safehands-pharos 1.4.0 → 2.6.0

package/dist/api/schemas.js

@@ -0,0 +1,81 @@
+// ─── SafeHands API — Request Schemas (read-only) ──────────────
+// Zod schemas validating API input. Addresses, calldata, tx hashes, values,
+// and network names are validated before any analyzer runs. Invalid input
+// throws a ZodError which the server maps to a safe 400 response. No schema
+// here enables execution, signing, or payment — these only shape read input.
+// ────────────────────────────────────────────────────────────────────────
+import { z } from "zod";
+import { isAddress } from "viem";
+import { isNetworkName } from "../lib/networks.js";
+// ── Reusable field validators ──────────────────────────────────────────
+export const addressSchema = z
+    .string()
+    .refine((v) => isAddress(v), { message: "Must be a valid EVM address (0x + 40 hex)." });
+/** Calldata: 0x followed by an even number of hex chars (may be empty 0x). */
+export const hexDataSchema = z
+    .string()
+    .regex(/^0x([0-9a-fA-F]{2})*$/, "Must be 0x-prefixed even-length hex calldata.");
+export const txHashSchema = z
+    .string()
+    .regex(/^0x[0-9a-fA-F]{64}$/, "Must be a 0x-prefixed 32-byte transaction hash.");
+/** Value in wei: a non-negative decimal string or 0x-prefixed hex string. */
+export const valueSchema = z
+    .string()
+    .regex(/^(0x[0-9a-fA-F]+|[0-9]+)$/, "Must be a decimal or 0x-hex wei value string.");
+export const networkNameSchema = z
+    .string()
+    .refine((v) => isNetworkName(v), { message: "Unknown network. Use pacific-mainnet or pacific-mainnet." });
+export const chainIdSchema = z.number().int().positive();
+// ── Endpoint request schemas ───────────────────────────────────────────
+/** Universal SafeHands check — every field optional; the router decides. */
+export const guardianCheckSchema = z.object({
+    network: networkNameSchema.optional(),
+    chainId: chainIdSchema.optional(),
+    to: addressSchema.optional(),
+    data: hexDataSchema.optional(),
+    value: valueSchema.optional(),
+    txHash: txHashSchema.optional(),
+    policy: z.string().optional(),
+    actor: z.string().optional(),
+    inputType: z.enum(["tx", "contract", "approval", "safe", "x402", "call"]).optional(),
+    /** Optional ecosystem provider hint (e.g. "LayerZero") — evidence only. */
+    provider: z.string().optional(),
+    /** Optional ecosystem category hint (e.g. "cross_chain") — evidence only. */
+    ecosystemCategory: z.string().optional(),
+});
+export const analyzeTxSchema = z.object({
+    txHash: txHashSchema,
+    network: networkNameSchema.optional(),
+    chainId: chainIdSchema.optional(),
+});
+export const analyzeContractSchema = z.object({
+    address: addressSchema,
+    network: networkNameSchema.optional(),
+    chainId: chainIdSchema.optional(),
+});
+export const analyzeApprovalSchema = z.object({
+    data: hexDataSchema,
+    token: addressSchema.optional(),
+});
+export const analyzeSafeSchema = z.object({
+    data: hexDataSchema,
+});
+export const analyzeCalldataSchema = z.object({
+    data: hexDataSchema,
+    /** Optional token/contract the calldata targets — read-only metadata only. */
+    token: addressSchema.optional(),
+});
+export const analyzeX402Schema = z.object({
+    url: z.string().min(1, "url is required."),
+    paymentAmountUsdc: z.string().optional(),
+    paymentTokenAddress: addressSchema.optional(),
+    payTo: addressSchema.optional(),
+    agentId: z.string().optional(),
+    chainId: chainIdSchema.optional(),
+});
+export const broadcastSignedSchema = z.object({
+    rawSignedTransaction: z.string().regex(/^0x([0-9a-fA-F]{2})+$/, "Must be 0x-prefixed hex transaction data."),
+    preparedTransactionId: z.string().uuid("Must be a valid UUID."),
+    preparedTransactionHash: txHashSchema, // 32 bytes hex
+});
+//# sourceMappingURL=schemas.js.map

package/dist/api/schemas.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"schemas.js","sourceRoot":"","sources":["../../src/api/schemas.ts"],"names":[],"mappings":"AAAA,iEAAiE;AACjE,4EAA4E;AAC5E,0EAA0E;AAC1E,4EAA4E;AAC5E,6EAA6E;AAC7E,2EAA2E;AAE3E,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AACxB,OAAO,EAAE,SAAS,EAAE,MAAM,MAAM,CAAC;AACjC,OAAO,EAAE,aAAa,EAAE,MAAM,oBAAoB,CAAC;AAEnD,0EAA0E;AAE1E,MAAM,CAAC,MAAM,aAAa,GAAG,CAAC;KAC3B,MAAM,EAAE;KACR,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,SAAS,CAAC,CAAC,CAAC,EAAE,EAAE,OAAO,EAAE,4CAA4C,EAAE,CAAC,CAAC;AAE1F,8EAA8E;AAC9E,MAAM,CAAC,MAAM,aAAa,GAAG,CAAC;KAC3B,MAAM,EAAE;KACR,KAAK,CAAC,uBAAuB,EAAE,+CAA+C,CAAC,CAAC;AAEnF,MAAM,CAAC,MAAM,YAAY,GAAG,CAAC;KAC1B,MAAM,EAAE;KACR,KAAK,CAAC,qBAAqB,EAAE,iDAAiD,CAAC,CAAC;AAEnF,6EAA6E;AAC7E,MAAM,CAAC,MAAM,WAAW,GAAG,CAAC;KACzB,MAAM,EAAE;KACR,KAAK,CAAC,2BAA2B,EAAE,+CAA+C,CAAC,CAAC;AAEvF,MAAM,CAAC,MAAM,iBAAiB,GAAG,CAAC;KAC/B,MAAM,EAAE;KACR,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,aAAa,CAAC,CAAC,CAAC,EAAE,EAAE,OAAO,EAAE,0DAA0D,EAAE,CAAC,CAAC;AAE5G,MAAM,CAAC,MAAM,aAAa,GAAG,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,EAAE,CAAC,QAAQ,EAAE,CAAC;AAEzD,0EAA0E;AAE1E,4EAA4E;AAC5E,MAAM,CAAC,MAAM,mBAAmB,GAAG,CAAC,CAAC,MAAM,CAAC;IAC1C,OAAO,EAAE,iBAAiB,CAAC,QAAQ,EAAE;IACrC,OAAO,EAAE,aAAa,CAAC,QAAQ,EAAE;IACjC,EAAE,EAAE,aAAa,CAAC,QAAQ,EAAE;IAC5B,IAAI,EAAE,aAAa,CAAC,QAAQ,EAAE;IAC9B,KAAK,EAAE,WAAW,CAAC,QAAQ,EAAE;IAC7B,MAAM,EAAE,YAAY,CAAC,QAAQ,EAAE;IAC/B,MAAM,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;IAC7B,KAAK,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;IAC5B,SAAS,EAAE,CAAC,CAAC,IAAI,CAAC,CAAC,IAAI,EAAE,UAAU,EAAE,UAAU,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,CAAC,CAAC,CAAC,QAAQ,EAAE;IACpF,2EAA2E;IAC3E,QAAQ,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;IAC/B,6EAA6E;IAC7E,iBAAiB,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;CACzC,CAAC,CAAC;AAGH,MAAM,CAAC,MAAM,eAAe,GAAG,CAAC,CAAC,MAAM,CAAC;IACtC,MAAM,EAAE,YAAY;IACpB,OAAO,EAAE,iBAAiB,CAAC,QAAQ,EAAE;IACrC,OAAO,EAAE,aAAa,CAAC,QAAQ,EAAE;CAClC,CAAC,CAAC;AAGH,MAAM,CAAC,MAAM,qBAAqB,GAAG,CAAC,CAAC,MAAM,CAAC;IAC5C,OAAO,EAAE,aAAa;IACtB,OAAO,EAAE,iBAAiB,CAAC,QAAQ,EAAE;IACrC,OAAO,EAAE,aAAa,CAAC,QAAQ,EAAE;CAClC,CAAC,CAAC;AAGH,MAAM,CAAC,MAAM,qBAAqB,GAAG,CAAC,CAAC,MAAM,CAAC;IAC5C,IAAI,EAAE,aAAa;IACnB,KAAK,EAAE,aAAa,CAAC,QAAQ,EAAE;CAChC,CAAC,CAAC;AAGH,MAAM,CAAC,MAAM,iBAAiB,GAAG,CAAC,CAAC,MAAM,CAAC;IACxC,IAAI,EAAE,aAAa;CACpB,CAAC,CAAC;AAGH,MAAM,CAAC,MAAM,qBAAqB,GAAG,CAAC,CAAC,MAAM,CAAC;IAC5C,IAAI,EAAE,aAAa;IACnB,8EAA8E;IAC9E,KAAK,EAAE,aAAa,CAAC,QAAQ,EAAE;CAChC,CAAC,CAAC;AAGH,MAAM,CAAC,MAAM,iBAAiB,GAAG,CAAC,CAAC,MAAM,CAAC;IACxC,GAAG,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,EAAE,kBAAkB,CAAC;IAC1C,iBAAiB,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;IACxC,mBAAmB,EAAE,aAAa,CAAC,QAAQ,EAAE;IAC7C,KAAK,EAAE,aAAa,CAAC,QAAQ,EAAE;IAC/B,OAAO,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;IAC9B,OAAO,EAAE,aAAa,CAAC,QAAQ,EAAE;CAClC,CAAC,CAAC;AAGH,MAAM,CAAC,MAAM,qBAAqB,GAAG,CAAC,CAAC,MAAM,CAAC;IAC5C,oBAAoB,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,KAAK,CAAC,uBAAuB,EAAE,2CAA2C,CAAC;IAC5G,qBAAqB,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,IAAI,CAAC,uBAAuB,CAAC;IAC/D,uBAAuB,EAAE,YAAY,EAAE,eAAe;CACvD,CAAC,CAAC"}

package/dist/api/server.d.ts

@@ -0,0 +1,11 @@
+import "../lib/envLoader.js";
+import express from "express";
+/**
+ * Build the SafeHands Express app (no listen). Pure construction so it can
+ * be imported by tests/tooling without binding a port. All middleware is env-driven
+ * via httpHardening.ts.
+ */
+export declare function createGuardianApp(): express.Application;
+/** Start the read-only SafeHands API on 0.0.0.0:PORT (Railway-ready). */
+export declare function startServer(): void;
+//# sourceMappingURL=server.d.ts.map

package/dist/api/server.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"server.d.ts","sourceRoot":"","sources":["../../src/api/server.ts"],"names":[],"mappings":"AAaA,OAAO,qBAAqB,CAAC;AAE7B,OAAO,OAAO,MAAM,SAAS,CAAC;AAiF9B;;;;GAIG;AACH,wBAAgB,iBAAiB,IAAI,OAAO,CAAC,WAAW,CAmXvD;AAED,yEAAyE;AACzE,wBAAgB,WAAW,IAAI,IAAI,CAalC"}

package/dist/api/server.js

@@ -0,0 +1,505 @@
+// ─── SafeHands API — Express Server + Tool Gateway ───────────────
+// Wires the pure read-only handlers (routes.ts) to HTTP. The only chain access
+// is a READ-ONLY viem public client (getCode / estimateGas / getGasPrice /
+// getTransactionReceipt). There is NO wallet client, NO private key, NO signer,
+// NO facilitator, and NO write/publish path — execution is impossible by
+// construction. Separate file/port from x402Server.ts.
+//
+// Production hardening lives in httpHardening.ts (pure, env-driven):
+// PORT/host, CORS allowlist, JSON body limit, rate limiting, error/404 shape.
+// The HTTP listener only starts when this module is run directly (e.g.
+// `node dist/api/server.js`), so importing it (tests/tools) never binds a port.
+// ────────────────────────────────────────────────────────────────────────
+import "../lib/envLoader.js";
+import { pathToFileURL } from "url";
+import express from "express";
+import { createPublicClient, defineChain, http } from "viem";
+import { getActiveNetwork, resolveRpcUrl } from "../lib/networks.js";
+import { PharosReadOnlyRpc } from "../lib/pharos/rpc.js";
+import { handleHealth, handleInfraStatus, handlePublicConfig, handleGuardianCheck, handleAnalyzeTx, handleAnalyzeContract, handleAnalyzeApproval, handleAnalyzeSafe, handleAnalyzeCalldata, handleAnalyzeX402, } from "./routes.js";
+import { ok, fail } from "../lib/toolResponse.js";
+import { handleAgentCheck, handleAgentA2ACheck } from "./agentRoutes.js";
+import { handlePrepareTx } from "./prepareRoutes.js";
+import { handleWalletPrepare } from "./walletPrepareRoutes.js";
+import { handleBroadcastSigned, handleGetBroadcastAttestationStatus } from "./broadcastRoutes.js";
+import { handleGoldskyStatus, handleLatestRiskRootIndex, handleAgentReputation } from "./indexerRoutes.js";
+import { assertProductionPosture } from "../lib/productionGuards.js";
+import { handleActivitySummary, handleActivityRecent, handleMetricsPublic } from "./activityRoutes.js";
+import { listHostedTools, invokeHostedTool, isWriteTool } from "./toolRoutes.js";
+import { DEMO_PAGE_HTML } from "./consolePage.js";
+import { buildX402Gate } from "./x402Gate.js";
+import { registerPaidRoutes } from "./paidRoutes.js";
+import { BIND_HOST, resolvePort, isProduction, resolveCorsConfig, corsOriginValue, resolveJsonLimit, resolveQuotaConfig, resolveActivityConfig, resolveLoggingConfig, errorResponseBody, notFoundBody, } from "./httpHardening.js";
+import { resolveRequestId } from "../lib/observability/requestId.js";
+import { logRequest } from "../lib/observability/logger.js";
+import { loadApiKeyConfig, resolveApiKey, evaluateAccess } from "../lib/observability/apiKey.js";
+import { buildAccessContext } from "../lib/observability/accessContext.js";
+import { QuotaLimiter, tierForCaller } from "../lib/observability/quota.js";
+import { resolvePresetName, presetPolicy, sanitizeRequestPolicy } from "../lib/policy/policyPresets.js";
+import { activityStore } from "../lib/observability/activityStore.js";
+import { toActivityItem, callerTypeForEndpoint } from "../lib/observability/sanitize.js";
+// ── Read-only chain access (no signer, no wallet) ──────────────────────
+function buildReadOnlyAccess() {
+    const network = getActiveNetwork();
+    const rpcUrl = resolveRpcUrl(network);
+    const chain = defineChain({
+        id: network.chainId,
+        name: network.label,
+        nativeCurrency: { name: network.nativeToken, symbol: network.nativeToken, decimals: 18 },
+        rpcUrls: { default: { http: [rpcUrl] } },
+        testnet: !network.isMainnet,
+    });
+    const client = createPublicClient({ chain, transport: http(undefined, { timeout: 10_000 }) });
+    // Single whitelist chokepoint: every live read passes the read-only method gate
+    // (rpc.guarded throws fail-closed for any non-read method) before the viem call.
+    const rpc = new PharosReadOnlyRpc({ network, url: rpcUrl });
+    return {
+        getCode: (address) => rpc.guarded("eth_getCode", () => client.getCode({ address })),
+        estimateGas: (args) => rpc.guarded("eth_estimateGas", () => client.estimateGas(args)),
+        getGasPrice: () => rpc.guarded("eth_gasPrice", () => client.getGasPrice()),
+        getTransactionReceipt: (hash) => rpc.guarded("eth_getTransactionReceipt", () => client.getTransactionReceipt({ hash })),
+    };
+}
+// ── Error mapping (consistent shape; never leaks stack traces) ─────────
+function sendError(res, err) {
+    const { status, body } = errorResponseBody(err, { production: isProduction() });
+    res.status(status).json(body);
+}
+/**
+ * Build the SafeHands Express app (no listen). Pure construction so it can
+ * be imported by tests/tooling without binding a port. All middleware is env-driven
+ * via httpHardening.ts.
+ */
+export function createGuardianApp() {
+    const chainAccess = buildReadOnlyAccess();
+    const cors = resolveCorsConfig();
+    const quotaCfg = resolveQuotaConfig();
+    const quota = new QuotaLimiter(quotaCfg);
+    const jsonLimit = resolveJsonLimit();
+    const apiKeyCfg = loadApiKeyConfig();
+    const activityCfg = resolveActivityConfig();
+    const loggingCfg = resolveLoggingConfig();
+    // Size/reset the in-memory activity ring from env at construction.
+    activityStore.configure(activityCfg.capacity);
+    const app = express();
+    app.disable("x-powered-by");
+    // Trust proxy — REQUIRED for correct client IP behind a reverse proxy/CDN, or
+    // the rate-limit buckets on req.ip collapse every client into the proxy's IP.
+    // Env-driven (default off = direct connection). "true" | integer hops | preset.
+    const tp = process.env.SAFEHANDS_TRUST_PROXY;
+    if (tp && tp !== "false") {
+        const hops = Number(tp);
+        app.set("trust proxy", tp === "true" ? true : Number.isInteger(hops) ? hops : tp);
+    }
+    // ── Request ID + structured request log (first; even 404/429 get an id) ──
+    app.use((req, res, next) => {
+        const requestId = resolveRequestId(req.headers["x-request-id"]);
+        const startNs = process.hrtime.bigint();
+        res.locals.requestId = requestId;
+        res.locals.startNs = startNs;
+        res.setHeader("X-Request-Id", requestId);
+        res.on("finish", () => {
+            const durationMs = Math.round(Number(process.hrtime.bigint() - startNs) / 1e6);
+            logRequest({
+                ts: new Date().toISOString(),
+                level: "info",
+                event: "request",
+                requestId,
+                method: req.method,
+                path: req.path,
+                status: res.statusCode,
+                durationMs,
+                callerType: res.locals.callerType ?? null,
+                decision: res.locals.decision ?? null,
+                rateLimited: res.locals.rateLimited === true,
+                apiKeyId: res.locals.apiKeyId ?? null,
+            }, loggingCfg);
+        });
+        next();
+    });
+    // CORS (env-driven allowlist; wildcard default for the public read-only API) + headers.
+    app.use((req, res, next) => {
+        const originValue = corsOriginValue(req.headers.origin, cors);
+        if (originValue)
+            res.setHeader("Access-Control-Allow-Origin", originValue);
+        if (cors.mode === "allowlist")
+            res.setHeader("Vary", "Origin");
+        res.setHeader("Access-Control-Allow-Methods", "GET, POST, OPTIONS");
+        res.setHeader("Access-Control-Allow-Headers", "Content-Type, Accept, X-Api-Key, Authorization, X-Request-Id");
+        res.setHeader("Access-Control-Expose-Headers", "X-Request-Id, X-RateLimit-Limit, X-RateLimit-Remaining, X-RateLimit-Reset, Retry-After");
+        res.setHeader("X-Content-Type-Options", "nosniff");
+        res.setHeader("Referrer-Policy", "no-referrer");
+        res.setHeader("X-Frame-Options", "DENY"); // clickjacking protection
+        res.setHeader("Strict-Transport-Security", "max-age=31536000; includeSubDomains"); // honored over HTTPS
+        if (req.method === "OPTIONS")
+            return res.sendStatus(204);
+        req.setTimeout(15_000);
+        next();
+    });
+    app.use(express.json({ limit: jsonLimit }));
+    // ── Optional API-key access control (open by default) ───────────────────
+    // Public read API stays open unless an operator configures keys AND sets
+    // SAFEHANDS_REQUIRE_API_KEY=true. An explicitly invalid key is always 401.
+    app.use((req, res, next) => {
+        const resolution = resolveApiKey(req.headers, apiKeyCfg);
+        // Sanitized caller identity (no raw key/headers/IP/payload) for activity + logs.
+        const accessCtx = buildAccessContext({
+            path: req.path,
+            resolution,
+            body: req.body,
+            requestId: res.locals.requestId,
+        });
+        res.locals.access = accessCtx;
+        res.locals.apiKeyId = accessCtx.keyId; // backward-compat for the request log
+        res.locals.apiKeyStatus = resolution.status; // "valid" | "anonymous" | "invalid" — used by the write-auth gate
+        const gate = evaluateAccess(req.path, resolution, apiKeyCfg);
+        res.locals.authGate = gate; // Save gate for evaluation after quota
+        next();
+    });
+    // Tiered in-memory quota (Phase 8B). Bucket key = TRUSTED identifier only:
+    // `keyId` for a valid key, else the client IP — never untrusted body identity.
+    // The access tier (anonymous | api-key | agent | a2a) selects the limit. Adds
+    // X-RateLimit-* headers (+ Retry-After on 429). No keys/IPs in headers or body.
+    // /health is exempt so the Railway liveness probe is never throttled.
+    if (quotaCfg.enabled) {
+        app.use((req, res, next) => {
+            if (req.path === "/health")
+                return next();
+            const ctx = res.locals.access;
+            const tier = tierForCaller(ctx?.callerType ?? "anonymous");
+            const identifier = ctx?.keyId ?? req.ip ?? "unknown";
+            const state = quota.consume(tier, identifier);
+            res.setHeader("X-RateLimit-Limit", String(state.limit));
+            res.setHeader("X-RateLimit-Remaining", String(state.remaining));
+            res.setHeader("X-RateLimit-Reset", String(state.resetAtSec));
+            if (state.limited) {
+                res.setHeader("Retry-After", String(state.retryAfterSec));
+                res.locals.rateLimited = true;
+                activityStore.recordRateLimited(tier);
+                const { body } = errorResponseBody(new Error("Too many requests"), { production: isProduction() });
+                return res.status(429).json({ ...body, error: { ...body.error, code: "RATE_LIMITED", retryable: true } });
+            }
+            return next();
+        });
+    }
+    // ── Auth Rejection Gate (runs AFTER Quota so brute-force attempts are rate-limited) ──
+    app.use((req, res, next) => {
+        const gate = res.locals.authGate;
+        if (gate && !gate.allow) {
+            const status = gate.code === "INSUFFICIENT_SCOPE" ? 403 : 401;
+            const message = gate.code === "API_KEY_REQUIRED"
+                ? "A valid API key is required for this endpoint."
+                : gate.code === "INSUFFICIENT_SCOPE"
+                    ? "The provided API key lacks the required scope for this endpoint."
+                    : "Invalid API key.";
+            return res.status(status).json(fail(gate.code ?? "UNAUTHORIZED", message, false, "guardian_api"));
+        }
+        next();
+    });
+    // ── Activity recording + response helpers (decision/analysis endpoints) ─
+    function recordDecision(req, res, endpoint, payload) {
+        const callerType = callerTypeForEndpoint(endpoint);
+        res.locals.callerType = callerType;
+        if (payload && typeof payload === "object" && "decision" in payload) {
+            res.locals.decision = payload.decision;
+        }
+        if (!activityCfg.enabled)
+            return;
+        try {
+            const access = res.locals.access;
+            activityStore.record(toActivityItem({
+                endpoint,
+                callerType,
+                requestId: res.locals.requestId ?? "unknown",
+                body: req.body,
+                payload,
+                access,
+            }));
+        }
+        catch {
+            // recording must never affect the response
+        }
+    }
+    function sendOk(req, res, data) {
+        const requestId = res.locals.requestId;
+        res.json(ok({ ...data, requestId }));
+    }
+    // State-changing endpoints (write tools, signed broadcast) must NEVER ride the
+    // open read origin. Require a VALID API key regardless of SAFEHANDS_REQUIRE_API_KEY.
+    // Fail-closed: with no keys configured, a write call cannot authenticate → refused.
+    function writeAuthOk(res) {
+        return res.locals.apiKeyStatus === "valid";
+    }
+    function denyWriteAuth(res) {
+        return res.status(401).json(fail("API_KEY_REQUIRED_FOR_WRITE", "This state-changing endpoint requires a valid API key. Configure SAFEHANDS_API_KEYS and present it via X-Api-Key or Authorization: Bearer.", false, "guardian_api"));
+    }
+    // Resolve the policy preset (tighten-only) + sanitize request overrides for the
+    // agent path. The result is fed to the EXISTING escalate-only applyPolicy, so it
+    // can never weaken a decision. Agent endpoints default to the `agent` preset.
+    function agentPolicyOpts(reqBody) {
+        const body = reqBody && typeof reqBody === "object" ? reqBody : {};
+        const policyPreset = resolvePresetName(body.policyPreset, "agent", process.env.SAFEHANDS_POLICY_PRESET);
+        const policy = sanitizeRequestPolicy(presetPolicy(policyPreset), body.policy);
+        return { policy, policyPreset };
+    }
+    // ── SafeHands/read routes ─────────────────────────────────────────────
+    // Interactive browser demo (static HTML, no keys, same-origin tool calls).
+    app.get("/demo", (_req, res) => {
+        // Static, server-controlled HTML with same-origin tool calls. Lock it down:
+        // no framing, and restrict resource origins. Inline is allowed because the
+        // console page ships its own inline script/style and reflects no user input.
+        res.setHeader("Content-Security-Policy", "default-src 'self'; script-src 'self' 'unsafe-inline'; style-src 'self' 'unsafe-inline'; connect-src 'self'; img-src 'self' data:; frame-ancestors 'none'");
+        res.type("html").send(DEMO_PAGE_HTML);
+    });
+    app.get("/health", (req, res) => sendOk(req, res, handleHealth()));
+    app.get("/infra/status", (req, res) => sendOk(req, res, handleInfraStatus()));
+    app.get("/public-config", (req, res) => sendOk(req, res, handlePublicConfig()));
+    app.post("/guardian/check", async (req, res) => {
+        try {
+            const payload = await handleGuardianCheck(req.body ?? {}, chainAccess);
+            recordDecision(req, res, "/guardian/check", payload);
+            sendOk(req, res, payload);
+        }
+        catch (err) {
+            sendError(res, err);
+        }
+    });
+    app.post("/analyze/tx", async (req, res) => {
+        try {
+            const payload = await handleAnalyzeTx(req.body ?? {}, chainAccess);
+            recordDecision(req, res, "/analyze/tx", payload);
+            sendOk(req, res, payload);
+        }
+        catch (err) {
+            sendError(res, err);
+        }
+    });
+    app.post("/analyze/contract", async (req, res) => {
+        try {
+            const payload = await handleAnalyzeContract(req.body ?? {}, chainAccess);
+            recordDecision(req, res, "/analyze/contract", payload);
+            sendOk(req, res, payload);
+        }
+        catch (err) {
+            sendError(res, err);
+        }
+    });
+    app.post("/analyze/approval", (req, res) => {
+        try {
+            const payload = handleAnalyzeApproval(req.body ?? {});
+            recordDecision(req, res, "/analyze/approval", payload);
+            sendOk(req, res, payload);
+        }
+        catch (err) {
+            sendError(res, err);
+        }
+    });
+    app.post("/analyze/safe", async (req, res) => {
+        try {
+            const payload = await handleAnalyzeSafe(req.body ?? {});
+            recordDecision(req, res, "/analyze/safe", payload);
+            sendOk(req, res, payload);
+        }
+        catch (err) {
+            sendError(res, err);
+        }
+    });
+    app.post("/analyze/calldata", (req, res) => {
+        try {
+            const payload = handleAnalyzeCalldata(req.body ?? {});
+            recordDecision(req, res, "/analyze/calldata", payload);
+            sendOk(req, res, payload);
+        }
+        catch (err) {
+            sendError(res, err);
+        }
+    });
+    app.post("/analyze/x402", (req, res) => {
+        try {
+            const payload = handleAnalyzeX402(req.body ?? {});
+            recordDecision(req, res, "/analyze/x402", payload);
+            sendOk(req, res, payload);
+        }
+        catch (err) {
+            sendError(res, err);
+        }
+    });
+    // ── SafeHands Agent endpoints (real SafeHandsGuardianAgent, read-only) ──
+    app.post("/agent/check", async (req, res) => {
+        try {
+            const payload = await handleAgentCheck(req.body ?? {}, chainAccess, agentPolicyOpts(req.body));
+            recordDecision(req, res, "/agent/check", payload);
+            sendOk(req, res, payload);
+        }
+        catch (err) {
+            sendError(res, err);
+        }
+    });
+    app.post("/agent/a2a/check", async (req, res) => {
+        try {
+            const payload = await handleAgentA2ACheck(req.body ?? {}, chainAccess, agentPolicyOpts(req.body));
+            recordDecision(req, res, "/agent/a2a/check", payload);
+            sendOk(req, res, payload);
+        }
+        catch (err) {
+            sendError(res, err);
+        }
+    });
+    // ── Prepare-only unsigned transaction — read-only; never signs/broadcasts ──
+    app.post("/prepare/tx", async (req, res) => {
+        try {
+            const payload = await handlePrepareTx(req.body ?? {}, chainAccess, agentPolicyOpts(req.body));
+            recordDecision(req, res, "/prepare/tx", payload);
+            sendOk(req, res, payload);
+        }
+        catch (err) {
+            sendError(res, err);
+        }
+    });
+    // ── Wallet-ready transaction handoff — read-only; never signs/broadcasts ──
+    // Reads wallet context (userAddress/from) from the request and returns a wallet-ready
+    // request for an EXTERNAL wallet to sign + send. SafeHands holds no key and creates no wallet.
+    app.post("/wallet/prepare", async (req, res) => {
+        try {
+            const payload = await handleWalletPrepare(req.body ?? {}, chainAccess, agentPolicyOpts(req.body));
+            recordDecision(req, res, "/wallet/prepare", payload);
+            sendOk(req, res, payload);
+        }
+        catch (err) {
+            sendError(res, err);
+        }
+    });
+    // ── Verified Broadcast ──
+    app.post("/broadcast/signed", async (req, res) => {
+        try {
+            if (!writeAuthOk(res))
+                return denyWriteAuth(res);
+            const payload = await handleBroadcastSigned(req.body ?? {});
+            recordDecision(req, res, "/broadcast/signed", payload);
+            sendOk(req, res, payload);
+        }
+        catch (err) {
+            sendError(res, err);
+        }
+    });
+    app.get("/attestation/:txHash", async (req, res) => {
+        try {
+            const payload = await handleGetBroadcastAttestationStatus(req.params.txHash);
+            sendOk(req, res, payload);
+        }
+        catch (err) {
+            sendError(res, err);
+        }
+    });
+    app.get("/goldsky/status", (req, res) => {
+        try {
+            sendOk(req, res, handleGoldskyStatus());
+        }
+        catch (err) {
+            sendError(res, err);
+        }
+    });
+    app.get("/registry/latest", async (req, res) => {
+        try {
+            sendOk(req, res, await handleLatestRiskRootIndex());
+        }
+        catch (err) {
+            sendError(res, err);
+        }
+    });
+    app.get("/reputation/:address", async (req, res) => {
+        try {
+            sendOk(req, res, await handleAgentReputation(req.params.address));
+        }
+        catch (err) {
+            sendError(res, err);
+        }
+    });
+    // ── Public activity feed + aggregate metrics (read-only) ──────
+    app.get("/activity/summary", (req, res) => {
+        try {
+            sendOk(req, res, handleActivitySummary());
+        }
+        catch (err) {
+            sendError(res, err);
+        }
+    });
+    app.get("/activity/recent", (req, res) => {
+        try {
+            sendOk(req, res, handleActivityRecent(req.query));
+        }
+        catch (err) {
+            sendError(res, err);
+        }
+    });
+    app.get("/metrics/public", (req, res) => {
+        try {
+            sendOk(req, res, handleMetricsPublic());
+        }
+        catch (err) {
+            sendError(res, err);
+        }
+    });
+    // ── Full SafeHands hosted tool gateway (same 33 tools as MCP/Anvita) ──
+    app.get("/tools", (req, res) => {
+        try {
+            sendOk(req, res, listHostedTools());
+        }
+        catch (err) {
+            sendError(res, err);
+        }
+    });
+    app.post("/tools/:toolName", async (req, res) => {
+        try {
+            // Read tools stay open; write tools require a valid API key (never open-origin execution).
+            if (isWriteTool(req.params.toolName) && !writeAuthOk(res))
+                return denyWriteAuth(res);
+            const payload = await invokeHostedTool(req.params.toolName, req.body ?? {});
+            res.status(payload.success ? 200 : 400).json(payload);
+        }
+        catch (err) {
+            sendError(res, err);
+        }
+    });
+    // ── x402 paid bundle entrypoints (/paid/*) ────────────────────────────
+    // Zero-custody gate: an EXTERNAL facilitator verifies/settles; the service holds no
+    // key. Installed BEFORE the handlers so paid logic never runs pre-payment; fail-closed
+    // (503) when unconfigured. Sits after quota/auth so 402 challenges stay rate-limited.
+    const x402Gate = buildX402Gate();
+    x402Gate.install(app);
+    registerPaidRoutes(app);
+    // ── Safe 404 (consistent shape) for any unmatched route/method ────────
+    app.use((req, res) => {
+        res.status(404).json(notFoundBody(req.method, req.path));
+    });
+    // ── Global error handler (last) — catches throws from middleware/body-parser
+    // that escape the per-route try/catch. ALWAYS genericized (production shape)
+    // so a stack trace can never leak regardless of NODE_ENV. ─────────────
+    app.use((err, _req, res, next) => {
+        if (res.headersSent)
+            return next(err);
+        const { status, body } = errorResponseBody(err, { production: true });
+        res.status(status).json(body);
+    });
+    return app;
+}
+/** Start the read-only SafeHands API on 0.0.0.0:PORT (Railway-ready). */
+export function startServer() {
+    // Fail-fast / warn on unsafe public-hosting posture before binding (production only).
+    assertProductionPosture();
+    const app = createGuardianApp();
+    const port = resolvePort();
+    app.listen(port, BIND_HOST, () => {
+        const network = getActiveNetwork();
+        console.log(`✅ SafeHands API + Tool Gateway on http://${BIND_HOST}:${port}`);
+        console.log(`📡 Active network: ${network.label} (chainId ${network.chainId}, ${network.nativeToken})`);
+        console.log(`🔐 Default-safe: read/check routes are open; hosted tools and user-signed broadcast stay env-gated.`);
+        console.log(`🆓 GET /health, /infra/status, /public-config · POST /guardian/check, /analyze/{tx,contract,approval,safe,calldata,x402}, /agent/check, /agent/a2a/check, /prepare/tx, /wallet/prepare, /broadcast/signed · GET /tools · POST /tools/:toolName`);
+        console.log(`📊 Observability: GET /activity/summary, /activity/recent, /metrics/public · X-Request-Id on every response`);
+    });
+}
+// Start ONLY when run directly (e.g. `node dist/api/server.js`); importing never binds.
+const invokedDirectly = Boolean(process.argv[1]) && import.meta.url === pathToFileURL(process.argv[1]).href;
+if (invokedDirectly)
+    startServer();
+//# sourceMappingURL=server.js.map

package/dist/api/server.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"server.js","sourceRoot":"","sources":["../../src/api/server.ts"],"names":[],"mappings":"AAAA,oEAAoE;AACpE,+EAA+E;AAC/E,2EAA2E;AAC3E,gFAAgF;AAChF,yEAAyE;AACzE,uDAAuD;AACvD,EAAE;AACF,qEAAqE;AACrE,8EAA8E;AAC9E,uEAAuE;AACvE,gFAAgF;AAChF,2EAA2E;AAE3E,OAAO,qBAAqB,CAAC;AAC7B,OAAO,EAAE,aAAa,EAAE,MAAM,KAAK,CAAC;AACpC,OAAO,OAAO,MAAM,SAAS,CAAC;AAC9B,OAAO,EAAE,kBAAkB,EAAE,WAAW,EAAE,IAAI,EAAE,MAAM,MAAM,CAAC;AAE7D,OAAO,EAAE,gBAAgB,EAAE,aAAa,EAAE,MAAM,oBAAoB,CAAC;AACrE,OAAO,EAAE,iBAAiB,EAAE,MAAM,sBAAsB,CAAC;AAEzD,OAAO,EACL,YAAY,EACZ,iBAAiB,EACjB,kBAAkB,EAClB,mBAAmB,EACnB,eAAe,EACf,qBAAqB,EACrB,qBAAqB,EACrB,iBAAiB,EACjB,qBAAqB,EACrB,iBAAiB,GAClB,MAAM,aAAa,CAAC;AACrB,OAAO,EAAE,EAAE,EAAE,IAAI,EAAE,MAAM,wBAAwB,CAAC;AAClD,OAAO,EAAE,gBAAgB,EAAE,mBAAmB,EAAE,MAAM,kBAAkB,CAAC;AACzE,OAAO,EAAE,eAAe,EAAE,MAAM,oBAAoB,CAAC;AACrD,OAAO,EAAE,mBAAmB,EAAE,MAAM,0BAA0B,CAAC;AAC/D,OAAO,EAAE,qBAAqB,EAAE,mCAAmC,EAAE,MAAM,sBAAsB,CAAC;AAClG,OAAO,EAAE,mBAAmB,EAAE,yBAAyB,EAAE,qBAAqB,EAAE,MAAM,oBAAoB,CAAC;AAC3G,OAAO,EAAE,uBAAuB,EAAE,MAAM,4BAA4B,CAAC;AACrE,OAAO,EAAE,qBAAqB,EAAE,oBAAoB,EAAE,mBAAmB,EAAE,MAAM,qBAAqB,CAAC;AACvG,OAAO,EAAE,eAAe,EAAE,gBAAgB,EAAE,WAAW,EAAE,MAAM,iBAAiB,CAAC;AACjF,OAAO,EAAE,cAAc,EAAE,MAAM,kBAAkB,CAAC;AAClD,OAAO,EAAE,aAAa,EAAE,MAAM,eAAe,CAAC;AAC9C,OAAO,EAAE,kBAAkB,EAAE,MAAM,iBAAiB,CAAC;AACrD,OAAO,EACL,SAAS,EACT,WAAW,EACX,YAAY,EACZ,iBAAiB,EACjB,eAAe,EACf,gBAAgB,EAChB,kBAAkB,EAClB,qBAAqB,EACrB,oBAAoB,EACpB,iBAAiB,EACjB,YAAY,GACb,MAAM,oBAAoB,CAAC;AAC5B,OAAO,EAAE,gBAAgB,EAAE,MAAM,mCAAmC,CAAC;AACrE,OAAO,EAAE,UAAU,EAAE,MAAM,gCAAgC,CAAC;AAC5D,OAAO,EAAE,gBAAgB,EAAE,aAAa,EAAE,cAAc,EAAE,MAAM,gCAAgC,CAAC;AACjG,OAAO,EAAE,kBAAkB,EAAsB,MAAM,uCAAuC,CAAC;AAC/F,OAAO,EAAE,YAAY,EAAE,aAAa,EAAE,MAAM,+BAA+B,CAAC;AAC5E,OAAO,EAAE,iBAAiB,EAAE,YAAY,EAAE,qBAAqB,EAAE,MAAM,gCAAgC,CAAC;AACxG,OAAO,EAAE,aAAa,EAAE,MAAM,uCAAuC,CAAC;AACtE,OAAO,EAAE,cAAc,EAAE,qBAAqB,EAAE,MAAM,kCAAkC,CAAC;AAEzF,0EAA0E;AAC1E,SAAS,mBAAmB;IAC1B,MAAM,OAAO,GAAG,gBAAgB,EAAE,CAAC;IACnC,MAAM,MAAM,GAAG,aAAa,CAAC,OAAO,CAAC,CAAC;IACtC,MAAM,KAAK,GAAG,WAAW,CAAC;QACxB,EAAE,EAAE,OAAO,CAAC,OAAO;QACnB,IAAI,EAAE,OAAO,CAAC,KAAK;QACnB,cAAc,EAAE,EAAE,IAAI,EAAE,OAAO,CAAC,WAAW,EAAE,MAAM,EAAE,OAAO,CAAC,WAAW,EAAE,QAAQ,EAAE,EAAE,EAAE;QACxF,OAAO,EAAE,EAAE,OAAO,EAAE,EAAE,IAAI,EAAE,CAAC,MAAM,CAAC,EAAE,EAAE;QACxC,OAAO,EAAE,CAAC,OAAO,CAAC,SAAS;KAC5B,CAAC,CAAC;IACH,MAAM,MAAM,GAAG,kBAAkB,CAAC,EAAE,KAAK,EAAE,SAAS,EAAE,IAAI,CAAC,SAAS,EAAE,EAAE,OAAO,EAAE,MAAM,EAAE,CAAC,EAAE,CAAC,CAAC;IAC9F,gFAAgF;IAChF,iFAAiF;IACjF,MAAM,GAAG,GAAG,IAAI,iBAAiB,CAAC,EAAE,OAAO,EAAE,GAAG,EAAE,MAAM,EAAE,CAAC,CAAC;IAC5D,OAAO;QACL,OAAO,EAAE,CAAC,OAAO,EAAE,EAAE,CAAC,GAAG,CAAC,OAAO,CAAC,aAAa,EAAE,GAAG,EAAE,CAAC,MAAM,CAAC,OAAO,CAAC,EAAE,OAAO,EAAE,CAAC,CAAC;QACnF,WAAW,EAAE,CAAC,IAAI,EAAE,EAAE,CAAC,GAAG,CAAC,OAAO,CAAC,iBAAiB,EAAE,GAAG,EAAE,CAAC,MAAM,CAAC,WAAW,CAAC,IAAI,CAAC,CAAC;QACrF,WAAW,EAAE,GAAG,EAAE,CAAC,GAAG,CAAC,OAAO,CAAC,cAAc,EAAE,GAAG,EAAE,CAAC,MAAM,CAAC,WAAW,EAAE,CAAC;QAC1E,qBAAqB,EAAE,CAAC,IAAI,EAAE,EAAE,CAAC,GAAG,CAAC,OAAO,CAAC,2BAA2B,EAAE,GAAG,EAAE,CAAC,MAAM,CAAC,qBAAqB,CAAC,EAAE,IAAI,EAAE,CAAC,CAAC;KACxH,CAAC;AACJ,CAAC;AAED,0EAA0E;AAC1E,SAAS,SAAS,CAAC,GAAqB,EAAE,GAAY;IACpD,MAAM,EAAE,MAAM,EAAE,IAAI,EAAE,GAAG,iBAAiB,CAAC,GAAG,EAAE,EAAE,UAAU,EAAE,YAAY,EAAE,EAAE,CAAC,CAAC;IAChF,GAAG,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;AAChC,CAAC;AAED;;;;GAIG;AACH,MAAM,UAAU,iBAAiB;IAC/B,MAAM,WAAW,GAAG,mBAAmB,EAAE,CAAC;IAC1C,MAAM,IAAI,GAAG,iBAAiB,EAAE,CAAC;IACjC,MAAM,QAAQ,GAAG,kBAAkB,EAAE,CAAC;IACtC,MAAM,KAAK,GAAG,IAAI,YAAY,CAAC,QAAQ,CAAC,CAAC;IACzC,MAAM,SAAS,GAAG,gBAAgB,EAAE,CAAC;IACrC,MAAM,SAAS,GAAG,gBAAgB,EAAE,CAAC;IACrC,MAAM,WAAW,GAAG,qBAAqB,EAAE,CAAC;IAC5C,MAAM,UAAU,GAAG,oBAAoB,EAAE,CAAC;IAE1C,mEAAmE;IACnE,aAAa,CAAC,SAAS,CAAC,WAAW,CAAC,QAAQ,CAAC,CAAC;IAE9C,MAAM,GAAG,GAAG,OAAO,EAAE,CAAC;IACtB,GAAG,CAAC,OAAO,CAAC,cAAc,CAAC,CAAC;IAE5B,8EAA8E;IAC9E,8EAA8E;IAC9E,gFAAgF;IAChF,MAAM,EAAE,GAAG,OAAO,CAAC,GAAG,CAAC,qBAAqB,CAAC;IAC7C,IAAI,EAAE,IAAI,EAAE,KAAK,OAAO,EAAE,CAAC;QACzB,MAAM,IAAI,GAAG,MAAM,CAAC,EAAE,CAAC,CAAC;QACxB,GAAG,CAAC,GAAG,CAAC,aAAa,EAAE,EAAE,KAAK,MAAM,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,MAAM,CAAC,SAAS,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC;IACpF,CAAC;IAED,4EAA4E;IAC5E,GAAG,CAAC,GAAG,CAAC,CAAC,GAAG,EAAE,GAAG,EAAE,IAAI,EAAE,EAAE;QACzB,MAAM,SAAS,GAAG,gBAAgB,CAAC,GAAG,CAAC,OAAO,CAAC,cAAc,CAAC,CAAC,CAAC;QAChE,MAAM,OAAO,GAAG,OAAO,CAAC,MAAM,CAAC,MAAM,EAAE,CAAC;QACxC,GAAG,CAAC,MAAM,CAAC,SAAS,GAAG,SAAS,CAAC;QACjC,GAAG,CAAC,MAAM,CAAC,OAAO,GAAG,OAAO,CAAC;QAC7B,GAAG,CAAC,SAAS,CAAC,cAAc,EAAE,SAAS,CAAC,CAAC;QACzC,GAAG,CAAC,EAAE,CAAC,QAAQ,EAAE,GAAG,EAAE;YACpB,MAAM,UAAU,GAAG,IAAI,CAAC,KAAK,CAAC,MAAM,CAAC,OAAO,CAAC,MAAM,CAAC,MAAM,EAAE,GAAG,OAAO,CAAC,GAAG,GAAG,CAAC,CAAC;YAC/E,UAAU,CACR;gBACE,EAAE,EAAE,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE;gBAC5B,KAAK,EAAE,MAAM;gBACb,KAAK,EAAE,SAAS;gBAChB,SAAS;gBACT,MAAM,EAAE,GAAG,CAAC,MAAM;gBAClB,IAAI,EAAE,GAAG,CAAC,IAAI;gBACd,MAAM,EAAE,GAAG,CAAC,UAAU;gBACtB,UAAU;gBACV,UAAU,EAAG,GAAG,CAAC,MAAM,CAAC,UAAiC,IAAI,IAAI;gBACjE,QAAQ,EAAG,GAAG,CAAC,MAAM,CAAC,QAA+B,IAAI,IAAI;gBAC7D,WAAW,EAAE,GAAG,CAAC,MAAM,CAAC,WAAW,KAAK,IAAI;gBAC5C,QAAQ,EAAG,GAAG,CAAC,MAAM,CAAC,QAA+B,IAAI,IAAI;aAC9D,EACD,UAAU,CACX,CAAC;QACJ,CAAC,CAAC,CAAC;QACH,IAAI,EAAE,CAAC;IACT,CAAC,CAAC,CAAC;IAEH,wFAAwF;IACxF,GAAG,CAAC,GAAG,CAAC,CAAC,GAAG,EAAE,GAAG,EAAE,IAAI,EAAE,EAAE;QACzB,MAAM,WAAW,GAAG,eAAe,CAAC,GAAG,CAAC,OAAO,CAAC,MAAM,EAAE,IAAI,CAAC,CAAC;QAC9D,IAAI,WAAW;YAAE,GAAG,CAAC,SAAS,CAAC,6BAA6B,EAAE,WAAW,CAAC,CAAC;QAC3E,IAAI,IAAI,CAAC,IAAI,KAAK,WAAW;YAAE,GAAG,CAAC,SAAS,CAAC,MAAM,EAAE,QAAQ,CAAC,CAAC;QAC/D,GAAG,CAAC,SAAS,CAAC,8BAA8B,EAAE,oBAAoB,CAAC,CAAC;QACpE,GAAG,CAAC,SAAS,CAAC,8BAA8B,EAAE,8DAA8D,CAAC,CAAC;QAC9G,GAAG,CAAC,SAAS,CAAC,+BAA+B,EAAE,wFAAwF,CAAC,CAAC;QACzI,GAAG,CAAC,SAAS,CAAC,wBAAwB,EAAE,SAAS,CAAC,CAAC;QACnD,GAAG,CAAC,SAAS,CAAC,iBAAiB,EAAE,aAAa,CAAC,CAAC;QAChD,GAAG,CAAC,SAAS,CAAC,iBAAiB,EAAE,MAAM,CAAC,CAAC,CAAC,0BAA0B;QACpE,GAAG,CAAC,SAAS,CAAC,2BAA2B,EAAE,qCAAqC,CAAC,CAAC,CAAC,qBAAqB;QACxG,IAAI,GAAG,CAAC,MAAM,KAAK,SAAS;YAAE,OAAO,GAAG,CAAC,UAAU,CAAC,GAAG,CAAC,CAAC;QACzD,GAAG,CAAC,UAAU,CAAC,MAAM,CAAC,CAAC;QACvB,IAAI,EAAE,CAAC;IACT,CAAC,CAAC,CAAC;IAEH,GAAG,CAAC,GAAG,CAAC,OAAO,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,SAAS,EAAE,CAAC,CAAC,CAAC;IAE5C,2EAA2E;IAC3E,yEAAyE;IACzE,2EAA2E;IAC3E,GAAG,CAAC,GAAG,CAAC,CAAC,GAAG,EAAE,GAAG,EAAE,IAAI,EAAE,EAAE;QACzB,MAAM,UAAU,GAAG,aAAa,CAAC,GAAG,CAAC,OAAO,EAAE,SAAS,CAAC,CAAC;QACzD,iFAAiF;QACjF,MAAM,SAAS,GAAG,kBAAkB,CAAC;YACnC,IAAI,EAAE,GAAG,CAAC,IAAI;YACd,UAAU;YACV,IAAI,EAAE,GAAG,CAAC,IAAI;YACd,SAAS,EAAE,GAAG,CAAC,MAAM,CAAC,SAA+B;SACtD,CAAC,CAAC;QACH,GAAG,CAAC,MAAM,CAAC,MAAM,GAAG,SAAS,CAAC;QAC9B,GAAG,CAAC,MAAM,CAAC,QAAQ,GAAG,SAAS,CAAC,KAAK,CAAC,CAAC,sCAAsC;QAC7E,GAAG,CAAC,MAAM,CAAC,YAAY,GAAG,UAAU,CAAC,MAAM,CAAC,CAAC,kEAAkE;QAC/G,MAAM,IAAI,GAAG,cAAc,CAAC,GAAG,CAAC,IAAI,EAAE,UAAU,EAAE,SAAS,CAAC,CAAC;QAC7D,GAAG,CAAC,MAAM,CAAC,QAAQ,GAAG,IAAI,CAAC,CAAC,uCAAuC;QACnE,IAAI,EAAE,CAAC;IACT,CAAC,CAAC,CAAC;IAEH,2EAA2E;IAC3E,+EAA+E;IAC/E,8EAA8E;IAC9E,gFAAgF;IAChF,sEAAsE;IACtE,IAAI,QAAQ,CAAC,OAAO,EAAE,CAAC;QACrB,GAAG,CAAC,GAAG,CAAC,CAAC,GAAG,EAAE,GAAG,EAAE,IAAI,EAAE,EAAE;YACzB,IAAI,GAAG,CAAC,IAAI,KAAK,SAAS;gBAAE,OAAO,IAAI,EAAE,CAAC;YAC1C,MAAM,GAAG,GAAG,GAAG,CAAC,MAAM,CAAC,MAAmC,CAAC;YAC3D,MAAM,IAAI,GAAG,aAAa,CAAC,GAAG,EAAE,UAAU,IAAI,WAAW,CAAC,CAAC;YAC3D,MAAM,UAAU,GAAG,GAAG,EAAE,KAAK,IAAI,GAAG,CAAC,EAAE,IAAI,SAAS,CAAC;YACrD,MAAM,KAAK,GAAG,KAAK,CAAC,OAAO,CAAC,IAAI,EAAE,UAAU,CAAC,CAAC;YAC9C,GAAG,CAAC,SAAS,CAAC,mBAAmB,EAAE,MAAM,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC,CAAC;YACxD,GAAG,CAAC,SAAS,CAAC,uBAAuB,EAAE,MAAM,CAAC,KAAK,CAAC,SAAS,CAAC,CAAC,CAAC;YAChE,GAAG,CAAC,SAAS,CAAC,mBAAmB,EAAE,MAAM,CAAC,KAAK,CAAC,UAAU,CAAC,CAAC,CAAC;YAC7D,IAAI,KAAK,CAAC,OAAO,EAAE,CAAC;gBAClB,GAAG,CAAC,SAAS,CAAC,aAAa,EAAE,MAAM,CAAC,KAAK,CAAC,aAAa,CAAC,CAAC,CAAC;gBAC1D,GAAG,CAAC,MAAM,CAAC,WAAW,GAAG,IAAI,CAAC;gBAC9B,aAAa,CAAC,iBAAiB,CAAC,IAAI,CAAC,CAAC;gBACtC,MAAM,EAAE,IAAI,EAAE,GAAG,iBAAiB,CAAC,IAAI,KAAK,CAAC,mBAAmB,CAAC,EAAE,EAAE,UAAU,EAAE,YAAY,EAAE,EAAE,CAAC,CAAC;gBACnG,OAAO,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,EAAE,GAAG,IAAI,EAAE,KAAK,EAAE,EAAE,GAAG,IAAI,CAAC,KAAK,EAAE,IAAI,EAAE,cAAc,EAAE,SAAS,EAAE,IAAI,EAAE,EAAE,CAAC,CAAC;YAC5G,CAAC;YACD,OAAO,IAAI,EAAE,CAAC;QAChB,CAAC,CAAC,CAAC;IACL,CAAC;IAED,wFAAwF;IACxF,GAAG,CAAC,GAAG,CAAC,CAAC,GAAG,EAAE,GAAG,EAAE,IAAI,EAAE,EAAE;QACzB,MAAM,IAAI,GAAG,GAAG,CAAC,MAAM,CAAC,QAAQ,CAAC;QACjC,IAAI,IAAI,IAAI,CAAC,IAAI,CAAC,KAAK,EAAE,CAAC;YACxB,MAAM,MAAM,GAAG,IAAI,CAAC,IAAI,KAAK,oBAAoB,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,GAAG,CAAC;YAC9D,MAAM,OAAO,GACX,IAAI,CAAC,IAAI,KAAK,kBAAkB;gBAC9B,CAAC,CAAC,gDAAgD;gBAClD,CAAC,CAAC,IAAI,CAAC,IAAI,KAAK,oBAAoB;oBAClC,CAAC,CAAC,kEAAkE;oBACpE,CAAC,CAAC,kBAAkB,CAAC;YAC3B,OAAO,GAAG,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI,IAAI,cAAc,EAAE,OAAO,EAAE,KAAK,EAAE,cAAc,CAAC,CAAC,CAAC;QACpG,CAAC;QACD,IAAI,EAAE,CAAC;IACT,CAAC,CAAC,CAAC;IAEH,2EAA2E;IAC3E,SAAS,cAAc,CAAC,GAAoB,EAAE,GAAqB,EAAE,QAAgB,EAAE,OAAgB;QACrG,MAAM,UAAU,GAAG,qBAAqB,CAAC,QAAQ,CAAC,CAAC;QACnD,GAAG,CAAC,MAAM,CAAC,UAAU,GAAG,UAAU,CAAC;QACnC,IAAI,OAAO,IAAI,OAAO,OAAO,KAAK,QAAQ,IAAI,UAAU,IAAK,OAAmC,EAAE,CAAC;YACjG,GAAG,CAAC,MAAM,CAAC,QAAQ,GAAI,OAAmC,CAAC,QAAQ,CAAC;QACtE,CAAC;QACD,IAAI,CAAC,WAAW,CAAC,OAAO;YAAE,OAAO;QACjC,IAAI,CAAC;YACH,MAAM,MAAM,GAAG,GAAG,CAAC,MAAM,CAAC,MAAmC,CAAC;YAC9D,aAAa,CAAC,MAAM,CAClB,cAAc,CAAC;gBACb,QAAQ;gBACR,UAAU;gBACV,SAAS,EAAG,GAAG,CAAC,MAAM,CAAC,SAAoB,IAAI,SAAS;gBACxD,IAAI,EAAE,GAAG,CAAC,IAAI;gBACd,OAAO;gBACP,MAAM;aACP,CAAC,CACH,CAAC;QACJ,CAAC;QAAC,MAAM,CAAC;YACP,2CAA2C;QAC7C,CAAC;IACH,CAAC;IAED,SAAS,MAAM,CAAC,GAAoB,EAAE,GAAqB,EAAE,IAAa;QACxE,MAAM,SAAS,GAAG,GAAG,CAAC,MAAM,CAAC,SAA+B,CAAC;QAC7D,GAAG,CAAC,IAAI,CAAC,EAAE,CAAC,EAAE,GAAI,IAAgC,EAAE,SAAS,EAAE,CAAC,CAAC,CAAC;IACpE,CAAC;IAED,+EAA+E;IAC/E,qFAAqF;IACrF,oFAAoF;IACpF,SAAS,WAAW,CAAC,GAAqB;QACxC,OAAO,GAAG,CAAC,MAAM,CAAC,YAAY,KAAK,OAAO,CAAC;IAC7C,CAAC;IACD,SAAS,aAAa,CAAC,GAAqB;QAC1C,OAAO,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CACzB,IAAI,CACF,4BAA4B,EAC5B,4IAA4I,EAC5I,KAAK,EACL,cAAc,CACf,CACF,CAAC;IACJ,CAAC;IAED,gFAAgF;IAChF,iFAAiF;IACjF,8EAA8E;IAC9E,SAAS,eAAe,CAAC,OAAgB;QACvC,MAAM,IAAI,GAAG,OAAO,IAAI,OAAO,OAAO,KAAK,QAAQ,CAAC,CAAC,CAAE,OAAmC,CAAC,CAAC,CAAC,EAAE,CAAC;QAChG,MAAM,YAAY,GAAG,iBAAiB,CAAC,IAAI,CAAC,YAAY,EAAE,OAAO,EAAE,OAAO,CAAC,GAAG,CAAC,uBAAuB,CAAC,CAAC;QACxG,MAAM,MAAM,GAAG,qBAAqB,CAAC,YAAY,CAAC,YAAY,CAAC,EAAE,IAAI,CAAC,MAAM,CAAC,CAAC;QAC9E,OAAO,EAAE,MAAM,EAAE,YAAY,EAAE,CAAC;IAClC,CAAC;IAED,yEAAyE;IACzE,2EAA2E;IAC3E,GAAG,CAAC,GAAG,CAAC,OAAO,EAAE,CAAC,IAAI,EAAE,GAAG,EAAE,EAAE;QAC7B,4EAA4E;QAC5E,2EAA2E;QAC3E,6EAA6E;QAC7E,GAAG,CAAC,SAAS,CACX,yBAAyB,EACzB,2JAA2J,CAC5J,CAAC;QACF,GAAG,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC,IAAI,CAAC,cAAc,CAAC,CAAC;IACxC,CAAC,CAAC,CAAC;IACH,GAAG,CAAC,GAAG,CAAC,SAAS,EAAE,CAAC,GAAG,EAAE,GAAG,EAAE,EAAE,CAAC,MAAM,CAAC,GAAG,EAAE,GAAG,EAAE,YAAY,EAAE,CAAC,CAAC,CAAC;IACnE,GAAG,CAAC,GAAG,CAAC,eAAe,EAAE,CAAC,GAAG,EAAE,GAAG,EAAE,EAAE,CAAC,MAAM,CAAC,GAAG,EAAE,GAAG,EAAE,iBAAiB,EAAE,CAAC,CAAC,CAAC;IAC9E,GAAG,CAAC,GAAG,CAAC,gBAAgB,EAAE,CAAC,GAAG,EAAE,GAAG,EAAE,EAAE,CAAC,MAAM,CAAC,GAAG,EAAE,GAAG,EAAE,kBAAkB,EAAE,CAAC,CAAC,CAAC;IAEhF,GAAG,CAAC,IAAI,CAAC,iBAAiB,EAAE,KAAK,EAAE,GAAG,EAAE,GAAG,EAAE,EAAE;QAC7C,IAAI,CAAC;YACH,MAAM,OAAO,GAAG,MAAM,mBAAmB,CAAC,GAAG,CAAC,IAAI,IAAI,EAAE,EAAE,WAAW,CAAC,CAAC;YACvE,cAAc,CAAC,GAAG,EAAE,GAAG,EAAE,iBAAiB,EAAE,OAAO,CAAC,CAAC;YACrD,MAAM,CAAC,GAAG,EAAE,GAAG,EAAE,OAAO,CAAC,CAAC;QAC5B,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YAAC,SAAS,CAAC,GAAG,EAAE,GAAG,CAAC,CAAC;QAAC,CAAC;IACxC,CAAC,CAAC,CAAC;IACH,GAAG,CAAC,IAAI,CAAC,aAAa,EAAE,KAAK,EAAE,GAAG,EAAE,GAAG,EAAE,EAAE;QACzC,IAAI,CAAC;YACH,MAAM,OAAO,GAAG,MAAM,eAAe,CAAC,GAAG,CAAC,IAAI,IAAI,EAAE,EAAE,WAAW,CAAC,CAAC;YACnE,cAAc,CAAC,GAAG,EAAE,GAAG,EAAE,aAAa,EAAE,OAAO,CAAC,CAAC;YACjD,MAAM,CAAC,GAAG,EAAE,GAAG,EAAE,OAAO,CAAC,CAAC;QAC5B,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YAAC,SAAS,CAAC,GAAG,EAAE,GAAG,CAAC,CAAC;QAAC,CAAC;IACxC,CAAC,CAAC,CAAC;IACH,GAAG,CAAC,IAAI,CAAC,mBAAmB,EAAE,KAAK,EAAE,GAAG,EAAE,GAAG,EAAE,EAAE;QAC/C,IAAI,CAAC;YACH,MAAM,OAAO,GAAG,MAAM,qBAAqB,CAAC,GAAG,CAAC,IAAI,IAAI,EAAE,EAAE,WAAW,CAAC,CAAC;YACzE,cAAc,CAAC,GAAG,EAAE,GAAG,EAAE,mBAAmB,EAAE,OAAO,CAAC,CAAC;YACvD,MAAM,CAAC,GAAG,EAAE,GAAG,EAAE,OAAO,CAAC,CAAC;QAC5B,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YAAC,SAAS,CAAC,GAAG,EAAE,GAAG,CAAC,CAAC;QAAC,CAAC;IACxC,CAAC,CAAC,CAAC;IACH,GAAG,CAAC,IAAI,CAAC,mBAAmB,EAAE,CAAC,GAAG,EAAE,GAAG,EAAE,EAAE;QACzC,IAAI,CAAC;YACH,MAAM,OAAO,GAAG,qBAAqB,CAAC,GAAG,CAAC,IAAI,IAAI,EAAE,CAAC,CAAC;YACtD,cAAc,CAAC,GAAG,EAAE,GAAG,EAAE,mBAAmB,EAAE,OAAO,CAAC,CAAC;YACvD,MAAM,CAAC,GAAG,EAAE,GAAG,EAAE,OAAO,CAAC,CAAC;QAC5B,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YAAC,SAAS,CAAC,GAAG,EAAE,GAAG,CAAC,CAAC;QAAC,CAAC;IACxC,CAAC,CAAC,CAAC;IACH,GAAG,CAAC,IAAI,CAAC,eAAe,EAAE,KAAK,EAAE,GAAG,EAAE,GAAG,EAAE,EAAE;QAC3C,IAAI,CAAC;YACH,MAAM,OAAO,GAAG,MAAM,iBAAiB,CAAC,GAAG,CAAC,IAAI,IAAI,EAAE,CAAC,CAAC;YACxD,cAAc,CAAC,GAAG,EAAE,GAAG,EAAE,eAAe,EAAE,OAAO,CAAC,CAAC;YACnD,MAAM,CAAC,GAAG,EAAE,GAAG,EAAE,OAAO,CAAC,CAAC;QAC5B,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YAAC,SAAS,CAAC,GAAG,EAAE,GAAG,CAAC,CAAC;QAAC,CAAC;IACxC,CAAC,CAAC,CAAC;IACH,GAAG,CAAC,IAAI,CAAC,mBAAmB,EAAE,CAAC,GAAG,EAAE,GAAG,EAAE,EAAE;QACzC,IAAI,CAAC;YACH,MAAM,OAAO,GAAG,qBAAqB,CAAC,GAAG,CAAC,IAAI,IAAI,EAAE,CAAC,CAAC;YACtD,cAAc,CAAC,GAAG,EAAE,GAAG,EAAE,mBAAmB,EAAE,OAAO,CAAC,CAAC;YACvD,MAAM,CAAC,GAAG,EAAE,GAAG,EAAE,OAAO,CAAC,CAAC;QAC5B,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YAAC,SAAS,CAAC,GAAG,EAAE,GAAG,CAAC,CAAC;QAAC,CAAC;IACxC,CAAC,CAAC,CAAC;IACH,GAAG,CAAC,IAAI,CAAC,eAAe,EAAE,CAAC,GAAG,EAAE,GAAG,EAAE,EAAE;QACrC,IAAI,CAAC;YACH,MAAM,OAAO,GAAG,iBAAiB,CAAC,GAAG,CAAC,IAAI,IAAI,EAAE,CAAC,CAAC;YAClD,cAAc,CAAC,GAAG,EAAE,GAAG,EAAE,eAAe,EAAE,OAAO,CAAC,CAAC;YACnD,MAAM,CAAC,GAAG,EAAE,GAAG,EAAE,OAAO,CAAC,CAAC;QAC5B,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YAAC,SAAS,CAAC,GAAG,EAAE,GAAG,CAAC,CAAC;QAAC,CAAC;IACxC,CAAC,CAAC,CAAC;IAEH,2EAA2E;IAC3E,GAAG,CAAC,IAAI,CAAC,cAAc,EAAE,KAAK,EAAE,GAAG,EAAE,GAAG,EAAE,EAAE;QAC1C,IAAI,CAAC;YACH,MAAM,OAAO,GAAG,MAAM,gBAAgB,CAAC,GAAG,CAAC,IAAI,IAAI,EAAE,EAAE,WAAW,EAAE,eAAe,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC,CAAC;YAC/F,cAAc,CAAC,GAAG,EAAE,GAAG,EAAE,cAAc,EAAE,OAAO,CAAC,CAAC;YAClD,MAAM,CAAC,GAAG,EAAE,GAAG,EAAE,OAAO,CAAC,CAAC;QAC5B,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YAAC,SAAS,CAAC,GAAG,EAAE,GAAG,CAAC,CAAC;QAAC,CAAC;IACxC,CAAC,CAAC,CAAC;IACH,GAAG,CAAC,IAAI,CAAC,kBAAkB,EAAE,KAAK,EAAE,GAAG,EAAE,GAAG,EAAE,EAAE;QAC9C,IAAI,CAAC;YACH,MAAM,OAAO,GAAG,MAAM,mBAAmB,CAAC,GAAG,CAAC,IAAI,IAAI,EAAE,EAAE,WAAW,EAAE,eAAe,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC,CAAC;YAClG,cAAc,CAAC,GAAG,EAAE,GAAG,EAAE,kBAAkB,EAAE,OAAO,CAAC,CAAC;YACtD,MAAM,CAAC,GAAG,EAAE,GAAG,EAAE,OAAO,CAAC,CAAC;QAC5B,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YAAC,SAAS,CAAC,GAAG,EAAE,GAAG,CAAC,CAAC;QAAC,CAAC;IACxC,CAAC,CAAC,CAAC;IAEH,8EAA8E;IAC9E,GAAG,CAAC,IAAI,CAAC,aAAa,EAAE,KAAK,EAAE,GAAG,EAAE,GAAG,EAAE,EAAE;QACzC,IAAI,CAAC;YACH,MAAM,OAAO,GAAG,MAAM,eAAe,CAAC,GAAG,CAAC,IAAI,IAAI,EAAE,EAAE,WAAW,EAAE,eAAe,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC,CAAC;YAC9F,cAAc,CAAC,GAAG,EAAE,GAAG,EAAE,aAAa,EAAE,OAAO,CAAC,CAAC;YACjD,MAAM,CAAC,GAAG,EAAE,GAAG,EAAE,OAAO,CAAC,CAAC;QAC5B,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YAAC,SAAS,CAAC,GAAG,EAAE,GAAG,CAAC,CAAC;QAAC,CAAC;IACxC,CAAC,CAAC,CAAC;IAEH,6EAA6E;IAC7E,sFAAsF;IACtF,+FAA+F;IAC/F,GAAG,CAAC,IAAI,CAAC,iBAAiB,EAAE,KAAK,EAAE,GAAG,EAAE,GAAG,EAAE,EAAE;QAC7C,IAAI,CAAC;YACH,MAAM,OAAO,GAAG,MAAM,mBAAmB,CAAC,GAAG,CAAC,IAAI,IAAI,EAAE,EAAE,WAAW,EAAE,eAAe,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC,CAAC;YAClG,cAAc,CAAC,GAAG,EAAE,GAAG,EAAE,iBAAiB,EAAE,OAAO,CAAC,CAAC;YACrD,MAAM,CAAC,GAAG,EAAE,GAAG,EAAE,OAAO,CAAC,CAAC;QAC5B,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YAAC,SAAS,CAAC,GAAG,EAAE,GAAG,CAAC,CAAC;QAAC,CAAC;IACxC,CAAC,CAAC,CAAC;IAEH,2BAA2B;IAC3B,GAAG,CAAC,IAAI,CAAC,mBAAmB,EAAE,KAAK,EAAE,GAAG,EAAE,GAAG,EAAE,EAAE;QAC/C,IAAI,CAAC;YACH,IAAI,CAAC,WAAW,CAAC,GAAG,CAAC;gBAAE,OAAO,aAAa,CAAC,GAAG,CAAC,CAAC;YACjD,MAAM,OAAO,GAAG,MAAM,qBAAqB,CAAC,GAAG,CAAC,IAAI,IAAI,EAAE,CAAC,CAAC;YAC5D,cAAc,CAAC,GAAG,EAAE,GAAG,EAAE,mBAAmB,EAAE,OAAO,CAAC,CAAC;YACvD,MAAM,CAAC,GAAG,EAAE,GAAG,EAAE,OAAO,CAAC,CAAC;QAC5B,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YAAC,SAAS,CAAC,GAAG,EAAE,GAAG,CAAC,CAAC;QAAC,CAAC;IACxC,CAAC,CAAC,CAAC;IAEH,GAAG,CAAC,GAAG,CAAC,sBAAsB,EAAE,KAAK,EAAE,GAAG,EAAE,GAAG,EAAE,EAAE;QACjD,IAAI,CAAC;YACH,MAAM,OAAO,GAAG,MAAM,mCAAmC,CAAC,GAAG,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC;YAC7E,MAAM,CAAC,GAAG,EAAE,GAAG,EAAE,OAAO,CAAC,CAAC;QAC5B,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YAAC,SAAS,CAAC,GAAG,EAAE,GAAG,CAAC,CAAC;QAAC,CAAC;IACxC,CAAC,CAAC,CAAC;IAEH,GAAG,CAAC,GAAG,CAAC,iBAAiB,EAAE,CAAC,GAAG,EAAE,GAAG,EAAE,EAAE;QACtC,IAAI,CAAC;YAAC,MAAM,CAAC,GAAG,EAAE,GAAG,EAAE,mBAAmB,EAAE,CAAC,CAAC;QAAC,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YAAC,SAAS,CAAC,GAAG,EAAE,GAAG,CAAC,CAAC;QAAC,CAAC;IACvF,CAAC,CAAC,CAAC;IAEH,GAAG,CAAC,GAAG,CAAC,kBAAkB,EAAE,KAAK,EAAE,GAAG,EAAE,GAAG,EAAE,EAAE;QAC7C,IAAI,CAAC;YAAC,MAAM,CAAC,GAAG,EAAE,GAAG,EAAE,MAAM,yBAAyB,EAAE,CAAC,CAAC;QAAC,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YAAC,SAAS,CAAC,GAAG,EAAE,GAAG,CAAC,CAAC;QAAC,CAAC;IACnG,CAAC,CAAC,CAAC;IAEH,GAAG,CAAC,GAAG,CAAC,sBAAsB,EAAE,KAAK,EAAE,GAAG,EAAE,GAAG,EAAE,EAAE;QACjD,IAAI,CAAC;YAAC,MAAM,CAAC,GAAG,EAAE,GAAG,EAAE,MAAM,qBAAqB,CAAC,GAAG,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC,CAAC;QAAC,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YAAC,SAAS,CAAC,GAAG,EAAE,GAAG,CAAC,CAAC;QAAC,CAAC;IACjH,CAAC,CAAC,CAAC;IAEH,iEAAiE;IACjE,GAAG,CAAC,GAAG,CAAC,mBAAmB,EAAE,CAAC,GAAG,EAAE,GAAG,EAAE,EAAE;QACxC,IAAI,CAAC;YAAC,MAAM,CAAC,GAAG,EAAE,GAAG,EAAE,qBAAqB,EAAE,CAAC,CAAC;QAAC,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YAAC,SAAS,CAAC,GAAG,EAAE,GAAG,CAAC,CAAC;QAAC,CAAC;IACzF,CAAC,CAAC,CAAC;IACH,GAAG,CAAC,GAAG,CAAC,kBAAkB,EAAE,CAAC,GAAG,EAAE,GAAG,EAAE,EAAE;QACvC,IAAI,CAAC;YAAC,MAAM,CAAC,GAAG,EAAE,GAAG,EAAE,oBAAoB,CAAC,GAAG,CAAC,KAAK,CAAC,CAAC,CAAC;QAAC,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YAAC,SAAS,CAAC,GAAG,EAAE,GAAG,CAAC,CAAC;QAAC,CAAC;IACjG,CAAC,CAAC,CAAC;IACH,GAAG,CAAC,GAAG,CAAC,iBAAiB,EAAE,CAAC,GAAG,EAAE,GAAG,EAAE,EAAE;QACtC,IAAI,CAAC;YAAC,MAAM,CAAC,GAAG,EAAE,GAAG,EAAE,mBAAmB,EAAE,CAAC,CAAC;QAAC,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YAAC,SAAS,CAAC,GAAG,EAAE,GAAG,CAAC,CAAC;QAAC,CAAC;IACvF,CAAC,CAAC,CAAC;IAEH,yEAAyE;IACzE,GAAG,CAAC,GAAG,CAAC,QAAQ,EAAE,CAAC,GAAG,EAAE,GAAG,EAAE,EAAE;QAC7B,IAAI,CAAC;YAAC,MAAM,CAAC,GAAG,EAAE,GAAG,EAAE,eAAe,EAAE,CAAC,CAAC;QAAC,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YAAC,SAAS,CAAC,GAAG,EAAE,GAAG,CAAC,CAAC;QAAC,CAAC;IACnF,CAAC,CAAC,CAAC;IACH,GAAG,CAAC,IAAI,CAAC,kBAAkB,EAAE,KAAK,EAAE,GAAG,EAAE,GAAG,EAAE,EAAE;QAC9C,IAAI,CAAC;YACH,2FAA2F;YAC3F,IAAI,WAAW,CAAC,GAAG,CAAC,MAAM,CAAC,QAAQ,CAAC,IAAI,CAAC,WAAW,CAAC,GAAG,CAAC;gBAAE,OAAO,aAAa,CAAC,GAAG,CAAC,CAAC;YACrF,MAAM,OAAO,GAAG,MAAM,gBAAgB,CAAC,GAAG,CAAC,MAAM,CAAC,QAAQ,EAAE,GAAG,CAAC,IAAI,IAAI,EAAE,CAAC,CAAC;YAC5E,GAAG,CAAC,MAAM,CAAC,OAAO,CAAC,OAAO,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC;QACxD,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YAAC,SAAS,CAAC,GAAG,EAAE,GAAG,CAAC,CAAC;QAAC,CAAC;IACxC,CAAC,CAAC,CAAC;IAEH,yEAAyE;IACzE,oFAAoF;IACpF,uFAAuF;IACvF,sFAAsF;IACtF,MAAM,QAAQ,GAAG,aAAa,EAAE,CAAC;IACjC,QAAQ,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC;IACtB,kBAAkB,CAAC,GAAG,CAAC,CAAC;IAExB,yEAAyE;IACzE,GAAG,CAAC,GAAG,CAAC,CAAC,GAAG,EAAE,GAAG,EAAE,EAAE;QACnB,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,YAAY,CAAC,GAAG,CAAC,MAAM,EAAE,GAAG,CAAC,IAAI,CAAC,CAAC,CAAC;IAC3D,CAAC,CAAC,CAAC;IAEH,8EAA8E;IAC9E,6EAA6E;IAC7E,wEAAwE;IACxE,GAAG,CAAC,GAAG,CAAC,CAAC,GAAY,EAAE,IAAqB,EAAE,GAAqB,EAAE,IAA0B,EAAE,EAAE;QACjG,IAAI,GAAG,CAAC,WAAW;YAAE,OAAO,IAAI,CAAC,GAAG,CAAC,CAAC;QACtC,MAAM,EAAE,MAAM,EAAE,IAAI,EAAE,GAAG,iBAAiB,CAAC,GAAG,EAAE,EAAE,UAAU,EAAE,IAAI,EAAE,CAAC,CAAC;QACtE,GAAG,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;IAChC,CAAC,CAAC,CAAC;IAEH,OAAO,GAAG,CAAC;AACb,CAAC;AAED,yEAAyE;AACzE,MAAM,UAAU,WAAW;IACzB,sFAAsF;IACtF,uBAAuB,EAAE,CAAC;IAC1B,MAAM,GAAG,GAAG,iBAAiB,EAAE,CAAC;IAChC,MAAM,IAAI,GAAG,WAAW,EAAE,CAAC;IAC3B,GAAG,CAAC,MAAM,CAAC,IAAI,EAAE,SAAS,EAAE,GAAG,EAAE;QAC/B,MAAM,OAAO,GAAG,gBAAgB,EAAE,CAAC;QACnC,OAAO,CAAC,GAAG,CAAC,4CAA4C,SAAS,IAAI,IAAI,EAAE,CAAC,CAAC;QAC7E,OAAO,CAAC,GAAG,CAAC,sBAAsB,OAAO,CAAC,KAAK,aAAa,OAAO,CAAC,OAAO,KAAK,OAAO,CAAC,WAAW,GAAG,CAAC,CAAC;QACxG,OAAO,CAAC,GAAG,CAAC,qGAAqG,CAAC,CAAC;QACnH,OAAO,CAAC,GAAG,CAAC,gPAAgP,CAAC,CAAC;QAC9P,OAAO,CAAC,GAAG,CAAC,6GAA6G,CAAC,CAAC;IAC7H,CAAC,CAAC,CAAC;AACL,CAAC;AAED,wFAAwF;AACxF,MAAM,eAAe,GACnB,OAAO,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,IAAI,MAAM,CAAC,IAAI,CAAC,GAAG,KAAK,aAAa,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC;AACtF,IAAI,eAAe;IAAE,WAAW,EAAE,CAAC"}