@anis-ly/partners 0.0.0-stage → 1.0.0

package/dist/index.js.map

@@ -0,0 +1 @@
+{"version":3,"sources":["../src/internal/uuid.ts","../src/signing/keyed-signer.ts","../src/signing/pem-p256-signer.ts","../src/internal/bytes.ts","../src/errors/anis-partners-error.ts","../src/errors/private-key-error.ts","../src/signing/request-signing-error.ts","../src/enrollment/key-thumbprint.ts","../src/internal/base64url.ts","../src/enrollment/safety-code.ts","../src/enrollment/enrollment-proof.ts","../src/models/model-parsing.ts","../src/models/enrollment.ts","../src/operations/partner-transport.ts","../src/errors/error-codes.generated.ts","../src/models/problem.ts","../src/internal/retry-after.ts","../src/errors/anis-api-error.ts","../src/signing/content-digest.ts","../src/signing/partner-request-signer.ts","../src/signing/signature-profile.ts","../src/signing/signature-inputs.ts","../src/signing/partner-request-signature-base.ts","../src/verification/partner-response-verifier.ts","../src/internal/clock.ts","../src/verification/signature-input-parser.ts","../src/verification/partner-response-signature-base.ts","../src/verification/unverifiable-response-error.ts","../src/internal/safe-telemetry.ts","../src/observability/telemetry-names.ts","../src/operations/partner-routes.ts","../src/signing/nonce-factory.ts","../src/errors/malformed-response-error.ts","../src/errors/signing-key-document-unavailable-error.ts","../src/client-options.ts","../src/verification/http-signing-key-source.ts","../src/verification/partner-jwk.ts","../src/enrollment/enrollment-client.ts","../src/models/money.ts","../src/models/catalogue.ts","../src/models/cards.ts","../src/models/orders.ts","../src/models/wallets.ts","../src/operations/operations.ts","../src/client.ts"],"sourcesContent":["/**\n * Validates a UUID and returns its canonical lower-case D form.\n *\n * @remarks Request `keyid` and operation identity have one wire spelling; canonicalizing once prevents the base and\n * emitted headers from describing different requests.\n */\nexport function canonicalUuid(value: string, argumentName = 'UUID'): string {\n  if (!/^[0-9a-fA-F]{8}-[0-9a-fA-F]{4}-[0-9a-fA-F]{4}-[0-9a-fA-F]{4}-[0-9a-fA-F]{12}$/.test(value)) {\n    throw new TypeError(`${argumentName} must be a canonical UUID.`);\n  }\n  return value.toLowerCase();\n}\n","import type { P256Signer, RequestSigner } from './p256-signer.js';\nimport { canonicalUuid } from '../internal/uuid.js';\n\n/**\n * Associates an external signer with the credential UUID used in request signatures.\n *\n * @remarks Keeping key custody behind the byte-signing seam lets a partner use a vault or HSM without exporting its\n * private key into this process.\n */\nexport class KeyedSigner implements RequestSigner {\n  /** The enrolled credential identifier, canonicalized so Anis can resolve it. */\n  readonly keyId: string;\n\n  /** Creates a binding; canonical identity avoids a valid signature that names an unknown credential. */\n  constructor(\n    private readonly signer: P256Signer,\n    keyId: string,\n  ) {\n    this.keyId = canonicalUuid(keyId, 'keyId');\n  }\n  /** Signs exact bytes through partner-owned key custody without exposing key material. */\n  sign(data: Uint8Array): Promise<Uint8Array> {\n    return this.signer.sign(data);\n  }\n}\n","import { readFile } from 'node:fs/promises';\nimport { KeyedSigner } from './keyed-signer.js';\nimport type { P256Signer } from './p256-signer.js';\nimport type { PartnerJwk } from '../verification/partner-jwk.js';\nimport { arrayBufferOf } from '../internal/bytes.js';\nimport { PrivateKeyError } from '../errors/private-key-error.js';\n\n/**\n * Signs with a P-256 PKCS#8 key held in this process.\n *\n * @remarks This file-backed option is suitable when the host protects the key file; `P256Signer` remains the seam for\n * a vault or HSM that never releases key material.\n */\nexport class PemP256Signer implements P256Signer {\n  readonly #privateKey: CryptoKey;\n  private constructor(\n    private readonly publicKey: CryptoKey,\n    privateKey: CryptoKey,\n  ) {\n    this.#privateKey = privateKey;\n  }\n\n  /** Imports a PKCS#8 PEM key and refuses other curves at load time, before a partner receives an avoidable refusal. */\n  static async fromPem(pem: string): Promise<PemP256Signer> {\n    if (typeof pem !== 'string') throw new PrivateKeyError('The private key must be supplied as PEM text.');\n    const normalized = pem.replace(/^\\uFEFF/, '').trim();\n    if (normalized.includes('-----BEGIN ENCRYPTED PRIVATE KEY-----'))\n      throw new PrivateKeyError('Encrypted PEM keys are not supported; decrypt the key before loading it.');\n    if (normalized.includes('-----BEGIN EC PRIVATE KEY-----'))\n      throw new PrivateKeyError('SEC1 PEM keys are not supported; convert to PKCS#8 before loading the key.');\n    const match = /-----BEGIN PRIVATE KEY-----\\s*([A-Za-z0-9+/=\\r\\n]+)\\s*-----END PRIVATE KEY-----/.exec(normalized);\n    if (!match?.[1]) throw new PrivateKeyError('Expected a PKCS#8 PEM block labeled PRIVATE KEY.');\n    const pkcs8 = Buffer.from(match[1].replace(/\\s/g, ''), 'base64');\n    try {\n      const extractableKey = await globalThis.crypto.subtle.importKey(\n        'pkcs8',\n        pkcs8,\n        { name: 'ECDSA', namedCurve: 'P-256' },\n        true,\n        ['sign'],\n      );\n      const jwk = await globalThis.crypto.subtle.exportKey('jwk', extractableKey);\n      if (!jwk.x || !jwk.y) throw new PrivateKeyError('The private key did not export public coordinates.');\n      const publicKey = await globalThis.crypto.subtle.importKey(\n        'jwk',\n        { kty: 'EC', crv: 'P-256', x: jwk.x, y: jwk.y, ext: true },\n        { name: 'ECDSA', namedCurve: 'P-256' },\n        true,\n        ['verify'],\n      );\n      const privateKey = await globalThis.crypto.subtle.importKey(\n        'pkcs8',\n        pkcs8,\n        { name: 'ECDSA', namedCurve: 'P-256' },\n        false,\n        ['sign'],\n      );\n      return new PemP256Signer(publicKey, privateKey);\n    } catch (cause) {\n      throw new PrivateKeyError('The PEM key must be a valid ECDSA P-256 PKCS#8 private key.', { cause });\n    } finally {\n      pkcs8.fill(0);\n    }\n  }\n\n  /** Reads and imports a protected PKCS#8 PEM file so the private key can remain in host-controlled storage. */\n  static async fromPemFile(path: string): Promise<PemP256Signer> {\n    try {\n      return await this.fromPem(await readFile(path, 'utf8'));\n    } catch (cause) {\n      if (cause instanceof PrivateKeyError) throw cause;\n      throw new PrivateKeyError('The PEM key file could not be read.', { cause });\n    }\n  }\n  /** Signs bytes in WebCrypto's 64-byte P1363 form; no DER conversion can silently change the wire signature. */\n  async sign(data: Uint8Array): Promise<Uint8Array> {\n    try {\n      return new Uint8Array(\n        await globalThis.crypto.subtle.sign({ name: 'ECDSA', hash: 'SHA-256' }, this.#privateKey, arrayBufferOf(data)),\n      );\n    } catch (cause) {\n      throw new PrivateKeyError('The in-memory P-256 private key could not sign the request.', { cause });\n    }\n  }\n  /** Exports only public coordinates for enrollment and verification; the private half is never part of the JWK. */\n  async publicJwk(): Promise<PartnerJwk> {\n    try {\n      const jwk = await globalThis.crypto.subtle.exportKey('jwk', this.publicKey);\n      return {\n        kty: 'EC',\n        crv: 'P-256',\n        ...(jwk.x === undefined ? {} : { x: jwk.x }),\n        ...(jwk.y === undefined ? {} : { y: jwk.y }),\n      };\n    } catch (cause) {\n      throw new PrivateKeyError('The P-256 public key could not be exported.', { cause });\n    }\n  }\n  /** Binds this key to the issued credential UUID used by Anis to resolve request signatures. */\n  forKey(keyId: string): KeyedSigner {\n    return new KeyedSigner(this, keyId);\n  }\n}\n","import { timingSafeEqual } from 'node:crypto';\n\n/** Compares byte strings without stopping at the first differing byte. */\nexport function fixedTimeEqual(left: Uint8Array, right: Uint8Array): boolean {\n  return left.length === right.length && timingSafeEqual(left, right);\n}\n\n/** Copies bytes into an ArrayBuffer accepted by WebCrypto's strict DOM typings. */\nexport function arrayBufferOf(bytes: Uint8Array): ArrayBuffer {\n  const copy = new Uint8Array(bytes.byteLength);\n  copy.set(bytes);\n  return copy.buffer;\n}\n","const errorBrandPrefix = '@anis-ly/partners.error:';\n\n/** Base type for failures raised by this SDK, so applications can handle local faults separately from HTTP refusals. */\nexport class AnisPartnersError extends Error {\n  constructor(message: string, options?: ErrorOptions) {\n    super(message, options);\n    let prototype: object = new.target.prototype;\n    while (prototype !== Error.prototype && prototype !== Object.prototype) {\n      const constructorName = (prototype.constructor as { name?: string }).name ?? 'AnisPartnersError';\n      Object.defineProperty(this, Symbol.for(`${errorBrandPrefix}${constructorName}`), { value: true });\n      const parent = Object.getPrototypeOf(prototype) as object | null;\n      if (parent === null) break;\n      prototype = parent;\n    }\n    this.name = new.target.name;\n  }\n\n  static override [Symbol.hasInstance](value: unknown): boolean {\n    if (typeof value !== 'object' || value === null) return false;\n    return (value as Record<symbol, unknown>)[Symbol.for(`${errorBrandPrefix}${this.name}`)] === true;\n  }\n\n  [inspect.custom](): string {\n    return `${this.name}: ${this.message}`;\n  }\n}\nimport { inspect } from 'node:util';\n","import { AnisPartnersError } from './anis-partners-error.js';\n\n/** Describes a local private-key loading or signing failure without exposing private key material. */\nexport class PrivateKeyError extends AnisPartnersError {}\n","import { AnisPartnersError } from '../errors/anis-partners-error.js';\n\n/** Indicates signing failed before a request was sent, so the partner can safely distinguish it from a server outcome. */\nexport class RequestSigningError extends AnisPartnersError {\n  /** Preserves the original signer failure as `cause` while keeping sensitive signature material out of the message. */\n  constructor(cause: unknown) {\n    super('The request could not be signed and was not sent.', { cause });\n  }\n}\n","import { createHash } from 'node:crypto';\nimport { decodeBase64Url, encodeBase64Url } from '../internal/base64url.js';\nimport type { PartnerJwk } from '../verification/partner-jwk.js';\n\n/**\n * Computes the RFC 7638 fingerprint used to confirm the submitted key.\n *\n * @remarks Computing locally and comparing with Anis's answer catches a changed public key before a partner proves\n * possession of the wrong key.\n */\nexport function keyThumbprint(publicJwk: PartnerJwk): string {\n  if (publicJwk.kty !== 'EC' || publicJwk.crv !== 'P-256')\n    throw new TypeError('The key must be a public EC P-256 JWK.');\n  const x = publicJwk.x;\n  const y = publicJwk.y;\n  if (!x || !y) throw new TypeError('A P-256 public key must include both coordinates.');\n  for (const [name, value] of [\n    ['x', x],\n    ['y', y],\n  ] as const)\n    if (decodeBase64Url(value)?.length !== 32)\n      throw new TypeError(`The JWK member \"${name}\" must be a 32-byte base64url coordinate.`);\n  const canonical = `{\"crv\":\"P-256\",\"kty\":\"EC\",\"x\":\"${x}\",\"y\":\"${y}\"}`;\n  return encodeBase64Url(createHash('sha256').update(canonical, 'utf8').digest());\n}\n","/**\n * Encodes bytes using RFC 4648 base64url without padding.\n *\n * @remarks Padding and the standard Base64 alphabet are not accepted for nonces, coordinates, thumbprints, or proofs.\n */\nexport function encodeBase64Url(bytes: Uint8Array): string {\n  return Buffer.from(bytes).toString('base64url');\n}\n\n/**\n * Decodes only strict unpadded base64url strings.\n *\n * @remarks Returning no value for padding or non-url characters keeps wire values in the single form Anis verifies.\n */\nexport function decodeBase64Url(value: string | null | undefined): Uint8Array | undefined {\n  if (!value || value.length % 4 === 1 || !/^[A-Za-z0-9_-]+$/.test(value)) return undefined;\n  try {\n    const decoded = Buffer.from(value, 'base64url');\n    return decoded.toString('base64url') === value ? new Uint8Array(decoded) : undefined;\n  } catch {\n    return undefined;\n  }\n}\n","import { decodeBase64Url } from '../internal/base64url.js';\nimport { fixedTimeEqual } from '../internal/bytes.js';\n\nconst alphabet = '0123456789ABCDEFGHJKMNPQRSTVWXYZ';\n\n/** Converts a locally checked thumbprint into the code read to Anis staff. */\nexport function safetyCodeFromThumbprint(thumbprint: string): string {\n  const bytes = decodeBase64Url(thumbprint);\n  if (bytes?.length !== 32) throw new TypeError('A thumbprint must encode 32 bytes.');\n  let buffer = 0;\n  let bits = 0;\n  let code = '';\n  for (const value of bytes.subarray(0, 10)) {\n    buffer = (buffer << 8) | value;\n    bits += 8;\n    while (bits >= 5) {\n      bits -= 5;\n      code += alphabet.charAt((buffer >> bits) & 31);\n    }\n    buffer &= (1 << bits) - 1;\n  }\n  return `${code.slice(0, 4)}-${code.slice(4, 8)}-${code.slice(8, 12)}-${code.slice(12)}`;\n}\n\n/** @internal Compares a caller-entered safety code or complete thumbprint. */\nexport function safetyCodeMatches(entered: string | null | undefined, thumbprint: string): boolean {\n  const raw = (entered ?? '').trim();\n  const candidate = raw.replace(/[ -]/g, '').toUpperCase().replaceAll('O', '0').replace(/[IL]/g, '1');\n  const expected = candidate.length === 16 ? safetyCodeFromThumbprint(thumbprint).replaceAll('-', '') : thumbprint;\n  return fixedTimeEqual(\n    new TextEncoder().encode(candidate.length === 16 ? candidate : raw),\n    new TextEncoder().encode(expected),\n  );\n}\n","import { createHash } from 'node:crypto';\nimport { canonicalUuid } from '../internal/uuid.js';\nimport { encodeBase64Url } from '../internal/base64url.js';\nimport type { P256Signer } from '../signing/p256-signer.js';\nimport { RequestSigningError } from '../signing/request-signing-error.js';\n\n/**\n * Domain separator checked by Anis when verifying credential possession.\n *\n * @remarks Including a distinct first line prevents a credential proof from being reused as another signature type.\n */\nexport const DOMAIN_SEPARATOR = 'anis.partners.v2.credential-proof';\n\n/** Builds the exact domain-separated UTF-8 proof message so both sides hash the challenge and bind the same credential. */\nexport function proofMessage(\n  keyId: string,\n  challengeGeneration: number,\n  challenge: string,\n  thumbprint: string,\n): Uint8Array {\n  if (challenge.length === 0) throw new TypeError('An enrollment challenge is required for a possession proof.');\n  if (thumbprint.length === 0) throw new TypeError('A key thumbprint is required for a possession proof.');\n  const hash = createHash('sha256').update(challenge, 'utf8').digest('hex');\n  return new TextEncoder().encode(\n    [DOMAIN_SEPARATOR, canonicalUuid(keyId, 'keyId'), String(challengeGeneration), hash, thumbprint].join('\\n'),\n  );\n}\n\n/** Signs the proof message and returns unpadded base64url P1363 bytes; DER would be refused at the proof endpoint. */\nexport async function proofSignature(message: Uint8Array, signer: P256Signer): Promise<string> {\n  let signature: Uint8Array;\n  try {\n    signature = await signer.sign(message);\n  } catch (cause) {\n    throw new RequestSigningError(cause);\n  }\n  if (!(signature instanceof Uint8Array) || signature.length !== 64)\n    throw new RequestSigningError(new Error('An enrollment proof signer must return 64-byte P-256 P1363 bytes.'));\n  return encodeBase64Url(signature);\n}\n","import * as uuidModule from '../internal/uuid.js';\n\n/** Shared runtime checks used by the wire model parsers. */\nexport type JsonObject = Record<string, unknown>;\n\n/** Requires an object so malformed JSON cannot silently become a partially empty model. */\nexport function asObject(value: unknown, label: string): JsonObject {\n  if (typeof value !== 'object' || value === null || Array.isArray(value)) {\n    throw new TypeError(`${label} must be a JSON object.`);\n  }\n  return value as JsonObject;\n}\n\n/** Reads a required string field. */\nexport function requiredString(object: JsonObject, field: string, label: string): string {\n  const value = object[field];\n  if (typeof value !== 'string') {\n    throw new TypeError(`${label}.${field} must be a string.`);\n  }\n  return value;\n}\n\n/** Reads an optional string field; a missing or null member stays absent. */\nexport function optionalString(object: JsonObject, field: string, label: string): string | undefined {\n  const value = object[field];\n  if (value === undefined || value === null) {\n    return undefined;\n  }\n  if (typeof value !== 'string') {\n    throw new TypeError(`${label}.${field} must be a string when present.`);\n  }\n  return value;\n}\n\n/** Reads a required canonical UUID field. */\nexport function requiredUuid(object: JsonObject, field: string, label: string): string {\n  const { canonicalUuid } = uuidModule;\n  return canonicalUuid(requiredString(object, field, label), `${label}.${field}`);\n}\n\n/** Reads an optional UUID field. */\nexport function optionalUuid(object: JsonObject, field: string, label: string): string | undefined {\n  const value = optionalString(object, field, label);\n  return value === undefined ? undefined : uuidModule.canonicalUuid(value, `${label}.${field}`);\n}\n\n/** Reads an optional timestamp as a valid Date. */\nexport function optionalTimestamp(object: JsonObject, field: string, label: string): Date | undefined {\n  const value = optionalString(object, field, label);\n  if (value === undefined) {\n    return undefined;\n  }\n  const result = new Date(value);\n  if (!isStrictIsoTimestamp(value) || Number.isNaN(result.getTime())) {\n    throw new TypeError(`${label}.${field} must be a valid timestamp.`);\n  }\n  return result;\n}\n\nfunction isStrictIsoTimestamp(value: string): boolean {\n  const match =\n    /^(\\d{4})-(\\d{2})-(\\d{2})T([01]\\d|2[0-3]):[0-5]\\d:[0-5]\\d(?:\\.\\d+)?(?:Z|[+-](?:[01]\\d|2[0-3]):[0-5]\\d)$/.exec(\n      value,\n    );\n  if (match === null) return false;\n  const year = Number(match[1]);\n  const month = Number(match[2]);\n  const day = Number(match[3]);\n  const daysInMonth = new Date(Date.UTC(year, month, 0)).getUTCDate();\n  return month >= 1 && month <= 12 && day >= 1 && day <= daysInMonth;\n}\n\n/** Reads an optional integer field. */\nexport function optionalInteger(object: JsonObject, field: string, label: string): number | undefined {\n  const value = object[field];\n  if (value === undefined || value === null) {\n    return undefined;\n  }\n  if (typeof value !== 'number' || !Number.isInteger(value)) {\n    throw new TypeError(`${label}.${field} must be an integer when present.`);\n  }\n  return value;\n}\n\n/** Reads an optional boolean field. */\nexport function optionalBoolean(object: JsonObject, field: string, label: string): boolean | undefined {\n  const value = object[field];\n  if (value === undefined || value === null) {\n    return undefined;\n  }\n  if (typeof value !== 'boolean') {\n    throw new TypeError(`${label}.${field} must be a boolean when present.`);\n  }\n  return value;\n}\n","import {\n  asObject,\n  optionalInteger,\n  optionalString,\n  optionalTimestamp,\n  optionalUuid,\n  requiredUuid,\n} from './model-parsing.js';\nimport type { PartnerJwk } from '../verification/partner-jwk.js';\n\n/** Invitation state as reported by the enrollment surface. */\nexport interface EnrollmentState {\n  /** Invitation UUID, when known. */\n  invitationId?: string;\n  /** Application UUID being enrolled. */\n  applicationId?: string;\n  /** Current invitation workflow state. */\n  state?: string;\n  /** Invitation expiry instant. */\n  expiresAt?: Date;\n}\n\n/**\n * Public key and requested validity window submitted during enrollment.\n *\n * @remarks Submit only the public half: sending private key material is refused by Anis and would expose signing\n * credentials outside the partner's key custody.\n */\nexport interface EnrollmentKeyRequest {\n  /** Public P-256 JWK only; private members are refused by Anis. */\n  publicJwk: PartnerJwk;\n  /** Requested beginning of the validity window. */\n  notBefore: Date;\n  /** Requested end of the validity window. */\n  expiresAt: Date;\n}\n\n/**\n * Key submission answer containing the challenge that must be signed.\n *\n * @remarks The local thumbprint check ties Anis's challenge and safety code to the key the partner actually submitted;\n * do not trust a safety code copied from an unverified answer.\n */\nexport interface EnrollmentKeyResult {\n  /** Credential UUID that becomes the request key id when active. */\n  keyId: string;\n  /** Server-computed RFC 7638 thumbprint, compared against the submitted public key. */\n  thumbprint?: string;\n  /** Safety code derived locally from the verified key thumbprint. */\n  safetyCode?: string;\n  /** Challenge whose domain-separated message proves possession of the private key. */\n  challenge?: string;\n  /** Challenge generation, incremented when Anis reissues the challenge. */\n  challengeGeneration?: number;\n}\n\n/** Proof request for the current enrollment challenge generation. */\nexport interface EnrollmentProofRequest {\n  /** Credential UUID whose challenge is being answered. */\n  keyId: string;\n  /** Generation that Anis currently expects. */\n  challengeGeneration: number;\n  /** P-256/P1363 signature in unpadded base64url form. */\n  signature: string;\n}\n\n/**\n * Enrollment proof and staff-approval state.\n *\n * @remarks A successful proof can remain pending until Anis staff verify the safety code. That approval is a control\n * on activation, not a state to work around.\n */\nexport interface EnrollmentStatus {\n  /** Credential UUID, when the invitation has accepted a key. */\n  keyId?: string;\n  /** Current challenge generation. */\n  challengeGeneration?: number;\n  /** Proof workflow state. */\n  proofState?: string;\n  /** Staff approval state. */\n  approvalState?: string;\n  /** Overall enrollment state. */\n  state?: string;\n  /** Current workflow-step expiry instant. */\n  expiresAt?: Date;\n  /** Credential validity end instant after activation. */\n  keyExpiresAt?: Date;\n}\n\n/** Facts the signature self-check reports about how the gateway interpreted a request. */\nexport interface SignatureDiagnostic {\n  /** Matched route identifier. */\n  routeId?: string;\n  /** HTTP method received by the gateway. */\n  method?: string;\n  /** Authority received by the gateway. */\n  authority?: string;\n  /** Path received by the gateway. */\n  path?: string;\n  /** Query without its leading question mark. */\n  canonicalQuery?: string;\n  /** Kind assigned by the route table. */\n  requestKind?: string;\n  /** Required permission for the route. */\n  requiredScope?: string;\n  /** Covered components required by the matched profile. */\n  coveredComponents: readonly string[];\n  /** Credential UUID named by the request. */\n  keyId?: string;\n  /** Partner UUID resolved from that credential. */\n  partnerId?: string;\n  /** Application UUID resolved from that credential. */\n  applicationId?: string;\n  /** Policy version applied. */\n  policyVersion?: number;\n  /** Scopes currently in effect. */\n  effectiveScopes: readonly string[];\n  /** Instant the gateway received the request. */\n  receivedAt?: Date;\n}\n\n/** Parses an enrollment invitation state. */\nexport function parseEnrollmentState(json: unknown): EnrollmentState {\n  const object = asObject(json, 'EnrollmentState');\n  const invitationId = optionalUuid(object, 'invitationId', 'EnrollmentState');\n  const applicationId = optionalUuid(object, 'applicationId', 'EnrollmentState');\n  const state = optionalString(object, 'state', 'EnrollmentState');\n  const expiresAt = optionalTimestamp(object, 'expiresAt', 'EnrollmentState');\n  return {\n    ...(invitationId === undefined ? {} : { invitationId }),\n    ...(applicationId === undefined ? {} : { applicationId }),\n    ...(state === undefined ? {} : { state }),\n    ...(expiresAt === undefined ? {} : { expiresAt }),\n  };\n}\n\n/** Parses a key submission challenge answer. */\nexport function parseEnrollmentKeyResult(json: unknown): EnrollmentKeyResult {\n  const object = asObject(json, 'EnrollmentKeyResult');\n  const keyId = requiredUuid(object, 'keyId', 'EnrollmentKeyResult');\n  const thumbprint = optionalString(object, 'thumbprint', 'EnrollmentKeyResult');\n  const safetyCode = optionalString(object, 'safetyCode', 'EnrollmentKeyResult');\n  const challenge = optionalString(object, 'challenge', 'EnrollmentKeyResult');\n  const challengeGeneration = optionalInteger(object, 'challengeGeneration', 'EnrollmentKeyResult');\n  return {\n    keyId,\n    ...(thumbprint === undefined ? {} : { thumbprint }),\n    ...(safetyCode === undefined ? {} : { safetyCode }),\n    ...(challenge === undefined ? {} : { challenge }),\n    ...(challengeGeneration === undefined ? {} : { challengeGeneration }),\n  };\n}\n\n/** Parses an enrollment status while keeping newly optional dates absent. */\nexport function parseEnrollmentStatus(json: unknown): EnrollmentStatus {\n  const object = asObject(json, 'EnrollmentStatus');\n  const keyId = optionalUuid(object, 'keyId', 'EnrollmentStatus');\n  const challengeGeneration = optionalInteger(object, 'challengeGeneration', 'EnrollmentStatus');\n  const proofState = optionalString(object, 'proofState', 'EnrollmentStatus');\n  const approvalState = optionalString(object, 'approvalState', 'EnrollmentStatus');\n  const state = optionalString(object, 'state', 'EnrollmentStatus');\n  const expiresAt = optionalTimestamp(object, 'expiresAt', 'EnrollmentStatus');\n  const keyExpiresAt = optionalTimestamp(object, 'keyExpiresAt', 'EnrollmentStatus');\n  return {\n    ...(keyId === undefined ? {} : { keyId }),\n    ...(challengeGeneration === undefined ? {} : { challengeGeneration }),\n    ...(proofState === undefined ? {} : { proofState }),\n    ...(approvalState === undefined ? {} : { approvalState }),\n    ...(state === undefined ? {} : { state }),\n    ...(expiresAt === undefined ? {} : { expiresAt }),\n    ...(keyExpiresAt === undefined ? {} : { keyExpiresAt }),\n  };\n}\n\n/** Parses diagnostic facts and defaults missing collections to empty arrays for straightforward partner checks. */\nexport function parseSignatureDiagnostic(json: unknown): SignatureDiagnostic {\n  const object = asObject(json, 'SignatureDiagnostic');\n  const routeId = optionalString(object, 'routeId', 'SignatureDiagnostic');\n  const method = optionalString(object, 'method', 'SignatureDiagnostic');\n  const authority = optionalString(object, 'authority', 'SignatureDiagnostic');\n  const path = optionalString(object, 'path', 'SignatureDiagnostic');\n  const canonicalQuery = optionalString(object, 'canonicalQuery', 'SignatureDiagnostic');\n  const requestKind = optionalString(object, 'requestKind', 'SignatureDiagnostic');\n  const requiredScope = optionalString(object, 'requiredScope', 'SignatureDiagnostic');\n  const coveredComponents = stringArray(object.coveredComponents, 'SignatureDiagnostic.coveredComponents');\n  const keyId = optionalUuid(object, 'keyId', 'SignatureDiagnostic');\n  const partnerId = optionalUuid(object, 'partnerId', 'SignatureDiagnostic');\n  const applicationId = optionalUuid(object, 'applicationId', 'SignatureDiagnostic');\n  const policyVersion = optionalInteger(object, 'policyVersion', 'SignatureDiagnostic');\n  const effectiveScopes = stringArray(object.effectiveScopes, 'SignatureDiagnostic.effectiveScopes');\n  const receivedAt = optionalTimestamp(object, 'receivedAt', 'SignatureDiagnostic');\n  return {\n    coveredComponents,\n    effectiveScopes,\n    ...(routeId === undefined ? {} : { routeId }),\n    ...(method === undefined ? {} : { method }),\n    ...(authority === undefined ? {} : { authority }),\n    ...(path === undefined ? {} : { path }),\n    ...(canonicalQuery === undefined ? {} : { canonicalQuery }),\n    ...(requestKind === undefined ? {} : { requestKind }),\n    ...(requiredScope === undefined ? {} : { requiredScope }),\n    ...(keyId === undefined ? {} : { keyId }),\n    ...(partnerId === undefined ? {} : { partnerId }),\n    ...(applicationId === undefined ? {} : { applicationId }),\n    ...(policyVersion === undefined ? {} : { policyVersion }),\n    ...(receivedAt === undefined ? {} : { receivedAt }),\n  };\n}\n\nfunction stringArray(value: unknown, label: string): readonly string[] {\n  const items = value ?? [];\n  if (!Array.isArray(items) || !items.every((item): item is string => typeof item === 'string')) {\n    throw new TypeError(`${label} must be an array of strings.`);\n  }\n  return items;\n}\n","import { SpanStatusCode } from '@opentelemetry/api';\nimport { AnisApiError, createAnisApiError } from '../errors/anis-api-error.js';\nimport { contentDigestOf } from '../signing/content-digest.js';\nimport type { RequestSigner } from '../signing/p256-signer.js';\nimport { PartnerRequestSigner } from '../signing/partner-request-signer.js';\nimport type { SignatureProfile } from '../signing/signature-profile.js';\nimport { PartnerResponseVerifier } from '../verification/partner-response-verifier.js';\nimport type { SigningKeySource } from '../verification/signing-key-source.js';\nimport type { ValidatedClientOptions } from '../client-options.js';\nimport { PARTNER_ROUTES } from './partner-routes.js';\nimport { RandomNonceFactory, type NonceFactory } from '../signing/nonce-factory.js';\nimport type { PartnerLogger } from '../observability/logger.js';\nimport { UnverifiableResponseError } from '../verification/unverifiable-response-error.js';\nimport { RequestSigningError } from '../signing/request-signing-error.js';\nimport { safeCounter, safeHistogram, safeLog, safeSpan, withSafeSpan } from '../internal/safe-telemetry.js';\nimport { MalformedResponseError } from '../errors/malformed-response-error.js';\nimport { SigningKeyDocumentUnavailableError } from '../errors/signing-key-document-unavailable-error.js';\n\n/** Frozen request settings used by all route groups. */\nexport interface TransportOptions extends ValidatedClientOptions {\n  /** Route-profile signer. */\n  signer?: RequestSigner;\n  /** Nonce source retained by the transport so every mutation gets a fresh replay guard. */\n  nonceFactory?: NonceFactory;\n  /** Injectable fetch implementation. */\n  fetcher: typeof globalThis.fetch;\n  /** Public response key source. */\n  keySource: SigningKeySource;\n  /** Optional structured diagnostics. */\n  logger?: Partial<PartnerLogger>;\n}\n\n/** Shared pipeline that signs exact request bytes and verifies a complete response before parsing it. */\nexport class PartnerTransport {\n  /** Configured bounded telemetry name for this client instance. */\n  get clientName(): string {\n    return this.settings.name;\n  }\n\n  private readonly requestSigner?: PartnerRequestSigner;\n  private readonly verifier: PartnerResponseVerifier;\n  private readonly nonceFactory: NonceFactory;\n\n  /** Keeps request signing and response verification together so callers cannot return an unverified answer. */\n  constructor(private readonly settings: TransportOptions) {\n    if (settings.signer !== undefined) this.requestSigner = new PartnerRequestSigner(settings.signer);\n    this.verifier = new PartnerResponseVerifier(settings.keySource, undefined, settings.logger);\n    this.nonceFactory = settings.nonceFactory ?? new RandomNonceFactory();\n  }\n\n  /** Sends one API request; response data is not parsed until its signature and digest pass. */\n  async send(request: {\n    method: string;\n    route: string;\n    path: string;\n    profile?: SignatureProfile;\n    body?: Uint8Array;\n    operationId?: string;\n    enrollmentToken?: string;\n    signal?: AbortSignal | undefined;\n  }): Promise<{ response: Response; body: Uint8Array }> {\n    return withSafeSpan(`anis.partners ${request.route}`, async (span) => {\n      const started = performance.now();\n      const timed = operationSignal(request.signal, this.settings.timeoutMs);\n      const attributes = {\n        'anis.client': this.settings.name,\n        'anis.route': request.route,\n        'http.request.method': request.method,\n      };\n      safeSpan(span, (active) => active.setAttributes(attributes));\n      const operationId = request.operationId;\n      if (operationId !== undefined) safeSpan(span, (active) => active.setAttribute('anis.operation_id', operationId));\n      try {\n        const route = PARTNER_ROUTES.find(\n          (entry) => entry.template === request.route && entry.method === request.method,\n        );\n        if (route === undefined) {\n          safeSpan(span, (active) => active.setStatus({ code: SpanStatusCode.ERROR, message: 'unknown route' }));\n          throw new RequestSigningError(new Error('The route is not in the SDK route table.'));\n        }\n        const routeProfile = 'profile' in route ? route.profile : undefined;\n        if (request.profile !== undefined && request.profile !== routeProfile) {\n          safeSpan(span, (active) =>\n            active.setStatus({ code: SpanStatusCode.ERROR, message: 'route profile mismatch' }),\n          );\n          throw new RequestSigningError(new Error('The signing profile must match the published route table.'));\n        }\n        const profile = routeProfile;\n        let url: URL;\n        try {\n          url = new URL(request.path, this.settings.authority);\n        } catch (cause) {\n          throw new RequestSigningError(cause);\n        }\n        const body = request.body ?? new Uint8Array();\n        const headers = new Headers();\n        headers.set('Accept-Encoding', 'identity');\n        if (this.settings.acceptLanguage) headers.set('Accept-Language', this.settings.acceptLanguage);\n        if (request.enrollmentToken !== undefined)\n          headers.set('Authorization', `Enrollment ${request.enrollmentToken}`);\n        if (body.length > 0) headers.set('Content-Type', 'application/json');\n        let signedIdempotencyKey: string | undefined;\n        if (profile !== undefined) {\n          if (this.requestSigner === undefined || this.settings.signer === undefined)\n            throw new RequestSigningError(new Error('A request signer is required for this route.'));\n          const now = new Date();\n          const nonceValue = profile === 'SafeRead' ? undefined : this.nonceFactory.create();\n          const digest = profile === 'SafeRead' ? undefined : contentDigestOf(body);\n          const sigStarted = performance.now();\n          let signed;\n          try {\n            signed = await this.requestSigner.sign(\n              profile,\n              {\n                method: request.method,\n                authority: url.host,\n                path: url.pathname,\n                canonicalQuery: url.search.slice(1),\n                anisDate: now.toISOString().replace(/\\.\\d{3}Z$/, 'Z'),\n                ...(digest === undefined ? {} : { contentDigest: digest }),\n                ...(nonceValue === undefined ? {} : { nonce: nonceValue }),\n                ...(request.operationId === undefined ? {} : { idempotencyKey: request.operationId }),\n              },\n              Math.floor(now.getTime() / 1000),\n              Math.floor(now.getTime() / 1000) + this.settings.signatureLifetimeSeconds,\n            );\n            signedIdempotencyKey = signed.idempotencyKey;\n          } catch (cause) {\n            const error = cause instanceof RequestSigningError ? cause : new RequestSigningError(cause);\n            safeLog(\n              this.settings.logger,\n              'warn',\n              `Request signing failed: method=${request.method}, route=${request.route}.`,\n              {\n                eventId: 1007,\n                method: request.method,\n                route: request.route,\n                reason: 'signing',\n              },\n            );\n            safeHistogram(\n              'anis.partners.request.duration',\n              performance.now() - started,\n              {\n                ...attributes,\n                'error.type': 'signing',\n              },\n              { unit: 'ms' },\n            );\n            safeSpan(span, (active) => active.setStatus({ code: SpanStatusCode.ERROR, message: 'signing' }));\n            safeSpan(span, (active) => active.setAttribute('error.type', 'signing'));\n            throw error;\n          }\n          safeHistogram(\n            'anis.partners.signature.duration',\n            performance.now() - sigStarted,\n            {\n              'anis.signature.profile': profile,\n            },\n            { unit: 'ms' },\n          );\n          safeLog(\n            this.settings.logger,\n            'debug',\n            `Request signed: method=${request.method}, route=${request.route}, profile=${profile}.`,\n            {\n              eventId: 1000,\n              method: request.method,\n              route: request.route,\n              profile,\n              keyId: this.settings.signer.keyId,\n            },\n          );\n          headers.set('X-Anis-Date', signed.anisDate);\n          if (signed.contentDigest !== undefined) headers.set('Content-Digest', signed.contentDigest);\n          if (signed.nonce !== undefined) headers.set('Nonce', signed.nonce);\n          headers.set('Signature-Input', signed.signatureInput);\n          headers.set('Signature', signed.signature);\n        }\n        const signal = timed.signal;\n        if (signedIdempotencyKey !== undefined) headers.set('Idempotency-Key', signedIdempotencyKey);\n        let response: Response | undefined;\n        try {\n          const receivedResponse = await this.settings.fetcher(url, {\n            method: request.method,\n            headers,\n            ...(body.length === 0 ? {} : { body: Buffer.from(body) }),\n            signal,\n            redirect: 'manual',\n          });\n          response = receivedResponse;\n          const contentEncoding = receivedResponse.headers.get('content-encoding');\n          if (contentEncoding !== null && contentEncoding.toLowerCase() !== 'identity') {\n            await cancelBody(receivedResponse);\n            safeCounter('anis.partners.response.verification.failures', {\n              'anis.verification.failure': 'content_digest_mismatch',\n            });\n            safeLog(this.settings.logger, 'error', 'Response discarded: failure=content_digest_mismatch.', {\n              eventId: 1003,\n              failure: 'content_digest_mismatch',\n            });\n            throw new UnverifiableResponseError(\n              'content_digest_mismatch',\n              'The response was content-encoded, so its received bytes cannot match the signed digest.',\n            );\n          }\n          const responseBody = new Uint8Array(await receivedResponse.arrayBuffer());\n          const mergedHeaders: Record<string, string> = {};\n          receivedResponse.headers.forEach((value, name) => {\n            mergedHeaders[name] = value;\n          });\n          try {\n            const requestSignatureInput = headers.get('Signature-Input');\n            await this.verifier.verify(\n              {\n                status: receivedResponse.status,\n                headers: mergedHeaders,\n                body: responseBody,\n                ...(requestSignatureInput === null ? {} : { requestSignatureInput }),\n              },\n              { signal },\n            );\n          } catch (error) {\n            if (error instanceof UnverifiableResponseError)\n              safeCounter('anis.partners.response.verification.failures', {\n                'anis.verification.failure': error.failure,\n              });\n            safeSpan(span, (active) => active.setStatus({ code: SpanStatusCode.ERROR, message: 'unverifiable' }));\n            if (error instanceof UnverifiableResponseError)\n              safeLog(this.settings.logger, 'error', `Response discarded: failure=${error.failure}.`, {\n                eventId: 1003,\n                failure: error.failure,\n              });\n            throw error;\n          }\n          safeSpan(span, (active) => active.setAttribute('http.response.status_code', receivedResponse.status));\n          const requestId = receivedResponse.headers.get('x-request-id');\n          if (requestId !== null) safeSpan(span, (active) => active.setAttribute('anis.request_id', requestId));\n          const elapsedMs = performance.now() - started;\n          safeLog(\n            this.settings.logger,\n            'debug',\n            `Request completed: method=${request.method}, route=${request.route}, status=${String(receivedResponse.status)}, requestId=${requestId ?? 'none'}, elapsedMs=${String(elapsedMs)}.`,\n            {\n              eventId: 1001,\n              method: request.method,\n              route: request.route,\n              statusCode: receivedResponse.status,\n              elapsedMs,\n              requestId,\n            },\n          );\n          if (!receivedResponse.ok) {\n            const refusal = createAnisApiError(responseBody, receivedResponse.status, receivedResponse.headers);\n            safeSpan(span, (active) => active.setAttribute('anis.error.code', refusal.rawCode ?? refusal.code));\n            safeHistogram(\n              'anis.partners.request.duration',\n              performance.now() - started,\n              {\n                ...attributes,\n                'http.response.status_code': receivedResponse.status,\n                'anis.error.code': refusal.rawCode ?? refusal.code,\n              },\n              { unit: 'ms' },\n            );\n            safeLog(\n              this.settings.logger,\n              'warn',\n              `Request refused: method=${request.method}, route=${request.route}, status=${String(receivedResponse.status)}, code=${refusal.rawCode ?? refusal.code}, requestId=${refusal.requestId ?? 'none'}, retryable=${String(refusal.isRetryable)}, replayed=${String(refusal.isReplayed)}.`,\n              {\n                eventId: 1002,\n                method: request.method,\n                route: request.route,\n                code: refusal.rawCode ?? refusal.code,\n                statusCode: receivedResponse.status,\n                requestId: refusal.requestId,\n                retryable: refusal.isRetryable,\n                replayed: refusal.isReplayed,\n              },\n            );\n            throw refusal;\n          }\n          safeHistogram(\n            'anis.partners.request.duration',\n            performance.now() - started,\n            {\n              ...attributes,\n              'http.response.status_code': receivedResponse.status,\n            },\n            { unit: 'ms' },\n          );\n          return { response: receivedResponse, body: responseBody };\n        } catch (error) {\n          if (response !== undefined) await cancelBody(response);\n          if (error instanceof AnisApiError) {\n            safeSpan(span, (active) => active.setAttribute('anis.error.code', error.rawCode ?? error.code));\n            safeSpan(span, (active) =>\n              active.setStatus({ code: SpanStatusCode.ERROR, message: error.rawCode ?? error.code }),\n            );\n            throw error;\n          }\n          const reason =\n            error instanceof UnverifiableResponseError\n              ? 'unverifiable'\n              : error instanceof SigningKeyDocumentUnavailableError\n                ? 'connection'\n                : request.signal?.aborted\n                  ? 'canceled'\n                  : signal.aborted\n                    ? 'timeout'\n                    : error instanceof TypeError\n                      ? 'connection'\n                      : 'other';\n          safeSpan(span, (active) => active.setStatus({ code: SpanStatusCode.ERROR, message: reason }));\n          safeSpan(span, (active) => active.setAttribute('error.type', reason));\n          safeHistogram(\n            'anis.partners.request.duration',\n            performance.now() - started,\n            {\n              ...attributes,\n              'error.type': reason,\n            },\n            { unit: 'ms' },\n          );\n          safeLog(\n            this.settings.logger,\n            'warn',\n            `No usable answer: method=${request.method}, route=${request.route}, reason=${reason}.`,\n            {\n              eventId: 1007,\n              method: request.method,\n              route: request.route,\n              elapsedMs: performance.now() - started,\n              reason,\n            },\n          );\n          throw error;\n        }\n      } finally {\n        timed.dispose();\n        safeSpan(span, (active) => {\n          active.end();\n        });\n      }\n    });\n  }\n\n  /** Sends and parses a verified non-empty JSON success. */\n  async json<T>(request: Parameters<PartnerTransport['send']>[0], parse: (value: unknown) => T): Promise<T> {\n    const result = await this.send(request);\n    if (result.body.length === 0)\n      throw new AnisApiError(\n        { status: result.response.status, code: 'internal_error', title: 'Empty body' },\n        result.response.status,\n      );\n    try {\n      const decoded: unknown = JSON.parse(new TextDecoder().decode(result.body));\n      if (decoded === null) throw new MalformedResponseError('JSON object');\n      return parse(decoded);\n    } catch (error) {\n      if (error instanceof MalformedResponseError) throw error;\n      if (error instanceof AnisApiError) throw error;\n      throw new MalformedResponseError('response model');\n    }\n  }\n\n  /** Records the closed order outcome without attaching credential data to logs. */\n  reportOrderOutcome(operationId: string, outcome: string, reason?: string): void {\n    const message =\n      outcome === 'unknown'\n        ? `Order outcome unknown: operationId=${operationId}, reason=${reason ?? 'unspecified'}; resume the same id.`\n        : `Order outcome ${outcome}: operationId=${operationId}.`;\n    safeLog(this.settings.logger, outcome === 'unknown' ? 'warn' : 'info', message, {\n      eventId: outcome === 'unknown' ? 1008 : 1004,\n      operationId,\n      outcome,\n      ...(reason === undefined ? {} : { reason }),\n    });\n  }\n}\n\nfunction operationSignal(caller: AbortSignal | undefined, timeoutMs: number): { signal: AbortSignal; dispose(): void } {\n  const controller = new AbortController();\n  const abortFromCaller = () => {\n    controller.abort(caller?.reason);\n  };\n  caller?.addEventListener('abort', abortFromCaller, { once: true });\n  if (caller?.aborted) abortFromCaller();\n  const timer = setTimeout(() => {\n    controller.abort(new DOMException('The operation timed out.', 'TimeoutError'));\n  }, timeoutMs);\n  return {\n    signal: controller.signal,\n    dispose() {\n      clearTimeout(timer);\n      caller?.removeEventListener('abort', abortFromCaller);\n    },\n  };\n}\n\nasync function cancelBody(response: Response): Promise<void> {\n  try {\n    await response.body?.cancel();\n  } catch {\n    // The discarded response cannot be used even when its stream resists cancellation.\n  }\n}\n","// This file is generated from contracts/error-catalogue.json by tools/generate-errors.mjs.\n// Do not edit it directly; run npm run generate:errors.\n\n/** Every published error code this SDK version recognizes. */\nexport const ERROR_CODES = [\n  'account_inactive',\n  'allowed_debt_consent_required',\n  'binding_not_authorized',\n  'business_subscription_required',\n  'card_not_found',\n  'card_unavailable',\n  'challenge_expired',\n  'currency_not_supported',\n  'daily_limit_exceeded',\n  'dependency_unavailable',\n  'idempotency_conflict',\n  'insufficient_balance',\n  'insufficient_scope',\n  'internal_error',\n  'invalid_content_digest',\n  'invalid_credentials',\n  'invitation_invalid',\n  'invoice_reveal_limit_exceeded',\n  'key_duplicate',\n  'key_proof_invalid',\n  'malformed_signed_request',\n  'operation_processing',\n  'owner_limit_exceeded',\n  'price_changed',\n  'purchase_not_allowed',\n  'quantity_unavailable',\n  'rate_limited',\n  'replay_detected',\n  'request_timeout',\n  'resource_not_found',\n  'reveal_not_allowed',\n  'signature_expired',\n  'source_ip_not_allowed',\n  'validation_failed',\n  'wallet_disabled',\n  'wallet_expired',\n  'wallet_not_granted',\n] as const;\n\n/** A published error code, or unknown when Anis adds one this SDK has not seen yet. */\nexport type ErrorCode = (typeof ERROR_CODES)[number] | 'unknown';\n\n/** Codes the public catalogue marks as retryable. Unknown codes are never assumed to be retryable. */\nexport const RETRYABLE_ERROR_CODES: ReadonlySet<ErrorCode> = new Set([\n  'dependency_unavailable',\n  'internal_error',\n  'operation_processing',\n  'rate_limited',\n  'replay_detected',\n  'request_timeout',\n  'signature_expired',\n]);\n\n/** Resolves a wire code, retaining forward compatibility when Anis publishes a new code. */\nexport function parseErrorCode(code: string | null | undefined): ErrorCode {\n  if (code === null || code === undefined) {\n    return 'unknown';\n  }\n  return ERROR_CODES.find((known) => known === code) ?? 'unknown';\n}\n","import { asObject, optionalInteger, optionalString } from './model-parsing.js';\n\n/** RFC 9457 problem returned for a verified refusal. Branch on code, never localized title or detail. */\nexport interface Problem {\n  /** Permanent documentation URI for this error. */\n  type?: string;\n  /** Localized presentation text. */\n  title?: string;\n  /** HTTP status repeated in the body. */\n  status: number;\n  /** Localized presentation detail. */\n  detail?: string;\n  /** Machine code used for stable decisions. */\n  code?: string;\n  /** Correlation id to quote when asking Anis about this call. */\n  requestId?: string;\n  /** Documented per-code extensions retained without assuming their shape. */\n  extensions?: unknown;\n}\n\n/** Parses a problem while retaining only documented RFC and SDK members. */\nexport function parseProblem(json: unknown): Problem {\n  const object = asObject(json, 'Problem');\n  const type = optionalString(object, 'type', 'Problem');\n  const title = optionalString(object, 'title', 'Problem');\n  const detail = optionalString(object, 'detail', 'Problem');\n  const code = optionalString(object, 'code', 'Problem');\n  const requestId = optionalString(object, 'requestId', 'Problem');\n  const status = optionalInteger(object, 'status', 'Problem') ?? 0;\n  const extensions = object.extensions;\n  return {\n    status,\n    ...(type === undefined ? {} : { type }),\n    ...(title === undefined ? {} : { title }),\n    ...(detail === undefined ? {} : { detail }),\n    ...(code === undefined ? {} : { code }),\n    ...(requestId === undefined ? {} : { requestId }),\n    ...(extensions === undefined || extensions === null ? {} : { extensions }),\n  };\n}\n","/** Parses the leading Retry-After integer within the signed 32-bit seconds range. */\nexport function retryAfterSeconds(value: string | null | undefined): number | undefined {\n  const first = value?.split(',')[0]?.trim();\n  if (first === undefined || !/^\\d+$/.test(first)) return undefined;\n  const seconds = Number(first);\n  return Number.isSafeInteger(seconds) && seconds <= 2_147_483_647 ? seconds : undefined;\n}\n","import { parseErrorCode, RETRYABLE_ERROR_CODES, type ErrorCode } from './error-codes.generated.js';\nimport { parseProblem, type Problem } from '../models/problem.js';\nimport { AnisPartnersError } from './anis-partners-error.js';\nimport { retryAfterSeconds } from '../internal/retry-after.js';\n\n/** Whether Anis's refusal means the order is closed or may still complete. */\nexport type OrderRefusalOutcome = 'notPlaced' | 'unknown';\n\n/** An Anis API refusal with stable machine fields for partner-side branching. */\nexport class AnisApiError extends AnisPartnersError {\n  /** Complete parsed problem returned by Anis. */\n  readonly problem: Problem;\n  /** Known machine code, or unknown when this SDK has not seen the value. */\n  readonly code: ErrorCode;\n  /** Exact wire code, including an unknown future value. */\n  readonly rawCode?: string;\n  /** HTTP status of the verified response. */\n  readonly status: number;\n  /** Correlation id to quote when asking Anis about the call. */\n  readonly requestId?: string;\n  /** Permanent documentation link for this code. */\n  readonly typeUri?: string;\n  /** Signed Retry-After value in seconds, when supplied. */\n  readonly retryAfter?: number;\n  /** True when Anis returned the recorded refusal for this operation id. */\n  readonly isReplayed: boolean;\n  /** Whether the catalogue marks this code retryable; this does not decide order recovery. */\n  readonly isRetryable: boolean;\n  /** Whether the refusal leaves an order open for resume. */\n  readonly orderOutcome: OrderRefusalOutcome;\n\n  /**\n   * Creates a structured API error from a verified problem.\n   *\n   * @remarks The code is the stable branching contract. Titles and details change with language and copy updates, so\n   * callers that branch on the message can break without any API behavior changing.\n   */\n  constructor(problem: Problem, status: number, retryAfter?: number, isReplayed = false) {\n    super(\n      `Anis returned ${String(status)} ${problem.code ?? 'unknown'}${isReplayed ? ' (recorded answer for this operation)' : ''}${problem.requestId === undefined ? '' : ` (request ${problem.requestId})`}. Branch on the code, not on this message.`,\n    );\n    this.problem = problem;\n    Object.defineProperty(this, 'problem', { enumerable: false });\n    this.status = status;\n    this.code = parseErrorCode(problem.code);\n    this.isReplayed = isReplayed;\n    this.isRetryable = RETRYABLE_ERROR_CODES.has(this.code);\n    this.orderOutcome = isReplayed ? 'notPlaced' : outcomeOf(this.code);\n    if (problem.code !== undefined) {\n      this.rawCode = problem.code;\n    }\n    if (problem.requestId !== undefined) {\n      this.requestId = problem.requestId;\n    }\n    if (problem.type !== undefined) {\n      this.typeUri = problem.type;\n    }\n    if (retryAfter !== undefined) {\n      this.retryAfter = retryAfter;\n    }\n  }\n}\n\n/** A final refusal because the wallet balance cannot cover the order. */\nexport class InsufficientBalanceError extends AnisApiError {}\n/** A final refusal because the catalogue price changed after it was read. */\nexport class PriceChangedError extends AnisApiError {}\n/** A final refusal because the card or requested quantity is unavailable. */\nexport class OutOfStockError extends AnisApiError {}\n/** A final refusal because an operation id was reused for a different order. */\nexport class IdempotencyConflictError extends AnisApiError {}\n/** A request-rate refusal; callers should honor Retry-After when present. */\nexport class RateLimitedError extends AnisApiError {}\n/** A final refusal because an owner spending allowance is exhausted. */\nexport class LimitExceededError extends AnisApiError {}\n/** A refusal because the signing credentials are not accepted. */\nexport class InvalidCredentialsError extends AnisApiError {}\n/** A refusal because the same signed nonce was already received. */\nexport class ReplayDetectedError extends AnisApiError {}\n/** A refusal because current application or owner policy does not allow the call. */\nexport class AuthorizationError extends AnisApiError {}\n/** A refusal for a resource that is absent or intentionally indistinguishable from absent. */\nexport class ResourceNotFoundError extends AnisApiError {}\n/** A refusal because the request does not satisfy the published contract. */\nexport class ValidationFailedError extends AnisApiError {}\n/** A refusal where Anis could not reach a decision; an order may still complete. */\nexport class DependencyUnavailableError extends AnisApiError {}\n/** A refusal of an invitation, key submission, or enrollment proof step. */\nexport class EnrollmentRefusedError extends AnisApiError {}\n\n/** Classifies an error code before applying the create-versus-resume rule. */\nexport function outcomeOf(code: ErrorCode): OrderRefusalOutcome {\n  return code === 'dependency_unavailable' ||\n    code === 'request_timeout' ||\n    code === 'internal_error' ||\n    code === 'operation_processing' ||\n    code === 'replay_detected' ||\n    code === 'rate_limited' ||\n    code === 'unknown' ||\n    refusedAtTheDoor(code)\n    ? 'unknown'\n    : 'notPlaced';\n}\n\n/** Reports a refusal decided before Anis looks up an order, which can leave an earlier attempt unresolved. */\nexport function refusedAtTheDoor(code: ErrorCode): boolean {\n  return (\n    code === 'invalid_credentials' ||\n    code === 'signature_expired' ||\n    code === 'insufficient_scope' ||\n    code === 'wallet_not_granted' ||\n    code === 'malformed_signed_request'\n  );\n}\n\n/** Parses a verified refusal and attaches typed errors for the cases partners commonly handle differently. */\nexport function createAnisApiError(body: Uint8Array | string, status: number, headers?: Headers): AnisApiError {\n  const problem = parseProblemOrFallback(body, status);\n  const retryAfter = retryAfterSeconds(headers?.get('retry-after'));\n  const isReplayed = headerValues(headers?.get('idempotency-replayed')).some((value) => value.toLowerCase() === 'true');\n  const ErrorType = errorTypeFor(problem.code);\n  return new ErrorType(problem, status, retryAfter, isReplayed);\n}\n\nfunction parseProblemOrFallback(body: Uint8Array | string, status: number): Problem {\n  try {\n    const text = typeof body === 'string' ? body : new TextDecoder().decode(body);\n    return parseProblem(JSON.parse(text) as unknown);\n  } catch {\n    return { type: 'about:blank', title: 'Unreadable problem', status, code: 'internal_error' };\n  }\n}\n\nfunction headerValues(value: string | null | undefined): string[] {\n  return value === undefined || value === null ? [] : value.split(',').map((part) => part.trim());\n}\n\nfunction errorTypeFor(code: string | undefined): typeof AnisApiError {\n  switch (parseErrorCode(code)) {\n    case 'insufficient_balance':\n      return InsufficientBalanceError;\n    case 'price_changed':\n      return PriceChangedError;\n    case 'quantity_unavailable':\n    case 'card_unavailable':\n      return OutOfStockError;\n    case 'idempotency_conflict':\n      return IdempotencyConflictError;\n    case 'rate_limited':\n      return RateLimitedError;\n    case 'owner_limit_exceeded':\n    case 'daily_limit_exceeded':\n      return LimitExceededError;\n    case 'invalid_credentials':\n    case 'signature_expired':\n      return InvalidCredentialsError;\n    case 'replay_detected':\n      return ReplayDetectedError;\n    case 'insufficient_scope':\n    case 'source_ip_not_allowed':\n    case 'binding_not_authorized':\n    case 'account_inactive':\n    case 'business_subscription_required':\n    case 'wallet_disabled':\n    case 'wallet_expired':\n    case 'purchase_not_allowed':\n    case 'reveal_not_allowed':\n      return AuthorizationError;\n    case 'resource_not_found':\n    case 'card_not_found':\n    case 'wallet_not_granted':\n      return ResourceNotFoundError;\n    case 'validation_failed':\n    case 'currency_not_supported':\n      return ValidationFailedError;\n    case 'dependency_unavailable':\n    case 'request_timeout':\n    case 'internal_error':\n      return DependencyUnavailableError;\n    case 'invitation_invalid':\n    case 'challenge_expired':\n    case 'key_proof_invalid':\n    case 'key_duplicate':\n      return EnrollmentRefusedError;\n    default:\n      return AnisApiError;\n  }\n}\n","import { createHash } from 'node:crypto';\n\n/**\n * Exact two-byte body used by the signature diagnostic.\n *\n * @remarks The diagnostic sends `{}` while reveal operations send zero bytes, so their covered digests must remain\n * distinct.\n */\nexport const EMPTY_OBJECT_BODY = new TextEncoder().encode('{}');\n\n/**\n * Produces the RFC 9530 digest for the exact transmitted body bytes.\n *\n * @remarks Re-serializing after hashing changes the bytes the gateway receives and causes rejection before it reads\n * the request.\n */\nexport function contentDigestOf(bytes: Uint8Array): string {\n  return `sha-256=:${createHash('sha256').update(bytes).digest('base64')}:`;\n}\n","import { inspect } from 'node:util';\nimport type { RequestSigner } from './p256-signer.js';\nimport { RequestSigningError } from './request-signing-error.js';\nimport { PartnerRequestSignatureBase } from './partner-request-signature-base.js';\nimport { componentsOf, type SignatureProfile } from './signature-profile.js';\nimport { canonicalizeSignatureInputs, type SignatureInputs } from './signature-inputs.js';\nimport type { SignedRequestHeaders } from './signed-request-headers.js';\n\n/**\n * Signs one request profile and returns the headers that must be set on that attempt.\n *\n * @remarks Signing is kept after the final body is known so `Content-Digest` covers the bytes that actually leave the\n * process; a signer failure or wrong signature form means nothing is sent.\n */\nexport class PartnerRequestSigner {\n  /** Creates a signer backed by partner-owned key custody; the private key never enters this API. */\n  constructor(private readonly signer: RequestSigner) {}\n\n  /** Builds and signs one attempt; errors retain the signer cause without exposing the base or signature in the message. */\n  async sign(\n    profile: SignatureProfile,\n    source: SignatureInputs,\n    created: number,\n    expires: number,\n  ): Promise<SignedRequestHeaders> {\n    const inputs = canonicalizeSignatureInputs(source);\n    if ((profile === 'SafeRead') !== (inputs.nonce === undefined))\n      throw new TypeError('The nonce does not match the selected signature profile.');\n    for (const name of componentsOf(profile)) {\n      if (name === 'content-digest' && inputs.contentDigest === undefined)\n        throw new TypeError('The selected profile requires Content-Digest.');\n      if (name === 'idempotency-key' && inputs.idempotencyKey === undefined)\n        throw new TypeError('The order profile requires a caller-owned idempotency key.');\n    }\n    const base = PartnerRequestSignatureBase.build(profile, inputs, created, expires, this.signer.keyId);\n    let signature: Uint8Array;\n    try {\n      signature = await this.signer.sign(base);\n    } catch (cause) {\n      throw new RequestSigningError(cause);\n    }\n    if (!(signature instanceof Uint8Array) || signature.length !== 64)\n      throw new RequestSigningError(\n        new Error(\n          `The signer must return a 64-byte Uint8Array for P-256 P1363. A 70–72 byte result is almost certainly DER.`,\n        ),\n      );\n    const params = PartnerRequestSignatureBase.parameters(profile, created, expires, this.signer.keyId, inputs.nonce);\n    return {\n      signatureInput: PartnerRequestSignatureBase.signatureInputHeader(params),\n      signature: PartnerRequestSignatureBase.signatureHeader(signature),\n      anisDate: inputs.anisDate,\n      ...(inputs.contentDigest === undefined ? {} : { contentDigest: inputs.contentDigest }),\n      ...(inputs.nonce === undefined ? {} : { nonce: inputs.nonce }),\n      ...(inputs.idempotencyKey === undefined ? {} : { idempotencyKey: inputs.idempotencyKey }),\n      signatureBase: base,\n      [inspect.custom]() {\n        return 'SignedRequestHeaders { signatureInput: <redacted>, signature: <redacted>, nonce: <redacted>, signatureBase: <redacted> }';\n      },\n    };\n  }\n}\n","/**\n * The three request shapes accepted by the Partner API.\n *\n * @remarks The route selects a frozen shape; a second configurable map could drift from Anis's route rules and turn\n * a valid signature into an unexplained refusal.\n */\nexport type SignatureProfile = 'SafeRead' | 'BodylessNonceMutation' | 'OrderMutation';\n\n/** Returns the frozen component order so the advertised list and signed bytes stay identical. */\nexport function componentsOf(profile: SignatureProfile): readonly string[] {\n  switch (profile) {\n    case 'SafeRead':\n      return ['@method', '@authority', '@path', '@query', 'x-anis-date'];\n    case 'BodylessNonceMutation':\n      return ['@method', '@authority', '@path', '@query', 'content-digest', 'nonce', 'x-anis-date'];\n    case 'OrderMutation':\n      return ['@method', '@authority', '@path', '@query', 'content-digest', 'nonce', 'idempotency-key', 'x-anis-date'];\n  }\n}\n","import { canonicalUuid } from '../internal/uuid.js';\n\n/**\n * Canonical request facts shared by the signature base and emitted headers.\n *\n * @remarks Each value is normalized once so the bytes signed and the headers sent cannot drift apart.\n */\nexport interface SignatureInputs {\n  /** HTTP method in upper-case because the gateway upper-cases before rebuilding the signed request. */ method: string;\n  /** Lower-case host and optional non-default port because the gateway compares the canonical authority. */ authority: string;\n  /** Absolute request path; percent escapes are refused because the gateway verifies the decoded path. */ path: string;\n  /** Raw query without a leading question mark so its original ordering and encoding are preserved. */ canonicalQuery: string;\n  /** UTC date value covered by the signature and sent as X-Anis-Date. */ anisDate: string;\n  /** Digest of the exact transmitted bytes; re-serializing the body would invalidate the request. */ contentDigest?: string;\n  /** Fresh mutation nonce repeated in the header and signature parameters to prevent replay. */ nonce?: string;\n  /** Caller-owned order UUID so retries keep the same operation identity. */ idempotencyKey?: string;\n}\n\n/**\n * Canonicalizes each request fact once, before the base builder and header writer share it.\n *\n * @remarks An upper-case method, lower-case authority, canonical operation UUID, and refused percent-escaped path\n * match the gateway's request envelope; normalizing later could sign values different from those sent.\n */\nexport function canonicalizeSignatureInputs(inputs: SignatureInputs): SignatureInputs {\n  if (inputs.path.includes('%')) throw new TypeError('Paths containing percent escapes cannot be signed.');\n  return {\n    method: inputs.method.toUpperCase(),\n    authority: inputs.authority.toLowerCase(),\n    path: inputs.path,\n    canonicalQuery: inputs.canonicalQuery,\n    anisDate: inputs.anisDate,\n    ...(inputs.contentDigest === undefined ? {} : { contentDigest: inputs.contentDigest }),\n    ...(inputs.nonce === undefined ? {} : { nonce: inputs.nonce }),\n    ...(inputs.idempotencyKey === undefined\n      ? {}\n      : { idempotencyKey: canonicalUuid(inputs.idempotencyKey, 'idempotencyKey') }),\n  };\n}\n\n/** Resolves a covered component from already-canonical facts. */\nexport function valueOf(inputs: SignatureInputs, component: string): string {\n  const values: Record<string, string | undefined> = {\n    '@method': inputs.method,\n    '@authority': inputs.authority,\n    '@path': inputs.path,\n    '@query': `?${inputs.canonicalQuery}`,\n    'content-digest': inputs.contentDigest,\n    nonce: inputs.nonce,\n    'idempotency-key': inputs.idempotencyKey,\n    'x-anis-date': inputs.anisDate,\n  };\n  const value = values[component];\n  if (value === undefined) throw new TypeError(`The covered component '${component}' has no value.`);\n  return value;\n}\n","import { canonicalUuid } from '../internal/uuid.js';\nimport { componentsOf, type SignatureProfile } from './signature-profile.js';\nimport { valueOf, type SignatureInputs } from './signature-inputs.js';\n\n/**\n * RFC 9421 request signature material built from one frozen component list.\n *\n * @remarks Building the input header and base from the same list prevents a request from advertising components\n * different from the ones its signature actually covers.\n */\nexport const PartnerRequestSignatureBase = {\n  /** The sole signature label accepted by Anis; an alternate label is rejected before signature verification. */\n  label: 'sig1',\n  /** The only algorithm negotiated by neither side, preventing a fallback with different signature semantics. */\n  algorithm: 'ecdsa-p256-sha256',\n  /** The gateway's independent upper bound; longer windows are refused before a request can be accepted. */\n  maxSignatureLifetimeSeconds: 300,\n\n  /** Builds exact UTF-8 bytes; the final line has no newline because even one extra byte invalidates the signature. */\n  build(\n    profile: SignatureProfile,\n    inputs: SignatureInputs,\n    created: number,\n    expires: number,\n    keyId: string,\n  ): Uint8Array {\n    const nonce = inputs.nonce;\n    const params = this.parameters(profile, created, expires, keyId, nonce);\n    const lines = componentsOf(profile).map((component) => `\"${component}\": ${valueOf(inputs, component)}\\n`);\n    lines.push(`\"@signature-params\": ${params}`);\n    return new TextEncoder().encode(lines.join(''));\n  },\n\n  /** Renders contract-ordered parameters, including the nonce only when the route profile requires it. */\n  parameters(profile: SignatureProfile, created: number, expires: number, keyId: string, nonce?: string): string {\n    if (expires - created > this.maxSignatureLifetimeSeconds)\n      throw new RangeError('A Partner signature may live at most 300 seconds.');\n    let invalidNonce = nonce === undefined || nonce.length === 0;\n    if (nonce !== undefined)\n      for (const character of nonce)\n        if (character === '\"' || character === '\\\\' || character.charCodeAt(0) < 32 || character.charCodeAt(0) === 127)\n          invalidNonce = true;\n    if (profile === 'SafeRead' ? nonce !== undefined : invalidNonce) {\n      throw new TypeError('The nonce does not match the selected signature profile.');\n    }\n    const ids = componentsOf(profile)\n      .map((part) => `\"${part}\"`)\n      .join(' ');\n    return `(${ids});created=${String(created)};expires=${String(expires)};keyid=\"${canonicalUuid(keyId, 'keyId')}\";alg=\"${PartnerRequestSignatureBase.algorithm}\"${nonce === undefined ? '' : `;nonce=\"${nonce}\"`}`;\n  },\n\n  /** Renders the sole supported label with the same parameters used to build the signed bytes. */\n  signatureInputHeader(parameters: string): string {\n    return `${this.label}=${parameters}`;\n  },\n  /** Renders the exact P1363 bytes; converting to DER would make Anis refuse this otherwise valid signature. */\n  signatureHeader(signature: Uint8Array): string {\n    return `${this.label}=:${Buffer.from(signature).toString('base64')}:`;\n  },\n};\n","import { createHash } from 'node:crypto';\nimport { decodeBase64Url } from '../internal/base64url.js';\nimport { arrayBufferOf, fixedTimeEqual } from '../internal/bytes.js';\nimport type { Clock } from '../internal/clock.js';\nimport { systemClock } from '../internal/clock.js';\nimport type { SigningKeySet, PartnerJwk } from './partner-jwk.js';\nimport type { SigningKeyRequestOptions, SigningKeySource } from './signing-key-source.js';\nimport { parseSignatureInput } from './signature-input-parser.js';\nimport { PartnerResponseSignatureBase } from './partner-response-signature-base.js';\nimport type { VerifiableResponse } from './verifiable-response.js';\nimport { UnverifiableResponseError } from './unverifiable-response-error.js';\nimport type { ResponseVerificationFailure } from './response-verification-failure.js';\nimport type { PartnerLogger } from '../observability/logger.js';\nimport { safeLog } from '../internal/safe-telemetry.js';\n\n/**\n * Verifies a signed Partner response and rejects it on the first failed contract rule.\n *\n * @remarks Check order is security-sensitive: the received body digest is compared in fixed time before signature\n * verification, and the covered list is rebuilt rather than accepted from the response.\n */\nexport class PartnerResponseVerifier {\n  /** Creates a verifier with key rotation and time supplied separately so neither weakens the wire checks. */\n  constructor(\n    private readonly keys: SigningKeySource,\n    private readonly clock: Clock = systemClock,\n    private readonly logger?: Partial<Pick<PartnerLogger, 'warn'>>,\n  ) {}\n\n  /** Resolves only for a verifiable response; every refusal throws so untrusted content cannot reach a caller. */\n  async verify(response: VerifiableResponse, options?: SigningKeyRequestOptions): Promise<void> {\n    const signatureInput = header(response, 'Signature-Input');\n    const signature = header(response, 'Signature');\n    if (!signatureInput || !signature) fail('signature_missing', 'The response carried no signature headers.');\n    const parsed = parseSignatureInput(signatureInput);\n    if (!parsed) fail('signature_malformed', 'Signature-Input could not be parsed.');\n    if (parsed.label !== 'sig1' || !signature.startsWith('sig1='))\n      fail('label_unexpected', 'The label is frozen at sig1 on both headers.');\n    if (parsed.algorithm !== undefined && parsed.algorithm !== 'ecdsa-p256-sha256')\n      fail('algorithm_not_supported', 'There is no alternate algorithm to negotiate.');\n    const digest = header(response, 'Content-Digest');\n    if (\n      !digest ||\n      !fixedTimeEqual(\n        new TextEncoder().encode(digest),\n        new TextEncoder().encode(`sha-256=:${createHash('sha256').update(response.body).digest('base64')}:`),\n      )\n    )\n      fail('content_digest_mismatch', 'The Content-Digest does not describe the body.');\n    const requestId = header(response, 'X-Request-Id');\n    if (!requestId) fail('covered_components_mismatch', 'The response carried no X-Request-Id.');\n    const components = PartnerResponseSignatureBase.components(\n      response.status,\n      digest,\n      requestId,\n      response.requestSignatureInput,\n      header(response, 'Location'),\n      header(response, 'Retry-After'),\n      header(response, 'Idempotency-Replayed'),\n      header(response, 'Cache-Control'),\n    );\n    const expected = components.map((part) => `${part.name}${part.requestBound ? ';req' : ''}`);\n    if (expected.length !== parsed.identifiers.length || expected.some((part, i) => part !== parsed.identifiers[i]))\n      fail('covered_components_mismatch', 'The advertised components differ from the frozen response profile.');\n    if (parsed.identifiers.some((id) => id.endsWith(';req')) && !response.requestSignatureInput)\n      fail('covered_components_mismatch', 'The request binding cannot be rebuilt.');\n    const age = Math.floor(this.clock.now().getTime() / 1000) - parsed.created;\n    if (!Number.isFinite(age) || Math.abs(age) > PartnerResponseSignatureBase.MAX_AGE_SECONDS)\n      fail('created_out_of_window', `created is ${String(age)}s from this clock.`);\n\n    let document = await this.keys.get(options);\n    let key = resolve(document, parsed.keyId);\n    if (!key) {\n      safeLog(this.logger, 'warn', 'Anis response used an unpublished signing key', {\n        keyId: parsed.keyId,\n        eventId: 1006,\n      });\n      document = await this.keys.refresh(options);\n      key = resolve(document, parsed.keyId);\n    }\n    if (document.keys.some((candidate) => candidate.d !== undefined && candidate.d !== ''))\n      fail('key_rejected', 'The published key document carries a private member.');\n    if (!key) fail('unknown_key', `keyid ${parsed.keyId} is not published.`);\n    const signatureBytes = byteSequence(signature);\n    if (signatureBytes?.length !== 64) fail('signature_malformed', 'P-256 P1363 signatures must be exactly 64 bytes.');\n    const x = decodeBase64Url(key.x);\n    const y = decodeBase64Url(key.y);\n    if (!x || !y || x.length !== 32 || y.length !== 32)\n      fail('key_rejected', 'The published key must have two 32-byte P-256 coordinates.');\n    let publicKey: CryptoKey;\n    const keyX = key.x;\n    const keyY = key.y;\n    if (!keyX || !keyY) fail('key_rejected', 'The published key has missing coordinates.');\n    try {\n      publicKey = await globalThis.crypto.subtle.importKey(\n        'jwk',\n        { kty: 'EC', crv: 'P-256', x: keyX, y: keyY, ext: true },\n        { name: 'ECDSA', namedCurve: 'P-256' },\n        false,\n        ['verify'],\n      );\n    } catch {\n      fail('key_rejected', 'The published coordinates are not a valid P-256 point.');\n    }\n    const base = PartnerResponseSignatureBase.build(components, parsed.created, parsed.keyId);\n    try {\n      if (\n        !(await globalThis.crypto.subtle.verify(\n          { name: 'ECDSA', hash: 'SHA-256' },\n          publicKey,\n          arrayBufferOf(signatureBytes),\n          arrayBufferOf(base),\n        ))\n      )\n        fail('signature_invalid', 'The signature does not verify over the rebuilt base.');\n    } catch (cause) {\n      if (cause instanceof UnverifiableResponseError) throw cause;\n      fail('signature_invalid', 'The signature could not be verified over the rebuilt base.');\n    }\n  }\n}\n\nfunction header(response: VerifiableResponse, name: string): string | undefined {\n  for (const key of Object.keys(response.headers))\n    if (key.toLowerCase() === name.toLowerCase()) return response.headers[key];\n  return undefined;\n}\nfunction resolve(document: SigningKeySet, keyId: string): PartnerJwk | undefined {\n  return document.keys.find((key) => key.kid === keyId && key.x && key.y);\n}\nfunction byteSequence(value: string): Uint8Array | undefined {\n  const match = /^sig1=:([A-Za-z0-9+/]+={0,2}):$/.exec(value);\n  if (!match) return undefined;\n  const encoded = match[1];\n  if (encoded === undefined) return undefined;\n  try {\n    const bytes = Buffer.from(encoded, 'base64');\n    return bytes.toString('base64') === encoded ? new Uint8Array(bytes) : undefined;\n  } catch {\n    return undefined;\n  }\n}\nfunction fail(reason: ResponseVerificationFailure, detail: string): never {\n  throw new UnverifiableResponseError(reason, detail);\n}\n","/** Supplies the instant used for response freshness checks. */\nexport interface Clock {\n  /** Returns the current instant; injection lets tests pin the same whole-second window as Anis. */\n  now(): Date;\n}\n\n/** Uses the host clock in production while keeping the clock replaceable for deterministic freshness tests. */\nexport const systemClock: Clock = { now: () => new Date() };\n","/** Parsed fields needed to rebuild a response signature without trusting its advertised component list. */\nexport interface ParsedSignatureInput {\n  /** Dictionary label checked against the one accepted label. */\n  label: string;\n  /** Quoted identifiers, including request binding, compared with the rebuilt profile. */\n  identifiers: readonly string[];\n  /** Unix creation time used for replay freshness checks. */\n  created: number;\n  /** Published key version used to resolve the verification key. */\n  keyId: string;\n  /** Optional algorithm; when present it must match the supported one. */\n  algorithm?: string;\n}\n\n/** Strictly parses the single signature form emitted by Anis; accepting ambiguity would let a response choose its verifier. */\nexport function parseSignatureInput(value: string): ParsedSignatureInput | undefined {\n  if (!value) return undefined;\n  const equal = value.indexOf('=');\n  if (equal <= 0 || value[equal + 1] !== '(') return undefined;\n  const label = value.slice(0, equal);\n  let index = equal + 2;\n  const identifiers: string[] = [];\n  while (index < value.length && value[index] !== ')') {\n    if (value[index] === ' ') {\n      while (value[index] === ' ') index++;\n      continue;\n    }\n    if (value[index] !== '\"') return undefined;\n    const end = value.indexOf('\"', index + 1);\n    if (end < 0) return undefined;\n    const name = value.slice(index + 1, end);\n    index = end + 1;\n    let requestBound = false;\n    if (value[index] === ';') {\n      if (!value.startsWith(';req', index)) return undefined;\n      index += 4;\n      requestBound = true;\n    }\n    identifiers.push(requestBound ? `${name};req` : name);\n  }\n  if (value[index] !== ')') return undefined;\n  index++;\n  let created: number | undefined;\n  let keyId: string | undefined;\n  let algorithm: string | undefined;\n  while (index < value.length) {\n    if (value[index] !== ';') return undefined;\n    const start = index + 1;\n    const eq = value.indexOf('=', start);\n    if (eq < 0) return undefined;\n    const name = value.slice(start, eq);\n    index = eq + 1;\n    if (value[index] === '\"') {\n      const end = value.indexOf('\"', index + 1);\n      if (end < 0) return undefined;\n      const text = value.slice(index + 1, end);\n      index = end + 1;\n      if (name === 'keyid') keyId = text;\n      else if (name === 'alg') algorithm = text;\n    } else {\n      let end = index;\n      while (end < value.length && value[end] !== ';') end++;\n      const text = value.slice(index, end);\n      if (!/^\\d+$/.test(text)) return undefined;\n      if (name === 'created') {\n        const integer = BigInt(text);\n        if (integer > 9_223_372_036_854_775_807n) return undefined;\n        created = Number(integer);\n      }\n      index = end;\n    }\n  }\n  if (created === undefined || keyId === undefined) return undefined;\n  return { label, identifiers, created, keyId, ...(algorithm === undefined ? {} : { algorithm }) };\n}\n","/** Response component and its exact value, rebuilt locally so the response cannot omit a protected field. */\nexport interface ResponseComponent {\n  /** Lower-case name or pseudo-header required by RFC 9421. */\n  name: string;\n  /** Value received from the response and covered by the signature. */\n  value: string;\n  /** Whether the field is bound to the request that this client actually sent. */\n  requestBound: boolean;\n}\n\n/**\n * Rebuilds the frozen response component profile before checking a signature.\n *\n * @remarks The advertised component list is not trusted: rebuilding from received fields ensures the body digest and\n * request binding remain covered even if a response tries to omit them.\n */\nexport const PartnerResponseSignatureBase = {\n  /** Response signatures are accepted within this whole-second window to match the gateway's freshness calculation. */ MAX_AGE_SECONDS: 60,\n  /** The sole response label; disagreement between headers is refused. */ label: 'sig1',\n  /** The only supported algorithm; there is no weaker fallback for responses. */ algorithm: 'ecdsa-p256-sha256',\n\n  /** Derives covered fields from what actually arrived so absent optional values are never signed as empty fields. */\n  components(\n    status: number,\n    digest: string,\n    requestId: string,\n    requestSignatureInput?: string,\n    location?: string,\n    retryAfter?: string,\n    replayed?: string,\n    cacheControl?: string,\n  ): ResponseComponent[] {\n    const result: ResponseComponent[] = [\n      { name: '@status', value: String(status), requestBound: false },\n      { name: 'content-digest', value: digest, requestBound: false },\n      { name: 'x-request-id', value: requestId, requestBound: false },\n    ];\n    if (requestSignatureInput)\n      result.push({ name: 'signature-input', value: requestSignatureInput, requestBound: true });\n    for (const [name, value] of [\n      ['location', location],\n      ['retry-after', retryAfter],\n      ['idempotency-replayed', replayed],\n      ['cache-control', cacheControl],\n    ] as const)\n      if (value) result.push({ name, value, requestBound: false });\n    return result;\n  },\n\n  /** Builds exact UTF-8 bytes; request binding and its `;req` identifier must agree in both places. */\n  build(components: readonly ResponseComponent[], created: number, keyId: string): Uint8Array {\n    const params = `(${components.map((part) => `\"${part.name}\"${part.requestBound ? ';req' : ''}`).join(' ')});created=${String(created)};keyid=\"${keyId}\";alg=\"${PartnerResponseSignatureBase.algorithm}\"`;\n    const lines = components.map((part) => `\"${part.name}\"${part.requestBound ? ';req' : ''}: ${part.value}\\n`);\n    lines.push(`\"@signature-params\": ${params}`);\n    return new TextEncoder().encode(lines.join(''));\n  },\n};\n","import type { ResponseVerificationFailure } from './response-verification-failure.js';\nimport { AnisPartnersError } from '../errors/anis-partners-error.js';\n\n/**\n * Thrown when a response cannot be verified, so its content cannot be used.\n *\n * @remarks This is an exception rather than a flag on a result because callers must not accidentally act on an\n * unverified answer.\n */\nexport class UnverifiableResponseError extends AnisPartnersError {\n  /** The contract reason for refusing the response, without requiring callers to parse message text. */\n  readonly failure: ResponseVerificationFailure;\n  /** Creates a response refusal while keeping its body, signature, base, and key material out of the message. */\n  constructor(failure: ResponseVerificationFailure, detail: string) {\n    super(`The Anis response could not be verified (${failure}): ${detail} Its content has been discarded.`);\n    this.failure = failure;\n  }\n}\n","import {\n  metrics,\n  SpanKind,\n  trace,\n  type Counter,\n  type Histogram,\n  type Meter,\n  type Span,\n  type SpanOptions,\n} from '@opentelemetry/api';\nimport type { PartnerLogger } from '../observability/logger.js';\nimport { AnisPartnersTelemetry } from '../observability/telemetry-names.js';\n\nconst packageVersion = '1.0.0';\nconst histograms = new WeakMap<Meter, Map<string, Histogram>>();\nconst counters = new WeakMap<Meter, Map<string, Counter>>();\n\n/** Runs the business callback even when a host tracing provider throws before creating a span. */\nexport async function withSafeSpan<T>(name: string, action: (span: Span | undefined) => Promise<T>): Promise<T> {\n  let callbackResult: Promise<T> | undefined;\n  try {\n    const tracer = trace.getTracer(AnisPartnersTelemetry.scope, packageVersion);\n    const result = tracer.startActiveSpan(name, { kind: SpanKind.CLIENT } satisfies SpanOptions, (span) => {\n      callbackResult = Promise.resolve().then(() => action(span));\n      return callbackResult;\n    });\n    void Promise.resolve(result).catch(() => undefined);\n    if (callbackResult !== undefined) return await callbackResult;\n    await result;\n  } catch {\n    if (callbackResult !== undefined) return callbackResult;\n  }\n  return action(undefined);\n}\n\n/** Swallows host span failures so instrumentation cannot change the API result. */\nexport function safeSpan(span: Span | undefined, action: (span: Span) => void): void {\n  if (span === undefined) return;\n  try {\n    action(span);\n  } catch {\n    // Host instrumentation is diagnostic only.\n  }\n}\n\n/** Sends a structured message without allowing a host logger to affect a business result. */\nexport function safeLog(\n  logger: Partial<PartnerLogger> | undefined,\n  level: keyof PartnerLogger,\n  message: string,\n  fields: Record<string, unknown>,\n): void {\n  if (logger === undefined) return;\n  try {\n    const result = logger[level]?.(message, fields);\n    if (result !== undefined && typeof (result as PromiseLike<unknown>).then === 'function') {\n      void Promise.resolve(result).catch(() => undefined);\n    }\n  } catch {\n    // Host instrumentation is diagnostic only.\n  }\n}\n\n/** Records a histogram value without allowing a host meter to affect a business result. */\nexport function safeHistogram(\n  name: string,\n  value: number,\n  attributes: Record<string, string | number | boolean>,\n  options?: { unit?: string },\n): void {\n  try {\n    const meter = metrics.getMeter(AnisPartnersTelemetry.scope, packageVersion);\n    const instruments = instrumentsFor(histograms, meter);\n    let instrument = instruments.get(name);\n    if (instrument === undefined) {\n      instrument = meter.createHistogram(name, { ...options, description: `${name} for signed Partner API calls` });\n      instruments.set(name, instrument);\n    }\n    instrument.record(value, attributes);\n  } catch {\n    // Host instrumentation is diagnostic only.\n  }\n}\n\n/** Increments a counter without allowing a host meter to affect a business result. */\nexport function safeCounter(name: string, attributes: Record<string, string | number | boolean>): void {\n  try {\n    const meter = metrics.getMeter(AnisPartnersTelemetry.scope, packageVersion);\n    const instruments = instrumentsFor(counters, meter);\n    let instrument = instruments.get(name);\n    if (instrument === undefined) {\n      instrument = meter.createCounter(name, { description: `${name} for signed Partner API calls` });\n      instruments.set(name, instrument);\n    }\n    instrument.add(1, attributes);\n  } catch {\n    // Host instrumentation is diagnostic only.\n  }\n}\n\nfunction instrumentsFor<T>(cache: WeakMap<Meter, Map<string, T>>, meter: Meter): Map<string, T> {\n  let instruments = cache.get(meter);\n  if (instruments === undefined) {\n    instruments = new Map<string, T>();\n    cache.set(meter, instruments);\n  }\n  return instruments;\n}\n","/**\n * Stable OpenTelemetry names for dashboards and host-side instrumentation configuration.\n *\n * @remarks These constants keep integrations aligned with the SDK's bounded dimensions so telemetry does not split\n * into incompatible series after an application upgrade.\n */\nexport const AnisPartnersTelemetry = {\n  /** Instrumentation scope used for every SDK span and metric. */\n  scope: '@anis-ly/partners',\n  /** Stable low-cardinality attribute names. */\n  attributes: {\n    client: 'anis.client',\n    route: 'anis.route',\n    method: 'http.request.method',\n    statusCode: 'http.response.status_code',\n    errorType: 'error.type',\n    errorCode: 'anis.error.code',\n    operationId: 'anis.operation_id',\n    requestId: 'anis.request_id',\n  },\n  /** Metric instrument names emitted by the SDK. */\n  instruments: {\n    requestDuration: 'anis.partners.request.duration',\n    signatureDuration: 'anis.partners.signature.duration',\n    verificationFailures: 'anis.partners.response.verification.failures',\n    orderOutcomes: 'anis.partners.order.outcomes',\n    signingKeyFetches: 'anis.partners.signing_keys.fetches',\n  },\n} as const;\n","import type { SignatureProfile } from '../signing/signature-profile.js';\n\n/** One route from the SDK's closed Partner API surface. */\nexport interface PartnerRoute {\n  /** HTTP method the SDK sends. */\n  method: string;\n  /** Published path template, with identifiers left as placeholders. */\n  template: string;\n  /** Required signing profile, or absent for enrollment-token and public key-document routes. */\n  profile?: SignatureProfile;\n}\n\n/**\n * Closed route table held against the published OpenAPI contract by drift tests.\n *\n * @remarks A local route can drift in either direction: an invented route may be refused, while an omitted published\n * route leaves a partner unable to reach part of the API. The drift test checks both.\n */\nexport const PARTNER_ROUTES = [\n  { method: 'GET', template: '/v1/profile', profile: 'SafeRead' },\n  { method: 'GET', template: '/v1/wallets', profile: 'SafeRead' },\n  { method: 'GET', template: '/v1/wallets/{walletId}', profile: 'SafeRead' },\n  { method: 'GET', template: '/v1/wallets/{walletId}/catalog/categories', profile: 'SafeRead' },\n  {\n    method: 'GET',\n    template: '/v1/wallets/{walletId}/catalog/categories/{categoryId}/subcategories',\n    profile: 'SafeRead',\n  },\n  { method: 'GET', template: '/v1/wallets/{walletId}/catalog/subcategories/{subcategoryId}', profile: 'SafeRead' },\n  {\n    method: 'GET',\n    template: '/v1/wallets/{walletId}/catalog/subcategories/{subcategoryId}/cards',\n    profile: 'SafeRead',\n  },\n  { method: 'POST', template: '/v1/wallets/{walletId}/orders', profile: 'OrderMutation' },\n  { method: 'GET', template: '/v1/orders/{operationId}', profile: 'SafeRead' },\n  { method: 'GET', template: '/v1/wallets/{walletId}/cards', profile: 'SafeRead' },\n  { method: 'GET', template: '/v1/wallets/{walletId}/cards/{soldCardId}', profile: 'SafeRead' },\n  { method: 'POST', template: '/v1/wallets/{walletId}/cards/{soldCardId}/reveal', profile: 'BodylessNonceMutation' },\n  {\n    method: 'POST',\n    template: '/v1/wallets/{walletId}/invoices/{invoiceId}/cards/reveal',\n    profile: 'BodylessNonceMutation',\n  },\n  { method: 'POST', template: '/v1/diagnostics/signature', profile: 'BodylessNonceMutation' },\n  { method: 'GET', template: '/v1/enrollments/{invitationId}' },\n  { method: 'POST', template: '/v1/enrollments/{invitationId}/keys' },\n  { method: 'POST', template: '/v1/enrollments/{invitationId}/proof' },\n  { method: 'GET', template: '/v1/enrollments/{invitationId}/status' },\n  { method: 'GET', template: '/.well-known/partner-signing-keys.json' },\n] as const satisfies readonly PartnerRoute[];\n","import { randomBytes } from 'node:crypto';\nimport { encodeBase64Url } from '../internal/base64url.js';\n\n/** Creates the single-use nonce that protects a mutation from replay. */\nexport interface NonceFactory {\n  /** Returns 128 random bits in unpadded base64url; repeated or guessable values are refused as replays. */\n  create(): string;\n}\n\n/** Uses the operating system cryptographic random source for every mutation attempt. */\nexport class RandomNonceFactory implements NonceFactory {\n  /** Generates a fresh 16-byte nonce so retries do not reuse a replayable request value. */\n  create(): string {\n    return encodeBase64Url(randomBytes(16));\n  }\n}\n","import { AnisPartnersError } from './anis-partners-error.js';\n\n/** A signed answer violated a model contract; its content is deliberately absent from the message and cause. */\nexport class MalformedResponseError extends AnisPartnersError {\n  readonly model: string;\n\n  constructor(model: string) {\n    super(`The verified Anis response did not match the ${model} contract.`);\n    this.model = model;\n  }\n}\n","import { AnisPartnersError } from './anis-partners-error.js';\n\n/** The public signing-key document could not be loaded, so the response has no usable verification key set. */\nexport class SigningKeyDocumentUnavailableError extends AnisPartnersError {\n  constructor() {\n    super('The Anis signing-key document could not be loaded.');\n  }\n}\n","/** Client settings that select one issued authority and bound signing, caching, and request time. */\nexport interface ClientOptions {\n  /** Issued Anis authority; the host is the only environment selector. */\n  authority: string | URL;\n  /** Signature lifetime in seconds. Capped at 60 so a request cannot finish after its answer freshness window. */\n  signatureLifetimeSeconds?: number | undefined;\n  /** Optional Arabic or English presentation preference. */\n  acceptLanguage?: 'ar' | 'en' | undefined;\n  /** Lifetime of the published response signing-key document cache. */\n  signingKeyCacheSeconds?: number | undefined;\n  /** Per-request timeout; an order timeout leaves its outcome unknown. */\n  timeoutMs?: number | undefined;\n  /** Stable host label used for bounded metric dimensions. */\n  name?: string | undefined;\n}\n\n/** Applies SDK defaults and rejects settings that could place orders whose answers are already stale. */\nexport interface ValidatedClientOptions {\n  authority: URL;\n  signatureLifetimeSeconds: number;\n  signingKeyCacheSeconds: number;\n  timeoutMs: number;\n  name: string;\n  acceptLanguage?: 'ar' | 'en' | undefined;\n}\n\n/** Rejects invalid authorities and stale signature lifetimes before a call can become unverifiable or leave an order unresolved. */\nexport function validateClientOptions(options: ClientOptions): ValidatedClientOptions {\n  const authority = new URL(options.authority);\n  const hostname = authority.hostname.toLowerCase().replace(/^\\[|\\]$/g, '');\n  const loopback = hostname === 'localhost' || hostname === '127.0.0.1' || hostname === '::1';\n  if (authority.protocol !== 'https:' && !(authority.protocol === 'http:' && loopback))\n    throw new TypeError(\n      'Authority must use HTTPS; plain HTTP lets an on-path attacker replace the unsigned key document and read card codes. HTTP is allowed only for loopback testing.',\n    );\n  if (authority.pathname !== '/' || authority.search || authority.hash)\n    throw new TypeError('Authority must not include a path, query, or fragment.');\n  const signatureLifetimeSeconds = options.signatureLifetimeSeconds ?? 60;\n  const signingKeyCacheSeconds = options.signingKeyCacheSeconds ?? 600;\n  const timeoutMs = options.timeoutMs ?? 30_000;\n  if (!Number.isInteger(signatureLifetimeSeconds) || signatureLifetimeSeconds < 1 || signatureLifetimeSeconds > 60)\n    throw new RangeError(\n      'signatureLifetimeSeconds must be from 1 through 60 so signed order answers remain fresh enough to verify.',\n    );\n  if (!Number.isFinite(signingKeyCacheSeconds) || signingKeyCacheSeconds <= 0)\n    throw new RangeError('signingKeyCacheSeconds must be a positive number.');\n  if (!Number.isInteger(timeoutMs) || timeoutMs < 1 || timeoutMs > 2_147_483_647)\n    throw new RangeError('timeoutMs must be an integer from 1 through 2147483647.');\n  const acceptLanguage: unknown = (options as { acceptLanguage?: unknown }).acceptLanguage;\n  if (acceptLanguage !== undefined && acceptLanguage !== 'ar' && acceptLanguage !== 'en')\n    throw new TypeError(\"acceptLanguage must be either 'ar' or 'en'.\");\n  return {\n    authority,\n    signatureLifetimeSeconds,\n    signingKeyCacheSeconds,\n    timeoutMs,\n    name: options.name ?? 'default',\n    ...(acceptLanguage === undefined ? {} : { acceptLanguage }),\n  };\n}\n","import { createHash } from 'node:crypto';\nimport type { SigningKeySet } from './partner-jwk.js';\nimport { parseSigningKeySet } from './partner-jwk.js';\nimport type { SigningKeyRequestOptions, SigningKeySource } from './signing-key-source.js';\nimport { safeCounter, safeLog } from '../internal/safe-telemetry.js';\nimport { SigningKeyDocumentUnavailableError } from '../errors/signing-key-document-unavailable-error.js';\n\n/** Optional shared cache for serverless instances that do not retain process memory between requests. */\nexport interface KeyDocumentCache {\n  /** Reads a cached document by stable authority key so another instance can avoid a duplicate fetch. */\n  get(key: string): Promise<string | undefined>;\n  /** Stores the public document for the requested lifetime. */\n  set(key: string, value: string, ttlSeconds: number): Promise<void>;\n}\n\n/** Receives non-secret refresh diagnostics without logging response content or key material. */\nexport interface SigningKeyLogger {\n  /** Records the fetch reason and key count without exposing the document. */\n  debug?(msg: string, fields: Record<string, unknown>): void;\n  /** Records a successful document fetch as an informational event. */\n  info?(msg: string, fields: Record<string, unknown>): void;\n  /** Records a shared-cache write failure without affecting response verification. */\n  warn?(msg: string, fields: Record<string, unknown>): void;\n}\n\n/** Options for fetching and caching the sole unsigned public key document. */\nexport interface HttpSigningKeySourceOptions {\n  /** Partner authority whose published keys verify signed responses. */\n  authority: string | URL;\n  /** Cache duration; ten minutes by default limits requests while allowing key rotation to propagate. */\n  cacheSeconds?: number;\n  /** Injectable fetch function for hosts and tests that control outbound HTTP. */\n  fetch?: typeof globalThis.fetch;\n  /** Optional shared cache for serverless hosts with short-lived instances. */\n  documentCache?: KeyDocumentCache;\n  /** Optional logger that receives cache reads, fetch reasons, and key counts without key material. */\n  logger?: SigningKeyLogger;\n}\n\n/** Fetches and caches the sole unsigned Partner API document used to verify every signed answer. */\nexport class HttpSigningKeySource implements SigningKeySource {\n  private readonly authority: URL;\n  private readonly cacheSeconds: number;\n  private readonly fetcher: typeof globalThis.fetch;\n  private readonly cache?: KeyDocumentCache;\n  private readonly logger?: SigningKeyLogger;\n  private cached?: { document: SigningKeySet; until: number };\n  private inFlight: { controller: AbortController; waiters: number; promise: Promise<SigningKeySet> } | undefined;\n\n  /** Creates an authority-scoped source; caching avoids a key-document request for every Partner response. */\n  constructor(options: HttpSigningKeySourceOptions) {\n    this.authority = new URL(options.authority);\n    this.cacheSeconds = options.cacheSeconds ?? 600;\n    if (!Number.isFinite(this.cacheSeconds) || this.cacheSeconds < 0)\n      throw new RangeError('Cache seconds must be non-negative.');\n    this.fetcher = options.fetch ?? globalThis.fetch;\n    if (options.documentCache !== undefined) this.cache = options.documentCache;\n    if (options.logger !== undefined) this.logger = options.logger;\n  }\n\n  /** Returns an unexpired document and shares one first-use fetch among concurrent callers. */\n  async get(options?: SigningKeyRequestOptions): Promise<SigningKeySet> {\n    throwIfAborted(options?.signal);\n    if (this.cached && this.cached.until > performance.now()) return this.cached.document;\n    if (this.inFlight) return this.waitForFlight(this.inFlight, options?.signal);\n    const reason = this.cached ? 'expired' : 'first-use';\n    return this.fetchAndCache(reason, options?.signal);\n  }\n\n  /** Forces a fetch after rotation or an explicit caller refresh, even when the cache is still fresh. */\n  async refresh(options?: SigningKeyRequestOptions): Promise<SigningKeySet> {\n    throwIfAborted(options?.signal);\n    return this.fetchAndCache('refresh', options?.signal);\n  }\n\n  private fetchAndCache(reason: 'first-use' | 'expired' | 'refresh', signal?: AbortSignal): Promise<SigningKeySet> {\n    if (this.inFlight) return this.waitForFlight(this.inFlight, signal);\n    const controller = new AbortController();\n    const promise = this.fetchDocument(reason, controller.signal).finally(() => {\n      if (this.inFlight?.controller === controller) this.inFlight = undefined;\n    });\n    const flight = { controller, waiters: 0, promise };\n    this.inFlight = flight;\n    return this.waitForFlight(flight, signal);\n  }\n\n  private waitForFlight(\n    flight: { controller: AbortController; waiters: number; promise: Promise<SigningKeySet> },\n    signal?: AbortSignal,\n  ): Promise<SigningKeySet> {\n    flight.waiters += 1;\n    return new Promise((resolve, reject) => {\n      let finished = false;\n      const release = () => {\n        if (finished) return;\n        finished = true;\n        signal?.removeEventListener('abort', abort);\n        flight.waiters -= 1;\n      };\n      const abort = () => {\n        release();\n        if (flight.waiters === 0) {\n          if (this.inFlight?.controller === flight.controller) this.inFlight = undefined;\n          flight.controller.abort(signal?.reason);\n        }\n        reject(abortReason(signal));\n      };\n      if (signal?.aborted) {\n        abort();\n        return;\n      }\n      signal?.addEventListener('abort', abort, { once: true });\n      flight.promise.then(\n        (document) => {\n          release();\n          resolve(document);\n        },\n        (error: unknown) => {\n          release();\n          reject(error instanceof Error ? error : new Error('The signing-key request failed.', { cause: error }));\n        },\n      );\n    });\n  }\n\n  private async fetchDocument(\n    reason: 'first-use' | 'expired' | 'refresh',\n    signal: AbortSignal,\n  ): Promise<SigningKeySet> {\n    const normalizedAuthority = this.authority.toString().toLowerCase().replace(/\\/+$/, '');\n    const cacheKey = `anis_partners_keys_${createHash('sha256').update(normalizedAuthority).digest('hex').slice(0, 32)}`;\n    if (reason === 'first-use' && this.cache) {\n      const cached = await settleCache(() => this.cache?.get(cacheKey) ?? Promise.resolve(undefined), signal);\n      throwIfAborted(signal);\n      const stored = cached.ok ? cached.value : undefined;\n      if (stored !== undefined) {\n        try {\n          const envelope: unknown = JSON.parse(stored);\n          if (isCacheEnvelope(envelope)) {\n            const nowSeconds = Date.now() / 1000;\n            const remainingMs = (envelope.fetchedAt + this.cacheSeconds - nowSeconds) * 1000;\n            if (remainingMs > 0 && envelope.fetchedAt <= nowSeconds + 60) {\n              const document = parseSigningKeySet(envelope.document);\n              this.cached = { document, until: performance.now() + remainingMs };\n              safeLog(this.logger, 'debug', 'signing keys read from the shared cache', {});\n              return document;\n            }\n          }\n        } catch {\n          /* Fetch a replaced or malformed shared cache entry. */\n        }\n      }\n    }\n    const url = new URL('/.well-known/partner-signing-keys.json', this.authority);\n    let response: Response;\n    try {\n      response = await this.fetcher(url, {\n        headers: { 'Accept-Encoding': 'identity' },\n        redirect: 'manual',\n        signal,\n      });\n    } catch {\n      if (signal.aborted) throw abortReason(signal);\n      throw new SigningKeyDocumentUnavailableError();\n    }\n    if (!response.ok) {\n      await cancelBody(response);\n      throw new SigningKeyDocumentUnavailableError();\n    }\n    const contentEncoding = response.headers.get('content-encoding');\n    if (contentEncoding !== null && contentEncoding.toLowerCase() !== 'identity') {\n      await cancelBody(response);\n      throw new SigningKeyDocumentUnavailableError();\n    }\n    let text: string;\n    let document: SigningKeySet;\n    try {\n      text = await response.text();\n      document = parseSigningKeySet(text);\n    } catch {\n      if (signal.aborted) throw abortReason(signal);\n      throw new SigningKeyDocumentUnavailableError();\n    }\n    const fetchedAt = Math.floor(Date.now() / 1000);\n    this.cached = { document, until: performance.now() + this.cacheSeconds * 1000 };\n    if (this.cache !== undefined) {\n      const value = JSON.stringify({ fetchedAt, document: text });\n      const written = await settleCache(\n        () => this.cache?.set(cacheKey, value, this.cacheSeconds) ?? Promise.resolve(),\n        signal,\n      );\n      if (!written.ok) safeLog(this.logger, 'warn', 'shared signing-key cache write failed', {});\n    }\n    safeLog(this.logger, 'info', `Signing keys fetched: reason=${reason}, keyCount=${String(document.keys.length)}.`, {\n      reason,\n      keyCount: document.keys.length,\n    });\n    safeCounter('anis.partners.signing_keys.fetches', { 'anis.fetch.reason': reason });\n    return document;\n  }\n}\n\nfunction isCacheEnvelope(value: unknown): value is { fetchedAt: number; document: string } {\n  if (typeof value !== 'object' || value === null) return false;\n  const record = value as Record<string, unknown>;\n  return (\n    typeof record.fetchedAt === 'number' &&\n    Number.isSafeInteger(record.fetchedAt) &&\n    typeof record.document === 'string'\n  );\n}\n\nfunction settleCache<T>(\n  operation: () => Promise<T>,\n  signal: AbortSignal,\n): Promise<{ ok: true; value: T } | { ok: false }> {\n  return new Promise((resolve) => {\n    let settled = false;\n    const finish = (result: { ok: true; value: T } | { ok: false }) => {\n      if (settled) return;\n      settled = true;\n      clearTimeout(timer);\n      signal.removeEventListener('abort', onAbort);\n      resolve(result);\n    };\n    const onAbort = () => {\n      finish({ ok: false });\n    };\n    const timer = setTimeout(() => {\n      finish({ ok: false });\n    }, 2_000);\n    signal.addEventListener('abort', onAbort, { once: true });\n    Promise.resolve()\n      .then(operation)\n      .then(\n        (value) => {\n          finish({ ok: true, value });\n        },\n        () => {\n          finish({ ok: false });\n        },\n      );\n  });\n}\n\nfunction throwIfAborted(signal: AbortSignal | undefined): void {\n  if (signal?.aborted) throw abortReason(signal);\n}\n\nasync function cancelBody(response: Response): Promise<void> {\n  try {\n    await response.body?.cancel();\n  } catch {\n    // A refused body cannot be used even when the host stream refuses cancellation.\n  }\n}\n\nfunction abortReason(signal: AbortSignal | undefined): Error {\n  return signal?.reason instanceof Error ? signal.reason : new DOMException('The operation was aborted.', 'AbortError');\n}\n","/**\n * One public key published for verifying Partner responses.\n *\n * @remarks Active, next, and retiring versions are published together so a response around a key rotation can still\n * be verified without trusting a key supplied by that response.\n */\nexport interface PartnerJwk {\n  /** Key type; only EC keys can be imported by the response verifier. */ kty?: string;\n  /** Curve; only P-256 matches the algorithm Anis uses for response signatures. */ crv?: string;\n  /** Base64url X coordinate; it must decode to 32 bytes for a P-256 point. */ x?: string;\n  /** Base64url Y coordinate; both coordinates are required to validate the published point. */ y?: string;\n  /** Response key version identifier used to find the key named by a response. */ kid?: string;\n  /** Intended use when published; retained so the document is represented faithfully. */ use?: string;\n  /** Algorithm when published; retained for partner inspection and protocol compatibility. */ alg?: string;\n  /** Private scalar; a non-empty value means the whole document has exposed private key material. */ d?: string;\n}\n\n/** Published response verification key set; rotation versions are needed to verify answers during key changes. */\nexport interface SigningKeySet {\n  /** Active, next, and retiring public key versions published together for safe rotation. */\n  keys: readonly PartnerJwk[];\n}\n\n/** Parses a key document before it is used, preventing malformed JSON shape from leaking into verification. */\nexport function parseSigningKeySet(json: string): SigningKeySet {\n  const value: unknown = JSON.parse(json);\n  if (typeof value !== 'object' || value === null || !('keys' in value) || !Array.isArray(value.keys))\n    throw new TypeError('The signing-key document must contain a keys array.');\n  return { keys: value.keys.map(parsePartnerJwk) };\n}\n\ntype JwkStringMember = 'kty' | 'crv' | 'x' | 'y' | 'kid' | 'use' | 'alg' | 'd';\nconst jwkStringMembers: readonly JwkStringMember[] = ['kty', 'crv', 'x', 'y', 'kid', 'use', 'alg', 'd'];\n\nfunction parsePartnerJwk(value: unknown): PartnerJwk {\n  if (typeof value !== 'object' || value === null || Array.isArray(value))\n    throw new TypeError('Every signing key must be a JSON object.');\n  const source = value as Record<string, unknown>;\n  const result: Partial<Record<JwkStringMember, string>> = {};\n  for (const member of jwkStringMembers) {\n    const entry = source[member];\n    if (member === 'd' && entry === null) continue;\n    if (entry === undefined) continue;\n    if (typeof entry !== 'string') throw new TypeError(`The signing-key member \"${member}\" must be a string.`);\n    result[member] = entry;\n  }\n  return result;\n}\n","import { fixedTimeEqual } from '../internal/bytes.js';\nimport { canonicalUuid } from '../internal/uuid.js';\nimport { keyThumbprint } from './key-thumbprint.js';\nimport { safetyCodeFromThumbprint } from './safety-code.js';\nimport { proofMessage, proofSignature } from './enrollment-proof.js';\nimport type {\n  EnrollmentKeyRequest,\n  EnrollmentKeyResult,\n  EnrollmentProofRequest,\n  EnrollmentState,\n  EnrollmentStatus,\n} from '../models/enrollment.js';\nimport { parseEnrollmentKeyResult, parseEnrollmentState, parseEnrollmentStatus } from '../models/enrollment.js';\nimport type { P256Signer } from '../signing/p256-signer.js';\nimport type { PartnerTransport } from '../operations/partner-transport.js';\nimport { PartnerTransport as Transport } from '../operations/partner-transport.js';\nimport type { TransportOptions } from '../operations/partner-transport.js';\nimport { validateClientOptions, type ClientOptions } from '../client-options.js';\nimport { HttpSigningKeySource, type KeyDocumentCache } from '../verification/http-signing-key-source.js';\nimport type { PartnerLogger } from '../observability/logger.js';\nimport { AnisPartnersError } from '../errors/anis-partners-error.js';\nimport { safeLog } from '../internal/safe-telemetry.js';\n\n/** Settings for an enrollment invitation before an active request key exists. */\nexport interface AnisEnrollmentClientOptions {\n  /** Issued Anis authority. */\n  authority: string | URL;\n  /** Invitation UUID being enrolled. */\n  invitationId: string;\n  /** Secret invitation token; it is sent only in Authorization and never logged. */\n  enrollmentToken: string;\n  /** Injectable fetch for proxies and in-memory API doubles. */\n  fetch?: typeof globalThis.fetch | undefined;\n  /** Shared key-document cache for short-lived hosts. */\n  keyCache?: KeyDocumentCache | undefined;\n  /** Optional structured log sink. */\n  logger?: Partial<PartnerLogger> | undefined;\n  /** Cache lifetime for the unsigned public response-key document. */\n  signingKeyCacheSeconds?: number | undefined;\n  /** Per-request timeout. */\n  timeoutMs?: number | undefined;\n}\n\n/** Raised when the verified challenge names a different key than the one submitted. */\nexport class EnrollmentKeyMismatchError extends AnisPartnersError {\n  /** Thumbprint calculated from the public key submitted by this caller. */\n  readonly localThumbprint: string;\n  /** Thumbprint returned by Anis, when present. */\n  readonly serverThumbprint?: string;\n  /** Stops a proof from being made with a challenge bound to another key. */\n  constructor(localThumbprint: string, serverThumbprint?: string) {\n    super(\n      'The key Anis holds differs from the one submitted. Do not prove possession; ask Anis to restart enrollment.',\n    );\n    this.localThumbprint = localThumbprint;\n    if (serverThumbprint !== undefined) this.serverThumbprint = serverThumbprint;\n  }\n}\n\n/** Enrollment flow, authenticated by its one-time token and still verifying every answer. */\nexport class AnisEnrollmentClient {\n  private readonly transport: PartnerTransport;\n  private readonly invitation: string;\n  readonly #token: string;\n  private constructor(transport: PartnerTransport, invitationId: string, token: string) {\n    this.transport = transport;\n    this.invitation = canonicalUuid(invitationId, 'invitationId');\n    this.#token = token;\n  }\n  /** Creates an enrollment client over the same mandatory response-verification pipeline. */\n  static create(input: AnisEnrollmentClientOptions): AnisEnrollmentClient {\n    if (input.enrollmentToken.trim().length === 0 || hasControlCharacters(input.enrollmentToken))\n      throw new TypeError('The enrollment token must be non-blank and contain no control characters.');\n    const options = validateClientOptions({\n      authority: input.authority,\n      ...(input.signingKeyCacheSeconds === undefined ? {} : { signingKeyCacheSeconds: input.signingKeyCacheSeconds }),\n      ...(input.timeoutMs === undefined ? {} : { timeoutMs: input.timeoutMs }),\n    } satisfies ClientOptions);\n    const fetcher = input.fetch ?? globalThis.fetch;\n    const keySource = new HttpSigningKeySource({\n      authority: options.authority,\n      cacheSeconds: options.signingKeyCacheSeconds,\n      fetch: fetcher,\n      ...(input.keyCache === undefined ? {} : { documentCache: input.keyCache }),\n      ...(input.logger === undefined\n        ? {}\n        : {\n            logger: {\n              debug(message: string, fields: Record<string, unknown>) {\n                safeLog(input.logger, 'debug', message, fields);\n              },\n              info(message: string, fields: Record<string, unknown>) {\n                safeLog(input.logger, 'info', message, { ...fields, eventId: 1005 });\n              },\n              warn(message: string, fields: Record<string, unknown>) {\n                safeLog(input.logger, 'warn', message, fields);\n              },\n            },\n          }),\n    });\n    const transportOptions: TransportOptions = {\n      ...options,\n      fetcher,\n      keySource,\n      ...(input.logger === undefined ? {} : { logger: input.logger }),\n    };\n    return new AnisEnrollmentClient(new Transport(transportOptions), input.invitationId, input.enrollmentToken);\n  }\n  /** Reads invitation state. */\n  async get(options?: { signal?: AbortSignal }): Promise<EnrollmentState> {\n    return this.transport.json(\n      {\n        method: 'GET',\n        route: '/v1/enrollments/{invitationId}',\n        path: `/v1/enrollments/${this.invitation}`,\n        enrollmentToken: this.#token,\n        ...(options?.signal === undefined ? {} : { signal: options.signal }),\n      },\n      parseEnrollmentState,\n    );\n  }\n  /** Reads approval and key-expiry state. */\n  async getStatus(options?: { signal?: AbortSignal }): Promise<EnrollmentStatus> {\n    return this.transport.json(\n      {\n        method: 'GET',\n        route: '/v1/enrollments/{invitationId}/status',\n        path: `/v1/enrollments/${this.invitation}/status`,\n        enrollmentToken: this.#token,\n        ...(options?.signal === undefined ? {} : { signal: options.signal }),\n      },\n      parseEnrollmentStatus,\n    );\n  }\n  /** Submits a public key, then checks the verified answer against its local RFC 7638 thumbprint. */\n  async submitKey(request: EnrollmentKeyRequest, options?: { signal?: AbortSignal }): Promise<EnrollmentKeyResult> {\n    rejectPrivateMembers(request.publicJwk);\n    const local = keyThumbprint(request.publicJwk);\n    const bytes = new TextEncoder().encode(\n      JSON.stringify({\n        publicJwk: {\n          kty: request.publicJwk.kty,\n          crv: request.publicJwk.crv,\n          x: request.publicJwk.x,\n          y: request.publicJwk.y,\n        },\n        notBefore: request.notBefore,\n        expiresAt: request.expiresAt,\n      }),\n    );\n    const answer = await this.transport.json(\n      {\n        method: 'POST',\n        route: '/v1/enrollments/{invitationId}/keys',\n        path: `/v1/enrollments/${this.invitation}/keys`,\n        body: bytes,\n        enrollmentToken: this.#token,\n        ...(options?.signal === undefined ? {} : { signal: options.signal }),\n      },\n      parseEnrollmentKeyResult,\n    );\n    if (\n      answer.thumbprint === undefined ||\n      !fixedTimeEqual(new TextEncoder().encode(local), new TextEncoder().encode(answer.thumbprint))\n    )\n      throw new EnrollmentKeyMismatchError(local, answer.thumbprint);\n    return { ...answer, safetyCode: safetyCodeFromThumbprint(local) };\n  }\n  /** Builds the possession message, obtains its P-256 signature, and submits the proof. */\n  async prove(\n    submitted: EnrollmentKeyResult,\n    signer: P256Signer,\n    options?: { signal?: AbortSignal },\n  ): Promise<EnrollmentStatus> {\n    const message = proofMessage(\n      submitted.keyId,\n      submitted.challengeGeneration ?? missing('challengeGeneration'),\n      submitted.challenge ?? missing('challenge'),\n      submitted.thumbprint ?? missing('thumbprint'),\n    );\n    const signature = await proofSignature(message, signer);\n    return this.submitProof(\n      {\n        keyId: submitted.keyId,\n        challengeGeneration: submitted.challengeGeneration ?? missing('challengeGeneration'),\n        signature,\n      },\n      options,\n    );\n  }\n  /** Submits a previously prepared proof for the current challenge generation. */\n  async submitProof(request: EnrollmentProofRequest, options?: { signal?: AbortSignal }): Promise<EnrollmentStatus> {\n    return this.transport.json(\n      {\n        method: 'POST',\n        route: '/v1/enrollments/{invitationId}/proof',\n        path: `/v1/enrollments/${this.invitation}/proof`,\n        body: new TextEncoder().encode(\n          JSON.stringify({\n            keyId: request.keyId,\n            challengeGeneration: request.challengeGeneration,\n            signature: request.signature,\n          }),\n        ),\n        enrollmentToken: this.#token,\n        ...(options?.signal === undefined ? {} : { signal: options.signal }),\n      },\n      parseEnrollmentStatus,\n    );\n  }\n}\n\nconst privateJwkMembers = ['d', 'p', 'q', 'dp', 'dq', 'qi', 'oth', 'k'] as const;\n\nfunction rejectPrivateMembers(jwk: object): void {\n  for (const member of privateJwkMembers) {\n    if (Object.hasOwn(jwk, member)) throw new TypeError('Enrollment accepts a public JWK only.');\n  }\n}\nfunction missing(member: string): never {\n  throw new TypeError(`Enrollment key answer has no ${member}.`);\n}\n\nfunction hasControlCharacters(value: string): boolean {\n  for (const character of value) {\n    const code = character.charCodeAt(0);\n    if (code <= 31 || code === 127) return true;\n  }\n  return false;\n}\n","import { asObject, optionalTimestamp, requiredString } from './model-parsing.js';\nimport { inspect } from 'node:util';\n\nconst moneyBrand = Symbol.for('@anis-ly/partners.Money');\n\n/**\n * An exact currency amount stored as thousandths instead of floating-point units.\n *\n * @remarks The contract sends amounts as decimal strings because a floating-point round trip can change the total\n * checked against unit price multiplied by quantity. Integer thousandths keep that comparison exact.\n */\nexport class Money {\n  readonly #thousandths: bigint;\n\n  private constructor(\n    thousandths: bigint,\n    /** ISO currency code associated with this amount. */\n    readonly currency: string,\n    /** Instant at which the amount was computed, when the wire provides one. */\n    readonly asOf?: Date,\n  ) {\n    this.#thousandths = thousandths;\n    Object.defineProperty(this, moneyBrand, { value: true });\n  }\n\n  static [Symbol.hasInstance](value: unknown): boolean {\n    return typeof value === 'object' && value !== null && (value as Record<symbol, unknown>)[moneyBrand] === true;\n  }\n\n  /**\n   * Builds an amount from its decimal wire spelling.\n   *\n   * @remarks A number has already passed through floating-point arithmetic, so accepting one could make an order\n   * total differ from the exact unit price the API checks.\n   */\n  static of(amount: string, currency: string, asOf?: Date): Money {\n    if (typeof amount !== 'string') {\n      throw new TypeError('Money amounts must be decimal strings.');\n    }\n    if (typeof currency !== 'string' || currency.length === 0) {\n      throw new TypeError('A currency code is required.');\n    }\n    const match = /^(-?)(0|[1-9]\\d*)(?:\\.(\\d+))?$/.exec(amount);\n    if (match === null) {\n      throw new TypeError('A money amount must be a decimal string.');\n    }\n    const sign = match[1] === '-' ? -1n : 1n;\n    const whole = BigInt(match[2] ?? '0');\n    const fraction = match[3] ?? '';\n    if (fraction.length > 3) {\n      throw new TypeError('Anis amounts have at most three decimal places');\n    }\n    const thousandths = whole * 1000n + BigInt((fraction + '000').slice(0, 3));\n    return new Money(sign * thousandths, currency, asOf);\n  }\n\n  /** The amount rendered with exactly three decimal places so Anis receives the contract's decimal-string form. */\n  get amount(): string {\n    const negative = this.#thousandths < 0n;\n    const absolute = negative ? -this.#thousandths : this.#thousandths;\n    const whole = absolute / 1000n;\n    const fraction = String(absolute % 1000n).padStart(3, '0');\n    return `${negative ? '-' : ''}${String(whole)}.${fraction}`;\n  }\n\n  /**\n   * Multiplies by a whole quantity without losing fractional currency units.\n   *\n   * @remarks The source instant describes the unit quote, not the computed order total, so it is cleared on the result.\n   */\n  multiply(quantity: number): Money {\n    if (!Number.isSafeInteger(quantity)) {\n      throw new TypeError('Money can only be multiplied by a safe whole number.');\n    }\n    return new Money(this.#thousandths * BigInt(quantity), this.currency);\n  }\n\n  /** Uses the familiar decimal and currency spelling when a balance is interpolated into application text. */\n  toString(): string {\n    return `${this.amount} ${this.currency}`;\n  }\n\n  [inspect.custom](): string {\n    return this.toString();\n  }\n\n  /** Converts to the contract object while retaining its decimal-string amount. */\n  toJSON(): { amount: string; currency: string; asOf?: string } {\n    return {\n      amount: this.amount,\n      currency: this.currency,\n      ...(this.asOf === undefined ? {} : { asOf: timestampToWire(this.asOf) }),\n    };\n  }\n}\n\n/** Parses the contract object and refuses JSON numbers for amounts. */\nexport function parseMoney(json: unknown): Money {\n  const object = asObject(json, 'Money');\n  const amount = requiredString(object, 'amount', 'Money');\n  const currency = requiredString(object, 'currency', 'Money');\n  const asOf = optionalTimestamp(object, 'asOf', 'Money');\n  return Money.of(amount, currency, asOf);\n}\n\nfunction timestampToWire(value: Date): string {\n  if (Number.isNaN(value.getTime())) {\n    throw new TypeError('Money.asOf must be a valid date.');\n  }\n  return value.toISOString().replace(/\\.\\d{3}Z$/, 'Z');\n}\n","import {\n  asObject,\n  optionalBoolean,\n  optionalInteger,\n  optionalString,\n  optionalUuid,\n  requiredUuid,\n} from './model-parsing.js';\nimport { parseMoney, type Money } from './money.js';\n\n/** Owner-supplied Arabic and English text; either translation can be absent. */\nexport interface LocalizedText {\n  /** Arabic text when supplied. */\n  ar?: string;\n  /** English text when supplied. */\n  en?: string;\n}\n\n/** Category source. Unknown wire values remain readable if Anis adds a category kind. */\nexport type CatalogueCategoryType = 'unknown' | 'local' | 'international';\n\n/** A published catalogue category. */\nexport interface CatalogueCategory {\n  /** Category UUID in canonical lower-case form. */\n  id: string;\n  /** Display name, which the owner may provide in either language. */\n  name?: LocalizedText;\n  /** Description, which the owner may provide in either language. */\n  description?: LocalizedText;\n  /** Logo URL when present. */\n  logo?: string;\n  /** Local, international, or unknown when the SDK has not seen a new value. */\n  type: CatalogueCategoryType;\n  /** Whether stock is live under the current owner rules. */\n  inStock: boolean;\n  /** Position chosen by the owner. */\n  displayOrder: number;\n}\n\n/** A published catalogue subcategory, including buyer-facing terms where present. */\nexport interface CatalogueSubcategory {\n  /** Subcategory UUID. */\n  id: string;\n  /** Parent category UUID. */\n  categoryId: string;\n  /** Display name, if supplied. */\n  name?: LocalizedText;\n  /** Description, if supplied. */\n  description?: LocalizedText;\n  /** Logo URL when present. */\n  logo?: string;\n  /** Whether the owner marked this subcategory as a best seller. */\n  isBestSelling: boolean;\n  /** Position chosen by the owner. */\n  displayOrder: number;\n  /** Whether it is currently available. */\n  available: boolean;\n  /** Buyer-facing terms to show before purchase; absent when the owner supplied none. */\n  disclaimer?: LocalizedText;\n}\n\n/** A purchasable card and the price this wallet pays for it. */\nexport interface CatalogueCard {\n  /** Card UUID used in an order. */\n  id: string;\n  /** Parent subcategory UUID. */\n  subcategoryId: string;\n  /** Display name, if supplied. */\n  name?: LocalizedText;\n  /** Printed face value, when the card has one. */\n  faceValue?: string;\n  /** The current unit price to return as expectedUnitPrice; absent when this wallet cannot buy it. */\n  unitPrice?: Money;\n  /** Business price for comparison and display; an order at a different value may be refused. */\n  businessPrice?: Money;\n  /** Retail price for display, present only above business price. */\n  personalPrice?: Money;\n  /** Whether a special offer applies. */\n  hasSpecialOffer: boolean;\n  /** Display-only offer price when a special offer applies. */\n  specialOfferPrice?: Money;\n  /** Whether the card is live under current owner rules. */\n  available: boolean;\n  /** Lowest quantity accepted in one order, when constrained. */\n  minimumQuantity?: number;\n  /** Highest quantity accepted in one order, when constrained. */\n  maximumQuantity?: number;\n}\n\n/** One cursor-paged result. Pass nextCursor to continue until it is absent. */\nexport interface Page<T> {\n  /** Values on this page. */\n  items: readonly T[];\n  /** Cursor for the next page, absent when the list is exhausted. */\n  nextCursor?: string;\n}\n\n/** Parses owner-supplied localized text without inventing a fallback. */\nexport function parseLocalizedText(json: unknown): LocalizedText {\n  const object = asObject(json, 'LocalizedText');\n  const ar = optionalString(object, 'ar', 'LocalizedText');\n  const en = optionalString(object, 'en', 'LocalizedText');\n  return { ...(ar === undefined ? {} : { ar }), ...(en === undefined ? {} : { en }) };\n}\n\n/** Parses category type leniently so a newly published value does not break the whole response. */\nexport function parseCatalogueCategoryType(value: unknown): CatalogueCategoryType {\n  if (typeof value !== 'string') {\n    return 'unknown';\n  }\n  switch (value.toLowerCase()) {\n    case 'local':\n      return 'local';\n    case 'international':\n      return 'international';\n    default:\n      return 'unknown';\n  }\n}\n\n/** Parses a catalogue category, retaining unknown category kinds as unknown. */\nexport function parseCatalogueCategory(json: unknown): CatalogueCategory {\n  const object = asObject(json, 'CatalogueCategory');\n  const name = parseOptionalLocalized(object, 'name', 'CatalogueCategory');\n  const description = parseOptionalLocalized(object, 'description', 'CatalogueCategory');\n  const logo = optionalString(object, 'logo', 'CatalogueCategory');\n  return {\n    id: requiredUuid(object, 'id', 'CatalogueCategory'),\n    type: parseCatalogueCategoryType(object.type),\n    inStock: optionalBoolean(object, 'inStock', 'CatalogueCategory') ?? false,\n    displayOrder: optionalInteger(object, 'displayOrder', 'CatalogueCategory') ?? 0,\n    ...(name === undefined ? {} : { name }),\n    ...(description === undefined ? {} : { description }),\n    ...(logo === undefined ? {} : { logo }),\n  };\n}\n\n/** Parses a catalogue subcategory and preserves its optional disclaimer. */\nexport function parseCatalogueSubcategory(json: unknown): CatalogueSubcategory {\n  const object = asObject(json, 'CatalogueSubcategory');\n  const name = parseOptionalLocalized(object, 'name', 'CatalogueSubcategory');\n  const description = parseOptionalLocalized(object, 'description', 'CatalogueSubcategory');\n  const logo = optionalString(object, 'logo', 'CatalogueSubcategory');\n  const disclaimer = parseOptionalLocalized(object, 'disclaimer', 'CatalogueSubcategory');\n  return {\n    id: requiredUuid(object, 'id', 'CatalogueSubcategory'),\n    categoryId: optionalUuid(object, 'categoryId', 'CatalogueSubcategory') ?? '00000000-0000-0000-0000-000000000000',\n    isBestSelling: optionalBoolean(object, 'isBestSelling', 'CatalogueSubcategory') ?? false,\n    displayOrder: optionalInteger(object, 'displayOrder', 'CatalogueSubcategory') ?? 0,\n    available: optionalBoolean(object, 'available', 'CatalogueSubcategory') ?? false,\n    ...(name === undefined ? {} : { name }),\n    ...(description === undefined ? {} : { description }),\n    ...(logo === undefined ? {} : { logo }),\n    ...(disclaimer === undefined ? {} : { disclaimer }),\n  };\n}\n\n/** Parses a catalogue card without recalculating any owner-provided price. */\nexport function parseCatalogueCard(json: unknown): CatalogueCard {\n  const object = asObject(json, 'CatalogueCard');\n  const name = parseOptionalLocalized(object, 'name', 'CatalogueCard');\n  const faceValue = optionalString(object, 'faceValue', 'CatalogueCard');\n  const unitPrice = parseOptionalMoney(object, 'unitPrice');\n  const businessPrice = parseOptionalMoney(object, 'businessPrice');\n  const personalPrice = parseOptionalMoney(object, 'personalPrice');\n  const specialOfferPrice = parseOptionalMoney(object, 'specialOfferPrice');\n  const minimumQuantity = optionalInteger(object, 'minimumQuantity', 'CatalogueCard');\n  const maximumQuantity = optionalInteger(object, 'maximumQuantity', 'CatalogueCard');\n  return {\n    id: requiredUuid(object, 'id', 'CatalogueCard'),\n    subcategoryId: optionalUuid(object, 'subcategoryId', 'CatalogueCard') ?? '00000000-0000-0000-0000-000000000000',\n    hasSpecialOffer: optionalBoolean(object, 'hasSpecialOffer', 'CatalogueCard') ?? false,\n    available: optionalBoolean(object, 'available', 'CatalogueCard') ?? false,\n    ...(name === undefined ? {} : { name }),\n    ...(faceValue === undefined ? {} : { faceValue }),\n    ...(unitPrice === undefined ? {} : { unitPrice }),\n    ...(businessPrice === undefined ? {} : { businessPrice }),\n    ...(personalPrice === undefined ? {} : { personalPrice }),\n    ...(specialOfferPrice === undefined ? {} : { specialOfferPrice }),\n    ...(minimumQuantity === undefined ? {} : { minimumQuantity }),\n    ...(maximumQuantity === undefined ? {} : { maximumQuantity }),\n  };\n}\n\n/** Parses a page and delegates each item to the route's model parser. */\nexport function parsePage<T>(json: unknown, parseItem: (item: unknown) => T): Page<T> {\n  const object = asObject(json, 'Page');\n  const items = object.items ?? [];\n  if (!Array.isArray(items)) {\n    throw new TypeError('Page.items must be an array.');\n  }\n  const nextCursor = optionalString(object, 'nextCursor', 'Page');\n  return {\n    items: items.map(parseItem),\n    ...(nextCursor === undefined ? {} : { nextCursor }),\n  };\n}\n\nfunction parseOptionalLocalized(\n  object: Record<string, unknown>,\n  field: string,\n  label: string,\n): LocalizedText | undefined {\n  const value = object[field];\n  if (value === undefined || value === null) {\n    return undefined;\n  }\n  try {\n    return parseLocalizedText(value);\n  } catch (cause) {\n    throw new TypeError(`${label}.${field} must contain Arabic or English text.`, { cause });\n  }\n}\n\nfunction parseOptionalMoney(object: Record<string, unknown>, field: string): Money | undefined {\n  const value = object[field];\n  return value === undefined || value === null ? undefined : parseMoney(value);\n}\n","import { inspect } from 'node:util';\nimport {\n  asObject,\n  optionalBoolean,\n  optionalInteger,\n  optionalString,\n  optionalTimestamp,\n  optionalUuid,\n  requiredUuid,\n} from './model-parsing.js';\nimport { parseMoney, type Money } from './money.js';\nimport { parseLocalizedText, type LocalizedText } from './catalogue.js';\n\n/** A sold card as a masked projection; plaintext is never present here. */\nexport interface MaskedCard {\n  /** Sold-card UUID used by a single-card reveal. */\n  id: string;\n  /** Order that produced this card, when the API exposes it. */\n  orderOperationId?: string;\n  /** Owner invoice needed for invoice-level reveal. */\n  invoiceId?: string;\n  /** Catalogue card summary. */\n  card?: MaskedCardProduct;\n  /** Masked serial for identification without disclosing the credential. */\n  serialNumberMasked?: string;\n  /** Whether Anis currently permits the credential to be revealed. */\n  credentialAvailable: boolean;\n  /** Purchase instant, when supplied. */\n  purchasedAt?: Date;\n  /** Amount originally charged per card, including after a refund. */\n  unitPrice?: Money;\n  /** Last calendar day the card can be used. */\n  expiryDate?: string;\n  /** Number printed on the owner invoice. */\n  invoiceNumber?: number;\n  /** Printed face value when supplied. */\n  faceValue?: string;\n  /** Catalogue subcategory summary. */\n  subcategory?: MaskedCardSubcategory;\n}\n\n/** A catalogue subcategory summary attached to a sold card. */\nexport interface MaskedCardSubcategory {\n  /** Subcategory UUID. */\n  id: string;\n  /** Localized name when supplied. */\n  name?: LocalizedText;\n}\n\n/** A catalogue product summary attached to a sold card or revealed credential. */\nexport interface MaskedCardProduct {\n  /** Card UUID. */\n  id: string;\n  /** Localized name when supplied. */\n  name?: LocalizedText;\n}\n\n/**\n * Credential plaintext returned only by a protected reveal or first order completion.\n *\n * @remarks This is the only public model that carries a voucher or serial. Redacting its string form prevents a\n * careless log interpolation from disclosing credentials.\n */\nexport interface RevealedCredential {\n  /** Sold-card UUID this credential belongs to. */\n  soldCardId: string;\n  /** Serial number; keep it out of logs and telemetry. */\n  serialNumber?: string;\n  /** Voucher code; keep it out of logs and telemetry. */\n  voucher?: string;\n  /** Reveal instant when supplied. */\n  revealedAt?: Date;\n  /** Last calendar day the card can be used. */\n  expiryDate?: string;\n  /** Invoice UUID, present on reveal routes. */\n  invoiceId?: string;\n  /** Product summary, present on reveal routes. */\n  card?: MaskedCardProduct;\n  /** Purchase instant, present on reveal routes. */\n  purchasedAt?: Date;\n  /** Redacted representation for accidental string interpolation. */\n  toString(): string;\n  /** Redacted representation for Node's recursive native inspection. */\n  [inspect.custom](): string;\n}\n\n/** All credentials released for one invoice, or none when the invoice cannot be revealed. */\nexport interface RevealedCredentialCollection {\n  /** Credentials on this invoice, capped by the public contract. */\n  items: readonly RevealedCredential[];\n}\n\n/** Parses a masked sold-card projection. */\nexport function parseMaskedCard(json: unknown): MaskedCard {\n  const object = asObject(json, 'MaskedCard');\n  const orderOperationId = optionalUuid(object, 'orderOperationId', 'MaskedCard');\n  const invoiceId = optionalUuid(object, 'invoiceId', 'MaskedCard');\n  const card = parseOptionalProduct(object, 'card');\n  const serialNumberMasked = optionalString(object, 'serialNumberMasked', 'MaskedCard');\n  const purchasedAt = optionalTimestamp(object, 'purchasedAt', 'MaskedCard');\n  const unitPrice =\n    object.unitPrice === undefined || object.unitPrice === null ? undefined : parseMoney(object.unitPrice);\n  const expiryDate = optionalDateOnly(object, 'expiryDate', 'MaskedCard');\n  const invoiceNumber = optionalInteger(object, 'invoiceNumber', 'MaskedCard');\n  const faceValue = optionalString(object, 'faceValue', 'MaskedCard');\n  const subcategory = parseOptionalSubcategory(object);\n  return {\n    id: requiredUuid(object, 'id', 'MaskedCard'),\n    credentialAvailable: optionalBoolean(object, 'credentialAvailable', 'MaskedCard') ?? false,\n    ...(orderOperationId === undefined ? {} : { orderOperationId }),\n    ...(invoiceId === undefined ? {} : { invoiceId }),\n    ...(card === undefined ? {} : { card }),\n    ...(serialNumberMasked === undefined ? {} : { serialNumberMasked }),\n    ...(purchasedAt === undefined ? {} : { purchasedAt }),\n    ...(unitPrice === undefined ? {} : { unitPrice }),\n    ...(expiryDate === undefined ? {} : { expiryDate }),\n    ...(invoiceNumber === undefined ? {} : { invoiceNumber }),\n    ...(faceValue === undefined ? {} : { faceValue }),\n    ...(subcategory === undefined ? {} : { subcategory }),\n  };\n}\n\n/** Parses a revealed credential and keeps its string representation redacted. */\nexport function parseRevealedCredential(json: unknown): RevealedCredential {\n  const object = asObject(json, 'RevealedCredential');\n  const serialNumber = optionalString(object, 'serialNumber', 'RevealedCredential');\n  const voucher = optionalString(object, 'voucher', 'RevealedCredential');\n  const revealedAt = optionalTimestamp(object, 'revealedAt', 'RevealedCredential');\n  const expiryDate = optionalDateOnly(object, 'expiryDate', 'RevealedCredential');\n  const invoiceId = optionalUuid(object, 'invoiceId', 'RevealedCredential');\n  const card = parseOptionalProduct(object, 'card');\n  const purchasedAt = optionalTimestamp(object, 'purchasedAt', 'RevealedCredential');\n  const credential: RevealedCredential = {\n    soldCardId: optionalUuid(object, 'soldCardId', 'RevealedCredential') ?? '00000000-0000-0000-0000-000000000000',\n    ...(serialNumber === undefined ? {} : { serialNumber }),\n    ...(voucher === undefined ? {} : { voucher }),\n    ...(revealedAt === undefined ? {} : { revealedAt }),\n    ...(expiryDate === undefined ? {} : { expiryDate }),\n    ...(invoiceId === undefined ? {} : { invoiceId }),\n    ...(card === undefined ? {} : { card }),\n    ...(purchasedAt === undefined ? {} : { purchasedAt }),\n    toString() {\n      return `RevealedCredential { SoldCardId = ${this.soldCardId}, Secret = <redacted> }`;\n    },\n    [inspect.custom]() {\n      return `RevealedCredential { SoldCardId = ${this.soldCardId}, Secret = <redacted> }`;\n    },\n  };\n  Object.defineProperty(credential, 'toString', { enumerable: false });\n  Object.defineProperty(credential, inspect.custom, { enumerable: false });\n  return credential;\n}\n\n/** Parses an invoice reveal collection. */\nexport function parseRevealedCredentialCollection(json: unknown): RevealedCredentialCollection {\n  const object = asObject(json, 'RevealedCredentialCollection');\n  const items = object.items ?? [];\n  if (!Array.isArray(items)) {\n    throw new TypeError('RevealedCredentialCollection.items must be an array.');\n  }\n  return { items: items.map(parseRevealedCredential) };\n}\n\nfunction parseOptionalProduct(object: Record<string, unknown>, field: string): MaskedCardProduct | undefined {\n  const value = object[field];\n  if (value === undefined || value === null) {\n    return undefined;\n  }\n  const nested = asObject(value, `MaskedCard.${field}`);\n  const name = nested.name === undefined || nested.name === null ? undefined : parseLocalizedText(nested.name);\n  return {\n    id: requiredUuid(nested, 'id', `MaskedCard.${field}`),\n    ...(name === undefined ? {} : { name }),\n  };\n}\n\nfunction parseOptionalSubcategory(object: Record<string, unknown>): MaskedCardSubcategory | undefined {\n  const value = object.subcategory;\n  if (value === undefined || value === null) {\n    return undefined;\n  }\n  const nested = asObject(value, 'MaskedCard.subcategory');\n  const name = nested.name === undefined || nested.name === null ? undefined : parseLocalizedText(nested.name);\n  return {\n    id: requiredUuid(nested, 'id', 'MaskedCard.subcategory'),\n    ...(name === undefined ? {} : { name }),\n  };\n}\n\nfunction optionalDateOnly(object: Record<string, unknown>, field: string, label: string): string | undefined {\n  const value = optionalString(object, field, label);\n  if (value === undefined) {\n    return undefined;\n  }\n  const parsed = new Date(`${value}T00:00:00Z`);\n  if (\n    !/^\\d{4}-\\d{2}-\\d{2}$/.test(value) ||\n    Number.isNaN(parsed.getTime()) ||\n    parsed.toISOString().slice(0, 10) !== value\n  ) {\n    throw new TypeError(`${label}.${field} must be a calendar date.`);\n  }\n  return value;\n}\n","import {\n  asObject,\n  optionalBoolean,\n  optionalInteger,\n  optionalString,\n  optionalTimestamp,\n  optionalUuid,\n  requiredUuid,\n} from './model-parsing.js';\nimport { parseMoney, type Money } from './money.js';\nimport { parseRevealedCredential, type RevealedCredential } from './cards.js';\n\n/**\n * Order lifecycle state. Unknown future values stay readable as unknown.\n *\n * @remarks The parser maps this wire enum explicitly because serializer defaults differ between runtimes. Order\n * outcomes still depend on the response and replay marker, never on a future status string alone.\n */\nexport type OrderStatus = 'unknown' | 'processing' | 'recoveryExhausted' | 'completed' | 'failed';\n\n/**\n * What a partner wants to buy. Prices remain exact decimal strings through Money serialization.\n *\n * @remarks The gateway rejects unknown request members and compares the total to exact unit-price multiplication;\n * floating-point arithmetic can therefore turn an apparently valid order into a refusal.\n */\nexport interface CreateOrderRequest {\n  /** Catalogue card being purchased. */\n  cardId: string;\n  /** Number of cards, within the live catalogue limits. */\n  quantity: number;\n  /** Price read from the catalogue, echoed to detect price changes. */\n  expectedUnitPrice: Money;\n  /** Exact expected unit price multiplied by quantity. */\n  expectedTotal: Money;\n  /** Partner's own reference, when useful for reconciliation. */\n  externalReference?: string | undefined;\n  /** Explicit consent to use an allowed owner debt balance. */\n  useAllowedDebt?: boolean | undefined;\n}\n\n/**\n * An order projection returned by create, resume, or lookup.\n *\n * @remarks Credentials appear only on the first completion answer. A replay or lookup is state-only, so use the typed\n * order result for a compile-time distinction before handling credentials.\n */\nexport interface Order {\n  /** Same UUID the caller sent as Idempotency-Key. */\n  operationId: string;\n  /** Current owner-reported order state. */\n  status: OrderStatus;\n  /** Owner invoice UUID once one exists. */\n  invoiceId?: string;\n  /** Wallet UUID the order used. */\n  walletId?: string;\n  /** Catalogue card UUID. */\n  cardId?: string;\n  /** Number of cards. */\n  quantity?: number;\n  /** Total amount charged. */\n  total?: Money;\n  /** Credentials, only on the first response that reports completion. */\n  soldCards?: readonly RevealedCredential[];\n  /** Completion instant. */\n  completedAt?: Date;\n  /** Partner's reference from the create request. */\n  externalReference?: string;\n  /** Recorded refusal code when a lookup reports a failed order. */\n  failureCode?: string;\n  /** Whether the completed order's credentials were withheld; absent means the API did not state it. */\n  codesWithheld?: boolean;\n}\n\n/** Parses a wire order and maps its lifecycle enum explicitly to avoid serializer-default drift. */\nexport function parseOrder(json: unknown): Order {\n  const object = asObject(json, 'Order');\n  const invoiceId = optionalUuid(object, 'invoiceId', 'Order');\n  const walletId = optionalUuid(object, 'walletId', 'Order');\n  const cardId = optionalUuid(object, 'cardId', 'Order');\n  const quantity = optionalInteger(object, 'quantity', 'Order');\n  const total = object.total === undefined || object.total === null ? undefined : parseMoney(object.total);\n  const soldCards = parseOptionalCredentials(object.soldCards);\n  const completedAt = optionalTimestamp(object, 'completedAt', 'Order');\n  const externalReference = optionalString(object, 'externalReference', 'Order');\n  const failureCode = optionalString(object, 'failureCode', 'Order');\n  const codesWithheld = optionalBoolean(object, 'codesWithheld', 'Order');\n  return {\n    operationId: requiredUuid(object, 'operationId', 'Order'),\n    status: parseOrderStatus(object.status),\n    ...(invoiceId === undefined ? {} : { invoiceId }),\n    ...(walletId === undefined ? {} : { walletId }),\n    ...(cardId === undefined ? {} : { cardId }),\n    ...(quantity === undefined ? {} : { quantity }),\n    ...(total === undefined ? {} : { total }),\n    ...(soldCards === undefined ? {} : { soldCards }),\n    ...(completedAt === undefined ? {} : { completedAt }),\n    ...(externalReference === undefined ? {} : { externalReference }),\n    ...(failureCode === undefined ? {} : { failureCode }),\n    ...(codesWithheld === undefined ? {} : { codesWithheld }),\n  };\n}\n\n/** Parses known order-state spellings and treats every new or missing value as unknown. */\nexport function parseOrderStatus(value: unknown): OrderStatus {\n  if (typeof value !== 'string') {\n    return 'unknown';\n  }\n  switch (value.toLowerCase()) {\n    case 'processing':\n      return 'processing';\n    case 'recoveryexhausted':\n      return 'recoveryExhausted';\n    case 'completed':\n      return 'completed';\n    case 'failed':\n      return 'failed';\n    default:\n      return 'unknown';\n  }\n}\n\nfunction parseOptionalCredentials(value: unknown): readonly RevealedCredential[] | undefined {\n  if (value === undefined || value === null) {\n    return undefined;\n  }\n  if (!Array.isArray(value)) {\n    throw new TypeError('Order.soldCards must be an array when present.');\n  }\n  return value.map(parseRevealedCredential);\n}\n","import { asObject, optionalString, requiredUuid } from './model-parsing.js';\nimport { parseMoney, type Money } from './money.js';\n\n/**\n * A wallet this application may act on after current access and owner rules are applied.\n *\n * @remarks The API has already intersected the application's grants with live owner and subscription eligibility;\n * absent subscription and capability fields are not independent permissions for partners to infer.\n */\nexport interface Wallet {\n  /** Wallet identity used by calls on this wallet. */\n  id: string;\n  /** Display name when the owner supplied one. */\n  name?: string;\n  /** Currency code used by its balances and orders. */\n  currency?: string;\n  /** Reserved-adjusted balance and the instant at which it was computed. */\n  balance: Money;\n}\n\n/**\n * The application's identity and the scopes its current policy grants.\n *\n * @remarks Names and environment are omitted because deployments are isolated copies; exposing a single-valued\n * environment would invite branching that cannot change the API surface.\n */\nexport interface PartnerProfile {\n  /** The Partner identity; names are intentionally not part of this surface. */\n  partner?: PartnerIdentity;\n  /** This application and its effective permissions. */\n  application?: ApplicationIdentity;\n  /** The owner account behind the wallets, when exposed by the surface. */\n  ownerAccount?: OwnerAccount;\n  /** Documentation version this deployment is aligned with. */\n  documentationVersion?: string;\n}\n\n/** Partner identity, by canonical UUID. */\nexport interface PartnerIdentity {\n  /** Partner UUID in lower-case hyphenated form. */\n  id: string;\n}\n\n/**\n * Application identity and its effective scopes.\n *\n * @remarks The application id remains stable while signing keys rotate, and scopes should be read from each response\n * because policy can change between calls.\n */\nexport interface ApplicationIdentity {\n  /** Stable application identity; keys can rotate beneath it. */\n  id: string;\n  /** Scopes in force for calls made now; policy can change between calls. */\n  scopes: readonly string[];\n}\n\n/** Owner account identity behind the wallets. */\nexport interface OwnerAccount {\n  /** Owner account UUID in lower-case hyphenated form. */\n  id: string;\n  /** Display name when the owner supplied one. */\n  displayName?: string;\n}\n\n/** Parses a wallet while preserving optional members as optional. */\nexport function parseWallet(json: unknown): Wallet {\n  const object = asObject(json, 'Wallet');\n  const name = optionalString(object, 'name', 'Wallet');\n  const currency = optionalString(object, 'currency', 'Wallet');\n  return {\n    id: requiredUuid(object, 'id', 'Wallet'),\n    balance: parseMoney(object.balance),\n    ...(name === undefined ? {} : { name }),\n    ...(currency === undefined ? {} : { currency }),\n  };\n}\n\n/** Parses the application identity response. */\nexport function parsePartnerProfile(json: unknown): PartnerProfile {\n  const object = asObject(json, 'PartnerProfile');\n  const partner =\n    object.partner === undefined || object.partner === null ? undefined : parsePartnerIdentity(object.partner);\n  const application =\n    object.application === undefined || object.application === null\n      ? undefined\n      : parseApplicationIdentity(object.application);\n  const ownerAccount =\n    object.ownerAccount === undefined || object.ownerAccount === null\n      ? undefined\n      : parseOwnerAccount(object.ownerAccount);\n  const documentationVersion = optionalString(object, 'documentationVersion', 'PartnerProfile');\n  return {\n    ...(partner === undefined ? {} : { partner }),\n    ...(application === undefined ? {} : { application }),\n    ...(ownerAccount === undefined ? {} : { ownerAccount }),\n    ...(documentationVersion === undefined ? {} : { documentationVersion }),\n  };\n}\n\n/** Parses a partner identity. */\nexport function parsePartnerIdentity(json: unknown): PartnerIdentity {\n  const object = asObject(json, 'PartnerIdentity');\n  return { id: requiredUuid(object, 'id', 'PartnerIdentity') };\n}\n\n/** Parses an application identity and validates all supplied scopes. */\nexport function parseApplicationIdentity(json: unknown): ApplicationIdentity {\n  const object = asObject(json, 'ApplicationIdentity');\n  const scopes = object.scopes ?? [];\n  if (!Array.isArray(scopes) || !scopes.every((scope): scope is string => typeof scope === 'string')) {\n    throw new TypeError('ApplicationIdentity.scopes must be an array of strings.');\n  }\n  return { id: requiredUuid(object, 'id', 'ApplicationIdentity'), scopes };\n}\n\n/** Parses an owner account identity. */\nexport function parseOwnerAccount(json: unknown): OwnerAccount {\n  const object = asObject(json, 'OwnerAccount');\n  const displayName = optionalString(object, 'displayName', 'OwnerAccount');\n  return {\n    id: requiredUuid(object, 'id', 'OwnerAccount'),\n    ...(displayName === undefined ? {} : { displayName }),\n  };\n}\n","import type { CatalogueCard, CatalogueCategory, CatalogueSubcategory, Page } from '../models/catalogue.js';\nimport {\n  parseCatalogueCard,\n  parseCatalogueCategory,\n  parseCatalogueSubcategory,\n  parsePage,\n} from '../models/catalogue.js';\nimport type { MaskedCard, RevealedCredential, RevealedCredentialCollection } from '../models/cards.js';\nimport { parseMaskedCard, parseRevealedCredential, parseRevealedCredentialCollection } from '../models/cards.js';\nimport type { Order, CreateOrderRequest } from '../models/orders.js';\nimport { parseOrder } from '../models/orders.js';\nimport type { PartnerProfile, Wallet } from '../models/wallets.js';\nimport { parsePartnerProfile, parseWallet } from '../models/wallets.js';\nimport type { SignatureDiagnostic } from '../models/enrollment.js';\nimport { parseSignatureDiagnostic } from '../models/enrollment.js';\nimport { Money } from '../models/money.js';\nimport { EMPTY_OBJECT_BODY } from '../signing/content-digest.js';\nimport { canonicalUuid } from '../internal/uuid.js';\nimport type { PartnerTransport } from './partner-transport.js';\nimport type { OrderResult } from './order-result.js';\nimport { AnisApiError, refusedAtTheDoor } from '../errors/anis-api-error.js';\nimport { RequestSigningError } from '../signing/request-signing-error.js';\nimport { UnverifiableResponseError } from '../verification/unverifiable-response-error.js';\nimport { safeCounter } from '../internal/safe-telemetry.js';\nimport { MalformedResponseError } from '../errors/malformed-response-error.js';\nimport { SigningKeyDocumentUnavailableError } from '../errors/signing-key-document-unavailable-error.js';\nimport { retryAfterSeconds } from '../internal/retry-after.js';\n\n/** Optional caller cancellation applied to one API call. */\nexport interface CallOptions {\n  /** Stops waiting for this request; for orders, its outcome is still recorded as unknown. */\n  signal?: AbortSignal | undefined;\n}\n\n/** Optional continuation cursor and cancellation signal for a single page request. */\nexport interface PageOptions extends CallOptions {\n  /** Cursor returned by the preceding page; omit it to read the first page. */\n  cursor?: string | undefined;\n}\n\n/** Reads the current profile so callers see policy changes. */\nexport class ProfileOperations {\n  /** Shares the verified transport so profile reads follow the client's authority and signing policy. */\n  constructor(private readonly transport: PartnerTransport) {}\n  /** Reads identity and effective scopes from the live policy. */\n  async get(options?: CallOptions): Promise<PartnerProfile> {\n    return this.transport.json(\n      {\n        method: 'GET',\n        route: '/v1/profile',\n        path: '/v1/profile',\n        profile: 'SafeRead',\n        signal: options?.signal,\n      },\n      parsePartnerProfile,\n    );\n  }\n}\n\n/** Lists granted wallets and reads one wallet. */\nexport class WalletOperations {\n  /** Shares the verified transport so wallet reads follow the client's authority and signing policy. */\n  constructor(private readonly transport: PartnerTransport) {}\n  /** Walks wallet pages so callers need not manage continuation cursors. */\n  async *list(options?: CallOptions): AsyncIterable<Wallet> {\n    yield* pages((cursor) => this.listPage(pageOptions(cursor, options)));\n  }\n  /** Reads one page when the caller manages the cursor. */\n  async listPage(options?: PageOptions): Promise<Page<Wallet>> {\n    return this.transport.json(\n      {\n        method: 'GET',\n        route: '/v1/wallets',\n        path: pagePath('/v1/wallets', options?.cursor),\n        profile: 'SafeRead',\n        signal: options?.signal,\n      },\n      (json) => parsePage(json, parseWallet),\n    );\n  }\n  /** Reads one granted wallet by canonical UUID. */\n  async get(walletId: string, options?: CallOptions): Promise<Wallet> {\n    const id = canonicalUuid(walletId, 'walletId');\n    return this.transport.json(\n      {\n        method: 'GET',\n        route: '/v1/wallets/{walletId}',\n        path: `/v1/wallets/${id}`,\n        profile: 'SafeRead',\n        signal: options?.signal,\n      },\n      parseWallet,\n    );\n  }\n}\n\n/** Reads wallet-priced catalogue categories, subcategories, and cards. */\nexport class CatalogueOperations {\n  /** Shares the verified transport so catalogue reads use the client's price and signing policy. */\n  constructor(private readonly transport: PartnerTransport) {}\n  /** Walks category pages for a wallet. */\n  async *listCategories(walletId: string, options?: CallOptions): AsyncIterable<CatalogueCategory> {\n    yield* pages((cursor) => this.listCategoriesPage(walletId, pageOptions(cursor, options)));\n  }\n  /** Reads one category page. */\n  async listCategoriesPage(walletId: string, options?: PageOptions): Promise<Page<CatalogueCategory>> {\n    const id = canonicalUuid(walletId, 'walletId');\n    return this.transport.json(\n      {\n        method: 'GET',\n        route: '/v1/wallets/{walletId}/catalog/categories',\n        path: pagePath(`/v1/wallets/${id}/catalog/categories`, options?.cursor),\n        profile: 'SafeRead',\n        signal: options?.signal,\n      },\n      (json) => parsePage(json, parseCatalogueCategory),\n    );\n  }\n  /** Walks subcategory pages. */\n  async *listSubcategories(\n    walletId: string,\n    categoryId: string,\n    options?: CallOptions,\n  ): AsyncIterable<CatalogueSubcategory> {\n    yield* pages((cursor) => this.listSubcategoriesPage(walletId, categoryId, pageOptions(cursor, options)));\n  }\n  /** Reads one subcategory page. */\n  async listSubcategoriesPage(\n    walletId: string,\n    categoryId: string,\n    options?: PageOptions,\n  ): Promise<Page<CatalogueSubcategory>> {\n    const wallet = canonicalUuid(walletId, 'walletId');\n    const category = canonicalUuid(categoryId, 'categoryId');\n    const route = '/v1/wallets/{walletId}/catalog/categories/{categoryId}/subcategories';\n    return this.transport.json(\n      {\n        method: 'GET',\n        route,\n        path: pagePath(`/v1/wallets/${wallet}/catalog/categories/${category}/subcategories`, options?.cursor),\n        profile: 'SafeRead',\n        signal: options?.signal,\n      },\n      (json) => parsePage(json, parseCatalogueSubcategory),\n    );\n  }\n  /** Reads one subcategory. */\n  async getSubcategory(walletId: string, subcategoryId: string, options?: CallOptions): Promise<CatalogueSubcategory> {\n    const wallet = canonicalUuid(walletId, 'walletId');\n    const subcategory = canonicalUuid(subcategoryId, 'subcategoryId');\n    return this.transport.json(\n      {\n        method: 'GET',\n        route: '/v1/wallets/{walletId}/catalog/subcategories/{subcategoryId}',\n        path: `/v1/wallets/${wallet}/catalog/subcategories/${subcategory}`,\n        profile: 'SafeRead',\n        signal: options?.signal,\n      },\n      parseCatalogueSubcategory,\n    );\n  }\n  /** Walks card pages for the given wallet and subcategory. */\n  async *listCards(walletId: string, subcategoryId: string, options?: CallOptions): AsyncIterable<CatalogueCard> {\n    yield* pages((cursor) => this.listCardsPage(walletId, subcategoryId, pageOptions(cursor, options)));\n  }\n  /** Reads one catalogue card page. */\n  async listCardsPage(walletId: string, subcategoryId: string, options?: PageOptions): Promise<Page<CatalogueCard>> {\n    const wallet = canonicalUuid(walletId, 'walletId');\n    const subcategory = canonicalUuid(subcategoryId, 'subcategoryId');\n    const route = '/v1/wallets/{walletId}/catalog/subcategories/{subcategoryId}/cards';\n    return this.transport.json(\n      {\n        method: 'GET',\n        route,\n        path: pagePath(`/v1/wallets/${wallet}/catalog/subcategories/${subcategory}/cards`, options?.cursor),\n        profile: 'SafeRead',\n        signal: options?.signal,\n      },\n      (json) => parsePage(json, parseCatalogueCard),\n    );\n  }\n}\n\n/** Places, resumes, and reads orders under caller-owned operation ids. */\nexport class OrderOperations {\n  /** Shares the verified transport so order recovery uses the same signer and idempotency rules. */\n  constructor(private readonly transport: PartnerTransport) {}\n  /** Creates an order under an id the caller has persisted, preventing a dropped answer from causing duplicate purchases. */\n  create(\n    walletId: string,\n    operationId: string,\n    order: CreateOrderRequest,\n    options?: CallOptions,\n  ): Promise<OrderResult> {\n    return this.send(walletId, operationId, order, false, options);\n  }\n  /** Repeats the same request and operation id to recover an unknown result. */\n  resume(\n    walletId: string,\n    operationId: string,\n    order: CreateOrderRequest,\n    options?: CallOptions,\n  ): Promise<OrderResult> {\n    return this.send(walletId, operationId, order, true, options);\n  }\n  /** Reads order state without dispatching a new order or returning credentials. */\n  async get(operationId: string, options?: CallOptions): Promise<Order> {\n    const id = canonicalUuid(operationId, 'operationId');\n    return this.transport.json(\n      {\n        method: 'GET',\n        route: '/v1/orders/{operationId}',\n        path: `/v1/orders/${id}`,\n        profile: 'SafeRead',\n        signal: options?.signal,\n      },\n      parseOrder,\n    );\n  }\n  private async send(\n    walletId: string,\n    operationId: string,\n    order: CreateOrderRequest,\n    resuming: boolean,\n    options?: CallOptions,\n  ): Promise<OrderResult> {\n    guardOrder(order);\n    const wallet = canonicalUuid(walletId, 'walletId');\n    const operation = canonicalUuid(operationId, 'operationId');\n    const card = canonicalUuid(order.cardId, 'cardId');\n    let bytes: Uint8Array;\n    try {\n      bytes = new TextEncoder().encode(\n        JSON.stringify({\n          cardId: card,\n          quantity: order.quantity,\n          expectedUnitPrice: order.expectedUnitPrice.toJSON(),\n          expectedTotal: order.expectedTotal.toJSON(),\n          ...(order.externalReference === undefined ? {} : { externalReference: order.externalReference }),\n          useAllowedDebt: order.useAllowedDebt ?? false,\n        }),\n      );\n    } catch (cause) {\n      throw new RequestSigningError(cause);\n    }\n    let result: OrderResult;\n    let report = true;\n    let rethrow = false;\n    let cancellation: unknown;\n    let outcomeReason: string | undefined;\n    try {\n      const { response, body } = await this.transport.send({\n        method: 'POST',\n        route: '/v1/wallets/{walletId}/orders',\n        path: `/v1/wallets/${wallet}/orders`,\n        profile: 'OrderMutation',\n        operationId: operation,\n        body: bytes,\n        signal: options?.signal,\n      });\n      if (body.length === 0) {\n        outcomeReason = 'empty_body';\n        result = {\n          kind: 'unknown',\n          operationId: operation,\n          suggestedDelayMs: 5000,\n          cause: emptyBodyError(response.status),\n        };\n      } else {\n        let decoded: unknown;\n        try {\n          decoded = parseBody(body);\n        } catch {\n          throw new MalformedResponseError('order response');\n        }\n        if (decoded === null) {\n          outcomeReason = 'empty_body';\n          result = {\n            kind: 'unknown',\n            operationId: operation,\n            suggestedDelayMs: 5000,\n            cause: emptyBodyError(response.status),\n          };\n        } else if (response.status === 202) {\n          const orderValue = parseOrderSafely(decoded);\n          result = {\n            kind: 'processing',\n            operationId: operation,\n            order: orderValue,\n            suggestedDelayMs:\n              retryAfterSeconds(response.headers.get('retry-after')) === undefined\n                ? 5000\n                : (retryAfterSeconds(response.headers.get('retry-after')) ?? 0) * 1000,\n            ...(response.headers.get('location') === null ? {} : { location: response.headers.get('location') ?? '' }),\n          };\n        } else {\n          const orderValue = parseOrderSafely(decoded);\n          const credentials = orderValue.soldCards ?? [];\n          if (credentials.length > 0) {\n            result = {\n              kind: 'completed',\n              operationId: operation,\n              order: orderValue,\n              credentials,\n              codesWithheld: orderValue.codesWithheld === true || credentials.length === 0,\n            };\n          } else if (\n            headerValues(response.headers.get('idempotency-replayed')).some((value) => value.toLowerCase() === 'true')\n          ) {\n            result = { kind: 'replayed', operationId: operation, order: orderValue };\n          } else {\n            result = {\n              kind: 'completed',\n              operationId: operation,\n              order: orderValue,\n              credentials,\n              codesWithheld: orderValue.codesWithheld === true || credentials.length === 0,\n            };\n          }\n        }\n      }\n    } catch (error) {\n      if (error instanceof AnisApiError) {\n        if (error.orderOutcome === 'notPlaced' && (error.isReplayed || !resuming)) {\n          result = { kind: 'notPlaced', operationId: operation, refusal: error };\n          report = false;\n        } else {\n          outcomeReason = error.rawCode ?? 'refused';\n          const delay =\n            error.retryAfter === undefined ? (refusedAtTheDoor(error.code) ? 60_000 : 5000) : error.retryAfter * 1000;\n          result = { kind: 'unknown', operationId: operation, suggestedDelayMs: delay, cause: error };\n        }\n      } else if (error instanceof RequestSigningError) {\n        throw error;\n      } else {\n        outcomeReason = options?.signal?.aborted ? 'canceled' : errorType(error);\n        result = { kind: 'unknown', operationId: operation, suggestedDelayMs: 5000, cause: error };\n        rethrow = options?.signal?.aborted ?? false;\n        cancellation = error;\n      }\n    }\n    if (report) {\n      if (result.kind === 'unknown') {\n        result = reportUnknown(\n          this.transport,\n          operation,\n          outcomeReason ?? errorType(result.cause),\n          result.cause,\n          result.suggestedDelayMs,\n        );\n      } else {\n        result = reportOutcome(this.transport, operation, result);\n      }\n    }\n    if (rethrow) throw cancellation;\n    return result;\n  }\n}\n\n/** Lists owned cards and reveals credentials only on explicit protected calls. */\nexport class OwnedCardOperations {\n  /** Shares the verified transport so card reads and reveals keep the client's response checks. */\n  constructor(private readonly transport: PartnerTransport) {}\n  /** Walks owned-card pages. */\n  async *list(walletId: string, options?: CallOptions): AsyncIterable<MaskedCard> {\n    yield* pages((cursor) => this.listPage(walletId, pageOptions(cursor, options)));\n  }\n  /** Reads one owned-card page. */\n  async listPage(walletId: string, options?: PageOptions): Promise<Page<MaskedCard>> {\n    const wallet = canonicalUuid(walletId, 'walletId');\n    return this.transport.json(\n      {\n        method: 'GET',\n        route: '/v1/wallets/{walletId}/cards',\n        path: pagePath(`/v1/wallets/${wallet}/cards`, options?.cursor),\n        profile: 'SafeRead',\n        signal: options?.signal,\n      },\n      (json) => parsePage(json, parseMaskedCard),\n    );\n  }\n  /** Reads a masked owned card. */\n  async get(walletId: string, soldCardId: string, options?: CallOptions): Promise<MaskedCard> {\n    const wallet = canonicalUuid(walletId, 'walletId');\n    const card = canonicalUuid(soldCardId, 'soldCardId');\n    return this.transport.json(\n      {\n        method: 'GET',\n        route: '/v1/wallets/{walletId}/cards/{soldCardId}',\n        path: `/v1/wallets/${wallet}/cards/${card}`,\n        profile: 'SafeRead',\n        signal: options?.signal,\n      },\n      parseMaskedCard,\n    );\n  }\n  /** Reveals one credential using a signed mutation with no body bytes. */\n  async reveal(walletId: string, soldCardId: string, options?: CallOptions): Promise<RevealedCredential> {\n    const wallet = canonicalUuid(walletId, 'walletId');\n    const card = canonicalUuid(soldCardId, 'soldCardId');\n    return this.transport.json(\n      {\n        method: 'POST',\n        route: '/v1/wallets/{walletId}/cards/{soldCardId}/reveal',\n        path: `/v1/wallets/${wallet}/cards/${card}/reveal`,\n        profile: 'BodylessNonceMutation',\n        signal: options?.signal,\n      },\n      parseRevealedCredential,\n    );\n  }\n  /** Reveals every credential on an invoice atomically. */\n  async revealInvoice(\n    walletId: string,\n    invoiceId: string,\n    options?: CallOptions,\n  ): Promise<RevealedCredentialCollection> {\n    const wallet = canonicalUuid(walletId, 'walletId');\n    const invoice = canonicalUuid(invoiceId, 'invoiceId');\n    const route = '/v1/wallets/{walletId}/invoices/{invoiceId}/cards/reveal';\n    return this.transport.json(\n      {\n        method: 'POST',\n        route,\n        path: `/v1/wallets/${wallet}/invoices/${invoice}/cards/reveal`,\n        profile: 'BodylessNonceMutation',\n        signal: options?.signal,\n      },\n      parseRevealedCredentialCollection,\n    );\n  }\n}\n\n/** Runs the signed, side-effect-free signature admission diagnostic. */\nexport class DiagnosticsOperations {\n  /** Shares the verified transport so the self-check uses the same request as the partner API. */\n  constructor(private readonly transport: PartnerTransport) {}\n  /** Sends the exact empty JSON object expected by the self-check route. */\n  async checkSignature(options?: CallOptions): Promise<SignatureDiagnostic> {\n    return this.transport.json(\n      {\n        method: 'POST',\n        route: '/v1/diagnostics/signature',\n        path: '/v1/diagnostics/signature',\n        profile: 'BodylessNonceMutation',\n        body: EMPTY_OBJECT_BODY,\n        signal: options?.signal,\n      },\n      parseSignatureDiagnostic,\n    );\n  }\n}\n\nasync function* pages<T>(load: (cursor?: string) => Promise<Page<T>>): AsyncIterable<T> {\n  let cursor: string | undefined;\n  const seenCursors = new Set<string>();\n  do {\n    const page = await load(cursor);\n    for (const item of page.items) yield item;\n    cursor = page.nextCursor;\n    if (cursor !== undefined && cursor.length > 0) {\n      if (seenCursors.has(cursor)) throw new MalformedResponseError('page continuation cursor');\n      seenCursors.add(cursor);\n    }\n  } while (cursor !== undefined && cursor.length > 0);\n}\nfunction pagePath(path: string, cursor?: string): string {\n  return cursor === undefined || cursor.length === 0 ? path : `${path}?cursor=${encodeURIComponent(cursor)}`;\n}\nfunction pageOptions(cursor: string | undefined, options?: CallOptions): PageOptions {\n  return {\n    ...(cursor === undefined ? {} : { cursor }),\n    signal: options?.signal,\n  };\n}\nfunction parseBody(body: Uint8Array): unknown {\n  return JSON.parse(new TextDecoder().decode(body)) as unknown;\n}\nfunction parseOrderSafely(value: unknown): Order {\n  try {\n    return parseOrder(value);\n  } catch {\n    throw new MalformedResponseError('order response');\n  }\n}\nfunction headerValues(value: string | null): string[] {\n  return value === null ? [] : value.split(',').map((part) => part.trim());\n}\nfunction guardOrder(order: CreateOrderRequest): void {\n  if (!Number.isInteger(order.quantity) || order.quantity < 1)\n    throw new RangeError('An order must be for at least one card.');\n  canonicalUuid(order.cardId, 'cardId');\n  if (!(order.expectedUnitPrice instanceof Money) || !(order.expectedTotal instanceof Money))\n    throw new TypeError('Order prices must be Money values.');\n  if (BigInt(order.expectedUnitPrice.amount.replace('.', '')) <= 0n)\n    throw new RangeError('ExpectedUnitPrice must be greater than zero.');\n  if (order.expectedUnitPrice.multiply(order.quantity).amount !== order.expectedTotal.amount)\n    throw new TypeError('ExpectedTotal must equal unit price multiplied by quantity.');\n  if (order.expectedUnitPrice.currency !== order.expectedTotal.currency)\n    throw new TypeError('Order prices must use the same currency.');\n}\nfunction reportOutcome<T extends OrderResult>(transport: PartnerTransport, operationId: string, result: T): T {\n  safeCounter('anis.partners.order.outcomes', {\n    'anis.client': transport.clientName,\n    'anis.order.outcome': result.kind,\n  });\n  transport.reportOrderOutcome(operationId, result.kind);\n  return result;\n}\nfunction reportUnknown(\n  transport: PartnerTransport,\n  operationId: string,\n  reason: string,\n  cause: unknown,\n  suggestedDelayMs = 5000,\n): OrderResult {\n  safeCounter('anis.partners.order.outcomes', {\n    'anis.client': transport.clientName,\n    'anis.order.outcome': 'unknown',\n    'error.type': reason,\n  });\n  transport.reportOrderOutcome(operationId, 'unknown', reason);\n  return { kind: 'unknown', operationId, suggestedDelayMs, cause };\n}\n\nfunction errorType(error: unknown): string {\n  if (error instanceof MalformedResponseError) return 'other';\n  if (error instanceof SigningKeyDocumentUnavailableError) return 'connection';\n  if (error instanceof UnverifiableResponseError) return 'unverifiable';\n  if (error instanceof DOMException && error.name === 'TimeoutError') return 'timeout';\n  if (error instanceof TypeError) return 'connection';\n  if (error instanceof SyntaxError) return 'invalid_json';\n  return error instanceof Error ? error.name : 'other';\n}\n\nfunction emptyBodyError(status: number): AnisApiError {\n  return new AnisApiError({ status, code: 'internal_error', title: 'Empty body' }, status);\n}\n","import type { ClientOptions } from './client-options.js';\nimport { validateClientOptions } from './client-options.js';\nimport { canonicalUuid } from './internal/uuid.js';\nimport { safeLog } from './internal/safe-telemetry.js';\nimport type { RequestSigner } from './signing/p256-signer.js';\nimport type { KeyDocumentCache, SigningKeyLogger } from './verification/http-signing-key-source.js';\nimport { HttpSigningKeySource } from './verification/http-signing-key-source.js';\nimport type { PartnerLogger } from './observability/logger.js';\nimport { PartnerTransport } from './operations/partner-transport.js';\nimport {\n  CatalogueOperations,\n  DiagnosticsOperations,\n  OrderOperations,\n  OwnedCardOperations,\n  ProfileOperations,\n  WalletOperations,\n} from './operations/operations.js';\n\n/** Dependencies used to create a signed and verified client. */\nexport interface AnisPartnersClientCreateOptions {\n  /** Validated authority and request settings. */\n  options: ClientOptions;\n  /** Partner key custody; signatures must be 64-byte P-256 P1363. */\n  signer: RequestSigner;\n  /** Injectable fetch for proxies and in-memory API doubles. */\n  fetch?: typeof globalThis.fetch | undefined;\n  /** Shared key-document cache for short-lived/serverless hosts. */\n  keyCache?: KeyDocumentCache | undefined;\n  /** Optional structured partner log sink. */\n  logger?: Partial<PartnerLogger> | undefined;\n}\n\n/** Node client whose requests are signed and whose complete responses are verified before parsing. */\nexport class AnisPartnersClient {\n  /** Reads identity and live scopes. */\n  readonly profile: ProfileOperations;\n  /** Lists wallets available to this application. */\n  readonly wallets: WalletOperations;\n  /** Reads wallet-priced catalogue entries. */\n  readonly catalogue: CatalogueOperations;\n  /** Creates and resumes caller-keyed orders. */\n  readonly orders: OrderOperations;\n  /** Reads owned cards and reveals credentials. */\n  readonly ownedCards: OwnedCardOperations;\n  /** Runs the side-effect-free signature check. */\n  readonly diagnostics: DiagnosticsOperations;\n\n  private constructor(transport: PartnerTransport) {\n    this.profile = new ProfileOperations(transport);\n    this.wallets = new WalletOperations(transport);\n    this.catalogue = new CatalogueOperations(transport);\n    this.orders = new OrderOperations(transport);\n    this.ownedCards = new OwnedCardOperations(transport);\n    this.diagnostics = new DiagnosticsOperations(transport);\n  }\n\n  /** Builds the grouped API client and its unsigned public key-document source. */\n  static create(input: AnisPartnersClientCreateOptions): AnisPartnersClient {\n    const options = validateClientOptions(input.options);\n    const signer: unknown = (input as { signer?: unknown }).signer;\n    if (typeof signer !== 'object' || signer === null || !('sign' in signer) || typeof signer.sign !== 'function')\n      throw new TypeError('A request signer with a sign method is required.');\n    if (!('keyId' in signer) || typeof signer.keyId !== 'string')\n      throw new TypeError('The request signer needs a key id.');\n    canonicalUuid(signer.keyId, 'signer.keyId');\n    const fetcher = input.fetch ?? globalThis.fetch;\n    const logger = input.logger;\n    const keyLogger: SigningKeyLogger | undefined =\n      logger === undefined\n        ? undefined\n        : {\n            debug(message, fields) {\n              safeLog(logger, 'debug', message, fields);\n            },\n            info(message, fields) {\n              safeLog(logger, 'info', message, { ...fields, eventId: 1005 });\n            },\n            warn(message, fields) {\n              safeLog(logger, 'warn', message, fields);\n            },\n          };\n    const keySource = new HttpSigningKeySource({\n      authority: options.authority,\n      cacheSeconds: options.signingKeyCacheSeconds,\n      fetch: fetcher,\n      ...(input.keyCache === undefined ? {} : { documentCache: input.keyCache }),\n      ...(keyLogger === undefined ? {} : { logger: keyLogger }),\n    });\n    const transport = new PartnerTransport({\n      ...options,\n      signer: input.signer,\n      fetcher,\n      keySource,\n      ...(logger === undefined ? {} : { logger }),\n    });\n    return new AnisPartnersClient(transport);\n  }\n}\n"],"mappings":";;;;;;;AAAA;AAAA;AAAA;AAAA;AAMO,SAAS,cAAc,OAAe,eAAe,QAAgB;AAC1E,MAAI,CAAC,gFAAgF,KAAK,KAAK,GAAG;AAChG,UAAM,IAAI,UAAU,GAAG,YAAY,4BAA4B;AAAA,EACjE;AACA,SAAO,MAAM,YAAY;AAC3B;;;ACFO,IAAM,cAAN,MAA2C;AAAA;AAAA,EAKhD,YACmB,QACjB,OACA;AAFiB;AAGjB,SAAK,QAAQ,cAAc,OAAO,OAAO;AAAA,EAC3C;AAAA,EAJmB;AAAA;AAAA,EAJV;AAAA;AAAA,EAUT,KAAK,MAAuC;AAC1C,WAAO,KAAK,OAAO,KAAK,IAAI;AAAA,EAC9B;AACF;;;ACxBA,SAAS,gBAAgB;;;ACAzB,SAAS,uBAAuB;AAGzB,SAAS,eAAe,MAAkB,OAA4B;AAC3E,SAAO,KAAK,WAAW,MAAM,UAAU,gBAAgB,MAAM,KAAK;AACpE;AAGO,SAAS,cAAc,OAAgC;AAC5D,QAAM,OAAO,IAAI,WAAW,MAAM,UAAU;AAC5C,OAAK,IAAI,KAAK;AACd,SAAO,KAAK;AACd;;;ACcA,SAAS,eAAe;AA1BxB,IAAM,mBAAmB;AAGlB,IAAM,oBAAN,cAAgC,MAAM;AAAA,EAC3C,YAAY,SAAiB,SAAwB;AACnD,UAAM,SAAS,OAAO;AACtB,QAAI,YAAoB,WAAW;AACnC,WAAO,cAAc,MAAM,aAAa,cAAc,OAAO,WAAW;AACtE,YAAM,kBAAmB,UAAU,YAAkC,QAAQ;AAC7E,aAAO,eAAe,MAAM,uBAAO,IAAI,GAAG,gBAAgB,GAAG,eAAe,EAAE,GAAG,EAAE,OAAO,KAAK,CAAC;AAChG,YAAM,SAAS,OAAO,eAAe,SAAS;AAC9C,UAAI,WAAW,KAAM;AACrB,kBAAY;AAAA,IACd;AACA,SAAK,OAAO,WAAW;AAAA,EACzB;AAAA,EAEA,QAAiB,OAAO,WAAW,EAAE,OAAyB;AAC5D,QAAI,OAAO,UAAU,YAAY,UAAU,KAAM,QAAO;AACxD,WAAQ,MAAkC,uBAAO,IAAI,GAAG,gBAAgB,GAAG,KAAK,IAAI,EAAE,CAAC,MAAM;AAAA,EAC/F;AAAA,EAEA,CAAC,QAAQ,MAAM,IAAY;AACzB,WAAO,GAAG,KAAK,IAAI,KAAK,KAAK,OAAO;AAAA,EACtC;AACF;;;ACtBO,IAAM,kBAAN,cAA8B,kBAAkB;AAAC;;;AHUjD,IAAM,gBAAN,MAAM,eAAoC;AAAA,EAEvC,YACW,WACjB,YACA;AAFiB;AAGjB,SAAK,cAAc;AAAA,EACrB;AAAA,EAJmB;AAAA,EAFV;AAAA;AAAA,EAST,aAAa,QAAQ,KAAqC;AACxD,QAAI,OAAO,QAAQ,SAAU,OAAM,IAAI,gBAAgB,+CAA+C;AACtG,UAAM,aAAa,IAAI,QAAQ,WAAW,EAAE,EAAE,KAAK;AACnD,QAAI,WAAW,SAAS,uCAAuC;AAC7D,YAAM,IAAI,gBAAgB,0EAA0E;AACtG,QAAI,WAAW,SAAS,gCAAgC;AACtD,YAAM,IAAI,gBAAgB,4EAA4E;AACxG,UAAM,QAAQ,kFAAkF,KAAK,UAAU;AAC/G,QAAI,CAAC,QAAQ,CAAC,EAAG,OAAM,IAAI,gBAAgB,kDAAkD;AAC7F,UAAM,QAAQ,OAAO,KAAK,MAAM,CAAC,EAAE,QAAQ,OAAO,EAAE,GAAG,QAAQ;AAC/D,QAAI;AACF,YAAM,iBAAiB,MAAM,WAAW,OAAO,OAAO;AAAA,QACpD;AAAA,QACA;AAAA,QACA,EAAE,MAAM,SAAS,YAAY,QAAQ;AAAA,QACrC;AAAA,QACA,CAAC,MAAM;AAAA,MACT;AACA,YAAM,MAAM,MAAM,WAAW,OAAO,OAAO,UAAU,OAAO,cAAc;AAC1E,UAAI,CAAC,IAAI,KAAK,CAAC,IAAI,EAAG,OAAM,IAAI,gBAAgB,oDAAoD;AACpG,YAAM,YAAY,MAAM,WAAW,OAAO,OAAO;AAAA,QAC/C;AAAA,QACA,EAAE,KAAK,MAAM,KAAK,SAAS,GAAG,IAAI,GAAG,GAAG,IAAI,GAAG,KAAK,KAAK;AAAA,QACzD,EAAE,MAAM,SAAS,YAAY,QAAQ;AAAA,QACrC;AAAA,QACA,CAAC,QAAQ;AAAA,MACX;AACA,YAAM,aAAa,MAAM,WAAW,OAAO,OAAO;AAAA,QAChD;AAAA,QACA;AAAA,QACA,EAAE,MAAM,SAAS,YAAY,QAAQ;AAAA,QACrC;AAAA,QACA,CAAC,MAAM;AAAA,MACT;AACA,aAAO,IAAI,eAAc,WAAW,UAAU;AAAA,IAChD,SAAS,OAAO;AACd,YAAM,IAAI,gBAAgB,+DAA+D,EAAE,MAAM,CAAC;AAAA,IACpG,UAAE;AACA,YAAM,KAAK,CAAC;AAAA,IACd;AAAA,EACF;AAAA;AAAA,EAGA,aAAa,YAAY,MAAsC;AAC7D,QAAI;AACF,aAAO,MAAM,KAAK,QAAQ,MAAM,SAAS,MAAM,MAAM,CAAC;AAAA,IACxD,SAAS,OAAO;AACd,UAAI,iBAAiB,gBAAiB,OAAM;AAC5C,YAAM,IAAI,gBAAgB,uCAAuC,EAAE,MAAM,CAAC;AAAA,IAC5E;AAAA,EACF;AAAA;AAAA,EAEA,MAAM,KAAK,MAAuC;AAChD,QAAI;AACF,aAAO,IAAI;AAAA,QACT,MAAM,WAAW,OAAO,OAAO,KAAK,EAAE,MAAM,SAAS,MAAM,UAAU,GAAG,KAAK,aAAa,cAAc,IAAI,CAAC;AAAA,MAC/G;AAAA,IACF,SAAS,OAAO;AACd,YAAM,IAAI,gBAAgB,+DAA+D,EAAE,MAAM,CAAC;AAAA,IACpG;AAAA,EACF;AAAA;AAAA,EAEA,MAAM,YAAiC;AACrC,QAAI;AACF,YAAM,MAAM,MAAM,WAAW,OAAO,OAAO,UAAU,OAAO,KAAK,SAAS;AAC1E,aAAO;AAAA,QACL,KAAK;AAAA,QACL,KAAK;AAAA,QACL,GAAI,IAAI,MAAM,SAAY,CAAC,IAAI,EAAE,GAAG,IAAI,EAAE;AAAA,QAC1C,GAAI,IAAI,MAAM,SAAY,CAAC,IAAI,EAAE,GAAG,IAAI,EAAE;AAAA,MAC5C;AAAA,IACF,SAAS,OAAO;AACd,YAAM,IAAI,gBAAgB,+CAA+C,EAAE,MAAM,CAAC;AAAA,IACpF;AAAA,EACF;AAAA;AAAA,EAEA,OAAO,OAA4B;AACjC,WAAO,IAAI,YAAY,MAAM,KAAK;AAAA,EACpC;AACF;;;AInGO,IAAM,sBAAN,cAAkC,kBAAkB;AAAA;AAAA,EAEzD,YAAY,OAAgB;AAC1B,UAAM,qDAAqD,EAAE,MAAM,CAAC;AAAA,EACtE;AACF;;;ACRA,SAAS,kBAAkB;;;ACKpB,SAAS,gBAAgB,OAA2B;AACzD,SAAO,OAAO,KAAK,KAAK,EAAE,SAAS,WAAW;AAChD;AAOO,SAAS,gBAAgB,OAA0D;AACxF,MAAI,CAAC,SAAS,MAAM,SAAS,MAAM,KAAK,CAAC,mBAAmB,KAAK,KAAK,EAAG,QAAO;AAChF,MAAI;AACF,UAAM,UAAU,OAAO,KAAK,OAAO,WAAW;AAC9C,WAAO,QAAQ,SAAS,WAAW,MAAM,QAAQ,IAAI,WAAW,OAAO,IAAI;AAAA,EAC7E,QAAQ;AACN,WAAO;AAAA,EACT;AACF;;;ADZO,SAAS,cAAc,WAA+B;AAC3D,MAAI,UAAU,QAAQ,QAAQ,UAAU,QAAQ;AAC9C,UAAM,IAAI,UAAU,wCAAwC;AAC9D,QAAM,IAAI,UAAU;AACpB,QAAM,IAAI,UAAU;AACpB,MAAI,CAAC,KAAK,CAAC,EAAG,OAAM,IAAI,UAAU,mDAAmD;AACrF,aAAW,CAAC,MAAM,KAAK,KAAK;AAAA,IAC1B,CAAC,KAAK,CAAC;AAAA,IACP,CAAC,KAAK,CAAC;AAAA,EACT;AACE,QAAI,gBAAgB,KAAK,GAAG,WAAW;AACrC,YAAM,IAAI,UAAU,mBAAmB,IAAI,2CAA2C;AAC1F,QAAM,YAAY,kCAAkC,CAAC,UAAU,CAAC;AAChE,SAAO,gBAAgB,WAAW,QAAQ,EAAE,OAAO,WAAW,MAAM,EAAE,OAAO,CAAC;AAChF;;;AErBA,IAAM,WAAW;AAGV,SAAS,yBAAyB,YAA4B;AACnE,QAAM,QAAQ,gBAAgB,UAAU;AACxC,MAAI,OAAO,WAAW,GAAI,OAAM,IAAI,UAAU,oCAAoC;AAClF,MAAI,SAAS;AACb,MAAI,OAAO;AACX,MAAI,OAAO;AACX,aAAW,SAAS,MAAM,SAAS,GAAG,EAAE,GAAG;AACzC,aAAU,UAAU,IAAK;AACzB,YAAQ;AACR,WAAO,QAAQ,GAAG;AAChB,cAAQ;AACR,cAAQ,SAAS,OAAQ,UAAU,OAAQ,EAAE;AAAA,IAC/C;AACA,eAAW,KAAK,QAAQ;AAAA,EAC1B;AACA,SAAO,GAAG,KAAK,MAAM,GAAG,CAAC,CAAC,IAAI,KAAK,MAAM,GAAG,CAAC,CAAC,IAAI,KAAK,MAAM,GAAG,EAAE,CAAC,IAAI,KAAK,MAAM,EAAE,CAAC;AACvF;;;ACtBA,SAAS,cAAAA,mBAAkB;AAWpB,IAAM,mBAAmB;AAGzB,SAAS,aACd,OACA,qBACA,WACA,YACY;AACZ,MAAI,UAAU,WAAW,EAAG,OAAM,IAAI,UAAU,6DAA6D;AAC7G,MAAI,WAAW,WAAW,EAAG,OAAM,IAAI,UAAU,sDAAsD;AACvG,QAAM,OAAOC,YAAW,QAAQ,EAAE,OAAO,WAAW,MAAM,EAAE,OAAO,KAAK;AACxE,SAAO,IAAI,YAAY,EAAE;AAAA,IACvB,CAAC,kBAAkB,cAAc,OAAO,OAAO,GAAG,OAAO,mBAAmB,GAAG,MAAM,UAAU,EAAE,KAAK,IAAI;AAAA,EAC5G;AACF;AAGA,eAAsB,eAAe,SAAqB,QAAqC;AAC7F,MAAI;AACJ,MAAI;AACF,gBAAY,MAAM,OAAO,KAAK,OAAO;AAAA,EACvC,SAAS,OAAO;AACd,UAAM,IAAI,oBAAoB,KAAK;AAAA,EACrC;AACA,MAAI,EAAE,qBAAqB,eAAe,UAAU,WAAW;AAC7D,UAAM,IAAI,oBAAoB,IAAI,MAAM,mEAAmE,CAAC;AAC9G,SAAO,gBAAgB,SAAS;AAClC;;;ACjCO,SAAS,SAAS,OAAgB,OAA2B;AAClE,MAAI,OAAO,UAAU,YAAY,UAAU,QAAQ,MAAM,QAAQ,KAAK,GAAG;AACvE,UAAM,IAAI,UAAU,GAAG,KAAK,yBAAyB;AAAA,EACvD;AACA,SAAO;AACT;AAGO,SAAS,eAAe,QAAoB,OAAe,OAAuB;AACvF,QAAM,QAAQ,OAAO,KAAK;AAC1B,MAAI,OAAO,UAAU,UAAU;AAC7B,UAAM,IAAI,UAAU,GAAG,KAAK,IAAI,KAAK,oBAAoB;AAAA,EAC3D;AACA,SAAO;AACT;AAGO,SAAS,eAAe,QAAoB,OAAe,OAAmC;AACnG,QAAM,QAAQ,OAAO,KAAK;AAC1B,MAAI,UAAU,UAAa,UAAU,MAAM;AACzC,WAAO;AAAA,EACT;AACA,MAAI,OAAO,UAAU,UAAU;AAC7B,UAAM,IAAI,UAAU,GAAG,KAAK,IAAI,KAAK,iCAAiC;AAAA,EACxE;AACA,SAAO;AACT;AAGO,SAAS,aAAa,QAAoB,OAAe,OAAuB;AACrF,QAAM,EAAE,eAAAC,eAAc,IAAI;AAC1B,SAAOA,eAAc,eAAe,QAAQ,OAAO,KAAK,GAAG,GAAG,KAAK,IAAI,KAAK,EAAE;AAChF;AAGO,SAAS,aAAa,QAAoB,OAAe,OAAmC;AACjG,QAAM,QAAQ,eAAe,QAAQ,OAAO,KAAK;AACjD,SAAO,UAAU,SAAY,SAAuB,cAAc,OAAO,GAAG,KAAK,IAAI,KAAK,EAAE;AAC9F;AAGO,SAAS,kBAAkB,QAAoB,OAAe,OAAiC;AACpG,QAAM,QAAQ,eAAe,QAAQ,OAAO,KAAK;AACjD,MAAI,UAAU,QAAW;AACvB,WAAO;AAAA,EACT;AACA,QAAM,SAAS,IAAI,KAAK,KAAK;AAC7B,MAAI,CAAC,qBAAqB,KAAK,KAAK,OAAO,MAAM,OAAO,QAAQ,CAAC,GAAG;AAClE,UAAM,IAAI,UAAU,GAAG,KAAK,IAAI,KAAK,6BAA6B;AAAA,EACpE;AACA,SAAO;AACT;AAEA,SAAS,qBAAqB,OAAwB;AACpD,QAAM,QACJ,yGAAyG;AAAA,IACvG;AAAA,EACF;AACF,MAAI,UAAU,KAAM,QAAO;AAC3B,QAAM,OAAO,OAAO,MAAM,CAAC,CAAC;AAC5B,QAAM,QAAQ,OAAO,MAAM,CAAC,CAAC;AAC7B,QAAM,MAAM,OAAO,MAAM,CAAC,CAAC;AAC3B,QAAM,cAAc,IAAI,KAAK,KAAK,IAAI,MAAM,OAAO,CAAC,CAAC,EAAE,WAAW;AAClE,SAAO,SAAS,KAAK,SAAS,MAAM,OAAO,KAAK,OAAO;AACzD;AAGO,SAAS,gBAAgB,QAAoB,OAAe,OAAmC;AACpG,QAAM,QAAQ,OAAO,KAAK;AAC1B,MAAI,UAAU,UAAa,UAAU,MAAM;AACzC,WAAO;AAAA,EACT;AACA,MAAI,OAAO,UAAU,YAAY,CAAC,OAAO,UAAU,KAAK,GAAG;AACzD,UAAM,IAAI,UAAU,GAAG,KAAK,IAAI,KAAK,mCAAmC;AAAA,EAC1E;AACA,SAAO;AACT;AAGO,SAAS,gBAAgB,QAAoB,OAAe,OAAoC;AACrG,QAAM,QAAQ,OAAO,KAAK;AAC1B,MAAI,UAAU,UAAa,UAAU,MAAM;AACzC,WAAO;AAAA,EACT;AACA,MAAI,OAAO,UAAU,WAAW;AAC9B,UAAM,IAAI,UAAU,GAAG,KAAK,IAAI,KAAK,kCAAkC;AAAA,EACzE;AACA,SAAO;AACT;;;AC4BO,SAAS,qBAAqB,MAAgC;AACnE,QAAM,SAAS,SAAS,MAAM,iBAAiB;AAC/C,QAAM,eAAe,aAAa,QAAQ,gBAAgB,iBAAiB;AAC3E,QAAM,gBAAgB,aAAa,QAAQ,iBAAiB,iBAAiB;AAC7E,QAAM,QAAQ,eAAe,QAAQ,SAAS,iBAAiB;AAC/D,QAAM,YAAY,kBAAkB,QAAQ,aAAa,iBAAiB;AAC1E,SAAO;AAAA,IACL,GAAI,iBAAiB,SAAY,CAAC,IAAI,EAAE,aAAa;AAAA,IACrD,GAAI,kBAAkB,SAAY,CAAC,IAAI,EAAE,cAAc;AAAA,IACvD,GAAI,UAAU,SAAY,CAAC,IAAI,EAAE,MAAM;AAAA,IACvC,GAAI,cAAc,SAAY,CAAC,IAAI,EAAE,UAAU;AAAA,EACjD;AACF;AAGO,SAAS,yBAAyB,MAAoC;AAC3E,QAAM,SAAS,SAAS,MAAM,qBAAqB;AACnD,QAAM,QAAQ,aAAa,QAAQ,SAAS,qBAAqB;AACjE,QAAM,aAAa,eAAe,QAAQ,cAAc,qBAAqB;AAC7E,QAAM,aAAa,eAAe,QAAQ,cAAc,qBAAqB;AAC7E,QAAM,YAAY,eAAe,QAAQ,aAAa,qBAAqB;AAC3E,QAAM,sBAAsB,gBAAgB,QAAQ,uBAAuB,qBAAqB;AAChG,SAAO;AAAA,IACL;AAAA,IACA,GAAI,eAAe,SAAY,CAAC,IAAI,EAAE,WAAW;AAAA,IACjD,GAAI,eAAe,SAAY,CAAC,IAAI,EAAE,WAAW;AAAA,IACjD,GAAI,cAAc,SAAY,CAAC,IAAI,EAAE,UAAU;AAAA,IAC/C,GAAI,wBAAwB,SAAY,CAAC,IAAI,EAAE,oBAAoB;AAAA,EACrE;AACF;AAGO,SAAS,sBAAsB,MAAiC;AACrE,QAAM,SAAS,SAAS,MAAM,kBAAkB;AAChD,QAAM,QAAQ,aAAa,QAAQ,SAAS,kBAAkB;AAC9D,QAAM,sBAAsB,gBAAgB,QAAQ,uBAAuB,kBAAkB;AAC7F,QAAM,aAAa,eAAe,QAAQ,cAAc,kBAAkB;AAC1E,QAAM,gBAAgB,eAAe,QAAQ,iBAAiB,kBAAkB;AAChF,QAAM,QAAQ,eAAe,QAAQ,SAAS,kBAAkB;AAChE,QAAM,YAAY,kBAAkB,QAAQ,aAAa,kBAAkB;AAC3E,QAAM,eAAe,kBAAkB,QAAQ,gBAAgB,kBAAkB;AACjF,SAAO;AAAA,IACL,GAAI,UAAU,SAAY,CAAC,IAAI,EAAE,MAAM;AAAA,IACvC,GAAI,wBAAwB,SAAY,CAAC,IAAI,EAAE,oBAAoB;AAAA,IACnE,GAAI,eAAe,SAAY,CAAC,IAAI,EAAE,WAAW;AAAA,IACjD,GAAI,kBAAkB,SAAY,CAAC,IAAI,EAAE,cAAc;AAAA,IACvD,GAAI,UAAU,SAAY,CAAC,IAAI,EAAE,MAAM;AAAA,IACvC,GAAI,cAAc,SAAY,CAAC,IAAI,EAAE,UAAU;AAAA,IAC/C,GAAI,iBAAiB,SAAY,CAAC,IAAI,EAAE,aAAa;AAAA,EACvD;AACF;AAGO,SAAS,yBAAyB,MAAoC;AAC3E,QAAM,SAAS,SAAS,MAAM,qBAAqB;AACnD,QAAM,UAAU,eAAe,QAAQ,WAAW,qBAAqB;AACvE,QAAM,SAAS,eAAe,QAAQ,UAAU,qBAAqB;AACrE,QAAM,YAAY,eAAe,QAAQ,aAAa,qBAAqB;AAC3E,QAAM,OAAO,eAAe,QAAQ,QAAQ,qBAAqB;AACjE,QAAM,iBAAiB,eAAe,QAAQ,kBAAkB,qBAAqB;AACrF,QAAM,cAAc,eAAe,QAAQ,eAAe,qBAAqB;AAC/E,QAAM,gBAAgB,eAAe,QAAQ,iBAAiB,qBAAqB;AACnF,QAAM,oBAAoB,YAAY,OAAO,mBAAmB,uCAAuC;AACvG,QAAM,QAAQ,aAAa,QAAQ,SAAS,qBAAqB;AACjE,QAAM,YAAY,aAAa,QAAQ,aAAa,qBAAqB;AACzE,QAAM,gBAAgB,aAAa,QAAQ,iBAAiB,qBAAqB;AACjF,QAAM,gBAAgB,gBAAgB,QAAQ,iBAAiB,qBAAqB;AACpF,QAAM,kBAAkB,YAAY,OAAO,iBAAiB,qCAAqC;AACjG,QAAM,aAAa,kBAAkB,QAAQ,cAAc,qBAAqB;AAChF,SAAO;AAAA,IACL;AAAA,IACA;AAAA,IACA,GAAI,YAAY,SAAY,CAAC,IAAI,EAAE,QAAQ;AAAA,IAC3C,GAAI,WAAW,SAAY,CAAC,IAAI,EAAE,OAAO;AAAA,IACzC,GAAI,cAAc,SAAY,CAAC,IAAI,EAAE,UAAU;AAAA,IAC/C,GAAI,SAAS,SAAY,CAAC,IAAI,EAAE,KAAK;AAAA,IACrC,GAAI,mBAAmB,SAAY,CAAC,IAAI,EAAE,eAAe;AAAA,IACzD,GAAI,gBAAgB,SAAY,CAAC,IAAI,EAAE,YAAY;AAAA,IACnD,GAAI,kBAAkB,SAAY,CAAC,IAAI,EAAE,cAAc;AAAA,IACvD,GAAI,UAAU,SAAY,CAAC,IAAI,EAAE,MAAM;AAAA,IACvC,GAAI,cAAc,SAAY,CAAC,IAAI,EAAE,UAAU;AAAA,IAC/C,GAAI,kBAAkB,SAAY,CAAC,IAAI,EAAE,cAAc;AAAA,IACvD,GAAI,kBAAkB,SAAY,CAAC,IAAI,EAAE,cAAc;AAAA,IACvD,GAAI,eAAe,SAAY,CAAC,IAAI,EAAE,WAAW;AAAA,EACnD;AACF;AAEA,SAAS,YAAY,OAAgB,OAAkC;AACrE,QAAM,QAAQ,SAAS,CAAC;AACxB,MAAI,CAAC,MAAM,QAAQ,KAAK,KAAK,CAAC,MAAM,MAAM,CAAC,SAAyB,OAAO,SAAS,QAAQ,GAAG;AAC7F,UAAM,IAAI,UAAU,GAAG,KAAK,+BAA+B;AAAA,EAC7D;AACA,SAAO;AACT;;;ACvNA,SAAS,sBAAsB;;;ACIxB,IAAM,cAAc;AAAA,EACzB;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AACF;AAMO,IAAM,wBAAgD,oBAAI,IAAI;AAAA,EACnE;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AACF,CAAC;AAGM,SAAS,eAAe,MAA4C;AACzE,MAAI,SAAS,QAAQ,SAAS,QAAW;AACvC,WAAO;AAAA,EACT;AACA,SAAO,YAAY,KAAK,CAAC,UAAU,UAAU,IAAI,KAAK;AACxD;;;AC3CO,SAAS,aAAa,MAAwB;AACnD,QAAM,SAAS,SAAS,MAAM,SAAS;AACvC,QAAM,OAAO,eAAe,QAAQ,QAAQ,SAAS;AACrD,QAAM,QAAQ,eAAe,QAAQ,SAAS,SAAS;AACvD,QAAM,SAAS,eAAe,QAAQ,UAAU,SAAS;AACzD,QAAM,OAAO,eAAe,QAAQ,QAAQ,SAAS;AACrD,QAAM,YAAY,eAAe,QAAQ,aAAa,SAAS;AAC/D,QAAM,SAAS,gBAAgB,QAAQ,UAAU,SAAS,KAAK;AAC/D,QAAM,aAAa,OAAO;AAC1B,SAAO;AAAA,IACL;AAAA,IACA,GAAI,SAAS,SAAY,CAAC,IAAI,EAAE,KAAK;AAAA,IACrC,GAAI,UAAU,SAAY,CAAC,IAAI,EAAE,MAAM;AAAA,IACvC,GAAI,WAAW,SAAY,CAAC,IAAI,EAAE,OAAO;AAAA,IACzC,GAAI,SAAS,SAAY,CAAC,IAAI,EAAE,KAAK;AAAA,IACrC,GAAI,cAAc,SAAY,CAAC,IAAI,EAAE,UAAU;AAAA,IAC/C,GAAI,eAAe,UAAa,eAAe,OAAO,CAAC,IAAI,EAAE,WAAW;AAAA,EAC1E;AACF;;;ACtCO,SAAS,kBAAkB,OAAsD;AACtF,QAAM,QAAQ,OAAO,MAAM,GAAG,EAAE,CAAC,GAAG,KAAK;AACzC,MAAI,UAAU,UAAa,CAAC,QAAQ,KAAK,KAAK,EAAG,QAAO;AACxD,QAAM,UAAU,OAAO,KAAK;AAC5B,SAAO,OAAO,cAAc,OAAO,KAAK,WAAW,aAAgB,UAAU;AAC/E;;;ACGO,IAAM,eAAN,cAA2B,kBAAkB;AAAA;AAAA,EAEzC;AAAA;AAAA,EAEA;AAAA;AAAA,EAEA;AAAA;AAAA,EAEA;AAAA;AAAA,EAEA;AAAA;AAAA,EAEA;AAAA;AAAA,EAEA;AAAA;AAAA,EAEA;AAAA;AAAA,EAEA;AAAA;AAAA,EAEA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAQT,YAAY,SAAkB,QAAgB,YAAqB,aAAa,OAAO;AACrF;AAAA,MACE,iBAAiB,OAAO,MAAM,CAAC,IAAI,QAAQ,QAAQ,SAAS,GAAG,aAAa,0CAA0C,EAAE,GAAG,QAAQ,cAAc,SAAY,KAAK,aAAa,QAAQ,SAAS,GAAG;AAAA,IACrM;AACA,SAAK,UAAU;AACf,WAAO,eAAe,MAAM,WAAW,EAAE,YAAY,MAAM,CAAC;AAC5D,SAAK,SAAS;AACd,SAAK,OAAO,eAAe,QAAQ,IAAI;AACvC,SAAK,aAAa;AAClB,SAAK,cAAc,sBAAsB,IAAI,KAAK,IAAI;AACtD,SAAK,eAAe,aAAa,cAAc,UAAU,KAAK,IAAI;AAClE,QAAI,QAAQ,SAAS,QAAW;AAC9B,WAAK,UAAU,QAAQ;AAAA,IACzB;AACA,QAAI,QAAQ,cAAc,QAAW;AACnC,WAAK,YAAY,QAAQ;AAAA,IAC3B;AACA,QAAI,QAAQ,SAAS,QAAW;AAC9B,WAAK,UAAU,QAAQ;AAAA,IACzB;AACA,QAAI,eAAe,QAAW;AAC5B,WAAK,aAAa;AAAA,IACpB;AAAA,EACF;AACF;AAGO,IAAM,2BAAN,cAAuC,aAAa;AAAC;AAErD,IAAM,oBAAN,cAAgC,aAAa;AAAC;AAE9C,IAAM,kBAAN,cAA8B,aAAa;AAAC;AAE5C,IAAM,2BAAN,cAAuC,aAAa;AAAC;AAErD,IAAM,mBAAN,cAA+B,aAAa;AAAC;AAE7C,IAAM,qBAAN,cAAiC,aAAa;AAAC;AAE/C,IAAM,0BAAN,cAAsC,aAAa;AAAC;AAEpD,IAAM,sBAAN,cAAkC,aAAa;AAAC;AAEhD,IAAM,qBAAN,cAAiC,aAAa;AAAC;AAE/C,IAAM,wBAAN,cAAoC,aAAa;AAAC;AAElD,IAAM,wBAAN,cAAoC,aAAa;AAAC;AAElD,IAAM,6BAAN,cAAyC,aAAa;AAAC;AAEvD,IAAM,yBAAN,cAAqC,aAAa;AAAC;AAGnD,SAAS,UAAU,MAAsC;AAC9D,SAAO,SAAS,4BACd,SAAS,qBACT,SAAS,oBACT,SAAS,0BACT,SAAS,qBACT,SAAS,kBACT,SAAS,aACT,iBAAiB,IAAI,IACnB,YACA;AACN;AAGO,SAAS,iBAAiB,MAA0B;AACzD,SACE,SAAS,yBACT,SAAS,uBACT,SAAS,wBACT,SAAS,wBACT,SAAS;AAEb;AAGO,SAAS,mBAAmB,MAA2B,QAAgB,SAAiC;AAC7G,QAAM,UAAU,uBAAuB,MAAM,MAAM;AACnD,QAAM,aAAa,kBAAkB,SAAS,IAAI,aAAa,CAAC;AAChE,QAAM,aAAa,aAAa,SAAS,IAAI,sBAAsB,CAAC,EAAE,KAAK,CAAC,UAAU,MAAM,YAAY,MAAM,MAAM;AACpH,QAAM,YAAY,aAAa,QAAQ,IAAI;AAC3C,SAAO,IAAI,UAAU,SAAS,QAAQ,YAAY,UAAU;AAC9D;AAEA,SAAS,uBAAuB,MAA2B,QAAyB;AAClF,MAAI;AACF,UAAM,OAAO,OAAO,SAAS,WAAW,OAAO,IAAI,YAAY,EAAE,OAAO,IAAI;AAC5E,WAAO,aAAa,KAAK,MAAM,IAAI,CAAY;AAAA,EACjD,QAAQ;AACN,WAAO,EAAE,MAAM,eAAe,OAAO,sBAAsB,QAAQ,MAAM,iBAAiB;AAAA,EAC5F;AACF;AAEA,SAAS,aAAa,OAA4C;AAChE,SAAO,UAAU,UAAa,UAAU,OAAO,CAAC,IAAI,MAAM,MAAM,GAAG,EAAE,IAAI,CAAC,SAAS,KAAK,KAAK,CAAC;AAChG;AAEA,SAAS,aAAa,MAA+C;AACnE,UAAQ,eAAe,IAAI,GAAG;AAAA,IAC5B,KAAK;AACH,aAAO;AAAA,IACT,KAAK;AACH,aAAO;AAAA,IACT,KAAK;AAAA,IACL,KAAK;AACH,aAAO;AAAA,IACT,KAAK;AACH,aAAO;AAAA,IACT,KAAK;AACH,aAAO;AAAA,IACT,KAAK;AAAA,IACL,KAAK;AACH,aAAO;AAAA,IACT,KAAK;AAAA,IACL,KAAK;AACH,aAAO;AAAA,IACT,KAAK;AACH,aAAO;AAAA,IACT,KAAK;AAAA,IACL,KAAK;AAAA,IACL,KAAK;AAAA,IACL,KAAK;AAAA,IACL,KAAK;AAAA,IACL,KAAK;AAAA,IACL,KAAK;AAAA,IACL,KAAK;AAAA,IACL,KAAK;AACH,aAAO;AAAA,IACT,KAAK;AAAA,IACL,KAAK;AAAA,IACL,KAAK;AACH,aAAO;AAAA,IACT,KAAK;AAAA,IACL,KAAK;AACH,aAAO;AAAA,IACT,KAAK;AAAA,IACL,KAAK;AAAA,IACL,KAAK;AACH,aAAO;AAAA,IACT,KAAK;AAAA,IACL,KAAK;AAAA,IACL,KAAK;AAAA,IACL,KAAK;AACH,aAAO;AAAA,IACT;AACE,aAAO;AAAA,EACX;AACF;;;AC3LA,SAAS,cAAAC,mBAAkB;AAQpB,IAAM,oBAAoB,IAAI,YAAY,EAAE,OAAO,IAAI;AAQvD,SAAS,gBAAgB,OAA2B;AACzD,SAAO,YAAYA,YAAW,QAAQ,EAAE,OAAO,KAAK,EAAE,OAAO,QAAQ,CAAC;AACxE;;;AClBA,SAAS,WAAAC,gBAAe;;;ACSjB,SAAS,aAAa,SAA8C;AACzE,UAAQ,SAAS;AAAA,IACf,KAAK;AACH,aAAO,CAAC,WAAW,cAAc,SAAS,UAAU,aAAa;AAAA,IACnE,KAAK;AACH,aAAO,CAAC,WAAW,cAAc,SAAS,UAAU,kBAAkB,SAAS,aAAa;AAAA,IAC9F,KAAK;AACH,aAAO,CAAC,WAAW,cAAc,SAAS,UAAU,kBAAkB,SAAS,mBAAmB,aAAa;AAAA,EACnH;AACF;;;ACMO,SAAS,4BAA4B,QAA0C;AACpF,MAAI,OAAO,KAAK,SAAS,GAAG,EAAG,OAAM,IAAI,UAAU,oDAAoD;AACvG,SAAO;AAAA,IACL,QAAQ,OAAO,OAAO,YAAY;AAAA,IAClC,WAAW,OAAO,UAAU,YAAY;AAAA,IACxC,MAAM,OAAO;AAAA,IACb,gBAAgB,OAAO;AAAA,IACvB,UAAU,OAAO;AAAA,IACjB,GAAI,OAAO,kBAAkB,SAAY,CAAC,IAAI,EAAE,eAAe,OAAO,cAAc;AAAA,IACpF,GAAI,OAAO,UAAU,SAAY,CAAC,IAAI,EAAE,OAAO,OAAO,MAAM;AAAA,IAC5D,GAAI,OAAO,mBAAmB,SAC1B,CAAC,IACD,EAAE,gBAAgB,cAAc,OAAO,gBAAgB,gBAAgB,EAAE;AAAA,EAC/E;AACF;AAGO,SAAS,QAAQ,QAAyB,WAA2B;AAC1E,QAAM,SAA6C;AAAA,IACjD,WAAW,OAAO;AAAA,IAClB,cAAc,OAAO;AAAA,IACrB,SAAS,OAAO;AAAA,IAChB,UAAU,IAAI,OAAO,cAAc;AAAA,IACnC,kBAAkB,OAAO;AAAA,IACzB,OAAO,OAAO;AAAA,IACd,mBAAmB,OAAO;AAAA,IAC1B,eAAe,OAAO;AAAA,EACxB;AACA,QAAM,QAAQ,OAAO,SAAS;AAC9B,MAAI,UAAU,OAAW,OAAM,IAAI,UAAU,0BAA0B,SAAS,iBAAiB;AACjG,SAAO;AACT;;;AC7CO,IAAM,8BAA8B;AAAA;AAAA,EAEzC,OAAO;AAAA;AAAA,EAEP,WAAW;AAAA;AAAA,EAEX,6BAA6B;AAAA;AAAA,EAG7B,MACE,SACA,QACA,SACA,SACA,OACY;AACZ,UAAM,QAAQ,OAAO;AACrB,UAAM,SAAS,KAAK,WAAW,SAAS,SAAS,SAAS,OAAO,KAAK;AACtE,UAAM,QAAQ,aAAa,OAAO,EAAE,IAAI,CAAC,cAAc,IAAI,SAAS,MAAM,QAAQ,QAAQ,SAAS,CAAC;AAAA,CAAI;AACxG,UAAM,KAAK,wBAAwB,MAAM,EAAE;AAC3C,WAAO,IAAI,YAAY,EAAE,OAAO,MAAM,KAAK,EAAE,CAAC;AAAA,EAChD;AAAA;AAAA,EAGA,WAAW,SAA2B,SAAiB,SAAiB,OAAe,OAAwB;AAC7G,QAAI,UAAU,UAAU,KAAK;AAC3B,YAAM,IAAI,WAAW,mDAAmD;AAC1E,QAAI,eAAe,UAAU,UAAa,MAAM,WAAW;AAC3D,QAAI,UAAU;AACZ,iBAAW,aAAa;AACtB,YAAI,cAAc,OAAO,cAAc,QAAQ,UAAU,WAAW,CAAC,IAAI,MAAM,UAAU,WAAW,CAAC,MAAM;AACzG,yBAAe;AAAA;AACrB,QAAI,YAAY,aAAa,UAAU,SAAY,cAAc;AAC/D,YAAM,IAAI,UAAU,0DAA0D;AAAA,IAChF;AACA,UAAM,MAAM,aAAa,OAAO,EAC7B,IAAI,CAAC,SAAS,IAAI,IAAI,GAAG,EACzB,KAAK,GAAG;AACX,WAAO,IAAI,GAAG,aAAa,OAAO,OAAO,CAAC,YAAY,OAAO,OAAO,CAAC,WAAW,cAAc,OAAO,OAAO,CAAC,UAAU,4BAA4B,SAAS,IAAI,UAAU,SAAY,KAAK,WAAW,KAAK,GAAG;AAAA,EAChN;AAAA;AAAA,EAGA,qBAAqB,YAA4B;AAC/C,WAAO,GAAG,KAAK,KAAK,IAAI,UAAU;AAAA,EACpC;AAAA;AAAA,EAEA,gBAAgB,WAA+B;AAC7C,WAAO,GAAG,KAAK,KAAK,KAAK,OAAO,KAAK,SAAS,EAAE,SAAS,QAAQ,CAAC;AAAA,EACpE;AACF;;;AH7CO,IAAM,uBAAN,MAA2B;AAAA;AAAA,EAEhC,YAA6B,QAAuB;AAAvB;AAAA,EAAwB;AAAA,EAAxB;AAAA;AAAA,EAG7B,MAAM,KACJ,SACA,QACA,SACA,SAC+B;AAC/B,UAAM,SAAS,4BAA4B,MAAM;AACjD,QAAK,YAAY,gBAAiB,OAAO,UAAU;AACjD,YAAM,IAAI,UAAU,0DAA0D;AAChF,eAAW,QAAQ,aAAa,OAAO,GAAG;AACxC,UAAI,SAAS,oBAAoB,OAAO,kBAAkB;AACxD,cAAM,IAAI,UAAU,+CAA+C;AACrE,UAAI,SAAS,qBAAqB,OAAO,mBAAmB;AAC1D,cAAM,IAAI,UAAU,4DAA4D;AAAA,IACpF;AACA,UAAM,OAAO,4BAA4B,MAAM,SAAS,QAAQ,SAAS,SAAS,KAAK,OAAO,KAAK;AACnG,QAAI;AACJ,QAAI;AACF,kBAAY,MAAM,KAAK,OAAO,KAAK,IAAI;AAAA,IACzC,SAAS,OAAO;AACd,YAAM,IAAI,oBAAoB,KAAK;AAAA,IACrC;AACA,QAAI,EAAE,qBAAqB,eAAe,UAAU,WAAW;AAC7D,YAAM,IAAI;AAAA,QACR,IAAI;AAAA,UACF;AAAA,QACF;AAAA,MACF;AACF,UAAM,SAAS,4BAA4B,WAAW,SAAS,SAAS,SAAS,KAAK,OAAO,OAAO,OAAO,KAAK;AAChH,WAAO;AAAA,MACL,gBAAgB,4BAA4B,qBAAqB,MAAM;AAAA,MACvE,WAAW,4BAA4B,gBAAgB,SAAS;AAAA,MAChE,UAAU,OAAO;AAAA,MACjB,GAAI,OAAO,kBAAkB,SAAY,CAAC,IAAI,EAAE,eAAe,OAAO,cAAc;AAAA,MACpF,GAAI,OAAO,UAAU,SAAY,CAAC,IAAI,EAAE,OAAO,OAAO,MAAM;AAAA,MAC5D,GAAI,OAAO,mBAAmB,SAAY,CAAC,IAAI,EAAE,gBAAgB,OAAO,eAAe;AAAA,MACvF,eAAe;AAAA,MACf,CAACC,SAAQ,MAAM,IAAI;AACjB,eAAO;AAAA,MACT;AAAA,IACF;AAAA,EACF;AACF;;;AI7DA,SAAS,cAAAC,mBAAkB;;;ACOpB,IAAM,cAAqB,EAAE,KAAK,MAAM,oBAAI,KAAK,EAAE;;;ACQnD,SAAS,oBAAoB,OAAiD;AACnF,MAAI,CAAC,MAAO,QAAO;AACnB,QAAM,QAAQ,MAAM,QAAQ,GAAG;AAC/B,MAAI,SAAS,KAAK,MAAM,QAAQ,CAAC,MAAM,IAAK,QAAO;AACnD,QAAM,QAAQ,MAAM,MAAM,GAAG,KAAK;AAClC,MAAI,QAAQ,QAAQ;AACpB,QAAM,cAAwB,CAAC;AAC/B,SAAO,QAAQ,MAAM,UAAU,MAAM,KAAK,MAAM,KAAK;AACnD,QAAI,MAAM,KAAK,MAAM,KAAK;AACxB,aAAO,MAAM,KAAK,MAAM,IAAK;AAC7B;AAAA,IACF;AACA,QAAI,MAAM,KAAK,MAAM,IAAK,QAAO;AACjC,UAAM,MAAM,MAAM,QAAQ,KAAK,QAAQ,CAAC;AACxC,QAAI,MAAM,EAAG,QAAO;AACpB,UAAM,OAAO,MAAM,MAAM,QAAQ,GAAG,GAAG;AACvC,YAAQ,MAAM;AACd,QAAI,eAAe;AACnB,QAAI,MAAM,KAAK,MAAM,KAAK;AACxB,UAAI,CAAC,MAAM,WAAW,QAAQ,KAAK,EAAG,QAAO;AAC7C,eAAS;AACT,qBAAe;AAAA,IACjB;AACA,gBAAY,KAAK,eAAe,GAAG,IAAI,SAAS,IAAI;AAAA,EACtD;AACA,MAAI,MAAM,KAAK,MAAM,IAAK,QAAO;AACjC;AACA,MAAI;AACJ,MAAI;AACJ,MAAI;AACJ,SAAO,QAAQ,MAAM,QAAQ;AAC3B,QAAI,MAAM,KAAK,MAAM,IAAK,QAAO;AACjC,UAAM,QAAQ,QAAQ;AACtB,UAAM,KAAK,MAAM,QAAQ,KAAK,KAAK;AACnC,QAAI,KAAK,EAAG,QAAO;AACnB,UAAM,OAAO,MAAM,MAAM,OAAO,EAAE;AAClC,YAAQ,KAAK;AACb,QAAI,MAAM,KAAK,MAAM,KAAK;AACxB,YAAM,MAAM,MAAM,QAAQ,KAAK,QAAQ,CAAC;AACxC,UAAI,MAAM,EAAG,QAAO;AACpB,YAAM,OAAO,MAAM,MAAM,QAAQ,GAAG,GAAG;AACvC,cAAQ,MAAM;AACd,UAAI,SAAS,QAAS,SAAQ;AAAA,eACrB,SAAS,MAAO,aAAY;AAAA,IACvC,OAAO;AACL,UAAI,MAAM;AACV,aAAO,MAAM,MAAM,UAAU,MAAM,GAAG,MAAM,IAAK;AACjD,YAAM,OAAO,MAAM,MAAM,OAAO,GAAG;AACnC,UAAI,CAAC,QAAQ,KAAK,IAAI,EAAG,QAAO;AAChC,UAAI,SAAS,WAAW;AACtB,cAAM,UAAU,OAAO,IAAI;AAC3B,YAAI,UAAU,qBAA4B,QAAO;AACjD,kBAAU,OAAO,OAAO;AAAA,MAC1B;AACA,cAAQ;AAAA,IACV;AAAA,EACF;AACA,MAAI,YAAY,UAAa,UAAU,OAAW,QAAO;AACzD,SAAO,EAAE,OAAO,aAAa,SAAS,OAAO,GAAI,cAAc,SAAY,CAAC,IAAI,EAAE,UAAU,EAAG;AACjG;;;AC1DO,IAAM,+BAA+B;AAAA;AAAA,EAC4E,iBAAiB;AAAA;AAAA,EAC9D,OAAO;AAAA;AAAA,EACA,WAAW;AAAA;AAAA,EAG3F,WACE,QACA,QACA,WACA,uBACA,UACA,YACA,UACA,cACqB;AACrB,UAAM,SAA8B;AAAA,MAClC,EAAE,MAAM,WAAW,OAAO,OAAO,MAAM,GAAG,cAAc,MAAM;AAAA,MAC9D,EAAE,MAAM,kBAAkB,OAAO,QAAQ,cAAc,MAAM;AAAA,MAC7D,EAAE,MAAM,gBAAgB,OAAO,WAAW,cAAc,MAAM;AAAA,IAChE;AACA,QAAI;AACF,aAAO,KAAK,EAAE,MAAM,mBAAmB,OAAO,uBAAuB,cAAc,KAAK,CAAC;AAC3F,eAAW,CAAC,MAAM,KAAK,KAAK;AAAA,MAC1B,CAAC,YAAY,QAAQ;AAAA,MACrB,CAAC,eAAe,UAAU;AAAA,MAC1B,CAAC,wBAAwB,QAAQ;AAAA,MACjC,CAAC,iBAAiB,YAAY;AAAA,IAChC;AACE,UAAI,MAAO,QAAO,KAAK,EAAE,MAAM,OAAO,cAAc,MAAM,CAAC;AAC7D,WAAO;AAAA,EACT;AAAA;AAAA,EAGA,MAAM,YAA0C,SAAiB,OAA2B;AAC1F,UAAM,SAAS,IAAI,WAAW,IAAI,CAAC,SAAS,IAAI,KAAK,IAAI,IAAI,KAAK,eAAe,SAAS,EAAE,EAAE,EAAE,KAAK,GAAG,CAAC,aAAa,OAAO,OAAO,CAAC,WAAW,KAAK,UAAU,6BAA6B,SAAS;AACrM,UAAM,QAAQ,WAAW,IAAI,CAAC,SAAS,IAAI,KAAK,IAAI,IAAI,KAAK,eAAe,SAAS,EAAE,KAAK,KAAK,KAAK;AAAA,CAAI;AAC1G,UAAM,KAAK,wBAAwB,MAAM,EAAE;AAC3C,WAAO,IAAI,YAAY,EAAE,OAAO,MAAM,KAAK,EAAE,CAAC;AAAA,EAChD;AACF;;;AC/CO,IAAM,4BAAN,cAAwC,kBAAkB;AAAA;AAAA,EAEtD;AAAA;AAAA,EAET,YAAY,SAAsC,QAAgB;AAChE,UAAM,4CAA4C,OAAO,MAAM,MAAM,kCAAkC;AACvG,SAAK,UAAU;AAAA,EACjB;AACF;;;ACjBA;AAAA,EACE;AAAA,EACA;AAAA,EACA;AAAA,OAMK;;;ACHA,IAAM,wBAAwB;AAAA;AAAA,EAEnC,OAAO;AAAA;AAAA,EAEP,YAAY;AAAA,IACV,QAAQ;AAAA,IACR,OAAO;AAAA,IACP,QAAQ;AAAA,IACR,YAAY;AAAA,IACZ,WAAW;AAAA,IACX,WAAW;AAAA,IACX,aAAa;AAAA,IACb,WAAW;AAAA,EACb;AAAA;AAAA,EAEA,aAAa;AAAA,IACX,iBAAiB;AAAA,IACjB,mBAAmB;AAAA,IACnB,sBAAsB;AAAA,IACtB,eAAe;AAAA,IACf,mBAAmB;AAAA,EACrB;AACF;;;ADfA,IAAM,iBAAiB;AACvB,IAAM,aAAa,oBAAI,QAAuC;AAC9D,IAAM,WAAW,oBAAI,QAAqC;AAG1D,eAAsB,aAAgB,MAAc,QAA4D;AAC9G,MAAI;AACJ,MAAI;AACF,UAAM,SAAS,MAAM,UAAU,sBAAsB,OAAO,cAAc;AAC1E,UAAM,SAAS,OAAO,gBAAgB,MAAM,EAAE,MAAM,SAAS,OAAO,GAAyB,CAAC,SAAS;AACrG,uBAAiB,QAAQ,QAAQ,EAAE,KAAK,MAAM,OAAO,IAAI,CAAC;AAC1D,aAAO;AAAA,IACT,CAAC;AACD,SAAK,QAAQ,QAAQ,MAAM,EAAE,MAAM,MAAM,MAAS;AAClD,QAAI,mBAAmB,OAAW,QAAO,MAAM;AAC/C,UAAM;AAAA,EACR,QAAQ;AACN,QAAI,mBAAmB,OAAW,QAAO;AAAA,EAC3C;AACA,SAAO,OAAO,MAAS;AACzB;AAGO,SAAS,SAAS,MAAwB,QAAoC;AACnF,MAAI,SAAS,OAAW;AACxB,MAAI;AACF,WAAO,IAAI;AAAA,EACb,QAAQ;AAAA,EAER;AACF;AAGO,SAAS,QACd,QACA,OACA,SACA,QACM;AACN,MAAI,WAAW,OAAW;AAC1B,MAAI;AACF,UAAM,SAAS,OAAO,KAAK,IAAI,SAAS,MAAM;AAC9C,QAAI,WAAW,UAAa,OAAQ,OAAgC,SAAS,YAAY;AACvF,WAAK,QAAQ,QAAQ,MAAM,EAAE,MAAM,MAAM,MAAS;AAAA,IACpD;AAAA,EACF,QAAQ;AAAA,EAER;AACF;AAGO,SAAS,cACd,MACA,OACA,YACA,SACM;AACN,MAAI;AACF,UAAM,QAAQ,QAAQ,SAAS,sBAAsB,OAAO,cAAc;AAC1E,UAAM,cAAc,eAAe,YAAY,KAAK;AACpD,QAAI,aAAa,YAAY,IAAI,IAAI;AACrC,QAAI,eAAe,QAAW;AAC5B,mBAAa,MAAM,gBAAgB,MAAM,EAAE,GAAG,SAAS,aAAa,GAAG,IAAI,gCAAgC,CAAC;AAC5G,kBAAY,IAAI,MAAM,UAAU;AAAA,IAClC;AACA,eAAW,OAAO,OAAO,UAAU;AAAA,EACrC,QAAQ;AAAA,EAER;AACF;AAGO,SAAS,YAAY,MAAc,YAA6D;AACrG,MAAI;AACF,UAAM,QAAQ,QAAQ,SAAS,sBAAsB,OAAO,cAAc;AAC1E,UAAM,cAAc,eAAe,UAAU,KAAK;AAClD,QAAI,aAAa,YAAY,IAAI,IAAI;AACrC,QAAI,eAAe,QAAW;AAC5B,mBAAa,MAAM,cAAc,MAAM,EAAE,aAAa,GAAG,IAAI,gCAAgC,CAAC;AAC9F,kBAAY,IAAI,MAAM,UAAU;AAAA,IAClC;AACA,eAAW,IAAI,GAAG,UAAU;AAAA,EAC9B,QAAQ;AAAA,EAER;AACF;AAEA,SAAS,eAAkB,OAAuC,OAA8B;AAC9F,MAAI,cAAc,MAAM,IAAI,KAAK;AACjC,MAAI,gBAAgB,QAAW;AAC7B,kBAAc,oBAAI,IAAe;AACjC,UAAM,IAAI,OAAO,WAAW;AAAA,EAC9B;AACA,SAAO;AACT;;;ALtFO,IAAM,0BAAN,MAA8B;AAAA;AAAA,EAEnC,YACmB,MACA,QAAe,aACf,QACjB;AAHiB;AACA;AACA;AAAA,EAChB;AAAA,EAHgB;AAAA,EACA;AAAA,EACA;AAAA;AAAA,EAInB,MAAM,OAAO,UAA8B,SAAmD;AAC5F,UAAM,iBAAiB,OAAO,UAAU,iBAAiB;AACzD,UAAM,YAAY,OAAO,UAAU,WAAW;AAC9C,QAAI,CAAC,kBAAkB,CAAC,UAAW,MAAK,qBAAqB,4CAA4C;AACzG,UAAM,SAAS,oBAAoB,cAAc;AACjD,QAAI,CAAC,OAAQ,MAAK,uBAAuB,sCAAsC;AAC/E,QAAI,OAAO,UAAU,UAAU,CAAC,UAAU,WAAW,OAAO;AAC1D,WAAK,oBAAoB,8CAA8C;AACzE,QAAI,OAAO,cAAc,UAAa,OAAO,cAAc;AACzD,WAAK,2BAA2B,+CAA+C;AACjF,UAAM,SAAS,OAAO,UAAU,gBAAgB;AAChD,QACE,CAAC,UACD,CAAC;AAAA,MACC,IAAI,YAAY,EAAE,OAAO,MAAM;AAAA,MAC/B,IAAI,YAAY,EAAE,OAAO,YAAYC,YAAW,QAAQ,EAAE,OAAO,SAAS,IAAI,EAAE,OAAO,QAAQ,CAAC,GAAG;AAAA,IACrG;AAEA,WAAK,2BAA2B,gDAAgD;AAClF,UAAM,YAAY,OAAO,UAAU,cAAc;AACjD,QAAI,CAAC,UAAW,MAAK,+BAA+B,uCAAuC;AAC3F,UAAM,aAAa,6BAA6B;AAAA,MAC9C,SAAS;AAAA,MACT;AAAA,MACA;AAAA,MACA,SAAS;AAAA,MACT,OAAO,UAAU,UAAU;AAAA,MAC3B,OAAO,UAAU,aAAa;AAAA,MAC9B,OAAO,UAAU,sBAAsB;AAAA,MACvC,OAAO,UAAU,eAAe;AAAA,IAClC;AACA,UAAM,WAAW,WAAW,IAAI,CAAC,SAAS,GAAG,KAAK,IAAI,GAAG,KAAK,eAAe,SAAS,EAAE,EAAE;AAC1F,QAAI,SAAS,WAAW,OAAO,YAAY,UAAU,SAAS,KAAK,CAAC,MAAM,MAAM,SAAS,OAAO,YAAY,CAAC,CAAC;AAC5G,WAAK,+BAA+B,oEAAoE;AAC1G,QAAI,OAAO,YAAY,KAAK,CAAC,OAAO,GAAG,SAAS,MAAM,CAAC,KAAK,CAAC,SAAS;AACpE,WAAK,+BAA+B,wCAAwC;AAC9E,UAAM,MAAM,KAAK,MAAM,KAAK,MAAM,IAAI,EAAE,QAAQ,IAAI,GAAI,IAAI,OAAO;AACnE,QAAI,CAAC,OAAO,SAAS,GAAG,KAAK,KAAK,IAAI,GAAG,IAAI,6BAA6B;AACxE,WAAK,yBAAyB,cAAc,OAAO,GAAG,CAAC,oBAAoB;AAE7E,QAAI,WAAW,MAAM,KAAK,KAAK,IAAI,OAAO;AAC1C,QAAI,MAAM,QAAQ,UAAU,OAAO,KAAK;AACxC,QAAI,CAAC,KAAK;AACR,cAAQ,KAAK,QAAQ,QAAQ,iDAAiD;AAAA,QAC5E,OAAO,OAAO;AAAA,QACd,SAAS;AAAA,MACX,CAAC;AACD,iBAAW,MAAM,KAAK,KAAK,QAAQ,OAAO;AAC1C,YAAM,QAAQ,UAAU,OAAO,KAAK;AAAA,IACtC;AACA,QAAI,SAAS,KAAK,KAAK,CAAC,cAAc,UAAU,MAAM,UAAa,UAAU,MAAM,EAAE;AACnF,WAAK,gBAAgB,sDAAsD;AAC7E,QAAI,CAAC,IAAK,MAAK,eAAe,SAAS,OAAO,KAAK,oBAAoB;AACvE,UAAM,iBAAiB,aAAa,SAAS;AAC7C,QAAI,gBAAgB,WAAW,GAAI,MAAK,uBAAuB,kDAAkD;AACjH,UAAM,IAAI,gBAAgB,IAAI,CAAC;AAC/B,UAAM,IAAI,gBAAgB,IAAI,CAAC;AAC/B,QAAI,CAAC,KAAK,CAAC,KAAK,EAAE,WAAW,MAAM,EAAE,WAAW;AAC9C,WAAK,gBAAgB,4DAA4D;AACnF,QAAI;AACJ,UAAM,OAAO,IAAI;AACjB,UAAM,OAAO,IAAI;AACjB,QAAI,CAAC,QAAQ,CAAC,KAAM,MAAK,gBAAgB,4CAA4C;AACrF,QAAI;AACF,kBAAY,MAAM,WAAW,OAAO,OAAO;AAAA,QACzC;AAAA,QACA,EAAE,KAAK,MAAM,KAAK,SAAS,GAAG,MAAM,GAAG,MAAM,KAAK,KAAK;AAAA,QACvD,EAAE,MAAM,SAAS,YAAY,QAAQ;AAAA,QACrC;AAAA,QACA,CAAC,QAAQ;AAAA,MACX;AAAA,IACF,QAAQ;AACN,WAAK,gBAAgB,wDAAwD;AAAA,IAC/E;AACA,UAAM,OAAO,6BAA6B,MAAM,YAAY,OAAO,SAAS,OAAO,KAAK;AACxF,QAAI;AACF,UACE,CAAE,MAAM,WAAW,OAAO,OAAO;AAAA,QAC/B,EAAE,MAAM,SAAS,MAAM,UAAU;AAAA,QACjC;AAAA,QACA,cAAc,cAAc;AAAA,QAC5B,cAAc,IAAI;AAAA,MACpB;AAEA,aAAK,qBAAqB,sDAAsD;AAAA,IACpF,SAAS,OAAO;AACd,UAAI,iBAAiB,0BAA2B,OAAM;AACtD,WAAK,qBAAqB,4DAA4D;AAAA,IACxF;AAAA,EACF;AACF;AAEA,SAAS,OAAO,UAA8B,MAAkC;AAC9E,aAAW,OAAO,OAAO,KAAK,SAAS,OAAO;AAC5C,QAAI,IAAI,YAAY,MAAM,KAAK,YAAY,EAAG,QAAO,SAAS,QAAQ,GAAG;AAC3E,SAAO;AACT;AACA,SAAS,QAAQ,UAAyB,OAAuC;AAC/E,SAAO,SAAS,KAAK,KAAK,CAAC,QAAQ,IAAI,QAAQ,SAAS,IAAI,KAAK,IAAI,CAAC;AACxE;AACA,SAAS,aAAa,OAAuC;AAC3D,QAAM,QAAQ,kCAAkC,KAAK,KAAK;AAC1D,MAAI,CAAC,MAAO,QAAO;AACnB,QAAM,UAAU,MAAM,CAAC;AACvB,MAAI,YAAY,OAAW,QAAO;AAClC,MAAI;AACF,UAAM,QAAQ,OAAO,KAAK,SAAS,QAAQ;AAC3C,WAAO,MAAM,SAAS,QAAQ,MAAM,UAAU,IAAI,WAAW,KAAK,IAAI;AAAA,EACxE,QAAQ;AACN,WAAO;AAAA,EACT;AACF;AACA,SAAS,KAAK,QAAqC,QAAuB;AACxE,QAAM,IAAI,0BAA0B,QAAQ,MAAM;AACpD;;;AO9HO,IAAM,iBAAiB;AAAA,EAC5B,EAAE,QAAQ,OAAO,UAAU,eAAe,SAAS,WAAW;AAAA,EAC9D,EAAE,QAAQ,OAAO,UAAU,eAAe,SAAS,WAAW;AAAA,EAC9D,EAAE,QAAQ,OAAO,UAAU,0BAA0B,SAAS,WAAW;AAAA,EACzE,EAAE,QAAQ,OAAO,UAAU,6CAA6C,SAAS,WAAW;AAAA,EAC5F;AAAA,IACE,QAAQ;AAAA,IACR,UAAU;AAAA,IACV,SAAS;AAAA,EACX;AAAA,EACA,EAAE,QAAQ,OAAO,UAAU,gEAAgE,SAAS,WAAW;AAAA,EAC/G;AAAA,IACE,QAAQ;AAAA,IACR,UAAU;AAAA,IACV,SAAS;AAAA,EACX;AAAA,EACA,EAAE,QAAQ,QAAQ,UAAU,iCAAiC,SAAS,gBAAgB;AAAA,EACtF,EAAE,QAAQ,OAAO,UAAU,4BAA4B,SAAS,WAAW;AAAA,EAC3E,EAAE,QAAQ,OAAO,UAAU,gCAAgC,SAAS,WAAW;AAAA,EAC/E,EAAE,QAAQ,OAAO,UAAU,6CAA6C,SAAS,WAAW;AAAA,EAC5F,EAAE,QAAQ,QAAQ,UAAU,oDAAoD,SAAS,wBAAwB;AAAA,EACjH;AAAA,IACE,QAAQ;AAAA,IACR,UAAU;AAAA,IACV,SAAS;AAAA,EACX;AAAA,EACA,EAAE,QAAQ,QAAQ,UAAU,6BAA6B,SAAS,wBAAwB;AAAA,EAC1F,EAAE,QAAQ,OAAO,UAAU,iCAAiC;AAAA,EAC5D,EAAE,QAAQ,QAAQ,UAAU,sCAAsC;AAAA,EAClE,EAAE,QAAQ,QAAQ,UAAU,uCAAuC;AAAA,EACnE,EAAE,QAAQ,OAAO,UAAU,wCAAwC;AAAA,EACnE,EAAE,QAAQ,OAAO,UAAU,yCAAyC;AACtE;;;AClDA,SAAS,mBAAmB;AAUrB,IAAM,qBAAN,MAAiD;AAAA;AAAA,EAEtD,SAAiB;AACf,WAAO,gBAAgB,YAAY,EAAE,CAAC;AAAA,EACxC;AACF;;;ACZO,IAAM,yBAAN,cAAqC,kBAAkB;AAAA,EACnD;AAAA,EAET,YAAY,OAAe;AACzB,UAAM,gDAAgD,KAAK,YAAY;AACvE,SAAK,QAAQ;AAAA,EACf;AACF;;;ACPO,IAAM,qCAAN,cAAiD,kBAAkB;AAAA,EACxE,cAAc;AACZ,UAAM,oDAAoD;AAAA,EAC5D;AACF;;;ApB0BO,IAAM,mBAAN,MAAuB;AAAA;AAAA,EAW5B,YAA6B,UAA4B;AAA5B;AAC3B,QAAI,SAAS,WAAW,OAAW,MAAK,gBAAgB,IAAI,qBAAqB,SAAS,MAAM;AAChG,SAAK,WAAW,IAAI,wBAAwB,SAAS,WAAW,QAAW,SAAS,MAAM;AAC1F,SAAK,eAAe,SAAS,gBAAgB,IAAI,mBAAmB;AAAA,EACtE;AAAA,EAJ6B;AAAA;AAAA,EAT7B,IAAI,aAAqB;AACvB,WAAO,KAAK,SAAS;AAAA,EACvB;AAAA,EAEiB;AAAA,EACA;AAAA,EACA;AAAA;AAAA,EAUjB,MAAM,KAAK,SAS2C;AACpD,WAAO,aAAa,iBAAiB,QAAQ,KAAK,IAAI,OAAO,SAAS;AACpE,YAAM,UAAU,YAAY,IAAI;AAChC,YAAM,QAAQ,gBAAgB,QAAQ,QAAQ,KAAK,SAAS,SAAS;AACrE,YAAM,aAAa;AAAA,QACjB,eAAe,KAAK,SAAS;AAAA,QAC7B,cAAc,QAAQ;AAAA,QACtB,uBAAuB,QAAQ;AAAA,MACjC;AACA,eAAS,MAAM,CAAC,WAAW,OAAO,cAAc,UAAU,CAAC;AAC3D,YAAM,cAAc,QAAQ;AAC5B,UAAI,gBAAgB,OAAW,UAAS,MAAM,CAAC,WAAW,OAAO,aAAa,qBAAqB,WAAW,CAAC;AAC/G,UAAI;AACF,cAAM,QAAQ,eAAe;AAAA,UAC3B,CAAC,UAAU,MAAM,aAAa,QAAQ,SAAS,MAAM,WAAW,QAAQ;AAAA,QAC1E;AACA,YAAI,UAAU,QAAW;AACvB,mBAAS,MAAM,CAAC,WAAW,OAAO,UAAU,EAAE,MAAM,eAAe,OAAO,SAAS,gBAAgB,CAAC,CAAC;AACrG,gBAAM,IAAI,oBAAoB,IAAI,MAAM,0CAA0C,CAAC;AAAA,QACrF;AACA,cAAM,eAAe,aAAa,QAAQ,MAAM,UAAU;AAC1D,YAAI,QAAQ,YAAY,UAAa,QAAQ,YAAY,cAAc;AACrE;AAAA,YAAS;AAAA,YAAM,CAAC,WACd,OAAO,UAAU,EAAE,MAAM,eAAe,OAAO,SAAS,yBAAyB,CAAC;AAAA,UACpF;AACA,gBAAM,IAAI,oBAAoB,IAAI,MAAM,2DAA2D,CAAC;AAAA,QACtG;AACA,cAAM,UAAU;AAChB,YAAI;AACJ,YAAI;AACF,gBAAM,IAAI,IAAI,QAAQ,MAAM,KAAK,SAAS,SAAS;AAAA,QACrD,SAAS,OAAO;AACd,gBAAM,IAAI,oBAAoB,KAAK;AAAA,QACrC;AACA,cAAM,OAAO,QAAQ,QAAQ,IAAI,WAAW;AAC5C,cAAM,UAAU,IAAI,QAAQ;AAC5B,gBAAQ,IAAI,mBAAmB,UAAU;AACzC,YAAI,KAAK,SAAS,eAAgB,SAAQ,IAAI,mBAAmB,KAAK,SAAS,cAAc;AAC7F,YAAI,QAAQ,oBAAoB;AAC9B,kBAAQ,IAAI,iBAAiB,cAAc,QAAQ,eAAe,EAAE;AACtE,YAAI,KAAK,SAAS,EAAG,SAAQ,IAAI,gBAAgB,kBAAkB;AACnE,YAAI;AACJ,YAAI,YAAY,QAAW;AACzB,cAAI,KAAK,kBAAkB,UAAa,KAAK,SAAS,WAAW;AAC/D,kBAAM,IAAI,oBAAoB,IAAI,MAAM,8CAA8C,CAAC;AACzF,gBAAM,MAAM,oBAAI,KAAK;AACrB,gBAAM,aAAa,YAAY,aAAa,SAAY,KAAK,aAAa,OAAO;AACjF,gBAAM,SAAS,YAAY,aAAa,SAAY,gBAAgB,IAAI;AACxE,gBAAM,aAAa,YAAY,IAAI;AACnC,cAAI;AACJ,cAAI;AACF,qBAAS,MAAM,KAAK,cAAc;AAAA,cAChC;AAAA,cACA;AAAA,gBACE,QAAQ,QAAQ;AAAA,gBAChB,WAAW,IAAI;AAAA,gBACf,MAAM,IAAI;AAAA,gBACV,gBAAgB,IAAI,OAAO,MAAM,CAAC;AAAA,gBAClC,UAAU,IAAI,YAAY,EAAE,QAAQ,aAAa,GAAG;AAAA,gBACpD,GAAI,WAAW,SAAY,CAAC,IAAI,EAAE,eAAe,OAAO;AAAA,gBACxD,GAAI,eAAe,SAAY,CAAC,IAAI,EAAE,OAAO,WAAW;AAAA,gBACxD,GAAI,QAAQ,gBAAgB,SAAY,CAAC,IAAI,EAAE,gBAAgB,QAAQ,YAAY;AAAA,cACrF;AAAA,cACA,KAAK,MAAM,IAAI,QAAQ,IAAI,GAAI;AAAA,cAC/B,KAAK,MAAM,IAAI,QAAQ,IAAI,GAAI,IAAI,KAAK,SAAS;AAAA,YACnD;AACA,mCAAuB,OAAO;AAAA,UAChC,SAAS,OAAO;AACd,kBAAM,QAAQ,iBAAiB,sBAAsB,QAAQ,IAAI,oBAAoB,KAAK;AAC1F;AAAA,cACE,KAAK,SAAS;AAAA,cACd;AAAA,cACA,kCAAkC,QAAQ,MAAM,WAAW,QAAQ,KAAK;AAAA,cACxE;AAAA,gBACE,SAAS;AAAA,gBACT,QAAQ,QAAQ;AAAA,gBAChB,OAAO,QAAQ;AAAA,gBACf,QAAQ;AAAA,cACV;AAAA,YACF;AACA;AAAA,cACE;AAAA,cACA,YAAY,IAAI,IAAI;AAAA,cACpB;AAAA,gBACE,GAAG;AAAA,gBACH,cAAc;AAAA,cAChB;AAAA,cACA,EAAE,MAAM,KAAK;AAAA,YACf;AACA,qBAAS,MAAM,CAAC,WAAW,OAAO,UAAU,EAAE,MAAM,eAAe,OAAO,SAAS,UAAU,CAAC,CAAC;AAC/F,qBAAS,MAAM,CAAC,WAAW,OAAO,aAAa,cAAc,SAAS,CAAC;AACvE,kBAAM;AAAA,UACR;AACA;AAAA,YACE;AAAA,YACA,YAAY,IAAI,IAAI;AAAA,YACpB;AAAA,cACE,0BAA0B;AAAA,YAC5B;AAAA,YACA,EAAE,MAAM,KAAK;AAAA,UACf;AACA;AAAA,YACE,KAAK,SAAS;AAAA,YACd;AAAA,YACA,0BAA0B,QAAQ,MAAM,WAAW,QAAQ,KAAK,aAAa,OAAO;AAAA,YACpF;AAAA,cACE,SAAS;AAAA,cACT,QAAQ,QAAQ;AAAA,cAChB,OAAO,QAAQ;AAAA,cACf;AAAA,cACA,OAAO,KAAK,SAAS,OAAO;AAAA,YAC9B;AAAA,UACF;AACA,kBAAQ,IAAI,eAAe,OAAO,QAAQ;AAC1C,cAAI,OAAO,kBAAkB,OAAW,SAAQ,IAAI,kBAAkB,OAAO,aAAa;AAC1F,cAAI,OAAO,UAAU,OAAW,SAAQ,IAAI,SAAS,OAAO,KAAK;AACjE,kBAAQ,IAAI,mBAAmB,OAAO,cAAc;AACpD,kBAAQ,IAAI,aAAa,OAAO,SAAS;AAAA,QAC3C;AACA,cAAM,SAAS,MAAM;AACrB,YAAI,yBAAyB,OAAW,SAAQ,IAAI,mBAAmB,oBAAoB;AAC3F,YAAI;AACJ,YAAI;AACF,gBAAM,mBAAmB,MAAM,KAAK,SAAS,QAAQ,KAAK;AAAA,YACxD,QAAQ,QAAQ;AAAA,YAChB;AAAA,YACA,GAAI,KAAK,WAAW,IAAI,CAAC,IAAI,EAAE,MAAM,OAAO,KAAK,IAAI,EAAE;AAAA,YACvD;AAAA,YACA,UAAU;AAAA,UACZ,CAAC;AACD,qBAAW;AACX,gBAAM,kBAAkB,iBAAiB,QAAQ,IAAI,kBAAkB;AACvE,cAAI,oBAAoB,QAAQ,gBAAgB,YAAY,MAAM,YAAY;AAC5E,kBAAM,WAAW,gBAAgB;AACjC,wBAAY,gDAAgD;AAAA,cAC1D,6BAA6B;AAAA,YAC/B,CAAC;AACD,oBAAQ,KAAK,SAAS,QAAQ,SAAS,wDAAwD;AAAA,cAC7F,SAAS;AAAA,cACT,SAAS;AAAA,YACX,CAAC;AACD,kBAAM,IAAI;AAAA,cACR;AAAA,cACA;AAAA,YACF;AAAA,UACF;AACA,gBAAM,eAAe,IAAI,WAAW,MAAM,iBAAiB,YAAY,CAAC;AACxE,gBAAM,gBAAwC,CAAC;AAC/C,2BAAiB,QAAQ,QAAQ,CAAC,OAAO,SAAS;AAChD,0BAAc,IAAI,IAAI;AAAA,UACxB,CAAC;AACD,cAAI;AACF,kBAAM,wBAAwB,QAAQ,IAAI,iBAAiB;AAC3D,kBAAM,KAAK,SAAS;AAAA,cAClB;AAAA,gBACE,QAAQ,iBAAiB;AAAA,gBACzB,SAAS;AAAA,gBACT,MAAM;AAAA,gBACN,GAAI,0BAA0B,OAAO,CAAC,IAAI,EAAE,sBAAsB;AAAA,cACpE;AAAA,cACA,EAAE,OAAO;AAAA,YACX;AAAA,UACF,SAAS,OAAO;AACd,gBAAI,iBAAiB;AACnB,0BAAY,gDAAgD;AAAA,gBAC1D,6BAA6B,MAAM;AAAA,cACrC,CAAC;AACH,qBAAS,MAAM,CAAC,WAAW,OAAO,UAAU,EAAE,MAAM,eAAe,OAAO,SAAS,eAAe,CAAC,CAAC;AACpG,gBAAI,iBAAiB;AACnB,sBAAQ,KAAK,SAAS,QAAQ,SAAS,+BAA+B,MAAM,OAAO,KAAK;AAAA,gBACtF,SAAS;AAAA,gBACT,SAAS,MAAM;AAAA,cACjB,CAAC;AACH,kBAAM;AAAA,UACR;AACA,mBAAS,MAAM,CAAC,WAAW,OAAO,aAAa,6BAA6B,iBAAiB,MAAM,CAAC;AACpG,gBAAM,YAAY,iBAAiB,QAAQ,IAAI,cAAc;AAC7D,cAAI,cAAc,KAAM,UAAS,MAAM,CAAC,WAAW,OAAO,aAAa,mBAAmB,SAAS,CAAC;AACpG,gBAAM,YAAY,YAAY,IAAI,IAAI;AACtC;AAAA,YACE,KAAK,SAAS;AAAA,YACd;AAAA,YACA,6BAA6B,QAAQ,MAAM,WAAW,QAAQ,KAAK,YAAY,OAAO,iBAAiB,MAAM,CAAC,eAAe,aAAa,MAAM,eAAe,OAAO,SAAS,CAAC;AAAA,YAChL;AAAA,cACE,SAAS;AAAA,cACT,QAAQ,QAAQ;AAAA,cAChB,OAAO,QAAQ;AAAA,cACf,YAAY,iBAAiB;AAAA,cAC7B;AAAA,cACA;AAAA,YACF;AAAA,UACF;AACA,cAAI,CAAC,iBAAiB,IAAI;AACxB,kBAAM,UAAU,mBAAmB,cAAc,iBAAiB,QAAQ,iBAAiB,OAAO;AAClG,qBAAS,MAAM,CAAC,WAAW,OAAO,aAAa,mBAAmB,QAAQ,WAAW,QAAQ,IAAI,CAAC;AAClG;AAAA,cACE;AAAA,cACA,YAAY,IAAI,IAAI;AAAA,cACpB;AAAA,gBACE,GAAG;AAAA,gBACH,6BAA6B,iBAAiB;AAAA,gBAC9C,mBAAmB,QAAQ,WAAW,QAAQ;AAAA,cAChD;AAAA,cACA,EAAE,MAAM,KAAK;AAAA,YACf;AACA;AAAA,cACE,KAAK,SAAS;AAAA,cACd;AAAA,cACA,2BAA2B,QAAQ,MAAM,WAAW,QAAQ,KAAK,YAAY,OAAO,iBAAiB,MAAM,CAAC,UAAU,QAAQ,WAAW,QAAQ,IAAI,eAAe,QAAQ,aAAa,MAAM,eAAe,OAAO,QAAQ,WAAW,CAAC,cAAc,OAAO,QAAQ,UAAU,CAAC;AAAA,cACjR;AAAA,gBACE,SAAS;AAAA,gBACT,QAAQ,QAAQ;AAAA,gBAChB,OAAO,QAAQ;AAAA,gBACf,MAAM,QAAQ,WAAW,QAAQ;AAAA,gBACjC,YAAY,iBAAiB;AAAA,gBAC7B,WAAW,QAAQ;AAAA,gBACnB,WAAW,QAAQ;AAAA,gBACnB,UAAU,QAAQ;AAAA,cACpB;AAAA,YACF;AACA,kBAAM;AAAA,UACR;AACA;AAAA,YACE;AAAA,YACA,YAAY,IAAI,IAAI;AAAA,YACpB;AAAA,cACE,GAAG;AAAA,cACH,6BAA6B,iBAAiB;AAAA,YAChD;AAAA,YACA,EAAE,MAAM,KAAK;AAAA,UACf;AACA,iBAAO,EAAE,UAAU,kBAAkB,MAAM,aAAa;AAAA,QAC1D,SAAS,OAAO;AACd,cAAI,aAAa,OAAW,OAAM,WAAW,QAAQ;AACrD,cAAI,iBAAiB,cAAc;AACjC,qBAAS,MAAM,CAAC,WAAW,OAAO,aAAa,mBAAmB,MAAM,WAAW,MAAM,IAAI,CAAC;AAC9F;AAAA,cAAS;AAAA,cAAM,CAAC,WACd,OAAO,UAAU,EAAE,MAAM,eAAe,OAAO,SAAS,MAAM,WAAW,MAAM,KAAK,CAAC;AAAA,YACvF;AACA,kBAAM;AAAA,UACR;AACA,gBAAM,SACJ,iBAAiB,4BACb,iBACA,iBAAiB,qCACf,eACA,QAAQ,QAAQ,UACd,aACA,OAAO,UACL,YACA,iBAAiB,YACf,eACA;AACd,mBAAS,MAAM,CAAC,WAAW,OAAO,UAAU,EAAE,MAAM,eAAe,OAAO,SAAS,OAAO,CAAC,CAAC;AAC5F,mBAAS,MAAM,CAAC,WAAW,OAAO,aAAa,cAAc,MAAM,CAAC;AACpE;AAAA,YACE;AAAA,YACA,YAAY,IAAI,IAAI;AAAA,YACpB;AAAA,cACE,GAAG;AAAA,cACH,cAAc;AAAA,YAChB;AAAA,YACA,EAAE,MAAM,KAAK;AAAA,UACf;AACA;AAAA,YACE,KAAK,SAAS;AAAA,YACd;AAAA,YACA,4BAA4B,QAAQ,MAAM,WAAW,QAAQ,KAAK,YAAY,MAAM;AAAA,YACpF;AAAA,cACE,SAAS;AAAA,cACT,QAAQ,QAAQ;AAAA,cAChB,OAAO,QAAQ;AAAA,cACf,WAAW,YAAY,IAAI,IAAI;AAAA,cAC/B;AAAA,YACF;AAAA,UACF;AACA,gBAAM;AAAA,QACR;AAAA,MACF,UAAE;AACA,cAAM,QAAQ;AACd,iBAAS,MAAM,CAAC,WAAW;AACzB,iBAAO,IAAI;AAAA,QACb,CAAC;AAAA,MACH;AAAA,IACF,CAAC;AAAA,EACH;AAAA;AAAA,EAGA,MAAM,KAAQ,SAAkD,OAA0C;AACxG,UAAM,SAAS,MAAM,KAAK,KAAK,OAAO;AACtC,QAAI,OAAO,KAAK,WAAW;AACzB,YAAM,IAAI;AAAA,QACR,EAAE,QAAQ,OAAO,SAAS,QAAQ,MAAM,kBAAkB,OAAO,aAAa;AAAA,QAC9E,OAAO,SAAS;AAAA,MAClB;AACF,QAAI;AACF,YAAM,UAAmB,KAAK,MAAM,IAAI,YAAY,EAAE,OAAO,OAAO,IAAI,CAAC;AACzE,UAAI,YAAY,KAAM,OAAM,IAAI,uBAAuB,aAAa;AACpE,aAAO,MAAM,OAAO;AAAA,IACtB,SAAS,OAAO;AACd,UAAI,iBAAiB,uBAAwB,OAAM;AACnD,UAAI,iBAAiB,aAAc,OAAM;AACzC,YAAM,IAAI,uBAAuB,gBAAgB;AAAA,IACnD;AAAA,EACF;AAAA;AAAA,EAGA,mBAAmB,aAAqB,SAAiB,QAAuB;AAC9E,UAAM,UACJ,YAAY,YACR,sCAAsC,WAAW,YAAY,UAAU,aAAa,0BACpF,iBAAiB,OAAO,iBAAiB,WAAW;AAC1D,YAAQ,KAAK,SAAS,QAAQ,YAAY,YAAY,SAAS,QAAQ,SAAS;AAAA,MAC9E,SAAS,YAAY,YAAY,OAAO;AAAA,MACxC;AAAA,MACA;AAAA,MACA,GAAI,WAAW,SAAY,CAAC,IAAI,EAAE,OAAO;AAAA,IAC3C,CAAC;AAAA,EACH;AACF;AAEA,SAAS,gBAAgB,QAAiC,WAA6D;AACrH,QAAM,aAAa,IAAI,gBAAgB;AACvC,QAAM,kBAAkB,MAAM;AAC5B,eAAW,MAAM,QAAQ,MAAM;AAAA,EACjC;AACA,UAAQ,iBAAiB,SAAS,iBAAiB,EAAE,MAAM,KAAK,CAAC;AACjE,MAAI,QAAQ,QAAS,iBAAgB;AACrC,QAAM,QAAQ,WAAW,MAAM;AAC7B,eAAW,MAAM,IAAI,aAAa,4BAA4B,cAAc,CAAC;AAAA,EAC/E,GAAG,SAAS;AACZ,SAAO;AAAA,IACL,QAAQ,WAAW;AAAA,IACnB,UAAU;AACR,mBAAa,KAAK;AAClB,cAAQ,oBAAoB,SAAS,eAAe;AAAA,IACtD;AAAA,EACF;AACF;AAEA,eAAe,WAAW,UAAmC;AAC3D,MAAI;AACF,UAAM,SAAS,MAAM,OAAO;AAAA,EAC9B,QAAQ;AAAA,EAER;AACF;;;AqB3XO,SAAS,sBAAsB,SAAgD;AACpF,QAAM,YAAY,IAAI,IAAI,QAAQ,SAAS;AAC3C,QAAM,WAAW,UAAU,SAAS,YAAY,EAAE,QAAQ,YAAY,EAAE;AACxE,QAAM,WAAW,aAAa,eAAe,aAAa,eAAe,aAAa;AACtF,MAAI,UAAU,aAAa,YAAY,EAAE,UAAU,aAAa,WAAW;AACzE,UAAM,IAAI;AAAA,MACR;AAAA,IACF;AACF,MAAI,UAAU,aAAa,OAAO,UAAU,UAAU,UAAU;AAC9D,UAAM,IAAI,UAAU,wDAAwD;AAC9E,QAAM,2BAA2B,QAAQ,4BAA4B;AACrE,QAAM,yBAAyB,QAAQ,0BAA0B;AACjE,QAAM,YAAY,QAAQ,aAAa;AACvC,MAAI,CAAC,OAAO,UAAU,wBAAwB,KAAK,2BAA2B,KAAK,2BAA2B;AAC5G,UAAM,IAAI;AAAA,MACR;AAAA,IACF;AACF,MAAI,CAAC,OAAO,SAAS,sBAAsB,KAAK,0BAA0B;AACxE,UAAM,IAAI,WAAW,mDAAmD;AAC1E,MAAI,CAAC,OAAO,UAAU,SAAS,KAAK,YAAY,KAAK,YAAY;AAC/D,UAAM,IAAI,WAAW,yDAAyD;AAChF,QAAM,iBAA2B,QAAyC;AAC1E,MAAI,mBAAmB,UAAa,mBAAmB,QAAQ,mBAAmB;AAChF,UAAM,IAAI,UAAU,6CAA6C;AACnE,SAAO;AAAA,IACL;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA,MAAM,QAAQ,QAAQ;AAAA,IACtB,GAAI,mBAAmB,SAAY,CAAC,IAAI,EAAE,eAAe;AAAA,EAC3D;AACF;;;AC3DA,SAAS,cAAAC,mBAAkB;;;ACwBpB,SAAS,mBAAmB,MAA6B;AAC9D,QAAM,QAAiB,KAAK,MAAM,IAAI;AACtC,MAAI,OAAO,UAAU,YAAY,UAAU,QAAQ,EAAE,UAAU,UAAU,CAAC,MAAM,QAAQ,MAAM,IAAI;AAChG,UAAM,IAAI,UAAU,qDAAqD;AAC3E,SAAO,EAAE,MAAM,MAAM,KAAK,IAAI,eAAe,EAAE;AACjD;AAGA,IAAM,mBAA+C,CAAC,OAAO,OAAO,KAAK,KAAK,OAAO,OAAO,OAAO,GAAG;AAEtG,SAAS,gBAAgB,OAA4B;AACnD,MAAI,OAAO,UAAU,YAAY,UAAU,QAAQ,MAAM,QAAQ,KAAK;AACpE,UAAM,IAAI,UAAU,0CAA0C;AAChE,QAAM,SAAS;AACf,QAAM,SAAmD,CAAC;AAC1D,aAAW,UAAU,kBAAkB;AACrC,UAAM,QAAQ,OAAO,MAAM;AAC3B,QAAI,WAAW,OAAO,UAAU,KAAM;AACtC,QAAI,UAAU,OAAW;AACzB,QAAI,OAAO,UAAU,SAAU,OAAM,IAAI,UAAU,2BAA2B,MAAM,qBAAqB;AACzG,WAAO,MAAM,IAAI;AAAA,EACnB;AACA,SAAO;AACT;;;ADPO,IAAM,uBAAN,MAAuD;AAAA,EAC3C;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACT;AAAA,EACA;AAAA;AAAA,EAGR,YAAY,SAAsC;AAChD,SAAK,YAAY,IAAI,IAAI,QAAQ,SAAS;AAC1C,SAAK,eAAe,QAAQ,gBAAgB;AAC5C,QAAI,CAAC,OAAO,SAAS,KAAK,YAAY,KAAK,KAAK,eAAe;AAC7D,YAAM,IAAI,WAAW,qCAAqC;AAC5D,SAAK,UAAU,QAAQ,SAAS,WAAW;AAC3C,QAAI,QAAQ,kBAAkB,OAAW,MAAK,QAAQ,QAAQ;AAC9D,QAAI,QAAQ,WAAW,OAAW,MAAK,SAAS,QAAQ;AAAA,EAC1D;AAAA;AAAA,EAGA,MAAM,IAAI,SAA4D;AACpE,mBAAe,SAAS,MAAM;AAC9B,QAAI,KAAK,UAAU,KAAK,OAAO,QAAQ,YAAY,IAAI,EAAG,QAAO,KAAK,OAAO;AAC7E,QAAI,KAAK,SAAU,QAAO,KAAK,cAAc,KAAK,UAAU,SAAS,MAAM;AAC3E,UAAM,SAAS,KAAK,SAAS,YAAY;AACzC,WAAO,KAAK,cAAc,QAAQ,SAAS,MAAM;AAAA,EACnD;AAAA;AAAA,EAGA,MAAM,QAAQ,SAA4D;AACxE,mBAAe,SAAS,MAAM;AAC9B,WAAO,KAAK,cAAc,WAAW,SAAS,MAAM;AAAA,EACtD;AAAA,EAEQ,cAAc,QAA6C,QAA8C;AAC/G,QAAI,KAAK,SAAU,QAAO,KAAK,cAAc,KAAK,UAAU,MAAM;AAClE,UAAM,aAAa,IAAI,gBAAgB;AACvC,UAAM,UAAU,KAAK,cAAc,QAAQ,WAAW,MAAM,EAAE,QAAQ,MAAM;AAC1E,UAAI,KAAK,UAAU,eAAe,WAAY,MAAK,WAAW;AAAA,IAChE,CAAC;AACD,UAAM,SAAS,EAAE,YAAY,SAAS,GAAG,QAAQ;AACjD,SAAK,WAAW;AAChB,WAAO,KAAK,cAAc,QAAQ,MAAM;AAAA,EAC1C;AAAA,EAEQ,cACN,QACA,QACwB;AACxB,WAAO,WAAW;AAClB,WAAO,IAAI,QAAQ,CAACC,UAAS,WAAW;AACtC,UAAI,WAAW;AACf,YAAM,UAAU,MAAM;AACpB,YAAI,SAAU;AACd,mBAAW;AACX,gBAAQ,oBAAoB,SAAS,KAAK;AAC1C,eAAO,WAAW;AAAA,MACpB;AACA,YAAM,QAAQ,MAAM;AAClB,gBAAQ;AACR,YAAI,OAAO,YAAY,GAAG;AACxB,cAAI,KAAK,UAAU,eAAe,OAAO,WAAY,MAAK,WAAW;AACrE,iBAAO,WAAW,MAAM,QAAQ,MAAM;AAAA,QACxC;AACA,eAAO,YAAY,MAAM,CAAC;AAAA,MAC5B;AACA,UAAI,QAAQ,SAAS;AACnB,cAAM;AACN;AAAA,MACF;AACA,cAAQ,iBAAiB,SAAS,OAAO,EAAE,MAAM,KAAK,CAAC;AACvD,aAAO,QAAQ;AAAA,QACb,CAAC,aAAa;AACZ,kBAAQ;AACR,UAAAA,SAAQ,QAAQ;AAAA,QAClB;AAAA,QACA,CAAC,UAAmB;AAClB,kBAAQ;AACR,iBAAO,iBAAiB,QAAQ,QAAQ,IAAI,MAAM,mCAAmC,EAAE,OAAO,MAAM,CAAC,CAAC;AAAA,QACxG;AAAA,MACF;AAAA,IACF,CAAC;AAAA,EACH;AAAA,EAEA,MAAc,cACZ,QACA,QACwB;AACxB,UAAM,sBAAsB,KAAK,UAAU,SAAS,EAAE,YAAY,EAAE,QAAQ,QAAQ,EAAE;AACtF,UAAM,WAAW,sBAAsBC,YAAW,QAAQ,EAAE,OAAO,mBAAmB,EAAE,OAAO,KAAK,EAAE,MAAM,GAAG,EAAE,CAAC;AAClH,QAAI,WAAW,eAAe,KAAK,OAAO;AACxC,YAAM,SAAS,MAAM,YAAY,MAAM,KAAK,OAAO,IAAI,QAAQ,KAAK,QAAQ,QAAQ,MAAS,GAAG,MAAM;AACtG,qBAAe,MAAM;AACrB,YAAM,SAAS,OAAO,KAAK,OAAO,QAAQ;AAC1C,UAAI,WAAW,QAAW;AACxB,YAAI;AACF,gBAAM,WAAoB,KAAK,MAAM,MAAM;AAC3C,cAAI,gBAAgB,QAAQ,GAAG;AAC7B,kBAAM,aAAa,KAAK,IAAI,IAAI;AAChC,kBAAM,eAAe,SAAS,YAAY,KAAK,eAAe,cAAc;AAC5E,gBAAI,cAAc,KAAK,SAAS,aAAa,aAAa,IAAI;AAC5D,oBAAMC,YAAW,mBAAmB,SAAS,QAAQ;AACrD,mBAAK,SAAS,EAAE,UAAAA,WAAU,OAAO,YAAY,IAAI,IAAI,YAAY;AACjE,sBAAQ,KAAK,QAAQ,SAAS,2CAA2C,CAAC,CAAC;AAC3E,qBAAOA;AAAA,YACT;AAAA,UACF;AAAA,QACF,QAAQ;AAAA,QAER;AAAA,MACF;AAAA,IACF;AACA,UAAM,MAAM,IAAI,IAAI,0CAA0C,KAAK,SAAS;AAC5E,QAAI;AACJ,QAAI;AACF,iBAAW,MAAM,KAAK,QAAQ,KAAK;AAAA,QACjC,SAAS,EAAE,mBAAmB,WAAW;AAAA,QACzC,UAAU;AAAA,QACV;AAAA,MACF,CAAC;AAAA,IACH,QAAQ;AACN,UAAI,OAAO,QAAS,OAAM,YAAY,MAAM;AAC5C,YAAM,IAAI,mCAAmC;AAAA,IAC/C;AACA,QAAI,CAAC,SAAS,IAAI;AAChB,YAAMC,YAAW,QAAQ;AACzB,YAAM,IAAI,mCAAmC;AAAA,IAC/C;AACA,UAAM,kBAAkB,SAAS,QAAQ,IAAI,kBAAkB;AAC/D,QAAI,oBAAoB,QAAQ,gBAAgB,YAAY,MAAM,YAAY;AAC5E,YAAMA,YAAW,QAAQ;AACzB,YAAM,IAAI,mCAAmC;AAAA,IAC/C;AACA,QAAI;AACJ,QAAI;AACJ,QAAI;AACF,aAAO,MAAM,SAAS,KAAK;AAC3B,iBAAW,mBAAmB,IAAI;AAAA,IACpC,QAAQ;AACN,UAAI,OAAO,QAAS,OAAM,YAAY,MAAM;AAC5C,YAAM,IAAI,mCAAmC;AAAA,IAC/C;AACA,UAAM,YAAY,KAAK,MAAM,KAAK,IAAI,IAAI,GAAI;AAC9C,SAAK,SAAS,EAAE,UAAU,OAAO,YAAY,IAAI,IAAI,KAAK,eAAe,IAAK;AAC9E,QAAI,KAAK,UAAU,QAAW;AAC5B,YAAM,QAAQ,KAAK,UAAU,EAAE,WAAW,UAAU,KAAK,CAAC;AAC1D,YAAM,UAAU,MAAM;AAAA,QACpB,MAAM,KAAK,OAAO,IAAI,UAAU,OAAO,KAAK,YAAY,KAAK,QAAQ,QAAQ;AAAA,QAC7E;AAAA,MACF;AACA,UAAI,CAAC,QAAQ,GAAI,SAAQ,KAAK,QAAQ,QAAQ,yCAAyC,CAAC,CAAC;AAAA,IAC3F;AACA,YAAQ,KAAK,QAAQ,QAAQ,gCAAgC,MAAM,cAAc,OAAO,SAAS,KAAK,MAAM,CAAC,KAAK;AAAA,MAChH;AAAA,MACA,UAAU,SAAS,KAAK;AAAA,IAC1B,CAAC;AACD,gBAAY,sCAAsC,EAAE,qBAAqB,OAAO,CAAC;AACjF,WAAO;AAAA,EACT;AACF;AAEA,SAAS,gBAAgB,OAAkE;AACzF,MAAI,OAAO,UAAU,YAAY,UAAU,KAAM,QAAO;AACxD,QAAM,SAAS;AACf,SACE,OAAO,OAAO,cAAc,YAC5B,OAAO,cAAc,OAAO,SAAS,KACrC,OAAO,OAAO,aAAa;AAE/B;AAEA,SAAS,YACP,WACA,QACiD;AACjD,SAAO,IAAI,QAAQ,CAACH,aAAY;AAC9B,QAAI,UAAU;AACd,UAAM,SAAS,CAAC,WAAmD;AACjE,UAAI,QAAS;AACb,gBAAU;AACV,mBAAa,KAAK;AAClB,aAAO,oBAAoB,SAAS,OAAO;AAC3C,MAAAA,SAAQ,MAAM;AAAA,IAChB;AACA,UAAM,UAAU,MAAM;AACpB,aAAO,EAAE,IAAI,MAAM,CAAC;AAAA,IACtB;AACA,UAAM,QAAQ,WAAW,MAAM;AAC7B,aAAO,EAAE,IAAI,MAAM,CAAC;AAAA,IACtB,GAAG,GAAK;AACR,WAAO,iBAAiB,SAAS,SAAS,EAAE,MAAM,KAAK,CAAC;AACxD,YAAQ,QAAQ,EACb,KAAK,SAAS,EACd;AAAA,MACC,CAAC,UAAU;AACT,eAAO,EAAE,IAAI,MAAM,MAAM,CAAC;AAAA,MAC5B;AAAA,MACA,MAAM;AACJ,eAAO,EAAE,IAAI,MAAM,CAAC;AAAA,MACtB;AAAA,IACF;AAAA,EACJ,CAAC;AACH;AAEA,SAAS,eAAe,QAAuC;AAC7D,MAAI,QAAQ,QAAS,OAAM,YAAY,MAAM;AAC/C;AAEA,eAAeG,YAAW,UAAmC;AAC3D,MAAI;AACF,UAAM,SAAS,MAAM,OAAO;AAAA,EAC9B,QAAQ;AAAA,EAER;AACF;AAEA,SAAS,YAAY,QAAwC;AAC3D,SAAO,QAAQ,kBAAkB,QAAQ,OAAO,SAAS,IAAI,aAAa,8BAA8B,YAAY;AACtH;;;AEvNO,IAAM,6BAAN,cAAyC,kBAAkB;AAAA;AAAA,EAEvD;AAAA;AAAA,EAEA;AAAA;AAAA,EAET,YAAY,iBAAyB,kBAA2B;AAC9D;AAAA,MACE;AAAA,IACF;AACA,SAAK,kBAAkB;AACvB,QAAI,qBAAqB,OAAW,MAAK,mBAAmB;AAAA,EAC9D;AACF;AAGO,IAAM,uBAAN,MAAM,sBAAqB;AAAA,EACf;AAAA,EACA;AAAA,EACR;AAAA,EACD,YAAY,WAA6B,cAAsB,OAAe;AACpF,SAAK,YAAY;AACjB,SAAK,aAAa,cAAc,cAAc,cAAc;AAC5D,SAAK,SAAS;AAAA,EAChB;AAAA;AAAA,EAEA,OAAO,OAAO,OAA0D;AACtE,QAAI,MAAM,gBAAgB,KAAK,EAAE,WAAW,KAAK,qBAAqB,MAAM,eAAe;AACzF,YAAM,IAAI,UAAU,2EAA2E;AACjG,UAAM,UAAU,sBAAsB;AAAA,MACpC,WAAW,MAAM;AAAA,MACjB,GAAI,MAAM,2BAA2B,SAAY,CAAC,IAAI,EAAE,wBAAwB,MAAM,uBAAuB;AAAA,MAC7G,GAAI,MAAM,cAAc,SAAY,CAAC,IAAI,EAAE,WAAW,MAAM,UAAU;AAAA,IACxE,CAAyB;AACzB,UAAM,UAAU,MAAM,SAAS,WAAW;AAC1C,UAAM,YAAY,IAAI,qBAAqB;AAAA,MACzC,WAAW,QAAQ;AAAA,MACnB,cAAc,QAAQ;AAAA,MACtB,OAAO;AAAA,MACP,GAAI,MAAM,aAAa,SAAY,CAAC,IAAI,EAAE,eAAe,MAAM,SAAS;AAAA,MACxE,GAAI,MAAM,WAAW,SACjB,CAAC,IACD;AAAA,QACE,QAAQ;AAAA,UACN,MAAM,SAAiB,QAAiC;AACtD,oBAAQ,MAAM,QAAQ,SAAS,SAAS,MAAM;AAAA,UAChD;AAAA,UACA,KAAK,SAAiB,QAAiC;AACrD,oBAAQ,MAAM,QAAQ,QAAQ,SAAS,EAAE,GAAG,QAAQ,SAAS,KAAK,CAAC;AAAA,UACrE;AAAA,UACA,KAAK,SAAiB,QAAiC;AACrD,oBAAQ,MAAM,QAAQ,QAAQ,SAAS,MAAM;AAAA,UAC/C;AAAA,QACF;AAAA,MACF;AAAA,IACN,CAAC;AACD,UAAM,mBAAqC;AAAA,MACzC,GAAG;AAAA,MACH;AAAA,MACA;AAAA,MACA,GAAI,MAAM,WAAW,SAAY,CAAC,IAAI,EAAE,QAAQ,MAAM,OAAO;AAAA,IAC/D;AACA,WAAO,IAAI,sBAAqB,IAAI,iBAAU,gBAAgB,GAAG,MAAM,cAAc,MAAM,eAAe;AAAA,EAC5G;AAAA;AAAA,EAEA,MAAM,IAAI,SAA8D;AACtE,WAAO,KAAK,UAAU;AAAA,MACpB;AAAA,QACE,QAAQ;AAAA,QACR,OAAO;AAAA,QACP,MAAM,mBAAmB,KAAK,UAAU;AAAA,QACxC,iBAAiB,KAAK;AAAA,QACtB,GAAI,SAAS,WAAW,SAAY,CAAC,IAAI,EAAE,QAAQ,QAAQ,OAAO;AAAA,MACpE;AAAA,MACA;AAAA,IACF;AAAA,EACF;AAAA;AAAA,EAEA,MAAM,UAAU,SAA+D;AAC7E,WAAO,KAAK,UAAU;AAAA,MACpB;AAAA,QACE,QAAQ;AAAA,QACR,OAAO;AAAA,QACP,MAAM,mBAAmB,KAAK,UAAU;AAAA,QACxC,iBAAiB,KAAK;AAAA,QACtB,GAAI,SAAS,WAAW,SAAY,CAAC,IAAI,EAAE,QAAQ,QAAQ,OAAO;AAAA,MACpE;AAAA,MACA;AAAA,IACF;AAAA,EACF;AAAA;AAAA,EAEA,MAAM,UAAU,SAA+B,SAAkE;AAC/G,yBAAqB,QAAQ,SAAS;AACtC,UAAM,QAAQ,cAAc,QAAQ,SAAS;AAC7C,UAAM,QAAQ,IAAI,YAAY,EAAE;AAAA,MAC9B,KAAK,UAAU;AAAA,QACb,WAAW;AAAA,UACT,KAAK,QAAQ,UAAU;AAAA,UACvB,KAAK,QAAQ,UAAU;AAAA,UACvB,GAAG,QAAQ,UAAU;AAAA,UACrB,GAAG,QAAQ,UAAU;AAAA,QACvB;AAAA,QACA,WAAW,QAAQ;AAAA,QACnB,WAAW,QAAQ;AAAA,MACrB,CAAC;AAAA,IACH;AACA,UAAM,SAAS,MAAM,KAAK,UAAU;AAAA,MAClC;AAAA,QACE,QAAQ;AAAA,QACR,OAAO;AAAA,QACP,MAAM,mBAAmB,KAAK,UAAU;AAAA,QACxC,MAAM;AAAA,QACN,iBAAiB,KAAK;AAAA,QACtB,GAAI,SAAS,WAAW,SAAY,CAAC,IAAI,EAAE,QAAQ,QAAQ,OAAO;AAAA,MACpE;AAAA,MACA;AAAA,IACF;AACA,QACE,OAAO,eAAe,UACtB,CAAC,eAAe,IAAI,YAAY,EAAE,OAAO,KAAK,GAAG,IAAI,YAAY,EAAE,OAAO,OAAO,UAAU,CAAC;AAE5F,YAAM,IAAI,2BAA2B,OAAO,OAAO,UAAU;AAC/D,WAAO,EAAE,GAAG,QAAQ,YAAY,yBAAyB,KAAK,EAAE;AAAA,EAClE;AAAA;AAAA,EAEA,MAAM,MACJ,WACA,QACA,SAC2B;AAC3B,UAAM,UAAU;AAAA,MACd,UAAU;AAAA,MACV,UAAU,uBAAuB,QAAQ,qBAAqB;AAAA,MAC9D,UAAU,aAAa,QAAQ,WAAW;AAAA,MAC1C,UAAU,cAAc,QAAQ,YAAY;AAAA,IAC9C;AACA,UAAM,YAAY,MAAM,eAAe,SAAS,MAAM;AACtD,WAAO,KAAK;AAAA,MACV;AAAA,QACE,OAAO,UAAU;AAAA,QACjB,qBAAqB,UAAU,uBAAuB,QAAQ,qBAAqB;AAAA,QACnF;AAAA,MACF;AAAA,MACA;AAAA,IACF;AAAA,EACF;AAAA;AAAA,EAEA,MAAM,YAAY,SAAiC,SAA+D;AAChH,WAAO,KAAK,UAAU;AAAA,MACpB;AAAA,QACE,QAAQ;AAAA,QACR,OAAO;AAAA,QACP,MAAM,mBAAmB,KAAK,UAAU;AAAA,QACxC,MAAM,IAAI,YAAY,EAAE;AAAA,UACtB,KAAK,UAAU;AAAA,YACb,OAAO,QAAQ;AAAA,YACf,qBAAqB,QAAQ;AAAA,YAC7B,WAAW,QAAQ;AAAA,UACrB,CAAC;AAAA,QACH;AAAA,QACA,iBAAiB,KAAK;AAAA,QACtB,GAAI,SAAS,WAAW,SAAY,CAAC,IAAI,EAAE,QAAQ,QAAQ,OAAO;AAAA,MACpE;AAAA,MACA;AAAA,IACF;AAAA,EACF;AACF;AAEA,IAAM,oBAAoB,CAAC,KAAK,KAAK,KAAK,MAAM,MAAM,MAAM,OAAO,GAAG;AAEtE,SAAS,qBAAqB,KAAmB;AAC/C,aAAW,UAAU,mBAAmB;AACtC,QAAI,OAAO,OAAO,KAAK,MAAM,EAAG,OAAM,IAAI,UAAU,uCAAuC;AAAA,EAC7F;AACF;AACA,SAAS,QAAQ,QAAuB;AACtC,QAAM,IAAI,UAAU,gCAAgC,MAAM,GAAG;AAC/D;AAEA,SAAS,qBAAqB,OAAwB;AACpD,aAAW,aAAa,OAAO;AAC7B,UAAM,OAAO,UAAU,WAAW,CAAC;AACnC,QAAI,QAAQ,MAAM,SAAS,IAAK,QAAO;AAAA,EACzC;AACA,SAAO;AACT;;;ACpOA,SAAS,WAAAC,gBAAe;AAExB,IAAM,aAAa,uBAAO,IAAI,yBAAyB;AAQhD,IAAM,QAAN,MAAM,OAAM;AAAA,EAGT,YACN,aAES,UAEA,MACT;AAHS;AAEA;AAET,SAAK,eAAe;AACpB,WAAO,eAAe,MAAM,YAAY,EAAE,OAAO,KAAK,CAAC;AAAA,EACzD;AAAA,EANW;AAAA,EAEA;AAAA,EAPF;AAAA,EAaT,QAAQ,OAAO,WAAW,EAAE,OAAyB;AACnD,WAAO,OAAO,UAAU,YAAY,UAAU,QAAS,MAAkC,UAAU,MAAM;AAAA,EAC3G;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAQA,OAAO,GAAG,QAAgB,UAAkB,MAAoB;AAC9D,QAAI,OAAO,WAAW,UAAU;AAC9B,YAAM,IAAI,UAAU,wCAAwC;AAAA,IAC9D;AACA,QAAI,OAAO,aAAa,YAAY,SAAS,WAAW,GAAG;AACzD,YAAM,IAAI,UAAU,8BAA8B;AAAA,IACpD;AACA,UAAM,QAAQ,iCAAiC,KAAK,MAAM;AAC1D,QAAI,UAAU,MAAM;AAClB,YAAM,IAAI,UAAU,0CAA0C;AAAA,IAChE;AACA,UAAM,OAAO,MAAM,CAAC,MAAM,MAAM,CAAC,KAAK;AACtC,UAAM,QAAQ,OAAO,MAAM,CAAC,KAAK,GAAG;AACpC,UAAM,WAAW,MAAM,CAAC,KAAK;AAC7B,QAAI,SAAS,SAAS,GAAG;AACvB,YAAM,IAAI,UAAU,gDAAgD;AAAA,IACtE;AACA,UAAM,cAAc,QAAQ,QAAQ,QAAQ,WAAW,OAAO,MAAM,GAAG,CAAC,CAAC;AACzE,WAAO,IAAI,OAAM,OAAO,aAAa,UAAU,IAAI;AAAA,EACrD;AAAA;AAAA,EAGA,IAAI,SAAiB;AACnB,UAAM,WAAW,KAAK,eAAe;AACrC,UAAM,WAAW,WAAW,CAAC,KAAK,eAAe,KAAK;AACtD,UAAM,QAAQ,WAAW;AACzB,UAAM,WAAW,OAAO,WAAW,KAAK,EAAE,SAAS,GAAG,GAAG;AACzD,WAAO,GAAG,WAAW,MAAM,EAAE,GAAG,OAAO,KAAK,CAAC,IAAI,QAAQ;AAAA,EAC3D;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAOA,SAAS,UAAyB;AAChC,QAAI,CAAC,OAAO,cAAc,QAAQ,GAAG;AACnC,YAAM,IAAI,UAAU,sDAAsD;AAAA,IAC5E;AACA,WAAO,IAAI,OAAM,KAAK,eAAe,OAAO,QAAQ,GAAG,KAAK,QAAQ;AAAA,EACtE;AAAA;AAAA,EAGA,WAAmB;AACjB,WAAO,GAAG,KAAK,MAAM,IAAI,KAAK,QAAQ;AAAA,EACxC;AAAA,EAEA,CAACA,SAAQ,MAAM,IAAY;AACzB,WAAO,KAAK,SAAS;AAAA,EACvB;AAAA;AAAA,EAGA,SAA8D;AAC5D,WAAO;AAAA,MACL,QAAQ,KAAK;AAAA,MACb,UAAU,KAAK;AAAA,MACf,GAAI,KAAK,SAAS,SAAY,CAAC,IAAI,EAAE,MAAM,gBAAgB,KAAK,IAAI,EAAE;AAAA,IACxE;AAAA,EACF;AACF;AAGO,SAAS,WAAW,MAAsB;AAC/C,QAAM,SAAS,SAAS,MAAM,OAAO;AACrC,QAAM,SAAS,eAAe,QAAQ,UAAU,OAAO;AACvD,QAAM,WAAW,eAAe,QAAQ,YAAY,OAAO;AAC3D,QAAM,OAAO,kBAAkB,QAAQ,QAAQ,OAAO;AACtD,SAAO,MAAM,GAAG,QAAQ,UAAU,IAAI;AACxC;AAEA,SAAS,gBAAgB,OAAqB;AAC5C,MAAI,OAAO,MAAM,MAAM,QAAQ,CAAC,GAAG;AACjC,UAAM,IAAI,UAAU,kCAAkC;AAAA,EACxD;AACA,SAAO,MAAM,YAAY,EAAE,QAAQ,aAAa,GAAG;AACrD;;;ACZO,SAAS,mBAAmB,MAA8B;AAC/D,QAAM,SAAS,SAAS,MAAM,eAAe;AAC7C,QAAM,KAAK,eAAe,QAAQ,MAAM,eAAe;AACvD,QAAM,KAAK,eAAe,QAAQ,MAAM,eAAe;AACvD,SAAO,EAAE,GAAI,OAAO,SAAY,CAAC,IAAI,EAAE,GAAG,GAAI,GAAI,OAAO,SAAY,CAAC,IAAI,EAAE,GAAG,EAAG;AACpF;AAGO,SAAS,2BAA2B,OAAuC;AAChF,MAAI,OAAO,UAAU,UAAU;AAC7B,WAAO;AAAA,EACT;AACA,UAAQ,MAAM,YAAY,GAAG;AAAA,IAC3B,KAAK;AACH,aAAO;AAAA,IACT,KAAK;AACH,aAAO;AAAA,IACT;AACE,aAAO;AAAA,EACX;AACF;AAGO,SAAS,uBAAuB,MAAkC;AACvE,QAAM,SAAS,SAAS,MAAM,mBAAmB;AACjD,QAAM,OAAO,uBAAuB,QAAQ,QAAQ,mBAAmB;AACvE,QAAM,cAAc,uBAAuB,QAAQ,eAAe,mBAAmB;AACrF,QAAM,OAAO,eAAe,QAAQ,QAAQ,mBAAmB;AAC/D,SAAO;AAAA,IACL,IAAI,aAAa,QAAQ,MAAM,mBAAmB;AAAA,IAClD,MAAM,2BAA2B,OAAO,IAAI;AAAA,IAC5C,SAAS,gBAAgB,QAAQ,WAAW,mBAAmB,KAAK;AAAA,IACpE,cAAc,gBAAgB,QAAQ,gBAAgB,mBAAmB,KAAK;AAAA,IAC9E,GAAI,SAAS,SAAY,CAAC,IAAI,EAAE,KAAK;AAAA,IACrC,GAAI,gBAAgB,SAAY,CAAC,IAAI,EAAE,YAAY;AAAA,IACnD,GAAI,SAAS,SAAY,CAAC,IAAI,EAAE,KAAK;AAAA,EACvC;AACF;AAGO,SAAS,0BAA0B,MAAqC;AAC7E,QAAM,SAAS,SAAS,MAAM,sBAAsB;AACpD,QAAM,OAAO,uBAAuB,QAAQ,QAAQ,sBAAsB;AAC1E,QAAM,cAAc,uBAAuB,QAAQ,eAAe,sBAAsB;AACxF,QAAM,OAAO,eAAe,QAAQ,QAAQ,sBAAsB;AAClE,QAAM,aAAa,uBAAuB,QAAQ,cAAc,sBAAsB;AACtF,SAAO;AAAA,IACL,IAAI,aAAa,QAAQ,MAAM,sBAAsB;AAAA,IACrD,YAAY,aAAa,QAAQ,cAAc,sBAAsB,KAAK;AAAA,IAC1E,eAAe,gBAAgB,QAAQ,iBAAiB,sBAAsB,KAAK;AAAA,IACnF,cAAc,gBAAgB,QAAQ,gBAAgB,sBAAsB,KAAK;AAAA,IACjF,WAAW,gBAAgB,QAAQ,aAAa,sBAAsB,KAAK;AAAA,IAC3E,GAAI,SAAS,SAAY,CAAC,IAAI,EAAE,KAAK;AAAA,IACrC,GAAI,gBAAgB,SAAY,CAAC,IAAI,EAAE,YAAY;AAAA,IACnD,GAAI,SAAS,SAAY,CAAC,IAAI,EAAE,KAAK;AAAA,IACrC,GAAI,eAAe,SAAY,CAAC,IAAI,EAAE,WAAW;AAAA,EACnD;AACF;AAGO,SAAS,mBAAmB,MAA8B;AAC/D,QAAM,SAAS,SAAS,MAAM,eAAe;AAC7C,QAAM,OAAO,uBAAuB,QAAQ,QAAQ,eAAe;AACnE,QAAM,YAAY,eAAe,QAAQ,aAAa,eAAe;AACrE,QAAM,YAAY,mBAAmB,QAAQ,WAAW;AACxD,QAAM,gBAAgB,mBAAmB,QAAQ,eAAe;AAChE,QAAM,gBAAgB,mBAAmB,QAAQ,eAAe;AAChE,QAAM,oBAAoB,mBAAmB,QAAQ,mBAAmB;AACxE,QAAM,kBAAkB,gBAAgB,QAAQ,mBAAmB,eAAe;AAClF,QAAM,kBAAkB,gBAAgB,QAAQ,mBAAmB,eAAe;AAClF,SAAO;AAAA,IACL,IAAI,aAAa,QAAQ,MAAM,eAAe;AAAA,IAC9C,eAAe,aAAa,QAAQ,iBAAiB,eAAe,KAAK;AAAA,IACzE,iBAAiB,gBAAgB,QAAQ,mBAAmB,eAAe,KAAK;AAAA,IAChF,WAAW,gBAAgB,QAAQ,aAAa,eAAe,KAAK;AAAA,IACpE,GAAI,SAAS,SAAY,CAAC,IAAI,EAAE,KAAK;AAAA,IACrC,GAAI,cAAc,SAAY,CAAC,IAAI,EAAE,UAAU;AAAA,IAC/C,GAAI,cAAc,SAAY,CAAC,IAAI,EAAE,UAAU;AAAA,IAC/C,GAAI,kBAAkB,SAAY,CAAC,IAAI,EAAE,cAAc;AAAA,IACvD,GAAI,kBAAkB,SAAY,CAAC,IAAI,EAAE,cAAc;AAAA,IACvD,GAAI,sBAAsB,SAAY,CAAC,IAAI,EAAE,kBAAkB;AAAA,IAC/D,GAAI,oBAAoB,SAAY,CAAC,IAAI,EAAE,gBAAgB;AAAA,IAC3D,GAAI,oBAAoB,SAAY,CAAC,IAAI,EAAE,gBAAgB;AAAA,EAC7D;AACF;AAGO,SAAS,UAAa,MAAe,WAA0C;AACpF,QAAM,SAAS,SAAS,MAAM,MAAM;AACpC,QAAM,QAAQ,OAAO,SAAS,CAAC;AAC/B,MAAI,CAAC,MAAM,QAAQ,KAAK,GAAG;AACzB,UAAM,IAAI,UAAU,8BAA8B;AAAA,EACpD;AACA,QAAM,aAAa,eAAe,QAAQ,cAAc,MAAM;AAC9D,SAAO;AAAA,IACL,OAAO,MAAM,IAAI,SAAS;AAAA,IAC1B,GAAI,eAAe,SAAY,CAAC,IAAI,EAAE,WAAW;AAAA,EACnD;AACF;AAEA,SAAS,uBACP,QACA,OACA,OAC2B;AAC3B,QAAM,QAAQ,OAAO,KAAK;AAC1B,MAAI,UAAU,UAAa,UAAU,MAAM;AACzC,WAAO;AAAA,EACT;AACA,MAAI;AACF,WAAO,mBAAmB,KAAK;AAAA,EACjC,SAAS,OAAO;AACd,UAAM,IAAI,UAAU,GAAG,KAAK,IAAI,KAAK,yCAAyC,EAAE,MAAM,CAAC;AAAA,EACzF;AACF;AAEA,SAAS,mBAAmB,QAAiC,OAAkC;AAC7F,QAAM,QAAQ,OAAO,KAAK;AAC1B,SAAO,UAAU,UAAa,UAAU,OAAO,SAAY,WAAW,KAAK;AAC7E;;;ACzNA,SAAS,WAAAC,gBAAe;AA6FjB,SAAS,gBAAgB,MAA2B;AACzD,QAAM,SAAS,SAAS,MAAM,YAAY;AAC1C,QAAM,mBAAmB,aAAa,QAAQ,oBAAoB,YAAY;AAC9E,QAAM,YAAY,aAAa,QAAQ,aAAa,YAAY;AAChE,QAAM,OAAO,qBAAqB,QAAQ,MAAM;AAChD,QAAM,qBAAqB,eAAe,QAAQ,sBAAsB,YAAY;AACpF,QAAM,cAAc,kBAAkB,QAAQ,eAAe,YAAY;AACzE,QAAM,YACJ,OAAO,cAAc,UAAa,OAAO,cAAc,OAAO,SAAY,WAAW,OAAO,SAAS;AACvG,QAAM,aAAa,iBAAiB,QAAQ,cAAc,YAAY;AACtE,QAAM,gBAAgB,gBAAgB,QAAQ,iBAAiB,YAAY;AAC3E,QAAM,YAAY,eAAe,QAAQ,aAAa,YAAY;AAClE,QAAM,cAAc,yBAAyB,MAAM;AACnD,SAAO;AAAA,IACL,IAAI,aAAa,QAAQ,MAAM,YAAY;AAAA,IAC3C,qBAAqB,gBAAgB,QAAQ,uBAAuB,YAAY,KAAK;AAAA,IACrF,GAAI,qBAAqB,SAAY,CAAC,IAAI,EAAE,iBAAiB;AAAA,IAC7D,GAAI,cAAc,SAAY,CAAC,IAAI,EAAE,UAAU;AAAA,IAC/C,GAAI,SAAS,SAAY,CAAC,IAAI,EAAE,KAAK;AAAA,IACrC,GAAI,uBAAuB,SAAY,CAAC,IAAI,EAAE,mBAAmB;AAAA,IACjE,GAAI,gBAAgB,SAAY,CAAC,IAAI,EAAE,YAAY;AAAA,IACnD,GAAI,cAAc,SAAY,CAAC,IAAI,EAAE,UAAU;AAAA,IAC/C,GAAI,eAAe,SAAY,CAAC,IAAI,EAAE,WAAW;AAAA,IACjD,GAAI,kBAAkB,SAAY,CAAC,IAAI,EAAE,cAAc;AAAA,IACvD,GAAI,cAAc,SAAY,CAAC,IAAI,EAAE,UAAU;AAAA,IAC/C,GAAI,gBAAgB,SAAY,CAAC,IAAI,EAAE,YAAY;AAAA,EACrD;AACF;AAGO,SAAS,wBAAwB,MAAmC;AACzE,QAAM,SAAS,SAAS,MAAM,oBAAoB;AAClD,QAAM,eAAe,eAAe,QAAQ,gBAAgB,oBAAoB;AAChF,QAAM,UAAU,eAAe,QAAQ,WAAW,oBAAoB;AACtE,QAAM,aAAa,kBAAkB,QAAQ,cAAc,oBAAoB;AAC/E,QAAM,aAAa,iBAAiB,QAAQ,cAAc,oBAAoB;AAC9E,QAAM,YAAY,aAAa,QAAQ,aAAa,oBAAoB;AACxE,QAAM,OAAO,qBAAqB,QAAQ,MAAM;AAChD,QAAM,cAAc,kBAAkB,QAAQ,eAAe,oBAAoB;AACjF,QAAM,aAAiC;AAAA,IACrC,YAAY,aAAa,QAAQ,cAAc,oBAAoB,KAAK;AAAA,IACxE,GAAI,iBAAiB,SAAY,CAAC,IAAI,EAAE,aAAa;AAAA,IACrD,GAAI,YAAY,SAAY,CAAC,IAAI,EAAE,QAAQ;AAAA,IAC3C,GAAI,eAAe,SAAY,CAAC,IAAI,EAAE,WAAW;AAAA,IACjD,GAAI,eAAe,SAAY,CAAC,IAAI,EAAE,WAAW;AAAA,IACjD,GAAI,cAAc,SAAY,CAAC,IAAI,EAAE,UAAU;AAAA,IAC/C,GAAI,SAAS,SAAY,CAAC,IAAI,EAAE,KAAK;AAAA,IACrC,GAAI,gBAAgB,SAAY,CAAC,IAAI,EAAE,YAAY;AAAA,IACnD,WAAW;AACT,aAAO,qCAAqC,KAAK,UAAU;AAAA,IAC7D;AAAA,IACA,CAACC,SAAQ,MAAM,IAAI;AACjB,aAAO,qCAAqC,KAAK,UAAU;AAAA,IAC7D;AAAA,EACF;AACA,SAAO,eAAe,YAAY,YAAY,EAAE,YAAY,MAAM,CAAC;AACnE,SAAO,eAAe,YAAYA,SAAQ,QAAQ,EAAE,YAAY,MAAM,CAAC;AACvE,SAAO;AACT;AAGO,SAAS,kCAAkC,MAA6C;AAC7F,QAAM,SAAS,SAAS,MAAM,8BAA8B;AAC5D,QAAM,QAAQ,OAAO,SAAS,CAAC;AAC/B,MAAI,CAAC,MAAM,QAAQ,KAAK,GAAG;AACzB,UAAM,IAAI,UAAU,sDAAsD;AAAA,EAC5E;AACA,SAAO,EAAE,OAAO,MAAM,IAAI,uBAAuB,EAAE;AACrD;AAEA,SAAS,qBAAqB,QAAiC,OAA8C;AAC3G,QAAM,QAAQ,OAAO,KAAK;AAC1B,MAAI,UAAU,UAAa,UAAU,MAAM;AACzC,WAAO;AAAA,EACT;AACA,QAAM,SAAS,SAAS,OAAO,cAAc,KAAK,EAAE;AACpD,QAAM,OAAO,OAAO,SAAS,UAAa,OAAO,SAAS,OAAO,SAAY,mBAAmB,OAAO,IAAI;AAC3G,SAAO;AAAA,IACL,IAAI,aAAa,QAAQ,MAAM,cAAc,KAAK,EAAE;AAAA,IACpD,GAAI,SAAS,SAAY,CAAC,IAAI,EAAE,KAAK;AAAA,EACvC;AACF;AAEA,SAAS,yBAAyB,QAAoE;AACpG,QAAM,QAAQ,OAAO;AACrB,MAAI,UAAU,UAAa,UAAU,MAAM;AACzC,WAAO;AAAA,EACT;AACA,QAAM,SAAS,SAAS,OAAO,wBAAwB;AACvD,QAAM,OAAO,OAAO,SAAS,UAAa,OAAO,SAAS,OAAO,SAAY,mBAAmB,OAAO,IAAI;AAC3G,SAAO;AAAA,IACL,IAAI,aAAa,QAAQ,MAAM,wBAAwB;AAAA,IACvD,GAAI,SAAS,SAAY,CAAC,IAAI,EAAE,KAAK;AAAA,EACvC;AACF;AAEA,SAAS,iBAAiB,QAAiC,OAAe,OAAmC;AAC3G,QAAM,QAAQ,eAAe,QAAQ,OAAO,KAAK;AACjD,MAAI,UAAU,QAAW;AACvB,WAAO;AAAA,EACT;AACA,QAAM,SAAS,oBAAI,KAAK,GAAG,KAAK,YAAY;AAC5C,MACE,CAAC,sBAAsB,KAAK,KAAK,KACjC,OAAO,MAAM,OAAO,QAAQ,CAAC,KAC7B,OAAO,YAAY,EAAE,MAAM,GAAG,EAAE,MAAM,OACtC;AACA,UAAM,IAAI,UAAU,GAAG,KAAK,IAAI,KAAK,2BAA2B;AAAA,EAClE;AACA,SAAO;AACT;;;AChIO,SAAS,WAAW,MAAsB;AAC/C,QAAM,SAAS,SAAS,MAAM,OAAO;AACrC,QAAM,YAAY,aAAa,QAAQ,aAAa,OAAO;AAC3D,QAAM,WAAW,aAAa,QAAQ,YAAY,OAAO;AACzD,QAAM,SAAS,aAAa,QAAQ,UAAU,OAAO;AACrD,QAAM,WAAW,gBAAgB,QAAQ,YAAY,OAAO;AAC5D,QAAM,QAAQ,OAAO,UAAU,UAAa,OAAO,UAAU,OAAO,SAAY,WAAW,OAAO,KAAK;AACvG,QAAM,YAAY,yBAAyB,OAAO,SAAS;AAC3D,QAAM,cAAc,kBAAkB,QAAQ,eAAe,OAAO;AACpE,QAAM,oBAAoB,eAAe,QAAQ,qBAAqB,OAAO;AAC7E,QAAM,cAAc,eAAe,QAAQ,eAAe,OAAO;AACjE,QAAM,gBAAgB,gBAAgB,QAAQ,iBAAiB,OAAO;AACtE,SAAO;AAAA,IACL,aAAa,aAAa,QAAQ,eAAe,OAAO;AAAA,IACxD,QAAQ,iBAAiB,OAAO,MAAM;AAAA,IACtC,GAAI,cAAc,SAAY,CAAC,IAAI,EAAE,UAAU;AAAA,IAC/C,GAAI,aAAa,SAAY,CAAC,IAAI,EAAE,SAAS;AAAA,IAC7C,GAAI,WAAW,SAAY,CAAC,IAAI,EAAE,OAAO;AAAA,IACzC,GAAI,aAAa,SAAY,CAAC,IAAI,EAAE,SAAS;AAAA,IAC7C,GAAI,UAAU,SAAY,CAAC,IAAI,EAAE,MAAM;AAAA,IACvC,GAAI,cAAc,SAAY,CAAC,IAAI,EAAE,UAAU;AAAA,IAC/C,GAAI,gBAAgB,SAAY,CAAC,IAAI,EAAE,YAAY;AAAA,IACnD,GAAI,sBAAsB,SAAY,CAAC,IAAI,EAAE,kBAAkB;AAAA,IAC/D,GAAI,gBAAgB,SAAY,CAAC,IAAI,EAAE,YAAY;AAAA,IACnD,GAAI,kBAAkB,SAAY,CAAC,IAAI,EAAE,cAAc;AAAA,EACzD;AACF;AAGO,SAAS,iBAAiB,OAA6B;AAC5D,MAAI,OAAO,UAAU,UAAU;AAC7B,WAAO;AAAA,EACT;AACA,UAAQ,MAAM,YAAY,GAAG;AAAA,IAC3B,KAAK;AACH,aAAO;AAAA,IACT,KAAK;AACH,aAAO;AAAA,IACT,KAAK;AACH,aAAO;AAAA,IACT,KAAK;AACH,aAAO;AAAA,IACT;AACE,aAAO;AAAA,EACX;AACF;AAEA,SAAS,yBAAyB,OAA2D;AAC3F,MAAI,UAAU,UAAa,UAAU,MAAM;AACzC,WAAO;AAAA,EACT;AACA,MAAI,CAAC,MAAM,QAAQ,KAAK,GAAG;AACzB,UAAM,IAAI,UAAU,gDAAgD;AAAA,EACtE;AACA,SAAO,MAAM,IAAI,uBAAuB;AAC1C;;;ACjEO,SAAS,YAAY,MAAuB;AACjD,QAAM,SAAS,SAAS,MAAM,QAAQ;AACtC,QAAM,OAAO,eAAe,QAAQ,QAAQ,QAAQ;AACpD,QAAM,WAAW,eAAe,QAAQ,YAAY,QAAQ;AAC5D,SAAO;AAAA,IACL,IAAI,aAAa,QAAQ,MAAM,QAAQ;AAAA,IACvC,SAAS,WAAW,OAAO,OAAO;AAAA,IAClC,GAAI,SAAS,SAAY,CAAC,IAAI,EAAE,KAAK;AAAA,IACrC,GAAI,aAAa,SAAY,CAAC,IAAI,EAAE,SAAS;AAAA,EAC/C;AACF;AAGO,SAAS,oBAAoB,MAA+B;AACjE,QAAM,SAAS,SAAS,MAAM,gBAAgB;AAC9C,QAAM,UACJ,OAAO,YAAY,UAAa,OAAO,YAAY,OAAO,SAAY,qBAAqB,OAAO,OAAO;AAC3G,QAAM,cACJ,OAAO,gBAAgB,UAAa,OAAO,gBAAgB,OACvD,SACA,yBAAyB,OAAO,WAAW;AACjD,QAAM,eACJ,OAAO,iBAAiB,UAAa,OAAO,iBAAiB,OACzD,SACA,kBAAkB,OAAO,YAAY;AAC3C,QAAM,uBAAuB,eAAe,QAAQ,wBAAwB,gBAAgB;AAC5F,SAAO;AAAA,IACL,GAAI,YAAY,SAAY,CAAC,IAAI,EAAE,QAAQ;AAAA,IAC3C,GAAI,gBAAgB,SAAY,CAAC,IAAI,EAAE,YAAY;AAAA,IACnD,GAAI,iBAAiB,SAAY,CAAC,IAAI,EAAE,aAAa;AAAA,IACrD,GAAI,yBAAyB,SAAY,CAAC,IAAI,EAAE,qBAAqB;AAAA,EACvE;AACF;AAGO,SAAS,qBAAqB,MAAgC;AACnE,QAAM,SAAS,SAAS,MAAM,iBAAiB;AAC/C,SAAO,EAAE,IAAI,aAAa,QAAQ,MAAM,iBAAiB,EAAE;AAC7D;AAGO,SAAS,yBAAyB,MAAoC;AAC3E,QAAM,SAAS,SAAS,MAAM,qBAAqB;AACnD,QAAM,SAAS,OAAO,UAAU,CAAC;AACjC,MAAI,CAAC,MAAM,QAAQ,MAAM,KAAK,CAAC,OAAO,MAAM,CAAC,UAA2B,OAAO,UAAU,QAAQ,GAAG;AAClG,UAAM,IAAI,UAAU,yDAAyD;AAAA,EAC/E;AACA,SAAO,EAAE,IAAI,aAAa,QAAQ,MAAM,qBAAqB,GAAG,OAAO;AACzE;AAGO,SAAS,kBAAkB,MAA6B;AAC7D,QAAM,SAAS,SAAS,MAAM,cAAc;AAC5C,QAAM,cAAc,eAAe,QAAQ,eAAe,cAAc;AACxE,SAAO;AAAA,IACL,IAAI,aAAa,QAAQ,MAAM,cAAc;AAAA,IAC7C,GAAI,gBAAgB,SAAY,CAAC,IAAI,EAAE,YAAY;AAAA,EACrD;AACF;;;AClFO,IAAM,oBAAN,MAAwB;AAAA;AAAA,EAE7B,YAA6B,WAA6B;AAA7B;AAAA,EAA8B;AAAA,EAA9B;AAAA;AAAA,EAE7B,MAAM,IAAI,SAAgD;AACxD,WAAO,KAAK,UAAU;AAAA,MACpB;AAAA,QACE,QAAQ;AAAA,QACR,OAAO;AAAA,QACP,MAAM;AAAA,QACN,SAAS;AAAA,QACT,QAAQ,SAAS;AAAA,MACnB;AAAA,MACA;AAAA,IACF;AAAA,EACF;AACF;AAGO,IAAM,mBAAN,MAAuB;AAAA;AAAA,EAE5B,YAA6B,WAA6B;AAA7B;AAAA,EAA8B;AAAA,EAA9B;AAAA;AAAA,EAE7B,OAAO,KAAK,SAA8C;AACxD,WAAO,MAAM,CAAC,WAAW,KAAK,SAAS,YAAY,QAAQ,OAAO,CAAC,CAAC;AAAA,EACtE;AAAA;AAAA,EAEA,MAAM,SAAS,SAA8C;AAC3D,WAAO,KAAK,UAAU;AAAA,MACpB;AAAA,QACE,QAAQ;AAAA,QACR,OAAO;AAAA,QACP,MAAM,SAAS,eAAe,SAAS,MAAM;AAAA,QAC7C,SAAS;AAAA,QACT,QAAQ,SAAS;AAAA,MACnB;AAAA,MACA,CAAC,SAAS,UAAU,MAAM,WAAW;AAAA,IACvC;AAAA,EACF;AAAA;AAAA,EAEA,MAAM,IAAI,UAAkB,SAAwC;AAClE,UAAM,KAAK,cAAc,UAAU,UAAU;AAC7C,WAAO,KAAK,UAAU;AAAA,MACpB;AAAA,QACE,QAAQ;AAAA,QACR,OAAO;AAAA,QACP,MAAM,eAAe,EAAE;AAAA,QACvB,SAAS;AAAA,QACT,QAAQ,SAAS;AAAA,MACnB;AAAA,MACA;AAAA,IACF;AAAA,EACF;AACF;AAGO,IAAM,sBAAN,MAA0B;AAAA;AAAA,EAE/B,YAA6B,WAA6B;AAA7B;AAAA,EAA8B;AAAA,EAA9B;AAAA;AAAA,EAE7B,OAAO,eAAe,UAAkB,SAAyD;AAC/F,WAAO,MAAM,CAAC,WAAW,KAAK,mBAAmB,UAAU,YAAY,QAAQ,OAAO,CAAC,CAAC;AAAA,EAC1F;AAAA;AAAA,EAEA,MAAM,mBAAmB,UAAkB,SAAyD;AAClG,UAAM,KAAK,cAAc,UAAU,UAAU;AAC7C,WAAO,KAAK,UAAU;AAAA,MACpB;AAAA,QACE,QAAQ;AAAA,QACR,OAAO;AAAA,QACP,MAAM,SAAS,eAAe,EAAE,uBAAuB,SAAS,MAAM;AAAA,QACtE,SAAS;AAAA,QACT,QAAQ,SAAS;AAAA,MACnB;AAAA,MACA,CAAC,SAAS,UAAU,MAAM,sBAAsB;AAAA,IAClD;AAAA,EACF;AAAA;AAAA,EAEA,OAAO,kBACL,UACA,YACA,SACqC;AACrC,WAAO,MAAM,CAAC,WAAW,KAAK,sBAAsB,UAAU,YAAY,YAAY,QAAQ,OAAO,CAAC,CAAC;AAAA,EACzG;AAAA;AAAA,EAEA,MAAM,sBACJ,UACA,YACA,SACqC;AACrC,UAAM,SAAS,cAAc,UAAU,UAAU;AACjD,UAAM,WAAW,cAAc,YAAY,YAAY;AACvD,UAAM,QAAQ;AACd,WAAO,KAAK,UAAU;AAAA,MACpB;AAAA,QACE,QAAQ;AAAA,QACR;AAAA,QACA,MAAM,SAAS,eAAe,MAAM,uBAAuB,QAAQ,kBAAkB,SAAS,MAAM;AAAA,QACpG,SAAS;AAAA,QACT,QAAQ,SAAS;AAAA,MACnB;AAAA,MACA,CAAC,SAAS,UAAU,MAAM,yBAAyB;AAAA,IACrD;AAAA,EACF;AAAA;AAAA,EAEA,MAAM,eAAe,UAAkB,eAAuB,SAAsD;AAClH,UAAM,SAAS,cAAc,UAAU,UAAU;AACjD,UAAM,cAAc,cAAc,eAAe,eAAe;AAChE,WAAO,KAAK,UAAU;AAAA,MACpB;AAAA,QACE,QAAQ;AAAA,QACR,OAAO;AAAA,QACP,MAAM,eAAe,MAAM,0BAA0B,WAAW;AAAA,QAChE,SAAS;AAAA,QACT,QAAQ,SAAS;AAAA,MACnB;AAAA,MACA;AAAA,IACF;AAAA,EACF;AAAA;AAAA,EAEA,OAAO,UAAU,UAAkB,eAAuB,SAAqD;AAC7G,WAAO,MAAM,CAAC,WAAW,KAAK,cAAc,UAAU,eAAe,YAAY,QAAQ,OAAO,CAAC,CAAC;AAAA,EACpG;AAAA;AAAA,EAEA,MAAM,cAAc,UAAkB,eAAuB,SAAqD;AAChH,UAAM,SAAS,cAAc,UAAU,UAAU;AACjD,UAAM,cAAc,cAAc,eAAe,eAAe;AAChE,UAAM,QAAQ;AACd,WAAO,KAAK,UAAU;AAAA,MACpB;AAAA,QACE,QAAQ;AAAA,QACR;AAAA,QACA,MAAM,SAAS,eAAe,MAAM,0BAA0B,WAAW,UAAU,SAAS,MAAM;AAAA,QAClG,SAAS;AAAA,QACT,QAAQ,SAAS;AAAA,MACnB;AAAA,MACA,CAAC,SAAS,UAAU,MAAM,kBAAkB;AAAA,IAC9C;AAAA,EACF;AACF;AAGO,IAAM,kBAAN,MAAsB;AAAA;AAAA,EAE3B,YAA6B,WAA6B;AAA7B;AAAA,EAA8B;AAAA,EAA9B;AAAA;AAAA,EAE7B,OACE,UACA,aACA,OACA,SACsB;AACtB,WAAO,KAAK,KAAK,UAAU,aAAa,OAAO,OAAO,OAAO;AAAA,EAC/D;AAAA;AAAA,EAEA,OACE,UACA,aACA,OACA,SACsB;AACtB,WAAO,KAAK,KAAK,UAAU,aAAa,OAAO,MAAM,OAAO;AAAA,EAC9D;AAAA;AAAA,EAEA,MAAM,IAAI,aAAqB,SAAuC;AACpE,UAAM,KAAK,cAAc,aAAa,aAAa;AACnD,WAAO,KAAK,UAAU;AAAA,MACpB;AAAA,QACE,QAAQ;AAAA,QACR,OAAO;AAAA,QACP,MAAM,cAAc,EAAE;AAAA,QACtB,SAAS;AAAA,QACT,QAAQ,SAAS;AAAA,MACnB;AAAA,MACA;AAAA,IACF;AAAA,EACF;AAAA,EACA,MAAc,KACZ,UACA,aACA,OACA,UACA,SACsB;AACtB,eAAW,KAAK;AAChB,UAAM,SAAS,cAAc,UAAU,UAAU;AACjD,UAAM,YAAY,cAAc,aAAa,aAAa;AAC1D,UAAM,OAAO,cAAc,MAAM,QAAQ,QAAQ;AACjD,QAAI;AACJ,QAAI;AACF,cAAQ,IAAI,YAAY,EAAE;AAAA,QACxB,KAAK,UAAU;AAAA,UACb,QAAQ;AAAA,UACR,UAAU,MAAM;AAAA,UAChB,mBAAmB,MAAM,kBAAkB,OAAO;AAAA,UAClD,eAAe,MAAM,cAAc,OAAO;AAAA,UAC1C,GAAI,MAAM,sBAAsB,SAAY,CAAC,IAAI,EAAE,mBAAmB,MAAM,kBAAkB;AAAA,UAC9F,gBAAgB,MAAM,kBAAkB;AAAA,QAC1C,CAAC;AAAA,MACH;AAAA,IACF,SAAS,OAAO;AACd,YAAM,IAAI,oBAAoB,KAAK;AAAA,IACrC;AACA,QAAI;AACJ,QAAI,SAAS;AACb,QAAI,UAAU;AACd,QAAI;AACJ,QAAI;AACJ,QAAI;AACF,YAAM,EAAE,UAAU,KAAK,IAAI,MAAM,KAAK,UAAU,KAAK;AAAA,QACnD,QAAQ;AAAA,QACR,OAAO;AAAA,QACP,MAAM,eAAe,MAAM;AAAA,QAC3B,SAAS;AAAA,QACT,aAAa;AAAA,QACb,MAAM;AAAA,QACN,QAAQ,SAAS;AAAA,MACnB,CAAC;AACD,UAAI,KAAK,WAAW,GAAG;AACrB,wBAAgB;AAChB,iBAAS;AAAA,UACP,MAAM;AAAA,UACN,aAAa;AAAA,UACb,kBAAkB;AAAA,UAClB,OAAO,eAAe,SAAS,MAAM;AAAA,QACvC;AAAA,MACF,OAAO;AACL,YAAI;AACJ,YAAI;AACF,oBAAU,UAAU,IAAI;AAAA,QAC1B,QAAQ;AACN,gBAAM,IAAI,uBAAuB,gBAAgB;AAAA,QACnD;AACA,YAAI,YAAY,MAAM;AACpB,0BAAgB;AAChB,mBAAS;AAAA,YACP,MAAM;AAAA,YACN,aAAa;AAAA,YACb,kBAAkB;AAAA,YAClB,OAAO,eAAe,SAAS,MAAM;AAAA,UACvC;AAAA,QACF,WAAW,SAAS,WAAW,KAAK;AAClC,gBAAM,aAAa,iBAAiB,OAAO;AAC3C,mBAAS;AAAA,YACP,MAAM;AAAA,YACN,aAAa;AAAA,YACb,OAAO;AAAA,YACP,kBACE,kBAAkB,SAAS,QAAQ,IAAI,aAAa,CAAC,MAAM,SACvD,OACC,kBAAkB,SAAS,QAAQ,IAAI,aAAa,CAAC,KAAK,KAAK;AAAA,YACtE,GAAI,SAAS,QAAQ,IAAI,UAAU,MAAM,OAAO,CAAC,IAAI,EAAE,UAAU,SAAS,QAAQ,IAAI,UAAU,KAAK,GAAG;AAAA,UAC1G;AAAA,QACF,OAAO;AACL,gBAAM,aAAa,iBAAiB,OAAO;AAC3C,gBAAM,cAAc,WAAW,aAAa,CAAC;AAC7C,cAAI,YAAY,SAAS,GAAG;AAC1B,qBAAS;AAAA,cACP,MAAM;AAAA,cACN,aAAa;AAAA,cACb,OAAO;AAAA,cACP;AAAA,cACA,eAAe,WAAW,kBAAkB,QAAQ,YAAY,WAAW;AAAA,YAC7E;AAAA,UACF,WACEC,cAAa,SAAS,QAAQ,IAAI,sBAAsB,CAAC,EAAE,KAAK,CAAC,UAAU,MAAM,YAAY,MAAM,MAAM,GACzG;AACA,qBAAS,EAAE,MAAM,YAAY,aAAa,WAAW,OAAO,WAAW;AAAA,UACzE,OAAO;AACL,qBAAS;AAAA,cACP,MAAM;AAAA,cACN,aAAa;AAAA,cACb,OAAO;AAAA,cACP;AAAA,cACA,eAAe,WAAW,kBAAkB,QAAQ,YAAY,WAAW;AAAA,YAC7E;AAAA,UACF;AAAA,QACF;AAAA,MACF;AAAA,IACF,SAAS,OAAO;AACd,UAAI,iBAAiB,cAAc;AACjC,YAAI,MAAM,iBAAiB,gBAAgB,MAAM,cAAc,CAAC,WAAW;AACzE,mBAAS,EAAE,MAAM,aAAa,aAAa,WAAW,SAAS,MAAM;AACrE,mBAAS;AAAA,QACX,OAAO;AACL,0BAAgB,MAAM,WAAW;AACjC,gBAAM,QACJ,MAAM,eAAe,SAAa,iBAAiB,MAAM,IAAI,IAAI,MAAS,MAAQ,MAAM,aAAa;AACvG,mBAAS,EAAE,MAAM,WAAW,aAAa,WAAW,kBAAkB,OAAO,OAAO,MAAM;AAAA,QAC5F;AAAA,MACF,WAAW,iBAAiB,qBAAqB;AAC/C,cAAM;AAAA,MACR,OAAO;AACL,wBAAgB,SAAS,QAAQ,UAAU,aAAa,UAAU,KAAK;AACvE,iBAAS,EAAE,MAAM,WAAW,aAAa,WAAW,kBAAkB,KAAM,OAAO,MAAM;AACzF,kBAAU,SAAS,QAAQ,WAAW;AACtC,uBAAe;AAAA,MACjB;AAAA,IACF;AACA,QAAI,QAAQ;AACV,UAAI,OAAO,SAAS,WAAW;AAC7B,iBAAS;AAAA,UACP,KAAK;AAAA,UACL;AAAA,UACA,iBAAiB,UAAU,OAAO,KAAK;AAAA,UACvC,OAAO;AAAA,UACP,OAAO;AAAA,QACT;AAAA,MACF,OAAO;AACL,iBAAS,cAAc,KAAK,WAAW,WAAW,MAAM;AAAA,MAC1D;AAAA,IACF;AACA,QAAI,QAAS,OAAM;AACnB,WAAO;AAAA,EACT;AACF;AAGO,IAAM,sBAAN,MAA0B;AAAA;AAAA,EAE/B,YAA6B,WAA6B;AAA7B;AAAA,EAA8B;AAAA,EAA9B;AAAA;AAAA,EAE7B,OAAO,KAAK,UAAkB,SAAkD;AAC9E,WAAO,MAAM,CAAC,WAAW,KAAK,SAAS,UAAU,YAAY,QAAQ,OAAO,CAAC,CAAC;AAAA,EAChF;AAAA;AAAA,EAEA,MAAM,SAAS,UAAkB,SAAkD;AACjF,UAAM,SAAS,cAAc,UAAU,UAAU;AACjD,WAAO,KAAK,UAAU;AAAA,MACpB;AAAA,QACE,QAAQ;AAAA,QACR,OAAO;AAAA,QACP,MAAM,SAAS,eAAe,MAAM,UAAU,SAAS,MAAM;AAAA,QAC7D,SAAS;AAAA,QACT,QAAQ,SAAS;AAAA,MACnB;AAAA,MACA,CAAC,SAAS,UAAU,MAAM,eAAe;AAAA,IAC3C;AAAA,EACF;AAAA;AAAA,EAEA,MAAM,IAAI,UAAkB,YAAoB,SAA4C;AAC1F,UAAM,SAAS,cAAc,UAAU,UAAU;AACjD,UAAM,OAAO,cAAc,YAAY,YAAY;AACnD,WAAO,KAAK,UAAU;AAAA,MACpB;AAAA,QACE,QAAQ;AAAA,QACR,OAAO;AAAA,QACP,MAAM,eAAe,MAAM,UAAU,IAAI;AAAA,QACzC,SAAS;AAAA,QACT,QAAQ,SAAS;AAAA,MACnB;AAAA,MACA;AAAA,IACF;AAAA,EACF;AAAA;AAAA,EAEA,MAAM,OAAO,UAAkB,YAAoB,SAAoD;AACrG,UAAM,SAAS,cAAc,UAAU,UAAU;AACjD,UAAM,OAAO,cAAc,YAAY,YAAY;AACnD,WAAO,KAAK,UAAU;AAAA,MACpB;AAAA,QACE,QAAQ;AAAA,QACR,OAAO;AAAA,QACP,MAAM,eAAe,MAAM,UAAU,IAAI;AAAA,QACzC,SAAS;AAAA,QACT,QAAQ,SAAS;AAAA,MACnB;AAAA,MACA;AAAA,IACF;AAAA,EACF;AAAA;AAAA,EAEA,MAAM,cACJ,UACA,WACA,SACuC;AACvC,UAAM,SAAS,cAAc,UAAU,UAAU;AACjD,UAAM,UAAU,cAAc,WAAW,WAAW;AACpD,UAAM,QAAQ;AACd,WAAO,KAAK,UAAU;AAAA,MACpB;AAAA,QACE,QAAQ;AAAA,QACR;AAAA,QACA,MAAM,eAAe,MAAM,aAAa,OAAO;AAAA,QAC/C,SAAS;AAAA,QACT,QAAQ,SAAS;AAAA,MACnB;AAAA,MACA;AAAA,IACF;AAAA,EACF;AACF;AAGO,IAAM,wBAAN,MAA4B;AAAA;AAAA,EAEjC,YAA6B,WAA6B;AAA7B;AAAA,EAA8B;AAAA,EAA9B;AAAA;AAAA,EAE7B,MAAM,eAAe,SAAqD;AACxE,WAAO,KAAK,UAAU;AAAA,MACpB;AAAA,QACE,QAAQ;AAAA,QACR,OAAO;AAAA,QACP,MAAM;AAAA,QACN,SAAS;AAAA,QACT,MAAM;AAAA,QACN,QAAQ,SAAS;AAAA,MACnB;AAAA,MACA;AAAA,IACF;AAAA,EACF;AACF;AAEA,gBAAgB,MAAS,MAA+D;AACtF,MAAI;AACJ,QAAM,cAAc,oBAAI,IAAY;AACpC,KAAG;AACD,UAAM,OAAO,MAAM,KAAK,MAAM;AAC9B,eAAW,QAAQ,KAAK,MAAO,OAAM;AACrC,aAAS,KAAK;AACd,QAAI,WAAW,UAAa,OAAO,SAAS,GAAG;AAC7C,UAAI,YAAY,IAAI,MAAM,EAAG,OAAM,IAAI,uBAAuB,0BAA0B;AACxF,kBAAY,IAAI,MAAM;AAAA,IACxB;AAAA,EACF,SAAS,WAAW,UAAa,OAAO,SAAS;AACnD;AACA,SAAS,SAAS,MAAc,QAAyB;AACvD,SAAO,WAAW,UAAa,OAAO,WAAW,IAAI,OAAO,GAAG,IAAI,WAAW,mBAAmB,MAAM,CAAC;AAC1G;AACA,SAAS,YAAY,QAA4B,SAAoC;AACnF,SAAO;AAAA,IACL,GAAI,WAAW,SAAY,CAAC,IAAI,EAAE,OAAO;AAAA,IACzC,QAAQ,SAAS;AAAA,EACnB;AACF;AACA,SAAS,UAAU,MAA2B;AAC5C,SAAO,KAAK,MAAM,IAAI,YAAY,EAAE,OAAO,IAAI,CAAC;AAClD;AACA,SAAS,iBAAiB,OAAuB;AAC/C,MAAI;AACF,WAAO,WAAW,KAAK;AAAA,EACzB,QAAQ;AACN,UAAM,IAAI,uBAAuB,gBAAgB;AAAA,EACnD;AACF;AACA,SAASA,cAAa,OAAgC;AACpD,SAAO,UAAU,OAAO,CAAC,IAAI,MAAM,MAAM,GAAG,EAAE,IAAI,CAAC,SAAS,KAAK,KAAK,CAAC;AACzE;AACA,SAAS,WAAW,OAAiC;AACnD,MAAI,CAAC,OAAO,UAAU,MAAM,QAAQ,KAAK,MAAM,WAAW;AACxD,UAAM,IAAI,WAAW,yCAAyC;AAChE,gBAAc,MAAM,QAAQ,QAAQ;AACpC,MAAI,EAAE,MAAM,6BAA6B,UAAU,EAAE,MAAM,yBAAyB;AAClF,UAAM,IAAI,UAAU,oCAAoC;AAC1D,MAAI,OAAO,MAAM,kBAAkB,OAAO,QAAQ,KAAK,EAAE,CAAC,KAAK;AAC7D,UAAM,IAAI,WAAW,8CAA8C;AACrE,MAAI,MAAM,kBAAkB,SAAS,MAAM,QAAQ,EAAE,WAAW,MAAM,cAAc;AAClF,UAAM,IAAI,UAAU,6DAA6D;AACnF,MAAI,MAAM,kBAAkB,aAAa,MAAM,cAAc;AAC3D,UAAM,IAAI,UAAU,0CAA0C;AAClE;AACA,SAAS,cAAqC,WAA6B,aAAqB,QAAc;AAC5G,cAAY,gCAAgC;AAAA,IAC1C,eAAe,UAAU;AAAA,IACzB,sBAAsB,OAAO;AAAA,EAC/B,CAAC;AACD,YAAU,mBAAmB,aAAa,OAAO,IAAI;AACrD,SAAO;AACT;AACA,SAAS,cACP,WACA,aACA,QACA,OACA,mBAAmB,KACN;AACb,cAAY,gCAAgC;AAAA,IAC1C,eAAe,UAAU;AAAA,IACzB,sBAAsB;AAAA,IACtB,cAAc;AAAA,EAChB,CAAC;AACD,YAAU,mBAAmB,aAAa,WAAW,MAAM;AAC3D,SAAO,EAAE,MAAM,WAAW,aAAa,kBAAkB,MAAM;AACjE;AAEA,SAAS,UAAU,OAAwB;AACzC,MAAI,iBAAiB,uBAAwB,QAAO;AACpD,MAAI,iBAAiB,mCAAoC,QAAO;AAChE,MAAI,iBAAiB,0BAA2B,QAAO;AACvD,MAAI,iBAAiB,gBAAgB,MAAM,SAAS,eAAgB,QAAO;AAC3E,MAAI,iBAAiB,UAAW,QAAO;AACvC,MAAI,iBAAiB,YAAa,QAAO;AACzC,SAAO,iBAAiB,QAAQ,MAAM,OAAO;AAC/C;AAEA,SAAS,eAAe,QAA8B;AACpD,SAAO,IAAI,aAAa,EAAE,QAAQ,MAAM,kBAAkB,OAAO,aAAa,GAAG,MAAM;AACzF;;;ACxfO,IAAM,qBAAN,MAAM,oBAAmB;AAAA;AAAA,EAErB;AAAA;AAAA,EAEA;AAAA;AAAA,EAEA;AAAA;AAAA,EAEA;AAAA;AAAA,EAEA;AAAA;AAAA,EAEA;AAAA,EAED,YAAY,WAA6B;AAC/C,SAAK,UAAU,IAAI,kBAAkB,SAAS;AAC9C,SAAK,UAAU,IAAI,iBAAiB,SAAS;AAC7C,SAAK,YAAY,IAAI,oBAAoB,SAAS;AAClD,SAAK,SAAS,IAAI,gBAAgB,SAAS;AAC3C,SAAK,aAAa,IAAI,oBAAoB,SAAS;AACnD,SAAK,cAAc,IAAI,sBAAsB,SAAS;AAAA,EACxD;AAAA;AAAA,EAGA,OAAO,OAAO,OAA4D;AACxE,UAAM,UAAU,sBAAsB,MAAM,OAAO;AACnD,UAAM,SAAmB,MAA+B;AACxD,QAAI,OAAO,WAAW,YAAY,WAAW,QAAQ,EAAE,UAAU,WAAW,OAAO,OAAO,SAAS;AACjG,YAAM,IAAI,UAAU,kDAAkD;AACxE,QAAI,EAAE,WAAW,WAAW,OAAO,OAAO,UAAU;AAClD,YAAM,IAAI,UAAU,oCAAoC;AAC1D,kBAAc,OAAO,OAAO,cAAc;AAC1C,UAAM,UAAU,MAAM,SAAS,WAAW;AAC1C,UAAM,SAAS,MAAM;AACrB,UAAM,YACJ,WAAW,SACP,SACA;AAAA,MACE,MAAM,SAAS,QAAQ;AACrB,gBAAQ,QAAQ,SAAS,SAAS,MAAM;AAAA,MAC1C;AAAA,MACA,KAAK,SAAS,QAAQ;AACpB,gBAAQ,QAAQ,QAAQ,SAAS,EAAE,GAAG,QAAQ,SAAS,KAAK,CAAC;AAAA,MAC/D;AAAA,MACA,KAAK,SAAS,QAAQ;AACpB,gBAAQ,QAAQ,QAAQ,SAAS,MAAM;AAAA,MACzC;AAAA,IACF;AACN,UAAM,YAAY,IAAI,qBAAqB;AAAA,MACzC,WAAW,QAAQ;AAAA,MACnB,cAAc,QAAQ;AAAA,MACtB,OAAO;AAAA,MACP,GAAI,MAAM,aAAa,SAAY,CAAC,IAAI,EAAE,eAAe,MAAM,SAAS;AAAA,MACxE,GAAI,cAAc,SAAY,CAAC,IAAI,EAAE,QAAQ,UAAU;AAAA,IACzD,CAAC;AACD,UAAM,YAAY,IAAI,iBAAiB;AAAA,MACrC,GAAG;AAAA,MACH,QAAQ,MAAM;AAAA,MACd;AAAA,MACA;AAAA,MACA,GAAI,WAAW,SAAY,CAAC,IAAI,EAAE,OAAO;AAAA,IAC3C,CAAC;AACD,WAAO,IAAI,oBAAmB,SAAS;AAAA,EACzC;AACF;","names":["createHash","createHash","canonicalUuid","createHash","inspect","inspect","createHash","createHash","createHash","resolve","createHash","document","cancelBody","inspect","inspect","inspect","headerValues"]}