@chitmark/sdk 0.2.0 → 0.5.0

package/README.md

@@ -1,9 +1,13 @@
 # @chitmark/sdk
 
-Official TypeScript / JavaScript SDK for Chitmark — trust decisions on agent-mediated actions, tuned by business outcomes (`verify` / `feedback` / `challenge`).
+Official TypeScript / JavaScript SDK for Chitmark: trust decisions on agent-mediated actions, tuned by business outcomes.
+
+AI agents and multi-account farms drain free tiers, trial credits, and API allowances while looking exactly like your best customers. Chitmark scores each action in under 50 ms and returns `allow`, `challenge`, or `deny`: cheap for one real human, expensive at farm scale. Then your outcomes (conversion, credit burn, chargeback) come back through `feedback` and tune the next decision.
 
 [![npm version](https://img.shields.io/npm/v/@chitmark/sdk.svg)](https://www.npmjs.com/package/@chitmark/sdk)
 
+Try it without a key: [run the playground](https://chitmark.com/playground). Live service health: [chitmark.com/status](https://chitmark.com/status).
+
 ## Install
 
 ```bash
@@ -12,7 +16,7 @@ npm install @chitmark/sdk
 pnpm add @chitmark/sdk
 ```
 
-Requires Node ≥ 24.
+Requires Node >= 24. Runs on Node, browsers, Cloudflare Workers, and other edge runtimes (see the `/edge` entrypoint below).
 
 ## Quick start
 
@@ -21,10 +25,10 @@ import { Chitmark } from "@chitmark/sdk";
 
 const chitmark = new Chitmark({
   apiKey: process.env.CHITMARK_API_KEY!,
-  // Optional — defaults shown
-  onDegraded: "challenge", // NEVER 'allow'
+  // Optional, defaults shown
+  onDegraded: "challenge", // NEVER 'allow': timeouts degrade to challenge
   timeoutMs: 800,
-  piiMode: "hashed", // 'raw' | 'hashed' | 'none'
+  piiMode: "hashed", // 'hashed' | 'none' | 'raw'
   env: "production",
 });
 
@@ -33,19 +37,20 @@ const verdict = await chitmark.verify({
   session: "sess_9f3a",
   surface: "app.acme.com/signup",
   subject: {
-    email: "buyer@acmecorp.com",
-    ip: "203.0.113.7",
+    email: "buyer@acmecorp.com", // hashed client-side before the wire
+    ip: "203.0.113.7", // truncated to /24 client-side
     userAgent: req.headers["user-agent"],
     headers: req.headers,
   },
 });
 
-// Persist verdict.eventId on the account row — feedback joins only on that id.
+if (verdict.decision === "challenge") {
+  // stop and run the challenge flow (below)
+}
+// Persist verdict.eventId on the account row: feedback joins only on that id.
 ```
 
-## API
-
-Three verbs:
+## The three verbs
 
 | Verb          | Method                 | Endpoint             | When                         |
 | :------------ | :--------------------- | :------------------- | :--------------------------- |
@@ -53,51 +58,113 @@ Three verbs:
 | **feedback**  | `chitmark.feedback()`  | `POST /v1/feedback`  | After an outcome is known    |
 | **challenge** | `chitmark.challenge()` | `POST /v1/challenge` | On `challenge` or `degraded` |
 
-**Golden rule:** fail to `challenge`, never to `allow`. Timeouts return a degraded challenge verdict.
+**Golden rule:** fail to `challenge`, never to `allow`. Timeouts and transport errors return a degraded challenge verdict (never allow, never a thrown error on `verify`); HTTP errors throw `ChitmarkApiError` with the status attached.
 
-### Feedback
+### Feedback: the data moat
+
+Attribution is a schema contract, not a fuzzy match. Store the `eventId` from verify on the account row, then report what happened against that same id. Outcomes tune your future decisions: no detector in a stack does that.
 
 ```typescript
+// At signup: persist the join key
+db.accounts.update(userId, { chitmarkEventId: verdict.eventId });
+
+// Later, when a label matures:
 await chitmark.feedback({
-  eventId: verdict.eventId, // stored at signup
-  outcome: "credit_burn", // outcomes label scoring
-  value: 87.4,
-  unit: "usd",
+  eventId: account.chitmarkEventId, // the stored join key: never guessed
+  outcome: "credit_burn", // converted | chargeback | abuse_confirmed | ...
+  value: 87.4, // dollar amount: `unit` rides along (default "usd")
+  observedAt: "2026-08-06T04:00:00Z",
 });
 ```
 
-### PII
+Exact duplicate feedback bodies derive the same warehouse id, so retrying a connector never double-counts a burned value.
+
+### Challenges: friction priced per action
+
+When verify returns `challenge`, issue one, solve it on the client, and complete it. Proof-of-work difficulty is server-issued (4 by default, up to 6 at higher risk tiers): about 65k hashes, milliseconds for one human's browser, real money at farm scale.
+
+```typescript
+import { createHash } from "node:crypto";
+
+const issued = await chitmark.challenge({
+  eventId: verdict.eventId,
+  session: "sess_9f3a", // the challenge binds to this session
+});
+
+if (issued.instructions.type === "pow") {
+  const { challengeId, instructions } = issued;
+  const prefix = "0".repeat(instructions.difficulty);
+  let nonce = 0;
+  for (; ; nonce++) {
+    const hex = createHash("sha256")
+      .update(`${challengeId}:${instructions.seed}:${nonce}`)
+      .digest("hex");
+    if (hex.startsWith(prefix)) break;
+  }
+  await chitmark.completeChallenge({
+    eventId: verdict.eventId,
+    challengeId,
+    session: "sess_9f3a",
+    proof: { type: "proof_of_work", nonce: String(nonce) },
+  });
+  // Re-verify with context: { challengeId } so the next verdict honors it.
+}
+```
+
+### Signed verdict receipts
+
+Every production verdict ships a `verdictToken`: an ES256 JWT bound to session, origin, and event. Verify it before acting on high-value decisions:
+
+```typescript
+const claims = await chitmark.verifyVerdictToken(verdict.verdictToken, {
+  session: "sess_9f3a", // enforce session binding (recommended)
+  aud: "api.chitmark.com", // enforce origin binding
+});
+// claims: { eventId, decision, actorType, confidence, jti, exp, ... }
+```
+
+Rejects expired tokens, unknown keys, bad signatures, and session or origin mismatches with typed `VerdictTokenError` codes.
+
+### PII modes
 
 | Mode               | Behavior                                                   |
 | :----------------- | :--------------------------------------------------------- |
-| `hashed` (default) | SHA-256 email, /24 IP truncation, minimized form fields    |
+| `hashed` (default) | SHA-256 email, /24 IP truncation, allowlisted form fields  |
 | `none`             | Derived/header-shape signals only (Web Bot Auth preserved) |
 | `raw`              | Tenant opt-in only; triggers higher compliance review      |
 
-## Cloudflare Workers
+## Framework integrations
+
+Express middleware and a Next.js route helper ship in the package:
 
 ```typescript
-import { Chitmark } from "@chitmark/sdk/edge";
+// Express: 403 on deny, 428 + challenge payload on challenge
+import { chitmarkGate } from "@chitmark/sdk";
+app.post("/signup", chitmarkGate(chitmark, "signup"), signupHandler);
 
-const chitmark = new Chitmark({ apiKey: env.CHITMARK_API_KEY });
-const verdict = await chitmark.verifyRequest(req, { action: "signup" });
+// Next.js App Router
+import { verifyNextRequest } from "@chitmark/sdk";
+const verdict = await verifyNextRequest(req, chitmark, { action: "signup" });
 ```
 
-## Express middleware
+## Cloudflare Workers
+
+The `/edge` entrypoint is the same client with a request-first helper:
 
 ```typescript
-import { Chitmark, chitmarkGate } from "@chitmark/sdk";
+import { Chitmark } from "@chitmark/sdk/edge";
 
-const chitmark = new Chitmark({ apiKey: process.env.CHITMARK_API_KEY! });
-app.post("/signup", chitmarkGate(chitmark, "signup"), signupHandler);
+const chitmark = new Chitmark({ apiKey: env.CHITMARK_API_KEY });
+const verdict = await chitmark.verifyRequest(req, { action: "signup" });
 ```
 
 ## Resources
 
 - [API reference](https://chitmark.com/docs)
+- [Quickstart](https://chitmark.com/docs/quickstart)
 - [OpenAPI contract](https://chitmark.com/openapi.yaml)
 - [GitHub](https://github.com/nonameuserd/Chitmark)
 
 ## License
 
-Proprietary — see [LICENSE](LICENSE).
+Proprietary: see [LICENSE](LICENSE).

package/dist/edge.cjs

@@ -61,7 +61,7 @@ var DEFAULT_BASE_URLS = {
   development: "http://127.0.0.1:8787"
 };
 var DEFAULT_TIMEOUT_MS = 800;
-var SDK_VERSION = "0.1.0";
+var SDK_VERSION = "0.5.0";
 function resolveBaseUrl(env = "production", baseUrl) {
   return (baseUrl ?? DEFAULT_BASE_URLS[env]).replace(/\/$/, "");
 }
@@ -156,7 +156,7 @@ async function prepareSubject(subject, piiMode) {
 }
 function pickWebBotAuthHeaders(headers) {
   if (!headers) return void 0;
-  const keys = ["signature-agent", "signature-input", "signature", "signature-agent"];
+  const keys = ["signature-agent", "signature-input", "signature"];
   const out = {};
   for (const [k, v] of Object.entries(headers)) {
     const lower = k.toLowerCase();
@@ -332,7 +332,7 @@ var Chitmark = class {
     }
     if (options.onDegraded && options.onDegraded !== "challenge") {
       throw new ChitmarkError(
-        'onDegraded must be "challenge" \u2014 fail to challenge, never to allow'
+        'onDegraded must be "challenge": fail to challenge, never to allow'
       );
     }
     this.apiKey = options.apiKey;
@@ -346,7 +346,7 @@ var Chitmark = class {
   /**
    * Score + route an inbound action (signup / trial / …).
    * Hot path at the edge; client budget defaults to 800ms.
-   * On timeout/transport error — or a malformed verdict shape from the API —
+   * On timeout/transport error, or a malformed verdict shape from the API,
    * returns a degraded challenge verdict (never allow, never crashes).
    *
    * Persist `v.eventId` on the account row: feedback joins only on that id.
@@ -388,7 +388,7 @@ var Chitmark = class {
   }
   /**
    * Report a downstream outcome joined on the stored eventId from verify.
-   * This is the data moat — attribution is a schema contract, not a fuzzy match.
+   * This is the data moat: attribution is a schema contract, not a fuzzy match.
    */
   async feedback(request) {
     return this.request("/v1/feedback", {
@@ -418,7 +418,7 @@ var Chitmark = class {
   }
   /**
    * Verify a verdictToken's signature against the API's JWKS and its session /
-   * origin binding (MVP-016). Rejects expired tokens, unknown kids, and
+   * origin binding. Rejects expired tokens, unknown kids, and
    * invalid signatures with `VerdictTokenError`. Pass `session` to enforce
    * session binding (recommended) and `aud` to enforce origin binding.
    */

package/dist/edge.cjs.map

@@ -1 +1 @@
-{"version":3,"sources":["../src/errors.ts","../src/internal/constants.ts","../src/pii.ts","../src/internal/prepare.ts","../src/verify-token.ts","../src/client.ts","../src/http-status.ts","../src/edge.ts"],"names":["out"],"mappings":";;;AAKO,IAAM,aAAA,GAAN,cAA4B,KAAA,CAAM;AAAA,EAC9B,IAAA,GAAO,eAAA;AAAA,EACP,MAAA;AAAA,EACA,IAAA;AAAA,EACA,IAAA;AAAA,EAET,WAAA,CACE,SACA,OAAA,EACA;AACA,IAAA,KAAA,CAAM,OAAO,CAAA;AACb,IAAA,IAAA,CAAK,SAAS,OAAA,EAAS,MAAA;AACvB,IAAA,IAAA,CAAK,OAAO,OAAA,EAAS,IAAA;AACrB,IAAA,IAAA,CAAK,OAAO,OAAA,EAAS,IAAA;AAAA,EACvB;AACF;AAKO,IAAM,gBAAA,GAAN,cAA+B,aAAA,CAAc;AAAA,EACzC,IAAA,GAAO,kBAAA;AAAA,EAEhB,WAAA,CAAY,MAAA,EAAgB,IAAA,EAAkC,OAAA,EAAkB;AAC9E,IAAA,MAAM,GAAA,GACJ,OAAA,KACC,OAAO,IAAA,KAAS,QAAA,GACb,IAAA,GACA,IAAA,CAAK,OAAA,IAAW,IAAA,CAAK,KAAA,IAAS,CAAA,oBAAA,EAAuB,MAAM,CAAA,CAAA,CAAA,CAAA;AACjE,IAAA,KAAA,CAAM,GAAA,EAAK;AAAA,MACT,MAAA;AAAA,MACA,MAAM,OAAO,IAAA,KAAS,WAAY,IAAA,CAAK,IAAA,IAAQ,KAAK,KAAA,GAAS,MAAA;AAAA,MAC7D;AAAA,KACD,CAAA;AAAA,EACH;AACF;AAMO,SAAS,wBAAA,CAAyB,QAAgB,OAAA,EAA2B;AAClF,EAAA,OAAO;AAAA,IACL,QAAA,EAAU,WAAA;AAAA,IACV,SAAA,EAAW,SAAA;AAAA,IACX,UAAA,EAAY,CAAA;AAAA,IACZ,OAAA,EAAS,CAAC,MAAM,CAAA;AAAA,IAChB,SAAA,EAAW;AAAA,MACT,QAAA,EAAU,KAAA;AAAA,MACV,aAAA,EAAe,CAAC,UAAU;AAAA,KAC5B;AAAA,IACA,YAAA,EAAc,EAAA;AAAA,IACd,OAAA,EAAS,CAAA,aAAA,EAAgB,OAAA,IAAW,SAAS,CAAA,CAAA;AAAA,IAC7C,QAAA,EAAU,IAAA;AAAA,IACV,eAAA,EAAiB;AAAA,GACnB;AACF;AAKO,SAAS,0BAA0B,OAAA,EAA2B;AACnE,EAAA,IAAI,OAAA,CAAQ,QAAA,IAAY,OAAA,CAAQ,QAAA,KAAa,OAAA,EAAS;AACpD,IAAA,OAAO;AAAA,MACL,GAAG,OAAA;AAAA,MACH,QAAA,EAAU,WAAA;AAAA,MACV,OAAA,EAAS;AAAA,QACP,GAAG,OAAA,CAAQ,OAAA;AAAA,QACX;AAAA;AACF,KACF;AAAA,EACF;AACA,EAAA,OAAO,OAAA;AACT;;;AC5EO,IAAM,iBAAA,GAAiD;AAAA,EAC5D,UAAA,EAAY,0BAAA;AAAA,EACZ,OAAA,EAAS,kCAAA;AAAA,EACT,WAAA,EAAa;AACf,CAAA;AAEO,IAAM,kBAAA,GAAqB,GAAA;AAC3B,IAAM,WAAA,GAAc,OAAA;AAEpB,SAAS,cAAA,CACd,GAAA,GAAmB,YAAA,EACnB,OAAA,EACQ;AACR,EAAA,OAAA,CAAQ,WAAW,iBAAA,CAAkB,GAAG,CAAA,EAAG,OAAA,CAAQ,OAAO,EAAE,CAAA;AAC9D;AAMO,SAAS,UAAA,GAAiC;AAC/C,EAAA,IAAI,OAAO,OAAA,KAAY,WAAA,EAAa,OAAO,MAAA;AAC3C,EAAA,MAAM,KAAA,GAAQ,QAAQ,GAAA,EAAK,iBAAA;AAC3B,EAAA,OAAO,KAAA,GAAQ,KAAA,CAAM,IAAA,EAAK,GAAI,MAAA;AAChC;;;ACjBA,eAAsB,gBAAgB,KAAA,EAAgC;AACpE,EAAA,MAAM,UAAA,GAAa,KAAA,CAAM,IAAA,EAAK,CAAE,WAAA,EAAY;AAC5C,EAAA,MAAM,IAAA,GAAO,IAAI,WAAA,EAAY,CAAE,OAAO,UAAU,CAAA;AAChD,EAAA,MAAM,SAAS,MAAM,MAAA,CAAO,MAAA,CAAO,MAAA,CAAO,WAAW,IAAI,CAAA;AACzD,EAAA,OAAO,YAAY,MAAM,CAAA;AAC3B;AAKO,SAAS,WAAW,EAAA,EAAoB;AAC7C,EAAA,MAAM,OAAA,GAAU,GAAG,IAAA,EAAK;AAExB,EAAA,MAAM,KAAA,GAAQ,QAAQ,KAAA,CAAM,GAAG,EAAE,CAAC,CAAA,EAAG,MAAK,IAAK,OAAA;AAC/C,EAAA,IAAI,KAAA,CAAM,SAAS,GAAG,CAAA,IAAK,CAAC,KAAA,CAAM,QAAA,CAAS,GAAG,CAAA,EAAG;AAC/C,IAAA,MAAM,KAAA,GAAQ,KAAA,CAAM,KAAA,CAAM,GAAG,CAAA;AAC7B,IAAA,IAAI,KAAA,CAAM,WAAW,CAAA,EAAG;AACtB,MAAA,OAAO,CAAA,EAAG,KAAA,CAAM,CAAC,CAAC,CAAA,CAAA,EAAI,KAAA,CAAM,CAAC,CAAC,CAAA,CAAA,EAAI,KAAA,CAAM,CAAC,CAAC,CAAA,KAAA,CAAA;AAAA,IAC5C;AAAA,EACF;AAEA,EAAA,IAAI,KAAA,CAAM,QAAA,CAAS,GAAG,CAAA,EAAG;AACvB,IAAA,MAAM,UAAU,KAAA,CAAM,KAAA,CAAM,GAAG,CAAA,CAAE,OAAO,OAAO,CAAA;AAC/C,IAAA,MAAM,OAAO,OAAA,CAAQ,KAAA,CAAM,GAAG,CAAC,CAAA,CAAE,KAAK,GAAG,CAAA;AACzC,IAAA,OAAO,GAAG,IAAI,CAAA,KAAA,CAAA;AAAA,EAChB;AACA,EAAA,OAAO,KAAA;AACT;AAMO,SAAS,iBACd,QAAA,EACqC;AACrC,EAAA,IAAI,CAAC,UAAU,OAAO,MAAA;AACtB,EAAA,MAAM,OAAA,uBAAc,GAAA,CAAI;AAAA,IACtB,eAAA;AAAA,IACA,gBAAA;AAAA,IACA,QAAA;AAAA,IACA,MAAA;AAAA,IACA,UAAA;AAAA,IACA,YAAA;AAAA,IACA,YAAA;AAAA,IACA;AAAA,GACD,CAAA;AACD,EAAA,MAAM,MAA+B,EAAC;AACtC,EAAA,KAAA,MAAW,CAAC,GAAA,EAAK,KAAK,KAAK,MAAA,CAAO,OAAA,CAAQ,QAAQ,CAAA,EAAG;AACnD,IAAA,IAAI,OAAA,CAAQ,GAAA,CAAI,GAAG,CAAA,IAAK,SAAS,IAAA,EAAM;AACrC,MAAA,GAAA,CAAI,GAAG,CAAA,GAAI,KAAA;AAAA,IACb;AAAA,EACF;AACA,EAAA,OAAO,OAAO,IAAA,CAAK,GAAG,CAAA,CAAE,MAAA,GAAS,IAAI,GAAA,GAAM,MAAA;AAC7C;AAEA,SAAS,YAAY,MAAA,EAA6B;AAChD,EAAA,MAAM,KAAA,GAAQ,IAAI,UAAA,CAAW,MAAM,CAAA;AACnC,EAAA,IAAI,GAAA,GAAM,EAAA;AACV,EAAA,KAAA,MAAW,KAAK,KAAA,EAAO;AACrB,IAAA,GAAA,IAAO,EAAE,QAAA,CAAS,EAAE,CAAA,CAAE,QAAA,CAAS,GAAG,GAAG,CAAA;AAAA,EACvC;AACA,EAAA,OAAO,GAAA;AACT;;;AClEA,eAAsB,cAAA,CACpB,SACA,OAAA,EACkB;AAClB,EAAA,IAAI,YAAY,KAAA,EAAO;AACrB,IAAA,OAAO,OAAA;AAAA,EACT;AAEA,EAAA,IAAI,YAAY,MAAA,EAAQ;AACtB,IAAA,OAAO;AAAA,MACL,WAAW,OAAA,CAAQ,SAAA;AAAA,MACnB,OAAA,EAAS,qBAAA,CAAsB,OAAA,CAAQ,OAAO;AAAA,KAChD;AAAA,EACF;AAGA,EAAA,MAAM,QAAA,GAAoB;AAAA,IACxB,WAAW,OAAA,CAAQ,SAAA;AAAA,IACnB,SAAS,OAAA,CAAQ;AAAA,GACnB;AAEA,EAAA,IAAI,QAAQ,WAAA,EAAa;AACvB,IAAA,QAAA,CAAS,cAAc,OAAA,CAAQ,WAAA;AAAA,EACjC,CAAA,MAAA,IAAW,QAAQ,KAAA,EAAO;AACxB,IAAA,QAAA,CAAS,WAAA,GAAc,MAAM,eAAA,CAAgB,OAAA,CAAQ,KAAK,CAAA;AAAA,EAC5D;AAEA,EAAA,IAAI,QAAQ,OAAA,EAAS;AACnB,IAAA,QAAA,CAAS,UAAU,OAAA,CAAQ,OAAA;AAAA,EAC7B,CAAA,MAAA,IAAW,QAAQ,EAAA,EAAI;AACrB,IAAA,QAAA,CAAS,OAAA,GAAU,UAAA,CAAW,OAAA,CAAQ,EAAE,CAAA;AAAA,EAC1C;AAEA,EAAA,MAAM,UAAA,GAAa,OAAA,CAAQ,cAAA,IAAkB,gBAAA,CAAiB,QAAQ,QAAQ,CAAA;AAC9E,EAAA,IAAI,UAAA,EAAY;AACd,IAAA,QAAA,CAAS,cAAA,GAAiB,UAAA;AAAA,EAC5B;AAEA,EAAA,OAAO,QAAA;AACT;AAEA,SAAS,sBACP,OAAA,EACoC;AACpC,EAAA,IAAI,CAAC,SAAS,OAAO,MAAA;AACrB,EAAA,MAAM,IAAA,GAAO,CAAC,iBAAA,EAAmB,iBAAA,EAAmB,aAAa,iBAAiB,CAAA;AAClF,EAAA,MAAM,MAA8B,EAAC;AACrC,EAAA,KAAA,MAAW,CAAC,CAAA,EAAG,CAAC,KAAK,MAAA,CAAO,OAAA,CAAQ,OAAO,CAAA,EAAG;AAC5C,IAAA,MAAM,KAAA,GAAQ,EAAE,WAAA,EAAY;AAC5B,IAAA,IAAI,KAAK,QAAA,CAAS,KAAK,CAAA,IAAK,OAAO,MAAM,QAAA,EAAU;AACjD,MAAA,GAAA,CAAI,KAAK,CAAA,GAAI,CAAA;AAAA,IACf,CAAA,MAAA,IAAW,IAAA,CAAK,QAAA,CAAS,KAAK,CAAA,IAAK,KAAA,CAAM,OAAA,CAAQ,CAAC,CAAA,IAAK,CAAA,CAAE,CAAC,CAAA,EAAG;AAC3D,MAAA,GAAA,CAAI,KAAK,CAAA,GAAI,CAAA,CAAE,CAAC,CAAA;AAAA,IAClB;AAAA,EACF;AACA,EAAA,OAAO,OAAO,IAAA,CAAK,GAAG,CAAA,CAAE,MAAA,GAAS,IAAI,GAAA,GAAM,MAAA;AAC7C;AAKO,SAAS,eACd,OAAA,EACoC;AACpC,EAAA,IAAI,CAAC,SAAS,OAAO,MAAA;AACrB,EAAA,IAAI,mBAAmB,OAAA,EAAS;AAC9B,IAAA,MAAMA,OAA8B,EAAC;AACrC,IAAA,OAAA,CAAQ,OAAA,CAAQ,CAAC,KAAA,EAAO,GAAA,KAAQ;AAC9B,MAAAA,IAAAA,CAAI,GAAA,CAAI,WAAA,EAAa,CAAA,GAAI,KAAA;AAAA,IAC3B,CAAC,CAAA;AACD,IAAA,OAAOA,IAAAA;AAAA,EACT;AACA,EAAA,MAAM,MAA8B,EAAC;AACrC,EAAA,KAAA,MAAW,CAAC,CAAA,EAAG,CAAC,KAAK,MAAA,CAAO,OAAA,CAAQ,OAAO,CAAA,EAAG;AAC5C,IAAA,IAAI,OAAO,CAAA,KAAM,QAAA,MAAc,CAAA,CAAE,WAAA,EAAa,CAAA,GAAI,CAAA;AAAA,SAAA,IACzC,KAAA,CAAM,OAAA,CAAQ,CAAC,CAAA,IAAK,CAAA,CAAE,CAAC,CAAA,EAAG,GAAA,CAAI,CAAA,CAAE,WAAA,EAAa,CAAA,GAAI,EAAE,CAAC,CAAA;AAAA,EAC/D;AACA,EAAA,OAAO,GAAA;AACT;;;AC9CO,IAAM,iBAAA,GAAN,cAAgC,aAAA,CAAc;AAAA,EAC1C,IAAA,GAAO,mBAAA;AAAA,EAEhB,WAAA,CAAY,MAA6B,OAAA,EAAiB;AACxD,IAAA,KAAA,CAAM,OAAA,EAAS,EAAE,IAAA,EAAM,CAAA;AAAA,EACzB;AACF;AAmBA,IAAM,gBAAA,GAAmB,gDAAA;AACzB,IAAM,sBAAA,GAAyB,EAAA;AAE/B,eAAsB,kBAAA,CACpB,KAAA,EACA,OAAA,GAAqC,EAAC,EACT;AAC7B,EAAA,MAAM,KAAA,GAAQ,OAAA,CAAQ,KAAA,IAAS,IAAA,CAAK,GAAA,EAAI;AACxC,EAAA,MAAM,aAAA,GAAgB,QAAQ,aAAA,IAAiB,sBAAA;AAE/C,EAAA,MAAM,KAAA,GAAQ,KAAA,CAAM,KAAA,CAAM,GAAG,CAAA;AAC7B,EAAA,IAAI,KAAA,CAAM,WAAW,CAAA,EAAG;AACtB,IAAA,MAAM,IAAI,iBAAA,CAAkB,iBAAA,EAAmB,4BAA4B,CAAA;AAAA,EAC7E;AACA,EAAA,MAAM,CAAC,SAAA,EAAW,UAAA,EAAY,YAAY,CAAA,GAAI,KAAA;AAE9C,EAAA,IAAI,MAAA;AACJ,EAAA,IAAI,OAAA;AACJ,EAAA,IAAI;AACF,IAAA,MAAA,GAAS,IAAA,CAAK,KAAA,CAAM,eAAA,CAAgB,SAAS,CAAC,CAAA;AAC9C,IAAA,OAAA,GAAU,IAAA,CAAK,KAAA,CAAM,eAAA,CAAgB,UAAU,CAAC,CAAA;AAAA,EAClD,CAAA,CAAA,MAAQ;AACN,IAAA,MAAM,IAAI,iBAAA,CAAkB,iBAAA,EAAmB,oCAAoC,CAAA;AAAA,EACrF;AAEA,EAAA,IAAI,MAAA,CAAO,KAAK,CAAA,KAAM,OAAA,EAAS;AAC7B,IAAA,MAAM,IAAI,iBAAA;AAAA,MACR,iBAAA;AAAA,MACA,CAAA,iCAAA,EAAoC,MAAA,CAAO,MAAA,CAAO,KAAK,CAAC,CAAC,CAAA;AAAA,KAC3D;AAAA,EACF;AACA,EAAA,MAAM,GAAA,GAAM,OAAO,MAAA,CAAO,KAAK,MAAM,QAAA,GAAW,MAAA,CAAO,KAAK,CAAA,GAAI,EAAA;AAChE,EAAA,IAAI,CAAC,GAAA,EAAK;AACR,IAAA,MAAM,IAAI,iBAAA,CAAkB,aAAA,EAAe,6BAA6B,CAAA;AAAA,EAC1E;AAEA,EAAA,MAAM,GAAA,GAAM,OAAO,OAAA,CAAQ,KAAK,MAAM,QAAA,GAAW,OAAA,CAAQ,KAAK,CAAA,GAAI,GAAA;AAClE,EAAA,MAAM,GAAA,GAAM,OAAO,OAAA,CAAQ,KAAK,MAAM,QAAA,GAAW,OAAA,CAAQ,KAAK,CAAA,GAAI,GAAA;AAClE,EAAA,MAAM,UAAA,GAAa,IAAA,CAAK,KAAA,CAAM,KAAA,GAAQ,GAAI,CAAA;AAC1C,EAAA,IAAI,OAAO,QAAA,CAAS,GAAG,CAAA,IAAK,GAAA,GAAM,aAAa,aAAA,EAAe;AAC5D,IAAA,MAAM,IAAI,iBAAA,CAAkB,SAAA,EAAW,0BAA0B,CAAA;AAAA,EACnE;AACA,EAAA,IAAI,OAAO,QAAA,CAAS,GAAG,CAAA,IAAK,GAAA,GAAM,aAAa,aAAA,EAAe;AAC5D,IAAA,MAAM,IAAI,iBAAA,CAAkB,eAAA,EAAiB,mCAAmC,CAAA;AAAA,EAClF;AAEA,EAAA,MAAM,kBAAkB,OAAA,CAAQ,OAAA;AAChC,EAAA,IAAI,eAAA,KAAoB,MAAA,IAAa,OAAA,CAAQ,KAAK,MAAM,eAAA,EAAiB;AACvE,IAAA,MAAM,IAAI,iBAAA;AAAA,MACR,eAAA;AAAA,MACA;AAAA,KACF;AAAA,EACF;AACA,EAAA,MAAM,cAAc,OAAA,CAAQ,GAAA;AAC5B,EAAA,IAAI,WAAA,KAAgB,MAAA,IAAa,OAAA,CAAQ,KAAK,MAAM,WAAA,EAAa;AAC/D,IAAA,MAAM,IAAI,iBAAA;AAAA,MACR,WAAA;AAAA,MACA;AAAA,KACF;AAAA,EACF;AAEA,EAAA,MAAM,GAAA,GAAM,MAAM,OAAA,CAAQ,GAAA,EAAK,OAAO,CAAA;AACtC,EAAA,IAAI,CAAC,GAAA,EAAK;AACR,IAAA,MAAM,IAAI,iBAAA,CAAkB,aAAA,EAAe,CAAA,wBAAA,EAA2B,GAAG,CAAA,CAAE,CAAA;AAAA,EAC7E;AAEA,EAAA,IAAI,SAAA;AACJ,EAAA,IAAI;AACF,IAAA,SAAA,GAAY,MAAM,OAAO,MAAA,CAAO,SAAA;AAAA,MAC9B,KAAA;AAAA,MACA,GAAA;AAAA,MACA,EAAE,IAAA,EAAM,OAAA,EAAS,UAAA,EAAY,OAAA,EAAQ;AAAA,MACrC,KAAA;AAAA,MACA,CAAC,QAAQ;AAAA,KACX;AAAA,EACF,CAAA,CAAA,MAAQ;AACN,IAAA,MAAM,IAAI,iBAAA;AAAA,MACR,mBAAA;AAAA,MACA;AAAA,KACF;AAAA,EACF;AAEA,EAAA,MAAM,cAAA,GAAiB,qBAAqB,YAAY,CAAA;AACxD,EAAA,MAAM,eAAA,GAAkB,IAAI,WAAA,CAAY,cAAA,CAAe,UAAU,CAAA;AACjE,EAAA,IAAI,UAAA,CAAW,eAAe,CAAA,CAAE,GAAA,CAAI,cAAc,CAAA;AAElD,EAAA,MAAM,KAAA,GAAQ,MAAM,MAAA,CAAO,MAAA,CAAO,MAAA;AAAA,IAChC,EAAE,IAAA,EAAM,OAAA,EAAS,IAAA,EAAM,SAAA,EAAU;AAAA,IACjC,SAAA;AAAA,IACA,eAAA;AAAA,IACA,IAAI,aAAY,CAAE,MAAA,CAAO,GAAG,SAAS,CAAA,CAAA,EAAI,UAAU,CAAA,CAAE;AAAA,GACvD;AACA,EAAA,IAAI,CAAC,KAAA,EAAO;AACV,IAAA,MAAM,IAAI,iBAAA;AAAA,MACR,mBAAA;AAAA,MACA;AAAA,KACF;AAAA,EACF;AAEA,EAAA,OAAO,OAAA;AACT;AAEA,eAAe,OAAA,CACb,KACA,OAAA,EAC8C;AAC9C,EAAA,IAAI,OAAO,OAAA,CAAQ,IAAA;AACnB,EAAA,IAAI,CAAC,IAAA,EAAM;AACT,IAAA,MAAM,OAAA,GAAU,QAAQ,OAAA,IAAW,gBAAA;AACnC,IAAA,IAAI;AACF,MAAA,MAAM,YAAY,OAAA,CAAQ,KAAA,IAAS,UAAA,CAAW,KAAA,CAAM,KAAK,UAAU,CAAA;AACnE,MAAA,MAAM,GAAA,GAAM,MAAM,SAAA,CAAU,OAAO,CAAA;AACnC,MAAA,IAAI,CAAC,IAAI,EAAA,EAAI;AACX,QAAA,MAAM,IAAI,KAAA,CAAM,CAAA,uBAAA,EAA0B,GAAA,CAAI,MAAM,CAAA,CAAE,CAAA;AAAA,MACxD;AACA,MAAA,IAAA,GAAQ,MAAM,IAAI,IAAA,EAAK;AAAA,IACzB,SAAS,GAAA,EAAK;AACZ,MAAA,MAAM,IAAI,iBAAA;AAAA,QACR,kBAAA;AAAA,QACA,4BAA4B,OAAO,CAAA,EAAA,EACjC,eAAe,KAAA,GAAQ,GAAA,CAAI,UAAU,eACvC,CAAA;AAAA,OACF;AAAA,IACF;AAAA,EACF;AACA,EAAA,IAAI,CAAC,KAAA,CAAM,OAAA,CAAQ,IAAA,CAAK,IAAI,CAAA,EAAG;AAC7B,IAAA,MAAM,IAAI,iBAAA,CAAkB,kBAAA,EAAoB,iCAAiC,CAAA;AAAA,EACnF;AACA,EAAA,OAAO,IAAA,CAAK,KAAK,IAAA,CAAK,CAAC,QAAQ,GAAA,CAAI,KAAK,MAAM,GAAG,CAAA;AACnD;AAEA,SAAS,gBAAgB,KAAA,EAAuB;AAC9C,EAAA,MAAM,UAAA,GAAa,MAAM,OAAA,CAAQ,IAAA,EAAM,GAAG,CAAA,CAAE,OAAA,CAAQ,MAAM,GAAG,CAAA;AAC7D,EAAA,MAAM,MAAA,GAAS,aAAa,GAAA,CAAI,MAAA,CAAA,CAAQ,IAAK,UAAA,CAAW,MAAA,GAAS,KAAM,CAAC,CAAA;AACxE,EAAA,MAAM,MAAA,GAAS,KAAK,MAAM,CAAA;AAC1B,EAAA,OAAO,IAAI,WAAA,EAAY,CAAE,MAAA,CAAO,UAAA,CAAW,IAAA,CAAK,MAAA,EAAQ,CAAC,EAAA,KAAO,EAAA,CAAG,UAAA,CAAW,CAAC,CAAC,CAAC,CAAA;AACnF;AAEA,SAAS,qBAAqB,KAAA,EAA2B;AACvD,EAAA,MAAM,UAAA,GAAa,MAAM,OAAA,CAAQ,IAAA,EAAM,GAAG,CAAA,CAAE,OAAA,CAAQ,MAAM,GAAG,CAAA;AAC7D,EAAA,MAAM,MAAA,GAAS,aAAa,GAAA,CAAI,MAAA,CAAA,CAAQ,IAAK,UAAA,CAAW,MAAA,GAAS,KAAM,CAAC,CAAA;AACxE,EAAA,MAAM,MAAA,GAAS,KAAK,MAAM,CAAA;AAC1B,EAAA,MAAM,GAAA,GAAM,IAAI,UAAA,CAAW,MAAA,CAAO,MAAM,CAAA;AACxC,EAAA,KAAA,IAAS,CAAA,GAAI,CAAA,EAAG,CAAA,GAAI,MAAA,CAAO,MAAA,EAAQ,CAAA,IAAK,CAAA,EAAG,GAAA,CAAI,CAAC,CAAA,GAAI,MAAA,CAAO,UAAA,CAAW,CAAC,CAAA;AACvE,EAAA,OAAO,GAAA;AACT;;;AClKO,IAAM,WAAN,MAAe;AAAA,EACH,MAAA;AAAA,EACA,OAAA;AAAA,EACA,SAAA;AAAA,EACA,OAAA;AAAA,EACA,UAAA;AAAA,EACA,SAAA;AAAA,EACA,UAAA;AAAA,EAEjB,YAAY,OAAA,EAA0B;AACpC,IAAA,IAAI,CAAC,QAAQ,MAAA,EAAQ;AACnB,MAAA,MAAM,IAAI,cAAc,6BAA6B,CAAA;AAAA,IACvD;AACA,IAAA,IAAI,OAAA,CAAQ,UAAA,IAAc,OAAA,CAAQ,UAAA,KAAe,WAAA,EAAa;AAC5D,MAAA,MAAM,IAAI,aAAA;AAAA,QACR;AAAA,OACF;AAAA,IACF;AACA,IAAA,IAAA,CAAK,SAAS,OAAA,CAAQ,MAAA;AACtB,IAAA,IAAA,CAAK,UAAU,cAAA,CAAe,OAAA,CAAQ,KAAK,OAAA,CAAQ,OAAA,IAAW,YAAY,CAAA;AAC1E,IAAA,IAAA,CAAK,SAAA,GAAY,QAAQ,SAAA,IAAa,kBAAA;AACtC,IAAA,IAAA,CAAK,OAAA,GAAU,QAAQ,OAAA,IAAW,QAAA;AAClC,IAAA,IAAA,CAAK,UAAA,GAAa,WAAA;AAClB,IAAA,IAAA,CAAK,YAAY,OAAA,CAAQ,KAAA,IAAS,UAAA,CAAW,KAAA,CAAM,KAAK,UAAU,CAAA;AAClE,IAAA,IAAA,CAAK,UAAA,GAAa,OAAA,CAAQ,UAAA,IAAc,CAAA,cAAA,EAAiB,WAAW,CAAA,CAAA;AAAA,EACtE;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAUA,MAAM,OAAO,OAAA,EAA0C;AACrD,IAAA,MAAM,UAAU,MAAM,cAAA;AAAA,MACpB;AAAA,QACE,GAAG,OAAA,CAAQ,OAAA;AAAA,QACX,OAAA,EAAS,cAAA,CAAe,OAAA,CAAQ,OAAA,CAAQ,OAAO;AAAA,OACjD;AAAA,MACA,IAAA,CAAK;AAAA,KACP;AAEA,IAAA,MAAM,IAAA,GAAsB;AAAA,MAC1B,GAAG,OAAA;AAAA,MACH;AAAA,KACF;AAEA,IAAA,IAAI;AACF,MAAA,MAAM,OAAA,GAAU,MAAM,IAAA,CAAK,OAAA,CAAiB,YAAA,EAAc;AAAA,QACxD,MAAA,EAAQ,MAAA;AAAA,QACR,IAAA;AAAA,QACA,gBAAgB,OAAA,CAAQ;AAAA,OACzB,CAAA;AACD,MAAA,IAAI,CAAC,mBAAA,CAAoB,OAAO,CAAA,EAAG;AACjC,QAAA,OAAO,wBAAA;AAAA,UACL,qDAAA;AAAA,UACA,OAAA,CAAQ;AAAA,SACV;AAAA,MACF;AACA,MAAA,OAAO,0BAA0B,OAAO,CAAA;AAAA,IAC1C,SAAS,GAAA,EAAK;AACZ,MAAA,IAAI,eAAe,gBAAA,EAAkB;AACnC,QAAA,MAAM,GAAA;AAAA,MACR;AACA,MAAA,OAAO,wBAAA;AAAA,QACL,GAAA,YAAe,KAAA,GAAQ,CAAA,UAAA,EAAa,GAAA,CAAI,OAAO,CAAA,CAAA,GAAK,yBAAA;AAAA,QACpD,OAAA,CAAQ;AAAA,OACV;AAAA,IACF;AAAA,EACF;AAAA;AAAA;AAAA;AAAA;AAAA,EAMA,MAAM,SAAS,OAAA,EAAqD;AAClE,IAAA,OAAO,IAAA,CAAK,QAA0B,cAAA,EAAgB;AAAA,MACpD,MAAA,EAAQ,MAAA;AAAA,MACR,IAAA,EAAM;AAAA,KACP,CAAA;AAAA,EACH;AAAA;AAAA;AAAA;AAAA,EAKA,MAAM,UAAU,OAAA,EAAuD;AACrE,IAAA,OAAO,IAAA,CAAK,QAA2B,eAAA,EAAiB;AAAA,MACtD,MAAA,EAAQ,MAAA;AAAA,MACR,IAAA,EAAM;AAAA,KACP,CAAA;AAAA,EACH;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAOA,MAAM,kBAAkB,OAAA,EAKiB;AACvC,IAAA,OAAO,IAAA,CAAK,QAAqC,eAAA,EAAiB;AAAA,MAChE,MAAA,EAAQ,MAAA;AAAA,MACR,IAAA,EAAM;AAAA,KACP,CAAA;AAAA,EACH;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAQA,MAAM,kBAAA,CACJ,KAAA,EACA,OAAA,GAAgE,EAAC,EACpC;AAC7B,IAAA,OAAO,mBAAmB,KAAA,EAAO;AAAA,MAC/B,GAAG,OAAA;AAAA,MACH,OAAA,EAAS,CAAA,EAAG,IAAA,CAAK,OAAO,CAAA,sBAAA,CAAA;AAAA,MACxB,OAAO,IAAA,CAAK;AAAA,KACb,CAAA;AAAA,EACH;AAAA;AAAA;AAAA;AAAA,EAKA,MAAM,OAAA,CACJ,IAAA,EACA,IAAA,EAKY;AACZ,IAAA,MAAM,UAAA,GAAa,IAAI,eAAA,EAAgB;AACvC,IAAA,MAAM,QAAQ,UAAA,CAAW,MAAM,WAAW,KAAA,EAAM,EAAG,KAAK,SAAS,CAAA;AAEjE,IAAA,IAAI;AACF,MAAA,MAAM,OAAA,GAAkC;AAAA,QACtC,aAAA,EAAe,CAAA,OAAA,EAAU,IAAA,CAAK,MAAM,CAAA,CAAA;AAAA,QACpC,cAAA,EAAgB,kBAAA;AAAA,QAChB,MAAA,EAAQ,kBAAA;AAAA,QACR,cAAc,IAAA,CAAK,UAAA;AAAA,QACnB,qBAAqB,IAAA,CAAK;AAAA,OAC5B;AACA,MAAA,IAAI,KAAK,cAAA,EAAgB;AACvB,QAAA,OAAA,CAAQ,iBAAiB,IAAI,IAAA,CAAK,cAAA;AAAA,MACpC;AAEA,MAAA,MAAM,GAAA,GAAM,MAAM,IAAA,CAAK,SAAA,CAAU,GAAG,IAAA,CAAK,OAAO,CAAA,EAAG,IAAI,CAAA,CAAA,EAAI;AAAA,QACzD,QAAQ,IAAA,CAAK,MAAA;AAAA,QACb,OAAA;AAAA,QACA,IAAA,EAAM,KAAK,IAAA,KAAS,KAAA,CAAA,GAAY,KAAK,SAAA,CAAU,IAAA,CAAK,IAAI,CAAA,GAAI,KAAA,CAAA;AAAA,QAC5D,QAAQ,UAAA,CAAW;AAAA,OACpB,CAAA;AAED,MAAA,MAAM,IAAA,GAAO,MAAM,GAAA,CAAI,IAAA,EAAK;AAC5B,MAAA,IAAI,MAAA,GAAkB,KAAA,CAAA;AACtB,MAAA,IAAI,IAAA,EAAM;AACR,QAAA,IAAI;AACF,UAAA,MAAA,GAAS,IAAA,CAAK,MAAM,IAAI,CAAA;AAAA,QAC1B,CAAA,CAAA,MAAQ;AACN,UAAA,MAAA,GAAS,IAAA;AAAA,QACX;AAAA,MACF;AAEA,MAAA,IAAI,CAAC,IAAI,EAAA,EAAI;AACX,QAAA,MAAM,UACJ,OAAO,MAAA,KAAW,QAAA,IAAY,MAAA,KAAW,OACpC,MAAA,GACD,IAAA;AACN,QAAA,MAAM,UAAA,GACJ,OAAO,OAAA,KAAY,QAAA,GACf,OAAA,GACA;AAAA,UACE,KAAA,EAAO,OAAA,CAAQ,KAAA,IAAS,CAAA,KAAA,EAAQ,IAAI,MAAM,CAAA,CAAA;AAAA,UAC1C,SAAS,OAAA,CAAQ,OAAA;AAAA,UACjB,MAAM,OAAA,CAAQ;AAAA,SAChB;AACN,QAAA,MAAM,IAAI,gBAAA,CAAiB,GAAA,CAAI,MAAA,EAAQ,UAAU,CAAA;AAAA,MACnD;AAEA,MAAA,OAAO,MAAA;AAAA,IACT,SAAS,GAAA,EAAK;AACZ,MAAA,IAAI,GAAA,YAAe,kBAAkB,MAAM,GAAA;AAC3C,MAAA,IAAI,GAAA,YAAe,KAAA,IAAS,GAAA,CAAI,IAAA,KAAS,YAAA,EAAc;AACrD,QAAA,MAAM,IAAI,aAAA,CAAc,CAAA,wBAAA,EAA2B,IAAA,CAAK,SAAS,CAAA,EAAA,CAAA,EAAM;AAAA,UACrE,IAAA,EAAM;AAAA,SACP,CAAA;AAAA,MACH;AACA,MAAA,MAAM,eAAe,KAAA,GACjB,IAAI,aAAA,CAAc,GAAA,CAAI,SAAS,EAAE,IAAA,EAAM,WAAA,EAAa,IACpD,IAAI,aAAA,CAAc,2BAA2B,EAAE,IAAA,EAAM,aAAa,CAAA;AAAA,IACxE,CAAA,SAAE;AACA,MAAA,YAAA,CAAa,KAAK,CAAA;AAAA,IACpB;AAAA,EACF;AAAA;AAAA,EAGA,IAAI,MAAA,GAKF;AACA,IAAA,OAAO;AAAA,MACL,SAAS,IAAA,CAAK,OAAA;AAAA,MACd,WAAW,IAAA,CAAK,SAAA;AAAA,MAChB,SAAS,IAAA,CAAK,OAAA;AAAA,MACd,YAAY,IAAA,CAAK;AAAA,KACnB;AAAA,EACF;AACF;AAEA,IAAM,oCAAyC,IAAI,GAAA,CAAI,CAAC,OAAA,EAAS,WAAA,EAAa,MAAM,CAAC,CAAA;AAM9E,SAAS,oBAAoB,KAAA,EAAkC;AACpE,EAAA,IAAI,OAAO,KAAA,KAAU,QAAA,IAAY,KAAA,KAAU,MAAM,OAAO,KAAA;AACxD,EAAA,MAAM,CAAA,GAAI,KAAA;AACV,EAAA,OACE,OAAO,CAAA,CAAE,QAAA,KAAa,YACtB,iBAAA,CAAkB,GAAA,CAAI,EAAE,QAAQ,CAAA,IAChC,OAAO,CAAA,CAAE,OAAA,KAAY,YACrB,CAAA,CAAE,OAAA,CAAQ,SAAS,CAAA,IACnB,OAAO,EAAE,QAAA,KAAa,SAAA;AAE1B;;;ACvRO,IAAM,oBAAA,GAAuB;AAAA,EAClC,EAAA,EAAI,GAAA;AAAA,EACJ,OAAA,EAAS,GAAA;AAAA,EACT,UAAA,EAAY,GAAA;AAAA,EACZ,YAAA,EAAc,GAAA;AAAA,EACd,SAAA,EAAW,GAAA;AAAA,EACX,QAAA,EAAU,GAAA;AAAA,EACV,QAAA,EAAU,GAAA;AAAA,EACV,oBAAA,EAAsB,GAAA;AAAA,EACtB,eAAA,EAAiB;AACnB;AAKO,IAAM,4BAAA,GAA+B;AAAA,EAC1C,EAAA,EAAI,0FAAA;AAAA,EACJ,OAAA,EAAS,4DAAA;AAAA,EACT,UAAA,EAAY,mDAAA;AAAA,EACZ,YAAA,EAAc,gCAAA;AAAA,EACd,SAAA,EAAW,yCAAA;AAAA,EACX,QAAA,EAAU,6CAAA;AAAA,EACV,QAAA,EAAU,iEAAA;AAAA,EACV,oBAAA,EACE,4EAAA;AAAA,EACF,eAAA,EAAiB;AACnB;AAEO,SAAS,oBAAoB,OAAA,EAAsC;AACxE,EAAA,IAAI,OAAA,CAAQ,QAAA,IAAY,OAAA,CAAQ,QAAA,KAAa,WAAA,EAAa;AACxD,IAAA,OAAO,oBAAA,CAAqB,oBAAA;AAAA,EAC9B;AACA,EAAA,IAAI,OAAA,CAAQ,QAAA,KAAa,MAAA,EAAQ,OAAO,oBAAA,CAAqB,SAAA;AAC7D,EAAA,OAAO,oBAAA,CAAqB,EAAA;AAC9B;;;ACHO,IAAM,YAAA,GAAN,cAA2B,QAAA,CAAS;AAAA;AAAA;AAAA;AAAA,EAIzC,MAAM,aAAA,CACJ,GAAA,EACA,OAAA,EACkB;AAClB,IAAA,MAAM,GAAA,GAAM,IAAI,GAAA,CAAI,GAAA,CAAI,GAAG,CAAA;AAC3B,IAAA,MAAM,KACJ,GAAA,CAAI,OAAA,CAAQ,GAAA,CAAI,kBAAkB,KAClC,GAAA,CAAI,OAAA,CAAQ,GAAA,CAAI,iBAAiB,GAAG,KAAA,CAAM,GAAG,EAAE,CAAC,CAAA,EAAG,MAAK,IACxD,EAAA;AACF,IAAA,MAAM,SAAA,GAAY,GAAA,CAAI,OAAA,CAAQ,GAAA,CAAI,YAAY,CAAA,IAAK,EAAA;AACnD,IAAA,MAAM,OAAA,GAAU,cAAA,CAAe,GAAA,CAAI,OAAO,CAAA;AAE1C,IAAA,MAAM,OAAA,GAAU,QAAQ,OAAA,IAAW;AAAA,MACjC,KAAA,EAAO,QAAQ,IAAA,EAAM,KAAA;AAAA,MACrB,EAAA;AAAA,MACA,SAAA;AAAA,MACA,OAAA;AAAA,MACA,UAAU,OAAA,CAAQ;AAAA,KACpB;AAEA,IAAA,OAAO,KAAK,MAAA,CAAO;AAAA,MACjB,QAAQ,OAAA,CAAQ,MAAA;AAAA,MAChB,SAAS,OAAA,CAAQ,OAAA;AAAA,MACjB,OAAA,EAAS,QAAQ,OAAA,IAAW,CAAA,EAAG,IAAI,IAAI,CAAA,EAAG,IAAI,QAAQ,CAAA,CAAA;AAAA,MACtD,OAAA;AAAA,MACA,SAAS,OAAA,CAAQ,OAAA;AAAA,MACjB,gBAAgB,OAAA,CAAQ;AAAA,KACzB,CAAA;AAAA,EACH;AACF","file":"edge.cjs","sourcesContent":["import type { ChitmarkErrorBody, Decision, Verdict } from \"./types.js\";\n\n/**\n * Base error for all Chitmark client failures.\n */\nexport class ChitmarkError extends Error {\n  override name = \"ChitmarkError\";\n  readonly status?: number;\n  readonly code?: string;\n  readonly body?: ChitmarkErrorBody | string;\n\n  constructor(\n    message: string,\n    options?: { status?: number; code?: string; body?: ChitmarkErrorBody | string },\n  ) {\n    super(message);\n    this.status = options?.status;\n    this.code = options?.code;\n    this.body = options?.body;\n  }\n}\n\n/**\n * Raised when the API returns a non-2xx response.\n */\nexport class ChitmarkApiError extends ChitmarkError {\n  override name = \"ChitmarkApiError\";\n\n  constructor(status: number, body: ChitmarkErrorBody | string, message?: string) {\n    const msg =\n      message ??\n      (typeof body === \"string\"\n        ? body\n        : body.message || body.error || `Chitmark API error (${status})`);\n    super(msg, {\n      status,\n      code: typeof body === \"object\" ? (body.code ?? body.error) : undefined,\n      body,\n    });\n  }\n}\n\n/**\n * Build the degraded challenge verdict used on timeout / transport failure.\n * Golden rule: fail to challenge, never to allow.\n */\nexport function degradedChallengeVerdict(reason: string, session?: string): Verdict {\n  return {\n    decision: \"challenge\" satisfies Decision,\n    actorType: \"unknown\",\n    confidence: 0,\n    reasons: [reason],\n    principal: {\n      resolved: false,\n      identityBasis: [\"degraded\"],\n    },\n    verdictToken: \"\",\n    eventId: `evt_degraded_${session ?? \"unknown\"}`,\n    degraded: true,\n    enforcementMode: \"enforce\",\n  };\n}\n\n/**\n * Ensure degraded responses never surface as allow (defense in depth client-side).\n */\nexport function enforceDegradedNeverAllow(verdict: Verdict): Verdict {\n  if (verdict.degraded && verdict.decision === \"allow\") {\n    return {\n      ...verdict,\n      decision: \"challenge\",\n      reasons: [\n        ...verdict.reasons,\n        \"Client enforced: degraded decision must not be allow\",\n      ],\n    };\n  }\n  return verdict;\n}\n","import type { ChitmarkEnv } from \"../types.js\";\n\nexport const DEFAULT_BASE_URLS: Record<ChitmarkEnv, string> = {\n  production: \"https://api.chitmark.com\",\n  staging: \"https://api.staging.chitmark.com\",\n  development: \"http://127.0.0.1:8787\",\n};\n\nexport const DEFAULT_TIMEOUT_MS = 800;\nexport const SDK_VERSION = \"0.1.0\";\n\nexport function resolveBaseUrl(\n  env: ChitmarkEnv = \"production\",\n  baseUrl?: string,\n): string {\n  return (baseUrl ?? DEFAULT_BASE_URLS[env]).replace(/\\/$/, \"\");\n}\n\n/**\n * CHITMARK_BASE_URL environment override, when present (Node only — no-op on\n * Workers/browsers where `process` is undefined).\n */\nexport function envBaseUrl(): string | undefined {\n  if (typeof process === \"undefined\") return undefined;\n  const value = process.env?.CHITMARK_BASE_URL;\n  return value ? value.trim() : undefined;\n}\n","/**\n * Client-side PII minimization helpers.\n * Default SDK mode hashes email and truncates IP before leaving the customer process.\n */\n\n/**\n * SHA-256 hex digest of lowercased, trimmed email.\n * Uses Web Crypto (Node 18+, browsers, Workers).\n */\nexport async function hashEmailSha256(email: string): Promise<string> {\n  const normalized = email.trim().toLowerCase();\n  const data = new TextEncoder().encode(normalized);\n  const digest = await crypto.subtle.digest(\"SHA-256\", data);\n  return bufferToHex(digest);\n}\n\n/**\n * Truncate IPv4 to /24 or IPv6 to /48 for coarse geo without host identity.\n */\nexport function truncateIp(ip: string): string {\n  const trimmed = ip.trim();\n  // IPv4 (optionally from x-forwarded-for first hop)\n  const first = trimmed.split(\",\")[0]?.trim() ?? trimmed;\n  if (first.includes(\".\") && !first.includes(\":\")) {\n    const parts = first.split(\".\");\n    if (parts.length === 4) {\n      return `${parts[0]}.${parts[1]}.${parts[2]}.0/24`;\n    }\n  }\n  // IPv6 — keep first 3 hextets (~/48)\n  if (first.includes(\":\")) {\n    const hextets = first.split(\":\").filter(Boolean);\n    const head = hextets.slice(0, 3).join(\":\");\n    return `${head}::/48`;\n  }\n  return first;\n}\n\n/**\n * Reduce form payload to non-PII keys (domain-style fields only for hashed mode).\n * Free-text is dropped; companyDomain-style keys are kept as-is when domain-like.\n */\nexport function minimizeFormData(\n  formData: Record<string, unknown> | undefined,\n): Record<string, unknown> | undefined {\n  if (!formData) return undefined;\n  const allowed = new Set([\n    \"companyDomain\",\n    \"company_domain\",\n    \"domain\",\n    \"plan\",\n    \"referrer\",\n    \"utm_source\",\n    \"utm_medium\",\n    \"utm_campaign\",\n  ]);\n  const out: Record<string, unknown> = {};\n  for (const [key, value] of Object.entries(formData)) {\n    if (allowed.has(key) && value != null) {\n      out[key] = value;\n    }\n  }\n  return Object.keys(out).length > 0 ? out : undefined;\n}\n\nfunction bufferToHex(buffer: ArrayBuffer): string {\n  const bytes = new Uint8Array(buffer);\n  let hex = \"\";\n  for (const b of bytes) {\n    hex += b.toString(16).padStart(2, \"0\");\n  }\n  return hex;\n}\n","import type { PiiMode, Subject } from \"../types.js\";\nimport { hashEmailSha256, minimizeFormData, truncateIp } from \"../pii.js\";\n\n/**\n * Apply client-side PII mode to a subject before the wire.\n */\nexport async function prepareSubject(\n  subject: Subject,\n  piiMode: PiiMode,\n): Promise<Subject> {\n  if (piiMode === \"raw\") {\n    return subject;\n  }\n\n  if (piiMode === \"none\") {\n    return {\n      userAgent: subject.userAgent,\n      headers: pickWebBotAuthHeaders(subject.headers),\n    };\n  }\n\n  // hashed (default)\n  const prepared: Subject = {\n    userAgent: subject.userAgent,\n    headers: subject.headers,\n  };\n\n  if (subject.emailSha256) {\n    prepared.emailSha256 = subject.emailSha256;\n  } else if (subject.email) {\n    prepared.emailSha256 = await hashEmailSha256(subject.email);\n  }\n\n  if (subject.ipTrunc) {\n    prepared.ipTrunc = subject.ipTrunc;\n  } else if (subject.ip) {\n    prepared.ipTrunc = truncateIp(subject.ip);\n  }\n\n  const hashedForm = subject.formDataHashed ?? minimizeFormData(subject.formData);\n  if (hashedForm) {\n    prepared.formDataHashed = hashedForm;\n  }\n\n  return prepared;\n}\n\nfunction pickWebBotAuthHeaders(\n  headers?: Record<string, string | string[] | undefined>,\n): Record<string, string> | undefined {\n  if (!headers) return undefined;\n  const keys = [\"signature-agent\", \"signature-input\", \"signature\", \"signature-agent\"];\n  const out: Record<string, string> = {};\n  for (const [k, v] of Object.entries(headers)) {\n    const lower = k.toLowerCase();\n    if (keys.includes(lower) && typeof v === \"string\") {\n      out[lower] = v;\n    } else if (keys.includes(lower) && Array.isArray(v) && v[0]) {\n      out[lower] = v[0];\n    }\n  }\n  return Object.keys(out).length > 0 ? out : undefined;\n}\n\n/**\n * Normalize header maps (Node / Fetch) to plain string records for JSON.\n */\nexport function flattenHeaders(\n  headers?: Record<string, string | string[] | undefined> | Headers,\n): Record<string, string> | undefined {\n  if (!headers) return undefined;\n  if (headers instanceof Headers) {\n    const out: Record<string, string> = {};\n    headers.forEach((value, key) => {\n      out[key.toLowerCase()] = value;\n    });\n    return out;\n  }\n  const out: Record<string, string> = {};\n  for (const [k, v] of Object.entries(headers)) {\n    if (typeof v === \"string\") out[k.toLowerCase()] = v;\n    else if (Array.isArray(v) && v[0]) out[k.toLowerCase()] = v[0];\n  }\n  return out;\n}\n","/**\n * Client-side verdictToken verification (MVP-016).\n *\n * A verdictToken is an ES256 JWT decision receipt minted by the edge and bound\n * to session (`sub`), origin (`aud`), and `jti` with a short `exp`. This module\n * validates shape, signature (against the JWKS served from\n * GET /.well-known/jwks.json), expiry, session binding, and — when an expected\n * audience is supplied — origin binding. Rejection reasons are surfaced as\n * `VerdictTokenError.code`.\n */\n\nimport { ChitmarkError } from \"./errors.js\";\nimport type { ActorType, Decision } from \"./types.js\";\n\nexport interface VerdictTokenClaims {\n  eventId: string;\n  decision: Decision;\n  actorType: ActorType;\n  confidence: number;\n  aud: string;\n  sub: string;\n  jti: string;\n  iat: number;\n  exp: number;\n  degraded: boolean;\n}\n\nexport type VerdictTokenErrorCode =\n  | \"malformed_token\"\n  | \"wrong_algorithm\"\n  | \"jwks_unavailable\"\n  | \"unknown_kid\"\n  | \"invalid_signature\"\n  | \"expired\"\n  | \"not_yet_valid\"\n  | \"wrong_session\"\n  | \"wrong_aud\";\n\nexport class VerdictTokenError extends ChitmarkError {\n  override name = \"VerdictTokenError\";\n\n  constructor(code: VerdictTokenErrorCode, message: string) {\n    super(message, { code });\n  }\n}\n\nexport interface VerifyVerdictTokenOptions {\n  /** Expected session — token `sub` must equal this or verification fails. */\n  session?: string;\n  /** Expected origin — token `aud` must equal this or verification fails. */\n  aud?: string;\n  /** JWKS URL; defaults to https://api.chitmark.com/.well-known/jwks.json. */\n  jwksUrl?: string;\n  /** Pre-fetched JWKS; skips the network fetch when provided. */\n  jwks?: { keys: Array<Record<string, unknown>> };\n  /** Injectable fetch (Node 24+/browsers have a global). */\n  fetch?: typeof fetch;\n  /** Clock override for tests. */\n  nowMs?: number;\n  /** Clock skew tolerance in seconds; defaults to 30. */\n  leewaySeconds?: number;\n}\n\nconst DEFAULT_JWKS_URL = \"https://api.chitmark.com/.well-known/jwks.json\";\nconst DEFAULT_LEEWAY_SECONDS = 30;\n\nexport async function verifyVerdictToken(\n  token: string,\n  options: VerifyVerdictTokenOptions = {},\n): Promise<VerdictTokenClaims> {\n  const nowMs = options.nowMs ?? Date.now();\n  const leewaySeconds = options.leewaySeconds ?? DEFAULT_LEEWAY_SECONDS;\n\n  const parts = token.split(\".\");\n  if (parts.length !== 3) {\n    throw new VerdictTokenError(\"malformed_token\", \"verdictToken must be a JWT\");\n  }\n  const [headerB64, payloadB64, signatureB64] = parts as [string, string, string];\n\n  let header: Record<string, unknown>;\n  let payload: Record<string, unknown>;\n  try {\n    header = JSON.parse(decodeBase64Url(headerB64)) as Record<string, unknown>;\n    payload = JSON.parse(decodeBase64Url(payloadB64)) as Record<string, unknown>;\n  } catch {\n    throw new VerdictTokenError(\"malformed_token\", \"verdictToken is not valid JWT JSON\");\n  }\n\n  if (header[\"alg\"] !== \"ES256\") {\n    throw new VerdictTokenError(\n      \"wrong_algorithm\",\n      `verdictToken must use ES256, got ${String(header[\"alg\"])}`,\n    );\n  }\n  const kid = typeof header[\"kid\"] === \"string\" ? header[\"kid\"] : \"\";\n  if (!kid) {\n    throw new VerdictTokenError(\"unknown_kid\", \"verdictToken is missing kid\");\n  }\n\n  const exp = typeof payload[\"exp\"] === \"number\" ? payload[\"exp\"] : NaN;\n  const iat = typeof payload[\"iat\"] === \"number\" ? payload[\"iat\"] : NaN;\n  const nowSeconds = Math.floor(nowMs / 1000);\n  if (Number.isFinite(exp) && exp < nowSeconds - leewaySeconds) {\n    throw new VerdictTokenError(\"expired\", \"verdictToken has expired\");\n  }\n  if (Number.isFinite(iat) && iat > nowSeconds + leewaySeconds) {\n    throw new VerdictTokenError(\"not_yet_valid\", \"verdictToken iat is in the future\");\n  }\n\n  const expectedSession = options.session;\n  if (expectedSession !== undefined && payload[\"sub\"] !== expectedSession) {\n    throw new VerdictTokenError(\n      \"wrong_session\",\n      \"verdictToken was minted for a different session\",\n    );\n  }\n  const expectedAud = options.aud;\n  if (expectedAud !== undefined && payload[\"aud\"] !== expectedAud) {\n    throw new VerdictTokenError(\n      \"wrong_aud\",\n      \"verdictToken was minted for a different origin\",\n    );\n  }\n\n  const jwk = await findJwk(kid, options);\n  if (!jwk) {\n    throw new VerdictTokenError(\"unknown_kid\", `JWKS has no key for kid ${kid}`);\n  }\n\n  let publicKey: CryptoKey;\n  try {\n    publicKey = await crypto.subtle.importKey(\n      \"jwk\",\n      jwk as unknown as JsonWebKey,\n      { name: \"ECDSA\", namedCurve: \"P-256\" },\n      false,\n      [\"verify\"],\n    );\n  } catch {\n    throw new VerdictTokenError(\n      \"invalid_signature\",\n      \"JWKS key is not a valid P-256 public key\",\n    );\n  }\n\n  const signatureBytes = decodeBase64UrlBytes(signatureB64);\n  const signatureBuffer = new ArrayBuffer(signatureBytes.byteLength);\n  new Uint8Array(signatureBuffer).set(signatureBytes);\n\n  const valid = await crypto.subtle.verify(\n    { name: \"ECDSA\", hash: \"SHA-256\" },\n    publicKey,\n    signatureBuffer,\n    new TextEncoder().encode(`${headerB64}.${payloadB64}`),\n  );\n  if (!valid) {\n    throw new VerdictTokenError(\n      \"invalid_signature\",\n      \"verdictToken signature failed verification\",\n    );\n  }\n\n  return payload as unknown as VerdictTokenClaims;\n}\n\nasync function findJwk(\n  kid: string,\n  options: VerifyVerdictTokenOptions,\n): Promise<Record<string, unknown> | undefined> {\n  let jwks = options.jwks;\n  if (!jwks) {\n    const jwksUrl = options.jwksUrl ?? DEFAULT_JWKS_URL;\n    try {\n      const fetchImpl = options.fetch ?? globalThis.fetch.bind(globalThis);\n      const res = await fetchImpl(jwksUrl);\n      if (!res.ok) {\n        throw new Error(`JWKS fetch failed with ${res.status}`);\n      }\n      jwks = (await res.json()) as { keys: Array<Record<string, unknown>> };\n    } catch (err) {\n      throw new VerdictTokenError(\n        \"jwks_unavailable\",\n        `Failed to load JWKS from ${jwksUrl}: ${\n          err instanceof Error ? err.message : \"unknown error\"\n        }`,\n      );\n    }\n  }\n  if (!Array.isArray(jwks.keys)) {\n    throw new VerdictTokenError(\"jwks_unavailable\", \"JWKS response has no keys array\");\n  }\n  return jwks.keys.find((key) => key[\"kid\"] === kid);\n}\n\nfunction decodeBase64Url(value: string): string {\n  const normalized = value.replace(/-/g, \"+\").replace(/_/g, \"/\");\n  const padded = normalized + \"=\".repeat((4 - (normalized.length % 4)) % 4);\n  const binary = atob(padded);\n  return new TextDecoder().decode(Uint8Array.from(binary, (ch) => ch.charCodeAt(0)));\n}\n\nfunction decodeBase64UrlBytes(value: string): Uint8Array {\n  const normalized = value.replace(/-/g, \"+\").replace(/_/g, \"/\");\n  const padded = normalized + \"=\".repeat((4 - (normalized.length % 4)) % 4);\n  const binary = atob(padded);\n  const out = new Uint8Array(binary.length);\n  for (let i = 0; i < binary.length; i += 1) out[i] = binary.charCodeAt(i);\n  return out;\n}\n","import {\n  ChitmarkApiError,\n  ChitmarkError,\n  degradedChallengeVerdict,\n  enforceDegradedNeverAllow,\n} from \"./errors.js\";\nimport {\n  DEFAULT_TIMEOUT_MS,\n  SDK_VERSION,\n  envBaseUrl,\n  resolveBaseUrl,\n} from \"./internal/constants.js\";\nimport { flattenHeaders, prepareSubject } from \"./internal/prepare.js\";\nimport {\n  verifyVerdictToken,\n  type VerdictTokenClaims,\n  type VerifyVerdictTokenOptions,\n} from \"./verify-token.js\";\nimport type {\n  ChallengeRequest,\n  ChallengeResponse,\n  ChallengeCompletionResponse,\n  ChallengeProof,\n  ChitmarkOptions,\n  FeedbackRequest,\n  FeedbackResponse,\n  OnDegraded,\n  PiiMode,\n  Verdict,\n  VerifyRequest,\n} from \"./types.js\";\n\n/**\n * Official Chitmark client (Open Agent Ledger) — three verbs:\n * verify, feedback, challenge. Trust decisions on agent-mediated actions,\n * tuned by business outcomes.\n *\n * @example\n * ```ts\n * const chitmark = new Chitmark({ apiKey: process.env.CHITMARK_API_KEY! });\n * const verdict = await chitmark.verify({\n *   action: \"signup\",\n *   subject: { email, ip, userAgent },\n * });\n * ```\n */\nexport class Chitmark {\n  private readonly apiKey: string;\n  private readonly baseUrl: string;\n  private readonly timeoutMs: number;\n  private readonly piiMode: PiiMode;\n  private readonly onDegraded: OnDegraded;\n  private readonly fetchImpl: typeof fetch;\n  private readonly clientName: string;\n\n  constructor(options: ChitmarkOptions) {\n    if (!options.apiKey) {\n      throw new ChitmarkError(\"Chitmark apiKey is required\");\n    }\n    if (options.onDegraded && options.onDegraded !== \"challenge\") {\n      throw new ChitmarkError(\n        'onDegraded must be \"challenge\" — fail to challenge, never to allow',\n      );\n    }\n    this.apiKey = options.apiKey;\n    this.baseUrl = resolveBaseUrl(options.env, options.baseUrl ?? envBaseUrl());\n    this.timeoutMs = options.timeoutMs ?? DEFAULT_TIMEOUT_MS;\n    this.piiMode = options.piiMode ?? \"hashed\";\n    this.onDegraded = \"challenge\";\n    this.fetchImpl = options.fetch ?? globalThis.fetch.bind(globalThis);\n    this.clientName = options.clientName ?? `chitmark-node/${SDK_VERSION}`;\n  }\n\n  /**\n   * Score + route an inbound action (signup / trial / …).\n   * Hot path at the edge; client budget defaults to 800ms.\n   * On timeout/transport error — or a malformed verdict shape from the API —\n   * returns a degraded challenge verdict (never allow, never crashes).\n   *\n   * Persist `v.eventId` on the account row: feedback joins only on that id.\n   */\n  async verify(request: VerifyRequest): Promise<Verdict> {\n    const subject = await prepareSubject(\n      {\n        ...request.subject,\n        headers: flattenHeaders(request.subject.headers),\n      },\n      this.piiMode,\n    );\n\n    const body: VerifyRequest = {\n      ...request,\n      subject,\n    };\n\n    try {\n      const verdict = await this.request<Verdict>(\"/v1/verify\", {\n        method: \"POST\",\n        body,\n        idempotencyKey: request.idempotencyKey,\n      });\n      if (!isWellFormedVerdict(verdict)) {\n        return degradedChallengeVerdict(\n          \"Degraded: verify returned a malformed verdict shape\",\n          request.session,\n        );\n      }\n      return enforceDegradedNeverAllow(verdict);\n    } catch (err) {\n      if (err instanceof ChitmarkApiError) {\n        throw err;\n      }\n      return degradedChallengeVerdict(\n        err instanceof Error ? `Degraded: ${err.message}` : \"Degraded: verify failed\",\n        request.session,\n      );\n    }\n  }\n\n  /**\n   * Report a downstream outcome joined on the stored eventId from verify.\n   * This is the data moat — attribution is a schema contract, not a fuzzy match.\n   */\n  async feedback(request: FeedbackRequest): Promise<FeedbackResponse> {\n    return this.request<FeedbackResponse>(\"/v1/feedback\", {\n      method: \"POST\",\n      body: request,\n    });\n  }\n\n  /**\n   * Issue an asymmetric-cost challenge after decision === challenge | degraded.\n   */\n  async challenge(request: ChallengeRequest): Promise<ChallengeResponse> {\n    return this.request<ChallengeResponse>(\"/v1/challenge\", {\n      method: \"POST\",\n      body: request,\n    });\n  }\n\n  /**\n   * Complete a challenge by submitting its solved proof. Clears only the bound\n   * session, once. Re-verify with `context.challengeId` to have the next\n   * verify honor the cleared session.\n   */\n  async completeChallenge(request: {\n    eventId: string;\n    challengeId: string;\n    session?: string;\n    proof: ChallengeProof;\n  }): Promise<ChallengeCompletionResponse> {\n    return this.request<ChallengeCompletionResponse>(\"/v1/challenge\", {\n      method: \"POST\",\n      body: request,\n    });\n  }\n\n  /**\n   * Verify a verdictToken's signature against the API's JWKS and its session /\n   * origin binding (MVP-016). Rejects expired tokens, unknown kids, and\n   * invalid signatures with `VerdictTokenError`. Pass `session` to enforce\n   * session binding (recommended) and `aud` to enforce origin binding.\n   */\n  async verifyVerdictToken(\n    token: string,\n    options: Omit<VerifyVerdictTokenOptions, \"jwksUrl\" | \"fetch\"> = {},\n  ): Promise<VerdictTokenClaims> {\n    return verifyVerdictToken(token, {\n      ...options,\n      jwksUrl: `${this.baseUrl}/.well-known/jwks.json`,\n      fetch: this.fetchImpl,\n    });\n  }\n\n  /**\n   * Low-level HTTP helper. Prefer verify / feedback / challenge.\n   */\n  async request<T>(\n    path: string,\n    init: {\n      method: string;\n      body?: unknown;\n      idempotencyKey?: string;\n    },\n  ): Promise<T> {\n    const controller = new AbortController();\n    const timer = setTimeout(() => controller.abort(), this.timeoutMs);\n\n    try {\n      const headers: Record<string, string> = {\n        Authorization: `Bearer ${this.apiKey}`,\n        \"Content-Type\": \"application/json\",\n        Accept: \"application/json\",\n        \"User-Agent\": this.clientName,\n        \"X-Chitmark-Client\": this.clientName,\n      };\n      if (init.idempotencyKey) {\n        headers[\"Idempotency-Key\"] = init.idempotencyKey;\n      }\n\n      const res = await this.fetchImpl(`${this.baseUrl}${path}`, {\n        method: init.method,\n        headers,\n        body: init.body !== undefined ? JSON.stringify(init.body) : undefined,\n        signal: controller.signal,\n      });\n\n      const text = await res.text();\n      let parsed: unknown = undefined;\n      if (text) {\n        try {\n          parsed = JSON.parse(text) as unknown;\n        } catch {\n          parsed = text;\n        }\n      }\n\n      if (!res.ok) {\n        const errBody =\n          typeof parsed === \"object\" && parsed !== null\n            ? (parsed as { error?: string; message?: string; code?: string })\n            : text;\n        const normalized =\n          typeof errBody === \"string\"\n            ? errBody\n            : {\n                error: errBody.error ?? `http_${res.status}`,\n                message: errBody.message,\n                code: errBody.code,\n              };\n        throw new ChitmarkApiError(res.status, normalized);\n      }\n\n      return parsed as T;\n    } catch (err) {\n      if (err instanceof ChitmarkApiError) throw err;\n      if (err instanceof Error && err.name === \"AbortError\") {\n        throw new ChitmarkError(`Request timed out after ${this.timeoutMs}ms`, {\n          code: \"timeout\",\n        });\n      }\n      throw err instanceof Error\n        ? new ChitmarkError(err.message, { code: \"transport\" })\n        : new ChitmarkError(\"Unknown transport error\", { code: \"transport\" });\n    } finally {\n      clearTimeout(timer);\n    }\n  }\n\n  /** Public accessors for inspection / tests. */\n  get config(): {\n    baseUrl: string;\n    timeoutMs: number;\n    piiMode: PiiMode;\n    onDegraded: OnDegraded;\n  } {\n    return {\n      baseUrl: this.baseUrl,\n      timeoutMs: this.timeoutMs,\n      piiMode: this.piiMode,\n      onDegraded: this.onDegraded,\n    };\n  }\n}\n\nconst VERDICT_DECISIONS: ReadonlySet<string> = new Set([\"allow\", \"challenge\", \"deny\"]);\n\n/**\n * Minimal shape guard for a 200 verify response. A malformed verdict must\n * never be treated as allow — the gating fields are what gate correctness.\n */\nexport function isWellFormedVerdict(value: unknown): value is Verdict {\n  if (typeof value !== \"object\" || value === null) return false;\n  const v = value as Partial<Verdict>;\n  return (\n    typeof v.decision === \"string\" &&\n    VERDICT_DECISIONS.has(v.decision) &&\n    typeof v.eventId === \"string\" &&\n    v.eventId.length > 0 &&\n    typeof v.degraded === \"boolean\"\n  );\n}\n","import type { Verdict } from \"./types.js\";\n\nexport const CHITMARK_HTTP_STATUS = {\n  ok: 200,\n  created: 201,\n  badRequest: 400,\n  unauthorized: 401,\n  forbidden: 403,\n  notFound: 404,\n  conflict: 409,\n  preconditionRequired: 428,\n  tooManyRequests: 429,\n} as const;\n\nexport type ChitmarkHttpStatus =\n  (typeof CHITMARK_HTTP_STATUS)[keyof typeof CHITMARK_HTTP_STATUS];\n\nexport const CHITMARK_HTTP_STATUS_MEANING = {\n  ok: \"Request succeeded. For verify gates, continue only after an explicit non-degraded allow.\",\n  created: \"Resource was created after an explicit non-degraded allow.\",\n  badRequest: \"Required request fields are missing or malformed.\",\n  unauthorized: \"API key is missing or invalid.\",\n  forbidden: \"Verify returned deny; block the action.\",\n  notFound: \"Referenced Chitmark resource was not found.\",\n  conflict: \"Idempotency key was reused with a materially different payload.\",\n  preconditionRequired:\n    \"Verify returned challenge or degraded; require friction before continuing.\",\n  tooManyRequests: \"Request was rate limited.\",\n} as const satisfies Record<keyof typeof CHITMARK_HTTP_STATUS, string>;\n\nexport function verdictToHttpStatus(verdict: Verdict): ChitmarkHttpStatus {\n  if (verdict.degraded || verdict.decision === \"challenge\") {\n    return CHITMARK_HTTP_STATUS.preconditionRequired;\n  }\n  if (verdict.decision === \"deny\") return CHITMARK_HTTP_STATUS.forbidden;\n  return CHITMARK_HTTP_STATUS.ok;\n}\n","import { Chitmark } from \"./client.js\";\nimport type { Action, Verdict, VerifyRequest } from \"./types.js\";\nimport { flattenHeaders } from \"./internal/prepare.js\";\n\nexport interface VerifyRequestFromRequestOptions {\n  action: Action;\n  session?: string;\n  surface?: string;\n  context?: Record<string, unknown>;\n  /** Dedupes retries; one verdict per action attempt. Sent as header + body. */\n  idempotencyKey?: string;\n  /** Optional body used for email / formData when already parsed. */\n  body?: {\n    email?: string;\n    [key: string]: unknown;\n  };\n  /**\n   * Override subject fields. By default reads IP / UA / headers from the Request.\n   */\n  subject?: VerifyRequest[\"subject\"];\n}\n\n/**\n * Edge-oriented helpers for Cloudflare Workers and other Fetch-API runtimes.\n * Import via `@chitmark/sdk/edge`.\n *\n * @example\n * ```ts\n * import { Chitmark } from \"@chitmark/sdk/edge\";\n * const chitmark = new Chitmark({ apiKey: env.CHITMARK_API_KEY });\n * const v = await chitmark.verifyRequest(req, { action: \"signup\" });\n * ```\n */\nexport class ChitmarkEdge extends Chitmark {\n  /**\n   * Build a verify call from a Fetch Request (headers, IP, body fields).\n   */\n  async verifyRequest(\n    req: Request,\n    options: VerifyRequestFromRequestOptions,\n  ): Promise<Verdict> {\n    const url = new URL(req.url);\n    const ip =\n      req.headers.get(\"cf-connecting-ip\") ??\n      req.headers.get(\"x-forwarded-for\")?.split(\",\")[0]?.trim() ??\n      \"\";\n    const userAgent = req.headers.get(\"user-agent\") ?? \"\";\n    const headers = flattenHeaders(req.headers);\n\n    const subject = options.subject ?? {\n      email: options.body?.email,\n      ip,\n      userAgent,\n      headers,\n      formData: options.body,\n    };\n\n    return this.verify({\n      action: options.action,\n      session: options.session,\n      surface: options.surface ?? `${url.host}${url.pathname}`,\n      subject,\n      context: options.context,\n      idempotencyKey: options.idempotencyKey,\n    });\n  }\n}\n\nexport { ChitmarkEdge as Chitmark };\nexport * from \"./types.js\";\nexport * from \"./errors.js\";\nexport * from \"./pii.js\";\nexport * from \"./http-status.js\";\nexport * from \"./verify-token.js\";\nexport { Chitmark as ChitmarkCore } from \"./client.js\";\n"]}
+{"version":3,"sources":["../src/errors.ts","../src/internal/constants.ts","../src/pii.ts","../src/internal/prepare.ts","../src/verify-token.ts","../src/client.ts","../src/http-status.ts","../src/edge.ts"],"names":["out"],"mappings":";;;AAKO,IAAM,aAAA,GAAN,cAA4B,KAAA,CAAM;AAAA,EAC9B,IAAA,GAAO,eAAA;AAAA,EACP,MAAA;AAAA,EACA,IAAA;AAAA,EACA,IAAA;AAAA,EAET,WAAA,CACE,SACA,OAAA,EACA;AACA,IAAA,KAAA,CAAM,OAAO,CAAA;AACb,IAAA,IAAA,CAAK,SAAS,OAAA,EAAS,MAAA;AACvB,IAAA,IAAA,CAAK,OAAO,OAAA,EAAS,IAAA;AACrB,IAAA,IAAA,CAAK,OAAO,OAAA,EAAS,IAAA;AAAA,EACvB;AACF;AAKO,IAAM,gBAAA,GAAN,cAA+B,aAAA,CAAc;AAAA,EACzC,IAAA,GAAO,kBAAA;AAAA,EAEhB,WAAA,CAAY,MAAA,EAAgB,IAAA,EAAkC,OAAA,EAAkB;AAC9E,IAAA,MAAM,GAAA,GACJ,OAAA,KACC,OAAO,IAAA,KAAS,QAAA,GACb,IAAA,GACA,IAAA,CAAK,OAAA,IAAW,IAAA,CAAK,KAAA,IAAS,CAAA,oBAAA,EAAuB,MAAM,CAAA,CAAA,CAAA,CAAA;AACjE,IAAA,KAAA,CAAM,GAAA,EAAK;AAAA,MACT,MAAA;AAAA,MACA,MAAM,OAAO,IAAA,KAAS,WAAY,IAAA,CAAK,IAAA,IAAQ,KAAK,KAAA,GAAS,MAAA;AAAA,MAC7D;AAAA,KACD,CAAA;AAAA,EACH;AACF;AAMO,SAAS,wBAAA,CAAyB,QAAgB,OAAA,EAA2B;AAClF,EAAA,OAAO;AAAA,IACL,QAAA,EAAU,WAAA;AAAA,IACV,SAAA,EAAW,SAAA;AAAA,IACX,UAAA,EAAY,CAAA;AAAA,IACZ,OAAA,EAAS,CAAC,MAAM,CAAA;AAAA,IAChB,SAAA,EAAW;AAAA,MACT,QAAA,EAAU,KAAA;AAAA,MACV,aAAA,EAAe,CAAC,UAAU;AAAA,KAC5B;AAAA,IACA,YAAA,EAAc,EAAA;AAAA,IACd,OAAA,EAAS,CAAA,aAAA,EAAgB,OAAA,IAAW,SAAS,CAAA,CAAA;AAAA,IAC7C,QAAA,EAAU,IAAA;AAAA,IACV,eAAA,EAAiB;AAAA,GACnB;AACF;AAKO,SAAS,0BAA0B,OAAA,EAA2B;AACnE,EAAA,IAAI,OAAA,CAAQ,QAAA,IAAY,OAAA,CAAQ,QAAA,KAAa,OAAA,EAAS;AACpD,IAAA,OAAO;AAAA,MACL,GAAG,OAAA;AAAA,MACH,QAAA,EAAU,WAAA;AAAA,MACV,OAAA,EAAS;AAAA,QACP,GAAG,OAAA,CAAQ,OAAA;AAAA,QACX;AAAA;AACF,KACF;AAAA,EACF;AACA,EAAA,OAAO,OAAA;AACT;;;AC5EO,IAAM,iBAAA,GAAiD;AAAA,EAC5D,UAAA,EAAY,0BAAA;AAAA,EACZ,OAAA,EAAS,kCAAA;AAAA,EACT,WAAA,EAAa;AACf,CAAA;AAEO,IAAM,kBAAA,GAAqB,GAAA;AAE3B,IAAM,WAAA,GAAc,OAAA;AAEpB,SAAS,cAAA,CACd,GAAA,GAAmB,YAAA,EACnB,OAAA,EACQ;AACR,EAAA,OAAA,CAAQ,WAAW,iBAAA,CAAkB,GAAG,CAAA,EAAG,OAAA,CAAQ,OAAO,EAAE,CAAA;AAC9D;AAMO,SAAS,UAAA,GAAiC;AAC/C,EAAA,IAAI,OAAO,OAAA,KAAY,WAAA,EAAa,OAAO,MAAA;AAC3C,EAAA,MAAM,KAAA,GAAQ,QAAQ,GAAA,EAAK,iBAAA;AAC3B,EAAA,OAAO,KAAA,GAAQ,KAAA,CAAM,IAAA,EAAK,GAAI,MAAA;AAChC;;;AClBA,eAAsB,gBAAgB,KAAA,EAAgC;AACpE,EAAA,MAAM,UAAA,GAAa,KAAA,CAAM,IAAA,EAAK,CAAE,WAAA,EAAY;AAC5C,EAAA,MAAM,IAAA,GAAO,IAAI,WAAA,EAAY,CAAE,OAAO,UAAU,CAAA;AAChD,EAAA,MAAM,SAAS,MAAM,MAAA,CAAO,MAAA,CAAO,MAAA,CAAO,WAAW,IAAI,CAAA;AACzD,EAAA,OAAO,YAAY,MAAM,CAAA;AAC3B;AAKO,SAAS,WAAW,EAAA,EAAoB;AAC7C,EAAA,MAAM,OAAA,GAAU,GAAG,IAAA,EAAK;AAExB,EAAA,MAAM,KAAA,GAAQ,QAAQ,KAAA,CAAM,GAAG,EAAE,CAAC,CAAA,EAAG,MAAK,IAAK,OAAA;AAC/C,EAAA,IAAI,KAAA,CAAM,SAAS,GAAG,CAAA,IAAK,CAAC,KAAA,CAAM,QAAA,CAAS,GAAG,CAAA,EAAG;AAC/C,IAAA,MAAM,KAAA,GAAQ,KAAA,CAAM,KAAA,CAAM,GAAG,CAAA;AAC7B,IAAA,IAAI,KAAA,CAAM,WAAW,CAAA,EAAG;AACtB,MAAA,OAAO,CAAA,EAAG,KAAA,CAAM,CAAC,CAAC,CAAA,CAAA,EAAI,KAAA,CAAM,CAAC,CAAC,CAAA,CAAA,EAAI,KAAA,CAAM,CAAC,CAAC,CAAA,KAAA,CAAA;AAAA,IAC5C;AAAA,EACF;AAEA,EAAA,IAAI,KAAA,CAAM,QAAA,CAAS,GAAG,CAAA,EAAG;AACvB,IAAA,MAAM,UAAU,KAAA,CAAM,KAAA,CAAM,GAAG,CAAA,CAAE,OAAO,OAAO,CAAA;AAC/C,IAAA,MAAM,OAAO,OAAA,CAAQ,KAAA,CAAM,GAAG,CAAC,CAAA,CAAE,KAAK,GAAG,CAAA;AACzC,IAAA,OAAO,GAAG,IAAI,CAAA,KAAA,CAAA;AAAA,EAChB;AACA,EAAA,OAAO,KAAA;AACT;AAMO,SAAS,iBACd,QAAA,EACqC;AACrC,EAAA,IAAI,CAAC,UAAU,OAAO,MAAA;AACtB,EAAA,MAAM,OAAA,uBAAc,GAAA,CAAI;AAAA,IACtB,eAAA;AAAA,IACA,gBAAA;AAAA,IACA,QAAA;AAAA,IACA,MAAA;AAAA,IACA,UAAA;AAAA,IACA,YAAA;AAAA,IACA,YAAA;AAAA,IACA;AAAA,GACD,CAAA;AACD,EAAA,MAAM,MAA+B,EAAC;AACtC,EAAA,KAAA,MAAW,CAAC,GAAA,EAAK,KAAK,KAAK,MAAA,CAAO,OAAA,CAAQ,QAAQ,CAAA,EAAG;AACnD,IAAA,IAAI,OAAA,CAAQ,GAAA,CAAI,GAAG,CAAA,IAAK,SAAS,IAAA,EAAM;AACrC,MAAA,GAAA,CAAI,GAAG,CAAA,GAAI,KAAA;AAAA,IACb;AAAA,EACF;AACA,EAAA,OAAO,OAAO,IAAA,CAAK,GAAG,CAAA,CAAE,MAAA,GAAS,IAAI,GAAA,GAAM,MAAA;AAC7C;AAEA,SAAS,YAAY,MAAA,EAA6B;AAChD,EAAA,MAAM,KAAA,GAAQ,IAAI,UAAA,CAAW,MAAM,CAAA;AACnC,EAAA,IAAI,GAAA,GAAM,EAAA;AACV,EAAA,KAAA,MAAW,KAAK,KAAA,EAAO;AACrB,IAAA,GAAA,IAAO,EAAE,QAAA,CAAS,EAAE,CAAA,CAAE,QAAA,CAAS,GAAG,GAAG,CAAA;AAAA,EACvC;AACA,EAAA,OAAO,GAAA;AACT;;;AClEA,eAAsB,cAAA,CACpB,SACA,OAAA,EACkB;AAClB,EAAA,IAAI,YAAY,KAAA,EAAO;AACrB,IAAA,OAAO,OAAA;AAAA,EACT;AAEA,EAAA,IAAI,YAAY,MAAA,EAAQ;AACtB,IAAA,OAAO;AAAA,MACL,WAAW,OAAA,CAAQ,SAAA;AAAA,MACnB,OAAA,EAAS,qBAAA,CAAsB,OAAA,CAAQ,OAAO;AAAA,KAChD;AAAA,EACF;AAGA,EAAA,MAAM,QAAA,GAAoB;AAAA,IACxB,WAAW,OAAA,CAAQ,SAAA;AAAA,IACnB,SAAS,OAAA,CAAQ;AAAA,GACnB;AAEA,EAAA,IAAI,QAAQ,WAAA,EAAa;AACvB,IAAA,QAAA,CAAS,cAAc,OAAA,CAAQ,WAAA;AAAA,EACjC,CAAA,MAAA,IAAW,QAAQ,KAAA,EAAO;AACxB,IAAA,QAAA,CAAS,WAAA,GAAc,MAAM,eAAA,CAAgB,OAAA,CAAQ,KAAK,CAAA;AAAA,EAC5D;AAEA,EAAA,IAAI,QAAQ,OAAA,EAAS;AACnB,IAAA,QAAA,CAAS,UAAU,OAAA,CAAQ,OAAA;AAAA,EAC7B,CAAA,MAAA,IAAW,QAAQ,EAAA,EAAI;AACrB,IAAA,QAAA,CAAS,OAAA,GAAU,UAAA,CAAW,OAAA,CAAQ,EAAE,CAAA;AAAA,EAC1C;AAEA,EAAA,MAAM,UAAA,GAAa,OAAA,CAAQ,cAAA,IAAkB,gBAAA,CAAiB,QAAQ,QAAQ,CAAA;AAC9E,EAAA,IAAI,UAAA,EAAY;AACd,IAAA,QAAA,CAAS,cAAA,GAAiB,UAAA;AAAA,EAC5B;AAEA,EAAA,OAAO,QAAA;AACT;AAEA,SAAS,sBACP,OAAA,EACoC;AACpC,EAAA,IAAI,CAAC,SAAS,OAAO,MAAA;AACrB,EAAA,MAAM,IAAA,GAAO,CAAC,iBAAA,EAAmB,iBAAA,EAAmB,WAAW,CAAA;AAC/D,EAAA,MAAM,MAA8B,EAAC;AACrC,EAAA,KAAA,MAAW,CAAC,CAAA,EAAG,CAAC,KAAK,MAAA,CAAO,OAAA,CAAQ,OAAO,CAAA,EAAG;AAC5C,IAAA,MAAM,KAAA,GAAQ,EAAE,WAAA,EAAY;AAC5B,IAAA,IAAI,KAAK,QAAA,CAAS,KAAK,CAAA,IAAK,OAAO,MAAM,QAAA,EAAU;AACjD,MAAA,GAAA,CAAI,KAAK,CAAA,GAAI,CAAA;AAAA,IACf,CAAA,MAAA,IAAW,IAAA,CAAK,QAAA,CAAS,KAAK,CAAA,IAAK,KAAA,CAAM,OAAA,CAAQ,CAAC,CAAA,IAAK,CAAA,CAAE,CAAC,CAAA,EAAG;AAC3D,MAAA,GAAA,CAAI,KAAK,CAAA,GAAI,CAAA,CAAE,CAAC,CAAA;AAAA,IAClB;AAAA,EACF;AACA,EAAA,OAAO,OAAO,IAAA,CAAK,GAAG,CAAA,CAAE,MAAA,GAAS,IAAI,GAAA,GAAM,MAAA;AAC7C;AAKO,SAAS,eACd,OAAA,EACoC;AACpC,EAAA,IAAI,CAAC,SAAS,OAAO,MAAA;AACrB,EAAA,IAAI,mBAAmB,OAAA,EAAS;AAC9B,IAAA,MAAMA,OAA8B,EAAC;AACrC,IAAA,OAAA,CAAQ,OAAA,CAAQ,CAAC,KAAA,EAAO,GAAA,KAAQ;AAC9B,MAAAA,IAAAA,CAAI,GAAA,CAAI,WAAA,EAAa,CAAA,GAAI,KAAA;AAAA,IAC3B,CAAC,CAAA;AACD,IAAA,OAAOA,IAAAA;AAAA,EACT;AACA,EAAA,MAAM,MAA8B,EAAC;AACrC,EAAA,KAAA,MAAW,CAAC,CAAA,EAAG,CAAC,KAAK,MAAA,CAAO,OAAA,CAAQ,OAAO,CAAA,EAAG;AAC5C,IAAA,IAAI,OAAO,CAAA,KAAM,QAAA,MAAc,CAAA,CAAE,WAAA,EAAa,CAAA,GAAI,CAAA;AAAA,SAAA,IACzC,KAAA,CAAM,OAAA,CAAQ,CAAC,CAAA,IAAK,CAAA,CAAE,CAAC,CAAA,EAAG,GAAA,CAAI,CAAA,CAAE,WAAA,EAAa,CAAA,GAAI,EAAE,CAAC,CAAA;AAAA,EAC/D;AACA,EAAA,OAAO,GAAA;AACT;;;AC9CO,IAAM,iBAAA,GAAN,cAAgC,aAAA,CAAc;AAAA,EAC1C,IAAA,GAAO,mBAAA;AAAA,EAEhB,WAAA,CAAY,MAA6B,OAAA,EAAiB;AACxD,IAAA,KAAA,CAAM,OAAA,EAAS,EAAE,IAAA,EAAM,CAAA;AAAA,EACzB;AACF;AAmBA,IAAM,gBAAA,GAAmB,gDAAA;AACzB,IAAM,sBAAA,GAAyB,EAAA;AAE/B,eAAsB,kBAAA,CACpB,KAAA,EACA,OAAA,GAAqC,EAAC,EACT;AAC7B,EAAA,MAAM,KAAA,GAAQ,OAAA,CAAQ,KAAA,IAAS,IAAA,CAAK,GAAA,EAAI;AACxC,EAAA,MAAM,aAAA,GAAgB,QAAQ,aAAA,IAAiB,sBAAA;AAE/C,EAAA,MAAM,KAAA,GAAQ,KAAA,CAAM,KAAA,CAAM,GAAG,CAAA;AAC7B,EAAA,IAAI,KAAA,CAAM,WAAW,CAAA,EAAG;AACtB,IAAA,MAAM,IAAI,iBAAA,CAAkB,iBAAA,EAAmB,4BAA4B,CAAA;AAAA,EAC7E;AACA,EAAA,MAAM,CAAC,SAAA,EAAW,UAAA,EAAY,YAAY,CAAA,GAAI,KAAA;AAE9C,EAAA,IAAI,MAAA;AACJ,EAAA,IAAI,OAAA;AACJ,EAAA,IAAI;AACF,IAAA,MAAA,GAAS,IAAA,CAAK,KAAA,CAAM,eAAA,CAAgB,SAAS,CAAC,CAAA;AAC9C,IAAA,OAAA,GAAU,IAAA,CAAK,KAAA,CAAM,eAAA,CAAgB,UAAU,CAAC,CAAA;AAAA,EAClD,CAAA,CAAA,MAAQ;AACN,IAAA,MAAM,IAAI,iBAAA,CAAkB,iBAAA,EAAmB,oCAAoC,CAAA;AAAA,EACrF;AAEA,EAAA,IAAI,MAAA,CAAO,KAAK,CAAA,KAAM,OAAA,EAAS;AAC7B,IAAA,MAAM,IAAI,iBAAA;AAAA,MACR,iBAAA;AAAA,MACA,CAAA,iCAAA,EAAoC,MAAA,CAAO,MAAA,CAAO,KAAK,CAAC,CAAC,CAAA;AAAA,KAC3D;AAAA,EACF;AACA,EAAA,MAAM,GAAA,GAAM,OAAO,MAAA,CAAO,KAAK,MAAM,QAAA,GAAW,MAAA,CAAO,KAAK,CAAA,GAAI,EAAA;AAChE,EAAA,IAAI,CAAC,GAAA,EAAK;AACR,IAAA,MAAM,IAAI,iBAAA,CAAkB,aAAA,EAAe,6BAA6B,CAAA;AAAA,EAC1E;AAEA,EAAA,MAAM,GAAA,GAAM,OAAO,OAAA,CAAQ,KAAK,MAAM,QAAA,GAAW,OAAA,CAAQ,KAAK,CAAA,GAAI,GAAA;AAClE,EAAA,MAAM,GAAA,GAAM,OAAO,OAAA,CAAQ,KAAK,MAAM,QAAA,GAAW,OAAA,CAAQ,KAAK,CAAA,GAAI,GAAA;AAClE,EAAA,MAAM,UAAA,GAAa,IAAA,CAAK,KAAA,CAAM,KAAA,GAAQ,GAAI,CAAA;AAC1C,EAAA,IAAI,OAAO,QAAA,CAAS,GAAG,CAAA,IAAK,GAAA,GAAM,aAAa,aAAA,EAAe;AAC5D,IAAA,MAAM,IAAI,iBAAA,CAAkB,SAAA,EAAW,0BAA0B,CAAA;AAAA,EACnE;AACA,EAAA,IAAI,OAAO,QAAA,CAAS,GAAG,CAAA,IAAK,GAAA,GAAM,aAAa,aAAA,EAAe;AAC5D,IAAA,MAAM,IAAI,iBAAA,CAAkB,eAAA,EAAiB,mCAAmC,CAAA;AAAA,EAClF;AAEA,EAAA,MAAM,kBAAkB,OAAA,CAAQ,OAAA;AAChC,EAAA,IAAI,eAAA,KAAoB,MAAA,IAAa,OAAA,CAAQ,KAAK,MAAM,eAAA,EAAiB;AACvE,IAAA,MAAM,IAAI,iBAAA;AAAA,MACR,eAAA;AAAA,MACA;AAAA,KACF;AAAA,EACF;AACA,EAAA,MAAM,cAAc,OAAA,CAAQ,GAAA;AAC5B,EAAA,IAAI,WAAA,KAAgB,MAAA,IAAa,OAAA,CAAQ,KAAK,MAAM,WAAA,EAAa;AAC/D,IAAA,MAAM,IAAI,iBAAA;AAAA,MACR,WAAA;AAAA,MACA;AAAA,KACF;AAAA,EACF;AAEA,EAAA,MAAM,GAAA,GAAM,MAAM,OAAA,CAAQ,GAAA,EAAK,OAAO,CAAA;AACtC,EAAA,IAAI,CAAC,GAAA,EAAK;AACR,IAAA,MAAM,IAAI,iBAAA,CAAkB,aAAA,EAAe,CAAA,wBAAA,EAA2B,GAAG,CAAA,CAAE,CAAA;AAAA,EAC7E;AAEA,EAAA,IAAI,SAAA;AACJ,EAAA,IAAI;AACF,IAAA,SAAA,GAAY,MAAM,OAAO,MAAA,CAAO,SAAA;AAAA,MAC9B,KAAA;AAAA,MACA,GAAA;AAAA,MACA,EAAE,IAAA,EAAM,OAAA,EAAS,UAAA,EAAY,OAAA,EAAQ;AAAA,MACrC,KAAA;AAAA,MACA,CAAC,QAAQ;AAAA,KACX;AAAA,EACF,CAAA,CAAA,MAAQ;AACN,IAAA,MAAM,IAAI,iBAAA;AAAA,MACR,mBAAA;AAAA,MACA;AAAA,KACF;AAAA,EACF;AAEA,EAAA,MAAM,cAAA,GAAiB,qBAAqB,YAAY,CAAA;AACxD,EAAA,MAAM,eAAA,GAAkB,IAAI,WAAA,CAAY,cAAA,CAAe,UAAU,CAAA;AACjE,EAAA,IAAI,UAAA,CAAW,eAAe,CAAA,CAAE,GAAA,CAAI,cAAc,CAAA;AAElD,EAAA,MAAM,KAAA,GAAQ,MAAM,MAAA,CAAO,MAAA,CAAO,MAAA;AAAA,IAChC,EAAE,IAAA,EAAM,OAAA,EAAS,IAAA,EAAM,SAAA,EAAU;AAAA,IACjC,SAAA;AAAA,IACA,eAAA;AAAA,IACA,IAAI,aAAY,CAAE,MAAA,CAAO,GAAG,SAAS,CAAA,CAAA,EAAI,UAAU,CAAA,CAAE;AAAA,GACvD;AACA,EAAA,IAAI,CAAC,KAAA,EAAO;AACV,IAAA,MAAM,IAAI,iBAAA;AAAA,MACR,mBAAA;AAAA,MACA;AAAA,KACF;AAAA,EACF;AAEA,EAAA,OAAO,OAAA;AACT;AAEA,eAAe,OAAA,CACb,KACA,OAAA,EAC8C;AAC9C,EAAA,IAAI,OAAO,OAAA,CAAQ,IAAA;AACnB,EAAA,IAAI,CAAC,IAAA,EAAM;AACT,IAAA,MAAM,OAAA,GAAU,QAAQ,OAAA,IAAW,gBAAA;AACnC,IAAA,IAAI;AACF,MAAA,MAAM,YAAY,OAAA,CAAQ,KAAA,IAAS,UAAA,CAAW,KAAA,CAAM,KAAK,UAAU,CAAA;AACnE,MAAA,MAAM,GAAA,GAAM,MAAM,SAAA,CAAU,OAAO,CAAA;AACnC,MAAA,IAAI,CAAC,IAAI,EAAA,EAAI;AACX,QAAA,MAAM,IAAI,KAAA,CAAM,CAAA,uBAAA,EAA0B,GAAA,CAAI,MAAM,CAAA,CAAE,CAAA;AAAA,MACxD;AACA,MAAA,IAAA,GAAQ,MAAM,IAAI,IAAA,EAAK;AAAA,IACzB,SAAS,GAAA,EAAK;AACZ,MAAA,MAAM,IAAI,iBAAA;AAAA,QACR,kBAAA;AAAA,QACA,4BAA4B,OAAO,CAAA,EAAA,EACjC,eAAe,KAAA,GAAQ,GAAA,CAAI,UAAU,eACvC,CAAA;AAAA,OACF;AAAA,IACF;AAAA,EACF;AACA,EAAA,IAAI,CAAC,KAAA,CAAM,OAAA,CAAQ,IAAA,CAAK,IAAI,CAAA,EAAG;AAC7B,IAAA,MAAM,IAAI,iBAAA,CAAkB,kBAAA,EAAoB,iCAAiC,CAAA;AAAA,EACnF;AACA,EAAA,OAAO,IAAA,CAAK,KAAK,IAAA,CAAK,CAAC,QAAQ,GAAA,CAAI,KAAK,MAAM,GAAG,CAAA;AACnD;AAEA,SAAS,gBAAgB,KAAA,EAAuB;AAC9C,EAAA,MAAM,UAAA,GAAa,MAAM,OAAA,CAAQ,IAAA,EAAM,GAAG,CAAA,CAAE,OAAA,CAAQ,MAAM,GAAG,CAAA;AAC7D,EAAA,MAAM,MAAA,GAAS,aAAa,GAAA,CAAI,MAAA,CAAA,CAAQ,IAAK,UAAA,CAAW,MAAA,GAAS,KAAM,CAAC,CAAA;AACxE,EAAA,MAAM,MAAA,GAAS,KAAK,MAAM,CAAA;AAC1B,EAAA,OAAO,IAAI,WAAA,EAAY,CAAE,MAAA,CAAO,UAAA,CAAW,IAAA,CAAK,MAAA,EAAQ,CAAC,EAAA,KAAO,EAAA,CAAG,UAAA,CAAW,CAAC,CAAC,CAAC,CAAA;AACnF;AAEA,SAAS,qBAAqB,KAAA,EAA2B;AACvD,EAAA,MAAM,UAAA,GAAa,MAAM,OAAA,CAAQ,IAAA,EAAM,GAAG,CAAA,CAAE,OAAA,CAAQ,MAAM,GAAG,CAAA;AAC7D,EAAA,MAAM,MAAA,GAAS,aAAa,GAAA,CAAI,MAAA,CAAA,CAAQ,IAAK,UAAA,CAAW,MAAA,GAAS,KAAM,CAAC,CAAA;AACxE,EAAA,MAAM,MAAA,GAAS,KAAK,MAAM,CAAA;AAC1B,EAAA,MAAM,GAAA,GAAM,IAAI,UAAA,CAAW,MAAA,CAAO,MAAM,CAAA;AACxC,EAAA,KAAA,IAAS,CAAA,GAAI,CAAA,EAAG,CAAA,GAAI,MAAA,CAAO,MAAA,EAAQ,CAAA,IAAK,CAAA,EAAG,GAAA,CAAI,CAAC,CAAA,GAAI,MAAA,CAAO,UAAA,CAAW,CAAC,CAAA;AACvE,EAAA,OAAO,GAAA;AACT;;;AClKO,IAAM,WAAN,MAAe;AAAA,EACH,MAAA;AAAA,EACA,OAAA;AAAA,EACA,SAAA;AAAA,EACA,OAAA;AAAA,EACA,UAAA;AAAA,EACA,SAAA;AAAA,EACA,UAAA;AAAA,EAEjB,YAAY,OAAA,EAA0B;AACpC,IAAA,IAAI,CAAC,QAAQ,MAAA,EAAQ;AACnB,MAAA,MAAM,IAAI,cAAc,6BAA6B,CAAA;AAAA,IACvD;AACA,IAAA,IAAI,OAAA,CAAQ,UAAA,IAAc,OAAA,CAAQ,UAAA,KAAe,WAAA,EAAa;AAC5D,MAAA,MAAM,IAAI,aAAA;AAAA,QACR;AAAA,OACF;AAAA,IACF;AACA,IAAA,IAAA,CAAK,SAAS,OAAA,CAAQ,MAAA;AACtB,IAAA,IAAA,CAAK,UAAU,cAAA,CAAe,OAAA,CAAQ,KAAK,OAAA,CAAQ,OAAA,IAAW,YAAY,CAAA;AAC1E,IAAA,IAAA,CAAK,SAAA,GAAY,QAAQ,SAAA,IAAa,kBAAA;AACtC,IAAA,IAAA,CAAK,OAAA,GAAU,QAAQ,OAAA,IAAW,QAAA;AAClC,IAAA,IAAA,CAAK,UAAA,GAAa,WAAA;AAClB,IAAA,IAAA,CAAK,YAAY,OAAA,CAAQ,KAAA,IAAS,UAAA,CAAW,KAAA,CAAM,KAAK,UAAU,CAAA;AAClE,IAAA,IAAA,CAAK,UAAA,GAAa,OAAA,CAAQ,UAAA,IAAc,CAAA,cAAA,EAAiB,WAAW,CAAA,CAAA;AAAA,EACtE;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAUA,MAAM,OAAO,OAAA,EAA0C;AACrD,IAAA,MAAM,UAAU,MAAM,cAAA;AAAA,MACpB;AAAA,QACE,GAAG,OAAA,CAAQ,OAAA;AAAA,QACX,OAAA,EAAS,cAAA,CAAe,OAAA,CAAQ,OAAA,CAAQ,OAAO;AAAA,OACjD;AAAA,MACA,IAAA,CAAK;AAAA,KACP;AAEA,IAAA,MAAM,IAAA,GAAsB;AAAA,MAC1B,GAAG,OAAA;AAAA,MACH;AAAA,KACF;AAEA,IAAA,IAAI;AACF,MAAA,MAAM,OAAA,GAAU,MAAM,IAAA,CAAK,OAAA,CAAiB,YAAA,EAAc;AAAA,QACxD,MAAA,EAAQ,MAAA;AAAA,QACR,IAAA;AAAA,QACA,gBAAgB,OAAA,CAAQ;AAAA,OACzB,CAAA;AACD,MAAA,IAAI,CAAC,mBAAA,CAAoB,OAAO,CAAA,EAAG;AACjC,QAAA,OAAO,wBAAA;AAAA,UACL,qDAAA;AAAA,UACA,OAAA,CAAQ;AAAA,SACV;AAAA,MACF;AACA,MAAA,OAAO,0BAA0B,OAAO,CAAA;AAAA,IAC1C,SAAS,GAAA,EAAK;AACZ,MAAA,IAAI,eAAe,gBAAA,EAAkB;AACnC,QAAA,MAAM,GAAA;AAAA,MACR;AACA,MAAA,OAAO,wBAAA;AAAA,QACL,GAAA,YAAe,KAAA,GAAQ,CAAA,UAAA,EAAa,GAAA,CAAI,OAAO,CAAA,CAAA,GAAK,yBAAA;AAAA,QACpD,OAAA,CAAQ;AAAA,OACV;AAAA,IACF;AAAA,EACF;AAAA;AAAA;AAAA;AAAA;AAAA,EAMA,MAAM,SAAS,OAAA,EAAqD;AAClE,IAAA,OAAO,IAAA,CAAK,QAA0B,cAAA,EAAgB;AAAA,MACpD,MAAA,EAAQ,MAAA;AAAA,MACR,IAAA,EAAM;AAAA,KACP,CAAA;AAAA,EACH;AAAA;AAAA;AAAA;AAAA,EAKA,MAAM,UAAU,OAAA,EAAuD;AACrE,IAAA,OAAO,IAAA,CAAK,QAA2B,eAAA,EAAiB;AAAA,MACtD,MAAA,EAAQ,MAAA;AAAA,MACR,IAAA,EAAM;AAAA,KACP,CAAA;AAAA,EACH;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAOA,MAAM,kBAAkB,OAAA,EAKiB;AACvC,IAAA,OAAO,IAAA,CAAK,QAAqC,eAAA,EAAiB;AAAA,MAChE,MAAA,EAAQ,MAAA;AAAA,MACR,IAAA,EAAM;AAAA,KACP,CAAA;AAAA,EACH;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAQA,MAAM,kBAAA,CACJ,KAAA,EACA,OAAA,GAAgE,EAAC,EACpC;AAC7B,IAAA,OAAO,mBAAmB,KAAA,EAAO;AAAA,MAC/B,GAAG,OAAA;AAAA,MACH,OAAA,EAAS,CAAA,EAAG,IAAA,CAAK,OAAO,CAAA,sBAAA,CAAA;AAAA,MACxB,OAAO,IAAA,CAAK;AAAA,KACb,CAAA;AAAA,EACH;AAAA;AAAA;AAAA;AAAA,EAKA,MAAM,OAAA,CACJ,IAAA,EACA,IAAA,EAKY;AACZ,IAAA,MAAM,UAAA,GAAa,IAAI,eAAA,EAAgB;AACvC,IAAA,MAAM,QAAQ,UAAA,CAAW,MAAM,WAAW,KAAA,EAAM,EAAG,KAAK,SAAS,CAAA;AAEjE,IAAA,IAAI;AACF,MAAA,MAAM,OAAA,GAAkC;AAAA,QACtC,aAAA,EAAe,CAAA,OAAA,EAAU,IAAA,CAAK,MAAM,CAAA,CAAA;AAAA,QACpC,cAAA,EAAgB,kBAAA;AAAA,QAChB,MAAA,EAAQ,kBAAA;AAAA,QACR,cAAc,IAAA,CAAK,UAAA;AAAA,QACnB,qBAAqB,IAAA,CAAK;AAAA,OAC5B;AACA,MAAA,IAAI,KAAK,cAAA,EAAgB;AACvB,QAAA,OAAA,CAAQ,iBAAiB,IAAI,IAAA,CAAK,cAAA;AAAA,MACpC;AAEA,MAAA,MAAM,GAAA,GAAM,MAAM,IAAA,CAAK,SAAA,CAAU,GAAG,IAAA,CAAK,OAAO,CAAA,EAAG,IAAI,CAAA,CAAA,EAAI;AAAA,QACzD,QAAQ,IAAA,CAAK,MAAA;AAAA,QACb,OAAA;AAAA,QACA,IAAA,EAAM,KAAK,IAAA,KAAS,KAAA,CAAA,GAAY,KAAK,SAAA,CAAU,IAAA,CAAK,IAAI,CAAA,GAAI,KAAA,CAAA;AAAA,QAC5D,QAAQ,UAAA,CAAW;AAAA,OACpB,CAAA;AAED,MAAA,MAAM,IAAA,GAAO,MAAM,GAAA,CAAI,IAAA,EAAK;AAC5B,MAAA,IAAI,MAAA,GAAkB,KAAA,CAAA;AACtB,MAAA,IAAI,IAAA,EAAM;AACR,QAAA,IAAI;AACF,UAAA,MAAA,GAAS,IAAA,CAAK,MAAM,IAAI,CAAA;AAAA,QAC1B,CAAA,CAAA,MAAQ;AACN,UAAA,MAAA,GAAS,IAAA;AAAA,QACX;AAAA,MACF;AAEA,MAAA,IAAI,CAAC,IAAI,EAAA,EAAI;AACX,QAAA,MAAM,UACJ,OAAO,MAAA,KAAW,QAAA,IAAY,MAAA,KAAW,OACpC,MAAA,GACD,IAAA;AACN,QAAA,MAAM,UAAA,GACJ,OAAO,OAAA,KAAY,QAAA,GACf,OAAA,GACA;AAAA,UACE,KAAA,EAAO,OAAA,CAAQ,KAAA,IAAS,CAAA,KAAA,EAAQ,IAAI,MAAM,CAAA,CAAA;AAAA,UAC1C,SAAS,OAAA,CAAQ,OAAA;AAAA,UACjB,MAAM,OAAA,CAAQ;AAAA,SAChB;AACN,QAAA,MAAM,IAAI,gBAAA,CAAiB,GAAA,CAAI,MAAA,EAAQ,UAAU,CAAA;AAAA,MACnD;AAEA,MAAA,OAAO,MAAA;AAAA,IACT,SAAS,GAAA,EAAK;AACZ,MAAA,IAAI,GAAA,YAAe,kBAAkB,MAAM,GAAA;AAC3C,MAAA,IAAI,GAAA,YAAe,KAAA,IAAS,GAAA,CAAI,IAAA,KAAS,YAAA,EAAc;AACrD,QAAA,MAAM,IAAI,aAAA,CAAc,CAAA,wBAAA,EAA2B,IAAA,CAAK,SAAS,CAAA,EAAA,CAAA,EAAM;AAAA,UACrE,IAAA,EAAM;AAAA,SACP,CAAA;AAAA,MACH;AACA,MAAA,MAAM,eAAe,KAAA,GACjB,IAAI,aAAA,CAAc,GAAA,CAAI,SAAS,EAAE,IAAA,EAAM,WAAA,EAAa,IACpD,IAAI,aAAA,CAAc,2BAA2B,EAAE,IAAA,EAAM,aAAa,CAAA;AAAA,IACxE,CAAA,SAAE;AACA,MAAA,YAAA,CAAa,KAAK,CAAA;AAAA,IACpB;AAAA,EACF;AAAA;AAAA,EAGA,IAAI,MAAA,GAKF;AACA,IAAA,OAAO;AAAA,MACL,SAAS,IAAA,CAAK,OAAA;AAAA,MACd,WAAW,IAAA,CAAK,SAAA;AAAA,MAChB,SAAS,IAAA,CAAK,OAAA;AAAA,MACd,YAAY,IAAA,CAAK;AAAA,KACnB;AAAA,EACF;AACF;AAEA,IAAM,oCAAyC,IAAI,GAAA,CAAI,CAAC,OAAA,EAAS,WAAA,EAAa,MAAM,CAAC,CAAA;AAM9E,SAAS,oBAAoB,KAAA,EAAkC;AACpE,EAAA,IAAI,OAAO,KAAA,KAAU,QAAA,IAAY,KAAA,KAAU,MAAM,OAAO,KAAA;AACxD,EAAA,MAAM,CAAA,GAAI,KAAA;AACV,EAAA,OACE,OAAO,CAAA,CAAE,QAAA,KAAa,YACtB,iBAAA,CAAkB,GAAA,CAAI,EAAE,QAAQ,CAAA,IAChC,OAAO,CAAA,CAAE,OAAA,KAAY,YACrB,CAAA,CAAE,OAAA,CAAQ,SAAS,CAAA,IACnB,OAAO,EAAE,QAAA,KAAa,SAAA;AAE1B;;;ACvRO,IAAM,oBAAA,GAAuB;AAAA,EAClC,EAAA,EAAI,GAAA;AAAA,EACJ,OAAA,EAAS,GAAA;AAAA,EACT,UAAA,EAAY,GAAA;AAAA,EACZ,YAAA,EAAc,GAAA;AAAA,EACd,SAAA,EAAW,GAAA;AAAA,EACX,QAAA,EAAU,GAAA;AAAA,EACV,QAAA,EAAU,GAAA;AAAA,EACV,oBAAA,EAAsB,GAAA;AAAA,EACtB,eAAA,EAAiB;AACnB;AAKO,IAAM,4BAAA,GAA+B;AAAA,EAC1C,EAAA,EAAI,0FAAA;AAAA,EACJ,OAAA,EAAS,4DAAA;AAAA,EACT,UAAA,EAAY,mDAAA;AAAA,EACZ,YAAA,EAAc,gCAAA;AAAA,EACd,SAAA,EAAW,yCAAA;AAAA,EACX,QAAA,EAAU,6CAAA;AAAA,EACV,QAAA,EAAU,iEAAA;AAAA,EACV,oBAAA,EACE,4EAAA;AAAA,EACF,eAAA,EAAiB;AACnB;AAEO,SAAS,oBAAoB,OAAA,EAAsC;AACxE,EAAA,IAAI,OAAA,CAAQ,QAAA,IAAY,OAAA,CAAQ,QAAA,KAAa,WAAA,EAAa;AACxD,IAAA,OAAO,oBAAA,CAAqB,oBAAA;AAAA,EAC9B;AACA,EAAA,IAAI,OAAA,CAAQ,QAAA,KAAa,MAAA,EAAQ,OAAO,oBAAA,CAAqB,SAAA;AAC7D,EAAA,OAAO,oBAAA,CAAqB,EAAA;AAC9B;;;ACHO,IAAM,YAAA,GAAN,cAA2B,QAAA,CAAS;AAAA;AAAA;AAAA;AAAA,EAIzC,MAAM,aAAA,CACJ,GAAA,EACA,OAAA,EACkB;AAClB,IAAA,MAAM,GAAA,GAAM,IAAI,GAAA,CAAI,GAAA,CAAI,GAAG,CAAA;AAC3B,IAAA,MAAM,KACJ,GAAA,CAAI,OAAA,CAAQ,GAAA,CAAI,kBAAkB,KAClC,GAAA,CAAI,OAAA,CAAQ,GAAA,CAAI,iBAAiB,GAAG,KAAA,CAAM,GAAG,EAAE,CAAC,CAAA,EAAG,MAAK,IACxD,EAAA;AACF,IAAA,MAAM,SAAA,GAAY,GAAA,CAAI,OAAA,CAAQ,GAAA,CAAI,YAAY,CAAA,IAAK,EAAA;AACnD,IAAA,MAAM,OAAA,GAAU,cAAA,CAAe,GAAA,CAAI,OAAO,CAAA;AAE1C,IAAA,MAAM,OAAA,GAAU,QAAQ,OAAA,IAAW;AAAA,MACjC,KAAA,EAAO,QAAQ,IAAA,EAAM,KAAA;AAAA,MACrB,EAAA;AAAA,MACA,SAAA;AAAA,MACA,OAAA;AAAA,MACA,UAAU,OAAA,CAAQ;AAAA,KACpB;AAEA,IAAA,OAAO,KAAK,MAAA,CAAO;AAAA,MACjB,QAAQ,OAAA,CAAQ,MAAA;AAAA,MAChB,SAAS,OAAA,CAAQ,OAAA;AAAA,MACjB,OAAA,EAAS,QAAQ,OAAA,IAAW,CAAA,EAAG,IAAI,IAAI,CAAA,EAAG,IAAI,QAAQ,CAAA,CAAA;AAAA,MACtD,OAAA;AAAA,MACA,SAAS,OAAA,CAAQ,OAAA;AAAA,MACjB,gBAAgB,OAAA,CAAQ;AAAA,KACzB,CAAA;AAAA,EACH;AACF","file":"edge.cjs","sourcesContent":["import type { ChitmarkErrorBody, Decision, Verdict } from \"./types.js\";\n\n/**\n * Base error for all Chitmark client failures.\n */\nexport class ChitmarkError extends Error {\n  override name = \"ChitmarkError\";\n  readonly status?: number;\n  readonly code?: string;\n  readonly body?: ChitmarkErrorBody | string;\n\n  constructor(\n    message: string,\n    options?: { status?: number; code?: string; body?: ChitmarkErrorBody | string },\n  ) {\n    super(message);\n    this.status = options?.status;\n    this.code = options?.code;\n    this.body = options?.body;\n  }\n}\n\n/**\n * Raised when the API returns a non-2xx response.\n */\nexport class ChitmarkApiError extends ChitmarkError {\n  override name = \"ChitmarkApiError\";\n\n  constructor(status: number, body: ChitmarkErrorBody | string, message?: string) {\n    const msg =\n      message ??\n      (typeof body === \"string\"\n        ? body\n        : body.message || body.error || `Chitmark API error (${status})`);\n    super(msg, {\n      status,\n      code: typeof body === \"object\" ? (body.code ?? body.error) : undefined,\n      body,\n    });\n  }\n}\n\n/**\n * Build the degraded challenge verdict used on timeout / transport failure.\n * Golden rule: fail to challenge, never to allow.\n */\nexport function degradedChallengeVerdict(reason: string, session?: string): Verdict {\n  return {\n    decision: \"challenge\" satisfies Decision,\n    actorType: \"unknown\",\n    confidence: 0,\n    reasons: [reason],\n    principal: {\n      resolved: false,\n      identityBasis: [\"degraded\"],\n    },\n    verdictToken: \"\",\n    eventId: `evt_degraded_${session ?? \"unknown\"}`,\n    degraded: true,\n    enforcementMode: \"enforce\",\n  };\n}\n\n/**\n * Ensure degraded responses never surface as allow (defense in depth client-side).\n */\nexport function enforceDegradedNeverAllow(verdict: Verdict): Verdict {\n  if (verdict.degraded && verdict.decision === \"allow\") {\n    return {\n      ...verdict,\n      decision: \"challenge\",\n      reasons: [\n        ...verdict.reasons,\n        \"Client enforced: degraded decision must not be allow\",\n      ],\n    };\n  }\n  return verdict;\n}\n","import type { ChitmarkEnv } from \"../types.js\";\n\nexport const DEFAULT_BASE_URLS: Record<ChitmarkEnv, string> = {\n  production: \"https://api.chitmark.com\",\n  staging: \"https://api.staging.chitmark.com\",\n  development: \"http://127.0.0.1:8787\",\n};\n\nexport const DEFAULT_TIMEOUT_MS = 800;\n/** Keep in parity with the package version and the Python SDK. */\nexport const SDK_VERSION = \"0.5.0\";\n\nexport function resolveBaseUrl(\n  env: ChitmarkEnv = \"production\",\n  baseUrl?: string,\n): string {\n  return (baseUrl ?? DEFAULT_BASE_URLS[env]).replace(/\\/$/, \"\");\n}\n\n/**\n * CHITMARK_BASE_URL environment override, when present (Node only, no-op on\n * Workers/browsers where `process` is undefined).\n */\nexport function envBaseUrl(): string | undefined {\n  if (typeof process === \"undefined\") return undefined;\n  const value = process.env?.CHITMARK_BASE_URL;\n  return value ? value.trim() : undefined;\n}\n","/**\n * Client-side PII minimization helpers.\n * Default SDK mode hashes email and truncates IP before leaving the customer process.\n */\n\n/**\n * SHA-256 hex digest of lowercased, trimmed email.\n * Uses Web Crypto (Node 18+, browsers, Workers).\n */\nexport async function hashEmailSha256(email: string): Promise<string> {\n  const normalized = email.trim().toLowerCase();\n  const data = new TextEncoder().encode(normalized);\n  const digest = await crypto.subtle.digest(\"SHA-256\", data);\n  return bufferToHex(digest);\n}\n\n/**\n * Truncate IPv4 to /24 or IPv6 to /48 for coarse geo without host identity.\n */\nexport function truncateIp(ip: string): string {\n  const trimmed = ip.trim();\n  // IPv4 (optionally from x-forwarded-for first hop)\n  const first = trimmed.split(\",\")[0]?.trim() ?? trimmed;\n  if (first.includes(\".\") && !first.includes(\":\")) {\n    const parts = first.split(\".\");\n    if (parts.length === 4) {\n      return `${parts[0]}.${parts[1]}.${parts[2]}.0/24`;\n    }\n  }\n  // IPv6: keep first 3 hextets (~/48)\n  if (first.includes(\":\")) {\n    const hextets = first.split(\":\").filter(Boolean);\n    const head = hextets.slice(0, 3).join(\":\");\n    return `${head}::/48`;\n  }\n  return first;\n}\n\n/**\n * Reduce form payload to non-PII keys (domain-style fields only for hashed mode).\n * Free-text is dropped; companyDomain-style keys are kept as-is when domain-like.\n */\nexport function minimizeFormData(\n  formData: Record<string, unknown> | undefined,\n): Record<string, unknown> | undefined {\n  if (!formData) return undefined;\n  const allowed = new Set([\n    \"companyDomain\",\n    \"company_domain\",\n    \"domain\",\n    \"plan\",\n    \"referrer\",\n    \"utm_source\",\n    \"utm_medium\",\n    \"utm_campaign\",\n  ]);\n  const out: Record<string, unknown> = {};\n  for (const [key, value] of Object.entries(formData)) {\n    if (allowed.has(key) && value != null) {\n      out[key] = value;\n    }\n  }\n  return Object.keys(out).length > 0 ? out : undefined;\n}\n\nfunction bufferToHex(buffer: ArrayBuffer): string {\n  const bytes = new Uint8Array(buffer);\n  let hex = \"\";\n  for (const b of bytes) {\n    hex += b.toString(16).padStart(2, \"0\");\n  }\n  return hex;\n}\n","import type { PiiMode, Subject } from \"../types.js\";\nimport { hashEmailSha256, minimizeFormData, truncateIp } from \"../pii.js\";\n\n/**\n * Apply client-side PII mode to a subject before the wire.\n */\nexport async function prepareSubject(\n  subject: Subject,\n  piiMode: PiiMode,\n): Promise<Subject> {\n  if (piiMode === \"raw\") {\n    return subject;\n  }\n\n  if (piiMode === \"none\") {\n    return {\n      userAgent: subject.userAgent,\n      headers: pickWebBotAuthHeaders(subject.headers),\n    };\n  }\n\n  // hashed (default)\n  const prepared: Subject = {\n    userAgent: subject.userAgent,\n    headers: subject.headers,\n  };\n\n  if (subject.emailSha256) {\n    prepared.emailSha256 = subject.emailSha256;\n  } else if (subject.email) {\n    prepared.emailSha256 = await hashEmailSha256(subject.email);\n  }\n\n  if (subject.ipTrunc) {\n    prepared.ipTrunc = subject.ipTrunc;\n  } else if (subject.ip) {\n    prepared.ipTrunc = truncateIp(subject.ip);\n  }\n\n  const hashedForm = subject.formDataHashed ?? minimizeFormData(subject.formData);\n  if (hashedForm) {\n    prepared.formDataHashed = hashedForm;\n  }\n\n  return prepared;\n}\n\nfunction pickWebBotAuthHeaders(\n  headers?: Record<string, string | string[] | undefined>,\n): Record<string, string> | undefined {\n  if (!headers) return undefined;\n  const keys = [\"signature-agent\", \"signature-input\", \"signature\"];\n  const out: Record<string, string> = {};\n  for (const [k, v] of Object.entries(headers)) {\n    const lower = k.toLowerCase();\n    if (keys.includes(lower) && typeof v === \"string\") {\n      out[lower] = v;\n    } else if (keys.includes(lower) && Array.isArray(v) && v[0]) {\n      out[lower] = v[0];\n    }\n  }\n  return Object.keys(out).length > 0 ? out : undefined;\n}\n\n/**\n * Normalize header maps (Node / Fetch) to plain string records for JSON.\n */\nexport function flattenHeaders(\n  headers?: Record<string, string | string[] | undefined> | Headers,\n): Record<string, string> | undefined {\n  if (!headers) return undefined;\n  if (headers instanceof Headers) {\n    const out: Record<string, string> = {};\n    headers.forEach((value, key) => {\n      out[key.toLowerCase()] = value;\n    });\n    return out;\n  }\n  const out: Record<string, string> = {};\n  for (const [k, v] of Object.entries(headers)) {\n    if (typeof v === \"string\") out[k.toLowerCase()] = v;\n    else if (Array.isArray(v) && v[0]) out[k.toLowerCase()] = v[0];\n  }\n  return out;\n}\n","/**\n * Client-side verdictToken verification.\n *\n * A verdictToken is an ES256 JWT decision receipt minted by the edge and bound\n * to session (`sub`), origin (`aud`), and `jti` with a short `exp`. This module\n * validates shape, signature (against the JWKS served from\n * GET /.well-known/jwks.json), expiry, session binding, and, when an expected\n * audience is supplied, origin binding. Rejection reasons are surfaced as\n * `VerdictTokenError.code`.\n */\n\nimport { ChitmarkError } from \"./errors.js\";\nimport type { ActorType, Decision } from \"./types.js\";\n\nexport interface VerdictTokenClaims {\n  eventId: string;\n  decision: Decision;\n  actorType: ActorType;\n  confidence: number;\n  aud: string;\n  sub: string;\n  jti: string;\n  iat: number;\n  exp: number;\n  degraded: boolean;\n}\n\nexport type VerdictTokenErrorCode =\n  | \"malformed_token\"\n  | \"wrong_algorithm\"\n  | \"jwks_unavailable\"\n  | \"unknown_kid\"\n  | \"invalid_signature\"\n  | \"expired\"\n  | \"not_yet_valid\"\n  | \"wrong_session\"\n  | \"wrong_aud\";\n\nexport class VerdictTokenError extends ChitmarkError {\n  override name = \"VerdictTokenError\";\n\n  constructor(code: VerdictTokenErrorCode, message: string) {\n    super(message, { code });\n  }\n}\n\nexport interface VerifyVerdictTokenOptions {\n  /** Expected session: token `sub` must equal this or verification fails. */\n  session?: string;\n  /** Expected origin: token `aud` must equal this or verification fails. */\n  aud?: string;\n  /** JWKS URL; defaults to https://api.chitmark.com/.well-known/jwks.json. */\n  jwksUrl?: string;\n  /** Pre-fetched JWKS; skips the network fetch when provided. */\n  jwks?: { keys: Array<Record<string, unknown>> };\n  /** Injectable fetch (Node 24+/browsers have a global). */\n  fetch?: typeof fetch;\n  /** Clock override for tests. */\n  nowMs?: number;\n  /** Clock skew tolerance in seconds; defaults to 30. */\n  leewaySeconds?: number;\n}\n\nconst DEFAULT_JWKS_URL = \"https://api.chitmark.com/.well-known/jwks.json\";\nconst DEFAULT_LEEWAY_SECONDS = 30;\n\nexport async function verifyVerdictToken(\n  token: string,\n  options: VerifyVerdictTokenOptions = {},\n): Promise<VerdictTokenClaims> {\n  const nowMs = options.nowMs ?? Date.now();\n  const leewaySeconds = options.leewaySeconds ?? DEFAULT_LEEWAY_SECONDS;\n\n  const parts = token.split(\".\");\n  if (parts.length !== 3) {\n    throw new VerdictTokenError(\"malformed_token\", \"verdictToken must be a JWT\");\n  }\n  const [headerB64, payloadB64, signatureB64] = parts as [string, string, string];\n\n  let header: Record<string, unknown>;\n  let payload: Record<string, unknown>;\n  try {\n    header = JSON.parse(decodeBase64Url(headerB64)) as Record<string, unknown>;\n    payload = JSON.parse(decodeBase64Url(payloadB64)) as Record<string, unknown>;\n  } catch {\n    throw new VerdictTokenError(\"malformed_token\", \"verdictToken is not valid JWT JSON\");\n  }\n\n  if (header[\"alg\"] !== \"ES256\") {\n    throw new VerdictTokenError(\n      \"wrong_algorithm\",\n      `verdictToken must use ES256, got ${String(header[\"alg\"])}`,\n    );\n  }\n  const kid = typeof header[\"kid\"] === \"string\" ? header[\"kid\"] : \"\";\n  if (!kid) {\n    throw new VerdictTokenError(\"unknown_kid\", \"verdictToken is missing kid\");\n  }\n\n  const exp = typeof payload[\"exp\"] === \"number\" ? payload[\"exp\"] : NaN;\n  const iat = typeof payload[\"iat\"] === \"number\" ? payload[\"iat\"] : NaN;\n  const nowSeconds = Math.floor(nowMs / 1000);\n  if (Number.isFinite(exp) && exp < nowSeconds - leewaySeconds) {\n    throw new VerdictTokenError(\"expired\", \"verdictToken has expired\");\n  }\n  if (Number.isFinite(iat) && iat > nowSeconds + leewaySeconds) {\n    throw new VerdictTokenError(\"not_yet_valid\", \"verdictToken iat is in the future\");\n  }\n\n  const expectedSession = options.session;\n  if (expectedSession !== undefined && payload[\"sub\"] !== expectedSession) {\n    throw new VerdictTokenError(\n      \"wrong_session\",\n      \"verdictToken was minted for a different session\",\n    );\n  }\n  const expectedAud = options.aud;\n  if (expectedAud !== undefined && payload[\"aud\"] !== expectedAud) {\n    throw new VerdictTokenError(\n      \"wrong_aud\",\n      \"verdictToken was minted for a different origin\",\n    );\n  }\n\n  const jwk = await findJwk(kid, options);\n  if (!jwk) {\n    throw new VerdictTokenError(\"unknown_kid\", `JWKS has no key for kid ${kid}`);\n  }\n\n  let publicKey: CryptoKey;\n  try {\n    publicKey = await crypto.subtle.importKey(\n      \"jwk\",\n      jwk as unknown as JsonWebKey,\n      { name: \"ECDSA\", namedCurve: \"P-256\" },\n      false,\n      [\"verify\"],\n    );\n  } catch {\n    throw new VerdictTokenError(\n      \"invalid_signature\",\n      \"JWKS key is not a valid P-256 public key\",\n    );\n  }\n\n  const signatureBytes = decodeBase64UrlBytes(signatureB64);\n  const signatureBuffer = new ArrayBuffer(signatureBytes.byteLength);\n  new Uint8Array(signatureBuffer).set(signatureBytes);\n\n  const valid = await crypto.subtle.verify(\n    { name: \"ECDSA\", hash: \"SHA-256\" },\n    publicKey,\n    signatureBuffer,\n    new TextEncoder().encode(`${headerB64}.${payloadB64}`),\n  );\n  if (!valid) {\n    throw new VerdictTokenError(\n      \"invalid_signature\",\n      \"verdictToken signature failed verification\",\n    );\n  }\n\n  return payload as unknown as VerdictTokenClaims;\n}\n\nasync function findJwk(\n  kid: string,\n  options: VerifyVerdictTokenOptions,\n): Promise<Record<string, unknown> | undefined> {\n  let jwks = options.jwks;\n  if (!jwks) {\n    const jwksUrl = options.jwksUrl ?? DEFAULT_JWKS_URL;\n    try {\n      const fetchImpl = options.fetch ?? globalThis.fetch.bind(globalThis);\n      const res = await fetchImpl(jwksUrl);\n      if (!res.ok) {\n        throw new Error(`JWKS fetch failed with ${res.status}`);\n      }\n      jwks = (await res.json()) as { keys: Array<Record<string, unknown>> };\n    } catch (err) {\n      throw new VerdictTokenError(\n        \"jwks_unavailable\",\n        `Failed to load JWKS from ${jwksUrl}: ${\n          err instanceof Error ? err.message : \"unknown error\"\n        }`,\n      );\n    }\n  }\n  if (!Array.isArray(jwks.keys)) {\n    throw new VerdictTokenError(\"jwks_unavailable\", \"JWKS response has no keys array\");\n  }\n  return jwks.keys.find((key) => key[\"kid\"] === kid);\n}\n\nfunction decodeBase64Url(value: string): string {\n  const normalized = value.replace(/-/g, \"+\").replace(/_/g, \"/\");\n  const padded = normalized + \"=\".repeat((4 - (normalized.length % 4)) % 4);\n  const binary = atob(padded);\n  return new TextDecoder().decode(Uint8Array.from(binary, (ch) => ch.charCodeAt(0)));\n}\n\nfunction decodeBase64UrlBytes(value: string): Uint8Array {\n  const normalized = value.replace(/-/g, \"+\").replace(/_/g, \"/\");\n  const padded = normalized + \"=\".repeat((4 - (normalized.length % 4)) % 4);\n  const binary = atob(padded);\n  const out = new Uint8Array(binary.length);\n  for (let i = 0; i < binary.length; i += 1) out[i] = binary.charCodeAt(i);\n  return out;\n}\n","import {\n  ChitmarkApiError,\n  ChitmarkError,\n  degradedChallengeVerdict,\n  enforceDegradedNeverAllow,\n} from \"./errors.js\";\nimport {\n  DEFAULT_TIMEOUT_MS,\n  SDK_VERSION,\n  envBaseUrl,\n  resolveBaseUrl,\n} from \"./internal/constants.js\";\nimport { flattenHeaders, prepareSubject } from \"./internal/prepare.js\";\nimport {\n  verifyVerdictToken,\n  type VerdictTokenClaims,\n  type VerifyVerdictTokenOptions,\n} from \"./verify-token.js\";\nimport type {\n  ChallengeRequest,\n  ChallengeResponse,\n  ChallengeCompletionResponse,\n  ChallengeProof,\n  ChitmarkOptions,\n  FeedbackRequest,\n  FeedbackResponse,\n  OnDegraded,\n  PiiMode,\n  Verdict,\n  VerifyRequest,\n} from \"./types.js\";\n\n/**\n * Official Chitmark client (Open Agent Ledger): three verbs:\n * verify, feedback, challenge. Trust decisions on agent-mediated actions,\n * tuned by business outcomes.\n *\n * @example\n * ```ts\n * const chitmark = new Chitmark({ apiKey: process.env.CHITMARK_API_KEY! });\n * const verdict = await chitmark.verify({\n *   action: \"signup\",\n *   subject: { email, ip, userAgent },\n * });\n * ```\n */\nexport class Chitmark {\n  private readonly apiKey: string;\n  private readonly baseUrl: string;\n  private readonly timeoutMs: number;\n  private readonly piiMode: PiiMode;\n  private readonly onDegraded: OnDegraded;\n  private readonly fetchImpl: typeof fetch;\n  private readonly clientName: string;\n\n  constructor(options: ChitmarkOptions) {\n    if (!options.apiKey) {\n      throw new ChitmarkError(\"Chitmark apiKey is required\");\n    }\n    if (options.onDegraded && options.onDegraded !== \"challenge\") {\n      throw new ChitmarkError(\n        'onDegraded must be \"challenge\": fail to challenge, never to allow',\n      );\n    }\n    this.apiKey = options.apiKey;\n    this.baseUrl = resolveBaseUrl(options.env, options.baseUrl ?? envBaseUrl());\n    this.timeoutMs = options.timeoutMs ?? DEFAULT_TIMEOUT_MS;\n    this.piiMode = options.piiMode ?? \"hashed\";\n    this.onDegraded = \"challenge\";\n    this.fetchImpl = options.fetch ?? globalThis.fetch.bind(globalThis);\n    this.clientName = options.clientName ?? `chitmark-node/${SDK_VERSION}`;\n  }\n\n  /**\n   * Score + route an inbound action (signup / trial / …).\n   * Hot path at the edge; client budget defaults to 800ms.\n   * On timeout/transport error, or a malformed verdict shape from the API,\n   * returns a degraded challenge verdict (never allow, never crashes).\n   *\n   * Persist `v.eventId` on the account row: feedback joins only on that id.\n   */\n  async verify(request: VerifyRequest): Promise<Verdict> {\n    const subject = await prepareSubject(\n      {\n        ...request.subject,\n        headers: flattenHeaders(request.subject.headers),\n      },\n      this.piiMode,\n    );\n\n    const body: VerifyRequest = {\n      ...request,\n      subject,\n    };\n\n    try {\n      const verdict = await this.request<Verdict>(\"/v1/verify\", {\n        method: \"POST\",\n        body,\n        idempotencyKey: request.idempotencyKey,\n      });\n      if (!isWellFormedVerdict(verdict)) {\n        return degradedChallengeVerdict(\n          \"Degraded: verify returned a malformed verdict shape\",\n          request.session,\n        );\n      }\n      return enforceDegradedNeverAllow(verdict);\n    } catch (err) {\n      if (err instanceof ChitmarkApiError) {\n        throw err;\n      }\n      return degradedChallengeVerdict(\n        err instanceof Error ? `Degraded: ${err.message}` : \"Degraded: verify failed\",\n        request.session,\n      );\n    }\n  }\n\n  /**\n   * Report a downstream outcome joined on the stored eventId from verify.\n   * This is the data moat: attribution is a schema contract, not a fuzzy match.\n   */\n  async feedback(request: FeedbackRequest): Promise<FeedbackResponse> {\n    return this.request<FeedbackResponse>(\"/v1/feedback\", {\n      method: \"POST\",\n      body: request,\n    });\n  }\n\n  /**\n   * Issue an asymmetric-cost challenge after decision === challenge | degraded.\n   */\n  async challenge(request: ChallengeRequest): Promise<ChallengeResponse> {\n    return this.request<ChallengeResponse>(\"/v1/challenge\", {\n      method: \"POST\",\n      body: request,\n    });\n  }\n\n  /**\n   * Complete a challenge by submitting its solved proof. Clears only the bound\n   * session, once. Re-verify with `context.challengeId` to have the next\n   * verify honor the cleared session.\n   */\n  async completeChallenge(request: {\n    eventId: string;\n    challengeId: string;\n    session?: string;\n    proof: ChallengeProof;\n  }): Promise<ChallengeCompletionResponse> {\n    return this.request<ChallengeCompletionResponse>(\"/v1/challenge\", {\n      method: \"POST\",\n      body: request,\n    });\n  }\n\n  /**\n   * Verify a verdictToken's signature against the API's JWKS and its session /\n   * origin binding. Rejects expired tokens, unknown kids, and\n   * invalid signatures with `VerdictTokenError`. Pass `session` to enforce\n   * session binding (recommended) and `aud` to enforce origin binding.\n   */\n  async verifyVerdictToken(\n    token: string,\n    options: Omit<VerifyVerdictTokenOptions, \"jwksUrl\" | \"fetch\"> = {},\n  ): Promise<VerdictTokenClaims> {\n    return verifyVerdictToken(token, {\n      ...options,\n      jwksUrl: `${this.baseUrl}/.well-known/jwks.json`,\n      fetch: this.fetchImpl,\n    });\n  }\n\n  /**\n   * Low-level HTTP helper. Prefer verify / feedback / challenge.\n   */\n  async request<T>(\n    path: string,\n    init: {\n      method: string;\n      body?: unknown;\n      idempotencyKey?: string;\n    },\n  ): Promise<T> {\n    const controller = new AbortController();\n    const timer = setTimeout(() => controller.abort(), this.timeoutMs);\n\n    try {\n      const headers: Record<string, string> = {\n        Authorization: `Bearer ${this.apiKey}`,\n        \"Content-Type\": \"application/json\",\n        Accept: \"application/json\",\n        \"User-Agent\": this.clientName,\n        \"X-Chitmark-Client\": this.clientName,\n      };\n      if (init.idempotencyKey) {\n        headers[\"Idempotency-Key\"] = init.idempotencyKey;\n      }\n\n      const res = await this.fetchImpl(`${this.baseUrl}${path}`, {\n        method: init.method,\n        headers,\n        body: init.body !== undefined ? JSON.stringify(init.body) : undefined,\n        signal: controller.signal,\n      });\n\n      const text = await res.text();\n      let parsed: unknown = undefined;\n      if (text) {\n        try {\n          parsed = JSON.parse(text) as unknown;\n        } catch {\n          parsed = text;\n        }\n      }\n\n      if (!res.ok) {\n        const errBody =\n          typeof parsed === \"object\" && parsed !== null\n            ? (parsed as { error?: string; message?: string; code?: string })\n            : text;\n        const normalized =\n          typeof errBody === \"string\"\n            ? errBody\n            : {\n                error: errBody.error ?? `http_${res.status}`,\n                message: errBody.message,\n                code: errBody.code,\n              };\n        throw new ChitmarkApiError(res.status, normalized);\n      }\n\n      return parsed as T;\n    } catch (err) {\n      if (err instanceof ChitmarkApiError) throw err;\n      if (err instanceof Error && err.name === \"AbortError\") {\n        throw new ChitmarkError(`Request timed out after ${this.timeoutMs}ms`, {\n          code: \"timeout\",\n        });\n      }\n      throw err instanceof Error\n        ? new ChitmarkError(err.message, { code: \"transport\" })\n        : new ChitmarkError(\"Unknown transport error\", { code: \"transport\" });\n    } finally {\n      clearTimeout(timer);\n    }\n  }\n\n  /** Public accessors for inspection / tests. */\n  get config(): {\n    baseUrl: string;\n    timeoutMs: number;\n    piiMode: PiiMode;\n    onDegraded: OnDegraded;\n  } {\n    return {\n      baseUrl: this.baseUrl,\n      timeoutMs: this.timeoutMs,\n      piiMode: this.piiMode,\n      onDegraded: this.onDegraded,\n    };\n  }\n}\n\nconst VERDICT_DECISIONS: ReadonlySet<string> = new Set([\"allow\", \"challenge\", \"deny\"]);\n\n/**\n * Minimal shape guard for a 200 verify response. A malformed verdict must\n * never be treated as allow: the gating fields are what gate correctness.\n */\nexport function isWellFormedVerdict(value: unknown): value is Verdict {\n  if (typeof value !== \"object\" || value === null) return false;\n  const v = value as Partial<Verdict>;\n  return (\n    typeof v.decision === \"string\" &&\n    VERDICT_DECISIONS.has(v.decision) &&\n    typeof v.eventId === \"string\" &&\n    v.eventId.length > 0 &&\n    typeof v.degraded === \"boolean\"\n  );\n}\n","import type { Verdict } from \"./types.js\";\n\nexport const CHITMARK_HTTP_STATUS = {\n  ok: 200,\n  created: 201,\n  badRequest: 400,\n  unauthorized: 401,\n  forbidden: 403,\n  notFound: 404,\n  conflict: 409,\n  preconditionRequired: 428,\n  tooManyRequests: 429,\n} as const;\n\nexport type ChitmarkHttpStatus =\n  (typeof CHITMARK_HTTP_STATUS)[keyof typeof CHITMARK_HTTP_STATUS];\n\nexport const CHITMARK_HTTP_STATUS_MEANING = {\n  ok: \"Request succeeded. For verify gates, continue only after an explicit non-degraded allow.\",\n  created: \"Resource was created after an explicit non-degraded allow.\",\n  badRequest: \"Required request fields are missing or malformed.\",\n  unauthorized: \"API key is missing or invalid.\",\n  forbidden: \"Verify returned deny; block the action.\",\n  notFound: \"Referenced Chitmark resource was not found.\",\n  conflict: \"Idempotency key was reused with a materially different payload.\",\n  preconditionRequired:\n    \"Verify returned challenge or degraded; require friction before continuing.\",\n  tooManyRequests: \"Request was rate limited.\",\n} as const satisfies Record<keyof typeof CHITMARK_HTTP_STATUS, string>;\n\nexport function verdictToHttpStatus(verdict: Verdict): ChitmarkHttpStatus {\n  if (verdict.degraded || verdict.decision === \"challenge\") {\n    return CHITMARK_HTTP_STATUS.preconditionRequired;\n  }\n  if (verdict.decision === \"deny\") return CHITMARK_HTTP_STATUS.forbidden;\n  return CHITMARK_HTTP_STATUS.ok;\n}\n","import { Chitmark } from \"./client.js\";\nimport type { Action, Verdict, VerifyContext, VerifyRequest } from \"./types.js\";\nimport { flattenHeaders } from \"./internal/prepare.js\";\n\nexport interface VerifyRequestFromRequestOptions {\n  action: Action;\n  session?: string;\n  surface?: string;\n  context?: VerifyContext;\n  /** Dedupes retries; one verdict per action attempt. Sent as header + body. */\n  idempotencyKey?: string;\n  /** Optional body used for email / formData when already parsed. */\n  body?: {\n    email?: string;\n    [key: string]: unknown;\n  };\n  /**\n   * Override subject fields. By default reads IP / UA / headers from the Request.\n   */\n  subject?: VerifyRequest[\"subject\"];\n}\n\n/**\n * Edge-oriented helpers for Cloudflare Workers and other Fetch-API runtimes.\n * Import via `@chitmark/sdk/edge`.\n *\n * @example\n * ```ts\n * import { Chitmark } from \"@chitmark/sdk/edge\";\n * const chitmark = new Chitmark({ apiKey: env.CHITMARK_API_KEY });\n * const v = await chitmark.verifyRequest(req, { action: \"signup\" });\n * ```\n */\nexport class ChitmarkEdge extends Chitmark {\n  /**\n   * Build a verify call from a Fetch Request (headers, IP, body fields).\n   */\n  async verifyRequest(\n    req: Request,\n    options: VerifyRequestFromRequestOptions,\n  ): Promise<Verdict> {\n    const url = new URL(req.url);\n    const ip =\n      req.headers.get(\"cf-connecting-ip\") ??\n      req.headers.get(\"x-forwarded-for\")?.split(\",\")[0]?.trim() ??\n      \"\";\n    const userAgent = req.headers.get(\"user-agent\") ?? \"\";\n    const headers = flattenHeaders(req.headers);\n\n    const subject = options.subject ?? {\n      email: options.body?.email,\n      ip,\n      userAgent,\n      headers,\n      formData: options.body,\n    };\n\n    return this.verify({\n      action: options.action,\n      session: options.session,\n      surface: options.surface ?? `${url.host}${url.pathname}`,\n      subject,\n      context: options.context,\n      idempotencyKey: options.idempotencyKey,\n    });\n  }\n}\n\nexport { ChitmarkEdge as Chitmark };\nexport * from \"./types.js\";\nexport * from \"./errors.js\";\nexport * from \"./pii.js\";\nexport * from \"./http-status.js\";\nexport * from \"./verify-token.js\";\nexport { Chitmark as ChitmarkCore } from \"./client.js\";\n"]}

package/dist/edge.d.cts

@@ -1,11 +1,11 @@
-import { C as Chitmark, A as Action, V as VerifyRequest, a as Verdict } from './http-status-CwxMw-nO.cjs';
-export { b as ActorType, c as CHITMARK_HTTP_STATUS, d as CHITMARK_HTTP_STATUS_MEANING, e as ChallengeCompletionResponse, f as ChallengeMethod, g as ChallengeProof, h as ChallengeRequest, i as ChallengeResponse, j as ChitmarkApiError, k as ChitmarkEnv, l as ChitmarkError, m as ChitmarkErrorBody, n as ChitmarkHttpStatus, o as ChitmarkOptions, D as Decision, E as EnforcementMode, F as FeedbackRequest, p as FeedbackResponse, O as OnDegraded, q as Outcome, P as PiiMode, r as Principal, S as Subject, s as VerdictTokenClaims, t as VerdictTokenError, u as VerdictTokenErrorCode, v as VerifyVerdictTokenOptions, w as degradedChallengeVerdict, x as enforceDegradedNeverAllow, y as hashEmailSha256, z as minimizeFormData, B as truncateIp, G as verdictToHttpStatus, H as verifyVerdictToken } from './http-status-CwxMw-nO.cjs';
+import { C as Chitmark, A as Action, V as VerifyContext, a as VerifyRequest, b as Verdict } from './http-status-VNdUBoY5.cjs';
+export { c as ActorType, d as CHITMARK_HTTP_STATUS, e as CHITMARK_HTTP_STATUS_MEANING, f as ChallengeCompletionResponse, g as ChallengeMethod, h as ChallengeProof, i as ChallengeRequest, j as ChallengeResponse, k as ChallengeRiskTier, l as ChitmarkApiError, m as ChitmarkEnv, n as ChitmarkError, o as ChitmarkErrorBody, p as ChitmarkHttpStatus, q as ChitmarkOptions, D as Decision, r as DecisionCosts, E as EnforcementMode, F as FeedbackRequest, s as FeedbackResponse, O as OnDegraded, t as Outcome, P as PiiMode, u as Principal, S as Subject, v as VerdictTokenClaims, w as VerdictTokenError, x as VerdictTokenErrorCode, y as VerifyVerdictTokenOptions, z as degradedChallengeVerdict, B as enforceDegradedNeverAllow, G as hashEmailSha256, H as minimizeFormData, I as truncateIp, J as verdictToHttpStatus, K as verifyVerdictToken } from './http-status-VNdUBoY5.cjs';
 
 interface VerifyRequestFromRequestOptions {
     action: Action;
     session?: string;
     surface?: string;
-    context?: Record<string, unknown>;
+    context?: VerifyContext;
     /** Dedupes retries; one verdict per action attempt. Sent as header + body. */
     idempotencyKey?: string;
     /** Optional body used for email / formData when already parsed. */
@@ -36,4 +36,4 @@ declare class ChitmarkEdge extends Chitmark {
     verifyRequest(req: Request, options: VerifyRequestFromRequestOptions): Promise<Verdict>;
 }
 
-export { Action, ChitmarkEdge as Chitmark, Chitmark as ChitmarkCore, ChitmarkEdge, Verdict, VerifyRequest, type VerifyRequestFromRequestOptions };
+export { Action, ChitmarkEdge as Chitmark, Chitmark as ChitmarkCore, ChitmarkEdge, Verdict, VerifyContext, VerifyRequest, type VerifyRequestFromRequestOptions };

package/dist/edge.d.ts

@@ -1,11 +1,11 @@
-import { C as Chitmark, A as Action, V as VerifyRequest, a as Verdict } from './http-status-CwxMw-nO.js';
-export { b as ActorType, c as CHITMARK_HTTP_STATUS, d as CHITMARK_HTTP_STATUS_MEANING, e as ChallengeCompletionResponse, f as ChallengeMethod, g as ChallengeProof, h as ChallengeRequest, i as ChallengeResponse, j as ChitmarkApiError, k as ChitmarkEnv, l as ChitmarkError, m as ChitmarkErrorBody, n as ChitmarkHttpStatus, o as ChitmarkOptions, D as Decision, E as EnforcementMode, F as FeedbackRequest, p as FeedbackResponse, O as OnDegraded, q as Outcome, P as PiiMode, r as Principal, S as Subject, s as VerdictTokenClaims, t as VerdictTokenError, u as VerdictTokenErrorCode, v as VerifyVerdictTokenOptions, w as degradedChallengeVerdict, x as enforceDegradedNeverAllow, y as hashEmailSha256, z as minimizeFormData, B as truncateIp, G as verdictToHttpStatus, H as verifyVerdictToken } from './http-status-CwxMw-nO.js';
+import { C as Chitmark, A as Action, V as VerifyContext, a as VerifyRequest, b as Verdict } from './http-status-VNdUBoY5.js';
+export { c as ActorType, d as CHITMARK_HTTP_STATUS, e as CHITMARK_HTTP_STATUS_MEANING, f as ChallengeCompletionResponse, g as ChallengeMethod, h as ChallengeProof, i as ChallengeRequest, j as ChallengeResponse, k as ChallengeRiskTier, l as ChitmarkApiError, m as ChitmarkEnv, n as ChitmarkError, o as ChitmarkErrorBody, p as ChitmarkHttpStatus, q as ChitmarkOptions, D as Decision, r as DecisionCosts, E as EnforcementMode, F as FeedbackRequest, s as FeedbackResponse, O as OnDegraded, t as Outcome, P as PiiMode, u as Principal, S as Subject, v as VerdictTokenClaims, w as VerdictTokenError, x as VerdictTokenErrorCode, y as VerifyVerdictTokenOptions, z as degradedChallengeVerdict, B as enforceDegradedNeverAllow, G as hashEmailSha256, H as minimizeFormData, I as truncateIp, J as verdictToHttpStatus, K as verifyVerdictToken } from './http-status-VNdUBoY5.js';
 
 interface VerifyRequestFromRequestOptions {
     action: Action;
     session?: string;
     surface?: string;
-    context?: Record<string, unknown>;
+    context?: VerifyContext;
     /** Dedupes retries; one verdict per action attempt. Sent as header + body. */
     idempotencyKey?: string;
     /** Optional body used for email / formData when already parsed. */
@@ -36,4 +36,4 @@ declare class ChitmarkEdge extends Chitmark {
     verifyRequest(req: Request, options: VerifyRequestFromRequestOptions): Promise<Verdict>;
 }
 
-export { Action, ChitmarkEdge as Chitmark, Chitmark as ChitmarkCore, ChitmarkEdge, Verdict, VerifyRequest, type VerifyRequestFromRequestOptions };
+export { Action, ChitmarkEdge as Chitmark, Chitmark as ChitmarkCore, ChitmarkEdge, Verdict, VerifyContext, VerifyRequest, type VerifyRequestFromRequestOptions };

package/dist/edge.js

@@ -59,7 +59,7 @@ var DEFAULT_BASE_URLS = {
   development: "http://127.0.0.1:8787"
 };
 var DEFAULT_TIMEOUT_MS = 800;
-var SDK_VERSION = "0.1.0";
+var SDK_VERSION = "0.5.0";
 function resolveBaseUrl(env = "production", baseUrl) {
   return (baseUrl ?? DEFAULT_BASE_URLS[env]).replace(/\/$/, "");
 }
@@ -154,7 +154,7 @@ async function prepareSubject(subject, piiMode) {
 }
 function pickWebBotAuthHeaders(headers) {
   if (!headers) return void 0;
-  const keys = ["signature-agent", "signature-input", "signature", "signature-agent"];
+  const keys = ["signature-agent", "signature-input", "signature"];
   const out = {};
   for (const [k, v] of Object.entries(headers)) {
     const lower = k.toLowerCase();
@@ -330,7 +330,7 @@ var Chitmark = class {
     }
     if (options.onDegraded && options.onDegraded !== "challenge") {
       throw new ChitmarkError(
-        'onDegraded must be "challenge" \u2014 fail to challenge, never to allow'
+        'onDegraded must be "challenge": fail to challenge, never to allow'
       );
     }
     this.apiKey = options.apiKey;
@@ -344,7 +344,7 @@ var Chitmark = class {
   /**
    * Score + route an inbound action (signup / trial / …).
    * Hot path at the edge; client budget defaults to 800ms.
-   * On timeout/transport error — or a malformed verdict shape from the API —
+   * On timeout/transport error, or a malformed verdict shape from the API,
    * returns a degraded challenge verdict (never allow, never crashes).
    *
    * Persist `v.eventId` on the account row: feedback joins only on that id.
@@ -386,7 +386,7 @@ var Chitmark = class {
   }
   /**
    * Report a downstream outcome joined on the stored eventId from verify.
-   * This is the data moat — attribution is a schema contract, not a fuzzy match.
+   * This is the data moat: attribution is a schema contract, not a fuzzy match.
    */
   async feedback(request) {
     return this.request("/v1/feedback", {
@@ -416,7 +416,7 @@ var Chitmark = class {
   }
   /**
    * Verify a verdictToken's signature against the API's JWKS and its session /
-   * origin binding (MVP-016). Rejects expired tokens, unknown kids, and
+   * origin binding. Rejects expired tokens, unknown kids, and
    * invalid signatures with `VerdictTokenError`. Pass `session` to enforce
    * session binding (recommended) and `aud` to enforce origin binding.
    */