@usesigil/kit 0.1.0

package/dist/seal.js

@@ -0,0 +1,569 @@
+/**
+ * seal() — Protocol-agnostic DeFi instruction sealing.
+ *
+ * Takes arbitrary DeFi instructions (from Jupiter API, SAK, GOAT, MCP servers)
+ * and sandwiches them with Sigil security:
+ * [ComputeBudget, ValidateAndAuthorize, ...defiIxs, FinalizeSession]
+ *
+ * All succeed or all revert atomically.
+ *
+ * Devnet prerequisites:
+ * - Sigil program deployed at SIGIL_PROGRAM_ADDRESS
+ * - SIGIL_ALT_DEVNET updated in alt-config.ts (currently placeholder)
+ * - PROTOCOL_TREASURY token accounts initialized for USDC/USDT on devnet
+ * - Vault funded with tokens and ATAs created
+ */
+import { AccountRole } from "@solana/kit";
+import { ActionType } from "./generated/types/actionType.js";
+import { VaultStatus } from "./generated/types/vaultStatus.js";
+import { getValidateAndAuthorizeInstructionAsync } from "./generated/instructions/validateAndAuthorize.js";
+import { getFinalizeSessionInstructionAsync } from "./generated/instructions/finalizeSession.js";
+import { resolveVaultState, resolveVaultStateForOwner, resolveVaultBudget, } from "./state-resolver.js";
+import { getSessionPDA, getAgentOverlayPDA } from "./resolve-accounts.js";
+import { composeSigilTransaction, measureTransactionSize, } from "./composer.js";
+import { BlockhashCache, signAndEncode, sendAndConfirmTransaction, } from "./rpc-helpers.js";
+import { AltCache, mergeAltAddresses, verifySigilAlt } from "./alt-loader.js";
+import { getSigilAltAddress, getExpectedAltContents } from "./alt-config.js";
+import { deriveAta } from "./x402/transfer-builder.js";
+import { isStablecoinMint, hasPermission, isSpendingAction, validateNetwork, normalizeNetwork, toInstruction, PROTOCOL_TREASURY, USDC_MINT_DEVNET, USDC_MINT_MAINNET, USDT_MINT_DEVNET, USDT_MINT_MAINNET, RECOGNIZED_DEFI_PROGRAMS, PROTOCOL_FEE_RATE, } from "./types.js";
+import { isProtocolAllowed } from "./protocol-resolver.js";
+import { toSigilAgentError } from "./agent-errors.js";
+import { getVaultPnL, getVaultTokenBalances, } from "./balance-tracker.js";
+import { parseTokenBalance } from "./simulation.js";
+import { createVault, } from "./create-vault.js";
+// ─── Well-known program addresses to strip ──────────────────────────────────
+const COMPUTE_BUDGET_PROGRAM = "ComputeBudget111111111111111111111111111111";
+const SYSTEM_PROGRAM = "11111111111111111111111111111111";
+const TOKEN_PROGRAM = "TokenkegQfeZyiNwAJbNbGKPFXCWuBvf9Ss623VQ5DA";
+const TOKEN_2022_PROGRAM = "TokenzQdBNbLqP5VEhdkAS6EPFLC1PHnBqCXEpPxuEb";
+// ─── Internal helpers ───────────────────────────────────────────────────────
+/** Replace agent ATAs with vault ATAs in DeFi instruction account lists. */
+export function replaceAgentAtas(instructions, replacements) {
+    if (replacements.size === 0)
+        return instructions;
+    return instructions.map((ix) => ({
+        ...ix,
+        accounts: ix.accounts?.map((acc) => {
+            const replacement = replacements.get(acc.address);
+            // Only replace WRITABLE accounts — read-only accounts (authorities, oracles)
+            // should keep their original address to avoid instruction malfunction.
+            // ATAs in DeFi instructions are always WRITABLE (they receive/send tokens).
+            if (replacement &&
+                (acc.role === AccountRole.WRITABLE ||
+                    acc.role === AccountRole.WRITABLE_SIGNER)) {
+                return { ...acc, address: replacement };
+            }
+            return acc;
+        }),
+    }));
+}
+const ACTION_TYPE_KEYS = {
+    [ActionType.Swap]: "swap",
+    [ActionType.OpenPosition]: "openPosition",
+    [ActionType.ClosePosition]: "closePosition",
+    [ActionType.IncreasePosition]: "increasePosition",
+    [ActionType.DecreasePosition]: "decreasePosition",
+    [ActionType.Deposit]: "deposit",
+    [ActionType.Withdraw]: "withdraw",
+    [ActionType.Transfer]: "transfer",
+    [ActionType.AddCollateral]: "addCollateral",
+    [ActionType.RemoveCollateral]: "removeCollateral",
+    [ActionType.PlaceTriggerOrder]: "placeTriggerOrder",
+    [ActionType.EditTriggerOrder]: "editTriggerOrder",
+    [ActionType.CancelTriggerOrder]: "cancelTriggerOrder",
+    [ActionType.PlaceLimitOrder]: "placeLimitOrder",
+    [ActionType.EditLimitOrder]: "editLimitOrder",
+    [ActionType.CancelLimitOrder]: "cancelLimitOrder",
+    [ActionType.SwapAndOpenPosition]: "swapAndOpenPosition",
+    [ActionType.CloseAndSwapPosition]: "closeAndSwapPosition",
+    [ActionType.CreateEscrow]: "createEscrow",
+    [ActionType.SettleEscrow]: "settleEscrow",
+    [ActionType.RefundEscrow]: "refundEscrow",
+};
+// ─── Shared caches (module-level singletons) ────────────────────────────────
+const blockhashCache = new BlockhashCache();
+const altCache = new AltCache();
+// ─── seal() ─────────────────────────────────────────────────────────────────
+/**
+ * Seal arbitrary DeFi instructions with Sigil security.
+ *
+ * Sandwiches the provided instructions between validate_and_authorize (before)
+ * and finalize_session (after) in an atomic Solana transaction.
+ *
+ * NOTE: Concurrent calls for the same vault+agent+tokenMint are NOT supported.
+ * The on-chain SessionAuthority PDA is deterministic — two concurrent seals
+ * produce colliding session PDAs and only one will succeed on-chain.
+ *
+ * @throws Error if vault is not active, agent lacks permission, protocol not allowed,
+ *   spending cap insufficient, or transaction exceeds 1232 byte limit.
+ */
+export async function seal(params) {
+    const warnings = [];
+    const net = normalizeNetwork(params.network);
+    validateNetwork(net);
+    // Step 1: Resolve vault state (with stale cache detection)
+    let state;
+    if (params.cachedState) {
+        const ageMs = (Date.now() / 1000 - Number(params.cachedState.resolvedAtTimestamp)) *
+            1000;
+        const maxAge = params.maxCacheAgeMs ?? 30_000;
+        if (ageMs > maxAge) {
+            state = await resolveVaultState(params.rpc, params.vault, params.agent.address, undefined, net);
+        }
+        else {
+            state = params.cachedState;
+        }
+    }
+    else {
+        state = await resolveVaultState(params.rpc, params.vault, params.agent.address, undefined, net);
+    }
+    // Verify vault is active
+    if (state.vault.status !== VaultStatus.Active) {
+        throw new Error(`Vault is not active (status: ${VaultStatus[state.vault.status] ?? state.vault.status})`);
+    }
+    // Step 2: Validate agent
+    const agentEntry = state.vault.agents.find((a) => a.pubkey === params.agent.address);
+    if (!agentEntry) {
+        throw new Error(`Agent ${params.agent.address} is not registered in vault ${params.vault}`);
+    }
+    if (agentEntry.paused) {
+        throw new Error(`Agent ${params.agent.address} is paused in vault ${params.vault}`);
+    }
+    // Step 3: Determine actionType + spending
+    const actionType = params.actionType ?? ActionType.Swap;
+    const actionKey = ACTION_TYPE_KEYS[actionType];
+    if (!actionKey) {
+        throw new Error(`Unknown ActionType: ${actionType}`);
+    }
+    // Escrow actions use standalone instructions, not the validate/finalize composition flow.
+    // On-chain validate_and_authorize rejects escrow actions with InvalidSession.
+    const ESCROW_ACTIONS = new Set([
+        ActionType.CreateEscrow,
+        ActionType.SettleEscrow,
+        ActionType.RefundEscrow,
+    ]);
+    if (ESCROW_ACTIONS.has(actionType)) {
+        throw new Error(`Escrow action "${actionKey}" uses standalone instructions, not seal(). ` +
+            `Use createEscrow/settleEscrow/refundEscrow directly.`);
+    }
+    const spending = isSpendingAction(actionKey);
+    if (params.amount < 0n) {
+        throw new Error(`Amount must be non-negative, got ${params.amount}. ` +
+            `Sigil amounts are unsigned 64-bit integers (0 to 18446744073709551615).`);
+    }
+    if (spending && params.amount === 0n) {
+        throw new Error(`Spending action "${actionKey}" requires amount > 0`);
+    }
+    if (!spending && params.amount !== undefined && params.amount !== 0n) {
+        throw new Error(`Non-spending action "${actionKey}" requires amount === 0 (on-chain enforces InvalidNonSpendingAmount)`);
+    }
+    // Step 4: Strip infrastructure instructions
+    const defiInstructions = params.instructions.filter((ix) => ix.programAddress !== COMPUTE_BUDGET_PROGRAM &&
+        ix.programAddress !== SYSTEM_PROGRAM);
+    // Step 4b: SPL Token blocking — mirrors on-chain scan_instruction_shared().
+    // Blocked: Approve(4), ApproveChecked(13), Transfer(3), TransferChecked(12),
+    // SetAuthority(6), CloseAccount(9), Burn(8), BurnChecked(15), Token-2022:26.
+    for (const ix of defiInstructions) {
+        if ((ix.programAddress === TOKEN_PROGRAM ||
+            ix.programAddress === TOKEN_2022_PROGRAM) &&
+            ix.data &&
+            ix.data.length > 0) {
+            const disc = ix.data[0];
+            if (disc === 4) {
+                throw new Error("Top-level SPL Token Approve not allowed in sealed transactions. " +
+                    "DeFi programs handle approvals via CPI.");
+            }
+            if (disc === 13) {
+                throw new Error("Top-level SPL Token ApproveChecked not allowed in sealed transactions. " +
+                    "DeFi programs handle approvals via CPI.");
+            }
+            if (disc === 3 ||
+                disc === 12 ||
+                (ix.programAddress === TOKEN_2022_PROGRAM && disc === 26)) {
+                throw new Error("Top-level SPL Token Transfer not allowed in sealed transactions. " +
+                    "Use the Transfer ActionType instead.");
+            }
+            if (disc === 6 || disc === 9) {
+                throw new Error("Top-level SPL Token SetAuthority/CloseAccount not allowed in sealed transactions. " +
+                    "These operations could damage or destroy vault token accounts.");
+            }
+            if (disc === 8 || disc === 15) {
+                throw new Error("Top-level SPL Token Burn/BurnChecked not allowed in sealed transactions. " +
+                    "Delegate burn authority could destroy vault funds.");
+            }
+        }
+    }
+    // Step 5: Determine targetProtocol
+    const targetProtocol = params.targetProtocol ?? defiInstructions[0]?.programAddress;
+    if (!targetProtocol) {
+        throw new Error("No target protocol: provide targetProtocol or include DeFi instructions");
+    }
+    // Step 6: Pre-flight checks
+    // 6a: Permission check (hard error)
+    if (!hasPermission(agentEntry.permissions, actionKey)) {
+        throw new Error(`Agent lacks permission for action "${actionKey}"`);
+    }
+    // 6b: Protocol allowlist (hard error)
+    if (!isProtocolAllowed(targetProtocol, state.policy)) {
+        throw new Error(`Protocol ${targetProtocol} is not allowed by vault policy`);
+    }
+    // 6b2: DeFi instruction count enforcement (mirrors on-chain v&a.rs:325-354)
+    if (spending) {
+        const defiCount = defiInstructions.filter((ix) => RECOGNIZED_DEFI_PROGRAMS.has(ix.programAddress)).length;
+        const isStablecoinInput = isStablecoinMint(params.tokenMint, net);
+        if (isStablecoinInput && defiCount > 1) {
+            throw new Error("At most 1 recognized DeFi instruction for stablecoin input " +
+                "(prevents round-trip fee avoidance).");
+        }
+        if (!isStablecoinInput && defiCount !== 1) {
+            throw new Error("Exactly 1 recognized DeFi instruction required for non-stablecoin input.");
+        }
+    }
+    // 6c: Cap headroom — fee-inclusive check (hard error)
+    // On-chain finalize_session measures actual_spend which includes fees deducted
+    // from the vault balance. SDK must account for fees to avoid submitting TXs
+    // that will definitely fail and waste priority fees.
+    if (spending && params.amount > 0n) {
+        const FEE_DENOM = 1000000n;
+        const ceilFee = (amount, rate) => (amount * rate + FEE_DENOM - 1n) / FEE_DENOM;
+        const protocolFee = ceilFee(params.amount, BigInt(PROTOCOL_FEE_RATE));
+        const devFee = ceilFee(params.amount, BigInt(state.policy.developerFeeRate));
+        const totalWithFees = params.amount + protocolFee + devFee;
+        const headroom = state.globalBudget.remaining;
+        if (totalWithFees > headroom) {
+            throw new Error(`Amount ${params.amount} + fees (protocol: ${protocolFee}, dev: ${devFee}) = ${totalWithFees} ` +
+                `exceeds remaining daily cap headroom ${headroom}. ` +
+                `Reduce amount or wait for rolling window to free capacity.`);
+        }
+    }
+    // 6d: Position limit check for increment actions (all 3 PositionEffect::Increment types)
+    if ((actionType === ActionType.OpenPosition ||
+        actionType === ActionType.SwapAndOpenPosition ||
+        actionType === ActionType.PlaceLimitOrder) &&
+        state.vault.openPositions >= state.policy.maxConcurrentPositions) {
+        throw new Error(`Position limit reached: ${state.vault.openPositions}/${state.policy.maxConcurrentPositions}`);
+    }
+    // Step 6e: Non-canonical output stablecoin ATA rejection
+    if (params.outputStablecoinAccount &&
+        spending &&
+        !isStablecoinMint(params.tokenMint, net)) {
+        const stableMint = net === "devnet" ? USDC_MINT_DEVNET : USDC_MINT_MAINNET;
+        const canonicalAta = await deriveAta(params.vault, stableMint);
+        if (params.outputStablecoinAccount !== canonicalAta) {
+            throw new Error(`Non-canonical output stablecoin ATA. Expected ${canonicalAta}, ` +
+                `got ${params.outputStablecoinAccount}. ` +
+                `Use the vault's canonical ATA for balance tracking consistency.`);
+        }
+    }
+    // Step 7: Derive token accounts (parallelized — all pure crypto, no RPC)
+    const needsOutputStablecoin = spending && !isStablecoinMint(params.tokenMint, net);
+    const defaultStableMint = net === "devnet" ? USDC_MINT_DEVNET : USDC_MINT_MAINNET;
+    const [vaultTokenAccount, outputStablecoinDerived, protocolTreasuryTokenAccount, feeDestinationTokenAccount, [agentOverlayPda], [sessionPda], agentTokenAta, agentStablecoinAta,] = await Promise.all([
+        deriveAta(params.vault, params.tokenMint),
+        needsOutputStablecoin && !params.outputStablecoinAccount
+            ? deriveAta(params.vault, defaultStableMint).then(async (ata) => {
+                // Fix 7: Verify output stablecoin ATA exists to prevent fee burn on missing account
+                try {
+                    const info = await params.rpc
+                        .getAccountInfo(ata, { encoding: "base64" })
+                        .send();
+                    if (!info || !info.value) {
+                        warnings.push(`Output stablecoin ATA ${ata} does not exist on-chain. ` +
+                            `Transaction will fail at validate_and_authorize. ` +
+                            `Create it first with createAssociatedTokenAccount.`);
+                    }
+                }
+                catch {
+                    // RPC error — proceed with derived address (on-chain will catch)
+                }
+                return ata;
+            })
+            : Promise.resolve(undefined),
+        spending
+            ? deriveAta(PROTOCOL_TREASURY, params.tokenMint)
+            : Promise.resolve(undefined),
+        spending && state.policy.developerFeeRate > 0
+            ? deriveAta(state.vault.feeDestination, params.tokenMint)
+            : Promise.resolve(undefined),
+        getAgentOverlayPDA(params.vault, 0),
+        getSessionPDA(params.vault, params.agent.address, params.tokenMint),
+        deriveAta(params.agent.address, params.tokenMint),
+        needsOutputStablecoin
+            ? deriveAta(params.agent.address, defaultStableMint)
+            : Promise.resolve(undefined),
+    ]);
+    const outputStablecoinAccount = params.outputStablecoinAccount ?? outputStablecoinDerived;
+    // Step 7b: Replace agent ATAs with vault ATAs in DeFi instructions
+    const ataReplacements = new Map();
+    ataReplacements.set(agentTokenAta, vaultTokenAccount);
+    if (agentStablecoinAta && outputStablecoinAccount) {
+        ataReplacements.set(agentStablecoinAta, outputStablecoinAccount);
+    }
+    // Merge additional ATA replacements for multi-token DeFi routes
+    if (params.additionalAtaReplacements) {
+        for (const [agentAta, vaultAta] of params.additionalAtaReplacements) {
+            if (ataReplacements.has(agentAta)) {
+                throw new Error(`additionalAtaReplacements key ${agentAta} conflicts with canonical ` +
+                    `ATA replacement. Cannot override vault token account mappings.`);
+            }
+            ataReplacements.set(agentAta, vaultAta);
+        }
+    }
+    const rewrittenDefiInstructions = replaceAgentAtas(defiInstructions, ataReplacements);
+    // Step 8: Build validate_and_authorize instruction
+    const validateIx = await getValidateAndAuthorizeInstructionAsync({
+        agent: params.agent,
+        vault: params.vault,
+        agentSpendOverlay: agentOverlayPda,
+        vaultTokenAccount,
+        tokenMintAccount: params.tokenMint,
+        protocolTreasuryTokenAccount,
+        feeDestinationTokenAccount,
+        outputStablecoinAccount,
+        actionType,
+        tokenMint: params.tokenMint,
+        amount: params.amount,
+        targetProtocol,
+        leverageBps: params.leverageBps ?? null,
+    });
+    const finalizeIx = await getFinalizeSessionInstructionAsync({
+        payer: params.agent,
+        vault: params.vault,
+        session: sessionPda,
+        sessionRentRecipient: params.agent.address,
+        agentSpendOverlay: agentOverlayPda,
+        vaultTokenAccount,
+        outputStablecoinAccount,
+    });
+    // Step 10: Compose + compile + measure
+    const blockhash = params.blockhash ?? (await blockhashCache.get(params.rpc));
+    // Resolve ALTs — Sigil ALT + protocol ALTs (e.g. Jupiter route-specific)
+    let addressLookupTables = params.addressLookupTables;
+    if (!addressLookupTables) {
+        const sigilAlt = getSigilAltAddress(net);
+        const allAlts = mergeAltAddresses(sigilAlt, params.protocolAltAddresses);
+        addressLookupTables = await altCache.resolve(params.rpc, allAlts);
+        // Verify Sigil ALT contents — if stale cache causes mismatch, evict and retry once.
+        // This self-heals after ALT extension without requiring manual cache invalidation.
+        try {
+            verifySigilAlt(addressLookupTables, sigilAlt, getExpectedAltContents(net));
+        }
+        catch (e) {
+            // Evict stale cache entry and re-resolve from RPC
+            altCache.invalidate();
+            addressLookupTables = await altCache.resolve(params.rpc, allAlts);
+            // Second attempt throws if still mismatched (real corruption, not staleness)
+            verifySigilAlt(addressLookupTables, sigilAlt, getExpectedAltContents(net));
+        }
+    }
+    const compiledTx = composeSigilTransaction({
+        feePayer: params.agent.address,
+        validateIx: toInstruction(validateIx),
+        defiInstructions: rewrittenDefiInstructions,
+        finalizeIx: toInstruction(finalizeIx),
+        blockhash,
+        computeUnits: params.computeUnits,
+        priorityFeeMicroLamports: params.priorityFeeMicroLamports,
+        addressLookupTables,
+    });
+    const { byteLength, withinLimit } = measureTransactionSize(compiledTx);
+    if (!withinLimit) {
+        const hasProtocolAlts = params.protocolAltAddresses && params.protocolAltAddresses.length > 0;
+        throw new Error(`Transaction size ${byteLength} bytes exceeds 1232 byte limit. ` +
+            (hasProtocolAlts
+                ? `Even with ${params.protocolAltAddresses.length} protocol ALT(s), the transaction is too large. Reduce instruction count.`
+                : `Pass protocolAltAddresses from your DeFi API response (e.g. Jupiter swap-instructions addressLookupTableAddresses).`));
+    }
+    // Build vaultContext for downstream drain detection
+    const usdcMintForNet = net === "devnet" ? USDC_MINT_DEVNET : USDC_MINT_MAINNET;
+    const usdtMintForNet = net === "devnet" ? USDT_MINT_DEVNET : USDT_MINT_MAINNET;
+    let tokenBalance;
+    if (params.tokenMint === usdcMintForNet) {
+        tokenBalance = state.stablecoinBalances.usdc;
+    }
+    else if (params.tokenMint === usdtMintForNet) {
+        tokenBalance = state.stablecoinBalances.usdt;
+    }
+    else {
+        // Non-stablecoin: fetch actual balance from vault's token ATA.
+        // Without this, drain detection is blind (totalVaultBalance=0 skips all checks).
+        // We DO NOT silently fall back to 0n — that disables drain detection entirely.
+        // If we can't verify the balance, we tell the caller explicitly.
+        try {
+            const info = await params.rpc
+                .getAccountInfo(vaultTokenAccount, { encoding: "base64" })
+                .send();
+            if (info?.value?.data?.[0]) {
+                tokenBalance = parseTokenBalance(info.value.data[0]);
+            }
+            else {
+                // Account doesn't exist → vault genuinely has 0 tokens of this mint.
+                // This is a legitimate state (vault created but not yet funded for this token).
+                tokenBalance = 0n;
+            }
+        }
+        catch {
+            // RPC failed — we cannot verify the vault balance.
+            // Rather than silently disabling drain detection by setting 0n,
+            // use a sentinel value that makes percentage checks MORE sensitive.
+            // u64::MAX means any outflow triggers LARGE_OUTFLOW + FULL_DRAIN.
+            tokenBalance = 18446744073709551615n; // u64::MAX — assume worst case
+            warnings.push("Failed to fetch non-stablecoin token balance via RPC. " +
+                "Drain detection assumes maximum balance (all outflows will be flagged). " +
+                "This is a conservative fallback — verify RPC connectivity.");
+        }
+    }
+    // Known recipients: ATA addresses that legitimately receive tokens during Sigil TXs.
+    // Drain detection compares against token account (ATA) addresses in balance deltas,
+    // so we must add ATAs here — NOT wallet addresses (which would never match).
+    const knownRecipients = new Set();
+    knownRecipients.add(vaultTokenAccount); // vault's own token ATA
+    if (protocolTreasuryTokenAccount) {
+        knownRecipients.add(protocolTreasuryTokenAccount);
+    }
+    if (feeDestinationTokenAccount) {
+        knownRecipients.add(feeDestinationTokenAccount);
+    }
+    return {
+        ok: true,
+        transaction: compiledTx,
+        actionType,
+        warnings,
+        txSizeBytes: byteLength,
+        lastValidBlockHeight: blockhash.lastValidBlockHeight,
+        vaultContext: {
+            vaultAddress: params.vault,
+            vaultTokenAta: vaultTokenAccount,
+            tokenBalance,
+            knownRecipients,
+        },
+    };
+}
+// ─── SigilClient ─────────────────────────────────────────────────────────
+/**
+ * Primary SDK entry point — stateful client that owns context and caches.
+ *
+ * Recommended over standalone seal() for production use:
+ * - Holds vault, agent, network, and RPC — no state carrying between calls
+ * - Blockhash and ALT caches are isolated per client instance
+ * - invalidateCaches() clears instance caches that are actually used
+ * - Convenience methods delegate to existing stateless functions
+ */
+export class SigilClient {
+    blockhashCacheInstance;
+    altCacheInstance;
+    onErrorCallback;
+    rpc;
+    vault;
+    agent;
+    network;
+    constructor(config) {
+        if (!config.rpc)
+            throw new Error("SigilClientConfig.rpc is required");
+        if (!config.vault)
+            throw new Error("SigilClientConfig.vault is required");
+        if (!config.agent)
+            throw new Error("SigilClientConfig.agent is required");
+        if (!config.network)
+            throw new Error("SigilClientConfig.network is required");
+        this.rpc = config.rpc;
+        this.vault = config.vault;
+        this.agent = config.agent;
+        this.network = config.network;
+        this.blockhashCacheInstance = new BlockhashCache(config.blockhashTtlMs);
+        this.altCacheInstance = new AltCache();
+        this.onErrorCallback = config.onError;
+    }
+    /**
+     * Seal DeFi instructions with Sigil security.
+     *
+     * Pre-resolves blockhash and ALTs from instance caches, then delegates
+     * to the standalone seal() function. This ensures invalidateCaches()
+     * actually clears caches that are read (N-2 fix).
+     */
+    async seal(instructions, opts) {
+        // Parallelize blockhash + ALT resolution (both independent RPC calls)
+        const altPromise = opts.addressLookupTables
+            ? Promise.resolve(opts.addressLookupTables)
+            : this.altCacheInstance.resolve(this.rpc, mergeAltAddresses(getSigilAltAddress(normalizeNetwork(this.network)), opts.protocolAltAddresses));
+        let [blockhash, addressLookupTables] = await Promise.all([
+            this.blockhashCacheInstance.get(this.rpc),
+            altPromise,
+        ]);
+        // Defense-in-depth: verify Sigil ALT contents even when pre-resolved.
+        // On-chain constraints are the real security boundary, but this catches
+        // stale ALT data or SDK-layer corruption before the transaction is sent.
+        // If stale cache causes mismatch, evict and retry once (self-healing).
+        if (!opts.addressLookupTables) {
+            const net = normalizeNetwork(this.network);
+            const sigilAlt = getSigilAltAddress(net);
+            const expected = getExpectedAltContents(net);
+            try {
+                verifySigilAlt(addressLookupTables, sigilAlt, expected);
+            }
+            catch {
+                this.altCacheInstance.invalidate();
+                const allAlts = mergeAltAddresses(sigilAlt, opts.protocolAltAddresses);
+                addressLookupTables = await this.altCacheInstance.resolve(this.rpc, allAlts);
+                verifySigilAlt(addressLookupTables, sigilAlt, expected);
+            }
+        }
+        return seal({
+            rpc: this.rpc,
+            vault: this.vault,
+            agent: this.agent,
+            network: this.network,
+            instructions,
+            ...opts,
+            blockhash,
+            addressLookupTables,
+        });
+    }
+    /**
+     * Seal + sign + send + confirm in one call.
+     *
+     * Uses the same signing pattern as TransactionExecutor.signSendConfirm()
+     * (transaction-executor.ts:236-265).
+     */
+    async executeAndConfirm(instructions, opts) {
+        try {
+            const result = await this.seal(instructions, opts);
+            const encoded = await signAndEncode(this.agent, result.transaction);
+            const signature = await sendAndConfirmTransaction(this.rpc, encoded, opts.confirmOptions);
+            return { signature, sealResult: result };
+        }
+        catch (err) {
+            const sdkError = toSigilAgentError(err);
+            this.onErrorCallback?.(sdkError, {
+                action: opts.actionType?.toString() ?? "unknown",
+                tokenMint: opts.tokenMint,
+                amount: opts.amount,
+            });
+            throw sdkError;
+        }
+    }
+    invalidateCaches() {
+        this.blockhashCacheInstance.invalidate();
+        this.altCacheInstance.invalidate();
+    }
+    // ─── Convenience methods (pure delegation) ─────────────────────────────
+    get networkFull() {
+        return this.network === "mainnet" ? "mainnet-beta" : "devnet";
+    }
+    async getVaultState() {
+        return resolveVaultStateForOwner(this.rpc, this.vault, undefined, this.networkFull);
+    }
+    async getAgentBudget() {
+        return resolveVaultBudget(this.rpc, this.vault, this.agent.address);
+    }
+    async getPnL() {
+        return getVaultPnL(this.rpc, this.vault, this.networkFull);
+    }
+    async getTokenBalances() {
+        return getVaultTokenBalances(this.rpc, this.vault, this.networkFull);
+    }
+    static async createVault(opts) {
+        return createVault(opts);
+    }
+}
+//# sourceMappingURL=seal.js.map

package/dist/seal.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"seal.js","sourceRoot":"","sources":["../src/seal.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;GAcG;AAUH,OAAO,EAAsB,WAAW,EAAE,MAAM,aAAa,CAAC;AAE9D,OAAO,EAAE,UAAU,EAAE,MAAM,iCAAiC,CAAC;AAC7D,OAAO,EAAE,WAAW,EAAE,MAAM,kCAAkC,CAAC;AAC/D,OAAO,EAAE,uCAAuC,EAAE,MAAM,kDAAkD,CAAC;AAC3G,OAAO,EAAE,kCAAkC,EAAE,MAAM,6CAA6C,CAAC;AAEjG,OAAO,EACL,iBAAiB,EACjB,yBAAyB,EACzB,kBAAkB,GAKnB,MAAM,qBAAqB,CAAC;AAC7B,OAAO,EAAE,aAAa,EAAE,kBAAkB,EAAE,MAAM,uBAAuB,CAAC;AAC1E,OAAO,EACL,uBAAuB,EACvB,sBAAsB,GACvB,MAAM,eAAe,CAAC;AACvB,OAAO,EACL,cAAc,EACd,aAAa,EACb,yBAAyB,GAG1B,MAAM,kBAAkB,CAAC;AAC1B,OAAO,EAAE,QAAQ,EAAE,iBAAiB,EAAE,cAAc,EAAE,MAAM,iBAAiB,CAAC;AAC9E,OAAO,EAAE,kBAAkB,EAAE,sBAAsB,EAAE,MAAM,iBAAiB,CAAC;AAC7E,OAAO,EAAE,SAAS,EAAE,MAAM,4BAA4B,CAAC;AACvD,OAAO,EAEL,gBAAgB,EAChB,aAAa,EACb,gBAAgB,EAChB,eAAe,EACf,gBAAgB,EAChB,aAAa,EACb,iBAAiB,EACjB,gBAAgB,EAChB,iBAAiB,EACjB,gBAAgB,EAChB,iBAAiB,EACjB,wBAAwB,EACxB,iBAAiB,GAClB,MAAM,YAAY,CAAC;AACpB,OAAO,EAAE,iBAAiB,EAAE,MAAM,wBAAwB,CAAC;AAC3D,OAAO,EAAE,iBAAiB,EAAmB,MAAM,mBAAmB,CAAC;AACvE,OAAO,EACL,WAAW,EACX,qBAAqB,GAGtB,MAAM,sBAAsB,CAAC;AAC9B,OAAO,EAAE,iBAAiB,EAAE,MAAM,iBAAiB,CAAC;AACpD,OAAO,EACL,WAAW,GAGZ,MAAM,mBAAmB,CAAC;AAE3B,+EAA+E;AAE/E,MAAM,sBAAsB,GAC1B,6CAAwD,CAAC;AAC3D,MAAM,cAAc,GAAG,kCAA6C,CAAC;AACrE,MAAM,aAAa,GAAG,6CAAwD,CAAC;AAC/E,MAAM,kBAAkB,GACtB,6CAAwD,CAAC;AA+F3D,+EAA+E;AAE/E,4EAA4E;AAC5E,MAAM,UAAU,gBAAgB,CAC9B,YAA2B,EAC3B,YAAmC;IAEnC,IAAI,YAAY,CAAC,IAAI,KAAK,CAAC;QAAE,OAAO,YAAY,CAAC;IACjD,OAAO,YAAY,CAAC,GAAG,CAAC,CAAC,EAAE,EAAE,EAAE,CAAC,CAAC;QAC/B,GAAG,EAAE;QACL,QAAQ,EAAE,EAAE,CAAC,QAAQ,EAAE,GAAG,CAAC,CAAC,GAAG,EAAE,EAAE;YACjC,MAAM,WAAW,GAAG,YAAY,CAAC,GAAG,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC;YAClD,6EAA6E;YAC7E,uEAAuE;YACvE,4EAA4E;YAC5E,IACE,WAAW;gBACX,CAAC,GAAG,CAAC,IAAI,KAAK,WAAW,CAAC,QAAQ;oBAChC,GAAG,CAAC,IAAI,KAAK,WAAW,CAAC,eAAe,CAAC,EAC3C,CAAC;gBACD,OAAO,EAAE,GAAG,GAAG,EAAE,OAAO,EAAE,WAAW,EAAE,CAAC;YAC1C,CAAC;YACD,OAAO,GAAG,CAAC;QACb,CAAC,CAAC;KACH,CAAC,CAAC,CAAC;AACN,CAAC;AAED,MAAM,gBAAgB,GAA2B;IAC/C,CAAC,UAAU,CAAC,IAAI,CAAC,EAAE,MAAM;IACzB,CAAC,UAAU,CAAC,YAAY,CAAC,EAAE,cAAc;IACzC,CAAC,UAAU,CAAC,aAAa,CAAC,EAAE,eAAe;IAC3C,CAAC,UAAU,CAAC,gBAAgB,CAAC,EAAE,kBAAkB;IACjD,CAAC,UAAU,CAAC,gBAAgB,CAAC,EAAE,kBAAkB;IACjD,CAAC,UAAU,CAAC,OAAO,CAAC,EAAE,SAAS;IAC/B,CAAC,UAAU,CAAC,QAAQ,CAAC,EAAE,UAAU;IACjC,CAAC,UAAU,CAAC,QAAQ,CAAC,EAAE,UAAU;IACjC,CAAC,UAAU,CAAC,aAAa,CAAC,EAAE,eAAe;IAC3C,CAAC,UAAU,CAAC,gBAAgB,CAAC,EAAE,kBAAkB;IACjD,CAAC,UAAU,CAAC,iBAAiB,CAAC,EAAE,mBAAmB;IACnD,CAAC,UAAU,CAAC,gBAAgB,CAAC,EAAE,kBAAkB;IACjD,CAAC,UAAU,CAAC,kBAAkB,CAAC,EAAE,oBAAoB;IACrD,CAAC,UAAU,CAAC,eAAe,CAAC,EAAE,iBAAiB;IAC/C,CAAC,UAAU,CAAC,cAAc,CAAC,EAAE,gBAAgB;IAC7C,CAAC,UAAU,CAAC,gBAAgB,CAAC,EAAE,kBAAkB;IACjD,CAAC,UAAU,CAAC,mBAAmB,CAAC,EAAE,qBAAqB;IACvD,CAAC,UAAU,CAAC,oBAAoB,CAAC,EAAE,sBAAsB;IACzD,CAAC,UAAU,CAAC,YAAY,CAAC,EAAE,cAAc;IACzC,CAAC,UAAU,CAAC,YAAY,CAAC,EAAE,cAAc;IACzC,CAAC,UAAU,CAAC,YAAY,CAAC,EAAE,cAAc;CAC1C,CAAC;AAEF,+EAA+E;AAE/E,MAAM,cAAc,GAAG,IAAI,cAAc,EAAE,CAAC;AAC5C,MAAM,QAAQ,GAAG,IAAI,QAAQ,EAAE,CAAC;AAEhC,+EAA+E;AAE/E;;;;;;;;;;;;GAYG;AACH,MAAM,CAAC,KAAK,UAAU,IAAI,CAAC,MAAkB;IAC3C,MAAM,QAAQ,GAAa,EAAE,CAAC;IAC9B,MAAM,GAAG,GAAG,gBAAgB,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC;IAC7C,eAAe,CAAC,GAAG,CAAC,CAAC;IAErB,2DAA2D;IAC3D,IAAI,KAAyB,CAAC;IAC9B,IAAI,MAAM,CAAC,WAAW,EAAE,CAAC;QACvB,MAAM,KAAK,GACT,CAAC,IAAI,CAAC,GAAG,EAAE,GAAG,IAAI,GAAG,MAAM,CAAC,MAAM,CAAC,WAAW,CAAC,mBAAmB,CAAC,CAAC;YACpE,IAAI,CAAC;QACP,MAAM,MAAM,GAAG,MAAM,CAAC,aAAa,IAAI,MAAM,CAAC;QAC9C,IAAI,KAAK,GAAG,MAAM,EAAE,CAAC;YACnB,KAAK,GAAG,MAAM,iBAAiB,CAC7B,MAAM,CAAC,GAAG,EACV,MAAM,CAAC,KAAK,EACZ,MAAM,CAAC,KAAK,CAAC,OAAO,EACpB,SAAS,EACT,GAAG,CACJ,CAAC;QACJ,CAAC;aAAM,CAAC;YACN,KAAK,GAAG,MAAM,CAAC,WAAW,CAAC;QAC7B,CAAC;IACH,CAAC;SAAM,CAAC;QACN,KAAK,GAAG,MAAM,iBAAiB,CAC7B,MAAM,CAAC,GAAG,EACV,MAAM,CAAC,KAAK,EACZ,MAAM,CAAC,KAAK,CAAC,OAAO,EACpB,SAAS,EACT,GAAG,CACJ,CAAC;IACJ,CAAC;IAED,yBAAyB;IACzB,IAAI,KAAK,CAAC,KAAK,CAAC,MAAM,KAAK,WAAW,CAAC,MAAM,EAAE,CAAC;QAC9C,MAAM,IAAI,KAAK,CACb,gCAAgC,WAAW,CAAC,KAAK,CAAC,KAAK,CAAC,MAAM,CAAC,IAAI,KAAK,CAAC,KAAK,CAAC,MAAM,GAAG,CACzF,CAAC;IACJ,CAAC;IAED,yBAAyB;IACzB,MAAM,UAAU,GAAG,KAAK,CAAC,KAAK,CAAC,MAAM,CAAC,IAAI,CACxC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,MAAM,KAAK,MAAM,CAAC,KAAK,CAAC,OAAO,CACzC,CAAC;IACF,IAAI,CAAC,UAAU,EAAE,CAAC;QAChB,MAAM,IAAI,KAAK,CACb,SAAS,MAAM,CAAC,KAAK,CAAC,OAAO,+BAA+B,MAAM,CAAC,KAAK,EAAE,CAC3E,CAAC;IACJ,CAAC;IACD,IAAI,UAAU,CAAC,MAAM,EAAE,CAAC;QACtB,MAAM,IAAI,KAAK,CACb,SAAS,MAAM,CAAC,KAAK,CAAC,OAAO,uBAAuB,MAAM,CAAC,KAAK,EAAE,CACnE,CAAC;IACJ,CAAC;IAED,0CAA0C;IAC1C,MAAM,UAAU,GAAG,MAAM,CAAC,UAAU,IAAI,UAAU,CAAC,IAAI,CAAC;IACxD,MAAM,SAAS,GAAG,gBAAgB,CAAC,UAAU,CAAC,CAAC;IAC/C,IAAI,CAAC,SAAS,EAAE,CAAC;QACf,MAAM,IAAI,KAAK,CAAC,uBAAuB,UAAU,EAAE,CAAC,CAAC;IACvD,CAAC;IAED,0FAA0F;IAC1F,8EAA8E;IAC9E,MAAM,cAAc,GAAG,IAAI,GAAG,CAAC;QAC7B,UAAU,CAAC,YAAY;QACvB,UAAU,CAAC,YAAY;QACvB,UAAU,CAAC,YAAY;KACxB,CAAC,CAAC;IACH,IAAI,cAAc,CAAC,GAAG,CAAC,UAAU,CAAC,EAAE,CAAC;QACnC,MAAM,IAAI,KAAK,CACb,kBAAkB,SAAS,8CAA8C;YACvE,sDAAsD,CACzD,CAAC;IACJ,CAAC;IAED,MAAM,QAAQ,GAAG,gBAAgB,CAAC,SAAS,CAAC,CAAC;IAC7C,IAAI,MAAM,CAAC,MAAM,GAAG,EAAE,EAAE,CAAC;QACvB,MAAM,IAAI,KAAK,CACb,oCAAoC,MAAM,CAAC,MAAM,IAAI;YACnD,yEAAyE,CAC5E,CAAC;IACJ,CAAC;IACD,IAAI,QAAQ,IAAI,MAAM,CAAC,MAAM,KAAK,EAAE,EAAE,CAAC;QACrC,MAAM,IAAI,KAAK,CAAC,oBAAoB,SAAS,uBAAuB,CAAC,CAAC;IACxE,CAAC;IACD,IAAI,CAAC,QAAQ,IAAI,MAAM,CAAC,MAAM,KAAK,SAAS,IAAI,MAAM,CAAC,MAAM,KAAK,EAAE,EAAE,CAAC;QACrE,MAAM,IAAI,KAAK,CACb,wBAAwB,SAAS,sEAAsE,CACxG,CAAC;IACJ,CAAC;IAED,4CAA4C;IAC5C,MAAM,gBAAgB,GAAG,MAAM,CAAC,YAAY,CAAC,MAAM,CACjD,CAAC,EAAE,EAAE,EAAE,CACL,EAAE,CAAC,cAAc,KAAK,sBAAsB;QAC5C,EAAE,CAAC,cAAc,KAAK,cAAc,CACvC,CAAC;IAEF,4EAA4E;IAC5E,6EAA6E;IAC7E,6EAA6E;IAC7E,KAAK,MAAM,EAAE,IAAI,gBAAgB,EAAE,CAAC;QAClC,IACE,CAAC,EAAE,CAAC,cAAc,KAAK,aAAa;YAClC,EAAE,CAAC,cAAc,KAAK,kBAAkB,CAAC;YAC3C,EAAE,CAAC,IAAI;YACP,EAAE,CAAC,IAAI,CAAC,MAAM,GAAG,CAAC,EAClB,CAAC;YACD,MAAM,IAAI,GAAG,EAAE,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;YACxB,IAAI,IAAI,KAAK,CAAC,EAAE,CAAC;gBACf,MAAM,IAAI,KAAK,CACb,kEAAkE;oBAChE,yCAAyC,CAC5C,CAAC;YACJ,CAAC;YACD,IAAI,IAAI,KAAK,EAAE,EAAE,CAAC;gBAChB,MAAM,IAAI,KAAK,CACb,yEAAyE;oBACvE,yCAAyC,CAC5C,CAAC;YACJ,CAAC;YACD,IACE,IAAI,KAAK,CAAC;gBACV,IAAI,KAAK,EAAE;gBACX,CAAC,EAAE,CAAC,cAAc,KAAK,kBAAkB,IAAI,IAAI,KAAK,EAAE,CAAC,EACzD,CAAC;gBACD,MAAM,IAAI,KAAK,CACb,mEAAmE;oBACjE,sCAAsC,CACzC,CAAC;YACJ,CAAC;YACD,IAAI,IAAI,KAAK,CAAC,IAAI,IAAI,KAAK,CAAC,EAAE,CAAC;gBAC7B,MAAM,IAAI,KAAK,CACb,oFAAoF;oBAClF,gEAAgE,CACnE,CAAC;YACJ,CAAC;YACD,IAAI,IAAI,KAAK,CAAC,IAAI,IAAI,KAAK,EAAE,EAAE,CAAC;gBAC9B,MAAM,IAAI,KAAK,CACb,2EAA2E;oBACzE,oDAAoD,CACvD,CAAC;YACJ,CAAC;QACH,CAAC;IACH,CAAC;IAED,mCAAmC;IACnC,MAAM,cAAc,GAClB,MAAM,CAAC,cAAc,IAAI,gBAAgB,CAAC,CAAC,CAAC,EAAE,cAAc,CAAC;IAC/D,IAAI,CAAC,cAAc,EAAE,CAAC;QACpB,MAAM,IAAI,KAAK,CACb,yEAAyE,CAC1E,CAAC;IACJ,CAAC;IAED,4BAA4B;IAC5B,oCAAoC;IACpC,IAAI,CAAC,aAAa,CAAC,UAAU,CAAC,WAAW,EAAE,SAAS,CAAC,EAAE,CAAC;QACtD,MAAM,IAAI,KAAK,CAAC,sCAAsC,SAAS,GAAG,CAAC,CAAC;IACtE,CAAC;IAED,sCAAsC;IACtC,IAAI,CAAC,iBAAiB,CAAC,cAAc,EAAE,KAAK,CAAC,MAAM,CAAC,EAAE,CAAC;QACrD,MAAM,IAAI,KAAK,CACb,YAAY,cAAc,iCAAiC,CAC5D,CAAC;IACJ,CAAC;IAED,4EAA4E;IAC5E,IAAI,QAAQ,EAAE,CAAC;QACb,MAAM,SAAS,GAAG,gBAAgB,CAAC,MAAM,CAAC,CAAC,EAAE,EAAE,EAAE,CAC/C,wBAAwB,CAAC,GAAG,CAAC,EAAE,CAAC,cAAwB,CAAC,CAC1D,CAAC,MAAM,CAAC;QACT,MAAM,iBAAiB,GAAG,gBAAgB,CAAC,MAAM,CAAC,SAAS,EAAE,GAAG,CAAC,CAAC;QAClE,IAAI,iBAAiB,IAAI,SAAS,GAAG,CAAC,EAAE,CAAC;YACvC,MAAM,IAAI,KAAK,CACb,6DAA6D;gBAC3D,sCAAsC,CACzC,CAAC;QACJ,CAAC;QACD,IAAI,CAAC,iBAAiB,IAAI,SAAS,KAAK,CAAC,EAAE,CAAC;YAC1C,MAAM,IAAI,KAAK,CACb,0EAA0E,CAC3E,CAAC;QACJ,CAAC;IACH,CAAC;IAED,sDAAsD;IACtD,+EAA+E;IAC/E,4EAA4E;IAC5E,qDAAqD;IACrD,IAAI,QAAQ,IAAI,MAAM,CAAC,MAAM,GAAG,EAAE,EAAE,CAAC;QACnC,MAAM,SAAS,GAAG,QAAU,CAAC;QAC7B,MAAM,OAAO,GAAG,CAAC,MAAc,EAAE,IAAY,EAAU,EAAE,CACvD,CAAC,MAAM,GAAG,IAAI,GAAG,SAAS,GAAG,EAAE,CAAC,GAAG,SAAS,CAAC;QAC/C,MAAM,WAAW,GAAG,OAAO,CAAC,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,iBAAiB,CAAC,CAAC,CAAC;QACtE,MAAM,MAAM,GAAG,OAAO,CACpB,MAAM,CAAC,MAAM,EACb,MAAM,CAAC,KAAK,CAAC,MAAM,CAAC,gBAAgB,CAAC,CACtC,CAAC;QACF,MAAM,aAAa,GAAG,MAAM,CAAC,MAAM,GAAG,WAAW,GAAG,MAAM,CAAC;QAC3D,MAAM,QAAQ,GAAG,KAAK,CAAC,YAAY,CAAC,SAAS,CAAC;QAC9C,IAAI,aAAa,GAAG,QAAQ,EAAE,CAAC;YAC7B,MAAM,IAAI,KAAK,CACb,UAAU,MAAM,CAAC,MAAM,sBAAsB,WAAW,UAAU,MAAM,OAAO,aAAa,GAAG;gBAC7F,wCAAwC,QAAQ,IAAI;gBACpD,4DAA4D,CAC/D,CAAC;QACJ,CAAC;IACH,CAAC;IAED,yFAAyF;IACzF,IACE,CAAC,UAAU,KAAK,UAAU,CAAC,YAAY;QACrC,UAAU,KAAK,UAAU,CAAC,mBAAmB;QAC7C,UAAU,KAAK,UAAU,CAAC,eAAe,CAAC;QAC5C,KAAK,CAAC,KAAK,CAAC,aAAa,IAAI,KAAK,CAAC,MAAM,CAAC,sBAAsB,EAChE,CAAC;QACD,MAAM,IAAI,KAAK,CACb,2BAA2B,KAAK,CAAC,KAAK,CAAC,aAAa,IAAI,KAAK,CAAC,MAAM,CAAC,sBAAsB,EAAE,CAC9F,CAAC;IACJ,CAAC;IAED,yDAAyD;IACzD,IACE,MAAM,CAAC,uBAAuB;QAC9B,QAAQ;QACR,CAAC,gBAAgB,CAAC,MAAM,CAAC,SAAS,EAAE,GAAG,CAAC,EACxC,CAAC;QACD,MAAM,UAAU,GAAG,GAAG,KAAK,QAAQ,CAAC,CAAC,CAAC,gBAAgB,CAAC,CAAC,CAAC,iBAAiB,CAAC;QAC3E,MAAM,YAAY,GAAG,MAAM,SAAS,CAAC,MAAM,CAAC,KAAK,EAAE,UAAU,CAAC,CAAC;QAC/D,IAAI,MAAM,CAAC,uBAAuB,KAAK,YAAY,EAAE,CAAC;YACpD,MAAM,IAAI,KAAK,CACb,iDAAiD,YAAY,IAAI;gBAC/D,OAAO,MAAM,CAAC,uBAAuB,IAAI;gBACzC,iEAAiE,CACpE,CAAC;QACJ,CAAC;IACH,CAAC;IAED,yEAAyE;IACzE,MAAM,qBAAqB,GACzB,QAAQ,IAAI,CAAC,gBAAgB,CAAC,MAAM,CAAC,SAAS,EAAE,GAAG,CAAC,CAAC;IACvD,MAAM,iBAAiB,GACrB,GAAG,KAAK,QAAQ,CAAC,CAAC,CAAC,gBAAgB,CAAC,CAAC,CAAC,iBAAiB,CAAC;IAE1D,MAAM,CACJ,iBAAiB,EACjB,uBAAuB,EACvB,4BAA4B,EAC5B,0BAA0B,EAC1B,CAAC,eAAe,CAAC,EACjB,CAAC,UAAU,CAAC,EACZ,aAAa,EACb,kBAAkB,EACnB,GAAG,MAAM,OAAO,CAAC,GAAG,CAAC;QACpB,SAAS,CAAC,MAAM,CAAC,KAAK,EAAE,MAAM,CAAC,SAAS,CAAC;QACzC,qBAAqB,IAAI,CAAC,MAAM,CAAC,uBAAuB;YACtD,CAAC,CAAC,SAAS,CAAC,MAAM,CAAC,KAAK,EAAE,iBAAiB,CAAC,CAAC,IAAI,CAAC,KAAK,EAAE,GAAG,EAAE,EAAE;gBAC5D,oFAAoF;gBACpF,IAAI,CAAC;oBACH,MAAM,IAAI,GAAG,MAAM,MAAM,CAAC,GAAG;yBAC1B,cAAc,CAAC,GAAG,EAAE,EAAE,QAAQ,EAAE,QAAQ,EAAE,CAAC;yBAC3C,IAAI,EAAE,CAAC;oBACV,IAAI,CAAC,IAAI,IAAI,CAAC,IAAI,CAAC,KAAK,EAAE,CAAC;wBACzB,QAAQ,CAAC,IAAI,CACX,yBAAyB,GAAG,4BAA4B;4BACtD,mDAAmD;4BACnD,oDAAoD,CACvD,CAAC;oBACJ,CAAC;gBACH,CAAC;gBAAC,MAAM,CAAC;oBACP,iEAAiE;gBACnE,CAAC;gBACD,OAAO,GAAG,CAAC;YACb,CAAC,CAAC;YACJ,CAAC,CAAC,OAAO,CAAC,OAAO,CAAC,SAAS,CAAC;QAC9B,QAAQ;YACN,CAAC,CAAC,SAAS,CAAC,iBAAiB,EAAE,MAAM,CAAC,SAAS,CAAC;YAChD,CAAC,CAAC,OAAO,CAAC,OAAO,CAAC,SAAS,CAAC;QAC9B,QAAQ,IAAI,KAAK,CAAC,MAAM,CAAC,gBAAgB,GAAG,CAAC;YAC3C,CAAC,CAAC,SAAS,CAAC,KAAK,CAAC,KAAK,CAAC,cAAc,EAAE,MAAM,CAAC,SAAS,CAAC;YACzD,CAAC,CAAC,OAAO,CAAC,OAAO,CAAC,SAAS,CAAC;QAC9B,kBAAkB,CAAC,MAAM,CAAC,KAAK,EAAE,CAAC,CAAC;QACnC,aAAa,CAAC,MAAM,CAAC,KAAK,EAAE,MAAM,CAAC,KAAK,CAAC,OAAO,EAAE,MAAM,CAAC,SAAS,CAAC;QACnE,SAAS,CAAC,MAAM,CAAC,KAAK,CAAC,OAAO,EAAE,MAAM,CAAC,SAAS,CAAC;QACjD,qBAAqB;YACnB,CAAC,CAAC,SAAS,CAAC,MAAM,CAAC,KAAK,CAAC,OAAO,EAAE,iBAAiB,CAAC;YACpD,CAAC,CAAC,OAAO,CAAC,OAAO,CAAC,SAAS,CAAC;KAC/B,CAAC,CAAC;IAEH,MAAM,uBAAuB,GAC3B,MAAM,CAAC,uBAAuB,IAAI,uBAAuB,CAAC;IAE5D,mEAAmE;IACnE,MAAM,eAAe,GAAG,IAAI,GAAG,EAAoB,CAAC;IACpD,eAAe,CAAC,GAAG,CAAC,aAAa,EAAE,iBAAiB,CAAC,CAAC;IACtD,IAAI,kBAAkB,IAAI,uBAAuB,EAAE,CAAC;QAClD,eAAe,CAAC,GAAG,CAAC,kBAAkB,EAAE,uBAAuB,CAAC,CAAC;IACnE,CAAC;IACD,gEAAgE;IAChE,IAAI,MAAM,CAAC,yBAAyB,EAAE,CAAC;QACrC,KAAK,MAAM,CAAC,QAAQ,EAAE,QAAQ,CAAC,IAAI,MAAM,CAAC,yBAAyB,EAAE,CAAC;YACpE,IAAI,eAAe,CAAC,GAAG,CAAC,QAAQ,CAAC,EAAE,CAAC;gBAClC,MAAM,IAAI,KAAK,CACb,iCAAiC,QAAQ,4BAA4B;oBACnE,gEAAgE,CACnE,CAAC;YACJ,CAAC;YACD,eAAe,CAAC,GAAG,CAAC,QAAQ,EAAE,QAAQ,CAAC,CAAC;QAC1C,CAAC;IACH,CAAC;IACD,MAAM,yBAAyB,GAAG,gBAAgB,CAChD,gBAAgB,EAChB,eAAe,CAChB,CAAC;IAEF,mDAAmD;IACnD,MAAM,UAAU,GAAG,MAAM,uCAAuC,CAAC;QAC/D,KAAK,EAAE,MAAM,CAAC,KAAK;QACnB,KAAK,EAAE,MAAM,CAAC,KAAK;QACnB,iBAAiB,EAAE,eAAe;QAClC,iBAAiB;QACjB,gBAAgB,EAAE,MAAM,CAAC,SAAS;QAClC,4BAA4B;QAC5B,0BAA0B;QAC1B,uBAAuB;QACvB,UAAU;QACV,SAAS,EAAE,MAAM,CAAC,SAAS;QAC3B,MAAM,EAAE,MAAM,CAAC,MAAM;QACrB,cAAc;QACd,WAAW,EAAE,MAAM,CAAC,WAAW,IAAI,IAAI;KACxC,CAAC,CAAC;IAEH,MAAM,UAAU,GAAG,MAAM,kCAAkC,CAAC;QAC1D,KAAK,EAAE,MAAM,CAAC,KAAK;QACnB,KAAK,EAAE,MAAM,CAAC,KAAK;QACnB,OAAO,EAAE,UAAU;QACnB,oBAAoB,EAAE,MAAM,CAAC,KAAK,CAAC,OAAO;QAC1C,iBAAiB,EAAE,eAAe;QAClC,iBAAiB;QACjB,uBAAuB;KACxB,CAAC,CAAC;IAEH,uCAAuC;IACvC,MAAM,SAAS,GAAG,MAAM,CAAC,SAAS,IAAI,CAAC,MAAM,cAAc,CAAC,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,CAAC;IAE7E,yEAAyE;IACzE,IAAI,mBAAmB,GAAG,MAAM,CAAC,mBAAmB,CAAC;IACrD,IAAI,CAAC,mBAAmB,EAAE,CAAC;QACzB,MAAM,QAAQ,GAAG,kBAAkB,CAAC,GAAG,CAAC,CAAC;QACzC,MAAM,OAAO,GAAG,iBAAiB,CAAC,QAAQ,EAAE,MAAM,CAAC,oBAAoB,CAAC,CAAC;QACzE,mBAAmB,GAAG,MAAM,QAAQ,CAAC,OAAO,CAAC,MAAM,CAAC,GAAG,EAAE,OAAO,CAAC,CAAC;QAElE,oFAAoF;QACpF,mFAAmF;QACnF,IAAI,CAAC;YACH,cAAc,CACZ,mBAAmB,EACnB,QAAQ,EACR,sBAAsB,CAAC,GAAG,CAAC,CAC5B,CAAC;QACJ,CAAC;QAAC,OAAO,CAAC,EAAE,CAAC;YACX,kDAAkD;YAClD,QAAQ,CAAC,UAAU,EAAE,CAAC;YACtB,mBAAmB,GAAG,MAAM,QAAQ,CAAC,OAAO,CAAC,MAAM,CAAC,GAAG,EAAE,OAAO,CAAC,CAAC;YAClE,6EAA6E;YAC7E,cAAc,CACZ,mBAAmB,EACnB,QAAQ,EACR,sBAAsB,CAAC,GAAG,CAAC,CAC5B,CAAC;QACJ,CAAC;IACH,CAAC;IAED,MAAM,UAAU,GAAG,uBAAuB,CAAC;QACzC,QAAQ,EAAE,MAAM,CAAC,KAAK,CAAC,OAAO;QAC9B,UAAU,EAAE,aAAa,CAAC,UAAU,CAAC;QACrC,gBAAgB,EAAE,yBAAyB;QAC3C,UAAU,EAAE,aAAa,CAAC,UAAU,CAAC;QACrC,SAAS;QACT,YAAY,EAAE,MAAM,CAAC,YAAY;QACjC,wBAAwB,EAAE,MAAM,CAAC,wBAAwB;QACzD,mBAAmB;KACpB,CAAC,CAAC;IAEH,MAAM,EAAE,UAAU,EAAE,WAAW,EAAE,GAAG,sBAAsB,CAAC,UAAU,CAAC,CAAC;IACvE,IAAI,CAAC,WAAW,EAAE,CAAC;QACjB,MAAM,eAAe,GACnB,MAAM,CAAC,oBAAoB,IAAI,MAAM,CAAC,oBAAoB,CAAC,MAAM,GAAG,CAAC,CAAC;QACxE,MAAM,IAAI,KAAK,CACb,oBAAoB,UAAU,kCAAkC;YAC9D,CAAC,eAAe;gBACd,CAAC,CAAC,aAAa,MAAM,CAAC,oBAAqB,CAAC,MAAM,2EAA2E;gBAC7H,CAAC,CAAC,qHAAqH,CAAC,CAC7H,CAAC;IACJ,CAAC;IAED,oDAAoD;IACpD,MAAM,cAAc,GAClB,GAAG,KAAK,QAAQ,CAAC,CAAC,CAAC,gBAAgB,CAAC,CAAC,CAAC,iBAAiB,CAAC;IAC1D,MAAM,cAAc,GAClB,GAAG,KAAK,QAAQ,CAAC,CAAC,CAAC,gBAAgB,CAAC,CAAC,CAAC,iBAAiB,CAAC;IAC1D,IAAI,YAAoB,CAAC;IACzB,IAAI,MAAM,CAAC,SAAS,KAAK,cAAc,EAAE,CAAC;QACxC,YAAY,GAAG,KAAK,CAAC,kBAAkB,CAAC,IAAI,CAAC;IAC/C,CAAC;SAAM,IAAI,MAAM,CAAC,SAAS,KAAK,cAAc,EAAE,CAAC;QAC/C,YAAY,GAAG,KAAK,CAAC,kBAAkB,CAAC,IAAI,CAAC;IAC/C,CAAC;SAAM,CAAC;QACN,+DAA+D;QAC/D,iFAAiF;QACjF,+EAA+E;QAC/E,iEAAiE;QACjE,IAAI,CAAC;YACH,MAAM,IAAI,GAAG,MAAM,MAAM,CAAC,GAAG;iBAC1B,cAAc,CAAC,iBAAiB,EAAE,EAAE,QAAQ,EAAE,QAAQ,EAAE,CAAC;iBACzD,IAAI,EAAE,CAAC;YACV,IAAI,IAAI,EAAE,KAAK,EAAE,IAAI,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;gBAC3B,YAAY,GAAG,iBAAiB,CAAC,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,CAAC;YACvD,CAAC;iBAAM,CAAC;gBACN,qEAAqE;gBACrE,gFAAgF;gBAChF,YAAY,GAAG,EAAE,CAAC;YACpB,CAAC;QACH,CAAC;QAAC,MAAM,CAAC;YACP,mDAAmD;YACnD,gEAAgE;YAChE,oEAAoE;YACpE,kEAAkE;YAClE,YAAY,GAAG,qBAAqB,CAAC,CAAC,+BAA+B;YACrE,QAAQ,CAAC,IAAI,CACX,wDAAwD;gBACtD,0EAA0E;gBAC1E,4DAA4D,CAC/D,CAAC;QACJ,CAAC;IACH,CAAC;IAED,qFAAqF;IACrF,oFAAoF;IACpF,6EAA6E;IAC7E,MAAM,eAAe,GAAG,IAAI,GAAG,EAAU,CAAC;IAC1C,eAAe,CAAC,GAAG,CAAC,iBAAiB,CAAC,CAAC,CAAC,wBAAwB;IAChE,IAAI,4BAA4B,EAAE,CAAC;QACjC,eAAe,CAAC,GAAG,CAAC,4BAA4B,CAAC,CAAC;IACpD,CAAC;IACD,IAAI,0BAA0B,EAAE,CAAC;QAC/B,eAAe,CAAC,GAAG,CAAC,0BAA0B,CAAC,CAAC;IAClD,CAAC;IAED,OAAO;QACL,EAAE,EAAE,IAAI;QACR,WAAW,EAAE,UAAU;QACvB,UAAU;QACV,QAAQ;QACR,WAAW,EAAE,UAAU;QACvB,oBAAoB,EAAE,SAAS,CAAC,oBAAoB;QACpD,YAAY,EAAE;YACZ,YAAY,EAAE,MAAM,CAAC,KAAK;YAC1B,aAAa,EAAE,iBAAiB;YAChC,YAAY;YACZ,eAAe;SAChB;KACF,CAAC;AACJ,CAAC;AA6CD,4EAA4E;AAE5E;;;;;;;;GAQG;AACH,MAAM,OAAO,WAAW;IACL,sBAAsB,CAAiB;IACvC,gBAAgB,CAAW;IAC3B,eAAe,CAAgC;IACvD,GAAG,CAAoB;IACvB,KAAK,CAAU;IACf,KAAK,CAAoB;IACzB,OAAO,CAAuB;IAEvC,YAAY,MAAyB;QACnC,IAAI,CAAC,MAAM,CAAC,GAAG;YAAE,MAAM,IAAI,KAAK,CAAC,mCAAmC,CAAC,CAAC;QACtE,IAAI,CAAC,MAAM,CAAC,KAAK;YAAE,MAAM,IAAI,KAAK,CAAC,qCAAqC,CAAC,CAAC;QAC1E,IAAI,CAAC,MAAM,CAAC,KAAK;YAAE,MAAM,IAAI,KAAK,CAAC,qCAAqC,CAAC,CAAC;QAC1E,IAAI,CAAC,MAAM,CAAC,OAAO;YACjB,MAAM,IAAI,KAAK,CAAC,uCAAuC,CAAC,CAAC;QAE3D,IAAI,CAAC,GAAG,GAAG,MAAM,CAAC,GAAG,CAAC;QACtB,IAAI,CAAC,KAAK,GAAG,MAAM,CAAC,KAAK,CAAC;QAC1B,IAAI,CAAC,KAAK,GAAG,MAAM,CAAC,KAAK,CAAC;QAC1B,IAAI,CAAC,OAAO,GAAG,MAAM,CAAC,OAAO,CAAC;QAC9B,IAAI,CAAC,sBAAsB,GAAG,IAAI,cAAc,CAAC,MAAM,CAAC,cAAc,CAAC,CAAC;QACxE,IAAI,CAAC,gBAAgB,GAAG,IAAI,QAAQ,EAAE,CAAC;QACvC,IAAI,CAAC,eAAe,GAAG,MAAM,CAAC,OAAO,CAAC;IACxC,CAAC;IAED;;;;;;OAMG;IACH,KAAK,CAAC,IAAI,CACR,YAA2B,EAC3B,IAAoB;QAEpB,sEAAsE;QACtE,MAAM,UAAU,GAAG,IAAI,CAAC,mBAAmB;YACzC,CAAC,CAAC,OAAO,CAAC,OAAO,CAAC,IAAI,CAAC,mBAAmB,CAAC;YAC3C,CAAC,CAAC,IAAI,CAAC,gBAAgB,CAAC,OAAO,CAC3B,IAAI,CAAC,GAAG,EACR,iBAAiB,CACf,kBAAkB,CAAC,gBAAgB,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC,EAClD,IAAI,CAAC,oBAAoB,CAC1B,CACF,CAAC;QAEN,IAAI,CAAC,SAAS,EAAE,mBAAmB,CAAC,GAAG,MAAM,OAAO,CAAC,GAAG,CAAC;YACvD,IAAI,CAAC,sBAAsB,CAAC,GAAG,CAAC,IAAI,CAAC,GAAG,CAAC;YACzC,UAAU;SACX,CAAC,CAAC;QAEH,sEAAsE;QACtE,wEAAwE;QACxE,yEAAyE;QACzE,uEAAuE;QACvE,IAAI,CAAC,IAAI,CAAC,mBAAmB,EAAE,CAAC;YAC9B,MAAM,GAAG,GAAG,gBAAgB,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC;YAC3C,MAAM,QAAQ,GAAG,kBAAkB,CAAC,GAAG,CAAC,CAAC;YACzC,MAAM,QAAQ,GAAG,sBAAsB,CAAC,GAAG,CAAC,CAAC;YAC7C,IAAI,CAAC;gBACH,cAAc,CAAC,mBAAmB,EAAE,QAAQ,EAAE,QAAQ,CAAC,CAAC;YAC1D,CAAC;YAAC,MAAM,CAAC;gBACP,IAAI,CAAC,gBAAgB,CAAC,UAAU,EAAE,CAAC;gBACnC,MAAM,OAAO,GAAG,iBAAiB,CAAC,QAAQ,EAAE,IAAI,CAAC,oBAAoB,CAAC,CAAC;gBACvE,mBAAmB,GAAG,MAAM,IAAI,CAAC,gBAAgB,CAAC,OAAO,CACvD,IAAI,CAAC,GAAG,EACR,OAAO,CACR,CAAC;gBACF,cAAc,CAAC,mBAAmB,EAAE,QAAQ,EAAE,QAAQ,CAAC,CAAC;YAC1D,CAAC;QACH,CAAC;QAED,OAAO,IAAI,CAAC;YACV,GAAG,EAAE,IAAI,CAAC,GAAG;YACb,KAAK,EAAE,IAAI,CAAC,KAAK;YACjB,KAAK,EAAE,IAAI,CAAC,KAAK;YACjB,OAAO,EAAE,IAAI,CAAC,OAAO;YACrB,YAAY;YACZ,GAAG,IAAI;YACP,SAAS;YACT,mBAAmB;SACpB,CAAC,CAAC;IACL,CAAC;IAED;;;;;OAKG;IACH,KAAK,CAAC,iBAAiB,CACrB,YAA2B,EAC3B,IAAiE;QAEjE,IAAI,CAAC;YACH,MAAM,MAAM,GAAG,MAAM,IAAI,CAAC,IAAI,CAAC,YAAY,EAAE,IAAI,CAAC,CAAC;YACnD,MAAM,OAAO,GAAG,MAAM,aAAa,CAAC,IAAI,CAAC,KAAK,EAAE,MAAM,CAAC,WAAW,CAAC,CAAC;YACpE,MAAM,SAAS,GAAG,MAAM,yBAAyB,CAC/C,IAAI,CAAC,GAAG,EACR,OAAO,EACP,IAAI,CAAC,cAAc,CACpB,CAAC;YACF,OAAO,EAAE,SAAS,EAAE,UAAU,EAAE,MAAM,EAAE,CAAC;QAC3C,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,MAAM,QAAQ,GAAG,iBAAiB,CAAC,GAAG,CAAC,CAAC;YACxC,IAAI,CAAC,eAAe,EAAE,CAAC,QAAQ,EAAE;gBAC/B,MAAM,EAAE,IAAI,CAAC,UAAU,EAAE,QAAQ,EAAE,IAAI,SAAS;gBAChD,SAAS,EAAE,IAAI,CAAC,SAAS;gBACzB,MAAM,EAAE,IAAI,CAAC,MAAM;aACpB,CAAC,CAAC;YACH,MAAM,QAAQ,CAAC;QACjB,CAAC;IACH,CAAC;IAED,gBAAgB;QACd,IAAI,CAAC,sBAAsB,CAAC,UAAU,EAAE,CAAC;QACzC,IAAI,CAAC,gBAAgB,CAAC,UAAU,EAAE,CAAC;IACrC,CAAC;IAED,0EAA0E;IAE1E,IAAY,WAAW;QACrB,OAAO,IAAI,CAAC,OAAO,KAAK,SAAS,CAAC,CAAC,CAAC,cAAc,CAAC,CAAC,CAAC,QAAQ,CAAC;IAChE,CAAC;IAED,KAAK,CAAC,aAAa;QACjB,OAAO,yBAAyB,CAC9B,IAAI,CAAC,GAAG,EACR,IAAI,CAAC,KAAK,EACV,SAAS,EACT,IAAI,CAAC,WAAW,CACjB,CAAC;IACJ,CAAC;IAED,KAAK,CAAC,cAAc;QAClB,OAAO,kBAAkB,CAAC,IAAI,CAAC,GAAG,EAAE,IAAI,CAAC,KAAK,EAAE,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC;IACtE,CAAC;IAED,KAAK,CAAC,MAAM;QACV,OAAO,WAAW,CAAC,IAAI,CAAC,GAAG,EAAE,IAAI,CAAC,KAAK,EAAE,IAAI,CAAC,WAAW,CAAC,CAAC;IAC7D,CAAC;IAED,KAAK,CAAC,gBAAgB;QACpB,OAAO,qBAAqB,CAAC,IAAI,CAAC,GAAG,EAAE,IAAI,CAAC,KAAK,EAAE,IAAI,CAAC,WAAW,CAAC,CAAC;IACvE,CAAC;IAED,MAAM,CAAC,KAAK,CAAC,WAAW,CACtB,IAAwB;QAExB,OAAO,WAAW,CAAC,IAAI,CAAC,CAAC;IAC3B,CAAC;CACF"}