@chitmark/sdk 0.8.0 → 0.9.0

This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
Files changed (16) hide show
  1. package/README.md +41 -172
  2. package/dist/edge.cjs +34 -8
  3. package/dist/edge.cjs.map +1 -1
  4. package/dist/edge.d.cts +2 -2
  5. package/dist/edge.d.ts +2 -2
  6. package/dist/edge.js +34 -8
  7. package/dist/edge.js.map +1 -1
  8. package/dist/index.cjs +34 -8
  9. package/dist/index.cjs.map +1 -1
  10. package/dist/index.d.cts +2 -2
  11. package/dist/index.d.ts +2 -2
  12. package/dist/index.js +34 -8
  13. package/dist/index.js.map +1 -1
  14. package/dist/{trusted-ip-BvSjdU80.d.cts → trusted-ip-DNO3xzCU.d.cts} +41 -9
  15. package/dist/{trusted-ip-BvSjdU80.d.ts → trusted-ip-DNO3xzCU.d.ts} +41 -9
  16. package/package.json +1 -1
package/dist/index.js.map CHANGED
@@ -1 +1 @@
1
- {"version":3,"sources":["../src/attribution.ts","../src/credentials.ts","../src/errors.ts","../src/internal/constants.ts","../src/pii.ts","../src/internal/prepare.ts","../src/verify-token.ts","../src/client.ts","../src/charge.ts","../src/http-status.ts","../src/action-binding.ts","../src/trusted-ip.ts","../src/middleware/express.ts","../src/middleware/next.ts","../src/evidence.ts","../src/evidence-checkpoint.ts"],"names":["hex","out","id","encode","key"],"mappings":";AAwDO,SAAS,mBAAA,CAAoB,SAAoC,IAAA,EAAe;AACrF,EAAA,MAAM,EAAE,OAAA,EAAS,UAAA,EAAY,OAAA,EAAS,OAAA,GAAU,MAAK,GAAI,OAAA;AACzD,EAAA,MAAM,UAAU,OAAA,CAAQ,OAAA;AACxB,EAAA,MAAM,MAAA,GACJ,OAAO,OAAA,CAAQ,GAAA,KAAQ,UAAA,GACnB,OAAA,CAAQ,GAAA,CAAI,sBAAsB,CAAA,GAClC,MAAA,CAAO,OAAA,CAAQ,OAAO,CAAA,CAAE,IAAA;AAAA,IACtB,CAAC,CAAC,IAAI,CAAA,KAAM,IAAA,CAAK,aAAY,KAAM;AAAA,MACjC,CAAC,CAAA;AACX,EAAA,IAAI,OAAO,OAAA,CAAQ,IAAA;AACnB,EAAA,IAAI,CAAC,IAAA,IAAQ,OAAA,CAAQ,GAAA,EAAK,UAAA,CAAW,UAAU,CAAA,EAAG,IAAA,GAAO,IAAI,GAAA,CAAI,OAAA,CAAQ,GAAG,CAAA,CAAE,MAAA;AAC9E,EAAA,IAAI,KAAA,GAAQ,UAAA;AACZ,EAAA,IAAI,CAAC,SAAS,OAAO,MAAA,KAAW,YAAY,MAAA,CAAO,MAAA,IAAU,QAAQ,IAAA,EAAM;AACzE,IAAA,IAAI;AACF,MAAA,KAAA,GAAQ,IAAA,CAAK,MAAM,MAAM,CAAA;AAAA,IAC3B,CAAA,CAAA,MAAQ;AAAA,IAER;AAAA,EACF;AACA,EAAA,OAAO,EAAE,IAAA,EAAM,OAAA,EAAS,OAAA,EAAS,YAAY,KAAA,EAAM;AACrD;;;AC9DA,IAAM,MAAA,GAAS,CAAC,KAAA,KACd,IAAA,CAAK,OAAO,YAAA,CAAa,GAAG,KAAK,CAAC,CAAA,CAC/B,QAAQ,IAAA,EAAM,EAAE,EAChB,OAAA,CAAQ,KAAA,EAAO,GAAG,CAAA,CAClB,OAAA,CAAQ,OAAO,GAAG,CAAA;AACvB,IAAM,IAAA,GAAO,CAAC,KAAA,KAAmB,MAAA,CAAO,IAAI,WAAA,EAAY,CAAE,MAAA,CAAO,IAAA,CAAK,SAAA,CAAU,KAAK,CAAC,CAAC,CAAA;AACvF,eAAsB,iBAAA,CACpB,MACA,MAAA,EACY;AACZ,EAAA,MAAA,CAAO,cAAA,EAAe;AACtB,EAAA,IAAI,KAAA;AACJ,EAAA,MAAM,OAAA,GAAU,IAAI,OAAA,CAAe,CAAC,GAAG,MAAA,KAAW;AAChD,IAAA,KAAA,GAAQ,MAAM,MAAA,CAAO,IAAI,KAAA,CAAM,8BAA8B,CAAC,CAAA;AAC9D,IAAA,MAAA,CAAO,iBAAiB,OAAA,EAAS,KAAA,EAAO,EAAE,IAAA,EAAM,MAAM,CAAA;AAAA,EACxD,CAAC,CAAA;AACD,EAAA,IAAI;AACF,IAAA,OAAO,MAAM,OAAA,CAAQ,IAAA,CAAK,CAAC,IAAA,EAAM,OAAO,CAAC,CAAA;AAAA,EAC3C,CAAA,SAAE;AACA,IAAA,MAAA,CAAO,mBAAA,CAAoB,SAAS,KAAK,CAAA;AAAA,EAC3C;AACF;AACO,SAAS,6BAA6B,OAAA,EAMtB;AACrB,EAAA,MAAM,EAAE,UAAA,EAAY,SAAA,EAAU,GAAI,OAAA;AAClC,EAAA,IACE,SAAA,CAAU,CAAA,IACV,SAAA,CAAU,GAAA,KAAQ,IAAA,IAClB,SAAA,CAAU,GAAA,KAAQ,OAAA,IAClB,CAAC,SAAA,CAAU,CAAA,IACX,CAAC,SAAA,CAAU,CAAA;AAEX,IAAA,MAAM,IAAI,MAAM,kCAAkC,CAAA;AACpD,EAAA,MAAM,GAAA,GAAM,EAAE,GAAA,EAAK,IAAA,EAAM,GAAA,EAAK,OAAA,EAAS,CAAA,EAAG,SAAA,CAAU,CAAA,EAAG,CAAA,EAAG,SAAA,CAAU,CAAA,EAAE;AACtE,EAAA,IAAI,MAAA;AACJ,EAAA,IAAI,OAAA;AACJ,EAAA,MAAM,KAAA,GAAQ,CAAC,CAAA,KACb,CAAC,CAAC,CAAA,IACF,OAAO,CAAA,CAAE,WAAA,KAAgB,QAAA,IACzB,0BAAA,CAA2B,KAAK,CAAA,CAAE,WAAW,KAC7C,CAAC,CAAA,CAAE,WAAW,CAAA,CAAE,cAAA,EAAgB,CAAA,CAAE,oBAAoB,CAAA,CAAE,KAAA;AAAA,IACtD,CAAC,CAAA,KAAM,MAAA,CAAO,aAAA,CAAc,CAAC,KAAK,CAAA,GAAI,IAAA,CAAK,GAAA,EAAI,GAAI,GAAA,GAAO;AAAA,GAC5D;AACF,EAAA,OAAO;AAAA,IACL,MAAM,OAAA,CAAQ,EAAE,GAAA,EAAK,MAAA,EAAQ,QAAO,EAAG;AACrC,MAAA,MAAA,CAAO,cAAA,EAAe;AACtB,MAAA,MAAM,MAAA,GAAS,IAAI,GAAA,CAAI,GAAG,CAAA;AAC1B,MAAA,IAAI,MAAA,CAAO,QAAA,KAAa,QAAA,IAAY,MAAA,CAAO,YAAY,MAAA,CAAO,QAAA;AAC5D,QAAA,MAAM,IAAI,MAAM,qBAAqB,CAAA;AACvC,MAAA,IAAI,CAAC,KAAA,CAAM,MAAM,CAAA,EAAG;AAClB,QAAA,IAAI,CAAC,OAAA,EAAS;AACZ,UAAA,MAAM,aAAA,GAAgB,WAAA,CAAY,OAAA,CAAQ,OAAA,CAAQ,oBAAoB,GAAG,CAAA;AAGzE,UAAA,OAAA,GAAU,OAAA,CAAQ,OAAA,EAAQ,CACvB,IAAA,CAAK,MAAM,OAAA,CAAQ,IAAA,CAAK,aAAa,CAAC,CAAA,CACtC,IAAA,CAAK,CAAC,CAAA,KAAM;AACX,YAAA,IAAI,CAAC,MAAM,CAAC,CAAA,IAAK,cAAc,OAAA,EAAS,MAAM,IAAI,KAAA,CAAM,kBAAkB,CAAA;AAC1E,YAAA,MAAA,GAAS,EAAE,GAAG,CAAA,EAAE;AAChB,YAAA,OAAO,MAAA;AAAA,UACT,CAAC,CAAA,CACA,OAAA,CAAQ,MAAM;AACb,YAAA,OAAA,GAAU,MAAA;AAAA,UACZ,CAAC,CAAA;AAAA,QACL;AACA,QAAA,MAAM,iBAAA;AAAA,UACJ,OAAA;AAAA,UACA,WAAA,CAAY,GAAA,CAAI,CAAC,MAAA,EAAQ,WAAA,CAAY,QAAQ,OAAA,CAAQ,gBAAA,IAAoB,GAAG,CAAC,CAAC;AAAA,SAChF;AAAA,MACF;AACA,MAAA,IAAI,CAAC,KAAA,CAAM,MAAM,GAAG,MAAM,IAAI,MAAM,kBAAkB,CAAA;AACtD,MAAA,MAAM,UAAA,GAAa,MAAA;AACnB,MAAA,MAAM,QAAQ,UAAA,CAAW,WAAA;AACzB,MAAA,MAAM,GAAA,GAAM,MAAA;AAAA,QACV,IAAI,UAAA;AAAA,UACF,MAAM,MAAA,CAAO,MAAA,CAAO,MAAA,CAAO,SAAA,EAAW,IAAI,WAAA,EAAY,CAAE,MAAA,CAAO,KAAK,CAAC;AAAA;AACvE,OACF;AACA,MAAA,MAAM,UAAU,CAAA,EAAG,IAAA,CAAK,EAAE,GAAA,EAAK,UAAA,EAAY,KAAK,OAAA,EAAS,GAAA,EAAK,CAAC,IAAI,IAAA,CAAK,EAAE,KAAK,MAAA,CAAO,UAAA,IAAc,GAAA,EAAK,IAAA,CAAK,KAAA,CAAM,IAAA,CAAK,KAAI,GAAI,GAAI,GAAG,GAAA,EAAK,MAAA,CAAO,aAAY,EAAG,GAAA,EAAK,CAAA,EAAG,MAAA,CAAO,MAAM,CAAA,EAAG,MAAA,CAAO,QAAQ,CAAA,CAAA,EAAI,GAAA,EAAK,CAAC,CAAA,CAAA;AACpN,MAAA,MAAM,SAAA,GAAY,MAAM,MAAA,CAAO,MAAA,CAAO,IAAA;AAAA,QACpC,EAAE,IAAA,EAAM,OAAA,EAAS,IAAA,EAAM,SAAA,EAAU;AAAA,QACjC,UAAA;AAAA,QACA,IAAI,WAAA,EAAY,CAAE,MAAA,CAAO,OAAO;AAAA,OAClC;AACA,MAAA,MAAA,CAAO,cAAA,EAAe;AACtB,MAAA,IAAI,CAAC,KAAA,CAAM,UAAU,GAAG,MAAM,IAAI,MAAM,kBAAkB,CAAA;AAC1D,MAAA,OAAO;AAAA,QACL,aAAA,EAAe,QAAQ,KAAK,CAAA,CAAA;AAAA,QAC5B,IAAA,EAAM,GAAG,OAAO,CAAA,CAAA,EAAI,OAAO,IAAI,UAAA,CAAW,SAAS,CAAC,CAAC,CAAA;AAAA,OACvD;AAAA,IACF;AAAA,GACF;AACF;;;AC1GO,IAAM,aAAA,GAAN,cAA4B,KAAA,CAAM;AAAA,EAC9B,IAAA,GAAO,eAAA;AAAA,EACP,MAAA;AAAA,EACA,IAAA;AAAA,EACA,IAAA;AAAA,EAET,WAAA,CACE,SACA,OAAA,EACA;AACA,IAAA,KAAA,CAAM,OAAO,CAAA;AACb,IAAA,IAAA,CAAK,SAAS,OAAA,EAAS,MAAA;AACvB,IAAA,IAAA,CAAK,OAAO,OAAA,EAAS,IAAA;AACrB,IAAA,IAAA,CAAK,OAAO,OAAA,EAAS,IAAA;AAAA,EACvB;AACF;AAKO,IAAM,gBAAA,GAAN,cAA+B,aAAA,CAAc;AAAA,EACzC,IAAA,GAAO,kBAAA;AAAA,EAEhB,WAAA,CAAY,MAAA,EAAgB,IAAA,EAAkC,OAAA,EAAkB;AAC9E,IAAA,MAAM,GAAA,GACJ,OAAA,KACC,OAAO,IAAA,KAAS,QAAA,GACb,IAAA,GACA,IAAA,CAAK,OAAA,IAAW,IAAA,CAAK,KAAA,IAAS,CAAA,oBAAA,EAAuB,MAAM,CAAA,CAAA,CAAA,CAAA;AACjE,IAAA,KAAA,CAAM,GAAA,EAAK;AAAA,MACT,MAAA;AAAA,MACA,MAAM,OAAO,IAAA,KAAS,WAAY,IAAA,CAAK,IAAA,IAAQ,KAAK,KAAA,GAAS,MAAA;AAAA,MAC7D;AAAA,KACD,CAAA;AAAA,EACH;AACF;AAMO,SAAS,wBAAA,CAAyB,QAAgB,OAAA,EAA2B;AAClF,EAAA,OAAO;AAAA,IACL,QAAA,EAAU,WAAA;AAAA,IACV,SAAA,EAAW,SAAA;AAAA,IACX,UAAA,EAAY,CAAA;AAAA,IACZ,OAAA,EAAS,CAAC,MAAM,CAAA;AAAA,IAChB,SAAA,EAAW;AAAA,MACT,QAAA,EAAU,KAAA;AAAA,MACV,aAAA,EAAe,CAAC,UAAU;AAAA,KAC5B;AAAA,IACA,YAAA,EAAc,EAAA;AAAA,IACd,OAAA,EAAS,CAAA,aAAA,EAAgB,OAAA,IAAW,SAAS,CAAA,CAAA;AAAA,IAC7C,QAAA,EAAU,IAAA;AAAA,IACV,eAAA,EAAiB;AAAA,GACnB;AACF;AAKO,SAAS,0BAA0B,OAAA,EAA2B;AACnE,EAAA,IAAI,OAAA,CAAQ,QAAA,IAAY,OAAA,CAAQ,QAAA,KAAa,OAAA,EAAS;AACpD,IAAA,OAAO;AAAA,MACL,GAAG,OAAA;AAAA,MACH,QAAA,EAAU,WAAA;AAAA,MACV,OAAA,EAAS;AAAA,QACP,GAAG,OAAA,CAAQ,OAAA;AAAA,QACX;AAAA;AACF,KACF;AAAA,EACF;AACA,EAAA,OAAO,OAAA;AACT;;;AC5EO,IAAM,iBAAA,GAAiD;AAAA,EAC5D,UAAA,EAAY,0BAAA;AAAA,EACZ,OAAA,EAAS,kCAAA;AAAA,EACT,WAAA,EAAa;AACf,CAAA;AAEO,IAAM,kBAAA,GAAqB,GAAA;AAE3B,IAAM,gBAAA,GAAmB,GAAA;AAEzB,IAAM,WAAA,GAAc,OAAA;AAGpB,SAAS,iBAAiB,OAAA,EAAyB;AACxD,EAAA,IAAI;AACF,IAAA,MAAM,IAAA,GAAO,IAAI,GAAA,CAAI,OAAO,CAAA,CAAE,SAAS,OAAA,CAAQ,UAAA,EAAY,EAAE,CAAA,CAAE,WAAA,EAAY;AAC3E,IAAA,OAAO,IAAA,KAAS,WAAA,IACd,IAAA,CAAK,QAAA,CAAS,YAAY,CAAA,IAC1B,IAAA,KAAS,WAAA,IACT,IAAA,KAAS,SAAA,IACT,IAAA,KAAS,KAAA,GACP,gBAAA,GACA,kBAAA;AAAA,EACN,CAAA,CAAA,MAAQ;AACN,IAAA,OAAO,kBAAA;AAAA,EACT;AACF;AAEO,SAAS,cAAA,CACd,GAAA,GAAmB,YAAA,EACnB,OAAA,EACQ;AACR,EAAA,OAAA,CAAQ,WAAW,iBAAA,CAAkB,GAAG,CAAA,EAAG,OAAA,CAAQ,OAAO,EAAE,CAAA;AAC9D;AAMO,SAAS,UAAA,GAAiC;AAC/C,EAAA,IAAI,OAAO,OAAA,KAAY,WAAA,EAAa,OAAO,MAAA;AAC3C,EAAA,MAAM,KAAA,GAAQ,QAAQ,GAAA,EAAK,iBAAA;AAC3B,EAAA,OAAO,KAAA,GAAQ,KAAA,CAAM,IAAA,EAAK,GAAI,MAAA;AAChC;;;ACpCA,eAAsB,gBAAgB,KAAA,EAAgC;AACpE,EAAA,MAAM,UAAA,GAAa,KAAA,CAAM,IAAA,EAAK,CAAE,WAAA,EAAY;AAC5C,EAAA,MAAM,IAAA,GAAO,IAAI,WAAA,EAAY,CAAE,OAAO,UAAU,CAAA;AAChD,EAAA,MAAM,SAAS,MAAM,MAAA,CAAO,MAAA,CAAO,MAAA,CAAO,WAAW,IAAI,CAAA;AACzD,EAAA,OAAO,YAAY,MAAM,CAAA;AAC3B;AAKO,SAAS,WAAW,EAAA,EAAoB;AAC7C,EAAA,MAAM,OAAA,GAAU,GAAG,IAAA,EAAK;AAExB,EAAA,MAAM,KAAA,GAAQ,QAAQ,KAAA,CAAM,GAAG,EAAE,CAAC,CAAA,EAAG,MAAK,IAAK,OAAA;AAC/C,EAAA,IAAI,KAAA,CAAM,SAAS,GAAG,CAAA,IAAK,CAAC,KAAA,CAAM,QAAA,CAAS,GAAG,CAAA,EAAG;AAC/C,IAAA,MAAM,KAAA,GAAQ,KAAA,CAAM,KAAA,CAAM,GAAG,CAAA;AAC7B,IAAA,IAAI,KAAA,CAAM,WAAW,CAAA,EAAG;AACtB,MAAA,OAAO,CAAA,EAAG,KAAA,CAAM,CAAC,CAAC,CAAA,CAAA,EAAI,KAAA,CAAM,CAAC,CAAC,CAAA,CAAA,EAAI,KAAA,CAAM,CAAC,CAAC,CAAA,KAAA,CAAA;AAAA,IAC5C;AAAA,EACF;AAEA,EAAA,IAAI,KAAA,CAAM,QAAA,CAAS,GAAG,CAAA,EAAG;AACvB,IAAA,MAAM,UAAU,KAAA,CAAM,KAAA,CAAM,GAAG,CAAA,CAAE,OAAO,OAAO,CAAA;AAC/C,IAAA,MAAM,OAAO,OAAA,CAAQ,KAAA,CAAM,GAAG,CAAC,CAAA,CAAE,KAAK,GAAG,CAAA;AACzC,IAAA,OAAO,GAAG,IAAI,CAAA,KAAA,CAAA;AAAA,EAChB;AACA,EAAA,OAAO,KAAA;AACT;AAMO,SAAS,iBACd,QAAA,EACqC;AACrC,EAAA,IAAI,CAAC,UAAU,OAAO,MAAA;AACtB,EAAA,MAAM,OAAA,uBAAc,GAAA,CAAI;AAAA,IACtB,eAAA;AAAA,IACA,gBAAA;AAAA,IACA,QAAA;AAAA,IACA,MAAA;AAAA,IACA,UAAA;AAAA,IACA,YAAA;AAAA,IACA,YAAA;AAAA,IACA;AAAA,GACD,CAAA;AACD,EAAA,MAAM,MAA+B,EAAC;AACtC,EAAA,KAAA,MAAW,CAAC,GAAA,EAAK,KAAK,KAAK,MAAA,CAAO,OAAA,CAAQ,QAAQ,CAAA,EAAG;AACnD,IAAA,IAAI,OAAA,CAAQ,GAAA,CAAI,GAAG,CAAA,IAAK,SAAS,IAAA,EAAM;AACrC,MAAA,GAAA,CAAI,GAAG,CAAA,GAAI,KAAA;AAAA,IACb;AAAA,EACF;AACA,EAAA,OAAO,OAAO,IAAA,CAAK,GAAG,CAAA,CAAE,MAAA,GAAS,IAAI,GAAA,GAAM,MAAA;AAC7C;AAEA,SAAS,YAAY,MAAA,EAA6B;AAChD,EAAA,MAAM,KAAA,GAAQ,IAAI,UAAA,CAAW,MAAM,CAAA;AACnC,EAAA,IAAIA,IAAAA,GAAM,EAAA;AACV,EAAA,KAAA,MAAW,KAAK,KAAA,EAAO;AACrB,IAAAA,QAAO,CAAA,CAAE,QAAA,CAAS,EAAE,CAAA,CAAE,QAAA,CAAS,GAAG,GAAG,CAAA;AAAA,EACvC;AACA,EAAA,OAAOA,IAAAA;AACT;;;AClEA,eAAsB,cAAA,CACpB,SACA,OAAA,EACkB;AAClB,EAAA,IAAI,YAAY,KAAA,EAAO;AACrB,IAAA,OAAO,OAAA;AAAA,EACT;AAEA,EAAA,IAAI,YAAY,MAAA,EAAQ;AACtB,IAAA,OAAO;AAAA,MACL,WAAW,OAAA,CAAQ,SAAA;AAAA,MACnB,OAAA,EAAS,qBAAA,CAAsB,OAAA,CAAQ,OAAO;AAAA,KAChD;AAAA,EACF;AAGA,EAAA,MAAM,QAAA,GAAoB;AAAA,IACxB,WAAW,OAAA,CAAQ,SAAA;AAAA,IACnB,SAAS,OAAA,CAAQ;AAAA,GACnB;AAEA,EAAA,IAAI,QAAQ,WAAA,EAAa;AACvB,IAAA,QAAA,CAAS,cAAc,OAAA,CAAQ,WAAA;AAAA,EACjC,CAAA,MAAA,IAAW,QAAQ,KAAA,EAAO;AACxB,IAAA,QAAA,CAAS,WAAA,GAAc,MAAM,eAAA,CAAgB,OAAA,CAAQ,KAAK,CAAA;AAAA,EAC5D;AAEA,EAAA,IAAI,QAAQ,OAAA,EAAS;AACnB,IAAA,QAAA,CAAS,UAAU,OAAA,CAAQ,OAAA;AAAA,EAC7B,CAAA,MAAA,IAAW,QAAQ,EAAA,EAAI;AACrB,IAAA,QAAA,CAAS,OAAA,GAAU,UAAA,CAAW,OAAA,CAAQ,EAAE,CAAA;AAAA,EAC1C;AAEA,EAAA,MAAM,UAAA,GAAa,OAAA,CAAQ,cAAA,IAAkB,gBAAA,CAAiB,QAAQ,QAAQ,CAAA;AAC9E,EAAA,IAAI,UAAA,EAAY;AACd,IAAA,QAAA,CAAS,cAAA,GAAiB,UAAA;AAAA,EAC5B;AAEA,EAAA,OAAO,QAAA;AACT;AAEA,SAAS,sBACP,OAAA,EACoC;AACpC,EAAA,IAAI,CAAC,SAAS,OAAO,MAAA;AACrB,EAAA,MAAM,IAAA,GAAO,CAAC,iBAAA,EAAmB,iBAAA,EAAmB,WAAW,CAAA;AAC/D,EAAA,MAAM,MAA8B,EAAC;AACrC,EAAA,KAAA,MAAW,CAAC,CAAA,EAAG,CAAC,KAAK,MAAA,CAAO,OAAA,CAAQ,OAAO,CAAA,EAAG;AAC5C,IAAA,MAAM,KAAA,GAAQ,EAAE,WAAA,EAAY;AAC5B,IAAA,IAAI,KAAK,QAAA,CAAS,KAAK,CAAA,IAAK,OAAO,MAAM,QAAA,EAAU;AACjD,MAAA,GAAA,CAAI,KAAK,CAAA,GAAI,CAAA;AAAA,IACf,CAAA,MAAA,IAAW,IAAA,CAAK,QAAA,CAAS,KAAK,CAAA,IAAK,KAAA,CAAM,OAAA,CAAQ,CAAC,CAAA,IAAK,CAAA,CAAE,CAAC,CAAA,EAAG;AAC3D,MAAA,GAAA,CAAI,KAAK,CAAA,GAAI,CAAA,CAAE,CAAC,CAAA;AAAA,IAClB;AAAA,EACF;AACA,EAAA,OAAO,OAAO,IAAA,CAAK,GAAG,CAAA,CAAE,MAAA,GAAS,IAAI,GAAA,GAAM,MAAA;AAC7C;AAKO,SAAS,eACd,OAAA,EACoC;AACpC,EAAA,IAAI,CAAC,SAAS,OAAO,MAAA;AACrB,EAAA,IAAI,mBAAmB,OAAA,EAAS;AAC9B,IAAA,MAAMC,OAA8B,EAAC;AACrC,IAAA,OAAA,CAAQ,OAAA,CAAQ,CAAC,KAAA,EAAO,GAAA,KAAQ;AAC9B,MAAAA,IAAAA,CAAI,GAAA,CAAI,WAAA,EAAa,CAAA,GAAI,KAAA;AAAA,IAC3B,CAAC,CAAA;AACD,IAAA,OAAOA,IAAAA;AAAA,EACT;AACA,EAAA,MAAM,MAA8B,EAAC;AACrC,EAAA,KAAA,MAAW,CAAC,CAAA,EAAG,CAAC,KAAK,MAAA,CAAO,OAAA,CAAQ,OAAO,CAAA,EAAG;AAC5C,IAAA,IAAI,OAAO,CAAA,KAAM,QAAA,MAAc,CAAA,CAAE,WAAA,EAAa,CAAA,GAAI,CAAA;AAAA,SAAA,IACzC,KAAA,CAAM,OAAA,CAAQ,CAAC,CAAA,IAAK,CAAA,CAAE,CAAC,CAAA,EAAG,GAAA,CAAI,CAAA,CAAE,WAAA,EAAa,CAAA,GAAI,EAAE,CAAC,CAAA;AAAA,EAC/D;AACA,EAAA,OAAO,GAAA;AACT;;;ACtDO,IAAM,oBAAA,GAAuB;AAmC7B,IAAM,iBAAA,GAAN,cAAgC,aAAA,CAAc;AAAA,EAC1C,IAAA,GAAO,mBAAA;AAAA,EAEhB,WAAA,CAAY,MAA6B,OAAA,EAAiB;AACxD,IAAA,KAAA,CAAM,OAAA,EAAS,EAAE,IAAA,EAAM,CAAA;AAAA,EACzB;AACF;AA+BA,IAAM,gBAAA,GAAmB,gDAAA;AACzB,IAAM,sBAAA,GAAyB,EAAA;AAQ/B,eAAsB,kBAAA,CACpB,OACA,OAAA,EAC6B;AAC7B,EAAA,OAAO,aAAA,CAAc,KAAA,EAAO,OAAA,EAAS,KAAK,CAAA;AAC5C;AAGO,IAAM,yBAAA,GAA4B;AAAA,EACvC,SAAA;AAAA,EACA,aAAA;AAAA,EACA,mBAAA;AAAA,EACA,mBAAA;AAAA,EACA,uBAAA;AAAA,EACA,yBAAA;AAAA,EACA,aAAA;AAAA,EACA,kBAAA;AAAA,EACA,gBAAA;AAAA,EACA,eAAA;AAAA,EACA,mBAAA;AAAA,EACA,cAAA;AAAA,EACA,kBAAA;AAAA,EACA,gBAAA;AAAA,EACA;AACF;AA8BA,eAAsB,mBAAA,CACpB,OACA,OAAA,EAC8B;AAC9B,EAAA,MAAM,SAAU,MAAM,aAAA;AAAA,IACpB,KAAA;AAAA,IACA;AAAA,MACE,GAAG,OAAA;AAAA,MACH,KAAK,OAAA,CAAQ,QAAA;AAAA,MACb,MAAA,EAAQ,oBAAA;AAAA,MACR,aAAA,EAAe;AAAA,KACjB;AAAA,IACA;AAAA,GACF;AACA,EAAA,MAAM,GAAA,GAAM,KAAK,KAAA,CAAA,CAAO,OAAA,CAAQ,SAAS,IAAA,CAAK,GAAA,MAAS,GAAI,CAAA;AAC3D,EAAA,IACE,CAAC,OAAA,CAAQ,QAAA,IACT,CAAC,OAAA,CAAQ,OAAA,IACT,CAAC,OAAA,CAAQ,QAAA,IACT,CAAC,OAAA,CAAQ,MAAA,IACT,CAAC,gBAAA,CAAiB,IAAA,CAAK,OAAA,CAAQ,MAAM,CAAA,IACrC,EAAE,OAAA,CAAQ,MAAA,KAAW,kBAAA,GACjB,OAAA,CAAQ,KAAA,KAAU,MAAA,IAAU,OAAA,CAAQ,KAAA,KAAU,YAAA,GAC7C,yBAAA,CAAgD,SAAS,OAAA,CAAQ,MAAM,CAAA,IACxE,OAAA,CAAQ,KAAA,KAAU,gBAAA,IAClB,OAAO,OAAA,CAAQ,OAAA,KAAY,QAAA,IAC3B,wBAAA,CAAyB,IAAA,CAAK,OAAA,CAAQ,OAAO,CAAA,IAC7C,MAAA,CAAO,OAAA,KAAY,OAAA,CAAQ,OAAA,CAAA,IAC/B,MAAA,CAAO,MAAA,KAAW,OAAA,CAAQ,MAAA,IACzB,OAAA,CAAQ,WAAA,KAAgB,MAAA,IAAU,OAAA,CAAQ,WAAA,KAAgB,MAAA,IAC3D,MAAA,CAAO,gBAAgB,OAAA,CAAQ,WAAA,IAC/B,CAAC,OAAA,CAAQ,OAAA,IACT,MAAA,CAAO,OAAA,KAAY,OAAA,CAAQ,OAAA,IAC3B,MAAA,CAAO,MAAA,KAAW,OAAA,CAAQ,MAAA,IAC1B,MAAA,CAAO,MAAA,KAAW,OAAA,CAAQ,MAAA,IAC1B,MAAA,CAAO,KAAA,KAAU,OAAA,CAAQ,KAAA,IACzB,MAAA,CAAO,eAAA,KAAoB,SAAA,IAC3B,MAAA,CAAO,QAAA,KAAa,OAAA,IACpB,MAAA,CAAO,QAAA,KAAa,KAAA,IACpB,OAAO,MAAA,CAAO,OAAA,KAAY,QAAA,IAC1B,CAAC,MAAA,CAAO,OAAA,IACR,CAAC,MAAA,CAAO,aAAA,CAAc,MAAA,CAAO,GAAG,CAAA,IAChC,CAAC,MAAA,CAAO,aAAA,CAAc,MAAA,CAAO,GAAG,CAAA,IAChC,MAAA,CAAO,GAAA,GAAM,GAAA,IACb,MAAA,CAAO,GAAA,IAAO,GAAA,IACd,MAAA,CAAO,GAAA,GAAM,MAAA,CAAO,GAAA,KAAQ,EAAA,EAC5B;AACA,IAAA,MAAM,IAAI,iBAAA;AAAA,MACR,sBAAA;AAAA,MACA;AAAA,KACF;AAAA,EACF;AACA,EAAA,OAAO,MAAA;AACT;AAEA,eAAe,aAAA,CACb,KAAA,EACA,OAAA,EACA,YAAA,EAC6B;AAC7B,EAAA,MAAM,KAAA,GAAQ,OAAA,CAAQ,KAAA,IAAS,IAAA,CAAK,GAAA,EAAI;AACxC,EAAA,MAAM,aAAA,GAAgB,QAAQ,aAAA,IAAiB,sBAAA;AAE/C,EAAA,MAAM,KAAA,GAAQ,KAAA,CAAM,KAAA,CAAM,GAAG,CAAA;AAC7B,EAAA,IAAI,KAAA,CAAM,WAAW,CAAA,EAAG;AACtB,IAAA,MAAM,IAAI,iBAAA,CAAkB,iBAAA,EAAmB,4BAA4B,CAAA;AAAA,EAC7E;AACA,EAAA,MAAM,CAAC,SAAA,EAAW,UAAA,EAAY,YAAY,CAAA,GAAI,KAAA;AAE9C,EAAA,IAAI,MAAA;AACJ,EAAA,IAAI,OAAA;AACJ,EAAA,IAAI;AACF,IAAA,MAAA,GAAS,IAAA,CAAK,KAAA,CAAM,eAAA,CAAgB,SAAS,CAAC,CAAA;AAC9C,IAAA,OAAA,GAAU,IAAA,CAAK,KAAA,CAAM,eAAA,CAAgB,UAAU,CAAC,CAAA;AAAA,EAClD,CAAA,CAAA,MAAQ;AACN,IAAA,MAAM,IAAI,iBAAA,CAAkB,iBAAA,EAAmB,oCAAoC,CAAA;AAAA,EACrF;AAEA,EAAA,IAAI,MAAA,CAAO,KAAK,CAAA,KAAM,OAAA,EAAS;AAC7B,IAAA,MAAM,IAAI,iBAAA;AAAA,MACR,iBAAA;AAAA,MACA,CAAA,iCAAA,EAAoC,MAAA,CAAO,MAAA,CAAO,KAAK,CAAC,CAAC,CAAA;AAAA,KAC3D;AAAA,EACF;AAGA,EAAA,IAAI,MAAA,CAAO,KAAK,CAAA,KAAM,YAAA,EAAc;AAClC,IAAA,MAAM,IAAI,iBAAA;AAAA,MACR,YAAA;AAAA,MACA,+BAA+B,YAAY,CAAA,MAAA,EAAS,OAAO,MAAA,CAAO,KAAK,CAAC,CAAC,CAAA;AAAA,KAC3E;AAAA,EACF;AACA,EAAA,MAAM,GAAA,GAAM,OAAO,MAAA,CAAO,KAAK,MAAM,QAAA,GAAW,MAAA,CAAO,KAAK,CAAA,GAAI,EAAA;AAChE,EAAA,IAAI,CAAC,GAAA,EAAK;AACR,IAAA,MAAM,IAAI,iBAAA,CAAkB,aAAA,EAAe,6BAA6B,CAAA;AAAA,EAC1E;AAEA,EAAA,MAAM,GAAA,GAAM,OAAO,OAAA,CAAQ,KAAK,MAAM,QAAA,GAAW,OAAA,CAAQ,KAAK,CAAA,GAAI,GAAA;AAClE,EAAA,MAAM,GAAA,GAAM,OAAO,OAAA,CAAQ,KAAK,MAAM,QAAA,GAAW,OAAA,CAAQ,KAAK,CAAA,GAAI,GAAA;AAClE,EAAA,MAAM,UAAA,GAAa,IAAA,CAAK,KAAA,CAAM,KAAA,GAAQ,GAAI,CAAA;AAC1C,EAAA,IAAI,OAAO,QAAA,CAAS,GAAG,CAAA,IAAK,GAAA,GAAM,aAAa,aAAA,EAAe;AAC5D,IAAA,MAAM,IAAI,iBAAA,CAAkB,SAAA,EAAW,0BAA0B,CAAA;AAAA,EACnE;AACA,EAAA,IAAI,OAAO,QAAA,CAAS,GAAG,CAAA,IAAK,GAAA,GAAM,aAAa,aAAA,EAAe;AAC5D,IAAA,MAAM,IAAI,iBAAA,CAAkB,eAAA,EAAiB,mCAAmC,CAAA;AAAA,EAClF;AAEA,EAAA,MAAM,cAAA,GAAiB,QAAQ,MAAA,IAAU,oBAAA;AACzC,EAAA,IAAI,OAAA,CAAQ,KAAK,CAAA,KAAM,cAAA,EAAgB;AACrC,IAAA,MAAM,IAAI,iBAAA;AAAA,MACR,cAAA;AAAA,MACA;AAAA,KACF;AAAA,EACF;AACA,EAAA,IAAI,OAAA,CAAQ,KAAK,CAAA,KAAM,OAAA,CAAQ,OAAA,EAAS;AACtC,IAAA,MAAM,IAAI,iBAAA;AAAA,MACR,eAAA;AAAA,MACA;AAAA,KACF;AAAA,EACF;AACA,EAAA,IAAI,OAAA,CAAQ,KAAK,CAAA,KAAM,OAAA,CAAQ,QAAA,EAAU;AACvC,IAAA,MAAM,IAAI,iBAAA;AAAA,MACR,cAAA;AAAA,MACA;AAAA,KACF;AAAA,EACF;AACA,EAAA,MAAM,cAAc,OAAA,CAAQ,GAAA;AAC5B,EAAA,IAAI,WAAA,KAAgB,MAAA,IAAa,OAAA,CAAQ,KAAK,MAAM,WAAA,EAAa;AAC/D,IAAA,MAAM,IAAI,iBAAA;AAAA,MACR,WAAA;AAAA,MACA;AAAA,KACF;AAAA,EACF;AAEA,EAAA,MAAM,GAAA,GAAM,MAAM,OAAA,CAAQ,GAAA,EAAK,OAAO,CAAA;AACtC,EAAA,IAAI,CAAC,GAAA,EAAK;AACR,IAAA,MAAM,IAAI,iBAAA,CAAkB,aAAA,EAAe,CAAA,wBAAA,EAA2B,GAAG,CAAA,CAAE,CAAA;AAAA,EAC7E;AAEA,EAAA,IACE,GAAA,CAAI,KAAK,CAAA,KAAM,IAAA,IACf,IAAI,KAAK,CAAA,KAAM,OAAA,IACd,GAAA,CAAI,KAAK,CAAA,KAAM,MAAA,IAAa,GAAA,CAAI,KAAK,MAAM,OAAA,EAC5C;AACA,IAAA,MAAM,IAAI,iBAAA;AAAA,MACR,iBAAA;AAAA,MACA;AAAA,KACF;AAAA,EACF;AAEA,EAAA,IAAI,SAAA;AACJ,EAAA,IAAI;AACF,IAAA,SAAA,GAAY,MAAM,OAAO,MAAA,CAAO,SAAA;AAAA,MAC9B,KAAA;AAAA,MACA,GAAA;AAAA,MACA,EAAE,IAAA,EAAM,OAAA,EAAS,UAAA,EAAY,OAAA,EAAQ;AAAA,MACrC,KAAA;AAAA,MACA,CAAC,QAAQ;AAAA,KACX;AAAA,EACF,CAAA,CAAA,MAAQ;AACN,IAAA,MAAM,IAAI,iBAAA;AAAA,MACR,mBAAA;AAAA,MACA;AAAA,KACF;AAAA,EACF;AAEA,EAAA,MAAM,cAAA,GAAiB,qBAAqB,YAAY,CAAA;AACxD,EAAA,MAAM,eAAA,GAAkB,IAAI,WAAA,CAAY,cAAA,CAAe,UAAU,CAAA;AACjE,EAAA,IAAI,UAAA,CAAW,eAAe,CAAA,CAAE,GAAA,CAAI,cAAc,CAAA;AAElD,EAAA,MAAM,KAAA,GAAQ,MAAM,MAAA,CAAO,MAAA,CAAO,MAAA;AAAA,IAChC,EAAE,IAAA,EAAM,OAAA,EAAS,IAAA,EAAM,SAAA,EAAU;AAAA,IACjC,SAAA;AAAA,IACA,eAAA;AAAA,IACA,IAAI,aAAY,CAAE,MAAA,CAAO,GAAG,SAAS,CAAA,CAAA,EAAI,UAAU,CAAA,CAAE;AAAA,GACvD;AACA,EAAA,IAAI,CAAC,KAAA,EAAO;AACV,IAAA,MAAM,IAAI,iBAAA;AAAA,MACR,mBAAA;AAAA,MACA;AAAA,KACF;AAAA,EACF;AAEA,EAAA,OAAO,OAAA;AACT;AAEA,eAAe,OAAA,CACb,KACA,OAAA,EAC8C;AAC9C,EAAA,IAAI,OAAO,OAAA,CAAQ,IAAA;AACnB,EAAA,IAAI,CAAC,IAAA,EAAM;AACT,IAAA,MAAM,OAAA,GAAU,QAAQ,OAAA,IAAW,gBAAA;AACnC,IAAA,IAAI;AACF,MAAA,MAAM,YAAY,OAAA,CAAQ,KAAA,IAAS,UAAA,CAAW,KAAA,CAAM,KAAK,UAAU,CAAA;AACnE,MAAA,MAAM,GAAA,GAAM,MAAM,SAAA,CAAU,OAAO,CAAA;AACnC,MAAA,IAAI,CAAC,IAAI,EAAA,EAAI;AACX,QAAA,MAAM,IAAI,KAAA,CAAM,CAAA,uBAAA,EAA0B,GAAA,CAAI,MAAM,CAAA,CAAE,CAAA;AAAA,MACxD;AACA,MAAA,IAAA,GAAQ,MAAM,IAAI,IAAA,EAAK;AAAA,IACzB,SAAS,GAAA,EAAK;AACZ,MAAA,MAAM,IAAI,iBAAA;AAAA,QACR,kBAAA;AAAA,QACA,4BAA4B,OAAO,CAAA,EAAA,EACjC,eAAe,KAAA,GAAQ,GAAA,CAAI,UAAU,eACvC,CAAA;AAAA,OACF;AAAA,IACF;AAAA,EACF;AACA,EAAA,IAAI,CAAC,KAAA,CAAM,OAAA,CAAQ,IAAA,CAAK,IAAI,CAAA,EAAG;AAC7B,IAAA,MAAM,IAAI,iBAAA,CAAkB,kBAAA,EAAoB,iCAAiC,CAAA;AAAA,EACnF;AACA,EAAA,OAAO,IAAA,CAAK,KAAK,IAAA,CAAK,CAAC,QAAQ,GAAA,CAAI,KAAK,MAAM,GAAG,CAAA;AACnD;AAEA,SAAS,gBAAgB,KAAA,EAAuB;AAC9C,EAAA,MAAM,UAAA,GAAa,MAAM,OAAA,CAAQ,IAAA,EAAM,GAAG,CAAA,CAAE,OAAA,CAAQ,MAAM,GAAG,CAAA;AAC7D,EAAA,MAAM,MAAA,GAAS,aAAa,GAAA,CAAI,MAAA,CAAA,CAAQ,IAAK,UAAA,CAAW,MAAA,GAAS,KAAM,CAAC,CAAA;AACxE,EAAA,MAAM,MAAA,GAAS,KAAK,MAAM,CAAA;AAC1B,EAAA,OAAO,IAAI,WAAA,EAAY,CAAE,MAAA,CAAO,UAAA,CAAW,IAAA,CAAK,MAAA,EAAQ,CAAC,EAAA,KAAO,EAAA,CAAG,UAAA,CAAW,CAAC,CAAC,CAAC,CAAA;AACnF;AAEA,SAAS,qBAAqB,KAAA,EAA2B;AACvD,EAAA,MAAM,UAAA,GAAa,MAAM,OAAA,CAAQ,IAAA,EAAM,GAAG,CAAA,CAAE,OAAA,CAAQ,MAAM,GAAG,CAAA;AAC7D,EAAA,MAAM,MAAA,GAAS,aAAa,GAAA,CAAI,MAAA,CAAA,CAAQ,IAAK,UAAA,CAAW,MAAA,GAAS,KAAM,CAAC,CAAA;AACxE,EAAA,MAAM,MAAA,GAAS,KAAK,MAAM,CAAA;AAC1B,EAAA,MAAM,GAAA,GAAM,IAAI,UAAA,CAAW,MAAA,CAAO,MAAM,CAAA;AACxC,EAAA,KAAA,IAAS,CAAA,GAAI,CAAA,EAAG,CAAA,GAAI,MAAA,CAAO,MAAA,EAAQ,CAAA,IAAK,CAAA,EAAG,GAAA,CAAI,CAAC,CAAA,GAAI,MAAA,CAAO,UAAA,CAAW,CAAC,CAAA;AACvE,EAAA,OAAO,GAAA;AACT;;;ACpVO,IAAM,WAAN,MAAe;AAAA,EACX,WAAA,GAAc;AAAA,IACrB,OAAA,EAAS,CAAC,KAAA,KACR,IAAA,CAAK,QAAQ,0BAAA,EAA4B;AAAA,MACvC,MAAA,EAAQ,MAAA;AAAA,MACR,IAAA,EAAM,mBAAA,CAAoB,KAAA,EAAO,IAAA,CAAK,OAAO,CAAA;AAAA,MAC7C,gBAAgB,KAAA,CAAM;AAAA,KACvB,CAAA;AAAA,IACH,GAAA,EAAK,CAACC,GAAAA,KACJ,IAAA,CAAK,OAAA,CAAQ,CAAA,iBAAA,EAAoB,kBAAA,CAAmBA,GAAE,CAAC,CAAA,CAAA,EAAI,EAAE,MAAA,EAAQ,OAAO,CAAA;AAAA,IAC9E,UAAA,EAAY,CACV,KAAA,EACA,cAAA,KAEA,IAAA,CAAK,OAAA,CAAQ,oBAAA,EAAsB,EAAE,MAAA,EAAQ,MAAA,EAAQ,IAAA,EAAM,KAAA,EAAO,gBAAgB,CAAA;AAAA,IACpF,UAAA,EAAY,CAACA,GAAAA,KACX,IAAA,CAAK,OAAA,CAAQ,CAAA,mBAAA,EAAsB,kBAAA,CAAmBA,GAAE,CAAC,CAAA,CAAA,EAAI,EAAE,MAAA,EAAQ,UAAU;AAAA,GACrF;AAAA;AAAA,EAGA,MAAM,OAAO,OAAA,EAAiD;AAC5D,IAAA,OAAO,IAAA,CAAK,QAAwB,YAAA,EAAc;AAAA,MAChD,MAAA,EAAQ,MAAA;AAAA,MACR,IAAA,EAAM,OAAA;AAAA,MACN,gBAAgB,OAAA,CAAQ,cAAA;AAAA,MACxB,SAAA,EAAW,IAAA,CAAK,GAAA,CAAI,IAAA,CAAK,WAAW,IAAM;AAAA,KAC3C,CAAA;AAAA,EACH;AAAA,EACiB,MAAA;AAAA,EACA,kBAAA;AAAA,EACA,OAAA;AAAA,EACA,SAAA;AAAA,EACA,OAAA;AAAA,EACA,UAAA;AAAA,EACA,SAAA;AAAA,EACA,UAAA;AAAA,EAEjB,YAAY,OAAA,EAA0B;AACpC,IAAA,IAAI,CAAC,CAAC,OAAA,CAAQ,WAAW,CAAC,CAAC,QAAQ,kBAAA,EAAoB;AACrD,MAAA,MAAM,IAAI,cAAc,6BAA6B,CAAA;AAAA,IACvD;AACA,IAAA,IAAI,OAAA,CAAQ,UAAA,IAAc,OAAA,CAAQ,UAAA,KAAe,WAAA,EAAa;AAC5D,MAAA,MAAM,IAAI,aAAA;AAAA,QACR;AAAA,OACF;AAAA,IACF;AACA,IAAA,IAAA,CAAK,SAAS,OAAA,CAAQ,MAAA;AACtB,IAAA,IAAA,CAAK,qBAAqB,OAAA,CAAQ,kBAAA;AAClC,IAAA,IAAA,CAAK,UAAU,cAAA,CAAe,OAAA,CAAQ,KAAK,OAAA,CAAQ,OAAA,IAAW,YAAY,CAAA;AAC1E,IAAA,IAAA,CAAK,SAAA,GAAY,OAAA,CAAQ,SAAA,IAAa,gBAAA,CAAiB,KAAK,OAAO,CAAA;AACnE,IAAA,IAAA,CAAK,OAAA,GAAU,QAAQ,OAAA,IAAW,QAAA;AAClC,IAAA,IAAA,CAAK,UAAA,GAAa,WAAA;AAClB,IAAA,IAAA,CAAK,YAAY,OAAA,CAAQ,KAAA,IAAS,UAAA,CAAW,KAAA,CAAM,KAAK,UAAU,CAAA;AAClE,IAAA,IAAA,CAAK,UAAA,GAAa,OAAA,CAAQ,UAAA,IAAc,CAAA,cAAA,EAAiB,WAAW,CAAA,CAAA;AAAA,EACtE;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAgBA,MAAM,OAAO,OAAA,EAA0C;AACrD,IAAA,MAAM,UAAU,MAAM,cAAA;AAAA,MACpB;AAAA,QACE,GAAG,OAAA,CAAQ,OAAA;AAAA,QACX,OAAA,EAAS,cAAA,CAAe,OAAA,CAAQ,OAAA,CAAQ,OAAO;AAAA,OACjD;AAAA,MACA,IAAA,CAAK;AAAA,KACP;AAEA,IAAA,MAAM,IAAA,GAAsB;AAAA,MAC1B,GAAG,OAAA;AAAA,MACH;AAAA,KACF;AAEA,IAAA,IAAI;AACF,MAAA,MAAM,OAAA,GAAU,MAAM,IAAA,CAAK,OAAA,CAAiB,YAAA,EAAc;AAAA,QACxD,MAAA,EAAQ,MAAA;AAAA,QACR,IAAA;AAAA,QACA,gBAAgB,OAAA,CAAQ;AAAA,OACzB,CAAA;AACD,MAAA,IAAI,CAAC,mBAAA,CAAoB,OAAO,CAAA,EAAG;AACjC,QAAA,OAAO,wBAAA;AAAA,UACL,qDAAA;AAAA,UACA,OAAA,CAAQ;AAAA,SACV;AAAA,MACF;AACA,MAAA,OAAO,0BAA0B,OAAO,CAAA;AAAA,IAC1C,SAAS,GAAA,EAAK;AACZ,MAAA,IAAI,eAAe,gBAAA,EAAkB;AACnC,QAAA,MAAM,GAAA;AAAA,MACR;AACA,MAAA,OAAO,wBAAA;AAAA,QACL,GAAA,YAAe,KAAA,GAAQ,CAAA,UAAA,EAAa,GAAA,CAAI,OAAO,CAAA,CAAA,GAAK,yBAAA;AAAA,QACpD,OAAA,CAAQ;AAAA,OACV;AAAA,IACF;AAAA,EACF;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAmBA,MAAM,SAAS,OAAA,EAAqD;AAClE,IAAA,OAAO,IAAA,CAAK,QAA0B,cAAA,EAAgB;AAAA,MACpD,MAAA,EAAQ,MAAA;AAAA,MACR,IAAA,EAAM,OAAA;AAAA,MACN,gBAAgB,OAAA,CAAQ;AAAA,KACzB,CAAA;AAAA,EACH;AAAA;AAAA;AAAA;AAAA,EAKA,MAAM,UAAU,OAAA,EAAuD;AACrE,IAAA,OAAO,IAAA,CAAK,QAA2B,eAAA,EAAiB;AAAA,MACtD,MAAA,EAAQ,MAAA;AAAA,MACR,IAAA,EAAM;AAAA,KACP,CAAA;AAAA,EACH;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAQA,MAAM,kBAAkB,OAAA,EAKiB;AACvC,IAAA,OAAO,IAAA,CAAK,QAAqC,eAAA,EAAiB;AAAA,MAChE,MAAA,EAAQ,MAAA;AAAA,MACR,IAAA,EAAM;AAAA,KACP,CAAA;AAAA,EACH;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAUA,MAAM,kBAAA,CACJ,KAAA,EACA,OAAA,EAC6B;AAC7B,IAAA,OAAO,mBAAmB,KAAA,EAAO;AAAA,MAC/B,GAAG,OAAA;AAAA,MACH,OAAA,EAAS,CAAA,EAAG,IAAA,CAAK,OAAO,CAAA,sBAAA,CAAA;AAAA,MACxB,OAAO,IAAA,CAAK;AAAA,KACb,CAAA;AAAA,EACH;AAAA;AAAA;AAAA;AAAA,EAKA,MAAM,OAAA,CACJ,IAAA,EACA,IAAA,EAMY;AACZ,IAAA,MAAM,UAAA,GAAa,IAAI,eAAA,EAAgB;AACvC,IAAA,MAAM,SAAA,GAAY,IAAA,CAAK,SAAA,IAAa,IAAA,CAAK,SAAA;AACzC,IAAA,MAAM,QAAQ,UAAA,CAAW,MAAM,UAAA,CAAW,KAAA,IAAS,SAAS,CAAA;AAE5D,IAAA,IAAI;AACF,MAAA,MAAM,OAAA,GAAkC;AAAA,QACtC,GAAI,IAAA,CAAK,MAAA,GAAS,EAAE,aAAA,EAAe,UAAU,IAAA,CAAK,MAAM,CAAA,CAAA,EAAG,GAAI,EAAC;AAAA,QAChE,cAAA,EAAgB,kBAAA;AAAA,QAChB,MAAA,EAAQ,kBAAA;AAAA,QACR,cAAc,IAAA,CAAK,UAAA;AAAA,QACnB,qBAAqB,IAAA,CAAK;AAAA,OAC5B;AACA,MAAA,IAAI,KAAK,kBAAA,EAAoB;AAC3B,QAAA,IAAI;AACF,UAAA,MAAA,CAAO,MAAA;AAAA,YACL,OAAA;AAAA,YACA,MAAM,iBAAA;AAAA,cACJ,IAAA,CAAK,mBAAmB,OAAA,CAAQ;AAAA,gBAC9B,GAAA,EAAK,CAAA,EAAG,IAAA,CAAK,OAAO,GAAG,IAAI,CAAA,CAAA;AAAA,gBAC3B,QAAQ,IAAA,CAAK,MAAA;AAAA,gBACb,QAAQ,UAAA,CAAW;AAAA,eACpB,CAAA;AAAA,cACD,UAAA,CAAW;AAAA;AACb,WACF;AAAA,QACF,CAAA,CAAA,MAAQ;AACN,UAAA,MAAM,IAAI,aAAA,CAAc,wBAAA,EAA0B,EAAE,IAAA,EAAM,cAAc,CAAA;AAAA,QAC1E;AACA,QAAA,IAAI,CAAC,OAAA,CAAQ,aAAA,EAAe,WAAW,OAAO,CAAA,IAAK,CAAC,OAAA,CAAQ,IAAA;AAC1D,UAAA,MAAM,IAAI,cAAc,0BAA0B,CAAA;AAAA,MACtD;AACA,MAAA,IAAI,KAAK,cAAA,EAAgB;AACvB,QAAA,OAAA,CAAQ,iBAAiB,IAAI,IAAA,CAAK,cAAA;AAAA,MACpC;AAEA,MAAA,MAAM,GAAA,GAAM,MAAM,IAAA,CAAK,SAAA,CAAU,GAAG,IAAA,CAAK,OAAO,CAAA,EAAG,IAAI,CAAA,CAAA,EAAI;AAAA,QACzD,QAAQ,IAAA,CAAK,MAAA;AAAA,QACb,OAAA;AAAA,QACA,IAAA,EAAM,KAAK,IAAA,KAAS,KAAA,CAAA,GAAY,KAAK,SAAA,CAAU,IAAA,CAAK,IAAI,CAAA,GAAI,KAAA,CAAA;AAAA,QAC5D,QAAQ,UAAA,CAAW,MAAA;AAAA,QACnB,QAAA,EAAU;AAAA,OACX,CAAA;AAED,MAAA,MAAM,IAAA,GAAO,MAAM,GAAA,CAAI,IAAA,EAAK;AAC5B,MAAA,IAAI,MAAA,GAAkB,KAAA,CAAA;AACtB,MAAA,IAAI,IAAA,EAAM;AACR,QAAA,IAAI;AACF,UAAA,MAAA,GAAS,IAAA,CAAK,MAAM,IAAI,CAAA;AAAA,QAC1B,CAAA,CAAA,MAAQ;AACN,UAAA,MAAA,GAAS,IAAA;AAAA,QACX;AAAA,MACF;AAEA,MAAA,IAAI,CAAC,IAAI,EAAA,EAAI;AACX,QAAA,MAAM,UACJ,OAAO,MAAA,KAAW,QAAA,IAAY,MAAA,KAAW,OACpC,MAAA,GACD,IAAA;AACN,QAAA,MAAM,UAAA,GACJ,OAAO,OAAA,KAAY,QAAA,GACf,OAAA,GACA;AAAA,UACE,KAAA,EAAO,OAAA,CAAQ,KAAA,IAAS,CAAA,KAAA,EAAQ,IAAI,MAAM,CAAA,CAAA;AAAA,UAC1C,SAAS,OAAA,CAAQ,OAAA;AAAA,UACjB,MAAM,OAAA,CAAQ;AAAA,SAChB;AACN,QAAA,MAAM,IAAI,gBAAA,CAAiB,GAAA,CAAI,MAAA,EAAQ,UAAU,CAAA;AAAA,MACnD;AAEA,MAAA,OAAO,MAAA;AAAA,IACT,SAAS,GAAA,EAAK;AACZ,MAAA,IAAI,GAAA,YAAe,kBAAkB,MAAM,GAAA;AAC3C,MAAA,IAAI,GAAA,YAAe,KAAA,IAAS,GAAA,CAAI,IAAA,KAAS,YAAA,EAAc;AACrD,QAAA,MAAM,IAAI,aAAA,CAAc,CAAA,wBAAA,EAA2B,SAAS,CAAA,EAAA,CAAA,EAAM;AAAA,UAChE,IAAA,EAAM;AAAA,SACP,CAAA;AAAA,MACH;AACA,MAAA,MAAM,eAAe,KAAA,GACjB,IAAI,aAAA,CAAc,GAAA,CAAI,SAAS,EAAE,IAAA,EAAM,WAAA,EAAa,IACpD,IAAI,aAAA,CAAc,2BAA2B,EAAE,IAAA,EAAM,aAAa,CAAA;AAAA,IACxE,CAAA,SAAE;AACA,MAAA,YAAA,CAAa,KAAK,CAAA;AAAA,IACpB;AAAA,EACF;AAAA;AAAA,EAGA,IAAI,MAAA,GAKF;AACA,IAAA,OAAO;AAAA,MACL,SAAS,IAAA,CAAK,OAAA;AAAA,MACd,WAAW,IAAA,CAAK,SAAA;AAAA,MAChB,SAAS,IAAA,CAAK,OAAA;AAAA,MACd,YAAY,IAAA,CAAK;AAAA,KACnB;AAAA,EACF;AACF;AAEA,IAAM,oCAAyC,IAAI,GAAA,CAAI,CAAC,OAAA,EAAS,WAAA,EAAa,MAAM,CAAC,CAAA;AAM9E,SAAS,oBAAoB,KAAA,EAAkC;AACpE,EAAA,IAAI,OAAO,KAAA,KAAU,QAAA,IAAY,KAAA,KAAU,MAAM,OAAO,KAAA;AACxD,EAAA,MAAM,CAAA,GAAI,KAAA;AACV,EAAA,OACE,OAAO,CAAA,CAAE,QAAA,KAAa,YACtB,iBAAA,CAAkB,GAAA,CAAI,EAAE,QAAQ,CAAA,IAChC,OAAO,CAAA,CAAE,OAAA,KAAY,YACrB,CAAA,CAAE,OAAA,CAAQ,SAAS,CAAA,IACnB,OAAO,EAAE,QAAA,KAAa,SAAA;AAE1B;;;AC9OO,SAAS,gBACd,CAAA,EACA,GAAA,GAAM,IAAA,CAAK,GAAA,IACX,eAAA,EACA;AACA,EAAA,IACE,oBAAoB,MAAA,KACnB,CAAC,OAAO,aAAA,CAAc,eAAe,KAAK,eAAA,GAAkB,CAAA,CAAA;AAE7D,IAAA,MAAM,IAAI,MAAM,qBAAqB,CAAA;AACvC,EAAA,MAAM,cAAA,GAAiB,CAAA,CAAE,QAAA,CAAS,UAAA,CAAW,MAAA;AAAA,IAC3C,CAAC,GAAG,CAAA,KAAM,CAAA,IAAK,EAAE,KAAA,KAAU,WAAA,GAAc,EAAE,SAAA,GAAY,CAAA,CAAA;AAAA,IACvD;AAAA,GACF;AACA,EAAA,MAAM,eAAA,GAAkB,CAAA,CAAE,QAAA,CAAS,UAAA,CAAW,MAAA;AAAA,IAC5C,CAAC,CAAA,EAAG,CAAA,KAAM,CAAA,IAAK,CAAA,CAAE,KAAA,KAAU,UAAA,IAAc,CAAA,CAAE,KAAA,KAAU,SAAA,GAAY,CAAA,CAAE,KAAA,GAAQ,CAAA,CAAA;AAAA,IAC3E;AAAA,GACF;AACA,EAAA,MAAM,GAAA,GACJ,CAAA,CAAE,OAAA,CAAQ,WAAA,KAAgB,IAAA,GACtB,IAAA,GACA,CAAA,CAAE,OAAA,CAAQ,cAAA,GAAiB,CAAA,CAAE,OAAA,CAAQ,cAAA,GAAiB,EAAE,OAAA,CAAQ,WAAA;AACtE,EAAA,OAAO;AAAA,IACL,gBACE,CAAA,CAAE,OAAA,CAAQ,UAAU,SAAA,IACpB,CAAA,CAAE,QAAQ,cAAA,GAAiB,CAAA,IAC3B,EAAE,OAAA,CAAQ,cAAA,KAAmB,KAC7B,CAAA,CAAE,OAAA,CAAQ,mBAAmB,CAAA,IAC7B,cAAA,KAAmB,EAAE,KAAA,CAAM,QAAA;AAAA,IAC7B,WAAA,EAAa,CAAA,CAAE,OAAA,CAAQ,cAAA,GAAiB,EAAE,OAAA,CAAQ,cAAA;AAAA,IAClD,4BAAA,EAA8B,cAAA,GAAiB,CAAA,CAAE,KAAA,CAAM,QAAA,CAAS,UAAA;AAAA,IAChE,cAAA;AAAA,IACA,eAAA;AAAA,IACA,yBAAA,EACE,CAAA,CAAE,OAAA,CAAQ,KAAA,KAAU,SAAA,IACpB,EAAE,OAAA,CAAQ,WAAA,KAAgB,SAAA,IAC1B,CAAA,CAAE,OAAA,CAAQ,WAAA,KAAgB,aAC1B,CAAA,CAAE,OAAA,CAAQ,KAAA,KAAU,SAAA,IACpB,eAAA,GAAkB,CAAA,GACd,IAAA,CAAK,GAAA,CAAI,CAAA,EAAG,GAAA,GAAM,CAAA,CAAE,SAAS,CAAA,GAC7B,IAAA;AAAA,IACN,aAAA,EAAe,EAAE,OAAA,CAAQ,cAAA;AAAA,IACzB,aAAA,EAAe,EAAE,OAAA,CAAQ,cAAA;AAAA,IACzB,eAAA,EAAiB,EAAE,OAAA,CAAQ,WAAA;AAAA,IAC3B,6BAAA,EAA+B,GAAA;AAAA,IAC/B,mBACE,GAAA,KAAQ,IAAA,IAAQ,eAAA,KAAoB,MAAA,GAAY,OAAO,GAAA,GAAM,eAAA;AAAA;AAAA,IAE/D,gBAAA,EAAkB,IAAA;AAAA,IAClB,gBAAA,EAAkB,IAAA;AAAA,IAClB,mBAAmB,IAAA,CAAK,GAAA,CAAI,GAAG,CAAA,CAAE,SAAA,GAAY,EAAE,SAAS;AAAA,GAC1D;AACF;;;AC/KO,IAAM,oBAAA,GAAuB;AAAA,EAClC,EAAA,EAAI,GAAA;AAAA,EACJ,OAAA,EAAS,GAAA;AAAA,EACT,UAAA,EAAY,GAAA;AAAA,EACZ,YAAA,EAAc,GAAA;AAAA,EACd,SAAA,EAAW,GAAA;AAAA,EACX,QAAA,EAAU,GAAA;AAAA,EACV,QAAA,EAAU,GAAA;AAAA,EACV,oBAAA,EAAsB,GAAA;AAAA,EACtB,eAAA,EAAiB;AACnB;AAKO,IAAM,4BAAA,GAA+B;AAAA,EAC1C,EAAA,EAAI,0FAAA;AAAA,EACJ,OAAA,EAAS,4DAAA;AAAA,EACT,UAAA,EAAY,mDAAA;AAAA,EACZ,YAAA,EAAc,gCAAA;AAAA,EACd,SAAA,EAAW,yCAAA;AAAA,EACX,QAAA,EAAU,6CAAA;AAAA,EACV,QAAA,EAAU,6EAAA;AAAA,EACV,oBAAA,EACE,0IAAA;AAAA,EACF,eAAA,EAAiB;AACnB;AAeO,SAAS,gBAAgB,OAAA,EAAmD;AACjF,EAAA,OAAO,OAAA,CAAQ,QAAA,KAAa,OAAA,IAAW,CAAC,OAAA,CAAQ,QAAA;AAClD;AAMO,SAAS,oBAAoB,OAAA,EAAsC;AACxE,EAAA,IAAI,OAAA,CAAQ,QAAA,IAAY,OAAA,CAAQ,QAAA,KAAa,WAAA,EAAa;AACxD,IAAA,OAAO,oBAAA,CAAqB,oBAAA;AAAA,EAC9B;AACA,EAAA,IAAI,OAAA,CAAQ,QAAA,KAAa,MAAA,EAAQ,OAAO,oBAAA,CAAqB,SAAA;AAC7D,EAAA,IAAI,CAAC,eAAA,CAAgB,OAAO,CAAA,EAAG;AAC7B,IAAA,OAAO,oBAAA,CAAqB,oBAAA;AAAA,EAC9B;AACA,EAAA,OAAO,oBAAA,CAAqB,EAAA;AAC9B;;;ACpDA,IAAM,QAAA,GAAW,0BAAA;AAGjB,eAAsB,2BACpB,SAAA,EACiB;AACjB,EAAA,MAAM,EAAE,WAAA,EAAa,MAAA,EAAQ,KAAA,EAAO,WAAU,GAAI,SAAA;AAClD,EAAA,IACE,MAAA,CAAO,IAAA,CAAK,SAAS,CAAA,CAAE,IAAA;AAAA,IACrB,CAAC,GAAA,KAAQ,CAAC,CAAC,aAAA,EAAe,UAAU,OAAA,EAAS,WAAW,CAAA,CAAE,QAAA,CAAS,GAAG;AAAA,GACxE,IACA,OAAO,WAAA,KAAgB,QAAA,IACvB,CAAC,QAAA,CAAS,IAAA,CAAK,WAAW,CAAA,IAC1B,OAAO,MAAA,KAAW,QAAA,IAClB,CAAC,SAAS,IAAA,CAAK,MAAM,CAAA,IACrB,CAAC,MAAA,CAAO,aAAA,CAAc,KAAK,CAAA,IAC3B,QAAQ,CAAA,IACP,SAAA,KAAc,MAAA,KACZ,OAAO,cAAc,QAAA,IAAY,CAAC,QAAA,CAAS,IAAA,CAAK,SAAS,CAAA,CAAA,EAC5D;AACA,IAAA,MAAM,IAAI,UAAU,gCAAgC,CAAA;AAAA,EACtD;AACA,EAAA,MAAM,KAAA,GAAQ,IAAI,WAAA,EAAY,CAAE,MAAA;AAAA,IAC9B,KAAK,SAAA,CAAU;AAAA,MACb,oBAAA;AAAA,MACA,kBAAA;AAAA,MACA,WAAA;AAAA,MACA,MAAA;AAAA,MACA,KAAA;AAAA,MACA,SAAA,IAAa;AAAA,KACd;AAAA,GACH;AACA,EAAA,MAAM,SAAS,MAAM,MAAA,CAAO,MAAA,CAAO,MAAA,CAAO,WAAW,KAAK,CAAA;AAC1D,EAAA,OAAO,KAAA,CAAM,IAAA;AAAA,IAAK,IAAI,WAAW,MAAM,CAAA;AAAA,IAAG,CAAC,SACzC,IAAA,CAAK,QAAA,CAAS,EAAE,CAAA,CAAE,QAAA,CAAS,GAAG,GAAG;AAAA,GACnC,CAAE,KAAK,EAAE,CAAA;AACX;;;ACnCO,SAAS,mBAAmB,GAAA,EAAsB;AACvD,EAAA,MAAM,QAAA,GACJ,GAAA,CAAI,OAAA,CAAQ,GAAA,CAAI,kBAAkB,CAAA,EAAG,IAAA,EAAK,IAC1C,GAAA,CAAI,OAAA,CAAQ,GAAA,CAAI,WAAW,CAAA,EAAG,MAAK,IACnC,GAAA,CAAI,OAAA,CAAQ,GAAA,CAAI,wBAAwB,CAAA,EAAG,KAAA,CAAM,GAAG,CAAA,CAAE,CAAC,CAAA,EAAG,IAAA,EAAK,IAC/D,EAAA;AACF,EAAA,IAAI,UAAU,OAAO,QAAA;AAIrB,EAAA,OAAO,GAAA,CAAI,OAAA,CAAQ,GAAA,CAAI,iBAAiB,CAAA,EAAG,KAAA,CAAM,GAAG,CAAA,CAAE,CAAC,CAAA,EAAG,IAAA,EAAK,IAAK,EAAA;AACtE;;;AC+BO,SAAS,YAAA,CACd,MAAA,EACA,MAAA,EACA,OAAA,GAAuB,EAAC,EAKP;AACjB,EAAA,OAAO,OAAO,GAAA,EAAK,GAAA,EAAK,IAAA,KAAS;AAC/B,IAAA,IAAI;AACF,MAAA,MAAM,OAAA,GAAU,OAAA,CAAQ,OAAA,GAAU,GAAG,CAAA,IAAK,CAAA,EAAG,GAAA,CAAI,QAAA,IAAY,EAAE,CAAA,EAAG,GAAA,CAAI,IAAA,IAAQ,EAAE,CAAA,CAAA;AAChF,MAAA,MAAM,OAAA,GAAU,OAAA,CAAQ,OAAA,GAAU,GAAG,CAAA;AAErC,MAAA,MAAM,CAAA,GAAa,MAAM,MAAA,CAAO,MAAA,CAAO;AAAA,QACrC,MAAA;AAAA,QACA,OAAA;AAAA,QACA,OAAA;AAAA,QACA,OAAA,EAAS;AAAA,UACP,KAAA,EAAO,IAAI,IAAA,EAAM,KAAA;AAAA,UACjB,IAAI,GAAA,CAAI,EAAA;AAAA,UACR,SAAA,EAAA,CACG,OAAO,GAAA,CAAI,OAAA,CAAQ,YAAY,CAAA,KAAM,QAAA,GAClC,GAAA,CAAI,OAAA,CAAQ,YAAY,CAAA,GACxB,KAAA,CAAA,KAAc,EAAA;AAAA,UACpB,SAAS,GAAA,CAAI,OAAA;AAAA,UACb,UAAU,GAAA,CAAI;AAAA;AAChB,OACD,CAAA;AAED,MAAA,GAAA,CAAI,OAAO,QAAA,GAAW,CAAA;AAEtB,MAAA,IAAI,CAAA,CAAE,QAAA,IAAY,CAAA,CAAE,QAAA,KAAa,WAAA,EAAa;AAC5C,QAAA,GAAA,CACG,MAAA,CAAO,oBAAA,CAAqB,oBAAoB,CAAA,CAChD,IAAA,CAAK,EAAE,SAAA,EAAW,IAAA,EAAM,OAAA,EAAS,CAAA,CAAE,OAAA,EAAS,CAAA;AAC/C,QAAA;AAAA,MACF;AACA,MAAA,IAAI,CAAA,CAAE,aAAa,MAAA,EAAQ;AACzB,QAAA,GAAA,CACG,MAAA,CAAO,oBAAA,CAAqB,SAAS,CAAA,CACrC,IAAA,CAAK,EAAE,KAAA,EAAO,SAAA,EAAW,OAAA,EAAS,CAAA,CAAE,OAAA,EAAS,CAAA;AAChD,QAAA;AAAA,MACF;AACA,MAAA,IAAI,CAAC,eAAA,CAAgB,CAAC,CAAA,EAAG;AAEvB,QAAA,GAAA,CACG,MAAA,CAAO,oBAAA,CAAqB,oBAAoB,CAAA,CAChD,IAAA,CAAK,EAAE,SAAA,EAAW,IAAA,EAAM,OAAA,EAAS,CAAA,CAAE,OAAA,EAAS,CAAA;AAC/C,QAAA;AAAA,MACF;AACA,MAAA,IAAA,EAAK;AAAA,IACP,SAAS,GAAA,EAAK;AACZ,MAAA,IAAA,CAAK,GAAG,CAAA;AAAA,IACV;AAAA,EACF,CAAA;AACF;;;AChFA,eAAsB,iBAAA,CACpB,MAAA,EACA,GAAA,EACA,OAAA,EACkB;AAClB,EAAA,MAAM,GAAA,GAAM,IAAI,GAAA,CAAI,GAAA,CAAI,GAAG,CAAA;AAC3B,EAAA,OAAO,OAAO,MAAA,CAAO;AAAA,IACnB,QAAQ,OAAA,CAAQ,MAAA;AAAA,IAChB,OAAA,EAAS,QAAQ,OAAA,IAAW,CAAA,EAAG,IAAI,IAAI,CAAA,EAAG,IAAI,QAAQ,CAAA,CAAA;AAAA,IACtD,SAAS,OAAA,CAAQ,OAAA;AAAA,IACjB,OAAA,EAAS;AAAA,MACP,KAAA,EAAO,QAAQ,IAAA,EAAM,KAAA;AAAA,MACrB,EAAA,EAAI,mBAAmB,GAAG,CAAA;AAAA,MAC1B,SAAA,EAAW,GAAA,CAAI,OAAA,CAAQ,GAAA,CAAI,YAAY,CAAA,IAAK,EAAA;AAAA,MAC5C,OAAA,EAAS,MAAA,CAAO,WAAA,CAAY,GAAA,CAAI,OAAO,CAAA;AAAA,MACvC,UAAU,OAAA,CAAQ;AAAA;AACpB,GACD,CAAA;AACH;;;AC1BO,IAAM,aAAA,GAAN,cAA4B,KAAA,CAAM;AAAA,EACvC,YAA4B,IAAA,EAAc;AACxC,IAAA,KAAA,CAAM,IAAI,CAAA;AADgB,IAAA,IAAA,CAAA,IAAA,GAAA,IAAA;AAE1B,IAAA,IAAA,CAAK,IAAA,GAAO,eAAA;AAAA,EACd;AAAA,EAH4B,IAAA;AAI9B;AACO,SAAS,cAAA,CAAe,OAAgB,IAAA,EAA6B;AAC1E,EAAA,IAAI,CAAC,KAAA,EAAO,MAAM,IAAI,cAAc,IAAI,CAAA;AAC1C;AAEO,SAAS,kBAAkB,KAAA,EAAwB;AACxD,EAAA,IAAI,KAAA,KAAU,QAAQ,OAAO,KAAA,KAAU,WAAW,OAAO,IAAA,CAAK,UAAU,KAAK,CAAA;AAC7E,EAAA,IAAI,OAAO,UAAU,QAAA,EAAU;AAC7B,IAAA,cAAA;AAAA,MACE,MAAA,CAAO,cAAc,KAAK,CAAA,IAAK,CAAC,MAAA,CAAO,EAAA,CAAG,OAAO,EAAE,CAAA;AAAA,MACnD;AAAA,KACF;AACA,IAAA,OAAO,OAAO,KAAK,CAAA;AAAA,EACrB;AACA,EAAA,IAAI,OAAO,UAAU,QAAA,EAAU;AAC7B,IAAA,cAAA,CAAe,gBAAA,CAAiB,IAAA,CAAK,KAAK,CAAA,EAAG,qBAAqB,CAAA;AAClE,IAAA,OAAO,IAAA,CAAK,UAAU,KAAK,CAAA;AAAA,EAC7B;AACA,EAAA,IAAI,KAAA,CAAM,OAAA,CAAQ,KAAK,CAAA,EAAG,OAAO,CAAA,CAAA,EAAI,KAAA,CAAM,GAAA,CAAI,iBAAiB,CAAA,CAAE,IAAA,CAAK,GAAG,CAAC,CAAA,CAAA,CAAA;AAC3E,EAAA,cAAA;AAAA,IACE,KAAA,IACE,OAAO,KAAA,KAAU,QAAA,IACjB,OAAO,cAAA,CAAe,KAAK,MAAM,MAAA,CAAO,SAAA;AAAA,IAC1C;AAAA,GACF;AACA,EAAA,MAAM,GAAA,GAAM,KAAA;AACZ,EAAA,OAAO,CAAA,CAAA,EAAI,MAAA,CAAO,IAAA,CAAK,GAAG,CAAA,CACvB,MAAK,CACL,GAAA,CAAI,CAAC,GAAA,KAAQ,CAAA,EAAG,iBAAA,CAAkB,GAAG,CAAC,CAAA,CAAA,EAAI,iBAAA,CAAkB,GAAA,CAAI,GAAG,CAAC,CAAC,CAAA,CAAE,CAAA,CACvE,IAAA,CAAK,GAAG,CAAC,CAAA,CAAA,CAAA;AACd;AACA,eAAsB,aAAa,KAAA,EAAgC;AACjE,EAAA,OAAO,KAAA,CAAM,IAAA;AAAA,IACX,IAAI,UAAA;AAAA,MACF,MAAM,MAAA,CAAO,MAAA,CAAO,MAAA,CAAO,SAAA,EAAW,IAAI,WAAA,EAAY,CAAE,MAAA,CAAO,KAAK,CAAC;AAAA,KACvE;AAAA,IACA,CAAC,MAAM,CAAA,CAAE,QAAA,CAAS,EAAE,CAAA,CAAE,QAAA,CAAS,GAAG,GAAG;AAAA,GACvC,CAAE,KAAK,EAAE,CAAA;AACX;AACA,IAAMC,OAAAA,GAAS,CAAC,KAAA,KACd,IAAA,CAAK,KAAA,CAAM,IAAA,CAAK,KAAA,EAAO,CAAC,CAAA,KAAM,MAAA,CAAO,YAAA,CAAa,CAAC,CAAC,CAAA,CAAE,IAAA,CAAK,EAAE,CAAC,CAAA,CAC3D,OAAA,CAAQ,KAAA,EAAO,GAAG,CAAA,CAClB,OAAA,CAAQ,KAAA,EAAO,GAAG,CAAA,CAClB,OAAA,CAAQ,KAAA,EAAO,EAAE,CAAA;AACtB,IAAM,MAAA,GAAS,CAAC,IAAA,KACd,UAAA,CAAW,IAAA;AAAA,EAAK,IAAA,CAAK,KAAK,OAAA,CAAQ,IAAA,EAAM,GAAG,CAAA,CAAE,OAAA,CAAQ,IAAA,EAAM,GAAG,CAAC,CAAA;AAAA,EAAG,CAAC,CAAA,KACjE,CAAA,CAAE,UAAA,CAAW,CAAC;AAChB,CAAA;AACK,SAAS,aAAA,CACd,OAAA,EACA,GAAA,EACA,EAAA,EACa;AACb,EAAA,MAAM,UAAU,OAAA,CAAQ,MAAA,CAAO,CAACC,IAAAA,KAAQA,IAAAA,CAAI,QAAQ,GAAG,CAAA;AACvD,EAAA,cAAA,CAAe,OAAA,CAAQ,MAAA,KAAW,CAAA,EAAG,oBAAoB,CAAA;AACzD,EAAA,MAAM,GAAA,GAAM,QAAQ,CAAC,CAAA;AACrB,EAAA,cAAA;AAAA,IACE,IAAI,GAAA,CAAI,GAAA,KAAQ,QACd,GAAA,CAAI,GAAA,CAAI,QAAQ,OAAA,KACf,CAAC,GAAA,CAAI,GAAA,CAAI,OAAO,GAAA,CAAI,GAAA,CAAI,QAAQ,OAAA,CAAA,IACjC,CAAC,IAAI,GAAA,CAAI,CAAA;AAAA,IACX;AAAA,GACF;AACA,EAAA,cAAA;AAAA,IACE,OAAO,aAAA,CAAc,EAAE,KACrB,MAAA,CAAO,aAAA,CAAc,IAAI,SAAS,CAAA,IAClC,MAAA,CAAO,aAAA,CAAc,IAAI,QAAQ,CAAA,IACjC,IAAI,SAAA,IAAa,EAAA,IACjB,KAAK,GAAA,CAAI,QAAA;AAAA,IACX;AAAA,GACF;AACA,EAAA,cAAA,CAAe,GAAA,CAAI,SAAA,KAAc,MAAA,EAAW,aAAa,CAAA;AACzD,EAAA,OAAO,GAAA;AACT;AACA,eAAsB,uBAAA,CACpB,KAAA,EACA,GAAA,EACA,OAAA,EACA,EAAA,EACkC;AAClC,EAAA,cAAA;AAAA,IACE,OAAO,UAAU,QAAA,IACf,KAAA,CAAM,UAAU,GAAA,IAChB,kDAAA,CAAmD,KAAK,KAAK,CAAA;AAAA,IAC/D;AAAA,GACF;AACA,EAAA,MAAM,CAAC,CAAA,EAAG,CAAA,EAAG,CAAC,CAAA,GAAI,KAAA,CAAM,MAAM,GAAG,CAAA;AACjC,EAAA,IAAI,IAAA,EAAM,OAAA;AACV,EAAA,IAAI;AACF,IAAA,IAAA,GAAO,IAAA,CAAK,KAAA;AAAA,MACV,IAAI,WAAA,CAAY,OAAA,EAAS,EAAE,KAAA,EAAO,IAAA,EAAM,SAAA,EAAW,IAAA,EAAM,CAAA,CAAE,MAAA,CAAO,MAAA,CAAO,CAAC,CAAC;AAAA,KAC7E;AACA,IAAA,OAAA,GAAU,IAAA,CAAK,KAAA;AAAA,MACb,IAAI,WAAA,CAAY,OAAA,EAAS,EAAE,KAAA,EAAO,IAAA,EAAM,SAAA,EAAW,IAAA,EAAM,CAAA,CAAE,MAAA,CAAO,MAAA,CAAO,CAAC,CAAC;AAAA,KAC7E;AAAA,EACF,CAAA,CAAA,MAAQ;AACN,IAAA,MAAM,IAAI,cAAc,qBAAqB,CAAA;AAAA,EAC/C;AACA,EAAA,cAAA;AAAA,IACE,IAAA,EAAM,GAAA,KAAQ,OAAA,IAAW,IAAA,CAAK,GAAA,KAAQ,OAAO,MAAA,CAAO,IAAA,CAAK,IAAI,CAAA,CAAE,MAAA,KAAW,CAAA;AAAA,IAC1E;AAAA,GACF;AACA,EAAA,MAAM,OAAA,GAAU,aAAA,CAAc,OAAA,EAAS,IAAA,CAAK,KAAK,EAAE,CAAA;AACnD,EAAA,MAAM,GAAA,GAAM,MAAM,MAAA,CAAO,MAAA,CAAO,SAAA;AAAA,IAC9B,KAAA;AAAA,IACA,OAAA,CAAQ,GAAA;AAAA,IACR,EAAE,IAAA,EAAM,OAAA,EAAS,UAAA,EAAY,OAAA,EAAQ;AAAA,IACrC,KAAA;AAAA,IACA,CAAC,QAAQ;AAAA,GACX;AACA,EAAA,cAAA;AAAA,IACE,MAAM,OAAO,MAAA,CAAO,MAAA;AAAA,MAClB,EAAE,IAAA,EAAM,OAAA,EAAS,IAAA,EAAM,SAAA,EAAU;AAAA,MACjC,GAAA;AAAA,MACA,OAAO,CAAC,CAAA;AAAA,MACR,IAAI,aAAY,CAAE,MAAA,CAAO,GAAG,CAAC,CAAA,CAAA,EAAI,CAAC,CAAA,CAAE;AAAA,KACtC;AAAA,IACA;AAAA,GACF;AACA,EAAA,cAAA;AAAA,IACE,WAAW,OAAO,OAAA,KAAY,YAAY,CAAC,KAAA,CAAM,QAAQ,OAAO,CAAA;AAAA,IAChE;AAAA,GACF;AACA,EAAA,OAAO,OAAA;AACT;AACA,eAAsB,YAAA,CACpB,OAAA,EACA,GAAA,EACA,GAAA,EACA,GAAA,EACiB;AACjB,EAAA,cAAA;AAAA,IACE,GAAA,CAAI,GAAA,KAAQ,IAAA,IAAQ,GAAA,CAAI,GAAA,KAAQ,YAAY,CAAC,GAAA,CAAI,GAAA,IAAO,GAAA,CAAI,GAAA,KAAQ,OAAA,CAAA;AAAA,IACpE;AAAA,GACF;AACA,EAAA,MAAM,KAAA,GAAQ,CAAA,EAAGD,OAAAA,CAAO,IAAI,WAAA,EAAY,CAAE,MAAA,CAAO,iBAAA,CAAkB,EAAE,GAAA,EAAK,OAAA,EAAS,GAAA,EAAK,GAAA,EAAK,CAAC,CAAC,CAAC,CAAA,CAAA,EAAIA,OAAAA,CAAO,IAAI,WAAA,EAAY,CAAE,MAAA,CAAO,iBAAA,CAAkB,OAAO,CAAC,CAAC,CAAC,CAAA,CAAA;AAChK,EAAA,cAAA,CAAe,KAAA,CAAM,MAAA,GAAS,EAAA,IAAM,GAAA,EAAW,kBAAkB,CAAA;AACjE,EAAA,MAAM,GAAA,GAAM,MAAM,MAAA,CAAO,MAAA,CAAO,SAAA;AAAA,IAC9B,KAAA;AAAA,IACA,GAAA;AAAA,IACA,EAAE,IAAA,EAAM,OAAA,EAAS,UAAA,EAAY,OAAA,EAAQ;AAAA,IACrC,KAAA;AAAA,IACA,CAAC,MAAM;AAAA,GACT;AACA,EAAA,OAAO,CAAA,EAAG,KAAK,CAAA,CAAA,EAAIA,OAAAA,CAAO,IAAI,WAAW,MAAM,MAAA,CAAO,MAAA,CAAO,IAAA,CAAK,EAAE,IAAA,EAAM,SAAS,IAAA,EAAM,SAAA,EAAU,EAAG,GAAA,EAAK,IAAI,WAAA,EAAY,CAAE,MAAA,CAAO,KAAK,CAAC,CAAC,CAAC,CAAC,CAAA,CAAA;AAC/I;AAiCA,IAAM,EAAA,GAAK,2BAAA;AACJ,SAAS,gBAAA,CAAiB,OAAyB,QAAA,EAAwB;AAChF,EAAA,cAAA;AAAA,IACE,OAAO,IAAA,CAAK,KAAK,EAAE,IAAA,EAAK,CAAE,KAAK,GAAG,CAAA,KAChC,sHACA,MAAA,CAAO,IAAA,CAAK,MAAM,SAAS,CAAA,CAAE,MAAK,CAAE,IAAA,CAAK,GAAG,CAAA,KAC1C,gDAAA;AAAA,IACJ;AAAA,GACF;AACA,EAAA,iBAAA,CAAkB,KAAK,CAAA;AACvB,EAAA,cAAA;AAAA,IACE,KAAA,CAAM,OAAA,KAAY,CAAA,IAChB,KAAA,CAAM,WAAW,6BAAA,IACjB,KAAA,CAAM,OAAA,KAAY,qBAAA,IAClB,KAAA,CAAM,QAAA,KAAa,QAAA,IACnB,EAAA,CAAG,KAAK,QAAQ,CAAA;AAAA,IAClB;AAAA,GACF;AACA,EAAA,cAAA;AAAA,IACE;AAAA,MACE,KAAA,CAAM,OAAA;AAAA,MACN,KAAA,CAAM,KAAA;AAAA,MACN,KAAA,CAAM,SAAA;AAAA,MACN,KAAA,CAAM,UAAA;AAAA,MACN,MAAM,SAAA,CAAU;AAAA,KAClB,CAAE,MAAM,MAAA,CAAO,aAAa,KAC1B,KAAA,CAAM,OAAA,GAAU,MAAM,KAAA,IACtB,KAAA,CAAM,SAAS,KAAA,CAAM,UAAA,IACrB,MAAM,UAAA,IAAc,KAAA,CAAM,aAC1B,KAAA,CAAM,SAAA,GAAY,MAAM,SAAA,CAAU,WAAA;AAAA,IACpC;AAAA,GACF;AACA,EAAA,cAAA;AAAA,IACE,KAAA,CAAM,YAAA,KAAiB,SAAA,IACrB,KAAA,CAAM,cAAc,kDAAA,IACpB,KAAA,CAAM,SAAA,CAAU,SAAA,KAAc,WAAA,IAC9B,KAAA,CAAM,SAAA,CAAU,cAAA,KAAmB,0BACnC,EAAA,CAAG,IAAA,CAAK,KAAA,CAAM,SAAA,CAAU,SAAS,CAAA,IACjC,KAAA,CAAM,OAAA,CAAQ,MAAM,IAAI,CAAA,IACxB,KAAA,CAAM,IAAA,CAAK,MAAM,CAAC,GAAA,KAAQ,EAAA,CAAG,IAAA,CAAK,GAAG,CAAC,CAAA;AAAA,IACxC;AAAA,GACF;AACA,EAAA,cAAA;AAAA,IACE,MAAM,OAAA,CAAQ,KAAA,CAAM,OAAO,CAAA,IAAK,KAAA,CAAM,QAAQ,MAAA,IAAU,GAAA;AAAA,IACxD;AAAA,GACF;AACA,EAAA,MAAM,IAAA,uBAAW,GAAA,EAAY;AAC7B,EAAA,KAAA,MAAW,GAAA,IAAO,MAAM,OAAA,EAAS;AAC/B,IAAA,cAAA;AAAA,MACE,MAAA,CAAO,KAAK,GAAG,CAAA,CAAE,MAAK,CAAE,IAAA,CAAK,GAAG,CAAA,KAC9B,4EAAA;AAAA,MACF;AAAA,KACF;AACA,IAAA,cAAA;AAAA,MACE,GAAG,IAAA,CAAK,GAAA,CAAI,EAAE,CAAA,IACZ,EAAA,CAAG,KAAK,GAAA,CAAI,OAAO,CAAA,IACnB,CAAC,YAAY,WAAA,EAAa,SAAS,EAAE,QAAA,CAAS,GAAA,CAAI,IAAI,CAAA,IACtD,EAAA,CAAG,IAAA,CAAK,GAAA,CAAI,MAAM,CAAA,KACjB,GAAA,CAAI,mBAAmB,IAAA,IAAQ,EAAA,CAAG,KAAK,GAAA,CAAI,cAAc,OACzD,GAAA,CAAI,OAAA,KAAY,QACd,OAAO,GAAA,CAAI,YAAY,QAAA,IAAY,GAAA,CAAI,QAAQ,MAAA,IAAU,IAAA,CAAA;AAAA,MAC9D;AAAA,KACF;AACA,IAAA,cAAA;AAAA,MACE,MAAA,CAAO,aAAA,CAAc,GAAA,CAAI,UAAU,CAAA,IACjC,MAAA,CAAO,aAAA,CAAc,GAAA,CAAI,UAAU,CAAA,IACnC,KAAA,CAAM,OAAA,IAAW,IAAI,UAAA,IACrB,GAAA,CAAI,UAAA,GAAa,KAAA,CAAM,KAAA,IACvB,GAAA,CAAI,UAAA,IAAc,KAAA,CAAM,cACxB,GAAA,CAAI,UAAA,IAAc,GAAA,CAAI,UAAA,IACtB,GAAA,CAAI,MAAA,MAAY,GAAA,CAAI,IAAA,KAAS,aAAa,kBAAA,GAAqB,iBAAA,CAAA;AAAA,MACjE;AAAA,KACF;AACA,IAAA,MAAM,WAAW,CAAA,EAAG,GAAA,CAAI,IAAI,CAAA,CAAA,EAAI,IAAI,EAAE,CAAA,CAAA;AACtC,IAAA,cAAA,CAAe,CAAC,IAAA,CAAK,GAAA,CAAI,QAAQ,GAAG,kBAAkB,CAAA;AACtD,IAAA,IAAA,CAAK,IAAI,QAAQ,CAAA;AAAA,EACnB;AACF;AAEA,eAAsB,oBAAA,CACpB,QACA,OAAA,EAMA;AACA,EAAA,gBAAA,CAAiB,MAAA,CAAO,QAAA,EAAU,OAAA,CAAQ,QAAQ,CAAA;AAClD,EAAA,cAAA;AAAA,IACE,MAAA,CAAO,QAAA,CAAS,SAAA,CAAU,SAAA,KAAc,OAAA,CAAQ,SAAA;AAAA,IAChD;AAAA,GACF;AACA,EAAA,cAAA;AAAA,IACE,OAAA,CAAQ,MAAM,MAAA,CAAO,QAAA,CAAS,UAAU,WAAA,IACtC,OAAA,CAAQ,GAAA,IAAO,MAAA,CAAO,QAAA,CAAS,SAAA;AAAA,IACjC;AAAA,GACF;AACA,EAAA,MAAM,SAAS,MAAM,uBAAA;AAAA,IACnB,MAAA,CAAO,SAAA;AAAA,IACP,uBAAA;AAAA,IACA,OAAA,CAAQ,WAAA;AAAA,IACR,OAAO,QAAA,CAAS;AAAA,GAClB;AACA,EAAA,cAAA;AAAA,IACE,iBAAA,CAAkB,MAAM,CAAA,KAAM,iBAAA,CAAkB,OAAO,QAAQ,CAAA;AAAA,IAC/D;AAAA,GACF;AACA,EAAA,MAAM,OAAO,IAAA,CAAK,KAAA;AAAA,IAChB,IAAI,WAAA,EAAY,CAAE,MAAA,CAAO,MAAA,CAAO,MAAA,CAAO,SAAA,CAAU,KAAA,CAAM,GAAG,CAAA,CAAE,CAAC,CAAE,CAAC;AAAA,GAClE;AACA,EAAA,cAAA;AAAA,IACE,aAAA,CAAc,QAAQ,WAAA,EAAa,IAAA,CAAK,KAAK,MAAA,CAAO,QAAA,CAAS,SAAS,CAAA,CACnE,aAAA,KAAkB,MAAA;AAAA,IACrB;AAAA,GACF;AACA,EAAA,OAAO;AAAA,IACL,OAAA,EAAS,qBAAA;AAAA,IACT,mBAAA,EAAqB,KAAA;AAAA,IACrB,SAAA,EAAW,OAAA;AAAA,IACX,YAAA,EAAc,SAAA;AAAA,IACd,YAAA,EAAc,iBAAA;AAAA,IACd,IAAA,EAAM,OAAO,QAAA,CAAS;AAAA,GACxB;AACF;AAIA,eAAsB,uBAAA,CACpB,OACA,OAAA,EAMA;AACA,EAAA,cAAA;AAAA,IACE,OAAO,KAAA,KAAU,QAAA,IAAY,KAAA,CAAM,MAAA,IAAU,IAAA;AAAA,IAC7C;AAAA,GACF;AACA,EAAA,IAAI,MAAA,EAAiC,IAAA;AACrC,EAAA,IAAI;AACF,IAAA,MAAM,KAAA,GAAQ,KAAA,CAAM,KAAA,CAAM,GAAG,CAAA;AAC7B,IAAA,IAAA,GAAO,IAAA,CAAK,KAAA,CAAM,IAAI,WAAA,EAAY,CAAE,MAAA,CAAO,MAAA,CAAO,KAAA,CAAM,CAAC,CAAE,CAAC,CAAC,CAAA;AAC7D,IAAA,MAAA,GAAS,IAAA,CAAK,KAAA,CAAM,IAAI,WAAA,EAAY,CAAE,MAAA,CAAO,MAAA,CAAO,KAAA,CAAM,CAAC,CAAE,CAAC,CAAC,CAAA;AAAA,EACjE,CAAA,CAAA,MAAQ;AACN,IAAA,MAAM,IAAI,cAAc,qBAAqB,CAAA;AAAA,EAC/C;AACA,EAAA,cAAA;AAAA,IACE,IAAA,CAAK,GAAA,KAAQ,KAAA,IAAS,IAAA,CAAK,GAAA,KAAQ,qBAAA;AAAA,IACnC;AAAA,GACF;AACA,EAAA,cAAA;AAAA,IACE,MAAA,CAAO,aAAA,CAAc,MAAA,CAAO,GAAG,CAAA,IAC7B,MAAA,CAAO,aAAA,CAAc,MAAA,CAAO,GAAG,CAAA,IAC/B,MAAA,CAAO,MAAA,CAAO,GAAG,CAAA,GAAI,MAAA,CAAO,MAAA,CAAO,GAAG,CAAA,IACtC,MAAA,CAAO,MAAA,CAAO,GAAG,CAAA,GAAI,MAAA,CAAO,MAAA,CAAO,GAAG,CAAA,KAAM,IAAA,CAAK,GAAA,KAAQ,QAAQ,GAAA,GAAM,EAAA,CAAA;AAAA,IACzE;AAAA,GACF;AACA,EAAA,MAAM,EAAA,GAAK,MAAA,CAAO,MAAA,CAAO,GAAG,CAAA;AAC5B,EAAA,cAAA;AAAA,IACE,OAAO,MAAA,CAAO,OAAA,KAAY,YAAY,wBAAA,CAAyB,IAAA,CAAK,OAAO,OAAO,CAAA;AAAA,IAClF;AAAA,GACF;AACA,EAAA,MAAM,OAAA,GAAU,cAAc,OAAA,CAAQ,WAAA,EAAa,OAAO,IAAA,CAAK,GAAG,GAAG,EAAE,CAAA;AACvE,EAAA,MAAA,GAAS,MAAM,uBAAA;AAAA,IACb,KAAA;AAAA,IACA,MAAA,CAAO,KAAK,GAAG,CAAA;AAAA,IACf,OAAA,CAAQ,WAAA;AAAA,IACR;AAAA,GACF;AACA,EAAA,cAAA;AAAA,IACE,MAAA,CAAO,QAAQ,OAAA,CAAQ,QAAA,IACrB,OAAO,GAAA,KAAQ,OAAA,CAAQ,OAAA,IACvB,MAAA,CAAO,GAAA,KAAQ,0BAAA;AAAA,IACjB;AAAA,GACF;AACA,EAAA,MAAM,YACJ,OAAA,CAAQ,OAAA,IACR,OAAO,aAAA,CAAc,OAAA,CAAQ,QAAQ,UAAU,CAAA,IAC/C,OAAA,CAAQ,OAAA,CAAQ,cAAc,EAAA,IAC9B,OAAA,CAAQ,QAAQ,SAAA,KAAe,MAAM,aAAa,KAAK,CAAA;AACzD,EAAA,MAAM,gBAAA,GACJ,cACC,OAAA,CAAQ,aAAA,KAAkB,UACzB,OAAA,CAAQ,OAAA,CAAS,aAAa,OAAA,CAAQ,aAAA,CAAA;AAC1C,EAAA,OAAO;AAAA,IACL,OAAA,EAAS,qBAAA;AAAA,IACT,mBAAA,EAAqB,KAAA;AAAA,IACrB,OAAA,EAAS,MAAA,CAAO,MAAA,CAAO,OAAO,CAAA;AAAA,IAC9B,gBAAgB,OAAO,MAAA,CAAO,MAAA,KAAW,QAAA,GAAW,OAAO,MAAA,GAAS,IAAA;AAAA,IACpE,eAAe,gBAAA,GACX,4BAAA,GACA,OAAA,CAAQ,aAAA,KAAkB,SACxB,4BAAA,GACA;AAAA,GACR;AACF;;;ACpYA,IAAM,GAAA,GAAM,gBAAA;AACZ,SAAS,KAAA,CAAM,UAAA,EAAgC,QAAA,EAAkB,GAAA,EAAa;AAC5E,EAAA,cAAA;AAAA,IACE,UAAA,CAAW,YAAY,CAAA,IACrB,UAAA,CAAW,aAAa,QAAA,IACxB,yBAAA,CAA0B,KAAK,UAAA,CAAW,KAAK,KAC/C,MAAA,CAAO,aAAA,CAAc,WAAW,SAAS,CAAA,IACzC,MAAM,UAAA,CAAW,SAAA,IACjB,OAAO,aAAA,CAAc,UAAA,CAAW,UAAU,CAAA,IAC1C,UAAA,CAAW,cAAc,GAAA,IACzB,UAAA,CAAW,aAAa,UAAA,CAAW,SAAA,IACnC,OAAO,aAAA,CAAc,UAAA,CAAW,IAAI,CAAA,IACpC,UAAA,CAAW,QAAQ,CAAA,IACnB,UAAA,CAAW,QAAQ,GAAA,IACnB,GAAA,CAAI,IAAA,CAAK,UAAA,CAAW,IAAI,CAAA;AAAA,IAC1B;AAAA,GACF;AACF;AACA,IAAM,OAAA,GAAU,CAAC,EAAA,KACf,YAAA;AAAA,EACE,iBAAA,CAAkB,CAAC,2BAAA,EAA6B,EAAA,CAAG,UAAU,EAAA,CAAG,KAAA,EAAO,EAAA,CAAG,SAAS,CAAC;AACtF,CAAA;AACK,IAAM,kBAAA,GAAqB,CAChC,EAAA,EACA,MAAA,EACA,IAAA,KACG;AACH,EAAA,cAAA,CAAe,GAAA,CAAI,IAAA,CAAK,IAAI,CAAA,EAAG,yBAAyB,CAAA;AACxD,EAAA,OAAO,YAAA;AAAA,IACL,iBAAA,CAAkB;AAAA,MAChB,oBAAA;AAAA,MACA,EAAA,CAAG,QAAA;AAAA,MACH,EAAA,CAAG,KAAA;AAAA,MACH,EAAA,CAAG,SAAA;AAAA,MACH,IAAA;AAAA,MACA;AAAA,KACD;AAAA,GACH;AACF;AACA,IAAM,OAAA,GAAU,CAAC,IAAA,EAAc,IAAA,EAAc,KAAA,KAC3C,YAAA,CAAa,iBAAA,CAAkB,CAAC,oBAAA,EAAsB,KAAA,EAAO,IAAA,EAAM,IAAI,CAAC,CAAC,CAAA;AAE3E,eAAsB,0BAA0B,KAAA,EAMhB;AAC9B,EAAA,cAAA;AAAA,IACE,KAAA,CAAM,WAAA,CAAY,MAAA,IAAU,GAAA,IAC1B,KAAA,CAAM,WAAA,CAAY,KAAA,CAAM,CAAC,IAAA,KAAS,GAAA,CAAI,IAAA,CAAK,IAAI,CAAC,CAAA;AAAA,IAClD;AAAA,GACF;AACA,EAAA,IAAI,IAAA,GAAO,MAAM,OAAA,CAAQ,KAAK,CAAA;AAC9B,EAAA,KAAA,IAAS,KAAA,GAAQ,CAAA,EAAG,KAAA,GAAQ,KAAA,CAAM,YAAY,MAAA,EAAQ,KAAA,EAAA;AACpD,IAAA,IAAA,GAAO,MAAM,OAAA,CAAQ,IAAA,EAAM,MAAM,WAAA,CAAY,KAAK,GAAI,KAAK,CAAA;AAC7D,EAAA,MAAM,EAAA,GAAyB;AAAA,IAC7B,OAAA,EAAS,CAAA;AAAA,IACT,UAAU,KAAA,CAAM,QAAA;AAAA,IAChB,OAAO,KAAA,CAAM,KAAA;AAAA,IACb,WAAW,KAAA,CAAM,SAAA;AAAA,IACjB,YAAY,KAAA,CAAM,UAAA;AAAA,IAClB,IAAA,EAAM,MAAM,WAAA,CAAY,MAAA;AAAA,IACxB;AAAA,GACF;AACA,EAAA,KAAA,CAAM,EAAA,EAAI,KAAA,CAAM,QAAA,EAAU,KAAA,CAAM,UAAU,CAAA;AAC1C,EAAA,OAAO,EAAA;AACT;AACA,eAAsB,sBAAA,CACpB,KAAA,EACA,KAAA,EACA,QAAA,EACA,OAAA,EACA;AACA,EAAA,KAAA,CAAM,KAAA,EAAO,OAAA,CAAQ,QAAA,EAAU,OAAA,CAAQ,GAAG,CAAA;AAC1C,EAAA,KAAA,CAAM,KAAA,EAAO,OAAA,CAAQ,QAAA,EAAU,OAAA,CAAQ,GAAG,CAAA;AAC1C,EAAA,IAAI,MAAM,IAAA,KAAS,CAAA;AACjB,IAAA,cAAA,CAAe,MAAM,IAAA,KAAU,MAAM,OAAA,CAAQ,KAAK,GAAI,0BAA0B,CAAA;AAClF,EAAA,cAAA;AAAA,IACE,KAAA,CAAM,KAAA,KAAU,KAAA,CAAM,KAAA,IACpB,MAAM,SAAA,KAAc,KAAA,CAAM,SAAA,IAC1B,KAAA,CAAM,UAAA,IAAc,KAAA,CAAM,UAAA,IAC1B,KAAA,CAAM,QAAQ,KAAA,CAAM,IAAA;AAAA,IACtB;AAAA,GACF;AACA,EAAA,IAAI,KAAA,CAAM,SAAS,KAAA,CAAM,IAAA;AACvB,IAAA,cAAA,CAAe,KAAA,CAAM,IAAA,KAAS,KAAA,CAAM,IAAA,EAAM,mBAAmB,CAAA;AAC/D,EAAA,IAAI,QAAA,KAAa,IAAA;AACf,IAAA,OAAO,EAAE,MAAA,EAAQ,aAAA,EAAwB,YAAA,EAAc,SAAA,EAAmB;AAC5E,EAAA,cAAA;AAAA,IACE,QAAA,CAAS,MAAA,KAAW,KAAA,CAAM,IAAA,GAAO,KAAA,CAAM,IAAA,IACrC,QAAA,CAAS,KAAA,CAAM,CAAC,IAAA,KAAS,GAAA,CAAI,IAAA,CAAK,IAAI,CAAC,CAAA;AAAA,IACzC;AAAA,GACF;AACA,EAAA,IAAI,OAAO,KAAA,CAAM,IAAA;AACjB,EAAA,KAAA,IAAS,KAAA,GAAQ,CAAA,EAAG,KAAA,GAAQ,QAAA,CAAS,MAAA,EAAQ,KAAA,EAAA;AAC3C,IAAA,IAAA,GAAO,MAAM,QAAQ,IAAA,EAAM,QAAA,CAAS,KAAK,CAAA,EAAI,KAAA,CAAM,OAAO,KAAK,CAAA;AACjE,EAAA,cAAA,CAAe,IAAA,KAAS,KAAA,CAAM,IAAA,EAAM,mBAAmB,CAAA;AACvD,EAAA,OAAO,EAAE,MAAA,EAAQ,YAAA,EAAuB,YAAA,EAAc,SAAA,EAAmB;AAC3E;AACA,eAAsB,yBAAA,CACpB,UAAA,EACA,KAAA,EACA,OAAA,EACA;AACA,EAAA,KAAA,CAAM,UAAA,EAAY,OAAA,CAAQ,QAAA,EAAU,OAAA,CAAQ,GAAG,CAAA;AAC/C,EAAA,IAAI,CAAC,KAAA,EAAO,OAAO,EAAE,MAAA,EAAQ,aAAA,EAAwB,cAAc,SAAA,EAAmB;AACtF,EAAA,cAAA;AAAA,IACE,MAAA,CAAO,aAAA,CAAc,KAAA,CAAM,KAAK,KAC9B,KAAA,CAAM,KAAA,IAAS,CAAA,IACf,KAAA,CAAM,QAAQ,UAAA,CAAW,IAAA,IACzB,KAAA,CAAM,WAAA,CAAY,WAAW,UAAA,CAAW,IAAA;AAAA,IAC1C;AAAA,GACF;AACA,EAAA,MAAM,OAAA,GAAU,MAAM,yBAAA,CAA0B;AAAA,IAC9C,GAAG,UAAA;AAAA,IACH,aAAa,KAAA,CAAM;AAAA,GACpB,CAAA;AACD,EAAA,cAAA;AAAA,IACE,OAAA,CAAQ,IAAA,KAAS,UAAA,CAAW,IAAA,IACzB,MAAM,kBAAA,CAAmB,UAAA,EAAY,KAAA,CAAM,MAAA,EAAQ,MAAM,IAAI,CAAA,KAC5D,KAAA,CAAM,WAAA,CAAY,MAAM,KAAK,CAAA;AAAA,IACjC;AAAA,GACF;AACA,EAAA,OAAO,EAAE,MAAA,EAAQ,UAAA,EAAqB,YAAA,EAAc,SAAA,EAAmB;AACzE","file":"index.js","sourcesContent":["import type { PiiMode } from \"./types.js\";\n\nexport interface AttributionAgentProof {\n linkId: string;\n nonce: string;\n issuedAt: number;\n signature: string;\n}\n\nexport interface AttributionResolveOptions {\n request: {\n url?: string;\n headers: Headers | Record<string, string | string[] | undefined>;\n };\n /** Explicit site origin for requests with a relative URL, such as IncomingMessage. */\n site?: string;\n /** Opaque credential supplied by the integrating server, never a raw browser cookie. */\n session?: string;\n agentProof?: AttributionAgentProof;\n piiMode?: PiiMode;\n idempotencyKey?: string;\n}\n\nexport interface AttributionResult {\n id: string;\n agent: { detected: boolean; provider: string | null; operator_verified: boolean };\n identity: {\n recognized: boolean;\n subject_id: string | null;\n scope: \"site\" | null;\n match: \"none\" | \"existing_session\" | \"verified_identity_link\";\n };\n principal: {\n status: \"unknown\" | \"previously_verified\";\n email: string | null;\n email_verified: boolean | null;\n current_delegation_verified: boolean | null;\n document_verified: boolean | null;\n };\n}\n\nexport interface AttributionLinkRequest {\n enrollmentId: string;\n site: string;\n agentKey: { kty: \"OKP\"; crv: \"Ed25519\"; x: string };\n recipientKeyId: string;\n emailConsent: boolean;\n expiresAt: number;\n principalProof: string;\n}\n\nexport interface AttributionLink {\n id: string;\n expires_at: number;\n}\n\nexport function attributionEvidence(options: AttributionResolveOptions, mode: PiiMode) {\n const { request, agentProof, session, piiMode = mode } = options;\n const headers = request.headers;\n const header =\n typeof headers.get === \"function\"\n ? headers.get(\"chitmark-agent-proof\")\n : Object.entries(headers).find(\n ([name]) => name.toLowerCase() === \"chitmark-agent-proof\",\n )?.[1];\n let site = options.site;\n if (!site && request.url?.startsWith(\"https://\")) site = new URL(request.url).origin;\n let proof = agentProof;\n if (!proof && typeof header === \"string\" && header.length <= 2048 && site) {\n try {\n proof = JSON.parse(header) as AttributionAgentProof;\n } catch {\n // Invalid transport evidence cannot resolve a principal.\n }\n }\n return { site, session, piiMode, agentProof: proof };\n}\n","/** Explicit sender-constrained credential profile. No static-key fallback. */\nexport interface CredentialProvider {\n headers(input: {\n url: string;\n method: string;\n signal: AbortSignal;\n }): Promise<{ Authorization: string; DPoP: string }>;\n}\nexport interface WorkloadCredential {\n accessToken: string;\n expiresAt: number;\n trustExpiresAt: number;\n revocationValidUntil: number;\n}\nconst encode = (bytes: Uint8Array) =>\n btoa(String.fromCharCode(...bytes))\n .replace(/=/g, \"\")\n .replace(/\\+/g, \"-\")\n .replace(/\\//g, \"_\");\nconst json = (value: unknown) => encode(new TextEncoder().encode(JSON.stringify(value)));\nexport async function boundedCredential<T>(\n work: Promise<T>,\n signal: AbortSignal,\n): Promise<T> {\n signal.throwIfAborted();\n let abort!: () => void;\n const aborted = new Promise<never>((_, reject) => {\n abort = () => reject(new Error(\"Credential deadline exceeded\"));\n signal.addEventListener(\"abort\", abort, { once: true });\n });\n try {\n return await Promise.race([work, aborted]);\n } finally {\n signal.removeEventListener(\"abort\", abort);\n }\n}\nexport function createDPoPCredentialProvider(options: {\n privateKey: CryptoKey;\n publicJwk: JsonWebKey;\n /** Issuer-specific authenticated exchange. Must bind tokens to publicJwk. */\n load: (signal: AbortSignal) => Promise<WorkloadCredential>;\n refreshTimeoutMs?: number;\n}): CredentialProvider {\n const { privateKey, publicJwk } = options;\n if (\n publicJwk.d ||\n publicJwk.kty !== \"EC\" ||\n publicJwk.crv !== \"P-256\" ||\n !publicJwk.x ||\n !publicJwk.y\n )\n throw new Error(\"DPoP requires a public P-256 JWK\");\n const jwk = { kty: \"EC\", crv: \"P-256\", x: publicJwk.x, y: publicJwk.y };\n let cached: WorkloadCredential | undefined;\n let pending: Promise<WorkloadCredential> | undefined;\n const valid = (c: WorkloadCredential | undefined): c is WorkloadCredential =>\n !!c &&\n typeof c.accessToken === \"string\" &&\n /^[\\w-]+\\.[\\w-]+\\.[\\w-]+$/.test(c.accessToken) &&\n [c.expiresAt, c.trustExpiresAt, c.revocationValidUntil].every(\n (v) => Number.isSafeInteger(v) && v > Date.now() / 1000 + 1,\n );\n return {\n async headers({ url, method, signal }) {\n signal.throwIfAborted();\n const target = new URL(url);\n if (target.protocol !== \"https:\" || target.username || target.password)\n throw new Error(\"DPoP requires HTTPS\");\n if (!valid(cached)) {\n if (!pending) {\n const refreshSignal = AbortSignal.timeout(options.refreshTimeoutMs ?? 500);\n // Keep an uncooperative exchange in-flight until it actually settles;\n // callers time out without spawning unbounded replacement exchanges.\n pending = Promise.resolve()\n .then(() => options.load(refreshSignal))\n .then((c) => {\n if (!valid(c) || refreshSignal.aborted) throw new Error(\"Stale credential\");\n cached = { ...c };\n return cached;\n })\n .finally(() => {\n pending = undefined;\n });\n }\n await boundedCredential(\n pending,\n AbortSignal.any([signal, AbortSignal.timeout(options.refreshTimeoutMs ?? 500)]),\n );\n }\n if (!valid(cached)) throw new Error(\"Stale credential\");\n const credential = cached;\n const token = credential.accessToken;\n const ath = encode(\n new Uint8Array(\n await crypto.subtle.digest(\"SHA-256\", new TextEncoder().encode(token)),\n ),\n );\n const payload = `${json({ typ: \"dpop+jwt\", alg: \"ES256\", jwk })}.${json({ jti: crypto.randomUUID(), iat: Math.floor(Date.now() / 1000), htm: method.toUpperCase(), htu: `${target.origin}${target.pathname}`, ath })}`;\n const signature = await crypto.subtle.sign(\n { name: \"ECDSA\", hash: \"SHA-256\" },\n privateKey,\n new TextEncoder().encode(payload),\n );\n signal.throwIfAborted();\n if (!valid(credential)) throw new Error(\"Stale credential\");\n return {\n Authorization: `DPoP ${token}`,\n DPoP: `${payload}.${encode(new Uint8Array(signature))}`,\n };\n },\n };\n}\n","import type { ChitmarkErrorBody, Decision, Verdict } from \"./types.js\";\n\n/**\n * Base error for all Chitmark client failures.\n */\nexport class ChitmarkError extends Error {\n override name = \"ChitmarkError\";\n readonly status?: number;\n readonly code?: string;\n readonly body?: ChitmarkErrorBody | string;\n\n constructor(\n message: string,\n options?: { status?: number; code?: string; body?: ChitmarkErrorBody | string },\n ) {\n super(message);\n this.status = options?.status;\n this.code = options?.code;\n this.body = options?.body;\n }\n}\n\n/**\n * Raised when the API returns a non-2xx response.\n */\nexport class ChitmarkApiError extends ChitmarkError {\n override name = \"ChitmarkApiError\";\n\n constructor(status: number, body: ChitmarkErrorBody | string, message?: string) {\n const msg =\n message ??\n (typeof body === \"string\"\n ? body\n : body.message || body.error || `Chitmark API error (${status})`);\n super(msg, {\n status,\n code: typeof body === \"object\" ? (body.code ?? body.error) : undefined,\n body,\n });\n }\n}\n\n/**\n * Build the degraded challenge verdict used on timeout / transport failure.\n * Golden rule: fail to challenge, never to allow.\n */\nexport function degradedChallengeVerdict(reason: string, session?: string): Verdict {\n return {\n decision: \"challenge\" satisfies Decision,\n actorType: \"unknown\",\n confidence: 0,\n reasons: [reason],\n principal: {\n resolved: false,\n identityBasis: [\"degraded\"],\n },\n verdictToken: \"\",\n eventId: `evt_degraded_${session ?? \"unknown\"}`,\n degraded: true,\n enforcementMode: \"enforce\",\n };\n}\n\n/**\n * Ensure degraded responses never surface as allow (defense in depth client-side).\n */\nexport function enforceDegradedNeverAllow(verdict: Verdict): Verdict {\n if (verdict.degraded && verdict.decision === \"allow\") {\n return {\n ...verdict,\n decision: \"challenge\",\n reasons: [\n ...verdict.reasons,\n \"Client enforced: degraded decision must not be allow\",\n ],\n };\n }\n return verdict;\n}\n","import type { ChitmarkEnv } from \"../types.js\";\n\nexport const DEFAULT_BASE_URLS: Record<ChitmarkEnv, string> = {\n production: \"https://api.chitmark.com\",\n staging: \"https://api.staging.chitmark.com\",\n development: \"http://127.0.0.1:8787\",\n};\n\nexport const DEFAULT_TIMEOUT_MS = 800;\n/** A cold local edge can take longer than the production budget to start. */\nexport const LOCAL_TIMEOUT_MS = 2_000;\n/** Keep in parity with the package version and the Python SDK. */\nexport const SDK_VERSION = \"0.8.0\";\n\n/** Pick the client budget from the resolved base URL. */\nexport function defaultTimeoutMs(baseUrl: string): number {\n try {\n const host = new URL(baseUrl).hostname.replace(/^\\[|\\]$/g, \"\").toLowerCase();\n return host === \"localhost\" ||\n host.endsWith(\".localhost\") ||\n host === \"127.0.0.1\" ||\n host === \"0.0.0.0\" ||\n host === \"::1\"\n ? LOCAL_TIMEOUT_MS\n : DEFAULT_TIMEOUT_MS;\n } catch {\n return DEFAULT_TIMEOUT_MS;\n }\n}\n\nexport function resolveBaseUrl(\n env: ChitmarkEnv = \"production\",\n baseUrl?: string,\n): string {\n return (baseUrl ?? DEFAULT_BASE_URLS[env]).replace(/\\/$/, \"\");\n}\n\n/**\n * CHITMARK_BASE_URL environment override, when present (Node only, no-op on\n * Workers/browsers where `process` is undefined).\n */\nexport function envBaseUrl(): string | undefined {\n if (typeof process === \"undefined\") return undefined;\n const value = process.env?.CHITMARK_BASE_URL;\n return value ? value.trim() : undefined;\n}\n","/**\n * Client-side PII minimization helpers.\n * Default SDK mode hashes email and truncates IP before leaving the customer process.\n */\n\n/**\n * SHA-256 hex digest of lowercased, trimmed email.\n * Uses Web Crypto (Node 18+, browsers, Workers).\n */\nexport async function hashEmailSha256(email: string): Promise<string> {\n const normalized = email.trim().toLowerCase();\n const data = new TextEncoder().encode(normalized);\n const digest = await crypto.subtle.digest(\"SHA-256\", data);\n return bufferToHex(digest);\n}\n\n/**\n * Truncate IPv4 to /24 or IPv6 to /48 for coarse geo without host identity.\n */\nexport function truncateIp(ip: string): string {\n const trimmed = ip.trim();\n // IPv4 (optionally from x-forwarded-for first hop)\n const first = trimmed.split(\",\")[0]?.trim() ?? trimmed;\n if (first.includes(\".\") && !first.includes(\":\")) {\n const parts = first.split(\".\");\n if (parts.length === 4) {\n return `${parts[0]}.${parts[1]}.${parts[2]}.0/24`;\n }\n }\n // IPv6: keep first 3 hextets (~/48)\n if (first.includes(\":\")) {\n const hextets = first.split(\":\").filter(Boolean);\n const head = hextets.slice(0, 3).join(\":\");\n return `${head}::/48`;\n }\n return first;\n}\n\n/**\n * Reduce form payload to non-PII keys (domain-style fields only for hashed mode).\n * Free-text is dropped; companyDomain-style keys are kept as-is when domain-like.\n */\nexport function minimizeFormData(\n formData: Record<string, unknown> | undefined,\n): Record<string, unknown> | undefined {\n if (!formData) return undefined;\n const allowed = new Set([\n \"companyDomain\",\n \"company_domain\",\n \"domain\",\n \"plan\",\n \"referrer\",\n \"utm_source\",\n \"utm_medium\",\n \"utm_campaign\",\n ]);\n const out: Record<string, unknown> = {};\n for (const [key, value] of Object.entries(formData)) {\n if (allowed.has(key) && value != null) {\n out[key] = value;\n }\n }\n return Object.keys(out).length > 0 ? out : undefined;\n}\n\nfunction bufferToHex(buffer: ArrayBuffer): string {\n const bytes = new Uint8Array(buffer);\n let hex = \"\";\n for (const b of bytes) {\n hex += b.toString(16).padStart(2, \"0\");\n }\n return hex;\n}\n","import type { PiiMode, Subject } from \"../types.js\";\nimport { hashEmailSha256, minimizeFormData, truncateIp } from \"../pii.js\";\n\n/**\n * Apply client-side PII mode to a subject before the wire.\n */\nexport async function prepareSubject(\n subject: Subject,\n piiMode: PiiMode,\n): Promise<Subject> {\n if (piiMode === \"raw\") {\n return subject;\n }\n\n if (piiMode === \"none\") {\n return {\n userAgent: subject.userAgent,\n headers: pickWebBotAuthHeaders(subject.headers),\n };\n }\n\n // hashed (default)\n const prepared: Subject = {\n userAgent: subject.userAgent,\n headers: subject.headers,\n };\n\n if (subject.emailSha256) {\n prepared.emailSha256 = subject.emailSha256;\n } else if (subject.email) {\n prepared.emailSha256 = await hashEmailSha256(subject.email);\n }\n\n if (subject.ipTrunc) {\n prepared.ipTrunc = subject.ipTrunc;\n } else if (subject.ip) {\n prepared.ipTrunc = truncateIp(subject.ip);\n }\n\n const hashedForm = subject.formDataHashed ?? minimizeFormData(subject.formData);\n if (hashedForm) {\n prepared.formDataHashed = hashedForm;\n }\n\n return prepared;\n}\n\nfunction pickWebBotAuthHeaders(\n headers?: Record<string, string | string[] | undefined>,\n): Record<string, string> | undefined {\n if (!headers) return undefined;\n const keys = [\"signature-agent\", \"signature-input\", \"signature\"];\n const out: Record<string, string> = {};\n for (const [k, v] of Object.entries(headers)) {\n const lower = k.toLowerCase();\n if (keys.includes(lower) && typeof v === \"string\") {\n out[lower] = v;\n } else if (keys.includes(lower) && Array.isArray(v) && v[0]) {\n out[lower] = v[0];\n }\n }\n return Object.keys(out).length > 0 ? out : undefined;\n}\n\n/**\n * Normalize header maps (Node / Fetch) to plain string records for JSON.\n */\nexport function flattenHeaders(\n headers?: Record<string, string | string[] | undefined> | Headers,\n): Record<string, string> | undefined {\n if (!headers) return undefined;\n if (headers instanceof Headers) {\n const out: Record<string, string> = {};\n headers.forEach((value, key) => {\n out[key.toLowerCase()] = value;\n });\n return out;\n }\n const out: Record<string, string> = {};\n for (const [k, v] of Object.entries(headers)) {\n if (typeof v === \"string\") out[k.toLowerCase()] = v;\n else if (Array.isArray(v) && v[0]) out[k.toLowerCase()] = v[0];\n }\n return out;\n}\n","/**\n * Client-side verdictToken verification.\n *\n * A verdictToken is an ES256 JWT decision receipt minted by the edge and bound\n * to session (`sub`), origin hint (`aud`), issuing tenant (`tid`), and a unique\n * `jti` (correlation id) with a short `exp` (5 minutes). Every signed token\n * requires a `kid` in the JWT header. Signature verification proves\n * authenticity and integrity; it does not make the JWT single-use. This module\n * always enforces `session` and `tenantId` (security boundary), validates\n * `iss` against the Chitmark issuer, and optionally `aud`. `aud` reflects\n * request headers and is attacker influenced: never enforce `aud` alone.\n * Rejection reasons are surfaced as `VerdictTokenError.code`.\n *\n * JWKS: respect `Cache-Control` and, when present, `ETag` /\n * `Last-Modified` via conditional requests (instead of a hard-coded\n * refresh interval). Refresh immediately on unknown `kid`. Do not fetch on\n * every verification; never permanently pin a single signing key. Each JWKS\n * key is EC P-256 for ES256: require JWT `alg === \"ES256\"` before verifying\n * (`wrong_algorithm` otherwise); never trust the token-requested algorithm.\n * Rotation overlaps old and new keys; keep the retiring key until tokens under it\n * expire (≥ 5 minutes + 60 seconds). Pass a cached `jwks` option to skip\n * the network call. An empty JWKS (`keys: []`) means no token can be\n * cryptographically verified: fail closed; never treat an empty set as\n * evidence that a token is valid (local/CI may emit `unsigned.<eventId>`).\n */\n\nimport { ChitmarkError } from \"./errors.js\";\nimport type { ActorType, Decision } from \"./types.js\";\n\n/** Canonical issuer claim on every signed verdictToken. */\nexport const VERDICT_TOKEN_ISSUER = \"https://api.chitmark.com\";\n\nexport interface VerdictTokenClaims {\n /** Issuer: https://api.chitmark.com. */\n iss: string;\n eventId: string;\n decision: Decision;\n actorType: ActorType;\n confidence: number;\n aud: string;\n sub: string;\n /** Issuing tenant, server-derived from the API key used at verify time. */\n tid: string;\n /** Unique token identifier (correlation). Not single-use unless you track it. */\n jti: string;\n iat: number;\n exp: number;\n degraded: boolean;\n}\n\nexport type VerdictTokenErrorCode =\n | \"malformed_token\"\n | \"wrong_algorithm\"\n | \"wrong_type\"\n | \"jwks_unavailable\"\n | \"unknown_kid\"\n | \"invalid_signature\"\n | \"expired\"\n | \"not_yet_valid\"\n | \"wrong_issuer\"\n | \"wrong_session\"\n | \"wrong_aud\"\n | \"wrong_tenant\"\n | \"wrong_action_binding\";\n\nexport class VerdictTokenError extends ChitmarkError {\n override name = \"VerdictTokenError\";\n\n constructor(code: VerdictTokenErrorCode, message: string) {\n super(message, { code });\n }\n}\n\nexport interface VerifyVerdictTokenOptions {\n /** Expected session: token `sub` must equal this or verification fails. */\n session: string;\n /** Expected issuing tenant: token `tid` must equal this or verification fails. */\n tenantId: string;\n /** Expected origin hint: token `aud` must equal this or verification fails. */\n aud?: string;\n /**\n * Expected issuer (`iss`). Defaults to {@link VERDICT_TOKEN_ISSUER}.\n * Override only in tests.\n */\n issuer?: string;\n /** JWKS URL; defaults to https://api.chitmark.com/.well-known/jwks.json. */\n jwksUrl?: string;\n /**\n * Pre-fetched / cached JWKS; skips the network fetch when provided.\n * Prefer caching via HTTP headers (`Cache-Control`, `ETag`, and\n * `Last-Modified` when present) with conditional refresh and immediate\n * refresh on unknown `kid`, rather than fetching on every verification.\n */\n jwks?: { keys: Array<Record<string, unknown>> };\n /** Injectable fetch (Node 24+/browsers have a global). */\n fetch?: typeof fetch;\n /** Clock override for tests. */\n nowMs?: number;\n /** Clock skew tolerance in seconds; defaults to 30. */\n leewaySeconds?: number;\n}\n\nconst DEFAULT_JWKS_URL = \"https://api.chitmark.com/.well-known/jwks.json\";\nconst DEFAULT_LEEWAY_SECONDS = 30;\n\n/**\n * Verify a verdictToken signature and binding.\n *\n * `session` and `tenantId` are required: they are the security boundary for\n * cross-service authorization, not optional hints.\n */\nexport async function verifyVerdictToken(\n token: string,\n options: VerifyVerdictTokenOptions,\n): Promise<VerdictTokenClaims> {\n return verifyReceipt(token, options, \"JWT\");\n}\n\n/** Actions whose receipts require `tenant_step_up` proof and a bound subject. */\nexport const SENSITIVE_RECEIPT_ACTIONS = [\n \"api_key\",\n \"data_export\",\n \"session_establish\",\n \"privilege_elevate\",\n \"authenticator_replace\",\n \"recovery_contact_change\",\n \"session_use\",\n \"privilege_change\",\n \"release_deploy\",\n \"bulk_mutation\",\n \"commitment_change\",\n \"agent_effect\",\n \"agent_escalation\",\n \"quote_generate\",\n \"queue_priority\",\n] as const;\n\nexport type SensitiveReceiptAction = (typeof SENSITIVE_RECEIPT_ACTIONS)[number];\n\nexport interface VerifyActionReceiptOptions extends Omit<\n VerifyVerdictTokenOptions,\n \"aud\" | \"issuer\" | \"leewaySeconds\"\n> {\n audience: string;\n action: \"trial_activation\" | SensitiveReceiptAction;\n subject?: string;\n environment: \"test\" | \"live\";\n surface: string;\n digest: string;\n policy: string;\n proof: \"none\" | \"pow_severe\" | \"tenant_step_up\";\n}\n\nexport interface ActionReceiptClaims extends VerdictTokenClaims {\n action: \"trial_activation\" | SensitiveReceiptAction;\n subject?: string;\n environment: \"test\" | \"live\";\n surface: string;\n digest: string;\n policy: string;\n proof: \"none\" | \"pow_severe\" | \"tenant_step_up\";\n enforcementMode: \"enforce\";\n}\n\n/** Verify authorization for an exact operation, using trusted expected values. */\nexport async function verifyActionReceipt(\n token: string,\n options: VerifyActionReceiptOptions,\n): Promise<ActionReceiptClaims> {\n const claims = (await verifyReceipt(\n token,\n {\n ...options,\n aud: options.audience,\n issuer: VERDICT_TOKEN_ISSUER,\n leewaySeconds: 0,\n },\n \"chitmark-action+jwt\",\n )) as ActionReceiptClaims;\n const now = Math.floor((options.nowMs ?? Date.now()) / 1000);\n if (\n !options.audience ||\n !options.session ||\n !options.tenantId ||\n !options.policy ||\n !/^[a-f0-9]{64}$/.test(options.digest) ||\n !(options.action === \"trial_activation\"\n ? options.proof === \"none\" || options.proof === \"pow_severe\"\n : (SENSITIVE_RECEIPT_ACTIONS as readonly string[]).includes(options.action) &&\n options.proof === \"tenant_step_up\" &&\n typeof options.subject === \"string\" &&\n /^[A-Za-z0-9_-]{1,128}$/.test(options.subject) &&\n claims.subject === options.subject) ||\n claims.action !== options.action ||\n (options.environment !== \"test\" && options.environment !== \"live\") ||\n claims.environment !== options.environment ||\n !options.surface ||\n claims.surface !== options.surface ||\n claims.digest !== options.digest ||\n claims.policy !== options.policy ||\n claims.proof !== options.proof ||\n claims.enforcementMode !== \"enforce\" ||\n claims.decision !== \"allow\" ||\n claims.degraded !== false ||\n typeof claims.eventId !== \"string\" ||\n !claims.eventId ||\n !Number.isSafeInteger(claims.iat) ||\n !Number.isSafeInteger(claims.exp) ||\n claims.iat > now ||\n claims.exp <= now ||\n claims.exp - claims.iat !== 60\n ) {\n throw new VerdictTokenError(\n \"wrong_action_binding\",\n \"Receipt cannot authorize this operation\",\n );\n }\n return claims;\n}\n\nasync function verifyReceipt(\n token: string,\n options: VerifyVerdictTokenOptions,\n expectedType: \"JWT\" | \"chitmark-action+jwt\",\n): Promise<VerdictTokenClaims> {\n const nowMs = options.nowMs ?? Date.now();\n const leewaySeconds = options.leewaySeconds ?? DEFAULT_LEEWAY_SECONDS;\n\n const parts = token.split(\".\");\n if (parts.length !== 3) {\n throw new VerdictTokenError(\"malformed_token\", \"verdictToken must be a JWT\");\n }\n const [headerB64, payloadB64, signatureB64] = parts as [string, string, string];\n\n let header: Record<string, unknown>;\n let payload: Record<string, unknown>;\n try {\n header = JSON.parse(decodeBase64Url(headerB64)) as Record<string, unknown>;\n payload = JSON.parse(decodeBase64Url(payloadB64)) as Record<string, unknown>;\n } catch {\n throw new VerdictTokenError(\"malformed_token\", \"verdictToken is not valid JWT JSON\");\n }\n\n if (header[\"alg\"] !== \"ES256\") {\n throw new VerdictTokenError(\n \"wrong_algorithm\",\n `verdictToken must use ES256, got ${String(header[\"alg\"])}`,\n );\n }\n // RFC 8725 §3.11: explicit typing keeps this receipt distinct from any\n // other JWT a tenant might accept. The edge always mints typ \"JWT\".\n if (header[\"typ\"] !== expectedType) {\n throw new VerdictTokenError(\n \"wrong_type\",\n `verdictToken must have type ${expectedType}, got ${String(header[\"typ\"])}`,\n );\n }\n const kid = typeof header[\"kid\"] === \"string\" ? header[\"kid\"] : \"\";\n if (!kid) {\n throw new VerdictTokenError(\"unknown_kid\", \"verdictToken is missing kid\");\n }\n\n const exp = typeof payload[\"exp\"] === \"number\" ? payload[\"exp\"] : NaN;\n const iat = typeof payload[\"iat\"] === \"number\" ? payload[\"iat\"] : NaN;\n const nowSeconds = Math.floor(nowMs / 1000);\n if (Number.isFinite(exp) && exp < nowSeconds - leewaySeconds) {\n throw new VerdictTokenError(\"expired\", \"verdictToken has expired\");\n }\n if (Number.isFinite(iat) && iat > nowSeconds + leewaySeconds) {\n throw new VerdictTokenError(\"not_yet_valid\", \"verdictToken iat is in the future\");\n }\n\n const expectedIssuer = options.issuer ?? VERDICT_TOKEN_ISSUER;\n if (payload[\"iss\"] !== expectedIssuer) {\n throw new VerdictTokenError(\n \"wrong_issuer\",\n \"verdictToken was not issued by Chitmark\",\n );\n }\n if (payload[\"sub\"] !== options.session) {\n throw new VerdictTokenError(\n \"wrong_session\",\n \"verdictToken was minted for a different session\",\n );\n }\n if (payload[\"tid\"] !== options.tenantId) {\n throw new VerdictTokenError(\n \"wrong_tenant\",\n \"verdictToken was minted for a different tenant\",\n );\n }\n const expectedAud = options.aud;\n if (expectedAud !== undefined && payload[\"aud\"] !== expectedAud) {\n throw new VerdictTokenError(\n \"wrong_aud\",\n \"verdictToken was minted for a different origin\",\n );\n }\n\n const jwk = await findJwk(kid, options);\n if (!jwk) {\n throw new VerdictTokenError(\"unknown_kid\", `JWKS has no key for kid ${kid}`);\n }\n\n if (\n jwk[\"kty\"] !== \"EC\" ||\n jwk[\"crv\"] !== \"P-256\" ||\n (jwk[\"alg\"] !== undefined && jwk[\"alg\"] !== \"ES256\")\n ) {\n throw new VerdictTokenError(\n \"wrong_algorithm\",\n \"Verification requires an ES256 P-256 key\",\n );\n }\n\n let publicKey: CryptoKey;\n try {\n publicKey = await crypto.subtle.importKey(\n \"jwk\",\n jwk as unknown as JsonWebKey,\n { name: \"ECDSA\", namedCurve: \"P-256\" },\n false,\n [\"verify\"],\n );\n } catch {\n throw new VerdictTokenError(\n \"invalid_signature\",\n \"JWKS key is not a valid P-256 public key\",\n );\n }\n\n const signatureBytes = decodeBase64UrlBytes(signatureB64);\n const signatureBuffer = new ArrayBuffer(signatureBytes.byteLength);\n new Uint8Array(signatureBuffer).set(signatureBytes);\n\n const valid = await crypto.subtle.verify(\n { name: \"ECDSA\", hash: \"SHA-256\" },\n publicKey,\n signatureBuffer,\n new TextEncoder().encode(`${headerB64}.${payloadB64}`),\n );\n if (!valid) {\n throw new VerdictTokenError(\n \"invalid_signature\",\n \"verdictToken signature failed verification\",\n );\n }\n\n return payload as unknown as VerdictTokenClaims;\n}\n\nasync function findJwk(\n kid: string,\n options: VerifyVerdictTokenOptions,\n): Promise<Record<string, unknown> | undefined> {\n let jwks = options.jwks;\n if (!jwks) {\n const jwksUrl = options.jwksUrl ?? DEFAULT_JWKS_URL;\n try {\n const fetchImpl = options.fetch ?? globalThis.fetch.bind(globalThis);\n const res = await fetchImpl(jwksUrl);\n if (!res.ok) {\n throw new Error(`JWKS fetch failed with ${res.status}`);\n }\n jwks = (await res.json()) as { keys: Array<Record<string, unknown>> };\n } catch (err) {\n throw new VerdictTokenError(\n \"jwks_unavailable\",\n `Failed to load JWKS from ${jwksUrl}: ${\n err instanceof Error ? err.message : \"unknown error\"\n }`,\n );\n }\n }\n if (!Array.isArray(jwks.keys)) {\n throw new VerdictTokenError(\"jwks_unavailable\", \"JWKS response has no keys array\");\n }\n return jwks.keys.find((key) => key[\"kid\"] === kid);\n}\n\nfunction decodeBase64Url(value: string): string {\n const normalized = value.replace(/-/g, \"+\").replace(/_/g, \"/\");\n const padded = normalized + \"=\".repeat((4 - (normalized.length % 4)) % 4);\n const binary = atob(padded);\n return new TextDecoder().decode(Uint8Array.from(binary, (ch) => ch.charCodeAt(0)));\n}\n\nfunction decodeBase64UrlBytes(value: string): Uint8Array {\n const normalized = value.replace(/-/g, \"+\").replace(/_/g, \"/\");\n const padded = normalized + \"=\".repeat((4 - (normalized.length % 4)) % 4);\n const binary = atob(padded);\n const out = new Uint8Array(binary.length);\n for (let i = 0; i < binary.length; i += 1) out[i] = binary.charCodeAt(i);\n return out;\n}\n","import {\n attributionEvidence,\n type AttributionLink,\n type AttributionLinkRequest,\n type AttributionResolveOptions,\n type AttributionResult,\n} from \"./attribution.js\";\nimport { boundedCredential, type CredentialProvider } from \"./credentials.js\";\nimport type { ChargeRequest, ChargeResponse } from \"./charge.js\";\nimport {\n ChitmarkApiError,\n ChitmarkError,\n degradedChallengeVerdict,\n enforceDegradedNeverAllow,\n} from \"./errors.js\";\nimport {\n SDK_VERSION,\n defaultTimeoutMs,\n envBaseUrl,\n resolveBaseUrl,\n} from \"./internal/constants.js\";\nimport { flattenHeaders, prepareSubject } from \"./internal/prepare.js\";\nimport {\n verifyVerdictToken,\n type VerdictTokenClaims,\n type VerifyVerdictTokenOptions,\n} from \"./verify-token.js\";\nimport type {\n ChallengeRequest,\n ChallengeResponse,\n ChallengeCompletionResponse,\n ChallengeProof,\n ChitmarkOptions,\n FeedbackRequest,\n FeedbackResponse,\n OnDegraded,\n PiiMode,\n Verdict,\n VerifyRequest,\n} from \"./types.js\";\n\n/**\n * Official Chitmark client: security operations and the paid-access lifecycle.\n * Trust decisions on agent-mediated actions, tuned by business outcomes.\n *\n * @example\n * ```ts\n * const chitmark = new Chitmark({ apiKey: process.env.CHITMARK_API_KEY! });\n * const verdict = await chitmark.verify({\n * action: \"signup\",\n * subject: { email, ip, userAgent },\n * });\n * ```\n */\nexport class Chitmark {\n readonly attribution = {\n resolve: (input: AttributionResolveOptions): Promise<AttributionResult> =>\n this.request(\"/v1/attributions/resolve\", {\n method: \"POST\",\n body: attributionEvidence(input, this.piiMode),\n idempotencyKey: input.idempotencyKey,\n }),\n get: (id: string): Promise<AttributionResult> =>\n this.request(`/v1/attributions/${encodeURIComponent(id)}`, { method: \"GET\" }),\n createLink: (\n input: AttributionLinkRequest,\n idempotencyKey?: string,\n ): Promise<AttributionLink> =>\n this.request(\"/v1/identity-links\", { method: \"POST\", body: input, idempotencyKey }),\n revokeLink: (id: string): Promise<void> =>\n this.request(`/v1/identity-links/${encodeURIComponent(id)}`, { method: \"DELETE\" }),\n };\n\n /** Paid access lifecycle. Transport uncertainty must be resumed, never treated as payment. */\n async charge(request: ChargeRequest): Promise<ChargeResponse> {\n return this.request<ChargeResponse>(\"/v1/charge\", {\n method: \"POST\",\n body: request,\n idempotencyKey: request.idempotencyKey,\n timeoutMs: Math.max(this.timeoutMs, 15_000),\n });\n }\n private readonly apiKey?: string;\n private readonly credentialProvider?: CredentialProvider;\n private readonly baseUrl: string;\n private readonly timeoutMs: number;\n private readonly piiMode: PiiMode;\n private readonly onDegraded: OnDegraded;\n private readonly fetchImpl: typeof fetch;\n private readonly clientName: string;\n\n constructor(options: ChitmarkOptions) {\n if (!!options.apiKey === !!options.credentialProvider) {\n throw new ChitmarkError(\"Chitmark apiKey is required\");\n }\n if (options.onDegraded && options.onDegraded !== \"challenge\") {\n throw new ChitmarkError(\n 'onDegraded must be \"challenge\": fail to challenge, never to allow',\n );\n }\n this.apiKey = options.apiKey;\n this.credentialProvider = options.credentialProvider;\n this.baseUrl = resolveBaseUrl(options.env, options.baseUrl ?? envBaseUrl());\n this.timeoutMs = options.timeoutMs ?? defaultTimeoutMs(this.baseUrl);\n this.piiMode = options.piiMode ?? \"hashed\";\n this.onDegraded = \"challenge\";\n this.fetchImpl = options.fetch ?? globalThis.fetch.bind(globalThis);\n this.clientName = options.clientName ?? `chitmark-node/${SDK_VERSION}`;\n }\n\n /**\n * Score + route an inbound action (signup / trial / …).\n * Client budget defaults to 800ms (2000ms for local base URLs).\n *\n * Store-outage degradation arrives as **HTTP 200** with a Verdict body\n * (`degraded: true`, `decision: \"challenge\"`). The SDK deserializes that\n * like any other Verdict. Verify never returns HTTP 503.\n *\n * HTTP 4xx / 429 Error responses throw `ChitmarkApiError`. Transport\n * timeout / network failure (or a malformed 200 body) synthesizes a local\n * degraded challenge Verdict (never allow, never crashes).\n *\n * Persist `v.eventId` on the account row: feedback joins only on that id.\n */\n async verify(request: VerifyRequest): Promise<Verdict> {\n const subject = await prepareSubject(\n {\n ...request.subject,\n headers: flattenHeaders(request.subject.headers),\n },\n this.piiMode,\n );\n\n const body: VerifyRequest = {\n ...request,\n subject,\n };\n\n try {\n const verdict = await this.request<Verdict>(\"/v1/verify\", {\n method: \"POST\",\n body,\n idempotencyKey: request.idempotencyKey,\n });\n if (!isWellFormedVerdict(verdict)) {\n return degradedChallengeVerdict(\n \"Degraded: verify returned a malformed verdict shape\",\n request.session,\n );\n }\n return enforceDegradedNeverAllow(verdict);\n } catch (err) {\n if (err instanceof ChitmarkApiError) {\n throw err;\n }\n return degradedChallengeVerdict(\n err instanceof Error ? `Degraded: ${err.message}` : \"Degraded: verify failed\",\n request.session,\n );\n }\n }\n\n /**\n * Report a downstream outcome joined on the stored eventId from verify.\n *\n * Security invariant: feedback cannot create attribution. It only attaches\n * an outcome to an existing verify event for this tenant. Unknown or\n * cross-tenant eventIds return 404. Never invent a join from email/IP.\n *\n * Append-only (not latest-wins): multiple outcomes may attach to one\n * eventId. Exact duplicates share one feedbackId. Compatible labels\n * coexist; conflicting pairs quarantine the new observation without\n * deleting prior evidence. HTTP `{ ok: true }` still acknowledges\n * quarantined ingest.\n *\n * `idempotencyKey` is sent as both the Idempotency-Key header and body field\n * (header takes precedence server-side) so exact retries replay the original\n * acknowledgement.\n */\n async feedback(request: FeedbackRequest): Promise<FeedbackResponse> {\n return this.request<FeedbackResponse>(\"/v1/feedback\", {\n method: \"POST\",\n body: request,\n idempotencyKey: request.idempotencyKey,\n });\n }\n\n /**\n * Issue an asymmetric-cost challenge after decision === challenge | degraded.\n */\n async challenge(request: ChallengeRequest): Promise<ChallengeResponse> {\n return this.request<ChallengeResponse>(\"/v1/challenge\", {\n method: \"POST\",\n body: request,\n });\n }\n\n /**\n * Complete a challenge by submitting its solved proof. Clears only the bound\n * session, once. Does not authorize the action: re-verify with\n * `context.challengeId` for standalone challenges or the original action\n * binding plus the challenge and event IDs for operation-bound challenges.\n */\n async completeChallenge(request: {\n eventId: string;\n challengeId: string;\n session: string;\n proof: ChallengeProof;\n }): Promise<ChallengeCompletionResponse> {\n return this.request<ChallengeCompletionResponse>(\"/v1/challenge\", {\n method: \"POST\",\n body: request,\n });\n }\n\n /**\n * Verify a verdictToken's signature against the API's JWKS and its session /\n * tenant binding. Prefers a cached `jwks` (refresh periodically and on\n * unknown `kid`); do not fetch on every call. Rejects expired tokens,\n * unknown kids, and invalid signatures with `VerdictTokenError`. Always\n * pass `session` and `tenantId` (required security boundary); `aud`\n * optionally enforces the origin hint only.\n */\n async verifyVerdictToken(\n token: string,\n options: Omit<VerifyVerdictTokenOptions, \"jwksUrl\" | \"fetch\">,\n ): Promise<VerdictTokenClaims> {\n return verifyVerdictToken(token, {\n ...options,\n jwksUrl: `${this.baseUrl}/.well-known/jwks.json`,\n fetch: this.fetchImpl,\n });\n }\n\n /**\n * Low-level HTTP helper. Prefer verify / feedback / challenge.\n */\n async request<T>(\n path: string,\n init: {\n method: string;\n body?: unknown;\n idempotencyKey?: string;\n timeoutMs?: number;\n },\n ): Promise<T> {\n const controller = new AbortController();\n const timeoutMs = init.timeoutMs ?? this.timeoutMs;\n const timer = setTimeout(() => controller.abort(), timeoutMs);\n\n try {\n const headers: Record<string, string> = {\n ...(this.apiKey ? { Authorization: `Bearer ${this.apiKey}` } : {}),\n \"Content-Type\": \"application/json\",\n Accept: \"application/json\",\n \"User-Agent\": this.clientName,\n \"X-Chitmark-Client\": this.clientName,\n };\n if (this.credentialProvider) {\n try {\n Object.assign(\n headers,\n await boundedCredential(\n this.credentialProvider.headers({\n url: `${this.baseUrl}${path}`,\n method: init.method,\n signal: controller.signal,\n }),\n controller.signal,\n ),\n );\n } catch {\n throw new ChitmarkError(\"Credential unavailable\", { code: \"credential\" });\n }\n if (!headers.Authorization?.startsWith(\"DPoP \") || !headers.DPoP)\n throw new ChitmarkError(\"Invalid DPoP credentials\");\n }\n if (init.idempotencyKey) {\n headers[\"Idempotency-Key\"] = init.idempotencyKey;\n }\n\n const res = await this.fetchImpl(`${this.baseUrl}${path}`, {\n method: init.method,\n headers,\n body: init.body !== undefined ? JSON.stringify(init.body) : undefined,\n signal: controller.signal,\n redirect: \"error\",\n });\n\n const text = await res.text();\n let parsed: unknown = undefined;\n if (text) {\n try {\n parsed = JSON.parse(text) as unknown;\n } catch {\n parsed = text;\n }\n }\n\n if (!res.ok) {\n const errBody =\n typeof parsed === \"object\" && parsed !== null\n ? (parsed as { error?: string; message?: string; code?: string })\n : text;\n const normalized =\n typeof errBody === \"string\"\n ? errBody\n : {\n error: errBody.error ?? `http_${res.status}`,\n message: errBody.message,\n code: errBody.code,\n };\n throw new ChitmarkApiError(res.status, normalized);\n }\n\n return parsed as T;\n } catch (err) {\n if (err instanceof ChitmarkApiError) throw err;\n if (err instanceof Error && err.name === \"AbortError\") {\n throw new ChitmarkError(`Request timed out after ${timeoutMs}ms`, {\n code: \"timeout\",\n });\n }\n throw err instanceof Error\n ? new ChitmarkError(err.message, { code: \"transport\" })\n : new ChitmarkError(\"Unknown transport error\", { code: \"transport\" });\n } finally {\n clearTimeout(timer);\n }\n }\n\n /** Public accessors for inspection / tests. */\n get config(): {\n baseUrl: string;\n timeoutMs: number;\n piiMode: PiiMode;\n onDegraded: OnDegraded;\n } {\n return {\n baseUrl: this.baseUrl,\n timeoutMs: this.timeoutMs,\n piiMode: this.piiMode,\n onDegraded: this.onDegraded,\n };\n }\n}\n\nconst VERDICT_DECISIONS: ReadonlySet<string> = new Set([\"allow\", \"challenge\", \"deny\"]);\n\n/**\n * Minimal shape guard for a 200 verify response. A malformed verdict must\n * never be treated as allow: the gating fields are what gate correctness.\n */\nexport function isWellFormedVerdict(value: unknown): value is Verdict {\n if (typeof value !== \"object\" || value === null) return false;\n const v = value as Partial<Verdict>;\n return (\n typeof v.decision === \"string\" &&\n VERDICT_DECISIONS.has(v.decision) &&\n typeof v.eventId === \"string\" &&\n v.eventId.length > 0 &&\n typeof v.degraded === \"boolean\"\n );\n}\n","/** Integer USD cents. Customer purchases are separate from Chitmark subscriptions. */\nexport interface PaidResource {\n resourceId: string;\n version: number;\n kind: \"api_call\" | \"dataset\" | \"compute\";\n unit: \"call\" | \"access\" | \"compute_second\";\n unitAmount: number;\n currency: \"usd\";\n minQuantity: number;\n maxQuantity: number;\n maxAmount: number;\n quoteTtlSeconds: number;\n accessTtlSeconds: number;\n enabled: boolean;\n refundTerms: \"unused_only\";\n}\ntype ChargeBase = { sellerTenantId: string; idempotencyKey?: string };\ntype PurchaseRef = ChargeBase & { purchaseId: string };\nexport type ChargeRequest =\n | (ChargeBase & { operation: \"resource\"; resourceId: string })\n | (ChargeBase & {\n operation: \"quote\";\n resourceId: string;\n quantity: number;\n operationDigest: string;\n })\n | (PurchaseRef & {\n operation: \"accept\";\n quoteVersion: string;\n maxAmount: number;\n currency: \"usd\";\n })\n | (PurchaseRef & { operation: \"status\" | \"cancel\" | \"reconcile\" })\n | (PurchaseRef & { operation: \"permission\"; allowed: boolean; eventId?: string })\n | (PurchaseRef & {\n operation: \"reserve\";\n executionId: string;\n operationDigest: string;\n units: number;\n })\n | (PurchaseRef & {\n operation: \"usage\";\n executionId: string;\n sequence: number;\n usedUnits: number;\n result: \"delivered\" | \"failed\" | \"unknown\";\n })\n | (PurchaseRef & { operation: \"refund\"; amount: number })\n | (ChargeBase & { operation: \"configure\"; resource: PaidResource })\n | (ChargeBase & { operation: \"budget\"; buyerTenantId: string; limit: number });\n\nexport interface ChargeQuote {\n version: string;\n sellerTenantId: string;\n buyerTenantId: string;\n actingAgent: string;\n resource: PaidResource;\n quantity: number;\n amount: number;\n currency: \"usd\";\n operationDigest: string;\n expiresAt: number;\n accessUntil: number;\n}\nexport interface ChargeExecution {\n executionId: string;\n /** Original seller-owned verify event captured at reservation, when required. */\n eventId?: string;\n units: number;\n usedUnits: number;\n sequence: number;\n state: \"reserved\" | \"delivered\" | \"failed\" | \"unknown\";\n leaseUntil: number;\n}\nexport interface ChargePurchase {\n purchaseId: string;\n quote: ChargeQuote;\n accepted: boolean;\n permission: { allowed: boolean; source: \"seller\"; eventId?: string };\n payment: {\n state:\n | \"pending\"\n | \"authorized\"\n | \"settled\"\n | \"failed\"\n | \"canceled\"\n | \"partially_refunded\"\n | \"refunded\"\n | \"disputed\"\n | \"unknown\";\n authorizedAmount: number;\n capturedAmount: number;\n refundedAmount: number;\n refundState?: \"none\" | \"pending\" | \"succeeded\" | \"failed\" | \"unknown\";\n disputedAmount: number;\n providerFee: number | null;\n checkedAt: number | null;\n source: \"provider\";\n };\n delivery: { source: \"seller_report\"; executions: ChargeExecution[] };\n stopped: boolean;\n refundRequestedAmount: number;\n createdAt: number;\n updatedAt: number;\n checkoutUrl?: string;\n}\nexport type ChargeResponse =\n | {\n ok: true;\n purchase: ChargePurchase;\n next:\n | \"accept\"\n | \"pay\"\n | \"wait\"\n | \"seller_permission\"\n | \"execute\"\n | \"reconcile\"\n | \"complete\";\n reservation?: { executionId: string; granted: boolean; leaseUntil: number };\n }\n | { ok: true; resource: PaidResource }\n | { ok: true; budget: { limit: number; committed: number } };\n\n/** Operational summary, never an execution authorization. Seller cost is optional\n * application evidence; absent cost/fees leaves margin unknown. */\nexport function summarizeCharge(\n p: ChargePurchase,\n now = Date.now(),\n sellerCostCents?: number,\n) {\n if (\n sellerCostCents !== undefined &&\n (!Number.isSafeInteger(sellerCostCents) || sellerCostCents < 0)\n )\n throw new Error(\"Invalid seller cost\");\n const deliveredUnits = p.delivery.executions.reduce(\n (n, e) => n + (e.state === \"delivered\" ? e.usedUnits : 0),\n 0,\n );\n const unresolvedUnits = p.delivery.executions.reduce(\n (n, e) => n + (e.state === \"reserved\" || e.state === \"unknown\" ? e.units : 0),\n 0,\n );\n const net =\n p.payment.providerFee === null\n ? null\n : p.payment.capturedAmount - p.payment.refundedAmount - p.payment.providerFee;\n return {\n paidCompletion:\n p.payment.state === \"settled\" &&\n p.payment.capturedAmount > 0 &&\n p.payment.refundedAmount === 0 &&\n p.payment.disputedAmount === 0 &&\n deliveredUnits === p.quote.quantity,\n billedCents: p.payment.capturedAmount - p.payment.refundedAmount,\n sellerReportedDeliveredCents: deliveredUnits * p.quote.resource.unitAmount,\n deliveredUnits,\n unresolvedUnits,\n unresolvedAgeUpperBoundMs:\n p.payment.state === \"pending\" ||\n p.payment.refundState === \"pending\" ||\n p.payment.refundState === \"unknown\" ||\n p.payment.state === \"unknown\" ||\n unresolvedUnits > 0\n ? Math.max(0, now - p.createdAt)\n : null,\n refundedCents: p.payment.refundedAmount,\n disputedCents: p.payment.disputedAmount,\n captureFeeCents: p.payment.providerFee,\n sellerNetAfterCaptureFeeCents: net,\n sellerMarginCents:\n net === null || sellerCostCents === undefined ? null : net - sellerCostCents,\n // Provider/application reconciliation must supply duplicate evidence; retries alone do not prove absence.\n duplicateCharges: null,\n duplicateEffects: null,\n observedElapsedMs: Math.max(0, p.updatedAt - p.createdAt),\n };\n}\n","import type { Verdict } from \"./types.js\";\n\nexport const CHITMARK_HTTP_STATUS = {\n ok: 200,\n created: 201,\n badRequest: 400,\n unauthorized: 401,\n forbidden: 403,\n notFound: 404,\n conflict: 409,\n preconditionRequired: 428,\n tooManyRequests: 429,\n} as const;\n\nexport type ChitmarkHttpStatus =\n (typeof CHITMARK_HTTP_STATUS)[keyof typeof CHITMARK_HTTP_STATUS];\n\nexport const CHITMARK_HTTP_STATUS_MEANING = {\n ok: \"Request succeeded. For verify gates, continue only after an explicit non-degraded allow.\",\n created: \"Resource was created after an explicit non-degraded allow.\",\n badRequest: \"Required request fields are missing or malformed.\",\n unauthorized: \"API key is missing or invalid.\",\n forbidden: \"Verify returned deny; block the action.\",\n notFound: \"Referenced Chitmark resource was not found.\",\n conflict: \"Idempotency key is already associated with a different payload fingerprint.\",\n preconditionRequired:\n \"428 means the request is not rejected permanently; a required verification precondition must be satisfied before the action can proceed.\",\n tooManyRequests: \"Request was rate limited.\",\n} as const satisfies Record<keyof typeof CHITMARK_HTTP_STATUS, string>;\n\n/**\n * Explicit non-degraded allow. Use this (or `isEligibleAllow`) before any\n * protected action so unknown / malformed decisions cannot fall through.\n */\nexport type EligibleAllowVerdict = Verdict & {\n decision: \"allow\";\n degraded: false;\n};\n\n/**\n * Type guard for the only verdict that may continue a gated action.\n * Fail closed: anything that is not an explicit non-degraded allow is ineligible.\n */\nexport function isEligibleAllow(verdict: Verdict): verdict is EligibleAllowVerdict {\n return verdict.decision === \"allow\" && !verdict.degraded;\n}\n\n/**\n * Map a verify verdict to an HTTP status for framework drop-ins.\n * Unknown or malformed decisions fail to challenge (428), never to allow (200).\n */\nexport function verdictToHttpStatus(verdict: Verdict): ChitmarkHttpStatus {\n if (verdict.degraded || verdict.decision === \"challenge\") {\n return CHITMARK_HTTP_STATUS.preconditionRequired;\n }\n if (verdict.decision === \"deny\") return CHITMARK_HTTP_STATUS.forbidden;\n if (!isEligibleAllow(verdict)) {\n return CHITMARK_HTTP_STATUS.preconditionRequired;\n }\n return CHITMARK_HTTP_STATUS.ok;\n}\n","/** Server-owned operation for the trial credit grant profile. Use opaque IDs. */\nexport interface TrialCreditOperation {\n operationId: string;\n target: string;\n quota: number;\n recipient?: string;\n}\n\nconst opaqueId = /^[A-Za-z0-9_.:-]{1,128}$/;\n\n/** Hash the exact operation that will be executed. IDs are case sensitive. */\nexport async function trialCreditOperationDigest(\n operation: TrialCreditOperation,\n): Promise<string> {\n const { operationId, target, quota, recipient } = operation;\n if (\n Object.keys(operation).some(\n (key) => ![\"operationId\", \"target\", \"quota\", \"recipient\"].includes(key),\n ) ||\n typeof operationId !== \"string\" ||\n !opaqueId.test(operationId) ||\n typeof target !== \"string\" ||\n !opaqueId.test(target) ||\n !Number.isSafeInteger(quota) ||\n quota < 1 ||\n (recipient !== undefined &&\n (typeof recipient !== \"string\" || !opaqueId.test(recipient)))\n ) {\n throw new TypeError(\"Invalid trial credit operation\");\n }\n const bytes = new TextEncoder().encode(\n JSON.stringify([\n \"chitmark-action-v1\",\n \"trial_activation\",\n operationId,\n target,\n quota,\n recipient ?? null,\n ]),\n );\n const digest = await crypto.subtle.digest(\"SHA-256\", bytes);\n return Array.from(new Uint8Array(digest), (byte) =>\n byte.toString(16).padStart(2, \"0\"),\n ).join(\"\");\n}\n","/**\n * Resolve a client IP for verify subject signals from a Fetch Request.\n *\n * Prefer platform-set headers (`cf-connecting-ip`, `x-real-ip`,\n * `x-vercel-forwarded-for`). `X-Forwarded-For` is only safe when a trusted\n * proxy boundary strips or rewrites client-supplied values. Do not read XFF\n * on a directly reachable origin. On Cloudflare Workers, prefer\n * `verifyRequest` from `@chitmark/sdk/edge`, which owns this lookup.\n */\nexport function getTrustedClientIp(req: Request): string {\n const platform =\n req.headers.get(\"cf-connecting-ip\")?.trim() ||\n req.headers.get(\"x-real-ip\")?.trim() ||\n req.headers.get(\"x-vercel-forwarded-for\")?.split(\",\")[0]?.trim() ||\n \"\";\n if (platform) return platform;\n\n // Last resort: first XFF hop. Only valid behind a trusted proxy that\n // overwrites this header at the edge.\n return req.headers.get(\"x-forwarded-for\")?.split(\",\")[0]?.trim() ?? \"\";\n}\n","import type { Chitmark } from \"../client.js\";\nimport { CHITMARK_HTTP_STATUS, isEligibleAllow } from \"../http-status.js\";\nimport type { Action, Verdict } from \"../types.js\";\n\n/**\n * Minimal Express-compatible types (no express dependency).\n */\nexport interface ExpressLikeRequest {\n hostname?: string;\n path?: string;\n ip?: string;\n body?: {\n email?: string;\n [key: string]: unknown;\n };\n headers: Record<string, string | string[] | undefined>;\n}\n\nexport interface ExpressLikeResponse {\n status: (code: number) => ExpressLikeResponse;\n json: (body: unknown) => unknown;\n locals: Record<string, unknown>;\n}\n\nexport type ExpressNext = (err?: unknown) => void;\n\nexport interface GateOptions {\n /** Optional session binder. */\n session?: (req: ExpressLikeRequest) => string | undefined;\n /** Custom surface string. */\n surface?: (req: ExpressLikeRequest) => string;\n}\n\n/**\n * Express middleware factory: verify on the hot path, attach verdict to res.locals.\n *\n * Verdict shape: `decision` is allow | challenge | deny; `degraded` is a\n * boolean operational flag (when true, decision is always challenge).\n * HTTP mapping:\n * - `decision === \"deny\"` → 403\n * - `decision === \"challenge\"` or `degraded` → 428\n * - anything else that is not an explicit non-degraded allow → 428 (fail closed)\n * - explicit non-degraded allow → next()\n *\n * 428 means the request is not rejected permanently; a required verification\n * precondition must be satisfied before the action can proceed.\n * @example\n * ```ts\n * app.post(\"/signup\", chitmarkGate(chitmark, \"signup\"), signupHandler);\n * ```\n */\nexport function chitmarkGate(\n client: Chitmark,\n action: Action,\n options: GateOptions = {},\n): (\n req: ExpressLikeRequest,\n res: ExpressLikeResponse,\n next: ExpressNext,\n) => Promise<void> {\n return async (req, res, next) => {\n try {\n const surface = options.surface?.(req) ?? `${req.hostname ?? \"\"}${req.path ?? \"\"}`;\n const session = options.session?.(req);\n\n const v: Verdict = await client.verify({\n action,\n surface,\n session,\n subject: {\n email: req.body?.email,\n ip: req.ip,\n userAgent:\n (typeof req.headers[\"user-agent\"] === \"string\"\n ? req.headers[\"user-agent\"]\n : undefined) ?? \"\",\n headers: req.headers,\n formData: req.body,\n },\n });\n\n res.locals.chitmark = v;\n\n if (v.degraded || v.decision === \"challenge\") {\n res\n .status(CHITMARK_HTTP_STATUS.preconditionRequired)\n .json({ challenge: true, eventId: v.eventId });\n return;\n }\n if (v.decision === \"deny\") {\n res\n .status(CHITMARK_HTTP_STATUS.forbidden)\n .json({ error: \"blocked\", eventId: v.eventId });\n return;\n }\n if (!isEligibleAllow(v)) {\n // Unknown / malformed decision: fail to challenge, never to allow.\n res\n .status(CHITMARK_HTTP_STATUS.preconditionRequired)\n .json({ challenge: true, eventId: v.eventId });\n return;\n }\n next();\n } catch (err) {\n next(err);\n }\n };\n}\n","import type { Chitmark } from \"../client.js\";\nimport type { Action, Verdict } from \"../types.js\";\nimport { getTrustedClientIp } from \"../trusted-ip.js\";\n\nexport interface NextVerifyOptions {\n action: Action;\n surface?: string;\n session?: string;\n body?: {\n email?: string;\n [key: string]: unknown;\n };\n}\n\n/**\n * Helper for Next.js App Router route handlers.\n * Returns the verdict; caller maps decision → Response.\n *\n * IP comes from {@link getTrustedClientIp}: platform headers first, then\n * `X-Forwarded-For` only as a last resort behind a trusted proxy boundary.\n *\n * @example\n * ```ts\n * const v = await verifyNextRequest(chitmark, req, { action: \"signup\", body });\n * const status = verdictToHttpStatus(v);\n * ```\n */\nexport async function verifyNextRequest(\n client: Chitmark,\n req: Request,\n options: NextVerifyOptions,\n): Promise<Verdict> {\n const url = new URL(req.url);\n return client.verify({\n action: options.action,\n surface: options.surface ?? `${url.host}${url.pathname}`,\n session: options.session,\n subject: {\n email: options.body?.email,\n ip: getTrustedClientIp(req),\n userAgent: req.headers.get(\"user-agent\") ?? \"\",\n headers: Object.fromEntries(req.headers),\n formData: options.body,\n },\n });\n}\n\nexport { verdictToHttpStatus } from \"../http-status.js\";\nexport { getTrustedClientIp } from \"../trusted-ip.js\";\n","/** Offline evidence only. These APIs never grant execution authority or fetch trust. */\nexport type EvidenceKey = {\n kid: string;\n jwk: Record<string, unknown>;\n notBefore: number;\n notAfter: number;\n revokedAt?: number;\n compromisedAt?: number;\n};\nexport type EvidenceSigningKey = {\n kty?: string;\n crv?: string;\n alg?: string;\n x?: string;\n y?: string;\n d?: string;\n ext?: boolean;\n key_ops?: string[];\n};\nexport class EvidenceError extends Error {\n constructor(public readonly code: string) {\n super(code);\n this.name = \"EvidenceError\";\n }\n}\nexport function evidenceAssert(value: unknown, code: string): asserts value {\n if (!value) throw new EvidenceError(code);\n}\n/** Restricted canonical JSON: ASCII strings/keys, safe integers, arrays and plain objects. */\nexport function canonicalEvidence(value: unknown): string {\n if (value === null || typeof value === \"boolean\") return JSON.stringify(value);\n if (typeof value === \"number\") {\n evidenceAssert(\n Number.isSafeInteger(value) && !Object.is(value, -0),\n \"noncanonical_number\",\n );\n return String(value);\n }\n if (typeof value === \"string\") {\n evidenceAssert(/^[\\x20-\\x7e]*$/.test(value), \"noncanonical_string\");\n return JSON.stringify(value);\n }\n if (Array.isArray(value)) return `[${value.map(canonicalEvidence).join(\",\")}]`;\n evidenceAssert(\n value &&\n typeof value === \"object\" &&\n Object.getPrototypeOf(value) === Object.prototype,\n \"noncanonical_object\",\n );\n const obj = value as Record<string, unknown>;\n return `{${Object.keys(obj)\n .sort()\n .map((key) => `${canonicalEvidence(key)}:${canonicalEvidence(obj[key])}`)\n .join(\",\")}}`;\n}\nexport async function evidenceHash(value: string): Promise<string> {\n return Array.from(\n new Uint8Array(\n await crypto.subtle.digest(\"SHA-256\", new TextEncoder().encode(value)),\n ),\n (b) => b.toString(16).padStart(2, \"0\"),\n ).join(\"\");\n}\nconst encode = (bytes: Uint8Array) =>\n btoa(Array.from(bytes, (b) => String.fromCharCode(b)).join(\"\"))\n .replace(/\\+/g, \"-\")\n .replace(/\\//g, \"_\")\n .replace(/=+$/, \"\");\nconst decode = (part: string): Uint8Array<ArrayBuffer> =>\n Uint8Array.from(atob(part.replace(/-/g, \"+\").replace(/_/g, \"/\")), (c) =>\n c.charCodeAt(0),\n );\nexport function evidenceKeyAt(\n history: EvidenceKey[],\n kid: string,\n at: number,\n): EvidenceKey {\n const matches = history.filter((key) => key.kid === kid);\n evidenceAssert(matches.length === 1, \"unknown_trust_root\");\n const key = matches[0]!;\n evidenceAssert(\n key.jwk.kty === \"EC\" &&\n key.jwk.crv === \"P-256\" &&\n (!key.jwk.alg || key.jwk.alg === \"ES256\") &&\n !key.jwk.d,\n \"unsupported_key\",\n );\n evidenceAssert(\n Number.isSafeInteger(at) &&\n Number.isSafeInteger(key.notBefore) &&\n Number.isSafeInteger(key.notAfter) &&\n key.notBefore <= at &&\n at < key.notAfter,\n \"key_outside_validity\",\n );\n evidenceAssert(key.revokedAt === undefined, \"revoked_key\");\n return key;\n}\nexport async function verifyEvidenceSignature(\n token: string,\n typ: string,\n history: EvidenceKey[],\n at: number,\n): Promise<Record<string, unknown>> {\n evidenceAssert(\n typeof token === \"string\" &&\n token.length <= 8_000_000 &&\n /^[A-Za-z0-9_-]+\\.[A-Za-z0-9_-]+\\.[A-Za-z0-9_-]+$/.test(token),\n \"malformed_signature\",\n );\n const [h, p, s] = token.split(\".\") as [string, string, string];\n let head, payload;\n try {\n head = JSON.parse(\n new TextDecoder(\"utf-8\", { fatal: true, ignoreBOM: true }).decode(decode(h)),\n );\n payload = JSON.parse(\n new TextDecoder(\"utf-8\", { fatal: true, ignoreBOM: true }).decode(decode(p)),\n );\n } catch {\n throw new EvidenceError(\"malformed_signature\");\n }\n evidenceAssert(\n head?.alg === \"ES256\" && head.typ === typ && Object.keys(head).length === 3,\n \"unsupported_profile\",\n );\n const trusted = evidenceKeyAt(history, head.kid, at);\n const key = await crypto.subtle.importKey(\n \"jwk\",\n trusted.jwk as unknown as JsonWebKey,\n { name: \"ECDSA\", namedCurve: \"P-256\" },\n false,\n [\"verify\"],\n );\n evidenceAssert(\n await crypto.subtle.verify(\n { name: \"ECDSA\", hash: \"SHA-256\" },\n key,\n decode(s),\n new TextEncoder().encode(`${h}.${p}`),\n ),\n \"invalid_signature\",\n );\n evidenceAssert(\n payload && typeof payload === \"object\" && !Array.isArray(payload),\n \"malformed_payload\",\n );\n return payload as Record<string, unknown>;\n}\nexport async function signEvidence(\n payload: object,\n typ: string,\n kid: string,\n jwk: EvidenceSigningKey,\n): Promise<string> {\n evidenceAssert(\n jwk.kty === \"EC\" && jwk.crv === \"P-256\" && (!jwk.alg || jwk.alg === \"ES256\"),\n \"unsupported_key\",\n );\n const input = `${encode(new TextEncoder().encode(canonicalEvidence({ alg: \"ES256\", kid, typ })))}.${encode(new TextEncoder().encode(canonicalEvidence(payload)))}`;\n evidenceAssert(input.length + 87 <= 8_000_000, \"bundle_too_large\");\n const key = await crypto.subtle.importKey(\n \"jwk\",\n jwk as unknown as JsonWebKey,\n { name: \"ECDSA\", namedCurve: \"P-256\" },\n false,\n [\"sign\"],\n );\n return `${input}.${encode(new Uint8Array(await crypto.subtle.sign({ name: \"ECDSA\", hash: \"SHA-256\" }, key, new TextEncoder().encode(input))))}`;\n}\n\nexport type PortableRecord = {\n id: string;\n eventId: string;\n kind: \"decision\" | \"execution\" | \"outcome\";\n occurredAt: number;\n recordedAt: number;\n policyRevision: string | null;\n result: string;\n source: \"decision_service\" | \"customer_report\";\n receipt: string | null;\n};\nexport type EvidenceManifest = {\n version: 1;\n issuer: \"https://portal.chitmark.com\";\n purpose: \"historical_evidence\";\n tenantId: string;\n startAt: number;\n endAt: number;\n createdAt: number;\n sourceAsOf: number;\n timeBasis: \"issuer_and_ingestion_clocks_not_independent_time\";\n completeness: \"unknown\";\n gaps: string[];\n retention: {\n deleteAfter: number;\n recipient: string;\n exportedCopies: \"recipient_controlled\";\n redaction: \"minimized\";\n };\n records: PortableRecord[];\n};\nconst id = /^[A-Za-z0-9_.:/-]{1,160}$/;\nexport function validateManifest(value: EvidenceManifest, tenantId: string): void {\n evidenceAssert(\n Object.keys(value).sort().join(\",\") ===\n \"completeness,createdAt,endAt,gaps,issuer,purpose,records,retention,sourceAsOf,startAt,tenantId,timeBasis,version\" &&\n Object.keys(value.retention).sort().join(\",\") ===\n \"deleteAfter,exportedCopies,recipient,redaction\",\n \"unminimized_manifest\",\n );\n canonicalEvidence(value);\n evidenceAssert(\n value.version === 1 &&\n value.issuer === \"https://portal.chitmark.com\" &&\n value.purpose === \"historical_evidence\" &&\n value.tenantId === tenantId &&\n id.test(tenantId),\n \"wrong_bundle_scope\",\n );\n evidenceAssert(\n [\n value.startAt,\n value.endAt,\n value.createdAt,\n value.sourceAsOf,\n value.retention.deleteAfter,\n ].every(Number.isSafeInteger) &&\n value.startAt < value.endAt &&\n value.endAt <= value.sourceAsOf &&\n value.sourceAsOf <= value.createdAt &&\n value.createdAt < value.retention.deleteAfter,\n \"invalid_window\",\n );\n evidenceAssert(\n value.completeness === \"unknown\" &&\n value.timeBasis === \"issuer_and_ingestion_clocks_not_independent_time\" &&\n value.retention.redaction === \"minimized\" &&\n value.retention.exportedCopies === \"recipient_controlled\" &&\n id.test(value.retention.recipient) &&\n Array.isArray(value.gaps) &&\n value.gaps.every((gap) => id.test(gap)),\n \"invalid_manifest\",\n );\n evidenceAssert(\n Array.isArray(value.records) && value.records.length <= 10_000,\n \"record_limit\",\n );\n const seen = new Set<string>();\n for (const row of value.records) {\n evidenceAssert(\n Object.keys(row).sort().join(\",\") ===\n \"eventId,id,kind,occurredAt,policyRevision,receipt,recordedAt,result,source\",\n \"unminimized_record\",\n );\n evidenceAssert(\n id.test(row.id) &&\n id.test(row.eventId) &&\n [\"decision\", \"execution\", \"outcome\"].includes(row.kind) &&\n id.test(row.result) &&\n (row.policyRevision === null || id.test(row.policyRevision)) &&\n (row.receipt === null ||\n (typeof row.receipt === \"string\" && row.receipt.length <= 8192)),\n \"invalid_record\",\n );\n evidenceAssert(\n Number.isSafeInteger(row.occurredAt) &&\n Number.isSafeInteger(row.recordedAt) &&\n value.startAt <= row.occurredAt &&\n row.occurredAt < value.endAt &&\n row.recordedAt <= value.sourceAsOf &&\n row.recordedAt >= row.occurredAt &&\n row.source === (row.kind === \"decision\" ? \"decision_service\" : \"customer_report\"),\n \"invalid_provenance\",\n );\n const identity = `${row.kind}:${row.id}`;\n evidenceAssert(!seen.has(identity), \"duplicate_record\");\n seen.add(identity);\n }\n}\nexport type EvidenceBundle = { manifest: EvidenceManifest; signature: string };\nexport async function verifyEvidenceBundle(\n bundle: EvidenceBundle,\n options: {\n tenantId: string;\n recipient: string;\n trustedKeys: EvidenceKey[];\n now: number;\n },\n) {\n validateManifest(bundle.manifest, options.tenantId);\n evidenceAssert(\n bundle.manifest.retention.recipient === options.recipient,\n \"wrong_recipient\",\n );\n evidenceAssert(\n options.now < bundle.manifest.retention.deleteAfter &&\n options.now >= bundle.manifest.createdAt,\n \"retention_expired\",\n );\n const signed = await verifyEvidenceSignature(\n bundle.signature,\n \"chitmark-evidence+jwt\",\n options.trustedKeys,\n bundle.manifest.createdAt,\n );\n evidenceAssert(\n canonicalEvidence(signed) === canonicalEvidence(bundle.manifest),\n \"manifest_mismatch\",\n );\n const head = JSON.parse(\n new TextDecoder().decode(decode(bundle.signature.split(\".\")[0]!)),\n );\n evidenceAssert(\n evidenceKeyAt(options.trustedKeys, head.kid, bundle.manifest.createdAt)\n .compromisedAt === undefined,\n \"compromised_bundle_key\",\n );\n return {\n purpose: \"historical_evidence\" as const,\n executionAuthorized: false as const,\n integrity: \"valid\" as const,\n completeness: \"unknown\" as const,\n outcomeTruth: \"not_established\" as const,\n gaps: bundle.manifest.gaps,\n };\n}\n\n/** The witness is supplied by the caller from an independently retained checkpoint,\n * never taken from a bundle's own claims. Hash comparison binds the exact receipt. */\nexport async function verifyHistoricalReceipt(\n token: string,\n options: {\n tenantId: string;\n session: string;\n trustedKeys: EvidenceKey[];\n witness?: { tokenHash: string; observedAt: number };\n },\n) {\n evidenceAssert(\n typeof token === \"string\" && token.length <= 8192,\n \"malformed_signature\",\n );\n let claims: Record<string, unknown>, head: Record<string, unknown>;\n try {\n const parts = token.split(\".\");\n head = JSON.parse(new TextDecoder().decode(decode(parts[0]!)));\n claims = JSON.parse(new TextDecoder().decode(decode(parts[1]!)));\n } catch {\n throw new EvidenceError(\"malformed_signature\");\n }\n evidenceAssert(\n head.typ === \"JWT\" || head.typ === \"chitmark-action+jwt\",\n \"unsupported_profile\",\n );\n evidenceAssert(\n Number.isSafeInteger(claims.iat) &&\n Number.isSafeInteger(claims.exp) &&\n Number(claims.iat) < Number(claims.exp) &&\n Number(claims.exp) - Number(claims.iat) <= (head.typ === \"JWT\" ? 300 : 60),\n \"invalid_receipt_time\",\n );\n const at = Number(claims.iat);\n evidenceAssert(\n typeof claims.eventId === \"string\" && /^[A-Za-z0-9_-]{1,160}$/.test(claims.eventId),\n \"invalid_receipt_context\",\n );\n const trusted = evidenceKeyAt(options.trustedKeys, String(head.kid), at);\n claims = await verifyEvidenceSignature(\n token,\n String(head.typ),\n options.trustedKeys,\n at,\n );\n evidenceAssert(\n claims.tid === options.tenantId &&\n claims.sub === options.session &&\n claims.iss === \"https://api.chitmark.com\",\n \"wrong_receipt_scope\",\n );\n const witnessed =\n options.witness &&\n Number.isSafeInteger(options.witness.observedAt) &&\n options.witness.observedAt >= at &&\n options.witness.tokenHash === (await evidenceHash(token));\n const beforeCompromise =\n witnessed &&\n (trusted.compromisedAt === undefined ||\n options.witness!.observedAt < trusted.compromisedAt);\n return {\n purpose: \"historical_evidence\" as const,\n executionAuthorized: false as const,\n eventId: String(claims.eventId),\n policyRevision: typeof claims.policy === \"string\" ? claims.policy : null,\n timeIntegrity: beforeCompromise\n ? \"independently_checkpointed\"\n : trusted.compromisedAt !== undefined\n ? \"uncertain_after_compromise\"\n : \"self_asserted\",\n };\n}\n","import { canonicalEvidence, evidenceAssert, evidenceHash } from \"./evidence.js\";\n\nexport type EvidenceCheckpoint = {\n version: 1;\n tenantId: string;\n epoch: string;\n expiresAt: number;\n size: number;\n root: string;\n observedAt: number;\n};\nexport type Commitment = { id: string; salt: string; record: object; ingestedAt: number };\nconst hex = /^[a-f0-9]{64}$/;\nfunction scope(checkpoint: EvidenceCheckpoint, tenantId: string, now: number) {\n evidenceAssert(\n checkpoint.version === 1 &&\n checkpoint.tenantId === tenantId &&\n /^[A-Za-z0-9_-]{16,128}$/.test(checkpoint.epoch) &&\n Number.isSafeInteger(checkpoint.expiresAt) &&\n now < checkpoint.expiresAt &&\n Number.isSafeInteger(checkpoint.observedAt) &&\n checkpoint.observedAt <= now &&\n checkpoint.observedAt < checkpoint.expiresAt &&\n Number.isSafeInteger(checkpoint.size) &&\n checkpoint.size >= 0 &&\n checkpoint.size <= 10_000 &&\n hex.test(checkpoint.root),\n \"checkpoint_scope_or_expiry\",\n );\n}\nconst genesis = (cp: Pick<EvidenceCheckpoint, \"tenantId\" | \"epoch\" | \"expiresAt\">) =>\n evidenceHash(\n canonicalEvidence([\"chitmark-private-chain-v1\", cp.tenantId, cp.epoch, cp.expiresAt]),\n );\nexport const evidenceCommitment = (\n cp: Pick<EvidenceCheckpoint, \"tenantId\" | \"epoch\" | \"expiresAt\">,\n record: object,\n salt: string,\n) => {\n evidenceAssert(hex.test(salt), \"invalid_commitment_salt\");\n return evidenceHash(\n canonicalEvidence([\n \"chitmark-record-v1\",\n cp.tenantId,\n cp.epoch,\n cp.expiresAt,\n salt,\n record,\n ]),\n );\n};\nconst advance = (root: string, leaf: string, index: number) =>\n evidenceHash(canonicalEvidence([\"chitmark-append-v1\", index, root, leaf]));\n/** Bounded linear commitment proof, not a public transparency log or a minimal Merkle proof. */\nexport async function checkpointFromCommitments(input: {\n tenantId: string;\n epoch: string;\n expiresAt: number;\n observedAt: number;\n commitments: string[];\n}): Promise<EvidenceCheckpoint> {\n evidenceAssert(\n input.commitments.length <= 10_000 &&\n input.commitments.every((leaf) => hex.test(leaf)),\n \"invalid_commitments\",\n );\n let root = await genesis(input);\n for (let index = 0; index < input.commitments.length; index++)\n root = await advance(root, input.commitments[index]!, index);\n const cp: EvidenceCheckpoint = {\n version: 1,\n tenantId: input.tenantId,\n epoch: input.epoch,\n expiresAt: input.expiresAt,\n observedAt: input.observedAt,\n size: input.commitments.length,\n root,\n };\n scope(cp, input.tenantId, input.observedAt);\n return cp;\n}\nexport async function verifyCheckpointAppend(\n older: EvidenceCheckpoint,\n newer: EvidenceCheckpoint,\n appended: string[] | null,\n options: { tenantId: string; now: number },\n) {\n scope(older, options.tenantId, options.now);\n scope(newer, options.tenantId, options.now);\n if (older.size === 0)\n evidenceAssert(older.root === (await genesis(older)), \"invalid_empty_checkpoint\");\n evidenceAssert(\n older.epoch === newer.epoch &&\n older.expiresAt === newer.expiresAt &&\n older.observedAt <= newer.observedAt &&\n older.size <= newer.size,\n \"inconsistent_checkpoint\",\n );\n if (older.size === newer.size)\n evidenceAssert(older.root === newer.root, \"divergent_history\");\n if (appended === null)\n return { status: \"unavailable\" as const, completeness: \"unknown\" as const };\n evidenceAssert(\n appended.length === newer.size - older.size &&\n appended.every((leaf) => hex.test(leaf)),\n \"invalid_append_proof\",\n );\n let root = older.root;\n for (let index = 0; index < appended.length; index++)\n root = await advance(root, appended[index]!, older.size + index);\n evidenceAssert(root === newer.root, \"divergent_history\");\n return { status: \"consistent\" as const, completeness: \"unknown\" as const };\n}\nexport async function verifyCheckpointInclusion(\n checkpoint: EvidenceCheckpoint,\n proof: { index: number; record: object; salt: string; commitments: string[] } | null,\n options: { tenantId: string; now: number },\n) {\n scope(checkpoint, options.tenantId, options.now);\n if (!proof) return { status: \"unavailable\" as const, completeness: \"unknown\" as const };\n evidenceAssert(\n Number.isSafeInteger(proof.index) &&\n proof.index >= 0 &&\n proof.index < checkpoint.size &&\n proof.commitments.length === checkpoint.size,\n \"invalid_inclusion_proof\",\n );\n const rebuilt = await checkpointFromCommitments({\n ...checkpoint,\n commitments: proof.commitments,\n });\n evidenceAssert(\n rebuilt.root === checkpoint.root &&\n (await evidenceCommitment(checkpoint, proof.record, proof.salt)) ===\n proof.commitments[proof.index],\n \"changed_record\",\n );\n return { status: \"included\" as const, completeness: \"unknown\" as const };\n}\n"]}
1
+ {"version":3,"sources":["../src/attribution.ts","../src/credentials.ts","../src/errors.ts","../src/internal/constants.ts","../src/pii.ts","../src/internal/prepare.ts","../src/verify-token.ts","../src/client.ts","../src/charge.ts","../src/http-status.ts","../src/action-binding.ts","../src/trusted-ip.ts","../src/middleware/express.ts","../src/middleware/next.ts","../src/evidence.ts","../src/evidence-checkpoint.ts"],"names":["hex","out","id","encode","key"],"mappings":";AA8FO,SAAS,mBAAA,CAAoB,SAAoC,IAAA,EAAe;AACrF,EAAA,MAAM,EAAE,OAAA,EAAS,UAAA,EAAY,SAAS,OAAA,EAAS,OAAA,GAAU,MAAK,GAAI,OAAA;AAClE,EAAA,MAAM,UAAU,OAAA,CAAQ,OAAA;AACxB,EAAA,MAAM,MAAA,GACJ,OAAO,OAAA,CAAQ,GAAA,KAAQ,UAAA,GACnB,OAAA,CAAQ,GAAA,CAAI,sBAAsB,CAAA,GAClC,MAAA,CAAO,OAAA,CAAQ,OAAO,CAAA,CAAE,IAAA;AAAA,IACtB,CAAC,CAAC,IAAI,CAAA,KAAM,IAAA,CAAK,aAAY,KAAM;AAAA,MACjC,CAAC,CAAA;AACX,EAAA,IAAI,GAAA;AACJ,EAAA,IAAI,CAAC,OAAA,CAAQ,IAAA,IAAQ,OAAA,CAAQ,GAAA,EAAK;AAChC,IAAA,IAAI;AACF,MAAA,GAAA,GAAM,IAAI,GAAA,CAAI,OAAA,CAAQ,GAAG,CAAA;AAAA,IAC3B,CAAA,CAAA,MAAQ;AAAA,IAER;AAAA,EACF;AACA,EAAA,MAAM,OAAO,OAAA,CAAQ,IAAA,KAAS,KAAK,QAAA,KAAa,QAAA,GAAW,IAAI,MAAA,GAAS,MAAA,CAAA;AACxE,EAAA,MAAM,KAAA,GAAQ,UAAA,KAAe,IAAA,GAAO,UAAA,CAAW,MAAM,CAAA,GAAI,MAAA,CAAA;AACzD,EAAA,OAAO,EAAE,IAAA,EAAM,OAAA,EAAS,OAAA,EAAS,OAAA,EAAS,YAAY,KAAA,EAAM;AAC9D;AAEA,SAAS,WACP,MAAA,EAC6D;AAC7D,EAAA,IAAI,OAAO,MAAA,KAAW,QAAA,IAAY,MAAA,CAAO,SAAS,IAAA,EAAM;AACxD,EAAA,IAAI;AACF,IAAA,MAAM,KAAA,GAAQ,IAAA,CAAK,KAAA,CAAM,MAAM,CAAA;AAC/B,IAAA,IACE,CAAC,KAAA,IACD,OAAO,KAAA,CAAM,KAAA,KAAU,QAAA,IACvB,KAAA,CAAM,KAAA,CAAM,MAAA,GAAS,EAAA,IACrB,OAAO,KAAA,CAAM,QAAA,KAAa,YAC1B,CAAC,MAAA,CAAO,aAAA,CAAc,KAAA,CAAM,QAAQ,CAAA,IACpC,OAAO,KAAA,CAAM,SAAA,KAAc,QAAA,IAC3B,KAAA,CAAM,SAAA,CAAU,MAAA,GAAS,EAAA;AAEzB,MAAA;AACF,IAAA,MAAM,EAAE,KAAA,EAAO,QAAA,EAAU,SAAA,EAAU,GAAI,KAAA;AACvC,IAAA,IAAI,SAAS,KAAA,EAAO;AAClB,MAAA,MAAM,MAAM,KAAA,CAAM,QAAA;AAClB,MAAA,IACE,MAAM,GAAA,KAAQ,uBAAA,IACd,KAAK,GAAA,KAAQ,KAAA,IACb,IAAI,GAAA,KAAQ,SAAA,IACZ,OAAO,GAAA,CAAI,CAAA,KAAM,YACjB,GAAA,CAAI,CAAA,CAAE,WAAW,EAAA,IACjB,EAAE,OAAO,GAAA,CAAA,EACT;AACA,QAAA,OAAO;AAAA,UACL,KAAK,KAAA,CAAM,GAAA;AAAA,UACX,QAAA,EAAU,EAAE,GAAA,EAAK,GAAA,CAAI,GAAA,EAAK,KAAK,GAAA,CAAI,GAAA,EAAK,CAAA,EAAG,GAAA,CAAI,CAAA,EAAE;AAAA,UACjD,KAAA;AAAA,UACA,QAAA;AAAA,UACA;AAAA,SACF;AAAA,MACF;AACA,MAAA;AAAA,IACF;AACA,IAAA,IAAI,OAAO,KAAA,CAAM,MAAA,KAAW,QAAA,IAAY,KAAA,CAAM,OAAO,MAAA,IAAU,EAAA;AAC7D,MAAA,OAAO,EAAE,MAAA,EAAQ,KAAA,CAAM,MAAA,EAAQ,KAAA,EAAO,UAAU,SAAA,EAAU;AAAA,EAC9D,CAAA,CAAA,MAAQ;AAAA,EAER;AACA,EAAA,OAAO,MAAA;AACT;;;ACjJA,IAAM,MAAA,GAAS,CAAC,KAAA,KACd,IAAA,CAAK,OAAO,YAAA,CAAa,GAAG,KAAK,CAAC,CAAA,CAC/B,QAAQ,IAAA,EAAM,EAAE,EAChB,OAAA,CAAQ,KAAA,EAAO,GAAG,CAAA,CAClB,OAAA,CAAQ,OAAO,GAAG,CAAA;AACvB,IAAM,IAAA,GAAO,CAAC,KAAA,KAAmB,MAAA,CAAO,IAAI,WAAA,EAAY,CAAE,MAAA,CAAO,IAAA,CAAK,SAAA,CAAU,KAAK,CAAC,CAAC,CAAA;AACvF,eAAsB,iBAAA,CACpB,MACA,MAAA,EACY;AACZ,EAAA,MAAA,CAAO,cAAA,EAAe;AACtB,EAAA,IAAI,KAAA;AACJ,EAAA,MAAM,OAAA,GAAU,IAAI,OAAA,CAAe,CAAC,GAAG,MAAA,KAAW;AAChD,IAAA,KAAA,GAAQ,MAAM,MAAA,CAAO,IAAI,KAAA,CAAM,8BAA8B,CAAC,CAAA;AAC9D,IAAA,MAAA,CAAO,iBAAiB,OAAA,EAAS,KAAA,EAAO,EAAE,IAAA,EAAM,MAAM,CAAA;AAAA,EACxD,CAAC,CAAA;AACD,EAAA,IAAI;AACF,IAAA,OAAO,MAAM,OAAA,CAAQ,IAAA,CAAK,CAAC,IAAA,EAAM,OAAO,CAAC,CAAA;AAAA,EAC3C,CAAA,SAAE;AACA,IAAA,MAAA,CAAO,mBAAA,CAAoB,SAAS,KAAK,CAAA;AAAA,EAC3C;AACF;AACO,SAAS,6BAA6B,OAAA,EAMtB;AACrB,EAAA,MAAM,EAAE,UAAA,EAAY,SAAA,EAAU,GAAI,OAAA;AAClC,EAAA,IACE,SAAA,CAAU,CAAA,IACV,SAAA,CAAU,GAAA,KAAQ,IAAA,IAClB,SAAA,CAAU,GAAA,KAAQ,OAAA,IAClB,CAAC,SAAA,CAAU,CAAA,IACX,CAAC,SAAA,CAAU,CAAA;AAEX,IAAA,MAAM,IAAI,MAAM,kCAAkC,CAAA;AACpD,EAAA,MAAM,GAAA,GAAM,EAAE,GAAA,EAAK,IAAA,EAAM,GAAA,EAAK,OAAA,EAAS,CAAA,EAAG,SAAA,CAAU,CAAA,EAAG,CAAA,EAAG,SAAA,CAAU,CAAA,EAAE;AACtE,EAAA,IAAI,MAAA;AACJ,EAAA,IAAI,OAAA;AACJ,EAAA,MAAM,KAAA,GAAQ,CAAC,CAAA,KACb,CAAC,CAAC,CAAA,IACF,OAAO,CAAA,CAAE,WAAA,KAAgB,QAAA,IACzB,0BAAA,CAA2B,KAAK,CAAA,CAAE,WAAW,KAC7C,CAAC,CAAA,CAAE,WAAW,CAAA,CAAE,cAAA,EAAgB,CAAA,CAAE,oBAAoB,CAAA,CAAE,KAAA;AAAA,IACtD,CAAC,CAAA,KAAM,MAAA,CAAO,aAAA,CAAc,CAAC,KAAK,CAAA,GAAI,IAAA,CAAK,GAAA,EAAI,GAAI,GAAA,GAAO;AAAA,GAC5D;AACF,EAAA,OAAO;AAAA,IACL,MAAM,OAAA,CAAQ,EAAE,GAAA,EAAK,MAAA,EAAQ,QAAO,EAAG;AACrC,MAAA,MAAA,CAAO,cAAA,EAAe;AACtB,MAAA,MAAM,MAAA,GAAS,IAAI,GAAA,CAAI,GAAG,CAAA;AAC1B,MAAA,IAAI,MAAA,CAAO,QAAA,KAAa,QAAA,IAAY,MAAA,CAAO,YAAY,MAAA,CAAO,QAAA;AAC5D,QAAA,MAAM,IAAI,MAAM,qBAAqB,CAAA;AACvC,MAAA,IAAI,CAAC,KAAA,CAAM,MAAM,CAAA,EAAG;AAClB,QAAA,IAAI,CAAC,OAAA,EAAS;AACZ,UAAA,MAAM,aAAA,GAAgB,WAAA,CAAY,OAAA,CAAQ,OAAA,CAAQ,oBAAoB,GAAG,CAAA;AAGzE,UAAA,OAAA,GAAU,OAAA,CAAQ,OAAA,EAAQ,CACvB,IAAA,CAAK,MAAM,OAAA,CAAQ,IAAA,CAAK,aAAa,CAAC,CAAA,CACtC,IAAA,CAAK,CAAC,CAAA,KAAM;AACX,YAAA,IAAI,CAAC,MAAM,CAAC,CAAA,IAAK,cAAc,OAAA,EAAS,MAAM,IAAI,KAAA,CAAM,kBAAkB,CAAA;AAC1E,YAAA,MAAA,GAAS,EAAE,GAAG,CAAA,EAAE;AAChB,YAAA,OAAO,MAAA;AAAA,UACT,CAAC,CAAA,CACA,OAAA,CAAQ,MAAM;AACb,YAAA,OAAA,GAAU,MAAA;AAAA,UACZ,CAAC,CAAA;AAAA,QACL;AACA,QAAA,MAAM,iBAAA;AAAA,UACJ,OAAA;AAAA,UACA,WAAA,CAAY,GAAA,CAAI,CAAC,MAAA,EAAQ,WAAA,CAAY,QAAQ,OAAA,CAAQ,gBAAA,IAAoB,GAAG,CAAC,CAAC;AAAA,SAChF;AAAA,MACF;AACA,MAAA,IAAI,CAAC,KAAA,CAAM,MAAM,GAAG,MAAM,IAAI,MAAM,kBAAkB,CAAA;AACtD,MAAA,MAAM,UAAA,GAAa,MAAA;AACnB,MAAA,MAAM,QAAQ,UAAA,CAAW,WAAA;AACzB,MAAA,MAAM,GAAA,GAAM,MAAA;AAAA,QACV,IAAI,UAAA;AAAA,UACF,MAAM,MAAA,CAAO,MAAA,CAAO,MAAA,CAAO,SAAA,EAAW,IAAI,WAAA,EAAY,CAAE,MAAA,CAAO,KAAK,CAAC;AAAA;AACvE,OACF;AACA,MAAA,MAAM,UAAU,CAAA,EAAG,IAAA,CAAK,EAAE,GAAA,EAAK,UAAA,EAAY,KAAK,OAAA,EAAS,GAAA,EAAK,CAAC,IAAI,IAAA,CAAK,EAAE,KAAK,MAAA,CAAO,UAAA,IAAc,GAAA,EAAK,IAAA,CAAK,KAAA,CAAM,IAAA,CAAK,KAAI,GAAI,GAAI,GAAG,GAAA,EAAK,MAAA,CAAO,aAAY,EAAG,GAAA,EAAK,CAAA,EAAG,MAAA,CAAO,MAAM,CAAA,EAAG,MAAA,CAAO,QAAQ,CAAA,CAAA,EAAI,GAAA,EAAK,CAAC,CAAA,CAAA;AACpN,MAAA,MAAM,SAAA,GAAY,MAAM,MAAA,CAAO,MAAA,CAAO,IAAA;AAAA,QACpC,EAAE,IAAA,EAAM,OAAA,EAAS,IAAA,EAAM,SAAA,EAAU;AAAA,QACjC,UAAA;AAAA,QACA,IAAI,WAAA,EAAY,CAAE,MAAA,CAAO,OAAO;AAAA,OAClC;AACA,MAAA,MAAA,CAAO,cAAA,EAAe;AACtB,MAAA,IAAI,CAAC,KAAA,CAAM,UAAU,GAAG,MAAM,IAAI,MAAM,kBAAkB,CAAA;AAC1D,MAAA,OAAO;AAAA,QACL,aAAA,EAAe,QAAQ,KAAK,CAAA,CAAA;AAAA,QAC5B,IAAA,EAAM,GAAG,OAAO,CAAA,CAAA,EAAI,OAAO,IAAI,UAAA,CAAW,SAAS,CAAC,CAAC,CAAA;AAAA,OACvD;AAAA,IACF;AAAA,GACF;AACF;;;AC1GO,IAAM,aAAA,GAAN,cAA4B,KAAA,CAAM;AAAA,EAC9B,IAAA,GAAO,eAAA;AAAA,EACP,MAAA;AAAA,EACA,IAAA;AAAA,EACA,IAAA;AAAA,EAET,WAAA,CACE,SACA,OAAA,EACA;AACA,IAAA,KAAA,CAAM,OAAO,CAAA;AACb,IAAA,IAAA,CAAK,SAAS,OAAA,EAAS,MAAA;AACvB,IAAA,IAAA,CAAK,OAAO,OAAA,EAAS,IAAA;AACrB,IAAA,IAAA,CAAK,OAAO,OAAA,EAAS,IAAA;AAAA,EACvB;AACF;AAKO,IAAM,gBAAA,GAAN,cAA+B,aAAA,CAAc;AAAA,EACzC,IAAA,GAAO,kBAAA;AAAA,EAEhB,WAAA,CAAY,MAAA,EAAgB,IAAA,EAAkC,OAAA,EAAkB;AAC9E,IAAA,MAAM,GAAA,GACJ,OAAA,KACC,OAAO,IAAA,KAAS,QAAA,GACb,IAAA,GACA,IAAA,CAAK,OAAA,IAAW,IAAA,CAAK,KAAA,IAAS,CAAA,oBAAA,EAAuB,MAAM,CAAA,CAAA,CAAA,CAAA;AACjE,IAAA,KAAA,CAAM,GAAA,EAAK;AAAA,MACT,MAAA;AAAA,MACA,MAAM,OAAO,IAAA,KAAS,WAAY,IAAA,CAAK,IAAA,IAAQ,KAAK,KAAA,GAAS,MAAA;AAAA,MAC7D;AAAA,KACD,CAAA;AAAA,EACH;AACF;AAMO,SAAS,wBAAA,CAAyB,QAAgB,OAAA,EAA2B;AAClF,EAAA,OAAO;AAAA,IACL,QAAA,EAAU,WAAA;AAAA,IACV,SAAA,EAAW,SAAA;AAAA,IACX,UAAA,EAAY,CAAA;AAAA,IACZ,OAAA,EAAS,CAAC,MAAM,CAAA;AAAA,IAChB,SAAA,EAAW;AAAA,MACT,QAAA,EAAU,KAAA;AAAA,MACV,aAAA,EAAe,CAAC,UAAU;AAAA,KAC5B;AAAA,IACA,YAAA,EAAc,EAAA;AAAA,IACd,OAAA,EAAS,CAAA,aAAA,EAAgB,OAAA,IAAW,SAAS,CAAA,CAAA;AAAA,IAC7C,QAAA,EAAU,IAAA;AAAA,IACV,eAAA,EAAiB;AAAA,GACnB;AACF;AAKO,SAAS,0BAA0B,OAAA,EAA2B;AACnE,EAAA,IAAI,OAAA,CAAQ,QAAA,IAAY,OAAA,CAAQ,QAAA,KAAa,OAAA,EAAS;AACpD,IAAA,OAAO;AAAA,MACL,GAAG,OAAA;AAAA,MACH,QAAA,EAAU,WAAA;AAAA,MACV,OAAA,EAAS;AAAA,QACP,GAAG,OAAA,CAAQ,OAAA;AAAA,QACX;AAAA;AACF,KACF;AAAA,EACF;AACA,EAAA,OAAO,OAAA;AACT;;;AC5EO,IAAM,iBAAA,GAAiD;AAAA,EAC5D,UAAA,EAAY,0BAAA;AAAA,EACZ,OAAA,EAAS,kCAAA;AAAA,EACT,WAAA,EAAa;AACf,CAAA;AAEO,IAAM,kBAAA,GAAqB,GAAA;AAE3B,IAAM,gBAAA,GAAmB,GAAA;AAEzB,IAAM,WAAA,GAAc,OAAA;AAGpB,SAAS,iBAAiB,OAAA,EAAyB;AACxD,EAAA,IAAI;AACF,IAAA,MAAM,IAAA,GAAO,IAAI,GAAA,CAAI,OAAO,CAAA,CAAE,SAAS,OAAA,CAAQ,UAAA,EAAY,EAAE,CAAA,CAAE,WAAA,EAAY;AAC3E,IAAA,OAAO,IAAA,KAAS,WAAA,IACd,IAAA,CAAK,QAAA,CAAS,YAAY,CAAA,IAC1B,IAAA,KAAS,WAAA,IACT,IAAA,KAAS,SAAA,IACT,IAAA,KAAS,KAAA,GACP,gBAAA,GACA,kBAAA;AAAA,EACN,CAAA,CAAA,MAAQ;AACN,IAAA,OAAO,kBAAA;AAAA,EACT;AACF;AAEO,SAAS,cAAA,CACd,GAAA,GAAmB,YAAA,EACnB,OAAA,EACQ;AACR,EAAA,OAAA,CAAQ,WAAW,iBAAA,CAAkB,GAAG,CAAA,EAAG,OAAA,CAAQ,OAAO,EAAE,CAAA;AAC9D;AAMO,SAAS,UAAA,GAAiC;AAC/C,EAAA,IAAI,OAAO,OAAA,KAAY,WAAA,EAAa,OAAO,MAAA;AAC3C,EAAA,MAAM,KAAA,GAAQ,QAAQ,GAAA,EAAK,iBAAA;AAC3B,EAAA,OAAO,KAAA,GAAQ,KAAA,CAAM,IAAA,EAAK,GAAI,MAAA;AAChC;;;ACpCA,eAAsB,gBAAgB,KAAA,EAAgC;AACpE,EAAA,MAAM,UAAA,GAAa,KAAA,CAAM,IAAA,EAAK,CAAE,WAAA,EAAY;AAC5C,EAAA,MAAM,IAAA,GAAO,IAAI,WAAA,EAAY,CAAE,OAAO,UAAU,CAAA;AAChD,EAAA,MAAM,SAAS,MAAM,MAAA,CAAO,MAAA,CAAO,MAAA,CAAO,WAAW,IAAI,CAAA;AACzD,EAAA,OAAO,YAAY,MAAM,CAAA;AAC3B;AAKO,SAAS,WAAW,EAAA,EAAoB;AAC7C,EAAA,MAAM,OAAA,GAAU,GAAG,IAAA,EAAK;AAExB,EAAA,MAAM,KAAA,GAAQ,QAAQ,KAAA,CAAM,GAAG,EAAE,CAAC,CAAA,EAAG,MAAK,IAAK,OAAA;AAC/C,EAAA,IAAI,KAAA,CAAM,SAAS,GAAG,CAAA,IAAK,CAAC,KAAA,CAAM,QAAA,CAAS,GAAG,CAAA,EAAG;AAC/C,IAAA,MAAM,KAAA,GAAQ,KAAA,CAAM,KAAA,CAAM,GAAG,CAAA;AAC7B,IAAA,IAAI,KAAA,CAAM,WAAW,CAAA,EAAG;AACtB,MAAA,OAAO,CAAA,EAAG,KAAA,CAAM,CAAC,CAAC,CAAA,CAAA,EAAI,KAAA,CAAM,CAAC,CAAC,CAAA,CAAA,EAAI,KAAA,CAAM,CAAC,CAAC,CAAA,KAAA,CAAA;AAAA,IAC5C;AAAA,EACF;AAEA,EAAA,IAAI,KAAA,CAAM,QAAA,CAAS,GAAG,CAAA,EAAG;AACvB,IAAA,MAAM,UAAU,KAAA,CAAM,KAAA,CAAM,GAAG,CAAA,CAAE,OAAO,OAAO,CAAA;AAC/C,IAAA,MAAM,OAAO,OAAA,CAAQ,KAAA,CAAM,GAAG,CAAC,CAAA,CAAE,KAAK,GAAG,CAAA;AACzC,IAAA,OAAO,GAAG,IAAI,CAAA,KAAA,CAAA;AAAA,EAChB;AACA,EAAA,OAAO,KAAA;AACT;AAMO,SAAS,iBACd,QAAA,EACqC;AACrC,EAAA,IAAI,CAAC,UAAU,OAAO,MAAA;AACtB,EAAA,MAAM,OAAA,uBAAc,GAAA,CAAI;AAAA,IACtB,eAAA;AAAA,IACA,gBAAA;AAAA,IACA,QAAA;AAAA,IACA,MAAA;AAAA,IACA,UAAA;AAAA,IACA,YAAA;AAAA,IACA,YAAA;AAAA,IACA;AAAA,GACD,CAAA;AACD,EAAA,MAAM,MAA+B,EAAC;AACtC,EAAA,KAAA,MAAW,CAAC,GAAA,EAAK,KAAK,KAAK,MAAA,CAAO,OAAA,CAAQ,QAAQ,CAAA,EAAG;AACnD,IAAA,IAAI,OAAA,CAAQ,GAAA,CAAI,GAAG,CAAA,IAAK,SAAS,IAAA,EAAM;AACrC,MAAA,GAAA,CAAI,GAAG,CAAA,GAAI,KAAA;AAAA,IACb;AAAA,EACF;AACA,EAAA,OAAO,OAAO,IAAA,CAAK,GAAG,CAAA,CAAE,MAAA,GAAS,IAAI,GAAA,GAAM,MAAA;AAC7C;AAEA,SAAS,YAAY,MAAA,EAA6B;AAChD,EAAA,MAAM,KAAA,GAAQ,IAAI,UAAA,CAAW,MAAM,CAAA;AACnC,EAAA,IAAIA,IAAAA,GAAM,EAAA;AACV,EAAA,KAAA,MAAW,KAAK,KAAA,EAAO;AACrB,IAAAA,QAAO,CAAA,CAAE,QAAA,CAAS,EAAE,CAAA,CAAE,QAAA,CAAS,GAAG,GAAG,CAAA;AAAA,EACvC;AACA,EAAA,OAAOA,IAAAA;AACT;;;AClEA,eAAsB,cAAA,CACpB,SACA,OAAA,EACkB;AAClB,EAAA,IAAI,YAAY,KAAA,EAAO;AACrB,IAAA,OAAO,OAAA;AAAA,EACT;AAEA,EAAA,IAAI,YAAY,MAAA,EAAQ;AACtB,IAAA,OAAO;AAAA,MACL,WAAW,OAAA,CAAQ,SAAA;AAAA,MACnB,OAAA,EAAS,qBAAA,CAAsB,OAAA,CAAQ,OAAO;AAAA,KAChD;AAAA,EACF;AAGA,EAAA,MAAM,QAAA,GAAoB;AAAA,IACxB,WAAW,OAAA,CAAQ,SAAA;AAAA,IACnB,SAAS,OAAA,CAAQ;AAAA,GACnB;AAEA,EAAA,IAAI,QAAQ,WAAA,EAAa;AACvB,IAAA,QAAA,CAAS,cAAc,OAAA,CAAQ,WAAA;AAAA,EACjC,CAAA,MAAA,IAAW,QAAQ,KAAA,EAAO;AACxB,IAAA,QAAA,CAAS,WAAA,GAAc,MAAM,eAAA,CAAgB,OAAA,CAAQ,KAAK,CAAA;AAAA,EAC5D;AAEA,EAAA,IAAI,QAAQ,OAAA,EAAS;AACnB,IAAA,QAAA,CAAS,UAAU,OAAA,CAAQ,OAAA;AAAA,EAC7B,CAAA,MAAA,IAAW,QAAQ,EAAA,EAAI;AACrB,IAAA,QAAA,CAAS,OAAA,GAAU,UAAA,CAAW,OAAA,CAAQ,EAAE,CAAA;AAAA,EAC1C;AAEA,EAAA,MAAM,UAAA,GAAa,OAAA,CAAQ,cAAA,IAAkB,gBAAA,CAAiB,QAAQ,QAAQ,CAAA;AAC9E,EAAA,IAAI,UAAA,EAAY;AACd,IAAA,QAAA,CAAS,cAAA,GAAiB,UAAA;AAAA,EAC5B;AAEA,EAAA,OAAO,QAAA;AACT;AAEA,SAAS,sBACP,OAAA,EACoC;AACpC,EAAA,IAAI,CAAC,SAAS,OAAO,MAAA;AACrB,EAAA,MAAM,IAAA,GAAO,CAAC,iBAAA,EAAmB,iBAAA,EAAmB,WAAW,CAAA;AAC/D,EAAA,MAAM,MAA8B,EAAC;AACrC,EAAA,KAAA,MAAW,CAAC,CAAA,EAAG,CAAC,KAAK,MAAA,CAAO,OAAA,CAAQ,OAAO,CAAA,EAAG;AAC5C,IAAA,MAAM,KAAA,GAAQ,EAAE,WAAA,EAAY;AAC5B,IAAA,IAAI,KAAK,QAAA,CAAS,KAAK,CAAA,IAAK,OAAO,MAAM,QAAA,EAAU;AACjD,MAAA,GAAA,CAAI,KAAK,CAAA,GAAI,CAAA;AAAA,IACf,CAAA,MAAA,IAAW,IAAA,CAAK,QAAA,CAAS,KAAK,CAAA,IAAK,KAAA,CAAM,OAAA,CAAQ,CAAC,CAAA,IAAK,CAAA,CAAE,CAAC,CAAA,EAAG;AAC3D,MAAA,GAAA,CAAI,KAAK,CAAA,GAAI,CAAA,CAAE,CAAC,CAAA;AAAA,IAClB;AAAA,EACF;AACA,EAAA,OAAO,OAAO,IAAA,CAAK,GAAG,CAAA,CAAE,MAAA,GAAS,IAAI,GAAA,GAAM,MAAA;AAC7C;AAKO,SAAS,eACd,OAAA,EACoC;AACpC,EAAA,IAAI,CAAC,SAAS,OAAO,MAAA;AACrB,EAAA,IAAI,mBAAmB,OAAA,EAAS;AAC9B,IAAA,MAAMC,OAA8B,EAAC;AACrC,IAAA,OAAA,CAAQ,OAAA,CAAQ,CAAC,KAAA,EAAO,GAAA,KAAQ;AAC9B,MAAAA,IAAAA,CAAI,GAAA,CAAI,WAAA,EAAa,CAAA,GAAI,KAAA;AAAA,IAC3B,CAAC,CAAA;AACD,IAAA,OAAOA,IAAAA;AAAA,EACT;AACA,EAAA,MAAM,MAA8B,EAAC;AACrC,EAAA,KAAA,MAAW,CAAC,CAAA,EAAG,CAAC,KAAK,MAAA,CAAO,OAAA,CAAQ,OAAO,CAAA,EAAG;AAC5C,IAAA,IAAI,OAAO,CAAA,KAAM,QAAA,MAAc,CAAA,CAAE,WAAA,EAAa,CAAA,GAAI,CAAA;AAAA,SAAA,IACzC,KAAA,CAAM,OAAA,CAAQ,CAAC,CAAA,IAAK,CAAA,CAAE,CAAC,CAAA,EAAG,GAAA,CAAI,CAAA,CAAE,WAAA,EAAa,CAAA,GAAI,EAAE,CAAC,CAAA;AAAA,EAC/D;AACA,EAAA,OAAO,GAAA;AACT;;;ACtDO,IAAM,oBAAA,GAAuB;AAmC7B,IAAM,iBAAA,GAAN,cAAgC,aAAA,CAAc;AAAA,EAC1C,IAAA,GAAO,mBAAA;AAAA,EAEhB,WAAA,CAAY,MAA6B,OAAA,EAAiB;AACxD,IAAA,KAAA,CAAM,OAAA,EAAS,EAAE,IAAA,EAAM,CAAA;AAAA,EACzB;AACF;AA+BA,IAAM,gBAAA,GAAmB,gDAAA;AACzB,IAAM,sBAAA,GAAyB,EAAA;AAQ/B,eAAsB,kBAAA,CACpB,OACA,OAAA,EAC6B;AAC7B,EAAA,OAAO,aAAA,CAAc,KAAA,EAAO,OAAA,EAAS,KAAK,CAAA;AAC5C;AAGO,IAAM,yBAAA,GAA4B;AAAA,EACvC,SAAA;AAAA,EACA,aAAA;AAAA,EACA,mBAAA;AAAA,EACA,mBAAA;AAAA,EACA,uBAAA;AAAA,EACA,yBAAA;AAAA,EACA,aAAA;AAAA,EACA,kBAAA;AAAA,EACA,gBAAA;AAAA,EACA,eAAA;AAAA,EACA,mBAAA;AAAA,EACA,cAAA;AAAA,EACA,kBAAA;AAAA,EACA,gBAAA;AAAA,EACA;AACF;AA8BA,eAAsB,mBAAA,CACpB,OACA,OAAA,EAC8B;AAC9B,EAAA,MAAM,SAAU,MAAM,aAAA;AAAA,IACpB,KAAA;AAAA,IACA;AAAA,MACE,GAAG,OAAA;AAAA,MACH,KAAK,OAAA,CAAQ,QAAA;AAAA,MACb,MAAA,EAAQ,oBAAA;AAAA,MACR,aAAA,EAAe;AAAA,KACjB;AAAA,IACA;AAAA,GACF;AACA,EAAA,MAAM,GAAA,GAAM,KAAK,KAAA,CAAA,CAAO,OAAA,CAAQ,SAAS,IAAA,CAAK,GAAA,MAAS,GAAI,CAAA;AAC3D,EAAA,IACE,CAAC,OAAA,CAAQ,QAAA,IACT,CAAC,OAAA,CAAQ,OAAA,IACT,CAAC,OAAA,CAAQ,QAAA,IACT,CAAC,OAAA,CAAQ,MAAA,IACT,CAAC,gBAAA,CAAiB,IAAA,CAAK,OAAA,CAAQ,MAAM,CAAA,IACrC,EAAE,OAAA,CAAQ,MAAA,KAAW,kBAAA,GACjB,OAAA,CAAQ,KAAA,KAAU,MAAA,IAAU,OAAA,CAAQ,KAAA,KAAU,YAAA,GAC7C,yBAAA,CAAgD,SAAS,OAAA,CAAQ,MAAM,CAAA,IACxE,OAAA,CAAQ,KAAA,KAAU,gBAAA,IAClB,OAAO,OAAA,CAAQ,OAAA,KAAY,QAAA,IAC3B,wBAAA,CAAyB,IAAA,CAAK,OAAA,CAAQ,OAAO,CAAA,IAC7C,MAAA,CAAO,OAAA,KAAY,OAAA,CAAQ,OAAA,CAAA,IAC/B,MAAA,CAAO,MAAA,KAAW,OAAA,CAAQ,MAAA,IACzB,OAAA,CAAQ,WAAA,KAAgB,MAAA,IAAU,OAAA,CAAQ,WAAA,KAAgB,MAAA,IAC3D,MAAA,CAAO,gBAAgB,OAAA,CAAQ,WAAA,IAC/B,CAAC,OAAA,CAAQ,OAAA,IACT,MAAA,CAAO,OAAA,KAAY,OAAA,CAAQ,OAAA,IAC3B,MAAA,CAAO,MAAA,KAAW,OAAA,CAAQ,MAAA,IAC1B,MAAA,CAAO,MAAA,KAAW,OAAA,CAAQ,MAAA,IAC1B,MAAA,CAAO,KAAA,KAAU,OAAA,CAAQ,KAAA,IACzB,MAAA,CAAO,eAAA,KAAoB,SAAA,IAC3B,MAAA,CAAO,QAAA,KAAa,OAAA,IACpB,MAAA,CAAO,QAAA,KAAa,KAAA,IACpB,OAAO,MAAA,CAAO,OAAA,KAAY,QAAA,IAC1B,CAAC,MAAA,CAAO,OAAA,IACR,CAAC,MAAA,CAAO,aAAA,CAAc,MAAA,CAAO,GAAG,CAAA,IAChC,CAAC,MAAA,CAAO,aAAA,CAAc,MAAA,CAAO,GAAG,CAAA,IAChC,MAAA,CAAO,GAAA,GAAM,GAAA,IACb,MAAA,CAAO,GAAA,IAAO,GAAA,IACd,MAAA,CAAO,GAAA,GAAM,MAAA,CAAO,GAAA,KAAQ,EAAA,EAC5B;AACA,IAAA,MAAM,IAAI,iBAAA;AAAA,MACR,sBAAA;AAAA,MACA;AAAA,KACF;AAAA,EACF;AACA,EAAA,OAAO,MAAA;AACT;AAEA,eAAe,aAAA,CACb,KAAA,EACA,OAAA,EACA,YAAA,EAC6B;AAC7B,EAAA,MAAM,KAAA,GAAQ,OAAA,CAAQ,KAAA,IAAS,IAAA,CAAK,GAAA,EAAI;AACxC,EAAA,MAAM,aAAA,GAAgB,QAAQ,aAAA,IAAiB,sBAAA;AAE/C,EAAA,MAAM,KAAA,GAAQ,KAAA,CAAM,KAAA,CAAM,GAAG,CAAA;AAC7B,EAAA,IAAI,KAAA,CAAM,WAAW,CAAA,EAAG;AACtB,IAAA,MAAM,IAAI,iBAAA,CAAkB,iBAAA,EAAmB,4BAA4B,CAAA;AAAA,EAC7E;AACA,EAAA,MAAM,CAAC,SAAA,EAAW,UAAA,EAAY,YAAY,CAAA,GAAI,KAAA;AAE9C,EAAA,IAAI,MAAA;AACJ,EAAA,IAAI,OAAA;AACJ,EAAA,IAAI;AACF,IAAA,MAAA,GAAS,IAAA,CAAK,KAAA,CAAM,eAAA,CAAgB,SAAS,CAAC,CAAA;AAC9C,IAAA,OAAA,GAAU,IAAA,CAAK,KAAA,CAAM,eAAA,CAAgB,UAAU,CAAC,CAAA;AAAA,EAClD,CAAA,CAAA,MAAQ;AACN,IAAA,MAAM,IAAI,iBAAA,CAAkB,iBAAA,EAAmB,oCAAoC,CAAA;AAAA,EACrF;AAEA,EAAA,IAAI,MAAA,CAAO,KAAK,CAAA,KAAM,OAAA,EAAS;AAC7B,IAAA,MAAM,IAAI,iBAAA;AAAA,MACR,iBAAA;AAAA,MACA,CAAA,iCAAA,EAAoC,MAAA,CAAO,MAAA,CAAO,KAAK,CAAC,CAAC,CAAA;AAAA,KAC3D;AAAA,EACF;AAGA,EAAA,IAAI,MAAA,CAAO,KAAK,CAAA,KAAM,YAAA,EAAc;AAClC,IAAA,MAAM,IAAI,iBAAA;AAAA,MACR,YAAA;AAAA,MACA,+BAA+B,YAAY,CAAA,MAAA,EAAS,OAAO,MAAA,CAAO,KAAK,CAAC,CAAC,CAAA;AAAA,KAC3E;AAAA,EACF;AACA,EAAA,MAAM,GAAA,GAAM,OAAO,MAAA,CAAO,KAAK,MAAM,QAAA,GAAW,MAAA,CAAO,KAAK,CAAA,GAAI,EAAA;AAChE,EAAA,IAAI,CAAC,GAAA,EAAK;AACR,IAAA,MAAM,IAAI,iBAAA,CAAkB,aAAA,EAAe,6BAA6B,CAAA;AAAA,EAC1E;AAEA,EAAA,MAAM,GAAA,GAAM,OAAO,OAAA,CAAQ,KAAK,MAAM,QAAA,GAAW,OAAA,CAAQ,KAAK,CAAA,GAAI,GAAA;AAClE,EAAA,MAAM,GAAA,GAAM,OAAO,OAAA,CAAQ,KAAK,MAAM,QAAA,GAAW,OAAA,CAAQ,KAAK,CAAA,GAAI,GAAA;AAClE,EAAA,MAAM,UAAA,GAAa,IAAA,CAAK,KAAA,CAAM,KAAA,GAAQ,GAAI,CAAA;AAC1C,EAAA,IAAI,OAAO,QAAA,CAAS,GAAG,CAAA,IAAK,GAAA,GAAM,aAAa,aAAA,EAAe;AAC5D,IAAA,MAAM,IAAI,iBAAA,CAAkB,SAAA,EAAW,0BAA0B,CAAA;AAAA,EACnE;AACA,EAAA,IAAI,OAAO,QAAA,CAAS,GAAG,CAAA,IAAK,GAAA,GAAM,aAAa,aAAA,EAAe;AAC5D,IAAA,MAAM,IAAI,iBAAA,CAAkB,eAAA,EAAiB,mCAAmC,CAAA;AAAA,EAClF;AAEA,EAAA,MAAM,cAAA,GAAiB,QAAQ,MAAA,IAAU,oBAAA;AACzC,EAAA,IAAI,OAAA,CAAQ,KAAK,CAAA,KAAM,cAAA,EAAgB;AACrC,IAAA,MAAM,IAAI,iBAAA;AAAA,MACR,cAAA;AAAA,MACA;AAAA,KACF;AAAA,EACF;AACA,EAAA,IAAI,OAAA,CAAQ,KAAK,CAAA,KAAM,OAAA,CAAQ,OAAA,EAAS;AACtC,IAAA,MAAM,IAAI,iBAAA;AAAA,MACR,eAAA;AAAA,MACA;AAAA,KACF;AAAA,EACF;AACA,EAAA,IAAI,OAAA,CAAQ,KAAK,CAAA,KAAM,OAAA,CAAQ,QAAA,EAAU;AACvC,IAAA,MAAM,IAAI,iBAAA;AAAA,MACR,cAAA;AAAA,MACA;AAAA,KACF;AAAA,EACF;AACA,EAAA,MAAM,cAAc,OAAA,CAAQ,GAAA;AAC5B,EAAA,IAAI,WAAA,KAAgB,MAAA,IAAa,OAAA,CAAQ,KAAK,MAAM,WAAA,EAAa;AAC/D,IAAA,MAAM,IAAI,iBAAA;AAAA,MACR,WAAA;AAAA,MACA;AAAA,KACF;AAAA,EACF;AAEA,EAAA,MAAM,GAAA,GAAM,MAAM,OAAA,CAAQ,GAAA,EAAK,OAAO,CAAA;AACtC,EAAA,IAAI,CAAC,GAAA,EAAK;AACR,IAAA,MAAM,IAAI,iBAAA,CAAkB,aAAA,EAAe,CAAA,wBAAA,EAA2B,GAAG,CAAA,CAAE,CAAA;AAAA,EAC7E;AAEA,EAAA,IACE,GAAA,CAAI,KAAK,CAAA,KAAM,IAAA,IACf,IAAI,KAAK,CAAA,KAAM,OAAA,IACd,GAAA,CAAI,KAAK,CAAA,KAAM,MAAA,IAAa,GAAA,CAAI,KAAK,MAAM,OAAA,EAC5C;AACA,IAAA,MAAM,IAAI,iBAAA;AAAA,MACR,iBAAA;AAAA,MACA;AAAA,KACF;AAAA,EACF;AAEA,EAAA,IAAI,SAAA;AACJ,EAAA,IAAI;AACF,IAAA,SAAA,GAAY,MAAM,OAAO,MAAA,CAAO,SAAA;AAAA,MAC9B,KAAA;AAAA,MACA,GAAA;AAAA,MACA,EAAE,IAAA,EAAM,OAAA,EAAS,UAAA,EAAY,OAAA,EAAQ;AAAA,MACrC,KAAA;AAAA,MACA,CAAC,QAAQ;AAAA,KACX;AAAA,EACF,CAAA,CAAA,MAAQ;AACN,IAAA,MAAM,IAAI,iBAAA;AAAA,MACR,mBAAA;AAAA,MACA;AAAA,KACF;AAAA,EACF;AAEA,EAAA,MAAM,cAAA,GAAiB,qBAAqB,YAAY,CAAA;AACxD,EAAA,MAAM,eAAA,GAAkB,IAAI,WAAA,CAAY,cAAA,CAAe,UAAU,CAAA;AACjE,EAAA,IAAI,UAAA,CAAW,eAAe,CAAA,CAAE,GAAA,CAAI,cAAc,CAAA;AAElD,EAAA,MAAM,KAAA,GAAQ,MAAM,MAAA,CAAO,MAAA,CAAO,MAAA;AAAA,IAChC,EAAE,IAAA,EAAM,OAAA,EAAS,IAAA,EAAM,SAAA,EAAU;AAAA,IACjC,SAAA;AAAA,IACA,eAAA;AAAA,IACA,IAAI,aAAY,CAAE,MAAA,CAAO,GAAG,SAAS,CAAA,CAAA,EAAI,UAAU,CAAA,CAAE;AAAA,GACvD;AACA,EAAA,IAAI,CAAC,KAAA,EAAO;AACV,IAAA,MAAM,IAAI,iBAAA;AAAA,MACR,mBAAA;AAAA,MACA;AAAA,KACF;AAAA,EACF;AAEA,EAAA,OAAO,OAAA;AACT;AAEA,eAAe,OAAA,CACb,KACA,OAAA,EAC8C;AAC9C,EAAA,IAAI,OAAO,OAAA,CAAQ,IAAA;AACnB,EAAA,IAAI,CAAC,IAAA,EAAM;AACT,IAAA,MAAM,OAAA,GAAU,QAAQ,OAAA,IAAW,gBAAA;AACnC,IAAA,IAAI;AACF,MAAA,MAAM,YAAY,OAAA,CAAQ,KAAA,IAAS,UAAA,CAAW,KAAA,CAAM,KAAK,UAAU,CAAA;AACnE,MAAA,MAAM,GAAA,GAAM,MAAM,SAAA,CAAU,OAAO,CAAA;AACnC,MAAA,IAAI,CAAC,IAAI,EAAA,EAAI;AACX,QAAA,MAAM,IAAI,KAAA,CAAM,CAAA,uBAAA,EAA0B,GAAA,CAAI,MAAM,CAAA,CAAE,CAAA;AAAA,MACxD;AACA,MAAA,IAAA,GAAQ,MAAM,IAAI,IAAA,EAAK;AAAA,IACzB,SAAS,GAAA,EAAK;AACZ,MAAA,MAAM,IAAI,iBAAA;AAAA,QACR,kBAAA;AAAA,QACA,4BAA4B,OAAO,CAAA,EAAA,EACjC,eAAe,KAAA,GAAQ,GAAA,CAAI,UAAU,eACvC,CAAA;AAAA,OACF;AAAA,IACF;AAAA,EACF;AACA,EAAA,IAAI,CAAC,KAAA,CAAM,OAAA,CAAQ,IAAA,CAAK,IAAI,CAAA,EAAG;AAC7B,IAAA,MAAM,IAAI,iBAAA,CAAkB,kBAAA,EAAoB,iCAAiC,CAAA;AAAA,EACnF;AACA,EAAA,OAAO,IAAA,CAAK,KAAK,IAAA,CAAK,CAAC,QAAQ,GAAA,CAAI,KAAK,MAAM,GAAG,CAAA;AACnD;AAEA,SAAS,gBAAgB,KAAA,EAAuB;AAC9C,EAAA,MAAM,UAAA,GAAa,MAAM,OAAA,CAAQ,IAAA,EAAM,GAAG,CAAA,CAAE,OAAA,CAAQ,MAAM,GAAG,CAAA;AAC7D,EAAA,MAAM,MAAA,GAAS,aAAa,GAAA,CAAI,MAAA,CAAA,CAAQ,IAAK,UAAA,CAAW,MAAA,GAAS,KAAM,CAAC,CAAA;AACxE,EAAA,MAAM,MAAA,GAAS,KAAK,MAAM,CAAA;AAC1B,EAAA,OAAO,IAAI,WAAA,EAAY,CAAE,MAAA,CAAO,UAAA,CAAW,IAAA,CAAK,MAAA,EAAQ,CAAC,EAAA,KAAO,EAAA,CAAG,UAAA,CAAW,CAAC,CAAC,CAAC,CAAA;AACnF;AAEA,SAAS,qBAAqB,KAAA,EAA2B;AACvD,EAAA,MAAM,UAAA,GAAa,MAAM,OAAA,CAAQ,IAAA,EAAM,GAAG,CAAA,CAAE,OAAA,CAAQ,MAAM,GAAG,CAAA;AAC7D,EAAA,MAAM,MAAA,GAAS,aAAa,GAAA,CAAI,MAAA,CAAA,CAAQ,IAAK,UAAA,CAAW,MAAA,GAAS,KAAM,CAAC,CAAA;AACxE,EAAA,MAAM,MAAA,GAAS,KAAK,MAAM,CAAA;AAC1B,EAAA,MAAM,GAAA,GAAM,IAAI,UAAA,CAAW,MAAA,CAAO,MAAM,CAAA;AACxC,EAAA,KAAA,IAAS,CAAA,GAAI,CAAA,EAAG,CAAA,GAAI,MAAA,CAAO,MAAA,EAAQ,CAAA,IAAK,CAAA,EAAG,GAAA,CAAI,CAAC,CAAA,GAAI,MAAA,CAAO,UAAA,CAAW,CAAC,CAAA;AACvE,EAAA,OAAO,GAAA;AACT;;;AClVO,IAAM,WAAN,MAAe;AAAA,EACX,WAAA,GAAc;AAAA,IACrB,OAAA,EAAS,CAAC,KAAA,KACR,IAAA,CAAK,QAAQ,0BAAA,EAA4B;AAAA,MACvC,MAAA,EAAQ,MAAA;AAAA,MACR,IAAA,EAAM,mBAAA,CAAoB,KAAA,EAAO,IAAA,CAAK,OAAO,CAAA;AAAA,MAC7C,gBAAgB,KAAA,CAAM;AAAA,KACvB,CAAA;AAAA,IACH,GAAA,EAAK,CAACC,GAAAA,KACJ,IAAA,CAAK,OAAA,CAAQ,CAAA,iBAAA,EAAoB,kBAAA,CAAmBA,GAAE,CAAC,CAAA,CAAA,EAAI,EAAE,MAAA,EAAQ,OAAO,CAAA;AAAA,IAC9E,UAAA,EAAY,CACV,KAAA,EAIA,cAAA,KAEA,IAAA,CAAK,OAAA,CAAQ,oBAAA,EAAsB,EAAE,MAAA,EAAQ,MAAA,EAAQ,IAAA,EAAM,KAAA,EAAO,gBAAgB,CAAA;AAAA,IACpF,UAAA,EAAY,CAACA,GAAAA,KACX,IAAA,CAAK,OAAA,CAAQ,CAAA,mBAAA,EAAsB,kBAAA,CAAmBA,GAAE,CAAC,CAAA,CAAA,EAAI,EAAE,MAAA,EAAQ,UAAU;AAAA,GACrF;AAAA;AAAA,EAGA,MAAM,OAAO,OAAA,EAAiD;AAC5D,IAAA,OAAO,IAAA,CAAK,QAAwB,YAAA,EAAc;AAAA,MAChD,MAAA,EAAQ,MAAA;AAAA,MACR,IAAA,EAAM,OAAA;AAAA,MACN,gBAAgB,OAAA,CAAQ,cAAA;AAAA,MACxB,SAAA,EAAW,IAAA,CAAK,GAAA,CAAI,IAAA,CAAK,WAAW,IAAM;AAAA,KAC3C,CAAA;AAAA,EACH;AAAA,EACiB,MAAA;AAAA,EACA,kBAAA;AAAA,EACA,OAAA;AAAA,EACA,SAAA;AAAA,EACA,OAAA;AAAA,EACA,UAAA;AAAA,EACA,SAAA;AAAA,EACA,UAAA;AAAA,EAEjB,YAAY,OAAA,EAA0B;AACpC,IAAA,IAAI,CAAC,CAAC,OAAA,CAAQ,WAAW,CAAC,CAAC,QAAQ,kBAAA,EAAoB;AACrD,MAAA,MAAM,IAAI,cAAc,6BAA6B,CAAA;AAAA,IACvD;AACA,IAAA,IAAI,OAAA,CAAQ,UAAA,IAAc,OAAA,CAAQ,UAAA,KAAe,WAAA,EAAa;AAC5D,MAAA,MAAM,IAAI,aAAA;AAAA,QACR;AAAA,OACF;AAAA,IACF;AACA,IAAA,IAAA,CAAK,SAAS,OAAA,CAAQ,MAAA;AACtB,IAAA,IAAA,CAAK,qBAAqB,OAAA,CAAQ,kBAAA;AAClC,IAAA,IAAA,CAAK,UAAU,cAAA,CAAe,OAAA,CAAQ,KAAK,OAAA,CAAQ,OAAA,IAAW,YAAY,CAAA;AAC1E,IAAA,IAAA,CAAK,SAAA,GAAY,OAAA,CAAQ,SAAA,IAAa,gBAAA,CAAiB,KAAK,OAAO,CAAA;AACnE,IAAA,IAAA,CAAK,OAAA,GAAU,QAAQ,OAAA,IAAW,QAAA;AAClC,IAAA,IAAA,CAAK,UAAA,GAAa,WAAA;AAClB,IAAA,IAAA,CAAK,YAAY,OAAA,CAAQ,KAAA,IAAS,UAAA,CAAW,KAAA,CAAM,KAAK,UAAU,CAAA;AAClE,IAAA,IAAA,CAAK,UAAA,GAAa,OAAA,CAAQ,UAAA,IAAc,CAAA,cAAA,EAAiB,WAAW,CAAA,CAAA;AAAA,EACtE;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAgBA,MAAM,OAAO,OAAA,EAA0C;AACrD,IAAA,MAAM,UAAU,MAAM,cAAA;AAAA,MACpB;AAAA,QACE,GAAG,OAAA,CAAQ,OAAA;AAAA,QACX,OAAA,EAAS,cAAA,CAAe,OAAA,CAAQ,OAAA,CAAQ,OAAO;AAAA,OACjD;AAAA,MACA,IAAA,CAAK;AAAA,KACP;AAEA,IAAA,MAAM,IAAA,GAAsB;AAAA,MAC1B,GAAG,OAAA;AAAA,MACH;AAAA,KACF;AAEA,IAAA,IAAI;AACF,MAAA,MAAM,OAAA,GAAU,MAAM,IAAA,CAAK,OAAA,CAAiB,YAAA,EAAc;AAAA,QACxD,MAAA,EAAQ,MAAA;AAAA,QACR,IAAA;AAAA,QACA,gBAAgB,OAAA,CAAQ;AAAA,OACzB,CAAA;AACD,MAAA,IAAI,CAAC,mBAAA,CAAoB,OAAO,CAAA,EAAG;AACjC,QAAA,OAAO,wBAAA;AAAA,UACL,qDAAA;AAAA,UACA,OAAA,CAAQ;AAAA,SACV;AAAA,MACF;AACA,MAAA,OAAO,0BAA0B,OAAO,CAAA;AAAA,IAC1C,SAAS,GAAA,EAAK;AACZ,MAAA,IAAI,eAAe,gBAAA,EAAkB;AACnC,QAAA,MAAM,GAAA;AAAA,MACR;AACA,MAAA,OAAO,wBAAA;AAAA,QACL,GAAA,YAAe,KAAA,GAAQ,CAAA,UAAA,EAAa,GAAA,CAAI,OAAO,CAAA,CAAA,GAAK,yBAAA;AAAA,QACpD,OAAA,CAAQ;AAAA,OACV;AAAA,IACF;AAAA,EACF;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAmBA,MAAM,SAAS,OAAA,EAAqD;AAClE,IAAA,OAAO,IAAA,CAAK,QAA0B,cAAA,EAAgB;AAAA,MACpD,MAAA,EAAQ,MAAA;AAAA,MACR,IAAA,EAAM,OAAA;AAAA,MACN,gBAAgB,OAAA,CAAQ;AAAA,KACzB,CAAA;AAAA,EACH;AAAA;AAAA;AAAA;AAAA,EAKA,MAAM,UAAU,OAAA,EAAuD;AACrE,IAAA,OAAO,IAAA,CAAK,QAA2B,eAAA,EAAiB;AAAA,MACtD,MAAA,EAAQ,MAAA;AAAA,MACR,IAAA,EAAM;AAAA,KACP,CAAA;AAAA,EACH;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAQA,MAAM,kBAAkB,OAAA,EAKiB;AACvC,IAAA,OAAO,IAAA,CAAK,QAAqC,eAAA,EAAiB;AAAA,MAChE,MAAA,EAAQ,MAAA;AAAA,MACR,IAAA,EAAM;AAAA,KACP,CAAA;AAAA,EACH;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAUA,MAAM,kBAAA,CACJ,KAAA,EACA,OAAA,EAC6B;AAC7B,IAAA,OAAO,mBAAmB,KAAA,EAAO;AAAA,MAC/B,GAAG,OAAA;AAAA,MACH,OAAA,EAAS,CAAA,EAAG,IAAA,CAAK,OAAO,CAAA,sBAAA,CAAA;AAAA,MACxB,OAAO,IAAA,CAAK;AAAA,KACb,CAAA;AAAA,EACH;AAAA;AAAA;AAAA;AAAA,EAKA,MAAM,OAAA,CACJ,IAAA,EACA,IAAA,EAMY;AACZ,IAAA,MAAM,UAAA,GAAa,IAAI,eAAA,EAAgB;AACvC,IAAA,MAAM,SAAA,GAAY,IAAA,CAAK,SAAA,IAAa,IAAA,CAAK,SAAA;AACzC,IAAA,MAAM,QAAQ,UAAA,CAAW,MAAM,UAAA,CAAW,KAAA,IAAS,SAAS,CAAA;AAE5D,IAAA,IAAI;AACF,MAAA,MAAM,OAAA,GAAkC;AAAA,QACtC,GAAI,IAAA,CAAK,MAAA,GAAS,EAAE,aAAA,EAAe,UAAU,IAAA,CAAK,MAAM,CAAA,CAAA,EAAG,GAAI,EAAC;AAAA,QAChE,cAAA,EAAgB,kBAAA;AAAA,QAChB,MAAA,EAAQ,kBAAA;AAAA,QACR,cAAc,IAAA,CAAK,UAAA;AAAA,QACnB,qBAAqB,IAAA,CAAK;AAAA,OAC5B;AACA,MAAA,IAAI,KAAK,kBAAA,EAAoB;AAC3B,QAAA,IAAI;AACF,UAAA,MAAA,CAAO,MAAA;AAAA,YACL,OAAA;AAAA,YACA,MAAM,iBAAA;AAAA,cACJ,IAAA,CAAK,mBAAmB,OAAA,CAAQ;AAAA,gBAC9B,GAAA,EAAK,CAAA,EAAG,IAAA,CAAK,OAAO,GAAG,IAAI,CAAA,CAAA;AAAA,gBAC3B,QAAQ,IAAA,CAAK,MAAA;AAAA,gBACb,QAAQ,UAAA,CAAW;AAAA,eACpB,CAAA;AAAA,cACD,UAAA,CAAW;AAAA;AACb,WACF;AAAA,QACF,CAAA,CAAA,MAAQ;AACN,UAAA,MAAM,IAAI,aAAA,CAAc,wBAAA,EAA0B,EAAE,IAAA,EAAM,cAAc,CAAA;AAAA,QAC1E;AACA,QAAA,IAAI,CAAC,OAAA,CAAQ,aAAA,EAAe,WAAW,OAAO,CAAA,IAAK,CAAC,OAAA,CAAQ,IAAA;AAC1D,UAAA,MAAM,IAAI,cAAc,0BAA0B,CAAA;AAAA,MACtD;AACA,MAAA,IAAI,KAAK,cAAA,EAAgB;AACvB,QAAA,OAAA,CAAQ,iBAAiB,IAAI,IAAA,CAAK,cAAA;AAAA,MACpC;AAEA,MAAA,MAAM,GAAA,GAAM,MAAM,IAAA,CAAK,SAAA,CAAU,GAAG,IAAA,CAAK,OAAO,CAAA,EAAG,IAAI,CAAA,CAAA,EAAI;AAAA,QACzD,QAAQ,IAAA,CAAK,MAAA;AAAA,QACb,OAAA;AAAA,QACA,IAAA,EAAM,KAAK,IAAA,KAAS,KAAA,CAAA,GAAY,KAAK,SAAA,CAAU,IAAA,CAAK,IAAI,CAAA,GAAI,KAAA,CAAA;AAAA,QAC5D,QAAQ,UAAA,CAAW,MAAA;AAAA,QACnB,QAAA,EAAU;AAAA,OACX,CAAA;AAED,MAAA,MAAM,IAAA,GAAO,MAAM,GAAA,CAAI,IAAA,EAAK;AAC5B,MAAA,IAAI,MAAA,GAAkB,KAAA,CAAA;AACtB,MAAA,IAAI,IAAA,EAAM;AACR,QAAA,IAAI;AACF,UAAA,MAAA,GAAS,IAAA,CAAK,MAAM,IAAI,CAAA;AAAA,QAC1B,CAAA,CAAA,MAAQ;AACN,UAAA,MAAA,GAAS,IAAA;AAAA,QACX;AAAA,MACF;AAEA,MAAA,IAAI,CAAC,IAAI,EAAA,EAAI;AACX,QAAA,MAAM,UACJ,OAAO,MAAA,KAAW,QAAA,IAAY,MAAA,KAAW,OACpC,MAAA,GACD,IAAA;AACN,QAAA,MAAM,UAAA,GACJ,OAAO,OAAA,KAAY,QAAA,GACf,OAAA,GACA;AAAA,UACE,KAAA,EAAO,OAAA,CAAQ,KAAA,IAAS,CAAA,KAAA,EAAQ,IAAI,MAAM,CAAA,CAAA;AAAA,UAC1C,SAAS,OAAA,CAAQ,OAAA;AAAA,UACjB,MAAM,OAAA,CAAQ;AAAA,SAChB;AACN,QAAA,MAAM,IAAI,gBAAA,CAAiB,GAAA,CAAI,MAAA,EAAQ,UAAU,CAAA;AAAA,MACnD;AAEA,MAAA,OAAO,MAAA;AAAA,IACT,SAAS,GAAA,EAAK;AACZ,MAAA,IAAI,GAAA,YAAe,kBAAkB,MAAM,GAAA;AAC3C,MAAA,IAAI,GAAA,YAAe,KAAA,IAAS,GAAA,CAAI,IAAA,KAAS,YAAA,EAAc;AACrD,QAAA,MAAM,IAAI,aAAA,CAAc,CAAA,wBAAA,EAA2B,SAAS,CAAA,EAAA,CAAA,EAAM;AAAA,UAChE,IAAA,EAAM;AAAA,SACP,CAAA;AAAA,MACH;AACA,MAAA,MAAM,eAAe,KAAA,GACjB,IAAI,aAAA,CAAc,GAAA,CAAI,SAAS,EAAE,IAAA,EAAM,WAAA,EAAa,IACpD,IAAI,aAAA,CAAc,2BAA2B,EAAE,IAAA,EAAM,aAAa,CAAA;AAAA,IACxE,CAAA,SAAE;AACA,MAAA,YAAA,CAAa,KAAK,CAAA;AAAA,IACpB;AAAA,EACF;AAAA;AAAA,EAGA,IAAI,MAAA,GAKF;AACA,IAAA,OAAO;AAAA,MACL,SAAS,IAAA,CAAK,OAAA;AAAA,MACd,WAAW,IAAA,CAAK,SAAA;AAAA,MAChB,SAAS,IAAA,CAAK,OAAA;AAAA,MACd,YAAY,IAAA,CAAK;AAAA,KACnB;AAAA,EACF;AACF;AAEA,IAAM,oCAAyC,IAAI,GAAA,CAAI,CAAC,OAAA,EAAS,WAAA,EAAa,MAAM,CAAC,CAAA;AAM9E,SAAS,oBAAoB,KAAA,EAAkC;AACpE,EAAA,IAAI,OAAO,KAAA,KAAU,QAAA,IAAY,KAAA,KAAU,MAAM,OAAO,KAAA;AACxD,EAAA,MAAM,CAAA,GAAI,KAAA;AACV,EAAA,OACE,OAAO,CAAA,CAAE,QAAA,KAAa,YACtB,iBAAA,CAAkB,GAAA,CAAI,EAAE,QAAQ,CAAA,IAChC,OAAO,CAAA,CAAE,OAAA,KAAY,YACrB,CAAA,CAAE,OAAA,CAAQ,SAAS,CAAA,IACnB,OAAO,EAAE,QAAA,KAAa,SAAA;AAE1B;;;ACnPO,SAAS,gBACd,CAAA,EACA,GAAA,GAAM,IAAA,CAAK,GAAA,IACX,eAAA,EACA;AACA,EAAA,IACE,oBAAoB,MAAA,KACnB,CAAC,OAAO,aAAA,CAAc,eAAe,KAAK,eAAA,GAAkB,CAAA,CAAA;AAE7D,IAAA,MAAM,IAAI,MAAM,qBAAqB,CAAA;AACvC,EAAA,MAAM,cAAA,GAAiB,CAAA,CAAE,QAAA,CAAS,UAAA,CAAW,MAAA;AAAA,IAC3C,CAAC,GAAG,CAAA,KAAM,CAAA,IAAK,EAAE,KAAA,KAAU,WAAA,GAAc,EAAE,SAAA,GAAY,CAAA,CAAA;AAAA,IACvD;AAAA,GACF;AACA,EAAA,MAAM,eAAA,GAAkB,CAAA,CAAE,QAAA,CAAS,UAAA,CAAW,MAAA;AAAA,IAC5C,CAAC,CAAA,EAAG,CAAA,KAAM,CAAA,IAAK,CAAA,CAAE,KAAA,KAAU,UAAA,IAAc,CAAA,CAAE,KAAA,KAAU,SAAA,GAAY,CAAA,CAAE,KAAA,GAAQ,CAAA,CAAA;AAAA,IAC3E;AAAA,GACF;AACA,EAAA,MAAM,GAAA,GACJ,CAAA,CAAE,OAAA,CAAQ,WAAA,KAAgB,IAAA,GACtB,IAAA,GACA,CAAA,CAAE,OAAA,CAAQ,cAAA,GAAiB,CAAA,CAAE,OAAA,CAAQ,cAAA,GAAiB,EAAE,OAAA,CAAQ,WAAA;AACtE,EAAA,OAAO;AAAA,IACL,gBACE,CAAA,CAAE,OAAA,CAAQ,UAAU,SAAA,IACpB,CAAA,CAAE,QAAQ,cAAA,GAAiB,CAAA,IAC3B,EAAE,OAAA,CAAQ,cAAA,KAAmB,KAC7B,CAAA,CAAE,OAAA,CAAQ,mBAAmB,CAAA,IAC7B,cAAA,KAAmB,EAAE,KAAA,CAAM,QAAA;AAAA,IAC7B,WAAA,EAAa,CAAA,CAAE,OAAA,CAAQ,cAAA,GAAiB,EAAE,OAAA,CAAQ,cAAA;AAAA,IAClD,4BAAA,EAA8B,cAAA,GAAiB,CAAA,CAAE,KAAA,CAAM,QAAA,CAAS,UAAA;AAAA,IAChE,cAAA;AAAA,IACA,eAAA;AAAA,IACA,yBAAA,EACE,CAAA,CAAE,OAAA,CAAQ,KAAA,KAAU,SAAA,IACpB,EAAE,OAAA,CAAQ,WAAA,KAAgB,SAAA,IAC1B,CAAA,CAAE,OAAA,CAAQ,WAAA,KAAgB,aAC1B,CAAA,CAAE,OAAA,CAAQ,KAAA,KAAU,SAAA,IACpB,eAAA,GAAkB,CAAA,GACd,IAAA,CAAK,GAAA,CAAI,CAAA,EAAG,GAAA,GAAM,CAAA,CAAE,SAAS,CAAA,GAC7B,IAAA;AAAA,IACN,aAAA,EAAe,EAAE,OAAA,CAAQ,cAAA;AAAA,IACzB,aAAA,EAAe,EAAE,OAAA,CAAQ,cAAA;AAAA,IACzB,eAAA,EAAiB,EAAE,OAAA,CAAQ,WAAA;AAAA,IAC3B,6BAAA,EAA+B,GAAA;AAAA,IAC/B,mBACE,GAAA,KAAQ,IAAA,IAAQ,eAAA,KAAoB,MAAA,GAAY,OAAO,GAAA,GAAM,eAAA;AAAA;AAAA,IAE/D,gBAAA,EAAkB,IAAA;AAAA,IAClB,gBAAA,EAAkB,IAAA;AAAA,IAClB,mBAAmB,IAAA,CAAK,GAAA,CAAI,GAAG,CAAA,CAAE,SAAA,GAAY,EAAE,SAAS;AAAA,GAC1D;AACF;;;AC/KO,IAAM,oBAAA,GAAuB;AAAA,EAClC,EAAA,EAAI,GAAA;AAAA,EACJ,OAAA,EAAS,GAAA;AAAA,EACT,UAAA,EAAY,GAAA;AAAA,EACZ,YAAA,EAAc,GAAA;AAAA,EACd,SAAA,EAAW,GAAA;AAAA,EACX,QAAA,EAAU,GAAA;AAAA,EACV,QAAA,EAAU,GAAA;AAAA,EACV,oBAAA,EAAsB,GAAA;AAAA,EACtB,eAAA,EAAiB;AACnB;AAKO,IAAM,4BAAA,GAA+B;AAAA,EAC1C,EAAA,EAAI,0FAAA;AAAA,EACJ,OAAA,EAAS,4DAAA;AAAA,EACT,UAAA,EAAY,mDAAA;AAAA,EACZ,YAAA,EAAc,gCAAA;AAAA,EACd,SAAA,EAAW,yCAAA;AAAA,EACX,QAAA,EAAU,6CAAA;AAAA,EACV,QAAA,EAAU,6EAAA;AAAA,EACV,oBAAA,EACE,0IAAA;AAAA,EACF,eAAA,EAAiB;AACnB;AAeO,SAAS,gBAAgB,OAAA,EAAmD;AACjF,EAAA,OAAO,OAAA,CAAQ,QAAA,KAAa,OAAA,IAAW,CAAC,OAAA,CAAQ,QAAA;AAClD;AAMO,SAAS,oBAAoB,OAAA,EAAsC;AACxE,EAAA,IAAI,OAAA,CAAQ,QAAA,IAAY,OAAA,CAAQ,QAAA,KAAa,WAAA,EAAa;AACxD,IAAA,OAAO,oBAAA,CAAqB,oBAAA;AAAA,EAC9B;AACA,EAAA,IAAI,OAAA,CAAQ,QAAA,KAAa,MAAA,EAAQ,OAAO,oBAAA,CAAqB,SAAA;AAC7D,EAAA,IAAI,CAAC,eAAA,CAAgB,OAAO,CAAA,EAAG;AAC7B,IAAA,OAAO,oBAAA,CAAqB,oBAAA;AAAA,EAC9B;AACA,EAAA,OAAO,oBAAA,CAAqB,EAAA;AAC9B;;;ACpDA,IAAM,QAAA,GAAW,0BAAA;AAGjB,eAAsB,2BACpB,SAAA,EACiB;AACjB,EAAA,MAAM,EAAE,WAAA,EAAa,MAAA,EAAQ,KAAA,EAAO,WAAU,GAAI,SAAA;AAClD,EAAA,IACE,MAAA,CAAO,IAAA,CAAK,SAAS,CAAA,CAAE,IAAA;AAAA,IACrB,CAAC,GAAA,KAAQ,CAAC,CAAC,aAAA,EAAe,UAAU,OAAA,EAAS,WAAW,CAAA,CAAE,QAAA,CAAS,GAAG;AAAA,GACxE,IACA,OAAO,WAAA,KAAgB,QAAA,IACvB,CAAC,QAAA,CAAS,IAAA,CAAK,WAAW,CAAA,IAC1B,OAAO,MAAA,KAAW,QAAA,IAClB,CAAC,SAAS,IAAA,CAAK,MAAM,CAAA,IACrB,CAAC,MAAA,CAAO,aAAA,CAAc,KAAK,CAAA,IAC3B,QAAQ,CAAA,IACP,SAAA,KAAc,MAAA,KACZ,OAAO,cAAc,QAAA,IAAY,CAAC,QAAA,CAAS,IAAA,CAAK,SAAS,CAAA,CAAA,EAC5D;AACA,IAAA,MAAM,IAAI,UAAU,gCAAgC,CAAA;AAAA,EACtD;AACA,EAAA,MAAM,KAAA,GAAQ,IAAI,WAAA,EAAY,CAAE,MAAA;AAAA,IAC9B,KAAK,SAAA,CAAU;AAAA,MACb,oBAAA;AAAA,MACA,kBAAA;AAAA,MACA,WAAA;AAAA,MACA,MAAA;AAAA,MACA,KAAA;AAAA,MACA,SAAA,IAAa;AAAA,KACd;AAAA,GACH;AACA,EAAA,MAAM,SAAS,MAAM,MAAA,CAAO,MAAA,CAAO,MAAA,CAAO,WAAW,KAAK,CAAA;AAC1D,EAAA,OAAO,KAAA,CAAM,IAAA;AAAA,IAAK,IAAI,WAAW,MAAM,CAAA;AAAA,IAAG,CAAC,SACzC,IAAA,CAAK,QAAA,CAAS,EAAE,CAAA,CAAE,QAAA,CAAS,GAAG,GAAG;AAAA,GACnC,CAAE,KAAK,EAAE,CAAA;AACX;;;ACnCO,SAAS,mBAAmB,GAAA,EAAsB;AACvD,EAAA,MAAM,QAAA,GACJ,GAAA,CAAI,OAAA,CAAQ,GAAA,CAAI,kBAAkB,CAAA,EAAG,IAAA,EAAK,IAC1C,GAAA,CAAI,OAAA,CAAQ,GAAA,CAAI,WAAW,CAAA,EAAG,MAAK,IACnC,GAAA,CAAI,OAAA,CAAQ,GAAA,CAAI,wBAAwB,CAAA,EAAG,KAAA,CAAM,GAAG,CAAA,CAAE,CAAC,CAAA,EAAG,IAAA,EAAK,IAC/D,EAAA;AACF,EAAA,IAAI,UAAU,OAAO,QAAA;AAIrB,EAAA,OAAO,GAAA,CAAI,OAAA,CAAQ,GAAA,CAAI,iBAAiB,CAAA,EAAG,KAAA,CAAM,GAAG,CAAA,CAAE,CAAC,CAAA,EAAG,IAAA,EAAK,IAAK,EAAA;AACtE;;;AC+BO,SAAS,YAAA,CACd,MAAA,EACA,MAAA,EACA,OAAA,GAAuB,EAAC,EAKP;AACjB,EAAA,OAAO,OAAO,GAAA,EAAK,GAAA,EAAK,IAAA,KAAS;AAC/B,IAAA,IAAI;AACF,MAAA,MAAM,OAAA,GAAU,OAAA,CAAQ,OAAA,GAAU,GAAG,CAAA,IAAK,CAAA,EAAG,GAAA,CAAI,QAAA,IAAY,EAAE,CAAA,EAAG,GAAA,CAAI,IAAA,IAAQ,EAAE,CAAA,CAAA;AAChF,MAAA,MAAM,OAAA,GAAU,OAAA,CAAQ,OAAA,GAAU,GAAG,CAAA;AAErC,MAAA,MAAM,CAAA,GAAa,MAAM,MAAA,CAAO,MAAA,CAAO;AAAA,QACrC,MAAA;AAAA,QACA,OAAA;AAAA,QACA,OAAA;AAAA,QACA,OAAA,EAAS;AAAA,UACP,KAAA,EAAO,IAAI,IAAA,EAAM,KAAA;AAAA,UACjB,IAAI,GAAA,CAAI,EAAA;AAAA,UACR,SAAA,EAAA,CACG,OAAO,GAAA,CAAI,OAAA,CAAQ,YAAY,CAAA,KAAM,QAAA,GAClC,GAAA,CAAI,OAAA,CAAQ,YAAY,CAAA,GACxB,KAAA,CAAA,KAAc,EAAA;AAAA,UACpB,SAAS,GAAA,CAAI,OAAA;AAAA,UACb,UAAU,GAAA,CAAI;AAAA;AAChB,OACD,CAAA;AAED,MAAA,GAAA,CAAI,OAAO,QAAA,GAAW,CAAA;AAEtB,MAAA,IAAI,CAAA,CAAE,QAAA,IAAY,CAAA,CAAE,QAAA,KAAa,WAAA,EAAa;AAC5C,QAAA,GAAA,CACG,MAAA,CAAO,oBAAA,CAAqB,oBAAoB,CAAA,CAChD,IAAA,CAAK,EAAE,SAAA,EAAW,IAAA,EAAM,OAAA,EAAS,CAAA,CAAE,OAAA,EAAS,CAAA;AAC/C,QAAA;AAAA,MACF;AACA,MAAA,IAAI,CAAA,CAAE,aAAa,MAAA,EAAQ;AACzB,QAAA,GAAA,CACG,MAAA,CAAO,oBAAA,CAAqB,SAAS,CAAA,CACrC,IAAA,CAAK,EAAE,KAAA,EAAO,SAAA,EAAW,OAAA,EAAS,CAAA,CAAE,OAAA,EAAS,CAAA;AAChD,QAAA;AAAA,MACF;AACA,MAAA,IAAI,CAAC,eAAA,CAAgB,CAAC,CAAA,EAAG;AAEvB,QAAA,GAAA,CACG,MAAA,CAAO,oBAAA,CAAqB,oBAAoB,CAAA,CAChD,IAAA,CAAK,EAAE,SAAA,EAAW,IAAA,EAAM,OAAA,EAAS,CAAA,CAAE,OAAA,EAAS,CAAA;AAC/C,QAAA;AAAA,MACF;AACA,MAAA,IAAA,EAAK;AAAA,IACP,SAAS,GAAA,EAAK;AACZ,MAAA,IAAA,CAAK,GAAG,CAAA;AAAA,IACV;AAAA,EACF,CAAA;AACF;;;AChFA,eAAsB,iBAAA,CACpB,MAAA,EACA,GAAA,EACA,OAAA,EACkB;AAClB,EAAA,MAAM,GAAA,GAAM,IAAI,GAAA,CAAI,GAAA,CAAI,GAAG,CAAA;AAC3B,EAAA,OAAO,OAAO,MAAA,CAAO;AAAA,IACnB,QAAQ,OAAA,CAAQ,MAAA;AAAA,IAChB,OAAA,EAAS,QAAQ,OAAA,IAAW,CAAA,EAAG,IAAI,IAAI,CAAA,EAAG,IAAI,QAAQ,CAAA,CAAA;AAAA,IACtD,SAAS,OAAA,CAAQ,OAAA;AAAA,IACjB,OAAA,EAAS;AAAA,MACP,KAAA,EAAO,QAAQ,IAAA,EAAM,KAAA;AAAA,MACrB,EAAA,EAAI,mBAAmB,GAAG,CAAA;AAAA,MAC1B,SAAA,EAAW,GAAA,CAAI,OAAA,CAAQ,GAAA,CAAI,YAAY,CAAA,IAAK,EAAA;AAAA,MAC5C,OAAA,EAAS,MAAA,CAAO,WAAA,CAAY,GAAA,CAAI,OAAO,CAAA;AAAA,MACvC,UAAU,OAAA,CAAQ;AAAA;AACpB,GACD,CAAA;AACH;;;AC1BO,IAAM,aAAA,GAAN,cAA4B,KAAA,CAAM;AAAA,EACvC,YAA4B,IAAA,EAAc;AACxC,IAAA,KAAA,CAAM,IAAI,CAAA;AADgB,IAAA,IAAA,CAAA,IAAA,GAAA,IAAA;AAE1B,IAAA,IAAA,CAAK,IAAA,GAAO,eAAA;AAAA,EACd;AAAA,EAH4B,IAAA;AAI9B;AACO,SAAS,cAAA,CAAe,OAAgB,IAAA,EAA6B;AAC1E,EAAA,IAAI,CAAC,KAAA,EAAO,MAAM,IAAI,cAAc,IAAI,CAAA;AAC1C;AAEO,SAAS,kBAAkB,KAAA,EAAwB;AACxD,EAAA,IAAI,KAAA,KAAU,QAAQ,OAAO,KAAA,KAAU,WAAW,OAAO,IAAA,CAAK,UAAU,KAAK,CAAA;AAC7E,EAAA,IAAI,OAAO,UAAU,QAAA,EAAU;AAC7B,IAAA,cAAA;AAAA,MACE,MAAA,CAAO,cAAc,KAAK,CAAA,IAAK,CAAC,MAAA,CAAO,EAAA,CAAG,OAAO,EAAE,CAAA;AAAA,MACnD;AAAA,KACF;AACA,IAAA,OAAO,OAAO,KAAK,CAAA;AAAA,EACrB;AACA,EAAA,IAAI,OAAO,UAAU,QAAA,EAAU;AAC7B,IAAA,cAAA,CAAe,gBAAA,CAAiB,IAAA,CAAK,KAAK,CAAA,EAAG,qBAAqB,CAAA;AAClE,IAAA,OAAO,IAAA,CAAK,UAAU,KAAK,CAAA;AAAA,EAC7B;AACA,EAAA,IAAI,KAAA,CAAM,OAAA,CAAQ,KAAK,CAAA,EAAG,OAAO,CAAA,CAAA,EAAI,KAAA,CAAM,GAAA,CAAI,iBAAiB,CAAA,CAAE,IAAA,CAAK,GAAG,CAAC,CAAA,CAAA,CAAA;AAC3E,EAAA,cAAA;AAAA,IACE,KAAA,IACE,OAAO,KAAA,KAAU,QAAA,IACjB,OAAO,cAAA,CAAe,KAAK,MAAM,MAAA,CAAO,SAAA;AAAA,IAC1C;AAAA,GACF;AACA,EAAA,MAAM,GAAA,GAAM,KAAA;AACZ,EAAA,OAAO,CAAA,CAAA,EAAI,MAAA,CAAO,IAAA,CAAK,GAAG,CAAA,CACvB,MAAK,CACL,GAAA,CAAI,CAAC,GAAA,KAAQ,CAAA,EAAG,iBAAA,CAAkB,GAAG,CAAC,CAAA,CAAA,EAAI,iBAAA,CAAkB,GAAA,CAAI,GAAG,CAAC,CAAC,CAAA,CAAE,CAAA,CACvE,IAAA,CAAK,GAAG,CAAC,CAAA,CAAA,CAAA;AACd;AACA,eAAsB,aAAa,KAAA,EAAgC;AACjE,EAAA,OAAO,KAAA,CAAM,IAAA;AAAA,IACX,IAAI,UAAA;AAAA,MACF,MAAM,MAAA,CAAO,MAAA,CAAO,MAAA,CAAO,SAAA,EAAW,IAAI,WAAA,EAAY,CAAE,MAAA,CAAO,KAAK,CAAC;AAAA,KACvE;AAAA,IACA,CAAC,MAAM,CAAA,CAAE,QAAA,CAAS,EAAE,CAAA,CAAE,QAAA,CAAS,GAAG,GAAG;AAAA,GACvC,CAAE,KAAK,EAAE,CAAA;AACX;AACA,IAAMC,OAAAA,GAAS,CAAC,KAAA,KACd,IAAA,CAAK,KAAA,CAAM,IAAA,CAAK,KAAA,EAAO,CAAC,CAAA,KAAM,MAAA,CAAO,YAAA,CAAa,CAAC,CAAC,CAAA,CAAE,IAAA,CAAK,EAAE,CAAC,CAAA,CAC3D,OAAA,CAAQ,KAAA,EAAO,GAAG,CAAA,CAClB,OAAA,CAAQ,KAAA,EAAO,GAAG,CAAA,CAClB,OAAA,CAAQ,KAAA,EAAO,EAAE,CAAA;AACtB,IAAM,MAAA,GAAS,CAAC,IAAA,KACd,UAAA,CAAW,IAAA;AAAA,EAAK,IAAA,CAAK,KAAK,OAAA,CAAQ,IAAA,EAAM,GAAG,CAAA,CAAE,OAAA,CAAQ,IAAA,EAAM,GAAG,CAAC,CAAA;AAAA,EAAG,CAAC,CAAA,KACjE,CAAA,CAAE,UAAA,CAAW,CAAC;AAChB,CAAA;AACK,SAAS,aAAA,CACd,OAAA,EACA,GAAA,EACA,EAAA,EACa;AACb,EAAA,MAAM,UAAU,OAAA,CAAQ,MAAA,CAAO,CAACC,IAAAA,KAAQA,IAAAA,CAAI,QAAQ,GAAG,CAAA;AACvD,EAAA,cAAA,CAAe,OAAA,CAAQ,MAAA,KAAW,CAAA,EAAG,oBAAoB,CAAA;AACzD,EAAA,MAAM,GAAA,GAAM,QAAQ,CAAC,CAAA;AACrB,EAAA,cAAA;AAAA,IACE,IAAI,GAAA,CAAI,GAAA,KAAQ,QACd,GAAA,CAAI,GAAA,CAAI,QAAQ,OAAA,KACf,CAAC,GAAA,CAAI,GAAA,CAAI,OAAO,GAAA,CAAI,GAAA,CAAI,QAAQ,OAAA,CAAA,IACjC,CAAC,IAAI,GAAA,CAAI,CAAA;AAAA,IACX;AAAA,GACF;AACA,EAAA,cAAA;AAAA,IACE,OAAO,aAAA,CAAc,EAAE,KACrB,MAAA,CAAO,aAAA,CAAc,IAAI,SAAS,CAAA,IAClC,MAAA,CAAO,aAAA,CAAc,IAAI,QAAQ,CAAA,IACjC,IAAI,SAAA,IAAa,EAAA,IACjB,KAAK,GAAA,CAAI,QAAA;AAAA,IACX;AAAA,GACF;AACA,EAAA,cAAA,CAAe,GAAA,CAAI,SAAA,KAAc,MAAA,EAAW,aAAa,CAAA;AACzD,EAAA,OAAO,GAAA;AACT;AACA,eAAsB,uBAAA,CACpB,KAAA,EACA,GAAA,EACA,OAAA,EACA,EAAA,EACkC;AAClC,EAAA,cAAA;AAAA,IACE,OAAO,UAAU,QAAA,IACf,KAAA,CAAM,UAAU,GAAA,IAChB,kDAAA,CAAmD,KAAK,KAAK,CAAA;AAAA,IAC/D;AAAA,GACF;AACA,EAAA,MAAM,CAAC,CAAA,EAAG,CAAA,EAAG,CAAC,CAAA,GAAI,KAAA,CAAM,MAAM,GAAG,CAAA;AACjC,EAAA,IAAI,IAAA,EAAM,OAAA;AACV,EAAA,IAAI;AACF,IAAA,IAAA,GAAO,IAAA,CAAK,KAAA;AAAA,MACV,IAAI,WAAA,CAAY,OAAA,EAAS,EAAE,KAAA,EAAO,IAAA,EAAM,SAAA,EAAW,IAAA,EAAM,CAAA,CAAE,MAAA,CAAO,MAAA,CAAO,CAAC,CAAC;AAAA,KAC7E;AACA,IAAA,OAAA,GAAU,IAAA,CAAK,KAAA;AAAA,MACb,IAAI,WAAA,CAAY,OAAA,EAAS,EAAE,KAAA,EAAO,IAAA,EAAM,SAAA,EAAW,IAAA,EAAM,CAAA,CAAE,MAAA,CAAO,MAAA,CAAO,CAAC,CAAC;AAAA,KAC7E;AAAA,EACF,CAAA,CAAA,MAAQ;AACN,IAAA,MAAM,IAAI,cAAc,qBAAqB,CAAA;AAAA,EAC/C;AACA,EAAA,cAAA;AAAA,IACE,IAAA,EAAM,GAAA,KAAQ,OAAA,IAAW,IAAA,CAAK,GAAA,KAAQ,OAAO,MAAA,CAAO,IAAA,CAAK,IAAI,CAAA,CAAE,MAAA,KAAW,CAAA;AAAA,IAC1E;AAAA,GACF;AACA,EAAA,MAAM,OAAA,GAAU,aAAA,CAAc,OAAA,EAAS,IAAA,CAAK,KAAK,EAAE,CAAA;AACnD,EAAA,MAAM,GAAA,GAAM,MAAM,MAAA,CAAO,MAAA,CAAO,SAAA;AAAA,IAC9B,KAAA;AAAA,IACA,OAAA,CAAQ,GAAA;AAAA,IACR,EAAE,IAAA,EAAM,OAAA,EAAS,UAAA,EAAY,OAAA,EAAQ;AAAA,IACrC,KAAA;AAAA,IACA,CAAC,QAAQ;AAAA,GACX;AACA,EAAA,cAAA;AAAA,IACE,MAAM,OAAO,MAAA,CAAO,MAAA;AAAA,MAClB,EAAE,IAAA,EAAM,OAAA,EAAS,IAAA,EAAM,SAAA,EAAU;AAAA,MACjC,GAAA;AAAA,MACA,OAAO,CAAC,CAAA;AAAA,MACR,IAAI,aAAY,CAAE,MAAA,CAAO,GAAG,CAAC,CAAA,CAAA,EAAI,CAAC,CAAA,CAAE;AAAA,KACtC;AAAA,IACA;AAAA,GACF;AACA,EAAA,cAAA;AAAA,IACE,WAAW,OAAO,OAAA,KAAY,YAAY,CAAC,KAAA,CAAM,QAAQ,OAAO,CAAA;AAAA,IAChE;AAAA,GACF;AACA,EAAA,OAAO,OAAA;AACT;AACA,eAAsB,YAAA,CACpB,OAAA,EACA,GAAA,EACA,GAAA,EACA,GAAA,EACiB;AACjB,EAAA,cAAA;AAAA,IACE,GAAA,CAAI,GAAA,KAAQ,IAAA,IAAQ,GAAA,CAAI,GAAA,KAAQ,YAAY,CAAC,GAAA,CAAI,GAAA,IAAO,GAAA,CAAI,GAAA,KAAQ,OAAA,CAAA;AAAA,IACpE;AAAA,GACF;AACA,EAAA,MAAM,KAAA,GAAQ,CAAA,EAAGD,OAAAA,CAAO,IAAI,WAAA,EAAY,CAAE,MAAA,CAAO,iBAAA,CAAkB,EAAE,GAAA,EAAK,OAAA,EAAS,GAAA,EAAK,GAAA,EAAK,CAAC,CAAC,CAAC,CAAA,CAAA,EAAIA,OAAAA,CAAO,IAAI,WAAA,EAAY,CAAE,MAAA,CAAO,iBAAA,CAAkB,OAAO,CAAC,CAAC,CAAC,CAAA,CAAA;AAChK,EAAA,cAAA,CAAe,KAAA,CAAM,MAAA,GAAS,EAAA,IAAM,GAAA,EAAW,kBAAkB,CAAA;AACjE,EAAA,MAAM,GAAA,GAAM,MAAM,MAAA,CAAO,MAAA,CAAO,SAAA;AAAA,IAC9B,KAAA;AAAA,IACA,GAAA;AAAA,IACA,EAAE,IAAA,EAAM,OAAA,EAAS,UAAA,EAAY,OAAA,EAAQ;AAAA,IACrC,KAAA;AAAA,IACA,CAAC,MAAM;AAAA,GACT;AACA,EAAA,OAAO,CAAA,EAAG,KAAK,CAAA,CAAA,EAAIA,OAAAA,CAAO,IAAI,WAAW,MAAM,MAAA,CAAO,MAAA,CAAO,IAAA,CAAK,EAAE,IAAA,EAAM,SAAS,IAAA,EAAM,SAAA,EAAU,EAAG,GAAA,EAAK,IAAI,WAAA,EAAY,CAAE,MAAA,CAAO,KAAK,CAAC,CAAC,CAAC,CAAC,CAAA,CAAA;AAC/I;AAiCA,IAAM,EAAA,GAAK,2BAAA;AACJ,SAAS,gBAAA,CAAiB,OAAyB,QAAA,EAAwB;AAChF,EAAA,cAAA;AAAA,IACE,OAAO,IAAA,CAAK,KAAK,EAAE,IAAA,EAAK,CAAE,KAAK,GAAG,CAAA,KAChC,sHACA,MAAA,CAAO,IAAA,CAAK,MAAM,SAAS,CAAA,CAAE,MAAK,CAAE,IAAA,CAAK,GAAG,CAAA,KAC1C,gDAAA;AAAA,IACJ;AAAA,GACF;AACA,EAAA,iBAAA,CAAkB,KAAK,CAAA;AACvB,EAAA,cAAA;AAAA,IACE,KAAA,CAAM,OAAA,KAAY,CAAA,IAChB,KAAA,CAAM,WAAW,6BAAA,IACjB,KAAA,CAAM,OAAA,KAAY,qBAAA,IAClB,KAAA,CAAM,QAAA,KAAa,QAAA,IACnB,EAAA,CAAG,KAAK,QAAQ,CAAA;AAAA,IAClB;AAAA,GACF;AACA,EAAA,cAAA;AAAA,IACE;AAAA,MACE,KAAA,CAAM,OAAA;AAAA,MACN,KAAA,CAAM,KAAA;AAAA,MACN,KAAA,CAAM,SAAA;AAAA,MACN,KAAA,CAAM,UAAA;AAAA,MACN,MAAM,SAAA,CAAU;AAAA,KAClB,CAAE,MAAM,MAAA,CAAO,aAAa,KAC1B,KAAA,CAAM,OAAA,GAAU,MAAM,KAAA,IACtB,KAAA,CAAM,SAAS,KAAA,CAAM,UAAA,IACrB,MAAM,UAAA,IAAc,KAAA,CAAM,aAC1B,KAAA,CAAM,SAAA,GAAY,MAAM,SAAA,CAAU,WAAA;AAAA,IACpC;AAAA,GACF;AACA,EAAA,cAAA;AAAA,IACE,KAAA,CAAM,YAAA,KAAiB,SAAA,IACrB,KAAA,CAAM,cAAc,kDAAA,IACpB,KAAA,CAAM,SAAA,CAAU,SAAA,KAAc,WAAA,IAC9B,KAAA,CAAM,SAAA,CAAU,cAAA,KAAmB,0BACnC,EAAA,CAAG,IAAA,CAAK,KAAA,CAAM,SAAA,CAAU,SAAS,CAAA,IACjC,KAAA,CAAM,OAAA,CAAQ,MAAM,IAAI,CAAA,IACxB,KAAA,CAAM,IAAA,CAAK,MAAM,CAAC,GAAA,KAAQ,EAAA,CAAG,IAAA,CAAK,GAAG,CAAC,CAAA;AAAA,IACxC;AAAA,GACF;AACA,EAAA,cAAA;AAAA,IACE,MAAM,OAAA,CAAQ,KAAA,CAAM,OAAO,CAAA,IAAK,KAAA,CAAM,QAAQ,MAAA,IAAU,GAAA;AAAA,IACxD;AAAA,GACF;AACA,EAAA,MAAM,IAAA,uBAAW,GAAA,EAAY;AAC7B,EAAA,KAAA,MAAW,GAAA,IAAO,MAAM,OAAA,EAAS;AAC/B,IAAA,cAAA;AAAA,MACE,MAAA,CAAO,KAAK,GAAG,CAAA,CAAE,MAAK,CAAE,IAAA,CAAK,GAAG,CAAA,KAC9B,4EAAA;AAAA,MACF;AAAA,KACF;AACA,IAAA,cAAA;AAAA,MACE,GAAG,IAAA,CAAK,GAAA,CAAI,EAAE,CAAA,IACZ,EAAA,CAAG,KAAK,GAAA,CAAI,OAAO,CAAA,IACnB,CAAC,YAAY,WAAA,EAAa,SAAS,EAAE,QAAA,CAAS,GAAA,CAAI,IAAI,CAAA,IACtD,EAAA,CAAG,IAAA,CAAK,GAAA,CAAI,MAAM,CAAA,KACjB,GAAA,CAAI,mBAAmB,IAAA,IAAQ,EAAA,CAAG,KAAK,GAAA,CAAI,cAAc,OACzD,GAAA,CAAI,OAAA,KAAY,QACd,OAAO,GAAA,CAAI,YAAY,QAAA,IAAY,GAAA,CAAI,QAAQ,MAAA,IAAU,IAAA,CAAA;AAAA,MAC9D;AAAA,KACF;AACA,IAAA,cAAA;AAAA,MACE,MAAA,CAAO,aAAA,CAAc,GAAA,CAAI,UAAU,CAAA,IACjC,MAAA,CAAO,aAAA,CAAc,GAAA,CAAI,UAAU,CAAA,IACnC,KAAA,CAAM,OAAA,IAAW,IAAI,UAAA,IACrB,GAAA,CAAI,UAAA,GAAa,KAAA,CAAM,KAAA,IACvB,GAAA,CAAI,UAAA,IAAc,KAAA,CAAM,cACxB,GAAA,CAAI,UAAA,IAAc,GAAA,CAAI,UAAA,IACtB,GAAA,CAAI,MAAA,MAAY,GAAA,CAAI,IAAA,KAAS,aAAa,kBAAA,GAAqB,iBAAA,CAAA;AAAA,MACjE;AAAA,KACF;AACA,IAAA,MAAM,WAAW,CAAA,EAAG,GAAA,CAAI,IAAI,CAAA,CAAA,EAAI,IAAI,EAAE,CAAA,CAAA;AACtC,IAAA,cAAA,CAAe,CAAC,IAAA,CAAK,GAAA,CAAI,QAAQ,GAAG,kBAAkB,CAAA;AACtD,IAAA,IAAA,CAAK,IAAI,QAAQ,CAAA;AAAA,EACnB;AACF;AAEA,eAAsB,oBAAA,CACpB,QACA,OAAA,EAMA;AACA,EAAA,gBAAA,CAAiB,MAAA,CAAO,QAAA,EAAU,OAAA,CAAQ,QAAQ,CAAA;AAClD,EAAA,cAAA;AAAA,IACE,MAAA,CAAO,QAAA,CAAS,SAAA,CAAU,SAAA,KAAc,OAAA,CAAQ,SAAA;AAAA,IAChD;AAAA,GACF;AACA,EAAA,cAAA;AAAA,IACE,OAAA,CAAQ,MAAM,MAAA,CAAO,QAAA,CAAS,UAAU,WAAA,IACtC,OAAA,CAAQ,GAAA,IAAO,MAAA,CAAO,QAAA,CAAS,SAAA;AAAA,IACjC;AAAA,GACF;AACA,EAAA,MAAM,SAAS,MAAM,uBAAA;AAAA,IACnB,MAAA,CAAO,SAAA;AAAA,IACP,uBAAA;AAAA,IACA,OAAA,CAAQ,WAAA;AAAA,IACR,OAAO,QAAA,CAAS;AAAA,GAClB;AACA,EAAA,cAAA;AAAA,IACE,iBAAA,CAAkB,MAAM,CAAA,KAAM,iBAAA,CAAkB,OAAO,QAAQ,CAAA;AAAA,IAC/D;AAAA,GACF;AACA,EAAA,MAAM,OAAO,IAAA,CAAK,KAAA;AAAA,IAChB,IAAI,WAAA,EAAY,CAAE,MAAA,CAAO,MAAA,CAAO,MAAA,CAAO,SAAA,CAAU,KAAA,CAAM,GAAG,CAAA,CAAE,CAAC,CAAE,CAAC;AAAA,GAClE;AACA,EAAA,cAAA;AAAA,IACE,aAAA,CAAc,QAAQ,WAAA,EAAa,IAAA,CAAK,KAAK,MAAA,CAAO,QAAA,CAAS,SAAS,CAAA,CACnE,aAAA,KAAkB,MAAA;AAAA,IACrB;AAAA,GACF;AACA,EAAA,OAAO;AAAA,IACL,OAAA,EAAS,qBAAA;AAAA,IACT,mBAAA,EAAqB,KAAA;AAAA,IACrB,SAAA,EAAW,OAAA;AAAA,IACX,YAAA,EAAc,SAAA;AAAA,IACd,YAAA,EAAc,iBAAA;AAAA,IACd,IAAA,EAAM,OAAO,QAAA,CAAS;AAAA,GACxB;AACF;AAIA,eAAsB,uBAAA,CACpB,OACA,OAAA,EAMA;AACA,EAAA,cAAA;AAAA,IACE,OAAO,KAAA,KAAU,QAAA,IAAY,KAAA,CAAM,MAAA,IAAU,IAAA;AAAA,IAC7C;AAAA,GACF;AACA,EAAA,IAAI,MAAA,EAAiC,IAAA;AACrC,EAAA,IAAI;AACF,IAAA,MAAM,KAAA,GAAQ,KAAA,CAAM,KAAA,CAAM,GAAG,CAAA;AAC7B,IAAA,IAAA,GAAO,IAAA,CAAK,KAAA,CAAM,IAAI,WAAA,EAAY,CAAE,MAAA,CAAO,MAAA,CAAO,KAAA,CAAM,CAAC,CAAE,CAAC,CAAC,CAAA;AAC7D,IAAA,MAAA,GAAS,IAAA,CAAK,KAAA,CAAM,IAAI,WAAA,EAAY,CAAE,MAAA,CAAO,MAAA,CAAO,KAAA,CAAM,CAAC,CAAE,CAAC,CAAC,CAAA;AAAA,EACjE,CAAA,CAAA,MAAQ;AACN,IAAA,MAAM,IAAI,cAAc,qBAAqB,CAAA;AAAA,EAC/C;AACA,EAAA,cAAA;AAAA,IACE,IAAA,CAAK,GAAA,KAAQ,KAAA,IAAS,IAAA,CAAK,GAAA,KAAQ,qBAAA;AAAA,IACnC;AAAA,GACF;AACA,EAAA,cAAA;AAAA,IACE,MAAA,CAAO,aAAA,CAAc,MAAA,CAAO,GAAG,CAAA,IAC7B,MAAA,CAAO,aAAA,CAAc,MAAA,CAAO,GAAG,CAAA,IAC/B,MAAA,CAAO,MAAA,CAAO,GAAG,CAAA,GAAI,MAAA,CAAO,MAAA,CAAO,GAAG,CAAA,IACtC,MAAA,CAAO,MAAA,CAAO,GAAG,CAAA,GAAI,MAAA,CAAO,MAAA,CAAO,GAAG,CAAA,KAAM,IAAA,CAAK,GAAA,KAAQ,QAAQ,GAAA,GAAM,EAAA,CAAA;AAAA,IACzE;AAAA,GACF;AACA,EAAA,MAAM,EAAA,GAAK,MAAA,CAAO,MAAA,CAAO,GAAG,CAAA;AAC5B,EAAA,cAAA;AAAA,IACE,OAAO,MAAA,CAAO,OAAA,KAAY,YAAY,wBAAA,CAAyB,IAAA,CAAK,OAAO,OAAO,CAAA;AAAA,IAClF;AAAA,GACF;AACA,EAAA,MAAM,OAAA,GAAU,cAAc,OAAA,CAAQ,WAAA,EAAa,OAAO,IAAA,CAAK,GAAG,GAAG,EAAE,CAAA;AACvE,EAAA,MAAA,GAAS,MAAM,uBAAA;AAAA,IACb,KAAA;AAAA,IACA,MAAA,CAAO,KAAK,GAAG,CAAA;AAAA,IACf,OAAA,CAAQ,WAAA;AAAA,IACR;AAAA,GACF;AACA,EAAA,cAAA;AAAA,IACE,MAAA,CAAO,QAAQ,OAAA,CAAQ,QAAA,IACrB,OAAO,GAAA,KAAQ,OAAA,CAAQ,OAAA,IACvB,MAAA,CAAO,GAAA,KAAQ,0BAAA;AAAA,IACjB;AAAA,GACF;AACA,EAAA,MAAM,YACJ,OAAA,CAAQ,OAAA,IACR,OAAO,aAAA,CAAc,OAAA,CAAQ,QAAQ,UAAU,CAAA,IAC/C,OAAA,CAAQ,OAAA,CAAQ,cAAc,EAAA,IAC9B,OAAA,CAAQ,QAAQ,SAAA,KAAe,MAAM,aAAa,KAAK,CAAA;AACzD,EAAA,MAAM,gBAAA,GACJ,cACC,OAAA,CAAQ,aAAA,KAAkB,UACzB,OAAA,CAAQ,OAAA,CAAS,aAAa,OAAA,CAAQ,aAAA,CAAA;AAC1C,EAAA,OAAO;AAAA,IACL,OAAA,EAAS,qBAAA;AAAA,IACT,mBAAA,EAAqB,KAAA;AAAA,IACrB,OAAA,EAAS,MAAA,CAAO,MAAA,CAAO,OAAO,CAAA;AAAA,IAC9B,gBAAgB,OAAO,MAAA,CAAO,MAAA,KAAW,QAAA,GAAW,OAAO,MAAA,GAAS,IAAA;AAAA,IACpE,eAAe,gBAAA,GACX,4BAAA,GACA,OAAA,CAAQ,aAAA,KAAkB,SACxB,4BAAA,GACA;AAAA,GACR;AACF;;;ACpYA,IAAM,GAAA,GAAM,gBAAA;AACZ,SAAS,KAAA,CAAM,UAAA,EAAgC,QAAA,EAAkB,GAAA,EAAa;AAC5E,EAAA,cAAA;AAAA,IACE,UAAA,CAAW,YAAY,CAAA,IACrB,UAAA,CAAW,aAAa,QAAA,IACxB,yBAAA,CAA0B,KAAK,UAAA,CAAW,KAAK,KAC/C,MAAA,CAAO,aAAA,CAAc,WAAW,SAAS,CAAA,IACzC,MAAM,UAAA,CAAW,SAAA,IACjB,OAAO,aAAA,CAAc,UAAA,CAAW,UAAU,CAAA,IAC1C,UAAA,CAAW,cAAc,GAAA,IACzB,UAAA,CAAW,aAAa,UAAA,CAAW,SAAA,IACnC,OAAO,aAAA,CAAc,UAAA,CAAW,IAAI,CAAA,IACpC,UAAA,CAAW,QAAQ,CAAA,IACnB,UAAA,CAAW,QAAQ,GAAA,IACnB,GAAA,CAAI,IAAA,CAAK,UAAA,CAAW,IAAI,CAAA;AAAA,IAC1B;AAAA,GACF;AACF;AACA,IAAM,OAAA,GAAU,CAAC,EAAA,KACf,YAAA;AAAA,EACE,iBAAA,CAAkB,CAAC,2BAAA,EAA6B,EAAA,CAAG,UAAU,EAAA,CAAG,KAAA,EAAO,EAAA,CAAG,SAAS,CAAC;AACtF,CAAA;AACK,IAAM,kBAAA,GAAqB,CAChC,EAAA,EACA,MAAA,EACA,IAAA,KACG;AACH,EAAA,cAAA,CAAe,GAAA,CAAI,IAAA,CAAK,IAAI,CAAA,EAAG,yBAAyB,CAAA;AACxD,EAAA,OAAO,YAAA;AAAA,IACL,iBAAA,CAAkB;AAAA,MAChB,oBAAA;AAAA,MACA,EAAA,CAAG,QAAA;AAAA,MACH,EAAA,CAAG,KAAA;AAAA,MACH,EAAA,CAAG,SAAA;AAAA,MACH,IAAA;AAAA,MACA;AAAA,KACD;AAAA,GACH;AACF;AACA,IAAM,OAAA,GAAU,CAAC,IAAA,EAAc,IAAA,EAAc,KAAA,KAC3C,YAAA,CAAa,iBAAA,CAAkB,CAAC,oBAAA,EAAsB,KAAA,EAAO,IAAA,EAAM,IAAI,CAAC,CAAC,CAAA;AAE3E,eAAsB,0BAA0B,KAAA,EAMhB;AAC9B,EAAA,cAAA;AAAA,IACE,KAAA,CAAM,WAAA,CAAY,MAAA,IAAU,GAAA,IAC1B,KAAA,CAAM,WAAA,CAAY,KAAA,CAAM,CAAC,IAAA,KAAS,GAAA,CAAI,IAAA,CAAK,IAAI,CAAC,CAAA;AAAA,IAClD;AAAA,GACF;AACA,EAAA,IAAI,IAAA,GAAO,MAAM,OAAA,CAAQ,KAAK,CAAA;AAC9B,EAAA,KAAA,IAAS,KAAA,GAAQ,CAAA,EAAG,KAAA,GAAQ,KAAA,CAAM,YAAY,MAAA,EAAQ,KAAA,EAAA;AACpD,IAAA,IAAA,GAAO,MAAM,OAAA,CAAQ,IAAA,EAAM,MAAM,WAAA,CAAY,KAAK,GAAI,KAAK,CAAA;AAC7D,EAAA,MAAM,EAAA,GAAyB;AAAA,IAC7B,OAAA,EAAS,CAAA;AAAA,IACT,UAAU,KAAA,CAAM,QAAA;AAAA,IAChB,OAAO,KAAA,CAAM,KAAA;AAAA,IACb,WAAW,KAAA,CAAM,SAAA;AAAA,IACjB,YAAY,KAAA,CAAM,UAAA;AAAA,IAClB,IAAA,EAAM,MAAM,WAAA,CAAY,MAAA;AAAA,IACxB;AAAA,GACF;AACA,EAAA,KAAA,CAAM,EAAA,EAAI,KAAA,CAAM,QAAA,EAAU,KAAA,CAAM,UAAU,CAAA;AAC1C,EAAA,OAAO,EAAA;AACT;AACA,eAAsB,sBAAA,CACpB,KAAA,EACA,KAAA,EACA,QAAA,EACA,OAAA,EACA;AACA,EAAA,KAAA,CAAM,KAAA,EAAO,OAAA,CAAQ,QAAA,EAAU,OAAA,CAAQ,GAAG,CAAA;AAC1C,EAAA,KAAA,CAAM,KAAA,EAAO,OAAA,CAAQ,QAAA,EAAU,OAAA,CAAQ,GAAG,CAAA;AAC1C,EAAA,IAAI,MAAM,IAAA,KAAS,CAAA;AACjB,IAAA,cAAA,CAAe,MAAM,IAAA,KAAU,MAAM,OAAA,CAAQ,KAAK,GAAI,0BAA0B,CAAA;AAClF,EAAA,cAAA;AAAA,IACE,KAAA,CAAM,KAAA,KAAU,KAAA,CAAM,KAAA,IACpB,MAAM,SAAA,KAAc,KAAA,CAAM,SAAA,IAC1B,KAAA,CAAM,UAAA,IAAc,KAAA,CAAM,UAAA,IAC1B,KAAA,CAAM,QAAQ,KAAA,CAAM,IAAA;AAAA,IACtB;AAAA,GACF;AACA,EAAA,IAAI,KAAA,CAAM,SAAS,KAAA,CAAM,IAAA;AACvB,IAAA,cAAA,CAAe,KAAA,CAAM,IAAA,KAAS,KAAA,CAAM,IAAA,EAAM,mBAAmB,CAAA;AAC/D,EAAA,IAAI,QAAA,KAAa,IAAA;AACf,IAAA,OAAO,EAAE,MAAA,EAAQ,aAAA,EAAwB,YAAA,EAAc,SAAA,EAAmB;AAC5E,EAAA,cAAA;AAAA,IACE,QAAA,CAAS,MAAA,KAAW,KAAA,CAAM,IAAA,GAAO,KAAA,CAAM,IAAA,IACrC,QAAA,CAAS,KAAA,CAAM,CAAC,IAAA,KAAS,GAAA,CAAI,IAAA,CAAK,IAAI,CAAC,CAAA;AAAA,IACzC;AAAA,GACF;AACA,EAAA,IAAI,OAAO,KAAA,CAAM,IAAA;AACjB,EAAA,KAAA,IAAS,KAAA,GAAQ,CAAA,EAAG,KAAA,GAAQ,QAAA,CAAS,MAAA,EAAQ,KAAA,EAAA;AAC3C,IAAA,IAAA,GAAO,MAAM,QAAQ,IAAA,EAAM,QAAA,CAAS,KAAK,CAAA,EAAI,KAAA,CAAM,OAAO,KAAK,CAAA;AACjE,EAAA,cAAA,CAAe,IAAA,KAAS,KAAA,CAAM,IAAA,EAAM,mBAAmB,CAAA;AACvD,EAAA,OAAO,EAAE,MAAA,EAAQ,YAAA,EAAuB,YAAA,EAAc,SAAA,EAAmB;AAC3E;AACA,eAAsB,yBAAA,CACpB,UAAA,EACA,KAAA,EACA,OAAA,EACA;AACA,EAAA,KAAA,CAAM,UAAA,EAAY,OAAA,CAAQ,QAAA,EAAU,OAAA,CAAQ,GAAG,CAAA;AAC/C,EAAA,IAAI,CAAC,KAAA,EAAO,OAAO,EAAE,MAAA,EAAQ,aAAA,EAAwB,cAAc,SAAA,EAAmB;AACtF,EAAA,cAAA;AAAA,IACE,MAAA,CAAO,aAAA,CAAc,KAAA,CAAM,KAAK,KAC9B,KAAA,CAAM,KAAA,IAAS,CAAA,IACf,KAAA,CAAM,QAAQ,UAAA,CAAW,IAAA,IACzB,KAAA,CAAM,WAAA,CAAY,WAAW,UAAA,CAAW,IAAA;AAAA,IAC1C;AAAA,GACF;AACA,EAAA,MAAM,OAAA,GAAU,MAAM,yBAAA,CAA0B;AAAA,IAC9C,GAAG,UAAA;AAAA,IACH,aAAa,KAAA,CAAM;AAAA,GACpB,CAAA;AACD,EAAA,cAAA;AAAA,IACE,OAAA,CAAQ,IAAA,KAAS,UAAA,CAAW,IAAA,IACzB,MAAM,kBAAA,CAAmB,UAAA,EAAY,KAAA,CAAM,MAAA,EAAQ,MAAM,IAAI,CAAA,KAC5D,KAAA,CAAM,WAAA,CAAY,MAAM,KAAK,CAAA;AAAA,IACjC;AAAA,GACF;AACA,EAAA,OAAO,EAAE,MAAA,EAAQ,UAAA,EAAqB,YAAA,EAAc,SAAA,EAAmB;AACzE","file":"index.js","sourcesContent":["import type { PiiMode } from \"./types.js\";\n\nexport interface AttributionAgentProof {\n linkId: string;\n nonce: string;\n issuedAt: number;\n signature: string;\n}\n\nexport interface AttributionAgentKey {\n kty: \"OKP\";\n crv: \"Ed25519\";\n x: string;\n}\n\nexport interface AttributionNetworkProof {\n iss: \"chitmark-agent-key-v1\";\n agentKey: AttributionAgentKey;\n nonce: string;\n issuedAt: number;\n signature: string;\n}\n\nexport interface AttributionResolveOptions {\n request: {\n url?: string;\n headers: Headers | Record<string, string | string[] | undefined>;\n };\n /** Explicit site origin for requests with a relative URL, such as IncomingMessage. */\n site?: string;\n /** Opaque credential supplied by the integrating server, never a raw browser cookie. */\n session?: string;\n agentProof?: AttributionAgentProof | AttributionNetworkProof;\n /** The recipient's configured disclosure purpose. Defaults to identity_attribution. */\n purpose?: string;\n piiMode?: PiiMode;\n idempotencyKey?: string;\n}\n\nexport interface AttributionResult {\n id: string;\n agent: { detected: boolean; provider: string | null; operator_verified: boolean };\n identity: {\n recognized: boolean;\n subject_id: string | null;\n scope: \"site\" | null;\n match:\n \"none\" | \"existing_session\" | \"verified_identity_link\" | \"verified_agent_account\";\n };\n principal: {\n status: \"unknown\" | \"previously_verified\" | \"withheld\";\n email: string | null;\n email_verified: boolean | null;\n current_delegation_verified: boolean | null;\n document_verified: boolean | null;\n };\n}\n\nexport interface AttributionLinkRequest {\n enrollmentId: string;\n site: string;\n agentKey: AttributionAgentKey;\n recipientKeyId: string;\n emailConsent: boolean;\n expiresAt: number;\n principalProof: string;\n}\n\nexport interface AttributionNetworkAgentRequest {\n kind: \"network_agent\";\n enrollmentId: string;\n agentKey: AttributionAgentKey;\n principalProof: string;\n agentProof: string;\n expiresAt: number;\n rotation?: { agentId: string; previousKey: AttributionAgentKey };\n}\n\nexport interface AttributionNetworkGrantRequest {\n kind: \"network_grant\";\n agentId: string;\n site: string;\n recipientKeyId: string;\n purpose: string;\n emailConsent: boolean;\n expiresAt: number;\n principalProof: string;\n}\n\nexport interface AttributionLink {\n id: string;\n expires_at: number;\n}\n\nexport function attributionEvidence(options: AttributionResolveOptions, mode: PiiMode) {\n const { request, agentProof, session, purpose, piiMode = mode } = options;\n const headers = request.headers;\n const header =\n typeof headers.get === \"function\"\n ? headers.get(\"chitmark-agent-proof\")\n : Object.entries(headers).find(\n ([name]) => name.toLowerCase() === \"chitmark-agent-proof\",\n )?.[1];\n let url: URL | undefined;\n if (!options.site && request.url) {\n try {\n url = new URL(request.url);\n } catch {\n // Relative URLs need an explicit site.\n }\n }\n const site = options.site ?? (url?.protocol === \"https:\" ? url.origin : undefined);\n const proof = agentProof ?? (site ? parseProof(header) : undefined);\n return { site, session, piiMode, purpose, agentProof: proof };\n}\n\nfunction parseProof(\n header: unknown,\n): AttributionAgentProof | AttributionNetworkProof | undefined {\n if (typeof header !== \"string\" || header.length > 2048) return;\n try {\n const value = JSON.parse(header) as Record<string, unknown> | null;\n if (\n !value ||\n typeof value.nonce !== \"string\" ||\n value.nonce.length > 36 ||\n typeof value.issuedAt !== \"number\" ||\n !Number.isSafeInteger(value.issuedAt) ||\n typeof value.signature !== \"string\" ||\n value.signature.length > 86\n )\n return;\n const { nonce, issuedAt, signature } = value;\n if (\"iss\" in value) {\n const key = value.agentKey as Record<string, unknown> | null | undefined;\n if (\n value.iss === \"chitmark-agent-key-v1\" &&\n key?.kty === \"OKP\" &&\n key.crv === \"Ed25519\" &&\n typeof key.x === \"string\" &&\n key.x.length === 43 &&\n !(\"d\" in key)\n ) {\n return {\n iss: value.iss,\n agentKey: { kty: key.kty, crv: key.crv, x: key.x },\n nonce,\n issuedAt,\n signature,\n };\n }\n return;\n }\n if (typeof value.linkId === \"string\" && value.linkId.length <= 36)\n return { linkId: value.linkId, nonce, issuedAt, signature };\n } catch {\n // Ignore malformed inbound evidence.\n }\n return undefined;\n}\n","/** Explicit sender-constrained credential profile. No static-key fallback. */\nexport interface CredentialProvider {\n headers(input: {\n url: string;\n method: string;\n signal: AbortSignal;\n }): Promise<{ Authorization: string; DPoP: string }>;\n}\nexport interface WorkloadCredential {\n accessToken: string;\n expiresAt: number;\n trustExpiresAt: number;\n revocationValidUntil: number;\n}\nconst encode = (bytes: Uint8Array) =>\n btoa(String.fromCharCode(...bytes))\n .replace(/=/g, \"\")\n .replace(/\\+/g, \"-\")\n .replace(/\\//g, \"_\");\nconst json = (value: unknown) => encode(new TextEncoder().encode(JSON.stringify(value)));\nexport async function boundedCredential<T>(\n work: Promise<T>,\n signal: AbortSignal,\n): Promise<T> {\n signal.throwIfAborted();\n let abort!: () => void;\n const aborted = new Promise<never>((_, reject) => {\n abort = () => reject(new Error(\"Credential deadline exceeded\"));\n signal.addEventListener(\"abort\", abort, { once: true });\n });\n try {\n return await Promise.race([work, aborted]);\n } finally {\n signal.removeEventListener(\"abort\", abort);\n }\n}\nexport function createDPoPCredentialProvider(options: {\n privateKey: CryptoKey;\n publicJwk: JsonWebKey;\n /** Issuer-specific authenticated exchange. Must bind tokens to publicJwk. */\n load: (signal: AbortSignal) => Promise<WorkloadCredential>;\n refreshTimeoutMs?: number;\n}): CredentialProvider {\n const { privateKey, publicJwk } = options;\n if (\n publicJwk.d ||\n publicJwk.kty !== \"EC\" ||\n publicJwk.crv !== \"P-256\" ||\n !publicJwk.x ||\n !publicJwk.y\n )\n throw new Error(\"DPoP requires a public P-256 JWK\");\n const jwk = { kty: \"EC\", crv: \"P-256\", x: publicJwk.x, y: publicJwk.y };\n let cached: WorkloadCredential | undefined;\n let pending: Promise<WorkloadCredential> | undefined;\n const valid = (c: WorkloadCredential | undefined): c is WorkloadCredential =>\n !!c &&\n typeof c.accessToken === \"string\" &&\n /^[\\w-]+\\.[\\w-]+\\.[\\w-]+$/.test(c.accessToken) &&\n [c.expiresAt, c.trustExpiresAt, c.revocationValidUntil].every(\n (v) => Number.isSafeInteger(v) && v > Date.now() / 1000 + 1,\n );\n return {\n async headers({ url, method, signal }) {\n signal.throwIfAborted();\n const target = new URL(url);\n if (target.protocol !== \"https:\" || target.username || target.password)\n throw new Error(\"DPoP requires HTTPS\");\n if (!valid(cached)) {\n if (!pending) {\n const refreshSignal = AbortSignal.timeout(options.refreshTimeoutMs ?? 500);\n // Keep an uncooperative exchange in-flight until it actually settles;\n // callers time out without spawning unbounded replacement exchanges.\n pending = Promise.resolve()\n .then(() => options.load(refreshSignal))\n .then((c) => {\n if (!valid(c) || refreshSignal.aborted) throw new Error(\"Stale credential\");\n cached = { ...c };\n return cached;\n })\n .finally(() => {\n pending = undefined;\n });\n }\n await boundedCredential(\n pending,\n AbortSignal.any([signal, AbortSignal.timeout(options.refreshTimeoutMs ?? 500)]),\n );\n }\n if (!valid(cached)) throw new Error(\"Stale credential\");\n const credential = cached;\n const token = credential.accessToken;\n const ath = encode(\n new Uint8Array(\n await crypto.subtle.digest(\"SHA-256\", new TextEncoder().encode(token)),\n ),\n );\n const payload = `${json({ typ: \"dpop+jwt\", alg: \"ES256\", jwk })}.${json({ jti: crypto.randomUUID(), iat: Math.floor(Date.now() / 1000), htm: method.toUpperCase(), htu: `${target.origin}${target.pathname}`, ath })}`;\n const signature = await crypto.subtle.sign(\n { name: \"ECDSA\", hash: \"SHA-256\" },\n privateKey,\n new TextEncoder().encode(payload),\n );\n signal.throwIfAborted();\n if (!valid(credential)) throw new Error(\"Stale credential\");\n return {\n Authorization: `DPoP ${token}`,\n DPoP: `${payload}.${encode(new Uint8Array(signature))}`,\n };\n },\n };\n}\n","import type { ChitmarkErrorBody, Decision, Verdict } from \"./types.js\";\n\n/**\n * Base error for all Chitmark client failures.\n */\nexport class ChitmarkError extends Error {\n override name = \"ChitmarkError\";\n readonly status?: number;\n readonly code?: string;\n readonly body?: ChitmarkErrorBody | string;\n\n constructor(\n message: string,\n options?: { status?: number; code?: string; body?: ChitmarkErrorBody | string },\n ) {\n super(message);\n this.status = options?.status;\n this.code = options?.code;\n this.body = options?.body;\n }\n}\n\n/**\n * Raised when the API returns a non-2xx response.\n */\nexport class ChitmarkApiError extends ChitmarkError {\n override name = \"ChitmarkApiError\";\n\n constructor(status: number, body: ChitmarkErrorBody | string, message?: string) {\n const msg =\n message ??\n (typeof body === \"string\"\n ? body\n : body.message || body.error || `Chitmark API error (${status})`);\n super(msg, {\n status,\n code: typeof body === \"object\" ? (body.code ?? body.error) : undefined,\n body,\n });\n }\n}\n\n/**\n * Build the degraded challenge verdict used on timeout / transport failure.\n * Golden rule: fail to challenge, never to allow.\n */\nexport function degradedChallengeVerdict(reason: string, session?: string): Verdict {\n return {\n decision: \"challenge\" satisfies Decision,\n actorType: \"unknown\",\n confidence: 0,\n reasons: [reason],\n principal: {\n resolved: false,\n identityBasis: [\"degraded\"],\n },\n verdictToken: \"\",\n eventId: `evt_degraded_${session ?? \"unknown\"}`,\n degraded: true,\n enforcementMode: \"enforce\",\n };\n}\n\n/**\n * Ensure degraded responses never surface as allow (defense in depth client-side).\n */\nexport function enforceDegradedNeverAllow(verdict: Verdict): Verdict {\n if (verdict.degraded && verdict.decision === \"allow\") {\n return {\n ...verdict,\n decision: \"challenge\",\n reasons: [\n ...verdict.reasons,\n \"Client enforced: degraded decision must not be allow\",\n ],\n };\n }\n return verdict;\n}\n","import type { ChitmarkEnv } from \"../types.js\";\n\nexport const DEFAULT_BASE_URLS: Record<ChitmarkEnv, string> = {\n production: \"https://api.chitmark.com\",\n staging: \"https://api.staging.chitmark.com\",\n development: \"http://127.0.0.1:8787\",\n};\n\nexport const DEFAULT_TIMEOUT_MS = 800;\n/** A cold local edge can take longer than the production budget to start. */\nexport const LOCAL_TIMEOUT_MS = 2_000;\n/** Keep in parity with the package version and the Python SDK. */\nexport const SDK_VERSION = \"0.9.0\";\n\n/** Pick the client budget from the resolved base URL. */\nexport function defaultTimeoutMs(baseUrl: string): number {\n try {\n const host = new URL(baseUrl).hostname.replace(/^\\[|\\]$/g, \"\").toLowerCase();\n return host === \"localhost\" ||\n host.endsWith(\".localhost\") ||\n host === \"127.0.0.1\" ||\n host === \"0.0.0.0\" ||\n host === \"::1\"\n ? LOCAL_TIMEOUT_MS\n : DEFAULT_TIMEOUT_MS;\n } catch {\n return DEFAULT_TIMEOUT_MS;\n }\n}\n\nexport function resolveBaseUrl(\n env: ChitmarkEnv = \"production\",\n baseUrl?: string,\n): string {\n return (baseUrl ?? DEFAULT_BASE_URLS[env]).replace(/\\/$/, \"\");\n}\n\n/**\n * CHITMARK_BASE_URL environment override, when present (Node only, no-op on\n * Workers/browsers where `process` is undefined).\n */\nexport function envBaseUrl(): string | undefined {\n if (typeof process === \"undefined\") return undefined;\n const value = process.env?.CHITMARK_BASE_URL;\n return value ? value.trim() : undefined;\n}\n","/**\n * Client-side PII minimization helpers.\n * Default SDK mode hashes email and truncates IP before leaving the customer process.\n */\n\n/**\n * SHA-256 hex digest of lowercased, trimmed email.\n * Uses Web Crypto (Node 18+, browsers, Workers).\n */\nexport async function hashEmailSha256(email: string): Promise<string> {\n const normalized = email.trim().toLowerCase();\n const data = new TextEncoder().encode(normalized);\n const digest = await crypto.subtle.digest(\"SHA-256\", data);\n return bufferToHex(digest);\n}\n\n/**\n * Truncate IPv4 to /24 or IPv6 to /48 for coarse geo without host identity.\n */\nexport function truncateIp(ip: string): string {\n const trimmed = ip.trim();\n // IPv4 (optionally from x-forwarded-for first hop)\n const first = trimmed.split(\",\")[0]?.trim() ?? trimmed;\n if (first.includes(\".\") && !first.includes(\":\")) {\n const parts = first.split(\".\");\n if (parts.length === 4) {\n return `${parts[0]}.${parts[1]}.${parts[2]}.0/24`;\n }\n }\n // IPv6: keep first 3 hextets (~/48)\n if (first.includes(\":\")) {\n const hextets = first.split(\":\").filter(Boolean);\n const head = hextets.slice(0, 3).join(\":\");\n return `${head}::/48`;\n }\n return first;\n}\n\n/**\n * Reduce form payload to non-PII keys (domain-style fields only for hashed mode).\n * Free-text is dropped; companyDomain-style keys are kept as-is when domain-like.\n */\nexport function minimizeFormData(\n formData: Record<string, unknown> | undefined,\n): Record<string, unknown> | undefined {\n if (!formData) return undefined;\n const allowed = new Set([\n \"companyDomain\",\n \"company_domain\",\n \"domain\",\n \"plan\",\n \"referrer\",\n \"utm_source\",\n \"utm_medium\",\n \"utm_campaign\",\n ]);\n const out: Record<string, unknown> = {};\n for (const [key, value] of Object.entries(formData)) {\n if (allowed.has(key) && value != null) {\n out[key] = value;\n }\n }\n return Object.keys(out).length > 0 ? out : undefined;\n}\n\nfunction bufferToHex(buffer: ArrayBuffer): string {\n const bytes = new Uint8Array(buffer);\n let hex = \"\";\n for (const b of bytes) {\n hex += b.toString(16).padStart(2, \"0\");\n }\n return hex;\n}\n","import type { PiiMode, Subject } from \"../types.js\";\nimport { hashEmailSha256, minimizeFormData, truncateIp } from \"../pii.js\";\n\n/**\n * Apply client-side PII mode to a subject before the wire.\n */\nexport async function prepareSubject(\n subject: Subject,\n piiMode: PiiMode,\n): Promise<Subject> {\n if (piiMode === \"raw\") {\n return subject;\n }\n\n if (piiMode === \"none\") {\n return {\n userAgent: subject.userAgent,\n headers: pickWebBotAuthHeaders(subject.headers),\n };\n }\n\n // hashed (default)\n const prepared: Subject = {\n userAgent: subject.userAgent,\n headers: subject.headers,\n };\n\n if (subject.emailSha256) {\n prepared.emailSha256 = subject.emailSha256;\n } else if (subject.email) {\n prepared.emailSha256 = await hashEmailSha256(subject.email);\n }\n\n if (subject.ipTrunc) {\n prepared.ipTrunc = subject.ipTrunc;\n } else if (subject.ip) {\n prepared.ipTrunc = truncateIp(subject.ip);\n }\n\n const hashedForm = subject.formDataHashed ?? minimizeFormData(subject.formData);\n if (hashedForm) {\n prepared.formDataHashed = hashedForm;\n }\n\n return prepared;\n}\n\nfunction pickWebBotAuthHeaders(\n headers?: Record<string, string | string[] | undefined>,\n): Record<string, string> | undefined {\n if (!headers) return undefined;\n const keys = [\"signature-agent\", \"signature-input\", \"signature\"];\n const out: Record<string, string> = {};\n for (const [k, v] of Object.entries(headers)) {\n const lower = k.toLowerCase();\n if (keys.includes(lower) && typeof v === \"string\") {\n out[lower] = v;\n } else if (keys.includes(lower) && Array.isArray(v) && v[0]) {\n out[lower] = v[0];\n }\n }\n return Object.keys(out).length > 0 ? out : undefined;\n}\n\n/**\n * Normalize header maps (Node / Fetch) to plain string records for JSON.\n */\nexport function flattenHeaders(\n headers?: Record<string, string | string[] | undefined> | Headers,\n): Record<string, string> | undefined {\n if (!headers) return undefined;\n if (headers instanceof Headers) {\n const out: Record<string, string> = {};\n headers.forEach((value, key) => {\n out[key.toLowerCase()] = value;\n });\n return out;\n }\n const out: Record<string, string> = {};\n for (const [k, v] of Object.entries(headers)) {\n if (typeof v === \"string\") out[k.toLowerCase()] = v;\n else if (Array.isArray(v) && v[0]) out[k.toLowerCase()] = v[0];\n }\n return out;\n}\n","/**\n * Client-side verdictToken verification.\n *\n * A verdictToken is an ES256 JWT decision receipt minted by the edge and bound\n * to session (`sub`), origin hint (`aud`), issuing tenant (`tid`), and a unique\n * `jti` (correlation id) with a short `exp` (5 minutes). Every signed token\n * requires a `kid` in the JWT header. Signature verification proves\n * authenticity and integrity; it does not make the JWT single-use. This module\n * always enforces `session` and `tenantId` (security boundary), validates\n * `iss` against the Chitmark issuer, and optionally `aud`. `aud` reflects\n * request headers and is attacker influenced: never enforce `aud` alone.\n * Rejection reasons are surfaced as `VerdictTokenError.code`.\n *\n * JWKS: respect `Cache-Control` and, when present, `ETag` /\n * `Last-Modified` via conditional requests (instead of a hard-coded\n * refresh interval). Refresh immediately on unknown `kid`. Do not fetch on\n * every verification; never permanently pin a single signing key. Each JWKS\n * key is EC P-256 for ES256: require JWT `alg === \"ES256\"` before verifying\n * (`wrong_algorithm` otherwise); never trust the token-requested algorithm.\n * Rotation overlaps old and new keys; keep the retiring key until tokens under it\n * expire (≥ 5 minutes + 60 seconds). Pass a cached `jwks` option to skip\n * the network call. An empty JWKS (`keys: []`) means no token can be\n * cryptographically verified: fail closed; never treat an empty set as\n * evidence that a token is valid (local/CI may emit `unsigned.<eventId>`).\n */\n\nimport { ChitmarkError } from \"./errors.js\";\nimport type { ActorType, Decision } from \"./types.js\";\n\n/** Canonical issuer claim on every signed verdictToken. */\nexport const VERDICT_TOKEN_ISSUER = \"https://api.chitmark.com\";\n\nexport interface VerdictTokenClaims {\n /** Issuer: https://api.chitmark.com. */\n iss: string;\n eventId: string;\n decision: Decision;\n actorType: ActorType;\n confidence: number;\n aud: string;\n sub: string;\n /** Issuing tenant, server-derived from the API key used at verify time. */\n tid: string;\n /** Unique token identifier (correlation). Not single-use unless you track it. */\n jti: string;\n iat: number;\n exp: number;\n degraded: boolean;\n}\n\nexport type VerdictTokenErrorCode =\n | \"malformed_token\"\n | \"wrong_algorithm\"\n | \"wrong_type\"\n | \"jwks_unavailable\"\n | \"unknown_kid\"\n | \"invalid_signature\"\n | \"expired\"\n | \"not_yet_valid\"\n | \"wrong_issuer\"\n | \"wrong_session\"\n | \"wrong_aud\"\n | \"wrong_tenant\"\n | \"wrong_action_binding\";\n\nexport class VerdictTokenError extends ChitmarkError {\n override name = \"VerdictTokenError\";\n\n constructor(code: VerdictTokenErrorCode, message: string) {\n super(message, { code });\n }\n}\n\nexport interface VerifyVerdictTokenOptions {\n /** Expected session: token `sub` must equal this or verification fails. */\n session: string;\n /** Expected issuing tenant: token `tid` must equal this or verification fails. */\n tenantId: string;\n /** Expected origin hint: token `aud` must equal this or verification fails. */\n aud?: string;\n /**\n * Expected issuer (`iss`). Defaults to {@link VERDICT_TOKEN_ISSUER}.\n * Override only in tests.\n */\n issuer?: string;\n /** JWKS URL; defaults to https://api.chitmark.com/.well-known/jwks.json. */\n jwksUrl?: string;\n /**\n * Pre-fetched / cached JWKS; skips the network fetch when provided.\n * Prefer caching via HTTP headers (`Cache-Control`, `ETag`, and\n * `Last-Modified` when present) with conditional refresh and immediate\n * refresh on unknown `kid`, rather than fetching on every verification.\n */\n jwks?: { keys: Array<Record<string, unknown>> };\n /** Injectable fetch (Node 24+/browsers have a global). */\n fetch?: typeof fetch;\n /** Clock override for tests. */\n nowMs?: number;\n /** Clock skew tolerance in seconds; defaults to 30. */\n leewaySeconds?: number;\n}\n\nconst DEFAULT_JWKS_URL = \"https://api.chitmark.com/.well-known/jwks.json\";\nconst DEFAULT_LEEWAY_SECONDS = 30;\n\n/**\n * Verify a verdictToken signature and binding.\n *\n * `session` and `tenantId` are required: they are the security boundary for\n * cross-service authorization, not optional hints.\n */\nexport async function verifyVerdictToken(\n token: string,\n options: VerifyVerdictTokenOptions,\n): Promise<VerdictTokenClaims> {\n return verifyReceipt(token, options, \"JWT\");\n}\n\n/** Actions whose receipts require `tenant_step_up` proof and a bound subject. */\nexport const SENSITIVE_RECEIPT_ACTIONS = [\n \"api_key\",\n \"data_export\",\n \"session_establish\",\n \"privilege_elevate\",\n \"authenticator_replace\",\n \"recovery_contact_change\",\n \"session_use\",\n \"privilege_change\",\n \"release_deploy\",\n \"bulk_mutation\",\n \"commitment_change\",\n \"agent_effect\",\n \"agent_escalation\",\n \"quote_generate\",\n \"queue_priority\",\n] as const;\n\nexport type SensitiveReceiptAction = (typeof SENSITIVE_RECEIPT_ACTIONS)[number];\n\nexport interface VerifyActionReceiptOptions extends Omit<\n VerifyVerdictTokenOptions,\n \"aud\" | \"issuer\" | \"leewaySeconds\"\n> {\n audience: string;\n action: \"trial_activation\" | SensitiveReceiptAction;\n subject?: string;\n environment: \"test\" | \"live\";\n surface: string;\n digest: string;\n policy: string;\n proof: \"none\" | \"pow_severe\" | \"tenant_step_up\";\n}\n\nexport interface ActionReceiptClaims extends VerdictTokenClaims {\n action: \"trial_activation\" | SensitiveReceiptAction;\n subject?: string;\n environment: \"test\" | \"live\";\n surface: string;\n digest: string;\n policy: string;\n proof: \"none\" | \"pow_severe\" | \"tenant_step_up\";\n enforcementMode: \"enforce\";\n}\n\n/** Verify authorization for an exact operation, using trusted expected values. */\nexport async function verifyActionReceipt(\n token: string,\n options: VerifyActionReceiptOptions,\n): Promise<ActionReceiptClaims> {\n const claims = (await verifyReceipt(\n token,\n {\n ...options,\n aud: options.audience,\n issuer: VERDICT_TOKEN_ISSUER,\n leewaySeconds: 0,\n },\n \"chitmark-action+jwt\",\n )) as ActionReceiptClaims;\n const now = Math.floor((options.nowMs ?? Date.now()) / 1000);\n if (\n !options.audience ||\n !options.session ||\n !options.tenantId ||\n !options.policy ||\n !/^[a-f0-9]{64}$/.test(options.digest) ||\n !(options.action === \"trial_activation\"\n ? options.proof === \"none\" || options.proof === \"pow_severe\"\n : (SENSITIVE_RECEIPT_ACTIONS as readonly string[]).includes(options.action) &&\n options.proof === \"tenant_step_up\" &&\n typeof options.subject === \"string\" &&\n /^[A-Za-z0-9_-]{1,128}$/.test(options.subject) &&\n claims.subject === options.subject) ||\n claims.action !== options.action ||\n (options.environment !== \"test\" && options.environment !== \"live\") ||\n claims.environment !== options.environment ||\n !options.surface ||\n claims.surface !== options.surface ||\n claims.digest !== options.digest ||\n claims.policy !== options.policy ||\n claims.proof !== options.proof ||\n claims.enforcementMode !== \"enforce\" ||\n claims.decision !== \"allow\" ||\n claims.degraded !== false ||\n typeof claims.eventId !== \"string\" ||\n !claims.eventId ||\n !Number.isSafeInteger(claims.iat) ||\n !Number.isSafeInteger(claims.exp) ||\n claims.iat > now ||\n claims.exp <= now ||\n claims.exp - claims.iat !== 60\n ) {\n throw new VerdictTokenError(\n \"wrong_action_binding\",\n \"Receipt cannot authorize this operation\",\n );\n }\n return claims;\n}\n\nasync function verifyReceipt(\n token: string,\n options: VerifyVerdictTokenOptions,\n expectedType: \"JWT\" | \"chitmark-action+jwt\",\n): Promise<VerdictTokenClaims> {\n const nowMs = options.nowMs ?? Date.now();\n const leewaySeconds = options.leewaySeconds ?? DEFAULT_LEEWAY_SECONDS;\n\n const parts = token.split(\".\");\n if (parts.length !== 3) {\n throw new VerdictTokenError(\"malformed_token\", \"verdictToken must be a JWT\");\n }\n const [headerB64, payloadB64, signatureB64] = parts as [string, string, string];\n\n let header: Record<string, unknown>;\n let payload: Record<string, unknown>;\n try {\n header = JSON.parse(decodeBase64Url(headerB64)) as Record<string, unknown>;\n payload = JSON.parse(decodeBase64Url(payloadB64)) as Record<string, unknown>;\n } catch {\n throw new VerdictTokenError(\"malformed_token\", \"verdictToken is not valid JWT JSON\");\n }\n\n if (header[\"alg\"] !== \"ES256\") {\n throw new VerdictTokenError(\n \"wrong_algorithm\",\n `verdictToken must use ES256, got ${String(header[\"alg\"])}`,\n );\n }\n // RFC 8725 §3.11: explicit typing keeps this receipt distinct from any\n // other JWT a tenant might accept. The edge always mints typ \"JWT\".\n if (header[\"typ\"] !== expectedType) {\n throw new VerdictTokenError(\n \"wrong_type\",\n `verdictToken must have type ${expectedType}, got ${String(header[\"typ\"])}`,\n );\n }\n const kid = typeof header[\"kid\"] === \"string\" ? header[\"kid\"] : \"\";\n if (!kid) {\n throw new VerdictTokenError(\"unknown_kid\", \"verdictToken is missing kid\");\n }\n\n const exp = typeof payload[\"exp\"] === \"number\" ? payload[\"exp\"] : NaN;\n const iat = typeof payload[\"iat\"] === \"number\" ? payload[\"iat\"] : NaN;\n const nowSeconds = Math.floor(nowMs / 1000);\n if (Number.isFinite(exp) && exp < nowSeconds - leewaySeconds) {\n throw new VerdictTokenError(\"expired\", \"verdictToken has expired\");\n }\n if (Number.isFinite(iat) && iat > nowSeconds + leewaySeconds) {\n throw new VerdictTokenError(\"not_yet_valid\", \"verdictToken iat is in the future\");\n }\n\n const expectedIssuer = options.issuer ?? VERDICT_TOKEN_ISSUER;\n if (payload[\"iss\"] !== expectedIssuer) {\n throw new VerdictTokenError(\n \"wrong_issuer\",\n \"verdictToken was not issued by Chitmark\",\n );\n }\n if (payload[\"sub\"] !== options.session) {\n throw new VerdictTokenError(\n \"wrong_session\",\n \"verdictToken was minted for a different session\",\n );\n }\n if (payload[\"tid\"] !== options.tenantId) {\n throw new VerdictTokenError(\n \"wrong_tenant\",\n \"verdictToken was minted for a different tenant\",\n );\n }\n const expectedAud = options.aud;\n if (expectedAud !== undefined && payload[\"aud\"] !== expectedAud) {\n throw new VerdictTokenError(\n \"wrong_aud\",\n \"verdictToken was minted for a different origin\",\n );\n }\n\n const jwk = await findJwk(kid, options);\n if (!jwk) {\n throw new VerdictTokenError(\"unknown_kid\", `JWKS has no key for kid ${kid}`);\n }\n\n if (\n jwk[\"kty\"] !== \"EC\" ||\n jwk[\"crv\"] !== \"P-256\" ||\n (jwk[\"alg\"] !== undefined && jwk[\"alg\"] !== \"ES256\")\n ) {\n throw new VerdictTokenError(\n \"wrong_algorithm\",\n \"Verification requires an ES256 P-256 key\",\n );\n }\n\n let publicKey: CryptoKey;\n try {\n publicKey = await crypto.subtle.importKey(\n \"jwk\",\n jwk as unknown as JsonWebKey,\n { name: \"ECDSA\", namedCurve: \"P-256\" },\n false,\n [\"verify\"],\n );\n } catch {\n throw new VerdictTokenError(\n \"invalid_signature\",\n \"JWKS key is not a valid P-256 public key\",\n );\n }\n\n const signatureBytes = decodeBase64UrlBytes(signatureB64);\n const signatureBuffer = new ArrayBuffer(signatureBytes.byteLength);\n new Uint8Array(signatureBuffer).set(signatureBytes);\n\n const valid = await crypto.subtle.verify(\n { name: \"ECDSA\", hash: \"SHA-256\" },\n publicKey,\n signatureBuffer,\n new TextEncoder().encode(`${headerB64}.${payloadB64}`),\n );\n if (!valid) {\n throw new VerdictTokenError(\n \"invalid_signature\",\n \"verdictToken signature failed verification\",\n );\n }\n\n return payload as unknown as VerdictTokenClaims;\n}\n\nasync function findJwk(\n kid: string,\n options: VerifyVerdictTokenOptions,\n): Promise<Record<string, unknown> | undefined> {\n let jwks = options.jwks;\n if (!jwks) {\n const jwksUrl = options.jwksUrl ?? DEFAULT_JWKS_URL;\n try {\n const fetchImpl = options.fetch ?? globalThis.fetch.bind(globalThis);\n const res = await fetchImpl(jwksUrl);\n if (!res.ok) {\n throw new Error(`JWKS fetch failed with ${res.status}`);\n }\n jwks = (await res.json()) as { keys: Array<Record<string, unknown>> };\n } catch (err) {\n throw new VerdictTokenError(\n \"jwks_unavailable\",\n `Failed to load JWKS from ${jwksUrl}: ${\n err instanceof Error ? err.message : \"unknown error\"\n }`,\n );\n }\n }\n if (!Array.isArray(jwks.keys)) {\n throw new VerdictTokenError(\"jwks_unavailable\", \"JWKS response has no keys array\");\n }\n return jwks.keys.find((key) => key[\"kid\"] === kid);\n}\n\nfunction decodeBase64Url(value: string): string {\n const normalized = value.replace(/-/g, \"+\").replace(/_/g, \"/\");\n const padded = normalized + \"=\".repeat((4 - (normalized.length % 4)) % 4);\n const binary = atob(padded);\n return new TextDecoder().decode(Uint8Array.from(binary, (ch) => ch.charCodeAt(0)));\n}\n\nfunction decodeBase64UrlBytes(value: string): Uint8Array {\n const normalized = value.replace(/-/g, \"+\").replace(/_/g, \"/\");\n const padded = normalized + \"=\".repeat((4 - (normalized.length % 4)) % 4);\n const binary = atob(padded);\n const out = new Uint8Array(binary.length);\n for (let i = 0; i < binary.length; i += 1) out[i] = binary.charCodeAt(i);\n return out;\n}\n","import {\n attributionEvidence,\n type AttributionLink,\n type AttributionLinkRequest,\n type AttributionNetworkAgentRequest,\n type AttributionNetworkGrantRequest,\n type AttributionResolveOptions,\n type AttributionResult,\n} from \"./attribution.js\";\nimport { boundedCredential, type CredentialProvider } from \"./credentials.js\";\nimport type { ChargeRequest, ChargeResponse } from \"./charge.js\";\nimport {\n ChitmarkApiError,\n ChitmarkError,\n degradedChallengeVerdict,\n enforceDegradedNeverAllow,\n} from \"./errors.js\";\nimport {\n SDK_VERSION,\n defaultTimeoutMs,\n envBaseUrl,\n resolveBaseUrl,\n} from \"./internal/constants.js\";\nimport { flattenHeaders, prepareSubject } from \"./internal/prepare.js\";\nimport {\n verifyVerdictToken,\n type VerdictTokenClaims,\n type VerifyVerdictTokenOptions,\n} from \"./verify-token.js\";\nimport type {\n ChallengeRequest,\n ChallengeResponse,\n ChallengeCompletionResponse,\n ChallengeProof,\n ChitmarkOptions,\n FeedbackRequest,\n FeedbackResponse,\n OnDegraded,\n PiiMode,\n Verdict,\n VerifyRequest,\n} from \"./types.js\";\n\n/**\n * Official Chitmark client: security operations and the paid-access lifecycle.\n * Trust decisions on agent-mediated actions, tuned by business outcomes.\n *\n * @example\n * ```ts\n * const chitmark = new Chitmark({ apiKey: process.env.CHITMARK_API_KEY! });\n * const verdict = await chitmark.verify({\n * action: \"signup\",\n * subject: { email, ip, userAgent },\n * });\n * ```\n */\nexport class Chitmark {\n readonly attribution = {\n resolve: (input: AttributionResolveOptions): Promise<AttributionResult> =>\n this.request(\"/v1/attributions/resolve\", {\n method: \"POST\",\n body: attributionEvidence(input, this.piiMode),\n idempotencyKey: input.idempotencyKey,\n }),\n get: (id: string): Promise<AttributionResult> =>\n this.request(`/v1/attributions/${encodeURIComponent(id)}`, { method: \"GET\" }),\n createLink: (\n input:\n | AttributionLinkRequest\n | AttributionNetworkAgentRequest\n | AttributionNetworkGrantRequest,\n idempotencyKey?: string,\n ): Promise<AttributionLink> =>\n this.request(\"/v1/identity-links\", { method: \"POST\", body: input, idempotencyKey }),\n revokeLink: (id: string): Promise<void> =>\n this.request(`/v1/identity-links/${encodeURIComponent(id)}`, { method: \"DELETE\" }),\n };\n\n /** Paid access lifecycle. Transport uncertainty must be resumed, never treated as payment. */\n async charge(request: ChargeRequest): Promise<ChargeResponse> {\n return this.request<ChargeResponse>(\"/v1/charge\", {\n method: \"POST\",\n body: request,\n idempotencyKey: request.idempotencyKey,\n timeoutMs: Math.max(this.timeoutMs, 15_000),\n });\n }\n private readonly apiKey?: string;\n private readonly credentialProvider?: CredentialProvider;\n private readonly baseUrl: string;\n private readonly timeoutMs: number;\n private readonly piiMode: PiiMode;\n private readonly onDegraded: OnDegraded;\n private readonly fetchImpl: typeof fetch;\n private readonly clientName: string;\n\n constructor(options: ChitmarkOptions) {\n if (!!options.apiKey === !!options.credentialProvider) {\n throw new ChitmarkError(\"Chitmark apiKey is required\");\n }\n if (options.onDegraded && options.onDegraded !== \"challenge\") {\n throw new ChitmarkError(\n 'onDegraded must be \"challenge\": fail to challenge, never to allow',\n );\n }\n this.apiKey = options.apiKey;\n this.credentialProvider = options.credentialProvider;\n this.baseUrl = resolveBaseUrl(options.env, options.baseUrl ?? envBaseUrl());\n this.timeoutMs = options.timeoutMs ?? defaultTimeoutMs(this.baseUrl);\n this.piiMode = options.piiMode ?? \"hashed\";\n this.onDegraded = \"challenge\";\n this.fetchImpl = options.fetch ?? globalThis.fetch.bind(globalThis);\n this.clientName = options.clientName ?? `chitmark-node/${SDK_VERSION}`;\n }\n\n /**\n * Score + route an inbound action (signup / trial / …).\n * Client budget defaults to 800ms (2000ms for local base URLs).\n *\n * Store-outage degradation arrives as **HTTP 200** with a Verdict body\n * (`degraded: true`, `decision: \"challenge\"`). The SDK deserializes that\n * like any other Verdict. Verify never returns HTTP 503.\n *\n * HTTP 4xx / 429 Error responses throw `ChitmarkApiError`. Transport\n * timeout / network failure (or a malformed 200 body) synthesizes a local\n * degraded challenge Verdict (never allow, never crashes).\n *\n * Persist `v.eventId` on the account row: feedback joins only on that id.\n */\n async verify(request: VerifyRequest): Promise<Verdict> {\n const subject = await prepareSubject(\n {\n ...request.subject,\n headers: flattenHeaders(request.subject.headers),\n },\n this.piiMode,\n );\n\n const body: VerifyRequest = {\n ...request,\n subject,\n };\n\n try {\n const verdict = await this.request<Verdict>(\"/v1/verify\", {\n method: \"POST\",\n body,\n idempotencyKey: request.idempotencyKey,\n });\n if (!isWellFormedVerdict(verdict)) {\n return degradedChallengeVerdict(\n \"Degraded: verify returned a malformed verdict shape\",\n request.session,\n );\n }\n return enforceDegradedNeverAllow(verdict);\n } catch (err) {\n if (err instanceof ChitmarkApiError) {\n throw err;\n }\n return degradedChallengeVerdict(\n err instanceof Error ? `Degraded: ${err.message}` : \"Degraded: verify failed\",\n request.session,\n );\n }\n }\n\n /**\n * Report a downstream outcome joined on the stored eventId from verify.\n *\n * Security invariant: feedback cannot create attribution. It only attaches\n * an outcome to an existing verify event for this tenant. Unknown or\n * cross-tenant eventIds return 404. Never invent a join from email/IP.\n *\n * Append-only (not latest-wins): multiple outcomes may attach to one\n * eventId. Exact duplicates share one feedbackId. Compatible labels\n * coexist; conflicting pairs quarantine the new observation without\n * deleting prior evidence. HTTP `{ ok: true }` still acknowledges\n * quarantined ingest.\n *\n * `idempotencyKey` is sent as both the Idempotency-Key header and body field\n * (header takes precedence server-side) so exact retries replay the original\n * acknowledgement.\n */\n async feedback(request: FeedbackRequest): Promise<FeedbackResponse> {\n return this.request<FeedbackResponse>(\"/v1/feedback\", {\n method: \"POST\",\n body: request,\n idempotencyKey: request.idempotencyKey,\n });\n }\n\n /**\n * Issue an asymmetric-cost challenge after decision === challenge | degraded.\n */\n async challenge(request: ChallengeRequest): Promise<ChallengeResponse> {\n return this.request<ChallengeResponse>(\"/v1/challenge\", {\n method: \"POST\",\n body: request,\n });\n }\n\n /**\n * Complete a challenge by submitting its solved proof. Clears only the bound\n * session, once. Does not authorize the action: re-verify with\n * `context.challengeId` for standalone challenges or the original action\n * binding plus the challenge and event IDs for operation-bound challenges.\n */\n async completeChallenge(request: {\n eventId: string;\n challengeId: string;\n session: string;\n proof: ChallengeProof;\n }): Promise<ChallengeCompletionResponse> {\n return this.request<ChallengeCompletionResponse>(\"/v1/challenge\", {\n method: \"POST\",\n body: request,\n });\n }\n\n /**\n * Verify a verdictToken's signature against the API's JWKS and its session /\n * tenant binding. Prefers a cached `jwks` (refresh periodically and on\n * unknown `kid`); do not fetch on every call. Rejects expired tokens,\n * unknown kids, and invalid signatures with `VerdictTokenError`. Always\n * pass `session` and `tenantId` (required security boundary); `aud`\n * optionally enforces the origin hint only.\n */\n async verifyVerdictToken(\n token: string,\n options: Omit<VerifyVerdictTokenOptions, \"jwksUrl\" | \"fetch\">,\n ): Promise<VerdictTokenClaims> {\n return verifyVerdictToken(token, {\n ...options,\n jwksUrl: `${this.baseUrl}/.well-known/jwks.json`,\n fetch: this.fetchImpl,\n });\n }\n\n /**\n * Low-level HTTP helper. Prefer verify / feedback / challenge.\n */\n async request<T>(\n path: string,\n init: {\n method: string;\n body?: unknown;\n idempotencyKey?: string;\n timeoutMs?: number;\n },\n ): Promise<T> {\n const controller = new AbortController();\n const timeoutMs = init.timeoutMs ?? this.timeoutMs;\n const timer = setTimeout(() => controller.abort(), timeoutMs);\n\n try {\n const headers: Record<string, string> = {\n ...(this.apiKey ? { Authorization: `Bearer ${this.apiKey}` } : {}),\n \"Content-Type\": \"application/json\",\n Accept: \"application/json\",\n \"User-Agent\": this.clientName,\n \"X-Chitmark-Client\": this.clientName,\n };\n if (this.credentialProvider) {\n try {\n Object.assign(\n headers,\n await boundedCredential(\n this.credentialProvider.headers({\n url: `${this.baseUrl}${path}`,\n method: init.method,\n signal: controller.signal,\n }),\n controller.signal,\n ),\n );\n } catch {\n throw new ChitmarkError(\"Credential unavailable\", { code: \"credential\" });\n }\n if (!headers.Authorization?.startsWith(\"DPoP \") || !headers.DPoP)\n throw new ChitmarkError(\"Invalid DPoP credentials\");\n }\n if (init.idempotencyKey) {\n headers[\"Idempotency-Key\"] = init.idempotencyKey;\n }\n\n const res = await this.fetchImpl(`${this.baseUrl}${path}`, {\n method: init.method,\n headers,\n body: init.body !== undefined ? JSON.stringify(init.body) : undefined,\n signal: controller.signal,\n redirect: \"error\",\n });\n\n const text = await res.text();\n let parsed: unknown = undefined;\n if (text) {\n try {\n parsed = JSON.parse(text) as unknown;\n } catch {\n parsed = text;\n }\n }\n\n if (!res.ok) {\n const errBody =\n typeof parsed === \"object\" && parsed !== null\n ? (parsed as { error?: string; message?: string; code?: string })\n : text;\n const normalized =\n typeof errBody === \"string\"\n ? errBody\n : {\n error: errBody.error ?? `http_${res.status}`,\n message: errBody.message,\n code: errBody.code,\n };\n throw new ChitmarkApiError(res.status, normalized);\n }\n\n return parsed as T;\n } catch (err) {\n if (err instanceof ChitmarkApiError) throw err;\n if (err instanceof Error && err.name === \"AbortError\") {\n throw new ChitmarkError(`Request timed out after ${timeoutMs}ms`, {\n code: \"timeout\",\n });\n }\n throw err instanceof Error\n ? new ChitmarkError(err.message, { code: \"transport\" })\n : new ChitmarkError(\"Unknown transport error\", { code: \"transport\" });\n } finally {\n clearTimeout(timer);\n }\n }\n\n /** Public accessors for inspection / tests. */\n get config(): {\n baseUrl: string;\n timeoutMs: number;\n piiMode: PiiMode;\n onDegraded: OnDegraded;\n } {\n return {\n baseUrl: this.baseUrl,\n timeoutMs: this.timeoutMs,\n piiMode: this.piiMode,\n onDegraded: this.onDegraded,\n };\n }\n}\n\nconst VERDICT_DECISIONS: ReadonlySet<string> = new Set([\"allow\", \"challenge\", \"deny\"]);\n\n/**\n * Minimal shape guard for a 200 verify response. A malformed verdict must\n * never be treated as allow: the gating fields are what gate correctness.\n */\nexport function isWellFormedVerdict(value: unknown): value is Verdict {\n if (typeof value !== \"object\" || value === null) return false;\n const v = value as Partial<Verdict>;\n return (\n typeof v.decision === \"string\" &&\n VERDICT_DECISIONS.has(v.decision) &&\n typeof v.eventId === \"string\" &&\n v.eventId.length > 0 &&\n typeof v.degraded === \"boolean\"\n );\n}\n","/** Integer USD cents. Customer purchases are separate from Chitmark subscriptions. */\nexport interface PaidResource {\n resourceId: string;\n version: number;\n kind: \"api_call\" | \"dataset\" | \"compute\";\n unit: \"call\" | \"access\" | \"compute_second\";\n unitAmount: number;\n currency: \"usd\";\n minQuantity: number;\n maxQuantity: number;\n maxAmount: number;\n quoteTtlSeconds: number;\n accessTtlSeconds: number;\n enabled: boolean;\n refundTerms: \"unused_only\";\n}\ntype ChargeBase = { sellerTenantId: string; idempotencyKey?: string };\ntype PurchaseRef = ChargeBase & { purchaseId: string };\nexport type ChargeRequest =\n | (ChargeBase & { operation: \"resource\"; resourceId: string })\n | (ChargeBase & {\n operation: \"quote\";\n resourceId: string;\n quantity: number;\n operationDigest: string;\n })\n | (PurchaseRef & {\n operation: \"accept\";\n quoteVersion: string;\n maxAmount: number;\n currency: \"usd\";\n })\n | (PurchaseRef & { operation: \"status\" | \"cancel\" | \"reconcile\" })\n | (PurchaseRef & { operation: \"permission\"; allowed: boolean; eventId?: string })\n | (PurchaseRef & {\n operation: \"reserve\";\n executionId: string;\n operationDigest: string;\n units: number;\n })\n | (PurchaseRef & {\n operation: \"usage\";\n executionId: string;\n sequence: number;\n usedUnits: number;\n result: \"delivered\" | \"failed\" | \"unknown\";\n })\n | (PurchaseRef & { operation: \"refund\"; amount: number })\n | (ChargeBase & { operation: \"configure\"; resource: PaidResource })\n | (ChargeBase & { operation: \"budget\"; buyerTenantId: string; limit: number });\n\nexport interface ChargeQuote {\n version: string;\n sellerTenantId: string;\n buyerTenantId: string;\n actingAgent: string;\n resource: PaidResource;\n quantity: number;\n amount: number;\n currency: \"usd\";\n operationDigest: string;\n expiresAt: number;\n accessUntil: number;\n}\nexport interface ChargeExecution {\n executionId: string;\n /** Original seller-owned verify event captured at reservation, when required. */\n eventId?: string;\n units: number;\n usedUnits: number;\n sequence: number;\n state: \"reserved\" | \"delivered\" | \"failed\" | \"unknown\";\n leaseUntil: number;\n}\nexport interface ChargePurchase {\n purchaseId: string;\n quote: ChargeQuote;\n accepted: boolean;\n permission: { allowed: boolean; source: \"seller\"; eventId?: string };\n payment: {\n state:\n | \"pending\"\n | \"authorized\"\n | \"settled\"\n | \"failed\"\n | \"canceled\"\n | \"partially_refunded\"\n | \"refunded\"\n | \"disputed\"\n | \"unknown\";\n authorizedAmount: number;\n capturedAmount: number;\n refundedAmount: number;\n refundState?: \"none\" | \"pending\" | \"succeeded\" | \"failed\" | \"unknown\";\n disputedAmount: number;\n providerFee: number | null;\n checkedAt: number | null;\n source: \"provider\";\n };\n delivery: { source: \"seller_report\"; executions: ChargeExecution[] };\n stopped: boolean;\n refundRequestedAmount: number;\n createdAt: number;\n updatedAt: number;\n checkoutUrl?: string;\n}\nexport type ChargeResponse =\n | {\n ok: true;\n purchase: ChargePurchase;\n next:\n | \"accept\"\n | \"pay\"\n | \"wait\"\n | \"seller_permission\"\n | \"execute\"\n | \"reconcile\"\n | \"complete\";\n reservation?: { executionId: string; granted: boolean; leaseUntil: number };\n }\n | { ok: true; resource: PaidResource }\n | { ok: true; budget: { limit: number; committed: number } };\n\n/** Operational summary, never an execution authorization. Seller cost is optional\n * application evidence; absent cost/fees leaves margin unknown. */\nexport function summarizeCharge(\n p: ChargePurchase,\n now = Date.now(),\n sellerCostCents?: number,\n) {\n if (\n sellerCostCents !== undefined &&\n (!Number.isSafeInteger(sellerCostCents) || sellerCostCents < 0)\n )\n throw new Error(\"Invalid seller cost\");\n const deliveredUnits = p.delivery.executions.reduce(\n (n, e) => n + (e.state === \"delivered\" ? e.usedUnits : 0),\n 0,\n );\n const unresolvedUnits = p.delivery.executions.reduce(\n (n, e) => n + (e.state === \"reserved\" || e.state === \"unknown\" ? e.units : 0),\n 0,\n );\n const net =\n p.payment.providerFee === null\n ? null\n : p.payment.capturedAmount - p.payment.refundedAmount - p.payment.providerFee;\n return {\n paidCompletion:\n p.payment.state === \"settled\" &&\n p.payment.capturedAmount > 0 &&\n p.payment.refundedAmount === 0 &&\n p.payment.disputedAmount === 0 &&\n deliveredUnits === p.quote.quantity,\n billedCents: p.payment.capturedAmount - p.payment.refundedAmount,\n sellerReportedDeliveredCents: deliveredUnits * p.quote.resource.unitAmount,\n deliveredUnits,\n unresolvedUnits,\n unresolvedAgeUpperBoundMs:\n p.payment.state === \"pending\" ||\n p.payment.refundState === \"pending\" ||\n p.payment.refundState === \"unknown\" ||\n p.payment.state === \"unknown\" ||\n unresolvedUnits > 0\n ? Math.max(0, now - p.createdAt)\n : null,\n refundedCents: p.payment.refundedAmount,\n disputedCents: p.payment.disputedAmount,\n captureFeeCents: p.payment.providerFee,\n sellerNetAfterCaptureFeeCents: net,\n sellerMarginCents:\n net === null || sellerCostCents === undefined ? null : net - sellerCostCents,\n // Provider/application reconciliation must supply duplicate evidence; retries alone do not prove absence.\n duplicateCharges: null,\n duplicateEffects: null,\n observedElapsedMs: Math.max(0, p.updatedAt - p.createdAt),\n };\n}\n","import type { Verdict } from \"./types.js\";\n\nexport const CHITMARK_HTTP_STATUS = {\n ok: 200,\n created: 201,\n badRequest: 400,\n unauthorized: 401,\n forbidden: 403,\n notFound: 404,\n conflict: 409,\n preconditionRequired: 428,\n tooManyRequests: 429,\n} as const;\n\nexport type ChitmarkHttpStatus =\n (typeof CHITMARK_HTTP_STATUS)[keyof typeof CHITMARK_HTTP_STATUS];\n\nexport const CHITMARK_HTTP_STATUS_MEANING = {\n ok: \"Request succeeded. For verify gates, continue only after an explicit non-degraded allow.\",\n created: \"Resource was created after an explicit non-degraded allow.\",\n badRequest: \"Required request fields are missing or malformed.\",\n unauthorized: \"API key is missing or invalid.\",\n forbidden: \"Verify returned deny; block the action.\",\n notFound: \"Referenced Chitmark resource was not found.\",\n conflict: \"Idempotency key is already associated with a different payload fingerprint.\",\n preconditionRequired:\n \"428 means the request is not rejected permanently; a required verification precondition must be satisfied before the action can proceed.\",\n tooManyRequests: \"Request was rate limited.\",\n} as const satisfies Record<keyof typeof CHITMARK_HTTP_STATUS, string>;\n\n/**\n * Explicit non-degraded allow. Use this (or `isEligibleAllow`) before any\n * protected action so unknown / malformed decisions cannot fall through.\n */\nexport type EligibleAllowVerdict = Verdict & {\n decision: \"allow\";\n degraded: false;\n};\n\n/**\n * Type guard for the only verdict that may continue a gated action.\n * Fail closed: anything that is not an explicit non-degraded allow is ineligible.\n */\nexport function isEligibleAllow(verdict: Verdict): verdict is EligibleAllowVerdict {\n return verdict.decision === \"allow\" && !verdict.degraded;\n}\n\n/**\n * Map a verify verdict to an HTTP status for framework drop-ins.\n * Unknown or malformed decisions fail to challenge (428), never to allow (200).\n */\nexport function verdictToHttpStatus(verdict: Verdict): ChitmarkHttpStatus {\n if (verdict.degraded || verdict.decision === \"challenge\") {\n return CHITMARK_HTTP_STATUS.preconditionRequired;\n }\n if (verdict.decision === \"deny\") return CHITMARK_HTTP_STATUS.forbidden;\n if (!isEligibleAllow(verdict)) {\n return CHITMARK_HTTP_STATUS.preconditionRequired;\n }\n return CHITMARK_HTTP_STATUS.ok;\n}\n","/** Server-owned operation for the trial credit grant profile. Use opaque IDs. */\nexport interface TrialCreditOperation {\n operationId: string;\n target: string;\n quota: number;\n recipient?: string;\n}\n\nconst opaqueId = /^[A-Za-z0-9_.:-]{1,128}$/;\n\n/** Hash the exact operation that will be executed. IDs are case sensitive. */\nexport async function trialCreditOperationDigest(\n operation: TrialCreditOperation,\n): Promise<string> {\n const { operationId, target, quota, recipient } = operation;\n if (\n Object.keys(operation).some(\n (key) => ![\"operationId\", \"target\", \"quota\", \"recipient\"].includes(key),\n ) ||\n typeof operationId !== \"string\" ||\n !opaqueId.test(operationId) ||\n typeof target !== \"string\" ||\n !opaqueId.test(target) ||\n !Number.isSafeInteger(quota) ||\n quota < 1 ||\n (recipient !== undefined &&\n (typeof recipient !== \"string\" || !opaqueId.test(recipient)))\n ) {\n throw new TypeError(\"Invalid trial credit operation\");\n }\n const bytes = new TextEncoder().encode(\n JSON.stringify([\n \"chitmark-action-v1\",\n \"trial_activation\",\n operationId,\n target,\n quota,\n recipient ?? null,\n ]),\n );\n const digest = await crypto.subtle.digest(\"SHA-256\", bytes);\n return Array.from(new Uint8Array(digest), (byte) =>\n byte.toString(16).padStart(2, \"0\"),\n ).join(\"\");\n}\n","/**\n * Resolve a client IP for verify subject signals from a Fetch Request.\n *\n * Prefer platform-set headers (`cf-connecting-ip`, `x-real-ip`,\n * `x-vercel-forwarded-for`). `X-Forwarded-For` is only safe when a trusted\n * proxy boundary strips or rewrites client-supplied values. Do not read XFF\n * on a directly reachable origin. On Cloudflare Workers, prefer\n * `verifyRequest` from `@chitmark/sdk/edge`, which owns this lookup.\n */\nexport function getTrustedClientIp(req: Request): string {\n const platform =\n req.headers.get(\"cf-connecting-ip\")?.trim() ||\n req.headers.get(\"x-real-ip\")?.trim() ||\n req.headers.get(\"x-vercel-forwarded-for\")?.split(\",\")[0]?.trim() ||\n \"\";\n if (platform) return platform;\n\n // Last resort: first XFF hop. Only valid behind a trusted proxy that\n // overwrites this header at the edge.\n return req.headers.get(\"x-forwarded-for\")?.split(\",\")[0]?.trim() ?? \"\";\n}\n","import type { Chitmark } from \"../client.js\";\nimport { CHITMARK_HTTP_STATUS, isEligibleAllow } from \"../http-status.js\";\nimport type { Action, Verdict } from \"../types.js\";\n\n/**\n * Minimal Express-compatible types (no express dependency).\n */\nexport interface ExpressLikeRequest {\n hostname?: string;\n path?: string;\n ip?: string;\n body?: {\n email?: string;\n [key: string]: unknown;\n };\n headers: Record<string, string | string[] | undefined>;\n}\n\nexport interface ExpressLikeResponse {\n status: (code: number) => ExpressLikeResponse;\n json: (body: unknown) => unknown;\n locals: Record<string, unknown>;\n}\n\nexport type ExpressNext = (err?: unknown) => void;\n\nexport interface GateOptions {\n /** Optional session binder. */\n session?: (req: ExpressLikeRequest) => string | undefined;\n /** Custom surface string. */\n surface?: (req: ExpressLikeRequest) => string;\n}\n\n/**\n * Express middleware factory: verify on the hot path, attach verdict to res.locals.\n *\n * Verdict shape: `decision` is allow | challenge | deny; `degraded` is a\n * boolean operational flag (when true, decision is always challenge).\n * HTTP mapping:\n * - `decision === \"deny\"` → 403\n * - `decision === \"challenge\"` or `degraded` → 428\n * - anything else that is not an explicit non-degraded allow → 428 (fail closed)\n * - explicit non-degraded allow → next()\n *\n * 428 means the request is not rejected permanently; a required verification\n * precondition must be satisfied before the action can proceed.\n * @example\n * ```ts\n * app.post(\"/signup\", chitmarkGate(chitmark, \"signup\"), signupHandler);\n * ```\n */\nexport function chitmarkGate(\n client: Chitmark,\n action: Action,\n options: GateOptions = {},\n): (\n req: ExpressLikeRequest,\n res: ExpressLikeResponse,\n next: ExpressNext,\n) => Promise<void> {\n return async (req, res, next) => {\n try {\n const surface = options.surface?.(req) ?? `${req.hostname ?? \"\"}${req.path ?? \"\"}`;\n const session = options.session?.(req);\n\n const v: Verdict = await client.verify({\n action,\n surface,\n session,\n subject: {\n email: req.body?.email,\n ip: req.ip,\n userAgent:\n (typeof req.headers[\"user-agent\"] === \"string\"\n ? req.headers[\"user-agent\"]\n : undefined) ?? \"\",\n headers: req.headers,\n formData: req.body,\n },\n });\n\n res.locals.chitmark = v;\n\n if (v.degraded || v.decision === \"challenge\") {\n res\n .status(CHITMARK_HTTP_STATUS.preconditionRequired)\n .json({ challenge: true, eventId: v.eventId });\n return;\n }\n if (v.decision === \"deny\") {\n res\n .status(CHITMARK_HTTP_STATUS.forbidden)\n .json({ error: \"blocked\", eventId: v.eventId });\n return;\n }\n if (!isEligibleAllow(v)) {\n // Unknown / malformed decision: fail to challenge, never to allow.\n res\n .status(CHITMARK_HTTP_STATUS.preconditionRequired)\n .json({ challenge: true, eventId: v.eventId });\n return;\n }\n next();\n } catch (err) {\n next(err);\n }\n };\n}\n","import type { Chitmark } from \"../client.js\";\nimport type { Action, Verdict } from \"../types.js\";\nimport { getTrustedClientIp } from \"../trusted-ip.js\";\n\nexport interface NextVerifyOptions {\n action: Action;\n surface?: string;\n session?: string;\n body?: {\n email?: string;\n [key: string]: unknown;\n };\n}\n\n/**\n * Helper for Next.js App Router route handlers.\n * Returns the verdict; caller maps decision → Response.\n *\n * IP comes from {@link getTrustedClientIp}: platform headers first, then\n * `X-Forwarded-For` only as a last resort behind a trusted proxy boundary.\n *\n * @example\n * ```ts\n * const v = await verifyNextRequest(chitmark, req, { action: \"signup\", body });\n * const status = verdictToHttpStatus(v);\n * ```\n */\nexport async function verifyNextRequest(\n client: Chitmark,\n req: Request,\n options: NextVerifyOptions,\n): Promise<Verdict> {\n const url = new URL(req.url);\n return client.verify({\n action: options.action,\n surface: options.surface ?? `${url.host}${url.pathname}`,\n session: options.session,\n subject: {\n email: options.body?.email,\n ip: getTrustedClientIp(req),\n userAgent: req.headers.get(\"user-agent\") ?? \"\",\n headers: Object.fromEntries(req.headers),\n formData: options.body,\n },\n });\n}\n\nexport { verdictToHttpStatus } from \"../http-status.js\";\nexport { getTrustedClientIp } from \"../trusted-ip.js\";\n","/** Offline evidence only. These APIs never grant execution authority or fetch trust. */\nexport type EvidenceKey = {\n kid: string;\n jwk: Record<string, unknown>;\n notBefore: number;\n notAfter: number;\n revokedAt?: number;\n compromisedAt?: number;\n};\nexport type EvidenceSigningKey = {\n kty?: string;\n crv?: string;\n alg?: string;\n x?: string;\n y?: string;\n d?: string;\n ext?: boolean;\n key_ops?: string[];\n};\nexport class EvidenceError extends Error {\n constructor(public readonly code: string) {\n super(code);\n this.name = \"EvidenceError\";\n }\n}\nexport function evidenceAssert(value: unknown, code: string): asserts value {\n if (!value) throw new EvidenceError(code);\n}\n/** Restricted canonical JSON: ASCII strings/keys, safe integers, arrays and plain objects. */\nexport function canonicalEvidence(value: unknown): string {\n if (value === null || typeof value === \"boolean\") return JSON.stringify(value);\n if (typeof value === \"number\") {\n evidenceAssert(\n Number.isSafeInteger(value) && !Object.is(value, -0),\n \"noncanonical_number\",\n );\n return String(value);\n }\n if (typeof value === \"string\") {\n evidenceAssert(/^[\\x20-\\x7e]*$/.test(value), \"noncanonical_string\");\n return JSON.stringify(value);\n }\n if (Array.isArray(value)) return `[${value.map(canonicalEvidence).join(\",\")}]`;\n evidenceAssert(\n value &&\n typeof value === \"object\" &&\n Object.getPrototypeOf(value) === Object.prototype,\n \"noncanonical_object\",\n );\n const obj = value as Record<string, unknown>;\n return `{${Object.keys(obj)\n .sort()\n .map((key) => `${canonicalEvidence(key)}:${canonicalEvidence(obj[key])}`)\n .join(\",\")}}`;\n}\nexport async function evidenceHash(value: string): Promise<string> {\n return Array.from(\n new Uint8Array(\n await crypto.subtle.digest(\"SHA-256\", new TextEncoder().encode(value)),\n ),\n (b) => b.toString(16).padStart(2, \"0\"),\n ).join(\"\");\n}\nconst encode = (bytes: Uint8Array) =>\n btoa(Array.from(bytes, (b) => String.fromCharCode(b)).join(\"\"))\n .replace(/\\+/g, \"-\")\n .replace(/\\//g, \"_\")\n .replace(/=+$/, \"\");\nconst decode = (part: string): Uint8Array<ArrayBuffer> =>\n Uint8Array.from(atob(part.replace(/-/g, \"+\").replace(/_/g, \"/\")), (c) =>\n c.charCodeAt(0),\n );\nexport function evidenceKeyAt(\n history: EvidenceKey[],\n kid: string,\n at: number,\n): EvidenceKey {\n const matches = history.filter((key) => key.kid === kid);\n evidenceAssert(matches.length === 1, \"unknown_trust_root\");\n const key = matches[0]!;\n evidenceAssert(\n key.jwk.kty === \"EC\" &&\n key.jwk.crv === \"P-256\" &&\n (!key.jwk.alg || key.jwk.alg === \"ES256\") &&\n !key.jwk.d,\n \"unsupported_key\",\n );\n evidenceAssert(\n Number.isSafeInteger(at) &&\n Number.isSafeInteger(key.notBefore) &&\n Number.isSafeInteger(key.notAfter) &&\n key.notBefore <= at &&\n at < key.notAfter,\n \"key_outside_validity\",\n );\n evidenceAssert(key.revokedAt === undefined, \"revoked_key\");\n return key;\n}\nexport async function verifyEvidenceSignature(\n token: string,\n typ: string,\n history: EvidenceKey[],\n at: number,\n): Promise<Record<string, unknown>> {\n evidenceAssert(\n typeof token === \"string\" &&\n token.length <= 8_000_000 &&\n /^[A-Za-z0-9_-]+\\.[A-Za-z0-9_-]+\\.[A-Za-z0-9_-]+$/.test(token),\n \"malformed_signature\",\n );\n const [h, p, s] = token.split(\".\") as [string, string, string];\n let head, payload;\n try {\n head = JSON.parse(\n new TextDecoder(\"utf-8\", { fatal: true, ignoreBOM: true }).decode(decode(h)),\n );\n payload = JSON.parse(\n new TextDecoder(\"utf-8\", { fatal: true, ignoreBOM: true }).decode(decode(p)),\n );\n } catch {\n throw new EvidenceError(\"malformed_signature\");\n }\n evidenceAssert(\n head?.alg === \"ES256\" && head.typ === typ && Object.keys(head).length === 3,\n \"unsupported_profile\",\n );\n const trusted = evidenceKeyAt(history, head.kid, at);\n const key = await crypto.subtle.importKey(\n \"jwk\",\n trusted.jwk as unknown as JsonWebKey,\n { name: \"ECDSA\", namedCurve: \"P-256\" },\n false,\n [\"verify\"],\n );\n evidenceAssert(\n await crypto.subtle.verify(\n { name: \"ECDSA\", hash: \"SHA-256\" },\n key,\n decode(s),\n new TextEncoder().encode(`${h}.${p}`),\n ),\n \"invalid_signature\",\n );\n evidenceAssert(\n payload && typeof payload === \"object\" && !Array.isArray(payload),\n \"malformed_payload\",\n );\n return payload as Record<string, unknown>;\n}\nexport async function signEvidence(\n payload: object,\n typ: string,\n kid: string,\n jwk: EvidenceSigningKey,\n): Promise<string> {\n evidenceAssert(\n jwk.kty === \"EC\" && jwk.crv === \"P-256\" && (!jwk.alg || jwk.alg === \"ES256\"),\n \"unsupported_key\",\n );\n const input = `${encode(new TextEncoder().encode(canonicalEvidence({ alg: \"ES256\", kid, typ })))}.${encode(new TextEncoder().encode(canonicalEvidence(payload)))}`;\n evidenceAssert(input.length + 87 <= 8_000_000, \"bundle_too_large\");\n const key = await crypto.subtle.importKey(\n \"jwk\",\n jwk as unknown as JsonWebKey,\n { name: \"ECDSA\", namedCurve: \"P-256\" },\n false,\n [\"sign\"],\n );\n return `${input}.${encode(new Uint8Array(await crypto.subtle.sign({ name: \"ECDSA\", hash: \"SHA-256\" }, key, new TextEncoder().encode(input))))}`;\n}\n\nexport type PortableRecord = {\n id: string;\n eventId: string;\n kind: \"decision\" | \"execution\" | \"outcome\";\n occurredAt: number;\n recordedAt: number;\n policyRevision: string | null;\n result: string;\n source: \"decision_service\" | \"customer_report\";\n receipt: string | null;\n};\nexport type EvidenceManifest = {\n version: 1;\n issuer: \"https://portal.chitmark.com\";\n purpose: \"historical_evidence\";\n tenantId: string;\n startAt: number;\n endAt: number;\n createdAt: number;\n sourceAsOf: number;\n timeBasis: \"issuer_and_ingestion_clocks_not_independent_time\";\n completeness: \"unknown\";\n gaps: string[];\n retention: {\n deleteAfter: number;\n recipient: string;\n exportedCopies: \"recipient_controlled\";\n redaction: \"minimized\";\n };\n records: PortableRecord[];\n};\nconst id = /^[A-Za-z0-9_.:/-]{1,160}$/;\nexport function validateManifest(value: EvidenceManifest, tenantId: string): void {\n evidenceAssert(\n Object.keys(value).sort().join(\",\") ===\n \"completeness,createdAt,endAt,gaps,issuer,purpose,records,retention,sourceAsOf,startAt,tenantId,timeBasis,version\" &&\n Object.keys(value.retention).sort().join(\",\") ===\n \"deleteAfter,exportedCopies,recipient,redaction\",\n \"unminimized_manifest\",\n );\n canonicalEvidence(value);\n evidenceAssert(\n value.version === 1 &&\n value.issuer === \"https://portal.chitmark.com\" &&\n value.purpose === \"historical_evidence\" &&\n value.tenantId === tenantId &&\n id.test(tenantId),\n \"wrong_bundle_scope\",\n );\n evidenceAssert(\n [\n value.startAt,\n value.endAt,\n value.createdAt,\n value.sourceAsOf,\n value.retention.deleteAfter,\n ].every(Number.isSafeInteger) &&\n value.startAt < value.endAt &&\n value.endAt <= value.sourceAsOf &&\n value.sourceAsOf <= value.createdAt &&\n value.createdAt < value.retention.deleteAfter,\n \"invalid_window\",\n );\n evidenceAssert(\n value.completeness === \"unknown\" &&\n value.timeBasis === \"issuer_and_ingestion_clocks_not_independent_time\" &&\n value.retention.redaction === \"minimized\" &&\n value.retention.exportedCopies === \"recipient_controlled\" &&\n id.test(value.retention.recipient) &&\n Array.isArray(value.gaps) &&\n value.gaps.every((gap) => id.test(gap)),\n \"invalid_manifest\",\n );\n evidenceAssert(\n Array.isArray(value.records) && value.records.length <= 10_000,\n \"record_limit\",\n );\n const seen = new Set<string>();\n for (const row of value.records) {\n evidenceAssert(\n Object.keys(row).sort().join(\",\") ===\n \"eventId,id,kind,occurredAt,policyRevision,receipt,recordedAt,result,source\",\n \"unminimized_record\",\n );\n evidenceAssert(\n id.test(row.id) &&\n id.test(row.eventId) &&\n [\"decision\", \"execution\", \"outcome\"].includes(row.kind) &&\n id.test(row.result) &&\n (row.policyRevision === null || id.test(row.policyRevision)) &&\n (row.receipt === null ||\n (typeof row.receipt === \"string\" && row.receipt.length <= 8192)),\n \"invalid_record\",\n );\n evidenceAssert(\n Number.isSafeInteger(row.occurredAt) &&\n Number.isSafeInteger(row.recordedAt) &&\n value.startAt <= row.occurredAt &&\n row.occurredAt < value.endAt &&\n row.recordedAt <= value.sourceAsOf &&\n row.recordedAt >= row.occurredAt &&\n row.source === (row.kind === \"decision\" ? \"decision_service\" : \"customer_report\"),\n \"invalid_provenance\",\n );\n const identity = `${row.kind}:${row.id}`;\n evidenceAssert(!seen.has(identity), \"duplicate_record\");\n seen.add(identity);\n }\n}\nexport type EvidenceBundle = { manifest: EvidenceManifest; signature: string };\nexport async function verifyEvidenceBundle(\n bundle: EvidenceBundle,\n options: {\n tenantId: string;\n recipient: string;\n trustedKeys: EvidenceKey[];\n now: number;\n },\n) {\n validateManifest(bundle.manifest, options.tenantId);\n evidenceAssert(\n bundle.manifest.retention.recipient === options.recipient,\n \"wrong_recipient\",\n );\n evidenceAssert(\n options.now < bundle.manifest.retention.deleteAfter &&\n options.now >= bundle.manifest.createdAt,\n \"retention_expired\",\n );\n const signed = await verifyEvidenceSignature(\n bundle.signature,\n \"chitmark-evidence+jwt\",\n options.trustedKeys,\n bundle.manifest.createdAt,\n );\n evidenceAssert(\n canonicalEvidence(signed) === canonicalEvidence(bundle.manifest),\n \"manifest_mismatch\",\n );\n const head = JSON.parse(\n new TextDecoder().decode(decode(bundle.signature.split(\".\")[0]!)),\n );\n evidenceAssert(\n evidenceKeyAt(options.trustedKeys, head.kid, bundle.manifest.createdAt)\n .compromisedAt === undefined,\n \"compromised_bundle_key\",\n );\n return {\n purpose: \"historical_evidence\" as const,\n executionAuthorized: false as const,\n integrity: \"valid\" as const,\n completeness: \"unknown\" as const,\n outcomeTruth: \"not_established\" as const,\n gaps: bundle.manifest.gaps,\n };\n}\n\n/** The witness is supplied by the caller from an independently retained checkpoint,\n * never taken from a bundle's own claims. Hash comparison binds the exact receipt. */\nexport async function verifyHistoricalReceipt(\n token: string,\n options: {\n tenantId: string;\n session: string;\n trustedKeys: EvidenceKey[];\n witness?: { tokenHash: string; observedAt: number };\n },\n) {\n evidenceAssert(\n typeof token === \"string\" && token.length <= 8192,\n \"malformed_signature\",\n );\n let claims: Record<string, unknown>, head: Record<string, unknown>;\n try {\n const parts = token.split(\".\");\n head = JSON.parse(new TextDecoder().decode(decode(parts[0]!)));\n claims = JSON.parse(new TextDecoder().decode(decode(parts[1]!)));\n } catch {\n throw new EvidenceError(\"malformed_signature\");\n }\n evidenceAssert(\n head.typ === \"JWT\" || head.typ === \"chitmark-action+jwt\",\n \"unsupported_profile\",\n );\n evidenceAssert(\n Number.isSafeInteger(claims.iat) &&\n Number.isSafeInteger(claims.exp) &&\n Number(claims.iat) < Number(claims.exp) &&\n Number(claims.exp) - Number(claims.iat) <= (head.typ === \"JWT\" ? 300 : 60),\n \"invalid_receipt_time\",\n );\n const at = Number(claims.iat);\n evidenceAssert(\n typeof claims.eventId === \"string\" && /^[A-Za-z0-9_-]{1,160}$/.test(claims.eventId),\n \"invalid_receipt_context\",\n );\n const trusted = evidenceKeyAt(options.trustedKeys, String(head.kid), at);\n claims = await verifyEvidenceSignature(\n token,\n String(head.typ),\n options.trustedKeys,\n at,\n );\n evidenceAssert(\n claims.tid === options.tenantId &&\n claims.sub === options.session &&\n claims.iss === \"https://api.chitmark.com\",\n \"wrong_receipt_scope\",\n );\n const witnessed =\n options.witness &&\n Number.isSafeInteger(options.witness.observedAt) &&\n options.witness.observedAt >= at &&\n options.witness.tokenHash === (await evidenceHash(token));\n const beforeCompromise =\n witnessed &&\n (trusted.compromisedAt === undefined ||\n options.witness!.observedAt < trusted.compromisedAt);\n return {\n purpose: \"historical_evidence\" as const,\n executionAuthorized: false as const,\n eventId: String(claims.eventId),\n policyRevision: typeof claims.policy === \"string\" ? claims.policy : null,\n timeIntegrity: beforeCompromise\n ? \"independently_checkpointed\"\n : trusted.compromisedAt !== undefined\n ? \"uncertain_after_compromise\"\n : \"self_asserted\",\n };\n}\n","import { canonicalEvidence, evidenceAssert, evidenceHash } from \"./evidence.js\";\n\nexport type EvidenceCheckpoint = {\n version: 1;\n tenantId: string;\n epoch: string;\n expiresAt: number;\n size: number;\n root: string;\n observedAt: number;\n};\nexport type Commitment = { id: string; salt: string; record: object; ingestedAt: number };\nconst hex = /^[a-f0-9]{64}$/;\nfunction scope(checkpoint: EvidenceCheckpoint, tenantId: string, now: number) {\n evidenceAssert(\n checkpoint.version === 1 &&\n checkpoint.tenantId === tenantId &&\n /^[A-Za-z0-9_-]{16,128}$/.test(checkpoint.epoch) &&\n Number.isSafeInteger(checkpoint.expiresAt) &&\n now < checkpoint.expiresAt &&\n Number.isSafeInteger(checkpoint.observedAt) &&\n checkpoint.observedAt <= now &&\n checkpoint.observedAt < checkpoint.expiresAt &&\n Number.isSafeInteger(checkpoint.size) &&\n checkpoint.size >= 0 &&\n checkpoint.size <= 10_000 &&\n hex.test(checkpoint.root),\n \"checkpoint_scope_or_expiry\",\n );\n}\nconst genesis = (cp: Pick<EvidenceCheckpoint, \"tenantId\" | \"epoch\" | \"expiresAt\">) =>\n evidenceHash(\n canonicalEvidence([\"chitmark-private-chain-v1\", cp.tenantId, cp.epoch, cp.expiresAt]),\n );\nexport const evidenceCommitment = (\n cp: Pick<EvidenceCheckpoint, \"tenantId\" | \"epoch\" | \"expiresAt\">,\n record: object,\n salt: string,\n) => {\n evidenceAssert(hex.test(salt), \"invalid_commitment_salt\");\n return evidenceHash(\n canonicalEvidence([\n \"chitmark-record-v1\",\n cp.tenantId,\n cp.epoch,\n cp.expiresAt,\n salt,\n record,\n ]),\n );\n};\nconst advance = (root: string, leaf: string, index: number) =>\n evidenceHash(canonicalEvidence([\"chitmark-append-v1\", index, root, leaf]));\n/** Bounded linear commitment proof, not a public transparency log or a minimal Merkle proof. */\nexport async function checkpointFromCommitments(input: {\n tenantId: string;\n epoch: string;\n expiresAt: number;\n observedAt: number;\n commitments: string[];\n}): Promise<EvidenceCheckpoint> {\n evidenceAssert(\n input.commitments.length <= 10_000 &&\n input.commitments.every((leaf) => hex.test(leaf)),\n \"invalid_commitments\",\n );\n let root = await genesis(input);\n for (let index = 0; index < input.commitments.length; index++)\n root = await advance(root, input.commitments[index]!, index);\n const cp: EvidenceCheckpoint = {\n version: 1,\n tenantId: input.tenantId,\n epoch: input.epoch,\n expiresAt: input.expiresAt,\n observedAt: input.observedAt,\n size: input.commitments.length,\n root,\n };\n scope(cp, input.tenantId, input.observedAt);\n return cp;\n}\nexport async function verifyCheckpointAppend(\n older: EvidenceCheckpoint,\n newer: EvidenceCheckpoint,\n appended: string[] | null,\n options: { tenantId: string; now: number },\n) {\n scope(older, options.tenantId, options.now);\n scope(newer, options.tenantId, options.now);\n if (older.size === 0)\n evidenceAssert(older.root === (await genesis(older)), \"invalid_empty_checkpoint\");\n evidenceAssert(\n older.epoch === newer.epoch &&\n older.expiresAt === newer.expiresAt &&\n older.observedAt <= newer.observedAt &&\n older.size <= newer.size,\n \"inconsistent_checkpoint\",\n );\n if (older.size === newer.size)\n evidenceAssert(older.root === newer.root, \"divergent_history\");\n if (appended === null)\n return { status: \"unavailable\" as const, completeness: \"unknown\" as const };\n evidenceAssert(\n appended.length === newer.size - older.size &&\n appended.every((leaf) => hex.test(leaf)),\n \"invalid_append_proof\",\n );\n let root = older.root;\n for (let index = 0; index < appended.length; index++)\n root = await advance(root, appended[index]!, older.size + index);\n evidenceAssert(root === newer.root, \"divergent_history\");\n return { status: \"consistent\" as const, completeness: \"unknown\" as const };\n}\nexport async function verifyCheckpointInclusion(\n checkpoint: EvidenceCheckpoint,\n proof: { index: number; record: object; salt: string; commitments: string[] } | null,\n options: { tenantId: string; now: number },\n) {\n scope(checkpoint, options.tenantId, options.now);\n if (!proof) return { status: \"unavailable\" as const, completeness: \"unknown\" as const };\n evidenceAssert(\n Number.isSafeInteger(proof.index) &&\n proof.index >= 0 &&\n proof.index < checkpoint.size &&\n proof.commitments.length === checkpoint.size,\n \"invalid_inclusion_proof\",\n );\n const rebuilt = await checkpointFromCommitments({\n ...checkpoint,\n commitments: proof.commitments,\n });\n evidenceAssert(\n rebuilt.root === checkpoint.root &&\n (await evidenceCommitment(checkpoint, proof.record, proof.salt)) ===\n proof.commitments[proof.index],\n \"changed_record\",\n );\n return { status: \"included\" as const, completeness: \"unknown\" as const };\n}\n"]}