safehands-pharos 1.5.0 → 2.8.0

package/dist/lib/analysis/calldata.js

@@ -0,0 +1,464 @@
+// ─── Calldata Decoder (read-only, offline) ─────────────────────────────
+// A canonical superset decoder for the common pre-sign risk selectors that a
+// wallet drainer relies on: ERC-2612 permit, Permit2 approve, setApprovalForAll,
+// transferFrom/transfer, increase/decreaseAllowance, plus a NON-EXHAUSTIVE
+// dangerous-admin selector dictionary (ownership/upgrade/admin). ERC-20 approve
+// (0x095ea7b3) is delegated to analyzeApproval so its behavior/tests stay the
+// single source of truth. Pure: no RPC, no keys, no network, no signer. Never
+// approves, signs, transfers, or sends. This analyzer is a SUB-SIGNAL only — the
+// final verdict is the guardian aggregation (worstDecision), which can only be
+// held or escalated by this decoder, never relaxed.
+// ────────────────────────────────────────────────────────────────────────
+import { decodeFunctionData, getAddress, isAddress } from "viem";
+import { isUnlimitedApprovalAmount } from "../policy/actionPolicyEngine.js";
+import { CHAIN_ID } from "../constants.js";
+import { addressTrustEvidence } from "../ecosystemRegistry.js";
+import { isDenylistedRecipient } from "../recipientSafety.js";
+import { analyzeApproval, APPROVE_SELECTOR } from "./approval.js";
+import { canonicalContractEvidence } from "./contractIntel.js";
+import { tokenRegistryEvidence } from "./pharosTokens.js";
+import { makeResult } from "./types.js";
+import { addressAtWord, calldataBody, calldataWordCount, hasExactWords } from "./abiWords.js";
+// ── Selector constants ─────────────────────────────────────────────────
+export const PERMIT_SELECTOR = "0xd505accf"; // ERC-2612 permit(owner,spender,value,deadline,v,r,s)
+export const PERMIT2_APPROVE_SELECTOR = "0x87517c45"; // Permit2 approve(token,spender,amount,expiration)
+export const SET_APPROVAL_FOR_ALL_SELECTOR = "0xa22cb465"; // setApprovalForAll(operator,approved)
+export const TRANSFER_FROM_SELECTOR = "0x23b872dd"; // transferFrom(from,to,amount)
+export const TRANSFER_SELECTOR = "0xa9059cbb"; // transfer(to,amount)
+export const INCREASE_ALLOWANCE_SELECTOR = "0x39509351"; // increaseAllowance(spender,addedValue)
+export const DECREASE_ALLOWANCE_SELECTOR = "0xa457c2d7"; // decreaseAllowance(spender,subtractedValue)
+// Dangerous / admin selectors — recognition & labeling only, NON-EXHAUSTIVE.
+export const TRANSFER_OWNERSHIP_SELECTOR = "0xf2fde38b"; // transferOwnership(newOwner)
+export const RENOUNCE_OWNERSHIP_SELECTOR = "0x715018a6"; // renounceOwnership()
+export const UPGRADE_TO_SELECTOR = "0x3659cfe6"; // upgradeTo(newImplementation)
+export const UPGRADE_TO_AND_CALL_SELECTOR = "0x4f1ef286"; // upgradeToAndCall(newImplementation,data)
+export const CHANGE_ADMIN_SELECTOR = "0x8f283970"; // changeAdmin(newAdmin)
+/** Canonical Permit2 singleton (lowercased). */
+const PERMIT2_ADDRESS = "0x000000000022d473030f116ddee9f6b43ac78ba3";
+/** Permit2 amounts are uint160; type(uint160).max means "infinite". */
+const PERMIT2_MAX_AMOUNT = (1n << 160n) - 1n;
+/**
+ * Selectors this analyzer decodes on its own (i.e. everything EXCEPT approve,
+ * which analyzeApproval owns, and MultiSend, which analyzeSafeTx owns). The
+ * guardian dispatch uses this to decide when to add the calldata analyzer.
+ */
+export const DECODABLE_CALLDATA_SELECTORS = new Set([
+    PERMIT_SELECTOR,
+    PERMIT2_APPROVE_SELECTOR,
+    SET_APPROVAL_FOR_ALL_SELECTOR,
+    TRANSFER_FROM_SELECTOR,
+    TRANSFER_SELECTOR,
+    INCREASE_ALLOWANCE_SELECTOR,
+    DECREASE_ALLOWANCE_SELECTOR,
+    TRANSFER_OWNERSHIP_SELECTOR,
+    RENOUNCE_OWNERSHIP_SELECTOR,
+    UPGRADE_TO_SELECTOR,
+    UPGRADE_TO_AND_CALL_SELECTOR,
+    CHANGE_ADMIN_SELECTOR,
+]);
+/** True when `analyzeCalldata` can decode this selector (approve delegates in-analyzer). */
+export function isDecodableCalldataSelector(selector) {
+    if (!selector)
+        return false;
+    return selector === APPROVE_SELECTOR || DECODABLE_CALLDATA_SELECTORS.has(selector);
+}
+// ── ABI fragments per selector ─────────────────────────────────────────
+const ABIS = {
+    [PERMIT_SELECTOR]: [{ name: "permit", type: "function", stateMutability: "nonpayable", inputs: [
+                { name: "owner", type: "address" }, { name: "spender", type: "address" }, { name: "value", type: "uint256" },
+                { name: "deadline", type: "uint256" }, { name: "v", type: "uint8" }, { name: "r", type: "bytes32" }, { name: "s", type: "bytes32" }
+            ], outputs: [] }],
+    [PERMIT2_APPROVE_SELECTOR]: [{ name: "approve", type: "function", stateMutability: "nonpayable", inputs: [
+                { name: "token", type: "address" }, { name: "spender", type: "address" }, { name: "amount", type: "uint160" }, { name: "expiration", type: "uint48" }
+            ], outputs: [] }],
+    [SET_APPROVAL_FOR_ALL_SELECTOR]: [{ name: "setApprovalForAll", type: "function", stateMutability: "nonpayable", inputs: [
+                { name: "operator", type: "address" }, { name: "approved", type: "bool" }
+            ], outputs: [] }],
+    [TRANSFER_FROM_SELECTOR]: [{ name: "transferFrom", type: "function", stateMutability: "nonpayable", inputs: [
+                { name: "from", type: "address" }, { name: "to", type: "address" }, { name: "amount", type: "uint256" }
+            ], outputs: [{ type: "bool" }] }],
+    [TRANSFER_SELECTOR]: [{ name: "transfer", type: "function", stateMutability: "nonpayable", inputs: [
+                { name: "to", type: "address" }, { name: "amount", type: "uint256" }
+            ], outputs: [{ type: "bool" }] }],
+    [INCREASE_ALLOWANCE_SELECTOR]: [{ name: "increaseAllowance", type: "function", stateMutability: "nonpayable", inputs: [
+                { name: "spender", type: "address" }, { name: "addedValue", type: "uint256" }
+            ], outputs: [{ type: "bool" }] }],
+    [DECREASE_ALLOWANCE_SELECTOR]: [{ name: "decreaseAllowance", type: "function", stateMutability: "nonpayable", inputs: [
+                { name: "spender", type: "address" }, { name: "subtractedValue", type: "uint256" }
+            ], outputs: [{ type: "bool" }] }],
+    [TRANSFER_OWNERSHIP_SELECTOR]: [{ name: "transferOwnership", type: "function", stateMutability: "nonpayable", inputs: [{ name: "newOwner", type: "address" }], outputs: [] }],
+    [RENOUNCE_OWNERSHIP_SELECTOR]: [{ name: "renounceOwnership", type: "function", stateMutability: "nonpayable", inputs: [], outputs: [] }],
+    [UPGRADE_TO_SELECTOR]: [{ name: "upgradeTo", type: "function", stateMutability: "nonpayable", inputs: [{ name: "newImplementation", type: "address" }], outputs: [] }],
+    [UPGRADE_TO_AND_CALL_SELECTOR]: [{ name: "upgradeToAndCall", type: "function", stateMutability: "payable", inputs: [{ name: "newImplementation", type: "address" }, { name: "data", type: "bytes" }], outputs: [] }],
+    [CHANGE_ADMIN_SELECTOR]: [{ name: "changeAdmin", type: "function", stateMutability: "nonpayable", inputs: [{ name: "newAdmin", type: "address" }], outputs: [] }],
+};
+/**
+ * Exact payload shape per selector, mirroring the hosted engine's per-method
+ * word-count checks. `words: null` marks a dynamic payload (upgradeToAndCall
+ * carries `bytes`), where only a minimum head is required.
+ */
+const CALLDATA_SHAPE = {
+    [PERMIT_SELECTOR]: { words: 7 },
+    [PERMIT2_APPROVE_SELECTOR]: { words: 4 },
+    [SET_APPROVAL_FOR_ALL_SELECTOR]: { words: 2 },
+    [TRANSFER_FROM_SELECTOR]: { words: 3 },
+    [TRANSFER_SELECTOR]: { words: 2 },
+    [INCREASE_ALLOWANCE_SELECTOR]: { words: 2 },
+    [DECREASE_ALLOWANCE_SELECTOR]: { words: 2 },
+    [TRANSFER_OWNERSHIP_SELECTOR]: { words: 1 },
+    [RENOUNCE_OWNERSHIP_SELECTOR]: { words: 0 },
+    [UPGRADE_TO_SELECTOR]: { words: 1 },
+    [CHANGE_ADMIN_SELECTOR]: { words: 1 },
+    [UPGRADE_TO_AND_CALL_SELECTOR]: { words: null },
+};
+const DANGEROUS_LABELS = {
+    [TRANSFER_OWNERSHIP_SELECTOR]: "transfers contract ownership",
+    [RENOUNCE_OWNERSHIP_SELECTOR]: "renounces contract ownership (irreversible)",
+    [UPGRADE_TO_SELECTOR]: "upgrades the contract implementation (proxy)",
+    [UPGRADE_TO_AND_CALL_SELECTOR]: "upgrades the contract implementation and calls into it (proxy)",
+    [CHANGE_ADMIN_SELECTOR]: "changes the proxy admin",
+};
+const EMPTY_DETAILS = {
+    method: null, selector: null, category: "unknown", token: null, spender: null, operator: null,
+    recipient: null, from: null, amountRaw: null, unlimited: false, isRevoke: false, approved: null,
+    counterpartyKnown: false, counterpartyLabel: null, recipientDenylisted: false, dangerous: false,
+    canonicalContractEvidence: null, tokenRegistryEvidence: null,
+};
+/**
+ * Recognize a spender/operator — registry-driven only. "known" requires canonical
+ * metadata or a VERIFIED allow_eligible registry contract on the active chain.
+ * Non-verified registry matches yield a label suffixed "recognition only" and
+ * NEVER set known (the former hardcoded DODO/FaroSwap entries relaxed risk with
+ * testnet-provenance addresses and are gone).
+ */
+function classifyKnown(addr) {
+    const canonical = isAddress(addr) ? canonicalContractEvidence(addr) : null;
+    if (canonical)
+        return { known: true, label: canonical.name, canonical };
+    const lower = addr.toLowerCase();
+    if (lower === PERMIT2_ADDRESS)
+        return { known: true, label: "Permit2", canonical: null };
+    const registry = isAddress(addr) ? addressTrustEvidence(addr, CHAIN_ID) : null;
+    if (registry?.verifiedCanonical) {
+        return { known: true, label: registry.contractLabel ?? registry.itemName, canonical: null };
+    }
+    if (registry?.recognized) {
+        return { known: false, label: `${registry.contractLabel} (${registry.verificationStatus}, recognition only)`, canonical: null };
+    }
+    return { known: false, label: null, canonical: null };
+}
+/** Shared approve-style risk matrix (approve/permit/permit2/increaseAllowance). */
+function approvalRisk(spender, isRevoke, unlimited, known, label) {
+    if (!isAddress(spender))
+        return { decision: "BLOCK", risk: "CRITICAL", reason: "Spender address is invalid." };
+    if (isRevoke)
+        return { decision: "ALLOW", risk: "LOW", reason: `Zero/revoke: clearing the allowance for ${spender}${label ? ` (${label})` : ""}.` };
+    if (unlimited && !known)
+        return { decision: "BLOCK", risk: "CRITICAL", reason: `Unlimited approval to an unknown spender (${spender}); blocked.` };
+    if (unlimited && known)
+        return { decision: "REQUIRE_CONFIRMATION", risk: "HIGH", reason: `Unlimited approval to a known spender (${label}); high risk, confirm intent.` };
+    if (!known)
+        return { decision: "REQUIRE_CONFIRMATION", risk: "MEDIUM", reason: `Approval to an unknown spender (${spender}); confirm before approving.` };
+    return { decision: "ALLOW", risk: "LOW", reason: `Limited approval to a known spender (${label}).` };
+}
+function result(params) {
+    return makeResult({
+        analyzer: "calldata",
+        decision: params.decision,
+        internalDecision: params.decision,
+        riskLevel: params.risk,
+        reasons: params.reasons,
+        warnings: params.warnings,
+        analyzerStatus: params.status,
+        experimental: params.experimental,
+        details: params.details,
+    });
+}
+/**
+ * Decode and risk-classify a single calldata payload.
+ * @param data  0x-prefixed calldata
+ * @param token optional token contract address the call targets (for metadata + Permit2 token)
+ */
+export function analyzeCalldata(data, token) {
+    const hex = (data?.startsWith("0x") ? data : `0x${data ?? ""}`).toLowerCase();
+    const selector = hex.length >= 10 ? hex.slice(0, 10) : null;
+    const tokenEvidence = token ? tokenRegistryEvidence(token) : null;
+    // ERC-20 approve is owned by analyzeApproval — delegate and adapt its result.
+    if (selector === APPROVE_SELECTOR) {
+        const a = analyzeApproval(data, token);
+        const d = a.details;
+        return result({
+            decision: a.internalDecision ?? "REQUIRE_CONFIRMATION",
+            risk: a.riskLevel,
+            reasons: a.reasons,
+            warnings: a.warnings,
+            status: a.analyzerStatus,
+            experimental: a.experimental,
+            details: {
+                ...EMPTY_DETAILS, method: "approve", selector, category: "approval", token: d.token,
+                spender: d.spender, amountRaw: d.amountRaw, unlimited: d.unlimited, isRevoke: d.isRevoke,
+                counterpartyKnown: d.spenderKnown, counterpartyLabel: d.spenderLabel,
+                canonicalContractEvidence: d.canonicalContractEvidence, tokenRegistryEvidence: d.tokenRegistryEvidence,
+            },
+        });
+    }
+    if (!selector || !DECODABLE_CALLDATA_SELECTORS.has(selector)) {
+        return result({
+            decision: "REQUIRE_CONFIRMATION", risk: "UNKNOWN",
+            reasons: [`Calldata selector ${selector ?? "n/a"} is not a recognized decodable method; confirm before signing.`],
+            warnings: [], status: "unavailable", details: { ...EMPTY_DETAILS, selector },
+        });
+    }
+    const malformedPayload = () => result({
+        decision: "REQUIRE_CONFIRMATION", risk: "MEDIUM",
+        reasons: ["Calldata matched a known selector but could not be decoded: malformed payload."],
+        warnings: ["Malformed calldata for the recognized selector."],
+        status: "partial", details: { ...EMPTY_DETAILS, selector },
+    });
+    // Validate the payload shape before decoding. viem mirrors what the EVM will
+    // accept (it masks dirty address padding and tolerates trailing bytes), which
+    // would report a clean spender for calldata solc's own decoder reverts on.
+    // The hosted engine refuses those payloads, so this side must too.
+    const body = calldataBody(hex);
+    const shape = CALLDATA_SHAPE[selector];
+    // `body` is "" for a zero-argument selector such as renounceOwnership, which
+    // is a valid payload: test for null, never for falsiness.
+    if (body === null || !shape)
+        return malformedPayload();
+    if (shape.words === null ? calldataWordCount(body) < 3 : !hasExactWords(body, shape.words)) {
+        return malformedPayload();
+    }
+    let args;
+    try {
+        const decoded = decodeFunctionData({ abi: ABIS[selector], data: hex });
+        args = (decoded.args ?? []);
+    }
+    catch {
+        return malformedPayload();
+    }
+    const base = { ...EMPTY_DETAILS, selector, token: token ?? null, tokenRegistryEvidence: tokenEvidence };
+    /** Address at `index`, or null when the word is not cleanly padded. */
+    const strictAddress = (index) => addressAtWord(body, index);
+    /**
+     * A dirty address word is a hard stop, but everything the payload *does*
+     * encode cleanly is still reported: only the untrustworthy address is
+     * withheld, never the amount or the method.
+     */
+    const deceptiveWord = (field, known) => result({
+        decision: "BLOCK", risk: "CRITICAL",
+        reasons: [`${field} word is not a clean address: malformed or deceptive calldata.`],
+        warnings: ["The address word carries dirty upper padding. Standard decoders revert on this; it is never a normal call."],
+        status: "ok", details: { ...base, ...known },
+    });
+    /** Amount word read directly, so it survives a rejected address word. */
+    const amountAtWord = (index) => BigInt(`0x${body.slice(index * 64, (index + 1) * 64) || "0"}`);
+    switch (selector) {
+        case PERMIT_SELECTOR: {
+            const spenderWord = strictAddress(1);
+            const value = amountAtWord(2);
+            if (!spenderWord) {
+                return deceptiveWord("permit spender", {
+                    method: "permit", category: "approval", amountRaw: value.toString(),
+                    unlimited: isUnlimitedApprovalAmount(value.toString()), isRevoke: value === 0n,
+                });
+            }
+            const spender = getAddress(spenderWord);
+            const unlimited = isUnlimitedApprovalAmount(value.toString());
+            const isRevoke = value === 0n;
+            const { known, label, canonical } = classifyKnown(spender);
+            const r = approvalRisk(spender, isRevoke, unlimited, known, label);
+            return result({
+                decision: r.decision, risk: r.risk, reasons: [r.reason],
+                warnings: ["ERC-2612 permit is a gasless, signature-based approval: the allowance is granted off-chain and can later authorize transfers."],
+                status: "ok",
+                details: { ...base, method: "permit", category: "approval", spender, amountRaw: value.toString(), unlimited, isRevoke, counterpartyKnown: known, counterpartyLabel: label, canonicalContractEvidence: canonical },
+            });
+        }
+        case PERMIT2_APPROVE_SELECTOR: {
+            // Only the spender word gates the verdict: a dirty token word grants no
+            // authority to anyone (the call reverts), which is why the hosted engine
+            // floors on the spender alone.
+            const tokenWord = strictAddress(0);
+            const spenderWord = strictAddress(1);
+            const amount = amountAtWord(2);
+            if (!spenderWord) {
+                return deceptiveWord("Permit2 approval spender", {
+                    method: "permit2_approve", category: "approval", token: tokenWord ?? (token ?? null),
+                    amountRaw: amount.toString(), unlimited: amount >= PERMIT2_MAX_AMOUNT, isRevoke: amount === 0n,
+                });
+            }
+            // A dirty token word falls back to the caller-supplied token, matching the
+            // hosted engine's `c.token = wordToAddress(...) || c.token`.
+            const permitToken = tokenWord ? getAddress(tokenWord) : (token ?? null);
+            const spender = getAddress(spenderWord);
+            const expiration = String(args[3]); // uint48 — viem decodes as number
+            const unlimited = amount >= PERMIT2_MAX_AMOUNT;
+            const isRevoke = amount === 0n;
+            const { known, label, canonical } = classifyKnown(spender);
+            const r = approvalRisk(spender, isRevoke, unlimited, known, label);
+            return result({
+                decision: r.decision, risk: r.risk,
+                reasons: [r.reason, `Permit2 approval for token ${permitToken}${expiration !== "0" ? ` (expiration ${expiration})` : ""}.`],
+                warnings: ["Permit2 approval: authorizes the spender to move the token via Permit2 (signature-driven). Deep PermitSingle/PermitBatch/permitTransferFrom decode is out of scope."],
+                status: "ok", experimental: true,
+                details: { ...base, method: "permit2_approve", category: "approval", token: permitToken, spender, amountRaw: amount.toString(), unlimited, isRevoke, counterpartyKnown: known, counterpartyLabel: label, canonicalContractEvidence: canonical, tokenRegistryEvidence: permitToken ? tokenRegistryEvidence(permitToken) : tokenEvidence },
+            });
+        }
+        case SET_APPROVAL_FOR_ALL_SELECTOR: {
+            const operatorWord = strictAddress(0);
+            const approved = args[1];
+            if (!operatorWord) {
+                return deceptiveWord("setApprovalForAll operator", { method: "setApprovalForAll", category: "approval", approved });
+            }
+            const operator = getAddress(operatorWord);
+            const { known, label, canonical } = classifyKnown(operator);
+            let decision;
+            let risk;
+            let reason;
+            if (!isAddress(operator)) {
+                decision = "BLOCK";
+                risk = "CRITICAL";
+                reason = "Operator address is invalid.";
+            }
+            else if (!approved) {
+                decision = "ALLOW";
+                risk = "LOW";
+                reason = `Revoking blanket operator approval for ${operator}${label ? ` (${label})` : ""}.`;
+            }
+            else if (!known) {
+                decision = "BLOCK";
+                risk = "CRITICAL";
+                reason = `Blanket collection approval (setApprovalForAll) to an UNKNOWN operator (${operator}); this authorizes transfer of every token in the collection. Blocked.`;
+            }
+            else {
+                decision = "REQUIRE_CONFIRMATION";
+                risk = "HIGH";
+                reason = `Blanket collection approval to a known operator (${label}); high risk, confirm intent.`;
+            }
+            return result({
+                decision, risk, reasons: [reason],
+                warnings: approved ? ["setApprovalForAll grants control over ALL tokens in the collection, a common NFT-drainer vector."] : [],
+                status: "ok",
+                details: { ...base, method: "setApprovalForAll", category: "approval", operator, approved, counterpartyKnown: known, counterpartyLabel: label, canonicalContractEvidence: canonical },
+            });
+        }
+        case TRANSFER_FROM_SELECTOR: {
+            const fromWord = strictAddress(0);
+            const toWord = strictAddress(1);
+            const amount = amountAtWord(2).toString();
+            const known = { method: "transferFrom", category: "transfer", from: fromWord, amountRaw: amount };
+            if (!fromWord)
+                return deceptiveWord("transferFrom source", known);
+            if (!toWord)
+                return deceptiveWord("transferFrom recipient", known);
+            return transferResult({ ...base, method: "transferFrom", from: getAddress(fromWord), recipient: getAddress(toWord), amountRaw: amount }, getAddress(toWord));
+        }
+        case TRANSFER_SELECTOR: {
+            const toWord = strictAddress(0);
+            const amount = amountAtWord(1).toString();
+            if (!toWord)
+                return deceptiveWord("transfer recipient", { method: "transfer", category: "transfer", amountRaw: amount });
+            const to = getAddress(toWord);
+            return transferResult({ ...base, method: "transfer", recipient: to, amountRaw: amount }, to);
+        }
+        case INCREASE_ALLOWANCE_SELECTOR: {
+            const spenderWord = strictAddress(0);
+            const added = amountAtWord(1);
+            if (!spenderWord) {
+                return deceptiveWord("increaseAllowance spender", {
+                    method: "increaseAllowance", category: "approval", amountRaw: added.toString(),
+                    unlimited: isUnlimitedApprovalAmount(added.toString()), isRevoke: added === 0n,
+                });
+            }
+            const spender = getAddress(spenderWord);
+            const unlimited = isUnlimitedApprovalAmount(added.toString());
+            const isRevoke = added === 0n;
+            const { known, label, canonical } = classifyKnown(spender);
+            const r = approvalRisk(spender, isRevoke, unlimited, known, label);
+            return result({
+                decision: r.decision, risk: r.risk, reasons: [`increaseAllowance: ${r.reason}`],
+                warnings: ["increaseAllowance raises an existing allowance on top of the current one."], status: "ok",
+                details: { ...base, method: "increaseAllowance", category: "approval", spender, amountRaw: added.toString(), unlimited, isRevoke, counterpartyKnown: known, counterpartyLabel: label, canonicalContractEvidence: canonical },
+            });
+        }
+        case DECREASE_ALLOWANCE_SELECTOR: {
+            const spenderWord = strictAddress(0);
+            const subtractedRaw = args[1].toString();
+            // Lowering an allowance creates no new exposure, so a dirty spender word
+            // is held for review rather than blocked (the hosted engine floors at 45,
+            // not 90). The decoded spender is still withheld: it was never clean.
+            if (!spenderWord) {
+                return result({
+                    decision: "REQUIRE_CONFIRMATION", risk: "MEDIUM",
+                    reasons: ["decreaseAllowance spender word is not a clean address: malformed calldata, held for review."],
+                    warnings: [], status: "partial",
+                    details: { ...base, method: "decreaseAllowance", category: "approval", amountRaw: subtractedRaw },
+                });
+            }
+            const spender = getAddress(spenderWord);
+            const subtracted = subtractedRaw;
+            const { known, label, canonical } = classifyKnown(spender);
+            return result({
+                decision: "ALLOW", risk: "LOW", reasons: [`decreaseAllowance: lowering the allowance for ${spender}${label ? ` (${label})` : ""}.`],
+                warnings: [], status: "ok",
+                details: { ...base, method: "decreaseAllowance", category: "approval", spender, amountRaw: subtracted, counterpartyKnown: known, counterpartyLabel: label, canonicalContractEvidence: canonical },
+            });
+        }
+        default:
+            // A dirty target word yields no target at all rather than a masked one;
+            // the verdict stays REQUIRE_CONFIRMATION either way (hosted floor 61).
+            return dangerousAdmin(selector, shape.words === 0 ? null : strictAddress(0), base);
+    }
+}
+/** transfer / transferFrom risk: denylist → BLOCK; otherwise REQUIRE_CONFIRMATION (never LOW — moving assets). */
+function transferResult(details, recipient) {
+    const label = details.method === "transferFrom" ? "transferFrom" : "transfer";
+    if (!isAddress(recipient)) {
+        return result({ decision: "BLOCK", risk: "CRITICAL", reasons: [`${label} recipient address is invalid.`], warnings: [], status: "ok", details: { ...details, category: "transfer" } });
+    }
+    if (isDenylistedRecipient(recipient)) {
+        return result({
+            decision: "BLOCK", risk: "CRITICAL",
+            reasons: [`${label} recipient ${recipient} is on the operator denylist; blocked.`],
+            warnings: [], status: "ok",
+            details: { ...details, category: "transfer", recipientDenylisted: true },
+        });
+    }
+    // Unknown / unverified recipient — a token transfer moves assets, so a pre-sign
+    // firewall must require confirmation. Never ALLOW/LOW for an unknown recipient.
+    return result({
+        decision: "REQUIRE_CONFIRMATION", risk: "MEDIUM",
+        reasons: [`${label} moves tokens to ${recipient}; recipient is not verified; confirm before signing.`],
+        warnings: [], status: "ok",
+        details: { ...details, category: "transfer" },
+    });
+}
+/** Non-exhaustive dangerous-admin dictionary — recognition/label only, always REQUIRE_CONFIRMATION. */
+function dangerousAdmin(selector, target, base) {
+    const label = DANGEROUS_LABELS[selector] ?? "performs a privileged/admin action";
+    const targetArg = target && isAddress(target) ? getAddress(target) : null;
+    // Recognition of the incoming owner/implementation is reported the same way
+    // the hosted engine reports it. It labels the target; it never relaxes the
+    // verdict, which stays REQUIRE_CONFIRMATION for every admin call.
+    const { known, label: targetLabel, canonical } = targetArg
+        ? classifyKnown(targetArg)
+        : { known: false, label: null, canonical: null };
+    const method = {
+        [TRANSFER_OWNERSHIP_SELECTOR]: "transferOwnership", [RENOUNCE_OWNERSHIP_SELECTOR]: "renounceOwnership",
+        [UPGRADE_TO_SELECTOR]: "upgradeTo", [UPGRADE_TO_AND_CALL_SELECTOR]: "upgradeToAndCall", [CHANGE_ADMIN_SELECTOR]: "changeAdmin",
+    }[selector] ?? null;
+    return result({
+        decision: "REQUIRE_CONFIRMATION", risk: "HIGH",
+        reasons: [`Dangerous/admin call: this transaction ${label}${targetArg ? ` (target ${targetArg})` : ""}; confirm this is intended.`],
+        warnings: ["Recognized as a privileged/admin function. This dangerous-selector list is NOT exhaustive; absence of a warning is not proof of safety."],
+        status: "ok",
+        // The target is the call's subject, not a recipient: an ownership or
+        // implementation target receives nothing, so it is reported as `spender`
+        // only, matching the hosted engine.
+        details: {
+            ...base, method, category: "admin", dangerous: true, spender: targetArg,
+            counterpartyKnown: known, counterpartyLabel: targetLabel, canonicalContractEvidence: canonical,
+        },
+    });
+}
+//# sourceMappingURL=calldata.js.map

package/dist/lib/analysis/calldata.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"calldata.js","sourceRoot":"","sources":["../../../src/lib/analysis/calldata.ts"],"names":[],"mappings":"AAAA,0EAA0E;AAC1E,6EAA6E;AAC7E,iFAAiF;AACjF,2EAA2E;AAC3E,gFAAgF;AAChF,8EAA8E;AAC9E,8EAA8E;AAC9E,iFAAiF;AACjF,+EAA+E;AAC/E,oDAAoD;AACpD,2EAA2E;AAE3E,OAAO,EAAE,kBAAkB,EAAE,UAAU,EAAE,SAAS,EAAE,MAAM,MAAM,CAAC;AACjE,OAAO,EAAE,yBAAyB,EAAE,MAAM,iCAAiC,CAAC;AAC5E,OAAO,EAAE,QAAQ,EAAE,MAAM,iBAAiB,CAAC;AAC3C,OAAO,EAAE,oBAAoB,EAAE,MAAM,yBAAyB,CAAC;AAC/D,OAAO,EAAE,qBAAqB,EAAE,MAAM,uBAAuB,CAAC;AAC9D,OAAO,EAAE,eAAe,EAAE,gBAAgB,EAAE,MAAM,eAAe,CAAC;AAClE,OAAO,EAAE,yBAAyB,EAAkC,MAAM,oBAAoB,CAAC;AAC/F,OAAO,EAAE,qBAAqB,EAA8B,MAAM,mBAAmB,CAAC;AACtF,OAAO,EAAE,UAAU,EAAuB,MAAM,YAAY,CAAC;AAC7D,OAAO,EAAE,aAAa,EAAE,YAAY,EAAE,iBAAiB,EAAE,aAAa,EAAE,MAAM,eAAe,CAAC;AAE9F,0EAA0E;AAC1E,MAAM,CAAC,MAAM,eAAe,GAAG,YAAY,CAAC,CAAC,sDAAsD;AACnG,MAAM,CAAC,MAAM,wBAAwB,GAAG,YAAY,CAAC,CAAC,mDAAmD;AACzG,MAAM,CAAC,MAAM,6BAA6B,GAAG,YAAY,CAAC,CAAC,uCAAuC;AAClG,MAAM,CAAC,MAAM,sBAAsB,GAAG,YAAY,CAAC,CAAC,+BAA+B;AACnF,MAAM,CAAC,MAAM,iBAAiB,GAAG,YAAY,CAAC,CAAC,sBAAsB;AACrE,MAAM,CAAC,MAAM,2BAA2B,GAAG,YAAY,CAAC,CAAC,wCAAwC;AACjG,MAAM,CAAC,MAAM,2BAA2B,GAAG,YAAY,CAAC,CAAC,6CAA6C;AAEtG,6EAA6E;AAC7E,MAAM,CAAC,MAAM,2BAA2B,GAAG,YAAY,CAAC,CAAC,8BAA8B;AACvF,MAAM,CAAC,MAAM,2BAA2B,GAAG,YAAY,CAAC,CAAC,sBAAsB;AAC/E,MAAM,CAAC,MAAM,mBAAmB,GAAG,YAAY,CAAC,CAAC,+BAA+B;AAChF,MAAM,CAAC,MAAM,4BAA4B,GAAG,YAAY,CAAC,CAAC,2CAA2C;AACrG,MAAM,CAAC,MAAM,qBAAqB,GAAG,YAAY,CAAC,CAAC,wBAAwB;AAE3E,gDAAgD;AAChD,MAAM,eAAe,GAAG,4CAA4C,CAAC;AACrE,uEAAuE;AACvE,MAAM,kBAAkB,GAAG,CAAC,EAAE,IAAI,IAAI,CAAC,GAAG,EAAE,CAAC;AAE7C;;;;GAIG;AACH,MAAM,CAAC,MAAM,4BAA4B,GAAwB,IAAI,GAAG,CAAC;IACvE,eAAe;IACf,wBAAwB;IACxB,6BAA6B;IAC7B,sBAAsB;IACtB,iBAAiB;IACjB,2BAA2B;IAC3B,2BAA2B;IAC3B,2BAA2B;IAC3B,2BAA2B;IAC3B,mBAAmB;IACnB,4BAA4B;IAC5B,qBAAqB;CACtB,CAAC,CAAC;AAEH,4FAA4F;AAC5F,MAAM,UAAU,2BAA2B,CAAC,QAAuB;IACjE,IAAI,CAAC,QAAQ;QAAE,OAAO,KAAK,CAAC;IAC5B,OAAO,QAAQ,KAAK,gBAAgB,IAAI,4BAA4B,CAAC,GAAG,CAAC,QAAQ,CAAC,CAAC;AACrF,CAAC;AAED,0EAA0E;AAC1E,MAAM,IAAI,GAAG;IACX,CAAC,eAAe,CAAC,EAAE,CAAC,EAAE,IAAI,EAAE,QAAQ,EAAE,IAAI,EAAE,UAAU,EAAE,eAAe,EAAE,YAAY,EAAE,MAAM,EAAE;gBAC7F,EAAE,IAAI,EAAE,OAAO,EAAE,IAAI,EAAE,SAAS,EAAE,EAAE,EAAE,IAAI,EAAE,SAAS,EAAE,IAAI,EAAE,SAAS,EAAE,EAAE,EAAE,IAAI,EAAE,OAAO,EAAE,IAAI,EAAE,SAAS,EAAE;gBAC5G,EAAE,IAAI,EAAE,UAAU,EAAE,IAAI,EAAE,SAAS,EAAE,EAAE,EAAE,IAAI,EAAE,GAAG,EAAE,IAAI,EAAE,OAAO,EAAE,EAAE,EAAE,IAAI,EAAE,GAAG,EAAE,IAAI,EAAE,SAAS,EAAE,EAAE,EAAE,IAAI,EAAE,GAAG,EAAE,IAAI,EAAE,SAAS,EAAE;aAAC,EAAE,OAAO,EAAE,EAAE,EAAE,CAAC;IACtJ,CAAC,wBAAwB,CAAC,EAAE,CAAC,EAAE,IAAI,EAAE,SAAS,EAAE,IAAI,EAAE,UAAU,EAAE,eAAe,EAAE,YAAY,EAAE,MAAM,EAAE;gBACvG,EAAE,IAAI,EAAE,OAAO,EAAE,IAAI,EAAE,SAAS,EAAE,EAAE,EAAE,IAAI,EAAE,SAAS,EAAE,IAAI,EAAE,SAAS,EAAE,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE,IAAI,EAAE,SAAS,EAAE,EAAE,EAAE,IAAI,EAAE,YAAY,EAAE,IAAI,EAAE,QAAQ,EAAE;aAAC,EAAE,OAAO,EAAE,EAAE,EAAE,CAAC;IACxK,CAAC,6BAA6B,CAAC,EAAE,CAAC,EAAE,IAAI,EAAE,mBAAmB,EAAE,IAAI,EAAE,UAAU,EAAE,eAAe,EAAE,YAAY,EAAE,MAAM,EAAE;gBACtH,EAAE,IAAI,EAAE,UAAU,EAAE,IAAI,EAAE,SAAS,EAAE,EAAE,EAAE,IAAI,EAAE,UAAU,EAAE,IAAI,EAAE,MAAM,EAAE;aAAC,EAAE,OAAO,EAAE,EAAE,EAAE,CAAC;IAC5F,CAAC,sBAAsB,CAAC,EAAE,CAAC,EAAE,IAAI,EAAE,cAAc,EAAE,IAAI,EAAE,UAAU,EAAE,eAAe,EAAE,YAAY,EAAE,MAAM,EAAE;gBAC1G,EAAE,IAAI,EAAE,MAAM,EAAE,IAAI,EAAE,SAAS,EAAE,EAAE,EAAE,IAAI,EAAE,IAAI,EAAE,IAAI,EAAE,SAAS,EAAE,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE,IAAI,EAAE,SAAS,EAAE;aAAC,EAAE,OAAO,EAAE,CAAC,EAAE,IAAI,EAAE,MAAM,EAAE,CAAC,EAAE,CAAC;IAC1I,CAAC,iBAAiB,CAAC,EAAE,CAAC,EAAE,IAAI,EAAE,UAAU,EAAE,IAAI,EAAE,UAAU,EAAE,eAAe,EAAE,YAAY,EAAE,MAAM,EAAE;gBACjG,EAAE,IAAI,EAAE,IAAI,EAAE,IAAI,EAAE,SAAS,EAAE,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE,IAAI,EAAE,SAAS,EAAE;aAAC,EAAE,OAAO,EAAE,CAAC,EAAE,IAAI,EAAE,MAAM,EAAE,CAAC,EAAE,CAAC;IACvG,CAAC,2BAA2B,CAAC,EAAE,CAAC,EAAE,IAAI,EAAE,mBAAmB,EAAE,IAAI,EAAE,UAAU,EAAE,eAAe,EAAE,YAAY,EAAE,MAAM,EAAE;gBACpH,EAAE,IAAI,EAAE,SAAS,EAAE,IAAI,EAAE,SAAS,EAAE,EAAE,EAAE,IAAI,EAAE,YAAY,EAAE,IAAI,EAAE,SAAS,EAAE;aAAC,EAAE,OAAO,EAAE,CAAC,EAAE,IAAI,EAAE,MAAM,EAAE,CAAC,EAAE,CAAC;IAChH,CAAC,2BAA2B,CAAC,EAAE,CAAC,EAAE,IAAI,EAAE,mBAAmB,EAAE,IAAI,EAAE,UAAU,EAAE,eAAe,EAAE,YAAY,EAAE,MAAM,EAAE;gBACpH,EAAE,IAAI,EAAE,SAAS,EAAE,IAAI,EAAE,SAAS,EAAE,EAAE,EAAE,IAAI,EAAE,iBAAiB,EAAE,IAAI,EAAE,SAAS,EAAE;aAAC,EAAE,OAAO,EAAE,CAAC,EAAE,IAAI,EAAE,MAAM,EAAE,CAAC,EAAE,CAAC;IACrH,CAAC,2BAA2B,CAAC,EAAE,CAAC,EAAE,IAAI,EAAE,mBAAmB,EAAE,IAAI,EAAE,UAAU,EAAE,eAAe,EAAE,YAAY,EAAE,MAAM,EAAE,CAAC,EAAE,IAAI,EAAE,UAAU,EAAE,IAAI,EAAE,SAAS,EAAE,CAAC,EAAE,OAAO,EAAE,EAAE,EAAE,CAAC;IAC7K,CAAC,2BAA2B,CAAC,EAAE,CAAC,EAAE,IAAI,EAAE,mBAAmB,EAAE,IAAI,EAAE,UAAU,EAAE,eAAe,EAAE,YAAY,EAAE,MAAM,EAAE,EAAE,EAAE,OAAO,EAAE,EAAE,EAAE,CAAC;IACxI,CAAC,mBAAmB,CAAC,EAAE,CAAC,EAAE,IAAI,EAAE,WAAW,EAAE,IAAI,EAAE,UAAU,EAAE,eAAe,EAAE,YAAY,EAAE,MAAM,EAAE,CAAC,EAAE,IAAI,EAAE,mBAAmB,EAAE,IAAI,EAAE,SAAS,EAAE,CAAC,EAAE,OAAO,EAAE,EAAE,EAAE,CAAC;IACtK,CAAC,4BAA4B,CAAC,EAAE,CAAC,EAAE,IAAI,EAAE,kBAAkB,EAAE,IAAI,EAAE,UAAU,EAAE,eAAe,EAAE,SAAS,EAAE,MAAM,EAAE,CAAC,EAAE,IAAI,EAAE,mBAAmB,EAAE,IAAI,EAAE,SAAS,EAAE,EAAE,EAAE,IAAI,EAAE,MAAM,EAAE,IAAI,EAAE,OAAO,EAAE,CAAC,EAAE,OAAO,EAAE,EAAE,EAAE,CAAC;IACpN,CAAC,qBAAqB,CAAC,EAAE,CAAC,EAAE,IAAI,EAAE,aAAa,EAAE,IAAI,EAAE,UAAU,EAAE,eAAe,EAAE,YAAY,EAAE,MAAM,EAAE,CAAC,EAAE,IAAI,EAAE,UAAU,EAAE,IAAI,EAAE,SAAS,EAAE,CAAC,EAAE,OAAO,EAAE,EAAE,EAAE,CAAC;CACzJ,CAAC;AAEX;;;;GAIG;AACH,MAAM,cAAc,GAA6C;IAC/D,CAAC,eAAe,CAAC,EAAE,EAAE,KAAK,EAAE,CAAC,EAAE;IAC/B,CAAC,wBAAwB,CAAC,EAAE,EAAE,KAAK,EAAE,CAAC,EAAE;IACxC,CAAC,6BAA6B,CAAC,EAAE,EAAE,KAAK,EAAE,CAAC,EAAE;IAC7C,CAAC,sBAAsB,CAAC,EAAE,EAAE,KAAK,EAAE,CAAC,EAAE;IACtC,CAAC,iBAAiB,CAAC,EAAE,EAAE,KAAK,EAAE,CAAC,EAAE;IACjC,CAAC,2BAA2B,CAAC,EAAE,EAAE,KAAK,EAAE,CAAC,EAAE;IAC3C,CAAC,2BAA2B,CAAC,EAAE,EAAE,KAAK,EAAE,CAAC,EAAE;IAC3C,CAAC,2BAA2B,CAAC,EAAE,EAAE,KAAK,EAAE,CAAC,EAAE;IAC3C,CAAC,2BAA2B,CAAC,EAAE,EAAE,KAAK,EAAE,CAAC,EAAE;IAC3C,CAAC,mBAAmB,CAAC,EAAE,EAAE,KAAK,EAAE,CAAC,EAAE;IACnC,CAAC,qBAAqB,CAAC,EAAE,EAAE,KAAK,EAAE,CAAC,EAAE;IACrC,CAAC,4BAA4B,CAAC,EAAE,EAAE,KAAK,EAAE,IAAI,EAAE;CAChD,CAAC;AAEF,MAAM,gBAAgB,GAA2B;IAC/C,CAAC,2BAA2B,CAAC,EAAE,8BAA8B;IAC7D,CAAC,2BAA2B,CAAC,EAAE,6CAA6C;IAC5E,CAAC,mBAAmB,CAAC,EAAE,8CAA8C;IACrE,CAAC,4BAA4B,CAAC,EAAE,gEAAgE;IAChG,CAAC,qBAAqB,CAAC,EAAE,yBAAyB;CACnD,CAAC;AAqCF,MAAM,aAAa,GAA4B;IAC7C,MAAM,EAAE,IAAI,EAAE,QAAQ,EAAE,IAAI,EAAE,QAAQ,EAAE,SAAS,EAAE,KAAK,EAAE,IAAI,EAAE,OAAO,EAAE,IAAI,EAAE,QAAQ,EAAE,IAAI;IAC7F,SAAS,EAAE,IAAI,EAAE,IAAI,EAAE,IAAI,EAAE,SAAS,EAAE,IAAI,EAAE,SAAS,EAAE,KAAK,EAAE,QAAQ,EAAE,KAAK,EAAE,QAAQ,EAAE,IAAI;IAC/F,iBAAiB,EAAE,KAAK,EAAE,iBAAiB,EAAE,IAAI,EAAE,mBAAmB,EAAE,KAAK,EAAE,SAAS,EAAE,KAAK;IAC/F,yBAAyB,EAAE,IAAI,EAAE,qBAAqB,EAAE,IAAI;CAC7D,CAAC;AAEF;;;;;;GAMG;AACH,SAAS,aAAa,CAAC,IAAY;IACjC,MAAM,SAAS,GAAG,SAAS,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,yBAAyB,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC;IAC3E,IAAI,SAAS;QAAE,OAAO,EAAE,KAAK,EAAE,IAAI,EAAE,KAAK,EAAE,SAAS,CAAC,IAAI,EAAE,SAAS,EAAE,CAAC;IACxE,MAAM,KAAK,GAAG,IAAI,CAAC,WAAW,EAAE,CAAC;IACjC,IAAI,KAAK,KAAK,eAAe;QAAE,OAAO,EAAE,KAAK,EAAE,IAAI,EAAE,KAAK,EAAE,SAAS,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC;IACzF,MAAM,QAAQ,GAAG,SAAS,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,oBAAoB,CAAC,IAAI,EAAE,QAAQ,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC;IAC/E,IAAI,QAAQ,EAAE,iBAAiB,EAAE,CAAC;QAChC,OAAO,EAAE,KAAK,EAAE,IAAI,EAAE,KAAK,EAAE,QAAQ,CAAC,aAAa,IAAI,QAAQ,CAAC,QAAQ,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC;IAC9F,CAAC;IACD,IAAI,QAAQ,EAAE,UAAU,EAAE,CAAC;QACzB,OAAO,EAAE,KAAK,EAAE,KAAK,EAAE,KAAK,EAAE,GAAG,QAAQ,CAAC,aAAa,KAAK,QAAQ,CAAC,kBAAkB,qBAAqB,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC;IAClI,CAAC;IACD,OAAO,EAAE,KAAK,EAAE,KAAK,EAAE,KAAK,EAAE,IAAI,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC;AACxD,CAAC;AAED,mFAAmF;AACnF,SAAS,YAAY,CAAC,OAAe,EAAE,QAAiB,EAAE,SAAkB,EAAE,KAAc,EAAE,KAAoB;IAChH,IAAI,CAAC,SAAS,CAAC,OAAO,CAAC;QAAE,OAAO,EAAE,QAAQ,EAAE,OAAO,EAAE,IAAI,EAAE,UAAU,EAAE,MAAM,EAAE,6BAA6B,EAAE,CAAC;IAC/G,IAAI,QAAQ;QAAE,OAAO,EAAE,QAAQ,EAAE,OAAO,EAAE,IAAI,EAAE,KAAK,EAAE,MAAM,EAAE,2CAA2C,OAAO,GAAG,KAAK,CAAC,CAAC,CAAC,KAAK,KAAK,GAAG,CAAC,CAAC,CAAC,EAAE,GAAG,EAAE,CAAC;IACpJ,IAAI,SAAS,IAAI,CAAC,KAAK;QAAE,OAAO,EAAE,QAAQ,EAAE,OAAO,EAAE,IAAI,EAAE,UAAU,EAAE,MAAM,EAAE,6CAA6C,OAAO,aAAa,EAAE,CAAC;IACnJ,IAAI,SAAS,IAAI,KAAK;QAAE,OAAO,EAAE,QAAQ,EAAE,sBAAsB,EAAE,IAAI,EAAE,MAAM,EAAE,MAAM,EAAE,0CAA0C,KAAK,+BAA+B,EAAE,CAAC;IAC1K,IAAI,CAAC,KAAK;QAAE,OAAO,EAAE,QAAQ,EAAE,sBAAsB,EAAE,IAAI,EAAE,QAAQ,EAAE,MAAM,EAAE,mCAAmC,OAAO,8BAA8B,EAAE,CAAC;IAC1J,OAAO,EAAE,QAAQ,EAAE,OAAO,EAAE,IAAI,EAAE,KAAK,EAAE,MAAM,EAAE,wCAAwC,KAAK,IAAI,EAAE,CAAC;AACvG,CAAC;AAED,SAAS,MAAM,CAAC,MAGf;IACC,OAAO,UAAU,CAA0B;QACzC,QAAQ,EAAE,UAAU;QACpB,QAAQ,EAAE,MAAM,CAAC,QAAQ;QACzB,gBAAgB,EAAE,MAAM,CAAC,QAAQ;QACjC,SAAS,EAAE,MAAM,CAAC,IAAI;QACtB,OAAO,EAAE,MAAM,CAAC,OAAO;QACvB,QAAQ,EAAE,MAAM,CAAC,QAAQ;QACzB,cAAc,EAAE,MAAM,CAAC,MAAM;QAC7B,YAAY,EAAE,MAAM,CAAC,YAAY;QACjC,OAAO,EAAE,MAAM,CAAC,OAAO;KACxB,CAAC,CAAC;AACL,CAAC;AAED;;;;GAIG;AACH,MAAM,UAAU,eAAe,CAAC,IAAY,EAAE,KAAc;IAC1D,MAAM,GAAG,GAAG,CAAC,IAAI,EAAE,UAAU,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,KAAK,IAAI,IAAI,EAAE,EAAE,CAAC,CAAC,WAAW,EAAE,CAAC;IAC9E,MAAM,QAAQ,GAAG,GAAG,CAAC,MAAM,IAAI,EAAE,CAAC,CAAC,CAAC,GAAG,CAAC,KAAK,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC;IAC5D,MAAM,aAAa,GAAG,KAAK,CAAC,CAAC,CAAC,qBAAqB,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC;IAElE,8EAA8E;IAC9E,IAAI,QAAQ,KAAK,gBAAgB,EAAE,CAAC;QAClC,MAAM,CAAC,GAAG,eAAe,CAAC,IAAI,EAAE,KAAK,CAAC,CAAC;QACvC,MAAM,CAAC,GAAG,CAAC,CAAC,OAAO,CAAC;QACpB,OAAO,MAAM,CAAC;YACZ,QAAQ,EAAG,CAAC,CAAC,gBAAqC,IAAI,sBAAsB;YAC5E,IAAI,EAAE,CAAC,CAAC,SAAS;YACjB,OAAO,EAAE,CAAC,CAAC,OAAO;YAClB,QAAQ,EAAE,CAAC,CAAC,QAAQ;YACpB,MAAM,EAAE,CAAC,CAAC,cAAc;YACxB,YAAY,EAAE,CAAC,CAAC,YAAY;YAC5B,OAAO,EAAE;gBACP,GAAG,aAAa,EAAE,MAAM,EAAE,SAAS,EAAE,QAAQ,EAAE,QAAQ,EAAE,UAAU,EAAE,KAAK,EAAE,CAAC,CAAC,KAAK;gBACnF,OAAO,EAAE,CAAC,CAAC,OAAO,EAAE,SAAS,EAAE,CAAC,CAAC,SAAS,EAAE,SAAS,EAAE,CAAC,CAAC,SAAS,EAAE,QAAQ,EAAE,CAAC,CAAC,QAAQ;gBACxF,iBAAiB,EAAE,CAAC,CAAC,YAAY,EAAE,iBAAiB,EAAE,CAAC,CAAC,YAAY;gBACpE,yBAAyB,EAAE,CAAC,CAAC,yBAAyB,EAAE,qBAAqB,EAAE,CAAC,CAAC,qBAAqB;aACvG;SACF,CAAC,CAAC;IACL,CAAC;IAED,IAAI,CAAC,QAAQ,IAAI,CAAC,4BAA4B,CAAC,GAAG,CAAC,QAAQ,CAAC,EAAE,CAAC;QAC7D,OAAO,MAAM,CAAC;YACZ,QAAQ,EAAE,sBAAsB,EAAE,IAAI,EAAE,SAAS;YACjD,OAAO,EAAE,CAAC,qBAAqB,QAAQ,IAAI,KAAK,gEAAgE,CAAC;YACjH,QAAQ,EAAE,EAAE,EAAE,MAAM,EAAE,aAAa,EAAE,OAAO,EAAE,EAAE,GAAG,aAAa,EAAE,QAAQ,EAAE;SAC7E,CAAC,CAAC;IACL,CAAC;IAED,MAAM,gBAAgB,GAAG,GAAG,EAAE,CAAC,MAAM,CAAC;QACpC,QAAQ,EAAE,sBAAsB,EAAE,IAAI,EAAE,QAAQ;QAChD,OAAO,EAAE,CAAC,gFAAgF,CAAC;QAC3F,QAAQ,EAAE,CAAC,iDAAiD,CAAC;QAC7D,MAAM,EAAE,SAAS,EAAE,OAAO,EAAE,EAAE,GAAG,aAAa,EAAE,QAAQ,EAAE;KAC3D,CAAC,CAAC;IAEH,6EAA6E;IAC7E,8EAA8E;IAC9E,2EAA2E;IAC3E,mEAAmE;IACnE,MAAM,IAAI,GAAG,YAAY,CAAC,GAAG,CAAC,CAAC;IAC/B,MAAM,KAAK,GAAG,cAAc,CAAC,QAAQ,CAAC,CAAC;IACvC,6EAA6E;IAC7E,0DAA0D;IAC1D,IAAI,IAAI,KAAK,IAAI,IAAI,CAAC,KAAK;QAAE,OAAO,gBAAgB,EAAE,CAAC;IACvD,IAAI,KAAK,CAAC,KAAK,KAAK,IAAI,CAAC,CAAC,CAAC,iBAAiB,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC,aAAa,CAAC,IAAI,EAAE,KAAK,CAAC,KAAK,CAAC,EAAE,CAAC;QAC3F,OAAO,gBAAgB,EAAE,CAAC;IAC5B,CAAC;IAED,IAAI,IAAwB,CAAC;IAC7B,IAAI,CAAC;QACH,MAAM,OAAO,GAAG,kBAAkB,CAAC,EAAE,GAAG,EAAE,IAAI,CAAC,QAA6B,CAAC,EAAE,IAAI,EAAE,GAAoB,EAAE,CAAC,CAAC;QAC7G,IAAI,GAAG,CAAC,OAAO,CAAC,IAAI,IAAI,EAAE,CAAuB,CAAC;IACpD,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,gBAAgB,EAAE,CAAC;IAC5B,CAAC;IAED,MAAM,IAAI,GAA4B,EAAE,GAAG,aAAa,EAAE,QAAQ,EAAE,KAAK,EAAE,KAAK,IAAI,IAAI,EAAE,qBAAqB,EAAE,aAAa,EAAE,CAAC;IAEjI,uEAAuE;IACvE,MAAM,aAAa,GAAG,CAAC,KAAa,EAAE,EAAE,CAAC,aAAa,CAAC,IAAI,EAAE,KAAK,CAAC,CAAC;IACpE;;;;OAIG;IACH,MAAM,aAAa,GAAG,CAAC,KAAa,EAAE,KAAuC,EAAE,EAAE,CAAC,MAAM,CAAC;QACvF,QAAQ,EAAE,OAAO,EAAE,IAAI,EAAE,UAAU;QACnC,OAAO,EAAE,CAAC,GAAG,KAAK,gEAAgE,CAAC;QACnF,QAAQ,EAAE,CAAC,4GAA4G,CAAC;QACxH,MAAM,EAAE,IAAI,EAAE,OAAO,EAAE,EAAE,GAAG,IAAI,EAAE,GAAG,KAAK,EAAE;KAC7C,CAAC,CAAC;IACH,yEAAyE;IACzE,MAAM,YAAY,GAAG,CAAC,KAAa,EAAE,EAAE,CAAC,MAAM,CAAC,KAAK,IAAI,CAAC,KAAK,CAAC,KAAK,GAAG,EAAE,EAAE,CAAC,KAAK,GAAG,CAAC,CAAC,GAAG,EAAE,CAAC,IAAI,GAAG,EAAE,CAAC,CAAC;IAEvG,QAAQ,QAAQ,EAAE,CAAC;QACjB,KAAK,eAAe,CAAC,CAAC,CAAC;YACrB,MAAM,WAAW,GAAG,aAAa,CAAC,CAAC,CAAC,CAAC;YACrC,MAAM,KAAK,GAAG,YAAY,CAAC,CAAC,CAAC,CAAC;YAC9B,IAAI,CAAC,WAAW,EAAE,CAAC;gBACjB,OAAO,aAAa,CAAC,gBAAgB,EAAE;oBACrC,MAAM,EAAE,QAAQ,EAAE,QAAQ,EAAE,UAAU,EAAE,SAAS,EAAE,KAAK,CAAC,QAAQ,EAAE;oBACnE,SAAS,EAAE,yBAAyB,CAAC,KAAK,CAAC,QAAQ,EAAE,CAAC,EAAE,QAAQ,EAAE,KAAK,KAAK,EAAE;iBAC/E,CAAC,CAAC;YACL,CAAC;YACD,MAAM,OAAO,GAAG,UAAU,CAAC,WAAW,CAAC,CAAC;YACxC,MAAM,SAAS,GAAG,yBAAyB,CAAC,KAAK,CAAC,QAAQ,EAAE,CAAC,CAAC;YAC9D,MAAM,QAAQ,GAAG,KAAK,KAAK,EAAE,CAAC;YAC9B,MAAM,EAAE,KAAK,EAAE,KAAK,EAAE,SAAS,EAAE,GAAG,aAAa,CAAC,OAAO,CAAC,CAAC;YAC3D,MAAM,CAAC,GAAG,YAAY,CAAC,OAAO,EAAE,QAAQ,EAAE,SAAS,EAAE,KAAK,EAAE,KAAK,CAAC,CAAC;YACnE,OAAO,MAAM,CAAC;gBACZ,QAAQ,EAAE,CAAC,CAAC,QAAQ,EAAE,IAAI,EAAE,CAAC,CAAC,IAAI,EAAE,OAAO,EAAE,CAAC,CAAC,CAAC,MAAM,CAAC;gBACvD,QAAQ,EAAE,CAAC,+HAA+H,CAAC;gBAC3I,MAAM,EAAE,IAAI;gBACZ,OAAO,EAAE,EAAE,GAAG,IAAI,EAAE,MAAM,EAAE,QAAQ,EAAE,QAAQ,EAAE,UAAU,EAAE,OAAO,EAAE,SAAS,EAAE,KAAK,CAAC,QAAQ,EAAE,EAAE,SAAS,EAAE,QAAQ,EAAE,iBAAiB,EAAE,KAAK,EAAE,iBAAiB,EAAE,KAAK,EAAE,yBAAyB,EAAE,SAAS,EAAE;aAClN,CAAC,CAAC;QACL,CAAC;QACD,KAAK,wBAAwB,CAAC,CAAC,CAAC;YAC9B,wEAAwE;YACxE,yEAAyE;YACzE,+BAA+B;YAC/B,MAAM,SAAS,GAAG,aAAa,CAAC,CAAC,CAAC,CAAC;YACnC,MAAM,WAAW,GAAG,aAAa,CAAC,CAAC,CAAC,CAAC;YACrC,MAAM,MAAM,GAAG,YAAY,CAAC,CAAC,CAAC,CAAC;YAC/B,IAAI,CAAC,WAAW,EAAE,CAAC;gBACjB,OAAO,aAAa,CAAC,0BAA0B,EAAE;oBAC/C,MAAM,EAAE,iBAAiB,EAAE,QAAQ,EAAE,UAAU,EAAE,KAAK,EAAE,SAAS,IAAI,CAAC,KAAK,IAAI,IAAI,CAAC;oBACpF,SAAS,EAAE,MAAM,CAAC,QAAQ,EAAE,EAAE,SAAS,EAAE,MAAM,IAAI,kBAAkB,EAAE,QAAQ,EAAE,MAAM,KAAK,EAAE;iBAC/F,CAAC,CAAC;YACL,CAAC;YACD,2EAA2E;YAC3E,6DAA6D;YAC7D,MAAM,WAAW,GAAG,SAAS,CAAC,CAAC,CAAC,UAAU,CAAC,SAAS,CAAC,CAAC,CAAC,CAAC,CAAC,KAAK,IAAI,IAAI,CAAC,CAAC;YACxE,MAAM,OAAO,GAAG,UAAU,CAAC,WAAW,CAAC,CAAC;YACxC,MAAM,UAAU,GAAG,MAAM,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,kCAAkC;YACtE,MAAM,SAAS,GAAG,MAAM,IAAI,kBAAkB,CAAC;YAC/C,MAAM,QAAQ,GAAG,MAAM,KAAK,EAAE,CAAC;YAC/B,MAAM,EAAE,KAAK,EAAE,KAAK,EAAE,SAAS,EAAE,GAAG,aAAa,CAAC,OAAO,CAAC,CAAC;YAC3D,MAAM,CAAC,GAAG,YAAY,CAAC,OAAO,EAAE,QAAQ,EAAE,SAAS,EAAE,KAAK,EAAE,KAAK,CAAC,CAAC;YACnE,OAAO,MAAM,CAAC;gBACZ,QAAQ,EAAE,CAAC,CAAC,QAAQ,EAAE,IAAI,EAAE,CAAC,CAAC,IAAI;gBAClC,OAAO,EAAE,CAAC,CAAC,CAAC,MAAM,EAAE,8BAA8B,WAAW,GAAG,UAAU,KAAK,GAAG,CAAC,CAAC,CAAC,gBAAgB,UAAU,GAAG,CAAC,CAAC,CAAC,EAAE,GAAG,CAAC;gBAC3H,QAAQ,EAAE,CAAC,qKAAqK,CAAC;gBACjL,MAAM,EAAE,IAAI,EAAE,YAAY,EAAE,IAAI;gBAChC,OAAO,EAAE,EAAE,GAAG,IAAI,EAAE,MAAM,EAAE,iBAAiB,EAAE,QAAQ,EAAE,UAAU,EAAE,KAAK,EAAE,WAAW,EAAE,OAAO,EAAE,SAAS,EAAE,MAAM,CAAC,QAAQ,EAAE,EAAE,SAAS,EAAE,QAAQ,EAAE,iBAAiB,EAAE,KAAK,EAAE,iBAAiB,EAAE,KAAK,EAAE,yBAAyB,EAAE,SAAS,EAAE,qBAAqB,EAAE,WAAW,CAAC,CAAC,CAAC,qBAAqB,CAAC,WAAW,CAAC,CAAC,CAAC,CAAC,aAAa,EAAE;aACzU,CAAC,CAAC;QACL,CAAC;QACD,KAAK,6BAA6B,CAAC,CAAC,CAAC;YACnC,MAAM,YAAY,GAAG,aAAa,CAAC,CAAC,CAAC,CAAC;YACtC,MAAM,QAAQ,GAAG,IAAI,CAAC,CAAC,CAAY,CAAC;YACpC,IAAI,CAAC,YAAY,EAAE,CAAC;gBAClB,OAAO,aAAa,CAAC,4BAA4B,EAAE,EAAE,MAAM,EAAE,mBAAmB,EAAE,QAAQ,EAAE,UAAU,EAAE,QAAQ,EAAE,CAAC,CAAC;YACtH,CAAC;YACD,MAAM,QAAQ,GAAG,UAAU,CAAC,YAAY,CAAC,CAAC;YAC1C,MAAM,EAAE,KAAK,EAAE,KAAK,EAAE,SAAS,EAAE,GAAG,aAAa,CAAC,QAAQ,CAAC,CAAC;YAC5D,IAAI,QAA0B,CAAC;YAAC,IAAI,IAAe,CAAC;YAAC,IAAI,MAAc,CAAC;YACxE,IAAI,CAAC,SAAS,CAAC,QAAQ,CAAC,EAAE,CAAC;gBAAC,QAAQ,GAAG,OAAO,CAAC;gBAAC,IAAI,GAAG,UAAU,CAAC;gBAAC,MAAM,GAAG,8BAA8B,CAAC;YAAC,CAAC;iBACxG,IAAI,CAAC,QAAQ,EAAE,CAAC;gBAAC,QAAQ,GAAG,OAAO,CAAC;gBAAC,IAAI,GAAG,KAAK,CAAC;gBAAC,MAAM,GAAG,0CAA0C,QAAQ,GAAG,KAAK,CAAC,CAAC,CAAC,KAAK,KAAK,GAAG,CAAC,CAAC,CAAC,EAAE,GAAG,CAAC;YAAC,CAAC;iBACjJ,IAAI,CAAC,KAAK,EAAE,CAAC;gBAAC,QAAQ,GAAG,OAAO,CAAC;gBAAC,IAAI,GAAG,UAAU,CAAC;gBAAC,MAAM,GAAG,2EAA2E,QAAQ,wEAAwE,CAAC;YAAC,CAAC;iBAC5N,CAAC;gBAAC,QAAQ,GAAG,sBAAsB,CAAC;gBAAC,IAAI,GAAG,MAAM,CAAC;gBAAC,MAAM,GAAG,oDAAoD,KAAK,+BAA+B,CAAC;YAAC,CAAC;YAC7J,OAAO,MAAM,CAAC;gBACZ,QAAQ,EAAE,IAAI,EAAE,OAAO,EAAE,CAAC,MAAM,CAAC;gBACjC,QAAQ,EAAE,QAAQ,CAAC,CAAC,CAAC,CAAC,kGAAkG,CAAC,CAAC,CAAC,CAAC,EAAE;gBAC9H,MAAM,EAAE,IAAI;gBACZ,OAAO,EAAE,EAAE,GAAG,IAAI,EAAE,MAAM,EAAE,mBAAmB,EAAE,QAAQ,EAAE,UAAU,EAAE,QAAQ,EAAE,QAAQ,EAAE,iBAAiB,EAAE,KAAK,EAAE,iBAAiB,EAAE,KAAK,EAAE,yBAAyB,EAAE,SAAS,EAAE;aACtL,CAAC,CAAC;QACL,CAAC;QACD,KAAK,sBAAsB,CAAC,CAAC,CAAC;YAC5B,MAAM,QAAQ,GAAG,aAAa,CAAC,CAAC,CAAC,CAAC;YAClC,MAAM,MAAM,GAAG,aAAa,CAAC,CAAC,CAAC,CAAC;YAChC,MAAM,MAAM,GAAG,YAAY,CAAC,CAAC,CAAC,CAAC,QAAQ,EAAE,CAAC;YAC1C,MAAM,KAAK,GAAG,EAAE,MAAM,EAAE,cAAc,EAAE,QAAQ,EAAE,UAAmB,EAAE,IAAI,EAAE,QAAQ,EAAE,SAAS,EAAE,MAAM,EAAE,CAAC;YAC3G,IAAI,CAAC,QAAQ;gBAAE,OAAO,aAAa,CAAC,qBAAqB,EAAE,KAAK,CAAC,CAAC;YAClE,IAAI,CAAC,MAAM;gBAAE,OAAO,aAAa,CAAC,wBAAwB,EAAE,KAAK,CAAC,CAAC;YACnE,OAAO,cAAc,CAAC,EAAE,GAAG,IAAI,EAAE,MAAM,EAAE,cAAc,EAAE,IAAI,EAAE,UAAU,CAAC,QAAQ,CAAC,EAAE,SAAS,EAAE,UAAU,CAAC,MAAM,CAAC,EAAE,SAAS,EAAE,MAAM,EAAE,EAAE,UAAU,CAAC,MAAM,CAAC,CAAC,CAAC;QAC/J,CAAC;QACD,KAAK,iBAAiB,CAAC,CAAC,CAAC;YACvB,MAAM,MAAM,GAAG,aAAa,CAAC,CAAC,CAAC,CAAC;YAChC,MAAM,MAAM,GAAG,YAAY,CAAC,CAAC,CAAC,CAAC,QAAQ,EAAE,CAAC;YAC1C,IAAI,CAAC,MAAM;gBAAE,OAAO,aAAa,CAAC,oBAAoB,EAAE,EAAE,MAAM,EAAE,UAAU,EAAE,QAAQ,EAAE,UAAU,EAAE,SAAS,EAAE,MAAM,EAAE,CAAC,CAAC;YACzH,MAAM,EAAE,GAAG,UAAU,CAAC,MAAM,CAAC,CAAC;YAC9B,OAAO,cAAc,CAAC,EAAE,GAAG,IAAI,EAAE,MAAM,EAAE,UAAU,EAAE,SAAS,EAAE,EAAE,EAAE,SAAS,EAAE,MAAM,EAAE,EAAE,EAAE,CAAC,CAAC;QAC/F,CAAC;QACD,KAAK,2BAA2B,CAAC,CAAC,CAAC;YACjC,MAAM,WAAW,GAAG,aAAa,CAAC,CAAC,CAAC,CAAC;YACrC,MAAM,KAAK,GAAG,YAAY,CAAC,CAAC,CAAC,CAAC;YAC9B,IAAI,CAAC,WAAW,EAAE,CAAC;gBACjB,OAAO,aAAa,CAAC,2BAA2B,EAAE;oBAChD,MAAM,EAAE,mBAAmB,EAAE,QAAQ,EAAE,UAAU,EAAE,SAAS,EAAE,KAAK,CAAC,QAAQ,EAAE;oBAC9E,SAAS,EAAE,yBAAyB,CAAC,KAAK,CAAC,QAAQ,EAAE,CAAC,EAAE,QAAQ,EAAE,KAAK,KAAK,EAAE;iBAC/E,CAAC,CAAC;YACL,CAAC;YACD,MAAM,OAAO,GAAG,UAAU,CAAC,WAAW,CAAC,CAAC;YACxC,MAAM,SAAS,GAAG,yBAAyB,CAAC,KAAK,CAAC,QAAQ,EAAE,CAAC,CAAC;YAC9D,MAAM,QAAQ,GAAG,KAAK,KAAK,EAAE,CAAC;YAC9B,MAAM,EAAE,KAAK,EAAE,KAAK,EAAE,SAAS,EAAE,GAAG,aAAa,CAAC,OAAO,CAAC,CAAC;YAC3D,MAAM,CAAC,GAAG,YAAY,CAAC,OAAO,EAAE,QAAQ,EAAE,SAAS,EAAE,KAAK,EAAE,KAAK,CAAC,CAAC;YACnE,OAAO,MAAM,CAAC;gBACZ,QAAQ,EAAE,CAAC,CAAC,QAAQ,EAAE,IAAI,EAAE,CAAC,CAAC,IAAI,EAAE,OAAO,EAAE,CAAC,sBAAsB,CAAC,CAAC,MAAM,EAAE,CAAC;gBAC/E,QAAQ,EAAE,CAAC,2EAA2E,CAAC,EAAE,MAAM,EAAE,IAAI;gBACrG,OAAO,EAAE,EAAE,GAAG,IAAI,EAAE,MAAM,EAAE,mBAAmB,EAAE,QAAQ,EAAE,UAAU,EAAE,OAAO,EAAE,SAAS,EAAE,KAAK,CAAC,QAAQ,EAAE,EAAE,SAAS,EAAE,QAAQ,EAAE,iBAAiB,EAAE,KAAK,EAAE,iBAAiB,EAAE,KAAK,EAAE,yBAAyB,EAAE,SAAS,EAAE;aAC7N,CAAC,CAAC;QACL,CAAC;QACD,KAAK,2BAA2B,CAAC,CAAC,CAAC;YACjC,MAAM,WAAW,GAAG,aAAa,CAAC,CAAC,CAAC,CAAC;YACrC,MAAM,aAAa,GAAI,IAAI,CAAC,CAAC,CAAY,CAAC,QAAQ,EAAE,CAAC;YACrD,yEAAyE;YACzE,0EAA0E;YAC1E,sEAAsE;YACtE,IAAI,CAAC,WAAW,EAAE,CAAC;gBACjB,OAAO,MAAM,CAAC;oBACZ,QAAQ,EAAE,sBAAsB,EAAE,IAAI,EAAE,QAAQ;oBAChD,OAAO,EAAE,CAAC,6FAA6F,CAAC;oBACxG,QAAQ,EAAE,EAAE,EAAE,MAAM,EAAE,SAAS;oBAC/B,OAAO,EAAE,EAAE,GAAG,IAAI,EAAE,MAAM,EAAE,mBAAmB,EAAE,QAAQ,EAAE,UAAU,EAAE,SAAS,EAAE,aAAa,EAAE;iBAClG,CAAC,CAAC;YACL,CAAC;YACD,MAAM,OAAO,GAAG,UAAU,CAAC,WAAW,CAAC,CAAC;YACxC,MAAM,UAAU,GAAG,aAAa,CAAC;YACjC,MAAM,EAAE,KAAK,EAAE,KAAK,EAAE,SAAS,EAAE,GAAG,aAAa,CAAC,OAAO,CAAC,CAAC;YAC3D,OAAO,MAAM,CAAC;gBACZ,QAAQ,EAAE,OAAO,EAAE,IAAI,EAAE,KAAK,EAAE,OAAO,EAAE,CAAC,iDAAiD,OAAO,GAAG,KAAK,CAAC,CAAC,CAAC,KAAK,KAAK,GAAG,CAAC,CAAC,CAAC,EAAE,GAAG,CAAC;gBACnI,QAAQ,EAAE,EAAE,EAAE,MAAM,EAAE,IAAI;gBAC1B,OAAO,EAAE,EAAE,GAAG,IAAI,EAAE,MAAM,EAAE,mBAAmB,EAAE,QAAQ,EAAE,UAAU,EAAE,OAAO,EAAE,SAAS,EAAE,UAAU,EAAE,iBAAiB,EAAE,KAAK,EAAE,iBAAiB,EAAE,KAAK,EAAE,yBAAyB,EAAE,SAAS,EAAE;aAClM,CAAC,CAAC;QACL,CAAC;QACD;YACE,wEAAwE;YACxE,uEAAuE;YACvE,OAAO,cAAc,CAAC,QAAQ,EAAE,KAAK,CAAC,KAAK,KAAK,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,aAAa,CAAC,CAAC,CAAC,EAAE,IAAI,CAAC,CAAC;IACvF,CAAC;AACH,CAAC;AAED,kHAAkH;AAClH,SAAS,cAAc,CAAC,OAAgC,EAAE,SAAiB;IACzE,MAAM,KAAK,GAAG,OAAO,CAAC,MAAM,KAAK,cAAc,CAAC,CAAC,CAAC,cAAc,CAAC,CAAC,CAAC,UAAU,CAAC;IAC9E,IAAI,CAAC,SAAS,CAAC,SAAS,CAAC,EAAE,CAAC;QAC1B,OAAO,MAAM,CAAC,EAAE,QAAQ,EAAE,OAAO,EAAE,IAAI,EAAE,UAAU,EAAE,OAAO,EAAE,CAAC,GAAG,KAAK,gCAAgC,CAAC,EAAE,QAAQ,EAAE,EAAE,EAAE,MAAM,EAAE,IAAI,EAAE,OAAO,EAAE,EAAE,GAAG,OAAO,EAAE,QAAQ,EAAE,UAAU,EAAE,EAAE,CAAC,CAAC;IACzL,CAAC;IACD,IAAI,qBAAqB,CAAC,SAAS,CAAC,EAAE,CAAC;QACrC,OAAO,MAAM,CAAC;YACZ,QAAQ,EAAE,OAAO,EAAE,IAAI,EAAE,UAAU;YACnC,OAAO,EAAE,CAAC,GAAG,KAAK,cAAc,SAAS,wCAAwC,CAAC;YAClF,QAAQ,EAAE,EAAE,EAAE,MAAM,EAAE,IAAI;YAC1B,OAAO,EAAE,EAAE,GAAG,OAAO,EAAE,QAAQ,EAAE,UAAU,EAAE,mBAAmB,EAAE,IAAI,EAAE;SACzE,CAAC,CAAC;IACL,CAAC;IACD,gFAAgF;IAChF,gFAAgF;IAChF,OAAO,MAAM,CAAC;QACZ,QAAQ,EAAE,sBAAsB,EAAE,IAAI,EAAE,QAAQ;QAChD,OAAO,EAAE,CAAC,GAAG,KAAK,oBAAoB,SAAS,sDAAsD,CAAC;QACtG,QAAQ,EAAE,EAAE,EAAE,MAAM,EAAE,IAAI;QAC1B,OAAO,EAAE,EAAE,GAAG,OAAO,EAAE,QAAQ,EAAE,UAAU,EAAE;KAC9C,CAAC,CAAC;AACL,CAAC;AAED,uGAAuG;AACvG,SAAS,cAAc,CAAC,QAAgB,EAAE,MAAqB,EAAE,IAA6B;IAC5F,MAAM,KAAK,GAAG,gBAAgB,CAAC,QAAQ,CAAC,IAAI,oCAAoC,CAAC;IACjF,MAAM,SAAS,GAAG,MAAM,IAAI,SAAS,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,UAAU,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC;IAC1E,4EAA4E;IAC5E,2EAA2E;IAC3E,kEAAkE;IAClE,MAAM,EAAE,KAAK,EAAE,KAAK,EAAE,WAAW,EAAE,SAAS,EAAE,GAAG,SAAS;QACxD,CAAC,CAAC,aAAa,CAAC,SAAS,CAAC;QAC1B,CAAC,CAAC,EAAE,KAAK,EAAE,KAAK,EAAE,KAAK,EAAE,IAAI,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC;IACnD,MAAM,MAAM,GAAI;QACd,CAAC,2BAA2B,CAAC,EAAE,mBAAmB,EAAE,CAAC,2BAA2B,CAAC,EAAE,mBAAmB;QACtG,CAAC,mBAAmB,CAAC,EAAE,WAAW,EAAE,CAAC,4BAA4B,CAAC,EAAE,kBAAkB,EAAE,CAAC,qBAAqB,CAAC,EAAE,aAAa;KACpG,CAAC,QAAQ,CAAC,IAAI,IAAI,CAAC;IAC/C,OAAO,MAAM,CAAC;QACZ,QAAQ,EAAE,sBAAsB,EAAE,IAAI,EAAE,MAAM;QAC9C,OAAO,EAAE,CAAC,0CAA0C,KAAK,GAAG,SAAS,CAAC,CAAC,CAAC,YAAY,SAAS,GAAG,CAAC,CAAC,CAAC,EAAE,6BAA6B,CAAC;QACnI,QAAQ,EAAE,CAAC,yIAAyI,CAAC;QACrJ,MAAM,EAAE,IAAI;QACZ,qEAAqE;QACrE,yEAAyE;QACzE,oCAAoC;QACpC,OAAO,EAAE;YACP,GAAG,IAAI,EAAE,MAAM,EAAE,QAAQ,EAAE,OAAO,EAAE,SAAS,EAAE,IAAI,EAAE,OAAO,EAAE,SAAS;YACvE,iBAAiB,EAAE,KAAK,EAAE,iBAAiB,EAAE,WAAW,EAAE,yBAAyB,EAAE,SAAS;SAC/F;KACF,CAAC,CAAC;AACL,CAAC"}

package/dist/lib/analysis/contractIntel.d.ts

@@ -0,0 +1,65 @@
+import { type NetworkName, type PharosNetwork } from "../networks.js";
+import { type AnalyzerResult, type EvidenceSource, type EvidenceStatus, type ReadOnlyChainAccess } from "./types.js";
+export type CanonicalStandard = "Safe" | "SafeL2" | "MultiSend" | "MultiSendCallOnly" | "MultiCall3" | "Permit2" | "ERC4337EntryPoint" | "ERC4337SenderCreator" | "CreateX" | "Create2Deployer" | "DeterministicDeploymentProxy" | "SafeSingletonFactory";
+export type CanonicalCategory = "smart-account" | "batching" | "approval-router" | "account-abstraction" | "deployer";
+export interface CanonicalContract {
+    /** Human label (kept stable — back-compat for spender/allowance recognition). */
+    label: string;
+    standard: CanonicalStandard;
+    category: CanonicalCategory;
+    /** Networks on which this canonical address is recognized (per-network). */
+    networks: NetworkName[];
+    /** Same address across EVM chains by deterministic deployment (CREATE2). */
+    deterministic: boolean;
+    source: EvidenceSource;
+    status: EvidenceStatus;
+    riskRelevance: string;
+    recommendedSafeHandsBehavior: string;
+    note?: string;
+}
+export declare const CANONICAL_CONTRACTS: Record<string, CanonicalContract>;
+/**
+ * Raw, network-agnostic lookup by address (returns the entry if the address is a
+ * known canonical contract on ANY network). Kept for back-compat with spender /
+ * allowance recognition. Use {@link canonicalContractEvidence} for per-network
+ * recognition.
+ */
+export declare function lookupCanonical(address: string): CanonicalContract | undefined;
+export interface CanonicalContractEvidence {
+    name: string;
+    category: CanonicalCategory;
+    standard: CanonicalStandard;
+    network: NetworkName;
+    chainId: number;
+    address: string;
+    deterministic: boolean;
+    source: EvidenceSource;
+    status: EvidenceStatus;
+    riskRelevance: string;
+    recommendedSafeHandsBehavior: string;
+}
+/**
+ * Per-network canonical recognition evidence. Returns evidence ONLY when the
+ * address is a known canonical contract recognized on `network`. A known address
+ * that is not recognized on this network (e.g. a Pacific-only Safe address while
+ * the active network is Atlantic) returns `null` — fail-safe under-recognition,
+ * never a false positive. Recognition is metadata, not a safety guarantee.
+ */
+export declare function canonicalContractEvidence(address: string, network?: PharosNetwork): CanonicalContractEvidence | null;
+export interface ContractIntelDetails {
+    address: string | null;
+    recognized: boolean;
+    label: string | null;
+    standard: CanonicalStandard | null;
+    recognitionSource: "canonical-address" | "none";
+    /** Recognition is by address only; on-chain source verification is NOT performed. */
+    sourceVerified: false;
+    /** Per-network canonical evidence (null when not recognized on the active network). */
+    canonicalContractEvidence: CanonicalContractEvidence | null;
+    network: NetworkName;
+    chainId: number;
+    codePresent: boolean | "unknown";
+    isContract: boolean | "unknown";
+}
+export declare function analyzeContract(address: string, access?: ReadOnlyChainAccess): Promise<AnalyzerResult<ContractIntelDetails>>;
+//# sourceMappingURL=contractIntel.d.ts.map

package/dist/lib/analysis/contractIntel.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"contractIntel.d.ts","sourceRoot":"","sources":["../../../src/lib/analysis/contractIntel.ts"],"names":[],"mappings":"AAgBA,OAAO,EAAoB,KAAK,WAAW,EAAE,KAAK,aAAa,EAAE,MAAM,gBAAgB,CAAC;AAExF,OAAO,EAAc,KAAK,cAAc,EAAE,KAAK,cAAc,EAAE,KAAK,cAAc,EAAE,KAAK,mBAAmB,EAAE,MAAM,YAAY,CAAC;AAEjI,MAAM,MAAM,iBAAiB,GACzB,MAAM,GACN,QAAQ,GACR,WAAW,GACX,mBAAmB,GACnB,YAAY,GACZ,SAAS,GACT,mBAAmB,GACnB,sBAAsB,GACtB,SAAS,GACT,iBAAiB,GACjB,8BAA8B,GAC9B,sBAAsB,CAAC;AAE3B,MAAM,MAAM,iBAAiB,GACzB,eAAe,GACf,UAAU,GACV,iBAAiB,GACjB,qBAAqB,GACrB,UAAU,CAAC;AAEf,MAAM,WAAW,iBAAiB;IAChC,iFAAiF;IACjF,KAAK,EAAE,MAAM,CAAC;IACd,QAAQ,EAAE,iBAAiB,CAAC;IAC5B,QAAQ,EAAE,iBAAiB,CAAC;IAC5B,4EAA4E;IAC5E,QAAQ,EAAE,WAAW,EAAE,CAAC;IACxB,4EAA4E;IAC5E,aAAa,EAAE,OAAO,CAAC;IACvB,MAAM,EAAE,cAAc,CAAC;IACvB,MAAM,EAAE,cAAc,CAAC;IACvB,aAAa,EAAE,MAAM,CAAC;IACtB,4BAA4B,EAAE,MAAM,CAAC;IACrC,IAAI,CAAC,EAAE,MAAM,CAAC;CACf;AA6LD,eAAO,MAAM,mBAAmB,EAAE,MAAM,CAAC,MAAM,EAAE,iBAAiB,CAKjE,CAAC;AAEF;;;;;GAKG;AACH,wBAAgB,eAAe,CAAC,OAAO,EAAE,MAAM,GAAG,iBAAiB,GAAG,SAAS,CAG9E;AAED,MAAM,WAAW,yBAAyB;IACxC,IAAI,EAAE,MAAM,CAAC;IACb,QAAQ,EAAE,iBAAiB,CAAC;IAC5B,QAAQ,EAAE,iBAAiB,CAAC;IAC5B,OAAO,EAAE,WAAW,CAAC;IACrB,OAAO,EAAE,MAAM,CAAC;IAChB,OAAO,EAAE,MAAM,CAAC;IAChB,aAAa,EAAE,OAAO,CAAC;IACvB,MAAM,EAAE,cAAc,CAAC;IACvB,MAAM,EAAE,cAAc,CAAC;IACvB,aAAa,EAAE,MAAM,CAAC;IACtB,4BAA4B,EAAE,MAAM,CAAC;CACtC;AAED;;;;;;GAMG;AACH,wBAAgB,yBAAyB,CACvC,OAAO,EAAE,MAAM,EACf,OAAO,GAAE,aAAkC,GAC1C,yBAAyB,GAAG,IAAI,CAgBlC;AAED,MAAM,WAAW,oBAAoB;IACnC,OAAO,EAAE,MAAM,GAAG,IAAI,CAAC;IACvB,UAAU,EAAE,OAAO,CAAC;IACpB,KAAK,EAAE,MAAM,GAAG,IAAI,CAAC;IACrB,QAAQ,EAAE,iBAAiB,GAAG,IAAI,CAAC;IACnC,iBAAiB,EAAE,mBAAmB,GAAG,MAAM,CAAC;IAChD,qFAAqF;IACrF,cAAc,EAAE,KAAK,CAAC;IACtB,uFAAuF;IACvF,yBAAyB,EAAE,yBAAyB,GAAG,IAAI,CAAC;IAC5D,OAAO,EAAE,WAAW,CAAC;IACrB,OAAO,EAAE,MAAM,CAAC;IAChB,WAAW,EAAE,OAAO,GAAG,SAAS,CAAC;IACjC,UAAU,EAAE,OAAO,GAAG,SAAS,CAAC;CACjC;AAED,wBAAsB,eAAe,CACnC,OAAO,EAAE,MAAM,EACf,MAAM,CAAC,EAAE,mBAAmB,GAC3B,OAAO,CAAC,cAAc,CAAC,oBAAoB,CAAC,CAAC,CAqF/C"}