@agentronics/sdk 0.5.0 → 0.6.0

package/dist/server.cjs.map

@@ -0,0 +1 @@
+{"version":3,"sources":["../src/detection/crawler.ts","../src/server/crawlers.ts","../src/server/structuredFields.ts","../src/server/httpSignatures.ts","../src/server/safeFetch.ts","../src/server/webBotAuth.ts","../src/server/agentAuth.ts","../src/server/middleware.ts"],"names":["result"],"mappings":";;;AA0BO,IAAM,kBAAA,GAAyC;AAAA;AAAA,EAEpD,EAAE,IAAA,EAAM,QAAA,EAAU,QAAA,EAAU,IAAA,EAAM,SAAS,SAAA,EAAU;AAAA,EACrD,EAAE,IAAA,EAAM,eAAA,EAAiB,QAAA,EAAU,IAAA,EAAM,SAAS,gBAAA,EAAiB;AAAA,EACnE,EAAE,IAAA,EAAM,cAAA,EAAgB,QAAA,EAAU,IAAA,EAAM,SAAS,eAAA,EAAgB;AAAA,EACjE,EAAE,IAAA,EAAM,WAAA,EAAa,QAAA,EAAU,IAAA,EAAM,SAAS,YAAA,EAAa;AAAA,EAC3D,EAAE,IAAA,EAAM,YAAA,EAAc,QAAA,EAAU,IAAA,EAAM,SAAS,aAAA,EAAc;AAAA,EAC7D,EAAE,IAAA,EAAM,cAAA,EAAgB,QAAA,EAAU,IAAA,EAAM,SAAS,eAAA,EAAgB;AAAA,EACjE,EAAE,IAAA,EAAM,eAAA,EAAiB,QAAA,EAAU,IAAA,EAAM,SAAS,gBAAA,EAAiB;AAAA,EACnE,EAAE,IAAA,EAAM,iBAAA,EAAmB,QAAA,EAAU,IAAA,EAAM,SAAS,kBAAA,EAAmB;AAAA,EACvE,EAAE,IAAA,EAAM,mBAAA,EAAqB,QAAA,EAAU,IAAA,EAAM,SAAS,oBAAA,EAAqB;AAAA,EAC3E,EAAE,IAAA,EAAM,WAAA,EAAa,QAAA,EAAU,IAAA,EAAM,SAAS,YAAA,EAAa;AAAA,EAC3D,EAAE,IAAA,EAAM,YAAA,EAAc,QAAA,EAAU,IAAA,EAAM,SAAS,aAAA,EAAc;AAAA,EAC7D,EAAE,IAAA,EAAM,OAAA,EAAS,QAAA,EAAU,IAAA,EAAM,SAAS,QAAA,EAAS;AAAA,EACnD,EAAE,IAAA,EAAM,oBAAA,EAAsB,QAAA,EAAU,IAAA,EAAM,SAAS,qBAAA,EAAsB;AAAA,EAC7E,EAAE,IAAA,EAAM,WAAA,EAAa,QAAA,EAAU,IAAA,EAAM,SAAS,YAAA,EAAa;AAAA;AAAA,EAE3D,EAAE,IAAA,EAAM,WAAA,EAAa,QAAA,EAAU,QAAA,EAAU,SAAS,YAAA,EAAa;AAAA,EAC/D,EAAE,IAAA,EAAM,SAAA,EAAW,QAAA,EAAU,QAAA,EAAU,SAAS,UAAA,EAAW;AAAA,EAC3D,EAAE,IAAA,EAAM,aAAA,EAAe,QAAA,EAAU,QAAA,EAAU,SAAS,cAAA,EAAe;AAAA,EACnE,EAAE,IAAA,EAAM,WAAA,EAAa,QAAA,EAAU,QAAA,EAAU,SAAS,YAAA,EAAa;AAAA,EAC/D,EAAE,IAAA,EAAM,aAAA,EAAe,QAAA,EAAU,QAAA,EAAU,SAAS,cAAA,EAAe;AAAA,EACnE,EAAE,IAAA,EAAM,UAAA,EAAY,QAAA,EAAU,QAAA,EAAU,SAAS,WAAA;AACnD,CAAA;;;ACpCO,IAAM,YAAA,GAAyC;AAAA,EACpD,SAAA,EAAW,CAAC,eAAA,EAAiB,YAAA,EAAc,uBAAuB,CAAA;AAAA,EAClE,OAAA,EAAS,CAAC,gBAAgB,CAAA;AAAA,EAC1B,QAAA,EAAU,CAAC,oBAAoB,CAAA;AAAA,EAC/B,mBAAA,EAAqB,CAAC,oBAAoB,CAAA;AAAA,EAC1C,SAAA,EAAW,CAAC,WAAA,EAAa,YAAA,EAAc,YAAY,CAAA;AAAA,EACnD,WAAA,EAAa,CAAC,WAAA,EAAa,UAAU,CAAA;AAAA,EACrC,SAAA,EAAW,CAAC,wBAAwB;AACtC;AAOO,SAAS,iBAAA,CAAkB,EAAA,EAAmB,UAAA,GAAa,kBAAA,EAAyC;AACzG,EAAA,IAAI,CAAC,IAAI,OAAO,IAAA;AAChB,EAAA,MAAM,GAAA,GAAM,WAAW,IAAA,CAAK,CAAC,MAAM,CAAA,CAAE,OAAA,CAAQ,IAAA,CAAK,EAAE,CAAC,CAAA;AACrD,EAAA,OAAO,GAAA,GAAM,EAAE,IAAA,EAAM,GAAA,CAAI,MAAM,QAAA,EAAU,GAAA,CAAI,UAAS,GAAI,IAAA;AAC5D;AASO,SAAS,QAAA,CAAS,OAAA,EAAkB,MAAA,GAAyB,MAAA,EAAuB;AACzF,EAAA,IAAI,OAAO,MAAA,KAAW,UAAA,EAAY,OAAO,OAAO,OAAO,CAAA;AACvD,EAAA,MAAM,IAAI,OAAA,CAAQ,OAAA;AAClB,EAAA,IAAI,MAAA,KAAW,YAAA,EAAc,OAAO,CAAA,CAAE,IAAI,kBAAkB,CAAA;AAC5D,EAAA,IAAI,MAAA,KAAW,UAAU,OAAO,CAAA,CAAE,IAAI,WAAW,CAAA,IAAK,CAAA,CAAE,GAAA,CAAI,wBAAwB,CAAA;AACpF,EAAA,OAAO,CAAA,CAAE,GAAA,CAAI,kBAAkB,CAAA,IAAK,CAAA,CAAE,IAAI,WAAW,CAAA,IAAK,CAAA,CAAE,GAAA,CAAI,wBAAwB,CAAA;AAC1F;AAaA,eAAe,YAAA,GAA4C;AACzD,EAAA,IAAI;AACF,IAAA,MAAM,MAAO,MAAM;AAAA;AAAA;AAAA,MAAoD;AAAA,KAA6B;AACpG,IAAA,OAAO;AAAA,MACL,OAAA,EAAS,CAAC,EAAA,KAAO,GAAA,CAAI,QAAQ,EAAE,CAAA;AAAA,MAC/B,QAAQ,OAAO,IAAA,KAAA,CAAU,MAAM,GAAA,CAAI,OAAO,IAAA,EAAM,EAAE,GAAA,EAAK,IAAA,EAAM,CAAA,EAAG,GAAA,CAAI,CAAC,CAAA,KAAM,EAAE,OAAO;AAAA,KACtF;AAAA,EACF,CAAA,CAAA,MAAQ;AACN,IAAA,OAAO,IAAA;AAAA,EACT;AACF;AAEA,IAAM,SAAA,uBAAgB,GAAA,EAA2D;AAOjF,eAAsB,aAAA,CACpB,KAAA,EACA,EAAA,EACA,QAAA,EAC8B;AAC9B,EAAA,MAAM,OAAA,GAAU,YAAA,CAAa,KAAA,CAAM,IAAI,CAAA;AACvC,EAAA,IAAI,CAAC,OAAA,EAAS,OAAO,EAAE,MAAA,EAAQ,cAAc,IAAA,EAAM,KAAA,CAAM,IAAA,EAAM,MAAA,EAAQ,2BAAA,EAA4B;AACnG,EAAA,IAAI,CAAC,EAAA,EAAI,OAAO,EAAE,MAAA,EAAQ,cAAc,IAAA,EAAM,KAAA,CAAM,IAAA,EAAM,MAAA,EAAQ,mBAAA,EAAoB;AAEtF,EAAA,MAAM,GAAA,GAAM,CAAA,EAAG,KAAA,CAAM,IAAI,IAAI,EAAE,CAAA,CAAA;AAC/B,EAAA,MAAM,GAAA,GAAM,SAAA,CAAU,GAAA,CAAI,GAAG,CAAA;AAC7B,EAAA,IAAI,GAAA,IAAO,GAAA,CAAI,KAAA,GAAQ,IAAA,CAAK,KAAI,EAAG;AACjC,IAAA,OAAO,GAAA,CAAI,KACP,EAAE,MAAA,EAAQ,YAAY,IAAA,EAAM,KAAA,CAAM,MAAM,IAAA,EAAM,GAAA,CAAI,MAAO,EAAA,EAAG,GAC5D,EAAE,MAAA,EAAQ,YAAA,EAAc,MAAM,KAAA,CAAM,IAAA,EAAM,QAAQ,eAAA,EAAgB;AAAA,EACxE;AAEA,EAAA,MAAM,GAAA,GAAM,QAAA,IAAa,MAAM,YAAA,EAAa;AAC5C,EAAA,IAAI,CAAC,GAAA,EAAK,OAAO,EAAE,MAAA,EAAQ,cAAc,IAAA,EAAM,KAAA,CAAM,IAAA,EAAM,MAAA,EAAQ,4BAAA,EAA6B;AAEhG,EAAA,MAAM,QAAA,GAAW,CAAC,EAAA,EAAa,IAAA,KAAkB;AAC/C,IAAA,IAAI,SAAA,CAAU,IAAA,GAAO,GAAA,EAAM,SAAA,CAAU,MAAA,CAAO,UAAU,IAAA,EAAK,CAAE,IAAA,EAAK,CAAE,KAAe,CAAA;AACnF,IAAA,SAAA,CAAU,IAAI,GAAA,EAAK,EAAE,IAAI,GAAI,IAAA,GAAO,EAAE,IAAA,EAAK,GAAI,EAAC,EAAI,OAAO,IAAA,CAAK,GAAA,MAAS,EAAA,GAAK,IAAA,GAAW,MAAU,CAAA;AAAA,EACrG,CAAA;AACA,EAAA,IAAI;AACF,IAAA,MAAM,KAAA,GAAQ,MAAM,GAAA,CAAI,OAAA,CAAQ,EAAE,CAAA;AAClC,IAAA,KAAA,MAAW,QAAQ,KAAA,EAAO;AACxB,MAAA,MAAM,OAAO,IAAA,CAAK,WAAA,EAAY,CAAE,OAAA,CAAQ,OAAO,EAAE,CAAA;AACjD,MAAA,IAAI,CAAC,OAAA,CAAQ,IAAA,CAAK,CAAC,CAAA,KAAM,IAAA,KAAS,CAAA,IAAK,IAAA,CAAK,QAAA,CAAS,CAAA,CAAA,EAAI,CAAC,CAAA,CAAE,CAAC,CAAA,EAAG;AAChE,MAAA,MAAM,OAAA,GAAU,MAAM,GAAA,CAAI,MAAA,CAAO,IAAI,CAAA;AACrC,MAAA,IAAI,OAAA,CAAQ,QAAA,CAAS,EAAE,CAAA,EAAG;AACxB,QAAA,QAAA,CAAS,MAAM,IAAI,CAAA;AACnB,QAAA,OAAO,EAAE,MAAA,EAAQ,UAAA,EAAY,MAAM,KAAA,CAAM,IAAA,EAAM,MAAM,EAAA,EAAG;AAAA,MAC1D;AAAA,IACF;AACA,IAAA,QAAA,CAAS,KAAK,CAAA;AACd,IAAA,OAAO,EAAE,MAAA,EAAQ,YAAA,EAAc,MAAM,KAAA,CAAM,IAAA,EAAM,QAAQ,eAAA,EAAgB;AAAA,EAC3E,CAAA,CAAA,MAAQ;AACN,IAAA,OAAO,EAAE,MAAA,EAAQ,YAAA,EAAc,MAAM,KAAA,CAAM,IAAA,EAAM,QAAQ,oBAAA,EAAqB;AAAA,EAChF;AACF;;;AC/GO,IAAM,UAAN,MAAc;AAAA,EACnB,YAAqB,KAAA,EAAe;AAAf,IAAA,IAAA,CAAA,KAAA,GAAA,KAAA;AAAA,EAAgB;AAAA,EAAhB,KAAA;AACvB,CAAA;AACO,IAAM,YAAN,MAAgB;AAAA,EACrB,YAAqB,KAAA,EAAe;AAAf,IAAA,IAAA,CAAA,KAAA,GAAA,KAAA;AAAA,EAAgB;AAAA,EAAhB,KAAA;AACvB,CAAA;AAcO,IAAM,WAAA,GAAc,CAAC,CAAA,KAA8B,OAAA,IAAW,CAAA;AAE9D,IAAM,YAAA,GAAN,cAA2B,KAAA,CAAM;AAAC,CAAA;AAEzC,IAAM,SAAN,MAAa;AAAA,EAEX,YAA6B,CAAA,EAAW;AAAX,IAAA,IAAA,CAAA,CAAA,GAAA,CAAA;AAAA,EAAY;AAAA,EAAZ,CAAA;AAAA,EAD7B,CAAA,GAAI,CAAA;AAAA,EAEJ,IAAI,IAAA,GAAO;AACT,IAAA,OAAO,IAAA,CAAK,CAAA,IAAK,IAAA,CAAK,CAAA,CAAE,MAAA;AAAA,EAC1B;AAAA,EACA,IAAA,GAAO;AACL,IAAA,OAAO,IAAA,CAAK,CAAA,CAAE,IAAA,CAAK,CAAC,CAAA,IAAK,EAAA;AAAA,EAC3B;AAAA,EACA,KAAK,IAAA,EAAqB;AACxB,IAAA,MAAM,IAAI,YAAA,CAAa,CAAA,EAAG,IAAI,CAAA,IAAA,EAAO,IAAA,CAAK,CAAC,CAAA,CAAE,CAAA;AAAA,EAC/C;AAAA,EACA,EAAA,GAAK;AACH,IAAA,OAAO,IAAA,CAAK,IAAA,EAAK,KAAM,GAAA,EAAK,IAAA,CAAK,CAAA,EAAA;AAAA,EACnC;AAAA,EACA,GAAA,GAAM;AACJ,IAAA,OAAO,IAAA,CAAK,MAAK,KAAM,GAAA,IAAO,KAAK,IAAA,EAAK,KAAM,KAAM,IAAA,CAAK,CAAA,EAAA;AAAA,EAC3D;AAAA,EAEA,GAAA,GAAc;AACZ,IAAA,MAAM,CAAA,GAAI,KAAK,IAAA,EAAK;AACpB,IAAA,IAAI,CAAC,QAAA,CAAS,IAAA,CAAK,CAAC,CAAA,EAAG,IAAA,CAAK,KAAK,aAAa,CAAA;AAC9C,IAAA,IAAI,GAAA,GAAM,EAAA;AACV,IAAA,OAAO,eAAA,CAAgB,IAAA,CAAK,IAAA,CAAK,IAAA,EAAM,GAAG,GAAA,IAAO,IAAA,CAAK,CAAA,CAAE,IAAA,CAAK,CAAA,EAAG,CAAA;AAChE,IAAA,OAAO,GAAA;AAAA,EACT;AAAA,EAEA,MAAA,GAAiB;AACf,IAAA,MAAM,MAAc,EAAC;AACrB,IAAA,OAAO,IAAA,CAAK,IAAA,EAAK,KAAM,GAAA,EAAK;AAC1B,MAAA,IAAA,CAAK,CAAA,EAAA;AACL,MAAA,IAAA,CAAK,EAAA,EAAG;AACR,MAAA,MAAM,CAAA,GAAI,KAAK,GAAA,EAAI;AACnB,MAAA,IAAI,CAAA,GAAc,IAAA;AAClB,MAAA,IAAI,IAAA,CAAK,IAAA,EAAK,KAAM,GAAA,EAAK;AACvB,QAAA,IAAA,CAAK,CAAA,EAAA;AACL,QAAA,CAAA,GAAI,KAAK,QAAA,EAAS;AAAA,MACpB;AACA,MAAA,MAAM,QAAA,GAAW,IAAI,SAAA,CAAU,CAAC,CAAC,EAAE,CAAA,KAAM,OAAO,CAAC,CAAA;AACjD,MAAA,IAAI,YAAY,CAAA,EAAG,GAAA,CAAI,QAAQ,CAAA,GAAI,CAAC,GAAG,CAAC,CAAA;AAAA,WACnC,GAAA,CAAI,IAAA,CAAK,CAAC,CAAA,EAAG,CAAC,CAAC,CAAA;AAAA,IACtB;AACA,IAAA,OAAO,GAAA;AAAA,EACT;AAAA,EAEA,QAAA,GAAqB;AACnB,IAAA,MAAM,CAAA,GAAI,KAAK,IAAA,EAAK;AACpB,IAAA,IAAI,CAAA,KAAM,OAAO,OAAA,CAAQ,IAAA,CAAK,CAAC,CAAA,EAAG,OAAO,KAAK,MAAA,EAAO;AACrD,IAAA,IAAI,CAAA,KAAM,GAAA,EAAK,OAAO,IAAA,CAAK,MAAA,EAAO;AAClC,IAAA,IAAI,CAAA,KAAM,GAAA,EAAK,OAAO,IAAA,CAAK,KAAA,EAAM;AACjC,IAAA,IAAI,CAAA,KAAM,GAAA,EAAK,OAAO,IAAA,CAAK,OAAA,EAAQ;AACnC,IAAA,IAAI,YAAY,IAAA,CAAK,CAAC,CAAA,EAAG,OAAO,KAAK,KAAA,EAAM;AAC3C,IAAA,OAAO,IAAA,CAAK,KAAK,mBAAmB,CAAA;AAAA,EACtC;AAAA,EAEA,MAAA,GAA6B;AAC3B,IAAA,IAAI,IAAA,GAAO,CAAA;AACX,IAAA,IAAI,IAAA,CAAK,IAAA,EAAK,KAAM,GAAA,EAAK;AACvB,MAAA,IAAA,GAAO,EAAA;AACP,MAAA,IAAA,CAAK,CAAA,EAAA;AAAA,IACP;AACA,IAAA,IAAI,GAAA,GAAM,EAAA;AACV,IAAA,IAAI,SAAA,GAAY,KAAA;AAChB,IAAA,OAAO,CAAC,KAAK,IAAA,EAAM;AACjB,MAAA,MAAM,CAAA,GAAI,KAAK,IAAA,EAAK;AACpB,MAAA,IAAI,OAAA,CAAQ,IAAA,CAAK,CAAC,CAAA,EAAG,GAAA,IAAO,CAAA;AAAA,WAAA,IACnB,CAAA,KAAM,GAAA,IAAO,CAAC,SAAA,EAAW;AAChC,QAAA,IAAI,GAAA,CAAI,MAAA,GAAS,EAAA,EAAI,IAAA,CAAK,KAAK,+BAA+B,CAAA;AAC9D,QAAA,SAAA,GAAY,IAAA;AACZ,QAAA,GAAA,IAAO,CAAA;AAAA,MACT,CAAA,MAAO;AACP,MAAA,IAAA,CAAK,CAAA,EAAA;AACL,MAAA,IAAI,CAAC,SAAA,IAAa,GAAA,CAAI,SAAS,EAAA,EAAI,IAAA,CAAK,KAAK,kBAAkB,CAAA;AAC/D,MAAA,IAAI,aAAa,GAAA,CAAI,MAAA,GAAS,EAAA,EAAI,IAAA,CAAK,KAAK,kBAAkB,CAAA;AAAA,IAChE;AACA,IAAA,IAAI,CAAC,OAAA,CAAQ,IAAA,CAAK,GAAA,CAAI,CAAC,KAAK,EAAE,CAAA,EAAG,IAAA,CAAK,IAAA,CAAK,gBAAgB,CAAA;AAC3D,IAAA,IAAI,SAAA,EAAW;AACb,MAAA,IAAI,IAAI,QAAA,CAAS,GAAG,CAAA,EAAG,IAAA,CAAK,KAAK,uBAAuB,CAAA;AACxD,MAAA,IAAI,GAAA,CAAI,KAAA,CAAM,GAAG,CAAA,CAAE,CAAC,EAAG,MAAA,GAAS,CAAA,EAAG,IAAA,CAAK,IAAA,CAAK,2BAA2B,CAAA;AACxE,MAAA,OAAO,IAAI,SAAA,CAAU,IAAA,GAAO,MAAA,CAAO,GAAG,CAAC,CAAA;AAAA,IACzC;AACA,IAAA,OAAO,IAAA,GAAO,OAAO,GAAG,CAAA;AAAA,EAC1B;AAAA,EAEA,MAAA,GAAiB;AACf,IAAA,IAAA,CAAK,CAAA,EAAA;AACL,IAAA,IAAI,GAAA,GAAM,EAAA;AACV,IAAA,OAAO,CAAC,KAAK,IAAA,EAAM;AACjB,MAAA,MAAM,CAAA,GAAI,IAAA,CAAK,CAAA,CAAE,IAAA,CAAK,CAAA,EAAG,CAAA;AACzB,MAAA,IAAI,MAAM,IAAA,EAAM;AACd,QAAA,MAAM,CAAA,GAAI,IAAA,CAAK,CAAA,CAAE,IAAA,CAAK,CAAA,EAAG,CAAA;AACzB,QAAA,IAAI,MAAM,GAAA,IAAO,CAAA,KAAM,IAAA,EAAM,IAAA,CAAK,KAAK,gBAAgB,CAAA;AACvD,QAAA,GAAA,IAAO,CAAA;AAAA,MACT,CAAA,MAAA,IAAW,CAAA,KAAM,GAAA,EAAK,OAAO,GAAA;AAAA,WACxB;AACH,QAAA,MAAM,IAAA,GAAO,CAAA,CAAE,UAAA,CAAW,CAAC,CAAA;AAC3B,QAAA,IAAI,OAAO,EAAA,IAAQ,IAAA,GAAO,GAAA,EAAM,IAAA,CAAK,KAAK,qBAAqB,CAAA;AAC/D,QAAA,GAAA,IAAO,CAAA;AAAA,MACT;AAAA,IACF;AACA,IAAA,OAAO,IAAA,CAAK,KAAK,qBAAqB,CAAA;AAAA,EACxC;AAAA,EAEA,KAAA,GAAiB;AACf,IAAA,IAAI,GAAA,GAAM,EAAA;AACV,IAAA,OAAO,+BAAA,CAAgC,IAAA,CAAK,IAAA,CAAK,IAAA,EAAM,CAAA,IAAK,CAAC,IAAA,CAAK,IAAA,EAAM,GAAA,IAAO,IAAA,CAAK,CAAA,CAAE,KAAK,CAAA,EAAG,CAAA;AAC9F,IAAA,OAAO,IAAI,QAAQ,GAAG,CAAA;AAAA,EACxB;AAAA,EAEA,KAAA,GAAoB;AAClB,IAAA,IAAA,CAAK,CAAA,EAAA;AACL,IAAA,MAAM,MAAM,IAAA,CAAK,CAAA,CAAE,OAAA,CAAQ,GAAA,EAAK,KAAK,CAAC,CAAA;AACtC,IAAA,IAAI,GAAA,GAAM,CAAA,EAAG,IAAA,CAAK,IAAA,CAAK,4BAA4B,CAAA;AACnD,IAAA,MAAM,MAAM,IAAA,CAAK,CAAA,CAAE,KAAA,CAAM,IAAA,CAAK,GAAG,GAAG,CAAA;AACpC,IAAA,IAAI,CAAC,mBAAA,CAAoB,IAAA,CAAK,GAAG,CAAA,EAAG,IAAA,CAAK,KAAK,gBAAgB,CAAA;AAC9D,IAAA,IAAA,CAAK,IAAI,GAAA,GAAM,CAAA;AACf,IAAA,OAAO,cAAc,GAAG,CAAA;AAAA,EAC1B;AAAA,EAEA,OAAA,GAAmB;AACjB,IAAA,IAAA,CAAK,CAAA,EAAA;AACL,IAAA,MAAM,CAAA,GAAI,IAAA,CAAK,CAAA,CAAE,IAAA,CAAK,CAAA,EAAG,CAAA;AACzB,IAAA,IAAI,CAAA,KAAM,KAAK,OAAO,IAAA;AACtB,IAAA,IAAI,CAAA,KAAM,KAAK,OAAO,KAAA;AACtB,IAAA,OAAO,IAAA,CAAK,KAAK,iBAAiB,CAAA;AAAA,EACpC;AAAA,EAEA,IAAA,GAAa;AACX,IAAA,MAAM,KAAA,GAAQ,KAAK,QAAA,EAAS;AAC5B,IAAA,OAAO,EAAE,KAAA,EAAO,MAAA,EAAQ,IAAA,CAAK,QAAO,EAAE;AAAA,EACxC;AAAA,EAEA,SAAA,GAAuB;AACrB,IAAA,IAAA,CAAK,CAAA,EAAA;AACL,IAAA,MAAM,QAAgB,EAAC;AACvB,IAAA,OAAO,CAAC,KAAK,IAAA,EAAM;AACjB,MAAA,IAAA,CAAK,EAAA,EAAG;AACR,MAAA,IAAI,IAAA,CAAK,IAAA,EAAK,KAAM,GAAA,EAAK;AACvB,QAAA,IAAA,CAAK,CAAA,EAAA;AACL,QAAA,OAAO,EAAE,KAAA,EAAO,MAAA,EAAQ,IAAA,CAAK,QAAO,EAAE;AAAA,MACxC;AACA,MAAA,KAAA,CAAM,IAAA,CAAK,IAAA,CAAK,IAAA,EAAM,CAAA;AACtB,MAAA,MAAM,CAAA,GAAI,KAAK,IAAA,EAAK;AACpB,MAAA,IAAI,MAAM,GAAA,IAAO,CAAA,KAAM,GAAA,EAAK,IAAA,CAAK,KAAK,oBAAoB,CAAA;AAAA,IAC5D;AACA,IAAA,OAAO,IAAA,CAAK,KAAK,yBAAyB,CAAA;AAAA,EAC5C;AAAA,EAEA,MAAA,GAAiB;AACf,IAAA,OAAO,IAAA,CAAK,MAAK,KAAM,GAAA,GAAM,KAAK,SAAA,EAAU,GAAI,KAAK,IAAA,EAAK;AAAA,EAC5D;AAAA,EAEA,UAAA,GAAyB;AACvB,IAAA,MAAM,GAAA,uBAAsB,GAAA,EAAI;AAChC,IAAA,IAAA,CAAK,EAAA,EAAG;AACR,IAAA,OAAO,CAAC,KAAK,IAAA,EAAM;AACjB,MAAA,MAAM,CAAA,GAAI,KAAK,GAAA,EAAI;AACnB,MAAA,IAAI,CAAA;AACJ,MAAA,IAAI,IAAA,CAAK,IAAA,EAAK,KAAM,GAAA,EAAK;AACvB,QAAA,IAAA,CAAK,CAAA,EAAA;AACL,QAAA,CAAA,GAAI,KAAK,MAAA,EAAO;AAAA,MAClB,CAAA,MAAO;AACL,QAAA,CAAA,GAAI,EAAE,KAAA,EAAO,IAAA,EAAM,MAAA,EAAQ,IAAA,CAAK,QAAO,EAAE;AAAA,MAC3C;AACA,MAAA,GAAA,CAAI,GAAA,CAAI,GAAG,CAAC,CAAA;AACZ,MAAA,IAAA,CAAK,GAAA,EAAI;AACT,MAAA,IAAI,IAAA,CAAK,MAAM,OAAO,GAAA;AACtB,MAAA,IAAI,KAAK,IAAA,EAAK,KAAM,GAAA,EAAK,IAAA,CAAK,KAAK,gBAAgB,CAAA;AACnD,MAAA,IAAA,CAAK,CAAA,EAAA;AACL,MAAA,IAAA,CAAK,GAAA,EAAI;AACT,MAAA,IAAI,IAAA,CAAK,IAAA,EAAM,IAAA,CAAK,IAAA,CAAK,gBAAgB,CAAA;AAAA,IAC3C;AACA,IAAA,OAAO,GAAA;AAAA,EACT;AACF,CAAA;AAEA,SAAS,QAAA,CAAY,OAAe,EAAA,EAAyB;AAC3D,EAAA,MAAM,CAAA,GAAI,IAAI,MAAA,CAAO,KAAA,CAAM,MAAM,CAAA;AACjC,EAAA,MAAM,GAAA,GAAM,GAAG,CAAC,CAAA;AAChB,EAAA,CAAA,CAAE,EAAA,EAAG;AACL,EAAA,IAAI,CAAC,CAAA,CAAE,IAAA,EAAM,CAAA,CAAE,KAAK,qBAAqB,CAAA;AACzC,EAAA,OAAO,GAAA;AACT;AAEO,IAAM,eAAA,GAAkB,CAAC,KAAA,KAAkB,QAAA,CAAS,OAAO,CAAC,CAAA,KAAM,CAAA,CAAE,UAAA,EAAY,CAAA;AAChF,IAAM,SAAA,GAAY,CAAC,KAAA,KAAkB,QAAA,CAAS,OAAO,CAAC,CAAA,KAAM,CAAA,CAAE,IAAA,EAAM,CAAA;AAIpE,SAAS,kBAAkB,CAAA,EAAqB;AACrD,EAAA,IAAI,OAAO,CAAA,KAAM,SAAA,EAAW,OAAO,IAAI,IAAA,GAAO,IAAA;AAC9C,EAAA,IAAI,OAAO,MAAM,QAAA,EAAU;AACzB,IAAA,IAAI,CAAC,OAAO,SAAA,CAAU,CAAC,GAAG,MAAM,IAAI,aAAa,mCAAmC,CAAA;AACpF,IAAA,OAAO,OAAO,CAAC,CAAA;AAAA,EACjB;AACA,EAAA,IAAI,aAAa,SAAA,EAAW;AAC1B,IAAA,MAAM,CAAA,GAAA,CAAK,KAAK,KAAA,CAAM,CAAA,CAAE,QAAQ,GAAI,CAAA,GAAI,KAAM,QAAA,EAAS;AACvD,IAAA,OAAO,EAAE,QAAA,CAAS,GAAG,CAAA,GAAI,CAAA,GAAI,GAAG,CAAC,CAAA,EAAA,CAAA;AAAA,EACnC;AACA,EAAA,IAAI,CAAA,YAAa,OAAA,EAAS,OAAO,CAAA,CAAE,KAAA;AACnC,EAAA,IAAI,aAAa,UAAA,EAAY,OAAO,CAAA,CAAA,EAAI,aAAA,CAAc,CAAC,CAAC,CAAA,CAAA,CAAA;AACxD,EAAA,OAAO,CAAA,CAAA,EAAI,EAAE,OAAA,CAAQ,KAAA,EAAO,MAAM,CAAA,CAAE,OAAA,CAAQ,IAAA,EAAM,KAAK,CAAC,CAAA,CAAA,CAAA;AAC1D;AAEO,IAAM,eAAA,GAAkB,CAAC,MAAA,KAC9B,MAAA,CAAO,GAAA,CAAI,CAAC,CAAC,CAAA,EAAG,CAAC,CAAA,KAAO,CAAA,KAAM,IAAA,GAAO,IAAI,CAAC,CAAA,CAAA,GAAK,CAAA,CAAA,EAAI,CAAC,CAAA,CAAA,EAAI,iBAAA,CAAkB,CAAC,CAAC,CAAA,CAAG,CAAA,CAAE,IAAA,CAAK,EAAE,CAAA;AAEnF,IAAM,aAAA,GAAgB,CAAC,IAAA,KAAe,iBAAA,CAAkB,KAAK,KAAK,CAAA,GAAI,eAAA,CAAgB,IAAA,CAAK,MAAM,CAAA;AAEjG,IAAM,qBAAqB,CAAC,IAAA,KACjC,CAAA,CAAA,EAAI,IAAA,CAAK,MAAM,GAAA,CAAI,aAAa,CAAA,CAAE,IAAA,CAAK,GAAG,CAAC,CAAA,CAAA,EAAI,eAAA,CAAgB,IAAA,CAAK,MAAM,CAAC,CAAA,CAAA;AAEtE,IAAM,eAAA,GAAkB,CAAC,CAAA,KAAe,WAAA,CAAY,CAAC,IAAI,kBAAA,CAAmB,CAAC,CAAA,GAAI,aAAA,CAAc,CAAC,CAAA;AAShG,IAAM,QAAA,GAAW,CAAC,MAAA,EAAgB,GAAA,KACvC,MAAA,CAAO,IAAA,CAAK,CAAC,CAAC,CAAC,CAAA,KAAM,CAAA,KAAM,GAAG,IAAI,CAAC,CAAA;AAI9B,SAAS,cAAc,GAAA,EAAyB;AACrD,EAAA,MAAM,GAAA,GAAM,KAAK,GAAG,CAAA;AACpB,EAAA,MAAM,GAAA,GAAM,IAAI,UAAA,CAAW,GAAA,CAAI,MAAM,CAAA;AACrC,EAAA,KAAA,IAAS,CAAA,GAAI,CAAA,EAAG,CAAA,GAAI,GAAA,CAAI,MAAA,EAAQ,CAAA,EAAA,EAAK,GAAA,CAAI,CAAC,CAAA,GAAI,GAAA,CAAI,UAAA,CAAW,CAAC,CAAA;AAC9D,EAAA,OAAO,GAAA;AACT;AAEO,SAAS,cAAc,KAAA,EAA2B;AACvD,EAAA,IAAI,GAAA,GAAM,EAAA;AACV,EAAA,KAAA,MAAW,CAAA,IAAK,KAAA,EAAO,GAAA,IAAO,MAAA,CAAO,aAAa,CAAC,CAAA;AACnD,EAAA,OAAO,KAAK,GAAG,CAAA;AACjB;AAEO,IAAM,mBAAmB,CAAC,KAAA,KAC/B,aAAA,CAAc,KAAK,EAAE,OAAA,CAAQ,KAAA,EAAO,GAAG,CAAA,CAAE,QAAQ,KAAA,EAAO,GAAG,CAAA,CAAE,OAAA,CAAQ,OAAO,EAAE,CAAA;;;AC7PzE,IAAM,cAAA,GAAN,cAA6B,KAAA,CAAM;AAAA,EACxC,WAAA,CACW,MACT,OAAA,EACA;AACA,IAAA,KAAA,CAAM,WAAW,IAAI,CAAA;AAHZ,IAAA,IAAA,CAAA,IAAA,GAAA,IAAA;AAAA,EAIX;AAAA,EAJW,IAAA;AAKb,CAAA;AASA,IAAM,OAAA,uBAAc,GAAA,CAAI;AAAA,EACtB,SAAA;AAAA,EACA,aAAA;AAAA,EACA,YAAA;AAAA,EACA,SAAA;AAAA,EACA,iBAAA;AAAA,EACA,OAAA;AAAA,EACA,QAAA;AAAA,EACA;AACF,CAAC,CAAA;AAGM,SAAS,cAAA,CAAe,IAAU,GAAA,EAA+B;AACtE,EAAA,IAAI,OAAO,GAAG,KAAA,KAAU,QAAA,QAAgB,IAAI,cAAA,CAAe,qBAAqB,+BAA+B,CAAA;AAC/G,EAAA,MAAM,OAAO,EAAA,CAAG,KAAA;AAChB,EAAA,MAAM,EAAE,KAAI,GAAI,GAAA;AAEhB,EAAA,IAAI,IAAA,CAAK,UAAA,CAAW,GAAG,CAAA,EAAG;AACxB,IAAA,IAAI,CAAC,QAAQ,GAAA,CAAI,IAAI,GAAG,MAAM,IAAI,cAAA,CAAe,uBAAA,EAAyB,IAAI,CAAA;AAC9E,IAAA,QAAQ,IAAA;AAAM,MACZ,KAAK,SAAA;AACH,QAAA,OAAO,GAAA,CAAI,OAAA,CAAQ,MAAA,CAAO,WAAA,EAAY;AAAA,MACxC,KAAK,aAAA;AACH,QAAA,OAAO,GAAA,CAAI,IAAA;AAAA,MACb,KAAK,YAAA;AACH,QAAA,OAAA,CAAQ,GAAA,CAAI,SAAA,IAAa,GAAA,CAAI,IAAA,EAAM,WAAA,EAAY;AAAA,MACjD,KAAK,SAAA;AACH,QAAA,OAAO,IAAI,QAAA,CAAS,OAAA,CAAQ,IAAA,EAAM,EAAE,EAAE,WAAA,EAAY;AAAA,MACpD,KAAK,iBAAA;AACH,QAAA,OAAO,GAAA,CAAI,WAAW,GAAA,CAAI,MAAA;AAAA,MAC5B,KAAK,OAAA;AACH,QAAA,OAAO,IAAI,QAAA,IAAY,GAAA;AAAA,MACzB,KAAK,QAAA;AACH,QAAA,OAAO,IAAI,MAAA,IAAU,GAAA;AAAA,MACvB,KAAK,cAAA,EAAgB;AACnB,QAAA,MAAM,KAAA,GAAQ,QAAA,CAAS,EAAA,CAAG,MAAA,EAAQ,MAAM,CAAA;AACxC,QAAA,IAAI,OAAO,KAAA,KAAU,QAAA,QAAgB,IAAI,cAAA,CAAe,qBAAqB,yBAAyB,CAAA;AACtG,QAAA,MAAM,MAAA,GAAS,GAAA,CAAI,YAAA,CAAa,MAAA,CAAO,KAAK,CAAA;AAC5C,QAAA,IAAI,MAAA,CAAO,WAAW,CAAA,EAAG,MAAM,IAAI,cAAA,CAAe,mBAAA,EAAqB,CAAA,aAAA,EAAgB,KAAK,CAAA,CAAE,CAAA;AAC9F,QAAA,OAAO,kBAAA,CAAmB,MAAA,CAAO,CAAC,CAAE,CAAA;AAAA,MACtC;AAAA;AACF,EACF;AAMA,EAAA,KAAA,MAAW,CAAC,CAAC,CAAA,IAAK,EAAA,CAAG,MAAA,EAAQ;AAC3B,IAAA,IAAI,CAAA,KAAM,OAAO,MAAM,IAAI,eAAe,uBAAA,EAAyB,CAAA,MAAA,EAAS,CAAC,CAAA,CAAE,CAAA;AAAA,EACjF;AACA,EAAA,MAAM,GAAA,GAAM,GAAA,CAAI,OAAA,CAAQ,OAAA,CAAQ,IAAI,IAAI,CAAA;AACxC,EAAA,IAAI,QAAQ,IAAA,EAAM,MAAM,IAAI,cAAA,CAAe,qBAAqB,IAAI,CAAA;AACpE,EAAA,MAAM,KAAA,GAAQ,IAAI,IAAA,EAAK;AAEvB,EAAA,MAAM,GAAA,GAAM,QAAA,CAAS,EAAA,CAAG,MAAA,EAAQ,KAAK,CAAA;AACrC,EAAA,IAAI,OAAO,QAAQ,QAAA,EAAU;AAC3B,IAAA,IAAI,IAAA;AACJ,IAAA,IAAI;AACF,MAAA,IAAA,GAAO,gBAAgB,KAAK,CAAA;AAAA,IAC9B,SAAS,CAAA,EAAG;AACV,MAAA,MAAM,IAAI,eAAe,mBAAA,EAAqB,CAAA,EAAG,IAAI,CAAA,sBAAA,EAA0B,CAAA,CAAY,OAAO,CAAA,CAAE,CAAA;AAAA,IACtG;AACA,IAAA,MAAM,MAAA,GAAS,IAAA,CAAK,GAAA,CAAI,GAAG,CAAA;AAC3B,IAAA,IAAI,CAAC,MAAA,EAAQ,MAAM,IAAI,cAAA,CAAe,qBAAqB,CAAA,EAAG,IAAI,CAAA,KAAA,EAAQ,GAAG,CAAA,CAAE,CAAA;AAC/E,IAAA,OAAO,gBAAgB,MAAM,CAAA;AAAA,EAC/B;AACA,EAAA,OAAO,KAAA;AACT;AAGO,SAAS,aAAA,CAAc,OAAkB,GAAA,EAA+B;AAC7E,EAAA,MAAM,IAAA,uBAAW,GAAA,EAAY;AAC7B,EAAA,MAAM,QAAkB,EAAC;AACzB,EAAA,KAAA,MAAW,EAAA,IAAM,MAAM,KAAA,EAAO;AAC5B,IAAA,MAAM,KAAA,GAAQ,cAAc,EAAE,CAAA;AAC9B,IAAA,IAAI,IAAA,CAAK,IAAI,KAAK,CAAA,QAAS,IAAI,cAAA,CAAe,uBAAuB,KAAK,CAAA;AAC1E,IAAA,IAAA,CAAK,IAAI,KAAK,CAAA;AACd,IAAA,KAAA,CAAM,IAAA,CAAK,GAAG,KAAK,CAAA,EAAA,EAAK,eAAe,EAAA,EAAI,GAAG,CAAC,CAAA,CAAE,CAAA;AAAA,EACnD;AACA,EAAA,KAAA,CAAM,IAAA,CAAK,CAAA,qBAAA,EAAwB,kBAAA,CAAmB,KAAK,CAAC,CAAA,CAAE,CAAA;AAC9D,EAAA,OAAO,KAAA,CAAM,KAAK,IAAI,CAAA;AACxB;AAyBA,IAAM,IAAA,GAGF;AAAA,EACF,OAAA,EAAS,EAAE,GAAA,EAAK,KAAA,EAAO,KAAK,SAAA,EAAW,SAAA,EAAW,EAAE,IAAA,EAAM,WAAU,EAAG,SAAA,EAAW,EAAE,IAAA,EAAM,WAAU,EAAE;AAAA,EACtG,gBAAA,EAAkB;AAAA,IAChB,GAAA,EAAK,KAAA;AAAA,IACL,SAAA,EAAW,EAAE,IAAA,EAAM,SAAA,EAAW,MAAM,SAAA,EAAU;AAAA,IAC9C,SAAA,EAAW,EAAE,IAAA,EAAM,SAAA,EAAW,YAAY,EAAA;AAAG,GAC/C;AAAA,EACA,iBAAA,EAAmB;AAAA,IACjB,GAAA,EAAK,KAAA;AAAA,IACL,SAAA,EAAW,EAAE,IAAA,EAAM,mBAAA,EAAqB,MAAM,SAAA,EAAU;AAAA,IACxD,SAAA,EAAW,EAAE,IAAA,EAAM,mBAAA;AAAoB,GACzC;AAAA,EACA,mBAAA,EAAqB;AAAA,IACnB,GAAA,EAAK,IAAA;AAAA,IACL,GAAA,EAAK,OAAA;AAAA,IACL,SAAA,EAAW,EAAE,IAAA,EAAM,OAAA,EAAS,YAAY,OAAA,EAAQ;AAAA,IAChD,SAAA,EAAW,EAAE,IAAA,EAAM,OAAA,EAAS,MAAM,SAAA;AAAU,GAC9C;AAAA,EACA,mBAAA,EAAqB;AAAA,IACnB,GAAA,EAAK,IAAA;AAAA,IACL,GAAA,EAAK,OAAA;AAAA,IACL,SAAA,EAAW,EAAE,IAAA,EAAM,OAAA,EAAS,YAAY,OAAA,EAAQ;AAAA,IAChD,SAAA,EAAW,EAAE,IAAA,EAAM,OAAA,EAAS,MAAM,SAAA;AAAU;AAEhD,CAAA;AAGO,SAAS,gBAAA,CAAiB,KAAgB,QAAA,EAAuC;AACtF,EAAA,IAAI,OAAO,aAAa,QAAA,EAAU;AAChC,IAAA,MAAM,IAAA,GAAO,KAAK,QAA8B,CAAA;AAChD,IAAA,IAAI,CAAC,IAAA,EAAM,MAAM,IAAI,cAAA,CAAe,mBAAmB,QAAQ,CAAA;AAC/D,IAAA,IAAI,IAAA,CAAK,QAAQ,GAAA,CAAI,GAAA,IAAQ,KAAK,GAAA,IAAO,IAAA,CAAK,GAAA,KAAQ,GAAA,CAAI,GAAA,EAAM;AAC9D,MAAA,MAAM,IAAI,cAAA,CAAe,kBAAA,EAAoB,CAAA,EAAG,QAAQ,CAAA,IAAA,EAAO,GAAA,CAAI,GAAG,CAAA,CAAA,EAAI,GAAA,CAAI,GAAA,IAAO,EAAE,CAAA,CAAE,CAAA;AAAA,IAC3F;AACA,IAAA,OAAO,QAAA;AAAA,EACT;AACA,EAAA,IAAI,IAAI,GAAA,KAAQ,KAAA,IAAS,GAAA,CAAI,GAAA,KAAQ,WAAW,OAAO,SAAA;AACvD,EAAA,IAAI,IAAI,GAAA,KAAQ,IAAA,IAAQ,GAAA,CAAI,GAAA,KAAQ,SAAS,OAAO,mBAAA;AACpD,EAAA,IAAI,IAAI,GAAA,KAAQ,IAAA,IAAQ,GAAA,CAAI,GAAA,KAAQ,SAAS,OAAO,mBAAA;AAEpD,EAAA,MAAM,IAAI,cAAA,CAAe,cAAA,EAAgB,CAAA,2BAAA,EAA8B,GAAA,CAAI,GAAG,CAAA,CAAE,CAAA;AAClF;AAEA,eAAsB,eAAA,CACpB,GAAA,EACA,GAAA,EACA,IAAA,EACA,SAAA,EACkB;AAClB,EAAA,MAAM,IAAA,GAAO,KAAK,GAAG,CAAA;AACrB,EAAA,MAAM,EAAE,GAAA,EAAK,IAAA,EAAM,GAAA,EAAK,IAAA,EAAM,GAAA,EAAK,IAAA,EAAM,GAAA,EAAK,IAAA,EAAM,GAAA,EAAK,IAAA,EAAM,GAAG,UAAS,GAAI,GAAA;AAC/E,EAAA,IAAI,GAAA;AACJ,EAAA,IAAI;AACF,IAAA,GAAA,GAAM,MAAM,MAAA,CAAO,MAAA,CAAO,SAAA,CAAU,KAAA,EAAO,QAAA,EAAwB,IAAA,CAAK,SAAA,EAAW,KAAA,EAAO,CAAC,QAAQ,CAAC,CAAA;AAAA,EACtG,SAAS,CAAA,EAAG;AACV,IAAA,MAAM,IAAI,cAAA,CAAe,aAAA,EAAgB,CAAA,CAAY,OAAO,CAAA;AAAA,EAC9D;AAEA,EAAA,OAAO,MAAA,CAAO,MAAA,CAAO,MAAA,CAAO,IAAA,CAAK,WAAW,GAAA,EAAK,IAAI,UAAA,CAAW,SAAS,GAAG,IAAI,WAAA,EAAY,CAAE,MAAA,CAAO,IAAI,CAAC,CAAA;AAC5G;AAGA,eAAsB,cAAc,GAAA,EAAiC;AACnE,EAAA,IAAI,SAAA;AACJ,EAAA,IAAI,IAAI,GAAA,KAAQ,KAAA,EAAO,SAAA,GAAY,IAAA,CAAK,UAAU,EAAE,GAAA,EAAK,GAAA,CAAI,GAAA,EAAK,KAAK,GAAA,CAAI,GAAA,EAAK,CAAA,EAAG,GAAA,CAAI,GAAG,CAAA;AAAA,OAAA,IACjF,IAAI,GAAA,KAAQ,IAAA,cAAkB,IAAA,CAAK,SAAA,CAAU,EAAE,GAAA,EAAK,GAAA,CAAI,KAAK,GAAA,EAAK,GAAA,CAAI,KAAK,CAAA,EAAG,GAAA,CAAI,GAAG,CAAA,EAAG,GAAA,CAAI,GAAG,CAAA;AAAA,OAAA,IAC/F,IAAI,GAAA,KAAQ,KAAA,EAAO,SAAA,GAAY,IAAA,CAAK,UAAU,EAAE,CAAA,EAAG,GAAA,CAAI,CAAA,EAAG,KAAK,GAAA,CAAI,GAAA,EAAK,CAAA,EAAG,GAAA,CAAI,GAAG,CAAA;AAAA,aAChF,IAAI,cAAA,CAAe,eAAe,CAAA,gBAAA,EAAmB,GAAA,CAAI,GAAG,CAAA,CAAE,CAAA;AACzE,EAAA,MAAM,MAAA,GAAS,MAAM,MAAA,CAAO,MAAA,CAAO,MAAA,CAAO,SAAA,EAAW,IAAI,WAAA,EAAY,CAAE,MAAA,CAAO,SAAS,CAAC,CAAA;AACxF,EAAA,OAAO,gBAAA,CAAiB,IAAI,UAAA,CAAW,MAAM,CAAC,CAAA;AAChD;;;ACxMO,IAAM,cAAA,GAAN,cAA6B,KAAA,CAAM;AAAC,CAAA;AAE3C,IAAM,gBAAA,GAAmB,CAAC,YAAA,EAAc,QAAA,EAAU,aAAa,YAAA,EAAc,MAAA,EAAQ,SAAS,WAAW,CAAA;AAElG,SAAS,cAAc,EAAA,EAAqB;AACjD,EAAA,MAAM,CAAA,GAAI,EAAA,CAAG,KAAA,CAAM,8CAA8C,CAAA;AACjE,EAAA,IAAI,CAAC,GAAG,OAAO,KAAA;AACf,EAAA,MAAM,CAAC,CAAA,EAAG,CAAC,CAAA,GAAI,CAAC,MAAA,CAAO,CAAA,CAAE,CAAC,CAAC,CAAA,EAAG,MAAA,CAAO,CAAA,CAAE,CAAC,CAAC,CAAC,CAAA;AAC1C,EAAA,OACE,CAAA,KAAM,CAAA,IACN,CAAA,KAAM,EAAA,IACN,CAAA,KAAM,OACL,CAAA,KAAM,GAAA,IAAO,CAAA,IAAK,EAAA,IAAM,CAAA,IAAK,GAAA;AAAA,EAC7B,CAAA,KAAM,OAAO,CAAA,KAAM,GAAA;AAAA,EACnB,CAAA,KAAM,OAAO,CAAA,IAAK,EAAA,IAAM,KAAK,EAAA,IAC7B,CAAA,KAAM,OAAO,CAAA,KAAM,GAAA,IACnB,MAAM,GAAA,IAAO,CAAA,KAAM,KACnB,CAAA,KAAM,GAAA,KAAQ,MAAM,EAAA,IAAM,CAAA,KAAM,OACjC,CAAA,IAAK,GAAA;AAET;AAEO,SAAS,cAAc,EAAA,EAAqB;AACjD,EAAA,MAAM,IAAI,EAAA,CAAG,WAAA,EAAY,CAAE,OAAA,CAAQ,YAAY,EAAE,CAAA;AACjD,EAAA,IAAI,CAAA,KAAM,IAAA,IAAQ,CAAA,KAAM,KAAA,EAAO,OAAO,IAAA;AACtC,EAAA,MAAM,MAAA,GAAS,CAAA,CAAE,KAAA,CAAM,+BAA+B,CAAA;AACtD,EAAA,IAAI,MAAA,EAAQ,OAAO,aAAA,CAAc,MAAA,CAAO,CAAC,CAAE,CAAA;AAC3C,EAAA,OAAO,6BAAA,CAA8B,KAAK,CAAC,CAAA;AAC7C;AAEA,IAAM,WAAA,GAAc,CAAC,IAAA,KAAiB,sBAAA,CAAuB,IAAA,CAAK,IAAI,CAAA,IAAK,IAAA,CAAK,QAAA,CAAS,GAAG,CAAA,IAAK,IAAA,CAAK,WAAW,GAAG,CAAA;AAG7G,SAAS,cAAc,GAAA,EAAkB;AAC9C,EAAA,IAAI,GAAA;AACJ,EAAA,IAAI;AACF,IAAA,GAAA,GAAM,IAAI,IAAI,GAAG,CAAA;AAAA,EACnB,CAAA,CAAA,MAAQ;AACN,IAAA,MAAM,IAAI,eAAe,aAAa,CAAA;AAAA,EACxC;AACA,EAAA,IAAI,IAAI,QAAA,KAAa,QAAA,EAAU,MAAM,IAAI,eAAe,gBAAgB,CAAA;AACxE,EAAA,IAAI,IAAI,QAAA,IAAY,GAAA,CAAI,UAAU,MAAM,IAAI,eAAe,oBAAoB,CAAA;AAC/E,EAAA,IAAI,GAAA,CAAI,QAAQ,GAAA,CAAI,IAAA,KAAS,OAAO,MAAM,IAAI,eAAe,mBAAmB,CAAA;AAChF,EAAA,MAAM,IAAA,GAAO,GAAA,CAAI,QAAA,CAAS,WAAA,EAAY;AACtC,EAAA,IAAI,YAAY,IAAI,CAAA,EAAG,MAAM,IAAI,eAAe,kCAAkC,CAAA;AAClF,EAAA,IAAI,IAAA,KAAS,WAAA,IAAe,CAAC,IAAA,CAAK,SAAS,GAAG,CAAA,IAAK,gBAAA,CAAiB,IAAA,CAAK,CAAC,CAAA,KAAM,IAAA,CAAK,QAAA,CAAS,CAAC,CAAC,CAAA,EAAG;AACjG,IAAA,MAAM,IAAI,eAAe,mBAAmB,CAAA;AAAA,EAC9C;AACA,EAAA,OAAO,GAAA;AACT;AAqBA,eAAe,gBAAgB,IAAA,EAA6B;AAC1D,EAAA,IAAI,GAAA;AACJ,EAAA,IAAI;AACF,IAAA,GAAA,GAAO,MAAM;AAAA;AAAA;AAAA,MAAoD;AAAA,KAA6B;AAAA,EAChG,CAAA,CAAA,MAAQ;AACN,IAAA;AAAA,EACF;AACA,EAAA,MAAM,KAAA,GAAQ,MAAM,GAAA,CAAI,MAAA,CAAO,IAAA,EAAM,EAAE,GAAA,EAAK,IAAA,EAAM,CAAA,CAAE,KAAA,CAAM,MAAM;AAC9D,IAAA,MAAM,IAAI,eAAe,mBAAmB,CAAA;AAAA,EAC9C,CAAC,CAAA;AACD,EAAA,KAAA,MAAW,EAAE,OAAA,EAAS,MAAA,EAAO,IAAK,KAAA,EAAO;AACvC,IAAA,IAAI,WAAW,CAAA,GAAI,aAAA,CAAc,OAAO,CAAA,GAAI,aAAA,CAAc,OAAO,CAAA,EAAG;AAClE,MAAA,MAAM,IAAI,eAAe,oCAAoC,CAAA;AAAA,IAC/D;AAAA,EACF;AACF;AAEA,eAAsB,SAAA,CAAU,GAAA,EAAa,IAAA,GAAyB,EAAC,EAA6B;AAClG,EAAA,MAAM,GAAA,GAAM,cAAc,GAAG,CAAA;AAC7B,EAAA,IAAI,IAAA,CAAK,UAAA,EAAY,MAAM,eAAA,CAAgB,IAAI,QAAQ,CAAA;AACvD,EAAA,MAAM,OAAA,GAAU,KAAK,KAAA,IAAS,KAAA;AAC9B,EAAA,MAAM,GAAA,GAAM,MAAM,OAAA,CAAQ,GAAA,CAAI,IAAA,EAAM;AAAA,IAClC,MAAA,EAAQ,KAAA;AAAA,IACR,QAAA,EAAU,QAAA;AAAA,IACV,OAAA,EAAS,EAAE,MAAA,EAAQ,IAAA,CAAK,UAAU,kBAAA,EAAmB;AAAA,IACrD,MAAA,EAAQ,WAAA,CAAY,OAAA,CAAQ,IAAA,CAAK,aAAa,GAAI;AAAA,GACnD,CAAA;AACD,EAAA,MAAM,QAAA,GAAW,IAAA,CAAK,QAAA,IAAY,EAAA,GAAK,IAAA;AACvC,EAAA,MAAM,WAAW,MAAA,CAAO,GAAA,CAAI,QAAQ,GAAA,CAAI,gBAAgB,KAAK,CAAC,CAAA;AAC9D,EAAA,IAAI,QAAA,GAAW,QAAA,EAAU,MAAM,IAAI,eAAe,oBAAoB,CAAA;AAEtE,EAAA,MAAM,MAAA,GAAS,GAAA,CAAI,IAAA,EAAM,SAAA,EAAU;AACnC,EAAA,MAAM,SAAuB,EAAC;AAC9B,EAAA,IAAI,KAAA,GAAQ,CAAA;AACZ,EAAA,IAAI,MAAA,EAAQ;AACV,IAAA,WAAS;AACP,MAAA,MAAM,EAAE,IAAA,EAAM,KAAA,EAAM,GAAI,MAAM,OAAO,IAAA,EAAK;AAC1C,MAAA,IAAI,IAAA,EAAM;AACV,MAAA,KAAA,IAAS,KAAA,CAAM,UAAA;AACf,MAAA,IAAI,QAAQ,QAAA,EAAU;AACpB,QAAA,MAAM,MAAA,CAAO,MAAA,EAAO,CAAE,KAAA,CAAM,MAAM,MAAS,CAAA;AAC3C,QAAA,MAAM,IAAI,eAAe,oBAAoB,CAAA;AAAA,MAC/C;AACA,MAAA,MAAA,CAAO,KAAK,KAAK,CAAA;AAAA,IACnB;AAAA,EACF;AACA,EAAA,MAAM,IAAA,GAAO,IAAI,UAAA,CAAW,KAAK,CAAA;AACjC,EAAA,IAAI,CAAA,GAAI,CAAA;AACR,EAAA,KAAA,MAAW,KAAK,MAAA,EAAQ;AACtB,IAAA,IAAA,CAAK,GAAA,CAAI,GAAG,CAAC,CAAA;AACb,IAAA,CAAA,IAAK,CAAA,CAAE,UAAA;AAAA,EACT;AACA,EAAA,OAAO,EAAE,MAAA,EAAQ,GAAA,CAAI,MAAA,EAAQ,OAAA,EAAS,GAAA,CAAI,OAAA,EAAS,IAAA,EAAM,IAAI,WAAA,EAAY,CAAE,MAAA,CAAO,IAAI,CAAA,EAAE;AAC1F;;;ACxGO,IAAM,gBAAA,GAAmB;AACzB,IAAM,cAAA,GAAiB;AACvB,IAAM,oBAAA,GAAuB,oDAAA;AAQ7B,SAAS,iBAAA,CAAkB,aAAa,GAAA,EAAqB;AAClE,EAAA,MAAM,CAAA,uBAAQ,GAAA,EAAoB;AAClC,EAAA,OAAO;AAAA,IACL,IAAI,GAAA,EAAK;AACP,MAAA,MAAM,GAAA,GAAM,CAAA,CAAE,GAAA,CAAI,GAAG,CAAA;AACrB,MAAA,IAAI,GAAA,KAAQ,QAAW,OAAO,KAAA;AAC9B,MAAA,IAAI,GAAA,GAAM,IAAA,CAAK,GAAA,EAAI,EAAG;AACpB,QAAA,CAAA,CAAE,OAAO,GAAG,CAAA;AACZ,QAAA,OAAO,KAAA;AAAA,MACT;AACA,MAAA,OAAO,IAAA;AAAA,IACT,CAAA;AAAA,IACA,GAAA,CAAI,KAAK,GAAA,EAAK;AACZ,MAAA,IAAI,CAAA,CAAE,IAAA,IAAQ,UAAA,EAAY,CAAA,CAAE,MAAA,CAAO,EAAE,IAAA,EAAK,CAAE,IAAA,EAAK,CAAE,KAAe,CAAA;AAClE,MAAA,CAAA,CAAE,IAAI,GAAA,EAAK,IAAA,CAAK,GAAA,EAAI,GAAI,MAAM,GAAI,CAAA;AAAA,IACpC;AAAA,GACF;AACF;AA6CA,IAAM,cAAA,uBAAqB,GAAA,EAAuD;AAClF,IAAM,UAAA,GAAa,GAAA;AACnB,IAAM,YAAA,GAAe,IAAI,EAAA,GAAK,GAAA;AAI9B,SAAS,WAAW,OAAA,EAA0B;AAC5C,EAAA,MAAM,EAAA,GAAK,OAAA,CAAQ,GAAA,CAAI,eAAe,CAAA,IAAK,EAAA;AAC3C,EAAA,MAAM,CAAA,GAAI,EAAA,CAAG,KAAA,CAAM,gBAAgB,CAAA;AACnC,EAAA,MAAM,OAAO,CAAA,GAAI,MAAA,CAAO,CAAA,CAAE,CAAC,CAAC,CAAA,GAAI,IAAA;AAChC,EAAA,OAAO,IAAA,CAAK,IAAI,IAAA,CAAK,GAAA,CAAI,MAAM,EAAE,CAAA,EAAG,KAAM,CAAA,GAAI,GAAA;AAChD;AAEA,eAAe,aAAA,CAAc,KAAa,IAAA,EAAmD;AAC3F,EAAA,MAAM,MAAA,GAAS,cAAA,CAAe,GAAA,CAAI,GAAG,CAAA;AACrC,EAAA,IAAI,UAAU,aAAA,IAAiB,MAAA,IAAU,OAAO,WAAA,GAAc,IAAA,CAAK,KAAI,EAAG;AACxE,IAAA,MAAM,IAAI,cAAA,CAAe,kBAAA,EAAoB,mCAAmC,CAAA;AAAA,EAClF;AACA,EAAA,IAAI,MAAA,IAAU,UAAU,MAAA,IAAU,MAAA,CAAO,QAAQ,IAAA,CAAK,GAAA,IAAO,OAAO,MAAA;AAEpE,EAAA,IAAI;AACF,IAAA,MAAM,GAAA,GAAM,MAAM,SAAA,CAAU,GAAA,EAAK;AAAA,MAC/B,GAAI,KAAK,KAAA,GAAQ,EAAE,OAAO,IAAA,CAAK,KAAA,KAAU,EAAC;AAAA,MAC1C,MAAA,EAAQ,GAAG,oBAAoB,CAAA,4CAAA,CAAA;AAAA,MAC/B,UAAA,EAAY,KAAK,UAAA,IAAc;AAAA,KAChC,CAAA;AACD,IAAA,IAAI,GAAA,CAAI,MAAA,KAAW,GAAA,EAAK,MAAM,IAAI,eAAe,kBAAA,EAAoB,CAAA,mBAAA,EAAsB,GAAA,CAAI,MAAM,CAAA,CAAE,CAAA;AACvG,IAAA,IAAI,GAAA;AACJ,IAAA,IAAI;AACF,MAAA,GAAA,GAAM,IAAA,CAAK,KAAA,CAAM,GAAA,CAAI,IAAI,CAAA;AAAA,IAC3B,CAAA,CAAA,MAAQ;AACN,MAAA,MAAM,IAAI,cAAA,CAAe,kBAAA,EAAoB,uBAAuB,CAAA;AAAA,IACtE;AACA,IAAA,MAAM,MAAO,GAAA,CAA2B,IAAA;AACxC,IAAA,IAAI,CAAC,MAAM,OAAA,CAAQ,GAAG,GAAG,MAAM,IAAI,cAAA,CAAe,kBAAA,EAAoB,6BAA6B,CAAA;AACnG,IAAA,MAAM,MAAO,IAAA,CAAK,GAAA,IAAM,IAAK,IAAA,CAAK,KAAI,GAAI,GAAA;AAC1C,IAAA,MAAM,OAAO,GAAA,CAAI,MAAA;AAAA,MACf,CAAC,MACC,OAAO,CAAA,KAAM,YACb,CAAA,KAAM,IAAA,IACN,OAAQ,CAAA,CAAgB,GAAA,KAAQ,aAC9B,CAAA,CAAgB,GAAA,KAAQ,UAAc,CAAA,CAAgB,GAAA,IAAQ,SAC9D,CAAA,CAAgB,GAAA,KAAQ,KAAA,CAAA,IAAc,CAAA,CAAgB,GAAA,GAAO,GAAA;AAAA,KACnE;AACA,IAAA,MAAM,WAAA,GAAc,MAAM,OAAA,CAAQ,GAAA,CAAI,KAAK,GAAA,CAAI,CAAC,CAAA,KAAM,aAAA,CAAc,CAAC,CAAA,CAAE,KAAA,CAAM,MAAM,EAAE,CAAC,CAAC,CAAA;AACvF,IAAA,MAAM,KAAA,GAAQ,EAAE,IAAA,EAAM,WAAA,EAAa,KAAA,EAAO,IAAA,CAAK,GAAA,EAAI,GAAI,UAAA,CAAW,GAAA,CAAI,OAAO,CAAA,EAAE;AAC/E,IAAA,IAAI,cAAA,CAAe,IAAA,IAAQ,UAAA,EAAY,cAAA,CAAe,MAAA,CAAO,eAAe,IAAA,EAAK,CAAE,IAAA,EAAK,CAAE,KAAe,CAAA;AACzG,IAAA,cAAA,CAAe,GAAA,CAAI,KAAK,KAAK,CAAA;AAC7B,IAAA,OAAO,KAAA;AAAA,EACT,SAAS,CAAA,EAAG;AACV,IAAA,cAAA,CAAe,GAAA,CAAI,KAAK,EAAE,WAAA,EAAa,KAAK,GAAA,EAAI,GAAI,cAAc,CAAA;AAClE,IAAA,IAAI,CAAA,YAAa,gBAAgB,MAAM,CAAA;AACvC,IAAA,MAAM,IAAI,cAAA,CAAe,kBAAA,EAAqB,CAAA,CAAY,OAAO,CAAA;AAAA,EACnE;AACF;AAEA,SAAS,gBAAgB,MAAA,EAAwD;AAC/E,EAAA,IAAI,OAAO,OAAO,KAAA,KAAU,QAAA,QAAgB,IAAI,cAAA,CAAe,2BAA2B,kBAAkB,CAAA;AAC5G,EAAA,IAAI,GAAA;AACJ,EAAA,IAAI;AACF,IAAA,GAAA,GAAM,IAAI,GAAA,CAAI,MAAA,CAAO,KAAK,CAAA;AAAA,EAC5B,CAAA,CAAA,MAAQ;AACN,IAAA,MAAM,IAAI,cAAA,CAAe,yBAAA,EAA2B,WAAW,CAAA;AAAA,EACjE;AACA,EAAA,IAAI,IAAI,QAAA,KAAa,QAAA,QAAgB,IAAI,cAAA,CAAe,2BAA2B,gBAAgB,CAAA;AACnG,EAAA,MAAM,SAAA,GAAY,QAAA,CAAS,MAAA,CAAO,MAAA,EAAQ,MAAM,CAAA;AAChD,EAAA,MAAM,IAAA,GAAO,qBAAqB,OAAA,GAAU,SAAA,CAAU,QAAQ,OAAO,SAAA,KAAc,WAAW,SAAA,GAAY,WAAA;AAC1G,EAAA,IAAI,IAAA,KAAS,WAAA,EAAa,OAAO,EAAE,MAAA,EAAQ,IAAI,MAAA,EAAQ,YAAA,EAAc,GAAA,CAAI,MAAA,GAAS,cAAA,EAAe;AACjG,EAAA,IAAI,IAAA,KAAS,YAAY,OAAO,EAAE,QAAQ,GAAA,CAAI,IAAA,EAAM,YAAA,EAAc,GAAA,CAAI,IAAA,EAAK;AAC3E,EAAA,MAAM,IAAI,cAAA,CAAe,kCAAA,EAAoC,IAAI,CAAA;AACnE;AAEA,SAAS,SAAA,CAAU,QAAgB,OAAA,EAA2D;AAC5F,EAAA,IAAI,CAAC,OAAA,IAAW,OAAA,KAAY,KAAA,EAAO,OAAO,IAAA;AAC1C,EAAA,OAAO,OAAA,CAAQ,IAAA,CAAK,CAAC,CAAA,KAAM;AACzB,IAAA,IAAI;AACF,MAAA,MAAM,CAAA,GAAI,IAAI,GAAA,CAAI,CAAC,CAAA;AACnB,MAAA,OAAO,CAAA,CAAE,MAAA,KAAW,MAAA,IAAU,CAAA,CAAE,IAAA,KAAS,MAAA,IAAU,IAAI,GAAA,CAAI,MAAM,CAAA,CAAE,MAAA,KAAW,CAAA,CAAE,MAAA;AAAA,IAClF,CAAA,CAAA,MAAQ;AACN,MAAA,OAAO,KAAA;AAAA,IACT;AAAA,EACF,CAAC,CAAA;AACH;AAIA,eAAsB,gBAAA,CAAiB,OAAA,EAAkB,IAAA,GAA0B,EAAC,EAA8B;AAChH,EAAA,MAAM,SAAA,GAAY,OAAA,CAAQ,OAAA,CAAQ,GAAA,CAAI,WAAW,CAAA;AACjD,EAAA,MAAM,WAAA,GAAc,OAAA,CAAQ,OAAA,CAAQ,GAAA,CAAI,iBAAiB,CAAA;AACzD,EAAA,IAAI,CAAC,SAAA,IAAa,CAAC,aAAa,OAAO,EAAE,QAAQ,QAAA,EAAS;AAC1D,EAAA,IAAI,CAAC,aAAa,CAAC,WAAA,SAAoB,EAAE,MAAA,EAAQ,SAAA,EAAW,MAAA,EAAQ,8BAAA,EAA+B;AAEnG,EAAA,IAAI,MAAA,EAAQ,IAAA;AACZ,EAAA,IAAI;AACF,IAAA,MAAA,GAAS,gBAAgB,WAAW,CAAA;AACpC,IAAA,IAAA,GAAO,gBAAgB,SAAS,CAAA;AAAA,EAClC,SAAS,CAAA,EAAG;AACV,IAAA,OAAO,EAAE,MAAA,EAAQ,SAAA,EAAW,QAAQ,CAAA,6BAAA,EAAiC,CAAA,CAAY,OAAO,CAAA,CAAA,EAAG;AAAA,EAC7F;AAIA,EAAA,MAAM,aAAa,CAAC,GAAG,MAAA,CAAO,OAAA,EAAS,CAAA,CAAE,MAAA;AAAA,IACvC,CAAC,GAAG,CAAC,CAAA,KAAM,WAAA,CAAY,CAAC,CAAA,IAAK,QAAA,CAAS,CAAA,CAAE,MAAA,EAAQ,KAAK,CAAA,KAAM;AAAA,GAC7D;AACA,EAAA,IAAI,WAAW,MAAA,KAAW,CAAA,EAAG,OAAO,EAAE,QAAQ,QAAA,EAAS;AAEvD,EAAA,IAAI,WAAA,GAAgC,EAAE,MAAA,EAAQ,SAAA,EAAW,QAAQ,oBAAA,EAAqB;AACtF,EAAA,KAAA,MAAW,CAAC,KAAA,EAAO,KAAK,CAAA,IAAK,UAAA,EAAY;AACvC,IAAA,MAAM,CAAA,GAAI,MAAM,SAAA,CAAU,OAAA,EAAS,KAAA,EAAO,OAAO,IAAA,CAAK,GAAA,CAAI,KAAK,CAAA,EAAG,IAAI,CAAA;AACtE,IAAA,IAAI,CAAA,CAAE,MAAA,KAAW,UAAA,EAAY,OAAO,CAAA;AACpC,IAAA,WAAA,GAAc,CAAA;AAAA,EAChB;AACA,EAAA,OAAO,WAAA;AACT;AAEA,eAAe,SAAA,CACb,OAAA,EACA,KAAA,EACA,KAAA,EACA,WACA,IAAA,EAC2B;AAC3B,EAAA,MAAM,IAAA,GAAO,CAAC,MAAA,EAAgB,KAAA,GAA+C,EAAC,MAAyB;AAAA,IACrG,MAAA,EAAQ,SAAA;AAAA,IACR,MAAA;AAAA,IACA,GAAG;AAAA,GACL,CAAA;AACA,EAAA,IAAI,CAAC,aAAa,WAAA,CAAY,SAAS,KAAK,EAAE,SAAA,CAAU,iBAAiB,UAAA,CAAA,EAAa;AACpF,IAAA,OAAO,KAAK,6BAA6B,CAAA;AAAA,EAC3C;AACA,EAAA,MAAM,YAAY,SAAA,CAAU,KAAA;AAG5B,EAAA,MAAM,OAAA,GAAU,QAAA,CAAS,KAAA,CAAM,MAAA,EAAQ,SAAS,CAAA;AAChD,EAAA,MAAM,OAAA,GAAU,QAAA,CAAS,KAAA,CAAM,MAAA,EAAQ,SAAS,CAAA;AAChD,EAAA,MAAM,KAAA,GAAQ,QAAA,CAAS,KAAA,CAAM,MAAA,EAAQ,OAAO,CAAA;AAC5C,EAAA,MAAM,KAAA,GAAQ,QAAA,CAAS,KAAA,CAAM,MAAA,EAAQ,OAAO,CAAA;AAC5C,EAAA,IAAI,OAAO,YAAY,QAAA,IAAY,OAAO,YAAY,QAAA,EAAU,OAAO,KAAK,8BAA8B,CAAA;AAC1G,EAAA,IAAI,OAAO,KAAA,KAAU,QAAA,EAAU,OAAO,KAAK,gBAAgB,CAAA;AAC3D,EAAA,IAAI,UAAU,MAAA,IAAa,OAAO,UAAU,QAAA,EAAU,OAAO,KAAK,eAAe,CAAA;AACjF,EAAA,IAAI,IAAA,CAAK,gBAAgB,KAAA,KAAU,MAAA,SAAkB,IAAA,CAAK,gBAAA,EAAkB,EAAE,KAAA,EAAO,CAAA;AAGrF,EAAA,MAAM,GAAA,GAAM,KAAK,KAAA,CAAM,IAAA,CAAK,OAAM,IAAK,IAAA,CAAK,GAAA,EAAI,GAAI,GAAI,CAAA;AACxD,EAAA,MAAM,IAAA,GAAO,KAAK,YAAA,IAAgB,EAAA;AAClC,EAAA,IAAI,OAAA,GAAU,MAAM,IAAA,EAAM,OAAO,KAAK,mBAAA,EAAqB,EAAE,OAAO,CAAA;AACpE,EAAA,IAAI,OAAA,GAAU,MAAM,IAAA,EAAM,OAAO,KAAK,SAAA,EAAW,EAAE,OAAO,CAAA;AAC1D,EAAA,IAAI,WAAW,OAAA,EAAS,OAAO,KAAK,wBAAA,EAA0B,EAAE,OAAO,CAAA;AACvE,EAAA,IAAI,OAAA,GAAU,OAAA,IAAW,IAAA,CAAK,cAAA,IAAkB,KAAA,CAAA,SAAgB,IAAA,CAAK,0BAAA,EAA4B,EAAE,KAAA,EAAO,CAAA;AAG1G,EAAA,MAAM,QAAQ,KAAA,CAAM,KAAA,CAAM,IAAI,CAAC,CAAA,KAAM,EAAE,KAAK,CAAA;AAC5C,EAAA,IAAI,CAAC,MAAM,QAAA,CAAS,YAAY,KAAK,CAAC,KAAA,CAAM,QAAA,CAAS,aAAa,CAAA,EAAG;AACnE,IAAA,OAAO,IAAA,CAAK,qCAAA,EAAuC,EAAE,KAAA,EAAO,CAAA;AAAA,EAC9D;AACA,EAAA,MAAM,cAAA,GAAiB,MAAM,KAAA,CAAM,IAAA,CAAK,CAAC,CAAA,KAAM,CAAA,CAAE,UAAU,iBAAiB,CAAA;AAC5E,EAAA,IAAI,CAAC,cAAA,EAAgB,OAAO,KAAK,6BAAA,EAA+B,EAAE,OAAO,CAAA;AAGzE,EAAA,MAAM,WAAA,GAAc,OAAA,CAAQ,OAAA,CAAQ,GAAA,CAAI,iBAAiB,CAAA;AACzD,EAAA,IAAI,CAAC,WAAA,EAAa,OAAO,KAAK,yBAAA,EAA2B,EAAE,OAAO,CAAA;AAClE,EAAA,IAAI,MAAA;AACJ,EAAA,IAAI;AACF,IAAA,MAAM,GAAA,GAAM,QAAA,CAAS,cAAA,CAAe,MAAA,EAAQ,KAAK,CAAA;AACjD,IAAA,IAAI,OAAO,QAAQ,QAAA,EAAU;AAC3B,MAAA,MAAM,CAAA,GAAI,eAAA,CAAgB,WAAW,CAAA,CAAE,IAAI,GAAG,CAAA;AAC9C,MAAA,IAAI,CAAC,CAAA,IAAK,WAAA,CAAY,CAAC,CAAA,SAAU,IAAA,CAAK,gCAAA,EAAkC,EAAE,KAAA,EAAO,CAAA;AACjF,MAAA,MAAA,GAAS,CAAA;AAAA,IACX,CAAA,MAAO;AACL,MAAA,MAAA,GAAS,UAAU,WAAW,CAAA;AAAA,IAChC;AAAA,EACF,SAAS,CAAA,EAAG;AACV,IAAA,OAAO,KAAK,CAAA,2BAAA,EAA+B,CAAA,CAAY,OAAO,CAAA,CAAA,EAAI,EAAE,OAAO,CAAA;AAAA,EAC7E;AACA,EAAA,IAAI,MAAA,EAAgB,YAAA;AACpB,EAAA,IAAI;AACF,IAAA;AAAC,IAAA,CAAC,EAAE,MAAA,EAAQ,YAAA,EAAa,GAAI,gBAAgB,MAAM,CAAA;AAAA,EACrD,SAAS,CAAA,EAAG;AACV,IAAA,OAAO,KAAM,CAAA,CAAqB,IAAA,IAAQ,yBAAA,EAA2B,EAAE,OAAO,CAAA;AAAA,EAChF;AACA,EAAA,IAAI,CAAC,SAAA,CAAU,MAAA,EAAQ,IAAA,CAAK,kBAAkB,CAAA,EAAG,OAAO,IAAA,CAAK,oBAAA,EAAsB,EAAE,QAAA,EAAU,MAAA,EAAQ,OAAO,CAAA;AAG9G,EAAA,MAAM,SAAA,GAAY,QAAQ,CAAA,EAAG,MAAM,IAAI,KAAK,CAAA,CAAA,EAAI,KAAK,CAAA,CAAA,GAAK,MAAA;AAC1D,EAAA,IAAI,SAAA,IAAc,MAAM,IAAA,CAAK,WAAA,EAAa,IAAI,SAAS,CAAA,EAAI,OAAO,IAAA,CAAK,gBAAA,EAAkB,EAAE,QAAA,EAAU,MAAA,EAAQ,OAAO,CAAA;AAGpH,EAAA,IAAI,GAAA;AACJ,EAAA,IAAI;AACF,IAAA,GAAA,GAAM,MAAM,aAAA,CAAc,YAAA,EAAc,IAAI,CAAA;AAAA,EAC9C,SAAS,CAAA,EAAG;AACV,IAAA,OAAO,IAAA,CAAM,EAAqB,IAAA,IAAQ,kBAAA,EAAoB,EAAE,QAAA,EAAU,MAAA,EAAQ,OAAO,CAAA;AAAA,EAC3F;AACA,EAAA,MAAM,GAAA,GAAM,GAAA,CAAI,WAAA,CAAY,OAAA,CAAQ,KAAK,CAAA;AACzC,EAAA,IAAI,GAAA,GAAM,GAAG,OAAO,IAAA,CAAK,iBAAiB,EAAE,QAAA,EAAU,MAAA,EAAQ,KAAA,EAAO,CAAA;AACrE,EAAA,MAAM,GAAA,GAAM,GAAA,CAAI,IAAA,CAAK,GAAG,CAAA;AAGxB,EAAA,IAAI;AACF,IAAA,MAAM,GAAA,GAAM,IAAI,GAAA,CAAI,OAAA,CAAQ,GAAG,CAAA;AAC/B,IAAA,MAAM,MAAM,gBAAA,CAAiB,GAAA,EAAK,SAAS,KAAA,CAAM,MAAA,EAAQ,KAAK,CAAC,CAAA;AAC/D,IAAA,MAAM,IAAA,GAAO,cAAc,KAAA,EAAO;AAAA,MAChC,OAAA;AAAA,MACA,GAAA;AAAA,MACA,GAAI,IAAA,CAAK,SAAA,GAAY,EAAE,SAAA,EAAW,IAAA,CAAK,SAAA,CAAU,OAAA,EAAS,GAAG,CAAA,EAAE,GAAI;AAAC,KACrE,CAAA;AACD,IAAA,MAAM,KAAK,MAAM,eAAA,CAAgB,GAAA,EAAK,GAAA,EAAK,MAAM,SAAS,CAAA;AAC1D,IAAA,IAAI,CAAC,IAAI,OAAO,IAAA,CAAK,iBAAiB,EAAE,QAAA,EAAU,MAAA,EAAQ,KAAA,EAAO,CAAA;AACjE,IAAA,IAAI,SAAA,EAAW,MAAM,IAAA,CAAK,WAAA,EAAa,GAAA,CAAI,SAAA,EAAW,IAAA,CAAK,GAAA,CAAI,OAAA,GAAU,GAAA,EAAK,CAAC,CAAA,GAAI,IAAI,CAAA;AACvF,IAAA,OAAO,EAAE,QAAQ,UAAA,EAAY,QAAA,EAAU,QAAQ,KAAA,EAAO,KAAA,EAAO,GAAA,EAAK,OAAA,EAAS,OAAA,EAAQ;AAAA,EACrF,SAAS,CAAA,EAAG;AACV,IAAA,OAAO,IAAA,CAAK,CAAA,YAAa,cAAA,GAAiB,CAAA,CAAE,IAAA,GAAO,sBAAsB,EAAE,QAAA,EAAU,MAAA,EAAQ,KAAA,EAAO,CAAA;AAAA,EACtG;AACF;;;AChPA,IAAM,aAAA,GAAkE;AAAA,EACtE,qBAAA,EAAuB,EAAE,IAAA,EAAM,eAAA,EAAiB,QAAQ,QAAA;AAC1D,CAAA;AAEA,IAAM,gBAAA,GAAmB,kDAAA;AACzB,IAAM,SAAA,GAAY,kDAAA;AAElB,SAAS,OAAO,OAAA,EAAiC;AAC/C,EAAA,MAAM,CAAA,GAAI,OAAA,CAAQ,OAAA,CAAQ,GAAA,CAAI,eAAe,CAAA;AAC7C,EAAA,OAAO,CAAA,IAAK,aAAA,CAAc,IAAA,CAAK,CAAC,CAAA,GAAI,CAAA,CAAE,OAAA,CAAQ,aAAA,EAAe,EAAE,CAAA,CAAE,IAAA,EAAK,GAAI,IAAA;AAC5E;AAEA,SAAS,oBAAoB,KAAA,EAA8B;AACzD,EAAA,IAAI;AACF,IAAA,MAAM,OAAA,GAAU,KAAA,CAAM,KAAA,CAAM,GAAG,EAAE,CAAC,CAAA;AAClC,IAAA,MAAM,IAAA,GAAO,IAAA,CAAK,OAAA,CAAQ,OAAA,CAAQ,IAAA,EAAM,GAAG,CAAA,CAAE,OAAA,CAAQ,IAAA,EAAM,GAAG,CAAC,CAAA;AAC/D,IAAA,MAAM,GAAA,GAAO,IAAA,CAAK,KAAA,CAAM,IAAI,CAAA,CAAwB,GAAA;AACpD,IAAA,OAAO,OAAO,GAAA,KAAQ,QAAA,GAAW,GAAA,GAAM,IAAA;AAAA,EACzC,CAAA,CAAA,MAAQ;AACN,IAAA,OAAO,IAAA;AAAA,EACT;AACF;AAGA,IAAI,WAAA;AACJ,IAAM,UAAA,uBAAiB,GAAA,EAA0D;AAEjF,eAAe,YAAA,CAAa,OAAe,CAAA,EAA8D;AACvG,EAAA,WAAA,KAAgB,OAAO,MAAM,CAAA;AAC7B,EAAA,MAAM,OAAO,MAAM,WAAA;AACnB,EAAA,MAAM,MAAA,GAAS,EAAE,IAAA,GACb,IAAA,CAAK,kBAAkB,CAAA,CAAE,IAAsD,KAC9E,MAAM;AACL,IAAA,MAAM,GAAA,GAAM,EAAE,OAAA,IAAW,CAAA,EAAG,EAAE,MAAA,CAAO,OAAA,CAAQ,KAAA,EAAO,EAAE,CAAC,CAAA,sBAAA,CAAA;AACvD,IAAA,IAAI,CAAA,GAAI,UAAA,CAAW,GAAA,CAAI,GAAG,CAAA;AAC1B,IAAA,IAAI,CAAC,CAAA,EAAG;AACN,MAAA,CAAA,GAAI,IAAA,CAAK,kBAAA,CAAmB,IAAI,GAAA,CAAI,GAAG,CAAA,EAAG,EAAE,WAAA,EAAa,IAAA,EAAW,gBAAA,EAAkB,GAAA,EAAQ,CAAA;AAC9F,MAAA,UAAA,CAAW,GAAA,CAAI,KAAK,CAAC,CAAA;AAAA,IACvB;AACA,IAAA,OAAO,CAAA;AAAA,EACT,CAAA,GAAG;AACP,EAAA,IAAI;AACF,IAAA,MAAM,EAAE,OAAA,EAAQ,GAAI,MAAM,IAAA,CAAK,SAAA,CAAU,OAAO,MAAA,EAAQ;AAAA,MACtD,QAAQ,CAAA,CAAE,MAAA;AAAA,MACV,UAAU,CAAA,CAAE,QAAA;AAAA,MACZ,YAAY,CAAA,CAAE,UAAA,IAAc,CAAC,OAAA,EAAS,OAAA,EAAS,SAAS,OAAO,CAAA;AAAA,MAC/D,cAAA,EAAgB,EAAE,iBAAA,IAAqB;AAAA,KACxC,CAAA;AACD,IAAA,IAAI,CAAA,CAAE,gBAAgB,MAAA,EAAQ;AAC5B,MAAA,MAAM,OAAA,GAAU,IAAI,GAAA,CAAI,MAAA,CAAO,OAAA,CAAQ,KAAA,IAAS,OAAA,CAAQ,GAAA,IAAO,EAAE,CAAA,CAAE,KAAA,CAAM,KAAK,CAAC,CAAA;AAC/E,MAAA,MAAM,OAAA,GAAU,CAAA,CAAE,cAAA,CAAe,MAAA,CAAO,CAAC,MAAM,CAAC,OAAA,CAAQ,GAAA,CAAI,CAAC,CAAC,CAAA;AAC9D,MAAA,IAAI,OAAA,CAAQ,MAAA,EAAQ,OAAO,EAAE,KAAA,EAAO,kBAAkB,OAAA,CAAQ,IAAA,CAAK,GAAG,CAAC,CAAA,CAAA,EAAG;AAAA,IAC5E;AACA,IAAA,MAAM,QAAA,GAAW,OAAO,OAAA,CAAQ,SAAA,IAAa,QAAQ,GAAA,IAAO,OAAA,CAAQ,OAAO,EAAE,CAAA;AAC7E,IAAA,IAAI,CAAC,QAAA,EAAU,OAAO,EAAE,OAAO,wBAAA,EAAyB;AACxD,IAAA,OAAO;AAAA,MACL,EAAA,EAAI,UAAU,QAAQ,CAAA,CAAA;AAAA,MACtB,MAAM,OAAO,OAAA,CAAQ,UAAA,KAAe,QAAA,GAAW,QAAQ,UAAA,GAAa,QAAA;AAAA,MACpE,QAAQ,OAAO,OAAA,CAAQ,YAAA,KAAiB,QAAA,GAAW,QAAQ,YAAA,GAAe,IAAA;AAAA,MAC1E,MAAA,EAAQ,QAAA;AAAA,MACR,MAAA,EAAQ,EAAE,GAAA,EAAK,OAAA,CAAQ,KAAK,KAAA,EAAO,OAAA,CAAQ,KAAA,IAAS,OAAA,CAAQ,GAAA;AAAI,KAClE;AAAA,EACF,SAAS,CAAA,EAAG;AACV,IAAA,OAAO,EAAE,KAAA,EAAO,CAAA,cAAA,EAAkB,EAAwB,IAAA,IAAS,CAAA,CAAY,OAAO,CAAA,CAAA,EAAG;AAAA,EAC3F;AACF;AAEO,SAAS,eAAA,CAAgB,OAAA,GAA4B,EAAC,EAAG;AAC9D,EAAA,MAAM,MACJ,OAAA,CAAQ,UAAA,KAAe,KAAA,GACnB,IAAA,GACA,EAAE,WAAA,EAAa,iBAAA,EAAkB,EAAG,GAAI,OAAO,OAAA,CAAQ,UAAA,KAAe,WAAW,OAAA,CAAQ,UAAA,GAAa,EAAC,EAAG;AAChH,EAAA,MAAM,QAAA,GACJ,OAAA,CAAQ,QAAA,KAAa,KAAA,GAAQ,IAAA,GAAO,OAAO,OAAA,CAAQ,QAAA,KAAa,QAAA,GAAW,OAAA,CAAQ,QAAA,GAAW,EAAC;AACjG,EAAA,MAAM,SAAA,GAAY,OAAA,CAAQ,MAAA,EAAQ,MAAA,IAAU,MAAA;AAE5C,EAAA,eAAe,aAAa,OAAA,EAA4C;AACtE,IAAA,MAAM,YAA+B,EAAC;AACtC,IAAA,MAAM,UAAoB,EAAC;AAC3B,IAAA,IAAI,WAAA;AAGJ,IAAA,IAAI,GAAA,EAAK;AACP,MAAA,MAAM,CAAA,GAAI,MAAM,gBAAA,CAAiB,OAAA,EAAS,GAAG,CAAA;AAC7C,MAAA,IAAI,CAAA,CAAE,WAAW,UAAA,EAAY;AAC3B,QAAA,MAAM,KAAA,GAAQ,aAAA,CAAc,CAAA,CAAE,QAAQ,CAAA;AACtC,QAAA,MAAM,IAAA,GAAO,IAAI,GAAA,CAAI,CAAA,CAAE,QAAQ,CAAA,CAAE,QAAA;AACjC,QAAA,OAAO;AAAA,UACL,MAAA,EAAQ,UAAA;AAAA,UACR,KAAA,EAAO;AAAA,YACL,IAAI,CAAA,CAAE,QAAA;AAAA,YACN,IAAA,EAAM,OAAO,IAAA,IAAQ,IAAA;AAAA,YACrB,MAAA,EAAQ,OAAO,MAAA,IAAU,IAAA;AAAA,YACzB,MAAA,EAAQ,cAAA;AAAA,YACR,QAAQ,EAAE,KAAA,EAAO,EAAE,KAAA,EAAO,GAAA,EAAK,EAAE,GAAA;AAAI;AACvC,SACF;AAAA,MACF;AACA,MAAA,IAAI,CAAA,CAAE,WAAW,SAAA,EAAW;AAC1B,QAAA,SAAA,CAAU,KAAK,cAAc,CAAA;AAC7B,QAAA,OAAA,CAAQ,IAAA,CAAK,CAAA,aAAA,EAAgB,CAAA,CAAE,MAAM,CAAA,CAAE,CAAA;AACvC,QAAA,WAAA,KAAgB,EAAE,QAAA,GAAW,IAAI,IAAI,CAAA,CAAE,QAAQ,EAAE,QAAA,GAAW,MAAA;AAAA,MAC9D;AAAA,IACF;AAGA,IAAA,MAAM,QAAQ,MAAA,CAAO,OAAO,KAAK,OAAA,CAAQ,OAAA,CAAQ,IAAI,aAAa,CAAA;AAClE,IAAA,IAAI,SAAS,OAAA,CAAQ,MAAA,IAAU,KAAA,CAAM,UAAA,CAAW,SAAS,CAAA,EAAG;AAC1D,MAAA,SAAA,CAAU,KAAK,SAAS,CAAA;AACxB,MAAA,MAAM,EAAA,GAAK,MAAM,OAAA,CAAQ,MAAA,CAAO,OAAO,KAAK,CAAA;AAC5C,MAAA,IAAI,EAAA,EAAI;AACN,QAAA,OAAO;AAAA,UACL,MAAA,EAAQ,UAAA;AAAA,UACR,KAAA,EAAO;AAAA,YACL,EAAA,EAAI,CAAA,IAAA,EAAO,EAAA,CAAG,OAAO,CAAA,CAAA;AAAA,YACrB,IAAA,EAAM,EAAA,CAAG,IAAA,IAAQ,EAAA,CAAG,OAAA;AAAA,YACpB,MAAA,EAAQ,GAAG,MAAA,IAAU,IAAA;AAAA,YACrB,MAAA,EAAQ,SAAA;AAAA,YACR,GAAI,EAAA,CAAG,MAAA,GAAS,EAAE,MAAA,EAAQ,EAAE,MAAA,EAAQ,EAAA,CAAG,MAAA,EAAO,EAAE,GAAI;AAAC;AACvD,SACF;AAAA,MACF;AACA,MAAA,OAAA,CAAQ,KAAK,4BAA4B,CAAA;AAAA,IAC3C,WAAW,KAAA,IAAS,OAAA,CAAQ,UAAU,SAAA,CAAU,IAAA,CAAK,KAAK,CAAA,EAAG;AAG3D,MAAA,MAAM,GAAA,GAAM,oBAAoB,KAAK,CAAA;AACrC,MAAA,IAAI,GAAA,KAAQ,OAAA,CAAQ,MAAA,CAAO,MAAA,EAAQ;AACjC,QAAA,SAAA,CAAU,KAAK,QAAQ,CAAA;AACvB,QAAA,MAAM,CAAA,GAAI,MAAM,YAAA,CAAa,KAAA,EAAO,QAAQ,MAAM,CAAA;AAClD,QAAA,IAAI,EAAE,WAAW,CAAA,CAAA,EAAI,OAAO,EAAE,MAAA,EAAQ,UAAA,EAAY,OAAO,CAAA,EAAE;AAC3D,QAAA,OAAA,CAAQ,IAAA,CAAK,CAAA,OAAA,EAAU,CAAA,CAAE,KAAK,CAAA,CAAE,CAAA;AAAA,MAClC;AAAA,IACF;AAGA,IAAA,MAAM,EAAA,GAAK,OAAA,CAAQ,OAAA,CAAQ,GAAA,CAAI,YAAY,CAAA;AAC3C,IAAA,MAAM,KAAA,GAAQ,kBAAkB,EAAE,CAAA;AAClC,IAAA,IAAI,KAAA,EAAO;AACT,MAAA,WAAA,KAAgB,KAAA,CAAM,IAAA;AACtB,MAAA,IAAI,QAAA,EAAU;AACZ,QAAA,SAAA,CAAU,KAAK,kBAAkB,CAAA;AACjC,QAAA,MAAM,CAAA,GAAI,MAAM,aAAA,CAAc,KAAA,EAAO,QAAA,CAAS,SAAS,QAAA,CAAS,QAAQ,CAAA,EAAG,QAAA,CAAS,QAAQ,CAAA;AAC5F,QAAA,IAAI,CAAA,CAAE,WAAW,UAAA,EAAY;AAC3B,UAAA,OAAO;AAAA,YACL,MAAA,EAAQ,UAAA;AAAA,YACR,OAAO,EAAE,EAAA,EAAI,WAAW,KAAA,CAAM,IAAI,IAAI,IAAA,EAAM,KAAA,CAAM,MAAM,MAAA,EAAQ,IAAA,EAAM,QAAQ,kBAAA,EAAoB,MAAA,EAAQ,EAAE,IAAA,EAAM,CAAA,CAAE,MAAK;AAAE,WAC7H;AAAA,QACF;AACA,QAAA,OAAA,CAAQ,IAAA,CAAK,CAAA,QAAA,EAAW,CAAA,CAAE,MAAM,CAAA,CAAE,CAAA;AAAA,MACpC,CAAA,MAAO,OAAA,CAAQ,IAAA,CAAK,+BAA+B,CAAA;AAAA,IACrD;AAEA,IAAA,IAAI,SAAA,CAAU,MAAA,IAAU,KAAA,IAAU,EAAA,IAAM,gBAAA,CAAiB,IAAA,CAAK,EAAE,CAAA,IAAM,OAAA,CAAQ,OAAA,CAAQ,GAAA,CAAI,iBAAiB,CAAA,EAAG;AAC5G,MAAA,OAAO;AAAA,QACL,MAAA,EAAQ,YAAA;AAAA,QACR,MAAA,EAAQ,OAAA,CAAQ,CAAC,CAAA,IAAK,iCAAA;AAAA,QACtB,GAAI,WAAA,GAAc,EAAE,WAAA,KAAgB,EAAC;AAAA,QACrC;AAAA,OACF;AAAA,IACF;AACA,IAAA,OAAO,EAAE,QAAQ,MAAA,EAAO;AAAA,EAC1B;AAEA,EAAA,OAAO,EAAE,YAAA,EAAa;AACxB;AAKA,eAAsB,aAAa,GAAA,EAA8B;AAC/D,EAAA,MAAM,CAAA,GAAI,MAAM,MAAA,CAAO,MAAA,CAAO,MAAA,CAAO,SAAA,EAAW,IAAI,WAAA,EAAY,CAAE,MAAA,CAAO,GAAG,CAAC,CAAA;AAC7E,EAAA,OAAO,CAAC,GAAG,IAAI,UAAA,CAAW,CAAC,CAAC,CAAA,CAAE,IAAI,CAAC,CAAA,KAAM,EAAE,QAAA,CAAS,EAAE,EAAE,QAAA,CAAS,CAAA,EAAG,GAAG,CAAC,CAAA,CAAE,KAAK,EAAE,CAAA;AACnF;AAGO,SAAS,kBAAkB,UAAA,EAAqE;AACrG,EAAA,OAAO,OAAO,GAAA,KAAQ,UAAA,CAAW,MAAM,YAAA,CAAa,GAAG,CAAC,CAAA,IAAK,IAAA;AAC/D;AAGO,SAAS,gBAAA,CAAiB,SAAS,MAAA,EAAgB;AACxD,EAAA,OAAO,MAAA,GAAS,iBAAiB,MAAA,CAAO,eAAA,CAAgB,IAAI,UAAA,CAAW,EAAE,CAAC,CAAC,CAAA;AAC7E;AAIO,IAAM,aAAA,GAAgB;AAAA,EAC3B,MAAA,EAAQ,4BAAA;AAAA,EACR,EAAA,EAAI,wBAAA;AAAA,EACJ,IAAA,EAAM,0BAAA;AAAA,EACN,MAAA,EAAQ,4BAAA;AAAA,EACR,MAAA,EAAQ;AACV;AAOO,SAAS,gBAAA,CAAiB,SAAkB,MAAA,EAAkC;AACnF,EAAA,MAAM,CAAA,GAAI,IAAI,OAAA,CAAQ,OAAA,CAAQ,OAAO,CAAA;AACrC,EAAA,KAAA,MAAW,KAAK,CAAC,GAAG,CAAA,CAAE,IAAA,EAAM,CAAA,EAAG,IAAI,CAAA,CAAE,WAAA,GAAc,UAAA,CAAW,gBAAgB,CAAA,EAAG,CAAA,CAAE,OAAO,CAAC,CAAA;AAC3F,EAAA,CAAA,CAAE,GAAA,CAAI,aAAA,CAAc,MAAA,EAAQ,MAAA,CAAO,MAAM,CAAA;AACzC,EAAA,IAAI,MAAA,CAAO,WAAW,UAAA,EAAY;AAChC,IAAA,CAAA,CAAE,GAAA,CAAI,aAAA,CAAc,EAAA,EAAI,MAAA,CAAO,MAAM,EAAE,CAAA;AACvC,IAAA,CAAA,CAAE,GAAA,CAAI,aAAA,CAAc,IAAA,EAAM,MAAA,CAAO,MAAM,IAAI,CAAA;AAC3C,IAAA,CAAA,CAAE,GAAA,CAAI,aAAA,CAAc,MAAA,EAAQ,MAAA,CAAO,MAAM,MAAM,CAAA;AAC/C,IAAA,IAAI,MAAA,CAAO,MAAM,MAAA,EAAQ,CAAA,CAAE,IAAI,aAAA,CAAc,MAAA,EAAQ,MAAA,CAAO,KAAA,CAAM,MAAM,CAAA;AAAA,EAC1E;AACA,EAAA,OAAO,CAAA;AACT;AAOO,SAAS,iBAAiB,OAAA,EAA+C;AAC9E,EAAA,MAAM,MAAA,GAAS,OAAA,CAAQ,GAAA,CAAI,aAAA,CAAc,MAAM,CAAA;AAC/C,EAAA,OAAO;AAAA,IACL,QAAQ,MAAA,IAAU,MAAA;AAAA,IAClB,EAAA,EAAI,OAAA,CAAQ,GAAA,CAAI,aAAA,CAAc,EAAE,CAAA;AAAA,IAChC,IAAA,EAAM,OAAA,CAAQ,GAAA,CAAI,aAAA,CAAc,IAAI,CAAA;AAAA,IACpC,MAAA,EAAQ,OAAA,CAAQ,GAAA,CAAI,aAAA,CAAc,MAAM,CAAA;AAAA,IACxC,MAAA,EAAQ,OAAA,CAAQ,GAAA,CAAI,aAAA,CAAc,MAAM;AAAA,GAC1C;AACF;AAQO,SAAS,YAAA,CAAa,QAAyB,GAAA,EAA8D;AAClH,EAAA,IAAI,MAAA,CAAO,MAAA,KAAW,MAAA,EAAQ,OAAO,IAAA;AACrC,EAAA,MAAM,GAAA,GAAM,IAAI,GAAA,CAAI,GAAA,CAAI,QAAQ,GAAG,CAAA;AACnC,EAAA,MAAM,QAAA,GAAW,OAAO,MAAA,KAAW,UAAA;AACnC,EAAA,OAAO;AAAA,IACL,EAAA,EAAI,CAAA,IAAA,EAAO,MAAA,CAAO,UAAA,EAAY,CAAA,CAAA;AAAA,IAC9B,QAAQ,GAAA,CAAI,MAAA;AAAA,IACZ,SAAA,EAAW,WAAW,MAAA,CAAO,KAAA,CAAM,KAAK,CAAA,WAAA,EAAc,MAAA,CAAO,eAAe,SAAS,CAAA,CAAA;AAAA,IACrF,UAAA,EAAA,iBAAY,IAAI,IAAA,EAAK,EAAE,WAAA,EAAY;AAAA,IACnC,IAAA,EAAM,yBAAA;AAAA,IACN,KAAA,EAAO;AAAA,MACL,KAAA,EAAO,SAAA;AAAA,MACP,KAAA,EAAO,WAAW,UAAA,GAAa,UAAA;AAAA,MAC/B,UAAA,EAAY,WAAW,CAAA,GAAI,GAAA;AAAA,MAC3B,MAAA,EAAQ,WAAY,MAAA,CAAO,KAAA,CAAM,UAAU,MAAA,CAAO,KAAA,CAAM,IAAA,GAAS,MAAA,CAAO,WAAA,IAAe,IAAA;AAAA,MACvF,SAAA,EAAW,GAAA,CAAI,OAAA,CAAQ,OAAA,CAAQ,IAAI,YAAY,CAAA;AAAA,MAC/C,gBAAA,EAAkB,SAAA;AAAA,MAClB,OAAA,EAAS,EAAE,OAAA,EAAS,QAAA;AAAS,KAC/B;AAAA,IACA,OAAA,EAAS,WAAW,SAAA,GAAY,OAAA;AAAA,IAChC,GAAI,QAAA,GAAW,KAAK,EAAE,KAAA,EAAO,OAAO,MAAA,EAAO;AAAA,IAC3C,QAAA,EAAU;AAAA,MACR,QAAA,EAAU,WAAW,MAAA,CAAO,KAAA,CAAM,SAAU,MAAA,CAAO,SAAA,CAAU,CAAC,CAAA,IAAK,MAAA;AAAA,MACnE,GAAI,WAAW,EAAE,OAAA,EAAS,OAAO,KAAA,CAAM,EAAA,KAAO,EAAC;AAAA,MAC/C,MAAM,GAAA,CAAI;AAAA;AACZ,GACF;AACF;;;AC3TO,SAAS,sBAAA,CAAuB,OAAA,GAAmC,EAAC,EAAG;AAC5E,EAAA,MAAM,IAAA,GAAO,gBAAgB,OAAO,CAAA;AACpC,EAAA,OAAO,eAAe,OAAO,OAAA,EAA2C;AACtE,IAAA,IAAI,OAAA,CAAQ,OAAA,IAAW,CAAC,OAAA,CAAQ,OAAA,CAAQ,IAAI,GAAA,CAAI,OAAA,CAAQ,GAAG,CAAC,CAAA,EAAG;AAC7D,MAAA,MAAMA,OAAAA,GAA0B,EAAE,MAAA,EAAQ,MAAA,EAAO;AACjD,MAAA,OAAO,EAAE,MAAA,EAAAA,OAAAA,EAAQ,SAAS,gBAAA,CAAiB,OAAA,EAASA,OAAM,CAAA,EAAE;AAAA,IAC9D;AACA,IAAA,MAAM,MAAA,GAAS,MAAM,IAAA,CAAK,YAAA,CAAa,OAAO,CAAA;AAC9C,IAAA,IAAI,MAAA,CAAO,MAAA,KAAW,MAAA,IAAU,OAAA,CAAQ,QAAA,EAAU;AAEhD,MAAA,KAAK,OAAA,CAAQ,OAAA,EAAQ,CAClB,IAAA,CAAK,MAAM,OAAA,CAAQ,QAAA,CAAU,EAAE,MAAA,EAAQ,SAAS,CAAC,CAAA,CACjD,KAAA,CAAM,MAAM,MAAS,CAAA;AAAA,IAC1B;AACA,IAAA,OAAO,EAAE,MAAA,EAAQ,OAAA,EAAS,gBAAA,CAAiB,OAAA,EAAS,MAAM,CAAA,EAAE;AAAA,EAC9D,CAAA;AACF;AAmBO,SAAS,gBAAA,CAAiB,OAAA,GAAmC,EAAC,EAAG;AACtE,EAAA,MAAM,MAAA,GAAS,uBAAuB,OAAO,CAAA;AAC7C,EAAA,OAAO,CAAC,GAAA,EAAc,IAAA,EAAe,IAAA,KAAkC;AACrE,IAAA,MAAM,OAAA,GAAU,IAAI,OAAA,EAAQ;AAC5B,IAAA,KAAA,MAAW,CAAC,GAAG,CAAC,CAAA,IAAK,OAAO,OAAA,CAAQ,GAAA,CAAI,OAAO,CAAA,EAAG;AAChD,MAAA,IAAI,CAAA,KAAM,MAAA,EAAW,OAAA,CAAQ,GAAA,CAAI,CAAA,EAAG,KAAA,CAAM,OAAA,CAAQ,CAAC,CAAA,GAAI,CAAA,CAAE,IAAA,CAAK,IAAI,IAAI,CAAC,CAAA;AAAA,IACzE;AACA,IAAA,MAAM,IAAA,GAAO,OAAA,CAAQ,GAAA,CAAI,MAAM,CAAA,IAAK,WAAA;AACpC,IAAA,MAAM,GAAA,GAAM,CAAA,EAAG,GAAA,CAAI,QAAA,IAAY,MAAM,CAAA,GAAA,EAAM,IAAI,CAAA,EAAG,GAAA,CAAI,WAAA,IAAe,GAAA,CAAI,GAAA,IAAO,GAAG,CAAA,CAAA;AACnF,IAAA,MAAA,CAAO,IAAI,OAAA,CAAQ,GAAA,EAAK,EAAE,QAAQ,GAAA,CAAI,MAAA,IAAU,KAAA,EAAO,OAAA,EAAS,CAAC,CAAA,CAC9D,IAAA,CAAK,CAAC,GAAA,KAAQ;AACb,MAAA,GAAA,CAAI,QAAQ,GAAA,CAAI,MAAA;AAChB,MAAA,KAAA,MAAW,CAAA,IAAK,MAAA,CAAO,IAAA,CAAK,GAAA,CAAI,OAAO,CAAA,EAAG,IAAI,CAAA,CAAE,UAAA,CAAW,gBAAgB,CAAA,EAAG,OAAO,GAAA,CAAI,QAAQ,CAAC,CAAA;AAClG,MAAA,GAAA,CAAI,OAAA,CAAQ,OAAA,CAAQ,CAAC,CAAA,EAAG,CAAA,KAAM;AAC5B,QAAA,IAAI,EAAE,UAAA,CAAW,gBAAgB,GAAG,GAAA,CAAI,OAAA,CAAQ,CAAC,CAAA,GAAI,CAAA;AAAA,MACvD,CAAC,CAAA;AACD,MAAA,IAAA,EAAK;AAAA,IACP,CAAC,CAAA,CAGA,KAAA,CAAM,MAAM;AACX,MAAA,KAAA,MAAW,CAAA,IAAK,MAAA,CAAO,IAAA,CAAK,GAAA,CAAI,OAAO,CAAA,EAAG,IAAI,CAAA,CAAE,UAAA,CAAW,gBAAgB,CAAA,EAAG,OAAO,GAAA,CAAI,QAAQ,CAAC,CAAA;AAClG,MAAA,GAAA,CAAI,KAAA,GAAQ,EAAE,MAAA,EAAQ,MAAA,EAAO;AAC7B,MAAA,IAAA,EAAK;AAAA,IACP,CAAC,CAAA;AAAA,EACL,CAAA;AACF","file":"server.cjs","sourcesContent":["import type { AgentIdentity } from '@agentronics/protocol'\nimport { SDK_VERSION } from '../version.js'\n\nexport type CrawlerCategory = 'ai' | 'search'\n\nexport interface CrawlerSignature {\n  /** Stable vendor id, reported as identity.vendor. */\n  name: string\n  category: CrawlerCategory\n  /** Tested against navigator.userAgent. */\n  pattern: RegExp\n}\n\n/**\n * Known AI + search crawlers, matched by User-Agent token.\n *\n * Caveats baked into the design:\n * - UA is self-reported and trivially spoofable, so a match is high-confidence\n *   but never certain — we report `confidence: 0.9`, not `1`.\n * - This is client-side detection: it only sees crawlers that actually execute\n *   JavaScript on the page. The majority of crawlers fetch HTML and never run\n *   the SDK, so full coverage needs server/edge UA inspection (a future product).\n *\n * Order matters: more specific tokens (e.g. `Google-Extended`, `Applebot-Extended`)\n * are listed before their broader siblings so the first match wins correctly.\n */\nexport const CRAWLER_SIGNATURES: CrawlerSignature[] = [\n  // AI / LLM crawlers\n  { name: 'GPTBot', category: 'ai', pattern: /GPTBot/i },\n  { name: 'OAI-SearchBot', category: 'ai', pattern: /OAI-SearchBot/i },\n  { name: 'ChatGPT-User', category: 'ai', pattern: /ChatGPT-User/i },\n  { name: 'ClaudeBot', category: 'ai', pattern: /ClaudeBot/i },\n  { name: 'Claude-Web', category: 'ai', pattern: /Claude-Web/i },\n  { name: 'anthropic-ai', category: 'ai', pattern: /anthropic-ai/i },\n  { name: 'PerplexityBot', category: 'ai', pattern: /PerplexityBot/i },\n  { name: 'Google-Extended', category: 'ai', pattern: /Google-Extended/i },\n  { name: 'Applebot-Extended', category: 'ai', pattern: /Applebot-Extended/i },\n  { name: 'Amazonbot', category: 'ai', pattern: /Amazonbot/i },\n  { name: 'Bytespider', category: 'ai', pattern: /Bytespider/i },\n  { name: 'CCBot', category: 'ai', pattern: /CCBot/i },\n  { name: 'Meta-ExternalAgent', category: 'ai', pattern: /Meta-ExternalAgent/i },\n  { name: 'cohere-ai', category: 'ai', pattern: /cohere-ai/i },\n  // Search crawlers\n  { name: 'Googlebot', category: 'search', pattern: /Googlebot/i },\n  { name: 'Bingbot', category: 'search', pattern: /bingbot/i },\n  { name: 'DuckDuckBot', category: 'search', pattern: /DuckDuckBot/i },\n  { name: 'YandexBot', category: 'search', pattern: /YandexBot/i },\n  { name: 'Baiduspider', category: 'search', pattern: /Baiduspider/i },\n  { name: 'Applebot', category: 'search', pattern: /Applebot/i },\n]\n\nexport interface DetectCrawlerOptions {\n  /** Override the signature table (e.g. to add private/first-party crawlers). */\n  signatures?: CrawlerSignature[]\n  /** Skip crawler detection entirely. */\n  disable?: boolean\n  /** Confidence reported on a UA match. Default 0.9 (UA is spoofable). */\n  confidence?: number\n}\n\n/**\n * Identify known AI/search crawlers by their User-Agent token. Returns `null`\n * when no signature matches or when there is no `navigator` (server-side).\n */\nexport const detectCrawler = (options: DetectCrawlerOptions = {}): AgentIdentity | null => {\n  const { signatures = CRAWLER_SIGNATURES, disable = false, confidence = 0.9 } = options\n  if (disable) return null\n  if (typeof navigator === 'undefined') return null\n\n  const ua = navigator.userAgent ?? ''\n  if (!ua) return null\n\n  for (const sig of signatures) {\n    if (sig.pattern.test(ua)) {\n      return {\n        class: 'crawler',\n        trust: 'detected',\n        confidence,\n        vendor: sig.name,\n        userAgent: ua,\n        detectionVersion: SDK_VERSION,\n        signals: { matched: sig.name, category: sig.category, ua },\n      }\n    }\n  }\n\n  return null\n}\n","/**\n * Server-side crawler identification + verification.\n *\n * A User-Agent claim is trivially spoofable, so on its own it only makes a\n * request \"claimed\". A claim becomes verified by forward-confirmed reverse DNS\n * (the IP's PTR name sits under the vendor's documented domain AND resolves\n * back to the same IP) — the method Google, Microsoft, Apple, Yandex, Baidu and\n * Amazon document for their crawlers. Needs Node DNS; on edge runtimes the\n * claim stays unverified (use Web Bot Auth, which works everywhere).\n */\nimport { CRAWLER_SIGNATURES, type CrawlerSignature } from '../detection/crawler.js'\n\n/** Vendors that document reverse-DNS verification, keyed by signature name. */\nexport const RDNS_DOMAINS: Record<string, string[]> = {\n  Googlebot: ['googlebot.com', 'google.com', 'googleusercontent.com'],\n  Bingbot: ['search.msn.com'],\n  Applebot: ['applebot.apple.com'],\n  'Applebot-Extended': ['applebot.apple.com'],\n  YandexBot: ['yandex.ru', 'yandex.net', 'yandex.com'],\n  Baiduspider: ['baidu.com', 'baidu.jp'],\n  Amazonbot: ['crawl.amazonbot.amazon'],\n}\n\nexport interface CrawlerClaim {\n  name: string\n  category: CrawlerSignature['category']\n}\n\nexport function classifyUserAgent(ua: string | null, signatures = CRAWLER_SIGNATURES): CrawlerClaim | null {\n  if (!ua) return null\n  const hit = signatures.find((s) => s.pattern.test(ua))\n  return hit ? { name: hit.name, category: hit.category } : null\n}\n\n/**\n * Where the real client IP comes from. Platform headers are set by the edge\n * and can't be spoofed by the caller; the leftmost X-Forwarded-For entry CAN,\n * so it's never used by default.\n */\nexport type ClientIpSource = 'auto' | 'cloudflare' | 'vercel' | ((request: Request) => string | null)\n\nexport function clientIp(request: Request, source: ClientIpSource = 'auto'): string | null {\n  if (typeof source === 'function') return source(request)\n  const h = request.headers\n  if (source === 'cloudflare') return h.get('cf-connecting-ip')\n  if (source === 'vercel') return h.get('x-real-ip') ?? h.get('x-vercel-forwarded-for')\n  return h.get('cf-connecting-ip') ?? h.get('x-real-ip') ?? h.get('x-vercel-forwarded-for')\n}\n\nexport interface DnsResolver {\n  reverse(ip: string): Promise<string[]>\n  lookup(host: string): Promise<string[]>\n}\n\n/** The two node:dns/promises calls we use — typed locally so edge builds need no @types/node. */\ninterface NodeDnsPromises {\n  reverse(ip: string): Promise<string[]>\n  lookup(host: string, opts: { all: true }): Promise<Array<{ address: string; family: number }>>\n}\n\nasync function nodeResolver(): Promise<DnsResolver | null> {\n  try {\n    const dns = (await import(/* webpackIgnore: true */ /* @vite-ignore */ 'node:dns/promises' as string)) as NodeDnsPromises\n    return {\n      reverse: (ip) => dns.reverse(ip),\n      lookup: async (host) => (await dns.lookup(host, { all: true })).map((a) => a.address),\n    }\n  } catch {\n    return null\n  }\n}\n\nconst rdnsCache = new Map<string, { ok: boolean; host?: string; until: number }>()\nexport const __clearRdnsCache = () => rdnsCache.clear()\n\nexport type CrawlerVerification =\n  | { status: 'verified'; name: string; host: string; ip: string }\n  | { status: 'unverified'; name: string; reason: string }\n\nexport async function verifyCrawler(\n  claim: CrawlerClaim,\n  ip: string | null,\n  resolver?: DnsResolver\n): Promise<CrawlerVerification> {\n  const domains = RDNS_DOMAINS[claim.name]\n  if (!domains) return { status: 'unverified', name: claim.name, reason: 'no_rdns_method_for_vendor' }\n  if (!ip) return { status: 'unverified', name: claim.name, reason: 'client_ip_unknown' }\n\n  const key = `${claim.name}|${ip}`\n  const hit = rdnsCache.get(key)\n  if (hit && hit.until > Date.now()) {\n    return hit.ok\n      ? { status: 'verified', name: claim.name, host: hit.host!, ip }\n      : { status: 'unverified', name: claim.name, reason: 'rdns_mismatch' }\n  }\n\n  const dns = resolver ?? (await nodeResolver())\n  if (!dns) return { status: 'unverified', name: claim.name, reason: 'dns_unavailable_in_runtime' }\n\n  const remember = (ok: boolean, host?: string) => {\n    if (rdnsCache.size > 5000) rdnsCache.delete(rdnsCache.keys().next().value as string)\n    rdnsCache.set(key, { ok, ...(host ? { host } : {}), until: Date.now() + (ok ? 3600_000 : 600_000) })\n  }\n  try {\n    const names = await dns.reverse(ip)\n    for (const name of names) {\n      const host = name.toLowerCase().replace(/\\.$/, '')\n      if (!domains.some((d) => host === d || host.endsWith(`.${d}`))) continue\n      const forward = await dns.lookup(host)\n      if (forward.includes(ip)) {\n        remember(true, host)\n        return { status: 'verified', name: claim.name, host, ip }\n      }\n    }\n    remember(false)\n    return { status: 'unverified', name: claim.name, reason: 'rdns_mismatch' }\n  } catch {\n    return { status: 'unverified', name: claim.name, reason: 'rdns_lookup_failed' }\n  }\n}\n","/**\n * Structured Field Values for HTTP (RFC 9651) — the subset HTTP Message\n * Signatures (RFC 9421) and Web Bot Auth need: Dictionaries, Inner Lists,\n * Items, Parameters; bare items of type Integer, Decimal, String, Token,\n * Byte Sequence and Boolean. Parsing is strict (invalid input throws), and\n * serialization is canonical, which RFC 9421 relies on for `@signature-params`.\n */\n\nexport class SfToken {\n  constructor(readonly value: string) {}\n}\nexport class SfDecimal {\n  constructor(readonly value: number) {}\n}\nexport type BareItem = string | number | boolean | Uint8Array | SfToken | SfDecimal\nexport type Params = Array<[string, BareItem]>\nexport interface Item {\n  value: BareItem\n  params: Params\n}\nexport interface InnerList {\n  items: Item[]\n  params: Params\n}\nexport type Member = Item | InnerList\nexport type Dictionary = Map<string, Member>\n\nexport const isInnerList = (m: Member): m is InnerList => 'items' in m\n\nexport class SfParseError extends Error {}\n\nclass Parser {\n  i = 0\n  constructor(private readonly s: string) {}\n  get done() {\n    return this.i >= this.s.length\n  }\n  peek() {\n    return this.s[this.i] ?? ''\n  }\n  fail(what: string): never {\n    throw new SfParseError(`${what} at ${this.i}`)\n  }\n  sp() {\n    while (this.peek() === ' ') this.i++\n  }\n  ows() {\n    while (this.peek() === ' ' || this.peek() === '\\t') this.i++\n  }\n\n  key(): string {\n    const c = this.peek()\n    if (!/[a-z*]/.test(c)) this.fail('invalid key')\n    let out = ''\n    while (/[a-z0-9_\\-.*]/.test(this.peek())) out += this.s[this.i++]\n    return out\n  }\n\n  params(): Params {\n    const out: Params = []\n    while (this.peek() === ';') {\n      this.i++\n      this.sp()\n      const k = this.key()\n      let v: BareItem = true\n      if (this.peek() === '=') {\n        this.i++\n        v = this.bareItem()\n      }\n      const existing = out.findIndex(([ek]) => ek === k)\n      if (existing >= 0) out[existing] = [k, v]\n      else out.push([k, v])\n    }\n    return out\n  }\n\n  bareItem(): BareItem {\n    const c = this.peek()\n    if (c === '-' || /[0-9]/.test(c)) return this.number()\n    if (c === '\"') return this.string()\n    if (c === ':') return this.bytes()\n    if (c === '?') return this.boolean()\n    if (/[A-Za-z*]/.test(c)) return this.token()\n    return this.fail('invalid bare item')\n  }\n\n  number(): number | SfDecimal {\n    let sign = 1\n    if (this.peek() === '-') {\n      sign = -1\n      this.i++\n    }\n    let num = ''\n    let isDecimal = false\n    while (!this.done) {\n      const c = this.peek()\n      if (/[0-9]/.test(c)) num += c\n      else if (c === '.' && !isDecimal) {\n        if (num.length > 12) this.fail('decimal integer part too long')\n        isDecimal = true\n        num += c\n      } else break\n      this.i++\n      if (!isDecimal && num.length > 15) this.fail('integer too long')\n      if (isDecimal && num.length > 16) this.fail('decimal too long')\n    }\n    if (!/[0-9]/.test(num[0] ?? '')) this.fail('invalid number')\n    if (isDecimal) {\n      if (num.endsWith('.')) this.fail('decimal ends with dot')\n      if (num.split('.')[1]!.length > 3) this.fail('decimal fraction too long')\n      return new SfDecimal(sign * Number(num))\n    }\n    return sign * Number(num)\n  }\n\n  string(): string {\n    this.i++ // opening quote\n    let out = ''\n    while (!this.done) {\n      const c = this.s[this.i++]!\n      if (c === '\\\\') {\n        const n = this.s[this.i++]\n        if (n !== '\"' && n !== '\\\\') this.fail('invalid escape')\n        out += n\n      } else if (c === '\"') return out\n      else {\n        const code = c.charCodeAt(0)\n        if (code < 0x20 || code > 0x7e) this.fail('invalid string char')\n        out += c\n      }\n    }\n    return this.fail('unterminated string')\n  }\n\n  token(): SfToken {\n    let out = ''\n    while (/[A-Za-z0-9!#$%&'*+\\-.^_`|~:/]/.test(this.peek()) && !this.done) out += this.s[this.i++]\n    return new SfToken(out)\n  }\n\n  bytes(): Uint8Array {\n    this.i++\n    const end = this.s.indexOf(':', this.i)\n    if (end < 0) this.fail('unterminated byte sequence')\n    const b64 = this.s.slice(this.i, end)\n    if (!/^[A-Za-z0-9+/=]*$/.test(b64)) this.fail('invalid base64')\n    this.i = end + 1\n    return base64ToBytes(b64)\n  }\n\n  boolean(): boolean {\n    this.i++\n    const c = this.s[this.i++]\n    if (c === '1') return true\n    if (c === '0') return false\n    return this.fail('invalid boolean')\n  }\n\n  item(): Item {\n    const value = this.bareItem()\n    return { value, params: this.params() }\n  }\n\n  innerList(): InnerList {\n    this.i++ // (\n    const items: Item[] = []\n    while (!this.done) {\n      this.sp()\n      if (this.peek() === ')') {\n        this.i++\n        return { items, params: this.params() }\n      }\n      items.push(this.item())\n      const c = this.peek()\n      if (c !== ' ' && c !== ')') this.fail('invalid inner list')\n    }\n    return this.fail('unterminated inner list')\n  }\n\n  member(): Member {\n    return this.peek() === '(' ? this.innerList() : this.item()\n  }\n\n  dictionary(): Dictionary {\n    const out: Dictionary = new Map()\n    this.sp()\n    while (!this.done) {\n      const k = this.key()\n      let m: Member\n      if (this.peek() === '=') {\n        this.i++\n        m = this.member()\n      } else {\n        m = { value: true, params: this.params() }\n      }\n      out.set(k, m)\n      this.ows()\n      if (this.done) return out\n      if (this.peek() !== ',') this.fail('expected comma')\n      this.i++\n      this.ows()\n      if (this.done) this.fail('trailing comma')\n    }\n    return out\n  }\n}\n\nfunction parseTop<T>(input: string, fn: (p: Parser) => T): T {\n  const p = new Parser(input.trim())\n  const out = fn(p)\n  p.sp()\n  if (!p.done) p.fail('trailing characters')\n  return out\n}\n\nexport const parseDictionary = (input: string) => parseTop(input, (p) => p.dictionary())\nexport const parseItem = (input: string) => parseTop(input, (p) => p.item())\n\n// ---- serialization ------------------------------------------------------\n\nexport function serializeBareItem(v: BareItem): string {\n  if (typeof v === 'boolean') return v ? '?1' : '?0'\n  if (typeof v === 'number') {\n    if (!Number.isInteger(v)) throw new SfParseError('non-integer number; use SfDecimal')\n    return String(v)\n  }\n  if (v instanceof SfDecimal) {\n    const s = (Math.round(v.value * 1000) / 1000).toString()\n    return s.includes('.') ? s : `${s}.0`\n  }\n  if (v instanceof SfToken) return v.value\n  if (v instanceof Uint8Array) return `:${bytesToBase64(v)}:`\n  return `\"${v.replace(/\\\\/g, '\\\\\\\\').replace(/\"/g, '\\\\\"')}\"`\n}\n\nexport const serializeParams = (params: Params) =>\n  params.map(([k, v]) => (v === true ? `;${k}` : `;${k}=${serializeBareItem(v)}`)).join('')\n\nexport const serializeItem = (item: Item) => serializeBareItem(item.value) + serializeParams(item.params)\n\nexport const serializeInnerList = (list: InnerList) =>\n  `(${list.items.map(serializeItem).join(' ')})${serializeParams(list.params)}`\n\nexport const serializeMember = (m: Member) => (isInnerList(m) ? serializeInnerList(m) : serializeItem(m))\n\nexport const serializeDictionary = (d: Dictionary) =>\n  [...d.entries()]\n    .map(([k, m]) =>\n      !isInnerList(m) && m.value === true ? `${k}${serializeParams(m.params)}` : `${k}=${serializeMember(m)}`\n    )\n    .join(', ')\n\nexport const getParam = (params: Params, key: string): BareItem | undefined =>\n  params.find(([k]) => k === key)?.[1]\n\n// ---- base64 helpers (runtime-neutral: browser, edge, node) --------------\n\nexport function base64ToBytes(b64: string): Uint8Array {\n  const bin = atob(b64)\n  const out = new Uint8Array(bin.length)\n  for (let i = 0; i < bin.length; i++) out[i] = bin.charCodeAt(i)\n  return out\n}\n\nexport function bytesToBase64(bytes: Uint8Array): string {\n  let bin = ''\n  for (const b of bytes) bin += String.fromCharCode(b)\n  return btoa(bin)\n}\n\nexport const bytesToBase64Url = (bytes: Uint8Array) =>\n  bytesToBase64(bytes).replace(/\\+/g, '-').replace(/\\//g, '_').replace(/=+$/, '')\n","/**\n * HTTP Message Signatures (RFC 9421) — request verification only.\n * Runtime-neutral: WebCrypto + Fetch `Request`, so it runs on Node ≥ 20,\n * Vercel/Next edge middleware, Cloudflare Workers, Deno and Bun.\n */\nimport {\n  type InnerList,\n  type Item,\n  SfParseError,\n  bytesToBase64Url,\n  getParam,\n  isInnerList,\n  parseDictionary,\n  serializeInnerList,\n  serializeItem,\n  serializeMember,\n} from './structuredFields.js'\n\nexport class SignatureError extends Error {\n  constructor(\n    readonly code: string,\n    message?: string\n  ) {\n    super(message ?? code)\n  }\n}\n\nexport interface ComponentContext {\n  request: Request\n  url: URL\n  /** Override for `@authority` (e.g. when a proxy rewrites Host). */\n  authority?: string\n}\n\nconst DERIVED = new Set([\n  '@method',\n  '@target-uri',\n  '@authority',\n  '@scheme',\n  '@request-target',\n  '@path',\n  '@query',\n  '@query-param',\n])\n\n/** Value of one covered component, per RFC 9421 §2.1 / §2.2. */\nexport function componentValue(id: Item, ctx: ComponentContext): string {\n  if (typeof id.value !== 'string') throw new SignatureError('invalid_component', 'component id must be a string')\n  const name = id.value\n  const { url } = ctx\n\n  if (name.startsWith('@')) {\n    if (!DERIVED.has(name)) throw new SignatureError('unsupported_component', name)\n    switch (name) {\n      case '@method':\n        return ctx.request.method.toUpperCase()\n      case '@target-uri':\n        return url.href\n      case '@authority':\n        return (ctx.authority ?? url.host).toLowerCase()\n      case '@scheme':\n        return url.protocol.replace(/:$/, '').toLowerCase()\n      case '@request-target':\n        return url.pathname + url.search\n      case '@path':\n        return url.pathname || '/'\n      case '@query':\n        return url.search || '?'\n      case '@query-param': {\n        const pname = getParam(id.params, 'name')\n        if (typeof pname !== 'string') throw new SignatureError('invalid_component', '@query-param needs name')\n        const values = url.searchParams.getAll(pname)\n        if (values.length !== 1) throw new SignatureError('invalid_component', `@query-param ${pname}`)\n        return encodeURIComponent(values[0]!)\n      }\n    }\n  }\n\n  // HTTP field component\n  // Only `;key` (dictionary member) is supported. `;sf` needs the field's\n  // structured type (not knowable generically); `;bs`, `;req`, `;tr` don't\n  // apply to Web Bot Auth. Reject rather than guess.\n  for (const [k] of id.params) {\n    if (k !== 'key') throw new SignatureError('unsupported_component', `param ${k}`)\n  }\n  const raw = ctx.request.headers.get(name)\n  if (raw === null) throw new SignatureError('missing_component', name)\n  const value = raw.trim()\n\n  const key = getParam(id.params, 'key')\n  if (typeof key === 'string') {\n    let dict\n    try {\n      dict = parseDictionary(value)\n    } catch (e) {\n      throw new SignatureError('invalid_component', `${name} is not a dictionary: ${(e as Error).message}`)\n    }\n    const member = dict.get(key)\n    if (!member) throw new SignatureError('missing_component', `${name};key=${key}`)\n    return serializeMember(member)\n  }\n  return value\n}\n\n/** Build the signature base (RFC 9421 §2.5) for one Signature-Input member. */\nexport function signatureBase(input: InnerList, ctx: ComponentContext): string {\n  const seen = new Set<string>()\n  const lines: string[] = []\n  for (const id of input.items) {\n    const ident = serializeItem(id)\n    if (seen.has(ident)) throw new SignatureError('duplicate_component', ident)\n    seen.add(ident)\n    lines.push(`${ident}: ${componentValue(id, ctx)}`)\n  }\n  lines.push(`\"@signature-params\": ${serializeInnerList(input)}`)\n  return lines.join('\\n')\n}\n\n// ---- keys + algorithms ----------------------------------------------------\n\nexport interface PublicJwk {\n  kty: string\n  crv?: string\n  x?: string\n  y?: string\n  n?: string\n  e?: string\n  kid?: string\n  alg?: string\n  use?: string\n  nbf?: number\n  exp?: number\n}\n\nexport type SignatureAlgorithm =\n  | 'ed25519'\n  | 'rsa-pss-sha512'\n  | 'rsa-v1_5-sha256'\n  | 'ecdsa-p256-sha256'\n  | 'ecdsa-p384-sha384'\n\nconst ALGS: Record<\n  SignatureAlgorithm,\n  { kty: string; crv?: string; importAlg: Parameters<SubtleCrypto['importKey']>[2]; verifyAlg: Parameters<SubtleCrypto['verify']>[0] }\n> = {\n  ed25519: { kty: 'OKP', crv: 'Ed25519', importAlg: { name: 'Ed25519' }, verifyAlg: { name: 'Ed25519' } },\n  'rsa-pss-sha512': {\n    kty: 'RSA',\n    importAlg: { name: 'RSA-PSS', hash: 'SHA-512' },\n    verifyAlg: { name: 'RSA-PSS', saltLength: 64 },\n  },\n  'rsa-v1_5-sha256': {\n    kty: 'RSA',\n    importAlg: { name: 'RSASSA-PKCS1-v1_5', hash: 'SHA-256' },\n    verifyAlg: { name: 'RSASSA-PKCS1-v1_5' },\n  },\n  'ecdsa-p256-sha256': {\n    kty: 'EC',\n    crv: 'P-256',\n    importAlg: { name: 'ECDSA', namedCurve: 'P-256' },\n    verifyAlg: { name: 'ECDSA', hash: 'SHA-256' },\n  },\n  'ecdsa-p384-sha384': {\n    kty: 'EC',\n    crv: 'P-384',\n    importAlg: { name: 'ECDSA', namedCurve: 'P-384' },\n    verifyAlg: { name: 'ECDSA', hash: 'SHA-384' },\n  },\n}\n\n/** Pick the algorithm: the `alg` parameter if present (must fit the key), else infer from the key. */\nexport function resolveAlgorithm(jwk: PublicJwk, algParam: unknown): SignatureAlgorithm {\n  if (typeof algParam === 'string') {\n    const spec = ALGS[algParam as SignatureAlgorithm]\n    if (!spec) throw new SignatureError('unsupported_alg', algParam)\n    if (spec.kty !== jwk.kty || (spec.crv && spec.crv !== jwk.crv)) {\n      throw new SignatureError('alg_key_mismatch', `${algParam} vs ${jwk.kty}/${jwk.crv ?? ''}`)\n    }\n    return algParam as SignatureAlgorithm\n  }\n  if (jwk.kty === 'OKP' && jwk.crv === 'Ed25519') return 'ed25519'\n  if (jwk.kty === 'EC' && jwk.crv === 'P-256') return 'ecdsa-p256-sha256'\n  if (jwk.kty === 'EC' && jwk.crv === 'P-384') return 'ecdsa-p384-sha384'\n  // RSA is ambiguous (PSS vs v1.5) — require an explicit alg.\n  throw new SignatureError('alg_required', `cannot infer algorithm for ${jwk.kty}`)\n}\n\nexport async function verifySignature(\n  alg: SignatureAlgorithm,\n  jwk: PublicJwk,\n  base: string,\n  signature: Uint8Array\n): Promise<boolean> {\n  const spec = ALGS[alg]\n  const { kid: _kid, alg: _alg, use: _use, nbf: _nbf, exp: _exp, ...material } = jwk\n  let key: CryptoKey\n  try {\n    key = await crypto.subtle.importKey('jwk', material as JsonWebKey, spec.importAlg, false, ['verify'])\n  } catch (e) {\n    throw new SignatureError('invalid_key', (e as Error).message)\n  }\n  // copy into a fresh ArrayBuffer-backed view (WebCrypto rejects SharedArrayBuffer views)\n  return crypto.subtle.verify(spec.verifyAlg, key, new Uint8Array(signature), new TextEncoder().encode(base))\n}\n\n/** JWK SHA-256 thumbprint, base64url (RFC 7638; RFC 8037 §A.3 for OKP). */\nexport async function jwkThumbprint(jwk: PublicJwk): Promise<string> {\n  let canonical: string\n  if (jwk.kty === 'OKP') canonical = JSON.stringify({ crv: jwk.crv, kty: jwk.kty, x: jwk.x })\n  else if (jwk.kty === 'EC') canonical = JSON.stringify({ crv: jwk.crv, kty: jwk.kty, x: jwk.x, y: jwk.y })\n  else if (jwk.kty === 'RSA') canonical = JSON.stringify({ e: jwk.e, kty: jwk.kty, n: jwk.n })\n  else throw new SignatureError('invalid_key', `unsupported kty ${jwk.kty}`)\n  const digest = await crypto.subtle.digest('SHA-256', new TextEncoder().encode(canonical))\n  return bytesToBase64Url(new Uint8Array(digest))\n}\n\nexport { SfParseError, isInnerList }\n","/**\n * SSRF-guarded fetch for attacker-supplied URLs (the Web Bot Auth\n * `Signature-Agent` value comes from an untrusted request header).\n *\n * Guards: HTTPS on port 443 only, no credentials in the URL, no IP-literal or\n * internal hostnames (localhost, *.local, *.internal, *.home.arpa, private /\n * loopback / link-local / CGNAT / multicast ranges), no redirects (spec:\n * non-200 is a discovery failure), a timeout, and a response size cap.\n *\n * On Node, `resolveDns: true` also resolves the hostname and rejects private\n * addresses. Residual risk: DNS rebinding between that check and the fetch —\n * restrict `allowedDirectories` to known signers if that matters to you.\n */\n\nexport class UnsafeUrlError extends Error {}\n\nconst BLOCKED_SUFFIXES = ['.localhost', '.local', '.internal', '.home.arpa', '.lan', '.corp', '.intranet']\n\nexport function isPrivateIpv4(ip: string): boolean {\n  const m = ip.match(/^(\\d{1,3})\\.(\\d{1,3})\\.(\\d{1,3})\\.(\\d{1,3})$/)\n  if (!m) return false\n  const [a, b] = [Number(m[1]), Number(m[2])]\n  return (\n    a === 0 ||\n    a === 10 ||\n    a === 127 ||\n    (a === 100 && b >= 64 && b <= 127) || // CGNAT\n    (a === 169 && b === 254) || // link-local / cloud metadata\n    (a === 172 && b >= 16 && b <= 31) ||\n    (a === 192 && b === 168) ||\n    (a === 192 && b === 0) ||\n    (a === 198 && (b === 18 || b === 19)) ||\n    a >= 224 // multicast + reserved\n  )\n}\n\nexport function isPrivateIpv6(ip: string): boolean {\n  const s = ip.toLowerCase().replace(/^\\[|\\]$/g, '')\n  if (s === '::' || s === '::1') return true\n  const mapped = s.match(/^::ffff:(\\d+\\.\\d+\\.\\d+\\.\\d+)$/)\n  if (mapped) return isPrivateIpv4(mapped[1]!)\n  return /^(fc|fd|fe8|fe9|fea|feb|ff)/.test(s) // ULA, link-local, multicast\n}\n\nconst isIpLiteral = (host: string) => /^\\d+\\.\\d+\\.\\d+\\.\\d+$/.test(host) || host.includes(':') || host.startsWith('[')\n\n/** Throws UnsafeUrlError unless `raw` is a safe public HTTPS URL. */\nexport function assertSafeUrl(raw: string): URL {\n  let url: URL\n  try {\n    url = new URL(raw)\n  } catch {\n    throw new UnsafeUrlError('invalid URL')\n  }\n  if (url.protocol !== 'https:') throw new UnsafeUrlError('HTTPS required')\n  if (url.username || url.password) throw new UnsafeUrlError('credentials in URL')\n  if (url.port && url.port !== '443') throw new UnsafeUrlError('non-standard port')\n  const host = url.hostname.toLowerCase()\n  if (isIpLiteral(host)) throw new UnsafeUrlError('IP-literal hosts are not allowed')\n  if (host === 'localhost' || !host.includes('.') || BLOCKED_SUFFIXES.some((s) => host.endsWith(s))) {\n    throw new UnsafeUrlError('internal hostname')\n  }\n  return url\n}\n\nexport interface SafeFetchOptions {\n  fetch?: typeof fetch\n  timeoutMs?: number\n  maxBytes?: number\n  accept?: string\n  /** Node only: resolve the host and reject private addresses before fetching. */\n  resolveDns?: boolean\n}\n\nexport interface SafeFetchResult {\n  status: number\n  headers: Headers\n  body: string\n}\n\ninterface NodeDnsLookup {\n  lookup(host: string, opts: { all: true }): Promise<Array<{ address: string; family: number }>>\n}\n\nasync function assertPublicDns(host: string): Promise<void> {\n  let dns: NodeDnsLookup\n  try {\n    dns = (await import(/* webpackIgnore: true */ /* @vite-ignore */ 'node:dns/promises' as string)) as NodeDnsLookup\n  } catch {\n    return // not on Node (edge/workers) — hostname checks only\n  }\n  const addrs = await dns.lookup(host, { all: true }).catch(() => {\n    throw new UnsafeUrlError('DNS lookup failed')\n  })\n  for (const { address, family } of addrs) {\n    if (family === 4 ? isPrivateIpv4(address) : isPrivateIpv6(address)) {\n      throw new UnsafeUrlError('host resolves to a private address')\n    }\n  }\n}\n\nexport async function safeFetch(raw: string, opts: SafeFetchOptions = {}): Promise<SafeFetchResult> {\n  const url = assertSafeUrl(raw)\n  if (opts.resolveDns) await assertPublicDns(url.hostname)\n  const doFetch = opts.fetch ?? fetch\n  const res = await doFetch(url.href, {\n    method: 'GET',\n    redirect: 'manual',\n    headers: { accept: opts.accept ?? 'application/json' },\n    signal: AbortSignal.timeout(opts.timeoutMs ?? 3000),\n  })\n  const maxBytes = opts.maxBytes ?? 64 * 1024\n  const declared = Number(res.headers.get('content-length') ?? 0)\n  if (declared > maxBytes) throw new UnsafeUrlError('response too large')\n  // Read with a hard cap (content-length can lie or be absent).\n  const reader = res.body?.getReader()\n  const chunks: Uint8Array[] = []\n  let total = 0\n  if (reader) {\n    for (;;) {\n      const { done, value } = await reader.read()\n      if (done) break\n      total += value.byteLength\n      if (total > maxBytes) {\n        await reader.cancel().catch(() => undefined)\n        throw new UnsafeUrlError('response too large')\n      }\n      chunks.push(value)\n    }\n  }\n  const body = new Uint8Array(total)\n  let o = 0\n  for (const c of chunks) {\n    body.set(c, o)\n    o += c.byteLength\n  }\n  return { status: res.status, headers: res.headers, body: new TextDecoder().decode(body) }\n}\n","/**\n * Web Bot Auth verifier — draft-meunier-webbotauth-httpsig-protocol-02.\n *\n * A signed agent request carries:\n *   Signature-Agent: agent2=\"https://signer.example\"        (dictionary form)\n *   Signature-Input: sig2=(\"@authority\" \"signature-agent\";key=\"agent2\");\n *                    created=…;expires=…;keyid=\"<JWK thumbprint>\";tag=\"web-bot-auth\"\n *   Signature:       sig2=:<base64>:\n * The verifier resolves the signer's key directory\n * (<origin>/.well-known/http-message-signatures-directory by default), picks\n * the key whose JWK thumbprint equals `keyid`, rebuilds the RFC 9421 signature\n * base, and verifies it. Cheap checks run before any network call.\n */\nimport {\n  SignatureError,\n  jwkThumbprint,\n  resolveAlgorithm,\n  signatureBase,\n  verifySignature,\n  type PublicJwk,\n  type SignatureAlgorithm,\n} from './httpSignatures.js'\nimport { safeFetch } from './safeFetch.js'\nimport {\n  type InnerList,\n  type Item,\n  getParam,\n  isInnerList,\n  parseDictionary,\n  parseItem,\n  SfToken,\n} from './structuredFields.js'\n\nexport const WEB_BOT_AUTH_TAG = 'web-bot-auth'\nexport const DIRECTORY_PATH = '/.well-known/http-message-signatures-directory'\nexport const DIRECTORY_MEDIA_TYPE = 'application/http-message-signatures-directory+json'\n\nexport interface ReplayCache {\n  has(key: string): boolean | Promise<boolean>\n  add(key: string, ttlSeconds: number): void | Promise<void>\n}\n\n/** Bounded in-memory replay cache. Use a shared store (Redis…) across instances. */\nexport function memoryReplayCache(maxEntries = 10_000): ReplayCache {\n  const m = new Map<string, number>()\n  return {\n    has(key) {\n      const exp = m.get(key)\n      if (exp === undefined) return false\n      if (exp < Date.now()) {\n        m.delete(key)\n        return false\n      }\n      return true\n    },\n    add(key, ttl) {\n      if (m.size >= maxEntries) m.delete(m.keys().next().value as string)\n      m.set(key, Date.now() + ttl * 1000)\n    },\n  }\n}\n\nexport interface WebBotAuthOptions {\n  /**\n   * Which signers may be resolved. `'any'` (default) accepts any public HTTPS\n   * signer behind SSRF guards; a list restricts to those origins/URLs.\n   */\n  allowedDirectories?: 'any' | string[]\n  /** Accepted clock drift in seconds. Default 60. */\n  clockSkewSec?: number\n  /** Max `expires - created`, seconds. Default 86400 (spec: ≤ 24 h recommended). */\n  maxValiditySec?: number\n  /** Reject signatures without a `nonce`. Default false. */\n  requireNonce?: boolean\n  replayCache?: ReplayCache\n  /** Override `@authority` when a proxy rewrites Host. */\n  authority?: (request: Request, url: URL) => string\n  /** Node only: DNS-check directory hosts for private addresses. Default true. */\n  resolveDns?: boolean\n  /** Test seams. */\n  fetch?: typeof fetch\n  now?: () => number\n}\n\nexport type WebBotAuthResult =\n  | { status: 'absent' }\n  | {\n      status: 'verified'\n      /** Stable identity: the signer URL (directory origin or JWKS URL). */\n      agentUrl: string\n      keyid: string\n      label: string\n      alg: SignatureAlgorithm\n      created: number\n      expires: number\n    }\n  | { status: 'invalid'; reason: string; agentUrl?: string; keyid?: string }\n\n// ---- key directory cache ---------------------------------------------------\n\ninterface CachedDirectory {\n  keys: PublicJwk[]\n  thumbprints: string[]\n  until: number\n}\nconst directoryCache = new Map<string, CachedDirectory | { failedUntil: number }>()\nconst MAX_CACHED = 256\nconst NEGATIVE_TTL = 5 * 60 * 1000\n\nexport const __clearDirectoryCache = () => directoryCache.clear()\n\nfunction cacheTtlMs(headers: Headers): number {\n  const cc = headers.get('cache-control') ?? ''\n  const m = cc.match(/max-age=(\\d+)/i)\n  const secs = m ? Number(m[1]) : 3600\n  return Math.min(Math.max(secs, 60), 86_400) * 1000\n}\n\nasync function loadDirectory(url: string, opts: WebBotAuthOptions): Promise<CachedDirectory> {\n  const cached = directoryCache.get(url)\n  if (cached && 'failedUntil' in cached && cached.failedUntil > Date.now()) {\n    throw new SignatureError('discovery_failed', 'recent discovery failure (cached)')\n  }\n  if (cached && 'keys' in cached && cached.until > Date.now()) return cached\n\n  try {\n    const res = await safeFetch(url, {\n      ...(opts.fetch ? { fetch: opts.fetch } : {}),\n      accept: `${DIRECTORY_MEDIA_TYPE}, application/jwk-set+json, application/json`,\n      resolveDns: opts.resolveDns ?? true,\n    })\n    if (res.status !== 200) throw new SignatureError('discovery_failed', `directory returned ${res.status}`)\n    let doc: unknown\n    try {\n      doc = JSON.parse(res.body)\n    } catch {\n      throw new SignatureError('discovery_failed', 'directory is not JSON')\n    }\n    const raw = (doc as { keys?: unknown }).keys\n    if (!Array.isArray(raw)) throw new SignatureError('discovery_failed', 'directory has no keys array')\n    const now = (opts.now?.() ?? Date.now() / 1000)\n    const keys = raw.filter(\n      (k): k is PublicJwk =>\n        typeof k === 'object' &&\n        k !== null &&\n        typeof (k as PublicJwk).kty === 'string' &&\n        ((k as PublicJwk).nbf === undefined || (k as PublicJwk).nbf! <= now) &&\n        ((k as PublicJwk).exp === undefined || (k as PublicJwk).exp! > now)\n    )\n    const thumbprints = await Promise.all(keys.map((k) => jwkThumbprint(k).catch(() => '')))\n    const entry = { keys, thumbprints, until: Date.now() + cacheTtlMs(res.headers) }\n    if (directoryCache.size >= MAX_CACHED) directoryCache.delete(directoryCache.keys().next().value as string)\n    directoryCache.set(url, entry)\n    return entry\n  } catch (e) {\n    directoryCache.set(url, { failedUntil: Date.now() + NEGATIVE_TTL })\n    if (e instanceof SignatureError) throw e\n    throw new SignatureError('discovery_failed', (e as Error).message)\n  }\n}\n\nfunction directoryUrlFor(member: Item): { signer: string; directoryUrl: string } {\n  if (typeof member.value !== 'string') throw new SignatureError('invalid_signature_agent', 'must be a string')\n  let url: URL\n  try {\n    url = new URL(member.value)\n  } catch {\n    throw new SignatureError('invalid_signature_agent', 'not a URL')\n  }\n  if (url.protocol !== 'https:') throw new SignatureError('invalid_signature_agent', 'HTTPS required')\n  const typeParam = getParam(member.params, 'type')\n  const type = typeParam instanceof SfToken ? typeParam.value : typeof typeParam === 'string' ? typeParam : 'directory'\n  if (type === 'directory') return { signer: url.origin, directoryUrl: url.origin + DIRECTORY_PATH }\n  if (type === 'jwks_uri') return { signer: url.href, directoryUrl: url.href }\n  throw new SignatureError('unsupported_signature_agent_type', type)\n}\n\nfunction isAllowed(signer: string, allowed: WebBotAuthOptions['allowedDirectories']): boolean {\n  if (!allowed || allowed === 'any') return true\n  return allowed.some((a) => {\n    try {\n      const u = new URL(a)\n      return u.origin === signer || u.href === signer || new URL(signer).origin === u.origin\n    } catch {\n      return false\n    }\n  })\n}\n\n// ---- verification ------------------------------------------------------------\n\nexport async function verifyWebBotAuth(request: Request, opts: WebBotAuthOptions = {}): Promise<WebBotAuthResult> {\n  const sigHeader = request.headers.get('signature')\n  const inputHeader = request.headers.get('signature-input')\n  if (!sigHeader && !inputHeader) return { status: 'absent' }\n  if (!sigHeader || !inputHeader) return { status: 'invalid', reason: 'signature_headers_incomplete' }\n\n  let inputs, sigs\n  try {\n    inputs = parseDictionary(inputHeader)\n    sigs = parseDictionary(sigHeader)\n  } catch (e) {\n    return { status: 'invalid', reason: `malformed_signature_headers: ${(e as Error).message}` }\n  }\n\n  // Only signatures tagged web-bot-auth are ours; others (e.g. unrelated\n  // HTTP signatures) are ignored, not failed.\n  const candidates = [...inputs.entries()].filter(\n    ([, m]) => isInnerList(m) && getParam(m.params, 'tag') === WEB_BOT_AUTH_TAG\n  ) as Array<[string, InnerList]>\n  if (candidates.length === 0) return { status: 'absent' }\n\n  let lastFailure: WebBotAuthResult = { status: 'invalid', reason: 'no_valid_signature' }\n  for (const [label, input] of candidates) {\n    const r = await verifyOne(request, label, input, sigs.get(label), opts)\n    if (r.status === 'verified') return r\n    lastFailure = r\n  }\n  return lastFailure\n}\n\nasync function verifyOne(\n  request: Request,\n  label: string,\n  input: InnerList,\n  sigMember: ReturnType<ReturnType<typeof parseDictionary>['get']>,\n  opts: WebBotAuthOptions\n): Promise<WebBotAuthResult> {\n  const fail = (reason: string, extra: { agentUrl?: string; keyid?: string } = {}): WebBotAuthResult => ({\n    status: 'invalid',\n    reason,\n    ...extra,\n  })\n  if (!sigMember || isInnerList(sigMember) || !(sigMember.value instanceof Uint8Array)) {\n    return fail('signature_missing_for_label')\n  }\n  const signature = sigMember.value\n\n  // 1. required parameters\n  const created = getParam(input.params, 'created')\n  const expires = getParam(input.params, 'expires')\n  const keyid = getParam(input.params, 'keyid')\n  const nonce = getParam(input.params, 'nonce')\n  if (typeof created !== 'number' || typeof expires !== 'number') return fail('created_and_expires_required')\n  if (typeof keyid !== 'string') return fail('keyid_required')\n  if (nonce !== undefined && typeof nonce !== 'string') return fail('invalid_nonce')\n  if (opts.requireNonce && nonce === undefined) return fail('nonce_required', { keyid })\n\n  // 2. time window\n  const now = Math.floor(opts.now?.() ?? Date.now() / 1000)\n  const skew = opts.clockSkewSec ?? 60\n  if (created > now + skew) return fail('created_in_future', { keyid })\n  if (expires < now - skew) return fail('expired', { keyid })\n  if (expires <= created) return fail('expires_before_created', { keyid })\n  if (expires - created > (opts.maxValiditySec ?? 86_400)) return fail('validity_window_too_long', { keyid })\n\n  // 3. covered components: @authority or @target-uri, plus signature-agent\n  const names = input.items.map((i) => i.value)\n  if (!names.includes('@authority') && !names.includes('@target-uri')) {\n    return fail('authority_or_target_uri_not_covered', { keyid })\n  }\n  const agentComponent = input.items.find((i) => i.value === 'signature-agent')\n  if (!agentComponent) return fail('signature_agent_not_covered', { keyid })\n\n  // 4. Signature-Agent → signer + directory\n  const agentHeader = request.headers.get('signature-agent')\n  if (!agentHeader) return fail('signature_agent_missing', { keyid })\n  let member: Item\n  try {\n    const key = getParam(agentComponent.params, 'key')\n    if (typeof key === 'string') {\n      const m = parseDictionary(agentHeader).get(key)\n      if (!m || isInnerList(m)) return fail('signature_agent_member_missing', { keyid })\n      member = m\n    } else {\n      member = parseItem(agentHeader) // legacy sf-string form\n    }\n  } catch (e) {\n    return fail(`malformed_signature_agent: ${(e as Error).message}`, { keyid })\n  }\n  let signer: string, directoryUrl: string\n  try {\n    ;({ signer, directoryUrl } = directoryUrlFor(member))\n  } catch (e) {\n    return fail((e as SignatureError).code ?? 'invalid_signature_agent', { keyid })\n  }\n  if (!isAllowed(signer, opts.allowedDirectories)) return fail('signer_not_allowed', { agentUrl: signer, keyid })\n\n  // 5. replay check (read-only; recorded only after a valid signature)\n  const replayKey = nonce ? `${signer}|${keyid}|${nonce}` : undefined\n  if (replayKey && (await opts.replayCache?.has(replayKey))) return fail('replayed_nonce', { agentUrl: signer, keyid })\n\n  // 6. key lookup — keyed on the (signer URL, key) pair, by thumbprint\n  let dir: CachedDirectory\n  try {\n    dir = await loadDirectory(directoryUrl, opts)\n  } catch (e) {\n    return fail((e as SignatureError).code ?? 'discovery_failed', { agentUrl: signer, keyid })\n  }\n  const idx = dir.thumbprints.indexOf(keyid)\n  if (idx < 0) return fail('unknown_keyid', { agentUrl: signer, keyid })\n  const jwk = dir.keys[idx]!\n\n  // 7. rebuild the signature base and verify\n  try {\n    const url = new URL(request.url)\n    const alg = resolveAlgorithm(jwk, getParam(input.params, 'alg'))\n    const base = signatureBase(input, {\n      request,\n      url,\n      ...(opts.authority ? { authority: opts.authority(request, url) } : {}),\n    })\n    const ok = await verifySignature(alg, jwk, base, signature)\n    if (!ok) return fail('bad_signature', { agentUrl: signer, keyid })\n    if (replayKey) await opts.replayCache?.add(replayKey, Math.max(expires - now, 1) + skew)\n    return { status: 'verified', agentUrl: signer, keyid, label, alg, created, expires }\n  } catch (e) {\n    return fail(e instanceof SignatureError ? e.code : 'verification_error', { agentUrl: signer, keyid })\n  }\n}\n","/**\n * Agent authentication for any HTTP request — the server half of the SDK.\n *\n *   const auth = createAgentAuth({ apiKey: { verify } })\n *   const result = await auth.authenticate(request)   // Fetch API Request\n *\n * Authentication never blocks. A verified agent gets a stable identity your\n * routes can read; an unverified agent (or a human) browses exactly as before.\n *\n * Methods, strongest first: Web Bot Auth (RFC 9421 signed agents), agent API\n * keys, OAuth2 client-credentials JWTs, and verified crawlers (forward-confirmed\n * reverse DNS). Everything runs on Node ≥ 20 and edge runtimes except crawler\n * rDNS, which needs Node DNS (it degrades to \"unverified\", never \"verified\").\n */\nimport type { TraceEvent } from '@agentronics/protocol'\nimport type * as Jose from 'jose'\nimport { classifyUserAgent, clientIp, verifyCrawler, type ClientIpSource, type DnsResolver } from './crawlers.js'\nimport { bytesToBase64Url } from './structuredFields.js'\nimport { memoryReplayCache, verifyWebBotAuth, type WebBotAuthOptions } from './webBotAuth.js'\n\nexport type AgentAuthMethod = 'web-bot-auth' | 'api-key' | 'oauth2' | 'verified-crawler'\n\nexport interface VerifiedAgent {\n  /** Stable id: signer URL, API-key agent id, OAuth client id, or crawler name. */\n  id: string\n  name: string\n  vendor: string | null\n  method: AgentAuthMethod\n  claims?: Record<string, unknown>\n}\n\nexport type AgentAuthResult =\n  | { status: 'verified'; agent: VerifiedAgent }\n  | { status: 'unverified'; reason: string; claimedName?: string; attempted: AgentAuthMethod[] }\n  | { status: 'none' }\n\nexport interface ApiKeyIdentity {\n  agentId: string\n  name?: string\n  vendor?: string\n  scopes?: string[]\n}\n\nexport interface ApiKeyOptions {\n  /** Key prefix that marks a bearer token as an agent key. Default `agk_`. */\n  prefix?: string\n  /** Look the key up. Return null for unknown/revoked keys. */\n  verify: (key: string) => ApiKeyIdentity | null | Promise<ApiKeyIdentity | null>\n}\n\nexport interface OAuth2Options {\n  issuer: string\n  audience: string | string[]\n  /** Default `<issuer>/.well-known/jwks.json`. */\n  jwksUri?: string\n  /** Static JWKS (tests / pinned keys) instead of fetching `jwksUri`. */\n  jwks?: { keys: JsonWebKey[] }\n  requiredScopes?: string[]\n  algorithms?: string[]\n  clockToleranceSec?: number\n}\n\nexport interface CrawlerOptions {\n  /** Where to read the client IP. Default 'auto' (platform headers only). */\n  clientIp?: ClientIpSource\n  /** Test seam / custom resolver. */\n  resolver?: DnsResolver\n}\n\nexport interface AgentAuthOptions {\n  /** Web Bot Auth (on by default). `false` disables it. */\n  webBotAuth?: boolean | WebBotAuthOptions\n  apiKey?: ApiKeyOptions\n  oauth2?: OAuth2Options\n  /** Verified crawlers (on by default). `false` disables it. */\n  crawlers?: boolean | CrawlerOptions\n}\n\n/** Signers we can name. Everything else is shown by hostname. */\nconst KNOWN_SIGNERS: Record<string, { name: string; vendor: string }> = {\n  'https://chatgpt.com': { name: 'ChatGPT agent', vendor: 'OpenAI' },\n}\n\nconst GENERIC_AGENT_UA = /\\b(bot|crawler|spider|agent|headless|scraper)\\b/i\nconst JWT_SHAPE = /^[A-Za-z0-9_-]+\\.[A-Za-z0-9_-]+\\.[A-Za-z0-9_-]*$/\n\nfunction bearer(request: Request): string | null {\n  const h = request.headers.get('authorization')\n  return h && /^bearer\\s+/i.test(h) ? h.replace(/^bearer\\s+/i, '').trim() : null\n}\n\nfunction unverifiedJwtIssuer(token: string): string | null {\n  try {\n    const payload = token.split('.')[1]!\n    const json = atob(payload.replace(/-/g, '+').replace(/_/g, '/'))\n    const iss = (JSON.parse(json) as { iss?: unknown }).iss\n    return typeof iss === 'string' ? iss : null\n  } catch {\n    return null\n  }\n}\n\ntype JoseModule = typeof Jose\nlet josePromise: Promise<JoseModule> | undefined\nconst remoteSets = new Map<string, ReturnType<JoseModule['createRemoteJWKSet']>>()\n\nasync function verifyOAuth2(token: string, o: OAuth2Options): Promise<VerifiedAgent | { error: string }> {\n  josePromise ??= import('jose')\n  const jose = await josePromise\n  const keySet = o.jwks\n    ? jose.createLocalJWKSet(o.jwks as Parameters<JoseModule['createLocalJWKSet']>[0])\n    : (() => {\n        const uri = o.jwksUri ?? `${o.issuer.replace(/\\/$/, '')}/.well-known/jwks.json`\n        let s = remoteSets.get(uri)\n        if (!s) {\n          s = jose.createRemoteJWKSet(new URL(uri), { cacheMaxAge: 3_600_000, cooldownDuration: 30_000 })\n          remoteSets.set(uri, s)\n        }\n        return s\n      })()\n  try {\n    const { payload } = await jose.jwtVerify(token, keySet, {\n      issuer: o.issuer,\n      audience: o.audience,\n      algorithms: o.algorithms ?? ['RS256', 'PS256', 'ES256', 'EdDSA'],\n      clockTolerance: o.clockToleranceSec ?? 30,\n    })\n    if (o.requiredScopes?.length) {\n      const granted = new Set(String(payload.scope ?? payload.scp ?? '').split(/\\s+/))\n      const missing = o.requiredScopes.filter((s) => !granted.has(s))\n      if (missing.length) return { error: `missing_scopes:${missing.join(',')}` }\n    }\n    const clientId = String(payload.client_id ?? payload.azp ?? payload.sub ?? '')\n    if (!clientId) return { error: 'token_has_no_client_id' }\n    return {\n      id: `oauth2:${clientId}`,\n      name: typeof payload.agent_name === 'string' ? payload.agent_name : clientId,\n      vendor: typeof payload.agent_vendor === 'string' ? payload.agent_vendor : null,\n      method: 'oauth2',\n      claims: { sub: payload.sub, scope: payload.scope ?? payload.scp },\n    }\n  } catch (e) {\n    return { error: `invalid_token:${(e as { code?: string }).code ?? (e as Error).message}` }\n  }\n}\n\nexport function createAgentAuth(options: AgentAuthOptions = {}) {\n  const wba: WebBotAuthOptions | null =\n    options.webBotAuth === false\n      ? null\n      : { replayCache: memoryReplayCache(), ...(typeof options.webBotAuth === 'object' ? options.webBotAuth : {}) }\n  const crawlers: CrawlerOptions | null =\n    options.crawlers === false ? null : typeof options.crawlers === 'object' ? options.crawlers : {}\n  const keyPrefix = options.apiKey?.prefix ?? 'agk_'\n\n  async function authenticate(request: Request): Promise<AgentAuthResult> {\n    const attempted: AgentAuthMethod[] = []\n    const reasons: string[] = []\n    let claimedName: string | undefined\n\n    // 1. Web Bot Auth\n    if (wba) {\n      const r = await verifyWebBotAuth(request, wba)\n      if (r.status === 'verified') {\n        const known = KNOWN_SIGNERS[r.agentUrl]\n        const host = new URL(r.agentUrl).hostname\n        return {\n          status: 'verified',\n          agent: {\n            id: r.agentUrl,\n            name: known?.name ?? host,\n            vendor: known?.vendor ?? null,\n            method: 'web-bot-auth',\n            claims: { keyid: r.keyid, alg: r.alg },\n          },\n        }\n      }\n      if (r.status === 'invalid') {\n        attempted.push('web-bot-auth')\n        reasons.push(`web-bot-auth:${r.reason}`)\n        claimedName ??= r.agentUrl ? new URL(r.agentUrl).hostname : undefined\n      }\n    }\n\n    // 2/3. Bearer credentials — agent API key or OAuth2 JWT\n    const token = bearer(request) ?? request.headers.get('x-agent-key')\n    if (token && options.apiKey && token.startsWith(keyPrefix)) {\n      attempted.push('api-key')\n      const id = await options.apiKey.verify(token)\n      if (id) {\n        return {\n          status: 'verified',\n          agent: {\n            id: `key:${id.agentId}`,\n            name: id.name ?? id.agentId,\n            vendor: id.vendor ?? null,\n            method: 'api-key',\n            ...(id.scopes ? { claims: { scopes: id.scopes } } : {}),\n          },\n        }\n      }\n      reasons.push('api-key:unknown_or_revoked')\n    } else if (token && options.oauth2 && JWT_SHAPE.test(token)) {\n      // Only tokens from *our* issuer are agent credentials — a user's\n      // session JWT from another issuer is not agent traffic.\n      const iss = unverifiedJwtIssuer(token)\n      if (iss === options.oauth2.issuer) {\n        attempted.push('oauth2')\n        const r = await verifyOAuth2(token, options.oauth2)\n        if (!('error' in r)) return { status: 'verified', agent: r }\n        reasons.push(`oauth2:${r.error}`)\n      }\n    }\n\n    // 4. Crawler claim → forward-confirmed reverse DNS\n    const ua = request.headers.get('user-agent')\n    const claim = classifyUserAgent(ua)\n    if (claim) {\n      claimedName ??= claim.name\n      if (crawlers) {\n        attempted.push('verified-crawler')\n        const v = await verifyCrawler(claim, clientIp(request, crawlers.clientIp), crawlers.resolver)\n        if (v.status === 'verified') {\n          return {\n            status: 'verified',\n            agent: { id: `crawler:${claim.name}`, name: claim.name, vendor: null, method: 'verified-crawler', claims: { host: v.host } },\n          }\n        }\n        reasons.push(`crawler:${v.reason}`)\n      } else reasons.push('crawler:verification_disabled')\n    }\n\n    if (attempted.length || claim || (ua && GENERIC_AGENT_UA.test(ua)) || request.headers.has('signature-agent')) {\n      return {\n        status: 'unverified',\n        reason: reasons[0] ?? 'agent_claim_without_credentials',\n        ...(claimedName ? { claimedName } : {}),\n        attempted,\n      }\n    }\n    return { status: 'none' }\n  }\n\n  return { authenticate }\n}\n\n// ---- helpers: API keys ---------------------------------------------------------\n\n/** SHA-256 hex of an agent key — store this, never the key. */\nexport async function hashAgentKey(key: string): Promise<string> {\n  const d = await crypto.subtle.digest('SHA-256', new TextEncoder().encode(key))\n  return [...new Uint8Array(d)].map((b) => b.toString(16).padStart(2, '0')).join('')\n}\n\n/** Verifier over a static map of `sha256(key) → identity` (e.g. from env/config). */\nexport function staticKeyVerifier(hashedKeys: Record<string, ApiKeyIdentity>): ApiKeyOptions['verify'] {\n  return async (key) => hashedKeys[await hashAgentKey(key)] ?? null\n}\n\n/** Mint a new agent key (`agk_` + 32 random bytes, base64url). Show it once; store its hash. */\nexport function generateAgentKey(prefix = 'agk_'): string {\n  return prefix + bytesToBase64Url(crypto.getRandomValues(new Uint8Array(32)))\n}\n\n// ---- helpers: headers + tracing ------------------------------------------------\n\nexport const AGENT_HEADERS = {\n  status: 'x-agentronics-agent-status',\n  id: 'x-agentronics-agent-id',\n  name: 'x-agentronics-agent-name',\n  vendor: 'x-agentronics-agent-vendor',\n  method: 'x-agentronics-auth-method',\n} as const\n\n/**\n * Request headers to forward downstream, with the auth result attached.\n * Any incoming `x-agentronics-*` header is stripped first so a caller can\n * never forge a verified identity.\n */\nexport function withAgentHeaders(request: Request, result: AgentAuthResult): Headers {\n  const h = new Headers(request.headers)\n  for (const k of [...h.keys()]) if (k.toLowerCase().startsWith('x-agentronics-')) h.delete(k)\n  h.set(AGENT_HEADERS.status, result.status)\n  if (result.status === 'verified') {\n    h.set(AGENT_HEADERS.id, result.agent.id)\n    h.set(AGENT_HEADERS.name, result.agent.name)\n    h.set(AGENT_HEADERS.method, result.agent.method)\n    if (result.agent.vendor) h.set(AGENT_HEADERS.vendor, result.agent.vendor)\n  }\n  return h\n}\n\n/**\n * Read the forwarded result in a route handler (only trust it behind the\n * middleware). Accepts anything with `get()` — `Headers`, Next's read-only\n * `headers()`, or a plain adapter.\n */\nexport function readAgentHeaders(headers: { get(name: string): string | null }) {\n  const status = headers.get(AGENT_HEADERS.status) as AgentAuthResult['status'] | null\n  return {\n    status: status ?? 'none',\n    id: headers.get(AGENT_HEADERS.id),\n    name: headers.get(AGENT_HEADERS.name),\n    vendor: headers.get(AGENT_HEADERS.vendor),\n    method: headers.get(AGENT_HEADERS.method) as AgentAuthMethod | null,\n  }\n}\n\n/**\n * Map a result to an SDK trace event so server-side auth shows up in the\n * console's Auth + Logs pages next to in-browser agents. Returns null for\n * non-agent traffic. Server-side agents use class `crawler` (HTTP fetchers);\n * the method is in `metadata.protocol`.\n */\nexport function toTraceEvent(result: AgentAuthResult, ctx: { siteId: string; request: Request }): TraceEvent | null {\n  if (result.status === 'none') return null\n  const url = new URL(ctx.request.url)\n  const verified = result.status === 'verified'\n  return {\n    id: `evt_${crypto.randomUUID()}`,\n    siteId: ctx.siteId,\n    sessionId: verified ? result.agent.id : `unverified:${result.claimedName ?? 'unknown'}`,\n    occurredAt: new Date().toISOString(),\n    type: 'auth.identity_presented',\n    agent: {\n      class: 'crawler',\n      trust: verified ? 'verified' : 'declared',\n      confidence: verified ? 1 : 0.5,\n      vendor: verified ? (result.agent.vendor ?? result.agent.name) : (result.claimedName ?? null),\n      userAgent: ctx.request.headers.get('user-agent'),\n      detectionVersion: '2026.09',\n      signals: { surface: 'server' },\n    },\n    outcome: verified ? 'success' : 'error',\n    ...(verified ? {} : { error: result.reason }),\n    metadata: {\n      protocol: verified ? result.agent.method : (result.attempted[0] ?? 'none'),\n      ...(verified ? { subject: result.agent.id } : {}),\n      page: url.pathname,\n    },\n  }\n}\n","/**\n * Drop-in request handlers built on createAgentAuth().\n *\n * - createAgentAuthHandler(): framework-agnostic (Fetch Request in, identity out)\n * - expressAgentAuth():        Express / Connect middleware\n * - agentronicsMiddleware():   Next.js middleware — see '@agentronics/sdk/next'\n *\n * None of these ever block a request. They authenticate the agent (if any),\n * attach the result as `x-agentronics-*` request headers, and pass every\n * request through — verified agents, unverified agents and humans alike.\n */\nimport { createAgentAuth, withAgentHeaders, type AgentAuthOptions, type AgentAuthResult } from './agentAuth.js'\n\nexport interface AgentAuthHandlerOptions extends AgentAuthOptions {\n  /** Called for every agent request (not for plain human traffic). Never awaited on the hot path. */\n  onResult?: (event: { result: AgentAuthResult; request: Request }) => void | Promise<void>\n  /** Return false to skip a path (e.g. static assets). */\n  matcher?: (url: URL) => boolean\n}\n\nexport interface HandlerOutcome {\n  result: AgentAuthResult\n  /** Request headers to forward downstream (spoofed x-agentronics-* stripped). */\n  headers: Headers\n}\n\nexport function createAgentAuthHandler(options: AgentAuthHandlerOptions = {}) {\n  const auth = createAgentAuth(options)\n  return async function handle(request: Request): Promise<HandlerOutcome> {\n    if (options.matcher && !options.matcher(new URL(request.url))) {\n      const result: AgentAuthResult = { status: 'none' }\n      return { result, headers: withAgentHeaders(request, result) }\n    }\n    const result = await auth.authenticate(request)\n    if (result.status !== 'none' && options.onResult) {\n      // fire-and-forget: reporting must never slow or break the request\n      void Promise.resolve()\n        .then(() => options.onResult!({ result, request }))\n        .catch(() => undefined)\n    }\n    return { result, headers: withAgentHeaders(request, result) }\n  }\n}\n\n// ---- Express / Connect -----------------------------------------------------\n\ninterface NodeReq {\n  method?: string\n  url?: string\n  originalUrl?: string\n  protocol?: string\n  headers: Record<string, string | string[] | undefined>\n  agent?: AgentAuthResult\n}\n\n/**\n * Express middleware. Sets `req.agent` to the auth result and the\n * `x-agentronics-*` request headers for downstream handlers, then always\n * calls next(). For correct `@authority`/client IP behind a proxy, set\n * Express `trust proxy`.\n */\nexport function expressAgentAuth(options: AgentAuthHandlerOptions = {}) {\n  const handle = createAgentAuthHandler(options)\n  return (req: NodeReq, _res: unknown, next: (err?: unknown) => void) => {\n    const headers = new Headers()\n    for (const [k, v] of Object.entries(req.headers)) {\n      if (v !== undefined) headers.set(k, Array.isArray(v) ? v.join(', ') : v)\n    }\n    const host = headers.get('host') ?? 'localhost'\n    const url = `${req.protocol ?? 'http'}://${host}${req.originalUrl ?? req.url ?? '/'}`\n    handle(new Request(url, { method: req.method ?? 'GET', headers }))\n      .then((out) => {\n        req.agent = out.result\n        for (const k of Object.keys(req.headers)) if (k.startsWith('x-agentronics-')) delete req.headers[k]\n        out.headers.forEach((v, k) => {\n          if (k.startsWith('x-agentronics-')) req.headers[k] = v\n        })\n        next()\n      })\n      // Authentication problems must never take the site down — fall through\n      // as unauthenticated traffic.\n      .catch(() => {\n        for (const k of Object.keys(req.headers)) if (k.startsWith('x-agentronics-')) delete req.headers[k]\n        req.agent = { status: 'none' }\n        next()\n      })\n  }\n}\n"]}

package/dist/server.d.cts

@@ -0,0 +1,336 @@
+import { TraceEvent } from '@agentronics/protocol';
+
+type CrawlerCategory = 'ai' | 'search';
+interface CrawlerSignature {
+    /** Stable vendor id, reported as identity.vendor. */
+    name: string;
+    category: CrawlerCategory;
+    /** Tested against navigator.userAgent. */
+    pattern: RegExp;
+}
+
+/**
+ * Server-side crawler identification + verification.
+ *
+ * A User-Agent claim is trivially spoofable, so on its own it only makes a
+ * request "claimed". A claim becomes verified by forward-confirmed reverse DNS
+ * (the IP's PTR name sits under the vendor's documented domain AND resolves
+ * back to the same IP) — the method Google, Microsoft, Apple, Yandex, Baidu and
+ * Amazon document for their crawlers. Needs Node DNS; on edge runtimes the
+ * claim stays unverified (use Web Bot Auth, which works everywhere).
+ */
+
+/** Vendors that document reverse-DNS verification, keyed by signature name. */
+declare const RDNS_DOMAINS: Record<string, string[]>;
+interface CrawlerClaim {
+    name: string;
+    category: CrawlerSignature['category'];
+}
+declare function classifyUserAgent(ua: string | null, signatures?: CrawlerSignature[]): CrawlerClaim | null;
+/**
+ * Where the real client IP comes from. Platform headers are set by the edge
+ * and can't be spoofed by the caller; the leftmost X-Forwarded-For entry CAN,
+ * so it's never used by default.
+ */
+type ClientIpSource = 'auto' | 'cloudflare' | 'vercel' | ((request: Request) => string | null);
+declare function clientIp(request: Request, source?: ClientIpSource): string | null;
+interface DnsResolver {
+    reverse(ip: string): Promise<string[]>;
+    lookup(host: string): Promise<string[]>;
+}
+type CrawlerVerification = {
+    status: 'verified';
+    name: string;
+    host: string;
+    ip: string;
+} | {
+    status: 'unverified';
+    name: string;
+    reason: string;
+};
+declare function verifyCrawler(claim: CrawlerClaim, ip: string | null, resolver?: DnsResolver): Promise<CrawlerVerification>;
+
+/**
+ * Structured Field Values for HTTP (RFC 9651) — the subset HTTP Message
+ * Signatures (RFC 9421) and Web Bot Auth need: Dictionaries, Inner Lists,
+ * Items, Parameters; bare items of type Integer, Decimal, String, Token,
+ * Byte Sequence and Boolean. Parsing is strict (invalid input throws), and
+ * serialization is canonical, which RFC 9421 relies on for `@signature-params`.
+ */
+declare class SfToken {
+    readonly value: string;
+    constructor(value: string);
+}
+declare class SfDecimal {
+    readonly value: number;
+    constructor(value: number);
+}
+type BareItem = string | number | boolean | Uint8Array | SfToken | SfDecimal;
+type Params = Array<[string, BareItem]>;
+interface Item {
+    value: BareItem;
+    params: Params;
+}
+interface InnerList {
+    items: Item[];
+    params: Params;
+}
+
+/**
+ * HTTP Message Signatures (RFC 9421) — request verification only.
+ * Runtime-neutral: WebCrypto + Fetch `Request`, so it runs on Node ≥ 20,
+ * Vercel/Next edge middleware, Cloudflare Workers, Deno and Bun.
+ */
+
+interface ComponentContext {
+    request: Request;
+    url: URL;
+    /** Override for `@authority` (e.g. when a proxy rewrites Host). */
+    authority?: string;
+}
+/** Build the signature base (RFC 9421 §2.5) for one Signature-Input member. */
+declare function signatureBase(input: InnerList, ctx: ComponentContext): string;
+interface PublicJwk {
+    kty: string;
+    crv?: string;
+    x?: string;
+    y?: string;
+    n?: string;
+    e?: string;
+    kid?: string;
+    alg?: string;
+    use?: string;
+    nbf?: number;
+    exp?: number;
+}
+type SignatureAlgorithm = 'ed25519' | 'rsa-pss-sha512' | 'rsa-v1_5-sha256' | 'ecdsa-p256-sha256' | 'ecdsa-p384-sha384';
+/** JWK SHA-256 thumbprint, base64url (RFC 7638; RFC 8037 §A.3 for OKP). */
+declare function jwkThumbprint(jwk: PublicJwk): Promise<string>;
+
+/**
+ * Web Bot Auth verifier — draft-meunier-webbotauth-httpsig-protocol-02.
+ *
+ * A signed agent request carries:
+ *   Signature-Agent: agent2="https://signer.example"        (dictionary form)
+ *   Signature-Input: sig2=("@authority" "signature-agent";key="agent2");
+ *                    created=…;expires=…;keyid="<JWK thumbprint>";tag="web-bot-auth"
+ *   Signature:       sig2=:<base64>:
+ * The verifier resolves the signer's key directory
+ * (<origin>/.well-known/http-message-signatures-directory by default), picks
+ * the key whose JWK thumbprint equals `keyid`, rebuilds the RFC 9421 signature
+ * base, and verifies it. Cheap checks run before any network call.
+ */
+
+declare const WEB_BOT_AUTH_TAG = "web-bot-auth";
+declare const DIRECTORY_PATH = "/.well-known/http-message-signatures-directory";
+interface ReplayCache {
+    has(key: string): boolean | Promise<boolean>;
+    add(key: string, ttlSeconds: number): void | Promise<void>;
+}
+/** Bounded in-memory replay cache. Use a shared store (Redis…) across instances. */
+declare function memoryReplayCache(maxEntries?: number): ReplayCache;
+interface WebBotAuthOptions {
+    /**
+     * Which signers may be resolved. `'any'` (default) accepts any public HTTPS
+     * signer behind SSRF guards; a list restricts to those origins/URLs.
+     */
+    allowedDirectories?: 'any' | string[];
+    /** Accepted clock drift in seconds. Default 60. */
+    clockSkewSec?: number;
+    /** Max `expires - created`, seconds. Default 86400 (spec: ≤ 24 h recommended). */
+    maxValiditySec?: number;
+    /** Reject signatures without a `nonce`. Default false. */
+    requireNonce?: boolean;
+    replayCache?: ReplayCache;
+    /** Override `@authority` when a proxy rewrites Host. */
+    authority?: (request: Request, url: URL) => string;
+    /** Node only: DNS-check directory hosts for private addresses. Default true. */
+    resolveDns?: boolean;
+    /** Test seams. */
+    fetch?: typeof fetch;
+    now?: () => number;
+}
+type WebBotAuthResult = {
+    status: 'absent';
+} | {
+    status: 'verified';
+    /** Stable identity: the signer URL (directory origin or JWKS URL). */
+    agentUrl: string;
+    keyid: string;
+    label: string;
+    alg: SignatureAlgorithm;
+    created: number;
+    expires: number;
+} | {
+    status: 'invalid';
+    reason: string;
+    agentUrl?: string;
+    keyid?: string;
+};
+declare function verifyWebBotAuth(request: Request, opts?: WebBotAuthOptions): Promise<WebBotAuthResult>;
+
+/**
+ * Agent authentication for any HTTP request — the server half of the SDK.
+ *
+ *   const auth = createAgentAuth({ apiKey: { verify } })
+ *   const result = await auth.authenticate(request)   // Fetch API Request
+ *
+ * Authentication never blocks. A verified agent gets a stable identity your
+ * routes can read; an unverified agent (or a human) browses exactly as before.
+ *
+ * Methods, strongest first: Web Bot Auth (RFC 9421 signed agents), agent API
+ * keys, OAuth2 client-credentials JWTs, and verified crawlers (forward-confirmed
+ * reverse DNS). Everything runs on Node ≥ 20 and edge runtimes except crawler
+ * rDNS, which needs Node DNS (it degrades to "unverified", never "verified").
+ */
+
+type AgentAuthMethod = 'web-bot-auth' | 'api-key' | 'oauth2' | 'verified-crawler';
+interface VerifiedAgent {
+    /** Stable id: signer URL, API-key agent id, OAuth client id, or crawler name. */
+    id: string;
+    name: string;
+    vendor: string | null;
+    method: AgentAuthMethod;
+    claims?: Record<string, unknown>;
+}
+type AgentAuthResult = {
+    status: 'verified';
+    agent: VerifiedAgent;
+} | {
+    status: 'unverified';
+    reason: string;
+    claimedName?: string;
+    attempted: AgentAuthMethod[];
+} | {
+    status: 'none';
+};
+interface ApiKeyIdentity {
+    agentId: string;
+    name?: string;
+    vendor?: string;
+    scopes?: string[];
+}
+interface ApiKeyOptions {
+    /** Key prefix that marks a bearer token as an agent key. Default `agk_`. */
+    prefix?: string;
+    /** Look the key up. Return null for unknown/revoked keys. */
+    verify: (key: string) => ApiKeyIdentity | null | Promise<ApiKeyIdentity | null>;
+}
+interface OAuth2Options {
+    issuer: string;
+    audience: string | string[];
+    /** Default `<issuer>/.well-known/jwks.json`. */
+    jwksUri?: string;
+    /** Static JWKS (tests / pinned keys) instead of fetching `jwksUri`. */
+    jwks?: {
+        keys: JsonWebKey[];
+    };
+    requiredScopes?: string[];
+    algorithms?: string[];
+    clockToleranceSec?: number;
+}
+interface CrawlerOptions {
+    /** Where to read the client IP. Default 'auto' (platform headers only). */
+    clientIp?: ClientIpSource;
+    /** Test seam / custom resolver. */
+    resolver?: DnsResolver;
+}
+interface AgentAuthOptions {
+    /** Web Bot Auth (on by default). `false` disables it. */
+    webBotAuth?: boolean | WebBotAuthOptions;
+    apiKey?: ApiKeyOptions;
+    oauth2?: OAuth2Options;
+    /** Verified crawlers (on by default). `false` disables it. */
+    crawlers?: boolean | CrawlerOptions;
+}
+declare function createAgentAuth(options?: AgentAuthOptions): {
+    authenticate: (request: Request) => Promise<AgentAuthResult>;
+};
+/** SHA-256 hex of an agent key — store this, never the key. */
+declare function hashAgentKey(key: string): Promise<string>;
+/** Verifier over a static map of `sha256(key) → identity` (e.g. from env/config). */
+declare function staticKeyVerifier(hashedKeys: Record<string, ApiKeyIdentity>): ApiKeyOptions['verify'];
+/** Mint a new agent key (`agk_` + 32 random bytes, base64url). Show it once; store its hash. */
+declare function generateAgentKey(prefix?: string): string;
+declare const AGENT_HEADERS: {
+    readonly status: "x-agentronics-agent-status";
+    readonly id: "x-agentronics-agent-id";
+    readonly name: "x-agentronics-agent-name";
+    readonly vendor: "x-agentronics-agent-vendor";
+    readonly method: "x-agentronics-auth-method";
+};
+/**
+ * Request headers to forward downstream, with the auth result attached.
+ * Any incoming `x-agentronics-*` header is stripped first so a caller can
+ * never forge a verified identity.
+ */
+declare function withAgentHeaders(request: Request, result: AgentAuthResult): Headers;
+/**
+ * Read the forwarded result in a route handler (only trust it behind the
+ * middleware). Accepts anything with `get()` — `Headers`, Next's read-only
+ * `headers()`, or a plain adapter.
+ */
+declare function readAgentHeaders(headers: {
+    get(name: string): string | null;
+}): {
+    status: "verified" | "unverified" | "none";
+    id: string | null;
+    name: string | null;
+    vendor: string | null;
+    method: AgentAuthMethod | null;
+};
+/**
+ * Map a result to an SDK trace event so server-side auth shows up in the
+ * console's Auth + Logs pages next to in-browser agents. Returns null for
+ * non-agent traffic. Server-side agents use class `crawler` (HTTP fetchers);
+ * the method is in `metadata.protocol`.
+ */
+declare function toTraceEvent(result: AgentAuthResult, ctx: {
+    siteId: string;
+    request: Request;
+}): TraceEvent | null;
+
+/**
+ * Drop-in request handlers built on createAgentAuth().
+ *
+ * - createAgentAuthHandler(): framework-agnostic (Fetch Request in, identity out)
+ * - expressAgentAuth():        Express / Connect middleware
+ * - agentronicsMiddleware():   Next.js middleware — see '@agentronics/sdk/next'
+ *
+ * None of these ever block a request. They authenticate the agent (if any),
+ * attach the result as `x-agentronics-*` request headers, and pass every
+ * request through — verified agents, unverified agents and humans alike.
+ */
+
+interface AgentAuthHandlerOptions extends AgentAuthOptions {
+    /** Called for every agent request (not for plain human traffic). Never awaited on the hot path. */
+    onResult?: (event: {
+        result: AgentAuthResult;
+        request: Request;
+    }) => void | Promise<void>;
+    /** Return false to skip a path (e.g. static assets). */
+    matcher?: (url: URL) => boolean;
+}
+interface HandlerOutcome {
+    result: AgentAuthResult;
+    /** Request headers to forward downstream (spoofed x-agentronics-* stripped). */
+    headers: Headers;
+}
+declare function createAgentAuthHandler(options?: AgentAuthHandlerOptions): (request: Request) => Promise<HandlerOutcome>;
+interface NodeReq {
+    method?: string;
+    url?: string;
+    originalUrl?: string;
+    protocol?: string;
+    headers: Record<string, string | string[] | undefined>;
+    agent?: AgentAuthResult;
+}
+/**
+ * Express middleware. Sets `req.agent` to the auth result and the
+ * `x-agentronics-*` request headers for downstream handlers, then always
+ * calls next(). For correct `@authority`/client IP behind a proxy, set
+ * Express `trust proxy`.
+ */
+declare function expressAgentAuth(options?: AgentAuthHandlerOptions): (req: NodeReq, _res: unknown, next: (err?: unknown) => void) => void;
+
+export { AGENT_HEADERS, type AgentAuthHandlerOptions, type AgentAuthMethod, type AgentAuthOptions, type AgentAuthResult, type ApiKeyIdentity, type ApiKeyOptions, type ClientIpSource, type CrawlerOptions, DIRECTORY_PATH, type HandlerOutcome, type OAuth2Options, type PublicJwk, RDNS_DOMAINS, type ReplayCache, type SignatureAlgorithm, type VerifiedAgent, WEB_BOT_AUTH_TAG, type WebBotAuthOptions, type WebBotAuthResult, classifyUserAgent, clientIp, createAgentAuth, createAgentAuthHandler, expressAgentAuth, generateAgentKey, hashAgentKey, jwkThumbprint, memoryReplayCache, readAgentHeaders, signatureBase, staticKeyVerifier, toTraceEvent, verifyCrawler, verifyWebBotAuth, withAgentHeaders };