@waiaas/daemon 2.0.0-rc.1

package/dist/api/routes/x402.js

@@ -0,0 +1,493 @@
+/**
+ * x402 Routes: POST /v1/x402/fetch
+ *
+ * Orchestrates x402 auto-payment flow:
+ * 1. Config check (x402.enabled)
+ * 2. Domain policy evaluation (X402_ALLOWED_DOMAINS -- default deny)
+ * 3. SSRF guard + initial HTTP request
+ * 4. Non-402 passthrough (no DB record)
+ * 5. 402 parsing + scheme selection
+ * 6. Transaction record (type=X402_PAYMENT)
+ * 7. USD resolution + SPENDING_LIMIT evaluation (evaluateAndReserve)
+ * 8. DELAY/APPROVAL tier handling
+ * 9. Payment signing + retry request
+ * 10. DB update (CONFIRMED/FAILED) + notification triggers
+ *
+ * @see packages/daemon/src/services/x402/x402-handler.ts (parse402Response, selectPaymentRequirement)
+ * @see packages/daemon/src/services/x402/x402-domain-policy.ts (evaluateX402Domain)
+ * @see packages/daemon/src/services/x402/x402-usd-resolver.ts (resolveX402UsdAmount)
+ */
+import { OpenAPIHono, createRoute, z } from '@hono/zod-openapi';
+import { eq, or, and, isNull, desc } from 'drizzle-orm';
+import { WAIaaSError, resolveX402Network, CAIP2_TO_NETWORK } from '@waiaas/core';
+import { wallets, transactions, policies } from '../../infrastructure/database/schema.js';
+import { generateId } from '../../infrastructure/database/id.js';
+import { evaluateX402Domain } from '../../services/x402/x402-domain-policy.js';
+import { resolveX402UsdAmount } from '../../services/x402/x402-usd-resolver.js';
+import { parse402Response, selectPaymentRequirement } from '../../services/x402/x402-handler.js';
+import { validateUrlSafety, safeFetchWithRedirects } from '../../services/x402/ssrf-guard.js';
+import { signPayment } from '../../services/x402/payment-signer.js';
+import { buildErrorResponses, openApiValidationHook } from './openapi-schemas.js';
+// ---------------------------------------------------------------------------
+// Helpers
+// ---------------------------------------------------------------------------
+const sleep = (ms) => new Promise((resolve) => setTimeout(resolve, ms));
+/**
+ * Encode a payment payload as a base64 PAYMENT-SIGNATURE header value.
+ */
+function encodePaymentSignatureHeader(paymentPayload) {
+    const json = JSON.stringify(paymentPayload);
+    return Buffer.from(json, 'utf-8').toString('base64');
+}
+/**
+ * Build a passthrough response object from a non-402 fetch response.
+ */
+async function buildPassthroughResponse(response) {
+    const body = await response.text();
+    const headers = {};
+    response.headers.forEach((value, key) => {
+        headers[key] = value;
+    });
+    return { status: response.status, headers, body };
+}
+// ---------------------------------------------------------------------------
+// Route definition (OpenAPIHono createRoute)
+// ---------------------------------------------------------------------------
+const x402FetchRoute = createRoute({
+    method: 'post',
+    path: '/x402/fetch',
+    tags: ['x402'],
+    summary: 'Fetch URL with x402 auto-payment',
+    description: 'Proxy an HTTP request to an external URL. If the server responds with ' +
+        'HTTP 402, automatically sign a payment and retry. Policy evaluation ' +
+        '(X402_ALLOWED_DOMAINS, SPENDING_LIMIT) is applied before payment.',
+    request: {
+        body: {
+            content: {
+                'application/json': {
+                    schema: z.object({
+                        url: z.string().url(),
+                        method: z.enum(['GET', 'POST', 'PUT', 'DELETE', 'PATCH']).default('GET'),
+                        headers: z.record(z.string()).optional(),
+                        body: z.string().optional(),
+                    }),
+                },
+            },
+        },
+    },
+    responses: {
+        200: {
+            description: 'Response from the external server (with optional payment info)',
+            content: {
+                'application/json': {
+                    schema: z.object({
+                        status: z.number().int(),
+                        headers: z.record(z.string()),
+                        body: z.string(),
+                        payment: z.object({
+                            amount: z.string(),
+                            asset: z.string(),
+                            network: z.string(),
+                            payTo: z.string(),
+                            txId: z.string(),
+                        }).optional(),
+                    }),
+                },
+            },
+        },
+        ...buildErrorResponses([
+            'X402_DISABLED',
+            'X402_DOMAIN_NOT_ALLOWED',
+            'X402_SSRF_BLOCKED',
+            'X402_UNSUPPORTED_SCHEME',
+            'X402_PAYMENT_REJECTED',
+            'X402_DELAY_TIMEOUT',
+            'X402_APPROVAL_REQUIRED',
+            'X402_SERVER_ERROR',
+            'WALLET_NOT_FOUND',
+            'POLICY_DENIED',
+        ]),
+    },
+});
+// ---------------------------------------------------------------------------
+// Route factory
+// ---------------------------------------------------------------------------
+/**
+ * Create x402 route sub-router.
+ *
+ * POST /x402/fetch -> proxy URL with x402 auto-payment
+ */
+export function x402Routes(deps) {
+    const router = new OpenAPIHono({ defaultHook: openApiValidationHook });
+    router.openapi(x402FetchRoute, async (c) => {
+        // -----------------------------------------------------------------------
+        // Phase A: Pre-payment validation
+        // -----------------------------------------------------------------------
+        // A1. Check x402 enabled
+        if (!deps.config.x402?.enabled) {
+            throw new WAIaaSError('X402_DISABLED', {
+                message: 'x402 payments are disabled in configuration',
+            });
+        }
+        // A2. Extract walletId + sessionId from sessionAuth context
+        const walletId = c.get('walletId');
+        const sessionId = c.get('sessionId');
+        // A3. Parse request body
+        const body = c.req.valid('json');
+        const targetUrl = new URL(body.url);
+        const targetDomain = targetUrl.hostname;
+        // A4. Look up wallet
+        const wallet = await deps.db.select().from(wallets).where(eq(wallets.id, walletId)).get();
+        if (!wallet) {
+            throw new WAIaaSError('WALLET_NOT_FOUND', {
+                message: `Wallet '${walletId}' not found`,
+            });
+        }
+        // A5. Load X402_ALLOWED_DOMAINS policy and evaluate domain
+        // 4-level override: wallet+network > wallet+null > global+network > global+null
+        const policyRows = await deps.db
+            .select()
+            .from(policies)
+            .where(and(or(eq(policies.walletId, walletId), isNull(policies.walletId)), eq(policies.type, 'X402_ALLOWED_DOMAINS'), eq(policies.enabled, true)))
+            .orderBy(desc(policies.priority))
+            .all();
+        // Apply 4-level override resolution for domain policies
+        const resolvedPolicies = resolveX402DomainPolicies(policyRows, walletId);
+        const domainResult = evaluateX402Domain(resolvedPolicies, targetDomain);
+        if (domainResult && !domainResult.allowed) {
+            void deps.notificationService?.notify('POLICY_VIOLATION', walletId, {
+                reason: domainResult.reason ?? 'Domain not allowed',
+                type: 'X402_ALLOWED_DOMAINS',
+            });
+            throw new WAIaaSError('X402_DOMAIN_NOT_ALLOWED', {
+                message: domainResult.reason ?? `Domain '${targetDomain}' not allowed for x402 payments`,
+            });
+        }
+        // A6. SSRF guard + initial HTTP request
+        const validatedUrl = await validateUrlSafety(body.url);
+        const response = await safeFetchWithRedirects(validatedUrl, body.method ?? 'GET', body.headers, body.body);
+        // A7. Non-402 passthrough (no DB record, no policy evaluation)
+        if (response.status !== 402) {
+            const passthrough = await buildPassthroughResponse(response);
+            return c.json(passthrough, 200);
+        }
+        // -----------------------------------------------------------------------
+        // Phase B: 402 detected -- payment flow
+        // -----------------------------------------------------------------------
+        // B1. Parse 402 response
+        const paymentRequired = await parse402Response(response);
+        // B2. Determine supported networks from CAIP2_TO_NETWORK
+        const supportedNetworks = new Set(Object.keys(CAIP2_TO_NETWORK));
+        // B3. Select best payment requirement
+        const selected = selectPaymentRequirement(paymentRequired.accepts, supportedNetworks);
+        // B4. Resolve chain + network from CAIP-2
+        const resolved = resolveX402Network(selected.network);
+        const resolvedChain = resolved.chain;
+        const resolvedNetwork = resolved.network;
+        // B5. Generate transaction ID + INSERT into DB
+        const txId = generateId();
+        const nowTs = new Date(Math.floor(Date.now() / 1000) * 1000);
+        await deps.db.insert(transactions).values({
+            id: txId,
+            walletId,
+            chain: resolvedChain,
+            network: resolvedNetwork,
+            type: 'X402_PAYMENT',
+            status: 'PENDING',
+            amount: selected.amount,
+            toAddress: selected.payTo,
+            sessionId: sessionId ?? null,
+            metadata: JSON.stringify({
+                target_url: body.url,
+                payment_amount: selected.amount,
+                network: selected.network,
+                asset: selected.asset,
+                scheme: selected.scheme,
+            }),
+            createdAt: nowTs,
+        });
+        // B6. TX_REQUESTED notification (fire-and-forget)
+        void deps.notificationService?.notify('TX_REQUESTED', walletId, {
+            amount: selected.amount,
+            to: selected.payTo,
+            type: 'X402_PAYMENT',
+            display_amount: '', // x402: USD-based payments, no forex conversion needed
+        }, { txId });
+        // v1.6: emit wallet:activity TX_REQUESTED event
+        deps.eventBus?.emit('wallet:activity', {
+            walletId,
+            activity: 'TX_REQUESTED',
+            details: { txId, type: 'X402_PAYMENT' },
+            timestamp: Math.floor(Date.now() / 1000),
+        });
+        // B7. USD resolution for SPENDING_LIMIT evaluation
+        const usdAmount = await resolveX402UsdAmount(selected.amount, selected.asset, selected.network, deps.priceOracle);
+        // B8. SPENDING_LIMIT evaluation via evaluateAndReserve (TOCTOU prevention)
+        const evaluation = deps.policyEngine.evaluateAndReserve(walletId, {
+            type: 'TRANSFER',
+            amount: selected.amount,
+            toAddress: selected.payTo,
+            chain: resolvedChain,
+            network: resolvedNetwork,
+        }, txId, usdAmount);
+        // B9. Handle policy denial
+        if (!evaluation.allowed) {
+            await deps.db
+                .update(transactions)
+                .set({ status: 'CANCELLED', tier: evaluation.tier, error: evaluation.reason ?? 'Policy denied' })
+                .where(eq(transactions.id, txId));
+            deps.policyEngine.releaseReservation(txId);
+            void deps.notificationService?.notify('TX_FAILED', walletId, {
+                reason: evaluation.reason ?? 'Policy denied',
+                amount: selected.amount,
+                display_amount: '',
+            }, { txId });
+            // v1.6: emit transaction:failed event (policy denial)
+            deps.eventBus?.emit('transaction:failed', {
+                walletId,
+                txId,
+                error: evaluation.reason ?? 'Policy denied',
+                network: resolvedNetwork,
+                type: 'X402_PAYMENT',
+                timestamp: Math.floor(Date.now() / 1000),
+            });
+            throw new WAIaaSError('POLICY_DENIED', {
+                message: evaluation.reason ?? 'Transaction denied by spending limit policy',
+            });
+        }
+        // B10. Handle APPROVAL tier -- immediate rejection
+        if (evaluation.tier === 'APPROVAL') {
+            await deps.db
+                .update(transactions)
+                .set({ status: 'CANCELLED', tier: 'APPROVAL', error: 'X402_APPROVAL_REQUIRED' })
+                .where(eq(transactions.id, txId));
+            deps.policyEngine.releaseReservation(txId);
+            void deps.notificationService?.notify('TX_FAILED', walletId, {
+                reason: 'x402 payment requires owner approval (amount too high)',
+                amount: selected.amount,
+                display_amount: '',
+            }, { txId });
+            // v1.6: emit transaction:failed event (approval required)
+            deps.eventBus?.emit('transaction:failed', {
+                walletId,
+                txId,
+                error: 'x402 payment requires owner approval (amount too high)',
+                network: resolvedNetwork,
+                type: 'X402_PAYMENT',
+                timestamp: Math.floor(Date.now() / 1000),
+            });
+            throw new WAIaaSError('X402_APPROVAL_REQUIRED', {
+                message: 'x402 payment requires owner approval (amount too high)',
+            });
+        }
+        // B11. Handle DELAY tier
+        if (evaluation.tier === 'DELAY') {
+            const delaySeconds = evaluation.delaySeconds ?? deps.config.security.policy_defaults_delay_seconds;
+            const requestTimeout = deps.config.x402?.request_timeout ?? 30;
+            if (delaySeconds > requestTimeout) {
+                await deps.db
+                    .update(transactions)
+                    .set({ status: 'CANCELLED', tier: 'DELAY', error: 'X402_DELAY_TIMEOUT' })
+                    .where(eq(transactions.id, txId));
+                deps.policyEngine.releaseReservation(txId);
+                void deps.notificationService?.notify('TX_FAILED', walletId, {
+                    reason: `Delay ${delaySeconds}s exceeds request timeout ${requestTimeout}s`,
+                    amount: selected.amount,
+                    display_amount: '',
+                }, { txId });
+                // v1.6: emit transaction:failed event (delay timeout)
+                deps.eventBus?.emit('transaction:failed', {
+                    walletId,
+                    txId,
+                    error: `Delay ${delaySeconds}s exceeds request timeout ${requestTimeout}s`,
+                    network: resolvedNetwork,
+                    type: 'X402_PAYMENT',
+                    timestamp: Math.floor(Date.now() / 1000),
+                });
+                throw new WAIaaSError('X402_DELAY_TIMEOUT', {
+                    message: `Delay of ${delaySeconds}s exceeds x402 request timeout of ${requestTimeout}s`,
+                });
+            }
+            // Delay is within timeout -- wait then proceed
+            await sleep(delaySeconds * 1000);
+        }
+        // B12. Update tier on transaction
+        await deps.db
+            .update(transactions)
+            .set({ tier: evaluation.tier })
+            .where(eq(transactions.id, txId));
+        // -----------------------------------------------------------------------
+        // Phase C: Payment signing + retry
+        // -----------------------------------------------------------------------
+        try {
+            // C1. Sign payment
+            const paymentPayload = await signPayment(selected, deps.keyStore, walletId, wallet.publicKey, deps.masterPassword);
+            // Fill resource.url in the payment payload
+            paymentPayload.resource = { url: body.url };
+            // C2. Encode PAYMENT-SIGNATURE header
+            const encodedSignature = encodePaymentSignatureHeader(paymentPayload);
+            const retryHeaders = {
+                ...(body.headers ?? {}),
+                'PAYMENT-SIGNATURE': encodedSignature,
+            };
+            // C3. Re-request with payment signature
+            const retryResponse = await safeFetchWithRedirects(validatedUrl, body.method ?? 'GET', retryHeaders, body.body);
+            // C4. Handle retry response
+            if (retryResponse.status === 402) {
+                // Payment rejected by server
+                await deps.db
+                    .update(transactions)
+                    .set({ status: 'FAILED', error: 'X402_PAYMENT_REJECTED' })
+                    .where(eq(transactions.id, txId));
+                deps.policyEngine.releaseReservation(txId);
+                void deps.notificationService?.notify('TX_FAILED', walletId, {
+                    reason: 'Payment was rejected by the resource server after retry',
+                    amount: selected.amount,
+                    display_amount: '',
+                }, { txId });
+                // v1.6: emit transaction:failed event (payment rejected)
+                deps.eventBus?.emit('transaction:failed', {
+                    walletId,
+                    txId,
+                    error: 'Payment was rejected by the resource server after retry',
+                    network: resolvedNetwork,
+                    type: 'X402_PAYMENT',
+                    timestamp: Math.floor(Date.now() / 1000),
+                });
+                throw new WAIaaSError('X402_PAYMENT_REJECTED', {
+                    message: 'Payment was rejected by the resource server after retry',
+                });
+            }
+            if (!retryResponse.ok) {
+                // Server error after payment
+                await deps.db
+                    .update(transactions)
+                    .set({ status: 'FAILED', error: `X402_SERVER_ERROR: HTTP ${retryResponse.status}` })
+                    .where(eq(transactions.id, txId));
+                deps.policyEngine.releaseReservation(txId);
+                void deps.notificationService?.notify('TX_FAILED', walletId, {
+                    reason: `Resource server returned ${retryResponse.status} after payment`,
+                    amount: selected.amount,
+                    display_amount: '',
+                }, { txId });
+                // v1.6: emit transaction:failed event (server error)
+                deps.eventBus?.emit('transaction:failed', {
+                    walletId,
+                    txId,
+                    error: `Resource server returned ${retryResponse.status} after payment`,
+                    network: resolvedNetwork,
+                    type: 'X402_PAYMENT',
+                    timestamp: Math.floor(Date.now() / 1000),
+                });
+                throw new WAIaaSError('X402_SERVER_ERROR', {
+                    message: `Resource server returned ${retryResponse.status} after payment`,
+                });
+            }
+            // C5. Payment succeeded
+            const confirmedAt = new Date(Math.floor(Date.now() / 1000) * 1000);
+            await deps.db
+                .update(transactions)
+                .set({ status: 'CONFIRMED', executedAt: confirmedAt })
+                .where(eq(transactions.id, txId));
+            void deps.notificationService?.notify('TX_CONFIRMED', walletId, {
+                txHash: '',
+                amount: selected.amount,
+                to: selected.payTo,
+                display_amount: '',
+            }, { txId });
+            // v1.6: emit transaction:completed event (x402 payment confirmed)
+            deps.eventBus?.emit('transaction:completed', {
+                walletId,
+                txId,
+                txHash: '',
+                amount: selected.amount,
+                network: resolvedNetwork,
+                type: 'X402_PAYMENT',
+                timestamp: Math.floor(Date.now() / 1000),
+            });
+            // C6. Build response
+            const responseBody = await buildPassthroughResponse(retryResponse);
+            return c.json({
+                ...responseBody,
+                payment: {
+                    amount: selected.amount,
+                    asset: selected.asset,
+                    network: selected.network,
+                    payTo: selected.payTo,
+                    txId,
+                },
+            }, 200);
+        }
+        catch (error) {
+            // If error is a WAIaaSError we already threw, re-throw it
+            if (error instanceof WAIaaSError) {
+                throw error;
+            }
+            // Unexpected error during payment -- mark FAILED + release reservation
+            await deps.db
+                .update(transactions)
+                .set({
+                status: 'FAILED',
+                error: error instanceof Error ? error.message : 'Unknown payment error',
+            })
+                .where(eq(transactions.id, txId));
+            deps.policyEngine.releaseReservation(txId);
+            void deps.notificationService?.notify('TX_FAILED', walletId, {
+                reason: error instanceof Error ? error.message : 'Unknown payment error',
+                amount: selected.amount,
+                display_amount: '',
+            }, { txId });
+            // v1.6: emit transaction:failed event (unexpected error)
+            deps.eventBus?.emit('transaction:failed', {
+                walletId,
+                txId,
+                error: error instanceof Error ? error.message : 'Unknown payment error',
+                network: resolvedNetwork,
+                type: 'X402_PAYMENT',
+                timestamp: Math.floor(Date.now() / 1000),
+            });
+            throw new WAIaaSError('X402_SERVER_ERROR', {
+                message: error instanceof Error ? error.message : 'Unknown payment error',
+            });
+        }
+    });
+    return router;
+}
+// ---------------------------------------------------------------------------
+// Policy resolution helper
+// ---------------------------------------------------------------------------
+/**
+ * Resolve X402_ALLOWED_DOMAINS policies with 4-level override priority.
+ * Returns resolved policy rows suitable for evaluateX402Domain.
+ */
+function resolveX402DomainPolicies(rows, walletId) {
+    // Simple 4-level override: wallet > global, network-specific > all-networks
+    // For X402_ALLOWED_DOMAINS, we pick the highest-priority match
+    const typeMap = new Map();
+    // Phase 1: global + all-networks (lowest priority)
+    for (const row of rows) {
+        if (row.walletId === null && row.network === null) {
+            typeMap.set(row.type, row);
+        }
+    }
+    // Phase 2: global + network-specific
+    for (const row of rows) {
+        if (row.walletId === null && row.network !== null) {
+            typeMap.set(row.type, row);
+        }
+    }
+    // Phase 3: wallet-specific + all-networks
+    for (const row of rows) {
+        if (row.walletId === walletId && row.network === null) {
+            typeMap.set(row.type, row);
+        }
+    }
+    // Phase 4: wallet-specific + network-specific (highest priority)
+    for (const row of rows) {
+        if (row.walletId === walletId && row.network !== null) {
+            typeMap.set(row.type, row);
+        }
+    }
+    return Array.from(typeMap.values());
+}
+//# sourceMappingURL=x402.js.map

package/dist/api/routes/x402.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"x402.js","sourceRoot":"","sources":["../../../src/api/routes/x402.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;GAkBG;AAEH,OAAO,EAAE,WAAW,EAAE,WAAW,EAAE,CAAC,EAAE,MAAM,mBAAmB,CAAC;AAChE,OAAO,EAAE,EAAE,EAAE,EAAE,EAAE,GAAG,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM,aAAa,CAAC;AAGxD,OAAO,EAAE,WAAW,EAAE,kBAAkB,EAAE,gBAAgB,EAAE,MAAM,cAAc,CAAC;AAIjF,OAAO,EAAE,OAAO,EAAE,YAAY,EAAE,QAAQ,EAAE,MAAM,yCAAyC,CAAC;AAG1F,OAAO,EAAE,UAAU,EAAE,MAAM,qCAAqC,CAAC;AACjE,OAAO,EAAE,kBAAkB,EAAE,MAAM,2CAA2C,CAAC;AAC/E,OAAO,EAAE,oBAAoB,EAAE,MAAM,0CAA0C,CAAC;AAChF,OAAO,EAAE,gBAAgB,EAAE,wBAAwB,EAAE,MAAM,qCAAqC,CAAC;AACjG,OAAO,EAAE,iBAAiB,EAAE,sBAAsB,EAAE,MAAM,mCAAmC,CAAC;AAC9F,OAAO,EAAE,WAAW,EAAE,MAAM,uCAAuC,CAAC;AAGpE,OAAO,EAAE,mBAAmB,EAAE,qBAAqB,EAAE,MAAM,sBAAsB,CAAC;AAqClF,8EAA8E;AAC9E,UAAU;AACV,8EAA8E;AAE9E,MAAM,KAAK,GAAG,CAAC,EAAU,EAAiB,EAAE,CAC1C,IAAI,OAAO,CAAC,CAAC,OAAO,EAAE,EAAE,CAAC,UAAU,CAAC,OAAO,EAAE,EAAE,CAAC,CAAC,CAAC;AAEpD;;GAEG;AACH,SAAS,4BAA4B,CAAC,cAAuC;IAC3E,MAAM,IAAI,GAAG,IAAI,CAAC,SAAS,CAAC,cAAc,CAAC,CAAC;IAC5C,OAAO,MAAM,CAAC,IAAI,CAAC,IAAI,EAAE,OAAO,CAAC,CAAC,QAAQ,CAAC,QAAQ,CAAC,CAAC;AACvD,CAAC;AAED;;GAEG;AACH,KAAK,UAAU,wBAAwB,CACrC,QAAkB;IAElB,MAAM,IAAI,GAAG,MAAM,QAAQ,CAAC,IAAI,EAAE,CAAC;IACnC,MAAM,OAAO,GAA2B,EAAE,CAAC;IAC3C,QAAQ,CAAC,OAAO,CAAC,OAAO,CAAC,CAAC,KAAK,EAAE,GAAG,EAAE,EAAE;QACtC,OAAO,CAAC,GAAG,CAAC,GAAG,KAAK,CAAC;IACvB,CAAC,CAAC,CAAC;IACH,OAAO,EAAE,MAAM,EAAE,QAAQ,CAAC,MAAM,EAAE,OAAO,EAAE,IAAI,EAAE,CAAC;AACpD,CAAC;AAED,8EAA8E;AAC9E,6CAA6C;AAC7C,8EAA8E;AAE9E,MAAM,cAAc,GAAG,WAAW,CAAC;IACjC,MAAM,EAAE,MAAM;IACd,IAAI,EAAE,aAAa;IACnB,IAAI,EAAE,CAAC,MAAM,CAAC;IACd,OAAO,EAAE,kCAAkC;IAC3C,WAAW,EACT,wEAAwE;QACxE,sEAAsE;QACtE,mEAAmE;IACrE,OAAO,EAAE;QACP,IAAI,EAAE;YACJ,OAAO,EAAE;gBACP,kBAAkB,EAAE;oBAClB,MAAM,EAAE,CAAC,CAAC,MAAM,CAAC;wBACf,GAAG,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,EAAE;wBACrB,MAAM,EAAE,CAAC,CAAC,IAAI,CAAC,CAAC,KAAK,EAAE,MAAM,EAAE,KAAK,EAAE,QAAQ,EAAE,OAAO,CAAC,CAAC,CAAC,OAAO,CAAC,KAAK,CAAC;wBACxE,OAAO,EAAE,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,MAAM,EAAE,CAAC,CAAC,QAAQ,EAAE;wBACxC,IAAI,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;qBAC5B,CAAC;iBACH;aACF;SACF;KACF;IACD,SAAS,EAAE;QACT,GAAG,EAAE;YACH,WAAW,EAAE,gEAAgE;YAC7E,OAAO,EAAE;gBACP,kBAAkB,EAAE;oBAClB,MAAM,EAAE,CAAC,CAAC,MAAM,CAAC;wBACf,MAAM,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,EAAE;wBACxB,OAAO,EAAE,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,MAAM,EAAE,CAAC;wBAC7B,IAAI,EAAE,CAAC,CAAC,MAAM,EAAE;wBAChB,OAAO,EAAE,CAAC,CAAC,MAAM,CAAC;4BAChB,MAAM,EAAE,CAAC,CAAC,MAAM,EAAE;4BAClB,KAAK,EAAE,CAAC,CAAC,MAAM,EAAE;4BACjB,OAAO,EAAE,CAAC,CAAC,MAAM,EAAE;4BACnB,KAAK,EAAE,CAAC,CAAC,MAAM,EAAE;4BACjB,IAAI,EAAE,CAAC,CAAC,MAAM,EAAE;yBACjB,CAAC,CAAC,QAAQ,EAAE;qBACd,CAAC;iBACH;aACF;SACF;QACD,GAAG,mBAAmB,CAAC;YACrB,eAAe;YACf,yBAAyB;YACzB,mBAAmB;YACnB,yBAAyB;YACzB,uBAAuB;YACvB,oBAAoB;YACpB,wBAAwB;YACxB,mBAAmB;YACnB,kBAAkB;YAClB,eAAe;SAChB,CAAC;KACH;CACF,CAAC,CAAC;AAEH,8EAA8E;AAC9E,gBAAgB;AAChB,8EAA8E;AAE9E;;;;GAIG;AACH,MAAM,UAAU,UAAU,CAAC,IAAmB;IAC5C,MAAM,MAAM,GAAG,IAAI,WAAW,CAAC,EAAE,WAAW,EAAE,qBAAqB,EAAE,CAAC,CAAC;IAEvE,MAAM,CAAC,OAAO,CAAC,cAAc,EAAE,KAAK,EAAE,CAAC,EAAE,EAAE;QACzC,0EAA0E;QAC1E,kCAAkC;QAClC,0EAA0E;QAE1E,yBAAyB;QACzB,IAAI,CAAC,IAAI,CAAC,MAAM,CAAC,IAAI,EAAE,OAAO,EAAE,CAAC;YAC/B,MAAM,IAAI,WAAW,CAAC,eAAe,EAAE;gBACrC,OAAO,EAAE,6CAA6C;aACvD,CAAC,CAAC;QACL,CAAC;QAED,4DAA4D;QAC5D,MAAM,QAAQ,GAAG,CAAC,CAAC,GAAG,CAAC,UAAmB,CAAW,CAAC;QACtD,MAAM,SAAS,GAAG,CAAC,CAAC,GAAG,CAAC,WAAoB,CAAuB,CAAC;QAEpE,yBAAyB;QACzB,MAAM,IAAI,GAAG,CAAC,CAAC,GAAG,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC;QACjC,MAAM,SAAS,GAAG,IAAI,GAAG,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;QACpC,MAAM,YAAY,GAAG,SAAS,CAAC,QAAQ,CAAC;QAExC,qBAAqB;QACrB,MAAM,MAAM,GAAG,MAAM,IAAI,CAAC,EAAE,CAAC,MAAM,EAAE,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC,KAAK,CAAC,EAAE,CAAC,OAAO,CAAC,EAAE,EAAE,QAAQ,CAAC,CAAC,CAAC,GAAG,EAAE,CAAC;QAC1F,IAAI,CAAC,MAAM,EAAE,CAAC;YACZ,MAAM,IAAI,WAAW,CAAC,kBAAkB,EAAE;gBACxC,OAAO,EAAE,WAAW,QAAQ,aAAa;aAC1C,CAAC,CAAC;QACL,CAAC;QAED,2DAA2D;QAC3D,gFAAgF;QAChF,MAAM,UAAU,GAAG,MAAM,IAAI,CAAC,EAAE;aAC7B,MAAM,EAAE;aACR,IAAI,CAAC,QAAQ,CAAC;aACd,KAAK,CACJ,GAAG,CACD,EAAE,CAAC,EAAE,CAAC,QAAQ,CAAC,QAAQ,EAAE,QAAQ,CAAC,EAAE,MAAM,CAAC,QAAQ,CAAC,QAAQ,CAAC,CAAC,EAC9D,EAAE,CAAC,QAAQ,CAAC,IAAI,EAAE,sBAAsB,CAAC,EACzC,EAAE,CAAC,QAAQ,CAAC,OAAO,EAAE,IAAI,CAAC,CAC3B,CACF;aACA,OAAO,CAAC,IAAI,CAAC,QAAQ,CAAC,QAAQ,CAAC,CAAC;aAChC,GAAG,EAAE,CAAC;QAET,wDAAwD;QACxD,MAAM,gBAAgB,GAAG,yBAAyB,CAAC,UAAU,EAAE,QAAQ,CAAC,CAAC;QAEzE,MAAM,YAAY,GAAG,kBAAkB,CAAC,gBAAgB,EAAE,YAAY,CAAC,CAAC;QACxE,IAAI,YAAY,IAAI,CAAC,YAAY,CAAC,OAAO,EAAE,CAAC;YAC1C,KAAK,IAAI,CAAC,mBAAmB,EAAE,MAAM,CAAC,kBAAkB,EAAE,QAAQ,EAAE;gBAClE,MAAM,EAAE,YAAY,CAAC,MAAM,IAAI,oBAAoB;gBACnD,IAAI,EAAE,sBAAsB;aAC7B,CAAC,CAAC;YACH,MAAM,IAAI,WAAW,CAAC,yBAAyB,EAAE;gBAC/C,OAAO,EAAE,YAAY,CAAC,MAAM,IAAI,WAAW,YAAY,iCAAiC;aACzF,CAAC,CAAC;QACL,CAAC;QAED,wCAAwC;QACxC,MAAM,YAAY,GAAG,MAAM,iBAAiB,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;QACvD,MAAM,QAAQ,GAAG,MAAM,sBAAsB,CAC3C,YAAY,EACZ,IAAI,CAAC,MAAM,IAAI,KAAK,EACpB,IAAI,CAAC,OAAO,EACZ,IAAI,CAAC,IAAI,CACV,CAAC;QAEF,+DAA+D;QAC/D,IAAI,QAAQ,CAAC,MAAM,KAAK,GAAG,EAAE,CAAC;YAC5B,MAAM,WAAW,GAAG,MAAM,wBAAwB,CAAC,QAAQ,CAAC,CAAC;YAC7D,OAAO,CAAC,CAAC,IAAI,CAAC,WAAW,EAAE,GAAG,CAAC,CAAC;QAClC,CAAC;QAED,0EAA0E;QAC1E,wCAAwC;QACxC,0EAA0E;QAE1E,yBAAyB;QACzB,MAAM,eAAe,GAAG,MAAM,gBAAgB,CAAC,QAAQ,CAAC,CAAC;QAEzD,yDAAyD;QACzD,MAAM,iBAAiB,GAAG,IAAI,GAAG,CAAC,MAAM,CAAC,IAAI,CAAC,gBAAgB,CAAC,CAAC,CAAC;QAEjE,sCAAsC;QACtC,MAAM,QAAQ,GAAG,wBAAwB,CACvC,eAAe,CAAC,OAAO,EACvB,iBAAiB,CAClB,CAAC;QAEF,0CAA0C;QAC1C,MAAM,QAAQ,GAAG,kBAAkB,CAAC,QAAQ,CAAC,OAAO,CAAC,CAAC;QACtD,MAAM,aAAa,GAAG,QAAQ,CAAC,KAAK,CAAC;QACrC,MAAM,eAAe,GAAG,QAAQ,CAAC,OAAO,CAAC;QAEzC,+CAA+C;QAC/C,MAAM,IAAI,GAAG,UAAU,EAAE,CAAC;QAC1B,MAAM,KAAK,GAAG,IAAI,IAAI,CAAC,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,GAAG,EAAE,GAAG,IAAI,CAAC,GAAG,IAAI,CAAC,CAAC;QAE7D,MAAM,IAAI,CAAC,EAAE,CAAC,MAAM,CAAC,YAAY,CAAC,CAAC,MAAM,CAAC;YACxC,EAAE,EAAE,IAAI;YACR,QAAQ;YACR,KAAK,EAAE,aAAa;YACpB,OAAO,EAAE,eAAe;YACxB,IAAI,EAAE,cAAc;YACpB,MAAM,EAAE,SAAS;YACjB,MAAM,EAAE,QAAQ,CAAC,MAAM;YACvB,SAAS,EAAE,QAAQ,CAAC,KAAK;YACzB,SAAS,EAAE,SAAS,IAAI,IAAI;YAC5B,QAAQ,EAAE,IAAI,CAAC,SAAS,CAAC;gBACvB,UAAU,EAAE,IAAI,CAAC,GAAG;gBACpB,cAAc,EAAE,QAAQ,CAAC,MAAM;gBAC/B,OAAO,EAAE,QAAQ,CAAC,OAAO;gBACzB,KAAK,EAAE,QAAQ,CAAC,KAAK;gBACrB,MAAM,EAAE,QAAQ,CAAC,MAAM;aACxB,CAAC;YACF,SAAS,EAAE,KAAK;SACjB,CAAC,CAAC;QAEH,kDAAkD;QAClD,KAAK,IAAI,CAAC,mBAAmB,EAAE,MAAM,CAAC,cAAc,EAAE,QAAQ,EAAE;YAC9D,MAAM,EAAE,QAAQ,CAAC,MAAM;YACvB,EAAE,EAAE,QAAQ,CAAC,KAAK;YAClB,IAAI,EAAE,cAAc;YACpB,cAAc,EAAE,EAAE,EAAE,uDAAuD;SAC5E,EAAE,EAAE,IAAI,EAAE,CAAC,CAAC;QAEb,gDAAgD;QAChD,IAAI,CAAC,QAAQ,EAAE,IAAI,CAAC,iBAAiB,EAAE;YACrC,QAAQ;YACR,QAAQ,EAAE,cAAc;YACxB,OAAO,EAAE,EAAE,IAAI,EAAE,IAAI,EAAE,cAAc,EAAE;YACvC,SAAS,EAAE,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,GAAG,EAAE,GAAG,IAAI,CAAC;SACzC,CAAC,CAAC;QAEH,mDAAmD;QACnD,MAAM,SAAS,GAAG,MAAM,oBAAoB,CAC1C,QAAQ,CAAC,MAAM,EACf,QAAQ,CAAC,KAAK,EACd,QAAQ,CAAC,OAAO,EAChB,IAAI,CAAC,WAAW,CACjB,CAAC;QAEF,2EAA2E;QAC3E,MAAM,UAAU,GAAG,IAAI,CAAC,YAAY,CAAC,kBAAkB,CACrD,QAAQ,EACR;YACE,IAAI,EAAE,UAAU;YAChB,MAAM,EAAE,QAAQ,CAAC,MAAM;YACvB,SAAS,EAAE,QAAQ,CAAC,KAAK;YACzB,KAAK,EAAE,aAAa;YACpB,OAAO,EAAE,eAAe;SACzB,EACD,IAAI,EACJ,SAAS,CACV,CAAC;QAEF,2BAA2B;QAC3B,IAAI,CAAC,UAAU,CAAC,OAAO,EAAE,CAAC;YACxB,MAAM,IAAI,CAAC,EAAE;iBACV,MAAM,CAAC,YAAY,CAAC;iBACpB,GAAG,CAAC,EAAE,MAAM,EAAE,WAAW,EAAE,IAAI,EAAE,UAAU,CAAC,IAAI,EAAE,KAAK,EAAE,UAAU,CAAC,MAAM,IAAI,eAAe,EAAE,CAAC;iBAChG,KAAK,CAAC,EAAE,CAAC,YAAY,CAAC,EAAE,EAAE,IAAI,CAAC,CAAC,CAAC;YACpC,IAAI,CAAC,YAAY,CAAC,kBAAkB,CAAC,IAAI,CAAC,CAAC;YAC3C,KAAK,IAAI,CAAC,mBAAmB,EAAE,MAAM,CAAC,WAAW,EAAE,QAAQ,EAAE;gBAC3D,MAAM,EAAE,UAAU,CAAC,MAAM,IAAI,eAAe;gBAC5C,MAAM,EAAE,QAAQ,CAAC,MAAM;gBACvB,cAAc,EAAE,EAAE;aACnB,EAAE,EAAE,IAAI,EAAE,CAAC,CAAC;YAEb,sDAAsD;YACtD,IAAI,CAAC,QAAQ,EAAE,IAAI,CAAC,oBAAoB,EAAE;gBACxC,QAAQ;gBACR,IAAI;gBACJ,KAAK,EAAE,UAAU,CAAC,MAAM,IAAI,eAAe;gBAC3C,OAAO,EAAE,eAAe;gBACxB,IAAI,EAAE,cAAc;gBACpB,SAAS,EAAE,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,GAAG,EAAE,GAAG,IAAI,CAAC;aACzC,CAAC,CAAC;YAEH,MAAM,IAAI,WAAW,CAAC,eAAe,EAAE;gBACrC,OAAO,EAAE,UAAU,CAAC,MAAM,IAAI,6CAA6C;aAC5E,CAAC,CAAC;QACL,CAAC;QAED,mDAAmD;QACnD,IAAI,UAAU,CAAC,IAAI,KAAK,UAAU,EAAE,CAAC;YACnC,MAAM,IAAI,CAAC,EAAE;iBACV,MAAM,CAAC,YAAY,CAAC;iBACpB,GAAG,CAAC,EAAE,MAAM,EAAE,WAAW,EAAE,IAAI,EAAE,UAAU,EAAE,KAAK,EAAE,wBAAwB,EAAE,CAAC;iBAC/E,KAAK,CAAC,EAAE,CAAC,YAAY,CAAC,EAAE,EAAE,IAAI,CAAC,CAAC,CAAC;YACpC,IAAI,CAAC,YAAY,CAAC,kBAAkB,CAAC,IAAI,CAAC,CAAC;YAC3C,KAAK,IAAI,CAAC,mBAAmB,EAAE,MAAM,CAAC,WAAW,EAAE,QAAQ,EAAE;gBAC3D,MAAM,EAAE,wDAAwD;gBAChE,MAAM,EAAE,QAAQ,CAAC,MAAM;gBACvB,cAAc,EAAE,EAAE;aACnB,EAAE,EAAE,IAAI,EAAE,CAAC,CAAC;YAEb,0DAA0D;YAC1D,IAAI,CAAC,QAAQ,EAAE,IAAI,CAAC,oBAAoB,EAAE;gBACxC,QAAQ;gBACR,IAAI;gBACJ,KAAK,EAAE,wDAAwD;gBAC/D,OAAO,EAAE,eAAe;gBACxB,IAAI,EAAE,cAAc;gBACpB,SAAS,EAAE,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,GAAG,EAAE,GAAG,IAAI,CAAC;aACzC,CAAC,CAAC;YAEH,MAAM,IAAI,WAAW,CAAC,wBAAwB,EAAE;gBAC9C,OAAO,EAAE,wDAAwD;aAClE,CAAC,CAAC;QACL,CAAC;QAED,yBAAyB;QACzB,IAAI,UAAU,CAAC,IAAI,KAAK,OAAO,EAAE,CAAC;YAChC,MAAM,YAAY,GAAG,UAAU,CAAC,YAAY,IAAI,IAAI,CAAC,MAAM,CAAC,QAAQ,CAAC,6BAA6B,CAAC;YACnG,MAAM,cAAc,GAAG,IAAI,CAAC,MAAM,CAAC,IAAI,EAAE,eAAe,IAAI,EAAE,CAAC;YAE/D,IAAI,YAAY,GAAG,cAAc,EAAE,CAAC;gBAClC,MAAM,IAAI,CAAC,EAAE;qBACV,MAAM,CAAC,YAAY,CAAC;qBACpB,GAAG,CAAC,EAAE,MAAM,EAAE,WAAW,EAAE,IAAI,EAAE,OAAO,EAAE,KAAK,EAAE,oBAAoB,EAAE,CAAC;qBACxE,KAAK,CAAC,EAAE,CAAC,YAAY,CAAC,EAAE,EAAE,IAAI,CAAC,CAAC,CAAC;gBACpC,IAAI,CAAC,YAAY,CAAC,kBAAkB,CAAC,IAAI,CAAC,CAAC;gBAC3C,KAAK,IAAI,CAAC,mBAAmB,EAAE,MAAM,CAAC,WAAW,EAAE,QAAQ,EAAE;oBAC3D,MAAM,EAAE,SAAS,YAAY,6BAA6B,cAAc,GAAG;oBAC3E,MAAM,EAAE,QAAQ,CAAC,MAAM;oBACvB,cAAc,EAAE,EAAE;iBACnB,EAAE,EAAE,IAAI,EAAE,CAAC,CAAC;gBAEb,sDAAsD;gBACtD,IAAI,CAAC,QAAQ,EAAE,IAAI,CAAC,oBAAoB,EAAE;oBACxC,QAAQ;oBACR,IAAI;oBACJ,KAAK,EAAE,SAAS,YAAY,6BAA6B,cAAc,GAAG;oBAC1E,OAAO,EAAE,eAAe;oBACxB,IAAI,EAAE,cAAc;oBACpB,SAAS,EAAE,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,GAAG,EAAE,GAAG,IAAI,CAAC;iBACzC,CAAC,CAAC;gBAEH,MAAM,IAAI,WAAW,CAAC,oBAAoB,EAAE;oBAC1C,OAAO,EAAE,YAAY,YAAY,qCAAqC,cAAc,GAAG;iBACxF,CAAC,CAAC;YACL,CAAC;YAED,+CAA+C;YAC/C,MAAM,KAAK,CAAC,YAAY,GAAG,IAAI,CAAC,CAAC;QACnC,CAAC;QAED,kCAAkC;QAClC,MAAM,IAAI,CAAC,EAAE;aACV,MAAM,CAAC,YAAY,CAAC;aACpB,GAAG,CAAC,EAAE,IAAI,EAAE,UAAU,CAAC,IAAI,EAAE,CAAC;aAC9B,KAAK,CAAC,EAAE,CAAC,YAAY,CAAC,EAAE,EAAE,IAAI,CAAC,CAAC,CAAC;QAEpC,0EAA0E;QAC1E,mCAAmC;QACnC,0EAA0E;QAE1E,IAAI,CAAC;YACH,mBAAmB;YACnB,MAAM,cAAc,GAAG,MAAM,WAAW,CACtC,QAAQ,EACR,IAAI,CAAC,QAAQ,EACb,QAAQ,EACR,MAAM,CAAC,SAAS,EAChB,IAAI,CAAC,cAAc,CACpB,CAAC;YAEF,2CAA2C;YAC3C,cAAc,CAAC,QAAQ,GAAG,EAAE,GAAG,EAAE,IAAI,CAAC,GAAG,EAAE,CAAC;YAE5C,sCAAsC;YACtC,MAAM,gBAAgB,GAAG,4BAA4B,CAAC,cAAc,CAAC,CAAC;YACtE,MAAM,YAAY,GAA2B;gBAC3C,GAAG,CAAC,IAAI,CAAC,OAAO,IAAI,EAAE,CAAC;gBACvB,mBAAmB,EAAE,gBAAgB;aACtC,CAAC;YAEF,wCAAwC;YACxC,MAAM,aAAa,GAAG,MAAM,sBAAsB,CAChD,YAAY,EACZ,IAAI,CAAC,MAAM,IAAI,KAAK,EACpB,YAAY,EACZ,IAAI,CAAC,IAAI,CACV,CAAC;YAEF,4BAA4B;YAC5B,IAAI,aAAa,CAAC,MAAM,KAAK,GAAG,EAAE,CAAC;gBACjC,6BAA6B;gBAC7B,MAAM,IAAI,CAAC,EAAE;qBACV,MAAM,CAAC,YAAY,CAAC;qBACpB,GAAG,CAAC,EAAE,MAAM,EAAE,QAAQ,EAAE,KAAK,EAAE,uBAAuB,EAAE,CAAC;qBACzD,KAAK,CAAC,EAAE,CAAC,YAAY,CAAC,EAAE,EAAE,IAAI,CAAC,CAAC,CAAC;gBACpC,IAAI,CAAC,YAAY,CAAC,kBAAkB,CAAC,IAAI,CAAC,CAAC;gBAC3C,KAAK,IAAI,CAAC,mBAAmB,EAAE,MAAM,CAAC,WAAW,EAAE,QAAQ,EAAE;oBAC3D,MAAM,EAAE,yDAAyD;oBACjE,MAAM,EAAE,QAAQ,CAAC,MAAM;oBACvB,cAAc,EAAE,EAAE;iBACnB,EAAE,EAAE,IAAI,EAAE,CAAC,CAAC;gBAEb,yDAAyD;gBACzD,IAAI,CAAC,QAAQ,EAAE,IAAI,CAAC,oBAAoB,EAAE;oBACxC,QAAQ;oBACR,IAAI;oBACJ,KAAK,EAAE,yDAAyD;oBAChE,OAAO,EAAE,eAAe;oBACxB,IAAI,EAAE,cAAc;oBACpB,SAAS,EAAE,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,GAAG,EAAE,GAAG,IAAI,CAAC;iBACzC,CAAC,CAAC;gBAEH,MAAM,IAAI,WAAW,CAAC,uBAAuB,EAAE;oBAC7C,OAAO,EAAE,yDAAyD;iBACnE,CAAC,CAAC;YACL,CAAC;YAED,IAAI,CAAC,aAAa,CAAC,EAAE,EAAE,CAAC;gBACtB,6BAA6B;gBAC7B,MAAM,IAAI,CAAC,EAAE;qBACV,MAAM,CAAC,YAAY,CAAC;qBACpB,GAAG,CAAC,EAAE,MAAM,EAAE,QAAQ,EAAE,KAAK,EAAE,2BAA2B,aAAa,CAAC,MAAM,EAAE,EAAE,CAAC;qBACnF,KAAK,CAAC,EAAE,CAAC,YAAY,CAAC,EAAE,EAAE,IAAI,CAAC,CAAC,CAAC;gBACpC,IAAI,CAAC,YAAY,CAAC,kBAAkB,CAAC,IAAI,CAAC,CAAC;gBAC3C,KAAK,IAAI,CAAC,mBAAmB,EAAE,MAAM,CAAC,WAAW,EAAE,QAAQ,EAAE;oBAC3D,MAAM,EAAE,4BAA4B,aAAa,CAAC,MAAM,gBAAgB;oBACxE,MAAM,EAAE,QAAQ,CAAC,MAAM;oBACvB,cAAc,EAAE,EAAE;iBACnB,EAAE,EAAE,IAAI,EAAE,CAAC,CAAC;gBAEb,qDAAqD;gBACrD,IAAI,CAAC,QAAQ,EAAE,IAAI,CAAC,oBAAoB,EAAE;oBACxC,QAAQ;oBACR,IAAI;oBACJ,KAAK,EAAE,4BAA4B,aAAa,CAAC,MAAM,gBAAgB;oBACvE,OAAO,EAAE,eAAe;oBACxB,IAAI,EAAE,cAAc;oBACpB,SAAS,EAAE,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,GAAG,EAAE,GAAG,IAAI,CAAC;iBACzC,CAAC,CAAC;gBAEH,MAAM,IAAI,WAAW,CAAC,mBAAmB,EAAE;oBACzC,OAAO,EAAE,4BAA4B,aAAa,CAAC,MAAM,gBAAgB;iBAC1E,CAAC,CAAC;YACL,CAAC;YAED,wBAAwB;YACxB,MAAM,WAAW,GAAG,IAAI,IAAI,CAAC,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,GAAG,EAAE,GAAG,IAAI,CAAC,GAAG,IAAI,CAAC,CAAC;YACnE,MAAM,IAAI,CAAC,EAAE;iBACV,MAAM,CAAC,YAAY,CAAC;iBACpB,GAAG,CAAC,EAAE,MAAM,EAAE,WAAW,EAAE,UAAU,EAAE,WAAW,EAAE,CAAC;iBACrD,KAAK,CAAC,EAAE,CAAC,YAAY,CAAC,EAAE,EAAE,IAAI,CAAC,CAAC,CAAC;YAEpC,KAAK,IAAI,CAAC,mBAAmB,EAAE,MAAM,CAAC,cAAc,EAAE,QAAQ,EAAE;gBAC9D,MAAM,EAAE,EAAE;gBACV,MAAM,EAAE,QAAQ,CAAC,MAAM;gBACvB,EAAE,EAAE,QAAQ,CAAC,KAAK;gBAClB,cAAc,EAAE,EAAE;aACnB,EAAE,EAAE,IAAI,EAAE,CAAC,CAAC;YAEb,kEAAkE;YAClE,IAAI,CAAC,QAAQ,EAAE,IAAI,CAAC,uBAAuB,EAAE;gBAC3C,QAAQ;gBACR,IAAI;gBACJ,MAAM,EAAE,EAAE;gBACV,MAAM,EAAE,QAAQ,CAAC,MAAM;gBACvB,OAAO,EAAE,eAAe;gBACxB,IAAI,EAAE,cAAc;gBACpB,SAAS,EAAE,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,GAAG,EAAE,GAAG,IAAI,CAAC;aACzC,CAAC,CAAC;YAEH,qBAAqB;YACrB,MAAM,YAAY,GAAG,MAAM,wBAAwB,CAAC,aAAa,CAAC,CAAC;YACnE,OAAO,CAAC,CAAC,IAAI,CACX;gBACE,GAAG,YAAY;gBACf,OAAO,EAAE;oBACP,MAAM,EAAE,QAAQ,CAAC,MAAM;oBACvB,KAAK,EAAE,QAAQ,CAAC,KAAK;oBACrB,OAAO,EAAE,QAAQ,CAAC,OAAO;oBACzB,KAAK,EAAE,QAAQ,CAAC,KAAK;oBACrB,IAAI;iBACL;aACF,EACD,GAAG,CACJ,CAAC;QACJ,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,0DAA0D;YAC1D,IAAI,KAAK,YAAY,WAAW,EAAE,CAAC;gBACjC,MAAM,KAAK,CAAC;YACd,CAAC;YAED,uEAAuE;YACvE,MAAM,IAAI,CAAC,EAAE;iBACV,MAAM,CAAC,YAAY,CAAC;iBACpB,GAAG,CAAC;gBACH,MAAM,EAAE,QAAQ;gBAChB,KAAK,EAAE,KAAK,YAAY,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,uBAAuB;aACxE,CAAC;iBACD,KAAK,CAAC,EAAE,CAAC,YAAY,CAAC,EAAE,EAAE,IAAI,CAAC,CAAC,CAAC;YACpC,IAAI,CAAC,YAAY,CAAC,kBAAkB,CAAC,IAAI,CAAC,CAAC;YAC3C,KAAK,IAAI,CAAC,mBAAmB,EAAE,MAAM,CAAC,WAAW,EAAE,QAAQ,EAAE;gBAC3D,MAAM,EAAE,KAAK,YAAY,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,uBAAuB;gBACxE,MAAM,EAAE,QAAQ,CAAC,MAAM;gBACvB,cAAc,EAAE,EAAE;aACnB,EAAE,EAAE,IAAI,EAAE,CAAC,CAAC;YAEb,yDAAyD;YACzD,IAAI,CAAC,QAAQ,EAAE,IAAI,CAAC,oBAAoB,EAAE;gBACxC,QAAQ;gBACR,IAAI;gBACJ,KAAK,EAAE,KAAK,YAAY,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,uBAAuB;gBACvE,OAAO,EAAE,eAAe;gBACxB,IAAI,EAAE,cAAc;gBACpB,SAAS,EAAE,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,GAAG,EAAE,GAAG,IAAI,CAAC;aACzC,CAAC,CAAC;YAEH,MAAM,IAAI,WAAW,CAAC,mBAAmB,EAAE;gBACzC,OAAO,EAAE,KAAK,YAAY,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,uBAAuB;aAC1E,CAAC,CAAC;QACL,CAAC;IACH,CAAC,CAAC,CAAC;IAEH,OAAO,MAAM,CAAC;AAChB,CAAC;AAED,8EAA8E;AAC9E,2BAA2B;AAC3B,8EAA8E;AAE9E;;;GAGG;AACH,SAAS,yBAAyB,CAChC,IAQE,EACF,QAAgB;IAUhB,4EAA4E;IAC5E,+DAA+D;IAC/D,MAAM,OAAO,GAAG,IAAI,GAAG,EAA+B,CAAC;IAEvD,mDAAmD;IACnD,KAAK,MAAM,GAAG,IAAI,IAAI,EAAE,CAAC;QACvB,IAAI,GAAG,CAAC,QAAQ,KAAK,IAAI,IAAI,GAAG,CAAC,OAAO,KAAK,IAAI,EAAE,CAAC;YAClD,OAAO,CAAC,GAAG,CAAC,GAAG,CAAC,IAAI,EAAE,GAAG,CAAC,CAAC;QAC7B,CAAC;IACH,CAAC;IAED,qCAAqC;IACrC,KAAK,MAAM,GAAG,IAAI,IAAI,EAAE,CAAC;QACvB,IAAI,GAAG,CAAC,QAAQ,KAAK,IAAI,IAAI,GAAG,CAAC,OAAO,KAAK,IAAI,EAAE,CAAC;YAClD,OAAO,CAAC,GAAG,CAAC,GAAG,CAAC,IAAI,EAAE,GAAG,CAAC,CAAC;QAC7B,CAAC;IACH,CAAC;IAED,0CAA0C;IAC1C,KAAK,MAAM,GAAG,IAAI,IAAI,EAAE,CAAC;QACvB,IAAI,GAAG,CAAC,QAAQ,KAAK,QAAQ,IAAI,GAAG,CAAC,OAAO,KAAK,IAAI,EAAE,CAAC;YACtD,OAAO,CAAC,GAAG,CAAC,GAAG,CAAC,IAAI,EAAE,GAAG,CAAC,CAAC;QAC7B,CAAC;IACH,CAAC;IAED,iEAAiE;IACjE,KAAK,MAAM,GAAG,IAAI,IAAI,EAAE,CAAC;QACvB,IAAI,GAAG,CAAC,QAAQ,KAAK,QAAQ,IAAI,GAAG,CAAC,OAAO,KAAK,IAAI,EAAE,CAAC;YACtD,OAAO,CAAC,GAAG,CAAC,GAAG,CAAC,IAAI,EAAE,GAAG,CAAC,CAAC;QAC7B,CAAC;IACH,CAAC;IAED,OAAO,KAAK,CAAC,IAAI,CAAC,OAAO,CAAC,MAAM,EAAE,CAAC,CAAC;AACtC,CAAC"}

package/dist/api/server.d.ts

@@ -0,0 +1,81 @@
+/**
+ * Hono API server factory: createApp(deps) returns a configured Hono instance.
+ *
+ * Middleware registration order:
+ *   1. requestId
+ *   2. hostGuard
+ *   3. killSwitchGuard
+ *   4. requestLogger
+ *
+ * Auth middleware (route-level, registered on app before sub-routers):
+ *   - masterAuth: /v1/wallets, /v1/policies, /v1/sessions, /v1/sessions/:id (admin operations, skips /renew)
+ *   - sessionAuth: /v1/sessions/:id/renew, /v1/wallet/*, /v1/transactions/*
+ *   - /health remains public (no auth required)
+ *
+ * Error handler is registered via app.onError.
+ *
+ * The returned app instance is NOT started -- starting is DaemonLifecycle's job.
+ *
+ * @see docs/29-api-framework-design.md
+ * @see docs/52-auth-redesign.md
+ */
+import { OpenAPIHono } from '@hono/zod-openapi';
+import type { BetterSQLite3Database } from 'drizzle-orm/better-sqlite3';
+import type { Database as SQLiteDatabase } from 'better-sqlite3';
+import type { AdapterPool } from '../infrastructure/adapter-pool.js';
+import type { GetKillSwitchState } from './middleware/index.js';
+import type { VersionCheckService } from '../infrastructure/version/index.js';
+import type { LocalKeyStore } from '../infrastructure/keystore/keystore.js';
+import type { DaemonConfig } from '../infrastructure/config/loader.js';
+import type { IPolicyEngine, IPriceOracle, IForexRateService, EventBus } from '@waiaas/core';
+import type { KillSwitchService } from '../services/kill-switch-service.js';
+import type { WcServiceRef } from '../services/wc-session-service.js';
+import type { WcSigningBridge } from '../services/wc-signing-bridge.js';
+import type { JwtSecretManager } from '../infrastructure/jwt/index.js';
+import type { ApprovalWorkflow } from '../workflow/approval-workflow.js';
+import type { DelayQueue } from '../workflow/delay-queue.js';
+import type { OwnerLifecycleService } from '../workflow/owner-state.js';
+import type { NotificationService } from '../notifications/notification-service.js';
+import type { SettingsService } from '../infrastructure/settings/index.js';
+import type { ActionProviderRegistry } from '../infrastructure/action/action-provider-registry.js';
+import type { ApiKeyStore } from '../infrastructure/action/api-key-store.js';
+import type * as schema from '../infrastructure/database/schema.js';
+export interface CreateAppDeps {
+    getKillSwitchState?: GetKillSwitchState;
+    setKillSwitchState?: (state: string, activatedBy?: string) => void;
+    requestShutdown?: () => void;
+    startTime?: number;
+    db?: BetterSQLite3Database<typeof schema>;
+    sqlite?: SQLiteDatabase;
+    keyStore?: LocalKeyStore;
+    masterPassword?: string;
+    masterPasswordHash?: string;
+    config?: DaemonConfig;
+    adapterPool?: AdapterPool | null;
+    policyEngine?: IPolicyEngine;
+    jwtSecretManager?: JwtSecretManager;
+    approvalWorkflow?: ApprovalWorkflow;
+    delayQueue?: DelayQueue;
+    ownerLifecycle?: OwnerLifecycleService;
+    notificationService?: NotificationService;
+    settingsService?: SettingsService;
+    priceOracle?: IPriceOracle;
+    actionProviderRegistry?: ActionProviderRegistry;
+    apiKeyStore?: ApiKeyStore;
+    onSettingsChanged?: (changedKeys: string[]) => void;
+    dataDir?: string;
+    forexRateService?: IForexRateService;
+    eventBus?: EventBus;
+    killSwitchService?: KillSwitchService;
+    wcServiceRef?: WcServiceRef;
+    wcSigningBridge?: WcSigningBridge;
+    versionCheckService?: VersionCheckService | null;
+}
+/**
+ * Create a Hono app instance with all middleware and routes configured.
+ *
+ * @param deps - Optional dependencies (extensible for future use)
+ * @returns Configured OpenAPIHono instance (not started)
+ */
+export declare function createApp(deps?: CreateAppDeps): OpenAPIHono;
+//# sourceMappingURL=server.d.ts.map

package/dist/api/server.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"server.d.ts","sourceRoot":"","sources":["../../src/api/server.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;GAoBG;AAKH,OAAO,EAAE,WAAW,EAAE,MAAM,mBAAmB,CAAC;AAWhD,OAAO,KAAK,EAAE,qBAAqB,EAAE,MAAM,4BAA4B,CAAC;AACxE,OAAO,KAAK,EAAE,QAAQ,IAAI,cAAc,EAAE,MAAM,gBAAgB,CAAC;AACjE,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,mCAAmC,CAAC;AAYrE,OAAO,KAAK,EAAE,kBAAkB,EAAE,MAAM,uBAAuB,CAAC;AAEhE,OAAO,KAAK,EAAE,mBAAmB,EAAE,MAAM,oCAAoC,CAAC;AAa9E,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,wCAAwC,CAAC;AAC5E,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,oCAAoC,CAAC;AAEvE,OAAO,KAAK,EAAE,aAAa,EAAE,YAAY,EAAE,iBAAiB,EAAE,QAAQ,EAAE,MAAM,cAAc,CAAC;AAC7F,OAAO,KAAK,EAAE,iBAAiB,EAAE,MAAM,oCAAoC,CAAC;AAC5E,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,mCAAmC,CAAC;AACtE,OAAO,KAAK,EAAE,eAAe,EAAE,MAAM,kCAAkC,CAAC;AACxE,OAAO,KAAK,EAAE,gBAAgB,EAAE,MAAM,gCAAgC,CAAC;AACvE,OAAO,KAAK,EAAE,gBAAgB,EAAE,MAAM,kCAAkC,CAAC;AACzE,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,4BAA4B,CAAC;AAC7D,OAAO,KAAK,EAAE,qBAAqB,EAAE,MAAM,4BAA4B,CAAC;AACxE,OAAO,KAAK,EAAE,mBAAmB,EAAE,MAAM,0CAA0C,CAAC;AACpF,OAAO,KAAK,EAAE,eAAe,EAAE,MAAM,qCAAqC,CAAC;AAC3E,OAAO,KAAK,EAAE,sBAAsB,EAAE,MAAM,sDAAsD,CAAC;AACnG,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,2CAA2C,CAAC;AAC7E,OAAO,KAAK,KAAK,MAAM,MAAM,sCAAsC,CAAC;AAOpE,MAAM,WAAW,aAAa;IAC5B,kBAAkB,CAAC,EAAE,kBAAkB,CAAC;IACxC,kBAAkB,CAAC,EAAE,CAAC,KAAK,EAAE,MAAM,EAAE,WAAW,CAAC,EAAE,MAAM,KAAK,IAAI,CAAC;IACnE,eAAe,CAAC,EAAE,MAAM,IAAI,CAAC;IAC7B,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,EAAE,CAAC,EAAE,qBAAqB,CAAC,OAAO,MAAM,CAAC,CAAC;IAC1C,MAAM,CAAC,EAAE,cAAc,CAAC;IACxB,QAAQ,CAAC,EAAE,aAAa,CAAC;IACzB,cAAc,CAAC,EAAE,MAAM,CAAC;IACxB,kBAAkB,CAAC,EAAE,MAAM,CAAC;IAC5B,MAAM,CAAC,EAAE,YAAY,CAAC;IACtB,WAAW,CAAC,EAAE,WAAW,GAAG,IAAI,CAAC;IACjC,YAAY,CAAC,EAAE,aAAa,CAAC;IAC7B,gBAAgB,CAAC,EAAE,gBAAgB,CAAC;IACpC,gBAAgB,CAAC,EAAE,gBAAgB,CAAC;IACpC,UAAU,CAAC,EAAE,UAAU,CAAC;IACxB,cAAc,CAAC,EAAE,qBAAqB,CAAC;IACvC,mBAAmB,CAAC,EAAE,mBAAmB,CAAC;IAC1C,eAAe,CAAC,EAAE,eAAe,CAAC;IAClC,WAAW,CAAC,EAAE,YAAY,CAAC;IAC3B,sBAAsB,CAAC,EAAE,sBAAsB,CAAC;IAChD,WAAW,CAAC,EAAE,WAAW,CAAC;IAC1B,iBAAiB,CAAC,EAAE,CAAC,WAAW,EAAE,MAAM,EAAE,KAAK,IAAI,CAAC;IACpD,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,gBAAgB,CAAC,EAAE,iBAAiB,CAAC;IACrC,QAAQ,CAAC,EAAE,QAAQ,CAAC;IACpB,iBAAiB,CAAC,EAAE,iBAAiB,CAAC;IACtC,YAAY,CAAC,EAAE,YAAY,CAAC;IAC5B,eAAe,CAAC,EAAE,eAAe,CAAC;IAClC,mBAAmB,CAAC,EAAE,mBAAmB,GAAG,IAAI,CAAC;CAClD;AAED;;;;;GAKG;AACH,wBAAgB,SAAS,CAAC,IAAI,GAAE,aAAkB,GAAG,WAAW,CAga/D"}