@waiaas/daemon 2.0.0-rc.1

package/dist/pipeline/sign-only.d.ts

@@ -0,0 +1,99 @@
+/**
+ * Sign-only pipeline module.
+ *
+ * Provides executeSignOnly() -- a standalone pipeline for signing external
+ * unsigned transactions after policy evaluation. Unlike the 6-stage send
+ * pipeline (stages.ts), this pipeline does NOT submit to chain.
+ *
+ * 10-step pipeline:
+ * 1. Parse unsigned tx (adapter.parseTransaction)
+ * 2. Map ParsedOperation[] to TransactionParam[] (for policy engine)
+ * 3. Generate UUID v7 transaction ID
+ * 4. INSERT DB record (type='SIGN', status='PENDING')
+ * 5. Policy evaluation (evaluateAndReserve / evaluateBatch / evaluate)
+ * 6. Check policy result (deny if !allowed)
+ * 7. Check tier (DELAY/APPROVAL -> immediate rejection)
+ * 8. Update tier on transaction row
+ * 9. Sign (keyStore.decrypt -> adapter.signExternalTransaction -> keyStore.release)
+ * 10. Update status='SIGNED', return result
+ *
+ * @see docs/32-pipeline-design.md
+ */
+import type { BetterSQLite3Database } from 'drizzle-orm/better-sqlite3';
+import type { Database as SQLiteDatabase } from 'better-sqlite3';
+import { type IChainAdapter, type IPolicyEngine, type ParsedOperation, type EventBus } from '@waiaas/core';
+import type { LocalKeyStore } from '../infrastructure/keystore/keystore.js';
+import type * as schema from '../infrastructure/database/schema.js';
+import type { NotificationService } from '../notifications/notification-service.js';
+export interface SignOnlyDeps {
+    db: BetterSQLite3Database<typeof schema>;
+    sqlite?: SQLiteDatabase;
+    adapter: IChainAdapter;
+    keyStore: LocalKeyStore;
+    policyEngine: IPolicyEngine;
+    masterPassword: string;
+    notificationService?: NotificationService;
+    eventBus?: EventBus;
+}
+export interface SignOnlyRequest {
+    transaction: string;
+    chain: string;
+    network?: string;
+}
+export interface SignOnlyResult {
+    id: string;
+    signedTransaction: string;
+    txHash?: string;
+    operations: Array<{
+        type: string;
+        to?: string;
+        amount?: string;
+        token?: string;
+        programId?: string;
+        method?: string;
+    }>;
+    policyResult: {
+        tier: string;
+    };
+}
+interface TransactionParam {
+    type: string;
+    amount: string;
+    toAddress: string;
+    chain: string;
+    network?: string;
+    tokenAddress?: string;
+    contractAddress?: string;
+    selector?: string;
+    spenderAddress?: string;
+    approveAmount?: string;
+}
+/**
+ * Convert a ParsedOperation (from adapter parser) to a TransactionParam
+ * (for policy engine evaluation).
+ *
+ * Mapping:
+ * - NATIVE_TRANSFER -> TRANSFER (WHITELIST, SPENDING_LIMIT)
+ * - TOKEN_TRANSFER -> TOKEN_TRANSFER (WHITELIST, ALLOWED_TOKENS, SPENDING_LIMIT)
+ * - CONTRACT_CALL -> CONTRACT_CALL (CONTRACT_WHITELIST, METHOD_WHITELIST)
+ * - APPROVE -> APPROVE (APPROVED_SPENDERS, APPROVE_AMOUNT_LIMIT, APPROVE_TIER_OVERRIDE)
+ * - UNKNOWN -> CONTRACT_CALL (CONTRACT_WHITELIST default deny for unknown)
+ */
+export declare function mapOperationToParam(op: ParsedOperation, chain: string, network?: string): TransactionParam;
+/**
+ * Execute the sign-only pipeline for an external unsigned transaction.
+ *
+ * Steps:
+ * 1. Parse -> 2. Map to policy params -> 3. Generate ID -> 4. INSERT DB ->
+ * 5. Evaluate policy -> 6. Check allowed -> 7. Check tier (reject DELAY/APPROVAL) ->
+ * 8. Update tier -> 9. Sign -> 10. Update status='SIGNED'
+ *
+ * @param deps - Pipeline dependencies (db, adapter, keyStore, policyEngine, etc.)
+ * @param walletId - The wallet whose key will sign
+ * @param request - Sign-only request (raw tx string, chain, network)
+ * @param sessionId - Optional session ID for audit trail
+ * @returns SignOnlyResult with signed transaction and metadata
+ */
+export declare function executeSignOnly(deps: SignOnlyDeps, walletId: string, request: SignOnlyRequest, sessionId?: string): Promise<SignOnlyResult>;
+export {};
+//# sourceMappingURL=sign-only.d.ts.map

package/dist/pipeline/sign-only.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"sign-only.d.ts","sourceRoot":"","sources":["../../src/pipeline/sign-only.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;GAoBG;AAGH,OAAO,KAAK,EAAE,qBAAqB,EAAE,MAAM,4BAA4B,CAAC;AACxE,OAAO,KAAK,EAAE,QAAQ,IAAI,cAAc,EAAE,MAAM,gBAAgB,CAAC;AACjE,OAAO,EAEL,KAAK,aAAa,EAClB,KAAK,aAAa,EAElB,KAAK,eAAe,EAEpB,KAAK,QAAQ,EACd,MAAM,cAAc,CAAC;AAGtB,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,wCAAwC,CAAC;AAC5E,OAAO,KAAK,KAAK,MAAM,MAAM,sCAAsC,CAAC;AAEpE,OAAO,KAAK,EAAE,mBAAmB,EAAE,MAAM,0CAA0C,CAAC;AAMpF,MAAM,WAAW,YAAY;IAC3B,EAAE,EAAE,qBAAqB,CAAC,OAAO,MAAM,CAAC,CAAC;IACzC,MAAM,CAAC,EAAE,cAAc,CAAC;IACxB,OAAO,EAAE,aAAa,CAAC;IACvB,QAAQ,EAAE,aAAa,CAAC;IACxB,YAAY,EAAE,aAAa,CAAC;IAC5B,cAAc,EAAE,MAAM,CAAC;IACvB,mBAAmB,CAAC,EAAE,mBAAmB,CAAC;IAC1C,QAAQ,CAAC,EAAE,QAAQ,CAAC;CACrB;AAED,MAAM,WAAW,eAAe;IAC9B,WAAW,EAAE,MAAM,CAAC;IACpB,KAAK,EAAE,MAAM,CAAC;IACd,OAAO,CAAC,EAAE,MAAM,CAAC;CAClB;AAED,MAAM,WAAW,cAAc;IAC7B,EAAE,EAAE,MAAM,CAAC;IACX,iBAAiB,EAAE,MAAM,CAAC;IAC1B,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,UAAU,EAAE,KAAK,CAAC;QAChB,IAAI,EAAE,MAAM,CAAC;QACb,EAAE,CAAC,EAAE,MAAM,CAAC;QACZ,MAAM,CAAC,EAAE,MAAM,CAAC;QAChB,KAAK,CAAC,EAAE,MAAM,CAAC;QACf,SAAS,CAAC,EAAE,MAAM,CAAC;QACnB,MAAM,CAAC,EAAE,MAAM,CAAC;KACjB,CAAC,CAAC;IACH,YAAY,EAAE;QACZ,IAAI,EAAE,MAAM,CAAC;KACd,CAAC;CACH;AAMD,UAAU,gBAAgB;IACxB,IAAI,EAAE,MAAM,CAAC;IACb,MAAM,EAAE,MAAM,CAAC;IACf,SAAS,EAAE,MAAM,CAAC;IAClB,KAAK,EAAE,MAAM,CAAC;IACd,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,YAAY,CAAC,EAAE,MAAM,CAAC;IACtB,eAAe,CAAC,EAAE,MAAM,CAAC;IACzB,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,cAAc,CAAC,EAAE,MAAM,CAAC;IACxB,aAAa,CAAC,EAAE,MAAM,CAAC;CACxB;AAMD;;;;;;;;;;GAUG;AACH,wBAAgB,mBAAmB,CACjC,EAAE,EAAE,eAAe,EACnB,KAAK,EAAE,MAAM,EACb,OAAO,CAAC,EAAE,MAAM,GACf,gBAAgB,CAyDlB;AAMD;;;;;;;;;;;;;GAaG;AACH,wBAAsB,eAAe,CACnC,IAAI,EAAE,YAAY,EAClB,QAAQ,EAAE,MAAM,EAChB,OAAO,EAAE,eAAe,EACxB,SAAS,CAAC,EAAE,MAAM,GACjB,OAAO,CAAC,cAAc,CAAC,CAqKzB"}

package/dist/pipeline/sign-only.js

@@ -0,0 +1,267 @@
+/**
+ * Sign-only pipeline module.
+ *
+ * Provides executeSignOnly() -- a standalone pipeline for signing external
+ * unsigned transactions after policy evaluation. Unlike the 6-stage send
+ * pipeline (stages.ts), this pipeline does NOT submit to chain.
+ *
+ * 10-step pipeline:
+ * 1. Parse unsigned tx (adapter.parseTransaction)
+ * 2. Map ParsedOperation[] to TransactionParam[] (for policy engine)
+ * 3. Generate UUID v7 transaction ID
+ * 4. INSERT DB record (type='SIGN', status='PENDING')
+ * 5. Policy evaluation (evaluateAndReserve / evaluateBatch / evaluate)
+ * 6. Check policy result (deny if !allowed)
+ * 7. Check tier (DELAY/APPROVAL -> immediate rejection)
+ * 8. Update tier on transaction row
+ * 9. Sign (keyStore.decrypt -> adapter.signExternalTransaction -> keyStore.release)
+ * 10. Update status='SIGNED', return result
+ *
+ * @see docs/32-pipeline-design.md
+ */
+import { eq } from 'drizzle-orm';
+import { WAIaaSError, } from '@waiaas/core';
+import { transactions } from '../infrastructure/database/schema.js';
+import { generateId } from '../infrastructure/database/id.js';
+import { DatabasePolicyEngine } from './database-policy-engine.js';
+// ---------------------------------------------------------------------------
+// Helper: map ParsedOperation to TransactionParam
+// ---------------------------------------------------------------------------
+/**
+ * Convert a ParsedOperation (from adapter parser) to a TransactionParam
+ * (for policy engine evaluation).
+ *
+ * Mapping:
+ * - NATIVE_TRANSFER -> TRANSFER (WHITELIST, SPENDING_LIMIT)
+ * - TOKEN_TRANSFER -> TOKEN_TRANSFER (WHITELIST, ALLOWED_TOKENS, SPENDING_LIMIT)
+ * - CONTRACT_CALL -> CONTRACT_CALL (CONTRACT_WHITELIST, METHOD_WHITELIST)
+ * - APPROVE -> APPROVE (APPROVED_SPENDERS, APPROVE_AMOUNT_LIMIT, APPROVE_TIER_OVERRIDE)
+ * - UNKNOWN -> CONTRACT_CALL (CONTRACT_WHITELIST default deny for unknown)
+ */
+export function mapOperationToParam(op, chain, network) {
+    switch (op.type) {
+        case 'NATIVE_TRANSFER':
+            return {
+                type: 'TRANSFER',
+                amount: (op.amount ?? 0n).toString(),
+                toAddress: op.to ?? '',
+                chain,
+                network,
+            };
+        case 'TOKEN_TRANSFER':
+            return {
+                type: 'TOKEN_TRANSFER',
+                amount: (op.amount ?? 0n).toString(),
+                toAddress: op.to ?? '',
+                chain,
+                network,
+                tokenAddress: op.token,
+            };
+        case 'CONTRACT_CALL':
+            return {
+                type: 'CONTRACT_CALL',
+                amount: '0',
+                toAddress: op.programId ?? op.to ?? '',
+                chain,
+                network,
+                contractAddress: op.programId ?? op.to,
+                selector: op.method,
+            };
+        case 'APPROVE':
+            return {
+                type: 'APPROVE',
+                amount: (op.amount ?? 0n).toString(),
+                toAddress: op.to ?? '',
+                chain,
+                network,
+                spenderAddress: op.to,
+                approveAmount: (op.amount ?? 0n).toString(),
+            };
+        case 'UNKNOWN':
+        default:
+            // UNKNOWN operations are mapped to CONTRACT_CALL for CONTRACT_WHITELIST evaluation
+            // If CONTRACT_WHITELIST is active (default), this will be denied unless the programId is whitelisted
+            return {
+                type: 'CONTRACT_CALL',
+                amount: '0',
+                toAddress: op.programId ?? op.to ?? '',
+                chain,
+                network,
+                contractAddress: op.programId ?? op.to,
+                selector: op.method,
+            };
+    }
+}
+// ---------------------------------------------------------------------------
+// executeSignOnly: 10-step sign-only pipeline
+// ---------------------------------------------------------------------------
+/**
+ * Execute the sign-only pipeline for an external unsigned transaction.
+ *
+ * Steps:
+ * 1. Parse -> 2. Map to policy params -> 3. Generate ID -> 4. INSERT DB ->
+ * 5. Evaluate policy -> 6. Check allowed -> 7. Check tier (reject DELAY/APPROVAL) ->
+ * 8. Update tier -> 9. Sign -> 10. Update status='SIGNED'
+ *
+ * @param deps - Pipeline dependencies (db, adapter, keyStore, policyEngine, etc.)
+ * @param walletId - The wallet whose key will sign
+ * @param request - Sign-only request (raw tx string, chain, network)
+ * @param sessionId - Optional session ID for audit trail
+ * @returns SignOnlyResult with signed transaction and metadata
+ */
+export async function executeSignOnly(deps, walletId, request, sessionId) {
+    // Step 1: Parse the unsigned transaction
+    let parsed;
+    try {
+        parsed = await deps.adapter.parseTransaction(request.transaction);
+    }
+    catch (err) {
+        throw new WAIaaSError('INVALID_TRANSACTION', {
+            message: err instanceof Error ? err.message : 'Failed to parse transaction',
+        });
+    }
+    // Fire-and-forget: notify TX_REQUESTED (never blocks pipeline)
+    const firstOp = parsed.operations[0];
+    void deps.notificationService?.notify('TX_REQUESTED', walletId, {
+        amount: firstOp?.amount?.toString() ?? '0',
+        to: firstOp?.to ?? '',
+        type: 'SIGN',
+        display_amount: '', // sign-only: no USD conversion
+    }, { txId: 'pending', signOnly: true });
+    // v1.6: emit wallet:activity TX_REQUESTED event
+    deps.eventBus?.emit('wallet:activity', {
+        walletId,
+        activity: 'TX_REQUESTED',
+        details: { signOnly: true },
+        timestamp: Math.floor(Date.now() / 1000),
+    });
+    // Step 2: Convert ParsedOperation[] to TransactionParam[] for policy evaluation
+    const txParams = parsed.operations.map((op) => mapOperationToParam(op, request.chain, request.network));
+    // Step 3: Generate transaction ID
+    const txId = generateId();
+    const now = new Date(Math.floor(Date.now() / 1000) * 1000);
+    // Step 4: INSERT transaction record (type='SIGN', status='PENDING')
+    await deps.db.insert(transactions).values({
+        id: txId,
+        walletId,
+        chain: request.chain,
+        network: request.network ?? null,
+        type: 'SIGN',
+        status: 'PENDING',
+        amount: firstOp?.amount?.toString() ?? null,
+        toAddress: firstOp?.to ?? null,
+        sessionId: sessionId ?? null,
+        createdAt: now,
+    });
+    // Step 5: Policy evaluation (single op vs multi-op)
+    let evaluation;
+    if (txParams.length === 1 && deps.policyEngine instanceof DatabasePolicyEngine && deps.sqlite) {
+        // Single operation: use evaluateAndReserve for TOCTOU safety
+        evaluation = deps.policyEngine.evaluateAndReserve(walletId, txParams[0], txId);
+    }
+    else if (txParams.length > 1 && deps.policyEngine instanceof DatabasePolicyEngine) {
+        // Multiple operations: use evaluateBatch
+        evaluation = await deps.policyEngine.evaluateBatch(walletId, txParams);
+        // For batch: manually set reserved_amount on the tx row
+        if (evaluation.allowed && deps.sqlite) {
+            const totalAmount = txParams.reduce((sum, p) => sum + BigInt(p.amount), 0n);
+            deps.sqlite
+                .prepare('UPDATE transactions SET reserved_amount = ? WHERE id = ?')
+                .run(totalAmount.toString(), txId);
+        }
+    }
+    else {
+        evaluation = await deps.policyEngine.evaluate(walletId, txParams[0]);
+    }
+    // Step 6: Check policy result
+    if (!evaluation.allowed) {
+        await deps.db
+            .update(transactions)
+            .set({ status: 'CANCELLED', error: evaluation.reason ?? 'Policy denied' })
+            .where(eq(transactions.id, txId));
+        throw new WAIaaSError('POLICY_DENIED', {
+            message: evaluation.reason ?? 'Sign-only request denied by policy',
+        });
+    }
+    // Step 7: DELAY/APPROVAL tier = immediate rejection for sign-only
+    if (evaluation.tier === 'DELAY' || evaluation.tier === 'APPROVAL') {
+        await deps.db
+            .update(transactions)
+            .set({
+            status: 'CANCELLED',
+            tier: evaluation.tier,
+            error: `Sign-only does not support ${evaluation.tier} tier`,
+        })
+            .where(eq(transactions.id, txId));
+        throw new WAIaaSError('POLICY_DENIED', {
+            message: `Sign-only request requires ${evaluation.tier} tier which is not supported. Use POST /v1/transactions/send for high-value transactions.`,
+        });
+    }
+    // Step 8: Update tier on transaction row
+    await deps.db
+        .update(transactions)
+        .set({ tier: evaluation.tier })
+        .where(eq(transactions.id, txId));
+    // Step 9: Sign the transaction
+    // CRITICAL: key MUST be released in finally block (see Pitfall 3)
+    let signed;
+    let privateKey = null;
+    try {
+        privateKey = await deps.keyStore.decryptPrivateKey(walletId, deps.masterPassword);
+        signed = await deps.adapter.signExternalTransaction(request.transaction, privateKey);
+    }
+    catch (err) {
+        await deps.db
+            .update(transactions)
+            .set({ status: 'FAILED', error: err instanceof Error ? err.message : 'Signing failed' })
+            .where(eq(transactions.id, txId));
+        throw err instanceof WAIaaSError
+            ? err
+            : new WAIaaSError('CHAIN_ERROR', {
+                message: err instanceof Error ? err.message : 'Failed to sign transaction',
+            });
+    }
+    finally {
+        if (privateKey) {
+            deps.keyStore.releaseKey(privateKey);
+        }
+    }
+    // Step 10: Update DB: status='SIGNED'
+    const executedAt = new Date(Math.floor(Date.now() / 1000) * 1000);
+    await deps.db
+        .update(transactions)
+        .set({ status: 'SIGNED', executedAt })
+        .where(eq(transactions.id, txId));
+    // Fire-and-forget: notify TX_SUBMITTED (sign complete, ready for external submission)
+    void deps.notificationService?.notify('TX_SUBMITTED', walletId, {
+        txHash: signed.txHash ?? '',
+        amount: firstOp?.amount?.toString() ?? '0',
+        to: firstOp?.to ?? '',
+        display_amount: '', // sign-only: no USD conversion
+    }, { txId, signOnly: true });
+    // v1.6: emit wallet:activity TX_SUBMITTED event (sign-only complete)
+    deps.eventBus?.emit('wallet:activity', {
+        walletId,
+        activity: 'TX_SUBMITTED',
+        details: { txId, signOnly: true, txHash: signed.txHash },
+        timestamp: Math.floor(Date.now() / 1000),
+    });
+    // Return result
+    return {
+        id: txId,
+        signedTransaction: signed.signedTransaction,
+        txHash: signed.txHash,
+        operations: parsed.operations.map((op) => ({
+            type: op.type,
+            to: op.to,
+            amount: op.amount?.toString(),
+            token: op.token,
+            programId: op.programId,
+            method: op.method,
+        })),
+        policyResult: {
+            tier: evaluation.tier,
+        },
+    };
+}
+//# sourceMappingURL=sign-only.js.map

package/dist/pipeline/sign-only.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"sign-only.js","sourceRoot":"","sources":["../../src/pipeline/sign-only.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;GAoBG;AAEH,OAAO,EAAE,EAAE,EAAE,MAAM,aAAa,CAAC;AAGjC,OAAO,EACL,WAAW,GAOZ,MAAM,cAAc,CAAC;AACtB,OAAO,EAAE,YAAY,EAAE,MAAM,sCAAsC,CAAC;AACpE,OAAO,EAAE,UAAU,EAAE,MAAM,kCAAkC,CAAC;AAG9D,OAAO,EAAE,oBAAoB,EAAE,MAAM,6BAA6B,CAAC;AA0DnE,8EAA8E;AAC9E,kDAAkD;AAClD,8EAA8E;AAE9E;;;;;;;;;;GAUG;AACH,MAAM,UAAU,mBAAmB,CACjC,EAAmB,EACnB,KAAa,EACb,OAAgB;IAEhB,QAAQ,EAAE,CAAC,IAAI,EAAE,CAAC;QAChB,KAAK,iBAAiB;YACpB,OAAO;gBACL,IAAI,EAAE,UAAU;gBAChB,MAAM,EAAE,CAAC,EAAE,CAAC,MAAM,IAAI,EAAE,CAAC,CAAC,QAAQ,EAAE;gBACpC,SAAS,EAAE,EAAE,CAAC,EAAE,IAAI,EAAE;gBACtB,KAAK;gBACL,OAAO;aACR,CAAC;QAEJ,KAAK,gBAAgB;YACnB,OAAO;gBACL,IAAI,EAAE,gBAAgB;gBACtB,MAAM,EAAE,CAAC,EAAE,CAAC,MAAM,IAAI,EAAE,CAAC,CAAC,QAAQ,EAAE;gBACpC,SAAS,EAAE,EAAE,CAAC,EAAE,IAAI,EAAE;gBACtB,KAAK;gBACL,OAAO;gBACP,YAAY,EAAE,EAAE,CAAC,KAAK;aACvB,CAAC;QAEJ,KAAK,eAAe;YAClB,OAAO;gBACL,IAAI,EAAE,eAAe;gBACrB,MAAM,EAAE,GAAG;gBACX,SAAS,EAAE,EAAE,CAAC,SAAS,IAAI,EAAE,CAAC,EAAE,IAAI,EAAE;gBACtC,KAAK;gBACL,OAAO;gBACP,eAAe,EAAE,EAAE,CAAC,SAAS,IAAI,EAAE,CAAC,EAAE;gBACtC,QAAQ,EAAE,EAAE,CAAC,MAAM;aACpB,CAAC;QAEJ,KAAK,SAAS;YACZ,OAAO;gBACL,IAAI,EAAE,SAAS;gBACf,MAAM,EAAE,CAAC,EAAE,CAAC,MAAM,IAAI,EAAE,CAAC,CAAC,QAAQ,EAAE;gBACpC,SAAS,EAAE,EAAE,CAAC,EAAE,IAAI,EAAE;gBACtB,KAAK;gBACL,OAAO;gBACP,cAAc,EAAE,EAAE,CAAC,EAAE;gBACrB,aAAa,EAAE,CAAC,EAAE,CAAC,MAAM,IAAI,EAAE,CAAC,CAAC,QAAQ,EAAE;aAC5C,CAAC;QAEJ,KAAK,SAAS,CAAC;QACf;YACE,mFAAmF;YACnF,qGAAqG;YACrG,OAAO;gBACL,IAAI,EAAE,eAAe;gBACrB,MAAM,EAAE,GAAG;gBACX,SAAS,EAAE,EAAE,CAAC,SAAS,IAAI,EAAE,CAAC,EAAE,IAAI,EAAE;gBACtC,KAAK;gBACL,OAAO;gBACP,eAAe,EAAE,EAAE,CAAC,SAAS,IAAI,EAAE,CAAC,EAAE;gBACtC,QAAQ,EAAE,EAAE,CAAC,MAAM;aACpB,CAAC;IACN,CAAC;AACH,CAAC;AAED,8EAA8E;AAC9E,8CAA8C;AAC9C,8EAA8E;AAE9E;;;;;;;;;;;;;GAaG;AACH,MAAM,CAAC,KAAK,UAAU,eAAe,CACnC,IAAkB,EAClB,QAAgB,EAChB,OAAwB,EACxB,SAAkB;IAElB,yCAAyC;IACzC,IAAI,MAAyB,CAAC;IAC9B,IAAI,CAAC;QACH,MAAM,GAAG,MAAM,IAAI,CAAC,OAAO,CAAC,gBAAgB,CAAC,OAAO,CAAC,WAAW,CAAC,CAAC;IACpE,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,MAAM,IAAI,WAAW,CAAC,qBAAqB,EAAE;YAC3C,OAAO,EAAE,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,6BAA6B;SAC5E,CAAC,CAAC;IACL,CAAC;IAED,+DAA+D;IAC/D,MAAM,OAAO,GAAG,MAAM,CAAC,UAAU,CAAC,CAAC,CAAC,CAAC;IACrC,KAAK,IAAI,CAAC,mBAAmB,EAAE,MAAM,CAAC,cAAc,EAAE,QAAQ,EAAE;QAC9D,MAAM,EAAE,OAAO,EAAE,MAAM,EAAE,QAAQ,EAAE,IAAI,GAAG;QAC1C,EAAE,EAAE,OAAO,EAAE,EAAE,IAAI,EAAE;QACrB,IAAI,EAAE,MAAM;QACZ,cAAc,EAAE,EAAE,EAAE,+BAA+B;KACpD,EAAE,EAAE,IAAI,EAAE,SAAS,EAAE,QAAQ,EAAE,IAAI,EAAE,CAAC,CAAC;IAExC,gDAAgD;IAChD,IAAI,CAAC,QAAQ,EAAE,IAAI,CAAC,iBAAiB,EAAE;QACrC,QAAQ;QACR,QAAQ,EAAE,cAAc;QACxB,OAAO,EAAE,EAAE,QAAQ,EAAE,IAAI,EAAE;QAC3B,SAAS,EAAE,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,GAAG,EAAE,GAAG,IAAI,CAAC;KACzC,CAAC,CAAC;IAEH,gFAAgF;IAChF,MAAM,QAAQ,GAAG,MAAM,CAAC,UAAU,CAAC,GAAG,CAAC,CAAC,EAAE,EAAE,EAAE,CAC5C,mBAAmB,CAAC,EAAE,EAAE,OAAO,CAAC,KAAK,EAAE,OAAO,CAAC,OAAO,CAAC,CACxD,CAAC;IAEF,kCAAkC;IAClC,MAAM,IAAI,GAAG,UAAU,EAAE,CAAC;IAC1B,MAAM,GAAG,GAAG,IAAI,IAAI,CAAC,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,GAAG,EAAE,GAAG,IAAI,CAAC,GAAG,IAAI,CAAC,CAAC;IAE3D,oEAAoE;IACpE,MAAM,IAAI,CAAC,EAAE,CAAC,MAAM,CAAC,YAAY,CAAC,CAAC,MAAM,CAAC;QACxC,EAAE,EAAE,IAAI;QACR,QAAQ;QACR,KAAK,EAAE,OAAO,CAAC,KAAK;QACpB,OAAO,EAAE,OAAO,CAAC,OAAO,IAAI,IAAI;QAChC,IAAI,EAAE,MAAM;QACZ,MAAM,EAAE,SAAS;QACjB,MAAM,EAAE,OAAO,EAAE,MAAM,EAAE,QAAQ,EAAE,IAAI,IAAI;QAC3C,SAAS,EAAE,OAAO,EAAE,EAAE,IAAI,IAAI;QAC9B,SAAS,EAAE,SAAS,IAAI,IAAI;QAC5B,SAAS,EAAE,GAAG;KACf,CAAC,CAAC;IAEH,oDAAoD;IACpD,IAAI,UAAU,CAAC;IACf,IAAI,QAAQ,CAAC,MAAM,KAAK,CAAC,IAAI,IAAI,CAAC,YAAY,YAAY,oBAAoB,IAAI,IAAI,CAAC,MAAM,EAAE,CAAC;QAC9F,6DAA6D;QAC7D,UAAU,GAAG,IAAI,CAAC,YAAY,CAAC,kBAAkB,CAAC,QAAQ,EAAE,QAAQ,CAAC,CAAC,CAAE,EAAE,IAAI,CAAC,CAAC;IAClF,CAAC;SAAM,IAAI,QAAQ,CAAC,MAAM,GAAG,CAAC,IAAI,IAAI,CAAC,YAAY,YAAY,oBAAoB,EAAE,CAAC;QACpF,yCAAyC;QACzC,UAAU,GAAG,MAAM,IAAI,CAAC,YAAY,CAAC,aAAa,CAAC,QAAQ,EAAE,QAAQ,CAAC,CAAC;QACvE,wDAAwD;QACxD,IAAI,UAAU,CAAC,OAAO,IAAI,IAAI,CAAC,MAAM,EAAE,CAAC;YACtC,MAAM,WAAW,GAAG,QAAQ,CAAC,MAAM,CAAC,CAAC,GAAG,EAAE,CAAC,EAAE,EAAE,CAAC,GAAG,GAAG,MAAM,CAAC,CAAC,CAAC,MAAM,CAAC,EAAE,EAAE,CAAC,CAAC;YAC5E,IAAI,CAAC,MAAM;iBACR,OAAO,CAAC,0DAA0D,CAAC;iBACnE,GAAG,CAAC,WAAW,CAAC,QAAQ,EAAE,EAAE,IAAI,CAAC,CAAC;QACvC,CAAC;IACH,CAAC;SAAM,CAAC;QACN,UAAU,GAAG,MAAM,IAAI,CAAC,YAAY,CAAC,QAAQ,CAAC,QAAQ,EAAE,QAAQ,CAAC,CAAC,CAAE,CAAC,CAAC;IACxE,CAAC;IAED,8BAA8B;IAC9B,IAAI,CAAC,UAAU,CAAC,OAAO,EAAE,CAAC;QACxB,MAAM,IAAI,CAAC,EAAE;aACV,MAAM,CAAC,YAAY,CAAC;aACpB,GAAG,CAAC,EAAE,MAAM,EAAE,WAAW,EAAE,KAAK,EAAE,UAAU,CAAC,MAAM,IAAI,eAAe,EAAE,CAAC;aACzE,KAAK,CAAC,EAAE,CAAC,YAAY,CAAC,EAAE,EAAE,IAAI,CAAC,CAAC,CAAC;QACpC,MAAM,IAAI,WAAW,CAAC,eAAe,EAAE;YACrC,OAAO,EAAE,UAAU,CAAC,MAAM,IAAI,oCAAoC;SACnE,CAAC,CAAC;IACL,CAAC;IAED,kEAAkE;IAClE,IAAI,UAAU,CAAC,IAAI,KAAK,OAAO,IAAI,UAAU,CAAC,IAAI,KAAK,UAAU,EAAE,CAAC;QAClE,MAAM,IAAI,CAAC,EAAE;aACV,MAAM,CAAC,YAAY,CAAC;aACpB,GAAG,CAAC;YACH,MAAM,EAAE,WAAW;YACnB,IAAI,EAAE,UAAU,CAAC,IAAI;YACrB,KAAK,EAAE,8BAA8B,UAAU,CAAC,IAAI,OAAO;SAC5D,CAAC;aACD,KAAK,CAAC,EAAE,CAAC,YAAY,CAAC,EAAE,EAAE,IAAI,CAAC,CAAC,CAAC;QACpC,MAAM,IAAI,WAAW,CAAC,eAAe,EAAE;YACrC,OAAO,EAAE,8BAA8B,UAAU,CAAC,IAAI,2FAA2F;SAClJ,CAAC,CAAC;IACL,CAAC;IAED,yCAAyC;IACzC,MAAM,IAAI,CAAC,EAAE;SACV,MAAM,CAAC,YAAY,CAAC;SACpB,GAAG,CAAC,EAAE,IAAI,EAAE,UAAU,CAAC,IAAI,EAAE,CAAC;SAC9B,KAAK,CAAC,EAAE,CAAC,YAAY,CAAC,EAAE,EAAE,IAAI,CAAC,CAAC,CAAC;IAEpC,+BAA+B;IAC/B,kEAAkE;IAClE,IAAI,MAAyB,CAAC;IAC9B,IAAI,UAAU,GAAsB,IAAI,CAAC;IACzC,IAAI,CAAC;QACH,UAAU,GAAG,MAAM,IAAI,CAAC,QAAQ,CAAC,iBAAiB,CAAC,QAAQ,EAAE,IAAI,CAAC,cAAc,CAAC,CAAC;QAClF,MAAM,GAAG,MAAM,IAAI,CAAC,OAAO,CAAC,uBAAuB,CAAC,OAAO,CAAC,WAAW,EAAE,UAAU,CAAC,CAAC;IACvF,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,MAAM,IAAI,CAAC,EAAE;aACV,MAAM,CAAC,YAAY,CAAC;aACpB,GAAG,CAAC,EAAE,MAAM,EAAE,QAAQ,EAAE,KAAK,EAAE,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,gBAAgB,EAAE,CAAC;aACvF,KAAK,CAAC,EAAE,CAAC,YAAY,CAAC,EAAE,EAAE,IAAI,CAAC,CAAC,CAAC;QACpC,MAAM,GAAG,YAAY,WAAW;YAC9B,CAAC,CAAC,GAAG;YACL,CAAC,CAAC,IAAI,WAAW,CAAC,aAAa,EAAE;gBAC7B,OAAO,EAAE,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,4BAA4B;aAC3E,CAAC,CAAC;IACT,CAAC;YAAS,CAAC;QACT,IAAI,UAAU,EAAE,CAAC;YACf,IAAI,CAAC,QAAQ,CAAC,UAAU,CAAC,UAAU,CAAC,CAAC;QACvC,CAAC;IACH,CAAC;IAED,sCAAsC;IACtC,MAAM,UAAU,GAAG,IAAI,IAAI,CAAC,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,GAAG,EAAE,GAAG,IAAI,CAAC,GAAG,IAAI,CAAC,CAAC;IAClE,MAAM,IAAI,CAAC,EAAE;SACV,MAAM,CAAC,YAAY,CAAC;SACpB,GAAG,CAAC,EAAE,MAAM,EAAE,QAAQ,EAAE,UAAU,EAAE,CAAC;SACrC,KAAK,CAAC,EAAE,CAAC,YAAY,CAAC,EAAE,EAAE,IAAI,CAAC,CAAC,CAAC;IAEpC,sFAAsF;IACtF,KAAK,IAAI,CAAC,mBAAmB,EAAE,MAAM,CAAC,cAAc,EAAE,QAAQ,EAAE;QAC9D,MAAM,EAAE,MAAM,CAAC,MAAM,IAAI,EAAE;QAC3B,MAAM,EAAE,OAAO,EAAE,MAAM,EAAE,QAAQ,EAAE,IAAI,GAAG;QAC1C,EAAE,EAAE,OAAO,EAAE,EAAE,IAAI,EAAE;QACrB,cAAc,EAAE,EAAE,EAAE,+BAA+B;KACpD,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE,IAAI,EAAE,CAAC,CAAC;IAE7B,qEAAqE;IACrE,IAAI,CAAC,QAAQ,EAAE,IAAI,CAAC,iBAAiB,EAAE;QACrC,QAAQ;QACR,QAAQ,EAAE,cAAc;QACxB,OAAO,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE,IAAI,EAAE,MAAM,EAAE,MAAM,CAAC,MAAM,EAAE;QACxD,SAAS,EAAE,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,GAAG,EAAE,GAAG,IAAI,CAAC;KACzC,CAAC,CAAC;IAEH,gBAAgB;IAChB,OAAO;QACL,EAAE,EAAE,IAAI;QACR,iBAAiB,EAAE,MAAM,CAAC,iBAAiB;QAC3C,MAAM,EAAE,MAAM,CAAC,MAAM;QACrB,UAAU,EAAE,MAAM,CAAC,UAAU,CAAC,GAAG,CAAC,CAAC,EAAE,EAAE,EAAE,CAAC,CAAC;YACzC,IAAI,EAAE,EAAE,CAAC,IAAI;YACb,EAAE,EAAE,EAAE,CAAC,EAAE;YACT,MAAM,EAAE,EAAE,CAAC,MAAM,EAAE,QAAQ,EAAE;YAC7B,KAAK,EAAE,EAAE,CAAC,KAAK;YACf,SAAS,EAAE,EAAE,CAAC,SAAS;YACvB,MAAM,EAAE,EAAE,CAAC,MAAM;SAClB,CAAC,CAAC;QACH,YAAY,EAAE;YACZ,IAAI,EAAE,UAAU,CAAC,IAAI;SACtB;KACF,CAAC;AACJ,CAAC"}

package/dist/pipeline/sleep.d.ts

@@ -0,0 +1,6 @@
+/**
+ * Sleep utility for exponential backoff in pipeline retry logic.
+ * Extracted as a separate module for testability (vi.mock).
+ */
+export declare function sleep(ms: number): Promise<void>;
+//# sourceMappingURL=sleep.d.ts.map

package/dist/pipeline/sleep.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"sleep.d.ts","sourceRoot":"","sources":["../../src/pipeline/sleep.ts"],"names":[],"mappings":"AAAA;;;GAGG;AACH,wBAAgB,KAAK,CAAC,EAAE,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,CAE/C"}

package/dist/pipeline/sleep.js

@@ -0,0 +1,8 @@
+/**
+ * Sleep utility for exponential backoff in pipeline retry logic.
+ * Extracted as a separate module for testability (vi.mock).
+ */
+export function sleep(ms) {
+    return new Promise(resolve => setTimeout(resolve, ms));
+}
+//# sourceMappingURL=sleep.js.map

package/dist/pipeline/sleep.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"sleep.js","sourceRoot":"","sources":["../../src/pipeline/sleep.ts"],"names":[],"mappings":"AAAA;;;GAGG;AACH,MAAM,UAAU,KAAK,CAAC,EAAU;IAC9B,OAAO,IAAI,OAAO,CAAC,OAAO,CAAC,EAAE,CAAC,UAAU,CAAC,OAAO,EAAE,EAAE,CAAC,CAAC,CAAC;AACzD,CAAC"}

package/dist/pipeline/stages.d.ts

@@ -0,0 +1,82 @@
+/**
+ * 6-stage transaction pipeline stages.
+ *
+ * Stage 1: Validate request + INSERT PENDING transaction (with sessionId audit trail)
+ * Stage 2: Auth (sessionId passthrough from route handler)
+ * Stage 3: Policy evaluation (evaluateAndReserve TOCTOU-safe + downgradeIfNoOwner)
+ * Stage 4: Wait (v1.1 passthrough, INSTANT tier only)
+ * Stage 5: On-chain execution (build -> simulate -> sign -> submit)
+ * Stage 6: Confirmation wait
+ *
+ * @see docs/32-pipeline-design.md
+ */
+import type { BetterSQLite3Database } from 'drizzle-orm/better-sqlite3';
+import type { Database as SQLiteDatabase } from 'better-sqlite3';
+import { type IChainAdapter, type IPolicyEngine, type PolicyTier, type UnsignedTransaction, type SubmitResult, type SendTransactionRequest, type TransactionRequest } from '@waiaas/core';
+import type { LocalKeyStore } from '../infrastructure/keystore/keystore.js';
+import type * as schema from '../infrastructure/database/schema.js';
+import type { DelayQueue } from '../workflow/delay-queue.js';
+import type { ApprovalWorkflow } from '../workflow/approval-workflow.js';
+import type { NotificationService } from '../notifications/notification-service.js';
+import type { SettingsService } from '../infrastructure/settings/settings-service.js';
+import type { IPriceOracle, IForexRateService } from '@waiaas/core';
+import { type EventBus } from '@waiaas/core';
+import type { WcSigningBridge } from '../services/wc-signing-bridge.js';
+declare const hintedTokens: Set<string>;
+export { hintedTokens };
+export interface PipelineContext {
+    db: BetterSQLite3Database<typeof schema>;
+    adapter: IChainAdapter;
+    keyStore: LocalKeyStore;
+    policyEngine: IPolicyEngine;
+    masterPassword: string;
+    walletId: string;
+    wallet: {
+        publicKey: string;
+        chain: string;
+        environment: string;
+        defaultNetwork: string | null;
+    };
+    resolvedNetwork: string;
+    request: SendTransactionRequest | TransactionRequest;
+    txId: string;
+    tier?: PolicyTier;
+    unsignedTx?: UnsignedTransaction;
+    signedTx?: Uint8Array;
+    submitResult?: SubmitResult;
+    sessionId?: string;
+    sqlite?: SQLiteDatabase;
+    delaySeconds?: number;
+    downgraded?: boolean;
+    delayQueue?: DelayQueue;
+    approvalWorkflow?: ApprovalWorkflow;
+    config?: {
+        policy_defaults_delay_seconds: number;
+        policy_defaults_approval_timeout: number;
+    };
+    notificationService?: NotificationService;
+    priceOracle?: IPriceOracle;
+    settingsService?: SettingsService;
+    forexRateService?: IForexRateService;
+    amountUsd?: number;
+    eventBus?: EventBus;
+    wcSigningBridge?: WcSigningBridge;
+}
+export declare function stage1Validate(ctx: PipelineContext): Promise<void>;
+export declare function stage2Auth(_ctx: PipelineContext): Promise<void>;
+export declare function stage3Policy(ctx: PipelineContext): Promise<void>;
+export declare function stage4Wait(ctx: PipelineContext): Promise<void>;
+/**
+ * Stage 5: Build -> Simulate -> Sign -> Submit with CONC-01 retry logic.
+ *
+ * ChainError category-based retry:
+ * - PERMANENT: immediate FAILED, no retry
+ * - TRANSIENT: exponential backoff (1s, 2s, 4s), max 3 retries (retryCount >= 3 guard)
+ * - STALE: rebuild from Stage 5a, max 1 (retryCount >= 1 guard)
+ *
+ * retryCount is shared between TRANSIENT and STALE to limit total retry count.
+ * Total attempts: initial 1 + up to 3 retries = 4 max.
+ */
+export declare function stage5Execute(ctx: PipelineContext): Promise<void>;
+export declare function stage6Confirm(ctx: PipelineContext): Promise<void>;
+//# sourceMappingURL=stages.d.ts.map

package/dist/pipeline/stages.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"stages.d.ts","sourceRoot":"","sources":["../../src/pipeline/stages.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;GAWG;AAGH,OAAO,KAAK,EAAE,qBAAqB,EAAE,MAAM,4BAA4B,CAAC;AACxE,OAAO,KAAK,EAAE,QAAQ,IAAI,cAAc,EAAE,MAAM,gBAAgB,CAAC;AACjE,OAAO,EAKL,KAAK,aAAa,EAClB,KAAK,aAAa,EAClB,KAAK,UAAU,EACf,KAAK,mBAAmB,EACxB,KAAK,YAAY,EACjB,KAAK,sBAAsB,EAC3B,KAAK,kBAAkB,EAKxB,MAAM,cAAc,CAAC;AAGtB,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,wCAAwC,CAAC;AAC5E,OAAO,KAAK,KAAK,MAAM,MAAM,sCAAsC,CAAC;AAGpE,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,4BAA4B,CAAC;AAC7D,OAAO,KAAK,EAAE,gBAAgB,EAAE,MAAM,kCAAkC,CAAC;AACzE,OAAO,KAAK,EAAE,mBAAmB,EAAE,MAAM,0CAA0C,CAAC;AACpF,OAAO,KAAK,EAAE,eAAe,EAAE,MAAM,gDAAgD,CAAC;AACtF,OAAO,KAAK,EAAE,YAAY,EAAE,iBAAiB,EAAgB,MAAM,cAAc,CAAC;AAClF,OAAO,EAAyB,KAAK,QAAQ,EAAE,MAAM,cAAc,CAAC;AACpE,OAAO,KAAK,EAAE,eAAe,EAAE,MAAM,kCAAkC,CAAC;AAKxE,QAAA,MAAM,YAAY,aAAoB,CAAC;AAGvC,OAAO,EAAE,YAAY,EAAE,CAAC;AAMxB,MAAM,WAAW,eAAe;IAE9B,EAAE,EAAE,qBAAqB,CAAC,OAAO,MAAM,CAAC,CAAC;IACzC,OAAO,EAAE,aAAa,CAAC;IACvB,QAAQ,EAAE,aAAa,CAAC;IACxB,YAAY,EAAE,aAAa,CAAC;IAC5B,cAAc,EAAE,MAAM,CAAC;IAEvB,QAAQ,EAAE,MAAM,CAAC;IACjB,MAAM,EAAE;QAAE,SAAS,EAAE,MAAM,CAAC;QAAC,KAAK,EAAE,MAAM,CAAC;QAAC,WAAW,EAAE,MAAM,CAAC;QAAC,cAAc,EAAE,MAAM,GAAG,IAAI,CAAA;KAAE,CAAC;IACjG,eAAe,EAAE,MAAM,CAAC;IACxB,OAAO,EAAE,sBAAsB,GAAG,kBAAkB,CAAC;IAErD,IAAI,EAAE,MAAM,CAAC;IACb,IAAI,CAAC,EAAE,UAAU,CAAC;IAClB,UAAU,CAAC,EAAE,mBAAmB,CAAC;IACjC,QAAQ,CAAC,EAAE,UAAU,CAAC;IACtB,YAAY,CAAC,EAAE,YAAY,CAAC;IAE5B,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,MAAM,CAAC,EAAE,cAAc,CAAC;IACxB,YAAY,CAAC,EAAE,MAAM,CAAC;IACtB,UAAU,CAAC,EAAE,OAAO,CAAC;IAErB,UAAU,CAAC,EAAE,UAAU,CAAC;IACxB,gBAAgB,CAAC,EAAE,gBAAgB,CAAC;IACpC,MAAM,CAAC,EAAE;QACP,6BAA6B,EAAE,MAAM,CAAC;QACtC,gCAAgC,EAAE,MAAM,CAAC;KAC1C,CAAC;IAEF,mBAAmB,CAAC,EAAE,mBAAmB,CAAC;IAE1C,WAAW,CAAC,EAAE,YAAY,CAAC;IAE3B,eAAe,CAAC,EAAE,eAAe,CAAC;IAElC,gBAAgB,CAAC,EAAE,iBAAiB,CAAC;IAErC,SAAS,CAAC,EAAE,MAAM,CAAC;IAEnB,QAAQ,CAAC,EAAE,QAAQ,CAAC;IAEpB,eAAe,CAAC,EAAE,eAAe,CAAC;CACnC;AA0ID,wBAAsB,cAAc,CAAC,GAAG,EAAE,eAAe,GAAG,OAAO,CAAC,IAAI,CAAC,CAqDxE;AAMD,wBAAsB,UAAU,CAAC,IAAI,EAAE,eAAe,GAAG,OAAO,CAAC,IAAI,CAAC,CAIrE;AAMD,wBAAsB,YAAY,CAAC,GAAG,EAAE,eAAe,GAAG,OAAO,CAAC,IAAI,CAAC,CAuMtE;AAMD,wBAAsB,UAAU,CAAC,GAAG,EAAE,eAAe,GAAG,OAAO,CAAC,IAAI,CAAC,CA+CpE;AAqID;;;;;;;;;;GAUG;AACH,wBAAsB,aAAa,CAAC,GAAG,EAAE,eAAe,GAAG,OAAO,CAAC,IAAI,CAAC,CAqNvE;AAMD,wBAAsB,aAAa,CAAC,GAAG,EAAE,eAAe,GAAG,OAAO,CAAC,IAAI,CAAC,CAwEvE"}