@cloudpdf/contract 3.0.0-next.6 → 3.0.0-next.8

package/dist/index.js

@@ -50,7 +50,9 @@ var adminWirePaths = {
   /** Deployment-global singletons: API-token only, no tenant context. */
   deploymentLicenseStatus: "/v1/deployment/license/status"
 };
-var DedupModeSchema = z.enum(["always-create", "reuse-existing"]);
+var DedupModeSchema = z.enum(["always-create", "reuse-existing"]).describe(
+  "always-create (default) creates a new document every time. reuse-existing returns a document that already holds the same content instead of storing it twice."
+);
 var UploadPreferenceSchema = z.enum(["auto", "presigned", "proxy"]);
 var DocumentStateSchema = z.enum(["pending", "ready", "failed", "deleting"]);
 var AdminDocumentRecordSchema = z.object({
@@ -123,15 +125,27 @@ var utf8ByteLength = (s) => new TextEncoder().encode(s).length;
 var AdminImportSourceSchema = z.discriminatedUnion("kind", [
   z.object({
     kind: z.literal("url"),
-    url: z.string().url().max(8192)
-  }),
+    url: z.string().url().max(8192).describe(
+      "The URL to fetch. Must be allowed by the deployment import policy (scheme, network range, size) and must declare a length."
+    )
+  }).describe(
+    "The caller supplies the authority: a presigned S3/GCS/Azure/R2/MinIO GET, or any HTTPS endpoint the deployment import policy allows. The URL is a capability \u2014 treat it as a secret. CloudPDF never echoes its query string back in errors, logs, or stored failure reasons."
+  ),
   z.object({
     kind: z.literal("connection"),
-    connectionId: z.string().min(1).max(128),
-    key: z.string().min(1).refine((k) => !k.includes("\0"), "key must not contain NUL").refine((k) => utf8ByteLength(k) <= 1024, "key must be at most 1024 UTF-8 bytes"),
-    revision: z.string().min(1).max(1024).optional()
-  })
-]);
+    connectionId: z.string().min(1).max(128).describe("The operator-registered storage connection to read from."),
+    key: z.string().min(1).refine((k) => !k.includes("\0"), "key must not contain NUL").refine((k) => utf8ByteLength(k) <= 1024, "key must be at most 1024 UTF-8 bytes").describe(
+      "The object key to read, inside the connection's configured scope. At most 1024 UTF-8 bytes."
+    ),
+    revision: z.string().min(1).max(1024).optional().describe(
+      "Pins a specific version of the object. Provider-interpreted (S3 VersionId, GCS generation, Azure version id); providers without versioning reject it."
+    )
+  }).describe(
+    "The operator pre-registered the authority: the request names a connection and a key inside it. Which provider backs the connection (S3, GCS, Azure Blob, filesystem, ...) is deployment configuration, never wire surface."
+  )
+]).describe(
+  "Where CloudPDF pulls the bytes from. The two shapes differ in WHO supplies the authority to read, not in which storage vendor holds the file."
+);
 var AdminDocumentImportRequestSchema = z.object({
   source: AdminImportSourceSchema,
   /**
@@ -143,11 +157,17 @@ var AdminDocumentImportRequestSchema = z.object({
    * hash the server cannot know what content to reuse.
    */
   expected: z.object({
-    sizeBytes: z.number().int().min(1).optional(),
-    sha256: z.string().regex(sha256Hex).optional()
-  }).optional(),
+    sizeBytes: z.number().int().min(1).optional().describe("Checked against the source's declared Content-Length before the transfer."),
+    sha256: z.string().regex(sha256Hex).optional().describe(
+      "Checked against the server-observed digest after the transfer. Required when dedupMode is reuse-existing."
+    )
+  }).optional().describe(
+    "Integrity pins, enforced when present. When absent, the server-observed values become authoritative."
+  ),
   metadata: z.record(z.string(), z.unknown()).optional(),
-  idempotencyKey: z.string().optional(),
+  idempotencyKey: z.string().optional().describe(
+    "Retrying with the same key resumes the same document rather than importing a second copy \u2014 including after a 502."
+  ),
   dedupMode: DedupModeSchema.optional(),
   docId: z.string().regex(docIdPattern).optional(),
   /**
@@ -159,7 +179,9 @@ var AdminDocumentImportRequestSchema = z.object({
    * additionally require `expected.sha256`, since they have no
    * revisions to pin retries to.
    */
-  mode: z.enum(["sync", "async"]).optional()
+  mode: z.enum(["sync", "async"]).optional().describe(
+    "sync (default) holds the response open for the whole transfer. async answers 202 with the document pending and transfers in the background; it requires a connection source, and filesystem connections additionally require expected.sha256."
+  )
 });
 var AdminDocumentImportResponseSchema = z.object({
   /**

package/dist/index.js.map

@@ -1 +1 @@
-{"version":3,"sources":["../src/index.ts"],"sourcesContent":["import type { DocCapability } from '@embedpdf/engine-core/runtime';\nimport {\n  AnnotationListPageSnapshotSchema,\n  DocumentHeadSchema,\n  DocumentManifestSchema,\n  DocumentMetadataSchema,\n  EngineErrorPayloadSchema,\n  FormSnapshotSchema,\n  MutationMetaSchema,\n  PageTextSnapshotSchema,\n  wireTemplates,\n} from '@embedpdf/engine-core/wire';\nimport { z } from 'zod';\n\nconst sha256Hex = /^[0-9a-f]{64}$/i;\nconst docIdPattern = /^[A-Za-z0-9_-]+$/;\n/**\n * Tenant ids share the doc-id charset: URL-safe by construction, since\n * they appear in every tenant-scoped path (and therefore in logs — do\n * not put PII in tenant ids).\n */\nexport const tenantIdPattern = /^[A-Za-z0-9_-]+$/;\n/**\n * A web origin pattern: scheme + host (+ optional port), no path. One\n * leading `*.` label is allowed and matches one or more subdomain\n * labels (`https://*.acme.com` covers `docs.acme.com`, never bare\n * `acme.com` and never `evilacme.com`).\n */\nconst originPattern =\n  /^https?:\\/\\/(\\*\\.)?[a-zA-Z0-9]([a-zA-Z0-9-]*[a-zA-Z0-9])?(\\.[a-zA-Z0-9]([a-zA-Z0-9-]*[a-zA-Z0-9])?)*(:\\d{1,5})?$/;\nconst originPatternArray = z\n  .array(\n    z\n      .string()\n      .max(262)\n      .regex(\n        originPattern,\n        'must be a web origin like https://example.com (optionally one leading *. wildcard label, optional port, no path)',\n      ),\n  )\n  .min(1)\n  .max(32);\n/** Share tokens are the grant row id: `shr_` + 24 url-safe random chars. */\nconst shareTokenPattern = /^shr_[A-Za-z0-9_-]{24}$/;\n\n/**\n * Wire paths. The URL carries the full resource identity — tenant\n * resources live under `/v1/tenants/{tenantId}/…` — and the auth model\n * is one rule: the API token is valid everywhere; a JWT is valid\n * exactly under the subtree of the resource it names.\n */\nexport const adminWirePaths = {\n  tenants: '/v1/tenants',\n  tenant: (tenantId: string) => `/v1/tenants/${encodeURIComponent(tenantId)}`,\n  documents: (tenantId: string) => `/v1/tenants/${encodeURIComponent(tenantId)}/documents`,\n  documentsInit: (tenantId: string) => `/v1/tenants/${encodeURIComponent(tenantId)}/documents/init`,\n  documentsImport: (tenantId: string) =>\n    `/v1/tenants/${encodeURIComponent(tenantId)}/documents/import`,\n  document: (tenantId: string, docId: string) =>\n    `/v1/tenants/${encodeURIComponent(tenantId)}/documents/${encodeURIComponent(docId)}`,\n  documentCommit: (tenantId: string, docId: string) =>\n    `/v1/tenants/${encodeURIComponent(tenantId)}/documents/${encodeURIComponent(docId)}/commit`,\n  documentUploadProxy: (tenantId: string, docId: string) =>\n    `/v1/tenants/${encodeURIComponent(tenantId)}/documents/${encodeURIComponent(docId)}/upload-proxy`,\n  documentDownload: (tenantId: string, docId: string) =>\n    `/v1/tenants/${encodeURIComponent(tenantId)}/documents/${encodeURIComponent(docId)}/download`,\n  /** The warmed dashboard-tile artifact. Returns 404 while `pending`/`locked`. */\n  documentThumbnail: (tenantId: string, docId: string) =>\n    `/v1/tenants/${encodeURIComponent(tenantId)}/documents/${encodeURIComponent(docId)}/thumbnail`,\n  tokenIssue: (tenantId: string) => `/v1/tenants/${encodeURIComponent(tenantId)}/tokens`,\n  tokenRevoke: (tenantId: string, jti: string) =>\n    `/v1/tenants/${encodeURIComponent(tenantId)}/tokens/${encodeURIComponent(jti)}/revoke`,\n  shares: (tenantId: string) => `/v1/tenants/${encodeURIComponent(tenantId)}/shares`,\n  share: (tenantId: string, shareId: string) =>\n    `/v1/tenants/${encodeURIComponent(tenantId)}/shares/${encodeURIComponent(shareId)}`,\n  tenantUsage: (tenantId: string) => `/v1/tenants/${encodeURIComponent(tenantId)}/usage`,\n  tenantSuspend: (tenantId: string) => `/v1/tenants/${encodeURIComponent(tenantId)}/suspend`,\n  tenantResume: (tenantId: string) => `/v1/tenants/${encodeURIComponent(tenantId)}/resume`,\n  /**\n   * The public share-session exchange. Deliberately outside any tenant\n   * subtree: the caller holds only a share token and does not know the\n   * tenant — the grant row resolves it server-side.\n   */\n  shareSessions: '/v1/share-sessions',\n  /** Deployment-global singletons: API-token only, no tenant context. */\n  deploymentLicenseStatus: '/v1/deployment/license/status',\n} as const;\n\nexport const DedupModeSchema = z.enum(['always-create', 'reuse-existing']);\nexport type DedupMode = z.infer<typeof DedupModeSchema>;\n\nexport const UploadPreferenceSchema = z.enum(['auto', 'presigned', 'proxy']);\nexport type UploadPreference = z.infer<typeof UploadPreferenceSchema>;\n\nexport const DocumentStateSchema = z.enum(['pending', 'ready', 'failed', 'deleting']);\nexport type DocumentState = z.infer<typeof DocumentStateSchema>;\n\nexport const AdminDocumentRecordSchema = z.object({\n  id: z.string(),\n  tenantId: z.string(),\n  state: DocumentStateSchema,\n  baseSha: z.string().nullable(),\n  storageSizeBytes: z.number().nullable(),\n  metadata: z.record(z.string(), z.unknown()).nullable(),\n  idempotencyKey: z.string().nullable(),\n  failureReason: z.string().nullable(),\n  /** Dashboard tile lifecycle. Optional because older servers omit these fields. */\n  thumbnailState: z.enum(['pending', 'ready', 'locked', 'failed']).optional(),\n  thumbnailUrl: z.string().nullable().optional(),\n  createdAt: z.number(),\n  updatedAt: z.number(),\n  createdBy: z.string().nullable(),\n});\nexport type AdminDocumentRecord = z.infer<typeof AdminDocumentRecordSchema>;\n\nexport const AdminDocumentInitRequestSchema = z.object({\n  contentLength: z.number().finite().min(1),\n  contentSha256: z.string().regex(sha256Hex),\n  metadata: z.record(z.string(), z.unknown()).optional(),\n  idempotencyKey: z.string().optional(),\n  dedupMode: DedupModeSchema.optional(),\n  docId: z.string().regex(docIdPattern).optional(),\n  uploadTtlSec: z.number().finite().min(60).max(3600).optional(),\n  uploadPreference: UploadPreferenceSchema.optional(),\n});\nexport type AdminDocumentInitRequest = z.infer<typeof AdminDocumentInitRequestSchema>;\n\nexport const AdminPresignedUploadSchema = z.object({\n  url: z.string(),\n  headers: z.record(z.string(), z.string()),\n  method: z.literal('PUT'),\n  expiresAt: z.number(),\n});\nexport type AdminPresignedUpload = z.infer<typeof AdminPresignedUploadSchema>;\n\nexport const AdminInitUploadSchema = z.discriminatedUnion('kind', [\n  z.object({\n    kind: z.literal('presigned'),\n    presigned: AdminPresignedUploadSchema,\n    key: z.string(),\n  }),\n  z.object({\n    kind: z.literal('proxy'),\n    url: z.string(),\n    key: z.string(),\n  }),\n]);\nexport type AdminInitUpload = z.infer<typeof AdminInitUploadSchema>;\n\nexport const AdminDocumentInitResponseSchema = z.discriminatedUnion('tag', [\n  z.object({\n    tag: z.literal('created'),\n    document: AdminDocumentRecordSchema,\n    upload: AdminInitUploadSchema,\n  }),\n  z.object({\n    tag: z.literal('resumed'),\n    document: AdminDocumentRecordSchema,\n    upload: AdminInitUploadSchema,\n  }),\n  z.object({\n    tag: z.literal('deduped'),\n    document: AdminDocumentRecordSchema,\n  }),\n]);\nexport type AdminDocumentInitResponse = z.infer<typeof AdminDocumentInitResponseSchema>;\n\nexport const AdminDocumentCommitRequestSchema = z.object({\n  sha256: z.string().regex(sha256Hex),\n});\nexport type AdminDocumentCommitRequest = z.infer<typeof AdminDocumentCommitRequestSchema>;\n\nexport const AdminDocumentCommitResponseSchema = z.object({\n  document: AdminDocumentRecordSchema,\n});\nexport type AdminDocumentCommitResponse = z.infer<typeof AdminDocumentCommitResponseSchema>;\n\n/** UTF-8 byte length — provider key limits are byte rules, not JS code units. */\nconst utf8ByteLength = (s: string): number => new TextEncoder().encode(s).length;\n\n/**\n * A server-side pull source for `documents.importFrom`. The discriminator\n * distinguishes AUTHORIZATION MODELS, not storage vendors:\n *\n *   - `url`        — the CALLER supplies authority: a presigned\n *     S3/GCS/Azure/R2/MinIO GET, or any HTTPS endpoint the\n *     deployment's import policy allows. The URL is a capability:\n *     treat it as a secret. Servers never echo its query string back\n *     in errors, logs, or stored failure reasons.\n *   - `connection` — the OPERATOR pre-registered authority: the\n *     request names a connection and a key; which provider backs it\n *     (S3, GCS, Azure Blob, filesystem, ...) is deployment\n *     configuration, never wire surface. `revision` is opaque here\n *     and provider-interpreted (S3 VersionId, GCS generation, Azure\n *     version id); unsupported providers reject it.\n *\n * Key validation at this layer is deliberately generic (byte length,\n * no NUL); provider-exact rules live in the server's source adapters,\n * which know which backend a connection names.\n */\nexport const AdminImportSourceSchema = z.discriminatedUnion('kind', [\n  z.object({\n    kind: z.literal('url'),\n    url: z.string().url().max(8192),\n  }),\n  z.object({\n    kind: z.literal('connection'),\n    connectionId: z.string().min(1).max(128),\n    key: z\n      .string()\n      .min(1)\n      .refine((k) => !k.includes('\\0'), 'key must not contain NUL')\n      .refine((k) => utf8ByteLength(k) <= 1024, 'key must be at most 1024 UTF-8 bytes'),\n    revision: z.string().min(1).max(1024).optional(),\n  }),\n]);\nexport type AdminImportSource = z.infer<typeof AdminImportSourceSchema>;\n\nexport const AdminDocumentImportRequestSchema = z.object({\n  source: AdminImportSourceSchema,\n  /**\n   * Optional integrity pins, enforced when present: `sizeBytes`\n   * against the source's declared Content-Length before the transfer,\n   * `sha256` against the server-observed digest after it. When absent\n   * the server-observed values become authoritative.\n   * `dedupMode=reuse-existing` REQUIRES `sha256` — without a declared\n   * hash the server cannot know what content to reuse.\n   */\n  expected: z\n    .object({\n      sizeBytes: z.number().int().min(1).optional(),\n      sha256: z.string().regex(sha256Hex).optional(),\n    })\n    .optional(),\n  metadata: z.record(z.string(), z.unknown()).optional(),\n  idempotencyKey: z.string().optional(),\n  dedupMode: DedupModeSchema.optional(),\n  docId: z.string().regex(docIdPattern).optional(),\n  /**\n   * `sync` (default) holds the response open for the whole transfer.\n   * `async` accepts the request (202, document `pending`), transfers\n   * in the background, and the caller polls the document. Async\n   * requires a `connection` source (URLs are secrets and expire, so\n   * they cannot sit in a durable job); filesystem connections\n   * additionally require `expected.sha256`, since they have no\n   * revisions to pin retries to.\n   */\n  mode: z.enum(['sync', 'async']).optional(),\n});\nexport type AdminDocumentImportRequest = z.infer<typeof AdminDocumentImportRequestSchema>;\n\nexport const AdminDocumentImportResponseSchema = z.object({\n  /**\n   * `imported` — bytes were pulled, verified, and committed (sync).\n   * `deduped`  — an existing document satisfied the request without a\n   * transfer (content dedup or idempotent replay).\n   * `accepted` — async: the job is queued (HTTP 202); poll the\n   * document until `ready` or `failed`.\n   */\n  tag: z.enum(['imported', 'deduped', 'accepted']),\n  document: AdminDocumentRecordSchema,\n});\nexport type AdminDocumentImportResponse = z.infer<typeof AdminDocumentImportResponseSchema>;\n\nexport const AdminDocumentResponseSchema = z.object({\n  document: AdminDocumentRecordSchema,\n});\nexport type AdminDocumentResponse = z.infer<typeof AdminDocumentResponseSchema>;\n\nexport const ADMIN_DOCUMENT_LIST_DEFAULT_LIMIT = 100;\nexport const ADMIN_DOCUMENT_LIST_MAX_LIMIT = 200;\n\n/**\n * Query parameters for `documents.list`. `limit` arrives as a string on\n * the wire, hence the coercion; values outside [1, MAX] are a validation\n * error, not a silent clamp. `cursor` is an opaque continuation token\n * from a previous page's `nextCursor` — clients must not parse it.\n */\nexport const AdminDocumentListQuerySchema = z.object({\n  limit: z.coerce\n    .number()\n    .int()\n    .min(1)\n    .max(ADMIN_DOCUMENT_LIST_MAX_LIMIT)\n    .default(ADMIN_DOCUMENT_LIST_DEFAULT_LIMIT),\n  cursor: z.string().min(1).optional(),\n  state: DocumentStateSchema.optional(),\n});\nexport type AdminDocumentListQuery = z.infer<typeof AdminDocumentListQuerySchema>;\n\nexport const AdminDocumentListResponseSchema = z.object({\n  documents: z.array(AdminDocumentRecordSchema),\n  /**\n   * Opaque cursor for the next page; `null` on the last page. Optional\n   * because pre-pagination servers omit it — clients treat absence as\n   * \"no continuation available\", same convention as the thumbnail fields.\n   */\n  nextCursor: z.string().nullable().optional(),\n});\nexport type AdminDocumentListResponse = z.infer<typeof AdminDocumentListResponseSchema>;\n\nexport const AdminUploadProxyResponseSchema = z.object({\n  sha256: z.string().regex(sha256Hex),\n});\nexport type AdminUploadProxyResponse = z.infer<typeof AdminUploadProxyResponseSchema>;\n\nexport const AdminErrorPayloadSchema = z.object({\n  error: z.object({\n    code: z.string(),\n    message: z.string(),\n  }),\n});\nexport type AdminErrorPayload = z.infer<typeof AdminErrorPayloadSchema>;\n\n/**\n * The thumbnail route's 404 while the warmed artifact is `pending`,\n * `locked`, or `failed` — the standard error envelope plus the tile\n * state so dashboards can render the right placeholder.\n */\nexport const AdminThumbnailUnavailablePayloadSchema = z.object({\n  error: z.object({\n    code: z.string(),\n    message: z.string(),\n    state: z.string(),\n  }),\n});\nexport type AdminThumbnailUnavailablePayload = z.infer<\n  typeof AdminThumbnailUnavailablePayloadSchema\n>;\n\nexport const AdminTenantParamsSchema = z.object({\n  tenantId: z.string().regex(tenantIdPattern),\n});\nexport type AdminTenantParams = z.infer<typeof AdminTenantParamsSchema>;\n\nexport const AdminTenantDocParamsSchema = z.object({\n  tenantId: z.string().regex(tenantIdPattern),\n  id: z.string().regex(docIdPattern),\n});\nexport type AdminTenantDocParams = z.infer<typeof AdminTenantDocParamsSchema>;\n\nexport const AdminTenantJtiParamsSchema = z.object({\n  tenantId: z.string().regex(tenantIdPattern),\n  jti: z.string().min(1).max(256),\n});\nexport type AdminTenantJtiParams = z.infer<typeof AdminTenantJtiParamsSchema>;\n\nexport const AdminTokenRevokeRequestSchema = z.object({\n  /** Optional human reason, written to the audit row. */\n  reason: z.string().max(1024).optional(),\n  /**\n   * The token's `exp` (unix seconds), used to GC the revocation row\n   * once the token would have expired anyway. Defaults server-side to\n   * now + 30 days.\n   */\n  expiresAtSeconds: z.number().int().positive().optional(),\n});\nexport type AdminTokenRevokeRequest = z.infer<typeof AdminTokenRevokeRequestSchema>;\n\n/**\n * License/reporting/usage passthrough. The inner shapes belong to the\n * licensing runtime and are surfaced as-is; they tighten to full\n * schemas when the licensing contract stabilizes.\n */\nexport const AdminLicenseStatusResponseSchema = z.object({\n  license: z.unknown(),\n  reporting: z.unknown().nullable(),\n  usage: z.unknown().nullable(),\n});\nexport type AdminLicenseStatusResponse = z.infer<typeof AdminLicenseStatusResponseSchema>;\n\nexport const AdminTenantRecordSchema = z.object({\n  id: z.string(),\n  name: z.string(),\n  /** True when the namespace materialized on first use rather than via explicit create. */\n  autoProvisioned: z.boolean(),\n  /**\n   * `suspended` tenants fail closed: every tenant JWT, doc JWT, and\n   * share exchange is refused until resume. The API token is exempt —\n   * the operator must be able to inspect, resume, or delete a\n   * suspended tenant. Optional because older servers omit it.\n   */\n  status: z.enum(['active', 'suspended']).optional(),\n  createdAt: z.number(),\n});\nexport type AdminTenantRecord = z.infer<typeof AdminTenantRecordSchema>;\n\nexport const AdminTenantCreateRequestSchema = z.object({\n  id: z.string().regex(tenantIdPattern),\n  /** Display name; defaults to the id. */\n  name: z.string().min(1).max(256).optional(),\n});\nexport type AdminTenantCreateRequest = z.infer<typeof AdminTenantCreateRequestSchema>;\n\nexport const AdminTenantCreateResponseSchema = z.object({\n  tenant: AdminTenantRecordSchema,\n  /** False when the tenant already existed — create is ensure-style. */\n  created: z.boolean(),\n});\nexport type AdminTenantCreateResponse = z.infer<typeof AdminTenantCreateResponseSchema>;\n\nexport const AdminTenantResponseSchema = z.object({\n  tenant: AdminTenantRecordSchema,\n});\nexport type AdminTenantResponse = z.infer<typeof AdminTenantResponseSchema>;\n\nexport const AdminTenantListQuerySchema = z.object({\n  limit: z.coerce\n    .number()\n    .int()\n    .min(1)\n    .max(ADMIN_DOCUMENT_LIST_MAX_LIMIT)\n    .default(ADMIN_DOCUMENT_LIST_DEFAULT_LIMIT),\n  cursor: z.string().min(1).optional(),\n});\nexport type AdminTenantListQuery = z.infer<typeof AdminTenantListQuerySchema>;\n\nexport const AdminTenantListResponseSchema = z.object({\n  tenants: z.array(AdminTenantRecordSchema),\n  /** Opaque cursor for the next page; `null` on the last page. */\n  nextCursor: z.string().nullable().optional(),\n});\nexport type AdminTenantListResponse = z.infer<typeof AdminTenantListResponseSchema>;\n\n/**\n * Tenant-token scopes used by the admin surface. The wildcard `*`\n * always satisfies a scope check and is deliberately not listed —\n * operations declare the *specific* scope they require.\n *\n * `tokens.issue-doc` and `tokens.revoke` are deliberately separate:\n * issuance leaking is a confidentiality risk (unauthorized access\n * creation), revocation leaking is an availability risk (mass session\n * kill). Different failure directions, different scopes.\n *\n * `shares.manage` covers the whole share-grant lifecycle with one\n * scope: a grant is a standing mint capability, so creating and\n * revoking it are the same trust decision — unlike ephemeral tokens,\n * where issue and revoke fail in different directions.\n */\nexport const adminTenantScopes = [\n  'docs.create',\n  'docs.read',\n  'docs.delete',\n  'tokens.issue-doc',\n  'tokens.revoke',\n  'shares.manage',\n] as const;\nexport type AdminTenantScope = (typeof adminTenantScopes)[number];\n\nexport const AdminTokenIssueDocRequestSchema = z.object({\n  kind: z.literal('doc'),\n  /** Subject of the minted token — the end user's id in your system. */\n  sub: z.string().min(1).max(256),\n  docId: z.string().regex(docIdPattern),\n  layerName: z.string().min(1).max(256).optional(),\n  /**\n   * Doc capability scopes (`doc.open`, `doc.render`, …, plus the\n   * collab grammar). Validated server-side against the engine's scope\n   * vocabulary — an unknown string rejects the whole request.\n   */\n  scope: z.array(z.string().min(1).max(128)).min(1).max(64),\n  userId: z.string().max(256).optional(),\n  displayName: z.string().max(256).optional(),\n  groupId: z.string().max(256).optional(),\n  groups: z.array(z.string().max(256)).max(64).optional(),\n  /**\n   * Origin lock: web origins (scheme + host, optional port; one leading\n   * `*.` wildcard label allowed) the minted token may be presented\n   * from. Enforced on every engine request that carries a browser\n   * `Origin` header — hotlink prevention, not DRM: non-browser callers\n   * are governed by the token itself.\n   */\n  origins: originPatternArray.optional(),\n  /** Token lifetime in seconds. */\n  expiresIn: z\n    .number()\n    .int()\n    .min(60)\n    .max(60 * 60 * 24 * 90),\n});\nexport type AdminTokenIssueDocRequest = z.infer<typeof AdminTokenIssueDocRequestSchema>;\n\nexport const AdminTokenIssueTenantRequestSchema = z.object({\n  kind: z.literal('tenant'),\n  sub: z.string().min(1).max(256),\n  scope: z\n    .array(z.union([z.literal('*'), z.enum(adminTenantScopes)]))\n    .min(1)\n    .max(16),\n  /** Token lifetime in seconds. */\n  expiresIn: z\n    .number()\n    .int()\n    .min(60)\n    .max(60 * 60 * 24 * 90),\n});\nexport type AdminTokenIssueTenantRequest = z.infer<typeof AdminTokenIssueTenantRequestSchema>;\n\nexport const AdminTokenIssueRequestSchema = z.discriminatedUnion('kind', [\n  AdminTokenIssueDocRequestSchema,\n  AdminTokenIssueTenantRequestSchema,\n]);\nexport type AdminTokenIssueRequest = z.infer<typeof AdminTokenIssueRequestSchema>;\n\nexport const AdminTokenIssueResponseSchema = z.object({\n  token: z.string(),\n  jti: z.string(),\n  /** Unix seconds. */\n  expiresAt: z.number(),\n});\nexport type AdminTokenIssueResponse = z.infer<typeof AdminTokenIssueResponseSchema>;\n\n// ---------------------------------------------------------------------------\n// Operation registry\n// ---------------------------------------------------------------------------\n//\n// The registry is the admin surface's contract: one entry per operation\n// carrying method, path template, required tenant scope, and the request/\n// response schemas. The server mounts its routes FROM these entries (so the\n// registry is executed, not merely described), and the OpenAPI document is\n// generated from the same entries in CI. Migration status: `documents.list`\n// is registered; the remaining admin operations move in as they are touched.\n\n/**\n * The credential kinds of the one-rule auth model: the API token\n * (static deployment secret) is valid everywhere; a tenant JWT is valid\n * exactly under its own `/v1/tenants/{tenantId}/` subtree; a doc JWT is\n * valid exactly on the `/v1/docs/{docId}` subtree it names, gated by\n * the capability scopes it carries.\n */\n// ---------------------------------------------------------------------------\n// Share grants\n// ---------------------------------------------------------------------------\n//\n// A share grant is a standing, revocable authorization decision stored\n// with the documents: \"anyone presenting this reference, from these\n// origins, gets exactly these capabilities on this document\". The grant\n// id doubles as the public share token — it is a REFERENCE whose power\n// is evaluated at exchange time, never a bearer credential, which is\n// what lets it live in public HTML while staying editable and\n// revocable. The only credential it ever produces is an ordinary\n// short-lived doc JWT, minted downward at `shares.exchange`.\n\nexport const ShareGrantRecordSchema = z.object({\n  /** Grant id; doubles as the public share token (`shr_…`). */\n  id: z.string(),\n  tenantId: z.string(),\n  docId: z.string(),\n  layerName: z.string(),\n  /** Doc capabilities the exchanged session carries. */\n  scope: z.array(z.string()),\n  /** Origin allowlist; null means any origin. */\n  origins: z.array(z.string()).nullable(),\n  /** True when a passphrase is required at exchange. The passphrase itself is never returned. */\n  passwordProtected: z.boolean(),\n  /** Lifetime of each exchanged session token, in seconds. */\n  sessionTtlSeconds: z.number(),\n  /** Paused grants refuse exchange (404) but keep their configuration. */\n  disabled: z.boolean(),\n  /** Unix epoch ms after which exchange returns 410; null = no expiry. */\n  expiresAt: z.number().nullable(),\n  /** Total successful exchanges — a dashboard convenience, not the usage meter. */\n  exchangeCount: z.number(),\n  lastExchangedAt: z.number().nullable(),\n  createdBy: z.string(),\n  createdAt: z.number(),\n  updatedAt: z.number(),\n});\nexport type ShareGrantRecord = z.infer<typeof ShareGrantRecordSchema>;\n\nexport const ShareGrantCreateRequestSchema = z.object({\n  docId: z.string().regex(docIdPattern),\n  layerName: z.string().min(1).max(256).optional(),\n  /**\n   * Doc capability scopes the exchanged session will carry. Validated\n   * server-side against the engine's scope vocabulary, same as\n   * `tokens.issue`.\n   */\n  scope: z.array(z.string().min(1).max(128)).min(1).max(64),\n  /** Origin allowlist; omit to allow any origin. */\n  origins: originPatternArray.optional(),\n  /** Optional passphrase gate, checked at exchange. Stored as a hash; never returned. */\n  password: z.string().min(1).max(1024).optional(),\n  /** Lifetime of exchanged session tokens. Default 600. */\n  sessionTtlSeconds: z\n    .number()\n    .int()\n    .min(60)\n    .max(60 * 60)\n    .optional(),\n  /** Unix epoch ms after which the grant stops exchanging; omit for no expiry. */\n  expiresAt: z.number().int().positive().optional(),\n});\nexport type ShareGrantCreateRequest = z.infer<typeof ShareGrantCreateRequestSchema>;\n\n/**\n * Partial update. `origins: null` clears the allowlist (any origin),\n * `password: null` removes the passphrase, `expiresAt: null` removes\n * the expiry. Absent fields stay untouched. The exchanged capabilities\n * and origin lock of every embedded snippet follow the row — editing a\n * grant retargets the copies already pasted into pages.\n */\nexport const ShareGrantUpdateRequestSchema = z.object({\n  scope: z.array(z.string().min(1).max(128)).min(1).max(64).optional(),\n  origins: originPatternArray.nullable().optional(),\n  password: z.string().min(1).max(1024).nullable().optional(),\n  sessionTtlSeconds: z\n    .number()\n    .int()\n    .min(60)\n    .max(60 * 60)\n    .optional(),\n  disabled: z.boolean().optional(),\n  expiresAt: z.number().int().positive().nullable().optional(),\n});\nexport type ShareGrantUpdateRequest = z.infer<typeof ShareGrantUpdateRequestSchema>;\n\nexport const ShareGrantResponseSchema = z.object({\n  share: ShareGrantRecordSchema,\n});\nexport type ShareGrantResponse = z.infer<typeof ShareGrantResponseSchema>;\n\nexport const ShareGrantListQuerySchema = z.object({\n  limit: z.coerce\n    .number()\n    .int()\n    .min(1)\n    .max(ADMIN_DOCUMENT_LIST_MAX_LIMIT)\n    .default(ADMIN_DOCUMENT_LIST_DEFAULT_LIMIT),\n  cursor: z.string().min(1).optional(),\n  /** Filter to one document's grants. */\n  docId: z.string().regex(docIdPattern).optional(),\n});\nexport type ShareGrantListQuery = z.infer<typeof ShareGrantListQuerySchema>;\n\nexport const ShareGrantListResponseSchema = z.object({\n  shares: z.array(ShareGrantRecordSchema),\n  /** Opaque cursor for the next page; `null` on the last page. */\n  nextCursor: z.string().nullable().optional(),\n});\nexport type ShareGrantListResponse = z.infer<typeof ShareGrantListResponseSchema>;\n\nexport const AdminTenantShareParamsSchema = z.object({\n  tenantId: z.string().regex(tenantIdPattern),\n  shareId: z.string().regex(shareTokenPattern),\n});\nexport type AdminTenantShareParams = z.infer<typeof AdminTenantShareParamsSchema>;\n\n/**\n * The share token travels in the BODY, never the path — URLs land in\n * access logs and proxy logs, and the token is the whole credential.\n */\nexport const ShareExchangeRequestSchema = z.object({\n  shareToken: z.string().regex(shareTokenPattern),\n  /** Required when the grant is passphrase-protected (422 otherwise). */\n  password: z.string().min(1).max(1024).optional(),\n});\nexport type ShareExchangeRequest = z.infer<typeof ShareExchangeRequestSchema>;\n\nexport const ShareSessionResponseSchema = z.object({\n  /** A doc-scoped session JWT carrying the grant's capabilities and origin lock. */\n  token: z.string(),\n  docId: z.string(),\n  layerName: z.string(),\n  /** Unix seconds when the session token expires; exchange again for a fresh one. */\n  expiresAt: z.number(),\n});\nexport type ShareSessionResponse = z.infer<typeof ShareSessionResponseSchema>;\n\n// ---------------------------------------------------------------------------\n// Tenant usage + suspension\n// ---------------------------------------------------------------------------\n\nexport const TenantUsageQuerySchema = z.object({\n  /** UTC month to report, `YYYY-MM`. Defaults to the current month. */\n  period: z\n    .string()\n    .regex(/^\\d{4}-(0[1-9]|1[0-2])$/)\n    .optional(),\n});\nexport type TenantUsageQuery = z.infer<typeof TenantUsageQuerySchema>;\n\n/**\n * Per-tenant usage FACTS for one UTC month. Deliberately opinion-free:\n * no limits, no plans, no billing state — those belong to whoever\n * operates the deployment. `pdf.views` counts share exchanges plus\n * authorized `/v1/access` grants, deduplicated (a share session that\n * later establishes access is not counted twice).\n */\nexport const TenantUsageResponseSchema = z.object({\n  tenantId: z.string(),\n  periodStart: z.string(),\n  periodEnd: z.string(),\n  metrics: z.object({\n    'pdf.views': z.number(),\n    'pdf.uploads': z.number(),\n    'storage.bytes': z.number(),\n  }),\n});\nexport type TenantUsageResponse = z.infer<typeof TenantUsageResponseSchema>;\n\nexport const TenantSuspendRequestSchema = z.object({\n  /** Optional operator reason, written to the security-events trail. */\n  reason: z.string().max(1024).optional(),\n});\nexport type TenantSuspendRequest = z.infer<typeof TenantSuspendRequestSchema>;\n\nexport const adminCredentials = ['api-token', 'tenant-jwt', 'doc-jwt'] as const;\nexport type AdminCredential = (typeof adminCredentials)[number];\n\nexport type AdminOperationMethod = 'GET' | 'POST' | 'PATCH' | 'DELETE';\n\nexport interface AdminOperationHeader {\n  name: string;\n  description: string;\n  /** Defaults to false. */\n  required?: boolean;\n}\n\nexport interface AdminOperationResponse {\n  /**\n   * MIME type(s) of the response body. An array means the server picks\n   * one per response (e.g. thumbnail webp/png). Absent = empty body\n   * (204-style).\n   */\n  contentType?: string | ReadonlyArray<string>;\n  /** Body schema; absent for empty or binary bodies. */\n  schema?: z.ZodTypeAny;\n}\n\nexport interface AdminOperationBody {\n  /** Accepted request MIME type(s). */\n  contentType: string | ReadonlyArray<string>;\n  /** Body schema; absent for binary bodies. */\n  schema?: z.ZodTypeAny;\n  /** Defaults to true; false when the operation accepts an empty body. */\n  required?: boolean;\n}\n\n/**\n * One admin operation, fully described: everything a server needs to mount\n * it and everything a generator needs to document it.\n */\nexport interface AdminOperation {\n  /** Stable `resource.verb` id; becomes the OpenAPI operationId. */\n  operationId: string;\n  /**\n   * Short display name for documentation surfaces (page titles, nav) —\n   * a noun phrase like \"Create tenant\", not a sentence. Emitted as\n   * `x-docs-title`; the API reference renders it verbatim, so naming\n   * an operation is part of designing it.\n   */\n  title: string;\n  summary: string;\n  method: AdminOperationMethod;\n  /** Fastify-style path template (`:param`); rewritten to `{param}` for OpenAPI. */\n  path: string;\n  /**\n   * Credentials accepted by this operation. The API token is root and\n   * passes every scope check; a tenant JWT additionally requires the\n   * path's `tenantId` to equal the token's `tenant_id`. Doc-scoped\n   * tokens are always rejected on these surfaces.\n   */\n  credentials: ReadonlyArray<AdminCredential>;\n  /**\n   * Tenant scopes accepted on the tenant-jwt path — possessing any one\n   * grants access (`*` always does). Empty for API-token-only\n   * operations, where no scope model applies.\n   */\n  scope: ReadonlyArray<AdminTenantScope>;\n  /**\n   * Doc capabilities required on the doc-jwt path — typed against the\n   * engine-core vocabulary so a misspelled capability fails compile.\n   * The API token bypasses capability checks, same as it passes tenant\n   * scope checks. Present only on doc-plane operations.\n   */\n  docCapabilities?: ReadonlyArray<DocCapability>;\n  /** Documented request headers (beyond Authorization). */\n  requestHeaders?: ReadonlyArray<AdminOperationHeader>;\n  /** Path-parameter schema, keyed by template name. */\n  params?: z.ZodTypeAny;\n  /** Query-string schema. */\n  query?: z.ZodTypeAny;\n  /** Request body. */\n  body?: AdminOperationBody;\n  /** Success and known-error responses by HTTP status code. */\n  responses: Readonly<Record<number, AdminOperationResponse>>;\n  /**\n   * Deployment caveats a generated doc must carry — e.g. an operation\n   * that is only mounted under a server flag.\n   */\n  notes?: string;\n}\n\nexport const adminOperations = {\n  'tenants.create': {\n    operationId: 'tenants.create',\n    title: 'Create tenant',\n    summary: 'Create a tenant, or confirm it already exists — ensure-style, idempotent.',\n    method: 'POST',\n    path: adminWirePaths.tenants,\n    credentials: ['api-token'],\n    scope: [],\n    body: { contentType: 'application/json', schema: AdminTenantCreateRequestSchema },\n    responses: {\n      200: { contentType: 'application/json', schema: AdminTenantCreateResponseSchema },\n      400: { contentType: 'application/json', schema: AdminErrorPayloadSchema },\n    },\n  },\n  'tenants.list': {\n    operationId: 'tenants.list',\n    title: 'List tenants',\n    summary: 'List tenants, newest first, cursor-paginated.',\n    method: 'GET',\n    path: adminWirePaths.tenants,\n    credentials: ['api-token'],\n    scope: [],\n    query: AdminTenantListQuerySchema,\n    responses: {\n      200: { contentType: 'application/json', schema: AdminTenantListResponseSchema },\n      400: { contentType: 'application/json', schema: AdminErrorPayloadSchema },\n    },\n  },\n  'tenants.get': {\n    operationId: 'tenants.get',\n    title: 'Get tenant',\n    summary: 'Fetch one tenant record.',\n    method: 'GET',\n    path: '/v1/tenants/:tenantId',\n    credentials: ['api-token'],\n    scope: [],\n    params: AdminTenantParamsSchema,\n    responses: {\n      200: { contentType: 'application/json', schema: AdminTenantResponseSchema },\n      404: { contentType: 'application/json', schema: AdminErrorPayloadSchema },\n    },\n  },\n  'tenants.delete': {\n    operationId: 'tenants.delete',\n    title: 'Delete tenant',\n    summary: 'Delete a tenant and everything under it.',\n    method: 'DELETE',\n    path: '/v1/tenants/:tenantId',\n    credentials: ['api-token'],\n    scope: [],\n    params: AdminTenantParamsSchema,\n    responses: {\n      204: {},\n      404: { contentType: 'application/json', schema: AdminErrorPayloadSchema },\n    },\n    notes:\n      'Destroys the tenant and everything in its namespace — documents, layers, stored bytes, audit history. Irreversible.',\n  },\n  'documents.init': {\n    operationId: 'documents.init',\n    title: 'Initialize upload',\n    summary:\n      'Begin an upload: create (or resume/dedupe) a pending document and issue upload access.',\n    method: 'POST',\n    path: '/v1/tenants/:tenantId/documents/init',\n    credentials: ['api-token', 'tenant-jwt'],\n    scope: ['docs.create'],\n    params: AdminTenantParamsSchema,\n    body: { contentType: 'application/json', schema: AdminDocumentInitRequestSchema },\n    responses: {\n      200: { contentType: 'application/json', schema: AdminDocumentInitResponseSchema },\n      400: { contentType: 'application/json', schema: AdminErrorPayloadSchema },\n    },\n  },\n  'documents.commit': {\n    operationId: 'documents.commit',\n    title: 'Commit upload',\n    summary: 'Finish an upload: verify the SHA-256 and promote the document to ready.',\n    method: 'POST',\n    path: '/v1/tenants/:tenantId/documents/:id/commit',\n    credentials: ['api-token', 'tenant-jwt'],\n    scope: ['docs.create'],\n    params: AdminTenantDocParamsSchema,\n    body: { contentType: 'application/json', schema: AdminDocumentCommitRequestSchema },\n    responses: {\n      200: { contentType: 'application/json', schema: AdminDocumentCommitResponseSchema },\n      400: { contentType: 'application/json', schema: AdminErrorPayloadSchema },\n      404: { contentType: 'application/json', schema: AdminErrorPayloadSchema },\n    },\n  },\n  'documents.uploadProxy': {\n    operationId: 'documents.uploadProxy',\n    title: 'Upload document through the origin',\n    summary: 'Upload a bounded PDF through the API when the initialized transfer kind is proxy.',\n    method: 'POST',\n    path: '/v1/tenants/:tenantId/documents/:id/upload-proxy',\n    credentials: ['api-token', 'tenant-jwt'],\n    scope: ['docs.create'],\n    params: AdminTenantDocParamsSchema,\n    body: {\n      contentType: 'multipart/form-data',\n    },\n    responses: {\n      200: { contentType: 'application/json', schema: AdminUploadProxyResponseSchema },\n      400: { contentType: 'application/json', schema: AdminErrorPayloadSchema },\n      409: { contentType: 'application/json', schema: AdminErrorPayloadSchema },\n    },\n    notes:\n      'This bounded origin-mediated fallback must only be used after documents.init returns upload.kind=proxy. Auto mode prefers a presigned object-store PUT whenever available.',\n  },\n  'documents.importFrom': {\n    operationId: 'documents.importFrom',\n    title: 'Import document',\n    summary:\n      'Server-side pull: fetch a PDF from a caller-supplied URL (e.g. a presigned object-store GET) or an operator-registered storage connection into CloudPDF-owned storage, verify it, and commit it.',\n    method: 'POST',\n    path: '/v1/tenants/:tenantId/documents/import',\n    credentials: ['api-token', 'tenant-jwt'],\n    scope: ['docs.create'],\n    params: AdminTenantParamsSchema,\n    body: { contentType: 'application/json', schema: AdminDocumentImportRequestSchema },\n    responses: {\n      200: { contentType: 'application/json', schema: AdminDocumentImportResponseSchema },\n      202: { contentType: 'application/json', schema: AdminDocumentImportResponseSchema },\n      400: { contentType: 'application/json', schema: AdminErrorPayloadSchema },\n      403: { contentType: 'application/json', schema: AdminErrorPayloadSchema },\n      502: { contentType: 'application/json', schema: AdminErrorPayloadSchema },\n    },\n    notes:\n      'Default mode is synchronous and bounded: the response returns only after the transfer verified and committed (or failed). mode=async (connection sources only) answers 202 immediately and an in-process worker performs the transfer with leased, fenced retries; poll the document until ready/failed. The deployment import policy gates scheme, network range, and size; sources must declare a length. CloudPDF copies and owns the bytes — the source is never referenced in place. A 502 marks a retryable upstream failure: retry with the same idempotencyKey to resume the same document. URL sources are capabilities and never echoed back. Connection sources name operator-registered storage (bucket/prefix scope, allowed credential classes, and tenant bindings are deployment configuration); `revision` is provider-interpreted (S3 VersionId, GCS generation, Azure version id).',\n  },\n  'documents.list': {\n    operationId: 'documents.list',\n    title: 'List documents',\n    summary: 'List documents in the tenant, newest first, cursor-paginated.',\n    method: 'GET',\n    path: '/v1/tenants/:tenantId/documents',\n    credentials: ['api-token', 'tenant-jwt'],\n    scope: ['docs.read'],\n    params: AdminTenantParamsSchema,\n    query: AdminDocumentListQuerySchema,\n    responses: {\n      200: { contentType: 'application/json', schema: AdminDocumentListResponseSchema },\n      400: { contentType: 'application/json', schema: AdminErrorPayloadSchema },\n    },\n  },\n  'documents.get': {\n    operationId: 'documents.get',\n    title: 'Get document',\n    summary: 'Fetch one document record.',\n    method: 'GET',\n    path: '/v1/tenants/:tenantId/documents/:id',\n    credentials: ['api-token', 'tenant-jwt'],\n    scope: ['docs.read'],\n    params: AdminTenantDocParamsSchema,\n    responses: {\n      200: { contentType: 'application/json', schema: AdminDocumentResponseSchema },\n      403: { contentType: 'application/json', schema: AdminErrorPayloadSchema },\n      404: { contentType: 'application/json', schema: AdminErrorPayloadSchema },\n    },\n  },\n  'documents.download': {\n    operationId: 'documents.download',\n    title: 'Download document',\n    summary: 'Download the stored base PDF bytes.',\n    method: 'GET',\n    path: '/v1/tenants/:tenantId/documents/:id/download',\n    credentials: ['api-token', 'tenant-jwt'],\n    scope: ['docs.read'],\n    params: AdminTenantDocParamsSchema,\n    responses: {\n      200: { contentType: 'application/pdf' },\n      403: { contentType: 'application/json', schema: AdminErrorPayloadSchema },\n      404: { contentType: 'application/json', schema: AdminErrorPayloadSchema },\n    },\n  },\n  'documents.delete': {\n    operationId: 'documents.delete',\n    title: 'Delete document',\n    summary: 'Delete a document and its stored artifacts.',\n    method: 'DELETE',\n    path: '/v1/tenants/:tenantId/documents/:id',\n    credentials: ['api-token', 'tenant-jwt'],\n    scope: ['docs.delete'],\n    params: AdminTenantDocParamsSchema,\n    responses: {\n      204: {},\n      403: { contentType: 'application/json', schema: AdminErrorPayloadSchema },\n      404: { contentType: 'application/json', schema: AdminErrorPayloadSchema },\n    },\n  },\n  'documents.thumbnail': {\n    operationId: 'documents.thumbnail',\n    title: 'Get thumbnail',\n    summary: 'Fetch the warmed dashboard-tile render for a document.',\n    method: 'GET',\n    path: '/v1/tenants/:tenantId/documents/:id/thumbnail',\n    credentials: ['api-token', 'tenant-jwt'],\n    scope: ['docs.read'],\n    params: AdminTenantDocParamsSchema,\n    responses: {\n      200: { contentType: ['image/webp', 'image/png'] },\n      404: { contentType: 'application/json', schema: AdminThumbnailUnavailablePayloadSchema },\n    },\n  },\n  'deployment.licenseStatus': {\n    operationId: 'deployment.licenseStatus',\n    title: 'License status',\n    summary: 'License decision plus usage-reporting and meter snapshots for this deployment.',\n    method: 'GET',\n    path: adminWirePaths.deploymentLicenseStatus,\n    credentials: ['api-token'],\n    scope: [],\n    responses: {\n      200: { contentType: 'application/json', schema: AdminLicenseStatusResponseSchema },\n    },\n  },\n  'tokens.issue': {\n    operationId: 'tokens.issue',\n    title: 'Issue token',\n    summary: 'Mint a delegated JWT: a doc token, or (API token only) a tenant token.',\n    method: 'POST',\n    path: '/v1/tenants/:tenantId/tokens',\n    credentials: ['api-token', 'tenant-jwt'],\n    scope: ['tokens.issue-doc'],\n    params: AdminTenantParamsSchema,\n    body: { contentType: 'application/json', schema: AdminTokenIssueRequestSchema },\n    responses: {\n      200: { contentType: 'application/json', schema: AdminTokenIssueResponseSchema },\n      400: { contentType: 'application/json', schema: AdminErrorPayloadSchema },\n      403: { contentType: 'application/json', schema: AdminErrorPayloadSchema },\n      404: { contentType: 'application/json', schema: AdminErrorPayloadSchema },\n    },\n    notes:\n      'kind \"tenant\" requires the API token — authority mints only downward. Mounted only when the deployment can sign (HS256 mode); asymmetric deployments mint with their own private key.',\n  },\n  'tokens.revoke': {\n    operationId: 'tokens.revoke',\n    title: 'Revoke token',\n    summary: 'Revoke a token by jti; live sessions drop on their next heartbeat.',\n    method: 'POST',\n    path: '/v1/tenants/:tenantId/tokens/:jti/revoke',\n    credentials: ['api-token', 'tenant-jwt'],\n    scope: ['tokens.revoke'],\n    params: AdminTenantJtiParamsSchema,\n    body: {\n      contentType: 'application/json',\n      schema: AdminTokenRevokeRequestSchema,\n      required: false,\n    },\n    responses: {\n      204: {},\n      400: { contentType: 'application/json', schema: AdminErrorPayloadSchema },\n    },\n    notes: 'Mounted only when the deployment enables token revocation.',\n  },\n  'tenants.usage': {\n    operationId: 'tenants.usage',\n    title: 'Tenant usage',\n    summary: 'Per-tenant usage facts (views, uploads, stored bytes) for one UTC month.',\n    method: 'GET',\n    path: '/v1/tenants/:tenantId/usage',\n    credentials: ['api-token', 'tenant-jwt'],\n    scope: ['docs.read'],\n    params: AdminTenantParamsSchema,\n    query: TenantUsageQuerySchema,\n    responses: {\n      200: { contentType: 'application/json', schema: TenantUsageResponseSchema },\n      400: { contentType: 'application/json', schema: AdminErrorPayloadSchema },\n      404: { contentType: 'application/json', schema: AdminErrorPayloadSchema },\n    },\n    notes:\n      'Facts only — no limits or billing state. Views count share exchanges plus authorized ' +\n      '/v1/access grants, deduplicated across the two.',\n  },\n  'tenants.suspend': {\n    operationId: 'tenants.suspend',\n    title: 'Suspend tenant',\n    summary: 'Fail the tenant closed: refuse every tenant JWT, doc JWT, and share exchange.',\n    method: 'POST',\n    path: '/v1/tenants/:tenantId/suspend',\n    credentials: ['api-token'],\n    scope: [],\n    params: AdminTenantParamsSchema,\n    body: {\n      contentType: 'application/json',\n      schema: TenantSuspendRequestSchema,\n      required: false,\n    },\n    responses: {\n      204: {},\n      404: { contentType: 'application/json', schema: AdminErrorPayloadSchema },\n    },\n    notes:\n      'Instantly reversible with resume. The API token is exempt, so a suspended tenant can ' +\n      'still be inspected, exported, resumed, or deleted.',\n  },\n  'tenants.resume': {\n    operationId: 'tenants.resume',\n    title: 'Resume tenant',\n    summary: 'Lift a suspension; credentials for the tenant verify again.',\n    method: 'POST',\n    path: '/v1/tenants/:tenantId/resume',\n    credentials: ['api-token'],\n    scope: [],\n    params: AdminTenantParamsSchema,\n    responses: {\n      204: {},\n      404: { contentType: 'application/json', schema: AdminErrorPayloadSchema },\n    },\n  },\n  'shares.create': {\n    operationId: 'shares.create',\n    title: 'Create share',\n    summary: 'Create a standing share grant for one document — the no-backend embed credential.',\n    method: 'POST',\n    path: '/v1/tenants/:tenantId/shares',\n    credentials: ['api-token', 'tenant-jwt'],\n    scope: ['shares.manage'],\n    params: AdminTenantParamsSchema,\n    body: { contentType: 'application/json', schema: ShareGrantCreateRequestSchema },\n    responses: {\n      200: { contentType: 'application/json', schema: ShareGrantResponseSchema },\n      400: { contentType: 'application/json', schema: AdminErrorPayloadSchema },\n      403: { contentType: 'application/json', schema: AdminErrorPayloadSchema },\n      404: { contentType: 'application/json', schema: AdminErrorPayloadSchema },\n    },\n    notes:\n      'The returned share id IS the public share token. Mounted only when the deployment can ' +\n      'sign (HS256 mode) — exchange mints session JWTs, so grants exist only where minting does.',\n  },\n  'shares.list': {\n    operationId: 'shares.list',\n    title: 'List shares',\n    summary: 'List share grants in the tenant, newest first, cursor-paginated.',\n    method: 'GET',\n    path: '/v1/tenants/:tenantId/shares',\n    credentials: ['api-token', 'tenant-jwt'],\n    scope: ['shares.manage'],\n    params: AdminTenantParamsSchema,\n    query: ShareGrantListQuerySchema,\n    responses: {\n      200: { contentType: 'application/json', schema: ShareGrantListResponseSchema },\n      400: { contentType: 'application/json', schema: AdminErrorPayloadSchema },\n    },\n  },\n  'shares.get': {\n    operationId: 'shares.get',\n    title: 'Get share',\n    summary: 'Fetch one share grant.',\n    method: 'GET',\n    path: '/v1/tenants/:tenantId/shares/:shareId',\n    credentials: ['api-token', 'tenant-jwt'],\n    scope: ['shares.manage'],\n    params: AdminTenantShareParamsSchema,\n    responses: {\n      200: { contentType: 'application/json', schema: ShareGrantResponseSchema },\n      404: { contentType: 'application/json', schema: AdminErrorPayloadSchema },\n    },\n  },\n  'shares.update': {\n    operationId: 'shares.update',\n    title: 'Update share',\n    summary: 'Edit a grant in place — every embedded copy of the token follows the row.',\n    method: 'PATCH',\n    path: '/v1/tenants/:tenantId/shares/:shareId',\n    credentials: ['api-token', 'tenant-jwt'],\n    scope: ['shares.manage'],\n    params: AdminTenantShareParamsSchema,\n    body: { contentType: 'application/json', schema: ShareGrantUpdateRequestSchema },\n    responses: {\n      200: { contentType: 'application/json', schema: ShareGrantResponseSchema },\n      400: { contentType: 'application/json', schema: AdminErrorPayloadSchema },\n      404: { contentType: 'application/json', schema: AdminErrorPayloadSchema },\n    },\n  },\n  'shares.delete': {\n    operationId: 'shares.delete',\n    title: 'Revoke share',\n    summary: 'Delete a grant; exchange stops immediately, live sessions lapse at their exp.',\n    method: 'DELETE',\n    path: '/v1/tenants/:tenantId/shares/:shareId',\n    credentials: ['api-token', 'tenant-jwt'],\n    scope: ['shares.manage'],\n    params: AdminTenantShareParamsSchema,\n    responses: {\n      204: {},\n      404: { contentType: 'application/json', schema: AdminErrorPayloadSchema },\n    },\n  },\n  'shares.exchange': {\n    operationId: 'shares.exchange',\n    title: 'Exchange share token',\n    summary: 'Trade a public share token for a short-lived document session JWT.',\n    method: 'POST',\n    path: adminWirePaths.shareSessions,\n    credentials: [],\n    scope: [],\n    body: { contentType: 'application/json', schema: ShareExchangeRequestSchema },\n    responses: {\n      200: { contentType: 'application/json', schema: ShareSessionResponseSchema },\n      400: { contentType: 'application/json', schema: AdminErrorPayloadSchema },\n      403: { contentType: 'application/json', schema: AdminErrorPayloadSchema },\n      404: { contentType: 'application/json', schema: AdminErrorPayloadSchema },\n      410: { contentType: 'application/json', schema: AdminErrorPayloadSchema },\n      422: { contentType: 'application/json', schema: AdminErrorPayloadSchema },\n    },\n    notes:\n      'Unauthenticated, but requires a browser Origin header, checked against the grant ' +\n      'allowlist. Unknown, revoked, and disabled tokens are indistinguishable (404). ' +\n      'Passphrase-protected grants return 422 SharePasswordRequired until `password` is ' +\n      'supplied. Mounted only when the deployment can sign (HS256 mode).',\n  },\n} as const satisfies Record<string, AdminOperation>;\nexport type AdminOperationId = keyof typeof adminOperations;\n\n// ---------------------------------------------------------------------------\n// Doc-plane operations (the backend-usable document API)\n// ---------------------------------------------------------------------------\n//\n// The \"API vs protocol\" split: these are the document operations a backend\n// can genuinely call — plain origin paths, credentialed by the API token\n// (which the server resolves to the document's own tenant) or a doc JWT\n// carrying the listed capabilities. The viewer-session protocol — /v1/access,\n// /v1/warm, the immutable `@{version}` CDN variants, SSE, weak annotation\n// sessions, password sessions — deliberately stays out of this registry: it\n// is the transport between the CloudPDF viewer SDK and the engine, free to\n// evolve behind the SDK boundary. Body/response schemas start deliberately\n// loose (documented paths, params, credentials, capabilities) and tighten\n// incrementally as the wire shapes are ported from engine-core.\n\nexport const DocIdParamsSchema = z.object({\n  docId: z.string().regex(docIdPattern),\n});\nexport const DocLayerParamsSchema = DocIdParamsSchema.extend({\n  layerName: z.string().min(1),\n});\nexport const DocPageParamsSchema = DocLayerParamsSchema.extend({\n  pon: z.coerce.number().int().min(0),\n});\nexport const DocAnnotationParamsSchema = DocPageParamsSchema.extend({\n  annotKey: z.string().min(1),\n});\nexport const DocFieldParamsSchema = DocLayerParamsSchema.extend({\n  fieldKey: z.string().min(1),\n});\n\n/**\n * Attached to every doc-plane operation: per-request password supply for\n * encrypted documents, API-token callers only. Viewer JWTs never send\n * passwords in headers — they use the SDK's password-session flow.\n */\nexport const documentPasswordHeader: AdminOperationHeader = {\n  name: 'X-Document-Password',\n  required: false,\n  description:\n    'Base64-encoded password for an encrypted document. Valid only with the API token ' +\n    '(403 anywhere else). An encrypted document answers 422 DocPasswordRequired when ' +\n    'the header is absent. Viewer doc JWTs use the SDK password-session flow instead.',\n};\n\nconst looseJson = z.record(z.string(), z.unknown());\nconst docCredentials = ['api-token', 'doc-jwt'] as const;\n\n/**\n * Every doc-plane mutation responds with the shared meta envelope — the\n * cache/version deltas SDKs use to re-point immutable reads — plus\n * operation-specific fields that tighten per-op as they are ported.\n */\nconst MutationResponseSchema = z.object({ meta: MutationMetaSchema }).passthrough();\n\nexport const docOperations = {\n  'doc.head': {\n    operationId: 'doc.head',\n    title: 'Open document',\n    summary: 'Open a document and return its head (versions, page count, security).',\n    method: 'GET',\n    path: wireTemplates.docHead,\n    credentials: docCredentials,\n    scope: [],\n    docCapabilities: ['doc.open'],\n    requestHeaders: [documentPasswordHeader],\n    params: DocIdParamsSchema,\n    responses: {\n      200: { contentType: 'application/json', schema: DocumentHeadSchema },\n      404: { contentType: 'application/json', schema: EngineErrorPayloadSchema },\n    },\n  },\n  'doc.manifest': {\n    operationId: 'doc.manifest',\n    title: 'Get manifest',\n    summary: \"Full layer manifest at the layer's current version.\",\n    method: 'GET',\n    path: wireTemplates.layerManifest,\n    credentials: docCredentials,\n    scope: [],\n    docCapabilities: ['doc.open'],\n    requestHeaders: [documentPasswordHeader],\n    params: DocLayerParamsSchema,\n    responses: {\n      200: { contentType: 'application/json', schema: DocumentManifestSchema },\n      404: { contentType: 'application/json', schema: EngineErrorPayloadSchema },\n    },\n  },\n  'doc.metadata.get': {\n    operationId: 'doc.metadata.get',\n    title: 'Get metadata',\n    summary: 'Document metadata (PDF info dictionary view) for a layer.',\n    method: 'GET',\n    path: wireTemplates.layerMetadata,\n    credentials: docCredentials,\n    scope: [],\n    docCapabilities: ['doc.open'],\n    requestHeaders: [documentPasswordHeader],\n    params: DocLayerParamsSchema,\n    responses: {\n      200: { contentType: 'application/json', schema: DocumentMetadataSchema },\n      404: { contentType: 'application/json', schema: EngineErrorPayloadSchema },\n    },\n  },\n  'doc.render': {\n    operationId: 'doc.render',\n    title: 'Render page',\n    summary: 'Render one page as an image at the current layer version.',\n    method: 'GET',\n    path: wireTemplates.layerRenderPage,\n    credentials: docCredentials,\n    scope: [],\n    docCapabilities: ['doc.render'],\n    requestHeaders: [documentPasswordHeader],\n    params: DocPageParamsSchema,\n    notes:\n      'Render parameters (viewport, format) pass as flat dotted query keys, e.g. ' +\n      '`?viewport.kind=width&viewport.width=800`; the full grammar is documented with the viewer.',\n    responses: {\n      200: { contentType: 'image/webp' },\n      404: { contentType: 'application/json', schema: EngineErrorPayloadSchema },\n    },\n  },\n  'doc.text': {\n    operationId: 'doc.text',\n    title: 'Extract page text',\n    summary: 'Extracted text content for one page.',\n    method: 'GET',\n    path: wireTemplates.layerTextPage,\n    credentials: docCredentials,\n    scope: [],\n    docCapabilities: ['doc.text.copy'],\n    requestHeaders: [documentPasswordHeader],\n    params: DocPageParamsSchema,\n    responses: {\n      200: { contentType: 'application/json', schema: PageTextSnapshotSchema },\n      404: { contentType: 'application/json', schema: EngineErrorPayloadSchema },\n    },\n  },\n  'doc.annotations.list': {\n    operationId: 'doc.annotations.list',\n    title: 'List annotations',\n    summary: \"One page's annotations at the current layer version.\",\n    method: 'GET',\n    path: wireTemplates.layerAnnotationItems,\n    credentials: docCredentials,\n    scope: [],\n    docCapabilities: ['doc.annotate.read'],\n    requestHeaders: [documentPasswordHeader],\n    params: DocPageParamsSchema,\n    responses: {\n      200: { contentType: 'application/json', schema: AnnotationListPageSnapshotSchema },\n      404: { contentType: 'application/json', schema: EngineErrorPayloadSchema },\n    },\n  },\n  'doc.annotations.create': {\n    operationId: 'doc.annotations.create',\n    title: 'Create annotation',\n    summary: 'Create an annotation on a page.',\n    method: 'POST',\n    path: wireTemplates.layerAnnotationItems,\n    credentials: docCredentials,\n    scope: [],\n    docCapabilities: ['doc.annotate.modify'],\n    requestHeaders: [documentPasswordHeader],\n    params: DocPageParamsSchema,\n    body: { contentType: 'application/json', schema: looseJson },\n    notes:\n      'Doc JWTs may instead carry collab scopes (annotations:create:self, …) that refine ' +\n      'per-annotation authorship rules; the API token is exempt from both.',\n    responses: {\n      200: { contentType: 'application/json', schema: MutationResponseSchema },\n      400: { contentType: 'application/json', schema: EngineErrorPayloadSchema },\n      404: { contentType: 'application/json', schema: EngineErrorPayloadSchema },\n    },\n  },\n  'doc.annotations.update': {\n    operationId: 'doc.annotations.update',\n    title: 'Update annotation',\n    summary: 'Update one annotation by key.',\n    method: 'PATCH',\n    path: wireTemplates.layerAnnotationItem,\n    credentials: docCredentials,\n    scope: [],\n    docCapabilities: ['doc.annotate.modify'],\n    requestHeaders: [documentPasswordHeader],\n    params: DocAnnotationParamsSchema,\n    body: { contentType: 'application/json', schema: looseJson },\n    responses: {\n      200: { contentType: 'application/json', schema: MutationResponseSchema },\n      400: { contentType: 'application/json', schema: EngineErrorPayloadSchema },\n      404: { contentType: 'application/json', schema: EngineErrorPayloadSchema },\n    },\n  },\n  'doc.annotations.delete': {\n    operationId: 'doc.annotations.delete',\n    title: 'Delete annotation',\n    summary: 'Delete one annotation by key.',\n    method: 'DELETE',\n    path: wireTemplates.layerAnnotationItem,\n    credentials: docCredentials,\n    scope: [],\n    docCapabilities: ['doc.annotate.modify'],\n    requestHeaders: [documentPasswordHeader],\n    params: DocAnnotationParamsSchema,\n    responses: {\n      200: { contentType: 'application/json', schema: MutationResponseSchema },\n      404: { contentType: 'application/json', schema: EngineErrorPayloadSchema },\n    },\n  },\n  'doc.forms.get': {\n    operationId: 'doc.forms.get',\n    title: 'Get form snapshot',\n    summary: 'Reconciled form snapshot: fields, widgets, values.',\n    method: 'GET',\n    path: wireTemplates.layerForm,\n    credentials: docCredentials,\n    scope: [],\n    docCapabilities: ['doc.forms.read'],\n    requestHeaders: [documentPasswordHeader],\n    params: DocLayerParamsSchema,\n    responses: {\n      200: { contentType: 'application/json', schema: FormSnapshotSchema },\n      404: { contentType: 'application/json', schema: EngineErrorPayloadSchema },\n    },\n  },\n  'doc.forms.setValue': {\n    operationId: 'doc.forms.setValue',\n    title: 'Set form value',\n    summary: \"Set one form field's value.\",\n    method: 'POST',\n    path: wireTemplates.layerFormFieldValue,\n    credentials: docCredentials,\n    scope: [],\n    docCapabilities: ['doc.forms.fill'],\n    requestHeaders: [documentPasswordHeader],\n    params: DocFieldParamsSchema,\n    body: { contentType: 'application/json', schema: looseJson },\n    responses: {\n      200: { contentType: 'application/json', schema: MutationResponseSchema },\n      400: { contentType: 'application/json', schema: EngineErrorPayloadSchema },\n      404: { contentType: 'application/json', schema: EngineErrorPayloadSchema },\n    },\n  },\n  'doc.forms.reset': {\n    operationId: 'doc.forms.reset',\n    title: 'Reset form field',\n    summary: 'Reset one form field to its default value.',\n    method: 'POST',\n    path: wireTemplates.layerFormFieldReset,\n    credentials: docCredentials,\n    scope: [],\n    docCapabilities: ['doc.forms.fill'],\n    requestHeaders: [documentPasswordHeader],\n    params: DocFieldParamsSchema,\n    responses: {\n      200: { contentType: 'application/json', schema: MutationResponseSchema },\n      404: { contentType: 'application/json', schema: EngineErrorPayloadSchema },\n    },\n  },\n  'doc.forms.exportData': {\n    operationId: 'doc.forms.exportData',\n    title: 'Export form data',\n    summary: 'Export form data as FDF or XFDF.',\n    method: 'GET',\n    path: wireTemplates.layerFormData,\n    credentials: docCredentials,\n    scope: [],\n    docCapabilities: ['doc.forms.read'],\n    requestHeaders: [documentPasswordHeader],\n    params: DocLayerParamsSchema,\n    query: z.object({ format: z.enum(['fdf', 'xfdf']).optional() }),\n    responses: {\n      200: { contentType: ['application/vnd.adobe.xfdf', 'application/vnd.fdf'] },\n      404: { contentType: 'application/json', schema: EngineErrorPayloadSchema },\n    },\n  },\n  'doc.forms.importData': {\n    operationId: 'doc.forms.importData',\n    title: 'Import form data',\n    summary: 'Import form data (FDF/XFDF), filling matching fields.',\n    method: 'POST',\n    path: wireTemplates.layerFormData,\n    credentials: docCredentials,\n    scope: [],\n    docCapabilities: ['doc.forms.fill'],\n    requestHeaders: [documentPasswordHeader],\n    params: DocLayerParamsSchema,\n    body: { contentType: 'application/json', schema: looseJson },\n    responses: {\n      200: { contentType: 'application/json', schema: MutationResponseSchema },\n      400: { contentType: 'application/json', schema: EngineErrorPayloadSchema },\n      404: { contentType: 'application/json', schema: EngineErrorPayloadSchema },\n    },\n  },\n  'doc.pages.move': {\n    operationId: 'doc.pages.move',\n    title: 'Move pages',\n    summary: 'Reorder pages.',\n    method: 'POST',\n    path: wireTemplates.layerPagesMove,\n    credentials: docCredentials,\n    scope: [],\n    docCapabilities: ['doc.pages.assemble'],\n    requestHeaders: [documentPasswordHeader],\n    params: DocLayerParamsSchema,\n    body: { contentType: 'application/json', schema: looseJson },\n    responses: {\n      200: { contentType: 'application/json', schema: MutationResponseSchema },\n      400: { contentType: 'application/json', schema: EngineErrorPayloadSchema },\n      404: { contentType: 'application/json', schema: EngineErrorPayloadSchema },\n    },\n  },\n  'doc.pages.rotate': {\n    operationId: 'doc.pages.rotate',\n    title: 'Rotate pages',\n    summary: 'Set absolute rotation on pages.',\n    method: 'POST',\n    path: wireTemplates.layerPagesRotate,\n    credentials: docCredentials,\n    scope: [],\n    docCapabilities: ['doc.pages.assemble'],\n    requestHeaders: [documentPasswordHeader],\n    params: DocLayerParamsSchema,\n    body: { contentType: 'application/json', schema: looseJson },\n    responses: {\n      200: { contentType: 'application/json', schema: MutationResponseSchema },\n      400: { contentType: 'application/json', schema: EngineErrorPayloadSchema },\n      404: { contentType: 'application/json', schema: EngineErrorPayloadSchema },\n    },\n  },\n  'doc.pages.delete': {\n    operationId: 'doc.pages.delete',\n    title: 'Delete pages',\n    summary: 'Delete pages.',\n    method: 'POST',\n    path: wireTemplates.layerPagesDelete,\n    credentials: docCredentials,\n    scope: [],\n    docCapabilities: ['doc.pages.assemble'],\n    requestHeaders: [documentPasswordHeader],\n    params: DocLayerParamsSchema,\n    body: { contentType: 'application/json', schema: looseJson },\n    responses: {\n      200: { contentType: 'application/json', schema: MutationResponseSchema },\n      400: { contentType: 'application/json', schema: EngineErrorPayloadSchema },\n      404: { contentType: 'application/json', schema: EngineErrorPayloadSchema },\n    },\n  },\n  'doc.pages.flatten': {\n    operationId: 'doc.pages.flatten',\n    title: 'Flatten pages',\n    summary: 'Flatten annotations and form fields into page content.',\n    method: 'POST',\n    path: wireTemplates.layerPagesFlatten,\n    credentials: docCredentials,\n    scope: [],\n    docCapabilities: ['doc.pages.modify', 'doc.annotate.modify'],\n    requestHeaders: [documentPasswordHeader],\n    params: DocLayerParamsSchema,\n    body: { contentType: 'application/json', schema: looseJson, required: false },\n    responses: {\n      200: { contentType: 'application/json', schema: MutationResponseSchema },\n      400: { contentType: 'application/json', schema: EngineErrorPayloadSchema },\n      404: { contentType: 'application/json', schema: EngineErrorPayloadSchema },\n    },\n  },\n  'doc.redactions.apply': {\n    operationId: 'doc.redactions.apply',\n    title: 'Apply redactions',\n    summary: 'Apply pending redactions, permanently removing content.',\n    method: 'POST',\n    path: wireTemplates.layerRedactionsApply,\n    credentials: docCredentials,\n    scope: [],\n    docCapabilities: ['doc.pages.modify', 'doc.annotate.modify', 'doc.redact'],\n    requestHeaders: [documentPasswordHeader],\n    params: DocLayerParamsSchema,\n    body: { contentType: 'application/json', schema: looseJson, required: false },\n    responses: {\n      200: { contentType: 'application/json', schema: MutationResponseSchema },\n      400: { contentType: 'application/json', schema: EngineErrorPayloadSchema },\n      404: { contentType: 'application/json', schema: EngineErrorPayloadSchema },\n    },\n  },\n  'doc.download': {\n    operationId: 'doc.download',\n    title: 'Download PDF',\n    summary: \"Download the layer's current PDF (base plus layer edits).\",\n    method: 'GET',\n    path: wireTemplates.layerDownload,\n    credentials: docCredentials,\n    scope: [],\n    docCapabilities: ['doc.download'],\n    requestHeaders: [documentPasswordHeader],\n    params: DocLayerParamsSchema,\n    responses: {\n      200: { contentType: 'application/pdf' },\n      404: { contentType: 'application/json', schema: EngineErrorPayloadSchema },\n    },\n  },\n} as const satisfies Record<string, AdminOperation>;\nexport type DocOperationId = keyof typeof docOperations;\n\n/** Every operation in the published contract: admin surfaces + doc plane. */\nexport const allOperations = { ...adminOperations, ...docOperations } as const;\n\n/**\n * Documentation groups, keyed by the dot-joined `x-fern-sdk-group-name`\n * path of the operations they contain. Emitted as `x-docs-groups`; the\n * API reference derives its navigation sections from this manifest, so\n * key order here is section order there. `slug` overrides the URL\n * segment when the registry's short group name isn't the public one.\n * The emitter fails if an operation's group path is missing here.\n */\nexport interface DocsGroup {\n  title: string;\n  slug?: string;\n}\n\nexport const docsGroups = {\n  deployment: { title: 'Deployment' },\n  tenants: { title: 'Tenants' },\n  documents: { title: 'Tenant documents' },\n  tokens: { title: 'Tokens' },\n  shares: { title: 'Shares' },\n  doc: { title: 'Document operations', slug: 'document-operations' },\n  'doc.annotations': { title: 'Annotations' },\n  'doc.forms': { title: 'Forms' },\n  'doc.metadata': { title: 'Metadata' },\n  'doc.pages': { title: 'Pages' },\n  'doc.redactions': { title: 'Redactions' },\n} as const satisfies Record<string, DocsGroup>;\n"],"mappings":";AACA;AAAA,EACE;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,OACK;AACP,SAAS,SAAS;AAElB,IAAM,YAAY;AAClB,IAAM,eAAe;AAMd,IAAM,kBAAkB;AAO/B,IAAM,gBACJ;AACF,IAAM,qBAAqB,EACxB;AAAA,EACC,EACG,OAAO,EACP,IAAI,GAAG,EACP;AAAA,IACC;AAAA,IACA;AAAA,EACF;AACJ,EACC,IAAI,CAAC,EACL,IAAI,EAAE;AAET,IAAM,oBAAoB;AAQnB,IAAM,iBAAiB;AAAA,EAC5B,SAAS;AAAA,EACT,QAAQ,CAAC,aAAqB,eAAe,mBAAmB,QAAQ,CAAC;AAAA,EACzE,WAAW,CAAC,aAAqB,eAAe,mBAAmB,QAAQ,CAAC;AAAA,EAC5E,eAAe,CAAC,aAAqB,eAAe,mBAAmB,QAAQ,CAAC;AAAA,EAChF,iBAAiB,CAAC,aAChB,eAAe,mBAAmB,QAAQ,CAAC;AAAA,EAC7C,UAAU,CAAC,UAAkB,UAC3B,eAAe,mBAAmB,QAAQ,CAAC,cAAc,mBAAmB,KAAK,CAAC;AAAA,EACpF,gBAAgB,CAAC,UAAkB,UACjC,eAAe,mBAAmB,QAAQ,CAAC,cAAc,mBAAmB,KAAK,CAAC;AAAA,EACpF,qBAAqB,CAAC,UAAkB,UACtC,eAAe,mBAAmB,QAAQ,CAAC,cAAc,mBAAmB,KAAK,CAAC;AAAA,EACpF,kBAAkB,CAAC,UAAkB,UACnC,eAAe,mBAAmB,QAAQ,CAAC,cAAc,mBAAmB,KAAK,CAAC;AAAA;AAAA,EAEpF,mBAAmB,CAAC,UAAkB,UACpC,eAAe,mBAAmB,QAAQ,CAAC,cAAc,mBAAmB,KAAK,CAAC;AAAA,EACpF,YAAY,CAAC,aAAqB,eAAe,mBAAmB,QAAQ,CAAC;AAAA,EAC7E,aAAa,CAAC,UAAkB,QAC9B,eAAe,mBAAmB,QAAQ,CAAC,WAAW,mBAAmB,GAAG,CAAC;AAAA,EAC/E,QAAQ,CAAC,aAAqB,eAAe,mBAAmB,QAAQ,CAAC;AAAA,EACzE,OAAO,CAAC,UAAkB,YACxB,eAAe,mBAAmB,QAAQ,CAAC,WAAW,mBAAmB,OAAO,CAAC;AAAA,EACnF,aAAa,CAAC,aAAqB,eAAe,mBAAmB,QAAQ,CAAC;AAAA,EAC9E,eAAe,CAAC,aAAqB,eAAe,mBAAmB,QAAQ,CAAC;AAAA,EAChF,cAAc,CAAC,aAAqB,eAAe,mBAAmB,QAAQ,CAAC;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAM/E,eAAe;AAAA;AAAA,EAEf,yBAAyB;AAC3B;AAEO,IAAM,kBAAkB,EAAE,KAAK,CAAC,iBAAiB,gBAAgB,CAAC;AAGlE,IAAM,yBAAyB,EAAE,KAAK,CAAC,QAAQ,aAAa,OAAO,CAAC;AAGpE,IAAM,sBAAsB,EAAE,KAAK,CAAC,WAAW,SAAS,UAAU,UAAU,CAAC;AAG7E,IAAM,4BAA4B,EAAE,OAAO;AAAA,EAChD,IAAI,EAAE,OAAO;AAAA,EACb,UAAU,EAAE,OAAO;AAAA,EACnB,OAAO;AAAA,EACP,SAAS,EAAE,OAAO,EAAE,SAAS;AAAA,EAC7B,kBAAkB,EAAE,OAAO,EAAE,SAAS;AAAA,EACtC,UAAU,EAAE,OAAO,EAAE,OAAO,GAAG,EAAE,QAAQ,CAAC,EAAE,SAAS;AAAA,EACrD,gBAAgB,EAAE,OAAO,EAAE,SAAS;AAAA,EACpC,eAAe,EAAE,OAAO,EAAE,SAAS;AAAA;AAAA,EAEnC,gBAAgB,EAAE,KAAK,CAAC,WAAW,SAAS,UAAU,QAAQ,CAAC,EAAE,SAAS;AAAA,EAC1E,cAAc,EAAE,OAAO,EAAE,SAAS,EAAE,SAAS;AAAA,EAC7C,WAAW,EAAE,OAAO;AAAA,EACpB,WAAW,EAAE,OAAO;AAAA,EACpB,WAAW,EAAE,OAAO,EAAE,SAAS;AACjC,CAAC;AAGM,IAAM,iCAAiC,EAAE,OAAO;AAAA,EACrD,eAAe,EAAE,OAAO,EAAE,OAAO,EAAE,IAAI,CAAC;AAAA,EACxC,eAAe,EAAE,OAAO,EAAE,MAAM,SAAS;AAAA,EACzC,UAAU,EAAE,OAAO,EAAE,OAAO,GAAG,EAAE,QAAQ,CAAC,EAAE,SAAS;AAAA,EACrD,gBAAgB,EAAE,OAAO,EAAE,SAAS;AAAA,EACpC,WAAW,gBAAgB,SAAS;AAAA,EACpC,OAAO,EAAE,OAAO,EAAE,MAAM,YAAY,EAAE,SAAS;AAAA,EAC/C,cAAc,EAAE,OAAO,EAAE,OAAO,EAAE,IAAI,EAAE,EAAE,IAAI,IAAI,EAAE,SAAS;AAAA,EAC7D,kBAAkB,uBAAuB,SAAS;AACpD,CAAC;AAGM,IAAM,6BAA6B,EAAE,OAAO;AAAA,EACjD,KAAK,EAAE,OAAO;AAAA,EACd,SAAS,EAAE,OAAO,EAAE,OAAO,GAAG,EAAE,OAAO,CAAC;AAAA,EACxC,QAAQ,EAAE,QAAQ,KAAK;AAAA,EACvB,WAAW,EAAE,OAAO;AACtB,CAAC;AAGM,IAAM,wBAAwB,EAAE,mBAAmB,QAAQ;AAAA,EAChE,EAAE,OAAO;AAAA,IACP,MAAM,EAAE,QAAQ,WAAW;AAAA,IAC3B,WAAW;AAAA,IACX,KAAK,EAAE,OAAO;AAAA,EAChB,CAAC;AAAA,EACD,EAAE,OAAO;AAAA,IACP,MAAM,EAAE,QAAQ,OAAO;AAAA,IACvB,KAAK,EAAE,OAAO;AAAA,IACd,KAAK,EAAE,OAAO;AAAA,EAChB,CAAC;AACH,CAAC;AAGM,IAAM,kCAAkC,EAAE,mBAAmB,OAAO;AAAA,EACzE,EAAE,OAAO;AAAA,IACP,KAAK,EAAE,QAAQ,SAAS;AAAA,IACxB,UAAU;AAAA,IACV,QAAQ;AAAA,EACV,CAAC;AAAA,EACD,EAAE,OAAO;AAAA,IACP,KAAK,EAAE,QAAQ,SAAS;AAAA,IACxB,UAAU;AAAA,IACV,QAAQ;AAAA,EACV,CAAC;AAAA,EACD,EAAE,OAAO;AAAA,IACP,KAAK,EAAE,QAAQ,SAAS;AAAA,IACxB,UAAU;AAAA,EACZ,CAAC;AACH,CAAC;AAGM,IAAM,mCAAmC,EAAE,OAAO;AAAA,EACvD,QAAQ,EAAE,OAAO,EAAE,MAAM,SAAS;AACpC,CAAC;AAGM,IAAM,oCAAoC,EAAE,OAAO;AAAA,EACxD,UAAU;AACZ,CAAC;AAID,IAAM,iBAAiB,CAAC,MAAsB,IAAI,YAAY,EAAE,OAAO,CAAC,EAAE;AAsBnE,IAAM,0BAA0B,EAAE,mBAAmB,QAAQ;AAAA,EAClE,EAAE,OAAO;AAAA,IACP,MAAM,EAAE,QAAQ,KAAK;AAAA,IACrB,KAAK,EAAE,OAAO,EAAE,IAAI,EAAE,IAAI,IAAI;AAAA,EAChC,CAAC;AAAA,EACD,EAAE,OAAO;AAAA,IACP,MAAM,EAAE,QAAQ,YAAY;AAAA,IAC5B,cAAc,EAAE,OAAO,EAAE,IAAI,CAAC,EAAE,IAAI,GAAG;AAAA,IACvC,KAAK,EACF,OAAO,EACP,IAAI,CAAC,EACL,OAAO,CAAC,MAAM,CAAC,EAAE,SAAS,IAAI,GAAG,0BAA0B,EAC3D,OAAO,CAAC,MAAM,eAAe,CAAC,KAAK,MAAM,sCAAsC;AAAA,IAClF,UAAU,EAAE,OAAO,EAAE,IAAI,CAAC,EAAE,IAAI,IAAI,EAAE,SAAS;AAAA,EACjD,CAAC;AACH,CAAC;AAGM,IAAM,mCAAmC,EAAE,OAAO;AAAA,EACvD,QAAQ;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EASR,UAAU,EACP,OAAO;AAAA,IACN,WAAW,EAAE,OAAO,EAAE,IAAI,EAAE,IAAI,CAAC,EAAE,SAAS;AAAA,IAC5C,QAAQ,EAAE,OAAO,EAAE,MAAM,SAAS,EAAE,SAAS;AAAA,EAC/C,CAAC,EACA,SAAS;AAAA,EACZ,UAAU,EAAE,OAAO,EAAE,OAAO,GAAG,EAAE,QAAQ,CAAC,EAAE,SAAS;AAAA,EACrD,gBAAgB,EAAE,OAAO,EAAE,SAAS;AAAA,EACpC,WAAW,gBAAgB,SAAS;AAAA,EACpC,OAAO,EAAE,OAAO,EAAE,MAAM,YAAY,EAAE,SAAS;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAU/C,MAAM,EAAE,KAAK,CAAC,QAAQ,OAAO,CAAC,EAAE,SAAS;AAC3C,CAAC;AAGM,IAAM,oCAAoC,EAAE,OAAO;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAQxD,KAAK,EAAE,KAAK,CAAC,YAAY,WAAW,UAAU,CAAC;AAAA,EAC/C,UAAU;AACZ,CAAC;AAGM,IAAM,8BAA8B,EAAE,OAAO;AAAA,EAClD,UAAU;AACZ,CAAC;AAGM,IAAM,oCAAoC;AAC1C,IAAM,gCAAgC;AAQtC,IAAM,+BAA+B,EAAE,OAAO;AAAA,EACnD,OAAO,EAAE,OACN,OAAO,EACP,IAAI,EACJ,IAAI,CAAC,EACL,IAAI,6BAA6B,EACjC,QAAQ,iCAAiC;AAAA,EAC5C,QAAQ,EAAE,OAAO,EAAE,IAAI,CAAC,EAAE,SAAS;AAAA,EACnC,OAAO,oBAAoB,SAAS;AACtC,CAAC;AAGM,IAAM,kCAAkC,EAAE,OAAO;AAAA,EACtD,WAAW,EAAE,MAAM,yBAAyB;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAM5C,YAAY,EAAE,OAAO,EAAE,SAAS,EAAE,SAAS;AAC7C,CAAC;AAGM,IAAM,iCAAiC,EAAE,OAAO;AAAA,EACrD,QAAQ,EAAE,OAAO,EAAE,MAAM,SAAS;AACpC,CAAC;AAGM,IAAM,0BAA0B,EAAE,OAAO;AAAA,EAC9C,OAAO,EAAE,OAAO;AAAA,IACd,MAAM,EAAE,OAAO;AAAA,IACf,SAAS,EAAE,OAAO;AAAA,EACpB,CAAC;AACH,CAAC;AAQM,IAAM,yCAAyC,EAAE,OAAO;AAAA,EAC7D,OAAO,EAAE,OAAO;AAAA,IACd,MAAM,EAAE,OAAO;AAAA,IACf,SAAS,EAAE,OAAO;AAAA,IAClB,OAAO,EAAE,OAAO;AAAA,EAClB,CAAC;AACH,CAAC;AAKM,IAAM,0BAA0B,EAAE,OAAO;AAAA,EAC9C,UAAU,EAAE,OAAO,EAAE,MAAM,eAAe;AAC5C,CAAC;AAGM,IAAM,6BAA6B,EAAE,OAAO;AAAA,EACjD,UAAU,EAAE,OAAO,EAAE,MAAM,eAAe;AAAA,EAC1C,IAAI,EAAE,OAAO,EAAE,MAAM,YAAY;AACnC,CAAC;AAGM,IAAM,6BAA6B,EAAE,OAAO;AAAA,EACjD,UAAU,EAAE,OAAO,EAAE,MAAM,eAAe;AAAA,EAC1C,KAAK,EAAE,OAAO,EAAE,IAAI,CAAC,EAAE,IAAI,GAAG;AAChC,CAAC;AAGM,IAAM,gCAAgC,EAAE,OAAO;AAAA;AAAA,EAEpD,QAAQ,EAAE,OAAO,EAAE,IAAI,IAAI,EAAE,SAAS;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAMtC,kBAAkB,EAAE,OAAO,EAAE,IAAI,EAAE,SAAS,EAAE,SAAS;AACzD,CAAC;AAQM,IAAM,mCAAmC,EAAE,OAAO;AAAA,EACvD,SAAS,EAAE,QAAQ;AAAA,EACnB,WAAW,EAAE,QAAQ,EAAE,SAAS;AAAA,EAChC,OAAO,EAAE,QAAQ,EAAE,SAAS;AAC9B,CAAC;AAGM,IAAM,0BAA0B,EAAE,OAAO;AAAA,EAC9C,IAAI,EAAE,OAAO;AAAA,EACb,MAAM,EAAE,OAAO;AAAA;AAAA,EAEf,iBAAiB,EAAE,QAAQ;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAO3B,QAAQ,EAAE,KAAK,CAAC,UAAU,WAAW,CAAC,EAAE,SAAS;AAAA,EACjD,WAAW,EAAE,OAAO;AACtB,CAAC;AAGM,IAAM,iCAAiC,EAAE,OAAO;AAAA,EACrD,IAAI,EAAE,OAAO,EAAE,MAAM,eAAe;AAAA;AAAA,EAEpC,MAAM,EAAE,OAAO,EAAE,IAAI,CAAC,EAAE,IAAI,GAAG,EAAE,SAAS;AAC5C,CAAC;AAGM,IAAM,kCAAkC,EAAE,OAAO;AAAA,EACtD,QAAQ;AAAA;AAAA,EAER,SAAS,EAAE,QAAQ;AACrB,CAAC;AAGM,IAAM,4BAA4B,EAAE,OAAO;AAAA,EAChD,QAAQ;AACV,CAAC;AAGM,IAAM,6BAA6B,EAAE,OAAO;AAAA,EACjD,OAAO,EAAE,OACN,OAAO,EACP,IAAI,EACJ,IAAI,CAAC,EACL,IAAI,6BAA6B,EACjC,QAAQ,iCAAiC;AAAA,EAC5C,QAAQ,EAAE,OAAO,EAAE,IAAI,CAAC,EAAE,SAAS;AACrC,CAAC;AAGM,IAAM,gCAAgC,EAAE,OAAO;AAAA,EACpD,SAAS,EAAE,MAAM,uBAAuB;AAAA;AAAA,EAExC,YAAY,EAAE,OAAO,EAAE,SAAS,EAAE,SAAS;AAC7C,CAAC;AAkBM,IAAM,oBAAoB;AAAA,EAC/B;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AACF;AAGO,IAAM,kCAAkC,EAAE,OAAO;AAAA,EACtD,MAAM,EAAE,QAAQ,KAAK;AAAA;AAAA,EAErB,KAAK,EAAE,OAAO,EAAE,IAAI,CAAC,EAAE,IAAI,GAAG;AAAA,EAC9B,OAAO,EAAE,OAAO,EAAE,MAAM,YAAY;AAAA,EACpC,WAAW,EAAE,OAAO,EAAE,IAAI,CAAC,EAAE,IAAI,GAAG,EAAE,SAAS;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAM/C,OAAO,EAAE,MAAM,EAAE,OAAO,EAAE,IAAI,CAAC,EAAE,IAAI,GAAG,CAAC,EAAE,IAAI,CAAC,EAAE,IAAI,EAAE;AAAA,EACxD,QAAQ,EAAE,OAAO,EAAE,IAAI,GAAG,EAAE,SAAS;AAAA,EACrC,aAAa,EAAE,OAAO,EAAE,IAAI,GAAG,EAAE,SAAS;AAAA,EAC1C,SAAS,EAAE,OAAO,EAAE,IAAI,GAAG,EAAE,SAAS;AAAA,EACtC,QAAQ,EAAE,MAAM,EAAE,OAAO,EAAE,IAAI,GAAG,CAAC,EAAE,IAAI,EAAE,EAAE,SAAS;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAQtD,SAAS,mBAAmB,SAAS;AAAA;AAAA,EAErC,WAAW,EACR,OAAO,EACP,IAAI,EACJ,IAAI,EAAE,EACN,IAAI,KAAK,KAAK,KAAK,EAAE;AAC1B,CAAC;AAGM,IAAM,qCAAqC,EAAE,OAAO;AAAA,EACzD,MAAM,EAAE,QAAQ,QAAQ;AAAA,EACxB,KAAK,EAAE,OAAO,EAAE,IAAI,CAAC,EAAE,IAAI,GAAG;AAAA,EAC9B,OAAO,EACJ,MAAM,EAAE,MAAM,CAAC,EAAE,QAAQ,GAAG,GAAG,EAAE,KAAK,iBAAiB,CAAC,CAAC,CAAC,EAC1D,IAAI,CAAC,EACL,IAAI,EAAE;AAAA;AAAA,EAET,WAAW,EACR,OAAO,EACP,IAAI,EACJ,IAAI,EAAE,EACN,IAAI,KAAK,KAAK,KAAK,EAAE;AAC1B,CAAC;AAGM,IAAM,+BAA+B,EAAE,mBAAmB,QAAQ;AAAA,EACvE;AAAA,EACA;AACF,CAAC;AAGM,IAAM,gCAAgC,EAAE,OAAO;AAAA,EACpD,OAAO,EAAE,OAAO;AAAA,EAChB,KAAK,EAAE,OAAO;AAAA;AAAA,EAEd,WAAW,EAAE,OAAO;AACtB,CAAC;AAkCM,IAAM,yBAAyB,EAAE,OAAO;AAAA;AAAA,EAE7C,IAAI,EAAE,OAAO;AAAA,EACb,UAAU,EAAE,OAAO;AAAA,EACnB,OAAO,EAAE,OAAO;AAAA,EAChB,WAAW,EAAE,OAAO;AAAA;AAAA,EAEpB,OAAO,EAAE,MAAM,EAAE,OAAO,CAAC;AAAA;AAAA,EAEzB,SAAS,EAAE,MAAM,EAAE,OAAO,CAAC,EAAE,SAAS;AAAA;AAAA,EAEtC,mBAAmB,EAAE,QAAQ;AAAA;AAAA,EAE7B,mBAAmB,EAAE,OAAO;AAAA;AAAA,EAE5B,UAAU,EAAE,QAAQ;AAAA;AAAA,EAEpB,WAAW,EAAE,OAAO,EAAE,SAAS;AAAA;AAAA,EAE/B,eAAe,EAAE,OAAO;AAAA,EACxB,iBAAiB,EAAE,OAAO,EAAE,SAAS;AAAA,EACrC,WAAW,EAAE,OAAO;AAAA,EACpB,WAAW,EAAE,OAAO;AAAA,EACpB,WAAW,EAAE,OAAO;AACtB,CAAC;AAGM,IAAM,gCAAgC,EAAE,OAAO;AAAA,EACpD,OAAO,EAAE,OAAO,EAAE,MAAM,YAAY;AAAA,EACpC,WAAW,EAAE,OAAO,EAAE,IAAI,CAAC,EAAE,IAAI,GAAG,EAAE,SAAS;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAM/C,OAAO,EAAE,MAAM,EAAE,OAAO,EAAE,IAAI,CAAC,EAAE,IAAI,GAAG,CAAC,EAAE,IAAI,CAAC,EAAE,IAAI,EAAE;AAAA;AAAA,EAExD,SAAS,mBAAmB,SAAS;AAAA;AAAA,EAErC,UAAU,EAAE,OAAO,EAAE,IAAI,CAAC,EAAE,IAAI,IAAI,EAAE,SAAS;AAAA;AAAA,EAE/C,mBAAmB,EAChB,OAAO,EACP,IAAI,EACJ,IAAI,EAAE,EACN,IAAI,KAAK,EAAE,EACX,SAAS;AAAA;AAAA,EAEZ,WAAW,EAAE,OAAO,EAAE,IAAI,EAAE,SAAS,EAAE,SAAS;AAClD,CAAC;AAUM,IAAM,gCAAgC,EAAE,OAAO;AAAA,EACpD,OAAO,EAAE,MAAM,EAAE,OAAO,EAAE,IAAI,CAAC,EAAE,IAAI,GAAG,CAAC,EAAE,IAAI,CAAC,EAAE,IAAI,EAAE,EAAE,SAAS;AAAA,EACnE,SAAS,mBAAmB,SAAS,EAAE,SAAS;AAAA,EAChD,UAAU,EAAE,OAAO,EAAE,IAAI,CAAC,EAAE,IAAI,IAAI,EAAE,SAAS,EAAE,SAAS;AAAA,EAC1D,mBAAmB,EAChB,OAAO,EACP,IAAI,EACJ,IAAI,EAAE,EACN,IAAI,KAAK,EAAE,EACX,SAAS;AAAA,EACZ,UAAU,EAAE,QAAQ,EAAE,SAAS;AAAA,EAC/B,WAAW,EAAE,OAAO,EAAE,IAAI,EAAE,SAAS,EAAE,SAAS,EAAE,SAAS;AAC7D,CAAC;AAGM,IAAM,2BAA2B,EAAE,OAAO;AAAA,EAC/C,OAAO;AACT,CAAC;AAGM,IAAM,4BAA4B,EAAE,OAAO;AAAA,EAChD,OAAO,EAAE,OACN,OAAO,EACP,IAAI,EACJ,IAAI,CAAC,EACL,IAAI,6BAA6B,EACjC,QAAQ,iCAAiC;AAAA,EAC5C,QAAQ,EAAE,OAAO,EAAE,IAAI,CAAC,EAAE,SAAS;AAAA;AAAA,EAEnC,OAAO,EAAE,OAAO,EAAE,MAAM,YAAY,EAAE,SAAS;AACjD,CAAC;AAGM,IAAM,+BAA+B,EAAE,OAAO;AAAA,EACnD,QAAQ,EAAE,MAAM,sBAAsB;AAAA;AAAA,EAEtC,YAAY,EAAE,OAAO,EAAE,SAAS,EAAE,SAAS;AAC7C,CAAC;AAGM,IAAM,+BAA+B,EAAE,OAAO;AAAA,EACnD,UAAU,EAAE,OAAO,EAAE,MAAM,eAAe;AAAA,EAC1C,SAAS,EAAE,OAAO,EAAE,MAAM,iBAAiB;AAC7C,CAAC;AAOM,IAAM,6BAA6B,EAAE,OAAO;AAAA,EACjD,YAAY,EAAE,OAAO,EAAE,MAAM,iBAAiB;AAAA;AAAA,EAE9C,UAAU,EAAE,OAAO,EAAE,IAAI,CAAC,EAAE,IAAI,IAAI,EAAE,SAAS;AACjD,CAAC;AAGM,IAAM,6BAA6B,EAAE,OAAO;AAAA;AAAA,EAEjD,OAAO,EAAE,OAAO;AAAA,EAChB,OAAO,EAAE,OAAO;AAAA,EAChB,WAAW,EAAE,OAAO;AAAA;AAAA,EAEpB,WAAW,EAAE,OAAO;AACtB,CAAC;AAOM,IAAM,yBAAyB,EAAE,OAAO;AAAA;AAAA,EAE7C,QAAQ,EACL,OAAO,EACP,MAAM,yBAAyB,EAC/B,SAAS;AACd,CAAC;AAUM,IAAM,4BAA4B,EAAE,OAAO;AAAA,EAChD,UAAU,EAAE,OAAO;AAAA,EACnB,aAAa,EAAE,OAAO;AAAA,EACtB,WAAW,EAAE,OAAO;AAAA,EACpB,SAAS,EAAE,OAAO;AAAA,IAChB,aAAa,EAAE,OAAO;AAAA,IACtB,eAAe,EAAE,OAAO;AAAA,IACxB,iBAAiB,EAAE,OAAO;AAAA,EAC5B,CAAC;AACH,CAAC;AAGM,IAAM,6BAA6B,EAAE,OAAO;AAAA;AAAA,EAEjD,QAAQ,EAAE,OAAO,EAAE,IAAI,IAAI,EAAE,SAAS;AACxC,CAAC;AAGM,IAAM,mBAAmB,CAAC,aAAa,cAAc,SAAS;AAuF9D,IAAM,kBAAkB;AAAA,EAC7B,kBAAkB;AAAA,IAChB,aAAa;AAAA,IACb,OAAO;AAAA,IACP,SAAS;AAAA,IACT,QAAQ;AAAA,IACR,MAAM,eAAe;AAAA,IACrB,aAAa,CAAC,WAAW;AAAA,IACzB,OAAO,CAAC;AAAA,IACR,MAAM,EAAE,aAAa,oBAAoB,QAAQ,+BAA+B;AAAA,IAChF,WAAW;AAAA,MACT,KAAK,EAAE,aAAa,oBAAoB,QAAQ,gCAAgC;AAAA,MAChF,KAAK,EAAE,aAAa,oBAAoB,QAAQ,wBAAwB;AAAA,IAC1E;AAAA,EACF;AAAA,EACA,gBAAgB;AAAA,IACd,aAAa;AAAA,IACb,OAAO;AAAA,IACP,SAAS;AAAA,IACT,QAAQ;AAAA,IACR,MAAM,eAAe;AAAA,IACrB,aAAa,CAAC,WAAW;AAAA,IACzB,OAAO,CAAC;AAAA,IACR,OAAO;AAAA,IACP,WAAW;AAAA,MACT,KAAK,EAAE,aAAa,oBAAoB,QAAQ,8BAA8B;AAAA,MAC9E,KAAK,EAAE,aAAa,oBAAoB,QAAQ,wBAAwB;AAAA,IAC1E;AAAA,EACF;AAAA,EACA,eAAe;AAAA,IACb,aAAa;AAAA,IACb,OAAO;AAAA,IACP,SAAS;AAAA,IACT,QAAQ;AAAA,IACR,MAAM;AAAA,IACN,aAAa,CAAC,WAAW;AAAA,IACzB,OAAO,CAAC;AAAA,IACR,QAAQ;AAAA,IACR,WAAW;AAAA,MACT,KAAK,EAAE,aAAa,oBAAoB,QAAQ,0BAA0B;AAAA,MAC1E,KAAK,EAAE,aAAa,oBAAoB,QAAQ,wBAAwB;AAAA,IAC1E;AAAA,EACF;AAAA,EACA,kBAAkB;AAAA,IAChB,aAAa;AAAA,IACb,OAAO;AAAA,IACP,SAAS;AAAA,IACT,QAAQ;AAAA,IACR,MAAM;AAAA,IACN,aAAa,CAAC,WAAW;AAAA,IACzB,OAAO,CAAC;AAAA,IACR,QAAQ;AAAA,IACR,WAAW;AAAA,MACT,KAAK,CAAC;AAAA,MACN,KAAK,EAAE,aAAa,oBAAoB,QAAQ,wBAAwB;AAAA,IAC1E;AAAA,IACA,OACE;AAAA,EACJ;AAAA,EACA,kBAAkB;AAAA,IAChB,aAAa;AAAA,IACb,OAAO;AAAA,IACP,SACE;AAAA,IACF,QAAQ;AAAA,IACR,MAAM;AAAA,IACN,aAAa,CAAC,aAAa,YAAY;AAAA,IACvC,OAAO,CAAC,aAAa;AAAA,IACrB,QAAQ;AAAA,IACR,MAAM,EAAE,aAAa,oBAAoB,QAAQ,+BAA+B;AAAA,IAChF,WAAW;AAAA,MACT,KAAK,EAAE,aAAa,oBAAoB,QAAQ,gCAAgC;AAAA,MAChF,KAAK,EAAE,aAAa,oBAAoB,QAAQ,wBAAwB;AAAA,IAC1E;AAAA,EACF;AAAA,EACA,oBAAoB;AAAA,IAClB,aAAa;AAAA,IACb,OAAO;AAAA,IACP,SAAS;AAAA,IACT,QAAQ;AAAA,IACR,MAAM;AAAA,IACN,aAAa,CAAC,aAAa,YAAY;AAAA,IACvC,OAAO,CAAC,aAAa;AAAA,IACrB,QAAQ;AAAA,IACR,MAAM,EAAE,aAAa,oBAAoB,QAAQ,iCAAiC;AAAA,IAClF,WAAW;AAAA,MACT,KAAK,EAAE,aAAa,oBAAoB,QAAQ,kCAAkC;AAAA,MAClF,KAAK,EAAE,aAAa,oBAAoB,QAAQ,wBAAwB;AAAA,MACxE,KAAK,EAAE,aAAa,oBAAoB,QAAQ,wBAAwB;AAAA,IAC1E;AAAA,EACF;AAAA,EACA,yBAAyB;AAAA,IACvB,aAAa;AAAA,IACb,OAAO;AAAA,IACP,SAAS;AAAA,IACT,QAAQ;AAAA,IACR,MAAM;AAAA,IACN,aAAa,CAAC,aAAa,YAAY;AAAA,IACvC,OAAO,CAAC,aAAa;AAAA,IACrB,QAAQ;AAAA,IACR,MAAM;AAAA,MACJ,aAAa;AAAA,IACf;AAAA,IACA,WAAW;AAAA,MACT,KAAK,EAAE,aAAa,oBAAoB,QAAQ,+BAA+B;AAAA,MAC/E,KAAK,EAAE,aAAa,oBAAoB,QAAQ,wBAAwB;AAAA,MACxE,KAAK,EAAE,aAAa,oBAAoB,QAAQ,wBAAwB;AAAA,IAC1E;AAAA,IACA,OACE;AAAA,EACJ;AAAA,EACA,wBAAwB;AAAA,IACtB,aAAa;AAAA,IACb,OAAO;AAAA,IACP,SACE;AAAA,IACF,QAAQ;AAAA,IACR,MAAM;AAAA,IACN,aAAa,CAAC,aAAa,YAAY;AAAA,IACvC,OAAO,CAAC,aAAa;AAAA,IACrB,QAAQ;AAAA,IACR,MAAM,EAAE,aAAa,oBAAoB,QAAQ,iCAAiC;AAAA,IAClF,WAAW;AAAA,MACT,KAAK,EAAE,aAAa,oBAAoB,QAAQ,kCAAkC;AAAA,MAClF,KAAK,EAAE,aAAa,oBAAoB,QAAQ,kCAAkC;AAAA,MAClF,KAAK,EAAE,aAAa,oBAAoB,QAAQ,wBAAwB;AAAA,MACxE,KAAK,EAAE,aAAa,oBAAoB,QAAQ,wBAAwB;AAAA,MACxE,KAAK,EAAE,aAAa,oBAAoB,QAAQ,wBAAwB;AAAA,IAC1E;AAAA,IACA,OACE;AAAA,EACJ;AAAA,EACA,kBAAkB;AAAA,IAChB,aAAa;AAAA,IACb,OAAO;AAAA,IACP,SAAS;AAAA,IACT,QAAQ;AAAA,IACR,MAAM;AAAA,IACN,aAAa,CAAC,aAAa,YAAY;AAAA,IACvC,OAAO,CAAC,WAAW;AAAA,IACnB,QAAQ;AAAA,IACR,OAAO;AAAA,IACP,WAAW;AAAA,MACT,KAAK,EAAE,aAAa,oBAAoB,QAAQ,gCAAgC;AAAA,MAChF,KAAK,EAAE,aAAa,oBAAoB,QAAQ,wBAAwB;AAAA,IAC1E;AAAA,EACF;AAAA,EACA,iBAAiB;AAAA,IACf,aAAa;AAAA,IACb,OAAO;AAAA,IACP,SAAS;AAAA,IACT,QAAQ;AAAA,IACR,MAAM;AAAA,IACN,aAAa,CAAC,aAAa,YAAY;AAAA,IACvC,OAAO,CAAC,WAAW;AAAA,IACnB,QAAQ;AAAA,IACR,WAAW;AAAA,MACT,KAAK,EAAE,aAAa,oBAAoB,QAAQ,4BAA4B;AAAA,MAC5E,KAAK,EAAE,aAAa,oBAAoB,QAAQ,wBAAwB;AAAA,MACxE,KAAK,EAAE,aAAa,oBAAoB,QAAQ,wBAAwB;AAAA,IAC1E;AAAA,EACF;AAAA,EACA,sBAAsB;AAAA,IACpB,aAAa;AAAA,IACb,OAAO;AAAA,IACP,SAAS;AAAA,IACT,QAAQ;AAAA,IACR,MAAM;AAAA,IACN,aAAa,CAAC,aAAa,YAAY;AAAA,IACvC,OAAO,CAAC,WAAW;AAAA,IACnB,QAAQ;AAAA,IACR,WAAW;AAAA,MACT,KAAK,EAAE,aAAa,kBAAkB;AAAA,MACtC,KAAK,EAAE,aAAa,oBAAoB,QAAQ,wBAAwB;AAAA,MACxE,KAAK,EAAE,aAAa,oBAAoB,QAAQ,wBAAwB;AAAA,IAC1E;AAAA,EACF;AAAA,EACA,oBAAoB;AAAA,IAClB,aAAa;AAAA,IACb,OAAO;AAAA,IACP,SAAS;AAAA,IACT,QAAQ;AAAA,IACR,MAAM;AAAA,IACN,aAAa,CAAC,aAAa,YAAY;AAAA,IACvC,OAAO,CAAC,aAAa;AAAA,IACrB,QAAQ;AAAA,IACR,WAAW;AAAA,MACT,KAAK,CAAC;AAAA,MACN,KAAK,EAAE,aAAa,oBAAoB,QAAQ,wBAAwB;AAAA,MACxE,KAAK,EAAE,aAAa,oBAAoB,QAAQ,wBAAwB;AAAA,IAC1E;AAAA,EACF;AAAA,EACA,uBAAuB;AAAA,IACrB,aAAa;AAAA,IACb,OAAO;AAAA,IACP,SAAS;AAAA,IACT,QAAQ;AAAA,IACR,MAAM;AAAA,IACN,aAAa,CAAC,aAAa,YAAY;AAAA,IACvC,OAAO,CAAC,WAAW;AAAA,IACnB,QAAQ;AAAA,IACR,WAAW;AAAA,MACT,KAAK,EAAE,aAAa,CAAC,cAAc,WAAW,EAAE;AAAA,MAChD,KAAK,EAAE,aAAa,oBAAoB,QAAQ,uCAAuC;AAAA,IACzF;AAAA,EACF;AAAA,EACA,4BAA4B;AAAA,IAC1B,aAAa;AAAA,IACb,OAAO;AAAA,IACP,SAAS;AAAA,IACT,QAAQ;AAAA,IACR,MAAM,eAAe;AAAA,IACrB,aAAa,CAAC,WAAW;AAAA,IACzB,OAAO,CAAC;AAAA,IACR,WAAW;AAAA,MACT,KAAK,EAAE,aAAa,oBAAoB,QAAQ,iCAAiC;AAAA,IACnF;AAAA,EACF;AAAA,EACA,gBAAgB;AAAA,IACd,aAAa;AAAA,IACb,OAAO;AAAA,IACP,SAAS;AAAA,IACT,QAAQ;AAAA,IACR,MAAM;AAAA,IACN,aAAa,CAAC,aAAa,YAAY;AAAA,IACvC,OAAO,CAAC,kBAAkB;AAAA,IAC1B,QAAQ;AAAA,IACR,MAAM,EAAE,aAAa,oBAAoB,QAAQ,6BAA6B;AAAA,IAC9E,WAAW;AAAA,MACT,KAAK,EAAE,aAAa,oBAAoB,QAAQ,8BAA8B;AAAA,MAC9E,KAAK,EAAE,aAAa,oBAAoB,QAAQ,wBAAwB;AAAA,MACxE,KAAK,EAAE,aAAa,oBAAoB,QAAQ,wBAAwB;AAAA,MACxE,KAAK,EAAE,aAAa,oBAAoB,QAAQ,wBAAwB;AAAA,IAC1E;AAAA,IACA,OACE;AAAA,EACJ;AAAA,EACA,iBAAiB;AAAA,IACf,aAAa;AAAA,IACb,OAAO;AAAA,IACP,SAAS;AAAA,IACT,QAAQ;AAAA,IACR,MAAM;AAAA,IACN,aAAa,CAAC,aAAa,YAAY;AAAA,IACvC,OAAO,CAAC,eAAe;AAAA,IACvB,QAAQ;AAAA,IACR,MAAM;AAAA,MACJ,aAAa;AAAA,MACb,QAAQ;AAAA,MACR,UAAU;AAAA,IACZ;AAAA,IACA,WAAW;AAAA,MACT,KAAK,CAAC;AAAA,MACN,KAAK,EAAE,aAAa,oBAAoB,QAAQ,wBAAwB;AAAA,IAC1E;AAAA,IACA,OAAO;AAAA,EACT;AAAA,EACA,iBAAiB;AAAA,IACf,aAAa;AAAA,IACb,OAAO;AAAA,IACP,SAAS;AAAA,IACT,QAAQ;AAAA,IACR,MAAM;AAAA,IACN,aAAa,CAAC,aAAa,YAAY;AAAA,IACvC,OAAO,CAAC,WAAW;AAAA,IACnB,QAAQ;AAAA,IACR,OAAO;AAAA,IACP,WAAW;AAAA,MACT,KAAK,EAAE,aAAa,oBAAoB,QAAQ,0BAA0B;AAAA,MAC1E,KAAK,EAAE,aAAa,oBAAoB,QAAQ,wBAAwB;AAAA,MACxE,KAAK,EAAE,aAAa,oBAAoB,QAAQ,wBAAwB;AAAA,IAC1E;AAAA,IACA,OACE;AAAA,EAEJ;AAAA,EACA,mBAAmB;AAAA,IACjB,aAAa;AAAA,IACb,OAAO;AAAA,IACP,SAAS;AAAA,IACT,QAAQ;AAAA,IACR,MAAM;AAAA,IACN,aAAa,CAAC,WAAW;AAAA,IACzB,OAAO,CAAC;AAAA,IACR,QAAQ;AAAA,IACR,MAAM;AAAA,MACJ,aAAa;AAAA,MACb,QAAQ;AAAA,MACR,UAAU;AAAA,IACZ;AAAA,IACA,WAAW;AAAA,MACT,KAAK,CAAC;AAAA,MACN,KAAK,EAAE,aAAa,oBAAoB,QAAQ,wBAAwB;AAAA,IAC1E;AAAA,IACA,OACE;AAAA,EAEJ;AAAA,EACA,kBAAkB;AAAA,IAChB,aAAa;AAAA,IACb,OAAO;AAAA,IACP,SAAS;AAAA,IACT,QAAQ;AAAA,IACR,MAAM;AAAA,IACN,aAAa,CAAC,WAAW;AAAA,IACzB,OAAO,CAAC;AAAA,IACR,QAAQ;AAAA,IACR,WAAW;AAAA,MACT,KAAK,CAAC;AAAA,MACN,KAAK,EAAE,aAAa,oBAAoB,QAAQ,wBAAwB;AAAA,IAC1E;AAAA,EACF;AAAA,EACA,iBAAiB;AAAA,IACf,aAAa;AAAA,IACb,OAAO;AAAA,IACP,SAAS;AAAA,IACT,QAAQ;AAAA,IACR,MAAM;AAAA,IACN,aAAa,CAAC,aAAa,YAAY;AAAA,IACvC,OAAO,CAAC,eAAe;AAAA,IACvB,QAAQ;AAAA,IACR,MAAM,EAAE,aAAa,oBAAoB,QAAQ,8BAA8B;AAAA,IAC/E,WAAW;AAAA,MACT,KAAK,EAAE,aAAa,oBAAoB,QAAQ,yBAAyB;AAAA,MACzE,KAAK,EAAE,aAAa,oBAAoB,QAAQ,wBAAwB;AAAA,MACxE,KAAK,EAAE,aAAa,oBAAoB,QAAQ,wBAAwB;AAAA,MACxE,KAAK,EAAE,aAAa,oBAAoB,QAAQ,wBAAwB;AAAA,IAC1E;AAAA,IACA,OACE;AAAA,EAEJ;AAAA,EACA,eAAe;AAAA,IACb,aAAa;AAAA,IACb,OAAO;AAAA,IACP,SAAS;AAAA,IACT,QAAQ;AAAA,IACR,MAAM;AAAA,IACN,aAAa,CAAC,aAAa,YAAY;AAAA,IACvC,OAAO,CAAC,eAAe;AAAA,IACvB,QAAQ;AAAA,IACR,OAAO;AAAA,IACP,WAAW;AAAA,MACT,KAAK,EAAE,aAAa,oBAAoB,QAAQ,6BAA6B;AAAA,MAC7E,KAAK,EAAE,aAAa,oBAAoB,QAAQ,wBAAwB;AAAA,IAC1E;AAAA,EACF;AAAA,EACA,cAAc;AAAA,IACZ,aAAa;AAAA,IACb,OAAO;AAAA,IACP,SAAS;AAAA,IACT,QAAQ;AAAA,IACR,MAAM;AAAA,IACN,aAAa,CAAC,aAAa,YAAY;AAAA,IACvC,OAAO,CAAC,eAAe;AAAA,IACvB,QAAQ;AAAA,IACR,WAAW;AAAA,MACT,KAAK,EAAE,aAAa,oBAAoB,QAAQ,yBAAyB;AAAA,MACzE,KAAK,EAAE,aAAa,oBAAoB,QAAQ,wBAAwB;AAAA,IAC1E;AAAA,EACF;AAAA,EACA,iBAAiB;AAAA,IACf,aAAa;AAAA,IACb,OAAO;AAAA,IACP,SAAS;AAAA,IACT,QAAQ;AAAA,IACR,MAAM;AAAA,IACN,aAAa,CAAC,aAAa,YAAY;AAAA,IACvC,OAAO,CAAC,eAAe;AAAA,IACvB,QAAQ;AAAA,IACR,MAAM,EAAE,aAAa,oBAAoB,QAAQ,8BAA8B;AAAA,IAC/E,WAAW;AAAA,MACT,KAAK,EAAE,aAAa,oBAAoB,QAAQ,yBAAyB;AAAA,MACzE,KAAK,EAAE,aAAa,oBAAoB,QAAQ,wBAAwB;AAAA,MACxE,KAAK,EAAE,aAAa,oBAAoB,QAAQ,wBAAwB;AAAA,IAC1E;AAAA,EACF;AAAA,EACA,iBAAiB;AAAA,IACf,aAAa;AAAA,IACb,OAAO;AAAA,IACP,SAAS;AAAA,IACT,QAAQ;AAAA,IACR,MAAM;AAAA,IACN,aAAa,CAAC,aAAa,YAAY;AAAA,IACvC,OAAO,CAAC,eAAe;AAAA,IACvB,QAAQ;AAAA,IACR,WAAW;AAAA,MACT,KAAK,CAAC;AAAA,MACN,KAAK,EAAE,aAAa,oBAAoB,QAAQ,wBAAwB;AAAA,IAC1E;AAAA,EACF;AAAA,EACA,mBAAmB;AAAA,IACjB,aAAa;AAAA,IACb,OAAO;AAAA,IACP,SAAS;AAAA,IACT,QAAQ;AAAA,IACR,MAAM,eAAe;AAAA,IACrB,aAAa,CAAC;AAAA,IACd,OAAO,CAAC;AAAA,IACR,MAAM,EAAE,aAAa,oBAAoB,QAAQ,2BAA2B;AAAA,IAC5E,WAAW;AAAA,MACT,KAAK,EAAE,aAAa,oBAAoB,QAAQ,2BAA2B;AAAA,MAC3E,KAAK,EAAE,aAAa,oBAAoB,QAAQ,wBAAwB;AAAA,MACxE,KAAK,EAAE,aAAa,oBAAoB,QAAQ,wBAAwB;AAAA,MACxE,KAAK,EAAE,aAAa,oBAAoB,QAAQ,wBAAwB;AAAA,MACxE,KAAK,EAAE,aAAa,oBAAoB,QAAQ,wBAAwB;AAAA,MACxE,KAAK,EAAE,aAAa,oBAAoB,QAAQ,wBAAwB;AAAA,IAC1E;AAAA,IACA,OACE;AAAA,EAIJ;AACF;AAkBO,IAAM,oBAAoB,EAAE,OAAO;AAAA,EACxC,OAAO,EAAE,OAAO,EAAE,MAAM,YAAY;AACtC,CAAC;AACM,IAAM,uBAAuB,kBAAkB,OAAO;AAAA,EAC3D,WAAW,EAAE,OAAO,EAAE,IAAI,CAAC;AAC7B,CAAC;AACM,IAAM,sBAAsB,qBAAqB,OAAO;AAAA,EAC7D,KAAK,EAAE,OAAO,OAAO,EAAE,IAAI,EAAE,IAAI,CAAC;AACpC,CAAC;AACM,IAAM,4BAA4B,oBAAoB,OAAO;AAAA,EAClE,UAAU,EAAE,OAAO,EAAE,IAAI,CAAC;AAC5B,CAAC;AACM,IAAM,uBAAuB,qBAAqB,OAAO;AAAA,EAC9D,UAAU,EAAE,OAAO,EAAE,IAAI,CAAC;AAC5B,CAAC;AAOM,IAAM,yBAA+C;AAAA,EAC1D,MAAM;AAAA,EACN,UAAU;AAAA,EACV,aACE;AAGJ;AAEA,IAAM,YAAY,EAAE,OAAO,EAAE,OAAO,GAAG,EAAE,QAAQ,CAAC;AAClD,IAAM,iBAAiB,CAAC,aAAa,SAAS;AAO9C,IAAM,yBAAyB,EAAE,OAAO,EAAE,MAAM,mBAAmB,CAAC,EAAE,YAAY;AAE3E,IAAM,gBAAgB;AAAA,EAC3B,YAAY;AAAA,IACV,aAAa;AAAA,IACb,OAAO;AAAA,IACP,SAAS;AAAA,IACT,QAAQ;AAAA,IACR,MAAM,cAAc;AAAA,IACpB,aAAa;AAAA,IACb,OAAO,CAAC;AAAA,IACR,iBAAiB,CAAC,UAAU;AAAA,IAC5B,gBAAgB,CAAC,sBAAsB;AAAA,IACvC,QAAQ;AAAA,IACR,WAAW;AAAA,MACT,KAAK,EAAE,aAAa,oBAAoB,QAAQ,mBAAmB;AAAA,MACnE,KAAK,EAAE,aAAa,oBAAoB,QAAQ,yBAAyB;AAAA,IAC3E;AAAA,EACF;AAAA,EACA,gBAAgB;AAAA,IACd,aAAa;AAAA,IACb,OAAO;AAAA,IACP,SAAS;AAAA,IACT,QAAQ;AAAA,IACR,MAAM,cAAc;AAAA,IACpB,aAAa;AAAA,IACb,OAAO,CAAC;AAAA,IACR,iBAAiB,CAAC,UAAU;AAAA,IAC5B,gBAAgB,CAAC,sBAAsB;AAAA,IACvC,QAAQ;AAAA,IACR,WAAW;AAAA,MACT,KAAK,EAAE,aAAa,oBAAoB,QAAQ,uBAAuB;AAAA,MACvE,KAAK,EAAE,aAAa,oBAAoB,QAAQ,yBAAyB;AAAA,IAC3E;AAAA,EACF;AAAA,EACA,oBAAoB;AAAA,IAClB,aAAa;AAAA,IACb,OAAO;AAAA,IACP,SAAS;AAAA,IACT,QAAQ;AAAA,IACR,MAAM,cAAc;AAAA,IACpB,aAAa;AAAA,IACb,OAAO,CAAC;AAAA,IACR,iBAAiB,CAAC,UAAU;AAAA,IAC5B,gBAAgB,CAAC,sBAAsB;AAAA,IACvC,QAAQ;AAAA,IACR,WAAW;AAAA,MACT,KAAK,EAAE,aAAa,oBAAoB,QAAQ,uBAAuB;AAAA,MACvE,KAAK,EAAE,aAAa,oBAAoB,QAAQ,yBAAyB;AAAA,IAC3E;AAAA,EACF;AAAA,EACA,cAAc;AAAA,IACZ,aAAa;AAAA,IACb,OAAO;AAAA,IACP,SAAS;AAAA,IACT,QAAQ;AAAA,IACR,MAAM,cAAc;AAAA,IACpB,aAAa;AAAA,IACb,OAAO,CAAC;AAAA,IACR,iBAAiB,CAAC,YAAY;AAAA,IAC9B,gBAAgB,CAAC,sBAAsB;AAAA,IACvC,QAAQ;AAAA,IACR,OACE;AAAA,IAEF,WAAW;AAAA,MACT,KAAK,EAAE,aAAa,aAAa;AAAA,MACjC,KAAK,EAAE,aAAa,oBAAoB,QAAQ,yBAAyB;AAAA,IAC3E;AAAA,EACF;AAAA,EACA,YAAY;AAAA,IACV,aAAa;AAAA,IACb,OAAO;AAAA,IACP,SAAS;AAAA,IACT,QAAQ;AAAA,IACR,MAAM,cAAc;AAAA,IACpB,aAAa;AAAA,IACb,OAAO,CAAC;AAAA,IACR,iBAAiB,CAAC,eAAe;AAAA,IACjC,gBAAgB,CAAC,sBAAsB;AAAA,IACvC,QAAQ;AAAA,IACR,WAAW;AAAA,MACT,KAAK,EAAE,aAAa,oBAAoB,QAAQ,uBAAuB;AAAA,MACvE,KAAK,EAAE,aAAa,oBAAoB,QAAQ,yBAAyB;AAAA,IAC3E;AAAA,EACF;AAAA,EACA,wBAAwB;AAAA,IACtB,aAAa;AAAA,IACb,OAAO;AAAA,IACP,SAAS;AAAA,IACT,QAAQ;AAAA,IACR,MAAM,cAAc;AAAA,IACpB,aAAa;AAAA,IACb,OAAO,CAAC;AAAA,IACR,iBAAiB,CAAC,mBAAmB;AAAA,IACrC,gBAAgB,CAAC,sBAAsB;AAAA,IACvC,QAAQ;AAAA,IACR,WAAW;AAAA,MACT,KAAK,EAAE,aAAa,oBAAoB,QAAQ,iCAAiC;AAAA,MACjF,KAAK,EAAE,aAAa,oBAAoB,QAAQ,yBAAyB;AAAA,IAC3E;AAAA,EACF;AAAA,EACA,0BAA0B;AAAA,IACxB,aAAa;AAAA,IACb,OAAO;AAAA,IACP,SAAS;AAAA,IACT,QAAQ;AAAA,IACR,MAAM,cAAc;AAAA,IACpB,aAAa;AAAA,IACb,OAAO,CAAC;AAAA,IACR,iBAAiB,CAAC,qBAAqB;AAAA,IACvC,gBAAgB,CAAC,sBAAsB;AAAA,IACvC,QAAQ;AAAA,IACR,MAAM,EAAE,aAAa,oBAAoB,QAAQ,UAAU;AAAA,IAC3D,OACE;AAAA,IAEF,WAAW;AAAA,MACT,KAAK,EAAE,aAAa,oBAAoB,QAAQ,uBAAuB;AAAA,MACvE,KAAK,EAAE,aAAa,oBAAoB,QAAQ,yBAAyB;AAAA,MACzE,KAAK,EAAE,aAAa,oBAAoB,QAAQ,yBAAyB;AAAA,IAC3E;AAAA,EACF;AAAA,EACA,0BAA0B;AAAA,IACxB,aAAa;AAAA,IACb,OAAO;AAAA,IACP,SAAS;AAAA,IACT,QAAQ;AAAA,IACR,MAAM,cAAc;AAAA,IACpB,aAAa;AAAA,IACb,OAAO,CAAC;AAAA,IACR,iBAAiB,CAAC,qBAAqB;AAAA,IACvC,gBAAgB,CAAC,sBAAsB;AAAA,IACvC,QAAQ;AAAA,IACR,MAAM,EAAE,aAAa,oBAAoB,QAAQ,UAAU;AAAA,IAC3D,WAAW;AAAA,MACT,KAAK,EAAE,aAAa,oBAAoB,QAAQ,uBAAuB;AAAA,MACvE,KAAK,EAAE,aAAa,oBAAoB,QAAQ,yBAAyB;AAAA,MACzE,KAAK,EAAE,aAAa,oBAAoB,QAAQ,yBAAyB;AAAA,IAC3E;AAAA,EACF;AAAA,EACA,0BAA0B;AAAA,IACxB,aAAa;AAAA,IACb,OAAO;AAAA,IACP,SAAS;AAAA,IACT,QAAQ;AAAA,IACR,MAAM,cAAc;AAAA,IACpB,aAAa;AAAA,IACb,OAAO,CAAC;AAAA,IACR,iBAAiB,CAAC,qBAAqB;AAAA,IACvC,gBAAgB,CAAC,sBAAsB;AAAA,IACvC,QAAQ;AAAA,IACR,WAAW;AAAA,MACT,KAAK,EAAE,aAAa,oBAAoB,QAAQ,uBAAuB;AAAA,MACvE,KAAK,EAAE,aAAa,oBAAoB,QAAQ,yBAAyB;AAAA,IAC3E;AAAA,EACF;AAAA,EACA,iBAAiB;AAAA,IACf,aAAa;AAAA,IACb,OAAO;AAAA,IACP,SAAS;AAAA,IACT,QAAQ;AAAA,IACR,MAAM,cAAc;AAAA,IACpB,aAAa;AAAA,IACb,OAAO,CAAC;AAAA,IACR,iBAAiB,CAAC,gBAAgB;AAAA,IAClC,gBAAgB,CAAC,sBAAsB;AAAA,IACvC,QAAQ;AAAA,IACR,WAAW;AAAA,MACT,KAAK,EAAE,aAAa,oBAAoB,QAAQ,mBAAmB;AAAA,MACnE,KAAK,EAAE,aAAa,oBAAoB,QAAQ,yBAAyB;AAAA,IAC3E;AAAA,EACF;AAAA,EACA,sBAAsB;AAAA,IACpB,aAAa;AAAA,IACb,OAAO;AAAA,IACP,SAAS;AAAA,IACT,QAAQ;AAAA,IACR,MAAM,cAAc;AAAA,IACpB,aAAa;AAAA,IACb,OAAO,CAAC;AAAA,IACR,iBAAiB,CAAC,gBAAgB;AAAA,IAClC,gBAAgB,CAAC,sBAAsB;AAAA,IACvC,QAAQ;AAAA,IACR,MAAM,EAAE,aAAa,oBAAoB,QAAQ,UAAU;AAAA,IAC3D,WAAW;AAAA,MACT,KAAK,EAAE,aAAa,oBAAoB,QAAQ,uBAAuB;AAAA,MACvE,KAAK,EAAE,aAAa,oBAAoB,QAAQ,yBAAyB;AAAA,MACzE,KAAK,EAAE,aAAa,oBAAoB,QAAQ,yBAAyB;AAAA,IAC3E;AAAA,EACF;AAAA,EACA,mBAAmB;AAAA,IACjB,aAAa;AAAA,IACb,OAAO;AAAA,IACP,SAAS;AAAA,IACT,QAAQ;AAAA,IACR,MAAM,cAAc;AAAA,IACpB,aAAa;AAAA,IACb,OAAO,CAAC;AAAA,IACR,iBAAiB,CAAC,gBAAgB;AAAA,IAClC,gBAAgB,CAAC,sBAAsB;AAAA,IACvC,QAAQ;AAAA,IACR,WAAW;AAAA,MACT,KAAK,EAAE,aAAa,oBAAoB,QAAQ,uBAAuB;AAAA,MACvE,KAAK,EAAE,aAAa,oBAAoB,QAAQ,yBAAyB;AAAA,IAC3E;AAAA,EACF;AAAA,EACA,wBAAwB;AAAA,IACtB,aAAa;AAAA,IACb,OAAO;AAAA,IACP,SAAS;AAAA,IACT,QAAQ;AAAA,IACR,MAAM,cAAc;AAAA,IACpB,aAAa;AAAA,IACb,OAAO,CAAC;AAAA,IACR,iBAAiB,CAAC,gBAAgB;AAAA,IAClC,gBAAgB,CAAC,sBAAsB;AAAA,IACvC,QAAQ;AAAA,IACR,OAAO,EAAE,OAAO,EAAE,QAAQ,EAAE,KAAK,CAAC,OAAO,MAAM,CAAC,EAAE,SAAS,EAAE,CAAC;AAAA,IAC9D,WAAW;AAAA,MACT,KAAK,EAAE,aAAa,CAAC,8BAA8B,qBAAqB,EAAE;AAAA,MAC1E,KAAK,EAAE,aAAa,oBAAoB,QAAQ,yBAAyB;AAAA,IAC3E;AAAA,EACF;AAAA,EACA,wBAAwB;AAAA,IACtB,aAAa;AAAA,IACb,OAAO;AAAA,IACP,SAAS;AAAA,IACT,QAAQ;AAAA,IACR,MAAM,cAAc;AAAA,IACpB,aAAa;AAAA,IACb,OAAO,CAAC;AAAA,IACR,iBAAiB,CAAC,gBAAgB;AAAA,IAClC,gBAAgB,CAAC,sBAAsB;AAAA,IACvC,QAAQ;AAAA,IACR,MAAM,EAAE,aAAa,oBAAoB,QAAQ,UAAU;AAAA,IAC3D,WAAW;AAAA,MACT,KAAK,EAAE,aAAa,oBAAoB,QAAQ,uBAAuB;AAAA,MACvE,KAAK,EAAE,aAAa,oBAAoB,QAAQ,yBAAyB;AAAA,MACzE,KAAK,EAAE,aAAa,oBAAoB,QAAQ,yBAAyB;AAAA,IAC3E;AAAA,EACF;AAAA,EACA,kBAAkB;AAAA,IAChB,aAAa;AAAA,IACb,OAAO;AAAA,IACP,SAAS;AAAA,IACT,QAAQ;AAAA,IACR,MAAM,cAAc;AAAA,IACpB,aAAa;AAAA,IACb,OAAO,CAAC;AAAA,IACR,iBAAiB,CAAC,oBAAoB;AAAA,IACtC,gBAAgB,CAAC,sBAAsB;AAAA,IACvC,QAAQ;AAAA,IACR,MAAM,EAAE,aAAa,oBAAoB,QAAQ,UAAU;AAAA,IAC3D,WAAW;AAAA,MACT,KAAK,EAAE,aAAa,oBAAoB,QAAQ,uBAAuB;AAAA,MACvE,KAAK,EAAE,aAAa,oBAAoB,QAAQ,yBAAyB;AAAA,MACzE,KAAK,EAAE,aAAa,oBAAoB,QAAQ,yBAAyB;AAAA,IAC3E;AAAA,EACF;AAAA,EACA,oBAAoB;AAAA,IAClB,aAAa;AAAA,IACb,OAAO;AAAA,IACP,SAAS;AAAA,IACT,QAAQ;AAAA,IACR,MAAM,cAAc;AAAA,IACpB,aAAa;AAAA,IACb,OAAO,CAAC;AAAA,IACR,iBAAiB,CAAC,oBAAoB;AAAA,IACtC,gBAAgB,CAAC,sBAAsB;AAAA,IACvC,QAAQ;AAAA,IACR,MAAM,EAAE,aAAa,oBAAoB,QAAQ,UAAU;AAAA,IAC3D,WAAW;AAAA,MACT,KAAK,EAAE,aAAa,oBAAoB,QAAQ,uBAAuB;AAAA,MACvE,KAAK,EAAE,aAAa,oBAAoB,QAAQ,yBAAyB;AAAA,MACzE,KAAK,EAAE,aAAa,oBAAoB,QAAQ,yBAAyB;AAAA,IAC3E;AAAA,EACF;AAAA,EACA,oBAAoB;AAAA,IAClB,aAAa;AAAA,IACb,OAAO;AAAA,IACP,SAAS;AAAA,IACT,QAAQ;AAAA,IACR,MAAM,cAAc;AAAA,IACpB,aAAa;AAAA,IACb,OAAO,CAAC;AAAA,IACR,iBAAiB,CAAC,oBAAoB;AAAA,IACtC,gBAAgB,CAAC,sBAAsB;AAAA,IACvC,QAAQ;AAAA,IACR,MAAM,EAAE,aAAa,oBAAoB,QAAQ,UAAU;AAAA,IAC3D,WAAW;AAAA,MACT,KAAK,EAAE,aAAa,oBAAoB,QAAQ,uBAAuB;AAAA,MACvE,KAAK,EAAE,aAAa,oBAAoB,QAAQ,yBAAyB;AAAA,MACzE,KAAK,EAAE,aAAa,oBAAoB,QAAQ,yBAAyB;AAAA,IAC3E;AAAA,EACF;AAAA,EACA,qBAAqB;AAAA,IACnB,aAAa;AAAA,IACb,OAAO;AAAA,IACP,SAAS;AAAA,IACT,QAAQ;AAAA,IACR,MAAM,cAAc;AAAA,IACpB,aAAa;AAAA,IACb,OAAO,CAAC;AAAA,IACR,iBAAiB,CAAC,oBAAoB,qBAAqB;AAAA,IAC3D,gBAAgB,CAAC,sBAAsB;AAAA,IACvC,QAAQ;AAAA,IACR,MAAM,EAAE,aAAa,oBAAoB,QAAQ,WAAW,UAAU,MAAM;AAAA,IAC5E,WAAW;AAAA,MACT,KAAK,EAAE,aAAa,oBAAoB,QAAQ,uBAAuB;AAAA,MACvE,KAAK,EAAE,aAAa,oBAAoB,QAAQ,yBAAyB;AAAA,MACzE,KAAK,EAAE,aAAa,oBAAoB,QAAQ,yBAAyB;AAAA,IAC3E;AAAA,EACF;AAAA,EACA,wBAAwB;AAAA,IACtB,aAAa;AAAA,IACb,OAAO;AAAA,IACP,SAAS;AAAA,IACT,QAAQ;AAAA,IACR,MAAM,cAAc;AAAA,IACpB,aAAa;AAAA,IACb,OAAO,CAAC;AAAA,IACR,iBAAiB,CAAC,oBAAoB,uBAAuB,YAAY;AAAA,IACzE,gBAAgB,CAAC,sBAAsB;AAAA,IACvC,QAAQ;AAAA,IACR,MAAM,EAAE,aAAa,oBAAoB,QAAQ,WAAW,UAAU,MAAM;AAAA,IAC5E,WAAW;AAAA,MACT,KAAK,EAAE,aAAa,oBAAoB,QAAQ,uBAAuB;AAAA,MACvE,KAAK,EAAE,aAAa,oBAAoB,QAAQ,yBAAyB;AAAA,MACzE,KAAK,EAAE,aAAa,oBAAoB,QAAQ,yBAAyB;AAAA,IAC3E;AAAA,EACF;AAAA,EACA,gBAAgB;AAAA,IACd,aAAa;AAAA,IACb,OAAO;AAAA,IACP,SAAS;AAAA,IACT,QAAQ;AAAA,IACR,MAAM,cAAc;AAAA,IACpB,aAAa;AAAA,IACb,OAAO,CAAC;AAAA,IACR,iBAAiB,CAAC,cAAc;AAAA,IAChC,gBAAgB,CAAC,sBAAsB;AAAA,IACvC,QAAQ;AAAA,IACR,WAAW;AAAA,MACT,KAAK,EAAE,aAAa,kBAAkB;AAAA,MACtC,KAAK,EAAE,aAAa,oBAAoB,QAAQ,yBAAyB;AAAA,IAC3E;AAAA,EACF;AACF;AAIO,IAAM,gBAAgB,EAAE,GAAG,iBAAiB,GAAG,cAAc;AAe7D,IAAM,aAAa;AAAA,EACxB,YAAY,EAAE,OAAO,aAAa;AAAA,EAClC,SAAS,EAAE,OAAO,UAAU;AAAA,EAC5B,WAAW,EAAE,OAAO,mBAAmB;AAAA,EACvC,QAAQ,EAAE,OAAO,SAAS;AAAA,EAC1B,QAAQ,EAAE,OAAO,SAAS;AAAA,EAC1B,KAAK,EAAE,OAAO,uBAAuB,MAAM,sBAAsB;AAAA,EACjE,mBAAmB,EAAE,OAAO,cAAc;AAAA,EAC1C,aAAa,EAAE,OAAO,QAAQ;AAAA,EAC9B,gBAAgB,EAAE,OAAO,WAAW;AAAA,EACpC,aAAa,EAAE,OAAO,QAAQ;AAAA,EAC9B,kBAAkB,EAAE,OAAO,aAAa;AAC1C;","names":[]}
+{"version":3,"sources":["../src/index.ts"],"sourcesContent":["import type { DocCapability } from '@embedpdf/engine-core/runtime';\nimport {\n  AnnotationListPageSnapshotSchema,\n  DocumentHeadSchema,\n  DocumentManifestSchema,\n  DocumentMetadataSchema,\n  EngineErrorPayloadSchema,\n  FormSnapshotSchema,\n  MutationMetaSchema,\n  PageTextSnapshotSchema,\n  wireTemplates,\n} from '@embedpdf/engine-core/wire';\nimport { z } from 'zod';\n\nconst sha256Hex = /^[0-9a-f]{64}$/i;\nconst docIdPattern = /^[A-Za-z0-9_-]+$/;\n/**\n * Tenant ids share the doc-id charset: URL-safe by construction, since\n * they appear in every tenant-scoped path (and therefore in logs — do\n * not put PII in tenant ids).\n */\nexport const tenantIdPattern = /^[A-Za-z0-9_-]+$/;\n/**\n * A web origin pattern: scheme + host (+ optional port), no path. One\n * leading `*.` label is allowed and matches one or more subdomain\n * labels (`https://*.acme.com` covers `docs.acme.com`, never bare\n * `acme.com` and never `evilacme.com`).\n */\nconst originPattern =\n  /^https?:\\/\\/(\\*\\.)?[a-zA-Z0-9]([a-zA-Z0-9-]*[a-zA-Z0-9])?(\\.[a-zA-Z0-9]([a-zA-Z0-9-]*[a-zA-Z0-9])?)*(:\\d{1,5})?$/;\nconst originPatternArray = z\n  .array(\n    z\n      .string()\n      .max(262)\n      .regex(\n        originPattern,\n        'must be a web origin like https://example.com (optionally one leading *. wildcard label, optional port, no path)',\n      ),\n  )\n  .min(1)\n  .max(32);\n/** Share tokens are the grant row id: `shr_` + 24 url-safe random chars. */\nconst shareTokenPattern = /^shr_[A-Za-z0-9_-]{24}$/;\n\n/**\n * Wire paths. The URL carries the full resource identity — tenant\n * resources live under `/v1/tenants/{tenantId}/…` — and the auth model\n * is one rule: the API token is valid everywhere; a JWT is valid\n * exactly under the subtree of the resource it names.\n */\nexport const adminWirePaths = {\n  tenants: '/v1/tenants',\n  tenant: (tenantId: string) => `/v1/tenants/${encodeURIComponent(tenantId)}`,\n  documents: (tenantId: string) => `/v1/tenants/${encodeURIComponent(tenantId)}/documents`,\n  documentsInit: (tenantId: string) => `/v1/tenants/${encodeURIComponent(tenantId)}/documents/init`,\n  documentsImport: (tenantId: string) =>\n    `/v1/tenants/${encodeURIComponent(tenantId)}/documents/import`,\n  document: (tenantId: string, docId: string) =>\n    `/v1/tenants/${encodeURIComponent(tenantId)}/documents/${encodeURIComponent(docId)}`,\n  documentCommit: (tenantId: string, docId: string) =>\n    `/v1/tenants/${encodeURIComponent(tenantId)}/documents/${encodeURIComponent(docId)}/commit`,\n  documentUploadProxy: (tenantId: string, docId: string) =>\n    `/v1/tenants/${encodeURIComponent(tenantId)}/documents/${encodeURIComponent(docId)}/upload-proxy`,\n  documentDownload: (tenantId: string, docId: string) =>\n    `/v1/tenants/${encodeURIComponent(tenantId)}/documents/${encodeURIComponent(docId)}/download`,\n  /** The warmed dashboard-tile artifact. Returns 404 while `pending`/`locked`. */\n  documentThumbnail: (tenantId: string, docId: string) =>\n    `/v1/tenants/${encodeURIComponent(tenantId)}/documents/${encodeURIComponent(docId)}/thumbnail`,\n  tokenIssue: (tenantId: string) => `/v1/tenants/${encodeURIComponent(tenantId)}/tokens`,\n  tokenRevoke: (tenantId: string, jti: string) =>\n    `/v1/tenants/${encodeURIComponent(tenantId)}/tokens/${encodeURIComponent(jti)}/revoke`,\n  shares: (tenantId: string) => `/v1/tenants/${encodeURIComponent(tenantId)}/shares`,\n  share: (tenantId: string, shareId: string) =>\n    `/v1/tenants/${encodeURIComponent(tenantId)}/shares/${encodeURIComponent(shareId)}`,\n  tenantUsage: (tenantId: string) => `/v1/tenants/${encodeURIComponent(tenantId)}/usage`,\n  tenantSuspend: (tenantId: string) => `/v1/tenants/${encodeURIComponent(tenantId)}/suspend`,\n  tenantResume: (tenantId: string) => `/v1/tenants/${encodeURIComponent(tenantId)}/resume`,\n  /**\n   * The public share-session exchange. Deliberately outside any tenant\n   * subtree: the caller holds only a share token and does not know the\n   * tenant — the grant row resolves it server-side.\n   */\n  shareSessions: '/v1/share-sessions',\n  /** Deployment-global singletons: API-token only, no tenant context. */\n  deploymentLicenseStatus: '/v1/deployment/license/status',\n} as const;\n\nexport const DedupModeSchema = z\n  .enum(['always-create', 'reuse-existing'])\n  .describe(\n    'always-create (default) creates a new document every time. reuse-existing returns a document that already holds the same content instead of storing it twice.',\n  );\nexport type DedupMode = z.infer<typeof DedupModeSchema>;\n\nexport const UploadPreferenceSchema = z.enum(['auto', 'presigned', 'proxy']);\nexport type UploadPreference = z.infer<typeof UploadPreferenceSchema>;\n\nexport const DocumentStateSchema = z.enum(['pending', 'ready', 'failed', 'deleting']);\nexport type DocumentState = z.infer<typeof DocumentStateSchema>;\n\nexport const AdminDocumentRecordSchema = z.object({\n  id: z.string(),\n  tenantId: z.string(),\n  state: DocumentStateSchema,\n  baseSha: z.string().nullable(),\n  storageSizeBytes: z.number().nullable(),\n  metadata: z.record(z.string(), z.unknown()).nullable(),\n  idempotencyKey: z.string().nullable(),\n  failureReason: z.string().nullable(),\n  /** Dashboard tile lifecycle. Optional because older servers omit these fields. */\n  thumbnailState: z.enum(['pending', 'ready', 'locked', 'failed']).optional(),\n  thumbnailUrl: z.string().nullable().optional(),\n  createdAt: z.number(),\n  updatedAt: z.number(),\n  createdBy: z.string().nullable(),\n});\nexport type AdminDocumentRecord = z.infer<typeof AdminDocumentRecordSchema>;\n\nexport const AdminDocumentInitRequestSchema = z.object({\n  contentLength: z.number().finite().min(1),\n  contentSha256: z.string().regex(sha256Hex),\n  metadata: z.record(z.string(), z.unknown()).optional(),\n  idempotencyKey: z.string().optional(),\n  dedupMode: DedupModeSchema.optional(),\n  docId: z.string().regex(docIdPattern).optional(),\n  uploadTtlSec: z.number().finite().min(60).max(3600).optional(),\n  uploadPreference: UploadPreferenceSchema.optional(),\n});\nexport type AdminDocumentInitRequest = z.infer<typeof AdminDocumentInitRequestSchema>;\n\nexport const AdminPresignedUploadSchema = z.object({\n  url: z.string(),\n  headers: z.record(z.string(), z.string()),\n  method: z.literal('PUT'),\n  expiresAt: z.number(),\n});\nexport type AdminPresignedUpload = z.infer<typeof AdminPresignedUploadSchema>;\n\nexport const AdminInitUploadSchema = z.discriminatedUnion('kind', [\n  z.object({\n    kind: z.literal('presigned'),\n    presigned: AdminPresignedUploadSchema,\n    key: z.string(),\n  }),\n  z.object({\n    kind: z.literal('proxy'),\n    url: z.string(),\n    key: z.string(),\n  }),\n]);\nexport type AdminInitUpload = z.infer<typeof AdminInitUploadSchema>;\n\nexport const AdminDocumentInitResponseSchema = z.discriminatedUnion('tag', [\n  z.object({\n    tag: z.literal('created'),\n    document: AdminDocumentRecordSchema,\n    upload: AdminInitUploadSchema,\n  }),\n  z.object({\n    tag: z.literal('resumed'),\n    document: AdminDocumentRecordSchema,\n    upload: AdminInitUploadSchema,\n  }),\n  z.object({\n    tag: z.literal('deduped'),\n    document: AdminDocumentRecordSchema,\n  }),\n]);\nexport type AdminDocumentInitResponse = z.infer<typeof AdminDocumentInitResponseSchema>;\n\nexport const AdminDocumentCommitRequestSchema = z.object({\n  sha256: z.string().regex(sha256Hex),\n});\nexport type AdminDocumentCommitRequest = z.infer<typeof AdminDocumentCommitRequestSchema>;\n\nexport const AdminDocumentCommitResponseSchema = z.object({\n  document: AdminDocumentRecordSchema,\n});\nexport type AdminDocumentCommitResponse = z.infer<typeof AdminDocumentCommitResponseSchema>;\n\n/** UTF-8 byte length — provider key limits are byte rules, not JS code units. */\nconst utf8ByteLength = (s: string): number => new TextEncoder().encode(s).length;\n\n/**\n * A server-side pull source for `documents.importFrom`. The discriminator\n * distinguishes AUTHORIZATION MODELS, not storage vendors:\n *\n *   - `url`        — the CALLER supplies authority: a presigned\n *     S3/GCS/Azure/R2/MinIO GET, or any HTTPS endpoint the\n *     deployment's import policy allows. The URL is a capability:\n *     treat it as a secret. Servers never echo its query string back\n *     in errors, logs, or stored failure reasons.\n *   - `connection` — the OPERATOR pre-registered authority: the\n *     request names a connection and a key; which provider backs it\n *     (S3, GCS, Azure Blob, filesystem, ...) is deployment\n *     configuration, never wire surface. `revision` is opaque here\n *     and provider-interpreted (S3 VersionId, GCS generation, Azure\n *     version id); unsupported providers reject it.\n *\n * Key validation at this layer is deliberately generic (byte length,\n * no NUL); provider-exact rules live in the server's source adapters,\n * which know which backend a connection names.\n */\nexport const AdminImportSourceSchema = z\n  .discriminatedUnion('kind', [\n    z\n      .object({\n        kind: z.literal('url'),\n        url: z\n          .string()\n          .url()\n          .max(8192)\n          .describe(\n            'The URL to fetch. Must be allowed by the deployment import policy (scheme, network range, size) and must declare a length.',\n          ),\n      })\n      .describe(\n        'The caller supplies the authority: a presigned S3/GCS/Azure/R2/MinIO GET, or any HTTPS endpoint the deployment import policy allows. The URL is a capability — treat it as a secret. CloudPDF never echoes its query string back in errors, logs, or stored failure reasons.',\n      ),\n    z\n      .object({\n        kind: z.literal('connection'),\n        connectionId: z\n          .string()\n          .min(1)\n          .max(128)\n          .describe('The operator-registered storage connection to read from.'),\n        key: z\n          .string()\n          .min(1)\n          .refine((k) => !k.includes('\\0'), 'key must not contain NUL')\n          .refine((k) => utf8ByteLength(k) <= 1024, 'key must be at most 1024 UTF-8 bytes')\n          .describe(\n            \"The object key to read, inside the connection's configured scope. At most 1024 UTF-8 bytes.\",\n          ),\n        revision: z\n          .string()\n          .min(1)\n          .max(1024)\n          .optional()\n          .describe(\n            'Pins a specific version of the object. Provider-interpreted (S3 VersionId, GCS generation, Azure version id); providers without versioning reject it.',\n          ),\n      })\n      .describe(\n        'The operator pre-registered the authority: the request names a connection and a key inside it. Which provider backs the connection (S3, GCS, Azure Blob, filesystem, ...) is deployment configuration, never wire surface.',\n      ),\n  ])\n  .describe(\n    'Where CloudPDF pulls the bytes from. The two shapes differ in WHO supplies the authority to read, not in which storage vendor holds the file.',\n  );\nexport type AdminImportSource = z.infer<typeof AdminImportSourceSchema>;\n\nexport const AdminDocumentImportRequestSchema = z.object({\n  source: AdminImportSourceSchema,\n  /**\n   * Optional integrity pins, enforced when present: `sizeBytes`\n   * against the source's declared Content-Length before the transfer,\n   * `sha256` against the server-observed digest after it. When absent\n   * the server-observed values become authoritative.\n   * `dedupMode=reuse-existing` REQUIRES `sha256` — without a declared\n   * hash the server cannot know what content to reuse.\n   */\n  expected: z\n    .object({\n      sizeBytes: z\n        .number()\n        .int()\n        .min(1)\n        .optional()\n        .describe(\"Checked against the source's declared Content-Length before the transfer.\"),\n      sha256: z\n        .string()\n        .regex(sha256Hex)\n        .optional()\n        .describe(\n          'Checked against the server-observed digest after the transfer. Required when dedupMode is reuse-existing.',\n        ),\n    })\n    .optional()\n    .describe(\n      'Integrity pins, enforced when present. When absent, the server-observed values become authoritative.',\n    ),\n  metadata: z.record(z.string(), z.unknown()).optional(),\n  idempotencyKey: z\n    .string()\n    .optional()\n    .describe(\n      'Retrying with the same key resumes the same document rather than importing a second copy — including after a 502.',\n    ),\n  dedupMode: DedupModeSchema.optional(),\n  docId: z.string().regex(docIdPattern).optional(),\n  /**\n   * `sync` (default) holds the response open for the whole transfer.\n   * `async` accepts the request (202, document `pending`), transfers\n   * in the background, and the caller polls the document. Async\n   * requires a `connection` source (URLs are secrets and expire, so\n   * they cannot sit in a durable job); filesystem connections\n   * additionally require `expected.sha256`, since they have no\n   * revisions to pin retries to.\n   */\n  mode: z\n    .enum(['sync', 'async'])\n    .optional()\n    .describe(\n      'sync (default) holds the response open for the whole transfer. async answers 202 with the document pending and transfers in the background; it requires a connection source, and filesystem connections additionally require expected.sha256.',\n    ),\n});\nexport type AdminDocumentImportRequest = z.infer<typeof AdminDocumentImportRequestSchema>;\n\nexport const AdminDocumentImportResponseSchema = z.object({\n  /**\n   * `imported` — bytes were pulled, verified, and committed (sync).\n   * `deduped`  — an existing document satisfied the request without a\n   * transfer (content dedup or idempotent replay).\n   * `accepted` — async: the job is queued (HTTP 202); poll the\n   * document until `ready` or `failed`.\n   */\n  tag: z.enum(['imported', 'deduped', 'accepted']),\n  document: AdminDocumentRecordSchema,\n});\nexport type AdminDocumentImportResponse = z.infer<typeof AdminDocumentImportResponseSchema>;\n\nexport const AdminDocumentResponseSchema = z.object({\n  document: AdminDocumentRecordSchema,\n});\nexport type AdminDocumentResponse = z.infer<typeof AdminDocumentResponseSchema>;\n\nexport const ADMIN_DOCUMENT_LIST_DEFAULT_LIMIT = 100;\nexport const ADMIN_DOCUMENT_LIST_MAX_LIMIT = 200;\n\n/**\n * Query parameters for `documents.list`. `limit` arrives as a string on\n * the wire, hence the coercion; values outside [1, MAX] are a validation\n * error, not a silent clamp. `cursor` is an opaque continuation token\n * from a previous page's `nextCursor` — clients must not parse it.\n */\nexport const AdminDocumentListQuerySchema = z.object({\n  limit: z.coerce\n    .number()\n    .int()\n    .min(1)\n    .max(ADMIN_DOCUMENT_LIST_MAX_LIMIT)\n    .default(ADMIN_DOCUMENT_LIST_DEFAULT_LIMIT),\n  cursor: z.string().min(1).optional(),\n  state: DocumentStateSchema.optional(),\n});\nexport type AdminDocumentListQuery = z.infer<typeof AdminDocumentListQuerySchema>;\n\nexport const AdminDocumentListResponseSchema = z.object({\n  documents: z.array(AdminDocumentRecordSchema),\n  /**\n   * Opaque cursor for the next page; `null` on the last page. Optional\n   * because pre-pagination servers omit it — clients treat absence as\n   * \"no continuation available\", same convention as the thumbnail fields.\n   */\n  nextCursor: z.string().nullable().optional(),\n});\nexport type AdminDocumentListResponse = z.infer<typeof AdminDocumentListResponseSchema>;\n\nexport const AdminUploadProxyResponseSchema = z.object({\n  sha256: z.string().regex(sha256Hex),\n});\nexport type AdminUploadProxyResponse = z.infer<typeof AdminUploadProxyResponseSchema>;\n\nexport const AdminErrorPayloadSchema = z.object({\n  error: z.object({\n    code: z.string(),\n    message: z.string(),\n  }),\n});\nexport type AdminErrorPayload = z.infer<typeof AdminErrorPayloadSchema>;\n\n/**\n * The thumbnail route's 404 while the warmed artifact is `pending`,\n * `locked`, or `failed` — the standard error envelope plus the tile\n * state so dashboards can render the right placeholder.\n */\nexport const AdminThumbnailUnavailablePayloadSchema = z.object({\n  error: z.object({\n    code: z.string(),\n    message: z.string(),\n    state: z.string(),\n  }),\n});\nexport type AdminThumbnailUnavailablePayload = z.infer<\n  typeof AdminThumbnailUnavailablePayloadSchema\n>;\n\nexport const AdminTenantParamsSchema = z.object({\n  tenantId: z.string().regex(tenantIdPattern),\n});\nexport type AdminTenantParams = z.infer<typeof AdminTenantParamsSchema>;\n\nexport const AdminTenantDocParamsSchema = z.object({\n  tenantId: z.string().regex(tenantIdPattern),\n  id: z.string().regex(docIdPattern),\n});\nexport type AdminTenantDocParams = z.infer<typeof AdminTenantDocParamsSchema>;\n\nexport const AdminTenantJtiParamsSchema = z.object({\n  tenantId: z.string().regex(tenantIdPattern),\n  jti: z.string().min(1).max(256),\n});\nexport type AdminTenantJtiParams = z.infer<typeof AdminTenantJtiParamsSchema>;\n\nexport const AdminTokenRevokeRequestSchema = z.object({\n  /** Optional human reason, written to the audit row. */\n  reason: z.string().max(1024).optional(),\n  /**\n   * The token's `exp` (unix seconds), used to GC the revocation row\n   * once the token would have expired anyway. Defaults server-side to\n   * now + 30 days.\n   */\n  expiresAtSeconds: z.number().int().positive().optional(),\n});\nexport type AdminTokenRevokeRequest = z.infer<typeof AdminTokenRevokeRequestSchema>;\n\n/**\n * License/reporting/usage passthrough. The inner shapes belong to the\n * licensing runtime and are surfaced as-is; they tighten to full\n * schemas when the licensing contract stabilizes.\n */\nexport const AdminLicenseStatusResponseSchema = z.object({\n  license: z.unknown(),\n  reporting: z.unknown().nullable(),\n  usage: z.unknown().nullable(),\n});\nexport type AdminLicenseStatusResponse = z.infer<typeof AdminLicenseStatusResponseSchema>;\n\nexport const AdminTenantRecordSchema = z.object({\n  id: z.string(),\n  name: z.string(),\n  /** True when the namespace materialized on first use rather than via explicit create. */\n  autoProvisioned: z.boolean(),\n  /**\n   * `suspended` tenants fail closed: every tenant JWT, doc JWT, and\n   * share exchange is refused until resume. The API token is exempt —\n   * the operator must be able to inspect, resume, or delete a\n   * suspended tenant. Optional because older servers omit it.\n   */\n  status: z.enum(['active', 'suspended']).optional(),\n  createdAt: z.number(),\n});\nexport type AdminTenantRecord = z.infer<typeof AdminTenantRecordSchema>;\n\nexport const AdminTenantCreateRequestSchema = z.object({\n  id: z.string().regex(tenantIdPattern),\n  /** Display name; defaults to the id. */\n  name: z.string().min(1).max(256).optional(),\n});\nexport type AdminTenantCreateRequest = z.infer<typeof AdminTenantCreateRequestSchema>;\n\nexport const AdminTenantCreateResponseSchema = z.object({\n  tenant: AdminTenantRecordSchema,\n  /** False when the tenant already existed — create is ensure-style. */\n  created: z.boolean(),\n});\nexport type AdminTenantCreateResponse = z.infer<typeof AdminTenantCreateResponseSchema>;\n\nexport const AdminTenantResponseSchema = z.object({\n  tenant: AdminTenantRecordSchema,\n});\nexport type AdminTenantResponse = z.infer<typeof AdminTenantResponseSchema>;\n\nexport const AdminTenantListQuerySchema = z.object({\n  limit: z.coerce\n    .number()\n    .int()\n    .min(1)\n    .max(ADMIN_DOCUMENT_LIST_MAX_LIMIT)\n    .default(ADMIN_DOCUMENT_LIST_DEFAULT_LIMIT),\n  cursor: z.string().min(1).optional(),\n});\nexport type AdminTenantListQuery = z.infer<typeof AdminTenantListQuerySchema>;\n\nexport const AdminTenantListResponseSchema = z.object({\n  tenants: z.array(AdminTenantRecordSchema),\n  /** Opaque cursor for the next page; `null` on the last page. */\n  nextCursor: z.string().nullable().optional(),\n});\nexport type AdminTenantListResponse = z.infer<typeof AdminTenantListResponseSchema>;\n\n/**\n * Tenant-token scopes used by the admin surface. The wildcard `*`\n * always satisfies a scope check and is deliberately not listed —\n * operations declare the *specific* scope they require.\n *\n * `tokens.issue-doc` and `tokens.revoke` are deliberately separate:\n * issuance leaking is a confidentiality risk (unauthorized access\n * creation), revocation leaking is an availability risk (mass session\n * kill). Different failure directions, different scopes.\n *\n * `shares.manage` covers the whole share-grant lifecycle with one\n * scope: a grant is a standing mint capability, so creating and\n * revoking it are the same trust decision — unlike ephemeral tokens,\n * where issue and revoke fail in different directions.\n */\nexport const adminTenantScopes = [\n  'docs.create',\n  'docs.read',\n  'docs.delete',\n  'tokens.issue-doc',\n  'tokens.revoke',\n  'shares.manage',\n] as const;\nexport type AdminTenantScope = (typeof adminTenantScopes)[number];\n\nexport const AdminTokenIssueDocRequestSchema = z.object({\n  kind: z.literal('doc'),\n  /** Subject of the minted token — the end user's id in your system. */\n  sub: z.string().min(1).max(256),\n  docId: z.string().regex(docIdPattern),\n  layerName: z.string().min(1).max(256).optional(),\n  /**\n   * Doc capability scopes (`doc.open`, `doc.render`, …, plus the\n   * collab grammar). Validated server-side against the engine's scope\n   * vocabulary — an unknown string rejects the whole request.\n   */\n  scope: z.array(z.string().min(1).max(128)).min(1).max(64),\n  userId: z.string().max(256).optional(),\n  displayName: z.string().max(256).optional(),\n  groupId: z.string().max(256).optional(),\n  groups: z.array(z.string().max(256)).max(64).optional(),\n  /**\n   * Origin lock: web origins (scheme + host, optional port; one leading\n   * `*.` wildcard label allowed) the minted token may be presented\n   * from. Enforced on every engine request that carries a browser\n   * `Origin` header — hotlink prevention, not DRM: non-browser callers\n   * are governed by the token itself.\n   */\n  origins: originPatternArray.optional(),\n  /** Token lifetime in seconds. */\n  expiresIn: z\n    .number()\n    .int()\n    .min(60)\n    .max(60 * 60 * 24 * 90),\n});\nexport type AdminTokenIssueDocRequest = z.infer<typeof AdminTokenIssueDocRequestSchema>;\n\nexport const AdminTokenIssueTenantRequestSchema = z.object({\n  kind: z.literal('tenant'),\n  sub: z.string().min(1).max(256),\n  scope: z\n    .array(z.union([z.literal('*'), z.enum(adminTenantScopes)]))\n    .min(1)\n    .max(16),\n  /** Token lifetime in seconds. */\n  expiresIn: z\n    .number()\n    .int()\n    .min(60)\n    .max(60 * 60 * 24 * 90),\n});\nexport type AdminTokenIssueTenantRequest = z.infer<typeof AdminTokenIssueTenantRequestSchema>;\n\nexport const AdminTokenIssueRequestSchema = z.discriminatedUnion('kind', [\n  AdminTokenIssueDocRequestSchema,\n  AdminTokenIssueTenantRequestSchema,\n]);\nexport type AdminTokenIssueRequest = z.infer<typeof AdminTokenIssueRequestSchema>;\n\nexport const AdminTokenIssueResponseSchema = z.object({\n  token: z.string(),\n  jti: z.string(),\n  /** Unix seconds. */\n  expiresAt: z.number(),\n});\nexport type AdminTokenIssueResponse = z.infer<typeof AdminTokenIssueResponseSchema>;\n\n// ---------------------------------------------------------------------------\n// Operation registry\n// ---------------------------------------------------------------------------\n//\n// The registry is the admin surface's contract: one entry per operation\n// carrying method, path template, required tenant scope, and the request/\n// response schemas. The server mounts its routes FROM these entries (so the\n// registry is executed, not merely described), and the OpenAPI document is\n// generated from the same entries in CI. Migration status: `documents.list`\n// is registered; the remaining admin operations move in as they are touched.\n\n/**\n * The credential kinds of the one-rule auth model: the API token\n * (static deployment secret) is valid everywhere; a tenant JWT is valid\n * exactly under its own `/v1/tenants/{tenantId}/` subtree; a doc JWT is\n * valid exactly on the `/v1/docs/{docId}` subtree it names, gated by\n * the capability scopes it carries.\n */\n// ---------------------------------------------------------------------------\n// Share grants\n// ---------------------------------------------------------------------------\n//\n// A share grant is a standing, revocable authorization decision stored\n// with the documents: \"anyone presenting this reference, from these\n// origins, gets exactly these capabilities on this document\". The grant\n// id doubles as the public share token — it is a REFERENCE whose power\n// is evaluated at exchange time, never a bearer credential, which is\n// what lets it live in public HTML while staying editable and\n// revocable. The only credential it ever produces is an ordinary\n// short-lived doc JWT, minted downward at `shares.exchange`.\n\nexport const ShareGrantRecordSchema = z.object({\n  /** Grant id; doubles as the public share token (`shr_…`). */\n  id: z.string(),\n  tenantId: z.string(),\n  docId: z.string(),\n  layerName: z.string(),\n  /** Doc capabilities the exchanged session carries. */\n  scope: z.array(z.string()),\n  /** Origin allowlist; null means any origin. */\n  origins: z.array(z.string()).nullable(),\n  /** True when a passphrase is required at exchange. The passphrase itself is never returned. */\n  passwordProtected: z.boolean(),\n  /** Lifetime of each exchanged session token, in seconds. */\n  sessionTtlSeconds: z.number(),\n  /** Paused grants refuse exchange (404) but keep their configuration. */\n  disabled: z.boolean(),\n  /** Unix epoch ms after which exchange returns 410; null = no expiry. */\n  expiresAt: z.number().nullable(),\n  /** Total successful exchanges — a dashboard convenience, not the usage meter. */\n  exchangeCount: z.number(),\n  lastExchangedAt: z.number().nullable(),\n  createdBy: z.string(),\n  createdAt: z.number(),\n  updatedAt: z.number(),\n});\nexport type ShareGrantRecord = z.infer<typeof ShareGrantRecordSchema>;\n\nexport const ShareGrantCreateRequestSchema = z.object({\n  docId: z.string().regex(docIdPattern),\n  layerName: z.string().min(1).max(256).optional(),\n  /**\n   * Doc capability scopes the exchanged session will carry. Validated\n   * server-side against the engine's scope vocabulary, same as\n   * `tokens.issue`.\n   */\n  scope: z.array(z.string().min(1).max(128)).min(1).max(64),\n  /** Origin allowlist; omit to allow any origin. */\n  origins: originPatternArray.optional(),\n  /** Optional passphrase gate, checked at exchange. Stored as a hash; never returned. */\n  password: z.string().min(1).max(1024).optional(),\n  /** Lifetime of exchanged session tokens. Default 600. */\n  sessionTtlSeconds: z\n    .number()\n    .int()\n    .min(60)\n    .max(60 * 60)\n    .optional(),\n  /** Unix epoch ms after which the grant stops exchanging; omit for no expiry. */\n  expiresAt: z.number().int().positive().optional(),\n});\nexport type ShareGrantCreateRequest = z.infer<typeof ShareGrantCreateRequestSchema>;\n\n/**\n * Partial update. `origins: null` clears the allowlist (any origin),\n * `password: null` removes the passphrase, `expiresAt: null` removes\n * the expiry. Absent fields stay untouched. The exchanged capabilities\n * and origin lock of every embedded snippet follow the row — editing a\n * grant retargets the copies already pasted into pages.\n */\nexport const ShareGrantUpdateRequestSchema = z.object({\n  scope: z.array(z.string().min(1).max(128)).min(1).max(64).optional(),\n  origins: originPatternArray.nullable().optional(),\n  password: z.string().min(1).max(1024).nullable().optional(),\n  sessionTtlSeconds: z\n    .number()\n    .int()\n    .min(60)\n    .max(60 * 60)\n    .optional(),\n  disabled: z.boolean().optional(),\n  expiresAt: z.number().int().positive().nullable().optional(),\n});\nexport type ShareGrantUpdateRequest = z.infer<typeof ShareGrantUpdateRequestSchema>;\n\nexport const ShareGrantResponseSchema = z.object({\n  share: ShareGrantRecordSchema,\n});\nexport type ShareGrantResponse = z.infer<typeof ShareGrantResponseSchema>;\n\nexport const ShareGrantListQuerySchema = z.object({\n  limit: z.coerce\n    .number()\n    .int()\n    .min(1)\n    .max(ADMIN_DOCUMENT_LIST_MAX_LIMIT)\n    .default(ADMIN_DOCUMENT_LIST_DEFAULT_LIMIT),\n  cursor: z.string().min(1).optional(),\n  /** Filter to one document's grants. */\n  docId: z.string().regex(docIdPattern).optional(),\n});\nexport type ShareGrantListQuery = z.infer<typeof ShareGrantListQuerySchema>;\n\nexport const ShareGrantListResponseSchema = z.object({\n  shares: z.array(ShareGrantRecordSchema),\n  /** Opaque cursor for the next page; `null` on the last page. */\n  nextCursor: z.string().nullable().optional(),\n});\nexport type ShareGrantListResponse = z.infer<typeof ShareGrantListResponseSchema>;\n\nexport const AdminTenantShareParamsSchema = z.object({\n  tenantId: z.string().regex(tenantIdPattern),\n  shareId: z.string().regex(shareTokenPattern),\n});\nexport type AdminTenantShareParams = z.infer<typeof AdminTenantShareParamsSchema>;\n\n/**\n * The share token travels in the BODY, never the path — URLs land in\n * access logs and proxy logs, and the token is the whole credential.\n */\nexport const ShareExchangeRequestSchema = z.object({\n  shareToken: z.string().regex(shareTokenPattern),\n  /** Required when the grant is passphrase-protected (422 otherwise). */\n  password: z.string().min(1).max(1024).optional(),\n});\nexport type ShareExchangeRequest = z.infer<typeof ShareExchangeRequestSchema>;\n\nexport const ShareSessionResponseSchema = z.object({\n  /** A doc-scoped session JWT carrying the grant's capabilities and origin lock. */\n  token: z.string(),\n  docId: z.string(),\n  layerName: z.string(),\n  /** Unix seconds when the session token expires; exchange again for a fresh one. */\n  expiresAt: z.number(),\n});\nexport type ShareSessionResponse = z.infer<typeof ShareSessionResponseSchema>;\n\n// ---------------------------------------------------------------------------\n// Tenant usage + suspension\n// ---------------------------------------------------------------------------\n\nexport const TenantUsageQuerySchema = z.object({\n  /** UTC month to report, `YYYY-MM`. Defaults to the current month. */\n  period: z\n    .string()\n    .regex(/^\\d{4}-(0[1-9]|1[0-2])$/)\n    .optional(),\n});\nexport type TenantUsageQuery = z.infer<typeof TenantUsageQuerySchema>;\n\n/**\n * Per-tenant usage FACTS for one UTC month. Deliberately opinion-free:\n * no limits, no plans, no billing state — those belong to whoever\n * operates the deployment. `pdf.views` counts share exchanges plus\n * authorized `/v1/access` grants, deduplicated (a share session that\n * later establishes access is not counted twice).\n */\nexport const TenantUsageResponseSchema = z.object({\n  tenantId: z.string(),\n  periodStart: z.string(),\n  periodEnd: z.string(),\n  metrics: z.object({\n    'pdf.views': z.number(),\n    'pdf.uploads': z.number(),\n    'storage.bytes': z.number(),\n  }),\n});\nexport type TenantUsageResponse = z.infer<typeof TenantUsageResponseSchema>;\n\nexport const TenantSuspendRequestSchema = z.object({\n  /** Optional operator reason, written to the security-events trail. */\n  reason: z.string().max(1024).optional(),\n});\nexport type TenantSuspendRequest = z.infer<typeof TenantSuspendRequestSchema>;\n\nexport const adminCredentials = ['api-token', 'tenant-jwt', 'doc-jwt'] as const;\nexport type AdminCredential = (typeof adminCredentials)[number];\n\nexport type AdminOperationMethod = 'GET' | 'POST' | 'PATCH' | 'DELETE';\n\nexport interface AdminOperationHeader {\n  name: string;\n  description: string;\n  /** Defaults to false. */\n  required?: boolean;\n}\n\nexport interface AdminOperationResponse {\n  /**\n   * MIME type(s) of the response body. An array means the server picks\n   * one per response (e.g. thumbnail webp/png). Absent = empty body\n   * (204-style).\n   */\n  contentType?: string | ReadonlyArray<string>;\n  /** Body schema; absent for empty or binary bodies. */\n  schema?: z.ZodTypeAny;\n}\n\nexport interface AdminOperationBody {\n  /** Accepted request MIME type(s). */\n  contentType: string | ReadonlyArray<string>;\n  /** Body schema; absent for binary bodies. */\n  schema?: z.ZodTypeAny;\n  /** Defaults to true; false when the operation accepts an empty body. */\n  required?: boolean;\n}\n\n/**\n * One admin operation, fully described: everything a server needs to mount\n * it and everything a generator needs to document it.\n */\nexport interface AdminOperation {\n  /** Stable `resource.verb` id; becomes the OpenAPI operationId. */\n  operationId: string;\n  /**\n   * Short display name for documentation surfaces (page titles, nav) —\n   * a noun phrase like \"Create tenant\", not a sentence. Emitted as\n   * `x-docs-title`; the API reference renders it verbatim, so naming\n   * an operation is part of designing it.\n   */\n  title: string;\n  summary: string;\n  method: AdminOperationMethod;\n  /** Fastify-style path template (`:param`); rewritten to `{param}` for OpenAPI. */\n  path: string;\n  /**\n   * Credentials accepted by this operation. The API token is root and\n   * passes every scope check; a tenant JWT additionally requires the\n   * path's `tenantId` to equal the token's `tenant_id`. Doc-scoped\n   * tokens are always rejected on these surfaces.\n   */\n  credentials: ReadonlyArray<AdminCredential>;\n  /**\n   * Tenant scopes accepted on the tenant-jwt path — possessing any one\n   * grants access (`*` always does). Empty for API-token-only\n   * operations, where no scope model applies.\n   */\n  scope: ReadonlyArray<AdminTenantScope>;\n  /**\n   * Doc capabilities required on the doc-jwt path — typed against the\n   * engine-core vocabulary so a misspelled capability fails compile.\n   * The API token bypasses capability checks, same as it passes tenant\n   * scope checks. Present only on doc-plane operations.\n   */\n  docCapabilities?: ReadonlyArray<DocCapability>;\n  /** Documented request headers (beyond Authorization). */\n  requestHeaders?: ReadonlyArray<AdminOperationHeader>;\n  /** Path-parameter schema, keyed by template name. */\n  params?: z.ZodTypeAny;\n  /** Query-string schema. */\n  query?: z.ZodTypeAny;\n  /** Request body. */\n  body?: AdminOperationBody;\n  /** Success and known-error responses by HTTP status code. */\n  responses: Readonly<Record<number, AdminOperationResponse>>;\n  /**\n   * Deployment caveats a generated doc must carry — e.g. an operation\n   * that is only mounted under a server flag.\n   */\n  notes?: string;\n}\n\nexport const adminOperations = {\n  'tenants.create': {\n    operationId: 'tenants.create',\n    title: 'Create tenant',\n    summary: 'Create a tenant, or confirm it already exists — ensure-style, idempotent.',\n    method: 'POST',\n    path: adminWirePaths.tenants,\n    credentials: ['api-token'],\n    scope: [],\n    body: { contentType: 'application/json', schema: AdminTenantCreateRequestSchema },\n    responses: {\n      200: { contentType: 'application/json', schema: AdminTenantCreateResponseSchema },\n      400: { contentType: 'application/json', schema: AdminErrorPayloadSchema },\n    },\n  },\n  'tenants.list': {\n    operationId: 'tenants.list',\n    title: 'List tenants',\n    summary: 'List tenants, newest first, cursor-paginated.',\n    method: 'GET',\n    path: adminWirePaths.tenants,\n    credentials: ['api-token'],\n    scope: [],\n    query: AdminTenantListQuerySchema,\n    responses: {\n      200: { contentType: 'application/json', schema: AdminTenantListResponseSchema },\n      400: { contentType: 'application/json', schema: AdminErrorPayloadSchema },\n    },\n  },\n  'tenants.get': {\n    operationId: 'tenants.get',\n    title: 'Get tenant',\n    summary: 'Fetch one tenant record.',\n    method: 'GET',\n    path: '/v1/tenants/:tenantId',\n    credentials: ['api-token'],\n    scope: [],\n    params: AdminTenantParamsSchema,\n    responses: {\n      200: { contentType: 'application/json', schema: AdminTenantResponseSchema },\n      404: { contentType: 'application/json', schema: AdminErrorPayloadSchema },\n    },\n  },\n  'tenants.delete': {\n    operationId: 'tenants.delete',\n    title: 'Delete tenant',\n    summary: 'Delete a tenant and everything under it.',\n    method: 'DELETE',\n    path: '/v1/tenants/:tenantId',\n    credentials: ['api-token'],\n    scope: [],\n    params: AdminTenantParamsSchema,\n    responses: {\n      204: {},\n      404: { contentType: 'application/json', schema: AdminErrorPayloadSchema },\n    },\n    notes:\n      'Destroys the tenant and everything in its namespace — documents, layers, stored bytes, audit history. Irreversible.',\n  },\n  'documents.init': {\n    operationId: 'documents.init',\n    title: 'Initialize upload',\n    summary:\n      'Begin an upload: create (or resume/dedupe) a pending document and issue upload access.',\n    method: 'POST',\n    path: '/v1/tenants/:tenantId/documents/init',\n    credentials: ['api-token', 'tenant-jwt'],\n    scope: ['docs.create'],\n    params: AdminTenantParamsSchema,\n    body: { contentType: 'application/json', schema: AdminDocumentInitRequestSchema },\n    responses: {\n      200: { contentType: 'application/json', schema: AdminDocumentInitResponseSchema },\n      400: { contentType: 'application/json', schema: AdminErrorPayloadSchema },\n    },\n  },\n  'documents.commit': {\n    operationId: 'documents.commit',\n    title: 'Commit upload',\n    summary: 'Finish an upload: verify the SHA-256 and promote the document to ready.',\n    method: 'POST',\n    path: '/v1/tenants/:tenantId/documents/:id/commit',\n    credentials: ['api-token', 'tenant-jwt'],\n    scope: ['docs.create'],\n    params: AdminTenantDocParamsSchema,\n    body: { contentType: 'application/json', schema: AdminDocumentCommitRequestSchema },\n    responses: {\n      200: { contentType: 'application/json', schema: AdminDocumentCommitResponseSchema },\n      400: { contentType: 'application/json', schema: AdminErrorPayloadSchema },\n      404: { contentType: 'application/json', schema: AdminErrorPayloadSchema },\n    },\n  },\n  'documents.uploadProxy': {\n    operationId: 'documents.uploadProxy',\n    title: 'Upload document through the origin',\n    summary: 'Upload a bounded PDF through the API when the initialized transfer kind is proxy.',\n    method: 'POST',\n    path: '/v1/tenants/:tenantId/documents/:id/upload-proxy',\n    credentials: ['api-token', 'tenant-jwt'],\n    scope: ['docs.create'],\n    params: AdminTenantDocParamsSchema,\n    body: {\n      contentType: 'multipart/form-data',\n    },\n    responses: {\n      200: { contentType: 'application/json', schema: AdminUploadProxyResponseSchema },\n      400: { contentType: 'application/json', schema: AdminErrorPayloadSchema },\n      409: { contentType: 'application/json', schema: AdminErrorPayloadSchema },\n    },\n    notes:\n      'This bounded origin-mediated fallback must only be used after documents.init returns upload.kind=proxy. Auto mode prefers a presigned object-store PUT whenever available.',\n  },\n  'documents.importFrom': {\n    operationId: 'documents.importFrom',\n    title: 'Import document',\n    summary:\n      'Server-side pull: fetch a PDF from a caller-supplied URL (e.g. a presigned object-store GET) or an operator-registered storage connection into CloudPDF-owned storage, verify it, and commit it.',\n    method: 'POST',\n    path: '/v1/tenants/:tenantId/documents/import',\n    credentials: ['api-token', 'tenant-jwt'],\n    scope: ['docs.create'],\n    params: AdminTenantParamsSchema,\n    body: { contentType: 'application/json', schema: AdminDocumentImportRequestSchema },\n    responses: {\n      200: { contentType: 'application/json', schema: AdminDocumentImportResponseSchema },\n      202: { contentType: 'application/json', schema: AdminDocumentImportResponseSchema },\n      400: { contentType: 'application/json', schema: AdminErrorPayloadSchema },\n      403: { contentType: 'application/json', schema: AdminErrorPayloadSchema },\n      502: { contentType: 'application/json', schema: AdminErrorPayloadSchema },\n    },\n    notes:\n      'Default mode is synchronous and bounded: the response returns only after the transfer verified and committed (or failed). mode=async (connection sources only) answers 202 immediately and an in-process worker performs the transfer with leased, fenced retries; poll the document until ready/failed. The deployment import policy gates scheme, network range, and size; sources must declare a length. CloudPDF copies and owns the bytes — the source is never referenced in place. A 502 marks a retryable upstream failure: retry with the same idempotencyKey to resume the same document. URL sources are capabilities and never echoed back. Connection sources name operator-registered storage (bucket/prefix scope, allowed credential classes, and tenant bindings are deployment configuration); `revision` is provider-interpreted (S3 VersionId, GCS generation, Azure version id).',\n  },\n  'documents.list': {\n    operationId: 'documents.list',\n    title: 'List documents',\n    summary: 'List documents in the tenant, newest first, cursor-paginated.',\n    method: 'GET',\n    path: '/v1/tenants/:tenantId/documents',\n    credentials: ['api-token', 'tenant-jwt'],\n    scope: ['docs.read'],\n    params: AdminTenantParamsSchema,\n    query: AdminDocumentListQuerySchema,\n    responses: {\n      200: { contentType: 'application/json', schema: AdminDocumentListResponseSchema },\n      400: { contentType: 'application/json', schema: AdminErrorPayloadSchema },\n    },\n  },\n  'documents.get': {\n    operationId: 'documents.get',\n    title: 'Get document',\n    summary: 'Fetch one document record.',\n    method: 'GET',\n    path: '/v1/tenants/:tenantId/documents/:id',\n    credentials: ['api-token', 'tenant-jwt'],\n    scope: ['docs.read'],\n    params: AdminTenantDocParamsSchema,\n    responses: {\n      200: { contentType: 'application/json', schema: AdminDocumentResponseSchema },\n      403: { contentType: 'application/json', schema: AdminErrorPayloadSchema },\n      404: { contentType: 'application/json', schema: AdminErrorPayloadSchema },\n    },\n  },\n  'documents.download': {\n    operationId: 'documents.download',\n    title: 'Download document',\n    summary: 'Download the stored base PDF bytes.',\n    method: 'GET',\n    path: '/v1/tenants/:tenantId/documents/:id/download',\n    credentials: ['api-token', 'tenant-jwt'],\n    scope: ['docs.read'],\n    params: AdminTenantDocParamsSchema,\n    responses: {\n      200: { contentType: 'application/pdf' },\n      403: { contentType: 'application/json', schema: AdminErrorPayloadSchema },\n      404: { contentType: 'application/json', schema: AdminErrorPayloadSchema },\n    },\n  },\n  'documents.delete': {\n    operationId: 'documents.delete',\n    title: 'Delete document',\n    summary: 'Delete a document and its stored artifacts.',\n    method: 'DELETE',\n    path: '/v1/tenants/:tenantId/documents/:id',\n    credentials: ['api-token', 'tenant-jwt'],\n    scope: ['docs.delete'],\n    params: AdminTenantDocParamsSchema,\n    responses: {\n      204: {},\n      403: { contentType: 'application/json', schema: AdminErrorPayloadSchema },\n      404: { contentType: 'application/json', schema: AdminErrorPayloadSchema },\n    },\n  },\n  'documents.thumbnail': {\n    operationId: 'documents.thumbnail',\n    title: 'Get thumbnail',\n    summary: 'Fetch the warmed dashboard-tile render for a document.',\n    method: 'GET',\n    path: '/v1/tenants/:tenantId/documents/:id/thumbnail',\n    credentials: ['api-token', 'tenant-jwt'],\n    scope: ['docs.read'],\n    params: AdminTenantDocParamsSchema,\n    responses: {\n      200: { contentType: ['image/webp', 'image/png'] },\n      404: { contentType: 'application/json', schema: AdminThumbnailUnavailablePayloadSchema },\n    },\n  },\n  'deployment.licenseStatus': {\n    operationId: 'deployment.licenseStatus',\n    title: 'License status',\n    summary: 'License decision plus usage-reporting and meter snapshots for this deployment.',\n    method: 'GET',\n    path: adminWirePaths.deploymentLicenseStatus,\n    credentials: ['api-token'],\n    scope: [],\n    responses: {\n      200: { contentType: 'application/json', schema: AdminLicenseStatusResponseSchema },\n    },\n  },\n  'tokens.issue': {\n    operationId: 'tokens.issue',\n    title: 'Issue token',\n    summary: 'Mint a delegated JWT: a doc token, or (API token only) a tenant token.',\n    method: 'POST',\n    path: '/v1/tenants/:tenantId/tokens',\n    credentials: ['api-token', 'tenant-jwt'],\n    scope: ['tokens.issue-doc'],\n    params: AdminTenantParamsSchema,\n    body: { contentType: 'application/json', schema: AdminTokenIssueRequestSchema },\n    responses: {\n      200: { contentType: 'application/json', schema: AdminTokenIssueResponseSchema },\n      400: { contentType: 'application/json', schema: AdminErrorPayloadSchema },\n      403: { contentType: 'application/json', schema: AdminErrorPayloadSchema },\n      404: { contentType: 'application/json', schema: AdminErrorPayloadSchema },\n    },\n    notes:\n      'kind \"tenant\" requires the API token — authority mints only downward. Mounted only when the deployment can sign (HS256 mode); asymmetric deployments mint with their own private key.',\n  },\n  'tokens.revoke': {\n    operationId: 'tokens.revoke',\n    title: 'Revoke token',\n    summary: 'Revoke a token by jti; live sessions drop on their next heartbeat.',\n    method: 'POST',\n    path: '/v1/tenants/:tenantId/tokens/:jti/revoke',\n    credentials: ['api-token', 'tenant-jwt'],\n    scope: ['tokens.revoke'],\n    params: AdminTenantJtiParamsSchema,\n    body: {\n      contentType: 'application/json',\n      schema: AdminTokenRevokeRequestSchema,\n      required: false,\n    },\n    responses: {\n      204: {},\n      400: { contentType: 'application/json', schema: AdminErrorPayloadSchema },\n    },\n    notes: 'Mounted only when the deployment enables token revocation.',\n  },\n  'tenants.usage': {\n    operationId: 'tenants.usage',\n    title: 'Tenant usage',\n    summary: 'Per-tenant usage facts (views, uploads, stored bytes) for one UTC month.',\n    method: 'GET',\n    path: '/v1/tenants/:tenantId/usage',\n    credentials: ['api-token', 'tenant-jwt'],\n    scope: ['docs.read'],\n    params: AdminTenantParamsSchema,\n    query: TenantUsageQuerySchema,\n    responses: {\n      200: { contentType: 'application/json', schema: TenantUsageResponseSchema },\n      400: { contentType: 'application/json', schema: AdminErrorPayloadSchema },\n      404: { contentType: 'application/json', schema: AdminErrorPayloadSchema },\n    },\n    notes:\n      'Facts only — no limits or billing state. Views count share exchanges plus authorized ' +\n      '/v1/access grants, deduplicated across the two.',\n  },\n  'tenants.suspend': {\n    operationId: 'tenants.suspend',\n    title: 'Suspend tenant',\n    summary: 'Fail the tenant closed: refuse every tenant JWT, doc JWT, and share exchange.',\n    method: 'POST',\n    path: '/v1/tenants/:tenantId/suspend',\n    credentials: ['api-token'],\n    scope: [],\n    params: AdminTenantParamsSchema,\n    body: {\n      contentType: 'application/json',\n      schema: TenantSuspendRequestSchema,\n      required: false,\n    },\n    responses: {\n      204: {},\n      404: { contentType: 'application/json', schema: AdminErrorPayloadSchema },\n    },\n    notes:\n      'Instantly reversible with resume. The API token is exempt, so a suspended tenant can ' +\n      'still be inspected, exported, resumed, or deleted.',\n  },\n  'tenants.resume': {\n    operationId: 'tenants.resume',\n    title: 'Resume tenant',\n    summary: 'Lift a suspension; credentials for the tenant verify again.',\n    method: 'POST',\n    path: '/v1/tenants/:tenantId/resume',\n    credentials: ['api-token'],\n    scope: [],\n    params: AdminTenantParamsSchema,\n    responses: {\n      204: {},\n      404: { contentType: 'application/json', schema: AdminErrorPayloadSchema },\n    },\n  },\n  'shares.create': {\n    operationId: 'shares.create',\n    title: 'Create share',\n    summary: 'Create a standing share grant for one document — the no-backend embed credential.',\n    method: 'POST',\n    path: '/v1/tenants/:tenantId/shares',\n    credentials: ['api-token', 'tenant-jwt'],\n    scope: ['shares.manage'],\n    params: AdminTenantParamsSchema,\n    body: { contentType: 'application/json', schema: ShareGrantCreateRequestSchema },\n    responses: {\n      200: { contentType: 'application/json', schema: ShareGrantResponseSchema },\n      400: { contentType: 'application/json', schema: AdminErrorPayloadSchema },\n      403: { contentType: 'application/json', schema: AdminErrorPayloadSchema },\n      404: { contentType: 'application/json', schema: AdminErrorPayloadSchema },\n    },\n    notes:\n      'The returned share id IS the public share token. Mounted only when the deployment can ' +\n      'sign (HS256 mode) — exchange mints session JWTs, so grants exist only where minting does.',\n  },\n  'shares.list': {\n    operationId: 'shares.list',\n    title: 'List shares',\n    summary: 'List share grants in the tenant, newest first, cursor-paginated.',\n    method: 'GET',\n    path: '/v1/tenants/:tenantId/shares',\n    credentials: ['api-token', 'tenant-jwt'],\n    scope: ['shares.manage'],\n    params: AdminTenantParamsSchema,\n    query: ShareGrantListQuerySchema,\n    responses: {\n      200: { contentType: 'application/json', schema: ShareGrantListResponseSchema },\n      400: { contentType: 'application/json', schema: AdminErrorPayloadSchema },\n    },\n  },\n  'shares.get': {\n    operationId: 'shares.get',\n    title: 'Get share',\n    summary: 'Fetch one share grant.',\n    method: 'GET',\n    path: '/v1/tenants/:tenantId/shares/:shareId',\n    credentials: ['api-token', 'tenant-jwt'],\n    scope: ['shares.manage'],\n    params: AdminTenantShareParamsSchema,\n    responses: {\n      200: { contentType: 'application/json', schema: ShareGrantResponseSchema },\n      404: { contentType: 'application/json', schema: AdminErrorPayloadSchema },\n    },\n  },\n  'shares.update': {\n    operationId: 'shares.update',\n    title: 'Update share',\n    summary: 'Edit a grant in place — every embedded copy of the token follows the row.',\n    method: 'PATCH',\n    path: '/v1/tenants/:tenantId/shares/:shareId',\n    credentials: ['api-token', 'tenant-jwt'],\n    scope: ['shares.manage'],\n    params: AdminTenantShareParamsSchema,\n    body: { contentType: 'application/json', schema: ShareGrantUpdateRequestSchema },\n    responses: {\n      200: { contentType: 'application/json', schema: ShareGrantResponseSchema },\n      400: { contentType: 'application/json', schema: AdminErrorPayloadSchema },\n      404: { contentType: 'application/json', schema: AdminErrorPayloadSchema },\n    },\n  },\n  'shares.delete': {\n    operationId: 'shares.delete',\n    title: 'Revoke share',\n    summary: 'Delete a grant; exchange stops immediately, live sessions lapse at their exp.',\n    method: 'DELETE',\n    path: '/v1/tenants/:tenantId/shares/:shareId',\n    credentials: ['api-token', 'tenant-jwt'],\n    scope: ['shares.manage'],\n    params: AdminTenantShareParamsSchema,\n    responses: {\n      204: {},\n      404: { contentType: 'application/json', schema: AdminErrorPayloadSchema },\n    },\n  },\n  'shares.exchange': {\n    operationId: 'shares.exchange',\n    title: 'Exchange share token',\n    summary: 'Trade a public share token for a short-lived document session JWT.',\n    method: 'POST',\n    path: adminWirePaths.shareSessions,\n    credentials: [],\n    scope: [],\n    body: { contentType: 'application/json', schema: ShareExchangeRequestSchema },\n    responses: {\n      200: { contentType: 'application/json', schema: ShareSessionResponseSchema },\n      400: { contentType: 'application/json', schema: AdminErrorPayloadSchema },\n      403: { contentType: 'application/json', schema: AdminErrorPayloadSchema },\n      404: { contentType: 'application/json', schema: AdminErrorPayloadSchema },\n      410: { contentType: 'application/json', schema: AdminErrorPayloadSchema },\n      422: { contentType: 'application/json', schema: AdminErrorPayloadSchema },\n    },\n    notes:\n      'Unauthenticated, but requires a browser Origin header, checked against the grant ' +\n      'allowlist. Unknown, revoked, and disabled tokens are indistinguishable (404). ' +\n      'Passphrase-protected grants return 422 SharePasswordRequired until `password` is ' +\n      'supplied. Mounted only when the deployment can sign (HS256 mode).',\n  },\n} as const satisfies Record<string, AdminOperation>;\nexport type AdminOperationId = keyof typeof adminOperations;\n\n// ---------------------------------------------------------------------------\n// Doc-plane operations (the backend-usable document API)\n// ---------------------------------------------------------------------------\n//\n// The \"API vs protocol\" split: these are the document operations a backend\n// can genuinely call — plain origin paths, credentialed by the API token\n// (which the server resolves to the document's own tenant) or a doc JWT\n// carrying the listed capabilities. The viewer-session protocol — /v1/access,\n// /v1/warm, the immutable `@{version}` CDN variants, SSE, weak annotation\n// sessions, password sessions — deliberately stays out of this registry: it\n// is the transport between the CloudPDF viewer SDK and the engine, free to\n// evolve behind the SDK boundary. Body/response schemas start deliberately\n// loose (documented paths, params, credentials, capabilities) and tighten\n// incrementally as the wire shapes are ported from engine-core.\n\nexport const DocIdParamsSchema = z.object({\n  docId: z.string().regex(docIdPattern),\n});\nexport const DocLayerParamsSchema = DocIdParamsSchema.extend({\n  layerName: z.string().min(1),\n});\nexport const DocPageParamsSchema = DocLayerParamsSchema.extend({\n  pon: z.coerce.number().int().min(0),\n});\nexport const DocAnnotationParamsSchema = DocPageParamsSchema.extend({\n  annotKey: z.string().min(1),\n});\nexport const DocFieldParamsSchema = DocLayerParamsSchema.extend({\n  fieldKey: z.string().min(1),\n});\n\n/**\n * Attached to every doc-plane operation: per-request password supply for\n * encrypted documents, API-token callers only. Viewer JWTs never send\n * passwords in headers — they use the SDK's password-session flow.\n */\nexport const documentPasswordHeader: AdminOperationHeader = {\n  name: 'X-Document-Password',\n  required: false,\n  description:\n    'Base64-encoded password for an encrypted document. Valid only with the API token ' +\n    '(403 anywhere else). An encrypted document answers 422 DocPasswordRequired when ' +\n    'the header is absent. Viewer doc JWTs use the SDK password-session flow instead.',\n};\n\nconst looseJson = z.record(z.string(), z.unknown());\nconst docCredentials = ['api-token', 'doc-jwt'] as const;\n\n/**\n * Every doc-plane mutation responds with the shared meta envelope — the\n * cache/version deltas SDKs use to re-point immutable reads — plus\n * operation-specific fields that tighten per-op as they are ported.\n */\nconst MutationResponseSchema = z.object({ meta: MutationMetaSchema }).passthrough();\n\nexport const docOperations = {\n  'doc.head': {\n    operationId: 'doc.head',\n    title: 'Open document',\n    summary: 'Open a document and return its head (versions, page count, security).',\n    method: 'GET',\n    path: wireTemplates.docHead,\n    credentials: docCredentials,\n    scope: [],\n    docCapabilities: ['doc.open'],\n    requestHeaders: [documentPasswordHeader],\n    params: DocIdParamsSchema,\n    responses: {\n      200: { contentType: 'application/json', schema: DocumentHeadSchema },\n      404: { contentType: 'application/json', schema: EngineErrorPayloadSchema },\n    },\n  },\n  'doc.manifest': {\n    operationId: 'doc.manifest',\n    title: 'Get manifest',\n    summary: \"Full layer manifest at the layer's current version.\",\n    method: 'GET',\n    path: wireTemplates.layerManifest,\n    credentials: docCredentials,\n    scope: [],\n    docCapabilities: ['doc.open'],\n    requestHeaders: [documentPasswordHeader],\n    params: DocLayerParamsSchema,\n    responses: {\n      200: { contentType: 'application/json', schema: DocumentManifestSchema },\n      404: { contentType: 'application/json', schema: EngineErrorPayloadSchema },\n    },\n  },\n  'doc.metadata.get': {\n    operationId: 'doc.metadata.get',\n    title: 'Get metadata',\n    summary: 'Document metadata (PDF info dictionary view) for a layer.',\n    method: 'GET',\n    path: wireTemplates.layerMetadata,\n    credentials: docCredentials,\n    scope: [],\n    docCapabilities: ['doc.open'],\n    requestHeaders: [documentPasswordHeader],\n    params: DocLayerParamsSchema,\n    responses: {\n      200: { contentType: 'application/json', schema: DocumentMetadataSchema },\n      404: { contentType: 'application/json', schema: EngineErrorPayloadSchema },\n    },\n  },\n  'doc.render': {\n    operationId: 'doc.render',\n    title: 'Render page',\n    summary: 'Render one page as an image at the current layer version.',\n    method: 'GET',\n    path: wireTemplates.layerRenderPage,\n    credentials: docCredentials,\n    scope: [],\n    docCapabilities: ['doc.render'],\n    requestHeaders: [documentPasswordHeader],\n    params: DocPageParamsSchema,\n    notes:\n      'Render parameters (viewport, format) pass as flat dotted query keys, e.g. ' +\n      '`?viewport.kind=width&viewport.width=800`; the full grammar is documented with the viewer.',\n    responses: {\n      200: { contentType: 'image/webp' },\n      404: { contentType: 'application/json', schema: EngineErrorPayloadSchema },\n    },\n  },\n  'doc.text': {\n    operationId: 'doc.text',\n    title: 'Extract page text',\n    summary: 'Extracted text content for one page.',\n    method: 'GET',\n    path: wireTemplates.layerTextPage,\n    credentials: docCredentials,\n    scope: [],\n    docCapabilities: ['doc.text.copy'],\n    requestHeaders: [documentPasswordHeader],\n    params: DocPageParamsSchema,\n    responses: {\n      200: { contentType: 'application/json', schema: PageTextSnapshotSchema },\n      404: { contentType: 'application/json', schema: EngineErrorPayloadSchema },\n    },\n  },\n  'doc.annotations.list': {\n    operationId: 'doc.annotations.list',\n    title: 'List annotations',\n    summary: \"One page's annotations at the current layer version.\",\n    method: 'GET',\n    path: wireTemplates.layerAnnotationItems,\n    credentials: docCredentials,\n    scope: [],\n    docCapabilities: ['doc.annotate.read'],\n    requestHeaders: [documentPasswordHeader],\n    params: DocPageParamsSchema,\n    responses: {\n      200: { contentType: 'application/json', schema: AnnotationListPageSnapshotSchema },\n      404: { contentType: 'application/json', schema: EngineErrorPayloadSchema },\n    },\n  },\n  'doc.annotations.create': {\n    operationId: 'doc.annotations.create',\n    title: 'Create annotation',\n    summary: 'Create an annotation on a page.',\n    method: 'POST',\n    path: wireTemplates.layerAnnotationItems,\n    credentials: docCredentials,\n    scope: [],\n    docCapabilities: ['doc.annotate.modify'],\n    requestHeaders: [documentPasswordHeader],\n    params: DocPageParamsSchema,\n    body: { contentType: 'application/json', schema: looseJson },\n    notes:\n      'Doc JWTs may instead carry collab scopes (annotations:create:self, …) that refine ' +\n      'per-annotation authorship rules; the API token is exempt from both.',\n    responses: {\n      200: { contentType: 'application/json', schema: MutationResponseSchema },\n      400: { contentType: 'application/json', schema: EngineErrorPayloadSchema },\n      404: { contentType: 'application/json', schema: EngineErrorPayloadSchema },\n    },\n  },\n  'doc.annotations.update': {\n    operationId: 'doc.annotations.update',\n    title: 'Update annotation',\n    summary: 'Update one annotation by key.',\n    method: 'PATCH',\n    path: wireTemplates.layerAnnotationItem,\n    credentials: docCredentials,\n    scope: [],\n    docCapabilities: ['doc.annotate.modify'],\n    requestHeaders: [documentPasswordHeader],\n    params: DocAnnotationParamsSchema,\n    body: { contentType: 'application/json', schema: looseJson },\n    responses: {\n      200: { contentType: 'application/json', schema: MutationResponseSchema },\n      400: { contentType: 'application/json', schema: EngineErrorPayloadSchema },\n      404: { contentType: 'application/json', schema: EngineErrorPayloadSchema },\n    },\n  },\n  'doc.annotations.delete': {\n    operationId: 'doc.annotations.delete',\n    title: 'Delete annotation',\n    summary: 'Delete one annotation by key.',\n    method: 'DELETE',\n    path: wireTemplates.layerAnnotationItem,\n    credentials: docCredentials,\n    scope: [],\n    docCapabilities: ['doc.annotate.modify'],\n    requestHeaders: [documentPasswordHeader],\n    params: DocAnnotationParamsSchema,\n    responses: {\n      200: { contentType: 'application/json', schema: MutationResponseSchema },\n      404: { contentType: 'application/json', schema: EngineErrorPayloadSchema },\n    },\n  },\n  'doc.forms.get': {\n    operationId: 'doc.forms.get',\n    title: 'Get form snapshot',\n    summary: 'Reconciled form snapshot: fields, widgets, values.',\n    method: 'GET',\n    path: wireTemplates.layerForm,\n    credentials: docCredentials,\n    scope: [],\n    docCapabilities: ['doc.forms.read'],\n    requestHeaders: [documentPasswordHeader],\n    params: DocLayerParamsSchema,\n    responses: {\n      200: { contentType: 'application/json', schema: FormSnapshotSchema },\n      404: { contentType: 'application/json', schema: EngineErrorPayloadSchema },\n    },\n  },\n  'doc.forms.setValue': {\n    operationId: 'doc.forms.setValue',\n    title: 'Set form value',\n    summary: \"Set one form field's value.\",\n    method: 'POST',\n    path: wireTemplates.layerFormFieldValue,\n    credentials: docCredentials,\n    scope: [],\n    docCapabilities: ['doc.forms.fill'],\n    requestHeaders: [documentPasswordHeader],\n    params: DocFieldParamsSchema,\n    body: { contentType: 'application/json', schema: looseJson },\n    responses: {\n      200: { contentType: 'application/json', schema: MutationResponseSchema },\n      400: { contentType: 'application/json', schema: EngineErrorPayloadSchema },\n      404: { contentType: 'application/json', schema: EngineErrorPayloadSchema },\n    },\n  },\n  'doc.forms.reset': {\n    operationId: 'doc.forms.reset',\n    title: 'Reset form field',\n    summary: 'Reset one form field to its default value.',\n    method: 'POST',\n    path: wireTemplates.layerFormFieldReset,\n    credentials: docCredentials,\n    scope: [],\n    docCapabilities: ['doc.forms.fill'],\n    requestHeaders: [documentPasswordHeader],\n    params: DocFieldParamsSchema,\n    responses: {\n      200: { contentType: 'application/json', schema: MutationResponseSchema },\n      404: { contentType: 'application/json', schema: EngineErrorPayloadSchema },\n    },\n  },\n  'doc.forms.exportData': {\n    operationId: 'doc.forms.exportData',\n    title: 'Export form data',\n    summary: 'Export form data as FDF or XFDF.',\n    method: 'GET',\n    path: wireTemplates.layerFormData,\n    credentials: docCredentials,\n    scope: [],\n    docCapabilities: ['doc.forms.read'],\n    requestHeaders: [documentPasswordHeader],\n    params: DocLayerParamsSchema,\n    query: z.object({ format: z.enum(['fdf', 'xfdf']).optional() }),\n    responses: {\n      200: { contentType: ['application/vnd.adobe.xfdf', 'application/vnd.fdf'] },\n      404: { contentType: 'application/json', schema: EngineErrorPayloadSchema },\n    },\n  },\n  'doc.forms.importData': {\n    operationId: 'doc.forms.importData',\n    title: 'Import form data',\n    summary: 'Import form data (FDF/XFDF), filling matching fields.',\n    method: 'POST',\n    path: wireTemplates.layerFormData,\n    credentials: docCredentials,\n    scope: [],\n    docCapabilities: ['doc.forms.fill'],\n    requestHeaders: [documentPasswordHeader],\n    params: DocLayerParamsSchema,\n    body: { contentType: 'application/json', schema: looseJson },\n    responses: {\n      200: { contentType: 'application/json', schema: MutationResponseSchema },\n      400: { contentType: 'application/json', schema: EngineErrorPayloadSchema },\n      404: { contentType: 'application/json', schema: EngineErrorPayloadSchema },\n    },\n  },\n  'doc.pages.move': {\n    operationId: 'doc.pages.move',\n    title: 'Move pages',\n    summary: 'Reorder pages.',\n    method: 'POST',\n    path: wireTemplates.layerPagesMove,\n    credentials: docCredentials,\n    scope: [],\n    docCapabilities: ['doc.pages.assemble'],\n    requestHeaders: [documentPasswordHeader],\n    params: DocLayerParamsSchema,\n    body: { contentType: 'application/json', schema: looseJson },\n    responses: {\n      200: { contentType: 'application/json', schema: MutationResponseSchema },\n      400: { contentType: 'application/json', schema: EngineErrorPayloadSchema },\n      404: { contentType: 'application/json', schema: EngineErrorPayloadSchema },\n    },\n  },\n  'doc.pages.rotate': {\n    operationId: 'doc.pages.rotate',\n    title: 'Rotate pages',\n    summary: 'Set absolute rotation on pages.',\n    method: 'POST',\n    path: wireTemplates.layerPagesRotate,\n    credentials: docCredentials,\n    scope: [],\n    docCapabilities: ['doc.pages.assemble'],\n    requestHeaders: [documentPasswordHeader],\n    params: DocLayerParamsSchema,\n    body: { contentType: 'application/json', schema: looseJson },\n    responses: {\n      200: { contentType: 'application/json', schema: MutationResponseSchema },\n      400: { contentType: 'application/json', schema: EngineErrorPayloadSchema },\n      404: { contentType: 'application/json', schema: EngineErrorPayloadSchema },\n    },\n  },\n  'doc.pages.delete': {\n    operationId: 'doc.pages.delete',\n    title: 'Delete pages',\n    summary: 'Delete pages.',\n    method: 'POST',\n    path: wireTemplates.layerPagesDelete,\n    credentials: docCredentials,\n    scope: [],\n    docCapabilities: ['doc.pages.assemble'],\n    requestHeaders: [documentPasswordHeader],\n    params: DocLayerParamsSchema,\n    body: { contentType: 'application/json', schema: looseJson },\n    responses: {\n      200: { contentType: 'application/json', schema: MutationResponseSchema },\n      400: { contentType: 'application/json', schema: EngineErrorPayloadSchema },\n      404: { contentType: 'application/json', schema: EngineErrorPayloadSchema },\n    },\n  },\n  'doc.pages.flatten': {\n    operationId: 'doc.pages.flatten',\n    title: 'Flatten pages',\n    summary: 'Flatten annotations and form fields into page content.',\n    method: 'POST',\n    path: wireTemplates.layerPagesFlatten,\n    credentials: docCredentials,\n    scope: [],\n    docCapabilities: ['doc.pages.modify', 'doc.annotate.modify'],\n    requestHeaders: [documentPasswordHeader],\n    params: DocLayerParamsSchema,\n    body: { contentType: 'application/json', schema: looseJson, required: false },\n    responses: {\n      200: { contentType: 'application/json', schema: MutationResponseSchema },\n      400: { contentType: 'application/json', schema: EngineErrorPayloadSchema },\n      404: { contentType: 'application/json', schema: EngineErrorPayloadSchema },\n    },\n  },\n  'doc.redactions.apply': {\n    operationId: 'doc.redactions.apply',\n    title: 'Apply redactions',\n    summary: 'Apply pending redactions, permanently removing content.',\n    method: 'POST',\n    path: wireTemplates.layerRedactionsApply,\n    credentials: docCredentials,\n    scope: [],\n    docCapabilities: ['doc.pages.modify', 'doc.annotate.modify', 'doc.redact'],\n    requestHeaders: [documentPasswordHeader],\n    params: DocLayerParamsSchema,\n    body: { contentType: 'application/json', schema: looseJson, required: false },\n    responses: {\n      200: { contentType: 'application/json', schema: MutationResponseSchema },\n      400: { contentType: 'application/json', schema: EngineErrorPayloadSchema },\n      404: { contentType: 'application/json', schema: EngineErrorPayloadSchema },\n    },\n  },\n  'doc.download': {\n    operationId: 'doc.download',\n    title: 'Download PDF',\n    summary: \"Download the layer's current PDF (base plus layer edits).\",\n    method: 'GET',\n    path: wireTemplates.layerDownload,\n    credentials: docCredentials,\n    scope: [],\n    docCapabilities: ['doc.download'],\n    requestHeaders: [documentPasswordHeader],\n    params: DocLayerParamsSchema,\n    responses: {\n      200: { contentType: 'application/pdf' },\n      404: { contentType: 'application/json', schema: EngineErrorPayloadSchema },\n    },\n  },\n} as const satisfies Record<string, AdminOperation>;\nexport type DocOperationId = keyof typeof docOperations;\n\n/** Every operation in the published contract: admin surfaces + doc plane. */\nexport const allOperations = { ...adminOperations, ...docOperations } as const;\n\n/**\n * Documentation groups, keyed by the dot-joined `x-fern-sdk-group-name`\n * path of the operations they contain. Emitted as `x-docs-groups`; the\n * API reference derives its navigation sections from this manifest, so\n * key order here is section order there. `slug` overrides the URL\n * segment when the registry's short group name isn't the public one.\n * The emitter fails if an operation's group path is missing here.\n */\nexport interface DocsGroup {\n  title: string;\n  slug?: string;\n}\n\nexport const docsGroups = {\n  deployment: { title: 'Deployment' },\n  tenants: { title: 'Tenants' },\n  documents: { title: 'Tenant documents' },\n  tokens: { title: 'Tokens' },\n  shares: { title: 'Shares' },\n  doc: { title: 'Document operations', slug: 'document-operations' },\n  'doc.annotations': { title: 'Annotations' },\n  'doc.forms': { title: 'Forms' },\n  'doc.metadata': { title: 'Metadata' },\n  'doc.pages': { title: 'Pages' },\n  'doc.redactions': { title: 'Redactions' },\n} as const satisfies Record<string, DocsGroup>;\n"],"mappings":";AACA;AAAA,EACE;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,OACK;AACP,SAAS,SAAS;AAElB,IAAM,YAAY;AAClB,IAAM,eAAe;AAMd,IAAM,kBAAkB;AAO/B,IAAM,gBACJ;AACF,IAAM,qBAAqB,EACxB;AAAA,EACC,EACG,OAAO,EACP,IAAI,GAAG,EACP;AAAA,IACC;AAAA,IACA;AAAA,EACF;AACJ,EACC,IAAI,CAAC,EACL,IAAI,EAAE;AAET,IAAM,oBAAoB;AAQnB,IAAM,iBAAiB;AAAA,EAC5B,SAAS;AAAA,EACT,QAAQ,CAAC,aAAqB,eAAe,mBAAmB,QAAQ,CAAC;AAAA,EACzE,WAAW,CAAC,aAAqB,eAAe,mBAAmB,QAAQ,CAAC;AAAA,EAC5E,eAAe,CAAC,aAAqB,eAAe,mBAAmB,QAAQ,CAAC;AAAA,EAChF,iBAAiB,CAAC,aAChB,eAAe,mBAAmB,QAAQ,CAAC;AAAA,EAC7C,UAAU,CAAC,UAAkB,UAC3B,eAAe,mBAAmB,QAAQ,CAAC,cAAc,mBAAmB,KAAK,CAAC;AAAA,EACpF,gBAAgB,CAAC,UAAkB,UACjC,eAAe,mBAAmB,QAAQ,CAAC,cAAc,mBAAmB,KAAK,CAAC;AAAA,EACpF,qBAAqB,CAAC,UAAkB,UACtC,eAAe,mBAAmB,QAAQ,CAAC,cAAc,mBAAmB,KAAK,CAAC;AAAA,EACpF,kBAAkB,CAAC,UAAkB,UACnC,eAAe,mBAAmB,QAAQ,CAAC,cAAc,mBAAmB,KAAK,CAAC;AAAA;AAAA,EAEpF,mBAAmB,CAAC,UAAkB,UACpC,eAAe,mBAAmB,QAAQ,CAAC,cAAc,mBAAmB,KAAK,CAAC;AAAA,EACpF,YAAY,CAAC,aAAqB,eAAe,mBAAmB,QAAQ,CAAC;AAAA,EAC7E,aAAa,CAAC,UAAkB,QAC9B,eAAe,mBAAmB,QAAQ,CAAC,WAAW,mBAAmB,GAAG,CAAC;AAAA,EAC/E,QAAQ,CAAC,aAAqB,eAAe,mBAAmB,QAAQ,CAAC;AAAA,EACzE,OAAO,CAAC,UAAkB,YACxB,eAAe,mBAAmB,QAAQ,CAAC,WAAW,mBAAmB,OAAO,CAAC;AAAA,EACnF,aAAa,CAAC,aAAqB,eAAe,mBAAmB,QAAQ,CAAC;AAAA,EAC9E,eAAe,CAAC,aAAqB,eAAe,mBAAmB,QAAQ,CAAC;AAAA,EAChF,cAAc,CAAC,aAAqB,eAAe,mBAAmB,QAAQ,CAAC;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAM/E,eAAe;AAAA;AAAA,EAEf,yBAAyB;AAC3B;AAEO,IAAM,kBAAkB,EAC5B,KAAK,CAAC,iBAAiB,gBAAgB,CAAC,EACxC;AAAA,EACC;AACF;AAGK,IAAM,yBAAyB,EAAE,KAAK,CAAC,QAAQ,aAAa,OAAO,CAAC;AAGpE,IAAM,sBAAsB,EAAE,KAAK,CAAC,WAAW,SAAS,UAAU,UAAU,CAAC;AAG7E,IAAM,4BAA4B,EAAE,OAAO;AAAA,EAChD,IAAI,EAAE,OAAO;AAAA,EACb,UAAU,EAAE,OAAO;AAAA,EACnB,OAAO;AAAA,EACP,SAAS,EAAE,OAAO,EAAE,SAAS;AAAA,EAC7B,kBAAkB,EAAE,OAAO,EAAE,SAAS;AAAA,EACtC,UAAU,EAAE,OAAO,EAAE,OAAO,GAAG,EAAE,QAAQ,CAAC,EAAE,SAAS;AAAA,EACrD,gBAAgB,EAAE,OAAO,EAAE,SAAS;AAAA,EACpC,eAAe,EAAE,OAAO,EAAE,SAAS;AAAA;AAAA,EAEnC,gBAAgB,EAAE,KAAK,CAAC,WAAW,SAAS,UAAU,QAAQ,CAAC,EAAE,SAAS;AAAA,EAC1E,cAAc,EAAE,OAAO,EAAE,SAAS,EAAE,SAAS;AAAA,EAC7C,WAAW,EAAE,OAAO;AAAA,EACpB,WAAW,EAAE,OAAO;AAAA,EACpB,WAAW,EAAE,OAAO,EAAE,SAAS;AACjC,CAAC;AAGM,IAAM,iCAAiC,EAAE,OAAO;AAAA,EACrD,eAAe,EAAE,OAAO,EAAE,OAAO,EAAE,IAAI,CAAC;AAAA,EACxC,eAAe,EAAE,OAAO,EAAE,MAAM,SAAS;AAAA,EACzC,UAAU,EAAE,OAAO,EAAE,OAAO,GAAG,EAAE,QAAQ,CAAC,EAAE,SAAS;AAAA,EACrD,gBAAgB,EAAE,OAAO,EAAE,SAAS;AAAA,EACpC,WAAW,gBAAgB,SAAS;AAAA,EACpC,OAAO,EAAE,OAAO,EAAE,MAAM,YAAY,EAAE,SAAS;AAAA,EAC/C,cAAc,EAAE,OAAO,EAAE,OAAO,EAAE,IAAI,EAAE,EAAE,IAAI,IAAI,EAAE,SAAS;AAAA,EAC7D,kBAAkB,uBAAuB,SAAS;AACpD,CAAC;AAGM,IAAM,6BAA6B,EAAE,OAAO;AAAA,EACjD,KAAK,EAAE,OAAO;AAAA,EACd,SAAS,EAAE,OAAO,EAAE,OAAO,GAAG,EAAE,OAAO,CAAC;AAAA,EACxC,QAAQ,EAAE,QAAQ,KAAK;AAAA,EACvB,WAAW,EAAE,OAAO;AACtB,CAAC;AAGM,IAAM,wBAAwB,EAAE,mBAAmB,QAAQ;AAAA,EAChE,EAAE,OAAO;AAAA,IACP,MAAM,EAAE,QAAQ,WAAW;AAAA,IAC3B,WAAW;AAAA,IACX,KAAK,EAAE,OAAO;AAAA,EAChB,CAAC;AAAA,EACD,EAAE,OAAO;AAAA,IACP,MAAM,EAAE,QAAQ,OAAO;AAAA,IACvB,KAAK,EAAE,OAAO;AAAA,IACd,KAAK,EAAE,OAAO;AAAA,EAChB,CAAC;AACH,CAAC;AAGM,IAAM,kCAAkC,EAAE,mBAAmB,OAAO;AAAA,EACzE,EAAE,OAAO;AAAA,IACP,KAAK,EAAE,QAAQ,SAAS;AAAA,IACxB,UAAU;AAAA,IACV,QAAQ;AAAA,EACV,CAAC;AAAA,EACD,EAAE,OAAO;AAAA,IACP,KAAK,EAAE,QAAQ,SAAS;AAAA,IACxB,UAAU;AAAA,IACV,QAAQ;AAAA,EACV,CAAC;AAAA,EACD,EAAE,OAAO;AAAA,IACP,KAAK,EAAE,QAAQ,SAAS;AAAA,IACxB,UAAU;AAAA,EACZ,CAAC;AACH,CAAC;AAGM,IAAM,mCAAmC,EAAE,OAAO;AAAA,EACvD,QAAQ,EAAE,OAAO,EAAE,MAAM,SAAS;AACpC,CAAC;AAGM,IAAM,oCAAoC,EAAE,OAAO;AAAA,EACxD,UAAU;AACZ,CAAC;AAID,IAAM,iBAAiB,CAAC,MAAsB,IAAI,YAAY,EAAE,OAAO,CAAC,EAAE;AAsBnE,IAAM,0BAA0B,EACpC,mBAAmB,QAAQ;AAAA,EAC1B,EACG,OAAO;AAAA,IACN,MAAM,EAAE,QAAQ,KAAK;AAAA,IACrB,KAAK,EACF,OAAO,EACP,IAAI,EACJ,IAAI,IAAI,EACR;AAAA,MACC;AAAA,IACF;AAAA,EACJ,CAAC,EACA;AAAA,IACC;AAAA,EACF;AAAA,EACF,EACG,OAAO;AAAA,IACN,MAAM,EAAE,QAAQ,YAAY;AAAA,IAC5B,cAAc,EACX,OAAO,EACP,IAAI,CAAC,EACL,IAAI,GAAG,EACP,SAAS,0DAA0D;AAAA,IACtE,KAAK,EACF,OAAO,EACP,IAAI,CAAC,EACL,OAAO,CAAC,MAAM,CAAC,EAAE,SAAS,IAAI,GAAG,0BAA0B,EAC3D,OAAO,CAAC,MAAM,eAAe,CAAC,KAAK,MAAM,sCAAsC,EAC/E;AAAA,MACC;AAAA,IACF;AAAA,IACF,UAAU,EACP,OAAO,EACP,IAAI,CAAC,EACL,IAAI,IAAI,EACR,SAAS,EACT;AAAA,MACC;AAAA,IACF;AAAA,EACJ,CAAC,EACA;AAAA,IACC;AAAA,EACF;AACJ,CAAC,EACA;AAAA,EACC;AACF;AAGK,IAAM,mCAAmC,EAAE,OAAO;AAAA,EACvD,QAAQ;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EASR,UAAU,EACP,OAAO;AAAA,IACN,WAAW,EACR,OAAO,EACP,IAAI,EACJ,IAAI,CAAC,EACL,SAAS,EACT,SAAS,2EAA2E;AAAA,IACvF,QAAQ,EACL,OAAO,EACP,MAAM,SAAS,EACf,SAAS,EACT;AAAA,MACC;AAAA,IACF;AAAA,EACJ,CAAC,EACA,SAAS,EACT;AAAA,IACC;AAAA,EACF;AAAA,EACF,UAAU,EAAE,OAAO,EAAE,OAAO,GAAG,EAAE,QAAQ,CAAC,EAAE,SAAS;AAAA,EACrD,gBAAgB,EACb,OAAO,EACP,SAAS,EACT;AAAA,IACC;AAAA,EACF;AAAA,EACF,WAAW,gBAAgB,SAAS;AAAA,EACpC,OAAO,EAAE,OAAO,EAAE,MAAM,YAAY,EAAE,SAAS;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAU/C,MAAM,EACH,KAAK,CAAC,QAAQ,OAAO,CAAC,EACtB,SAAS,EACT;AAAA,IACC;AAAA,EACF;AACJ,CAAC;AAGM,IAAM,oCAAoC,EAAE,OAAO;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAQxD,KAAK,EAAE,KAAK,CAAC,YAAY,WAAW,UAAU,CAAC;AAAA,EAC/C,UAAU;AACZ,CAAC;AAGM,IAAM,8BAA8B,EAAE,OAAO;AAAA,EAClD,UAAU;AACZ,CAAC;AAGM,IAAM,oCAAoC;AAC1C,IAAM,gCAAgC;AAQtC,IAAM,+BAA+B,EAAE,OAAO;AAAA,EACnD,OAAO,EAAE,OACN,OAAO,EACP,IAAI,EACJ,IAAI,CAAC,EACL,IAAI,6BAA6B,EACjC,QAAQ,iCAAiC;AAAA,EAC5C,QAAQ,EAAE,OAAO,EAAE,IAAI,CAAC,EAAE,SAAS;AAAA,EACnC,OAAO,oBAAoB,SAAS;AACtC,CAAC;AAGM,IAAM,kCAAkC,EAAE,OAAO;AAAA,EACtD,WAAW,EAAE,MAAM,yBAAyB;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAM5C,YAAY,EAAE,OAAO,EAAE,SAAS,EAAE,SAAS;AAC7C,CAAC;AAGM,IAAM,iCAAiC,EAAE,OAAO;AAAA,EACrD,QAAQ,EAAE,OAAO,EAAE,MAAM,SAAS;AACpC,CAAC;AAGM,IAAM,0BAA0B,EAAE,OAAO;AAAA,EAC9C,OAAO,EAAE,OAAO;AAAA,IACd,MAAM,EAAE,OAAO;AAAA,IACf,SAAS,EAAE,OAAO;AAAA,EACpB,CAAC;AACH,CAAC;AAQM,IAAM,yCAAyC,EAAE,OAAO;AAAA,EAC7D,OAAO,EAAE,OAAO;AAAA,IACd,MAAM,EAAE,OAAO;AAAA,IACf,SAAS,EAAE,OAAO;AAAA,IAClB,OAAO,EAAE,OAAO;AAAA,EAClB,CAAC;AACH,CAAC;AAKM,IAAM,0BAA0B,EAAE,OAAO;AAAA,EAC9C,UAAU,EAAE,OAAO,EAAE,MAAM,eAAe;AAC5C,CAAC;AAGM,IAAM,6BAA6B,EAAE,OAAO;AAAA,EACjD,UAAU,EAAE,OAAO,EAAE,MAAM,eAAe;AAAA,EAC1C,IAAI,EAAE,OAAO,EAAE,MAAM,YAAY;AACnC,CAAC;AAGM,IAAM,6BAA6B,EAAE,OAAO;AAAA,EACjD,UAAU,EAAE,OAAO,EAAE,MAAM,eAAe;AAAA,EAC1C,KAAK,EAAE,OAAO,EAAE,IAAI,CAAC,EAAE,IAAI,GAAG;AAChC,CAAC;AAGM,IAAM,gCAAgC,EAAE,OAAO;AAAA;AAAA,EAEpD,QAAQ,EAAE,OAAO,EAAE,IAAI,IAAI,EAAE,SAAS;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAMtC,kBAAkB,EAAE,OAAO,EAAE,IAAI,EAAE,SAAS,EAAE,SAAS;AACzD,CAAC;AAQM,IAAM,mCAAmC,EAAE,OAAO;AAAA,EACvD,SAAS,EAAE,QAAQ;AAAA,EACnB,WAAW,EAAE,QAAQ,EAAE,SAAS;AAAA,EAChC,OAAO,EAAE,QAAQ,EAAE,SAAS;AAC9B,CAAC;AAGM,IAAM,0BAA0B,EAAE,OAAO;AAAA,EAC9C,IAAI,EAAE,OAAO;AAAA,EACb,MAAM,EAAE,OAAO;AAAA;AAAA,EAEf,iBAAiB,EAAE,QAAQ;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAO3B,QAAQ,EAAE,KAAK,CAAC,UAAU,WAAW,CAAC,EAAE,SAAS;AAAA,EACjD,WAAW,EAAE,OAAO;AACtB,CAAC;AAGM,IAAM,iCAAiC,EAAE,OAAO;AAAA,EACrD,IAAI,EAAE,OAAO,EAAE,MAAM,eAAe;AAAA;AAAA,EAEpC,MAAM,EAAE,OAAO,EAAE,IAAI,CAAC,EAAE,IAAI,GAAG,EAAE,SAAS;AAC5C,CAAC;AAGM,IAAM,kCAAkC,EAAE,OAAO;AAAA,EACtD,QAAQ;AAAA;AAAA,EAER,SAAS,EAAE,QAAQ;AACrB,CAAC;AAGM,IAAM,4BAA4B,EAAE,OAAO;AAAA,EAChD,QAAQ;AACV,CAAC;AAGM,IAAM,6BAA6B,EAAE,OAAO;AAAA,EACjD,OAAO,EAAE,OACN,OAAO,EACP,IAAI,EACJ,IAAI,CAAC,EACL,IAAI,6BAA6B,EACjC,QAAQ,iCAAiC;AAAA,EAC5C,QAAQ,EAAE,OAAO,EAAE,IAAI,CAAC,EAAE,SAAS;AACrC,CAAC;AAGM,IAAM,gCAAgC,EAAE,OAAO;AAAA,EACpD,SAAS,EAAE,MAAM,uBAAuB;AAAA;AAAA,EAExC,YAAY,EAAE,OAAO,EAAE,SAAS,EAAE,SAAS;AAC7C,CAAC;AAkBM,IAAM,oBAAoB;AAAA,EAC/B;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AACF;AAGO,IAAM,kCAAkC,EAAE,OAAO;AAAA,EACtD,MAAM,EAAE,QAAQ,KAAK;AAAA;AAAA,EAErB,KAAK,EAAE,OAAO,EAAE,IAAI,CAAC,EAAE,IAAI,GAAG;AAAA,EAC9B,OAAO,EAAE,OAAO,EAAE,MAAM,YAAY;AAAA,EACpC,WAAW,EAAE,OAAO,EAAE,IAAI,CAAC,EAAE,IAAI,GAAG,EAAE,SAAS;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAM/C,OAAO,EAAE,MAAM,EAAE,OAAO,EAAE,IAAI,CAAC,EAAE,IAAI,GAAG,CAAC,EAAE,IAAI,CAAC,EAAE,IAAI,EAAE;AAAA,EACxD,QAAQ,EAAE,OAAO,EAAE,IAAI,GAAG,EAAE,SAAS;AAAA,EACrC,aAAa,EAAE,OAAO,EAAE,IAAI,GAAG,EAAE,SAAS;AAAA,EAC1C,SAAS,EAAE,OAAO,EAAE,IAAI,GAAG,EAAE,SAAS;AAAA,EACtC,QAAQ,EAAE,MAAM,EAAE,OAAO,EAAE,IAAI,GAAG,CAAC,EAAE,IAAI,EAAE,EAAE,SAAS;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAQtD,SAAS,mBAAmB,SAAS;AAAA;AAAA,EAErC,WAAW,EACR,OAAO,EACP,IAAI,EACJ,IAAI,EAAE,EACN,IAAI,KAAK,KAAK,KAAK,EAAE;AAC1B,CAAC;AAGM,IAAM,qCAAqC,EAAE,OAAO;AAAA,EACzD,MAAM,EAAE,QAAQ,QAAQ;AAAA,EACxB,KAAK,EAAE,OAAO,EAAE,IAAI,CAAC,EAAE,IAAI,GAAG;AAAA,EAC9B,OAAO,EACJ,MAAM,EAAE,MAAM,CAAC,EAAE,QAAQ,GAAG,GAAG,EAAE,KAAK,iBAAiB,CAAC,CAAC,CAAC,EAC1D,IAAI,CAAC,EACL,IAAI,EAAE;AAAA;AAAA,EAET,WAAW,EACR,OAAO,EACP,IAAI,EACJ,IAAI,EAAE,EACN,IAAI,KAAK,KAAK,KAAK,EAAE;AAC1B,CAAC;AAGM,IAAM,+BAA+B,EAAE,mBAAmB,QAAQ;AAAA,EACvE;AAAA,EACA;AACF,CAAC;AAGM,IAAM,gCAAgC,EAAE,OAAO;AAAA,EACpD,OAAO,EAAE,OAAO;AAAA,EAChB,KAAK,EAAE,OAAO;AAAA;AAAA,EAEd,WAAW,EAAE,OAAO;AACtB,CAAC;AAkCM,IAAM,yBAAyB,EAAE,OAAO;AAAA;AAAA,EAE7C,IAAI,EAAE,OAAO;AAAA,EACb,UAAU,EAAE,OAAO;AAAA,EACnB,OAAO,EAAE,OAAO;AAAA,EAChB,WAAW,EAAE,OAAO;AAAA;AAAA,EAEpB,OAAO,EAAE,MAAM,EAAE,OAAO,CAAC;AAAA;AAAA,EAEzB,SAAS,EAAE,MAAM,EAAE,OAAO,CAAC,EAAE,SAAS;AAAA;AAAA,EAEtC,mBAAmB,EAAE,QAAQ;AAAA;AAAA,EAE7B,mBAAmB,EAAE,OAAO;AAAA;AAAA,EAE5B,UAAU,EAAE,QAAQ;AAAA;AAAA,EAEpB,WAAW,EAAE,OAAO,EAAE,SAAS;AAAA;AAAA,EAE/B,eAAe,EAAE,OAAO;AAAA,EACxB,iBAAiB,EAAE,OAAO,EAAE,SAAS;AAAA,EACrC,WAAW,EAAE,OAAO;AAAA,EACpB,WAAW,EAAE,OAAO;AAAA,EACpB,WAAW,EAAE,OAAO;AACtB,CAAC;AAGM,IAAM,gCAAgC,EAAE,OAAO;AAAA,EACpD,OAAO,EAAE,OAAO,EAAE,MAAM,YAAY;AAAA,EACpC,WAAW,EAAE,OAAO,EAAE,IAAI,CAAC,EAAE,IAAI,GAAG,EAAE,SAAS;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAM/C,OAAO,EAAE,MAAM,EAAE,OAAO,EAAE,IAAI,CAAC,EAAE,IAAI,GAAG,CAAC,EAAE,IAAI,CAAC,EAAE,IAAI,EAAE;AAAA;AAAA,EAExD,SAAS,mBAAmB,SAAS;AAAA;AAAA,EAErC,UAAU,EAAE,OAAO,EAAE,IAAI,CAAC,EAAE,IAAI,IAAI,EAAE,SAAS;AAAA;AAAA,EAE/C,mBAAmB,EAChB,OAAO,EACP,IAAI,EACJ,IAAI,EAAE,EACN,IAAI,KAAK,EAAE,EACX,SAAS;AAAA;AAAA,EAEZ,WAAW,EAAE,OAAO,EAAE,IAAI,EAAE,SAAS,EAAE,SAAS;AAClD,CAAC;AAUM,IAAM,gCAAgC,EAAE,OAAO;AAAA,EACpD,OAAO,EAAE,MAAM,EAAE,OAAO,EAAE,IAAI,CAAC,EAAE,IAAI,GAAG,CAAC,EAAE,IAAI,CAAC,EAAE,IAAI,EAAE,EAAE,SAAS;AAAA,EACnE,SAAS,mBAAmB,SAAS,EAAE,SAAS;AAAA,EAChD,UAAU,EAAE,OAAO,EAAE,IAAI,CAAC,EAAE,IAAI,IAAI,EAAE,SAAS,EAAE,SAAS;AAAA,EAC1D,mBAAmB,EAChB,OAAO,EACP,IAAI,EACJ,IAAI,EAAE,EACN,IAAI,KAAK,EAAE,EACX,SAAS;AAAA,EACZ,UAAU,EAAE,QAAQ,EAAE,SAAS;AAAA,EAC/B,WAAW,EAAE,OAAO,EAAE,IAAI,EAAE,SAAS,EAAE,SAAS,EAAE,SAAS;AAC7D,CAAC;AAGM,IAAM,2BAA2B,EAAE,OAAO;AAAA,EAC/C,OAAO;AACT,CAAC;AAGM,IAAM,4BAA4B,EAAE,OAAO;AAAA,EAChD,OAAO,EAAE,OACN,OAAO,EACP,IAAI,EACJ,IAAI,CAAC,EACL,IAAI,6BAA6B,EACjC,QAAQ,iCAAiC;AAAA,EAC5C,QAAQ,EAAE,OAAO,EAAE,IAAI,CAAC,EAAE,SAAS;AAAA;AAAA,EAEnC,OAAO,EAAE,OAAO,EAAE,MAAM,YAAY,EAAE,SAAS;AACjD,CAAC;AAGM,IAAM,+BAA+B,EAAE,OAAO;AAAA,EACnD,QAAQ,EAAE,MAAM,sBAAsB;AAAA;AAAA,EAEtC,YAAY,EAAE,OAAO,EAAE,SAAS,EAAE,SAAS;AAC7C,CAAC;AAGM,IAAM,+BAA+B,EAAE,OAAO;AAAA,EACnD,UAAU,EAAE,OAAO,EAAE,MAAM,eAAe;AAAA,EAC1C,SAAS,EAAE,OAAO,EAAE,MAAM,iBAAiB;AAC7C,CAAC;AAOM,IAAM,6BAA6B,EAAE,OAAO;AAAA,EACjD,YAAY,EAAE,OAAO,EAAE,MAAM,iBAAiB;AAAA;AAAA,EAE9C,UAAU,EAAE,OAAO,EAAE,IAAI,CAAC,EAAE,IAAI,IAAI,EAAE,SAAS;AACjD,CAAC;AAGM,IAAM,6BAA6B,EAAE,OAAO;AAAA;AAAA,EAEjD,OAAO,EAAE,OAAO;AAAA,EAChB,OAAO,EAAE,OAAO;AAAA,EAChB,WAAW,EAAE,OAAO;AAAA;AAAA,EAEpB,WAAW,EAAE,OAAO;AACtB,CAAC;AAOM,IAAM,yBAAyB,EAAE,OAAO;AAAA;AAAA,EAE7C,QAAQ,EACL,OAAO,EACP,MAAM,yBAAyB,EAC/B,SAAS;AACd,CAAC;AAUM,IAAM,4BAA4B,EAAE,OAAO;AAAA,EAChD,UAAU,EAAE,OAAO;AAAA,EACnB,aAAa,EAAE,OAAO;AAAA,EACtB,WAAW,EAAE,OAAO;AAAA,EACpB,SAAS,EAAE,OAAO;AAAA,IAChB,aAAa,EAAE,OAAO;AAAA,IACtB,eAAe,EAAE,OAAO;AAAA,IACxB,iBAAiB,EAAE,OAAO;AAAA,EAC5B,CAAC;AACH,CAAC;AAGM,IAAM,6BAA6B,EAAE,OAAO;AAAA;AAAA,EAEjD,QAAQ,EAAE,OAAO,EAAE,IAAI,IAAI,EAAE,SAAS;AACxC,CAAC;AAGM,IAAM,mBAAmB,CAAC,aAAa,cAAc,SAAS;AAuF9D,IAAM,kBAAkB;AAAA,EAC7B,kBAAkB;AAAA,IAChB,aAAa;AAAA,IACb,OAAO;AAAA,IACP,SAAS;AAAA,IACT,QAAQ;AAAA,IACR,MAAM,eAAe;AAAA,IACrB,aAAa,CAAC,WAAW;AAAA,IACzB,OAAO,CAAC;AAAA,IACR,MAAM,EAAE,aAAa,oBAAoB,QAAQ,+BAA+B;AAAA,IAChF,WAAW;AAAA,MACT,KAAK,EAAE,aAAa,oBAAoB,QAAQ,gCAAgC;AAAA,MAChF,KAAK,EAAE,aAAa,oBAAoB,QAAQ,wBAAwB;AAAA,IAC1E;AAAA,EACF;AAAA,EACA,gBAAgB;AAAA,IACd,aAAa;AAAA,IACb,OAAO;AAAA,IACP,SAAS;AAAA,IACT,QAAQ;AAAA,IACR,MAAM,eAAe;AAAA,IACrB,aAAa,CAAC,WAAW;AAAA,IACzB,OAAO,CAAC;AAAA,IACR,OAAO;AAAA,IACP,WAAW;AAAA,MACT,KAAK,EAAE,aAAa,oBAAoB,QAAQ,8BAA8B;AAAA,MAC9E,KAAK,EAAE,aAAa,oBAAoB,QAAQ,wBAAwB;AAAA,IAC1E;AAAA,EACF;AAAA,EACA,eAAe;AAAA,IACb,aAAa;AAAA,IACb,OAAO;AAAA,IACP,SAAS;AAAA,IACT,QAAQ;AAAA,IACR,MAAM;AAAA,IACN,aAAa,CAAC,WAAW;AAAA,IACzB,OAAO,CAAC;AAAA,IACR,QAAQ;AAAA,IACR,WAAW;AAAA,MACT,KAAK,EAAE,aAAa,oBAAoB,QAAQ,0BAA0B;AAAA,MAC1E,KAAK,EAAE,aAAa,oBAAoB,QAAQ,wBAAwB;AAAA,IAC1E;AAAA,EACF;AAAA,EACA,kBAAkB;AAAA,IAChB,aAAa;AAAA,IACb,OAAO;AAAA,IACP,SAAS;AAAA,IACT,QAAQ;AAAA,IACR,MAAM;AAAA,IACN,aAAa,CAAC,WAAW;AAAA,IACzB,OAAO,CAAC;AAAA,IACR,QAAQ;AAAA,IACR,WAAW;AAAA,MACT,KAAK,CAAC;AAAA,MACN,KAAK,EAAE,aAAa,oBAAoB,QAAQ,wBAAwB;AAAA,IAC1E;AAAA,IACA,OACE;AAAA,EACJ;AAAA,EACA,kBAAkB;AAAA,IAChB,aAAa;AAAA,IACb,OAAO;AAAA,IACP,SACE;AAAA,IACF,QAAQ;AAAA,IACR,MAAM;AAAA,IACN,aAAa,CAAC,aAAa,YAAY;AAAA,IACvC,OAAO,CAAC,aAAa;AAAA,IACrB,QAAQ;AAAA,IACR,MAAM,EAAE,aAAa,oBAAoB,QAAQ,+BAA+B;AAAA,IAChF,WAAW;AAAA,MACT,KAAK,EAAE,aAAa,oBAAoB,QAAQ,gCAAgC;AAAA,MAChF,KAAK,EAAE,aAAa,oBAAoB,QAAQ,wBAAwB;AAAA,IAC1E;AAAA,EACF;AAAA,EACA,oBAAoB;AAAA,IAClB,aAAa;AAAA,IACb,OAAO;AAAA,IACP,SAAS;AAAA,IACT,QAAQ;AAAA,IACR,MAAM;AAAA,IACN,aAAa,CAAC,aAAa,YAAY;AAAA,IACvC,OAAO,CAAC,aAAa;AAAA,IACrB,QAAQ;AAAA,IACR,MAAM,EAAE,aAAa,oBAAoB,QAAQ,iCAAiC;AAAA,IAClF,WAAW;AAAA,MACT,KAAK,EAAE,aAAa,oBAAoB,QAAQ,kCAAkC;AAAA,MAClF,KAAK,EAAE,aAAa,oBAAoB,QAAQ,wBAAwB;AAAA,MACxE,KAAK,EAAE,aAAa,oBAAoB,QAAQ,wBAAwB;AAAA,IAC1E;AAAA,EACF;AAAA,EACA,yBAAyB;AAAA,IACvB,aAAa;AAAA,IACb,OAAO;AAAA,IACP,SAAS;AAAA,IACT,QAAQ;AAAA,IACR,MAAM;AAAA,IACN,aAAa,CAAC,aAAa,YAAY;AAAA,IACvC,OAAO,CAAC,aAAa;AAAA,IACrB,QAAQ;AAAA,IACR,MAAM;AAAA,MACJ,aAAa;AAAA,IACf;AAAA,IACA,WAAW;AAAA,MACT,KAAK,EAAE,aAAa,oBAAoB,QAAQ,+BAA+B;AAAA,MAC/E,KAAK,EAAE,aAAa,oBAAoB,QAAQ,wBAAwB;AAAA,MACxE,KAAK,EAAE,aAAa,oBAAoB,QAAQ,wBAAwB;AAAA,IAC1E;AAAA,IACA,OACE;AAAA,EACJ;AAAA,EACA,wBAAwB;AAAA,IACtB,aAAa;AAAA,IACb,OAAO;AAAA,IACP,SACE;AAAA,IACF,QAAQ;AAAA,IACR,MAAM;AAAA,IACN,aAAa,CAAC,aAAa,YAAY;AAAA,IACvC,OAAO,CAAC,aAAa;AAAA,IACrB,QAAQ;AAAA,IACR,MAAM,EAAE,aAAa,oBAAoB,QAAQ,iCAAiC;AAAA,IAClF,WAAW;AAAA,MACT,KAAK,EAAE,aAAa,oBAAoB,QAAQ,kCAAkC;AAAA,MAClF,KAAK,EAAE,aAAa,oBAAoB,QAAQ,kCAAkC;AAAA,MAClF,KAAK,EAAE,aAAa,oBAAoB,QAAQ,wBAAwB;AAAA,MACxE,KAAK,EAAE,aAAa,oBAAoB,QAAQ,wBAAwB;AAAA,MACxE,KAAK,EAAE,aAAa,oBAAoB,QAAQ,wBAAwB;AAAA,IAC1E;AAAA,IACA,OACE;AAAA,EACJ;AAAA,EACA,kBAAkB;AAAA,IAChB,aAAa;AAAA,IACb,OAAO;AAAA,IACP,SAAS;AAAA,IACT,QAAQ;AAAA,IACR,MAAM;AAAA,IACN,aAAa,CAAC,aAAa,YAAY;AAAA,IACvC,OAAO,CAAC,WAAW;AAAA,IACnB,QAAQ;AAAA,IACR,OAAO;AAAA,IACP,WAAW;AAAA,MACT,KAAK,EAAE,aAAa,oBAAoB,QAAQ,gCAAgC;AAAA,MAChF,KAAK,EAAE,aAAa,oBAAoB,QAAQ,wBAAwB;AAAA,IAC1E;AAAA,EACF;AAAA,EACA,iBAAiB;AAAA,IACf,aAAa;AAAA,IACb,OAAO;AAAA,IACP,SAAS;AAAA,IACT,QAAQ;AAAA,IACR,MAAM;AAAA,IACN,aAAa,CAAC,aAAa,YAAY;AAAA,IACvC,OAAO,CAAC,WAAW;AAAA,IACnB,QAAQ;AAAA,IACR,WAAW;AAAA,MACT,KAAK,EAAE,aAAa,oBAAoB,QAAQ,4BAA4B;AAAA,MAC5E,KAAK,EAAE,aAAa,oBAAoB,QAAQ,wBAAwB;AAAA,MACxE,KAAK,EAAE,aAAa,oBAAoB,QAAQ,wBAAwB;AAAA,IAC1E;AAAA,EACF;AAAA,EACA,sBAAsB;AAAA,IACpB,aAAa;AAAA,IACb,OAAO;AAAA,IACP,SAAS;AAAA,IACT,QAAQ;AAAA,IACR,MAAM;AAAA,IACN,aAAa,CAAC,aAAa,YAAY;AAAA,IACvC,OAAO,CAAC,WAAW;AAAA,IACnB,QAAQ;AAAA,IACR,WAAW;AAAA,MACT,KAAK,EAAE,aAAa,kBAAkB;AAAA,MACtC,KAAK,EAAE,aAAa,oBAAoB,QAAQ,wBAAwB;AAAA,MACxE,KAAK,EAAE,aAAa,oBAAoB,QAAQ,wBAAwB;AAAA,IAC1E;AAAA,EACF;AAAA,EACA,oBAAoB;AAAA,IAClB,aAAa;AAAA,IACb,OAAO;AAAA,IACP,SAAS;AAAA,IACT,QAAQ;AAAA,IACR,MAAM;AAAA,IACN,aAAa,CAAC,aAAa,YAAY;AAAA,IACvC,OAAO,CAAC,aAAa;AAAA,IACrB,QAAQ;AAAA,IACR,WAAW;AAAA,MACT,KAAK,CAAC;AAAA,MACN,KAAK,EAAE,aAAa,oBAAoB,QAAQ,wBAAwB;AAAA,MACxE,KAAK,EAAE,aAAa,oBAAoB,QAAQ,wBAAwB;AAAA,IAC1E;AAAA,EACF;AAAA,EACA,uBAAuB;AAAA,IACrB,aAAa;AAAA,IACb,OAAO;AAAA,IACP,SAAS;AAAA,IACT,QAAQ;AAAA,IACR,MAAM;AAAA,IACN,aAAa,CAAC,aAAa,YAAY;AAAA,IACvC,OAAO,CAAC,WAAW;AAAA,IACnB,QAAQ;AAAA,IACR,WAAW;AAAA,MACT,KAAK,EAAE,aAAa,CAAC,cAAc,WAAW,EAAE;AAAA,MAChD,KAAK,EAAE,aAAa,oBAAoB,QAAQ,uCAAuC;AAAA,IACzF;AAAA,EACF;AAAA,EACA,4BAA4B;AAAA,IAC1B,aAAa;AAAA,IACb,OAAO;AAAA,IACP,SAAS;AAAA,IACT,QAAQ;AAAA,IACR,MAAM,eAAe;AAAA,IACrB,aAAa,CAAC,WAAW;AAAA,IACzB,OAAO,CAAC;AAAA,IACR,WAAW;AAAA,MACT,KAAK,EAAE,aAAa,oBAAoB,QAAQ,iCAAiC;AAAA,IACnF;AAAA,EACF;AAAA,EACA,gBAAgB;AAAA,IACd,aAAa;AAAA,IACb,OAAO;AAAA,IACP,SAAS;AAAA,IACT,QAAQ;AAAA,IACR,MAAM;AAAA,IACN,aAAa,CAAC,aAAa,YAAY;AAAA,IACvC,OAAO,CAAC,kBAAkB;AAAA,IAC1B,QAAQ;AAAA,IACR,MAAM,EAAE,aAAa,oBAAoB,QAAQ,6BAA6B;AAAA,IAC9E,WAAW;AAAA,MACT,KAAK,EAAE,aAAa,oBAAoB,QAAQ,8BAA8B;AAAA,MAC9E,KAAK,EAAE,aAAa,oBAAoB,QAAQ,wBAAwB;AAAA,MACxE,KAAK,EAAE,aAAa,oBAAoB,QAAQ,wBAAwB;AAAA,MACxE,KAAK,EAAE,aAAa,oBAAoB,QAAQ,wBAAwB;AAAA,IAC1E;AAAA,IACA,OACE;AAAA,EACJ;AAAA,EACA,iBAAiB;AAAA,IACf,aAAa;AAAA,IACb,OAAO;AAAA,IACP,SAAS;AAAA,IACT,QAAQ;AAAA,IACR,MAAM;AAAA,IACN,aAAa,CAAC,aAAa,YAAY;AAAA,IACvC,OAAO,CAAC,eAAe;AAAA,IACvB,QAAQ;AAAA,IACR,MAAM;AAAA,MACJ,aAAa;AAAA,MACb,QAAQ;AAAA,MACR,UAAU;AAAA,IACZ;AAAA,IACA,WAAW;AAAA,MACT,KAAK,CAAC;AAAA,MACN,KAAK,EAAE,aAAa,oBAAoB,QAAQ,wBAAwB;AAAA,IAC1E;AAAA,IACA,OAAO;AAAA,EACT;AAAA,EACA,iBAAiB;AAAA,IACf,aAAa;AAAA,IACb,OAAO;AAAA,IACP,SAAS;AAAA,IACT,QAAQ;AAAA,IACR,MAAM;AAAA,IACN,aAAa,CAAC,aAAa,YAAY;AAAA,IACvC,OAAO,CAAC,WAAW;AAAA,IACnB,QAAQ;AAAA,IACR,OAAO;AAAA,IACP,WAAW;AAAA,MACT,KAAK,EAAE,aAAa,oBAAoB,QAAQ,0BAA0B;AAAA,MAC1E,KAAK,EAAE,aAAa,oBAAoB,QAAQ,wBAAwB;AAAA,MACxE,KAAK,EAAE,aAAa,oBAAoB,QAAQ,wBAAwB;AAAA,IAC1E;AAAA,IACA,OACE;AAAA,EAEJ;AAAA,EACA,mBAAmB;AAAA,IACjB,aAAa;AAAA,IACb,OAAO;AAAA,IACP,SAAS;AAAA,IACT,QAAQ;AAAA,IACR,MAAM;AAAA,IACN,aAAa,CAAC,WAAW;AAAA,IACzB,OAAO,CAAC;AAAA,IACR,QAAQ;AAAA,IACR,MAAM;AAAA,MACJ,aAAa;AAAA,MACb,QAAQ;AAAA,MACR,UAAU;AAAA,IACZ;AAAA,IACA,WAAW;AAAA,MACT,KAAK,CAAC;AAAA,MACN,KAAK,EAAE,aAAa,oBAAoB,QAAQ,wBAAwB;AAAA,IAC1E;AAAA,IACA,OACE;AAAA,EAEJ;AAAA,EACA,kBAAkB;AAAA,IAChB,aAAa;AAAA,IACb,OAAO;AAAA,IACP,SAAS;AAAA,IACT,QAAQ;AAAA,IACR,MAAM;AAAA,IACN,aAAa,CAAC,WAAW;AAAA,IACzB,OAAO,CAAC;AAAA,IACR,QAAQ;AAAA,IACR,WAAW;AAAA,MACT,KAAK,CAAC;AAAA,MACN,KAAK,EAAE,aAAa,oBAAoB,QAAQ,wBAAwB;AAAA,IAC1E;AAAA,EACF;AAAA,EACA,iBAAiB;AAAA,IACf,aAAa;AAAA,IACb,OAAO;AAAA,IACP,SAAS;AAAA,IACT,QAAQ;AAAA,IACR,MAAM;AAAA,IACN,aAAa,CAAC,aAAa,YAAY;AAAA,IACvC,OAAO,CAAC,eAAe;AAAA,IACvB,QAAQ;AAAA,IACR,MAAM,EAAE,aAAa,oBAAoB,QAAQ,8BAA8B;AAAA,IAC/E,WAAW;AAAA,MACT,KAAK,EAAE,aAAa,oBAAoB,QAAQ,yBAAyB;AAAA,MACzE,KAAK,EAAE,aAAa,oBAAoB,QAAQ,wBAAwB;AAAA,MACxE,KAAK,EAAE,aAAa,oBAAoB,QAAQ,wBAAwB;AAAA,MACxE,KAAK,EAAE,aAAa,oBAAoB,QAAQ,wBAAwB;AAAA,IAC1E;AAAA,IACA,OACE;AAAA,EAEJ;AAAA,EACA,eAAe;AAAA,IACb,aAAa;AAAA,IACb,OAAO;AAAA,IACP,SAAS;AAAA,IACT,QAAQ;AAAA,IACR,MAAM;AAAA,IACN,aAAa,CAAC,aAAa,YAAY;AAAA,IACvC,OAAO,CAAC,eAAe;AAAA,IACvB,QAAQ;AAAA,IACR,OAAO;AAAA,IACP,WAAW;AAAA,MACT,KAAK,EAAE,aAAa,oBAAoB,QAAQ,6BAA6B;AAAA,MAC7E,KAAK,EAAE,aAAa,oBAAoB,QAAQ,wBAAwB;AAAA,IAC1E;AAAA,EACF;AAAA,EACA,cAAc;AAAA,IACZ,aAAa;AAAA,IACb,OAAO;AAAA,IACP,SAAS;AAAA,IACT,QAAQ;AAAA,IACR,MAAM;AAAA,IACN,aAAa,CAAC,aAAa,YAAY;AAAA,IACvC,OAAO,CAAC,eAAe;AAAA,IACvB,QAAQ;AAAA,IACR,WAAW;AAAA,MACT,KAAK,EAAE,aAAa,oBAAoB,QAAQ,yBAAyB;AAAA,MACzE,KAAK,EAAE,aAAa,oBAAoB,QAAQ,wBAAwB;AAAA,IAC1E;AAAA,EACF;AAAA,EACA,iBAAiB;AAAA,IACf,aAAa;AAAA,IACb,OAAO;AAAA,IACP,SAAS;AAAA,IACT,QAAQ;AAAA,IACR,MAAM;AAAA,IACN,aAAa,CAAC,aAAa,YAAY;AAAA,IACvC,OAAO,CAAC,eAAe;AAAA,IACvB,QAAQ;AAAA,IACR,MAAM,EAAE,aAAa,oBAAoB,QAAQ,8BAA8B;AAAA,IAC/E,WAAW;AAAA,MACT,KAAK,EAAE,aAAa,oBAAoB,QAAQ,yBAAyB;AAAA,MACzE,KAAK,EAAE,aAAa,oBAAoB,QAAQ,wBAAwB;AAAA,MACxE,KAAK,EAAE,aAAa,oBAAoB,QAAQ,wBAAwB;AAAA,IAC1E;AAAA,EACF;AAAA,EACA,iBAAiB;AAAA,IACf,aAAa;AAAA,IACb,OAAO;AAAA,IACP,SAAS;AAAA,IACT,QAAQ;AAAA,IACR,MAAM;AAAA,IACN,aAAa,CAAC,aAAa,YAAY;AAAA,IACvC,OAAO,CAAC,eAAe;AAAA,IACvB,QAAQ;AAAA,IACR,WAAW;AAAA,MACT,KAAK,CAAC;AAAA,MACN,KAAK,EAAE,aAAa,oBAAoB,QAAQ,wBAAwB;AAAA,IAC1E;AAAA,EACF;AAAA,EACA,mBAAmB;AAAA,IACjB,aAAa;AAAA,IACb,OAAO;AAAA,IACP,SAAS;AAAA,IACT,QAAQ;AAAA,IACR,MAAM,eAAe;AAAA,IACrB,aAAa,CAAC;AAAA,IACd,OAAO,CAAC;AAAA,IACR,MAAM,EAAE,aAAa,oBAAoB,QAAQ,2BAA2B;AAAA,IAC5E,WAAW;AAAA,MACT,KAAK,EAAE,aAAa,oBAAoB,QAAQ,2BAA2B;AAAA,MAC3E,KAAK,EAAE,aAAa,oBAAoB,QAAQ,wBAAwB;AAAA,MACxE,KAAK,EAAE,aAAa,oBAAoB,QAAQ,wBAAwB;AAAA,MACxE,KAAK,EAAE,aAAa,oBAAoB,QAAQ,wBAAwB;AAAA,MACxE,KAAK,EAAE,aAAa,oBAAoB,QAAQ,wBAAwB;AAAA,MACxE,KAAK,EAAE,aAAa,oBAAoB,QAAQ,wBAAwB;AAAA,IAC1E;AAAA,IACA,OACE;AAAA,EAIJ;AACF;AAkBO,IAAM,oBAAoB,EAAE,OAAO;AAAA,EACxC,OAAO,EAAE,OAAO,EAAE,MAAM,YAAY;AACtC,CAAC;AACM,IAAM,uBAAuB,kBAAkB,OAAO;AAAA,EAC3D,WAAW,EAAE,OAAO,EAAE,IAAI,CAAC;AAC7B,CAAC;AACM,IAAM,sBAAsB,qBAAqB,OAAO;AAAA,EAC7D,KAAK,EAAE,OAAO,OAAO,EAAE,IAAI,EAAE,IAAI,CAAC;AACpC,CAAC;AACM,IAAM,4BAA4B,oBAAoB,OAAO;AAAA,EAClE,UAAU,EAAE,OAAO,EAAE,IAAI,CAAC;AAC5B,CAAC;AACM,IAAM,uBAAuB,qBAAqB,OAAO;AAAA,EAC9D,UAAU,EAAE,OAAO,EAAE,IAAI,CAAC;AAC5B,CAAC;AAOM,IAAM,yBAA+C;AAAA,EAC1D,MAAM;AAAA,EACN,UAAU;AAAA,EACV,aACE;AAGJ;AAEA,IAAM,YAAY,EAAE,OAAO,EAAE,OAAO,GAAG,EAAE,QAAQ,CAAC;AAClD,IAAM,iBAAiB,CAAC,aAAa,SAAS;AAO9C,IAAM,yBAAyB,EAAE,OAAO,EAAE,MAAM,mBAAmB,CAAC,EAAE,YAAY;AAE3E,IAAM,gBAAgB;AAAA,EAC3B,YAAY;AAAA,IACV,aAAa;AAAA,IACb,OAAO;AAAA,IACP,SAAS;AAAA,IACT,QAAQ;AAAA,IACR,MAAM,cAAc;AAAA,IACpB,aAAa;AAAA,IACb,OAAO,CAAC;AAAA,IACR,iBAAiB,CAAC,UAAU;AAAA,IAC5B,gBAAgB,CAAC,sBAAsB;AAAA,IACvC,QAAQ;AAAA,IACR,WAAW;AAAA,MACT,KAAK,EAAE,aAAa,oBAAoB,QAAQ,mBAAmB;AAAA,MACnE,KAAK,EAAE,aAAa,oBAAoB,QAAQ,yBAAyB;AAAA,IAC3E;AAAA,EACF;AAAA,EACA,gBAAgB;AAAA,IACd,aAAa;AAAA,IACb,OAAO;AAAA,IACP,SAAS;AAAA,IACT,QAAQ;AAAA,IACR,MAAM,cAAc;AAAA,IACpB,aAAa;AAAA,IACb,OAAO,CAAC;AAAA,IACR,iBAAiB,CAAC,UAAU;AAAA,IAC5B,gBAAgB,CAAC,sBAAsB;AAAA,IACvC,QAAQ;AAAA,IACR,WAAW;AAAA,MACT,KAAK,EAAE,aAAa,oBAAoB,QAAQ,uBAAuB;AAAA,MACvE,KAAK,EAAE,aAAa,oBAAoB,QAAQ,yBAAyB;AAAA,IAC3E;AAAA,EACF;AAAA,EACA,oBAAoB;AAAA,IAClB,aAAa;AAAA,IACb,OAAO;AAAA,IACP,SAAS;AAAA,IACT,QAAQ;AAAA,IACR,MAAM,cAAc;AAAA,IACpB,aAAa;AAAA,IACb,OAAO,CAAC;AAAA,IACR,iBAAiB,CAAC,UAAU;AAAA,IAC5B,gBAAgB,CAAC,sBAAsB;AAAA,IACvC,QAAQ;AAAA,IACR,WAAW;AAAA,MACT,KAAK,EAAE,aAAa,oBAAoB,QAAQ,uBAAuB;AAAA,MACvE,KAAK,EAAE,aAAa,oBAAoB,QAAQ,yBAAyB;AAAA,IAC3E;AAAA,EACF;AAAA,EACA,cAAc;AAAA,IACZ,aAAa;AAAA,IACb,OAAO;AAAA,IACP,SAAS;AAAA,IACT,QAAQ;AAAA,IACR,MAAM,cAAc;AAAA,IACpB,aAAa;AAAA,IACb,OAAO,CAAC;AAAA,IACR,iBAAiB,CAAC,YAAY;AAAA,IAC9B,gBAAgB,CAAC,sBAAsB;AAAA,IACvC,QAAQ;AAAA,IACR,OACE;AAAA,IAEF,WAAW;AAAA,MACT,KAAK,EAAE,aAAa,aAAa;AAAA,MACjC,KAAK,EAAE,aAAa,oBAAoB,QAAQ,yBAAyB;AAAA,IAC3E;AAAA,EACF;AAAA,EACA,YAAY;AAAA,IACV,aAAa;AAAA,IACb,OAAO;AAAA,IACP,SAAS;AAAA,IACT,QAAQ;AAAA,IACR,MAAM,cAAc;AAAA,IACpB,aAAa;AAAA,IACb,OAAO,CAAC;AAAA,IACR,iBAAiB,CAAC,eAAe;AAAA,IACjC,gBAAgB,CAAC,sBAAsB;AAAA,IACvC,QAAQ;AAAA,IACR,WAAW;AAAA,MACT,KAAK,EAAE,aAAa,oBAAoB,QAAQ,uBAAuB;AAAA,MACvE,KAAK,EAAE,aAAa,oBAAoB,QAAQ,yBAAyB;AAAA,IAC3E;AAAA,EACF;AAAA,EACA,wBAAwB;AAAA,IACtB,aAAa;AAAA,IACb,OAAO;AAAA,IACP,SAAS;AAAA,IACT,QAAQ;AAAA,IACR,MAAM,cAAc;AAAA,IACpB,aAAa;AAAA,IACb,OAAO,CAAC;AAAA,IACR,iBAAiB,CAAC,mBAAmB;AAAA,IACrC,gBAAgB,CAAC,sBAAsB;AAAA,IACvC,QAAQ;AAAA,IACR,WAAW;AAAA,MACT,KAAK,EAAE,aAAa,oBAAoB,QAAQ,iCAAiC;AAAA,MACjF,KAAK,EAAE,aAAa,oBAAoB,QAAQ,yBAAyB;AAAA,IAC3E;AAAA,EACF;AAAA,EACA,0BAA0B;AAAA,IACxB,aAAa;AAAA,IACb,OAAO;AAAA,IACP,SAAS;AAAA,IACT,QAAQ;AAAA,IACR,MAAM,cAAc;AAAA,IACpB,aAAa;AAAA,IACb,OAAO,CAAC;AAAA,IACR,iBAAiB,CAAC,qBAAqB;AAAA,IACvC,gBAAgB,CAAC,sBAAsB;AAAA,IACvC,QAAQ;AAAA,IACR,MAAM,EAAE,aAAa,oBAAoB,QAAQ,UAAU;AAAA,IAC3D,OACE;AAAA,IAEF,WAAW;AAAA,MACT,KAAK,EAAE,aAAa,oBAAoB,QAAQ,uBAAuB;AAAA,MACvE,KAAK,EAAE,aAAa,oBAAoB,QAAQ,yBAAyB;AAAA,MACzE,KAAK,EAAE,aAAa,oBAAoB,QAAQ,yBAAyB;AAAA,IAC3E;AAAA,EACF;AAAA,EACA,0BAA0B;AAAA,IACxB,aAAa;AAAA,IACb,OAAO;AAAA,IACP,SAAS;AAAA,IACT,QAAQ;AAAA,IACR,MAAM,cAAc;AAAA,IACpB,aAAa;AAAA,IACb,OAAO,CAAC;AAAA,IACR,iBAAiB,CAAC,qBAAqB;AAAA,IACvC,gBAAgB,CAAC,sBAAsB;AAAA,IACvC,QAAQ;AAAA,IACR,MAAM,EAAE,aAAa,oBAAoB,QAAQ,UAAU;AAAA,IAC3D,WAAW;AAAA,MACT,KAAK,EAAE,aAAa,oBAAoB,QAAQ,uBAAuB;AAAA,MACvE,KAAK,EAAE,aAAa,oBAAoB,QAAQ,yBAAyB;AAAA,MACzE,KAAK,EAAE,aAAa,oBAAoB,QAAQ,yBAAyB;AAAA,IAC3E;AAAA,EACF;AAAA,EACA,0BAA0B;AAAA,IACxB,aAAa;AAAA,IACb,OAAO;AAAA,IACP,SAAS;AAAA,IACT,QAAQ;AAAA,IACR,MAAM,cAAc;AAAA,IACpB,aAAa;AAAA,IACb,OAAO,CAAC;AAAA,IACR,iBAAiB,CAAC,qBAAqB;AAAA,IACvC,gBAAgB,CAAC,sBAAsB;AAAA,IACvC,QAAQ;AAAA,IACR,WAAW;AAAA,MACT,KAAK,EAAE,aAAa,oBAAoB,QAAQ,uBAAuB;AAAA,MACvE,KAAK,EAAE,aAAa,oBAAoB,QAAQ,yBAAyB;AAAA,IAC3E;AAAA,EACF;AAAA,EACA,iBAAiB;AAAA,IACf,aAAa;AAAA,IACb,OAAO;AAAA,IACP,SAAS;AAAA,IACT,QAAQ;AAAA,IACR,MAAM,cAAc;AAAA,IACpB,aAAa;AAAA,IACb,OAAO,CAAC;AAAA,IACR,iBAAiB,CAAC,gBAAgB;AAAA,IAClC,gBAAgB,CAAC,sBAAsB;AAAA,IACvC,QAAQ;AAAA,IACR,WAAW;AAAA,MACT,KAAK,EAAE,aAAa,oBAAoB,QAAQ,mBAAmB;AAAA,MACnE,KAAK,EAAE,aAAa,oBAAoB,QAAQ,yBAAyB;AAAA,IAC3E;AAAA,EACF;AAAA,EACA,sBAAsB;AAAA,IACpB,aAAa;AAAA,IACb,OAAO;AAAA,IACP,SAAS;AAAA,IACT,QAAQ;AAAA,IACR,MAAM,cAAc;AAAA,IACpB,aAAa;AAAA,IACb,OAAO,CAAC;AAAA,IACR,iBAAiB,CAAC,gBAAgB;AAAA,IAClC,gBAAgB,CAAC,sBAAsB;AAAA,IACvC,QAAQ;AAAA,IACR,MAAM,EAAE,aAAa,oBAAoB,QAAQ,UAAU;AAAA,IAC3D,WAAW;AAAA,MACT,KAAK,EAAE,aAAa,oBAAoB,QAAQ,uBAAuB;AAAA,MACvE,KAAK,EAAE,aAAa,oBAAoB,QAAQ,yBAAyB;AAAA,MACzE,KAAK,EAAE,aAAa,oBAAoB,QAAQ,yBAAyB;AAAA,IAC3E;AAAA,EACF;AAAA,EACA,mBAAmB;AAAA,IACjB,aAAa;AAAA,IACb,OAAO;AAAA,IACP,SAAS;AAAA,IACT,QAAQ;AAAA,IACR,MAAM,cAAc;AAAA,IACpB,aAAa;AAAA,IACb,OAAO,CAAC;AAAA,IACR,iBAAiB,CAAC,gBAAgB;AAAA,IAClC,gBAAgB,CAAC,sBAAsB;AAAA,IACvC,QAAQ;AAAA,IACR,WAAW;AAAA,MACT,KAAK,EAAE,aAAa,oBAAoB,QAAQ,uBAAuB;AAAA,MACvE,KAAK,EAAE,aAAa,oBAAoB,QAAQ,yBAAyB;AAAA,IAC3E;AAAA,EACF;AAAA,EACA,wBAAwB;AAAA,IACtB,aAAa;AAAA,IACb,OAAO;AAAA,IACP,SAAS;AAAA,IACT,QAAQ;AAAA,IACR,MAAM,cAAc;AAAA,IACpB,aAAa;AAAA,IACb,OAAO,CAAC;AAAA,IACR,iBAAiB,CAAC,gBAAgB;AAAA,IAClC,gBAAgB,CAAC,sBAAsB;AAAA,IACvC,QAAQ;AAAA,IACR,OAAO,EAAE,OAAO,EAAE,QAAQ,EAAE,KAAK,CAAC,OAAO,MAAM,CAAC,EAAE,SAAS,EAAE,CAAC;AAAA,IAC9D,WAAW;AAAA,MACT,KAAK,EAAE,aAAa,CAAC,8BAA8B,qBAAqB,EAAE;AAAA,MAC1E,KAAK,EAAE,aAAa,oBAAoB,QAAQ,yBAAyB;AAAA,IAC3E;AAAA,EACF;AAAA,EACA,wBAAwB;AAAA,IACtB,aAAa;AAAA,IACb,OAAO;AAAA,IACP,SAAS;AAAA,IACT,QAAQ;AAAA,IACR,MAAM,cAAc;AAAA,IACpB,aAAa;AAAA,IACb,OAAO,CAAC;AAAA,IACR,iBAAiB,CAAC,gBAAgB;AAAA,IAClC,gBAAgB,CAAC,sBAAsB;AAAA,IACvC,QAAQ;AAAA,IACR,MAAM,EAAE,aAAa,oBAAoB,QAAQ,UAAU;AAAA,IAC3D,WAAW;AAAA,MACT,KAAK,EAAE,aAAa,oBAAoB,QAAQ,uBAAuB;AAAA,MACvE,KAAK,EAAE,aAAa,oBAAoB,QAAQ,yBAAyB;AAAA,MACzE,KAAK,EAAE,aAAa,oBAAoB,QAAQ,yBAAyB;AAAA,IAC3E;AAAA,EACF;AAAA,EACA,kBAAkB;AAAA,IAChB,aAAa;AAAA,IACb,OAAO;AAAA,IACP,SAAS;AAAA,IACT,QAAQ;AAAA,IACR,MAAM,cAAc;AAAA,IACpB,aAAa;AAAA,IACb,OAAO,CAAC;AAAA,IACR,iBAAiB,CAAC,oBAAoB;AAAA,IACtC,gBAAgB,CAAC,sBAAsB;AAAA,IACvC,QAAQ;AAAA,IACR,MAAM,EAAE,aAAa,oBAAoB,QAAQ,UAAU;AAAA,IAC3D,WAAW;AAAA,MACT,KAAK,EAAE,aAAa,oBAAoB,QAAQ,uBAAuB;AAAA,MACvE,KAAK,EAAE,aAAa,oBAAoB,QAAQ,yBAAyB;AAAA,MACzE,KAAK,EAAE,aAAa,oBAAoB,QAAQ,yBAAyB;AAAA,IAC3E;AAAA,EACF;AAAA,EACA,oBAAoB;AAAA,IAClB,aAAa;AAAA,IACb,OAAO;AAAA,IACP,SAAS;AAAA,IACT,QAAQ;AAAA,IACR,MAAM,cAAc;AAAA,IACpB,aAAa;AAAA,IACb,OAAO,CAAC;AAAA,IACR,iBAAiB,CAAC,oBAAoB;AAAA,IACtC,gBAAgB,CAAC,sBAAsB;AAAA,IACvC,QAAQ;AAAA,IACR,MAAM,EAAE,aAAa,oBAAoB,QAAQ,UAAU;AAAA,IAC3D,WAAW;AAAA,MACT,KAAK,EAAE,aAAa,oBAAoB,QAAQ,uBAAuB;AAAA,MACvE,KAAK,EAAE,aAAa,oBAAoB,QAAQ,yBAAyB;AAAA,MACzE,KAAK,EAAE,aAAa,oBAAoB,QAAQ,yBAAyB;AAAA,IAC3E;AAAA,EACF;AAAA,EACA,oBAAoB;AAAA,IAClB,aAAa;AAAA,IACb,OAAO;AAAA,IACP,SAAS;AAAA,IACT,QAAQ;AAAA,IACR,MAAM,cAAc;AAAA,IACpB,aAAa;AAAA,IACb,OAAO,CAAC;AAAA,IACR,iBAAiB,CAAC,oBAAoB;AAAA,IACtC,gBAAgB,CAAC,sBAAsB;AAAA,IACvC,QAAQ;AAAA,IACR,MAAM,EAAE,aAAa,oBAAoB,QAAQ,UAAU;AAAA,IAC3D,WAAW;AAAA,MACT,KAAK,EAAE,aAAa,oBAAoB,QAAQ,uBAAuB;AAAA,MACvE,KAAK,EAAE,aAAa,oBAAoB,QAAQ,yBAAyB;AAAA,MACzE,KAAK,EAAE,aAAa,oBAAoB,QAAQ,yBAAyB;AAAA,IAC3E;AAAA,EACF;AAAA,EACA,qBAAqB;AAAA,IACnB,aAAa;AAAA,IACb,OAAO;AAAA,IACP,SAAS;AAAA,IACT,QAAQ;AAAA,IACR,MAAM,cAAc;AAAA,IACpB,aAAa;AAAA,IACb,OAAO,CAAC;AAAA,IACR,iBAAiB,CAAC,oBAAoB,qBAAqB;AAAA,IAC3D,gBAAgB,CAAC,sBAAsB;AAAA,IACvC,QAAQ;AAAA,IACR,MAAM,EAAE,aAAa,oBAAoB,QAAQ,WAAW,UAAU,MAAM;AAAA,IAC5E,WAAW;AAAA,MACT,KAAK,EAAE,aAAa,oBAAoB,QAAQ,uBAAuB;AAAA,MACvE,KAAK,EAAE,aAAa,oBAAoB,QAAQ,yBAAyB;AAAA,MACzE,KAAK,EAAE,aAAa,oBAAoB,QAAQ,yBAAyB;AAAA,IAC3E;AAAA,EACF;AAAA,EACA,wBAAwB;AAAA,IACtB,aAAa;AAAA,IACb,OAAO;AAAA,IACP,SAAS;AAAA,IACT,QAAQ;AAAA,IACR,MAAM,cAAc;AAAA,IACpB,aAAa;AAAA,IACb,OAAO,CAAC;AAAA,IACR,iBAAiB,CAAC,oBAAoB,uBAAuB,YAAY;AAAA,IACzE,gBAAgB,CAAC,sBAAsB;AAAA,IACvC,QAAQ;AAAA,IACR,MAAM,EAAE,aAAa,oBAAoB,QAAQ,WAAW,UAAU,MAAM;AAAA,IAC5E,WAAW;AAAA,MACT,KAAK,EAAE,aAAa,oBAAoB,QAAQ,uBAAuB;AAAA,MACvE,KAAK,EAAE,aAAa,oBAAoB,QAAQ,yBAAyB;AAAA,MACzE,KAAK,EAAE,aAAa,oBAAoB,QAAQ,yBAAyB;AAAA,IAC3E;AAAA,EACF;AAAA,EACA,gBAAgB;AAAA,IACd,aAAa;AAAA,IACb,OAAO;AAAA,IACP,SAAS;AAAA,IACT,QAAQ;AAAA,IACR,MAAM,cAAc;AAAA,IACpB,aAAa;AAAA,IACb,OAAO,CAAC;AAAA,IACR,iBAAiB,CAAC,cAAc;AAAA,IAChC,gBAAgB,CAAC,sBAAsB;AAAA,IACvC,QAAQ;AAAA,IACR,WAAW;AAAA,MACT,KAAK,EAAE,aAAa,kBAAkB;AAAA,MACtC,KAAK,EAAE,aAAa,oBAAoB,QAAQ,yBAAyB;AAAA,IAC3E;AAAA,EACF;AACF;AAIO,IAAM,gBAAgB,EAAE,GAAG,iBAAiB,GAAG,cAAc;AAe7D,IAAM,aAAa;AAAA,EACxB,YAAY,EAAE,OAAO,aAAa;AAAA,EAClC,SAAS,EAAE,OAAO,UAAU;AAAA,EAC5B,WAAW,EAAE,OAAO,mBAAmB;AAAA,EACvC,QAAQ,EAAE,OAAO,SAAS;AAAA,EAC1B,QAAQ,EAAE,OAAO,SAAS;AAAA,EAC1B,KAAK,EAAE,OAAO,uBAAuB,MAAM,sBAAsB;AAAA,EACjE,mBAAmB,EAAE,OAAO,cAAc;AAAA,EAC1C,aAAa,EAAE,OAAO,QAAQ;AAAA,EAC9B,gBAAgB,EAAE,OAAO,WAAW;AAAA,EACpC,aAAa,EAAE,OAAO,QAAQ;AAAA,EAC9B,kBAAkB,EAAE,OAAO,aAAa;AAC1C;","names":[]}