viem 2.57.4 → 2.57.5

package/tempo/internal/relay/feePayer.ts

@@ -419,7 +419,7 @@ async function handleRawTransaction(options: handleRawTransaction.Options) {
     })
 
   const transaction = Transaction.deserialize(serialized)
-  // Prefer sender recovered from raw envelope; multisig finalize path supplies fallback sender.
+  // Prefer sender recovered from raw envelope; configurable account finalize path supplies fallback sender.
   const sender = transaction.from ?? options.sender
 
   // Sponsorship only applies after sender has signed original transaction.

package/tempo/internal/relay/keyAuthorization.ts

@@ -0,0 +1,415 @@
+import type { Address } from 'abitype'
+import * as RpcResponse from 'ox/RpcResponse'
+import {
+  AccountConfig,
+  AccountOperation,
+  KeyAuthorization,
+  SignatureEnvelope,
+} from 'ox/tempo'
+import { getBlockNumber } from '../../../actions/public/getBlockNumber.js'
+import type { Client } from '../../../clients/createClient.js'
+import { BaseError } from '../../../errors/base.js'
+import { isAddressEqual } from '../../../utils/address/isAddressEqual.js'
+import * as Actions from '../../actions/index.js'
+import type * as Relay from '../../Relay.js'
+import * as Store from '../../Store.js'
+import { selectApprovals, validateConfig } from './accounts.js'
+import * as Plugin from './plugin.js'
+
+/** Creates middleware that stores pending key authorizations and attaches them to fills. @internal */
+export function create(
+  options: Relay.keyAuthorization.Options = {},
+): Relay.keyAuthorization.ReturnType {
+  const { store = Store.memory() } = options
+  if (!store.compareAndSet)
+    throw new RpcResponse.InvalidParamsError({
+      message:
+        'Key authorization storage requires a store with atomic `compareAndSet`.',
+    })
+  return Plugin.keyAuthorization({
+    async handleRequest(context, next) {
+      const { request } = context
+
+      if (request.method === 'relay_saveKeyAuthorization') {
+        const keyAuthorization = parse(request.params?.[0])
+        const chainId = Number(keyAuthorization.chainId)
+        if (
+          context.options.chainId !== undefined &&
+          context.options.chainId !== chainId
+        )
+          throw new RpcResponse.InvalidParamsError({
+            message: 'Conflicting chain ids.',
+          })
+        const client = context.getClient(chainId)
+        const account = await check(client, keyAuthorization)
+        if (!account) return null
+        // Drop an unusable pending authorization so it cannot block this one.
+        await read(client, store, {
+          account,
+          accessKey: keyAuthorization.address,
+          chainId,
+        })
+        if (!(await write(store, { account, keyAuthorization })))
+          throw new RpcResponse.InvalidParamsError({
+            message:
+              'A pending key authorization for this access key expires later.',
+          })
+        return null
+      }
+
+      if (request.method === 'account_approveKeyAuthorization') {
+        await next()
+        const operation = AccountOperation.fromRpc(
+          context.result as AccountOperation.Rpc,
+        ) as AccountOperation.KeyAuthorizationOperation
+        if (operation.status !== 'success') return
+        const keyAuthorization = KeyAuthorization.deserialize(
+          operation.keyAuthorization,
+        ) as KeyAuthorization.Signed
+        // Re-check completed operations: quorum may land after expiry, and a
+        // stored success may predate a config rotation. The approval itself
+        // succeeded, so an authorization that fails these checks, or loses to a
+        // newer pending one, is skipped rather than reported. Operational
+        // failures propagate so callers know storage did not complete.
+        const chainId = Number(keyAuthorization.chainId)
+        const client = context.getClient(chainId)
+        const account = await check(client, keyAuthorization).catch((error) => {
+          if (error instanceof RpcResponse.InvalidParamsError) return undefined
+          throw error
+        })
+        if (!account) return
+        await read(client, store, {
+          account,
+          accessKey: keyAuthorization.address,
+          chainId,
+        })
+        await write(store, { account, keyAuthorization })
+        return
+      }
+
+      if (request.method !== 'eth_fillTransaction') return next()
+
+      const parameters = request.params?.[0] as Record<string, unknown>
+      const { from: account, keyId: accessKey } = parameters
+      if (
+        parameters.keyAuthorization ||
+        typeof account !== 'string' ||
+        typeof accessKey !== 'string'
+      )
+        return next()
+
+      const pending = await read(context.client, store, {
+        account: account as Address,
+        accessKey: accessKey as Address,
+        chainId: context.options.chainId!,
+      })
+      if (!pending) return next()
+      const metadata = await Actions.accessKey.getMetadata(context.client, {
+        account: account as Address,
+        accessKey: accessKey as Address,
+      })
+      // The key already landed onchain, so the authorization is spent.
+      if (isActive(metadata, accessKey as Address)) {
+        await remove(store, pending)
+        return next()
+      }
+      const keyAuthorization = KeyAuthorization.toRpc(pending.keyAuthorization)
+
+      // Attach before forwarding so gas estimation and later plugins see the authorization.
+      context.request = {
+        ...request,
+        params: [{ ...parameters, keyAuthorization }],
+      }
+      return next()
+    },
+  })
+}
+
+/** Parses a signed key authorization from RPC parameters. */
+function parse(value: unknown) {
+  const keyAuthorization = (() => {
+    try {
+      if (typeof value === 'string')
+        return KeyAuthorization.deserialize(value as `0x${string}`)
+      return KeyAuthorization.fromRpc(value as KeyAuthorization.Rpc)
+    } catch {
+      return undefined
+    }
+  })()
+  if (!keyAuthorization?.signature)
+    throw new RpcResponse.InvalidParamsError({
+      message: 'Expected a signed key authorization.',
+    })
+  return keyAuthorization as KeyAuthorization.Signed
+}
+
+/**
+ * Validates an authorization and returns the account it authorizes, or `undefined`
+ * when the access key is already active onchain.
+ */
+async function check(
+  client: Client,
+  keyAuthorization: KeyAuthorization.Signed,
+): Promise<Address | undefined> {
+  if (isExpired(keyAuthorization))
+    throw new RpcResponse.InvalidParamsError({
+      message: 'Key authorization has expired.',
+    })
+  const account = await verify(client, keyAuthorization)
+  if (await isBurned(client, { account, keyAuthorization }))
+    throw new RpcResponse.InvalidParamsError({
+      message: 'Key authorization witness has been burned.',
+    })
+  // Authorizations for keys that are already active would only be removed on the next fill.
+  const metadata = await Actions.accessKey.getMetadata(client, {
+    account,
+    accessKey: keyAuthorization.address,
+  })
+  if (isActive(metadata, keyAuthorization.address)) return undefined
+  return account
+}
+
+/** Verifies the authorization signature and returns the account it authorizes. */
+async function verify(
+  client: Client,
+  keyAuthorization: KeyAuthorization.Signed,
+): Promise<Address> {
+  const { signature, ...unsigned } = keyAuthorization
+  const payload = KeyAuthorization.getSignPayload(unsigned)
+
+  if (signature.type === 'configurable') {
+    if (
+      !keyAuthorization.account ||
+      !isAddressEqual(keyAuthorization.account, signature.account)
+    )
+      throw new RpcResponse.InvalidParamsError({
+        message:
+          'Configurable account key authorization account does not match its signature.',
+      })
+    const config = AccountConfig.from(signature.config)
+    await validateConfig({
+      account: signature.account,
+      blockNumber: await getBlockNumber(client, { cacheTime: 0 }),
+      client: client as never,
+      config,
+    })
+    const approvals = await selectApprovals({
+      account: signature.account,
+      approvals: signature.signatures.map((signature) =>
+        SignatureEnvelope.serialize(signature),
+      ),
+      config,
+      hash: AccountConfig.getSignPayload({
+        account: signature.account,
+        config,
+        payload,
+      }),
+    })
+    if (approvals.weight < approvals.threshold)
+      throw new RpcResponse.InvalidParamsError({
+        message:
+          'Configurable account key authorization has not reached quorum.',
+      })
+    return signature.account
+  }
+
+  const signer = (() => {
+    try {
+      const signer = SignatureEnvelope.extractAddress({ payload, signature })
+      if (SignatureEnvelope.verify(signature, { address: signer, payload }))
+        return signer
+    } catch {}
+    throw new RpcResponse.InvalidParamsError({
+      message: 'Invalid key authorization signature.',
+    })
+  })()
+
+  // Admin-signed authorizations can only be submitted by the admin key itself,
+  // so only authorizations signed by the account can be attached for the new key.
+  if (
+    keyAuthorization.account &&
+    !isAddressEqual(keyAuthorization.account, signer)
+  )
+    throw new RpcResponse.InvalidParamsError({
+      message: 'Key authorization must be signed by its account.',
+    })
+  return signer
+}
+
+/**
+ * Reads the pending authorization for an access key. Entries that are malformed,
+ * expired, or whose witness has been burned are removed.
+ */
+async function read(
+  client: Client,
+  store: Store.Atomic,
+  options: { account: Address; accessKey: Address; chainId: number },
+) {
+  const { account } = options
+  const key = getKey(options)
+  const value = await store.getItem(key)
+  if (!value) return undefined
+  const keyAuthorization = (() => {
+    try {
+      return KeyAuthorization.deserialize(
+        value as `0x${string}`,
+      ) as KeyAuthorization.Signed
+    } catch {
+      return undefined
+    }
+  })()
+  if (
+    keyAuthorization &&
+    !isExpired(keyAuthorization) &&
+    (await isVerified(client, keyAuthorization)) &&
+    !(await isBurned(client, { account, keyAuthorization }))
+  )
+    return { key, keyAuthorization, value }
+  await remove(store, { key, value })
+  return undefined
+}
+
+/**
+ * Removes a stored authorization only while it still holds the value that was read,
+ * so a concurrently saved replacement survives. The empty value expires immediately.
+ * @internal
+ */
+export async function remove(
+  store: Store.Atomic,
+  options: { key: string; value: string },
+) {
+  const { key, value } = options
+  await store.compareAndSet(key, value, '', { expiresAt: Date.now() })
+}
+
+/**
+ * Returns whether the authorization still verifies, such as after a configurable
+ * account rotates its config. Operational failures propagate.
+ */
+async function isVerified(
+  client: Client,
+  keyAuthorization: KeyAuthorization.Signed,
+) {
+  try {
+    await verify(client, keyAuthorization)
+    return true
+  } catch (error) {
+    if (error instanceof RpcResponse.InvalidParamsError) return false
+    throw error
+  }
+}
+
+/** Returns whether the authorization's witness has been burned onchain. */
+async function isBurned(
+  client: Client,
+  options: { account: Address; keyAuthorization: KeyAuthorization.Signed },
+) {
+  const { account, keyAuthorization } = options
+  if (!keyAuthorization.witness) return false
+  return Actions.accessKey.isWitnessBurned(client, {
+    account,
+    witness: keyAuthorization.witness,
+  })
+}
+
+/**
+ * Stores an authorization unless a pending authorization for the same key expires
+ * later, so a replayed older authorization cannot replace a newer one.
+ * @internal
+ */
+export async function write(
+  store: Store.Atomic,
+  options: {
+    account: Address
+    keyAuthorization: KeyAuthorization.Signed
+  },
+): Promise<boolean> {
+  const { account, keyAuthorization } = options
+  const key = getKey({
+    account,
+    accessKey: keyAuthorization.address,
+    chainId: Number(keyAuthorization.chainId),
+  })
+  const value = KeyAuthorization.serialize(keyAuthorization)
+  const expiresAt = Math.min(
+    Date.now() + maxTtl,
+    getExpiry(keyAuthorization) * 1_000,
+  )
+  for (let attempt = 0; attempt < maxWriteAttempts; attempt++) {
+    const current = (await store.getItem(key)) ?? null
+    const existing = (() => {
+      if (!current) return undefined
+      try {
+        return KeyAuthorization.deserialize(current as `0x${string}`)
+      } catch {
+        return undefined
+      }
+    })()
+    if (existing && current!.toLowerCase() === value.toLowerCase()) return true
+    if (existing && getExpiry(existing) >= getExpiry(keyAuthorization))
+      return false
+    // A lost compare-and-set means another writer replaced the value, so compare again.
+    if (await store.compareAndSet(key, current, value, { expiresAt }))
+      return true
+  }
+  throw new StoreConflictError()
+}
+
+/** Maximum compare-and-set attempts before a write is abandoned. */
+const maxWriteAttempts = 32
+
+/** Maximum time a pending key authorization is kept. */
+const maxTtl = 30 * 24 * 60 * 60 * 1_000
+
+/** Returns the authorization expiry in seconds, treating no expiry as unbounded. */
+function getExpiry(keyAuthorization: KeyAuthorization.KeyAuthorization) {
+  const { expiry } = keyAuthorization
+  return expiry === undefined || expiry === null
+    ? Number.POSITIVE_INFINITY
+    : Number(expiry)
+}
+
+/** Returns whether the access key is active onchain. */
+function isActive(
+  metadata: Actions.accessKey.getMetadata.ReturnValue,
+  accessKey: Address,
+) {
+  return (
+    isAddressEqual(metadata.address, accessKey) &&
+    !metadata.isRevoked &&
+    metadata.expiry > BigInt(Math.floor(Date.now() / 1000))
+  )
+}
+
+function isExpired(keyAuthorization: KeyAuthorization.KeyAuthorization) {
+  const { expiry } = keyAuthorization
+  return (
+    expiry !== undefined &&
+    expiry !== null &&
+    BigInt(expiry) <= BigInt(Math.floor(Date.now() / 1000))
+  )
+}
+
+function getKey(options: {
+  account: Address
+  accessKey: Address
+  chainId: number
+}) {
+  const { account, accessKey, chainId } = options
+  return [
+    'keyAuthorization',
+    chainId,
+    account.toLowerCase(),
+    accessKey.toLowerCase(),
+  ].join(':')
+}
+
+/** Thrown when a pending key authorization cannot be written after repeated conflicts. */
+class StoreConflictError extends BaseError {
+  constructor() {
+    super(
+      'Pending key authorization could not be written after repeated conflicts.',
+      { name: 'Relay.KeyAuthorization.StoreConflictError' },
+    )
+  }
+}

package/tempo/internal/relay/plugin.ts

@@ -1,13 +1,26 @@
 import type * as Relay from '../../Relay.js'
 
-const multisigPlugins = new WeakSet<Relay.Plugin>()
+const accountsPlugins = new WeakSet<Relay.Plugin>()
+const keyAuthorizationPlugins = new WeakSet<Relay.Plugin>()
 
-/** Registers the built-in multisig plugin for transport capability detection. */
-export function multisig(plugin: Relay.Plugin): Relay.multisig.ReturnType {
-  multisigPlugins.add(plugin)
-  return plugin as Relay.multisig.ReturnType
+/** Registers the built-in accounts plugin for transport capability detection. */
+export function accounts(plugin: Relay.Plugin): Relay.accounts.ReturnType {
+  accountsPlugins.add(plugin)
+  return plugin as Relay.accounts.ReturnType
 }
 
-export function isMultisig(plugin: Relay.Plugin): boolean {
-  return multisigPlugins.has(plugin)
+export function isAccounts(plugin: Relay.Plugin): boolean {
+  return accountsPlugins.has(plugin)
+}
+
+/** Registers the built-in key authorization plugin for transport capability detection. */
+export function keyAuthorization(
+  plugin: Relay.Plugin,
+): Relay.keyAuthorization.ReturnType {
+  keyAuthorizationPlugins.add(plugin)
+  return plugin as Relay.keyAuthorization.ReturnType
+}
+
+export function isKeyAuthorization(plugin: Relay.Plugin): boolean {
+  return keyAuthorizationPlugins.has(plugin)
 }

package/utils/hash/normalizeSignature.ts

@@ -46,8 +46,9 @@ export function normalizeSignature(
 
     // Ignore spaces
     if (char === ' ') {
-      // If the previous character is a separator, and the current section isn't empty, we want to deactivate.
-      if (signature[i - 1] !== ',' && current !== ',' && current !== ',(') {
+      // A space directly after a `(` or `,` separator is leading whitespace.
+      // Otherwise, it ends the type, so we want to deactivate.
+      if (!current.endsWith(',') && !current.endsWith('(')) {
         current = ''
         active = false
       }

package/utils/rpc/http.ts

@@ -115,35 +115,56 @@ export function getHttpRpcClient(
       const { headers, method, signal: signal_ } = fetchOptions
 
       try {
-        const response = await withTimeout(
-          async ({ signal }) => {
-            const init: RequestInit = {
-              ...fetchOptions,
-              body: Array.isArray(body)
-                ? stringify(
-                    body.map((body) => ({
+        const { response, responseBody } = await withTimeout(
+          async ({ signal: timeoutSignal }) => {
+            // Abort on whichever fires first so that a `signal` does not
+            // disable the timeout.
+            const { signal, cleanup } = anySignal([
+              signal_,
+              timeout > 0 ? timeoutSignal : null,
+            ])
+            try {
+              const init: RequestInit = {
+                ...fetchOptions,
+                body: Array.isArray(body)
+                  ? stringify(
+                      body.map((body) => ({
+                        jsonrpc: '2.0',
+                        id: body.id ?? idCache.take(),
+                        ...body,
+                      })),
+                    )
+                  : stringify({
                       jsonrpc: '2.0',
                       id: body.id ?? idCache.take(),
                       ...body,
-                    })),
-                  )
-                : stringify({
-                    jsonrpc: '2.0',
-                    id: body.id ?? idCache.take(),
-                    ...body,
-                  }),
-              headers: {
-                ...headers_url,
-                'Content-Type': 'application/json',
-                ...headers,
-              },
-              method: method || 'POST',
-              signal: signal_ || (timeout > 0 ? signal : null),
+                    }),
+                headers: {
+                  ...headers_url,
+                  'Content-Type': 'application/json',
+                  ...headers,
+                },
+                method: method || 'POST',
+                signal,
+              }
+              const request = new Request(url, init)
+              const args = (await onRequest?.(request, init)) ?? {
+                ...init,
+                url,
+              }
+              const response = await fetchFn(args.url ?? url, args)
+
+              if (onResponse) await onResponse(response)
+
+              // Read the body within the timeout too, so a response that stalls
+              // after its headers cannot hang the request.
+              const responseBody = await readResponseBody(response, {
+                maxResponseBodySize,
+              })
+              return { response, responseBody }
+            } finally {
+              cleanup()
             }
-            const request = new Request(url, init)
-            const args = (await onRequest?.(request, init)) ?? { ...init, url }
-            const response = await fetchFn(args.url ?? url, args)
-            return response
           },
           {
             errorInstance: new TimeoutError({ body, url }),
@@ -152,12 +173,7 @@ export function getHttpRpcClient(
           },
         )
 
-        if (onResponse) await onResponse(response)
-
         let data: any
-        const responseBody = await readResponseBody(response, {
-          maxResponseBodySize,
-        })
         if (
           response.headers.get('Content-Type')?.startsWith('application/json')
         )
@@ -207,6 +223,36 @@ export function getHttpRpcClient(
   }
 }
 
+/**
+ * Returns a signal that aborts as soon as any of `signals` aborts, and a
+ * `cleanup` function that detaches the listeners added to `signals`.
+ */
+function anySignal(signals: readonly (AbortSignal | null | undefined)[]) {
+  const signals_ = signals.filter((signal) => !!signal)
+  if (signals_.length < 2)
+    return { signal: signals_[0] ?? null, cleanup: () => {} }
+
+  const controller = new AbortController()
+  const onAbort = () => {
+    cleanup()
+    controller.abort(signals_.find((signal) => signal.aborted)?.reason)
+  }
+  const cleanup = () => {
+    for (const signal of signals_) signal.removeEventListener('abort', onAbort)
+  }
+
+  for (const signal of signals_) {
+    if (signal.aborted) {
+      cleanup()
+      controller.abort(signal.reason)
+      break
+    }
+    signal.addEventListener('abort', onAbort)
+  }
+
+  return { signal: controller.signal, cleanup }
+}
+
 async function readResponseBody(
   response: Response,
   { maxResponseBodySize }: { maxResponseBodySize: number | false },

package/utils/rpc/socket.ts

@@ -260,8 +260,10 @@ export async function getSocketRpcClient<socket extends {}>(
               body.method === 'eth_subscribe' &&
               typeof response.result === 'string'
             )
+              // Store `onResponse` rather than `callback` (which filters by this request's
+              // id) so the re-subscribe on reconnect delivers the new id to the subscriber.
               subscriptions.set(response.result, {
-                onResponse: callback,
+                onResponse,
                 onError,
                 body,
               })

package/_cjs/tempo/actions/multisig.js.map

@@ -1 +0,0 @@
-{"version":3,"file":"multisig.js","sourceRoot":"","sources":["../../../tempo/actions/multisig.ts"],"names":[],"mappings":";;AA8CA,8BAaC;AAwCD,kDAYC;AAyCD,oCAaC;AA4DD,oCAQC;AAkLD,4CAyBC;AAjbD,oCAIiB;AAGjB,0EAAmE;AAEnE,4EAAqE;AACrE,oFAA6E;AAO7E,yEAAkE;AAClE,mCAAkC;AAClC,8CAAkE;AAClE,6CAA4C;AAE5C,mDAAiD;AAqB1C,KAAK,UAAU,SAAS,CAC7B,MAAc,EACd,UAAgC;IAEhC,MAAM,MAAM,GAAG,MAAM,MAAM,CAAC,OAAO,CAIhC;QACD,MAAM,EAAE,oBAAoB;QAC5B,MAAM,EAAE,CAAC,EAAE,OAAO,EAAE,UAAU,CAAC,OAAO,EAAE,CAAC;KAC1C,CAAC,CAAA;IACF,OAAO,MAAM,CAAC,CAAC,CAAC,sBAAc,CAAC,OAAO,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,IAAI,CAAA;AACvD,CAAC;AAwCM,KAAK,UAAU,mBAAmB,CAIvC,MAAyC,EACzC,UAA0C;IAE1C,MAAM,EAAE,OAAO,EAAE,GAAG,IAAI,EAAE,GAAG,UAAU,CAAA;IACvC,OAAO,IAAA,8BAAY,EAAC,MAAM,EAAE;QAC1B,GAAG,IAAI;QACP,GAAG,mBAAmB,CAAC,IAAI,CAAC,EAAE,OAAO,EAAE,CAAC;KACzC,CAAC,CAAA;AACJ,CAAC;AAED,WAAiB,mBAAmB;IAsBlC,SAAgB,IAAI,CAAC,IAAU;QAC7B,OAAO,IAAA,qBAAU,EAAC;YAChB,OAAO,EAAE,SAAS,CAAC,cAAc;YACjC,GAAG,EAAE,IAAI,CAAC,cAAc;YACxB,IAAI,EAAE,CAAC,IAAI,CAAC,OAAO,CAAC;YACpB,YAAY,EAAE,qBAAqB;SACpC,CAAC,CAAA;IACJ,CAAC;IAPe,wBAAI,OAOnB,CAAA;AACH,CAAC,EA9BgB,mBAAmB,mCAAnB,mBAAmB,QA8BnC;AASM,KAAK,UAAU,YAAY,CAChC,MAAc,EACd,UAAmC;IAMnC,MAAM,SAAS,GAAG,MAAM,MAAM,CAAC,OAAO,CAAwB;QAC5D,MAAM,EAAE,uBAAuB;QAC/B,MAAM,EAAE,CAAC,UAAU,CAAC,IAAI,CAAC;KAC1B,CAAC,CAAA;IACF,OAAO,SAAS,CAAC,CAAC,CAAC,yBAAiB,CAAC,OAAO,CAAC,SAAS,CAAC,CAAC,CAAC,CAAC,IAAI,CAAA;AAChE,CAAC;AA4DM,KAAK,UAAU,YAAY,CAIhC,MAAyC,EACzC,UAAmD;IAEnD,OAAO,YAAY,CAAC,KAAK,CAAC,gCAAa,EAAE,MAAM,EAAE,UAAU,CAAC,CAAA;AAC9D,CAAC;AAED,WAAiB,YAAY;IAwBpB,KAAK,UAAU,KAAK,CAKzB,MAAc,EACd,MAAyC,EACzC,UAAsC;QAEtC,MAAM,EACJ,OAAO,EAAE,QAAQ,EACjB,aAAa,EAAE,cAAc,EAC7B,UAAU,EACV,GAAG,IAAI,EACR,GAAG,UAAU,CAAA;QACd,MAAM,YAAY,GAAG,QAAQ,IAAI,MAAM,CAAC,OAAO,CAAA;QAC/C,MAAM,OAAO,GAAG,CAAC,GAAG,EAAE;YACpB,IACE,OAAO,YAAY,KAAK,QAAQ;gBAChC,YAAY,CAAC,MAAM,KAAK,UAAU;gBAElC,OAAO,YAA+B,CAAA;YACxC,OAAO,SAAS,CAAA;QAClB,CAAC,CAAC,EAAE,CAAA;QACJ,MAAM,MAAM,GAAG,CAAC,GAAG,EAAE;YACnB,IAAI,cAAc;gBAAE,OAAO,cAAc,CAAA;YACzC,IAAI,OAAO,EAAE,MAAM;gBAAE,OAAO,OAAO,CAAC,MAAM,CAAA;YAC1C,OAAO,SAAS,CAAA;QAClB,CAAC,CAAC,EAAE,CAAA;QACJ,MAAM,OAAO,GAAG,CAAC,GAAG,EAAE;YACpB,IAAI,OAAO;gBAAE,OAAO,OAAO,CAAC,OAAO,CAAA;YACnC,IAAI,OAAO,YAAY,KAAK,QAAQ;gBAAE,OAAO,YAAuB,CAAA;YACpE,IAAI,YAAY;gBAAE,OAAO,YAAY,CAAC,OAAO,CAAA;YAC7C,OAAO,SAAS,CAAA;QAClB,CAAC,CAAC,EAAE,CAAA;QACJ,MAAM,aAAa,GAAG,MAAM,CAAC,KAAK,IAAI,EAAE;YACtC,IAAI,MAAM;gBAAE,OAAO,sBAAc,CAAC,IAAI,CAAC,MAAM,CAAC,CAAA;YAC9C,IAAI,CAAC,OAAO;gBACV,MAAM,IAAI,KAAK,CACb,2DAA2D,CAC5D,CAAA;YACH,MAAM,YAAY,GAAG,MAAM,SAAS,CAAC,MAAM,EAAE,EAAE,OAAO,EAAE,CAAC,CAAA;YACzD,IAAI,CAAC,YAAY;gBACf,MAAM,IAAI,KAAK,CACb,oDAAoD,OAAO,+BAA+B,CAC3F,CAAA;YACH,OAAO,YAAY,CAAA;QACrB,CAAC,CAAC,EAAE,CAAA;QACJ,MAAM,eAAe,GAAG,CAAC,GAAG,EAAE;YAC5B,IAAI,OAAO;gBAAE,OAAO,EAAE,GAAG,OAAO,EAAE,MAAM,EAAE,aAAa,EAAE,CAAA;YACzD,IAAI,OAAO,YAAY,KAAK,QAAQ;gBAAE,OAAO,YAAY,CAAA;YACzD,IAAI,OAAO;gBAAE,OAAO,IAAA,yBAAY,EAAC,EAAE,OAAO,EAAE,GAAG,aAAa,EAAE,CAAC,CAAA;YAC/D,OAAO,SAAS,CAAA;QAClB,CAAC,CAAC,EAAE,CAAA;QACJ,OAAO,CAAC,MAAM,MAAM,CAAC,MAAM,EAAE;YAC3B,GAAG,IAAI;YACP,GAAG,CAAC,eAAe,CAAC,CAAC,CAAC,EAAE,OAAO,EAAE,eAAe,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;YACxD,GAAG,YAAY,CAAC,IAAI,CAAC,EAAE,aAAa,EAAE,UAAU,EAAE,CAAC;SAC3C,CAAC,CAAU,CAAA;IACvB,CAAC;IA3DqB,kBAAK,QA2D1B,CAAA;IA4BD,SAAgB,IAAI,CAAC,IAAU;QAC7B,MAAM,aAAa,GAAG,sBAAc,CAAC,IAAI,CAAC,IAAI,CAAC,aAAa,CAAC,CAAA;QAC7D,MAAM,UAAU,GAAG,sBAAc,CAAC,IAAI,CAAC;YACrC,MAAM,EAAE,IAAI,CAAC,UAAU,CAAC,MAAM;YAC9B,IAAI,EAAE,aAAa,CAAC,IAAI;YACxB,SAAS,EAAE,IAAI,CAAC,UAAU,CAAC,SAAS;YACpC,OAAO,EAAE,aAAa,CAAC,OAAO,GAAG,EAAE;SACpC,CAAC,CAAA;QACF,OAAO,IAAA,qBAAU,EAAC;YAChB,OAAO,EAAE,SAAS,CAAC,cAAc;YACjC,GAAG,EAAE,IAAI,CAAC,cAAc;YACxB,IAAI,EAAE,CAAC,aAAa,EAAE,UAAU,CAAC,SAAS,EAAE,UAAU,CAAC,MAAM,CAAC;YAC9D,YAAY,EAAE,cAAc;SAC7B,CAAC,CAAA;IACJ,CAAC;IAde,iBAAI,OAcnB,CAAA;IAQD,SAAgB,YAAY,CAAC,IAAW;QACtC,MAAM,CAAC,GAAG,CAAC,GAAG,IAAA,kCAAc,EAAC;YAC3B,GAAG,EAAE,IAAI,CAAC,cAAc;YACxB,IAAI;YACJ,SAAS,EAAE,uBAAuB;YAClC,MAAM,EAAE,IAAI;SACb,CAAC,CAAA;QACF,IAAI,CAAC,GAAG;YAAE,MAAM,IAAI,KAAK,CAAC,0CAA0C,CAAC,CAAA;QACrE,OAAO,GAAG,CAAA;IACZ,CAAC;IATe,yBAAY,eAS3B,CAAA;AACH,CAAC,EA/IgB,YAAY,4BAAZ,YAAY,QA+I5B;AAiCM,KAAK,UAAU,gBAAgB,CAIpC,MAAyC,EACzC,UAAuD;IAEvD,MAAM,EAAE,oBAAoB,GAAG,IAAI,EAAE,GAAG,IAAI,EAAE,GAAG,UAAU,CAAA;IAC3D,MAAM,OAAO,GAAG,MAAM,YAAY,CAAC,KAAK,CAAC,wCAAiB,EAAE,MAAM,EAAE;QAClE,GAAG,IAAI;QACP,oBAAoB;KACZ,CAAC,CAAA;IACX,IAAK,OAA0C,CAAC,MAAM,KAAK,SAAS;QAClE,OAAO,EAAE,OAAO,EAAW,CAAA;IAC7B,MAAM,EAAE,IAAI,EAAE,GAAG,YAAY,CAAC,YAAY,CAAC,OAAO,CAAC,IAAI,CAAC,CAAA;IACxD,OAAO;QACL,OAAO,EAAE,IAAI,CAAC,OAAO;QACrB,MAAM,EAAE,sBAAc,CAAC,IAAI,CAAC;YAC1B,MAAM,EAAE,IAAI,CAAC,MAAM;YACnB,IAAI,EAAE,IAAI,CAAC,IAAI;YACf,SAAS,EAAE,IAAI,CAAC,SAAS;YACzB,OAAO,EAAE,IAAI,CAAC,OAAO;SACtB,CAAC;QACF,OAAO;KACC,CAAA;AACZ,CAAC"}