@agentronics/sdk 0.6.0 → 0.7.1

package/dist/webmcp-BgKzHeQ3.d.cts

@@ -0,0 +1,97 @@
+import { AgentIdentity } from '@agentronics/protocol';
+
+/**
+ * The WebMCP `ModelContext` surface, per the W3C WebMCP draft (Oct 2026):
+ *
+ *   await document.modelContext.registerTool(tool, { signal, exposedTo })
+ *
+ * - The getter lives on `document`. `navigator.modelContext` was the old name;
+ *   Chrome 150 kept it as an alias and Chrome 152 removed it, so it's read
+ *   only as a fallback.
+ * - `registerTool()` is async. There is no `unregisterTool()`; aborting the
+ *   `signal` passed at registration unregisters the tool.
+ * - `toolactivated` / `toolcancel` events fire on the ModelContext when an
+ *   agent starts or cancels a tool call — the only reliable "an agent is here"
+ *   signal, because the API itself exists for every visitor of a WebMCP browser.
+ * - The declarative form API (`<form toolname>`) was removed from the spec
+ *   (Oct 8, 2026) and lives on only as an explainer; the SDK registers every
+ *   tool imperatively.
+ */
+interface ToolAnnotations {
+    /** The tool only reads; agents may call it without asking the user. */
+    readOnlyHint?: boolean;
+    /** The tool's output includes content the site didn't author (reviews, messages, …). */
+    untrustedContentHint?: boolean;
+    /** Payments, deletes, sends — the agent should confirm with the user first. */
+    consequentialHint?: boolean;
+    /** Exposed only to agent debugging tools. */
+    debugging?: boolean;
+}
+interface ToolExecuteOptions {
+    signal: AbortSignal;
+}
+interface ModelContextTool {
+    name: string;
+    title?: string;
+    description: string;
+    inputSchema?: Record<string, unknown>;
+    annotations?: ToolAnnotations;
+    execute: (input: Record<string, unknown>, options: ToolExecuteOptions) => Promise<unknown>;
+}
+interface RegisterToolOptions {
+    signal?: AbortSignal;
+    /** Origins (besides this one) whose agents may see the tool. */
+    exposedTo?: string[];
+}
+interface ModelContextLike {
+    registerTool(tool: ModelContextTool, options?: RegisterToolOptions): Promise<void> | void;
+    addEventListener?: (type: string, listener: (event: Event) => void) => void;
+    removeEventListener?: (type: string, listener: (event: Event) => void) => void;
+}
+/** Very old polyfills exposed `provideContext({ tools })` instead of `registerTool`. */
+interface LegacyProvider {
+    provideContext(payload: {
+        tools: Array<{
+            name: string;
+            description?: string;
+            inputSchema?: Record<string, unknown>;
+            invoke(input?: unknown): Promise<unknown>;
+        }>;
+    }): {
+        revoke: () => void;
+    };
+}
+type ModelContextSource = 'document' | 'navigator' | 'legacy';
+interface ResolvedModelContext {
+    source: ModelContextSource;
+    context: ModelContextLike | LegacyProvider;
+}
+interface HostLike {
+    document?: {
+        modelContext?: unknown;
+    } | null;
+    navigator?: {
+        modelContext?: unknown;
+    } | null;
+}
+/** Find the page's ModelContext: `document.modelContext`, then the legacy names. */
+declare const resolveModelContext: (host?: HostLike | null) => ResolvedModelContext | null;
+interface WebMcpActivity {
+    type: 'activated' | 'cancelled' | 'executed';
+    toolName: string;
+    at: number;
+}
+declare const onWebMcpActivity: (listener: (activity: WebMcpActivity) => void) => () => void;
+
+interface DetectWebMcpOptions {
+    /**
+     * Wait up to this many milliseconds for an agent to act (or an extension to
+     * inject itself). 0 reads once and returns immediately.
+     */
+    pollMs?: number;
+}
+/** Whether this page can serve WebMCP tools, and through which surface. */
+declare const webMcpSupport: () => ModelContextSource | null;
+declare const detectWebMcp: (options?: DetectWebMcpOptions) => Promise<AgentIdentity | null>;
+
+export { type DetectWebMcpOptions as D, type LegacyProvider as L, type ModelContextTool as M, type ToolAnnotations as T, type WebMcpActivity as W, type ModelContextSource as a, type ModelContextLike as b, detectWebMcp as d, onWebMcpActivity as o, resolveModelContext as r, webMcpSupport as w };

package/dist/webmcp-BgKzHeQ3.d.ts

@@ -0,0 +1,97 @@
+import { AgentIdentity } from '@agentronics/protocol';
+
+/**
+ * The WebMCP `ModelContext` surface, per the W3C WebMCP draft (Oct 2026):
+ *
+ *   await document.modelContext.registerTool(tool, { signal, exposedTo })
+ *
+ * - The getter lives on `document`. `navigator.modelContext` was the old name;
+ *   Chrome 150 kept it as an alias and Chrome 152 removed it, so it's read
+ *   only as a fallback.
+ * - `registerTool()` is async. There is no `unregisterTool()`; aborting the
+ *   `signal` passed at registration unregisters the tool.
+ * - `toolactivated` / `toolcancel` events fire on the ModelContext when an
+ *   agent starts or cancels a tool call — the only reliable "an agent is here"
+ *   signal, because the API itself exists for every visitor of a WebMCP browser.
+ * - The declarative form API (`<form toolname>`) was removed from the spec
+ *   (Oct 8, 2026) and lives on only as an explainer; the SDK registers every
+ *   tool imperatively.
+ */
+interface ToolAnnotations {
+    /** The tool only reads; agents may call it without asking the user. */
+    readOnlyHint?: boolean;
+    /** The tool's output includes content the site didn't author (reviews, messages, …). */
+    untrustedContentHint?: boolean;
+    /** Payments, deletes, sends — the agent should confirm with the user first. */
+    consequentialHint?: boolean;
+    /** Exposed only to agent debugging tools. */
+    debugging?: boolean;
+}
+interface ToolExecuteOptions {
+    signal: AbortSignal;
+}
+interface ModelContextTool {
+    name: string;
+    title?: string;
+    description: string;
+    inputSchema?: Record<string, unknown>;
+    annotations?: ToolAnnotations;
+    execute: (input: Record<string, unknown>, options: ToolExecuteOptions) => Promise<unknown>;
+}
+interface RegisterToolOptions {
+    signal?: AbortSignal;
+    /** Origins (besides this one) whose agents may see the tool. */
+    exposedTo?: string[];
+}
+interface ModelContextLike {
+    registerTool(tool: ModelContextTool, options?: RegisterToolOptions): Promise<void> | void;
+    addEventListener?: (type: string, listener: (event: Event) => void) => void;
+    removeEventListener?: (type: string, listener: (event: Event) => void) => void;
+}
+/** Very old polyfills exposed `provideContext({ tools })` instead of `registerTool`. */
+interface LegacyProvider {
+    provideContext(payload: {
+        tools: Array<{
+            name: string;
+            description?: string;
+            inputSchema?: Record<string, unknown>;
+            invoke(input?: unknown): Promise<unknown>;
+        }>;
+    }): {
+        revoke: () => void;
+    };
+}
+type ModelContextSource = 'document' | 'navigator' | 'legacy';
+interface ResolvedModelContext {
+    source: ModelContextSource;
+    context: ModelContextLike | LegacyProvider;
+}
+interface HostLike {
+    document?: {
+        modelContext?: unknown;
+    } | null;
+    navigator?: {
+        modelContext?: unknown;
+    } | null;
+}
+/** Find the page's ModelContext: `document.modelContext`, then the legacy names. */
+declare const resolveModelContext: (host?: HostLike | null) => ResolvedModelContext | null;
+interface WebMcpActivity {
+    type: 'activated' | 'cancelled' | 'executed';
+    toolName: string;
+    at: number;
+}
+declare const onWebMcpActivity: (listener: (activity: WebMcpActivity) => void) => () => void;
+
+interface DetectWebMcpOptions {
+    /**
+     * Wait up to this many milliseconds for an agent to act (or an extension to
+     * inject itself). 0 reads once and returns immediately.
+     */
+    pollMs?: number;
+}
+/** Whether this page can serve WebMCP tools, and through which surface. */
+declare const webMcpSupport: () => ModelContextSource | null;
+declare const detectWebMcp: (options?: DetectWebMcpOptions) => Promise<AgentIdentity | null>;
+
+export { type DetectWebMcpOptions as D, type LegacyProvider as L, type ModelContextTool as M, type ToolAnnotations as T, type WebMcpActivity as W, type ModelContextSource as a, type ModelContextLike as b, detectWebMcp as d, onWebMcpActivity as o, resolveModelContext as r, webMcpSupport as w };

package/package.json

@@ -1,7 +1,7 @@
 {
   "name": "@agentronics/sdk",
-  "version": "0.6.0",
-  "description": "Authentication for AI agents — verify every agent on your site (WebMCP, browser agents, crawlers, API agents) with any method: Web Bot Auth, API keys, OAuth2, SSO, SPIFFE, mTLS.",
+  "version": "0.7.1",
+  "description": "Govern AI agents on your site — detect them (WebMCP, browser, vision, crawlers), authenticate them (Web Bot Auth, OAuth 2.1, agent API keys, verified crawlers), authorize every WebMCP tool call (allow / deny / review), and observe it all.",
   "license": "Apache-2.0",
   "repository": {
     "type": "git",
@@ -42,7 +42,7 @@
   ],
   "dependencies": {
     "jose": "^6.2.3",
-    "@agentronics/protocol": "0.4.0"
+    "@agentronics/protocol": "0.5.0"
   },
   "devDependencies": {
     "@size-limit/preset-small-lib": "^11.1.6",
@@ -60,7 +60,7 @@
     {
       "name": "Agentronics.init reachable graph (esm, brotli)",
       "path": "dist/init-only.js",
-      "limit": "25 KB"
+      "limit": "28 KB"
     },
     {
       "name": "lite (esm, gzipped)",

package/dist/chunk-LLD3Y2LZ.js

@@ -1,2 +0,0 @@
-var n="0.1.2";var l=()=>{if(typeof navigator>"u")return null;let e=navigator.modelContext;return e&&typeof e=="object"?e:null},d=async(e={})=>{let{pollMs:o=500}=e,r=Date.now();for(;;){let t=l();if(t)return s(t);if(Date.now()-r>=o)return null;await new Promise(i=>setTimeout(i,50));}},s=e=>({class:"webmcp",trust:"detected",confidence:1,vendor:e.vendor??e.client??null,userAgent:typeof navigator>"u"?null:navigator.userAgent,detectionVersion:n,signals:{webmcp:true,toolCount:Array.isArray(e.tools)?e.tools.length:0}});export{n as a,d as b};//# sourceMappingURL=chunk-LLD3Y2LZ.js.map
-//# sourceMappingURL=chunk-LLD3Y2LZ.js.map

package/dist/chunk-LLD3Y2LZ.js.map

@@ -1 +0,0 @@
-{"version":3,"sources":["../src/version.ts","../src/detection/webmcp.ts"],"names":["SDK_VERSION","readModelContext","value","detectWebMcp","options","pollMs","start","ctx","buildIdentity","resolve"],"mappings":"AAKO,IAAMA,CAAAA,CAAc,QCI3B,IAAMC,CAAAA,CAAmB,IAA+B,CACtD,GAAI,OAAO,SAAA,CAAc,GAAA,CAAa,OAAO,IAAA,CAC7C,IAAMC,CAAAA,CAAS,SAAA,CAA6D,YAAA,CAC5E,OAAOA,CAAAA,EAAS,OAAOA,GAAU,QAAA,CAAWA,CAAAA,CAAQ,IACtD,CAAA,CAUaC,CAAAA,CAAe,MAC1BC,EAA+B,EAAC,GACE,CAClC,GAAM,CAAE,MAAA,CAAAC,EAAS,GAAI,CAAA,CAAID,CAAAA,CACnBE,CAAAA,CAAQ,IAAA,CAAK,GAAA,GAEnB,OAAa,CACX,IAAMC,CAAAA,CAAMN,CAAAA,EAAiB,CAC7B,GAAIM,CAAAA,CAAK,OAAOC,CAAAA,CAAcD,CAAG,CAAA,CACjC,GAAI,IAAA,CAAK,KAAI,CAAID,CAAAA,EAASD,CAAAA,CAAQ,OAAO,IAAA,CACzC,MAAM,IAAI,OAAA,CAASI,CAAAA,EAAY,UAAA,CAAWA,CAAAA,CAAS,EAAE,CAAC,EACxD,CACF,CAAA,CAEMD,CAAAA,CAAiBD,CAAAA,GAA0C,CAC/D,KAAA,CAAO,SACP,KAAA,CAAO,UAAA,CACP,UAAA,CAAY,CAAA,CACZ,MAAA,CAAQA,CAAAA,CAAI,QAAUA,CAAAA,CAAI,MAAA,EAAU,IAAA,CACpC,SAAA,CAAW,OAAO,SAAA,CAAc,IAAc,IAAA,CAAO,SAAA,CAAU,SAAA,CAC/D,gBAAA,CAAkBP,CAAAA,CAClB,OAAA,CAAS,CACP,MAAA,CAAQ,IAAA,CACR,SAAA,CAAW,KAAA,CAAM,OAAA,CAAQO,CAAAA,CAAI,KAAK,CAAA,CAAIA,CAAAA,CAAI,KAAA,CAAM,MAAA,CAAS,CAC3D,CACF,CAAA","file":"chunk-LLD3Y2LZ.js","sourcesContent":["// Single source of truth for the SDK build version, surfaced on every\n// AgentIdentity as `detectionVersion` so traces can be filtered by SDK\n// generation. tsup inlines a pkg-version replacement at build time;\n// the literal here is the dev/test fallback. Bump this when you cut a\n// new SDK release.\nexport const SDK_VERSION = '0.1.2'\n","import type { AgentIdentity } from '@agentronics/protocol'\nimport { SDK_VERSION } from \"../version.js\"\n\ninterface ModelContextLike {\n  client?: string\n  vendor?: string\n  tools?: unknown[]\n}\n\nconst readModelContext = (): ModelContextLike | null => {\n  if (typeof navigator === 'undefined') return null\n  const value = (navigator as unknown as { modelContext?: ModelContextLike }).modelContext\n  return value && typeof value === 'object' ? value : null\n}\n\nexport interface DetectWebMcpOptions {\n  /**\n   * Some extensions inject `navigator.modelContext` after first paint. Poll for this many\n   * milliseconds before giving up. Set to 0 to read synchronously and return immediately.\n   */\n  pollMs?: number\n}\n\nexport const detectWebMcp = async (\n  options: DetectWebMcpOptions = {}\n): Promise<AgentIdentity | null> => {\n  const { pollMs = 500 } = options\n  const start = Date.now()\n\n  while (true) {\n    const ctx = readModelContext()\n    if (ctx) return buildIdentity(ctx)\n    if (Date.now() - start >= pollMs) return null\n    await new Promise((resolve) => setTimeout(resolve, 50))\n  }\n}\n\nconst buildIdentity = (ctx: ModelContextLike): AgentIdentity => ({\n  class: 'webmcp',\n  trust: 'detected',\n  confidence: 1,\n  vendor: ctx.vendor ?? ctx.client ?? null,\n  userAgent: typeof navigator === 'undefined' ? null : navigator.userAgent,\n  detectionVersion: SDK_VERSION,\n  signals: {\n    webmcp: true,\n    toolCount: Array.isArray(ctx.tools) ? ctx.tools.length : 0,\n  },\n})\n"]}

package/dist/chunk-X7NFMFN6.js.map

@@ -1 +0,0 @@
-{"version":3,"sources":["../src/detection/crawler.ts","../src/server/crawlers.ts","../src/server/structuredFields.ts","../src/server/httpSignatures.ts","../src/server/safeFetch.ts","../src/server/webBotAuth.ts","../src/server/agentAuth.ts","../src/server/middleware.ts"],"names":["result"],"mappings":";AA0BO,IAAM,kBAAA,GAAyC;AAAA;AAAA,EAEpD,EAAE,IAAA,EAAM,QAAA,EAAU,QAAA,EAAU,IAAA,EAAM,SAAS,SAAA,EAAU;AAAA,EACrD,EAAE,IAAA,EAAM,eAAA,EAAiB,QAAA,EAAU,IAAA,EAAM,SAAS,gBAAA,EAAiB;AAAA,EACnE,EAAE,IAAA,EAAM,cAAA,EAAgB,QAAA,EAAU,IAAA,EAAM,SAAS,eAAA,EAAgB;AAAA,EACjE,EAAE,IAAA,EAAM,WAAA,EAAa,QAAA,EAAU,IAAA,EAAM,SAAS,YAAA,EAAa;AAAA,EAC3D,EAAE,IAAA,EAAM,YAAA,EAAc,QAAA,EAAU,IAAA,EAAM,SAAS,aAAA,EAAc;AAAA,EAC7D,EAAE,IAAA,EAAM,cAAA,EAAgB,QAAA,EAAU,IAAA,EAAM,SAAS,eAAA,EAAgB;AAAA,EACjE,EAAE,IAAA,EAAM,eAAA,EAAiB,QAAA,EAAU,IAAA,EAAM,SAAS,gBAAA,EAAiB;AAAA,EACnE,EAAE,IAAA,EAAM,iBAAA,EAAmB,QAAA,EAAU,IAAA,EAAM,SAAS,kBAAA,EAAmB;AAAA,EACvE,EAAE,IAAA,EAAM,mBAAA,EAAqB,QAAA,EAAU,IAAA,EAAM,SAAS,oBAAA,EAAqB;AAAA,EAC3E,EAAE,IAAA,EAAM,WAAA,EAAa,QAAA,EAAU,IAAA,EAAM,SAAS,YAAA,EAAa;AAAA,EAC3D,EAAE,IAAA,EAAM,YAAA,EAAc,QAAA,EAAU,IAAA,EAAM,SAAS,aAAA,EAAc;AAAA,EAC7D,EAAE,IAAA,EAAM,OAAA,EAAS,QAAA,EAAU,IAAA,EAAM,SAAS,QAAA,EAAS;AAAA,EACnD,EAAE,IAAA,EAAM,oBAAA,EAAsB,QAAA,EAAU,IAAA,EAAM,SAAS,qBAAA,EAAsB;AAAA,EAC7E,EAAE,IAAA,EAAM,WAAA,EAAa,QAAA,EAAU,IAAA,EAAM,SAAS,YAAA,EAAa;AAAA;AAAA,EAE3D,EAAE,IAAA,EAAM,WAAA,EAAa,QAAA,EAAU,QAAA,EAAU,SAAS,YAAA,EAAa;AAAA,EAC/D,EAAE,IAAA,EAAM,SAAA,EAAW,QAAA,EAAU,QAAA,EAAU,SAAS,UAAA,EAAW;AAAA,EAC3D,EAAE,IAAA,EAAM,aAAA,EAAe,QAAA,EAAU,QAAA,EAAU,SAAS,cAAA,EAAe;AAAA,EACnE,EAAE,IAAA,EAAM,WAAA,EAAa,QAAA,EAAU,QAAA,EAAU,SAAS,YAAA,EAAa;AAAA,EAC/D,EAAE,IAAA,EAAM,aAAA,EAAe,QAAA,EAAU,QAAA,EAAU,SAAS,cAAA,EAAe;AAAA,EACnE,EAAE,IAAA,EAAM,UAAA,EAAY,QAAA,EAAU,QAAA,EAAU,SAAS,WAAA;AACnD,CAAA;;;ACpCO,IAAM,YAAA,GAAyC;AAAA,EACpD,SAAA,EAAW,CAAC,eAAA,EAAiB,YAAA,EAAc,uBAAuB,CAAA;AAAA,EAClE,OAAA,EAAS,CAAC,gBAAgB,CAAA;AAAA,EAC1B,QAAA,EAAU,CAAC,oBAAoB,CAAA;AAAA,EAC/B,mBAAA,EAAqB,CAAC,oBAAoB,CAAA;AAAA,EAC1C,SAAA,EAAW,CAAC,WAAA,EAAa,YAAA,EAAc,YAAY,CAAA;AAAA,EACnD,WAAA,EAAa,CAAC,WAAA,EAAa,UAAU,CAAA;AAAA,EACrC,SAAA,EAAW,CAAC,wBAAwB;AACtC;AAOO,SAAS,iBAAA,CAAkB,EAAA,EAAmB,UAAA,GAAa,kBAAA,EAAyC;AACzG,EAAA,IAAI,CAAC,IAAI,OAAO,IAAA;AAChB,EAAA,MAAM,GAAA,GAAM,WAAW,IAAA,CAAK,CAAC,MAAM,CAAA,CAAE,OAAA,CAAQ,IAAA,CAAK,EAAE,CAAC,CAAA;AACrD,EAAA,OAAO,GAAA,GAAM,EAAE,IAAA,EAAM,GAAA,CAAI,MAAM,QAAA,EAAU,GAAA,CAAI,UAAS,GAAI,IAAA;AAC5D;AASO,SAAS,QAAA,CAAS,OAAA,EAAkB,MAAA,GAAyB,MAAA,EAAuB;AACzF,EAAA,IAAI,OAAO,MAAA,KAAW,UAAA,EAAY,OAAO,OAAO,OAAO,CAAA;AACvD,EAAA,MAAM,IAAI,OAAA,CAAQ,OAAA;AAClB,EAAA,IAAI,MAAA,KAAW,YAAA,EAAc,OAAO,CAAA,CAAE,IAAI,kBAAkB,CAAA;AAC5D,EAAA,IAAI,MAAA,KAAW,UAAU,OAAO,CAAA,CAAE,IAAI,WAAW,CAAA,IAAK,CAAA,CAAE,GAAA,CAAI,wBAAwB,CAAA;AACpF,EAAA,OAAO,CAAA,CAAE,GAAA,CAAI,kBAAkB,CAAA,IAAK,CAAA,CAAE,IAAI,WAAW,CAAA,IAAK,CAAA,CAAE,GAAA,CAAI,wBAAwB,CAAA;AAC1F;AAaA,eAAe,YAAA,GAA4C;AACzD,EAAA,IAAI;AACF,IAAA,MAAM,MAAO,MAAM;AAAA;AAAA;AAAA,MAAoD;AAAA,KAA6B;AACpG,IAAA,OAAO;AAAA,MACL,OAAA,EAAS,CAAC,EAAA,KAAO,GAAA,CAAI,QAAQ,EAAE,CAAA;AAAA,MAC/B,QAAQ,OAAO,IAAA,KAAA,CAAU,MAAM,GAAA,CAAI,OAAO,IAAA,EAAM,EAAE,GAAA,EAAK,IAAA,EAAM,CAAA,EAAG,GAAA,CAAI,CAAC,CAAA,KAAM,EAAE,OAAO;AAAA,KACtF;AAAA,EACF,CAAA,CAAA,MAAQ;AACN,IAAA,OAAO,IAAA;AAAA,EACT;AACF;AAEA,IAAM,SAAA,uBAAgB,GAAA,EAA2D;AAOjF,eAAsB,aAAA,CACpB,KAAA,EACA,EAAA,EACA,QAAA,EAC8B;AAC9B,EAAA,MAAM,OAAA,GAAU,YAAA,CAAa,KAAA,CAAM,IAAI,CAAA;AACvC,EAAA,IAAI,CAAC,OAAA,EAAS,OAAO,EAAE,MAAA,EAAQ,cAAc,IAAA,EAAM,KAAA,CAAM,IAAA,EAAM,MAAA,EAAQ,2BAAA,EAA4B;AACnG,EAAA,IAAI,CAAC,EAAA,EAAI,OAAO,EAAE,MAAA,EAAQ,cAAc,IAAA,EAAM,KAAA,CAAM,IAAA,EAAM,MAAA,EAAQ,mBAAA,EAAoB;AAEtF,EAAA,MAAM,GAAA,GAAM,CAAA,EAAG,KAAA,CAAM,IAAI,IAAI,EAAE,CAAA,CAAA;AAC/B,EAAA,MAAM,GAAA,GAAM,SAAA,CAAU,GAAA,CAAI,GAAG,CAAA;AAC7B,EAAA,IAAI,GAAA,IAAO,GAAA,CAAI,KAAA,GAAQ,IAAA,CAAK,KAAI,EAAG;AACjC,IAAA,OAAO,GAAA,CAAI,KACP,EAAE,MAAA,EAAQ,YAAY,IAAA,EAAM,KAAA,CAAM,MAAM,IAAA,EAAM,GAAA,CAAI,MAAO,EAAA,EAAG,GAC5D,EAAE,MAAA,EAAQ,YAAA,EAAc,MAAM,KAAA,CAAM,IAAA,EAAM,QAAQ,eAAA,EAAgB;AAAA,EACxE;AAEA,EAAA,MAAM,GAAA,GAAM,QAAA,IAAa,MAAM,YAAA,EAAa;AAC5C,EAAA,IAAI,CAAC,GAAA,EAAK,OAAO,EAAE,MAAA,EAAQ,cAAc,IAAA,EAAM,KAAA,CAAM,IAAA,EAAM,MAAA,EAAQ,4BAAA,EAA6B;AAEhG,EAAA,MAAM,QAAA,GAAW,CAAC,EAAA,EAAa,IAAA,KAAkB;AAC/C,IAAA,IAAI,SAAA,CAAU,IAAA,GAAO,GAAA,EAAM,SAAA,CAAU,MAAA,CAAO,UAAU,IAAA,EAAK,CAAE,IAAA,EAAK,CAAE,KAAe,CAAA;AACnF,IAAA,SAAA,CAAU,IAAI,GAAA,EAAK,EAAE,IAAI,GAAI,IAAA,GAAO,EAAE,IAAA,EAAK,GAAI,EAAC,EAAI,OAAO,IAAA,CAAK,GAAA,MAAS,EAAA,GAAK,IAAA,GAAW,MAAU,CAAA;AAAA,EACrG,CAAA;AACA,EAAA,IAAI;AACF,IAAA,MAAM,KAAA,GAAQ,MAAM,GAAA,CAAI,OAAA,CAAQ,EAAE,CAAA;AAClC,IAAA,KAAA,MAAW,QAAQ,KAAA,EAAO;AACxB,MAAA,MAAM,OAAO,IAAA,CAAK,WAAA,EAAY,CAAE,OAAA,CAAQ,OAAO,EAAE,CAAA;AACjD,MAAA,IAAI,CAAC,OAAA,CAAQ,IAAA,CAAK,CAAC,CAAA,KAAM,IAAA,KAAS,CAAA,IAAK,IAAA,CAAK,QAAA,CAAS,CAAA,CAAA,EAAI,CAAC,CAAA,CAAE,CAAC,CAAA,EAAG;AAChE,MAAA,MAAM,OAAA,GAAU,MAAM,GAAA,CAAI,MAAA,CAAO,IAAI,CAAA;AACrC,MAAA,IAAI,OAAA,CAAQ,QAAA,CAAS,EAAE,CAAA,EAAG;AACxB,QAAA,QAAA,CAAS,MAAM,IAAI,CAAA;AACnB,QAAA,OAAO,EAAE,MAAA,EAAQ,UAAA,EAAY,MAAM,KAAA,CAAM,IAAA,EAAM,MAAM,EAAA,EAAG;AAAA,MAC1D;AAAA,IACF;AACA,IAAA,QAAA,CAAS,KAAK,CAAA;AACd,IAAA,OAAO,EAAE,MAAA,EAAQ,YAAA,EAAc,MAAM,KAAA,CAAM,IAAA,EAAM,QAAQ,eAAA,EAAgB;AAAA,EAC3E,CAAA,CAAA,MAAQ;AACN,IAAA,OAAO,EAAE,MAAA,EAAQ,YAAA,EAAc,MAAM,KAAA,CAAM,IAAA,EAAM,QAAQ,oBAAA,EAAqB;AAAA,EAChF;AACF;;;AC/GO,IAAM,UAAN,MAAc;AAAA,EACnB,YAAqB,KAAA,EAAe;AAAf,IAAA,IAAA,CAAA,KAAA,GAAA,KAAA;AAAA,EAAgB;AAAA,EAAhB,KAAA;AACvB,CAAA;AACO,IAAM,YAAN,MAAgB;AAAA,EACrB,YAAqB,KAAA,EAAe;AAAf,IAAA,IAAA,CAAA,KAAA,GAAA,KAAA;AAAA,EAAgB;AAAA,EAAhB,KAAA;AACvB,CAAA;AAcO,IAAM,WAAA,GAAc,CAAC,CAAA,KAA8B,OAAA,IAAW,CAAA;AAE9D,IAAM,YAAA,GAAN,cAA2B,KAAA,CAAM;AAAC,CAAA;AAEzC,IAAM,SAAN,MAAa;AAAA,EAEX,YAA6B,CAAA,EAAW;AAAX,IAAA,IAAA,CAAA,CAAA,GAAA,CAAA;AAAA,EAAY;AAAA,EAAZ,CAAA;AAAA,EAD7B,CAAA,GAAI,CAAA;AAAA,EAEJ,IAAI,IAAA,GAAO;AACT,IAAA,OAAO,IAAA,CAAK,CAAA,IAAK,IAAA,CAAK,CAAA,CAAE,MAAA;AAAA,EAC1B;AAAA,EACA,IAAA,GAAO;AACL,IAAA,OAAO,IAAA,CAAK,CAAA,CAAE,IAAA,CAAK,CAAC,CAAA,IAAK,EAAA;AAAA,EAC3B;AAAA,EACA,KAAK,IAAA,EAAqB;AACxB,IAAA,MAAM,IAAI,YAAA,CAAa,CAAA,EAAG,IAAI,CAAA,IAAA,EAAO,IAAA,CAAK,CAAC,CAAA,CAAE,CAAA;AAAA,EAC/C;AAAA,EACA,EAAA,GAAK;AACH,IAAA,OAAO,IAAA,CAAK,IAAA,EAAK,KAAM,GAAA,EAAK,IAAA,CAAK,CAAA,EAAA;AAAA,EACnC;AAAA,EACA,GAAA,GAAM;AACJ,IAAA,OAAO,IAAA,CAAK,MAAK,KAAM,GAAA,IAAO,KAAK,IAAA,EAAK,KAAM,KAAM,IAAA,CAAK,CAAA,EAAA;AAAA,EAC3D;AAAA,EAEA,GAAA,GAAc;AACZ,IAAA,MAAM,CAAA,GAAI,KAAK,IAAA,EAAK;AACpB,IAAA,IAAI,CAAC,QAAA,CAAS,IAAA,CAAK,CAAC,CAAA,EAAG,IAAA,CAAK,KAAK,aAAa,CAAA;AAC9C,IAAA,IAAI,GAAA,GAAM,EAAA;AACV,IAAA,OAAO,eAAA,CAAgB,IAAA,CAAK,IAAA,CAAK,IAAA,EAAM,GAAG,GAAA,IAAO,IAAA,CAAK,CAAA,CAAE,IAAA,CAAK,CAAA,EAAG,CAAA;AAChE,IAAA,OAAO,GAAA;AAAA,EACT;AAAA,EAEA,MAAA,GAAiB;AACf,IAAA,MAAM,MAAc,EAAC;AACrB,IAAA,OAAO,IAAA,CAAK,IAAA,EAAK,KAAM,GAAA,EAAK;AAC1B,MAAA,IAAA,CAAK,CAAA,EAAA;AACL,MAAA,IAAA,CAAK,EAAA,EAAG;AACR,MAAA,MAAM,CAAA,GAAI,KAAK,GAAA,EAAI;AACnB,MAAA,IAAI,CAAA,GAAc,IAAA;AAClB,MAAA,IAAI,IAAA,CAAK,IAAA,EAAK,KAAM,GAAA,EAAK;AACvB,QAAA,IAAA,CAAK,CAAA,EAAA;AACL,QAAA,CAAA,GAAI,KAAK,QAAA,EAAS;AAAA,MACpB;AACA,MAAA,MAAM,QAAA,GAAW,IAAI,SAAA,CAAU,CAAC,CAAC,EAAE,CAAA,KAAM,OAAO,CAAC,CAAA;AACjD,MAAA,IAAI,YAAY,CAAA,EAAG,GAAA,CAAI,QAAQ,CAAA,GAAI,CAAC,GAAG,CAAC,CAAA;AAAA,WACnC,GAAA,CAAI,IAAA,CAAK,CAAC,CAAA,EAAG,CAAC,CAAC,CAAA;AAAA,IACtB;AACA,IAAA,OAAO,GAAA;AAAA,EACT;AAAA,EAEA,QAAA,GAAqB;AACnB,IAAA,MAAM,CAAA,GAAI,KAAK,IAAA,EAAK;AACpB,IAAA,IAAI,CAAA,KAAM,OAAO,OAAA,CAAQ,IAAA,CAAK,CAAC,CAAA,EAAG,OAAO,KAAK,MAAA,EAAO;AACrD,IAAA,IAAI,CAAA,KAAM,GAAA,EAAK,OAAO,IAAA,CAAK,MAAA,EAAO;AAClC,IAAA,IAAI,CAAA,KAAM,GAAA,EAAK,OAAO,IAAA,CAAK,KAAA,EAAM;AACjC,IAAA,IAAI,CAAA,KAAM,GAAA,EAAK,OAAO,IAAA,CAAK,OAAA,EAAQ;AACnC,IAAA,IAAI,YAAY,IAAA,CAAK,CAAC,CAAA,EAAG,OAAO,KAAK,KAAA,EAAM;AAC3C,IAAA,OAAO,IAAA,CAAK,KAAK,mBAAmB,CAAA;AAAA,EACtC;AAAA,EAEA,MAAA,GAA6B;AAC3B,IAAA,IAAI,IAAA,GAAO,CAAA;AACX,IAAA,IAAI,IAAA,CAAK,IAAA,EAAK,KAAM,GAAA,EAAK;AACvB,MAAA,IAAA,GAAO,EAAA;AACP,MAAA,IAAA,CAAK,CAAA,EAAA;AAAA,IACP;AACA,IAAA,IAAI,GAAA,GAAM,EAAA;AACV,IAAA,IAAI,SAAA,GAAY,KAAA;AAChB,IAAA,OAAO,CAAC,KAAK,IAAA,EAAM;AACjB,MAAA,MAAM,CAAA,GAAI,KAAK,IAAA,EAAK;AACpB,MAAA,IAAI,OAAA,CAAQ,IAAA,CAAK,CAAC,CAAA,EAAG,GAAA,IAAO,CAAA;AAAA,WAAA,IACnB,CAAA,KAAM,GAAA,IAAO,CAAC,SAAA,EAAW;AAChC,QAAA,IAAI,GAAA,CAAI,MAAA,GAAS,EAAA,EAAI,IAAA,CAAK,KAAK,+BAA+B,CAAA;AAC9D,QAAA,SAAA,GAAY,IAAA;AACZ,QAAA,GAAA,IAAO,CAAA;AAAA,MACT,CAAA,MAAO;AACP,MAAA,IAAA,CAAK,CAAA,EAAA;AACL,MAAA,IAAI,CAAC,SAAA,IAAa,GAAA,CAAI,SAAS,EAAA,EAAI,IAAA,CAAK,KAAK,kBAAkB,CAAA;AAC/D,MAAA,IAAI,aAAa,GAAA,CAAI,MAAA,GAAS,EAAA,EAAI,IAAA,CAAK,KAAK,kBAAkB,CAAA;AAAA,IAChE;AACA,IAAA,IAAI,CAAC,OAAA,CAAQ,IAAA,CAAK,GAAA,CAAI,CAAC,KAAK,EAAE,CAAA,EAAG,IAAA,CAAK,IAAA,CAAK,gBAAgB,CAAA;AAC3D,IAAA,IAAI,SAAA,EAAW;AACb,MAAA,IAAI,IAAI,QAAA,CAAS,GAAG,CAAA,EAAG,IAAA,CAAK,KAAK,uBAAuB,CAAA;AACxD,MAAA,IAAI,GAAA,CAAI,KAAA,CAAM,GAAG,CAAA,CAAE,CAAC,EAAG,MAAA,GAAS,CAAA,EAAG,IAAA,CAAK,IAAA,CAAK,2BAA2B,CAAA;AACxE,MAAA,OAAO,IAAI,SAAA,CAAU,IAAA,GAAO,MAAA,CAAO,GAAG,CAAC,CAAA;AAAA,IACzC;AACA,IAAA,OAAO,IAAA,GAAO,OAAO,GAAG,CAAA;AAAA,EAC1B;AAAA,EAEA,MAAA,GAAiB;AACf,IAAA,IAAA,CAAK,CAAA,EAAA;AACL,IAAA,IAAI,GAAA,GAAM,EAAA;AACV,IAAA,OAAO,CAAC,KAAK,IAAA,EAAM;AACjB,MAAA,MAAM,CAAA,GAAI,IAAA,CAAK,CAAA,CAAE,IAAA,CAAK,CAAA,EAAG,CAAA;AACzB,MAAA,IAAI,MAAM,IAAA,EAAM;AACd,QAAA,MAAM,CAAA,GAAI,IAAA,CAAK,CAAA,CAAE,IAAA,CAAK,CAAA,EAAG,CAAA;AACzB,QAAA,IAAI,MAAM,GAAA,IAAO,CAAA,KAAM,IAAA,EAAM,IAAA,CAAK,KAAK,gBAAgB,CAAA;AACvD,QAAA,GAAA,IAAO,CAAA;AAAA,MACT,CAAA,MAAA,IAAW,CAAA,KAAM,GAAA,EAAK,OAAO,GAAA;AAAA,WACxB;AACH,QAAA,MAAM,IAAA,GAAO,CAAA,CAAE,UAAA,CAAW,CAAC,CAAA;AAC3B,QAAA,IAAI,OAAO,EAAA,IAAQ,IAAA,GAAO,GAAA,EAAM,IAAA,CAAK,KAAK,qBAAqB,CAAA;AAC/D,QAAA,GAAA,IAAO,CAAA;AAAA,MACT;AAAA,IACF;AACA,IAAA,OAAO,IAAA,CAAK,KAAK,qBAAqB,CAAA;AAAA,EACxC;AAAA,EAEA,KAAA,GAAiB;AACf,IAAA,IAAI,GAAA,GAAM,EAAA;AACV,IAAA,OAAO,+BAAA,CAAgC,IAAA,CAAK,IAAA,CAAK,IAAA,EAAM,CAAA,IAAK,CAAC,IAAA,CAAK,IAAA,EAAM,GAAA,IAAO,IAAA,CAAK,CAAA,CAAE,KAAK,CAAA,EAAG,CAAA;AAC9F,IAAA,OAAO,IAAI,QAAQ,GAAG,CAAA;AAAA,EACxB;AAAA,EAEA,KAAA,GAAoB;AAClB,IAAA,IAAA,CAAK,CAAA,EAAA;AACL,IAAA,MAAM,MAAM,IAAA,CAAK,CAAA,CAAE,OAAA,CAAQ,GAAA,EAAK,KAAK,CAAC,CAAA;AACtC,IAAA,IAAI,GAAA,GAAM,CAAA,EAAG,IAAA,CAAK,IAAA,CAAK,4BAA4B,CAAA;AACnD,IAAA,MAAM,MAAM,IAAA,CAAK,CAAA,CAAE,KAAA,CAAM,IAAA,CAAK,GAAG,GAAG,CAAA;AACpC,IAAA,IAAI,CAAC,mBAAA,CAAoB,IAAA,CAAK,GAAG,CAAA,EAAG,IAAA,CAAK,KAAK,gBAAgB,CAAA;AAC9D,IAAA,IAAA,CAAK,IAAI,GAAA,GAAM,CAAA;AACf,IAAA,OAAO,cAAc,GAAG,CAAA;AAAA,EAC1B;AAAA,EAEA,OAAA,GAAmB;AACjB,IAAA,IAAA,CAAK,CAAA,EAAA;AACL,IAAA,MAAM,CAAA,GAAI,IAAA,CAAK,CAAA,CAAE,IAAA,CAAK,CAAA,EAAG,CAAA;AACzB,IAAA,IAAI,CAAA,KAAM,KAAK,OAAO,IAAA;AACtB,IAAA,IAAI,CAAA,KAAM,KAAK,OAAO,KAAA;AACtB,IAAA,OAAO,IAAA,CAAK,KAAK,iBAAiB,CAAA;AAAA,EACpC;AAAA,EAEA,IAAA,GAAa;AACX,IAAA,MAAM,KAAA,GAAQ,KAAK,QAAA,EAAS;AAC5B,IAAA,OAAO,EAAE,KAAA,EAAO,MAAA,EAAQ,IAAA,CAAK,QAAO,EAAE;AAAA,EACxC;AAAA,EAEA,SAAA,GAAuB;AACrB,IAAA,IAAA,CAAK,CAAA,EAAA;AACL,IAAA,MAAM,QAAgB,EAAC;AACvB,IAAA,OAAO,CAAC,KAAK,IAAA,EAAM;AACjB,MAAA,IAAA,CAAK,EAAA,EAAG;AACR,MAAA,IAAI,IAAA,CAAK,IAAA,EAAK,KAAM,GAAA,EAAK;AACvB,QAAA,IAAA,CAAK,CAAA,EAAA;AACL,QAAA,OAAO,EAAE,KAAA,EAAO,MAAA,EAAQ,IAAA,CAAK,QAAO,EAAE;AAAA,MACxC;AACA,MAAA,KAAA,CAAM,IAAA,CAAK,IAAA,CAAK,IAAA,EAAM,CAAA;AACtB,MAAA,MAAM,CAAA,GAAI,KAAK,IAAA,EAAK;AACpB,MAAA,IAAI,MAAM,GAAA,IAAO,CAAA,KAAM,GAAA,EAAK,IAAA,CAAK,KAAK,oBAAoB,CAAA;AAAA,IAC5D;AACA,IAAA,OAAO,IAAA,CAAK,KAAK,yBAAyB,CAAA;AAAA,EAC5C;AAAA,EAEA,MAAA,GAAiB;AACf,IAAA,OAAO,IAAA,CAAK,MAAK,KAAM,GAAA,GAAM,KAAK,SAAA,EAAU,GAAI,KAAK,IAAA,EAAK;AAAA,EAC5D;AAAA,EAEA,UAAA,GAAyB;AACvB,IAAA,MAAM,GAAA,uBAAsB,GAAA,EAAI;AAChC,IAAA,IAAA,CAAK,EAAA,EAAG;AACR,IAAA,OAAO,CAAC,KAAK,IAAA,EAAM;AACjB,MAAA,MAAM,CAAA,GAAI,KAAK,GAAA,EAAI;AACnB,MAAA,IAAI,CAAA;AACJ,MAAA,IAAI,IAAA,CAAK,IAAA,EAAK,KAAM,GAAA,EAAK;AACvB,QAAA,IAAA,CAAK,CAAA,EAAA;AACL,QAAA,CAAA,GAAI,KAAK,MAAA,EAAO;AAAA,MAClB,CAAA,MAAO;AACL,QAAA,CAAA,GAAI,EAAE,KAAA,EAAO,IAAA,EAAM,MAAA,EAAQ,IAAA,CAAK,QAAO,EAAE;AAAA,MAC3C;AACA,MAAA,GAAA,CAAI,GAAA,CAAI,GAAG,CAAC,CAAA;AACZ,MAAA,IAAA,CAAK,GAAA,EAAI;AACT,MAAA,IAAI,IAAA,CAAK,MAAM,OAAO,GAAA;AACtB,MAAA,IAAI,KAAK,IAAA,EAAK,KAAM,GAAA,EAAK,IAAA,CAAK,KAAK,gBAAgB,CAAA;AACnD,MAAA,IAAA,CAAK,CAAA,EAAA;AACL,MAAA,IAAA,CAAK,GAAA,EAAI;AACT,MAAA,IAAI,IAAA,CAAK,IAAA,EAAM,IAAA,CAAK,IAAA,CAAK,gBAAgB,CAAA;AAAA,IAC3C;AACA,IAAA,OAAO,GAAA;AAAA,EACT;AACF,CAAA;AAEA,SAAS,QAAA,CAAY,OAAe,EAAA,EAAyB;AAC3D,EAAA,MAAM,CAAA,GAAI,IAAI,MAAA,CAAO,KAAA,CAAM,MAAM,CAAA;AACjC,EAAA,MAAM,GAAA,GAAM,GAAG,CAAC,CAAA;AAChB,EAAA,CAAA,CAAE,EAAA,EAAG;AACL,EAAA,IAAI,CAAC,CAAA,CAAE,IAAA,EAAM,CAAA,CAAE,KAAK,qBAAqB,CAAA;AACzC,EAAA,OAAO,GAAA;AACT;AAEO,IAAM,eAAA,GAAkB,CAAC,KAAA,KAAkB,QAAA,CAAS,OAAO,CAAC,CAAA,KAAM,CAAA,CAAE,UAAA,EAAY,CAAA;AAChF,IAAM,SAAA,GAAY,CAAC,KAAA,KAAkB,QAAA,CAAS,OAAO,CAAC,CAAA,KAAM,CAAA,CAAE,IAAA,EAAM,CAAA;AAIpE,SAAS,kBAAkB,CAAA,EAAqB;AACrD,EAAA,IAAI,OAAO,CAAA,KAAM,SAAA,EAAW,OAAO,IAAI,IAAA,GAAO,IAAA;AAC9C,EAAA,IAAI,OAAO,MAAM,QAAA,EAAU;AACzB,IAAA,IAAI,CAAC,OAAO,SAAA,CAAU,CAAC,GAAG,MAAM,IAAI,aAAa,mCAAmC,CAAA;AACpF,IAAA,OAAO,OAAO,CAAC,CAAA;AAAA,EACjB;AACA,EAAA,IAAI,aAAa,SAAA,EAAW;AAC1B,IAAA,MAAM,CAAA,GAAA,CAAK,KAAK,KAAA,CAAM,CAAA,CAAE,QAAQ,GAAI,CAAA,GAAI,KAAM,QAAA,EAAS;AACvD,IAAA,OAAO,EAAE,QAAA,CAAS,GAAG,CAAA,GAAI,CAAA,GAAI,GAAG,CAAC,CAAA,EAAA,CAAA;AAAA,EACnC;AACA,EAAA,IAAI,CAAA,YAAa,OAAA,EAAS,OAAO,CAAA,CAAE,KAAA;AACnC,EAAA,IAAI,aAAa,UAAA,EAAY,OAAO,CAAA,CAAA,EAAI,aAAA,CAAc,CAAC,CAAC,CAAA,CAAA,CAAA;AACxD,EAAA,OAAO,CAAA,CAAA,EAAI,EAAE,OAAA,CAAQ,KAAA,EAAO,MAAM,CAAA,CAAE,OAAA,CAAQ,IAAA,EAAM,KAAK,CAAC,CAAA,CAAA,CAAA;AAC1D;AAEO,IAAM,eAAA,GAAkB,CAAC,MAAA,KAC9B,MAAA,CAAO,GAAA,CAAI,CAAC,CAAC,CAAA,EAAG,CAAC,CAAA,KAAO,CAAA,KAAM,IAAA,GAAO,IAAI,CAAC,CAAA,CAAA,GAAK,CAAA,CAAA,EAAI,CAAC,CAAA,CAAA,EAAI,iBAAA,CAAkB,CAAC,CAAC,CAAA,CAAG,CAAA,CAAE,IAAA,CAAK,EAAE,CAAA;AAEnF,IAAM,aAAA,GAAgB,CAAC,IAAA,KAAe,iBAAA,CAAkB,KAAK,KAAK,CAAA,GAAI,eAAA,CAAgB,IAAA,CAAK,MAAM,CAAA;AAEjG,IAAM,qBAAqB,CAAC,IAAA,KACjC,CAAA,CAAA,EAAI,IAAA,CAAK,MAAM,GAAA,CAAI,aAAa,CAAA,CAAE,IAAA,CAAK,GAAG,CAAC,CAAA,CAAA,EAAI,eAAA,CAAgB,IAAA,CAAK,MAAM,CAAC,CAAA,CAAA;AAEtE,IAAM,eAAA,GAAkB,CAAC,CAAA,KAAe,WAAA,CAAY,CAAC,IAAI,kBAAA,CAAmB,CAAC,CAAA,GAAI,aAAA,CAAc,CAAC,CAAA;AAShG,IAAM,QAAA,GAAW,CAAC,MAAA,EAAgB,GAAA,KACvC,MAAA,CAAO,IAAA,CAAK,CAAC,CAAC,CAAC,CAAA,KAAM,CAAA,KAAM,GAAG,IAAI,CAAC,CAAA;AAI9B,SAAS,cAAc,GAAA,EAAyB;AACrD,EAAA,MAAM,GAAA,GAAM,KAAK,GAAG,CAAA;AACpB,EAAA,MAAM,GAAA,GAAM,IAAI,UAAA,CAAW,GAAA,CAAI,MAAM,CAAA;AACrC,EAAA,KAAA,IAAS,CAAA,GAAI,CAAA,EAAG,CAAA,GAAI,GAAA,CAAI,MAAA,EAAQ,CAAA,EAAA,EAAK,GAAA,CAAI,CAAC,CAAA,GAAI,GAAA,CAAI,UAAA,CAAW,CAAC,CAAA;AAC9D,EAAA,OAAO,GAAA;AACT;AAEO,SAAS,cAAc,KAAA,EAA2B;AACvD,EAAA,IAAI,GAAA,GAAM,EAAA;AACV,EAAA,KAAA,MAAW,CAAA,IAAK,KAAA,EAAO,GAAA,IAAO,MAAA,CAAO,aAAa,CAAC,CAAA;AACnD,EAAA,OAAO,KAAK,GAAG,CAAA;AACjB;AAEO,IAAM,mBAAmB,CAAC,KAAA,KAC/B,aAAA,CAAc,KAAK,EAAE,OAAA,CAAQ,KAAA,EAAO,GAAG,CAAA,CAAE,QAAQ,KAAA,EAAO,GAAG,CAAA,CAAE,OAAA,CAAQ,OAAO,EAAE,CAAA;;;AC7PzE,IAAM,cAAA,GAAN,cAA6B,KAAA,CAAM;AAAA,EACxC,WAAA,CACW,MACT,OAAA,EACA;AACA,IAAA,KAAA,CAAM,WAAW,IAAI,CAAA;AAHZ,IAAA,IAAA,CAAA,IAAA,GAAA,IAAA;AAAA,EAIX;AAAA,EAJW,IAAA;AAKb,CAAA;AASA,IAAM,OAAA,uBAAc,GAAA,CAAI;AAAA,EACtB,SAAA;AAAA,EACA,aAAA;AAAA,EACA,YAAA;AAAA,EACA,SAAA;AAAA,EACA,iBAAA;AAAA,EACA,OAAA;AAAA,EACA,QAAA;AAAA,EACA;AACF,CAAC,CAAA;AAGM,SAAS,cAAA,CAAe,IAAU,GAAA,EAA+B;AACtE,EAAA,IAAI,OAAO,GAAG,KAAA,KAAU,QAAA,QAAgB,IAAI,cAAA,CAAe,qBAAqB,+BAA+B,CAAA;AAC/G,EAAA,MAAM,OAAO,EAAA,CAAG,KAAA;AAChB,EAAA,MAAM,EAAE,KAAI,GAAI,GAAA;AAEhB,EAAA,IAAI,IAAA,CAAK,UAAA,CAAW,GAAG,CAAA,EAAG;AACxB,IAAA,IAAI,CAAC,QAAQ,GAAA,CAAI,IAAI,GAAG,MAAM,IAAI,cAAA,CAAe,uBAAA,EAAyB,IAAI,CAAA;AAC9E,IAAA,QAAQ,IAAA;AAAM,MACZ,KAAK,SAAA;AACH,QAAA,OAAO,GAAA,CAAI,OAAA,CAAQ,MAAA,CAAO,WAAA,EAAY;AAAA,MACxC,KAAK,aAAA;AACH,QAAA,OAAO,GAAA,CAAI,IAAA;AAAA,MACb,KAAK,YAAA;AACH,QAAA,OAAA,CAAQ,GAAA,CAAI,SAAA,IAAa,GAAA,CAAI,IAAA,EAAM,WAAA,EAAY;AAAA,MACjD,KAAK,SAAA;AACH,QAAA,OAAO,IAAI,QAAA,CAAS,OAAA,CAAQ,IAAA,EAAM,EAAE,EAAE,WAAA,EAAY;AAAA,MACpD,KAAK,iBAAA;AACH,QAAA,OAAO,GAAA,CAAI,WAAW,GAAA,CAAI,MAAA;AAAA,MAC5B,KAAK,OAAA;AACH,QAAA,OAAO,IAAI,QAAA,IAAY,GAAA;AAAA,MACzB,KAAK,QAAA;AACH,QAAA,OAAO,IAAI,MAAA,IAAU,GAAA;AAAA,MACvB,KAAK,cAAA,EAAgB;AACnB,QAAA,MAAM,KAAA,GAAQ,QAAA,CAAS,EAAA,CAAG,MAAA,EAAQ,MAAM,CAAA;AACxC,QAAA,IAAI,OAAO,KAAA,KAAU,QAAA,QAAgB,IAAI,cAAA,CAAe,qBAAqB,yBAAyB,CAAA;AACtG,QAAA,MAAM,MAAA,GAAS,GAAA,CAAI,YAAA,CAAa,MAAA,CAAO,KAAK,CAAA;AAC5C,QAAA,IAAI,MAAA,CAAO,WAAW,CAAA,EAAG,MAAM,IAAI,cAAA,CAAe,mBAAA,EAAqB,CAAA,aAAA,EAAgB,KAAK,CAAA,CAAE,CAAA;AAC9F,QAAA,OAAO,kBAAA,CAAmB,MAAA,CAAO,CAAC,CAAE,CAAA;AAAA,MACtC;AAAA;AACF,EACF;AAMA,EAAA,KAAA,MAAW,CAAC,CAAC,CAAA,IAAK,EAAA,CAAG,MAAA,EAAQ;AAC3B,IAAA,IAAI,CAAA,KAAM,OAAO,MAAM,IAAI,eAAe,uBAAA,EAAyB,CAAA,MAAA,EAAS,CAAC,CAAA,CAAE,CAAA;AAAA,EACjF;AACA,EAAA,MAAM,GAAA,GAAM,GAAA,CAAI,OAAA,CAAQ,OAAA,CAAQ,IAAI,IAAI,CAAA;AACxC,EAAA,IAAI,QAAQ,IAAA,EAAM,MAAM,IAAI,cAAA,CAAe,qBAAqB,IAAI,CAAA;AACpE,EAAA,MAAM,KAAA,GAAQ,IAAI,IAAA,EAAK;AAEvB,EAAA,MAAM,GAAA,GAAM,QAAA,CAAS,EAAA,CAAG,MAAA,EAAQ,KAAK,CAAA;AACrC,EAAA,IAAI,OAAO,QAAQ,QAAA,EAAU;AAC3B,IAAA,IAAI,IAAA;AACJ,IAAA,IAAI;AACF,MAAA,IAAA,GAAO,gBAAgB,KAAK,CAAA;AAAA,IAC9B,SAAS,CAAA,EAAG;AACV,MAAA,MAAM,IAAI,eAAe,mBAAA,EAAqB,CAAA,EAAG,IAAI,CAAA,sBAAA,EAA0B,CAAA,CAAY,OAAO,CAAA,CAAE,CAAA;AAAA,IACtG;AACA,IAAA,MAAM,MAAA,GAAS,IAAA,CAAK,GAAA,CAAI,GAAG,CAAA;AAC3B,IAAA,IAAI,CAAC,MAAA,EAAQ,MAAM,IAAI,cAAA,CAAe,qBAAqB,CAAA,EAAG,IAAI,CAAA,KAAA,EAAQ,GAAG,CAAA,CAAE,CAAA;AAC/E,IAAA,OAAO,gBAAgB,MAAM,CAAA;AAAA,EAC/B;AACA,EAAA,OAAO,KAAA;AACT;AAGO,SAAS,aAAA,CAAc,OAAkB,GAAA,EAA+B;AAC7E,EAAA,MAAM,IAAA,uBAAW,GAAA,EAAY;AAC7B,EAAA,MAAM,QAAkB,EAAC;AACzB,EAAA,KAAA,MAAW,EAAA,IAAM,MAAM,KAAA,EAAO;AAC5B,IAAA,MAAM,KAAA,GAAQ,cAAc,EAAE,CAAA;AAC9B,IAAA,IAAI,IAAA,CAAK,IAAI,KAAK,CAAA,QAAS,IAAI,cAAA,CAAe,uBAAuB,KAAK,CAAA;AAC1E,IAAA,IAAA,CAAK,IAAI,KAAK,CAAA;AACd,IAAA,KAAA,CAAM,IAAA,CAAK,GAAG,KAAK,CAAA,EAAA,EAAK,eAAe,EAAA,EAAI,GAAG,CAAC,CAAA,CAAE,CAAA;AAAA,EACnD;AACA,EAAA,KAAA,CAAM,IAAA,CAAK,CAAA,qBAAA,EAAwB,kBAAA,CAAmB,KAAK,CAAC,CAAA,CAAE,CAAA;AAC9D,EAAA,OAAO,KAAA,CAAM,KAAK,IAAI,CAAA;AACxB;AAyBA,IAAM,IAAA,GAGF;AAAA,EACF,OAAA,EAAS,EAAE,GAAA,EAAK,KAAA,EAAO,KAAK,SAAA,EAAW,SAAA,EAAW,EAAE,IAAA,EAAM,WAAU,EAAG,SAAA,EAAW,EAAE,IAAA,EAAM,WAAU,EAAE;AAAA,EACtG,gBAAA,EAAkB;AAAA,IAChB,GAAA,EAAK,KAAA;AAAA,IACL,SAAA,EAAW,EAAE,IAAA,EAAM,SAAA,EAAW,MAAM,SAAA,EAAU;AAAA,IAC9C,SAAA,EAAW,EAAE,IAAA,EAAM,SAAA,EAAW,YAAY,EAAA;AAAG,GAC/C;AAAA,EACA,iBAAA,EAAmB;AAAA,IACjB,GAAA,EAAK,KAAA;AAAA,IACL,SAAA,EAAW,EAAE,IAAA,EAAM,mBAAA,EAAqB,MAAM,SAAA,EAAU;AAAA,IACxD,SAAA,EAAW,EAAE,IAAA,EAAM,mBAAA;AAAoB,GACzC;AAAA,EACA,mBAAA,EAAqB;AAAA,IACnB,GAAA,EAAK,IAAA;AAAA,IACL,GAAA,EAAK,OAAA;AAAA,IACL,SAAA,EAAW,EAAE,IAAA,EAAM,OAAA,EAAS,YAAY,OAAA,EAAQ;AAAA,IAChD,SAAA,EAAW,EAAE,IAAA,EAAM,OAAA,EAAS,MAAM,SAAA;AAAU,GAC9C;AAAA,EACA,mBAAA,EAAqB;AAAA,IACnB,GAAA,EAAK,IAAA;AAAA,IACL,GAAA,EAAK,OAAA;AAAA,IACL,SAAA,EAAW,EAAE,IAAA,EAAM,OAAA,EAAS,YAAY,OAAA,EAAQ;AAAA,IAChD,SAAA,EAAW,EAAE,IAAA,EAAM,OAAA,EAAS,MAAM,SAAA;AAAU;AAEhD,CAAA;AAGO,SAAS,gBAAA,CAAiB,KAAgB,QAAA,EAAuC;AACtF,EAAA,IAAI,OAAO,aAAa,QAAA,EAAU;AAChC,IAAA,MAAM,IAAA,GAAO,KAAK,QAA8B,CAAA;AAChD,IAAA,IAAI,CAAC,IAAA,EAAM,MAAM,IAAI,cAAA,CAAe,mBAAmB,QAAQ,CAAA;AAC/D,IAAA,IAAI,IAAA,CAAK,QAAQ,GAAA,CAAI,GAAA,IAAQ,KAAK,GAAA,IAAO,IAAA,CAAK,GAAA,KAAQ,GAAA,CAAI,GAAA,EAAM;AAC9D,MAAA,MAAM,IAAI,cAAA,CAAe,kBAAA,EAAoB,CAAA,EAAG,QAAQ,CAAA,IAAA,EAAO,GAAA,CAAI,GAAG,CAAA,CAAA,EAAI,GAAA,CAAI,GAAA,IAAO,EAAE,CAAA,CAAE,CAAA;AAAA,IAC3F;AACA,IAAA,OAAO,QAAA;AAAA,EACT;AACA,EAAA,IAAI,IAAI,GAAA,KAAQ,KAAA,IAAS,GAAA,CAAI,GAAA,KAAQ,WAAW,OAAO,SAAA;AACvD,EAAA,IAAI,IAAI,GAAA,KAAQ,IAAA,IAAQ,GAAA,CAAI,GAAA,KAAQ,SAAS,OAAO,mBAAA;AACpD,EAAA,IAAI,IAAI,GAAA,KAAQ,IAAA,IAAQ,GAAA,CAAI,GAAA,KAAQ,SAAS,OAAO,mBAAA;AAEpD,EAAA,MAAM,IAAI,cAAA,CAAe,cAAA,EAAgB,CAAA,2BAAA,EAA8B,GAAA,CAAI,GAAG,CAAA,CAAE,CAAA;AAClF;AAEA,eAAsB,eAAA,CACpB,GAAA,EACA,GAAA,EACA,IAAA,EACA,SAAA,EACkB;AAClB,EAAA,MAAM,IAAA,GAAO,KAAK,GAAG,CAAA;AACrB,EAAA,MAAM,EAAE,GAAA,EAAK,IAAA,EAAM,GAAA,EAAK,IAAA,EAAM,GAAA,EAAK,IAAA,EAAM,GAAA,EAAK,IAAA,EAAM,GAAA,EAAK,IAAA,EAAM,GAAG,UAAS,GAAI,GAAA;AAC/E,EAAA,IAAI,GAAA;AACJ,EAAA,IAAI;AACF,IAAA,GAAA,GAAM,MAAM,MAAA,CAAO,MAAA,CAAO,SAAA,CAAU,KAAA,EAAO,QAAA,EAAwB,IAAA,CAAK,SAAA,EAAW,KAAA,EAAO,CAAC,QAAQ,CAAC,CAAA;AAAA,EACtG,SAAS,CAAA,EAAG;AACV,IAAA,MAAM,IAAI,cAAA,CAAe,aAAA,EAAgB,CAAA,CAAY,OAAO,CAAA;AAAA,EAC9D;AAEA,EAAA,OAAO,MAAA,CAAO,MAAA,CAAO,MAAA,CAAO,IAAA,CAAK,WAAW,GAAA,EAAK,IAAI,UAAA,CAAW,SAAS,GAAG,IAAI,WAAA,EAAY,CAAE,MAAA,CAAO,IAAI,CAAC,CAAA;AAC5G;AAGA,eAAsB,cAAc,GAAA,EAAiC;AACnE,EAAA,IAAI,SAAA;AACJ,EAAA,IAAI,IAAI,GAAA,KAAQ,KAAA,EAAO,SAAA,GAAY,IAAA,CAAK,UAAU,EAAE,GAAA,EAAK,GAAA,CAAI,GAAA,EAAK,KAAK,GAAA,CAAI,GAAA,EAAK,CAAA,EAAG,GAAA,CAAI,GAAG,CAAA;AAAA,OAAA,IACjF,IAAI,GAAA,KAAQ,IAAA,cAAkB,IAAA,CAAK,SAAA,CAAU,EAAE,GAAA,EAAK,GAAA,CAAI,KAAK,GAAA,EAAK,GAAA,CAAI,KAAK,CAAA,EAAG,GAAA,CAAI,GAAG,CAAA,EAAG,GAAA,CAAI,GAAG,CAAA;AAAA,OAAA,IAC/F,IAAI,GAAA,KAAQ,KAAA,EAAO,SAAA,GAAY,IAAA,CAAK,UAAU,EAAE,CAAA,EAAG,GAAA,CAAI,CAAA,EAAG,KAAK,GAAA,CAAI,GAAA,EAAK,CAAA,EAAG,GAAA,CAAI,GAAG,CAAA;AAAA,aAChF,IAAI,cAAA,CAAe,eAAe,CAAA,gBAAA,EAAmB,GAAA,CAAI,GAAG,CAAA,CAAE,CAAA;AACzE,EAAA,MAAM,MAAA,GAAS,MAAM,MAAA,CAAO,MAAA,CAAO,MAAA,CAAO,SAAA,EAAW,IAAI,WAAA,EAAY,CAAE,MAAA,CAAO,SAAS,CAAC,CAAA;AACxF,EAAA,OAAO,gBAAA,CAAiB,IAAI,UAAA,CAAW,MAAM,CAAC,CAAA;AAChD;;;ACxMO,IAAM,cAAA,GAAN,cAA6B,KAAA,CAAM;AAAC,CAAA;AAE3C,IAAM,gBAAA,GAAmB,CAAC,YAAA,EAAc,QAAA,EAAU,aAAa,YAAA,EAAc,MAAA,EAAQ,SAAS,WAAW,CAAA;AAElG,SAAS,cAAc,EAAA,EAAqB;AACjD,EAAA,MAAM,CAAA,GAAI,EAAA,CAAG,KAAA,CAAM,8CAA8C,CAAA;AACjE,EAAA,IAAI,CAAC,GAAG,OAAO,KAAA;AACf,EAAA,MAAM,CAAC,CAAA,EAAG,CAAC,CAAA,GAAI,CAAC,MAAA,CAAO,CAAA,CAAE,CAAC,CAAC,CAAA,EAAG,MAAA,CAAO,CAAA,CAAE,CAAC,CAAC,CAAC,CAAA;AAC1C,EAAA,OACE,CAAA,KAAM,CAAA,IACN,CAAA,KAAM,EAAA,IACN,CAAA,KAAM,OACL,CAAA,KAAM,GAAA,IAAO,CAAA,IAAK,EAAA,IAAM,CAAA,IAAK,GAAA;AAAA,EAC7B,CAAA,KAAM,OAAO,CAAA,KAAM,GAAA;AAAA,EACnB,CAAA,KAAM,OAAO,CAAA,IAAK,EAAA,IAAM,KAAK,EAAA,IAC7B,CAAA,KAAM,OAAO,CAAA,KAAM,GAAA,IACnB,MAAM,GAAA,IAAO,CAAA,KAAM,KACnB,CAAA,KAAM,GAAA,KAAQ,MAAM,EAAA,IAAM,CAAA,KAAM,OACjC,CAAA,IAAK,GAAA;AAET;AAEO,SAAS,cAAc,EAAA,EAAqB;AACjD,EAAA,MAAM,IAAI,EAAA,CAAG,WAAA,EAAY,CAAE,OAAA,CAAQ,YAAY,EAAE,CAAA;AACjD,EAAA,IAAI,CAAA,KAAM,IAAA,IAAQ,CAAA,KAAM,KAAA,EAAO,OAAO,IAAA;AACtC,EAAA,MAAM,MAAA,GAAS,CAAA,CAAE,KAAA,CAAM,+BAA+B,CAAA;AACtD,EAAA,IAAI,MAAA,EAAQ,OAAO,aAAA,CAAc,MAAA,CAAO,CAAC,CAAE,CAAA;AAC3C,EAAA,OAAO,6BAAA,CAA8B,KAAK,CAAC,CAAA;AAC7C;AAEA,IAAM,WAAA,GAAc,CAAC,IAAA,KAAiB,sBAAA,CAAuB,IAAA,CAAK,IAAI,CAAA,IAAK,IAAA,CAAK,QAAA,CAAS,GAAG,CAAA,IAAK,IAAA,CAAK,WAAW,GAAG,CAAA;AAG7G,SAAS,cAAc,GAAA,EAAkB;AAC9C,EAAA,IAAI,GAAA;AACJ,EAAA,IAAI;AACF,IAAA,GAAA,GAAM,IAAI,IAAI,GAAG,CAAA;AAAA,EACnB,CAAA,CAAA,MAAQ;AACN,IAAA,MAAM,IAAI,eAAe,aAAa,CAAA;AAAA,EACxC;AACA,EAAA,IAAI,IAAI,QAAA,KAAa,QAAA,EAAU,MAAM,IAAI,eAAe,gBAAgB,CAAA;AACxE,EAAA,IAAI,IAAI,QAAA,IAAY,GAAA,CAAI,UAAU,MAAM,IAAI,eAAe,oBAAoB,CAAA;AAC/E,EAAA,IAAI,GAAA,CAAI,QAAQ,GAAA,CAAI,IAAA,KAAS,OAAO,MAAM,IAAI,eAAe,mBAAmB,CAAA;AAChF,EAAA,MAAM,IAAA,GAAO,GAAA,CAAI,QAAA,CAAS,WAAA,EAAY;AACtC,EAAA,IAAI,YAAY,IAAI,CAAA,EAAG,MAAM,IAAI,eAAe,kCAAkC,CAAA;AAClF,EAAA,IAAI,IAAA,KAAS,WAAA,IAAe,CAAC,IAAA,CAAK,SAAS,GAAG,CAAA,IAAK,gBAAA,CAAiB,IAAA,CAAK,CAAC,CAAA,KAAM,IAAA,CAAK,QAAA,CAAS,CAAC,CAAC,CAAA,EAAG;AACjG,IAAA,MAAM,IAAI,eAAe,mBAAmB,CAAA;AAAA,EAC9C;AACA,EAAA,OAAO,GAAA;AACT;AAqBA,eAAe,gBAAgB,IAAA,EAA6B;AAC1D,EAAA,IAAI,GAAA;AACJ,EAAA,IAAI;AACF,IAAA,GAAA,GAAO,MAAM;AAAA;AAAA;AAAA,MAAoD;AAAA,KAA6B;AAAA,EAChG,CAAA,CAAA,MAAQ;AACN,IAAA;AAAA,EACF;AACA,EAAA,MAAM,KAAA,GAAQ,MAAM,GAAA,CAAI,MAAA,CAAO,IAAA,EAAM,EAAE,GAAA,EAAK,IAAA,EAAM,CAAA,CAAE,KAAA,CAAM,MAAM;AAC9D,IAAA,MAAM,IAAI,eAAe,mBAAmB,CAAA;AAAA,EAC9C,CAAC,CAAA;AACD,EAAA,KAAA,MAAW,EAAE,OAAA,EAAS,MAAA,EAAO,IAAK,KAAA,EAAO;AACvC,IAAA,IAAI,WAAW,CAAA,GAAI,aAAA,CAAc,OAAO,CAAA,GAAI,aAAA,CAAc,OAAO,CAAA,EAAG;AAClE,MAAA,MAAM,IAAI,eAAe,oCAAoC,CAAA;AAAA,IAC/D;AAAA,EACF;AACF;AAEA,eAAsB,SAAA,CAAU,GAAA,EAAa,IAAA,GAAyB,EAAC,EAA6B;AAClG,EAAA,MAAM,GAAA,GAAM,cAAc,GAAG,CAAA;AAC7B,EAAA,IAAI,IAAA,CAAK,UAAA,EAAY,MAAM,eAAA,CAAgB,IAAI,QAAQ,CAAA;AACvD,EAAA,MAAM,OAAA,GAAU,KAAK,KAAA,IAAS,KAAA;AAC9B,EAAA,MAAM,GAAA,GAAM,MAAM,OAAA,CAAQ,GAAA,CAAI,IAAA,EAAM;AAAA,IAClC,MAAA,EAAQ,KAAA;AAAA,IACR,QAAA,EAAU,QAAA;AAAA,IACV,OAAA,EAAS,EAAE,MAAA,EAAQ,IAAA,CAAK,UAAU,kBAAA,EAAmB;AAAA,IACrD,MAAA,EAAQ,WAAA,CAAY,OAAA,CAAQ,IAAA,CAAK,aAAa,GAAI;AAAA,GACnD,CAAA;AACD,EAAA,MAAM,QAAA,GAAW,IAAA,CAAK,QAAA,IAAY,EAAA,GAAK,IAAA;AACvC,EAAA,MAAM,WAAW,MAAA,CAAO,GAAA,CAAI,QAAQ,GAAA,CAAI,gBAAgB,KAAK,CAAC,CAAA;AAC9D,EAAA,IAAI,QAAA,GAAW,QAAA,EAAU,MAAM,IAAI,eAAe,oBAAoB,CAAA;AAEtE,EAAA,MAAM,MAAA,GAAS,GAAA,CAAI,IAAA,EAAM,SAAA,EAAU;AACnC,EAAA,MAAM,SAAuB,EAAC;AAC9B,EAAA,IAAI,KAAA,GAAQ,CAAA;AACZ,EAAA,IAAI,MAAA,EAAQ;AACV,IAAA,WAAS;AACP,MAAA,MAAM,EAAE,IAAA,EAAM,KAAA,EAAM,GAAI,MAAM,OAAO,IAAA,EAAK;AAC1C,MAAA,IAAI,IAAA,EAAM;AACV,MAAA,KAAA,IAAS,KAAA,CAAM,UAAA;AACf,MAAA,IAAI,QAAQ,QAAA,EAAU;AACpB,QAAA,MAAM,MAAA,CAAO,MAAA,EAAO,CAAE,KAAA,CAAM,MAAM,MAAS,CAAA;AAC3C,QAAA,MAAM,IAAI,eAAe,oBAAoB,CAAA;AAAA,MAC/C;AACA,MAAA,MAAA,CAAO,KAAK,KAAK,CAAA;AAAA,IACnB;AAAA,EACF;AACA,EAAA,MAAM,IAAA,GAAO,IAAI,UAAA,CAAW,KAAK,CAAA;AACjC,EAAA,IAAI,CAAA,GAAI,CAAA;AACR,EAAA,KAAA,MAAW,KAAK,MAAA,EAAQ;AACtB,IAAA,IAAA,CAAK,GAAA,CAAI,GAAG,CAAC,CAAA;AACb,IAAA,CAAA,IAAK,CAAA,CAAE,UAAA;AAAA,EACT;AACA,EAAA,OAAO,EAAE,MAAA,EAAQ,GAAA,CAAI,MAAA,EAAQ,OAAA,EAAS,GAAA,CAAI,OAAA,EAAS,IAAA,EAAM,IAAI,WAAA,EAAY,CAAE,MAAA,CAAO,IAAI,CAAA,EAAE;AAC1F;;;ACxGO,IAAM,gBAAA,GAAmB;AACzB,IAAM,cAAA,GAAiB;AACvB,IAAM,oBAAA,GAAuB,oDAAA;AAQ7B,SAAS,iBAAA,CAAkB,aAAa,GAAA,EAAqB;AAClE,EAAA,MAAM,CAAA,uBAAQ,GAAA,EAAoB;AAClC,EAAA,OAAO;AAAA,IACL,IAAI,GAAA,EAAK;AACP,MAAA,MAAM,GAAA,GAAM,CAAA,CAAE,GAAA,CAAI,GAAG,CAAA;AACrB,MAAA,IAAI,GAAA,KAAQ,QAAW,OAAO,KAAA;AAC9B,MAAA,IAAI,GAAA,GAAM,IAAA,CAAK,GAAA,EAAI,EAAG;AACpB,QAAA,CAAA,CAAE,OAAO,GAAG,CAAA;AACZ,QAAA,OAAO,KAAA;AAAA,MACT;AACA,MAAA,OAAO,IAAA;AAAA,IACT,CAAA;AAAA,IACA,GAAA,CAAI,KAAK,GAAA,EAAK;AACZ,MAAA,IAAI,CAAA,CAAE,IAAA,IAAQ,UAAA,EAAY,CAAA,CAAE,MAAA,CAAO,EAAE,IAAA,EAAK,CAAE,IAAA,EAAK,CAAE,KAAe,CAAA;AAClE,MAAA,CAAA,CAAE,IAAI,GAAA,EAAK,IAAA,CAAK,GAAA,EAAI,GAAI,MAAM,GAAI,CAAA;AAAA,IACpC;AAAA,GACF;AACF;AA6CA,IAAM,cAAA,uBAAqB,GAAA,EAAuD;AAClF,IAAM,UAAA,GAAa,GAAA;AACnB,IAAM,YAAA,GAAe,IAAI,EAAA,GAAK,GAAA;AAI9B,SAAS,WAAW,OAAA,EAA0B;AAC5C,EAAA,MAAM,EAAA,GAAK,OAAA,CAAQ,GAAA,CAAI,eAAe,CAAA,IAAK,EAAA;AAC3C,EAAA,MAAM,CAAA,GAAI,EAAA,CAAG,KAAA,CAAM,gBAAgB,CAAA;AACnC,EAAA,MAAM,OAAO,CAAA,GAAI,MAAA,CAAO,CAAA,CAAE,CAAC,CAAC,CAAA,GAAI,IAAA;AAChC,EAAA,OAAO,IAAA,CAAK,IAAI,IAAA,CAAK,GAAA,CAAI,MAAM,EAAE,CAAA,EAAG,KAAM,CAAA,GAAI,GAAA;AAChD;AAEA,eAAe,aAAA,CAAc,KAAa,IAAA,EAAmD;AAC3F,EAAA,MAAM,MAAA,GAAS,cAAA,CAAe,GAAA,CAAI,GAAG,CAAA;AACrC,EAAA,IAAI,UAAU,aAAA,IAAiB,MAAA,IAAU,OAAO,WAAA,GAAc,IAAA,CAAK,KAAI,EAAG;AACxE,IAAA,MAAM,IAAI,cAAA,CAAe,kBAAA,EAAoB,mCAAmC,CAAA;AAAA,EAClF;AACA,EAAA,IAAI,MAAA,IAAU,UAAU,MAAA,IAAU,MAAA,CAAO,QAAQ,IAAA,CAAK,GAAA,IAAO,OAAO,MAAA;AAEpE,EAAA,IAAI;AACF,IAAA,MAAM,GAAA,GAAM,MAAM,SAAA,CAAU,GAAA,EAAK;AAAA,MAC/B,GAAI,KAAK,KAAA,GAAQ,EAAE,OAAO,IAAA,CAAK,KAAA,KAAU,EAAC;AAAA,MAC1C,MAAA,EAAQ,GAAG,oBAAoB,CAAA,4CAAA,CAAA;AAAA,MAC/B,UAAA,EAAY,KAAK,UAAA,IAAc;AAAA,KAChC,CAAA;AACD,IAAA,IAAI,GAAA,CAAI,MAAA,KAAW,GAAA,EAAK,MAAM,IAAI,eAAe,kBAAA,EAAoB,CAAA,mBAAA,EAAsB,GAAA,CAAI,MAAM,CAAA,CAAE,CAAA;AACvG,IAAA,IAAI,GAAA;AACJ,IAAA,IAAI;AACF,MAAA,GAAA,GAAM,IAAA,CAAK,KAAA,CAAM,GAAA,CAAI,IAAI,CAAA;AAAA,IAC3B,CAAA,CAAA,MAAQ;AACN,MAAA,MAAM,IAAI,cAAA,CAAe,kBAAA,EAAoB,uBAAuB,CAAA;AAAA,IACtE;AACA,IAAA,MAAM,MAAO,GAAA,CAA2B,IAAA;AACxC,IAAA,IAAI,CAAC,MAAM,OAAA,CAAQ,GAAG,GAAG,MAAM,IAAI,cAAA,CAAe,kBAAA,EAAoB,6BAA6B,CAAA;AACnG,IAAA,MAAM,MAAO,IAAA,CAAK,GAAA,IAAM,IAAK,IAAA,CAAK,KAAI,GAAI,GAAA;AAC1C,IAAA,MAAM,OAAO,GAAA,CAAI,MAAA;AAAA,MACf,CAAC,MACC,OAAO,CAAA,KAAM,YACb,CAAA,KAAM,IAAA,IACN,OAAQ,CAAA,CAAgB,GAAA,KAAQ,aAC9B,CAAA,CAAgB,GAAA,KAAQ,UAAc,CAAA,CAAgB,GAAA,IAAQ,SAC9D,CAAA,CAAgB,GAAA,KAAQ,KAAA,CAAA,IAAc,CAAA,CAAgB,GAAA,GAAO,GAAA;AAAA,KACnE;AACA,IAAA,MAAM,WAAA,GAAc,MAAM,OAAA,CAAQ,GAAA,CAAI,KAAK,GAAA,CAAI,CAAC,CAAA,KAAM,aAAA,CAAc,CAAC,CAAA,CAAE,KAAA,CAAM,MAAM,EAAE,CAAC,CAAC,CAAA;AACvF,IAAA,MAAM,KAAA,GAAQ,EAAE,IAAA,EAAM,WAAA,EAAa,KAAA,EAAO,IAAA,CAAK,GAAA,EAAI,GAAI,UAAA,CAAW,GAAA,CAAI,OAAO,CAAA,EAAE;AAC/E,IAAA,IAAI,cAAA,CAAe,IAAA,IAAQ,UAAA,EAAY,cAAA,CAAe,MAAA,CAAO,eAAe,IAAA,EAAK,CAAE,IAAA,EAAK,CAAE,KAAe,CAAA;AACzG,IAAA,cAAA,CAAe,GAAA,CAAI,KAAK,KAAK,CAAA;AAC7B,IAAA,OAAO,KAAA;AAAA,EACT,SAAS,CAAA,EAAG;AACV,IAAA,cAAA,CAAe,GAAA,CAAI,KAAK,EAAE,WAAA,EAAa,KAAK,GAAA,EAAI,GAAI,cAAc,CAAA;AAClE,IAAA,IAAI,CAAA,YAAa,gBAAgB,MAAM,CAAA;AACvC,IAAA,MAAM,IAAI,cAAA,CAAe,kBAAA,EAAqB,CAAA,CAAY,OAAO,CAAA;AAAA,EACnE;AACF;AAEA,SAAS,gBAAgB,MAAA,EAAwD;AAC/E,EAAA,IAAI,OAAO,OAAO,KAAA,KAAU,QAAA,QAAgB,IAAI,cAAA,CAAe,2BAA2B,kBAAkB,CAAA;AAC5G,EAAA,IAAI,GAAA;AACJ,EAAA,IAAI;AACF,IAAA,GAAA,GAAM,IAAI,GAAA,CAAI,MAAA,CAAO,KAAK,CAAA;AAAA,EAC5B,CAAA,CAAA,MAAQ;AACN,IAAA,MAAM,IAAI,cAAA,CAAe,yBAAA,EAA2B,WAAW,CAAA;AAAA,EACjE;AACA,EAAA,IAAI,IAAI,QAAA,KAAa,QAAA,QAAgB,IAAI,cAAA,CAAe,2BAA2B,gBAAgB,CAAA;AACnG,EAAA,MAAM,SAAA,GAAY,QAAA,CAAS,MAAA,CAAO,MAAA,EAAQ,MAAM,CAAA;AAChD,EAAA,MAAM,IAAA,GAAO,qBAAqB,OAAA,GAAU,SAAA,CAAU,QAAQ,OAAO,SAAA,KAAc,WAAW,SAAA,GAAY,WAAA;AAC1G,EAAA,IAAI,IAAA,KAAS,WAAA,EAAa,OAAO,EAAE,MAAA,EAAQ,IAAI,MAAA,EAAQ,YAAA,EAAc,GAAA,CAAI,MAAA,GAAS,cAAA,EAAe;AACjG,EAAA,IAAI,IAAA,KAAS,YAAY,OAAO,EAAE,QAAQ,GAAA,CAAI,IAAA,EAAM,YAAA,EAAc,GAAA,CAAI,IAAA,EAAK;AAC3E,EAAA,MAAM,IAAI,cAAA,CAAe,kCAAA,EAAoC,IAAI,CAAA;AACnE;AAEA,SAAS,SAAA,CAAU,QAAgB,OAAA,EAA2D;AAC5F,EAAA,IAAI,CAAC,OAAA,IAAW,OAAA,KAAY,KAAA,EAAO,OAAO,IAAA;AAC1C,EAAA,OAAO,OAAA,CAAQ,IAAA,CAAK,CAAC,CAAA,KAAM;AACzB,IAAA,IAAI;AACF,MAAA,MAAM,CAAA,GAAI,IAAI,GAAA,CAAI,CAAC,CAAA;AACnB,MAAA,OAAO,CAAA,CAAE,MAAA,KAAW,MAAA,IAAU,CAAA,CAAE,IAAA,KAAS,MAAA,IAAU,IAAI,GAAA,CAAI,MAAM,CAAA,CAAE,MAAA,KAAW,CAAA,CAAE,MAAA;AAAA,IAClF,CAAA,CAAA,MAAQ;AACN,MAAA,OAAO,KAAA;AAAA,IACT;AAAA,EACF,CAAC,CAAA;AACH;AAIA,eAAsB,gBAAA,CAAiB,OAAA,EAAkB,IAAA,GAA0B,EAAC,EAA8B;AAChH,EAAA,MAAM,SAAA,GAAY,OAAA,CAAQ,OAAA,CAAQ,GAAA,CAAI,WAAW,CAAA;AACjD,EAAA,MAAM,WAAA,GAAc,OAAA,CAAQ,OAAA,CAAQ,GAAA,CAAI,iBAAiB,CAAA;AACzD,EAAA,IAAI,CAAC,SAAA,IAAa,CAAC,aAAa,OAAO,EAAE,QAAQ,QAAA,EAAS;AAC1D,EAAA,IAAI,CAAC,aAAa,CAAC,WAAA,SAAoB,EAAE,MAAA,EAAQ,SAAA,EAAW,MAAA,EAAQ,8BAAA,EAA+B;AAEnG,EAAA,IAAI,MAAA,EAAQ,IAAA;AACZ,EAAA,IAAI;AACF,IAAA,MAAA,GAAS,gBAAgB,WAAW,CAAA;AACpC,IAAA,IAAA,GAAO,gBAAgB,SAAS,CAAA;AAAA,EAClC,SAAS,CAAA,EAAG;AACV,IAAA,OAAO,EAAE,MAAA,EAAQ,SAAA,EAAW,QAAQ,CAAA,6BAAA,EAAiC,CAAA,CAAY,OAAO,CAAA,CAAA,EAAG;AAAA,EAC7F;AAIA,EAAA,MAAM,aAAa,CAAC,GAAG,MAAA,CAAO,OAAA,EAAS,CAAA,CAAE,MAAA;AAAA,IACvC,CAAC,GAAG,CAAC,CAAA,KAAM,WAAA,CAAY,CAAC,CAAA,IAAK,QAAA,CAAS,CAAA,CAAE,MAAA,EAAQ,KAAK,CAAA,KAAM;AAAA,GAC7D;AACA,EAAA,IAAI,WAAW,MAAA,KAAW,CAAA,EAAG,OAAO,EAAE,QAAQ,QAAA,EAAS;AAEvD,EAAA,IAAI,WAAA,GAAgC,EAAE,MAAA,EAAQ,SAAA,EAAW,QAAQ,oBAAA,EAAqB;AACtF,EAAA,KAAA,MAAW,CAAC,KAAA,EAAO,KAAK,CAAA,IAAK,UAAA,EAAY;AACvC,IAAA,MAAM,CAAA,GAAI,MAAM,SAAA,CAAU,OAAA,EAAS,KAAA,EAAO,OAAO,IAAA,CAAK,GAAA,CAAI,KAAK,CAAA,EAAG,IAAI,CAAA;AACtE,IAAA,IAAI,CAAA,CAAE,MAAA,KAAW,UAAA,EAAY,OAAO,CAAA;AACpC,IAAA,WAAA,GAAc,CAAA;AAAA,EAChB;AACA,EAAA,OAAO,WAAA;AACT;AAEA,eAAe,SAAA,CACb,OAAA,EACA,KAAA,EACA,KAAA,EACA,WACA,IAAA,EAC2B;AAC3B,EAAA,MAAM,IAAA,GAAO,CAAC,MAAA,EAAgB,KAAA,GAA+C,EAAC,MAAyB;AAAA,IACrG,MAAA,EAAQ,SAAA;AAAA,IACR,MAAA;AAAA,IACA,GAAG;AAAA,GACL,CAAA;AACA,EAAA,IAAI,CAAC,aAAa,WAAA,CAAY,SAAS,KAAK,EAAE,SAAA,CAAU,iBAAiB,UAAA,CAAA,EAAa;AACpF,IAAA,OAAO,KAAK,6BAA6B,CAAA;AAAA,EAC3C;AACA,EAAA,MAAM,YAAY,SAAA,CAAU,KAAA;AAG5B,EAAA,MAAM,OAAA,GAAU,QAAA,CAAS,KAAA,CAAM,MAAA,EAAQ,SAAS,CAAA;AAChD,EAAA,MAAM,OAAA,GAAU,QAAA,CAAS,KAAA,CAAM,MAAA,EAAQ,SAAS,CAAA;AAChD,EAAA,MAAM,KAAA,GAAQ,QAAA,CAAS,KAAA,CAAM,MAAA,EAAQ,OAAO,CAAA;AAC5C,EAAA,MAAM,KAAA,GAAQ,QAAA,CAAS,KAAA,CAAM,MAAA,EAAQ,OAAO,CAAA;AAC5C,EAAA,IAAI,OAAO,YAAY,QAAA,IAAY,OAAO,YAAY,QAAA,EAAU,OAAO,KAAK,8BAA8B,CAAA;AAC1G,EAAA,IAAI,OAAO,KAAA,KAAU,QAAA,EAAU,OAAO,KAAK,gBAAgB,CAAA;AAC3D,EAAA,IAAI,UAAU,MAAA,IAAa,OAAO,UAAU,QAAA,EAAU,OAAO,KAAK,eAAe,CAAA;AACjF,EAAA,IAAI,IAAA,CAAK,gBAAgB,KAAA,KAAU,MAAA,SAAkB,IAAA,CAAK,gBAAA,EAAkB,EAAE,KAAA,EAAO,CAAA;AAGrF,EAAA,MAAM,GAAA,GAAM,KAAK,KAAA,CAAM,IAAA,CAAK,OAAM,IAAK,IAAA,CAAK,GAAA,EAAI,GAAI,GAAI,CAAA;AACxD,EAAA,MAAM,IAAA,GAAO,KAAK,YAAA,IAAgB,EAAA;AAClC,EAAA,IAAI,OAAA,GAAU,MAAM,IAAA,EAAM,OAAO,KAAK,mBAAA,EAAqB,EAAE,OAAO,CAAA;AACpE,EAAA,IAAI,OAAA,GAAU,MAAM,IAAA,EAAM,OAAO,KAAK,SAAA,EAAW,EAAE,OAAO,CAAA;AAC1D,EAAA,IAAI,WAAW,OAAA,EAAS,OAAO,KAAK,wBAAA,EAA0B,EAAE,OAAO,CAAA;AACvE,EAAA,IAAI,OAAA,GAAU,OAAA,IAAW,IAAA,CAAK,cAAA,IAAkB,KAAA,CAAA,SAAgB,IAAA,CAAK,0BAAA,EAA4B,EAAE,KAAA,EAAO,CAAA;AAG1G,EAAA,MAAM,QAAQ,KAAA,CAAM,KAAA,CAAM,IAAI,CAAC,CAAA,KAAM,EAAE,KAAK,CAAA;AAC5C,EAAA,IAAI,CAAC,MAAM,QAAA,CAAS,YAAY,KAAK,CAAC,KAAA,CAAM,QAAA,CAAS,aAAa,CAAA,EAAG;AACnE,IAAA,OAAO,IAAA,CAAK,qCAAA,EAAuC,EAAE,KAAA,EAAO,CAAA;AAAA,EAC9D;AACA,EAAA,MAAM,cAAA,GAAiB,MAAM,KAAA,CAAM,IAAA,CAAK,CAAC,CAAA,KAAM,CAAA,CAAE,UAAU,iBAAiB,CAAA;AAC5E,EAAA,IAAI,CAAC,cAAA,EAAgB,OAAO,KAAK,6BAAA,EAA+B,EAAE,OAAO,CAAA;AAGzE,EAAA,MAAM,WAAA,GAAc,OAAA,CAAQ,OAAA,CAAQ,GAAA,CAAI,iBAAiB,CAAA;AACzD,EAAA,IAAI,CAAC,WAAA,EAAa,OAAO,KAAK,yBAAA,EAA2B,EAAE,OAAO,CAAA;AAClE,EAAA,IAAI,MAAA;AACJ,EAAA,IAAI;AACF,IAAA,MAAM,GAAA,GAAM,QAAA,CAAS,cAAA,CAAe,MAAA,EAAQ,KAAK,CAAA;AACjD,IAAA,IAAI,OAAO,QAAQ,QAAA,EAAU;AAC3B,MAAA,MAAM,CAAA,GAAI,eAAA,CAAgB,WAAW,CAAA,CAAE,IAAI,GAAG,CAAA;AAC9C,MAAA,IAAI,CAAC,CAAA,IAAK,WAAA,CAAY,CAAC,CAAA,SAAU,IAAA,CAAK,gCAAA,EAAkC,EAAE,KAAA,EAAO,CAAA;AACjF,MAAA,MAAA,GAAS,CAAA;AAAA,IACX,CAAA,MAAO;AACL,MAAA,MAAA,GAAS,UAAU,WAAW,CAAA;AAAA,IAChC;AAAA,EACF,SAAS,CAAA,EAAG;AACV,IAAA,OAAO,KAAK,CAAA,2BAAA,EAA+B,CAAA,CAAY,OAAO,CAAA,CAAA,EAAI,EAAE,OAAO,CAAA;AAAA,EAC7E;AACA,EAAA,IAAI,MAAA,EAAgB,YAAA;AACpB,EAAA,IAAI;AACF,IAAA;AAAC,IAAA,CAAC,EAAE,MAAA,EAAQ,YAAA,EAAa,GAAI,gBAAgB,MAAM,CAAA;AAAA,EACrD,SAAS,CAAA,EAAG;AACV,IAAA,OAAO,KAAM,CAAA,CAAqB,IAAA,IAAQ,yBAAA,EAA2B,EAAE,OAAO,CAAA;AAAA,EAChF;AACA,EAAA,IAAI,CAAC,SAAA,CAAU,MAAA,EAAQ,IAAA,CAAK,kBAAkB,CAAA,EAAG,OAAO,IAAA,CAAK,oBAAA,EAAsB,EAAE,QAAA,EAAU,MAAA,EAAQ,OAAO,CAAA;AAG9G,EAAA,MAAM,SAAA,GAAY,QAAQ,CAAA,EAAG,MAAM,IAAI,KAAK,CAAA,CAAA,EAAI,KAAK,CAAA,CAAA,GAAK,MAAA;AAC1D,EAAA,IAAI,SAAA,IAAc,MAAM,IAAA,CAAK,WAAA,EAAa,IAAI,SAAS,CAAA,EAAI,OAAO,IAAA,CAAK,gBAAA,EAAkB,EAAE,QAAA,EAAU,MAAA,EAAQ,OAAO,CAAA;AAGpH,EAAA,IAAI,GAAA;AACJ,EAAA,IAAI;AACF,IAAA,GAAA,GAAM,MAAM,aAAA,CAAc,YAAA,EAAc,IAAI,CAAA;AAAA,EAC9C,SAAS,CAAA,EAAG;AACV,IAAA,OAAO,IAAA,CAAM,EAAqB,IAAA,IAAQ,kBAAA,EAAoB,EAAE,QAAA,EAAU,MAAA,EAAQ,OAAO,CAAA;AAAA,EAC3F;AACA,EAAA,MAAM,GAAA,GAAM,GAAA,CAAI,WAAA,CAAY,OAAA,CAAQ,KAAK,CAAA;AACzC,EAAA,IAAI,GAAA,GAAM,GAAG,OAAO,IAAA,CAAK,iBAAiB,EAAE,QAAA,EAAU,MAAA,EAAQ,KAAA,EAAO,CAAA;AACrE,EAAA,MAAM,GAAA,GAAM,GAAA,CAAI,IAAA,CAAK,GAAG,CAAA;AAGxB,EAAA,IAAI;AACF,IAAA,MAAM,GAAA,GAAM,IAAI,GAAA,CAAI,OAAA,CAAQ,GAAG,CAAA;AAC/B,IAAA,MAAM,MAAM,gBAAA,CAAiB,GAAA,EAAK,SAAS,KAAA,CAAM,MAAA,EAAQ,KAAK,CAAC,CAAA;AAC/D,IAAA,MAAM,IAAA,GAAO,cAAc,KAAA,EAAO;AAAA,MAChC,OAAA;AAAA,MACA,GAAA;AAAA,MACA,GAAI,IAAA,CAAK,SAAA,GAAY,EAAE,SAAA,EAAW,IAAA,CAAK,SAAA,CAAU,OAAA,EAAS,GAAG,CAAA,EAAE,GAAI;AAAC,KACrE,CAAA;AACD,IAAA,MAAM,KAAK,MAAM,eAAA,CAAgB,GAAA,EAAK,GAAA,EAAK,MAAM,SAAS,CAAA;AAC1D,IAAA,IAAI,CAAC,IAAI,OAAO,IAAA,CAAK,iBAAiB,EAAE,QAAA,EAAU,MAAA,EAAQ,KAAA,EAAO,CAAA;AACjE,IAAA,IAAI,SAAA,EAAW,MAAM,IAAA,CAAK,WAAA,EAAa,GAAA,CAAI,SAAA,EAAW,IAAA,CAAK,GAAA,CAAI,OAAA,GAAU,GAAA,EAAK,CAAC,CAAA,GAAI,IAAI,CAAA;AACvF,IAAA,OAAO,EAAE,QAAQ,UAAA,EAAY,QAAA,EAAU,QAAQ,KAAA,EAAO,KAAA,EAAO,GAAA,EAAK,OAAA,EAAS,OAAA,EAAQ;AAAA,EACrF,SAAS,CAAA,EAAG;AACV,IAAA,OAAO,IAAA,CAAK,CAAA,YAAa,cAAA,GAAiB,CAAA,CAAE,IAAA,GAAO,sBAAsB,EAAE,QAAA,EAAU,MAAA,EAAQ,KAAA,EAAO,CAAA;AAAA,EACtG;AACF;;;AChPA,IAAM,aAAA,GAAkE;AAAA,EACtE,qBAAA,EAAuB,EAAE,IAAA,EAAM,eAAA,EAAiB,QAAQ,QAAA;AAC1D,CAAA;AAEA,IAAM,gBAAA,GAAmB,kDAAA;AACzB,IAAM,SAAA,GAAY,kDAAA;AAElB,SAAS,OAAO,OAAA,EAAiC;AAC/C,EAAA,MAAM,CAAA,GAAI,OAAA,CAAQ,OAAA,CAAQ,GAAA,CAAI,eAAe,CAAA;AAC7C,EAAA,OAAO,CAAA,IAAK,aAAA,CAAc,IAAA,CAAK,CAAC,CAAA,GAAI,CAAA,CAAE,OAAA,CAAQ,aAAA,EAAe,EAAE,CAAA,CAAE,IAAA,EAAK,GAAI,IAAA;AAC5E;AAEA,SAAS,oBAAoB,KAAA,EAA8B;AACzD,EAAA,IAAI;AACF,IAAA,MAAM,OAAA,GAAU,KAAA,CAAM,KAAA,CAAM,GAAG,EAAE,CAAC,CAAA;AAClC,IAAA,MAAM,IAAA,GAAO,IAAA,CAAK,OAAA,CAAQ,OAAA,CAAQ,IAAA,EAAM,GAAG,CAAA,CAAE,OAAA,CAAQ,IAAA,EAAM,GAAG,CAAC,CAAA;AAC/D,IAAA,MAAM,GAAA,GAAO,IAAA,CAAK,KAAA,CAAM,IAAI,CAAA,CAAwB,GAAA;AACpD,IAAA,OAAO,OAAO,GAAA,KAAQ,QAAA,GAAW,GAAA,GAAM,IAAA;AAAA,EACzC,CAAA,CAAA,MAAQ;AACN,IAAA,OAAO,IAAA;AAAA,EACT;AACF;AAGA,IAAI,WAAA;AACJ,IAAM,UAAA,uBAAiB,GAAA,EAA0D;AAEjF,eAAe,YAAA,CAAa,OAAe,CAAA,EAA8D;AACvG,EAAA,WAAA,KAAgB,OAAO,MAAM,CAAA;AAC7B,EAAA,MAAM,OAAO,MAAM,WAAA;AACnB,EAAA,MAAM,MAAA,GAAS,EAAE,IAAA,GACb,IAAA,CAAK,kBAAkB,CAAA,CAAE,IAAsD,KAC9E,MAAM;AACL,IAAA,MAAM,GAAA,GAAM,EAAE,OAAA,IAAW,CAAA,EAAG,EAAE,MAAA,CAAO,OAAA,CAAQ,KAAA,EAAO,EAAE,CAAC,CAAA,sBAAA,CAAA;AACvD,IAAA,IAAI,CAAA,GAAI,UAAA,CAAW,GAAA,CAAI,GAAG,CAAA;AAC1B,IAAA,IAAI,CAAC,CAAA,EAAG;AACN,MAAA,CAAA,GAAI,IAAA,CAAK,kBAAA,CAAmB,IAAI,GAAA,CAAI,GAAG,CAAA,EAAG,EAAE,WAAA,EAAa,IAAA,EAAW,gBAAA,EAAkB,GAAA,EAAQ,CAAA;AAC9F,MAAA,UAAA,CAAW,GAAA,CAAI,KAAK,CAAC,CAAA;AAAA,IACvB;AACA,IAAA,OAAO,CAAA;AAAA,EACT,CAAA,GAAG;AACP,EAAA,IAAI;AACF,IAAA,MAAM,EAAE,OAAA,EAAQ,GAAI,MAAM,IAAA,CAAK,SAAA,CAAU,OAAO,MAAA,EAAQ;AAAA,MACtD,QAAQ,CAAA,CAAE,MAAA;AAAA,MACV,UAAU,CAAA,CAAE,QAAA;AAAA,MACZ,YAAY,CAAA,CAAE,UAAA,IAAc,CAAC,OAAA,EAAS,OAAA,EAAS,SAAS,OAAO,CAAA;AAAA,MAC/D,cAAA,EAAgB,EAAE,iBAAA,IAAqB;AAAA,KACxC,CAAA;AACD,IAAA,IAAI,CAAA,CAAE,gBAAgB,MAAA,EAAQ;AAC5B,MAAA,MAAM,OAAA,GAAU,IAAI,GAAA,CAAI,MAAA,CAAO,OAAA,CAAQ,KAAA,IAAS,OAAA,CAAQ,GAAA,IAAO,EAAE,CAAA,CAAE,KAAA,CAAM,KAAK,CAAC,CAAA;AAC/E,MAAA,MAAM,OAAA,GAAU,CAAA,CAAE,cAAA,CAAe,MAAA,CAAO,CAAC,MAAM,CAAC,OAAA,CAAQ,GAAA,CAAI,CAAC,CAAC,CAAA;AAC9D,MAAA,IAAI,OAAA,CAAQ,MAAA,EAAQ,OAAO,EAAE,KAAA,EAAO,kBAAkB,OAAA,CAAQ,IAAA,CAAK,GAAG,CAAC,CAAA,CAAA,EAAG;AAAA,IAC5E;AACA,IAAA,MAAM,QAAA,GAAW,OAAO,OAAA,CAAQ,SAAA,IAAa,QAAQ,GAAA,IAAO,OAAA,CAAQ,OAAO,EAAE,CAAA;AAC7E,IAAA,IAAI,CAAC,QAAA,EAAU,OAAO,EAAE,OAAO,wBAAA,EAAyB;AACxD,IAAA,OAAO;AAAA,MACL,EAAA,EAAI,UAAU,QAAQ,CAAA,CAAA;AAAA,MACtB,MAAM,OAAO,OAAA,CAAQ,UAAA,KAAe,QAAA,GAAW,QAAQ,UAAA,GAAa,QAAA;AAAA,MACpE,QAAQ,OAAO,OAAA,CAAQ,YAAA,KAAiB,QAAA,GAAW,QAAQ,YAAA,GAAe,IAAA;AAAA,MAC1E,MAAA,EAAQ,QAAA;AAAA,MACR,MAAA,EAAQ,EAAE,GAAA,EAAK,OAAA,CAAQ,KAAK,KAAA,EAAO,OAAA,CAAQ,KAAA,IAAS,OAAA,CAAQ,GAAA;AAAI,KAClE;AAAA,EACF,SAAS,CAAA,EAAG;AACV,IAAA,OAAO,EAAE,KAAA,EAAO,CAAA,cAAA,EAAkB,EAAwB,IAAA,IAAS,CAAA,CAAY,OAAO,CAAA,CAAA,EAAG;AAAA,EAC3F;AACF;AAEO,SAAS,eAAA,CAAgB,OAAA,GAA4B,EAAC,EAAG;AAC9D,EAAA,MAAM,MACJ,OAAA,CAAQ,UAAA,KAAe,KAAA,GACnB,IAAA,GACA,EAAE,WAAA,EAAa,iBAAA,EAAkB,EAAG,GAAI,OAAO,OAAA,CAAQ,UAAA,KAAe,WAAW,OAAA,CAAQ,UAAA,GAAa,EAAC,EAAG;AAChH,EAAA,MAAM,QAAA,GACJ,OAAA,CAAQ,QAAA,KAAa,KAAA,GAAQ,IAAA,GAAO,OAAO,OAAA,CAAQ,QAAA,KAAa,QAAA,GAAW,OAAA,CAAQ,QAAA,GAAW,EAAC;AACjG,EAAA,MAAM,SAAA,GAAY,OAAA,CAAQ,MAAA,EAAQ,MAAA,IAAU,MAAA;AAE5C,EAAA,eAAe,aAAa,OAAA,EAA4C;AACtE,IAAA,MAAM,YAA+B,EAAC;AACtC,IAAA,MAAM,UAAoB,EAAC;AAC3B,IAAA,IAAI,WAAA;AAGJ,IAAA,IAAI,GAAA,EAAK;AACP,MAAA,MAAM,CAAA,GAAI,MAAM,gBAAA,CAAiB,OAAA,EAAS,GAAG,CAAA;AAC7C,MAAA,IAAI,CAAA,CAAE,WAAW,UAAA,EAAY;AAC3B,QAAA,MAAM,KAAA,GAAQ,aAAA,CAAc,CAAA,CAAE,QAAQ,CAAA;AACtC,QAAA,MAAM,IAAA,GAAO,IAAI,GAAA,CAAI,CAAA,CAAE,QAAQ,CAAA,CAAE,QAAA;AACjC,QAAA,OAAO;AAAA,UACL,MAAA,EAAQ,UAAA;AAAA,UACR,KAAA,EAAO;AAAA,YACL,IAAI,CAAA,CAAE,QAAA;AAAA,YACN,IAAA,EAAM,OAAO,IAAA,IAAQ,IAAA;AAAA,YACrB,MAAA,EAAQ,OAAO,MAAA,IAAU,IAAA;AAAA,YACzB,MAAA,EAAQ,cAAA;AAAA,YACR,QAAQ,EAAE,KAAA,EAAO,EAAE,KAAA,EAAO,GAAA,EAAK,EAAE,GAAA;AAAI;AACvC,SACF;AAAA,MACF;AACA,MAAA,IAAI,CAAA,CAAE,WAAW,SAAA,EAAW;AAC1B,QAAA,SAAA,CAAU,KAAK,cAAc,CAAA;AAC7B,QAAA,OAAA,CAAQ,IAAA,CAAK,CAAA,aAAA,EAAgB,CAAA,CAAE,MAAM,CAAA,CAAE,CAAA;AACvC,QAAA,WAAA,KAAgB,EAAE,QAAA,GAAW,IAAI,IAAI,CAAA,CAAE,QAAQ,EAAE,QAAA,GAAW,MAAA;AAAA,MAC9D;AAAA,IACF;AAGA,IAAA,MAAM,QAAQ,MAAA,CAAO,OAAO,KAAK,OAAA,CAAQ,OAAA,CAAQ,IAAI,aAAa,CAAA;AAClE,IAAA,IAAI,SAAS,OAAA,CAAQ,MAAA,IAAU,KAAA,CAAM,UAAA,CAAW,SAAS,CAAA,EAAG;AAC1D,MAAA,SAAA,CAAU,KAAK,SAAS,CAAA;AACxB,MAAA,MAAM,EAAA,GAAK,MAAM,OAAA,CAAQ,MAAA,CAAO,OAAO,KAAK,CAAA;AAC5C,MAAA,IAAI,EAAA,EAAI;AACN,QAAA,OAAO;AAAA,UACL,MAAA,EAAQ,UAAA;AAAA,UACR,KAAA,EAAO;AAAA,YACL,EAAA,EAAI,CAAA,IAAA,EAAO,EAAA,CAAG,OAAO,CAAA,CAAA;AAAA,YACrB,IAAA,EAAM,EAAA,CAAG,IAAA,IAAQ,EAAA,CAAG,OAAA;AAAA,YACpB,MAAA,EAAQ,GAAG,MAAA,IAAU,IAAA;AAAA,YACrB,MAAA,EAAQ,SAAA;AAAA,YACR,GAAI,EAAA,CAAG,MAAA,GAAS,EAAE,MAAA,EAAQ,EAAE,MAAA,EAAQ,EAAA,CAAG,MAAA,EAAO,EAAE,GAAI;AAAC;AACvD,SACF;AAAA,MACF;AACA,MAAA,OAAA,CAAQ,KAAK,4BAA4B,CAAA;AAAA,IAC3C,WAAW,KAAA,IAAS,OAAA,CAAQ,UAAU,SAAA,CAAU,IAAA,CAAK,KAAK,CAAA,EAAG;AAG3D,MAAA,MAAM,GAAA,GAAM,oBAAoB,KAAK,CAAA;AACrC,MAAA,IAAI,GAAA,KAAQ,OAAA,CAAQ,MAAA,CAAO,MAAA,EAAQ;AACjC,QAAA,SAAA,CAAU,KAAK,QAAQ,CAAA;AACvB,QAAA,MAAM,CAAA,GAAI,MAAM,YAAA,CAAa,KAAA,EAAO,QAAQ,MAAM,CAAA;AAClD,QAAA,IAAI,EAAE,WAAW,CAAA,CAAA,EAAI,OAAO,EAAE,MAAA,EAAQ,UAAA,EAAY,OAAO,CAAA,EAAE;AAC3D,QAAA,OAAA,CAAQ,IAAA,CAAK,CAAA,OAAA,EAAU,CAAA,CAAE,KAAK,CAAA,CAAE,CAAA;AAAA,MAClC;AAAA,IACF;AAGA,IAAA,MAAM,EAAA,GAAK,OAAA,CAAQ,OAAA,CAAQ,GAAA,CAAI,YAAY,CAAA;AAC3C,IAAA,MAAM,KAAA,GAAQ,kBAAkB,EAAE,CAAA;AAClC,IAAA,IAAI,KAAA,EAAO;AACT,MAAA,WAAA,KAAgB,KAAA,CAAM,IAAA;AACtB,MAAA,IAAI,QAAA,EAAU;AACZ,QAAA,SAAA,CAAU,KAAK,kBAAkB,CAAA;AACjC,QAAA,MAAM,CAAA,GAAI,MAAM,aAAA,CAAc,KAAA,EAAO,QAAA,CAAS,SAAS,QAAA,CAAS,QAAQ,CAAA,EAAG,QAAA,CAAS,QAAQ,CAAA;AAC5F,QAAA,IAAI,CAAA,CAAE,WAAW,UAAA,EAAY;AAC3B,UAAA,OAAO;AAAA,YACL,MAAA,EAAQ,UAAA;AAAA,YACR,OAAO,EAAE,EAAA,EAAI,WAAW,KAAA,CAAM,IAAI,IAAI,IAAA,EAAM,KAAA,CAAM,MAAM,MAAA,EAAQ,IAAA,EAAM,QAAQ,kBAAA,EAAoB,MAAA,EAAQ,EAAE,IAAA,EAAM,CAAA,CAAE,MAAK;AAAE,WAC7H;AAAA,QACF;AACA,QAAA,OAAA,CAAQ,IAAA,CAAK,CAAA,QAAA,EAAW,CAAA,CAAE,MAAM,CAAA,CAAE,CAAA;AAAA,MACpC,CAAA,MAAO,OAAA,CAAQ,IAAA,CAAK,+BAA+B,CAAA;AAAA,IACrD;AAEA,IAAA,IAAI,SAAA,CAAU,MAAA,IAAU,KAAA,IAAU,EAAA,IAAM,gBAAA,CAAiB,IAAA,CAAK,EAAE,CAAA,IAAM,OAAA,CAAQ,OAAA,CAAQ,GAAA,CAAI,iBAAiB,CAAA,EAAG;AAC5G,MAAA,OAAO;AAAA,QACL,MAAA,EAAQ,YAAA;AAAA,QACR,MAAA,EAAQ,OAAA,CAAQ,CAAC,CAAA,IAAK,iCAAA;AAAA,QACtB,GAAI,WAAA,GAAc,EAAE,WAAA,KAAgB,EAAC;AAAA,QACrC;AAAA,OACF;AAAA,IACF;AACA,IAAA,OAAO,EAAE,QAAQ,MAAA,EAAO;AAAA,EAC1B;AAEA,EAAA,OAAO,EAAE,YAAA,EAAa;AACxB;AAKA,eAAsB,aAAa,GAAA,EAA8B;AAC/D,EAAA,MAAM,CAAA,GAAI,MAAM,MAAA,CAAO,MAAA,CAAO,MAAA,CAAO,SAAA,EAAW,IAAI,WAAA,EAAY,CAAE,MAAA,CAAO,GAAG,CAAC,CAAA;AAC7E,EAAA,OAAO,CAAC,GAAG,IAAI,UAAA,CAAW,CAAC,CAAC,CAAA,CAAE,IAAI,CAAC,CAAA,KAAM,EAAE,QAAA,CAAS,EAAE,EAAE,QAAA,CAAS,CAAA,EAAG,GAAG,CAAC,CAAA,CAAE,KAAK,EAAE,CAAA;AACnF;AAGO,SAAS,kBAAkB,UAAA,EAAqE;AACrG,EAAA,OAAO,OAAO,GAAA,KAAQ,UAAA,CAAW,MAAM,YAAA,CAAa,GAAG,CAAC,CAAA,IAAK,IAAA;AAC/D;AAGO,SAAS,gBAAA,CAAiB,SAAS,MAAA,EAAgB;AACxD,EAAA,OAAO,MAAA,GAAS,iBAAiB,MAAA,CAAO,eAAA,CAAgB,IAAI,UAAA,CAAW,EAAE,CAAC,CAAC,CAAA;AAC7E;AAIO,IAAM,aAAA,GAAgB;AAAA,EAC3B,MAAA,EAAQ,4BAAA;AAAA,EACR,EAAA,EAAI,wBAAA;AAAA,EACJ,IAAA,EAAM,0BAAA;AAAA,EACN,MAAA,EAAQ,4BAAA;AAAA,EACR,MAAA,EAAQ;AACV;AAOO,SAAS,gBAAA,CAAiB,SAAkB,MAAA,EAAkC;AACnF,EAAA,MAAM,CAAA,GAAI,IAAI,OAAA,CAAQ,OAAA,CAAQ,OAAO,CAAA;AACrC,EAAA,KAAA,MAAW,KAAK,CAAC,GAAG,CAAA,CAAE,IAAA,EAAM,CAAA,EAAG,IAAI,CAAA,CAAE,WAAA,GAAc,UAAA,CAAW,gBAAgB,CAAA,EAAG,CAAA,CAAE,OAAO,CAAC,CAAA;AAC3F,EAAA,CAAA,CAAE,GAAA,CAAI,aAAA,CAAc,MAAA,EAAQ,MAAA,CAAO,MAAM,CAAA;AACzC,EAAA,IAAI,MAAA,CAAO,WAAW,UAAA,EAAY;AAChC,IAAA,CAAA,CAAE,GAAA,CAAI,aAAA,CAAc,EAAA,EAAI,MAAA,CAAO,MAAM,EAAE,CAAA;AACvC,IAAA,CAAA,CAAE,GAAA,CAAI,aAAA,CAAc,IAAA,EAAM,MAAA,CAAO,MAAM,IAAI,CAAA;AAC3C,IAAA,CAAA,CAAE,GAAA,CAAI,aAAA,CAAc,MAAA,EAAQ,MAAA,CAAO,MAAM,MAAM,CAAA;AAC/C,IAAA,IAAI,MAAA,CAAO,MAAM,MAAA,EAAQ,CAAA,CAAE,IAAI,aAAA,CAAc,MAAA,EAAQ,MAAA,CAAO,KAAA,CAAM,MAAM,CAAA;AAAA,EAC1E;AACA,EAAA,OAAO,CAAA;AACT;AAOO,SAAS,iBAAiB,OAAA,EAA+C;AAC9E,EAAA,MAAM,MAAA,GAAS,OAAA,CAAQ,GAAA,CAAI,aAAA,CAAc,MAAM,CAAA;AAC/C,EAAA,OAAO;AAAA,IACL,QAAQ,MAAA,IAAU,MAAA;AAAA,IAClB,EAAA,EAAI,OAAA,CAAQ,GAAA,CAAI,aAAA,CAAc,EAAE,CAAA;AAAA,IAChC,IAAA,EAAM,OAAA,CAAQ,GAAA,CAAI,aAAA,CAAc,IAAI,CAAA;AAAA,IACpC,MAAA,EAAQ,OAAA,CAAQ,GAAA,CAAI,aAAA,CAAc,MAAM,CAAA;AAAA,IACxC,MAAA,EAAQ,OAAA,CAAQ,GAAA,CAAI,aAAA,CAAc,MAAM;AAAA,GAC1C;AACF;AAQO,SAAS,YAAA,CAAa,QAAyB,GAAA,EAA8D;AAClH,EAAA,IAAI,MAAA,CAAO,MAAA,KAAW,MAAA,EAAQ,OAAO,IAAA;AACrC,EAAA,MAAM,GAAA,GAAM,IAAI,GAAA,CAAI,GAAA,CAAI,QAAQ,GAAG,CAAA;AACnC,EAAA,MAAM,QAAA,GAAW,OAAO,MAAA,KAAW,UAAA;AACnC,EAAA,OAAO;AAAA,IACL,EAAA,EAAI,CAAA,IAAA,EAAO,MAAA,CAAO,UAAA,EAAY,CAAA,CAAA;AAAA,IAC9B,QAAQ,GAAA,CAAI,MAAA;AAAA,IACZ,SAAA,EAAW,WAAW,MAAA,CAAO,KAAA,CAAM,KAAK,CAAA,WAAA,EAAc,MAAA,CAAO,eAAe,SAAS,CAAA,CAAA;AAAA,IACrF,UAAA,EAAA,iBAAY,IAAI,IAAA,EAAK,EAAE,WAAA,EAAY;AAAA,IACnC,IAAA,EAAM,yBAAA;AAAA,IACN,KAAA,EAAO;AAAA,MACL,KAAA,EAAO,SAAA;AAAA,MACP,KAAA,EAAO,WAAW,UAAA,GAAa,UAAA;AAAA,MAC/B,UAAA,EAAY,WAAW,CAAA,GAAI,GAAA;AAAA,MAC3B,MAAA,EAAQ,WAAY,MAAA,CAAO,KAAA,CAAM,UAAU,MAAA,CAAO,KAAA,CAAM,IAAA,GAAS,MAAA,CAAO,WAAA,IAAe,IAAA;AAAA,MACvF,SAAA,EAAW,GAAA,CAAI,OAAA,CAAQ,OAAA,CAAQ,IAAI,YAAY,CAAA;AAAA,MAC/C,gBAAA,EAAkB,SAAA;AAAA,MAClB,OAAA,EAAS,EAAE,OAAA,EAAS,QAAA;AAAS,KAC/B;AAAA,IACA,OAAA,EAAS,WAAW,SAAA,GAAY,OAAA;AAAA,IAChC,GAAI,QAAA,GAAW,KAAK,EAAE,KAAA,EAAO,OAAO,MAAA,EAAO;AAAA,IAC3C,QAAA,EAAU;AAAA,MACR,QAAA,EAAU,WAAW,MAAA,CAAO,KAAA,CAAM,SAAU,MAAA,CAAO,SAAA,CAAU,CAAC,CAAA,IAAK,MAAA;AAAA,MACnE,GAAI,WAAW,EAAE,OAAA,EAAS,OAAO,KAAA,CAAM,EAAA,KAAO,EAAC;AAAA,MAC/C,MAAM,GAAA,CAAI;AAAA;AACZ,GACF;AACF;;;AC3TO,SAAS,sBAAA,CAAuB,OAAA,GAAmC,EAAC,EAAG;AAC5E,EAAA,MAAM,IAAA,GAAO,gBAAgB,OAAO,CAAA;AACpC,EAAA,OAAO,eAAe,OAAO,OAAA,EAA2C;AACtE,IAAA,IAAI,OAAA,CAAQ,OAAA,IAAW,CAAC,OAAA,CAAQ,OAAA,CAAQ,IAAI,GAAA,CAAI,OAAA,CAAQ,GAAG,CAAC,CAAA,EAAG;AAC7D,MAAA,MAAMA,OAAAA,GAA0B,EAAE,MAAA,EAAQ,MAAA,EAAO;AACjD,MAAA,OAAO,EAAE,MAAA,EAAAA,OAAAA,EAAQ,SAAS,gBAAA,CAAiB,OAAA,EAASA,OAAM,CAAA,EAAE;AAAA,IAC9D;AACA,IAAA,MAAM,MAAA,GAAS,MAAM,IAAA,CAAK,YAAA,CAAa,OAAO,CAAA;AAC9C,IAAA,IAAI,MAAA,CAAO,MAAA,KAAW,MAAA,IAAU,OAAA,CAAQ,QAAA,EAAU;AAEhD,MAAA,KAAK,OAAA,CAAQ,OAAA,EAAQ,CAClB,IAAA,CAAK,MAAM,OAAA,CAAQ,QAAA,CAAU,EAAE,MAAA,EAAQ,SAAS,CAAC,CAAA,CACjD,KAAA,CAAM,MAAM,MAAS,CAAA;AAAA,IAC1B;AACA,IAAA,OAAO,EAAE,MAAA,EAAQ,OAAA,EAAS,gBAAA,CAAiB,OAAA,EAAS,MAAM,CAAA,EAAE;AAAA,EAC9D,CAAA;AACF;AAmBO,SAAS,gBAAA,CAAiB,OAAA,GAAmC,EAAC,EAAG;AACtE,EAAA,MAAM,MAAA,GAAS,uBAAuB,OAAO,CAAA;AAC7C,EAAA,OAAO,CAAC,GAAA,EAAc,IAAA,EAAe,IAAA,KAAkC;AACrE,IAAA,MAAM,OAAA,GAAU,IAAI,OAAA,EAAQ;AAC5B,IAAA,KAAA,MAAW,CAAC,GAAG,CAAC,CAAA,IAAK,OAAO,OAAA,CAAQ,GAAA,CAAI,OAAO,CAAA,EAAG;AAChD,MAAA,IAAI,CAAA,KAAM,MAAA,EAAW,OAAA,CAAQ,GAAA,CAAI,CAAA,EAAG,KAAA,CAAM,OAAA,CAAQ,CAAC,CAAA,GAAI,CAAA,CAAE,IAAA,CAAK,IAAI,IAAI,CAAC,CAAA;AAAA,IACzE;AACA,IAAA,MAAM,IAAA,GAAO,OAAA,CAAQ,GAAA,CAAI,MAAM,CAAA,IAAK,WAAA;AACpC,IAAA,MAAM,GAAA,GAAM,CAAA,EAAG,GAAA,CAAI,QAAA,IAAY,MAAM,CAAA,GAAA,EAAM,IAAI,CAAA,EAAG,GAAA,CAAI,WAAA,IAAe,GAAA,CAAI,GAAA,IAAO,GAAG,CAAA,CAAA;AACnF,IAAA,MAAA,CAAO,IAAI,OAAA,CAAQ,GAAA,EAAK,EAAE,QAAQ,GAAA,CAAI,MAAA,IAAU,KAAA,EAAO,OAAA,EAAS,CAAC,CAAA,CAC9D,IAAA,CAAK,CAAC,GAAA,KAAQ;AACb,MAAA,GAAA,CAAI,QAAQ,GAAA,CAAI,MAAA;AAChB,MAAA,KAAA,MAAW,CAAA,IAAK,MAAA,CAAO,IAAA,CAAK,GAAA,CAAI,OAAO,CAAA,EAAG,IAAI,CAAA,CAAE,UAAA,CAAW,gBAAgB,CAAA,EAAG,OAAO,GAAA,CAAI,QAAQ,CAAC,CAAA;AAClG,MAAA,GAAA,CAAI,OAAA,CAAQ,OAAA,CAAQ,CAAC,CAAA,EAAG,CAAA,KAAM;AAC5B,QAAA,IAAI,EAAE,UAAA,CAAW,gBAAgB,GAAG,GAAA,CAAI,OAAA,CAAQ,CAAC,CAAA,GAAI,CAAA;AAAA,MACvD,CAAC,CAAA;AACD,MAAA,IAAA,EAAK;AAAA,IACP,CAAC,CAAA,CAGA,KAAA,CAAM,MAAM;AACX,MAAA,KAAA,MAAW,CAAA,IAAK,MAAA,CAAO,IAAA,CAAK,GAAA,CAAI,OAAO,CAAA,EAAG,IAAI,CAAA,CAAE,UAAA,CAAW,gBAAgB,CAAA,EAAG,OAAO,GAAA,CAAI,QAAQ,CAAC,CAAA;AAClG,MAAA,GAAA,CAAI,KAAA,GAAQ,EAAE,MAAA,EAAQ,MAAA,EAAO;AAC7B,MAAA,IAAA,EAAK;AAAA,IACP,CAAC,CAAA;AAAA,EACL,CAAA;AACF","file":"chunk-X7NFMFN6.js","sourcesContent":["import type { AgentIdentity } from '@agentronics/protocol'\nimport { SDK_VERSION } from '../version.js'\n\nexport type CrawlerCategory = 'ai' | 'search'\n\nexport interface CrawlerSignature {\n  /** Stable vendor id, reported as identity.vendor. */\n  name: string\n  category: CrawlerCategory\n  /** Tested against navigator.userAgent. */\n  pattern: RegExp\n}\n\n/**\n * Known AI + search crawlers, matched by User-Agent token.\n *\n * Caveats baked into the design:\n * - UA is self-reported and trivially spoofable, so a match is high-confidence\n *   but never certain — we report `confidence: 0.9`, not `1`.\n * - This is client-side detection: it only sees crawlers that actually execute\n *   JavaScript on the page. The majority of crawlers fetch HTML and never run\n *   the SDK, so full coverage needs server/edge UA inspection (a future product).\n *\n * Order matters: more specific tokens (e.g. `Google-Extended`, `Applebot-Extended`)\n * are listed before their broader siblings so the first match wins correctly.\n */\nexport const CRAWLER_SIGNATURES: CrawlerSignature[] = [\n  // AI / LLM crawlers\n  { name: 'GPTBot', category: 'ai', pattern: /GPTBot/i },\n  { name: 'OAI-SearchBot', category: 'ai', pattern: /OAI-SearchBot/i },\n  { name: 'ChatGPT-User', category: 'ai', pattern: /ChatGPT-User/i },\n  { name: 'ClaudeBot', category: 'ai', pattern: /ClaudeBot/i },\n  { name: 'Claude-Web', category: 'ai', pattern: /Claude-Web/i },\n  { name: 'anthropic-ai', category: 'ai', pattern: /anthropic-ai/i },\n  { name: 'PerplexityBot', category: 'ai', pattern: /PerplexityBot/i },\n  { name: 'Google-Extended', category: 'ai', pattern: /Google-Extended/i },\n  { name: 'Applebot-Extended', category: 'ai', pattern: /Applebot-Extended/i },\n  { name: 'Amazonbot', category: 'ai', pattern: /Amazonbot/i },\n  { name: 'Bytespider', category: 'ai', pattern: /Bytespider/i },\n  { name: 'CCBot', category: 'ai', pattern: /CCBot/i },\n  { name: 'Meta-ExternalAgent', category: 'ai', pattern: /Meta-ExternalAgent/i },\n  { name: 'cohere-ai', category: 'ai', pattern: /cohere-ai/i },\n  // Search crawlers\n  { name: 'Googlebot', category: 'search', pattern: /Googlebot/i },\n  { name: 'Bingbot', category: 'search', pattern: /bingbot/i },\n  { name: 'DuckDuckBot', category: 'search', pattern: /DuckDuckBot/i },\n  { name: 'YandexBot', category: 'search', pattern: /YandexBot/i },\n  { name: 'Baiduspider', category: 'search', pattern: /Baiduspider/i },\n  { name: 'Applebot', category: 'search', pattern: /Applebot/i },\n]\n\nexport interface DetectCrawlerOptions {\n  /** Override the signature table (e.g. to add private/first-party crawlers). */\n  signatures?: CrawlerSignature[]\n  /** Skip crawler detection entirely. */\n  disable?: boolean\n  /** Confidence reported on a UA match. Default 0.9 (UA is spoofable). */\n  confidence?: number\n}\n\n/**\n * Identify known AI/search crawlers by their User-Agent token. Returns `null`\n * when no signature matches or when there is no `navigator` (server-side).\n */\nexport const detectCrawler = (options: DetectCrawlerOptions = {}): AgentIdentity | null => {\n  const { signatures = CRAWLER_SIGNATURES, disable = false, confidence = 0.9 } = options\n  if (disable) return null\n  if (typeof navigator === 'undefined') return null\n\n  const ua = navigator.userAgent ?? ''\n  if (!ua) return null\n\n  for (const sig of signatures) {\n    if (sig.pattern.test(ua)) {\n      return {\n        class: 'crawler',\n        trust: 'detected',\n        confidence,\n        vendor: sig.name,\n        userAgent: ua,\n        detectionVersion: SDK_VERSION,\n        signals: { matched: sig.name, category: sig.category, ua },\n      }\n    }\n  }\n\n  return null\n}\n","/**\n * Server-side crawler identification + verification.\n *\n * A User-Agent claim is trivially spoofable, so on its own it only makes a\n * request \"claimed\". A claim becomes verified by forward-confirmed reverse DNS\n * (the IP's PTR name sits under the vendor's documented domain AND resolves\n * back to the same IP) — the method Google, Microsoft, Apple, Yandex, Baidu and\n * Amazon document for their crawlers. Needs Node DNS; on edge runtimes the\n * claim stays unverified (use Web Bot Auth, which works everywhere).\n */\nimport { CRAWLER_SIGNATURES, type CrawlerSignature } from '../detection/crawler.js'\n\n/** Vendors that document reverse-DNS verification, keyed by signature name. */\nexport const RDNS_DOMAINS: Record<string, string[]> = {\n  Googlebot: ['googlebot.com', 'google.com', 'googleusercontent.com'],\n  Bingbot: ['search.msn.com'],\n  Applebot: ['applebot.apple.com'],\n  'Applebot-Extended': ['applebot.apple.com'],\n  YandexBot: ['yandex.ru', 'yandex.net', 'yandex.com'],\n  Baiduspider: ['baidu.com', 'baidu.jp'],\n  Amazonbot: ['crawl.amazonbot.amazon'],\n}\n\nexport interface CrawlerClaim {\n  name: string\n  category: CrawlerSignature['category']\n}\n\nexport function classifyUserAgent(ua: string | null, signatures = CRAWLER_SIGNATURES): CrawlerClaim | null {\n  if (!ua) return null\n  const hit = signatures.find((s) => s.pattern.test(ua))\n  return hit ? { name: hit.name, category: hit.category } : null\n}\n\n/**\n * Where the real client IP comes from. Platform headers are set by the edge\n * and can't be spoofed by the caller; the leftmost X-Forwarded-For entry CAN,\n * so it's never used by default.\n */\nexport type ClientIpSource = 'auto' | 'cloudflare' | 'vercel' | ((request: Request) => string | null)\n\nexport function clientIp(request: Request, source: ClientIpSource = 'auto'): string | null {\n  if (typeof source === 'function') return source(request)\n  const h = request.headers\n  if (source === 'cloudflare') return h.get('cf-connecting-ip')\n  if (source === 'vercel') return h.get('x-real-ip') ?? h.get('x-vercel-forwarded-for')\n  return h.get('cf-connecting-ip') ?? h.get('x-real-ip') ?? h.get('x-vercel-forwarded-for')\n}\n\nexport interface DnsResolver {\n  reverse(ip: string): Promise<string[]>\n  lookup(host: string): Promise<string[]>\n}\n\n/** The two node:dns/promises calls we use — typed locally so edge builds need no @types/node. */\ninterface NodeDnsPromises {\n  reverse(ip: string): Promise<string[]>\n  lookup(host: string, opts: { all: true }): Promise<Array<{ address: string; family: number }>>\n}\n\nasync function nodeResolver(): Promise<DnsResolver | null> {\n  try {\n    const dns = (await import(/* webpackIgnore: true */ /* @vite-ignore */ 'node:dns/promises' as string)) as NodeDnsPromises\n    return {\n      reverse: (ip) => dns.reverse(ip),\n      lookup: async (host) => (await dns.lookup(host, { all: true })).map((a) => a.address),\n    }\n  } catch {\n    return null\n  }\n}\n\nconst rdnsCache = new Map<string, { ok: boolean; host?: string; until: number }>()\nexport const __clearRdnsCache = () => rdnsCache.clear()\n\nexport type CrawlerVerification =\n  | { status: 'verified'; name: string; host: string; ip: string }\n  | { status: 'unverified'; name: string; reason: string }\n\nexport async function verifyCrawler(\n  claim: CrawlerClaim,\n  ip: string | null,\n  resolver?: DnsResolver\n): Promise<CrawlerVerification> {\n  const domains = RDNS_DOMAINS[claim.name]\n  if (!domains) return { status: 'unverified', name: claim.name, reason: 'no_rdns_method_for_vendor' }\n  if (!ip) return { status: 'unverified', name: claim.name, reason: 'client_ip_unknown' }\n\n  const key = `${claim.name}|${ip}`\n  const hit = rdnsCache.get(key)\n  if (hit && hit.until > Date.now()) {\n    return hit.ok\n      ? { status: 'verified', name: claim.name, host: hit.host!, ip }\n      : { status: 'unverified', name: claim.name, reason: 'rdns_mismatch' }\n  }\n\n  const dns = resolver ?? (await nodeResolver())\n  if (!dns) return { status: 'unverified', name: claim.name, reason: 'dns_unavailable_in_runtime' }\n\n  const remember = (ok: boolean, host?: string) => {\n    if (rdnsCache.size > 5000) rdnsCache.delete(rdnsCache.keys().next().value as string)\n    rdnsCache.set(key, { ok, ...(host ? { host } : {}), until: Date.now() + (ok ? 3600_000 : 600_000) })\n  }\n  try {\n    const names = await dns.reverse(ip)\n    for (const name of names) {\n      const host = name.toLowerCase().replace(/\\.$/, '')\n      if (!domains.some((d) => host === d || host.endsWith(`.${d}`))) continue\n      const forward = await dns.lookup(host)\n      if (forward.includes(ip)) {\n        remember(true, host)\n        return { status: 'verified', name: claim.name, host, ip }\n      }\n    }\n    remember(false)\n    return { status: 'unverified', name: claim.name, reason: 'rdns_mismatch' }\n  } catch {\n    return { status: 'unverified', name: claim.name, reason: 'rdns_lookup_failed' }\n  }\n}\n","/**\n * Structured Field Values for HTTP (RFC 9651) — the subset HTTP Message\n * Signatures (RFC 9421) and Web Bot Auth need: Dictionaries, Inner Lists,\n * Items, Parameters; bare items of type Integer, Decimal, String, Token,\n * Byte Sequence and Boolean. Parsing is strict (invalid input throws), and\n * serialization is canonical, which RFC 9421 relies on for `@signature-params`.\n */\n\nexport class SfToken {\n  constructor(readonly value: string) {}\n}\nexport class SfDecimal {\n  constructor(readonly value: number) {}\n}\nexport type BareItem = string | number | boolean | Uint8Array | SfToken | SfDecimal\nexport type Params = Array<[string, BareItem]>\nexport interface Item {\n  value: BareItem\n  params: Params\n}\nexport interface InnerList {\n  items: Item[]\n  params: Params\n}\nexport type Member = Item | InnerList\nexport type Dictionary = Map<string, Member>\n\nexport const isInnerList = (m: Member): m is InnerList => 'items' in m\n\nexport class SfParseError extends Error {}\n\nclass Parser {\n  i = 0\n  constructor(private readonly s: string) {}\n  get done() {\n    return this.i >= this.s.length\n  }\n  peek() {\n    return this.s[this.i] ?? ''\n  }\n  fail(what: string): never {\n    throw new SfParseError(`${what} at ${this.i}`)\n  }\n  sp() {\n    while (this.peek() === ' ') this.i++\n  }\n  ows() {\n    while (this.peek() === ' ' || this.peek() === '\\t') this.i++\n  }\n\n  key(): string {\n    const c = this.peek()\n    if (!/[a-z*]/.test(c)) this.fail('invalid key')\n    let out = ''\n    while (/[a-z0-9_\\-.*]/.test(this.peek())) out += this.s[this.i++]\n    return out\n  }\n\n  params(): Params {\n    const out: Params = []\n    while (this.peek() === ';') {\n      this.i++\n      this.sp()\n      const k = this.key()\n      let v: BareItem = true\n      if (this.peek() === '=') {\n        this.i++\n        v = this.bareItem()\n      }\n      const existing = out.findIndex(([ek]) => ek === k)\n      if (existing >= 0) out[existing] = [k, v]\n      else out.push([k, v])\n    }\n    return out\n  }\n\n  bareItem(): BareItem {\n    const c = this.peek()\n    if (c === '-' || /[0-9]/.test(c)) return this.number()\n    if (c === '\"') return this.string()\n    if (c === ':') return this.bytes()\n    if (c === '?') return this.boolean()\n    if (/[A-Za-z*]/.test(c)) return this.token()\n    return this.fail('invalid bare item')\n  }\n\n  number(): number | SfDecimal {\n    let sign = 1\n    if (this.peek() === '-') {\n      sign = -1\n      this.i++\n    }\n    let num = ''\n    let isDecimal = false\n    while (!this.done) {\n      const c = this.peek()\n      if (/[0-9]/.test(c)) num += c\n      else if (c === '.' && !isDecimal) {\n        if (num.length > 12) this.fail('decimal integer part too long')\n        isDecimal = true\n        num += c\n      } else break\n      this.i++\n      if (!isDecimal && num.length > 15) this.fail('integer too long')\n      if (isDecimal && num.length > 16) this.fail('decimal too long')\n    }\n    if (!/[0-9]/.test(num[0] ?? '')) this.fail('invalid number')\n    if (isDecimal) {\n      if (num.endsWith('.')) this.fail('decimal ends with dot')\n      if (num.split('.')[1]!.length > 3) this.fail('decimal fraction too long')\n      return new SfDecimal(sign * Number(num))\n    }\n    return sign * Number(num)\n  }\n\n  string(): string {\n    this.i++ // opening quote\n    let out = ''\n    while (!this.done) {\n      const c = this.s[this.i++]!\n      if (c === '\\\\') {\n        const n = this.s[this.i++]\n        if (n !== '\"' && n !== '\\\\') this.fail('invalid escape')\n        out += n\n      } else if (c === '\"') return out\n      else {\n        const code = c.charCodeAt(0)\n        if (code < 0x20 || code > 0x7e) this.fail('invalid string char')\n        out += c\n      }\n    }\n    return this.fail('unterminated string')\n  }\n\n  token(): SfToken {\n    let out = ''\n    while (/[A-Za-z0-9!#$%&'*+\\-.^_`|~:/]/.test(this.peek()) && !this.done) out += this.s[this.i++]\n    return new SfToken(out)\n  }\n\n  bytes(): Uint8Array {\n    this.i++\n    const end = this.s.indexOf(':', this.i)\n    if (end < 0) this.fail('unterminated byte sequence')\n    const b64 = this.s.slice(this.i, end)\n    if (!/^[A-Za-z0-9+/=]*$/.test(b64)) this.fail('invalid base64')\n    this.i = end + 1\n    return base64ToBytes(b64)\n  }\n\n  boolean(): boolean {\n    this.i++\n    const c = this.s[this.i++]\n    if (c === '1') return true\n    if (c === '0') return false\n    return this.fail('invalid boolean')\n  }\n\n  item(): Item {\n    const value = this.bareItem()\n    return { value, params: this.params() }\n  }\n\n  innerList(): InnerList {\n    this.i++ // (\n    const items: Item[] = []\n    while (!this.done) {\n      this.sp()\n      if (this.peek() === ')') {\n        this.i++\n        return { items, params: this.params() }\n      }\n      items.push(this.item())\n      const c = this.peek()\n      if (c !== ' ' && c !== ')') this.fail('invalid inner list')\n    }\n    return this.fail('unterminated inner list')\n  }\n\n  member(): Member {\n    return this.peek() === '(' ? this.innerList() : this.item()\n  }\n\n  dictionary(): Dictionary {\n    const out: Dictionary = new Map()\n    this.sp()\n    while (!this.done) {\n      const k = this.key()\n      let m: Member\n      if (this.peek() === '=') {\n        this.i++\n        m = this.member()\n      } else {\n        m = { value: true, params: this.params() }\n      }\n      out.set(k, m)\n      this.ows()\n      if (this.done) return out\n      if (this.peek() !== ',') this.fail('expected comma')\n      this.i++\n      this.ows()\n      if (this.done) this.fail('trailing comma')\n    }\n    return out\n  }\n}\n\nfunction parseTop<T>(input: string, fn: (p: Parser) => T): T {\n  const p = new Parser(input.trim())\n  const out = fn(p)\n  p.sp()\n  if (!p.done) p.fail('trailing characters')\n  return out\n}\n\nexport const parseDictionary = (input: string) => parseTop(input, (p) => p.dictionary())\nexport const parseItem = (input: string) => parseTop(input, (p) => p.item())\n\n// ---- serialization ------------------------------------------------------\n\nexport function serializeBareItem(v: BareItem): string {\n  if (typeof v === 'boolean') return v ? '?1' : '?0'\n  if (typeof v === 'number') {\n    if (!Number.isInteger(v)) throw new SfParseError('non-integer number; use SfDecimal')\n    return String(v)\n  }\n  if (v instanceof SfDecimal) {\n    const s = (Math.round(v.value * 1000) / 1000).toString()\n    return s.includes('.') ? s : `${s}.0`\n  }\n  if (v instanceof SfToken) return v.value\n  if (v instanceof Uint8Array) return `:${bytesToBase64(v)}:`\n  return `\"${v.replace(/\\\\/g, '\\\\\\\\').replace(/\"/g, '\\\\\"')}\"`\n}\n\nexport const serializeParams = (params: Params) =>\n  params.map(([k, v]) => (v === true ? `;${k}` : `;${k}=${serializeBareItem(v)}`)).join('')\n\nexport const serializeItem = (item: Item) => serializeBareItem(item.value) + serializeParams(item.params)\n\nexport const serializeInnerList = (list: InnerList) =>\n  `(${list.items.map(serializeItem).join(' ')})${serializeParams(list.params)}`\n\nexport const serializeMember = (m: Member) => (isInnerList(m) ? serializeInnerList(m) : serializeItem(m))\n\nexport const serializeDictionary = (d: Dictionary) =>\n  [...d.entries()]\n    .map(([k, m]) =>\n      !isInnerList(m) && m.value === true ? `${k}${serializeParams(m.params)}` : `${k}=${serializeMember(m)}`\n    )\n    .join(', ')\n\nexport const getParam = (params: Params, key: string): BareItem | undefined =>\n  params.find(([k]) => k === key)?.[1]\n\n// ---- base64 helpers (runtime-neutral: browser, edge, node) --------------\n\nexport function base64ToBytes(b64: string): Uint8Array {\n  const bin = atob(b64)\n  const out = new Uint8Array(bin.length)\n  for (let i = 0; i < bin.length; i++) out[i] = bin.charCodeAt(i)\n  return out\n}\n\nexport function bytesToBase64(bytes: Uint8Array): string {\n  let bin = ''\n  for (const b of bytes) bin += String.fromCharCode(b)\n  return btoa(bin)\n}\n\nexport const bytesToBase64Url = (bytes: Uint8Array) =>\n  bytesToBase64(bytes).replace(/\\+/g, '-').replace(/\\//g, '_').replace(/=+$/, '')\n","/**\n * HTTP Message Signatures (RFC 9421) — request verification only.\n * Runtime-neutral: WebCrypto + Fetch `Request`, so it runs on Node ≥ 20,\n * Vercel/Next edge middleware, Cloudflare Workers, Deno and Bun.\n */\nimport {\n  type InnerList,\n  type Item,\n  SfParseError,\n  bytesToBase64Url,\n  getParam,\n  isInnerList,\n  parseDictionary,\n  serializeInnerList,\n  serializeItem,\n  serializeMember,\n} from './structuredFields.js'\n\nexport class SignatureError extends Error {\n  constructor(\n    readonly code: string,\n    message?: string\n  ) {\n    super(message ?? code)\n  }\n}\n\nexport interface ComponentContext {\n  request: Request\n  url: URL\n  /** Override for `@authority` (e.g. when a proxy rewrites Host). */\n  authority?: string\n}\n\nconst DERIVED = new Set([\n  '@method',\n  '@target-uri',\n  '@authority',\n  '@scheme',\n  '@request-target',\n  '@path',\n  '@query',\n  '@query-param',\n])\n\n/** Value of one covered component, per RFC 9421 §2.1 / §2.2. */\nexport function componentValue(id: Item, ctx: ComponentContext): string {\n  if (typeof id.value !== 'string') throw new SignatureError('invalid_component', 'component id must be a string')\n  const name = id.value\n  const { url } = ctx\n\n  if (name.startsWith('@')) {\n    if (!DERIVED.has(name)) throw new SignatureError('unsupported_component', name)\n    switch (name) {\n      case '@method':\n        return ctx.request.method.toUpperCase()\n      case '@target-uri':\n        return url.href\n      case '@authority':\n        return (ctx.authority ?? url.host).toLowerCase()\n      case '@scheme':\n        return url.protocol.replace(/:$/, '').toLowerCase()\n      case '@request-target':\n        return url.pathname + url.search\n      case '@path':\n        return url.pathname || '/'\n      case '@query':\n        return url.search || '?'\n      case '@query-param': {\n        const pname = getParam(id.params, 'name')\n        if (typeof pname !== 'string') throw new SignatureError('invalid_component', '@query-param needs name')\n        const values = url.searchParams.getAll(pname)\n        if (values.length !== 1) throw new SignatureError('invalid_component', `@query-param ${pname}`)\n        return encodeURIComponent(values[0]!)\n      }\n    }\n  }\n\n  // HTTP field component\n  // Only `;key` (dictionary member) is supported. `;sf` needs the field's\n  // structured type (not knowable generically); `;bs`, `;req`, `;tr` don't\n  // apply to Web Bot Auth. Reject rather than guess.\n  for (const [k] of id.params) {\n    if (k !== 'key') throw new SignatureError('unsupported_component', `param ${k}`)\n  }\n  const raw = ctx.request.headers.get(name)\n  if (raw === null) throw new SignatureError('missing_component', name)\n  const value = raw.trim()\n\n  const key = getParam(id.params, 'key')\n  if (typeof key === 'string') {\n    let dict\n    try {\n      dict = parseDictionary(value)\n    } catch (e) {\n      throw new SignatureError('invalid_component', `${name} is not a dictionary: ${(e as Error).message}`)\n    }\n    const member = dict.get(key)\n    if (!member) throw new SignatureError('missing_component', `${name};key=${key}`)\n    return serializeMember(member)\n  }\n  return value\n}\n\n/** Build the signature base (RFC 9421 §2.5) for one Signature-Input member. */\nexport function signatureBase(input: InnerList, ctx: ComponentContext): string {\n  const seen = new Set<string>()\n  const lines: string[] = []\n  for (const id of input.items) {\n    const ident = serializeItem(id)\n    if (seen.has(ident)) throw new SignatureError('duplicate_component', ident)\n    seen.add(ident)\n    lines.push(`${ident}: ${componentValue(id, ctx)}`)\n  }\n  lines.push(`\"@signature-params\": ${serializeInnerList(input)}`)\n  return lines.join('\\n')\n}\n\n// ---- keys + algorithms ----------------------------------------------------\n\nexport interface PublicJwk {\n  kty: string\n  crv?: string\n  x?: string\n  y?: string\n  n?: string\n  e?: string\n  kid?: string\n  alg?: string\n  use?: string\n  nbf?: number\n  exp?: number\n}\n\nexport type SignatureAlgorithm =\n  | 'ed25519'\n  | 'rsa-pss-sha512'\n  | 'rsa-v1_5-sha256'\n  | 'ecdsa-p256-sha256'\n  | 'ecdsa-p384-sha384'\n\nconst ALGS: Record<\n  SignatureAlgorithm,\n  { kty: string; crv?: string; importAlg: Parameters<SubtleCrypto['importKey']>[2]; verifyAlg: Parameters<SubtleCrypto['verify']>[0] }\n> = {\n  ed25519: { kty: 'OKP', crv: 'Ed25519', importAlg: { name: 'Ed25519' }, verifyAlg: { name: 'Ed25519' } },\n  'rsa-pss-sha512': {\n    kty: 'RSA',\n    importAlg: { name: 'RSA-PSS', hash: 'SHA-512' },\n    verifyAlg: { name: 'RSA-PSS', saltLength: 64 },\n  },\n  'rsa-v1_5-sha256': {\n    kty: 'RSA',\n    importAlg: { name: 'RSASSA-PKCS1-v1_5', hash: 'SHA-256' },\n    verifyAlg: { name: 'RSASSA-PKCS1-v1_5' },\n  },\n  'ecdsa-p256-sha256': {\n    kty: 'EC',\n    crv: 'P-256',\n    importAlg: { name: 'ECDSA', namedCurve: 'P-256' },\n    verifyAlg: { name: 'ECDSA', hash: 'SHA-256' },\n  },\n  'ecdsa-p384-sha384': {\n    kty: 'EC',\n    crv: 'P-384',\n    importAlg: { name: 'ECDSA', namedCurve: 'P-384' },\n    verifyAlg: { name: 'ECDSA', hash: 'SHA-384' },\n  },\n}\n\n/** Pick the algorithm: the `alg` parameter if present (must fit the key), else infer from the key. */\nexport function resolveAlgorithm(jwk: PublicJwk, algParam: unknown): SignatureAlgorithm {\n  if (typeof algParam === 'string') {\n    const spec = ALGS[algParam as SignatureAlgorithm]\n    if (!spec) throw new SignatureError('unsupported_alg', algParam)\n    if (spec.kty !== jwk.kty || (spec.crv && spec.crv !== jwk.crv)) {\n      throw new SignatureError('alg_key_mismatch', `${algParam} vs ${jwk.kty}/${jwk.crv ?? ''}`)\n    }\n    return algParam as SignatureAlgorithm\n  }\n  if (jwk.kty === 'OKP' && jwk.crv === 'Ed25519') return 'ed25519'\n  if (jwk.kty === 'EC' && jwk.crv === 'P-256') return 'ecdsa-p256-sha256'\n  if (jwk.kty === 'EC' && jwk.crv === 'P-384') return 'ecdsa-p384-sha384'\n  // RSA is ambiguous (PSS vs v1.5) — require an explicit alg.\n  throw new SignatureError('alg_required', `cannot infer algorithm for ${jwk.kty}`)\n}\n\nexport async function verifySignature(\n  alg: SignatureAlgorithm,\n  jwk: PublicJwk,\n  base: string,\n  signature: Uint8Array\n): Promise<boolean> {\n  const spec = ALGS[alg]\n  const { kid: _kid, alg: _alg, use: _use, nbf: _nbf, exp: _exp, ...material } = jwk\n  let key: CryptoKey\n  try {\n    key = await crypto.subtle.importKey('jwk', material as JsonWebKey, spec.importAlg, false, ['verify'])\n  } catch (e) {\n    throw new SignatureError('invalid_key', (e as Error).message)\n  }\n  // copy into a fresh ArrayBuffer-backed view (WebCrypto rejects SharedArrayBuffer views)\n  return crypto.subtle.verify(spec.verifyAlg, key, new Uint8Array(signature), new TextEncoder().encode(base))\n}\n\n/** JWK SHA-256 thumbprint, base64url (RFC 7638; RFC 8037 §A.3 for OKP). */\nexport async function jwkThumbprint(jwk: PublicJwk): Promise<string> {\n  let canonical: string\n  if (jwk.kty === 'OKP') canonical = JSON.stringify({ crv: jwk.crv, kty: jwk.kty, x: jwk.x })\n  else if (jwk.kty === 'EC') canonical = JSON.stringify({ crv: jwk.crv, kty: jwk.kty, x: jwk.x, y: jwk.y })\n  else if (jwk.kty === 'RSA') canonical = JSON.stringify({ e: jwk.e, kty: jwk.kty, n: jwk.n })\n  else throw new SignatureError('invalid_key', `unsupported kty ${jwk.kty}`)\n  const digest = await crypto.subtle.digest('SHA-256', new TextEncoder().encode(canonical))\n  return bytesToBase64Url(new Uint8Array(digest))\n}\n\nexport { SfParseError, isInnerList }\n","/**\n * SSRF-guarded fetch for attacker-supplied URLs (the Web Bot Auth\n * `Signature-Agent` value comes from an untrusted request header).\n *\n * Guards: HTTPS on port 443 only, no credentials in the URL, no IP-literal or\n * internal hostnames (localhost, *.local, *.internal, *.home.arpa, private /\n * loopback / link-local / CGNAT / multicast ranges), no redirects (spec:\n * non-200 is a discovery failure), a timeout, and a response size cap.\n *\n * On Node, `resolveDns: true` also resolves the hostname and rejects private\n * addresses. Residual risk: DNS rebinding between that check and the fetch —\n * restrict `allowedDirectories` to known signers if that matters to you.\n */\n\nexport class UnsafeUrlError extends Error {}\n\nconst BLOCKED_SUFFIXES = ['.localhost', '.local', '.internal', '.home.arpa', '.lan', '.corp', '.intranet']\n\nexport function isPrivateIpv4(ip: string): boolean {\n  const m = ip.match(/^(\\d{1,3})\\.(\\d{1,3})\\.(\\d{1,3})\\.(\\d{1,3})$/)\n  if (!m) return false\n  const [a, b] = [Number(m[1]), Number(m[2])]\n  return (\n    a === 0 ||\n    a === 10 ||\n    a === 127 ||\n    (a === 100 && b >= 64 && b <= 127) || // CGNAT\n    (a === 169 && b === 254) || // link-local / cloud metadata\n    (a === 172 && b >= 16 && b <= 31) ||\n    (a === 192 && b === 168) ||\n    (a === 192 && b === 0) ||\n    (a === 198 && (b === 18 || b === 19)) ||\n    a >= 224 // multicast + reserved\n  )\n}\n\nexport function isPrivateIpv6(ip: string): boolean {\n  const s = ip.toLowerCase().replace(/^\\[|\\]$/g, '')\n  if (s === '::' || s === '::1') return true\n  const mapped = s.match(/^::ffff:(\\d+\\.\\d+\\.\\d+\\.\\d+)$/)\n  if (mapped) return isPrivateIpv4(mapped[1]!)\n  return /^(fc|fd|fe8|fe9|fea|feb|ff)/.test(s) // ULA, link-local, multicast\n}\n\nconst isIpLiteral = (host: string) => /^\\d+\\.\\d+\\.\\d+\\.\\d+$/.test(host) || host.includes(':') || host.startsWith('[')\n\n/** Throws UnsafeUrlError unless `raw` is a safe public HTTPS URL. */\nexport function assertSafeUrl(raw: string): URL {\n  let url: URL\n  try {\n    url = new URL(raw)\n  } catch {\n    throw new UnsafeUrlError('invalid URL')\n  }\n  if (url.protocol !== 'https:') throw new UnsafeUrlError('HTTPS required')\n  if (url.username || url.password) throw new UnsafeUrlError('credentials in URL')\n  if (url.port && url.port !== '443') throw new UnsafeUrlError('non-standard port')\n  const host = url.hostname.toLowerCase()\n  if (isIpLiteral(host)) throw new UnsafeUrlError('IP-literal hosts are not allowed')\n  if (host === 'localhost' || !host.includes('.') || BLOCKED_SUFFIXES.some((s) => host.endsWith(s))) {\n    throw new UnsafeUrlError('internal hostname')\n  }\n  return url\n}\n\nexport interface SafeFetchOptions {\n  fetch?: typeof fetch\n  timeoutMs?: number\n  maxBytes?: number\n  accept?: string\n  /** Node only: resolve the host and reject private addresses before fetching. */\n  resolveDns?: boolean\n}\n\nexport interface SafeFetchResult {\n  status: number\n  headers: Headers\n  body: string\n}\n\ninterface NodeDnsLookup {\n  lookup(host: string, opts: { all: true }): Promise<Array<{ address: string; family: number }>>\n}\n\nasync function assertPublicDns(host: string): Promise<void> {\n  let dns: NodeDnsLookup\n  try {\n    dns = (await import(/* webpackIgnore: true */ /* @vite-ignore */ 'node:dns/promises' as string)) as NodeDnsLookup\n  } catch {\n    return // not on Node (edge/workers) — hostname checks only\n  }\n  const addrs = await dns.lookup(host, { all: true }).catch(() => {\n    throw new UnsafeUrlError('DNS lookup failed')\n  })\n  for (const { address, family } of addrs) {\n    if (family === 4 ? isPrivateIpv4(address) : isPrivateIpv6(address)) {\n      throw new UnsafeUrlError('host resolves to a private address')\n    }\n  }\n}\n\nexport async function safeFetch(raw: string, opts: SafeFetchOptions = {}): Promise<SafeFetchResult> {\n  const url = assertSafeUrl(raw)\n  if (opts.resolveDns) await assertPublicDns(url.hostname)\n  const doFetch = opts.fetch ?? fetch\n  const res = await doFetch(url.href, {\n    method: 'GET',\n    redirect: 'manual',\n    headers: { accept: opts.accept ?? 'application/json' },\n    signal: AbortSignal.timeout(opts.timeoutMs ?? 3000),\n  })\n  const maxBytes = opts.maxBytes ?? 64 * 1024\n  const declared = Number(res.headers.get('content-length') ?? 0)\n  if (declared > maxBytes) throw new UnsafeUrlError('response too large')\n  // Read with a hard cap (content-length can lie or be absent).\n  const reader = res.body?.getReader()\n  const chunks: Uint8Array[] = []\n  let total = 0\n  if (reader) {\n    for (;;) {\n      const { done, value } = await reader.read()\n      if (done) break\n      total += value.byteLength\n      if (total > maxBytes) {\n        await reader.cancel().catch(() => undefined)\n        throw new UnsafeUrlError('response too large')\n      }\n      chunks.push(value)\n    }\n  }\n  const body = new Uint8Array(total)\n  let o = 0\n  for (const c of chunks) {\n    body.set(c, o)\n    o += c.byteLength\n  }\n  return { status: res.status, headers: res.headers, body: new TextDecoder().decode(body) }\n}\n","/**\n * Web Bot Auth verifier — draft-meunier-webbotauth-httpsig-protocol-02.\n *\n * A signed agent request carries:\n *   Signature-Agent: agent2=\"https://signer.example\"        (dictionary form)\n *   Signature-Input: sig2=(\"@authority\" \"signature-agent\";key=\"agent2\");\n *                    created=…;expires=…;keyid=\"<JWK thumbprint>\";tag=\"web-bot-auth\"\n *   Signature:       sig2=:<base64>:\n * The verifier resolves the signer's key directory\n * (<origin>/.well-known/http-message-signatures-directory by default), picks\n * the key whose JWK thumbprint equals `keyid`, rebuilds the RFC 9421 signature\n * base, and verifies it. Cheap checks run before any network call.\n */\nimport {\n  SignatureError,\n  jwkThumbprint,\n  resolveAlgorithm,\n  signatureBase,\n  verifySignature,\n  type PublicJwk,\n  type SignatureAlgorithm,\n} from './httpSignatures.js'\nimport { safeFetch } from './safeFetch.js'\nimport {\n  type InnerList,\n  type Item,\n  getParam,\n  isInnerList,\n  parseDictionary,\n  parseItem,\n  SfToken,\n} from './structuredFields.js'\n\nexport const WEB_BOT_AUTH_TAG = 'web-bot-auth'\nexport const DIRECTORY_PATH = '/.well-known/http-message-signatures-directory'\nexport const DIRECTORY_MEDIA_TYPE = 'application/http-message-signatures-directory+json'\n\nexport interface ReplayCache {\n  has(key: string): boolean | Promise<boolean>\n  add(key: string, ttlSeconds: number): void | Promise<void>\n}\n\n/** Bounded in-memory replay cache. Use a shared store (Redis…) across instances. */\nexport function memoryReplayCache(maxEntries = 10_000): ReplayCache {\n  const m = new Map<string, number>()\n  return {\n    has(key) {\n      const exp = m.get(key)\n      if (exp === undefined) return false\n      if (exp < Date.now()) {\n        m.delete(key)\n        return false\n      }\n      return true\n    },\n    add(key, ttl) {\n      if (m.size >= maxEntries) m.delete(m.keys().next().value as string)\n      m.set(key, Date.now() + ttl * 1000)\n    },\n  }\n}\n\nexport interface WebBotAuthOptions {\n  /**\n   * Which signers may be resolved. `'any'` (default) accepts any public HTTPS\n   * signer behind SSRF guards; a list restricts to those origins/URLs.\n   */\n  allowedDirectories?: 'any' | string[]\n  /** Accepted clock drift in seconds. Default 60. */\n  clockSkewSec?: number\n  /** Max `expires - created`, seconds. Default 86400 (spec: ≤ 24 h recommended). */\n  maxValiditySec?: number\n  /** Reject signatures without a `nonce`. Default false. */\n  requireNonce?: boolean\n  replayCache?: ReplayCache\n  /** Override `@authority` when a proxy rewrites Host. */\n  authority?: (request: Request, url: URL) => string\n  /** Node only: DNS-check directory hosts for private addresses. Default true. */\n  resolveDns?: boolean\n  /** Test seams. */\n  fetch?: typeof fetch\n  now?: () => number\n}\n\nexport type WebBotAuthResult =\n  | { status: 'absent' }\n  | {\n      status: 'verified'\n      /** Stable identity: the signer URL (directory origin or JWKS URL). */\n      agentUrl: string\n      keyid: string\n      label: string\n      alg: SignatureAlgorithm\n      created: number\n      expires: number\n    }\n  | { status: 'invalid'; reason: string; agentUrl?: string; keyid?: string }\n\n// ---- key directory cache ---------------------------------------------------\n\ninterface CachedDirectory {\n  keys: PublicJwk[]\n  thumbprints: string[]\n  until: number\n}\nconst directoryCache = new Map<string, CachedDirectory | { failedUntil: number }>()\nconst MAX_CACHED = 256\nconst NEGATIVE_TTL = 5 * 60 * 1000\n\nexport const __clearDirectoryCache = () => directoryCache.clear()\n\nfunction cacheTtlMs(headers: Headers): number {\n  const cc = headers.get('cache-control') ?? ''\n  const m = cc.match(/max-age=(\\d+)/i)\n  const secs = m ? Number(m[1]) : 3600\n  return Math.min(Math.max(secs, 60), 86_400) * 1000\n}\n\nasync function loadDirectory(url: string, opts: WebBotAuthOptions): Promise<CachedDirectory> {\n  const cached = directoryCache.get(url)\n  if (cached && 'failedUntil' in cached && cached.failedUntil > Date.now()) {\n    throw new SignatureError('discovery_failed', 'recent discovery failure (cached)')\n  }\n  if (cached && 'keys' in cached && cached.until > Date.now()) return cached\n\n  try {\n    const res = await safeFetch(url, {\n      ...(opts.fetch ? { fetch: opts.fetch } : {}),\n      accept: `${DIRECTORY_MEDIA_TYPE}, application/jwk-set+json, application/json`,\n      resolveDns: opts.resolveDns ?? true,\n    })\n    if (res.status !== 200) throw new SignatureError('discovery_failed', `directory returned ${res.status}`)\n    let doc: unknown\n    try {\n      doc = JSON.parse(res.body)\n    } catch {\n      throw new SignatureError('discovery_failed', 'directory is not JSON')\n    }\n    const raw = (doc as { keys?: unknown }).keys\n    if (!Array.isArray(raw)) throw new SignatureError('discovery_failed', 'directory has no keys array')\n    const now = (opts.now?.() ?? Date.now() / 1000)\n    const keys = raw.filter(\n      (k): k is PublicJwk =>\n        typeof k === 'object' &&\n        k !== null &&\n        typeof (k as PublicJwk).kty === 'string' &&\n        ((k as PublicJwk).nbf === undefined || (k as PublicJwk).nbf! <= now) &&\n        ((k as PublicJwk).exp === undefined || (k as PublicJwk).exp! > now)\n    )\n    const thumbprints = await Promise.all(keys.map((k) => jwkThumbprint(k).catch(() => '')))\n    const entry = { keys, thumbprints, until: Date.now() + cacheTtlMs(res.headers) }\n    if (directoryCache.size >= MAX_CACHED) directoryCache.delete(directoryCache.keys().next().value as string)\n    directoryCache.set(url, entry)\n    return entry\n  } catch (e) {\n    directoryCache.set(url, { failedUntil: Date.now() + NEGATIVE_TTL })\n    if (e instanceof SignatureError) throw e\n    throw new SignatureError('discovery_failed', (e as Error).message)\n  }\n}\n\nfunction directoryUrlFor(member: Item): { signer: string; directoryUrl: string } {\n  if (typeof member.value !== 'string') throw new SignatureError('invalid_signature_agent', 'must be a string')\n  let url: URL\n  try {\n    url = new URL(member.value)\n  } catch {\n    throw new SignatureError('invalid_signature_agent', 'not a URL')\n  }\n  if (url.protocol !== 'https:') throw new SignatureError('invalid_signature_agent', 'HTTPS required')\n  const typeParam = getParam(member.params, 'type')\n  const type = typeParam instanceof SfToken ? typeParam.value : typeof typeParam === 'string' ? typeParam : 'directory'\n  if (type === 'directory') return { signer: url.origin, directoryUrl: url.origin + DIRECTORY_PATH }\n  if (type === 'jwks_uri') return { signer: url.href, directoryUrl: url.href }\n  throw new SignatureError('unsupported_signature_agent_type', type)\n}\n\nfunction isAllowed(signer: string, allowed: WebBotAuthOptions['allowedDirectories']): boolean {\n  if (!allowed || allowed === 'any') return true\n  return allowed.some((a) => {\n    try {\n      const u = new URL(a)\n      return u.origin === signer || u.href === signer || new URL(signer).origin === u.origin\n    } catch {\n      return false\n    }\n  })\n}\n\n// ---- verification ------------------------------------------------------------\n\nexport async function verifyWebBotAuth(request: Request, opts: WebBotAuthOptions = {}): Promise<WebBotAuthResult> {\n  const sigHeader = request.headers.get('signature')\n  const inputHeader = request.headers.get('signature-input')\n  if (!sigHeader && !inputHeader) return { status: 'absent' }\n  if (!sigHeader || !inputHeader) return { status: 'invalid', reason: 'signature_headers_incomplete' }\n\n  let inputs, sigs\n  try {\n    inputs = parseDictionary(inputHeader)\n    sigs = parseDictionary(sigHeader)\n  } catch (e) {\n    return { status: 'invalid', reason: `malformed_signature_headers: ${(e as Error).message}` }\n  }\n\n  // Only signatures tagged web-bot-auth are ours; others (e.g. unrelated\n  // HTTP signatures) are ignored, not failed.\n  const candidates = [...inputs.entries()].filter(\n    ([, m]) => isInnerList(m) && getParam(m.params, 'tag') === WEB_BOT_AUTH_TAG\n  ) as Array<[string, InnerList]>\n  if (candidates.length === 0) return { status: 'absent' }\n\n  let lastFailure: WebBotAuthResult = { status: 'invalid', reason: 'no_valid_signature' }\n  for (const [label, input] of candidates) {\n    const r = await verifyOne(request, label, input, sigs.get(label), opts)\n    if (r.status === 'verified') return r\n    lastFailure = r\n  }\n  return lastFailure\n}\n\nasync function verifyOne(\n  request: Request,\n  label: string,\n  input: InnerList,\n  sigMember: ReturnType<ReturnType<typeof parseDictionary>['get']>,\n  opts: WebBotAuthOptions\n): Promise<WebBotAuthResult> {\n  const fail = (reason: string, extra: { agentUrl?: string; keyid?: string } = {}): WebBotAuthResult => ({\n    status: 'invalid',\n    reason,\n    ...extra,\n  })\n  if (!sigMember || isInnerList(sigMember) || !(sigMember.value instanceof Uint8Array)) {\n    return fail('signature_missing_for_label')\n  }\n  const signature = sigMember.value\n\n  // 1. required parameters\n  const created = getParam(input.params, 'created')\n  const expires = getParam(input.params, 'expires')\n  const keyid = getParam(input.params, 'keyid')\n  const nonce = getParam(input.params, 'nonce')\n  if (typeof created !== 'number' || typeof expires !== 'number') return fail('created_and_expires_required')\n  if (typeof keyid !== 'string') return fail('keyid_required')\n  if (nonce !== undefined && typeof nonce !== 'string') return fail('invalid_nonce')\n  if (opts.requireNonce && nonce === undefined) return fail('nonce_required', { keyid })\n\n  // 2. time window\n  const now = Math.floor(opts.now?.() ?? Date.now() / 1000)\n  const skew = opts.clockSkewSec ?? 60\n  if (created > now + skew) return fail('created_in_future', { keyid })\n  if (expires < now - skew) return fail('expired', { keyid })\n  if (expires <= created) return fail('expires_before_created', { keyid })\n  if (expires - created > (opts.maxValiditySec ?? 86_400)) return fail('validity_window_too_long', { keyid })\n\n  // 3. covered components: @authority or @target-uri, plus signature-agent\n  const names = input.items.map((i) => i.value)\n  if (!names.includes('@authority') && !names.includes('@target-uri')) {\n    return fail('authority_or_target_uri_not_covered', { keyid })\n  }\n  const agentComponent = input.items.find((i) => i.value === 'signature-agent')\n  if (!agentComponent) return fail('signature_agent_not_covered', { keyid })\n\n  // 4. Signature-Agent → signer + directory\n  const agentHeader = request.headers.get('signature-agent')\n  if (!agentHeader) return fail('signature_agent_missing', { keyid })\n  let member: Item\n  try {\n    const key = getParam(agentComponent.params, 'key')\n    if (typeof key === 'string') {\n      const m = parseDictionary(agentHeader).get(key)\n      if (!m || isInnerList(m)) return fail('signature_agent_member_missing', { keyid })\n      member = m\n    } else {\n      member = parseItem(agentHeader) // legacy sf-string form\n    }\n  } catch (e) {\n    return fail(`malformed_signature_agent: ${(e as Error).message}`, { keyid })\n  }\n  let signer: string, directoryUrl: string\n  try {\n    ;({ signer, directoryUrl } = directoryUrlFor(member))\n  } catch (e) {\n    return fail((e as SignatureError).code ?? 'invalid_signature_agent', { keyid })\n  }\n  if (!isAllowed(signer, opts.allowedDirectories)) return fail('signer_not_allowed', { agentUrl: signer, keyid })\n\n  // 5. replay check (read-only; recorded only after a valid signature)\n  const replayKey = nonce ? `${signer}|${keyid}|${nonce}` : undefined\n  if (replayKey && (await opts.replayCache?.has(replayKey))) return fail('replayed_nonce', { agentUrl: signer, keyid })\n\n  // 6. key lookup — keyed on the (signer URL, key) pair, by thumbprint\n  let dir: CachedDirectory\n  try {\n    dir = await loadDirectory(directoryUrl, opts)\n  } catch (e) {\n    return fail((e as SignatureError).code ?? 'discovery_failed', { agentUrl: signer, keyid })\n  }\n  const idx = dir.thumbprints.indexOf(keyid)\n  if (idx < 0) return fail('unknown_keyid', { agentUrl: signer, keyid })\n  const jwk = dir.keys[idx]!\n\n  // 7. rebuild the signature base and verify\n  try {\n    const url = new URL(request.url)\n    const alg = resolveAlgorithm(jwk, getParam(input.params, 'alg'))\n    const base = signatureBase(input, {\n      request,\n      url,\n      ...(opts.authority ? { authority: opts.authority(request, url) } : {}),\n    })\n    const ok = await verifySignature(alg, jwk, base, signature)\n    if (!ok) return fail('bad_signature', { agentUrl: signer, keyid })\n    if (replayKey) await opts.replayCache?.add(replayKey, Math.max(expires - now, 1) + skew)\n    return { status: 'verified', agentUrl: signer, keyid, label, alg, created, expires }\n  } catch (e) {\n    return fail(e instanceof SignatureError ? e.code : 'verification_error', { agentUrl: signer, keyid })\n  }\n}\n","/**\n * Agent authentication for any HTTP request — the server half of the SDK.\n *\n *   const auth = createAgentAuth({ apiKey: { verify } })\n *   const result = await auth.authenticate(request)   // Fetch API Request\n *\n * Authentication never blocks. A verified agent gets a stable identity your\n * routes can read; an unverified agent (or a human) browses exactly as before.\n *\n * Methods, strongest first: Web Bot Auth (RFC 9421 signed agents), agent API\n * keys, OAuth2 client-credentials JWTs, and verified crawlers (forward-confirmed\n * reverse DNS). Everything runs on Node ≥ 20 and edge runtimes except crawler\n * rDNS, which needs Node DNS (it degrades to \"unverified\", never \"verified\").\n */\nimport type { TraceEvent } from '@agentronics/protocol'\nimport type * as Jose from 'jose'\nimport { classifyUserAgent, clientIp, verifyCrawler, type ClientIpSource, type DnsResolver } from './crawlers.js'\nimport { bytesToBase64Url } from './structuredFields.js'\nimport { memoryReplayCache, verifyWebBotAuth, type WebBotAuthOptions } from './webBotAuth.js'\n\nexport type AgentAuthMethod = 'web-bot-auth' | 'api-key' | 'oauth2' | 'verified-crawler'\n\nexport interface VerifiedAgent {\n  /** Stable id: signer URL, API-key agent id, OAuth client id, or crawler name. */\n  id: string\n  name: string\n  vendor: string | null\n  method: AgentAuthMethod\n  claims?: Record<string, unknown>\n}\n\nexport type AgentAuthResult =\n  | { status: 'verified'; agent: VerifiedAgent }\n  | { status: 'unverified'; reason: string; claimedName?: string; attempted: AgentAuthMethod[] }\n  | { status: 'none' }\n\nexport interface ApiKeyIdentity {\n  agentId: string\n  name?: string\n  vendor?: string\n  scopes?: string[]\n}\n\nexport interface ApiKeyOptions {\n  /** Key prefix that marks a bearer token as an agent key. Default `agk_`. */\n  prefix?: string\n  /** Look the key up. Return null for unknown/revoked keys. */\n  verify: (key: string) => ApiKeyIdentity | null | Promise<ApiKeyIdentity | null>\n}\n\nexport interface OAuth2Options {\n  issuer: string\n  audience: string | string[]\n  /** Default `<issuer>/.well-known/jwks.json`. */\n  jwksUri?: string\n  /** Static JWKS (tests / pinned keys) instead of fetching `jwksUri`. */\n  jwks?: { keys: JsonWebKey[] }\n  requiredScopes?: string[]\n  algorithms?: string[]\n  clockToleranceSec?: number\n}\n\nexport interface CrawlerOptions {\n  /** Where to read the client IP. Default 'auto' (platform headers only). */\n  clientIp?: ClientIpSource\n  /** Test seam / custom resolver. */\n  resolver?: DnsResolver\n}\n\nexport interface AgentAuthOptions {\n  /** Web Bot Auth (on by default). `false` disables it. */\n  webBotAuth?: boolean | WebBotAuthOptions\n  apiKey?: ApiKeyOptions\n  oauth2?: OAuth2Options\n  /** Verified crawlers (on by default). `false` disables it. */\n  crawlers?: boolean | CrawlerOptions\n}\n\n/** Signers we can name. Everything else is shown by hostname. */\nconst KNOWN_SIGNERS: Record<string, { name: string; vendor: string }> = {\n  'https://chatgpt.com': { name: 'ChatGPT agent', vendor: 'OpenAI' },\n}\n\nconst GENERIC_AGENT_UA = /\\b(bot|crawler|spider|agent|headless|scraper)\\b/i\nconst JWT_SHAPE = /^[A-Za-z0-9_-]+\\.[A-Za-z0-9_-]+\\.[A-Za-z0-9_-]*$/\n\nfunction bearer(request: Request): string | null {\n  const h = request.headers.get('authorization')\n  return h && /^bearer\\s+/i.test(h) ? h.replace(/^bearer\\s+/i, '').trim() : null\n}\n\nfunction unverifiedJwtIssuer(token: string): string | null {\n  try {\n    const payload = token.split('.')[1]!\n    const json = atob(payload.replace(/-/g, '+').replace(/_/g, '/'))\n    const iss = (JSON.parse(json) as { iss?: unknown }).iss\n    return typeof iss === 'string' ? iss : null\n  } catch {\n    return null\n  }\n}\n\ntype JoseModule = typeof Jose\nlet josePromise: Promise<JoseModule> | undefined\nconst remoteSets = new Map<string, ReturnType<JoseModule['createRemoteJWKSet']>>()\n\nasync function verifyOAuth2(token: string, o: OAuth2Options): Promise<VerifiedAgent | { error: string }> {\n  josePromise ??= import('jose')\n  const jose = await josePromise\n  const keySet = o.jwks\n    ? jose.createLocalJWKSet(o.jwks as Parameters<JoseModule['createLocalJWKSet']>[0])\n    : (() => {\n        const uri = o.jwksUri ?? `${o.issuer.replace(/\\/$/, '')}/.well-known/jwks.json`\n        let s = remoteSets.get(uri)\n        if (!s) {\n          s = jose.createRemoteJWKSet(new URL(uri), { cacheMaxAge: 3_600_000, cooldownDuration: 30_000 })\n          remoteSets.set(uri, s)\n        }\n        return s\n      })()\n  try {\n    const { payload } = await jose.jwtVerify(token, keySet, {\n      issuer: o.issuer,\n      audience: o.audience,\n      algorithms: o.algorithms ?? ['RS256', 'PS256', 'ES256', 'EdDSA'],\n      clockTolerance: o.clockToleranceSec ?? 30,\n    })\n    if (o.requiredScopes?.length) {\n      const granted = new Set(String(payload.scope ?? payload.scp ?? '').split(/\\s+/))\n      const missing = o.requiredScopes.filter((s) => !granted.has(s))\n      if (missing.length) return { error: `missing_scopes:${missing.join(',')}` }\n    }\n    const clientId = String(payload.client_id ?? payload.azp ?? payload.sub ?? '')\n    if (!clientId) return { error: 'token_has_no_client_id' }\n    return {\n      id: `oauth2:${clientId}`,\n      name: typeof payload.agent_name === 'string' ? payload.agent_name : clientId,\n      vendor: typeof payload.agent_vendor === 'string' ? payload.agent_vendor : null,\n      method: 'oauth2',\n      claims: { sub: payload.sub, scope: payload.scope ?? payload.scp },\n    }\n  } catch (e) {\n    return { error: `invalid_token:${(e as { code?: string }).code ?? (e as Error).message}` }\n  }\n}\n\nexport function createAgentAuth(options: AgentAuthOptions = {}) {\n  const wba: WebBotAuthOptions | null =\n    options.webBotAuth === false\n      ? null\n      : { replayCache: memoryReplayCache(), ...(typeof options.webBotAuth === 'object' ? options.webBotAuth : {}) }\n  const crawlers: CrawlerOptions | null =\n    options.crawlers === false ? null : typeof options.crawlers === 'object' ? options.crawlers : {}\n  const keyPrefix = options.apiKey?.prefix ?? 'agk_'\n\n  async function authenticate(request: Request): Promise<AgentAuthResult> {\n    const attempted: AgentAuthMethod[] = []\n    const reasons: string[] = []\n    let claimedName: string | undefined\n\n    // 1. Web Bot Auth\n    if (wba) {\n      const r = await verifyWebBotAuth(request, wba)\n      if (r.status === 'verified') {\n        const known = KNOWN_SIGNERS[r.agentUrl]\n        const host = new URL(r.agentUrl).hostname\n        return {\n          status: 'verified',\n          agent: {\n            id: r.agentUrl,\n            name: known?.name ?? host,\n            vendor: known?.vendor ?? null,\n            method: 'web-bot-auth',\n            claims: { keyid: r.keyid, alg: r.alg },\n          },\n        }\n      }\n      if (r.status === 'invalid') {\n        attempted.push('web-bot-auth')\n        reasons.push(`web-bot-auth:${r.reason}`)\n        claimedName ??= r.agentUrl ? new URL(r.agentUrl).hostname : undefined\n      }\n    }\n\n    // 2/3. Bearer credentials — agent API key or OAuth2 JWT\n    const token = bearer(request) ?? request.headers.get('x-agent-key')\n    if (token && options.apiKey && token.startsWith(keyPrefix)) {\n      attempted.push('api-key')\n      const id = await options.apiKey.verify(token)\n      if (id) {\n        return {\n          status: 'verified',\n          agent: {\n            id: `key:${id.agentId}`,\n            name: id.name ?? id.agentId,\n            vendor: id.vendor ?? null,\n            method: 'api-key',\n            ...(id.scopes ? { claims: { scopes: id.scopes } } : {}),\n          },\n        }\n      }\n      reasons.push('api-key:unknown_or_revoked')\n    } else if (token && options.oauth2 && JWT_SHAPE.test(token)) {\n      // Only tokens from *our* issuer are agent credentials — a user's\n      // session JWT from another issuer is not agent traffic.\n      const iss = unverifiedJwtIssuer(token)\n      if (iss === options.oauth2.issuer) {\n        attempted.push('oauth2')\n        const r = await verifyOAuth2(token, options.oauth2)\n        if (!('error' in r)) return { status: 'verified', agent: r }\n        reasons.push(`oauth2:${r.error}`)\n      }\n    }\n\n    // 4. Crawler claim → forward-confirmed reverse DNS\n    const ua = request.headers.get('user-agent')\n    const claim = classifyUserAgent(ua)\n    if (claim) {\n      claimedName ??= claim.name\n      if (crawlers) {\n        attempted.push('verified-crawler')\n        const v = await verifyCrawler(claim, clientIp(request, crawlers.clientIp), crawlers.resolver)\n        if (v.status === 'verified') {\n          return {\n            status: 'verified',\n            agent: { id: `crawler:${claim.name}`, name: claim.name, vendor: null, method: 'verified-crawler', claims: { host: v.host } },\n          }\n        }\n        reasons.push(`crawler:${v.reason}`)\n      } else reasons.push('crawler:verification_disabled')\n    }\n\n    if (attempted.length || claim || (ua && GENERIC_AGENT_UA.test(ua)) || request.headers.has('signature-agent')) {\n      return {\n        status: 'unverified',\n        reason: reasons[0] ?? 'agent_claim_without_credentials',\n        ...(claimedName ? { claimedName } : {}),\n        attempted,\n      }\n    }\n    return { status: 'none' }\n  }\n\n  return { authenticate }\n}\n\n// ---- helpers: API keys ---------------------------------------------------------\n\n/** SHA-256 hex of an agent key — store this, never the key. */\nexport async function hashAgentKey(key: string): Promise<string> {\n  const d = await crypto.subtle.digest('SHA-256', new TextEncoder().encode(key))\n  return [...new Uint8Array(d)].map((b) => b.toString(16).padStart(2, '0')).join('')\n}\n\n/** Verifier over a static map of `sha256(key) → identity` (e.g. from env/config). */\nexport function staticKeyVerifier(hashedKeys: Record<string, ApiKeyIdentity>): ApiKeyOptions['verify'] {\n  return async (key) => hashedKeys[await hashAgentKey(key)] ?? null\n}\n\n/** Mint a new agent key (`agk_` + 32 random bytes, base64url). Show it once; store its hash. */\nexport function generateAgentKey(prefix = 'agk_'): string {\n  return prefix + bytesToBase64Url(crypto.getRandomValues(new Uint8Array(32)))\n}\n\n// ---- helpers: headers + tracing ------------------------------------------------\n\nexport const AGENT_HEADERS = {\n  status: 'x-agentronics-agent-status',\n  id: 'x-agentronics-agent-id',\n  name: 'x-agentronics-agent-name',\n  vendor: 'x-agentronics-agent-vendor',\n  method: 'x-agentronics-auth-method',\n} as const\n\n/**\n * Request headers to forward downstream, with the auth result attached.\n * Any incoming `x-agentronics-*` header is stripped first so a caller can\n * never forge a verified identity.\n */\nexport function withAgentHeaders(request: Request, result: AgentAuthResult): Headers {\n  const h = new Headers(request.headers)\n  for (const k of [...h.keys()]) if (k.toLowerCase().startsWith('x-agentronics-')) h.delete(k)\n  h.set(AGENT_HEADERS.status, result.status)\n  if (result.status === 'verified') {\n    h.set(AGENT_HEADERS.id, result.agent.id)\n    h.set(AGENT_HEADERS.name, result.agent.name)\n    h.set(AGENT_HEADERS.method, result.agent.method)\n    if (result.agent.vendor) h.set(AGENT_HEADERS.vendor, result.agent.vendor)\n  }\n  return h\n}\n\n/**\n * Read the forwarded result in a route handler (only trust it behind the\n * middleware). Accepts anything with `get()` — `Headers`, Next's read-only\n * `headers()`, or a plain adapter.\n */\nexport function readAgentHeaders(headers: { get(name: string): string | null }) {\n  const status = headers.get(AGENT_HEADERS.status) as AgentAuthResult['status'] | null\n  return {\n    status: status ?? 'none',\n    id: headers.get(AGENT_HEADERS.id),\n    name: headers.get(AGENT_HEADERS.name),\n    vendor: headers.get(AGENT_HEADERS.vendor),\n    method: headers.get(AGENT_HEADERS.method) as AgentAuthMethod | null,\n  }\n}\n\n/**\n * Map a result to an SDK trace event so server-side auth shows up in the\n * console's Auth + Logs pages next to in-browser agents. Returns null for\n * non-agent traffic. Server-side agents use class `crawler` (HTTP fetchers);\n * the method is in `metadata.protocol`.\n */\nexport function toTraceEvent(result: AgentAuthResult, ctx: { siteId: string; request: Request }): TraceEvent | null {\n  if (result.status === 'none') return null\n  const url = new URL(ctx.request.url)\n  const verified = result.status === 'verified'\n  return {\n    id: `evt_${crypto.randomUUID()}`,\n    siteId: ctx.siteId,\n    sessionId: verified ? result.agent.id : `unverified:${result.claimedName ?? 'unknown'}`,\n    occurredAt: new Date().toISOString(),\n    type: 'auth.identity_presented',\n    agent: {\n      class: 'crawler',\n      trust: verified ? 'verified' : 'declared',\n      confidence: verified ? 1 : 0.5,\n      vendor: verified ? (result.agent.vendor ?? result.agent.name) : (result.claimedName ?? null),\n      userAgent: ctx.request.headers.get('user-agent'),\n      detectionVersion: '2026.09',\n      signals: { surface: 'server' },\n    },\n    outcome: verified ? 'success' : 'error',\n    ...(verified ? {} : { error: result.reason }),\n    metadata: {\n      protocol: verified ? result.agent.method : (result.attempted[0] ?? 'none'),\n      ...(verified ? { subject: result.agent.id } : {}),\n      page: url.pathname,\n    },\n  }\n}\n","/**\n * Drop-in request handlers built on createAgentAuth().\n *\n * - createAgentAuthHandler(): framework-agnostic (Fetch Request in, identity out)\n * - expressAgentAuth():        Express / Connect middleware\n * - agentronicsMiddleware():   Next.js middleware — see '@agentronics/sdk/next'\n *\n * None of these ever block a request. They authenticate the agent (if any),\n * attach the result as `x-agentronics-*` request headers, and pass every\n * request through — verified agents, unverified agents and humans alike.\n */\nimport { createAgentAuth, withAgentHeaders, type AgentAuthOptions, type AgentAuthResult } from './agentAuth.js'\n\nexport interface AgentAuthHandlerOptions extends AgentAuthOptions {\n  /** Called for every agent request (not for plain human traffic). Never awaited on the hot path. */\n  onResult?: (event: { result: AgentAuthResult; request: Request }) => void | Promise<void>\n  /** Return false to skip a path (e.g. static assets). */\n  matcher?: (url: URL) => boolean\n}\n\nexport interface HandlerOutcome {\n  result: AgentAuthResult\n  /** Request headers to forward downstream (spoofed x-agentronics-* stripped). */\n  headers: Headers\n}\n\nexport function createAgentAuthHandler(options: AgentAuthHandlerOptions = {}) {\n  const auth = createAgentAuth(options)\n  return async function handle(request: Request): Promise<HandlerOutcome> {\n    if (options.matcher && !options.matcher(new URL(request.url))) {\n      const result: AgentAuthResult = { status: 'none' }\n      return { result, headers: withAgentHeaders(request, result) }\n    }\n    const result = await auth.authenticate(request)\n    if (result.status !== 'none' && options.onResult) {\n      // fire-and-forget: reporting must never slow or break the request\n      void Promise.resolve()\n        .then(() => options.onResult!({ result, request }))\n        .catch(() => undefined)\n    }\n    return { result, headers: withAgentHeaders(request, result) }\n  }\n}\n\n// ---- Express / Connect -----------------------------------------------------\n\ninterface NodeReq {\n  method?: string\n  url?: string\n  originalUrl?: string\n  protocol?: string\n  headers: Record<string, string | string[] | undefined>\n  agent?: AgentAuthResult\n}\n\n/**\n * Express middleware. Sets `req.agent` to the auth result and the\n * `x-agentronics-*` request headers for downstream handlers, then always\n * calls next(). For correct `@authority`/client IP behind a proxy, set\n * Express `trust proxy`.\n */\nexport function expressAgentAuth(options: AgentAuthHandlerOptions = {}) {\n  const handle = createAgentAuthHandler(options)\n  return (req: NodeReq, _res: unknown, next: (err?: unknown) => void) => {\n    const headers = new Headers()\n    for (const [k, v] of Object.entries(req.headers)) {\n      if (v !== undefined) headers.set(k, Array.isArray(v) ? v.join(', ') : v)\n    }\n    const host = headers.get('host') ?? 'localhost'\n    const url = `${req.protocol ?? 'http'}://${host}${req.originalUrl ?? req.url ?? '/'}`\n    handle(new Request(url, { method: req.method ?? 'GET', headers }))\n      .then((out) => {\n        req.agent = out.result\n        for (const k of Object.keys(req.headers)) if (k.startsWith('x-agentronics-')) delete req.headers[k]\n        out.headers.forEach((v, k) => {\n          if (k.startsWith('x-agentronics-')) req.headers[k] = v\n        })\n        next()\n      })\n      // Authentication problems must never take the site down — fall through\n      // as unauthenticated traffic.\n      .catch(() => {\n        for (const k of Object.keys(req.headers)) if (k.startsWith('x-agentronics-')) delete req.headers[k]\n        req.agent = { status: 'none' }\n        next()\n      })\n  }\n}\n"]}

package/dist/chunk-Y7JYD5RA.js

@@ -1,17 +0,0 @@
-import {a,b}from'./chunk-LLD3Y2LZ.js';import {AgentClass,isHigherTrust,IdentityClaim,AgentronicsError,PolicyRule,MemoryEntry,SiteMemory,SITE_MEMORY_DEFAULT,TraceEvent,classifyApiKey,PUBLISHABLE_KEY_PREFIX,TRUST_RANK,SiteMemoryPageContext}from'@agentronics/protocol';var pe=[{name:"GPTBot",category:"ai",pattern:/GPTBot/i},{name:"OAI-SearchBot",category:"ai",pattern:/OAI-SearchBot/i},{name:"ChatGPT-User",category:"ai",pattern:/ChatGPT-User/i},{name:"ClaudeBot",category:"ai",pattern:/ClaudeBot/i},{name:"Claude-Web",category:"ai",pattern:/Claude-Web/i},{name:"anthropic-ai",category:"ai",pattern:/anthropic-ai/i},{name:"PerplexityBot",category:"ai",pattern:/PerplexityBot/i},{name:"Google-Extended",category:"ai",pattern:/Google-Extended/i},{name:"Applebot-Extended",category:"ai",pattern:/Applebot-Extended/i},{name:"Amazonbot",category:"ai",pattern:/Amazonbot/i},{name:"Bytespider",category:"ai",pattern:/Bytespider/i},{name:"CCBot",category:"ai",pattern:/CCBot/i},{name:"Meta-ExternalAgent",category:"ai",pattern:/Meta-ExternalAgent/i},{name:"cohere-ai",category:"ai",pattern:/cohere-ai/i},{name:"Googlebot",category:"search",pattern:/Googlebot/i},{name:"Bingbot",category:"search",pattern:/bingbot/i},{name:"DuckDuckBot",category:"search",pattern:/DuckDuckBot/i},{name:"YandexBot",category:"search",pattern:/YandexBot/i},{name:"Baiduspider",category:"search",pattern:/Baiduspider/i},{name:"Applebot",category:"search",pattern:/Applebot/i}],$=(e={})=>{let{signatures:t=pe,disable:r=false,confidence:n=.9}=e;if(r||typeof navigator>"u")return null;let o=navigator.userAgent??"";if(!o)return null;for(let a$1 of t)if(a$1.pattern.test(o))return {class:"crawler",trust:"detected",confidence:n,vendor:a$1.name,userAgent:o,detectionVersion:a,signals:{matched:a$1.name,category:a$1.category,ua:o}};return null};var xt=[/HeadlessChrome/i,/Headless/i,/PhantomJS/i,/SlimerJS/i],St=()=>({hit:(typeof navigator<"u"&&navigator.webdriver)===true,weight:.6,detail:"navigator.webdriver === true"}),bt=()=>{if(typeof window>"u")return {hit:false,weight:.5};let e=Object.keys(window).filter(t=>t.startsWith("cdc_"));return {hit:e.length>0,weight:.5,detail:`window.${e[0]??"cdc_*"}`}},Tt=()=>{if(typeof navigator>"u"||!navigator.plugins)return {hit:false,weight:.2};let e=/Win|Mac|Linux/.test(navigator.userAgent??""),t=navigator.plugins.length===0;return {hit:e&&t,weight:.2,detail:"desktop UA with no plugins"}},At=()=>{if(typeof navigator>"u")return {hit:false,weight:.7};let e=navigator.userAgent??"",t=xt.some(r=>r.test(e));return t?{hit:t,weight:.7,detail:`headless UA: ${e}`}:{hit:t,weight:.7}},kt=()=>{if(typeof navigator>"u")return {hit:false,weight:.15};let e=navigator.languages;return {hit:!e||e.length===0,weight:.15,detail:"navigator.languages empty"}},It=()=>{if(typeof navigator>"u")return {hit:false,weight:.1};let e="chrome"in window,t=navigator.userAgent??"";return {hit:/Chrome\//.test(t)&&!/Edg\//.test(t)&&!e,weight:.2,detail:"Chrome UA without window.chrome"}},Mt={webdriver:St,chromedriver:bt,headlessUa:At,languages:kt,permissions:It,plugins:Tt},L=(e={})=>{let{threshold:t=.4}=e,r={},n=0,o=0;for(let[s,l]of Object.entries(Mt)){let i=l();n+=i.weight,r[s]={hit:i.hit,weight:i.weight,detail:i.detail},i.hit&&(o+=i.weight);}let a$1=n===0?0:o/n;return a$1<t?null:{class:"dom",trust:"detected",confidence:a$1,vendor:null,userAgent:typeof navigator>"u"?null:navigator.userAgent,detectionVersion:a,signals:r}};var de=()=>[{id:"webmcp.model-context",status:"stable",detect:()=>b({pollMs:0})},{id:"crawler.user-agent",status:"beta",detect:()=>$()},{id:"dom.automation-heuristics",status:"beta",detect:()=>L()}],K=(e=de())=>{let t=new Map(e.map(r=>[r.id,r]));return {register(r){t.set(r.id,r);},list(r){let n=[...t.values()];return r?n.filter(o=>o.status===r):n},async detectAll(r=false){for(let n of t.values()){if(n.status==="research"&&!r)continue;let o=await n.detect();if(o)return o}return null}}};var Rt=e=>{let t=AgentClass.parse(e.class),r=e.verificationToken?"verified":"declared";return {class:t,trust:r,confidence:1,vendor:e.vendor,userAgent:typeof navigator>"u"?null:navigator.userAgent,detectionVersion:a,signals:{declared:true,hasVerificationToken:!!e.verificationToken}}};var Pt=({gatewayUrl:e,fetcher:t=fetch})=>{let r=null,n=[];return {snapshot(){return [...n]},async sync(){let o=await t(`${e.replace(/\/$/,"")}/v1/detector-signatures`,{headers:r?{"if-none-match":r}:{}});if(o.status===304)return this.snapshot();if(!o.ok)throw new Error(`Detector signature sync failed with status ${o.status}.`);return n=(await o.json()).signatures??[],r=o.headers.get("etag"),this.snapshot()}}};var me=async(e={})=>{if(e.customDetectors?.length){let t=await K(e.customDetectors).detectAll(!!e.experimental);if(t)return t}if(e.webmcp!==false){let t=await b(e.webmcp??{});if(t)return t}if(e.crawler!==false){let t=$(e.crawler??{});if(t)return t}if(e.dom!==false){let t=L(e.dom??{});if(t)return t}return null};var $t=e=>({class:e.class,trust:"declared",confidence:1,vendor:e.vendor,userAgent:typeof navigator>"u"?null:navigator.userAgent,detectionVersion:a,signals:{declared:true,hasToken:true,tokenExpiresAt:e.expiresAt??null}}),ye=()=>{let e=null;return {present(t){let r=IdentityClaim.safeParse(t);if(!r.success)throw new AgentronicsError("invalid_api_key",`Invalid identity claim: ${r.error.issues[0]?.message??"unknown"}`);let n={claim:r.data,identity:$t(r.data)};return e=n,n},clear(){e=null;},preferOver(t){return e?t?isHigherTrust(e.identity.trust,t.trust)?e.identity:t:e.identity:t},snapshot(){return e}}};var Vr=({detected:e,declared:t,verified:r,linked:n})=>n?"linked":r?"verified":t?"declared":"detected",fe=e=>{let t=null;for(let r of e)(!t||TRUST_RANK[r.trust]>TRUST_RANK[t.trust])&&(t=r);return t};var he=()=>({name:"bearer",async authenticate(e,t){if(!e.bearerToken)return null;let r=await t.verifyToken?.("bearer",e.bearerToken);return {class:e.classHint??"dom",trust:r?.trust??"verified",confidence:1,vendor:r?.vendor??e.vendorHint??"bearer",userAgent:typeof navigator>"u"?null:navigator.userAgent,detectionVersion:a,signals:{bearer:true,verifiedRemotely:!!r}}}});var ve=()=>({name:"detection",async authenticate(e){return e.detected??null}});var we=()=>({name:"extensionToken",async authenticate(e,t){if(!e.extensionToken)return null;let r=await t.verifyToken?.("extensionToken",e.extensionToken);return {class:"dom",trust:r?.trust??"verified",confidence:1,vendor:r?.vendor??e.vendorHint??"browser-extension",userAgent:typeof navigator>"u"?null:navigator.userAgent,detectionVersion:a,signals:{extensionToken:true,verifiedRemotely:!!r}}}});var xe=()=>({name:"mtls",async authenticate(e,t){if(!e.xfccHeader)return null;let r=await t.verifyToken?.("mtls",e.xfccHeader);return {class:e.classHint??"webmcp",trust:r?.trust??"verified",confidence:1,vendor:r?.vendor??e.vendorHint??"mtls",userAgent:typeof navigator>"u"?null:navigator.userAgent,detectionVersion:a,signals:{mtls:true,subject:r?.subject??null,verifiedRemotely:!!r,...r?.signals??{}}}}});var Se=()=>({name:"oauth2",async authenticate(e,t){if(!e.oauth2AccessToken)return null;let r=await t.verifyToken?.("oauth2",e.oauth2AccessToken);return {class:e.classHint??"webmcp",trust:e.oauth2Subject?"linked":r?.trust??"verified",confidence:1,vendor:r?.vendor??e.vendorHint??"oauth2",userAgent:typeof navigator>"u"?null:navigator.userAgent,detectionVersion:a,signals:{oauth2:true,subject:e.oauth2Subject??null,verifiedRemotely:!!r}}}});var jt=e=>({class:e.class,trust:"declared",confidence:1,vendor:e.vendor,userAgent:typeof navigator>"u"?null:navigator.userAgent,detectionVersion:a,signals:{declared:true,hasToken:true,tokenExpiresAt:e.expiresAt??null}}),be=()=>({name:"selfDeclaration",async authenticate(e){return e.declaration?jt(IdentityClaim.parse(e.declaration)):null}});var Te=()=>({name:"sessionLink",async authenticate(e,t){if(!e.sessionLinkToken)return null;let r=await t.verifyToken?.("sessionLink",e.sessionLinkToken);return {class:e.classHint??"screenshot",trust:e.linkedUserId?"linked":r?.trust??"verified",confidence:1,vendor:r?.vendor??e.vendorHint??"session-link",userAgent:typeof navigator>"u"?null:navigator.userAgent,detectionVersion:a,signals:{sessionLink:true,linkedUserId:e.linkedUserId??null,verifiedRemotely:!!r}}}});var Ae=()=>({name:"sso",async authenticate(e,t){if(!e.ssoIdToken)return null;let r=await t.verifyToken?.("sso",e.ssoIdToken);return {class:e.classHint??"dom",trust:r?.trust??"verified",confidence:1,vendor:r?.vendor??e.vendorHint??"sso",userAgent:typeof navigator>"u"?null:navigator.userAgent,detectionVersion:a,signals:{sso:true,subject:r?.subject??null,verifiedRemotely:!!r,...r?.signals??{}}}}});var ke=()=>({name:"spiffe",async authenticate(e,t){if(!e.spiffeJwt)return null;let r=await t.verifyToken?.("spiffe",e.spiffeJwt),n=r?.vendor==="google";return {class:e.classHint??"webmcp",trust:r?.trust??"verified",confidence:1,vendor:r?.vendor??e.vendorHint??"spiffe",userAgent:typeof navigator>"u"?null:navigator.userAgent,detectionVersion:a,signals:{spiffe:true,spiffeId:r?.subject??null,subject:r?.subject??null,verifiedRemotely:!!r,...n?{googleAgent:true}:{},...r?.signals??{}}}}});var Ie=()=>({name:"xAgentHeader",async authenticate(e){if(!e.xAgentHeader)return null;let[t="x-agent",r="dom",n]=e.xAgentHeader.split(";"),o=AgentClass.safeParse(r);return {class:o.success?o.data:"dom",trust:n?"verified":"declared",confidence:n?1:.8,vendor:t,userAgent:typeof navigator>"u"?null:navigator.userAgent,detectionVersion:a,signals:{xAgentHeader:true,hasProof:!!n}}}});var Gt=()=>[ve(),be(),he(),Ie(),we(),Te(),Se(),Ae(),ke(),xe()],Wt={detection:"detection",selfDeclaration:"declaration",bearer:"bearer",xAgentHeader:"x-agent-header",extensionToken:"extension",sessionLink:"session-link",oauth2:"oauth2",sso:"sso",spiffe:"spiffe",mtls:"mtls"},Nt=(e,t)=>e==="spiffe"&&t.signals?.googleAgent===true?"google-agent":Wt[e],Me=({methods:e=Gt(),context:t={},onTrace:r}={})=>({async authenticate(n){let o=[],a={};for(let m of e){let d=await m.authenticate(n,t);a[m.name]=!!d,d&&o.push({method:m.name,identity:d});}let s=fe(o.map(m=>m.identity)),l=s?o.find(m=>m.identity===s):void 0,i=l?Nt(l.method,l.identity):void 0,g=typeof s?.signals?.subject=="string"?s.signals.subject:void 0,p={type:s?"auth.identity_presented":"sdk.error",agent:s,outcome:s?"success":"error",metadata:{methods:a,...i?{protocol:i}:{},...g?{subject:g}:{}}};return s||(p.error="No auth method produced an identity."),r?.(p),s},methods(){return e.map(n=>n.name)}});var _t={identity:null,source:"initial",updatedAt:null},Ee=()=>{let e=_t,t=new Set,r=()=>{t.size!==0&&t.forEach(n=>n(e));};return {snapshot(){return e},set(n,o){e={identity:n,source:o,updatedAt:new Date().toISOString()},r();},subscribe(n){return t.add(n),()=>{t.delete(n);}}}};var Ut=()=>{let e=new Map;return {read:t=>e.get(t)??null,write:(t,r)=>{e.set(t,r);}}},Kt=()=>typeof window>"u"||!window.localStorage?Ut():{read:e=>{try{return window.localStorage.getItem(e)}catch{return null}},write:(e,t)=>{try{window.localStorage.setItem(e,t);}catch{}}},Ht=e=>{if(!e)return null;try{let t=JSON.parse(e);if(typeof t=="object"&&t!==null&&Number.isFinite(t.count)&&Number.isFinite(t.resetAt))return t}catch{return null}return null},Re=(e=Kt())=>({consume(t,r,n=Date.now()){let o=`agtx:rate:${t}`,a=Ht(e.read(o)),s=a&&a.resetAt>n?a.resetAt:n+r.windowSeconds*1e3,l=a&&a.resetAt>n?a.count+1:1;return e.write(o,JSON.stringify({count:l,resetAt:s})),{allowed:l<=r.max,remaining:Math.max(0,r.max-l),resetAt:s}}});var zt=(e,t)=>e==="*"||e===t?true:e.includes("*")?new RegExp("^"+e.replace(/[.+?^${}()|[\]\\]/g,"\\$&").replace(/\*/g,".*")+"$").test(t):false,Vt=(e,t)=>{let r=e?TRUST_RANK[e.trust]:-1,n=TRUST_RANK[t.minTrust];return r>=n},Ft=(e,t)=>t.allowedClasses.length===0?true:e?t.allowedClasses.includes(e.class):false,Ce="review",Jt=(e,t)=>{let r=t?.class??"unknown",n=t?.vendor??"unknown",o=t?.trust??"none";return `${e}:${r}:${n}:${o}`},De=(e=[],t={})=>{let r=e.map(o=>PolicyRule.parse(o)),n=t.rateLimiter??Re();return {set(o){r=o.map(a=>PolicyRule.parse(a));},list(){return [...r]},evaluate({tool:o,identity:a}){for(let s of r)if(zt(s.tool,o)){if(!Vt(a,s))return {decision:"deny",ruleId:s.id,reason:`Rule "${s.id}" requires trust >= ${s.minTrust}.`};if(!Ft(a,s))return {decision:"deny",ruleId:s.id,reason:`Rule "${s.id}" restricts to classes: ${s.allowedClasses.join(", ")}.`};if(s.rateLimit){let l=n.consume(Jt(o,a),s.rateLimit);if(!l.allowed)return {decision:"deny",ruleId:s.id,reason:`Rule "${s.id}" rate limit exceeded. Resets at ${new Date(l.resetAt).toISOString()}.`}}return {decision:s.decision,ruleId:s.id,reason:`Matched rule "${s.id}".`}}return {decision:Ce,ruleId:null,reason:`No rule matched tool "${o}". Falling back to "${Ce}".`}}}};var $e=({gatewayUrl:e,siteId:t,publishableKey:r,fetcher:n=fetch})=>{let o={policies:[],etag:null};return {snapshot(){return {policies:[...o.policies],etag:o.etag}},async sync(){let a=await n(`${e.replace(/\/$/,"")}/v1/sites/${encodeURIComponent(t)}/policies`,{headers:{authorization:`Bearer ${r}`,...o.etag?{"if-none-match":o.etag}:{}}});if(a.status===304)return this.snapshot();if(!a.ok)throw new Error(`Policy sync failed with status ${a.status}.`);let s=await a.json();return o={policies:PolicyRule.array().parse(s.policies??[]),etag:a.headers.get("etag")},this.snapshot()}}};var Le=({message:e="Agent action blocked by site policy.",durationMs:t=2400,documentRef:r=typeof document>"u"?void 0:document}={})=>{if(!r?.body)return null;let n=r.createElement("div");return n.setAttribute("role","status"),n.setAttribute("data-agentronics-deny-overlay","true"),n.textContent=e,Object.assign(n.style,{position:"fixed",zIndex:"2147483647",left:"50%",bottom:"24px",transform:"translateX(-50%)",maxWidth:"min(520px, calc(100vw - 32px))",padding:"12px 16px",borderRadius:"8px",background:"#07091A",color:"#F4F4F5",border:"1px solid #6366F1",boxShadow:"0 20px 48px -16px rgba(7,9,26,0.55)",font:"13px/1.45 'Space Mono', ui-monospace, SFMono-Regular, Menlo, monospace"}),r.body.appendChild(n),window.setTimeout(()=>n.remove(),t),n};var je=({policyEngine:e,getIdentity:t,documentRef:r=typeof document>"u"?void 0:document,selector:n="[data-agentronics-tool]"})=>{if(!r)return {uninstall:()=>{}};let o=a=>{let s=a.target instanceof Element?a.target.closest(n):null;if(!(s instanceof HTMLElement))return;let l=s.dataset.agentronicsTool;l&&Promise.resolve(t()).then(i=>{let g=e.evaluate({tool:l,identity:i});g.decision==="deny"&&(a.preventDefault(),a.stopPropagation(),Le({message:g.reason,documentRef:r}));});};return r.addEventListener("click",o,true),{uninstall:()=>r.removeEventListener("click",o,true)}};var H=()=>{let e=new Map;return {read:t=>e.get(t)??null,write:(t,r)=>{e.set(t,r);},remove:t=>{e.delete(t);},keys:()=>[...e.keys()]}},Be=(e,t)=>({read:r=>{try{return e.getItem(t+r)}catch{return null}},write:(r,n)=>{try{e.setItem(t+r,n);}catch{}},remove:r=>{try{e.removeItem(t+r);}catch{}},keys:()=>{let r=[];try{for(let n=0;n<e.length;n++){let o=e.key(n);o&&o.startsWith(t)&&r.push(o.slice(t.length));}}catch{}return r}}),Ge="agtx:",We=()=>{let e=typeof window<"u",t=e&&typeof window.sessionStorage<"u"?Be(window.sessionStorage,Ge+"session:"):H(),r=e&&typeof window.localStorage<"u"?Be(window.localStorage,Ge+"user:"):H();return {session:t,user:r,org:H()}};var _e=(e,t)=>e.expiresAt!==null&&e.expiresAt<=t,Ue=e=>{if(!e)return null;try{let t=JSON.parse(e);return typeof t!="object"||t===null?null:t}catch{return null}},Xt=e=>JSON.stringify(e),Ke=(e={})=>{let t=We(),r=i=>{e.onTrace?.(i);};return {get:(i,g={})=>{let p=g.scope??"session",m=t[p],d=Ue(m.read(i));if(!d){r({type:"memory.accessed",metadata:{operation:"get",key:i,scope:p,hit:false}});return}if(_e(d,Date.now())){m.remove(i),r({type:"memory.accessed",metadata:{operation:"get",key:i,scope:p,hit:false,expired:true}});return}return r({type:"memory.accessed",metadata:{operation:"get",key:i,scope:p,hit:true}}),d.value},set:(i,g,p={})=>{let m=p.scope??"session",d=p.ttlSeconds??null,h=Date.now(),w={value:g,expiresAt:d===null?null:h+d*1e3,updatedAt:new Date(h).toISOString()};return t[m].write(i,Xt(w)),r({type:"memory.updated",metadata:{operation:"set",key:i,scope:m,ttlSeconds:d}}),MemoryEntry.parse({key:i,value:g,scope:m,ttlSeconds:d,updatedAt:w.updatedAt})},remove:(i,g={})=>{let p=g.scope??"session";t[p].remove(i),r({type:"memory.updated",metadata:{operation:"remove",key:i,scope:p}});},list:(i={})=>{let g=i.scope??"session",p=t[g],m=Date.now(),d=[];for(let h of p.keys()){let w=Ue(p.read(h));if(w){if(_e(w,m)){p.remove(h);continue}d.push(MemoryEntry.parse({key:h,value:w.value,scope:g,ttlSeconds:w.expiresAt===null?null:Math.max(0,Math.round((w.expiresAt-m)/1e3)),updatedAt:w.updatedAt}));}}return r({type:"memory.accessed",metadata:{operation:"list",scope:g,count:d.length}}),d},clear:(i={})=>{let g=i.scope??"session",p=t[g],m=p.keys().length;for(let d of p.keys())p.remove(d);r({type:"memory.updated",metadata:{operation:"clear",scope:g,count:m}});}}};var z=e=>SiteMemory.parse(JSON.parse(JSON.stringify(e))),G=e=>({...e,updatedAt:new Date().toISOString()}),He=(e={})=>{let t=SiteMemory.parse({...SITE_MEMORY_DEFAULT,...e.initial??{}}),r=null,n=new Set,o=u=>{e.onTrace?.(u);},a=()=>{r=null;},s=()=>{if(n.size===0)return;let u=z(t);r=u,n.forEach(v=>v(u));},l=u=>{let v=SiteMemory.parse({...t,...u,workflows:{...t.workflows,...u.workflows??{}},policies:{...t.policies,...u.policies??{}},uiGuidance:{...t.uiGuidance,...u.uiGuidance??{}},pageContexts:{...t.pageContexts,...u.pageContexts??{}}});return t=G(v),a(),o({type:"memory.updated",metadata:{kind:"site",operation:"provide",keys:Object.keys(u)}}),s(),p()},i=(u,v)=>{let x=u.split(".").filter(Boolean);if(x.length===0)throw new Error("siteMemory.update() requires a non-empty dot-path.");let k=JSON.parse(JSON.stringify(t)),I=k;for(let E=0;E<x.length-1;E++){let T=x[E],R=I[T];(typeof R!="object"||R===null||Array.isArray(R))&&(I[T]={}),I=I[T];}return I[x[x.length-1]]=v,t=G(SiteMemory.parse(k)),a(),o({type:"memory.updated",metadata:{kind:"site",operation:"update",path:u}}),s(),p()},g=u=>{let v=SiteMemoryPageContext.parse({path:u.path,payload:u.payload,updatedAt:new Date().toISOString()});return t=G({...t,pageContexts:{...t.pageContexts,[u.path]:v}}),a(),o({type:"memory.updated",metadata:{kind:"site",operation:"provideForPage",path:u.path}}),s(),{...v,payload:{...v.payload}}},p=()=>(r||(r=z(t)),r);return {provide:l,update:i,provideForPage:g,snapshot:p,get:u=>{if(o({type:"memory.accessed",metadata:{kind:"site",operation:u?"get":"snapshot",path:u??null}}),!u)return z(t);let v=u.split(".").filter(Boolean),x=t;for(let k of v){if(typeof x!="object"||x===null)return;x=x[k];}return x},getForPage:u=>{o({type:"memory.accessed",metadata:{kind:"site",operation:"getForPage",path:u}});let v=t.pageContexts[u];return v?{...v,payload:{...v.payload}}:null},replace:u=>(t=G(SiteMemory.parse(u)),a(),s(),p()),subscribe:u=>(n.add(u),()=>{n.delete(u);})}};var Ve=({gatewayUrl:e,siteId:t,publishableKey:r,fetcher:n=fetch})=>{let o={memory:null,etag:null};return {snapshot(){return {memory:o.memory?SiteMemory.parse(o.memory):null,etag:o.etag}},async sync(){let a=await n(`${e.replace(/\/$/,"")}/v1/sites/${encodeURIComponent(t)}/memory`,{headers:{authorization:`Bearer ${r}`,...o.etag?{"if-none-match":o.etag}:{}}});if(a.status===304)return this.snapshot();if(!a.ok)throw new Error(`Memory sync failed with status ${a.status}.`);let s=await a.json();return o={memory:SiteMemory.parse(s.memory??{}),etag:a.headers.get("etag")},this.snapshot()}}};var Zt=({toolName:e="getSiteContext",description:t="Returns Agentronics site memory: page map, workflows, policies, UI guidance.",getSnapshot:r,onAccess:n})=>({name:e,description:t,inputSchema:{type:"object",properties:{path:{type:"string",description:'Optional dot-path into the site memory (e.g. "workflows.purchase").'}},required:[]},invoke(o={}){let a=r(),s=o.path??null;if(n?.(s),!s)return {content:a};let l=s.split(".").filter(Boolean),i=a;for(let g of l){if(typeof i!="object"||i===null)return {content:void 0};i=i[g];}return {content:i}}});var A="agent-context-",V="agentronics-site-context",er=e=>{try{return JSON.stringify(e)}catch{return "{}"}},W=(e,t,r)=>{let n=e.querySelector(`meta[name="${t}"]`);n||(n=e.createElement("meta"),n.setAttribute("name",t),e.head.appendChild(n)),n.setAttribute("content",r);},N=(e,t)=>{e.querySelectorAll(`meta[name="${t}"]`).forEach(r=>r.remove());},F=({doc:e=typeof document>"u"?null:document,snapshot:t,schemaType:r="WebSite"})=>{if(!e)return {uninstall:()=>{}};W(e,`${A}version`,t.version),W(e,`${A}updated-at`,t.updatedAt??new Date().toISOString()),t.siteMap?.navigation?.flow&&W(e,`${A}flow`,t.siteMap.navigation.flow),W(e,`${A}workflows`,Object.keys(t.workflows).join(","));let n=e.getElementById(V);return n||(n=e.createElement("script"),n.type="application/ld+json",n.id=V,e.head.appendChild(n)),n.textContent=er({"@context":"https://schema.org","@type":r,name:"Agentronics Site Memory",agentronics:t}),{uninstall:()=>{N(e,`${A}version`),N(e,`${A}updated-at`),N(e,`${A}flow`),N(e,`${A}workflows`),e.getElementById(V)?.remove();}}};var Fe="agentronics-memory-overlay",tr=e=>`
-position: fixed;
-bottom: 16px;
-right: 16px;
-max-width: 320px;
-padding: 10px 12px;
-background: rgba(17, 24, 39, 0.92);
-color: #f9fafb;
-font: 12px/1.45 ui-monospace, SFMono-Regular, Menlo, monospace;
-border-radius: 8px;
-z-index: 2147483647;
-opacity: ${e?"0":"1"};
-pointer-events: ${e?"none":"auto"};
-box-shadow: 0 12px 32px rgba(15, 23, 42, 0.35);
-`,Je=e=>{let t=e.siteMap?.pages?.length??0,r=Object.keys(e.workflows).length,n=Object.keys(e.uiGuidance).length;return `Agentronics site memory \xB7 pages:${t} \xB7 workflows:${r} \xB7 ui-hints:${n}`},J=({doc:e=typeof document>"u"?null:document,snapshot:t,hidden:r=false})=>{if(!e)return {uninstall:()=>{},refresh:()=>{}};let n=e.getElementById(Fe);return n||(n=e.createElement("div"),n.id=Fe,n.setAttribute("role","note"),n.setAttribute("aria-label","Agentronics site memory summary"),n.setAttribute("data-agent-context","overlay"),e.body.appendChild(n)),n.setAttribute("style",tr(r)),n.textContent=Je(t),{uninstall:()=>{n?.remove();},refresh:o=>{n&&(n.textContent=Je(o));}}};var Xe="/.well-known/agent-context.json",q=async({origin:e,fetcher:t=fetch,signal:r}={})=>{let n=(e?e.replace(/\/$/,""):typeof window<"u"?window.location.origin:"")+Xe;if(!n.startsWith("http"))return null;let o={headers:{accept:"application/json"}};r!==void 0&&(o.signal=r);let a=await t(n,o);if(!a.ok){if(a.status===404)return null;throw new Error(`well-known agent-context fetch failed with status ${a.status}.`)}let s=await a.json();return SiteMemory.parse(s)},rr=({snapshot:e})=>JSON.stringify(SiteMemory.parse(e));var Ye=({evaluate:e,setPolicies:t,listPolicies:r,onTrace:n,identityResolver:o})=>{let a=new Map,s=new Set,l=i=>{if(!i.authz||!t||!r)return;let g={id:`tool:${i.name}`,tool:i.name,...i.authz,rateLimit:i.rateLimit??i.authz.rateLimit};t([...r().filter(p=>p.id!==g.id),g]);};return {register(i){return a.set(i.name,i),s.delete(i.name),l(i),n?.({type:"tool.registered",tool:i.name,metadata:{version:i.version??null,group:i.group??null,stage:i.stage??null}}),()=>{a.delete(i.name),s.delete(i.name);}},unregister(i){a.delete(i),s.delete(i);},enable(i){!a.has(i)||!s.has(i)||(s.delete(i),n?.({type:"tool.surfaced",tool:i,metadata:{state:"enabled"}}));},disable(i){!a.has(i)||s.has(i)||(s.add(i),n?.({type:"tool.surfaced",tool:i,metadata:{state:"disabled"}}));},isEnabled:i=>a.has(i)&&!s.has(i),list({includeDisabled:i=false}={}){let g=[...a.values()];return i?g:g.filter(p=>!s.has(p.name))},get:i=>a.get(i),async execute(i,g,p){let m=p===void 0?o?.()??null:p,d=a.get(i);if(!d)throw new Error(`Tool "${i}" is not registered.`);if(s.has(i)){let u={decision:"deny",ruleId:`tool:${i}`,reason:"Tool is disabled."};throw n?.({type:"tool.executed",tool:i,agent:m,policy:u,outcome:"blocked"}),new Error(u.reason)}let h=await e(i,{identity:m});if(h.decision==="deny")throw n?.({type:"tool.executed",tool:i,agent:m,policy:h,outcome:"blocked"}),new Error(h.reason);let w=Date.now();try{let u=await d.execute(g,{identity:m});return n?.({type:"tool.executed",tool:i,agent:m,policy:h,outcome:"success",durationMs:Date.now()-w}),u}catch(u){throw n?.({type:"tool.executed",tool:i,agent:m,policy:h,outcome:"error",durationMs:Date.now()-w,error:u instanceof Error?u.message:String(u)}),u}}}};var Qe=(e,t={})=>{let r=new Map;for(let s of e.stages)r.set(s.name,s);if(!r.has(e.initial))throw new Error(`Initial stage "${e.initial}" is not declared in progression stages.`);let n=e.initial,o=()=>{let s=r.get(n);return s?.enables?[n,...s.enables]:[n]},a=(s,l)=>{let i=n;if(!r.has(s))throw new Error(`Cannot transition to unknown stage "${s}".`);return s===n?{changed:false,from:i,to:s}:(n=s,t.onTrace?.({type:"tool.progressed",metadata:{from:i,to:s,trigger:l}}),{changed:true,from:i,to:s})};return {current:()=>n,enabledStages:()=>o(),notify(s){let i=r.get(n)?.transitions?.find(g=>g.on===s);return i?a(i.to,s):{changed:false,from:n,to:n}},set(s){return a(s,"manual")},reset(){let s=n;n=e.initial,s!==n&&t.onTrace?.({type:"tool.progressed",metadata:{from:s,to:n,trigger:"reset"}});},snapshot:()=>({current:n,enabled:o()})}};var nr=(e,t)=>{let r=e.authz?.minTrust;return r?t?TRUST_RANK[t.trust]<TRUST_RANK[r]?{ok:false,reason:`trust-too-low:${t.trust}<${r}`}:{ok:true,reason:"trust-ok"}:{ok:false,reason:`requires-trust:${r}`}:{ok:true,reason:"no-trust-floor"}},or=(e,t)=>{let r=e.authz?.allowedClasses??[];return r.length===0?{ok:true,reason:"no-class-restriction"}:t?r.includes(t.class)?{ok:true,reason:"class-ok"}:{ok:false,reason:`class-not-allowed:${t.class}`}:{ok:false,reason:`requires-class:${r.join("|")}`}},ir=(e,t)=>e.stage?t.enabledStages&&t.enabledStages.includes(e.stage)?{ok:true,reason:`stage-enabled:${e.stage}`}:t.stage===e.stage?{ok:true,reason:`stage-active:${e.stage}`}:{ok:false,reason:`stage-locked:${e.stage}`}:{ok:true,reason:"no-stage"},et=(e,t)=>{let r=nr(e,t.identity);if(!r.ok)return {tool:e,visible:false,reason:r.reason};let n=or(e,t.identity);if(!n.ok)return {tool:e,visible:false,reason:n.reason};let o=ir(e,t);return o.ok?e.authz?.decision==="deny"?{tool:e,visible:false,reason:"authz-deny"}:{tool:e,visible:true,reason:"visible"}:{tool:e,visible:false,reason:o.reason}},tt=(e,t)=>e.filter(r=>et(r,t).visible),rt=(e,t)=>e.map(r=>et(r,t));var nt="default",ot=e=>{let t=new Map;for(let r of e){let n=r.group??nt,o=t.get(n)??[];o.push(r),t.set(n,o);}return [...t.entries()].sort(([r],[n])=>r.localeCompare(n)).map(([r,n])=>({name:r,tools:n}))},so=e=>[...new Set(e.map(t=>t.group??nt))].sort();var X=e=>e===null||typeof e!="object"?JSON.stringify(e):Array.isArray(e)?`[${e.map(X).join(",")}]`:`{${Object.keys(e).sort().map(r=>`${JSON.stringify(r)}:${X(e[r])}`).join(",")}}`,sr=e=>{let t={name:e.name,version:e.version??null,group:e.group??null,description:e.description??null,inputSchema:e.inputSchema??null,authz:e.authz??null,rateLimit:e.rateLimit??null},r=X(t).length;return {name:e.name,characters:r,tokens:Math.ceil(r/4)}},it=e=>{let t=e.map(sr);return {total:t.reduce((n,o)=>n+o.tokens,0),perTool:t}};var st=e=>{if(e.provider)return e.provider;let r=(e.doc?.defaultView??(typeof globalThis<"u"?globalThis:null))?.navigator?.modelContext;return !r||typeof r.provideContext!="function"?null:r},ar=(e,t)=>{let r={name:e.name,invoke:n=>t(e,n)};return e.description!==void 0&&(r.description=e.description),e.inputSchema!==void 0&&(r.inputSchema=e.inputSchema),r},at=(e={})=>{let t=e.invoke??(async(n,o)=>n.execute(o,{identity:null})),r=null;return {publish(n){let o=st(e);return o?(r?.revoke(),r=o.provideContext({tools:n.map(a=>ar(a,t))}),{revoked:true}):{revoked:false}},revoke(){r?.revoke(),r=null;},available:()=>!!st(e)}};var Y=(e=500)=>{let t=[];return {add(r){t.push(r),t.length>e&&t.splice(0,t.length-e);},list(){return [...t]},clear(){t.length=0;}}};var ct=(e,t)=>e===void 0?t:Math.max(0,Math.min(1,e)),Q=(e={})=>{let t=ct(e.traceRate,1),r=ct(e.errorRate,1),n=e.random??Math.random;return {shouldKeep(o){let a=o.outcome==="error"?r:t;return n()<a}}};var cr="[REDACTED]",lr=e=>{if(e!==void 0)return JSON.parse(JSON.stringify(e))},Z=(e,t)=>{if(t.length===0||typeof e!="object"||e===null)return;let[r,...n]=t;if(!r)return;if(Array.isArray(e)){for(let a of e)Z(a,t);return}let o=e;if(r in o){if(n.length===0){o[r]=cr;return}Z(o[r],n);}},ee=(e,t=[])=>{if(t.length===0)return e;let r=lr(e);for(let n of t)Z(r,n.split(".").filter(Boolean));return r},te=["metadata.password","metadata.token","metadata.authorization","metadata.cookie"];var pr=()=>typeof location<"u"&&typeof location.pathname=="string"?location.pathname:void 0,lt=e=>{let t=globalThis.crypto;return t&&"randomUUID"in t?`${e}_${t.randomUUID()}`:`${e}_${Date.now().toString(36)}_${Math.random().toString(36).slice(2)}`},re=({siteId:e,bufferSize:t,sessionId:r=lt("ses"),scrubPaths:n=te,exporters:o=[],onExporterError:a,pageProvider:s=pr,...l})=>{let i=Y(t),g=Q(l),p=()=>{try{return s()}catch{return}};return {sessionId:r,async emit(m){let d={...m.metadata};if(d.page===void 0){let w=p();w!==void 0&&(d.page=w);}let h=TraceEvent.parse(ee({id:lt("trc"),siteId:e,sessionId:r,occurredAt:new Date().toISOString(),outcome:m.outcome??"success",...m,metadata:d},n));return g.shouldKeep(h)?(i.add(h),await Promise.all(o.map(async w=>{try{await w.export([h]);}catch(u){a?.(u,w,h);}})),h):null},list:()=>i.list(),clear:()=>i.clear()}};var ne=()=>({name:"console",export(e){for(let t of e)console.info("[agentronics:trace]",t.type,t);}});var oe=({gatewayUrl:e,publishableKey:t,fetcher:r=fetch})=>({name:"gateway",async export(n){let o={publishableKey:t,events:n};await r(`${e.replace(/\/$/,"")}/v1/traces`,{method:"POST",headers:{"content-type":"application/json",authorization:`Bearer ${t}`},body:JSON.stringify(o)});}});var dr=e=>new Promise(t=>setTimeout(t,e)),se=({url:e,fetcher:t=fetch,maxRetries:r=2,queueLimit:n=500})=>({name:"webhook",async export(o){let s=[...mr(e),...o].slice(-n),l=0;for(;;){let i=await t(e,{method:"POST",headers:{"content-type":"application/json"},body:JSON.stringify({events:s})});if(i.ok){ut(e,[]);return}if(l>=r)throw ut(e,s),new Error(`Webhook exporter failed with status ${i.status}.`);l+=1,await dr(100*l);}}}),ie=e=>`agtx:webhook:${e}`,mr=e=>{if(typeof window>"u"||!window.localStorage)return [];try{let t=window.localStorage.getItem(ie(e));return t?JSON.parse(t):[]}catch{return []}},ut=(e,t)=>{if(!(typeof window>"u"||!window.localStorage))try{if(t.length===0){window.localStorage.removeItem(ie(e));return}window.localStorage.setItem(ie(e),JSON.stringify(t));}catch{}};var ae=e=>{let t={name:e.name,description:e.description??"",inputSchema:e.inputSchema??{},tokens:0};return e.group&&(t.group=e.group),e.stage&&(t.page=e.stage),e.outputSchema&&(t.outputSchema=e.outputSchema),t.tokens=Math.ceil(JSON.stringify({name:t.name,description:t.description,inputSchema:t.inputSchema,...t.outputSchema?{outputSchema:t.outputSchema}:{}}).length/4),t},pt=({gatewayUrl:e,siteId:t,publishableKey:r,fetcher:n=fetch})=>({async push(o){let a=o.map(ae),s=await n(`${e.replace(/\/$/,"")}/v1/sites/${encodeURIComponent(t)}/tools`,{method:"PUT",headers:{authorization:`Bearer ${r}`,"content-type":"application/json"},body:JSON.stringify({registry:{tools:a}})});if(!s.ok)throw new Error(`Tool sync failed with status ${s.status}.`);return a.length}});var dt="/v1/sdk/events",mt=({url:e,ingestKey:t,fetcher:r=fetch})=>{let n=e.replace(/\/$/,""),o=n.endsWith(dt)?n:`${n}${dt}`;return {name:"intel",async export(a){let s={events:a},l=await r(o,{method:"POST",headers:{"content-type":"application/json",authorization:`Bearer ${t}`},body:JSON.stringify(s)});if(!l.ok)throw new Error(`Intel exporter failed with status ${l.status}.`)}}},yt=({url:e,ingestKey:t,siteId:r,fetcher:n=fetch})=>{let o=e.replace(/\/$/,""),a=async(s,l)=>{let i=await n(`${o}${s}`,{method:"POST",headers:{"content-type":"application/json",authorization:`Bearer ${t}`},body:JSON.stringify(l)});if(!i.ok)throw new Error(`Intel sync ${s} failed with status ${i.status}.`)};return {async pushTools(s){let l=s.map(ae);return await a("/v1/sdk/tools",{siteId:r,tools:l}),l.length},async pushMemory(s,l){await a("/v1/sdk/memory",{siteId:r,snapshot:s,...typeof l=="number"?{score:l}:{}});}}},yr=mt,gr=yt;var ft="https://gateway.agentronics.dev",vr=e=>{if(e===void 0)return ft;if(e===ft)return e;let t;try{t=new URL(e);}catch{throw new Error(`Agentronics SDK: \`gatewayUrl\` is not a valid URL: ${e}`)}if(t.hostname==="localhost"||t.hostname==="127.0.0.1")return e;throw new Error(`Agentronics SDK does not support custom gateway URLs. Omit \`gatewayUrl\` to use the canonical https://gateway.agentronics.dev. The only accepted override is a localhost / 127.0.0.1 URL for local development. Got: ${e}`)},ti=e=>{let{publishableKey:t,siteId:r="default",debug:n=false,policies:o=[],trace:a$1={}}=e,s=vr(e.gatewayUrl),l=classifyApiKey(t);if(l==="secret")throw new AgentronicsError("wrong_key_kind","A secret key was passed to Agentronics.init(). Browser code must use a publishable key (agtx_pk_*).");if(l!=="publishable")throw new AgentronicsError("invalid_api_key",`Agentronics.init() expected a key starting with "${PUBLISHABLE_KEY_PREFIX}".`);let i=a$1.enabled??true,g=[...n?[ne()]:[],...a$1.gateway?[oe({gatewayUrl:s,publishableKey:t})]:[],...a$1.webhookUrl?[se({url:a$1.webhookUrl})]:[],...a$1.exporters??[]],p={siteId:r,exporters:i?g:[],onExporterError:(c,y)=>{n&&console.warn(`[agentronics] trace exporter "${y.name}" failed`,c);}};a$1.bufferSize!==void 0&&(p.bufferSize=a$1.bufferSize),a$1.traceRate!==void 0&&(p.traceRate=a$1.traceRate),a$1.errorRate!==void 0&&(p.errorRate=a$1.errorRate),a$1.scrubPaths!==void 0&&(p.scrubPaths=a$1.scrubPaths);let m=re(p),d=c=>{i&&m.emit(c);},h=ye(),w={onTrace:d};e.auth!==void 0&&(w.context=e.auth);let u=Me(w),v=Ee(),x=De(o),k=$e({gatewayUrl:s,siteId:r,publishableKey:t}),I=Ke({onTrace:d}),E={onTrace:d};e.siteMemory!==void 0&&(E.initial=e.siteMemory);let T=He(E),R=Ve({gatewayUrl:s,siteId:r,publishableKey:t}),ht=pt({gatewayUrl:s,siteId:r,publishableKey:t}),B=async c=>{let y=Date.now(),S=await me(c),b=h.preferOver(S);return i&&await m.emit({type:b?"agent.detected":"agent.missed",agent:b,durationMs:Date.now()-y,metadata:{detectedClass:S?.class??null,presented:h.snapshot()!==null}}),v.set(b,"detect"),b},ce=async(c,y={})=>{let S=Date.now(),b=y.identity!==void 0?y.identity:await B(),U=x.evaluate({tool:c,identity:b});return i&&await m.emit({type:"authz.evaluated",tool:c,agent:b,policy:U,outcome:U.decision==="deny"?"blocked":"success",durationMs:Date.now()-S}),U},M=Ye({evaluate:ce,setPolicies:c=>x.set(c),listPolicies:()=>x.list(),onTrace:d,identityResolver:()=>v.snapshot().identity});for(let c of e.tools??[])M.register(c);let P=e.progression?Qe(e.progression,{onTrace:d}):null,le=c=>{let y={identity:c};return P&&(y.stage=P.current(),y.enabledStages=P.enabledStages()),y},O=c=>tt(M.list(),le(c)),ue=c=>{if(!P)return;P.notify(c).changed&&C.publish(O(v.snapshot().identity));},vt={class:"webmcp",trust:"detected",confidence:1,vendor:null,userAgent:typeof navigator<"u"?navigator.userAgent:null,detectionVersion:a,signals:{source:"navigator.modelContext"}},C=at({invoke:async(c,y)=>{let S=v.snapshot().identity??vt,b=await M.execute(c.name,y,S);return ue(c.name),b}});v.subscribe(c=>{C.available()&&C.publish(O(c.identity));});let _=e.autoDetect??true,wt=_===false?Promise.resolve(null):(async()=>{let c=_===true?{}:_;try{return await B(c)}catch(y){return n&&console.warn("[agentronics] autoDetect failed:",y),null}})();return Object.freeze({publishableKey:t,siteId:r,gatewayUrl:s,debug:n,memory:I,siteMemory:T,memoryCache:R,tracer:m,auth:u,agentContext:v,authz:x,policyCache:k,tools:M,progression:P,webmcp:C,ready:wt,detect:B,authenticate:async c=>{let y=await u.authenticate(c);return v.set(y,"authenticate"),y},presentIdentity:c=>{let y=h.present(c);return d({type:"auth.identity_presented",agent:y.identity,metadata:{vendor:y.identity.vendor,class:y.identity.class}}),v.set(y.identity,"declare"),y},clearIdentity:()=>{h.clear(),d({type:"auth.identity_cleared"}),v.set(null,"cleared");},presentedIdentity:()=>h.snapshot(),setPolicies:c=>{x.set(c),d({type:"authz.policies_set",metadata:{count:c.length}});},listPolicies:()=>x.list(),syncPolicies:async()=>{let c=await k.sync();return x.set(c.policies),d({type:"authz.policies_set",metadata:{count:c.policies.length,synced:true}}),c.policies},syncSiteMemory:async()=>{let c=await R.sync();return c.memory&&(T.replace(c.memory),d({type:"memory.updated",metadata:{kind:"site",operation:"sync",etag:c.etag}})),c.memory},provideSiteMemory:c=>T.provide(c),provideForPage:c=>{T.provideForPage(c);},installMemoryDelivery:({metaTags:c=true,overlay:y=false}={})=>{let S=[];return c&&S.push(F({snapshot:T.snapshot()})),y&&S.push(J({snapshot:T.snapshot()})),{uninstall:()=>{S.forEach(b=>b.uninstall());}}},fetchWellKnown:async c=>{let y={};c!==void 0&&(y.origin=c);let S=await q(y);return S&&(T.replace(S),d({type:"memory.updated",metadata:{kind:"site",operation:"wellKnown",origin:c??null}})),S},installDomEnforcer:()=>je({policyEngine:x,getIdentity:()=>B({webmcp:{pollMs:0}})}),registerTool:c=>M.register(c),syncTools:async()=>{let c=M.list({includeDisabled:true}),y=await ht.push(c);return d({type:"tool.registered",metadata:{operation:"sync",count:y}}),y},surfaceTools:({identity:c=null}={})=>O(c),explainSurfacing:({identity:c=null}={})=>rt(M.list(),le(c)),groupedTools:({identity:c=null}={})=>ot(O(c)),estimateTokens:({identity:c=null}={})=>it(O(c)),publishToWebMcp:({identity:c=null}={})=>{let y=O(c),S=C.publish(y);return y.forEach(b=>{d({type:"tool.surfaced",tool:b.name,metadata:{state:"published",trust:c?.trust??null,group:b.group??null}});}),{revoked:S.revoked,surfaced:y.length}},notifyToolInvoked:c=>ue(c),evaluate:ce,traces:()=>m.list(),clearTraces:()=>m.clear(),async ping(){try{let c=await fetch(`${s.replace(/\/$/,"")}/v1/health`,{method:"GET",headers:{authorization:`Bearer ${t}`}});if(!c.ok)return {ok:!1,status:c.status,error:`gateway returned ${c.status}`};let y=await c.json().catch(()=>null)??{};return {ok:!0,status:c.status,body:y}}catch(c){return {ok:false,status:0,error:c instanceof Error?c.message:String(c)}}}})};
-export{rr as A,Ye as B,Qe as C,et as D,tt as E,rt as F,nt as G,ot as H,so as I,sr as J,it as K,at as L,Y as M,re as N,ne as O,oe as P,se as Q,mt as R,yt as S,yr as T,gr as U,ti as V,pe as a,$ as b,L as c,de as d,K as e,Rt as f,Pt as g,me as h,ye as i,Vr as j,fe as k,Me as l,Ee as m,Re as n,De as o,$e as p,Le as q,je as r,Ke as s,He as t,Ve as u,Zt as v,F as w,J as x,Xe as y,q as z};//# sourceMappingURL=chunk-Y7JYD5RA.js.map
-//# sourceMappingURL=chunk-Y7JYD5RA.js.map