cordisx 0.1.0-beta.2 → 0.1.0-beta.21

package/dist/src/launcher/wallet-pool-operation.js

@@ -0,0 +1,60 @@
+import { spendCanonical } from './wallet-spend-ipc-wire.js';
+import { sameSpendSource, spendId, spendObject, spendSigned, spendSource, spendTerms, } from './wallet-spend-validation.js';
+export function poolRecord(value, identity, source) {
+    const r = spendObject(value, ['reservation', 'sequence', 'paid', 'exited', 'decisionHash']);
+    const p = spendSigned(r.reservation, 'economy.pool-reservation/v1', identity.walletPublicKey);
+    if (p.walletId !== identity.walletId || p.walletPublicKey !== identity.walletPublicKey
+        || !sameSpendSource(source, spendSource({ serviceOrigin: p.serviceOrigin, servicePublicKey: p.servicePublicKey, serverId: p.serverId }))
+        || !Number.isSafeInteger(r.sequence) || r.sequence < 0 || !Number.isSafeInteger(r.paid) || r.paid < 0
+        || typeof r.exited !== 'boolean' || (r.decisionHash !== null && !/^[a-f0-9]{64}$/.test(r.decisionHash)))
+        throw Error('invalid pool record');
+    return r;
+}
+/** Economic effects are delegated to the trusted provider. This layer only authorizes an exact document. */
+export async function runPoolOperation(options) {
+    const { operation, input, source, identity, client, guard } = options;
+    if (operation === 'wallet-spend-pool-lookup') {
+        const result = await client.call('pool-lookup', { source, requestId: spendId(input.requestId) });
+        return result === null ? null : poolRecord(result, identity, source);
+    }
+    if (operation === 'wallet-spend-pool-apply') {
+        const decision = spendSigned(input.decision, 'economy.pool-decision/v1', source.servicePublicKey, 262_144);
+        spendTerms(JSON.stringify(decision.terms), source, identity, false, true);
+        guard();
+        options.markDispatched();
+        return poolRecord(await client.call('pool-apply', { source, decision: input.decision }), identity, source);
+    }
+    const terms = spendTerms(input.terms, source, identity, false, true);
+    const previous = await client.call('pool-lookup', { source, requestId: spendId(input.requestId) });
+    guard();
+    const check = (value) => {
+        const record = poolRecord(value, identity, source), p = JSON.parse(record.reservation).payload;
+        if (p.termsHash !== terms.hash || p.matchId !== terms.payload.matchId || p.amount !== terms.own.amount
+            || p.gameAccountId !== terms.own.gameAccountId)
+            throw Error('pool request conflict');
+        return record;
+    };
+    if (previous !== null)
+        return check(previous);
+    spendTerms(input.terms, source, identity, true, true);
+    const quote = spendObject(await client.call('pool-quote', { terms: input.terms, requestId: input.requestId }), [
+        'token',
+        'terms',
+    ]);
+    guard();
+    const quoted = spendTerms(quote.terms, source, identity, true, true);
+    if (spendCanonical(quoted.payload) !== spendCanonical(terms.payload))
+        throw Error('changed pool quote');
+    const approved = await options.confirm({
+        summary: `抵押 ${terms.own.amount} Token 参加 ${terms.payload.rounds} 轮游戏，按约定分配奖池。断线时保留抵押。`,
+        document: JSON.stringify({ plugin: options.plugin, terms: quoted.payload, termsHash: terms.hash }, null, 2),
+        signal: options.signal,
+    });
+    guard();
+    if (!approved)
+        return 'denied';
+    spendTerms(quote.terms, source, identity, true, true);
+    options.markDispatched();
+    return check(await client.call('pool-reserve', { token: quote.token }));
+}
+//# sourceMappingURL=wallet-pool-operation.js.map

package/dist/src/launcher/wallet-pool-operation.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"wallet-pool-operation.js","sourceRoot":"","sources":["../../../src/launcher/wallet-pool-operation.ts"],"names":[],"mappings":"AAIA,OAAO,EAAE,cAAc,EAAE,MAAM,4BAA4B,CAAA;AAC3D,OAAO,EACL,eAAe,EACf,OAAO,EACP,WAAW,EACX,WAAW,EACX,WAAW,EACX,UAAU,GACX,MAAM,8BAA8B,CAAA;AAErC,MAAM,UAAU,UAAU,CACxB,KAAc,EACd,QAA+B,EAC/B,MAA2B;IAE3B,MAAM,CAAC,GAAG,WAAW,CAAC,KAAK,EAAE,CAAC,aAAa,EAAE,UAAU,EAAE,MAAM,EAAE,QAAQ,EAAE,cAAc,CAAC,CAAC,CAAA;IAC3F,MAAM,CAAC,GAAG,WAAW,CAAC,CAAC,CAAC,WAAW,EAAE,6BAA6B,EAAE,QAAQ,CAAC,eAAe,CAAC,CAAA;IAC7F,IACE,CAAC,CAAC,QAAQ,KAAK,QAAQ,CAAC,QAAQ,IAAI,CAAC,CAAC,eAAe,KAAK,QAAQ,CAAC,eAAe;WAC/E,CAAC,eAAe,CACjB,MAAM,EACN,WAAW,CAAC,EAAE,aAAa,EAAE,CAAC,CAAC,aAAa,EAAE,gBAAgB,EAAE,CAAC,CAAC,gBAAgB,EAAE,QAAQ,EAAE,CAAC,CAAC,QAAQ,EAAE,CAAC,CAC5G;WACE,CAAC,MAAM,CAAC,aAAa,CAAC,CAAC,CAAC,QAAQ,CAAC,IAAI,CAAC,CAAC,QAAQ,GAAG,CAAC,IAAI,CAAC,MAAM,CAAC,aAAa,CAAC,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,IAAI,GAAG,CAAC;WAClG,OAAO,CAAC,CAAC,MAAM,KAAK,SAAS,IAAI,CAAC,CAAC,CAAC,YAAY,KAAK,IAAI,IAAI,CAAC,gBAAgB,CAAC,IAAI,CAAC,CAAC,CAAC,YAAY,CAAC,CAAC;QACvG,MAAM,KAAK,CAAC,qBAAqB,CAAC,CAAA;IACpC,OAAO,CAAkC,CAAA;AAC3C,CAAC;AACD,4GAA4G;AAC5G,MAAM,CAAC,KAAK,UAAU,gBAAgB,CAAC,OAWtC;IACC,MAAM,EAAE,SAAS,EAAE,KAAK,EAAE,MAAM,EAAE,QAAQ,EAAE,MAAM,EAAE,KAAK,EAAE,GAAG,OAAO,CAAA;IACrE,IAAI,SAAS,KAAK,0BAA0B,EAAE,CAAC;QAC7C,MAAM,MAAM,GAAG,MAAM,MAAM,CAAC,IAAI,CAAC,aAAa,EAAE,EAAE,MAAM,EAAE,SAAS,EAAE,OAAO,CAAC,KAAK,CAAC,SAAS,CAAC,EAAE,CAAC,CAAA;QAChG,OAAO,MAAM,KAAK,IAAI,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,UAAU,CAAC,MAAM,EAAE,QAAQ,EAAE,MAAM,CAAC,CAAA;IACtE,CAAC;IACD,IAAI,SAAS,KAAK,yBAAyB,EAAE,CAAC;QAC5C,MAAM,QAAQ,GAAG,WAAW,CAAC,KAAK,CAAC,QAAQ,EAAE,0BAA0B,EAAE,MAAM,CAAC,gBAAgB,EAAE,OAAO,CAAC,CAAA;QAC1G,UAAU,CAAC,IAAI,CAAC,SAAS,CAAC,QAAQ,CAAC,KAAK,CAAC,EAAE,MAAM,EAAE,QAAQ,EAAE,KAAK,EAAE,IAAI,CAAC,CAAA;QACzE,KAAK,EAAE,CAAA;QACP,OAAO,CAAC,cAAc,EAAE,CAAA;QACxB,OAAO,UAAU,CAAC,MAAM,MAAM,CAAC,IAAI,CAAC,YAAY,EAAE,EAAE,MAAM,EAAE,QAAQ,EAAE,KAAK,CAAC,QAAQ,EAAE,CAAC,EAAE,QAAQ,EAAE,MAAM,CAAC,CAAA;IAC5G,CAAC;IACD,MAAM,KAAK,GAAG,UAAU,CAAC,KAAK,CAAC,KAAK,EAAE,MAAM,EAAE,QAAQ,EAAE,KAAK,EAAE,IAAI,CAAC,CAAA;IACpE,MAAM,QAAQ,GAAG,MAAM,MAAM,CAAC,IAAI,CAAC,aAAa,EAAE,EAAE,MAAM,EAAE,SAAS,EAAE,OAAO,CAAC,KAAK,CAAC,SAAS,CAAC,EAAE,CAAC,CAAA;IAClG,KAAK,EAAE,CAAA;IACP,MAAM,KAAK,GAAG,CAAC,KAAc,EAAE,EAAE;QAC/B,MAAM,MAAM,GAAG,UAAU,CAAC,KAAK,EAAE,QAAQ,EAAE,MAAM,CAAC,EAAE,CAAC,GAAG,IAAI,CAAC,KAAK,CAAC,MAAM,CAAC,WAAW,CAAC,CAAC,OAAO,CAAA;QAC9F,IACE,CAAC,CAAC,SAAS,KAAK,KAAK,CAAC,IAAI,IAAI,CAAC,CAAC,OAAO,KAAK,KAAK,CAAC,OAAO,CAAC,OAAO,IAAI,CAAC,CAAC,MAAM,KAAK,KAAK,CAAC,GAAG,CAAC,MAAM;eAC/F,CAAC,CAAC,aAAa,KAAK,KAAK,CAAC,GAAG,CAAC,aAAa;YAC9C,MAAM,KAAK,CAAC,uBAAuB,CAAC,CAAA;QACtC,OAAO,MAAM,CAAA;IACf,CAAC,CAAA;IACD,IAAI,QAAQ,KAAK,IAAI;QAAE,OAAO,KAAK,CAAC,QAAQ,CAAC,CAAA;IAC7C,UAAU,CAAC,KAAK,CAAC,KAAK,EAAE,MAAM,EAAE,QAAQ,EAAE,IAAI,EAAE,IAAI,CAAC,CAAA;IACrD,MAAM,KAAK,GAAG,WAAW,CAAC,MAAM,MAAM,CAAC,IAAI,CAAC,YAAY,EAAE,EAAE,KAAK,EAAE,KAAK,CAAC,KAAK,EAAE,SAAS,EAAE,KAAK,CAAC,SAAS,EAAE,CAAC,EAAE;QAC7G,OAAO;QACP,OAAO;KACR,CAAC,CAAA;IACF,KAAK,EAAE,CAAA;IACP,MAAM,MAAM,GAAG,UAAU,CAAC,KAAK,CAAC,KAAK,EAAE,MAAM,EAAE,QAAQ,EAAE,IAAI,EAAE,IAAI,CAAC,CAAA;IACpE,IAAI,cAAc,CAAC,MAAM,CAAC,OAAO,CAAC,KAAK,cAAc,CAAC,KAAK,CAAC,OAAO,CAAC;QAAE,MAAM,KAAK,CAAC,oBAAoB,CAAC,CAAA;IACvG,MAAM,QAAQ,GAAG,MAAM,OAAO,CAAC,OAAO,CAAC;QACrC,OAAO,EAAE,MAAM,KAAK,CAAC,GAAG,CAAC,MAAM,aAAa,KAAK,CAAC,OAAO,CAAC,MAAM,uBAAuB;QACvF,QAAQ,EAAE,IAAI,CAAC,SAAS,CAAC,EAAE,MAAM,EAAE,OAAO,CAAC,MAAM,EAAE,KAAK,EAAE,MAAM,CAAC,OAAO,EAAE,SAAS,EAAE,KAAK,CAAC,IAAI,EAAE,EAAE,IAAI,EAAE,CAAC,CAAC;QAC3G,MAAM,EAAE,OAAO,CAAC,MAAM;KACvB,CAAC,CAAA;IACF,KAAK,EAAE,CAAA;IACP,IAAI,CAAC,QAAQ;QAAE,OAAO,QAAiB,CAAA;IACvC,UAAU,CAAC,KAAK,CAAC,KAAK,EAAE,MAAM,EAAE,QAAQ,EAAE,IAAI,EAAE,IAAI,CAAC,CAAA;IACrD,OAAO,CAAC,cAAc,EAAE,CAAA;IACxB,OAAO,KAAK,CAAC,MAAM,MAAM,CAAC,IAAI,CAAC,cAAc,EAAE,EAAE,KAAK,EAAE,KAAK,CAAC,KAAK,EAAE,CAAC,CAAC,CAAA;AACzE,CAAC"}

package/dist/src/launcher/wallet-spend-authority.d.ts

@@ -0,0 +1,27 @@
+import type { WalletSpendResultV1 } from '@cordisx/protocol/wallet-spend/v1';
+import { LocalWalletRegistry } from './local-wallet-registry.js';
+import { confirmWalletSpendNative } from './wallet-spend-native-consent.js';
+import { fetchWalletSpendSource, verifyWalletSpendSource } from './wallet-spend-source-proof.js';
+import type { OwnerDocumentPrincipal } from './owner-document-rpc.js';
+export declare function isWalletSpendRequest(raw: unknown): boolean;
+/** Launcher-only authority. Renderer callbacks cannot confirm, configure, or select a wallet. */
+export declare class WalletSpendAuthority {
+    private readonly options;
+    private disposed;
+    private confirming;
+    private readonly retiredClients;
+    private readonly operations;
+    constructor(options: {
+        readonly homeDir?: string;
+        readonly profileId: string;
+        readonly resolve: (token: unknown) => OwnerDocumentPrincipal | undefined;
+        /** Test injection stays at the privileged process boundary. */
+        readonly confirm?: typeof confirmWalletSpendNative;
+        readonly registry?: LocalWalletRegistry;
+        readonly verifySource?: typeof verifyWalletSpendSource;
+        readonly fetchSource?: typeof fetchWalletSpendSource;
+    });
+    handle(raw: unknown, documentLive?: () => boolean): Promise<WalletSpendResultV1<unknown>>;
+    dispose(): void;
+}
+//# sourceMappingURL=wallet-spend-authority.d.ts.map

package/dist/src/launcher/wallet-spend-authority.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"wallet-spend-authority.d.ts","sourceRoot":"","sources":["../../../src/launcher/wallet-spend-authority.ts"],"names":[],"mappings":"AACA,OAAO,KAAK,EAAwB,mBAAmB,EAAuB,MAAM,mCAAmC,CAAA;AAEvH,OAAO,EAAoB,mBAAmB,EAAE,MAAM,4BAA4B,CAAA;AAGlF,OAAO,EAAE,wBAAwB,EAAE,MAAM,kCAAkC,CAAA;AAC3E,OAAO,EAAE,sBAAsB,EAAE,uBAAuB,EAAE,MAAM,gCAAgC,CAAA;AAEhG,OAAO,KAAK,EAAE,sBAAsB,EAAE,MAAM,yBAAyB,CAAA;AAerE,wBAAgB,oBAAoB,CAAC,GAAG,EAAE,OAAO,GAAG,OAAO,CAG1D;AACD,iGAAiG;AACjG,qBAAa,oBAAoB;IAM7B,OAAO,CAAC,QAAQ,CAAC,OAAO;IAL1B,OAAO,CAAC,QAAQ,CAAQ;IACxB,OAAO,CAAC,UAAU,CAAQ;IAC1B,OAAO,CAAC,QAAQ,CAAC,cAAc,CAAoB;IACnD,OAAO,CAAC,QAAQ,CAAC,UAAU,CAAkF;gBAE1F,OAAO,EAAE;QACxB,QAAQ,CAAC,OAAO,CAAC,EAAE,MAAM,CAAA;QACzB,QAAQ,CAAC,SAAS,EAAE,MAAM,CAAA;QAC1B,QAAQ,CAAC,OAAO,EAAE,CAAC,KAAK,EAAE,OAAO,KAAK,sBAAsB,GAAG,SAAS,CAAA;QACxE,+DAA+D;QAC/D,QAAQ,CAAC,OAAO,CAAC,EAAE,OAAO,wBAAwB,CAAA;QAClD,QAAQ,CAAC,QAAQ,CAAC,EAAE,mBAAmB,CAAA;QACvC,QAAQ,CAAC,YAAY,CAAC,EAAE,OAAO,uBAAuB,CAAA;QACtD,QAAQ,CAAC,WAAW,CAAC,EAAE,OAAO,sBAAsB,CAAA;KACrD;IAEG,MAAM,CAAC,GAAG,EAAE,OAAO,EAAE,YAAY,GAAE,MAAM,OAAoB,GAAG,OAAO,CAAC,mBAAmB,CAAC,OAAO,CAAC,CAAC;IA6c3G,OAAO,IAAI,IAAI;CAIhB"}

package/dist/src/launcher/wallet-spend-authority.js

@@ -0,0 +1,462 @@
+import { runPoolOperation } from './wallet-pool-operation.js';
+import { createMacOSKeychainBackend } from './secret-store.js';
+import { localWalletRealm, LocalWalletRegistry } from './local-wallet-registry.js';
+import { loadWalletSpendConfig, persistWalletSpendSource } from './wallet-spend-config.js';
+import { WalletSpendIpcClient } from './wallet-spend-ipc-client.js';
+import { confirmWalletSpendNative } from './wallet-spend-native-consent.js';
+import { fetchWalletSpendSource, verifyWalletSpendSource } from './wallet-spend-source-proof.js';
+import { spendCanonical } from './wallet-spend-ipc-wire.js';
+import { sameSpendSource, spendChallenge, spendId, spendIdentity, spendObject, spendPurchaseReceipt, spendRecord, spendSigned, spendSource, spendTerms, } from './wallet-spend-validation.js';
+const failure = (code) => ({ status: 'unavailable', code });
+export function isWalletSpendRequest(raw) {
+    return !!raw && typeof raw === 'object'
+        && String(raw.operation).startsWith('wallet-spend-');
+}
+/** Launcher-only authority. Renderer callbacks cannot confirm, configure, or select a wallet. */
+export class WalletSpendAuthority {
+    options;
+    disposed = false;
+    confirming = false;
+    retiredClients = new Set();
+    operations = new Map();
+    constructor(options) {
+        this.options = options;
+    }
+    async handle(raw, documentLive = () => true) {
+        let dispatched = false, releaseConfirmation = false, registeredOperation = false;
+        let client, timer;
+        let monitor, operationKey = '';
+        try {
+            const request = spendObject(raw);
+            if (Object.keys(request).some(key => !['version', 'requestId', 'token', 'operation', 'clientId', 'operationId', 'input'].includes(key)))
+                return failure('invalid-request');
+            const principal = this.options.resolve(request.token);
+            if (!principal || this.disposed || !documentLive())
+                return failure('stale-generation');
+            const ownerKey = JSON.stringify(principal), clientKey = ownerKey + ':' + spendId(request.clientId);
+            if (request.operation === 'wallet-spend-dispose' || request.operation === 'wallet-spend-abort') {
+                if (request.operation === 'wallet-spend-dispose') {
+                    if (this.retiredClients.size >= 1024)
+                        this.dispose();
+                    else
+                        this.retiredClients.add(clientKey);
+                }
+                for (const [key, operation] of this.operations) {
+                    if (operation.client === clientKey && (request.operation === 'wallet-spend-dispose'
+                        || key === clientKey + ':' + request.operationId))
+                        operation.abort.abort();
+                }
+                return { status: 'accepted', value: null };
+            }
+            if (this.retiredClients.has(clientKey))
+                return failure('stale-generation');
+            const input = spendObject(request.input), operation = request.operation;
+            const expected = operation === 'wallet-spend-identity'
+                ? []
+                : (operation === 'wallet-spend-reserve' || operation === 'wallet-spend-pool-reserve')
+                    ? ['source', 'terms', 'requestId', 'deadline']
+                    : operation === 'wallet-spend-bind'
+                        ? ['source', 'challenge', 'deadline']
+                        : (operation === 'wallet-spend-lookup' || operation === 'wallet-spend-pool-lookup')
+                            ? ['source', 'requestId', 'deadline']
+                            : (operation === 'wallet-spend-apply' || operation === 'wallet-spend-pool-apply')
+                                ? ['source', 'decision', 'deadline']
+                                : undefined;
+            const commerceExpected = operation === 'wallet-spend-catalog' || operation === 'wallet-spend-orders'
+                ? ['storeId', 'deadline']
+                : operation === 'wallet-spend-order'
+                    ? ['storeId', 'requestId', 'deadline']
+                    : (operation === 'wallet-spend-purchase' || operation === 'wallet-spend-cancel-purchase')
+                        ? [
+                            'storeId',
+                            'itemId',
+                            'quantity',
+                            'expectedTotal',
+                            'requestId',
+                            'deadline',
+                            ...(input.fulfillmentTarget === undefined ? [] : ['fulfillmentTarget']),
+                        ]
+                        : operation === 'wallet-spend-legacy-receipt'
+                            ? ['kind', 'requestId', 'input', 'deadline']
+                            : operation === 'wallet-spend-authorize-source'
+                                ? ['serviceOrigin', 'deadline']
+                                : undefined;
+            if (!expected && !commerceExpected)
+                return failure('invalid-request');
+            spendObject(input, expected ?? commerceExpected);
+            const deadline = operation === 'wallet-spend-identity' ? Date.now() + 10_000 : input.deadline;
+            if (!Number.isSafeInteger(deadline) || deadline > Date.now() + 120_000)
+                return failure('invalid-request');
+            if (deadline <= Date.now())
+                return failure('deadline-exceeded');
+            if (!this.options.homeDir)
+                return failure('unsupported');
+            let config;
+            try {
+                config = loadWalletSpendConfig(this.options.homeDir, this.options.profileId);
+            }
+            catch {
+                return failure('provider-unavailable');
+            }
+            const source = input.source === undefined ? undefined : spendSource(input.source);
+            if (source && !config.services.some(entry => entry.owner.pluginId === principal.identity.pluginId
+                && entry.owner.source === principal.identity.source && sameSpendSource(entry.source, source)
+                && (!['wallet-spend-bind', 'wallet-spend-reserve', 'wallet-spend-pool-reserve'].includes(operation)
+                    || entry.status === 'active')))
+                return failure('source-unavailable');
+            if (input.storeId !== undefined && !config.stores.some(entry => entry.owner.pluginId === principal.identity.pluginId
+                && entry.owner.source === principal.identity.source && entry.storeId === spendId(input.storeId)))
+                return failure('source-unavailable');
+            const registry = this.options.registry
+                ?? new LocalWalletRegistry(this.options.homeDir, this.options.profileId, createMacOSKeychainBackend());
+            let profile;
+            try {
+                profile = registry.active(config.binding);
+            }
+            catch {
+                return failure('wallet-unavailable');
+            }
+            const accountId = profile.entries.find(entry => entry.realm === localWalletRealm(config.binding)).accountId;
+            const abort = new AbortController();
+            operationKey = clientKey + ':' + spendId(request.operationId);
+            if (this.operations.size >= 32 || this.operations.has(operationKey))
+                return failure('invalid-request');
+            this.operations.set(operationKey, { client: clientKey, abort });
+            registeredOperation = true;
+            const live = () => !abort.signal.aborted && !this.disposed && documentLive() && !this.retiredClients.has(clientKey)
+                && this.options.resolve(request.token) !== undefined && registry.current(profile)
+                && loadWalletSpendConfig(this.options.homeDir, this.options.profileId).fingerprint === config.fingerprint;
+            const guard = () => {
+                if (!live())
+                    throw new Error('retired operation');
+            };
+            timer = setTimeout(() => abort.abort(), deadline - Date.now());
+            monitor = setInterval(() => {
+                try {
+                    guard();
+                }
+                catch {
+                    abort.abort();
+                }
+            }, 100);
+            guard();
+            if (operation === 'wallet-spend-authorize-source') {
+                if (this.confirming)
+                    return failure('denied');
+                this.confirming = true;
+                releaseConfirmation = true;
+                const prior = config.services.filter(entry => entry.owner.pluginId === principal.identity.pluginId
+                    && entry.owner.source === principal.identity.source && entry.source.serviceOrigin === input.serviceOrigin);
+                const operatorLocalPins = prior.filter(entry => entry.status === 'active' && new URL(entry.source.serviceOrigin).protocol === 'http:');
+                if (new URL(input.serviceOrigin).protocol !== 'https:' && !operatorLocalPins.length) {
+                    return failure('source-unavailable');
+                }
+                let fetched;
+                try {
+                    fetched = await (this.options.fetchSource ?? fetchWalletSpendSource)(input.serviceOrigin, abort.signal, operatorLocalPins.length > 0);
+                }
+                catch {
+                    return failure('source-unavailable');
+                }
+                guard();
+                // HTTP only reopens an exact active operator pin; it never onboards or rotates a key.
+                if (operatorLocalPins.length && !operatorLocalPins.some(entry => sameSpendSource(entry.source, fetched))) {
+                    return failure('source-unavailable');
+                }
+                if (prior.some(entry => entry.status === 'active' && sameSpendSource(entry.source, fetched))) {
+                    return { status: 'accepted', value: fetched };
+                }
+                const approved = await (this.options.confirm ?? confirmWalletSpendNative)({
+                    summary: prior.length
+                        ? 'This server identity changed. Approve this exact new origin and key? Old pending reservations keep their original key.'
+                        : 'Allow this exact HTTPS server identity for this plugin? Each future spend requires separate approval.',
+                    document: JSON.stringify({
+                        plugin: principal.identity,
+                        source: fetched,
+                        previousPins: prior.map(entry => entry.source),
+                    }, null, 2),
+                    signal: abort.signal,
+                });
+                guard();
+                if (!approved)
+                    return failure('denied');
+                persistWalletSpendSource(this.options.homeDir, this.options.profileId, config.fingerprint, principal.identity, fetched, guard);
+                return { status: 'accepted', value: fetched };
+            }
+            client = await WalletSpendIpcClient.open(config, {
+                origin: config.binding.origin,
+                instanceId: config.binding.instanceId,
+                accountId,
+                subject: profile.subject,
+                publicKey: profile.publicKey,
+            }, deadline, abort.signal);
+            guard();
+            const identity = spendIdentity(await client.call('identity', {}));
+            guard();
+            let value;
+            if (operation.startsWith('wallet-spend-pool-')) {
+                if (operation === 'wallet-spend-pool-reserve') {
+                    if (this.confirming)
+                        return failure('denied');
+                    this.confirming = true;
+                    releaseConfirmation = true;
+                }
+                value = await runPoolOperation({
+                    operation,
+                    input,
+                    source: source,
+                    identity,
+                    client,
+                    guard,
+                    markDispatched: () => {
+                        dispatched = true;
+                    },
+                    confirm: this.options.confirm ?? confirmWalletSpendNative,
+                    signal: abort.signal,
+                    plugin: principal.identity,
+                });
+                if (value === 'denied')
+                    return failure('denied');
+            }
+            else if (operation === 'wallet-spend-identity')
+                value = identity;
+            else if (operation === 'wallet-spend-catalog' || operation === 'wallet-spend-orders'
+                || operation === 'wallet-spend-order') {
+                value = await client.call(operation.slice('wallet-spend-'.length), {
+                    storeId: input.storeId,
+                    ...(operation === 'wallet-spend-order' ? { requestId: spendId(input.requestId) } : {}),
+                });
+                if (value !== null && (typeof value !== 'string' || Buffer.byteLength(value) > 262_144)) {
+                    throw new Error('invalid commerce result');
+                }
+            }
+            else if (operation === 'wallet-spend-legacy-receipt') {
+                if (!['grant', 'migration', 'purchase'].includes(input.kind) || typeof input.input !== 'string'
+                    || Buffer.byteLength(input.input) > 65_536)
+                    return failure('invalid-request');
+                value = await client.call('legacy-receipt', {
+                    kind: input.kind,
+                    requestId: spendId(input.requestId),
+                    input: input.input,
+                });
+                if (value !== null && (typeof value !== 'string' || Buffer.byteLength(value) > 262_144)) {
+                    throw new Error('invalid legacy receipt');
+                }
+            }
+            else if (operation === 'wallet-spend-purchase' || operation === 'wallet-spend-cancel-purchase') {
+                spendId(input.itemId);
+                spendId(input.requestId);
+                if (!Number.isSafeInteger(input.quantity) || input.quantity < 1 || input.quantity > 1000
+                    || !Number.isSafeInteger(input.expectedTotal) || input.expectedTotal < 0
+                    || input.expectedTotal > 1_000_000_000_000)
+                    return failure('invalid-request');
+                if (input.fulfillmentTarget !== undefined) {
+                    spendObject(input.fulfillmentTarget, ['namespace', 'storeId']);
+                    if (input.fulfillmentTarget.namespace !== input.storeId)
+                        return failure('invalid-request');
+                    spendId(input.fulfillmentTarget.storeId);
+                }
+                const purchaseInput = {
+                    storeId: input.storeId,
+                    itemId: input.itemId,
+                    quantity: input.quantity,
+                    expectedTotal: input.expectedTotal,
+                    requestId: input.requestId,
+                    ...(input.fulfillmentTarget === undefined ? {} : { fulfillmentTarget: input.fulfillmentTarget }),
+                };
+                const previous = await client.call('order', { storeId: input.storeId, requestId: input.requestId });
+                guard();
+                if (previous !== null) {
+                    try {
+                        spendPurchaseReceipt(previous, purchaseInput, config.binding.instanceId, accountId);
+                    }
+                    catch {
+                        return failure('conflict');
+                    }
+                    return { status: 'accepted', value: previous };
+                }
+                if (this.confirming)
+                    return failure('denied');
+                this.confirming = true;
+                releaseConfirmation = true;
+                const cancelling = operation === 'wallet-spend-cancel-purchase';
+                const quoted = spendObject(await client.call(cancelling ? 'quote-cancellation' : 'quote-purchase', purchaseInput), ['token', 'quote']);
+                guard();
+                if (typeof quoted.quote !== 'string' || Buffer.byteLength(quoted.quote) > 65_536) {
+                    return failure('invalid-request');
+                }
+                if (cancelling) {
+                    const quote = spendObject(JSON.parse(quoted.quote), ['contract', 'walletId', 'input']);
+                    if (quote.contract !== 'economy.local-purchase-cancellation-quote/v1' || quote.walletId !== identity.walletId
+                        || spendCanonical(quote.input) !== spendCanonical(purchaseInput))
+                        return failure('invalid-request');
+                    const approved = await (this.options.confirm ?? confirmWalletSpendNative)({
+                        summary: 'Cancel this exact local purchase request? If it already committed, recover its existing order.',
+                        document: JSON.stringify({
+                            plugin: principal.identity,
+                            originalWallet: { instanceId: config.binding.instanceId, accountId },
+                            quote,
+                        }, null, 2),
+                        signal: abort.signal,
+                    });
+                    guard();
+                    if (!approved)
+                        return failure('denied');
+                    dispatched = true;
+                    const result = await client.call('cancel-purchase', { token: quoted.token });
+                    spendPurchaseReceipt(result, purchaseInput, config.binding.instanceId, accountId);
+                    guard();
+                    return { status: 'accepted', value: result };
+                }
+                const q = spendObject(JSON.parse(quoted.quote), [
+                    'contract',
+                    'storeId',
+                    'itemId',
+                    'title',
+                    'quantity',
+                    'unitPrice',
+                    'total',
+                    'requestId',
+                    'walletId',
+                    ...(input.fulfillmentTarget === undefined ? [] : ['fulfillmentTarget']),
+                ]);
+                if (q.contract !== 'economy.local-purchase-quote/v1' || q.storeId !== input.storeId || q.itemId !== input.itemId
+                    || q.quantity !== input.quantity || q.total !== input.expectedTotal || q.requestId !== input.requestId
+                    || q.walletId !== identity.walletId || typeof q.title !== 'string' || !Number.isSafeInteger(q.unitPrice)
+                    || q.unitPrice < 0 || q.total !== q.quantity * q.unitPrice
+                    || spendCanonical(q.fulfillmentTarget ?? null) !== spendCanonical(input.fulfillmentTarget ?? null))
+                    return failure('invalid-request');
+                const approved = await (this.options.confirm ?? confirmWalletSpendNative)({
+                    summary: `Buy exactly ${q.quantity} item(s) for ${q.total} Token from the local catalog.`,
+                    document: JSON.stringify({
+                        plugin: principal.identity,
+                        originalWallet: { instanceId: config.binding.instanceId, accountId },
+                        quote: q,
+                    }, null, 2),
+                    signal: abort.signal,
+                });
+                guard();
+                dispatched = true;
+                value = await client.call(approved ? 'purchase' : 'cancel-purchase', { token: quoted.token });
+                spendPurchaseReceipt(value, purchaseInput, config.binding.instanceId, accountId);
+            }
+            else if (operation === 'wallet-spend-lookup') {
+                const result = await client.call('lookup', { source, requestId: spendId(input.requestId) });
+                value = result === null ? null : spendRecord(result, identity, source);
+            }
+            else if (operation === 'wallet-spend-apply') {
+                const decision = spendSigned(input.decision, 'economy.spend-decision/v1', source.servicePublicKey, 262_144);
+                if (!sameSpendSource(source, spendSource({
+                    serviceOrigin: decision.serviceOrigin,
+                    servicePublicKey: decision.servicePublicKey,
+                    serverId: decision.serverId,
+                })))
+                    return failure('invalid-request');
+                guard();
+                dispatched = true;
+                const records = await client.call('apply', { source, decision: input.decision });
+                if (!Array.isArray(records) || records.length > 8)
+                    throw new Error('invalid records');
+                value = records.map(record => spendRecord(record, identity, source));
+            }
+            else {
+                if (operation === 'wallet-spend-reserve') {
+                    const terms = spendTerms(input.terms, source, identity, false);
+                    const prior = await client.call('lookup', { source, requestId: spendId(input.requestId) });
+                    guard();
+                    if (prior !== null) {
+                        const record = spendRecord(prior, identity, source), receipt = JSON.parse(record.reservation).payload;
+                        if (receipt.termsHash !== terms.hash || receipt.matchId !== terms.payload.matchId
+                            || receipt.gameAccountId !== terms.own.gameAccountId || receipt.amount !== terms.own.amount)
+                            return failure('conflict');
+                        return { status: 'accepted', value: record };
+                    }
+                }
+                try {
+                    await (this.options.verifySource ?? verifyWalletSpendSource)(source, abort.signal);
+                }
+                catch {
+                    return failure('source-unavailable');
+                }
+                guard();
+                if (this.confirming)
+                    return failure('denied');
+                this.confirming = true;
+                releaseConfirmation = true;
+                const binding = operation === 'wallet-spend-bind';
+                const original = binding
+                    ? spendChallenge(input.challenge, source)
+                    : spendTerms(input.terms, source, identity).payload;
+                const quote = spendObject(await client.call(binding ? 'quote-binding' : 'quote', binding
+                    ? { challenge: input.challenge }
+                    : { terms: input.terms, requestId: spendId(input.requestId) }), binding ? ['token', 'challenge'] : ['token', 'terms']);
+                guard();
+                const quoted = binding
+                    ? spendChallenge(quote.challenge, source)
+                    : spendTerms(quote.terms, source, identity).payload;
+                if (spendCanonical(original) !== spendCanonical(quoted))
+                    return failure('invalid-request');
+                const terms = binding ? undefined : spendTerms(quote.terms, source, identity);
+                const approved = await (this.options.confirm ?? confirmWalletSpendNative)({
+                    summary: binding
+                        ? 'Link this logged-in game account to your existing local wallet. This does not spend Token.'
+                        : `Reserve exactly ${terms.own.amount} Token. This service may consume 0–${terms.own.amount}; the remainder returns to this reservation. No game winnings mint Token. Offline or timeout keeps funds reserved.`,
+                    document: JSON.stringify({
+                        plugin: principal.identity,
+                        originalWallet: { instanceId: config.binding.instanceId, accountId },
+                        receiptIdentity: identity,
+                        ...(binding ? {} : { termsHash: terms.hash }),
+                        signedPayload: quoted,
+                        reviewNotice: 'The service-reported review status is not Host verification.',
+                    }, null, 2),
+                    signal: abort.signal,
+                });
+                guard();
+                if (!approved)
+                    return failure('denied');
+                if (binding)
+                    spendChallenge(quote.challenge, source);
+                else
+                    spendTerms(quote.terms, source, identity);
+                guard();
+                dispatched = true;
+                const result = await client.call(binding ? 'bind' : 'reserve', { token: quote.token });
+                if (binding) {
+                    const receipt = spendSigned(result, 'economy.spend-wallet-binding/v1', identity.walletPublicKey);
+                    if (receipt.walletId !== identity.walletId || receipt.walletPublicKey !== identity.walletPublicKey
+                        || Object.keys(quoted).some(key => key !== 'contract' && receipt[key] !== quoted[key]))
+                        throw new Error('wrong binding');
+                    value = result;
+                }
+                else {
+                    const record = spendRecord(result, identity, source), receipt = JSON.parse(record.reservation).payload;
+                    if (receipt.termsHash !== terms.hash || receipt.matchId !== quoted.matchId
+                        || receipt.amount !== terms.own.amount
+                        || receipt.gameAccountId !== terms.own.gameAccountId)
+                        throw new Error('wrong reservation');
+                    value = record;
+                }
+            }
+            guard();
+            return { status: 'accepted', value };
+        }
+        catch {
+            return failure(dispatched ? 'outcome-unknown' : 'invalid-request');
+        }
+        finally {
+            client?.close();
+            clearTimeout(timer);
+            clearInterval(monitor);
+            if (registeredOperation)
+                this.operations.delete(operationKey);
+            if (releaseConfirmation)
+                this.confirming = false;
+        }
+    }
+    dispose() {
+        this.disposed = true;
+        for (const operation of this.operations.values())
+            operation.abort.abort();
+    }
+}
+//# sourceMappingURL=wallet-spend-authority.js.map

package/dist/src/launcher/wallet-spend-authority.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"wallet-spend-authority.js","sourceRoot":"","sources":["../../../src/launcher/wallet-spend-authority.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,gBAAgB,EAAE,MAAM,4BAA4B,CAAA;AAE7D,OAAO,EAAE,0BAA0B,EAAE,MAAM,mBAAmB,CAAA;AAC9D,OAAO,EAAE,gBAAgB,EAAE,mBAAmB,EAAE,MAAM,4BAA4B,CAAA;AAClF,OAAO,EAAE,qBAAqB,EAAE,wBAAwB,EAAE,MAAM,0BAA0B,CAAA;AAC1F,OAAO,EAAE,oBAAoB,EAAE,MAAM,8BAA8B,CAAA;AACnE,OAAO,EAAE,wBAAwB,EAAE,MAAM,kCAAkC,CAAA;AAC3E,OAAO,EAAE,sBAAsB,EAAE,uBAAuB,EAAE,MAAM,gCAAgC,CAAA;AAChG,OAAO,EAAE,cAAc,EAAE,MAAM,4BAA4B,CAAA;AAE3D,OAAO,EACL,eAAe,EACf,cAAc,EACd,OAAO,EACP,aAAa,EACb,WAAW,EACX,oBAAoB,EACpB,WAAW,EACX,WAAW,EACX,WAAW,EACX,UAAU,GACX,MAAM,8BAA8B,CAAA;AAErC,MAAM,OAAO,GAAG,CAAC,IAA0B,EAA8B,EAAE,CAAC,CAAC,EAAE,MAAM,EAAE,aAAa,EAAE,IAAI,EAAE,CAAC,CAAA;AAC7G,MAAM,UAAU,oBAAoB,CAAC,GAAY;IAC/C,OAAO,CAAC,CAAC,GAAG,IAAI,OAAO,GAAG,KAAK,QAAQ;WAClC,MAAM,CAAE,GAA+B,CAAC,SAAS,CAAC,CAAC,UAAU,CAAC,eAAe,CAAC,CAAA;AACrF,CAAC;AACD,iGAAiG;AACjG,MAAM,OAAO,oBAAoB;IAMZ;IALX,QAAQ,GAAG,KAAK,CAAA;IAChB,UAAU,GAAG,KAAK,CAAA;IACT,cAAc,GAAG,IAAI,GAAG,EAAU,CAAA;IAClC,UAAU,GAAG,IAAI,GAAG,EAAwE,CAAA;IAC7G,YACmB,OAShB;QATgB,YAAO,GAAP,OAAO,CASvB;IACA,CAAC;IACJ,KAAK,CAAC,MAAM,CAAC,GAAY,EAAE,eAA8B,GAAG,EAAE,CAAC,IAAI;QACjE,IAAI,UAAU,GAAG,KAAK,EAAE,mBAAmB,GAAG,KAAK,EAAE,mBAAmB,GAAG,KAAK,CAAA;QAChF,IAAI,MAAwC,EAAE,KAAgD,CAAA;QAC9F,IAAI,OAAmD,EAAE,YAAY,GAAG,EAAE,CAAA;QAC1E,IAAI,CAAC;YACH,MAAM,OAAO,GAAG,WAAW,CAAC,GAAG,CAAC,CAAA;YAChC,IACE,MAAM,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,EAAE,CAC9B,CAAC,CAAC,SAAS,EAAE,WAAW,EAAE,OAAO,EAAE,WAAW,EAAE,UAAU,EAAE,aAAa,EAAE,OAAO,CAAC,CAAC,QAAQ,CAAC,GAAG,CAAC,CAClG;gBACD,OAAO,OAAO,CAAC,iBAAiB,CAAC,CAAA;YACnC,MAAM,SAAS,GAAG,IAAI,CAAC,OAAO,CAAC,OAAO,CAAC,OAAO,CAAC,KAAK,CAAC,CAAA;YACrD,IAAI,CAAC,SAAS,IAAI,IAAI,CAAC,QAAQ,IAAI,CAAC,YAAY,EAAE;gBAAE,OAAO,OAAO,CAAC,kBAAkB,CAAC,CAAA;YACtF,MAAM,QAAQ,GAAG,IAAI,CAAC,SAAS,CAAC,SAAS,CAAC,EAAE,SAAS,GAAG,QAAQ,GAAG,GAAG,GAAG,OAAO,CAAC,OAAO,CAAC,QAAQ,CAAC,CAAA;YAClG,IAAI,OAAO,CAAC,SAAS,KAAK,sBAAsB,IAAI,OAAO,CAAC,SAAS,KAAK,oBAAoB,EAAE,CAAC;gBAC/F,IAAI,OAAO,CAAC,SAAS,KAAK,sBAAsB,EAAE,CAAC;oBACjD,IAAI,IAAI,CAAC,cAAc,CAAC,IAAI,IAAI,IAAI;wBAAE,IAAI,CAAC,OAAO,EAAE,CAAA;;wBAC/C,IAAI,CAAC,cAAc,CAAC,GAAG,CAAC,SAAS,CAAC,CAAA;gBACzC,CAAC;gBACD,KAAK,MAAM,CAAC,GAAG,EAAE,SAAS,CAAC,IAAI,IAAI,CAAC,UAAU,EAAE,CAAC;oBAC/C,IACE,SAAS,CAAC,MAAM,KAAK,SAAS,IAAI,CAAC,OAAO,CAAC,SAAS,KAAK,sBAAsB;2BAC1E,GAAG,KAAK,SAAS,GAAG,GAAG,GAAG,OAAO,CAAC,WAAW,CAAC;wBACnD,SAAS,CAAC,KAAK,CAAC,KAAK,EAAE,CAAA;gBAC3B,CAAC;gBACD,OAAO,EAAE,MAAM,EAAE,UAAU,EAAE,KAAK,EAAE,IAAI,EAAE,CAAA;YAC5C,CAAC;YACD,IAAI,IAAI,CAAC,cAAc,CAAC,GAAG,CAAC,SAAS,CAAC;gBAAE,OAAO,OAAO,CAAC,kBAAkB,CAAC,CAAA;YAC1E,MAAM,KAAK,GAAG,WAAW,CAAC,OAAO,CAAC,KAAK,CAAC,EAAE,SAAS,GAAG,OAAO,CAAC,SAAS,CAAA;YACvE,MAAM,QAAQ,GAAG,SAAS,KAAK,uBAAuB;gBACpD,CAAC,CAAC,EAAE;gBACJ,CAAC,CAAC,CAAC,SAAS,KAAK,sBAAsB,IAAI,SAAS,KAAK,2BAA2B,CAAC;oBACrF,CAAC,CAAC,CAAC,QAAQ,EAAE,OAAO,EAAE,WAAW,EAAE,UAAU,CAAC;oBAC9C,CAAC,CAAC,SAAS,KAAK,mBAAmB;wBACnC,CAAC,CAAC,CAAC,QAAQ,EAAE,WAAW,EAAE,UAAU,CAAC;wBACrC,CAAC,CAAC,CAAC,SAAS,KAAK,qBAAqB,IAAI,SAAS,KAAK,0BAA0B,CAAC;4BACnF,CAAC,CAAC,CAAC,QAAQ,EAAE,WAAW,EAAE,UAAU,CAAC;4BACrC,CAAC,CAAC,CAAC,SAAS,KAAK,oBAAoB,IAAI,SAAS,KAAK,yBAAyB,CAAC;gCACjF,CAAC,CAAC,CAAC,QAAQ,EAAE,UAAU,EAAE,UAAU,CAAC;gCACpC,CAAC,CAAC,SAAS,CAAA;YACb,MAAM,gBAAgB,GAAG,SAAS,KAAK,sBAAsB,IAAI,SAAS,KAAK,qBAAqB;gBAClG,CAAC,CAAC,CAAC,SAAS,EAAE,UAAU,CAAC;gBACzB,CAAC,CAAC,SAAS,KAAK,oBAAoB;oBACpC,CAAC,CAAC,CAAC,SAAS,EAAE,WAAW,EAAE,UAAU,CAAC;oBACtC,CAAC,CAAC,CAAC,SAAS,KAAK,uBAAuB,IAAI,SAAS,KAAK,8BAA8B,CAAC;wBACzF,CAAC,CAAC;4BACA,SAAS;4BACT,QAAQ;4BACR,UAAU;4BACV,eAAe;4BACf,WAAW;4BACX,UAAU;4BACV,GAAG,CAAC,KAAK,CAAC,iBAAiB,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC,mBAAmB,CAAC,CAAC;yBACxE;wBACD,CAAC,CAAC,SAAS,KAAK,6BAA6B;4BAC7C,CAAC,CAAC,CAAC,MAAM,EAAE,WAAW,EAAE,OAAO,EAAE,UAAU,CAAC;4BAC5C,CAAC,CAAC,SAAS,KAAK,+BAA+B;gCAC/C,CAAC,CAAC,CAAC,eAAe,EAAE,UAAU,CAAC;gCAC/B,CAAC,CAAC,SAAS,CAAA;YACb,IAAI,CAAC,QAAQ,IAAI,CAAC,gBAAgB;gBAAE,OAAO,OAAO,CAAC,iBAAiB,CAAC,CAAA;YACrE,WAAW,CAAC,KAAK,EAAE,QAAQ,IAAI,gBAAgB,CAAC,CAAA;YAChD,MAAM,QAAQ,GAAG,SAAS,KAAK,uBAAuB,CAAC,CAAC,CAAC,IAAI,CAAC,GAAG,EAAE,GAAG,MAAM,CAAC,CAAC,CAAC,KAAK,CAAC,QAAQ,CAAA;YAC7F,IAAI,CAAC,MAAM,CAAC,aAAa,CAAC,QAAQ,CAAC,IAAI,QAAQ,GAAG,IAAI,CAAC,GAAG,EAAE,GAAG,OAAO;gBAAE,OAAO,OAAO,CAAC,iBAAiB,CAAC,CAAA;YACzG,IAAI,QAAQ,IAAI,IAAI,CAAC,GAAG,EAAE;gBAAE,OAAO,OAAO,CAAC,mBAAmB,CAAC,CAAA;YAC/D,IAAI,CAAC,IAAI,CAAC,OAAO,CAAC,OAAO;gBAAE,OAAO,OAAO,CAAC,aAAa,CAAC,CAAA;YACxD,IAAI,MAAgD,CAAA;YACpD,IAAI,CAAC;gBACH,MAAM,GAAG,qBAAqB,CAAC,IAAI,CAAC,OAAO,CAAC,OAAO,EAAE,IAAI,CAAC,OAAO,CAAC,SAAS,CAAC,CAAA;YAC9E,CAAC;YAAC,MAAM,CAAC;gBACP,OAAO,OAAO,CAAC,sBAAsB,CAAC,CAAA;YACxC,CAAC;YACD,MAAM,MAAM,GAAoC,KAAK,CAAC,MAAM,KAAK,SAAS,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,WAAW,CAAC,KAAK,CAAC,MAAM,CAAC,CAAA;YAClH,IACE,MAAM,IAAI,CAAC,MAAM,CAAC,QAAQ,CAAC,IAAI,CAAC,KAAK,CAAC,EAAE,CACtC,KAAK,CAAC,KAAK,CAAC,QAAQ,KAAK,SAAS,CAAC,QAAQ,CAAC,QAAQ;mBACjD,KAAK,CAAC,KAAK,CAAC,MAAM,KAAK,SAAS,CAAC,QAAQ,CAAC,MAAM,IAAI,eAAe,CAAC,KAAK,CAAC,MAAM,EAAE,MAAM,CAAC;mBACzF,CAAC,CAAC,CAAC,mBAAmB,EAAE,sBAAsB,EAAE,2BAA2B,CAAC,CAAC,QAAQ,CAAC,SAAS,CAAC;uBAC9F,KAAK,CAAC,MAAM,KAAK,QAAQ,CAAC,CAChC;gBACD,OAAO,OAAO,CAAC,oBAAoB,CAAC,CAAA;YACtC,IACE,KAAK,CAAC,OAAO,KAAK,SAAS,IAAI,CAAC,MAAM,CAAC,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,EAAE,CACzD,KAAK,CAAC,KAAK,CAAC,QAAQ,KAAK,SAAS,CAAC,QAAQ,CAAC,QAAQ;mBACjD,KAAK,CAAC,KAAK,CAAC,MAAM,KAAK,SAAS,CAAC,QAAQ,CAAC,MAAM,IAAI,KAAK,CAAC,OAAO,KAAK,OAAO,CAAC,KAAK,CAAC,OAAO,CAAC,CAChG;gBACD,OAAO,OAAO,CAAC,oBAAoB,CAAC,CAAA;YACtC,MAAM,QAAQ,GAAG,IAAI,CAAC,OAAO,CAAC,QAAQ;mBACjC,IAAI,mBAAmB,CAAC,IAAI,CAAC,OAAO,CAAC,OAAO,EAAE,IAAI,CAAC,OAAO,CAAC,SAAS,EAAE,0BAA0B,EAAE,CAAC,CAAA;YACxG,IAAI,OAAkD,CAAA;YACtD,IAAI,CAAC;gBACH,OAAO,GAAG,QAAQ,CAAC,MAAM,CAAC,MAAM,CAAC,OAAO,CAAC,CAAA;YAC3C,CAAC;YAAC,MAAM,CAAC;gBACP,OAAO,OAAO,CAAC,oBAAoB,CAAC,CAAA;YACtC,CAAC;YACD,MAAM,SAAS,GAAG,OAAO,CAAC,OAAO,CAAC,IAAI,CAAC,KAAK,CAAC,EAAE,CAAC,KAAK,CAAC,KAAK,KAAK,gBAAgB,CAAC,MAAM,CAAC,OAAO,CAAC,CAAE,CAAC,SAAU,CAAA;YAC7G,MAAM,KAAK,GAAG,IAAI,eAAe,EAAE,CAAA;YACnC,YAAY,GAAG,SAAS,GAAG,GAAG,GAAG,OAAO,CAAC,OAAO,CAAC,WAAW,CAAC,CAAA;YAC7D,IAAI,IAAI,CAAC,UAAU,CAAC,IAAI,IAAI,EAAE,IAAI,IAAI,CAAC,UAAU,CAAC,GAAG,CAAC,YAAY,CAAC;gBAAE,OAAO,OAAO,CAAC,iBAAiB,CAAC,CAAA;YACtG,IAAI,CAAC,UAAU,CAAC,GAAG,CAAC,YAAY,EAAE,EAAE,MAAM,EAAE,SAAS,EAAE,KAAK,EAAE,CAAC,CAAA;YAC/D,mBAAmB,GAAG,IAAI,CAAA;YAC1B,MAAM,IAAI,GAAG,GAAG,EAAE,CAChB,CAAC,KAAK,CAAC,MAAM,CAAC,OAAO,IAAI,CAAC,IAAI,CAAC,QAAQ,IAAI,YAAY,EAAE,IAAI,CAAC,IAAI,CAAC,cAAc,CAAC,GAAG,CAAC,SAAS,CAAC;mBAC7F,IAAI,CAAC,OAAO,CAAC,OAAO,CAAC,OAAO,CAAC,KAAK,CAAC,KAAK,SAAS,IAAI,QAAQ,CAAC,OAAO,CAAC,OAAO,CAAC;mBAC9E,qBAAqB,CAAC,IAAI,CAAC,OAAO,CAAC,OAAQ,EAAE,IAAI,CAAC,OAAO,CAAC,SAAS,CAAC,CAAC,WAAW,KAAK,MAAM,CAAC,WAAW,CAAA;YAC5G,MAAM,KAAK,GAAG,GAAG,EAAE;gBACjB,IAAI,CAAC,IAAI,EAAE;oBAAE,MAAM,IAAI,KAAK,CAAC,mBAAmB,CAAC,CAAA;YACnD,CAAC,CAAA;YACD,KAAK,GAAG,UAAU,CAAC,GAAG,EAAE,CAAC,KAAK,CAAC,KAAK,EAAE,EAAE,QAAQ,GAAG,IAAI,CAAC,GAAG,EAAE,CAAC,CAAA;YAC9D,OAAO,GAAG,WAAW,CAAC,GAAG,EAAE;gBACzB,IAAI,CAAC;oBACH,KAAK,EAAE,CAAA;gBACT,CAAC;gBAAC,MAAM,CAAC;oBACP,KAAK,CAAC,KAAK,EAAE,CAAA;gBACf,CAAC;YACH,CAAC,EAAE,GAAG,CAAC,CAAA;YACP,KAAK,EAAE,CAAA;YACP,IAAI,SAAS,KAAK,+BAA+B,EAAE,CAAC;gBAClD,IAAI,IAAI,CAAC,UAAU;oBAAE,OAAO,OAAO,CAAC,QAAQ,CAAC,CAAA;gBAC7C,IAAI,CAAC,UAAU,GAAG,IAAI,CAAA;gBACtB,mBAAmB,GAAG,IAAI,CAAA;gBAC1B,MAAM,KAAK,GAAG,MAAM,CAAC,QAAQ,CAAC,MAAM,CAAC,KAAK,CAAC,EAAE,CAC3C,KAAK,CAAC,KAAK,CAAC,QAAQ,KAAK,SAAS,CAAC,QAAQ,CAAC,QAAQ;uBACjD,KAAK,CAAC,KAAK,CAAC,MAAM,KAAK,SAAS,CAAC,QAAQ,CAAC,MAAM,IAAI,KAAK,CAAC,MAAM,CAAC,aAAa,KAAK,KAAK,CAAC,aAAa,CAC1G,CAAA;gBACD,MAAM,iBAAiB,GAAG,KAAK,CAAC,MAAM,CAAC,KAAK,CAAC,EAAE,CAC7C,KAAK,CAAC,MAAM,KAAK,QAAQ,IAAI,IAAI,GAAG,CAAC,KAAK,CAAC,MAAM,CAAC,aAAa,CAAC,CAAC,QAAQ,KAAK,OAAO,CACtF,CAAA;gBACD,IAAI,IAAI,GAAG,CAAC,KAAK,CAAC,aAAa,CAAC,CAAC,QAAQ,KAAK,QAAQ,IAAI,CAAC,iBAAiB,CAAC,MAAM,EAAE,CAAC;oBACpF,OAAO,OAAO,CAAC,oBAAoB,CAAC,CAAA;gBACtC,CAAC;gBACD,IAAI,OAA4B,CAAA;gBAChC,IAAI,CAAC;oBACH,OAAO,GAAG,MAAM,CAAC,IAAI,CAAC,OAAO,CAAC,WAAW,IAAI,sBAAsB,CAAC,CAClE,KAAK,CAAC,aAAa,EACnB,KAAK,CAAC,MAAM,EACZ,iBAAiB,CAAC,MAAM,GAAG,CAAC,CAC7B,CAAA;gBACH,CAAC;gBAAC,MAAM,CAAC;oBACP,OAAO,OAAO,CAAC,oBAAoB,CAAC,CAAA;gBACtC,CAAC;gBACD,KAAK,EAAE,CAAA;gBACP,sFAAsF;gBACtF,IAAI,iBAAiB,CAAC,MAAM,IAAI,CAAC,iBAAiB,CAAC,IAAI,CAAC,KAAK,CAAC,EAAE,CAAC,eAAe,CAAC,KAAK,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC,EAAE,CAAC;oBACzG,OAAO,OAAO,CAAC,oBAAoB,CAAC,CAAA;gBACtC,CAAC;gBACD,IAAI,KAAK,CAAC,IAAI,CAAC,KAAK,CAAC,EAAE,CAAC,KAAK,CAAC,MAAM,KAAK,QAAQ,IAAI,eAAe,CAAC,KAAK,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC,EAAE,CAAC;oBAC7F,OAAO,EAAE,MAAM,EAAE,UAAU,EAAE,KAAK,EAAE,OAAO,EAAE,CAAA;gBAC/C,CAAC;gBACD,MAAM,QAAQ,GAAG,MAAM,CAAC,IAAI,CAAC,OAAO,CAAC,OAAO,IAAI,wBAAwB,CAAC,CAAC;oBACxE,OAAO,EAAE,KAAK,CAAC,MAAM;wBACnB,CAAC,CAAC,wHAAwH;wBAC1H,CAAC,CAAC,uGAAuG;oBAC3G,QAAQ,EAAE,IAAI,CAAC,SAAS,CACtB;wBACE,MAAM,EAAE,SAAS,CAAC,QAAQ;wBAC1B,MAAM,EAAE,OAAO;wBACf,YAAY,EAAE,KAAK,CAAC,GAAG,CAAC,KAAK,CAAC,EAAE,CAAC,KAAK,CAAC,MAAM,CAAC;qBAC/C,EACD,IAAI,EACJ,CAAC,CACF;oBACD,MAAM,EAAE,KAAK,CAAC,MAAM;iBACrB,CAAC,CAAA;gBACF,KAAK,EAAE,CAAA;gBACP,IAAI,CAAC,QAAQ;oBAAE,OAAO,OAAO,CAAC,QAAQ,CAAC,CAAA;gBACvC,wBAAwB,CACtB,IAAI,CAAC,OAAO,CAAC,OAAO,EACpB,IAAI,CAAC,OAAO,CAAC,SAAS,EACtB,MAAM,CAAC,WAAW,EAClB,SAAS,CAAC,QAAQ,EAClB,OAAO,EACP,KAAK,CACN,CAAA;gBACD,OAAO,EAAE,MAAM,EAAE,UAAU,EAAE,KAAK,EAAE,OAAO,EAAE,CAAA;YAC/C,CAAC;YACD,MAAM,GAAG,MAAM,oBAAoB,CAAC,IAAI,CACtC,MAAM,EACN;gBACE,MAAM,EAAE,MAAM,CAAC,OAAO,CAAC,MAAM;gBAC7B,UAAU,EAAE,MAAM,CAAC,OAAO,CAAC,UAAU;gBACrC,SAAS;gBACT,OAAO,EAAE,OAAO,CAAC,OAAO;gBACxB,SAAS,EAAE,OAAO,CAAC,SAAS;aAC7B,EACD,QAAQ,EACR,KAAK,CAAC,MAAM,CACb,CAAA;YACD,KAAK,EAAE,CAAA;YACP,MAAM,QAAQ,GAAG,aAAa,CAAC,MAAM,MAAM,CAAC,IAAI,CAAC,UAAU,EAAE,EAAE,CAAC,CAAC,CAAA;YACjE,KAAK,EAAE,CAAA;YACP,IAAI,KAAc,CAAA;YAClB,IAAI,SAAS,CAAC,UAAU,CAAC,oBAAoB,CAAC,EAAE,CAAC;gBAC/C,IAAI,SAAS,KAAK,2BAA2B,EAAE,CAAC;oBAC9C,IAAI,IAAI,CAAC,UAAU;wBAAE,OAAO,OAAO,CAAC,QAAQ,CAAC,CAAA;oBAC7C,IAAI,CAAC,UAAU,GAAG,IAAI,CAAA;oBACtB,mBAAmB,GAAG,IAAI,CAAA;gBAC5B,CAAC;gBACD,KAAK,GAAG,MAAM,gBAAgB,CAAC;oBAC7B,SAAS;oBACT,KAAK;oBACL,MAAM,EAAE,MAAO;oBACf,QAAQ;oBACR,MAAM;oBACN,KAAK;oBACL,cAAc,EAAE,GAAG,EAAE;wBACnB,UAAU,GAAG,IAAI,CAAA;oBACnB,CAAC;oBACD,OAAO,EAAE,IAAI,CAAC,OAAO,CAAC,OAAO,IAAI,wBAAwB;oBACzD,MAAM,EAAE,KAAK,CAAC,MAAM;oBACpB,MAAM,EAAE,SAAS,CAAC,QAAQ;iBAC3B,CAAC,CAAA;gBACF,IAAI,KAAK,KAAK,QAAQ;oBAAE,OAAO,OAAO,CAAC,QAAQ,CAAC,CAAA;YAClD,CAAC;iBAAM,IAAI,SAAS,KAAK,uBAAuB;gBAAE,KAAK,GAAG,QAAQ,CAAA;iBAC7D,IACH,SAAS,KAAK,sBAAsB,IAAI,SAAS,KAAK,qBAAqB;mBACxE,SAAS,KAAK,oBAAoB,EACrC,CAAC;gBACD,KAAK,GAAG,MAAM,MAAM,CAAC,IAAI,CAAC,SAAS,CAAC,KAAK,CAAC,eAAe,CAAC,MAAM,CAAC,EAAE;oBACjE,OAAO,EAAE,KAAK,CAAC,OAAO;oBACtB,GAAG,CAAC,SAAS,KAAK,oBAAoB,CAAC,CAAC,CAAC,EAAE,SAAS,EAAE,OAAO,CAAC,KAAK,CAAC,SAAS,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;iBACvF,CAAC,CAAA;gBACF,IAAI,KAAK,KAAK,IAAI,IAAI,CAAC,OAAO,KAAK,KAAK,QAAQ,IAAI,MAAM,CAAC,UAAU,CAAC,KAAK,CAAC,GAAG,OAAO,CAAC,EAAE,CAAC;oBACxF,MAAM,IAAI,KAAK,CAAC,yBAAyB,CAAC,CAAA;gBAC5C,CAAC;YACH,CAAC;iBAAM,IAAI,SAAS,KAAK,6BAA6B,EAAE,CAAC;gBACvD,IACE,CAAC,CAAC,OAAO,EAAE,WAAW,EAAE,UAAU,CAAC,CAAC,QAAQ,CAAC,KAAK,CAAC,IAAI,CAAC,IAAI,OAAO,KAAK,CAAC,KAAK,KAAK,QAAQ;uBACxF,MAAM,CAAC,UAAU,CAAC,KAAK,CAAC,KAAK,CAAC,GAAG,MAAM;oBAC1C,OAAO,OAAO,CAAC,iBAAiB,CAAC,CAAA;gBACnC,KAAK,GAAG,MAAM,MAAM,CAAC,IAAI,CAAC,gBAAgB,EAAE;oBAC1C,IAAI,EAAE,KAAK,CAAC,IAAI;oBAChB,SAAS,EAAE,OAAO,CAAC,KAAK,CAAC,SAAS,CAAC;oBACnC,KAAK,EAAE,KAAK,CAAC,KAAK;iBACnB,CAAC,CAAA;gBACF,IAAI,KAAK,KAAK,IAAI,IAAI,CAAC,OAAO,KAAK,KAAK,QAAQ,IAAI,MAAM,CAAC,UAAU,CAAC,KAAK,CAAC,GAAG,OAAO,CAAC,EAAE,CAAC;oBACxF,MAAM,IAAI,KAAK,CAAC,wBAAwB,CAAC,CAAA;gBAC3C,CAAC;YACH,CAAC;iBAAM,IAAI,SAAS,KAAK,uBAAuB,IAAI,SAAS,KAAK,8BAA8B,EAAE,CAAC;gBACjG,OAAO,CAAC,KAAK,CAAC,MAAM,CAAC,CAAA;gBACrB,OAAO,CAAC,KAAK,CAAC,SAAS,CAAC,CAAA;gBACxB,IACE,CAAC,MAAM,CAAC,aAAa,CAAC,KAAK,CAAC,QAAQ,CAAC,IAAI,KAAK,CAAC,QAAQ,GAAG,CAAC,IAAI,KAAK,CAAC,QAAQ,GAAG,IAAI;uBACjF,CAAC,MAAM,CAAC,aAAa,CAAC,KAAK,CAAC,aAAa,CAAC,IAAI,KAAK,CAAC,aAAa,GAAG,CAAC;uBACrE,KAAK,CAAC,aAAa,GAAG,iBAAiB;oBAC1C,OAAO,OAAO,CAAC,iBAAiB,CAAC,CAAA;gBACnC,IAAI,KAAK,CAAC,iBAAiB,KAAK,SAAS,EAAE,CAAC;oBAC1C,WAAW,CAAC,KAAK,CAAC,iBAAiB,EAAE,CAAC,WAAW,EAAE,SAAS,CAAC,CAAC,CAAA;oBAC9D,IAAI,KAAK,CAAC,iBAAiB,CAAC,SAAS,KAAK,KAAK,CAAC,OAAO;wBAAE,OAAO,OAAO,CAAC,iBAAiB,CAAC,CAAA;oBAC1F,OAAO,CAAC,KAAK,CAAC,iBAAiB,CAAC,OAAO,CAAC,CAAA;gBAC1C,CAAC;gBACD,MAAM,aAAa,GAAG;oBACpB,OAAO,EAAE,KAAK,CAAC,OAAO;oBACtB,MAAM,EAAE,KAAK,CAAC,MAAM;oBACpB,QAAQ,EAAE,KAAK,CAAC,QAAQ;oBACxB,aAAa,EAAE,KAAK,CAAC,aAAa;oBAClC,SAAS,EAAE,KAAK,CAAC,SAAS;oBAC1B,GAAG,CAAC,KAAK,CAAC,iBAAiB,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,iBAAiB,EAAE,KAAK,CAAC,iBAAiB,EAAE,CAAC;iBACjG,CAAA;gBACD,MAAM,QAAQ,GAAG,MAAM,MAAM,CAAC,IAAI,CAAC,OAAO,EAAE,EAAE,OAAO,EAAE,KAAK,CAAC,OAAO,EAAE,SAAS,EAAE,KAAK,CAAC,SAAS,EAAE,CAAC,CAAA;gBACnG,KAAK,EAAE,CAAA;gBACP,IAAI,QAAQ,KAAK,IAAI,EAAE,CAAC;oBACtB,IAAI,CAAC;wBACH,oBAAoB,CAAC,QAAQ,EAAE,aAAa,EAAE,MAAM,CAAC,OAAO,CAAC,UAAU,EAAE,SAAS,CAAC,CAAA;oBACrF,CAAC;oBAAC,MAAM,CAAC;wBACP,OAAO,OAAO,CAAC,UAAU,CAAC,CAAA;oBAC5B,CAAC;oBACD,OAAO,EAAE,MAAM,EAAE,UAAU,EAAE,KAAK,EAAE,QAAQ,EAAE,CAAA;gBAChD,CAAC;gBACD,IAAI,IAAI,CAAC,UAAU;oBAAE,OAAO,OAAO,CAAC,QAAQ,CAAC,CAAA;gBAC7C,IAAI,CAAC,UAAU,GAAG,IAAI,CAAA;gBACtB,mBAAmB,GAAG,IAAI,CAAA;gBAC1B,MAAM,UAAU,GAAG,SAAS,KAAK,8BAA8B,CAAA;gBAC/D,MAAM,MAAM,GAAG,WAAW,CACxB,MAAM,MAAM,CAAC,IAAI,CAAC,UAAU,CAAC,CAAC,CAAC,oBAAoB,CAAC,CAAC,CAAC,gBAAgB,EAAE,aAAa,CAAC,EACtF,CAAC,OAAO,EAAE,OAAO,CAAC,CACnB,CAAA;gBACD,KAAK,EAAE,CAAA;gBACP,IAAI,OAAO,MAAM,CAAC,KAAK,KAAK,QAAQ,IAAI,MAAM,CAAC,UAAU,CAAC,MAAM,CAAC,KAAK,CAAC,GAAG,MAAM,EAAE,CAAC;oBACjF,OAAO,OAAO,CAAC,iBAAiB,CAAC,CAAA;gBACnC,CAAC;gBACD,IAAI,UAAU,EAAE,CAAC;oBACf,MAAM,KAAK,GAAG,WAAW,CAAC,IAAI,CAAC,KAAK,CAAC,MAAM,CAAC,KAAK,CAAC,EAAE,CAAC,UAAU,EAAE,UAAU,EAAE,OAAO,CAAC,CAAC,CAAA;oBACtF,IACE,KAAK,CAAC,QAAQ,KAAK,8CAA8C,IAAI,KAAK,CAAC,QAAQ,KAAK,QAAQ,CAAC,QAAQ;2BACtG,cAAc,CAAC,KAAK,CAAC,KAAK,CAAC,KAAK,cAAc,CAAC,aAAa,CAAC;wBAChE,OAAO,OAAO,CAAC,iBAAiB,CAAC,CAAA;oBACnC,MAAM,QAAQ,GAAG,MAAM,CAAC,IAAI,CAAC,OAAO,CAAC,OAAO,IAAI,wBAAwB,CAAC,CAAC;wBACxE,OAAO,EAAE,gGAAgG;wBACzG,QAAQ,EAAE,IAAI,CAAC,SAAS,CACtB;4BACE,MAAM,EAAE,SAAS,CAAC,QAAQ;4BAC1B,cAAc,EAAE,EAAE,UAAU,EAAE,MAAM,CAAC,OAAO,CAAC,UAAU,EAAE,SAAS,EAAE;4BACpE,KAAK;yBACN,EACD,IAAI,EACJ,CAAC,CACF;wBACD,MAAM,EAAE,KAAK,CAAC,MAAM;qBACrB,CAAC,CAAA;oBACF,KAAK,EAAE,CAAA;oBACP,IAAI,CAAC,QAAQ;wBAAE,OAAO,OAAO,CAAC,QAAQ,CAAC,CAAA;oBACvC,UAAU,GAAG,IAAI,CAAA;oBACjB,MAAM,MAAM,GAAG,MAAM,MAAM,CAAC,IAAI,CAAC,iBAAiB,EAAE,EAAE,KAAK,EAAE,MAAM,CAAC,KAAK,EAAE,CAAC,CAAA;oBAC5E,oBAAoB,CAAC,MAAM,EAAE,aAAa,EAAE,MAAM,CAAC,OAAO,CAAC,UAAU,EAAE,SAAS,CAAC,CAAA;oBACjF,KAAK,EAAE,CAAA;oBACP,OAAO,EAAE,MAAM,EAAE,UAAU,EAAE,KAAK,EAAE,MAAM,EAAE,CAAA;gBAC9C,CAAC;gBACD,MAAM,CAAC,GAAG,WAAW,CAAC,IAAI,CAAC,KAAK,CAAC,MAAM,CAAC,KAAK,CAAC,EAAE;oBAC9C,UAAU;oBACV,SAAS;oBACT,QAAQ;oBACR,OAAO;oBACP,UAAU;oBACV,WAAW;oBACX,OAAO;oBACP,WAAW;oBACX,UAAU;oBACV,GAAG,CAAC,KAAK,CAAC,iBAAiB,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC,mBAAmB,CAAC,CAAC;iBACxE,CAAC,CAAA;gBACF,IACE,CAAC,CAAC,QAAQ,KAAK,iCAAiC,IAAI,CAAC,CAAC,OAAO,KAAK,KAAK,CAAC,OAAO,IAAI,CAAC,CAAC,MAAM,KAAK,KAAK,CAAC,MAAM;uBACzG,CAAC,CAAC,QAAQ,KAAK,KAAK,CAAC,QAAQ,IAAI,CAAC,CAAC,KAAK,KAAK,KAAK,CAAC,aAAa,IAAI,CAAC,CAAC,SAAS,KAAK,KAAK,CAAC,SAAS;uBACnG,CAAC,CAAC,QAAQ,KAAK,QAAQ,CAAC,QAAQ,IAAI,OAAO,CAAC,CAAC,KAAK,KAAK,QAAQ,IAAI,CAAC,MAAM,CAAC,aAAa,CAAC,CAAC,CAAC,SAAS,CAAC;uBACrG,CAAC,CAAC,SAAS,GAAG,CAAC,IAAI,CAAC,CAAC,KAAK,KAAK,CAAC,CAAC,QAAQ,GAAG,CAAC,CAAC,SAAS;uBACvD,cAAc,CAAC,CAAC,CAAC,iBAAiB,IAAI,IAAI,CAAC,KAAK,cAAc,CAAC,KAAK,CAAC,iBAAiB,IAAI,IAAI,CAAC;oBAClG,OAAO,OAAO,CAAC,iBAAiB,CAAC,CAAA;gBACnC,MAAM,QAAQ,GAAG,MAAM,CAAC,IAAI,CAAC,OAAO,CAAC,OAAO,IAAI,wBAAwB,CAAC,CAAC;oBACxE,OAAO,EAAE,eAAe,CAAC,CAAC,QAAQ,gBAAgB,CAAC,CAAC,KAAK,gCAAgC;oBACzF,QAAQ,EAAE,IAAI,CAAC,SAAS,CACtB;wBACE,MAAM,EAAE,SAAS,CAAC,QAAQ;wBAC1B,cAAc,EAAE,EAAE,UAAU,EAAE,MAAM,CAAC,OAAO,CAAC,UAAU,EAAE,SAAS,EAAE;wBACpE,KAAK,EAAE,CAAC;qBACT,EACD,IAAI,EACJ,CAAC,CACF;oBACD,MAAM,EAAE,KAAK,CAAC,MAAM;iBACrB,CAAC,CAAA;gBACF,KAAK,EAAE,CAAA;gBACP,UAAU,GAAG,IAAI,CAAA;gBACjB,KAAK,GAAG,MAAM,MAAM,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC,CAAC,UAAU,CAAC,CAAC,CAAC,iBAAiB,EAAE,EAAE,KAAK,EAAE,MAAM,CAAC,KAAK,EAAE,CAAC,CAAA;gBAC7F,oBAAoB,CAAC,KAAK,EAAE,aAAa,EAAE,MAAM,CAAC,OAAO,CAAC,UAAU,EAAE,SAAS,CAAC,CAAA;YAClF,CAAC;iBAAM,IAAI,SAAS,KAAK,qBAAqB,EAAE,CAAC;gBAC/C,MAAM,MAAM,GAAG,MAAM,MAAM,CAAC,IAAI,CAAC,QAAQ,EAAE,EAAE,MAAM,EAAE,SAAS,EAAE,OAAO,CAAC,KAAK,CAAC,SAAS,CAAC,EAAE,CAAC,CAAA;gBAC3F,KAAK,GAAG,MAAM,KAAK,IAAI,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,WAAW,CAAC,MAAM,EAAE,QAAQ,EAAE,MAAO,CAAC,CAAA;YACzE,CAAC;iBAAM,IAAI,SAAS,KAAK,oBAAoB,EAAE,CAAC;gBAC9C,MAAM,QAAQ,GAAG,WAAW,CAAC,KAAK,CAAC,QAAQ,EAAE,2BAA2B,EAAE,MAAO,CAAC,gBAAgB,EAAE,OAAO,CAAC,CAAA;gBAC5G,IACE,CAAC,eAAe,CACd,MAAO,EACP,WAAW,CAAC;oBACV,aAAa,EAAE,QAAQ,CAAC,aAAa;oBACrC,gBAAgB,EAAE,QAAQ,CAAC,gBAAgB;oBAC3C,QAAQ,EAAE,QAAQ,CAAC,QAAQ;iBAC5B,CAAC,CACH;oBACD,OAAO,OAAO,CAAC,iBAAiB,CAAC,CAAA;gBACnC,KAAK,EAAE,CAAA;gBACP,UAAU,GAAG,IAAI,CAAA;gBACjB,MAAM,OAAO,GAAG,MAAM,MAAM,CAAC,IAAI,CAAC,OAAO,EAAE,EAAE,MAAM,EAAE,QAAQ,EAAE,KAAK,CAAC,QAAQ,EAAE,CAAC,CAAA;gBAChF,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,OAAO,CAAC,IAAI,OAAO,CAAC,MAAM,GAAG,CAAC;oBAAE,MAAM,IAAI,KAAK,CAAC,iBAAiB,CAAC,CAAA;gBACrF,KAAK,GAAG,OAAO,CAAC,GAAG,CAAC,MAAM,CAAC,EAAE,CAAC,WAAW,CAAC,MAAM,EAAE,QAAQ,EAAE,MAAO,CAAC,CAAC,CAAA;YACvE,CAAC;iBAAM,CAAC;gBACN,IAAI,SAAS,KAAK,sBAAsB,EAAE,CAAC;oBACzC,MAAM,KAAK,GAAG,UAAU,CAAC,KAAK,CAAC,KAAK,EAAE,MAAO,EAAE,QAAQ,EAAE,KAAK,CAAC,CAAA;oBAC/D,MAAM,KAAK,GAAG,MAAM,MAAM,CAAC,IAAI,CAAC,QAAQ,EAAE,EAAE,MAAM,EAAE,SAAS,EAAE,OAAO,CAAC,KAAK,CAAC,SAAS,CAAC,EAAE,CAAC,CAAA;oBAC1F,KAAK,EAAE,CAAA;oBACP,IAAI,KAAK,KAAK,IAAI,EAAE,CAAC;wBACnB,MAAM,MAAM,GAAG,WAAW,CAAC,KAAK,EAAE,QAAQ,EAAE,MAAO,CAAC,EAAE,OAAO,GAAG,IAAI,CAAC,KAAK,CAAC,MAAM,CAAC,WAAW,CAAC,CAAC,OAAO,CAAA;wBACtG,IACE,OAAO,CAAC,SAAS,KAAK,KAAK,CAAC,IAAI,IAAI,OAAO,CAAC,OAAO,KAAK,KAAK,CAAC,OAAO,CAAC,OAAO;+BAC1E,OAAO,CAAC,aAAa,KAAK,KAAK,CAAC,GAAG,CAAC,aAAa,IAAI,OAAO,CAAC,MAAM,KAAK,KAAK,CAAC,GAAG,CAAC,MAAM;4BAC3F,OAAO,OAAO,CAAC,UAAU,CAAC,CAAA;wBAC5B,OAAO,EAAE,MAAM,EAAE,UAAU,EAAE,KAAK,EAAE,MAAM,EAAE,CAAA;oBAC9C,CAAC;gBACH,CAAC;gBACD,IAAI,CAAC;oBACH,MAAM,CAAC,IAAI,CAAC,OAAO,CAAC,YAAY,IAAI,uBAAuB,CAAC,CAAC,MAAO,EAAE,KAAK,CAAC,MAAM,CAAC,CAAA;gBACrF,CAAC;gBAAC,MAAM,CAAC;oBACP,OAAO,OAAO,CAAC,oBAAoB,CAAC,CAAA;gBACtC,CAAC;gBACD,KAAK,EAAE,CAAA;gBACP,IAAI,IAAI,CAAC,UAAU;oBAAE,OAAO,OAAO,CAAC,QAAQ,CAAC,CAAA;gBAC7C,IAAI,CAAC,UAAU,GAAG,IAAI,CAAA;gBACtB,mBAAmB,GAAG,IAAI,CAAA;gBAC1B,MAAM,OAAO,GAAG,SAAS,KAAK,mBAAmB,CAAA;gBACjD,MAAM,QAAQ,GAAG,OAAO;oBACtB,CAAC,CAAC,cAAc,CAAC,KAAK,CAAC,SAAS,EAAE,MAAO,CAAC;oBAC1C,CAAC,CAAC,UAAU,CAAC,KAAK,CAAC,KAAK,EAAE,MAAO,EAAE,QAAQ,CAAC,CAAC,OAAO,CAAA;gBACtD,MAAM,KAAK,GAAG,WAAW,CACvB,MAAM,MAAM,CAAC,IAAI,CACf,OAAO,CAAC,CAAC,CAAC,eAAe,CAAC,CAAC,CAAC,OAAO,EACnC,OAAO;oBACL,CAAC,CAAC,EAAE,SAAS,EAAE,KAAK,CAAC,SAAS,EAAE;oBAChC,CAAC,CAAC,EAAE,KAAK,EAAE,KAAK,CAAC,KAAK,EAAE,SAAS,EAAE,OAAO,CAAC,KAAK,CAAC,SAAS,CAAC,EAAE,CAChE,EACD,OAAO,CAAC,CAAC,CAAC,CAAC,OAAO,EAAE,WAAW,CAAC,CAAC,CAAC,CAAC,CAAC,OAAO,EAAE,OAAO,CAAC,CACtD,CAAA;gBACD,KAAK,EAAE,CAAA;gBACP,MAAM,MAAM,GAAG,OAAO;oBACpB,CAAC,CAAC,cAAc,CAAC,KAAK,CAAC,SAAS,EAAE,MAAO,CAAC;oBAC1C,CAAC,CAAC,UAAU,CAAC,KAAK,CAAC,KAAK,EAAE,MAAO,EAAE,QAAQ,CAAC,CAAC,OAAO,CAAA;gBACtD,IAAI,cAAc,CAAC,QAAQ,CAAC,KAAK,cAAc,CAAC,MAAM,CAAC;oBAAE,OAAO,OAAO,CAAC,iBAAiB,CAAC,CAAA;gBAC1F,MAAM,KAAK,GAAG,OAAO,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,UAAU,CAAC,KAAK,CAAC,KAAK,EAAE,MAAO,EAAE,QAAQ,CAAC,CAAA;gBAC9E,MAAM,QAAQ,GAAG,MAAM,CAAC,IAAI,CAAC,OAAO,CAAC,OAAO,IAAI,wBAAwB,CAAC,CAAC;oBACxE,OAAO,EAAE,OAAO;wBACd,CAAC,CAAC,4FAA4F;wBAC9F,CAAC,CAAC,mBAAmB,KAAM,CAAC,GAAG,CAAC,MAAM,sCACpC,KAAM,CAAC,GAAG,CAAC,MACb,oHAAoH;oBACtH,QAAQ,EAAE,IAAI,CAAC,SAAS,CACtB;wBACE,MAAM,EAAE,SAAS,CAAC,QAAQ;wBAC1B,cAAc,EAAE,EAAE,UAAU,EAAE,MAAM,CAAC,OAAO,CAAC,UAAU,EAAE,SAAS,EAAE;wBACpE,eAAe,EAAE,QAAQ;wBACzB,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,SAAS,EAAE,KAAM,CAAC,IAAI,EAAE,CAAC;wBAC9C,aAAa,EAAE,MAAM;wBACrB,YAAY,EAAE,8DAA8D;qBAC7E,EACD,IAAI,EACJ,CAAC,CACF;oBACD,MAAM,EAAE,KAAK,CAAC,MAAM;iBACrB,CAAC,CAAA;gBACF,KAAK,EAAE,CAAA;gBACP,IAAI,CAAC,QAAQ;oBAAE,OAAO,OAAO,CAAC,QAAQ,CAAC,CAAA;gBACvC,IAAI,OAAO;oBAAE,cAAc,CAAC,KAAK,CAAC,SAAS,EAAE,MAAO,CAAC,CAAA;;oBAChD,UAAU,CAAC,KAAK,CAAC,KAAK,EAAE,MAAO,EAAE,QAAQ,CAAC,CAAA;gBAC/C,KAAK,EAAE,CAAA;gBACP,UAAU,GAAG,IAAI,CAAA;gBACjB,MAAM,MAAM,GAAG,MAAM,MAAM,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,SAAS,EAAE,EAAE,KAAK,EAAE,KAAK,CAAC,KAAK,EAAE,CAAC,CAAA;gBACtF,IAAI,OAAO,EAAE,CAAC;oBACZ,MAAM,OAAO,GAAG,WAAW,CAAC,MAAM,EAAE,iCAAiC,EAAE,QAAQ,CAAC,eAAe,CAAC,CAAA;oBAChG,IACE,OAAO,CAAC,QAAQ,KAAK,QAAQ,CAAC,QAAQ,IAAI,OAAO,CAAC,eAAe,KAAK,QAAQ,CAAC,eAAe;2BAC3F,MAAM,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,KAAK,UAAU,IAAI,OAAO,CAAC,GAAG,CAAC,KAAK,MAAM,CAAC,GAAG,CAAC,CAAC;wBACtF,MAAM,IAAI,KAAK,CAAC,eAAe,CAAC,CAAA;oBAClC,KAAK,GAAG,MAAM,CAAA;gBAChB,CAAC;qBAAM,CAAC;oBACN,MAAM,MAAM,GAAG,WAAW,CAAC,MAAM,EAAE,QAAQ,EAAE,MAAO,CAAC,EAAE,OAAO,GAAG,IAAI,CAAC,KAAK,CAAC,MAAM,CAAC,WAAW,CAAC,CAAC,OAAO,CAAA;oBACvG,IACE,OAAO,CAAC,SAAS,KAAK,KAAM,CAAC,IAAI,IAAI,OAAO,CAAC,OAAO,KAAK,MAAM,CAAC,OAAO;2BACpE,OAAO,CAAC,MAAM,KAAK,KAAM,CAAC,GAAG,CAAC,MAAM;2BACpC,OAAO,CAAC,aAAa,KAAK,KAAM,CAAC,GAAG,CAAC,aAAa;wBACrD,MAAM,IAAI,KAAK,CAAC,mBAAmB,CAAC,CAAA;oBACtC,KAAK,GAAG,MAAM,CAAA;gBAChB,CAAC;YACH,CAAC;YACD,KAAK,EAAE,CAAA;YACP,OAAO,EAAE,MAAM,EAAE,UAAU,EAAE,KAAK,EAAE,CAAA;QACtC,CAAC;QAAC,MAAM,CAAC;YACP,OAAO,OAAO,CAAC,UAAU,CAAC,CAAC,CAAC,iBAAiB,CAAC,CAAC,CAAC,iBAAiB,CAAC,CAAA;QACpE,CAAC;gBAAS,CAAC;YACT,MAAM,EAAE,KAAK,EAAE,CAAA;YACf,YAAY,CAAC,KAAK,CAAC,CAAA;YACnB,aAAa,CAAC,OAAO,CAAC,CAAA;YACtB,IAAI,mBAAmB;gBAAE,IAAI,CAAC,UAAU,CAAC,MAAM,CAAC,YAAY,CAAC,CAAA;YAC7D,IAAI,mBAAmB;gBAAE,IAAI,CAAC,UAAU,GAAG,KAAK,CAAA;QAClD,CAAC;IACH,CAAC;IACD,OAAO;QACL,IAAI,CAAC,QAAQ,GAAG,IAAI,CAAA;QACpB,KAAK,MAAM,SAAS,IAAI,IAAI,CAAC,UAAU,CAAC,MAAM,EAAE;YAAE,SAAS,CAAC,KAAK,CAAC,KAAK,EAAE,CAAA;IAC3E,CAAC;CACF"}

package/dist/src/launcher/wallet-spend-config.d.ts

@@ -0,0 +1,29 @@
+import type { WalletSpendSourceV1 } from '@cordisx/protocol/wallet-spend/v1';
+/** Deployment-private configuration. It is never loaded from plugin configuration. */
+export declare function loadWalletSpendConfig(homeDir: string, profileId: string): {
+    socketPath: string;
+    secretFile: string;
+    binding: import("@cordisx/protocol/local-wallet/v1").LocalWalletBindingV1;
+    services: {
+        owner: {
+            pluginId: string;
+            source: string;
+        };
+        source: WalletSpendSourceV1;
+        status: any;
+    }[];
+    stores: {
+        owner: {
+            pluginId: string;
+            source: string;
+        };
+        storeId: string;
+    }[];
+    fingerprint: string;
+};
+/** Native-approved TLS pins; rotation preserves old keys exclusively for pending recovery. */
+export declare function persistWalletSpendSource(homeDir: string, profileId: string, fingerprint: string, owner: {
+    readonly pluginId: string;
+    readonly source: string;
+}, source: WalletSpendSourceV1, guard: () => void): void;
+//# sourceMappingURL=wallet-spend-config.d.ts.map