@vultisig/core-chain 2.37.0 → 2.39.0

package/dist/chains/solana/kamino/tx/validate.js

@@ -0,0 +1,542 @@
+import { getAssociatedTokenAddressSync, TOKEN_2022_PROGRAM_ID, TOKEN_PROGRAM_ID } from '@solana/spl-token';
+import { PublicKey } from '@solana/web3.js';
+import { kaminoShareAmount } from '../amount.js';
+import { kaminoMaxBaseUnits } from '../baseUnits.js';
+import { kaminoConfig } from '../config.js';
+import { getKaminoVaultDescriptor } from '../registry.js';
+import { anchorU64Argument, anchorU128Argument, computeUnitLimitArgument, computeUnitPriceArgument, deriveKaminoFarmsUserState, hasNoAnchorArgument, isAttributionMemoData, isBuilderComposedProgram, kaminoAllowedProgram, kaminoAllowedPrograms, kaminoFarmsStakeScale, kaminoInstructionAccounts, systemTransferLamports, } from './instructions.js';
+import { expectedKaminoSequence, kaminoInstructionKind, kaminoInstructionKindName, matchKaminoSequence, } from './sequence.js';
+import { isKaminoAccountWritable, isUnsignedSingleSigner, resolveKaminoAccountAddresses, resolveKaminoLookupTables, totalKaminoAccountCount, } from './wire.js';
+/**
+ * Shares the farm has to release before the withdraw can burn its amount:
+ * the shortfall, and nothing more. Measured against captured builds: a
+ * request covered by the unstaked balance is built with no farms
+ * instructions at all, and anything above it unstakes exactly the
+ * difference.
+ */
+export const kaminoUnstakeShares = ({ shares, unstakedShares }) => {
+    const shortfall = shares.baseUnits - unstakedShares.baseUnits;
+    return kaminoShareAmount(shortfall > 0n ? shortfall : 0n, shares.decimals);
+};
+/**
+ * A refusal from the fail-closed validator. Everything it finds is a refusal
+ * — nothing downgrades to a warning — and `finding` names the category so
+ * callers and tests branch on data rather than message text.
+ */
+export class KaminoValidationError extends Error {
+    finding;
+    constructor(finding, detail) {
+        super(`Kamino transaction refused (${finding}): ${detail}`);
+        this.name = 'KaminoValidationError';
+        this.finding = finding;
+    }
+}
+const refuse = (finding, detail) => {
+    throw new KaminoValidationError(finding, detail);
+};
+/**
+ * The user's associated token accounts for one mint, one per token program.
+ * Both token programs are tried because a mint belongs to exactly one and
+ * which one is not knowable from the address alone.
+ */
+export const kaminoUserTokenAccounts = ({ owner, mint }) => {
+    try {
+        const ownerKey = new PublicKey(owner);
+        const mintKey = new PublicKey(mint);
+        return new Set([TOKEN_PROGRAM_ID, TOKEN_2022_PROGRAM_ID].map(program => getAssociatedTokenAddressSync(mintKey, ownerKey, false, program).toBase58()));
+    }
+    catch {
+        return new Set();
+    }
+};
+const instructionAccounts = (context, position) => Array.from(context.transaction.message.compiledInstructions[position].accountKeyIndexes, index => {
+    const address = context.accounts[index];
+    return address ?? refuse('accountResolution', `instruction ${position} indexes account ${index}`);
+});
+const requireOwner = (context, account, role) => {
+    if (account !== context.intent.owner) {
+        refuse('accountMismatch', `${role} is ${account}, expected ${context.intent.owner}`);
+    }
+};
+const requireAccount = (account, expected, role) => {
+    if (account !== expected)
+        refuse('accountMismatch', `${role} is ${account}, expected ${expected}`);
+};
+const requireUserTokenAccount = (context, account, role) => {
+    if (!context.userTokenAccounts.has(account))
+        refuse('accountNotOwnedByUser', `${role} ${account}`);
+};
+const requireUserShareAccount = (context, account, role) => {
+    if (!context.userShareAccounts.has(account))
+        refuse('accountNotOwnedByUser', `${role} ${account}`);
+};
+const requireFarm = (context, account) => {
+    const farm = context.intent.vault.descriptor.farm;
+    if (!farm)
+        refuse('instructionNotForOperation', 'farm instruction against a farmless vault');
+    else
+        requireAccount(account, farm, 'farm');
+};
+const requireFarmUserState = (context, account) => {
+    const farm = context.intent.vault.descriptor.farm;
+    if (!farm)
+        return refuse('instructionNotForOperation', 'farm instruction against a farmless vault');
+    const expected = deriveKaminoFarmsUserState({ farm, owner: context.intent.owner });
+    if (!expected)
+        return refuse('derivationFailed', `the farm user state for ${farm}`);
+    requireAccount(account, expected, 'farm user state');
+};
+const requireNoAccounts = (accounts, position, detail) => {
+    if (accounts.length > 0)
+        refuse('malformedInstruction', `instruction ${position}: ${detail} takes no accounts`);
+};
+const requireU64 = (value, role) => {
+    if (value < 0n || value > kaminoMaxBaseUnits)
+        refuse('amountOutOfRange', `${role} ${value}`);
+    return value;
+};
+const requireAnchorAmount = (data, position, expected, role) => {
+    const argument = anchorU64Argument(data);
+    if (argument === undefined) {
+        return refuse('malformedInstruction', `instruction ${position}: ${role} argument`);
+    }
+    if (argument !== requireU64(expected, role)) {
+        refuse('amountMismatch', `${role} is ${argument}, expected ${expected}`);
+    }
+};
+const operationKind = (intent) => 'deposit' in intent.operation ? 'deposit' : 'withdraw';
+const layout = kaminoInstructionAccounts;
+/**
+ * The compute unit limit, pinned to the value the app injected. A limit is
+ * half of the fee — the network charges `limit × price` — so one raised
+ * beyond what the transaction needs is SOL spent for nothing.
+ */
+const checkComputeUnitLimit = ({ context, position, data, accounts }) => {
+    requireNoAccounts(accounts, position, 'compute budget');
+    const limit = computeUnitLimitArgument(data);
+    const fee = context.intent.priorityFee;
+    if (!fee || limit === undefined) {
+        return refuse('malformedInstruction', `instruction ${position}: compute unit limit`);
+    }
+    if (limit !== fee.unitLimit) {
+        refuse('amountMismatch', `compute unit limit is ${limit}, expected ${fee.unitLimit}`);
+    }
+};
+/**
+ * The price per compute unit, pinned to the value the app injected. This is
+ * the half an attacker would inflate: a u64 of micro-lamports, and nothing on
+ * chain caps the resulting fee below the payer's balance.
+ */
+const checkComputeUnitPrice = ({ context, position, data, accounts }) => {
+    requireNoAccounts(accounts, position, 'compute budget');
+    const price = computeUnitPriceArgument(data);
+    const fee = context.intent.priorityFee;
+    if (!fee || price === undefined) {
+        return refuse('malformedInstruction', `instruction ${position}: compute unit price`);
+    }
+    if (price !== fee.unitPriceMicroLamports) {
+        refuse('amountMismatch', `compute unit price is ${price}, expected ${fee.unitPriceMicroLamports}`);
+    }
+};
+/**
+ * A CreateIdempotent may only create one of the vault's two mints' accounts,
+ * for the user, at the address derivation says it must have. Creating an
+ * account is harmless in itself, but it is also where a third-party
+ * destination would first appear.
+ */
+const checkCreateTokenAccount = ({ context, accounts, requireMinimumAccounts }) => {
+    const { intent } = context;
+    requireMinimumAccounts(layout.associatedToken.count);
+    requireOwner(context, accounts[layout.associatedToken.payer], 'token account funder');
+    requireOwner(context, accounts[layout.associatedToken.wallet], 'token account owner');
+    const mint = accounts[layout.associatedToken.mint];
+    const { tokenMint, sharesMint } = intent.vault.descriptor;
+    if (mint !== tokenMint && mint !== sharesMint) {
+        return refuse('accountMismatch', `created token account mint is ${mint}`);
+    }
+    const tokenProgramId = accounts[layout.associatedToken.tokenProgram];
+    const tokenProgram = splTokenProgram(tokenProgramId);
+    if (!tokenProgram)
+        return refuse('programNotAllowed', `token program ${tokenProgramId}`);
+    const derived = getAssociatedTokenAddressSync(new PublicKey(mint), new PublicKey(intent.owner), false, tokenProgram).toBase58();
+    requireAccount(accounts[layout.associatedToken.account], derived, 'created token account');
+};
+const splTokenProgram = (programId) => {
+    if (programId === kaminoAllowedPrograms.token)
+        return TOKEN_PROGRAM_ID;
+    if (programId === kaminoAllowedPrograms.token2022)
+        return TOKEN_2022_PROGRAM_ID;
+    return undefined;
+};
+/**
+ * The lamports that fund the wSOL account: the only native SOL movement the
+ * operation performs, so both endpoints and the amount are pinned.
+ */
+const checkWrapSolTransfer = ({ context, position, data, accounts, requireMinimumAccounts }) => {
+    const { intent } = context;
+    requireMinimumAccounts(layout.systemTransfer.count);
+    const lamports = systemTransferLamports(data);
+    if (lamports === undefined) {
+        return refuse('malformedInstruction', `instruction ${position}: system transfer`);
+    }
+    requireOwner(context, accounts[layout.systemTransfer.source], 'SOL transfer source');
+    requireUserTokenAccount(context, accounts[layout.systemTransfer.destination], 'SOL transfer destination');
+    if (!('deposit' in intent.operation)) {
+        return refuse('instructionNotForOperation', 'SOL wrap on a withdraw');
+    }
+    const expected = requireU64(intent.operation.deposit.baseUnits, 'deposit amount');
+    if (lamports !== expected) {
+        refuse('amountMismatch', `wrapped SOL amount is ${lamports}, expected ${expected}`);
+    }
+};
+const checkSyncNative = ({ context, accounts, requireMinimumAccounts }) => {
+    requireMinimumAccounts(1);
+    requireUserTokenAccount(context, accounts[0], 'wrapped SOL account');
+};
+/**
+ * Closing a token account sends its remaining lamports somewhere. Both the
+ * account being closed and where its rent lands have to be the user's.
+ */
+const checkCloseTokenAccount = ({ context, accounts, requireMinimumAccounts }) => {
+    requireMinimumAccounts(layout.closeAccount.count);
+    const closed = accounts[layout.closeAccount.account];
+    if (!context.userTokenAccounts.has(closed) && !context.userShareAccounts.has(closed)) {
+        return refuse('accountNotOwnedByUser', `closed token account ${closed}`);
+    }
+    requireOwner(context, accounts[layout.closeAccount.destination], 'closed account rent destination');
+    requireOwner(context, accounts[layout.closeAccount.authority], 'closed account authority');
+};
+const checkKvaultDeposit = ({ context, position, data, accounts, requireMinimumAccounts }) => {
+    const { intent } = context;
+    requireMinimumAccounts(layout.kvaultDeposit.minimumCount);
+    if (!('deposit' in intent.operation)) {
+        return refuse('instructionNotForOperation', 'vault deposit on a withdraw');
+    }
+    const { address, tokenMint, sharesMint } = intent.vault.descriptor;
+    requireOwner(context, accounts[layout.kvaultDeposit.user], 'deposit authority');
+    requireAccount(accounts[layout.kvaultDeposit.vault], address, 'vault');
+    requireAccount(accounts[layout.kvaultDeposit.tokenMint], tokenMint, 'deposit token mint');
+    requireAccount(accounts[layout.kvaultDeposit.sharesMint], sharesMint, 'deposit shares mint');
+    requireUserTokenAccount(context, accounts[layout.kvaultDeposit.userTokenAccount], 'deposit source');
+    requireUserShareAccount(context, accounts[layout.kvaultDeposit.userShareAccount], 'deposit share destination');
+    requireAnchorAmount(data, position, intent.operation.deposit.baseUnits, 'deposit amount');
+};
+const checkKvaultWithdraw = ({ context, position, data, accounts, requireMinimumAccounts }) => {
+    const { intent } = context;
+    requireMinimumAccounts(layout.kvaultWithdraw.minimumCount);
+    if (!('withdraw' in intent.operation)) {
+        return refuse('instructionNotForOperation', 'vault withdraw on a deposit');
+    }
+    const { address, tokenMint, sharesMint } = intent.vault.descriptor;
+    requireOwner(context, accounts[layout.kvaultWithdraw.user], 'withdraw authority');
+    requireAccount(accounts[layout.kvaultWithdraw.vault], address, 'vault');
+    requireAccount(accounts[layout.kvaultWithdraw.tokenMint], tokenMint, 'withdraw token mint');
+    requireAccount(accounts[layout.kvaultWithdraw.sharesMint], sharesMint, 'withdraw shares mint');
+    requireUserTokenAccount(context, accounts[layout.kvaultWithdraw.userTokenAccount], 'withdraw destination');
+    requireUserShareAccount(context, accounts[layout.kvaultWithdraw.userShareAccount], 'withdraw share source');
+    // Shares, not tokens. The API takes the same `amount` field for both actions
+    // with inverted units, and an amount above the user's balance is silently
+    // rewritten to u64::MAX — withdraw everything — so this is the check that
+    // stands between a partial exit and a full one.
+    requireAnchorAmount(data, position, intent.operation.withdraw.shares.baseUnits, 'withdraw share amount');
+};
+const checkFarmsInitializeUser = ({ context, accounts, requireMinimumAccounts }) => {
+    requireMinimumAccounts(layout.farmsInitializeUser.minimumCount);
+    requireOwner(context, accounts[layout.farmsInitializeUser.authority], 'farm user authority');
+    requireFarm(context, accounts[layout.farmsInitializeUser.farm]);
+};
+/**
+ * The stake that makes the deposit's shares invisible in the wallet. It must
+ * move the user's own shares into this vault's own farm — a farm belonging to
+ * another vault would park the position somewhere the app never reads.
+ */
+const checkFarmsStake = ({ context, position, data, accounts, requireMinimumAccounts }) => {
+    requireMinimumAccounts(layout.farmsStake.minimumCount);
+    requireOwner(context, accounts[layout.farmsStake.owner], 'stake authority');
+    requireFarm(context, accounts[layout.farmsStake.farm]);
+    requireUserShareAccount(context, accounts[layout.farmsStake.userShareAccount], 'stake source');
+    requireAccount(accounts[layout.farmsStake.sharesMint], context.intent.vault.descriptor.sharesMint, 'stake shares mint');
+    // Kamino stakes the whole share balance rather than the freshly minted
+    // amount, so the argument is the u64 sentinel. A different value is a
+    // behaviour change, not a variation, and is worth stopping on.
+    const argument = anchorU64Argument(data);
+    if (argument === undefined) {
+        return refuse('malformedInstruction', `instruction ${position}: farms stake argument`);
+    }
+    if (argument !== kaminoMaxBaseUnits) {
+        refuse('amountMismatch', `staked share amount is ${argument}, expected ${kaminoMaxBaseUnits}`);
+    }
+};
+/**
+ * The release of staked shares from the farm, and the one amount in this
+ * feature that is not a u64: a u128 scaled by 10^18, checked in exact bigint
+ * arithmetic with no division and no narrowing.
+ *
+ * Pinned to the exact shortfall rather than bounded above by it: a LARGER
+ * unstake would release shares the transaction then leaves sitting out of the
+ * farm and no longer earning — a real loss, silent, and invisible on the
+ * verify screen; a smaller one simply cannot settle.
+ */
+const checkFarmsUnstake = ({ context, position, data, accounts, requireMinimumAccounts }) => {
+    const { intent } = context;
+    requireMinimumAccounts(layout.farmsUnstake.minimumCount);
+    if (!('withdraw' in intent.operation)) {
+        return refuse('instructionNotForOperation', 'farm unstake on a deposit');
+    }
+    requireOwner(context, accounts[layout.farmsUnstake.owner], 'unstake authority');
+    requireFarm(context, accounts[layout.farmsUnstake.farm]);
+    requireFarmUserState(context, accounts[layout.farmsUnstake.userState]);
+    const scaled = anchorU128Argument(data);
+    if (scaled === undefined) {
+        return refuse('malformedInstruction', `instruction ${position}: farms unstake argument`);
+    }
+    const expected = kaminoUnstakeShares(intent.operation.withdraw).baseUnits * kaminoFarmsStakeScale;
+    if (scaled !== expected) {
+        refuse('amountMismatch', `unstaked share amount is ${scaled}, expected ${expected}`);
+    }
+};
+/**
+ * Moving what the unstake released into the user's own share account. It
+ * takes no argument — it always moves the whole released balance — so
+ * everything checkable here is an account, and the one that matters is the
+ * destination: the vault withdraw burns from that same account, and a
+ * destination belonging to anyone else would hand the position over.
+ */
+const checkFarmsWithdrawUnstakedDeposits = ({ context, position, data, accounts, requireMinimumAccounts, }) => {
+    requireMinimumAccounts(layout.farmsWithdrawUnstakedDeposits.minimumCount);
+    if (!('withdraw' in context.intent.operation)) {
+        return refuse('instructionNotForOperation', 'farm unstaked share withdrawal on a deposit');
+    }
+    if (!hasNoAnchorArgument(data)) {
+        return refuse('malformedInstruction', `instruction ${position}: farms withdrawUnstakedDeposits takes no argument`);
+    }
+    requireOwner(context, accounts[layout.farmsWithdrawUnstakedDeposits.owner], 'unstaked share withdrawal authority');
+    requireFarm(context, accounts[layout.farmsWithdrawUnstakedDeposits.farm]);
+    requireFarmUserState(context, accounts[layout.farmsWithdrawUnstakedDeposits.userState]);
+    requireUserShareAccount(context, accounts[layout.farmsWithdrawUnstakedDeposits.userShareAccount], 'unstaked share destination');
+};
+/**
+ * The sequence already refuses any other payload under the Memo program, so
+ * reaching here with different bytes is impossible — which is exactly why it
+ * is asserted rather than assumed: the tag is the only reason this program is
+ * allow-listed at all. No accounts, either: a memo listing accounts is the
+ * Memo program attesting that they signed, and attribution is not an
+ * attestation.
+ */
+const checkAttributionMemo = ({ position, data, accounts }) => {
+    requireNoAccounts(accounts, position, 'attribution memo');
+    if (!isAttributionMemoData(data)) {
+        refuse('malformedInstruction', `instruction ${position}: attribution memo`);
+    }
+};
+/**
+ * The account and amount checks each matched instruction must pass, one entry
+ * per template step. A record rather than a switch so every check stands on
+ * its own, and so a template step added without a check is a type error
+ * rather than an instruction that silently goes unchecked.
+ */
+const instructionChecks = {
+    computeUnitLimit: checkComputeUnitLimit,
+    computeUnitPrice: checkComputeUnitPrice,
+    createTokenAccount: checkCreateTokenAccount,
+    wrapSolTransfer: checkWrapSolTransfer,
+    syncNative: checkSyncNative,
+    closeTokenAccount: checkCloseTokenAccount,
+    kvaultDeposit: checkKvaultDeposit,
+    kvaultWithdraw: checkKvaultWithdraw,
+    farmsInitializeUser: checkFarmsInitializeUser,
+    farmsStake: checkFarmsStake,
+    farmsUnstake: checkFarmsUnstake,
+    farmsWithdrawUnstakedDeposits: checkFarmsWithdrawUnstakedDeposits,
+    attributionMemo: checkAttributionMemo,
+};
+const validateInstruction = (context, kind, position) => {
+    const accounts = instructionAccounts(context, position);
+    instructionChecks[kind]({
+        context,
+        position,
+        data: context.transaction.message.compiledInstructions[position].data,
+        accounts,
+        requireMinimumAccounts: minimum => {
+            if (accounts.length < minimum) {
+                refuse('malformedInstruction', `instruction ${position}: ${kaminoInstructionKindName[kind]} needs ${minimum} accounts`);
+            }
+        },
+    });
+};
+/**
+ * Two rules, together covering "no unexplained writes". A writable account
+ * nothing references is a loaded write privilege with no purpose, which is
+ * not a shape any legitimate builder emits. And an account that a
+ * builder-composed instruction can write to has to be one this operation can
+ * name — the user, the vault, its two mints, or the user's own token accounts
+ * for them. A drain has to write somewhere, and outside the `kvault`/`farms`
+ * programs there is nowhere left for it to write.
+ */
+const validateWritableAccounts = (context) => {
+    const { transaction, accounts, programs } = context;
+    const instructions = transaction.message.compiledInstructions;
+    const referenced = new Set();
+    for (const instruction of instructions) {
+        for (const index of instruction.accountKeyIndexes)
+            referenced.add(index);
+    }
+    for (let index = 0; index < accounts.length; index++) {
+        if (isKaminoAccountWritable({ transaction, index }) && !referenced.has(index)) {
+            refuse('unreferencedWritableAccount', accounts[index]);
+        }
+    }
+    for (let position = 0; position < instructions.length; position++) {
+        const program = programs[position];
+        if (!program || !isBuilderComposedProgram(program))
+            continue;
+        for (const index of instructions[position].accountKeyIndexes) {
+            if (!isKaminoAccountWritable({ transaction, index }))
+                continue;
+            const account = accounts[index];
+            if (!context.explainedAccounts.has(account)) {
+                refuse('unattributableWritableAccount', `${program} writes ${account}`);
+            }
+        }
+    }
+};
+/**
+ * Fail-closed validation of a Kamino-built Solana transaction.
+ *
+ * Kamino builds the transaction and the app signs the bytes verbatim, so
+ * between an API response and a signature over it there is only this. It runs
+ * before simulation and before keysign, and every finding is a refusal.
+ *
+ * What it establishes, in layers: the shape (one unsigned signature, paid by
+ * the user, every lookup table the vault's own); the programs (every
+ * `programIdIndex` resolves to an allow-listed program — the outer bound on
+ * what the signature can authorise); the sequence (the instruction list
+ * matches the shape this operation produces, so a new instruction fails
+ * closed); the identity of every account that decides where money goes,
+ * compared against values the app already had — registry and local
+ * derivations, never the response, because checking a transaction the API
+ * built against metadata the same API supplied would be circular; the amounts
+ * (the kvault `u64` equals what the user was shown, the priority fee equals
+ * what the app injected); and the writable accounts (no unexplained writes).
+ *
+ * What it does not establish is what the `kvault` and `farms` programs do
+ * with the accounts they are handed. That is the protocol, and choosing to
+ * trust it is what the registry allow-list expresses.
+ *
+ * Pure — lookup tables arrive resolved, so tests can drive it against pinned
+ * contents. `validateKaminoTransactionOnline` is the fetching entry point.
+ */
+export const validateKaminoTransaction = ({ transaction, intent, lookupTables, }) => {
+    const vaultAddress = intent.vault.descriptor.address;
+    const registered = getKaminoVaultDescriptor(vaultAddress);
+    if (!registered)
+        return refuse('vaultNotAllowed', vaultAddress);
+    // The registry's own object, not a value-equal copy. Every value the checks
+    // below rest on — the mints, their decimals, the farm — lives on this
+    // descriptor, so accepting one that merely *claims* an allow-listed address
+    // would hand an attacker the pinning itself. Identity makes the registry
+    // the only possible source of a vault's identity, structurally rather than
+    // by convention.
+    if (registered !== intent.vault.descriptor) {
+        return refuse('vaultDescriptorMismatch', vaultAddress);
+    }
+    if (!isUnsignedSingleSigner(transaction, intent.owner)) {
+        return refuse('transactionShape', 'not an unsigned single-signer transaction paid by the owner');
+    }
+    // Every table the transaction reads from must be the vault's own. A table
+    // decides which pubkey an account index names, so a foreign one is how an
+    // account substitution would be hidden. Zero tables is allowed — then every
+    // account is a static key and there is nothing to hide behind.
+    const lookups = transaction.message.addressTableLookups;
+    if (lookups.length > 1)
+        return refuse('unexpectedLookupTable', `${lookups.length} lookup tables`);
+    for (const lookup of lookups) {
+        const address = lookup.accountKey.toBase58();
+        if (address !== intent.vault.lookupTable) {
+            return refuse('unexpectedLookupTable', `${address}, expected ${intent.vault.lookupTable}`);
+        }
+    }
+    const accounts = resolveKaminoAccountAddresses({ transaction, lookupTables });
+    if (!accounts || accounts.length !== totalKaminoAccountCount(transaction)) {
+        return refuse('accountResolution', 'lookup tables do not resolve every account index');
+    }
+    const instructions = transaction.message.compiledInstructions;
+    const programs = instructions.map(instruction => kaminoAllowedProgram(accounts[instruction.programIdIndex]));
+    for (let position = 0; position < programs.length; position++) {
+        if (!programs[position]) {
+            return refuse('programNotAllowed', `instruction ${position} invokes ${accounts[instructions[position].programIdIndex]}`);
+        }
+    }
+    // Before injection the app has chosen no fee and written no memo, so either
+    // arriving in the response came from the builder — and each is named
+    // separately so the refusal says what is actually wrong, rather than
+    // reading as a sequencing error.
+    if (!intent.priorityFee && programs.includes('computeBudget')) {
+        return refuse('unexpectedPriorityFee', 'compute budget instruction before injection');
+    }
+    if (!intent.carriesAttributionMemo && programs.includes('memo')) {
+        return refuse('unexpectedMemo', 'memo instruction before injection');
+    }
+    const userTokenAccounts = kaminoUserTokenAccounts({ owner: intent.owner, mint: intent.vault.descriptor.tokenMint });
+    const userShareAccounts = kaminoUserTokenAccounts({ owner: intent.owner, mint: intent.vault.descriptor.sharesMint });
+    if (userTokenAccounts.size === 0 || userShareAccounts.size === 0) {
+        return refuse('derivationFailed', "the user's associated token accounts");
+    }
+    const context = {
+        intent,
+        transaction,
+        accounts,
+        programs,
+        userTokenAccounts,
+        userShareAccounts,
+        explainedAccounts: new Set([
+            ...userTokenAccounts,
+            ...userShareAccounts,
+            intent.owner,
+            intent.vault.descriptor.address,
+            intent.vault.descriptor.tokenMint,
+            intent.vault.descriptor.sharesMint,
+        ]),
+    };
+    const kinds = instructions.map((instruction, position) => kaminoInstructionKind(programs[position], instruction.data));
+    const steps = expectedKaminoSequence({
+        operation: operationKind(intent),
+        isWrappedSolVault: intent.vault.descriptor.tokenMint === kaminoConfig.wrappedSolMint,
+        hasFarm: intent.vault.descriptor.farm !== undefined,
+        hasPriorityFee: intent.priorityFee !== undefined,
+        hasAttributionMemo: intent.carriesAttributionMemo,
+        // This device read the position, so it knows which of the two withdraw
+        // shapes it asked for and says so. Never 'unknown' here: accepting either
+        // shape would let a transaction that unstakes shares pass as one that was
+        // not supposed to touch the farm.
+        farmUnstake: 'withdraw' in intent.operation
+            ? kaminoUnstakeShares(intent.operation.withdraw).baseUnits > 0n
+                ? 'required'
+                : 'forbidden'
+            : 'forbidden',
+    });
+    const outcome = matchKaminoSequence(kinds, steps);
+    if ('mismatch' in outcome) {
+        const { mismatch } = outcome;
+        if ('unexpectedInstruction' in mismatch) {
+            return refuse('unexpectedInstruction', `instruction ${mismatch.unexpectedInstruction.index}`);
+        }
+        return refuse('missingInstruction', 'missingInstruction' in mismatch ? mismatch.missingInstruction : mismatch.incompleteInstructionPair);
+    }
+    outcome.matched.forEach((kind, position) => validateInstruction(context, kind, position));
+    validateWritableAccounts(context);
+};
+/**
+ * Resolves the transaction's address lookup tables from the RPC, then runs
+ * the pure validator against them.
+ *
+ * Rejects with `KaminoValidationError` for a refusal of the transaction, and
+ * with `KaminoWireError` when the lookup tables could not be resolved at all
+ * (missing table, stalled node past the read deadline, transport failure) —
+ * callers must not assume every rejection carries a `finding`.
+ */
+export const validateKaminoTransactionOnline = async ({ transaction, intent, }) => {
+    const lookupTables = await resolveKaminoLookupTables(transaction);
+    validateKaminoTransaction({ transaction, intent, lookupTables });
+};
+//# sourceMappingURL=validate.js.map

package/dist/chains/solana/kamino/tx/validate.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"validate.js","sourceRoot":"","sources":["../../../../../../../../packages/core/chain/chains/solana/kamino/tx/validate.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,6BAA6B,EAAE,qBAAqB,EAAE,gBAAgB,EAAE,MAAM,mBAAmB,CAAA;AAC1G,OAAO,EAAE,SAAS,EAAwB,MAAM,iBAAiB,CAAA;AAEjE,OAAO,EAAqB,iBAAiB,EAAqB,MAAM,WAAW,CAAA;AACnF,OAAO,EAAE,kBAAkB,EAAE,MAAM,cAAc,CAAA;AACjD,OAAO,EAAE,YAAY,EAAE,MAAM,WAAW,CAAA;AAExC,OAAO,EAAE,wBAAwB,EAAE,MAAM,aAAa,CAAA;AACtD,OAAO,EACL,iBAAiB,EACjB,kBAAkB,EAClB,wBAAwB,EACxB,wBAAwB,EACxB,0BAA0B,EAC1B,mBAAmB,EACnB,qBAAqB,EACrB,wBAAwB,EAExB,oBAAoB,EACpB,qBAAqB,EACrB,qBAAqB,EACrB,yBAAyB,EACzB,sBAAsB,GACvB,MAAM,gBAAgB,CAAA;AACvB,OAAO,EACL,sBAAsB,EAEtB,qBAAqB,EACrB,yBAAyB,EACzB,mBAAmB,GACpB,MAAM,YAAY,CAAA;AACnB,OAAO,EACL,uBAAuB,EACvB,sBAAsB,EACtB,6BAA6B,EAC7B,yBAAyB,EACzB,uBAAuB,GACxB,MAAM,QAAQ,CAAA;AAwBf;;;;;;GAMG;AACH,MAAM,CAAC,MAAM,mBAAmB,GAAG,CAAC,EAAE,MAAM,EAAE,cAAc,EAAyB,EAAqB,EAAE;IAC1G,MAAM,SAAS,GAAG,MAAM,CAAC,SAAS,GAAG,cAAc,CAAC,SAAS,CAAA;IAC7D,OAAO,iBAAiB,CAAC,SAAS,GAAG,EAAE,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,EAAE,EAAE,MAAM,CAAC,QAAQ,CAAC,CAAA;AAC5E,CAAC,CAAA;AA+DD;;;;GAIG;AACH,MAAM,OAAO,qBAAsB,SAAQ,KAAK;IACrC,OAAO,CAAyB;IAEzC,YAAY,OAAgC,EAAE,MAAc;QAC1D,KAAK,CAAC,+BAA+B,OAAO,MAAM,MAAM,EAAE,CAAC,CAAA;QAC3D,IAAI,CAAC,IAAI,GAAG,uBAAuB,CAAA;QACnC,IAAI,CAAC,OAAO,GAAG,OAAO,CAAA;IACxB,CAAC;CACF;AAED,MAAM,MAAM,GAAG,CAAC,OAAgC,EAAE,MAAc,EAAS,EAAE;IACzE,MAAM,IAAI,qBAAqB,CAAC,OAAO,EAAE,MAAM,CAAC,CAAA;AAClD,CAAC,CAAA;AAED;;;;GAIG;AACH,MAAM,CAAC,MAAM,uBAAuB,GAAG,CAAC,EAAE,KAAK,EAAE,IAAI,EAAmC,EAAe,EAAE;IACvG,IAAI,CAAC;QACH,MAAM,QAAQ,GAAG,IAAI,SAAS,CAAC,KAAK,CAAC,CAAA;QACrC,MAAM,OAAO,GAAG,IAAI,SAAS,CAAC,IAAI,CAAC,CAAA;QACnC,OAAO,IAAI,GAAG,CACZ,CAAC,gBAAgB,EAAE,qBAAqB,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,EAAE,CACtD,6BAA6B,CAAC,OAAO,EAAE,QAAQ,EAAE,KAAK,EAAE,OAAO,CAAC,CAAC,QAAQ,EAAE,CAC5E,CACF,CAAA;IACH,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,IAAI,GAAG,EAAE,CAAA;IAClB,CAAC;AACH,CAAC,CAAA;AAkBD,MAAM,mBAAmB,GAAG,CAAC,OAAgB,EAAE,QAAgB,EAAY,EAAE,CAC3E,KAAK,CAAC,IAAI,CAAC,OAAO,CAAC,WAAW,CAAC,OAAO,CAAC,oBAAoB,CAAC,QAAQ,CAAC,CAAC,iBAAiB,EAAE,KAAK,CAAC,EAAE;IAC/F,MAAM,OAAO,GAAG,OAAO,CAAC,QAAQ,CAAC,KAAK,CAAC,CAAA;IACvC,OAAO,OAAO,IAAI,MAAM,CAAC,mBAAmB,EAAE,eAAe,QAAQ,oBAAoB,KAAK,EAAE,CAAC,CAAA;AACnG,CAAC,CAAC,CAAA;AAEJ,MAAM,YAAY,GAAG,CAAC,OAAgB,EAAE,OAAe,EAAE,IAAY,EAAE,EAAE;IACvE,IAAI,OAAO,KAAK,OAAO,CAAC,MAAM,CAAC,KAAK,EAAE,CAAC;QACrC,MAAM,CAAC,iBAAiB,EAAE,GAAG,IAAI,OAAO,OAAO,cAAc,OAAO,CAAC,MAAM,CAAC,KAAK,EAAE,CAAC,CAAA;IACtF,CAAC;AACH,CAAC,CAAA;AAED,MAAM,cAAc,GAAG,CAAC,OAAe,EAAE,QAAgB,EAAE,IAAY,EAAE,EAAE;IACzE,IAAI,OAAO,KAAK,QAAQ;QAAE,MAAM,CAAC,iBAAiB,EAAE,GAAG,IAAI,OAAO,OAAO,cAAc,QAAQ,EAAE,CAAC,CAAA;AACpG,CAAC,CAAA;AAED,MAAM,uBAAuB,GAAG,CAAC,OAAgB,EAAE,OAAe,EAAE,IAAY,EAAE,EAAE;IAClF,IAAI,CAAC,OAAO,CAAC,iBAAiB,CAAC,GAAG,CAAC,OAAO,CAAC;QAAE,MAAM,CAAC,uBAAuB,EAAE,GAAG,IAAI,IAAI,OAAO,EAAE,CAAC,CAAA;AACpG,CAAC,CAAA;AAED,MAAM,uBAAuB,GAAG,CAAC,OAAgB,EAAE,OAAe,EAAE,IAAY,EAAE,EAAE;IAClF,IAAI,CAAC,OAAO,CAAC,iBAAiB,CAAC,GAAG,CAAC,OAAO,CAAC;QAAE,MAAM,CAAC,uBAAuB,EAAE,GAAG,IAAI,IAAI,OAAO,EAAE,CAAC,CAAA;AACpG,CAAC,CAAA;AAED,MAAM,WAAW,GAAG,CAAC,OAAgB,EAAE,OAAe,EAAE,EAAE;IACxD,MAAM,IAAI,GAAG,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,UAAU,CAAC,IAAI,CAAA;IACjD,IAAI,CAAC,IAAI;QAAE,MAAM,CAAC,4BAA4B,EAAE,2CAA2C,CAAC,CAAA;;QACvF,cAAc,CAAC,OAAO,EAAE,IAAI,EAAE,MAAM,CAAC,CAAA;AAC5C,CAAC,CAAA;AAED,MAAM,oBAAoB,GAAG,CAAC,OAAgB,EAAE,OAAe,EAAE,EAAE;IACjE,MAAM,IAAI,GAAG,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,UAAU,CAAC,IAAI,CAAA;IACjD,IAAI,CAAC,IAAI;QAAE,OAAO,MAAM,CAAC,4BAA4B,EAAE,2CAA2C,CAAC,CAAA;IACnG,MAAM,QAAQ,GAAG,0BAA0B,CAAC,EAAE,IAAI,EAAE,KAAK,EAAE,OAAO,CAAC,MAAM,CAAC,KAAK,EAAE,CAAC,CAAA;IAClF,IAAI,CAAC,QAAQ;QAAE,OAAO,MAAM,CAAC,kBAAkB,EAAE,2BAA2B,IAAI,EAAE,CAAC,CAAA;IACnF,cAAc,CAAC,OAAO,EAAE,QAAQ,EAAE,iBAAiB,CAAC,CAAA;AACtD,CAAC,CAAA;AAED,MAAM,iBAAiB,GAAG,CAAC,QAAkB,EAAE,QAAgB,EAAE,MAAc,EAAE,EAAE;IACjF,IAAI,QAAQ,CAAC,MAAM,GAAG,CAAC;QAAE,MAAM,CAAC,sBAAsB,EAAE,eAAe,QAAQ,KAAK,MAAM,oBAAoB,CAAC,CAAA;AACjH,CAAC,CAAA;AAED,MAAM,UAAU,GAAG,CAAC,KAAa,EAAE,IAAY,EAAU,EAAE;IACzD,IAAI,KAAK,GAAG,EAAE,IAAI,KAAK,GAAG,kBAAkB;QAAE,MAAM,CAAC,kBAAkB,EAAE,GAAG,IAAI,IAAI,KAAK,EAAE,CAAC,CAAA;IAC5F,OAAO,KAAK,CAAA;AACd,CAAC,CAAA;AAED,MAAM,mBAAmB,GAAG,CAAC,IAAgB,EAAE,QAAgB,EAAE,QAAgB,EAAE,IAAY,EAAE,EAAE;IACjG,MAAM,QAAQ,GAAG,iBAAiB,CAAC,IAAI,CAAC,CAAA;IACxC,IAAI,QAAQ,KAAK,SAAS,EAAE,CAAC;QAC3B,OAAO,MAAM,CAAC,sBAAsB,EAAE,eAAe,QAAQ,KAAK,IAAI,WAAW,CAAC,CAAA;IACpF,CAAC;IACD,IAAI,QAAQ,KAAK,UAAU,CAAC,QAAQ,EAAE,IAAI,CAAC,EAAE,CAAC;QAC5C,MAAM,CAAC,gBAAgB,EAAE,GAAG,IAAI,OAAO,QAAQ,cAAc,QAAQ,EAAE,CAAC,CAAA;IAC1E,CAAC;AACH,CAAC,CAAA;AAED,MAAM,aAAa,GAAG,CAAC,MAA+B,EAA0B,EAAE,CAChF,SAAS,IAAI,MAAM,CAAC,SAAS,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,UAAU,CAAA;AAaxD,MAAM,MAAM,GAAG,yBAAyB,CAAA;AAExC;;;;GAIG;AACH,MAAM,qBAAqB,GAAG,CAAC,EAAE,OAAO,EAAE,QAAQ,EAAE,IAAI,EAAE,QAAQ,EAAoB,EAAE,EAAE;IACxF,iBAAiB,CAAC,QAAQ,EAAE,QAAQ,EAAE,gBAAgB,CAAC,CAAA;IACvD,MAAM,KAAK,GAAG,wBAAwB,CAAC,IAAI,CAAC,CAAA;IAC5C,MAAM,GAAG,GAAG,OAAO,CAAC,MAAM,CAAC,WAAW,CAAA;IACtC,IAAI,CAAC,GAAG,IAAI,KAAK,KAAK,SAAS,EAAE,CAAC;QAChC,OAAO,MAAM,CAAC,sBAAsB,EAAE,eAAe,QAAQ,sBAAsB,CAAC,CAAA;IACtF,CAAC;IACD,IAAI,KAAK,KAAK,GAAG,CAAC,SAAS,EAAE,CAAC;QAC5B,MAAM,CAAC,gBAAgB,EAAE,yBAAyB,KAAK,cAAc,GAAG,CAAC,SAAS,EAAE,CAAC,CAAA;IACvF,CAAC;AACH,CAAC,CAAA;AAED;;;;GAIG;AACH,MAAM,qBAAqB,GAAG,CAAC,EAAE,OAAO,EAAE,QAAQ,EAAE,IAAI,EAAE,QAAQ,EAAoB,EAAE,EAAE;IACxF,iBAAiB,CAAC,QAAQ,EAAE,QAAQ,EAAE,gBAAgB,CAAC,CAAA;IACvD,MAAM,KAAK,GAAG,wBAAwB,CAAC,IAAI,CAAC,CAAA;IAC5C,MAAM,GAAG,GAAG,OAAO,CAAC,MAAM,CAAC,WAAW,CAAA;IACtC,IAAI,CAAC,GAAG,IAAI,KAAK,KAAK,SAAS,EAAE,CAAC;QAChC,OAAO,MAAM,CAAC,sBAAsB,EAAE,eAAe,QAAQ,sBAAsB,CAAC,CAAA;IACtF,CAAC;IACD,IAAI,KAAK,KAAK,GAAG,CAAC,sBAAsB,EAAE,CAAC;QACzC,MAAM,CAAC,gBAAgB,EAAE,yBAAyB,KAAK,cAAc,GAAG,CAAC,sBAAsB,EAAE,CAAC,CAAA;IACpG,CAAC;AACH,CAAC,CAAA;AAED;;;;;GAKG;AACH,MAAM,uBAAuB,GAAG,CAAC,EAAE,OAAO,EAAE,QAAQ,EAAE,sBAAsB,EAAoB,EAAE,EAAE;IAClG,MAAM,EAAE,MAAM,EAAE,GAAG,OAAO,CAAA;IAC1B,sBAAsB,CAAC,MAAM,CAAC,eAAe,CAAC,KAAK,CAAC,CAAA;IACpD,YAAY,CAAC,OAAO,EAAE,QAAQ,CAAC,MAAM,CAAC,eAAe,CAAC,KAAK,CAAC,EAAE,sBAAsB,CAAC,CAAA;IACrF,YAAY,CAAC,OAAO,EAAE,QAAQ,CAAC,MAAM,CAAC,eAAe,CAAC,MAAM,CAAC,EAAE,qBAAqB,CAAC,CAAA;IAErF,MAAM,IAAI,GAAG,QAAQ,CAAC,MAAM,CAAC,eAAe,CAAC,IAAI,CAAC,CAAA;IAClD,MAAM,EAAE,SAAS,EAAE,UAAU,EAAE,GAAG,MAAM,CAAC,KAAK,CAAC,UAAU,CAAA;IACzD,IAAI,IAAI,KAAK,SAAS,IAAI,IAAI,KAAK,UAAU,EAAE,CAAC;QAC9C,OAAO,MAAM,CAAC,iBAAiB,EAAE,iCAAiC,IAAI,EAAE,CAAC,CAAA;IAC3E,CAAC;IAED,MAAM,cAAc,GAAG,QAAQ,CAAC,MAAM,CAAC,eAAe,CAAC,YAAY,CAAC,CAAA;IACpE,MAAM,YAAY,GAAG,eAAe,CAAC,cAAc,CAAC,CAAA;IACpD,IAAI,CAAC,YAAY;QAAE,OAAO,MAAM,CAAC,mBAAmB,EAAE,iBAAiB,cAAc,EAAE,CAAC,CAAA;IAExF,MAAM,OAAO,GAAG,6BAA6B,CAC3C,IAAI,SAAS,CAAC,IAAI,CAAC,EACnB,IAAI,SAAS,CAAC,MAAM,CAAC,KAAK,CAAC,EAC3B,KAAK,EACL,YAAY,CACb,CAAC,QAAQ,EAAE,CAAA;IACZ,cAAc,CAAC,QAAQ,CAAC,MAAM,CAAC,eAAe,CAAC,OAAO,CAAC,EAAE,OAAO,EAAE,uBAAuB,CAAC,CAAA;AAC5F,CAAC,CAAA;AAED,MAAM,eAAe,GAAG,CAAC,SAAiB,EAAyB,EAAE;IACnE,IAAI,SAAS,KAAK,qBAAqB,CAAC,KAAK;QAAE,OAAO,gBAAgB,CAAA;IACtE,IAAI,SAAS,KAAK,qBAAqB,CAAC,SAAS;QAAE,OAAO,qBAAqB,CAAA;IAC/E,OAAO,SAAS,CAAA;AAClB,CAAC,CAAA;AAED;;;GAGG;AACH,MAAM,oBAAoB,GAAG,CAAC,EAAE,OAAO,EAAE,QAAQ,EAAE,IAAI,EAAE,QAAQ,EAAE,sBAAsB,EAAoB,EAAE,EAAE;IAC/G,MAAM,EAAE,MAAM,EAAE,GAAG,OAAO,CAAA;IAC1B,sBAAsB,CAAC,MAAM,CAAC,cAAc,CAAC,KAAK,CAAC,CAAA;IACnD,MAAM,QAAQ,GAAG,sBAAsB,CAAC,IAAI,CAAC,CAAA;IAC7C,IAAI,QAAQ,KAAK,SAAS,EAAE,CAAC;QAC3B,OAAO,MAAM,CAAC,sBAAsB,EAAE,eAAe,QAAQ,mBAAmB,CAAC,CAAA;IACnF,CAAC;IACD,YAAY,CAAC,OAAO,EAAE,QAAQ,CAAC,MAAM,CAAC,cAAc,CAAC,MAAM,CAAC,EAAE,qBAAqB,CAAC,CAAA;IACpF,uBAAuB,CAAC,OAAO,EAAE,QAAQ,CAAC,MAAM,CAAC,cAAc,CAAC,WAAW,CAAC,EAAE,0BAA0B,CAAC,CAAA;IAEzG,IAAI,CAAC,CAAC,SAAS,IAAI,MAAM,CAAC,SAAS,CAAC,EAAE,CAAC;QACrC,OAAO,MAAM,CAAC,4BAA4B,EAAE,wBAAwB,CAAC,CAAA;IACvE,CAAC;IACD,MAAM,QAAQ,GAAG,UAAU,CAAC,MAAM,CAAC,SAAS,CAAC,OAAO,CAAC,SAAS,EAAE,gBAAgB,CAAC,CAAA;IACjF,IAAI,QAAQ,KAAK,QAAQ,EAAE,CAAC;QAC1B,MAAM,CAAC,gBAAgB,EAAE,yBAAyB,QAAQ,cAAc,QAAQ,EAAE,CAAC,CAAA;IACrF,CAAC;AACH,CAAC,CAAA;AAED,MAAM,eAAe,GAAG,CAAC,EAAE,OAAO,EAAE,QAAQ,EAAE,sBAAsB,EAAoB,EAAE,EAAE;IAC1F,sBAAsB,CAAC,CAAC,CAAC,CAAA;IACzB,uBAAuB,CAAC,OAAO,EAAE,QAAQ,CAAC,CAAC,CAAC,EAAE,qBAAqB,CAAC,CAAA;AACtE,CAAC,CAAA;AAED;;;GAGG;AACH,MAAM,sBAAsB,GAAG,CAAC,EAAE,OAAO,EAAE,QAAQ,EAAE,sBAAsB,EAAoB,EAAE,EAAE;IACjG,sBAAsB,CAAC,MAAM,CAAC,YAAY,CAAC,KAAK,CAAC,CAAA;IACjD,MAAM,MAAM,GAAG,QAAQ,CAAC,MAAM,CAAC,YAAY,CAAC,OAAO,CAAC,CAAA;IACpD,IAAI,CAAC,OAAO,CAAC,iBAAiB,CAAC,GAAG,CAAC,MAAM,CAAC,IAAI,CAAC,OAAO,CAAC,iBAAiB,CAAC,GAAG,CAAC,MAAM,CAAC,EAAE,CAAC;QACrF,OAAO,MAAM,CAAC,uBAAuB,EAAE,wBAAwB,MAAM,EAAE,CAAC,CAAA;IAC1E,CAAC;IACD,YAAY,CAAC,OAAO,EAAE,QAAQ,CAAC,MAAM,CAAC,YAAY,CAAC,WAAW,CAAC,EAAE,iCAAiC,CAAC,CAAA;IACnG,YAAY,CAAC,OAAO,EAAE,QAAQ,CAAC,MAAM,CAAC,YAAY,CAAC,SAAS,CAAC,EAAE,0BAA0B,CAAC,CAAA;AAC5F,CAAC,CAAA;AAED,MAAM,kBAAkB,GAAG,CAAC,EAAE,OAAO,EAAE,QAAQ,EAAE,IAAI,EAAE,QAAQ,EAAE,sBAAsB,EAAoB,EAAE,EAAE;IAC7G,MAAM,EAAE,MAAM,EAAE,GAAG,OAAO,CAAA;IAC1B,sBAAsB,CAAC,MAAM,CAAC,aAAa,CAAC,YAAY,CAAC,CAAA;IACzD,IAAI,CAAC,CAAC,SAAS,IAAI,MAAM,CAAC,SAAS,CAAC,EAAE,CAAC;QACrC,OAAO,MAAM,CAAC,4BAA4B,EAAE,6BAA6B,CAAC,CAAA;IAC5E,CAAC;IACD,MAAM,EAAE,OAAO,EAAE,SAAS,EAAE,UAAU,EAAE,GAAG,MAAM,CAAC,KAAK,CAAC,UAAU,CAAA;IAClE,YAAY,CAAC,OAAO,EAAE,QAAQ,CAAC,MAAM,CAAC,aAAa,CAAC,IAAI,CAAC,EAAE,mBAAmB,CAAC,CAAA;IAC/E,cAAc,CAAC,QAAQ,CAAC,MAAM,CAAC,aAAa,CAAC,KAAK,CAAC,EAAE,OAAO,EAAE,OAAO,CAAC,CAAA;IACtE,cAAc,CAAC,QAAQ,CAAC,MAAM,CAAC,aAAa,CAAC,SAAS,CAAC,EAAE,SAAS,EAAE,oBAAoB,CAAC,CAAA;IACzF,cAAc,CAAC,QAAQ,CAAC,MAAM,CAAC,aAAa,CAAC,UAAU,CAAC,EAAE,UAAU,EAAE,qBAAqB,CAAC,CAAA;IAC5F,uBAAuB,CAAC,OAAO,EAAE,QAAQ,CAAC,MAAM,CAAC,aAAa,CAAC,gBAAgB,CAAC,EAAE,gBAAgB,CAAC,CAAA;IACnG,uBAAuB,CAAC,OAAO,EAAE,QAAQ,CAAC,MAAM,CAAC,aAAa,CAAC,gBAAgB,CAAC,EAAE,2BAA2B,CAAC,CAAA;IAC9G,mBAAmB,CAAC,IAAI,EAAE,QAAQ,EAAE,MAAM,CAAC,SAAS,CAAC,OAAO,CAAC,SAAS,EAAE,gBAAgB,CAAC,CAAA;AAC3F,CAAC,CAAA;AAED,MAAM,mBAAmB,GAAG,CAAC,EAAE,OAAO,EAAE,QAAQ,EAAE,IAAI,EAAE,QAAQ,EAAE,sBAAsB,EAAoB,EAAE,EAAE;IAC9G,MAAM,EAAE,MAAM,EAAE,GAAG,OAAO,CAAA;IAC1B,sBAAsB,CAAC,MAAM,CAAC,cAAc,CAAC,YAAY,CAAC,CAAA;IAC1D,IAAI,CAAC,CAAC,UAAU,IAAI,MAAM,CAAC,SAAS,CAAC,EAAE,CAAC;QACtC,OAAO,MAAM,CAAC,4BAA4B,EAAE,6BAA6B,CAAC,CAAA;IAC5E,CAAC;IACD,MAAM,EAAE,OAAO,EAAE,SAAS,EAAE,UAAU,EAAE,GAAG,MAAM,CAAC,KAAK,CAAC,UAAU,CAAA;IAClE,YAAY,CAAC,OAAO,EAAE,QAAQ,CAAC,MAAM,CAAC,cAAc,CAAC,IAAI,CAAC,EAAE,oBAAoB,CAAC,CAAA;IACjF,cAAc,CAAC,QAAQ,CAAC,MAAM,CAAC,cAAc,CAAC,KAAK,CAAC,EAAE,OAAO,EAAE,OAAO,CAAC,CAAA;IACvE,cAAc,CAAC,QAAQ,CAAC,MAAM,CAAC,cAAc,CAAC,SAAS,CAAC,EAAE,SAAS,EAAE,qBAAqB,CAAC,CAAA;IAC3F,cAAc,CAAC,QAAQ,CAAC,MAAM,CAAC,cAAc,CAAC,UAAU,CAAC,EAAE,UAAU,EAAE,sBAAsB,CAAC,CAAA;IAC9F,uBAAuB,CAAC,OAAO,EAAE,QAAQ,CAAC,MAAM,CAAC,cAAc,CAAC,gBAAgB,CAAC,EAAE,sBAAsB,CAAC,CAAA;IAC1G,uBAAuB,CAAC,OAAO,EAAE,QAAQ,CAAC,MAAM,CAAC,cAAc,CAAC,gBAAgB,CAAC,EAAE,uBAAuB,CAAC,CAAA;IAC3G,6EAA6E;IAC7E,0EAA0E;IAC1E,0EAA0E;IAC1E,gDAAgD;IAChD,mBAAmB,CAAC,IAAI,EAAE,QAAQ,EAAE,MAAM,CAAC,SAAS,CAAC,QAAQ,CAAC,MAAM,CAAC,SAAS,EAAE,uBAAuB,CAAC,CAAA;AAC1G,CAAC,CAAA;AAED,MAAM,wBAAwB,GAAG,CAAC,EAAE,OAAO,EAAE,QAAQ,EAAE,sBAAsB,EAAoB,EAAE,EAAE;IACnG,sBAAsB,CAAC,MAAM,CAAC,mBAAmB,CAAC,YAAY,CAAC,CAAA;IAC/D,YAAY,CAAC,OAAO,EAAE,QAAQ,CAAC,MAAM,CAAC,mBAAmB,CAAC,SAAS,CAAC,EAAE,qBAAqB,CAAC,CAAA;IAC5F,WAAW,CAAC,OAAO,EAAE,QAAQ,CAAC,MAAM,CAAC,mBAAmB,CAAC,IAAI,CAAC,CAAC,CAAA;AACjE,CAAC,CAAA;AAED;;;;GAIG;AACH,MAAM,eAAe,GAAG,CAAC,EAAE,OAAO,EAAE,QAAQ,EAAE,IAAI,EAAE,QAAQ,EAAE,sBAAsB,EAAoB,EAAE,EAAE;IAC1G,sBAAsB,CAAC,MAAM,CAAC,UAAU,CAAC,YAAY,CAAC,CAAA;IACtD,YAAY,CAAC,OAAO,EAAE,QAAQ,CAAC,MAAM,CAAC,UAAU,CAAC,KAAK,CAAC,EAAE,iBAAiB,CAAC,CAAA;IAC3E,WAAW,CAAC,OAAO,EAAE,QAAQ,CAAC,MAAM,CAAC,UAAU,CAAC,IAAI,CAAC,CAAC,CAAA;IACtD,uBAAuB,CAAC,OAAO,EAAE,QAAQ,CAAC,MAAM,CAAC,UAAU,CAAC,gBAAgB,CAAC,EAAE,cAAc,CAAC,CAAA;IAC9F,cAAc,CACZ,QAAQ,CAAC,MAAM,CAAC,UAAU,CAAC,UAAU,CAAC,EACtC,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,UAAU,CAAC,UAAU,EAC1C,mBAAmB,CACpB,CAAA;IAED,uEAAuE;IACvE,sEAAsE;IACtE,+DAA+D;IAC/D,MAAM,QAAQ,GAAG,iBAAiB,CAAC,IAAI,CAAC,CAAA;IACxC,IAAI,QAAQ,KAAK,SAAS,EAAE,CAAC;QAC3B,OAAO,MAAM,CAAC,sBAAsB,EAAE,eAAe,QAAQ,wBAAwB,CAAC,CAAA;IACxF,CAAC;IACD,IAAI,QAAQ,KAAK,kBAAkB,EAAE,CAAC;QACpC,MAAM,CAAC,gBAAgB,EAAE,0BAA0B,QAAQ,cAAc,kBAAkB,EAAE,CAAC,CAAA;IAChG,CAAC;AACH,CAAC,CAAA;AAED;;;;;;;;;GASG;AACH,MAAM,iBAAiB,GAAG,CAAC,EAAE,OAAO,EAAE,QAAQ,EAAE,IAAI,EAAE,QAAQ,EAAE,sBAAsB,EAAoB,EAAE,EAAE;IAC5G,MAAM,EAAE,MAAM,EAAE,GAAG,OAAO,CAAA;IAC1B,sBAAsB,CAAC,MAAM,CAAC,YAAY,CAAC,YAAY,CAAC,CAAA;IACxD,IAAI,CAAC,CAAC,UAAU,IAAI,MAAM,CAAC,SAAS,CAAC,EAAE,CAAC;QACtC,OAAO,MAAM,CAAC,4BAA4B,EAAE,2BAA2B,CAAC,CAAA;IAC1E,CAAC;IACD,YAAY,CAAC,OAAO,EAAE,QAAQ,CAAC,MAAM,CAAC,YAAY,CAAC,KAAK,CAAC,EAAE,mBAAmB,CAAC,CAAA;IAC/E,WAAW,CAAC,OAAO,EAAE,QAAQ,CAAC,MAAM,CAAC,YAAY,CAAC,IAAI,CAAC,CAAC,CAAA;IACxD,oBAAoB,CAAC,OAAO,EAAE,QAAQ,CAAC,MAAM,CAAC,YAAY,CAAC,SAAS,CAAC,CAAC,CAAA;IAEtE,MAAM,MAAM,GAAG,kBAAkB,CAAC,IAAI,CAAC,CAAA;IACvC,IAAI,MAAM,KAAK,SAAS,EAAE,CAAC;QACzB,OAAO,MAAM,CAAC,sBAAsB,EAAE,eAAe,QAAQ,0BAA0B,CAAC,CAAA;IAC1F,CAAC;IACD,MAAM,QAAQ,GAAG,mBAAmB,CAAC,MAAM,CAAC,SAAS,CAAC,QAAQ,CAAC,CAAC,SAAS,GAAG,qBAAqB,CAAA;IACjG,IAAI,MAAM,KAAK,QAAQ,EAAE,CAAC;QACxB,MAAM,CAAC,gBAAgB,EAAE,4BAA4B,MAAM,cAAc,QAAQ,EAAE,CAAC,CAAA;IACtF,CAAC;AACH,CAAC,CAAA;AAED;;;;;;GAMG;AACH,MAAM,kCAAkC,GAAG,CAAC,EAC1C,OAAO,EACP,QAAQ,EACR,IAAI,EACJ,QAAQ,EACR,sBAAsB,GACL,EAAE,EAAE;IACrB,sBAAsB,CAAC,MAAM,CAAC,6BAA6B,CAAC,YAAY,CAAC,CAAA;IACzE,IAAI,CAAC,CAAC,UAAU,IAAI,OAAO,CAAC,MAAM,CAAC,SAAS,CAAC,EAAE,CAAC;QAC9C,OAAO,MAAM,CAAC,4BAA4B,EAAE,6CAA6C,CAAC,CAAA;IAC5F,CAAC;IACD,IAAI,CAAC,mBAAmB,CAAC,IAAI,CAAC,EAAE,CAAC;QAC/B,OAAO,MAAM,CAAC,sBAAsB,EAAE,eAAe,QAAQ,oDAAoD,CAAC,CAAA;IACpH,CAAC;IACD,YAAY,CAAC,OAAO,EAAE,QAAQ,CAAC,MAAM,CAAC,6BAA6B,CAAC,KAAK,CAAC,EAAE,qCAAqC,CAAC,CAAA;IAClH,WAAW,CAAC,OAAO,EAAE,QAAQ,CAAC,MAAM,CAAC,6BAA6B,CAAC,IAAI,CAAC,CAAC,CAAA;IACzE,oBAAoB,CAAC,OAAO,EAAE,QAAQ,CAAC,MAAM,CAAC,6BAA6B,CAAC,SAAS,CAAC,CAAC,CAAA;IACvF,uBAAuB,CACrB,OAAO,EACP,QAAQ,CAAC,MAAM,CAAC,6BAA6B,CAAC,gBAAgB,CAAC,EAC/D,4BAA4B,CAC7B,CAAA;AACH,CAAC,CAAA;AAED;;;;;;;GAOG;AACH,MAAM,oBAAoB,GAAG,CAAC,EAAE,QAAQ,EAAE,IAAI,EAAE,QAAQ,EAAoB,EAAE,EAAE;IAC9E,iBAAiB,CAAC,QAAQ,EAAE,QAAQ,EAAE,kBAAkB,CAAC,CAAA;IACzD,IAAI,CAAC,qBAAqB,CAAC,IAAI,CAAC,EAAE,CAAC;QACjC,MAAM,CAAC,sBAAsB,EAAE,eAAe,QAAQ,oBAAoB,CAAC,CAAA;IAC7E,CAAC;AACH,CAAC,CAAA;AAED;;;;;GAKG;AACH,MAAM,iBAAiB,GAAqE;IAC1F,gBAAgB,EAAE,qBAAqB;IACvC,gBAAgB,EAAE,qBAAqB;IACvC,kBAAkB,EAAE,uBAAuB;IAC3C,eAAe,EAAE,oBAAoB;IACrC,UAAU,EAAE,eAAe;IAC3B,iBAAiB,EAAE,sBAAsB;IACzC,aAAa,EAAE,kBAAkB;IACjC,cAAc,EAAE,mBAAmB;IACnC,mBAAmB,EAAE,wBAAwB;IAC7C,UAAU,EAAE,eAAe;IAC3B,YAAY,EAAE,iBAAiB;IAC/B,6BAA6B,EAAE,kCAAkC;IACjE,eAAe,EAAE,oBAAoB;CACtC,CAAA;AAED,MAAM,mBAAmB,GAAG,CAAC,OAAgB,EAAE,IAA2B,EAAE,QAAgB,EAAE,EAAE;IAC9F,MAAM,QAAQ,GAAG,mBAAmB,CAAC,OAAO,EAAE,QAAQ,CAAC,CAAA;IACvD,iBAAiB,CAAC,IAAI,CAAC,CAAC;QACtB,OAAO;QACP,QAAQ;QACR,IAAI,EAAE,OAAO,CAAC,WAAW,CAAC,OAAO,CAAC,oBAAoB,CAAC,QAAQ,CAAC,CAAC,IAAI;QACrE,QAAQ;QACR,sBAAsB,EAAE,OAAO,CAAC,EAAE;YAChC,IAAI,QAAQ,CAAC,MAAM,GAAG,OAAO,EAAE,CAAC;gBAC9B,MAAM,CACJ,sBAAsB,EACtB,eAAe,QAAQ,KAAK,yBAAyB,CAAC,IAAI,CAAC,UAAU,OAAO,WAAW,CACxF,CAAA;YACH,CAAC;QACH,CAAC;KACF,CAAC,CAAA;AACJ,CAAC,CAAA;AAED;;;;;;;;GAQG;AACH,MAAM,wBAAwB,GAAG,CAAC,OAAgB,EAAE,EAAE;IACpD,MAAM,EAAE,WAAW,EAAE,QAAQ,EAAE,QAAQ,EAAE,GAAG,OAAO,CAAA;IACnD,MAAM,YAAY,GAAG,WAAW,CAAC,OAAO,CAAC,oBAAoB,CAAA;IAE7D,MAAM,UAAU,GAAG,IAAI,GAAG,EAAU,CAAA;IACpC,KAAK,MAAM,WAAW,IAAI,YAAY,EAAE,CAAC;QACvC,KAAK,MAAM,KAAK,IAAI,WAAW,CAAC,iBAAiB;YAAE,UAAU,CAAC,GAAG,CAAC,KAAK,CAAC,CAAA;IAC1E,CAAC;IACD,KAAK,IAAI,KAAK,GAAG,CAAC,EAAE,KAAK,GAAG,QAAQ,CAAC,MAAM,EAAE,KAAK,EAAE,EAAE,CAAC;QACrD,IAAI,uBAAuB,CAAC,EAAE,WAAW,EAAE,KAAK,EAAE,CAAC,IAAI,CAAC,UAAU,CAAC,GAAG,CAAC,KAAK,CAAC,EAAE,CAAC;YAC9E,MAAM,CAAC,6BAA6B,EAAE,QAAQ,CAAC,KAAK,CAAC,CAAC,CAAA;QACxD,CAAC;IACH,CAAC;IAED,KAAK,IAAI,QAAQ,GAAG,CAAC,EAAE,QAAQ,GAAG,YAAY,CAAC,MAAM,EAAE,QAAQ,EAAE,EAAE,CAAC;QAClE,MAAM,OAAO,GAAG,QAAQ,CAAC,QAAQ,CAAC,CAAA;QAClC,IAAI,CAAC,OAAO,IAAI,CAAC,wBAAwB,CAAC,OAAO,CAAC;YAAE,SAAQ;QAC5D,KAAK,MAAM,KAAK,IAAI,YAAY,CAAC,QAAQ,CAAC,CAAC,iBAAiB,EAAE,CAAC;YAC7D,IAAI,CAAC,uBAAuB,CAAC,EAAE,WAAW,EAAE,KAAK,EAAE,CAAC;gBAAE,SAAQ;YAC9D,MAAM,OAAO,GAAG,QAAQ,CAAC,KAAK,CAAC,CAAA;YAC/B,IAAI,CAAC,OAAO,CAAC,iBAAiB,CAAC,GAAG,CAAC,OAAO,CAAC,EAAE,CAAC;gBAC5C,MAAM,CAAC,+BAA+B,EAAE,GAAG,OAAO,WAAW,OAAO,EAAE,CAAC,CAAA;YACzE,CAAC;QACH,CAAC;IACH,CAAC;AACH,CAAC,CAAA;AAED;;;;;;;;;;;;;;;;;;;;;;;;;GAyBG;AACH,MAAM,CAAC,MAAM,yBAAyB,GAAG,CAAC,EACxC,WAAW,EACX,MAAM,EACN,YAAY,GAMb,EAAQ,EAAE;IACT,MAAM,YAAY,GAAG,MAAM,CAAC,KAAK,CAAC,UAAU,CAAC,OAAO,CAAA;IACpD,MAAM,UAAU,GAAG,wBAAwB,CAAC,YAAY,CAAC,CAAA;IACzD,IAAI,CAAC,UAAU;QAAE,OAAO,MAAM,CAAC,iBAAiB,EAAE,YAAY,CAAC,CAAA;IAC/D,4EAA4E;IAC5E,sEAAsE;IACtE,4EAA4E;IAC5E,yEAAyE;IACzE,2EAA2E;IAC3E,iBAAiB;IACjB,IAAI,UAAU,KAAK,MAAM,CAAC,KAAK,CAAC,UAAU,EAAE,CAAC;QAC3C,OAAO,MAAM,CAAC,yBAAyB,EAAE,YAAY,CAAC,CAAA;IACxD,CAAC;IAED,IAAI,CAAC,sBAAsB,CAAC,WAAW,EAAE,MAAM,CAAC,KAAK,CAAC,EAAE,CAAC;QACvD,OAAO,MAAM,CAAC,kBAAkB,EAAE,6DAA6D,CAAC,CAAA;IAClG,CAAC;IAED,0EAA0E;IAC1E,0EAA0E;IAC1E,4EAA4E;IAC5E,+DAA+D;IAC/D,MAAM,OAAO,GAAG,WAAW,CAAC,OAAO,CAAC,mBAAmB,CAAA;IACvD,IAAI,OAAO,CAAC,MAAM,GAAG,CAAC;QAAE,OAAO,MAAM,CAAC,uBAAuB,EAAE,GAAG,OAAO,CAAC,MAAM,gBAAgB,CAAC,CAAA;IACjG,KAAK,MAAM,MAAM,IAAI,OAAO,EAAE,CAAC;QAC7B,MAAM,OAAO,GAAG,MAAM,CAAC,UAAU,CAAC,QAAQ,EAAE,CAAA;QAC5C,IAAI,OAAO,KAAK,MAAM,CAAC,KAAK,CAAC,WAAW,EAAE,CAAC;YACzC,OAAO,MAAM,CAAC,uBAAuB,EAAE,GAAG,OAAO,cAAc,MAAM,CAAC,KAAK,CAAC,WAAW,EAAE,CAAC,CAAA;QAC5F,CAAC;IACH,CAAC;IAED,MAAM,QAAQ,GAAG,6BAA6B,CAAC,EAAE,WAAW,EAAE,YAAY,EAAE,CAAC,CAAA;IAC7E,IAAI,CAAC,QAAQ,IAAI,QAAQ,CAAC,MAAM,KAAK,uBAAuB,CAAC,WAAW,CAAC,EAAE,CAAC;QAC1E,OAAO,MAAM,CAAC,mBAAmB,EAAE,kDAAkD,CAAC,CAAA;IACxF,CAAC;IAED,MAAM,YAAY,GAAG,WAAW,CAAC,OAAO,CAAC,oBAAoB,CAAA;IAC7D,MAAM,QAAQ,GAAG,YAAY,CAAC,GAAG,CAAC,WAAW,CAAC,EAAE,CAAC,oBAAoB,CAAC,QAAQ,CAAC,WAAW,CAAC,cAAc,CAAC,CAAC,CAAC,CAAA;IAC5G,KAAK,IAAI,QAAQ,GAAG,CAAC,EAAE,QAAQ,GAAG,QAAQ,CAAC,MAAM,EAAE,QAAQ,EAAE,EAAE,CAAC;QAC9D,IAAI,CAAC,QAAQ,CAAC,QAAQ,CAAC,EAAE,CAAC;YACxB,OAAO,MAAM,CACX,mBAAmB,EACnB,eAAe,QAAQ,YAAY,QAAQ,CAAC,YAAY,CAAC,QAAQ,CAAC,CAAC,cAAc,CAAC,EAAE,CACrF,CAAA;QACH,CAAC;IACH,CAAC;IAED,4EAA4E;IAC5E,qEAAqE;IACrE,qEAAqE;IACrE,iCAAiC;IACjC,IAAI,CAAC,MAAM,CAAC,WAAW,IAAI,QAAQ,CAAC,QAAQ,CAAC,eAAe,CAAC,EAAE,CAAC;QAC9D,OAAO,MAAM,CAAC,uBAAuB,EAAE,6CAA6C,CAAC,CAAA;IACvF,CAAC;IACD,IAAI,CAAC,MAAM,CAAC,sBAAsB,IAAI,QAAQ,CAAC,QAAQ,CAAC,MAAM,CAAC,EAAE,CAAC;QAChE,OAAO,MAAM,CAAC,gBAAgB,EAAE,mCAAmC,CAAC,CAAA;IACtE,CAAC;IAED,MAAM,iBAAiB,GAAG,uBAAuB,CAAC,EAAE,KAAK,EAAE,MAAM,CAAC,KAAK,EAAE,IAAI,EAAE,MAAM,CAAC,KAAK,CAAC,UAAU,CAAC,SAAS,EAAE,CAAC,CAAA;IACnH,MAAM,iBAAiB,GAAG,uBAAuB,CAAC,EAAE,KAAK,EAAE,MAAM,CAAC,KAAK,EAAE,IAAI,EAAE,MAAM,CAAC,KAAK,CAAC,UAAU,CAAC,UAAU,EAAE,CAAC,CAAA;IACpH,IAAI,iBAAiB,CAAC,IAAI,KAAK,CAAC,IAAI,iBAAiB,CAAC,IAAI,KAAK,CAAC,EAAE,CAAC;QACjE,OAAO,MAAM,CAAC,kBAAkB,EAAE,sCAAsC,CAAC,CAAA;IAC3E,CAAC;IAED,MAAM,OAAO,GAAY;QACvB,MAAM;QACN,WAAW;QACX,QAAQ;QACR,QAAQ;QACR,iBAAiB;QACjB,iBAAiB;QACjB,iBAAiB,EAAE,IAAI,GAAG,CAAC;YACzB,GAAG,iBAAiB;YACpB,GAAG,iBAAiB;YACpB,MAAM,CAAC,KAAK;YACZ,MAAM,CAAC,KAAK,CAAC,UAAU,CAAC,OAAO;YAC/B,MAAM,CAAC,KAAK,CAAC,UAAU,CAAC,SAAS;YACjC,MAAM,CAAC,KAAK,CAAC,UAAU,CAAC,UAAU;SACnC,CAAC;KACH,CAAA;IAED,MAAM,KAAK,GAAG,YAAY,CAAC,GAAG,CAAC,CAAC,WAAW,EAAE,QAAQ,EAAE,EAAE,CAAC,qBAAqB,CAAC,QAAQ,CAAC,QAAQ,CAAC,EAAE,WAAW,CAAC,IAAI,CAAC,CAAC,CAAA;IACtH,MAAM,KAAK,GAAG,sBAAsB,CAAC;QACnC,SAAS,EAAE,aAAa,CAAC,MAAM,CAAC;QAChC,iBAAiB,EAAE,MAAM,CAAC,KAAK,CAAC,UAAU,CAAC,SAAS,KAAK,YAAY,CAAC,cAAc;QACpF,OAAO,EAAE,MAAM,CAAC,KAAK,CAAC,UAAU,CAAC,IAAI,KAAK,SAAS;QACnD,cAAc,EAAE,MAAM,CAAC,WAAW,KAAK,SAAS;QAChD,kBAAkB,EAAE,MAAM,CAAC,sBAAsB;QACjD,uEAAuE;QACvE,0EAA0E;QAC1E,0EAA0E;QAC1E,kCAAkC;QAClC,WAAW,EACT,UAAU,IAAI,MAAM,CAAC,SAAS;YAC5B,CAAC,CAAC,mBAAmB,CAAC,MAAM,CAAC,SAAS,CAAC,QAAQ,CAAC,CAAC,SAAS,GAAG,EAAE;gBAC7D,CAAC,CAAC,UAAU;gBACZ,CAAC,CAAC,WAAW;YACf,CAAC,CAAC,WAAW;KAClB,CAAC,CAAA;IAEF,MAAM,OAAO,GAAG,mBAAmB,CAAC,KAAK,EAAE,KAAK,CAAC,CAAA;IACjD,IAAI,UAAU,IAAI,OAAO,EAAE,CAAC;QAC1B,MAAM,EAAE,QAAQ,EAAE,GAAG,OAAO,CAAA;QAC5B,IAAI,uBAAuB,IAAI,QAAQ,EAAE,CAAC;YACxC,OAAO,MAAM,CAAC,uBAAuB,EAAE,eAAe,QAAQ,CAAC,qBAAqB,CAAC,KAAK,EAAE,CAAC,CAAA;QAC/F,CAAC;QACD,OAAO,MAAM,CACX,oBAAoB,EACpB,oBAAoB,IAAI,QAAQ,CAAC,CAAC,CAAC,QAAQ,CAAC,kBAAkB,CAAC,CAAC,CAAC,QAAQ,CAAC,yBAAyB,CACpG,CAAA;IACH,CAAC;IAED,OAAO,CAAC,OAAO,CAAC,OAAO,CAAC,CAAC,IAAI,EAAE,QAAQ,EAAE,EAAE,CAAC,mBAAmB,CAAC,OAAO,EAAE,IAAI,EAAE,QAAQ,CAAC,CAAC,CAAA;IACzF,wBAAwB,CAAC,OAAO,CAAC,CAAA;AACnC,CAAC,CAAA;AAED;;;;;;;;GAQG;AACH,MAAM,CAAC,MAAM,+BAA+B,GAAG,KAAK,EAAE,EACpD,WAAW,EACX,MAAM,GAIP,EAAiB,EAAE;IAClB,MAAM,YAAY,GAAG,MAAM,yBAAyB,CAAC,WAAW,CAAC,CAAA;IACjE,yBAAyB,CAAC,EAAE,WAAW,EAAE,MAAM,EAAE,YAAY,EAAE,CAAC,CAAA;AAClE,CAAC,CAAA"}