@armoriq/policy-ir 0.1.0

package/dist/index.js.map

@@ -0,0 +1 @@
+{"version":3,"sources":["../src/ir.ts","../src/canonical.ts","../src/hash.ts","../src/schema-hash.ts","../src/evaluate/input.ts","../src/evaluate/glob.ts","../src/evaluate/conditions.ts","../src/evaluate/select.ts","../src/evaluate/layers.ts","../src/evaluate/evaluate.ts","../src/document/parse.ts","../src/document/diagnostics.ts","../src/document/grammar.ts","../src/document/reader.ts","../src/document/validate.ts","../src/compile/port.ts","../src/compile/clamp.ts","../src/compile/lower-floors.ts","../src/compile/lower-conditions.ts","../src/compile/controls.ts","../src/compile/lower-rules.ts","../src/compile/report.ts","../src/compile/compile.ts","../src/compile/serialize.ts"],"sourcesContent":["/**\n * `armor.policy.v2` intermediate representation.\n *\n * Data, never a program: the same JSON is evaluated by conmap, the Armor CLI\n * daemon, the SDK pre-check and OPA. The document is the hashing and signing\n * boundary, so every field here is part of `policyHash` except `policyHash`.\n */\n\nexport const SCHEMA_VERSION = 'armor.policy.v2' as const;\n\nexport type Verdict = 'allow' | 'hold' | 'block';\n\n/** Where a document sits in the layering ladder. A boundary is a floor: it can only tighten. */\nexport type Layer = 'floor' | 'group' | 'agent' | 'member' | 'local';\n\nexport type PolicyTarget =\n  | { org: '*' }\n  | { group: string }\n  | { agent: string; mcpServers?: string[] }\n  | { device: 'local'; products?: string[] };\n\nexport interface Defaults {\n  tools: Verdict;\n  network: Verdict;\n  files: Verdict;\n  skills: Verdict;\n}\n\nexport interface Capture {\n  arguments: boolean;\n  redact: string[];\n  maxBytesPerCall: number;\n  sample: number;\n}\n\nexport type KeyTier = 'exact' | 'glob';\n\nexport type StatementMatch =\n  | { tool: string; keyTier: KeyTier; order: number }\n  | { capability: string };\n\nexport type ConditionOp =\n  | 'eq'\n  | 'ne'\n  | 'gt'\n  | 'gte'\n  | 'lt'\n  | 'lte'\n  | 'in'\n  | 'notIn'\n  | 'glob'\n  | 'regex'\n  | 'notRegex'\n  | 'startsWith'\n  | 'exists';\n\nexport interface SchemaBinding {\n  /** `sha256:` of the tool's canonical input schema at compile time; null when the inventory had none. */\n  schemaHash: string | null;\n}\n\nexport interface Condition {\n  /** Dotpath into the call: `args.amount`, `args.command.program`, `path`. */\n  field: string;\n  op: ConditionOp;\n  value?: unknown;\n  schemaBinding?: SchemaBinding;\n}\n\nexport interface Approval {\n  approvers: number;\n  roles?: string[];\n  members?: string[];\n  anyMember?: boolean;\n}\n\n/** Who a statement applies to. Absent means everyone the document targets. */\nexport type Subject =\n  | { membershipId: string }\n  | { email: string }\n  | { group: string }\n  | { product: string };\n\nexport interface Provenance {\n  ruleKey: string;\n  variant: number;\n  source: 'yaml' | 'converter' | 'compose' | 'settings-import';\n  layer: Layer;\n}\n\nexport interface Statement {\n  id: string;\n  subject: Subject | null;\n  match: StatementMatch;\n  effect: Verdict;\n  conditions: Condition[];\n  approval?: Approval;\n  /** ISO date-time, or the literal `never`. Always present. */\n  expiresAt: string | 'never';\n  controls?: string[];\n  provenance: Provenance;\n}\n\nexport interface PolicyDocument {\n  schemaVersion: typeof SCHEMA_VERSION;\n  policyId: string;\n  /** `sha256:` over the canonical document without this field. */\n  policyHash?: string;\n  target: PolicyTarget;\n  layer: Layer;\n  defaults: Defaults;\n  capture: Capture;\n  /** ISO date-time, or the literal `never`. Always present. */\n  expiresAt: string | 'never';\n  statements: Statement[];\n}\n\nexport function layerOfTarget(target: PolicyTarget): Layer {\n  if ('org' in target) return 'floor';\n  if ('group' in target) return 'group';\n  if ('agent' in target) return 'agent';\n  return 'local';\n}\n","/**\n * Canonical JSON: sorted keys, no whitespace, ASCII escapes for anything\n * outside printable ASCII. Byte-for-byte the rule the SDKs and the tool\n * inventory use for `schemaHash`, so the platform has one hashing rule.\n * Not RFC 8785. `undefined` object members are dropped; `undefined` and\n * `null` values both serialize as `null`.\n */\nexport function canonicalJson(value: unknown): string {\n  if (value === null || value === undefined) return 'null';\n  switch (typeof value) {\n    case 'number':\n      return canonicalNumber(value);\n    case 'boolean':\n      return value ? 'true' : 'false';\n    case 'string':\n      return escapeAscii(value);\n    case 'object':\n      return Array.isArray(value)\n        ? '[' + value.map(canonicalJson).join(',') + ']'\n        : canonicalObject(value as Record<string, unknown>);\n    default:\n      throw new TypeError(`unsupported type in canonical JSON: ${typeof value}`);\n  }\n}\n\nfunction canonicalNumber(value: number): string {\n  if (!Number.isFinite(value)) {\n    throw new TypeError('non-finite number is not valid in canonical JSON');\n  }\n  return JSON.stringify(value);\n}\n\nfunction canonicalObject(obj: Record<string, unknown>): string {\n  const keys = Object.keys(obj)\n    .filter((k) => obj[k] !== undefined)\n    .sort();\n  return '{' + keys.map((k) => escapeAscii(k) + ':' + canonicalJson(obj[k])).join(',') + '}';\n}\n\nconst SHORT_ESCAPES: Record<number, string> = {\n  0x08: '\\\\b',\n  0x09: '\\\\t',\n  0x0a: '\\\\n',\n  0x0c: '\\\\f',\n  0x0d: '\\\\r',\n  0x22: '\\\\\"',\n  0x5c: '\\\\\\\\',\n};\n\nfunction escapeAscii(s: string): string {\n  let out = '\"';\n  for (let i = 0; i < s.length; i++) {\n    const code = s.charCodeAt(i);\n    const short = SHORT_ESCAPES[code];\n    if (short !== undefined) out += short;\n    else if (code < 0x20 || code > 0x7e) out += '\\\\u' + code.toString(16).padStart(4, '0');\n    else out += s[i];\n  }\n  return out + '\"';\n}\n","import { createHash } from 'node:crypto';\nimport { canonicalJson } from './canonical.js';\nimport type { PolicyDocument } from './ir.js';\n\nexport const HASH_PREFIX = 'sha256:';\n\n/** `sha256:` over the canonical JSON of any value. */\nexport function sha256Canonical(value: unknown): string {\n  return HASH_PREFIX + createHash('sha256').update(canonicalJson(value), 'utf8').digest('hex');\n}\n\n/**\n * The document's hash: canonical JSON of the document with `policyHash`\n * removed. Stable across key order and whitespace; any change to a\n * statement, default, target or capture setting changes it. This is the\n * hashing and signing boundary shared by every runtime.\n */\nexport function policyHash(document: PolicyDocument): string {\n  const { policyHash: _omitted, ...rest } = document;\n  return sha256Canonical(rest);\n}\n\n/** True when `document.policyHash` is present and matches its content. */\nexport function verifyPolicyHash(document: PolicyDocument): boolean {\n  return typeof document.policyHash === 'string' && document.policyHash === policyHash(document);\n}\n","import { createHash } from 'node:crypto';\nimport { canonicalJson } from './canonical.js';\n\n/**\n * A tool's input schema reduced to what governs a call: annotations\n * (`description`, `title`) are dropped, local `$ref`s are resolved, and the\n * result is hashed in canonical form. Byte-for-byte the rule the SDKs and the\n * tool inventory use, pinned by the shared vectors, so a policy compiled\n * against a snapshot hash and a call carrying the live hash compare equal\n * only when the schema is the same.\n */\nexport function schemaHash(inputSchema: unknown): string | null {\n  if (inputSchema === null || inputSchema === undefined) return null;\n  const canonical = canonicalizeSchema(inputSchema, inputSchema, new Set());\n  return 'sha256:' + createHash('sha256').update(canonicalJson(canonical), 'utf8').digest('hex');\n}\n\n/** Keywords whose object value is a map of name → schema, never a schema itself. */\nconst SCHEMA_MAP_KEYWORDS = new Set([\n  'properties',\n  'patternProperties',\n  '$defs',\n  'definitions',\n  'dependentSchemas',\n]);\n\n/** Keywords whose value is data, copied verbatim. */\nconst DATA_KEYWORDS = new Set(['enum', 'const', 'default', 'examples']);\n\nconst ANNOTATION_KEYS = new Set(['description', 'title']);\n\ntype Seen = ReadonlySet<string>;\n\nfunction canonicalizeSchema(node: unknown, root: unknown, seen: Seen, isSchemaMap = false): unknown {\n  if (Array.isArray(node)) return node.map((item) => canonicalizeSchema(item, root, seen));\n  if (node === null || typeof node !== 'object') return node;\n  const obj = node as Record<string, unknown>;\n  if (isSchemaMap) return mapValues(obj, (v) => canonicalizeSchema(v, root, seen));\n  const ref = obj['$ref'];\n  if (typeof ref === 'string' && ref.startsWith('#')) return canonicalizeRef(obj, ref, root, seen);\n  return canonicalizeKeywords(obj, root, seen);\n}\n\nfunction canonicalizeKeywords(obj: Record<string, unknown>, root: unknown, seen: Seen): Record<string, unknown> {\n  const out: Record<string, unknown> = {};\n  for (const [k, v] of Object.entries(obj)) {\n    if (ANNOTATION_KEYS.has(k)) continue;\n    out[k] = DATA_KEYWORDS.has(k) ? v : canonicalizeSchema(v, root, seen, SCHEMA_MAP_KEYWORDS.has(k));\n  }\n  return out;\n}\n\n/** A cyclic or dangling `$ref` stays verbatim; a resolvable one is inlined, siblings winning over the target's keys. */\nfunction canonicalizeRef(obj: Record<string, unknown>, ref: string, root: unknown, seen: Seen): unknown {\n  if (seen.has(ref)) return { $ref: ref };\n  const target = resolvePointer(root, ref);\n  if (target === undefined) return { $ref: ref };\n  const next = new Set(seen);\n  next.add(ref);\n  const resolved = canonicalizeSchema(target, root, next);\n  const { $ref: _ref, ...siblings } = obj;\n  if (Object.keys(siblings).length === 0) return resolved;\n  const base = isPlainObject(resolved) ? { ...resolved } : { $ref: ref };\n  return Object.assign(base, canonicalizeKeywords(siblings, root, next));\n}\n\nfunction resolvePointer(root: unknown, ref: string): unknown {\n  if (ref === '#') return root;\n  if (!ref.startsWith('#/')) return undefined;\n  let node: unknown = root;\n  for (const rawSeg of ref.slice(2).split('/')) {\n    const seg = decodeURIComponent(rawSeg).replace(/~1/g, '/').replace(/~0/g, '~');\n    node = childOf(node, seg);\n    if (node === undefined) return undefined;\n  }\n  return node;\n}\n\nfunction childOf(node: unknown, seg: string): unknown {\n  if (node === null || typeof node !== 'object') return undefined;\n  return Array.isArray(node) ? node[Number(seg)] : (node as Record<string, unknown>)[seg];\n}\n\nfunction isPlainObject(value: unknown): value is Record<string, unknown> {\n  return value !== null && typeof value === 'object' && !Array.isArray(value);\n}\n\nfunction mapValues(obj: Record<string, unknown>, fn: (v: unknown) => unknown): Record<string, unknown> {\n  const out: Record<string, unknown> = {};\n  for (const [k, v] of Object.entries(obj)) out[k] = fn(v);\n  return out;\n}\n","import type { Approval, Layer, Verdict } from '../ir.js';\n\nexport interface Principal {\n  membershipId?: string;\n  email?: string;\n  groups?: string[];\n  /** The local agent making the call, for a `products:` overlay. */\n  product?: string;\n}\n\n/** One call, as the enforce path and the local hook both see it. */\nexport interface CallInput {\n  tool: string;\n  arguments: Record<string, unknown>;\n  /**\n   * Derived fields a host may supply: `path`, `program`, `command`,\n   * `writeRedirection`, `withinWorkspace`, `url`, `host`, `skill`, `env`.\n   * Globs are literal, so a host writes `path` home-relative (`~/.ssh/id_rsa`)\n   * when the path is under the user's home; `files.deny: [\"~/.ssh/**\"]` then\n   * matches exactly what the author wrote.\n   */\n  derived?: Record<string, unknown>;\n  /** Capability tags the inventory holds for this tool. */\n  capabilities?: string[];\n  /** The tool's live input-schema hash, when the caller knows it. */\n  schemaHash?: string | null;\n  member?: Principal;\n  /** ISO date-time the call is evaluated at. */\n  timestamp: string;\n}\n\nexport interface SchemaDriftObligation {\n  type: 'schema_drift';\n  statementId: string;\n  bound: string;\n  observed: string | null;\n}\n\nexport type Obligation = SchemaDriftObligation;\n\nexport interface VerdictProvenance {\n  policyId: string;\n  statementId: string | null;\n  ruleKey: string;\n  variant: number;\n  layer: Layer;\n}\n\nexport interface Evaluation {\n  verdict: Verdict;\n  /** The floor's own verdict, so a caller can tell a floor block from a rule block. */\n  floorVerdict: Verdict | null;\n  approval: Approval | null;\n  obligations: Obligation[];\n  provenance: VerdictProvenance;\n}\n\nexport const VERDICT_RANK: Record<Verdict, number> = { allow: 0, hold: 1, block: 2 };\n\nexport function stricter(a: Verdict, b: Verdict): Verdict {\n  return VERDICT_RANK[a] >= VERDICT_RANK[b] ? a : b;\n}\n","/**\n * Glob matching for tool keys and paths. `*` matches any run of characters\n * except `/`; `**` matches across `/`; `?` matches one character. Tool keys\n * carry no `/`, so `*` spans the whole name there. Anchored at both ends.\n */\nexport function globToRegExp(pattern: string): RegExp {\n  let source = '^';\n  for (let i = 0; i < pattern.length; i++) {\n    const ch = pattern[i]!;\n    if (ch === '*') {\n      const double = pattern[i + 1] === '*';\n      source += double ? '.*' : '[^/]*';\n      if (double) i++;\n    } else if (ch === '?') {\n      source += '[^/]';\n    } else {\n      source += escapeRegExp(ch);\n    }\n  }\n  return new RegExp(source + '$');\n}\n\nexport function matchGlob(pattern: string, value: string): boolean {\n  return globToRegExp(pattern).test(value);\n}\n\nexport function isGlob(key: string): boolean {\n  return key.includes('*') || key.includes('?');\n}\n\nfunction escapeRegExp(ch: string): string {\n  return /[\\\\^$.|?*+()[\\]{}]/.test(ch) ? '\\\\' + ch : ch;\n}\n","import type { Condition } from '../ir.js';\nimport { matchGlob } from './glob.js';\nimport type { CallInput } from './input.js';\n\n/**\n * Resolve a dotpath against the call. `args.*` reads `arguments`; any other\n * root reads the host-derived fields. `undefined` means absent, and an absent\n * field fails the condition rather than throwing or matching.\n */\nexport function resolveField(input: CallInput, field: string): unknown {\n  const [root, ...rest] = field.split('.');\n  const base = root === 'args' ? input.arguments : input.derived?.[root ?? ''];\n  return rest.reduce<unknown>(childOf, base);\n}\n\nfunction childOf(node: unknown, key: string): unknown {\n  if (node === null || typeof node !== 'object') return undefined;\n  return (node as Record<string, unknown>)[key];\n}\n\nexport function conditionsHold(input: CallInput, conditions: Condition[]): boolean {\n  return conditions.every((c) => conditionHolds(input, c));\n}\n\nexport function conditionHolds(input: CallInput, condition: Condition): boolean {\n  const actual = resolveField(input, condition.field);\n  if (condition.op === 'exists') return (actual !== undefined) === (condition.value ?? true);\n  if (actual === undefined) return false;\n  return compare(condition.op, actual, condition.value);\n}\n\ntype Comparator = (actual: unknown, expected: unknown) => boolean;\n\nconst COMPARATORS: Record<Exclude<Condition['op'], 'exists'>, Comparator> = {\n  eq: (a, e) => a === e,\n  ne: (a, e) => a !== e,\n  gt: (a, e) => numeric(a, e, (x, y) => x > y),\n  gte: (a, e) => numeric(a, e, (x, y) => x >= y),\n  lt: (a, e) => numeric(a, e, (x, y) => x < y),\n  lte: (a, e) => numeric(a, e, (x, y) => x <= y),\n  in: (a, e) => Array.isArray(e) && e.includes(a),\n  notIn: (a, e) => Array.isArray(e) && !e.includes(a),\n  glob: (a, e) => strings(a, e, (x, y) => matchGlob(y, x)),\n  regex: (a, e) => strings(a, e, (x, y) => new RegExp(y).test(x)),\n  notRegex: (a, e) => strings(a, e, (x, y) => !new RegExp(y).test(x)),\n  startsWith: (a, e) => strings(a, e, (x, y) => x.startsWith(y)),\n};\n\nfunction compare(op: Exclude<Condition['op'], 'exists'>, actual: unknown, expected: unknown): boolean {\n  return COMPARATORS[op](actual, expected);\n}\n\nfunction strings(a: unknown, e: unknown, test: (x: string, y: string) => boolean): boolean {\n  return typeof a === 'string' && typeof e === 'string' && test(a, e);\n}\n\nfunction numeric(a: unknown, e: unknown, test: (x: number, y: number) => boolean): boolean {\n  return typeof a === 'number' && typeof e === 'number' && test(a, e);\n}\n","import type { Statement } from '../ir.js';\nimport { isGlob, matchGlob } from './glob.js';\n\n/**\n * Key selection: an exact key beats any glob, a longer glob beats a shorter\n * one. Two same-length globs matching one tool are rejected at compile time;\n * here the first in document order wins so evaluation stays deterministic.\n */\nexport function selectRuleKey(statements: Statement[], tool: string): string | null {\n  let best: string | null = null;\n  for (const key of ruleKeysOf(statements)) {\n    if (!keyMatches(key, tool)) continue;\n    if (best === null || keyBeats(key, best)) best = key;\n  }\n  return best;\n}\n\nfunction ruleKeysOf(statements: Statement[]): Set<string> {\n  const keys = new Set<string>();\n  for (const s of statements) if ('tool' in s.match) keys.add(s.match.tool);\n  return keys;\n}\n\nfunction keyMatches(key: string, tool: string): boolean {\n  return isGlob(key) ? matchGlob(key, tool) : key === tool;\n}\n\nfunction keyBeats(candidate: string, incumbent: string): boolean {\n  const candidateGlob = isGlob(candidate);\n  const incumbentGlob = isGlob(incumbent);\n  if (candidateGlob !== incumbentGlob) return !candidateGlob;\n  return candidate.length > incumbent.length;\n}\n\n/** The variants of one rule key in declared order. */\nexport function variantsOf(statements: Statement[], ruleKey: string): Statement[] {\n  return statements\n    .filter((s) => 'tool' in s.match && s.match.tool === ruleKey)\n    .sort((a, b) => ('tool' in a.match && 'tool' in b.match ? a.match.order - b.match.order : 0));\n}\n\nexport function capabilityStatements(statements: Statement[], tags: string[]): Statement[] {\n  return statements.filter((s) => 'capability' in s.match && tags.includes(s.match.capability));\n}\n","import type { PolicyDocument, Statement, Subject } from '../ir.js';\nimport { conditionsHold } from './conditions.js';\nimport type { CallInput, Obligation, Principal } from './input.js';\nimport { stricter } from './input.js';\nimport { capabilityStatements, selectRuleKey, variantsOf } from './select.js';\n\nexport interface LayerDecision {\n  statement: Statement;\n  obligations: Obligation[];\n}\n\n/** A document contributes nothing once its own expiry has passed. */\nexport function isLive(expiresAt: string, timestamp: string): boolean {\n  return expiresAt === 'never' || Date.parse(expiresAt) > Date.parse(timestamp);\n}\n\nexport function liveStatements(doc: PolicyDocument, input: CallInput): Statement[] {\n  if (!isLive(doc.expiresAt, input.timestamp)) return [];\n  return doc.statements.filter((s) => isLive(s.expiresAt, input.timestamp));\n}\n\n/**\n * The member scope that applies to the principal: membershipId beats email\n * beats group. One scope wins; its statements are the member overlay.\n */\nexport function memberScope(statements: Statement[], principal: Principal | undefined): Statement[] {\n  if (!principal) return [];\n  const subjects = statements.map((s) => s.subject).filter((s): s is Subject => s !== null);\n  const winner = strongestSubject(subjects, principal);\n  return winner ? statements.filter((s) => s.subject !== null && sameSubject(s.subject, winner)) : [];\n}\n\nfunction strongestSubject(subjects: Subject[], principal: Principal): Subject | null {\n  const byId = subjects.find((s) => 'membershipId' in s && s.membershipId === principal.membershipId);\n  if (byId) return byId;\n  const email = principal.email?.toLowerCase();\n  const byEmail = subjects.find((s) => 'email' in s && s.email.toLowerCase() === email);\n  if (byEmail) return byEmail;\n  const groups = principal.groups ?? [];\n  const byGroup = subjects.find((s) => 'group' in s && groups.includes(s.group));\n  if (byGroup) return byGroup;\n  return subjects.find((s) => 'product' in s && s.product === principal.product) ?? null;\n}\n\nfunction sameSubject(a: Subject, b: Subject): boolean {\n  return JSON.stringify(a) === JSON.stringify(b);\n}\n\n/**\n * One layer's decision for the call: the first matching variant of the\n * selected rule key, tightened by any matching capability statement whose\n * conditions hold. Null when the layer is silent on this tool.\n */\nexport function decideLayer(statements: Statement[], input: CallInput): LayerDecision | null {\n  const ruleDecision = decideRule(statements, input);\n  const capability = decideCapabilities(statements, input);\n  if (!ruleDecision) return capability;\n  if (!capability) return ruleDecision;\n  return stricter(capability.statement.effect, ruleDecision.statement.effect) === ruleDecision.statement.effect\n    ? ruleDecision\n    : capability;\n}\n\nfunction decideRule(statements: Statement[], input: CallInput): LayerDecision | null {\n  const key = selectRuleKey(statements, input.tool);\n  if (key === null) return null;\n  const winner = variantsOf(statements, key).find((v) => conditionsHold(input, v.conditions));\n  return winner ? { statement: winner, obligations: driftObligations(winner, input) } : null;\n}\n\nfunction decideCapabilities(statements: Statement[], input: CallInput): LayerDecision | null {\n  const matching = capabilityStatements(statements, input.capabilities ?? []).filter((s) =>\n    conditionsHold(input, s.conditions),\n  );\n  let best: Statement | null = null;\n  for (const s of matching) {\n    if (!best || stricter(s.effect, best.effect) === s.effect) best = s;\n  }\n  return best ? { statement: best, obligations: [] } : null;\n}\n\n/** A bound schema that differs from the live one still evaluates by name and says so. */\nfunction driftObligations(statement: Statement, input: CallInput): Obligation[] {\n  if (input.schemaHash === undefined) return [];\n  const drifted = statement.conditions\n    .map((c) => c.schemaBinding?.schemaHash ?? null)\n    .filter((bound): bound is string => bound !== null && bound !== input.schemaHash);\n  return drifted.map((bound) => ({\n    type: 'schema_drift',\n    statementId: statement.id,\n    bound,\n    observed: input.schemaHash ?? null,\n  }));\n}\n","import type { PolicyDocument, Statement, Verdict } from '../ir.js';\nimport type { CallInput, Evaluation, VerdictProvenance } from './input.js';\nimport { stricter } from './input.js';\nimport { decideLayer, liveStatements, memberScope, type LayerDecision } from './layers.js';\n\n/**\n * The documents bound to one target. At most one per layer, enforced by the\n * single-active trigger; the floor is the organization's.\n */\nexport interface BoundDocuments {\n  floor?: PolicyDocument;\n  group?: PolicyDocument;\n  agent?: PolicyDocument;\n}\n\n/**\n * Four stages over four layers (PRD §7.4):\n *   1. floor: a floor block ends evaluation; otherwise its verdict is retained\n *   2. resolve: the member scope inside the most specific document\n *   3. candidate: member rule, then agent, then group, then the most specific tools.default\n *   4. merge: the stricter of floor and candidate\n */\nexport function evaluate(input: CallInput, bound: BoundDocuments): Evaluation {\n  const floor = decideFloor(bound.floor, input);\n  if (floor?.statement.effect === 'block') return fromDecision(floor, bound.floor!, 'floor');\n\n  const candidate = decideCandidate(input, bound);\n  const floorVerdict = floor?.statement.effect ?? null;\n  if (floorVerdict && stricter(floorVerdict, candidate.verdict) !== candidate.verdict) {\n    return { ...fromDecision(floor!, bound.floor!, 'floor'), floorVerdict };\n  }\n  return { ...candidate, floorVerdict };\n}\n\nfunction decideFloor(doc: PolicyDocument | undefined, input: CallInput): LayerDecision | null {\n  if (!doc) return null;\n  return decideLayer(liveStatements(doc, input).filter((s) => s.subject === null), input);\n}\n\nfunction decideCandidate(input: CallInput, bound: BoundDocuments): Evaluation {\n  for (const doc of [bound.agent, bound.group]) {\n    if (!doc) continue;\n    const statements = liveStatements(doc, input);\n    const member = decideLayer(memberScope(statements, input.member), input);\n    if (member) return fromDecision(member, doc, 'member');\n    const own = decideLayer(statements.filter((s) => s.subject === null), input);\n    if (own) return fromDecision(own, doc, doc.layer);\n  }\n  return fromDefault(mostSpecific(bound));\n}\n\nfunction mostSpecific(bound: BoundDocuments): PolicyDocument {\n  const doc = bound.agent ?? bound.group ?? bound.floor;\n  if (!doc) throw new Error('evaluate: no document is bound to the target');\n  return doc;\n}\n\nfunction fromDecision(decision: LayerDecision, doc: PolicyDocument, layer: VerdictProvenance['layer']): Evaluation {\n  const { statement } = decision;\n  return {\n    verdict: statement.effect,\n    floorVerdict: null,\n    approval: statement.approval ?? null,\n    obligations: decision.obligations,\n    provenance: provenanceOf(statement, doc.policyId, layer),\n  };\n}\n\nfunction provenanceOf(statement: Statement, policyId: string, layer: VerdictProvenance['layer']): VerdictProvenance {\n  return {\n    policyId,\n    statementId: statement.id,\n    ruleKey: statement.provenance.ruleKey,\n    variant: statement.provenance.variant,\n    layer,\n  };\n}\n\n/** An unmatched tool lands on the most specific document's `tools.default`, never on a wildcard. */\nfunction fromDefault(doc: PolicyDocument): Evaluation {\n  const verdict: Verdict = doc.defaults.tools;\n  return {\n    verdict,\n    floorVerdict: null,\n    approval: null,\n    obligations: [],\n    provenance: { policyId: doc.policyId, statementId: null, ruleKey: 'tools.default', variant: -1, layer: doc.layer },\n  };\n}\n","import { parse as parseYamlText } from 'yaml';\nimport type { Approval } from '../ir.js';\nimport { Diagnostics } from './diagnostics.js';\nimport {\n  type ConditionSpec,\n  type NetworkEntry,\n  type Overlay,\n  type PolicySource,\n  type PolicySpec,\n  type RuleValue,\n  type RuleVariant,\n  SOURCE_OPERATORS,\n  type SourceTarget,\n  type ToolsSection,\n} from './grammar.js';\nimport { Reader, isPlainObject } from './reader.js';\n\nexport interface ParseResult {\n  source: PolicySource | null;\n  diagnostics: Diagnostics;\n}\n\n/** Parse `armor.io/v2` YAML text strictly. */\nexport function parseYaml(text: string): ParseResult {\n  const diag = new Diagnostics();\n  let value: unknown;\n  try {\n    value = parseYamlText(text);\n  } catch (error) {\n    diag.error('yaml_syntax', '', (error as Error).message);\n    return { source: null, diagnostics: diag };\n  }\n  return parseValue(value, diag);\n}\n\n/** Parse an already-loaded YAML/JSON value strictly. */\nexport function parseDocument(value: unknown): ParseResult {\n  return parseValue(value, new Diagnostics());\n}\n\nconst ROOT_KEYS = ['apiVersion', 'kind', 'metadata', 'target', 'precedence', 'spec'] as const;\nconst SPEC_KEYS = ['tools', 'files', 'network', 'skills', 'secrets', 'members', 'products', 'capture', 'approvalDefaults', 'expiresAt'] as const;\nconst VARIANT_KEYS = ['action', 'when', 'approval', 'reason', 'controls', 'expiresAt'] as const;\n\nfunction parseValue(value: unknown, diag: Diagnostics): ParseResult {\n  const r = new Reader(diag);\n  const root = r.object(value, '', ROOT_KEYS);\n  if (!root) return { source: null, diagnostics: diag };\n  if (root.apiVersion !== 'armor.io/v2') diag.error('unsupported_api_version', '/apiVersion', `expected armor.io/v2`);\n  if (root.kind !== 'Policy') diag.error('unsupported_kind', '/kind', `expected Policy`);\n  const metadata = parseMetadata(r, root.metadata);\n  const target = parseTarget(r, diag, root.target);\n  const precedence = parsePrecedence(diag, root.precedence);\n  const spec = parseSpec(r, diag, root.spec);\n  if (diag.hasErrors || !metadata || !target || !spec) return { source: null, diagnostics: diag };\n  const source: PolicySource = { apiVersion: 'armor.io/v2', kind: 'Policy', metadata, target, spec };\n  if (precedence) source.precedence = precedence;\n  return { source, diagnostics: diag };\n}\n\nfunction parseMetadata(r: Reader, value: unknown): PolicySource['metadata'] | null {\n  const m = r.object(value, '/metadata', ['name', 'description', 'orgId', 'labels']);\n  if (!m) return null;\n  const name = r.string(m.name, '/metadata/name');\n  if (!name) return null;\n  const out: PolicySource['metadata'] = { name };\n  const description = r.optionalString(m.description, '/metadata/description');\n  const orgId = r.optionalString(m.orgId, '/metadata/orgId');\n  if (description) out.description = description;\n  if (orgId) out.orgId = orgId;\n  if (m.labels !== undefined) out.labels = parseLabels(r, m.labels);\n  return out;\n}\n\nfunction parseLabels(r: Reader, value: unknown): Record<string, string> {\n  const labels = r.map(value, '/metadata/labels') ?? {};\n  const out: Record<string, string> = {};\n  for (const [k, v] of Object.entries(labels)) {\n    const s = r.string(v, `/metadata/labels/${k}`);\n    if (s) out[k] = s;\n  }\n  return out;\n}\n\nconst TARGET_FORMS = ['agent', 'group', 'org', 'device'] as const;\n\nfunction parseTarget(r: Reader, diag: Diagnostics, value: unknown): SourceTarget | null {\n  const t = r.object(value, '/target', ['agent', 'mcpServers', 'group', 'org', 'device']);\n  if (!t) return null;\n  const forms = TARGET_FORMS.filter((f) => t[f] !== undefined);\n  if (forms.length !== 1) {\n    diag.error('target_form', '/target', `exactly one of agent, group, org or device is required; got ${forms.length}`);\n    return null;\n  }\n  return targetOf(r, diag, t, forms[0]!);\n}\n\nfunction targetOf(r: Reader, diag: Diagnostics, t: Record<string, unknown>, form: (typeof TARGET_FORMS)[number]): SourceTarget | null {\n  if (form === 'org' || form === 'device') return fixedTarget(diag, t, form);\n  if (t.mcpServers !== undefined && form !== 'agent') diag.error('unknown_key', '/target/mcpServers', 'mcpServers belongs to an agent target');\n  const id = r.string(t[form], `/target/${form}`);\n  if (!id) return null;\n  if (form === 'group') return { group: id };\n  const servers = r.strings(t.mcpServers, '/target/mcpServers');\n  return servers ? { agent: id, mcpServers: servers } : { agent: id };\n}\n\nconst FIXED_TARGETS = {\n  org: { value: '*', code: 'target_org', message: 'the organization floor is written as org: \"*\"' },\n  device: { value: 'local', code: 'target_device', message: 'the only device target is local' },\n} as const;\n\nfunction fixedTarget(diag: Diagnostics, t: Record<string, unknown>, form: 'org' | 'device'): SourceTarget | null {\n  const expected = FIXED_TARGETS[form];\n  if (t[form] === expected.value) return form === 'org' ? { org: '*' } : { device: 'local' };\n  diag.error(expected.code, `/target/${form}`, expected.message);\n  return null;\n}\n\nfunction parsePrecedence(diag: Diagnostics, value: unknown): PolicySource['precedence'] | undefined {\n  if (value === undefined || value === 'device-first' || value === 'agent-first') return value as PolicySource['precedence'];\n  diag.error('expected_precedence', '/precedence', 'expected device-first or agent-first');\n  return undefined;\n}\n\nfunction parseSpec(r: Reader, diag: Diagnostics, value: unknown): PolicySpec | null {\n  const s = r.object(value, '/spec', SPEC_KEYS);\n  if (!s) return null;\n  const tools = parseTools(r, diag, s.tools, '/spec/tools');\n  if (!tools) return null;\n  const spec: PolicySpec = { tools, expiresAt: r.expiresAt(s.expiresAt, '/spec/expiresAt') };\n  assign(spec, 'files', parseFiles(r, s.files));\n  assign(spec, 'network', parseNetwork(r, s.network));\n  assign(spec, 'skills', parseSkills(r, s.skills));\n  assign(spec, 'secrets', parseSecrets(r, s.secrets));\n  assign(spec, 'members', parseOverlays(r, diag, s.members, '/spec/members'));\n  assign(spec, 'products', parseOverlays(r, diag, s.products, '/spec/products'));\n  assign(spec, 'capture', parseCapture(r, s.capture));\n  assign(spec, 'approvalDefaults', parseApproval(r, s.approvalDefaults, '/spec/approvalDefaults'));\n  return spec;\n}\n\nfunction assign<K extends keyof PolicySpec>(spec: PolicySpec, key: K, value: PolicySpec[K] | undefined): void {\n  if (value !== undefined) spec[key] = value;\n}\n\nfunction parseTools(r: Reader, diag: Diagnostics, value: unknown, path: string): ToolsSection | null {\n  const t = r.object(value, path, ['default', 'rules']);\n  if (!t) return null;\n  const dflt = r.verdict(t.default, `${path}/default`);\n  if (!dflt) return null;\n  const rules = parseRules(r, diag, t.rules, `${path}/rules`);\n  return rules ? { default: dflt, rules } : { default: dflt };\n}\n\nfunction parseRules(r: Reader, diag: Diagnostics, value: unknown, path: string): Record<string, RuleValue> | undefined {\n  if (value === undefined) return undefined;\n  const map = r.map(value, path);\n  if (!map) return undefined;\n  const out: Record<string, RuleValue> = {};\n  for (const [key, rule] of Object.entries(map)) {\n    const parsed = parseRule(r, diag, rule, `${path}/${key}`);\n    if (parsed) out[key] = parsed;\n  }\n  return out;\n}\n\n/** A scalar verdict is one unconditional variant; a list is ordered variants. */\nfunction parseRule(r: Reader, diag: Diagnostics, value: unknown, path: string): RuleValue | null {\n  if (typeof value === 'string') {\n    const v = r.verdict(value, path);\n    return v ? [{ action: v, expiresAt: 'never' }] : null;\n  }\n  if (!Array.isArray(value)) {\n    diag.error('expected_rule', path, 'expected a verdict or a list of variants');\n    return null;\n  }\n  const variants = value.map((v, i) => parseVariant(r, diag, v, `${path}/${i}`));\n  return variants.every((v): v is RuleVariant => v !== null) ? variants : null;\n}\n\nfunction parseVariant(r: Reader, diag: Diagnostics, value: unknown, path: string): RuleVariant | null {\n  const v = r.object(value, path, VARIANT_KEYS);\n  if (!v) return null;\n  const action = r.verdict(v.action, `${path}/action`);\n  if (!action) return null;\n  const variant: RuleVariant = { action, expiresAt: r.expiresAt(v.expiresAt, `${path}/expiresAt`) };\n  const when = parseWhen(r, diag, v.when, `${path}/when`);\n  const approval = parseApproval(r, v.approval, `${path}/approval`);\n  const reason = r.optionalString(v.reason, `${path}/reason`);\n  const controls = r.strings(v.controls, `${path}/controls`);\n  if (when) variant.when = when;\n  if (approval) variant.approval = approval;\n  if (reason) variant.reason = reason;\n  if (controls) variant.controls = controls;\n  return variant;\n}\n\nfunction parseWhen(r: Reader, diag: Diagnostics, value: unknown, path: string): Record<string, ConditionSpec> | undefined {\n  if (value === undefined) return undefined;\n  const map = r.map(value, path);\n  if (!map) return undefined;\n  const out: Record<string, ConditionSpec> = {};\n  for (const [field, spec] of Object.entries(map)) {\n    const cond = parseCondition(r, diag, spec, `${path}/${field}`);\n    if (cond) out[field] = cond;\n  }\n  return out;\n}\n\nfunction parseCondition(r: Reader, diag: Diagnostics, value: unknown, path: string): ConditionSpec | null {\n  const c = r.object(value, path, SOURCE_OPERATORS);\n  if (!c) return null;\n  const ops = Object.keys(c);\n  if (ops.length !== 1) {\n    diag.error('condition_operator', path, `exactly one operator is required; got ${ops.length}`);\n    return null;\n  }\n  return c as ConditionSpec;\n}\n\nfunction parseApproval(r: Reader, value: unknown, path: string): Approval | undefined {\n  if (value === undefined) return undefined;\n  const a = r.object(value, path, ['approvers', 'roles', 'members', 'anyMember']);\n  if (!a) return undefined;\n  const approvers = r.number(a.approvers, `${path}/approvers`);\n  const out: Approval = { approvers: approvers ?? 1 };\n  const roles = r.strings(a.roles, `${path}/roles`);\n  const members = r.strings(a.members, `${path}/members`);\n  const anyMember = r.boolean(a.anyMember, `${path}/anyMember`);\n  if (roles) out.roles = roles;\n  if (members) out.members = members;\n  if (anyMember !== undefined) out.anyMember = anyMember;\n  return out;\n}\n\nfunction parseFiles(r: Reader, value: unknown): PolicySpec['files'] | undefined {\n  if (value === undefined) return undefined;\n  const f = r.object(value, '/spec/files', ['deny', 'allowOutsideWorkspace']);\n  if (!f) return undefined;\n  const out: NonNullable<PolicySpec['files']> = {};\n  const deny = r.strings(f.deny, '/spec/files/deny');\n  const outside = r.boolean(f.allowOutsideWorkspace, '/spec/files/allowOutsideWorkspace');\n  if (deny) out.deny = deny;\n  if (outside !== undefined) out.allowOutsideWorkspace = outside;\n  return out;\n}\n\nfunction parseNetwork(r: Reader, value: unknown): PolicySpec['network'] | undefined {\n  if (value === undefined) return undefined;\n  const n = r.object(value, '/spec/network', ['default', 'allow', 'deny']);\n  if (!n) return undefined;\n  const out: NonNullable<PolicySpec['network']> = {};\n  const dflt = r.optionalVerdict(n.default, '/spec/network/default');\n  const allow = parseNetworkEntries(r, n.allow, '/spec/network/allow');\n  const deny = parseNetworkEntries(r, n.deny, '/spec/network/deny');\n  if (dflt) out.default = dflt;\n  if (allow) out.allow = allow;\n  if (deny) out.deny = deny;\n  return out;\n}\n\nfunction parseNetworkEntries(r: Reader, value: unknown, path: string): NetworkEntry[] | undefined {\n  if (value === undefined) return undefined;\n  if (!Array.isArray(value)) {\n    r.strings(value, path);\n    return undefined;\n  }\n  const out: NetworkEntry[] = [];\n  value.forEach((entry, i) => {\n    if (typeof entry === 'string') return void out.push(entry);\n    const e = r.object(entry, `${path}/${i}`, ['host', 'reason']);\n    const host = e ? r.string(e.host, `${path}/${i}/host`) : null;\n    if (e && host) out.push(e.reason === undefined ? { host } : { host, reason: String(e.reason) });\n  });\n  return out;\n}\n\nfunction parseSkills(r: Reader, value: unknown): PolicySpec['skills'] | undefined {\n  if (value === undefined) return undefined;\n  const s = r.object(value, '/spec/skills', ['default', 'hold', 'block']);\n  if (!s) return undefined;\n  const out: NonNullable<PolicySpec['skills']> = {};\n  const dflt = r.optionalVerdict(s.default, '/spec/skills/default');\n  const hold = r.strings(s.hold, '/spec/skills/hold');\n  const block = r.strings(s.block, '/spec/skills/block');\n  if (dflt) out.default = dflt;\n  if (hold) out.hold = hold;\n  if (block) out.block = block;\n  return out;\n}\n\nfunction parseSecrets(r: Reader, value: unknown): PolicySpec['secrets'] | undefined {\n  if (value === undefined) return undefined;\n  const s = r.object(value, '/spec/secrets', ['envBlocklist']);\n  if (!s) return undefined;\n  const envBlocklist = r.strings(s.envBlocklist, '/spec/secrets/envBlocklist');\n  return envBlocklist ? { envBlocklist } : {};\n}\n\nfunction parseOverlays(r: Reader, diag: Diagnostics, value: unknown, path: string): Record<string, Overlay> | undefined {\n  if (value === undefined) return undefined;\n  const map = r.map(value, path);\n  if (!map) return undefined;\n  const out: Record<string, Overlay> = {};\n  for (const [key, overlay] of Object.entries(map)) {\n    const parsed = parseOverlay(r, diag, overlay, `${path}/${key}`);\n    if (parsed) out[key] = parsed;\n  }\n  return out;\n}\n\nfunction parseOverlay(r: Reader, diag: Diagnostics, value: unknown, path: string): Overlay | null {\n  const o = r.object(value, path, ['tools', 'expiresAt']);\n  if (!o) return null;\n  const overlay: Overlay = { expiresAt: r.expiresAt(o.expiresAt, `${path}/expiresAt`) };\n  if (o.tools === undefined) return overlay;\n  const t = r.object(o.tools, `${path}/tools`, ['default', 'rules']);\n  if (!t) return overlay;\n  const tools: NonNullable<Overlay['tools']> = {};\n  const dflt = r.optionalVerdict(t.default, `${path}/tools/default`);\n  const rules = parseRules(r, diag, t.rules, `${path}/tools/rules`);\n  if (dflt) tools.default = dflt;\n  if (rules) tools.rules = rules;\n  overlay.tools = tools;\n  return overlay;\n}\n\nfunction parseCapture(r: Reader, value: unknown): PolicySpec['capture'] | undefined {\n  if (value === undefined) return undefined;\n  const c = r.object(value, '/spec/capture', ['arguments', 'redact', 'maxBytesPerCall', 'sample']);\n  if (!c) return undefined;\n  const out: NonNullable<PolicySpec['capture']> = {};\n  const args = r.boolean(c.arguments, '/spec/capture/arguments');\n  const redact = r.strings(c.redact, '/spec/capture/redact');\n  const max = r.number(c.maxBytesPerCall, '/spec/capture/maxBytesPerCall');\n  const sample = r.number(c.sample, '/spec/capture/sample');\n  if (args !== undefined) out.arguments = args;\n  if (redact) out.redact = redact;\n  if (max !== undefined) out.maxBytesPerCall = max;\n  if (sample !== undefined) out.sample = sample;\n  return out;\n}\n\nexport { isPlainObject };\n","export type Severity = 'error' | 'warning';\n\nexport interface Diagnostic {\n  code: string;\n  severity: Severity;\n  /** JSON-pointer-like path into the source document, `/spec/tools/rules/Bash/0`. */\n  path: string;\n  message: string;\n}\n\nexport class Diagnostics {\n  readonly items: Diagnostic[] = [];\n\n  error(code: string, path: string, message: string): void {\n    this.items.push({ code, severity: 'error', path, message });\n  }\n\n  warning(code: string, path: string, message: string): void {\n    this.items.push({ code, severity: 'warning', path, message });\n  }\n\n  get hasErrors(): boolean {\n    return this.items.some((d) => d.severity === 'error');\n  }\n}\n","import type { Approval, Verdict } from '../ir.js';\n\n/** The `armor.io/v2` source document after strict parsing, before lowering. */\nexport interface PolicySource {\n  apiVersion: 'armor.io/v2';\n  kind: 'Policy';\n  metadata: { name: string; description?: string; orgId?: string; labels?: Record<string, string> };\n  target: SourceTarget;\n  precedence?: 'device-first' | 'agent-first';\n  spec: PolicySpec;\n}\n\nexport type SourceTarget =\n  | { agent: string; mcpServers?: string[] }\n  | { group: string }\n  | { org: '*' }\n  | { device: 'local' };\n\nexport interface PolicySpec {\n  tools: ToolsSection;\n  files?: { deny?: string[]; allowOutsideWorkspace?: boolean };\n  network?: { default?: Verdict; allow?: NetworkEntry[]; deny?: NetworkEntry[] };\n  skills?: { default?: Verdict; hold?: string[]; block?: string[] };\n  secrets?: { envBlocklist?: string[] };\n  members?: Record<string, Overlay>;\n  products?: Record<string, Overlay>;\n  capture?: { arguments?: boolean; redact?: string[]; maxBytesPerCall?: number; sample?: number };\n  approvalDefaults?: Approval;\n  expiresAt: string;\n}\n\nexport type NetworkEntry = string | { host: string; reason?: string };\n\nexport interface ToolsSection {\n  default: Verdict;\n  rules?: Record<string, RuleValue>;\n}\n\nexport interface Overlay {\n  tools?: { default?: Verdict; rules?: Record<string, RuleValue> };\n  expiresAt: string;\n}\n\n/** A scalar verdict is shorthand for one unconditional variant. */\nexport type RuleValue = Verdict | RuleVariant[];\n\nexport interface RuleVariant {\n  action: Verdict;\n  when?: Record<string, ConditionSpec>;\n  approval?: Approval;\n  reason?: string;\n  controls?: string[];\n  expiresAt: string;\n}\n\n/** `{gt: 5000}`, `{in: [a, b]}`, `{matches: '^x'}`, `{exists: true}`. Exactly one operator. */\nexport type ConditionSpec = Partial<Record<SourceOperator, unknown>>;\n\nexport const SOURCE_OPERATORS = [\n  'eq',\n  'neq',\n  'in',\n  'notIn',\n  'gt',\n  'gte',\n  'lt',\n  'lte',\n  'matches',\n  'notMatches',\n  'startsWith',\n  'glob',\n  'withinWorkspace',\n  'exists',\n] as const;\nexport type SourceOperator = (typeof SOURCE_OPERATORS)[number];\n\nexport const VERDICTS: readonly Verdict[] = ['allow', 'hold', 'block'];\nexport const NEVER = 'never';\n","import type { Verdict } from '../ir.js';\nimport type { Diagnostics } from './diagnostics.js';\nimport { NEVER, VERDICTS } from './grammar.js';\n\n/**\n * Strict field readers over a parsed YAML value. Every unknown key is an\n * error (VC-2): a typo such as `denyTools:` must never become a no-op.\n */\nexport class Reader {\n  constructor(private readonly diag: Diagnostics) {}\n\n  object(value: unknown, path: string, keys: readonly string[]): Record<string, unknown> | null {\n    if (!isPlainObject(value)) {\n      this.diag.error('expected_object', path, `expected a mapping, got ${describe(value)}`);\n      return null;\n    }\n    for (const key of Object.keys(value)) {\n      if (!keys.includes(key)) this.diag.error('unknown_key', `${path}/${key}`, `unknown key \"${key}\"`);\n    }\n    return value;\n  }\n\n  /** A mapping whose keys are user-chosen (rule keys, member keys). */\n  map(value: unknown, path: string): Record<string, unknown> | null {\n    if (isPlainObject(value)) return value;\n    this.diag.error('expected_object', path, `expected a mapping, got ${describe(value)}`);\n    return null;\n  }\n\n  string(value: unknown, path: string): string | null {\n    if (typeof value === 'string' && value.length > 0) return value;\n    this.diag.error('expected_string', path, `expected a non-empty string, got ${describe(value)}`);\n    return null;\n  }\n\n  optionalString(value: unknown, path: string): string | undefined {\n    return value === undefined ? undefined : (this.string(value, path) ?? undefined);\n  }\n\n  boolean(value: unknown, path: string): boolean | undefined {\n    if (value === undefined || typeof value === 'boolean') return value;\n    this.diag.error('expected_boolean', path, `expected true or false, got ${describe(value)}`);\n    return undefined;\n  }\n\n  number(value: unknown, path: string): number | undefined {\n    if (value === undefined || (typeof value === 'number' && Number.isFinite(value))) return value;\n    this.diag.error('expected_number', path, `expected a number, got ${describe(value)}`);\n    return undefined;\n  }\n\n  strings(value: unknown, path: string): string[] | undefined {\n    if (value === undefined) return undefined;\n    if (Array.isArray(value) && value.every((v) => typeof v === 'string')) return value as string[];\n    this.diag.error('expected_string_list', path, `expected a list of strings, got ${describe(value)}`);\n    return undefined;\n  }\n\n  verdict(value: unknown, path: string): Verdict | null {\n    if (typeof value === 'string' && (VERDICTS as readonly string[]).includes(value)) return value as Verdict;\n    this.diag.error('expected_verdict', path, `expected allow, hold or block, got ${describe(value)}`);\n    return null;\n  }\n\n  optionalVerdict(value: unknown, path: string): Verdict | undefined {\n    return value === undefined ? undefined : (this.verdict(value, path) ?? undefined);\n  }\n\n  /** `never` or ISO-8601; absent materializes to `never` (VC-7c, FR-22). */\n  expiresAt(value: unknown, path: string): string {\n    if (value === undefined) return NEVER;\n    if (value instanceof Date) return value.toISOString();\n    if (value === NEVER) return NEVER;\n    if (typeof value === 'string' && !Number.isNaN(Date.parse(value))) return new Date(value).toISOString();\n    this.diag.error('expected_expiry', path, `expected \"never\" or an ISO-8601 date-time, got ${describe(value)}`);\n    return NEVER;\n  }\n}\n\nexport function isPlainObject(value: unknown): value is Record<string, unknown> {\n  return value !== null && typeof value === 'object' && !Array.isArray(value) && !(value instanceof Date);\n}\n\nexport function describe(value: unknown): string {\n  if (value === null) return 'null';\n  if (Array.isArray(value)) return 'a list';\n  if (value instanceof Date) return 'a date';\n  return typeof value === 'object' ? 'a mapping' : JSON.stringify(value);\n}\n","import type { Approval, Verdict } from '../ir.js';\nimport { VERDICT_RANK } from '../evaluate/input.js';\nimport { Diagnostics } from './diagnostics.js';\nimport type { ConditionSpec, Overlay, PolicySource, RuleValue, RuleVariant, SourceOperator } from './grammar.js';\n\n/**\n * Everything that can be checked without an inventory. Inventory-dependent\n * checks (roster clamp, glob collisions on real tools, schema binding) live in\n * the compiler.\n */\nexport function validate(source: PolicySource): Diagnostics {\n  const diag = new Diagnostics();\n  const ctx: Context = { diag, approvalDefaults: source.spec.approvalDefaults, base: source.spec.tools };\n  validateTargetSections(ctx, source);\n  if (source.spec.approvalDefaults) validateApproval(ctx, source.spec.approvalDefaults, '/spec/approvalDefaults', true);\n  validateRules(ctx, source.spec.tools.rules, '/spec/tools/rules');\n  validateOverlays(ctx, source.spec.members, '/spec/members');\n  validateOverlays(ctx, source.spec.products, '/spec/products');\n  validateCapture(ctx, source);\n  return diag;\n}\n\ninterface Context {\n  diag: Diagnostics;\n  approvalDefaults: Approval | undefined;\n  base: PolicySource['spec']['tools'];\n}\n\n/** `products:` and `precedence:` are local only; `members:` is enterprise only (VC-17, VC-18). */\nfunction validateTargetSections(ctx: Context, source: PolicySource): void {\n  const local = 'device' in source.target;\n  if (!local && source.spec.products) ctx.diag.error('local_only_section', '/spec/products', 'products applies only under target device: local');\n  if (!local && source.precedence) ctx.diag.error('local_only_section', '/precedence', 'precedence applies only under target device: local');\n  if (local && source.spec.members) ctx.diag.error('enterprise_only_section', '/spec/members', 'members applies only to an enterprise target');\n  if (local && source.metadata.orgId) ctx.diag.error('enterprise_only_field', '/metadata/orgId', 'a local policy carries no orgId');\n}\n\nfunction validateRules(ctx: Context, rules: Record<string, RuleValue> | undefined, path: string): void {\n  for (const [key, variants] of Object.entries(rules ?? {})) {\n    validateVariants(ctx, variants as RuleVariant[], `${path}/${key}`);\n  }\n}\n\nfunction validateVariants(ctx: Context, variants: RuleVariant[], path: string): void {\n  variants.forEach((variant, i) => {\n    const vpath = `${path}/${i}`;\n    if (i > 0 && isUnconditional(variants[i - 1]!)) {\n      ctx.diag.error('unreachable_variant', vpath, `variant ${i - 1} has no when, so this variant can never be reached`);\n    }\n    validateVariant(ctx, variant, vpath);\n  });\n}\n\nfunction isUnconditional(variant: RuleVariant): boolean {\n  return !variant.when || Object.keys(variant.when).length === 0;\n}\n\nfunction validateVariant(ctx: Context, variant: RuleVariant, path: string): void {\n  if (variant.action === 'hold') validateHoldApprover(ctx, variant, path);\n  for (const [field, spec] of Object.entries(variant.when ?? {})) validateCondition(ctx, spec, `${path}/when/${field}`);\n}\n\n/** A hold must name a way to resolve its approver, on the variant or in approvalDefaults (VC-6). */\nfunction validateHoldApprover(ctx: Context, variant: RuleVariant, path: string): void {\n  if (variant.approval) return void validateApproval(ctx, variant.approval, `${path}/approval`, true);\n  if (!ctx.approvalDefaults) {\n    ctx.diag.error('hold_without_approver', path, 'a hold names an approval or the document sets approvalDefaults');\n  }\n}\n\nfunction validateApproval(ctx: Context, approval: Approval, path: string, requireResolvable: boolean): void {\n  if (!Number.isInteger(approval.approvers) || approval.approvers < 1) {\n    ctx.diag.error('approvers_count', `${path}/approvers`, 'approvers is a whole number of at least 1');\n  }\n  if (requireResolvable && !namesAnApprover(approval)) {\n    ctx.diag.error('approval_unresolvable', path, 'an approval names roles, members or anyMember: true');\n  }\n}\n\nfunction namesAnApprover(approval: Approval): boolean {\n  return (approval.roles?.length ?? 0) > 0 || (approval.members?.length ?? 0) > 0 || approval.anyMember === true;\n}\n\ntype OperandCheck = (value: unknown) => boolean;\n\nconst OPERANDS: Record<SourceOperator, [OperandCheck, string]> = {\n  eq: [() => true, 'any value'],\n  neq: [() => true, 'any value'],\n  in: [Array.isArray, 'a list'],\n  notIn: [Array.isArray, 'a list'],\n  gt: [isNumber, 'a number'],\n  gte: [isNumber, 'a number'],\n  lt: [isNumber, 'a number'],\n  lte: [isNumber, 'a number'],\n  matches: [isRe2Pattern, 'an RE2-compatible regular expression'],\n  notMatches: [isRe2Pattern, 'an RE2-compatible regular expression'],\n  startsWith: [isString, 'a string'],\n  glob: [isString, 'a glob'],\n  withinWorkspace: [isBoolean, 'true or false'],\n  exists: [isBoolean, 'true or false'],\n};\n\nfunction validateCondition(ctx: Context, spec: ConditionSpec, path: string): void {\n  const [op, value] = Object.entries(spec)[0] as [SourceOperator, unknown];\n  const [check, expected] = OPERANDS[op];\n  if (!check(value)) ctx.diag.error('condition_operand', `${path}/${op}`, `${op} takes ${expected}`);\n}\n\nfunction isNumber(v: unknown): boolean {\n  return typeof v === 'number' && Number.isFinite(v);\n}\nfunction isString(v: unknown): boolean {\n  return typeof v === 'string';\n}\nfunction isBoolean(v: unknown): boolean {\n  return typeof v === 'boolean';\n}\n\n/** RE2 has no backreferences and no lookaround; rejecting them here keeps the Rego evaluator able to run the same pattern. */\nfunction isRe2Pattern(v: unknown): boolean {\n  if (typeof v !== 'string') return false;\n  if (/\\\\[1-9]|\\(\\?[=!<]/.test(v)) return false;\n  try {\n    new RegExp(v);\n    return true;\n  } catch {\n    return false;\n  }\n}\n\nfunction validateOverlays(ctx: Context, overlays: Record<string, Overlay> | undefined, path: string): void {\n  for (const [key, overlay] of Object.entries(overlays ?? {})) {\n    const opath = `${path}/${key}`;\n    validateRules(ctx, overlay.tools?.rules, `${opath}/tools/rules`);\n    flagLoosening(ctx, overlay, opath);\n  }\n}\n\n/** A member or product overlay may loosen the base; the review diff must show it (VC-7). */\nfunction flagLoosening(ctx: Context, overlay: Overlay, path: string): void {\n  const baseDefault = ctx.base.default;\n  if (overlay.tools?.default && looser(overlay.tools.default, baseDefault)) {\n    ctx.diag.warning('loosening_grant', `${path}/tools/default`, `default ${overlay.tools.default} is looser than the base default ${baseDefault}`);\n  }\n  for (const [key, variants] of Object.entries(overlay.tools?.rules ?? {})) {\n    const base = baseVerdictFor(ctx.base, key);\n    const loosest = (variants as RuleVariant[]).reduce<Verdict>((v, x) => (looser(x.action, v) ? x.action : v), 'block');\n    if (looser(loosest, base)) {\n      ctx.diag.warning('loosening_grant', `${path}/tools/rules/${key}`, `${key}: ${loosest} is looser than the base ${base}`);\n    }\n  }\n}\n\n/**\n * What the base can do at its strictest for a key: an overlay verdict looser\n * than that bypasses at least one base variant. No rule means tools.default.\n */\nfunction baseVerdictFor(base: PolicySource['spec']['tools'], key: string): Verdict {\n  const variants = base.rules?.[key] as RuleVariant[] | undefined;\n  if (!variants) return base.default;\n  return variants.reduce<Verdict>((v, x) => (looser(v, x.action) ? x.action : v), 'allow');\n}\n\nfunction looser(a: Verdict, b: Verdict): boolean {\n  return VERDICT_RANK[a] < VERDICT_RANK[b];\n}\n\nfunction validateCapture(ctx: Context, source: PolicySource): void {\n  const c = source.spec.capture;\n  if (!c) return;\n  if (c.sample !== undefined && (c.sample < 0 || c.sample > 1)) ctx.diag.error('capture_sample', '/spec/capture/sample', 'sample is between 0 and 1');\n  if (c.maxBytesPerCall !== undefined && (c.maxBytesPerCall < 0 || !Number.isInteger(c.maxBytesPerCall))) {\n    ctx.diag.error('capture_max_bytes', '/spec/capture/maxBytesPerCall', 'maxBytesPerCall is a whole number of bytes');\n  }\n}\n","import type { SourceTarget } from '../document/grammar.js';\n\n/** One tool the target can reach, as the inventory knows it. */\nexport interface InventoryTool {\n  /** The wire name the model sees; for an MCP tool the host may also supply the qualified `mcp__<server>__<tool>` form as `qualifiedName`. */\n  name: string;\n  qualifiedName?: string;\n  owner: { type: 'mcp_server' | 'agent' | 'local'; id: string; name?: string };\n  schemaHash: string | null;\n  inputSchema?: unknown;\n  capabilities?: string[];\n  /** False for a row the observed feed created and no owner has declared: the compiler warns instead of binding. */\n  declared: boolean;\n}\n\n/** What a host implements: conmap on `tool_snapshots`, the Armor CLI on the local tool list. */\nexport interface InventoryPort {\n  toolsForTarget(target: SourceTarget): Promise<InventoryTool[]>;\n}\n\nexport const CAPABILITY_KEYS: ReadonlySet<string> = new Set([\n  'shell',\n  'file.read',\n  'file.write',\n  'file.delete',\n  'web.fetch',\n  'web.search',\n  'skill',\n  'subagent',\n  'destructive',\n  'files',\n  'network',\n  'skills',\n  'secrets',\n]);\n","import { isGlob, matchGlob } from '../evaluate/glob.js';\nimport type { Diagnostics } from '../document/diagnostics.js';\nimport { CAPABILITY_KEYS, type InventoryTool } from './port.js';\n\nexport type KeyKind = 'exact' | 'glob' | 'capability';\n\nexport interface ResolvedKey {\n  kind: KeyKind;\n  /** For an exact key: the one inventory tool it binds, when declared. */\n  tool: InventoryTool | null;\n}\n\n/**\n * Tell a rule key's kind apart by lookup, not by syntax: a glob if it has\n * wildcards, a capability if it names a known capability or a tag the\n * inventory carries, else an exact tool name clamped against the inventory\n * (VC-8). A bare name declared by more than one owner is an error that asks\n * for the qualified form.\n */\nexport function resolveKey(key: string, inventory: InventoryTool[], diag: Diagnostics, path: string): ResolvedKey {\n  if (isGlob(key)) return { kind: 'glob', tool: null };\n  const matches = inventory.filter((t) => t.name === key || t.qualifiedName === key);\n  if (matches.length === 0 && isCapabilityKey(key, inventory)) return { kind: 'capability', tool: null };\n  if (matches.length > 1 && !matches.every((t) => t.owner.id === matches[0]!.owner.id)) {\n    diag.error('ambiguous_tool_key', path, `\"${key}\" exists on ${matches.length} owners; use the qualified mcp__<server>__${key} form`);\n    return { kind: 'exact', tool: null };\n  }\n  return { kind: 'exact', tool: bindExact(key, matches[0] ?? null, diag, path) };\n}\n\nfunction bindExact(key: string, tool: InventoryTool | null, diag: Diagnostics, path: string): InventoryTool | null {\n  if (!tool) {\n    diag.warning('unknown_tool_key', path, `\"${key}\" is not in the target's inventory; the rule compiles and binds nothing until the tool appears`);\n    return null;\n  }\n  if (!tool.declared) {\n    diag.warning('observed_only_tool', path, `\"${key}\" has only been observed, never declared; the rule compiles without a schema binding`);\n    return null;\n  }\n  return tool;\n}\n\nfunction isCapabilityKey(key: string, inventory: InventoryTool[]): boolean {\n  return CAPABILITY_KEYS.has(key) || inventory.some((t) => t.capabilities?.includes(key));\n}\n\n/** Two same-length globs matching one real tool is rejected at compile time (VC-4). */\nexport function checkGlobCollisions(keys: string[], inventory: InventoryTool[], diag: Diagnostics, path: string): void {\n  const globs = keys.filter(isGlob);\n  for (const tool of inventory) {\n    const matching = globs.filter((g) => matchGlob(g, tool.name) || (tool.qualifiedName !== undefined && matchGlob(g, tool.qualifiedName)));\n    const collision = sameLengthPair(matching);\n    if (collision) diag.error('ambiguous_glob', path, `\"${collision[0]}\" and \"${collision[1]}\" both match ${tool.name} with the same specificity`);\n  }\n}\n\nfunction sameLengthPair(globs: string[]): [string, string] | null {\n  const byLength = new Map<number, string>();\n  for (const g of globs) {\n    const other = byLength.get(g.length);\n    if (other !== undefined) return [other, g];\n    byLength.set(g.length, g);\n  }\n  return null;\n}\n\n/** An `args.*` key the tool's schema does not declare is a warning (VC-9). */\nexport function checkArgumentKeys(fields: string[], tool: InventoryTool, diag: Diagnostics, path: string): void {\n  const properties = schemaProperties(tool.inputSchema);\n  if (!properties) return;\n  for (const field of fields) {\n    const [root, first] = field.split('.');\n    if (root === 'args' && first !== undefined && !properties.has(first)) {\n      diag.warning('unknown_argument', `${path}/${field}`, `\"${first}\" is not a declared argument of ${tool.name}`);\n    }\n  }\n}\n\nfunction schemaProperties(schema: unknown): Set<string> | null {\n  if (schema === null || typeof schema !== 'object') return null;\n  const props = (schema as { properties?: unknown }).properties;\n  if (props === null || typeof props !== 'object') return null;\n  return new Set(Object.keys(props as object));\n}\n","import type { Condition, Statement } from '../ir.js';\nimport type { NetworkEntry, PolicySpec } from '../document/grammar.js';\nimport type { LoweringContext } from './lower-rules.js';\n\n/**\n * Capability floors lower to capability statements: `files` over any event\n * carrying a path, `network` over any event carrying a host, `skills` over a\n * skill name, `secrets` over an environment variable name.\n */\nexport function lowerFloors(spec: PolicySpec, ctx: LoweringContext): Statement[] {\n  return [...lowerFiles(spec, ctx), ...lowerNetwork(spec, ctx), ...lowerSkills(spec, ctx), ...lowerSecrets(spec, ctx)];\n}\n\nfunction floor(capability: string, effect: Statement['effect'], conditions: Condition[], order: number, ctx: LoweringContext): Statement {\n  return {\n    id: `st-${capability}-${effect}-${order}`,\n    subject: null,\n    match: { capability },\n    effect,\n    conditions,\n    expiresAt: 'never',\n    provenance: { ruleKey: capability, variant: order, source: ctx.source, layer: ctx.layer },\n  };\n}\n\nfunction lowerFiles(spec: PolicySpec, ctx: LoweringContext): Statement[] {\n  const out = (spec.files?.deny ?? []).map((glob, i) => floor('files', 'block', [{ field: 'path', op: 'glob', value: glob }], i, ctx));\n  if (spec.files?.allowOutsideWorkspace === false) {\n    out.push(floor('files', 'block', [{ field: 'withinWorkspace', op: 'eq', value: false }], out.length, ctx));\n  }\n  return out;\n}\n\nfunction hostOf(entry: NetworkEntry): string {\n  return typeof entry === 'string' ? entry : entry.host;\n}\n\nfunction lowerNetwork(spec: PolicySpec, ctx: LoweringContext): Statement[] {\n  const n = spec.network;\n  if (!n) return [];\n  const deny = (n.deny ?? []).map((e, i) => floor('network', 'block', [{ field: 'host', op: 'glob', value: hostOf(e) }], i, ctx));\n  const allow = (n.allow ?? []).map((e, i) => floor('network', 'allow', [{ field: 'host', op: 'glob', value: hostOf(e) }], deny.length + i, ctx));\n  return [...deny, ...allow];\n}\n\nfunction lowerSkills(spec: PolicySpec, ctx: LoweringContext): Statement[] {\n  const s = spec.skills;\n  if (!s) return [];\n  const hold = (s.hold ?? []).map((g, i) => floor('skills', 'hold', [{ field: 'skill', op: 'glob', value: g }], i, ctx));\n  const block = (s.block ?? []).map((g, i) => floor('skills', 'block', [{ field: 'skill', op: 'glob', value: g }], hold.length + i, ctx));\n  return [...hold, ...block];\n}\n\nfunction lowerSecrets(spec: PolicySpec, ctx: LoweringContext): Statement[] {\n  const names = spec.secrets?.envBlocklist ?? [];\n  return names.length === 0 ? [] : [floor('secrets', 'block', [{ field: 'env', op: 'in', value: names }], 0, ctx)];\n}\n","import type { Condition, ConditionOp } from '../ir.js';\nimport type { ConditionSpec, SourceOperator } from '../document/grammar.js';\n\nconst OP_MAP: Record<SourceOperator, ConditionOp> = {\n  eq: 'eq',\n  neq: 'ne',\n  in: 'in',\n  notIn: 'notIn',\n  gt: 'gt',\n  gte: 'gte',\n  lt: 'lt',\n  lte: 'lte',\n  matches: 'regex',\n  notMatches: 'notRegex',\n  startsWith: 'startsWith',\n  glob: 'glob',\n  withinWorkspace: 'eq',\n  exists: 'exists',\n};\n\n/**\n * `when` is an AND of `field: {operator: operand}`. `withinWorkspace` is a\n * host-derived boolean rather than a test on the path, so it lowers to an\n * equality on the `withinWorkspace` field.\n */\nexport function lowerConditions(when: Record<string, ConditionSpec> | undefined, schemaHash: string | null | undefined): Condition[] {\n  return Object.entries(when ?? {}).map(([field, spec]) => lowerCondition(field, spec, schemaHash));\n}\n\nfunction lowerCondition(field: string, spec: ConditionSpec, schemaHash: string | null | undefined): Condition {\n  const [op, operand] = Object.entries(spec)[0] as [SourceOperator, unknown];\n  const condition: Condition = {\n    field: op === 'withinWorkspace' ? 'withinWorkspace' : field,\n    op: OP_MAP[op],\n    value: operand,\n  };\n  if (schemaHash !== undefined && field.startsWith('args.')) condition.schemaBinding = { schemaHash };\n  return condition;\n}\n","/**\n * Compliance control identifiers a rule may cite. The shipped vocabulary is\n * SOC 2 Trust Services Criteria and HIPAA Security Rule sections; an unknown\n * identifier compiles with a warning naming it (VC-15).\n */\nconst SOC2 = [\n  'CC1.1', 'CC1.2', 'CC1.3', 'CC1.4', 'CC1.5',\n  'CC2.1', 'CC2.2', 'CC2.3',\n  'CC3.1', 'CC3.2', 'CC3.3', 'CC3.4',\n  'CC4.1', 'CC4.2',\n  'CC5.1', 'CC5.2', 'CC5.3',\n  'CC6.1', 'CC6.2', 'CC6.3', 'CC6.4', 'CC6.5', 'CC6.6', 'CC6.7', 'CC6.8',\n  'CC7.1', 'CC7.2', 'CC7.3', 'CC7.4', 'CC7.5',\n  'CC8.1',\n  'CC9.1', 'CC9.2',\n].map((c) => `SOC2-${c}`);\n\nconst HIPAA = [\n  '164.308(a)(1)', '164.308(a)(3)', '164.308(a)(4)', '164.308(a)(5)', '164.308(a)(6)',\n  '164.310(a)(1)', '164.310(b)', '164.310(c)', '164.310(d)(1)',\n  '164.312(a)(1)', '164.312(a)(2)(i)', '164.312(a)(2)(iv)', '164.312(b)', '164.312(c)(1)', '164.312(d)', '164.312(e)(1)',\n].map((c) => `HIPAA-${c}`);\n\nexport const KNOWN_CONTROLS: ReadonlySet<string> = new Set([...SOC2, ...HIPAA]);\n","import type { Approval, KeyTier, Layer, Statement, StatementMatch, Subject } from '../ir.js';\nimport type { Diagnostics } from '../document/diagnostics.js';\nimport type { Overlay, RuleValue, RuleVariant } from '../document/grammar.js';\nimport { checkArgumentKeys, resolveKey } from './clamp.js';\nimport { lowerConditions } from './lower-conditions.js';\nimport { KNOWN_CONTROLS } from './controls.js';\nimport type { InventoryTool } from './port.js';\n\nexport interface LoweringContext {\n  inventory: InventoryTool[];\n  diag: Diagnostics;\n  layer: Layer;\n  approvalDefaults: Approval | undefined;\n  source: Statement['provenance']['source'];\n}\n\nexport function lowerRules(rules: Record<string, RuleValue> | undefined, ctx: LoweringContext, path: string, subject: Subject | null, scopeExpiry: string): Statement[] {\n  const out: Statement[] = [];\n  for (const [key, value] of Object.entries(rules ?? {})) {\n    out.push(...lowerRule(key, value as RuleVariant[], ctx, `${path}/${key}`, subject, scopeExpiry));\n  }\n  return out;\n}\n\nfunction lowerRule(key: string, variants: RuleVariant[], ctx: LoweringContext, path: string, subject: Subject | null, scopeExpiry: string): Statement[] {\n  const resolved = resolveKey(key, ctx.inventory, ctx.diag, path);\n  checkControls(variants, ctx.diag, path);\n  const fields = variants.flatMap((v) => Object.keys(v.when ?? {}));\n  if (resolved.tool) checkArgumentKeys(fields, resolved.tool, ctx.diag, path);\n  const schemaHash = resolved.kind === 'exact' ? (resolved.tool?.schemaHash ?? null) : undefined;\n  return variants.map((variant, order) => ({\n    id: statementId(key, order, subject),\n    subject,\n    match: matchFor(key, resolved.kind, order),\n    effect: variant.action,\n    conditions: lowerConditions(variant.when, schemaHash),\n    ...approvalFor(variant, ctx.approvalDefaults),\n    expiresAt: earliest(variant.expiresAt, scopeExpiry),\n    ...(variant.controls ? { controls: variant.controls } : {}),\n    provenance: { ruleKey: key, variant: order, source: ctx.source, layer: subject ? 'member' : ctx.layer },\n  }));\n}\n\n/** An unknown control identifier compiles with a warning naming it (VC-15). */\nfunction checkControls(variants: RuleVariant[], diag: Diagnostics, path: string): void {\n  variants.forEach((v, i) => {\n    for (const control of v.controls ?? []) {\n      if (!KNOWN_CONTROLS.has(control)) diag.warning('unknown_control', `${path}/${i}/controls`, `unknown control identifier \"${control}\"`);\n    }\n  });\n}\n\nfunction matchFor(key: string, kind: 'exact' | 'glob' | 'capability', order: number): StatementMatch {\n  if (kind === 'capability') return { capability: key };\n  const keyTier: KeyTier = kind;\n  return { tool: key, keyTier, order };\n}\n\nfunction approvalFor(variant: RuleVariant, defaults: Approval | undefined): { approval?: Approval } {\n  if (variant.action !== 'hold') return {};\n  const approval = variant.approval ?? defaults;\n  return approval ? { approval } : {};\n}\n\n/** A rule expiry earlier than its scope's wins; `never` yields to any date (VC-16). */\nexport function earliest(a: string, b: string): string {\n  if (a === 'never') return b;\n  if (b === 'never') return a;\n  return Date.parse(a) <= Date.parse(b) ? a : b;\n}\n\nexport function statementId(key: string, order: number, subject: Subject | null): string {\n  const slug = key.replace(/[^A-Za-z0-9]+/g, '-').replace(/^-|-$/g, '').toLowerCase();\n  const who = subject ? '-' + subjectSlug(subject) : '';\n  return `st-${slug}${who}-${order}`;\n}\n\nfunction subjectSlug(subject: Subject): string {\n  const value = Object.values(subject)[0] as string;\n  return value.replace(/[^A-Za-z0-9]+/g, '-').replace(/^-|-$/g, '').toLowerCase();\n}\n\n/** `alice@x.io` is an email, `team:x` a group, `claude-code` under products a product, anything else a membershipId. */\nexport function subjectFor(key: string, kind: 'members' | 'products'): Subject {\n  if (kind === 'products') return { product: key };\n  if (key.includes('@')) return { email: key.toLowerCase() };\n  if (key.startsWith('team:')) return { group: key.slice('team:'.length) };\n  return { membershipId: key };\n}\n\nexport function lowerOverlays(overlays: Record<string, Overlay> | undefined, kind: 'members' | 'products', ctx: LoweringContext, path: string): Statement[] {\n  const out: Statement[] = [];\n  for (const [key, overlay] of Object.entries(overlays ?? {})) {\n    const subject = subjectFor(key, kind);\n    const opath = `${path}/${key}/tools`;\n    out.push(...lowerRules(overlay.tools?.rules, ctx, `${opath}/rules`, subject, overlay.expiresAt));\n    if (overlay.tools?.default) out.push(overlayDefault(overlay.tools.default, subject, overlay.expiresAt, ctx));\n  }\n  return out;\n}\n\n/** A per-subject default is the least specific rule that subject has: a `*` glob. */\nfunction overlayDefault(effect: Statement['effect'], subject: Subject, expiresAt: string, ctx: LoweringContext): Statement {\n  return {\n    id: statementId('*', 0, subject),\n    subject,\n    match: { tool: '*', keyTier: 'glob', order: 0 },\n    effect,\n    conditions: [],\n    ...(effect === 'hold' && ctx.approvalDefaults ? { approval: ctx.approvalDefaults } : {}),\n    expiresAt,\n    provenance: { ruleKey: 'tools.default', variant: 0, source: ctx.source, layer: 'member' },\n  };\n}\n","import type { PolicySource } from '../document/grammar.js';\nimport type { InventoryTool } from './port.js';\nimport { CAPABILITY_KEYS } from './port.js';\n\nexport type Enforceability = 'enforced' | 'argument-only' | 'inert';\n\nexport type Section = 'tools' | 'files' | 'network' | 'skills' | 'secrets';\n\n/**\n * Per-section honesty (FR-9, FR-19): a local device sees real paths and\n * hosts; the enterprise SDK path sees only path-shaped and URL-shaped\n * arguments; skills and secrets have no enterprise surface at all.\n */\nexport interface EnforceabilityReport {\n  sections: Partial<Record<Section, Enforceability>>;\n  /** Tools in the inventory that no capability rule reaches, when the document uses capability keys (M-12). */\n  notCoveredByCapabilityRules: string[];\n}\n\nconst ENTERPRISE: Record<Section, Enforceability> = {\n  tools: 'enforced',\n  files: 'argument-only',\n  network: 'argument-only',\n  skills: 'inert',\n  secrets: 'inert',\n};\n\nconst LOCAL: Record<Section, Enforceability> = {\n  tools: 'enforced',\n  files: 'enforced',\n  network: 'enforced',\n  skills: 'enforced',\n  secrets: 'enforced',\n};\n\nexport function enforceabilityReport(source: PolicySource, inventory: InventoryTool[]): EnforceabilityReport {\n  const table = 'device' in source.target ? LOCAL : ENTERPRISE;\n  const sections: EnforceabilityReport['sections'] = { tools: table.tools };\n  for (const section of ['files', 'network', 'skills', 'secrets'] as const) {\n    if (source.spec[section]) sections[section] = table[section];\n  }\n  return { sections, notCoveredByCapabilityRules: uncovered(source, inventory) };\n}\n\nfunction uncovered(source: PolicySource, inventory: InventoryTool[]): string[] {\n  const capabilityKeys = Object.keys(source.spec.tools.rules ?? {}).filter((k) => CAPABILITY_KEYS.has(k) || inventory.some((t) => t.capabilities?.includes(k)));\n  if (capabilityKeys.length === 0) return [];\n  return inventory\n    .filter((t) => !capabilityKeys.some((k) => t.capabilities?.includes(k)))\n    .map((t) => t.qualifiedName ?? t.name)\n    .sort();\n}\n","import { Diagnostics } from '../document/diagnostics.js';\nimport type { PolicySource, RuleVariant, SourceTarget } from '../document/grammar.js';\nimport { validate } from '../document/validate.js';\nimport { VERDICT_RANK } from '../evaluate/input.js';\nimport { policyHash } from '../hash.js';\nimport { layerOfTarget, SCHEMA_VERSION, type Capture, type Defaults, type PolicyDocument, type PolicyTarget, type Statement } from '../ir.js';\nimport { checkGlobCollisions } from './clamp.js';\nimport { lowerFloors } from './lower-floors.js';\nimport { lowerOverlays, lowerRules, type LoweringContext } from './lower-rules.js';\nimport type { InventoryPort, InventoryTool } from './port.js';\nimport { enforceabilityReport, type EnforceabilityReport } from './report.js';\n\nexport interface CompileOptions {\n  policyId: string;\n  source?: Statement['provenance']['source'];\n}\n\nexport interface CompileResult {\n  document: PolicyDocument | null;\n  diagnostics: Diagnostics;\n  report: EnforceabilityReport;\n}\n\n/** Validate, clamp against the inventory, lower to IR, hash. Synchronous once the inventory is in hand. */\nexport function compile(source: PolicySource, inventory: InventoryTool[], options: CompileOptions): CompileResult {\n  const diag = validate(source);\n  const report = enforceabilityReport(source, inventory);\n  if (diag.hasErrors) return { document: null, diagnostics: diag, report };\n  const layer = layerOfTarget(targetOf(source.target));\n  const ctx: LoweringContext = { inventory, diag, layer, approvalDefaults: source.spec.approvalDefaults, source: options.source ?? 'yaml' };\n  checkGlobCollisions(Object.keys(source.spec.tools.rules ?? {}), inventory, diag, '/spec/tools/rules');\n  checkDeviceFirst(source, diag);\n  const statements = [\n    ...lowerRules(source.spec.tools.rules, ctx, '/spec/tools/rules', null, source.spec.expiresAt),\n    ...lowerFloors(source.spec, ctx),\n    ...lowerOverlays(source.spec.members, 'members', ctx, '/spec/members'),\n    ...lowerOverlays(source.spec.products, 'products', ctx, '/spec/products'),\n  ];\n  if (diag.hasErrors) return { document: null, diagnostics: diag, report };\n  const document: PolicyDocument = {\n    schemaVersion: SCHEMA_VERSION,\n    policyId: options.policyId,\n    target: targetOf(source.target, source),\n    layer,\n    defaults: defaultsOf(source),\n    capture: captureOf(source),\n    expiresAt: source.spec.expiresAt,\n    statements,\n  };\n  document.policyHash = policyHash(document);\n  return { document, diagnostics: diag, report };\n}\n\nexport async function compileWithPort(source: PolicySource, port: InventoryPort, options: CompileOptions): Promise<CompileResult> {\n  return compile(source, await port.toolsForTarget(source.target), options);\n}\n\nfunction targetOf(target: SourceTarget, source?: PolicySource): PolicyTarget {\n  if ('device' in target) {\n    const products = Object.keys(source?.spec.products ?? {});\n    return products.length ? { device: 'local', products } : { device: 'local' };\n  }\n  return target;\n}\n\nfunction defaultsOf(source: PolicySource): Defaults {\n  return {\n    tools: source.spec.tools.default,\n    network: source.spec.network?.default ?? 'block',\n    files: 'allow',\n    skills: source.spec.skills?.default ?? 'allow',\n  };\n}\n\nfunction captureOf(source: PolicySource): Capture {\n  const c = source.spec.capture;\n  return {\n    arguments: c?.arguments ?? false,\n    redact: c?.redact ?? ['*token*', '*secret*', 'authorization'],\n    maxBytesPerCall: c?.maxBytesPerCall ?? 16384,\n    sample: c?.sample ?? 1,\n  };\n}\n\n/** Under `precedence: device-first` (the default) a products overlay may only tighten the base. */\nfunction checkDeviceFirst(source: PolicySource, diag: Diagnostics): void {\n  if (!('device' in source.target) || source.precedence === 'agent-first') return;\n  for (const [product, overlay] of Object.entries(source.spec.products ?? {})) {\n    for (const [key, variants] of Object.entries(overlay.tools?.rules ?? {})) {\n      if (loosensBase(variants as RuleVariant[], baseRankFor(source, key))) {\n        diag.error('device_first_loosening', `/spec/products/${product}/tools/rules/${key}`, `under device-first a product overlay may only tighten the base; set precedence: agent-first to allow this`);\n      }\n    }\n  }\n}\n\nfunction baseRankFor(source: PolicySource, key: string): number {\n  const base = source.spec.tools.rules?.[key];\n  if (!Array.isArray(base)) return VERDICT_RANK[source.spec.tools.default];\n  return Math.min(...base.map((v) => VERDICT_RANK[v.action]));\n}\n\nfunction loosensBase(variants: RuleVariant[], baseRank: number): boolean {\n  return variants.some((v) => VERDICT_RANK[v.action] < baseRank);\n}\n","import { stringify } from 'yaml';\nimport type { PolicySource, RuleValue, RuleVariant } from '../document/grammar.js';\n\n/**\n * PolicySource back to YAML such that `parse(serialize(x))` equals `x`\n * (VC-10). A single unconditional variant with no other fields is written as\n * the scalar shorthand; `expiresAt: never` is written only where the parser\n * would not materialize it identically anyway (everywhere), so it is kept.\n */\nexport function serialize(source: PolicySource): string {\n  const spec = { ...source.spec, tools: { ...source.spec.tools, rules: shorthand(source.spec.tools.rules) } };\n  if (spec.members) spec.members = overlays(spec.members);\n  if (spec.products) spec.products = overlays(spec.products);\n  const doc: Record<string, unknown> = {\n    apiVersion: source.apiVersion,\n    kind: source.kind,\n    metadata: source.metadata,\n    target: source.target,\n  };\n  if (source.precedence) doc.precedence = source.precedence;\n  doc.spec = spec;\n  return stringify(doc, { lineWidth: 0, defaultStringType: 'PLAIN', defaultKeyType: 'PLAIN' });\n}\n\nfunction shorthand(rules: Record<string, RuleValue> | undefined): Record<string, RuleValue> | undefined {\n  if (!rules) return undefined;\n  const out: Record<string, RuleValue> = {};\n  for (const [key, value] of Object.entries(rules)) out[key] = scalarIfPlain(value as RuleVariant[]);\n  return out;\n}\n\nfunction scalarIfPlain(variants: RuleVariant[]): RuleValue {\n  const only = variants.length === 1 ? variants[0]! : null;\n  const plain = only && Object.keys(only).length === 2 && only.expiresAt === 'never';\n  return plain ? only.action : variants;\n}\n\nfunction overlays<T extends { tools?: { rules?: Record<string, RuleValue> } }>(map: Record<string, T>): Record<string, T> {\n  const out: Record<string, T> = {};\n  for (const [key, overlay] of Object.entries(map)) {\n    out[key] = overlay.tools?.rules ? { ...overlay, tools: { ...overlay.tools, rules: shorthand(overlay.tools.rules) } } : overlay;\n  }\n  return out;\n}\n"],"mappings":";AAQO,IAAM,iBAAiB;AA6GvB,SAAS,cAAc,QAA6B;AACzD,MAAI,SAAS,OAAQ,QAAO;AAC5B,MAAI,WAAW,OAAQ,QAAO;AAC9B,MAAI,WAAW,OAAQ,QAAO;AAC9B,SAAO;AACT;;;ACnHO,SAAS,cAAc,OAAwB;AACpD,MAAI,UAAU,QAAQ,UAAU,OAAW,QAAO;AAClD,UAAQ,OAAO,OAAO;AAAA,IACpB,KAAK;AACH,aAAO,gBAAgB,KAAK;AAAA,IAC9B,KAAK;AACH,aAAO,QAAQ,SAAS;AAAA,IAC1B,KAAK;AACH,aAAO,YAAY,KAAK;AAAA,IAC1B,KAAK;AACH,aAAO,MAAM,QAAQ,KAAK,IACtB,MAAM,MAAM,IAAI,aAAa,EAAE,KAAK,GAAG,IAAI,MAC3C,gBAAgB,KAAgC;AAAA,IACtD;AACE,YAAM,IAAI,UAAU,uCAAuC,OAAO,KAAK,EAAE;AAAA,EAC7E;AACF;AAEA,SAAS,gBAAgB,OAAuB;AAC9C,MAAI,CAAC,OAAO,SAAS,KAAK,GAAG;AAC3B,UAAM,IAAI,UAAU,kDAAkD;AAAA,EACxE;AACA,SAAO,KAAK,UAAU,KAAK;AAC7B;AAEA,SAAS,gBAAgB,KAAsC;AAC7D,QAAM,OAAO,OAAO,KAAK,GAAG,EACzB,OAAO,CAAC,MAAM,IAAI,CAAC,MAAM,MAAS,EAClC,KAAK;AACR,SAAO,MAAM,KAAK,IAAI,CAAC,MAAM,YAAY,CAAC,IAAI,MAAM,cAAc,IAAI,CAAC,CAAC,CAAC,EAAE,KAAK,GAAG,IAAI;AACzF;AAEA,IAAM,gBAAwC;AAAA,EAC5C,GAAM;AAAA,EACN,GAAM;AAAA,EACN,IAAM;AAAA,EACN,IAAM;AAAA,EACN,IAAM;AAAA,EACN,IAAM;AAAA,EACN,IAAM;AACR;AAEA,SAAS,YAAY,GAAmB;AACtC,MAAI,MAAM;AACV,WAAS,IAAI,GAAG,IAAI,EAAE,QAAQ,KAAK;AACjC,UAAM,OAAO,EAAE,WAAW,CAAC;AAC3B,UAAM,QAAQ,cAAc,IAAI;AAChC,QAAI,UAAU,OAAW,QAAO;AAAA,aACvB,OAAO,MAAQ,OAAO,IAAM,QAAO,QAAQ,KAAK,SAAS,EAAE,EAAE,SAAS,GAAG,GAAG;AAAA,QAChF,QAAO,EAAE,CAAC;AAAA,EACjB;AACA,SAAO,MAAM;AACf;;;AC3DA,SAAS,kBAAkB;AAIpB,IAAM,cAAc;AAGpB,SAAS,gBAAgB,OAAwB;AACtD,SAAO,cAAc,WAAW,QAAQ,EAAE,OAAO,cAAc,KAAK,GAAG,MAAM,EAAE,OAAO,KAAK;AAC7F;AAQO,SAAS,WAAW,UAAkC;AAC3D,QAAM,EAAE,YAAY,UAAU,GAAG,KAAK,IAAI;AAC1C,SAAO,gBAAgB,IAAI;AAC7B;AAGO,SAAS,iBAAiB,UAAmC;AAClE,SAAO,OAAO,SAAS,eAAe,YAAY,SAAS,eAAe,WAAW,QAAQ;AAC/F;;;ACzBA,SAAS,cAAAA,mBAAkB;AAWpB,SAAS,WAAW,aAAqC;AAC9D,MAAI,gBAAgB,QAAQ,gBAAgB,OAAW,QAAO;AAC9D,QAAM,YAAY,mBAAmB,aAAa,aAAa,oBAAI,IAAI,CAAC;AACxE,SAAO,YAAYC,YAAW,QAAQ,EAAE,OAAO,cAAc,SAAS,GAAG,MAAM,EAAE,OAAO,KAAK;AAC/F;AAGA,IAAM,sBAAsB,oBAAI,IAAI;AAAA,EAClC;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AACF,CAAC;AAGD,IAAM,gBAAgB,oBAAI,IAAI,CAAC,QAAQ,SAAS,WAAW,UAAU,CAAC;AAEtE,IAAM,kBAAkB,oBAAI,IAAI,CAAC,eAAe,OAAO,CAAC;AAIxD,SAAS,mBAAmB,MAAe,MAAe,MAAY,cAAc,OAAgB;AAClG,MAAI,MAAM,QAAQ,IAAI,EAAG,QAAO,KAAK,IAAI,CAAC,SAAS,mBAAmB,MAAM,MAAM,IAAI,CAAC;AACvF,MAAI,SAAS,QAAQ,OAAO,SAAS,SAAU,QAAO;AACtD,QAAM,MAAM;AACZ,MAAI,YAAa,QAAO,UAAU,KAAK,CAAC,MAAM,mBAAmB,GAAG,MAAM,IAAI,CAAC;AAC/E,QAAM,MAAM,IAAI,MAAM;AACtB,MAAI,OAAO,QAAQ,YAAY,IAAI,WAAW,GAAG,EAAG,QAAO,gBAAgB,KAAK,KAAK,MAAM,IAAI;AAC/F,SAAO,qBAAqB,KAAK,MAAM,IAAI;AAC7C;AAEA,SAAS,qBAAqB,KAA8B,MAAe,MAAqC;AAC9G,QAAM,MAA+B,CAAC;AACtC,aAAW,CAAC,GAAG,CAAC,KAAK,OAAO,QAAQ,GAAG,GAAG;AACxC,QAAI,gBAAgB,IAAI,CAAC,EAAG;AAC5B,QAAI,CAAC,IAAI,cAAc,IAAI,CAAC,IAAI,IAAI,mBAAmB,GAAG,MAAM,MAAM,oBAAoB,IAAI,CAAC,CAAC;AAAA,EAClG;AACA,SAAO;AACT;AAGA,SAAS,gBAAgB,KAA8B,KAAa,MAAe,MAAqB;AACtG,MAAI,KAAK,IAAI,GAAG,EAAG,QAAO,EAAE,MAAM,IAAI;AACtC,QAAM,SAAS,eAAe,MAAM,GAAG;AACvC,MAAI,WAAW,OAAW,QAAO,EAAE,MAAM,IAAI;AAC7C,QAAM,OAAO,IAAI,IAAI,IAAI;AACzB,OAAK,IAAI,GAAG;AACZ,QAAM,WAAW,mBAAmB,QAAQ,MAAM,IAAI;AACtD,QAAM,EAAE,MAAM,MAAM,GAAG,SAAS,IAAI;AACpC,MAAI,OAAO,KAAK,QAAQ,EAAE,WAAW,EAAG,QAAO;AAC/C,QAAM,OAAO,cAAc,QAAQ,IAAI,EAAE,GAAG,SAAS,IAAI,EAAE,MAAM,IAAI;AACrE,SAAO,OAAO,OAAO,MAAM,qBAAqB,UAAU,MAAM,IAAI,CAAC;AACvE;AAEA,SAAS,eAAe,MAAe,KAAsB;AAC3D,MAAI,QAAQ,IAAK,QAAO;AACxB,MAAI,CAAC,IAAI,WAAW,IAAI,EAAG,QAAO;AAClC,MAAI,OAAgB;AACpB,aAAW,UAAU,IAAI,MAAM,CAAC,EAAE,MAAM,GAAG,GAAG;AAC5C,UAAM,MAAM,mBAAmB,MAAM,EAAE,QAAQ,OAAO,GAAG,EAAE,QAAQ,OAAO,GAAG;AAC7E,WAAO,QAAQ,MAAM,GAAG;AACxB,QAAI,SAAS,OAAW,QAAO;AAAA,EACjC;AACA,SAAO;AACT;AAEA,SAAS,QAAQ,MAAe,KAAsB;AACpD,MAAI,SAAS,QAAQ,OAAO,SAAS,SAAU,QAAO;AACtD,SAAO,MAAM,QAAQ,IAAI,IAAI,KAAK,OAAO,GAAG,CAAC,IAAK,KAAiC,GAAG;AACxF;AAEA,SAAS,cAAc,OAAkD;AACvE,SAAO,UAAU,QAAQ,OAAO,UAAU,YAAY,CAAC,MAAM,QAAQ,KAAK;AAC5E;AAEA,SAAS,UAAU,KAA8B,IAAsD;AACrG,QAAM,MAA+B,CAAC;AACtC,aAAW,CAAC,GAAG,CAAC,KAAK,OAAO,QAAQ,GAAG,EAAG,KAAI,CAAC,IAAI,GAAG,CAAC;AACvD,SAAO;AACT;;;AClCO,IAAM,eAAwC,EAAE,OAAO,GAAG,MAAM,GAAG,OAAO,EAAE;AAE5E,SAAS,SAAS,GAAY,GAAqB;AACxD,SAAO,aAAa,CAAC,KAAK,aAAa,CAAC,IAAI,IAAI;AAClD;;;ACxDO,SAAS,aAAa,SAAyB;AACpD,MAAI,SAAS;AACb,WAAS,IAAI,GAAG,IAAI,QAAQ,QAAQ,KAAK;AACvC,UAAM,KAAK,QAAQ,CAAC;AACpB,QAAI,OAAO,KAAK;AACd,YAAM,SAAS,QAAQ,IAAI,CAAC,MAAM;AAClC,gBAAU,SAAS,OAAO;AAC1B,UAAI,OAAQ;AAAA,IACd,WAAW,OAAO,KAAK;AACrB,gBAAU;AAAA,IACZ,OAAO;AACL,gBAAU,aAAa,EAAE;AAAA,IAC3B;AAAA,EACF;AACA,SAAO,IAAI,OAAO,SAAS,GAAG;AAChC;AAEO,SAAS,UAAU,SAAiB,OAAwB;AACjE,SAAO,aAAa,OAAO,EAAE,KAAK,KAAK;AACzC;AAEO,SAAS,OAAO,KAAsB;AAC3C,SAAO,IAAI,SAAS,GAAG,KAAK,IAAI,SAAS,GAAG;AAC9C;AAEA,SAAS,aAAa,IAAoB;AACxC,SAAO,qBAAqB,KAAK,EAAE,IAAI,OAAO,KAAK;AACrD;;;ACvBO,SAAS,aAAa,OAAkB,OAAwB;AACrE,QAAM,CAAC,MAAM,GAAG,IAAI,IAAI,MAAM,MAAM,GAAG;AACvC,QAAM,OAAO,SAAS,SAAS,MAAM,YAAY,MAAM,UAAU,QAAQ,EAAE;AAC3E,SAAO,KAAK,OAAgBC,UAAS,IAAI;AAC3C;AAEA,SAASA,SAAQ,MAAe,KAAsB;AACpD,MAAI,SAAS,QAAQ,OAAO,SAAS,SAAU,QAAO;AACtD,SAAQ,KAAiC,GAAG;AAC9C;AAEO,SAAS,eAAe,OAAkB,YAAkC;AACjF,SAAO,WAAW,MAAM,CAAC,MAAM,eAAe,OAAO,CAAC,CAAC;AACzD;AAEO,SAAS,eAAe,OAAkB,WAA+B;AAC9E,QAAM,SAAS,aAAa,OAAO,UAAU,KAAK;AAClD,MAAI,UAAU,OAAO,SAAU,QAAQ,WAAW,YAAgB,UAAU,SAAS;AACrF,MAAI,WAAW,OAAW,QAAO;AACjC,SAAO,QAAQ,UAAU,IAAI,QAAQ,UAAU,KAAK;AACtD;AAIA,IAAM,cAAsE;AAAA,EAC1E,IAAI,CAAC,GAAG,MAAM,MAAM;AAAA,EACpB,IAAI,CAAC,GAAG,MAAM,MAAM;AAAA,EACpB,IAAI,CAAC,GAAG,MAAM,QAAQ,GAAG,GAAG,CAAC,GAAG,MAAM,IAAI,CAAC;AAAA,EAC3C,KAAK,CAAC,GAAG,MAAM,QAAQ,GAAG,GAAG,CAAC,GAAG,MAAM,KAAK,CAAC;AAAA,EAC7C,IAAI,CAAC,GAAG,MAAM,QAAQ,GAAG,GAAG,CAAC,GAAG,MAAM,IAAI,CAAC;AAAA,EAC3C,KAAK,CAAC,GAAG,MAAM,QAAQ,GAAG,GAAG,CAAC,GAAG,MAAM,KAAK,CAAC;AAAA,EAC7C,IAAI,CAAC,GAAG,MAAM,MAAM,QAAQ,CAAC,KAAK,EAAE,SAAS,CAAC;AAAA,EAC9C,OAAO,CAAC,GAAG,MAAM,MAAM,QAAQ,CAAC,KAAK,CAAC,EAAE,SAAS,CAAC;AAAA,EAClD,MAAM,CAAC,GAAG,MAAM,QAAQ,GAAG,GAAG,CAAC,GAAG,MAAM,UAAU,GAAG,CAAC,CAAC;AAAA,EACvD,OAAO,CAAC,GAAG,MAAM,QAAQ,GAAG,GAAG,CAAC,GAAG,MAAM,IAAI,OAAO,CAAC,EAAE,KAAK,CAAC,CAAC;AAAA,EAC9D,UAAU,CAAC,GAAG,MAAM,QAAQ,GAAG,GAAG,CAAC,GAAG,MAAM,CAAC,IAAI,OAAO,CAAC,EAAE,KAAK,CAAC,CAAC;AAAA,EAClE,YAAY,CAAC,GAAG,MAAM,QAAQ,GAAG,GAAG,CAAC,GAAG,MAAM,EAAE,WAAW,CAAC,CAAC;AAC/D;AAEA,SAAS,QAAQ,IAAwC,QAAiB,UAA4B;AACpG,SAAO,YAAY,EAAE,EAAE,QAAQ,QAAQ;AACzC;AAEA,SAAS,QAAQ,GAAY,GAAY,MAAkD;AACzF,SAAO,OAAO,MAAM,YAAY,OAAO,MAAM,YAAY,KAAK,GAAG,CAAC;AACpE;AAEA,SAAS,QAAQ,GAAY,GAAY,MAAkD;AACzF,SAAO,OAAO,MAAM,YAAY,OAAO,MAAM,YAAY,KAAK,GAAG,CAAC;AACpE;;;AClDO,SAAS,cAAc,YAAyB,MAA6B;AAClF,MAAI,OAAsB;AAC1B,aAAW,OAAO,WAAW,UAAU,GAAG;AACxC,QAAI,CAAC,WAAW,KAAK,IAAI,EAAG;AAC5B,QAAI,SAAS,QAAQ,SAAS,KAAK,IAAI,EAAG,QAAO;AAAA,EACnD;AACA,SAAO;AACT;AAEA,SAAS,WAAW,YAAsC;AACxD,QAAM,OAAO,oBAAI,IAAY;AAC7B,aAAW,KAAK,WAAY,KAAI,UAAU,EAAE,MAAO,MAAK,IAAI,EAAE,MAAM,IAAI;AACxE,SAAO;AACT;AAEA,SAAS,WAAW,KAAa,MAAuB;AACtD,SAAO,OAAO,GAAG,IAAI,UAAU,KAAK,IAAI,IAAI,QAAQ;AACtD;AAEA,SAAS,SAAS,WAAmB,WAA4B;AAC/D,QAAM,gBAAgB,OAAO,SAAS;AACtC,QAAM,gBAAgB,OAAO,SAAS;AACtC,MAAI,kBAAkB,cAAe,QAAO,CAAC;AAC7C,SAAO,UAAU,SAAS,UAAU;AACtC;AAGO,SAAS,WAAW,YAAyB,SAA8B;AAChF,SAAO,WACJ,OAAO,CAAC,MAAM,UAAU,EAAE,SAAS,EAAE,MAAM,SAAS,OAAO,EAC3D,KAAK,CAAC,GAAG,MAAO,UAAU,EAAE,SAAS,UAAU,EAAE,QAAQ,EAAE,MAAM,QAAQ,EAAE,MAAM,QAAQ,CAAE;AAChG;AAEO,SAAS,qBAAqB,YAAyB,MAA6B;AACzF,SAAO,WAAW,OAAO,CAAC,MAAM,gBAAgB,EAAE,SAAS,KAAK,SAAS,EAAE,MAAM,UAAU,CAAC;AAC9F;;;AC/BO,SAAS,OAAO,WAAmB,WAA4B;AACpE,SAAO,cAAc,WAAW,KAAK,MAAM,SAAS,IAAI,KAAK,MAAM,SAAS;AAC9E;AAEO,SAAS,eAAe,KAAqB,OAA+B;AACjF,MAAI,CAAC,OAAO,IAAI,WAAW,MAAM,SAAS,EAAG,QAAO,CAAC;AACrD,SAAO,IAAI,WAAW,OAAO,CAAC,MAAM,OAAO,EAAE,WAAW,MAAM,SAAS,CAAC;AAC1E;AAMO,SAAS,YAAY,YAAyB,WAA+C;AAClG,MAAI,CAAC,UAAW,QAAO,CAAC;AACxB,QAAM,WAAW,WAAW,IAAI,CAAC,MAAM,EAAE,OAAO,EAAE,OAAO,CAAC,MAAoB,MAAM,IAAI;AACxF,QAAM,SAAS,iBAAiB,UAAU,SAAS;AACnD,SAAO,SAAS,WAAW,OAAO,CAAC,MAAM,EAAE,YAAY,QAAQ,YAAY,EAAE,SAAS,MAAM,CAAC,IAAI,CAAC;AACpG;AAEA,SAAS,iBAAiB,UAAqB,WAAsC;AACnF,QAAM,OAAO,SAAS,KAAK,CAAC,MAAM,kBAAkB,KAAK,EAAE,iBAAiB,UAAU,YAAY;AAClG,MAAI,KAAM,QAAO;AACjB,QAAM,QAAQ,UAAU,OAAO,YAAY;AAC3C,QAAM,UAAU,SAAS,KAAK,CAAC,MAAM,WAAW,KAAK,EAAE,MAAM,YAAY,MAAM,KAAK;AACpF,MAAI,QAAS,QAAO;AACpB,QAAM,SAAS,UAAU,UAAU,CAAC;AACpC,QAAM,UAAU,SAAS,KAAK,CAAC,MAAM,WAAW,KAAK,OAAO,SAAS,EAAE,KAAK,CAAC;AAC7E,MAAI,QAAS,QAAO;AACpB,SAAO,SAAS,KAAK,CAAC,MAAM,aAAa,KAAK,EAAE,YAAY,UAAU,OAAO,KAAK;AACpF;AAEA,SAAS,YAAY,GAAY,GAAqB;AACpD,SAAO,KAAK,UAAU,CAAC,MAAM,KAAK,UAAU,CAAC;AAC/C;AAOO,SAAS,YAAY,YAAyB,OAAwC;AAC3F,QAAM,eAAe,WAAW,YAAY,KAAK;AACjD,QAAM,aAAa,mBAAmB,YAAY,KAAK;AACvD,MAAI,CAAC,aAAc,QAAO;AAC1B,MAAI,CAAC,WAAY,QAAO;AACxB,SAAO,SAAS,WAAW,UAAU,QAAQ,aAAa,UAAU,MAAM,MAAM,aAAa,UAAU,SACnG,eACA;AACN;AAEA,SAAS,WAAW,YAAyB,OAAwC;AACnF,QAAM,MAAM,cAAc,YAAY,MAAM,IAAI;AAChD,MAAI,QAAQ,KAAM,QAAO;AACzB,QAAM,SAAS,WAAW,YAAY,GAAG,EAAE,KAAK,CAAC,MAAM,eAAe,OAAO,EAAE,UAAU,CAAC;AAC1F,SAAO,SAAS,EAAE,WAAW,QAAQ,aAAa,iBAAiB,QAAQ,KAAK,EAAE,IAAI;AACxF;AAEA,SAAS,mBAAmB,YAAyB,OAAwC;AAC3F,QAAM,WAAW,qBAAqB,YAAY,MAAM,gBAAgB,CAAC,CAAC,EAAE;AAAA,IAAO,CAAC,MAClF,eAAe,OAAO,EAAE,UAAU;AAAA,EACpC;AACA,MAAI,OAAyB;AAC7B,aAAW,KAAK,UAAU;AACxB,QAAI,CAAC,QAAQ,SAAS,EAAE,QAAQ,KAAK,MAAM,MAAM,EAAE,OAAQ,QAAO;AAAA,EACpE;AACA,SAAO,OAAO,EAAE,WAAW,MAAM,aAAa,CAAC,EAAE,IAAI;AACvD;AAGA,SAAS,iBAAiB,WAAsB,OAAgC;AAC9E,MAAI,MAAM,eAAe,OAAW,QAAO,CAAC;AAC5C,QAAM,UAAU,UAAU,WACvB,IAAI,CAAC,MAAM,EAAE,eAAe,cAAc,IAAI,EAC9C,OAAO,CAAC,UAA2B,UAAU,QAAQ,UAAU,MAAM,UAAU;AAClF,SAAO,QAAQ,IAAI,CAAC,WAAW;AAAA,IAC7B,MAAM;AAAA,IACN,aAAa,UAAU;AAAA,IACvB;AAAA,IACA,UAAU,MAAM,cAAc;AAAA,EAChC,EAAE;AACJ;;;ACvEO,SAAS,SAAS,OAAkB,OAAmC;AAC5E,QAAMC,SAAQ,YAAY,MAAM,OAAO,KAAK;AAC5C,MAAIA,QAAO,UAAU,WAAW,QAAS,QAAO,aAAaA,QAAO,MAAM,OAAQ,OAAO;AAEzF,QAAM,YAAY,gBAAgB,OAAO,KAAK;AAC9C,QAAM,eAAeA,QAAO,UAAU,UAAU;AAChD,MAAI,gBAAgB,SAAS,cAAc,UAAU,OAAO,MAAM,UAAU,SAAS;AACnF,WAAO,EAAE,GAAG,aAAaA,QAAQ,MAAM,OAAQ,OAAO,GAAG,aAAa;AAAA,EACxE;AACA,SAAO,EAAE,GAAG,WAAW,aAAa;AACtC;AAEA,SAAS,YAAY,KAAiC,OAAwC;AAC5F,MAAI,CAAC,IAAK,QAAO;AACjB,SAAO,YAAY,eAAe,KAAK,KAAK,EAAE,OAAO,CAAC,MAAM,EAAE,YAAY,IAAI,GAAG,KAAK;AACxF;AAEA,SAAS,gBAAgB,OAAkB,OAAmC;AAC5E,aAAW,OAAO,CAAC,MAAM,OAAO,MAAM,KAAK,GAAG;AAC5C,QAAI,CAAC,IAAK;AACV,UAAM,aAAa,eAAe,KAAK,KAAK;AAC5C,UAAM,SAAS,YAAY,YAAY,YAAY,MAAM,MAAM,GAAG,KAAK;AACvE,QAAI,OAAQ,QAAO,aAAa,QAAQ,KAAK,QAAQ;AACrD,UAAM,MAAM,YAAY,WAAW,OAAO,CAAC,MAAM,EAAE,YAAY,IAAI,GAAG,KAAK;AAC3E,QAAI,IAAK,QAAO,aAAa,KAAK,KAAK,IAAI,KAAK;AAAA,EAClD;AACA,SAAO,YAAY,aAAa,KAAK,CAAC;AACxC;AAEA,SAAS,aAAa,OAAuC;AAC3D,QAAM,MAAM,MAAM,SAAS,MAAM,SAAS,MAAM;AAChD,MAAI,CAAC,IAAK,OAAM,IAAI,MAAM,8CAA8C;AACxE,SAAO;AACT;AAEA,SAAS,aAAa,UAAyB,KAAqB,OAA+C;AACjH,QAAM,EAAE,UAAU,IAAI;AACtB,SAAO;AAAA,IACL,SAAS,UAAU;AAAA,IACnB,cAAc;AAAA,IACd,UAAU,UAAU,YAAY;AAAA,IAChC,aAAa,SAAS;AAAA,IACtB,YAAY,aAAa,WAAW,IAAI,UAAU,KAAK;AAAA,EACzD;AACF;AAEA,SAAS,aAAa,WAAsB,UAAkB,OAAsD;AAClH,SAAO;AAAA,IACL;AAAA,IACA,aAAa,UAAU;AAAA,IACvB,SAAS,UAAU,WAAW;AAAA,IAC9B,SAAS,UAAU,WAAW;AAAA,IAC9B;AAAA,EACF;AACF;AAGA,SAAS,YAAY,KAAiC;AACpD,QAAM,UAAmB,IAAI,SAAS;AACtC,SAAO;AAAA,IACL;AAAA,IACA,cAAc;AAAA,IACd,UAAU;AAAA,IACV,aAAa,CAAC;AAAA,IACd,YAAY,EAAE,UAAU,IAAI,UAAU,aAAa,MAAM,SAAS,iBAAiB,SAAS,IAAI,OAAO,IAAI,MAAM;AAAA,EACnH;AACF;;;ACxFA,SAAS,SAAS,qBAAqB;;;ACUhC,IAAM,cAAN,MAAkB;AAAA,EACd,QAAsB,CAAC;AAAA,EAEhC,MAAM,MAAc,MAAc,SAAuB;AACvD,SAAK,MAAM,KAAK,EAAE,MAAM,UAAU,SAAS,MAAM,QAAQ,CAAC;AAAA,EAC5D;AAAA,EAEA,QAAQ,MAAc,MAAc,SAAuB;AACzD,SAAK,MAAM,KAAK,EAAE,MAAM,UAAU,WAAW,MAAM,QAAQ,CAAC;AAAA,EAC9D;AAAA,EAEA,IAAI,YAAqB;AACvB,WAAO,KAAK,MAAM,KAAK,CAAC,MAAM,EAAE,aAAa,OAAO;AAAA,EACtD;AACF;;;ACkCO,IAAM,mBAAmB;AAAA,EAC9B;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AACF;AAGO,IAAM,WAA+B,CAAC,SAAS,QAAQ,OAAO;AAC9D,IAAM,QAAQ;;;ACrEd,IAAM,SAAN,MAAa;AAAA,EAClB,YAA6B,MAAmB;AAAnB;AAAA,EAAoB;AAAA,EAApB;AAAA,EAE7B,OAAO,OAAgB,MAAc,MAAyD;AAC5F,QAAI,CAACC,eAAc,KAAK,GAAG;AACzB,WAAK,KAAK,MAAM,mBAAmB,MAAM,2BAA2B,SAAS,KAAK,CAAC,EAAE;AACrF,aAAO;AAAA,IACT;AACA,eAAW,OAAO,OAAO,KAAK,KAAK,GAAG;AACpC,UAAI,CAAC,KAAK,SAAS,GAAG,EAAG,MAAK,KAAK,MAAM,eAAe,GAAG,IAAI,IAAI,GAAG,IAAI,gBAAgB,GAAG,GAAG;AAAA,IAClG;AACA,WAAO;AAAA,EACT;AAAA;AAAA,EAGA,IAAI,OAAgB,MAA8C;AAChE,QAAIA,eAAc,KAAK,EAAG,QAAO;AACjC,SAAK,KAAK,MAAM,mBAAmB,MAAM,2BAA2B,SAAS,KAAK,CAAC,EAAE;AACrF,WAAO;AAAA,EACT;AAAA,EAEA,OAAO,OAAgB,MAA6B;AAClD,QAAI,OAAO,UAAU,YAAY,MAAM,SAAS,EAAG,QAAO;AAC1D,SAAK,KAAK,MAAM,mBAAmB,MAAM,oCAAoC,SAAS,KAAK,CAAC,EAAE;AAC9F,WAAO;AAAA,EACT;AAAA,EAEA,eAAe,OAAgB,MAAkC;AAC/D,WAAO,UAAU,SAAY,SAAa,KAAK,OAAO,OAAO,IAAI,KAAK;AAAA,EACxE;AAAA,EAEA,QAAQ,OAAgB,MAAmC;AACzD,QAAI,UAAU,UAAa,OAAO,UAAU,UAAW,QAAO;AAC9D,SAAK,KAAK,MAAM,oBAAoB,MAAM,+BAA+B,SAAS,KAAK,CAAC,EAAE;AAC1F,WAAO;AAAA,EACT;AAAA,EAEA,OAAO,OAAgB,MAAkC;AACvD,QAAI,UAAU,UAAc,OAAO,UAAU,YAAY,OAAO,SAAS,KAAK,EAAI,QAAO;AACzF,SAAK,KAAK,MAAM,mBAAmB,MAAM,0BAA0B,SAAS,KAAK,CAAC,EAAE;AACpF,WAAO;AAAA,EACT;AAAA,EAEA,QAAQ,OAAgB,MAAoC;AAC1D,QAAI,UAAU,OAAW,QAAO;AAChC,QAAI,MAAM,QAAQ,KAAK,KAAK,MAAM,MAAM,CAAC,MAAM,OAAO,MAAM,QAAQ,EAAG,QAAO;AAC9E,SAAK,KAAK,MAAM,wBAAwB,MAAM,mCAAmC,SAAS,KAAK,CAAC,EAAE;AAClG,WAAO;AAAA,EACT;AAAA,EAEA,QAAQ,OAAgB,MAA8B;AACpD,QAAI,OAAO,UAAU,YAAa,SAA+B,SAAS,KAAK,EAAG,QAAO;AACzF,SAAK,KAAK,MAAM,oBAAoB,MAAM,sCAAsC,SAAS,KAAK,CAAC,EAAE;AACjG,WAAO;AAAA,EACT;AAAA,EAEA,gBAAgB,OAAgB,MAAmC;AACjE,WAAO,UAAU,SAAY,SAAa,KAAK,QAAQ,OAAO,IAAI,KAAK;AAAA,EACzE;AAAA;AAAA,EAGA,UAAU,OAAgB,MAAsB;AAC9C,QAAI,UAAU,OAAW,QAAO;AAChC,QAAI,iBAAiB,KAAM,QAAO,MAAM,YAAY;AACpD,QAAI,UAAU,MAAO,QAAO;AAC5B,QAAI,OAAO,UAAU,YAAY,CAAC,OAAO,MAAM,KAAK,MAAM,KAAK,CAAC,EAAG,QAAO,IAAI,KAAK,KAAK,EAAE,YAAY;AACtG,SAAK,KAAK,MAAM,mBAAmB,MAAM,kDAAkD,SAAS,KAAK,CAAC,EAAE;AAC5G,WAAO;AAAA,EACT;AACF;AAEO,SAASA,eAAc,OAAkD;AAC9E,SAAO,UAAU,QAAQ,OAAO,UAAU,YAAY,CAAC,MAAM,QAAQ,KAAK,KAAK,EAAE,iBAAiB;AACpG;AAEO,SAAS,SAAS,OAAwB;AAC/C,MAAI,UAAU,KAAM,QAAO;AAC3B,MAAI,MAAM,QAAQ,KAAK,EAAG,QAAO;AACjC,MAAI,iBAAiB,KAAM,QAAO;AAClC,SAAO,OAAO,UAAU,WAAW,cAAc,KAAK,UAAU,KAAK;AACvE;;;AHjEO,SAAS,UAAU,MAA2B;AACnD,QAAM,OAAO,IAAI,YAAY;AAC7B,MAAI;AACJ,MAAI;AACF,YAAQ,cAAc,IAAI;AAAA,EAC5B,SAAS,OAAO;AACd,SAAK,MAAM,eAAe,IAAK,MAAgB,OAAO;AACtD,WAAO,EAAE,QAAQ,MAAM,aAAa,KAAK;AAAA,EAC3C;AACA,SAAO,WAAW,OAAO,IAAI;AAC/B;AAGO,SAAS,cAAc,OAA6B;AACzD,SAAO,WAAW,OAAO,IAAI,YAAY,CAAC;AAC5C;AAEA,IAAM,YAAY,CAAC,cAAc,QAAQ,YAAY,UAAU,cAAc,MAAM;AACnF,IAAM,YAAY,CAAC,SAAS,SAAS,WAAW,UAAU,WAAW,WAAW,YAAY,WAAW,oBAAoB,WAAW;AACtI,IAAM,eAAe,CAAC,UAAU,QAAQ,YAAY,UAAU,YAAY,WAAW;AAErF,SAAS,WAAW,OAAgB,MAAgC;AAClE,QAAM,IAAI,IAAI,OAAO,IAAI;AACzB,QAAM,OAAO,EAAE,OAAO,OAAO,IAAI,SAAS;AAC1C,MAAI,CAAC,KAAM,QAAO,EAAE,QAAQ,MAAM,aAAa,KAAK;AACpD,MAAI,KAAK,eAAe,cAAe,MAAK,MAAM,2BAA2B,eAAe,sBAAsB;AAClH,MAAI,KAAK,SAAS,SAAU,MAAK,MAAM,oBAAoB,SAAS,iBAAiB;AACrF,QAAM,WAAW,cAAc,GAAG,KAAK,QAAQ;AAC/C,QAAM,SAAS,YAAY,GAAG,MAAM,KAAK,MAAM;AAC/C,QAAM,aAAa,gBAAgB,MAAM,KAAK,UAAU;AACxD,QAAM,OAAO,UAAU,GAAG,MAAM,KAAK,IAAI;AACzC,MAAI,KAAK,aAAa,CAAC,YAAY,CAAC,UAAU,CAAC,KAAM,QAAO,EAAE,QAAQ,MAAM,aAAa,KAAK;AAC9F,QAAM,SAAuB,EAAE,YAAY,eAAe,MAAM,UAAU,UAAU,QAAQ,KAAK;AACjG,MAAI,WAAY,QAAO,aAAa;AACpC,SAAO,EAAE,QAAQ,aAAa,KAAK;AACrC;AAEA,SAAS,cAAc,GAAW,OAAiD;AACjF,QAAM,IAAI,EAAE,OAAO,OAAO,aAAa,CAAC,QAAQ,eAAe,SAAS,QAAQ,CAAC;AACjF,MAAI,CAAC,EAAG,QAAO;AACf,QAAM,OAAO,EAAE,OAAO,EAAE,MAAM,gBAAgB;AAC9C,MAAI,CAAC,KAAM,QAAO;AAClB,QAAM,MAAgC,EAAE,KAAK;AAC7C,QAAM,cAAc,EAAE,eAAe,EAAE,aAAa,uBAAuB;AAC3E,QAAM,QAAQ,EAAE,eAAe,EAAE,OAAO,iBAAiB;AACzD,MAAI,YAAa,KAAI,cAAc;AACnC,MAAI,MAAO,KAAI,QAAQ;AACvB,MAAI,EAAE,WAAW,OAAW,KAAI,SAAS,YAAY,GAAG,EAAE,MAAM;AAChE,SAAO;AACT;AAEA,SAAS,YAAY,GAAW,OAAwC;AACtE,QAAM,SAAS,EAAE,IAAI,OAAO,kBAAkB,KAAK,CAAC;AACpD,QAAM,MAA8B,CAAC;AACrC,aAAW,CAAC,GAAG,CAAC,KAAK,OAAO,QAAQ,MAAM,GAAG;AAC3C,UAAM,IAAI,EAAE,OAAO,GAAG,oBAAoB,CAAC,EAAE;AAC7C,QAAI,EAAG,KAAI,CAAC,IAAI;AAAA,EAClB;AACA,SAAO;AACT;AAEA,IAAM,eAAe,CAAC,SAAS,SAAS,OAAO,QAAQ;AAEvD,SAAS,YAAY,GAAW,MAAmB,OAAqC;AACtF,QAAM,IAAI,EAAE,OAAO,OAAO,WAAW,CAAC,SAAS,cAAc,SAAS,OAAO,QAAQ,CAAC;AACtF,MAAI,CAAC,EAAG,QAAO;AACf,QAAM,QAAQ,aAAa,OAAO,CAAC,MAAM,EAAE,CAAC,MAAM,MAAS;AAC3D,MAAI,MAAM,WAAW,GAAG;AACtB,SAAK,MAAM,eAAe,WAAW,+DAA+D,MAAM,MAAM,EAAE;AAClH,WAAO;AAAA,EACT;AACA,SAAO,SAAS,GAAG,MAAM,GAAG,MAAM,CAAC,CAAE;AACvC;AAEA,SAAS,SAAS,GAAW,MAAmB,GAA4B,MAA0D;AACpI,MAAI,SAAS,SAAS,SAAS,SAAU,QAAO,YAAY,MAAM,GAAG,IAAI;AACzE,MAAI,EAAE,eAAe,UAAa,SAAS,QAAS,MAAK,MAAM,eAAe,sBAAsB,uCAAuC;AAC3I,QAAM,KAAK,EAAE,OAAO,EAAE,IAAI,GAAG,WAAW,IAAI,EAAE;AAC9C,MAAI,CAAC,GAAI,QAAO;AAChB,MAAI,SAAS,QAAS,QAAO,EAAE,OAAO,GAAG;AACzC,QAAM,UAAU,EAAE,QAAQ,EAAE,YAAY,oBAAoB;AAC5D,SAAO,UAAU,EAAE,OAAO,IAAI,YAAY,QAAQ,IAAI,EAAE,OAAO,GAAG;AACpE;AAEA,IAAM,gBAAgB;AAAA,EACpB,KAAK,EAAE,OAAO,KAAK,MAAM,cAAc,SAAS,gDAAgD;AAAA,EAChG,QAAQ,EAAE,OAAO,SAAS,MAAM,iBAAiB,SAAS,kCAAkC;AAC9F;AAEA,SAAS,YAAY,MAAmB,GAA4B,MAA6C;AAC/G,QAAM,WAAW,cAAc,IAAI;AACnC,MAAI,EAAE,IAAI,MAAM,SAAS,MAAO,QAAO,SAAS,QAAQ,EAAE,KAAK,IAAI,IAAI,EAAE,QAAQ,QAAQ;AACzF,OAAK,MAAM,SAAS,MAAM,WAAW,IAAI,IAAI,SAAS,OAAO;AAC7D,SAAO;AACT;AAEA,SAAS,gBAAgB,MAAmB,OAAwD;AAClG,MAAI,UAAU,UAAa,UAAU,kBAAkB,UAAU,cAAe,QAAO;AACvF,OAAK,MAAM,uBAAuB,eAAe,sCAAsC;AACvF,SAAO;AACT;AAEA,SAAS,UAAU,GAAW,MAAmB,OAAmC;AAClF,QAAM,IAAI,EAAE,OAAO,OAAO,SAAS,SAAS;AAC5C,MAAI,CAAC,EAAG,QAAO;AACf,QAAM,QAAQ,WAAW,GAAG,MAAM,EAAE,OAAO,aAAa;AACxD,MAAI,CAAC,MAAO,QAAO;AACnB,QAAM,OAAmB,EAAE,OAAO,WAAW,EAAE,UAAU,EAAE,WAAW,iBAAiB,EAAE;AACzF,SAAO,MAAM,SAAS,WAAW,GAAG,EAAE,KAAK,CAAC;AAC5C,SAAO,MAAM,WAAW,aAAa,GAAG,EAAE,OAAO,CAAC;AAClD,SAAO,MAAM,UAAU,YAAY,GAAG,EAAE,MAAM,CAAC;AAC/C,SAAO,MAAM,WAAW,aAAa,GAAG,EAAE,OAAO,CAAC;AAClD,SAAO,MAAM,WAAW,cAAc,GAAG,MAAM,EAAE,SAAS,eAAe,CAAC;AAC1E,SAAO,MAAM,YAAY,cAAc,GAAG,MAAM,EAAE,UAAU,gBAAgB,CAAC;AAC7E,SAAO,MAAM,WAAW,aAAa,GAAG,EAAE,OAAO,CAAC;AAClD,SAAO,MAAM,oBAAoB,cAAc,GAAG,EAAE,kBAAkB,wBAAwB,CAAC;AAC/F,SAAO;AACT;AAEA,SAAS,OAAmC,MAAkB,KAAQ,OAAwC;AAC5G,MAAI,UAAU,OAAW,MAAK,GAAG,IAAI;AACvC;AAEA,SAAS,WAAW,GAAW,MAAmB,OAAgB,MAAmC;AACnG,QAAM,IAAI,EAAE,OAAO,OAAO,MAAM,CAAC,WAAW,OAAO,CAAC;AACpD,MAAI,CAAC,EAAG,QAAO;AACf,QAAM,OAAO,EAAE,QAAQ,EAAE,SAAS,GAAG,IAAI,UAAU;AACnD,MAAI,CAAC,KAAM,QAAO;AAClB,QAAM,QAAQ,WAAW,GAAG,MAAM,EAAE,OAAO,GAAG,IAAI,QAAQ;AAC1D,SAAO,QAAQ,EAAE,SAAS,MAAM,MAAM,IAAI,EAAE,SAAS,KAAK;AAC5D;AAEA,SAAS,WAAW,GAAW,MAAmB,OAAgB,MAAqD;AACrH,MAAI,UAAU,OAAW,QAAO;AAChC,QAAM,MAAM,EAAE,IAAI,OAAO,IAAI;AAC7B,MAAI,CAAC,IAAK,QAAO;AACjB,QAAM,MAAiC,CAAC;AACxC,aAAW,CAAC,KAAK,IAAI,KAAK,OAAO,QAAQ,GAAG,GAAG;AAC7C,UAAM,SAAS,UAAU,GAAG,MAAM,MAAM,GAAG,IAAI,IAAI,GAAG,EAAE;AACxD,QAAI,OAAQ,KAAI,GAAG,IAAI;AAAA,EACzB;AACA,SAAO;AACT;AAGA,SAAS,UAAU,GAAW,MAAmB,OAAgB,MAAgC;AAC/F,MAAI,OAAO,UAAU,UAAU;AAC7B,UAAM,IAAI,EAAE,QAAQ,OAAO,IAAI;AAC/B,WAAO,IAAI,CAAC,EAAE,QAAQ,GAAG,WAAW,QAAQ,CAAC,IAAI;AAAA,EACnD;AACA,MAAI,CAAC,MAAM,QAAQ,KAAK,GAAG;AACzB,SAAK,MAAM,iBAAiB,MAAM,0CAA0C;AAC5E,WAAO;AAAA,EACT;AACA,QAAM,WAAW,MAAM,IAAI,CAAC,GAAG,MAAM,aAAa,GAAG,MAAM,GAAG,GAAG,IAAI,IAAI,CAAC,EAAE,CAAC;AAC7E,SAAO,SAAS,MAAM,CAAC,MAAwB,MAAM,IAAI,IAAI,WAAW;AAC1E;AAEA,SAAS,aAAa,GAAW,MAAmB,OAAgB,MAAkC;AACpG,QAAM,IAAI,EAAE,OAAO,OAAO,MAAM,YAAY;AAC5C,MAAI,CAAC,EAAG,QAAO;AACf,QAAM,SAAS,EAAE,QAAQ,EAAE,QAAQ,GAAG,IAAI,SAAS;AACnD,MAAI,CAAC,OAAQ,QAAO;AACpB,QAAM,UAAuB,EAAE,QAAQ,WAAW,EAAE,UAAU,EAAE,WAAW,GAAG,IAAI,YAAY,EAAE;AAChG,QAAM,OAAO,UAAU,GAAG,MAAM,EAAE,MAAM,GAAG,IAAI,OAAO;AACtD,QAAM,WAAW,cAAc,GAAG,EAAE,UAAU,GAAG,IAAI,WAAW;AAChE,QAAM,SAAS,EAAE,eAAe,EAAE,QAAQ,GAAG,IAAI,SAAS;AAC1D,QAAM,WAAW,EAAE,QAAQ,EAAE,UAAU,GAAG,IAAI,WAAW;AACzD,MAAI,KAAM,SAAQ,OAAO;AACzB,MAAI,SAAU,SAAQ,WAAW;AACjC,MAAI,OAAQ,SAAQ,SAAS;AAC7B,MAAI,SAAU,SAAQ,WAAW;AACjC,SAAO;AACT;AAEA,SAAS,UAAU,GAAW,MAAmB,OAAgB,MAAyD;AACxH,MAAI,UAAU,OAAW,QAAO;AAChC,QAAM,MAAM,EAAE,IAAI,OAAO,IAAI;AAC7B,MAAI,CAAC,IAAK,QAAO;AACjB,QAAM,MAAqC,CAAC;AAC5C,aAAW,CAAC,OAAO,IAAI,KAAK,OAAO,QAAQ,GAAG,GAAG;AAC/C,UAAM,OAAO,eAAe,GAAG,MAAM,MAAM,GAAG,IAAI,IAAI,KAAK,EAAE;AAC7D,QAAI,KAAM,KAAI,KAAK,IAAI;AAAA,EACzB;AACA,SAAO;AACT;AAEA,SAAS,eAAe,GAAW,MAAmB,OAAgB,MAAoC;AACxG,QAAM,IAAI,EAAE,OAAO,OAAO,MAAM,gBAAgB;AAChD,MAAI,CAAC,EAAG,QAAO;AACf,QAAM,MAAM,OAAO,KAAK,CAAC;AACzB,MAAI,IAAI,WAAW,GAAG;AACpB,SAAK,MAAM,sBAAsB,MAAM,yCAAyC,IAAI,MAAM,EAAE;AAC5F,WAAO;AAAA,EACT;AACA,SAAO;AACT;AAEA,SAAS,cAAc,GAAW,OAAgB,MAAoC;AACpF,MAAI,UAAU,OAAW,QAAO;AAChC,QAAM,IAAI,EAAE,OAAO,OAAO,MAAM,CAAC,aAAa,SAAS,WAAW,WAAW,CAAC;AAC9E,MAAI,CAAC,EAAG,QAAO;AACf,QAAM,YAAY,EAAE,OAAO,EAAE,WAAW,GAAG,IAAI,YAAY;AAC3D,QAAM,MAAgB,EAAE,WAAW,aAAa,EAAE;AAClD,QAAM,QAAQ,EAAE,QAAQ,EAAE,OAAO,GAAG,IAAI,QAAQ;AAChD,QAAM,UAAU,EAAE,QAAQ,EAAE,SAAS,GAAG,IAAI,UAAU;AACtD,QAAM,YAAY,EAAE,QAAQ,EAAE,WAAW,GAAG,IAAI,YAAY;AAC5D,MAAI,MAAO,KAAI,QAAQ;AACvB,MAAI,QAAS,KAAI,UAAU;AAC3B,MAAI,cAAc,OAAW,KAAI,YAAY;AAC7C,SAAO;AACT;AAEA,SAAS,WAAW,GAAW,OAAiD;AAC9E,MAAI,UAAU,OAAW,QAAO;AAChC,QAAM,IAAI,EAAE,OAAO,OAAO,eAAe,CAAC,QAAQ,uBAAuB,CAAC;AAC1E,MAAI,CAAC,EAAG,QAAO;AACf,QAAM,MAAwC,CAAC;AAC/C,QAAM,OAAO,EAAE,QAAQ,EAAE,MAAM,kBAAkB;AACjD,QAAM,UAAU,EAAE,QAAQ,EAAE,uBAAuB,mCAAmC;AACtF,MAAI,KAAM,KAAI,OAAO;AACrB,MAAI,YAAY,OAAW,KAAI,wBAAwB;AACvD,SAAO;AACT;AAEA,SAAS,aAAa,GAAW,OAAmD;AAClF,MAAI,UAAU,OAAW,QAAO;AAChC,QAAM,IAAI,EAAE,OAAO,OAAO,iBAAiB,CAAC,WAAW,SAAS,MAAM,CAAC;AACvE,MAAI,CAAC,EAAG,QAAO;AACf,QAAM,MAA0C,CAAC;AACjD,QAAM,OAAO,EAAE,gBAAgB,EAAE,SAAS,uBAAuB;AACjE,QAAM,QAAQ,oBAAoB,GAAG,EAAE,OAAO,qBAAqB;AACnE,QAAM,OAAO,oBAAoB,GAAG,EAAE,MAAM,oBAAoB;AAChE,MAAI,KAAM,KAAI,UAAU;AACxB,MAAI,MAAO,KAAI,QAAQ;AACvB,MAAI,KAAM,KAAI,OAAO;AACrB,SAAO;AACT;AAEA,SAAS,oBAAoB,GAAW,OAAgB,MAA0C;AAChG,MAAI,UAAU,OAAW,QAAO;AAChC,MAAI,CAAC,MAAM,QAAQ,KAAK,GAAG;AACzB,MAAE,QAAQ,OAAO,IAAI;AACrB,WAAO;AAAA,EACT;AACA,QAAM,MAAsB,CAAC;AAC7B,QAAM,QAAQ,CAAC,OAAO,MAAM;AAC1B,QAAI,OAAO,UAAU,SAAU,QAAO,KAAK,IAAI,KAAK,KAAK;AACzD,UAAM,IAAI,EAAE,OAAO,OAAO,GAAG,IAAI,IAAI,CAAC,IAAI,CAAC,QAAQ,QAAQ,CAAC;AAC5D,UAAM,OAAO,IAAI,EAAE,OAAO,EAAE,MAAM,GAAG,IAAI,IAAI,CAAC,OAAO,IAAI;AACzD,QAAI,KAAK,KAAM,KAAI,KAAK,EAAE,WAAW,SAAY,EAAE,KAAK,IAAI,EAAE,MAAM,QAAQ,OAAO,EAAE,MAAM,EAAE,CAAC;AAAA,EAChG,CAAC;AACD,SAAO;AACT;AAEA,SAAS,YAAY,GAAW,OAAkD;AAChF,MAAI,UAAU,OAAW,QAAO;AAChC,QAAM,IAAI,EAAE,OAAO,OAAO,gBAAgB,CAAC,WAAW,QAAQ,OAAO,CAAC;AACtE,MAAI,CAAC,EAAG,QAAO;AACf,QAAM,MAAyC,CAAC;AAChD,QAAM,OAAO,EAAE,gBAAgB,EAAE,SAAS,sBAAsB;AAChE,QAAM,OAAO,EAAE,QAAQ,EAAE,MAAM,mBAAmB;AAClD,QAAM,QAAQ,EAAE,QAAQ,EAAE,OAAO,oBAAoB;AACrD,MAAI,KAAM,KAAI,UAAU;AACxB,MAAI,KAAM,KAAI,OAAO;AACrB,MAAI,MAAO,KAAI,QAAQ;AACvB,SAAO;AACT;AAEA,SAAS,aAAa,GAAW,OAAmD;AAClF,MAAI,UAAU,OAAW,QAAO;AAChC,QAAM,IAAI,EAAE,OAAO,OAAO,iBAAiB,CAAC,cAAc,CAAC;AAC3D,MAAI,CAAC,EAAG,QAAO;AACf,QAAM,eAAe,EAAE,QAAQ,EAAE,cAAc,4BAA4B;AAC3E,SAAO,eAAe,EAAE,aAAa,IAAI,CAAC;AAC5C;AAEA,SAAS,cAAc,GAAW,MAAmB,OAAgB,MAAmD;AACtH,MAAI,UAAU,OAAW,QAAO;AAChC,QAAM,MAAM,EAAE,IAAI,OAAO,IAAI;AAC7B,MAAI,CAAC,IAAK,QAAO;AACjB,QAAM,MAA+B,CAAC;AACtC,aAAW,CAAC,KAAK,OAAO,KAAK,OAAO,QAAQ,GAAG,GAAG;AAChD,UAAM,SAAS,aAAa,GAAG,MAAM,SAAS,GAAG,IAAI,IAAI,GAAG,EAAE;AAC9D,QAAI,OAAQ,KAAI,GAAG,IAAI;AAAA,EACzB;AACA,SAAO;AACT;AAEA,SAAS,aAAa,GAAW,MAAmB,OAAgB,MAA8B;AAChG,QAAM,IAAI,EAAE,OAAO,OAAO,MAAM,CAAC,SAAS,WAAW,CAAC;AACtD,MAAI,CAAC,EAAG,QAAO;AACf,QAAM,UAAmB,EAAE,WAAW,EAAE,UAAU,EAAE,WAAW,GAAG,IAAI,YAAY,EAAE;AACpF,MAAI,EAAE,UAAU,OAAW,QAAO;AAClC,QAAM,IAAI,EAAE,OAAO,EAAE,OAAO,GAAG,IAAI,UAAU,CAAC,WAAW,OAAO,CAAC;AACjE,MAAI,CAAC,EAAG,QAAO;AACf,QAAM,QAAuC,CAAC;AAC9C,QAAM,OAAO,EAAE,gBAAgB,EAAE,SAAS,GAAG,IAAI,gBAAgB;AACjE,QAAM,QAAQ,WAAW,GAAG,MAAM,EAAE,OAAO,GAAG,IAAI,cAAc;AAChE,MAAI,KAAM,OAAM,UAAU;AAC1B,MAAI,MAAO,OAAM,QAAQ;AACzB,UAAQ,QAAQ;AAChB,SAAO;AACT;AAEA,SAAS,aAAa,GAAW,OAAmD;AAClF,MAAI,UAAU,OAAW,QAAO;AAChC,QAAM,IAAI,EAAE,OAAO,OAAO,iBAAiB,CAAC,aAAa,UAAU,mBAAmB,QAAQ,CAAC;AAC/F,MAAI,CAAC,EAAG,QAAO;AACf,QAAM,MAA0C,CAAC;AACjD,QAAM,OAAO,EAAE,QAAQ,EAAE,WAAW,yBAAyB;AAC7D,QAAM,SAAS,EAAE,QAAQ,EAAE,QAAQ,sBAAsB;AACzD,QAAM,MAAM,EAAE,OAAO,EAAE,iBAAiB,+BAA+B;AACvE,QAAM,SAAS,EAAE,OAAO,EAAE,QAAQ,sBAAsB;AACxD,MAAI,SAAS,OAAW,KAAI,YAAY;AACxC,MAAI,OAAQ,KAAI,SAAS;AACzB,MAAI,QAAQ,OAAW,KAAI,kBAAkB;AAC7C,MAAI,WAAW,OAAW,KAAI,SAAS;AACvC,SAAO;AACT;;;AI5UO,SAAS,SAAS,QAAmC;AAC1D,QAAM,OAAO,IAAI,YAAY;AAC7B,QAAM,MAAe,EAAE,MAAM,kBAAkB,OAAO,KAAK,kBAAkB,MAAM,OAAO,KAAK,MAAM;AACrG,yBAAuB,KAAK,MAAM;AAClC,MAAI,OAAO,KAAK,iBAAkB,kBAAiB,KAAK,OAAO,KAAK,kBAAkB,0BAA0B,IAAI;AACpH,gBAAc,KAAK,OAAO,KAAK,MAAM,OAAO,mBAAmB;AAC/D,mBAAiB,KAAK,OAAO,KAAK,SAAS,eAAe;AAC1D,mBAAiB,KAAK,OAAO,KAAK,UAAU,gBAAgB;AAC5D,kBAAgB,KAAK,MAAM;AAC3B,SAAO;AACT;AASA,SAAS,uBAAuB,KAAc,QAA4B;AACxE,QAAM,QAAQ,YAAY,OAAO;AACjC,MAAI,CAAC,SAAS,OAAO,KAAK,SAAU,KAAI,KAAK,MAAM,sBAAsB,kBAAkB,kDAAkD;AAC7I,MAAI,CAAC,SAAS,OAAO,WAAY,KAAI,KAAK,MAAM,sBAAsB,eAAe,oDAAoD;AACzI,MAAI,SAAS,OAAO,KAAK,QAAS,KAAI,KAAK,MAAM,2BAA2B,iBAAiB,8CAA8C;AAC3I,MAAI,SAAS,OAAO,SAAS,MAAO,KAAI,KAAK,MAAM,yBAAyB,mBAAmB,iCAAiC;AAClI;AAEA,SAAS,cAAc,KAAc,OAA8C,MAAoB;AACrG,aAAW,CAAC,KAAK,QAAQ,KAAK,OAAO,QAAQ,SAAS,CAAC,CAAC,GAAG;AACzD,qBAAiB,KAAK,UAA2B,GAAG,IAAI,IAAI,GAAG,EAAE;AAAA,EACnE;AACF;AAEA,SAAS,iBAAiB,KAAc,UAAyB,MAAoB;AACnF,WAAS,QAAQ,CAAC,SAAS,MAAM;AAC/B,UAAM,QAAQ,GAAG,IAAI,IAAI,CAAC;AAC1B,QAAI,IAAI,KAAK,gBAAgB,SAAS,IAAI,CAAC,CAAE,GAAG;AAC9C,UAAI,KAAK,MAAM,uBAAuB,OAAO,WAAW,IAAI,CAAC,oDAAoD;AAAA,IACnH;AACA,oBAAgB,KAAK,SAAS,KAAK;AAAA,EACrC,CAAC;AACH;AAEA,SAAS,gBAAgB,SAA+B;AACtD,SAAO,CAAC,QAAQ,QAAQ,OAAO,KAAK,QAAQ,IAAI,EAAE,WAAW;AAC/D;AAEA,SAAS,gBAAgB,KAAc,SAAsB,MAAoB;AAC/E,MAAI,QAAQ,WAAW,OAAQ,sBAAqB,KAAK,SAAS,IAAI;AACtE,aAAW,CAAC,OAAO,IAAI,KAAK,OAAO,QAAQ,QAAQ,QAAQ,CAAC,CAAC,EAAG,mBAAkB,KAAK,MAAM,GAAG,IAAI,SAAS,KAAK,EAAE;AACtH;AAGA,SAAS,qBAAqB,KAAc,SAAsB,MAAoB;AACpF,MAAI,QAAQ,SAAU,QAAO,KAAK,iBAAiB,KAAK,QAAQ,UAAU,GAAG,IAAI,aAAa,IAAI;AAClG,MAAI,CAAC,IAAI,kBAAkB;AACzB,QAAI,KAAK,MAAM,yBAAyB,MAAM,gEAAgE;AAAA,EAChH;AACF;AAEA,SAAS,iBAAiB,KAAc,UAAoB,MAAc,mBAAkC;AAC1G,MAAI,CAAC,OAAO,UAAU,SAAS,SAAS,KAAK,SAAS,YAAY,GAAG;AACnE,QAAI,KAAK,MAAM,mBAAmB,GAAG,IAAI,cAAc,2CAA2C;AAAA,EACpG;AACA,MAAI,qBAAqB,CAAC,gBAAgB,QAAQ,GAAG;AACnD,QAAI,KAAK,MAAM,yBAAyB,MAAM,qDAAqD;AAAA,EACrG;AACF;AAEA,SAAS,gBAAgB,UAA6B;AACpD,UAAQ,SAAS,OAAO,UAAU,KAAK,MAAM,SAAS,SAAS,UAAU,KAAK,KAAK,SAAS,cAAc;AAC5G;AAIA,IAAM,WAA2D;AAAA,EAC/D,IAAI,CAAC,MAAM,MAAM,WAAW;AAAA,EAC5B,KAAK,CAAC,MAAM,MAAM,WAAW;AAAA,EAC7B,IAAI,CAAC,MAAM,SAAS,QAAQ;AAAA,EAC5B,OAAO,CAAC,MAAM,SAAS,QAAQ;AAAA,EAC/B,IAAI,CAAC,UAAU,UAAU;AAAA,EACzB,KAAK,CAAC,UAAU,UAAU;AAAA,EAC1B,IAAI,CAAC,UAAU,UAAU;AAAA,EACzB,KAAK,CAAC,UAAU,UAAU;AAAA,EAC1B,SAAS,CAAC,cAAc,sCAAsC;AAAA,EAC9D,YAAY,CAAC,cAAc,sCAAsC;AAAA,EACjE,YAAY,CAAC,UAAU,UAAU;AAAA,EACjC,MAAM,CAAC,UAAU,QAAQ;AAAA,EACzB,iBAAiB,CAAC,WAAW,eAAe;AAAA,EAC5C,QAAQ,CAAC,WAAW,eAAe;AACrC;AAEA,SAAS,kBAAkB,KAAc,MAAqB,MAAoB;AAChF,QAAM,CAAC,IAAI,KAAK,IAAI,OAAO,QAAQ,IAAI,EAAE,CAAC;AAC1C,QAAM,CAAC,OAAO,QAAQ,IAAI,SAAS,EAAE;AACrC,MAAI,CAAC,MAAM,KAAK,EAAG,KAAI,KAAK,MAAM,qBAAqB,GAAG,IAAI,IAAI,EAAE,IAAI,GAAG,EAAE,UAAU,QAAQ,EAAE;AACnG;AAEA,SAAS,SAAS,GAAqB;AACrC,SAAO,OAAO,MAAM,YAAY,OAAO,SAAS,CAAC;AACnD;AACA,SAAS,SAAS,GAAqB;AACrC,SAAO,OAAO,MAAM;AACtB;AACA,SAAS,UAAU,GAAqB;AACtC,SAAO,OAAO,MAAM;AACtB;AAGA,SAAS,aAAa,GAAqB;AACzC,MAAI,OAAO,MAAM,SAAU,QAAO;AAClC,MAAI,oBAAoB,KAAK,CAAC,EAAG,QAAO;AACxC,MAAI;AACF,QAAI,OAAO,CAAC;AACZ,WAAO;AAAA,EACT,QAAQ;AACN,WAAO;AAAA,EACT;AACF;AAEA,SAAS,iBAAiB,KAAcC,WAA+C,MAAoB;AACzG,aAAW,CAAC,KAAK,OAAO,KAAK,OAAO,QAAQA,aAAY,CAAC,CAAC,GAAG;AAC3D,UAAM,QAAQ,GAAG,IAAI,IAAI,GAAG;AAC5B,kBAAc,KAAK,QAAQ,OAAO,OAAO,GAAG,KAAK,cAAc;AAC/D,kBAAc,KAAK,SAAS,KAAK;AAAA,EACnC;AACF;AAGA,SAAS,cAAc,KAAc,SAAkB,MAAoB;AACzE,QAAM,cAAc,IAAI,KAAK;AAC7B,MAAI,QAAQ,OAAO,WAAW,OAAO,QAAQ,MAAM,SAAS,WAAW,GAAG;AACxE,QAAI,KAAK,QAAQ,mBAAmB,GAAG,IAAI,kBAAkB,WAAW,QAAQ,MAAM,OAAO,oCAAoC,WAAW,EAAE;AAAA,EAChJ;AACA,aAAW,CAAC,KAAK,QAAQ,KAAK,OAAO,QAAQ,QAAQ,OAAO,SAAS,CAAC,CAAC,GAAG;AACxE,UAAM,OAAO,eAAe,IAAI,MAAM,GAAG;AACzC,UAAM,UAAW,SAA2B,OAAgB,CAAC,GAAG,MAAO,OAAO,EAAE,QAAQ,CAAC,IAAI,EAAE,SAAS,GAAI,OAAO;AACnH,QAAI,OAAO,SAAS,IAAI,GAAG;AACzB,UAAI,KAAK,QAAQ,mBAAmB,GAAG,IAAI,gBAAgB,GAAG,IAAI,GAAG,GAAG,KAAK,OAAO,4BAA4B,IAAI,EAAE;AAAA,IACxH;AAAA,EACF;AACF;AAMA,SAAS,eAAe,MAAqC,KAAsB;AACjF,QAAM,WAAW,KAAK,QAAQ,GAAG;AACjC,MAAI,CAAC,SAAU,QAAO,KAAK;AAC3B,SAAO,SAAS,OAAgB,CAAC,GAAG,MAAO,OAAO,GAAG,EAAE,MAAM,IAAI,EAAE,SAAS,GAAI,OAAO;AACzF;AAEA,SAAS,OAAO,GAAY,GAAqB;AAC/C,SAAO,aAAa,CAAC,IAAI,aAAa,CAAC;AACzC;AAEA,SAAS,gBAAgB,KAAc,QAA4B;AACjE,QAAM,IAAI,OAAO,KAAK;AACtB,MAAI,CAAC,EAAG;AACR,MAAI,EAAE,WAAW,WAAc,EAAE,SAAS,KAAK,EAAE,SAAS,GAAI,KAAI,KAAK,MAAM,kBAAkB,wBAAwB,2BAA2B;AAClJ,MAAI,EAAE,oBAAoB,WAAc,EAAE,kBAAkB,KAAK,CAAC,OAAO,UAAU,EAAE,eAAe,IAAI;AACtG,QAAI,KAAK,MAAM,qBAAqB,iCAAiC,4CAA4C;AAAA,EACnH;AACF;;;AC1JO,IAAM,kBAAuC,oBAAI,IAAI;AAAA,EAC1D;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AACF,CAAC;;;ACfM,SAAS,WAAW,KAAa,WAA4B,MAAmB,MAA2B;AAChH,MAAI,OAAO,GAAG,EAAG,QAAO,EAAE,MAAM,QAAQ,MAAM,KAAK;AACnD,QAAM,UAAU,UAAU,OAAO,CAAC,MAAM,EAAE,SAAS,OAAO,EAAE,kBAAkB,GAAG;AACjF,MAAI,QAAQ,WAAW,KAAK,gBAAgB,KAAK,SAAS,EAAG,QAAO,EAAE,MAAM,cAAc,MAAM,KAAK;AACrG,MAAI,QAAQ,SAAS,KAAK,CAAC,QAAQ,MAAM,CAAC,MAAM,EAAE,MAAM,OAAO,QAAQ,CAAC,EAAG,MAAM,EAAE,GAAG;AACpF,SAAK,MAAM,sBAAsB,MAAM,IAAI,GAAG,eAAe,QAAQ,MAAM,6CAA6C,GAAG,OAAO;AAClI,WAAO,EAAE,MAAM,SAAS,MAAM,KAAK;AAAA,EACrC;AACA,SAAO,EAAE,MAAM,SAAS,MAAM,UAAU,KAAK,QAAQ,CAAC,KAAK,MAAM,MAAM,IAAI,EAAE;AAC/E;AAEA,SAAS,UAAU,KAAa,MAA4B,MAAmB,MAAoC;AACjH,MAAI,CAAC,MAAM;AACT,SAAK,QAAQ,oBAAoB,MAAM,IAAI,GAAG,gGAAgG;AAC9I,WAAO;AAAA,EACT;AACA,MAAI,CAAC,KAAK,UAAU;AAClB,SAAK,QAAQ,sBAAsB,MAAM,IAAI,GAAG,sFAAsF;AACtI,WAAO;AAAA,EACT;AACA,SAAO;AACT;AAEA,SAAS,gBAAgB,KAAa,WAAqC;AACzE,SAAO,gBAAgB,IAAI,GAAG,KAAK,UAAU,KAAK,CAAC,MAAM,EAAE,cAAc,SAAS,GAAG,CAAC;AACxF;AAGO,SAAS,oBAAoB,MAAgB,WAA4B,MAAmB,MAAoB;AACrH,QAAM,QAAQ,KAAK,OAAO,MAAM;AAChC,aAAW,QAAQ,WAAW;AAC5B,UAAM,WAAW,MAAM,OAAO,CAAC,MAAM,UAAU,GAAG,KAAK,IAAI,KAAM,KAAK,kBAAkB,UAAa,UAAU,GAAG,KAAK,aAAa,CAAE;AACtI,UAAM,YAAY,eAAe,QAAQ;AACzC,QAAI,UAAW,MAAK,MAAM,kBAAkB,MAAM,IAAI,UAAU,CAAC,CAAC,UAAU,UAAU,CAAC,CAAC,gBAAgB,KAAK,IAAI,4BAA4B;AAAA,EAC/I;AACF;AAEA,SAAS,eAAe,OAA0C;AAChE,QAAM,WAAW,oBAAI,IAAoB;AACzC,aAAW,KAAK,OAAO;AACrB,UAAM,QAAQ,SAAS,IAAI,EAAE,MAAM;AACnC,QAAI,UAAU,OAAW,QAAO,CAAC,OAAO,CAAC;AACzC,aAAS,IAAI,EAAE,QAAQ,CAAC;AAAA,EAC1B;AACA,SAAO;AACT;AAGO,SAAS,kBAAkB,QAAkB,MAAqB,MAAmB,MAAoB;AAC9G,QAAM,aAAa,iBAAiB,KAAK,WAAW;AACpD,MAAI,CAAC,WAAY;AACjB,aAAW,SAAS,QAAQ;AAC1B,UAAM,CAAC,MAAM,KAAK,IAAI,MAAM,MAAM,GAAG;AACrC,QAAI,SAAS,UAAU,UAAU,UAAa,CAAC,WAAW,IAAI,KAAK,GAAG;AACpE,WAAK,QAAQ,oBAAoB,GAAG,IAAI,IAAI,KAAK,IAAI,IAAI,KAAK,mCAAmC,KAAK,IAAI,EAAE;AAAA,IAC9G;AAAA,EACF;AACF;AAEA,SAAS,iBAAiB,QAAqC;AAC7D,MAAI,WAAW,QAAQ,OAAO,WAAW,SAAU,QAAO;AAC1D,QAAM,QAAS,OAAoC;AACnD,MAAI,UAAU,QAAQ,OAAO,UAAU,SAAU,QAAO;AACxD,SAAO,IAAI,IAAI,OAAO,KAAK,KAAe,CAAC;AAC7C;;;AC1EO,SAAS,YAAY,MAAkB,KAAmC;AAC/E,SAAO,CAAC,GAAG,WAAW,MAAM,GAAG,GAAG,GAAG,aAAa,MAAM,GAAG,GAAG,GAAG,YAAY,MAAM,GAAG,GAAG,GAAG,aAAa,MAAM,GAAG,CAAC;AACrH;AAEA,SAAS,MAAM,YAAoB,QAA6B,YAAyB,OAAe,KAAiC;AACvI,SAAO;AAAA,IACL,IAAI,MAAM,UAAU,IAAI,MAAM,IAAI,KAAK;AAAA,IACvC,SAAS;AAAA,IACT,OAAO,EAAE,WAAW;AAAA,IACpB;AAAA,IACA;AAAA,IACA,WAAW;AAAA,IACX,YAAY,EAAE,SAAS,YAAY,SAAS,OAAO,QAAQ,IAAI,QAAQ,OAAO,IAAI,MAAM;AAAA,EAC1F;AACF;AAEA,SAAS,WAAW,MAAkB,KAAmC;AACvE,QAAM,OAAO,KAAK,OAAO,QAAQ,CAAC,GAAG,IAAI,CAAC,MAAM,MAAM,MAAM,SAAS,SAAS,CAAC,EAAE,OAAO,QAAQ,IAAI,QAAQ,OAAO,KAAK,CAAC,GAAG,GAAG,GAAG,CAAC;AACnI,MAAI,KAAK,OAAO,0BAA0B,OAAO;AAC/C,QAAI,KAAK,MAAM,SAAS,SAAS,CAAC,EAAE,OAAO,mBAAmB,IAAI,MAAM,OAAO,MAAM,CAAC,GAAG,IAAI,QAAQ,GAAG,CAAC;AAAA,EAC3G;AACA,SAAO;AACT;AAEA,SAAS,OAAO,OAA6B;AAC3C,SAAO,OAAO,UAAU,WAAW,QAAQ,MAAM;AACnD;AAEA,SAAS,aAAa,MAAkB,KAAmC;AACzE,QAAM,IAAI,KAAK;AACf,MAAI,CAAC,EAAG,QAAO,CAAC;AAChB,QAAM,QAAQ,EAAE,QAAQ,CAAC,GAAG,IAAI,CAAC,GAAG,MAAM,MAAM,WAAW,SAAS,CAAC,EAAE,OAAO,QAAQ,IAAI,QAAQ,OAAO,OAAO,CAAC,EAAE,CAAC,GAAG,GAAG,GAAG,CAAC;AAC9H,QAAM,SAAS,EAAE,SAAS,CAAC,GAAG,IAAI,CAAC,GAAG,MAAM,MAAM,WAAW,SAAS,CAAC,EAAE,OAAO,QAAQ,IAAI,QAAQ,OAAO,OAAO,CAAC,EAAE,CAAC,GAAG,KAAK,SAAS,GAAG,GAAG,CAAC;AAC9I,SAAO,CAAC,GAAG,MAAM,GAAG,KAAK;AAC3B;AAEA,SAAS,YAAY,MAAkB,KAAmC;AACxE,QAAM,IAAI,KAAK;AACf,MAAI,CAAC,EAAG,QAAO,CAAC;AAChB,QAAM,QAAQ,EAAE,QAAQ,CAAC,GAAG,IAAI,CAAC,GAAG,MAAM,MAAM,UAAU,QAAQ,CAAC,EAAE,OAAO,SAAS,IAAI,QAAQ,OAAO,EAAE,CAAC,GAAG,GAAG,GAAG,CAAC;AACrH,QAAM,SAAS,EAAE,SAAS,CAAC,GAAG,IAAI,CAAC,GAAG,MAAM,MAAM,UAAU,SAAS,CAAC,EAAE,OAAO,SAAS,IAAI,QAAQ,OAAO,EAAE,CAAC,GAAG,KAAK,SAAS,GAAG,GAAG,CAAC;AACtI,SAAO,CAAC,GAAG,MAAM,GAAG,KAAK;AAC3B;AAEA,SAAS,aAAa,MAAkB,KAAmC;AACzE,QAAM,QAAQ,KAAK,SAAS,gBAAgB,CAAC;AAC7C,SAAO,MAAM,WAAW,IAAI,CAAC,IAAI,CAAC,MAAM,WAAW,SAAS,CAAC,EAAE,OAAO,OAAO,IAAI,MAAM,OAAO,MAAM,CAAC,GAAG,GAAG,GAAG,CAAC;AACjH;;;ACrDA,IAAM,SAA8C;AAAA,EAClD,IAAI;AAAA,EACJ,KAAK;AAAA,EACL,IAAI;AAAA,EACJ,OAAO;AAAA,EACP,IAAI;AAAA,EACJ,KAAK;AAAA,EACL,IAAI;AAAA,EACJ,KAAK;AAAA,EACL,SAAS;AAAA,EACT,YAAY;AAAA,EACZ,YAAY;AAAA,EACZ,MAAM;AAAA,EACN,iBAAiB;AAAA,EACjB,QAAQ;AACV;AAOO,SAAS,gBAAgB,MAAiDC,aAAoD;AACnI,SAAO,OAAO,QAAQ,QAAQ,CAAC,CAAC,EAAE,IAAI,CAAC,CAAC,OAAO,IAAI,MAAM,eAAe,OAAO,MAAMA,WAAU,CAAC;AAClG;AAEA,SAAS,eAAe,OAAe,MAAqBA,aAAkD;AAC5G,QAAM,CAAC,IAAI,OAAO,IAAI,OAAO,QAAQ,IAAI,EAAE,CAAC;AAC5C,QAAM,YAAuB;AAAA,IAC3B,OAAO,OAAO,oBAAoB,oBAAoB;AAAA,IACtD,IAAI,OAAO,EAAE;AAAA,IACb,OAAO;AAAA,EACT;AACA,MAAIA,gBAAe,UAAa,MAAM,WAAW,OAAO,EAAG,WAAU,gBAAgB,EAAE,YAAAA,YAAW;AAClG,SAAO;AACT;;;ACjCA,IAAM,OAAO;AAAA,EACX;AAAA,EAAS;AAAA,EAAS;AAAA,EAAS;AAAA,EAAS;AAAA,EACpC;AAAA,EAAS;AAAA,EAAS;AAAA,EAClB;AAAA,EAAS;AAAA,EAAS;AAAA,EAAS;AAAA,EAC3B;AAAA,EAAS;AAAA,EACT;AAAA,EAAS;AAAA,EAAS;AAAA,EAClB;AAAA,EAAS;AAAA,EAAS;AAAA,EAAS;AAAA,EAAS;AAAA,EAAS;AAAA,EAAS;AAAA,EAAS;AAAA,EAC/D;AAAA,EAAS;AAAA,EAAS;AAAA,EAAS;AAAA,EAAS;AAAA,EACpC;AAAA,EACA;AAAA,EAAS;AACX,EAAE,IAAI,CAAC,MAAM,QAAQ,CAAC,EAAE;AAExB,IAAM,QAAQ;AAAA,EACZ;AAAA,EAAiB;AAAA,EAAiB;AAAA,EAAiB;AAAA,EAAiB;AAAA,EACpE;AAAA,EAAiB;AAAA,EAAc;AAAA,EAAc;AAAA,EAC7C;AAAA,EAAiB;AAAA,EAAoB;AAAA,EAAqB;AAAA,EAAc;AAAA,EAAiB;AAAA,EAAc;AACzG,EAAE,IAAI,CAAC,MAAM,SAAS,CAAC,EAAE;AAElB,IAAM,iBAAsC,oBAAI,IAAI,CAAC,GAAG,MAAM,GAAG,KAAK,CAAC;;;ACPvE,SAAS,WAAW,OAA8C,KAAsB,MAAc,SAAyB,aAAkC;AACtK,QAAM,MAAmB,CAAC;AAC1B,aAAW,CAAC,KAAK,KAAK,KAAK,OAAO,QAAQ,SAAS,CAAC,CAAC,GAAG;AACtD,QAAI,KAAK,GAAG,UAAU,KAAK,OAAwB,KAAK,GAAG,IAAI,IAAI,GAAG,IAAI,SAAS,WAAW,CAAC;AAAA,EACjG;AACA,SAAO;AACT;AAEA,SAAS,UAAU,KAAa,UAAyB,KAAsB,MAAc,SAAyB,aAAkC;AACtJ,QAAM,WAAW,WAAW,KAAK,IAAI,WAAW,IAAI,MAAM,IAAI;AAC9D,gBAAc,UAAU,IAAI,MAAM,IAAI;AACtC,QAAM,SAAS,SAAS,QAAQ,CAAC,MAAM,OAAO,KAAK,EAAE,QAAQ,CAAC,CAAC,CAAC;AAChE,MAAI,SAAS,KAAM,mBAAkB,QAAQ,SAAS,MAAM,IAAI,MAAM,IAAI;AAC1E,QAAMC,cAAa,SAAS,SAAS,UAAW,SAAS,MAAM,cAAc,OAAQ;AACrF,SAAO,SAAS,IAAI,CAAC,SAAS,WAAW;AAAA,IACvC,IAAI,YAAY,KAAK,OAAO,OAAO;AAAA,IACnC;AAAA,IACA,OAAO,SAAS,KAAK,SAAS,MAAM,KAAK;AAAA,IACzC,QAAQ,QAAQ;AAAA,IAChB,YAAY,gBAAgB,QAAQ,MAAMA,WAAU;AAAA,IACpD,GAAG,YAAY,SAAS,IAAI,gBAAgB;AAAA,IAC5C,WAAW,SAAS,QAAQ,WAAW,WAAW;AAAA,IAClD,GAAI,QAAQ,WAAW,EAAE,UAAU,QAAQ,SAAS,IAAI,CAAC;AAAA,IACzD,YAAY,EAAE,SAAS,KAAK,SAAS,OAAO,QAAQ,IAAI,QAAQ,OAAO,UAAU,WAAW,IAAI,MAAM;AAAA,EACxG,EAAE;AACJ;AAGA,SAAS,cAAc,UAAyB,MAAmB,MAAoB;AACrF,WAAS,QAAQ,CAAC,GAAG,MAAM;AACzB,eAAW,WAAW,EAAE,YAAY,CAAC,GAAG;AACtC,UAAI,CAAC,eAAe,IAAI,OAAO,EAAG,MAAK,QAAQ,mBAAmB,GAAG,IAAI,IAAI,CAAC,aAAa,+BAA+B,OAAO,GAAG;AAAA,IACtI;AAAA,EACF,CAAC;AACH;AAEA,SAAS,SAAS,KAAa,MAAuC,OAA+B;AACnG,MAAI,SAAS,aAAc,QAAO,EAAE,YAAY,IAAI;AACpD,QAAM,UAAmB;AACzB,SAAO,EAAE,MAAM,KAAK,SAAS,MAAM;AACrC;AAEA,SAAS,YAAY,SAAsB,UAAyD;AAClG,MAAI,QAAQ,WAAW,OAAQ,QAAO,CAAC;AACvC,QAAM,WAAW,QAAQ,YAAY;AACrC,SAAO,WAAW,EAAE,SAAS,IAAI,CAAC;AACpC;AAGO,SAAS,SAAS,GAAW,GAAmB;AACrD,MAAI,MAAM,QAAS,QAAO;AAC1B,MAAI,MAAM,QAAS,QAAO;AAC1B,SAAO,KAAK,MAAM,CAAC,KAAK,KAAK,MAAM,CAAC,IAAI,IAAI;AAC9C;AAEO,SAAS,YAAY,KAAa,OAAe,SAAiC;AACvF,QAAM,OAAO,IAAI,QAAQ,kBAAkB,GAAG,EAAE,QAAQ,UAAU,EAAE,EAAE,YAAY;AAClF,QAAM,MAAM,UAAU,MAAM,YAAY,OAAO,IAAI;AACnD,SAAO,MAAM,IAAI,GAAG,GAAG,IAAI,KAAK;AAClC;AAEA,SAAS,YAAY,SAA0B;AAC7C,QAAM,QAAQ,OAAO,OAAO,OAAO,EAAE,CAAC;AACtC,SAAO,MAAM,QAAQ,kBAAkB,GAAG,EAAE,QAAQ,UAAU,EAAE,EAAE,YAAY;AAChF;AAGO,SAAS,WAAW,KAAa,MAAuC;AAC7E,MAAI,SAAS,WAAY,QAAO,EAAE,SAAS,IAAI;AAC/C,MAAI,IAAI,SAAS,GAAG,EAAG,QAAO,EAAE,OAAO,IAAI,YAAY,EAAE;AACzD,MAAI,IAAI,WAAW,OAAO,EAAG,QAAO,EAAE,OAAO,IAAI,MAAM,QAAQ,MAAM,EAAE;AACvE,SAAO,EAAE,cAAc,IAAI;AAC7B;AAEO,SAAS,cAAcC,WAA+C,MAA8B,KAAsB,MAA2B;AAC1J,QAAM,MAAmB,CAAC;AAC1B,aAAW,CAAC,KAAK,OAAO,KAAK,OAAO,QAAQA,aAAY,CAAC,CAAC,GAAG;AAC3D,UAAM,UAAU,WAAW,KAAK,IAAI;AACpC,UAAM,QAAQ,GAAG,IAAI,IAAI,GAAG;AAC5B,QAAI,KAAK,GAAG,WAAW,QAAQ,OAAO,OAAO,KAAK,GAAG,KAAK,UAAU,SAAS,QAAQ,SAAS,CAAC;AAC/F,QAAI,QAAQ,OAAO,QAAS,KAAI,KAAK,eAAe,QAAQ,MAAM,SAAS,SAAS,QAAQ,WAAW,GAAG,CAAC;AAAA,EAC7G;AACA,SAAO;AACT;AAGA,SAAS,eAAe,QAA6B,SAAkB,WAAmB,KAAiC;AACzH,SAAO;AAAA,IACL,IAAI,YAAY,KAAK,GAAG,OAAO;AAAA,IAC/B;AAAA,IACA,OAAO,EAAE,MAAM,KAAK,SAAS,QAAQ,OAAO,EAAE;AAAA,IAC9C;AAAA,IACA,YAAY,CAAC;AAAA,IACb,GAAI,WAAW,UAAU,IAAI,mBAAmB,EAAE,UAAU,IAAI,iBAAiB,IAAI,CAAC;AAAA,IACtF;AAAA,IACA,YAAY,EAAE,SAAS,iBAAiB,SAAS,GAAG,QAAQ,IAAI,QAAQ,OAAO,SAAS;AAAA,EAC1F;AACF;;;AC9FA,IAAM,aAA8C;AAAA,EAClD,OAAO;AAAA,EACP,OAAO;AAAA,EACP,SAAS;AAAA,EACT,QAAQ;AAAA,EACR,SAAS;AACX;AAEA,IAAM,QAAyC;AAAA,EAC7C,OAAO;AAAA,EACP,OAAO;AAAA,EACP,SAAS;AAAA,EACT,QAAQ;AAAA,EACR,SAAS;AACX;AAEO,SAAS,qBAAqB,QAAsB,WAAkD;AAC3G,QAAM,QAAQ,YAAY,OAAO,SAAS,QAAQ;AAClD,QAAM,WAA6C,EAAE,OAAO,MAAM,MAAM;AACxE,aAAW,WAAW,CAAC,SAAS,WAAW,UAAU,SAAS,GAAY;AACxE,QAAI,OAAO,KAAK,OAAO,EAAG,UAAS,OAAO,IAAI,MAAM,OAAO;AAAA,EAC7D;AACA,SAAO,EAAE,UAAU,6BAA6B,UAAU,QAAQ,SAAS,EAAE;AAC/E;AAEA,SAAS,UAAU,QAAsB,WAAsC;AAC7E,QAAM,iBAAiB,OAAO,KAAK,OAAO,KAAK,MAAM,SAAS,CAAC,CAAC,EAAE,OAAO,CAAC,MAAM,gBAAgB,IAAI,CAAC,KAAK,UAAU,KAAK,CAAC,MAAM,EAAE,cAAc,SAAS,CAAC,CAAC,CAAC;AAC5J,MAAI,eAAe,WAAW,EAAG,QAAO,CAAC;AACzC,SAAO,UACJ,OAAO,CAAC,MAAM,CAAC,eAAe,KAAK,CAAC,MAAM,EAAE,cAAc,SAAS,CAAC,CAAC,CAAC,EACtE,IAAI,CAAC,MAAM,EAAE,iBAAiB,EAAE,IAAI,EACpC,KAAK;AACV;;;AC3BO,SAAS,QAAQ,QAAsB,WAA4B,SAAwC;AAChH,QAAM,OAAO,SAAS,MAAM;AAC5B,QAAM,SAAS,qBAAqB,QAAQ,SAAS;AACrD,MAAI,KAAK,UAAW,QAAO,EAAE,UAAU,MAAM,aAAa,MAAM,OAAO;AACvE,QAAM,QAAQ,cAAcC,UAAS,OAAO,MAAM,CAAC;AACnD,QAAM,MAAuB,EAAE,WAAW,MAAM,OAAO,kBAAkB,OAAO,KAAK,kBAAkB,QAAQ,QAAQ,UAAU,OAAO;AACxI,sBAAoB,OAAO,KAAK,OAAO,KAAK,MAAM,SAAS,CAAC,CAAC,GAAG,WAAW,MAAM,mBAAmB;AACpG,mBAAiB,QAAQ,IAAI;AAC7B,QAAM,aAAa;AAAA,IACjB,GAAG,WAAW,OAAO,KAAK,MAAM,OAAO,KAAK,qBAAqB,MAAM,OAAO,KAAK,SAAS;AAAA,IAC5F,GAAG,YAAY,OAAO,MAAM,GAAG;AAAA,IAC/B,GAAG,cAAc,OAAO,KAAK,SAAS,WAAW,KAAK,eAAe;AAAA,IACrE,GAAG,cAAc,OAAO,KAAK,UAAU,YAAY,KAAK,gBAAgB;AAAA,EAC1E;AACA,MAAI,KAAK,UAAW,QAAO,EAAE,UAAU,MAAM,aAAa,MAAM,OAAO;AACvE,QAAM,WAA2B;AAAA,IAC/B,eAAe;AAAA,IACf,UAAU,QAAQ;AAAA,IAClB,QAAQA,UAAS,OAAO,QAAQ,MAAM;AAAA,IACtC;AAAA,IACA,UAAU,WAAW,MAAM;AAAA,IAC3B,SAAS,UAAU,MAAM;AAAA,IACzB,WAAW,OAAO,KAAK;AAAA,IACvB;AAAA,EACF;AACA,WAAS,aAAa,WAAW,QAAQ;AACzC,SAAO,EAAE,UAAU,aAAa,MAAM,OAAO;AAC/C;AAEA,eAAsB,gBAAgB,QAAsB,MAAqB,SAAiD;AAChI,SAAO,QAAQ,QAAQ,MAAM,KAAK,eAAe,OAAO,MAAM,GAAG,OAAO;AAC1E;AAEA,SAASA,UAAS,QAAsB,QAAqC;AAC3E,MAAI,YAAY,QAAQ;AACtB,UAAM,WAAW,OAAO,KAAK,QAAQ,KAAK,YAAY,CAAC,CAAC;AACxD,WAAO,SAAS,SAAS,EAAE,QAAQ,SAAS,SAAS,IAAI,EAAE,QAAQ,QAAQ;AAAA,EAC7E;AACA,SAAO;AACT;AAEA,SAAS,WAAW,QAAgC;AAClD,SAAO;AAAA,IACL,OAAO,OAAO,KAAK,MAAM;AAAA,IACzB,SAAS,OAAO,KAAK,SAAS,WAAW;AAAA,IACzC,OAAO;AAAA,IACP,QAAQ,OAAO,KAAK,QAAQ,WAAW;AAAA,EACzC;AACF;AAEA,SAAS,UAAU,QAA+B;AAChD,QAAM,IAAI,OAAO,KAAK;AACtB,SAAO;AAAA,IACL,WAAW,GAAG,aAAa;AAAA,IAC3B,QAAQ,GAAG,UAAU,CAAC,WAAW,YAAY,eAAe;AAAA,IAC5D,iBAAiB,GAAG,mBAAmB;AAAA,IACvC,QAAQ,GAAG,UAAU;AAAA,EACvB;AACF;AAGA,SAAS,iBAAiB,QAAsB,MAAyB;AACvE,MAAI,EAAE,YAAY,OAAO,WAAW,OAAO,eAAe,cAAe;AACzE,aAAW,CAAC,SAAS,OAAO,KAAK,OAAO,QAAQ,OAAO,KAAK,YAAY,CAAC,CAAC,GAAG;AAC3E,eAAW,CAAC,KAAK,QAAQ,KAAK,OAAO,QAAQ,QAAQ,OAAO,SAAS,CAAC,CAAC,GAAG;AACxE,UAAI,YAAY,UAA2B,YAAY,QAAQ,GAAG,CAAC,GAAG;AACpE,aAAK,MAAM,0BAA0B,kBAAkB,OAAO,gBAAgB,GAAG,IAAI,2GAA2G;AAAA,MAClM;AAAA,IACF;AAAA,EACF;AACF;AAEA,SAAS,YAAY,QAAsB,KAAqB;AAC9D,QAAM,OAAO,OAAO,KAAK,MAAM,QAAQ,GAAG;AAC1C,MAAI,CAAC,MAAM,QAAQ,IAAI,EAAG,QAAO,aAAa,OAAO,KAAK,MAAM,OAAO;AACvE,SAAO,KAAK,IAAI,GAAG,KAAK,IAAI,CAAC,MAAM,aAAa,EAAE,MAAM,CAAC,CAAC;AAC5D;AAEA,SAAS,YAAY,UAAyB,UAA2B;AACvE,SAAO,SAAS,KAAK,CAAC,MAAM,aAAa,EAAE,MAAM,IAAI,QAAQ;AAC/D;;;ACxGA,SAAS,iBAAiB;AASnB,SAAS,UAAU,QAA8B;AACtD,QAAM,OAAO,EAAE,GAAG,OAAO,MAAM,OAAO,EAAE,GAAG,OAAO,KAAK,OAAO,OAAO,UAAU,OAAO,KAAK,MAAM,KAAK,EAAE,EAAE;AAC1G,MAAI,KAAK,QAAS,MAAK,UAAU,SAAS,KAAK,OAAO;AACtD,MAAI,KAAK,SAAU,MAAK,WAAW,SAAS,KAAK,QAAQ;AACzD,QAAM,MAA+B;AAAA,IACnC,YAAY,OAAO;AAAA,IACnB,MAAM,OAAO;AAAA,IACb,UAAU,OAAO;AAAA,IACjB,QAAQ,OAAO;AAAA,EACjB;AACA,MAAI,OAAO,WAAY,KAAI,aAAa,OAAO;AAC/C,MAAI,OAAO;AACX,SAAO,UAAU,KAAK,EAAE,WAAW,GAAG,mBAAmB,SAAS,gBAAgB,QAAQ,CAAC;AAC7F;AAEA,SAAS,UAAU,OAAqF;AACtG,MAAI,CAAC,MAAO,QAAO;AACnB,QAAM,MAAiC,CAAC;AACxC,aAAW,CAAC,KAAK,KAAK,KAAK,OAAO,QAAQ,KAAK,EAAG,KAAI,GAAG,IAAI,cAAc,KAAsB;AACjG,SAAO;AACT;AAEA,SAAS,cAAc,UAAoC;AACzD,QAAM,OAAO,SAAS,WAAW,IAAI,SAAS,CAAC,IAAK;AACpD,QAAM,QAAQ,QAAQ,OAAO,KAAK,IAAI,EAAE,WAAW,KAAK,KAAK,cAAc;AAC3E,SAAO,QAAQ,KAAK,SAAS;AAC/B;AAEA,SAAS,SAAsE,KAA2C;AACxH,QAAM,MAAyB,CAAC;AAChC,aAAW,CAAC,KAAK,OAAO,KAAK,OAAO,QAAQ,GAAG,GAAG;AAChD,QAAI,GAAG,IAAI,QAAQ,OAAO,QAAQ,EAAE,GAAG,SAAS,OAAO,EAAE,GAAG,QAAQ,OAAO,OAAO,UAAU,QAAQ,MAAM,KAAK,EAAE,EAAE,IAAI;AAAA,EACzH;AACA,SAAO;AACT;","names":["createHash","createHash","childOf","floor","isPlainObject","overlays","schemaHash","schemaHash","overlays","targetOf"]}