@byok-sdk/cloud 0.4.2 → 0.5.0

This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
Files changed (6) hide show
  1. package/README.md +19 -0
  2. package/dist/auth/device-assertion.d.ts +18 -0
  3. package/dist/index.d.ts +2 -0
  4. package/dist/index.js +24 -2
  5. package/dist/index.js.map +1 -1
  6. package/package.json +3 -3
package/dist/index.js.map CHANGED
@@ -1 +1 @@
1
- {"version":3,"sources":["../src/crypto/web-crypto.ts","../src/auth/tokens.ts","../src/auth/verify.ts","../src/auth/plane.ts","../src/capabilities.ts","../src/errors.ts","../src/activity.ts","../src/coordination.ts","../src/auth/bearer.ts","../src/tenant-stores.ts","../src/handlers/shared.ts","../src/handlers/blobs.ts","../src/handlers/capabilities.ts","../src/handlers/auth.ts","../src/handlers/events.ts","../src/approval-timeline.ts","../src/board-projection.ts","../src/inbound.ts","../src/handlers/messages.ts","../src/handlers/board.ts","../src/handlers/presence.ts","../src/handlers/skill-packs.ts","../src/auth/device-proof.ts","../src/truth/contract.ts","../src/truth/errors.ts","../src/handlers/truth.ts","../src/router/registry.ts","../src/terminal-result.ts","../src/cloud.ts","../src/stores/in-memory/rate-limiter.ts","../src/stores/in-memory/blobs.ts","../src/stores/in-memory/device-directory.ts","../src/stores/in-memory/dedup.ts","../src/stores/in-memory/nonces.ts","../src/stores/in-memory/pairing-codes.ts","../src/stores/in-memory/receipts.ts","../src/stores/in-memory/proof-receipts.ts","../src/stores/in-memory/task-attempts.ts","../src/stores/in-memory/activity.ts","../src/stores/in-memory/approval-timeline.ts","../src/stores/in-memory/index.ts","../src/composition/in-memory.ts","../src/coordination-client.ts","../src/stores/ports.ts","../src/stores/ports-contract.ts"],"names":["tenantId","z","response","tenantKey","isCoreConflictError","isCoreError","principalTenant","isTenantId","unauthorized","contentHash","STORAGE_ERROR_CODES","STORAGE_ERROR_HTTP_STATUS","decodeEnvelope","envelope","encodeEnvelope","nonce","BOARD_STATUSES","hasCapability","BYOK_BOARD_PATH","BYOK_BOARD_STREAM_PATH"],"mappings":";;;;;;;;;AAWA,IAAM,qBAAA,GAAwB,kCAAA;AAE9B,IAAM,UAAA,GAAa,kBAAA;AAEZ,SAAS,gBAAgB,KAAA,EAA2B;AACzD,EAAA,IAAI,MAAA,GAAS,EAAA;AACb,EAAA,KAAA,MAAW,IAAA,IAAQ,KAAA,EAAO,MAAA,IAAU,MAAA,CAAO,aAAa,IAAI,CAAA;AAC5D,EAAA,OAAO,IAAA,CAAK,MAAM,CAAA,CAAE,UAAA,CAAW,GAAA,EAAK,GAAG,CAAA,CAAE,UAAA,CAAW,GAAA,EAAK,GAAG,CAAA,CAAE,UAAA,CAAW,KAAK,EAAE,CAAA;AAClF;AAQO,SAAS,gBAAgB,KAAA,EAAuC;AACrE,EAAA,MAAM,MAAA,GAAS,MAAM,UAAA,CAAW,GAAA,EAAK,GAAG,CAAA,CAAE,UAAA,CAAW,KAAK,GAAG,CAAA;AAC7D,EAAA,IAAI;AACF,IAAA,MAAM,MAAA,GAAS,KAAK,MAAM,CAAA;AAC1B,IAAA,MAAM,KAAA,GAAQ,IAAI,UAAA,CAAW,MAAA,CAAO,MAAM,CAAA;AAC1C,IAAA,KAAA,IAAS,KAAA,GAAQ,CAAA,EAAG,KAAA,GAAQ,MAAA,CAAO,MAAA,EAAQ,KAAA,IAAS,CAAA,EAAG,KAAA,CAAM,KAAK,CAAA,GAAI,MAAA,CAAO,UAAA,CAAW,KAAK,CAAA;AAC7F,IAAA,OAAO,KAAA;AAAA,EACT,CAAA,CAAA,MAAQ;AACN,IAAA,OAAO,MAAA;AAAA,EACT;AACF;AAEA,SAAS,MAAM,KAAA,EAA2B;AACxC,EAAA,IAAI,GAAA,GAAM,EAAA;AACV,EAAA,KAAA,MAAW,QAAQ,KAAA,EAAO;AACxB,IAAA,GAAA,IAAO,UAAA,CAAY,IAAA,IAAQ,CAAA,GAAK,EAAG,CAAA;AACnC,IAAA,GAAA,IAAO,UAAA,CAAW,OAAO,EAAG,CAAA;AAAA,EAC9B;AACA,EAAA,OAAO,GAAA;AACT;AAaA,SAAS,MAAA,GAA2B;AAClC,EAAA,MAAM,YAAY,UAAA,CAAW,MAAA;AAC7B,EAAA,IAAI,SAAA,EAAW,WAAW,MAAA,EAAW;AACnC,IAAA,MAAM,IAAI,MAAM,0EAA0E,CAAA;AAAA,EAC5F;AACA,EAAA,OAAO,SAAA,CAAU,MAAA;AACnB;AAEO,SAAS,eAAA,GAA+B;AAC7C,EAAA,OAAO;AAAA,IACL,UAAA,GAAqB;AACnB,MAAA,OAAO,UAAA,CAAW,OAAO,UAAA,EAAW;AAAA,IACtC,CAAA;AAAA,IAEA,YAAY,UAAA,EAA4B;AACtC,MAAA,OAAO,eAAA,CAAgB,WAAW,MAAA,CAAO,eAAA,CAAgB,IAAI,UAAA,CAAW,UAAU,CAAC,CAAC,CAAA;AAAA,IACtF,CAAA;AAAA,IAEA,kBAAkB,MAAA,EAAwB;AACxC,MAAA,MAAM,QAAQ,UAAA,CAAW,MAAA,CAAO,gBAAgB,IAAI,UAAA,CAAW,MAAM,CAAC,CAAA;AACtE,MAAA,IAAI,GAAA,GAAM,EAAA;AACV,MAAA,KAAA,MAAW,QAAQ,KAAA,EAAO;AACxB,QAAA,GAAA,IAAO,qBAAA,CAAsB,IAAA,GAAO,qBAAA,CAAsB,MAAM,CAAA;AAAA,MAClE;AACA,MAAA,OAAO,GAAA;AAAA,IACT,CAAA;AAAA,IAEA,MAAM,aAAA,CACJ,kBAAA,EACA,OAAA,EACA,SAAA,EACkB;AAClB,MAAA,MAAM,cAAA,GAAiB,gBAAgB,SAAS,CAAA;AAChD,MAAA,IAAI,cAAA,KAAmB,QAAW,OAAO,KAAA;AACzC,MAAA,IAAI;AACF,QAAA,MAAM,GAAA,GAAM,MAAM,MAAA,EAAO,CAAE,SAAA;AAAA,UACzB,KAAA;AAAA,UACA,EAAE,GAAA,EAAK,KAAA,EAAO,GAAA,EAAK,SAAA,EAAW,GAAG,kBAAA,EAAmB;AAAA,UACpD,EAAE,MAAM,SAAA,EAAU;AAAA,UAClB,KAAA;AAAA,UACA,CAAC,QAAQ;AAAA,SACX;AACA,QAAA,MAAM,YAAA,GAAe,OAAO,OAAA,KAAY,QAAA,GAAW,IAAI,WAAA,EAAY,CAAE,MAAA,CAAO,OAAO,CAAA,GAAI,OAAA;AACvF,QAAA,OAAO,MAAM,MAAA,EAAO,CAAE,MAAA,CAAO,EAAE,MAAM,SAAA,EAAU,EAAG,GAAA,EAAK,cAAA,EAAgB,YAAY,CAAA;AAAA,MACrF,CAAA,CAAA,MAAQ;AAGN,QAAA,OAAO,KAAA;AAAA,MACT;AAAA,IACF,CAAA;AAAA,IAEA,MAAM,UAAA,CAAW,MAAA,EAAoB,OAAA,EAAkC;AACrE,MAAA,MAAM,MAAM,MAAM,MAAA,EAAO,CAAE,SAAA,CAAU,OAAO,MAAA,EAAQ,EAAE,IAAA,EAAM,MAAA,EAAQ,MAAM,SAAA,EAAU,EAAG,KAAA,EAAO,CAAC,MAAM,CAAC,CAAA;AACtG,MAAA,MAAM,SAAA,GAAY,MAAM,MAAA,EAAO,CAAE,IAAA,CAAK,MAAA,EAAQ,GAAA,EAAK,IAAI,WAAA,EAAY,CAAE,MAAA,CAAO,OAAO,CAAC,CAAA;AACpF,MAAA,OAAO,eAAA,CAAgB,IAAI,UAAA,CAAW,SAAS,CAAC,CAAA;AAAA,IAClD,CAAA;AAAA,IAEA,MAAM,OAAO,IAAA,EAAmC;AAC9C,MAAA,MAAM,SAAS,MAAM,MAAA,EAAO,CAAE,MAAA,CAAO,WAAW,IAAI,CAAA;AACpD,MAAA,OAAO,UAAU,KAAA,CAAM,IAAI,UAAA,CAAW,MAAM,CAAC,CAAC,CAAA,CAAA;AAAA,IAChD,CAAA;AAAA,IAEA,eAAA,CAAgB,MAAc,KAAA,EAAwB;AACpD,MAAA,MAAM,SAAA,GAAY,gBAAgB,IAAI,CAAA;AACtC,MAAA,MAAM,UAAA,GAAa,gBAAgB,KAAK,CAAA;AACxC,MAAA,IAAI,SAAA,KAAc,MAAA,IAAa,UAAA,KAAe,MAAA,EAAW,OAAO,KAAA;AAChE,MAAA,IAAI,SAAA,CAAU,MAAA,KAAW,UAAA,CAAW,MAAA,EAAQ,OAAO,KAAA;AACnD,MAAA,IAAI,IAAA,GAAO,CAAA;AACX,MAAA,KAAA,IAAS,QAAQ,CAAA,EAAG,KAAA,GAAQ,SAAA,CAAU,MAAA,EAAQ,SAAS,CAAA,EAAG;AACxD,QAAA,IAAA,IAAA,CAAS,UAAU,KAAK,CAAA,IAAK,CAAA,KAAM,UAAA,CAAW,KAAK,CAAA,IAAK,CAAA,CAAA;AAAA,MAC1D;AACA,MAAA,OAAO,IAAA,KAAS,CAAA;AAAA,IAClB;AAAA,GACF;AACF;;;AC7GO,IAAM,2BAA2B,EAAA,GAAK;AAsB7C,SAAS,cAAc,KAAA,EAAwB;AAC7C,EAAA,OAAO,eAAA,CAAgB,IAAI,WAAA,EAAY,CAAE,OAAO,IAAA,CAAK,SAAA,CAAU,KAAK,CAAC,CAAC,CAAA;AACxE;AASO,SAAS,qBAAA,CAAsB,QAAoB,KAAA,EAA2B;AACnF,EAAA,eAAe,WAAW,KAAA,EAA6C;AACrE,IAAA,OAAO,UAAA,CAAW,MAAA,CAAO,MAAA,CAAO,SAAA,CAAU,OAAO,MAAA,EAAQ,EAAE,IAAA,EAAM,MAAA,EAAQ,MAAM,SAAA,EAAU,EAAG,KAAA,EAAO,CAAC,KAAK,CAAC,CAAA;AAAA,EAC5G;AAEA,EAAA,eAAe,UAAU,YAAA,EAAuC;AAC9D,IAAA,MAAM,GAAA,GAAM,MAAM,UAAA,CAAW,MAAM,CAAA;AACnC,IAAA,MAAM,KAAA,GAAQ,MAAM,UAAA,CAAW,MAAA,CAAO,MAAA,CAAO,IAAA,CAAK,MAAA,EAAQ,GAAA,EAAK,IAAI,WAAA,EAAY,CAAE,MAAA,CAAO,YAAY,CAAC,CAAA;AACrG,IAAA,OAAO,eAAA,CAAgB,IAAI,UAAA,CAAW,KAAK,CAAC,CAAA;AAAA,EAC9C;AAEA,EAAA,OAAO;AAAA,IACL,MAAM,IAAA,CAAK,MAAA,EAAQ,gBAAA,EAAkB;AACnC,MAAA,MAAM,QAAA,GAAW,KAAK,KAAA,CAAM,KAAA,CAAM,KAAI,CAAE,OAAA,KAAY,GAAI,CAAA;AACxD,MAAA,MAAM,SAAS,aAAA,CAAc,EAAE,KAAK,OAAA,EAAS,GAAA,EAAK,OAAO,CAAA;AACzD,MAAA,MAAM,UAAU,aAAA,CAAc;AAAA,QAC5B,UAAU,MAAA,CAAO,QAAA;AAAA,QACjB,UAAU,MAAA,CAAO,QAAA;AAAA,QACjB,WAAW,MAAA,CAAO,SAAA;AAAA,QAClB,GAAA,EAAK,QAAA;AAAA,QACL,KAAK,QAAA,GAAW;AAAA,OACjB,CAAA;AACD,MAAA,MAAM,YAAA,GAAe,CAAA,EAAG,MAAM,CAAA,CAAA,EAAI,OAAO,CAAA,CAAA;AACzC,MAAA,OAAO,GAAG,YAAY,CAAA,CAAA,EAAI,MAAM,SAAA,CAAU,YAAY,CAAC,CAAA,CAAA;AAAA,IACzD,CAAA;AAAA,IAEA,MAAM,OAAO,KAAA,EAAO;AAClB,MAAA,MAAM,KAAA,GAAQ,KAAA,CAAM,KAAA,CAAM,GAAG,CAAA;AAC7B,MAAA,IAAI,KAAA,CAAM,MAAA,KAAW,CAAA,EAAG,OAAO,MAAA;AAC/B,MAAA,MAAM,CAAC,MAAA,EAAQ,OAAA,EAAS,QAAQ,CAAA,GAAI,KAAA;AAEpC,MAAA,MAAM,GAAA,GAAM,MAAM,UAAA,CAAW,QAAQ,CAAA;AACrC,MAAA,MAAM,aAAA,GAAgB,gBAAgB,QAAQ,CAAA;AAC9C,MAAA,IAAI,aAAA,KAAkB,QAAW,OAAO,MAAA;AACxC,MAAA,MAAM,EAAA,GAAK,MAAM,UAAA,CAAW,MAAA,CAAO,MAAA,CAAO,MAAA;AAAA,QACxC,MAAA;AAAA,QACA,GAAA;AAAA,QACA,aAAA;AAAA,QACA,IAAI,aAAY,CAAE,MAAA,CAAO,GAAG,MAAM,CAAA,CAAA,EAAI,OAAO,CAAA,CAAE;AAAA,OACjD;AACA,MAAA,IAAI,CAAC,IAAI,OAAO,MAAA;AAEhB,MAAA,MAAM,WAAA,GAAc,gBAAgB,MAAM,CAAA;AAC1C,MAAA,MAAM,YAAA,GAAe,gBAAgB,OAAO,CAAA;AAC5C,MAAA,IAAI,WAAA,KAAgB,MAAA,IAAa,YAAA,KAAiB,MAAA,EAAW,OAAO,MAAA;AAEpE,MAAA,IAAI,aAAA;AACJ,MAAA,IAAI,cAAA;AACJ,MAAA,IAAI;AACF,QAAA,aAAA,GAAgB,KAAK,KAAA,CAAM,IAAI,aAAY,CAAE,MAAA,CAAO,WAAW,CAAC,CAAA;AAChE,QAAA,cAAA,GAAiB,KAAK,KAAA,CAAM,IAAI,aAAY,CAAE,MAAA,CAAO,YAAY,CAAC,CAAA;AAAA,MACpE,CAAA,CAAA,MAAQ;AACN,QAAA,OAAO,MAAA;AAAA,MACT;AAEA,MAAA,MAAM,MAAO,aAAA,EAA4C,GAAA;AACzD,MAAA,IAAI,GAAA,KAAQ,SAAS,OAAO,MAAA;AAE5B,MAAA,MAAM,EAAE,QAAA,EAAU,QAAA,EAAAA,SAAAA,EAAU,SAAA,EAAW,KAAI,GAAI,cAAA;AAC/C,MAAA,IAAI,OAAO,aAAa,QAAA,IAAY,OAAOA,cAAa,QAAA,IAAY,OAAO,cAAc,QAAA,EAAU;AACjG,QAAA,OAAO,MAAA;AAAA,MACT;AACA,MAAA,IAAI,OAAO,GAAA,KAAQ,QAAA,IAAY,KAAA,CAAM,GAAA,GAAM,OAAA,EAAQ,GAAI,GAAA,IAAQ,GAAA,EAAK,OAAO,MAAA;AAE3E,MAAA,OAAO,EAAE,QAAA,EAAU,QAAA,EAAAA,SAAAA,EAAU,SAAA,EAAU;AAAA,IACzC;AAAA,GACF;AACF;ACjGO,SAAS,oBAAA,CACd,MAAA,EACA,eAAA,EACA,KAAA,EACA,SAAA,EACkB;AAIlB,EAAA,OAAO,MAAA,CAAO,aAAA,CAAc,eAAA,EAAiB,oBAAA,GAAuB,OAAO,SAAS,CAAA;AACtF;;;ACZO,IAAM,mBAAA,GAAsB,KAAK,EAAA,GAAK;AAE7C,IAAM,mBAAA,GAAsB,CAAA;AAGrB,IAAM,4BAAA,GAA+B;AACrC,IAAM,+BAAA,GAAkC;AA0CxC,SAAS,gBAAgB,IAAA,EAAgC;AAC9D,EAAA,MAAM,EAAE,MAAA,EAAQ,MAAA,EAAQ,KAAA,EAAO,aAAY,GAAI,IAAA;AAC/C,EAAA,MAAM,UAAA,GAAa,KAAK,qBAAA,IAAyB,wBAAA;AAEjD,EAAA,OAAO;AAAA,IACL,MAAM,iBAAA,CAAkB,MAAA,EAAQ,KAAA,EAAO;AACrC,MAAA,MAAM,SAAA,GAAY,IAAI,IAAA,CAAK,KAAA,CAAM,GAAA,EAAI,CAAE,OAAA,EAAQ,IAAK,KAAA,CAAM,KAAA,IAAS,mBAAA,CAAoB,CAAA,CAAE,WAAA,EAAY;AACrG,MAAA,OAAO,MAAA,CAAO,YAAA,CAAa,KAAA,CAAM,MAAA,EAAQ;AAAA,QACvC,IAAA,EAAM,MAAA,CAAO,iBAAA,CAAkB,mBAAmB,CAAA;AAAA,QAClD,WAAW,KAAA,CAAM,SAAA;AAAA,QACjB;AAAA,OACD,CAAA;AAAA,IACH,CAAA;AAAA,IAEA,MAAM,kBAAkB,KAAA,EAAO;AAC7B,MAAA,MAAM,SAAS,MAAM,MAAA,CAAO,YAAA,CAAa,MAAA,CAAO,MAAM,WAAW,CAAA;AACjE,MAAA,IAAI,MAAA,KAAW,QAAW,OAAO,MAAA;AAIjC,MAAA,OAAO,MAAA,CAAO,OAAA,CAAQ,QAAA,CAAS,MAAA,CAAO,QAAA,EAAU;AAAA,QAC9C,WAAW,MAAA,CAAO,SAAA;AAAA,QAClB,QAAA,EAAU,CAAA,IAAA,EAAO,MAAA,CAAO,UAAA,EAAY,CAAA,CAAA;AAAA,QACpC,YAAY,KAAA,CAAM,UAAA;AAAA,QAClB,iBAAiB,KAAA,CAAM,eAAA;AAAA,QACvB,UAAA,EAAY,4BAAA;AAAA,QACZ,aAAA,EAAe;AAAA,OAChB,CAAA;AAAA,IACH,CAAA;AAAA,IAEA,MAAM,cAAc,QAAA,EAAU;AAC5B,MAAA,MAAM,MAAA,GAAS,MAAM,MAAA,CAAO,OAAA,CAAQ,kBAAkB,QAAQ,CAAA;AAC9D,MAAA,IAAI,MAAA,KAAW,MAAA,IAAa,MAAA,CAAO,OAAA,EAAS,OAAO,MAAA;AACnD,MAAA,OAAO,MAAA;AAAA,IACT,CAAA;AAAA,IAEA,WAAW,MAAA,EAAQ;AACjB,MAAA,OAAO,OAAO,MAAA,CAAO,KAAA,CAAM,MAAA,CAAO,QAAA,EAAU,OAAO,QAAQ,CAAA;AAAA,IAC7D,CAAA;AAAA,IAEA,aAAA,CAAc,QAAQ,KAAA,EAAO;AAC3B,MAAA,OAAO,OAAO,MAAA,CAAO,QAAA,CAAS,OAAO,QAAA,EAAU,MAAA,CAAO,UAAU,KAAK,CAAA;AAAA,IACvE,CAAA;AAAA,IAEA,YAAA,CAAa,QAAQ,KAAA,EAAO;AAC1B,MAAA,OAAO,MAAA,CAAO,MAAA,CAAO,QAAA,CAAS,MAAA,CAAO,UAAU,KAAK,CAAA;AAAA,IACtD,CAAA;AAAA,IAEA,eAAA,CAAgB,MAAA,EAAQ,KAAA,EAAO,SAAA,EAAW;AACxC,MAAA,OAAO,oBAAA,CAAqB,MAAA,EAAQ,MAAA,CAAO,eAAA,EAAiB,OAAO,SAAS,CAAA;AAAA,IAC9E,CAAA;AAAA,IAEA,MAAM,gBAAgB,MAAA,EAAQ;AAC5B,MAAA,MAAM,WAAA,GAAc,MAAM,WAAA,CAAY,IAAA;AAAA,QACpC,EAAE,UAAU,MAAA,CAAO,QAAA,EAAU,UAAU,MAAA,CAAO,QAAA,EAAU,SAAA,EAAW,MAAA,CAAO,SAAA,EAAU;AAAA,QACpF;AAAA,OACF;AACA,MAAA,OAAO;AAAA,QACL,WAAA;AAAA,QACA,SAAA,EAAW,IAAI,IAAA,CAAK,KAAA,CAAM,GAAA,EAAI,CAAE,OAAA,EAAQ,GAAI,UAAA,GAAa,GAAI,CAAA,CAAE,WAAA;AAAY,OAC7E;AAAA,IACF;AAAA,GACF;AACF;ACpHO,IAAM,kBAAA,GAAqB;AAAA;AAAA,EAEhC,cAAA,EAAgB,iBAAA;AAAA;AAAA,EAEhB,aAAA,EAAe,gBAAA;AAAA;AAAA,EAEf,cAAA,EAAgB,iBAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAehB,iBAAA,EAAmB,oBAAA;AAAA;AAAA,EAEnB,iBAAA,EAAmB,oBAAA;AAAA;AAAA,EAEnB,QAAA,EAAU,WAAA;AAAA;AAAA,EAEV,aAAA,EAAe,gBAAA;AAAA;AAAA,EAEf,YAAA,EAAc,eAAA;AAAA;AAAA,EAEd,YAAA,EAAc,eAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAYd,UAAA,EAAY;AACd;AAKO,IAAM,0BAAA,GAA6B;AAmBnC,SAAS,yBAAA,CACd,OAAA,GAAU,CAAA,EACV,OAAA,GAA4C,EAAC,EACtB;AACvB,EAAA,OAAO;AAAA,IACL,MAAA,EAAQ,sBAAA;AAAA,IACR,OAAA;AAAA,IACA,cAAc,MAAA,CAAO,MAAA,CAAO,kBAAkB,CAAA,CAAE,MAAA,CAAO,CAAC,UAAA,KAAe;AACrE,MAAA,IAAI,UAAA,KAAe,kBAAA,CAAmB,YAAA,EAAc,OAAO,QAAQ,mBAAA,KAAwB,IAAA;AAC3F,MAAA,IAAI,UAAA,KAAe,kBAAA,CAAmB,UAAA,EAAY,OAAO,QAAQ,iBAAA,KAAsB,IAAA;AACvF,MAAA,OAAO,IAAA;AAAA,IACT,CAAC;AAAA,GACH;AACF;AAEO,SAAS,QAAA,CAAS,aAAoC,UAAA,EAAsC;AACjG,EAAA,OAAO,aAAA,CAAc,aAAa,UAAU,CAAA;AAC9C;;;AC/FO,IAAM,iBAAA,GAAoB;AAAA;AAAA,EAE/B,oBAAA,EAAsB,sBAAA;AAAA;AAAA,EAEtB,qBAAA,EAAuB,uBAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAMvB,oBAAA,EAAsB,sBAAA;AAAA;AAAA,EAEtB,8BAAA,EAAgC,gCAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAUhC,wBAAA,EAA0B,0BAAA;AAAA;AAAA,EAE1B,0BAAA,EAA4B,4BAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAO5B,2BAAA,EAA6B,6BAAA;AAAA;AAAA,EAE7B,wBAAA,EAA0B;AAC5B;AAIO,IAAM,cAAA,GAAN,cAA6B,KAAA,CAAM;AAAA,EACxB,IAAA;AAAA,EAEhB,WAAA,CAAY,IAAA,EAAsB,OAAA,EAAiB,OAAA,EAAwB;AACzE,IAAA,KAAA,CAAM,SAAS,OAAO,CAAA;AACtB,IAAA,IAAA,CAAK,IAAA,GAAO,gBAAA;AACZ,IAAA,IAAA,CAAK,IAAA,GAAO,IAAA;AAAA,EACd;AACF;AAEO,SAAS,YAAA,CAAa,OAAgB,IAAA,EAAgD;AAC3F,EAAA,IAAI,EAAE,KAAA,YAAiB,cAAA,CAAA,EAAiB,OAAO,KAAA;AAC/C,EAAA,OAAO,IAAA,KAAS,MAAA,IAAa,KAAA,CAAM,IAAA,KAAS,IAAA;AAC9C;;;ACxDO,IAAM,yBAAA,GAA4B;AAEzC,IAAM,oBAAA,GAAuB,EAAE,MAAA,EAAO,CAAE,IAAI,CAAC,CAAA,CAAE,IAAI,GAAG,CAAA;AACtD,IAAM,sBAAA,GAAyB,EAC5B,MAAA,EAAO,CACP,IAAI,GAAG,CAAA,CACP,KAAA,CAAM,IAAA,EAAM,oCAAoC,CAAA;AAE5C,IAAM,2BAAA,GAA8B,EAAE,MAAA,CAAO;AAAA,EAClD,MAAA,EAAQ,oBAAA;AAAA,EACR,gBAAA,EAAkB,sBAAA;AAAA,EAClB,UAAU,CAAA,CAAE,MAAA,EAAO,CAAE,GAAA,GAAM,WAAA,EAAY;AAAA,EACvC,QAAQ,CAAA,CAAE,KAAA,CAAM,yBAAyB,CAAA,CAAE,IAAI,CAAC,CAAA;AAAA,EAChD,SAAS,CAAA,CAAE,MAAA,EAAO,CAAE,GAAA,GAAM,WAAA;AAC5B,CAAC;AAEM,IAAM,mBAAA,GAAsB,EAAE,MAAA,CAAO;AAAA,EAC1C,MAAA,EAAQ,oBAAA;AAAA,EACR,gBAAA,EAAkB,sBAAA;AAAA,EAClB,UAAU,CAAA,CAAE,MAAA,EAAO,CAAE,GAAA,GAAM,WAAA,EAAY;AAAA,EACvC,YAAY,CAAA,CAAE,MAAA,EAAO,CAAE,GAAA,GAAM,WAAA,EAAY;AAAA,EACzC,UAAA,EAAY,CAAA,CAAE,GAAA,CAAI,QAAA,EAAS;AAAA,EAC3B,KAAA,EAAO;AACT,CAAC;AAkCM,SAAS,uBAAuB,KAAA,EAAoC;AACzE,EAAA,IAAI,CAAC,OAAO,QAAA,CAAS,KAAA,CAAM,KAAK,CAAA,IAAK,KAAA,CAAM,SAAS,CAAA,EAAG;AACrD,IAAA,MAAM,IAAI,cAAA;AAAA,MACR,4BAAA;AAAA,MACA,CAAA,iEAAA,EAAoE,MAAA,CAAO,KAAA,CAAM,KAAK,CAAC,CAAA,CAAA;AAAA,KACzF;AAAA,EACF;AACA,EAAA,MAAM,QAAA,GAAW,MAAM,QAAA,IAAY,yBAAA;AACnC,EAAA,IAAI,CAAC,MAAA,CAAO,aAAA,CAAc,QAAQ,CAAA,IAAK,YAAY,CAAA,EAAG;AACpD,IAAA,MAAM,IAAI,cAAA;AAAA,MACR,4BAAA;AAAA,MACA,CAAA,uDAAA,EAA0D,MAAA,CAAO,QAAQ,CAAC,CAAA,CAAA;AAAA,KAC5E;AAAA,EACF;AACA,EAAA,MAAM,MAAA,GAAS,2BAAA,CAA4B,SAAA,CAAU,KAAK,CAAA;AAC1D,EAAA,IAAI,CAAC,OAAO,OAAA,EAAS;AACnB,IAAA,MAAM,IAAI,cAAA;AAAA,MACR,4BAAA;AAAA,MACA;AAAA,KACF;AAAA,EACF;AACA,EAAA,OAAO,QAAA;AACT;AAEO,SAAS,qBAAA,CACd,OACA,UAAA,EAC0B;AAC1B,EAAA,OAAO,MAAM,MAAA,CAAO,GAAA;AAAA,IAAI,CAAC,KAAA,EAAO,UAAA,KAC9B,mBAAA,CAAoB,KAAA,CAAM;AAAA,MACxB,QAAQ,KAAA,CAAM,MAAA;AAAA,MACd,kBAAkB,KAAA,CAAM,gBAAA;AAAA,MACxB,UAAU,KAAA,CAAM,QAAA;AAAA,MAChB,UAAA;AAAA,MACA,UAAA;AAAA,MACA;AAAA,KACD;AAAA,GACH;AACF;AAEO,SAAS,oBAAoB,KAAA,EAA0C;AAC5E,EAAA,OAAO,CAAA,CAAE,KAAA,CAAM,mBAAmB,CAAA,CAAE,MAAM,KAAK,CAAA;AACjD;AAEO,SAAS,qBAAA,CAAsB,MAAqB,KAAA,EAA8B;AACvF,EAAA,OAAO,KAAK,QAAA,GAAW,KAAA,CAAM,QAAA,IAAY,IAAA,CAAK,aAAa,KAAA,CAAM,UAAA;AACnE;AAEO,SAAS,eACd,OAAA,EAC4B;AAC5B,EAAA,MAAM,IAAA,GAAO,OAAA,CAAQ,EAAA,CAAG,EAAE,CAAA;AAC1B,EAAA,OAAO,IAAA,KAAS,SAAY,MAAA,GAAY,EAAE,UAAU,IAAA,CAAK,QAAA,EAAU,UAAA,EAAY,IAAA,CAAK,UAAA,EAAW;AACjG;AAEO,SAAS,eAAA,CAAgB,QAAkB,MAAA,EAAwB;AACxE,EAAA,OAAO,SAAA,CAAU,QAAQ,MAAM,CAAA;AACjC;;;AC7GO,IAAM,+BAAA,GAAkC;AACxC,IAAM,6BAAA,GAAgC;AACtC,IAAM,2BAAA,GAA8B;AACpC,IAAM,6BAA6B,EAAA,GAAK;AAExC,IAAM,0BAA0B,EAAA,GAAK;AACrC,IAAM,uBAAA,GAA0B;AAChC,IAAM,oCAAA,GAAuC;AAC7C,IAAM,iCAAA,GAAoC;AAEjD,IAAM,OAAA,GAAU,IAAI,WAAA,EAAY;AASzB,IAAM,uBAAA,GAA0C;AAAA,EACrD,SAAA,EAAW,2BAAA;AAAA,EACX,QAAA,EAAU,0BAAA;AAAA,EACV,QAAA,EAAU,yBAAA;AAAA,EACV,KAAA,EAAO;AACT;AAEO,SAAS,iBAAA,CACd,OAAA,EACA,KAAA,EACA,MAAA,EACM;AACN,EAAA,IAAI,OAAA,CAAQ,WAAW,CAAA,IAAK,OAAA,CAAQ,OAAO,OAAO,CAAA,CAAE,MAAA,GAAS,MAAA,CAAO,eAAA,EAAiB;AACnF,IAAA,MAAM,IAAI,cAAA;AAAA,MACR,4BAAA;AAAA,MACA,CAAA,8BAAA,EAAiC,OAAO,eAAe,CAAA,aAAA;AAAA,KACzD;AAAA,EACF;AACA,EAAA,IAAI,KAAA,CAAM,WAAW,CAAA,IAAK,OAAA,CAAQ,OAAO,KAAK,CAAA,CAAE,MAAA,GAAS,MAAA,CAAO,aAAA,EAAe;AAC7E,IAAA,MAAM,IAAI,cAAA;AAAA,MACR,4BAAA;AAAA,MACA,CAAA,4BAAA,EAA+B,OAAO,aAAa,CAAA,aAAA;AAAA,KACrD;AAAA,EACF;AACF;AAEO,SAAS,sBAAA,CACd,MAAA,EACA,OAAA,EACA,MAAA,EACM;AACN,EAAA,IAAI,CAAC,MAAA,CAAO,aAAA,CAAc,OAAO,CAAA,IAAK,UAAU,CAAA,EAAG;AACjD,IAAA,MAAM,IAAI,cAAA;AAAA,MACR,4BAAA;AAAA,MACA;AAAA,KACF;AAAA,EACF;AACA,EAAA,IAAI,OAAO,MAAA,KAAW,CAAA,IAAK,MAAA,CAAO,MAAA,GAAS,OAAO,SAAA,EAAW;AAC3D,IAAA,MAAM,IAAI,cAAA;AAAA,MACR,0BAAA;AAAA,MACA,CAAA,+BAAA,EAAkC,OAAO,SAAS,CAAA,QAAA;AAAA,KACpD;AAAA,EACF;AACA,EAAA,MAAM,OAAA,GAAU,IAAA,CAAK,SAAA,CAAU,MAAM,CAAA;AACrC,EAAA,IAAI,QAAQ,MAAA,CAAO,OAAO,CAAA,CAAE,MAAA,GAAS,OAAO,QAAA,EAAU;AACpD,IAAA,MAAM,IAAI,cAAA;AAAA,MACR,0BAAA;AAAA,MACA,CAAA,uBAAA,EAA0B,OAAO,QAAQ,CAAA,aAAA;AAAA,KAC3C;AAAA,EACF;AACF;AAEO,SAAS,qBAAA,CACd,OACA,MAAA,EACM;AACN,EAAA,sBAAA,CAAuB,KAAA,CAAM,MAAA,EAAQ,KAAA,CAAM,OAAA,EAAS,MAAM,CAAA;AAC1D,EAAA,sBAAA,CAAuB,EAAE,GAAG,KAAA,EAAO,KAAA,EAAO,OAAO,KAAA,EAAO,QAAA,EAAU,MAAA,CAAO,QAAA,EAAU,CAAA;AACrF;AAEA,eAAsB,oBAAA,CACpB,QAAA,EACA,KAAA,EAOA,MAAA,EACuB;AACvB,EAAA,qBAAA,CAAsB,OAAO,MAAM,CAAA;AACnC,EAAA,OAAO,SAAS,MAAA,CAAO;AAAA,IACrB,QAAQ,KAAA,CAAM,MAAA;AAAA,IACd,kBAAkB,KAAA,CAAM,gBAAA;AAAA,IACxB,UAAU,KAAA,CAAM,QAAA;AAAA,IAChB,QAAQ,KAAA,CAAM,MAAA;AAAA,IACd,SAAS,KAAA,CAAM,OAAA;AAAA,IACf,OAAO,MAAA,CAAO,KAAA;AAAA,IACd,UAAU,MAAA,CAAO;AAAA,GAClB,CAAA;AACH;ACrFO,SAAS,mBAAmB,MAAA,EAAgD;AACjF,EAAA,IAAI,MAAA,KAAW,QAAW,OAAO,MAAA;AACjC,EAAA,MAAM,KAAA,GAAQ,kBAAA,CAAmB,IAAA,CAAK,MAAM,CAAA;AAC5C,EAAA,OAAO,QAAQ,CAAC,CAAA;AAClB;AAEA,eAAsB,kBAAA,CACpB,QACA,IAAA,EACsC;AACtC,EAAA,MAAM,KAAA,GAAQ,mBAAmB,MAAM,CAAA;AACvC,EAAA,IAAI,KAAA,KAAU,QAAW,OAAO,MAAA;AAEhC,EAAA,MAAM,MAAA,GAAS,MAAM,IAAA,CAAK,WAAA,CAAY,OAAO,KAAK,CAAA;AAClD,EAAA,IAAI,MAAA,KAAW,QAAW,OAAO,MAAA;AAGjC,EAAA,IAAI,CAAC,UAAA,CAAW,MAAA,CAAO,QAAQ,GAAG,OAAO,MAAA;AAEzC,EAAA,MAAM,MAAA,GAAS,MAAM,IAAA,CAAK,OAAA,CAAQ,GAAA,CAAI,SAAS,MAAA,CAAO,QAAQ,CAAA,EAAG,MAAA,CAAO,QAAQ,CAAA;AAChF,EAAA,IAAI,MAAA,KAAW,MAAA,IAAa,MAAA,CAAO,OAAA,EAAS,OAAO,MAAA;AACnD,EAAA,IAAI,MAAA,CAAO,SAAA,KAAc,MAAA,CAAO,SAAA,EAAW,OAAO,MAAA;AAElD,EAAA,OAAO;AAAA,IACL,IAAA,EAAM,QAAA;AAAA,IACN,UAAU,MAAA,CAAO,QAAA;AAAA,IACjB,WAAW,MAAA,CAAO,SAAA;AAAA,IAClB,UAAU,MAAA,CAAO;AAAA,GACnB;AACF;AC0GO,SAAS,eAAA,CAAgB,WAAsB,IAAA,EAAqC;AACzF,EAAA,MAAM,MAAA,GAAS,gBAAgB,SAAS,CAAA;AACxC,EAAA,MAAM,EAAE,IAAA,EAAM,KAAA,EAAM,GAAI,IAAA;AAExB,EAAA,OAAO;AAAA,IACL,MAAA;AAAA,IACA,SAAA;AAAA,IACA,OAAA,EAAS;AAAA,MACP,QAAQ,CAAC,KAAA,KAAU,KAAK,OAAA,CAAQ,MAAA,CAAO,QAAQ,KAAK,CAAA;AAAA,MACpD,WAAW,CAAC,KAAA,KAAU,KAAK,OAAA,CAAQ,SAAA,CAAU,QAAQ,KAAK,CAAA;AAAA,MAC1D,eAAe,CAAC,KAAA,KAAU,KAAK,OAAA,CAAQ,aAAA,CAAc,QAAQ,KAAK,CAAA;AAAA,MAClE,YAAY,CAAC,QAAA,KAAa,KAAK,OAAA,CAAQ,UAAA,CAAW,QAAQ,QAAQ;AAAA,KACpE;AAAA,IACA,KAAA,EAAO;AAAA,MACL,QAAQ,CAAC,KAAA,KAAU,KAAK,KAAA,CAAM,MAAA,CAAO,QAAQ,KAAK,CAAA;AAAA,MAClD,KAAK,CAAC,MAAA,KAAW,KAAK,KAAA,CAAM,GAAA,CAAI,QAAQ,MAAM,CAAA;AAAA,MAC9C,MAAM,CAAC,KAAA,KAAU,KAAK,KAAA,CAAM,IAAA,CAAK,QAAQ,KAAK,CAAA;AAAA,MAC9C,OAAO,CAAC,KAAA,KAAU,KAAK,KAAA,CAAM,KAAA,CAAM,QAAQ,KAAK,CAAA;AAAA,MAChD,SAAS,CAAC,KAAA,KAAU,KAAK,KAAA,CAAM,OAAA,CAAQ,QAAQ,KAAK,CAAA;AAAA,MACpD,cAAc,CAAC,KAAA,KAAU,KAAK,KAAA,CAAM,YAAA,CAAa,QAAQ,KAAK;AAAA,KAChE;AAAA,IACA,QAAA,EAAU;AAAA,MACR,SAAS,CAAC,KAAA,KAAU,KAAK,QAAA,CAAS,OAAA,CAAQ,QAAQ,KAAK,CAAA;AAAA,MACvD,MAAM,CAAC,QAAA,KAAa,KAAK,QAAA,CAAS,IAAA,CAAK,QAAQ,QAAQ,CAAA;AAAA,MACvD,IAAA,EAAM,MAAM,IAAA,CAAK,QAAA,CAAS,KAAK,MAAM;AAAA,KACvC;AAAA,IACA,QAAA,EAAU;AAAA,MACR,QAAQ,CAAC,KAAA,KAAU,MAAM,QAAA,CAAS,MAAA,CAAO,QAAQ,KAAK,CAAA;AAAA,MACtD,MAAM,CAAC,MAAA,KAAW,MAAM,QAAA,CAAS,IAAA,CAAK,QAAQ,MAAM;AAAA,KACtD;AAAA,IACA,SAAA,EAAW;AAAA,MACT,QAAQ,CAAC,KAAA,KAAU,MAAM,SAAA,CAAU,MAAA,CAAO,QAAQ,KAAK,CAAA;AAAA,MACvD,MAAM,CAAC,MAAA,KAAW,MAAM,SAAA,CAAU,IAAA,CAAK,QAAQ,MAAM;AAAA,KACvD;AAAA,IACA,OAAA,EAAS;AAAA,MACP,KAAK,CAAC,QAAA,KAAa,MAAM,OAAA,CAAQ,GAAA,CAAI,QAAQ,QAAQ,CAAA;AAAA,MACrD,IAAA,EAAM,MAAM,KAAA,CAAM,OAAA,CAAQ,KAAK,MAAM,CAAA;AAAA,MACrC,QAAQ,CAAC,QAAA,KAAa,MAAM,OAAA,CAAQ,MAAA,CAAO,QAAQ,QAAQ;AAAA,KAC7D;AAAA,IACA,KAAA,EAAO;AAAA,MACL,MAAM,CAAC,KAAA,KAAU,MAAM,KAAA,CAAM,IAAA,CAAK,QAAQ,KAAK,CAAA;AAAA,MAC/C,KAAK,CAAC,MAAA,KAAW,MAAM,KAAA,CAAM,GAAA,CAAI,QAAQ,MAAM,CAAA;AAAA,MAC/C,OAAO,CAAC,KAAA,KAAU,MAAM,KAAA,CAAM,KAAA,CAAM,QAAQ,KAAK,CAAA;AAAA,MACjD,cAAc,CAAC,KAAA,KAAU,MAAM,KAAA,CAAM,YAAA,CAAa,QAAQ,KAAK;AAAA,KACjE;AAAA,IACA,KAAA,EAAO;AAAA,MACL,cAAA,EAAgB,CAAC,QAAA,EAAU,UAAA,KAAe,MAAM,KAAA,CAAM,cAAA,CAAe,MAAA,EAAQ,QAAA,EAAU,UAAU;AAAA,KACnG;AAAA,IACA,QAAA,EAAU;AAAA,MACR,QAAQ,CAAC,KAAA,KAAU,MAAM,QAAA,CAAS,MAAA,CAAO,QAAQ,KAAK,CAAA;AAAA,MACtD,KAAK,CAAC,GAAA,KAAQ,MAAM,QAAA,CAAS,GAAA,CAAI,QAAQ,GAAG;AAAA,KAC9C;AAAA,IACA,KAAA,EAAO;AAAA,MACL,cAAc,CAAC,WAAA,KAAgB,MAAM,KAAA,CAAM,YAAA,CAAa,QAAQ,WAAW,CAAA;AAAA,MAC3E,aAAA,EAAe,CAAC,MAAA,EAAQ,WAAA,KAAgB,MAAM,KAAA,CAAM,aAAA,CAAc,MAAA,EAAQ,MAAA,EAAQ,WAAW,CAAA;AAAA,MAC7F,gBAAgB,CAAC,MAAA,KAAW,MAAM,KAAA,CAAM,cAAA,CAAe,QAAQ,MAAM;AAAA,KACvE;AAAA,IACA,KAAA,EAAO;AAAA,MACL,iBAAiB,CAAC,aAAA,KAAkB,KAAK,KAAA,CAAM,eAAA,CAAgB,QAAQ,aAAa,CAAA;AAAA,MACpF,SAAS,CAAC,KAAA,KAAU,KAAK,KAAA,CAAM,OAAA,CAAQ,QAAQ,KAAK,CAAA;AAAA,MACpD,qBAAqB,CAAC,KAAA,KAAU,KAAK,KAAA,CAAM,mBAAA,CAAoB,QAAQ,KAAK,CAAA;AAAA,MAC5E,kBAAkB,CAAC,aAAA,KAAkB,KAAK,KAAA,CAAM,gBAAA,CAAiB,QAAQ,aAAa;AAAA,KACxF;AAAA,IACA,WAAA,EAAa;AAAA,MACX,SAAS,CAAC,QAAA,KAAa,MAAM,WAAA,CAAY,OAAA,CAAQ,QAAQ,QAAQ;AAAA;AACnE,GACF;AACF;;;AClNA,eAAsB,aAAa,CAAA,EAA8B;AAC/D,EAAA,IAAI;AACF,IAAA,OAAO,MAAM,CAAA,CAAE,GAAA,CAAI,IAAA,EAAK;AAAA,EAC1B,CAAA,CAAA,MAAQ;AACN,IAAA,OAAO,MAAA;AAAA,EACT;AACF;AAiBA,eAAsB,kBAAA,CACpB,GACA,IAAA,EACiD;AACjD,EAAA,MAAM,MAAA,GAAS,MAAM,kBAAA,CAAmB,CAAA,CAAE,IAAI,MAAA,CAAO,eAAe,CAAA,EAAG,IAAA,CAAK,MAAM,CAAA;AAClF,EAAA,IAAI,MAAA,KAAW,QAAW,OAAO,MAAA;AACjC,EAAA,OAAO,EAAE,MAAA,EAAQ,MAAA,EAAQ,gBAAgB,MAAA,EAAQ,IAAA,CAAK,IAAI,CAAA,EAAE;AAC9D;;;ACNO,IAAM,uBAAA,GAA0B,KAAK,EAAA,GAAK,GAAA;AAgBjD,IAAM,oBAAA,GAAuBC,EAAE,MAAA,CAAO;AAAA,EACpC,GAAA,EAAKA,CAAAA,CAAE,MAAA,EAAO,CAAE,IAAI,CAAC,CAAA;AAAA,EACrB,GAAA,EAAKA,CAAAA,CAAE,MAAA,CAAO,MAAA,GAAS,MAAA;AACzB,CAAC,CAAA;AAEM,SAAS,kBAAkB,IAAA,EAAqB;AACrD,EAAA,OAAO,OAAO,CAAA,KAAkC;AAC9C,IAAA,MAAM,aAAA,GAAgB,MAAM,kBAAA,CAAmB,CAAA,EAAG,IAAI,CAAA;AACtD,IAAA,IAAI,aAAA,KAAkB,QAAW,OAAO,CAAA,CAAE,KAAK,EAAE,KAAA,EAAO,cAAA,EAAe,EAAG,GAAG,CAAA;AAE7E,IAAA,MAAM,SAAS,uBAAA,CAAwB,SAAA,CAAU,MAAM,YAAA,CAAa,CAAC,CAAC,CAAA;AACtE,IAAA,IAAI,CAAC,MAAA,CAAO,OAAA,EAAS,OAAO,CAAA,CAAE,KAAK,EAAE,KAAA,EAAO,iDAAA,EAAkD,EAAG,GAAG,CAAA;AACpG,IAAA,IAAI,MAAA,CAAO,IAAA,CAAK,IAAA,GAAO,IAAA,CAAK,gBAAA,EAAkB;AAC5C,MAAA,OAAO,CAAA,CAAE,KAAK,EAAE,KAAA,EAAO,4BAA4B,IAAA,CAAK,gBAAgB,CAAA,MAAA,CAAA,EAAS,EAAG,GAAG,CAAA;AAAA,IACzF;AAEA,IAAA,MAAM,aAAA,GAAgB,eAAe,CAAC,CAAA;AACtC,IAAA,IAAI,kBAAkB,MAAA,EAAW;AAC/B,MAAA,OAAO,EAAE,IAAA,CAAK,EAAE,KAAA,EAAO,oCAAA,IAAwC,GAAG,CAAA;AAAA,IACpE;AAEA,IAAA,IAAI;AACF,MAAA,MAAM,WAAA,GAAc,MAAM,aAAA,CAAc,MAAA,CAAO,MAAM,OAAA,CAAQ;AAAA,QAC3D,aAAA;AAAA,QACA,IAAA,EAAM,QAAA;AAAA,QACN,aAAA,EAAe,MAAA,CAAO,MAAA,CAAO,IAAA,CAAK,IAAI,CAAA;AAAA,QACtC,WAAA,EAAa,WAAA,CAAY,MAAA,CAAO,IAAA,CAAK,WAAW,CAAA;AAAA,QAChD,WAAA,EAAa,OAAO,IAAA,CAAK,WAAA;AAAA,QACzB,KAAA,EAAO;AAAA,OACR,CAAA;AACD,MAAA,IAAI;AACF,QAAA,MAAM,EAAE,QAAQ,SAAA,EAAU,GAAI,MAAM,aAAA,CAAc,MAAA,CAAO,KAAA,CAAM,YAAA,CAAa,WAAW,CAAA;AACvF,QAAA,MAAM,QAAA,GAA+B,EAAE,MAAA,EAAQ,SAAA,EAAU;AACzD,QAAA,OAAO,CAAA,CAAE,IAAA,CAAK,QAAA,EAAU,GAAG,CAAA;AAAA,MAC7B,SAAS,KAAA,EAAO;AAId,QAAA,MAAM,aAAA,CAAc,OAAO,KAAA,CAAM,gBAAA,CAAiB,aAAa,CAAA,CAAE,KAAA,CAAM,MAAM,KAAA,CAAS,CAAA;AACtF,QAAA,MAAM,QAAA,GAAW,kBAAA,CAAmB,CAAA,EAAG,KAAK,CAAA;AAC5C,QAAA,IAAI,QAAA,KAAa,QAAW,OAAO,QAAA;AACnC,QAAA,MAAM,KAAA;AAAA,MACR;AAAA,IACF,SAAS,KAAA,EAAO;AACd,MAAA,MAAM,QAAA,GAAW,kBAAA,CAAmB,CAAA,EAAG,KAAK,CAAA;AAC5C,MAAA,IAAI,QAAA,KAAa,QAAW,OAAO,QAAA;AACnC,MAAA,MAAM,KAAA;AAAA,IACR;AAAA,EACF,CAAA;AACF;AAEO,SAAS,oBAAoB,IAAA,EAAqB;AACvD,EAAA,OAAO,OAAO,CAAA,KAAkC;AAC9C,IAAA,MAAM,aAAA,GAAgB,MAAM,kBAAA,CAAmB,CAAA,EAAG,IAAI,CAAA;AACtD,IAAA,IAAI,aAAA,KAAkB,QAAW,OAAO,CAAA,CAAE,KAAK,EAAE,KAAA,EAAO,cAAA,EAAe,EAAG,GAAG,CAAA;AAE7E,IAAA,MAAM,aAAA,GAAgB,eAAe,CAAC,CAAA;AACtC,IAAA,IAAI,kBAAkB,MAAA,EAAW;AAC/B,MAAA,OAAO,EAAE,IAAA,CAAK,EAAE,KAAA,EAAO,oCAAA,IAAwC,GAAG,CAAA;AAAA,IACpE;AAEA,IAAA,IAAI;AACF,MAAA,MAAM,cAAc,MAAM,aAAA,CAAc,MAAA,CAAO,KAAA,CAAM,gBAAgB,aAAa,CAAA;AAClF,MAAA,IAAI,gBAAgB,KAAA,CAAA,EAAW;AAC7B,QAAA,OAAO,EAAE,IAAA,CAAK,EAAE,KAAA,EAAO,+BAAA,IAAmC,GAAG,CAAA;AAAA,MAC/D;AACA,MAAA,MAAM,MAAA,GAAS,CAAA,CAAE,GAAA,CAAI,KAAA,CAAM,IAAI,CAAA,IAAK,EAAA;AACpC,MAAA,MAAM,QAAA,GAAW,MAAM,aAAA,CAAc,MAAA,CAAO,KAAA,CAAM,aAAA;AAAA,QAChD,MAAA;AAAA,QACA;AAAA,OACF;AACA,MAAA,IAAI,aAAa,KAAA,CAAA,EAAW;AAC1B,QAAA,MAAM,aAAA,CAAc,MAAA,CAAO,KAAA,CAAM,gBAAA,CAAiB,aAAa,CAAA;AAC/D,QAAA,OAAO,EAAE,IAAA,CAAK,EAAE,KAAA,EAAO,4BAAA,IAAgC,GAAG,CAAA;AAAA,MAC5D;AAEA,MAAA,MAAM,aAAA,CAAc,MAAA,CAAO,KAAA,CAAM,mBAAA,CAAoB;AAAA,QACnD,aAAA;AAAA,QACA,GAAG;AAAA,OACJ,CAAA;AACD,MAAA,OAAO,CAAA,CAAE,IAAA,CAAK,IAAA,EAAM,GAAG,CAAA;AAAA,IACzB,SAAS,KAAA,EAAO;AACd,MAAA,MAAM,QAAA,GAAW,kBAAA,CAAmB,CAAA,EAAG,KAAK,CAAA;AAC5C,MAAA,IAAI,QAAA,KAAa,QAAW,OAAO,QAAA;AACnC,MAAA,MAAM,KAAA;AAAA,IACR;AAAA,EACF,CAAA;AACF;AAEO,SAAS,uBAAuB,IAAA,EAAqB;AAC1D,EAAA,OAAO,OAAO,CAAA,KAAkC;AAC9C,IAAA,MAAM,aAAA,GAAgB,MAAM,kBAAA,CAAmB,CAAA,EAAG,IAAI,CAAA;AACtD,IAAA,IAAI,aAAA,KAAkB,QAAW,OAAO,CAAA,CAAE,KAAK,EAAE,KAAA,EAAO,cAAA,EAAe,EAAG,GAAG,CAAA;AAE7E,IAAA,MAAM,WAAA,GAAc,MAAM,aAAA,CAAc,MAAA,CAAO,KAAA,CAAM,cAAA,CAAe,CAAA,CAAE,GAAA,CAAI,KAAA,CAAM,IAAI,CAAA,IAAK,EAAE,CAAA;AAC3F,IAAA,IAAI,WAAA,KAAgB,QAAW,OAAO,CAAA,CAAE,KAAK,EAAE,KAAA,EAAO,gBAAA,EAAiB,EAAG,GAAG,CAAA;AAE7E,IAAA,MAAM,QAAA,GAAoC,EAAE,WAAA,EAAY;AACxD,IAAA,OAAO,CAAA,CAAE,IAAA,CAAK,QAAA,EAAU,GAAG,CAAA;AAAA,EAC7B,CAAA;AACF;AAEO,SAAS,yBAAyB,IAAA,EAA4B;AACnE,EAAA,OAAO,OAAO,CAAA,KAAkC;AAC9C,IAAA,MAAM,MAAA,GAAS,CAAA,CAAE,GAAA,CAAI,KAAA,CAAM,IAAI,CAAA,IAAK,EAAA;AACpC,IAAA,MAAM,QAAQ,oBAAA,CAAqB,SAAA,CAAU,EAAE,GAAA,EAAK,EAAE,GAAA,CAAI,KAAA,CAAM,KAAK,CAAA,EAAG,KAAK,CAAA,CAAE,GAAA,CAAI,KAAA,CAAM,KAAK,GAAG,CAAA;AACjG,IAAA,IAAI,CAAC,KAAA,CAAM,OAAA,IAAW,CAAE,MAAM,KAAK,YAAA,CAAa,eAAA,CAAgB,MAAA,EAAQ,KAAA,EAAO,MAAM,IAAA,CAAK,GAAA,EAAK,KAAA,CAAM,IAAA,CAAK,GAAG,CAAA,EAAI;AAC/G,MAAA,OAAO,EAAE,IAAA,CAAK,EAAE,KAAA,EAAO,8BAAA,IAAkC,GAAG,CAAA;AAAA,IAC9D;AAEA,IAAA,MAAM,MAAA,GAAS,MAAM,IAAA,CAAK,YAAA,CAAa,YAAA,CAAa,MAAA,EAAQ,IAAI,UAAA,CAAW,MAAM,CAAA,CAAE,GAAA,CAAI,WAAA,EAAa,CAAC,CAAA;AACrG,IAAA,IAAI,CAAC,MAAA,CAAO,EAAA,EAAI,OAAO,CAAA,CAAE,IAAA,CAAK,EAAE,KAAA,EAAO,MAAA,CAAO,MAAA,EAAO,EAAG,GAAG,CAAA;AAC3D,IAAA,OAAO,CAAA,CAAE,IAAA,CAAK,IAAA,EAAM,GAAG,CAAA;AAAA,EACzB,CAAA;AACF;AAEO,SAAS,2BAA2B,IAAA,EAA4B;AACrE,EAAA,OAAO,OAAO,CAAA,KAAkC;AAC9C,IAAA,MAAM,MAAA,GAAS,CAAA,CAAE,GAAA,CAAI,KAAA,CAAM,IAAI,CAAA,IAAK,EAAA;AACpC,IAAA,MAAM,QAAQ,oBAAA,CAAqB,SAAA,CAAU,EAAE,GAAA,EAAK,EAAE,GAAA,CAAI,KAAA,CAAM,KAAK,CAAA,EAAG,KAAK,CAAA,CAAE,GAAA,CAAI,KAAA,CAAM,KAAK,GAAG,CAAA;AACjG,IAAA,IAAI,CAAC,KAAA,CAAM,OAAA,IAAW,CAAE,MAAM,KAAK,YAAA,CAAa,eAAA,CAAgB,MAAA,EAAQ,KAAA,EAAO,MAAM,IAAA,CAAK,GAAA,EAAK,KAAA,CAAM,IAAA,CAAK,GAAG,CAAA,EAAI;AAC/G,MAAA,OAAO,EAAE,IAAA,CAAK,EAAE,KAAA,EAAO,8BAAA,IAAkC,GAAG,CAAA;AAAA,IAC9D;AAEA,IAAA,MAAM,OAAA,GAAU,MAAM,IAAA,CAAK,YAAA,CAAa,YAAY,MAAM,CAAA;AAC1D,IAAA,IAAI,OAAA,KAAY,QAAW,OAAO,CAAA,CAAE,KAAK,EAAE,KAAA,EAAO,gBAAA,EAAiB,EAAG,GAAG,CAAA;AACzE,IAAA,OAAO,CAAA,CAAE,IAAA,CAAK,IAAI,UAAA,CAAW,OAAA,CAAQ,IAAI,CAAA,EAAG,GAAA,EAAK,EAAE,cAAA,EAAgB,OAAA,CAAQ,WAAA,EAAa,CAAA;AAAA,EAC1F,CAAA;AACF;AAEA,SAAS,eAAe,CAAA,EAAgC;AACtD,EAAA,MAAM,KAAA,GAAQ,CAAA,CAAE,GAAA,CAAI,MAAA,CAAO,iBAAiB,CAAA;AAC5C,EAAA,IAAI,KAAA,KAAU,UAAa,KAAA,CAAM,MAAA,KAAW,KAAK,KAAA,CAAM,MAAA,GAAS,KAAK,OAAO,MAAA;AAC5E,EAAA,OAAO,KAAA;AACT;AAEA,SAAS,kBAAA,CAAmB,GAAY,KAAA,EAAsC;AAC5E,EAAA,IAAI,CAAC,WAAA,CAAY,KAAK,CAAA,EAAG,OAAO,MAAA;AAChC,EAAA,IAAK,mBAAA,CAA0C,QAAA,CAAS,KAAA,CAAM,IAAI,CAAA,EAAG;AACnE,IAAA,MAAM,OAAO,KAAA,CAAM,IAAA;AACnB,IAAA,OAAO,CAAA,CAAE,KAAK,EAAE,KAAA,EAAO,MAAK,EAAG,yBAAA,CAA0B,IAAI,CAAC,CAAA;AAAA,EAChE;AACA,EAAA,IAAI,KAAA,CAAM,IAAA,KAAS,+BAAA,IAAmC,KAAA,CAAM,SAAS,kBAAA,EAAoB;AACvF,IAAA,OAAO,EAAE,IAAA,CAAK,EAAE,OAAO,KAAA,CAAM,IAAA,IAAQ,GAAG,CAAA;AAAA,EAC1C;AACA,EAAA,IAAI,KAAA,CAAM,IAAA,KAAS,6BAAA,IAAiC,KAAA,CAAM,SAAS,sBAAA,EAAwB;AACzF,IAAA,OAAO,EAAE,IAAA,CAAK,EAAE,OAAO,KAAA,CAAM,IAAA,IAAQ,GAAG,CAAA;AAAA,EAC1C;AACA,EAAA,IAAI,KAAA,CAAM,SAAS,sBAAA,EAAwB;AACzC,IAAA,OAAO,EAAE,IAAA,CAAK,EAAE,OAAO,KAAA,CAAM,IAAA,IAAQ,GAAG,CAAA;AAAA,EAC1C;AACA,EAAA,OAAO,MAAA;AACT;;;AClMO,SAAS,oBAAoB,IAAA,EAA6B;AAC/D,EAAA,OAAO,OAAO,CAAA,KAAkC,CAAA,CAAE,IAAA,CAAK,IAAA,CAAK,aAAa,GAAG,CAAA;AAC9E;ACYO,SAAS,YAAY,IAAA,EAAqB;AAC/C,EAAA,OAAO,OAAO,CAAA,KAAkC;AAC9C,IAAA,MAAM,SAAS,iBAAA,CAAkB,SAAA,CAAU,MAAM,YAAA,CAAa,CAAC,CAAC,CAAA;AAChE,IAAA,IAAI,CAAC,OAAO,OAAA,EAAS;AACnB,MAAA,OAAO,EAAE,IAAA,CAAK,EAAE,KAAA,EAAO,mEAAA,IAAuE,GAAG,CAAA;AAAA,IACnG;AAEA,IAAA,MAAM,SAAS,MAAM,IAAA,CAAK,IAAA,CAAK,iBAAA,CAAkB,OAAO,IAAI,CAAA;AAC5D,IAAA,IAAI,MAAA,KAAW,QAAW,OAAO,CAAA,CAAE,KAAK,EAAE,KAAA,EAAO,sBAAA,EAAuB,EAAG,GAAG,CAAA;AAE9E,IAAA,MAAM,EAAE,aAAa,SAAA,EAAU,GAAI,MAAM,IAAA,CAAK,IAAA,CAAK,gBAAgB,MAAM,CAAA;AACzE,IAAA,MAAM,WAAyB,EAAE,QAAA,EAAU,OAAO,QAAA,EAAU,WAAA,EAAa,aAAa,SAAA,EAAU;AAChG,IAAA,OAAO,CAAA,CAAE,IAAA,CAAK,QAAA,EAAU,GAAG,CAAA;AAAA,EAC7B,CAAA;AACF;AAEO,SAAS,iBAAiB,IAAA,EAAqB;AACpD,EAAA,OAAO,OAAO,CAAA,KAAkC;AAC9C,IAAA,MAAM,SAAS,sBAAA,CAAuB,SAAA,CAAU,MAAM,YAAA,CAAa,CAAC,CAAC,CAAA;AACrE,IAAA,IAAI,CAAC,MAAA,CAAO,OAAA,EAAS,OAAO,CAAA,CAAE,KAAK,EAAE,KAAA,EAAO,sBAAA,EAAuB,EAAG,GAAG,CAAA;AAKzE,IAAA,MAAM,SAAS,MAAM,IAAA,CAAK,KAAK,aAAA,CAAc,MAAA,CAAO,KAAK,QAAQ,CAAA;AACjE,IAAA,IAAI,MAAA,KAAW,QAAW,OAAO,CAAA,CAAE,KAAK,EAAE,KAAA,EAAO,2BAAA,EAA4B,EAAG,GAAG,CAAA;AAEnF,IAAA,MAAM,QAAA,GAA8B,EAAE,KAAA,EAAO,MAAM,KAAK,IAAA,CAAK,UAAA,CAAW,MAAM,CAAA,EAAE;AAChF,IAAA,OAAO,CAAA,CAAE,IAAA,CAAK,QAAA,EAAU,GAAG,CAAA;AAAA,EAC7B,CAAA;AACF;AAEO,SAAS,aAAa,IAAA,EAAqB;AAChD,EAAA,OAAO,OAAO,CAAA,KAAkC;AAC9C,IAAA,MAAM,SAAS,kBAAA,CAAmB,SAAA,CAAU,MAAM,YAAA,CAAa,CAAC,CAAC,CAAA;AACjE,IAAA,IAAI,CAAC,MAAA,CAAO,OAAA,EAAS,OAAO,CAAA,CAAE,KAAK,EAAE,KAAA,EAAO,6CAAA,EAA8C,EAAG,GAAG,CAAA;AAChG,IAAA,MAAM,EAAE,QAAA,EAAU,KAAA,EAAO,SAAA,KAAc,MAAA,CAAO,IAAA;AAE9C,IAAA,MAAM,MAAA,GAAS,MAAM,IAAA,CAAK,IAAA,CAAK,cAAc,QAAQ,CAAA;AACrD,IAAA,IAAI,MAAA,KAAW,QAAW,OAAO,CAAA,CAAE,KAAK,EAAE,KAAA,EAAO,2BAAA,EAA4B,EAAG,GAAG,CAAA;AAEnF,IAAA,IAAI,CAAE,MAAM,IAAA,CAAK,KAAK,aAAA,CAAc,MAAA,EAAQ,KAAK,CAAA,EAAI;AACnD,MAAA,OAAO,EAAE,IAAA,CAAK,EAAE,KAAA,EAAO,yCAAA,IAA6C,GAAG,CAAA;AAAA,IACzE;AAGA,IAAA,IAAI,CAAE,MAAM,IAAA,CAAK,IAAA,CAAK,gBAAgB,MAAA,EAAQ,KAAA,EAAO,SAAS,CAAA,EAAI;AAChE,MAAA,OAAO,EAAE,IAAA,CAAK,EAAE,KAAA,EAAO,mBAAA,IAAuB,GAAG,CAAA;AAAA,IACnD;AAGA,IAAA,MAAM,IAAA,CAAK,IAAA,CAAK,YAAA,CAAa,MAAA,EAAQ,KAAK,CAAA;AAE1C,IAAA,MAAM,EAAE,aAAa,SAAA,EAAU,GAAI,MAAM,IAAA,CAAK,IAAA,CAAK,gBAAgB,MAAM,CAAA;AACzE,IAAA,MAAM,QAAA,GAA0B,EAAE,WAAA,EAAa,SAAA,EAAU;AACzD,IAAA,OAAO,CAAA,CAAE,IAAA,CAAK,QAAA,EAAU,GAAG,CAAA;AAAA,EAC7B,CAAA;AACF;AC3DA,IAAM,2BAAA,GAA8B,CAAC,iBAAiB,CAAA;AAWtD,SAAS,MAAM,EAAA,EAA2B;AACxC,EAAA,OAAO,IAAI,OAAA,CAAQ,CAAC,YAAY,UAAA,CAAW,OAAA,EAAS,EAAE,CAAC,CAAA;AACzD;AAEO,SAAS,cAAc,IAAA,EAAuB;AACnD,EAAA,OAAO,OAAO,CAAA,KAAkC;AAC9C,IAAA,MAAM,aAAA,GAAgB,MAAM,kBAAA,CAAmB,CAAA,EAAG,IAAI,CAAA;AACtD,IAAA,IAAI,aAAA,KAAkB,QAAW,OAAO,CAAA,CAAE,KAAK,EAAE,KAAA,EAAO,cAAA,EAAe,EAAG,GAAG,CAAA;AAC7E,IAAA,MAAM,EAAE,MAAA,EAAQ,MAAA,EAAO,GAAI,aAAA;AAE3B,IAAA,MAAM,SAAA,GAAY,CAAA,CAAE,GAAA,CAAI,KAAA,CAAM,QAAQ,CAAA;AACtC,IAAA,IAAI,MAAA,GAAS,CAAA;AACb,IAAA,IAAI,cAAc,MAAA,EAAW;AAC3B,MAAA,MAAM,YAAA,GAAe,OAAO,SAAS,CAAA;AACrC,MAAA,IAAI,CAAC,MAAA,CAAO,SAAA,CAAU,YAAY,KAAK,YAAA,GAAe,CAAA,EAAG,OAAO,CAAA,CAAE,IAAA,CAAK,EAAE,KAAA,EAAO,gBAAA,IAAoB,GAAG,CAAA;AACvG,MAAA,MAAA,GAAS,YAAA;AAAA,IACX;AAEA,IAAA,MAAM,QAAQ,MAAM,MAAA,CAAO,OAAA,CAAQ,UAAA,CAAW,OAAO,QAAQ,CAAA;AAC7D,IAAA,IAAI,MAAA,GAAS,MAAM,QAAA,EAAU;AAC3B,MAAA,MAAM,MAAA,CAAO,QAAQ,aAAA,CAAc,EAAE,UAAU,MAAA,CAAO,QAAA,EAAU,QAAA,EAAU,MAAA,EAAQ,CAAA;AAAA,IACpF;AAEA,IAAA,MAAM,QAAA,GAAW,IAAA,CAAK,GAAA,CAAI,CAAA,EAAG,IAAA,CAAK,KAAK,IAAA,CAAK,cAAA,GAAiB,IAAA,CAAK,kBAAkB,CAAC,CAAA;AACrF,IAAA,KAAA,IAAS,OAAA,GAAU,CAAA,EAAG,OAAA,GAAU,QAAA,EAAU,WAAW,CAAA,EAAG;AACtD,MAAA,MAAM,IAAA,GAAO,MAAM,MAAA,CAAO,OAAA,CAAQ,SAAA,CAAU;AAAA,QAC1C,UAAU,MAAA,CAAO,QAAA;AAAA,QACjB,QAAA,EAAU,MAAA;AAAA,QACV,OAAO,IAAA,CAAK;AAAA,OACb,CAAA;AACD,MAAA,IAAI,IAAA,CAAK,QAAA,CAAS,MAAA,GAAS,CAAA,EAAG;AAC5B,QAAA,MAAM,MAAA,GAAqB,KAAK,QAAA,CAAS,GAAA,CAAI,CAAC,OAAA,KAAY,cAAA,CAAe,OAAA,CAAQ,IAAI,CAAC,CAAA;AACtF,QAAA,MAAMC,SAAAA,GAA+B;AAAA,UACnC,MAAA;AAAA,UACA,QAAQ,IAAA,CAAK,OAAA;AAAA,UACb,YAAA,EAAc;AAAA,SAChB;AACA,QAAA,OAAO,CAAA,CAAE,IAAA,CAAKA,SAAAA,EAAU,GAAG,CAAA;AAAA,MAC7B;AACA,MAAA,IAAI,UAAU,QAAA,GAAW,CAAA,EAAG,MAAM,KAAA,CAAM,KAAK,kBAAkB,CAAA;AAAA,IACjE;AAEA,IAAA,MAAM,QAAA,GAA+B;AAAA,MACnC,QAAQ,EAAC;AAAA,MACT,MAAA;AAAA,MACA,YAAA,EAAc;AAAA,KAChB;AACA,IAAA,OAAO,CAAA,CAAE,IAAA,CAAK,QAAA,EAAU,GAAG,CAAA;AAAA,EAC7B,CAAA;AACF;ACnFO,IAAM,kCAAA,GAAqC;AAC3C,IAAM,gCAAA,GAAmC,KAAK,EAAA,GAAK;AACnD,IAAM,6BAA6B,EAAA,GAAK;AAE/C,IAAM,gBAAA,GAAmBD,EAAE,MAAA,EAAO,CAAE,IAAI,GAAG,CAAA,CAAE,KAAA,CAAM,IAAA,EAAM,yBAAyB,CAAA;AAClF,IAAM,YAAA,GAAeA,EAAE,MAAA,EAAO,CAAE,IAAI,CAAC,CAAA,CAAE,IAAI,GAAG,CAAA;AAEvC,IAAM,2BAAA,GAA8BA,CAAAA,CAAE,kBAAA,CAAmB,MAAA,EAAQ;AAAA,EACtEA,EAAE,MAAA,CAAO;AAAA,IACP,IAAA,EAAMA,CAAAA,CAAE,OAAA,CAAQ,oBAAoB,CAAA;AAAA,IACpC,OAAA,EAASA,EAAE,MAAA,EAAO;AAAA,IAClB,UAAA,EAAY,iBAAiB,QAAA;AAAS,GACvC,CAAA;AAAA,EACDA,EAAE,MAAA,CAAO;AAAA,IACP,IAAA,EAAMA,CAAAA,CAAE,OAAA,CAAQ,mBAAmB,CAAA;AAAA,IACnC,UAAA,EAAY,gBAAA;AAAA,IACZ,UAAUA,CAAAA,CAAE,IAAA,CAAK,CAAC,SAAA,EAAW,QAAQ,CAAC,CAAA;AAAA,IACtC,UAAA,EAAYA,CAAAA,CAAE,IAAA,CAAK,CAAC,OAAO,CAAC,CAAA;AAAA,IAC5B,IAAIA,CAAAA,CAAE,GAAA,CAAI,SAAS,EAAE,MAAA,EAAQ,MAAM;AAAA,GACpC;AACH,CAAC;AAIM,IAAM,yBAAA,GAA4BA,EAAE,MAAA,CAAO;AAAA,EAChD,MAAA,EAAQ,YAAA;AAAA,EACR,gBAAA,EAAkB,gBAAA;AAAA,EAClB,UAAUA,CAAAA,CAAE,MAAA,EAAO,CAAE,GAAA,GAAM,QAAA,EAAS;AAAA,EACpC,UAAA,EAAYA,CAAAA,CAAE,GAAA,CAAI,QAAA,EAAS;AAAA,EAC3B,KAAA,EAAO;AACT,CAAC;AAiCM,SAAS,+BACd,KAAA,EACiC;AACjC,EAAA,MAAM,QAAA,GAAW,MAAM,QAAA,IAAY,kCAAA;AACnC,EAAA,MAAM,KAAA,GAAQ,MAAM,KAAA,IAAS,gCAAA;AAC7B,EAAA,IAAI,CAAC,MAAA,CAAO,aAAA,CAAc,QAAQ,CAAA,IAAK,YAAY,CAAA,EAAG;AACpD,IAAA,MAAM,IAAI,cAAA;AAAA,MACR,4BAAA;AAAA,MACA,CAAA,gEAAA,EAAmE,MAAA,CAAO,QAAQ,CAAC,CAAA,CAAA;AAAA,KACrF;AAAA,EACF;AACA,EAAA,IAAI,CAAC,MAAA,CAAO,QAAA,CAAS,KAAK,CAAA,IAAK,SAAS,CAAA,EAAG;AACzC,IAAA,MAAM,IAAI,cAAA;AAAA,MACR,4BAAA;AAAA,MACA,CAAA,0EAAA,EAA6E,MAAA,CAAO,KAAK,CAAC,CAAA,CAAA;AAAA,KAC5F;AAAA,EACF;AACA,EAAA,MAAM,MAAA,GAASA,EACZ,MAAA,CAAO;AAAA,IACN,MAAA,EAAQ,YAAA;AAAA,IACR,gBAAA,EAAkB,gBAAA;AAAA,IAClB,KAAA,EAAO;AAAA,GACR,CAAA,CACA,SAAA,CAAU,KAAK,CAAA;AAClB,EAAA,IAAI,CAAC,OAAO,OAAA,EAAS;AACnB,IAAA,MAAM,IAAI,cAAA;AAAA,MACR,4BAAA;AAAA,MACA;AAAA,KACF;AAAA,EACF;AACA,EAAA,IACE,MAAA,CAAO,IAAA,CAAK,KAAA,CAAM,IAAA,KAAS,wBAC3B,IAAI,WAAA,EAAY,CAAE,MAAA,CAAO,OAAO,IAAA,CAAK,KAAA,CAAM,OAAO,CAAA,CAAE,aAAa,0BAAA,EACjE;AACA,IAAA,MAAM,IAAI,cAAA;AAAA,MACR,4BAAA;AAAA,MACA,4BAA4B,0BAA0B,CAAA,aAAA;AAAA,KACxD;AAAA,EACF;AACA,EAAA,OAAO,EAAE,QAAA,EAAU,KAAA,EAAO,KAAA,EAAO,MAAA,CAAO,KAAK,KAAA,EAAM;AACrD;AAEO,SAAS,mBAAA,CAAoB,QAAkB,MAAA,EAAwB;AAC5E,EAAA,OAAOE,SAAAA,CAAU,QAAQ,MAAM,CAAA;AACjC;AAEO,SAAS,0BAA0B,KAAA,EAAgD;AACxF,EAAA,OAAOF,CAAAA,CAAE,KAAA,CAAM,yBAAyB,CAAA,CAAE,MAAM,KAAK,CAAA;AACvD;AAEO,SAAS,uBACd,OAAA,EACoB;AACpB,EAAA,OAAO,OAAA,CAAQ,EAAA,CAAG,EAAE,CAAA,EAAG,QAAA;AACzB;AC/GA,eAAsB,uBAAA,CAAwB,OAAyB,MAAA,EAA+B;AACpG,EAAA,MAAM,IAAA,GAAO,MAAM,KAAA,CAAM,GAAA,CAAI,MAAM,CAAA;AACnC,EAAA,IAAI,IAAA,KAAS,MAAA,IAAa,IAAA,CAAK,MAAA,KAAW,aAAA,EAAe;AACzD,EAAA,IAAI;AACF,IAAA,MAAM,MAAM,YAAA,CAAa;AAAA,MACvB,MAAA,EAAQ,MAAA;AAAA,MACR,cAAA,EAAgB,aAAA;AAAA,MAChB,MAAA,EAAQ;AAAA,KACT,CAAA;AAAA,EACH,SAAS,MAAA,EAAQ;AACf,IAAA,IAAI,mBAAA,CAAoB,MAAM,CAAA,EAAG;AACjC,IAAA,MAAM,MAAA;AAAA,EACR;AACF;;;AC4BO,SAAS,mBAAmB,MAAA,EAAwB;AACzD,EAAA,OAAO,QAAQ,MAAM,CAAA,SAAA,CAAA;AACvB;AAEA,eAAsB,qBAAA,CACpB,MAAA,EACA,QAAA,EACA,QAAA,EACA,iBAAiC,uBAAA,EACR;AACzB,EAAA,IAAI,CAAE,MAAM,MAAA,CAAO,YAAY,OAAA,CAAQ,QAAQ,GAAI,OAAO,cAAA;AAE1D,EAAA,IAAI,CAAE,sBAAA,CAAkD,QAAA,CAAS,QAAA,CAAS,IAAI,GAAG,OAAO,UAAA;AAExF,EAAA,MAAM,SAAS,QAAA,CAAS,OAAA;AAGxB,EAAA,IAAI,MAAA,KAAW,QAAW,OAAO,UAAA;AAEjC,EAAA,MAAM,OAAA,GAAU,MAAM,MAAA,CAAO,KAAA,CAAM,IAAI,MAAM,CAAA;AAC7C,EAAA,IAAI,SAAS,aAAA,KAAkB,MAAA,IAAa,OAAA,CAAQ,aAAA,KAAkB,UAAU,OAAO,UAAA;AAEvF,EAAA,IAAI,SAAS,IAAA,KAAS,eAAA,IAAmB,SAAS,OAAA,CAAQ,MAAA,CAAO,SAAS,CAAA,EAAG;AAC3E,IAAA,IAAI;AACF,MAAA,qBAAA;AAAA,QACE;AAAA,UACE,MAAA;AAAA,UACA,kBAAkB,QAAA,CAAS,EAAA;AAAA,UAC3B,QAAA,EAAU,SAAS,OAAA,CAAQ,GAAA;AAAA,UAC3B,MAAA,EAAQ,SAAS,OAAA,CAAQ,MAAA;AAAA,UACzB,OAAA,EAAS;AAAA,SACX;AAAA,QACA;AAAA,OACF;AAAA,IACF,SAAS,MAAA,EAAQ;AACf,MAAA,IACE,aAAa,MAAA,EAAQ,0BAA0B,KAC/C,YAAA,CAAa,MAAA,EAAQ,4BAA4B,CAAA,EACjD;AACA,QAAA,OAAO,UAAA;AAAA,MACT;AACA,MAAA,MAAM,MAAA;AAAA,IACR;AAAA,EACF;AAEA,EAAA,MAAM,aAAA,GAAgB,2BAAA,CAA4B,MAAA,EAAQ,QAAQ,CAAA;AAClE,EAAA,IAAI,kBAAkB,MAAA,EAAW;AAC/B,IAAA,IAAI;AACF,MAAA,8BAAA,CAA+B,aAAa,CAAA;AAAA,IAC9C,SAAS,MAAA,EAAQ;AACf,MAAA,IAAI,YAAA,CAAa,MAAA,EAAQ,4BAA4B,CAAA,EAAG,OAAO,UAAA;AAC/D,MAAA,MAAM,MAAA;AAAA,IACR;AAAA,EACF;AAEA,EAAA,IAAI,MAAM,OAAO,KAAA,CAAM,cAAA,CAAe,UAAU,QAAA,CAAS,EAAE,GAAG,OAAO,WAAA;AAErE,EAAA,MAAM,cAAA,CAAe,MAAA,EAAQ,QAAA,EAAU,MAAA,EAAQ,UAAU,cAAc,CAAA;AACvE,EAAA,OAAO,UAAA;AACT;AASA,eAAe,cAAA,CACb,MAAA,EACA,QAAA,EACA,MAAA,EACA,UACA,cAAA,EACe;AACf,EAAA,QAAQ,SAAS,IAAA;AAAM,IACrB,KAAK,YAAA;AACH,MAAA,MAAM,OAAO,KAAA,CAAM,KAAA,CAAM,EAAE,MAAA,EAAQ,UAAU,CAAA;AAC7C,MAAA;AAAA,IACF,KAAK,cAAA;AACH,MAAA,MAAM,OAAO,KAAA,CAAM,YAAA,CAAa,EAAE,MAAA,EAAQ,MAAA,EAAQ,WAAW,CAAA;AAC7D,MAAA;AAAA,IACF,KAAK,cAAA;AACH,MAAA,MAAM,OAAO,KAAA,CAAM,YAAA,CAAa,EAAE,MAAA,EAAQ,MAAA,EAAQ,UAAU,CAAA;AAC5D,MAAA;AAAA,IACF,KAAK,eAAA;AACH,MAAA,IAAI,QAAA,CAAS,OAAA,CAAQ,MAAA,CAAO,MAAA,GAAS,CAAA,EAAG;AACtC,QAAA,MAAM,oBAAA;AAAA,UACJ,MAAA,CAAO,QAAA;AAAA,UACP;AAAA,YACE,MAAA;AAAA,YACA,kBAAkB,QAAA,CAAS,EAAA;AAAA,YAC3B,QAAA,EAAU,SAAS,OAAA,CAAQ,GAAA;AAAA,YAC3B,MAAA,EAAQ,SAAS,OAAA,CAAQ,MAAA;AAAA,YACzB,OAAA,EAAS;AAAA,WACX;AAAA,UACA;AAAA,SACF;AAAA,MACF;AACA,MAAA;AAAA,IACF,KAAK,qBAAA;AACH,MAAA,MAAM,OAAO,SAAA,CAAU,MAAA,CAAO,2BAAA,CAA4B,MAAA,EAAQ,QAAQ,CAAE,CAAA;AAC5E,MAAA;AAAA,IACF,KAAK,wBAAA;AACH,MAAA,MAAM,OAAO,SAAA,CAAU,MAAA,CAAO,2BAAA,CAA4B,MAAA,EAAQ,QAAQ,CAAE,CAAA;AAC5E,MAAA;AAAA,IACF,KAAK,eAAA;AACH,MAAA,MAAM,cAAA,CAAe,MAAA,EAAQ,MAAA,EAAQ,QAAA,EAAU,UAAU,CAAA;AACzD,MAAA;AAAA,IACF,KAAK,WAAA;AACH,MAAA,MAAM,cAAA,CAAe,MAAA,EAAQ,MAAA,EAAQ,QAAA,EAAU,QAAQ,CAAA;AACvD,MAAA;AAAA,IACF,KAAK,gBAAA;AACH,MAAA,MAAM,cAAA,CAAe,MAAA,EAAQ,MAAA,EAAQ,QAAA,EAAU,WAAW,CAAA;AAC1D,MAAA;AAAA,IACF;AACE,MAAA;AAAA;AAEN;AAEA,SAAS,2BAAA,CACP,QACA,QAAA,EACyC;AACzC,EAAA,QAAQ,SAAS,IAAA;AAAM,IACrB,KAAK,qBAAA;AACH,MAAA,OAAO;AAAA,QACL,MAAA;AAAA,QACA,kBAAkB,QAAA,CAAS,EAAA;AAAA,QAC3B,KAAA,EAAO;AAAA,UACL,IAAA,EAAM,oBAAA;AAAA,UACN,OAAA,EAAS,SAAS,OAAA,CAAQ,OAAA;AAAA,UAC1B,GAAI,QAAA,CAAS,OAAA,CAAQ,UAAA,KAAe,MAAA,GAChC,EAAC,GACD,EAAE,UAAA,EAAY,QAAA,CAAS,OAAA,CAAQ,UAAA;AAAW;AAChD,OACF;AAAA,IACF,KAAK,wBAAA;AACH,MAAA,OAAO;AAAA,QACL,MAAA;AAAA,QACA,kBAAkB,QAAA,CAAS,EAAA;AAAA,QAC3B,KAAA,EAAO;AAAA,UACL,IAAA,EAAM,mBAAA;AAAA,UACN,UAAA,EAAY,SAAS,OAAA,CAAQ,UAAA;AAAA,UAC7B,QAAA,EAAU,SAAS,OAAA,CAAQ,QAAA;AAAA,UAC3B,UAAA,EAAY,SAAS,OAAA,CAAQ,UAAA;AAAA,UAC7B,EAAA,EAAI,SAAS,OAAA,CAAQ;AAAA;AACvB,OACF;AAAA,IACF;AACE,MAAA,OAAO,MAAA;AAAA;AAEb;AAgBA,eAAe,cAAA,CACb,MAAA,EACA,MAAA,EACA,QAAA,EACA,MAAA,EACe;AACf,EAAA,MAAM,EAAE,OAAA,EAAQ,GAAI,MAAM,MAAA,CAAO,SAAS,MAAA,CAAO;AAAA,IAC/C,GAAA,EAAK,mBAAmB,MAAM,CAAA;AAAA,IAC9B,IAAA,EAAM,eAAe,QAAQ;AAAA,GAC9B,CAAA;AACD,EAAA,IAAI,CAAC,OAAA,EAAS;AACd,EAAA,MAAM,OAAO,KAAA,CAAM,YAAA,CAAa,EAAE,MAAA,EAAQ,QAAQ,CAAA;AAClD,EAAA,MAAM,uBAAA,CAAwB,MAAA,CAAO,KAAA,EAAO,MAAM,CAAA;AACpD;;;ACzMO,SAAS,gBAAgB,IAAA,EAAyB;AACvD,EAAA,OAAO,OAAO,CAAA,KAAkC;AAC9C,IAAA,MAAM,aAAA,GAAgB,MAAM,kBAAA,CAAmB,CAAA,EAAG,IAAI,CAAA;AACtD,IAAA,IAAI,aAAA,KAAkB,QAAW,OAAO,CAAA,CAAE,KAAK,EAAE,KAAA,EAAO,cAAA,EAAe,EAAG,GAAG,CAAA;AAC7E,IAAA,MAAM,EAAE,MAAA,EAAQ,MAAA,EAAO,GAAI,aAAA;AAE3B,IAAA,MAAM,SAAS,yBAAA,CAA0B,SAAA,CAAU,MAAM,YAAA,CAAa,CAAC,CAAC,CAAA;AACxE,IAAA,IAAI,CAAC,MAAA,CAAO,OAAA,EAAS,OAAO,CAAA,CAAE,KAAK,EAAE,KAAA,EAAO,wCAAA,EAAyC,EAAG,GAAG,CAAA;AAE3F,IAAA,IAAI,QAAA,GAAW,CAAA;AACf,IAAA,IAAI,QAAA,GAAW,CAAA;AACf,IAAA,KAAA,MAAW,QAAA,IAAY,MAAA,CAAO,IAAA,CAAK,QAAA,EAAU;AAC3C,MAAA,MAAM,UAAU,MAAM,qBAAA;AAAA,QACpB,MAAA;AAAA,QACA,MAAA,CAAO,QAAA;AAAA,QACP,QAAA;AAAA,QACA,IAAA,CAAK;AAAA,OACP;AACA,MAAA,IAAI,OAAA,KAAY,gBAAgB,OAAO,CAAA,CAAE,KAAK,EAAE,KAAA,EAAO,qBAAA,EAAsB,EAAG,GAAG,CAAA;AAInF,MAAA,IAAI,OAAA,KAAY,YAAY,QAAA,IAAY,CAAA;AAAA,WACnC,QAAA,IAAY,CAAA;AAAA,IACnB;AAIA,IAAA,MAAM,QAAA,GAAiC,WAAW,CAAA,GAAI,EAAE,UAAU,QAAA,EAAS,GAAI,EAAE,QAAA,EAAS;AAC1F,IAAA,OAAO,CAAA,CAAE,IAAA,CAAK,QAAA,EAAU,GAAG,CAAA;AAAA,EAC7B,CAAA;AACF;AClDO,IAAM,wBAAA,GAA2B;AACjC,IAAM,sCAAA,GAAyC;AAC/C,IAAM,0CAAA,GAA6C;AACnD,IAAM,+CAAA,GAAkD;AAY/D,IAAM,eAAA,GAAkBA,CAAAA,CAAE,MAAA,CAAO,EAAE,cAAA,EAAgBA,CAAAA,CAAE,IAAA,CAAK,cAAc,CAAA,CAAE,QAAA,EAAS,EAAG,CAAA;AACtF,IAAM,gBAAA,GAAmBA,EAAE,MAAA,CAAO;AAAA,EAChC,cAAA,EAAgBA,CAAAA,CAAE,IAAA,CAAK,cAAc,CAAA;AAAA,EACrC,MAAA,EAAQA,CAAAA,CAAE,IAAA,CAAK,cAAc;AAC/B,CAAC,CAAA;AAED,SAAS,wBAAwB,KAAA,EAA+C;AAC9E,EAAA,IAAI,KAAA,KAAU,QAAW,OAAO,CAAA;AAChC,EAAA,MAAM,MAAA,GAAS,OAAO,KAAK,CAAA;AAC3B,EAAA,OAAO,OAAO,aAAA,CAAc,MAAM,CAAA,IAAK,MAAA,IAAU,IAAI,MAAA,GAAS,MAAA;AAChE;AAEA,SAAS,oBAAA,CAAqB,OAA2B,QAAA,EAAsC;AAC7F,EAAA,IAAI,KAAA,KAAU,QAAW,OAAO,QAAA;AAChC,EAAA,MAAM,MAAA,GAAS,OAAO,KAAK,CAAA;AAC3B,EAAA,OAAO,OAAO,aAAA,CAAc,MAAM,CAAA,IAAK,MAAA,GAAS,IAAI,MAAA,GAAS,MAAA;AAC/D;AAEA,SAAS,UAAA,CAAW,GAAY,SAAA,EAA+C;AAC7E,EAAA,MAAM,WAAW,uBAAA,CAAwB,CAAA,CAAE,GAAA,CAAI,KAAA,CAAM,OAAO,CAAC,CAAA;AAC7D,EAAA,MAAM,QAAQ,oBAAA,CAAqB,CAAA,CAAE,IAAI,KAAA,CAAM,OAAO,GAAG,SAAS,CAAA;AAClE,EAAA,MAAM,SAAA,GAAY,CAAA,CAAE,GAAA,CAAI,KAAA,CAAM,QAAQ,CAAA;AACtC,EAAA,IAAI,aAAa,MAAA,IAAa,KAAA,KAAU,MAAA,IAAa,KAAA,GAAQ,WAAW,OAAO,MAAA;AAC/E,EAAA,IAAI,cAAc,MAAA,IAAa,CAAC,cAAA,CAAe,QAAA,CAAS,SAA4C,CAAA,EAAG;AACrG,IAAA,OAAO,MAAA;AAAA,EACT;AACA,EAAA,OAAO;AAAA,IACL,QAAA;AAAA,IACA,KAAA;AAAA,IACA,GAAI,CAAA,CAAE,GAAA,CAAI,KAAA,CAAM,SAAS,CAAA,KAAM,MAAA,GAAY,EAAC,GAAI,EAAE,OAAA,EAAS,CAAA,CAAE,GAAA,CAAI,KAAA,CAAM,SAAS,CAAA,EAAE;AAAA,IAClF,GAAI,SAAA,KAAc,MAAA,GAAY,EAAC,GAAI,EAAE,QAAQ,SAAA;AAA6C,GAC5F;AACF;AAEO,SAAS,iBAAiB,IAAA,EAAsB;AACrD,EAAA,OAAO,OAAO,CAAA,KAAkC;AAC9C,IAAA,MAAM,aAAA,GAAgB,MAAM,kBAAA,CAAmB,CAAA,EAAG,IAAI,CAAA;AACtD,IAAA,IAAI,aAAA,KAAkB,QAAW,OAAO,CAAA,CAAE,KAAK,EAAE,KAAA,EAAO,cAAA,EAAe,EAAG,GAAG,CAAA;AAC7E,IAAA,MAAM,KAAA,GAAQ,UAAA,CAAW,CAAA,EAAG,IAAA,CAAK,SAAS,CAAA;AAC1C,IAAA,IAAI,KAAA,KAAU,QAAW,OAAO,CAAA,CAAE,KAAK,EAAE,KAAA,EAAO,qBAAA,EAAsB,EAAG,GAAG,CAAA;AAC5E,IAAA,OAAO,CAAA,CAAE,KAAK,MAAM,aAAA,CAAc,OAAO,KAAA,CAAM,IAAA,CAAK,KAAK,CAAA,EAAG,GAAG,CAAA;AAAA,EACjE,CAAA;AACF;AAEO,SAAS,kBAAkB,IAAA,EAAuB;AACvD,EAAA,OAAO,OAAO,CAAA,KAAkC;AAC9C,IAAA,MAAM,aAAA,GAAgB,MAAM,kBAAA,CAAmB,CAAA,EAAG,IAAI,CAAA;AACtD,IAAA,IAAI,aAAA,KAAkB,QAAW,OAAO,CAAA,CAAE,KAAK,EAAE,KAAA,EAAO,cAAA,EAAe,EAAG,GAAG,CAAA;AAC7E,IAAA,MAAM,SAAS,eAAA,CAAgB,SAAA,CAAU,MAAM,YAAA,CAAa,CAAC,CAAC,CAAA;AAC9D,IAAA,IAAI,CAAC,MAAA,CAAO,OAAA,EAAS,OAAO,CAAA,CAAE,KAAK,EAAE,KAAA,EAAO,oBAAA,EAAqB,EAAG,GAAG,CAAA;AACvE,IAAA,MAAM,MAAA,GAAS,CAAA,CAAE,GAAA,CAAI,KAAA,CAAM,IAAI,CAAA;AAC/B,IAAA,IAAI,MAAA,KAAW,MAAA,IAAa,MAAA,CAAO,MAAA,KAAW,CAAA,EAAG,OAAO,CAAA,CAAE,IAAA,CAAK,EAAE,KAAA,EAAO,uBAAA,EAAwB,EAAG,GAAG,CAAA;AACtG,IAAA,IAAI;AACF,MAAA,MAAM,IAAA,GAAO,MAAM,aAAA,CAAc,MAAA,CAAO,MAAM,KAAA,CAAM;AAAA,QAClD,MAAA;AAAA,QACA,QAAA,EAAU,cAAc,MAAA,CAAO,QAAA;AAAA,QAC/B,GAAI,MAAA,CAAO,IAAA,CAAK,cAAA,KAAmB,KAAA,CAAA,GAC/B,EAAC,GACD,EAAE,cAAA,EAAgB,MAAA,CAAO,IAAA,CAAK,cAAA;AAAe,OAClD,CAAA;AACD,MAAA,OAAO,CAAA,CAAE,IAAA,CAAK,IAAA,EAAM,GAAG,CAAA;AAAA,IACzB,SAAS,MAAA,EAAQ;AACf,MAAA,OAAO,YAAA,CAAa,GAAG,MAAM,CAAA;AAAA,IAC/B;AAAA,EACF,CAAA;AACF;AAEO,SAAS,oBAAoB,IAAA,EAAuB;AACzD,EAAA,OAAO,OAAO,CAAA,KAAkC;AAC9C,IAAA,MAAM,aAAA,GAAgB,MAAM,kBAAA,CAAmB,CAAA,EAAG,IAAI,CAAA;AACtD,IAAA,IAAI,aAAA,KAAkB,QAAW,OAAO,CAAA,CAAE,KAAK,EAAE,KAAA,EAAO,cAAA,EAAe,EAAG,GAAG,CAAA;AAC7E,IAAA,MAAM,MAAA,GAAS,CAAA,CAAE,GAAA,CAAI,KAAA,CAAM,IAAI,CAAA;AAC/B,IAAA,IAAI,MAAA,KAAW,MAAA,IAAa,MAAA,CAAO,MAAA,KAAW,CAAA,EAAG,OAAO,CAAA,CAAE,IAAA,CAAK,EAAE,KAAA,EAAO,uBAAA,EAAwB,EAAG,GAAG,CAAA;AACtG,IAAA,IAAI;AACF,MAAA,OAAO,CAAA,CAAE,IAAA;AAAA,QACP,MAAM,aAAA,CAAc,MAAA,CAAO,KAAA,CAAM,OAAA,CAAQ;AAAA,UACvC,MAAA;AAAA,UACA,QAAA,EAAU,cAAc,MAAA,CAAO;AAAA,SAChC,CAAA;AAAA,QACD;AAAA,OACF;AAAA,IACF,SAAS,MAAA,EAAQ;AACf,MAAA,OAAO,YAAA,CAAa,GAAG,MAAM,CAAA;AAAA,IAC/B;AAAA,EACF,CAAA;AACF;AAEO,SAAS,mBAAmB,IAAA,EAAuB;AACxD,EAAA,OAAO,OAAO,CAAA,KAAkC;AAC9C,IAAA,MAAM,aAAA,GAAgB,MAAM,kBAAA,CAAmB,CAAA,EAAG,IAAI,CAAA;AACtD,IAAA,IAAI,aAAA,KAAkB,QAAW,OAAO,CAAA,CAAE,KAAK,EAAE,KAAA,EAAO,cAAA,EAAe,EAAG,GAAG,CAAA;AAC7E,IAAA,MAAM,SAAS,gBAAA,CAAiB,SAAA,CAAU,MAAM,YAAA,CAAa,CAAC,CAAC,CAAA;AAC/D,IAAA,IAAI,CAAC,MAAA,CAAO,OAAA,EAAS,OAAO,CAAA,CAAE,KAAK,EAAE,KAAA,EAAO,qBAAA,EAAsB,EAAG,GAAG,CAAA;AACxE,IAAA,MAAM,MAAA,GAAS,CAAA,CAAE,GAAA,CAAI,KAAA,CAAM,IAAI,CAAA;AAC/B,IAAA,IAAI,MAAA,KAAW,MAAA,IAAa,MAAA,CAAO,MAAA,KAAW,CAAA,EAAG,OAAO,CAAA,CAAE,IAAA,CAAK,EAAE,KAAA,EAAO,uBAAA,EAAwB,EAAG,GAAG,CAAA;AACtG,IAAA,IAAI,MAAA,CAAO,IAAA,CAAK,MAAA,KAAW,MAAA,EAAQ;AACjC,MAAA,OAAO,EAAE,IAAA,CAAK,EAAE,KAAA,EAAO,sCAAA,IAA0C,GAAG,CAAA;AAAA,IACtE;AACA,IAAA,IAAI;AACF,MAAA,OAAO,CAAA,CAAE,IAAA;AAAA,QACP,MAAM,aAAA,CAAc,MAAA,CAAO,KAAA,CAAM,YAAA,CAAa;AAAA,UAC5C,MAAA;AAAA,UACA,cAAA,EAAgB,OAAO,IAAA,CAAK,cAAA;AAAA,UAC5B,MAAA,EAAQ,OAAO,IAAA,CAAK,MAAA;AAAA,UACpB,QAAA,EAAU,cAAc,MAAA,CAAO;AAAA,SAChC,CAAA;AAAA,QACD;AAAA,OACF;AAAA,IACF,SAAS,MAAA,EAAQ;AACf,MAAA,OAAO,YAAA,CAAa,GAAG,MAAM,CAAA;AAAA,IAC/B;AAAA,EACF,CAAA;AACF;AAEO,SAAS,mBAAmB,IAAA,EAA4B;AAC7D,EAAA,OAAO,OAAO,CAAA,KAAkC;AAC9C,IAAA,MAAM,SAAA,GAAY,MAAM,kBAAA,CAAmB,CAAA,EAAG,IAAI,CAAA;AAClD,IAAA,IAAI,SAAA,KAAc,QAAW,OAAO,CAAA,CAAE,KAAK,EAAE,KAAA,EAAO,cAAA,EAAe,EAAG,GAAG,CAAA;AACzE,IAAA,MAAM,KAAA,GAAQ,UAAA,CAAW,CAAA,EAAG,IAAA,CAAK,SAAS,CAAA;AAC1C,IAAA,IAAI,KAAA,KAAU,QAAW,OAAO,CAAA,CAAE,KAAK,EAAE,KAAA,EAAO,qBAAA,EAAsB,EAAG,GAAG,CAAA;AAE5E,IAAA,MAAM,UAAA,GAAa,MAAM,QAAA,IAAY,CAAA;AACrC,IAAA,MAAM,SAAA,GAAY,CAAA,CAAE,GAAA,CAAI,MAAA,CAAO,eAAe,CAAA;AAC9C,IAAA,MAAM,WAAA,GAAc,SAAA,KAAc,MAAA,GAAY,MAAA,GAAY,wBAAwB,SAAS,CAAA;AAC3F,IAAA,IAAI,SAAA,KAAc,MAAA,IAAa,WAAA,KAAgB,MAAA,EAAW;AACxD,MAAA,OAAO,EAAE,IAAA,CAAK,EAAE,KAAA,EAAO,uBAAA,IAA2B,GAAG,CAAA;AAAA,IACvD;AACA,IAAA,IAAI,WAAA,KAAgB,UAAa,CAAA,CAAE,GAAA,CAAI,MAAM,OAAO,CAAA,KAAM,MAAA,IAAa,WAAA,KAAgB,UAAA,EAAY;AACjG,MAAA,OAAO,EAAE,IAAA,CAAK,EAAE,KAAA,EAAO,4BAAA,IAAgC,GAAG,CAAA;AAAA,IAC5D;AAEA,IAAA,IAAI,OAAA,GAAU,KAAA;AACd,IAAA,MAAM,cAAA,GAAiB,IAAI,eAAA,EAAgB;AAC3C,IAAA,MAAM,MAAA,GAAS,CAAA,CAAE,GAAA,CAAI,GAAA,CAAI,MAAA;AACzB,IAAA,MAAM,MAAA,GAAS,IAAI,cAAA,CAA2B;AAAA,MAC5C,MAAM,UAAA,EAAY;AAChB,QAAA,MAAM,UAAU,MAAM;AACpB,UAAA,OAAA,GAAU,IAAA;AACV,UAAA,cAAA,CAAe,KAAA,EAAM;AACrB,UAAA,eAAA,CAAgB,UAAU,CAAA;AAAA,QAC5B,CAAA;AACA,QAAA,MAAA,CAAO,iBAAiB,OAAA,EAAS,OAAA,EAAS,EAAE,IAAA,EAAM,MAAM,CAAA;AACxD,QAAA,KAAK,eAAA;AAAA,UACH,UAAA;AAAA,UACA,CAAA;AAAA,UACA,IAAA;AAAA,UACA,EAAE,GAAG,KAAA,EAAO,QAAA,EAAU,eAAe,UAAA,EAAW;AAAA,UAChD,MAAM,WAAW,MAAA,CAAO,OAAA;AAAA,UACxB,cAAA,CAAe;AAAA,SACjB,CAAE,QAAQ,MAAM;AACd,UAAA,OAAA,GAAU,IAAA;AACV,UAAA,cAAA,CAAe,KAAA,EAAM;AACrB,UAAA,MAAA,CAAO,mBAAA,CAAoB,SAAS,OAAO,CAAA;AAC3C,UAAA,eAAA,CAAgB,UAAU,CAAA;AAAA,QAC5B,CAAC,CAAA;AAAA,MACH,CAAA;AAAA,MACA,MAAA,GAAS;AACP,QAAA,OAAA,GAAU,IAAA;AACV,QAAA,cAAA,CAAe,KAAA,EAAM;AAAA,MACvB;AAAA,KACD,CAAA;AAED,IAAA,OAAO,IAAI,SAAS,MAAA,EAAQ;AAAA,MAC1B,MAAA,EAAQ,GAAA;AAAA,MACR,OAAA,EAAS;AAAA,QACP,eAAA,EAAiB,wBAAA;AAAA,QACjB,UAAA,EAAY,YAAA;AAAA,QACZ,cAAA,EAAgB;AAAA;AAClB,KACD,CAAA;AAAA,EACH,CAAA;AACF;AAEA,eAAe,gBACb,UAAA,EACA,CAAA,EACA,IAAA,EACA,YAAA,EACA,WACA,UAAA,EACe;AACf,EAAA,IAAI,MAAA,GAAS,aAAa,QAAA,IAAY,CAAA;AACtC,EAAA,IAAI,aAAA,GAAgB,YAAY,GAAA,EAAI;AACpC,EAAA,IAAI,aAAA,GAAgB,YAAY,GAAA,EAAI;AACpC,EAAA,OAAO,CAAC,WAAU,EAAG;AACnB,IAAA,MAAM,aAAA,GAAgB,MAAM,kBAAA,CAAmB,CAAA,EAAG,IAAI,CAAA;AACtD,IAAA,IAAI,kBAAkB,MAAA,EAAW;AAEjC,IAAA,MAAM,IAAA,GAAO,MAAM,aAAA,CAAc,MAAA,CAAO,KAAA,CAAM,IAAA,CAAK,EAAE,GAAG,YAAA,EAAc,QAAA,EAAU,MAAA,EAAQ,CAAA;AACxF,IAAA,KAAA,MAAW,IAAA,IAAQ,KAAK,KAAA,EAAO;AAC7B,MAAA,OAAA,CAAQ,UAAA,EAAY,CAAA;AAAA,IAAA,EAAqB,KAAK,QAAQ;AAAA,MAAA,EAAW,IAAA,CAAK,SAAA,CAAU,IAAI,CAAC;;AAAA,CAAM,CAAA;AAC3F,MAAA,MAAA,GAAS,IAAA,CAAK,QAAA;AAAA,IAChB;AACA,IAAA,IAAI,KAAK,OAAA,EAAS;AAElB,IAAA,MAAM,GAAA,GAAM,YAAY,GAAA,EAAI;AAC5B,IAAA,IAAI,GAAA,GAAM,aAAA,IAAiB,IAAA,CAAK,wBAAA,EAA0B;AACxD,MAAA,OAAA,CAAQ,UAAA,EAAY,CAAA;AAAA,MAAA,EAA2B,KAAK,SAAA,CAAU,EAAE,KAAA,EAAO,CAAA,EAAG,CAAC;;AAAA,CAAM,CAAA;AACjF,MAAA,aAAA,GAAgB,GAAA;AAAA,IAClB;AACA,IAAA,IAAI,GAAA,GAAM,aAAA,IAAiB,IAAA,CAAK,mBAAA,EAAqB;AACnD,MAAA,OAAA,CAAQ,YAAY,iBAAiB,CAAA;AACrC,MAAA,aAAA,GAAgB,GAAA;AAAA,IAClB;AACA,IAAA,MAAM,cAAA,CAAe,IAAA,CAAK,eAAA,EAAiB,UAAU,CAAA;AAAA,EACvD;AACF;AAEA,SAAS,OAAA,CAAQ,YAAyD,KAAA,EAAqB;AAC7F,EAAA,IAAI;AACF,IAAA,UAAA,CAAW,QAAQ,IAAI,WAAA,EAAY,CAAE,MAAA,CAAO,KAAK,CAAC,CAAA;AAAA,EACpD,CAAA,CAAA,MAAQ;AAAA,EAER;AACF;AAEA,SAAS,gBAAgB,UAAA,EAA+D;AACtF,EAAA,IAAI;AACF,IAAA,UAAA,CAAW,KAAA,EAAM;AAAA,EACnB,CAAA,CAAA,MAAQ;AAAA,EAER;AACF;AAEA,eAAe,cAAA,CAAe,IAAY,MAAA,EAAoC;AAC5E,EAAA,IAAI,OAAO,OAAA,EAAS;AACpB,EAAA,MAAM,IAAI,OAAA,CAAc,CAAC,OAAA,KAAY;AACnC,IAAA,IAAI,KAAA;AACJ,IAAA,MAAM,SAAS,MAAM;AACnB,MAAA,IAAI,KAAA,KAAU,MAAA,EAAW,YAAA,CAAa,KAAK,CAAA;AAC3C,MAAA,MAAA,CAAO,mBAAA,CAAoB,SAAS,MAAM,CAAA;AAC1C,MAAA,OAAA,EAAQ;AAAA,IACV,CAAA;AACA,IAAA,KAAA,GAAQ,UAAA,CAAW,QAAQ,EAAE,CAAA;AAC7B,IAAA,MAAA,CAAO,iBAAiB,OAAA,EAAS,MAAA,EAAQ,EAAE,IAAA,EAAM,MAAM,CAAA;AACvD,IAAA,IAAI,MAAA,CAAO,SAAS,MAAA,EAAO;AAAA,EAC7B,CAAC,CAAA;AACH;AAEA,SAAS,YAAA,CAAa,GAAY,MAAA,EAA2B;AAC3D,EAAA,IAAIG,mBAAAA,CAA+B,MAAM,CAAA,EAAG;AAC1C,IAAA,MAAM,MAAA,GAAS,OAAO,OAAA,CAAQ,QAAA;AAC9B,IAAA,OAAO,CAAA,CAAE,IAAA;AAAA,MACP;AAAA,QACE,OAAO,MAAA,CAAO,IAAA;AAAA,QACd,SAAS,MAAA,CAAO,OAAA;AAAA,QAChB,YAAY,MAAA,CAAO,UAAA;AAAA,QACnB,GAAI,MAAA,KAAW,MAAA,GAAY,EAAC,GAAI,EAAE,MAAA,EAAQ,EAAE,GAAG,MAAA,EAAQ,UAAA,EAAY,MAAA,CAAO,YAAW;AAAE,OACzF;AAAA,MACA;AAAA,KACF;AAAA,EACF;AACA,EAAA,IAAIC,WAAAA,CAAY,MAAA,EAAQ,sBAAsB,CAAA,EAAG,OAAO,CAAA,CAAE,IAAA,CAAK,EAAE,KAAA,EAAO,MAAA,CAAO,IAAA,EAAK,EAAG,GAAG,CAAA;AAC1F,EAAA,IAAIA,WAAAA,CAAY,MAAA,EAAQ,gBAAgB,CAAA,EAAG,OAAO,CAAA,CAAE,IAAA,CAAK,EAAE,KAAA,EAAO,MAAA,CAAO,IAAA,EAAK,EAAG,GAAG,CAAA;AACpF,EAAA,MAAM,MAAA;AACR;ACvQA,IAAM,kBAAA,GAAqBJ,EAAE,MAAA,CAAO;AAAA,EAClC,KAAA,EAAOA,CAAAA,CAAE,IAAA,CAAK,eAAe,CAAA;AAAA,EAC7B,MAAA,EAAQA,CAAAA,CAAE,MAAA,EAAO,CAAE,QAAA,EAAS;AAAA,EAC5B,kBAAA,EAAoB,yBAAyB,QAAA;AAC/C,CAAC,CAAA;AAEM,SAAS,uBAAuB,IAAA,EAAyB;AAC9D,EAAA,OAAO,OAAO,CAAA,KAAkC;AAC9C,IAAA,MAAM,aAAA,GAAgB,MAAM,kBAAA,CAAmB,CAAA,EAAG,IAAI,CAAA;AACtD,IAAA,IAAI,aAAA,KAAkB,QAAW,OAAO,CAAA,CAAE,KAAK,EAAE,KAAA,EAAO,cAAA,EAAe,EAAG,GAAG,CAAA;AAC7E,IAAA,MAAM,SAAS,kBAAA,CAAmB,SAAA,CAAU,MAAM,YAAA,CAAa,CAAC,CAAC,CAAA;AACjE,IAAA,IAAI,CAAC,MAAA,CAAO,OAAA,EAAS,OAAO,CAAA,CAAE,KAAK,EAAE,KAAA,EAAO,uBAAA,EAAwB,EAAG,GAAG,CAAA;AAC1E,IAAA,IACE,MAAA,CAAO,IAAA,CAAK,MAAA,KAAW,MAAA,IACvB,IAAI,WAAA,EAAY,CAAE,MAAA,CAAO,MAAA,CAAO,IAAA,CAAK,MAAM,CAAA,CAAE,MAAA,GAAS,KAAK,cAAA,EAC3D;AACA,MAAA,OAAO,EAAE,IAAA,CAAK,EAAE,KAAA,EAAO,2BAAA,IAA+B,GAAG,CAAA;AAAA,IAC3D;AACA,IAAA,IAAI;AACF,MAAA,OAAO,CAAA,CAAE,IAAA;AAAA,QACP,MAAM,aAAA,CAAc,MAAA,CAAO,QAAA,CAAS,OAAA,CAAQ;AAAA,UAC1C,QAAA,EAAU,cAAc,MAAA,CAAO,QAAA;AAAA,UAC/B,KAAA,EAAO,OAAO,IAAA,CAAK,KAAA;AAAA,UACnB,GAAI,MAAA,CAAO,IAAA,CAAK,MAAA,KAAW,KAAA,CAAA,GAAY,EAAC,GAAI,EAAE,MAAA,EAAQ,MAAA,CAAO,IAAA,CAAK,MAAA,EAAO;AAAA,UACzE,GAAI,MAAA,CAAO,IAAA,CAAK,kBAAA,KAAuB,KAAA,CAAA,GACnC,EAAC,GACD,EAAE,kBAAA,EAAoB,MAAA,CAAO,IAAA,CAAK,kBAAA,EAAmB;AAAA,UACzD,OAAO,IAAA,CAAK,KAAA;AAAA,UACZ,mBAAmB,IAAA,CAAK;AAAA,SACzB,CAAA;AAAA,QACD;AAAA,OACF;AAAA,IACF,SAAS,MAAA,EAAQ;AACf,MAAA,IAAII,WAAAA,CAAY,MAAA,EAAQ,mBAAmB,CAAA,EAAG;AAC5C,QAAA,OAAO,EAAE,IAAA,CAAK,EAAE,OAAO,MAAA,CAAO,IAAA,IAAQ,GAAG,CAAA;AAAA,MAC3C;AACA,MAAA,MAAM,MAAA;AAAA,IACR;AAAA,EACF,CAAA;AACF;AAEO,SAAS,sBAAsB,IAAA,EAAyB;AAC7D,EAAA,OAAO,OAAO,CAAA,KAAkC;AAC9C,IAAA,MAAM,aAAA,GAAgB,MAAM,kBAAA,CAAmB,CAAA,EAAG,IAAI,CAAA;AACtD,IAAA,IAAI,aAAA,KAAkB,QAAW,OAAO,CAAA,CAAE,KAAK,EAAE,KAAA,EAAO,cAAA,EAAe,EAAG,GAAG,CAAA;AAC7E,IAAA,MAAM,SAAS,2BAAA,CAA4B,SAAA,CAAU,MAAM,YAAA,CAAa,CAAC,CAAC,CAAA;AAC1E,IAAA,IAAI,CAAC,MAAA,CAAO,OAAA,EAAS,OAAO,CAAA,CAAE,KAAK,EAAE,KAAA,EAAO,uBAAA,EAAwB,EAAG,GAAG,CAAA;AAC1E,IAAA,IAAI;AACF,MAAA,OAAO,CAAA,CAAE,IAAA;AAAA,QACP,MAAM,qBAAqB,aAAA,CAAc,MAAA,CAAO,UAAU,MAAA,CAAO,IAAA,EAAM,KAAK,MAAM,CAAA;AAAA,QAClF;AAAA,OACF;AAAA,IACF,SAAS,MAAA,EAAQ;AACf,MAAA,IAAI,YAAA,CAAa,MAAA,EAAQ,0BAA0B,CAAA,EAAG;AACpD,QAAA,OAAO,EAAE,IAAA,CAAK,EAAE,OAAO,MAAA,CAAO,IAAA,IAAQ,GAAG,CAAA;AAAA,MAC3C;AACA,MAAA,IAAI,YAAA,CAAa,MAAA,EAAQ,4BAA4B,CAAA,EAAG;AACtD,QAAA,OAAO,EAAE,IAAA,CAAK,EAAE,OAAO,MAAA,CAAO,IAAA,IAAQ,GAAG,CAAA;AAAA,MAC3C;AACA,MAAA,MAAM,MAAA;AAAA,IACR;AAAA,EACF,CAAA;AACF;ACvDO,IAAM,6BAAA,GAAgC;AAQtC,SAAS,qBAAqB,IAAA,EAA0B;AAC7D,EAAA,OAAO,OAAO,CAAA,KAAkC;AAC9C,IAAA,MAAM,MAAA,GAAS,MAAM,kBAAA,CAAmB,CAAA,CAAE,IAAI,MAAA,CAAO,eAAe,CAAA,EAAG,IAAA,CAAK,MAAM,CAAA;AAClF,IAAA,IAAI,MAAA,KAAW,MAAA,EAAW,OAAO,YAAA,CAAa,CAAC,CAAA;AAE/C,IAAA,MAAM,KAAA,GAAQ,MAAM,IAAA,CAAK,UAAA,CAAW,IAAA,CAAKC,eAAAA,CAAgB,MAAM,CAAA,EAAG,EAAE,KAAA,EAAO,IAAA,CAAK,SAAA,EAAW,CAAA;AAC3F,IAAA,OAAO,CAAA,CAAE,IAAA,CAAK,EAAE,KAAA,IAAS,GAAG,CAAA;AAAA,EAC9B,CAAA;AACF;AAEO,SAAS,qBAAqB,IAAA,EAA0B;AAC7D,EAAA,OAAO,OAAO,CAAA,KAAkC;AAC9C,IAAA,MAAM,MAAA,GAAS,MAAM,kBAAA,CAAmB,CAAA,CAAE,IAAI,MAAA,CAAO,eAAe,CAAA,EAAG,IAAA,CAAK,MAAM,CAAA;AAClF,IAAA,IAAI,MAAA,KAAW,MAAA,EAAW,OAAO,YAAA,CAAa,CAAC,CAAA;AAE/C,IAAA,MAAM,IAAA,GAAO,CAAA,CAAE,GAAA,CAAI,KAAA,CAAM,MAAM,CAAA;AAC/B,IAAA,MAAM,IAAA,GAAO,CAAA,CAAE,GAAA,CAAI,KAAA,CAAM,MAAM,CAAA;AAC/B,IAAA,IAAI,SAAS,MAAA,IAAa,IAAA,KAAS,MAAA,EAAW,OAAO,SAAS,CAAC,CAAA;AAO/D,IAAA,MAAM,IAAA,GAAO,MAAM,IAAA,CAAK,UAAA,CAAW,SAASA,eAAAA,CAAgB,MAAM,CAAA,EAAG,IAAA,EAAM,IAAI,CAAA;AAC/E,IAAA,IAAI,IAAA,KAAS,MAAA,EAAW,OAAO,QAAA,CAAS,CAAC,CAAA;AACzC,IAAA,OAAO,CAAA,CAAE,IAAA,CAAK,IAAA,EAAM,GAAG,CAAA;AAAA,EACzB,CAAA;AACF;AAEA,SAAS,aAAa,CAAA,EAAsB;AAC1C,EAAA,OAAO,EAAE,IAAA,CAAK,EAAE,KAAA,EAAO,cAAA,IAAkB,GAAG,CAAA;AAC9C;AAEA,SAAS,SAAS,CAAA,EAAsB;AACtC,EAAA,OAAO,EAAE,IAAA,CAAK,EAAE,KAAA,EAAO,sBAAA,IAA0B,GAAG,CAAA;AACtD;AC1DO,IAAM,kCAAA,GAAqC;AAC3C,IAAM,iCAAiC,CAAA,GAAI;AAC3C,IAAM,uCAAuC,CAAA,GAAI;AACjD,IAAM,mCAAmC,EAAA,GAAK;AA8BrD,SAAS,UAAA,CAAW,OAAe,OAAA,EAA0B;AAC3D,EAAA,OAAO,OAAO,aAAA,CAAc,KAAK,CAAA,IAAK,KAAA,IAAS,KAAK,KAAA,IAAS,OAAA;AAC/D;AAEA,SAAS,aAAa,KAAA,EAAmC;AACvD,EAAA,MAAM,MAAA,GAAS,IAAA,CAAK,KAAA,CAAM,KAAK,CAAA;AAC/B,EAAA,OAAO,MAAA,CAAO,QAAA,CAAS,MAAM,CAAA,GAAI,MAAA,GAAS,MAAA;AAC5C;AAEA,SAAS,kBAAA,CACP,QAAA,EACA,GAAA,EACA,WAAA,EACA,aAAA,EACS;AACT,EAAA,MAAM,QAAA,GAAW,YAAA,CAAa,QAAA,CAAS,SAAA,CAAU,QAAQ,CAAA;AACzD,EAAA,IAAI,QAAA,KAAa,QAAW,OAAO,KAAA;AACnC,EAAA,IAAI,WAAW,GAAA,GAAM,WAAA,IAAe,QAAA,GAAW,GAAA,GAAM,aAAa,OAAO,KAAA;AAEzE,EAAA,MAAM,MAAA,GAAS,SAAS,SAAA,CAAU,SAAA;AAClC,EAAA,IAAI,MAAA,KAAW,QAAW,OAAO,IAAA;AACjC,EAAA,MAAM,SAAA,GAAY,aAAa,MAAM,CAAA;AACrC,EAAA,IAAI,SAAA,KAAc,MAAA,IAAa,SAAA,GAAY,QAAA,EAAU,OAAO,KAAA;AAC5D,EAAA,IAAI,SAAA,GAAY,QAAA,GAAW,aAAA,EAAe,OAAO,KAAA;AACjD,EAAA,OAAO,OAAO,SAAA,GAAY,WAAA;AAC5B;AAOA,eAAsB,uBAAA,CACpB,KAAA,EACA,OAAA,EACA,IAAA,EAC+C;AAC/C,EAAA,MAAM,WAAA,GAAc,KAAK,WAAA,IAAe,kCAAA;AACxC,EAAA,MAAM,aAAA,GAAgB,KAAK,aAAA,IAAiB,oCAAA;AAC5C,EAAA,IAAI,CAAC,UAAA,CAAW,WAAA,EAAa,8BAA8B,GAAG,OAAO,MAAA;AACrE,EAAA,IAAI,CAAC,UAAA,CAAW,aAAA,EAAe,gCAAgC,GAAG,OAAO,MAAA;AAEzE,EAAA,IAAI,QAAA;AACJ,EAAA,IAAI;AACF,IAAA,QAAA,GAAW,yBAAyB,KAAK,CAAA;AAAA,EAC3C,CAAA,CAAA,MAAQ;AACN,IAAA,OAAO,MAAA;AAAA,EACT;AACA,EAAA,MAAM,SAAS,QAAA,CAAS,SAAA;AAExB,EAAA,IAAI,OAAO,SAAA,KAAc,OAAA,CAAQ,aAAa,MAAA,CAAO,QAAA,KAAa,QAAQ,QAAA,EAAU;AAClF,IAAA,OAAO,MAAA;AAAA,EACT;AACA,EAAA,IAAI,MAAA,CAAO,WAAA,KAAgB,MAAA,EAAW,OAAO,MAAA;AAC7C,EAAA,IAAI,MAAA,CAAO,WAAW,OAAA,CAAQ,MAAA,IAAU,OAAO,IAAA,KAAS,OAAA,CAAQ,MAAM,OAAO,MAAA;AAC7E,EAAA,IAAI,MAAA,CAAO,QAAA,KAAa,OAAA,CAAQ,IAAA,CAAK,YAAY,OAAO,MAAA;AACxD,EAAA,IAAK,MAAM,KAAK,MAAA,CAAO,MAAA,CAAO,QAAQ,IAAI,CAAA,KAAO,MAAA,CAAO,UAAA,EAAY,OAAO,MAAA;AAE3E,EAAA,IAAI,CAACC,UAAAA,CAAW,MAAA,CAAO,QAAQ,GAAG,OAAO,MAAA;AACzC,EAAA,MAAM,GAAA,GAAM,MAAM,IAAA,CAAK,OAAA,CAAQ,GAAA,CAAIP,SAAS,MAAA,CAAO,QAAQ,CAAA,EAAG,MAAA,CAAO,QAAQ,CAAA;AAC7E,EAAA,IAAI,GAAA,KAAQ,MAAA,IAAa,GAAA,CAAI,OAAA,EAAS,OAAO,MAAA;AAC7C,EAAA,IAAI,GAAA,CAAI,SAAA,KAAc,MAAA,CAAO,SAAA,EAAW,OAAO,MAAA;AAC/C,EAAA,IAAI,IAAI,UAAA,KAAe,MAAA,CAAO,SAAS,GAAA,CAAI,aAAA,KAAkB,OAAO,QAAA,EAAU;AAC5E,IAAA,OAAO,MAAA;AAAA,EACT;AAEA,EAAA,IAAI,CAAC,kBAAA,CAAmB,QAAA,EAAU,IAAA,CAAK,KAAA,CAAM,GAAA,EAAI,CAAE,OAAA,EAAQ,EAAG,WAAA,EAAa,aAAa,CAAA,EAAG;AACzF,IAAA,OAAO,MAAA;AAAA,EACT;AACA,EAAA,MAAM,QAAA,GAAW,MAAM,IAAA,CAAK,MAAA,CAAO,aAAA;AAAA,IACjC,GAAA,CAAI,eAAA;AAAA,IACJ,wBAAwB,MAAM,CAAA;AAAA,IAC9B,QAAA,CAAS;AAAA,GACX;AACA,EAAA,IAAI,CAAC,UAAU,OAAO,MAAA;AAEtB,EAAA,OAAO;AAAA,IACL,MAAA,EAAQ;AAAA,MACN,IAAA,EAAM,QAAA;AAAA,MACN,UAAU,GAAA,CAAI,QAAA;AAAA,MACd,WAAW,GAAA,CAAI,SAAA;AAAA,MACf,UAAU,GAAA,CAAI;AAAA,KAChB;AAAA,IACA,WAAW,MAAA,CAAO,SAAA;AAAA,IAClB,WAAW,MAAA,CAAO,SAAA;AAAA,IAClB,UAAU,MAAA,CAAO,QAAA;AAAA,IACjB,YAAY,MAAA,CAAO,UAAA;AAAA,IACnB,QAAA,EAAU,MAAA,CAAO,MAAA,CAAO,QAAQ,CAAA;AAAA,IAChC,OAAO,GAAA,CAAI,UAAA;AAAA,IACX,UAAU,GAAA,CAAI;AAAA,GAChB;AACF;AC5HO,IAAM,uBAAA,GAA0B;AAChC,IAAM,yBAAA,GAA4B;AAClC,IAAM,2BAAA,GAA8B;AACpC,IAAM,2BAAA,GAA8B;AACpC,IAAM,sBAAA,GAAyB;AAC/B,IAAM,uBAAA,GAA0B;AAChC,IAAM,wBAAA,GAA2B;AAExC,IAAM,oBAAA,GAAuB,uBAAA;AAC7B,IAAM,kBAAA,GAAqB,+BAAA;AAEpB,IAAM,uBAAuBC,CAAAA,CACjC,MAAA,GACA,GAAA,CAAI,CAAC,EACL,GAAA,CAAI,2BAA2B,EAC/B,KAAA,CAAM,kBAAkB,EACxB,MAAA,CAAO,CAAC,UAAU,KAAA,KAAU,GAAA,IAAO,UAAU,IAAI;AAE7C,IAAM,oBAAA,GAAuBA,CAAAA,CAAE,kBAAA,CAAmB,MAAA,EAAQ;AAAA,EAC/DA,EAAE,YAAA,CAAa;AAAA,IACb,IAAA,EAAMA,CAAAA,CAAE,OAAA,CAAQ,QAAQ,CAAA;AAAA,IACxB,OAAA,EAASA,EAAE,MAAA,EAAO;AAAA,IAClB,WAAA,EAAaA,CAAAA,CAAE,MAAA,EAAO,CAAE,MAAM,oBAAoB;AAAA,GACnD,CAAA;AAAA,EACDA,EAAE,YAAA,CAAa;AAAA,IACb,IAAA,EAAMA,CAAAA,CAAE,OAAA,CAAQ,QAAQ,CAAA;AAAA,IACxB,WAAA,EAAaA,CAAAA,CAAE,MAAA,EAAO,CAAE,MAAM,oBAAoB,CAAA;AAAA,IAClD,QAAA,EAAUA,EAAE,MAAA,EAAO,CAAE,KAAI,CAAE,WAAA,GAAc,IAAA;AAAK,GAC/C;AACH,CAAC;AAED,IAAM,uBAAA,GAA0BA,EAAE,YAAA,CAAa;AAAA,EAC7C,MAAMA,CAAAA,CAAE,IAAA,CAAK,CAAC,SAAA,EAAW,QAAQ,CAAC,CAAA;AAAA,EAClC,SAAA,EAAW,oBAAA;AAAA,EACX,WAAA,EAAaA,EAAE,MAAA,EAAO,CAAE,KAAI,CAAE,WAAA,GAAc,IAAA,EAAK;AAAA,EACjD,IAAA,EAAM,oBAAA;AAAA,EACN,OAAOA,CAAAA,CAAE,MAAA,GAAS,GAAA,CAAI,sBAAsB,EAAE,QAAA;AAChD,CAAC,CAAA;AAEM,IAAM,uBAAA,GAA0BA,EAAE,YAAA,CAAa;AAAA,EACpD,WAAA,EAAaA,CAAAA,CAAE,MAAA,EAAO,CAAE,GAAA,GAAM,WAAA,EAAY,CAAE,IAAA,EAAK,CAAE,QAAA,EAAS;AAAA,EAC5D,IAAA,EAAM,oBAAA;AAAA,EACN,OAAOA,CAAAA,CAAE,MAAA,GAAS,GAAA,CAAI,sBAAsB,EAAE,QAAA,EAAS;AAAA,EACvD,SAAA,EAAWA,EAAE,KAAA,CAAM,uBAAuB,EAAE,GAAA,CAAI,uBAAA,GAA0B,CAAC,CAAA,CAAE,QAAA;AAC/E,CAAC;AA4CM,IAAM,yBAAA,GAA4BA,EAAE,YAAA,CAAa;AAAA,EACtD,MAAMA,CAAAA,CAAE,IAAA,CAAK,CAAC,eAAA,EAAiB,SAAA,EAAW,QAAQ,CAAC,CAAA;AAAA,EACnD,SAAA,EAAW,oBAAA;AAAA,EACX,GAAA,EAAKA,EAAE,MAAA,EAAO,CAAE,KAAI,CAAE,QAAA,GAAW,IAAA,EAAK;AAAA,EACtC,WAAA,EAAaA,CAAAA,CAAE,MAAA,EAAO,CAAE,MAAM,oBAAoB,CAAA;AAAA,EAClD,QAAA,EAAUA,EAAE,MAAA,EAAO,CAAE,KAAI,CAAE,WAAA,GAAc,IAAA,EAAK;AAAA,EAC9C,OAAOA,CAAAA,CAAE,MAAA,GAAS,GAAA,CAAI,sBAAsB,EAAE,QAAA,EAAS;AAAA,EACvD,SAAA,EAAWA,EAAE,MAAA,EAAO,CAAE,SAAS,EAAE,MAAA,EAAQ,MAAM;AACjD,CAAC;AAOM,IAAM,yBAAA,GAA4BA,EAAE,YAAA,CAAa;AAAA,EACtD,OAAA,EAAS,yBAAA;AAAA,EACT,WAAWA,CAAAA,CAAE,KAAA,CAAM,yBAAyB,CAAA,CAAE,GAAA,CAAI,0BAA0B,CAAC;AAC/E,CAAC;AAwBM,SAAS,oBAAoB,MAAA,EAA0C;AAC5E,EAAA,MAAM,QAAA,GAAW,MAAA,CAAO,MAAA,CAAO,QAAQ,CAAA;AACvC,EAAA,IAAI,CAAC,OAAO,aAAA,CAAc,QAAQ,GAAG,MAAM,IAAI,MAAM,2CAA2C,CAAA;AAChG,EAAA,OAAO;AAAA,IACL,MAAM,MAAA,CAAO,IAAA;AAAA,IACb,WAAW,MAAA,CAAO,SAAA;AAAA,IAClB,KAAK,MAAA,CAAO,GAAA;AAAA,IACZ,aAAa,MAAA,CAAO,WAAA;AAAA,IACpB,QAAA;AAAA,IACA,GAAI,OAAO,KAAA,KAAU,MAAA,GAAY,EAAC,GAAI,EAAE,KAAA,EAAO,MAAA,CAAO,KAAA,EAAM;AAAA,IAC5D,WAAW,MAAA,CAAO;AAAA,GACpB;AACF;AAEO,SAAS,sBAAsB,KAAA,EAAgD;AACpF,EAAA,MAAM,QAAA,GAAW,MAAA,CAAO,KAAA,CAAM,QAAQ,CAAA;AACtC,EAAA,IAAI,CAAC,OAAO,aAAA,CAAc,QAAQ,GAAG,MAAM,IAAI,MAAM,6CAA6C,CAAA;AAClG,EAAA,OAAO;AAAA,IACL,MAAM,KAAA,CAAM,IAAA;AAAA,IACZ,WAAW,KAAA,CAAM,SAAA;AAAA,IACjB,KAAK,KAAA,CAAM,GAAA;AAAA,IACX,aAAa,KAAA,CAAM,WAAA;AAAA,IACnB,QAAA;AAAA,IACA,GAAI,MAAM,KAAA,KAAU,MAAA,GAAY,EAAC,GAAI,EAAE,KAAA,EAAO,KAAA,CAAM,KAAA,EAAM;AAAA,IAC1D,WAAW,KAAA,CAAM;AAAA,GACnB;AACF;;;ACjKO,IAAM,gBAAA,GAAN,cAA+B,KAAA,CAAM;AAAA,EACjC,IAAA;AAAA,EACA,OAAA;AAAA,EAET,WAAA,CAAY,IAAA,EAA4B,OAAA,EAAiB,OAAA,EAAmB;AAC1E,IAAA,KAAA,CAAM,OAAO,CAAA;AACb,IAAA,IAAA,CAAK,IAAA,GAAO,kBAAA;AACZ,IAAA,IAAA,CAAK,IAAA,GAAO,IAAA;AACZ,IAAA,IAAA,CAAK,OAAA,GAAU,OAAA;AAAA,EACjB;AACF;AAEO,SAAS,mBAAmB,KAAA,EAA2C;AAC5E,EAAA,OAAO,KAAA,YAAiB,gBAAA;AAC1B;;;ACcO,IAAM,+BAAA,GAAkC,IAAI,IAAA,GAAO;AACnD,IAAM,gCAAgC,EAAA,GAAK;AAElD,IAAM,UAAA,GAAa,IAAI,UAAA,EAAW;AAClC,IAAM,qBAAA,GAAwB,+BAAA;AAkBvB,SAAS,qBAAqB,IAAA,EAAsB;AACzD,EAAA,OAAO,OAAO,CAAA,KAAkC;AAC9C,IAAA,MAAM,aAAA,GAAgB,MAAM,wBAAA,CAAyB,CAAA,EAAG,IAAA,EAAM;AAAA,MAC5D,IAAA,EAAM,UAAA;AAAA,MACN,SAAA,EAAW,YAAA;AAAA,MACX,QAAA,EAAU;AAAA,KACX,CAAA;AACD,IAAA,IAAI,aAAA,KAAkB,MAAA,EAAW,OAAOO,aAAAA,CAAa,CAAC,CAAA;AAEtD,IAAA,MAAM,KAAA,GAAQ,cAAc,CAAC,CAAA;AAC7B,IAAA,IAAI,KAAA,KAAU,QAAW,OAAO,CAAA,CAAE,KAAK,EAAE,KAAA,EAAO,8BAAA,EAA+B,EAAG,GAAG,CAAA;AACrF,IAAA,MAAM,OAAA,GAAU,MAAM,IAAA,CAAK,KAAA,CAAM,aAAaF,eAAAA,CAAgB,aAAA,CAAc,MAAM,CAAA,EAAG,KAAK,CAAA;AAC1F,IAAA,OAAO,CAAA,CAAE,KAAK,EAAE,OAAA,EAAS,QAAQ,GAAA,CAAI,qBAAqB,CAAA,EAAE,EAAG,GAAG,CAAA;AAAA,EACpE,CAAA;AACF;AAEO,SAAS,gBAAgB,IAAA,EAAsB;AACpD,EAAA,OAAO,OAAO,CAAA,KAAkC;AAC9C,IAAA,MAAM,QAAA,GAAW,kBAAkB,CAAC,CAAA;AACpC,IAAA,MAAM,aAAA,GAAgB,MAAM,wBAAA,CAAyB,CAAA,EAAG,IAAA,EAAM;AAAA,MAC5D,IAAA,EAAM,UAAA;AAAA,MACN,SAAA,EAAW,YAAA;AAAA,MACX;AAAA,KACD,CAAA;AACD,IAAA,IAAI,aAAA,KAAkB,MAAA,EAAW,OAAOE,aAAAA,CAAa,CAAC,CAAA;AACtD,IAAA,MAAM,QAAA,GAAW,eAAe,CAAC,CAAA;AACjC,IAAA,IAAI,QAAA,KAAa,QAAW,OAAO,CAAA,CAAE,KAAK,EAAE,KAAA,EAAO,+BAAA,EAAgC,EAAG,GAAG,CAAA;AAEzF,IAAA,MAAM,MAAA,GAAS,MAAM,IAAA,CAAK,KAAA,CAAM,UAAUF,eAAAA,CAAgB,aAAA,CAAc,MAAM,CAAA,EAAG,QAAQ,CAAA;AACzF,IAAA,IAAI,MAAA,KAAW,QAAW,OAAO,CAAA,CAAE,KAAK,EAAE,KAAA,EAAO,wBAAA,EAAyB,EAAG,GAAG,CAAA;AAChF,IAAA,MAAM,QAAA,GAAW,oBAAoB,MAAM,CAAA;AAC3C,IAAA,IAAI,MAAA,CAAO,IAAA,CAAK,IAAA,KAAS,QAAA,EAAU;AACjC,MAAA,OAAO,CAAA,CAAE,IAAA,CAAK,EAAE,GAAG,UAAU,IAAA,EAAM,EAAE,IAAA,EAAM,QAAA,EAAU,SAAS,MAAA,CAAO,IAAA,CAAK,IAAA,EAAK,IAAK,GAAG,CAAA;AAAA,IACzF;AAEA,IAAA,MAAM,WAAA,GAAc,MAAM,IAAA,CAAK,eAAA,CAAgB,cAAA;AAAA,MAC7CA,eAAAA,CAAgB,cAAc,MAAM,CAAA;AAAA,MACpC,OAAO,IAAA,CAAK;AAAA,KACd;AACA,IAAA,IAAI,WAAA,KAAgB,QAAW,OAAO,CAAA,CAAE,KAAK,EAAE,KAAA,EAAO,kBAAA,EAAmB,EAAG,GAAG,CAAA;AAC/E,IAAA,OAAO,CAAA,CAAE,IAAA,CAAK,EAAE,GAAG,QAAA,EAAU,IAAA,EAAM,EAAE,IAAA,EAAM,QAAA,EAAU,WAAA,EAAY,EAAE,EAAG,GAAG,CAAA;AAAA,EAC3E,CAAA;AACF;AAEO,SAAS,gBAAgB,IAAA,EAAsB;AACpD,EAAA,OAAO,OAAO,CAAA,KAAkC;AAC9C,IAAA,MAAM,IAAA,GAAO,MAAM,eAAA,CAAgB,CAAA,EAAG,KAAK,eAAe,CAAA;AAC1D,IAAA,IAAI,IAAA,KAAS,aAAa,OAAO,CAAA,CAAE,KAAK,EAAE,KAAA,EAAO,8BAAA,EAA+B,EAAG,GAAG,CAAA;AACtF,IAAA,IAAI,IAAA,KAAS,QAAW,OAAO,CAAA,CAAE,KAAK,EAAE,KAAA,EAAO,4BAAA,EAA6B,EAAG,GAAG,CAAA;AAElF,IAAA,MAAM,aAAA,GAAgB,MAAM,wBAAA,CAAyB,CAAA,EAAG,IAAA,EAAM;AAAA,MAC5D,IAAA;AAAA,MACA,SAAA,EAAW,aAAA;AAAA,MACX,QAAA,EAAU,kBAAkB,CAAC;AAAA,KAC9B,CAAA;AACD,IAAA,IAAI,aAAA,KAAkB,MAAA,EAAW,OAAOE,aAAAA,CAAa,CAAC,CAAA;AACtD,IAAA,MAAM,QAAA,GAAW,eAAe,CAAC,CAAA;AACjC,IAAA,IAAI,QAAA,KAAa,QAAW,OAAO,CAAA,CAAE,KAAK,EAAE,KAAA,EAAO,+BAAA,EAAgC,EAAG,GAAG,CAAA;AAEzF,IAAA,MAAM,UAAA,GAAa,eAAe,IAAI,CAAA;AACtC,IAAA,MAAM,MAAA,GAAS,uBAAA,CAAwB,SAAA,CAAU,UAAU,CAAA;AAC3D,IAAA,IAAI,CAAC,MAAA,CAAO,OAAA,EAAS,OAAO,CAAA,CAAE,KAAK,EAAE,KAAA,EAAO,6BAAA,EAA8B,EAAG,GAAG,CAAA;AAChF,IAAA,MAAM,SAAS,aAAA,CAAc,QAAA,CAAS,MAAM,QAAA,CAAS,SAAA,EAAW,OAAO,IAAI,CAAA;AAC3E,IAAA,IAAI,MAAA,KAAW,QAAW,OAAO,CAAA,CAAE,KAAK,EAAE,KAAA,EAAO,2BAAA,EAA4B,EAAG,GAAG,CAAA;AAEnF,IAAA,MAAM,KAAA,GAA0B;AAAA,MAC9B,QAAA,EAAU,cAAc,MAAA,CAAO,QAAA;AAAA,MAC/B,WAAW,aAAA,CAAc,SAAA;AAAA,MACzB,WAAW,aAAA,CAAc,SAAA;AAAA,MACzB,UAAU,aAAA,CAAc,QAAA;AAAA,MACxB,iBAAiB,aAAA,CAAc,UAAA;AAAA,MAC/B,eAAe,aAAA,CAAc,QAAA;AAAA,MAC7B;AAAA,KACF;AACA,IAAA,IAAI;AACF,MAAA,MAAM,MAAA,GAAS,MAAM,IAAA,CAAK,KAAA,CAAM,OAAOF,eAAAA,CAAgB,aAAA,CAAc,MAAM,CAAA,EAAG,KAAK,CAAA;AACnF,MAAA,OAAO,CAAA,CAAE,IAAA,CAAK,MAAA,CAAO,QAAA,EAAU,GAAA,EAAK,EAAE,iBAAA,EAAmB,MAAA,CAAO,QAAA,GAAW,MAAA,GAAS,OAAA,EAAS,CAAA;AAAA,IAC/F,SAAS,MAAA,EAAQ;AACf,MAAA,OAAO,YAAA,CAAa,GAAG,MAAM,CAAA;AAAA,IAC/B;AAAA,EACF,CAAA;AACF;AAEA,SAAS,eACP,CAAA,EAC4E;AAC5E,EAAA,MAAM,IAAA,GAAO,CAAA,CAAE,GAAA,CAAI,KAAA,CAAM,MAAM,CAAA;AAC/B,EAAA,MAAM,SAAA,GAAY,CAAA,CAAE,GAAA,CAAI,KAAA,CAAM,KAAK,CAAA;AACnC,EAAA,IAAI,CAAC,kBAAA,CAAmB,QAAA,CAAS,IAAuB,GAAG,OAAO,MAAA;AAClE,EAAA,MAAM,SAAA,GAAY,oBAAA,CAAqB,SAAA,CAAU,SAAS,CAAA;AAC1D,EAAA,IAAI,CAAC,SAAA,CAAU,OAAA,EAAS,OAAO,MAAA;AAC/B,EAAA,OAAO,EAAE,IAAA,EAA+B,SAAA,EAAW,SAAA,CAAU,IAAA,EAAK;AACpE;AAEA,SAAS,kBAAkB,CAAA,EAAoB;AAC7C,EAAA,OAAO,CAAA,EAAG,CAAA,CAAE,GAAA,CAAI,KAAA,CAAM,MAAM,CAAA,IAAK,EAAE,CAAA,CAAA,EAAI,CAAA,CAAE,GAAA,CAAI,KAAA,CAAM,KAAK,KAAK,EAAE,CAAA,CAAA;AACjE;AAEA,SAAS,cAAc,CAAA,EAA4C;AACjE,EAAA,MAAM,GAAA,GAAM,IAAI,GAAA,CAAI,CAAA,CAAE,IAAI,GAAG,CAAA;AAC7B,EAAA,KAAA,MAAW,GAAA,IAAO,GAAA,CAAI,YAAA,CAAa,IAAA,EAAK,EAAG;AACzC,IAAA,IACG,GAAA,KAAQ,MAAA,IAAU,GAAA,KAAQ,QAAA,IAAY,GAAA,KAAQ,OAAA,IAC/C,GAAA,CAAI,YAAA,CAAa,MAAA,CAAO,GAAG,CAAA,CAAE,MAAA,KAAW,CAAA,EACxC;AACA,MAAA,OAAO,MAAA;AAAA,IACT;AAAA,EACF;AACA,EAAA,MAAM,IAAA,GAAO,GAAA,CAAI,YAAA,CAAa,GAAA,CAAI,MAAM,CAAA,IAAK,MAAA;AAC7C,EAAA,IAAI,SAAS,MAAA,IAAa,CAAC,mBAAmB,QAAA,CAAS,IAAuB,GAAG,OAAO,MAAA;AACxF,EAAA,MAAM,SAAA,GAAY,GAAA,CAAI,YAAA,CAAa,GAAA,CAAI,QAAQ,CAAA,IAAK,MAAA;AACpD,EAAA,IACE,SAAA,KAAc,MAAA,KACb,SAAA,CAAU,MAAA,KAAW,CAAA,IAAK,SAAA,CAAU,MAAA,GAAS,GAAA,IAAO,CAAC,qBAAA,CAAsB,IAAA,CAAK,SAAS,CAAA,CAAA,EAC1F;AACA,IAAA,OAAO,MAAA;AAAA,EACT;AACA,EAAA,MAAM,QAAA,GAAW,GAAA,CAAI,YAAA,CAAa,GAAA,CAAI,OAAO,CAAA,IAAK,MAAA;AAClD,EAAA,MAAM,KAAA,GAAQ,QAAA,KAAa,MAAA,GAAY,wBAAA,GAA2B,OAAO,QAAQ,CAAA;AACjF,EAAA,IAAI,CAAC,OAAO,aAAA,CAAc,KAAK,KAAK,KAAA,GAAQ,CAAA,IAAK,KAAA,GAAQ,wBAAA,EAA0B,OAAO,MAAA;AAC1F,EAAA,OAAO;AAAA,IACL,GAAI,IAAA,KAAS,MAAA,GAAY,EAAC,GAAI,EAAE,IAAA,EAA8B;AAAA,IAC9D,GAAI,SAAA,KAAc,MAAA,GAAY,EAAC,GAAI,EAAE,SAAA,EAAU;AAAA,IAC/C;AAAA,GACF;AACF;AAEA,SAAS,aAAA,CACP,IAAA,EACA,SAAA,EACA,OAAA,EACoE;AACpE,EAAA,IAAI,SAAS,eAAA,EAAiB;AAC5B,IAAA,IAAI,OAAA,CAAQ,WAAA,KAAgB,MAAA,EAAW,OAAO,MAAA;AAAA,EAChD,WAAW,OAAA,CAAQ,WAAA,KAAgB,MAAA,IAAa,OAAA,CAAQ,cAAc,MAAA,EAAW;AAC/E,IAAA,OAAO,MAAA;AAAA,EACT;AAEA,EAAA,MAAM,OAAA,GAAU,aAAa,IAAA,EAAM,SAAA,EAAW,QAAQ,IAAA,EAAM,OAAA,CAAQ,WAAA,EAAa,OAAA,CAAQ,KAAK,CAAA;AAC9F,EAAA,MAAM,SAAA,GAAA,CAAa,OAAA,CAAQ,SAAA,IAAa,EAAC,EAAG,GAAA;AAAA,IAAI,CAAC,QAAA,KAC/C,YAAA;AAAA,MACE,QAAA,CAAS,IAAA;AAAA,MACT,QAAA,CAAS,SAAA;AAAA,MACT,QAAA,CAAS,IAAA;AAAA,MACT,QAAA,CAAS,WAAA;AAAA,MACT,QAAA,CAAS;AAAA;AACX,GACF;AACA,EAAA,OAAO,CAAC,OAAA,EAAS,GAAG,SAAS,CAAA;AAC/B;AAEA,SAAS,YAAA,CACP,IAAA,EACA,SAAA,EACA,KAAA,EACA,aACA,KAAA,EACoB;AACpB,EAAA,MAAM,IAAA,GAAOG,WAAAA,CAAY,KAAA,CAAM,WAAW,CAAA;AAC1C,EAAA,MAAM,IAAA,GACJ,KAAA,CAAM,IAAA,KAAS,QAAA,GACV,EAAE,IAAA,EAAM,QAAA,EAAU,IAAA,EAAM,KAAA,CAAM,OAAA,EAAQ,GACtC,EAAE,IAAA,EAAM,UAAU,IAAA,EAAK;AAC9B,EAAA,MAAM,WACJ,KAAA,CAAM,IAAA,KAAS,QAAA,GACX,MAAA,CAAO,IAAI,WAAA,EAAY,CAAE,MAAA,CAAO,KAAA,CAAM,OAAO,CAAA,CAAE,UAAU,CAAA,GACzD,MAAA,CAAO,MAAM,QAAQ,CAAA;AAC3B,EAAA,IAAI,SAAS,eAAA,EAAiB;AAC5B,IAAA,OAAO,EAAE,IAAA,EAAM,SAAA,EAAW,WAAA,EAAa,MAAM,QAAA,EAAU,IAAA,EAAM,GAAI,KAAA,KAAU,MAAA,GAAY,EAAC,GAAI,EAAE,OAAM,EAAG;AAAA,EACzG;AACA,EAAA,IAAI,WAAA,KAAgB,MAAA,EAAW,MAAM,IAAI,MAAM,wCAAwC,CAAA;AACvF,EAAA,OAAO;AAAA,IACL,IAAA;AAAA,IACA,SAAA;AAAA,IACA,WAAA;AAAA,IACA,WAAA,EAAa,IAAA;AAAA,IACb,QAAA;AAAA,IACA,IAAA;AAAA,IACA,GAAI,KAAA,KAAU,MAAA,GAAY,EAAC,GAAI,EAAE,KAAA;AAAM,GACzC;AACF;AAEA,eAAe,wBAAA,CACb,CAAA,EACA,IAAA,EACA,OAAA,EACmC;AACnC,EAAA,MAAM,QAAQ,iBAAA,CAAkB,CAAA,CAAE,GAAA,CAAI,MAAA,CAAO,mBAAmB,CAAC,CAAA;AACjE,EAAA,IAAI,KAAA,KAAU,QAAW,OAAO,MAAA;AAChC,EAAA,MAAM,GAAA,GAAM,IAAI,GAAA,CAAI,CAAA,CAAE,IAAI,GAAG,CAAA;AAC7B,EAAA,OAAO,uBAAA;AAAA,IACL,KAAA;AAAA,IACA;AAAA,MACE,MAAA,EAAQ,EAAE,GAAA,CAAI,MAAA;AAAA,MACd,MAAM,CAAA,EAAG,GAAA,CAAI,QAAQ,CAAA,EAAG,IAAI,MAAM,CAAA,CAAA;AAAA,MAClC,WAAW,OAAA,CAAQ,SAAA;AAAA,MACnB,UAAU,OAAA,CAAQ,QAAA;AAAA,MAClB,MAAM,OAAA,CAAQ;AAAA,KAChB;AAAA,IACA,IAAA,CAAK;AAAA,GACP;AACF;AAEA,SAAS,kBAAkB,KAAA,EAAgD;AACzE,EAAA,IAAI,UAAU,MAAA,IAAa,KAAA,CAAM,WAAW,CAAA,IAAK,KAAA,CAAM,SAAS,6BAAA,EAA+B;AAC7F,IAAA,OAAO,MAAA;AAAA,EACT;AACA,EAAA,IAAI,CAAC,mBAAmB,IAAA,CAAK,KAAK,KAAK,KAAA,CAAM,MAAA,GAAS,CAAA,KAAM,CAAA,EAAG,OAAO,MAAA;AACtE,EAAA,IAAI;AACF,IAAA,MAAM,SAAS,KAAA,CAAM,OAAA,CAAQ,IAAA,EAAM,GAAG,EAAE,OAAA,CAAQ,IAAA,EAAM,GAAG,CAAA,GAAI,IAAI,MAAA,CAAA,CAAQ,CAAA,GAAK,KAAA,CAAM,MAAA,GAAS,KAAM,CAAC,CAAA;AACpG,IAAA,MAAM,MAAA,GAAS,KAAK,MAAM,CAAA;AAC1B,IAAA,MAAM,KAAA,GAAQ,WAAW,IAAA,CAAK,MAAA,EAAQ,CAAC,SAAA,KAAc,SAAA,CAAU,UAAA,CAAW,CAAC,CAAC,CAAA;AAC5E,IAAA,OAAO,IAAA,CAAK,KAAA,CAAM,IAAI,WAAA,CAAY,OAAA,EAAS,EAAE,KAAA,EAAO,IAAA,EAAM,CAAA,CAAE,MAAA,CAAO,KAAK,CAAC,CAAA;AAAA,EAC3E,CAAA,CAAA,MAAQ;AACN,IAAA,OAAO,MAAA;AAAA,EACT;AACF;AAEA,eAAe,eAAA,CACb,GACA,OAAA,EAC+C;AAC/C,EAAA,MAAM,MAAA,GAAS,CAAA,CAAE,GAAA,CAAI,MAAA,CAAO,gBAAgB,CAAA;AAC5C,EAAA,IAAI,WAAW,MAAA,EAAW;AACxB,IAAA,MAAM,MAAA,GAAS,OAAO,MAAM,CAAA;AAC5B,IAAA,IAAI,CAAC,MAAA,CAAO,aAAA,CAAc,MAAM,CAAA,IAAK,MAAA,GAAS,GAAG,OAAO,MAAA;AACxD,IAAA,IAAI,MAAA,GAAS,SAAS,OAAO,WAAA;AAAA,EAC/B;AACA,EAAA,IAAI;AACF,IAAA,MAAM,QAAQ,IAAI,UAAA,CAAW,MAAM,CAAA,CAAE,GAAA,CAAI,aAAa,CAAA;AACtD,IAAA,OAAO,KAAA,CAAM,UAAA,GAAa,OAAA,GAAU,WAAA,GAAc,KAAA;AAAA,EACpD,CAAA,CAAA,MAAQ;AACN,IAAA,OAAO,MAAA;AAAA,EACT;AACF;AAEA,SAAS,eAAe,KAAA,EAAwC;AAC9D,EAAA,IAAI;AACF,IAAA,OAAO,IAAA,CAAK,KAAA,CAAM,IAAI,WAAA,CAAY,OAAA,EAAS,EAAE,KAAA,EAAO,IAAA,EAAM,CAAA,CAAE,MAAA,CAAO,KAAK,CAAC,CAAA;AAAA,EAC3E,CAAA,CAAA,MAAQ;AACN,IAAA,OAAO,MAAA;AAAA,EACT;AACF;AAEA,SAASD,cAAa,CAAA,EAAsB;AAC1C,EAAA,OAAO,EAAE,IAAA,CAAK,EAAE,KAAA,EAAO,cAAA,IAAkB,GAAG,CAAA;AAC9C;AAEA,SAAS,YAAA,CAAa,GAAY,MAAA,EAA2B;AAC3D,EAAA,IAAIJ,mBAAAA,CAA6C,MAAM,CAAA,EAAG;AACxD,IAAA,MAAM,UACJ,MAAA,CAAO,OAAA,KAAY,SAAY,IAAA,GAAO,mBAAA,CAAoB,OAAO,OAAO,CAAA;AAC1E,IAAA,OAAO,CAAA,CAAE,IAAA,CAAK,EAAE,KAAA,EAAO,MAAA,CAAO,IAAA,EAAM,OAAA,EAAS,UAAA,EAAY,MAAA,CAAO,UAAA,EAAW,EAAG,GAAG,CAAA;AAAA,EACnF;AACA,EAAA,IAAI,kBAAA,CAAmB,MAAM,CAAA,EAAG;AAC9B,IAAA,OAAO,EAAE,IAAA,CAAK,EAAE,OAAO,MAAA,CAAO,IAAA,EAAM,GAAI,MAAA,CAAO,OAAA,KAAY,MAAA,GAAY,KAAK,EAAE,OAAA,EAAS,OAAO,OAAA,EAAQ,IAAM,GAAG,CAAA;AAAA,EACjH;AACA,EAAA,IAAIC,WAAAA,CAAY,MAAM,CAAA,EAAG;AACvB,IAAA,IAAKK,mBAAAA,CAA0C,QAAA,CAAS,MAAA,CAAO,IAAI,CAAA,EAAG;AACpE,MAAA,MAAM,OAAO,MAAA,CAAO,IAAA;AACpB,MAAA,OAAO,CAAA,CAAE,KAAK,EAAE,KAAA,EAAO,MAAK,EAAGC,yBAAAA,CAA0B,IAAI,CAAC,CAAA;AAAA,IAChE;AACA,IAAA,IAAI,MAAA,CAAO,IAAA,KAAS,6BAAA,IAAiC,MAAA,CAAO,SAAS,sBAAA,EAAwB;AAC3F,MAAA,OAAO,EAAE,IAAA,CAAK,EAAE,OAAO,MAAA,CAAO,IAAA,IAAQ,GAAG,CAAA;AAAA,IAC3C;AACA,IAAA,IAAI,MAAA,CAAO,IAAA,KAAS,sBAAA,EAAwB,OAAO,CAAA,CAAE,IAAA,CAAK,EAAE,KAAA,EAAO,MAAA,CAAO,IAAA,EAAK,EAAG,GAAG,CAAA;AAAA,EACvF;AACA,EAAA,MAAM,MAAA;AACR;ACtSO,IAAM,aAAA,GAAgB,CAAC,QAAA,EAAU,OAAA,EAAS,aAAa,QAAQ;AAG/D,IAAM,aAAA,GAAgB,CAAC,KAAA,EAAO,MAAA,EAAQ,KAAK;AAW3C,SAAS,SAAS,KAAA,EAAmE;AAC1F,EAAA,OAAO,CAAA,EAAG,KAAA,CAAM,MAAM,CAAA,CAAA,EAAI,MAAM,IAAI,CAAA,CAAA;AACtC;AAEO,IAAM,qBAAN,MAAyB;AAAA,EACrB,IAAA,GAAO,IAAI,IAAA,EAAK;AAAA,EAChB,UAA6B,EAAC;AAAA,EAEvC,QAAA,CAAS,YAA6B,OAAA,EAAkC;AACtE,IAAA,IAAI,CAAE,aAAA,CAAoC,QAAA,CAAS,UAAA,CAAW,KAAK,CAAA,EAAG;AACpE,MAAA,MAAM,IAAI,KAAA,CAAM,CAAA,MAAA,EAAS,QAAA,CAAS,UAAU,CAAC,CAAA,6BAAA,CAA+B,CAAA;AAAA,IAC9E;AACA,IAAA,IAAI,CAAE,aAAA,CAAoC,QAAA,CAAS,UAAA,CAAW,MAAM,CAAA,EAAG;AACrE,MAAA,MAAM,IAAI,KAAA,CAAM,CAAA,MAAA,EAAS,QAAA,CAAS,UAAU,CAAC,CAAA,2BAAA,CAA6B,CAAA;AAAA,IAC5E;AACA,IAAA,IAAI,IAAA,CAAK,OAAA,CAAQ,IAAA,CAAK,CAAC,QAAA,KAAa,QAAA,CAAS,QAAQ,CAAA,KAAM,QAAA,CAAS,UAAU,CAAC,CAAA,EAAG;AAChF,MAAA,MAAM,IAAI,KAAA,CAAM,CAAA,MAAA,EAAS,QAAA,CAAS,UAAU,CAAC,CAAA,sBAAA,CAAwB,CAAA;AAAA,IACvE;AACA,IAAA,IAAA,CAAK,OAAA,CAAQ,KAAK,UAAU,CAAA;AAC5B,IAAA,IAAA,CAAK,KAAK,EAAA,CAAG,UAAA,CAAW,MAAA,EAAQ,UAAA,CAAW,MAAM,OAAO,CAAA;AAAA,EAC1D;AAAA;AAAA,EAGA,IAAI,MAAA,GAAqC;AACvC,IAAA,OAAO,IAAA,CAAK,OAAA;AAAA,EACd;AAAA;AAAA,EAGA,IAAI,OAAA,GAAyE;AAC3E,IAAA,OAAO,IAAA,CAAK,IAAA,CAAK,MAAA,CAAO,GAAA,CAAI,CAAC,KAAA,MAAW,EAAE,MAAA,EAAQ,KAAA,CAAM,MAAA,EAAQ,IAAA,EAAM,KAAA,CAAM,MAAK,CAAE,CAAA;AAAA,EACrF;AAAA,EAEA,IAAI,KAAA,GAAgF;AAClF,IAAA,OAAO,KAAK,IAAA,CAAK,KAAA;AAAA,EACnB;AACF;ACxCO,SAAS,qBAAA,CAAsB,QAAgB,OAAA,EAAyC;AAC7F,EAAA,IAAI,QAAA;AACJ,EAAA,IAAI;AACF,IAAA,QAAA,GAAWC,cAAAA,CAAe,QAAQ,IAAI,CAAA;AAAA,EACxC,SAAS,KAAA,EAAO;AACd,IAAA,MAAM,IAAI,cAAA;AAAA,MACR,6BAAA;AAAA,MACA,iCAAiC,MAAM,CAAA,+CAAA,CAAA;AAAA,MACvC,EAAE,KAAA;AAAM,KACV;AAAA,EACF;AACA,EAAA,QAAQ,SAAS,IAAA;AAAM,IACrB,KAAK,eAAA;AACH,MAAA,OAAO;AAAA,QACL,MAAA;AAAA,QACA,KAAA,EAAO,UAAA;AAAA,QACP,OAAA,EAAS,SAAS,OAAA,CAAQ,OAAA;AAAA,QAC1B,UAAA,EAAY,SAAS,OAAA,CAAQ,UAAA;AAAA,QAC7B,GAAI,QAAA,CAAS,OAAA,CAAQ,YAAA,KAAiB,MAAA,GAClC,EAAE,YAAA,EAAc,QAAA,CAAS,OAAA,CAAQ,YAAA,EAAa,GAC9C,EAAC;AAAA,QACL,GAAI,QAAA,CAAS,OAAA,CAAQ,QAAA,KAAa,MAAA,GAAY,EAAE,QAAA,EAAU,QAAA,CAAS,OAAA,CAAQ,QAAA,EAAS,GAAI,EAAC;AAAA,QACzF,YAAY,OAAA,CAAQ;AAAA,OACtB;AAAA,IACF,KAAK,WAAA;AACH,MAAA,OAAO;AAAA,QACL,MAAA;AAAA,QACA,KAAA,EAAO,QAAA;AAAA,QACP,MAAA,EAAQ,SAAS,OAAA,CAAQ,MAAA;AAAA,QACzB,GAAI,QAAA,CAAS,OAAA,CAAQ,SAAA,KAAc,MAAA,GAC/B,EAAE,SAAA,EAAW,QAAA,CAAS,OAAA,CAAQ,SAAA,EAAU,GACxC,EAAC;AAAA,QACL,YAAY,OAAA,CAAQ;AAAA,OACtB;AAAA,IACF,KAAK,gBAAA;AACH,MAAA,OAAO;AAAA,QACL,MAAA;AAAA,QACA,KAAA,EAAO,WAAA;AAAA,QACP,GAAI,QAAA,CAAS,OAAA,CAAQ,MAAA,KAAW,MAAA,GAAY,EAAE,MAAA,EAAQ,QAAA,CAAS,OAAA,CAAQ,MAAA,EAAO,GAAI,EAAC;AAAA,QACnF,YAAY,OAAA,CAAQ;AAAA,OACtB;AAAA,IACF;AACE,MAAA,MAAM,IAAI,cAAA;AAAA,QACR,6BAAA;AAAA,QACA,CAAA,8BAAA,EAAiC,MAAM,CAAA,SAAA,EAAY,QAAA,CAAS,IAAI,CAAA,wCAAA;AAAA,OAClE;AAAA;AAEN;;;AC0CO,IAAM,2BAAA,GAA8B,MAAM,IAAA,GAAO;AAEjD,IAAM,yBAAA,GAA4B;AAElC,IAAM,6BAAA,GAAgC;AAEtC,IAAM,yBAAA,GAA4B;AA8HlC,SAAS,gBAAgB,OAAA,EAAsC;AACpE,EAAA,MAAM,WAAA,GAAc,gBAAA,CAAiB,OAAA,CAAQ,YAAY,CAAA;AACzD,EAAA,uBAAA;AAAA,IACE,WAAA;AAAA,IACA,OAAA,CAAQ,gBAAA;AAAA,IACR,OAAA,CAAQ,cAAA;AAAA,IACR,OAAA,CAAQ,oBAAA;AAAA,IACR,OAAA,CAAQ;AAAA,GACV;AACA,EAAA,MAAM,OAAwB,EAAE,IAAA,EAAM,QAAQ,IAAA,EAAM,KAAA,EAAO,QAAQ,KAAA,EAAM;AACzE,EAAA,MAAM,OAAkB,eAAA,CAAgB;AAAA,IACtC,QAAQ,OAAA,CAAQ,KAAA;AAAA,IAChB,QAAQ,OAAA,CAAQ,MAAA;AAAA,IAChB,OAAO,OAAA,CAAQ,KAAA;AAAA,IACf,aAAa,OAAA,CAAQ,WAAA;AAAA,IACrB,GAAI,QAAQ,qBAAA,KAA0B,MAAA,GAClC,EAAE,qBAAA,EAAuB,OAAA,CAAQ,qBAAA,EAAsB,GACvD;AAAC,GACN,CAAA;AAED,EAAA,MAAM,eAAA,GAAkB;AAAA,IACtB,IAAA;AAAA,IACA,MAAA,EAAQ,EAAE,WAAA,EAAa,OAAA,CAAQ,aAAa,OAAA,EAAS,OAAA,CAAQ,MAAM,OAAA;AAAQ,GAC7E;AAEA,EAAA,MAAM,QAAA,GAAW,IAAI,kBAAA,EAAmB;AACxC,EAAA,MAAM,cAAA,GAAiC;AAAA,IACrC,SAAA,EAAW,QAAQ,iBAAA,IAAqB,2BAAA;AAAA,IACxC,QAAA,EAAU,QAAQ,gBAAA,IAAoB,0BAAA;AAAA,IACtC,QAAA,EAAU,QAAQ,gBAAA,IAAoB,yBAAA;AAAA,IACtC,KAAA,EAAO,QAAQ,aAAA,IAAiB;AAAA,GAClC;AAGA,EAAA,QAAA,CAAS,QAAA,CAAS,EAAE,MAAA,EAAQ,MAAA,EAAQ,IAAA,EAAM,cAAA,EAAgB,KAAA,EAAO,QAAA,EAAS,EAAG,WAAA,CAAY,EAAE,IAAA,EAAM,CAAC,CAAA;AAClG,EAAA,QAAA,CAAS,QAAA,CAAS,EAAE,MAAA,EAAQ,MAAA,EAAQ,IAAA,EAAM,mBAAA,EAAqB,KAAA,EAAO,QAAA,EAAS,EAAG,gBAAA,CAAiB,EAAE,IAAA,EAAM,CAAC,CAAA;AAC5G,EAAA,QAAA,CAAS,QAAA,CAAS,EAAE,MAAA,EAAQ,MAAA,EAAQ,IAAA,EAAM,eAAA,EAAiB,KAAA,EAAO,QAAA,EAAS,EAAG,YAAA,CAAa,EAAE,IAAA,EAAM,CAAC,CAAA;AAIpG,EAAA,QAAA,CAAS,QAAA;AAAA,IACP,EAAE,MAAA,EAAQ,KAAA,EAAO,IAAA,EAAM,sBAAA,EAAwB,OAAO,QAAA,EAAS;AAAA,IAC/D,mBAAA,CAAoB,EAAE,WAAA,EAAa;AAAA,GACrC;AAEA,EAAA,IAAI,QAAA,CAAS,WAAA,EAAa,kBAAA,CAAmB,cAAc,CAAA,EAAG;AAC5D,IAAA,QAAA,CAAS,QAAA;AAAA,MACP,EAAE,MAAA,EAAQ,KAAA,EAAO,IAAA,EAAM,gBAAA,EAAkB,OAAO,QAAA,EAAS;AAAA,MACzD,aAAA,CAAc;AAAA,QACZ,GAAG,eAAA;AAAA,QACH,cAAA,EAAgB,QAAQ,cAAA,IAAkB,yBAAA;AAAA,QAC1C,kBAAA,EAAoB,QAAQ,kBAAA,IAAsB,6BAAA;AAAA,QAClD,SAAA,EAAW,QAAQ,eAAA,IAAmB;AAAA,OACvC;AAAA,KACH;AAAA,EACF;AAEA,EAAA,IAAI,QAAA,CAAS,WAAA,EAAa,kBAAA,CAAmB,aAAa,CAAA,EAAG;AAC3D,IAAA,QAAA,CAAS,QAAA;AAAA,MACP,EAAE,MAAA,EAAQ,MAAA,EAAQ,IAAA,EAAM,kBAAA,EAAoB,OAAO,QAAA,EAAS;AAAA,MAC5D,eAAA,CAAgB,EAAE,GAAG,eAAA,EAAiB,gBAAgB;AAAA,KACxD;AAAA,EACF;AAEA,EAAA,IAAI,QAAA,CAAS,WAAA,EAAa,kBAAA,CAAmB,iBAAiB,CAAA,EAAG;AAC/D,IAAA,MAAM,SAAA,GAAY;AAAA,MAChB,GAAG,eAAA;AAAA,MACH,SAAA,EAAW,QAAQ,cAAA,IAAkB;AAAA,KACvC;AACA,IAAA,QAAA,CAAS,QAAA,CAAS,EAAE,MAAA,EAAQ,KAAA,EAAO,IAAA,EAAM,eAAA,EAAiB,KAAA,EAAO,QAAA,EAAS,EAAG,gBAAA,CAAiB,SAAS,CAAC,CAAA;AACxG,IAAA,QAAA,CAAS,QAAA;AAAA,MACP,EAAE,MAAA,EAAQ,MAAA,EAAQ,IAAA,EAAM,sBAAA,EAAwB,OAAO,QAAA,EAAS;AAAA,MAChE,kBAAkB,eAAe;AAAA,KACnC;AACA,IAAA,QAAA,CAAS,QAAA;AAAA,MACP,EAAE,MAAA,EAAQ,MAAA,EAAQ,IAAA,EAAM,wBAAA,EAA0B,OAAO,QAAA,EAAS;AAAA,MAClE,oBAAoB,eAAe;AAAA,KACrC;AACA,IAAA,QAAA,CAAS,QAAA;AAAA,MACP,EAAE,MAAA,EAAQ,MAAA,EAAQ,IAAA,EAAM,uBAAA,EAAyB,OAAO,QAAA,EAAS;AAAA,MACjE,mBAAmB,eAAe;AAAA,KACpC;AAAA,EACF;AAEA,EAAA,IAAI,QAAA,CAAS,WAAA,EAAa,kBAAA,CAAmB,QAAQ,CAAA,EAAG;AACtD,IAAA,QAAA,CAAS,QAAA;AAAA,MACP,EAAE,MAAA,EAAQ,KAAA,EAAO,IAAA,EAAM,sBAAA,EAAwB,OAAO,QAAA,EAAS;AAAA,MAC/D,kBAAA,CAAmB;AAAA,QACjB,GAAG,eAAA;AAAA,QACH,SAAA,EAAW,QAAQ,cAAA,IAAkB,wBAAA;AAAA,QACrC,eAAA,EAAiB,QAAQ,0BAAA,IAA8B,sCAAA;AAAA,QACvD,mBAAA,EACE,QAAQ,8BAAA,IAAkC,0CAAA;AAAA,QAC5C,wBAAA,EACE,QAAQ,mCAAA,IACR;AAAA,OACH;AAAA,KACH;AAAA,EACF;AAEA,EAAA,IAAI,QAAA,CAAS,WAAA,EAAa,kBAAA,CAAmB,aAAa,CAAA,EAAG;AAC3D,IAAA,QAAA,CAAS,QAAA;AAAA,MACP,EAAE,MAAA,EAAQ,KAAA,EAAO,IAAA,EAAM,kBAAA,EAAoB,OAAO,QAAA,EAAS;AAAA,MAC3D,sBAAA,CAAuB;AAAA,QACrB,GAAG,eAAA;AAAA,QACH,KAAA,EAAO,QAAQ,aAAA,IAAiB,uBAAA;AAAA,QAChC,iBAAA,EACE,QAAQ,yBAAA,IAA6B,oCAAA;AAAA,QACvC,cAAA,EAAgB,QAAQ,sBAAA,IAA0B;AAAA,OACnD;AAAA,KACH;AAAA,EACF;AAEA,EAAA,IAAI,QAAA,CAAS,WAAA,EAAa,kBAAA,CAAmB,YAAY,CAAA,EAAG;AAC1D,IAAA,QAAA,CAAS,QAAA;AAAA,MACP,EAAE,MAAA,EAAQ,MAAA,EAAQ,IAAA,EAAM,kBAAA,EAAoB,OAAO,QAAA,EAAS;AAAA,MAC5D,sBAAsB,EAAE,GAAG,eAAA,EAAiB,MAAA,EAAQ,gBAAgB;AAAA,KACtE;AAAA,EACF;AAEA,EAAA,MAAM,iBAAiB,OAAA,CAAQ,cAAA;AAC/B,EAAA,MAAM,uBAAuB,OAAA,CAAQ,oBAAA;AACrC,EAAA,IACE,cAAA,KAAmB,UACnB,oBAAA,KAAyB,MAAA,IACzB,SAAS,WAAA,EAAa,kBAAA,CAAmB,YAAY,CAAA,EACrD;AACA,IAAA,MAAM,SAAA,GAAY;AAAA,MAChB,KAAA,EAAO;AAAA,QACL,OAAA,EAAS,QAAQ,KAAA,CAAM,OAAA;AAAA,QACvB,QAAQ,OAAA,CAAQ,MAAA;AAAA,QAChB,OAAO,OAAA,CAAQ;AAAA,OACjB;AAAA,MACA,KAAA,EAAO,cAAA;AAAA,MACP,eAAA,EAAiB,oBAAA;AAAA,MACjB,eAAA,EAAiB,QAAQ,oBAAA,IAAwB;AAAA,KACnD;AACA,IAAA,QAAA,CAAS,QAAA;AAAA,MACP,EAAE,MAAA,EAAQ,KAAA,EAAO,IAAA,EAAM,iBAAA,EAAmB,OAAO,OAAA,EAAQ;AAAA,MACzD,qBAAqB,SAAS;AAAA,KAChC;AACA,IAAA,QAAA,CAAS,QAAA;AAAA,MACP,EAAE,MAAA,EAAQ,KAAA,EAAO,IAAA,EAAM,iBAAA,EAAmB,OAAO,OAAA,EAAQ;AAAA,MACzD,gBAAgB,SAAS;AAAA,KAC3B;AACA,IAAA,QAAA,CAAS,QAAA;AAAA,MACP,EAAE,MAAA,EAAQ,KAAA,EAAO,IAAA,EAAM,iBAAA,EAAmB,OAAO,OAAA,EAAQ;AAAA,MACzD,gBAAgB,SAAS;AAAA,KAC3B;AAAA,EACF;AAMA,EAAA,MAAM,aAAa,OAAA,CAAQ,UAAA;AAC3B,EAAA,IAAI,eAAe,MAAA,IAAa,QAAA,CAAS,WAAA,EAAa,kBAAA,CAAmB,UAAU,CAAA,EAAG;AACpF,IAAA,MAAM,aAAA,GAAgB;AAAA,MACpB,QAAQ,eAAA,CAAgB,MAAA;AAAA,MACxB,UAAA;AAAA,MACA,SAAA,EAAW,QAAQ,kBAAA,IAAsB;AAAA,KAC3C;AACA,IAAA,QAAA,CAAS,QAAA;AAAA,MACP,EAAE,MAAA,EAAQ,KAAA,EAAO,IAAA,EAAM,qBAAA,EAAuB,OAAO,QAAA,EAAS;AAAA,MAC9D,qBAAqB,aAAa;AAAA,KACpC;AACA,IAAA,QAAA,CAAS,QAAA;AAAA,MACP,EAAE,MAAA,EAAQ,KAAA,EAAO,IAAA,EAAM,0BAAA,EAA4B,OAAO,QAAA,EAAS;AAAA,MACnE,qBAAqB,aAAa;AAAA,KACpC;AAAA,EACF;AAEA,EAAA,IAAI,QAAA,CAAS,WAAA,EAAa,kBAAA,CAAmB,cAAc,CAAA,EAAG;AAC5D,IAAA,MAAM,QAAA,GAAW;AAAA,MACf,GAAG,eAAA;AAAA,MACH,gBAAA,EAAkB,QAAQ,gBAAA,IAAoB;AAAA,KAChD;AACA,IAAA,QAAA,CAAS,QAAA,CAAS,EAAE,MAAA,EAAQ,MAAA,EAAQ,IAAA,EAAM,eAAA,EAAiB,KAAA,EAAO,QAAA,EAAS,EAAG,iBAAA,CAAkB,QAAQ,CAAC,CAAA;AACzG,IAAA,QAAA,CAAS,QAAA,CAAS,EAAE,MAAA,EAAQ,MAAA,EAAQ,IAAA,EAAM,wBAAA,EAA0B,KAAA,EAAO,QAAA,EAAS,EAAG,mBAAA,CAAoB,QAAQ,CAAC,CAAA;AACpH,IAAA,QAAA,CAAS,QAAA,CAAS,EAAE,MAAA,EAAQ,KAAA,EAAO,IAAA,EAAM,mBAAA,EAAqB,KAAA,EAAO,QAAA,EAAS,EAAG,sBAAA,CAAuB,QAAQ,CAAC,CAAA;AAAA,EACnH;AAqBA,EAAA,MAAM,eAAe,OAAA,CAAQ,gBAAA;AAC7B,EAAA,IAAI,iBAAiB,MAAA,IAAa,QAAA,CAAS,WAAA,EAAa,kBAAA,CAAmB,iBAAiB,CAAA,EAAG;AAC7F,IAAA,MAAM,WAAA,GAAc,EAAE,YAAA,EAAa;AACnC,IAAA,QAAA,CAAS,QAAA;AAAA,MACP,EAAE,MAAA,EAAQ,KAAA,EAAO,IAAA,EAAM,uBAAA,EAAyB,OAAO,WAAA,EAAY;AAAA,MACnE,yBAAyB,WAAW;AAAA,KACtC;AACA,IAAA,QAAA,CAAS,QAAA;AAAA,MACP,EAAE,MAAA,EAAQ,KAAA,EAAO,IAAA,EAAM,uBAAA,EAAyB,OAAO,WAAA,EAAY;AAAA,MACnE,2BAA2B,WAAW;AAAA,KACxC;AAAA,EACF;AAQA,EAAA,MAAM,UAAA,GAAa,QAAQ,UAAA,IAAc,MAAA;AAEzC,EAAA,SAAS,aAAa,MAAA,EAAyC;AAC7D,IAAA,OAAO,EAAE,IAAA,EAAM,eAAA,EAAiB,QAAA,EAAU,QAAQ,UAAA,EAAW;AAAA,EAC/D;AAEA,EAAA,eAAe,mBAAA,CACb,MAAA,EACA,QAAA,EACA,eAAA,EACA,aAAA,EACwB;AACxB,IAAA,MAAM,MAAA,GAAS,eAAA,CAAgB,YAAA,CAAa,MAAM,GAAG,IAAI,CAAA;AACzD,IAAA,MAAM,SAAS,eAAA,IAAmB,CAAA,KAAA,EAAQ,OAAA,CAAQ,MAAA,CAAO,YAAY,CAAA,CAAA;AACrE,IAAA,MAAM,SAAA,GAAY,OAAA,CAAQ,MAAA,CAAO,UAAA,EAAW;AAE5C,IAAA,MAAM,OAAA,GAAU,MAAM,MAAA,CAAO,OAAA,CAAQ,MAAA,CAAO;AAAA,MAC1C,QAAA;AAAA,MACA,SAAA;AAAA,MACA,WAAA,EAAa,OAAO,GAAA,KAAQ;AAI1B,QAAA,MAAMC,SAAAA,GAAW,aAAA,CAAc,MAAA,EAAQ,GAAA,EAAK,SAAS,CAAA;AACrD,QAAA,MAAM,IAAA,GAAOC,eAAeD,SAAQ,CAAA;AACpC,QAAA,MAAM,KAAA,GAAQ,IAAI,WAAA,EAAY,CAAE,OAAO,IAAI,CAAA;AAC3C,QAAA,OAAO;AAAA,UACL,IAAA;AAAA,UACA,UAAUJ,WAAAA,CAAY,MAAM,QAAQ,MAAA,CAAO,MAAA,CAAO,KAAK,CAAC,CAAA;AAAA,UACxD,QAAA,EAAU,MAAA,CAAO,KAAA,CAAM,MAAM;AAAA,SAC/B;AAAA,MACF;AAAA,KACD,CAAA;AACD,IAAA,MAAM,QAAA,GAAWG,cAAAA,CAAe,OAAA,CAAQ,IAAI,CAAA;AAC5C,IAAA,IAAI,QAAA,CAAS,GAAA,KAAQ,OAAA,CAAQ,GAAA,EAAK;AAChC,MAAA,MAAM,IAAI,cAAA;AAAA,QACR,sBAAA;AAAA,QACA,4BAA4B,MAAA,CAAO,QAAA,CAAS,GAAG,CAAC,CAAA,QAAA,EAAW,QAAQ,GAAG,CAAA,gDAAA;AAAA,OACxE;AAAA,IACF;AAEA,IAAA,MAAM,OAAA,GAAU,MAAM,MAAA,CAAO,KAAA,CAAM,KAAK,EAAE,MAAA,EAAQ,UAAU,CAAA;AAC5D,IAAA,OAAO,EAAE,MAAA,EAAQ,GAAA,EAAK,OAAA,CAAQ,GAAA,EAAK,UAAU,OAAA,EAAQ;AAAA,EACvD;AAEA,EAAA,OAAO;AAAA,IACL,OAAO,QAAA,CAAS,KAAA;AAAA,IAChB,QAAQ,QAAA,CAAS,MAAA;AAAA,IACjB,eAAe,QAAA,CAAS,OAAA;AAAA,IACxB,YAAA,EAAc,WAAA;AAAA,IAEd,iBAAA,CAAkB,QAAQ,KAAA,EAAO;AAC/B,MAAA,OAAO,IAAA,CAAK,iBAAA,CAAkB,MAAA,EAAQ,KAAK,CAAA;AAAA,IAC7C,CAAA;AAAA,IAEA,MAAM,YAAA,CAAa,MAAA,EAAQ,QAAA,EAAU,KAAA,EAAO;AAC1C,MAAA,OAAO,mBAAA;AAAA,QAAoB,MAAA;AAAA,QAAQ,QAAA;AAAA,QAAU,KAAA,CAAM,MAAA;AAAA,QAAQ,CAAC,MAAA,EAAQ,GAAA,EAAK,SAAA,KACvE,cAAA,CAAe,YAAA,EAAc,KAAA,CAAM,OAAA,EAAS,EAAE,EAAA,EAAI,SAAA,EAAW,MAAA,EAAQ,KAAK;AAAA,OAC5E;AAAA,IACF,CAAA;AAAA,IAEA,MAAM,mBAAA,CAAoB,MAAA,EAAQ,QAAA,EAAU,KAAA,EAAO;AACjD,MAAA,OAAO,mBAAA;AAAA,QAAoB,MAAA;AAAA,QAAQ,QAAA;AAAA,QAAU,KAAA,CAAM,MAAA;AAAA,QAAQ,CAAC,MAAA,EAAQ,GAAA,EAAK,SAAA,KACvE,cAAA,CAAe,0BAAA,EAA4B,KAAA,CAAM,OAAA,EAAS,EAAE,EAAA,EAAI,SAAA,EAAW,MAAA,EAAQ,KAAK;AAAA,OAC1F;AAAA,IACF,CAAA;AAAA,IAEA,eAAA,CAAgB,QAAQ,MAAA,EAAQ;AAC9B,MAAA,OAAO,eAAA,CAAgB,aAAa,MAAM,CAAA,EAAG,IAAI,CAAA,CAAE,KAAA,CAAM,IAAI,MAAM,CAAA;AAAA,IACrE,CAAA;AAAA,IAEA,mBAAA,CAAoB,QAAQ,MAAA,EAAQ;AAClC,MAAA,OAAO,eAAA,CAAgB,YAAA,CAAa,MAAM,CAAA,EAAG,IAAI,EAAE,QAAA,CAAS,GAAA,CAAI,kBAAA,CAAmB,MAAM,CAAC,CAAA;AAAA,IAC5F,CAAA;AAAA,IAEA,MAAM,cAAA,CAAe,MAAA,EAAQ,MAAA,EAAQ;AACnC,MAAA,MAAM,OAAA,GAAU,MAAM,eAAA,CAAgB,YAAA,CAAa,MAAM,CAAA,EAAG,IAAI,EAAE,QAAA,CAAS,GAAA;AAAA,QACzE,mBAAmB,MAAM;AAAA,OAC3B;AACA,MAAA,OAAO,OAAA,KAAY,MAAA,GAAY,MAAA,GAAY,qBAAA,CAAsB,QAAQ,OAAO,CAAA;AAAA,IAClF,CAAA;AAAA,IAEA,YAAY,MAAA,EAAQ;AAClB,MAAA,OAAO,gBAAgB,YAAA,CAAa,MAAM,GAAG,IAAI,CAAA,CAAE,QAAQ,IAAA,EAAK;AAAA,IAClE,CAAA;AAAA,IAEA,YAAA,CAAa,QAAQ,QAAA,EAAU;AAC7B,MAAA,OAAO,eAAA,CAAgB,aAAa,MAAM,CAAA,EAAG,IAAI,CAAA,CAAE,OAAA,CAAQ,OAAO,QAAQ,CAAA;AAAA,IAC5E,CAAA;AAAA,IAEA,eAAA,CAAgB,QAAQ,KAAA,EAAO;AAC7B,MAAA,iBAAA,CAAkB,KAAA,CAAM,OAAA,EAAS,KAAA,CAAM,KAAA,EAAO;AAAA,QAC5C,eAAA,EAAiB,QAAQ,oBAAA,IAAwB,+BAAA;AAAA,QACjD,aAAA,EAAe,QAAQ,kBAAA,IAAsB;AAAA,OAC9C,CAAA;AACD,MAAA,OAAO,eAAA,CAAgB,aAAa,MAAM,CAAA,EAAG,IAAI,CAAA,CAAE,KAAA,CAAM,OAAO,KAAK,CAAA;AAAA,IACvE,CAAA;AAAA,IAEA,cAAA,CAAe,QAAQ,KAAA,EAAO;AAC5B,MAAA,OAAO,eAAA,CAAgB,aAAa,MAAM,CAAA,EAAG,IAAI,CAAA,CAAE,KAAA,CAAM,KAAK,KAAK,CAAA;AAAA,IACrE,CAAA;AAAA,IAEA,eAAA,CAAgB,QAAQ,MAAA,EAAQ;AAC9B,MAAA,OAAO,gBAAgB,YAAA,CAAa,MAAM,GAAG,IAAI,CAAA,CAAE,MAAM,YAAA,CAAa;AAAA,QACpE,MAAA;AAAA,QACA,cAAA,EAAgB,WAAA;AAAA,QAChB,MAAA,EAAQ;AAAA,OACT,CAAA;AAAA,IACH,CAAA;AAAA,IAEA,aAAa,MAAA,EAAQ;AACnB,MAAA,OAAO,gBAAgB,YAAA,CAAa,MAAM,GAAG,IAAI,CAAA,CAAE,SAAS,IAAA,EAAK;AAAA,IACnE,CAAA;AAAA,IAEA,YAAA,CAAa,QAAQ,MAAA,EAAQ;AAC3B,MAAA,OAAO,eAAA,CAAgB,aAAa,MAAM,CAAA,EAAG,IAAI,CAAA,CAAE,QAAA,CAAS,KAAK,MAAM,CAAA;AAAA,IACzE,CAAA;AAAA,IAEA,oBAAA,CAAqB,QAAQ,MAAA,EAAQ;AACnC,MAAA,OAAO,eAAA,CAAgB,aAAa,MAAM,CAAA,EAAG,IAAI,CAAA,CAAE,SAAA,CAAU,KAAK,MAAM,CAAA;AAAA,IAC1E;AAAA,GACF;AACF;AAaA,SAAS,uBAAA,CACP,WAAA,EACA,YAAA,EACA,cAAA,EACA,sBACA,UAAA,EACM;AACN,EAAA,IACE,QAAA,CAAS,WAAA,EAAa,kBAAA,CAAmB,QAAQ,CAAA,IACjD,CAAC,QAAA,CAAS,WAAA,EAAa,kBAAA,CAAmB,iBAAiB,CAAA,EAC3D;AACA,IAAA,MAAM,IAAI,cAAA;AAAA,MACR,0BAAA;AAAA,MACA,CAAA,EAAG,kBAAA,CAAmB,QAAQ,CAAA,UAAA,EAAa,mBAAmB,iBAAiB,CAAA,yEAAA;AAAA,KACjF;AAAA,EACF;AACA,EAAA,IAAI,iBAAiB,MAAA,IAAa,QAAA,CAAS,WAAA,EAAa,kBAAA,CAAmB,iBAAiB,CAAA,EAAG;AAC7F,IAAA,MAAM,IAAI,cAAA;AAAA,MACR,0BAAA;AAAA,MACA,CAAA,yBAAA,EAA4B,mBAAmB,iBAAiB,CAAA,2GAAA;AAAA,KAClE;AAAA,EACF;AACA,EAAA,IAAI,mBAAmB,MAAA,IAAa,QAAA,CAAS,WAAA,EAAa,kBAAA,CAAmB,YAAY,CAAA,EAAG;AAC1F,IAAA,MAAM,IAAI,cAAA;AAAA,MACR,0BAAA;AAAA,MACA,CAAA,yBAAA,EAA4B,mBAAmB,YAAY,CAAA,wCAAA;AAAA,KAC7D;AAAA,EACF;AACA,EAAA,IAAI,yBAAyB,MAAA,IAAa,QAAA,CAAS,WAAA,EAAa,kBAAA,CAAmB,YAAY,CAAA,EAAG;AAChG,IAAA,MAAM,IAAI,cAAA;AAAA,MACR,0BAAA;AAAA,MACA,CAAA,yBAAA,EAA4B,mBAAmB,YAAY,CAAA,oEAAA;AAAA,KAC7D;AAAA,EACF;AACA,EAAA,IAAI,eAAe,MAAA,IAAa,QAAA,CAAS,WAAA,EAAa,kBAAA,CAAmB,UAAU,CAAA,EAAG;AACpF,IAAA,MAAM,IAAI,cAAA;AAAA,MACR,0BAAA;AAAA,MACA,CAAA,yBAAA,EAA4B,mBAAmB,UAAU,CAAA,mGAAA;AAAA,KAC3D;AAAA,EACF;AACF;AAEA,SAAS,iBAAiB,WAAA,EAA2D;AACnF,EAAA,IAAI;AACF,IAAA,OAAO,2BAA2B,WAAW,CAAA;AAAA,EAC/C,SAAS,KAAA,EAAO;AACd,IAAA,MAAM,IAAI,cAAA;AAAA,MACR,gCAAA;AAAA,MACA,oGAAA;AAAA,MACA,EAAE,KAAA;AAAM,KACV;AAAA,EACF;AACF;;;ACjpBO,IAAM,sBAAN,MAAwD;AAAA,EAC7D,MAAM,OAAA,CAAQ,OAAA,EAAmB,SAAA,EAAqC;AACpE,IAAA,OAAO,IAAA;AAAA,EACT;AACF;ACyBO,IAAM,eAAA,GAAkB,KAAK,EAAA,GAAK;AAEzC,IAAM,oBAAA,GAAuB,EAAA;AAuB7B,IAAM,uBAAN,MAA2B;AAAA,EAChB,KAAA,uBAAY,GAAA,EAAwB;AAAA,EACpC,gBAAA,uBAAuB,GAAA,EAAoB;AAAA,EAC3C,KAAA;AAAA,EACA,MAAA;AAAA,EACA,MAAA;AAAA,EACA,QAAA;AAAA,EAET,WAAA,CAAY,KAAA,EAAc,MAAA,EAAqB,OAAA,EAAmC;AAChF,IAAA,IAAA,CAAK,KAAA,GAAQ,KAAA;AACb,IAAA,IAAA,CAAK,MAAA,GAAS,MAAA;AACd,IAAA,IAAA,CAAK,SAAS,UAAA,CAAW,MAAA,CAAO,gBAAgB,IAAI,UAAA,CAAW,oBAAoB,CAAC,CAAA;AACpF,IAAA,IAAA,CAAK,QAAA,GAAW,QAAQ,QAAA,IAAY,eAAA;AAAA,EACtC;AAAA,EAEA,MAAM,OAAA,CAAQ,MAAA,EAAgB,MAAA,EAAwC;AACpE,IAAA,MAAM,MAAM,IAAA,CAAK,KAAA,CAAM,KAAI,CAAE,OAAA,KAAY,IAAA,CAAK,QAAA;AAC9C,IAAA,MAAM,MAAM,MAAM,IAAA,CAAK,UAAA,CAAW,MAAA,EAAQ,QAAQ,GAAG,CAAA;AACrD,IAAA,OAAO,GAAG,mBAAA,CAAoB,MAAM,CAAC,CAAA,KAAA,EAAQ,GAAG,QAAQ,GAAG,CAAA,CAAA;AAAA,EAC7D;AAAA,EAEA,UAAA,CAAW,MAAA,EAAgB,MAAA,EAAuB,GAAA,EAA8B;AAC9E,IAAA,OAAO,IAAA,CAAK,MAAA,CAAO,UAAA,CAAW,IAAA,CAAK,MAAA,EAAQ,CAAA,EAAG,MAAM,CAAA,CAAA,EAAI,MAAM,CAAA,CAAA,EAAI,GAAG,CAAA,CAAE,CAAA;AAAA,EACzE;AACF,CAAA;AAGO,IAAM,yBAAN,MAAuD;AAAA,EACnD,SAAA;AAAA,EACA,QAAA;AAAA,EAET,WAAA,CAAY,UAAgC,OAAA,EAAsB;AAChE,IAAA,IAAA,CAAK,SAAA,GAAY,QAAA;AACjB,IAAA,IAAA,CAAK,QAAA,GAAW,OAAA;AAAA,EAClB;AAAA,EAEA,MAAM,YAAA,CAAa,MAAA,EAAkB,WAAA,EAAiF;AACpH,IAAA,oBAAA,CAAqB,QAAQ,WAAW,CAAA;AACxC,IAAA,MAAM,cAAA,GAAiB,CAAA,EAAG,MAAM,CAAA,EAAA,EAAS,YAAY,aAAa,CAAA,CAAA;AAClE,IAAA,MAAM,cAAA,GAAiB,IAAA,CAAK,SAAA,CAAU,gBAAA,CAAiB,IAAI,cAAc,CAAA;AACzE,IAAA,IAAI,mBAAmB,MAAA,EAAW;AAChC,MAAA,MAAM,WAAW,MAAM,IAAA,CAAK,SAAS,GAAA,CAAI,MAAA,EAAQ,YAAY,WAAW,CAAA;AACxE,MAAA,IAAI,QAAA,EAAU,UAAU,WAAA,EAAa;AACnC,QAAA,MAAM,IAAI,aAAA;AAAA,UACR,sBAAA;AAAA,UACA,CAAA,OAAA,EAAU,YAAY,WAAW,CAAA,oCAAA;AAAA,SACnC;AAAA,MACF;AACA,MAAA,OAAO,EAAE,MAAA,EAAQ,cAAA,EAAgB,SAAA,EAAW,MAAM,KAAK,SAAA,CAAU,OAAA,CAAQ,cAAA,EAAgB,KAAK,CAAA,EAAE;AAAA,IAClG;AAEA,IAAA,MAAM,KAAA,GAAQ,MAAM,IAAA,CAAK,QAAA,CAAS,YAAY,MAAA,EAAQ;AAAA,MACpD,MAAM,WAAA,CAAY,WAAA;AAAA,MAClB,UAAU,WAAA,CAAY,aAAA;AAAA,MACtB,aAAa,WAAA,CAAY;AAAA,KAC1B,CAAA;AACD,IAAA,IACE,MAAM,QAAA,KAAa,WAAA,CAAY,iBAC/B,KAAA,CAAM,WAAA,KAAgB,YAAY,WAAA,EAClC;AACA,MAAA,MAAM,IAAI,aAAA;AAAA,QACR,4BAAA;AAAA,QACA,CAAA,OAAA,EAAU,YAAY,WAAW,CAAA,+CAAA;AAAA,OACnC;AAAA,IACF;AACA,IAAA,IAAI,KAAA,CAAM,UAAU,WAAA,EAAa;AAC/B,MAAA,MAAM,IAAI,aAAA;AAAA,QACR,sBAAA;AAAA,QACA,CAAA,OAAA,EAAU,YAAY,WAAW,CAAA,oCAAA;AAAA,OACnC;AAAA,IACF;AAEA,IAAA,MAAM,SAAS,CAAA,KAAA,EAAQ,IAAA,CAAK,SAAA,CAAU,MAAA,CAAO,YAAY,CAAA,CAAA;AACzD,IAAA,IAAA,CAAK,SAAA,CAAU,KAAA,CAAM,GAAA,CAAI,MAAA,EAAQ;AAAA,MAC/B,QAAA,EAAU,MAAA;AAAA,MACV,eAAe,WAAA,CAAY,aAAA;AAAA,MAC3B,aAAa,WAAA,CAAY,WAAA;AAAA,MACzB,UAAU,WAAA,CAAY,aAAA;AAAA,MACtB,aAAa,WAAA,CAAY,WAAA;AAAA,MACzB,QAAA,EAAU;AAAA,KACX,CAAA;AACD,IAAA,IAAA,CAAK,SAAA,CAAU,gBAAA,CAAiB,GAAA,CAAI,cAAA,EAAgB,MAAM,CAAA;AAC1D,IAAA,OAAO,EAAE,QAAQ,SAAA,EAAW,MAAM,KAAK,SAAA,CAAU,OAAA,CAAQ,MAAA,EAAQ,KAAK,CAAA,EAAE;AAAA,EAC1E;AAAA,EAEA,MAAM,aAAA,CACJ,MAAA,EACA,MAAA,EACA,WAAA,EACsC;AACtC,IAAA,MAAM,MAAA,GAAS,IAAA,CAAK,SAAA,CAAU,KAAA,CAAM,IAAI,MAAM,CAAA;AAC9C,IAAA,IACE,WAAW,MAAA,IACX,MAAA,CAAO,aAAa,MAAA,IACpB,WAAA,CAAY,aAAa,MAAA,IACzB,MAAA,CAAO,aAAA,KAAkB,WAAA,CAAY,iBACrC,MAAA,CAAO,WAAA,KAAgB,YAAY,WAAA,IACnC,CAAC,OAAO,QAAA,EACR;AACA,MAAA,OAAO,MAAA;AAAA,IACT;AACA,IAAA,OAAO;AAAA,MACL,gBAAA,EAAkB,MAAA,CAAO,MAAA,CAAO,IAAA,EAAM,UAAU,CAAC,CAAA;AAAA,MACjD,qBAAqB,MAAA,CAAO;AAAA,KAC9B;AAAA,EACF;AAAA,EAEA,MAAM,cAAA,CAAe,MAAA,EAAkB,MAAA,EAA6C;AAClF,IAAA,MAAM,MAAA,GAAS,IAAA,CAAK,SAAA,CAAU,KAAA,CAAM,IAAI,MAAM,CAAA;AAE9C,IAAA,IAAI,MAAA,KAAW,UAAa,MAAA,CAAO,QAAA,KAAa,UAAU,CAAC,MAAA,CAAO,UAAU,OAAO,MAAA;AACnF,IAAA,MAAM,WAAW,MAAM,IAAA,CAAK,SAAS,GAAA,CAAI,MAAA,EAAQ,OAAO,WAAW,CAAA;AACnE,IAAA,IAAI,QAAA,EAAU,KAAA,KAAU,WAAA,EAAa,OAAO,MAAA;AAC5C,IAAA,OAAO,IAAA,CAAK,SAAA,CAAU,OAAA,CAAQ,MAAA,EAAQ,KAAK,CAAA;AAAA,EAC7C;AACF;AAGO,IAAM,2BAAN,MAA2D;AAAA,EACvD,SAAA;AAAA,EAET,YAAY,QAAA,EAAgC;AAC1C,IAAA,IAAA,CAAK,SAAA,GAAY,QAAA;AAAA,EACnB;AAAA,EAEA,MAAM,eAAA,CAAgB,MAAA,EAAgB,MAAA,EAAuB,KAAa,GAAA,EAA+B;AACvG,IAAA,IAAI,CAAC,MAAA,CAAO,QAAA,CAAS,GAAG,CAAA,IAAK,IAAA,CAAK,SAAA,CAAU,KAAA,CAAM,GAAA,EAAI,CAAE,OAAA,EAAQ,GAAI,KAAK,OAAO,KAAA;AAChF,IAAA,MAAM,WAAW,MAAM,IAAA,CAAK,UAAU,UAAA,CAAW,MAAA,EAAQ,QAAQ,GAAG,CAAA;AACpE,IAAA,OAAO,IAAA,CAAK,SAAA,CAAU,MAAA,CAAO,eAAA,CAAgB,UAAU,GAAG,CAAA;AAAA,EAC5D;AAAA,EAEA,MAAM,YAAA,CAAa,MAAA,EAAgB,IAAA,EAA4C;AAC7E,IAAA,MAAM,MAAA,GAAS,IAAA,CAAK,SAAA,CAAU,KAAA,CAAM,IAAI,MAAM,CAAA;AAC9C,IAAA,IAAI,WAAW,MAAA,EAAW,OAAO,EAAE,EAAA,EAAI,KAAA,EAAO,QAAQ,gBAAA,EAAiB;AACvE,IAAA,IAAI,MAAA,CAAO,IAAA,CAAK,MAAM,CAAA,KAAM,OAAO,QAAA,EAAU;AAC3C,MAAA,OAAO,EAAE,EAAA,EAAI,KAAA,EAAO,MAAA,EAAQ,CAAA,wBAAA,EAA2B,MAAA,CAAO,MAAA,CAAO,QAAQ,CAAC,CAAA,WAAA,EAAc,IAAA,CAAK,MAAM,CAAA,CAAA,EAAG;AAAA,IAC5G;AACA,IAAA,MAAM,aAAa,MAAM,IAAA,CAAK,SAAA,CAAU,MAAA,CAAO,OAAO,IAAI,CAAA;AAC1D,IAAA,IAAI,UAAA,KAAe,OAAO,WAAA,EAAa;AACrC,MAAA,OAAO,EAAE,EAAA,EAAI,KAAA,EAAO,MAAA,EAAQ,sBAAA,EAAuB;AAAA,IACrD;AACA,IAAA,MAAA,CAAO,IAAA,GAAO,IAAA;AACd,IAAA,MAAA,CAAO,QAAA,GAAW,IAAA;AAClB,IAAA,OAAO,EAAE,IAAI,IAAA,EAAK;AAAA,EACpB;AAAA,EAEA,MAAM,YAAY,MAAA,EAAkD;AAClE,IAAA,MAAM,MAAA,GAAS,IAAA,CAAK,SAAA,CAAU,KAAA,CAAM,IAAI,MAAM,CAAA;AAC9C,IAAA,IAAI,MAAA,KAAW,UAAa,CAAC,MAAA,CAAO,YAAY,MAAA,CAAO,IAAA,KAAS,QAAW,OAAO,MAAA;AAClF,IAAA,OAAO,EAAE,IAAA,EAAM,MAAA,CAAO,IAAA,EAAM,WAAA,EAAa,OAAO,WAAA,EAAY;AAAA,EAC9D;AACF;AAQO,SAAS,oBACd,KAAA,EACA,MAAA,EACA,OAAA,EACA,OAAA,GAAoC,EAAC,EACtB;AACf,EAAA,MAAM,QAAA,GAAW,IAAI,oBAAA,CAAqB,KAAA,EAAO,QAAQ,OAAO,CAAA;AAChE,EAAA,OAAO;AAAA,IACL,KAAA,EAAO,IAAI,sBAAA,CAAuB,QAAA,EAAU,OAAO,CAAA;AAAA,IACnD,YAAA,EAAc,IAAI,wBAAA,CAAyB,QAAQ;AAAA,GACrD;AACF;AAEA,SAAS,oBAAA,CAAqB,QAAkB,WAAA,EAAuC;AACrF,EAAA,IACE,WAAA,CAAY,QAAA,KAAa,MAAA,IACzB,WAAA,CAAY,IAAA,KAAS,QAAA,IACrB,WAAA,CAAY,KAAA,KAAU,UAAA,IACtB,WAAA,CAAY,aAAA,IAAiB,EAAA,EAC7B;AACA,IAAA;AAAA,EACF;AACA,EAAA,MAAM,IAAI,aAAA;AAAA,IACR,4BAAA;AAAA,IACA;AAAA,GACF;AACF;AC9OO,IAAM,0BAAN,MAAyD;AAAA,EACrD,SAAA,uBAAgB,GAAA,EAA0B;AAAA,EAC1C,WAAA,uBAAkB,GAAA,EAAoB;AAAA,EAE/C,MAAM,QAAA,CAAS,MAAA,EAAkB,KAAA,EAAkD;AACjF,IAAA,MAAM,MAAA,GAAuB;AAAA,MAC3B,QAAA,EAAU,MAAA;AAAA,MACV,WAAW,KAAA,CAAM,SAAA;AAAA,MACjB,UAAU,KAAA,CAAM,QAAA;AAAA,MAChB,YAAY,KAAA,CAAM,UAAA;AAAA,MAClB,iBAAiB,KAAA,CAAM,eAAA;AAAA,MACvB,YAAY,KAAA,CAAM,UAAA;AAAA,MAClB,eAAe,KAAA,CAAM,aAAA;AAAA,MACrB,OAAA,EAAS;AAAA,KACX;AACA,IAAA,MAAM,GAAA,GAAMT,SAAAA,CAAU,MAAA,EAAQ,MAAA,CAAO,QAAQ,CAAA;AAC7C,IAAA,IAAA,CAAK,SAAA,CAAU,GAAA,CAAI,GAAA,EAAK,MAAM,CAAA;AAC9B,IAAA,IAAA,CAAK,WAAA,CAAY,GAAA,CAAI,MAAA,CAAO,QAAA,EAAU,GAAG,CAAA;AACzC,IAAA,OAAO,MAAA;AAAA,EACT;AAAA,EAEA,MAAM,GAAA,CAAI,MAAA,EAAkB,QAAA,EAAqD;AAC/E,IAAA,OAAO,KAAK,SAAA,CAAU,GAAA,CAAIA,SAAAA,CAAU,MAAA,EAAQ,QAAQ,CAAC,CAAA;AAAA,EACvD;AAAA,EAEA,MAAM,MAAA,CAAO,MAAA,EAAkB,QAAA,EAAiC;AAC9D,IAAA,MAAM,GAAA,GAAMA,SAAAA,CAAU,MAAA,EAAQ,QAAQ,CAAA;AACtC,IAAA,MAAM,MAAA,GAAS,IAAA,CAAK,SAAA,CAAU,GAAA,CAAI,GAAG,CAAA;AACrC,IAAA,IAAI,WAAW,MAAA,EAAW;AAC1B,IAAA,IAAA,CAAK,SAAA,CAAU,IAAI,GAAA,EAAK,EAAE,GAAG,MAAA,EAAQ,OAAA,EAAS,MAAM,CAAA;AAAA,EACtD;AAAA,EAEA,MAAM,KAAK,MAAA,EAAoD;AAC7D,IAAA,MAAM,MAAA,GAASA,SAAAA,CAAU,MAAA,EAAQ,EAAE,CAAA;AACnC,IAAA,OAAO,CAAC,GAAG,IAAA,CAAK,SAAA,CAAU,SAAS,CAAA,CAChC,MAAA,CAAO,CAAC,CAAC,GAAG,MAAM,GAAA,CAAI,UAAA,CAAW,MAAM,CAAC,CAAA,CACxC,GAAA,CAAI,CAAC,GAAG,MAAM,CAAA,KAAM,MAAM,CAAA;AAAA,EAC/B;AAAA,EAEA,MAAM,kBAAkB,QAAA,EAAqD;AAC3E,IAAA,MAAM,GAAA,GAAM,IAAA,CAAK,WAAA,CAAY,GAAA,CAAI,QAAQ,CAAA;AACzC,IAAA,OAAO,QAAQ,MAAA,GAAY,MAAA,GAAY,IAAA,CAAK,SAAA,CAAU,IAAI,GAAG,CAAA;AAAA,EAC/D;AACF;AC3CO,IAAM,mBAAA,GAAsB;AAE5B,IAAM,4BAAN,MAA6D;AAAA,EACzD,MAAA,uBAAa,GAAA,EAAyB;AAAA,EACtC,SAAA;AAAA,EAET,WAAA,CAAY,WAAmB,mBAAA,EAAqB;AAClD,IAAA,IAAA,CAAK,SAAA,GAAY,QAAA;AAAA,EACnB;AAAA,EAEA,MAAM,cAAA,CAAe,MAAA,EAAkB,QAAA,EAAkB,UAAA,EAAsC;AAC7F,IAAA,MAAM,GAAA,GAAMA,SAAAA,CAAU,MAAA,EAAQ,QAAQ,CAAA;AACtC,IAAA,IAAI,IAAA,GAAO,IAAA,CAAK,MAAA,CAAO,GAAA,CAAI,GAAG,CAAA;AAC9B,IAAA,IAAI,SAAS,MAAA,EAAW;AACtB,MAAA,IAAA,uBAAW,GAAA,EAAY;AACvB,MAAA,IAAA,CAAK,MAAA,CAAO,GAAA,CAAI,GAAA,EAAK,IAAI,CAAA;AAAA,IAC3B;AACA,IAAA,IAAI,IAAA,CAAK,GAAA,CAAI,UAAU,CAAA,EAAG,OAAO,IAAA;AACjC,IAAA,IAAA,CAAK,IAAI,UAAU,CAAA;AACnB,IAAA,IAAI,IAAA,CAAK,IAAA,GAAO,IAAA,CAAK,SAAA,EAAW;AAC9B,MAAA,MAAM,MAAA,GAAS,IAAA,CAAK,MAAA,EAAO,CAAE,MAAK,CAAE,KAAA;AACpC,MAAA,IAAI,MAAA,KAAW,MAAA,EAAW,IAAA,CAAK,MAAA,CAAO,MAAM,CAAA;AAAA,IAC9C;AACA,IAAA,OAAO,KAAA;AAAA,EACT;AACF;ACxBO,IAAM,YAAA,GAAe,IAAI,EAAA,GAAK;AAErC,IAAM,WAAA,GAAc,EAAA;AAQb,IAAM,qBAAN,MAA+C;AAAA,EAC3C,OAAA,uBAAc,GAAA,EAAyB;AAAA,EACvC,MAAA;AAAA,EACA,OAAA;AAAA,EACA,MAAA;AAAA,EAET,WAAA,CAAY,KAAA,EAAc,MAAA,EAAqB,KAAA,GAAgB,YAAA,EAAc;AAC3E,IAAA,IAAA,CAAK,MAAA,GAAS,KAAA;AACd,IAAA,IAAA,CAAK,OAAA,GAAU,MAAA;AACf,IAAA,IAAA,CAAK,MAAA,GAAS,KAAA;AAAA,EAChB;AAAA;AAAA,EAGA,IAAI,IAAA,GAAe;AACjB,IAAA,OAAO,KAAK,OAAA,CAAQ,IAAA;AAAA,EACtB;AAAA,EAEA,MAAM,KAAA,CAAM,MAAA,EAAkB,QAAA,EAAmC;AAC/D,IAAA,MAAM,KAAA,GAAQ,IAAA,CAAK,MAAA,CAAO,GAAA,GAAM,OAAA,EAAQ;AAGxC,IAAA,KAAA,MAAW,CAACY,MAAAA,EAAO,MAAM,CAAA,IAAK,KAAK,OAAA,EAAS;AAC1C,MAAA,IAAI,MAAA,CAAO,QAAQ,MAAA,CAAO,WAAA,IAAe,OAAO,IAAA,CAAK,OAAA,CAAQ,OAAOA,MAAK,CAAA;AAAA,IAC3E;AACA,IAAA,MAAM,KAAA,GAAQ,IAAA,CAAK,OAAA,CAAQ,WAAA,CAAY,WAAW,CAAA;AAClD,IAAA,IAAA,CAAK,OAAA,CAAQ,IAAI,KAAA,EAAO;AAAA,MACtB,KAAA,EAAOZ,SAAAA,CAAU,MAAA,EAAQ,QAAQ,CAAA;AAAA,MACjC,WAAA,EAAa,QAAQ,IAAA,CAAK,MAAA;AAAA,MAC1B,IAAA,EAAM;AAAA,KACP,CAAA;AACD,IAAA,OAAO,KAAA;AAAA,EACT;AAAA,EAEA,MAAM,QAAA,CAAS,MAAA,EAAkB,QAAA,EAAkB,KAAA,EAAiC;AAClF,IAAA,MAAM,MAAA,GAAS,IAAA,CAAK,OAAA,CAAQ,GAAA,CAAI,KAAK,CAAA;AACrC,IAAA,IAAI,MAAA,KAAW,QAAW,OAAO,KAAA;AACjC,IAAA,IAAI,MAAA,CAAO,MAAM,OAAO,KAAA;AACxB,IAAA,IAAI,OAAO,KAAA,KAAUA,SAAAA,CAAU,MAAA,EAAQ,QAAQ,GAAG,OAAO,KAAA;AACzD,IAAA,OAAO,KAAK,MAAA,CAAO,GAAA,EAAI,CAAE,OAAA,MAAa,MAAA,CAAO,WAAA;AAAA,EAC/C;AAAA,EAEA,MAAM,QAAA,CAAS,MAAA,EAAkB,KAAA,EAA8B;AAC7D,IAAA,MAAM,MAAA,GAAS,IAAA,CAAK,OAAA,CAAQ,GAAA,CAAI,KAAK,CAAA;AACrC,IAAA,IAAI,WAAW,MAAA,EAAW;AAC1B,IAAA,IAAI,CAAC,OAAO,KAAA,CAAM,UAAA,CAAWA,UAAU,MAAA,EAAQ,EAAE,CAAC,CAAA,EAAG;AACrD,IAAA,MAAA,CAAO,IAAA,GAAO,IAAA;AAAA,EAChB;AACF;;;AC9CO,IAAM,2BAAN,MAA2D;AAAA,EACvD,MAAA,uBAAa,GAAA,EAA+B;AAAA,EAC5C,MAAA;AAAA,EAET,YAAY,KAAA,EAAc;AACxB,IAAA,IAAA,CAAK,MAAA,GAAS,KAAA;AAAA,EAChB;AAAA,EAEA,MAAM,KAAA,CAAM,MAAA,EAAkB,KAAA,EAAwD;AACpF,IAAA,IAAA,CAAK,MAAA,CAAO,GAAA,CAAI,KAAA,CAAM,IAAA,EAAM;AAAA,MAC1B,QAAQ,EAAE,QAAA,EAAU,MAAA,EAAQ,SAAA,EAAW,MAAM,SAAA,EAAU;AAAA,MACvD,aAAa,IAAI,IAAA,CAAK,KAAA,CAAM,SAAS,EAAE,OAAA,EAAQ;AAAA,MAC/C,IAAA,EAAM;AAAA,KACP,CAAA;AACD,IAAA,OAAO,EAAE,IAAA,EAAM,KAAA,CAAM,IAAA,EAAM,SAAA,EAAW,MAAM,SAAA,EAAU;AAAA,EACxD;AAAA,EAEA,MAAM,OAAO,IAAA,EAAsD;AACjE,IAAA,MAAM,MAAA,GAAS,IAAA,CAAK,MAAA,CAAO,GAAA,CAAI,IAAI,CAAA;AACnC,IAAA,IAAI,MAAA,KAAW,QAAW,OAAO,MAAA;AACjC,IAAA,IAAI,MAAA,CAAO,MAAM,OAAO,MAAA;AACxB,IAAA,IAAI,IAAA,CAAK,OAAO,GAAA,EAAI,CAAE,SAAQ,GAAI,MAAA,CAAO,aAAa,OAAO,MAAA;AAC7D,IAAA,MAAA,CAAO,IAAA,GAAO,IAAA;AACd,IAAA,OAAO,MAAA,CAAO,MAAA;AAAA,EAChB;AACF;ACvCO,IAAM,8BAAN,MAAiE;AAAA,EAC7D,SAAA,uBAAgB,GAAA,EAA4B;AAAA,EAC5C,MAAA;AAAA,EAET,YAAY,KAAA,EAAc;AACxB,IAAA,IAAA,CAAK,MAAA,GAAS,KAAA;AAAA,EAChB;AAAA,EAEA,MAAM,MAAA,CACJ,MAAA,EACA,KAAA,EACwD;AACxD,IAAA,MAAM,GAAA,GAAMA,SAAAA,CAAU,MAAA,EAAQ,KAAA,CAAM,GAAG,CAAA;AACvC,IAAA,MAAM,QAAA,GAAW,IAAA,CAAK,SAAA,CAAU,GAAA,CAAI,GAAG,CAAA;AACvC,IAAA,IAAI,aAAa,MAAA,EAAW,OAAO,EAAE,OAAA,EAAS,QAAA,EAAU,SAAS,KAAA,EAAM;AACvE,IAAA,MAAM,OAAA,GAA0B;AAAA,MAC9B,QAAA,EAAU,MAAA;AAAA,MACV,KAAK,KAAA,CAAM,GAAA;AAAA,MACX,MAAM,KAAA,CAAM,IAAA;AAAA,MACZ,UAAA,EAAY,IAAA,CAAK,MAAA,CAAO,GAAA,GAAM,WAAA;AAAY,KAC5C;AACA,IAAA,IAAA,CAAK,SAAA,CAAU,GAAA,CAAI,GAAA,EAAK,OAAO,CAAA;AAC/B,IAAA,OAAO,EAAE,OAAA,EAAS,OAAA,EAAS,IAAA,EAAK;AAAA,EAClC;AAAA,EAEA,MAAM,GAAA,CAAI,MAAA,EAAkB,GAAA,EAAkD;AAC5E,IAAA,OAAO,KAAK,SAAA,CAAU,GAAA,CAAIA,SAAAA,CAAU,MAAA,EAAQ,GAAG,CAAC,CAAA;AAAA,EAClD;AACF;AC/BO,IAAM,mCAAN,MAA2E;AAAA,EACvE,SAAA,uBAAgB,GAAA,EAAiC;AAAA,EACjD,MAAA;AAAA,EAET,YAAY,KAAA,EAAc;AACxB,IAAA,IAAA,CAAK,MAAA,GAAS,KAAA;AAAA,EAChB;AAAA,EAEA,MAAM,MAAA,CACJ,MAAA,EACA,KAAA,EAC+E;AAC/E,IAAA,MAAM,MAAMA,SAAAA,CAAU,MAAA,EAAQ,KAAA,CAAM,QAAA,EAAU,MAAM,SAAS,CAAA;AAC7D,IAAA,MAAM,QAAA,GAAW,IAAA,CAAK,SAAA,CAAU,GAAA,CAAI,GAAG,CAAA;AACvC,IAAA,IAAI,aAAa,MAAA,EAAW,OAAO,EAAE,OAAA,EAAS,QAAA,EAAU,SAAS,KAAA,EAAM;AACvE,IAAA,MAAM,OAAA,GAA+B;AAAA,MACnC,QAAA,EAAU,MAAA;AAAA,MACV,GAAG,KAAA;AAAA,MACH,UAAA,EAAY,IAAA,CAAK,MAAA,CAAO,GAAA,GAAM,WAAA;AAAY,KAC5C;AACA,IAAA,IAAA,CAAK,SAAA,CAAU,GAAA,CAAI,GAAA,EAAK,OAAO,CAAA;AAC/B,IAAA,OAAO,EAAE,OAAA,EAAS,OAAA,EAAS,IAAA,EAAK;AAAA,EAClC;AAAA,EAEA,MAAM,GAAA,CACJ,MAAA,EACA,QAAA,EACA,SAAA,EAC0C;AAC1C,IAAA,OAAO,KAAK,SAAA,CAAU,GAAA,CAAIA,UAAU,MAAA,EAAQ,QAAA,EAAU,SAAS,CAAC,CAAA;AAAA,EAClE;AACF;AClBO,IAAM,2BAAN,MAA2D;AAAA,EACvD,SAAA,uBAAgB,GAAA,EAAyB;AAAA,EACzC,MAAA;AAAA,EAET,YAAY,KAAA,EAAc;AACxB,IAAA,IAAA,CAAK,MAAA,GAAS,KAAA;AAAA,EAChB;AAAA,EAEA,MAAM,IAAA,CAAK,MAAA,EAAkB,KAAA,EAAmE;AAC9F,IAAA,MAAM,GAAA,GAAMA,SAAAA,CAAU,MAAA,EAAQ,KAAA,CAAM,MAAM,CAAA;AAC1C,IAAA,MAAM,QAAA,GAAW,IAAA,CAAK,SAAA,CAAU,GAAA,CAAI,GAAG,CAAA;AACvC,IAAA,IAAI,QAAA,KAAa,QAAW,OAAO,QAAA;AACnC,IAAA,MAAM,OAAA,GAAuB;AAAA,MAC3B,QAAA,EAAU,MAAA;AAAA,MACV,QAAQ,KAAA,CAAM,MAAA;AAAA,MACd,UAAU,KAAA,CAAM,QAAA;AAAA,MAChB,MAAA,EAAQ,SAAA;AAAA,MACR,SAAA,EAAW,KAAK,IAAA;AAAK,KACvB;AACA,IAAA,IAAA,CAAK,SAAA,CAAU,GAAA,CAAI,GAAA,EAAK,OAAO,CAAA;AAC/B,IAAA,OAAO,OAAA;AAAA,EACT;AAAA,EAEA,MAAM,GAAA,CAAI,MAAA,EAAkB,MAAA,EAAkD;AAC5E,IAAA,OAAO,KAAK,SAAA,CAAU,GAAA,CAAIA,SAAAA,CAAU,MAAA,EAAQ,MAAM,CAAC,CAAA;AAAA,EACrD;AAAA,EAEA,MAAM,KAAA,CAAM,MAAA,EAAkB,KAAA,EAA+E;AAC3G,IAAA,MAAM,GAAA,GAAMA,SAAAA,CAAU,MAAA,EAAQ,KAAA,CAAM,MAAM,CAAA;AAC1C,IAAA,MAAM,QAAA,GAAW,IAAA,CAAK,SAAA,CAAU,GAAA,CAAI,GAAG,CAAA;AACvC,IAAA,IAAI,QAAA,KAAa,QAAW,OAAO,MAAA;AACnC,IAAA,IAAI,QAAA,CAAS,aAAA,KAAkB,MAAA,EAAW,OAAO,QAAA;AACjD,IAAA,MAAM,OAAA,GAAuB;AAAA,MAC3B,GAAG,QAAA;AAAA,MACH,eAAe,KAAA,CAAM,QAAA;AAAA,MACrB,MAAA,EAAQ,SAAA;AAAA,MACR,SAAA,EAAW,KAAK,IAAA;AAAK,KACvB;AACA,IAAA,IAAA,CAAK,SAAA,CAAU,GAAA,CAAI,GAAA,EAAK,OAAO,CAAA;AAC/B,IAAA,OAAO,OAAA;AAAA,EACT;AAAA,EAEA,MAAM,YAAA,CACJ,MAAA,EACA,KAAA,EACkC;AAClC,IAAA,MAAM,GAAA,GAAMA,SAAAA,CAAU,MAAA,EAAQ,KAAA,CAAM,MAAM,CAAA;AAC1C,IAAA,MAAM,QAAA,GAAW,IAAA,CAAK,SAAA,CAAU,GAAA,CAAI,GAAG,CAAA;AACvC,IAAA,IAAI,QAAA,KAAa,QAAW,OAAO,MAAA;AACnC,IAAA,MAAM,OAAA,GAAuB,EAAE,GAAG,QAAA,EAAU,MAAA,EAAQ,MAAM,MAAA,EAAQ,SAAA,EAAW,IAAA,CAAK,IAAA,EAAK,EAAE;AACzF,IAAA,IAAA,CAAK,SAAA,CAAU,GAAA,CAAI,GAAA,EAAK,OAAO,CAAA;AAC/B,IAAA,OAAO,OAAA;AAAA,EACT;AAAA,EAEA,IAAA,GAAe;AACb,IAAA,OAAO,IAAA,CAAK,MAAA,CAAO,GAAA,EAAI,CAAE,WAAA,EAAY;AAAA,EACvC;AACF;;;AChEO,IAAM,wBAAN,MAAqD;AAAA,EAG1D,YAA6B,KAAA,EAAc;AAAd,IAAA,IAAA,CAAA,KAAA,GAAA,KAAA;AAAA,EAAe;AAAA,EAAf,KAAA;AAAA,EAFpB,MAAA,uBAAa,GAAA,EAA0B;AAAA,EAIhD,MAAM,MAAA,CAAO,MAAA,EAAkB,KAAA,EAAmD;AAChF,IAAA,MAAM,QAAA,GAAW,uBAAuB,KAAK,CAAA;AAC7C,IAAA,MAAM,GAAA,GAAM,IAAA,CAAK,KAAA,CAAM,GAAA,EAAI;AAC3B,IAAA,MAAM,UAAA,GAAa,IAAI,WAAA,EAAY;AACnC,IAAA,MAAM,GAAA,GAAM,eAAA,CAAgB,MAAA,EAAQ,KAAA,CAAM,MAAM,CAAA;AAChD,IAAA,MAAM,QAAA,GAAW,IAAA,CAAK,MAAA,CAAO,GAAA,CAAI,GAAG,CAAA;AACpC,IAAA,MAAM,OAAO,QAAA,KAAa,MAAA,IAAa,UAAA,GAAa,QAAA,CAAS,YAAY,QAAA,GAAW,MAAA;AACpF,IAAA,MAAM,QAAA,GAAW,qBAAA,CAAsB,KAAA,EAAO,UAAU,CAAA;AACxD,IAAA,KAAA,MAAW,QAAQ,QAAA,EAAU;AAC3B,MAAA,MAAM,SAAA,GAAY,MAAM,OAAA,CAAQ,IAAA;AAAA,QAC9B,CAAC,KAAA,KACC,KAAA,CAAM,QAAA,KAAa,IAAA,CAAK,QAAA,IACxB,KAAA,CAAM,UAAA,KAAe,IAAA,CAAK,UAAA,IAC1B,KAAA,CAAM,gBAAA,KAAqB,IAAA,CAAK;AAAA,OACpC;AACA,MAAA,IAAI,cAAc,MAAA,EAAW;AAC3B,QAAA,MAAM,IAAI,cAAA;AAAA,UACR,4BAAA;AAAA,UACA,CAAA,oBAAA,EAAuB,IAAA,CAAK,QAAQ,CAAA,EAAA,EAAK,KAAK,UAAU,CAAA,6CAAA;AAAA,SAC1D;AAAA,MACF;AAAA,IACF;AACA,IAAA,MAAM,UAAA,GAAa,CAAC,GAAI,IAAA,EAAM,OAAA,IAAW,EAAC,EAAI,GAAG,QAAQ,CAAA,CAAE,IAAA,CAAK,qBAAqB,CAAA;AACrF,IAAA,MAAM,UAAU,IAAA,CAAK,GAAA,CAAI,UAAA,CAAW,MAAA,GAAS,UAAU,CAAC,CAAA;AACxD,IAAA,MAAM,OAAA,GAAU,UAAA,CAAW,KAAA,CAAM,OAAO,CAAA;AACxC,IAAA,MAAM,MAAA,GAAS,eAAe,OAAO,CAAA;AACrC,IAAA,MAAM,IAAA,GAAqB;AAAA,MACzB,QAAA,EAAU,MAAA;AAAA,MACV,QAAQ,KAAA,CAAM,MAAA;AAAA,MACd,OAAA;AAAA,MACA,GAAI,MAAA,KAAW,MAAA,GAAY,EAAC,GAAI,EAAE,MAAA,EAAO;AAAA,MACzC,OAAA,EAAA,CAAU,IAAA,EAAM,OAAA,IAAW,CAAA,IAAK,MAAM,OAAA,GAAU,OAAA;AAAA,MAChD,QAAA;AAAA,MACA,SAAA,EAAW,IAAI,IAAA,CAAK,GAAA,CAAI,SAAQ,GAAI,KAAA,CAAM,KAAK,CAAA,CAAE,WAAA;AAAY,KAC/D;AACA,IAAA,IAAA,CAAK,MAAA,CAAO,GAAA,CAAI,GAAA,EAAK,IAAI,CAAA;AACzB,IAAA,OAAO,IAAA;AAAA,EACT;AAAA,EAEA,MAAM,IAAA,CAAK,MAAA,EAAkB,MAAA,EAAmD;AAC9E,IAAA,MAAM,GAAA,GAAM,eAAA,CAAgB,MAAA,EAAQ,MAAM,CAAA;AAC1C,IAAA,MAAM,IAAA,GAAO,IAAA,CAAK,MAAA,CAAO,GAAA,CAAI,GAAG,CAAA;AAChC,IAAA,IAAI,IAAA,KAAS,QAAW,OAAO,MAAA;AAC/B,IAAA,IAAI,KAAK,KAAA,CAAM,GAAA,GAAM,WAAA,EAAY,IAAK,KAAK,SAAA,EAAW;AACpD,MAAA,IAAA,CAAK,MAAA,CAAO,OAAO,GAAG,CAAA;AACtB,MAAA,OAAO,MAAA;AAAA,IACT;AACA,IAAA,OAAO,IAAA;AAAA,EACT;AACF;;;ACvDO,IAAM,gCAAN,MAAqE;AAAA,EAG1E,YAA6B,KAAA,EAAc;AAAd,IAAA,IAAA,CAAA,KAAA,GAAA,KAAA;AAAA,EAAe;AAAA,EAAf,KAAA;AAAA,EAFpB,MAAA,uBAAa,GAAA,EAAkC;AAAA,EAIxD,MAAM,MAAA,CACJ,MAAA,EACA,KAAA,EAC+B;AAC/B,IAAA,MAAM,EAAE,QAAA,EAAU,KAAA,EAAO,KAAA,EAAM,GAAI,+BAA+B,KAAK,CAAA;AACvE,IAAA,MAAM,GAAA,GAAM,IAAA,CAAK,KAAA,CAAM,GAAA,EAAI;AAC3B,IAAA,MAAM,UAAA,GAAa,IAAI,WAAA,EAAY;AACnC,IAAA,MAAM,GAAA,GAAM,mBAAA,CAAoB,MAAA,EAAQ,KAAA,CAAM,MAAM,CAAA;AACpD,IAAA,MAAM,QAAA,GAAW,IAAA,CAAK,MAAA,CAAO,GAAA,CAAI,GAAG,CAAA;AACpC,IAAA,MAAM,OAAO,QAAA,KAAa,MAAA,IAAa,UAAA,GAAa,QAAA,CAAS,YAAY,QAAA,GAAW,MAAA;AACpF,IAAA,IAAI,SAAS,MAAA,EAAW;AACtB,MAAA,MAAM,SAAA,GAAY,KAAK,OAAA,CAAQ,IAAA;AAAA,QAC7B,CAAC,KAAA,KAAU,KAAA,CAAM,gBAAA,KAAqB,KAAA,CAAM;AAAA,OAC9C;AACA,MAAA,IAAI,cAAc,MAAA,EAAW;AAC3B,QAAA,IAAI,IAAA,CAAK,UAAU,SAAA,CAAU,KAAK,MAAM,IAAA,CAAK,SAAA,CAAU,KAAK,CAAA,EAAG;AAC7D,UAAA,MAAM,IAAI,cAAA;AAAA,YACR,4BAAA;AAAA,YACA;AAAA,WACF;AAAA,QACF;AACA,QAAA,OAAO,IAAA;AAAA,MACT;AAAA,IACF;AAEA,IAAA,MAAM,QAAA,GAAA,CAAY,IAAA,EAAM,MAAA,IAAU,CAAA,IAAK,CAAA;AACvC,IAAA,MAAM,WAAA,GAAc,0BAA0B,KAAA,CAAM;AAAA,MAClD,QAAQ,KAAA,CAAM,MAAA;AAAA,MACd,kBAAkB,KAAA,CAAM,gBAAA;AAAA,MACxB,QAAA;AAAA,MACA,UAAA;AAAA,MACA;AAAA,KACD,CAAA;AACD,IAAA,MAAM,aAAa,CAAC,GAAI,MAAM,OAAA,IAAW,IAAK,WAAW,CAAA;AACzD,IAAA,MAAM,UAAU,IAAA,CAAK,GAAA,CAAI,UAAA,CAAW,MAAA,GAAS,UAAU,CAAC,CAAA;AACxD,IAAA,MAAM,OAAA,GAAU,UAAA,CAAW,KAAA,CAAM,OAAO,CAAA;AACxC,IAAA,MAAM,IAAA,GAA6B;AAAA,MACjC,QAAA,EAAU,MAAA;AAAA,MACV,QAAQ,KAAA,CAAM,MAAA;AAAA,MACd,OAAA;AAAA,MACA,MAAA,EAAQ,uBAAuB,OAAO,CAAA;AAAA,MACtC,OAAA,EAAA,CAAU,IAAA,EAAM,OAAA,IAAW,CAAA,IAAK,OAAA;AAAA,MAChC,QAAA;AAAA,MACA,SAAA,EAAW,IAAI,IAAA,CAAK,GAAA,CAAI,SAAQ,GAAI,KAAK,EAAE,WAAA;AAAY,KACzD;AACA,IAAA,IAAA,CAAK,MAAA,CAAO,GAAA,CAAI,GAAA,EAAK,IAAI,CAAA;AACzB,IAAA,OAAO,IAAA;AAAA,EACT;AAAA,EAEA,MAAM,IAAA,CAAK,MAAA,EAAkB,MAAA,EAA2D;AACtF,IAAA,MAAM,GAAA,GAAM,mBAAA,CAAoB,MAAA,EAAQ,MAAM,CAAA;AAC9C,IAAA,MAAM,IAAA,GAAO,IAAA,CAAK,MAAA,CAAO,GAAA,CAAI,GAAG,CAAA;AAChC,IAAA,IAAI,IAAA,KAAS,QAAW,OAAO,MAAA;AAC/B,IAAA,IAAI,KAAK,KAAA,CAAM,GAAA,GAAM,WAAA,EAAY,IAAK,KAAK,SAAA,EAAW;AACpD,MAAA,IAAA,CAAK,MAAA,CAAO,OAAO,GAAG,CAAA;AACtB,MAAA,OAAO,MAAA;AAAA,IACT;AACA,IAAA,OAAO,IAAA;AAAA,EACT;AACF,CAAA;;;ACrBO,SAAS,yBAAA,CACd,KAAA,EACA,MAAA,EACA,OAAA,EAC0B;AAC1B,EAAA,MAAM,KAAA,GAAQ,mBAAA,CAAoB,KAAA,EAAO,MAAA,EAAQ,OAAO,CAAA;AACxD,EAAA,OAAO;AAAA,IACL,MAAA,EAAQ;AAAA,MACN,QAAA,EAAU,IAAI,qBAAA,CAAsB,KAAK,CAAA;AAAA,MACzC,SAAA,EAAW,IAAI,6BAAA,CAA8B,KAAK,CAAA;AAAA,MAClD,OAAA,EAAS,IAAI,uBAAA,EAAwB;AAAA,MACrC,YAAA,EAAc,IAAI,wBAAA,CAAyB,KAAK,CAAA;AAAA,MAChD,MAAA,EAAQ,IAAI,kBAAA,CAAmB,KAAA,EAAO,MAAM,CAAA;AAAA,MAC5C,KAAA,EAAO,IAAI,yBAAA,EAA0B;AAAA,MACrC,KAAA,EAAO,IAAI,wBAAA,CAAyB,KAAK,CAAA;AAAA,MACzC,QAAA,EAAU,IAAI,2BAAA,CAA4B,KAAK,CAAA;AAAA,MAC/C,aAAA,EAAe,IAAI,gCAAA,CAAiC,KAAK,CAAA;AAAA,MACzD,OAAO,KAAA,CAAM,KAAA;AAAA,MACb,WAAA,EAAa,IAAI,mBAAA;AAAoB,KACvC;AAAA,IACA,kBAAkB,KAAA,CAAM;AAAA,GAC1B;AACF;;;ACpDA,IAAM,kBAAA,GAAqB,EAAA;AAW3B,SAAS,WAAA,GAAqB;AAC5B,EAAA,OAAO,EAAE,GAAA,EAAK,sBAAM,IAAI,MAAK,EAAE;AACjC;AAmDO,SAAS,uBAAA,CAAwB,OAAA,GAAoC,EAAC,EAAsB;AACjG,EAAA,MAAM,KAAA,GAAQ,OAAA,CAAQ,KAAA,IAAS,WAAA,EAAY;AAC3C,EAAA,MAAM,MAAA,GAAS,OAAA,CAAQ,MAAA,IAAU,eAAA,EAAgB;AACjD,EAAA,MAAM,IAAA,GAAO,wBAAA,CAAyB,EAAE,KAAA,EAAO,CAAA,CAAE,MAAA;AACjD,EAAA,MAAM,EAAE,QAAQ,gBAAA,EAAiB,GAAI,0BAA0B,KAAA,EAAO,MAAA,EAAQ,KAAK,OAAO,CAAA;AAC1F,EAAA,MAAM,WAAA,GACJ,OAAA,CAAQ,WAAA,IACR,qBAAA,CAAsB,UAAA,CAAW,MAAA,CAAO,eAAA,CAAgB,IAAI,UAAA,CAAW,kBAAkB,CAAC,CAAA,EAAG,KAAK,CAAA;AAEpG,EAAA,MAAM,QAAQ,eAAA,CAAgB;AAAA,IAC5B,IAAA;AAAA,IACA,KAAA,EAAO,MAAA;AAAA;AAAA;AAAA;AAAA;AAAA,IAKP,gBAAA;AAAA,IACA,MAAA;AAAA,IACA,WAAA;AAAA,IACA,KAAA;AAAA,IACA,YAAA,EAAc,OAAA,CAAQ,YAAA,IAAgB,yBAAA,EAA0B;AAAA,IAChE,GAAI,QAAQ,cAAA,KAAmB,MAAA,GAAY,EAAC,GAAI,EAAE,cAAA,EAAgB,OAAA,CAAQ,cAAA,EAAe;AAAA,IACzF,GAAI,QAAQ,oBAAA,KAAyB,MAAA,GACjC,EAAC,GACD,EAAE,oBAAA,EAAsB,OAAA,CAAQ,oBAAA,EAAqB;AAAA,IACzD,GAAI,QAAQ,UAAA,KAAe,MAAA,GAAY,EAAE,UAAA,EAAY,OAAA,CAAQ,UAAA,EAAW,GAAI,EAAC;AAAA,IAC7E,GAAI,QAAQ,gBAAA,KAAqB,MAAA,GAAY,EAAE,gBAAA,EAAkB,OAAA,CAAQ,gBAAA,EAAiB,GAAI,EAAC;AAAA,IAC/F,GAAI,QAAQ,cAAA,KAAmB,MAAA,GAAY,EAAE,cAAA,EAAgB,OAAA,CAAQ,cAAA,EAAe,GAAI,EAAC;AAAA,IACzF,GAAI,QAAQ,kBAAA,KAAuB,MAAA,GAAY,EAAE,kBAAA,EAAoB,OAAA,CAAQ,kBAAA,EAAmB,GAAI,EAAC;AAAA,IACrG,GAAI,QAAQ,eAAA,KAAoB,MAAA,GAAY,EAAE,eAAA,EAAiB,OAAA,CAAQ,eAAA,EAAgB,GAAI,EAAC;AAAA,IAC5F,GAAI,QAAQ,qBAAA,KAA0B,MAAA,GAClC,EAAE,qBAAA,EAAuB,OAAA,CAAQ,qBAAA,EAAsB,GACvD,EAAC;AAAA,IACL,GAAI,QAAQ,cAAA,KAAmB,MAAA,GAAY,EAAC,GAAI,EAAE,cAAA,EAAgB,OAAA,CAAQ,cAAA,EAAe;AAAA,IACzF,GAAI,QAAQ,0BAAA,KAA+B,MAAA,GACvC,EAAC,GACD,EAAE,0BAAA,EAA4B,OAAA,CAAQ,0BAAA,EAA2B;AAAA,IACrE,GAAI,QAAQ,8BAAA,KAAmC,MAAA,GAC3C,EAAC,GACD,EAAE,8BAAA,EAAgC,OAAA,CAAQ,8BAAA,EAA+B;AAAA,IAC7E,GAAI,QAAQ,mCAAA,KAAwC,MAAA,GAChD,EAAC,GACD,EAAE,mCAAA,EAAqC,OAAA,CAAQ,mCAAA,EAAoC;AAAA,IACvF,GAAI,QAAQ,oBAAA,KAAyB,MAAA,GACjC,EAAC,GACD,EAAE,oBAAA,EAAsB,OAAA,CAAQ,oBAAA,EAAqB;AAAA,IACzD,GAAI,QAAQ,kBAAA,KAAuB,MAAA,GAC/B,EAAC,GACD,EAAE,kBAAA,EAAoB,OAAA,CAAQ,kBAAA,EAAmB;AAAA,IACrD,GAAI,QAAQ,aAAA,KAAkB,MAAA,GAAY,EAAC,GAAI,EAAE,aAAA,EAAe,OAAA,CAAQ,aAAA,EAAc;AAAA,IACtF,GAAI,QAAQ,yBAAA,KAA8B,MAAA,GACtC,EAAC,GACD,EAAE,yBAAA,EAA2B,OAAA,CAAQ,yBAAA,EAA0B;AAAA,IACnE,GAAI,QAAQ,sBAAA,KAA2B,MAAA,GACnC,EAAC,GACD,EAAE,sBAAA,EAAwB,OAAA,CAAQ,sBAAA,EAAuB;AAAA,IAC7D,GAAI,QAAQ,iBAAA,KAAsB,MAAA,GAAY,EAAC,GAAI,EAAE,iBAAA,EAAmB,OAAA,CAAQ,iBAAA,EAAkB;AAAA,IAClG,GAAI,QAAQ,gBAAA,KAAqB,MAAA,GAAY,EAAC,GAAI,EAAE,gBAAA,EAAkB,OAAA,CAAQ,gBAAA,EAAiB;AAAA,IAC/F,GAAI,QAAQ,gBAAA,KAAqB,MAAA,GAAY,EAAC,GAAI,EAAE,gBAAA,EAAkB,OAAA,CAAQ,gBAAA,EAAiB;AAAA,IAC/F,GAAI,QAAQ,aAAA,KAAkB,MAAA,GAAY,EAAC,GAAI,EAAE,aAAA,EAAe,OAAA,CAAQ,aAAA,EAAc;AAAA,IACtF,GAAI,QAAQ,oBAAA,KAAyB,MAAA,GACjC,EAAC,GACD,EAAE,oBAAA,EAAsB,OAAA,CAAQ,oBAAA,EAAqB;AAAA,IACzD,GAAI,QAAQ,UAAA,KAAe,MAAA,GAAY,EAAC,GAAI,EAAE,UAAA,EAAY,OAAA,CAAQ,UAAA,EAAW;AAAA,IAC7E,GAAI,QAAQ,kBAAA,KAAuB,MAAA,GAC/B,EAAC,GACD,EAAE,kBAAA,EAAoB,OAAA,CAAQ,kBAAA;AAAmB,GACtD,CAAA;AAED,EAAA,OAAO,EAAE,KAAA,EAAO,IAAA,EAAM,MAAA,EAAQ,gBAAA,EAAkB,OAAO,MAAA,EAAO;AAChE;ACrJA,IAAM,mBAAA,GAAsBF,EAAE,MAAA,CAAO;AAAA,EACnC,QAAA,EAAUA,EAAE,MAAA,EAAO;AAAA,EACnB,MAAA,EAAQA,EAAE,MAAA,EAAO;AAAA,EACjB,OAAA,EAASA,EAAE,MAAA,EAAO;AAAA,EAClB,KAAA,EAAOA,EAAE,MAAA,EAAO;AAAA,EAChB,MAAA,EAAQA,CAAAA,CAAE,IAAA,CAAKe,cAAc,CAAA;AAAA,EAC7B,QAAA,EAAUf,CAAAA,CACP,MAAA,CAAO,EAAE,UAAUA,CAAAA,CAAE,MAAA,EAAO,EAAG,SAAA,EAAWA,CAAAA,CAAE,MAAA,EAAO,EAAG,EACtD,QAAA,EAAS;AAAA,EACZ,UAAUA,CAAAA,CAAE,MAAA,EAAO,CAAE,GAAA,GAAM,WAAA,EAAY;AAAA,EACvC,SAAA,EAAWA,EAAE,MAAA,EAAO;AAAA,EACpB,SAAA,EAAWA,EAAE,MAAA;AACf,CAAC,CAAA;AAED,IAAM,mBAAA,GAAsBA,EAAE,MAAA,CAAO;AAAA,EACnC,KAAA,EAAOA,CAAAA,CAAE,KAAA,CAAM,mBAAmB,CAAA;AAAA,EAClC,SAASA,CAAAA,CAAE,MAAA,EAAO,CAAE,GAAA,GAAM,WAAA,EAAY;AAAA,EACtC,OAAA,EAASA,EAAE,OAAA;AACb,CAAC,CAAA;AAUM,IAAM,uBAAA,GAAN,cAAsC,KAAA,CAAM;AAAA,EACjD,WAAA,CAAY,SAAiB,OAAA,EAAwB;AACnD,IAAA,KAAA,CAAM,SAAS,OAAO,CAAA;AACtB,IAAA,IAAA,CAAK,IAAA,GAAO,yBAAA;AAAA,EACd;AACF;AAEO,IAAM,qBAAA,GAAN,cAAoC,KAAA,CAAM;AAAA,EAC/C,YAAY,OAAA,EAAiB;AAC3B,IAAA,KAAA,CAAM,OAAO,CAAA;AACb,IAAA,IAAA,CAAK,IAAA,GAAO,uBAAA;AAAA,EACd;AACF;AAmBO,IAAM,kBAAN,MAAsB;AAAA,EAClB,IAAA;AAAA,EACA,KAAA;AAAA,EACA,YAAA;AAAA,EACA,MAAA;AAAA,EACA,eAAA;AAAA,EAET,YAAY,OAAA,EAAiC;AAC3C,IAAA,gBAAA,CAAiB,OAAA,CAAQ,YAAA,EAAc,kBAAA,CAAmB,iBAAiB,CAAA;AAC3E,IAAA,IAAA,CAAK,OAAOgB,aAAAA,CAAc,OAAA,CAAQ,cAAc,kBAAA,CAAmB,QAAQ,IAAI,KAAA,GAAQ,MAAA;AACvF,IAAA,IAAA,CAAK,KAAA,GAAQ,IAAI,GAAA,CAAI,OAAA,CAAQ,OAAO,CAAA;AACpC,IAAA,IAAA,CAAK,eAAe,OAAA,CAAQ,WAAA;AAC5B,IAAA,IAAA,CAAK,MAAA,GAAS,OAAA,CAAQ,KAAA,IAAS,UAAA,CAAW,KAAA;AAC1C,IAAA,IAAA,CAAK,eAAA,GAAkB,QAAQ,cAAA,IAAkB,GAAA;AAAA,EACnD;AAAA,EAEA,MAAM,QAAA,CAAS,QAAA,EAAkB,MAAA,EAA8C;AAC7E,IAAA,IAAI,CAAC,MAAA,CAAO,aAAA,CAAc,QAAQ,CAAA,IAAK,WAAW,CAAA,EAAG;AACnD,MAAA,MAAM,IAAI,UAAU,+CAA+C,CAAA;AAAA,IACrE;AACA,IAAA,OAAO,IAAA,CAAK,IAAA,KAAS,KAAA,GACjB,IAAA,CAAK,YAAA,CAAa,QAAA,EAAU,MAAM,CAAA,GAClC,IAAA,CAAK,aAAA,CAAc,QAAA,EAAU,MAAM,CAAA;AAAA,EACzC;AAAA,EAEA,MAAM,aAAA,CAAc,QAAA,EAAkB,MAAA,EAA8C;AAClF,IAAA,MAAM,GAAA,GAAM,IAAI,GAAA,CAAIC,eAAAA,EAAiB,KAAK,KAAK,CAAA;AAC/C,IAAA,GAAA,CAAI,YAAA,CAAa,GAAA,CAAI,OAAA,EAAS,MAAA,CAAO,QAAQ,CAAC,CAAA;AAC9C,IAAA,MAAM,QAAA,GAAW,MAAM,IAAA,CAAK,MAAA,CAAO,GAAA,EAAK;AAAA,MACtC,SAAS,EAAE,aAAA,EAAe,CAAA,OAAA,EAAU,IAAA,CAAK,YAAY,CAAA,CAAA,EAAG;AAAA,MACxD,GAAI,MAAA,KAAW,MAAA,GAAY,EAAC,GAAI,EAAE,MAAA;AAAO,KAC1C,CAAA;AACD,IAAA,mBAAA,CAAoB,UAAU,MAAM,CAAA;AACpC,IAAA,OAAO,EAAE,IAAA,EAAM,MAAA,EAAQ,IAAA,EAAM,mBAAA,CAAoB,MAAM,MAAM,QAAA,CAAS,IAAA,EAAM,CAAA,EAAE;AAAA,EAChF;AAAA,EAEA,MAAM,YAAA,CAAa,QAAA,EAAkB,MAAA,EAA8C;AACjF,IAAA,MAAM,GAAA,GAAM,IAAI,GAAA,CAAIC,sBAAAA,EAAwB,KAAK,KAAK,CAAA;AACtD,IAAA,MAAM,QAAA,GAAW,MAAM,IAAA,CAAK,MAAA,CAAO,GAAA,EAAK;AAAA,MACtC,OAAA,EAAS;AAAA,QACP,MAAA,EAAQ,mBAAA;AAAA,QACR,aAAA,EAAe,CAAA,OAAA,EAAU,IAAA,CAAK,YAAY,CAAA,CAAA;AAAA,QAC1C,eAAA,EAAiB,OAAO,QAAQ;AAAA,OAClC;AAAA,MACA,GAAI,MAAA,KAAW,MAAA,GAAY,EAAC,GAAI,EAAE,MAAA;AAAO,KAC1C,CAAA;AACD,IAAA,mBAAA,CAAoB,UAAU,KAAK,CAAA;AACnC,IAAA,IAAI,SAAS,IAAA,KAAS,IAAA,EAAM,MAAM,IAAI,wBAAwB,iCAAiC,CAAA;AAE/F,IAAA,MAAM,MAAA,GAAS,QAAA,CAAS,IAAA,CAAK,SAAA,EAAU;AACvC,IAAA,MAAM,OAAA,GAAU,IAAI,WAAA,EAAY;AAChC,IAAA,IAAI,MAAA,GAAS,EAAA;AACb,IAAA,IAAI;AACF,MAAA,OAAO,IAAA,EAAM;AACX,QAAA,MAAM,KAAA,GAAQ,MAAM,gBAAA,CAAiB,MAAA,EAAQ,KAAK,eAAe,CAAA;AACjE,QAAA,IAAI,KAAA,CAAM,IAAA,EAAM,MAAM,IAAI,wBAAwB,wCAAwC,CAAA;AAC1F,QAAA,MAAA,IAAU,OAAA,CAAQ,MAAA,CAAO,KAAA,CAAM,KAAA,EAAO,EAAE,MAAA,EAAQ,IAAA,EAAM,CAAA,CAAE,UAAA,CAAW,MAAA,EAAQ,IAAI,CAAA;AAC/E,QAAA,IAAI,QAAA,GAAW,MAAA,CAAO,OAAA,CAAQ,MAAM,CAAA;AACpC,QAAA,OAAO,YAAY,CAAA,EAAG;AACpB,UAAA,MAAM,KAAA,GAAQ,MAAA,CAAO,KAAA,CAAM,CAAA,EAAG,QAAQ,CAAA;AACtC,UAAA,MAAA,GAAS,MAAA,CAAO,KAAA,CAAM,QAAA,GAAW,CAAC,CAAA;AAClC,UAAA,MAAM,MAAA,GAAS,cAAc,KAAK,CAAA;AAClC,UAAA,IAAI,MAAA,KAAW,QAAW,OAAO,MAAA;AACjC,UAAA,QAAA,GAAW,MAAA,CAAO,QAAQ,MAAM,CAAA;AAAA,QAClC;AAAA,MACF;AAAA,IACF,CAAA,SAAE;AACA,MAAA,MAAM,MAAA,CAAO,MAAA,EAAO,CAAE,KAAA,CAAM,MAAM,MAAS,CAAA;AAAA,IAC7C;AAAA,EACF;AACF;AAEA,SAAS,mBAAA,CAAoB,UAAoB,SAAA,EAAiC;AAChF,EAAA,IAAI,QAAA,CAAS,WAAW,GAAA,EAAK;AAC3B,IAAA,MAAM,IAAI,sBAAsB,sCAAsC,CAAA;AAAA,EACxE;AACA,EAAA,IAAI,SAAS,EAAA,EAAI;AACjB,EAAA,IAAI,QAAA,CAAS,UAAU,GAAA,EAAK;AAC1B,IAAA,MAAM,IAAI,uBAAA,CAAwB,CAAA,MAAA,EAAS,SAAS,CAAA,kBAAA,EAAqB,QAAA,CAAS,MAAM,CAAA,CAAA,CAAG,CAAA;AAAA,EAC7F;AACA,EAAA,MAAM,IAAI,qBAAA;AAAA,IACR,CAAA,MAAA,EAAS,SAAS,CAAA,8BAAA,EAAiC,QAAA,CAAS,MAAM,CAAA,CAAA;AAAA,GACpE;AACF;AAEA,eAAe,gBAAA,CACb,QACA,SAAA,EACA;AACA,EAAA,IAAI,KAAA;AACJ,EAAA,IAAI;AACF,IAAA,OAAO,MAAM,QAAQ,IAAA,CAAK;AAAA,MACxB,OAAO,IAAA,EAAK;AAAA,MACZ,IAAI,OAAA,CAAe,CAAC,CAAA,EAAG,MAAA,KAAW;AAChC,QAAA,KAAA,GAAQ,UAAA;AAAA,UACN,MAAM,MAAA,CAAO,IAAI,uBAAA,CAAwB,kCAAkC,CAAC,CAAA;AAAA,UAC5E;AAAA,SACF;AAAA,MACF,CAAC;AAAA,KACF,CAAA;AAAA,EACH,CAAA,SAAE;AACA,IAAA,IAAI,KAAA,KAAU,MAAA,EAAW,YAAA,CAAa,KAAK,CAAA;AAAA,EAC7C;AACF;AAEA,SAAS,cAAc,KAAA,EAA0C;AAC/D,EAAA,IAAI,MAAM,MAAA,KAAW,CAAA,IAAK,MAAM,UAAA,CAAW,GAAG,GAAG,OAAO,MAAA;AACxD,EAAA,IAAI,KAAA,GAAQ,SAAA;AACZ,EAAA,MAAM,OAAiB,EAAC;AACxB,EAAA,KAAA,MAAW,IAAA,IAAQ,KAAA,CAAM,KAAA,CAAM,IAAI,CAAA,EAAG;AACpC,IAAA,IAAI,IAAA,CAAK,UAAA,CAAW,QAAQ,CAAA,EAAG,KAAA,GAAQ,KAAK,KAAA,CAAM,QAAA,CAAS,MAAM,CAAA,CAAE,SAAA,EAAU;AAC7E,IAAA,IAAI,IAAA,CAAK,UAAA,CAAW,OAAO,CAAA,EAAG,IAAA,CAAK,IAAA,CAAK,IAAA,CAAK,KAAA,CAAM,OAAA,CAAQ,MAAM,CAAA,CAAE,SAAA,EAAW,CAAA;AAAA,EAChF;AACA,EAAA,IAAI,KAAA,KAAU,WAAA,EAAa,OAAO,EAAE,MAAM,WAAA,EAAY;AACtD,EAAA,IAAI,KAAA,KAAU,SAAS,OAAO,MAAA;AAC9B,EAAA,IAAI,KAAK,MAAA,KAAW,CAAA,EAAG,MAAM,IAAI,YAAY,oCAAoC,CAAA;AACjF,EAAA,OAAO,EAAE,IAAA,EAAM,OAAA,EAAS,IAAA,EAAM,mBAAA,CAAoB,KAAA,CAAM,IAAA,CAAK,KAAA,CAAM,IAAA,CAAK,IAAA,CAAK,IAAI,CAAC,CAAC,CAAA,EAAE;AACvF;;;ACvCO,IAAM,qBAAA,GAAwB;AAAA,EACnC,SAAA;AAAA,EACA,SAAA;AAAA,EACA,SAAA;AAAA,EACA,UAAA;AAAA,EACA,QAAA;AAAA,EACA;AACF;AA6MO,IAAM,iBAAA,GAAoB;AAAA,EAC/B,UAAA;AAAA,EACA,WAAA;AAAA,EACA,SAAA;AAAA,EACA,cAAA;AAAA,EACA,QAAA;AAAA,EACA,OAAA;AAAA,EACA,OAAA;AAAA,EACA,UAAA;AAAA,EACA,eAAA;AAAA,EACA,OAAA;AAAA,EACA;AACF;;;ACjWO,IAAM,kBAAA,GAA0E;AAAA,EACrF,QAAA,EAAU,CAAC,QAAA,EAAU,MAAM,CAAA;AAAA,EAC3B,SAAA,EAAW,CAAC,QAAA,EAAU,MAAM,CAAA;AAAA,EAC5B,SAAS,CAAC,UAAA,EAAY,KAAA,EAAO,QAAA,EAAU,QAAQ,mBAAmB,CAAA;AAAA,EAClE,YAAA,EAAc,CAAC,OAAA,EAAS,QAAQ,CAAA;AAAA,EAChC,MAAA,EAAQ,CAAC,OAAA,EAAS,UAAA,EAAY,UAAU,CAAA;AAAA,EACxC,KAAA,EAAO,CAAC,gBAAgB,CAAA;AAAA,EACxB,KAAA,EAAO,CAAC,MAAA,EAAQ,KAAA,EAAO,SAAS,cAAc,CAAA;AAAA,EAC9C,QAAA,EAAU,CAAC,QAAA,EAAU,KAAK,CAAA;AAAA,EAC1B,aAAA,EAAe,CAAC,QAAA,EAAU,KAAK,CAAA;AAAA;AAAA;AAAA;AAAA,EAI/B,KAAA,EAAO,CAAC,cAAA,EAAgB,eAAA,EAAiB,gBAAgB,CAAA;AAAA,EACzD,WAAA,EAAa,CAAC,SAAS;AACzB;AAGO,IAAM,qBAAA,GAAkE;AAAA,EAC7E,QAAA,EAAU,eAAA;AAAA,EACV,SAAA,EAAW,uBAAA;AAAA,EACX,OAAA,EAAS,iBAAA;AAAA,EACT,YAAA,EAAc,kBAAA;AAAA,EACd,MAAA,EAAQ,YAAA;AAAA,EACR,KAAA,EAAO,mBAAA;AAAA,EACP,KAAA,EAAO,kBAAA;AAAA,EACP,QAAA,EAAU,qBAAA;AAAA,EACV,aAAA,EAAe,0BAAA;AAAA,EACf,KAAA,EAAO,gBAAA;AAAA,EACP,WAAA,EAAa;AACf","file":"index.js","sourcesContent":["/**\n * The reference {@link CloudCrypto}, built entirely on the WebCrypto API that\n * Node >=20, Cloudflare Workers, and Deno all expose as `globalThis.crypto`.\n *\n * No `node:crypto`, no dependency: the point of the port is that a hosted\n * composition stays runtime-neutral, and an adapter that reached for a Node\n * built-in here would make that claim false for the default composition.\n */\nimport type { CloudCrypto } from './port';\n\n/** Short, human-typeable pairing code alphabet — no `0/O`, no `1/I` (mirrors the reference server's). */\nconst PAIRING_CODE_ALPHABET = 'ABCDEFGHJKLMNPQRSTUVWXYZ23456789';\n\nconst HEX_DIGITS = '0123456789abcdef';\n\nexport function base64UrlEncode(bytes: Uint8Array): string {\n let binary = '';\n for (const byte of bytes) binary += String.fromCharCode(byte);\n return btoa(binary).replaceAll('+', '-').replaceAll('/', '_').replaceAll('=', '');\n}\n\n/**\n * Decode base64url. Returns `undefined` rather than throwing for input that\n * is not base64url at all — every caller here is verifying attacker-supplied\n * material, where \"not decodable\" and \"does not verify\" must be the same\n * answer.\n */\nexport function base64UrlDecode(value: string): Uint8Array | undefined {\n const padded = value.replaceAll('-', '+').replaceAll('_', '/');\n try {\n const binary = atob(padded);\n const bytes = new Uint8Array(binary.length);\n for (let index = 0; index < binary.length; index += 1) bytes[index] = binary.charCodeAt(index);\n return bytes;\n } catch {\n return undefined;\n }\n}\n\nfunction toHex(bytes: Uint8Array): string {\n let out = '';\n for (const byte of bytes) {\n out += HEX_DIGITS[(byte >> 4) & 0xf];\n out += HEX_DIGITS[byte & 0xf];\n }\n return out;\n}\n\n/**\n * WebCrypto's own types are derived from the runtime's `globalThis.crypto`\n * rather than named directly: `CryptoKey`/`SubtleCrypto`/`KeyUsage` are DOM\n * lib globals, and this package compiles without the DOM lib (a Workers build\n * has no DOM either). Deriving keeps the types exact without pulling in a\n * `node:` import or widening `lib`.\n */\nexport type SubtleCryptoLike = typeof globalThis.crypto.subtle;\nexport type CryptoKeyLike = Awaited<ReturnType<SubtleCryptoLike['importKey']>>;\nexport type KeyUsageLike = Parameters<SubtleCryptoLike['importKey']>[4][number];\n\nfunction subtle(): SubtleCryptoLike {\n const webCrypto = globalThis.crypto;\n if (webCrypto?.subtle === undefined) {\n throw new Error('@byok-sdk/cloud requires a WebCrypto implementation on globalThis.crypto');\n }\n return webCrypto.subtle;\n}\n\nexport function createWebCrypto(): CloudCrypto {\n return {\n randomUuid(): string {\n return globalThis.crypto.randomUUID();\n },\n\n randomToken(byteLength: number): string {\n return base64UrlEncode(globalThis.crypto.getRandomValues(new Uint8Array(byteLength)));\n },\n\n randomPairingCode(length: number): string {\n const bytes = globalThis.crypto.getRandomValues(new Uint8Array(length));\n let out = '';\n for (const byte of bytes) {\n out += PAIRING_CODE_ALPHABET[byte % PAIRING_CODE_ALPHABET.length];\n }\n return out;\n },\n\n async verifyEd25519(\n publicKeyBase64Url: string,\n message: string | Uint8Array,\n signature: string,\n ): Promise<boolean> {\n const signatureBytes = base64UrlDecode(signature);\n if (signatureBytes === undefined) return false;\n try {\n const key = await subtle().importKey(\n 'jwk',\n { kty: 'OKP', crv: 'Ed25519', x: publicKeyBase64Url },\n { name: 'Ed25519' },\n false,\n ['verify'],\n );\n const messageBytes = typeof message === 'string' ? new TextEncoder().encode(message) : message;\n return await subtle().verify({ name: 'Ed25519' }, key, signatureBytes, messageBytes);\n } catch {\n // A key that will not import is a key that cannot have signed this —\n // same answer as a bad signature, with no distinguishing error.\n return false;\n }\n },\n\n async hmacSha256(secret: Uint8Array, message: string): Promise<string> {\n const key = await subtle().importKey('raw', secret, { name: 'HMAC', hash: 'SHA-256' }, false, ['sign']);\n const signature = await subtle().sign('HMAC', key, new TextEncoder().encode(message));\n return base64UrlEncode(new Uint8Array(signature));\n },\n\n async sha256(data: Uint8Array): Promise<string> {\n const digest = await subtle().digest('SHA-256', data);\n return `sha256:${toHex(new Uint8Array(digest))}`;\n },\n\n timingSafeEqual(left: string, right: string): boolean {\n const leftBytes = base64UrlDecode(left);\n const rightBytes = base64UrlDecode(right);\n if (leftBytes === undefined || rightBytes === undefined) return false;\n if (leftBytes.length !== rightBytes.length) return false;\n let diff = 0;\n for (let index = 0; index < leftBytes.length; index += 1) {\n diff |= (leftBytes[index] ?? 0) ^ (rightBytes[index] ?? 0);\n }\n return diff === 0;\n },\n };\n}\n","/**\n * Access tokens for the hosted device surface (docs/protocol.md §6).\n *\n * The token carries the identity TRIPLE — `(deviceId, tenantId, productId)` —\n * and all three legs are lookup keys, never authority: `authenticateBearer`\n * (`bearer.ts`) resolves them against the device directory and answers with\n * the ROW's identity. A token missing a leg is not a partially usable token;\n * it is not a token this deployment minted.\n *\n * {@link TokenSigner} is a port for the same reason `@byok-sdk/server` made it\n * one: a SaaS with an org-wide asymmetric signer or a KMS swaps its own in.\n * The reference implementation below is HS256 over a caller-supplied secret,\n * built on WebCrypto so the package stays runtime-neutral (no `jose`, no\n * `node:crypto`).\n */\nimport type { Clock } from '@byok-sdk/core';\nimport {\n base64UrlDecode,\n base64UrlEncode,\n type CryptoKeyLike,\n type KeyUsageLike,\n} from '../crypto/web-crypto';\n\n/** Access tokens are ~1h, matching the reference server (docs/protocol.md §6.1/§6.2). */\nexport const ACCESS_TOKEN_TTL_SECONDS = 60 * 60;\n\nexport interface AccessTokenClaims {\n readonly deviceId: string;\n /** Unbranded on the wire: the value is only a lookup key until a device row vouches for it. */\n readonly tenantId: string;\n readonly productId: string;\n}\n\nexport interface TokenSigner {\n sign(claims: AccessTokenClaims, expiresInSeconds: number): Promise<string>;\n /** Claims for a valid, unexpired token, or `undefined` for invalid/expired/malformed — no reason is ever reported. */\n verify(token: string): Promise<AccessTokenClaims | undefined>;\n}\n\ninterface TokenPayload {\n readonly deviceId: unknown;\n readonly tenantId: unknown;\n readonly productId: unknown;\n readonly exp: unknown;\n}\n\nfunction encodeSegment(value: unknown): string {\n return base64UrlEncode(new TextEncoder().encode(JSON.stringify(value)));\n}\n\n/**\n * HS256 JWT signer over `secret`.\n *\n * `clock` is injected rather than read off `Date.now()` so expiry is testable\n * and so the whole package keeps a single notion of \"now\" (the same one the\n * stores use for TTLs).\n */\nexport function createHmacTokenSigner(secret: Uint8Array, clock: Clock): TokenSigner {\n async function signingKey(usage: KeyUsageLike): Promise<CryptoKeyLike> {\n return globalThis.crypto.subtle.importKey('raw', secret, { name: 'HMAC', hash: 'SHA-256' }, false, [usage]);\n }\n\n async function signature(signingInput: string): Promise<string> {\n const key = await signingKey('sign');\n const bytes = await globalThis.crypto.subtle.sign('HMAC', key, new TextEncoder().encode(signingInput));\n return base64UrlEncode(new Uint8Array(bytes));\n }\n\n return {\n async sign(claims, expiresInSeconds) {\n const issuedAt = Math.floor(clock.now().getTime() / 1000);\n const header = encodeSegment({ alg: 'HS256', typ: 'JWT' });\n const payload = encodeSegment({\n deviceId: claims.deviceId,\n tenantId: claims.tenantId,\n productId: claims.productId,\n iat: issuedAt,\n exp: issuedAt + expiresInSeconds,\n });\n const signingInput = `${header}.${payload}`;\n return `${signingInput}.${await signature(signingInput)}`;\n },\n\n async verify(token) {\n const parts = token.split('.');\n if (parts.length !== 3) return undefined;\n const [header, payload, provided] = parts as [string, string, string];\n\n const key = await signingKey('verify');\n const providedBytes = base64UrlDecode(provided);\n if (providedBytes === undefined) return undefined;\n const ok = await globalThis.crypto.subtle.verify(\n 'HMAC',\n key,\n providedBytes,\n new TextEncoder().encode(`${header}.${payload}`),\n );\n if (!ok) return undefined;\n\n const headerBytes = base64UrlDecode(header);\n const payloadBytes = base64UrlDecode(payload);\n if (headerBytes === undefined || payloadBytes === undefined) return undefined;\n\n let decodedHeader: unknown;\n let decodedPayload: TokenPayload;\n try {\n decodedHeader = JSON.parse(new TextDecoder().decode(headerBytes));\n decodedPayload = JSON.parse(new TextDecoder().decode(payloadBytes)) as TokenPayload;\n } catch {\n return undefined;\n }\n\n const alg = (decodedHeader as { alg?: unknown } | null)?.alg;\n if (alg !== 'HS256') return undefined;\n\n const { deviceId, tenantId, productId, exp } = decodedPayload;\n if (typeof deviceId !== 'string' || typeof tenantId !== 'string' || typeof productId !== 'string') {\n return undefined;\n }\n if (typeof exp !== 'number' || clock.now().getTime() / 1000 >= exp) return undefined;\n\n return { deviceId, tenantId, productId };\n },\n };\n}\n","/**\n * The one nonce-signature check on the hosted surface (docs/protocol.md §6.2).\n *\n * S1 (GAP-004): a device signs `byok-nonce-v1\\n` + nonce, never the bare\n * nonce. The device key is a long-lived identity key that later planes (S6\n * device proof) also sign structured messages with; without a domain tag, a\n * signature produced for one purpose is a valid signature for another.\n *\n * Applying the domain HERE rather than at the call site is the point: there\n * is exactly one place that decides what a device signature over a nonce\n * means, so no route can be written that accepts the undomained form. There\n * is deliberately no dual mode and no grace window — a device on the old\n * encoding re-pairs.\n *\n * The domain literal itself lives in `@byok-sdk/core` (`src/pairing.ts`): the\n * daemon must not be able to tell self-hosted from hosted, and three copies\n * each commented as byte-identical to the other two were a drift hazard, not a\n * design. Importing the constant from the package all three ends already depend\n * on is not the same as importing the server — parity of *behavior* is still\n * asserted by behavior tests, and this package still has no `@byok-sdk/server`\n * edge. Re-exported so this module's public surface is unchanged.\n */\nimport { NONCE_SIGNING_DOMAIN } from '@byok-sdk/core';\nimport type { CloudCrypto } from '../crypto/port';\n\nexport { NONCE_SIGNING_DOMAIN } from '@byok-sdk/core';\n\nexport function verifyNonceSignature(\n crypto: CloudCrypto,\n devicePublicKey: string,\n nonce: string,\n signature: string,\n): Promise<boolean> {\n // `CloudCrypto.verifyEd25519` takes the message as a string and encodes it as\n // UTF-8 itself, so the concatenation happens here rather than through core's\n // `nonceSigningBytes` — same bytes, one encoding step instead of two.\n return crypto.verifyEd25519(devicePublicKey, NONCE_SIGNING_DOMAIN + nonce, signature);\n}\n","/**\n * The auth plane: everything the three pre-tenant routes (`/byok/pair`,\n * `/byok/challenge`, `/byok/token`) need, and nothing else.\n *\n * Those three routes cannot take a {@link TenantStores} facade — they run\n * BEFORE a principal exists, which is exactly why they are the surface where a\n * tenant boundary is easiest to lose. So instead of handing them naked stores\n * and trusting each handler to pass the right tenant, this module owns every\n * tenant-carrying call they make and hands back operations that name no tenant\n * at all:\n *\n * - a pairing code redeems into a REGISTERED device row in one step, so the\n * claims never sit in handler scope as a tenant a handler could substitute;\n * - a device resolves to a row (the pre-tenant lookup, §6.2's pinned wire\n * contract), and unknown/revoked collapse to one answer;\n * - nonce issue/validate/consume and token minting take that ROW, so the\n * tenant they act on is the row's, by construction.\n */\nimport type { Clock, TenantId } from '@byok-sdk/core';\nimport type { CloudCrypto } from '../crypto/port';\nimport type { CloudStores, DeviceRecord, PairingCodeInfo } from '../stores/ports';\nimport { ACCESS_TOKEN_TTL_SECONDS, type TokenSigner } from './tokens';\nimport { verifyNonceSignature } from './verify';\n\n/** ~10min, matching the reference server's pairing-code lifetime. */\nexport const PAIRING_CODE_TTL_MS = 10 * 60 * 1000;\n\nconst PAIRING_CODE_LENGTH = 8;\n\n/** The paired identity key is the first and only proof key in S6. */\nexport const DEVICE_IDENTITY_PROOF_KEY_ID = 'identity';\nexport const DEVICE_IDENTITY_PROOF_KEY_EPOCH = 0;\n\nexport interface PairInput {\n readonly pairingCode: string;\n readonly deviceName: string;\n readonly devicePublicKey: string;\n}\n\nexport interface MintedAccessToken {\n readonly accessToken: string;\n readonly expiresAt: string;\n}\n\nexport interface AuthPlane {\n /** Host control plane: mint a single-use code carrying the tenant/product a device will land in. */\n createPairingCode(tenant: TenantId, input: { readonly productId: string; readonly ttlMs?: number }): Promise<PairingCodeInfo>;\n /**\n * Redeem a code and register the device it pairs, in one step. `undefined`\n * for a code that is unknown, expired, or already used — one answer for all\n * three. Single-use redemption is what makes this exclusive: a second\n * redeem never reaches the row write.\n */\n redeemAndRegister(input: PairInput): Promise<DeviceRecord | undefined>;\n /** The pre-tenant device lookup §6.2's wire contract forces. `undefined` for unknown AND revoked alike — no existence oracle. */\n resolveDevice(deviceId: string): Promise<DeviceRecord | undefined>;\n issueNonce(device: DeviceRecord): Promise<string>;\n validateNonce(device: DeviceRecord, nonce: string): Promise<boolean>;\n /** Burn the nonce. Called only on a fully verified request (§6.2). */\n consumeNonce(device: DeviceRecord, nonce: string): Promise<void>;\n /** Domain-separated (`byok-nonce-v1\\n`) — see `verify.ts`. A raw signature over the bare nonce is invalid, with no second accepted form. */\n verifySignature(device: DeviceRecord, nonce: string, signature: string): Promise<boolean>;\n mintAccessToken(device: DeviceRecord): Promise<MintedAccessToken>;\n}\n\nexport interface AuthPlaneDeps {\n readonly stores: CloudStores;\n readonly crypto: CloudCrypto;\n readonly clock: Clock;\n readonly tokenSigner: TokenSigner;\n readonly accessTokenTtlSeconds?: number;\n}\n\nexport function createAuthPlane(deps: AuthPlaneDeps): AuthPlane {\n const { stores, crypto, clock, tokenSigner } = deps;\n const ttlSeconds = deps.accessTokenTtlSeconds ?? ACCESS_TOKEN_TTL_SECONDS;\n\n return {\n async createPairingCode(tenant, input) {\n const expiresAt = new Date(clock.now().getTime() + (input.ttlMs ?? PAIRING_CODE_TTL_MS)).toISOString();\n return stores.pairingCodes.issue(tenant, {\n code: crypto.randomPairingCode(PAIRING_CODE_LENGTH),\n productId: input.productId,\n expiresAt,\n });\n },\n\n async redeemAndRegister(input) {\n const claims = await stores.pairingCodes.redeem(input.pairingCode);\n if (claims === undefined) return undefined;\n // The redeemed code's claims are the ONLY source of the device's\n // tenant/product — `PairRequest` carries neither, so a device can never\n // choose where it lands.\n return stores.devices.register(claims.tenantId, {\n productId: claims.productId,\n deviceId: `dev_${crypto.randomUuid()}`,\n deviceName: input.deviceName,\n devicePublicKey: input.devicePublicKey,\n proofKeyId: DEVICE_IDENTITY_PROOF_KEY_ID,\n proofKeyEpoch: DEVICE_IDENTITY_PROOF_KEY_EPOCH,\n });\n },\n\n async resolveDevice(deviceId) {\n const device = await stores.devices.resolveByDeviceId(deviceId);\n if (device === undefined || device.revoked) return undefined;\n return device;\n },\n\n issueNonce(device) {\n return stores.nonces.issue(device.tenantId, device.deviceId);\n },\n\n validateNonce(device, nonce) {\n return stores.nonces.validate(device.tenantId, device.deviceId, nonce);\n },\n\n consumeNonce(device, nonce) {\n return stores.nonces.markUsed(device.tenantId, nonce);\n },\n\n verifySignature(device, nonce, signature) {\n return verifyNonceSignature(crypto, device.devicePublicKey, nonce, signature);\n },\n\n async mintAccessToken(device) {\n const accessToken = await tokenSigner.sign(\n { deviceId: device.deviceId, tenantId: device.tenantId, productId: device.productId },\n ttlSeconds,\n );\n return {\n accessToken,\n expiresAt: new Date(clock.now().getTime() + ttlSeconds * 1000).toISOString(),\n };\n },\n };\n}\n","/**\n * The hosted capability declaration (ADR-010).\n *\n * A client learns what a deployment supports by READING a declaration, never\n * by probing an endpoint and interpreting 404/405/501. `@byok-sdk/core` owns the\n * declaration shape and the `hasCapability`/`assertCapability` enforcement\n * point; what lives here is the hosted vocabulary and the mapping from a\n * capability name to the routes that provide it.\n *\n * `GET /byok/capabilities` is a hosted-only route: it is not part of the\n * frozen device wire contract, `@byok-sdk/protocol` is untouched by it, and the\n * daemon does not consume it yet (that lands in a later slice). What it\n * already does here is drive route selection — a deployment that does not\n * declare `blobs.presigned` does not mount the grant routes at all, and one\n * that does not declare `blobs.contentproxy` does not mount the two `/content`\n * routes, so the declaration and the surface cannot disagree.\n */\nimport { CapabilityDeclarationSchema, hasCapability, type CapabilityDeclaration } from '@byok-sdk/core';\n\n/** The hosted capability vocabulary this package knows how to serve. */\nexport const CLOUD_CAPABILITIES = {\n /** `GET /byok/events` long-poll receive (§8). */\n eventsLongPoll: 'events.longpoll',\n /** `POST /byok/messages` batched send (§8.2). */\n messagesBatch: 'messages.batch',\n /** The three bearer-authed blob routes: reserve/grant, explicit finalize, committed-only download (§7). */\n blobsPresigned: 'blobs.presigned',\n /**\n * The two presigned `/byok/blobs/:id/content` routes — cloud carrying the\n * bytes itself.\n *\n * Split out of `blobs.presigned` because it was one capability describing two\n * separable facts. A composition whose bytes live in object storage mints\n * grants (`blobs.presigned`) but has no byte-proxy path at all, and saying so\n * by declaration is ADR-010's whole posture: a client reads what a deployment\n * serves, it never probes a `/content` route and interprets the status code.\n *\n * Spelled all-lowercase because core's declaration schema pins capability\n * names to `/^[a-z0-9]+(?:[._-][a-z0-9]+)*$/` — the same reason the sibling\n * above reads `events.longpoll` and not `events.longPoll`.\n */\n blobsContentProxy: 'blobs.contentproxy',\n /** Board list/claim/unclaim/status routes. Polling is first-class under this declaration. */\n boardCoordination: 'board.coordination',\n /** Additional SSE transport for the same board read model. */\n boardSse: 'board.sse',\n /** Device-scoped five-level presence publication. */\n presenceHints: 'presence.hints',\n /** Bounded task activity batch publication. */\n activityTail: 'activity.tail',\n /** Request-bound device proof record manifest/read/write surface (S6). */\n truthRecords: 'truth.records',\n /**\n * Tenant-scoped skill pack distribution: the manifest list plus the per-file\n * content route a paired device installs from.\n *\n * Hosted HTTP on purpose. A pack is DECLARATIVE CONTENT a device pulls after\n * reading this declaration — not a message — so `@byok-sdk/protocol` gains\n * nothing from it and the frozen v1 envelope stays untouched. Composition-\n * bound like `truth.records`: a deployment that declares it without supplying\n * a `SkillPackStore` is refused at construction rather than publishing two\n * routes it would then 404.\n */\n skillPacks: 'skills.pack',\n} as const;\n\nexport type CloudCapability = (typeof CLOUD_CAPABILITIES)[keyof typeof CLOUD_CAPABILITIES];\n\n/** The wire DTO for `GET /byok/capabilities` — core's shape, bound to a cloud-owned route. */\nexport const CapabilitiesResponseSchema = CapabilityDeclarationSchema;\nexport type CapabilitiesResponse = CapabilityDeclaration;\n\nexport interface FullCapabilityDeclarationOptions {\n /**\n * Composition-bound capabilities require an explicit application authority.\n * `truth.records` is omitted by default because the standard in-memory\n * composition cannot truthfully promise a cross-store atomic commit.\n */\n readonly includeTruthRecords?: boolean;\n /**\n * `skills.pack` is omitted for the same reason: the standard composition is\n * given no `SkillPackStore`, and a default-on declaration would make every\n * existing deployment refuse to construct.\n */\n readonly includeSkillPacks?: boolean;\n}\n\n/** Every capability the standard composition can serve, plus explicitly wired composition-bound ones. */\nexport function fullCapabilityDeclaration(\n version = 1,\n options: FullCapabilityDeclarationOptions = {},\n): CapabilityDeclaration {\n return {\n schema: 'byok-capabilities-v1',\n version,\n capabilities: Object.values(CLOUD_CAPABILITIES).filter((capability) => {\n if (capability === CLOUD_CAPABILITIES.truthRecords) return options.includeTruthRecords === true;\n if (capability === CLOUD_CAPABILITIES.skillPacks) return options.includeSkillPacks === true;\n return true;\n }),\n };\n}\n\nexport function declares(declaration: CapabilityDeclaration, capability: CloudCapability): boolean {\n return hasCapability(declaration, capability);\n}\n","/**\n * The one error taxonomy for `@byok-sdk/cloud`.\n *\n * Same idiom as `@byok-sdk/core`'s `errors.ts`: one class, code-based branching,\n * so a composition maps failures onto HTTP with a code table instead of an\n * `instanceof` chain. Cloud does not re-export core's codes — a cloud error is\n * about the hosted surface (a store contract the composition broke, a\n * declaration the host mis-configured), and core errors travel up unchanged.\n */\n\nexport const CLOUD_ERROR_CODES = {\n /** A pairing code that is unknown, expired, or already redeemed (§6.1). */\n pairing_code_invalid: 'pairing_code_invalid',\n /** The composition handed a device row whose tenant is not a mintable `TenantId`. */\n device_tenant_invalid: 'device_tenant_invalid',\n /**\n * The mailbox committed a row `seq` that disagrees with the delivery `seq`\n * its body factory baked into the envelope. Loud rather than silent: those\n * two numbers ARE the daemon's redelivery cursor.\n */\n mailbox_seq_mismatch: 'mailbox_seq_mismatch',\n /** A capability declaration the host supplied that core refused. */\n capability_declaration_invalid: 'capability_declaration_invalid',\n /**\n * The declaration names a capability this composition cannot serve, so the\n * deployment would publish a surface it does not have (ADR-010).\n *\n * Construction-time and fatal. A client learns what a deployment supports by\n * READING the declaration and is entitled to act on it without probing, so a\n * declaration that over-states is not a degraded deployment — it is a\n * deployment whose one honest interface lies.\n */\n capability_over_declared: 'capability_over_declared',\n /** Host-supplied board labels or coordination input exceeded the explicit contract. */\n coordination_input_invalid: 'coordination_input_invalid',\n /**\n * A terminal receipt whose stored body is not a terminal envelope — either\n * undecodable or a non-terminal type. Whatever wrote that row broke the\n * receipt-store contract, so the typed read model fails closed instead of\n * projecting a best-effort shape.\n */\n terminal_receipt_unreadable: 'terminal_receipt_unreadable',\n /** A progress/activity batch exceeded the configured event or byte ceiling. */\n activity_batch_too_large: 'activity_batch_too_large',\n} as const;\n\nexport type CloudErrorCode = (typeof CLOUD_ERROR_CODES)[keyof typeof CLOUD_ERROR_CODES];\n\nexport class ByokCloudError extends Error {\n public readonly code: CloudErrorCode;\n\n constructor(code: CloudErrorCode, message: string, options?: ErrorOptions) {\n super(message, options);\n this.name = 'ByokCloudError';\n this.code = code;\n }\n}\n\nexport function isCloudError(value: unknown, code?: CloudErrorCode): value is ByokCloudError {\n if (!(value instanceof ByokCloudError)) return false;\n return code === undefined || value.code === code;\n}\n","import { tenantKey, type TenantId } from '@byok-sdk/core';\nimport { AgentEventOrUnknownSchema, type AgentEventOrUnknown } from '@byok-sdk/protocol';\nimport { z } from 'zod';\nimport { ByokCloudError } from './errors';\n\nexport const DEFAULT_ACTIVITY_CAPACITY = 50;\n\nconst ActivityTaskIdSchema = z.string().min(1).max(200);\nconst SourceEnvelopeIdSchema = z\n .string()\n .max(200)\n .regex(/\\S/, 'sourceEnvelopeId must not be blank');\n\nexport const ActivityAppendRequestSchema = z.object({\n taskId: ActivityTaskIdSchema,\n sourceEnvelopeId: SourceEnvelopeIdSchema,\n batchSeq: z.number().int().nonnegative(),\n events: z.array(AgentEventOrUnknownSchema).min(1),\n dropped: z.number().int().nonnegative(),\n});\n\nexport const TimelineEventSchema = z.object({\n taskId: ActivityTaskIdSchema,\n sourceEnvelopeId: SourceEnvelopeIdSchema,\n batchSeq: z.number().int().nonnegative(),\n eventIndex: z.number().int().nonnegative(),\n receivedAt: z.iso.datetime(),\n event: AgentEventOrUnknownSchema,\n});\n\nexport type TimelineEvent = Readonly<z.infer<typeof TimelineEventSchema>>;\n\nexport interface ActivityCursor {\n readonly batchSeq: number;\n readonly eventIndex: number;\n}\n\nexport interface ActivityTail {\n readonly tenantId: TenantId;\n readonly taskId: string;\n readonly entries: readonly TimelineEvent[];\n readonly cursor?: ActivityCursor;\n readonly dropped: number;\n readonly capacity: number;\n readonly expiresAt: string;\n}\n\nexport interface ActivityAppendInput {\n readonly taskId: string;\n readonly sourceEnvelopeId: string;\n readonly batchSeq: number;\n readonly events: readonly AgentEventOrUnknown[];\n readonly dropped: number;\n readonly ttlMs: number;\n readonly capacity?: number;\n}\n\nexport interface ActivityStore {\n append(tenant: TenantId, input: ActivityAppendInput): Promise<ActivityTail>;\n read(tenant: TenantId, taskId: string): Promise<ActivityTail | undefined>;\n}\n\nexport function validateActivityAppend(input: ActivityAppendInput): number {\n if (!Number.isFinite(input.ttlMs) || input.ttlMs <= 0) {\n throw new ByokCloudError(\n 'coordination_input_invalid',\n `Activity ttl must be a positive number of milliseconds, received ${String(input.ttlMs)}.`,\n );\n }\n const capacity = input.capacity ?? DEFAULT_ACTIVITY_CAPACITY;\n if (!Number.isSafeInteger(capacity) || capacity <= 0) {\n throw new ByokCloudError(\n 'coordination_input_invalid',\n `Activity capacity must be a positive integer, received ${String(capacity)}.`,\n );\n }\n const parsed = ActivityAppendRequestSchema.safeParse(input);\n if (!parsed.success) {\n throw new ByokCloudError(\n 'coordination_input_invalid',\n 'Activity batches require stable source identity, order, at least one valid event, and a non-negative dropped count.',\n );\n }\n return capacity;\n}\n\nexport function projectTimelineEvents(\n input: ActivityAppendInput,\n receivedAt: string,\n): readonly TimelineEvent[] {\n return input.events.map((event, eventIndex) =>\n TimelineEventSchema.parse({\n taskId: input.taskId,\n sourceEnvelopeId: input.sourceEnvelopeId,\n batchSeq: input.batchSeq,\n eventIndex,\n receivedAt,\n event,\n }),\n );\n}\n\nexport function parseTimelineEvents(value: unknown): readonly TimelineEvent[] {\n return z.array(TimelineEventSchema).parse(value) as readonly TimelineEvent[];\n}\n\nexport function compareTimelineEvents(left: TimelineEvent, right: TimelineEvent): number {\n return left.batchSeq - right.batchSeq || left.eventIndex - right.eventIndex;\n}\n\nexport function activityCursor(\n entries: readonly TimelineEvent[],\n): ActivityCursor | undefined {\n const last = entries.at(-1);\n return last === undefined ? undefined : { batchSeq: last.batchSeq, eventIndex: last.eventIndex };\n}\n\nexport function activityTailKey(tenant: TenantId, taskId: string): string {\n return tenantKey(tenant, taskId);\n}\n","import type { AgentEventOrUnknown } from '@byok-sdk/protocol';\nimport {\n DEFAULT_ACTIVITY_CAPACITY,\n validateActivityAppend,\n type ActivityAppendInput,\n type ActivityTail,\n} from './activity';\nimport { ByokCloudError } from './errors';\nimport type { TenantBoundActivity } from './tenant-stores';\n\nexport const DEFAULT_BOARD_CHANNEL_MAX_BYTES = 128;\nexport const DEFAULT_BOARD_TITLE_MAX_BYTES = 512;\nexport const DEFAULT_ACTIVITY_MAX_EVENTS = 50;\nexport const DEFAULT_ACTIVITY_MAX_BYTES = 64 * 1024;\nexport { DEFAULT_ACTIVITY_CAPACITY } from './activity';\nexport const DEFAULT_ACTIVITY_TTL_MS = 10 * 60_000;\nexport const DEFAULT_PRESENCE_TTL_MS = 90_000;\nexport const DEFAULT_PRESENCE_MINIMUM_INTERVAL_MS = 5_000;\nexport const DEFAULT_PRESENCE_DETAIL_MAX_BYTES = 512;\n\nconst encoder = new TextEncoder();\n\nexport interface ActivityBounds {\n readonly maxEvents: number;\n readonly maxBytes: number;\n readonly capacity: number;\n readonly ttlMs: number;\n}\n\nexport const DEFAULT_ACTIVITY_BOUNDS: ActivityBounds = {\n maxEvents: DEFAULT_ACTIVITY_MAX_EVENTS,\n maxBytes: DEFAULT_ACTIVITY_MAX_BYTES,\n capacity: DEFAULT_ACTIVITY_CAPACITY,\n ttlMs: DEFAULT_ACTIVITY_TTL_MS,\n};\n\nexport function assertBoardLabels(\n channel: string,\n title: string,\n limits: { readonly channelMaxBytes: number; readonly titleMaxBytes: number },\n): void {\n if (channel.length === 0 || encoder.encode(channel).length > limits.channelMaxBytes) {\n throw new ByokCloudError(\n 'coordination_input_invalid',\n `Board channel must contain 1..${limits.channelMaxBytes} UTF-8 bytes.`,\n );\n }\n if (title.length === 0 || encoder.encode(title).length > limits.titleMaxBytes) {\n throw new ByokCloudError(\n 'coordination_input_invalid',\n `Board title must contain 1..${limits.titleMaxBytes} UTF-8 bytes.`,\n );\n }\n}\n\nexport function validateActivityEvents(\n events: readonly AgentEventOrUnknown[],\n dropped: number,\n bounds: ActivityBounds,\n): void {\n if (!Number.isSafeInteger(dropped) || dropped < 0) {\n throw new ByokCloudError(\n 'coordination_input_invalid',\n 'Activity dropped must be a non-negative integer.',\n );\n }\n if (events.length === 0 || events.length > bounds.maxEvents) {\n throw new ByokCloudError(\n 'activity_batch_too_large',\n `Activity batch must contain 1..${bounds.maxEvents} events.`,\n );\n }\n const encoded = JSON.stringify(events);\n if (encoder.encode(encoded).length > bounds.maxBytes) {\n throw new ByokCloudError(\n 'activity_batch_too_large',\n `Activity batch exceeds ${bounds.maxBytes} UTF-8 bytes.`,\n );\n }\n}\n\nexport function validateActivityBatch(\n input: Omit<ActivityAppendInput, 'ttlMs' | 'capacity'>,\n bounds: ActivityBounds,\n): void {\n validateActivityEvents(input.events, input.dropped, bounds);\n validateActivityAppend({ ...input, ttlMs: bounds.ttlMs, capacity: bounds.capacity });\n}\n\nexport async function appendActivityEvents(\n activity: TenantBoundActivity,\n input: {\n readonly taskId: string;\n readonly sourceEnvelopeId: string;\n readonly batchSeq: number;\n readonly events: readonly AgentEventOrUnknown[];\n readonly dropped: number;\n },\n bounds: ActivityBounds,\n): Promise<ActivityTail> {\n validateActivityBatch(input, bounds);\n return activity.append({\n taskId: input.taskId,\n sourceEnvelopeId: input.sourceEnvelopeId,\n batchSeq: input.batchSeq,\n events: input.events,\n dropped: input.dropped,\n ttlMs: bounds.ttlMs,\n capacity: bounds.capacity,\n });\n}\n","/**\n * The single bearer check every device-facing route shares.\n *\n * S1 shape, reproduced exactly: the token's `(tenantId, deviceId, productId)`\n * are LOOKUP KEYS, and the ROW that comes back is the authority. A token for a\n * device that no longer exists, one whose tenant does not own that device, one\n * whose product disagrees with the row, one for a revoked device, an expired\n * token, and a malformed tenant id in the claims all fail identically here and\n * are indistinguishable to the caller. There is deliberately no \"which of\n * those was it\" signal to hand back, so no route can turn a 401 into a\n * cross-tenant existence oracle.\n *\n * The returned {@link DevicePrincipal} is core's, carrying a minted\n * `TenantId` — which is what makes it the only legal input to\n * `tenantStoresFor` (`../tenant-stores.ts`).\n */\nimport { isTenantId, tenantId, type DevicePrincipal } from '@byok-sdk/core';\nimport type { DeviceDirectory } from '../stores/ports';\nimport type { TokenSigner } from './tokens';\n\nexport interface BearerAuthDeps {\n readonly tokenSigner: TokenSigner;\n readonly devices: DeviceDirectory;\n}\n\nexport function extractBearerToken(header: string | undefined): string | undefined {\n if (header === undefined) return undefined;\n const match = /^Bearer\\s+(.+)$/i.exec(header);\n return match?.[1];\n}\n\nexport async function authenticateBearer(\n header: string | undefined,\n deps: BearerAuthDeps,\n): Promise<DevicePrincipal | undefined> {\n const token = extractBearerToken(header);\n if (token === undefined) return undefined;\n\n const claims = await deps.tokenSigner.verify(token);\n if (claims === undefined) return undefined;\n // The claim is a bare string until it is minted; a tenant id that core would\n // refuse is simply not a tenant this deployment ever issued a token for.\n if (!isTenantId(claims.tenantId)) return undefined;\n\n const device = await deps.devices.get(tenantId(claims.tenantId), claims.deviceId);\n if (device === undefined || device.revoked) return undefined;\n if (device.productId !== claims.productId) return undefined;\n\n return {\n kind: 'device',\n tenantId: device.tenantId,\n productId: device.productId,\n deviceId: device.deviceId,\n };\n}\n","/**\n * Layer 2 of the six-layer isolation model (§12.6.2) — the tenant-closed\n * facade a handler actually receives.\n *\n * `@byok-sdk/core`'s `stores.ts` deliberately left this undefined: it is shaped by\n * how handlers are written, and the first handlers live here. This is that\n * shape, and the two properties it exists to enforce are:\n *\n * 1. **It can only be built from an authenticated principal.** {@link\n * tenantStoresFor} is the only constructor, and its first parameter is a\n * `Principal` — a value that only `authenticateBearer` (`auth/bearer.ts`)\n * mints, and only from a device ROW. There is no path from a device-supplied\n * string to a facade.\n * 2. **No handler ever passes a `TenantId` again.** Every method below has the\n * tenant pre-applied, so a handler cannot read `principal.tenantId` off one\n * principal and hand a different tenant to a store. Grep the handler tree\n * for `TenantId` and you will not find one — asserted by\n * `src/__tests__/constraints.test.ts`.\n *\n * The three pre-tenant store methods (`resolveByDeviceId`, `redeem`, the\n * presigned blob calls) are deliberately absent from this surface: a\n * device-facing handler must not be able to reach them.\n */\nimport {\n principalTenant,\n type BoardClaimInput,\n type BoardItem,\n type BoardItemInput,\n type BoardListQuery,\n type BoardPage,\n type BoardStatusUpdateInput,\n type BoardUnclaimInput,\n type CoreStores,\n type MailboxAdvanceCursorInput,\n type MailboxAppendInput,\n type MailboxCursorState,\n type MailboxMessage,\n type MailboxPage,\n type MailboxReadQuery,\n type Principal,\n type PresenceHint,\n type PresenceHintInput,\n type StorageFinalizeInput,\n type StorageFinalizeResult,\n type StorageReservation,\n type StorageReservationInput,\n type TenantId,\n} from '@byok-sdk/core';\nimport type { ActivityAppendInput, ActivityTail } from './activity';\nimport type {\n ApprovalTimelineAppendInput,\n ApprovalTimelineTail,\n} from './approval-timeline';\nimport type {\n BlobObservation,\n CloudStores,\n DeviceRecord,\n RequestReceipt,\n TaskAttempt,\n TaskAttemptStatus,\n} from './stores/ports';\n\nexport interface TenantBoundMailbox {\n append(input: MailboxAppendInput): Promise<MailboxMessage>;\n /** Pure read. Never advances the cursor — the daemon's next poll is the only ack. */\n readAfter(query: MailboxReadQuery): Promise<MailboxPage>;\n advanceCursor(input: MailboxAdvanceCursorInput): Promise<MailboxCursorState>;\n readCursor(deviceId: string): Promise<MailboxCursorState>;\n}\n\nexport interface TenantBoundBoard {\n create(input: BoardItemInput): Promise<BoardItem>;\n get(itemId: string): Promise<BoardItem | undefined>;\n list(query: BoardListQuery): Promise<BoardPage>;\n claim(input: BoardClaimInput): Promise<BoardItem>;\n unclaim(input: BoardUnclaimInput): Promise<BoardItem>;\n updateStatus(input: BoardStatusUpdateInput): Promise<BoardItem>;\n}\n\nexport interface TenantBoundPresence {\n publish(input: PresenceHintInput): Promise<PresenceHint>;\n read(deviceId: string): Promise<PresenceHint | undefined>;\n list(): Promise<readonly PresenceHint[]>;\n}\n\nexport interface TenantBoundActivity {\n append(input: ActivityAppendInput): Promise<ActivityTail>;\n read(taskId: string): Promise<ActivityTail | undefined>;\n}\n\nexport interface TenantBoundApprovalTimeline {\n append(input: ApprovalTimelineAppendInput): Promise<ApprovalTimelineTail>;\n read(taskId: string): Promise<ApprovalTimelineTail | undefined>;\n}\n\nexport interface TenantBoundDevices {\n get(deviceId: string): Promise<DeviceRecord | undefined>;\n list(): Promise<readonly DeviceRecord[]>;\n revoke(deviceId: string): Promise<void>;\n}\n\nexport interface TenantBoundTaskAttempts {\n open(input: { readonly taskId: string; readonly deviceId: string }): Promise<TaskAttempt>;\n get(taskId: string): Promise<TaskAttempt | undefined>;\n claim(input: { readonly taskId: string; readonly deviceId: string }): Promise<TaskAttempt | undefined>;\n recordStatus(input: { readonly taskId: string; readonly status: TaskAttemptStatus }): Promise<TaskAttempt | undefined>;\n}\n\nexport interface TenantBoundDedup {\n checkAndRecord(deviceId: string, envelopeId: string): Promise<boolean>;\n}\n\nexport interface TenantBoundReceipts {\n record(input: { readonly key: string; readonly body: string }): Promise<{\n readonly receipt: RequestReceipt;\n readonly created: boolean;\n }>;\n get(key: string): Promise<RequestReceipt | undefined>;\n}\n\nexport interface TenantBoundBlobs {\n createUpload(reservation: StorageReservation): Promise<{ readonly blobId: string; readonly uploadUrl: string }>;\n observeUpload(blobId: string, reservation: StorageReservation): Promise<BlobObservation | undefined>;\n getDownloadUrl(blobId: string): Promise<string | undefined>;\n}\n\nexport interface TenantBoundQuota {\n readReservation(reservationId: string): Promise<StorageReservation | undefined>;\n reserve(input: StorageReservationInput): Promise<StorageReservation>;\n finalizeReservation(input: StorageFinalizeInput): Promise<StorageFinalizeResult>;\n abortReservation(reservationId: string): Promise<StorageReservation>;\n}\n\nexport interface TenantBoundRateLimiter {\n consume(deviceId: string): Promise<boolean>;\n}\n\nexport interface TenantStores {\n readonly tenant: TenantId;\n readonly principal: Principal;\n readonly mailbox: TenantBoundMailbox;\n readonly board: TenantBoundBoard;\n readonly presence: TenantBoundPresence;\n readonly activity: TenantBoundActivity;\n readonly approvals: TenantBoundApprovalTimeline;\n readonly devices: TenantBoundDevices;\n readonly tasks: TenantBoundTaskAttempts;\n readonly dedup: TenantBoundDedup;\n readonly receipts: TenantBoundReceipts;\n readonly blobs: TenantBoundBlobs;\n readonly quota: TenantBoundQuota;\n readonly rateLimiter: TenantBoundRateLimiter;\n}\n\n/** Every naked store a composition supplies. Only {@link tenantStoresFor} reads this. */\nexport interface CloudRootStores {\n readonly core: CoreStores;\n readonly cloud: CloudStores;\n}\n\nexport function tenantStoresFor(principal: Principal, root: CloudRootStores): TenantStores {\n const tenant = principalTenant(principal);\n const { core, cloud } = root;\n\n return {\n tenant,\n principal,\n mailbox: {\n append: (input) => core.mailbox.append(tenant, input),\n readAfter: (query) => core.mailbox.readAfter(tenant, query),\n advanceCursor: (input) => core.mailbox.advanceCursor(tenant, input),\n readCursor: (deviceId) => core.mailbox.readCursor(tenant, deviceId),\n },\n board: {\n create: (input) => core.board.create(tenant, input),\n get: (itemId) => core.board.get(tenant, itemId),\n list: (query) => core.board.list(tenant, query),\n claim: (input) => core.board.claim(tenant, input),\n unclaim: (input) => core.board.unclaim(tenant, input),\n updateStatus: (input) => core.board.updateStatus(tenant, input),\n },\n presence: {\n publish: (input) => core.presence.publish(tenant, input),\n read: (deviceId) => core.presence.read(tenant, deviceId),\n list: () => core.presence.list(tenant),\n },\n activity: {\n append: (input) => cloud.activity.append(tenant, input),\n read: (taskId) => cloud.activity.read(tenant, taskId),\n },\n approvals: {\n append: (input) => cloud.approvals.append(tenant, input),\n read: (taskId) => cloud.approvals.read(tenant, taskId),\n },\n devices: {\n get: (deviceId) => cloud.devices.get(tenant, deviceId),\n list: () => cloud.devices.list(tenant),\n revoke: (deviceId) => cloud.devices.revoke(tenant, deviceId),\n },\n tasks: {\n open: (input) => cloud.tasks.open(tenant, input),\n get: (taskId) => cloud.tasks.get(tenant, taskId),\n claim: (input) => cloud.tasks.claim(tenant, input),\n recordStatus: (input) => cloud.tasks.recordStatus(tenant, input),\n },\n dedup: {\n checkAndRecord: (deviceId, envelopeId) => cloud.dedup.checkAndRecord(tenant, deviceId, envelopeId),\n },\n receipts: {\n record: (input) => cloud.receipts.record(tenant, input),\n get: (key) => cloud.receipts.get(tenant, key),\n },\n blobs: {\n createUpload: (reservation) => cloud.blobs.createUpload(tenant, reservation),\n observeUpload: (blobId, reservation) => cloud.blobs.observeUpload(tenant, blobId, reservation),\n getDownloadUrl: (blobId) => cloud.blobs.getDownloadUrl(tenant, blobId),\n },\n quota: {\n readReservation: (reservationId) => core.quota.readReservation(tenant, reservationId),\n reserve: (input) => core.quota.reserve(tenant, input),\n finalizeReservation: (input) => core.quota.finalizeReservation(tenant, input),\n abortReservation: (reservationId) => core.quota.abortReservation(tenant, reservationId),\n },\n rateLimiter: {\n consume: (deviceId) => cloud.rateLimiter.consume(tenant, deviceId),\n },\n };\n}\n","/**\n * The two things every device-facing handler starts from: a tolerant JSON body\n * read, and the bearer -> principal -> tenant-closed-facade step.\n *\n * Once {@link authenticateDevice} has answered, a handler holds a\n * `TenantStores` and a `DevicePrincipal` and never sees a `TenantId` again.\n */\nimport type { Context } from 'hono';\nimport type { DevicePrincipal } from '@byok-sdk/core';\nimport { authenticateBearer, type BearerAuthDeps } from '../auth/bearer';\nimport { tenantStoresFor, type CloudRootStores, type TenantStores } from '../tenant-stores';\n\n/** Every error response on this surface is `{ error }` — the same shape the reference server uses. */\nexport interface ErrorBody {\n readonly error: string;\n}\n\nexport async function readJsonBody(c: Context): Promise<unknown> {\n try {\n return await c.req.json();\n } catch {\n return undefined;\n }\n}\n\nexport interface DeviceRouteDeps {\n readonly bearer: BearerAuthDeps;\n readonly root: CloudRootStores;\n}\n\nexport interface AuthenticatedDeviceContext {\n readonly device: DevicePrincipal;\n readonly stores: TenantStores;\n}\n\n/**\n * `undefined` means \"answer 401\" — and it means that for a missing header, a\n * forged token, an expired token, a revoked device, a product mismatch, and a\n * token whose tenant does not own the device, indistinguishably.\n */\nexport async function authenticateDevice(\n c: Context,\n deps: DeviceRouteDeps,\n): Promise<AuthenticatedDeviceContext | undefined> {\n const device = await authenticateBearer(c.req.header('authorization'), deps.bearer);\n if (device === undefined) return undefined;\n return { device, stores: tenantStoresFor(device, deps.root) };\n}\n","/**\n * Blob flows (§7).\n *\n * Two route classes on purpose: `POST /byok/blobs` and `GET\n * /byok/blobs/:id/url` are bearer-authed and therefore tenant-closed (a\n * download URL is minted only for a blob the caller's own tenant owns, and a\n * foreign blob is indistinguishable from a missing one); the two `/content`\n * routes are presigned, because they are meant to be hit directly — by a\n * browser, by a `PUT` from a daemon that holds only the signed URL — with no\n * JWT in scope at all. The HMAC signature over the blob id plus its expiry IS\n * the credential there, which is why those two carry the `presigned` class in\n * the route inventory rather than being lumped in with the device routes.\n *\n * The split runs all the way down: the bearer-authed pair reaches blobs only\n * through the tenant facade and never holds a naked store, and the presigned\n * pair holds only a {@link BlobContentProxy} and no bearer deps. A composition\n * without a proxy does not mount them (`cloud.ts`).\n */\nimport type { Context } from 'hono';\nimport { z } from 'zod';\nimport {\n CreateBlobRequestSchema,\n type BlobDownloadUrlResponse,\n type CreateBlobResponse,\n} from '@byok-sdk/protocol';\nimport {\n STORAGE_ERROR_CODES,\n STORAGE_ERROR_HTTP_STATUS,\n contentHash,\n isCoreError,\n type StorageErrorCode,\n} from '@byok-sdk/core';\nimport type { BlobContentProxy } from '../stores/ports';\nimport { authenticateDevice, readJsonBody, type DeviceRouteDeps } from './shared';\n\n/** The three bearer-authed routes: everything they touch goes through the tenant facade. */\nexport interface BlobRouteDeps extends DeviceRouteDeps {\n readonly maxBlobSizeBytes: number;\n}\n\n/** Reservation and presign grants deliberately share one expiry horizon. */\nexport const BLOB_RESERVATION_TTL_MS = 15 * 60 * 1000;\n\n/**\n * The two presigned routes. No bearer deps at all — there is no principal to\n * build a facade from, and the proxy is the only thing they need.\n */\nexport interface BlobContentRouteDeps {\n readonly contentProxy: BlobContentProxy;\n}\n\n/**\n * The presigned query contract. Cloud-owned (the wire DTO package covers\n * request/response BODIES, not URL signing), and validated rather than\n * hand-parsed so a non-numeric `exp` is a failed verification instead of a\n * `NaN` comparison that quietly answers `false` for the wrong reason.\n */\nconst SignedUrlQuerySchema = z.object({\n sig: z.string().min(1),\n exp: z.coerce.number().finite(),\n});\n\nexport function createBlobHandler(deps: BlobRouteDeps) {\n return async (c: Context): Promise<Response> => {\n const authenticated = await authenticateDevice(c, deps);\n if (authenticated === undefined) return c.json({ error: 'unauthorized' }, 401);\n\n const parsed = CreateBlobRequestSchema.safeParse(await readJsonBody(c));\n if (!parsed.success) return c.json({ error: 'size, contentType, and contentHash are required' }, 400);\n if (parsed.data.size > deps.maxBlobSizeBytes) {\n return c.json({ error: `blob exceeds max size of ${deps.maxBlobSizeBytes} bytes` }, 413);\n }\n\n const reservationId = idempotencyKey(c);\n if (reservationId === undefined) {\n return c.json({ error: 'Idempotency-Key header is required' }, 400);\n }\n\n try {\n const reservation = await authenticated.stores.quota.reserve({\n reservationId,\n kind: 'object',\n expectedBytes: BigInt(parsed.data.size),\n contentHash: contentHash(parsed.data.contentHash),\n contentType: parsed.data.contentType,\n ttlMs: BLOB_RESERVATION_TTL_MS,\n });\n try {\n const { blobId, uploadUrl } = await authenticated.stores.blobs.createUpload(reservation);\n const response: CreateBlobResponse = { blobId, uploadUrl };\n return c.json(response, 200);\n } catch (error) {\n // Preserve the grant failure as the client-facing authority. Cleanup\n // is best-effort here; admission reaps an abandoned hold after TTL if\n // the store is concurrently unavailable.\n await authenticated.stores.quota.abortReservation(reservationId).catch(() => undefined);\n const rendered = renderStorageError(c, error);\n if (rendered !== undefined) return rendered;\n throw error;\n }\n } catch (error) {\n const rendered = renderStorageError(c, error);\n if (rendered !== undefined) return rendered;\n throw error;\n }\n };\n}\n\nexport function finalizeBlobHandler(deps: BlobRouteDeps) {\n return async (c: Context): Promise<Response> => {\n const authenticated = await authenticateDevice(c, deps);\n if (authenticated === undefined) return c.json({ error: 'unauthorized' }, 401);\n\n const reservationId = idempotencyKey(c);\n if (reservationId === undefined) {\n return c.json({ error: 'Idempotency-Key header is required' }, 400);\n }\n\n try {\n const reservation = await authenticated.stores.quota.readReservation(reservationId);\n if (reservation === undefined) {\n return c.json({ error: 'storage_reservation_not_found' }, 404);\n }\n const blobId = c.req.param('id') ?? '';\n const observed = await authenticated.stores.blobs.observeUpload(\n blobId,\n reservation,\n );\n if (observed === undefined) {\n await authenticated.stores.quota.abortReservation(reservationId);\n return c.json({ error: 'storage_integrity_mismatch' }, 422);\n }\n\n await authenticated.stores.quota.finalizeReservation({\n reservationId,\n ...observed,\n });\n return c.body(null, 204);\n } catch (error) {\n const rendered = renderStorageError(c, error);\n if (rendered !== undefined) return rendered;\n throw error;\n }\n };\n}\n\nexport function blobDownloadUrlHandler(deps: BlobRouteDeps) {\n return async (c: Context): Promise<Response> => {\n const authenticated = await authenticateDevice(c, deps);\n if (authenticated === undefined) return c.json({ error: 'unauthorized' }, 401);\n\n const downloadUrl = await authenticated.stores.blobs.getDownloadUrl(c.req.param('id') ?? '');\n if (downloadUrl === undefined) return c.json({ error: 'blob not found' }, 404);\n\n const response: BlobDownloadUrlResponse = { downloadUrl };\n return c.json(response, 200);\n };\n}\n\nexport function blobUploadContentHandler(deps: BlobContentRouteDeps) {\n return async (c: Context): Promise<Response> => {\n const blobId = c.req.param('id') ?? '';\n const query = SignedUrlQuerySchema.safeParse({ sig: c.req.query('sig'), exp: c.req.query('exp') });\n if (!query.success || !(await deps.contentProxy.verifySignedUrl(blobId, 'put', query.data.sig, query.data.exp))) {\n return c.json({ error: 'invalid or expired signature' }, 401);\n }\n\n const result = await deps.contentProxy.writeContent(blobId, new Uint8Array(await c.req.arrayBuffer()));\n if (!result.ok) return c.json({ error: result.reason }, 422);\n return c.body(null, 204);\n };\n}\n\nexport function blobDownloadContentHandler(deps: BlobContentRouteDeps) {\n return async (c: Context): Promise<Response> => {\n const blobId = c.req.param('id') ?? '';\n const query = SignedUrlQuerySchema.safeParse({ sig: c.req.query('sig'), exp: c.req.query('exp') });\n if (!query.success || !(await deps.contentProxy.verifySignedUrl(blobId, 'get', query.data.sig, query.data.exp))) {\n return c.json({ error: 'invalid or expired signature' }, 401);\n }\n\n const content = await deps.contentProxy.readContent(blobId);\n if (content === undefined) return c.json({ error: 'blob not found' }, 404);\n return c.body(new Uint8Array(content.data), 200, { 'content-type': content.contentType });\n };\n}\n\nfunction idempotencyKey(c: Context): string | undefined {\n const value = c.req.header('Idempotency-Key');\n if (value === undefined || value.length === 0 || value.length > 200) return undefined;\n return value;\n}\n\nfunction renderStorageError(c: Context, error: unknown): Response | undefined {\n if (!isCoreError(error)) return undefined;\n if ((STORAGE_ERROR_CODES as readonly string[]).includes(error.code)) {\n const code = error.code as StorageErrorCode;\n return c.json({ error: code }, STORAGE_ERROR_HTTP_STATUS[code]);\n }\n if (error.code === 'storage_reservation_not_found' || error.code === 'object_not_found') {\n return c.json({ error: error.code }, 404);\n }\n if (error.code === 'storage_entitlement_missing' || error.code === 'object_state_invalid') {\n return c.json({ error: error.code }, 409);\n }\n if (error.code === 'content_hash_invalid') {\n return c.json({ error: error.code }, 400);\n }\n return undefined;\n}\n","/**\n * `GET /byok/capabilities` — the declaration route (ADR-010).\n *\n * Public by design: a client has to be able to read what a deployment supports\n * before it holds a credential, and the declaration is a deployment-level\n * fact, not a tenant-level one. Nothing tenant-scoped may ever be added to\n * this response for exactly that reason.\n */\nimport type { Context } from 'hono';\nimport type { CapabilityDeclaration } from '@byok-sdk/core';\n\nexport interface CapabilitiesRouteDeps {\n readonly declaration: CapabilityDeclaration;\n}\n\nexport function capabilitiesHandler(deps: CapabilitiesRouteDeps) {\n return async (c: Context): Promise<Response> => c.json(deps.declaration, 200);\n}\n","/**\n * Auth v2 (docs/protocol.md §6): pair, challenge, token.\n *\n * Byte-for-byte the same request/response DTOs the daemon already speaks,\n * because they come from `@byok-sdk/protocol` rather than from a hosted copy of\n * them. The behavior differences a hosted surface DOES make are two, both\n * narrowing:\n *\n * - a pairing code that is unknown, expired, or already used gets one 401 with\n * one message (the reference server names the reason);\n * - an unknown device and a revoked device were already indistinguishable on\n * the reference server, and stay so here.\n */\nimport type { Context } from 'hono';\nimport {\n ChallengeRequestSchema,\n PairRequestSchema,\n TokenRequestSchema,\n type ChallengeResponse,\n type PairResponse,\n type TokenResponse,\n} from '@byok-sdk/protocol';\nimport type { AuthPlane } from '../auth/plane';\nimport { readJsonBody } from './shared';\n\nexport interface AuthRouteDeps {\n readonly auth: AuthPlane;\n}\n\nexport function pairHandler(deps: AuthRouteDeps) {\n return async (c: Context): Promise<Response> => {\n const parsed = PairRequestSchema.safeParse(await readJsonBody(c));\n if (!parsed.success) {\n return c.json({ error: 'pairingCode, deviceName, and devicePublicKey are required strings' }, 400);\n }\n\n const device = await deps.auth.redeemAndRegister(parsed.data);\n if (device === undefined) return c.json({ error: 'invalid pairing code' }, 401);\n\n const { accessToken, expiresAt } = await deps.auth.mintAccessToken(device);\n const response: PairResponse = { deviceId: device.deviceId, accessToken, refreshHint: expiresAt };\n return c.json(response, 200);\n };\n}\n\nexport function challengeHandler(deps: AuthRouteDeps) {\n return async (c: Context): Promise<Response> => {\n const parsed = ChallengeRequestSchema.safeParse(await readJsonBody(c));\n if (!parsed.success) return c.json({ error: 'deviceId is required' }, 400);\n\n // Pre-tenant by construction: `ChallengeRequest` is the pinned wire\n // contract and carries only a deviceId, so the ROW is what tells this\n // deployment which tenant the device belongs to.\n const device = await deps.auth.resolveDevice(parsed.data.deviceId);\n if (device === undefined) return c.json({ error: 'unknown or revoked device' }, 401);\n\n const response: ChallengeResponse = { nonce: await deps.auth.issueNonce(device) };\n return c.json(response, 200);\n };\n}\n\nexport function tokenHandler(deps: AuthRouteDeps) {\n return async (c: Context): Promise<Response> => {\n const parsed = TokenRequestSchema.safeParse(await readJsonBody(c));\n if (!parsed.success) return c.json({ error: 'deviceId, nonce, and signature are required' }, 400);\n const { deviceId, nonce, signature } = parsed.data;\n\n const device = await deps.auth.resolveDevice(deviceId);\n if (device === undefined) return c.json({ error: 'unknown or revoked device' }, 401);\n\n if (!(await deps.auth.validateNonce(device, nonce))) {\n return c.json({ error: 'invalid, expired, or already-used nonce' }, 401);\n }\n // Domain-separated (`byok-nonce-v1\\n`, `auth/verify.ts`): a raw signature\n // over the bare nonce is invalid here, with no second accepted form.\n if (!(await deps.auth.verifySignature(device, nonce, signature))) {\n return c.json({ error: 'invalid signature' }, 401);\n }\n // Burn the nonce only on a fully verified success (§6.2) — an invalid\n // signature attempt does not consume the legitimate device's nonce.\n await deps.auth.consumeNonce(device, nonce);\n\n const { accessToken, expiresAt } = await deps.auth.mintAccessToken(device);\n const response: TokenResponse = { accessToken, expiresAt };\n return c.json(response, 200);\n };\n}\n","/**\n * `GET /byok/events?cursor=N` — the long-poll receive half (§8).\n *\n * Three properties the daemon's transport depends on, reproduced against the\n * core mailbox rather than an in-process outbox:\n *\n * - **Reading is not acknowledging.** `readAfter` never moves the cursor. The\n * ONLY ack is the cursor the daemon brings back on its NEXT poll, after it\n * has durably processed what it was handed — which is why the ack below\n * happens before the read, against the incoming `cursor`, and why a poll\n * that hands back the same cursor replays the same page forever.\n * - **The ack is monotonic.** A cursor at or below what the device already\n * acked carries no new information and is not an ack attempt; only a\n * strictly higher one advances. The store's own\n * `mailbox_cursor_regression` guard stays the authority on going backwards\n * (asserted directly in `src/__tests__/mailbox-cursor.test.ts`).\n * - **The hold.** An empty poll is held open instead of answered immediately,\n * so an idle daemon is not a busy-loop. The hold is a bounded re-read, not a\n * registered waiter: a waiter map is exactly the cross-request state a\n * stateless handler may not keep (S3.5 boxes 14-15), and a second cloud\n * instance would not see it anyway.\n */\nimport type { Context } from 'hono';\nimport { decodeEnvelope, type Envelope, type EventsPollResponse } from '@byok-sdk/protocol';\nimport { authenticateDevice, type DeviceRouteDeps } from './shared';\n\n/** Protocol features this cloud build accepts from a long-poll daemon. */\nconst CLOUD_PROTOCOL_CAPABILITIES = ['result-document'];\n\nexport interface EventsRouteDeps extends DeviceRouteDeps {\n /** How long an empty poll is held open, ms. */\n readonly longPollHoldMs: number;\n /** How often the mailbox is re-read while holding, ms. */\n readonly longPollIntervalMs: number;\n /** Max rows per response. */\n readonly pageLimit: number;\n}\n\nfunction sleep(ms: number): Promise<void> {\n return new Promise((resolve) => setTimeout(resolve, ms));\n}\n\nexport function eventsHandler(deps: EventsRouteDeps) {\n return async (c: Context): Promise<Response> => {\n const authenticated = await authenticateDevice(c, deps);\n if (authenticated === undefined) return c.json({ error: 'unauthorized' }, 401);\n const { device, stores } = authenticated;\n\n const cursorRaw = c.req.query('cursor');\n let cursor = 0;\n if (cursorRaw !== undefined) {\n const parsedCursor = Number(cursorRaw);\n if (!Number.isInteger(parsedCursor) || parsedCursor < 0) return c.json({ error: 'invalid cursor' }, 400);\n cursor = parsedCursor;\n }\n\n const acked = await stores.mailbox.readCursor(device.deviceId);\n if (cursor > acked.ackedSeq) {\n await stores.mailbox.advanceCursor({ deviceId: device.deviceId, ackedSeq: cursor });\n }\n\n const attempts = Math.max(1, Math.ceil(deps.longPollHoldMs / deps.longPollIntervalMs));\n for (let attempt = 0; attempt < attempts; attempt += 1) {\n const page = await stores.mailbox.readAfter({\n deviceId: device.deviceId,\n afterSeq: cursor,\n limit: deps.pageLimit,\n });\n if (page.messages.length > 0) {\n const events: Envelope[] = page.messages.map((message) => decodeEnvelope(message.body));\n const response: EventsPollResponse = {\n events,\n cursor: page.nextSeq,\n capabilities: CLOUD_PROTOCOL_CAPABILITIES,\n };\n return c.json(response, 200);\n }\n if (attempt < attempts - 1) await sleep(deps.longPollIntervalMs);\n }\n\n const response: EventsPollResponse = {\n events: [],\n cursor,\n capabilities: CLOUD_PROTOCOL_CAPABILITIES,\n };\n return c.json(response, 200);\n };\n}\n","import { tenantKey, type TenantId } from '@byok-sdk/core';\nimport { z } from 'zod';\nimport { ByokCloudError } from './errors';\n\nexport const DEFAULT_APPROVAL_TIMELINE_CAPACITY = 50;\nexport const DEFAULT_APPROVAL_TIMELINE_TTL_MS = 10 * 60 * 1_000;\nexport const APPROVAL_SUMMARY_MAX_BYTES = 16 * 1_024;\n\nconst NonBlankIdSchema = z.string().max(200).regex(/\\S/, 'value must not be blank');\nconst TaskIdSchema = z.string().min(1).max(200);\n\nexport const ApprovalTimelineEventSchema = z.discriminatedUnion('type', [\n z.object({\n type: z.literal('approval_requested'),\n summary: z.string(),\n approvalId: NonBlankIdSchema.optional(),\n }),\n z.object({\n type: z.literal('approval_resolved'),\n approvalId: NonBlankIdSchema,\n decision: z.enum(['approve', 'reject']),\n resolvedBy: z.enum(['local']),\n at: z.iso.datetime({ offset: true }),\n }),\n]);\n\nexport type ApprovalTimelineEvent = Readonly<z.infer<typeof ApprovalTimelineEventSchema>>;\n\nexport const ApprovalObservationSchema = z.object({\n taskId: TaskIdSchema,\n sourceEnvelopeId: NonBlankIdSchema,\n revision: z.number().int().positive(),\n receivedAt: z.iso.datetime(),\n event: ApprovalTimelineEventSchema,\n});\n\nexport type ApprovalObservation = Readonly<z.infer<typeof ApprovalObservationSchema>>;\n\nexport interface ApprovalTimelineTail {\n readonly tenantId: TenantId;\n readonly taskId: string;\n readonly entries: readonly ApprovalObservation[];\n readonly cursor?: number;\n readonly dropped: number;\n readonly capacity: number;\n readonly expiresAt: string;\n}\n\nexport interface ApprovalTimelineAppendInput {\n readonly taskId: string;\n readonly sourceEnvelopeId: string;\n readonly event: ApprovalTimelineEvent;\n readonly ttlMs?: number;\n readonly capacity?: number;\n}\n\nexport interface ApprovalTimelineStore {\n append(tenant: TenantId, input: ApprovalTimelineAppendInput): Promise<ApprovalTimelineTail>;\n read(tenant: TenantId, taskId: string): Promise<ApprovalTimelineTail | undefined>;\n}\n\nexport interface ValidatedApprovalTimelineAppend {\n readonly capacity: number;\n readonly ttlMs: number;\n readonly event: ApprovalTimelineEvent;\n}\n\nexport function validateApprovalTimelineAppend(\n input: ApprovalTimelineAppendInput,\n): ValidatedApprovalTimelineAppend {\n const capacity = input.capacity ?? DEFAULT_APPROVAL_TIMELINE_CAPACITY;\n const ttlMs = input.ttlMs ?? DEFAULT_APPROVAL_TIMELINE_TTL_MS;\n if (!Number.isSafeInteger(capacity) || capacity <= 0) {\n throw new ByokCloudError(\n 'coordination_input_invalid',\n `Approval timeline capacity must be a positive integer, received ${String(capacity)}.`,\n );\n }\n if (!Number.isFinite(ttlMs) || ttlMs <= 0) {\n throw new ByokCloudError(\n 'coordination_input_invalid',\n `Approval timeline ttl must be a positive number of milliseconds, received ${String(ttlMs)}.`,\n );\n }\n const parsed = z\n .object({\n taskId: TaskIdSchema,\n sourceEnvelopeId: NonBlankIdSchema,\n event: ApprovalTimelineEventSchema,\n })\n .safeParse(input);\n if (!parsed.success) {\n throw new ByokCloudError(\n 'coordination_input_invalid',\n 'Approval observations require stable source identity and a valid native lifecycle event.',\n );\n }\n if (\n parsed.data.event.type === 'approval_requested' &&\n new TextEncoder().encode(parsed.data.event.summary).byteLength > APPROVAL_SUMMARY_MAX_BYTES\n ) {\n throw new ByokCloudError(\n 'coordination_input_invalid',\n `Approval summary exceeds ${APPROVAL_SUMMARY_MAX_BYTES} UTF-8 bytes.`,\n );\n }\n return { capacity, ttlMs, event: parsed.data.event };\n}\n\nexport function approvalTimelineKey(tenant: TenantId, taskId: string): string {\n return tenantKey(tenant, taskId);\n}\n\nexport function parseApprovalObservations(value: unknown): readonly ApprovalObservation[] {\n return z.array(ApprovalObservationSchema).parse(value) as readonly ApprovalObservation[];\n}\n\nexport function approvalTimelineCursor(\n entries: readonly ApprovalObservation[],\n): number | undefined {\n return entries.at(-1)?.revision;\n}\n","import { isCoreConflictError } from '@byok-sdk/core';\nimport type { TenantBoundBoard } from './tenant-stores';\n\n/**\n * One-way projection from an already accepted terminal fact into coordination.\n *\n * This module deliberately knows no wire message type or execution-state\n * vocabulary. It can only CAS an existing coordination row one step toward\n * review, and a concurrent board decision wins without retry or overwrite.\n */\nexport async function projectTerminalToReview(board: TenantBoundBoard, taskId: string): Promise<void> {\n const item = await board.get(taskId);\n if (item === undefined || item.status !== 'in_progress') return;\n try {\n await board.updateStatus({\n itemId: taskId,\n expectedStatus: 'in_progress',\n status: 'in_review',\n });\n } catch (caught) {\n if (isCoreConflictError(caught)) return;\n throw caught;\n }\n}\n","/**\n * The single inbound choke point for every daemon -> cloud envelope.\n *\n * The reference server runs this gate inside a live `ConnectionHub`; here it\n * is a pure function over a tenant-closed facade, so the same order holds with\n * no connection, no session, and no cross-request state:\n *\n * 0. **rate limit** — one token per inbound envelope, debited BEFORE anything\n * else, so a flood of garbage-typed envelopes costs the same budget as a\n * flood of well-formed ones. S3a's reference limiter allows everything; the\n * seam is what matters at this position.\n * 1. **type-allow** — only `DAEMON_TO_SERVER_TYPES` may pass. A server ->\n * daemon type arriving inbound, or anything unrecognized, is rejected\n * before it is dispatched or counted accepted.\n * 2. **ownership** — an envelope for a task already owned by a DIFFERENT\n * device is dropped, never force-failed: force-failing on an authz mismatch\n * would let an attacker who merely guesses a `taskId` kill the real owner's\n * task. A task with no owner yet, or that this tenant does not have at all,\n * is not rejected here — the store's own no-op-on-missing behavior covers\n * the latter, and it covers it per tenant, so a guessed id from another\n * tenant writes nothing anywhere.\n * 3. **dedup** — an envelope id already seen from this device is a no-op. The\n * wire is at-least-once (§9); this makes processing at-most-once.\n * 4. **apply** — the lifecycle write.\n *\n * A duplicate is still a wire-level success (§8.2): it just did not re-run\n * anything. Only `rejected`/`rate_limited` are excluded from `accepted`.\n */\nimport {\n DAEMON_TO_SERVER_TYPES,\n encodeEnvelope,\n type Envelope,\n type MessageType,\n} from '@byok-sdk/protocol';\nimport {\n validateActivityBatch,\n appendActivityEvents,\n DEFAULT_ACTIVITY_BOUNDS,\n type ActivityBounds,\n} from './coordination';\nimport {\n validateApprovalTimelineAppend,\n type ApprovalTimelineAppendInput,\n} from './approval-timeline';\nimport { isCloudError } from './errors';\nimport { projectTerminalToReview } from './board-projection';\nimport type { TenantStores } from './tenant-stores';\n\nexport type InboundOutcome = 'accepted' | 'duplicate' | 'rejected' | 'rate_limited';\n\n/** Receipt key a task's terminal is recorded under — the idempotency seam S3b's journal will share. */\nexport function terminalReceiptKey(taskId: string): string {\n return `task:${taskId}:terminal`;\n}\n\nexport async function handleInboundEnvelope(\n stores: TenantStores,\n deviceId: string,\n envelope: Envelope,\n activityBounds: ActivityBounds = DEFAULT_ACTIVITY_BOUNDS,\n): Promise<InboundOutcome> {\n if (!(await stores.rateLimiter.consume(deviceId))) return 'rate_limited';\n\n if (!(DAEMON_TO_SERVER_TYPES as readonly MessageType[]).includes(envelope.type)) return 'rejected';\n\n const taskId = envelope.task_id;\n // Every `DAEMON_TO_SERVER_TYPES` member requires `task_id` at the schema\n // level; this is the defensive restatement, not a second contract.\n if (taskId === undefined) return 'rejected';\n\n const attempt = await stores.tasks.get(taskId);\n if (attempt?.ownerDeviceId !== undefined && attempt.ownerDeviceId !== deviceId) return 'rejected';\n\n if (envelope.type === 'task.progress' && envelope.payload.events.length > 0) {\n try {\n validateActivityBatch(\n {\n taskId,\n sourceEnvelopeId: envelope.id,\n batchSeq: envelope.payload.seq,\n events: envelope.payload.events,\n dropped: 0,\n },\n activityBounds,\n );\n } catch (caught) {\n if (\n isCloudError(caught, 'activity_batch_too_large') ||\n isCloudError(caught, 'coordination_input_invalid')\n ) {\n return 'rejected';\n }\n throw caught;\n }\n }\n\n const approvalInput = approvalTimelineAppendInput(taskId, envelope);\n if (approvalInput !== undefined) {\n try {\n validateApprovalTimelineAppend(approvalInput);\n } catch (caught) {\n if (isCloudError(caught, 'coordination_input_invalid')) return 'rejected';\n throw caught;\n }\n }\n\n if (await stores.dedup.checkAndRecord(deviceId, envelope.id)) return 'duplicate';\n\n await applyLifecycle(stores, deviceId, taskId, envelope, activityBounds);\n return 'accepted';\n}\n\n/**\n * The lifecycle half. Deliberately thin: S3a records ownership, the coarse\n * attempt status, the terminal receipt, and bounded activity/approval\n * observations. Artifacts are accepted and carried, but the durable record of\n * what a task *produced* belongs to the truth and board planes (S5/S6) and to\n * S3b's journal — not to a map in this package.\n */\nasync function applyLifecycle(\n stores: TenantStores,\n deviceId: string,\n taskId: string,\n envelope: Envelope,\n activityBounds: ActivityBounds,\n): Promise<void> {\n switch (envelope.type) {\n case 'task.claim':\n await stores.tasks.claim({ taskId, deviceId });\n return;\n case 'task.started':\n await stores.tasks.recordStatus({ taskId, status: 'running' });\n return;\n case 'task.decline':\n await stores.tasks.recordStatus({ taskId, status: 'failed' });\n return;\n case 'task.progress':\n if (envelope.payload.events.length > 0) {\n await appendActivityEvents(\n stores.activity,\n {\n taskId,\n sourceEnvelopeId: envelope.id,\n batchSeq: envelope.payload.seq,\n events: envelope.payload.events,\n dropped: 0,\n },\n activityBounds,\n );\n }\n return;\n case 'task.await_approval':\n await stores.approvals.append(approvalTimelineAppendInput(taskId, envelope)!);\n return;\n case 'task.approval_resolved':\n await stores.approvals.append(approvalTimelineAppendInput(taskId, envelope)!);\n return;\n case 'task.complete':\n await recordTerminal(stores, taskId, envelope, 'complete');\n return;\n case 'task.fail':\n await recordTerminal(stores, taskId, envelope, 'failed');\n return;\n case 'task.cancelled':\n await recordTerminal(stores, taskId, envelope, 'cancelled');\n return;\n default:\n return;\n }\n}\n\nfunction approvalTimelineAppendInput(\n taskId: string,\n envelope: Envelope,\n): ApprovalTimelineAppendInput | undefined {\n switch (envelope.type) {\n case 'task.await_approval':\n return {\n taskId,\n sourceEnvelopeId: envelope.id,\n event: {\n type: 'approval_requested',\n summary: envelope.payload.summary,\n ...(envelope.payload.approvalId === undefined\n ? {}\n : { approvalId: envelope.payload.approvalId }),\n },\n };\n case 'task.approval_resolved':\n return {\n taskId,\n sourceEnvelopeId: envelope.id,\n event: {\n type: 'approval_resolved',\n approvalId: envelope.payload.approvalId,\n decision: envelope.payload.decision,\n resolvedBy: envelope.payload.resolvedBy,\n at: envelope.payload.at,\n },\n };\n default:\n return undefined;\n }\n}\n\n/**\n * First terminal wins (§12.6.4: 不覆写第一份事实). A retried terminal — same\n * task, new envelope id, so dedup does not catch it — records nothing new and\n * leaves the attempt status where the first one put it.\n *\n * What gets stored is `encodeEnvelope(envelope)`: the canonical v1 encoding of\n * the envelope this gate already zod-parsed, NOT the device's original byte\n * sequence. The two are semantically identical by the frozen codec's own\n * round-trip guarantee, but they are not necessarily byte-identical (key\n * order, whitespace, and any field the schema drops are the parser's call, not\n * the device's) — so this receipt is evidence of the first terminal FACT, not\n * a byte-faithful capture of the first terminal REQUEST. S3b's local journal\n * is where the device's own bytes are kept.\n */\nasync function recordTerminal(\n stores: TenantStores,\n taskId: string,\n envelope: Envelope,\n status: 'complete' | 'failed' | 'cancelled',\n): Promise<void> {\n const { created } = await stores.receipts.record({\n key: terminalReceiptKey(taskId),\n body: encodeEnvelope(envelope),\n });\n if (!created) return;\n await stores.tasks.recordStatus({ taskId, status });\n await projectTerminalToReview(stores.board, taskId);\n}\n","/**\n * `POST /byok/messages` — the long-poll send half (§8.2).\n *\n * A device long-polling for cloud -> daemon traffic has no live socket to\n * carry its own outbound envelopes; this batches them over authed HTTP. Every\n * envelope goes through the same gate (`../inbound.ts`) in the same order, so\n * claim/progress/complete behave identically no matter which transport carried\n * them.\n *\n * The batch stays tolerant at the schema level — one malformed envelope must\n * not 400 the whole request — so only a structurally invalid `Envelope` or an\n * oversized batch (`MAX_MESSAGES_PER_BATCH`) fails the request outright.\n *\n * Rate limiting is per REQUEST, not per envelope: the moment any envelope\n * comes back `rate_limited`, the rest of the batch is abandoned (its bucket is\n * empty, so every remaining envelope would limit too) and the WHOLE request\n * answers 429. Envelopes processed earlier in the same batch already took\n * effect — there are no rollback semantics here — which is safe because every\n * `task.*` type is idempotent (§9): a client that retries the same batch gets\n * `duplicate` for whatever already landed.\n */\nimport type { Context } from 'hono';\nimport { MessagesSendRequestSchema, type MessagesSendResponse } from '@byok-sdk/protocol';\nimport { handleInboundEnvelope } from '../inbound';\nimport type { ActivityBounds } from '../coordination';\nimport { authenticateDevice, readJsonBody, type DeviceRouteDeps } from './shared';\n\nexport interface MessagesRouteDeps extends DeviceRouteDeps {\n readonly activityBounds: ActivityBounds;\n}\n\nexport function messagesHandler(deps: MessagesRouteDeps) {\n return async (c: Context): Promise<Response> => {\n const authenticated = await authenticateDevice(c, deps);\n if (authenticated === undefined) return c.json({ error: 'unauthorized' }, 401);\n const { device, stores } = authenticated;\n\n const parsed = MessagesSendRequestSchema.safeParse(await readJsonBody(c));\n if (!parsed.success) return c.json({ error: 'messages must be an array of envelopes' }, 400);\n\n let accepted = 0;\n let rejected = 0;\n for (const envelope of parsed.data.messages) {\n const outcome = await handleInboundEnvelope(\n stores,\n device.deviceId,\n envelope,\n deps.activityBounds,\n );\n if (outcome === 'rate_limited') return c.json({ error: 'rate limit exceeded' }, 429);\n // A duplicate is still a wire-level success (§8.2/§9's idempotency\n // window) — it just did not re-run a handler. Only a gate rejection\n // (wrong-direction type, or an ownership mismatch) is excluded.\n if (outcome === 'rejected') rejected += 1;\n else accepted += 1;\n }\n\n // `rejected` is additive and omitted entirely when zero, so a batch with\n // nothing rejected keeps the `{ accepted }` shape callers depend on.\n const response: MessagesSendResponse = rejected > 0 ? { accepted, rejected } : { accepted };\n return c.json(response, 200);\n };\n}\n","import {\n BOARD_STATUSES,\n isCoreConflictError,\n isCoreError,\n type BoardItem,\n type BoardListQuery,\n type BoardPage,\n} from '@byok-sdk/core';\nimport type { Context } from 'hono';\nimport { z } from 'zod';\nimport { authenticateDevice, readJsonBody, type DeviceRouteDeps } from './shared';\n\nexport const DEFAULT_BOARD_PAGE_LIMIT = 50;\nexport const DEFAULT_BOARD_STREAM_QUERY_INTERVAL_MS = 5_000;\nexport const DEFAULT_BOARD_STREAM_HEARTBEAT_INTERVAL_MS = 15_000;\nexport const DEFAULT_BOARD_STREAM_RECONCILIATION_INTERVAL_MS = 120_000;\n\nexport interface BoardRouteDeps extends DeviceRouteDeps {\n readonly pageLimit: number;\n}\n\nexport interface BoardStreamRouteDeps extends BoardRouteDeps {\n readonly queryIntervalMs: number;\n readonly heartbeatIntervalMs: number;\n readonly reconciliationIntervalMs: number;\n}\n\nconst ClaimBodySchema = z.object({ expectedStatus: z.enum(BOARD_STATUSES).optional() });\nconst StatusBodySchema = z.object({\n expectedStatus: z.enum(BOARD_STATUSES),\n status: z.enum(BOARD_STATUSES),\n});\n\nfunction parseNonNegativeInteger(value: string | undefined): number | undefined {\n if (value === undefined) return 0;\n const parsed = Number(value);\n return Number.isSafeInteger(parsed) && parsed >= 0 ? parsed : undefined;\n}\n\nfunction parsePositiveInteger(value: string | undefined, fallback: number): number | undefined {\n if (value === undefined) return fallback;\n const parsed = Number(value);\n return Number.isSafeInteger(parsed) && parsed > 0 ? parsed : undefined;\n}\n\nfunction boardQuery(c: Context, pageLimit: number): BoardListQuery | undefined {\n const afterSeq = parseNonNegativeInteger(c.req.query('since'));\n const limit = parsePositiveInteger(c.req.query('limit'), pageLimit);\n const statusRaw = c.req.query('status');\n if (afterSeq === undefined || limit === undefined || limit > pageLimit) return undefined;\n if (statusRaw !== undefined && !BOARD_STATUSES.includes(statusRaw as (typeof BOARD_STATUSES)[number])) {\n return undefined;\n }\n return {\n afterSeq,\n limit,\n ...(c.req.query('channel') === undefined ? {} : { channel: c.req.query('channel') }),\n ...(statusRaw === undefined ? {} : { status: statusRaw as (typeof BOARD_STATUSES)[number] }),\n };\n}\n\nexport function boardListHandler(deps: BoardRouteDeps) {\n return async (c: Context): Promise<Response> => {\n const authenticated = await authenticateDevice(c, deps);\n if (authenticated === undefined) return c.json({ error: 'unauthorized' }, 401);\n const query = boardQuery(c, deps.pageLimit);\n if (query === undefined) return c.json({ error: 'invalid board query' }, 400);\n return c.json(await authenticated.stores.board.list(query), 200);\n };\n}\n\nexport function boardClaimHandler(deps: DeviceRouteDeps) {\n return async (c: Context): Promise<Response> => {\n const authenticated = await authenticateDevice(c, deps);\n if (authenticated === undefined) return c.json({ error: 'unauthorized' }, 401);\n const parsed = ClaimBodySchema.safeParse(await readJsonBody(c));\n if (!parsed.success) return c.json({ error: 'invalid claim body' }, 400);\n const itemId = c.req.param('id');\n if (itemId === undefined || itemId.length === 0) return c.json({ error: 'invalid board item id' }, 400);\n try {\n const item = await authenticated.stores.board.claim({\n itemId,\n holderId: authenticated.device.deviceId,\n ...(parsed.data.expectedStatus === undefined\n ? {}\n : { expectedStatus: parsed.data.expectedStatus }),\n });\n return c.json(item, 200);\n } catch (caught) {\n return boardFailure(c, caught);\n }\n };\n}\n\nexport function boardUnclaimHandler(deps: DeviceRouteDeps) {\n return async (c: Context): Promise<Response> => {\n const authenticated = await authenticateDevice(c, deps);\n if (authenticated === undefined) return c.json({ error: 'unauthorized' }, 401);\n const itemId = c.req.param('id');\n if (itemId === undefined || itemId.length === 0) return c.json({ error: 'invalid board item id' }, 400);\n try {\n return c.json(\n await authenticated.stores.board.unclaim({\n itemId,\n holderId: authenticated.device.deviceId,\n }),\n 200,\n );\n } catch (caught) {\n return boardFailure(c, caught);\n }\n };\n}\n\nexport function boardStatusHandler(deps: DeviceRouteDeps) {\n return async (c: Context): Promise<Response> => {\n const authenticated = await authenticateDevice(c, deps);\n if (authenticated === undefined) return c.json({ error: 'unauthorized' }, 401);\n const parsed = StatusBodySchema.safeParse(await readJsonBody(c));\n if (!parsed.success) return c.json({ error: 'invalid status body' }, 400);\n const itemId = c.req.param('id');\n if (itemId === undefined || itemId.length === 0) return c.json({ error: 'invalid board item id' }, 400);\n if (parsed.data.status === 'done') {\n return c.json({ error: 'done requires host review acceptance' }, 403);\n }\n try {\n return c.json(\n await authenticated.stores.board.updateStatus({\n itemId,\n expectedStatus: parsed.data.expectedStatus,\n status: parsed.data.status,\n holderId: authenticated.device.deviceId,\n }),\n 200,\n );\n } catch (caught) {\n return boardFailure(c, caught);\n }\n };\n}\n\nexport function boardStreamHandler(deps: BoardStreamRouteDeps) {\n return async (c: Context): Promise<Response> => {\n const firstAuth = await authenticateDevice(c, deps);\n if (firstAuth === undefined) return c.json({ error: 'unauthorized' }, 401);\n const query = boardQuery(c, deps.pageLimit);\n if (query === undefined) return c.json({ error: 'invalid board query' }, 400);\n\n const querySince = query.afterSeq ?? 0;\n const headerRaw = c.req.header('last-event-id');\n const headerSince = headerRaw === undefined ? undefined : parseNonNegativeInteger(headerRaw);\n if (headerRaw !== undefined && headerSince === undefined) {\n return c.json({ error: 'invalid Last-Event-ID' }, 400);\n }\n if (headerSince !== undefined && c.req.query('since') !== undefined && headerSince !== querySince) {\n return c.json({ error: 'conflicting stream cursors' }, 400);\n }\n\n let stopped = false;\n const stopController = new AbortController();\n const signal = c.req.raw.signal;\n const stream = new ReadableStream<Uint8Array>({\n start(controller) {\n const onAbort = () => {\n stopped = true;\n stopController.abort();\n closeController(controller);\n };\n signal.addEventListener('abort', onAbort, { once: true });\n void pumpBoardStream(\n controller,\n c,\n deps,\n { ...query, afterSeq: headerSince ?? querySince },\n () => stopped || signal.aborted,\n stopController.signal,\n ).finally(() => {\n stopped = true;\n stopController.abort();\n signal.removeEventListener('abort', onAbort);\n closeController(controller);\n });\n },\n cancel() {\n stopped = true;\n stopController.abort();\n },\n });\n\n return new Response(stream, {\n status: 200,\n headers: {\n 'cache-control': 'no-cache, no-transform',\n connection: 'keep-alive',\n 'content-type': 'text/event-stream; charset=utf-8',\n },\n });\n };\n}\n\nasync function pumpBoardStream(\n controller: ReadableStreamDefaultController<Uint8Array>,\n c: Context,\n deps: BoardStreamRouteDeps,\n initialQuery: BoardListQuery,\n isStopped: () => boolean,\n stopSignal: AbortSignal,\n): Promise<void> {\n let cursor = initialQuery.afterSeq ?? 0;\n let lastHeartbeat = performance.now();\n let lastReconcile = performance.now();\n while (!isStopped()) {\n const authenticated = await authenticateDevice(c, deps);\n if (authenticated === undefined) return;\n\n const page = await authenticated.stores.board.list({ ...initialQuery, afterSeq: cursor });\n for (const item of page.items) {\n enqueue(controller, `event: board\\nid: ${item.boardSeq}\\ndata: ${JSON.stringify(item)}\\n\\n`);\n cursor = item.boardSeq;\n }\n if (page.hasMore) continue;\n\n const now = performance.now();\n if (now - lastReconcile >= deps.reconciliationIntervalMs) {\n enqueue(controller, `event: reconcile\\ndata: ${JSON.stringify({ since: 0 })}\\n\\n`);\n lastReconcile = now;\n }\n if (now - lastHeartbeat >= deps.heartbeatIntervalMs) {\n enqueue(controller, ': heartbeat\\n\\n');\n lastHeartbeat = now;\n }\n await abortableSleep(deps.queryIntervalMs, stopSignal);\n }\n}\n\nfunction enqueue(controller: ReadableStreamDefaultController<Uint8Array>, value: string): void {\n try {\n controller.enqueue(new TextEncoder().encode(value));\n } catch {\n // The request abort/cancel path owns closure. A closed controller is terminal.\n }\n}\n\nfunction closeController(controller: ReadableStreamDefaultController<Uint8Array>): void {\n try {\n controller.close();\n } catch {\n // Already closed by the peer or the pump.\n }\n}\n\nasync function abortableSleep(ms: number, signal: AbortSignal): Promise<void> {\n if (signal.aborted) return;\n await new Promise<void>((resolve) => {\n let timer: ReturnType<typeof setTimeout> | undefined;\n const finish = () => {\n if (timer !== undefined) clearTimeout(timer);\n signal.removeEventListener('abort', finish);\n resolve();\n };\n timer = setTimeout(finish, ms);\n signal.addEventListener('abort', finish, { once: true });\n if (signal.aborted) finish();\n });\n}\n\nfunction boardFailure(c: Context, caught: unknown): Response {\n if (isCoreConflictError<BoardItem>(caught)) {\n const holder = caught.current.assignee;\n return c.json(\n {\n error: caught.code,\n current: caught.current,\n observedAt: caught.observedAt,\n ...(holder === undefined ? {} : { holder: { ...holder, observedAt: caught.observedAt } }),\n },\n 409,\n );\n }\n if (isCoreError(caught, 'board_item_not_found')) return c.json({ error: caught.code }, 404);\n if (isCoreError(caught, 'board_not_held')) return c.json({ error: caught.code }, 409);\n throw caught;\n}\n\nexport type BoardPollResponse = BoardPage;\n","import { isCoreError, PRESENCE_LEVELS } from '@byok-sdk/core';\nimport { ConfiguredToolsetsSchema } from '@byok-sdk/protocol';\nimport type { Context } from 'hono';\nimport { z } from 'zod';\nimport { appendActivityEvents, type ActivityBounds } from '../coordination';\nimport { ActivityAppendRequestSchema } from '../activity';\nimport { isCloudError } from '../errors';\nimport { authenticateDevice, readJsonBody, type DeviceRouteDeps } from './shared';\n\nexport interface PresenceRouteDeps extends DeviceRouteDeps {\n readonly ttlMs: number;\n readonly minimumIntervalMs: number;\n readonly detailMaxBytes: number;\n}\n\nexport interface ActivityRouteDeps extends DeviceRouteDeps {\n readonly bounds: ActivityBounds;\n}\n\nconst PresenceBodySchema = z.object({\n level: z.enum(PRESENCE_LEVELS),\n detail: z.string().optional(),\n configuredToolsets: ConfiguredToolsetsSchema.optional(),\n});\n\nexport function presencePublishHandler(deps: PresenceRouteDeps) {\n return async (c: Context): Promise<Response> => {\n const authenticated = await authenticateDevice(c, deps);\n if (authenticated === undefined) return c.json({ error: 'unauthorized' }, 401);\n const parsed = PresenceBodySchema.safeParse(await readJsonBody(c));\n if (!parsed.success) return c.json({ error: 'invalid presence body' }, 400);\n if (\n parsed.data.detail !== undefined &&\n new TextEncoder().encode(parsed.data.detail).length > deps.detailMaxBytes\n ) {\n return c.json({ error: 'presence detail too large' }, 413);\n }\n try {\n return c.json(\n await authenticated.stores.presence.publish({\n deviceId: authenticated.device.deviceId,\n level: parsed.data.level,\n ...(parsed.data.detail === undefined ? {} : { detail: parsed.data.detail }),\n ...(parsed.data.configuredToolsets === undefined\n ? {}\n : { configuredToolsets: parsed.data.configuredToolsets }),\n ttlMs: deps.ttlMs,\n minimumIntervalMs: deps.minimumIntervalMs,\n }),\n 200,\n );\n } catch (caught) {\n if (isCoreError(caught, 'hint_rate_limited')) {\n return c.json({ error: caught.code }, 429);\n }\n throw caught;\n }\n };\n}\n\nexport function activityAppendHandler(deps: ActivityRouteDeps) {\n return async (c: Context): Promise<Response> => {\n const authenticated = await authenticateDevice(c, deps);\n if (authenticated === undefined) return c.json({ error: 'unauthorized' }, 401);\n const parsed = ActivityAppendRequestSchema.safeParse(await readJsonBody(c));\n if (!parsed.success) return c.json({ error: 'invalid activity body' }, 400);\n try {\n return c.json(\n await appendActivityEvents(authenticated.stores.activity, parsed.data, deps.bounds),\n 200,\n );\n } catch (caught) {\n if (isCloudError(caught, 'activity_batch_too_large')) {\n return c.json({ error: caught.code }, 413);\n }\n if (isCloudError(caught, 'coordination_input_invalid')) {\n return c.json({ error: caught.code }, 400);\n }\n throw caught;\n }\n };\n}\n","/**\n * `GET /byok/skill-packs` and `GET /byok/skill-packs/:name/files/:path` — the\n * hosted half of the skill-pack delivery channel.\n *\n * Two device-class reads, and nothing else. There is no publish route here on\n * purpose: a device is a CONSUMER of packs, and a device-bearer-authed write\n * would let any paired device in a tenant publish content to every other device\n * in it. Publication is a host control-plane action against the store directly,\n * exactly as board item creation is.\n *\n * Both routes answer 404 for a pack this tenant does not have — the same answer\n * a name that never existed anywhere gets — so the surface is not a\n * cross-tenant existence oracle. The store is tenant-first, so that property\n * comes from the lookup key rather than from a comparison a handler could\n * forget.\n *\n * Bytes travel as UTF-8 text inside JSON. A pack carries Markdown, YAML and\n * static text; there is no archive to unpack and no binary channel to\n * negotiate, which is the same reason the manifest has no exec surface — the\n * format cannot express the thing we do not want it to express.\n */\nimport { principalTenant, type SkillPackStore } from '@byok-sdk/core';\nimport type { Context } from 'hono';\nimport { authenticateBearer, type BearerAuthDeps } from '../auth/bearer';\n\n/** Rows per `GET /byok/skill-packs` response. A tenant's pack catalogue is small by design. */\nexport const DEFAULT_SKILL_PACK_PAGE_LIMIT = 50;\n\nexport interface SkillPackRouteDeps {\n readonly bearer: BearerAuthDeps;\n readonly skillPacks: SkillPackStore;\n readonly pageLimit: number;\n}\n\nexport function skillPackListHandler(deps: SkillPackRouteDeps) {\n return async (c: Context): Promise<Response> => {\n const device = await authenticateBearer(c.req.header('authorization'), deps.bearer);\n if (device === undefined) return unauthorized(c);\n\n const packs = await deps.skillPacks.list(principalTenant(device), { limit: deps.pageLimit });\n return c.json({ packs }, 200);\n };\n}\n\nexport function skillPackFileHandler(deps: SkillPackRouteDeps) {\n return async (c: Context): Promise<Response> => {\n const device = await authenticateBearer(c.req.header('authorization'), deps.bearer);\n if (device === undefined) return unauthorized(c);\n\n const name = c.req.param('name');\n const path = c.req.param('path');\n if (name === undefined || path === undefined) return notFound(c);\n\n // No path normalization, no resolution, no decoding step of our own: the\n // store answers only for a path its own manifest declares, and those paths\n // passed core's path rule at publish time. A handler that \"cleaned up\" a\n // requested path would be inventing a second, weaker authority over what a\n // pack contains.\n const file = await deps.skillPacks.readFile(principalTenant(device), name, path);\n if (file === undefined) return notFound(c);\n return c.json(file, 200);\n };\n}\n\nfunction unauthorized(c: Context): Response {\n return c.json({ error: 'unauthorized' }, 401);\n}\n\nfunction notFound(c: Context): Response {\n return c.json({ error: 'skill_pack_not_found' }, 404);\n}\n","import {\n deviceProofSigningInput,\n isTenantId,\n parseDeviceProofEnvelope,\n tenantId,\n type Clock,\n type DevicePrincipal,\n type DeviceProofEnvelopeV1,\n} from '@byok-sdk/core';\nimport type { CloudCrypto } from '../crypto/port';\nimport type { DeviceDirectory } from '../stores/ports';\n\nexport const DEFAULT_DEVICE_PROOF_CLOCK_SKEW_MS = 60_000;\nexport const MAX_DEVICE_PROOF_CLOCK_SKEW_MS = 5 * 60_000;\nexport const DEFAULT_DEVICE_PROOF_MAX_LIFETIME_MS = 5 * 60_000;\nexport const MAX_DEVICE_PROOF_MAX_LIFETIME_MS = 15 * 60_000;\n\nexport interface DeviceProofRequestBinding {\n readonly method: string;\n readonly path: string;\n readonly operation: string;\n readonly resource: string;\n readonly body: Uint8Array;\n}\n\nexport interface DeviceProofAuthDeps {\n readonly devices: DeviceDirectory;\n readonly crypto: CloudCrypto;\n readonly clock: Clock;\n readonly clockSkewMs?: number;\n readonly maxLifetimeMs?: number;\n}\n\nexport interface AuthenticatedDeviceProof {\n /** Row-derived principal; no protected claim is re-used as authority. */\n readonly device: DevicePrincipal;\n readonly requestId: string;\n readonly operation: string;\n readonly resource: string;\n readonly bodySha256: string;\n readonly bodySize: bigint;\n readonly keyId: string;\n readonly keyEpoch: number;\n}\n\nfunction validBound(value: number, maximum: number): boolean {\n return Number.isSafeInteger(value) && value >= 0 && value <= maximum;\n}\n\nfunction parseInstant(value: string): number | undefined {\n const parsed = Date.parse(value);\n return Number.isFinite(parsed) ? parsed : undefined;\n}\n\nfunction timeBindingIsValid(\n envelope: DeviceProofEnvelopeV1,\n now: number,\n clockSkewMs: number,\n maxLifetimeMs: number,\n): boolean {\n const issuedAt = parseInstant(envelope.protected.issuedAt);\n if (issuedAt === undefined) return false;\n if (issuedAt < now - clockSkewMs || issuedAt > now + clockSkewMs) return false;\n\n const expiry = envelope.protected.expiresAt;\n if (expiry === undefined) return true;\n const expiresAt = parseInstant(expiry);\n if (expiresAt === undefined || expiresAt < issuedAt) return false;\n if (expiresAt - issuedAt > maxLifetimeMs) return false;\n return now <= expiresAt + clockSkewMs;\n}\n\n/**\n * Authenticate a request-bound proof. Every rejected state is `undefined`, so\n * a route has one 401 response for malformed input, row misses, revocation,\n * stale epochs, binding changes, clock failures and bad signatures.\n */\nexport async function authenticateDeviceProof(\n input: unknown,\n request: DeviceProofRequestBinding,\n deps: DeviceProofAuthDeps,\n): Promise<AuthenticatedDeviceProof | undefined> {\n const clockSkewMs = deps.clockSkewMs ?? DEFAULT_DEVICE_PROOF_CLOCK_SKEW_MS;\n const maxLifetimeMs = deps.maxLifetimeMs ?? DEFAULT_DEVICE_PROOF_MAX_LIFETIME_MS;\n if (!validBound(clockSkewMs, MAX_DEVICE_PROOF_CLOCK_SKEW_MS)) return undefined;\n if (!validBound(maxLifetimeMs, MAX_DEVICE_PROOF_MAX_LIFETIME_MS)) return undefined;\n\n let envelope: DeviceProofEnvelopeV1;\n try {\n envelope = parseDeviceProofEnvelope(input);\n } catch {\n return undefined;\n }\n const claims = envelope.protected;\n\n if (claims.operation !== request.operation || claims.resource !== request.resource) {\n return undefined;\n }\n if (claims.operationId !== undefined) return undefined;\n if (claims.method !== request.method || claims.path !== request.path) return undefined;\n if (claims.bodySize !== request.body.byteLength) return undefined;\n if ((await deps.crypto.sha256(request.body)) !== claims.bodySha256) return undefined;\n\n if (!isTenantId(claims.tenantId)) return undefined;\n const row = await deps.devices.get(tenantId(claims.tenantId), claims.deviceId);\n if (row === undefined || row.revoked) return undefined;\n if (row.productId !== claims.productId) return undefined;\n if (row.proofKeyId !== claims.keyId || row.proofKeyEpoch !== claims.keyEpoch) {\n return undefined;\n }\n\n if (!timeBindingIsValid(envelope, deps.clock.now().getTime(), clockSkewMs, maxLifetimeMs)) {\n return undefined;\n }\n const verified = await deps.crypto.verifyEd25519(\n row.devicePublicKey,\n deviceProofSigningInput(claims),\n envelope.signature,\n );\n if (!verified) return undefined;\n\n return {\n device: {\n kind: 'device',\n tenantId: row.tenantId,\n productId: row.productId,\n deviceId: row.deviceId,\n },\n requestId: claims.requestId,\n operation: claims.operation,\n resource: claims.resource,\n bodySha256: claims.bodySha256,\n bodySize: BigInt(claims.bodySize),\n keyId: row.proofKeyId,\n keyEpoch: row.proofKeyEpoch,\n };\n}\n","import type {\n ContentHash,\n TenantId,\n TruthBodyRef,\n TruthManifestEntry,\n TruthManifestQuery,\n TruthRecord,\n TruthRecordKind,\n TruthRecordSelector,\n} from '@byok-sdk/core';\nimport { z } from 'zod';\n\nexport const TRUTH_RECORD_CAPABILITY = 'truth.records';\nexport const TRUTH_INLINE_CONTENT_TYPE = 'application/vnd.byok.truth+utf8';\nexport const TRUTH_REQUEST_ID_MAX_LENGTH = 120;\nexport const TRUTH_RECORD_KEY_MAX_LENGTH = 200;\nexport const TRUTH_LABEL_MAX_LENGTH = 200;\nexport const TRUTH_BATCH_MAX_RECORDS = 32;\nexport const TRUTH_MANIFEST_MAX_LIMIT = 100;\n\nconst CONTENT_HASH_PATTERN = /^sha256:[0-9a-f]{64}$/;\nconst RECORD_KEY_PATTERN = /^[A-Za-z0-9][A-Za-z0-9._:-]*$/;\n\nexport const TruthRecordKeySchema = z\n .string()\n .min(1)\n .max(TRUTH_RECORD_KEY_MAX_LENGTH)\n .regex(RECORD_KEY_PATTERN)\n .refine((value) => value !== '.' && value !== '..');\n\nexport const TruthBodyInputSchema = z.discriminatedUnion('kind', [\n z.strictObject({\n kind: z.literal('inline'),\n content: z.string(),\n contentHash: z.string().regex(CONTENT_HASH_PATTERN),\n }),\n z.strictObject({\n kind: z.literal('object'),\n contentHash: z.string().regex(CONTENT_HASH_PATTERN),\n byteSize: z.number().int().nonnegative().safe(),\n }),\n]);\n\nconst SnapshotCandidateSchema = z.strictObject({\n kind: z.enum(['profile', 'memory']),\n recordKey: TruthRecordKeySchema,\n expectedRev: z.number().int().nonnegative().safe(),\n body: TruthBodyInputSchema,\n label: z.string().max(TRUTH_LABEL_MAX_LENGTH).optional(),\n});\n\nexport const TruthWriteRequestSchema = z.strictObject({\n expectedRev: z.number().int().nonnegative().safe().optional(),\n body: TruthBodyInputSchema,\n label: z.string().max(TRUTH_LABEL_MAX_LENGTH).optional(),\n snapshots: z.array(SnapshotCandidateSchema).max(TRUTH_BATCH_MAX_RECORDS - 1).optional(),\n});\n\nexport type TruthBodyInput = z.infer<typeof TruthBodyInputSchema>;\nexport type TruthWriteRequest = z.infer<typeof TruthWriteRequestSchema>;\n\nexport type PreparedTruthWrite =\n | {\n readonly kind: 'task.terminal';\n readonly recordKey: string;\n readonly contentHash: ContentHash;\n readonly byteSize: bigint;\n readonly body: TruthBodyRef;\n readonly label?: string;\n }\n | {\n readonly kind: 'profile' | 'memory';\n readonly recordKey: string;\n readonly expectedRev: number;\n readonly contentHash: ContentHash;\n readonly byteSize: bigint;\n readonly body: TruthBodyRef;\n readonly label?: string;\n };\n\nexport interface TruthCommitInput {\n readonly deviceId: string;\n readonly requestId: string;\n readonly operation: string;\n readonly resource: string;\n readonly proofBodySha256: string;\n readonly proofBodySize: bigint;\n readonly writes: readonly [PreparedTruthWrite, ...PreparedTruthWrite[]];\n}\n\nexport interface TruthRecordMetadata {\n readonly kind: TruthRecordKind;\n readonly recordKey: string;\n readonly rev: number;\n readonly contentHash: string;\n readonly byteSize: number;\n readonly label?: string;\n readonly updatedAt: string;\n}\n\nexport const TruthRecordMetadataSchema = z.strictObject({\n kind: z.enum(['task.terminal', 'profile', 'memory']),\n recordKey: TruthRecordKeySchema,\n rev: z.number().int().positive().safe(),\n contentHash: z.string().regex(CONTENT_HASH_PATTERN),\n byteSize: z.number().int().nonnegative().safe(),\n label: z.string().max(TRUTH_LABEL_MAX_LENGTH).optional(),\n updatedAt: z.string().datetime({ offset: true }),\n});\n\nexport interface TruthCommitResponse {\n readonly primary: TruthRecordMetadata;\n readonly snapshots: readonly TruthRecordMetadata[];\n}\n\nexport const TruthCommitResponseSchema = z.strictObject({\n primary: TruthRecordMetadataSchema,\n snapshots: z.array(TruthRecordMetadataSchema).max(TRUTH_BATCH_MAX_RECORDS - 1),\n});\n\nexport interface TruthCommitResult {\n readonly response: TruthCommitResponse;\n readonly replayed: boolean;\n}\n\nexport interface TruthCommitter {\n commit(tenant: TenantId, input: TruthCommitInput): Promise<TruthCommitResult>;\n getRecord(tenant: TenantId, selector: TruthRecordSelector): Promise<TruthRecord | undefined>;\n listManifest(\n tenant: TenantId,\n query: TruthManifestQuery,\n ): Promise<readonly TruthManifestEntry[]>;\n}\n\n/**\n * Object download grant authority for truth bodies. The input is the canonical\n * content hash stored in `TruthBodyRef`, never an opaque upload id.\n */\nexport interface TruthObjectDownloads {\n getDownloadUrl(tenant: TenantId, hash: ContentHash): Promise<string | undefined>;\n}\n\nexport function truthRecordMetadata(record: TruthRecord): TruthRecordMetadata {\n const byteSize = Number(record.byteSize);\n if (!Number.isSafeInteger(byteSize)) throw new Error('truth record byte size exceeds JSON range');\n return {\n kind: record.kind,\n recordKey: record.recordKey,\n rev: record.rev,\n contentHash: record.contentHash,\n byteSize,\n ...(record.label === undefined ? {} : { label: record.label }),\n updatedAt: record.writtenAt,\n };\n}\n\nexport function truthManifestMetadata(entry: TruthManifestEntry): TruthRecordMetadata {\n const byteSize = Number(entry.byteSize);\n if (!Number.isSafeInteger(byteSize)) throw new Error('truth manifest byte size exceeds JSON range');\n return {\n kind: entry.kind,\n recordKey: entry.recordKey,\n rev: entry.rev,\n contentHash: entry.contentHash,\n byteSize,\n ...(entry.label === undefined ? {} : { label: entry.label }),\n updatedAt: entry.updatedAt,\n };\n}\n","export const TRUTH_COMMIT_ERROR_CODES = [\n 'proof_request_conflict',\n 'truth_object_not_committed',\n] as const;\n\nexport type TruthCommitErrorCode = (typeof TRUTH_COMMIT_ERROR_CODES)[number];\n\nexport class TruthCommitError extends Error {\n readonly code: TruthCommitErrorCode;\n readonly current?: unknown;\n\n constructor(code: TruthCommitErrorCode, message: string, current?: unknown) {\n super(message);\n this.name = 'TruthCommitError';\n this.code = code;\n this.current = current;\n }\n}\n\nexport function isTruthCommitError(value: unknown): value is TruthCommitError {\n return value instanceof TruthCommitError;\n}\n","import {\n DEVICE_PROOF_HEADER,\n STORAGE_ERROR_CODES,\n STORAGE_ERROR_HTTP_STATUS,\n TRUTH_RECORD_KINDS,\n contentHash,\n isCoreConflictError,\n isCoreError,\n principalTenant,\n type DevicePrincipal,\n type StorageErrorCode,\n type TruthManifestQuery,\n type TruthRecord,\n type TruthRecordKind,\n} from '@byok-sdk/core';\nimport type { Context } from 'hono';\nimport { authenticateDeviceProof, type DeviceProofAuthDeps } from '../auth/device-proof';\nimport {\n TRUTH_MANIFEST_MAX_LIMIT,\n TruthRecordKeySchema,\n TruthWriteRequestSchema,\n truthManifestMetadata,\n truthRecordMetadata,\n type PreparedTruthWrite,\n type TruthBodyInput,\n type TruthCommitInput,\n type TruthCommitter,\n type TruthObjectDownloads,\n type TruthRecordMetadata,\n} from '../truth/contract';\nimport { isTruthCommitError } from '../truth/errors';\n\n// Re-exported from core (single source of truth for the wire header); still\n// part of this module's public surface for callers importing it from cloud.\nexport { DEVICE_PROOF_HEADER };\nexport const DEFAULT_MAX_TRUTH_REQUEST_BYTES = 2 * 1024 * 1024;\nexport const MAX_DEVICE_PROOF_HEADER_BYTES = 16 * 1024;\n\nconst EMPTY_BODY = new Uint8Array();\nconst RECORD_PREFIX_PATTERN = /^[A-Za-z0-9][A-Za-z0-9._:-]*$/;\n\nexport interface TruthRouteDeps {\n readonly proof: DeviceProofAuthDeps;\n readonly truth: TruthCommitter;\n readonly objectDownloads: TruthObjectDownloads;\n readonly maxRequestBytes: number;\n}\n\ninterface ProofContext {\n readonly device: DevicePrincipal;\n readonly requestId: string;\n readonly operation: string;\n readonly resource: string;\n readonly bodySha256: string;\n readonly bodySize: bigint;\n}\n\nexport function truthManifestHandler(deps: TruthRouteDeps) {\n return async (c: Context): Promise<Response> => {\n const authenticated = await authenticateTruthRequest(c, deps, {\n body: EMPTY_BODY,\n operation: 'truth.list',\n resource: 'records',\n });\n if (authenticated === undefined) return unauthorized(c);\n\n const query = manifestQuery(c);\n if (query === undefined) return c.json({ error: 'invalid truth manifest query' }, 400);\n const records = await deps.truth.listManifest(principalTenant(authenticated.device), query);\n return c.json({ records: records.map(truthManifestMetadata) }, 200);\n };\n}\n\nexport function truthGetHandler(deps: TruthRouteDeps) {\n return async (c: Context): Promise<Response> => {\n const resource = rawRecordResource(c);\n const authenticated = await authenticateTruthRequest(c, deps, {\n body: EMPTY_BODY,\n operation: 'truth.read',\n resource,\n });\n if (authenticated === undefined) return unauthorized(c);\n const selector = recordSelector(c);\n if (selector === undefined) return c.json({ error: 'invalid truth record selector' }, 400);\n\n const record = await deps.truth.getRecord(principalTenant(authenticated.device), selector);\n if (record === undefined) return c.json({ error: 'truth_record_not_found' }, 404);\n const metadata = truthRecordMetadata(record);\n if (record.body.kind === 'inline') {\n return c.json({ ...metadata, body: { kind: 'inline', content: record.body.body } }, 200);\n }\n\n const downloadUrl = await deps.objectDownloads.getDownloadUrl(\n principalTenant(authenticated.device),\n record.body.hash,\n );\n if (downloadUrl === undefined) return c.json({ error: 'object_not_found' }, 404);\n return c.json({ ...metadata, body: { kind: 'object', downloadUrl } }, 200);\n };\n}\n\nexport function truthPutHandler(deps: TruthRouteDeps) {\n return async (c: Context): Promise<Response> => {\n const body = await readBoundedBody(c, deps.maxRequestBytes);\n if (body === 'too_large') return c.json({ error: 'truth request body too large' }, 413);\n if (body === undefined) return c.json({ error: 'invalid truth request body' }, 400);\n\n const authenticated = await authenticateTruthRequest(c, deps, {\n body,\n operation: 'truth.write',\n resource: rawRecordResource(c),\n });\n if (authenticated === undefined) return unauthorized(c);\n const selector = recordSelector(c);\n if (selector === undefined) return c.json({ error: 'invalid truth record selector' }, 400);\n\n const parsedJson = parseJsonBytes(body);\n const parsed = TruthWriteRequestSchema.safeParse(parsedJson);\n if (!parsed.success) return c.json({ error: 'invalid truth write request' }, 400);\n const writes = prepareWrites(selector.kind, selector.recordKey, parsed.data);\n if (writes === undefined) return c.json({ error: 'invalid truth write model' }, 400);\n\n const input: TruthCommitInput = {\n deviceId: authenticated.device.deviceId,\n requestId: authenticated.requestId,\n operation: authenticated.operation,\n resource: authenticated.resource,\n proofBodySha256: authenticated.bodySha256,\n proofBodySize: authenticated.bodySize,\n writes,\n };\n try {\n const result = await deps.truth.commit(principalTenant(authenticated.device), input);\n return c.json(result.response, 200, { 'x-byok-replayed': result.replayed ? 'true' : 'false' });\n } catch (caught) {\n return truthFailure(c, caught);\n }\n };\n}\n\nfunction recordSelector(\n c: Context,\n): { readonly kind: TruthRecordKind; readonly recordKey: string } | undefined {\n const kind = c.req.param('kind');\n const recordKey = c.req.param('key');\n if (!TRUTH_RECORD_KINDS.includes(kind as TruthRecordKind)) return undefined;\n const parsedKey = TruthRecordKeySchema.safeParse(recordKey);\n if (!parsedKey.success) return undefined;\n return { kind: kind as TruthRecordKind, recordKey: parsedKey.data };\n}\n\nfunction rawRecordResource(c: Context): string {\n return `${c.req.param('kind') ?? ''}/${c.req.param('key') ?? ''}`;\n}\n\nfunction manifestQuery(c: Context): TruthManifestQuery | undefined {\n const url = new URL(c.req.url);\n for (const key of url.searchParams.keys()) {\n if (\n (key !== 'kind' && key !== 'prefix' && key !== 'limit') ||\n url.searchParams.getAll(key).length !== 1\n ) {\n return undefined;\n }\n }\n const kind = url.searchParams.get('kind') ?? undefined;\n if (kind !== undefined && !TRUTH_RECORD_KINDS.includes(kind as TruthRecordKind)) return undefined;\n const keyPrefix = url.searchParams.get('prefix') ?? undefined;\n if (\n keyPrefix !== undefined &&\n (keyPrefix.length === 0 || keyPrefix.length > 200 || !RECORD_PREFIX_PATTERN.test(keyPrefix))\n ) {\n return undefined;\n }\n const limitRaw = url.searchParams.get('limit') ?? undefined;\n const limit = limitRaw === undefined ? TRUTH_MANIFEST_MAX_LIMIT : Number(limitRaw);\n if (!Number.isSafeInteger(limit) || limit < 1 || limit > TRUTH_MANIFEST_MAX_LIMIT) return undefined;\n return {\n ...(kind === undefined ? {} : { kind: kind as TruthRecordKind }),\n ...(keyPrefix === undefined ? {} : { keyPrefix }),\n limit,\n };\n}\n\nfunction prepareWrites(\n kind: TruthRecordKind,\n recordKey: string,\n request: ReturnType<typeof TruthWriteRequestSchema.parse>,\n): readonly [PreparedTruthWrite, ...PreparedTruthWrite[]] | undefined {\n if (kind === 'task.terminal') {\n if (request.expectedRev !== undefined) return undefined;\n } else if (request.expectedRev === undefined || request.snapshots !== undefined) {\n return undefined;\n }\n\n const primary = prepareWrite(kind, recordKey, request.body, request.expectedRev, request.label);\n const snapshots = (request.snapshots ?? []).map((snapshot) =>\n prepareWrite(\n snapshot.kind,\n snapshot.recordKey,\n snapshot.body,\n snapshot.expectedRev,\n snapshot.label,\n ),\n );\n return [primary, ...snapshots];\n}\n\nfunction prepareWrite(\n kind: TruthRecordKind,\n recordKey: string,\n input: TruthBodyInput,\n expectedRev: number | undefined,\n label: string | undefined,\n): PreparedTruthWrite {\n const hash = contentHash(input.contentHash);\n const body =\n input.kind === 'inline'\n ? ({ kind: 'inline', body: input.content } as const)\n : ({ kind: 'object', hash } as const);\n const byteSize =\n input.kind === 'inline'\n ? BigInt(new TextEncoder().encode(input.content).byteLength)\n : BigInt(input.byteSize);\n if (kind === 'task.terminal') {\n return { kind, recordKey, contentHash: hash, byteSize, body, ...(label === undefined ? {} : { label }) };\n }\n if (expectedRev === undefined) throw new Error('snapshot expectedRev was not validated');\n return {\n kind,\n recordKey,\n expectedRev,\n contentHash: hash,\n byteSize,\n body,\n ...(label === undefined ? {} : { label }),\n };\n}\n\nasync function authenticateTruthRequest(\n c: Context,\n deps: TruthRouteDeps,\n request: { readonly body: Uint8Array; readonly operation: string; readonly resource: string },\n): Promise<ProofContext | undefined> {\n const proof = decodeProofHeader(c.req.header(DEVICE_PROOF_HEADER));\n if (proof === undefined) return undefined;\n const url = new URL(c.req.url);\n return authenticateDeviceProof(\n proof,\n {\n method: c.req.method,\n path: `${url.pathname}${url.search}`,\n operation: request.operation,\n resource: request.resource,\n body: request.body,\n },\n deps.proof,\n );\n}\n\nfunction decodeProofHeader(value: string | undefined): unknown | undefined {\n if (value === undefined || value.length === 0 || value.length > MAX_DEVICE_PROOF_HEADER_BYTES) {\n return undefined;\n }\n if (!/^[A-Za-z0-9_-]+$/.test(value) || value.length % 4 === 1) return undefined;\n try {\n const padded = value.replace(/-/g, '+').replace(/_/g, '/') + '='.repeat((4 - (value.length % 4)) % 4);\n const binary = atob(padded);\n const bytes = Uint8Array.from(binary, (character) => character.charCodeAt(0));\n return JSON.parse(new TextDecoder('utf-8', { fatal: true }).decode(bytes));\n } catch {\n return undefined;\n }\n}\n\nasync function readBoundedBody(\n c: Context,\n maximum: number,\n): Promise<Uint8Array | 'too_large' | undefined> {\n const length = c.req.header('content-length');\n if (length !== undefined) {\n const parsed = Number(length);\n if (!Number.isSafeInteger(parsed) || parsed < 0) return undefined;\n if (parsed > maximum) return 'too_large';\n }\n try {\n const bytes = new Uint8Array(await c.req.arrayBuffer());\n return bytes.byteLength > maximum ? 'too_large' : bytes;\n } catch {\n return undefined;\n }\n}\n\nfunction parseJsonBytes(bytes: Uint8Array): unknown | undefined {\n try {\n return JSON.parse(new TextDecoder('utf-8', { fatal: true }).decode(bytes));\n } catch {\n return undefined;\n }\n}\n\nfunction unauthorized(c: Context): Response {\n return c.json({ error: 'unauthorized' }, 401);\n}\n\nfunction truthFailure(c: Context, caught: unknown): Response {\n if (isCoreConflictError<TruthRecord | undefined>(caught)) {\n const current: TruthRecordMetadata | null =\n caught.current === undefined ? null : truthRecordMetadata(caught.current);\n return c.json({ error: caught.code, current, observedAt: caught.observedAt }, 409);\n }\n if (isTruthCommitError(caught)) {\n return c.json({ error: caught.code, ...(caught.current === undefined ? {} : { current: caught.current }) }, 409);\n }\n if (isCoreError(caught)) {\n if ((STORAGE_ERROR_CODES as readonly string[]).includes(caught.code)) {\n const code = caught.code as StorageErrorCode;\n return c.json({ error: code }, STORAGE_ERROR_HTTP_STATUS[code]);\n }\n if (caught.code === 'storage_entitlement_missing' || caught.code === 'object_state_invalid') {\n return c.json({ error: caught.code }, 409);\n }\n if (caught.code === 'content_hash_invalid') return c.json({ error: caught.code }, 400);\n }\n throw caught;\n}\n","/**\n * The route inventory (sprint I1).\n *\n * Isolation review starts by asking \"what routes exist, and what does each one\n * require?\" — a question that is only answerable if the answer cannot drift\n * from what is actually mounted. So mounting goes through {@link\n * CloudRouteRegistry.register} and nowhere else: the registry owns the Hono\n * app, hands out no reference to it that could be mounted on directly, and\n * records a class for every route as it goes.\n *\n * `src/__tests__/route-inventory.test.ts` closes that loop in BOTH directions\n * against Hono's own `app.routes` table: a mounted route missing from the\n * inventory fails the suite, and an inventoried route that never reached the\n * router fails it too. A route whose class is not one of {@link ROUTE_CLASSES}\n * cannot be registered at all.\n */\nimport { Hono, type Context } from 'hono';\n\n/**\n * What a route requires of its caller. Not a description of the handler's\n * work — a description of the credential it is authenticated by, which is the\n * thing an isolation review has to enumerate:\n *\n * - `device` — a bearer access token; resolves to a `DevicePrincipal` and a\n * tenant-closed facade.\n * - `proof` — a request-bound Ed25519 device proof; tenant/product/key\n * authority comes from the current device row, not protected claims.\n * - `presigned` — no principal at all; an HMAC signature over the resource id\n * plus an expiry IS the credential (§7's two `/content` routes).\n * - `public` — deliberately unauthenticated; must expose nothing tenant-scoped.\n */\nexport const ROUTE_CLASSES = ['device', 'proof', 'presigned', 'public'] as const;\nexport type RouteClass = (typeof ROUTE_CLASSES)[number];\n\nexport const ROUTE_METHODS = ['GET', 'POST', 'PUT'] as const;\nexport type RouteMethod = (typeof ROUTE_METHODS)[number];\n\nexport interface RouteDescriptor {\n readonly method: RouteMethod;\n readonly path: string;\n readonly class: RouteClass;\n}\n\nexport type CloudRouteHandler = (c: Context) => Response | Promise<Response>;\n\nexport function routeKey(route: { readonly method: string; readonly path: string }): string {\n return `${route.method} ${route.path}`;\n}\n\nexport class CloudRouteRegistry {\n readonly #app = new Hono();\n readonly #routes: RouteDescriptor[] = [];\n\n register(descriptor: RouteDescriptor, handler: CloudRouteHandler): void {\n if (!(ROUTE_CLASSES as readonly string[]).includes(descriptor.class)) {\n throw new Error(`Route ${routeKey(descriptor)} has no valid isolation class`);\n }\n if (!(ROUTE_METHODS as readonly string[]).includes(descriptor.method)) {\n throw new Error(`Route ${routeKey(descriptor)} uses an unsupported method`);\n }\n if (this.#routes.some((existing) => routeKey(existing) === routeKey(descriptor))) {\n throw new Error(`Route ${routeKey(descriptor)} is already registered`);\n }\n this.#routes.push(descriptor);\n this.#app.on(descriptor.method, descriptor.path, handler);\n }\n\n /** The inventory, in registration order. */\n get routes(): readonly RouteDescriptor[] {\n return this.#routes;\n }\n\n /** What the router actually mounted, read back off Hono itself — the other half of the I1 comparison. */\n get mounted(): readonly { readonly method: string; readonly path: string }[] {\n return this.#app.routes.map((route) => ({ method: route.method, path: route.path }));\n }\n\n get fetch(): (request: Request, ...rest: unknown[]) => Response | Promise<Response> {\n return this.#app.fetch as (request: Request, ...rest: unknown[]) => Response | Promise<Response>;\n }\n}\n","import { decodeEnvelope, type BlobRef, type Envelope } from '@byok-sdk/protocol';\nimport { ByokCloudError } from './errors';\nimport type { RequestReceipt } from './stores/ports';\n\n/**\n * The typed terminal read model — the hosted counterpart of the embedded\n * coordinator's `TaskResult`, projected off the receipt the inbound gate\n * stores. Every field is copied verbatim from the payload the gate already\n * zod-parsed before storing (`recordTerminal`, `inbound.ts`); this projection\n * neither re-validates nor synthesizes one.\n */\nexport interface TerminalResult {\n readonly taskId: string;\n readonly state: 'complete' | 'failed' | 'cancelled';\n readonly summary?: string;\n readonly sessionRef?: string;\n readonly artifactRefs?: readonly BlobRef[];\n /**\n * The product's structured terminal result, verbatim `task.complete.document`.\n * Absent — key missing, never null — when the daemon sent none, which covers\n * both a legacy pre-`result-document` build and a daemon with no\n * `resultDocument` extractor.\n */\n readonly document?: unknown;\n readonly reason?: string;\n readonly retryable?: boolean;\n /** When the receipt store wrote the terminal fact — the first one, by its own first-write-wins rule. */\n readonly recordedAt: string;\n}\n\n/**\n * Pure projection of a terminal receipt onto {@link TerminalResult}. `taskId`\n * names the task the receipt was read for (the receipt's key carries it, its\n * body does not); `recordedAt` is the receipt store's write time.\n *\n * Fail closed on anything but a terminal envelope: the stored body is\n * `encodeEnvelope` of what the inbound gate accepted, so an undecodable body\n * or a non-terminal type means the receipt-store contract itself broke — an\n * error, never a best-effort shape.\n */\nexport function projectTerminalResult(taskId: string, receipt: RequestReceipt): TerminalResult {\n let envelope: Envelope;\n try {\n envelope = decodeEnvelope(receipt.body);\n } catch (cause) {\n throw new ByokCloudError(\n 'terminal_receipt_unreadable',\n `The terminal receipt for task ${taskId} holds a body that is not a decodable envelope.`,\n { cause },\n );\n }\n switch (envelope.type) {\n case 'task.complete':\n return {\n taskId,\n state: 'complete',\n summary: envelope.payload.summary,\n sessionRef: envelope.payload.sessionRef,\n ...(envelope.payload.artifactRefs !== undefined\n ? { artifactRefs: envelope.payload.artifactRefs }\n : {}),\n ...(envelope.payload.document !== undefined ? { document: envelope.payload.document } : {}),\n recordedAt: receipt.recordedAt,\n };\n case 'task.fail':\n return {\n taskId,\n state: 'failed',\n reason: envelope.payload.reason,\n ...(envelope.payload.retryable !== undefined\n ? { retryable: envelope.payload.retryable }\n : {}),\n recordedAt: receipt.recordedAt,\n };\n case 'task.cancelled':\n return {\n taskId,\n state: 'cancelled',\n ...(envelope.payload.reason !== undefined ? { reason: envelope.payload.reason } : {}),\n recordedAt: receipt.recordedAt,\n };\n default:\n throw new ByokCloudError(\n 'terminal_receipt_unreadable',\n `The terminal receipt for task ${taskId} holds a ${envelope.type} envelope, which is not a terminal type.`,\n );\n }\n}\n","/**\n * `createByokCloud` — the hosted device surface, assembled.\n *\n * What this is NOT: an embedded coordinator. There is no `TaskHandle`, no\n * connection registry, no per-task object that a host holds onto. Sprint 0.1's\n * non-goal is explicit about that — the embedded `TaskHandle` must not become\n * the hosted API — so the host's control-plane input is a function\n * ({@link ByokCloud.enqueueOffer}) and its read model is a store query\n * ({@link ByokCloud.readTaskAttempt}).\n *\n * Every route is stateless in the strict sense: it resolves a principal from\n * the request, binds stores to that principal's tenant, and returns. Nothing\n * survives the response but what a store wrote. The one shape that would\n * quietly undo that — a Running/session map — is asserted absent by\n * `src/__tests__/constraints.test.ts`.\n */\nimport {\n contentHash,\n parseCapabilityDeclaration,\n type BoardItem,\n type BoardItemInput,\n type BoardListQuery,\n type BoardPage,\n type CapabilityDeclaration,\n type Clock,\n type ControlPlanePrincipal,\n type CoreStores,\n type PresenceHint,\n type SkillPackStore,\n type TenantId,\n} from '@byok-sdk/core';\nimport type { ActivityTail } from './activity';\nimport type { ApprovalTimelineTail } from './approval-timeline';\nimport {\n BYOK_ACTIVITY_PATH,\n BYOK_BLOB_CONTENT_ROUTE,\n BYOK_BLOB_FINALIZE_ROUTE,\n BYOK_BLOB_URL_ROUTE,\n BYOK_BLOBS_PATH,\n BYOK_BOARD_CLAIM_ROUTE,\n BYOK_BOARD_PATH,\n BYOK_BOARD_STATUS_ROUTE,\n BYOK_BOARD_STREAM_PATH,\n BYOK_BOARD_UNCLAIM_ROUTE,\n BYOK_CAPABILITIES_PATH,\n BYOK_CHALLENGE_PATH,\n BYOK_EVENTS_PATH,\n BYOK_MESSAGES_PATH,\n BYOK_PAIR_PATH,\n BYOK_PRESENCE_PATH,\n BYOK_RECORD_ROUTE,\n BYOK_RECORDS_PATH,\n BYOK_SKILL_PACK_FILE_ROUTE,\n BYOK_SKILL_PACKS_PATH,\n BYOK_TOKEN_PATH,\n createEnvelope,\n decodeEnvelope,\n encodeEnvelope,\n type Envelope,\n type TaskOfferPayload,\n type TaskOfferWithToolsetsPayload,\n} from '@byok-sdk/protocol';\nimport { createAuthPlane, type AuthPlane } from './auth/plane';\nimport type { TokenSigner } from './auth/tokens';\nimport { CLOUD_CAPABILITIES, declares } from './capabilities';\nimport {\n assertBoardLabels,\n DEFAULT_ACTIVITY_CAPACITY,\n DEFAULT_ACTIVITY_MAX_BYTES,\n DEFAULT_ACTIVITY_MAX_EVENTS,\n DEFAULT_ACTIVITY_TTL_MS,\n DEFAULT_BOARD_CHANNEL_MAX_BYTES,\n DEFAULT_BOARD_TITLE_MAX_BYTES,\n DEFAULT_PRESENCE_DETAIL_MAX_BYTES,\n DEFAULT_PRESENCE_MINIMUM_INTERVAL_MS,\n DEFAULT_PRESENCE_TTL_MS,\n type ActivityBounds,\n} from './coordination';\nimport type { CloudCrypto } from './crypto/port';\nimport { ByokCloudError } from './errors';\nimport {\n blobDownloadContentHandler,\n blobDownloadUrlHandler,\n blobUploadContentHandler,\n createBlobHandler,\n finalizeBlobHandler,\n} from './handlers/blobs';\nimport { capabilitiesHandler } from './handlers/capabilities';\nimport { challengeHandler, pairHandler, tokenHandler } from './handlers/auth';\nimport { eventsHandler } from './handlers/events';\nimport { messagesHandler } from './handlers/messages';\nimport {\n boardClaimHandler,\n boardListHandler,\n boardStatusHandler,\n boardStreamHandler,\n boardUnclaimHandler,\n DEFAULT_BOARD_PAGE_LIMIT,\n DEFAULT_BOARD_STREAM_HEARTBEAT_INTERVAL_MS,\n DEFAULT_BOARD_STREAM_QUERY_INTERVAL_MS,\n DEFAULT_BOARD_STREAM_RECONCILIATION_INTERVAL_MS,\n} from './handlers/board';\nimport { activityAppendHandler, presencePublishHandler } from './handlers/presence';\nimport {\n DEFAULT_SKILL_PACK_PAGE_LIMIT,\n skillPackFileHandler,\n skillPackListHandler,\n} from './handlers/skill-packs';\nimport {\n DEFAULT_MAX_TRUTH_REQUEST_BYTES,\n truthGetHandler,\n truthManifestHandler,\n truthPutHandler,\n} from './handlers/truth';\nimport { CloudRouteRegistry, type RouteDescriptor } from './router/registry';\nimport { terminalReceiptKey } from './inbound';\nimport type {\n BlobContentProxy,\n CloudStores,\n DeviceRecord,\n PairingCodeInfo,\n RequestReceipt,\n TaskAttempt,\n} from './stores/ports';\nimport { projectTerminalResult, type TerminalResult } from './terminal-result';\nimport { tenantStoresFor, type CloudRootStores } from './tenant-stores';\nimport type { TruthCommitter, TruthObjectDownloads } from './truth/contract';\n\n/** Matches the reference server's ceiling (§7). */\nexport const DEFAULT_MAX_BLOB_SIZE_BYTES = 100 * 1024 * 1024;\n/** Matches the reference server's hold (§8). */\nexport const DEFAULT_LONG_POLL_HOLD_MS = 50_000;\n/** How often a held poll re-reads the mailbox. */\nexport const DEFAULT_LONG_POLL_INTERVAL_MS = 250;\n/** Rows per `GET /byok/events` response. */\nexport const DEFAULT_EVENTS_PAGE_LIMIT = 50;\n\nexport interface ByokCloudOptions {\n readonly core: CoreStores;\n readonly cloud: CloudStores;\n /**\n * Byte proxying for the two `/byok/blobs/:id/content` routes. OPTIONAL, and\n * absent is a first-class answer: a composition backed by object storage\n * hands the device a presigned URL to the object store and never carries a\n * byte, so it has nothing to supply here. Supplying it is necessary but not\n * sufficient for the routes to exist — the deployment must also declare\n * `blobs.contentproxy` (ADR-010).\n */\n readonly blobContentProxy?: BlobContentProxy;\n /** Atomic proof receipt + truth/reference/accounting authority for S6 routes. */\n readonly truthCommitter?: TruthCommitter;\n /** Content-hash keyed object GET grants for object-backed truth bodies. */\n readonly truthObjectDownloads?: TruthObjectDownloads;\n /**\n * Tenant-scoped skill pack catalogue. OPTIONAL, and absent is a first-class\n * answer: a deployment that distributes no declarative content supplies\n * nothing here and declares no `skills.pack`. Supplying it is necessary but\n * not sufficient for the routes to exist — the deployment must also declare\n * the capability (ADR-010), the same asymmetry the byte proxy above has.\n */\n readonly skillPacks?: SkillPackStore;\n readonly crypto: CloudCrypto;\n readonly tokenSigner: TokenSigner;\n readonly clock: Clock;\n /** What this deployment serves (ADR-010). Routes are mounted from it, so it can never over-declare. */\n readonly capabilities: CapabilityDeclaration;\n /** Recorded on the control-plane principal every host-side call is made under. */\n readonly operatorId?: string;\n readonly maxBlobSizeBytes?: number;\n readonly longPollHoldMs?: number;\n readonly longPollIntervalMs?: number;\n readonly eventsPageLimit?: number;\n readonly accessTokenTtlSeconds?: number;\n readonly boardPageLimit?: number;\n readonly boardStreamQueryIntervalMs?: number;\n readonly boardStreamHeartbeatIntervalMs?: number;\n readonly boardStreamReconciliationIntervalMs?: number;\n readonly boardChannelMaxBytes?: number;\n readonly boardTitleMaxBytes?: number;\n readonly presenceTtlMs?: number;\n readonly presenceMinimumIntervalMs?: number;\n readonly presenceDetailMaxBytes?: number;\n readonly activityMaxEvents?: number;\n readonly activityMaxBytes?: number;\n readonly activityCapacity?: number;\n readonly activityTtlMs?: number;\n readonly maxTruthRequestBytes?: number;\n readonly skillPackPageLimit?: number;\n}\n\nexport interface EnqueueOfferInput {\n /** Supply one to make the enqueue addressable by the host's own id; otherwise cloud mints one. */\n readonly taskId?: string;\n readonly payload: TaskOfferPayload;\n}\n\nexport interface EnqueueToolsetOfferInput {\n /** Supply one to make the enqueue addressable by the host's own id; otherwise cloud mints one. */\n readonly taskId?: string;\n /** Strict control payload containing logical ids only; executable MCP definitions are not part of this type. */\n readonly payload: TaskOfferWithToolsetsPayload;\n}\n\nexport interface EnqueuedOffer {\n readonly taskId: string;\n /** The per-(tenant, device) delivery seq — the daemon's redelivery cursor position for this envelope. */\n readonly seq: number;\n readonly envelope: Envelope;\n readonly attempt: TaskAttempt;\n}\n\nexport interface ByokCloud {\n /** WHATWG fetch handler — mount on `@hono/node-server`, a Worker, or Deno. */\n readonly fetch: (request: Request, ...rest: unknown[]) => Response | Promise<Response>;\n /** The I1 route inventory: every mounted route and the credential class it requires. */\n readonly routes: readonly RouteDescriptor[];\n /**\n * What the router ACTUALLY holds, read back off the router itself. Exposed\n * so the I1 matrix can close in both directions: an inventory is only\n * evidence if a route mounted some other way would show up here without a\n * matching entry in {@link routes}.\n */\n readonly mountedRoutes: readonly { readonly method: string; readonly path: string }[];\n readonly capabilities: CapabilityDeclaration;\n /** Host control plane: mint a single-use pairing code for a tenant/product. */\n createPairingCode(tenant: TenantId, input: { readonly productId: string; readonly ttlMs?: number }): Promise<PairingCodeInfo>;\n /** Host control plane: hand a device a frozen-v1 `task.offer`. The hosted replacement for `dispatch()` — a function, not a handle. */\n enqueueOffer(tenant: TenantId, deviceId: string, input: EnqueueOfferInput): Promise<EnqueuedOffer>;\n /** Host control plane: enqueue the additive fail-closed offer variant that requires local MCP toolsets. */\n enqueueToolsetOffer(tenant: TenantId, deviceId: string, input: EnqueueToolsetOfferInput): Promise<EnqueuedOffer>;\n readTaskAttempt(tenant: TenantId, taskId: string): Promise<TaskAttempt | undefined>;\n /** The recorded terminal for a task — the first one, re-encoded canonically under the frozen v1 codec (see `recordTerminal`, `inbound.ts`: the stored body is `encodeEnvelope` of the zod-parsed envelope, not the device's original byte sequence). */\n readTerminalReceipt(tenant: TenantId, taskId: string): Promise<RequestReceipt | undefined>;\n /**\n * Host control plane: the same first terminal, decoded into the typed read\n * model ({@link TerminalResult}) so a host reads result fields, not envelope\n * prose. `undefined` ONLY means no terminal fact is recorded yet:\n * first-terminal-wins is inherited from the receipt store\n * ({@link ByokCloud.readTerminalReceipt} reads the same row), and a declined\n * task records no terminal at all — use {@link ByokCloud.readTaskAttempt}\n * for that attempt status. An absent `document` covers both a legacy\n * pre-`result-document` daemon build and a daemon with no `resultDocument`\n * extractor; a receipt whose body is not a terminal envelope throws rather\n * than returning a best-effort shape.\n */\n readTaskResult(tenant: TenantId, taskId: string): Promise<TerminalResult | undefined>;\n listDevices(tenant: TenantId): Promise<readonly DeviceRecord[]>;\n revokeDevice(tenant: TenantId, deviceId: string): Promise<void>;\n /** Host control plane: create a board row from explicit producer labels. */\n createBoardItem(tenant: TenantId, input: BoardItemInput): Promise<BoardItem>;\n listBoardItems(tenant: TenantId, query: BoardListQuery): Promise<BoardPage>;\n /** Human review authority. Device routes cannot produce `done`. */\n acceptBoardItem(tenant: TenantId, itemId: string): Promise<BoardItem>;\n listPresence(tenant: TenantId): Promise<readonly PresenceHint[]>;\n readActivity(tenant: TenantId, taskId: string): Promise<ActivityTail | undefined>;\n readApprovalTimeline(\n tenant: TenantId,\n taskId: string,\n ): Promise<ApprovalTimelineTail | undefined>;\n}\n\nexport function createByokCloud(options: ByokCloudOptions): ByokCloud {\n const declaration = parseDeclaration(options.capabilities);\n assertNoOverDeclaration(\n declaration,\n options.blobContentProxy,\n options.truthCommitter,\n options.truthObjectDownloads,\n options.skillPacks,\n );\n const root: CloudRootStores = { core: options.core, cloud: options.cloud };\n const auth: AuthPlane = createAuthPlane({\n stores: options.cloud,\n crypto: options.crypto,\n clock: options.clock,\n tokenSigner: options.tokenSigner,\n ...(options.accessTokenTtlSeconds !== undefined\n ? { accessTokenTtlSeconds: options.accessTokenTtlSeconds }\n : {}),\n });\n\n const deviceRouteDeps = {\n root,\n bearer: { tokenSigner: options.tokenSigner, devices: options.cloud.devices },\n };\n\n const registry = new CloudRouteRegistry();\n const activityBounds: ActivityBounds = {\n maxEvents: options.activityMaxEvents ?? DEFAULT_ACTIVITY_MAX_EVENTS,\n maxBytes: options.activityMaxBytes ?? DEFAULT_ACTIVITY_MAX_BYTES,\n capacity: options.activityCapacity ?? DEFAULT_ACTIVITY_CAPACITY,\n ttlMs: options.activityTtlMs ?? DEFAULT_ACTIVITY_TTL_MS,\n };\n\n // Auth v2 (§6) — always mounted: without pairing there is no deployment.\n registry.register({ method: 'POST', path: BYOK_PAIR_PATH, class: 'public' }, pairHandler({ auth }));\n registry.register({ method: 'POST', path: BYOK_CHALLENGE_PATH, class: 'public' }, challengeHandler({ auth }));\n registry.register({ method: 'POST', path: BYOK_TOKEN_PATH, class: 'public' }, tokenHandler({ auth }));\n\n // ADR-010 — the declaration itself is always readable; a client that cannot\n // read it has no way to learn anything else without probing status codes.\n registry.register(\n { method: 'GET', path: BYOK_CAPABILITIES_PATH, class: 'public' },\n capabilitiesHandler({ declaration }),\n );\n\n if (declares(declaration, CLOUD_CAPABILITIES.eventsLongPoll)) {\n registry.register(\n { method: 'GET', path: BYOK_EVENTS_PATH, class: 'device' },\n eventsHandler({\n ...deviceRouteDeps,\n longPollHoldMs: options.longPollHoldMs ?? DEFAULT_LONG_POLL_HOLD_MS,\n longPollIntervalMs: options.longPollIntervalMs ?? DEFAULT_LONG_POLL_INTERVAL_MS,\n pageLimit: options.eventsPageLimit ?? DEFAULT_EVENTS_PAGE_LIMIT,\n }),\n );\n }\n\n if (declares(declaration, CLOUD_CAPABILITIES.messagesBatch)) {\n registry.register(\n { method: 'POST', path: BYOK_MESSAGES_PATH, class: 'device' },\n messagesHandler({ ...deviceRouteDeps, activityBounds }),\n );\n }\n\n if (declares(declaration, CLOUD_CAPABILITIES.boardCoordination)) {\n const boardDeps = {\n ...deviceRouteDeps,\n pageLimit: options.boardPageLimit ?? DEFAULT_BOARD_PAGE_LIMIT,\n };\n registry.register({ method: 'GET', path: BYOK_BOARD_PATH, class: 'device' }, boardListHandler(boardDeps));\n registry.register(\n { method: 'POST', path: BYOK_BOARD_CLAIM_ROUTE, class: 'device' },\n boardClaimHandler(deviceRouteDeps),\n );\n registry.register(\n { method: 'POST', path: BYOK_BOARD_UNCLAIM_ROUTE, class: 'device' },\n boardUnclaimHandler(deviceRouteDeps),\n );\n registry.register(\n { method: 'POST', path: BYOK_BOARD_STATUS_ROUTE, class: 'device' },\n boardStatusHandler(deviceRouteDeps),\n );\n }\n\n if (declares(declaration, CLOUD_CAPABILITIES.boardSse)) {\n registry.register(\n { method: 'GET', path: BYOK_BOARD_STREAM_PATH, class: 'device' },\n boardStreamHandler({\n ...deviceRouteDeps,\n pageLimit: options.boardPageLimit ?? DEFAULT_BOARD_PAGE_LIMIT,\n queryIntervalMs: options.boardStreamQueryIntervalMs ?? DEFAULT_BOARD_STREAM_QUERY_INTERVAL_MS,\n heartbeatIntervalMs:\n options.boardStreamHeartbeatIntervalMs ?? DEFAULT_BOARD_STREAM_HEARTBEAT_INTERVAL_MS,\n reconciliationIntervalMs:\n options.boardStreamReconciliationIntervalMs ??\n DEFAULT_BOARD_STREAM_RECONCILIATION_INTERVAL_MS,\n }),\n );\n }\n\n if (declares(declaration, CLOUD_CAPABILITIES.presenceHints)) {\n registry.register(\n { method: 'PUT', path: BYOK_PRESENCE_PATH, class: 'device' },\n presencePublishHandler({\n ...deviceRouteDeps,\n ttlMs: options.presenceTtlMs ?? DEFAULT_PRESENCE_TTL_MS,\n minimumIntervalMs:\n options.presenceMinimumIntervalMs ?? DEFAULT_PRESENCE_MINIMUM_INTERVAL_MS,\n detailMaxBytes: options.presenceDetailMaxBytes ?? DEFAULT_PRESENCE_DETAIL_MAX_BYTES,\n }),\n );\n }\n\n if (declares(declaration, CLOUD_CAPABILITIES.activityTail)) {\n registry.register(\n { method: 'POST', path: BYOK_ACTIVITY_PATH, class: 'device' },\n activityAppendHandler({ ...deviceRouteDeps, bounds: activityBounds }),\n );\n }\n\n const truthCommitter = options.truthCommitter;\n const truthObjectDownloads = options.truthObjectDownloads;\n if (\n truthCommitter !== undefined &&\n truthObjectDownloads !== undefined &&\n declares(declaration, CLOUD_CAPABILITIES.truthRecords)\n ) {\n const truthDeps = {\n proof: {\n devices: options.cloud.devices,\n crypto: options.crypto,\n clock: options.clock,\n },\n truth: truthCommitter,\n objectDownloads: truthObjectDownloads,\n maxRequestBytes: options.maxTruthRequestBytes ?? DEFAULT_MAX_TRUTH_REQUEST_BYTES,\n };\n registry.register(\n { method: 'GET', path: BYOK_RECORDS_PATH, class: 'proof' },\n truthManifestHandler(truthDeps),\n );\n registry.register(\n { method: 'GET', path: BYOK_RECORD_ROUTE, class: 'proof' },\n truthGetHandler(truthDeps),\n );\n registry.register(\n { method: 'PUT', path: BYOK_RECORD_ROUTE, class: 'proof' },\n truthPutHandler(truthDeps),\n );\n }\n\n // Skill packs: both conditions, same asymmetry as the byte proxy below.\n // Declared-without-a-store is fatal (above); supplied-without-a-declaration\n // is a silent no-mount, which is how a deployment rolls the channel out or\n // back without ever telling a client something false.\n const skillPacks = options.skillPacks;\n if (skillPacks !== undefined && declares(declaration, CLOUD_CAPABILITIES.skillPacks)) {\n const skillPackDeps = {\n bearer: deviceRouteDeps.bearer,\n skillPacks,\n pageLimit: options.skillPackPageLimit ?? DEFAULT_SKILL_PACK_PAGE_LIMIT,\n };\n registry.register(\n { method: 'GET', path: BYOK_SKILL_PACKS_PATH, class: 'device' },\n skillPackListHandler(skillPackDeps),\n );\n registry.register(\n { method: 'GET', path: BYOK_SKILL_PACK_FILE_ROUTE, class: 'device' },\n skillPackFileHandler(skillPackDeps),\n );\n }\n\n if (declares(declaration, CLOUD_CAPABILITIES.blobsPresigned)) {\n const blobDeps = {\n ...deviceRouteDeps,\n maxBlobSizeBytes: options.maxBlobSizeBytes ?? DEFAULT_MAX_BLOB_SIZE_BYTES,\n };\n registry.register({ method: 'POST', path: BYOK_BLOBS_PATH, class: 'device' }, createBlobHandler(blobDeps));\n registry.register({ method: 'POST', path: BYOK_BLOB_FINALIZE_ROUTE, class: 'device' }, finalizeBlobHandler(blobDeps));\n registry.register({ method: 'GET', path: BYOK_BLOB_URL_ROUTE, class: 'device' }, blobDownloadUrlHandler(blobDeps));\n }\n\n // Byte proxying: BOTH conditions, and neither is inferred from the other.\n // There is no third state: a composition either carries bytes or it does not.\n //\n // The two halves fail differently, and the asymmetry is the point.\n //\n // DECLARED WITHOUT A PROXY is fatal, above. A declaration is the ONE thing a\n // client is entitled to trust without probing (ADR-010), so a deployment\n // publishing `blobs.contentproxy` it cannot serve does not degrade to \"two\n // missing routes\" — it tells every client something false and then answers\n // 404 to the client that believed it. Not mounting the routes is what an\n // honest composition does with a capability it lacks; the dishonesty is in\n // still announcing it, and the announcement is unconditional.\n //\n // SUPPLIED WITHOUT A DECLARATION is not fatal, and stays a silent no-mount.\n // The deployment's declaration is then merely narrower than its parts, which\n // is how a capability gets rolled out or rolled back: a host with a proxy\n // wired up but the capability withheld serves exactly what it declares. The\n // client is told less than the truth, never more, and no route exists that a\n // client could only discover by probing.\n const contentProxy = options.blobContentProxy;\n if (contentProxy !== undefined && declares(declaration, CLOUD_CAPABILITIES.blobsContentProxy)) {\n const contentDeps = { contentProxy };\n registry.register(\n { method: 'PUT', path: BYOK_BLOB_CONTENT_ROUTE, class: 'presigned' },\n blobUploadContentHandler(contentDeps),\n );\n registry.register(\n { method: 'GET', path: BYOK_BLOB_CONTENT_ROUTE, class: 'presigned' },\n blobDownloadContentHandler(contentDeps),\n );\n }\n\n // Task approval is deliberately absent, exactly as it is on the reference\n // server: every route above is authenticated by a DEVICE's own credential,\n // and a device-bearer-authed approval route would let any validly paired\n // device approve any task in its tenant. Approval is an operator action and\n // belongs to the host's own control-plane surface.\n\n const operatorId = options.operatorId ?? 'host';\n\n function controlPlane(tenant: TenantId): ControlPlanePrincipal {\n return { kind: 'control-plane', tenantId: tenant, operatorId };\n }\n\n async function enqueueTaskEnvelope(\n tenant: TenantId,\n deviceId: string,\n requestedTaskId: string | undefined,\n buildEnvelope: (taskId: string, seq: number, messageId: string) => Envelope,\n ): Promise<EnqueuedOffer> {\n const stores = tenantStoresFor(controlPlane(tenant), root);\n const taskId = requestedTaskId ?? `task_${options.crypto.randomUuid()}`;\n const messageId = options.crypto.randomUuid();\n\n const message = await stores.mailbox.append({\n deviceId,\n messageId,\n materialize: async (seq) => {\n // Core stays protocol-free: the mailbox reserves the one authoritative\n // delivery number, then asks this producer to build opaque bytes while\n // allocation and insertion are still serialized per device.\n const envelope = buildEnvelope(taskId, seq, messageId);\n const body = encodeEnvelope(envelope);\n const bytes = new TextEncoder().encode(body);\n return {\n body,\n bodyHash: contentHash(await options.crypto.sha256(bytes)),\n byteSize: BigInt(bytes.length),\n };\n },\n });\n const envelope = decodeEnvelope(message.body);\n if (envelope.seq !== message.seq) {\n throw new ByokCloudError(\n 'mailbox_seq_mismatch',\n `Mailbox stored offer seq ${String(envelope.seq)} at row ${message.seq}; the daemon's redelivery cursor would be wrong.`,\n );\n }\n\n const attempt = await stores.tasks.open({ taskId, deviceId });\n return { taskId, seq: message.seq, envelope, attempt };\n }\n\n return {\n fetch: registry.fetch,\n routes: registry.routes,\n mountedRoutes: registry.mounted,\n capabilities: declaration,\n\n createPairingCode(tenant, input) {\n return auth.createPairingCode(tenant, input);\n },\n\n async enqueueOffer(tenant, deviceId, input) {\n return enqueueTaskEnvelope(tenant, deviceId, input.taskId, (taskId, seq, messageId) =>\n createEnvelope('task.offer', input.payload, { id: messageId, taskId, seq }),\n );\n },\n\n async enqueueToolsetOffer(tenant, deviceId, input) {\n return enqueueTaskEnvelope(tenant, deviceId, input.taskId, (taskId, seq, messageId) =>\n createEnvelope('task.offer_with_toolsets', input.payload, { id: messageId, taskId, seq }),\n );\n },\n\n readTaskAttempt(tenant, taskId) {\n return tenantStoresFor(controlPlane(tenant), root).tasks.get(taskId);\n },\n\n readTerminalReceipt(tenant, taskId) {\n return tenantStoresFor(controlPlane(tenant), root).receipts.get(terminalReceiptKey(taskId));\n },\n\n async readTaskResult(tenant, taskId) {\n const receipt = await tenantStoresFor(controlPlane(tenant), root).receipts.get(\n terminalReceiptKey(taskId),\n );\n return receipt === undefined ? undefined : projectTerminalResult(taskId, receipt);\n },\n\n listDevices(tenant) {\n return tenantStoresFor(controlPlane(tenant), root).devices.list();\n },\n\n revokeDevice(tenant, deviceId) {\n return tenantStoresFor(controlPlane(tenant), root).devices.revoke(deviceId);\n },\n\n createBoardItem(tenant, input) {\n assertBoardLabels(input.channel, input.title, {\n channelMaxBytes: options.boardChannelMaxBytes ?? DEFAULT_BOARD_CHANNEL_MAX_BYTES,\n titleMaxBytes: options.boardTitleMaxBytes ?? DEFAULT_BOARD_TITLE_MAX_BYTES,\n });\n return tenantStoresFor(controlPlane(tenant), root).board.create(input);\n },\n\n listBoardItems(tenant, query) {\n return tenantStoresFor(controlPlane(tenant), root).board.list(query);\n },\n\n acceptBoardItem(tenant, itemId) {\n return tenantStoresFor(controlPlane(tenant), root).board.updateStatus({\n itemId,\n expectedStatus: 'in_review',\n status: 'done',\n });\n },\n\n listPresence(tenant) {\n return tenantStoresFor(controlPlane(tenant), root).presence.list();\n },\n\n readActivity(tenant, taskId) {\n return tenantStoresFor(controlPlane(tenant), root).activity.read(taskId);\n },\n\n readApprovalTimeline(tenant, taskId) {\n return tenantStoresFor(controlPlane(tenant), root).approvals.read(taskId);\n },\n };\n}\n\n/**\n * Fail closed on a declaration this composition's parts cannot back.\n *\n * Route mounting alone cannot enforce this: `GET /byok/capabilities` serves the\n * declaration verbatim and is mounted unconditionally, so a deployment that\n * declares `blobs.contentproxy` without a proxy publishes the capability and\n * 404s both routes. Refusing at construction is the only placement where the\n * deployment cannot exist in that state — the alternative, sanitizing the\n * declaration down to what got mounted, would make the running surface a second\n * authority over what the host said it was deploying.\n */\nfunction assertNoOverDeclaration(\n declaration: CapabilityDeclaration,\n contentProxy: BlobContentProxy | undefined,\n truthCommitter: TruthCommitter | undefined,\n truthObjectDownloads: TruthObjectDownloads | undefined,\n skillPacks: SkillPackStore | undefined,\n): void {\n if (\n declares(declaration, CLOUD_CAPABILITIES.boardSse) &&\n !declares(declaration, CLOUD_CAPABILITIES.boardCoordination)\n ) {\n throw new ByokCloudError(\n 'capability_over_declared',\n `${CLOUD_CAPABILITIES.boardSse} requires ${CLOUD_CAPABILITIES.boardCoordination}; without polling, reconciliation and declared fallback cannot be served.`,\n );\n }\n if (contentProxy === undefined && declares(declaration, CLOUD_CAPABILITIES.blobsContentProxy)) {\n throw new ByokCloudError(\n 'capability_over_declared',\n `This deployment declares ${CLOUD_CAPABILITIES.blobsContentProxy} but was given no BlobContentProxy, so both /byok/blobs/:id/content routes would be published and unserved.`,\n );\n }\n if (truthCommitter === undefined && declares(declaration, CLOUD_CAPABILITIES.truthRecords)) {\n throw new ByokCloudError(\n 'capability_over_declared',\n `This deployment declares ${CLOUD_CAPABILITIES.truthRecords} but was given no atomic TruthCommitter.`,\n );\n }\n if (truthObjectDownloads === undefined && declares(declaration, CLOUD_CAPABILITIES.truthRecords)) {\n throw new ByokCloudError(\n 'capability_over_declared',\n `This deployment declares ${CLOUD_CAPABILITIES.truthRecords} but was given no content-hash keyed TruthObjectDownloads authority.`,\n );\n }\n if (skillPacks === undefined && declares(declaration, CLOUD_CAPABILITIES.skillPacks)) {\n throw new ByokCloudError(\n 'capability_over_declared',\n `This deployment declares ${CLOUD_CAPABILITIES.skillPacks} but was given no SkillPackStore, so both /byok/skill-packs routes would be published and unserved.`,\n );\n }\n}\n\nfunction parseDeclaration(declaration: CapabilityDeclaration): CapabilityDeclaration {\n try {\n return parseCapabilityDeclaration(declaration);\n } catch (cause) {\n throw new ByokCloudError(\n 'capability_declaration_invalid',\n 'The capability declaration this deployment was configured with is not a valid ADR-010 declaration.',\n { cause },\n );\n }\n}\n","/**\n * The reference {@link InboundRateLimiter}: allow-all.\n *\n * S3a's job is to put the seam at gate position 0 — before the type-allow\n * check — not to invent a limiter policy. A hosted deployment's real budget\n * lives at its edge; when it arrives it plugs in here and the gate order does\n * not move.\n */\nimport type { TenantId } from '@byok-sdk/core';\nimport type { InboundRateLimiter } from '../ports';\n\nexport class AllowAllRateLimiter implements InboundRateLimiter {\n async consume(_tenant: TenantId, _deviceId: string): Promise<boolean> {\n return true;\n }\n}\n","/**\n * The in-memory blob pair: metadata and bytes in process memory, HMAC-signed\n * expiring URLs (docs/protocol.md §7).\n *\n * TWO objects, one shared record map, because the contract they satisfy is two\n * things: {@link CloudBlobStore} is the tenant-first port every composition\n * owes, and {@link BlobContentProxy} is the optional byte-carrying half. The\n * in-memory composition is the one that supplies both — it has nowhere else to\n * put bytes — which is why hosted-in-memory behavior is byte-for-byte what it\n * was before the split.\n *\n * They cannot be one object: the port's method inventory is contract data\n * (`CLOUD_PORT_METHODS`) and `@byok-sdk/conformance` asserts a composition's blob\n * store implements EXACTLY the two declared methods. An object carrying all\n * six would fail that assertion, which is the point — the suite is what keeps\n * the narrowed port narrow.\n *\n * The presigned URL form — `/byok/blobs/<id>/content?sig=&exp=` — is the\n * relative shape the daemon's blob client already resolves against its server\n * base, so a hosted deployment is indistinguishable from a self-hosted one on\n * this route too.\n *\n * Tenancy: `createUpload` records the owning tenant and reservation while\n * `observeUpload`/`getDownloadUrl` refuse any other, so the three bearer routes are\n * tenant-closed. The two `/content` routes are presigned by construction and\n * have no principal at all — the signature over the blob id IS the credential\n * (same posture as the reference server, §7).\n */\nimport { ByokCoreError, type Clock, type ContentHash, type ObjectStore, type StorageReservation, type TenantId } from '@byok-sdk/core';\nimport { byokBlobContentPath } from '@byok-sdk/protocol';\nimport type { CloudCrypto } from '../../crypto/port';\nimport type {\n BlobContent,\n BlobContentProxy,\n BlobObservation,\n BlobWriteResult,\n CloudBlobStore,\n} from '../ports';\n\n/** How long a presigned upload/download URL stays valid. */\nexport const BLOB_URL_TTL_MS = 15 * 60 * 1000;\n\nconst SIGNING_SECRET_BYTES = 32;\n\ninterface BlobRecord {\n readonly tenantId: TenantId;\n readonly reservationId: string;\n readonly contentHash: ContentHash;\n readonly byteSize: bigint;\n readonly contentType: string;\n uploaded: boolean;\n data?: Uint8Array;\n}\n\nexport interface InMemoryBlobStoreOptions {\n readonly urlTtlMs?: number;\n}\n\n/**\n * The state both halves read, and the only thing they share.\n *\n * Module-private on purpose: it is not a port, and nothing outside this file\n * should be able to reach a blob record without going through one of the two\n * contracts above.\n */\nclass InMemoryBlobRegistry {\n readonly blobs = new Map<string, BlobRecord>();\n readonly reservationBlobs = new Map<string, string>();\n readonly clock: Clock;\n readonly crypto: CloudCrypto;\n readonly secret: Uint8Array;\n readonly urlTtlMs: number;\n\n constructor(clock: Clock, crypto: CloudCrypto, options: InMemoryBlobStoreOptions) {\n this.clock = clock;\n this.crypto = crypto;\n this.secret = globalThis.crypto.getRandomValues(new Uint8Array(SIGNING_SECRET_BYTES));\n this.urlTtlMs = options.urlTtlMs ?? BLOB_URL_TTL_MS;\n }\n\n async signUrl(blobId: string, action: 'put' | 'get'): Promise<string> {\n const exp = this.clock.now().getTime() + this.urlTtlMs;\n const sig = await this.computeSig(blobId, action, exp);\n return `${byokBlobContentPath(blobId)}?sig=${sig}&exp=${exp}`;\n }\n\n computeSig(blobId: string, action: 'put' | 'get', exp: number): Promise<string> {\n return this.crypto.hmacSha256(this.secret, `${blobId}:${action}:${exp}`);\n }\n}\n\n/** The narrowed port: tenant-first grants, no bytes. */\nexport class InMemoryCloudBlobStore implements CloudBlobStore {\n readonly #registry: InMemoryBlobRegistry;\n readonly #objects: ObjectStore;\n\n constructor(registry: InMemoryBlobRegistry, objects: ObjectStore) {\n this.#registry = registry;\n this.#objects = objects;\n }\n\n async createUpload(tenant: TenantId, reservation: StorageReservation): Promise<{ blobId: string; uploadUrl: string }> {\n assertReservedObject(tenant, reservation);\n const reservationKey = `${tenant}\\u0000${reservation.reservationId}`;\n const existingBlobId = this.#registry.reservationBlobs.get(reservationKey);\n if (existingBlobId !== undefined) {\n const manifest = await this.#objects.get(tenant, reservation.contentHash);\n if (manifest?.state === 'committed') {\n throw new ByokCoreError(\n 'object_state_invalid',\n `Object ${reservation.contentHash} is already committed and immutable.`,\n );\n }\n return { blobId: existingBlobId, uploadUrl: await this.#registry.signUrl(existingBlobId, 'put') };\n }\n\n const entry = await this.#objects.putManifest(tenant, {\n hash: reservation.contentHash,\n byteSize: reservation.expectedBytes,\n contentType: reservation.contentType,\n });\n if (\n entry.byteSize !== reservation.expectedBytes ||\n entry.contentType !== reservation.contentType\n ) {\n throw new ByokCoreError(\n 'storage_integrity_mismatch',\n `Object ${reservation.contentHash} already binds a different storage declaration.`,\n );\n }\n if (entry.state === 'committed') {\n throw new ByokCoreError(\n 'object_state_invalid',\n `Object ${reservation.contentHash} is already committed and immutable.`,\n );\n }\n\n const blobId = `blob_${this.#registry.crypto.randomUuid()}`;\n this.#registry.blobs.set(blobId, {\n tenantId: tenant,\n reservationId: reservation.reservationId,\n contentHash: reservation.contentHash,\n byteSize: reservation.expectedBytes,\n contentType: reservation.contentType,\n uploaded: false,\n });\n this.#registry.reservationBlobs.set(reservationKey, blobId);\n return { blobId, uploadUrl: await this.#registry.signUrl(blobId, 'put') };\n }\n\n async observeUpload(\n tenant: TenantId,\n blobId: string,\n reservation: StorageReservation,\n ): Promise<BlobObservation | undefined> {\n const record = this.#registry.blobs.get(blobId);\n if (\n record === undefined ||\n record.tenantId !== tenant ||\n reservation.tenantId !== tenant ||\n record.reservationId !== reservation.reservationId ||\n record.contentHash !== reservation.contentHash ||\n !record.uploaded\n ) {\n return undefined;\n }\n return {\n observedByteSize: BigInt(record.data?.length ?? 0),\n observedContentType: record.contentType,\n };\n }\n\n async getDownloadUrl(tenant: TenantId, blobId: string): Promise<string | undefined> {\n const record = this.#registry.blobs.get(blobId);\n // Another tenant's blob and a blob that does not exist answer identically.\n if (record === undefined || record.tenantId !== tenant || !record.uploaded) return undefined;\n const manifest = await this.#objects.get(tenant, record.contentHash);\n if (manifest?.state !== 'committed') return undefined;\n return this.#registry.signUrl(blobId, 'get');\n }\n}\n\n/** The optional half: the bytes this composition has nowhere else to put. */\nexport class InMemoryBlobContentProxy implements BlobContentProxy {\n readonly #registry: InMemoryBlobRegistry;\n\n constructor(registry: InMemoryBlobRegistry) {\n this.#registry = registry;\n }\n\n async verifySignedUrl(blobId: string, action: 'put' | 'get', sig: string, exp: number): Promise<boolean> {\n if (!Number.isFinite(exp) || this.#registry.clock.now().getTime() > exp) return false;\n const expected = await this.#registry.computeSig(blobId, action, exp);\n return this.#registry.crypto.timingSafeEqual(expected, sig);\n }\n\n async writeContent(blobId: string, data: Uint8Array): Promise<BlobWriteResult> {\n const record = this.#registry.blobs.get(blobId);\n if (record === undefined) return { ok: false, reason: 'unknown blobId' };\n if (BigInt(data.length) !== record.byteSize) {\n return { ok: false, reason: `size mismatch: declared ${String(record.byteSize)}, received ${data.length}` };\n }\n const actualHash = await this.#registry.crypto.sha256(data);\n if (actualHash !== record.contentHash) {\n return { ok: false, reason: 'contentHash mismatch' };\n }\n record.data = data;\n record.uploaded = true;\n return { ok: true };\n }\n\n async readContent(blobId: string): Promise<BlobContent | undefined> {\n const record = this.#registry.blobs.get(blobId);\n if (record === undefined || !record.uploaded || record.data === undefined) return undefined;\n return { data: record.data, contentType: record.contentType };\n }\n}\n\n/** Both halves over one registry. The only way to obtain either. */\nexport interface InMemoryBlobs {\n readonly blobs: CloudBlobStore;\n readonly contentProxy: BlobContentProxy;\n}\n\nexport function createInMemoryBlobs(\n clock: Clock,\n crypto: CloudCrypto,\n objects: ObjectStore,\n options: InMemoryBlobStoreOptions = {},\n): InMemoryBlobs {\n const registry = new InMemoryBlobRegistry(clock, crypto, options);\n return {\n blobs: new InMemoryCloudBlobStore(registry, objects),\n contentProxy: new InMemoryBlobContentProxy(registry),\n };\n}\n\nfunction assertReservedObject(tenant: TenantId, reservation: StorageReservation): void {\n if (\n reservation.tenantId === tenant &&\n reservation.kind === 'object' &&\n reservation.state === 'reserved' &&\n reservation.expectedBytes >= 0n\n ) {\n return;\n }\n throw new ByokCoreError(\n 'storage_integrity_mismatch',\n 'An upload grant requires a reserved object reservation owned by this tenant.',\n );\n}\n","/**\n * In-memory {@link DeviceDirectory}.\n *\n * Rows live under a `(tenant, deviceId)` composite key, so a cross-tenant read\n * is not \"denied\" — it addresses a different key space and finds nothing\n * (§12.6.2 layer 3). The pre-tenant index below holds the SAME record objects,\n * so a revocation applied through the composite key is immediately visible to\n * `/byok/challenge` and `/byok/token` with no second copy to keep in sync.\n */\nimport { tenantKey, type TenantId } from '@byok-sdk/core';\nimport type { DeviceDirectory, DeviceRecord, DeviceRegistration } from '../ports';\n\nexport class InMemoryDeviceDirectory implements DeviceDirectory {\n readonly #byTenant = new Map<string, DeviceRecord>();\n readonly #byDeviceId = new Map<string, string>();\n\n async register(tenant: TenantId, input: DeviceRegistration): Promise<DeviceRecord> {\n const record: DeviceRecord = {\n tenantId: tenant,\n productId: input.productId,\n deviceId: input.deviceId,\n deviceName: input.deviceName,\n devicePublicKey: input.devicePublicKey,\n proofKeyId: input.proofKeyId,\n proofKeyEpoch: input.proofKeyEpoch,\n revoked: false,\n };\n const key = tenantKey(tenant, record.deviceId);\n this.#byTenant.set(key, record);\n this.#byDeviceId.set(record.deviceId, key);\n return record;\n }\n\n async get(tenant: TenantId, deviceId: string): Promise<DeviceRecord | undefined> {\n return this.#byTenant.get(tenantKey(tenant, deviceId));\n }\n\n async revoke(tenant: TenantId, deviceId: string): Promise<void> {\n const key = tenantKey(tenant, deviceId);\n const record = this.#byTenant.get(key);\n if (record === undefined) return;\n this.#byTenant.set(key, { ...record, revoked: true });\n }\n\n async list(tenant: TenantId): Promise<readonly DeviceRecord[]> {\n const prefix = tenantKey(tenant, '');\n return [...this.#byTenant.entries()]\n .filter(([key]) => key.startsWith(prefix))\n .map(([, record]) => record);\n }\n\n async resolveByDeviceId(deviceId: string): Promise<DeviceRecord | undefined> {\n const key = this.#byDeviceId.get(deviceId);\n return key === undefined ? undefined : this.#byTenant.get(key);\n }\n}\n","/**\n * In-memory {@link InboundDedupStore} (N3).\n *\n * A bounded ring per (tenant, device), not an unbounded set: the wire is\n * at-least-once (§9), so this makes processing at-most-once without letting a\n * chatty device grow memory without limit. Check-and-record is one call, so a\n * composition cannot accidentally split it into a racy read-then-write.\n */\nimport { tenantKey, type TenantId } from '@byok-sdk/core';\nimport type { InboundDedupStore } from '../ports';\n\n/** Ids retained per device. Same order of magnitude as the reference server's ring. */\nexport const DEDUP_RING_CAPACITY = 1024;\n\nexport class InMemoryInboundDedupStore implements InboundDedupStore {\n readonly #rings = new Map<string, Set<string>>();\n readonly #capacity: number;\n\n constructor(capacity: number = DEDUP_RING_CAPACITY) {\n this.#capacity = capacity;\n }\n\n async checkAndRecord(tenant: TenantId, deviceId: string, envelopeId: string): Promise<boolean> {\n const key = tenantKey(tenant, deviceId);\n let ring = this.#rings.get(key);\n if (ring === undefined) {\n ring = new Set<string>();\n this.#rings.set(key, ring);\n }\n if (ring.has(envelopeId)) return true;\n ring.add(envelopeId);\n if (ring.size > this.#capacity) {\n const oldest = ring.values().next().value;\n if (oldest !== undefined) ring.delete(oldest);\n }\n return false;\n }\n}\n","/**\n * In-memory {@link NonceStore}: single-use challenge nonces, ~5min TTL\n * (docs/protocol.md §6.2).\n *\n * A nonce is bound to the (tenant, device) it was issued for, so a nonce\n * issued to one tenant's device is not validatable by another's even if the\n * value leaks.\n */\nimport { tenantKey, type Clock, type TenantId } from '@byok-sdk/core';\nimport type { CloudCrypto } from '../../crypto/port';\nimport type { NonceStore } from '../ports';\n\n/** ~5min, matching the reference server (docs/protocol.md §6.2). */\nexport const NONCE_TTL_MS = 5 * 60 * 1000;\n\nconst NONCE_BYTES = 24;\n\ninterface NonceRecord {\n readonly owner: string;\n readonly expiresAtMs: number;\n used: boolean;\n}\n\nexport class InMemoryNonceStore implements NonceStore {\n readonly #nonces = new Map<string, NonceRecord>();\n readonly #clock: Clock;\n readonly #crypto: CloudCrypto;\n readonly #ttlMs: number;\n\n constructor(clock: Clock, crypto: CloudCrypto, ttlMs: number = NONCE_TTL_MS) {\n this.#clock = clock;\n this.#crypto = crypto;\n this.#ttlMs = ttlMs;\n }\n\n /** Number of records currently held (post-sweep). Test-facing only. */\n get size(): number {\n return this.#nonces.size;\n }\n\n async issue(tenant: TenantId, deviceId: string): Promise<string> {\n const nowMs = this.#clock.now().getTime();\n // A long-lived deployment never calls a sweep on a timer, so issue sweeps\n // inline — same posture as the reference server's `NonceStore`.\n for (const [nonce, record] of this.#nonces) {\n if (record.used || record.expiresAtMs <= nowMs) this.#nonces.delete(nonce);\n }\n const nonce = this.#crypto.randomToken(NONCE_BYTES);\n this.#nonces.set(nonce, {\n owner: tenantKey(tenant, deviceId),\n expiresAtMs: nowMs + this.#ttlMs,\n used: false,\n });\n return nonce;\n }\n\n async validate(tenant: TenantId, deviceId: string, nonce: string): Promise<boolean> {\n const record = this.#nonces.get(nonce);\n if (record === undefined) return false;\n if (record.used) return false;\n if (record.owner !== tenantKey(tenant, deviceId)) return false;\n return this.#clock.now().getTime() <= record.expiresAtMs;\n }\n\n async markUsed(tenant: TenantId, nonce: string): Promise<void> {\n const record = this.#nonces.get(nonce);\n if (record === undefined) return;\n if (!record.owner.startsWith(tenantKey(tenant, ''))) return;\n record.used = true;\n }\n}\n","/**\n * In-memory {@link PairingCodeStore}: single-use codes bound to the tenant and\n * product they were minted for.\n *\n * `redeem` answers `undefined` for unknown, expired, and already-used alike.\n * The reference server distinguishes those three in its 401 text; a hosted,\n * multi-tenant surface deliberately does not — the code is a bearer credential\n * addressable across every tenant, and \"already used\" versus \"never existed\"\n * is exactly the difference an attacker enumerating codes would pay for.\n */\nimport type { Clock, TenantId } from '@byok-sdk/core';\nimport type {\n PairingCodeClaims,\n PairingCodeInfo,\n PairingCodeIssueInput,\n PairingCodeStore,\n} from '../ports';\n\ninterface PairingCodeRecord {\n readonly claims: PairingCodeClaims;\n readonly expiresAtMs: number;\n used: boolean;\n}\n\nexport class InMemoryPairingCodeStore implements PairingCodeStore {\n readonly #codes = new Map<string, PairingCodeRecord>();\n readonly #clock: Clock;\n\n constructor(clock: Clock) {\n this.#clock = clock;\n }\n\n async issue(tenant: TenantId, input: PairingCodeIssueInput): Promise<PairingCodeInfo> {\n this.#codes.set(input.code, {\n claims: { tenantId: tenant, productId: input.productId },\n expiresAtMs: new Date(input.expiresAt).getTime(),\n used: false,\n });\n return { code: input.code, expiresAt: input.expiresAt };\n }\n\n async redeem(code: string): Promise<PairingCodeClaims | undefined> {\n const record = this.#codes.get(code);\n if (record === undefined) return undefined;\n if (record.used) return undefined;\n if (this.#clock.now().getTime() > record.expiresAtMs) return undefined;\n record.used = true;\n return record.claims;\n }\n}\n","/**\n * In-memory {@link RequestReceiptStore}: first write wins.\n *\n * The terminal a device reports is a fact, and a retry of the same terminal\n * (the wire is at-least-once) must not overwrite the first one — `created:\n * false` is how the caller learns it was a replay rather than a new fact.\n */\nimport { tenantKey, type Clock, type TenantId } from '@byok-sdk/core';\nimport type { RequestReceipt, RequestReceiptStore } from '../ports';\n\nexport class InMemoryRequestReceiptStore implements RequestReceiptStore {\n readonly #receipts = new Map<string, RequestReceipt>();\n readonly #clock: Clock;\n\n constructor(clock: Clock) {\n this.#clock = clock;\n }\n\n async record(\n tenant: TenantId,\n input: { key: string; body: string },\n ): Promise<{ receipt: RequestReceipt; created: boolean }> {\n const key = tenantKey(tenant, input.key);\n const existing = this.#receipts.get(key);\n if (existing !== undefined) return { receipt: existing, created: false };\n const receipt: RequestReceipt = {\n tenantId: tenant,\n key: input.key,\n body: input.body,\n recordedAt: this.#clock.now().toISOString(),\n };\n this.#receipts.set(key, receipt);\n return { receipt, created: true };\n }\n\n async get(tenant: TenantId, key: string): Promise<RequestReceipt | undefined> {\n return this.#receipts.get(tenantKey(tenant, key));\n }\n}\n","import { tenantKey, type Clock, type TenantId } from '@byok-sdk/core';\nimport type {\n ProofRequestReceipt,\n ProofRequestReceiptInput,\n ProofRequestReceiptStore,\n} from '../ports';\n\nexport class InMemoryProofRequestReceiptStore implements ProofRequestReceiptStore {\n readonly #receipts = new Map<string, ProofRequestReceipt>();\n readonly #clock: Clock;\n\n constructor(clock: Clock) {\n this.#clock = clock;\n }\n\n async record(\n tenant: TenantId,\n input: ProofRequestReceiptInput,\n ): Promise<{ readonly receipt: ProofRequestReceipt; readonly created: boolean }> {\n const key = tenantKey(tenant, input.deviceId, input.requestId);\n const existing = this.#receipts.get(key);\n if (existing !== undefined) return { receipt: existing, created: false };\n const receipt: ProofRequestReceipt = {\n tenantId: tenant,\n ...input,\n recordedAt: this.#clock.now().toISOString(),\n };\n this.#receipts.set(key, receipt);\n return { receipt, created: true };\n }\n\n async get(\n tenant: TenantId,\n deviceId: string,\n requestId: string,\n ): Promise<ProofRequestReceipt | undefined> {\n return this.#receipts.get(tenantKey(tenant, deviceId, requestId));\n }\n}\n","/**\n * In-memory {@link TaskAttemptStore} — the ownership authority the inbound\n * gate reads (N2).\n *\n * Two deliberate no-ops:\n *\n * - `claim` on a task this tenant never offered writes nothing. A device that\n * guesses a taskId must not be able to conjure a row (and, cross-tenant,\n * must not leave a trace in the tenant it guessed into).\n * - `recordStatus` on an unknown task writes nothing, mirroring the reference\n * server's per-type handlers, whose behavior on a missing record is a no-op\n * rather than a rejection.\n *\n * Ownership is first-claim-wins and never transfers: reassigning an owner is\n * the one operation that would make the gate's cross-device assertion\n * unfalsifiable.\n */\nimport { tenantKey, type Clock, type TenantId } from '@byok-sdk/core';\nimport type { TaskAttempt, TaskAttemptStatus, TaskAttemptStore } from '../ports';\n\nexport class InMemoryTaskAttemptStore implements TaskAttemptStore {\n readonly #attempts = new Map<string, TaskAttempt>();\n readonly #clock: Clock;\n\n constructor(clock: Clock) {\n this.#clock = clock;\n }\n\n async open(tenant: TenantId, input: { taskId: string; deviceId: string }): Promise<TaskAttempt> {\n const key = tenantKey(tenant, input.taskId);\n const existing = this.#attempts.get(key);\n if (existing !== undefined) return existing;\n const attempt: TaskAttempt = {\n tenantId: tenant,\n taskId: input.taskId,\n deviceId: input.deviceId,\n status: 'offered',\n updatedAt: this.#now(),\n };\n this.#attempts.set(key, attempt);\n return attempt;\n }\n\n async get(tenant: TenantId, taskId: string): Promise<TaskAttempt | undefined> {\n return this.#attempts.get(tenantKey(tenant, taskId));\n }\n\n async claim(tenant: TenantId, input: { taskId: string; deviceId: string }): Promise<TaskAttempt | undefined> {\n const key = tenantKey(tenant, input.taskId);\n const existing = this.#attempts.get(key);\n if (existing === undefined) return undefined;\n if (existing.ownerDeviceId !== undefined) return existing;\n const claimed: TaskAttempt = {\n ...existing,\n ownerDeviceId: input.deviceId,\n status: 'claimed',\n updatedAt: this.#now(),\n };\n this.#attempts.set(key, claimed);\n return claimed;\n }\n\n async recordStatus(\n tenant: TenantId,\n input: { taskId: string; status: TaskAttemptStatus },\n ): Promise<TaskAttempt | undefined> {\n const key = tenantKey(tenant, input.taskId);\n const existing = this.#attempts.get(key);\n if (existing === undefined) return undefined;\n const updated: TaskAttempt = { ...existing, status: input.status, updatedAt: this.#now() };\n this.#attempts.set(key, updated);\n return updated;\n }\n\n #now(): string {\n return this.#clock.now().toISOString();\n }\n}\n","import type { Clock, TenantId } from '@byok-sdk/core';\nimport { ByokCloudError } from '../../errors';\nimport {\n activityCursor,\n activityTailKey,\n compareTimelineEvents,\n projectTimelineEvents,\n validateActivityAppend,\n type ActivityAppendInput,\n type ActivityStore,\n type ActivityTail,\n} from '../../activity';\n\nexport class InMemoryActivityStore implements ActivityStore {\n readonly #tails = new Map<string, ActivityTail>();\n\n constructor(private readonly clock: Clock) {}\n\n async append(tenant: TenantId, input: ActivityAppendInput): Promise<ActivityTail> {\n const capacity = validateActivityAppend(input);\n const now = this.clock.now();\n const receivedAt = now.toISOString();\n const key = activityTailKey(tenant, input.taskId);\n const existing = this.#tails.get(key);\n const live = existing !== undefined && receivedAt < existing.expiresAt ? existing : undefined;\n const incoming = projectTimelineEvents(input, receivedAt);\n for (const next of incoming) {\n const collision = live?.entries.find(\n (entry) =>\n entry.batchSeq === next.batchSeq &&\n entry.eventIndex === next.eventIndex &&\n entry.sourceEnvelopeId !== next.sourceEnvelopeId,\n );\n if (collision !== undefined) {\n throw new ByokCloudError(\n 'coordination_input_invalid',\n `Activity order key (${next.batchSeq}, ${next.eventIndex}) already belongs to another source envelope.`,\n );\n }\n }\n const allEntries = [...(live?.entries ?? []), ...incoming].sort(compareTimelineEvents);\n const evicted = Math.max(allEntries.length - capacity, 0);\n const entries = allEntries.slice(evicted);\n const cursor = activityCursor(entries);\n const tail: ActivityTail = {\n tenantId: tenant,\n taskId: input.taskId,\n entries,\n ...(cursor === undefined ? {} : { cursor }),\n dropped: (live?.dropped ?? 0) + input.dropped + evicted,\n capacity,\n expiresAt: new Date(now.getTime() + input.ttlMs).toISOString(),\n };\n this.#tails.set(key, tail);\n return tail;\n }\n\n async read(tenant: TenantId, taskId: string): Promise<ActivityTail | undefined> {\n const key = activityTailKey(tenant, taskId);\n const tail = this.#tails.get(key);\n if (tail === undefined) return undefined;\n if (this.clock.now().toISOString() >= tail.expiresAt) {\n this.#tails.delete(key);\n return undefined;\n }\n return tail;\n }\n}\n","import type { Clock, TenantId } from '@byok-sdk/core';\nimport { ByokCloudError } from '../../errors';\nimport {\n ApprovalObservationSchema,\n approvalTimelineCursor,\n approvalTimelineKey,\n validateApprovalTimelineAppend,\n type ApprovalTimelineAppendInput,\n type ApprovalTimelineStore,\n type ApprovalTimelineTail,\n} from '../../approval-timeline';\n\nexport class InMemoryApprovalTimelineStore implements ApprovalTimelineStore {\n readonly #tails = new Map<string, ApprovalTimelineTail>();\n\n constructor(private readonly clock: Clock) {}\n\n async append(\n tenant: TenantId,\n input: ApprovalTimelineAppendInput,\n ): Promise<ApprovalTimelineTail> {\n const { capacity, ttlMs, event } = validateApprovalTimelineAppend(input);\n const now = this.clock.now();\n const receivedAt = now.toISOString();\n const key = approvalTimelineKey(tenant, input.taskId);\n const existing = this.#tails.get(key);\n const live = existing !== undefined && receivedAt < existing.expiresAt ? existing : undefined;\n if (live !== undefined) {\n const duplicate = live.entries.find(\n (entry) => entry.sourceEnvelopeId === input.sourceEnvelopeId,\n );\n if (duplicate !== undefined) {\n if (JSON.stringify(duplicate.event) !== JSON.stringify(event)) {\n throw new ByokCloudError(\n 'coordination_input_invalid',\n 'Approval source envelope identity already belongs to another lifecycle event.',\n );\n }\n return live;\n }\n }\n\n const revision = (live?.cursor ?? 0) + 1;\n const observation = ApprovalObservationSchema.parse({\n taskId: input.taskId,\n sourceEnvelopeId: input.sourceEnvelopeId,\n revision,\n receivedAt,\n event,\n });\n const allEntries = [...(live?.entries ?? []), observation];\n const evicted = Math.max(allEntries.length - capacity, 0);\n const entries = allEntries.slice(evicted);\n const tail: ApprovalTimelineTail = {\n tenantId: tenant,\n taskId: input.taskId,\n entries,\n cursor: approvalTimelineCursor(entries),\n dropped: (live?.dropped ?? 0) + evicted,\n capacity,\n expiresAt: new Date(now.getTime() + ttlMs).toISOString(),\n };\n this.#tails.set(key, tail);\n return tail;\n }\n\n async read(tenant: TenantId, taskId: string): Promise<ApprovalTimelineTail | undefined> {\n const key = approvalTimelineKey(tenant, taskId);\n const tail = this.#tails.get(key);\n if (tail === undefined) return undefined;\n if (this.clock.now().toISOString() >= tail.expiresAt) {\n this.#tails.delete(key);\n return undefined;\n }\n return tail;\n }\n}\n","/**\n * The in-memory reference implementation of every cloud-local port.\n *\n * Same posture as `@byok-sdk/core`'s: a reference, not a production store. What it\n * guarantees is that the behavior the handler suites assert is achievable\n * without a database — which is what makes those same assertions meaningful\n * when a durable composition (S3b's journal, S4A's schema) runs them later.\n */\nimport type { Clock, ObjectStore } from '@byok-sdk/core';\nimport type { CloudCrypto } from '../../crypto/port';\nimport type { BlobContentProxy, CloudStores } from '../ports';\nimport { AllowAllRateLimiter } from './rate-limiter';\nimport { createInMemoryBlobs } from './blobs';\nimport { InMemoryDeviceDirectory } from './device-directory';\nimport { InMemoryInboundDedupStore } from './dedup';\nimport { InMemoryNonceStore } from './nonces';\nimport { InMemoryPairingCodeStore } from './pairing-codes';\nimport { InMemoryRequestReceiptStore } from './receipts';\nimport { InMemoryProofRequestReceiptStore } from './proof-receipts';\nimport { InMemoryTaskAttemptStore } from './task-attempts';\nimport { InMemoryActivityStore } from './activity';\nimport { InMemoryApprovalTimelineStore } from './approval-timeline';\n\nexport { AllowAllRateLimiter } from './rate-limiter';\nexport {\n BLOB_URL_TTL_MS,\n InMemoryBlobContentProxy,\n InMemoryCloudBlobStore,\n createInMemoryBlobs,\n} from './blobs';\nexport type { InMemoryBlobs, InMemoryBlobStoreOptions } from './blobs';\nexport { DEDUP_RING_CAPACITY, InMemoryInboundDedupStore } from './dedup';\nexport { InMemoryDeviceDirectory } from './device-directory';\nexport { InMemoryNonceStore, NONCE_TTL_MS } from './nonces';\nexport { InMemoryPairingCodeStore } from './pairing-codes';\nexport { InMemoryRequestReceiptStore } from './receipts';\nexport { InMemoryProofRequestReceiptStore } from './proof-receipts';\nexport { InMemoryTaskAttemptStore } from './task-attempts';\nexport { InMemoryActivityStore } from './activity';\nexport { InMemoryApprovalTimelineStore } from './approval-timeline';\n\n/**\n * The port bundle plus the byte proxy, in the shape `createInMemoryCoreStores`\n * already uses: the composition is an object with a `stores` field, not the\n * bundle itself.\n *\n * `blobContentProxy` sits BESIDE `stores` rather than inside it because it is\n * not a port — `createByokCloud` takes it as its own optional input, and a\n * composition that cannot carry bytes simply has none to hand over.\n */\nexport interface InMemoryCloudComposition {\n readonly stores: CloudStores;\n readonly blobContentProxy: BlobContentProxy;\n}\n\nexport function createInMemoryCloudStores(\n clock: Clock,\n crypto: CloudCrypto,\n objects: ObjectStore,\n): InMemoryCloudComposition {\n const blobs = createInMemoryBlobs(clock, crypto, objects);\n return {\n stores: {\n activity: new InMemoryActivityStore(clock),\n approvals: new InMemoryApprovalTimelineStore(clock),\n devices: new InMemoryDeviceDirectory(),\n pairingCodes: new InMemoryPairingCodeStore(clock),\n nonces: new InMemoryNonceStore(clock, crypto),\n dedup: new InMemoryInboundDedupStore(),\n tasks: new InMemoryTaskAttemptStore(clock),\n receipts: new InMemoryRequestReceiptStore(clock),\n proofReceipts: new InMemoryProofRequestReceiptStore(clock),\n blobs: blobs.blobs,\n rateLimiter: new AllowAllRateLimiter(),\n },\n blobContentProxy: blobs.contentProxy,\n };\n}\n","/**\n * The in-memory composition: core's reference stores plus cloud's, wired into\n * a working {@link ByokCloud}.\n *\n * This is what the handler suites and the client-side end-to-end test run\n * against, and it is the honest demonstration of the S3 claim — the daemon\n * cannot tell this from `@byok-sdk/server`, and nothing in the path needs a\n * database to prove it.\n */\nimport {\n createInMemoryCoreStores,\n type CapabilityDeclaration,\n type Clock,\n type CoreStores,\n type SkillPackStore,\n} from '@byok-sdk/core';\nimport { createHmacTokenSigner, type TokenSigner } from '../auth/tokens';\nimport { fullCapabilityDeclaration } from '../capabilities';\nimport { createWebCrypto } from '../crypto/web-crypto';\nimport type { CloudCrypto } from '../crypto/port';\nimport { createByokCloud, type ByokCloud } from '../cloud';\nimport { createInMemoryCloudStores } from '../stores/in-memory/index';\nimport type { BlobContentProxy, CloudStores } from '../stores/ports';\nimport type { TruthCommitter, TruthObjectDownloads } from '../truth/contract';\n\nconst TOKEN_SECRET_BYTES = 32;\n\n/**\n * Real time by default, deliberately.\n *\n * Core's in-memory reference defaults to a FROZEN clock so TTL conformance is\n * deterministic. A composition serving a real daemon cannot: the daemon\n * compares the `expiresAt` it is handed against its own wall clock and would\n * treat every token from a clock stuck in the past as already expired. A test\n * that needs deterministic TTLs injects a mutable clock here instead.\n */\nfunction systemClock(): Clock {\n return { now: () => new Date() };\n}\n\nexport interface InMemoryByokCloudOptions {\n readonly clock?: Clock;\n readonly crypto?: CloudCrypto;\n readonly tokenSigner?: TokenSigner;\n readonly capabilities?: CapabilityDeclaration;\n readonly operatorId?: string;\n readonly maxBlobSizeBytes?: number;\n readonly longPollHoldMs?: number;\n readonly longPollIntervalMs?: number;\n readonly eventsPageLimit?: number;\n readonly accessTokenTtlSeconds?: number;\n readonly boardPageLimit?: number;\n readonly boardStreamQueryIntervalMs?: number;\n readonly boardStreamHeartbeatIntervalMs?: number;\n readonly boardStreamReconciliationIntervalMs?: number;\n readonly boardChannelMaxBytes?: number;\n readonly boardTitleMaxBytes?: number;\n readonly presenceTtlMs?: number;\n readonly presenceMinimumIntervalMs?: number;\n readonly presenceDetailMaxBytes?: number;\n readonly activityMaxEvents?: number;\n readonly activityMaxBytes?: number;\n readonly activityCapacity?: number;\n readonly activityTtlMs?: number;\n /** Test/host supplied atomic truth authority; never synthesized from sequential stores. */\n readonly truthCommitter?: TruthCommitter;\n readonly truthObjectDownloads?: TruthObjectDownloads;\n readonly maxTruthRequestBytes?: number;\n /**\n * Host/test supplied skill pack catalogue. Absent by default, and\n * `fullCapabilityDeclaration()` withholds `skills.pack` to match — a\n * composition that declared a channel it has no store for would be refused at\n * construction, which would break every existing in-memory deployment.\n */\n readonly skillPacks?: SkillPackStore;\n readonly skillPackPageLimit?: number;\n}\n\nexport interface InMemoryByokCloud {\n readonly cloud: ByokCloud;\n /** The naked stores, for a host that wants to inspect or seed state directly. */\n readonly core: CoreStores;\n readonly stores: CloudStores;\n /** The byte proxy the two `/content` routes were mounted on. */\n readonly blobContentProxy: BlobContentProxy;\n readonly clock: Clock;\n readonly crypto: CloudCrypto;\n}\n\nexport function createInMemoryByokCloud(options: InMemoryByokCloudOptions = {}): InMemoryByokCloud {\n const clock = options.clock ?? systemClock();\n const crypto = options.crypto ?? createWebCrypto();\n const core = createInMemoryCoreStores({ clock }).stores;\n const { stores, blobContentProxy } = createInMemoryCloudStores(clock, crypto, core.objects);\n const tokenSigner =\n options.tokenSigner ??\n createHmacTokenSigner(globalThis.crypto.getRandomValues(new Uint8Array(TOKEN_SECRET_BYTES)), clock);\n\n const cloud = createByokCloud({\n core,\n cloud: stores,\n // This composition has nowhere else to put bytes, so it supplies the proxy\n // and `fullCapabilityDeclaration()` declares `blobs.contentproxy`. That\n // pairing is what keeps hosted-in-memory behavior identical to what it was\n // before the port narrowed.\n blobContentProxy,\n crypto,\n tokenSigner,\n clock,\n capabilities: options.capabilities ?? fullCapabilityDeclaration(),\n ...(options.truthCommitter === undefined ? {} : { truthCommitter: options.truthCommitter }),\n ...(options.truthObjectDownloads === undefined\n ? {}\n : { truthObjectDownloads: options.truthObjectDownloads }),\n ...(options.operatorId !== undefined ? { operatorId: options.operatorId } : {}),\n ...(options.maxBlobSizeBytes !== undefined ? { maxBlobSizeBytes: options.maxBlobSizeBytes } : {}),\n ...(options.longPollHoldMs !== undefined ? { longPollHoldMs: options.longPollHoldMs } : {}),\n ...(options.longPollIntervalMs !== undefined ? { longPollIntervalMs: options.longPollIntervalMs } : {}),\n ...(options.eventsPageLimit !== undefined ? { eventsPageLimit: options.eventsPageLimit } : {}),\n ...(options.accessTokenTtlSeconds !== undefined\n ? { accessTokenTtlSeconds: options.accessTokenTtlSeconds }\n : {}),\n ...(options.boardPageLimit === undefined ? {} : { boardPageLimit: options.boardPageLimit }),\n ...(options.boardStreamQueryIntervalMs === undefined\n ? {}\n : { boardStreamQueryIntervalMs: options.boardStreamQueryIntervalMs }),\n ...(options.boardStreamHeartbeatIntervalMs === undefined\n ? {}\n : { boardStreamHeartbeatIntervalMs: options.boardStreamHeartbeatIntervalMs }),\n ...(options.boardStreamReconciliationIntervalMs === undefined\n ? {}\n : { boardStreamReconciliationIntervalMs: options.boardStreamReconciliationIntervalMs }),\n ...(options.boardChannelMaxBytes === undefined\n ? {}\n : { boardChannelMaxBytes: options.boardChannelMaxBytes }),\n ...(options.boardTitleMaxBytes === undefined\n ? {}\n : { boardTitleMaxBytes: options.boardTitleMaxBytes }),\n ...(options.presenceTtlMs === undefined ? {} : { presenceTtlMs: options.presenceTtlMs }),\n ...(options.presenceMinimumIntervalMs === undefined\n ? {}\n : { presenceMinimumIntervalMs: options.presenceMinimumIntervalMs }),\n ...(options.presenceDetailMaxBytes === undefined\n ? {}\n : { presenceDetailMaxBytes: options.presenceDetailMaxBytes }),\n ...(options.activityMaxEvents === undefined ? {} : { activityMaxEvents: options.activityMaxEvents }),\n ...(options.activityMaxBytes === undefined ? {} : { activityMaxBytes: options.activityMaxBytes }),\n ...(options.activityCapacity === undefined ? {} : { activityCapacity: options.activityCapacity }),\n ...(options.activityTtlMs === undefined ? {} : { activityTtlMs: options.activityTtlMs }),\n ...(options.maxTruthRequestBytes === undefined\n ? {}\n : { maxTruthRequestBytes: options.maxTruthRequestBytes }),\n ...(options.skillPacks === undefined ? {} : { skillPacks: options.skillPacks }),\n ...(options.skillPackPageLimit === undefined\n ? {}\n : { skillPackPageLimit: options.skillPackPageLimit }),\n });\n\n return { cloud, core, stores, blobContentProxy, clock, crypto };\n}\n","import {\n BOARD_STATUSES,\n assertCapability,\n hasCapability,\n type CapabilityDeclaration,\n} from '@byok-sdk/core';\nimport { BYOK_BOARD_PATH, BYOK_BOARD_STREAM_PATH } from '@byok-sdk/protocol';\nimport { z } from 'zod';\nimport { CLOUD_CAPABILITIES } from './capabilities';\n\nconst BoardFeedItemSchema = z.object({\n tenantId: z.string(),\n itemId: z.string(),\n channel: z.string(),\n title: z.string(),\n status: z.enum(BOARD_STATUSES),\n assignee: z\n .object({ holderId: z.string(), heldSince: z.string() })\n .optional(),\n boardSeq: z.number().int().nonnegative(),\n createdAt: z.string(),\n updatedAt: z.string(),\n});\n\nconst BoardFeedPageSchema = z.object({\n items: z.array(BoardFeedItemSchema),\n nextSeq: z.number().int().nonnegative(),\n hasMore: z.boolean(),\n});\n\nexport type BoardFeedItem = z.infer<typeof BoardFeedItemSchema>;\nexport type BoardFeedPage = z.infer<typeof BoardFeedPageSchema>;\nexport type BoardFeedMode = 'sse' | 'poll';\nexport type BoardFeedRead =\n | { readonly type: 'board'; readonly item: BoardFeedItem }\n | { readonly type: 'reconcile' }\n | { readonly type: 'poll'; readonly page: BoardFeedPage };\n\nexport class BoardFeedRetryableError extends Error {\n constructor(message: string, options?: ErrorOptions) {\n super(message, options);\n this.name = 'BoardFeedRetryableError';\n }\n}\n\nexport class BoardFeedStoppedError extends Error {\n constructor(message: string) {\n super(message);\n this.name = 'BoardFeedStoppedError';\n }\n}\n\nexport interface BoardFeedClientOptions {\n readonly baseUrl: string | URL;\n readonly accessToken: string;\n readonly capabilities: CapabilityDeclaration;\n readonly fetch?: typeof globalThis.fetch;\n readonly idleWatchdogMs?: number;\n}\n\n/**\n * One board feed consumer with a declaration-fixed transport.\n *\n * The mode is selected once from ADR-010 data. A temporary SSE 5xx or idle\n * watchdog expiry raises {@link BoardFeedRetryableError}; it never mutates the\n * mode to polling. A caller retries the same instance and therefore the same\n * declared transport. Polling exists only when `board.sse` was absent from the\n * declaration in the first place.\n */\nexport class BoardFeedClient {\n readonly mode: BoardFeedMode;\n readonly #base: URL;\n readonly #accessToken: string;\n readonly #fetch: typeof globalThis.fetch;\n readonly #idleWatchdogMs: number;\n\n constructor(options: BoardFeedClientOptions) {\n assertCapability(options.capabilities, CLOUD_CAPABILITIES.boardCoordination);\n this.mode = hasCapability(options.capabilities, CLOUD_CAPABILITIES.boardSse) ? 'sse' : 'poll';\n this.#base = new URL(options.baseUrl);\n this.#accessToken = options.accessToken;\n this.#fetch = options.fetch ?? globalThis.fetch;\n this.#idleWatchdogMs = options.idleWatchdogMs ?? 30_000;\n }\n\n async readOnce(afterSeq: number, signal?: AbortSignal): Promise<BoardFeedRead> {\n if (!Number.isSafeInteger(afterSeq) || afterSeq < 0) {\n throw new TypeError('afterSeq must be a non-negative safe integer.');\n }\n return this.mode === 'sse'\n ? this.#readSseOnce(afterSeq, signal)\n : this.#readPollOnce(afterSeq, signal);\n }\n\n async #readPollOnce(afterSeq: number, signal?: AbortSignal): Promise<BoardFeedRead> {\n const url = new URL(BYOK_BOARD_PATH, this.#base);\n url.searchParams.set('since', String(afterSeq));\n const response = await this.#fetch(url, {\n headers: { authorization: `Bearer ${this.#accessToken}` },\n ...(signal === undefined ? {} : { signal }),\n });\n assertBoardResponse(response, 'poll');\n return { type: 'poll', page: BoardFeedPageSchema.parse(await response.json()) };\n }\n\n async #readSseOnce(afterSeq: number, signal?: AbortSignal): Promise<BoardFeedRead> {\n const url = new URL(BYOK_BOARD_STREAM_PATH, this.#base);\n const response = await this.#fetch(url, {\n headers: {\n accept: 'text/event-stream',\n authorization: `Bearer ${this.#accessToken}`,\n 'last-event-id': String(afterSeq),\n },\n ...(signal === undefined ? {} : { signal }),\n });\n assertBoardResponse(response, 'SSE');\n if (response.body === null) throw new BoardFeedRetryableError('Board SSE response had no body.');\n\n const reader = response.body.getReader();\n const decoder = new TextDecoder();\n let buffer = '';\n try {\n while (true) {\n const chunk = await readWithWatchdog(reader, this.#idleWatchdogMs);\n if (chunk.done) throw new BoardFeedRetryableError('Board SSE ended before the next event.');\n buffer += decoder.decode(chunk.value, { stream: true }).replaceAll('\\r\\n', '\\n');\n let boundary = buffer.indexOf('\\n\\n');\n while (boundary >= 0) {\n const frame = buffer.slice(0, boundary);\n buffer = buffer.slice(boundary + 2);\n const parsed = parseSseFrame(frame);\n if (parsed !== undefined) return parsed;\n boundary = buffer.indexOf('\\n\\n');\n }\n }\n } finally {\n await reader.cancel().catch(() => undefined);\n }\n }\n}\n\nfunction assertBoardResponse(response: Response, transport: 'poll' | 'SSE'): void {\n if (response.status === 401) {\n throw new BoardFeedStoppedError('Board credential is no longer valid.');\n }\n if (response.ok) return;\n if (response.status >= 500) {\n throw new BoardFeedRetryableError(`Board ${transport} failed with HTTP ${response.status}.`);\n }\n throw new BoardFeedStoppedError(\n `Board ${transport} failed permanently with HTTP ${response.status}.`,\n );\n}\n\nasync function readWithWatchdog(\n reader: ReadableStreamDefaultReader<Uint8Array>,\n timeoutMs: number,\n) {\n let timer: ReturnType<typeof setTimeout> | undefined;\n try {\n return await Promise.race([\n reader.read(),\n new Promise<never>((_, reject) => {\n timer = setTimeout(\n () => reject(new BoardFeedRetryableError('Board SSE idle watchdog expired.')),\n timeoutMs,\n );\n }),\n ]);\n } finally {\n if (timer !== undefined) clearTimeout(timer);\n }\n}\n\nfunction parseSseFrame(frame: string): BoardFeedRead | undefined {\n if (frame.length === 0 || frame.startsWith(':')) return undefined;\n let event = 'message';\n const data: string[] = [];\n for (const line of frame.split('\\n')) {\n if (line.startsWith('event:')) event = line.slice('event:'.length).trimStart();\n if (line.startsWith('data:')) data.push(line.slice('data:'.length).trimStart());\n }\n if (event === 'reconcile') return { type: 'reconcile' };\n if (event !== 'board') return undefined;\n if (data.length === 0) throw new SyntaxError('Board SSE board event had no data.');\n return { type: 'board', item: BoardFeedItemSchema.parse(JSON.parse(data.join('\\n'))) };\n}\n","/**\n * The cloud-local store ports.\n *\n * `@byok-sdk/core` owns the platform ports every composition shares (mailbox,\n * board, truth, objects, quota). These are the ones only a HOSTED device\n * surface needs — the auth plane and the task-attempt bookkeeping the device\n * routes read. S2 deliberately kept them out of core: they are hosted-surface\n * concerns, and S4A's schema work is the right moment to decide their durable\n * home. Cloud owning them keeps this slice additive and revertible.\n *\n * Two rules, same as core's (`stores.ts`):\n *\n * 1. **Async.** Every method returns a `Promise`, so a SQL or KV composition\n * can implement the same contract the in-memory reference does.\n * 2. **Tenant-first.** Every method's first parameter is a required\n * `TenantId` — with exactly two documented exceptions below, each of\n * which is pre-tenant *by construction* because the credential it is\n * handed is itself what resolves the tenant.\n *\n * The two exceptions:\n *\n * - {@link DeviceDirectory.resolveByDeviceId} — `POST /byok/challenge` and\n * `POST /byok/token` carry only a deviceId (the pinned wire contract), and\n * the row is what tells the deployment which tenant to mint for.\n * - {@link PairingCodeStore.redeem} — the code IS the tenant lookup; it was\n * minted against a tenant that only the host's control plane knew.\n *\n * Neither is reachable through {@link TenantStores} (see `tenant-stores.ts`),\n * so a device-facing handler cannot call them.\n *\n * The byte-proxy trio that used to be a third pre-tenant exception is no\n * longer part of this bundle at all: it moved to {@link BlobContentProxy},\n * an OPTIONAL composition input rather than a {@link CloudStores} member,\n * because a composition backed by object storage physically cannot proxy\n * bytes (see the blobs section below).\n */\nimport type { StorageReservation, TenantId } from '@byok-sdk/core';\nimport type { ActivityStore } from '../activity';\nimport type { ApprovalTimelineStore } from '../approval-timeline';\n\n// ---------------------------------------------------------------------------\n// Device directory (S1's `DeviceRegistry`, tenant-first)\n// ---------------------------------------------------------------------------\n\nexport interface DeviceRecord {\n readonly tenantId: TenantId;\n readonly productId: string;\n readonly deviceId: string;\n readonly deviceName: string;\n /** Ed25519 public key, base64url-encoded (JWK `x` form). */\n readonly devicePublicKey: string;\n /** Proof key identity stored on the row; verifier claims never supply a default. */\n readonly proofKeyId: string;\n /** Current proof signing-key rotation generation. */\n readonly proofKeyEpoch: number;\n readonly revoked: boolean;\n}\n\n/** Everything `POST /byok/pair` knows at registration time. `tenantId` is the store's first parameter; `revoked` is the store's own to set. */\nexport interface DeviceRegistration {\n readonly productId: string;\n readonly deviceId: string;\n readonly deviceName: string;\n readonly devicePublicKey: string;\n readonly proofKeyId: string;\n readonly proofKeyEpoch: number;\n}\n\nexport interface DeviceDirectory {\n register(tenant: TenantId, input: DeviceRegistration): Promise<DeviceRecord>;\n /** The row `tenant` owns under `deviceId` — `undefined` including when the device exists under a DIFFERENT tenant. */\n get(tenant: TenantId, deviceId: string): Promise<DeviceRecord | undefined>;\n revoke(tenant: TenantId, deviceId: string): Promise<void>;\n list(tenant: TenantId): Promise<readonly DeviceRecord[]>;\n /** Pre-tenant. Two callers only: `POST /byok/challenge` and `POST /byok/token`. Never exposed through the tenant facade. */\n resolveByDeviceId(deviceId: string): Promise<DeviceRecord | undefined>;\n}\n\n// ---------------------------------------------------------------------------\n// Pairing codes (S1's `PairingManager`, tenant-first mint)\n// ---------------------------------------------------------------------------\n\n/**\n * The identity a pairing code carries. Minted out-of-band by the host's own\n * auth/device-flow UI — the only party that knows which tenant a human is\n * acting for. Deliberately NOT a wire field: `PairRequest` has no tenant of\n * its own, so a device can never name the tenant it lands in.\n */\nexport interface PairingCodeClaims {\n readonly tenantId: TenantId;\n readonly productId: string;\n}\n\nexport interface PairingCodeInfo {\n readonly code: string;\n /** Canonical ISO-8601 UTC instant. */\n readonly expiresAt: string;\n}\n\nexport interface PairingCodeIssueInput {\n readonly code: string;\n readonly productId: string;\n readonly expiresAt: string;\n}\n\nexport interface PairingCodeStore {\n issue(tenant: TenantId, input: PairingCodeIssueInput): Promise<PairingCodeInfo>;\n /**\n * Validate and CONSUME a code, returning the claims it was minted with, or\n * `undefined` when it is unknown, expired, or already used — one answer for\n * all three, so a redeem attempt is never an existence oracle. Single-use is\n * what makes the caller's \"redeem, then register the device row\" sequence\n * exclusive: a second redeem can never reach the registration step.\n */\n redeem(code: string): Promise<PairingCodeClaims | undefined>;\n}\n\n// ---------------------------------------------------------------------------\n// Challenge nonces\n// ---------------------------------------------------------------------------\n\nexport interface NonceStore {\n issue(tenant: TenantId, deviceId: string): Promise<string>;\n /** `true` iff the nonce exists for this (tenant, device), is unexpired, and has not been consumed. Never mutates. */\n validate(tenant: TenantId, deviceId: string, nonce: string): Promise<boolean>;\n /** Consume the nonce. Called only after every other check on the request has passed. */\n markUsed(tenant: TenantId, nonce: string): Promise<void>;\n}\n\n// ---------------------------------------------------------------------------\n// Inbound envelope dedup (N3)\n// ---------------------------------------------------------------------------\n\nexport interface InboundDedupStore {\n /**\n * `true` when `envelopeId` was already seen for this (tenant, device);\n * otherwise records it and returns `false`. Bounded per device — the wire is\n * at-least-once (§9); this makes processing at-most-once without an\n * unbounded set.\n */\n checkAndRecord(tenant: TenantId, deviceId: string, envelopeId: string): Promise<boolean>;\n}\n\n// ---------------------------------------------------------------------------\n// Task attempts — the ownership authority the inbound gate reads (N2)\n// ---------------------------------------------------------------------------\n\nexport const TASK_ATTEMPT_STATUSES = [\n 'offered',\n 'claimed',\n 'running',\n 'complete',\n 'failed',\n 'cancelled',\n] as const;\nexport type TaskAttemptStatus = (typeof TASK_ATTEMPT_STATUSES)[number];\n\nexport interface TaskAttempt {\n readonly tenantId: TenantId;\n readonly taskId: string;\n /** The device the offer was addressed to. */\n readonly deviceId: string;\n /** Set by `task.claim`, and only by the first one. Until then the task has no owner and the gate lets any of this tenant's devices through, matching the reference server. */\n readonly ownerDeviceId?: string;\n readonly status: TaskAttemptStatus;\n readonly updatedAt: string;\n}\n\nexport interface TaskAttemptStore {\n /** Called when an offer is enqueued: records the pending attempt with no owner yet. */\n open(tenant: TenantId, input: { readonly taskId: string; readonly deviceId: string }): Promise<TaskAttempt>;\n get(tenant: TenantId, taskId: string): Promise<TaskAttempt | undefined>;\n /** First claim wins the ownership; a later claim by the same device is idempotent. No-op (returns `undefined`) for a task this tenant never offered. */\n claim(tenant: TenantId, input: { readonly taskId: string; readonly deviceId: string }): Promise<TaskAttempt | undefined>;\n /** Record a lifecycle transition. No-op (returns `undefined`) for an unknown task — same shape as the reference server's per-type handlers. */\n recordStatus(\n tenant: TenantId,\n input: { readonly taskId: string; readonly status: TaskAttemptStatus },\n ): Promise<TaskAttempt | undefined>;\n}\n\n// ---------------------------------------------------------------------------\n// Request receipts — the terminal idempotency seam\n// ---------------------------------------------------------------------------\n\nexport interface RequestReceipt {\n readonly tenantId: TenantId;\n readonly key: string;\n /** Opaque payload the caller recorded — for terminals, the encoded envelope. */\n readonly body: string;\n readonly recordedAt: string;\n}\n\nexport interface RequestReceiptStore {\n /**\n * Record a receipt under `key`, or return the existing one untouched.\n * `created` is `false` for a replay — the FIRST terminal is the fact\n * (§12.6.4: 不覆写第一份事实), and a retry of the same terminal must not\n * overwrite it.\n */\n record(\n tenant: TenantId,\n input: { readonly key: string; readonly body: string },\n ): Promise<{ readonly receipt: RequestReceipt; readonly created: boolean }>;\n get(tenant: TenantId, key: string): Promise<RequestReceipt | undefined>;\n}\n\n// ---------------------------------------------------------------------------\n// Device-proof request receipts — request-bound replay authority (S6)\n// ---------------------------------------------------------------------------\n\nexport interface ProofRequestReceipt {\n readonly tenantId: TenantId;\n readonly deviceId: string;\n readonly requestId: string;\n readonly operation: string;\n readonly resource: string;\n readonly bodySha256: string;\n readonly bodySize: bigint;\n readonly responseStatus: number;\n readonly responseBody: string;\n readonly recordedAt: string;\n}\n\nexport type ProofRequestReceiptInput = Omit<\n ProofRequestReceipt,\n 'tenantId' | 'recordedAt'\n>;\n\n/**\n * First-result-wins replay store. The application layer compares every stored\n * binding before returning an exact replay; a reused request id with any\n * different binding is a conflict, never a second write.\n */\nexport interface ProofRequestReceiptStore {\n record(\n tenant: TenantId,\n input: ProofRequestReceiptInput,\n ): Promise<{ readonly receipt: ProofRequestReceipt; readonly created: boolean }>;\n get(\n tenant: TenantId,\n deviceId: string,\n requestId: string,\n ): Promise<ProofRequestReceipt | undefined>;\n}\n\n// ---------------------------------------------------------------------------\n// Blobs (§7)\n// ---------------------------------------------------------------------------\n\nexport interface BlobDeclaration {\n readonly size: number;\n readonly contentType: string;\n /** Canonical `sha256:<64 lowercase hex>` — the schema rejected anything else before this store sees it. */\n readonly contentHash: string;\n}\n\n/** What object-store metadata can actually observe at finalize (ADR-024). */\nexport interface BlobObservation {\n readonly observedByteSize: bigint;\n readonly observedContentType: string;\n}\n\nexport type BlobWriteResult = { readonly ok: true } | { readonly ok: false; readonly reason: string };\n\nexport interface BlobContent {\n readonly data: Uint8Array;\n readonly contentType: string;\n}\n\n/**\n * The capability-minting half of blobs: what EVERY composition can honestly\n * provide, whoever holds the bytes.\n *\n * Both methods are tenant-first, and both are reachable through {@link\n * TenantStores}. There is no pre-tenant method left on this port — see\n * {@link BlobContentProxy} for where the other three went and why.\n */\nexport interface CloudBlobStore {\n /** Mint only from an already-admitted object reservation. */\n createUpload(tenant: TenantId, reservation: StorageReservation): Promise<{ readonly blobId: string; readonly uploadUrl: string }>;\n /** Observe existence/size/type while proving this blob belongs to this reservation. */\n observeUpload(tenant: TenantId, blobId: string, reservation: StorageReservation): Promise<BlobObservation | undefined>;\n /** A presigned GET URL for a blob THIS tenant owns that has finished uploading; `undefined` otherwise — including for another tenant's blob. */\n getDownloadUrl(tenant: TenantId, blobId: string): Promise<string | undefined>;\n}\n\n/**\n * The byte-proxying half: an OPTIONAL composition input, not a port.\n *\n * These three serve the two `/byok/blobs/:id/content` routes, which exist\n * because the in-memory and self-hosted compositions have nowhere else to put\n * bytes — cloud has to carry them. A composition whose bytes live in object\n * storage (S3/R2) hands the device a presigned URL to the object store itself\n * and never sees a byte, so it cannot implement these at all.\n *\n * That is why this is a separate interface supplied at composition time rather\n * than a member of {@link CloudStores}: \"this deployment cannot proxy bytes\"\n * becomes a type-level fact (the proxy is simply absent) instead of three\n * methods that throw. The alternatives were both anti-patterns — a conformance\n * suite that skips three methods for one composition is a subset waiver, and\n * one that asserts a typed rejection proves nothing\n * (docs/researches/s4a-dataplane-design.md §6).\n *\n * All three are pre-tenant by construction: the `/content` routes are\n * presigned, not bearer-authed, so there is no principal in scope at all and\n * the HMAC signature over the blob id is the whole credential. They stay off\n * {@link TenantStores} for the same reason the two exceptions above do.\n *\n * A deployment supplying a proxy must also declare `blobs.contentproxy`\n * (ADR-010): the routes mount on proxy-presence AND declaration, never on\n * either alone.\n */\nexport interface BlobContentProxy {\n verifySignedUrl(blobId: string, action: 'put' | 'get', sig: string, exp: number): Promise<boolean>;\n writeContent(blobId: string, data: Uint8Array): Promise<BlobWriteResult>;\n readContent(blobId: string): Promise<BlobContent | undefined>;\n}\n\n// ---------------------------------------------------------------------------\n// Inbound rate limiting (M4 Phase 4 part A's seam)\n// ---------------------------------------------------------------------------\n\n/**\n * Step 0 of the inbound gate. S3a ships an allow-all reference (a hosted\n * deployment's real limiter is edge/infra work, not handler work) — what\n * matters now is that the SEAM sits at gate position 0, before the type-allow\n * check, so a flood of garbage-typed envelopes costs the same budget as a\n * flood of well-formed ones once a real limiter is plugged in.\n */\nexport interface InboundRateLimiter {\n consume(tenant: TenantId, deviceId: string): Promise<boolean>;\n}\n\n// ---------------------------------------------------------------------------\n// The bundle a composition supplies\n// ---------------------------------------------------------------------------\n\n/**\n * All-or-nothing: a composition supplies every port here or it is not a\n * composition. {@link BlobContentProxy} is deliberately absent — it is an\n * optional input to `createByokCloud`, not a port, precisely so that the\n * bundle can stay all-or-nothing while byte proxying stays optional.\n */\nexport interface CloudStores {\n readonly activity: ActivityStore;\n readonly approvals: ApprovalTimelineStore;\n readonly devices: DeviceDirectory;\n readonly pairingCodes: PairingCodeStore;\n readonly nonces: NonceStore;\n readonly dedup: InboundDedupStore;\n readonly tasks: TaskAttemptStore;\n readonly receipts: RequestReceiptStore;\n readonly proofReceipts: ProofRequestReceiptStore;\n readonly blobs: CloudBlobStore;\n readonly rateLimiter: InboundRateLimiter;\n}\n\n/** Names of every port in {@link CloudStores}, in contract order. */\nexport const CLOUD_STORE_NAMES = [\n 'activity',\n 'approvals',\n 'devices',\n 'pairingCodes',\n 'nonces',\n 'dedup',\n 'tasks',\n 'receipts',\n 'proofReceipts',\n 'blobs',\n 'rateLimiter',\n] as const;\n\nexport type CloudStoreName = (typeof CLOUD_STORE_NAMES)[number];\n","/**\n * The declared method inventory of every cloud-local port.\n *\n * The exact counterpart of `@byok-sdk/core`'s `ports-contract.ts`, and it exists\n * for the same reason: the table says what a port IS, so it has to be readable\n * by every enforcer without any of them owning it. `@byok-sdk/conformance` asserts\n * live compositions against it; a durable adapter (`@byok-sdk/cloud-dataplane`) is\n * written against it.\n *\n * This module adds data and nothing else. It does not re-declare, re-shape, or\n * re-interpret a single line of `ports.ts` — that file stays the authority for\n * what the methods mean, and stayed byte-identical through S4A-a.\n *\n * Adding a port method means editing this table, which is the point: a port\n * grows by contract, not by whichever composition needed something.\n */\nimport type { CloudStoreName } from './ports';\n\nexport const CLOUD_PORT_METHODS: Readonly<Record<CloudStoreName, readonly string[]>> = {\n activity: ['append', 'read'],\n approvals: ['append', 'read'],\n devices: ['register', 'get', 'revoke', 'list', 'resolveByDeviceId'],\n pairingCodes: ['issue', 'redeem'],\n nonces: ['issue', 'validate', 'markUsed'],\n dedup: ['checkAndRecord'],\n tasks: ['open', 'get', 'claim', 'recordStatus'],\n receipts: ['record', 'get'],\n proofReceipts: ['record', 'get'],\n // Three methods, not six: the byte-proxy trio moved to `BlobContentProxy`,\n // which is a composition input rather than a port and therefore has no row\n // in this table (docs/researches/s4a-dataplane-design.md §6).\n blobs: ['createUpload', 'observeUpload', 'getDownloadUrl'],\n rateLimiter: ['consume'],\n};\n\n/** The interface each port name is declared as, for a source-side scan. */\nexport const CLOUD_PORT_INTERFACES: Readonly<Record<CloudStoreName, string>> = {\n activity: 'ActivityStore',\n approvals: 'ApprovalTimelineStore',\n devices: 'DeviceDirectory',\n pairingCodes: 'PairingCodeStore',\n nonces: 'NonceStore',\n dedup: 'InboundDedupStore',\n tasks: 'TaskAttemptStore',\n receipts: 'RequestReceiptStore',\n proofReceipts: 'ProofRequestReceiptStore',\n blobs: 'CloudBlobStore',\n rateLimiter: 'InboundRateLimiter',\n};\n"]}
1
+ {"version":3,"sources":["../src/crypto/web-crypto.ts","../src/auth/tokens.ts","../src/auth/verify.ts","../src/auth/plane.ts","../src/capabilities.ts","../src/errors.ts","../src/activity.ts","../src/coordination.ts","../src/auth/bearer.ts","../src/tenant-stores.ts","../src/handlers/shared.ts","../src/handlers/blobs.ts","../src/handlers/capabilities.ts","../src/handlers/auth.ts","../src/handlers/events.ts","../src/approval-timeline.ts","../src/board-projection.ts","../src/inbound.ts","../src/handlers/messages.ts","../src/handlers/board.ts","../src/handlers/presence.ts","../src/handlers/skill-packs.ts","../src/auth/device-proof.ts","../src/truth/contract.ts","../src/truth/errors.ts","../src/handlers/truth.ts","../src/router/registry.ts","../src/terminal-result.ts","../src/cloud.ts","../src/stores/in-memory/rate-limiter.ts","../src/stores/in-memory/blobs.ts","../src/stores/in-memory/device-directory.ts","../src/stores/in-memory/dedup.ts","../src/stores/in-memory/nonces.ts","../src/stores/in-memory/pairing-codes.ts","../src/stores/in-memory/receipts.ts","../src/stores/in-memory/proof-receipts.ts","../src/stores/in-memory/task-attempts.ts","../src/stores/in-memory/activity.ts","../src/stores/in-memory/approval-timeline.ts","../src/stores/in-memory/index.ts","../src/composition/in-memory.ts","../src/auth/device-assertion.ts","../src/coordination-client.ts","../src/stores/ports.ts","../src/stores/ports-contract.ts"],"names":["tenantId","z","response","tenantKey","isCoreConflictError","isCoreError","principalTenant","isTenantId","unauthorized","contentHash","STORAGE_ERROR_CODES","STORAGE_ERROR_HTTP_STATUS","decodeEnvelope","envelope","encodeEnvelope","nonce","BOARD_STATUSES","hasCapability","BYOK_BOARD_PATH","BYOK_BOARD_STREAM_PATH"],"mappings":";;;;;;;;;AAWA,IAAM,qBAAA,GAAwB,kCAAA;AAE9B,IAAM,UAAA,GAAa,kBAAA;AAEZ,SAAS,gBAAgB,KAAA,EAA2B;AACzD,EAAA,IAAI,MAAA,GAAS,EAAA;AACb,EAAA,KAAA,MAAW,IAAA,IAAQ,KAAA,EAAO,MAAA,IAAU,MAAA,CAAO,aAAa,IAAI,CAAA;AAC5D,EAAA,OAAO,IAAA,CAAK,MAAM,CAAA,CAAE,UAAA,CAAW,GAAA,EAAK,GAAG,CAAA,CAAE,UAAA,CAAW,GAAA,EAAK,GAAG,CAAA,CAAE,UAAA,CAAW,KAAK,EAAE,CAAA;AAClF;AAQO,SAAS,gBAAgB,KAAA,EAAuC;AACrE,EAAA,MAAM,MAAA,GAAS,MAAM,UAAA,CAAW,GAAA,EAAK,GAAG,CAAA,CAAE,UAAA,CAAW,KAAK,GAAG,CAAA;AAC7D,EAAA,IAAI;AACF,IAAA,MAAM,MAAA,GAAS,KAAK,MAAM,CAAA;AAC1B,IAAA,MAAM,KAAA,GAAQ,IAAI,UAAA,CAAW,MAAA,CAAO,MAAM,CAAA;AAC1C,IAAA,KAAA,IAAS,KAAA,GAAQ,CAAA,EAAG,KAAA,GAAQ,MAAA,CAAO,MAAA,EAAQ,KAAA,IAAS,CAAA,EAAG,KAAA,CAAM,KAAK,CAAA,GAAI,MAAA,CAAO,UAAA,CAAW,KAAK,CAAA;AAC7F,IAAA,OAAO,KAAA;AAAA,EACT,CAAA,CAAA,MAAQ;AACN,IAAA,OAAO,MAAA;AAAA,EACT;AACF;AAEA,SAAS,MAAM,KAAA,EAA2B;AACxC,EAAA,IAAI,GAAA,GAAM,EAAA;AACV,EAAA,KAAA,MAAW,QAAQ,KAAA,EAAO;AACxB,IAAA,GAAA,IAAO,UAAA,CAAY,IAAA,IAAQ,CAAA,GAAK,EAAG,CAAA;AACnC,IAAA,GAAA,IAAO,UAAA,CAAW,OAAO,EAAG,CAAA;AAAA,EAC9B;AACA,EAAA,OAAO,GAAA;AACT;AAaA,SAAS,MAAA,GAA2B;AAClC,EAAA,MAAM,YAAY,UAAA,CAAW,MAAA;AAC7B,EAAA,IAAI,SAAA,EAAW,WAAW,MAAA,EAAW;AACnC,IAAA,MAAM,IAAI,MAAM,0EAA0E,CAAA;AAAA,EAC5F;AACA,EAAA,OAAO,SAAA,CAAU,MAAA;AACnB;AAEO,SAAS,eAAA,GAA+B;AAC7C,EAAA,OAAO;AAAA,IACL,UAAA,GAAqB;AACnB,MAAA,OAAO,UAAA,CAAW,OAAO,UAAA,EAAW;AAAA,IACtC,CAAA;AAAA,IAEA,YAAY,UAAA,EAA4B;AACtC,MAAA,OAAO,eAAA,CAAgB,WAAW,MAAA,CAAO,eAAA,CAAgB,IAAI,UAAA,CAAW,UAAU,CAAC,CAAC,CAAA;AAAA,IACtF,CAAA;AAAA,IAEA,kBAAkB,MAAA,EAAwB;AACxC,MAAA,MAAM,QAAQ,UAAA,CAAW,MAAA,CAAO,gBAAgB,IAAI,UAAA,CAAW,MAAM,CAAC,CAAA;AACtE,MAAA,IAAI,GAAA,GAAM,EAAA;AACV,MAAA,KAAA,MAAW,QAAQ,KAAA,EAAO;AACxB,QAAA,GAAA,IAAO,qBAAA,CAAsB,IAAA,GAAO,qBAAA,CAAsB,MAAM,CAAA;AAAA,MAClE;AACA,MAAA,OAAO,GAAA;AAAA,IACT,CAAA;AAAA,IAEA,MAAM,aAAA,CACJ,kBAAA,EACA,OAAA,EACA,SAAA,EACkB;AAClB,MAAA,MAAM,cAAA,GAAiB,gBAAgB,SAAS,CAAA;AAChD,MAAA,IAAI,cAAA,KAAmB,QAAW,OAAO,KAAA;AACzC,MAAA,IAAI;AACF,QAAA,MAAM,GAAA,GAAM,MAAM,MAAA,EAAO,CAAE,SAAA;AAAA,UACzB,KAAA;AAAA,UACA,EAAE,GAAA,EAAK,KAAA,EAAO,GAAA,EAAK,SAAA,EAAW,GAAG,kBAAA,EAAmB;AAAA,UACpD,EAAE,MAAM,SAAA,EAAU;AAAA,UAClB,KAAA;AAAA,UACA,CAAC,QAAQ;AAAA,SACX;AACA,QAAA,MAAM,YAAA,GAAe,OAAO,OAAA,KAAY,QAAA,GAAW,IAAI,WAAA,EAAY,CAAE,MAAA,CAAO,OAAO,CAAA,GAAI,OAAA;AACvF,QAAA,OAAO,MAAM,MAAA,EAAO,CAAE,MAAA,CAAO,EAAE,MAAM,SAAA,EAAU,EAAG,GAAA,EAAK,cAAA,EAAgB,YAAY,CAAA;AAAA,MACrF,CAAA,CAAA,MAAQ;AAGN,QAAA,OAAO,KAAA;AAAA,MACT;AAAA,IACF,CAAA;AAAA,IAEA,MAAM,UAAA,CAAW,MAAA,EAAoB,OAAA,EAAkC;AACrE,MAAA,MAAM,MAAM,MAAM,MAAA,EAAO,CAAE,SAAA,CAAU,OAAO,MAAA,EAAQ,EAAE,IAAA,EAAM,MAAA,EAAQ,MAAM,SAAA,EAAU,EAAG,KAAA,EAAO,CAAC,MAAM,CAAC,CAAA;AACtG,MAAA,MAAM,SAAA,GAAY,MAAM,MAAA,EAAO,CAAE,IAAA,CAAK,MAAA,EAAQ,GAAA,EAAK,IAAI,WAAA,EAAY,CAAE,MAAA,CAAO,OAAO,CAAC,CAAA;AACpF,MAAA,OAAO,eAAA,CAAgB,IAAI,UAAA,CAAW,SAAS,CAAC,CAAA;AAAA,IAClD,CAAA;AAAA,IAEA,MAAM,OAAO,IAAA,EAAmC;AAC9C,MAAA,MAAM,SAAS,MAAM,MAAA,EAAO,CAAE,MAAA,CAAO,WAAW,IAAI,CAAA;AACpD,MAAA,OAAO,UAAU,KAAA,CAAM,IAAI,UAAA,CAAW,MAAM,CAAC,CAAC,CAAA,CAAA;AAAA,IAChD,CAAA;AAAA,IAEA,eAAA,CAAgB,MAAc,KAAA,EAAwB;AACpD,MAAA,MAAM,SAAA,GAAY,gBAAgB,IAAI,CAAA;AACtC,MAAA,MAAM,UAAA,GAAa,gBAAgB,KAAK,CAAA;AACxC,MAAA,IAAI,SAAA,KAAc,MAAA,IAAa,UAAA,KAAe,MAAA,EAAW,OAAO,KAAA;AAChE,MAAA,IAAI,SAAA,CAAU,MAAA,KAAW,UAAA,CAAW,MAAA,EAAQ,OAAO,KAAA;AACnD,MAAA,IAAI,IAAA,GAAO,CAAA;AACX,MAAA,KAAA,IAAS,QAAQ,CAAA,EAAG,KAAA,GAAQ,SAAA,CAAU,MAAA,EAAQ,SAAS,CAAA,EAAG;AACxD,QAAA,IAAA,IAAA,CAAS,UAAU,KAAK,CAAA,IAAK,CAAA,KAAM,UAAA,CAAW,KAAK,CAAA,IAAK,CAAA,CAAA;AAAA,MAC1D;AACA,MAAA,OAAO,IAAA,KAAS,CAAA;AAAA,IAClB;AAAA,GACF;AACF;;;AC7GO,IAAM,2BAA2B,EAAA,GAAK;AAsB7C,SAAS,cAAc,KAAA,EAAwB;AAC7C,EAAA,OAAO,eAAA,CAAgB,IAAI,WAAA,EAAY,CAAE,OAAO,IAAA,CAAK,SAAA,CAAU,KAAK,CAAC,CAAC,CAAA;AACxE;AASO,SAAS,qBAAA,CAAsB,QAAoB,KAAA,EAA2B;AACnF,EAAA,eAAe,WAAW,KAAA,EAA6C;AACrE,IAAA,OAAO,UAAA,CAAW,MAAA,CAAO,MAAA,CAAO,SAAA,CAAU,OAAO,MAAA,EAAQ,EAAE,IAAA,EAAM,MAAA,EAAQ,MAAM,SAAA,EAAU,EAAG,KAAA,EAAO,CAAC,KAAK,CAAC,CAAA;AAAA,EAC5G;AAEA,EAAA,eAAe,UAAU,YAAA,EAAuC;AAC9D,IAAA,MAAM,GAAA,GAAM,MAAM,UAAA,CAAW,MAAM,CAAA;AACnC,IAAA,MAAM,KAAA,GAAQ,MAAM,UAAA,CAAW,MAAA,CAAO,MAAA,CAAO,IAAA,CAAK,MAAA,EAAQ,GAAA,EAAK,IAAI,WAAA,EAAY,CAAE,MAAA,CAAO,YAAY,CAAC,CAAA;AACrG,IAAA,OAAO,eAAA,CAAgB,IAAI,UAAA,CAAW,KAAK,CAAC,CAAA;AAAA,EAC9C;AAEA,EAAA,OAAO;AAAA,IACL,MAAM,IAAA,CAAK,MAAA,EAAQ,gBAAA,EAAkB;AACnC,MAAA,MAAM,QAAA,GAAW,KAAK,KAAA,CAAM,KAAA,CAAM,KAAI,CAAE,OAAA,KAAY,GAAI,CAAA;AACxD,MAAA,MAAM,SAAS,aAAA,CAAc,EAAE,KAAK,OAAA,EAAS,GAAA,EAAK,OAAO,CAAA;AACzD,MAAA,MAAM,UAAU,aAAA,CAAc;AAAA,QAC5B,UAAU,MAAA,CAAO,QAAA;AAAA,QACjB,UAAU,MAAA,CAAO,QAAA;AAAA,QACjB,WAAW,MAAA,CAAO,SAAA;AAAA,QAClB,GAAA,EAAK,QAAA;AAAA,QACL,KAAK,QAAA,GAAW;AAAA,OACjB,CAAA;AACD,MAAA,MAAM,YAAA,GAAe,CAAA,EAAG,MAAM,CAAA,CAAA,EAAI,OAAO,CAAA,CAAA;AACzC,MAAA,OAAO,GAAG,YAAY,CAAA,CAAA,EAAI,MAAM,SAAA,CAAU,YAAY,CAAC,CAAA,CAAA;AAAA,IACzD,CAAA;AAAA,IAEA,MAAM,OAAO,KAAA,EAAO;AAClB,MAAA,MAAM,KAAA,GAAQ,KAAA,CAAM,KAAA,CAAM,GAAG,CAAA;AAC7B,MAAA,IAAI,KAAA,CAAM,MAAA,KAAW,CAAA,EAAG,OAAO,MAAA;AAC/B,MAAA,MAAM,CAAC,MAAA,EAAQ,OAAA,EAAS,QAAQ,CAAA,GAAI,KAAA;AAEpC,MAAA,MAAM,GAAA,GAAM,MAAM,UAAA,CAAW,QAAQ,CAAA;AACrC,MAAA,MAAM,aAAA,GAAgB,gBAAgB,QAAQ,CAAA;AAC9C,MAAA,IAAI,aAAA,KAAkB,QAAW,OAAO,MAAA;AACxC,MAAA,MAAM,EAAA,GAAK,MAAM,UAAA,CAAW,MAAA,CAAO,MAAA,CAAO,MAAA;AAAA,QACxC,MAAA;AAAA,QACA,GAAA;AAAA,QACA,aAAA;AAAA,QACA,IAAI,aAAY,CAAE,MAAA,CAAO,GAAG,MAAM,CAAA,CAAA,EAAI,OAAO,CAAA,CAAE;AAAA,OACjD;AACA,MAAA,IAAI,CAAC,IAAI,OAAO,MAAA;AAEhB,MAAA,MAAM,WAAA,GAAc,gBAAgB,MAAM,CAAA;AAC1C,MAAA,MAAM,YAAA,GAAe,gBAAgB,OAAO,CAAA;AAC5C,MAAA,IAAI,WAAA,KAAgB,MAAA,IAAa,YAAA,KAAiB,MAAA,EAAW,OAAO,MAAA;AAEpE,MAAA,IAAI,aAAA;AACJ,MAAA,IAAI,cAAA;AACJ,MAAA,IAAI;AACF,QAAA,aAAA,GAAgB,KAAK,KAAA,CAAM,IAAI,aAAY,CAAE,MAAA,CAAO,WAAW,CAAC,CAAA;AAChE,QAAA,cAAA,GAAiB,KAAK,KAAA,CAAM,IAAI,aAAY,CAAE,MAAA,CAAO,YAAY,CAAC,CAAA;AAAA,MACpE,CAAA,CAAA,MAAQ;AACN,QAAA,OAAO,MAAA;AAAA,MACT;AAEA,MAAA,MAAM,MAAO,aAAA,EAA4C,GAAA;AACzD,MAAA,IAAI,GAAA,KAAQ,SAAS,OAAO,MAAA;AAE5B,MAAA,MAAM,EAAE,QAAA,EAAU,QAAA,EAAAA,SAAAA,EAAU,SAAA,EAAW,KAAI,GAAI,cAAA;AAC/C,MAAA,IAAI,OAAO,aAAa,QAAA,IAAY,OAAOA,cAAa,QAAA,IAAY,OAAO,cAAc,QAAA,EAAU;AACjG,QAAA,OAAO,MAAA;AAAA,MACT;AACA,MAAA,IAAI,OAAO,GAAA,KAAQ,QAAA,IAAY,KAAA,CAAM,GAAA,GAAM,OAAA,EAAQ,GAAI,GAAA,IAAQ,GAAA,EAAK,OAAO,MAAA;AAE3E,MAAA,OAAO,EAAE,QAAA,EAAU,QAAA,EAAAA,SAAAA,EAAU,SAAA,EAAU;AAAA,IACzC;AAAA,GACF;AACF;ACjGO,SAAS,oBAAA,CACd,MAAA,EACA,eAAA,EACA,KAAA,EACA,SAAA,EACkB;AAIlB,EAAA,OAAO,MAAA,CAAO,aAAA,CAAc,eAAA,EAAiB,oBAAA,GAAuB,OAAO,SAAS,CAAA;AACtF;;;ACZO,IAAM,mBAAA,GAAsB,KAAK,EAAA,GAAK;AAE7C,IAAM,mBAAA,GAAsB,CAAA;AAGrB,IAAM,4BAAA,GAA+B;AACrC,IAAM,+BAAA,GAAkC;AA0CxC,SAAS,gBAAgB,IAAA,EAAgC;AAC9D,EAAA,MAAM,EAAE,MAAA,EAAQ,MAAA,EAAQ,KAAA,EAAO,aAAY,GAAI,IAAA;AAC/C,EAAA,MAAM,UAAA,GAAa,KAAK,qBAAA,IAAyB,wBAAA;AAEjD,EAAA,OAAO;AAAA,IACL,MAAM,iBAAA,CAAkB,MAAA,EAAQ,KAAA,EAAO;AACrC,MAAA,MAAM,SAAA,GAAY,IAAI,IAAA,CAAK,KAAA,CAAM,GAAA,EAAI,CAAE,OAAA,EAAQ,IAAK,KAAA,CAAM,KAAA,IAAS,mBAAA,CAAoB,CAAA,CAAE,WAAA,EAAY;AACrG,MAAA,OAAO,MAAA,CAAO,YAAA,CAAa,KAAA,CAAM,MAAA,EAAQ;AAAA,QACvC,IAAA,EAAM,MAAA,CAAO,iBAAA,CAAkB,mBAAmB,CAAA;AAAA,QAClD,WAAW,KAAA,CAAM,SAAA;AAAA,QACjB;AAAA,OACD,CAAA;AAAA,IACH,CAAA;AAAA,IAEA,MAAM,kBAAkB,KAAA,EAAO;AAC7B,MAAA,MAAM,SAAS,MAAM,MAAA,CAAO,YAAA,CAAa,MAAA,CAAO,MAAM,WAAW,CAAA;AACjE,MAAA,IAAI,MAAA,KAAW,QAAW,OAAO,MAAA;AAIjC,MAAA,OAAO,MAAA,CAAO,OAAA,CAAQ,QAAA,CAAS,MAAA,CAAO,QAAA,EAAU;AAAA,QAC9C,WAAW,MAAA,CAAO,SAAA;AAAA,QAClB,QAAA,EAAU,CAAA,IAAA,EAAO,MAAA,CAAO,UAAA,EAAY,CAAA,CAAA;AAAA,QACpC,YAAY,KAAA,CAAM,UAAA;AAAA,QAClB,iBAAiB,KAAA,CAAM,eAAA;AAAA,QACvB,UAAA,EAAY,4BAAA;AAAA,QACZ,aAAA,EAAe;AAAA,OAChB,CAAA;AAAA,IACH,CAAA;AAAA,IAEA,MAAM,cAAc,QAAA,EAAU;AAC5B,MAAA,MAAM,MAAA,GAAS,MAAM,MAAA,CAAO,OAAA,CAAQ,kBAAkB,QAAQ,CAAA;AAC9D,MAAA,IAAI,MAAA,KAAW,MAAA,IAAa,MAAA,CAAO,OAAA,EAAS,OAAO,MAAA;AACnD,MAAA,OAAO,MAAA;AAAA,IACT,CAAA;AAAA,IAEA,WAAW,MAAA,EAAQ;AACjB,MAAA,OAAO,OAAO,MAAA,CAAO,KAAA,CAAM,MAAA,CAAO,QAAA,EAAU,OAAO,QAAQ,CAAA;AAAA,IAC7D,CAAA;AAAA,IAEA,aAAA,CAAc,QAAQ,KAAA,EAAO;AAC3B,MAAA,OAAO,OAAO,MAAA,CAAO,QAAA,CAAS,OAAO,QAAA,EAAU,MAAA,CAAO,UAAU,KAAK,CAAA;AAAA,IACvE,CAAA;AAAA,IAEA,YAAA,CAAa,QAAQ,KAAA,EAAO;AAC1B,MAAA,OAAO,MAAA,CAAO,MAAA,CAAO,QAAA,CAAS,MAAA,CAAO,UAAU,KAAK,CAAA;AAAA,IACtD,CAAA;AAAA,IAEA,eAAA,CAAgB,MAAA,EAAQ,KAAA,EAAO,SAAA,EAAW;AACxC,MAAA,OAAO,oBAAA,CAAqB,MAAA,EAAQ,MAAA,CAAO,eAAA,EAAiB,OAAO,SAAS,CAAA;AAAA,IAC9E,CAAA;AAAA,IAEA,MAAM,gBAAgB,MAAA,EAAQ;AAC5B,MAAA,MAAM,WAAA,GAAc,MAAM,WAAA,CAAY,IAAA;AAAA,QACpC,EAAE,UAAU,MAAA,CAAO,QAAA,EAAU,UAAU,MAAA,CAAO,QAAA,EAAU,SAAA,EAAW,MAAA,CAAO,SAAA,EAAU;AAAA,QACpF;AAAA,OACF;AACA,MAAA,OAAO;AAAA,QACL,WAAA;AAAA,QACA,SAAA,EAAW,IAAI,IAAA,CAAK,KAAA,CAAM,GAAA,EAAI,CAAE,OAAA,EAAQ,GAAI,UAAA,GAAa,GAAI,CAAA,CAAE,WAAA;AAAY,OAC7E;AAAA,IACF;AAAA,GACF;AACF;ACpHO,IAAM,kBAAA,GAAqB;AAAA;AAAA,EAEhC,cAAA,EAAgB,iBAAA;AAAA;AAAA,EAEhB,aAAA,EAAe,gBAAA;AAAA;AAAA,EAEf,cAAA,EAAgB,iBAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAehB,iBAAA,EAAmB,oBAAA;AAAA;AAAA,EAEnB,iBAAA,EAAmB,oBAAA;AAAA;AAAA,EAEnB,QAAA,EAAU,WAAA;AAAA;AAAA,EAEV,aAAA,EAAe,gBAAA;AAAA;AAAA,EAEf,YAAA,EAAc,eAAA;AAAA;AAAA,EAEd,YAAA,EAAc,eAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAYd,UAAA,EAAY;AACd;AAKO,IAAM,0BAAA,GAA6B;AAmBnC,SAAS,yBAAA,CACd,OAAA,GAAU,CAAA,EACV,OAAA,GAA4C,EAAC,EACtB;AACvB,EAAA,OAAO;AAAA,IACL,MAAA,EAAQ,sBAAA;AAAA,IACR,OAAA;AAAA,IACA,cAAc,MAAA,CAAO,MAAA,CAAO,kBAAkB,CAAA,CAAE,MAAA,CAAO,CAAC,UAAA,KAAe;AACrE,MAAA,IAAI,UAAA,KAAe,kBAAA,CAAmB,YAAA,EAAc,OAAO,QAAQ,mBAAA,KAAwB,IAAA;AAC3F,MAAA,IAAI,UAAA,KAAe,kBAAA,CAAmB,UAAA,EAAY,OAAO,QAAQ,iBAAA,KAAsB,IAAA;AACvF,MAAA,OAAO,IAAA;AAAA,IACT,CAAC;AAAA,GACH;AACF;AAEO,SAAS,QAAA,CAAS,aAAoC,UAAA,EAAsC;AACjG,EAAA,OAAO,aAAA,CAAc,aAAa,UAAU,CAAA;AAC9C;;;AC/FO,IAAM,iBAAA,GAAoB;AAAA;AAAA,EAE/B,oBAAA,EAAsB,sBAAA;AAAA;AAAA,EAEtB,qBAAA,EAAuB,uBAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAMvB,oBAAA,EAAsB,sBAAA;AAAA;AAAA,EAEtB,8BAAA,EAAgC,gCAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAUhC,wBAAA,EAA0B,0BAAA;AAAA;AAAA,EAE1B,0BAAA,EAA4B,4BAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAO5B,2BAAA,EAA6B,6BAAA;AAAA;AAAA,EAE7B,wBAAA,EAA0B;AAC5B;AAIO,IAAM,cAAA,GAAN,cAA6B,KAAA,CAAM;AAAA,EACxB,IAAA;AAAA,EAEhB,WAAA,CAAY,IAAA,EAAsB,OAAA,EAAiB,OAAA,EAAwB;AACzE,IAAA,KAAA,CAAM,SAAS,OAAO,CAAA;AACtB,IAAA,IAAA,CAAK,IAAA,GAAO,gBAAA;AACZ,IAAA,IAAA,CAAK,IAAA,GAAO,IAAA;AAAA,EACd;AACF;AAEO,SAAS,YAAA,CAAa,OAAgB,IAAA,EAAgD;AAC3F,EAAA,IAAI,EAAE,KAAA,YAAiB,cAAA,CAAA,EAAiB,OAAO,KAAA;AAC/C,EAAA,OAAO,IAAA,KAAS,MAAA,IAAa,KAAA,CAAM,IAAA,KAAS,IAAA;AAC9C;;;ACxDO,IAAM,yBAAA,GAA4B;AAEzC,IAAM,oBAAA,GAAuB,EAAE,MAAA,EAAO,CAAE,IAAI,CAAC,CAAA,CAAE,IAAI,GAAG,CAAA;AACtD,IAAM,sBAAA,GAAyB,EAC5B,MAAA,EAAO,CACP,IAAI,GAAG,CAAA,CACP,KAAA,CAAM,IAAA,EAAM,oCAAoC,CAAA;AAE5C,IAAM,2BAAA,GAA8B,EAAE,MAAA,CAAO;AAAA,EAClD,MAAA,EAAQ,oBAAA;AAAA,EACR,gBAAA,EAAkB,sBAAA;AAAA,EAClB,UAAU,CAAA,CAAE,MAAA,EAAO,CAAE,GAAA,GAAM,WAAA,EAAY;AAAA,EACvC,QAAQ,CAAA,CAAE,KAAA,CAAM,yBAAyB,CAAA,CAAE,IAAI,CAAC,CAAA;AAAA,EAChD,SAAS,CAAA,CAAE,MAAA,EAAO,CAAE,GAAA,GAAM,WAAA;AAC5B,CAAC;AAEM,IAAM,mBAAA,GAAsB,EAAE,MAAA,CAAO;AAAA,EAC1C,MAAA,EAAQ,oBAAA;AAAA,EACR,gBAAA,EAAkB,sBAAA;AAAA,EAClB,UAAU,CAAA,CAAE,MAAA,EAAO,CAAE,GAAA,GAAM,WAAA,EAAY;AAAA,EACvC,YAAY,CAAA,CAAE,MAAA,EAAO,CAAE,GAAA,GAAM,WAAA,EAAY;AAAA,EACzC,UAAA,EAAY,CAAA,CAAE,GAAA,CAAI,QAAA,EAAS;AAAA,EAC3B,KAAA,EAAO;AACT,CAAC;AAkCM,SAAS,uBAAuB,KAAA,EAAoC;AACzE,EAAA,IAAI,CAAC,OAAO,QAAA,CAAS,KAAA,CAAM,KAAK,CAAA,IAAK,KAAA,CAAM,SAAS,CAAA,EAAG;AACrD,IAAA,MAAM,IAAI,cAAA;AAAA,MACR,4BAAA;AAAA,MACA,CAAA,iEAAA,EAAoE,MAAA,CAAO,KAAA,CAAM,KAAK,CAAC,CAAA,CAAA;AAAA,KACzF;AAAA,EACF;AACA,EAAA,MAAM,QAAA,GAAW,MAAM,QAAA,IAAY,yBAAA;AACnC,EAAA,IAAI,CAAC,MAAA,CAAO,aAAA,CAAc,QAAQ,CAAA,IAAK,YAAY,CAAA,EAAG;AACpD,IAAA,MAAM,IAAI,cAAA;AAAA,MACR,4BAAA;AAAA,MACA,CAAA,uDAAA,EAA0D,MAAA,CAAO,QAAQ,CAAC,CAAA,CAAA;AAAA,KAC5E;AAAA,EACF;AACA,EAAA,MAAM,MAAA,GAAS,2BAAA,CAA4B,SAAA,CAAU,KAAK,CAAA;AAC1D,EAAA,IAAI,CAAC,OAAO,OAAA,EAAS;AACnB,IAAA,MAAM,IAAI,cAAA;AAAA,MACR,4BAAA;AAAA,MACA;AAAA,KACF;AAAA,EACF;AACA,EAAA,OAAO,QAAA;AACT;AAEO,SAAS,qBAAA,CACd,OACA,UAAA,EAC0B;AAC1B,EAAA,OAAO,MAAM,MAAA,CAAO,GAAA;AAAA,IAAI,CAAC,KAAA,EAAO,UAAA,KAC9B,mBAAA,CAAoB,KAAA,CAAM;AAAA,MACxB,QAAQ,KAAA,CAAM,MAAA;AAAA,MACd,kBAAkB,KAAA,CAAM,gBAAA;AAAA,MACxB,UAAU,KAAA,CAAM,QAAA;AAAA,MAChB,UAAA;AAAA,MACA,UAAA;AAAA,MACA;AAAA,KACD;AAAA,GACH;AACF;AAEO,SAAS,oBAAoB,KAAA,EAA0C;AAC5E,EAAA,OAAO,CAAA,CAAE,KAAA,CAAM,mBAAmB,CAAA,CAAE,MAAM,KAAK,CAAA;AACjD;AAEO,SAAS,qBAAA,CAAsB,MAAqB,KAAA,EAA8B;AACvF,EAAA,OAAO,KAAK,QAAA,GAAW,KAAA,CAAM,QAAA,IAAY,IAAA,CAAK,aAAa,KAAA,CAAM,UAAA;AACnE;AAEO,SAAS,eACd,OAAA,EAC4B;AAC5B,EAAA,MAAM,IAAA,GAAO,OAAA,CAAQ,EAAA,CAAG,EAAE,CAAA;AAC1B,EAAA,OAAO,IAAA,KAAS,SAAY,MAAA,GAAY,EAAE,UAAU,IAAA,CAAK,QAAA,EAAU,UAAA,EAAY,IAAA,CAAK,UAAA,EAAW;AACjG;AAEO,SAAS,eAAA,CAAgB,QAAkB,MAAA,EAAwB;AACxE,EAAA,OAAO,SAAA,CAAU,QAAQ,MAAM,CAAA;AACjC;;;AC7GO,IAAM,+BAAA,GAAkC;AACxC,IAAM,6BAAA,GAAgC;AACtC,IAAM,2BAAA,GAA8B;AACpC,IAAM,6BAA6B,EAAA,GAAK;AAExC,IAAM,0BAA0B,EAAA,GAAK;AACrC,IAAM,uBAAA,GAA0B;AAChC,IAAM,oCAAA,GAAuC;AAC7C,IAAM,iCAAA,GAAoC;AAEjD,IAAM,OAAA,GAAU,IAAI,WAAA,EAAY;AASzB,IAAM,uBAAA,GAA0C;AAAA,EACrD,SAAA,EAAW,2BAAA;AAAA,EACX,QAAA,EAAU,0BAAA;AAAA,EACV,QAAA,EAAU,yBAAA;AAAA,EACV,KAAA,EAAO;AACT;AAEO,SAAS,iBAAA,CACd,OAAA,EACA,KAAA,EACA,MAAA,EACM;AACN,EAAA,IAAI,OAAA,CAAQ,WAAW,CAAA,IAAK,OAAA,CAAQ,OAAO,OAAO,CAAA,CAAE,MAAA,GAAS,MAAA,CAAO,eAAA,EAAiB;AACnF,IAAA,MAAM,IAAI,cAAA;AAAA,MACR,4BAAA;AAAA,MACA,CAAA,8BAAA,EAAiC,OAAO,eAAe,CAAA,aAAA;AAAA,KACzD;AAAA,EACF;AACA,EAAA,IAAI,KAAA,CAAM,WAAW,CAAA,IAAK,OAAA,CAAQ,OAAO,KAAK,CAAA,CAAE,MAAA,GAAS,MAAA,CAAO,aAAA,EAAe;AAC7E,IAAA,MAAM,IAAI,cAAA;AAAA,MACR,4BAAA;AAAA,MACA,CAAA,4BAAA,EAA+B,OAAO,aAAa,CAAA,aAAA;AAAA,KACrD;AAAA,EACF;AACF;AAEO,SAAS,sBAAA,CACd,MAAA,EACA,OAAA,EACA,MAAA,EACM;AACN,EAAA,IAAI,CAAC,MAAA,CAAO,aAAA,CAAc,OAAO,CAAA,IAAK,UAAU,CAAA,EAAG;AACjD,IAAA,MAAM,IAAI,cAAA;AAAA,MACR,4BAAA;AAAA,MACA;AAAA,KACF;AAAA,EACF;AACA,EAAA,IAAI,OAAO,MAAA,KAAW,CAAA,IAAK,MAAA,CAAO,MAAA,GAAS,OAAO,SAAA,EAAW;AAC3D,IAAA,MAAM,IAAI,cAAA;AAAA,MACR,0BAAA;AAAA,MACA,CAAA,+BAAA,EAAkC,OAAO,SAAS,CAAA,QAAA;AAAA,KACpD;AAAA,EACF;AACA,EAAA,MAAM,OAAA,GAAU,IAAA,CAAK,SAAA,CAAU,MAAM,CAAA;AACrC,EAAA,IAAI,QAAQ,MAAA,CAAO,OAAO,CAAA,CAAE,MAAA,GAAS,OAAO,QAAA,EAAU;AACpD,IAAA,MAAM,IAAI,cAAA;AAAA,MACR,0BAAA;AAAA,MACA,CAAA,uBAAA,EAA0B,OAAO,QAAQ,CAAA,aAAA;AAAA,KAC3C;AAAA,EACF;AACF;AAEO,SAAS,qBAAA,CACd,OACA,MAAA,EACM;AACN,EAAA,sBAAA,CAAuB,KAAA,CAAM,MAAA,EAAQ,KAAA,CAAM,OAAA,EAAS,MAAM,CAAA;AAC1D,EAAA,sBAAA,CAAuB,EAAE,GAAG,KAAA,EAAO,KAAA,EAAO,OAAO,KAAA,EAAO,QAAA,EAAU,MAAA,CAAO,QAAA,EAAU,CAAA;AACrF;AAEA,eAAsB,oBAAA,CACpB,QAAA,EACA,KAAA,EAOA,MAAA,EACuB;AACvB,EAAA,qBAAA,CAAsB,OAAO,MAAM,CAAA;AACnC,EAAA,OAAO,SAAS,MAAA,CAAO;AAAA,IACrB,QAAQ,KAAA,CAAM,MAAA;AAAA,IACd,kBAAkB,KAAA,CAAM,gBAAA;AAAA,IACxB,UAAU,KAAA,CAAM,QAAA;AAAA,IAChB,QAAQ,KAAA,CAAM,MAAA;AAAA,IACd,SAAS,KAAA,CAAM,OAAA;AAAA,IACf,OAAO,MAAA,CAAO,KAAA;AAAA,IACd,UAAU,MAAA,CAAO;AAAA,GAClB,CAAA;AACH;ACrFO,SAAS,mBAAmB,MAAA,EAAgD;AACjF,EAAA,IAAI,MAAA,KAAW,QAAW,OAAO,MAAA;AACjC,EAAA,MAAM,KAAA,GAAQ,kBAAA,CAAmB,IAAA,CAAK,MAAM,CAAA;AAC5C,EAAA,OAAO,QAAQ,CAAC,CAAA;AAClB;AAEA,eAAsB,kBAAA,CACpB,QACA,IAAA,EACsC;AACtC,EAAA,MAAM,KAAA,GAAQ,mBAAmB,MAAM,CAAA;AACvC,EAAA,IAAI,KAAA,KAAU,QAAW,OAAO,MAAA;AAEhC,EAAA,MAAM,MAAA,GAAS,MAAM,IAAA,CAAK,WAAA,CAAY,OAAO,KAAK,CAAA;AAClD,EAAA,IAAI,MAAA,KAAW,QAAW,OAAO,MAAA;AAGjC,EAAA,IAAI,CAAC,UAAA,CAAW,MAAA,CAAO,QAAQ,GAAG,OAAO,MAAA;AAEzC,EAAA,MAAM,MAAA,GAAS,MAAM,IAAA,CAAK,OAAA,CAAQ,GAAA,CAAI,SAAS,MAAA,CAAO,QAAQ,CAAA,EAAG,MAAA,CAAO,QAAQ,CAAA;AAChF,EAAA,IAAI,MAAA,KAAW,MAAA,IAAa,MAAA,CAAO,OAAA,EAAS,OAAO,MAAA;AACnD,EAAA,IAAI,MAAA,CAAO,SAAA,KAAc,MAAA,CAAO,SAAA,EAAW,OAAO,MAAA;AAElD,EAAA,OAAO;AAAA,IACL,IAAA,EAAM,QAAA;AAAA,IACN,UAAU,MAAA,CAAO,QAAA;AAAA,IACjB,WAAW,MAAA,CAAO,SAAA;AAAA,IAClB,UAAU,MAAA,CAAO;AAAA,GACnB;AACF;AC0GO,SAAS,eAAA,CAAgB,WAAsB,IAAA,EAAqC;AACzF,EAAA,MAAM,MAAA,GAAS,gBAAgB,SAAS,CAAA;AACxC,EAAA,MAAM,EAAE,IAAA,EAAM,KAAA,EAAM,GAAI,IAAA;AAExB,EAAA,OAAO;AAAA,IACL,MAAA;AAAA,IACA,SAAA;AAAA,IACA,OAAA,EAAS;AAAA,MACP,QAAQ,CAAC,KAAA,KAAU,KAAK,OAAA,CAAQ,MAAA,CAAO,QAAQ,KAAK,CAAA;AAAA,MACpD,WAAW,CAAC,KAAA,KAAU,KAAK,OAAA,CAAQ,SAAA,CAAU,QAAQ,KAAK,CAAA;AAAA,MAC1D,eAAe,CAAC,KAAA,KAAU,KAAK,OAAA,CAAQ,aAAA,CAAc,QAAQ,KAAK,CAAA;AAAA,MAClE,YAAY,CAAC,QAAA,KAAa,KAAK,OAAA,CAAQ,UAAA,CAAW,QAAQ,QAAQ;AAAA,KACpE;AAAA,IACA,KAAA,EAAO;AAAA,MACL,QAAQ,CAAC,KAAA,KAAU,KAAK,KAAA,CAAM,MAAA,CAAO,QAAQ,KAAK,CAAA;AAAA,MAClD,KAAK,CAAC,MAAA,KAAW,KAAK,KAAA,CAAM,GAAA,CAAI,QAAQ,MAAM,CAAA;AAAA,MAC9C,MAAM,CAAC,KAAA,KAAU,KAAK,KAAA,CAAM,IAAA,CAAK,QAAQ,KAAK,CAAA;AAAA,MAC9C,OAAO,CAAC,KAAA,KAAU,KAAK,KAAA,CAAM,KAAA,CAAM,QAAQ,KAAK,CAAA;AAAA,MAChD,SAAS,CAAC,KAAA,KAAU,KAAK,KAAA,CAAM,OAAA,CAAQ,QAAQ,KAAK,CAAA;AAAA,MACpD,cAAc,CAAC,KAAA,KAAU,KAAK,KAAA,CAAM,YAAA,CAAa,QAAQ,KAAK;AAAA,KAChE;AAAA,IACA,QAAA,EAAU;AAAA,MACR,SAAS,CAAC,KAAA,KAAU,KAAK,QAAA,CAAS,OAAA,CAAQ,QAAQ,KAAK,CAAA;AAAA,MACvD,MAAM,CAAC,QAAA,KAAa,KAAK,QAAA,CAAS,IAAA,CAAK,QAAQ,QAAQ,CAAA;AAAA,MACvD,IAAA,EAAM,MAAM,IAAA,CAAK,QAAA,CAAS,KAAK,MAAM;AAAA,KACvC;AAAA,IACA,QAAA,EAAU;AAAA,MACR,QAAQ,CAAC,KAAA,KAAU,MAAM,QAAA,CAAS,MAAA,CAAO,QAAQ,KAAK,CAAA;AAAA,MACtD,MAAM,CAAC,MAAA,KAAW,MAAM,QAAA,CAAS,IAAA,CAAK,QAAQ,MAAM;AAAA,KACtD;AAAA,IACA,SAAA,EAAW;AAAA,MACT,QAAQ,CAAC,KAAA,KAAU,MAAM,SAAA,CAAU,MAAA,CAAO,QAAQ,KAAK,CAAA;AAAA,MACvD,MAAM,CAAC,MAAA,KAAW,MAAM,SAAA,CAAU,IAAA,CAAK,QAAQ,MAAM;AAAA,KACvD;AAAA,IACA,OAAA,EAAS;AAAA,MACP,KAAK,CAAC,QAAA,KAAa,MAAM,OAAA,CAAQ,GAAA,CAAI,QAAQ,QAAQ,CAAA;AAAA,MACrD,IAAA,EAAM,MAAM,KAAA,CAAM,OAAA,CAAQ,KAAK,MAAM,CAAA;AAAA,MACrC,QAAQ,CAAC,QAAA,KAAa,MAAM,OAAA,CAAQ,MAAA,CAAO,QAAQ,QAAQ;AAAA,KAC7D;AAAA,IACA,KAAA,EAAO;AAAA,MACL,MAAM,CAAC,KAAA,KAAU,MAAM,KAAA,CAAM,IAAA,CAAK,QAAQ,KAAK,CAAA;AAAA,MAC/C,KAAK,CAAC,MAAA,KAAW,MAAM,KAAA,CAAM,GAAA,CAAI,QAAQ,MAAM,CAAA;AAAA,MAC/C,OAAO,CAAC,KAAA,KAAU,MAAM,KAAA,CAAM,KAAA,CAAM,QAAQ,KAAK,CAAA;AAAA,MACjD,cAAc,CAAC,KAAA,KAAU,MAAM,KAAA,CAAM,YAAA,CAAa,QAAQ,KAAK;AAAA,KACjE;AAAA,IACA,KAAA,EAAO;AAAA,MACL,cAAA,EAAgB,CAAC,QAAA,EAAU,UAAA,KAAe,MAAM,KAAA,CAAM,cAAA,CAAe,MAAA,EAAQ,QAAA,EAAU,UAAU;AAAA,KACnG;AAAA,IACA,QAAA,EAAU;AAAA,MACR,QAAQ,CAAC,KAAA,KAAU,MAAM,QAAA,CAAS,MAAA,CAAO,QAAQ,KAAK,CAAA;AAAA,MACtD,KAAK,CAAC,GAAA,KAAQ,MAAM,QAAA,CAAS,GAAA,CAAI,QAAQ,GAAG;AAAA,KAC9C;AAAA,IACA,KAAA,EAAO;AAAA,MACL,cAAc,CAAC,WAAA,KAAgB,MAAM,KAAA,CAAM,YAAA,CAAa,QAAQ,WAAW,CAAA;AAAA,MAC3E,aAAA,EAAe,CAAC,MAAA,EAAQ,WAAA,KAAgB,MAAM,KAAA,CAAM,aAAA,CAAc,MAAA,EAAQ,MAAA,EAAQ,WAAW,CAAA;AAAA,MAC7F,gBAAgB,CAAC,MAAA,KAAW,MAAM,KAAA,CAAM,cAAA,CAAe,QAAQ,MAAM;AAAA,KACvE;AAAA,IACA,KAAA,EAAO;AAAA,MACL,iBAAiB,CAAC,aAAA,KAAkB,KAAK,KAAA,CAAM,eAAA,CAAgB,QAAQ,aAAa,CAAA;AAAA,MACpF,SAAS,CAAC,KAAA,KAAU,KAAK,KAAA,CAAM,OAAA,CAAQ,QAAQ,KAAK,CAAA;AAAA,MACpD,qBAAqB,CAAC,KAAA,KAAU,KAAK,KAAA,CAAM,mBAAA,CAAoB,QAAQ,KAAK,CAAA;AAAA,MAC5E,kBAAkB,CAAC,aAAA,KAAkB,KAAK,KAAA,CAAM,gBAAA,CAAiB,QAAQ,aAAa;AAAA,KACxF;AAAA,IACA,WAAA,EAAa;AAAA,MACX,SAAS,CAAC,QAAA,KAAa,MAAM,WAAA,CAAY,OAAA,CAAQ,QAAQ,QAAQ;AAAA;AACnE,GACF;AACF;;;AClNA,eAAsB,aAAa,CAAA,EAA8B;AAC/D,EAAA,IAAI;AACF,IAAA,OAAO,MAAM,CAAA,CAAE,GAAA,CAAI,IAAA,EAAK;AAAA,EAC1B,CAAA,CAAA,MAAQ;AACN,IAAA,OAAO,MAAA;AAAA,EACT;AACF;AAiBA,eAAsB,kBAAA,CACpB,GACA,IAAA,EACiD;AACjD,EAAA,MAAM,MAAA,GAAS,MAAM,kBAAA,CAAmB,CAAA,CAAE,IAAI,MAAA,CAAO,eAAe,CAAA,EAAG,IAAA,CAAK,MAAM,CAAA;AAClF,EAAA,IAAI,MAAA,KAAW,QAAW,OAAO,MAAA;AACjC,EAAA,OAAO,EAAE,MAAA,EAAQ,MAAA,EAAQ,gBAAgB,MAAA,EAAQ,IAAA,CAAK,IAAI,CAAA,EAAE;AAC9D;;;ACNO,IAAM,uBAAA,GAA0B,KAAK,EAAA,GAAK,GAAA;AAgBjD,IAAM,oBAAA,GAAuBC,EAAE,MAAA,CAAO;AAAA,EACpC,GAAA,EAAKA,CAAAA,CAAE,MAAA,EAAO,CAAE,IAAI,CAAC,CAAA;AAAA,EACrB,GAAA,EAAKA,CAAAA,CAAE,MAAA,CAAO,MAAA,GAAS,MAAA;AACzB,CAAC,CAAA;AAEM,SAAS,kBAAkB,IAAA,EAAqB;AACrD,EAAA,OAAO,OAAO,CAAA,KAAkC;AAC9C,IAAA,MAAM,aAAA,GAAgB,MAAM,kBAAA,CAAmB,CAAA,EAAG,IAAI,CAAA;AACtD,IAAA,IAAI,aAAA,KAAkB,QAAW,OAAO,CAAA,CAAE,KAAK,EAAE,KAAA,EAAO,cAAA,EAAe,EAAG,GAAG,CAAA;AAE7E,IAAA,MAAM,SAAS,uBAAA,CAAwB,SAAA,CAAU,MAAM,YAAA,CAAa,CAAC,CAAC,CAAA;AACtE,IAAA,IAAI,CAAC,MAAA,CAAO,OAAA,EAAS,OAAO,CAAA,CAAE,KAAK,EAAE,KAAA,EAAO,iDAAA,EAAkD,EAAG,GAAG,CAAA;AACpG,IAAA,IAAI,MAAA,CAAO,IAAA,CAAK,IAAA,GAAO,IAAA,CAAK,gBAAA,EAAkB;AAC5C,MAAA,OAAO,CAAA,CAAE,KAAK,EAAE,KAAA,EAAO,4BAA4B,IAAA,CAAK,gBAAgB,CAAA,MAAA,CAAA,EAAS,EAAG,GAAG,CAAA;AAAA,IACzF;AAEA,IAAA,MAAM,aAAA,GAAgB,eAAe,CAAC,CAAA;AACtC,IAAA,IAAI,kBAAkB,MAAA,EAAW;AAC/B,MAAA,OAAO,EAAE,IAAA,CAAK,EAAE,KAAA,EAAO,oCAAA,IAAwC,GAAG,CAAA;AAAA,IACpE;AAEA,IAAA,IAAI;AACF,MAAA,MAAM,WAAA,GAAc,MAAM,aAAA,CAAc,MAAA,CAAO,MAAM,OAAA,CAAQ;AAAA,QAC3D,aAAA;AAAA,QACA,IAAA,EAAM,QAAA;AAAA,QACN,aAAA,EAAe,MAAA,CAAO,MAAA,CAAO,IAAA,CAAK,IAAI,CAAA;AAAA,QACtC,WAAA,EAAa,WAAA,CAAY,MAAA,CAAO,IAAA,CAAK,WAAW,CAAA;AAAA,QAChD,WAAA,EAAa,OAAO,IAAA,CAAK,WAAA;AAAA,QACzB,KAAA,EAAO;AAAA,OACR,CAAA;AACD,MAAA,IAAI;AACF,QAAA,MAAM,EAAE,QAAQ,SAAA,EAAU,GAAI,MAAM,aAAA,CAAc,MAAA,CAAO,KAAA,CAAM,YAAA,CAAa,WAAW,CAAA;AACvF,QAAA,MAAM,QAAA,GAA+B,EAAE,MAAA,EAAQ,SAAA,EAAU;AACzD,QAAA,OAAO,CAAA,CAAE,IAAA,CAAK,QAAA,EAAU,GAAG,CAAA;AAAA,MAC7B,SAAS,KAAA,EAAO;AAId,QAAA,MAAM,aAAA,CAAc,OAAO,KAAA,CAAM,gBAAA,CAAiB,aAAa,CAAA,CAAE,KAAA,CAAM,MAAM,KAAA,CAAS,CAAA;AACtF,QAAA,MAAM,QAAA,GAAW,kBAAA,CAAmB,CAAA,EAAG,KAAK,CAAA;AAC5C,QAAA,IAAI,QAAA,KAAa,QAAW,OAAO,QAAA;AACnC,QAAA,MAAM,KAAA;AAAA,MACR;AAAA,IACF,SAAS,KAAA,EAAO;AACd,MAAA,MAAM,QAAA,GAAW,kBAAA,CAAmB,CAAA,EAAG,KAAK,CAAA;AAC5C,MAAA,IAAI,QAAA,KAAa,QAAW,OAAO,QAAA;AACnC,MAAA,MAAM,KAAA;AAAA,IACR;AAAA,EACF,CAAA;AACF;AAEO,SAAS,oBAAoB,IAAA,EAAqB;AACvD,EAAA,OAAO,OAAO,CAAA,KAAkC;AAC9C,IAAA,MAAM,aAAA,GAAgB,MAAM,kBAAA,CAAmB,CAAA,EAAG,IAAI,CAAA;AACtD,IAAA,IAAI,aAAA,KAAkB,QAAW,OAAO,CAAA,CAAE,KAAK,EAAE,KAAA,EAAO,cAAA,EAAe,EAAG,GAAG,CAAA;AAE7E,IAAA,MAAM,aAAA,GAAgB,eAAe,CAAC,CAAA;AACtC,IAAA,IAAI,kBAAkB,MAAA,EAAW;AAC/B,MAAA,OAAO,EAAE,IAAA,CAAK,EAAE,KAAA,EAAO,oCAAA,IAAwC,GAAG,CAAA;AAAA,IACpE;AAEA,IAAA,IAAI;AACF,MAAA,MAAM,cAAc,MAAM,aAAA,CAAc,MAAA,CAAO,KAAA,CAAM,gBAAgB,aAAa,CAAA;AAClF,MAAA,IAAI,gBAAgB,KAAA,CAAA,EAAW;AAC7B,QAAA,OAAO,EAAE,IAAA,CAAK,EAAE,KAAA,EAAO,+BAAA,IAAmC,GAAG,CAAA;AAAA,MAC/D;AACA,MAAA,MAAM,MAAA,GAAS,CAAA,CAAE,GAAA,CAAI,KAAA,CAAM,IAAI,CAAA,IAAK,EAAA;AACpC,MAAA,MAAM,QAAA,GAAW,MAAM,aAAA,CAAc,MAAA,CAAO,KAAA,CAAM,aAAA;AAAA,QAChD,MAAA;AAAA,QACA;AAAA,OACF;AACA,MAAA,IAAI,aAAa,KAAA,CAAA,EAAW;AAC1B,QAAA,MAAM,aAAA,CAAc,MAAA,CAAO,KAAA,CAAM,gBAAA,CAAiB,aAAa,CAAA;AAC/D,QAAA,OAAO,EAAE,IAAA,CAAK,EAAE,KAAA,EAAO,4BAAA,IAAgC,GAAG,CAAA;AAAA,MAC5D;AAEA,MAAA,MAAM,aAAA,CAAc,MAAA,CAAO,KAAA,CAAM,mBAAA,CAAoB;AAAA,QACnD,aAAA;AAAA,QACA,GAAG;AAAA,OACJ,CAAA;AACD,MAAA,OAAO,CAAA,CAAE,IAAA,CAAK,IAAA,EAAM,GAAG,CAAA;AAAA,IACzB,SAAS,KAAA,EAAO;AACd,MAAA,MAAM,QAAA,GAAW,kBAAA,CAAmB,CAAA,EAAG,KAAK,CAAA;AAC5C,MAAA,IAAI,QAAA,KAAa,QAAW,OAAO,QAAA;AACnC,MAAA,MAAM,KAAA;AAAA,IACR;AAAA,EACF,CAAA;AACF;AAEO,SAAS,uBAAuB,IAAA,EAAqB;AAC1D,EAAA,OAAO,OAAO,CAAA,KAAkC;AAC9C,IAAA,MAAM,aAAA,GAAgB,MAAM,kBAAA,CAAmB,CAAA,EAAG,IAAI,CAAA;AACtD,IAAA,IAAI,aAAA,KAAkB,QAAW,OAAO,CAAA,CAAE,KAAK,EAAE,KAAA,EAAO,cAAA,EAAe,EAAG,GAAG,CAAA;AAE7E,IAAA,MAAM,WAAA,GAAc,MAAM,aAAA,CAAc,MAAA,CAAO,KAAA,CAAM,cAAA,CAAe,CAAA,CAAE,GAAA,CAAI,KAAA,CAAM,IAAI,CAAA,IAAK,EAAE,CAAA;AAC3F,IAAA,IAAI,WAAA,KAAgB,QAAW,OAAO,CAAA,CAAE,KAAK,EAAE,KAAA,EAAO,gBAAA,EAAiB,EAAG,GAAG,CAAA;AAE7E,IAAA,MAAM,QAAA,GAAoC,EAAE,WAAA,EAAY;AACxD,IAAA,OAAO,CAAA,CAAE,IAAA,CAAK,QAAA,EAAU,GAAG,CAAA;AAAA,EAC7B,CAAA;AACF;AAEO,SAAS,yBAAyB,IAAA,EAA4B;AACnE,EAAA,OAAO,OAAO,CAAA,KAAkC;AAC9C,IAAA,MAAM,MAAA,GAAS,CAAA,CAAE,GAAA,CAAI,KAAA,CAAM,IAAI,CAAA,IAAK,EAAA;AACpC,IAAA,MAAM,QAAQ,oBAAA,CAAqB,SAAA,CAAU,EAAE,GAAA,EAAK,EAAE,GAAA,CAAI,KAAA,CAAM,KAAK,CAAA,EAAG,KAAK,CAAA,CAAE,GAAA,CAAI,KAAA,CAAM,KAAK,GAAG,CAAA;AACjG,IAAA,IAAI,CAAC,KAAA,CAAM,OAAA,IAAW,CAAE,MAAM,KAAK,YAAA,CAAa,eAAA,CAAgB,MAAA,EAAQ,KAAA,EAAO,MAAM,IAAA,CAAK,GAAA,EAAK,KAAA,CAAM,IAAA,CAAK,GAAG,CAAA,EAAI;AAC/G,MAAA,OAAO,EAAE,IAAA,CAAK,EAAE,KAAA,EAAO,8BAAA,IAAkC,GAAG,CAAA;AAAA,IAC9D;AAEA,IAAA,MAAM,MAAA,GAAS,MAAM,IAAA,CAAK,YAAA,CAAa,YAAA,CAAa,MAAA,EAAQ,IAAI,UAAA,CAAW,MAAM,CAAA,CAAE,GAAA,CAAI,WAAA,EAAa,CAAC,CAAA;AACrG,IAAA,IAAI,CAAC,MAAA,CAAO,EAAA,EAAI,OAAO,CAAA,CAAE,IAAA,CAAK,EAAE,KAAA,EAAO,MAAA,CAAO,MAAA,EAAO,EAAG,GAAG,CAAA;AAC3D,IAAA,OAAO,CAAA,CAAE,IAAA,CAAK,IAAA,EAAM,GAAG,CAAA;AAAA,EACzB,CAAA;AACF;AAEO,SAAS,2BAA2B,IAAA,EAA4B;AACrE,EAAA,OAAO,OAAO,CAAA,KAAkC;AAC9C,IAAA,MAAM,MAAA,GAAS,CAAA,CAAE,GAAA,CAAI,KAAA,CAAM,IAAI,CAAA,IAAK,EAAA;AACpC,IAAA,MAAM,QAAQ,oBAAA,CAAqB,SAAA,CAAU,EAAE,GAAA,EAAK,EAAE,GAAA,CAAI,KAAA,CAAM,KAAK,CAAA,EAAG,KAAK,CAAA,CAAE,GAAA,CAAI,KAAA,CAAM,KAAK,GAAG,CAAA;AACjG,IAAA,IAAI,CAAC,KAAA,CAAM,OAAA,IAAW,CAAE,MAAM,KAAK,YAAA,CAAa,eAAA,CAAgB,MAAA,EAAQ,KAAA,EAAO,MAAM,IAAA,CAAK,GAAA,EAAK,KAAA,CAAM,IAAA,CAAK,GAAG,CAAA,EAAI;AAC/G,MAAA,OAAO,EAAE,IAAA,CAAK,EAAE,KAAA,EAAO,8BAAA,IAAkC,GAAG,CAAA;AAAA,IAC9D;AAEA,IAAA,MAAM,OAAA,GAAU,MAAM,IAAA,CAAK,YAAA,CAAa,YAAY,MAAM,CAAA;AAC1D,IAAA,IAAI,OAAA,KAAY,QAAW,OAAO,CAAA,CAAE,KAAK,EAAE,KAAA,EAAO,gBAAA,EAAiB,EAAG,GAAG,CAAA;AACzE,IAAA,OAAO,CAAA,CAAE,IAAA,CAAK,IAAI,UAAA,CAAW,OAAA,CAAQ,IAAI,CAAA,EAAG,GAAA,EAAK,EAAE,cAAA,EAAgB,OAAA,CAAQ,WAAA,EAAa,CAAA;AAAA,EAC1F,CAAA;AACF;AAEA,SAAS,eAAe,CAAA,EAAgC;AACtD,EAAA,MAAM,KAAA,GAAQ,CAAA,CAAE,GAAA,CAAI,MAAA,CAAO,iBAAiB,CAAA;AAC5C,EAAA,IAAI,KAAA,KAAU,UAAa,KAAA,CAAM,MAAA,KAAW,KAAK,KAAA,CAAM,MAAA,GAAS,KAAK,OAAO,MAAA;AAC5E,EAAA,OAAO,KAAA;AACT;AAEA,SAAS,kBAAA,CAAmB,GAAY,KAAA,EAAsC;AAC5E,EAAA,IAAI,CAAC,WAAA,CAAY,KAAK,CAAA,EAAG,OAAO,MAAA;AAChC,EAAA,IAAK,mBAAA,CAA0C,QAAA,CAAS,KAAA,CAAM,IAAI,CAAA,EAAG;AACnE,IAAA,MAAM,OAAO,KAAA,CAAM,IAAA;AACnB,IAAA,OAAO,CAAA,CAAE,KAAK,EAAE,KAAA,EAAO,MAAK,EAAG,yBAAA,CAA0B,IAAI,CAAC,CAAA;AAAA,EAChE;AACA,EAAA,IAAI,KAAA,CAAM,IAAA,KAAS,+BAAA,IAAmC,KAAA,CAAM,SAAS,kBAAA,EAAoB;AACvF,IAAA,OAAO,EAAE,IAAA,CAAK,EAAE,OAAO,KAAA,CAAM,IAAA,IAAQ,GAAG,CAAA;AAAA,EAC1C;AACA,EAAA,IAAI,KAAA,CAAM,IAAA,KAAS,6BAAA,IAAiC,KAAA,CAAM,SAAS,sBAAA,EAAwB;AACzF,IAAA,OAAO,EAAE,IAAA,CAAK,EAAE,OAAO,KAAA,CAAM,IAAA,IAAQ,GAAG,CAAA;AAAA,EAC1C;AACA,EAAA,IAAI,KAAA,CAAM,SAAS,sBAAA,EAAwB;AACzC,IAAA,OAAO,EAAE,IAAA,CAAK,EAAE,OAAO,KAAA,CAAM,IAAA,IAAQ,GAAG,CAAA;AAAA,EAC1C;AACA,EAAA,OAAO,MAAA;AACT;;;AClMO,SAAS,oBAAoB,IAAA,EAA6B;AAC/D,EAAA,OAAO,OAAO,CAAA,KAAkC,CAAA,CAAE,IAAA,CAAK,IAAA,CAAK,aAAa,GAAG,CAAA;AAC9E;ACYO,SAAS,YAAY,IAAA,EAAqB;AAC/C,EAAA,OAAO,OAAO,CAAA,KAAkC;AAC9C,IAAA,MAAM,SAAS,iBAAA,CAAkB,SAAA,CAAU,MAAM,YAAA,CAAa,CAAC,CAAC,CAAA;AAChE,IAAA,IAAI,CAAC,OAAO,OAAA,EAAS;AACnB,MAAA,OAAO,EAAE,IAAA,CAAK,EAAE,KAAA,EAAO,mEAAA,IAAuE,GAAG,CAAA;AAAA,IACnG;AAEA,IAAA,MAAM,SAAS,MAAM,IAAA,CAAK,IAAA,CAAK,iBAAA,CAAkB,OAAO,IAAI,CAAA;AAC5D,IAAA,IAAI,MAAA,KAAW,QAAW,OAAO,CAAA,CAAE,KAAK,EAAE,KAAA,EAAO,sBAAA,EAAuB,EAAG,GAAG,CAAA;AAE9E,IAAA,MAAM,EAAE,aAAa,SAAA,EAAU,GAAI,MAAM,IAAA,CAAK,IAAA,CAAK,gBAAgB,MAAM,CAAA;AACzE,IAAA,MAAM,WAAyB,EAAE,QAAA,EAAU,OAAO,QAAA,EAAU,WAAA,EAAa,aAAa,SAAA,EAAU;AAChG,IAAA,OAAO,CAAA,CAAE,IAAA,CAAK,QAAA,EAAU,GAAG,CAAA;AAAA,EAC7B,CAAA;AACF;AAEO,SAAS,iBAAiB,IAAA,EAAqB;AACpD,EAAA,OAAO,OAAO,CAAA,KAAkC;AAC9C,IAAA,MAAM,SAAS,sBAAA,CAAuB,SAAA,CAAU,MAAM,YAAA,CAAa,CAAC,CAAC,CAAA;AACrE,IAAA,IAAI,CAAC,MAAA,CAAO,OAAA,EAAS,OAAO,CAAA,CAAE,KAAK,EAAE,KAAA,EAAO,sBAAA,EAAuB,EAAG,GAAG,CAAA;AAKzE,IAAA,MAAM,SAAS,MAAM,IAAA,CAAK,KAAK,aAAA,CAAc,MAAA,CAAO,KAAK,QAAQ,CAAA;AACjE,IAAA,IAAI,MAAA,KAAW,QAAW,OAAO,CAAA,CAAE,KAAK,EAAE,KAAA,EAAO,2BAAA,EAA4B,EAAG,GAAG,CAAA;AAEnF,IAAA,MAAM,QAAA,GAA8B,EAAE,KAAA,EAAO,MAAM,KAAK,IAAA,CAAK,UAAA,CAAW,MAAM,CAAA,EAAE;AAChF,IAAA,OAAO,CAAA,CAAE,IAAA,CAAK,QAAA,EAAU,GAAG,CAAA;AAAA,EAC7B,CAAA;AACF;AAEO,SAAS,aAAa,IAAA,EAAqB;AAChD,EAAA,OAAO,OAAO,CAAA,KAAkC;AAC9C,IAAA,MAAM,SAAS,kBAAA,CAAmB,SAAA,CAAU,MAAM,YAAA,CAAa,CAAC,CAAC,CAAA;AACjE,IAAA,IAAI,CAAC,MAAA,CAAO,OAAA,EAAS,OAAO,CAAA,CAAE,KAAK,EAAE,KAAA,EAAO,6CAAA,EAA8C,EAAG,GAAG,CAAA;AAChG,IAAA,MAAM,EAAE,QAAA,EAAU,KAAA,EAAO,SAAA,KAAc,MAAA,CAAO,IAAA;AAE9C,IAAA,MAAM,MAAA,GAAS,MAAM,IAAA,CAAK,IAAA,CAAK,cAAc,QAAQ,CAAA;AACrD,IAAA,IAAI,MAAA,KAAW,QAAW,OAAO,CAAA,CAAE,KAAK,EAAE,KAAA,EAAO,2BAAA,EAA4B,EAAG,GAAG,CAAA;AAEnF,IAAA,IAAI,CAAE,MAAM,IAAA,CAAK,KAAK,aAAA,CAAc,MAAA,EAAQ,KAAK,CAAA,EAAI;AACnD,MAAA,OAAO,EAAE,IAAA,CAAK,EAAE,KAAA,EAAO,yCAAA,IAA6C,GAAG,CAAA;AAAA,IACzE;AAGA,IAAA,IAAI,CAAE,MAAM,IAAA,CAAK,IAAA,CAAK,gBAAgB,MAAA,EAAQ,KAAA,EAAO,SAAS,CAAA,EAAI;AAChE,MAAA,OAAO,EAAE,IAAA,CAAK,EAAE,KAAA,EAAO,mBAAA,IAAuB,GAAG,CAAA;AAAA,IACnD;AAGA,IAAA,MAAM,IAAA,CAAK,IAAA,CAAK,YAAA,CAAa,MAAA,EAAQ,KAAK,CAAA;AAE1C,IAAA,MAAM,EAAE,aAAa,SAAA,EAAU,GAAI,MAAM,IAAA,CAAK,IAAA,CAAK,gBAAgB,MAAM,CAAA;AACzE,IAAA,MAAM,QAAA,GAA0B,EAAE,WAAA,EAAa,SAAA,EAAU;AACzD,IAAA,OAAO,CAAA,CAAE,IAAA,CAAK,QAAA,EAAU,GAAG,CAAA;AAAA,EAC7B,CAAA;AACF;AC3DA,IAAM,2BAAA,GAA8B,CAAC,iBAAiB,CAAA;AAWtD,SAAS,MAAM,EAAA,EAA2B;AACxC,EAAA,OAAO,IAAI,OAAA,CAAQ,CAAC,YAAY,UAAA,CAAW,OAAA,EAAS,EAAE,CAAC,CAAA;AACzD;AAEO,SAAS,cAAc,IAAA,EAAuB;AACnD,EAAA,OAAO,OAAO,CAAA,KAAkC;AAC9C,IAAA,MAAM,aAAA,GAAgB,MAAM,kBAAA,CAAmB,CAAA,EAAG,IAAI,CAAA;AACtD,IAAA,IAAI,aAAA,KAAkB,QAAW,OAAO,CAAA,CAAE,KAAK,EAAE,KAAA,EAAO,cAAA,EAAe,EAAG,GAAG,CAAA;AAC7E,IAAA,MAAM,EAAE,MAAA,EAAQ,MAAA,EAAO,GAAI,aAAA;AAE3B,IAAA,MAAM,SAAA,GAAY,CAAA,CAAE,GAAA,CAAI,KAAA,CAAM,QAAQ,CAAA;AACtC,IAAA,IAAI,MAAA,GAAS,CAAA;AACb,IAAA,IAAI,cAAc,MAAA,EAAW;AAC3B,MAAA,MAAM,YAAA,GAAe,OAAO,SAAS,CAAA;AACrC,MAAA,IAAI,CAAC,MAAA,CAAO,SAAA,CAAU,YAAY,KAAK,YAAA,GAAe,CAAA,EAAG,OAAO,CAAA,CAAE,IAAA,CAAK,EAAE,KAAA,EAAO,gBAAA,IAAoB,GAAG,CAAA;AACvG,MAAA,MAAA,GAAS,YAAA;AAAA,IACX;AAEA,IAAA,MAAM,QAAQ,MAAM,MAAA,CAAO,OAAA,CAAQ,UAAA,CAAW,OAAO,QAAQ,CAAA;AAC7D,IAAA,IAAI,MAAA,GAAS,MAAM,QAAA,EAAU;AAC3B,MAAA,MAAM,MAAA,CAAO,QAAQ,aAAA,CAAc,EAAE,UAAU,MAAA,CAAO,QAAA,EAAU,QAAA,EAAU,MAAA,EAAQ,CAAA;AAAA,IACpF;AAEA,IAAA,MAAM,QAAA,GAAW,IAAA,CAAK,GAAA,CAAI,CAAA,EAAG,IAAA,CAAK,KAAK,IAAA,CAAK,cAAA,GAAiB,IAAA,CAAK,kBAAkB,CAAC,CAAA;AACrF,IAAA,KAAA,IAAS,OAAA,GAAU,CAAA,EAAG,OAAA,GAAU,QAAA,EAAU,WAAW,CAAA,EAAG;AACtD,MAAA,MAAM,IAAA,GAAO,MAAM,MAAA,CAAO,OAAA,CAAQ,SAAA,CAAU;AAAA,QAC1C,UAAU,MAAA,CAAO,QAAA;AAAA,QACjB,QAAA,EAAU,MAAA;AAAA,QACV,OAAO,IAAA,CAAK;AAAA,OACb,CAAA;AACD,MAAA,IAAI,IAAA,CAAK,QAAA,CAAS,MAAA,GAAS,CAAA,EAAG;AAC5B,QAAA,MAAM,MAAA,GAAqB,KAAK,QAAA,CAAS,GAAA,CAAI,CAAC,OAAA,KAAY,cAAA,CAAe,OAAA,CAAQ,IAAI,CAAC,CAAA;AACtF,QAAA,MAAMC,SAAAA,GAA+B;AAAA,UACnC,MAAA;AAAA,UACA,QAAQ,IAAA,CAAK,OAAA;AAAA,UACb,YAAA,EAAc;AAAA,SAChB;AACA,QAAA,OAAO,CAAA,CAAE,IAAA,CAAKA,SAAAA,EAAU,GAAG,CAAA;AAAA,MAC7B;AACA,MAAA,IAAI,UAAU,QAAA,GAAW,CAAA,EAAG,MAAM,KAAA,CAAM,KAAK,kBAAkB,CAAA;AAAA,IACjE;AAEA,IAAA,MAAM,QAAA,GAA+B;AAAA,MACnC,QAAQ,EAAC;AAAA,MACT,MAAA;AAAA,MACA,YAAA,EAAc;AAAA,KAChB;AACA,IAAA,OAAO,CAAA,CAAE,IAAA,CAAK,QAAA,EAAU,GAAG,CAAA;AAAA,EAC7B,CAAA;AACF;ACnFO,IAAM,kCAAA,GAAqC;AAC3C,IAAM,gCAAA,GAAmC,KAAK,EAAA,GAAK;AACnD,IAAM,6BAA6B,EAAA,GAAK;AAE/C,IAAM,gBAAA,GAAmBD,EAAE,MAAA,EAAO,CAAE,IAAI,GAAG,CAAA,CAAE,KAAA,CAAM,IAAA,EAAM,yBAAyB,CAAA;AAClF,IAAM,YAAA,GAAeA,EAAE,MAAA,EAAO,CAAE,IAAI,CAAC,CAAA,CAAE,IAAI,GAAG,CAAA;AAEvC,IAAM,2BAAA,GAA8BA,CAAAA,CAAE,kBAAA,CAAmB,MAAA,EAAQ;AAAA,EACtEA,EAAE,MAAA,CAAO;AAAA,IACP,IAAA,EAAMA,CAAAA,CAAE,OAAA,CAAQ,oBAAoB,CAAA;AAAA,IACpC,OAAA,EAASA,EAAE,MAAA,EAAO;AAAA,IAClB,UAAA,EAAY,iBAAiB,QAAA;AAAS,GACvC,CAAA;AAAA,EACDA,EAAE,MAAA,CAAO;AAAA,IACP,IAAA,EAAMA,CAAAA,CAAE,OAAA,CAAQ,mBAAmB,CAAA;AAAA,IACnC,UAAA,EAAY,gBAAA;AAAA,IACZ,UAAUA,CAAAA,CAAE,IAAA,CAAK,CAAC,SAAA,EAAW,QAAQ,CAAC,CAAA;AAAA,IACtC,UAAA,EAAYA,CAAAA,CAAE,IAAA,CAAK,CAAC,OAAO,CAAC,CAAA;AAAA,IAC5B,IAAIA,CAAAA,CAAE,GAAA,CAAI,SAAS,EAAE,MAAA,EAAQ,MAAM;AAAA,GACpC;AACH,CAAC;AAIM,IAAM,yBAAA,GAA4BA,EAAE,MAAA,CAAO;AAAA,EAChD,MAAA,EAAQ,YAAA;AAAA,EACR,gBAAA,EAAkB,gBAAA;AAAA,EAClB,UAAUA,CAAAA,CAAE,MAAA,EAAO,CAAE,GAAA,GAAM,QAAA,EAAS;AAAA,EACpC,UAAA,EAAYA,CAAAA,CAAE,GAAA,CAAI,QAAA,EAAS;AAAA,EAC3B,KAAA,EAAO;AACT,CAAC;AAiCM,SAAS,+BACd,KAAA,EACiC;AACjC,EAAA,MAAM,QAAA,GAAW,MAAM,QAAA,IAAY,kCAAA;AACnC,EAAA,MAAM,KAAA,GAAQ,MAAM,KAAA,IAAS,gCAAA;AAC7B,EAAA,IAAI,CAAC,MAAA,CAAO,aAAA,CAAc,QAAQ,CAAA,IAAK,YAAY,CAAA,EAAG;AACpD,IAAA,MAAM,IAAI,cAAA;AAAA,MACR,4BAAA;AAAA,MACA,CAAA,gEAAA,EAAmE,MAAA,CAAO,QAAQ,CAAC,CAAA,CAAA;AAAA,KACrF;AAAA,EACF;AACA,EAAA,IAAI,CAAC,MAAA,CAAO,QAAA,CAAS,KAAK,CAAA,IAAK,SAAS,CAAA,EAAG;AACzC,IAAA,MAAM,IAAI,cAAA;AAAA,MACR,4BAAA;AAAA,MACA,CAAA,0EAAA,EAA6E,MAAA,CAAO,KAAK,CAAC,CAAA,CAAA;AAAA,KAC5F;AAAA,EACF;AACA,EAAA,MAAM,MAAA,GAASA,EACZ,MAAA,CAAO;AAAA,IACN,MAAA,EAAQ,YAAA;AAAA,IACR,gBAAA,EAAkB,gBAAA;AAAA,IAClB,KAAA,EAAO;AAAA,GACR,CAAA,CACA,SAAA,CAAU,KAAK,CAAA;AAClB,EAAA,IAAI,CAAC,OAAO,OAAA,EAAS;AACnB,IAAA,MAAM,IAAI,cAAA;AAAA,MACR,4BAAA;AAAA,MACA;AAAA,KACF;AAAA,EACF;AACA,EAAA,IACE,MAAA,CAAO,IAAA,CAAK,KAAA,CAAM,IAAA,KAAS,wBAC3B,IAAI,WAAA,EAAY,CAAE,MAAA,CAAO,OAAO,IAAA,CAAK,KAAA,CAAM,OAAO,CAAA,CAAE,aAAa,0BAAA,EACjE;AACA,IAAA,MAAM,IAAI,cAAA;AAAA,MACR,4BAAA;AAAA,MACA,4BAA4B,0BAA0B,CAAA,aAAA;AAAA,KACxD;AAAA,EACF;AACA,EAAA,OAAO,EAAE,QAAA,EAAU,KAAA,EAAO,KAAA,EAAO,MAAA,CAAO,KAAK,KAAA,EAAM;AACrD;AAEO,SAAS,mBAAA,CAAoB,QAAkB,MAAA,EAAwB;AAC5E,EAAA,OAAOE,SAAAA,CAAU,QAAQ,MAAM,CAAA;AACjC;AAEO,SAAS,0BAA0B,KAAA,EAAgD;AACxF,EAAA,OAAOF,CAAAA,CAAE,KAAA,CAAM,yBAAyB,CAAA,CAAE,MAAM,KAAK,CAAA;AACvD;AAEO,SAAS,uBACd,OAAA,EACoB;AACpB,EAAA,OAAO,OAAA,CAAQ,EAAA,CAAG,EAAE,CAAA,EAAG,QAAA;AACzB;AC/GA,eAAsB,uBAAA,CAAwB,OAAyB,MAAA,EAA+B;AACpG,EAAA,MAAM,IAAA,GAAO,MAAM,KAAA,CAAM,GAAA,CAAI,MAAM,CAAA;AACnC,EAAA,IAAI,IAAA,KAAS,MAAA,IAAa,IAAA,CAAK,MAAA,KAAW,aAAA,EAAe;AACzD,EAAA,IAAI;AACF,IAAA,MAAM,MAAM,YAAA,CAAa;AAAA,MACvB,MAAA,EAAQ,MAAA;AAAA,MACR,cAAA,EAAgB,aAAA;AAAA,MAChB,MAAA,EAAQ;AAAA,KACT,CAAA;AAAA,EACH,SAAS,MAAA,EAAQ;AACf,IAAA,IAAI,mBAAA,CAAoB,MAAM,CAAA,EAAG;AACjC,IAAA,MAAM,MAAA;AAAA,EACR;AACF;;;AC4BO,SAAS,mBAAmB,MAAA,EAAwB;AACzD,EAAA,OAAO,QAAQ,MAAM,CAAA,SAAA,CAAA;AACvB;AAEA,eAAsB,qBAAA,CACpB,MAAA,EACA,QAAA,EACA,QAAA,EACA,iBAAiC,uBAAA,EACR;AACzB,EAAA,IAAI,CAAE,MAAM,MAAA,CAAO,YAAY,OAAA,CAAQ,QAAQ,GAAI,OAAO,cAAA;AAE1D,EAAA,IAAI,CAAE,sBAAA,CAAkD,QAAA,CAAS,QAAA,CAAS,IAAI,GAAG,OAAO,UAAA;AAExF,EAAA,MAAM,SAAS,QAAA,CAAS,OAAA;AAGxB,EAAA,IAAI,MAAA,KAAW,QAAW,OAAO,UAAA;AAEjC,EAAA,MAAM,OAAA,GAAU,MAAM,MAAA,CAAO,KAAA,CAAM,IAAI,MAAM,CAAA;AAC7C,EAAA,IAAI,SAAS,aAAA,KAAkB,MAAA,IAAa,OAAA,CAAQ,aAAA,KAAkB,UAAU,OAAO,UAAA;AAEvF,EAAA,IAAI,SAAS,IAAA,KAAS,eAAA,IAAmB,SAAS,OAAA,CAAQ,MAAA,CAAO,SAAS,CAAA,EAAG;AAC3E,IAAA,IAAI;AACF,MAAA,qBAAA;AAAA,QACE;AAAA,UACE,MAAA;AAAA,UACA,kBAAkB,QAAA,CAAS,EAAA;AAAA,UAC3B,QAAA,EAAU,SAAS,OAAA,CAAQ,GAAA;AAAA,UAC3B,MAAA,EAAQ,SAAS,OAAA,CAAQ,MAAA;AAAA,UACzB,OAAA,EAAS;AAAA,SACX;AAAA,QACA;AAAA,OACF;AAAA,IACF,SAAS,MAAA,EAAQ;AACf,MAAA,IACE,aAAa,MAAA,EAAQ,0BAA0B,KAC/C,YAAA,CAAa,MAAA,EAAQ,4BAA4B,CAAA,EACjD;AACA,QAAA,OAAO,UAAA;AAAA,MACT;AACA,MAAA,MAAM,MAAA;AAAA,IACR;AAAA,EACF;AAEA,EAAA,MAAM,aAAA,GAAgB,2BAAA,CAA4B,MAAA,EAAQ,QAAQ,CAAA;AAClE,EAAA,IAAI,kBAAkB,MAAA,EAAW;AAC/B,IAAA,IAAI;AACF,MAAA,8BAAA,CAA+B,aAAa,CAAA;AAAA,IAC9C,SAAS,MAAA,EAAQ;AACf,MAAA,IAAI,YAAA,CAAa,MAAA,EAAQ,4BAA4B,CAAA,EAAG,OAAO,UAAA;AAC/D,MAAA,MAAM,MAAA;AAAA,IACR;AAAA,EACF;AAEA,EAAA,IAAI,MAAM,OAAO,KAAA,CAAM,cAAA,CAAe,UAAU,QAAA,CAAS,EAAE,GAAG,OAAO,WAAA;AAErE,EAAA,MAAM,cAAA,CAAe,MAAA,EAAQ,QAAA,EAAU,MAAA,EAAQ,UAAU,cAAc,CAAA;AACvE,EAAA,OAAO,UAAA;AACT;AASA,eAAe,cAAA,CACb,MAAA,EACA,QAAA,EACA,MAAA,EACA,UACA,cAAA,EACe;AACf,EAAA,QAAQ,SAAS,IAAA;AAAM,IACrB,KAAK,YAAA;AACH,MAAA,MAAM,OAAO,KAAA,CAAM,KAAA,CAAM,EAAE,MAAA,EAAQ,UAAU,CAAA;AAC7C,MAAA;AAAA,IACF,KAAK,cAAA;AACH,MAAA,MAAM,OAAO,KAAA,CAAM,YAAA,CAAa,EAAE,MAAA,EAAQ,MAAA,EAAQ,WAAW,CAAA;AAC7D,MAAA;AAAA,IACF,KAAK,cAAA;AACH,MAAA,MAAM,OAAO,KAAA,CAAM,YAAA,CAAa,EAAE,MAAA,EAAQ,MAAA,EAAQ,UAAU,CAAA;AAC5D,MAAA;AAAA,IACF,KAAK,eAAA;AACH,MAAA,IAAI,QAAA,CAAS,OAAA,CAAQ,MAAA,CAAO,MAAA,GAAS,CAAA,EAAG;AACtC,QAAA,MAAM,oBAAA;AAAA,UACJ,MAAA,CAAO,QAAA;AAAA,UACP;AAAA,YACE,MAAA;AAAA,YACA,kBAAkB,QAAA,CAAS,EAAA;AAAA,YAC3B,QAAA,EAAU,SAAS,OAAA,CAAQ,GAAA;AAAA,YAC3B,MAAA,EAAQ,SAAS,OAAA,CAAQ,MAAA;AAAA,YACzB,OAAA,EAAS;AAAA,WACX;AAAA,UACA;AAAA,SACF;AAAA,MACF;AACA,MAAA;AAAA,IACF,KAAK,qBAAA;AACH,MAAA,MAAM,OAAO,SAAA,CAAU,MAAA,CAAO,2BAAA,CAA4B,MAAA,EAAQ,QAAQ,CAAE,CAAA;AAC5E,MAAA;AAAA,IACF,KAAK,wBAAA;AACH,MAAA,MAAM,OAAO,SAAA,CAAU,MAAA,CAAO,2BAAA,CAA4B,MAAA,EAAQ,QAAQ,CAAE,CAAA;AAC5E,MAAA;AAAA,IACF,KAAK,eAAA;AACH,MAAA,MAAM,cAAA,CAAe,MAAA,EAAQ,MAAA,EAAQ,QAAA,EAAU,UAAU,CAAA;AACzD,MAAA;AAAA,IACF,KAAK,WAAA;AACH,MAAA,MAAM,cAAA,CAAe,MAAA,EAAQ,MAAA,EAAQ,QAAA,EAAU,QAAQ,CAAA;AACvD,MAAA;AAAA,IACF,KAAK,gBAAA;AACH,MAAA,MAAM,cAAA,CAAe,MAAA,EAAQ,MAAA,EAAQ,QAAA,EAAU,WAAW,CAAA;AAC1D,MAAA;AAAA,IACF;AACE,MAAA;AAAA;AAEN;AAEA,SAAS,2BAAA,CACP,QACA,QAAA,EACyC;AACzC,EAAA,QAAQ,SAAS,IAAA;AAAM,IACrB,KAAK,qBAAA;AACH,MAAA,OAAO;AAAA,QACL,MAAA;AAAA,QACA,kBAAkB,QAAA,CAAS,EAAA;AAAA,QAC3B,KAAA,EAAO;AAAA,UACL,IAAA,EAAM,oBAAA;AAAA,UACN,OAAA,EAAS,SAAS,OAAA,CAAQ,OAAA;AAAA,UAC1B,GAAI,QAAA,CAAS,OAAA,CAAQ,UAAA,KAAe,MAAA,GAChC,EAAC,GACD,EAAE,UAAA,EAAY,QAAA,CAAS,OAAA,CAAQ,UAAA;AAAW;AAChD,OACF;AAAA,IACF,KAAK,wBAAA;AACH,MAAA,OAAO;AAAA,QACL,MAAA;AAAA,QACA,kBAAkB,QAAA,CAAS,EAAA;AAAA,QAC3B,KAAA,EAAO;AAAA,UACL,IAAA,EAAM,mBAAA;AAAA,UACN,UAAA,EAAY,SAAS,OAAA,CAAQ,UAAA;AAAA,UAC7B,QAAA,EAAU,SAAS,OAAA,CAAQ,QAAA;AAAA,UAC3B,UAAA,EAAY,SAAS,OAAA,CAAQ,UAAA;AAAA,UAC7B,EAAA,EAAI,SAAS,OAAA,CAAQ;AAAA;AACvB,OACF;AAAA,IACF;AACE,MAAA,OAAO,MAAA;AAAA;AAEb;AAgBA,eAAe,cAAA,CACb,MAAA,EACA,MAAA,EACA,QAAA,EACA,MAAA,EACe;AACf,EAAA,MAAM,EAAE,OAAA,EAAQ,GAAI,MAAM,MAAA,CAAO,SAAS,MAAA,CAAO;AAAA,IAC/C,GAAA,EAAK,mBAAmB,MAAM,CAAA;AAAA,IAC9B,IAAA,EAAM,eAAe,QAAQ;AAAA,GAC9B,CAAA;AACD,EAAA,IAAI,CAAC,OAAA,EAAS;AACd,EAAA,MAAM,OAAO,KAAA,CAAM,YAAA,CAAa,EAAE,MAAA,EAAQ,QAAQ,CAAA;AAClD,EAAA,MAAM,uBAAA,CAAwB,MAAA,CAAO,KAAA,EAAO,MAAM,CAAA;AACpD;;;ACzMO,SAAS,gBAAgB,IAAA,EAAyB;AACvD,EAAA,OAAO,OAAO,CAAA,KAAkC;AAC9C,IAAA,MAAM,aAAA,GAAgB,MAAM,kBAAA,CAAmB,CAAA,EAAG,IAAI,CAAA;AACtD,IAAA,IAAI,aAAA,KAAkB,QAAW,OAAO,CAAA,CAAE,KAAK,EAAE,KAAA,EAAO,cAAA,EAAe,EAAG,GAAG,CAAA;AAC7E,IAAA,MAAM,EAAE,MAAA,EAAQ,MAAA,EAAO,GAAI,aAAA;AAE3B,IAAA,MAAM,SAAS,yBAAA,CAA0B,SAAA,CAAU,MAAM,YAAA,CAAa,CAAC,CAAC,CAAA;AACxE,IAAA,IAAI,CAAC,MAAA,CAAO,OAAA,EAAS,OAAO,CAAA,CAAE,KAAK,EAAE,KAAA,EAAO,wCAAA,EAAyC,EAAG,GAAG,CAAA;AAE3F,IAAA,IAAI,QAAA,GAAW,CAAA;AACf,IAAA,IAAI,QAAA,GAAW,CAAA;AACf,IAAA,KAAA,MAAW,QAAA,IAAY,MAAA,CAAO,IAAA,CAAK,QAAA,EAAU;AAC3C,MAAA,MAAM,UAAU,MAAM,qBAAA;AAAA,QACpB,MAAA;AAAA,QACA,MAAA,CAAO,QAAA;AAAA,QACP,QAAA;AAAA,QACA,IAAA,CAAK;AAAA,OACP;AACA,MAAA,IAAI,OAAA,KAAY,gBAAgB,OAAO,CAAA,CAAE,KAAK,EAAE,KAAA,EAAO,qBAAA,EAAsB,EAAG,GAAG,CAAA;AAInF,MAAA,IAAI,OAAA,KAAY,YAAY,QAAA,IAAY,CAAA;AAAA,WACnC,QAAA,IAAY,CAAA;AAAA,IACnB;AAIA,IAAA,MAAM,QAAA,GAAiC,WAAW,CAAA,GAAI,EAAE,UAAU,QAAA,EAAS,GAAI,EAAE,QAAA,EAAS;AAC1F,IAAA,OAAO,CAAA,CAAE,IAAA,CAAK,QAAA,EAAU,GAAG,CAAA;AAAA,EAC7B,CAAA;AACF;AClDO,IAAM,wBAAA,GAA2B;AACjC,IAAM,sCAAA,GAAyC;AAC/C,IAAM,0CAAA,GAA6C;AACnD,IAAM,+CAAA,GAAkD;AAY/D,IAAM,eAAA,GAAkBA,CAAAA,CAAE,MAAA,CAAO,EAAE,cAAA,EAAgBA,CAAAA,CAAE,IAAA,CAAK,cAAc,CAAA,CAAE,QAAA,EAAS,EAAG,CAAA;AACtF,IAAM,gBAAA,GAAmBA,EAAE,MAAA,CAAO;AAAA,EAChC,cAAA,EAAgBA,CAAAA,CAAE,IAAA,CAAK,cAAc,CAAA;AAAA,EACrC,MAAA,EAAQA,CAAAA,CAAE,IAAA,CAAK,cAAc;AAC/B,CAAC,CAAA;AAED,SAAS,wBAAwB,KAAA,EAA+C;AAC9E,EAAA,IAAI,KAAA,KAAU,QAAW,OAAO,CAAA;AAChC,EAAA,MAAM,MAAA,GAAS,OAAO,KAAK,CAAA;AAC3B,EAAA,OAAO,OAAO,aAAA,CAAc,MAAM,CAAA,IAAK,MAAA,IAAU,IAAI,MAAA,GAAS,MAAA;AAChE;AAEA,SAAS,oBAAA,CAAqB,OAA2B,QAAA,EAAsC;AAC7F,EAAA,IAAI,KAAA,KAAU,QAAW,OAAO,QAAA;AAChC,EAAA,MAAM,MAAA,GAAS,OAAO,KAAK,CAAA;AAC3B,EAAA,OAAO,OAAO,aAAA,CAAc,MAAM,CAAA,IAAK,MAAA,GAAS,IAAI,MAAA,GAAS,MAAA;AAC/D;AAEA,SAAS,UAAA,CAAW,GAAY,SAAA,EAA+C;AAC7E,EAAA,MAAM,WAAW,uBAAA,CAAwB,CAAA,CAAE,GAAA,CAAI,KAAA,CAAM,OAAO,CAAC,CAAA;AAC7D,EAAA,MAAM,QAAQ,oBAAA,CAAqB,CAAA,CAAE,IAAI,KAAA,CAAM,OAAO,GAAG,SAAS,CAAA;AAClE,EAAA,MAAM,SAAA,GAAY,CAAA,CAAE,GAAA,CAAI,KAAA,CAAM,QAAQ,CAAA;AACtC,EAAA,IAAI,aAAa,MAAA,IAAa,KAAA,KAAU,MAAA,IAAa,KAAA,GAAQ,WAAW,OAAO,MAAA;AAC/E,EAAA,IAAI,cAAc,MAAA,IAAa,CAAC,cAAA,CAAe,QAAA,CAAS,SAA4C,CAAA,EAAG;AACrG,IAAA,OAAO,MAAA;AAAA,EACT;AACA,EAAA,OAAO;AAAA,IACL,QAAA;AAAA,IACA,KAAA;AAAA,IACA,GAAI,CAAA,CAAE,GAAA,CAAI,KAAA,CAAM,SAAS,CAAA,KAAM,MAAA,GAAY,EAAC,GAAI,EAAE,OAAA,EAAS,CAAA,CAAE,GAAA,CAAI,KAAA,CAAM,SAAS,CAAA,EAAE;AAAA,IAClF,GAAI,SAAA,KAAc,MAAA,GAAY,EAAC,GAAI,EAAE,QAAQ,SAAA;AAA6C,GAC5F;AACF;AAEO,SAAS,iBAAiB,IAAA,EAAsB;AACrD,EAAA,OAAO,OAAO,CAAA,KAAkC;AAC9C,IAAA,MAAM,aAAA,GAAgB,MAAM,kBAAA,CAAmB,CAAA,EAAG,IAAI,CAAA;AACtD,IAAA,IAAI,aAAA,KAAkB,QAAW,OAAO,CAAA,CAAE,KAAK,EAAE,KAAA,EAAO,cAAA,EAAe,EAAG,GAAG,CAAA;AAC7E,IAAA,MAAM,KAAA,GAAQ,UAAA,CAAW,CAAA,EAAG,IAAA,CAAK,SAAS,CAAA;AAC1C,IAAA,IAAI,KAAA,KAAU,QAAW,OAAO,CAAA,CAAE,KAAK,EAAE,KAAA,EAAO,qBAAA,EAAsB,EAAG,GAAG,CAAA;AAC5E,IAAA,OAAO,CAAA,CAAE,KAAK,MAAM,aAAA,CAAc,OAAO,KAAA,CAAM,IAAA,CAAK,KAAK,CAAA,EAAG,GAAG,CAAA;AAAA,EACjE,CAAA;AACF;AAEO,SAAS,kBAAkB,IAAA,EAAuB;AACvD,EAAA,OAAO,OAAO,CAAA,KAAkC;AAC9C,IAAA,MAAM,aAAA,GAAgB,MAAM,kBAAA,CAAmB,CAAA,EAAG,IAAI,CAAA;AACtD,IAAA,IAAI,aAAA,KAAkB,QAAW,OAAO,CAAA,CAAE,KAAK,EAAE,KAAA,EAAO,cAAA,EAAe,EAAG,GAAG,CAAA;AAC7E,IAAA,MAAM,SAAS,eAAA,CAAgB,SAAA,CAAU,MAAM,YAAA,CAAa,CAAC,CAAC,CAAA;AAC9D,IAAA,IAAI,CAAC,MAAA,CAAO,OAAA,EAAS,OAAO,CAAA,CAAE,KAAK,EAAE,KAAA,EAAO,oBAAA,EAAqB,EAAG,GAAG,CAAA;AACvE,IAAA,MAAM,MAAA,GAAS,CAAA,CAAE,GAAA,CAAI,KAAA,CAAM,IAAI,CAAA;AAC/B,IAAA,IAAI,MAAA,KAAW,MAAA,IAAa,MAAA,CAAO,MAAA,KAAW,CAAA,EAAG,OAAO,CAAA,CAAE,IAAA,CAAK,EAAE,KAAA,EAAO,uBAAA,EAAwB,EAAG,GAAG,CAAA;AACtG,IAAA,IAAI;AACF,MAAA,MAAM,IAAA,GAAO,MAAM,aAAA,CAAc,MAAA,CAAO,MAAM,KAAA,CAAM;AAAA,QAClD,MAAA;AAAA,QACA,QAAA,EAAU,cAAc,MAAA,CAAO,QAAA;AAAA,QAC/B,GAAI,MAAA,CAAO,IAAA,CAAK,cAAA,KAAmB,KAAA,CAAA,GAC/B,EAAC,GACD,EAAE,cAAA,EAAgB,MAAA,CAAO,IAAA,CAAK,cAAA;AAAe,OAClD,CAAA;AACD,MAAA,OAAO,CAAA,CAAE,IAAA,CAAK,IAAA,EAAM,GAAG,CAAA;AAAA,IACzB,SAAS,MAAA,EAAQ;AACf,MAAA,OAAO,YAAA,CAAa,GAAG,MAAM,CAAA;AAAA,IAC/B;AAAA,EACF,CAAA;AACF;AAEO,SAAS,oBAAoB,IAAA,EAAuB;AACzD,EAAA,OAAO,OAAO,CAAA,KAAkC;AAC9C,IAAA,MAAM,aAAA,GAAgB,MAAM,kBAAA,CAAmB,CAAA,EAAG,IAAI,CAAA;AACtD,IAAA,IAAI,aAAA,KAAkB,QAAW,OAAO,CAAA,CAAE,KAAK,EAAE,KAAA,EAAO,cAAA,EAAe,EAAG,GAAG,CAAA;AAC7E,IAAA,MAAM,MAAA,GAAS,CAAA,CAAE,GAAA,CAAI,KAAA,CAAM,IAAI,CAAA;AAC/B,IAAA,IAAI,MAAA,KAAW,MAAA,IAAa,MAAA,CAAO,MAAA,KAAW,CAAA,EAAG,OAAO,CAAA,CAAE,IAAA,CAAK,EAAE,KAAA,EAAO,uBAAA,EAAwB,EAAG,GAAG,CAAA;AACtG,IAAA,IAAI;AACF,MAAA,OAAO,CAAA,CAAE,IAAA;AAAA,QACP,MAAM,aAAA,CAAc,MAAA,CAAO,KAAA,CAAM,OAAA,CAAQ;AAAA,UACvC,MAAA;AAAA,UACA,QAAA,EAAU,cAAc,MAAA,CAAO;AAAA,SAChC,CAAA;AAAA,QACD;AAAA,OACF;AAAA,IACF,SAAS,MAAA,EAAQ;AACf,MAAA,OAAO,YAAA,CAAa,GAAG,MAAM,CAAA;AAAA,IAC/B;AAAA,EACF,CAAA;AACF;AAEO,SAAS,mBAAmB,IAAA,EAAuB;AACxD,EAAA,OAAO,OAAO,CAAA,KAAkC;AAC9C,IAAA,MAAM,aAAA,GAAgB,MAAM,kBAAA,CAAmB,CAAA,EAAG,IAAI,CAAA;AACtD,IAAA,IAAI,aAAA,KAAkB,QAAW,OAAO,CAAA,CAAE,KAAK,EAAE,KAAA,EAAO,cAAA,EAAe,EAAG,GAAG,CAAA;AAC7E,IAAA,MAAM,SAAS,gBAAA,CAAiB,SAAA,CAAU,MAAM,YAAA,CAAa,CAAC,CAAC,CAAA;AAC/D,IAAA,IAAI,CAAC,MAAA,CAAO,OAAA,EAAS,OAAO,CAAA,CAAE,KAAK,EAAE,KAAA,EAAO,qBAAA,EAAsB,EAAG,GAAG,CAAA;AACxE,IAAA,MAAM,MAAA,GAAS,CAAA,CAAE,GAAA,CAAI,KAAA,CAAM,IAAI,CAAA;AAC/B,IAAA,IAAI,MAAA,KAAW,MAAA,IAAa,MAAA,CAAO,MAAA,KAAW,CAAA,EAAG,OAAO,CAAA,CAAE,IAAA,CAAK,EAAE,KAAA,EAAO,uBAAA,EAAwB,EAAG,GAAG,CAAA;AACtG,IAAA,IAAI,MAAA,CAAO,IAAA,CAAK,MAAA,KAAW,MAAA,EAAQ;AACjC,MAAA,OAAO,EAAE,IAAA,CAAK,EAAE,KAAA,EAAO,sCAAA,IAA0C,GAAG,CAAA;AAAA,IACtE;AACA,IAAA,IAAI;AACF,MAAA,OAAO,CAAA,CAAE,IAAA;AAAA,QACP,MAAM,aAAA,CAAc,MAAA,CAAO,KAAA,CAAM,YAAA,CAAa;AAAA,UAC5C,MAAA;AAAA,UACA,cAAA,EAAgB,OAAO,IAAA,CAAK,cAAA;AAAA,UAC5B,MAAA,EAAQ,OAAO,IAAA,CAAK,MAAA;AAAA,UACpB,QAAA,EAAU,cAAc,MAAA,CAAO;AAAA,SAChC,CAAA;AAAA,QACD;AAAA,OACF;AAAA,IACF,SAAS,MAAA,EAAQ;AACf,MAAA,OAAO,YAAA,CAAa,GAAG,MAAM,CAAA;AAAA,IAC/B;AAAA,EACF,CAAA;AACF;AAEO,SAAS,mBAAmB,IAAA,EAA4B;AAC7D,EAAA,OAAO,OAAO,CAAA,KAAkC;AAC9C,IAAA,MAAM,SAAA,GAAY,MAAM,kBAAA,CAAmB,CAAA,EAAG,IAAI,CAAA;AAClD,IAAA,IAAI,SAAA,KAAc,QAAW,OAAO,CAAA,CAAE,KAAK,EAAE,KAAA,EAAO,cAAA,EAAe,EAAG,GAAG,CAAA;AACzE,IAAA,MAAM,KAAA,GAAQ,UAAA,CAAW,CAAA,EAAG,IAAA,CAAK,SAAS,CAAA;AAC1C,IAAA,IAAI,KAAA,KAAU,QAAW,OAAO,CAAA,CAAE,KAAK,EAAE,KAAA,EAAO,qBAAA,EAAsB,EAAG,GAAG,CAAA;AAE5E,IAAA,MAAM,UAAA,GAAa,MAAM,QAAA,IAAY,CAAA;AACrC,IAAA,MAAM,SAAA,GAAY,CAAA,CAAE,GAAA,CAAI,MAAA,CAAO,eAAe,CAAA;AAC9C,IAAA,MAAM,WAAA,GAAc,SAAA,KAAc,MAAA,GAAY,MAAA,GAAY,wBAAwB,SAAS,CAAA;AAC3F,IAAA,IAAI,SAAA,KAAc,MAAA,IAAa,WAAA,KAAgB,MAAA,EAAW;AACxD,MAAA,OAAO,EAAE,IAAA,CAAK,EAAE,KAAA,EAAO,uBAAA,IAA2B,GAAG,CAAA;AAAA,IACvD;AACA,IAAA,IAAI,WAAA,KAAgB,UAAa,CAAA,CAAE,GAAA,CAAI,MAAM,OAAO,CAAA,KAAM,MAAA,IAAa,WAAA,KAAgB,UAAA,EAAY;AACjG,MAAA,OAAO,EAAE,IAAA,CAAK,EAAE,KAAA,EAAO,4BAAA,IAAgC,GAAG,CAAA;AAAA,IAC5D;AAEA,IAAA,IAAI,OAAA,GAAU,KAAA;AACd,IAAA,MAAM,cAAA,GAAiB,IAAI,eAAA,EAAgB;AAC3C,IAAA,MAAM,MAAA,GAAS,CAAA,CAAE,GAAA,CAAI,GAAA,CAAI,MAAA;AACzB,IAAA,MAAM,MAAA,GAAS,IAAI,cAAA,CAA2B;AAAA,MAC5C,MAAM,UAAA,EAAY;AAChB,QAAA,MAAM,UAAU,MAAM;AACpB,UAAA,OAAA,GAAU,IAAA;AACV,UAAA,cAAA,CAAe,KAAA,EAAM;AACrB,UAAA,eAAA,CAAgB,UAAU,CAAA;AAAA,QAC5B,CAAA;AACA,QAAA,MAAA,CAAO,iBAAiB,OAAA,EAAS,OAAA,EAAS,EAAE,IAAA,EAAM,MAAM,CAAA;AACxD,QAAA,KAAK,eAAA;AAAA,UACH,UAAA;AAAA,UACA,CAAA;AAAA,UACA,IAAA;AAAA,UACA,EAAE,GAAG,KAAA,EAAO,QAAA,EAAU,eAAe,UAAA,EAAW;AAAA,UAChD,MAAM,WAAW,MAAA,CAAO,OAAA;AAAA,UACxB,cAAA,CAAe;AAAA,SACjB,CAAE,QAAQ,MAAM;AACd,UAAA,OAAA,GAAU,IAAA;AACV,UAAA,cAAA,CAAe,KAAA,EAAM;AACrB,UAAA,MAAA,CAAO,mBAAA,CAAoB,SAAS,OAAO,CAAA;AAC3C,UAAA,eAAA,CAAgB,UAAU,CAAA;AAAA,QAC5B,CAAC,CAAA;AAAA,MACH,CAAA;AAAA,MACA,MAAA,GAAS;AACP,QAAA,OAAA,GAAU,IAAA;AACV,QAAA,cAAA,CAAe,KAAA,EAAM;AAAA,MACvB;AAAA,KACD,CAAA;AAED,IAAA,OAAO,IAAI,SAAS,MAAA,EAAQ;AAAA,MAC1B,MAAA,EAAQ,GAAA;AAAA,MACR,OAAA,EAAS;AAAA,QACP,eAAA,EAAiB,wBAAA;AAAA,QACjB,UAAA,EAAY,YAAA;AAAA,QACZ,cAAA,EAAgB;AAAA;AAClB,KACD,CAAA;AAAA,EACH,CAAA;AACF;AAEA,eAAe,gBACb,UAAA,EACA,CAAA,EACA,IAAA,EACA,YAAA,EACA,WACA,UAAA,EACe;AACf,EAAA,IAAI,MAAA,GAAS,aAAa,QAAA,IAAY,CAAA;AACtC,EAAA,IAAI,aAAA,GAAgB,YAAY,GAAA,EAAI;AACpC,EAAA,IAAI,aAAA,GAAgB,YAAY,GAAA,EAAI;AACpC,EAAA,OAAO,CAAC,WAAU,EAAG;AACnB,IAAA,MAAM,aAAA,GAAgB,MAAM,kBAAA,CAAmB,CAAA,EAAG,IAAI,CAAA;AACtD,IAAA,IAAI,kBAAkB,MAAA,EAAW;AAEjC,IAAA,MAAM,IAAA,GAAO,MAAM,aAAA,CAAc,MAAA,CAAO,KAAA,CAAM,IAAA,CAAK,EAAE,GAAG,YAAA,EAAc,QAAA,EAAU,MAAA,EAAQ,CAAA;AACxF,IAAA,KAAA,MAAW,IAAA,IAAQ,KAAK,KAAA,EAAO;AAC7B,MAAA,OAAA,CAAQ,UAAA,EAAY,CAAA;AAAA,IAAA,EAAqB,KAAK,QAAQ;AAAA,MAAA,EAAW,IAAA,CAAK,SAAA,CAAU,IAAI,CAAC;;AAAA,CAAM,CAAA;AAC3F,MAAA,MAAA,GAAS,IAAA,CAAK,QAAA;AAAA,IAChB;AACA,IAAA,IAAI,KAAK,OAAA,EAAS;AAElB,IAAA,MAAM,GAAA,GAAM,YAAY,GAAA,EAAI;AAC5B,IAAA,IAAI,GAAA,GAAM,aAAA,IAAiB,IAAA,CAAK,wBAAA,EAA0B;AACxD,MAAA,OAAA,CAAQ,UAAA,EAAY,CAAA;AAAA,MAAA,EAA2B,KAAK,SAAA,CAAU,EAAE,KAAA,EAAO,CAAA,EAAG,CAAC;;AAAA,CAAM,CAAA;AACjF,MAAA,aAAA,GAAgB,GAAA;AAAA,IAClB;AACA,IAAA,IAAI,GAAA,GAAM,aAAA,IAAiB,IAAA,CAAK,mBAAA,EAAqB;AACnD,MAAA,OAAA,CAAQ,YAAY,iBAAiB,CAAA;AACrC,MAAA,aAAA,GAAgB,GAAA;AAAA,IAClB;AACA,IAAA,MAAM,cAAA,CAAe,IAAA,CAAK,eAAA,EAAiB,UAAU,CAAA;AAAA,EACvD;AACF;AAEA,SAAS,OAAA,CAAQ,YAAyD,KAAA,EAAqB;AAC7F,EAAA,IAAI;AACF,IAAA,UAAA,CAAW,QAAQ,IAAI,WAAA,EAAY,CAAE,MAAA,CAAO,KAAK,CAAC,CAAA;AAAA,EACpD,CAAA,CAAA,MAAQ;AAAA,EAER;AACF;AAEA,SAAS,gBAAgB,UAAA,EAA+D;AACtF,EAAA,IAAI;AACF,IAAA,UAAA,CAAW,KAAA,EAAM;AAAA,EACnB,CAAA,CAAA,MAAQ;AAAA,EAER;AACF;AAEA,eAAe,cAAA,CAAe,IAAY,MAAA,EAAoC;AAC5E,EAAA,IAAI,OAAO,OAAA,EAAS;AACpB,EAAA,MAAM,IAAI,OAAA,CAAc,CAAC,OAAA,KAAY;AACnC,IAAA,IAAI,KAAA;AACJ,IAAA,MAAM,SAAS,MAAM;AACnB,MAAA,IAAI,KAAA,KAAU,MAAA,EAAW,YAAA,CAAa,KAAK,CAAA;AAC3C,MAAA,MAAA,CAAO,mBAAA,CAAoB,SAAS,MAAM,CAAA;AAC1C,MAAA,OAAA,EAAQ;AAAA,IACV,CAAA;AACA,IAAA,KAAA,GAAQ,UAAA,CAAW,QAAQ,EAAE,CAAA;AAC7B,IAAA,MAAA,CAAO,iBAAiB,OAAA,EAAS,MAAA,EAAQ,EAAE,IAAA,EAAM,MAAM,CAAA;AACvD,IAAA,IAAI,MAAA,CAAO,SAAS,MAAA,EAAO;AAAA,EAC7B,CAAC,CAAA;AACH;AAEA,SAAS,YAAA,CAAa,GAAY,MAAA,EAA2B;AAC3D,EAAA,IAAIG,mBAAAA,CAA+B,MAAM,CAAA,EAAG;AAC1C,IAAA,MAAM,MAAA,GAAS,OAAO,OAAA,CAAQ,QAAA;AAC9B,IAAA,OAAO,CAAA,CAAE,IAAA;AAAA,MACP;AAAA,QACE,OAAO,MAAA,CAAO,IAAA;AAAA,QACd,SAAS,MAAA,CAAO,OAAA;AAAA,QAChB,YAAY,MAAA,CAAO,UAAA;AAAA,QACnB,GAAI,MAAA,KAAW,MAAA,GAAY,EAAC,GAAI,EAAE,MAAA,EAAQ,EAAE,GAAG,MAAA,EAAQ,UAAA,EAAY,MAAA,CAAO,YAAW;AAAE,OACzF;AAAA,MACA;AAAA,KACF;AAAA,EACF;AACA,EAAA,IAAIC,WAAAA,CAAY,MAAA,EAAQ,sBAAsB,CAAA,EAAG,OAAO,CAAA,CAAE,IAAA,CAAK,EAAE,KAAA,EAAO,MAAA,CAAO,IAAA,EAAK,EAAG,GAAG,CAAA;AAC1F,EAAA,IAAIA,WAAAA,CAAY,MAAA,EAAQ,gBAAgB,CAAA,EAAG,OAAO,CAAA,CAAE,IAAA,CAAK,EAAE,KAAA,EAAO,MAAA,CAAO,IAAA,EAAK,EAAG,GAAG,CAAA;AACpF,EAAA,MAAM,MAAA;AACR;ACvQA,IAAM,kBAAA,GAAqBJ,EAAE,MAAA,CAAO;AAAA,EAClC,KAAA,EAAOA,CAAAA,CAAE,IAAA,CAAK,eAAe,CAAA;AAAA,EAC7B,MAAA,EAAQA,CAAAA,CAAE,MAAA,EAAO,CAAE,QAAA,EAAS;AAAA,EAC5B,kBAAA,EAAoB,yBAAyB,QAAA;AAC/C,CAAC,CAAA;AAEM,SAAS,uBAAuB,IAAA,EAAyB;AAC9D,EAAA,OAAO,OAAO,CAAA,KAAkC;AAC9C,IAAA,MAAM,aAAA,GAAgB,MAAM,kBAAA,CAAmB,CAAA,EAAG,IAAI,CAAA;AACtD,IAAA,IAAI,aAAA,KAAkB,QAAW,OAAO,CAAA,CAAE,KAAK,EAAE,KAAA,EAAO,cAAA,EAAe,EAAG,GAAG,CAAA;AAC7E,IAAA,MAAM,SAAS,kBAAA,CAAmB,SAAA,CAAU,MAAM,YAAA,CAAa,CAAC,CAAC,CAAA;AACjE,IAAA,IAAI,CAAC,MAAA,CAAO,OAAA,EAAS,OAAO,CAAA,CAAE,KAAK,EAAE,KAAA,EAAO,uBAAA,EAAwB,EAAG,GAAG,CAAA;AAC1E,IAAA,IACE,MAAA,CAAO,IAAA,CAAK,MAAA,KAAW,MAAA,IACvB,IAAI,WAAA,EAAY,CAAE,MAAA,CAAO,MAAA,CAAO,IAAA,CAAK,MAAM,CAAA,CAAE,MAAA,GAAS,KAAK,cAAA,EAC3D;AACA,MAAA,OAAO,EAAE,IAAA,CAAK,EAAE,KAAA,EAAO,2BAAA,IAA+B,GAAG,CAAA;AAAA,IAC3D;AACA,IAAA,IAAI;AACF,MAAA,OAAO,CAAA,CAAE,IAAA;AAAA,QACP,MAAM,aAAA,CAAc,MAAA,CAAO,QAAA,CAAS,OAAA,CAAQ;AAAA,UAC1C,QAAA,EAAU,cAAc,MAAA,CAAO,QAAA;AAAA,UAC/B,KAAA,EAAO,OAAO,IAAA,CAAK,KAAA;AAAA,UACnB,GAAI,MAAA,CAAO,IAAA,CAAK,MAAA,KAAW,KAAA,CAAA,GAAY,EAAC,GAAI,EAAE,MAAA,EAAQ,MAAA,CAAO,IAAA,CAAK,MAAA,EAAO;AAAA,UACzE,GAAI,MAAA,CAAO,IAAA,CAAK,kBAAA,KAAuB,KAAA,CAAA,GACnC,EAAC,GACD,EAAE,kBAAA,EAAoB,MAAA,CAAO,IAAA,CAAK,kBAAA,EAAmB;AAAA,UACzD,OAAO,IAAA,CAAK,KAAA;AAAA,UACZ,mBAAmB,IAAA,CAAK;AAAA,SACzB,CAAA;AAAA,QACD;AAAA,OACF;AAAA,IACF,SAAS,MAAA,EAAQ;AACf,MAAA,IAAII,WAAAA,CAAY,MAAA,EAAQ,mBAAmB,CAAA,EAAG;AAC5C,QAAA,OAAO,EAAE,IAAA,CAAK,EAAE,OAAO,MAAA,CAAO,IAAA,IAAQ,GAAG,CAAA;AAAA,MAC3C;AACA,MAAA,MAAM,MAAA;AAAA,IACR;AAAA,EACF,CAAA;AACF;AAEO,SAAS,sBAAsB,IAAA,EAAyB;AAC7D,EAAA,OAAO,OAAO,CAAA,KAAkC;AAC9C,IAAA,MAAM,aAAA,GAAgB,MAAM,kBAAA,CAAmB,CAAA,EAAG,IAAI,CAAA;AACtD,IAAA,IAAI,aAAA,KAAkB,QAAW,OAAO,CAAA,CAAE,KAAK,EAAE,KAAA,EAAO,cAAA,EAAe,EAAG,GAAG,CAAA;AAC7E,IAAA,MAAM,SAAS,2BAAA,CAA4B,SAAA,CAAU,MAAM,YAAA,CAAa,CAAC,CAAC,CAAA;AAC1E,IAAA,IAAI,CAAC,MAAA,CAAO,OAAA,EAAS,OAAO,CAAA,CAAE,KAAK,EAAE,KAAA,EAAO,uBAAA,EAAwB,EAAG,GAAG,CAAA;AAC1E,IAAA,IAAI;AACF,MAAA,OAAO,CAAA,CAAE,IAAA;AAAA,QACP,MAAM,qBAAqB,aAAA,CAAc,MAAA,CAAO,UAAU,MAAA,CAAO,IAAA,EAAM,KAAK,MAAM,CAAA;AAAA,QAClF;AAAA,OACF;AAAA,IACF,SAAS,MAAA,EAAQ;AACf,MAAA,IAAI,YAAA,CAAa,MAAA,EAAQ,0BAA0B,CAAA,EAAG;AACpD,QAAA,OAAO,EAAE,IAAA,CAAK,EAAE,OAAO,MAAA,CAAO,IAAA,IAAQ,GAAG,CAAA;AAAA,MAC3C;AACA,MAAA,IAAI,YAAA,CAAa,MAAA,EAAQ,4BAA4B,CAAA,EAAG;AACtD,QAAA,OAAO,EAAE,IAAA,CAAK,EAAE,OAAO,MAAA,CAAO,IAAA,IAAQ,GAAG,CAAA;AAAA,MAC3C;AACA,MAAA,MAAM,MAAA;AAAA,IACR;AAAA,EACF,CAAA;AACF;ACvDO,IAAM,6BAAA,GAAgC;AAQtC,SAAS,qBAAqB,IAAA,EAA0B;AAC7D,EAAA,OAAO,OAAO,CAAA,KAAkC;AAC9C,IAAA,MAAM,MAAA,GAAS,MAAM,kBAAA,CAAmB,CAAA,CAAE,IAAI,MAAA,CAAO,eAAe,CAAA,EAAG,IAAA,CAAK,MAAM,CAAA;AAClF,IAAA,IAAI,MAAA,KAAW,MAAA,EAAW,OAAO,YAAA,CAAa,CAAC,CAAA;AAE/C,IAAA,MAAM,KAAA,GAAQ,MAAM,IAAA,CAAK,UAAA,CAAW,IAAA,CAAKC,eAAAA,CAAgB,MAAM,CAAA,EAAG,EAAE,KAAA,EAAO,IAAA,CAAK,SAAA,EAAW,CAAA;AAC3F,IAAA,OAAO,CAAA,CAAE,IAAA,CAAK,EAAE,KAAA,IAAS,GAAG,CAAA;AAAA,EAC9B,CAAA;AACF;AAEO,SAAS,qBAAqB,IAAA,EAA0B;AAC7D,EAAA,OAAO,OAAO,CAAA,KAAkC;AAC9C,IAAA,MAAM,MAAA,GAAS,MAAM,kBAAA,CAAmB,CAAA,CAAE,IAAI,MAAA,CAAO,eAAe,CAAA,EAAG,IAAA,CAAK,MAAM,CAAA;AAClF,IAAA,IAAI,MAAA,KAAW,MAAA,EAAW,OAAO,YAAA,CAAa,CAAC,CAAA;AAE/C,IAAA,MAAM,IAAA,GAAO,CAAA,CAAE,GAAA,CAAI,KAAA,CAAM,MAAM,CAAA;AAC/B,IAAA,MAAM,IAAA,GAAO,CAAA,CAAE,GAAA,CAAI,KAAA,CAAM,MAAM,CAAA;AAC/B,IAAA,IAAI,SAAS,MAAA,IAAa,IAAA,KAAS,MAAA,EAAW,OAAO,SAAS,CAAC,CAAA;AAO/D,IAAA,MAAM,IAAA,GAAO,MAAM,IAAA,CAAK,UAAA,CAAW,SAASA,eAAAA,CAAgB,MAAM,CAAA,EAAG,IAAA,EAAM,IAAI,CAAA;AAC/E,IAAA,IAAI,IAAA,KAAS,MAAA,EAAW,OAAO,QAAA,CAAS,CAAC,CAAA;AACzC,IAAA,OAAO,CAAA,CAAE,IAAA,CAAK,IAAA,EAAM,GAAG,CAAA;AAAA,EACzB,CAAA;AACF;AAEA,SAAS,aAAa,CAAA,EAAsB;AAC1C,EAAA,OAAO,EAAE,IAAA,CAAK,EAAE,KAAA,EAAO,cAAA,IAAkB,GAAG,CAAA;AAC9C;AAEA,SAAS,SAAS,CAAA,EAAsB;AACtC,EAAA,OAAO,EAAE,IAAA,CAAK,EAAE,KAAA,EAAO,sBAAA,IAA0B,GAAG,CAAA;AACtD;AC1DO,IAAM,kCAAA,GAAqC;AAC3C,IAAM,iCAAiC,CAAA,GAAI;AAC3C,IAAM,uCAAuC,CAAA,GAAI;AACjD,IAAM,mCAAmC,EAAA,GAAK;AA8BrD,SAAS,UAAA,CAAW,OAAe,OAAA,EAA0B;AAC3D,EAAA,OAAO,OAAO,aAAA,CAAc,KAAK,CAAA,IAAK,KAAA,IAAS,KAAK,KAAA,IAAS,OAAA;AAC/D;AAEA,SAAS,aAAa,KAAA,EAAmC;AACvD,EAAA,MAAM,MAAA,GAAS,IAAA,CAAK,KAAA,CAAM,KAAK,CAAA;AAC/B,EAAA,OAAO,MAAA,CAAO,QAAA,CAAS,MAAM,CAAA,GAAI,MAAA,GAAS,MAAA;AAC5C;AAEA,SAAS,kBAAA,CACP,QAAA,EACA,GAAA,EACA,WAAA,EACA,aAAA,EACS;AACT,EAAA,MAAM,QAAA,GAAW,YAAA,CAAa,QAAA,CAAS,SAAA,CAAU,QAAQ,CAAA;AACzD,EAAA,IAAI,QAAA,KAAa,QAAW,OAAO,KAAA;AACnC,EAAA,IAAI,WAAW,GAAA,GAAM,WAAA,IAAe,QAAA,GAAW,GAAA,GAAM,aAAa,OAAO,KAAA;AAEzE,EAAA,MAAM,MAAA,GAAS,SAAS,SAAA,CAAU,SAAA;AAClC,EAAA,IAAI,MAAA,KAAW,QAAW,OAAO,IAAA;AACjC,EAAA,MAAM,SAAA,GAAY,aAAa,MAAM,CAAA;AACrC,EAAA,IAAI,SAAA,KAAc,MAAA,IAAa,SAAA,GAAY,QAAA,EAAU,OAAO,KAAA;AAC5D,EAAA,IAAI,SAAA,GAAY,QAAA,GAAW,aAAA,EAAe,OAAO,KAAA;AACjD,EAAA,OAAO,OAAO,SAAA,GAAY,WAAA;AAC5B;AAOA,eAAsB,uBAAA,CACpB,KAAA,EACA,OAAA,EACA,IAAA,EAC+C;AAC/C,EAAA,MAAM,WAAA,GAAc,KAAK,WAAA,IAAe,kCAAA;AACxC,EAAA,MAAM,aAAA,GAAgB,KAAK,aAAA,IAAiB,oCAAA;AAC5C,EAAA,IAAI,CAAC,UAAA,CAAW,WAAA,EAAa,8BAA8B,GAAG,OAAO,MAAA;AACrE,EAAA,IAAI,CAAC,UAAA,CAAW,aAAA,EAAe,gCAAgC,GAAG,OAAO,MAAA;AAEzE,EAAA,IAAI,QAAA;AACJ,EAAA,IAAI;AACF,IAAA,QAAA,GAAW,yBAAyB,KAAK,CAAA;AAAA,EAC3C,CAAA,CAAA,MAAQ;AACN,IAAA,OAAO,MAAA;AAAA,EACT;AACA,EAAA,MAAM,SAAS,QAAA,CAAS,SAAA;AAExB,EAAA,IAAI,OAAO,SAAA,KAAc,OAAA,CAAQ,aAAa,MAAA,CAAO,QAAA,KAAa,QAAQ,QAAA,EAAU;AAClF,IAAA,OAAO,MAAA;AAAA,EACT;AACA,EAAA,IAAI,MAAA,CAAO,WAAA,KAAgB,MAAA,EAAW,OAAO,MAAA;AAC7C,EAAA,IAAI,MAAA,CAAO,WAAW,OAAA,CAAQ,MAAA,IAAU,OAAO,IAAA,KAAS,OAAA,CAAQ,MAAM,OAAO,MAAA;AAC7E,EAAA,IAAI,MAAA,CAAO,QAAA,KAAa,OAAA,CAAQ,IAAA,CAAK,YAAY,OAAO,MAAA;AACxD,EAAA,IAAK,MAAM,KAAK,MAAA,CAAO,MAAA,CAAO,QAAQ,IAAI,CAAA,KAAO,MAAA,CAAO,UAAA,EAAY,OAAO,MAAA;AAE3E,EAAA,IAAI,CAACC,UAAAA,CAAW,MAAA,CAAO,QAAQ,GAAG,OAAO,MAAA;AACzC,EAAA,MAAM,GAAA,GAAM,MAAM,IAAA,CAAK,OAAA,CAAQ,GAAA,CAAIP,SAAS,MAAA,CAAO,QAAQ,CAAA,EAAG,MAAA,CAAO,QAAQ,CAAA;AAC7E,EAAA,IAAI,GAAA,KAAQ,MAAA,IAAa,GAAA,CAAI,OAAA,EAAS,OAAO,MAAA;AAC7C,EAAA,IAAI,GAAA,CAAI,SAAA,KAAc,MAAA,CAAO,SAAA,EAAW,OAAO,MAAA;AAC/C,EAAA,IAAI,IAAI,UAAA,KAAe,MAAA,CAAO,SAAS,GAAA,CAAI,aAAA,KAAkB,OAAO,QAAA,EAAU;AAC5E,IAAA,OAAO,MAAA;AAAA,EACT;AAEA,EAAA,IAAI,CAAC,kBAAA,CAAmB,QAAA,EAAU,IAAA,CAAK,KAAA,CAAM,GAAA,EAAI,CAAE,OAAA,EAAQ,EAAG,WAAA,EAAa,aAAa,CAAA,EAAG;AACzF,IAAA,OAAO,MAAA;AAAA,EACT;AACA,EAAA,MAAM,QAAA,GAAW,MAAM,IAAA,CAAK,MAAA,CAAO,aAAA;AAAA,IACjC,GAAA,CAAI,eAAA;AAAA,IACJ,wBAAwB,MAAM,CAAA;AAAA,IAC9B,QAAA,CAAS;AAAA,GACX;AACA,EAAA,IAAI,CAAC,UAAU,OAAO,MAAA;AAEtB,EAAA,OAAO;AAAA,IACL,MAAA,EAAQ;AAAA,MACN,IAAA,EAAM,QAAA;AAAA,MACN,UAAU,GAAA,CAAI,QAAA;AAAA,MACd,WAAW,GAAA,CAAI,SAAA;AAAA,MACf,UAAU,GAAA,CAAI;AAAA,KAChB;AAAA,IACA,WAAW,MAAA,CAAO,SAAA;AAAA,IAClB,WAAW,MAAA,CAAO,SAAA;AAAA,IAClB,UAAU,MAAA,CAAO,QAAA;AAAA,IACjB,YAAY,MAAA,CAAO,UAAA;AAAA,IACnB,QAAA,EAAU,MAAA,CAAO,MAAA,CAAO,QAAQ,CAAA;AAAA,IAChC,OAAO,GAAA,CAAI,UAAA;AAAA,IACX,UAAU,GAAA,CAAI;AAAA,GAChB;AACF;AC5HO,IAAM,uBAAA,GAA0B;AAChC,IAAM,yBAAA,GAA4B;AAClC,IAAM,2BAAA,GAA8B;AACpC,IAAM,2BAAA,GAA8B;AACpC,IAAM,sBAAA,GAAyB;AAC/B,IAAM,uBAAA,GAA0B;AAChC,IAAM,wBAAA,GAA2B;AAExC,IAAM,oBAAA,GAAuB,uBAAA;AAC7B,IAAM,kBAAA,GAAqB,+BAAA;AAEpB,IAAM,uBAAuBC,CAAAA,CACjC,MAAA,GACA,GAAA,CAAI,CAAC,EACL,GAAA,CAAI,2BAA2B,EAC/B,KAAA,CAAM,kBAAkB,EACxB,MAAA,CAAO,CAAC,UAAU,KAAA,KAAU,GAAA,IAAO,UAAU,IAAI;AAE7C,IAAM,oBAAA,GAAuBA,CAAAA,CAAE,kBAAA,CAAmB,MAAA,EAAQ;AAAA,EAC/DA,EAAE,YAAA,CAAa;AAAA,IACb,IAAA,EAAMA,CAAAA,CAAE,OAAA,CAAQ,QAAQ,CAAA;AAAA,IACxB,OAAA,EAASA,EAAE,MAAA,EAAO;AAAA,IAClB,WAAA,EAAaA,CAAAA,CAAE,MAAA,EAAO,CAAE,MAAM,oBAAoB;AAAA,GACnD,CAAA;AAAA,EACDA,EAAE,YAAA,CAAa;AAAA,IACb,IAAA,EAAMA,CAAAA,CAAE,OAAA,CAAQ,QAAQ,CAAA;AAAA,IACxB,WAAA,EAAaA,CAAAA,CAAE,MAAA,EAAO,CAAE,MAAM,oBAAoB,CAAA;AAAA,IAClD,QAAA,EAAUA,EAAE,MAAA,EAAO,CAAE,KAAI,CAAE,WAAA,GAAc,IAAA;AAAK,GAC/C;AACH,CAAC;AAED,IAAM,uBAAA,GAA0BA,EAAE,YAAA,CAAa;AAAA,EAC7C,MAAMA,CAAAA,CAAE,IAAA,CAAK,CAAC,SAAA,EAAW,QAAQ,CAAC,CAAA;AAAA,EAClC,SAAA,EAAW,oBAAA;AAAA,EACX,WAAA,EAAaA,EAAE,MAAA,EAAO,CAAE,KAAI,CAAE,WAAA,GAAc,IAAA,EAAK;AAAA,EACjD,IAAA,EAAM,oBAAA;AAAA,EACN,OAAOA,CAAAA,CAAE,MAAA,GAAS,GAAA,CAAI,sBAAsB,EAAE,QAAA;AAChD,CAAC,CAAA;AAEM,IAAM,uBAAA,GAA0BA,EAAE,YAAA,CAAa;AAAA,EACpD,WAAA,EAAaA,CAAAA,CAAE,MAAA,EAAO,CAAE,GAAA,GAAM,WAAA,EAAY,CAAE,IAAA,EAAK,CAAE,QAAA,EAAS;AAAA,EAC5D,IAAA,EAAM,oBAAA;AAAA,EACN,OAAOA,CAAAA,CAAE,MAAA,GAAS,GAAA,CAAI,sBAAsB,EAAE,QAAA,EAAS;AAAA,EACvD,SAAA,EAAWA,EAAE,KAAA,CAAM,uBAAuB,EAAE,GAAA,CAAI,uBAAA,GAA0B,CAAC,CAAA,CAAE,QAAA;AAC/E,CAAC;AA4CM,IAAM,yBAAA,GAA4BA,EAAE,YAAA,CAAa;AAAA,EACtD,MAAMA,CAAAA,CAAE,IAAA,CAAK,CAAC,eAAA,EAAiB,SAAA,EAAW,QAAQ,CAAC,CAAA;AAAA,EACnD,SAAA,EAAW,oBAAA;AAAA,EACX,GAAA,EAAKA,EAAE,MAAA,EAAO,CAAE,KAAI,CAAE,QAAA,GAAW,IAAA,EAAK;AAAA,EACtC,WAAA,EAAaA,CAAAA,CAAE,MAAA,EAAO,CAAE,MAAM,oBAAoB,CAAA;AAAA,EAClD,QAAA,EAAUA,EAAE,MAAA,EAAO,CAAE,KAAI,CAAE,WAAA,GAAc,IAAA,EAAK;AAAA,EAC9C,OAAOA,CAAAA,CAAE,MAAA,GAAS,GAAA,CAAI,sBAAsB,EAAE,QAAA,EAAS;AAAA,EACvD,SAAA,EAAWA,EAAE,MAAA,EAAO,CAAE,SAAS,EAAE,MAAA,EAAQ,MAAM;AACjD,CAAC;AAOM,IAAM,yBAAA,GAA4BA,EAAE,YAAA,CAAa;AAAA,EACtD,OAAA,EAAS,yBAAA;AAAA,EACT,WAAWA,CAAAA,CAAE,KAAA,CAAM,yBAAyB,CAAA,CAAE,GAAA,CAAI,0BAA0B,CAAC;AAC/E,CAAC;AAwBM,SAAS,oBAAoB,MAAA,EAA0C;AAC5E,EAAA,MAAM,QAAA,GAAW,MAAA,CAAO,MAAA,CAAO,QAAQ,CAAA;AACvC,EAAA,IAAI,CAAC,OAAO,aAAA,CAAc,QAAQ,GAAG,MAAM,IAAI,MAAM,2CAA2C,CAAA;AAChG,EAAA,OAAO;AAAA,IACL,MAAM,MAAA,CAAO,IAAA;AAAA,IACb,WAAW,MAAA,CAAO,SAAA;AAAA,IAClB,KAAK,MAAA,CAAO,GAAA;AAAA,IACZ,aAAa,MAAA,CAAO,WAAA;AAAA,IACpB,QAAA;AAAA,IACA,GAAI,OAAO,KAAA,KAAU,MAAA,GAAY,EAAC,GAAI,EAAE,KAAA,EAAO,MAAA,CAAO,KAAA,EAAM;AAAA,IAC5D,WAAW,MAAA,CAAO;AAAA,GACpB;AACF;AAEO,SAAS,sBAAsB,KAAA,EAAgD;AACpF,EAAA,MAAM,QAAA,GAAW,MAAA,CAAO,KAAA,CAAM,QAAQ,CAAA;AACtC,EAAA,IAAI,CAAC,OAAO,aAAA,CAAc,QAAQ,GAAG,MAAM,IAAI,MAAM,6CAA6C,CAAA;AAClG,EAAA,OAAO;AAAA,IACL,MAAM,KAAA,CAAM,IAAA;AAAA,IACZ,WAAW,KAAA,CAAM,SAAA;AAAA,IACjB,KAAK,KAAA,CAAM,GAAA;AAAA,IACX,aAAa,KAAA,CAAM,WAAA;AAAA,IACnB,QAAA;AAAA,IACA,GAAI,MAAM,KAAA,KAAU,MAAA,GAAY,EAAC,GAAI,EAAE,KAAA,EAAO,KAAA,CAAM,KAAA,EAAM;AAAA,IAC1D,WAAW,KAAA,CAAM;AAAA,GACnB;AACF;;;ACjKO,IAAM,gBAAA,GAAN,cAA+B,KAAA,CAAM;AAAA,EACjC,IAAA;AAAA,EACA,OAAA;AAAA,EAET,WAAA,CAAY,IAAA,EAA4B,OAAA,EAAiB,OAAA,EAAmB;AAC1E,IAAA,KAAA,CAAM,OAAO,CAAA;AACb,IAAA,IAAA,CAAK,IAAA,GAAO,kBAAA;AACZ,IAAA,IAAA,CAAK,IAAA,GAAO,IAAA;AACZ,IAAA,IAAA,CAAK,OAAA,GAAU,OAAA;AAAA,EACjB;AACF;AAEO,SAAS,mBAAmB,KAAA,EAA2C;AAC5E,EAAA,OAAO,KAAA,YAAiB,gBAAA;AAC1B;;;ACcO,IAAM,+BAAA,GAAkC,IAAI,IAAA,GAAO;AACnD,IAAM,gCAAgC,EAAA,GAAK;AAElD,IAAM,UAAA,GAAa,IAAI,UAAA,EAAW;AAClC,IAAM,qBAAA,GAAwB,+BAAA;AAkBvB,SAAS,qBAAqB,IAAA,EAAsB;AACzD,EAAA,OAAO,OAAO,CAAA,KAAkC;AAC9C,IAAA,MAAM,aAAA,GAAgB,MAAM,wBAAA,CAAyB,CAAA,EAAG,IAAA,EAAM;AAAA,MAC5D,IAAA,EAAM,UAAA;AAAA,MACN,SAAA,EAAW,YAAA;AAAA,MACX,QAAA,EAAU;AAAA,KACX,CAAA;AACD,IAAA,IAAI,aAAA,KAAkB,MAAA,EAAW,OAAOO,aAAAA,CAAa,CAAC,CAAA;AAEtD,IAAA,MAAM,KAAA,GAAQ,cAAc,CAAC,CAAA;AAC7B,IAAA,IAAI,KAAA,KAAU,QAAW,OAAO,CAAA,CAAE,KAAK,EAAE,KAAA,EAAO,8BAAA,EAA+B,EAAG,GAAG,CAAA;AACrF,IAAA,MAAM,OAAA,GAAU,MAAM,IAAA,CAAK,KAAA,CAAM,aAAaF,eAAAA,CAAgB,aAAA,CAAc,MAAM,CAAA,EAAG,KAAK,CAAA;AAC1F,IAAA,OAAO,CAAA,CAAE,KAAK,EAAE,OAAA,EAAS,QAAQ,GAAA,CAAI,qBAAqB,CAAA,EAAE,EAAG,GAAG,CAAA;AAAA,EACpE,CAAA;AACF;AAEO,SAAS,gBAAgB,IAAA,EAAsB;AACpD,EAAA,OAAO,OAAO,CAAA,KAAkC;AAC9C,IAAA,MAAM,QAAA,GAAW,kBAAkB,CAAC,CAAA;AACpC,IAAA,MAAM,aAAA,GAAgB,MAAM,wBAAA,CAAyB,CAAA,EAAG,IAAA,EAAM;AAAA,MAC5D,IAAA,EAAM,UAAA;AAAA,MACN,SAAA,EAAW,YAAA;AAAA,MACX;AAAA,KACD,CAAA;AACD,IAAA,IAAI,aAAA,KAAkB,MAAA,EAAW,OAAOE,aAAAA,CAAa,CAAC,CAAA;AACtD,IAAA,MAAM,QAAA,GAAW,eAAe,CAAC,CAAA;AACjC,IAAA,IAAI,QAAA,KAAa,QAAW,OAAO,CAAA,CAAE,KAAK,EAAE,KAAA,EAAO,+BAAA,EAAgC,EAAG,GAAG,CAAA;AAEzF,IAAA,MAAM,MAAA,GAAS,MAAM,IAAA,CAAK,KAAA,CAAM,UAAUF,eAAAA,CAAgB,aAAA,CAAc,MAAM,CAAA,EAAG,QAAQ,CAAA;AACzF,IAAA,IAAI,MAAA,KAAW,QAAW,OAAO,CAAA,CAAE,KAAK,EAAE,KAAA,EAAO,wBAAA,EAAyB,EAAG,GAAG,CAAA;AAChF,IAAA,MAAM,QAAA,GAAW,oBAAoB,MAAM,CAAA;AAC3C,IAAA,IAAI,MAAA,CAAO,IAAA,CAAK,IAAA,KAAS,QAAA,EAAU;AACjC,MAAA,OAAO,CAAA,CAAE,IAAA,CAAK,EAAE,GAAG,UAAU,IAAA,EAAM,EAAE,IAAA,EAAM,QAAA,EAAU,SAAS,MAAA,CAAO,IAAA,CAAK,IAAA,EAAK,IAAK,GAAG,CAAA;AAAA,IACzF;AAEA,IAAA,MAAM,WAAA,GAAc,MAAM,IAAA,CAAK,eAAA,CAAgB,cAAA;AAAA,MAC7CA,eAAAA,CAAgB,cAAc,MAAM,CAAA;AAAA,MACpC,OAAO,IAAA,CAAK;AAAA,KACd;AACA,IAAA,IAAI,WAAA,KAAgB,QAAW,OAAO,CAAA,CAAE,KAAK,EAAE,KAAA,EAAO,kBAAA,EAAmB,EAAG,GAAG,CAAA;AAC/E,IAAA,OAAO,CAAA,CAAE,IAAA,CAAK,EAAE,GAAG,QAAA,EAAU,IAAA,EAAM,EAAE,IAAA,EAAM,QAAA,EAAU,WAAA,EAAY,EAAE,EAAG,GAAG,CAAA;AAAA,EAC3E,CAAA;AACF;AAEO,SAAS,gBAAgB,IAAA,EAAsB;AACpD,EAAA,OAAO,OAAO,CAAA,KAAkC;AAC9C,IAAA,MAAM,IAAA,GAAO,MAAM,eAAA,CAAgB,CAAA,EAAG,KAAK,eAAe,CAAA;AAC1D,IAAA,IAAI,IAAA,KAAS,aAAa,OAAO,CAAA,CAAE,KAAK,EAAE,KAAA,EAAO,8BAAA,EAA+B,EAAG,GAAG,CAAA;AACtF,IAAA,IAAI,IAAA,KAAS,QAAW,OAAO,CAAA,CAAE,KAAK,EAAE,KAAA,EAAO,4BAAA,EAA6B,EAAG,GAAG,CAAA;AAElF,IAAA,MAAM,aAAA,GAAgB,MAAM,wBAAA,CAAyB,CAAA,EAAG,IAAA,EAAM;AAAA,MAC5D,IAAA;AAAA,MACA,SAAA,EAAW,aAAA;AAAA,MACX,QAAA,EAAU,kBAAkB,CAAC;AAAA,KAC9B,CAAA;AACD,IAAA,IAAI,aAAA,KAAkB,MAAA,EAAW,OAAOE,aAAAA,CAAa,CAAC,CAAA;AACtD,IAAA,MAAM,QAAA,GAAW,eAAe,CAAC,CAAA;AACjC,IAAA,IAAI,QAAA,KAAa,QAAW,OAAO,CAAA,CAAE,KAAK,EAAE,KAAA,EAAO,+BAAA,EAAgC,EAAG,GAAG,CAAA;AAEzF,IAAA,MAAM,UAAA,GAAa,eAAe,IAAI,CAAA;AACtC,IAAA,MAAM,MAAA,GAAS,uBAAA,CAAwB,SAAA,CAAU,UAAU,CAAA;AAC3D,IAAA,IAAI,CAAC,MAAA,CAAO,OAAA,EAAS,OAAO,CAAA,CAAE,KAAK,EAAE,KAAA,EAAO,6BAAA,EAA8B,EAAG,GAAG,CAAA;AAChF,IAAA,MAAM,SAAS,aAAA,CAAc,QAAA,CAAS,MAAM,QAAA,CAAS,SAAA,EAAW,OAAO,IAAI,CAAA;AAC3E,IAAA,IAAI,MAAA,KAAW,QAAW,OAAO,CAAA,CAAE,KAAK,EAAE,KAAA,EAAO,2BAAA,EAA4B,EAAG,GAAG,CAAA;AAEnF,IAAA,MAAM,KAAA,GAA0B;AAAA,MAC9B,QAAA,EAAU,cAAc,MAAA,CAAO,QAAA;AAAA,MAC/B,WAAW,aAAA,CAAc,SAAA;AAAA,MACzB,WAAW,aAAA,CAAc,SAAA;AAAA,MACzB,UAAU,aAAA,CAAc,QAAA;AAAA,MACxB,iBAAiB,aAAA,CAAc,UAAA;AAAA,MAC/B,eAAe,aAAA,CAAc,QAAA;AAAA,MAC7B;AAAA,KACF;AACA,IAAA,IAAI;AACF,MAAA,MAAM,MAAA,GAAS,MAAM,IAAA,CAAK,KAAA,CAAM,OAAOF,eAAAA,CAAgB,aAAA,CAAc,MAAM,CAAA,EAAG,KAAK,CAAA;AACnF,MAAA,OAAO,CAAA,CAAE,IAAA,CAAK,MAAA,CAAO,QAAA,EAAU,GAAA,EAAK,EAAE,iBAAA,EAAmB,MAAA,CAAO,QAAA,GAAW,MAAA,GAAS,OAAA,EAAS,CAAA;AAAA,IAC/F,SAAS,MAAA,EAAQ;AACf,MAAA,OAAO,YAAA,CAAa,GAAG,MAAM,CAAA;AAAA,IAC/B;AAAA,EACF,CAAA;AACF;AAEA,SAAS,eACP,CAAA,EAC4E;AAC5E,EAAA,MAAM,IAAA,GAAO,CAAA,CAAE,GAAA,CAAI,KAAA,CAAM,MAAM,CAAA;AAC/B,EAAA,MAAM,SAAA,GAAY,CAAA,CAAE,GAAA,CAAI,KAAA,CAAM,KAAK,CAAA;AACnC,EAAA,IAAI,CAAC,kBAAA,CAAmB,QAAA,CAAS,IAAuB,GAAG,OAAO,MAAA;AAClE,EAAA,MAAM,SAAA,GAAY,oBAAA,CAAqB,SAAA,CAAU,SAAS,CAAA;AAC1D,EAAA,IAAI,CAAC,SAAA,CAAU,OAAA,EAAS,OAAO,MAAA;AAC/B,EAAA,OAAO,EAAE,IAAA,EAA+B,SAAA,EAAW,SAAA,CAAU,IAAA,EAAK;AACpE;AAEA,SAAS,kBAAkB,CAAA,EAAoB;AAC7C,EAAA,OAAO,CAAA,EAAG,CAAA,CAAE,GAAA,CAAI,KAAA,CAAM,MAAM,CAAA,IAAK,EAAE,CAAA,CAAA,EAAI,CAAA,CAAE,GAAA,CAAI,KAAA,CAAM,KAAK,KAAK,EAAE,CAAA,CAAA;AACjE;AAEA,SAAS,cAAc,CAAA,EAA4C;AACjE,EAAA,MAAM,GAAA,GAAM,IAAI,GAAA,CAAI,CAAA,CAAE,IAAI,GAAG,CAAA;AAC7B,EAAA,KAAA,MAAW,GAAA,IAAO,GAAA,CAAI,YAAA,CAAa,IAAA,EAAK,EAAG;AACzC,IAAA,IACG,GAAA,KAAQ,MAAA,IAAU,GAAA,KAAQ,QAAA,IAAY,GAAA,KAAQ,OAAA,IAC/C,GAAA,CAAI,YAAA,CAAa,MAAA,CAAO,GAAG,CAAA,CAAE,MAAA,KAAW,CAAA,EACxC;AACA,MAAA,OAAO,MAAA;AAAA,IACT;AAAA,EACF;AACA,EAAA,MAAM,IAAA,GAAO,GAAA,CAAI,YAAA,CAAa,GAAA,CAAI,MAAM,CAAA,IAAK,MAAA;AAC7C,EAAA,IAAI,SAAS,MAAA,IAAa,CAAC,mBAAmB,QAAA,CAAS,IAAuB,GAAG,OAAO,MAAA;AACxF,EAAA,MAAM,SAAA,GAAY,GAAA,CAAI,YAAA,CAAa,GAAA,CAAI,QAAQ,CAAA,IAAK,MAAA;AACpD,EAAA,IACE,SAAA,KAAc,MAAA,KACb,SAAA,CAAU,MAAA,KAAW,CAAA,IAAK,SAAA,CAAU,MAAA,GAAS,GAAA,IAAO,CAAC,qBAAA,CAAsB,IAAA,CAAK,SAAS,CAAA,CAAA,EAC1F;AACA,IAAA,OAAO,MAAA;AAAA,EACT;AACA,EAAA,MAAM,QAAA,GAAW,GAAA,CAAI,YAAA,CAAa,GAAA,CAAI,OAAO,CAAA,IAAK,MAAA;AAClD,EAAA,MAAM,KAAA,GAAQ,QAAA,KAAa,MAAA,GAAY,wBAAA,GAA2B,OAAO,QAAQ,CAAA;AACjF,EAAA,IAAI,CAAC,OAAO,aAAA,CAAc,KAAK,KAAK,KAAA,GAAQ,CAAA,IAAK,KAAA,GAAQ,wBAAA,EAA0B,OAAO,MAAA;AAC1F,EAAA,OAAO;AAAA,IACL,GAAI,IAAA,KAAS,MAAA,GAAY,EAAC,GAAI,EAAE,IAAA,EAA8B;AAAA,IAC9D,GAAI,SAAA,KAAc,MAAA,GAAY,EAAC,GAAI,EAAE,SAAA,EAAU;AAAA,IAC/C;AAAA,GACF;AACF;AAEA,SAAS,aAAA,CACP,IAAA,EACA,SAAA,EACA,OAAA,EACoE;AACpE,EAAA,IAAI,SAAS,eAAA,EAAiB;AAC5B,IAAA,IAAI,OAAA,CAAQ,WAAA,KAAgB,MAAA,EAAW,OAAO,MAAA;AAAA,EAChD,WAAW,OAAA,CAAQ,WAAA,KAAgB,MAAA,IAAa,OAAA,CAAQ,cAAc,MAAA,EAAW;AAC/E,IAAA,OAAO,MAAA;AAAA,EACT;AAEA,EAAA,MAAM,OAAA,GAAU,aAAa,IAAA,EAAM,SAAA,EAAW,QAAQ,IAAA,EAAM,OAAA,CAAQ,WAAA,EAAa,OAAA,CAAQ,KAAK,CAAA;AAC9F,EAAA,MAAM,SAAA,GAAA,CAAa,OAAA,CAAQ,SAAA,IAAa,EAAC,EAAG,GAAA;AAAA,IAAI,CAAC,QAAA,KAC/C,YAAA;AAAA,MACE,QAAA,CAAS,IAAA;AAAA,MACT,QAAA,CAAS,SAAA;AAAA,MACT,QAAA,CAAS,IAAA;AAAA,MACT,QAAA,CAAS,WAAA;AAAA,MACT,QAAA,CAAS;AAAA;AACX,GACF;AACA,EAAA,OAAO,CAAC,OAAA,EAAS,GAAG,SAAS,CAAA;AAC/B;AAEA,SAAS,YAAA,CACP,IAAA,EACA,SAAA,EACA,KAAA,EACA,aACA,KAAA,EACoB;AACpB,EAAA,MAAM,IAAA,GAAOG,WAAAA,CAAY,KAAA,CAAM,WAAW,CAAA;AAC1C,EAAA,MAAM,IAAA,GACJ,KAAA,CAAM,IAAA,KAAS,QAAA,GACV,EAAE,IAAA,EAAM,QAAA,EAAU,IAAA,EAAM,KAAA,CAAM,OAAA,EAAQ,GACtC,EAAE,IAAA,EAAM,UAAU,IAAA,EAAK;AAC9B,EAAA,MAAM,WACJ,KAAA,CAAM,IAAA,KAAS,QAAA,GACX,MAAA,CAAO,IAAI,WAAA,EAAY,CAAE,MAAA,CAAO,KAAA,CAAM,OAAO,CAAA,CAAE,UAAU,CAAA,GACzD,MAAA,CAAO,MAAM,QAAQ,CAAA;AAC3B,EAAA,IAAI,SAAS,eAAA,EAAiB;AAC5B,IAAA,OAAO,EAAE,IAAA,EAAM,SAAA,EAAW,WAAA,EAAa,MAAM,QAAA,EAAU,IAAA,EAAM,GAAI,KAAA,KAAU,MAAA,GAAY,EAAC,GAAI,EAAE,OAAM,EAAG;AAAA,EACzG;AACA,EAAA,IAAI,WAAA,KAAgB,MAAA,EAAW,MAAM,IAAI,MAAM,wCAAwC,CAAA;AACvF,EAAA,OAAO;AAAA,IACL,IAAA;AAAA,IACA,SAAA;AAAA,IACA,WAAA;AAAA,IACA,WAAA,EAAa,IAAA;AAAA,IACb,QAAA;AAAA,IACA,IAAA;AAAA,IACA,GAAI,KAAA,KAAU,MAAA,GAAY,EAAC,GAAI,EAAE,KAAA;AAAM,GACzC;AACF;AAEA,eAAe,wBAAA,CACb,CAAA,EACA,IAAA,EACA,OAAA,EACmC;AACnC,EAAA,MAAM,QAAQ,iBAAA,CAAkB,CAAA,CAAE,GAAA,CAAI,MAAA,CAAO,mBAAmB,CAAC,CAAA;AACjE,EAAA,IAAI,KAAA,KAAU,QAAW,OAAO,MAAA;AAChC,EAAA,MAAM,GAAA,GAAM,IAAI,GAAA,CAAI,CAAA,CAAE,IAAI,GAAG,CAAA;AAC7B,EAAA,OAAO,uBAAA;AAAA,IACL,KAAA;AAAA,IACA;AAAA,MACE,MAAA,EAAQ,EAAE,GAAA,CAAI,MAAA;AAAA,MACd,MAAM,CAAA,EAAG,GAAA,CAAI,QAAQ,CAAA,EAAG,IAAI,MAAM,CAAA,CAAA;AAAA,MAClC,WAAW,OAAA,CAAQ,SAAA;AAAA,MACnB,UAAU,OAAA,CAAQ,QAAA;AAAA,MAClB,MAAM,OAAA,CAAQ;AAAA,KAChB;AAAA,IACA,IAAA,CAAK;AAAA,GACP;AACF;AAEA,SAAS,kBAAkB,KAAA,EAAgD;AACzE,EAAA,IAAI,UAAU,MAAA,IAAa,KAAA,CAAM,WAAW,CAAA,IAAK,KAAA,CAAM,SAAS,6BAAA,EAA+B;AAC7F,IAAA,OAAO,MAAA;AAAA,EACT;AACA,EAAA,IAAI,CAAC,mBAAmB,IAAA,CAAK,KAAK,KAAK,KAAA,CAAM,MAAA,GAAS,CAAA,KAAM,CAAA,EAAG,OAAO,MAAA;AACtE,EAAA,IAAI;AACF,IAAA,MAAM,SAAS,KAAA,CAAM,OAAA,CAAQ,IAAA,EAAM,GAAG,EAAE,OAAA,CAAQ,IAAA,EAAM,GAAG,CAAA,GAAI,IAAI,MAAA,CAAA,CAAQ,CAAA,GAAK,KAAA,CAAM,MAAA,GAAS,KAAM,CAAC,CAAA;AACpG,IAAA,MAAM,MAAA,GAAS,KAAK,MAAM,CAAA;AAC1B,IAAA,MAAM,KAAA,GAAQ,WAAW,IAAA,CAAK,MAAA,EAAQ,CAAC,SAAA,KAAc,SAAA,CAAU,UAAA,CAAW,CAAC,CAAC,CAAA;AAC5E,IAAA,OAAO,IAAA,CAAK,KAAA,CAAM,IAAI,WAAA,CAAY,OAAA,EAAS,EAAE,KAAA,EAAO,IAAA,EAAM,CAAA,CAAE,MAAA,CAAO,KAAK,CAAC,CAAA;AAAA,EAC3E,CAAA,CAAA,MAAQ;AACN,IAAA,OAAO,MAAA;AAAA,EACT;AACF;AAEA,eAAe,eAAA,CACb,GACA,OAAA,EAC+C;AAC/C,EAAA,MAAM,MAAA,GAAS,CAAA,CAAE,GAAA,CAAI,MAAA,CAAO,gBAAgB,CAAA;AAC5C,EAAA,IAAI,WAAW,MAAA,EAAW;AACxB,IAAA,MAAM,MAAA,GAAS,OAAO,MAAM,CAAA;AAC5B,IAAA,IAAI,CAAC,MAAA,CAAO,aAAA,CAAc,MAAM,CAAA,IAAK,MAAA,GAAS,GAAG,OAAO,MAAA;AACxD,IAAA,IAAI,MAAA,GAAS,SAAS,OAAO,WAAA;AAAA,EAC/B;AACA,EAAA,IAAI;AACF,IAAA,MAAM,QAAQ,IAAI,UAAA,CAAW,MAAM,CAAA,CAAE,GAAA,CAAI,aAAa,CAAA;AACtD,IAAA,OAAO,KAAA,CAAM,UAAA,GAAa,OAAA,GAAU,WAAA,GAAc,KAAA;AAAA,EACpD,CAAA,CAAA,MAAQ;AACN,IAAA,OAAO,MAAA;AAAA,EACT;AACF;AAEA,SAAS,eAAe,KAAA,EAAwC;AAC9D,EAAA,IAAI;AACF,IAAA,OAAO,IAAA,CAAK,KAAA,CAAM,IAAI,WAAA,CAAY,OAAA,EAAS,EAAE,KAAA,EAAO,IAAA,EAAM,CAAA,CAAE,MAAA,CAAO,KAAK,CAAC,CAAA;AAAA,EAC3E,CAAA,CAAA,MAAQ;AACN,IAAA,OAAO,MAAA;AAAA,EACT;AACF;AAEA,SAASD,cAAa,CAAA,EAAsB;AAC1C,EAAA,OAAO,EAAE,IAAA,CAAK,EAAE,KAAA,EAAO,cAAA,IAAkB,GAAG,CAAA;AAC9C;AAEA,SAAS,YAAA,CAAa,GAAY,MAAA,EAA2B;AAC3D,EAAA,IAAIJ,mBAAAA,CAA6C,MAAM,CAAA,EAAG;AACxD,IAAA,MAAM,UACJ,MAAA,CAAO,OAAA,KAAY,SAAY,IAAA,GAAO,mBAAA,CAAoB,OAAO,OAAO,CAAA;AAC1E,IAAA,OAAO,CAAA,CAAE,IAAA,CAAK,EAAE,KAAA,EAAO,MAAA,CAAO,IAAA,EAAM,OAAA,EAAS,UAAA,EAAY,MAAA,CAAO,UAAA,EAAW,EAAG,GAAG,CAAA;AAAA,EACnF;AACA,EAAA,IAAI,kBAAA,CAAmB,MAAM,CAAA,EAAG;AAC9B,IAAA,OAAO,EAAE,IAAA,CAAK,EAAE,OAAO,MAAA,CAAO,IAAA,EAAM,GAAI,MAAA,CAAO,OAAA,KAAY,MAAA,GAAY,KAAK,EAAE,OAAA,EAAS,OAAO,OAAA,EAAQ,IAAM,GAAG,CAAA;AAAA,EACjH;AACA,EAAA,IAAIC,WAAAA,CAAY,MAAM,CAAA,EAAG;AACvB,IAAA,IAAKK,mBAAAA,CAA0C,QAAA,CAAS,MAAA,CAAO,IAAI,CAAA,EAAG;AACpE,MAAA,MAAM,OAAO,MAAA,CAAO,IAAA;AACpB,MAAA,OAAO,CAAA,CAAE,KAAK,EAAE,KAAA,EAAO,MAAK,EAAGC,yBAAAA,CAA0B,IAAI,CAAC,CAAA;AAAA,IAChE;AACA,IAAA,IAAI,MAAA,CAAO,IAAA,KAAS,6BAAA,IAAiC,MAAA,CAAO,SAAS,sBAAA,EAAwB;AAC3F,MAAA,OAAO,EAAE,IAAA,CAAK,EAAE,OAAO,MAAA,CAAO,IAAA,IAAQ,GAAG,CAAA;AAAA,IAC3C;AACA,IAAA,IAAI,MAAA,CAAO,IAAA,KAAS,sBAAA,EAAwB,OAAO,CAAA,CAAE,IAAA,CAAK,EAAE,KAAA,EAAO,MAAA,CAAO,IAAA,EAAK,EAAG,GAAG,CAAA;AAAA,EACvF;AACA,EAAA,MAAM,MAAA;AACR;ACtSO,IAAM,aAAA,GAAgB,CAAC,QAAA,EAAU,OAAA,EAAS,aAAa,QAAQ;AAG/D,IAAM,aAAA,GAAgB,CAAC,KAAA,EAAO,MAAA,EAAQ,KAAK;AAW3C,SAAS,SAAS,KAAA,EAAmE;AAC1F,EAAA,OAAO,CAAA,EAAG,KAAA,CAAM,MAAM,CAAA,CAAA,EAAI,MAAM,IAAI,CAAA,CAAA;AACtC;AAEO,IAAM,qBAAN,MAAyB;AAAA,EACrB,IAAA,GAAO,IAAI,IAAA,EAAK;AAAA,EAChB,UAA6B,EAAC;AAAA,EAEvC,QAAA,CAAS,YAA6B,OAAA,EAAkC;AACtE,IAAA,IAAI,CAAE,aAAA,CAAoC,QAAA,CAAS,UAAA,CAAW,KAAK,CAAA,EAAG;AACpE,MAAA,MAAM,IAAI,KAAA,CAAM,CAAA,MAAA,EAAS,QAAA,CAAS,UAAU,CAAC,CAAA,6BAAA,CAA+B,CAAA;AAAA,IAC9E;AACA,IAAA,IAAI,CAAE,aAAA,CAAoC,QAAA,CAAS,UAAA,CAAW,MAAM,CAAA,EAAG;AACrE,MAAA,MAAM,IAAI,KAAA,CAAM,CAAA,MAAA,EAAS,QAAA,CAAS,UAAU,CAAC,CAAA,2BAAA,CAA6B,CAAA;AAAA,IAC5E;AACA,IAAA,IAAI,IAAA,CAAK,OAAA,CAAQ,IAAA,CAAK,CAAC,QAAA,KAAa,QAAA,CAAS,QAAQ,CAAA,KAAM,QAAA,CAAS,UAAU,CAAC,CAAA,EAAG;AAChF,MAAA,MAAM,IAAI,KAAA,CAAM,CAAA,MAAA,EAAS,QAAA,CAAS,UAAU,CAAC,CAAA,sBAAA,CAAwB,CAAA;AAAA,IACvE;AACA,IAAA,IAAA,CAAK,OAAA,CAAQ,KAAK,UAAU,CAAA;AAC5B,IAAA,IAAA,CAAK,KAAK,EAAA,CAAG,UAAA,CAAW,MAAA,EAAQ,UAAA,CAAW,MAAM,OAAO,CAAA;AAAA,EAC1D;AAAA;AAAA,EAGA,IAAI,MAAA,GAAqC;AACvC,IAAA,OAAO,IAAA,CAAK,OAAA;AAAA,EACd;AAAA;AAAA,EAGA,IAAI,OAAA,GAAyE;AAC3E,IAAA,OAAO,IAAA,CAAK,IAAA,CAAK,MAAA,CAAO,GAAA,CAAI,CAAC,KAAA,MAAW,EAAE,MAAA,EAAQ,KAAA,CAAM,MAAA,EAAQ,IAAA,EAAM,KAAA,CAAM,MAAK,CAAE,CAAA;AAAA,EACrF;AAAA,EAEA,IAAI,KAAA,GAAgF;AAClF,IAAA,OAAO,KAAK,IAAA,CAAK,KAAA;AAAA,EACnB;AACF;ACxCO,SAAS,qBAAA,CAAsB,QAAgB,OAAA,EAAyC;AAC7F,EAAA,IAAI,QAAA;AACJ,EAAA,IAAI;AACF,IAAA,QAAA,GAAWC,cAAAA,CAAe,QAAQ,IAAI,CAAA;AAAA,EACxC,SAAS,KAAA,EAAO;AACd,IAAA,MAAM,IAAI,cAAA;AAAA,MACR,6BAAA;AAAA,MACA,iCAAiC,MAAM,CAAA,+CAAA,CAAA;AAAA,MACvC,EAAE,KAAA;AAAM,KACV;AAAA,EACF;AACA,EAAA,QAAQ,SAAS,IAAA;AAAM,IACrB,KAAK,eAAA;AACH,MAAA,OAAO;AAAA,QACL,MAAA;AAAA,QACA,KAAA,EAAO,UAAA;AAAA,QACP,OAAA,EAAS,SAAS,OAAA,CAAQ,OAAA;AAAA,QAC1B,UAAA,EAAY,SAAS,OAAA,CAAQ,UAAA;AAAA,QAC7B,GAAI,QAAA,CAAS,OAAA,CAAQ,YAAA,KAAiB,MAAA,GAClC,EAAE,YAAA,EAAc,QAAA,CAAS,OAAA,CAAQ,YAAA,EAAa,GAC9C,EAAC;AAAA,QACL,GAAI,QAAA,CAAS,OAAA,CAAQ,QAAA,KAAa,MAAA,GAAY,EAAE,QAAA,EAAU,QAAA,CAAS,OAAA,CAAQ,QAAA,EAAS,GAAI,EAAC;AAAA,QACzF,YAAY,OAAA,CAAQ;AAAA,OACtB;AAAA,IACF,KAAK,WAAA;AACH,MAAA,OAAO;AAAA,QACL,MAAA;AAAA,QACA,KAAA,EAAO,QAAA;AAAA,QACP,MAAA,EAAQ,SAAS,OAAA,CAAQ,MAAA;AAAA,QACzB,GAAI,QAAA,CAAS,OAAA,CAAQ,SAAA,KAAc,MAAA,GAC/B,EAAE,SAAA,EAAW,QAAA,CAAS,OAAA,CAAQ,SAAA,EAAU,GACxC,EAAC;AAAA,QACL,YAAY,OAAA,CAAQ;AAAA,OACtB;AAAA,IACF,KAAK,gBAAA;AACH,MAAA,OAAO;AAAA,QACL,MAAA;AAAA,QACA,KAAA,EAAO,WAAA;AAAA,QACP,GAAI,QAAA,CAAS,OAAA,CAAQ,MAAA,KAAW,MAAA,GAAY,EAAE,MAAA,EAAQ,QAAA,CAAS,OAAA,CAAQ,MAAA,EAAO,GAAI,EAAC;AAAA,QACnF,YAAY,OAAA,CAAQ;AAAA,OACtB;AAAA,IACF;AACE,MAAA,MAAM,IAAI,cAAA;AAAA,QACR,6BAAA;AAAA,QACA,CAAA,8BAAA,EAAiC,MAAM,CAAA,SAAA,EAAY,QAAA,CAAS,IAAI,CAAA,wCAAA;AAAA,OAClE;AAAA;AAEN;;;AC0CO,IAAM,2BAAA,GAA8B,MAAM,IAAA,GAAO;AAEjD,IAAM,yBAAA,GAA4B;AAElC,IAAM,6BAAA,GAAgC;AAEtC,IAAM,yBAAA,GAA4B;AA8HlC,SAAS,gBAAgB,OAAA,EAAsC;AACpE,EAAA,MAAM,WAAA,GAAc,gBAAA,CAAiB,OAAA,CAAQ,YAAY,CAAA;AACzD,EAAA,uBAAA;AAAA,IACE,WAAA;AAAA,IACA,OAAA,CAAQ,gBAAA;AAAA,IACR,OAAA,CAAQ,cAAA;AAAA,IACR,OAAA,CAAQ,oBAAA;AAAA,IACR,OAAA,CAAQ;AAAA,GACV;AACA,EAAA,MAAM,OAAwB,EAAE,IAAA,EAAM,QAAQ,IAAA,EAAM,KAAA,EAAO,QAAQ,KAAA,EAAM;AACzE,EAAA,MAAM,OAAkB,eAAA,CAAgB;AAAA,IACtC,QAAQ,OAAA,CAAQ,KAAA;AAAA,IAChB,QAAQ,OAAA,CAAQ,MAAA;AAAA,IAChB,OAAO,OAAA,CAAQ,KAAA;AAAA,IACf,aAAa,OAAA,CAAQ,WAAA;AAAA,IACrB,GAAI,QAAQ,qBAAA,KAA0B,MAAA,GAClC,EAAE,qBAAA,EAAuB,OAAA,CAAQ,qBAAA,EAAsB,GACvD;AAAC,GACN,CAAA;AAED,EAAA,MAAM,eAAA,GAAkB;AAAA,IACtB,IAAA;AAAA,IACA,MAAA,EAAQ,EAAE,WAAA,EAAa,OAAA,CAAQ,aAAa,OAAA,EAAS,OAAA,CAAQ,MAAM,OAAA;AAAQ,GAC7E;AAEA,EAAA,MAAM,QAAA,GAAW,IAAI,kBAAA,EAAmB;AACxC,EAAA,MAAM,cAAA,GAAiC;AAAA,IACrC,SAAA,EAAW,QAAQ,iBAAA,IAAqB,2BAAA;AAAA,IACxC,QAAA,EAAU,QAAQ,gBAAA,IAAoB,0BAAA;AAAA,IACtC,QAAA,EAAU,QAAQ,gBAAA,IAAoB,yBAAA;AAAA,IACtC,KAAA,EAAO,QAAQ,aAAA,IAAiB;AAAA,GAClC;AAGA,EAAA,QAAA,CAAS,QAAA,CAAS,EAAE,MAAA,EAAQ,MAAA,EAAQ,IAAA,EAAM,cAAA,EAAgB,KAAA,EAAO,QAAA,EAAS,EAAG,WAAA,CAAY,EAAE,IAAA,EAAM,CAAC,CAAA;AAClG,EAAA,QAAA,CAAS,QAAA,CAAS,EAAE,MAAA,EAAQ,MAAA,EAAQ,IAAA,EAAM,mBAAA,EAAqB,KAAA,EAAO,QAAA,EAAS,EAAG,gBAAA,CAAiB,EAAE,IAAA,EAAM,CAAC,CAAA;AAC5G,EAAA,QAAA,CAAS,QAAA,CAAS,EAAE,MAAA,EAAQ,MAAA,EAAQ,IAAA,EAAM,eAAA,EAAiB,KAAA,EAAO,QAAA,EAAS,EAAG,YAAA,CAAa,EAAE,IAAA,EAAM,CAAC,CAAA;AAIpG,EAAA,QAAA,CAAS,QAAA;AAAA,IACP,EAAE,MAAA,EAAQ,KAAA,EAAO,IAAA,EAAM,sBAAA,EAAwB,OAAO,QAAA,EAAS;AAAA,IAC/D,mBAAA,CAAoB,EAAE,WAAA,EAAa;AAAA,GACrC;AAEA,EAAA,IAAI,QAAA,CAAS,WAAA,EAAa,kBAAA,CAAmB,cAAc,CAAA,EAAG;AAC5D,IAAA,QAAA,CAAS,QAAA;AAAA,MACP,EAAE,MAAA,EAAQ,KAAA,EAAO,IAAA,EAAM,gBAAA,EAAkB,OAAO,QAAA,EAAS;AAAA,MACzD,aAAA,CAAc;AAAA,QACZ,GAAG,eAAA;AAAA,QACH,cAAA,EAAgB,QAAQ,cAAA,IAAkB,yBAAA;AAAA,QAC1C,kBAAA,EAAoB,QAAQ,kBAAA,IAAsB,6BAAA;AAAA,QAClD,SAAA,EAAW,QAAQ,eAAA,IAAmB;AAAA,OACvC;AAAA,KACH;AAAA,EACF;AAEA,EAAA,IAAI,QAAA,CAAS,WAAA,EAAa,kBAAA,CAAmB,aAAa,CAAA,EAAG;AAC3D,IAAA,QAAA,CAAS,QAAA;AAAA,MACP,EAAE,MAAA,EAAQ,MAAA,EAAQ,IAAA,EAAM,kBAAA,EAAoB,OAAO,QAAA,EAAS;AAAA,MAC5D,eAAA,CAAgB,EAAE,GAAG,eAAA,EAAiB,gBAAgB;AAAA,KACxD;AAAA,EACF;AAEA,EAAA,IAAI,QAAA,CAAS,WAAA,EAAa,kBAAA,CAAmB,iBAAiB,CAAA,EAAG;AAC/D,IAAA,MAAM,SAAA,GAAY;AAAA,MAChB,GAAG,eAAA;AAAA,MACH,SAAA,EAAW,QAAQ,cAAA,IAAkB;AAAA,KACvC;AACA,IAAA,QAAA,CAAS,QAAA,CAAS,EAAE,MAAA,EAAQ,KAAA,EAAO,IAAA,EAAM,eAAA,EAAiB,KAAA,EAAO,QAAA,EAAS,EAAG,gBAAA,CAAiB,SAAS,CAAC,CAAA;AACxG,IAAA,QAAA,CAAS,QAAA;AAAA,MACP,EAAE,MAAA,EAAQ,MAAA,EAAQ,IAAA,EAAM,sBAAA,EAAwB,OAAO,QAAA,EAAS;AAAA,MAChE,kBAAkB,eAAe;AAAA,KACnC;AACA,IAAA,QAAA,CAAS,QAAA;AAAA,MACP,EAAE,MAAA,EAAQ,MAAA,EAAQ,IAAA,EAAM,wBAAA,EAA0B,OAAO,QAAA,EAAS;AAAA,MAClE,oBAAoB,eAAe;AAAA,KACrC;AACA,IAAA,QAAA,CAAS,QAAA;AAAA,MACP,EAAE,MAAA,EAAQ,MAAA,EAAQ,IAAA,EAAM,uBAAA,EAAyB,OAAO,QAAA,EAAS;AAAA,MACjE,mBAAmB,eAAe;AAAA,KACpC;AAAA,EACF;AAEA,EAAA,IAAI,QAAA,CAAS,WAAA,EAAa,kBAAA,CAAmB,QAAQ,CAAA,EAAG;AACtD,IAAA,QAAA,CAAS,QAAA;AAAA,MACP,EAAE,MAAA,EAAQ,KAAA,EAAO,IAAA,EAAM,sBAAA,EAAwB,OAAO,QAAA,EAAS;AAAA,MAC/D,kBAAA,CAAmB;AAAA,QACjB,GAAG,eAAA;AAAA,QACH,SAAA,EAAW,QAAQ,cAAA,IAAkB,wBAAA;AAAA,QACrC,eAAA,EAAiB,QAAQ,0BAAA,IAA8B,sCAAA;AAAA,QACvD,mBAAA,EACE,QAAQ,8BAAA,IAAkC,0CAAA;AAAA,QAC5C,wBAAA,EACE,QAAQ,mCAAA,IACR;AAAA,OACH;AAAA,KACH;AAAA,EACF;AAEA,EAAA,IAAI,QAAA,CAAS,WAAA,EAAa,kBAAA,CAAmB,aAAa,CAAA,EAAG;AAC3D,IAAA,QAAA,CAAS,QAAA;AAAA,MACP,EAAE,MAAA,EAAQ,KAAA,EAAO,IAAA,EAAM,kBAAA,EAAoB,OAAO,QAAA,EAAS;AAAA,MAC3D,sBAAA,CAAuB;AAAA,QACrB,GAAG,eAAA;AAAA,QACH,KAAA,EAAO,QAAQ,aAAA,IAAiB,uBAAA;AAAA,QAChC,iBAAA,EACE,QAAQ,yBAAA,IAA6B,oCAAA;AAAA,QACvC,cAAA,EAAgB,QAAQ,sBAAA,IAA0B;AAAA,OACnD;AAAA,KACH;AAAA,EACF;AAEA,EAAA,IAAI,QAAA,CAAS,WAAA,EAAa,kBAAA,CAAmB,YAAY,CAAA,EAAG;AAC1D,IAAA,QAAA,CAAS,QAAA;AAAA,MACP,EAAE,MAAA,EAAQ,MAAA,EAAQ,IAAA,EAAM,kBAAA,EAAoB,OAAO,QAAA,EAAS;AAAA,MAC5D,sBAAsB,EAAE,GAAG,eAAA,EAAiB,MAAA,EAAQ,gBAAgB;AAAA,KACtE;AAAA,EACF;AAEA,EAAA,MAAM,iBAAiB,OAAA,CAAQ,cAAA;AAC/B,EAAA,MAAM,uBAAuB,OAAA,CAAQ,oBAAA;AACrC,EAAA,IACE,cAAA,KAAmB,UACnB,oBAAA,KAAyB,MAAA,IACzB,SAAS,WAAA,EAAa,kBAAA,CAAmB,YAAY,CAAA,EACrD;AACA,IAAA,MAAM,SAAA,GAAY;AAAA,MAChB,KAAA,EAAO;AAAA,QACL,OAAA,EAAS,QAAQ,KAAA,CAAM,OAAA;AAAA,QACvB,QAAQ,OAAA,CAAQ,MAAA;AAAA,QAChB,OAAO,OAAA,CAAQ;AAAA,OACjB;AAAA,MACA,KAAA,EAAO,cAAA;AAAA,MACP,eAAA,EAAiB,oBAAA;AAAA,MACjB,eAAA,EAAiB,QAAQ,oBAAA,IAAwB;AAAA,KACnD;AACA,IAAA,QAAA,CAAS,QAAA;AAAA,MACP,EAAE,MAAA,EAAQ,KAAA,EAAO,IAAA,EAAM,iBAAA,EAAmB,OAAO,OAAA,EAAQ;AAAA,MACzD,qBAAqB,SAAS;AAAA,KAChC;AACA,IAAA,QAAA,CAAS,QAAA;AAAA,MACP,EAAE,MAAA,EAAQ,KAAA,EAAO,IAAA,EAAM,iBAAA,EAAmB,OAAO,OAAA,EAAQ;AAAA,MACzD,gBAAgB,SAAS;AAAA,KAC3B;AACA,IAAA,QAAA,CAAS,QAAA;AAAA,MACP,EAAE,MAAA,EAAQ,KAAA,EAAO,IAAA,EAAM,iBAAA,EAAmB,OAAO,OAAA,EAAQ;AAAA,MACzD,gBAAgB,SAAS;AAAA,KAC3B;AAAA,EACF;AAMA,EAAA,MAAM,aAAa,OAAA,CAAQ,UAAA;AAC3B,EAAA,IAAI,eAAe,MAAA,IAAa,QAAA,CAAS,WAAA,EAAa,kBAAA,CAAmB,UAAU,CAAA,EAAG;AACpF,IAAA,MAAM,aAAA,GAAgB;AAAA,MACpB,QAAQ,eAAA,CAAgB,MAAA;AAAA,MACxB,UAAA;AAAA,MACA,SAAA,EAAW,QAAQ,kBAAA,IAAsB;AAAA,KAC3C;AACA,IAAA,QAAA,CAAS,QAAA;AAAA,MACP,EAAE,MAAA,EAAQ,KAAA,EAAO,IAAA,EAAM,qBAAA,EAAuB,OAAO,QAAA,EAAS;AAAA,MAC9D,qBAAqB,aAAa;AAAA,KACpC;AACA,IAAA,QAAA,CAAS,QAAA;AAAA,MACP,EAAE,MAAA,EAAQ,KAAA,EAAO,IAAA,EAAM,0BAAA,EAA4B,OAAO,QAAA,EAAS;AAAA,MACnE,qBAAqB,aAAa;AAAA,KACpC;AAAA,EACF;AAEA,EAAA,IAAI,QAAA,CAAS,WAAA,EAAa,kBAAA,CAAmB,cAAc,CAAA,EAAG;AAC5D,IAAA,MAAM,QAAA,GAAW;AAAA,MACf,GAAG,eAAA;AAAA,MACH,gBAAA,EAAkB,QAAQ,gBAAA,IAAoB;AAAA,KAChD;AACA,IAAA,QAAA,CAAS,QAAA,CAAS,EAAE,MAAA,EAAQ,MAAA,EAAQ,IAAA,EAAM,eAAA,EAAiB,KAAA,EAAO,QAAA,EAAS,EAAG,iBAAA,CAAkB,QAAQ,CAAC,CAAA;AACzG,IAAA,QAAA,CAAS,QAAA,CAAS,EAAE,MAAA,EAAQ,MAAA,EAAQ,IAAA,EAAM,wBAAA,EAA0B,KAAA,EAAO,QAAA,EAAS,EAAG,mBAAA,CAAoB,QAAQ,CAAC,CAAA;AACpH,IAAA,QAAA,CAAS,QAAA,CAAS,EAAE,MAAA,EAAQ,KAAA,EAAO,IAAA,EAAM,mBAAA,EAAqB,KAAA,EAAO,QAAA,EAAS,EAAG,sBAAA,CAAuB,QAAQ,CAAC,CAAA;AAAA,EACnH;AAqBA,EAAA,MAAM,eAAe,OAAA,CAAQ,gBAAA;AAC7B,EAAA,IAAI,iBAAiB,MAAA,IAAa,QAAA,CAAS,WAAA,EAAa,kBAAA,CAAmB,iBAAiB,CAAA,EAAG;AAC7F,IAAA,MAAM,WAAA,GAAc,EAAE,YAAA,EAAa;AACnC,IAAA,QAAA,CAAS,QAAA;AAAA,MACP,EAAE,MAAA,EAAQ,KAAA,EAAO,IAAA,EAAM,uBAAA,EAAyB,OAAO,WAAA,EAAY;AAAA,MACnE,yBAAyB,WAAW;AAAA,KACtC;AACA,IAAA,QAAA,CAAS,QAAA;AAAA,MACP,EAAE,MAAA,EAAQ,KAAA,EAAO,IAAA,EAAM,uBAAA,EAAyB,OAAO,WAAA,EAAY;AAAA,MACnE,2BAA2B,WAAW;AAAA,KACxC;AAAA,EACF;AAQA,EAAA,MAAM,UAAA,GAAa,QAAQ,UAAA,IAAc,MAAA;AAEzC,EAAA,SAAS,aAAa,MAAA,EAAyC;AAC7D,IAAA,OAAO,EAAE,IAAA,EAAM,eAAA,EAAiB,QAAA,EAAU,QAAQ,UAAA,EAAW;AAAA,EAC/D;AAEA,EAAA,eAAe,mBAAA,CACb,MAAA,EACA,QAAA,EACA,eAAA,EACA,aAAA,EACwB;AACxB,IAAA,MAAM,MAAA,GAAS,eAAA,CAAgB,YAAA,CAAa,MAAM,GAAG,IAAI,CAAA;AACzD,IAAA,MAAM,SAAS,eAAA,IAAmB,CAAA,KAAA,EAAQ,OAAA,CAAQ,MAAA,CAAO,YAAY,CAAA,CAAA;AACrE,IAAA,MAAM,SAAA,GAAY,OAAA,CAAQ,MAAA,CAAO,UAAA,EAAW;AAE5C,IAAA,MAAM,OAAA,GAAU,MAAM,MAAA,CAAO,OAAA,CAAQ,MAAA,CAAO;AAAA,MAC1C,QAAA;AAAA,MACA,SAAA;AAAA,MACA,WAAA,EAAa,OAAO,GAAA,KAAQ;AAI1B,QAAA,MAAMC,SAAAA,GAAW,aAAA,CAAc,MAAA,EAAQ,GAAA,EAAK,SAAS,CAAA;AACrD,QAAA,MAAM,IAAA,GAAOC,eAAeD,SAAQ,CAAA;AACpC,QAAA,MAAM,KAAA,GAAQ,IAAI,WAAA,EAAY,CAAE,OAAO,IAAI,CAAA;AAC3C,QAAA,OAAO;AAAA,UACL,IAAA;AAAA,UACA,UAAUJ,WAAAA,CAAY,MAAM,QAAQ,MAAA,CAAO,MAAA,CAAO,KAAK,CAAC,CAAA;AAAA,UACxD,QAAA,EAAU,MAAA,CAAO,KAAA,CAAM,MAAM;AAAA,SAC/B;AAAA,MACF;AAAA,KACD,CAAA;AACD,IAAA,MAAM,QAAA,GAAWG,cAAAA,CAAe,OAAA,CAAQ,IAAI,CAAA;AAC5C,IAAA,IAAI,QAAA,CAAS,GAAA,KAAQ,OAAA,CAAQ,GAAA,EAAK;AAChC,MAAA,MAAM,IAAI,cAAA;AAAA,QACR,sBAAA;AAAA,QACA,4BAA4B,MAAA,CAAO,QAAA,CAAS,GAAG,CAAC,CAAA,QAAA,EAAW,QAAQ,GAAG,CAAA,gDAAA;AAAA,OACxE;AAAA,IACF;AAEA,IAAA,MAAM,OAAA,GAAU,MAAM,MAAA,CAAO,KAAA,CAAM,KAAK,EAAE,MAAA,EAAQ,UAAU,CAAA;AAC5D,IAAA,OAAO,EAAE,MAAA,EAAQ,GAAA,EAAK,OAAA,CAAQ,GAAA,EAAK,UAAU,OAAA,EAAQ;AAAA,EACvD;AAEA,EAAA,OAAO;AAAA,IACL,OAAO,QAAA,CAAS,KAAA;AAAA,IAChB,QAAQ,QAAA,CAAS,MAAA;AAAA,IACjB,eAAe,QAAA,CAAS,OAAA;AAAA,IACxB,YAAA,EAAc,WAAA;AAAA,IAEd,iBAAA,CAAkB,QAAQ,KAAA,EAAO;AAC/B,MAAA,OAAO,IAAA,CAAK,iBAAA,CAAkB,MAAA,EAAQ,KAAK,CAAA;AAAA,IAC7C,CAAA;AAAA,IAEA,MAAM,YAAA,CAAa,MAAA,EAAQ,QAAA,EAAU,KAAA,EAAO;AAC1C,MAAA,OAAO,mBAAA;AAAA,QAAoB,MAAA;AAAA,QAAQ,QAAA;AAAA,QAAU,KAAA,CAAM,MAAA;AAAA,QAAQ,CAAC,MAAA,EAAQ,GAAA,EAAK,SAAA,KACvE,cAAA,CAAe,YAAA,EAAc,KAAA,CAAM,OAAA,EAAS,EAAE,EAAA,EAAI,SAAA,EAAW,MAAA,EAAQ,KAAK;AAAA,OAC5E;AAAA,IACF,CAAA;AAAA,IAEA,MAAM,mBAAA,CAAoB,MAAA,EAAQ,QAAA,EAAU,KAAA,EAAO;AACjD,MAAA,OAAO,mBAAA;AAAA,QAAoB,MAAA;AAAA,QAAQ,QAAA;AAAA,QAAU,KAAA,CAAM,MAAA;AAAA,QAAQ,CAAC,MAAA,EAAQ,GAAA,EAAK,SAAA,KACvE,cAAA,CAAe,0BAAA,EAA4B,KAAA,CAAM,OAAA,EAAS,EAAE,EAAA,EAAI,SAAA,EAAW,MAAA,EAAQ,KAAK;AAAA,OAC1F;AAAA,IACF,CAAA;AAAA,IAEA,eAAA,CAAgB,QAAQ,MAAA,EAAQ;AAC9B,MAAA,OAAO,eAAA,CAAgB,aAAa,MAAM,CAAA,EAAG,IAAI,CAAA,CAAE,KAAA,CAAM,IAAI,MAAM,CAAA;AAAA,IACrE,CAAA;AAAA,IAEA,mBAAA,CAAoB,QAAQ,MAAA,EAAQ;AAClC,MAAA,OAAO,eAAA,CAAgB,YAAA,CAAa,MAAM,CAAA,EAAG,IAAI,EAAE,QAAA,CAAS,GAAA,CAAI,kBAAA,CAAmB,MAAM,CAAC,CAAA;AAAA,IAC5F,CAAA;AAAA,IAEA,MAAM,cAAA,CAAe,MAAA,EAAQ,MAAA,EAAQ;AACnC,MAAA,MAAM,OAAA,GAAU,MAAM,eAAA,CAAgB,YAAA,CAAa,MAAM,CAAA,EAAG,IAAI,EAAE,QAAA,CAAS,GAAA;AAAA,QACzE,mBAAmB,MAAM;AAAA,OAC3B;AACA,MAAA,OAAO,OAAA,KAAY,MAAA,GAAY,MAAA,GAAY,qBAAA,CAAsB,QAAQ,OAAO,CAAA;AAAA,IAClF,CAAA;AAAA,IAEA,YAAY,MAAA,EAAQ;AAClB,MAAA,OAAO,gBAAgB,YAAA,CAAa,MAAM,GAAG,IAAI,CAAA,CAAE,QAAQ,IAAA,EAAK;AAAA,IAClE,CAAA;AAAA,IAEA,YAAA,CAAa,QAAQ,QAAA,EAAU;AAC7B,MAAA,OAAO,eAAA,CAAgB,aAAa,MAAM,CAAA,EAAG,IAAI,CAAA,CAAE,OAAA,CAAQ,OAAO,QAAQ,CAAA;AAAA,IAC5E,CAAA;AAAA,IAEA,eAAA,CAAgB,QAAQ,KAAA,EAAO;AAC7B,MAAA,iBAAA,CAAkB,KAAA,CAAM,OAAA,EAAS,KAAA,CAAM,KAAA,EAAO;AAAA,QAC5C,eAAA,EAAiB,QAAQ,oBAAA,IAAwB,+BAAA;AAAA,QACjD,aAAA,EAAe,QAAQ,kBAAA,IAAsB;AAAA,OAC9C,CAAA;AACD,MAAA,OAAO,eAAA,CAAgB,aAAa,MAAM,CAAA,EAAG,IAAI,CAAA,CAAE,KAAA,CAAM,OAAO,KAAK,CAAA;AAAA,IACvE,CAAA;AAAA,IAEA,cAAA,CAAe,QAAQ,KAAA,EAAO;AAC5B,MAAA,OAAO,eAAA,CAAgB,aAAa,MAAM,CAAA,EAAG,IAAI,CAAA,CAAE,KAAA,CAAM,KAAK,KAAK,CAAA;AAAA,IACrE,CAAA;AAAA,IAEA,eAAA,CAAgB,QAAQ,MAAA,EAAQ;AAC9B,MAAA,OAAO,gBAAgB,YAAA,CAAa,MAAM,GAAG,IAAI,CAAA,CAAE,MAAM,YAAA,CAAa;AAAA,QACpE,MAAA;AAAA,QACA,cAAA,EAAgB,WAAA;AAAA,QAChB,MAAA,EAAQ;AAAA,OACT,CAAA;AAAA,IACH,CAAA;AAAA,IAEA,aAAa,MAAA,EAAQ;AACnB,MAAA,OAAO,gBAAgB,YAAA,CAAa,MAAM,GAAG,IAAI,CAAA,CAAE,SAAS,IAAA,EAAK;AAAA,IACnE,CAAA;AAAA,IAEA,YAAA,CAAa,QAAQ,MAAA,EAAQ;AAC3B,MAAA,OAAO,eAAA,CAAgB,aAAa,MAAM,CAAA,EAAG,IAAI,CAAA,CAAE,QAAA,CAAS,KAAK,MAAM,CAAA;AAAA,IACzE,CAAA;AAAA,IAEA,oBAAA,CAAqB,QAAQ,MAAA,EAAQ;AACnC,MAAA,OAAO,eAAA,CAAgB,aAAa,MAAM,CAAA,EAAG,IAAI,CAAA,CAAE,SAAA,CAAU,KAAK,MAAM,CAAA;AAAA,IAC1E;AAAA,GACF;AACF;AAaA,SAAS,uBAAA,CACP,WAAA,EACA,YAAA,EACA,cAAA,EACA,sBACA,UAAA,EACM;AACN,EAAA,IACE,QAAA,CAAS,WAAA,EAAa,kBAAA,CAAmB,QAAQ,CAAA,IACjD,CAAC,QAAA,CAAS,WAAA,EAAa,kBAAA,CAAmB,iBAAiB,CAAA,EAC3D;AACA,IAAA,MAAM,IAAI,cAAA;AAAA,MACR,0BAAA;AAAA,MACA,CAAA,EAAG,kBAAA,CAAmB,QAAQ,CAAA,UAAA,EAAa,mBAAmB,iBAAiB,CAAA,yEAAA;AAAA,KACjF;AAAA,EACF;AACA,EAAA,IAAI,iBAAiB,MAAA,IAAa,QAAA,CAAS,WAAA,EAAa,kBAAA,CAAmB,iBAAiB,CAAA,EAAG;AAC7F,IAAA,MAAM,IAAI,cAAA;AAAA,MACR,0BAAA;AAAA,MACA,CAAA,yBAAA,EAA4B,mBAAmB,iBAAiB,CAAA,2GAAA;AAAA,KAClE;AAAA,EACF;AACA,EAAA,IAAI,mBAAmB,MAAA,IAAa,QAAA,CAAS,WAAA,EAAa,kBAAA,CAAmB,YAAY,CAAA,EAAG;AAC1F,IAAA,MAAM,IAAI,cAAA;AAAA,MACR,0BAAA;AAAA,MACA,CAAA,yBAAA,EAA4B,mBAAmB,YAAY,CAAA,wCAAA;AAAA,KAC7D;AAAA,EACF;AACA,EAAA,IAAI,yBAAyB,MAAA,IAAa,QAAA,CAAS,WAAA,EAAa,kBAAA,CAAmB,YAAY,CAAA,EAAG;AAChG,IAAA,MAAM,IAAI,cAAA;AAAA,MACR,0BAAA;AAAA,MACA,CAAA,yBAAA,EAA4B,mBAAmB,YAAY,CAAA,oEAAA;AAAA,KAC7D;AAAA,EACF;AACA,EAAA,IAAI,eAAe,MAAA,IAAa,QAAA,CAAS,WAAA,EAAa,kBAAA,CAAmB,UAAU,CAAA,EAAG;AACpF,IAAA,MAAM,IAAI,cAAA;AAAA,MACR,0BAAA;AAAA,MACA,CAAA,yBAAA,EAA4B,mBAAmB,UAAU,CAAA,mGAAA;AAAA,KAC3D;AAAA,EACF;AACF;AAEA,SAAS,iBAAiB,WAAA,EAA2D;AACnF,EAAA,IAAI;AACF,IAAA,OAAO,2BAA2B,WAAW,CAAA;AAAA,EAC/C,SAAS,KAAA,EAAO;AACd,IAAA,MAAM,IAAI,cAAA;AAAA,MACR,gCAAA;AAAA,MACA,oGAAA;AAAA,MACA,EAAE,KAAA;AAAM,KACV;AAAA,EACF;AACF;;;ACjpBO,IAAM,sBAAN,MAAwD;AAAA,EAC7D,MAAM,OAAA,CAAQ,OAAA,EAAmB,SAAA,EAAqC;AACpE,IAAA,OAAO,IAAA;AAAA,EACT;AACF;ACyBO,IAAM,eAAA,GAAkB,KAAK,EAAA,GAAK;AAEzC,IAAM,oBAAA,GAAuB,EAAA;AAuB7B,IAAM,uBAAN,MAA2B;AAAA,EAChB,KAAA,uBAAY,GAAA,EAAwB;AAAA,EACpC,gBAAA,uBAAuB,GAAA,EAAoB;AAAA,EAC3C,KAAA;AAAA,EACA,MAAA;AAAA,EACA,MAAA;AAAA,EACA,QAAA;AAAA,EAET,WAAA,CAAY,KAAA,EAAc,MAAA,EAAqB,OAAA,EAAmC;AAChF,IAAA,IAAA,CAAK,KAAA,GAAQ,KAAA;AACb,IAAA,IAAA,CAAK,MAAA,GAAS,MAAA;AACd,IAAA,IAAA,CAAK,SAAS,UAAA,CAAW,MAAA,CAAO,gBAAgB,IAAI,UAAA,CAAW,oBAAoB,CAAC,CAAA;AACpF,IAAA,IAAA,CAAK,QAAA,GAAW,QAAQ,QAAA,IAAY,eAAA;AAAA,EACtC;AAAA,EAEA,MAAM,OAAA,CAAQ,MAAA,EAAgB,MAAA,EAAwC;AACpE,IAAA,MAAM,MAAM,IAAA,CAAK,KAAA,CAAM,KAAI,CAAE,OAAA,KAAY,IAAA,CAAK,QAAA;AAC9C,IAAA,MAAM,MAAM,MAAM,IAAA,CAAK,UAAA,CAAW,MAAA,EAAQ,QAAQ,GAAG,CAAA;AACrD,IAAA,OAAO,GAAG,mBAAA,CAAoB,MAAM,CAAC,CAAA,KAAA,EAAQ,GAAG,QAAQ,GAAG,CAAA,CAAA;AAAA,EAC7D;AAAA,EAEA,UAAA,CAAW,MAAA,EAAgB,MAAA,EAAuB,GAAA,EAA8B;AAC9E,IAAA,OAAO,IAAA,CAAK,MAAA,CAAO,UAAA,CAAW,IAAA,CAAK,MAAA,EAAQ,CAAA,EAAG,MAAM,CAAA,CAAA,EAAI,MAAM,CAAA,CAAA,EAAI,GAAG,CAAA,CAAE,CAAA;AAAA,EACzE;AACF,CAAA;AAGO,IAAM,yBAAN,MAAuD;AAAA,EACnD,SAAA;AAAA,EACA,QAAA;AAAA,EAET,WAAA,CAAY,UAAgC,OAAA,EAAsB;AAChE,IAAA,IAAA,CAAK,SAAA,GAAY,QAAA;AACjB,IAAA,IAAA,CAAK,QAAA,GAAW,OAAA;AAAA,EAClB;AAAA,EAEA,MAAM,YAAA,CAAa,MAAA,EAAkB,WAAA,EAAiF;AACpH,IAAA,oBAAA,CAAqB,QAAQ,WAAW,CAAA;AACxC,IAAA,MAAM,cAAA,GAAiB,CAAA,EAAG,MAAM,CAAA,EAAA,EAAS,YAAY,aAAa,CAAA,CAAA;AAClE,IAAA,MAAM,cAAA,GAAiB,IAAA,CAAK,SAAA,CAAU,gBAAA,CAAiB,IAAI,cAAc,CAAA;AACzE,IAAA,IAAI,mBAAmB,MAAA,EAAW;AAChC,MAAA,MAAM,WAAW,MAAM,IAAA,CAAK,SAAS,GAAA,CAAI,MAAA,EAAQ,YAAY,WAAW,CAAA;AACxE,MAAA,IAAI,QAAA,EAAU,UAAU,WAAA,EAAa;AACnC,QAAA,MAAM,IAAI,aAAA;AAAA,UACR,sBAAA;AAAA,UACA,CAAA,OAAA,EAAU,YAAY,WAAW,CAAA,oCAAA;AAAA,SACnC;AAAA,MACF;AACA,MAAA,OAAO,EAAE,MAAA,EAAQ,cAAA,EAAgB,SAAA,EAAW,MAAM,KAAK,SAAA,CAAU,OAAA,CAAQ,cAAA,EAAgB,KAAK,CAAA,EAAE;AAAA,IAClG;AAEA,IAAA,MAAM,KAAA,GAAQ,MAAM,IAAA,CAAK,QAAA,CAAS,YAAY,MAAA,EAAQ;AAAA,MACpD,MAAM,WAAA,CAAY,WAAA;AAAA,MAClB,UAAU,WAAA,CAAY,aAAA;AAAA,MACtB,aAAa,WAAA,CAAY;AAAA,KAC1B,CAAA;AACD,IAAA,IACE,MAAM,QAAA,KAAa,WAAA,CAAY,iBAC/B,KAAA,CAAM,WAAA,KAAgB,YAAY,WAAA,EAClC;AACA,MAAA,MAAM,IAAI,aAAA;AAAA,QACR,4BAAA;AAAA,QACA,CAAA,OAAA,EAAU,YAAY,WAAW,CAAA,+CAAA;AAAA,OACnC;AAAA,IACF;AACA,IAAA,IAAI,KAAA,CAAM,UAAU,WAAA,EAAa;AAC/B,MAAA,MAAM,IAAI,aAAA;AAAA,QACR,sBAAA;AAAA,QACA,CAAA,OAAA,EAAU,YAAY,WAAW,CAAA,oCAAA;AAAA,OACnC;AAAA,IACF;AAEA,IAAA,MAAM,SAAS,CAAA,KAAA,EAAQ,IAAA,CAAK,SAAA,CAAU,MAAA,CAAO,YAAY,CAAA,CAAA;AACzD,IAAA,IAAA,CAAK,SAAA,CAAU,KAAA,CAAM,GAAA,CAAI,MAAA,EAAQ;AAAA,MAC/B,QAAA,EAAU,MAAA;AAAA,MACV,eAAe,WAAA,CAAY,aAAA;AAAA,MAC3B,aAAa,WAAA,CAAY,WAAA;AAAA,MACzB,UAAU,WAAA,CAAY,aAAA;AAAA,MACtB,aAAa,WAAA,CAAY,WAAA;AAAA,MACzB,QAAA,EAAU;AAAA,KACX,CAAA;AACD,IAAA,IAAA,CAAK,SAAA,CAAU,gBAAA,CAAiB,GAAA,CAAI,cAAA,EAAgB,MAAM,CAAA;AAC1D,IAAA,OAAO,EAAE,QAAQ,SAAA,EAAW,MAAM,KAAK,SAAA,CAAU,OAAA,CAAQ,MAAA,EAAQ,KAAK,CAAA,EAAE;AAAA,EAC1E;AAAA,EAEA,MAAM,aAAA,CACJ,MAAA,EACA,MAAA,EACA,WAAA,EACsC;AACtC,IAAA,MAAM,MAAA,GAAS,IAAA,CAAK,SAAA,CAAU,KAAA,CAAM,IAAI,MAAM,CAAA;AAC9C,IAAA,IACE,WAAW,MAAA,IACX,MAAA,CAAO,aAAa,MAAA,IACpB,WAAA,CAAY,aAAa,MAAA,IACzB,MAAA,CAAO,aAAA,KAAkB,WAAA,CAAY,iBACrC,MAAA,CAAO,WAAA,KAAgB,YAAY,WAAA,IACnC,CAAC,OAAO,QAAA,EACR;AACA,MAAA,OAAO,MAAA;AAAA,IACT;AACA,IAAA,OAAO;AAAA,MACL,gBAAA,EAAkB,MAAA,CAAO,MAAA,CAAO,IAAA,EAAM,UAAU,CAAC,CAAA;AAAA,MACjD,qBAAqB,MAAA,CAAO;AAAA,KAC9B;AAAA,EACF;AAAA,EAEA,MAAM,cAAA,CAAe,MAAA,EAAkB,MAAA,EAA6C;AAClF,IAAA,MAAM,MAAA,GAAS,IAAA,CAAK,SAAA,CAAU,KAAA,CAAM,IAAI,MAAM,CAAA;AAE9C,IAAA,IAAI,MAAA,KAAW,UAAa,MAAA,CAAO,QAAA,KAAa,UAAU,CAAC,MAAA,CAAO,UAAU,OAAO,MAAA;AACnF,IAAA,MAAM,WAAW,MAAM,IAAA,CAAK,SAAS,GAAA,CAAI,MAAA,EAAQ,OAAO,WAAW,CAAA;AACnE,IAAA,IAAI,QAAA,EAAU,KAAA,KAAU,WAAA,EAAa,OAAO,MAAA;AAC5C,IAAA,OAAO,IAAA,CAAK,SAAA,CAAU,OAAA,CAAQ,MAAA,EAAQ,KAAK,CAAA;AAAA,EAC7C;AACF;AAGO,IAAM,2BAAN,MAA2D;AAAA,EACvD,SAAA;AAAA,EAET,YAAY,QAAA,EAAgC;AAC1C,IAAA,IAAA,CAAK,SAAA,GAAY,QAAA;AAAA,EACnB;AAAA,EAEA,MAAM,eAAA,CAAgB,MAAA,EAAgB,MAAA,EAAuB,KAAa,GAAA,EAA+B;AACvG,IAAA,IAAI,CAAC,MAAA,CAAO,QAAA,CAAS,GAAG,CAAA,IAAK,IAAA,CAAK,SAAA,CAAU,KAAA,CAAM,GAAA,EAAI,CAAE,OAAA,EAAQ,GAAI,KAAK,OAAO,KAAA;AAChF,IAAA,MAAM,WAAW,MAAM,IAAA,CAAK,UAAU,UAAA,CAAW,MAAA,EAAQ,QAAQ,GAAG,CAAA;AACpE,IAAA,OAAO,IAAA,CAAK,SAAA,CAAU,MAAA,CAAO,eAAA,CAAgB,UAAU,GAAG,CAAA;AAAA,EAC5D;AAAA,EAEA,MAAM,YAAA,CAAa,MAAA,EAAgB,IAAA,EAA4C;AAC7E,IAAA,MAAM,MAAA,GAAS,IAAA,CAAK,SAAA,CAAU,KAAA,CAAM,IAAI,MAAM,CAAA;AAC9C,IAAA,IAAI,WAAW,MAAA,EAAW,OAAO,EAAE,EAAA,EAAI,KAAA,EAAO,QAAQ,gBAAA,EAAiB;AACvE,IAAA,IAAI,MAAA,CAAO,IAAA,CAAK,MAAM,CAAA,KAAM,OAAO,QAAA,EAAU;AAC3C,MAAA,OAAO,EAAE,EAAA,EAAI,KAAA,EAAO,MAAA,EAAQ,CAAA,wBAAA,EAA2B,MAAA,CAAO,MAAA,CAAO,QAAQ,CAAC,CAAA,WAAA,EAAc,IAAA,CAAK,MAAM,CAAA,CAAA,EAAG;AAAA,IAC5G;AACA,IAAA,MAAM,aAAa,MAAM,IAAA,CAAK,SAAA,CAAU,MAAA,CAAO,OAAO,IAAI,CAAA;AAC1D,IAAA,IAAI,UAAA,KAAe,OAAO,WAAA,EAAa;AACrC,MAAA,OAAO,EAAE,EAAA,EAAI,KAAA,EAAO,MAAA,EAAQ,sBAAA,EAAuB;AAAA,IACrD;AACA,IAAA,MAAA,CAAO,IAAA,GAAO,IAAA;AACd,IAAA,MAAA,CAAO,QAAA,GAAW,IAAA;AAClB,IAAA,OAAO,EAAE,IAAI,IAAA,EAAK;AAAA,EACpB;AAAA,EAEA,MAAM,YAAY,MAAA,EAAkD;AAClE,IAAA,MAAM,MAAA,GAAS,IAAA,CAAK,SAAA,CAAU,KAAA,CAAM,IAAI,MAAM,CAAA;AAC9C,IAAA,IAAI,MAAA,KAAW,UAAa,CAAC,MAAA,CAAO,YAAY,MAAA,CAAO,IAAA,KAAS,QAAW,OAAO,MAAA;AAClF,IAAA,OAAO,EAAE,IAAA,EAAM,MAAA,CAAO,IAAA,EAAM,WAAA,EAAa,OAAO,WAAA,EAAY;AAAA,EAC9D;AACF;AAQO,SAAS,oBACd,KAAA,EACA,MAAA,EACA,OAAA,EACA,OAAA,GAAoC,EAAC,EACtB;AACf,EAAA,MAAM,QAAA,GAAW,IAAI,oBAAA,CAAqB,KAAA,EAAO,QAAQ,OAAO,CAAA;AAChE,EAAA,OAAO;AAAA,IACL,KAAA,EAAO,IAAI,sBAAA,CAAuB,QAAA,EAAU,OAAO,CAAA;AAAA,IACnD,YAAA,EAAc,IAAI,wBAAA,CAAyB,QAAQ;AAAA,GACrD;AACF;AAEA,SAAS,oBAAA,CAAqB,QAAkB,WAAA,EAAuC;AACrF,EAAA,IACE,WAAA,CAAY,QAAA,KAAa,MAAA,IACzB,WAAA,CAAY,IAAA,KAAS,QAAA,IACrB,WAAA,CAAY,KAAA,KAAU,UAAA,IACtB,WAAA,CAAY,aAAA,IAAiB,EAAA,EAC7B;AACA,IAAA;AAAA,EACF;AACA,EAAA,MAAM,IAAI,aAAA;AAAA,IACR,4BAAA;AAAA,IACA;AAAA,GACF;AACF;AC9OO,IAAM,0BAAN,MAAyD;AAAA,EACrD,SAAA,uBAAgB,GAAA,EAA0B;AAAA,EAC1C,WAAA,uBAAkB,GAAA,EAAoB;AAAA,EAE/C,MAAM,QAAA,CAAS,MAAA,EAAkB,KAAA,EAAkD;AACjF,IAAA,MAAM,MAAA,GAAuB;AAAA,MAC3B,QAAA,EAAU,MAAA;AAAA,MACV,WAAW,KAAA,CAAM,SAAA;AAAA,MACjB,UAAU,KAAA,CAAM,QAAA;AAAA,MAChB,YAAY,KAAA,CAAM,UAAA;AAAA,MAClB,iBAAiB,KAAA,CAAM,eAAA;AAAA,MACvB,YAAY,KAAA,CAAM,UAAA;AAAA,MAClB,eAAe,KAAA,CAAM,aAAA;AAAA,MACrB,OAAA,EAAS;AAAA,KACX;AACA,IAAA,MAAM,GAAA,GAAMT,SAAAA,CAAU,MAAA,EAAQ,MAAA,CAAO,QAAQ,CAAA;AAC7C,IAAA,IAAA,CAAK,SAAA,CAAU,GAAA,CAAI,GAAA,EAAK,MAAM,CAAA;AAC9B,IAAA,IAAA,CAAK,WAAA,CAAY,GAAA,CAAI,MAAA,CAAO,QAAA,EAAU,GAAG,CAAA;AACzC,IAAA,OAAO,MAAA;AAAA,EACT;AAAA,EAEA,MAAM,GAAA,CAAI,MAAA,EAAkB,QAAA,EAAqD;AAC/E,IAAA,OAAO,KAAK,SAAA,CAAU,GAAA,CAAIA,SAAAA,CAAU,MAAA,EAAQ,QAAQ,CAAC,CAAA;AAAA,EACvD;AAAA,EAEA,MAAM,MAAA,CAAO,MAAA,EAAkB,QAAA,EAAiC;AAC9D,IAAA,MAAM,GAAA,GAAMA,SAAAA,CAAU,MAAA,EAAQ,QAAQ,CAAA;AACtC,IAAA,MAAM,MAAA,GAAS,IAAA,CAAK,SAAA,CAAU,GAAA,CAAI,GAAG,CAAA;AACrC,IAAA,IAAI,WAAW,MAAA,EAAW;AAC1B,IAAA,IAAA,CAAK,SAAA,CAAU,IAAI,GAAA,EAAK,EAAE,GAAG,MAAA,EAAQ,OAAA,EAAS,MAAM,CAAA;AAAA,EACtD;AAAA,EAEA,MAAM,KAAK,MAAA,EAAoD;AAC7D,IAAA,MAAM,MAAA,GAASA,SAAAA,CAAU,MAAA,EAAQ,EAAE,CAAA;AACnC,IAAA,OAAO,CAAC,GAAG,IAAA,CAAK,SAAA,CAAU,SAAS,CAAA,CAChC,MAAA,CAAO,CAAC,CAAC,GAAG,MAAM,GAAA,CAAI,UAAA,CAAW,MAAM,CAAC,CAAA,CACxC,GAAA,CAAI,CAAC,GAAG,MAAM,CAAA,KAAM,MAAM,CAAA;AAAA,EAC/B;AAAA,EAEA,MAAM,kBAAkB,QAAA,EAAqD;AAC3E,IAAA,MAAM,GAAA,GAAM,IAAA,CAAK,WAAA,CAAY,GAAA,CAAI,QAAQ,CAAA;AACzC,IAAA,OAAO,QAAQ,MAAA,GAAY,MAAA,GAAY,IAAA,CAAK,SAAA,CAAU,IAAI,GAAG,CAAA;AAAA,EAC/D;AACF;AC3CO,IAAM,mBAAA,GAAsB;AAE5B,IAAM,4BAAN,MAA6D;AAAA,EACzD,MAAA,uBAAa,GAAA,EAAyB;AAAA,EACtC,SAAA;AAAA,EAET,WAAA,CAAY,WAAmB,mBAAA,EAAqB;AAClD,IAAA,IAAA,CAAK,SAAA,GAAY,QAAA;AAAA,EACnB;AAAA,EAEA,MAAM,cAAA,CAAe,MAAA,EAAkB,QAAA,EAAkB,UAAA,EAAsC;AAC7F,IAAA,MAAM,GAAA,GAAMA,SAAAA,CAAU,MAAA,EAAQ,QAAQ,CAAA;AACtC,IAAA,IAAI,IAAA,GAAO,IAAA,CAAK,MAAA,CAAO,GAAA,CAAI,GAAG,CAAA;AAC9B,IAAA,IAAI,SAAS,MAAA,EAAW;AACtB,MAAA,IAAA,uBAAW,GAAA,EAAY;AACvB,MAAA,IAAA,CAAK,MAAA,CAAO,GAAA,CAAI,GAAA,EAAK,IAAI,CAAA;AAAA,IAC3B;AACA,IAAA,IAAI,IAAA,CAAK,GAAA,CAAI,UAAU,CAAA,EAAG,OAAO,IAAA;AACjC,IAAA,IAAA,CAAK,IAAI,UAAU,CAAA;AACnB,IAAA,IAAI,IAAA,CAAK,IAAA,GAAO,IAAA,CAAK,SAAA,EAAW;AAC9B,MAAA,MAAM,MAAA,GAAS,IAAA,CAAK,MAAA,EAAO,CAAE,MAAK,CAAE,KAAA;AACpC,MAAA,IAAI,MAAA,KAAW,MAAA,EAAW,IAAA,CAAK,MAAA,CAAO,MAAM,CAAA;AAAA,IAC9C;AACA,IAAA,OAAO,KAAA;AAAA,EACT;AACF;ACxBO,IAAM,YAAA,GAAe,IAAI,EAAA,GAAK;AAErC,IAAM,WAAA,GAAc,EAAA;AAQb,IAAM,qBAAN,MAA+C;AAAA,EAC3C,OAAA,uBAAc,GAAA,EAAyB;AAAA,EACvC,MAAA;AAAA,EACA,OAAA;AAAA,EACA,MAAA;AAAA,EAET,WAAA,CAAY,KAAA,EAAc,MAAA,EAAqB,KAAA,GAAgB,YAAA,EAAc;AAC3E,IAAA,IAAA,CAAK,MAAA,GAAS,KAAA;AACd,IAAA,IAAA,CAAK,OAAA,GAAU,MAAA;AACf,IAAA,IAAA,CAAK,MAAA,GAAS,KAAA;AAAA,EAChB;AAAA;AAAA,EAGA,IAAI,IAAA,GAAe;AACjB,IAAA,OAAO,KAAK,OAAA,CAAQ,IAAA;AAAA,EACtB;AAAA,EAEA,MAAM,KAAA,CAAM,MAAA,EAAkB,QAAA,EAAmC;AAC/D,IAAA,MAAM,KAAA,GAAQ,IAAA,CAAK,MAAA,CAAO,GAAA,GAAM,OAAA,EAAQ;AAGxC,IAAA,KAAA,MAAW,CAACY,MAAAA,EAAO,MAAM,CAAA,IAAK,KAAK,OAAA,EAAS;AAC1C,MAAA,IAAI,MAAA,CAAO,QAAQ,MAAA,CAAO,WAAA,IAAe,OAAO,IAAA,CAAK,OAAA,CAAQ,OAAOA,MAAK,CAAA;AAAA,IAC3E;AACA,IAAA,MAAM,KAAA,GAAQ,IAAA,CAAK,OAAA,CAAQ,WAAA,CAAY,WAAW,CAAA;AAClD,IAAA,IAAA,CAAK,OAAA,CAAQ,IAAI,KAAA,EAAO;AAAA,MACtB,KAAA,EAAOZ,SAAAA,CAAU,MAAA,EAAQ,QAAQ,CAAA;AAAA,MACjC,WAAA,EAAa,QAAQ,IAAA,CAAK,MAAA;AAAA,MAC1B,IAAA,EAAM;AAAA,KACP,CAAA;AACD,IAAA,OAAO,KAAA;AAAA,EACT;AAAA,EAEA,MAAM,QAAA,CAAS,MAAA,EAAkB,QAAA,EAAkB,KAAA,EAAiC;AAClF,IAAA,MAAM,MAAA,GAAS,IAAA,CAAK,OAAA,CAAQ,GAAA,CAAI,KAAK,CAAA;AACrC,IAAA,IAAI,MAAA,KAAW,QAAW,OAAO,KAAA;AACjC,IAAA,IAAI,MAAA,CAAO,MAAM,OAAO,KAAA;AACxB,IAAA,IAAI,OAAO,KAAA,KAAUA,SAAAA,CAAU,MAAA,EAAQ,QAAQ,GAAG,OAAO,KAAA;AACzD,IAAA,OAAO,KAAK,MAAA,CAAO,GAAA,EAAI,CAAE,OAAA,MAAa,MAAA,CAAO,WAAA;AAAA,EAC/C;AAAA,EAEA,MAAM,QAAA,CAAS,MAAA,EAAkB,KAAA,EAA8B;AAC7D,IAAA,MAAM,MAAA,GAAS,IAAA,CAAK,OAAA,CAAQ,GAAA,CAAI,KAAK,CAAA;AACrC,IAAA,IAAI,WAAW,MAAA,EAAW;AAC1B,IAAA,IAAI,CAAC,OAAO,KAAA,CAAM,UAAA,CAAWA,UAAU,MAAA,EAAQ,EAAE,CAAC,CAAA,EAAG;AACrD,IAAA,MAAA,CAAO,IAAA,GAAO,IAAA;AAAA,EAChB;AACF;;;AC9CO,IAAM,2BAAN,MAA2D;AAAA,EACvD,MAAA,uBAAa,GAAA,EAA+B;AAAA,EAC5C,MAAA;AAAA,EAET,YAAY,KAAA,EAAc;AACxB,IAAA,IAAA,CAAK,MAAA,GAAS,KAAA;AAAA,EAChB;AAAA,EAEA,MAAM,KAAA,CAAM,MAAA,EAAkB,KAAA,EAAwD;AACpF,IAAA,IAAA,CAAK,MAAA,CAAO,GAAA,CAAI,KAAA,CAAM,IAAA,EAAM;AAAA,MAC1B,QAAQ,EAAE,QAAA,EAAU,MAAA,EAAQ,SAAA,EAAW,MAAM,SAAA,EAAU;AAAA,MACvD,aAAa,IAAI,IAAA,CAAK,KAAA,CAAM,SAAS,EAAE,OAAA,EAAQ;AAAA,MAC/C,IAAA,EAAM;AAAA,KACP,CAAA;AACD,IAAA,OAAO,EAAE,IAAA,EAAM,KAAA,CAAM,IAAA,EAAM,SAAA,EAAW,MAAM,SAAA,EAAU;AAAA,EACxD;AAAA,EAEA,MAAM,OAAO,IAAA,EAAsD;AACjE,IAAA,MAAM,MAAA,GAAS,IAAA,CAAK,MAAA,CAAO,GAAA,CAAI,IAAI,CAAA;AACnC,IAAA,IAAI,MAAA,KAAW,QAAW,OAAO,MAAA;AACjC,IAAA,IAAI,MAAA,CAAO,MAAM,OAAO,MAAA;AACxB,IAAA,IAAI,IAAA,CAAK,OAAO,GAAA,EAAI,CAAE,SAAQ,GAAI,MAAA,CAAO,aAAa,OAAO,MAAA;AAC7D,IAAA,MAAA,CAAO,IAAA,GAAO,IAAA;AACd,IAAA,OAAO,MAAA,CAAO,MAAA;AAAA,EAChB;AACF;ACvCO,IAAM,8BAAN,MAAiE;AAAA,EAC7D,SAAA,uBAAgB,GAAA,EAA4B;AAAA,EAC5C,MAAA;AAAA,EAET,YAAY,KAAA,EAAc;AACxB,IAAA,IAAA,CAAK,MAAA,GAAS,KAAA;AAAA,EAChB;AAAA,EAEA,MAAM,MAAA,CACJ,MAAA,EACA,KAAA,EACwD;AACxD,IAAA,MAAM,GAAA,GAAMA,SAAAA,CAAU,MAAA,EAAQ,KAAA,CAAM,GAAG,CAAA;AACvC,IAAA,MAAM,QAAA,GAAW,IAAA,CAAK,SAAA,CAAU,GAAA,CAAI,GAAG,CAAA;AACvC,IAAA,IAAI,aAAa,MAAA,EAAW,OAAO,EAAE,OAAA,EAAS,QAAA,EAAU,SAAS,KAAA,EAAM;AACvE,IAAA,MAAM,OAAA,GAA0B;AAAA,MAC9B,QAAA,EAAU,MAAA;AAAA,MACV,KAAK,KAAA,CAAM,GAAA;AAAA,MACX,MAAM,KAAA,CAAM,IAAA;AAAA,MACZ,UAAA,EAAY,IAAA,CAAK,MAAA,CAAO,GAAA,GAAM,WAAA;AAAY,KAC5C;AACA,IAAA,IAAA,CAAK,SAAA,CAAU,GAAA,CAAI,GAAA,EAAK,OAAO,CAAA;AAC/B,IAAA,OAAO,EAAE,OAAA,EAAS,OAAA,EAAS,IAAA,EAAK;AAAA,EAClC;AAAA,EAEA,MAAM,GAAA,CAAI,MAAA,EAAkB,GAAA,EAAkD;AAC5E,IAAA,OAAO,KAAK,SAAA,CAAU,GAAA,CAAIA,SAAAA,CAAU,MAAA,EAAQ,GAAG,CAAC,CAAA;AAAA,EAClD;AACF;AC/BO,IAAM,mCAAN,MAA2E;AAAA,EACvE,SAAA,uBAAgB,GAAA,EAAiC;AAAA,EACjD,MAAA;AAAA,EAET,YAAY,KAAA,EAAc;AACxB,IAAA,IAAA,CAAK,MAAA,GAAS,KAAA;AAAA,EAChB;AAAA,EAEA,MAAM,MAAA,CACJ,MAAA,EACA,KAAA,EAC+E;AAC/E,IAAA,MAAM,MAAMA,SAAAA,CAAU,MAAA,EAAQ,KAAA,CAAM,QAAA,EAAU,MAAM,SAAS,CAAA;AAC7D,IAAA,MAAM,QAAA,GAAW,IAAA,CAAK,SAAA,CAAU,GAAA,CAAI,GAAG,CAAA;AACvC,IAAA,IAAI,aAAa,MAAA,EAAW,OAAO,EAAE,OAAA,EAAS,QAAA,EAAU,SAAS,KAAA,EAAM;AACvE,IAAA,MAAM,OAAA,GAA+B;AAAA,MACnC,QAAA,EAAU,MAAA;AAAA,MACV,GAAG,KAAA;AAAA,MACH,UAAA,EAAY,IAAA,CAAK,MAAA,CAAO,GAAA,GAAM,WAAA;AAAY,KAC5C;AACA,IAAA,IAAA,CAAK,SAAA,CAAU,GAAA,CAAI,GAAA,EAAK,OAAO,CAAA;AAC/B,IAAA,OAAO,EAAE,OAAA,EAAS,OAAA,EAAS,IAAA,EAAK;AAAA,EAClC;AAAA,EAEA,MAAM,GAAA,CACJ,MAAA,EACA,QAAA,EACA,SAAA,EAC0C;AAC1C,IAAA,OAAO,KAAK,SAAA,CAAU,GAAA,CAAIA,UAAU,MAAA,EAAQ,QAAA,EAAU,SAAS,CAAC,CAAA;AAAA,EAClE;AACF;AClBO,IAAM,2BAAN,MAA2D;AAAA,EACvD,SAAA,uBAAgB,GAAA,EAAyB;AAAA,EACzC,MAAA;AAAA,EAET,YAAY,KAAA,EAAc;AACxB,IAAA,IAAA,CAAK,MAAA,GAAS,KAAA;AAAA,EAChB;AAAA,EAEA,MAAM,IAAA,CAAK,MAAA,EAAkB,KAAA,EAAmE;AAC9F,IAAA,MAAM,GAAA,GAAMA,SAAAA,CAAU,MAAA,EAAQ,KAAA,CAAM,MAAM,CAAA;AAC1C,IAAA,MAAM,QAAA,GAAW,IAAA,CAAK,SAAA,CAAU,GAAA,CAAI,GAAG,CAAA;AACvC,IAAA,IAAI,QAAA,KAAa,QAAW,OAAO,QAAA;AACnC,IAAA,MAAM,OAAA,GAAuB;AAAA,MAC3B,QAAA,EAAU,MAAA;AAAA,MACV,QAAQ,KAAA,CAAM,MAAA;AAAA,MACd,UAAU,KAAA,CAAM,QAAA;AAAA,MAChB,MAAA,EAAQ,SAAA;AAAA,MACR,SAAA,EAAW,KAAK,IAAA;AAAK,KACvB;AACA,IAAA,IAAA,CAAK,SAAA,CAAU,GAAA,CAAI,GAAA,EAAK,OAAO,CAAA;AAC/B,IAAA,OAAO,OAAA;AAAA,EACT;AAAA,EAEA,MAAM,GAAA,CAAI,MAAA,EAAkB,MAAA,EAAkD;AAC5E,IAAA,OAAO,KAAK,SAAA,CAAU,GAAA,CAAIA,SAAAA,CAAU,MAAA,EAAQ,MAAM,CAAC,CAAA;AAAA,EACrD;AAAA,EAEA,MAAM,KAAA,CAAM,MAAA,EAAkB,KAAA,EAA+E;AAC3G,IAAA,MAAM,GAAA,GAAMA,SAAAA,CAAU,MAAA,EAAQ,KAAA,CAAM,MAAM,CAAA;AAC1C,IAAA,MAAM,QAAA,GAAW,IAAA,CAAK,SAAA,CAAU,GAAA,CAAI,GAAG,CAAA;AACvC,IAAA,IAAI,QAAA,KAAa,QAAW,OAAO,MAAA;AACnC,IAAA,IAAI,QAAA,CAAS,aAAA,KAAkB,MAAA,EAAW,OAAO,QAAA;AACjD,IAAA,MAAM,OAAA,GAAuB;AAAA,MAC3B,GAAG,QAAA;AAAA,MACH,eAAe,KAAA,CAAM,QAAA;AAAA,MACrB,MAAA,EAAQ,SAAA;AAAA,MACR,SAAA,EAAW,KAAK,IAAA;AAAK,KACvB;AACA,IAAA,IAAA,CAAK,SAAA,CAAU,GAAA,CAAI,GAAA,EAAK,OAAO,CAAA;AAC/B,IAAA,OAAO,OAAA;AAAA,EACT;AAAA,EAEA,MAAM,YAAA,CACJ,MAAA,EACA,KAAA,EACkC;AAClC,IAAA,MAAM,GAAA,GAAMA,SAAAA,CAAU,MAAA,EAAQ,KAAA,CAAM,MAAM,CAAA;AAC1C,IAAA,MAAM,QAAA,GAAW,IAAA,CAAK,SAAA,CAAU,GAAA,CAAI,GAAG,CAAA;AACvC,IAAA,IAAI,QAAA,KAAa,QAAW,OAAO,MAAA;AACnC,IAAA,MAAM,OAAA,GAAuB,EAAE,GAAG,QAAA,EAAU,MAAA,EAAQ,MAAM,MAAA,EAAQ,SAAA,EAAW,IAAA,CAAK,IAAA,EAAK,EAAE;AACzF,IAAA,IAAA,CAAK,SAAA,CAAU,GAAA,CAAI,GAAA,EAAK,OAAO,CAAA;AAC/B,IAAA,OAAO,OAAA;AAAA,EACT;AAAA,EAEA,IAAA,GAAe;AACb,IAAA,OAAO,IAAA,CAAK,MAAA,CAAO,GAAA,EAAI,CAAE,WAAA,EAAY;AAAA,EACvC;AACF;;;AChEO,IAAM,wBAAN,MAAqD;AAAA,EAG1D,YAA6B,KAAA,EAAc;AAAd,IAAA,IAAA,CAAA,KAAA,GAAA,KAAA;AAAA,EAAe;AAAA,EAAf,KAAA;AAAA,EAFpB,MAAA,uBAAa,GAAA,EAA0B;AAAA,EAIhD,MAAM,MAAA,CAAO,MAAA,EAAkB,KAAA,EAAmD;AAChF,IAAA,MAAM,QAAA,GAAW,uBAAuB,KAAK,CAAA;AAC7C,IAAA,MAAM,GAAA,GAAM,IAAA,CAAK,KAAA,CAAM,GAAA,EAAI;AAC3B,IAAA,MAAM,UAAA,GAAa,IAAI,WAAA,EAAY;AACnC,IAAA,MAAM,GAAA,GAAM,eAAA,CAAgB,MAAA,EAAQ,KAAA,CAAM,MAAM,CAAA;AAChD,IAAA,MAAM,QAAA,GAAW,IAAA,CAAK,MAAA,CAAO,GAAA,CAAI,GAAG,CAAA;AACpC,IAAA,MAAM,OAAO,QAAA,KAAa,MAAA,IAAa,UAAA,GAAa,QAAA,CAAS,YAAY,QAAA,GAAW,MAAA;AACpF,IAAA,MAAM,QAAA,GAAW,qBAAA,CAAsB,KAAA,EAAO,UAAU,CAAA;AACxD,IAAA,KAAA,MAAW,QAAQ,QAAA,EAAU;AAC3B,MAAA,MAAM,SAAA,GAAY,MAAM,OAAA,CAAQ,IAAA;AAAA,QAC9B,CAAC,KAAA,KACC,KAAA,CAAM,QAAA,KAAa,IAAA,CAAK,QAAA,IACxB,KAAA,CAAM,UAAA,KAAe,IAAA,CAAK,UAAA,IAC1B,KAAA,CAAM,gBAAA,KAAqB,IAAA,CAAK;AAAA,OACpC;AACA,MAAA,IAAI,cAAc,MAAA,EAAW;AAC3B,QAAA,MAAM,IAAI,cAAA;AAAA,UACR,4BAAA;AAAA,UACA,CAAA,oBAAA,EAAuB,IAAA,CAAK,QAAQ,CAAA,EAAA,EAAK,KAAK,UAAU,CAAA,6CAAA;AAAA,SAC1D;AAAA,MACF;AAAA,IACF;AACA,IAAA,MAAM,UAAA,GAAa,CAAC,GAAI,IAAA,EAAM,OAAA,IAAW,EAAC,EAAI,GAAG,QAAQ,CAAA,CAAE,IAAA,CAAK,qBAAqB,CAAA;AACrF,IAAA,MAAM,UAAU,IAAA,CAAK,GAAA,CAAI,UAAA,CAAW,MAAA,GAAS,UAAU,CAAC,CAAA;AACxD,IAAA,MAAM,OAAA,GAAU,UAAA,CAAW,KAAA,CAAM,OAAO,CAAA;AACxC,IAAA,MAAM,MAAA,GAAS,eAAe,OAAO,CAAA;AACrC,IAAA,MAAM,IAAA,GAAqB;AAAA,MACzB,QAAA,EAAU,MAAA;AAAA,MACV,QAAQ,KAAA,CAAM,MAAA;AAAA,MACd,OAAA;AAAA,MACA,GAAI,MAAA,KAAW,MAAA,GAAY,EAAC,GAAI,EAAE,MAAA,EAAO;AAAA,MACzC,OAAA,EAAA,CAAU,IAAA,EAAM,OAAA,IAAW,CAAA,IAAK,MAAM,OAAA,GAAU,OAAA;AAAA,MAChD,QAAA;AAAA,MACA,SAAA,EAAW,IAAI,IAAA,CAAK,GAAA,CAAI,SAAQ,GAAI,KAAA,CAAM,KAAK,CAAA,CAAE,WAAA;AAAY,KAC/D;AACA,IAAA,IAAA,CAAK,MAAA,CAAO,GAAA,CAAI,GAAA,EAAK,IAAI,CAAA;AACzB,IAAA,OAAO,IAAA;AAAA,EACT;AAAA,EAEA,MAAM,IAAA,CAAK,MAAA,EAAkB,MAAA,EAAmD;AAC9E,IAAA,MAAM,GAAA,GAAM,eAAA,CAAgB,MAAA,EAAQ,MAAM,CAAA;AAC1C,IAAA,MAAM,IAAA,GAAO,IAAA,CAAK,MAAA,CAAO,GAAA,CAAI,GAAG,CAAA;AAChC,IAAA,IAAI,IAAA,KAAS,QAAW,OAAO,MAAA;AAC/B,IAAA,IAAI,KAAK,KAAA,CAAM,GAAA,GAAM,WAAA,EAAY,IAAK,KAAK,SAAA,EAAW;AACpD,MAAA,IAAA,CAAK,MAAA,CAAO,OAAO,GAAG,CAAA;AACtB,MAAA,OAAO,MAAA;AAAA,IACT;AACA,IAAA,OAAO,IAAA;AAAA,EACT;AACF;;;ACvDO,IAAM,gCAAN,MAAqE;AAAA,EAG1E,YAA6B,KAAA,EAAc;AAAd,IAAA,IAAA,CAAA,KAAA,GAAA,KAAA;AAAA,EAAe;AAAA,EAAf,KAAA;AAAA,EAFpB,MAAA,uBAAa,GAAA,EAAkC;AAAA,EAIxD,MAAM,MAAA,CACJ,MAAA,EACA,KAAA,EAC+B;AAC/B,IAAA,MAAM,EAAE,QAAA,EAAU,KAAA,EAAO,KAAA,EAAM,GAAI,+BAA+B,KAAK,CAAA;AACvE,IAAA,MAAM,GAAA,GAAM,IAAA,CAAK,KAAA,CAAM,GAAA,EAAI;AAC3B,IAAA,MAAM,UAAA,GAAa,IAAI,WAAA,EAAY;AACnC,IAAA,MAAM,GAAA,GAAM,mBAAA,CAAoB,MAAA,EAAQ,KAAA,CAAM,MAAM,CAAA;AACpD,IAAA,MAAM,QAAA,GAAW,IAAA,CAAK,MAAA,CAAO,GAAA,CAAI,GAAG,CAAA;AACpC,IAAA,MAAM,OAAO,QAAA,KAAa,MAAA,IAAa,UAAA,GAAa,QAAA,CAAS,YAAY,QAAA,GAAW,MAAA;AACpF,IAAA,IAAI,SAAS,MAAA,EAAW;AACtB,MAAA,MAAM,SAAA,GAAY,KAAK,OAAA,CAAQ,IAAA;AAAA,QAC7B,CAAC,KAAA,KAAU,KAAA,CAAM,gBAAA,KAAqB,KAAA,CAAM;AAAA,OAC9C;AACA,MAAA,IAAI,cAAc,MAAA,EAAW;AAC3B,QAAA,IAAI,IAAA,CAAK,UAAU,SAAA,CAAU,KAAK,MAAM,IAAA,CAAK,SAAA,CAAU,KAAK,CAAA,EAAG;AAC7D,UAAA,MAAM,IAAI,cAAA;AAAA,YACR,4BAAA;AAAA,YACA;AAAA,WACF;AAAA,QACF;AACA,QAAA,OAAO,IAAA;AAAA,MACT;AAAA,IACF;AAEA,IAAA,MAAM,QAAA,GAAA,CAAY,IAAA,EAAM,MAAA,IAAU,CAAA,IAAK,CAAA;AACvC,IAAA,MAAM,WAAA,GAAc,0BAA0B,KAAA,CAAM;AAAA,MAClD,QAAQ,KAAA,CAAM,MAAA;AAAA,MACd,kBAAkB,KAAA,CAAM,gBAAA;AAAA,MACxB,QAAA;AAAA,MACA,UAAA;AAAA,MACA;AAAA,KACD,CAAA;AACD,IAAA,MAAM,aAAa,CAAC,GAAI,MAAM,OAAA,IAAW,IAAK,WAAW,CAAA;AACzD,IAAA,MAAM,UAAU,IAAA,CAAK,GAAA,CAAI,UAAA,CAAW,MAAA,GAAS,UAAU,CAAC,CAAA;AACxD,IAAA,MAAM,OAAA,GAAU,UAAA,CAAW,KAAA,CAAM,OAAO,CAAA;AACxC,IAAA,MAAM,IAAA,GAA6B;AAAA,MACjC,QAAA,EAAU,MAAA;AAAA,MACV,QAAQ,KAAA,CAAM,MAAA;AAAA,MACd,OAAA;AAAA,MACA,MAAA,EAAQ,uBAAuB,OAAO,CAAA;AAAA,MACtC,OAAA,EAAA,CAAU,IAAA,EAAM,OAAA,IAAW,CAAA,IAAK,OAAA;AAAA,MAChC,QAAA;AAAA,MACA,SAAA,EAAW,IAAI,IAAA,CAAK,GAAA,CAAI,SAAQ,GAAI,KAAK,EAAE,WAAA;AAAY,KACzD;AACA,IAAA,IAAA,CAAK,MAAA,CAAO,GAAA,CAAI,GAAA,EAAK,IAAI,CAAA;AACzB,IAAA,OAAO,IAAA;AAAA,EACT;AAAA,EAEA,MAAM,IAAA,CAAK,MAAA,EAAkB,MAAA,EAA2D;AACtF,IAAA,MAAM,GAAA,GAAM,mBAAA,CAAoB,MAAA,EAAQ,MAAM,CAAA;AAC9C,IAAA,MAAM,IAAA,GAAO,IAAA,CAAK,MAAA,CAAO,GAAA,CAAI,GAAG,CAAA;AAChC,IAAA,IAAI,IAAA,KAAS,QAAW,OAAO,MAAA;AAC/B,IAAA,IAAI,KAAK,KAAA,CAAM,GAAA,GAAM,WAAA,EAAY,IAAK,KAAK,SAAA,EAAW;AACpD,MAAA,IAAA,CAAK,MAAA,CAAO,OAAO,GAAG,CAAA;AACtB,MAAA,OAAO,MAAA;AAAA,IACT;AACA,IAAA,OAAO,IAAA;AAAA,EACT;AACF,CAAA;;;ACrBO,SAAS,yBAAA,CACd,KAAA,EACA,MAAA,EACA,OAAA,EAC0B;AAC1B,EAAA,MAAM,KAAA,GAAQ,mBAAA,CAAoB,KAAA,EAAO,MAAA,EAAQ,OAAO,CAAA;AACxD,EAAA,OAAO;AAAA,IACL,MAAA,EAAQ;AAAA,MACN,QAAA,EAAU,IAAI,qBAAA,CAAsB,KAAK,CAAA;AAAA,MACzC,SAAA,EAAW,IAAI,6BAAA,CAA8B,KAAK,CAAA;AAAA,MAClD,OAAA,EAAS,IAAI,uBAAA,EAAwB;AAAA,MACrC,YAAA,EAAc,IAAI,wBAAA,CAAyB,KAAK,CAAA;AAAA,MAChD,MAAA,EAAQ,IAAI,kBAAA,CAAmB,KAAA,EAAO,MAAM,CAAA;AAAA,MAC5C,KAAA,EAAO,IAAI,yBAAA,EAA0B;AAAA,MACrC,KAAA,EAAO,IAAI,wBAAA,CAAyB,KAAK,CAAA;AAAA,MACzC,QAAA,EAAU,IAAI,2BAAA,CAA4B,KAAK,CAAA;AAAA,MAC/C,aAAA,EAAe,IAAI,gCAAA,CAAiC,KAAK,CAAA;AAAA,MACzD,OAAO,KAAA,CAAM,KAAA;AAAA,MACb,WAAA,EAAa,IAAI,mBAAA;AAAoB,KACvC;AAAA,IACA,kBAAkB,KAAA,CAAM;AAAA,GAC1B;AACF;;;ACpDA,IAAM,kBAAA,GAAqB,EAAA;AAW3B,SAAS,WAAA,GAAqB;AAC5B,EAAA,OAAO,EAAE,GAAA,EAAK,sBAAM,IAAI,MAAK,EAAE;AACjC;AAmDO,SAAS,uBAAA,CAAwB,OAAA,GAAoC,EAAC,EAAsB;AACjG,EAAA,MAAM,KAAA,GAAQ,OAAA,CAAQ,KAAA,IAAS,WAAA,EAAY;AAC3C,EAAA,MAAM,MAAA,GAAS,OAAA,CAAQ,MAAA,IAAU,eAAA,EAAgB;AACjD,EAAA,MAAM,IAAA,GAAO,wBAAA,CAAyB,EAAE,KAAA,EAAO,CAAA,CAAE,MAAA;AACjD,EAAA,MAAM,EAAE,QAAQ,gBAAA,EAAiB,GAAI,0BAA0B,KAAA,EAAO,MAAA,EAAQ,KAAK,OAAO,CAAA;AAC1F,EAAA,MAAM,WAAA,GACJ,OAAA,CAAQ,WAAA,IACR,qBAAA,CAAsB,UAAA,CAAW,MAAA,CAAO,eAAA,CAAgB,IAAI,UAAA,CAAW,kBAAkB,CAAC,CAAA,EAAG,KAAK,CAAA;AAEpG,EAAA,MAAM,QAAQ,eAAA,CAAgB;AAAA,IAC5B,IAAA;AAAA,IACA,KAAA,EAAO,MAAA;AAAA;AAAA;AAAA;AAAA;AAAA,IAKP,gBAAA;AAAA,IACA,MAAA;AAAA,IACA,WAAA;AAAA,IACA,KAAA;AAAA,IACA,YAAA,EAAc,OAAA,CAAQ,YAAA,IAAgB,yBAAA,EAA0B;AAAA,IAChE,GAAI,QAAQ,cAAA,KAAmB,MAAA,GAAY,EAAC,GAAI,EAAE,cAAA,EAAgB,OAAA,CAAQ,cAAA,EAAe;AAAA,IACzF,GAAI,QAAQ,oBAAA,KAAyB,MAAA,GACjC,EAAC,GACD,EAAE,oBAAA,EAAsB,OAAA,CAAQ,oBAAA,EAAqB;AAAA,IACzD,GAAI,QAAQ,UAAA,KAAe,MAAA,GAAY,EAAE,UAAA,EAAY,OAAA,CAAQ,UAAA,EAAW,GAAI,EAAC;AAAA,IAC7E,GAAI,QAAQ,gBAAA,KAAqB,MAAA,GAAY,EAAE,gBAAA,EAAkB,OAAA,CAAQ,gBAAA,EAAiB,GAAI,EAAC;AAAA,IAC/F,GAAI,QAAQ,cAAA,KAAmB,MAAA,GAAY,EAAE,cAAA,EAAgB,OAAA,CAAQ,cAAA,EAAe,GAAI,EAAC;AAAA,IACzF,GAAI,QAAQ,kBAAA,KAAuB,MAAA,GAAY,EAAE,kBAAA,EAAoB,OAAA,CAAQ,kBAAA,EAAmB,GAAI,EAAC;AAAA,IACrG,GAAI,QAAQ,eAAA,KAAoB,MAAA,GAAY,EAAE,eAAA,EAAiB,OAAA,CAAQ,eAAA,EAAgB,GAAI,EAAC;AAAA,IAC5F,GAAI,QAAQ,qBAAA,KAA0B,MAAA,GAClC,EAAE,qBAAA,EAAuB,OAAA,CAAQ,qBAAA,EAAsB,GACvD,EAAC;AAAA,IACL,GAAI,QAAQ,cAAA,KAAmB,MAAA,GAAY,EAAC,GAAI,EAAE,cAAA,EAAgB,OAAA,CAAQ,cAAA,EAAe;AAAA,IACzF,GAAI,QAAQ,0BAAA,KAA+B,MAAA,GACvC,EAAC,GACD,EAAE,0BAAA,EAA4B,OAAA,CAAQ,0BAAA,EAA2B;AAAA,IACrE,GAAI,QAAQ,8BAAA,KAAmC,MAAA,GAC3C,EAAC,GACD,EAAE,8BAAA,EAAgC,OAAA,CAAQ,8BAAA,EAA+B;AAAA,IAC7E,GAAI,QAAQ,mCAAA,KAAwC,MAAA,GAChD,EAAC,GACD,EAAE,mCAAA,EAAqC,OAAA,CAAQ,mCAAA,EAAoC;AAAA,IACvF,GAAI,QAAQ,oBAAA,KAAyB,MAAA,GACjC,EAAC,GACD,EAAE,oBAAA,EAAsB,OAAA,CAAQ,oBAAA,EAAqB;AAAA,IACzD,GAAI,QAAQ,kBAAA,KAAuB,MAAA,GAC/B,EAAC,GACD,EAAE,kBAAA,EAAoB,OAAA,CAAQ,kBAAA,EAAmB;AAAA,IACrD,GAAI,QAAQ,aAAA,KAAkB,MAAA,GAAY,EAAC,GAAI,EAAE,aAAA,EAAe,OAAA,CAAQ,aAAA,EAAc;AAAA,IACtF,GAAI,QAAQ,yBAAA,KAA8B,MAAA,GACtC,EAAC,GACD,EAAE,yBAAA,EAA2B,OAAA,CAAQ,yBAAA,EAA0B;AAAA,IACnE,GAAI,QAAQ,sBAAA,KAA2B,MAAA,GACnC,EAAC,GACD,EAAE,sBAAA,EAAwB,OAAA,CAAQ,sBAAA,EAAuB;AAAA,IAC7D,GAAI,QAAQ,iBAAA,KAAsB,MAAA,GAAY,EAAC,GAAI,EAAE,iBAAA,EAAmB,OAAA,CAAQ,iBAAA,EAAkB;AAAA,IAClG,GAAI,QAAQ,gBAAA,KAAqB,MAAA,GAAY,EAAC,GAAI,EAAE,gBAAA,EAAkB,OAAA,CAAQ,gBAAA,EAAiB;AAAA,IAC/F,GAAI,QAAQ,gBAAA,KAAqB,MAAA,GAAY,EAAC,GAAI,EAAE,gBAAA,EAAkB,OAAA,CAAQ,gBAAA,EAAiB;AAAA,IAC/F,GAAI,QAAQ,aAAA,KAAkB,MAAA,GAAY,EAAC,GAAI,EAAE,aAAA,EAAe,OAAA,CAAQ,aAAA,EAAc;AAAA,IACtF,GAAI,QAAQ,oBAAA,KAAyB,MAAA,GACjC,EAAC,GACD,EAAE,oBAAA,EAAsB,OAAA,CAAQ,oBAAA,EAAqB;AAAA,IACzD,GAAI,QAAQ,UAAA,KAAe,MAAA,GAAY,EAAC,GAAI,EAAE,UAAA,EAAY,OAAA,CAAQ,UAAA,EAAW;AAAA,IAC7E,GAAI,QAAQ,kBAAA,KAAuB,MAAA,GAC/B,EAAC,GACD,EAAE,kBAAA,EAAoB,OAAA,CAAQ,kBAAA;AAAmB,GACtD,CAAA;AAED,EAAA,OAAO,EAAE,KAAA,EAAO,IAAA,EAAM,MAAA,EAAQ,gBAAA,EAAkB,OAAO,MAAA,EAAO;AAChE;ACtIO,SAAS,iCAAA,CACd,OACA,IAAA,EACmD;AACnD,EAAA,OAAO,4BAA4B,KAAA,EAAO;AAAA,IACxC,QAAA,EAAU;AAAA,MACR,MAAA,EAAQ,CAAC,EAAE,SAAA,EAAW,YAAA,EAAc,SAAA,EAAU,KAC5C,IAAA,CAAK,MAAA,CAAO,aAAA,CAAc,SAAA,EAAW,YAAA,EAAc,SAAS;AAAA,KAChE;AAAA,IACA,YAAA,EAAc,OAAO,QAAA,KAAa;AAChC,MAAA,MAAM,GAAA,GAAM,MAAM,IAAA,CAAK,OAAA,CAAQ,kBAAkB,QAAQ,CAAA;AACzD,MAAA,IAAI,GAAA,KAAQ,QAAW,OAAO,MAAA;AAC9B,MAAA,OAAO;AAAA,QACL,UAAU,GAAA,CAAI,QAAA;AAAA,QACd,WAAW,GAAA,CAAI,SAAA;AAAA,QACf,UAAU,GAAA,CAAI,QAAA;AAAA,QACd,eAAe,GAAA,CAAI,eAAA;AAAA,QACnB,SAAS,GAAA,CAAI;AAAA,OACf;AAAA,IACF,CAAA;AAAA,IACA,QAAQ,IAAA,CAAK,MAAA;AAAA,IACb,UAAU,IAAA,CAAK,QAAA;AAAA,IACf,GAAA,EAAK,IAAA,CAAK,KAAA,CAAM,GAAA,EAAI;AAAA,IACpB,GAAI,KAAK,aAAA,KAAkB,MAAA,GAAY,EAAC,GAAI,EAAE,aAAA,EAAe,IAAA,CAAK,aAAA;AAAc,GACjF,CAAA;AACH;ACxCA,IAAM,mBAAA,GAAsBF,EAAE,MAAA,CAAO;AAAA,EACnC,QAAA,EAAUA,EAAE,MAAA,EAAO;AAAA,EACnB,MAAA,EAAQA,EAAE,MAAA,EAAO;AAAA,EACjB,OAAA,EAASA,EAAE,MAAA,EAAO;AAAA,EAClB,KAAA,EAAOA,EAAE,MAAA,EAAO;AAAA,EAChB,MAAA,EAAQA,CAAAA,CAAE,IAAA,CAAKe,cAAc,CAAA;AAAA,EAC7B,QAAA,EAAUf,CAAAA,CACP,MAAA,CAAO,EAAE,UAAUA,CAAAA,CAAE,MAAA,EAAO,EAAG,SAAA,EAAWA,CAAAA,CAAE,MAAA,EAAO,EAAG,EACtD,QAAA,EAAS;AAAA,EACZ,UAAUA,CAAAA,CAAE,MAAA,EAAO,CAAE,GAAA,GAAM,WAAA,EAAY;AAAA,EACvC,SAAA,EAAWA,EAAE,MAAA,EAAO;AAAA,EACpB,SAAA,EAAWA,EAAE,MAAA;AACf,CAAC,CAAA;AAED,IAAM,mBAAA,GAAsBA,EAAE,MAAA,CAAO;AAAA,EACnC,KAAA,EAAOA,CAAAA,CAAE,KAAA,CAAM,mBAAmB,CAAA;AAAA,EAClC,SAASA,CAAAA,CAAE,MAAA,EAAO,CAAE,GAAA,GAAM,WAAA,EAAY;AAAA,EACtC,OAAA,EAASA,EAAE,OAAA;AACb,CAAC,CAAA;AAUM,IAAM,uBAAA,GAAN,cAAsC,KAAA,CAAM;AAAA,EACjD,WAAA,CAAY,SAAiB,OAAA,EAAwB;AACnD,IAAA,KAAA,CAAM,SAAS,OAAO,CAAA;AACtB,IAAA,IAAA,CAAK,IAAA,GAAO,yBAAA;AAAA,EACd;AACF;AAEO,IAAM,qBAAA,GAAN,cAAoC,KAAA,CAAM;AAAA,EAC/C,YAAY,OAAA,EAAiB;AAC3B,IAAA,KAAA,CAAM,OAAO,CAAA;AACb,IAAA,IAAA,CAAK,IAAA,GAAO,uBAAA;AAAA,EACd;AACF;AAmBO,IAAM,kBAAN,MAAsB;AAAA,EAClB,IAAA;AAAA,EACA,KAAA;AAAA,EACA,YAAA;AAAA,EACA,MAAA;AAAA,EACA,eAAA;AAAA,EAET,YAAY,OAAA,EAAiC;AAC3C,IAAA,gBAAA,CAAiB,OAAA,CAAQ,YAAA,EAAc,kBAAA,CAAmB,iBAAiB,CAAA;AAC3E,IAAA,IAAA,CAAK,OAAOgB,aAAAA,CAAc,OAAA,CAAQ,cAAc,kBAAA,CAAmB,QAAQ,IAAI,KAAA,GAAQ,MAAA;AACvF,IAAA,IAAA,CAAK,KAAA,GAAQ,IAAI,GAAA,CAAI,OAAA,CAAQ,OAAO,CAAA;AACpC,IAAA,IAAA,CAAK,eAAe,OAAA,CAAQ,WAAA;AAC5B,IAAA,IAAA,CAAK,MAAA,GAAS,OAAA,CAAQ,KAAA,IAAS,UAAA,CAAW,KAAA;AAC1C,IAAA,IAAA,CAAK,eAAA,GAAkB,QAAQ,cAAA,IAAkB,GAAA;AAAA,EACnD;AAAA,EAEA,MAAM,QAAA,CAAS,QAAA,EAAkB,MAAA,EAA8C;AAC7E,IAAA,IAAI,CAAC,MAAA,CAAO,aAAA,CAAc,QAAQ,CAAA,IAAK,WAAW,CAAA,EAAG;AACnD,MAAA,MAAM,IAAI,UAAU,+CAA+C,CAAA;AAAA,IACrE;AACA,IAAA,OAAO,IAAA,CAAK,IAAA,KAAS,KAAA,GACjB,IAAA,CAAK,YAAA,CAAa,QAAA,EAAU,MAAM,CAAA,GAClC,IAAA,CAAK,aAAA,CAAc,QAAA,EAAU,MAAM,CAAA;AAAA,EACzC;AAAA,EAEA,MAAM,aAAA,CAAc,QAAA,EAAkB,MAAA,EAA8C;AAClF,IAAA,MAAM,GAAA,GAAM,IAAI,GAAA,CAAIC,eAAAA,EAAiB,KAAK,KAAK,CAAA;AAC/C,IAAA,GAAA,CAAI,YAAA,CAAa,GAAA,CAAI,OAAA,EAAS,MAAA,CAAO,QAAQ,CAAC,CAAA;AAC9C,IAAA,MAAM,QAAA,GAAW,MAAM,IAAA,CAAK,MAAA,CAAO,GAAA,EAAK;AAAA,MACtC,SAAS,EAAE,aAAA,EAAe,CAAA,OAAA,EAAU,IAAA,CAAK,YAAY,CAAA,CAAA,EAAG;AAAA,MACxD,GAAI,MAAA,KAAW,MAAA,GAAY,EAAC,GAAI,EAAE,MAAA;AAAO,KAC1C,CAAA;AACD,IAAA,mBAAA,CAAoB,UAAU,MAAM,CAAA;AACpC,IAAA,OAAO,EAAE,IAAA,EAAM,MAAA,EAAQ,IAAA,EAAM,mBAAA,CAAoB,MAAM,MAAM,QAAA,CAAS,IAAA,EAAM,CAAA,EAAE;AAAA,EAChF;AAAA,EAEA,MAAM,YAAA,CAAa,QAAA,EAAkB,MAAA,EAA8C;AACjF,IAAA,MAAM,GAAA,GAAM,IAAI,GAAA,CAAIC,sBAAAA,EAAwB,KAAK,KAAK,CAAA;AACtD,IAAA,MAAM,QAAA,GAAW,MAAM,IAAA,CAAK,MAAA,CAAO,GAAA,EAAK;AAAA,MACtC,OAAA,EAAS;AAAA,QACP,MAAA,EAAQ,mBAAA;AAAA,QACR,aAAA,EAAe,CAAA,OAAA,EAAU,IAAA,CAAK,YAAY,CAAA,CAAA;AAAA,QAC1C,eAAA,EAAiB,OAAO,QAAQ;AAAA,OAClC;AAAA,MACA,GAAI,MAAA,KAAW,MAAA,GAAY,EAAC,GAAI,EAAE,MAAA;AAAO,KAC1C,CAAA;AACD,IAAA,mBAAA,CAAoB,UAAU,KAAK,CAAA;AACnC,IAAA,IAAI,SAAS,IAAA,KAAS,IAAA,EAAM,MAAM,IAAI,wBAAwB,iCAAiC,CAAA;AAE/F,IAAA,MAAM,MAAA,GAAS,QAAA,CAAS,IAAA,CAAK,SAAA,EAAU;AACvC,IAAA,MAAM,OAAA,GAAU,IAAI,WAAA,EAAY;AAChC,IAAA,IAAI,MAAA,GAAS,EAAA;AACb,IAAA,IAAI;AACF,MAAA,OAAO,IAAA,EAAM;AACX,QAAA,MAAM,KAAA,GAAQ,MAAM,gBAAA,CAAiB,MAAA,EAAQ,KAAK,eAAe,CAAA;AACjE,QAAA,IAAI,KAAA,CAAM,IAAA,EAAM,MAAM,IAAI,wBAAwB,wCAAwC,CAAA;AAC1F,QAAA,MAAA,IAAU,OAAA,CAAQ,MAAA,CAAO,KAAA,CAAM,KAAA,EAAO,EAAE,MAAA,EAAQ,IAAA,EAAM,CAAA,CAAE,UAAA,CAAW,MAAA,EAAQ,IAAI,CAAA;AAC/E,QAAA,IAAI,QAAA,GAAW,MAAA,CAAO,OAAA,CAAQ,MAAM,CAAA;AACpC,QAAA,OAAO,YAAY,CAAA,EAAG;AACpB,UAAA,MAAM,KAAA,GAAQ,MAAA,CAAO,KAAA,CAAM,CAAA,EAAG,QAAQ,CAAA;AACtC,UAAA,MAAA,GAAS,MAAA,CAAO,KAAA,CAAM,QAAA,GAAW,CAAC,CAAA;AAClC,UAAA,MAAM,MAAA,GAAS,cAAc,KAAK,CAAA;AAClC,UAAA,IAAI,MAAA,KAAW,QAAW,OAAO,MAAA;AACjC,UAAA,QAAA,GAAW,MAAA,CAAO,QAAQ,MAAM,CAAA;AAAA,QAClC;AAAA,MACF;AAAA,IACF,CAAA,SAAE;AACA,MAAA,MAAM,MAAA,CAAO,MAAA,EAAO,CAAE,KAAA,CAAM,MAAM,MAAS,CAAA;AAAA,IAC7C;AAAA,EACF;AACF;AAEA,SAAS,mBAAA,CAAoB,UAAoB,SAAA,EAAiC;AAChF,EAAA,IAAI,QAAA,CAAS,WAAW,GAAA,EAAK;AAC3B,IAAA,MAAM,IAAI,sBAAsB,sCAAsC,CAAA;AAAA,EACxE;AACA,EAAA,IAAI,SAAS,EAAA,EAAI;AACjB,EAAA,IAAI,QAAA,CAAS,UAAU,GAAA,EAAK;AAC1B,IAAA,MAAM,IAAI,uBAAA,CAAwB,CAAA,MAAA,EAAS,SAAS,CAAA,kBAAA,EAAqB,QAAA,CAAS,MAAM,CAAA,CAAA,CAAG,CAAA;AAAA,EAC7F;AACA,EAAA,MAAM,IAAI,qBAAA;AAAA,IACR,CAAA,MAAA,EAAS,SAAS,CAAA,8BAAA,EAAiC,QAAA,CAAS,MAAM,CAAA,CAAA;AAAA,GACpE;AACF;AAEA,eAAe,gBAAA,CACb,QACA,SAAA,EACA;AACA,EAAA,IAAI,KAAA;AACJ,EAAA,IAAI;AACF,IAAA,OAAO,MAAM,QAAQ,IAAA,CAAK;AAAA,MACxB,OAAO,IAAA,EAAK;AAAA,MACZ,IAAI,OAAA,CAAe,CAAC,CAAA,EAAG,MAAA,KAAW;AAChC,QAAA,KAAA,GAAQ,UAAA;AAAA,UACN,MAAM,MAAA,CAAO,IAAI,uBAAA,CAAwB,kCAAkC,CAAC,CAAA;AAAA,UAC5E;AAAA,SACF;AAAA,MACF,CAAC;AAAA,KACF,CAAA;AAAA,EACH,CAAA,SAAE;AACA,IAAA,IAAI,KAAA,KAAU,MAAA,EAAW,YAAA,CAAa,KAAK,CAAA;AAAA,EAC7C;AACF;AAEA,SAAS,cAAc,KAAA,EAA0C;AAC/D,EAAA,IAAI,MAAM,MAAA,KAAW,CAAA,IAAK,MAAM,UAAA,CAAW,GAAG,GAAG,OAAO,MAAA;AACxD,EAAA,IAAI,KAAA,GAAQ,SAAA;AACZ,EAAA,MAAM,OAAiB,EAAC;AACxB,EAAA,KAAA,MAAW,IAAA,IAAQ,KAAA,CAAM,KAAA,CAAM,IAAI,CAAA,EAAG;AACpC,IAAA,IAAI,IAAA,CAAK,UAAA,CAAW,QAAQ,CAAA,EAAG,KAAA,GAAQ,KAAK,KAAA,CAAM,QAAA,CAAS,MAAM,CAAA,CAAE,SAAA,EAAU;AAC7E,IAAA,IAAI,IAAA,CAAK,UAAA,CAAW,OAAO,CAAA,EAAG,IAAA,CAAK,IAAA,CAAK,IAAA,CAAK,KAAA,CAAM,OAAA,CAAQ,MAAM,CAAA,CAAE,SAAA,EAAW,CAAA;AAAA,EAChF;AACA,EAAA,IAAI,KAAA,KAAU,WAAA,EAAa,OAAO,EAAE,MAAM,WAAA,EAAY;AACtD,EAAA,IAAI,KAAA,KAAU,SAAS,OAAO,MAAA;AAC9B,EAAA,IAAI,KAAK,MAAA,KAAW,CAAA,EAAG,MAAM,IAAI,YAAY,oCAAoC,CAAA;AACjF,EAAA,OAAO,EAAE,IAAA,EAAM,OAAA,EAAS,IAAA,EAAM,mBAAA,CAAoB,KAAA,CAAM,IAAA,CAAK,KAAA,CAAM,IAAA,CAAK,IAAA,CAAK,IAAI,CAAC,CAAC,CAAA,EAAE;AACvF;;;ACvCO,IAAM,qBAAA,GAAwB;AAAA,EACnC,SAAA;AAAA,EACA,SAAA;AAAA,EACA,SAAA;AAAA,EACA,UAAA;AAAA,EACA,QAAA;AAAA,EACA;AACF;AA6MO,IAAM,iBAAA,GAAoB;AAAA,EAC/B,UAAA;AAAA,EACA,WAAA;AAAA,EACA,SAAA;AAAA,EACA,cAAA;AAAA,EACA,QAAA;AAAA,EACA,OAAA;AAAA,EACA,OAAA;AAAA,EACA,UAAA;AAAA,EACA,eAAA;AAAA,EACA,OAAA;AAAA,EACA;AACF;;;ACjWO,IAAM,kBAAA,GAA0E;AAAA,EACrF,QAAA,EAAU,CAAC,QAAA,EAAU,MAAM,CAAA;AAAA,EAC3B,SAAA,EAAW,CAAC,QAAA,EAAU,MAAM,CAAA;AAAA,EAC5B,SAAS,CAAC,UAAA,EAAY,KAAA,EAAO,QAAA,EAAU,QAAQ,mBAAmB,CAAA;AAAA,EAClE,YAAA,EAAc,CAAC,OAAA,EAAS,QAAQ,CAAA;AAAA,EAChC,MAAA,EAAQ,CAAC,OAAA,EAAS,UAAA,EAAY,UAAU,CAAA;AAAA,EACxC,KAAA,EAAO,CAAC,gBAAgB,CAAA;AAAA,EACxB,KAAA,EAAO,CAAC,MAAA,EAAQ,KAAA,EAAO,SAAS,cAAc,CAAA;AAAA,EAC9C,QAAA,EAAU,CAAC,QAAA,EAAU,KAAK,CAAA;AAAA,EAC1B,aAAA,EAAe,CAAC,QAAA,EAAU,KAAK,CAAA;AAAA;AAAA;AAAA;AAAA,EAI/B,KAAA,EAAO,CAAC,cAAA,EAAgB,eAAA,EAAiB,gBAAgB,CAAA;AAAA,EACzD,WAAA,EAAa,CAAC,SAAS;AACzB;AAGO,IAAM,qBAAA,GAAkE;AAAA,EAC7E,QAAA,EAAU,eAAA;AAAA,EACV,SAAA,EAAW,uBAAA;AAAA,EACX,OAAA,EAAS,iBAAA;AAAA,EACT,YAAA,EAAc,kBAAA;AAAA,EACd,MAAA,EAAQ,YAAA;AAAA,EACR,KAAA,EAAO,mBAAA;AAAA,EACP,KAAA,EAAO,kBAAA;AAAA,EACP,QAAA,EAAU,qBAAA;AAAA,EACV,aAAA,EAAe,0BAAA;AAAA,EACf,KAAA,EAAO,gBAAA;AAAA,EACP,WAAA,EAAa;AACf","file":"index.js","sourcesContent":["/**\n * The reference {@link CloudCrypto}, built entirely on the WebCrypto API that\n * Node >=20, Cloudflare Workers, and Deno all expose as `globalThis.crypto`.\n *\n * No `node:crypto`, no dependency: the point of the port is that a hosted\n * composition stays runtime-neutral, and an adapter that reached for a Node\n * built-in here would make that claim false for the default composition.\n */\nimport type { CloudCrypto } from './port';\n\n/** Short, human-typeable pairing code alphabet — no `0/O`, no `1/I` (mirrors the reference server's). */\nconst PAIRING_CODE_ALPHABET = 'ABCDEFGHJKLMNPQRSTUVWXYZ23456789';\n\nconst HEX_DIGITS = '0123456789abcdef';\n\nexport function base64UrlEncode(bytes: Uint8Array): string {\n let binary = '';\n for (const byte of bytes) binary += String.fromCharCode(byte);\n return btoa(binary).replaceAll('+', '-').replaceAll('/', '_').replaceAll('=', '');\n}\n\n/**\n * Decode base64url. Returns `undefined` rather than throwing for input that\n * is not base64url at all — every caller here is verifying attacker-supplied\n * material, where \"not decodable\" and \"does not verify\" must be the same\n * answer.\n */\nexport function base64UrlDecode(value: string): Uint8Array | undefined {\n const padded = value.replaceAll('-', '+').replaceAll('_', '/');\n try {\n const binary = atob(padded);\n const bytes = new Uint8Array(binary.length);\n for (let index = 0; index < binary.length; index += 1) bytes[index] = binary.charCodeAt(index);\n return bytes;\n } catch {\n return undefined;\n }\n}\n\nfunction toHex(bytes: Uint8Array): string {\n let out = '';\n for (const byte of bytes) {\n out += HEX_DIGITS[(byte >> 4) & 0xf];\n out += HEX_DIGITS[byte & 0xf];\n }\n return out;\n}\n\n/**\n * WebCrypto's own types are derived from the runtime's `globalThis.crypto`\n * rather than named directly: `CryptoKey`/`SubtleCrypto`/`KeyUsage` are DOM\n * lib globals, and this package compiles without the DOM lib (a Workers build\n * has no DOM either). Deriving keeps the types exact without pulling in a\n * `node:` import or widening `lib`.\n */\nexport type SubtleCryptoLike = typeof globalThis.crypto.subtle;\nexport type CryptoKeyLike = Awaited<ReturnType<SubtleCryptoLike['importKey']>>;\nexport type KeyUsageLike = Parameters<SubtleCryptoLike['importKey']>[4][number];\n\nfunction subtle(): SubtleCryptoLike {\n const webCrypto = globalThis.crypto;\n if (webCrypto?.subtle === undefined) {\n throw new Error('@byok-sdk/cloud requires a WebCrypto implementation on globalThis.crypto');\n }\n return webCrypto.subtle;\n}\n\nexport function createWebCrypto(): CloudCrypto {\n return {\n randomUuid(): string {\n return globalThis.crypto.randomUUID();\n },\n\n randomToken(byteLength: number): string {\n return base64UrlEncode(globalThis.crypto.getRandomValues(new Uint8Array(byteLength)));\n },\n\n randomPairingCode(length: number): string {\n const bytes = globalThis.crypto.getRandomValues(new Uint8Array(length));\n let out = '';\n for (const byte of bytes) {\n out += PAIRING_CODE_ALPHABET[byte % PAIRING_CODE_ALPHABET.length];\n }\n return out;\n },\n\n async verifyEd25519(\n publicKeyBase64Url: string,\n message: string | Uint8Array,\n signature: string,\n ): Promise<boolean> {\n const signatureBytes = base64UrlDecode(signature);\n if (signatureBytes === undefined) return false;\n try {\n const key = await subtle().importKey(\n 'jwk',\n { kty: 'OKP', crv: 'Ed25519', x: publicKeyBase64Url },\n { name: 'Ed25519' },\n false,\n ['verify'],\n );\n const messageBytes = typeof message === 'string' ? new TextEncoder().encode(message) : message;\n return await subtle().verify({ name: 'Ed25519' }, key, signatureBytes, messageBytes);\n } catch {\n // A key that will not import is a key that cannot have signed this —\n // same answer as a bad signature, with no distinguishing error.\n return false;\n }\n },\n\n async hmacSha256(secret: Uint8Array, message: string): Promise<string> {\n const key = await subtle().importKey('raw', secret, { name: 'HMAC', hash: 'SHA-256' }, false, ['sign']);\n const signature = await subtle().sign('HMAC', key, new TextEncoder().encode(message));\n return base64UrlEncode(new Uint8Array(signature));\n },\n\n async sha256(data: Uint8Array): Promise<string> {\n const digest = await subtle().digest('SHA-256', data);\n return `sha256:${toHex(new Uint8Array(digest))}`;\n },\n\n timingSafeEqual(left: string, right: string): boolean {\n const leftBytes = base64UrlDecode(left);\n const rightBytes = base64UrlDecode(right);\n if (leftBytes === undefined || rightBytes === undefined) return false;\n if (leftBytes.length !== rightBytes.length) return false;\n let diff = 0;\n for (let index = 0; index < leftBytes.length; index += 1) {\n diff |= (leftBytes[index] ?? 0) ^ (rightBytes[index] ?? 0);\n }\n return diff === 0;\n },\n };\n}\n","/**\n * Access tokens for the hosted device surface (docs/protocol.md §6).\n *\n * The token carries the identity TRIPLE — `(deviceId, tenantId, productId)` —\n * and all three legs are lookup keys, never authority: `authenticateBearer`\n * (`bearer.ts`) resolves them against the device directory and answers with\n * the ROW's identity. A token missing a leg is not a partially usable token;\n * it is not a token this deployment minted.\n *\n * {@link TokenSigner} is a port for the same reason `@byok-sdk/server` made it\n * one: a SaaS with an org-wide asymmetric signer or a KMS swaps its own in.\n * The reference implementation below is HS256 over a caller-supplied secret,\n * built on WebCrypto so the package stays runtime-neutral (no `jose`, no\n * `node:crypto`).\n */\nimport type { Clock } from '@byok-sdk/core';\nimport {\n base64UrlDecode,\n base64UrlEncode,\n type CryptoKeyLike,\n type KeyUsageLike,\n} from '../crypto/web-crypto';\n\n/** Access tokens are ~1h, matching the reference server (docs/protocol.md §6.1/§6.2). */\nexport const ACCESS_TOKEN_TTL_SECONDS = 60 * 60;\n\nexport interface AccessTokenClaims {\n readonly deviceId: string;\n /** Unbranded on the wire: the value is only a lookup key until a device row vouches for it. */\n readonly tenantId: string;\n readonly productId: string;\n}\n\nexport interface TokenSigner {\n sign(claims: AccessTokenClaims, expiresInSeconds: number): Promise<string>;\n /** Claims for a valid, unexpired token, or `undefined` for invalid/expired/malformed — no reason is ever reported. */\n verify(token: string): Promise<AccessTokenClaims | undefined>;\n}\n\ninterface TokenPayload {\n readonly deviceId: unknown;\n readonly tenantId: unknown;\n readonly productId: unknown;\n readonly exp: unknown;\n}\n\nfunction encodeSegment(value: unknown): string {\n return base64UrlEncode(new TextEncoder().encode(JSON.stringify(value)));\n}\n\n/**\n * HS256 JWT signer over `secret`.\n *\n * `clock` is injected rather than read off `Date.now()` so expiry is testable\n * and so the whole package keeps a single notion of \"now\" (the same one the\n * stores use for TTLs).\n */\nexport function createHmacTokenSigner(secret: Uint8Array, clock: Clock): TokenSigner {\n async function signingKey(usage: KeyUsageLike): Promise<CryptoKeyLike> {\n return globalThis.crypto.subtle.importKey('raw', secret, { name: 'HMAC', hash: 'SHA-256' }, false, [usage]);\n }\n\n async function signature(signingInput: string): Promise<string> {\n const key = await signingKey('sign');\n const bytes = await globalThis.crypto.subtle.sign('HMAC', key, new TextEncoder().encode(signingInput));\n return base64UrlEncode(new Uint8Array(bytes));\n }\n\n return {\n async sign(claims, expiresInSeconds) {\n const issuedAt = Math.floor(clock.now().getTime() / 1000);\n const header = encodeSegment({ alg: 'HS256', typ: 'JWT' });\n const payload = encodeSegment({\n deviceId: claims.deviceId,\n tenantId: claims.tenantId,\n productId: claims.productId,\n iat: issuedAt,\n exp: issuedAt + expiresInSeconds,\n });\n const signingInput = `${header}.${payload}`;\n return `${signingInput}.${await signature(signingInput)}`;\n },\n\n async verify(token) {\n const parts = token.split('.');\n if (parts.length !== 3) return undefined;\n const [header, payload, provided] = parts as [string, string, string];\n\n const key = await signingKey('verify');\n const providedBytes = base64UrlDecode(provided);\n if (providedBytes === undefined) return undefined;\n const ok = await globalThis.crypto.subtle.verify(\n 'HMAC',\n key,\n providedBytes,\n new TextEncoder().encode(`${header}.${payload}`),\n );\n if (!ok) return undefined;\n\n const headerBytes = base64UrlDecode(header);\n const payloadBytes = base64UrlDecode(payload);\n if (headerBytes === undefined || payloadBytes === undefined) return undefined;\n\n let decodedHeader: unknown;\n let decodedPayload: TokenPayload;\n try {\n decodedHeader = JSON.parse(new TextDecoder().decode(headerBytes));\n decodedPayload = JSON.parse(new TextDecoder().decode(payloadBytes)) as TokenPayload;\n } catch {\n return undefined;\n }\n\n const alg = (decodedHeader as { alg?: unknown } | null)?.alg;\n if (alg !== 'HS256') return undefined;\n\n const { deviceId, tenantId, productId, exp } = decodedPayload;\n if (typeof deviceId !== 'string' || typeof tenantId !== 'string' || typeof productId !== 'string') {\n return undefined;\n }\n if (typeof exp !== 'number' || clock.now().getTime() / 1000 >= exp) return undefined;\n\n return { deviceId, tenantId, productId };\n },\n };\n}\n","/**\n * The one nonce-signature check on the hosted surface (docs/protocol.md §6.2).\n *\n * S1 (GAP-004): a device signs `byok-nonce-v1\\n` + nonce, never the bare\n * nonce. The device key is a long-lived identity key that later planes (S6\n * device proof) also sign structured messages with; without a domain tag, a\n * signature produced for one purpose is a valid signature for another.\n *\n * Applying the domain HERE rather than at the call site is the point: there\n * is exactly one place that decides what a device signature over a nonce\n * means, so no route can be written that accepts the undomained form. There\n * is deliberately no dual mode and no grace window — a device on the old\n * encoding re-pairs.\n *\n * The domain literal itself lives in `@byok-sdk/core` (`src/pairing.ts`): the\n * daemon must not be able to tell self-hosted from hosted, and three copies\n * each commented as byte-identical to the other two were a drift hazard, not a\n * design. Importing the constant from the package all three ends already depend\n * on is not the same as importing the server — parity of *behavior* is still\n * asserted by behavior tests, and this package still has no `@byok-sdk/server`\n * edge. Re-exported so this module's public surface is unchanged.\n */\nimport { NONCE_SIGNING_DOMAIN } from '@byok-sdk/core';\nimport type { CloudCrypto } from '../crypto/port';\n\nexport { NONCE_SIGNING_DOMAIN } from '@byok-sdk/core';\n\nexport function verifyNonceSignature(\n crypto: CloudCrypto,\n devicePublicKey: string,\n nonce: string,\n signature: string,\n): Promise<boolean> {\n // `CloudCrypto.verifyEd25519` takes the message as a string and encodes it as\n // UTF-8 itself, so the concatenation happens here rather than through core's\n // `nonceSigningBytes` — same bytes, one encoding step instead of two.\n return crypto.verifyEd25519(devicePublicKey, NONCE_SIGNING_DOMAIN + nonce, signature);\n}\n","/**\n * The auth plane: everything the three pre-tenant routes (`/byok/pair`,\n * `/byok/challenge`, `/byok/token`) need, and nothing else.\n *\n * Those three routes cannot take a {@link TenantStores} facade — they run\n * BEFORE a principal exists, which is exactly why they are the surface where a\n * tenant boundary is easiest to lose. So instead of handing them naked stores\n * and trusting each handler to pass the right tenant, this module owns every\n * tenant-carrying call they make and hands back operations that name no tenant\n * at all:\n *\n * - a pairing code redeems into a REGISTERED device row in one step, so the\n * claims never sit in handler scope as a tenant a handler could substitute;\n * - a device resolves to a row (the pre-tenant lookup, §6.2's pinned wire\n * contract), and unknown/revoked collapse to one answer;\n * - nonce issue/validate/consume and token minting take that ROW, so the\n * tenant they act on is the row's, by construction.\n */\nimport type { Clock, TenantId } from '@byok-sdk/core';\nimport type { CloudCrypto } from '../crypto/port';\nimport type { CloudStores, DeviceRecord, PairingCodeInfo } from '../stores/ports';\nimport { ACCESS_TOKEN_TTL_SECONDS, type TokenSigner } from './tokens';\nimport { verifyNonceSignature } from './verify';\n\n/** ~10min, matching the reference server's pairing-code lifetime. */\nexport const PAIRING_CODE_TTL_MS = 10 * 60 * 1000;\n\nconst PAIRING_CODE_LENGTH = 8;\n\n/** The paired identity key is the first and only proof key in S6. */\nexport const DEVICE_IDENTITY_PROOF_KEY_ID = 'identity';\nexport const DEVICE_IDENTITY_PROOF_KEY_EPOCH = 0;\n\nexport interface PairInput {\n readonly pairingCode: string;\n readonly deviceName: string;\n readonly devicePublicKey: string;\n}\n\nexport interface MintedAccessToken {\n readonly accessToken: string;\n readonly expiresAt: string;\n}\n\nexport interface AuthPlane {\n /** Host control plane: mint a single-use code carrying the tenant/product a device will land in. */\n createPairingCode(tenant: TenantId, input: { readonly productId: string; readonly ttlMs?: number }): Promise<PairingCodeInfo>;\n /**\n * Redeem a code and register the device it pairs, in one step. `undefined`\n * for a code that is unknown, expired, or already used — one answer for all\n * three. Single-use redemption is what makes this exclusive: a second\n * redeem never reaches the row write.\n */\n redeemAndRegister(input: PairInput): Promise<DeviceRecord | undefined>;\n /** The pre-tenant device lookup §6.2's wire contract forces. `undefined` for unknown AND revoked alike — no existence oracle. */\n resolveDevice(deviceId: string): Promise<DeviceRecord | undefined>;\n issueNonce(device: DeviceRecord): Promise<string>;\n validateNonce(device: DeviceRecord, nonce: string): Promise<boolean>;\n /** Burn the nonce. Called only on a fully verified request (§6.2). */\n consumeNonce(device: DeviceRecord, nonce: string): Promise<void>;\n /** Domain-separated (`byok-nonce-v1\\n`) — see `verify.ts`. A raw signature over the bare nonce is invalid, with no second accepted form. */\n verifySignature(device: DeviceRecord, nonce: string, signature: string): Promise<boolean>;\n mintAccessToken(device: DeviceRecord): Promise<MintedAccessToken>;\n}\n\nexport interface AuthPlaneDeps {\n readonly stores: CloudStores;\n readonly crypto: CloudCrypto;\n readonly clock: Clock;\n readonly tokenSigner: TokenSigner;\n readonly accessTokenTtlSeconds?: number;\n}\n\nexport function createAuthPlane(deps: AuthPlaneDeps): AuthPlane {\n const { stores, crypto, clock, tokenSigner } = deps;\n const ttlSeconds = deps.accessTokenTtlSeconds ?? ACCESS_TOKEN_TTL_SECONDS;\n\n return {\n async createPairingCode(tenant, input) {\n const expiresAt = new Date(clock.now().getTime() + (input.ttlMs ?? PAIRING_CODE_TTL_MS)).toISOString();\n return stores.pairingCodes.issue(tenant, {\n code: crypto.randomPairingCode(PAIRING_CODE_LENGTH),\n productId: input.productId,\n expiresAt,\n });\n },\n\n async redeemAndRegister(input) {\n const claims = await stores.pairingCodes.redeem(input.pairingCode);\n if (claims === undefined) return undefined;\n // The redeemed code's claims are the ONLY source of the device's\n // tenant/product — `PairRequest` carries neither, so a device can never\n // choose where it lands.\n return stores.devices.register(claims.tenantId, {\n productId: claims.productId,\n deviceId: `dev_${crypto.randomUuid()}`,\n deviceName: input.deviceName,\n devicePublicKey: input.devicePublicKey,\n proofKeyId: DEVICE_IDENTITY_PROOF_KEY_ID,\n proofKeyEpoch: DEVICE_IDENTITY_PROOF_KEY_EPOCH,\n });\n },\n\n async resolveDevice(deviceId) {\n const device = await stores.devices.resolveByDeviceId(deviceId);\n if (device === undefined || device.revoked) return undefined;\n return device;\n },\n\n issueNonce(device) {\n return stores.nonces.issue(device.tenantId, device.deviceId);\n },\n\n validateNonce(device, nonce) {\n return stores.nonces.validate(device.tenantId, device.deviceId, nonce);\n },\n\n consumeNonce(device, nonce) {\n return stores.nonces.markUsed(device.tenantId, nonce);\n },\n\n verifySignature(device, nonce, signature) {\n return verifyNonceSignature(crypto, device.devicePublicKey, nonce, signature);\n },\n\n async mintAccessToken(device) {\n const accessToken = await tokenSigner.sign(\n { deviceId: device.deviceId, tenantId: device.tenantId, productId: device.productId },\n ttlSeconds,\n );\n return {\n accessToken,\n expiresAt: new Date(clock.now().getTime() + ttlSeconds * 1000).toISOString(),\n };\n },\n };\n}\n","/**\n * The hosted capability declaration (ADR-010).\n *\n * A client learns what a deployment supports by READING a declaration, never\n * by probing an endpoint and interpreting 404/405/501. `@byok-sdk/core` owns the\n * declaration shape and the `hasCapability`/`assertCapability` enforcement\n * point; what lives here is the hosted vocabulary and the mapping from a\n * capability name to the routes that provide it.\n *\n * `GET /byok/capabilities` is a hosted-only route: it is not part of the\n * frozen device wire contract, `@byok-sdk/protocol` is untouched by it, and the\n * daemon does not consume it yet (that lands in a later slice). What it\n * already does here is drive route selection — a deployment that does not\n * declare `blobs.presigned` does not mount the grant routes at all, and one\n * that does not declare `blobs.contentproxy` does not mount the two `/content`\n * routes, so the declaration and the surface cannot disagree.\n */\nimport { CapabilityDeclarationSchema, hasCapability, type CapabilityDeclaration } from '@byok-sdk/core';\n\n/** The hosted capability vocabulary this package knows how to serve. */\nexport const CLOUD_CAPABILITIES = {\n /** `GET /byok/events` long-poll receive (§8). */\n eventsLongPoll: 'events.longpoll',\n /** `POST /byok/messages` batched send (§8.2). */\n messagesBatch: 'messages.batch',\n /** The three bearer-authed blob routes: reserve/grant, explicit finalize, committed-only download (§7). */\n blobsPresigned: 'blobs.presigned',\n /**\n * The two presigned `/byok/blobs/:id/content` routes — cloud carrying the\n * bytes itself.\n *\n * Split out of `blobs.presigned` because it was one capability describing two\n * separable facts. A composition whose bytes live in object storage mints\n * grants (`blobs.presigned`) but has no byte-proxy path at all, and saying so\n * by declaration is ADR-010's whole posture: a client reads what a deployment\n * serves, it never probes a `/content` route and interprets the status code.\n *\n * Spelled all-lowercase because core's declaration schema pins capability\n * names to `/^[a-z0-9]+(?:[._-][a-z0-9]+)*$/` — the same reason the sibling\n * above reads `events.longpoll` and not `events.longPoll`.\n */\n blobsContentProxy: 'blobs.contentproxy',\n /** Board list/claim/unclaim/status routes. Polling is first-class under this declaration. */\n boardCoordination: 'board.coordination',\n /** Additional SSE transport for the same board read model. */\n boardSse: 'board.sse',\n /** Device-scoped five-level presence publication. */\n presenceHints: 'presence.hints',\n /** Bounded task activity batch publication. */\n activityTail: 'activity.tail',\n /** Request-bound device proof record manifest/read/write surface (S6). */\n truthRecords: 'truth.records',\n /**\n * Tenant-scoped skill pack distribution: the manifest list plus the per-file\n * content route a paired device installs from.\n *\n * Hosted HTTP on purpose. A pack is DECLARATIVE CONTENT a device pulls after\n * reading this declaration — not a message — so `@byok-sdk/protocol` gains\n * nothing from it and the frozen v1 envelope stays untouched. Composition-\n * bound like `truth.records`: a deployment that declares it without supplying\n * a `SkillPackStore` is refused at construction rather than publishing two\n * routes it would then 404.\n */\n skillPacks: 'skills.pack',\n} as const;\n\nexport type CloudCapability = (typeof CLOUD_CAPABILITIES)[keyof typeof CLOUD_CAPABILITIES];\n\n/** The wire DTO for `GET /byok/capabilities` — core's shape, bound to a cloud-owned route. */\nexport const CapabilitiesResponseSchema = CapabilityDeclarationSchema;\nexport type CapabilitiesResponse = CapabilityDeclaration;\n\nexport interface FullCapabilityDeclarationOptions {\n /**\n * Composition-bound capabilities require an explicit application authority.\n * `truth.records` is omitted by default because the standard in-memory\n * composition cannot truthfully promise a cross-store atomic commit.\n */\n readonly includeTruthRecords?: boolean;\n /**\n * `skills.pack` is omitted for the same reason: the standard composition is\n * given no `SkillPackStore`, and a default-on declaration would make every\n * existing deployment refuse to construct.\n */\n readonly includeSkillPacks?: boolean;\n}\n\n/** Every capability the standard composition can serve, plus explicitly wired composition-bound ones. */\nexport function fullCapabilityDeclaration(\n version = 1,\n options: FullCapabilityDeclarationOptions = {},\n): CapabilityDeclaration {\n return {\n schema: 'byok-capabilities-v1',\n version,\n capabilities: Object.values(CLOUD_CAPABILITIES).filter((capability) => {\n if (capability === CLOUD_CAPABILITIES.truthRecords) return options.includeTruthRecords === true;\n if (capability === CLOUD_CAPABILITIES.skillPacks) return options.includeSkillPacks === true;\n return true;\n }),\n };\n}\n\nexport function declares(declaration: CapabilityDeclaration, capability: CloudCapability): boolean {\n return hasCapability(declaration, capability);\n}\n","/**\n * The one error taxonomy for `@byok-sdk/cloud`.\n *\n * Same idiom as `@byok-sdk/core`'s `errors.ts`: one class, code-based branching,\n * so a composition maps failures onto HTTP with a code table instead of an\n * `instanceof` chain. Cloud does not re-export core's codes — a cloud error is\n * about the hosted surface (a store contract the composition broke, a\n * declaration the host mis-configured), and core errors travel up unchanged.\n */\n\nexport const CLOUD_ERROR_CODES = {\n /** A pairing code that is unknown, expired, or already redeemed (§6.1). */\n pairing_code_invalid: 'pairing_code_invalid',\n /** The composition handed a device row whose tenant is not a mintable `TenantId`. */\n device_tenant_invalid: 'device_tenant_invalid',\n /**\n * The mailbox committed a row `seq` that disagrees with the delivery `seq`\n * its body factory baked into the envelope. Loud rather than silent: those\n * two numbers ARE the daemon's redelivery cursor.\n */\n mailbox_seq_mismatch: 'mailbox_seq_mismatch',\n /** A capability declaration the host supplied that core refused. */\n capability_declaration_invalid: 'capability_declaration_invalid',\n /**\n * The declaration names a capability this composition cannot serve, so the\n * deployment would publish a surface it does not have (ADR-010).\n *\n * Construction-time and fatal. A client learns what a deployment supports by\n * READING the declaration and is entitled to act on it without probing, so a\n * declaration that over-states is not a degraded deployment — it is a\n * deployment whose one honest interface lies.\n */\n capability_over_declared: 'capability_over_declared',\n /** Host-supplied board labels or coordination input exceeded the explicit contract. */\n coordination_input_invalid: 'coordination_input_invalid',\n /**\n * A terminal receipt whose stored body is not a terminal envelope — either\n * undecodable or a non-terminal type. Whatever wrote that row broke the\n * receipt-store contract, so the typed read model fails closed instead of\n * projecting a best-effort shape.\n */\n terminal_receipt_unreadable: 'terminal_receipt_unreadable',\n /** A progress/activity batch exceeded the configured event or byte ceiling. */\n activity_batch_too_large: 'activity_batch_too_large',\n} as const;\n\nexport type CloudErrorCode = (typeof CLOUD_ERROR_CODES)[keyof typeof CLOUD_ERROR_CODES];\n\nexport class ByokCloudError extends Error {\n public readonly code: CloudErrorCode;\n\n constructor(code: CloudErrorCode, message: string, options?: ErrorOptions) {\n super(message, options);\n this.name = 'ByokCloudError';\n this.code = code;\n }\n}\n\nexport function isCloudError(value: unknown, code?: CloudErrorCode): value is ByokCloudError {\n if (!(value instanceof ByokCloudError)) return false;\n return code === undefined || value.code === code;\n}\n","import { tenantKey, type TenantId } from '@byok-sdk/core';\nimport { AgentEventOrUnknownSchema, type AgentEventOrUnknown } from '@byok-sdk/protocol';\nimport { z } from 'zod';\nimport { ByokCloudError } from './errors';\n\nexport const DEFAULT_ACTIVITY_CAPACITY = 50;\n\nconst ActivityTaskIdSchema = z.string().min(1).max(200);\nconst SourceEnvelopeIdSchema = z\n .string()\n .max(200)\n .regex(/\\S/, 'sourceEnvelopeId must not be blank');\n\nexport const ActivityAppendRequestSchema = z.object({\n taskId: ActivityTaskIdSchema,\n sourceEnvelopeId: SourceEnvelopeIdSchema,\n batchSeq: z.number().int().nonnegative(),\n events: z.array(AgentEventOrUnknownSchema).min(1),\n dropped: z.number().int().nonnegative(),\n});\n\nexport const TimelineEventSchema = z.object({\n taskId: ActivityTaskIdSchema,\n sourceEnvelopeId: SourceEnvelopeIdSchema,\n batchSeq: z.number().int().nonnegative(),\n eventIndex: z.number().int().nonnegative(),\n receivedAt: z.iso.datetime(),\n event: AgentEventOrUnknownSchema,\n});\n\nexport type TimelineEvent = Readonly<z.infer<typeof TimelineEventSchema>>;\n\nexport interface ActivityCursor {\n readonly batchSeq: number;\n readonly eventIndex: number;\n}\n\nexport interface ActivityTail {\n readonly tenantId: TenantId;\n readonly taskId: string;\n readonly entries: readonly TimelineEvent[];\n readonly cursor?: ActivityCursor;\n readonly dropped: number;\n readonly capacity: number;\n readonly expiresAt: string;\n}\n\nexport interface ActivityAppendInput {\n readonly taskId: string;\n readonly sourceEnvelopeId: string;\n readonly batchSeq: number;\n readonly events: readonly AgentEventOrUnknown[];\n readonly dropped: number;\n readonly ttlMs: number;\n readonly capacity?: number;\n}\n\nexport interface ActivityStore {\n append(tenant: TenantId, input: ActivityAppendInput): Promise<ActivityTail>;\n read(tenant: TenantId, taskId: string): Promise<ActivityTail | undefined>;\n}\n\nexport function validateActivityAppend(input: ActivityAppendInput): number {\n if (!Number.isFinite(input.ttlMs) || input.ttlMs <= 0) {\n throw new ByokCloudError(\n 'coordination_input_invalid',\n `Activity ttl must be a positive number of milliseconds, received ${String(input.ttlMs)}.`,\n );\n }\n const capacity = input.capacity ?? DEFAULT_ACTIVITY_CAPACITY;\n if (!Number.isSafeInteger(capacity) || capacity <= 0) {\n throw new ByokCloudError(\n 'coordination_input_invalid',\n `Activity capacity must be a positive integer, received ${String(capacity)}.`,\n );\n }\n const parsed = ActivityAppendRequestSchema.safeParse(input);\n if (!parsed.success) {\n throw new ByokCloudError(\n 'coordination_input_invalid',\n 'Activity batches require stable source identity, order, at least one valid event, and a non-negative dropped count.',\n );\n }\n return capacity;\n}\n\nexport function projectTimelineEvents(\n input: ActivityAppendInput,\n receivedAt: string,\n): readonly TimelineEvent[] {\n return input.events.map((event, eventIndex) =>\n TimelineEventSchema.parse({\n taskId: input.taskId,\n sourceEnvelopeId: input.sourceEnvelopeId,\n batchSeq: input.batchSeq,\n eventIndex,\n receivedAt,\n event,\n }),\n );\n}\n\nexport function parseTimelineEvents(value: unknown): readonly TimelineEvent[] {\n return z.array(TimelineEventSchema).parse(value) as readonly TimelineEvent[];\n}\n\nexport function compareTimelineEvents(left: TimelineEvent, right: TimelineEvent): number {\n return left.batchSeq - right.batchSeq || left.eventIndex - right.eventIndex;\n}\n\nexport function activityCursor(\n entries: readonly TimelineEvent[],\n): ActivityCursor | undefined {\n const last = entries.at(-1);\n return last === undefined ? undefined : { batchSeq: last.batchSeq, eventIndex: last.eventIndex };\n}\n\nexport function activityTailKey(tenant: TenantId, taskId: string): string {\n return tenantKey(tenant, taskId);\n}\n","import type { AgentEventOrUnknown } from '@byok-sdk/protocol';\nimport {\n DEFAULT_ACTIVITY_CAPACITY,\n validateActivityAppend,\n type ActivityAppendInput,\n type ActivityTail,\n} from './activity';\nimport { ByokCloudError } from './errors';\nimport type { TenantBoundActivity } from './tenant-stores';\n\nexport const DEFAULT_BOARD_CHANNEL_MAX_BYTES = 128;\nexport const DEFAULT_BOARD_TITLE_MAX_BYTES = 512;\nexport const DEFAULT_ACTIVITY_MAX_EVENTS = 50;\nexport const DEFAULT_ACTIVITY_MAX_BYTES = 64 * 1024;\nexport { DEFAULT_ACTIVITY_CAPACITY } from './activity';\nexport const DEFAULT_ACTIVITY_TTL_MS = 10 * 60_000;\nexport const DEFAULT_PRESENCE_TTL_MS = 90_000;\nexport const DEFAULT_PRESENCE_MINIMUM_INTERVAL_MS = 5_000;\nexport const DEFAULT_PRESENCE_DETAIL_MAX_BYTES = 512;\n\nconst encoder = new TextEncoder();\n\nexport interface ActivityBounds {\n readonly maxEvents: number;\n readonly maxBytes: number;\n readonly capacity: number;\n readonly ttlMs: number;\n}\n\nexport const DEFAULT_ACTIVITY_BOUNDS: ActivityBounds = {\n maxEvents: DEFAULT_ACTIVITY_MAX_EVENTS,\n maxBytes: DEFAULT_ACTIVITY_MAX_BYTES,\n capacity: DEFAULT_ACTIVITY_CAPACITY,\n ttlMs: DEFAULT_ACTIVITY_TTL_MS,\n};\n\nexport function assertBoardLabels(\n channel: string,\n title: string,\n limits: { readonly channelMaxBytes: number; readonly titleMaxBytes: number },\n): void {\n if (channel.length === 0 || encoder.encode(channel).length > limits.channelMaxBytes) {\n throw new ByokCloudError(\n 'coordination_input_invalid',\n `Board channel must contain 1..${limits.channelMaxBytes} UTF-8 bytes.`,\n );\n }\n if (title.length === 0 || encoder.encode(title).length > limits.titleMaxBytes) {\n throw new ByokCloudError(\n 'coordination_input_invalid',\n `Board title must contain 1..${limits.titleMaxBytes} UTF-8 bytes.`,\n );\n }\n}\n\nexport function validateActivityEvents(\n events: readonly AgentEventOrUnknown[],\n dropped: number,\n bounds: ActivityBounds,\n): void {\n if (!Number.isSafeInteger(dropped) || dropped < 0) {\n throw new ByokCloudError(\n 'coordination_input_invalid',\n 'Activity dropped must be a non-negative integer.',\n );\n }\n if (events.length === 0 || events.length > bounds.maxEvents) {\n throw new ByokCloudError(\n 'activity_batch_too_large',\n `Activity batch must contain 1..${bounds.maxEvents} events.`,\n );\n }\n const encoded = JSON.stringify(events);\n if (encoder.encode(encoded).length > bounds.maxBytes) {\n throw new ByokCloudError(\n 'activity_batch_too_large',\n `Activity batch exceeds ${bounds.maxBytes} UTF-8 bytes.`,\n );\n }\n}\n\nexport function validateActivityBatch(\n input: Omit<ActivityAppendInput, 'ttlMs' | 'capacity'>,\n bounds: ActivityBounds,\n): void {\n validateActivityEvents(input.events, input.dropped, bounds);\n validateActivityAppend({ ...input, ttlMs: bounds.ttlMs, capacity: bounds.capacity });\n}\n\nexport async function appendActivityEvents(\n activity: TenantBoundActivity,\n input: {\n readonly taskId: string;\n readonly sourceEnvelopeId: string;\n readonly batchSeq: number;\n readonly events: readonly AgentEventOrUnknown[];\n readonly dropped: number;\n },\n bounds: ActivityBounds,\n): Promise<ActivityTail> {\n validateActivityBatch(input, bounds);\n return activity.append({\n taskId: input.taskId,\n sourceEnvelopeId: input.sourceEnvelopeId,\n batchSeq: input.batchSeq,\n events: input.events,\n dropped: input.dropped,\n ttlMs: bounds.ttlMs,\n capacity: bounds.capacity,\n });\n}\n","/**\n * The single bearer check every device-facing route shares.\n *\n * S1 shape, reproduced exactly: the token's `(tenantId, deviceId, productId)`\n * are LOOKUP KEYS, and the ROW that comes back is the authority. A token for a\n * device that no longer exists, one whose tenant does not own that device, one\n * whose product disagrees with the row, one for a revoked device, an expired\n * token, and a malformed tenant id in the claims all fail identically here and\n * are indistinguishable to the caller. There is deliberately no \"which of\n * those was it\" signal to hand back, so no route can turn a 401 into a\n * cross-tenant existence oracle.\n *\n * The returned {@link DevicePrincipal} is core's, carrying a minted\n * `TenantId` — which is what makes it the only legal input to\n * `tenantStoresFor` (`../tenant-stores.ts`).\n */\nimport { isTenantId, tenantId, type DevicePrincipal } from '@byok-sdk/core';\nimport type { DeviceDirectory } from '../stores/ports';\nimport type { TokenSigner } from './tokens';\n\nexport interface BearerAuthDeps {\n readonly tokenSigner: TokenSigner;\n readonly devices: DeviceDirectory;\n}\n\nexport function extractBearerToken(header: string | undefined): string | undefined {\n if (header === undefined) return undefined;\n const match = /^Bearer\\s+(.+)$/i.exec(header);\n return match?.[1];\n}\n\nexport async function authenticateBearer(\n header: string | undefined,\n deps: BearerAuthDeps,\n): Promise<DevicePrincipal | undefined> {\n const token = extractBearerToken(header);\n if (token === undefined) return undefined;\n\n const claims = await deps.tokenSigner.verify(token);\n if (claims === undefined) return undefined;\n // The claim is a bare string until it is minted; a tenant id that core would\n // refuse is simply not a tenant this deployment ever issued a token for.\n if (!isTenantId(claims.tenantId)) return undefined;\n\n const device = await deps.devices.get(tenantId(claims.tenantId), claims.deviceId);\n if (device === undefined || device.revoked) return undefined;\n if (device.productId !== claims.productId) return undefined;\n\n return {\n kind: 'device',\n tenantId: device.tenantId,\n productId: device.productId,\n deviceId: device.deviceId,\n };\n}\n","/**\n * Layer 2 of the six-layer isolation model (§12.6.2) — the tenant-closed\n * facade a handler actually receives.\n *\n * `@byok-sdk/core`'s `stores.ts` deliberately left this undefined: it is shaped by\n * how handlers are written, and the first handlers live here. This is that\n * shape, and the two properties it exists to enforce are:\n *\n * 1. **It can only be built from an authenticated principal.** {@link\n * tenantStoresFor} is the only constructor, and its first parameter is a\n * `Principal` — a value that only `authenticateBearer` (`auth/bearer.ts`)\n * mints, and only from a device ROW. There is no path from a device-supplied\n * string to a facade.\n * 2. **No handler ever passes a `TenantId` again.** Every method below has the\n * tenant pre-applied, so a handler cannot read `principal.tenantId` off one\n * principal and hand a different tenant to a store. Grep the handler tree\n * for `TenantId` and you will not find one — asserted by\n * `src/__tests__/constraints.test.ts`.\n *\n * The three pre-tenant store methods (`resolveByDeviceId`, `redeem`, the\n * presigned blob calls) are deliberately absent from this surface: a\n * device-facing handler must not be able to reach them.\n */\nimport {\n principalTenant,\n type BoardClaimInput,\n type BoardItem,\n type BoardItemInput,\n type BoardListQuery,\n type BoardPage,\n type BoardStatusUpdateInput,\n type BoardUnclaimInput,\n type CoreStores,\n type MailboxAdvanceCursorInput,\n type MailboxAppendInput,\n type MailboxCursorState,\n type MailboxMessage,\n type MailboxPage,\n type MailboxReadQuery,\n type Principal,\n type PresenceHint,\n type PresenceHintInput,\n type StorageFinalizeInput,\n type StorageFinalizeResult,\n type StorageReservation,\n type StorageReservationInput,\n type TenantId,\n} from '@byok-sdk/core';\nimport type { ActivityAppendInput, ActivityTail } from './activity';\nimport type {\n ApprovalTimelineAppendInput,\n ApprovalTimelineTail,\n} from './approval-timeline';\nimport type {\n BlobObservation,\n CloudStores,\n DeviceRecord,\n RequestReceipt,\n TaskAttempt,\n TaskAttemptStatus,\n} from './stores/ports';\n\nexport interface TenantBoundMailbox {\n append(input: MailboxAppendInput): Promise<MailboxMessage>;\n /** Pure read. Never advances the cursor — the daemon's next poll is the only ack. */\n readAfter(query: MailboxReadQuery): Promise<MailboxPage>;\n advanceCursor(input: MailboxAdvanceCursorInput): Promise<MailboxCursorState>;\n readCursor(deviceId: string): Promise<MailboxCursorState>;\n}\n\nexport interface TenantBoundBoard {\n create(input: BoardItemInput): Promise<BoardItem>;\n get(itemId: string): Promise<BoardItem | undefined>;\n list(query: BoardListQuery): Promise<BoardPage>;\n claim(input: BoardClaimInput): Promise<BoardItem>;\n unclaim(input: BoardUnclaimInput): Promise<BoardItem>;\n updateStatus(input: BoardStatusUpdateInput): Promise<BoardItem>;\n}\n\nexport interface TenantBoundPresence {\n publish(input: PresenceHintInput): Promise<PresenceHint>;\n read(deviceId: string): Promise<PresenceHint | undefined>;\n list(): Promise<readonly PresenceHint[]>;\n}\n\nexport interface TenantBoundActivity {\n append(input: ActivityAppendInput): Promise<ActivityTail>;\n read(taskId: string): Promise<ActivityTail | undefined>;\n}\n\nexport interface TenantBoundApprovalTimeline {\n append(input: ApprovalTimelineAppendInput): Promise<ApprovalTimelineTail>;\n read(taskId: string): Promise<ApprovalTimelineTail | undefined>;\n}\n\nexport interface TenantBoundDevices {\n get(deviceId: string): Promise<DeviceRecord | undefined>;\n list(): Promise<readonly DeviceRecord[]>;\n revoke(deviceId: string): Promise<void>;\n}\n\nexport interface TenantBoundTaskAttempts {\n open(input: { readonly taskId: string; readonly deviceId: string }): Promise<TaskAttempt>;\n get(taskId: string): Promise<TaskAttempt | undefined>;\n claim(input: { readonly taskId: string; readonly deviceId: string }): Promise<TaskAttempt | undefined>;\n recordStatus(input: { readonly taskId: string; readonly status: TaskAttemptStatus }): Promise<TaskAttempt | undefined>;\n}\n\nexport interface TenantBoundDedup {\n checkAndRecord(deviceId: string, envelopeId: string): Promise<boolean>;\n}\n\nexport interface TenantBoundReceipts {\n record(input: { readonly key: string; readonly body: string }): Promise<{\n readonly receipt: RequestReceipt;\n readonly created: boolean;\n }>;\n get(key: string): Promise<RequestReceipt | undefined>;\n}\n\nexport interface TenantBoundBlobs {\n createUpload(reservation: StorageReservation): Promise<{ readonly blobId: string; readonly uploadUrl: string }>;\n observeUpload(blobId: string, reservation: StorageReservation): Promise<BlobObservation | undefined>;\n getDownloadUrl(blobId: string): Promise<string | undefined>;\n}\n\nexport interface TenantBoundQuota {\n readReservation(reservationId: string): Promise<StorageReservation | undefined>;\n reserve(input: StorageReservationInput): Promise<StorageReservation>;\n finalizeReservation(input: StorageFinalizeInput): Promise<StorageFinalizeResult>;\n abortReservation(reservationId: string): Promise<StorageReservation>;\n}\n\nexport interface TenantBoundRateLimiter {\n consume(deviceId: string): Promise<boolean>;\n}\n\nexport interface TenantStores {\n readonly tenant: TenantId;\n readonly principal: Principal;\n readonly mailbox: TenantBoundMailbox;\n readonly board: TenantBoundBoard;\n readonly presence: TenantBoundPresence;\n readonly activity: TenantBoundActivity;\n readonly approvals: TenantBoundApprovalTimeline;\n readonly devices: TenantBoundDevices;\n readonly tasks: TenantBoundTaskAttempts;\n readonly dedup: TenantBoundDedup;\n readonly receipts: TenantBoundReceipts;\n readonly blobs: TenantBoundBlobs;\n readonly quota: TenantBoundQuota;\n readonly rateLimiter: TenantBoundRateLimiter;\n}\n\n/** Every naked store a composition supplies. Only {@link tenantStoresFor} reads this. */\nexport interface CloudRootStores {\n readonly core: CoreStores;\n readonly cloud: CloudStores;\n}\n\nexport function tenantStoresFor(principal: Principal, root: CloudRootStores): TenantStores {\n const tenant = principalTenant(principal);\n const { core, cloud } = root;\n\n return {\n tenant,\n principal,\n mailbox: {\n append: (input) => core.mailbox.append(tenant, input),\n readAfter: (query) => core.mailbox.readAfter(tenant, query),\n advanceCursor: (input) => core.mailbox.advanceCursor(tenant, input),\n readCursor: (deviceId) => core.mailbox.readCursor(tenant, deviceId),\n },\n board: {\n create: (input) => core.board.create(tenant, input),\n get: (itemId) => core.board.get(tenant, itemId),\n list: (query) => core.board.list(tenant, query),\n claim: (input) => core.board.claim(tenant, input),\n unclaim: (input) => core.board.unclaim(tenant, input),\n updateStatus: (input) => core.board.updateStatus(tenant, input),\n },\n presence: {\n publish: (input) => core.presence.publish(tenant, input),\n read: (deviceId) => core.presence.read(tenant, deviceId),\n list: () => core.presence.list(tenant),\n },\n activity: {\n append: (input) => cloud.activity.append(tenant, input),\n read: (taskId) => cloud.activity.read(tenant, taskId),\n },\n approvals: {\n append: (input) => cloud.approvals.append(tenant, input),\n read: (taskId) => cloud.approvals.read(tenant, taskId),\n },\n devices: {\n get: (deviceId) => cloud.devices.get(tenant, deviceId),\n list: () => cloud.devices.list(tenant),\n revoke: (deviceId) => cloud.devices.revoke(tenant, deviceId),\n },\n tasks: {\n open: (input) => cloud.tasks.open(tenant, input),\n get: (taskId) => cloud.tasks.get(tenant, taskId),\n claim: (input) => cloud.tasks.claim(tenant, input),\n recordStatus: (input) => cloud.tasks.recordStatus(tenant, input),\n },\n dedup: {\n checkAndRecord: (deviceId, envelopeId) => cloud.dedup.checkAndRecord(tenant, deviceId, envelopeId),\n },\n receipts: {\n record: (input) => cloud.receipts.record(tenant, input),\n get: (key) => cloud.receipts.get(tenant, key),\n },\n blobs: {\n createUpload: (reservation) => cloud.blobs.createUpload(tenant, reservation),\n observeUpload: (blobId, reservation) => cloud.blobs.observeUpload(tenant, blobId, reservation),\n getDownloadUrl: (blobId) => cloud.blobs.getDownloadUrl(tenant, blobId),\n },\n quota: {\n readReservation: (reservationId) => core.quota.readReservation(tenant, reservationId),\n reserve: (input) => core.quota.reserve(tenant, input),\n finalizeReservation: (input) => core.quota.finalizeReservation(tenant, input),\n abortReservation: (reservationId) => core.quota.abortReservation(tenant, reservationId),\n },\n rateLimiter: {\n consume: (deviceId) => cloud.rateLimiter.consume(tenant, deviceId),\n },\n };\n}\n","/**\n * The two things every device-facing handler starts from: a tolerant JSON body\n * read, and the bearer -> principal -> tenant-closed-facade step.\n *\n * Once {@link authenticateDevice} has answered, a handler holds a\n * `TenantStores` and a `DevicePrincipal` and never sees a `TenantId` again.\n */\nimport type { Context } from 'hono';\nimport type { DevicePrincipal } from '@byok-sdk/core';\nimport { authenticateBearer, type BearerAuthDeps } from '../auth/bearer';\nimport { tenantStoresFor, type CloudRootStores, type TenantStores } from '../tenant-stores';\n\n/** Every error response on this surface is `{ error }` — the same shape the reference server uses. */\nexport interface ErrorBody {\n readonly error: string;\n}\n\nexport async function readJsonBody(c: Context): Promise<unknown> {\n try {\n return await c.req.json();\n } catch {\n return undefined;\n }\n}\n\nexport interface DeviceRouteDeps {\n readonly bearer: BearerAuthDeps;\n readonly root: CloudRootStores;\n}\n\nexport interface AuthenticatedDeviceContext {\n readonly device: DevicePrincipal;\n readonly stores: TenantStores;\n}\n\n/**\n * `undefined` means \"answer 401\" — and it means that for a missing header, a\n * forged token, an expired token, a revoked device, a product mismatch, and a\n * token whose tenant does not own the device, indistinguishably.\n */\nexport async function authenticateDevice(\n c: Context,\n deps: DeviceRouteDeps,\n): Promise<AuthenticatedDeviceContext | undefined> {\n const device = await authenticateBearer(c.req.header('authorization'), deps.bearer);\n if (device === undefined) return undefined;\n return { device, stores: tenantStoresFor(device, deps.root) };\n}\n","/**\n * Blob flows (§7).\n *\n * Two route classes on purpose: `POST /byok/blobs` and `GET\n * /byok/blobs/:id/url` are bearer-authed and therefore tenant-closed (a\n * download URL is minted only for a blob the caller's own tenant owns, and a\n * foreign blob is indistinguishable from a missing one); the two `/content`\n * routes are presigned, because they are meant to be hit directly — by a\n * browser, by a `PUT` from a daemon that holds only the signed URL — with no\n * JWT in scope at all. The HMAC signature over the blob id plus its expiry IS\n * the credential there, which is why those two carry the `presigned` class in\n * the route inventory rather than being lumped in with the device routes.\n *\n * The split runs all the way down: the bearer-authed pair reaches blobs only\n * through the tenant facade and never holds a naked store, and the presigned\n * pair holds only a {@link BlobContentProxy} and no bearer deps. A composition\n * without a proxy does not mount them (`cloud.ts`).\n */\nimport type { Context } from 'hono';\nimport { z } from 'zod';\nimport {\n CreateBlobRequestSchema,\n type BlobDownloadUrlResponse,\n type CreateBlobResponse,\n} from '@byok-sdk/protocol';\nimport {\n STORAGE_ERROR_CODES,\n STORAGE_ERROR_HTTP_STATUS,\n contentHash,\n isCoreError,\n type StorageErrorCode,\n} from '@byok-sdk/core';\nimport type { BlobContentProxy } from '../stores/ports';\nimport { authenticateDevice, readJsonBody, type DeviceRouteDeps } from './shared';\n\n/** The three bearer-authed routes: everything they touch goes through the tenant facade. */\nexport interface BlobRouteDeps extends DeviceRouteDeps {\n readonly maxBlobSizeBytes: number;\n}\n\n/** Reservation and presign grants deliberately share one expiry horizon. */\nexport const BLOB_RESERVATION_TTL_MS = 15 * 60 * 1000;\n\n/**\n * The two presigned routes. No bearer deps at all — there is no principal to\n * build a facade from, and the proxy is the only thing they need.\n */\nexport interface BlobContentRouteDeps {\n readonly contentProxy: BlobContentProxy;\n}\n\n/**\n * The presigned query contract. Cloud-owned (the wire DTO package covers\n * request/response BODIES, not URL signing), and validated rather than\n * hand-parsed so a non-numeric `exp` is a failed verification instead of a\n * `NaN` comparison that quietly answers `false` for the wrong reason.\n */\nconst SignedUrlQuerySchema = z.object({\n sig: z.string().min(1),\n exp: z.coerce.number().finite(),\n});\n\nexport function createBlobHandler(deps: BlobRouteDeps) {\n return async (c: Context): Promise<Response> => {\n const authenticated = await authenticateDevice(c, deps);\n if (authenticated === undefined) return c.json({ error: 'unauthorized' }, 401);\n\n const parsed = CreateBlobRequestSchema.safeParse(await readJsonBody(c));\n if (!parsed.success) return c.json({ error: 'size, contentType, and contentHash are required' }, 400);\n if (parsed.data.size > deps.maxBlobSizeBytes) {\n return c.json({ error: `blob exceeds max size of ${deps.maxBlobSizeBytes} bytes` }, 413);\n }\n\n const reservationId = idempotencyKey(c);\n if (reservationId === undefined) {\n return c.json({ error: 'Idempotency-Key header is required' }, 400);\n }\n\n try {\n const reservation = await authenticated.stores.quota.reserve({\n reservationId,\n kind: 'object',\n expectedBytes: BigInt(parsed.data.size),\n contentHash: contentHash(parsed.data.contentHash),\n contentType: parsed.data.contentType,\n ttlMs: BLOB_RESERVATION_TTL_MS,\n });\n try {\n const { blobId, uploadUrl } = await authenticated.stores.blobs.createUpload(reservation);\n const response: CreateBlobResponse = { blobId, uploadUrl };\n return c.json(response, 200);\n } catch (error) {\n // Preserve the grant failure as the client-facing authority. Cleanup\n // is best-effort here; admission reaps an abandoned hold after TTL if\n // the store is concurrently unavailable.\n await authenticated.stores.quota.abortReservation(reservationId).catch(() => undefined);\n const rendered = renderStorageError(c, error);\n if (rendered !== undefined) return rendered;\n throw error;\n }\n } catch (error) {\n const rendered = renderStorageError(c, error);\n if (rendered !== undefined) return rendered;\n throw error;\n }\n };\n}\n\nexport function finalizeBlobHandler(deps: BlobRouteDeps) {\n return async (c: Context): Promise<Response> => {\n const authenticated = await authenticateDevice(c, deps);\n if (authenticated === undefined) return c.json({ error: 'unauthorized' }, 401);\n\n const reservationId = idempotencyKey(c);\n if (reservationId === undefined) {\n return c.json({ error: 'Idempotency-Key header is required' }, 400);\n }\n\n try {\n const reservation = await authenticated.stores.quota.readReservation(reservationId);\n if (reservation === undefined) {\n return c.json({ error: 'storage_reservation_not_found' }, 404);\n }\n const blobId = c.req.param('id') ?? '';\n const observed = await authenticated.stores.blobs.observeUpload(\n blobId,\n reservation,\n );\n if (observed === undefined) {\n await authenticated.stores.quota.abortReservation(reservationId);\n return c.json({ error: 'storage_integrity_mismatch' }, 422);\n }\n\n await authenticated.stores.quota.finalizeReservation({\n reservationId,\n ...observed,\n });\n return c.body(null, 204);\n } catch (error) {\n const rendered = renderStorageError(c, error);\n if (rendered !== undefined) return rendered;\n throw error;\n }\n };\n}\n\nexport function blobDownloadUrlHandler(deps: BlobRouteDeps) {\n return async (c: Context): Promise<Response> => {\n const authenticated = await authenticateDevice(c, deps);\n if (authenticated === undefined) return c.json({ error: 'unauthorized' }, 401);\n\n const downloadUrl = await authenticated.stores.blobs.getDownloadUrl(c.req.param('id') ?? '');\n if (downloadUrl === undefined) return c.json({ error: 'blob not found' }, 404);\n\n const response: BlobDownloadUrlResponse = { downloadUrl };\n return c.json(response, 200);\n };\n}\n\nexport function blobUploadContentHandler(deps: BlobContentRouteDeps) {\n return async (c: Context): Promise<Response> => {\n const blobId = c.req.param('id') ?? '';\n const query = SignedUrlQuerySchema.safeParse({ sig: c.req.query('sig'), exp: c.req.query('exp') });\n if (!query.success || !(await deps.contentProxy.verifySignedUrl(blobId, 'put', query.data.sig, query.data.exp))) {\n return c.json({ error: 'invalid or expired signature' }, 401);\n }\n\n const result = await deps.contentProxy.writeContent(blobId, new Uint8Array(await c.req.arrayBuffer()));\n if (!result.ok) return c.json({ error: result.reason }, 422);\n return c.body(null, 204);\n };\n}\n\nexport function blobDownloadContentHandler(deps: BlobContentRouteDeps) {\n return async (c: Context): Promise<Response> => {\n const blobId = c.req.param('id') ?? '';\n const query = SignedUrlQuerySchema.safeParse({ sig: c.req.query('sig'), exp: c.req.query('exp') });\n if (!query.success || !(await deps.contentProxy.verifySignedUrl(blobId, 'get', query.data.sig, query.data.exp))) {\n return c.json({ error: 'invalid or expired signature' }, 401);\n }\n\n const content = await deps.contentProxy.readContent(blobId);\n if (content === undefined) return c.json({ error: 'blob not found' }, 404);\n return c.body(new Uint8Array(content.data), 200, { 'content-type': content.contentType });\n };\n}\n\nfunction idempotencyKey(c: Context): string | undefined {\n const value = c.req.header('Idempotency-Key');\n if (value === undefined || value.length === 0 || value.length > 200) return undefined;\n return value;\n}\n\nfunction renderStorageError(c: Context, error: unknown): Response | undefined {\n if (!isCoreError(error)) return undefined;\n if ((STORAGE_ERROR_CODES as readonly string[]).includes(error.code)) {\n const code = error.code as StorageErrorCode;\n return c.json({ error: code }, STORAGE_ERROR_HTTP_STATUS[code]);\n }\n if (error.code === 'storage_reservation_not_found' || error.code === 'object_not_found') {\n return c.json({ error: error.code }, 404);\n }\n if (error.code === 'storage_entitlement_missing' || error.code === 'object_state_invalid') {\n return c.json({ error: error.code }, 409);\n }\n if (error.code === 'content_hash_invalid') {\n return c.json({ error: error.code }, 400);\n }\n return undefined;\n}\n","/**\n * `GET /byok/capabilities` — the declaration route (ADR-010).\n *\n * Public by design: a client has to be able to read what a deployment supports\n * before it holds a credential, and the declaration is a deployment-level\n * fact, not a tenant-level one. Nothing tenant-scoped may ever be added to\n * this response for exactly that reason.\n */\nimport type { Context } from 'hono';\nimport type { CapabilityDeclaration } from '@byok-sdk/core';\n\nexport interface CapabilitiesRouteDeps {\n readonly declaration: CapabilityDeclaration;\n}\n\nexport function capabilitiesHandler(deps: CapabilitiesRouteDeps) {\n return async (c: Context): Promise<Response> => c.json(deps.declaration, 200);\n}\n","/**\n * Auth v2 (docs/protocol.md §6): pair, challenge, token.\n *\n * Byte-for-byte the same request/response DTOs the daemon already speaks,\n * because they come from `@byok-sdk/protocol` rather than from a hosted copy of\n * them. The behavior differences a hosted surface DOES make are two, both\n * narrowing:\n *\n * - a pairing code that is unknown, expired, or already used gets one 401 with\n * one message (the reference server names the reason);\n * - an unknown device and a revoked device were already indistinguishable on\n * the reference server, and stay so here.\n */\nimport type { Context } from 'hono';\nimport {\n ChallengeRequestSchema,\n PairRequestSchema,\n TokenRequestSchema,\n type ChallengeResponse,\n type PairResponse,\n type TokenResponse,\n} from '@byok-sdk/protocol';\nimport type { AuthPlane } from '../auth/plane';\nimport { readJsonBody } from './shared';\n\nexport interface AuthRouteDeps {\n readonly auth: AuthPlane;\n}\n\nexport function pairHandler(deps: AuthRouteDeps) {\n return async (c: Context): Promise<Response> => {\n const parsed = PairRequestSchema.safeParse(await readJsonBody(c));\n if (!parsed.success) {\n return c.json({ error: 'pairingCode, deviceName, and devicePublicKey are required strings' }, 400);\n }\n\n const device = await deps.auth.redeemAndRegister(parsed.data);\n if (device === undefined) return c.json({ error: 'invalid pairing code' }, 401);\n\n const { accessToken, expiresAt } = await deps.auth.mintAccessToken(device);\n const response: PairResponse = { deviceId: device.deviceId, accessToken, refreshHint: expiresAt };\n return c.json(response, 200);\n };\n}\n\nexport function challengeHandler(deps: AuthRouteDeps) {\n return async (c: Context): Promise<Response> => {\n const parsed = ChallengeRequestSchema.safeParse(await readJsonBody(c));\n if (!parsed.success) return c.json({ error: 'deviceId is required' }, 400);\n\n // Pre-tenant by construction: `ChallengeRequest` is the pinned wire\n // contract and carries only a deviceId, so the ROW is what tells this\n // deployment which tenant the device belongs to.\n const device = await deps.auth.resolveDevice(parsed.data.deviceId);\n if (device === undefined) return c.json({ error: 'unknown or revoked device' }, 401);\n\n const response: ChallengeResponse = { nonce: await deps.auth.issueNonce(device) };\n return c.json(response, 200);\n };\n}\n\nexport function tokenHandler(deps: AuthRouteDeps) {\n return async (c: Context): Promise<Response> => {\n const parsed = TokenRequestSchema.safeParse(await readJsonBody(c));\n if (!parsed.success) return c.json({ error: 'deviceId, nonce, and signature are required' }, 400);\n const { deviceId, nonce, signature } = parsed.data;\n\n const device = await deps.auth.resolveDevice(deviceId);\n if (device === undefined) return c.json({ error: 'unknown or revoked device' }, 401);\n\n if (!(await deps.auth.validateNonce(device, nonce))) {\n return c.json({ error: 'invalid, expired, or already-used nonce' }, 401);\n }\n // Domain-separated (`byok-nonce-v1\\n`, `auth/verify.ts`): a raw signature\n // over the bare nonce is invalid here, with no second accepted form.\n if (!(await deps.auth.verifySignature(device, nonce, signature))) {\n return c.json({ error: 'invalid signature' }, 401);\n }\n // Burn the nonce only on a fully verified success (§6.2) — an invalid\n // signature attempt does not consume the legitimate device's nonce.\n await deps.auth.consumeNonce(device, nonce);\n\n const { accessToken, expiresAt } = await deps.auth.mintAccessToken(device);\n const response: TokenResponse = { accessToken, expiresAt };\n return c.json(response, 200);\n };\n}\n","/**\n * `GET /byok/events?cursor=N` — the long-poll receive half (§8).\n *\n * Three properties the daemon's transport depends on, reproduced against the\n * core mailbox rather than an in-process outbox:\n *\n * - **Reading is not acknowledging.** `readAfter` never moves the cursor. The\n * ONLY ack is the cursor the daemon brings back on its NEXT poll, after it\n * has durably processed what it was handed — which is why the ack below\n * happens before the read, against the incoming `cursor`, and why a poll\n * that hands back the same cursor replays the same page forever.\n * - **The ack is monotonic.** A cursor at or below what the device already\n * acked carries no new information and is not an ack attempt; only a\n * strictly higher one advances. The store's own\n * `mailbox_cursor_regression` guard stays the authority on going backwards\n * (asserted directly in `src/__tests__/mailbox-cursor.test.ts`).\n * - **The hold.** An empty poll is held open instead of answered immediately,\n * so an idle daemon is not a busy-loop. The hold is a bounded re-read, not a\n * registered waiter: a waiter map is exactly the cross-request state a\n * stateless handler may not keep (S3.5 boxes 14-15), and a second cloud\n * instance would not see it anyway.\n */\nimport type { Context } from 'hono';\nimport { decodeEnvelope, type Envelope, type EventsPollResponse } from '@byok-sdk/protocol';\nimport { authenticateDevice, type DeviceRouteDeps } from './shared';\n\n/** Protocol features this cloud build accepts from a long-poll daemon. */\nconst CLOUD_PROTOCOL_CAPABILITIES = ['result-document'];\n\nexport interface EventsRouteDeps extends DeviceRouteDeps {\n /** How long an empty poll is held open, ms. */\n readonly longPollHoldMs: number;\n /** How often the mailbox is re-read while holding, ms. */\n readonly longPollIntervalMs: number;\n /** Max rows per response. */\n readonly pageLimit: number;\n}\n\nfunction sleep(ms: number): Promise<void> {\n return new Promise((resolve) => setTimeout(resolve, ms));\n}\n\nexport function eventsHandler(deps: EventsRouteDeps) {\n return async (c: Context): Promise<Response> => {\n const authenticated = await authenticateDevice(c, deps);\n if (authenticated === undefined) return c.json({ error: 'unauthorized' }, 401);\n const { device, stores } = authenticated;\n\n const cursorRaw = c.req.query('cursor');\n let cursor = 0;\n if (cursorRaw !== undefined) {\n const parsedCursor = Number(cursorRaw);\n if (!Number.isInteger(parsedCursor) || parsedCursor < 0) return c.json({ error: 'invalid cursor' }, 400);\n cursor = parsedCursor;\n }\n\n const acked = await stores.mailbox.readCursor(device.deviceId);\n if (cursor > acked.ackedSeq) {\n await stores.mailbox.advanceCursor({ deviceId: device.deviceId, ackedSeq: cursor });\n }\n\n const attempts = Math.max(1, Math.ceil(deps.longPollHoldMs / deps.longPollIntervalMs));\n for (let attempt = 0; attempt < attempts; attempt += 1) {\n const page = await stores.mailbox.readAfter({\n deviceId: device.deviceId,\n afterSeq: cursor,\n limit: deps.pageLimit,\n });\n if (page.messages.length > 0) {\n const events: Envelope[] = page.messages.map((message) => decodeEnvelope(message.body));\n const response: EventsPollResponse = {\n events,\n cursor: page.nextSeq,\n capabilities: CLOUD_PROTOCOL_CAPABILITIES,\n };\n return c.json(response, 200);\n }\n if (attempt < attempts - 1) await sleep(deps.longPollIntervalMs);\n }\n\n const response: EventsPollResponse = {\n events: [],\n cursor,\n capabilities: CLOUD_PROTOCOL_CAPABILITIES,\n };\n return c.json(response, 200);\n };\n}\n","import { tenantKey, type TenantId } from '@byok-sdk/core';\nimport { z } from 'zod';\nimport { ByokCloudError } from './errors';\n\nexport const DEFAULT_APPROVAL_TIMELINE_CAPACITY = 50;\nexport const DEFAULT_APPROVAL_TIMELINE_TTL_MS = 10 * 60 * 1_000;\nexport const APPROVAL_SUMMARY_MAX_BYTES = 16 * 1_024;\n\nconst NonBlankIdSchema = z.string().max(200).regex(/\\S/, 'value must not be blank');\nconst TaskIdSchema = z.string().min(1).max(200);\n\nexport const ApprovalTimelineEventSchema = z.discriminatedUnion('type', [\n z.object({\n type: z.literal('approval_requested'),\n summary: z.string(),\n approvalId: NonBlankIdSchema.optional(),\n }),\n z.object({\n type: z.literal('approval_resolved'),\n approvalId: NonBlankIdSchema,\n decision: z.enum(['approve', 'reject']),\n resolvedBy: z.enum(['local']),\n at: z.iso.datetime({ offset: true }),\n }),\n]);\n\nexport type ApprovalTimelineEvent = Readonly<z.infer<typeof ApprovalTimelineEventSchema>>;\n\nexport const ApprovalObservationSchema = z.object({\n taskId: TaskIdSchema,\n sourceEnvelopeId: NonBlankIdSchema,\n revision: z.number().int().positive(),\n receivedAt: z.iso.datetime(),\n event: ApprovalTimelineEventSchema,\n});\n\nexport type ApprovalObservation = Readonly<z.infer<typeof ApprovalObservationSchema>>;\n\nexport interface ApprovalTimelineTail {\n readonly tenantId: TenantId;\n readonly taskId: string;\n readonly entries: readonly ApprovalObservation[];\n readonly cursor?: number;\n readonly dropped: number;\n readonly capacity: number;\n readonly expiresAt: string;\n}\n\nexport interface ApprovalTimelineAppendInput {\n readonly taskId: string;\n readonly sourceEnvelopeId: string;\n readonly event: ApprovalTimelineEvent;\n readonly ttlMs?: number;\n readonly capacity?: number;\n}\n\nexport interface ApprovalTimelineStore {\n append(tenant: TenantId, input: ApprovalTimelineAppendInput): Promise<ApprovalTimelineTail>;\n read(tenant: TenantId, taskId: string): Promise<ApprovalTimelineTail | undefined>;\n}\n\nexport interface ValidatedApprovalTimelineAppend {\n readonly capacity: number;\n readonly ttlMs: number;\n readonly event: ApprovalTimelineEvent;\n}\n\nexport function validateApprovalTimelineAppend(\n input: ApprovalTimelineAppendInput,\n): ValidatedApprovalTimelineAppend {\n const capacity = input.capacity ?? DEFAULT_APPROVAL_TIMELINE_CAPACITY;\n const ttlMs = input.ttlMs ?? DEFAULT_APPROVAL_TIMELINE_TTL_MS;\n if (!Number.isSafeInteger(capacity) || capacity <= 0) {\n throw new ByokCloudError(\n 'coordination_input_invalid',\n `Approval timeline capacity must be a positive integer, received ${String(capacity)}.`,\n );\n }\n if (!Number.isFinite(ttlMs) || ttlMs <= 0) {\n throw new ByokCloudError(\n 'coordination_input_invalid',\n `Approval timeline ttl must be a positive number of milliseconds, received ${String(ttlMs)}.`,\n );\n }\n const parsed = z\n .object({\n taskId: TaskIdSchema,\n sourceEnvelopeId: NonBlankIdSchema,\n event: ApprovalTimelineEventSchema,\n })\n .safeParse(input);\n if (!parsed.success) {\n throw new ByokCloudError(\n 'coordination_input_invalid',\n 'Approval observations require stable source identity and a valid native lifecycle event.',\n );\n }\n if (\n parsed.data.event.type === 'approval_requested' &&\n new TextEncoder().encode(parsed.data.event.summary).byteLength > APPROVAL_SUMMARY_MAX_BYTES\n ) {\n throw new ByokCloudError(\n 'coordination_input_invalid',\n `Approval summary exceeds ${APPROVAL_SUMMARY_MAX_BYTES} UTF-8 bytes.`,\n );\n }\n return { capacity, ttlMs, event: parsed.data.event };\n}\n\nexport function approvalTimelineKey(tenant: TenantId, taskId: string): string {\n return tenantKey(tenant, taskId);\n}\n\nexport function parseApprovalObservations(value: unknown): readonly ApprovalObservation[] {\n return z.array(ApprovalObservationSchema).parse(value) as readonly ApprovalObservation[];\n}\n\nexport function approvalTimelineCursor(\n entries: readonly ApprovalObservation[],\n): number | undefined {\n return entries.at(-1)?.revision;\n}\n","import { isCoreConflictError } from '@byok-sdk/core';\nimport type { TenantBoundBoard } from './tenant-stores';\n\n/**\n * One-way projection from an already accepted terminal fact into coordination.\n *\n * This module deliberately knows no wire message type or execution-state\n * vocabulary. It can only CAS an existing coordination row one step toward\n * review, and a concurrent board decision wins without retry or overwrite.\n */\nexport async function projectTerminalToReview(board: TenantBoundBoard, taskId: string): Promise<void> {\n const item = await board.get(taskId);\n if (item === undefined || item.status !== 'in_progress') return;\n try {\n await board.updateStatus({\n itemId: taskId,\n expectedStatus: 'in_progress',\n status: 'in_review',\n });\n } catch (caught) {\n if (isCoreConflictError(caught)) return;\n throw caught;\n }\n}\n","/**\n * The single inbound choke point for every daemon -> cloud envelope.\n *\n * The reference server runs this gate inside a live `ConnectionHub`; here it\n * is a pure function over a tenant-closed facade, so the same order holds with\n * no connection, no session, and no cross-request state:\n *\n * 0. **rate limit** — one token per inbound envelope, debited BEFORE anything\n * else, so a flood of garbage-typed envelopes costs the same budget as a\n * flood of well-formed ones. S3a's reference limiter allows everything; the\n * seam is what matters at this position.\n * 1. **type-allow** — only `DAEMON_TO_SERVER_TYPES` may pass. A server ->\n * daemon type arriving inbound, or anything unrecognized, is rejected\n * before it is dispatched or counted accepted.\n * 2. **ownership** — an envelope for a task already owned by a DIFFERENT\n * device is dropped, never force-failed: force-failing on an authz mismatch\n * would let an attacker who merely guesses a `taskId` kill the real owner's\n * task. A task with no owner yet, or that this tenant does not have at all,\n * is not rejected here — the store's own no-op-on-missing behavior covers\n * the latter, and it covers it per tenant, so a guessed id from another\n * tenant writes nothing anywhere.\n * 3. **dedup** — an envelope id already seen from this device is a no-op. The\n * wire is at-least-once (§9); this makes processing at-most-once.\n * 4. **apply** — the lifecycle write.\n *\n * A duplicate is still a wire-level success (§8.2): it just did not re-run\n * anything. Only `rejected`/`rate_limited` are excluded from `accepted`.\n */\nimport {\n DAEMON_TO_SERVER_TYPES,\n encodeEnvelope,\n type Envelope,\n type MessageType,\n} from '@byok-sdk/protocol';\nimport {\n validateActivityBatch,\n appendActivityEvents,\n DEFAULT_ACTIVITY_BOUNDS,\n type ActivityBounds,\n} from './coordination';\nimport {\n validateApprovalTimelineAppend,\n type ApprovalTimelineAppendInput,\n} from './approval-timeline';\nimport { isCloudError } from './errors';\nimport { projectTerminalToReview } from './board-projection';\nimport type { TenantStores } from './tenant-stores';\n\nexport type InboundOutcome = 'accepted' | 'duplicate' | 'rejected' | 'rate_limited';\n\n/** Receipt key a task's terminal is recorded under — the idempotency seam S3b's journal will share. */\nexport function terminalReceiptKey(taskId: string): string {\n return `task:${taskId}:terminal`;\n}\n\nexport async function handleInboundEnvelope(\n stores: TenantStores,\n deviceId: string,\n envelope: Envelope,\n activityBounds: ActivityBounds = DEFAULT_ACTIVITY_BOUNDS,\n): Promise<InboundOutcome> {\n if (!(await stores.rateLimiter.consume(deviceId))) return 'rate_limited';\n\n if (!(DAEMON_TO_SERVER_TYPES as readonly MessageType[]).includes(envelope.type)) return 'rejected';\n\n const taskId = envelope.task_id;\n // Every `DAEMON_TO_SERVER_TYPES` member requires `task_id` at the schema\n // level; this is the defensive restatement, not a second contract.\n if (taskId === undefined) return 'rejected';\n\n const attempt = await stores.tasks.get(taskId);\n if (attempt?.ownerDeviceId !== undefined && attempt.ownerDeviceId !== deviceId) return 'rejected';\n\n if (envelope.type === 'task.progress' && envelope.payload.events.length > 0) {\n try {\n validateActivityBatch(\n {\n taskId,\n sourceEnvelopeId: envelope.id,\n batchSeq: envelope.payload.seq,\n events: envelope.payload.events,\n dropped: 0,\n },\n activityBounds,\n );\n } catch (caught) {\n if (\n isCloudError(caught, 'activity_batch_too_large') ||\n isCloudError(caught, 'coordination_input_invalid')\n ) {\n return 'rejected';\n }\n throw caught;\n }\n }\n\n const approvalInput = approvalTimelineAppendInput(taskId, envelope);\n if (approvalInput !== undefined) {\n try {\n validateApprovalTimelineAppend(approvalInput);\n } catch (caught) {\n if (isCloudError(caught, 'coordination_input_invalid')) return 'rejected';\n throw caught;\n }\n }\n\n if (await stores.dedup.checkAndRecord(deviceId, envelope.id)) return 'duplicate';\n\n await applyLifecycle(stores, deviceId, taskId, envelope, activityBounds);\n return 'accepted';\n}\n\n/**\n * The lifecycle half. Deliberately thin: S3a records ownership, the coarse\n * attempt status, the terminal receipt, and bounded activity/approval\n * observations. Artifacts are accepted and carried, but the durable record of\n * what a task *produced* belongs to the truth and board planes (S5/S6) and to\n * S3b's journal — not to a map in this package.\n */\nasync function applyLifecycle(\n stores: TenantStores,\n deviceId: string,\n taskId: string,\n envelope: Envelope,\n activityBounds: ActivityBounds,\n): Promise<void> {\n switch (envelope.type) {\n case 'task.claim':\n await stores.tasks.claim({ taskId, deviceId });\n return;\n case 'task.started':\n await stores.tasks.recordStatus({ taskId, status: 'running' });\n return;\n case 'task.decline':\n await stores.tasks.recordStatus({ taskId, status: 'failed' });\n return;\n case 'task.progress':\n if (envelope.payload.events.length > 0) {\n await appendActivityEvents(\n stores.activity,\n {\n taskId,\n sourceEnvelopeId: envelope.id,\n batchSeq: envelope.payload.seq,\n events: envelope.payload.events,\n dropped: 0,\n },\n activityBounds,\n );\n }\n return;\n case 'task.await_approval':\n await stores.approvals.append(approvalTimelineAppendInput(taskId, envelope)!);\n return;\n case 'task.approval_resolved':\n await stores.approvals.append(approvalTimelineAppendInput(taskId, envelope)!);\n return;\n case 'task.complete':\n await recordTerminal(stores, taskId, envelope, 'complete');\n return;\n case 'task.fail':\n await recordTerminal(stores, taskId, envelope, 'failed');\n return;\n case 'task.cancelled':\n await recordTerminal(stores, taskId, envelope, 'cancelled');\n return;\n default:\n return;\n }\n}\n\nfunction approvalTimelineAppendInput(\n taskId: string,\n envelope: Envelope,\n): ApprovalTimelineAppendInput | undefined {\n switch (envelope.type) {\n case 'task.await_approval':\n return {\n taskId,\n sourceEnvelopeId: envelope.id,\n event: {\n type: 'approval_requested',\n summary: envelope.payload.summary,\n ...(envelope.payload.approvalId === undefined\n ? {}\n : { approvalId: envelope.payload.approvalId }),\n },\n };\n case 'task.approval_resolved':\n return {\n taskId,\n sourceEnvelopeId: envelope.id,\n event: {\n type: 'approval_resolved',\n approvalId: envelope.payload.approvalId,\n decision: envelope.payload.decision,\n resolvedBy: envelope.payload.resolvedBy,\n at: envelope.payload.at,\n },\n };\n default:\n return undefined;\n }\n}\n\n/**\n * First terminal wins (§12.6.4: 不覆写第一份事实). A retried terminal — same\n * task, new envelope id, so dedup does not catch it — records nothing new and\n * leaves the attempt status where the first one put it.\n *\n * What gets stored is `encodeEnvelope(envelope)`: the canonical v1 encoding of\n * the envelope this gate already zod-parsed, NOT the device's original byte\n * sequence. The two are semantically identical by the frozen codec's own\n * round-trip guarantee, but they are not necessarily byte-identical (key\n * order, whitespace, and any field the schema drops are the parser's call, not\n * the device's) — so this receipt is evidence of the first terminal FACT, not\n * a byte-faithful capture of the first terminal REQUEST. S3b's local journal\n * is where the device's own bytes are kept.\n */\nasync function recordTerminal(\n stores: TenantStores,\n taskId: string,\n envelope: Envelope,\n status: 'complete' | 'failed' | 'cancelled',\n): Promise<void> {\n const { created } = await stores.receipts.record({\n key: terminalReceiptKey(taskId),\n body: encodeEnvelope(envelope),\n });\n if (!created) return;\n await stores.tasks.recordStatus({ taskId, status });\n await projectTerminalToReview(stores.board, taskId);\n}\n","/**\n * `POST /byok/messages` — the long-poll send half (§8.2).\n *\n * A device long-polling for cloud -> daemon traffic has no live socket to\n * carry its own outbound envelopes; this batches them over authed HTTP. Every\n * envelope goes through the same gate (`../inbound.ts`) in the same order, so\n * claim/progress/complete behave identically no matter which transport carried\n * them.\n *\n * The batch stays tolerant at the schema level — one malformed envelope must\n * not 400 the whole request — so only a structurally invalid `Envelope` or an\n * oversized batch (`MAX_MESSAGES_PER_BATCH`) fails the request outright.\n *\n * Rate limiting is per REQUEST, not per envelope: the moment any envelope\n * comes back `rate_limited`, the rest of the batch is abandoned (its bucket is\n * empty, so every remaining envelope would limit too) and the WHOLE request\n * answers 429. Envelopes processed earlier in the same batch already took\n * effect — there are no rollback semantics here — which is safe because every\n * `task.*` type is idempotent (§9): a client that retries the same batch gets\n * `duplicate` for whatever already landed.\n */\nimport type { Context } from 'hono';\nimport { MessagesSendRequestSchema, type MessagesSendResponse } from '@byok-sdk/protocol';\nimport { handleInboundEnvelope } from '../inbound';\nimport type { ActivityBounds } from '../coordination';\nimport { authenticateDevice, readJsonBody, type DeviceRouteDeps } from './shared';\n\nexport interface MessagesRouteDeps extends DeviceRouteDeps {\n readonly activityBounds: ActivityBounds;\n}\n\nexport function messagesHandler(deps: MessagesRouteDeps) {\n return async (c: Context): Promise<Response> => {\n const authenticated = await authenticateDevice(c, deps);\n if (authenticated === undefined) return c.json({ error: 'unauthorized' }, 401);\n const { device, stores } = authenticated;\n\n const parsed = MessagesSendRequestSchema.safeParse(await readJsonBody(c));\n if (!parsed.success) return c.json({ error: 'messages must be an array of envelopes' }, 400);\n\n let accepted = 0;\n let rejected = 0;\n for (const envelope of parsed.data.messages) {\n const outcome = await handleInboundEnvelope(\n stores,\n device.deviceId,\n envelope,\n deps.activityBounds,\n );\n if (outcome === 'rate_limited') return c.json({ error: 'rate limit exceeded' }, 429);\n // A duplicate is still a wire-level success (§8.2/§9's idempotency\n // window) — it just did not re-run a handler. Only a gate rejection\n // (wrong-direction type, or an ownership mismatch) is excluded.\n if (outcome === 'rejected') rejected += 1;\n else accepted += 1;\n }\n\n // `rejected` is additive and omitted entirely when zero, so a batch with\n // nothing rejected keeps the `{ accepted }` shape callers depend on.\n const response: MessagesSendResponse = rejected > 0 ? { accepted, rejected } : { accepted };\n return c.json(response, 200);\n };\n}\n","import {\n BOARD_STATUSES,\n isCoreConflictError,\n isCoreError,\n type BoardItem,\n type BoardListQuery,\n type BoardPage,\n} from '@byok-sdk/core';\nimport type { Context } from 'hono';\nimport { z } from 'zod';\nimport { authenticateDevice, readJsonBody, type DeviceRouteDeps } from './shared';\n\nexport const DEFAULT_BOARD_PAGE_LIMIT = 50;\nexport const DEFAULT_BOARD_STREAM_QUERY_INTERVAL_MS = 5_000;\nexport const DEFAULT_BOARD_STREAM_HEARTBEAT_INTERVAL_MS = 15_000;\nexport const DEFAULT_BOARD_STREAM_RECONCILIATION_INTERVAL_MS = 120_000;\n\nexport interface BoardRouteDeps extends DeviceRouteDeps {\n readonly pageLimit: number;\n}\n\nexport interface BoardStreamRouteDeps extends BoardRouteDeps {\n readonly queryIntervalMs: number;\n readonly heartbeatIntervalMs: number;\n readonly reconciliationIntervalMs: number;\n}\n\nconst ClaimBodySchema = z.object({ expectedStatus: z.enum(BOARD_STATUSES).optional() });\nconst StatusBodySchema = z.object({\n expectedStatus: z.enum(BOARD_STATUSES),\n status: z.enum(BOARD_STATUSES),\n});\n\nfunction parseNonNegativeInteger(value: string | undefined): number | undefined {\n if (value === undefined) return 0;\n const parsed = Number(value);\n return Number.isSafeInteger(parsed) && parsed >= 0 ? parsed : undefined;\n}\n\nfunction parsePositiveInteger(value: string | undefined, fallback: number): number | undefined {\n if (value === undefined) return fallback;\n const parsed = Number(value);\n return Number.isSafeInteger(parsed) && parsed > 0 ? parsed : undefined;\n}\n\nfunction boardQuery(c: Context, pageLimit: number): BoardListQuery | undefined {\n const afterSeq = parseNonNegativeInteger(c.req.query('since'));\n const limit = parsePositiveInteger(c.req.query('limit'), pageLimit);\n const statusRaw = c.req.query('status');\n if (afterSeq === undefined || limit === undefined || limit > pageLimit) return undefined;\n if (statusRaw !== undefined && !BOARD_STATUSES.includes(statusRaw as (typeof BOARD_STATUSES)[number])) {\n return undefined;\n }\n return {\n afterSeq,\n limit,\n ...(c.req.query('channel') === undefined ? {} : { channel: c.req.query('channel') }),\n ...(statusRaw === undefined ? {} : { status: statusRaw as (typeof BOARD_STATUSES)[number] }),\n };\n}\n\nexport function boardListHandler(deps: BoardRouteDeps) {\n return async (c: Context): Promise<Response> => {\n const authenticated = await authenticateDevice(c, deps);\n if (authenticated === undefined) return c.json({ error: 'unauthorized' }, 401);\n const query = boardQuery(c, deps.pageLimit);\n if (query === undefined) return c.json({ error: 'invalid board query' }, 400);\n return c.json(await authenticated.stores.board.list(query), 200);\n };\n}\n\nexport function boardClaimHandler(deps: DeviceRouteDeps) {\n return async (c: Context): Promise<Response> => {\n const authenticated = await authenticateDevice(c, deps);\n if (authenticated === undefined) return c.json({ error: 'unauthorized' }, 401);\n const parsed = ClaimBodySchema.safeParse(await readJsonBody(c));\n if (!parsed.success) return c.json({ error: 'invalid claim body' }, 400);\n const itemId = c.req.param('id');\n if (itemId === undefined || itemId.length === 0) return c.json({ error: 'invalid board item id' }, 400);\n try {\n const item = await authenticated.stores.board.claim({\n itemId,\n holderId: authenticated.device.deviceId,\n ...(parsed.data.expectedStatus === undefined\n ? {}\n : { expectedStatus: parsed.data.expectedStatus }),\n });\n return c.json(item, 200);\n } catch (caught) {\n return boardFailure(c, caught);\n }\n };\n}\n\nexport function boardUnclaimHandler(deps: DeviceRouteDeps) {\n return async (c: Context): Promise<Response> => {\n const authenticated = await authenticateDevice(c, deps);\n if (authenticated === undefined) return c.json({ error: 'unauthorized' }, 401);\n const itemId = c.req.param('id');\n if (itemId === undefined || itemId.length === 0) return c.json({ error: 'invalid board item id' }, 400);\n try {\n return c.json(\n await authenticated.stores.board.unclaim({\n itemId,\n holderId: authenticated.device.deviceId,\n }),\n 200,\n );\n } catch (caught) {\n return boardFailure(c, caught);\n }\n };\n}\n\nexport function boardStatusHandler(deps: DeviceRouteDeps) {\n return async (c: Context): Promise<Response> => {\n const authenticated = await authenticateDevice(c, deps);\n if (authenticated === undefined) return c.json({ error: 'unauthorized' }, 401);\n const parsed = StatusBodySchema.safeParse(await readJsonBody(c));\n if (!parsed.success) return c.json({ error: 'invalid status body' }, 400);\n const itemId = c.req.param('id');\n if (itemId === undefined || itemId.length === 0) return c.json({ error: 'invalid board item id' }, 400);\n if (parsed.data.status === 'done') {\n return c.json({ error: 'done requires host review acceptance' }, 403);\n }\n try {\n return c.json(\n await authenticated.stores.board.updateStatus({\n itemId,\n expectedStatus: parsed.data.expectedStatus,\n status: parsed.data.status,\n holderId: authenticated.device.deviceId,\n }),\n 200,\n );\n } catch (caught) {\n return boardFailure(c, caught);\n }\n };\n}\n\nexport function boardStreamHandler(deps: BoardStreamRouteDeps) {\n return async (c: Context): Promise<Response> => {\n const firstAuth = await authenticateDevice(c, deps);\n if (firstAuth === undefined) return c.json({ error: 'unauthorized' }, 401);\n const query = boardQuery(c, deps.pageLimit);\n if (query === undefined) return c.json({ error: 'invalid board query' }, 400);\n\n const querySince = query.afterSeq ?? 0;\n const headerRaw = c.req.header('last-event-id');\n const headerSince = headerRaw === undefined ? undefined : parseNonNegativeInteger(headerRaw);\n if (headerRaw !== undefined && headerSince === undefined) {\n return c.json({ error: 'invalid Last-Event-ID' }, 400);\n }\n if (headerSince !== undefined && c.req.query('since') !== undefined && headerSince !== querySince) {\n return c.json({ error: 'conflicting stream cursors' }, 400);\n }\n\n let stopped = false;\n const stopController = new AbortController();\n const signal = c.req.raw.signal;\n const stream = new ReadableStream<Uint8Array>({\n start(controller) {\n const onAbort = () => {\n stopped = true;\n stopController.abort();\n closeController(controller);\n };\n signal.addEventListener('abort', onAbort, { once: true });\n void pumpBoardStream(\n controller,\n c,\n deps,\n { ...query, afterSeq: headerSince ?? querySince },\n () => stopped || signal.aborted,\n stopController.signal,\n ).finally(() => {\n stopped = true;\n stopController.abort();\n signal.removeEventListener('abort', onAbort);\n closeController(controller);\n });\n },\n cancel() {\n stopped = true;\n stopController.abort();\n },\n });\n\n return new Response(stream, {\n status: 200,\n headers: {\n 'cache-control': 'no-cache, no-transform',\n connection: 'keep-alive',\n 'content-type': 'text/event-stream; charset=utf-8',\n },\n });\n };\n}\n\nasync function pumpBoardStream(\n controller: ReadableStreamDefaultController<Uint8Array>,\n c: Context,\n deps: BoardStreamRouteDeps,\n initialQuery: BoardListQuery,\n isStopped: () => boolean,\n stopSignal: AbortSignal,\n): Promise<void> {\n let cursor = initialQuery.afterSeq ?? 0;\n let lastHeartbeat = performance.now();\n let lastReconcile = performance.now();\n while (!isStopped()) {\n const authenticated = await authenticateDevice(c, deps);\n if (authenticated === undefined) return;\n\n const page = await authenticated.stores.board.list({ ...initialQuery, afterSeq: cursor });\n for (const item of page.items) {\n enqueue(controller, `event: board\\nid: ${item.boardSeq}\\ndata: ${JSON.stringify(item)}\\n\\n`);\n cursor = item.boardSeq;\n }\n if (page.hasMore) continue;\n\n const now = performance.now();\n if (now - lastReconcile >= deps.reconciliationIntervalMs) {\n enqueue(controller, `event: reconcile\\ndata: ${JSON.stringify({ since: 0 })}\\n\\n`);\n lastReconcile = now;\n }\n if (now - lastHeartbeat >= deps.heartbeatIntervalMs) {\n enqueue(controller, ': heartbeat\\n\\n');\n lastHeartbeat = now;\n }\n await abortableSleep(deps.queryIntervalMs, stopSignal);\n }\n}\n\nfunction enqueue(controller: ReadableStreamDefaultController<Uint8Array>, value: string): void {\n try {\n controller.enqueue(new TextEncoder().encode(value));\n } catch {\n // The request abort/cancel path owns closure. A closed controller is terminal.\n }\n}\n\nfunction closeController(controller: ReadableStreamDefaultController<Uint8Array>): void {\n try {\n controller.close();\n } catch {\n // Already closed by the peer or the pump.\n }\n}\n\nasync function abortableSleep(ms: number, signal: AbortSignal): Promise<void> {\n if (signal.aborted) return;\n await new Promise<void>((resolve) => {\n let timer: ReturnType<typeof setTimeout> | undefined;\n const finish = () => {\n if (timer !== undefined) clearTimeout(timer);\n signal.removeEventListener('abort', finish);\n resolve();\n };\n timer = setTimeout(finish, ms);\n signal.addEventListener('abort', finish, { once: true });\n if (signal.aborted) finish();\n });\n}\n\nfunction boardFailure(c: Context, caught: unknown): Response {\n if (isCoreConflictError<BoardItem>(caught)) {\n const holder = caught.current.assignee;\n return c.json(\n {\n error: caught.code,\n current: caught.current,\n observedAt: caught.observedAt,\n ...(holder === undefined ? {} : { holder: { ...holder, observedAt: caught.observedAt } }),\n },\n 409,\n );\n }\n if (isCoreError(caught, 'board_item_not_found')) return c.json({ error: caught.code }, 404);\n if (isCoreError(caught, 'board_not_held')) return c.json({ error: caught.code }, 409);\n throw caught;\n}\n\nexport type BoardPollResponse = BoardPage;\n","import { isCoreError, PRESENCE_LEVELS } from '@byok-sdk/core';\nimport { ConfiguredToolsetsSchema } from '@byok-sdk/protocol';\nimport type { Context } from 'hono';\nimport { z } from 'zod';\nimport { appendActivityEvents, type ActivityBounds } from '../coordination';\nimport { ActivityAppendRequestSchema } from '../activity';\nimport { isCloudError } from '../errors';\nimport { authenticateDevice, readJsonBody, type DeviceRouteDeps } from './shared';\n\nexport interface PresenceRouteDeps extends DeviceRouteDeps {\n readonly ttlMs: number;\n readonly minimumIntervalMs: number;\n readonly detailMaxBytes: number;\n}\n\nexport interface ActivityRouteDeps extends DeviceRouteDeps {\n readonly bounds: ActivityBounds;\n}\n\nconst PresenceBodySchema = z.object({\n level: z.enum(PRESENCE_LEVELS),\n detail: z.string().optional(),\n configuredToolsets: ConfiguredToolsetsSchema.optional(),\n});\n\nexport function presencePublishHandler(deps: PresenceRouteDeps) {\n return async (c: Context): Promise<Response> => {\n const authenticated = await authenticateDevice(c, deps);\n if (authenticated === undefined) return c.json({ error: 'unauthorized' }, 401);\n const parsed = PresenceBodySchema.safeParse(await readJsonBody(c));\n if (!parsed.success) return c.json({ error: 'invalid presence body' }, 400);\n if (\n parsed.data.detail !== undefined &&\n new TextEncoder().encode(parsed.data.detail).length > deps.detailMaxBytes\n ) {\n return c.json({ error: 'presence detail too large' }, 413);\n }\n try {\n return c.json(\n await authenticated.stores.presence.publish({\n deviceId: authenticated.device.deviceId,\n level: parsed.data.level,\n ...(parsed.data.detail === undefined ? {} : { detail: parsed.data.detail }),\n ...(parsed.data.configuredToolsets === undefined\n ? {}\n : { configuredToolsets: parsed.data.configuredToolsets }),\n ttlMs: deps.ttlMs,\n minimumIntervalMs: deps.minimumIntervalMs,\n }),\n 200,\n );\n } catch (caught) {\n if (isCoreError(caught, 'hint_rate_limited')) {\n return c.json({ error: caught.code }, 429);\n }\n throw caught;\n }\n };\n}\n\nexport function activityAppendHandler(deps: ActivityRouteDeps) {\n return async (c: Context): Promise<Response> => {\n const authenticated = await authenticateDevice(c, deps);\n if (authenticated === undefined) return c.json({ error: 'unauthorized' }, 401);\n const parsed = ActivityAppendRequestSchema.safeParse(await readJsonBody(c));\n if (!parsed.success) return c.json({ error: 'invalid activity body' }, 400);\n try {\n return c.json(\n await appendActivityEvents(authenticated.stores.activity, parsed.data, deps.bounds),\n 200,\n );\n } catch (caught) {\n if (isCloudError(caught, 'activity_batch_too_large')) {\n return c.json({ error: caught.code }, 413);\n }\n if (isCloudError(caught, 'coordination_input_invalid')) {\n return c.json({ error: caught.code }, 400);\n }\n throw caught;\n }\n };\n}\n","/**\n * `GET /byok/skill-packs` and `GET /byok/skill-packs/:name/files/:path` — the\n * hosted half of the skill-pack delivery channel.\n *\n * Two device-class reads, and nothing else. There is no publish route here on\n * purpose: a device is a CONSUMER of packs, and a device-bearer-authed write\n * would let any paired device in a tenant publish content to every other device\n * in it. Publication is a host control-plane action against the store directly,\n * exactly as board item creation is.\n *\n * Both routes answer 404 for a pack this tenant does not have — the same answer\n * a name that never existed anywhere gets — so the surface is not a\n * cross-tenant existence oracle. The store is tenant-first, so that property\n * comes from the lookup key rather than from a comparison a handler could\n * forget.\n *\n * Bytes travel as UTF-8 text inside JSON. A pack carries Markdown, YAML and\n * static text; there is no archive to unpack and no binary channel to\n * negotiate, which is the same reason the manifest has no exec surface — the\n * format cannot express the thing we do not want it to express.\n */\nimport { principalTenant, type SkillPackStore } from '@byok-sdk/core';\nimport type { Context } from 'hono';\nimport { authenticateBearer, type BearerAuthDeps } from '../auth/bearer';\n\n/** Rows per `GET /byok/skill-packs` response. A tenant's pack catalogue is small by design. */\nexport const DEFAULT_SKILL_PACK_PAGE_LIMIT = 50;\n\nexport interface SkillPackRouteDeps {\n readonly bearer: BearerAuthDeps;\n readonly skillPacks: SkillPackStore;\n readonly pageLimit: number;\n}\n\nexport function skillPackListHandler(deps: SkillPackRouteDeps) {\n return async (c: Context): Promise<Response> => {\n const device = await authenticateBearer(c.req.header('authorization'), deps.bearer);\n if (device === undefined) return unauthorized(c);\n\n const packs = await deps.skillPacks.list(principalTenant(device), { limit: deps.pageLimit });\n return c.json({ packs }, 200);\n };\n}\n\nexport function skillPackFileHandler(deps: SkillPackRouteDeps) {\n return async (c: Context): Promise<Response> => {\n const device = await authenticateBearer(c.req.header('authorization'), deps.bearer);\n if (device === undefined) return unauthorized(c);\n\n const name = c.req.param('name');\n const path = c.req.param('path');\n if (name === undefined || path === undefined) return notFound(c);\n\n // No path normalization, no resolution, no decoding step of our own: the\n // store answers only for a path its own manifest declares, and those paths\n // passed core's path rule at publish time. A handler that \"cleaned up\" a\n // requested path would be inventing a second, weaker authority over what a\n // pack contains.\n const file = await deps.skillPacks.readFile(principalTenant(device), name, path);\n if (file === undefined) return notFound(c);\n return c.json(file, 200);\n };\n}\n\nfunction unauthorized(c: Context): Response {\n return c.json({ error: 'unauthorized' }, 401);\n}\n\nfunction notFound(c: Context): Response {\n return c.json({ error: 'skill_pack_not_found' }, 404);\n}\n","import {\n deviceProofSigningInput,\n isTenantId,\n parseDeviceProofEnvelope,\n tenantId,\n type Clock,\n type DevicePrincipal,\n type DeviceProofEnvelopeV1,\n} from '@byok-sdk/core';\nimport type { CloudCrypto } from '../crypto/port';\nimport type { DeviceDirectory } from '../stores/ports';\n\nexport const DEFAULT_DEVICE_PROOF_CLOCK_SKEW_MS = 60_000;\nexport const MAX_DEVICE_PROOF_CLOCK_SKEW_MS = 5 * 60_000;\nexport const DEFAULT_DEVICE_PROOF_MAX_LIFETIME_MS = 5 * 60_000;\nexport const MAX_DEVICE_PROOF_MAX_LIFETIME_MS = 15 * 60_000;\n\nexport interface DeviceProofRequestBinding {\n readonly method: string;\n readonly path: string;\n readonly operation: string;\n readonly resource: string;\n readonly body: Uint8Array;\n}\n\nexport interface DeviceProofAuthDeps {\n readonly devices: DeviceDirectory;\n readonly crypto: CloudCrypto;\n readonly clock: Clock;\n readonly clockSkewMs?: number;\n readonly maxLifetimeMs?: number;\n}\n\nexport interface AuthenticatedDeviceProof {\n /** Row-derived principal; no protected claim is re-used as authority. */\n readonly device: DevicePrincipal;\n readonly requestId: string;\n readonly operation: string;\n readonly resource: string;\n readonly bodySha256: string;\n readonly bodySize: bigint;\n readonly keyId: string;\n readonly keyEpoch: number;\n}\n\nfunction validBound(value: number, maximum: number): boolean {\n return Number.isSafeInteger(value) && value >= 0 && value <= maximum;\n}\n\nfunction parseInstant(value: string): number | undefined {\n const parsed = Date.parse(value);\n return Number.isFinite(parsed) ? parsed : undefined;\n}\n\nfunction timeBindingIsValid(\n envelope: DeviceProofEnvelopeV1,\n now: number,\n clockSkewMs: number,\n maxLifetimeMs: number,\n): boolean {\n const issuedAt = parseInstant(envelope.protected.issuedAt);\n if (issuedAt === undefined) return false;\n if (issuedAt < now - clockSkewMs || issuedAt > now + clockSkewMs) return false;\n\n const expiry = envelope.protected.expiresAt;\n if (expiry === undefined) return true;\n const expiresAt = parseInstant(expiry);\n if (expiresAt === undefined || expiresAt < issuedAt) return false;\n if (expiresAt - issuedAt > maxLifetimeMs) return false;\n return now <= expiresAt + clockSkewMs;\n}\n\n/**\n * Authenticate a request-bound proof. Every rejected state is `undefined`, so\n * a route has one 401 response for malformed input, row misses, revocation,\n * stale epochs, binding changes, clock failures and bad signatures.\n */\nexport async function authenticateDeviceProof(\n input: unknown,\n request: DeviceProofRequestBinding,\n deps: DeviceProofAuthDeps,\n): Promise<AuthenticatedDeviceProof | undefined> {\n const clockSkewMs = deps.clockSkewMs ?? DEFAULT_DEVICE_PROOF_CLOCK_SKEW_MS;\n const maxLifetimeMs = deps.maxLifetimeMs ?? DEFAULT_DEVICE_PROOF_MAX_LIFETIME_MS;\n if (!validBound(clockSkewMs, MAX_DEVICE_PROOF_CLOCK_SKEW_MS)) return undefined;\n if (!validBound(maxLifetimeMs, MAX_DEVICE_PROOF_MAX_LIFETIME_MS)) return undefined;\n\n let envelope: DeviceProofEnvelopeV1;\n try {\n envelope = parseDeviceProofEnvelope(input);\n } catch {\n return undefined;\n }\n const claims = envelope.protected;\n\n if (claims.operation !== request.operation || claims.resource !== request.resource) {\n return undefined;\n }\n if (claims.operationId !== undefined) return undefined;\n if (claims.method !== request.method || claims.path !== request.path) return undefined;\n if (claims.bodySize !== request.body.byteLength) return undefined;\n if ((await deps.crypto.sha256(request.body)) !== claims.bodySha256) return undefined;\n\n if (!isTenantId(claims.tenantId)) return undefined;\n const row = await deps.devices.get(tenantId(claims.tenantId), claims.deviceId);\n if (row === undefined || row.revoked) return undefined;\n if (row.productId !== claims.productId) return undefined;\n if (row.proofKeyId !== claims.keyId || row.proofKeyEpoch !== claims.keyEpoch) {\n return undefined;\n }\n\n if (!timeBindingIsValid(envelope, deps.clock.now().getTime(), clockSkewMs, maxLifetimeMs)) {\n return undefined;\n }\n const verified = await deps.crypto.verifyEd25519(\n row.devicePublicKey,\n deviceProofSigningInput(claims),\n envelope.signature,\n );\n if (!verified) return undefined;\n\n return {\n device: {\n kind: 'device',\n tenantId: row.tenantId,\n productId: row.productId,\n deviceId: row.deviceId,\n },\n requestId: claims.requestId,\n operation: claims.operation,\n resource: claims.resource,\n bodySha256: claims.bodySha256,\n bodySize: BigInt(claims.bodySize),\n keyId: row.proofKeyId,\n keyEpoch: row.proofKeyEpoch,\n };\n}\n","import type {\n ContentHash,\n TenantId,\n TruthBodyRef,\n TruthManifestEntry,\n TruthManifestQuery,\n TruthRecord,\n TruthRecordKind,\n TruthRecordSelector,\n} from '@byok-sdk/core';\nimport { z } from 'zod';\n\nexport const TRUTH_RECORD_CAPABILITY = 'truth.records';\nexport const TRUTH_INLINE_CONTENT_TYPE = 'application/vnd.byok.truth+utf8';\nexport const TRUTH_REQUEST_ID_MAX_LENGTH = 120;\nexport const TRUTH_RECORD_KEY_MAX_LENGTH = 200;\nexport const TRUTH_LABEL_MAX_LENGTH = 200;\nexport const TRUTH_BATCH_MAX_RECORDS = 32;\nexport const TRUTH_MANIFEST_MAX_LIMIT = 100;\n\nconst CONTENT_HASH_PATTERN = /^sha256:[0-9a-f]{64}$/;\nconst RECORD_KEY_PATTERN = /^[A-Za-z0-9][A-Za-z0-9._:-]*$/;\n\nexport const TruthRecordKeySchema = z\n .string()\n .min(1)\n .max(TRUTH_RECORD_KEY_MAX_LENGTH)\n .regex(RECORD_KEY_PATTERN)\n .refine((value) => value !== '.' && value !== '..');\n\nexport const TruthBodyInputSchema = z.discriminatedUnion('kind', [\n z.strictObject({\n kind: z.literal('inline'),\n content: z.string(),\n contentHash: z.string().regex(CONTENT_HASH_PATTERN),\n }),\n z.strictObject({\n kind: z.literal('object'),\n contentHash: z.string().regex(CONTENT_HASH_PATTERN),\n byteSize: z.number().int().nonnegative().safe(),\n }),\n]);\n\nconst SnapshotCandidateSchema = z.strictObject({\n kind: z.enum(['profile', 'memory']),\n recordKey: TruthRecordKeySchema,\n expectedRev: z.number().int().nonnegative().safe(),\n body: TruthBodyInputSchema,\n label: z.string().max(TRUTH_LABEL_MAX_LENGTH).optional(),\n});\n\nexport const TruthWriteRequestSchema = z.strictObject({\n expectedRev: z.number().int().nonnegative().safe().optional(),\n body: TruthBodyInputSchema,\n label: z.string().max(TRUTH_LABEL_MAX_LENGTH).optional(),\n snapshots: z.array(SnapshotCandidateSchema).max(TRUTH_BATCH_MAX_RECORDS - 1).optional(),\n});\n\nexport type TruthBodyInput = z.infer<typeof TruthBodyInputSchema>;\nexport type TruthWriteRequest = z.infer<typeof TruthWriteRequestSchema>;\n\nexport type PreparedTruthWrite =\n | {\n readonly kind: 'task.terminal';\n readonly recordKey: string;\n readonly contentHash: ContentHash;\n readonly byteSize: bigint;\n readonly body: TruthBodyRef;\n readonly label?: string;\n }\n | {\n readonly kind: 'profile' | 'memory';\n readonly recordKey: string;\n readonly expectedRev: number;\n readonly contentHash: ContentHash;\n readonly byteSize: bigint;\n readonly body: TruthBodyRef;\n readonly label?: string;\n };\n\nexport interface TruthCommitInput {\n readonly deviceId: string;\n readonly requestId: string;\n readonly operation: string;\n readonly resource: string;\n readonly proofBodySha256: string;\n readonly proofBodySize: bigint;\n readonly writes: readonly [PreparedTruthWrite, ...PreparedTruthWrite[]];\n}\n\nexport interface TruthRecordMetadata {\n readonly kind: TruthRecordKind;\n readonly recordKey: string;\n readonly rev: number;\n readonly contentHash: string;\n readonly byteSize: number;\n readonly label?: string;\n readonly updatedAt: string;\n}\n\nexport const TruthRecordMetadataSchema = z.strictObject({\n kind: z.enum(['task.terminal', 'profile', 'memory']),\n recordKey: TruthRecordKeySchema,\n rev: z.number().int().positive().safe(),\n contentHash: z.string().regex(CONTENT_HASH_PATTERN),\n byteSize: z.number().int().nonnegative().safe(),\n label: z.string().max(TRUTH_LABEL_MAX_LENGTH).optional(),\n updatedAt: z.string().datetime({ offset: true }),\n});\n\nexport interface TruthCommitResponse {\n readonly primary: TruthRecordMetadata;\n readonly snapshots: readonly TruthRecordMetadata[];\n}\n\nexport const TruthCommitResponseSchema = z.strictObject({\n primary: TruthRecordMetadataSchema,\n snapshots: z.array(TruthRecordMetadataSchema).max(TRUTH_BATCH_MAX_RECORDS - 1),\n});\n\nexport interface TruthCommitResult {\n readonly response: TruthCommitResponse;\n readonly replayed: boolean;\n}\n\nexport interface TruthCommitter {\n commit(tenant: TenantId, input: TruthCommitInput): Promise<TruthCommitResult>;\n getRecord(tenant: TenantId, selector: TruthRecordSelector): Promise<TruthRecord | undefined>;\n listManifest(\n tenant: TenantId,\n query: TruthManifestQuery,\n ): Promise<readonly TruthManifestEntry[]>;\n}\n\n/**\n * Object download grant authority for truth bodies. The input is the canonical\n * content hash stored in `TruthBodyRef`, never an opaque upload id.\n */\nexport interface TruthObjectDownloads {\n getDownloadUrl(tenant: TenantId, hash: ContentHash): Promise<string | undefined>;\n}\n\nexport function truthRecordMetadata(record: TruthRecord): TruthRecordMetadata {\n const byteSize = Number(record.byteSize);\n if (!Number.isSafeInteger(byteSize)) throw new Error('truth record byte size exceeds JSON range');\n return {\n kind: record.kind,\n recordKey: record.recordKey,\n rev: record.rev,\n contentHash: record.contentHash,\n byteSize,\n ...(record.label === undefined ? {} : { label: record.label }),\n updatedAt: record.writtenAt,\n };\n}\n\nexport function truthManifestMetadata(entry: TruthManifestEntry): TruthRecordMetadata {\n const byteSize = Number(entry.byteSize);\n if (!Number.isSafeInteger(byteSize)) throw new Error('truth manifest byte size exceeds JSON range');\n return {\n kind: entry.kind,\n recordKey: entry.recordKey,\n rev: entry.rev,\n contentHash: entry.contentHash,\n byteSize,\n ...(entry.label === undefined ? {} : { label: entry.label }),\n updatedAt: entry.updatedAt,\n };\n}\n","export const TRUTH_COMMIT_ERROR_CODES = [\n 'proof_request_conflict',\n 'truth_object_not_committed',\n] as const;\n\nexport type TruthCommitErrorCode = (typeof TRUTH_COMMIT_ERROR_CODES)[number];\n\nexport class TruthCommitError extends Error {\n readonly code: TruthCommitErrorCode;\n readonly current?: unknown;\n\n constructor(code: TruthCommitErrorCode, message: string, current?: unknown) {\n super(message);\n this.name = 'TruthCommitError';\n this.code = code;\n this.current = current;\n }\n}\n\nexport function isTruthCommitError(value: unknown): value is TruthCommitError {\n return value instanceof TruthCommitError;\n}\n","import {\n DEVICE_PROOF_HEADER,\n STORAGE_ERROR_CODES,\n STORAGE_ERROR_HTTP_STATUS,\n TRUTH_RECORD_KINDS,\n contentHash,\n isCoreConflictError,\n isCoreError,\n principalTenant,\n type DevicePrincipal,\n type StorageErrorCode,\n type TruthManifestQuery,\n type TruthRecord,\n type TruthRecordKind,\n} from '@byok-sdk/core';\nimport type { Context } from 'hono';\nimport { authenticateDeviceProof, type DeviceProofAuthDeps } from '../auth/device-proof';\nimport {\n TRUTH_MANIFEST_MAX_LIMIT,\n TruthRecordKeySchema,\n TruthWriteRequestSchema,\n truthManifestMetadata,\n truthRecordMetadata,\n type PreparedTruthWrite,\n type TruthBodyInput,\n type TruthCommitInput,\n type TruthCommitter,\n type TruthObjectDownloads,\n type TruthRecordMetadata,\n} from '../truth/contract';\nimport { isTruthCommitError } from '../truth/errors';\n\n// Re-exported from core (single source of truth for the wire header); still\n// part of this module's public surface for callers importing it from cloud.\nexport { DEVICE_PROOF_HEADER };\nexport const DEFAULT_MAX_TRUTH_REQUEST_BYTES = 2 * 1024 * 1024;\nexport const MAX_DEVICE_PROOF_HEADER_BYTES = 16 * 1024;\n\nconst EMPTY_BODY = new Uint8Array();\nconst RECORD_PREFIX_PATTERN = /^[A-Za-z0-9][A-Za-z0-9._:-]*$/;\n\nexport interface TruthRouteDeps {\n readonly proof: DeviceProofAuthDeps;\n readonly truth: TruthCommitter;\n readonly objectDownloads: TruthObjectDownloads;\n readonly maxRequestBytes: number;\n}\n\ninterface ProofContext {\n readonly device: DevicePrincipal;\n readonly requestId: string;\n readonly operation: string;\n readonly resource: string;\n readonly bodySha256: string;\n readonly bodySize: bigint;\n}\n\nexport function truthManifestHandler(deps: TruthRouteDeps) {\n return async (c: Context): Promise<Response> => {\n const authenticated = await authenticateTruthRequest(c, deps, {\n body: EMPTY_BODY,\n operation: 'truth.list',\n resource: 'records',\n });\n if (authenticated === undefined) return unauthorized(c);\n\n const query = manifestQuery(c);\n if (query === undefined) return c.json({ error: 'invalid truth manifest query' }, 400);\n const records = await deps.truth.listManifest(principalTenant(authenticated.device), query);\n return c.json({ records: records.map(truthManifestMetadata) }, 200);\n };\n}\n\nexport function truthGetHandler(deps: TruthRouteDeps) {\n return async (c: Context): Promise<Response> => {\n const resource = rawRecordResource(c);\n const authenticated = await authenticateTruthRequest(c, deps, {\n body: EMPTY_BODY,\n operation: 'truth.read',\n resource,\n });\n if (authenticated === undefined) return unauthorized(c);\n const selector = recordSelector(c);\n if (selector === undefined) return c.json({ error: 'invalid truth record selector' }, 400);\n\n const record = await deps.truth.getRecord(principalTenant(authenticated.device), selector);\n if (record === undefined) return c.json({ error: 'truth_record_not_found' }, 404);\n const metadata = truthRecordMetadata(record);\n if (record.body.kind === 'inline') {\n return c.json({ ...metadata, body: { kind: 'inline', content: record.body.body } }, 200);\n }\n\n const downloadUrl = await deps.objectDownloads.getDownloadUrl(\n principalTenant(authenticated.device),\n record.body.hash,\n );\n if (downloadUrl === undefined) return c.json({ error: 'object_not_found' }, 404);\n return c.json({ ...metadata, body: { kind: 'object', downloadUrl } }, 200);\n };\n}\n\nexport function truthPutHandler(deps: TruthRouteDeps) {\n return async (c: Context): Promise<Response> => {\n const body = await readBoundedBody(c, deps.maxRequestBytes);\n if (body === 'too_large') return c.json({ error: 'truth request body too large' }, 413);\n if (body === undefined) return c.json({ error: 'invalid truth request body' }, 400);\n\n const authenticated = await authenticateTruthRequest(c, deps, {\n body,\n operation: 'truth.write',\n resource: rawRecordResource(c),\n });\n if (authenticated === undefined) return unauthorized(c);\n const selector = recordSelector(c);\n if (selector === undefined) return c.json({ error: 'invalid truth record selector' }, 400);\n\n const parsedJson = parseJsonBytes(body);\n const parsed = TruthWriteRequestSchema.safeParse(parsedJson);\n if (!parsed.success) return c.json({ error: 'invalid truth write request' }, 400);\n const writes = prepareWrites(selector.kind, selector.recordKey, parsed.data);\n if (writes === undefined) return c.json({ error: 'invalid truth write model' }, 400);\n\n const input: TruthCommitInput = {\n deviceId: authenticated.device.deviceId,\n requestId: authenticated.requestId,\n operation: authenticated.operation,\n resource: authenticated.resource,\n proofBodySha256: authenticated.bodySha256,\n proofBodySize: authenticated.bodySize,\n writes,\n };\n try {\n const result = await deps.truth.commit(principalTenant(authenticated.device), input);\n return c.json(result.response, 200, { 'x-byok-replayed': result.replayed ? 'true' : 'false' });\n } catch (caught) {\n return truthFailure(c, caught);\n }\n };\n}\n\nfunction recordSelector(\n c: Context,\n): { readonly kind: TruthRecordKind; readonly recordKey: string } | undefined {\n const kind = c.req.param('kind');\n const recordKey = c.req.param('key');\n if (!TRUTH_RECORD_KINDS.includes(kind as TruthRecordKind)) return undefined;\n const parsedKey = TruthRecordKeySchema.safeParse(recordKey);\n if (!parsedKey.success) return undefined;\n return { kind: kind as TruthRecordKind, recordKey: parsedKey.data };\n}\n\nfunction rawRecordResource(c: Context): string {\n return `${c.req.param('kind') ?? ''}/${c.req.param('key') ?? ''}`;\n}\n\nfunction manifestQuery(c: Context): TruthManifestQuery | undefined {\n const url = new URL(c.req.url);\n for (const key of url.searchParams.keys()) {\n if (\n (key !== 'kind' && key !== 'prefix' && key !== 'limit') ||\n url.searchParams.getAll(key).length !== 1\n ) {\n return undefined;\n }\n }\n const kind = url.searchParams.get('kind') ?? undefined;\n if (kind !== undefined && !TRUTH_RECORD_KINDS.includes(kind as TruthRecordKind)) return undefined;\n const keyPrefix = url.searchParams.get('prefix') ?? undefined;\n if (\n keyPrefix !== undefined &&\n (keyPrefix.length === 0 || keyPrefix.length > 200 || !RECORD_PREFIX_PATTERN.test(keyPrefix))\n ) {\n return undefined;\n }\n const limitRaw = url.searchParams.get('limit') ?? undefined;\n const limit = limitRaw === undefined ? TRUTH_MANIFEST_MAX_LIMIT : Number(limitRaw);\n if (!Number.isSafeInteger(limit) || limit < 1 || limit > TRUTH_MANIFEST_MAX_LIMIT) return undefined;\n return {\n ...(kind === undefined ? {} : { kind: kind as TruthRecordKind }),\n ...(keyPrefix === undefined ? {} : { keyPrefix }),\n limit,\n };\n}\n\nfunction prepareWrites(\n kind: TruthRecordKind,\n recordKey: string,\n request: ReturnType<typeof TruthWriteRequestSchema.parse>,\n): readonly [PreparedTruthWrite, ...PreparedTruthWrite[]] | undefined {\n if (kind === 'task.terminal') {\n if (request.expectedRev !== undefined) return undefined;\n } else if (request.expectedRev === undefined || request.snapshots !== undefined) {\n return undefined;\n }\n\n const primary = prepareWrite(kind, recordKey, request.body, request.expectedRev, request.label);\n const snapshots = (request.snapshots ?? []).map((snapshot) =>\n prepareWrite(\n snapshot.kind,\n snapshot.recordKey,\n snapshot.body,\n snapshot.expectedRev,\n snapshot.label,\n ),\n );\n return [primary, ...snapshots];\n}\n\nfunction prepareWrite(\n kind: TruthRecordKind,\n recordKey: string,\n input: TruthBodyInput,\n expectedRev: number | undefined,\n label: string | undefined,\n): PreparedTruthWrite {\n const hash = contentHash(input.contentHash);\n const body =\n input.kind === 'inline'\n ? ({ kind: 'inline', body: input.content } as const)\n : ({ kind: 'object', hash } as const);\n const byteSize =\n input.kind === 'inline'\n ? BigInt(new TextEncoder().encode(input.content).byteLength)\n : BigInt(input.byteSize);\n if (kind === 'task.terminal') {\n return { kind, recordKey, contentHash: hash, byteSize, body, ...(label === undefined ? {} : { label }) };\n }\n if (expectedRev === undefined) throw new Error('snapshot expectedRev was not validated');\n return {\n kind,\n recordKey,\n expectedRev,\n contentHash: hash,\n byteSize,\n body,\n ...(label === undefined ? {} : { label }),\n };\n}\n\nasync function authenticateTruthRequest(\n c: Context,\n deps: TruthRouteDeps,\n request: { readonly body: Uint8Array; readonly operation: string; readonly resource: string },\n): Promise<ProofContext | undefined> {\n const proof = decodeProofHeader(c.req.header(DEVICE_PROOF_HEADER));\n if (proof === undefined) return undefined;\n const url = new URL(c.req.url);\n return authenticateDeviceProof(\n proof,\n {\n method: c.req.method,\n path: `${url.pathname}${url.search}`,\n operation: request.operation,\n resource: request.resource,\n body: request.body,\n },\n deps.proof,\n );\n}\n\nfunction decodeProofHeader(value: string | undefined): unknown | undefined {\n if (value === undefined || value.length === 0 || value.length > MAX_DEVICE_PROOF_HEADER_BYTES) {\n return undefined;\n }\n if (!/^[A-Za-z0-9_-]+$/.test(value) || value.length % 4 === 1) return undefined;\n try {\n const padded = value.replace(/-/g, '+').replace(/_/g, '/') + '='.repeat((4 - (value.length % 4)) % 4);\n const binary = atob(padded);\n const bytes = Uint8Array.from(binary, (character) => character.charCodeAt(0));\n return JSON.parse(new TextDecoder('utf-8', { fatal: true }).decode(bytes));\n } catch {\n return undefined;\n }\n}\n\nasync function readBoundedBody(\n c: Context,\n maximum: number,\n): Promise<Uint8Array | 'too_large' | undefined> {\n const length = c.req.header('content-length');\n if (length !== undefined) {\n const parsed = Number(length);\n if (!Number.isSafeInteger(parsed) || parsed < 0) return undefined;\n if (parsed > maximum) return 'too_large';\n }\n try {\n const bytes = new Uint8Array(await c.req.arrayBuffer());\n return bytes.byteLength > maximum ? 'too_large' : bytes;\n } catch {\n return undefined;\n }\n}\n\nfunction parseJsonBytes(bytes: Uint8Array): unknown | undefined {\n try {\n return JSON.parse(new TextDecoder('utf-8', { fatal: true }).decode(bytes));\n } catch {\n return undefined;\n }\n}\n\nfunction unauthorized(c: Context): Response {\n return c.json({ error: 'unauthorized' }, 401);\n}\n\nfunction truthFailure(c: Context, caught: unknown): Response {\n if (isCoreConflictError<TruthRecord | undefined>(caught)) {\n const current: TruthRecordMetadata | null =\n caught.current === undefined ? null : truthRecordMetadata(caught.current);\n return c.json({ error: caught.code, current, observedAt: caught.observedAt }, 409);\n }\n if (isTruthCommitError(caught)) {\n return c.json({ error: caught.code, ...(caught.current === undefined ? {} : { current: caught.current }) }, 409);\n }\n if (isCoreError(caught)) {\n if ((STORAGE_ERROR_CODES as readonly string[]).includes(caught.code)) {\n const code = caught.code as StorageErrorCode;\n return c.json({ error: code }, STORAGE_ERROR_HTTP_STATUS[code]);\n }\n if (caught.code === 'storage_entitlement_missing' || caught.code === 'object_state_invalid') {\n return c.json({ error: caught.code }, 409);\n }\n if (caught.code === 'content_hash_invalid') return c.json({ error: caught.code }, 400);\n }\n throw caught;\n}\n","/**\n * The route inventory (sprint I1).\n *\n * Isolation review starts by asking \"what routes exist, and what does each one\n * require?\" — a question that is only answerable if the answer cannot drift\n * from what is actually mounted. So mounting goes through {@link\n * CloudRouteRegistry.register} and nowhere else: the registry owns the Hono\n * app, hands out no reference to it that could be mounted on directly, and\n * records a class for every route as it goes.\n *\n * `src/__tests__/route-inventory.test.ts` closes that loop in BOTH directions\n * against Hono's own `app.routes` table: a mounted route missing from the\n * inventory fails the suite, and an inventoried route that never reached the\n * router fails it too. A route whose class is not one of {@link ROUTE_CLASSES}\n * cannot be registered at all.\n */\nimport { Hono, type Context } from 'hono';\n\n/**\n * What a route requires of its caller. Not a description of the handler's\n * work — a description of the credential it is authenticated by, which is the\n * thing an isolation review has to enumerate:\n *\n * - `device` — a bearer access token; resolves to a `DevicePrincipal` and a\n * tenant-closed facade.\n * - `proof` — a request-bound Ed25519 device proof; tenant/product/key\n * authority comes from the current device row, not protected claims.\n * - `presigned` — no principal at all; an HMAC signature over the resource id\n * plus an expiry IS the credential (§7's two `/content` routes).\n * - `public` — deliberately unauthenticated; must expose nothing tenant-scoped.\n */\nexport const ROUTE_CLASSES = ['device', 'proof', 'presigned', 'public'] as const;\nexport type RouteClass = (typeof ROUTE_CLASSES)[number];\n\nexport const ROUTE_METHODS = ['GET', 'POST', 'PUT'] as const;\nexport type RouteMethod = (typeof ROUTE_METHODS)[number];\n\nexport interface RouteDescriptor {\n readonly method: RouteMethod;\n readonly path: string;\n readonly class: RouteClass;\n}\n\nexport type CloudRouteHandler = (c: Context) => Response | Promise<Response>;\n\nexport function routeKey(route: { readonly method: string; readonly path: string }): string {\n return `${route.method} ${route.path}`;\n}\n\nexport class CloudRouteRegistry {\n readonly #app = new Hono();\n readonly #routes: RouteDescriptor[] = [];\n\n register(descriptor: RouteDescriptor, handler: CloudRouteHandler): void {\n if (!(ROUTE_CLASSES as readonly string[]).includes(descriptor.class)) {\n throw new Error(`Route ${routeKey(descriptor)} has no valid isolation class`);\n }\n if (!(ROUTE_METHODS as readonly string[]).includes(descriptor.method)) {\n throw new Error(`Route ${routeKey(descriptor)} uses an unsupported method`);\n }\n if (this.#routes.some((existing) => routeKey(existing) === routeKey(descriptor))) {\n throw new Error(`Route ${routeKey(descriptor)} is already registered`);\n }\n this.#routes.push(descriptor);\n this.#app.on(descriptor.method, descriptor.path, handler);\n }\n\n /** The inventory, in registration order. */\n get routes(): readonly RouteDescriptor[] {\n return this.#routes;\n }\n\n /** What the router actually mounted, read back off Hono itself — the other half of the I1 comparison. */\n get mounted(): readonly { readonly method: string; readonly path: string }[] {\n return this.#app.routes.map((route) => ({ method: route.method, path: route.path }));\n }\n\n get fetch(): (request: Request, ...rest: unknown[]) => Response | Promise<Response> {\n return this.#app.fetch as (request: Request, ...rest: unknown[]) => Response | Promise<Response>;\n }\n}\n","import { decodeEnvelope, type BlobRef, type Envelope } from '@byok-sdk/protocol';\nimport { ByokCloudError } from './errors';\nimport type { RequestReceipt } from './stores/ports';\n\n/**\n * The typed terminal read model — the hosted counterpart of the embedded\n * coordinator's `TaskResult`, projected off the receipt the inbound gate\n * stores. Every field is copied verbatim from the payload the gate already\n * zod-parsed before storing (`recordTerminal`, `inbound.ts`); this projection\n * neither re-validates nor synthesizes one.\n */\nexport interface TerminalResult {\n readonly taskId: string;\n readonly state: 'complete' | 'failed' | 'cancelled';\n readonly summary?: string;\n readonly sessionRef?: string;\n readonly artifactRefs?: readonly BlobRef[];\n /**\n * The product's structured terminal result, verbatim `task.complete.document`.\n * Absent — key missing, never null — when the daemon sent none, which covers\n * both a legacy pre-`result-document` build and a daemon with no\n * `resultDocument` extractor.\n */\n readonly document?: unknown;\n readonly reason?: string;\n readonly retryable?: boolean;\n /** When the receipt store wrote the terminal fact — the first one, by its own first-write-wins rule. */\n readonly recordedAt: string;\n}\n\n/**\n * Pure projection of a terminal receipt onto {@link TerminalResult}. `taskId`\n * names the task the receipt was read for (the receipt's key carries it, its\n * body does not); `recordedAt` is the receipt store's write time.\n *\n * Fail closed on anything but a terminal envelope: the stored body is\n * `encodeEnvelope` of what the inbound gate accepted, so an undecodable body\n * or a non-terminal type means the receipt-store contract itself broke — an\n * error, never a best-effort shape.\n */\nexport function projectTerminalResult(taskId: string, receipt: RequestReceipt): TerminalResult {\n let envelope: Envelope;\n try {\n envelope = decodeEnvelope(receipt.body);\n } catch (cause) {\n throw new ByokCloudError(\n 'terminal_receipt_unreadable',\n `The terminal receipt for task ${taskId} holds a body that is not a decodable envelope.`,\n { cause },\n );\n }\n switch (envelope.type) {\n case 'task.complete':\n return {\n taskId,\n state: 'complete',\n summary: envelope.payload.summary,\n sessionRef: envelope.payload.sessionRef,\n ...(envelope.payload.artifactRefs !== undefined\n ? { artifactRefs: envelope.payload.artifactRefs }\n : {}),\n ...(envelope.payload.document !== undefined ? { document: envelope.payload.document } : {}),\n recordedAt: receipt.recordedAt,\n };\n case 'task.fail':\n return {\n taskId,\n state: 'failed',\n reason: envelope.payload.reason,\n ...(envelope.payload.retryable !== undefined\n ? { retryable: envelope.payload.retryable }\n : {}),\n recordedAt: receipt.recordedAt,\n };\n case 'task.cancelled':\n return {\n taskId,\n state: 'cancelled',\n ...(envelope.payload.reason !== undefined ? { reason: envelope.payload.reason } : {}),\n recordedAt: receipt.recordedAt,\n };\n default:\n throw new ByokCloudError(\n 'terminal_receipt_unreadable',\n `The terminal receipt for task ${taskId} holds a ${envelope.type} envelope, which is not a terminal type.`,\n );\n }\n}\n","/**\n * `createByokCloud` — the hosted device surface, assembled.\n *\n * What this is NOT: an embedded coordinator. There is no `TaskHandle`, no\n * connection registry, no per-task object that a host holds onto. Sprint 0.1's\n * non-goal is explicit about that — the embedded `TaskHandle` must not become\n * the hosted API — so the host's control-plane input is a function\n * ({@link ByokCloud.enqueueOffer}) and its read model is a store query\n * ({@link ByokCloud.readTaskAttempt}).\n *\n * Every route is stateless in the strict sense: it resolves a principal from\n * the request, binds stores to that principal's tenant, and returns. Nothing\n * survives the response but what a store wrote. The one shape that would\n * quietly undo that — a Running/session map — is asserted absent by\n * `src/__tests__/constraints.test.ts`.\n */\nimport {\n contentHash,\n parseCapabilityDeclaration,\n type BoardItem,\n type BoardItemInput,\n type BoardListQuery,\n type BoardPage,\n type CapabilityDeclaration,\n type Clock,\n type ControlPlanePrincipal,\n type CoreStores,\n type PresenceHint,\n type SkillPackStore,\n type TenantId,\n} from '@byok-sdk/core';\nimport type { ActivityTail } from './activity';\nimport type { ApprovalTimelineTail } from './approval-timeline';\nimport {\n BYOK_ACTIVITY_PATH,\n BYOK_BLOB_CONTENT_ROUTE,\n BYOK_BLOB_FINALIZE_ROUTE,\n BYOK_BLOB_URL_ROUTE,\n BYOK_BLOBS_PATH,\n BYOK_BOARD_CLAIM_ROUTE,\n BYOK_BOARD_PATH,\n BYOK_BOARD_STATUS_ROUTE,\n BYOK_BOARD_STREAM_PATH,\n BYOK_BOARD_UNCLAIM_ROUTE,\n BYOK_CAPABILITIES_PATH,\n BYOK_CHALLENGE_PATH,\n BYOK_EVENTS_PATH,\n BYOK_MESSAGES_PATH,\n BYOK_PAIR_PATH,\n BYOK_PRESENCE_PATH,\n BYOK_RECORD_ROUTE,\n BYOK_RECORDS_PATH,\n BYOK_SKILL_PACK_FILE_ROUTE,\n BYOK_SKILL_PACKS_PATH,\n BYOK_TOKEN_PATH,\n createEnvelope,\n decodeEnvelope,\n encodeEnvelope,\n type Envelope,\n type TaskOfferPayload,\n type TaskOfferWithToolsetsPayload,\n} from '@byok-sdk/protocol';\nimport { createAuthPlane, type AuthPlane } from './auth/plane';\nimport type { TokenSigner } from './auth/tokens';\nimport { CLOUD_CAPABILITIES, declares } from './capabilities';\nimport {\n assertBoardLabels,\n DEFAULT_ACTIVITY_CAPACITY,\n DEFAULT_ACTIVITY_MAX_BYTES,\n DEFAULT_ACTIVITY_MAX_EVENTS,\n DEFAULT_ACTIVITY_TTL_MS,\n DEFAULT_BOARD_CHANNEL_MAX_BYTES,\n DEFAULT_BOARD_TITLE_MAX_BYTES,\n DEFAULT_PRESENCE_DETAIL_MAX_BYTES,\n DEFAULT_PRESENCE_MINIMUM_INTERVAL_MS,\n DEFAULT_PRESENCE_TTL_MS,\n type ActivityBounds,\n} from './coordination';\nimport type { CloudCrypto } from './crypto/port';\nimport { ByokCloudError } from './errors';\nimport {\n blobDownloadContentHandler,\n blobDownloadUrlHandler,\n blobUploadContentHandler,\n createBlobHandler,\n finalizeBlobHandler,\n} from './handlers/blobs';\nimport { capabilitiesHandler } from './handlers/capabilities';\nimport { challengeHandler, pairHandler, tokenHandler } from './handlers/auth';\nimport { eventsHandler } from './handlers/events';\nimport { messagesHandler } from './handlers/messages';\nimport {\n boardClaimHandler,\n boardListHandler,\n boardStatusHandler,\n boardStreamHandler,\n boardUnclaimHandler,\n DEFAULT_BOARD_PAGE_LIMIT,\n DEFAULT_BOARD_STREAM_HEARTBEAT_INTERVAL_MS,\n DEFAULT_BOARD_STREAM_QUERY_INTERVAL_MS,\n DEFAULT_BOARD_STREAM_RECONCILIATION_INTERVAL_MS,\n} from './handlers/board';\nimport { activityAppendHandler, presencePublishHandler } from './handlers/presence';\nimport {\n DEFAULT_SKILL_PACK_PAGE_LIMIT,\n skillPackFileHandler,\n skillPackListHandler,\n} from './handlers/skill-packs';\nimport {\n DEFAULT_MAX_TRUTH_REQUEST_BYTES,\n truthGetHandler,\n truthManifestHandler,\n truthPutHandler,\n} from './handlers/truth';\nimport { CloudRouteRegistry, type RouteDescriptor } from './router/registry';\nimport { terminalReceiptKey } from './inbound';\nimport type {\n BlobContentProxy,\n CloudStores,\n DeviceRecord,\n PairingCodeInfo,\n RequestReceipt,\n TaskAttempt,\n} from './stores/ports';\nimport { projectTerminalResult, type TerminalResult } from './terminal-result';\nimport { tenantStoresFor, type CloudRootStores } from './tenant-stores';\nimport type { TruthCommitter, TruthObjectDownloads } from './truth/contract';\n\n/** Matches the reference server's ceiling (§7). */\nexport const DEFAULT_MAX_BLOB_SIZE_BYTES = 100 * 1024 * 1024;\n/** Matches the reference server's hold (§8). */\nexport const DEFAULT_LONG_POLL_HOLD_MS = 50_000;\n/** How often a held poll re-reads the mailbox. */\nexport const DEFAULT_LONG_POLL_INTERVAL_MS = 250;\n/** Rows per `GET /byok/events` response. */\nexport const DEFAULT_EVENTS_PAGE_LIMIT = 50;\n\nexport interface ByokCloudOptions {\n readonly core: CoreStores;\n readonly cloud: CloudStores;\n /**\n * Byte proxying for the two `/byok/blobs/:id/content` routes. OPTIONAL, and\n * absent is a first-class answer: a composition backed by object storage\n * hands the device a presigned URL to the object store and never carries a\n * byte, so it has nothing to supply here. Supplying it is necessary but not\n * sufficient for the routes to exist — the deployment must also declare\n * `blobs.contentproxy` (ADR-010).\n */\n readonly blobContentProxy?: BlobContentProxy;\n /** Atomic proof receipt + truth/reference/accounting authority for S6 routes. */\n readonly truthCommitter?: TruthCommitter;\n /** Content-hash keyed object GET grants for object-backed truth bodies. */\n readonly truthObjectDownloads?: TruthObjectDownloads;\n /**\n * Tenant-scoped skill pack catalogue. OPTIONAL, and absent is a first-class\n * answer: a deployment that distributes no declarative content supplies\n * nothing here and declares no `skills.pack`. Supplying it is necessary but\n * not sufficient for the routes to exist — the deployment must also declare\n * the capability (ADR-010), the same asymmetry the byte proxy above has.\n */\n readonly skillPacks?: SkillPackStore;\n readonly crypto: CloudCrypto;\n readonly tokenSigner: TokenSigner;\n readonly clock: Clock;\n /** What this deployment serves (ADR-010). Routes are mounted from it, so it can never over-declare. */\n readonly capabilities: CapabilityDeclaration;\n /** Recorded on the control-plane principal every host-side call is made under. */\n readonly operatorId?: string;\n readonly maxBlobSizeBytes?: number;\n readonly longPollHoldMs?: number;\n readonly longPollIntervalMs?: number;\n readonly eventsPageLimit?: number;\n readonly accessTokenTtlSeconds?: number;\n readonly boardPageLimit?: number;\n readonly boardStreamQueryIntervalMs?: number;\n readonly boardStreamHeartbeatIntervalMs?: number;\n readonly boardStreamReconciliationIntervalMs?: number;\n readonly boardChannelMaxBytes?: number;\n readonly boardTitleMaxBytes?: number;\n readonly presenceTtlMs?: number;\n readonly presenceMinimumIntervalMs?: number;\n readonly presenceDetailMaxBytes?: number;\n readonly activityMaxEvents?: number;\n readonly activityMaxBytes?: number;\n readonly activityCapacity?: number;\n readonly activityTtlMs?: number;\n readonly maxTruthRequestBytes?: number;\n readonly skillPackPageLimit?: number;\n}\n\nexport interface EnqueueOfferInput {\n /** Supply one to make the enqueue addressable by the host's own id; otherwise cloud mints one. */\n readonly taskId?: string;\n readonly payload: TaskOfferPayload;\n}\n\nexport interface EnqueueToolsetOfferInput {\n /** Supply one to make the enqueue addressable by the host's own id; otherwise cloud mints one. */\n readonly taskId?: string;\n /** Strict control payload containing logical ids only; executable MCP definitions are not part of this type. */\n readonly payload: TaskOfferWithToolsetsPayload;\n}\n\nexport interface EnqueuedOffer {\n readonly taskId: string;\n /** The per-(tenant, device) delivery seq — the daemon's redelivery cursor position for this envelope. */\n readonly seq: number;\n readonly envelope: Envelope;\n readonly attempt: TaskAttempt;\n}\n\nexport interface ByokCloud {\n /** WHATWG fetch handler — mount on `@hono/node-server`, a Worker, or Deno. */\n readonly fetch: (request: Request, ...rest: unknown[]) => Response | Promise<Response>;\n /** The I1 route inventory: every mounted route and the credential class it requires. */\n readonly routes: readonly RouteDescriptor[];\n /**\n * What the router ACTUALLY holds, read back off the router itself. Exposed\n * so the I1 matrix can close in both directions: an inventory is only\n * evidence if a route mounted some other way would show up here without a\n * matching entry in {@link routes}.\n */\n readonly mountedRoutes: readonly { readonly method: string; readonly path: string }[];\n readonly capabilities: CapabilityDeclaration;\n /** Host control plane: mint a single-use pairing code for a tenant/product. */\n createPairingCode(tenant: TenantId, input: { readonly productId: string; readonly ttlMs?: number }): Promise<PairingCodeInfo>;\n /** Host control plane: hand a device a frozen-v1 `task.offer`. The hosted replacement for `dispatch()` — a function, not a handle. */\n enqueueOffer(tenant: TenantId, deviceId: string, input: EnqueueOfferInput): Promise<EnqueuedOffer>;\n /** Host control plane: enqueue the additive fail-closed offer variant that requires local MCP toolsets. */\n enqueueToolsetOffer(tenant: TenantId, deviceId: string, input: EnqueueToolsetOfferInput): Promise<EnqueuedOffer>;\n readTaskAttempt(tenant: TenantId, taskId: string): Promise<TaskAttempt | undefined>;\n /** The recorded terminal for a task — the first one, re-encoded canonically under the frozen v1 codec (see `recordTerminal`, `inbound.ts`: the stored body is `encodeEnvelope` of the zod-parsed envelope, not the device's original byte sequence). */\n readTerminalReceipt(tenant: TenantId, taskId: string): Promise<RequestReceipt | undefined>;\n /**\n * Host control plane: the same first terminal, decoded into the typed read\n * model ({@link TerminalResult}) so a host reads result fields, not envelope\n * prose. `undefined` ONLY means no terminal fact is recorded yet:\n * first-terminal-wins is inherited from the receipt store\n * ({@link ByokCloud.readTerminalReceipt} reads the same row), and a declined\n * task records no terminal at all — use {@link ByokCloud.readTaskAttempt}\n * for that attempt status. An absent `document` covers both a legacy\n * pre-`result-document` daemon build and a daemon with no `resultDocument`\n * extractor; a receipt whose body is not a terminal envelope throws rather\n * than returning a best-effort shape.\n */\n readTaskResult(tenant: TenantId, taskId: string): Promise<TerminalResult | undefined>;\n listDevices(tenant: TenantId): Promise<readonly DeviceRecord[]>;\n revokeDevice(tenant: TenantId, deviceId: string): Promise<void>;\n /** Host control plane: create a board row from explicit producer labels. */\n createBoardItem(tenant: TenantId, input: BoardItemInput): Promise<BoardItem>;\n listBoardItems(tenant: TenantId, query: BoardListQuery): Promise<BoardPage>;\n /** Human review authority. Device routes cannot produce `done`. */\n acceptBoardItem(tenant: TenantId, itemId: string): Promise<BoardItem>;\n listPresence(tenant: TenantId): Promise<readonly PresenceHint[]>;\n readActivity(tenant: TenantId, taskId: string): Promise<ActivityTail | undefined>;\n readApprovalTimeline(\n tenant: TenantId,\n taskId: string,\n ): Promise<ApprovalTimelineTail | undefined>;\n}\n\nexport function createByokCloud(options: ByokCloudOptions): ByokCloud {\n const declaration = parseDeclaration(options.capabilities);\n assertNoOverDeclaration(\n declaration,\n options.blobContentProxy,\n options.truthCommitter,\n options.truthObjectDownloads,\n options.skillPacks,\n );\n const root: CloudRootStores = { core: options.core, cloud: options.cloud };\n const auth: AuthPlane = createAuthPlane({\n stores: options.cloud,\n crypto: options.crypto,\n clock: options.clock,\n tokenSigner: options.tokenSigner,\n ...(options.accessTokenTtlSeconds !== undefined\n ? { accessTokenTtlSeconds: options.accessTokenTtlSeconds }\n : {}),\n });\n\n const deviceRouteDeps = {\n root,\n bearer: { tokenSigner: options.tokenSigner, devices: options.cloud.devices },\n };\n\n const registry = new CloudRouteRegistry();\n const activityBounds: ActivityBounds = {\n maxEvents: options.activityMaxEvents ?? DEFAULT_ACTIVITY_MAX_EVENTS,\n maxBytes: options.activityMaxBytes ?? DEFAULT_ACTIVITY_MAX_BYTES,\n capacity: options.activityCapacity ?? DEFAULT_ACTIVITY_CAPACITY,\n ttlMs: options.activityTtlMs ?? DEFAULT_ACTIVITY_TTL_MS,\n };\n\n // Auth v2 (§6) — always mounted: without pairing there is no deployment.\n registry.register({ method: 'POST', path: BYOK_PAIR_PATH, class: 'public' }, pairHandler({ auth }));\n registry.register({ method: 'POST', path: BYOK_CHALLENGE_PATH, class: 'public' }, challengeHandler({ auth }));\n registry.register({ method: 'POST', path: BYOK_TOKEN_PATH, class: 'public' }, tokenHandler({ auth }));\n\n // ADR-010 — the declaration itself is always readable; a client that cannot\n // read it has no way to learn anything else without probing status codes.\n registry.register(\n { method: 'GET', path: BYOK_CAPABILITIES_PATH, class: 'public' },\n capabilitiesHandler({ declaration }),\n );\n\n if (declares(declaration, CLOUD_CAPABILITIES.eventsLongPoll)) {\n registry.register(\n { method: 'GET', path: BYOK_EVENTS_PATH, class: 'device' },\n eventsHandler({\n ...deviceRouteDeps,\n longPollHoldMs: options.longPollHoldMs ?? DEFAULT_LONG_POLL_HOLD_MS,\n longPollIntervalMs: options.longPollIntervalMs ?? DEFAULT_LONG_POLL_INTERVAL_MS,\n pageLimit: options.eventsPageLimit ?? DEFAULT_EVENTS_PAGE_LIMIT,\n }),\n );\n }\n\n if (declares(declaration, CLOUD_CAPABILITIES.messagesBatch)) {\n registry.register(\n { method: 'POST', path: BYOK_MESSAGES_PATH, class: 'device' },\n messagesHandler({ ...deviceRouteDeps, activityBounds }),\n );\n }\n\n if (declares(declaration, CLOUD_CAPABILITIES.boardCoordination)) {\n const boardDeps = {\n ...deviceRouteDeps,\n pageLimit: options.boardPageLimit ?? DEFAULT_BOARD_PAGE_LIMIT,\n };\n registry.register({ method: 'GET', path: BYOK_BOARD_PATH, class: 'device' }, boardListHandler(boardDeps));\n registry.register(\n { method: 'POST', path: BYOK_BOARD_CLAIM_ROUTE, class: 'device' },\n boardClaimHandler(deviceRouteDeps),\n );\n registry.register(\n { method: 'POST', path: BYOK_BOARD_UNCLAIM_ROUTE, class: 'device' },\n boardUnclaimHandler(deviceRouteDeps),\n );\n registry.register(\n { method: 'POST', path: BYOK_BOARD_STATUS_ROUTE, class: 'device' },\n boardStatusHandler(deviceRouteDeps),\n );\n }\n\n if (declares(declaration, CLOUD_CAPABILITIES.boardSse)) {\n registry.register(\n { method: 'GET', path: BYOK_BOARD_STREAM_PATH, class: 'device' },\n boardStreamHandler({\n ...deviceRouteDeps,\n pageLimit: options.boardPageLimit ?? DEFAULT_BOARD_PAGE_LIMIT,\n queryIntervalMs: options.boardStreamQueryIntervalMs ?? DEFAULT_BOARD_STREAM_QUERY_INTERVAL_MS,\n heartbeatIntervalMs:\n options.boardStreamHeartbeatIntervalMs ?? DEFAULT_BOARD_STREAM_HEARTBEAT_INTERVAL_MS,\n reconciliationIntervalMs:\n options.boardStreamReconciliationIntervalMs ??\n DEFAULT_BOARD_STREAM_RECONCILIATION_INTERVAL_MS,\n }),\n );\n }\n\n if (declares(declaration, CLOUD_CAPABILITIES.presenceHints)) {\n registry.register(\n { method: 'PUT', path: BYOK_PRESENCE_PATH, class: 'device' },\n presencePublishHandler({\n ...deviceRouteDeps,\n ttlMs: options.presenceTtlMs ?? DEFAULT_PRESENCE_TTL_MS,\n minimumIntervalMs:\n options.presenceMinimumIntervalMs ?? DEFAULT_PRESENCE_MINIMUM_INTERVAL_MS,\n detailMaxBytes: options.presenceDetailMaxBytes ?? DEFAULT_PRESENCE_DETAIL_MAX_BYTES,\n }),\n );\n }\n\n if (declares(declaration, CLOUD_CAPABILITIES.activityTail)) {\n registry.register(\n { method: 'POST', path: BYOK_ACTIVITY_PATH, class: 'device' },\n activityAppendHandler({ ...deviceRouteDeps, bounds: activityBounds }),\n );\n }\n\n const truthCommitter = options.truthCommitter;\n const truthObjectDownloads = options.truthObjectDownloads;\n if (\n truthCommitter !== undefined &&\n truthObjectDownloads !== undefined &&\n declares(declaration, CLOUD_CAPABILITIES.truthRecords)\n ) {\n const truthDeps = {\n proof: {\n devices: options.cloud.devices,\n crypto: options.crypto,\n clock: options.clock,\n },\n truth: truthCommitter,\n objectDownloads: truthObjectDownloads,\n maxRequestBytes: options.maxTruthRequestBytes ?? DEFAULT_MAX_TRUTH_REQUEST_BYTES,\n };\n registry.register(\n { method: 'GET', path: BYOK_RECORDS_PATH, class: 'proof' },\n truthManifestHandler(truthDeps),\n );\n registry.register(\n { method: 'GET', path: BYOK_RECORD_ROUTE, class: 'proof' },\n truthGetHandler(truthDeps),\n );\n registry.register(\n { method: 'PUT', path: BYOK_RECORD_ROUTE, class: 'proof' },\n truthPutHandler(truthDeps),\n );\n }\n\n // Skill packs: both conditions, same asymmetry as the byte proxy below.\n // Declared-without-a-store is fatal (above); supplied-without-a-declaration\n // is a silent no-mount, which is how a deployment rolls the channel out or\n // back without ever telling a client something false.\n const skillPacks = options.skillPacks;\n if (skillPacks !== undefined && declares(declaration, CLOUD_CAPABILITIES.skillPacks)) {\n const skillPackDeps = {\n bearer: deviceRouteDeps.bearer,\n skillPacks,\n pageLimit: options.skillPackPageLimit ?? DEFAULT_SKILL_PACK_PAGE_LIMIT,\n };\n registry.register(\n { method: 'GET', path: BYOK_SKILL_PACKS_PATH, class: 'device' },\n skillPackListHandler(skillPackDeps),\n );\n registry.register(\n { method: 'GET', path: BYOK_SKILL_PACK_FILE_ROUTE, class: 'device' },\n skillPackFileHandler(skillPackDeps),\n );\n }\n\n if (declares(declaration, CLOUD_CAPABILITIES.blobsPresigned)) {\n const blobDeps = {\n ...deviceRouteDeps,\n maxBlobSizeBytes: options.maxBlobSizeBytes ?? DEFAULT_MAX_BLOB_SIZE_BYTES,\n };\n registry.register({ method: 'POST', path: BYOK_BLOBS_PATH, class: 'device' }, createBlobHandler(blobDeps));\n registry.register({ method: 'POST', path: BYOK_BLOB_FINALIZE_ROUTE, class: 'device' }, finalizeBlobHandler(blobDeps));\n registry.register({ method: 'GET', path: BYOK_BLOB_URL_ROUTE, class: 'device' }, blobDownloadUrlHandler(blobDeps));\n }\n\n // Byte proxying: BOTH conditions, and neither is inferred from the other.\n // There is no third state: a composition either carries bytes or it does not.\n //\n // The two halves fail differently, and the asymmetry is the point.\n //\n // DECLARED WITHOUT A PROXY is fatal, above. A declaration is the ONE thing a\n // client is entitled to trust without probing (ADR-010), so a deployment\n // publishing `blobs.contentproxy` it cannot serve does not degrade to \"two\n // missing routes\" — it tells every client something false and then answers\n // 404 to the client that believed it. Not mounting the routes is what an\n // honest composition does with a capability it lacks; the dishonesty is in\n // still announcing it, and the announcement is unconditional.\n //\n // SUPPLIED WITHOUT A DECLARATION is not fatal, and stays a silent no-mount.\n // The deployment's declaration is then merely narrower than its parts, which\n // is how a capability gets rolled out or rolled back: a host with a proxy\n // wired up but the capability withheld serves exactly what it declares. The\n // client is told less than the truth, never more, and no route exists that a\n // client could only discover by probing.\n const contentProxy = options.blobContentProxy;\n if (contentProxy !== undefined && declares(declaration, CLOUD_CAPABILITIES.blobsContentProxy)) {\n const contentDeps = { contentProxy };\n registry.register(\n { method: 'PUT', path: BYOK_BLOB_CONTENT_ROUTE, class: 'presigned' },\n blobUploadContentHandler(contentDeps),\n );\n registry.register(\n { method: 'GET', path: BYOK_BLOB_CONTENT_ROUTE, class: 'presigned' },\n blobDownloadContentHandler(contentDeps),\n );\n }\n\n // Task approval is deliberately absent, exactly as it is on the reference\n // server: every route above is authenticated by a DEVICE's own credential,\n // and a device-bearer-authed approval route would let any validly paired\n // device approve any task in its tenant. Approval is an operator action and\n // belongs to the host's own control-plane surface.\n\n const operatorId = options.operatorId ?? 'host';\n\n function controlPlane(tenant: TenantId): ControlPlanePrincipal {\n return { kind: 'control-plane', tenantId: tenant, operatorId };\n }\n\n async function enqueueTaskEnvelope(\n tenant: TenantId,\n deviceId: string,\n requestedTaskId: string | undefined,\n buildEnvelope: (taskId: string, seq: number, messageId: string) => Envelope,\n ): Promise<EnqueuedOffer> {\n const stores = tenantStoresFor(controlPlane(tenant), root);\n const taskId = requestedTaskId ?? `task_${options.crypto.randomUuid()}`;\n const messageId = options.crypto.randomUuid();\n\n const message = await stores.mailbox.append({\n deviceId,\n messageId,\n materialize: async (seq) => {\n // Core stays protocol-free: the mailbox reserves the one authoritative\n // delivery number, then asks this producer to build opaque bytes while\n // allocation and insertion are still serialized per device.\n const envelope = buildEnvelope(taskId, seq, messageId);\n const body = encodeEnvelope(envelope);\n const bytes = new TextEncoder().encode(body);\n return {\n body,\n bodyHash: contentHash(await options.crypto.sha256(bytes)),\n byteSize: BigInt(bytes.length),\n };\n },\n });\n const envelope = decodeEnvelope(message.body);\n if (envelope.seq !== message.seq) {\n throw new ByokCloudError(\n 'mailbox_seq_mismatch',\n `Mailbox stored offer seq ${String(envelope.seq)} at row ${message.seq}; the daemon's redelivery cursor would be wrong.`,\n );\n }\n\n const attempt = await stores.tasks.open({ taskId, deviceId });\n return { taskId, seq: message.seq, envelope, attempt };\n }\n\n return {\n fetch: registry.fetch,\n routes: registry.routes,\n mountedRoutes: registry.mounted,\n capabilities: declaration,\n\n createPairingCode(tenant, input) {\n return auth.createPairingCode(tenant, input);\n },\n\n async enqueueOffer(tenant, deviceId, input) {\n return enqueueTaskEnvelope(tenant, deviceId, input.taskId, (taskId, seq, messageId) =>\n createEnvelope('task.offer', input.payload, { id: messageId, taskId, seq }),\n );\n },\n\n async enqueueToolsetOffer(tenant, deviceId, input) {\n return enqueueTaskEnvelope(tenant, deviceId, input.taskId, (taskId, seq, messageId) =>\n createEnvelope('task.offer_with_toolsets', input.payload, { id: messageId, taskId, seq }),\n );\n },\n\n readTaskAttempt(tenant, taskId) {\n return tenantStoresFor(controlPlane(tenant), root).tasks.get(taskId);\n },\n\n readTerminalReceipt(tenant, taskId) {\n return tenantStoresFor(controlPlane(tenant), root).receipts.get(terminalReceiptKey(taskId));\n },\n\n async readTaskResult(tenant, taskId) {\n const receipt = await tenantStoresFor(controlPlane(tenant), root).receipts.get(\n terminalReceiptKey(taskId),\n );\n return receipt === undefined ? undefined : projectTerminalResult(taskId, receipt);\n },\n\n listDevices(tenant) {\n return tenantStoresFor(controlPlane(tenant), root).devices.list();\n },\n\n revokeDevice(tenant, deviceId) {\n return tenantStoresFor(controlPlane(tenant), root).devices.revoke(deviceId);\n },\n\n createBoardItem(tenant, input) {\n assertBoardLabels(input.channel, input.title, {\n channelMaxBytes: options.boardChannelMaxBytes ?? DEFAULT_BOARD_CHANNEL_MAX_BYTES,\n titleMaxBytes: options.boardTitleMaxBytes ?? DEFAULT_BOARD_TITLE_MAX_BYTES,\n });\n return tenantStoresFor(controlPlane(tenant), root).board.create(input);\n },\n\n listBoardItems(tenant, query) {\n return tenantStoresFor(controlPlane(tenant), root).board.list(query);\n },\n\n acceptBoardItem(tenant, itemId) {\n return tenantStoresFor(controlPlane(tenant), root).board.updateStatus({\n itemId,\n expectedStatus: 'in_review',\n status: 'done',\n });\n },\n\n listPresence(tenant) {\n return tenantStoresFor(controlPlane(tenant), root).presence.list();\n },\n\n readActivity(tenant, taskId) {\n return tenantStoresFor(controlPlane(tenant), root).activity.read(taskId);\n },\n\n readApprovalTimeline(tenant, taskId) {\n return tenantStoresFor(controlPlane(tenant), root).approvals.read(taskId);\n },\n };\n}\n\n/**\n * Fail closed on a declaration this composition's parts cannot back.\n *\n * Route mounting alone cannot enforce this: `GET /byok/capabilities` serves the\n * declaration verbatim and is mounted unconditionally, so a deployment that\n * declares `blobs.contentproxy` without a proxy publishes the capability and\n * 404s both routes. Refusing at construction is the only placement where the\n * deployment cannot exist in that state — the alternative, sanitizing the\n * declaration down to what got mounted, would make the running surface a second\n * authority over what the host said it was deploying.\n */\nfunction assertNoOverDeclaration(\n declaration: CapabilityDeclaration,\n contentProxy: BlobContentProxy | undefined,\n truthCommitter: TruthCommitter | undefined,\n truthObjectDownloads: TruthObjectDownloads | undefined,\n skillPacks: SkillPackStore | undefined,\n): void {\n if (\n declares(declaration, CLOUD_CAPABILITIES.boardSse) &&\n !declares(declaration, CLOUD_CAPABILITIES.boardCoordination)\n ) {\n throw new ByokCloudError(\n 'capability_over_declared',\n `${CLOUD_CAPABILITIES.boardSse} requires ${CLOUD_CAPABILITIES.boardCoordination}; without polling, reconciliation and declared fallback cannot be served.`,\n );\n }\n if (contentProxy === undefined && declares(declaration, CLOUD_CAPABILITIES.blobsContentProxy)) {\n throw new ByokCloudError(\n 'capability_over_declared',\n `This deployment declares ${CLOUD_CAPABILITIES.blobsContentProxy} but was given no BlobContentProxy, so both /byok/blobs/:id/content routes would be published and unserved.`,\n );\n }\n if (truthCommitter === undefined && declares(declaration, CLOUD_CAPABILITIES.truthRecords)) {\n throw new ByokCloudError(\n 'capability_over_declared',\n `This deployment declares ${CLOUD_CAPABILITIES.truthRecords} but was given no atomic TruthCommitter.`,\n );\n }\n if (truthObjectDownloads === undefined && declares(declaration, CLOUD_CAPABILITIES.truthRecords)) {\n throw new ByokCloudError(\n 'capability_over_declared',\n `This deployment declares ${CLOUD_CAPABILITIES.truthRecords} but was given no content-hash keyed TruthObjectDownloads authority.`,\n );\n }\n if (skillPacks === undefined && declares(declaration, CLOUD_CAPABILITIES.skillPacks)) {\n throw new ByokCloudError(\n 'capability_over_declared',\n `This deployment declares ${CLOUD_CAPABILITIES.skillPacks} but was given no SkillPackStore, so both /byok/skill-packs routes would be published and unserved.`,\n );\n }\n}\n\nfunction parseDeclaration(declaration: CapabilityDeclaration): CapabilityDeclaration {\n try {\n return parseCapabilityDeclaration(declaration);\n } catch (cause) {\n throw new ByokCloudError(\n 'capability_declaration_invalid',\n 'The capability declaration this deployment was configured with is not a valid ADR-010 declaration.',\n { cause },\n );\n }\n}\n","/**\n * The reference {@link InboundRateLimiter}: allow-all.\n *\n * S3a's job is to put the seam at gate position 0 — before the type-allow\n * check — not to invent a limiter policy. A hosted deployment's real budget\n * lives at its edge; when it arrives it plugs in here and the gate order does\n * not move.\n */\nimport type { TenantId } from '@byok-sdk/core';\nimport type { InboundRateLimiter } from '../ports';\n\nexport class AllowAllRateLimiter implements InboundRateLimiter {\n async consume(_tenant: TenantId, _deviceId: string): Promise<boolean> {\n return true;\n }\n}\n","/**\n * The in-memory blob pair: metadata and bytes in process memory, HMAC-signed\n * expiring URLs (docs/protocol.md §7).\n *\n * TWO objects, one shared record map, because the contract they satisfy is two\n * things: {@link CloudBlobStore} is the tenant-first port every composition\n * owes, and {@link BlobContentProxy} is the optional byte-carrying half. The\n * in-memory composition is the one that supplies both — it has nowhere else to\n * put bytes — which is why hosted-in-memory behavior is byte-for-byte what it\n * was before the split.\n *\n * They cannot be one object: the port's method inventory is contract data\n * (`CLOUD_PORT_METHODS`) and `@byok-sdk/conformance` asserts a composition's blob\n * store implements EXACTLY the two declared methods. An object carrying all\n * six would fail that assertion, which is the point — the suite is what keeps\n * the narrowed port narrow.\n *\n * The presigned URL form — `/byok/blobs/<id>/content?sig=&exp=` — is the\n * relative shape the daemon's blob client already resolves against its server\n * base, so a hosted deployment is indistinguishable from a self-hosted one on\n * this route too.\n *\n * Tenancy: `createUpload` records the owning tenant and reservation while\n * `observeUpload`/`getDownloadUrl` refuse any other, so the three bearer routes are\n * tenant-closed. The two `/content` routes are presigned by construction and\n * have no principal at all — the signature over the blob id IS the credential\n * (same posture as the reference server, §7).\n */\nimport { ByokCoreError, type Clock, type ContentHash, type ObjectStore, type StorageReservation, type TenantId } from '@byok-sdk/core';\nimport { byokBlobContentPath } from '@byok-sdk/protocol';\nimport type { CloudCrypto } from '../../crypto/port';\nimport type {\n BlobContent,\n BlobContentProxy,\n BlobObservation,\n BlobWriteResult,\n CloudBlobStore,\n} from '../ports';\n\n/** How long a presigned upload/download URL stays valid. */\nexport const BLOB_URL_TTL_MS = 15 * 60 * 1000;\n\nconst SIGNING_SECRET_BYTES = 32;\n\ninterface BlobRecord {\n readonly tenantId: TenantId;\n readonly reservationId: string;\n readonly contentHash: ContentHash;\n readonly byteSize: bigint;\n readonly contentType: string;\n uploaded: boolean;\n data?: Uint8Array;\n}\n\nexport interface InMemoryBlobStoreOptions {\n readonly urlTtlMs?: number;\n}\n\n/**\n * The state both halves read, and the only thing they share.\n *\n * Module-private on purpose: it is not a port, and nothing outside this file\n * should be able to reach a blob record without going through one of the two\n * contracts above.\n */\nclass InMemoryBlobRegistry {\n readonly blobs = new Map<string, BlobRecord>();\n readonly reservationBlobs = new Map<string, string>();\n readonly clock: Clock;\n readonly crypto: CloudCrypto;\n readonly secret: Uint8Array;\n readonly urlTtlMs: number;\n\n constructor(clock: Clock, crypto: CloudCrypto, options: InMemoryBlobStoreOptions) {\n this.clock = clock;\n this.crypto = crypto;\n this.secret = globalThis.crypto.getRandomValues(new Uint8Array(SIGNING_SECRET_BYTES));\n this.urlTtlMs = options.urlTtlMs ?? BLOB_URL_TTL_MS;\n }\n\n async signUrl(blobId: string, action: 'put' | 'get'): Promise<string> {\n const exp = this.clock.now().getTime() + this.urlTtlMs;\n const sig = await this.computeSig(blobId, action, exp);\n return `${byokBlobContentPath(blobId)}?sig=${sig}&exp=${exp}`;\n }\n\n computeSig(blobId: string, action: 'put' | 'get', exp: number): Promise<string> {\n return this.crypto.hmacSha256(this.secret, `${blobId}:${action}:${exp}`);\n }\n}\n\n/** The narrowed port: tenant-first grants, no bytes. */\nexport class InMemoryCloudBlobStore implements CloudBlobStore {\n readonly #registry: InMemoryBlobRegistry;\n readonly #objects: ObjectStore;\n\n constructor(registry: InMemoryBlobRegistry, objects: ObjectStore) {\n this.#registry = registry;\n this.#objects = objects;\n }\n\n async createUpload(tenant: TenantId, reservation: StorageReservation): Promise<{ blobId: string; uploadUrl: string }> {\n assertReservedObject(tenant, reservation);\n const reservationKey = `${tenant}\\u0000${reservation.reservationId}`;\n const existingBlobId = this.#registry.reservationBlobs.get(reservationKey);\n if (existingBlobId !== undefined) {\n const manifest = await this.#objects.get(tenant, reservation.contentHash);\n if (manifest?.state === 'committed') {\n throw new ByokCoreError(\n 'object_state_invalid',\n `Object ${reservation.contentHash} is already committed and immutable.`,\n );\n }\n return { blobId: existingBlobId, uploadUrl: await this.#registry.signUrl(existingBlobId, 'put') };\n }\n\n const entry = await this.#objects.putManifest(tenant, {\n hash: reservation.contentHash,\n byteSize: reservation.expectedBytes,\n contentType: reservation.contentType,\n });\n if (\n entry.byteSize !== reservation.expectedBytes ||\n entry.contentType !== reservation.contentType\n ) {\n throw new ByokCoreError(\n 'storage_integrity_mismatch',\n `Object ${reservation.contentHash} already binds a different storage declaration.`,\n );\n }\n if (entry.state === 'committed') {\n throw new ByokCoreError(\n 'object_state_invalid',\n `Object ${reservation.contentHash} is already committed and immutable.`,\n );\n }\n\n const blobId = `blob_${this.#registry.crypto.randomUuid()}`;\n this.#registry.blobs.set(blobId, {\n tenantId: tenant,\n reservationId: reservation.reservationId,\n contentHash: reservation.contentHash,\n byteSize: reservation.expectedBytes,\n contentType: reservation.contentType,\n uploaded: false,\n });\n this.#registry.reservationBlobs.set(reservationKey, blobId);\n return { blobId, uploadUrl: await this.#registry.signUrl(blobId, 'put') };\n }\n\n async observeUpload(\n tenant: TenantId,\n blobId: string,\n reservation: StorageReservation,\n ): Promise<BlobObservation | undefined> {\n const record = this.#registry.blobs.get(blobId);\n if (\n record === undefined ||\n record.tenantId !== tenant ||\n reservation.tenantId !== tenant ||\n record.reservationId !== reservation.reservationId ||\n record.contentHash !== reservation.contentHash ||\n !record.uploaded\n ) {\n return undefined;\n }\n return {\n observedByteSize: BigInt(record.data?.length ?? 0),\n observedContentType: record.contentType,\n };\n }\n\n async getDownloadUrl(tenant: TenantId, blobId: string): Promise<string | undefined> {\n const record = this.#registry.blobs.get(blobId);\n // Another tenant's blob and a blob that does not exist answer identically.\n if (record === undefined || record.tenantId !== tenant || !record.uploaded) return undefined;\n const manifest = await this.#objects.get(tenant, record.contentHash);\n if (manifest?.state !== 'committed') return undefined;\n return this.#registry.signUrl(blobId, 'get');\n }\n}\n\n/** The optional half: the bytes this composition has nowhere else to put. */\nexport class InMemoryBlobContentProxy implements BlobContentProxy {\n readonly #registry: InMemoryBlobRegistry;\n\n constructor(registry: InMemoryBlobRegistry) {\n this.#registry = registry;\n }\n\n async verifySignedUrl(blobId: string, action: 'put' | 'get', sig: string, exp: number): Promise<boolean> {\n if (!Number.isFinite(exp) || this.#registry.clock.now().getTime() > exp) return false;\n const expected = await this.#registry.computeSig(blobId, action, exp);\n return this.#registry.crypto.timingSafeEqual(expected, sig);\n }\n\n async writeContent(blobId: string, data: Uint8Array): Promise<BlobWriteResult> {\n const record = this.#registry.blobs.get(blobId);\n if (record === undefined) return { ok: false, reason: 'unknown blobId' };\n if (BigInt(data.length) !== record.byteSize) {\n return { ok: false, reason: `size mismatch: declared ${String(record.byteSize)}, received ${data.length}` };\n }\n const actualHash = await this.#registry.crypto.sha256(data);\n if (actualHash !== record.contentHash) {\n return { ok: false, reason: 'contentHash mismatch' };\n }\n record.data = data;\n record.uploaded = true;\n return { ok: true };\n }\n\n async readContent(blobId: string): Promise<BlobContent | undefined> {\n const record = this.#registry.blobs.get(blobId);\n if (record === undefined || !record.uploaded || record.data === undefined) return undefined;\n return { data: record.data, contentType: record.contentType };\n }\n}\n\n/** Both halves over one registry. The only way to obtain either. */\nexport interface InMemoryBlobs {\n readonly blobs: CloudBlobStore;\n readonly contentProxy: BlobContentProxy;\n}\n\nexport function createInMemoryBlobs(\n clock: Clock,\n crypto: CloudCrypto,\n objects: ObjectStore,\n options: InMemoryBlobStoreOptions = {},\n): InMemoryBlobs {\n const registry = new InMemoryBlobRegistry(clock, crypto, options);\n return {\n blobs: new InMemoryCloudBlobStore(registry, objects),\n contentProxy: new InMemoryBlobContentProxy(registry),\n };\n}\n\nfunction assertReservedObject(tenant: TenantId, reservation: StorageReservation): void {\n if (\n reservation.tenantId === tenant &&\n reservation.kind === 'object' &&\n reservation.state === 'reserved' &&\n reservation.expectedBytes >= 0n\n ) {\n return;\n }\n throw new ByokCoreError(\n 'storage_integrity_mismatch',\n 'An upload grant requires a reserved object reservation owned by this tenant.',\n );\n}\n","/**\n * In-memory {@link DeviceDirectory}.\n *\n * Rows live under a `(tenant, deviceId)` composite key, so a cross-tenant read\n * is not \"denied\" — it addresses a different key space and finds nothing\n * (§12.6.2 layer 3). The pre-tenant index below holds the SAME record objects,\n * so a revocation applied through the composite key is immediately visible to\n * `/byok/challenge` and `/byok/token` with no second copy to keep in sync.\n */\nimport { tenantKey, type TenantId } from '@byok-sdk/core';\nimport type { DeviceDirectory, DeviceRecord, DeviceRegistration } from '../ports';\n\nexport class InMemoryDeviceDirectory implements DeviceDirectory {\n readonly #byTenant = new Map<string, DeviceRecord>();\n readonly #byDeviceId = new Map<string, string>();\n\n async register(tenant: TenantId, input: DeviceRegistration): Promise<DeviceRecord> {\n const record: DeviceRecord = {\n tenantId: tenant,\n productId: input.productId,\n deviceId: input.deviceId,\n deviceName: input.deviceName,\n devicePublicKey: input.devicePublicKey,\n proofKeyId: input.proofKeyId,\n proofKeyEpoch: input.proofKeyEpoch,\n revoked: false,\n };\n const key = tenantKey(tenant, record.deviceId);\n this.#byTenant.set(key, record);\n this.#byDeviceId.set(record.deviceId, key);\n return record;\n }\n\n async get(tenant: TenantId, deviceId: string): Promise<DeviceRecord | undefined> {\n return this.#byTenant.get(tenantKey(tenant, deviceId));\n }\n\n async revoke(tenant: TenantId, deviceId: string): Promise<void> {\n const key = tenantKey(tenant, deviceId);\n const record = this.#byTenant.get(key);\n if (record === undefined) return;\n this.#byTenant.set(key, { ...record, revoked: true });\n }\n\n async list(tenant: TenantId): Promise<readonly DeviceRecord[]> {\n const prefix = tenantKey(tenant, '');\n return [...this.#byTenant.entries()]\n .filter(([key]) => key.startsWith(prefix))\n .map(([, record]) => record);\n }\n\n async resolveByDeviceId(deviceId: string): Promise<DeviceRecord | undefined> {\n const key = this.#byDeviceId.get(deviceId);\n return key === undefined ? undefined : this.#byTenant.get(key);\n }\n}\n","/**\n * In-memory {@link InboundDedupStore} (N3).\n *\n * A bounded ring per (tenant, device), not an unbounded set: the wire is\n * at-least-once (§9), so this makes processing at-most-once without letting a\n * chatty device grow memory without limit. Check-and-record is one call, so a\n * composition cannot accidentally split it into a racy read-then-write.\n */\nimport { tenantKey, type TenantId } from '@byok-sdk/core';\nimport type { InboundDedupStore } from '../ports';\n\n/** Ids retained per device. Same order of magnitude as the reference server's ring. */\nexport const DEDUP_RING_CAPACITY = 1024;\n\nexport class InMemoryInboundDedupStore implements InboundDedupStore {\n readonly #rings = new Map<string, Set<string>>();\n readonly #capacity: number;\n\n constructor(capacity: number = DEDUP_RING_CAPACITY) {\n this.#capacity = capacity;\n }\n\n async checkAndRecord(tenant: TenantId, deviceId: string, envelopeId: string): Promise<boolean> {\n const key = tenantKey(tenant, deviceId);\n let ring = this.#rings.get(key);\n if (ring === undefined) {\n ring = new Set<string>();\n this.#rings.set(key, ring);\n }\n if (ring.has(envelopeId)) return true;\n ring.add(envelopeId);\n if (ring.size > this.#capacity) {\n const oldest = ring.values().next().value;\n if (oldest !== undefined) ring.delete(oldest);\n }\n return false;\n }\n}\n","/**\n * In-memory {@link NonceStore}: single-use challenge nonces, ~5min TTL\n * (docs/protocol.md §6.2).\n *\n * A nonce is bound to the (tenant, device) it was issued for, so a nonce\n * issued to one tenant's device is not validatable by another's even if the\n * value leaks.\n */\nimport { tenantKey, type Clock, type TenantId } from '@byok-sdk/core';\nimport type { CloudCrypto } from '../../crypto/port';\nimport type { NonceStore } from '../ports';\n\n/** ~5min, matching the reference server (docs/protocol.md §6.2). */\nexport const NONCE_TTL_MS = 5 * 60 * 1000;\n\nconst NONCE_BYTES = 24;\n\ninterface NonceRecord {\n readonly owner: string;\n readonly expiresAtMs: number;\n used: boolean;\n}\n\nexport class InMemoryNonceStore implements NonceStore {\n readonly #nonces = new Map<string, NonceRecord>();\n readonly #clock: Clock;\n readonly #crypto: CloudCrypto;\n readonly #ttlMs: number;\n\n constructor(clock: Clock, crypto: CloudCrypto, ttlMs: number = NONCE_TTL_MS) {\n this.#clock = clock;\n this.#crypto = crypto;\n this.#ttlMs = ttlMs;\n }\n\n /** Number of records currently held (post-sweep). Test-facing only. */\n get size(): number {\n return this.#nonces.size;\n }\n\n async issue(tenant: TenantId, deviceId: string): Promise<string> {\n const nowMs = this.#clock.now().getTime();\n // A long-lived deployment never calls a sweep on a timer, so issue sweeps\n // inline — same posture as the reference server's `NonceStore`.\n for (const [nonce, record] of this.#nonces) {\n if (record.used || record.expiresAtMs <= nowMs) this.#nonces.delete(nonce);\n }\n const nonce = this.#crypto.randomToken(NONCE_BYTES);\n this.#nonces.set(nonce, {\n owner: tenantKey(tenant, deviceId),\n expiresAtMs: nowMs + this.#ttlMs,\n used: false,\n });\n return nonce;\n }\n\n async validate(tenant: TenantId, deviceId: string, nonce: string): Promise<boolean> {\n const record = this.#nonces.get(nonce);\n if (record === undefined) return false;\n if (record.used) return false;\n if (record.owner !== tenantKey(tenant, deviceId)) return false;\n return this.#clock.now().getTime() <= record.expiresAtMs;\n }\n\n async markUsed(tenant: TenantId, nonce: string): Promise<void> {\n const record = this.#nonces.get(nonce);\n if (record === undefined) return;\n if (!record.owner.startsWith(tenantKey(tenant, ''))) return;\n record.used = true;\n }\n}\n","/**\n * In-memory {@link PairingCodeStore}: single-use codes bound to the tenant and\n * product they were minted for.\n *\n * `redeem` answers `undefined` for unknown, expired, and already-used alike.\n * The reference server distinguishes those three in its 401 text; a hosted,\n * multi-tenant surface deliberately does not — the code is a bearer credential\n * addressable across every tenant, and \"already used\" versus \"never existed\"\n * is exactly the difference an attacker enumerating codes would pay for.\n */\nimport type { Clock, TenantId } from '@byok-sdk/core';\nimport type {\n PairingCodeClaims,\n PairingCodeInfo,\n PairingCodeIssueInput,\n PairingCodeStore,\n} from '../ports';\n\ninterface PairingCodeRecord {\n readonly claims: PairingCodeClaims;\n readonly expiresAtMs: number;\n used: boolean;\n}\n\nexport class InMemoryPairingCodeStore implements PairingCodeStore {\n readonly #codes = new Map<string, PairingCodeRecord>();\n readonly #clock: Clock;\n\n constructor(clock: Clock) {\n this.#clock = clock;\n }\n\n async issue(tenant: TenantId, input: PairingCodeIssueInput): Promise<PairingCodeInfo> {\n this.#codes.set(input.code, {\n claims: { tenantId: tenant, productId: input.productId },\n expiresAtMs: new Date(input.expiresAt).getTime(),\n used: false,\n });\n return { code: input.code, expiresAt: input.expiresAt };\n }\n\n async redeem(code: string): Promise<PairingCodeClaims | undefined> {\n const record = this.#codes.get(code);\n if (record === undefined) return undefined;\n if (record.used) return undefined;\n if (this.#clock.now().getTime() > record.expiresAtMs) return undefined;\n record.used = true;\n return record.claims;\n }\n}\n","/**\n * In-memory {@link RequestReceiptStore}: first write wins.\n *\n * The terminal a device reports is a fact, and a retry of the same terminal\n * (the wire is at-least-once) must not overwrite the first one — `created:\n * false` is how the caller learns it was a replay rather than a new fact.\n */\nimport { tenantKey, type Clock, type TenantId } from '@byok-sdk/core';\nimport type { RequestReceipt, RequestReceiptStore } from '../ports';\n\nexport class InMemoryRequestReceiptStore implements RequestReceiptStore {\n readonly #receipts = new Map<string, RequestReceipt>();\n readonly #clock: Clock;\n\n constructor(clock: Clock) {\n this.#clock = clock;\n }\n\n async record(\n tenant: TenantId,\n input: { key: string; body: string },\n ): Promise<{ receipt: RequestReceipt; created: boolean }> {\n const key = tenantKey(tenant, input.key);\n const existing = this.#receipts.get(key);\n if (existing !== undefined) return { receipt: existing, created: false };\n const receipt: RequestReceipt = {\n tenantId: tenant,\n key: input.key,\n body: input.body,\n recordedAt: this.#clock.now().toISOString(),\n };\n this.#receipts.set(key, receipt);\n return { receipt, created: true };\n }\n\n async get(tenant: TenantId, key: string): Promise<RequestReceipt | undefined> {\n return this.#receipts.get(tenantKey(tenant, key));\n }\n}\n","import { tenantKey, type Clock, type TenantId } from '@byok-sdk/core';\nimport type {\n ProofRequestReceipt,\n ProofRequestReceiptInput,\n ProofRequestReceiptStore,\n} from '../ports';\n\nexport class InMemoryProofRequestReceiptStore implements ProofRequestReceiptStore {\n readonly #receipts = new Map<string, ProofRequestReceipt>();\n readonly #clock: Clock;\n\n constructor(clock: Clock) {\n this.#clock = clock;\n }\n\n async record(\n tenant: TenantId,\n input: ProofRequestReceiptInput,\n ): Promise<{ readonly receipt: ProofRequestReceipt; readonly created: boolean }> {\n const key = tenantKey(tenant, input.deviceId, input.requestId);\n const existing = this.#receipts.get(key);\n if (existing !== undefined) return { receipt: existing, created: false };\n const receipt: ProofRequestReceipt = {\n tenantId: tenant,\n ...input,\n recordedAt: this.#clock.now().toISOString(),\n };\n this.#receipts.set(key, receipt);\n return { receipt, created: true };\n }\n\n async get(\n tenant: TenantId,\n deviceId: string,\n requestId: string,\n ): Promise<ProofRequestReceipt | undefined> {\n return this.#receipts.get(tenantKey(tenant, deviceId, requestId));\n }\n}\n","/**\n * In-memory {@link TaskAttemptStore} — the ownership authority the inbound\n * gate reads (N2).\n *\n * Two deliberate no-ops:\n *\n * - `claim` on a task this tenant never offered writes nothing. A device that\n * guesses a taskId must not be able to conjure a row (and, cross-tenant,\n * must not leave a trace in the tenant it guessed into).\n * - `recordStatus` on an unknown task writes nothing, mirroring the reference\n * server's per-type handlers, whose behavior on a missing record is a no-op\n * rather than a rejection.\n *\n * Ownership is first-claim-wins and never transfers: reassigning an owner is\n * the one operation that would make the gate's cross-device assertion\n * unfalsifiable.\n */\nimport { tenantKey, type Clock, type TenantId } from '@byok-sdk/core';\nimport type { TaskAttempt, TaskAttemptStatus, TaskAttemptStore } from '../ports';\n\nexport class InMemoryTaskAttemptStore implements TaskAttemptStore {\n readonly #attempts = new Map<string, TaskAttempt>();\n readonly #clock: Clock;\n\n constructor(clock: Clock) {\n this.#clock = clock;\n }\n\n async open(tenant: TenantId, input: { taskId: string; deviceId: string }): Promise<TaskAttempt> {\n const key = tenantKey(tenant, input.taskId);\n const existing = this.#attempts.get(key);\n if (existing !== undefined) return existing;\n const attempt: TaskAttempt = {\n tenantId: tenant,\n taskId: input.taskId,\n deviceId: input.deviceId,\n status: 'offered',\n updatedAt: this.#now(),\n };\n this.#attempts.set(key, attempt);\n return attempt;\n }\n\n async get(tenant: TenantId, taskId: string): Promise<TaskAttempt | undefined> {\n return this.#attempts.get(tenantKey(tenant, taskId));\n }\n\n async claim(tenant: TenantId, input: { taskId: string; deviceId: string }): Promise<TaskAttempt | undefined> {\n const key = tenantKey(tenant, input.taskId);\n const existing = this.#attempts.get(key);\n if (existing === undefined) return undefined;\n if (existing.ownerDeviceId !== undefined) return existing;\n const claimed: TaskAttempt = {\n ...existing,\n ownerDeviceId: input.deviceId,\n status: 'claimed',\n updatedAt: this.#now(),\n };\n this.#attempts.set(key, claimed);\n return claimed;\n }\n\n async recordStatus(\n tenant: TenantId,\n input: { taskId: string; status: TaskAttemptStatus },\n ): Promise<TaskAttempt | undefined> {\n const key = tenantKey(tenant, input.taskId);\n const existing = this.#attempts.get(key);\n if (existing === undefined) return undefined;\n const updated: TaskAttempt = { ...existing, status: input.status, updatedAt: this.#now() };\n this.#attempts.set(key, updated);\n return updated;\n }\n\n #now(): string {\n return this.#clock.now().toISOString();\n }\n}\n","import type { Clock, TenantId } from '@byok-sdk/core';\nimport { ByokCloudError } from '../../errors';\nimport {\n activityCursor,\n activityTailKey,\n compareTimelineEvents,\n projectTimelineEvents,\n validateActivityAppend,\n type ActivityAppendInput,\n type ActivityStore,\n type ActivityTail,\n} from '../../activity';\n\nexport class InMemoryActivityStore implements ActivityStore {\n readonly #tails = new Map<string, ActivityTail>();\n\n constructor(private readonly clock: Clock) {}\n\n async append(tenant: TenantId, input: ActivityAppendInput): Promise<ActivityTail> {\n const capacity = validateActivityAppend(input);\n const now = this.clock.now();\n const receivedAt = now.toISOString();\n const key = activityTailKey(tenant, input.taskId);\n const existing = this.#tails.get(key);\n const live = existing !== undefined && receivedAt < existing.expiresAt ? existing : undefined;\n const incoming = projectTimelineEvents(input, receivedAt);\n for (const next of incoming) {\n const collision = live?.entries.find(\n (entry) =>\n entry.batchSeq === next.batchSeq &&\n entry.eventIndex === next.eventIndex &&\n entry.sourceEnvelopeId !== next.sourceEnvelopeId,\n );\n if (collision !== undefined) {\n throw new ByokCloudError(\n 'coordination_input_invalid',\n `Activity order key (${next.batchSeq}, ${next.eventIndex}) already belongs to another source envelope.`,\n );\n }\n }\n const allEntries = [...(live?.entries ?? []), ...incoming].sort(compareTimelineEvents);\n const evicted = Math.max(allEntries.length - capacity, 0);\n const entries = allEntries.slice(evicted);\n const cursor = activityCursor(entries);\n const tail: ActivityTail = {\n tenantId: tenant,\n taskId: input.taskId,\n entries,\n ...(cursor === undefined ? {} : { cursor }),\n dropped: (live?.dropped ?? 0) + input.dropped + evicted,\n capacity,\n expiresAt: new Date(now.getTime() + input.ttlMs).toISOString(),\n };\n this.#tails.set(key, tail);\n return tail;\n }\n\n async read(tenant: TenantId, taskId: string): Promise<ActivityTail | undefined> {\n const key = activityTailKey(tenant, taskId);\n const tail = this.#tails.get(key);\n if (tail === undefined) return undefined;\n if (this.clock.now().toISOString() >= tail.expiresAt) {\n this.#tails.delete(key);\n return undefined;\n }\n return tail;\n }\n}\n","import type { Clock, TenantId } from '@byok-sdk/core';\nimport { ByokCloudError } from '../../errors';\nimport {\n ApprovalObservationSchema,\n approvalTimelineCursor,\n approvalTimelineKey,\n validateApprovalTimelineAppend,\n type ApprovalTimelineAppendInput,\n type ApprovalTimelineStore,\n type ApprovalTimelineTail,\n} from '../../approval-timeline';\n\nexport class InMemoryApprovalTimelineStore implements ApprovalTimelineStore {\n readonly #tails = new Map<string, ApprovalTimelineTail>();\n\n constructor(private readonly clock: Clock) {}\n\n async append(\n tenant: TenantId,\n input: ApprovalTimelineAppendInput,\n ): Promise<ApprovalTimelineTail> {\n const { capacity, ttlMs, event } = validateApprovalTimelineAppend(input);\n const now = this.clock.now();\n const receivedAt = now.toISOString();\n const key = approvalTimelineKey(tenant, input.taskId);\n const existing = this.#tails.get(key);\n const live = existing !== undefined && receivedAt < existing.expiresAt ? existing : undefined;\n if (live !== undefined) {\n const duplicate = live.entries.find(\n (entry) => entry.sourceEnvelopeId === input.sourceEnvelopeId,\n );\n if (duplicate !== undefined) {\n if (JSON.stringify(duplicate.event) !== JSON.stringify(event)) {\n throw new ByokCloudError(\n 'coordination_input_invalid',\n 'Approval source envelope identity already belongs to another lifecycle event.',\n );\n }\n return live;\n }\n }\n\n const revision = (live?.cursor ?? 0) + 1;\n const observation = ApprovalObservationSchema.parse({\n taskId: input.taskId,\n sourceEnvelopeId: input.sourceEnvelopeId,\n revision,\n receivedAt,\n event,\n });\n const allEntries = [...(live?.entries ?? []), observation];\n const evicted = Math.max(allEntries.length - capacity, 0);\n const entries = allEntries.slice(evicted);\n const tail: ApprovalTimelineTail = {\n tenantId: tenant,\n taskId: input.taskId,\n entries,\n cursor: approvalTimelineCursor(entries),\n dropped: (live?.dropped ?? 0) + evicted,\n capacity,\n expiresAt: new Date(now.getTime() + ttlMs).toISOString(),\n };\n this.#tails.set(key, tail);\n return tail;\n }\n\n async read(tenant: TenantId, taskId: string): Promise<ApprovalTimelineTail | undefined> {\n const key = approvalTimelineKey(tenant, taskId);\n const tail = this.#tails.get(key);\n if (tail === undefined) return undefined;\n if (this.clock.now().toISOString() >= tail.expiresAt) {\n this.#tails.delete(key);\n return undefined;\n }\n return tail;\n }\n}\n","/**\n * The in-memory reference implementation of every cloud-local port.\n *\n * Same posture as `@byok-sdk/core`'s: a reference, not a production store. What it\n * guarantees is that the behavior the handler suites assert is achievable\n * without a database — which is what makes those same assertions meaningful\n * when a durable composition (S3b's journal, S4A's schema) runs them later.\n */\nimport type { Clock, ObjectStore } from '@byok-sdk/core';\nimport type { CloudCrypto } from '../../crypto/port';\nimport type { BlobContentProxy, CloudStores } from '../ports';\nimport { AllowAllRateLimiter } from './rate-limiter';\nimport { createInMemoryBlobs } from './blobs';\nimport { InMemoryDeviceDirectory } from './device-directory';\nimport { InMemoryInboundDedupStore } from './dedup';\nimport { InMemoryNonceStore } from './nonces';\nimport { InMemoryPairingCodeStore } from './pairing-codes';\nimport { InMemoryRequestReceiptStore } from './receipts';\nimport { InMemoryProofRequestReceiptStore } from './proof-receipts';\nimport { InMemoryTaskAttemptStore } from './task-attempts';\nimport { InMemoryActivityStore } from './activity';\nimport { InMemoryApprovalTimelineStore } from './approval-timeline';\n\nexport { AllowAllRateLimiter } from './rate-limiter';\nexport {\n BLOB_URL_TTL_MS,\n InMemoryBlobContentProxy,\n InMemoryCloudBlobStore,\n createInMemoryBlobs,\n} from './blobs';\nexport type { InMemoryBlobs, InMemoryBlobStoreOptions } from './blobs';\nexport { DEDUP_RING_CAPACITY, InMemoryInboundDedupStore } from './dedup';\nexport { InMemoryDeviceDirectory } from './device-directory';\nexport { InMemoryNonceStore, NONCE_TTL_MS } from './nonces';\nexport { InMemoryPairingCodeStore } from './pairing-codes';\nexport { InMemoryRequestReceiptStore } from './receipts';\nexport { InMemoryProofRequestReceiptStore } from './proof-receipts';\nexport { InMemoryTaskAttemptStore } from './task-attempts';\nexport { InMemoryActivityStore } from './activity';\nexport { InMemoryApprovalTimelineStore } from './approval-timeline';\n\n/**\n * The port bundle plus the byte proxy, in the shape `createInMemoryCoreStores`\n * already uses: the composition is an object with a `stores` field, not the\n * bundle itself.\n *\n * `blobContentProxy` sits BESIDE `stores` rather than inside it because it is\n * not a port — `createByokCloud` takes it as its own optional input, and a\n * composition that cannot carry bytes simply has none to hand over.\n */\nexport interface InMemoryCloudComposition {\n readonly stores: CloudStores;\n readonly blobContentProxy: BlobContentProxy;\n}\n\nexport function createInMemoryCloudStores(\n clock: Clock,\n crypto: CloudCrypto,\n objects: ObjectStore,\n): InMemoryCloudComposition {\n const blobs = createInMemoryBlobs(clock, crypto, objects);\n return {\n stores: {\n activity: new InMemoryActivityStore(clock),\n approvals: new InMemoryApprovalTimelineStore(clock),\n devices: new InMemoryDeviceDirectory(),\n pairingCodes: new InMemoryPairingCodeStore(clock),\n nonces: new InMemoryNonceStore(clock, crypto),\n dedup: new InMemoryInboundDedupStore(),\n tasks: new InMemoryTaskAttemptStore(clock),\n receipts: new InMemoryRequestReceiptStore(clock),\n proofReceipts: new InMemoryProofRequestReceiptStore(clock),\n blobs: blobs.blobs,\n rateLimiter: new AllowAllRateLimiter(),\n },\n blobContentProxy: blobs.contentProxy,\n };\n}\n","/**\n * The in-memory composition: core's reference stores plus cloud's, wired into\n * a working {@link ByokCloud}.\n *\n * This is what the handler suites and the client-side end-to-end test run\n * against, and it is the honest demonstration of the S3 claim — the daemon\n * cannot tell this from `@byok-sdk/server`, and nothing in the path needs a\n * database to prove it.\n */\nimport {\n createInMemoryCoreStores,\n type CapabilityDeclaration,\n type Clock,\n type CoreStores,\n type SkillPackStore,\n} from '@byok-sdk/core';\nimport { createHmacTokenSigner, type TokenSigner } from '../auth/tokens';\nimport { fullCapabilityDeclaration } from '../capabilities';\nimport { createWebCrypto } from '../crypto/web-crypto';\nimport type { CloudCrypto } from '../crypto/port';\nimport { createByokCloud, type ByokCloud } from '../cloud';\nimport { createInMemoryCloudStores } from '../stores/in-memory/index';\nimport type { BlobContentProxy, CloudStores } from '../stores/ports';\nimport type { TruthCommitter, TruthObjectDownloads } from '../truth/contract';\n\nconst TOKEN_SECRET_BYTES = 32;\n\n/**\n * Real time by default, deliberately.\n *\n * Core's in-memory reference defaults to a FROZEN clock so TTL conformance is\n * deterministic. A composition serving a real daemon cannot: the daemon\n * compares the `expiresAt` it is handed against its own wall clock and would\n * treat every token from a clock stuck in the past as already expired. A test\n * that needs deterministic TTLs injects a mutable clock here instead.\n */\nfunction systemClock(): Clock {\n return { now: () => new Date() };\n}\n\nexport interface InMemoryByokCloudOptions {\n readonly clock?: Clock;\n readonly crypto?: CloudCrypto;\n readonly tokenSigner?: TokenSigner;\n readonly capabilities?: CapabilityDeclaration;\n readonly operatorId?: string;\n readonly maxBlobSizeBytes?: number;\n readonly longPollHoldMs?: number;\n readonly longPollIntervalMs?: number;\n readonly eventsPageLimit?: number;\n readonly accessTokenTtlSeconds?: number;\n readonly boardPageLimit?: number;\n readonly boardStreamQueryIntervalMs?: number;\n readonly boardStreamHeartbeatIntervalMs?: number;\n readonly boardStreamReconciliationIntervalMs?: number;\n readonly boardChannelMaxBytes?: number;\n readonly boardTitleMaxBytes?: number;\n readonly presenceTtlMs?: number;\n readonly presenceMinimumIntervalMs?: number;\n readonly presenceDetailMaxBytes?: number;\n readonly activityMaxEvents?: number;\n readonly activityMaxBytes?: number;\n readonly activityCapacity?: number;\n readonly activityTtlMs?: number;\n /** Test/host supplied atomic truth authority; never synthesized from sequential stores. */\n readonly truthCommitter?: TruthCommitter;\n readonly truthObjectDownloads?: TruthObjectDownloads;\n readonly maxTruthRequestBytes?: number;\n /**\n * Host/test supplied skill pack catalogue. Absent by default, and\n * `fullCapabilityDeclaration()` withholds `skills.pack` to match — a\n * composition that declared a channel it has no store for would be refused at\n * construction, which would break every existing in-memory deployment.\n */\n readonly skillPacks?: SkillPackStore;\n readonly skillPackPageLimit?: number;\n}\n\nexport interface InMemoryByokCloud {\n readonly cloud: ByokCloud;\n /** The naked stores, for a host that wants to inspect or seed state directly. */\n readonly core: CoreStores;\n readonly stores: CloudStores;\n /** The byte proxy the two `/content` routes were mounted on. */\n readonly blobContentProxy: BlobContentProxy;\n readonly clock: Clock;\n readonly crypto: CloudCrypto;\n}\n\nexport function createInMemoryByokCloud(options: InMemoryByokCloudOptions = {}): InMemoryByokCloud {\n const clock = options.clock ?? systemClock();\n const crypto = options.crypto ?? createWebCrypto();\n const core = createInMemoryCoreStores({ clock }).stores;\n const { stores, blobContentProxy } = createInMemoryCloudStores(clock, crypto, core.objects);\n const tokenSigner =\n options.tokenSigner ??\n createHmacTokenSigner(globalThis.crypto.getRandomValues(new Uint8Array(TOKEN_SECRET_BYTES)), clock);\n\n const cloud = createByokCloud({\n core,\n cloud: stores,\n // This composition has nowhere else to put bytes, so it supplies the proxy\n // and `fullCapabilityDeclaration()` declares `blobs.contentproxy`. That\n // pairing is what keeps hosted-in-memory behavior identical to what it was\n // before the port narrowed.\n blobContentProxy,\n crypto,\n tokenSigner,\n clock,\n capabilities: options.capabilities ?? fullCapabilityDeclaration(),\n ...(options.truthCommitter === undefined ? {} : { truthCommitter: options.truthCommitter }),\n ...(options.truthObjectDownloads === undefined\n ? {}\n : { truthObjectDownloads: options.truthObjectDownloads }),\n ...(options.operatorId !== undefined ? { operatorId: options.operatorId } : {}),\n ...(options.maxBlobSizeBytes !== undefined ? { maxBlobSizeBytes: options.maxBlobSizeBytes } : {}),\n ...(options.longPollHoldMs !== undefined ? { longPollHoldMs: options.longPollHoldMs } : {}),\n ...(options.longPollIntervalMs !== undefined ? { longPollIntervalMs: options.longPollIntervalMs } : {}),\n ...(options.eventsPageLimit !== undefined ? { eventsPageLimit: options.eventsPageLimit } : {}),\n ...(options.accessTokenTtlSeconds !== undefined\n ? { accessTokenTtlSeconds: options.accessTokenTtlSeconds }\n : {}),\n ...(options.boardPageLimit === undefined ? {} : { boardPageLimit: options.boardPageLimit }),\n ...(options.boardStreamQueryIntervalMs === undefined\n ? {}\n : { boardStreamQueryIntervalMs: options.boardStreamQueryIntervalMs }),\n ...(options.boardStreamHeartbeatIntervalMs === undefined\n ? {}\n : { boardStreamHeartbeatIntervalMs: options.boardStreamHeartbeatIntervalMs }),\n ...(options.boardStreamReconciliationIntervalMs === undefined\n ? {}\n : { boardStreamReconciliationIntervalMs: options.boardStreamReconciliationIntervalMs }),\n ...(options.boardChannelMaxBytes === undefined\n ? {}\n : { boardChannelMaxBytes: options.boardChannelMaxBytes }),\n ...(options.boardTitleMaxBytes === undefined\n ? {}\n : { boardTitleMaxBytes: options.boardTitleMaxBytes }),\n ...(options.presenceTtlMs === undefined ? {} : { presenceTtlMs: options.presenceTtlMs }),\n ...(options.presenceMinimumIntervalMs === undefined\n ? {}\n : { presenceMinimumIntervalMs: options.presenceMinimumIntervalMs }),\n ...(options.presenceDetailMaxBytes === undefined\n ? {}\n : { presenceDetailMaxBytes: options.presenceDetailMaxBytes }),\n ...(options.activityMaxEvents === undefined ? {} : { activityMaxEvents: options.activityMaxEvents }),\n ...(options.activityMaxBytes === undefined ? {} : { activityMaxBytes: options.activityMaxBytes }),\n ...(options.activityCapacity === undefined ? {} : { activityCapacity: options.activityCapacity }),\n ...(options.activityTtlMs === undefined ? {} : { activityTtlMs: options.activityTtlMs }),\n ...(options.maxTruthRequestBytes === undefined\n ? {}\n : { maxTruthRequestBytes: options.maxTruthRequestBytes }),\n ...(options.skillPacks === undefined ? {} : { skillPacks: options.skillPacks }),\n ...(options.skillPackPageLimit === undefined\n ? {}\n : { skillPackPageLimit: options.skillPackPageLimit }),\n });\n\n return { cloud, core, stores, blobContentProxy, clock, crypto };\n}\n","import {\n authenticateDeviceAssertion,\n type AuthenticatedDeviceAssertion,\n type Clock,\n type DeviceAssertionExpectedBinding,\n type DeviceAssertionReplayAuthority,\n} from '@byok-sdk/core';\nimport type { CloudCrypto } from '../crypto/port';\nimport type { DeviceDirectory } from '../stores/ports';\n\nexport interface HostedDeviceAssertionAuthDeps {\n readonly devices: DeviceDirectory;\n readonly crypto: CloudCrypto;\n readonly replay: DeviceAssertionReplayAuthority;\n readonly clock: Clock;\n readonly expected: DeviceAssertionExpectedBinding;\n readonly maxLifetimeMs?: number;\n}\n\n/**\n * Hosted composition for an assertion exchange endpoint. The returned\n * principal is current device-directory authority; the assertion is consumed\n * before success is returned. Connector sessions minted afterward remain\n * host-owned and are never represented by this short-lived credential.\n */\nexport function authenticateHostedDeviceAssertion(\n input: unknown,\n deps: HostedDeviceAssertionAuthDeps,\n): Promise<AuthenticatedDeviceAssertion | undefined> {\n return authenticateDeviceAssertion(input, {\n verifier: {\n verify: ({ publicKey, signingInput, signature }) =>\n deps.crypto.verifyEd25519(publicKey, signingInput, signature),\n },\n lookupDevice: async (deviceId) => {\n const row = await deps.devices.resolveByDeviceId(deviceId);\n if (row === undefined) return undefined;\n return {\n tenantId: row.tenantId,\n productId: row.productId,\n deviceId: row.deviceId,\n publicKeyJwkX: row.devicePublicKey,\n revoked: row.revoked,\n };\n },\n replay: deps.replay,\n expected: deps.expected,\n now: deps.clock.now(),\n ...(deps.maxLifetimeMs === undefined ? {} : { maxLifetimeMs: deps.maxLifetimeMs }),\n });\n}\n","import {\n BOARD_STATUSES,\n assertCapability,\n hasCapability,\n type CapabilityDeclaration,\n} from '@byok-sdk/core';\nimport { BYOK_BOARD_PATH, BYOK_BOARD_STREAM_PATH } from '@byok-sdk/protocol';\nimport { z } from 'zod';\nimport { CLOUD_CAPABILITIES } from './capabilities';\n\nconst BoardFeedItemSchema = z.object({\n tenantId: z.string(),\n itemId: z.string(),\n channel: z.string(),\n title: z.string(),\n status: z.enum(BOARD_STATUSES),\n assignee: z\n .object({ holderId: z.string(), heldSince: z.string() })\n .optional(),\n boardSeq: z.number().int().nonnegative(),\n createdAt: z.string(),\n updatedAt: z.string(),\n});\n\nconst BoardFeedPageSchema = z.object({\n items: z.array(BoardFeedItemSchema),\n nextSeq: z.number().int().nonnegative(),\n hasMore: z.boolean(),\n});\n\nexport type BoardFeedItem = z.infer<typeof BoardFeedItemSchema>;\nexport type BoardFeedPage = z.infer<typeof BoardFeedPageSchema>;\nexport type BoardFeedMode = 'sse' | 'poll';\nexport type BoardFeedRead =\n | { readonly type: 'board'; readonly item: BoardFeedItem }\n | { readonly type: 'reconcile' }\n | { readonly type: 'poll'; readonly page: BoardFeedPage };\n\nexport class BoardFeedRetryableError extends Error {\n constructor(message: string, options?: ErrorOptions) {\n super(message, options);\n this.name = 'BoardFeedRetryableError';\n }\n}\n\nexport class BoardFeedStoppedError extends Error {\n constructor(message: string) {\n super(message);\n this.name = 'BoardFeedStoppedError';\n }\n}\n\nexport interface BoardFeedClientOptions {\n readonly baseUrl: string | URL;\n readonly accessToken: string;\n readonly capabilities: CapabilityDeclaration;\n readonly fetch?: typeof globalThis.fetch;\n readonly idleWatchdogMs?: number;\n}\n\n/**\n * One board feed consumer with a declaration-fixed transport.\n *\n * The mode is selected once from ADR-010 data. A temporary SSE 5xx or idle\n * watchdog expiry raises {@link BoardFeedRetryableError}; it never mutates the\n * mode to polling. A caller retries the same instance and therefore the same\n * declared transport. Polling exists only when `board.sse` was absent from the\n * declaration in the first place.\n */\nexport class BoardFeedClient {\n readonly mode: BoardFeedMode;\n readonly #base: URL;\n readonly #accessToken: string;\n readonly #fetch: typeof globalThis.fetch;\n readonly #idleWatchdogMs: number;\n\n constructor(options: BoardFeedClientOptions) {\n assertCapability(options.capabilities, CLOUD_CAPABILITIES.boardCoordination);\n this.mode = hasCapability(options.capabilities, CLOUD_CAPABILITIES.boardSse) ? 'sse' : 'poll';\n this.#base = new URL(options.baseUrl);\n this.#accessToken = options.accessToken;\n this.#fetch = options.fetch ?? globalThis.fetch;\n this.#idleWatchdogMs = options.idleWatchdogMs ?? 30_000;\n }\n\n async readOnce(afterSeq: number, signal?: AbortSignal): Promise<BoardFeedRead> {\n if (!Number.isSafeInteger(afterSeq) || afterSeq < 0) {\n throw new TypeError('afterSeq must be a non-negative safe integer.');\n }\n return this.mode === 'sse'\n ? this.#readSseOnce(afterSeq, signal)\n : this.#readPollOnce(afterSeq, signal);\n }\n\n async #readPollOnce(afterSeq: number, signal?: AbortSignal): Promise<BoardFeedRead> {\n const url = new URL(BYOK_BOARD_PATH, this.#base);\n url.searchParams.set('since', String(afterSeq));\n const response = await this.#fetch(url, {\n headers: { authorization: `Bearer ${this.#accessToken}` },\n ...(signal === undefined ? {} : { signal }),\n });\n assertBoardResponse(response, 'poll');\n return { type: 'poll', page: BoardFeedPageSchema.parse(await response.json()) };\n }\n\n async #readSseOnce(afterSeq: number, signal?: AbortSignal): Promise<BoardFeedRead> {\n const url = new URL(BYOK_BOARD_STREAM_PATH, this.#base);\n const response = await this.#fetch(url, {\n headers: {\n accept: 'text/event-stream',\n authorization: `Bearer ${this.#accessToken}`,\n 'last-event-id': String(afterSeq),\n },\n ...(signal === undefined ? {} : { signal }),\n });\n assertBoardResponse(response, 'SSE');\n if (response.body === null) throw new BoardFeedRetryableError('Board SSE response had no body.');\n\n const reader = response.body.getReader();\n const decoder = new TextDecoder();\n let buffer = '';\n try {\n while (true) {\n const chunk = await readWithWatchdog(reader, this.#idleWatchdogMs);\n if (chunk.done) throw new BoardFeedRetryableError('Board SSE ended before the next event.');\n buffer += decoder.decode(chunk.value, { stream: true }).replaceAll('\\r\\n', '\\n');\n let boundary = buffer.indexOf('\\n\\n');\n while (boundary >= 0) {\n const frame = buffer.slice(0, boundary);\n buffer = buffer.slice(boundary + 2);\n const parsed = parseSseFrame(frame);\n if (parsed !== undefined) return parsed;\n boundary = buffer.indexOf('\\n\\n');\n }\n }\n } finally {\n await reader.cancel().catch(() => undefined);\n }\n }\n}\n\nfunction assertBoardResponse(response: Response, transport: 'poll' | 'SSE'): void {\n if (response.status === 401) {\n throw new BoardFeedStoppedError('Board credential is no longer valid.');\n }\n if (response.ok) return;\n if (response.status >= 500) {\n throw new BoardFeedRetryableError(`Board ${transport} failed with HTTP ${response.status}.`);\n }\n throw new BoardFeedStoppedError(\n `Board ${transport} failed permanently with HTTP ${response.status}.`,\n );\n}\n\nasync function readWithWatchdog(\n reader: ReadableStreamDefaultReader<Uint8Array>,\n timeoutMs: number,\n) {\n let timer: ReturnType<typeof setTimeout> | undefined;\n try {\n return await Promise.race([\n reader.read(),\n new Promise<never>((_, reject) => {\n timer = setTimeout(\n () => reject(new BoardFeedRetryableError('Board SSE idle watchdog expired.')),\n timeoutMs,\n );\n }),\n ]);\n } finally {\n if (timer !== undefined) clearTimeout(timer);\n }\n}\n\nfunction parseSseFrame(frame: string): BoardFeedRead | undefined {\n if (frame.length === 0 || frame.startsWith(':')) return undefined;\n let event = 'message';\n const data: string[] = [];\n for (const line of frame.split('\\n')) {\n if (line.startsWith('event:')) event = line.slice('event:'.length).trimStart();\n if (line.startsWith('data:')) data.push(line.slice('data:'.length).trimStart());\n }\n if (event === 'reconcile') return { type: 'reconcile' };\n if (event !== 'board') return undefined;\n if (data.length === 0) throw new SyntaxError('Board SSE board event had no data.');\n return { type: 'board', item: BoardFeedItemSchema.parse(JSON.parse(data.join('\\n'))) };\n}\n","/**\n * The cloud-local store ports.\n *\n * `@byok-sdk/core` owns the platform ports every composition shares (mailbox,\n * board, truth, objects, quota). These are the ones only a HOSTED device\n * surface needs — the auth plane and the task-attempt bookkeeping the device\n * routes read. S2 deliberately kept them out of core: they are hosted-surface\n * concerns, and S4A's schema work is the right moment to decide their durable\n * home. Cloud owning them keeps this slice additive and revertible.\n *\n * Two rules, same as core's (`stores.ts`):\n *\n * 1. **Async.** Every method returns a `Promise`, so a SQL or KV composition\n * can implement the same contract the in-memory reference does.\n * 2. **Tenant-first.** Every method's first parameter is a required\n * `TenantId` — with exactly two documented exceptions below, each of\n * which is pre-tenant *by construction* because the credential it is\n * handed is itself what resolves the tenant.\n *\n * The two exceptions:\n *\n * - {@link DeviceDirectory.resolveByDeviceId} — `POST /byok/challenge` and\n * `POST /byok/token` carry only a deviceId (the pinned wire contract), and\n * the row is what tells the deployment which tenant to mint for.\n * - {@link PairingCodeStore.redeem} — the code IS the tenant lookup; it was\n * minted against a tenant that only the host's control plane knew.\n *\n * Neither is reachable through {@link TenantStores} (see `tenant-stores.ts`),\n * so a device-facing handler cannot call them.\n *\n * The byte-proxy trio that used to be a third pre-tenant exception is no\n * longer part of this bundle at all: it moved to {@link BlobContentProxy},\n * an OPTIONAL composition input rather than a {@link CloudStores} member,\n * because a composition backed by object storage physically cannot proxy\n * bytes (see the blobs section below).\n */\nimport type { StorageReservation, TenantId } from '@byok-sdk/core';\nimport type { ActivityStore } from '../activity';\nimport type { ApprovalTimelineStore } from '../approval-timeline';\n\n// ---------------------------------------------------------------------------\n// Device directory (S1's `DeviceRegistry`, tenant-first)\n// ---------------------------------------------------------------------------\n\nexport interface DeviceRecord {\n readonly tenantId: TenantId;\n readonly productId: string;\n readonly deviceId: string;\n readonly deviceName: string;\n /** Ed25519 public key, base64url-encoded (JWK `x` form). */\n readonly devicePublicKey: string;\n /** Proof key identity stored on the row; verifier claims never supply a default. */\n readonly proofKeyId: string;\n /** Current proof signing-key rotation generation. */\n readonly proofKeyEpoch: number;\n readonly revoked: boolean;\n}\n\n/** Everything `POST /byok/pair` knows at registration time. `tenantId` is the store's first parameter; `revoked` is the store's own to set. */\nexport interface DeviceRegistration {\n readonly productId: string;\n readonly deviceId: string;\n readonly deviceName: string;\n readonly devicePublicKey: string;\n readonly proofKeyId: string;\n readonly proofKeyEpoch: number;\n}\n\nexport interface DeviceDirectory {\n register(tenant: TenantId, input: DeviceRegistration): Promise<DeviceRecord>;\n /** The row `tenant` owns under `deviceId` — `undefined` including when the device exists under a DIFFERENT tenant. */\n get(tenant: TenantId, deviceId: string): Promise<DeviceRecord | undefined>;\n revoke(tenant: TenantId, deviceId: string): Promise<void>;\n list(tenant: TenantId): Promise<readonly DeviceRecord[]>;\n /** Pre-tenant. Two callers only: `POST /byok/challenge` and `POST /byok/token`. Never exposed through the tenant facade. */\n resolveByDeviceId(deviceId: string): Promise<DeviceRecord | undefined>;\n}\n\n// ---------------------------------------------------------------------------\n// Pairing codes (S1's `PairingManager`, tenant-first mint)\n// ---------------------------------------------------------------------------\n\n/**\n * The identity a pairing code carries. Minted out-of-band by the host's own\n * auth/device-flow UI — the only party that knows which tenant a human is\n * acting for. Deliberately NOT a wire field: `PairRequest` has no tenant of\n * its own, so a device can never name the tenant it lands in.\n */\nexport interface PairingCodeClaims {\n readonly tenantId: TenantId;\n readonly productId: string;\n}\n\nexport interface PairingCodeInfo {\n readonly code: string;\n /** Canonical ISO-8601 UTC instant. */\n readonly expiresAt: string;\n}\n\nexport interface PairingCodeIssueInput {\n readonly code: string;\n readonly productId: string;\n readonly expiresAt: string;\n}\n\nexport interface PairingCodeStore {\n issue(tenant: TenantId, input: PairingCodeIssueInput): Promise<PairingCodeInfo>;\n /**\n * Validate and CONSUME a code, returning the claims it was minted with, or\n * `undefined` when it is unknown, expired, or already used — one answer for\n * all three, so a redeem attempt is never an existence oracle. Single-use is\n * what makes the caller's \"redeem, then register the device row\" sequence\n * exclusive: a second redeem can never reach the registration step.\n */\n redeem(code: string): Promise<PairingCodeClaims | undefined>;\n}\n\n// ---------------------------------------------------------------------------\n// Challenge nonces\n// ---------------------------------------------------------------------------\n\nexport interface NonceStore {\n issue(tenant: TenantId, deviceId: string): Promise<string>;\n /** `true` iff the nonce exists for this (tenant, device), is unexpired, and has not been consumed. Never mutates. */\n validate(tenant: TenantId, deviceId: string, nonce: string): Promise<boolean>;\n /** Consume the nonce. Called only after every other check on the request has passed. */\n markUsed(tenant: TenantId, nonce: string): Promise<void>;\n}\n\n// ---------------------------------------------------------------------------\n// Inbound envelope dedup (N3)\n// ---------------------------------------------------------------------------\n\nexport interface InboundDedupStore {\n /**\n * `true` when `envelopeId` was already seen for this (tenant, device);\n * otherwise records it and returns `false`. Bounded per device — the wire is\n * at-least-once (§9); this makes processing at-most-once without an\n * unbounded set.\n */\n checkAndRecord(tenant: TenantId, deviceId: string, envelopeId: string): Promise<boolean>;\n}\n\n// ---------------------------------------------------------------------------\n// Task attempts — the ownership authority the inbound gate reads (N2)\n// ---------------------------------------------------------------------------\n\nexport const TASK_ATTEMPT_STATUSES = [\n 'offered',\n 'claimed',\n 'running',\n 'complete',\n 'failed',\n 'cancelled',\n] as const;\nexport type TaskAttemptStatus = (typeof TASK_ATTEMPT_STATUSES)[number];\n\nexport interface TaskAttempt {\n readonly tenantId: TenantId;\n readonly taskId: string;\n /** The device the offer was addressed to. */\n readonly deviceId: string;\n /** Set by `task.claim`, and only by the first one. Until then the task has no owner and the gate lets any of this tenant's devices through, matching the reference server. */\n readonly ownerDeviceId?: string;\n readonly status: TaskAttemptStatus;\n readonly updatedAt: string;\n}\n\nexport interface TaskAttemptStore {\n /** Called when an offer is enqueued: records the pending attempt with no owner yet. */\n open(tenant: TenantId, input: { readonly taskId: string; readonly deviceId: string }): Promise<TaskAttempt>;\n get(tenant: TenantId, taskId: string): Promise<TaskAttempt | undefined>;\n /** First claim wins the ownership; a later claim by the same device is idempotent. No-op (returns `undefined`) for a task this tenant never offered. */\n claim(tenant: TenantId, input: { readonly taskId: string; readonly deviceId: string }): Promise<TaskAttempt | undefined>;\n /** Record a lifecycle transition. No-op (returns `undefined`) for an unknown task — same shape as the reference server's per-type handlers. */\n recordStatus(\n tenant: TenantId,\n input: { readonly taskId: string; readonly status: TaskAttemptStatus },\n ): Promise<TaskAttempt | undefined>;\n}\n\n// ---------------------------------------------------------------------------\n// Request receipts — the terminal idempotency seam\n// ---------------------------------------------------------------------------\n\nexport interface RequestReceipt {\n readonly tenantId: TenantId;\n readonly key: string;\n /** Opaque payload the caller recorded — for terminals, the encoded envelope. */\n readonly body: string;\n readonly recordedAt: string;\n}\n\nexport interface RequestReceiptStore {\n /**\n * Record a receipt under `key`, or return the existing one untouched.\n * `created` is `false` for a replay — the FIRST terminal is the fact\n * (§12.6.4: 不覆写第一份事实), and a retry of the same terminal must not\n * overwrite it.\n */\n record(\n tenant: TenantId,\n input: { readonly key: string; readonly body: string },\n ): Promise<{ readonly receipt: RequestReceipt; readonly created: boolean }>;\n get(tenant: TenantId, key: string): Promise<RequestReceipt | undefined>;\n}\n\n// ---------------------------------------------------------------------------\n// Device-proof request receipts — request-bound replay authority (S6)\n// ---------------------------------------------------------------------------\n\nexport interface ProofRequestReceipt {\n readonly tenantId: TenantId;\n readonly deviceId: string;\n readonly requestId: string;\n readonly operation: string;\n readonly resource: string;\n readonly bodySha256: string;\n readonly bodySize: bigint;\n readonly responseStatus: number;\n readonly responseBody: string;\n readonly recordedAt: string;\n}\n\nexport type ProofRequestReceiptInput = Omit<\n ProofRequestReceipt,\n 'tenantId' | 'recordedAt'\n>;\n\n/**\n * First-result-wins replay store. The application layer compares every stored\n * binding before returning an exact replay; a reused request id with any\n * different binding is a conflict, never a second write.\n */\nexport interface ProofRequestReceiptStore {\n record(\n tenant: TenantId,\n input: ProofRequestReceiptInput,\n ): Promise<{ readonly receipt: ProofRequestReceipt; readonly created: boolean }>;\n get(\n tenant: TenantId,\n deviceId: string,\n requestId: string,\n ): Promise<ProofRequestReceipt | undefined>;\n}\n\n// ---------------------------------------------------------------------------\n// Blobs (§7)\n// ---------------------------------------------------------------------------\n\nexport interface BlobDeclaration {\n readonly size: number;\n readonly contentType: string;\n /** Canonical `sha256:<64 lowercase hex>` — the schema rejected anything else before this store sees it. */\n readonly contentHash: string;\n}\n\n/** What object-store metadata can actually observe at finalize (ADR-024). */\nexport interface BlobObservation {\n readonly observedByteSize: bigint;\n readonly observedContentType: string;\n}\n\nexport type BlobWriteResult = { readonly ok: true } | { readonly ok: false; readonly reason: string };\n\nexport interface BlobContent {\n readonly data: Uint8Array;\n readonly contentType: string;\n}\n\n/**\n * The capability-minting half of blobs: what EVERY composition can honestly\n * provide, whoever holds the bytes.\n *\n * Both methods are tenant-first, and both are reachable through {@link\n * TenantStores}. There is no pre-tenant method left on this port — see\n * {@link BlobContentProxy} for where the other three went and why.\n */\nexport interface CloudBlobStore {\n /** Mint only from an already-admitted object reservation. */\n createUpload(tenant: TenantId, reservation: StorageReservation): Promise<{ readonly blobId: string; readonly uploadUrl: string }>;\n /** Observe existence/size/type while proving this blob belongs to this reservation. */\n observeUpload(tenant: TenantId, blobId: string, reservation: StorageReservation): Promise<BlobObservation | undefined>;\n /** A presigned GET URL for a blob THIS tenant owns that has finished uploading; `undefined` otherwise — including for another tenant's blob. */\n getDownloadUrl(tenant: TenantId, blobId: string): Promise<string | undefined>;\n}\n\n/**\n * The byte-proxying half: an OPTIONAL composition input, not a port.\n *\n * These three serve the two `/byok/blobs/:id/content` routes, which exist\n * because the in-memory and self-hosted compositions have nowhere else to put\n * bytes — cloud has to carry them. A composition whose bytes live in object\n * storage (S3/R2) hands the device a presigned URL to the object store itself\n * and never sees a byte, so it cannot implement these at all.\n *\n * That is why this is a separate interface supplied at composition time rather\n * than a member of {@link CloudStores}: \"this deployment cannot proxy bytes\"\n * becomes a type-level fact (the proxy is simply absent) instead of three\n * methods that throw. The alternatives were both anti-patterns — a conformance\n * suite that skips three methods for one composition is a subset waiver, and\n * one that asserts a typed rejection proves nothing\n * (docs/researches/s4a-dataplane-design.md §6).\n *\n * All three are pre-tenant by construction: the `/content` routes are\n * presigned, not bearer-authed, so there is no principal in scope at all and\n * the HMAC signature over the blob id is the whole credential. They stay off\n * {@link TenantStores} for the same reason the two exceptions above do.\n *\n * A deployment supplying a proxy must also declare `blobs.contentproxy`\n * (ADR-010): the routes mount on proxy-presence AND declaration, never on\n * either alone.\n */\nexport interface BlobContentProxy {\n verifySignedUrl(blobId: string, action: 'put' | 'get', sig: string, exp: number): Promise<boolean>;\n writeContent(blobId: string, data: Uint8Array): Promise<BlobWriteResult>;\n readContent(blobId: string): Promise<BlobContent | undefined>;\n}\n\n// ---------------------------------------------------------------------------\n// Inbound rate limiting (M4 Phase 4 part A's seam)\n// ---------------------------------------------------------------------------\n\n/**\n * Step 0 of the inbound gate. S3a ships an allow-all reference (a hosted\n * deployment's real limiter is edge/infra work, not handler work) — what\n * matters now is that the SEAM sits at gate position 0, before the type-allow\n * check, so a flood of garbage-typed envelopes costs the same budget as a\n * flood of well-formed ones once a real limiter is plugged in.\n */\nexport interface InboundRateLimiter {\n consume(tenant: TenantId, deviceId: string): Promise<boolean>;\n}\n\n// ---------------------------------------------------------------------------\n// The bundle a composition supplies\n// ---------------------------------------------------------------------------\n\n/**\n * All-or-nothing: a composition supplies every port here or it is not a\n * composition. {@link BlobContentProxy} is deliberately absent — it is an\n * optional input to `createByokCloud`, not a port, precisely so that the\n * bundle can stay all-or-nothing while byte proxying stays optional.\n */\nexport interface CloudStores {\n readonly activity: ActivityStore;\n readonly approvals: ApprovalTimelineStore;\n readonly devices: DeviceDirectory;\n readonly pairingCodes: PairingCodeStore;\n readonly nonces: NonceStore;\n readonly dedup: InboundDedupStore;\n readonly tasks: TaskAttemptStore;\n readonly receipts: RequestReceiptStore;\n readonly proofReceipts: ProofRequestReceiptStore;\n readonly blobs: CloudBlobStore;\n readonly rateLimiter: InboundRateLimiter;\n}\n\n/** Names of every port in {@link CloudStores}, in contract order. */\nexport const CLOUD_STORE_NAMES = [\n 'activity',\n 'approvals',\n 'devices',\n 'pairingCodes',\n 'nonces',\n 'dedup',\n 'tasks',\n 'receipts',\n 'proofReceipts',\n 'blobs',\n 'rateLimiter',\n] as const;\n\nexport type CloudStoreName = (typeof CLOUD_STORE_NAMES)[number];\n","/**\n * The declared method inventory of every cloud-local port.\n *\n * The exact counterpart of `@byok-sdk/core`'s `ports-contract.ts`, and it exists\n * for the same reason: the table says what a port IS, so it has to be readable\n * by every enforcer without any of them owning it. `@byok-sdk/conformance` asserts\n * live compositions against it; a durable adapter (`@byok-sdk/cloud-dataplane`) is\n * written against it.\n *\n * This module adds data and nothing else. It does not re-declare, re-shape, or\n * re-interpret a single line of `ports.ts` — that file stays the authority for\n * what the methods mean, and stayed byte-identical through S4A-a.\n *\n * Adding a port method means editing this table, which is the point: a port\n * grows by contract, not by whichever composition needed something.\n */\nimport type { CloudStoreName } from './ports';\n\nexport const CLOUD_PORT_METHODS: Readonly<Record<CloudStoreName, readonly string[]>> = {\n activity: ['append', 'read'],\n approvals: ['append', 'read'],\n devices: ['register', 'get', 'revoke', 'list', 'resolveByDeviceId'],\n pairingCodes: ['issue', 'redeem'],\n nonces: ['issue', 'validate', 'markUsed'],\n dedup: ['checkAndRecord'],\n tasks: ['open', 'get', 'claim', 'recordStatus'],\n receipts: ['record', 'get'],\n proofReceipts: ['record', 'get'],\n // Three methods, not six: the byte-proxy trio moved to `BlobContentProxy`,\n // which is a composition input rather than a port and therefore has no row\n // in this table (docs/researches/s4a-dataplane-design.md §6).\n blobs: ['createUpload', 'observeUpload', 'getDownloadUrl'],\n rateLimiter: ['consume'],\n};\n\n/** The interface each port name is declared as, for a source-side scan. */\nexport const CLOUD_PORT_INTERFACES: Readonly<Record<CloudStoreName, string>> = {\n activity: 'ActivityStore',\n approvals: 'ApprovalTimelineStore',\n devices: 'DeviceDirectory',\n pairingCodes: 'PairingCodeStore',\n nonces: 'NonceStore',\n dedup: 'InboundDedupStore',\n tasks: 'TaskAttemptStore',\n receipts: 'RequestReceiptStore',\n proofReceipts: 'ProofRequestReceiptStore',\n blobs: 'CloudBlobStore',\n rateLimiter: 'InboundRateLimiter',\n};\n"]}