@fabricorg/sdui-release 0.3.0 → 0.5.0

package/CHANGELOG.md

@@ -1,5 +1,181 @@
 # Changelog
 
+## 0.5.0
+
+### Minor Changes
+
+- 8ce5e06: Derive release grants from what an actor holds, and complete the port catalog.
+
+  `deriveAuthorizationGrants` turns usage contracts plus an actor's permissions, entitlements and
+  feature flags into an `SduiAuthorizationGrants`. A shell that answers "what may this actor see" from
+  its own configuration, while grants are hand-maintained elsewhere and enforcement happens in a third
+  place, produces three sources that must agree with nothing forcing them to. Deriving them makes
+  navigation a projection of the same declarations. It is navigation-shaped rather than enforcement:
+  the Host still re-checks authority at execution and `ProjectionHost` still authorizes every query.
+  Withheld capabilities are returned with the requirement that was missing, so an absent entry is
+  explainable.
+
+  `ContentPort`, `PaymentsPort`, `SearchPort` and `CustomerRecordPort` join flags, design tokens and
+  identity, each with the suite an adapter must pass. The suites encode what each port class actually
+  gets wrong: content inventing a default for an unauthored key or carrying a capability reference,
+  money expressed as a float or an idempotency key that moves it twice, search hits mistaken for
+  authorization rather than pointers a governed read still resolves, and redelivery duplicating a
+  customer record. `PaymentOutcome` includes `ambiguous`, which maps onto the platform's existing
+  adapter outcomes so an uncertain charge reconciles instead of being retried.
+
+- a598fb9: Close the remaining review findings.
+
+  **One capability-reference grammar.** `sdui-release` accepted any name after the namespace while
+  `sdui-composer` rejected `/`, so a view named `orders/reports/daily` produced a release that validated
+  and then died at promotion with nothing wrong upstream to point at. Both now share
+  `parseCapabilityRef`, tightened to lowercase path segments matching what the platform permits for a
+  view name. Two views in one contract that reduce to the same reference are reported as
+  `ambiguous_capability_reference` at validation rather than surfacing as an ambiguous route later.
+
+  **A bounded replay window.** A client-supplied `capturedAt` had no lower bound. Deferring it to the
+  Host looked safe and was not: the Host checks staleness only when the capture-authority adapter
+  supplies an `expiresAt`, and skips the execution-time expiry check entirely for actions governed at
+  capture. A gateway that accepts replay must now declare `maxOfflineReplayAgeMs`, and the instant must
+  be RFC 3339 with an explicit offset.
+
+  **One token-set grammar.** `document.tokenSet` accepted names and versions that `supportedTokenSets`
+  rejected, while validation treats the two fields as interchangeable.
+
+  **Port requirements narrow as they are checked.** A requirement for a standard _and_ a version could
+  be satisfied by two different adapters covering one constraint each. `requirement.standard.version`
+  was declared and never read.
+
+- 8f75ac9: Add the channel conformance suite and multi-brand promotion.
+
+  `sduiChannelChecks` and `runSduiChannelChecks` certify that a channel refuses anything that is not a
+  promoted, digest-verified release: tampered content, a bare document that was never promoted, and a
+  release carrying no digest. It also requires a channel to report missing core vocabulary rather than
+  render anyway, and to leave the release unmutated. The rule previously existed only in the type
+  signature of the one implementation Fabric ships, while every client writes their own renderer. See
+  ADR 0016.
+
+  `SduiDocument.supportedTokenSets` lets one authored document be promoted against several brands.
+  Each promotion still pins exactly one resolved token set, so a release digest continues to identify
+  precisely what a viewer received — the property that carrying several token sets inside one release
+  would have given up. The field is optional and a document that omits it digests exactly as before.
+
+- 9a5b18a: Close what a fifth review found, including a regression the previous fix introduced.
+
+  **Ambiguity fired on legal documents.** Counting every declared view made publishing a view at two
+  versions a hard failure, and view versioning is a first-class pattern: the platform and the usage
+  contract both key a view on `name@version`. It also failed a release over a capability that release
+  never touched. Ambiguity is now reported for _granted_ references only, where a versionless reference
+  genuinely cannot pick between two versions, and a contract supplied twice gets its own finding
+  instead of making every one of its views look ambiguous.
+
+  **A failed replay is `unknown`, not `refused`.** `failed` is reachable after adapter steps succeeded
+  and the domain transaction committed, so telling an operator the action was definitely refused could
+  be as wrong as telling them it was applied. Only policy blocks and validation failures are decided
+  before any effect. A replay adapter that returns nothing is surfaced rather than counted as applied,
+  which was the one line the previous rewrite left untouched.
+
+  **`parked` and `expired` carry their records**, and reconciliation carries the invocation id. Bare
+  counts left nobody able to say which action needs approving or whose work was dropped, and external
+  reconciliation needs the id the type exists to enable.
+
+  Settled-failure classification gained the superseded-action-version case and dropped two it had
+  wrong: a future-dated capture comes good as clocks correct, and a gateway missing its replay window
+  is a deployment mistake somebody will fix. Discarding either would destroy work.
+
+  **`assertPortSuiteHasTeeth` takes a set of broken adapters.** Requiring one stub to trip every check
+  was unsatisfiable for any suite with a fixture-liveness guard, since the guard bites on the
+  complement of what it guards, and two reference ports could not pass their own suites. Port ids now
+  permit a hyphen in the first segment, so a port can be defined for every name a manifest can declare,
+  and `certifyAdapter` validates its definition rather than issuing evidence the gate reports as
+  missing.
+
+- 9b2e55b: Close what a fourth review found: each earlier fix closed one instance of a class and left its
+  siblings.
+
+  **Replay disposition is now exhaustive over `ActionStatus`.** The previous fix enumerated the two
+  statuses that looked like refusals, so `failed`, `validation_failed` and `waiting_for_approval` fell
+  through and were deleted from the queue and reported to the operator as applied — the same bug the
+  fix set out to kill, one layer in. Any returned outcome now means the platform holds the invocation,
+  so the capture leaves the queue either way; what differs is whether a person needs to hear about it.
+  An undeterminable adapter outcome is reported as `unknown` rather than `refused`, because the effect
+  may well have happened. `isSettledReplayFailure` learned the refusals the sibling commit introduced,
+  including a capture rejected for age, which can never come good.
+
+  **A replay without `capturedAt` is refused.** It was reachable only through an untyped cast, so
+  omitting it skipped the age check entirely and stamped receipt time into durable capture evidence.
+
+  **A capability can name a namespaced port.** `definePort` required a dot and the manifest validator
+  forbade one, so no real capability could name a defined port and the certification gate was
+  unreachable. Certification is also checked structurally rather than by the presence of a property, so
+  a hand-written claim no longer satisfies the gate that exists to demand evidence, and a port
+  requirement narrows its candidates as each constraint is applied.
+
+  **`assertPortSuiteHasTeeth` names every vacuous check** rather than returning on the first one that
+  bites, and a reference port is actually run through it. The payments control asserts its result, so
+  an adapter that never charges no longer certifies. The capability-reference grammar matches the
+  platform's own view-name rule instead of being stricter than it, and ambiguity is counted by
+  occurrence across views and intents rather than by comparing names within one contract.
+
+- 0d1f6f6: Close what a third independent review found, including two defects introduced by the previous fix.
+
+  **Offline replay counted refusals as successes.** `PlatformHost` reports a refused capture by
+  _returning_ `reconciliation_required` with the reason, not by throwing, so the queue took its success
+  branch, deleted the capture and reported it applied. The reconciliation path was unreachable. Replay
+  now reads the returned outcome. The already-applied branch is removed entirely: a repeated key
+  returns the original invocation without complaint, and an idempotency _conflict_ means the key was
+  reused for a materially different command, so that capture was never applied and is kept rather than
+  discarded.
+
+  **`deriveAuthorizationGrants` defaulted open and reached the signed artifact.** Requirements are
+  optional metadata, so a capability declaring none granted everything to an actor holding nothing.
+  Grants are also carried onto a release unexamined and promotion signs a route for each, so a surplus
+  grant became a signed route to a capability the screen never renders. Undeclared requirements now
+  withhold by default, and `document` scopes the result to references the screen actually binds.
+
+  Several conformance checks could not fail: a search suite passed an adapter returning nothing, a
+  payments suite passed a double-charger that omitted a provider reference, an identity suite certified
+  timestamps the scope check then rejected on every request, an MFE probe could be refused for an
+  unrelated reason, and a channel check accepted any exception as a refusal. Each now proves what it
+  claims. Promotion configuration rejects anything reading like a key rather than two spellings,
+  rejects unknown fields, and constrains the application name that decides the default output path.
+
+### Patch Changes
+
+- 274d948: Close the gaps a second independent review found.
+
+  Experience promotion now binds the usage contracts it compiles routes from to the assembly the
+  release was validated against. Promotion previously accepted arbitrary contracts while copying the
+  release's assembly digest through unchanged, so a substituted contract could remap an already-granted
+  `capability://` reference onto a different installed action. PlatformHost still authorized that
+  action, which made this an integrity failure of what a release exposes rather than an authorization
+  bypass, and invisible downstream. `@fabricorg/assembly` exports `computeAssemblyLockfileDigest` so
+  tooling can build a self-consistent lockfile; the validator already recomputed it.
+
+  The MFE loader gains `fabric.mfe-loader.mismatched-digest-denial.v1`, which supplies a well-formed
+  integrity value that cannot match the approved bundle. The previous integrity check supplied only a
+  malformed value, so it proved a regex ran; a transport that ignored integrity entirely certified
+  clean. Since same-realm MFE code carries the application's own authority, a false integrity
+  certification is worth catching in the suite rather than in production.
+
+  The SDUI channel suite no longer certifies a channel it never exercised: the missing-vocabulary check
+  now runs against the subject rather than a fresh built-in one, rejects a vacuous or contradictory
+  subject instead of passing it, requires a refusal to name the digest so an unrelated crash cannot
+  read as correct behaviour, and edits several digest-covered fields so a channel cannot pass by
+  special-casing one fixture. `supportedTokenSets` uses a total comparator over its fields rather than
+  an interpolated key, and duplicate or malformed token-set references are rejected.
+
+- Updated dependencies [274d948]
+  - @fabricorg/assembly@0.4.0
+
+## 0.4.0
+
+### Minor Changes
+
+- Add browser-safe Release v3 contracts, RFC 8785 canonicalization, async ES256
+  verification, exact compiled routes, tree-scoped effective grants, and
+  issuer/application/channel-bound monotonic release pointers while preserving
+  Release v2.
+
 ## 0.3.0
 
 ### Minor Changes

package/README.md

@@ -3,6 +3,12 @@
 Versioned SDUI document, fragment, token-set, component-pack, and promoted release
 contracts validated independently of any renderer.
 
+The browser-safe `@fabricorg/sdui-release/contracts` entry adds Release v3 route and
+tree-scoped grant contracts, RFC 8785 canonicalization, async crypto adapters, ES256
+JWS verification, and signed monotonic release-channel pointers. It contains no Node
+builtin or runtime Platform import. Release v2 and the existing root entry remain
+compatible.
+
 ## What this package owns
 
 - **`SduiDocument`** — a versioned tree of fragments with a token-set reference and
@@ -78,7 +84,7 @@ validateSduiRelease({
 });
 ```
 
-An experience host or adoption-binding build can derive these references from
+An experience composer or adoption-binding build can derive these references from
 its reviewed grants. Supplying a contract, or merely finding a matching
 capability reference, never authorizes a read or mutation.
 
@@ -99,5 +105,6 @@ fragments and forwards action intents through
 This package depends on `@fabricorg/assembly` for shared semver resolution,
 `@fabricorg/gen-capability` for `UsageContractDocument` validation, and
 `@fabricorg/platform` for `PortableJsonSchema`. It does not depend on a renderer,
-a host, or a specific runtime. SDUI rendering, theming, and composition remain
-outside Fabric Platform, as established by ADR 0006.
+a Host, or a specific runtime. SDUI rendering, theming, and composition remain
+outside the portable kernel and governed Hosts. Separately versioned experience-tier
+packages support those concerns as established by ADR 0015.

package/dist/chunk-BTWHVBZ3.js

@@ -0,0 +1,255 @@
+// contracts.ts
+var SDUI_RELEASE_V3_FORMAT_VERSION = 3;
+var RELEASE_CHANNEL_POINTER_FORMAT_VERSION = 1;
+var encoder = new TextEncoder();
+var decoder = new TextDecoder("utf-8", { fatal: true });
+var HEX_DIGEST = /^[a-f0-9]{64}$/;
+function canonicalizeJcs(value) {
+  return canonical(value, 0);
+}
+function canonical(value, depth) {
+  if (depth > 64) throw new Error("Canonical JSON exceeds the maximum depth of 64.");
+  if (value === null) return "null";
+  if (typeof value === "boolean") return value ? "true" : "false";
+  if (typeof value === "number") {
+    if (!Number.isFinite(value)) throw new Error("Canonical JSON numbers must be finite.");
+    return Object.is(value, -0) ? "0" : JSON.stringify(value);
+  }
+  if (typeof value === "string") {
+    assertValidUnicode(value);
+    return JSON.stringify(value);
+  }
+  if (Array.isArray(value)) return `[${value.map((entry) => canonical(entry, depth + 1)).join(",")}]`;
+  if (typeof value !== "object") throw new Error(`Canonical JSON cannot encode ${typeof value}.`);
+  const record = value;
+  const keys = Object.keys(record).sort();
+  return `{${keys.map((key) => {
+    assertValidUnicode(key);
+    return `${JSON.stringify(key)}:${canonical(record[key], depth + 1)}`;
+  }).join(",")}}`;
+}
+function assertValidUnicode(value) {
+  for (let index = 0; index < value.length; index += 1) {
+    const code = value.charCodeAt(index);
+    if (code >= 55296 && code <= 56319) {
+      const next = value.charCodeAt(index + 1);
+      if (!(next >= 56320 && next <= 57343)) throw new Error("Canonical JSON contains an unpaired Unicode surrogate.");
+      index += 1;
+    } else if (code >= 56320 && code <= 57343) {
+      throw new Error("Canonical JSON contains an unpaired Unicode surrogate.");
+    }
+  }
+}
+async function verifySignedExperienceArtifact(input) {
+  const maxBytes = input.maxBytes ?? 1048576;
+  if (encoder.encode(input.compactJws).byteLength > maxBytes) {
+    throw new Error(`Signed experience artifact exceeds the ${maxBytes}-byte size limit.`);
+  }
+  const parts = input.compactJws.split(".");
+  if (parts.length !== 3 || parts.some((part) => part.length === 0)) throw new Error("Signed experience artifact must be a compact JWS.");
+  const header = parseSegment(parts[0], "protected header");
+  if (header.alg !== "ES256") throw new Error("Signed experience artifacts must use ES256.");
+  if (header.typ !== input.expectedType) throw new Error(`Signed experience artifact type must be ${input.expectedType}.`);
+  if (typeof header.kid !== "string" || !header.kid) throw new Error("Signed experience artifact requires a key id.");
+  const payloadBytes = decodeBase64Url(parts[1]);
+  const payload = parseJsonBytes(payloadBytes, "payload");
+  if (typeof payload.issuer !== "string" || !payload.issuer) throw new Error("Signed experience artifact requires an issuer.");
+  const key = await input.trust.resolveKey({ keyId: header.kid, issuer: payload.issuer, algorithm: "ES256" });
+  if (!key || key.algorithm !== "ES256") throw new Error("Signed experience artifact has no trusted key.");
+  const signature = decodeBase64Url(parts[2]);
+  if (signature.byteLength !== 64) throw new Error("ES256 signatures must be 64-byte JOSE signatures.");
+  const verified = await input.crypto.verify({
+    algorithm: "ES256",
+    key: key.key,
+    signingInput: encoder.encode(`${parts[0]}.${parts[1]}`),
+    signature
+  });
+  if (!verified) throw new Error("Signed experience artifact signature is invalid.");
+  return payload;
+}
+async function verifySignedExperienceRelease(input) {
+  const payload = await verifySignedExperienceArtifact({
+    compactJws: input.compactJws,
+    expectedType: "fabric-experience-release+jws",
+    crypto: input.crypto,
+    trust: input.trust,
+    ...input.maxBytes === void 0 ? {} : { maxBytes: input.maxBytes }
+  });
+  assertSduiReleaseV3(payload);
+  if (payload.issuer !== input.expected.issuer || payload.application !== input.expected.application || payload.assemblyDigest !== input.expected.assemblyDigest) {
+    throw new Error("Signed experience release does not match the expected issuer, application, and assembly.");
+  }
+  const { releaseDigest, ...body } = payload;
+  const digest = await input.crypto.digestSha256(encoder.encode(canonicalizeJcs(body)));
+  const expectedDigest = [...digest].map((byte) => byte.toString(16).padStart(2, "0")).join("");
+  if (releaseDigest !== expectedDigest) throw new Error("Signed experience release digest does not match its canonical content.");
+  return payload;
+}
+function assertSduiReleaseV3(value) {
+  if (!value || typeof value !== "object" || Array.isArray(value)) throw new Error("SDUI Release v3 must be an object.");
+  const release = value;
+  if (release.formatVersion !== SDUI_RELEASE_V3_FORMAT_VERSION || release.kind !== "experience-release") {
+    throw new Error("SDUI Release v3 has an unsupported format.");
+  }
+  for (const field of ["issuer", "application", "releaseDigest", "assemblyDigest"]) {
+    if (typeof release[field] !== "string" || !release[field]) throw new Error(`SDUI Release v3 ${field} is required.`);
+  }
+  if (!HEX_DIGEST.test(release.releaseDigest) || !HEX_DIGEST.test(release.assemblyDigest)) {
+    throw new Error("SDUI Release v3 digests must be lowercase SHA-256 values.");
+  }
+  if (!release.document || typeof release.document !== "object" || !release.tokenSet || typeof release.tokenSet !== "object" || !Array.isArray(release.componentPacks) || !release.routes || typeof release.routes !== "object" || !Array.isArray(release.routes.views) || !Array.isArray(release.routes.intents) || !Array.isArray(release.effectiveGrants)) {
+    throw new Error("SDUI Release v3 is structurally incomplete.");
+  }
+  const routes = release.routes;
+  assertUniqueRecords(routes.views, "view route", (route) => {
+    const record = assertRecord(route, "view route");
+    assertCapabilityReference(record.reference, "view route");
+    assertNonEmptyString(record.name, "view route name");
+    assertNonEmptyString(record.version, "view route version");
+    if (record.parameterSchemaDigest !== void 0) {
+      assertHexDigest(record.parameterSchemaDigest, "view route parameterSchemaDigest");
+    }
+    return record.reference;
+  });
+  assertUniqueRecords(routes.intents, "intent route", (route) => {
+    const record = assertRecord(route, "intent route");
+    assertCapabilityReference(record.reference, "intent route");
+    assertNonEmptyString(record.actionId, "intent route actionId");
+    if (!Number.isSafeInteger(record.version) || record.version < 1) {
+      throw new Error("SDUI Release v3 intent route version must be a positive integer.");
+    }
+    if (record.parameterSchemaDigest !== void 0) {
+      assertHexDigest(record.parameterSchemaDigest, "intent route parameterSchemaDigest");
+    }
+    return record.reference;
+  });
+  assertUniqueRecords(release.effectiveGrants, "effective grant", (grant) => {
+    const record = assertRecord(grant, "effective grant");
+    assertNonEmptyString(record.treeId, "effective grant treeId");
+    assertNonEmptyString(record.fragmentId, "effective grant fragmentId");
+    if (!Array.isArray(record.views) || !record.views.every((item) => typeof item === "string") || !Array.isArray(record.intents) || !record.intents.every((item) => typeof item === "string")) {
+      throw new Error("SDUI Release v3 effective grant routes must be string arrays.");
+    }
+    return `${record.treeId}\0${record.fragmentId}`;
+  });
+}
+function assertRecord(value, label) {
+  if (!value || typeof value !== "object" || Array.isArray(value)) throw new Error(`SDUI Release v3 ${label} must be an object.`);
+  return value;
+}
+function assertNonEmptyString(value, label) {
+  if (typeof value !== "string" || !value) throw new Error(`SDUI Release v3 ${label} is required.`);
+}
+function assertHexDigest(value, label) {
+  if (typeof value !== "string" || !HEX_DIGEST.test(value)) throw new Error(`SDUI Release v3 ${label} must be a lowercase SHA-256 value.`);
+}
+function assertCapabilityReference(value, label) {
+  if (typeof value !== "string" || !value.startsWith("capability://")) throw new Error(`SDUI Release v3 ${label} reference is invalid.`);
+}
+function assertUniqueRecords(values, label, identity) {
+  const seen = /* @__PURE__ */ new Set();
+  for (const value of values) {
+    const key = identity(value);
+    if (seen.has(key)) throw new Error(`SDUI Release v3 has a duplicate ${label}.`);
+    seen.add(key);
+  }
+}
+async function activateReleaseChannelPointer(input) {
+  const payload = await verifySignedExperienceArtifact({
+    compactJws: input.compactJws,
+    expectedType: "fabric-release-channel-pointer+jws",
+    crypto: input.crypto,
+    trust: input.trust
+  });
+  assertReleaseChannelPointer(payload);
+  if (payload.issuer !== input.expected.issuer || payload.application !== input.expected.application || payload.channel !== input.expected.channel) {
+    throw new Error("Release channel pointer does not match the expected issuer, application, and channel.");
+  }
+  const now = (input.now ?? /* @__PURE__ */ new Date()).getTime();
+  if (payload.notBefore !== void 0 && now < parseTimestamp(payload.notBefore, "notBefore")) {
+    throw new Error("Release channel pointer is not active yet.");
+  }
+  if (payload.expiresAt !== void 0 && now >= parseTimestamp(payload.expiresAt, "expiresAt")) {
+    throw new Error("Release channel pointer has expired.");
+  }
+  const generationKey = `${payload.issuer}:${payload.application}:${payload.channel}`;
+  const pointerDigestBytes = await input.crypto.digestSha256(encoder.encode(canonicalizeJcs(payload)));
+  const pointerDigest = [...pointerDigestBytes].map((byte) => byte.toString(16).padStart(2, "0")).join("");
+  const current = await input.generations.get(generationKey);
+  if (current !== void 0 && payload.generation < current.generation) {
+    throw new Error("Release channel pointer is older than the accepted generation.");
+  }
+  if (current?.generation === payload.generation && current.pointerDigest !== pointerDigest) {
+    throw new Error("Release channel generation is already bound to a different signed pointer.");
+  }
+  if (current?.generation !== payload.generation) {
+    const accepted = await input.generations.acceptIfHigher(generationKey, payload.generation, pointerDigest);
+    if (!accepted) {
+      const raced = await input.generations.get(generationKey);
+      if (raced?.generation !== payload.generation || raced.pointerDigest !== pointerDigest) {
+        throw new Error("Release channel pointer lost an activation race to a different generation.");
+      }
+    }
+  }
+  return payload;
+}
+function assertReleaseChannelPointer(value) {
+  if (!value || typeof value !== "object" || Array.isArray(value)) throw new Error("Release channel pointer must be an object.");
+  const pointer = value;
+  if (pointer.formatVersion !== RELEASE_CHANNEL_POINTER_FORMAT_VERSION || pointer.kind !== "release-channel-pointer") {
+    throw new Error("Release channel pointer has an unsupported format.");
+  }
+  for (const field of ["issuer", "application", "channel", "issuedAt"]) {
+    if (typeof pointer[field] !== "string" || !pointer[field]) throw new Error(`Release channel pointer ${field} is required.`);
+  }
+  if (!Number.isSafeInteger(pointer.generation) || pointer.generation < 0) throw new Error("Release channel pointer generation must be a non-negative safe integer.");
+  if (!HEX_DIGEST.test(String(pointer.activeReleaseDigest)) || !HEX_DIGEST.test(String(pointer.assemblyDigest))) {
+    throw new Error("Release channel pointer digests must be lowercase SHA-256 values.");
+  }
+  if (pointer.fallbackReleaseDigests !== void 0 && (!Array.isArray(pointer.fallbackReleaseDigests) || !pointer.fallbackReleaseDigests.every((digest) => typeof digest === "string" && HEX_DIGEST.test(digest)) || new Set(pointer.fallbackReleaseDigests).size !== pointer.fallbackReleaseDigests.length)) {
+    throw new Error("Release channel pointer fallbackReleaseDigests must contain unique lowercase SHA-256 values.");
+  }
+  parseTimestamp(pointer.issuedAt, "issuedAt");
+}
+function parseSegment(segment, label) {
+  return parseJsonBytes(decodeBase64Url(segment), label);
+}
+function parseJsonBytes(bytes, label) {
+  let value;
+  try {
+    value = JSON.parse(decoder.decode(bytes));
+  } catch {
+    throw new Error(`Signed experience artifact ${label} is not valid UTF-8 JSON.`);
+  }
+  if (!value || typeof value !== "object" || Array.isArray(value)) throw new Error(`Signed experience artifact ${label} must be an object.`);
+  return value;
+}
+function decodeBase64Url(value) {
+  if (!/^[A-Za-z0-9_-]+$/.test(value)) throw new Error("Signed experience artifact contains invalid base64url.");
+  const padded = value.replace(/-/g, "+").replace(/_/g, "/").padEnd(Math.ceil(value.length / 4) * 4, "=");
+  let binary;
+  try {
+    binary = atob(padded);
+  } catch {
+    throw new Error("Signed experience artifact contains invalid base64url.");
+  }
+  return Uint8Array.from(binary, (character) => character.charCodeAt(0));
+}
+function parseTimestamp(value, field) {
+  if (!/(?:Z|[+-]\d{2}:\d{2})$/.test(value)) throw new Error(`Release channel pointer ${field} must be RFC 3339 with an explicit offset.`);
+  const parsed = Date.parse(value);
+  if (Number.isNaN(parsed)) throw new Error(`Release channel pointer ${field} is invalid.`);
+  return parsed;
+}
+
+export {
+  SDUI_RELEASE_V3_FORMAT_VERSION,
+  RELEASE_CHANNEL_POINTER_FORMAT_VERSION,
+  canonicalizeJcs,
+  verifySignedExperienceArtifact,
+  verifySignedExperienceRelease,
+  assertSduiReleaseV3,
+  activateReleaseChannelPointer,
+  assertReleaseChannelPointer
+};
+//# sourceMappingURL=chunk-BTWHVBZ3.js.map

package/dist/chunk-BTWHVBZ3.js.map

@@ -0,0 +1 @@
+{"version":3,"sources":["../contracts.ts"],"sourcesContent":["import type { ActionExecutionContract, PortableJsonSchema } from \"@fabricorg/platform\";\nimport type { SduiDocument, SduiTokenSet, ResolvedSduiComponentPack } from \"./types\";\nexport type {\n\tSduiActionRef,\n\tSduiDocument,\n\tSduiFragment,\n\tSduiFragmentValue,\n\tSduiTokenSet,\n\tResolvedSduiComponentPack,\n} from \"./types\";\n\nexport const SDUI_RELEASE_V3_FORMAT_VERSION = 3 as const;\nexport const RELEASE_CHANNEL_POINTER_FORMAT_VERSION = 1 as const;\n\nexport interface ExperienceViewRoute {\n\treference: `capability://${string}`;\n\tname: `${string}/${string}`;\n\tversion: string;\n\tparameterSchema?: PortableJsonSchema;\n\tparameterSchemaDigest?: string;\n}\n\nexport interface ExperienceIntentRoute {\n\treference: `capability://${string}`;\n\tactionId: `${string}.${string}`;\n\tversion: number;\n\tparameterSchema?: PortableJsonSchema;\n\tparameterSchemaDigest?: string;\n\texecution?: ActionExecutionContract;\n}\n\nexport interface EffectiveFragmentGrant {\n\ttreeId: \"root\" | string;\n\tfragmentId: string;\n\tviews: readonly string[];\n\tintents: readonly string[];\n}\n\nexport interface SduiReleaseV3 {\n\tformatVersion: typeof SDUI_RELEASE_V3_FORMAT_VERSION;\n\tkind: \"experience-release\";\n\tissuer: string;\n\tapplication: string;\n\treleaseDigest: string;\n\tassemblyDigest: string;\n\tdocument: SduiDocument;\n\ttokenSet: SduiTokenSet;\n\tcomponentPacks: ResolvedSduiComponentPack[];\n\troutes: {\n\t\tviews: ExperienceViewRoute[];\n\t\tintents: ExperienceIntentRoute[];\n\t};\n\teffectiveGrants: EffectiveFragmentGrant[];\n}\n\nexport interface ReleaseChannelPointer {\n\tformatVersion: typeof RELEASE_CHANNEL_POINTER_FORMAT_VERSION;\n\tkind: \"release-channel-pointer\";\n\tissuer: string;\n\tapplication: string;\n\tchannel: string;\n\tgeneration: number;\n\tactiveReleaseDigest: string;\n\tassemblyDigest: string;\n\tissuedAt: string;\n\tnotBefore?: string;\n\texpiresAt?: string;\n\tfallbackReleaseDigests?: readonly string[];\n}\n\nexport interface ReleaseVerificationKey {\n\tkeyId: string;\n\talgorithm: \"ES256\";\n\tkey: unknown;\n}\n\nexport interface ReleaseTrustStore {\n\tresolveKey(input: { keyId: string; issuer: string; algorithm: \"ES256\" }): ReleaseVerificationKey | undefined | Promise<ReleaseVerificationKey | undefined>;\n}\n\nexport interface ReleaseCryptoPort {\n\tverify(input: {\n\t\talgorithm: \"ES256\";\n\t\tkey: unknown;\n\t\tsigningInput: Uint8Array;\n\t\tsignature: Uint8Array;\n\t}): Promise<boolean>;\n\tdigestSha256(bytes: Uint8Array): Promise<Uint8Array>;\n}\n\nexport interface ReleaseGenerationStore {\n\tget(key: string): Promise<{ generation: number; pointerDigest: string } | undefined>;\n\t/**\n\t * Atomically accepts `generation` only when it is greater than the stored\n\t * value for `key`. Implementations must compare and write in one operation.\n\t */\n\tacceptIfHigher(key: string, generation: number, pointerDigest: string): Promise<boolean>;\n}\n\nexport interface VerifySignedExperienceArtifactInput {\n\tcompactJws: string;\n\texpectedType: \"fabric-experience-release+jws\" | \"fabric-release-channel-pointer+jws\";\n\tcrypto: ReleaseCryptoPort;\n\ttrust: ReleaseTrustStore;\n\tmaxBytes?: number;\n}\n\nconst encoder = new TextEncoder();\nconst decoder = new TextDecoder(\"utf-8\", { fatal: true });\nconst HEX_DIGEST = /^[a-f0-9]{64}$/;\n\n/**\n * RFC 8785 JSON Canonicalization Scheme for values already restricted to the\n * JSON data model. Invalid Unicode, non-finite numbers and non-JSON values are\n * rejected rather than normalized differently by another runtime.\n */\nexport function canonicalizeJcs(value: unknown): string {\n\treturn canonical(value, 0);\n}\n\nfunction canonical(value: unknown, depth: number): string {\n\tif (depth > 64) throw new Error(\"Canonical JSON exceeds the maximum depth of 64.\");\n\tif (value === null) return \"null\";\n\tif (typeof value === \"boolean\") return value ? \"true\" : \"false\";\n\tif (typeof value === \"number\") {\n\t\tif (!Number.isFinite(value)) throw new Error(\"Canonical JSON numbers must be finite.\");\n\t\treturn Object.is(value, -0) ? \"0\" : JSON.stringify(value);\n\t}\n\tif (typeof value === \"string\") {\n\t\tassertValidUnicode(value);\n\t\treturn JSON.stringify(value);\n\t}\n\tif (Array.isArray(value)) return `[${value.map((entry) => canonical(entry, depth + 1)).join(\",\")}]`;\n\tif (typeof value !== \"object\") throw new Error(`Canonical JSON cannot encode ${typeof value}.`);\n\tconst record = value as Record<string, unknown>;\n\tconst keys = Object.keys(record).sort();\n\treturn `{${keys.map((key) => {\n\t\tassertValidUnicode(key);\n\t\treturn `${JSON.stringify(key)}:${canonical(record[key], depth + 1)}`;\n\t}).join(\",\")}}`;\n}\n\nfunction assertValidUnicode(value: string): void {\n\tfor (let index = 0; index < value.length; index += 1) {\n\t\tconst code = value.charCodeAt(index);\n\t\tif (code >= 0xd800 && code <= 0xdbff) {\n\t\t\tconst next = value.charCodeAt(index + 1);\n\t\t\tif (!(next >= 0xdc00 && next <= 0xdfff)) throw new Error(\"Canonical JSON contains an unpaired Unicode surrogate.\");\n\t\t\tindex += 1;\n\t\t} else if (code >= 0xdc00 && code <= 0xdfff) {\n\t\t\tthrow new Error(\"Canonical JSON contains an unpaired Unicode surrogate.\");\n\t\t}\n\t}\n}\n\nexport async function verifySignedExperienceArtifact(\n\tinput: VerifySignedExperienceArtifactInput,\n): Promise<Record<string, unknown>> {\n\tconst maxBytes = input.maxBytes ?? 1_048_576;\n\tif (encoder.encode(input.compactJws).byteLength > maxBytes) {\n\t\tthrow new Error(`Signed experience artifact exceeds the ${maxBytes}-byte size limit.`);\n\t}\n\tconst parts = input.compactJws.split(\".\");\n\tif (parts.length !== 3 || parts.some((part) => part.length === 0)) throw new Error(\"Signed experience artifact must be a compact JWS.\");\n\tconst header = parseSegment(parts[0]!, \"protected header\");\n\tif (header.alg !== \"ES256\") throw new Error(\"Signed experience artifacts must use ES256.\");\n\tif (header.typ !== input.expectedType) throw new Error(`Signed experience artifact type must be ${input.expectedType}.`);\n\tif (typeof header.kid !== \"string\" || !header.kid) throw new Error(\"Signed experience artifact requires a key id.\");\n\tconst payloadBytes = decodeBase64Url(parts[1]!);\n\tconst payload = parseJsonBytes(payloadBytes, \"payload\");\n\tif (typeof payload.issuer !== \"string\" || !payload.issuer) throw new Error(\"Signed experience artifact requires an issuer.\");\n\tconst key = await input.trust.resolveKey({ keyId: header.kid, issuer: payload.issuer, algorithm: \"ES256\" });\n\tif (!key || key.algorithm !== \"ES256\") throw new Error(\"Signed experience artifact has no trusted key.\");\n\tconst signature = decodeBase64Url(parts[2]!);\n\tif (signature.byteLength !== 64) throw new Error(\"ES256 signatures must be 64-byte JOSE signatures.\");\n\tconst verified = await input.crypto.verify({\n\t\talgorithm: \"ES256\",\n\t\tkey: key.key,\n\t\tsigningInput: encoder.encode(`${parts[0]}.${parts[1]}`),\n\t\tsignature,\n\t});\n\tif (!verified) throw new Error(\"Signed experience artifact signature is invalid.\");\n\treturn payload;\n}\n\nexport async function verifySignedExperienceRelease(input: {\n\tcompactJws: string;\n\tcrypto: ReleaseCryptoPort;\n\ttrust: ReleaseTrustStore;\n\texpected: { issuer: string; application: string; assemblyDigest: string };\n\tmaxBytes?: number;\n}): Promise<SduiReleaseV3> {\n\tconst payload = await verifySignedExperienceArtifact({\n\t\tcompactJws: input.compactJws,\n\t\texpectedType: \"fabric-experience-release+jws\",\n\t\tcrypto: input.crypto,\n\t\ttrust: input.trust,\n\t\t...(input.maxBytes === undefined ? {} : { maxBytes: input.maxBytes }),\n\t});\n\tassertSduiReleaseV3(payload);\n\tif (payload.issuer !== input.expected.issuer\n\t\t|| payload.application !== input.expected.application\n\t\t|| payload.assemblyDigest !== input.expected.assemblyDigest) {\n\t\tthrow new Error(\"Signed experience release does not match the expected issuer, application, and assembly.\");\n\t}\n\tconst { releaseDigest, ...body } = payload;\n\tconst digest = await input.crypto.digestSha256(encoder.encode(canonicalizeJcs(body)));\n\tconst expectedDigest = [...digest].map((byte) => byte.toString(16).padStart(2, \"0\")).join(\"\");\n\tif (releaseDigest !== expectedDigest) throw new Error(\"Signed experience release digest does not match its canonical content.\");\n\treturn payload;\n}\n\nexport function assertSduiReleaseV3(value: unknown): asserts value is SduiReleaseV3 {\n\tif (!value || typeof value !== \"object\" || Array.isArray(value)) throw new Error(\"SDUI Release v3 must be an object.\");\n\tconst release = value as Record<string, unknown>;\n\tif (release.formatVersion !== SDUI_RELEASE_V3_FORMAT_VERSION || release.kind !== \"experience-release\") {\n\t\tthrow new Error(\"SDUI Release v3 has an unsupported format.\");\n\t}\n\tfor (const field of [\"issuer\", \"application\", \"releaseDigest\", \"assemblyDigest\"] as const) {\n\t\tif (typeof release[field] !== \"string\" || !release[field]) throw new Error(`SDUI Release v3 ${field} is required.`);\n\t}\n\tif (!HEX_DIGEST.test(release.releaseDigest as string) || !HEX_DIGEST.test(release.assemblyDigest as string)) {\n\t\tthrow new Error(\"SDUI Release v3 digests must be lowercase SHA-256 values.\");\n\t}\n\tif (!release.document || typeof release.document !== \"object\"\n\t\t|| !release.tokenSet || typeof release.tokenSet !== \"object\"\n\t\t|| !Array.isArray(release.componentPacks)\n\t\t|| !release.routes || typeof release.routes !== \"object\"\n\t\t|| !Array.isArray((release.routes as Record<string, unknown>).views)\n\t\t|| !Array.isArray((release.routes as Record<string, unknown>).intents)\n\t\t|| !Array.isArray(release.effectiveGrants)) {\n\t\tthrow new Error(\"SDUI Release v3 is structurally incomplete.\");\n\t}\n\tconst routes = release.routes as { views: unknown[]; intents: unknown[] };\n\tassertUniqueRecords(routes.views, \"view route\", (route) => {\n\t\tconst record = assertRecord(route, \"view route\");\n\t\tassertCapabilityReference(record.reference, \"view route\");\n\t\tassertNonEmptyString(record.name, \"view route name\");\n\t\tassertNonEmptyString(record.version, \"view route version\");\n\t\tif (record.parameterSchemaDigest !== undefined) {\n\t\t\tassertHexDigest(record.parameterSchemaDigest, \"view route parameterSchemaDigest\");\n\t\t}\n\t\treturn record.reference as string;\n\t});\n\tassertUniqueRecords(routes.intents, \"intent route\", (route) => {\n\t\tconst record = assertRecord(route, \"intent route\");\n\t\tassertCapabilityReference(record.reference, \"intent route\");\n\t\tassertNonEmptyString(record.actionId, \"intent route actionId\");\n\t\tif (!Number.isSafeInteger(record.version) || (record.version as number) < 1) {\n\t\t\tthrow new Error(\"SDUI Release v3 intent route version must be a positive integer.\");\n\t\t}\n\t\tif (record.parameterSchemaDigest !== undefined) {\n\t\t\tassertHexDigest(record.parameterSchemaDigest, \"intent route parameterSchemaDigest\");\n\t\t}\n\t\treturn record.reference as string;\n\t});\n\tassertUniqueRecords(release.effectiveGrants as unknown[], \"effective grant\", (grant) => {\n\t\tconst record = assertRecord(grant, \"effective grant\");\n\t\tassertNonEmptyString(record.treeId, \"effective grant treeId\");\n\t\tassertNonEmptyString(record.fragmentId, \"effective grant fragmentId\");\n\t\tif (!Array.isArray(record.views) || !record.views.every((item) => typeof item === \"string\")\n\t\t\t|| !Array.isArray(record.intents) || !record.intents.every((item) => typeof item === \"string\")) {\n\t\t\tthrow new Error(\"SDUI Release v3 effective grant routes must be string arrays.\");\n\t\t}\n\t\treturn `${record.treeId as string}\\0${record.fragmentId as string}`;\n\t});\n}\n\nfunction assertRecord(value: unknown, label: string): Record<string, unknown> {\n\tif (!value || typeof value !== \"object\" || Array.isArray(value)) throw new Error(`SDUI Release v3 ${label} must be an object.`);\n\treturn value as Record<string, unknown>;\n}\n\nfunction assertNonEmptyString(value: unknown, label: string): asserts value is string {\n\tif (typeof value !== \"string\" || !value) throw new Error(`SDUI Release v3 ${label} is required.`);\n}\n\nfunction assertHexDigest(value: unknown, label: string): asserts value is string {\n\tif (typeof value !== \"string\" || !HEX_DIGEST.test(value)) throw new Error(`SDUI Release v3 ${label} must be a lowercase SHA-256 value.`);\n}\n\nfunction assertCapabilityReference(value: unknown, label: string): asserts value is `capability://${string}` {\n\tif (typeof value !== \"string\" || !value.startsWith(\"capability://\")) throw new Error(`SDUI Release v3 ${label} reference is invalid.`);\n}\n\nfunction assertUniqueRecords(values: unknown[], label: string, identity: (value: unknown) => string): void {\n\tconst seen = new Set<string>();\n\tfor (const value of values) {\n\t\tconst key = identity(value);\n\t\tif (seen.has(key)) throw new Error(`SDUI Release v3 has a duplicate ${label}.`);\n\t\tseen.add(key);\n\t}\n}\n\nexport async function activateReleaseChannelPointer(input: {\n\tcompactJws: string;\n\tcrypto: ReleaseCryptoPort;\n\ttrust: ReleaseTrustStore;\n\tgenerations: ReleaseGenerationStore;\n\texpected: { issuer: string; application: string; channel: string };\n\tnow?: Date;\n}): Promise<ReleaseChannelPointer> {\n\tconst payload = await verifySignedExperienceArtifact({\n\t\tcompactJws: input.compactJws,\n\t\texpectedType: \"fabric-release-channel-pointer+jws\",\n\t\tcrypto: input.crypto,\n\t\ttrust: input.trust,\n\t});\n\tassertReleaseChannelPointer(payload);\n\tif (payload.issuer !== input.expected.issuer\n\t\t|| payload.application !== input.expected.application\n\t\t|| payload.channel !== input.expected.channel) {\n\t\tthrow new Error(\"Release channel pointer does not match the expected issuer, application, and channel.\");\n\t}\n\tconst now = (input.now ?? new Date()).getTime();\n\tif (payload.notBefore !== undefined && now < parseTimestamp(payload.notBefore, \"notBefore\")) {\n\t\tthrow new Error(\"Release channel pointer is not active yet.\");\n\t}\n\tif (payload.expiresAt !== undefined && now >= parseTimestamp(payload.expiresAt, \"expiresAt\")) {\n\t\tthrow new Error(\"Release channel pointer has expired.\");\n\t}\n\tconst generationKey = `${payload.issuer}:${payload.application}:${payload.channel}`;\n\tconst pointerDigestBytes = await input.crypto.digestSha256(encoder.encode(canonicalizeJcs(payload)));\n\tconst pointerDigest = [...pointerDigestBytes].map((byte) => byte.toString(16).padStart(2, \"0\")).join(\"\");\n\tconst current = await input.generations.get(generationKey);\n\tif (current !== undefined && payload.generation < current.generation) {\n\t\tthrow new Error(\"Release channel pointer is older than the accepted generation.\");\n\t}\n\tif (current?.generation === payload.generation && current.pointerDigest !== pointerDigest) {\n\t\tthrow new Error(\"Release channel generation is already bound to a different signed pointer.\");\n\t}\n\tif (current?.generation !== payload.generation) {\n\t\tconst accepted = await input.generations.acceptIfHigher(generationKey, payload.generation, pointerDigest);\n\t\tif (!accepted) {\n\t\t\tconst raced = await input.generations.get(generationKey);\n\t\t\tif (raced?.generation !== payload.generation || raced.pointerDigest !== pointerDigest) {\n\t\t\t\tthrow new Error(\"Release channel pointer lost an activation race to a different generation.\");\n\t\t\t}\n\t\t}\n\t}\n\treturn payload;\n}\n\nexport function assertReleaseChannelPointer(value: unknown): asserts value is ReleaseChannelPointer {\n\tif (!value || typeof value !== \"object\" || Array.isArray(value)) throw new Error(\"Release channel pointer must be an object.\");\n\tconst pointer = value as Record<string, unknown>;\n\tif (pointer.formatVersion !== RELEASE_CHANNEL_POINTER_FORMAT_VERSION || pointer.kind !== \"release-channel-pointer\") {\n\t\tthrow new Error(\"Release channel pointer has an unsupported format.\");\n\t}\n\tfor (const field of [\"issuer\", \"application\", \"channel\", \"issuedAt\"] as const) {\n\t\tif (typeof pointer[field] !== \"string\" || !pointer[field]) throw new Error(`Release channel pointer ${field} is required.`);\n\t}\n\tif (!Number.isSafeInteger(pointer.generation) || (pointer.generation as number) < 0) throw new Error(\"Release channel pointer generation must be a non-negative safe integer.\");\n\tif (!HEX_DIGEST.test(String(pointer.activeReleaseDigest)) || !HEX_DIGEST.test(String(pointer.assemblyDigest))) {\n\t\tthrow new Error(\"Release channel pointer digests must be lowercase SHA-256 values.\");\n\t}\n\tif (pointer.fallbackReleaseDigests !== undefined\n\t\t&& (!Array.isArray(pointer.fallbackReleaseDigests)\n\t\t\t|| !pointer.fallbackReleaseDigests.every((digest) => typeof digest === \"string\" && HEX_DIGEST.test(digest))\n\t\t\t|| new Set(pointer.fallbackReleaseDigests).size !== pointer.fallbackReleaseDigests.length)) {\n\t\tthrow new Error(\"Release channel pointer fallbackReleaseDigests must contain unique lowercase SHA-256 values.\");\n\t}\n\tparseTimestamp(pointer.issuedAt as string, \"issuedAt\");\n}\n\nfunction parseSegment(segment: string, label: string): Record<string, unknown> {\n\treturn parseJsonBytes(decodeBase64Url(segment), label);\n}\n\nfunction parseJsonBytes(bytes: Uint8Array, label: string): Record<string, unknown> {\n\tlet value: unknown;\n\ttry { value = JSON.parse(decoder.decode(bytes)); }\n\tcatch { throw new Error(`Signed experience artifact ${label} is not valid UTF-8 JSON.`); }\n\tif (!value || typeof value !== \"object\" || Array.isArray(value)) throw new Error(`Signed experience artifact ${label} must be an object.`);\n\treturn value as Record<string, unknown>;\n}\n\nfunction decodeBase64Url(value: string): Uint8Array {\n\tif (!/^[A-Za-z0-9_-]+$/.test(value)) throw new Error(\"Signed experience artifact contains invalid base64url.\");\n\tconst padded = value.replace(/-/g, \"+\").replace(/_/g, \"/\").padEnd(Math.ceil(value.length / 4) * 4, \"=\");\n\tlet binary: string;\n\ttry { binary = atob(padded); }\n\tcatch { throw new Error(\"Signed experience artifact contains invalid base64url.\"); }\n\treturn Uint8Array.from(binary, (character) => character.charCodeAt(0));\n}\n\nfunction parseTimestamp(value: string, field: string): number {\n\tif (!/(?:Z|[+-]\\d{2}:\\d{2})$/.test(value)) throw new Error(`Release channel pointer ${field} must be RFC 3339 with an explicit offset.`);\n\tconst parsed = Date.parse(value);\n\tif (Number.isNaN(parsed)) throw new Error(`Release channel pointer ${field} is invalid.`);\n\treturn parsed;\n}\n"],"mappings":";AAWO,IAAM,iCAAiC;AACvC,IAAM,yCAAyC;AA+FtD,IAAM,UAAU,IAAI,YAAY;AAChC,IAAM,UAAU,IAAI,YAAY,SAAS,EAAE,OAAO,KAAK,CAAC;AACxD,IAAM,aAAa;AAOZ,SAAS,gBAAgB,OAAwB;AACvD,SAAO,UAAU,OAAO,CAAC;AAC1B;AAEA,SAAS,UAAU,OAAgB,OAAuB;AACzD,MAAI,QAAQ,GAAI,OAAM,IAAI,MAAM,iDAAiD;AACjF,MAAI,UAAU,KAAM,QAAO;AAC3B,MAAI,OAAO,UAAU,UAAW,QAAO,QAAQ,SAAS;AACxD,MAAI,OAAO,UAAU,UAAU;AAC9B,QAAI,CAAC,OAAO,SAAS,KAAK,EAAG,OAAM,IAAI,MAAM,wCAAwC;AACrF,WAAO,OAAO,GAAG,OAAO,EAAE,IAAI,MAAM,KAAK,UAAU,KAAK;AAAA,EACzD;AACA,MAAI,OAAO,UAAU,UAAU;AAC9B,uBAAmB,KAAK;AACxB,WAAO,KAAK,UAAU,KAAK;AAAA,EAC5B;AACA,MAAI,MAAM,QAAQ,KAAK,EAAG,QAAO,IAAI,MAAM,IAAI,CAAC,UAAU,UAAU,OAAO,QAAQ,CAAC,CAAC,EAAE,KAAK,GAAG,CAAC;AAChG,MAAI,OAAO,UAAU,SAAU,OAAM,IAAI,MAAM,gCAAgC,OAAO,KAAK,GAAG;AAC9F,QAAM,SAAS;AACf,QAAM,OAAO,OAAO,KAAK,MAAM,EAAE,KAAK;AACtC,SAAO,IAAI,KAAK,IAAI,CAAC,QAAQ;AAC5B,uBAAmB,GAAG;AACtB,WAAO,GAAG,KAAK,UAAU,GAAG,CAAC,IAAI,UAAU,OAAO,GAAG,GAAG,QAAQ,CAAC,CAAC;AAAA,EACnE,CAAC,EAAE,KAAK,GAAG,CAAC;AACb;AAEA,SAAS,mBAAmB,OAAqB;AAChD,WAAS,QAAQ,GAAG,QAAQ,MAAM,QAAQ,SAAS,GAAG;AACrD,UAAM,OAAO,MAAM,WAAW,KAAK;AACnC,QAAI,QAAQ,SAAU,QAAQ,OAAQ;AACrC,YAAM,OAAO,MAAM,WAAW,QAAQ,CAAC;AACvC,UAAI,EAAE,QAAQ,SAAU,QAAQ,OAAS,OAAM,IAAI,MAAM,wDAAwD;AACjH,eAAS;AAAA,IACV,WAAW,QAAQ,SAAU,QAAQ,OAAQ;AAC5C,YAAM,IAAI,MAAM,wDAAwD;AAAA,IACzE;AAAA,EACD;AACD;AAEA,eAAsB,+BACrB,OACmC;AACnC,QAAM,WAAW,MAAM,YAAY;AACnC,MAAI,QAAQ,OAAO,MAAM,UAAU,EAAE,aAAa,UAAU;AAC3D,UAAM,IAAI,MAAM,0CAA0C,QAAQ,mBAAmB;AAAA,EACtF;AACA,QAAM,QAAQ,MAAM,WAAW,MAAM,GAAG;AACxC,MAAI,MAAM,WAAW,KAAK,MAAM,KAAK,CAAC,SAAS,KAAK,WAAW,CAAC,EAAG,OAAM,IAAI,MAAM,mDAAmD;AACtI,QAAM,SAAS,aAAa,MAAM,CAAC,GAAI,kBAAkB;AACzD,MAAI,OAAO,QAAQ,QAAS,OAAM,IAAI,MAAM,6CAA6C;AACzF,MAAI,OAAO,QAAQ,MAAM,aAAc,OAAM,IAAI,MAAM,2CAA2C,MAAM,YAAY,GAAG;AACvH,MAAI,OAAO,OAAO,QAAQ,YAAY,CAAC,OAAO,IAAK,OAAM,IAAI,MAAM,+CAA+C;AAClH,QAAM,eAAe,gBAAgB,MAAM,CAAC,CAAE;AAC9C,QAAM,UAAU,eAAe,cAAc,SAAS;AACtD,MAAI,OAAO,QAAQ,WAAW,YAAY,CAAC,QAAQ,OAAQ,OAAM,IAAI,MAAM,gDAAgD;AAC3H,QAAM,MAAM,MAAM,MAAM,MAAM,WAAW,EAAE,OAAO,OAAO,KAAK,QAAQ,QAAQ,QAAQ,WAAW,QAAQ,CAAC;AAC1G,MAAI,CAAC,OAAO,IAAI,cAAc,QAAS,OAAM,IAAI,MAAM,gDAAgD;AACvG,QAAM,YAAY,gBAAgB,MAAM,CAAC,CAAE;AAC3C,MAAI,UAAU,eAAe,GAAI,OAAM,IAAI,MAAM,mDAAmD;AACpG,QAAM,WAAW,MAAM,MAAM,OAAO,OAAO;AAAA,IAC1C,WAAW;AAAA,IACX,KAAK,IAAI;AAAA,IACT,cAAc,QAAQ,OAAO,GAAG,MAAM,CAAC,CAAC,IAAI,MAAM,CAAC,CAAC,EAAE;AAAA,IACtD;AAAA,EACD,CAAC;AACD,MAAI,CAAC,SAAU,OAAM,IAAI,MAAM,kDAAkD;AACjF,SAAO;AACR;AAEA,eAAsB,8BAA8B,OAMzB;AAC1B,QAAM,UAAU,MAAM,+BAA+B;AAAA,IACpD,YAAY,MAAM;AAAA,IAClB,cAAc;AAAA,IACd,QAAQ,MAAM;AAAA,IACd,OAAO,MAAM;AAAA,IACb,GAAI,MAAM,aAAa,SAAY,CAAC,IAAI,EAAE,UAAU,MAAM,SAAS;AAAA,EACpE,CAAC;AACD,sBAAoB,OAAO;AAC3B,MAAI,QAAQ,WAAW,MAAM,SAAS,UAClC,QAAQ,gBAAgB,MAAM,SAAS,eACvC,QAAQ,mBAAmB,MAAM,SAAS,gBAAgB;AAC7D,UAAM,IAAI,MAAM,0FAA0F;AAAA,EAC3G;AACA,QAAM,EAAE,eAAe,GAAG,KAAK,IAAI;AACnC,QAAM,SAAS,MAAM,MAAM,OAAO,aAAa,QAAQ,OAAO,gBAAgB,IAAI,CAAC,CAAC;AACpF,QAAM,iBAAiB,CAAC,GAAG,MAAM,EAAE,IAAI,CAAC,SAAS,KAAK,SAAS,EAAE,EAAE,SAAS,GAAG,GAAG,CAAC,EAAE,KAAK,EAAE;AAC5F,MAAI,kBAAkB,eAAgB,OAAM,IAAI,MAAM,wEAAwE;AAC9H,SAAO;AACR;AAEO,SAAS,oBAAoB,OAAgD;AACnF,MAAI,CAAC,SAAS,OAAO,UAAU,YAAY,MAAM,QAAQ,KAAK,EAAG,OAAM,IAAI,MAAM,oCAAoC;AACrH,QAAM,UAAU;AAChB,MAAI,QAAQ,kBAAkB,kCAAkC,QAAQ,SAAS,sBAAsB;AACtG,UAAM,IAAI,MAAM,4CAA4C;AAAA,EAC7D;AACA,aAAW,SAAS,CAAC,UAAU,eAAe,iBAAiB,gBAAgB,GAAY;AAC1F,QAAI,OAAO,QAAQ,KAAK,MAAM,YAAY,CAAC,QAAQ,KAAK,EAAG,OAAM,IAAI,MAAM,mBAAmB,KAAK,eAAe;AAAA,EACnH;AACA,MAAI,CAAC,WAAW,KAAK,QAAQ,aAAuB,KAAK,CAAC,WAAW,KAAK,QAAQ,cAAwB,GAAG;AAC5G,UAAM,IAAI,MAAM,2DAA2D;AAAA,EAC5E;AACA,MAAI,CAAC,QAAQ,YAAY,OAAO,QAAQ,aAAa,YACjD,CAAC,QAAQ,YAAY,OAAO,QAAQ,aAAa,YACjD,CAAC,MAAM,QAAQ,QAAQ,cAAc,KACrC,CAAC,QAAQ,UAAU,OAAO,QAAQ,WAAW,YAC7C,CAAC,MAAM,QAAS,QAAQ,OAAmC,KAAK,KAChE,CAAC,MAAM,QAAS,QAAQ,OAAmC,OAAO,KAClE,CAAC,MAAM,QAAQ,QAAQ,eAAe,GAAG;AAC5C,UAAM,IAAI,MAAM,6CAA6C;AAAA,EAC9D;AACA,QAAM,SAAS,QAAQ;AACvB,sBAAoB,OAAO,OAAO,cAAc,CAAC,UAAU;AAC1D,UAAM,SAAS,aAAa,OAAO,YAAY;AAC/C,8BAA0B,OAAO,WAAW,YAAY;AACxD,yBAAqB,OAAO,MAAM,iBAAiB;AACnD,yBAAqB,OAAO,SAAS,oBAAoB;AACzD,QAAI,OAAO,0BAA0B,QAAW;AAC/C,sBAAgB,OAAO,uBAAuB,kCAAkC;AAAA,IACjF;AACA,WAAO,OAAO;AAAA,EACf,CAAC;AACD,sBAAoB,OAAO,SAAS,gBAAgB,CAAC,UAAU;AAC9D,UAAM,SAAS,aAAa,OAAO,cAAc;AACjD,8BAA0B,OAAO,WAAW,cAAc;AAC1D,yBAAqB,OAAO,UAAU,uBAAuB;AAC7D,QAAI,CAAC,OAAO,cAAc,OAAO,OAAO,KAAM,OAAO,UAAqB,GAAG;AAC5E,YAAM,IAAI,MAAM,kEAAkE;AAAA,IACnF;AACA,QAAI,OAAO,0BAA0B,QAAW;AAC/C,sBAAgB,OAAO,uBAAuB,oCAAoC;AAAA,IACnF;AACA,WAAO,OAAO;AAAA,EACf,CAAC;AACD,sBAAoB,QAAQ,iBAA8B,mBAAmB,CAAC,UAAU;AACvF,UAAM,SAAS,aAAa,OAAO,iBAAiB;AACpD,yBAAqB,OAAO,QAAQ,wBAAwB;AAC5D,yBAAqB,OAAO,YAAY,4BAA4B;AACpE,QAAI,CAAC,MAAM,QAAQ,OAAO,KAAK,KAAK,CAAC,OAAO,MAAM,MAAM,CAAC,SAAS,OAAO,SAAS,QAAQ,KACtF,CAAC,MAAM,QAAQ,OAAO,OAAO,KAAK,CAAC,OAAO,QAAQ,MAAM,CAAC,SAAS,OAAO,SAAS,QAAQ,GAAG;AAChG,YAAM,IAAI,MAAM,+DAA+D;AAAA,IAChF;AACA,WAAO,GAAG,OAAO,MAAgB,KAAK,OAAO,UAAoB;AAAA,EAClE,CAAC;AACF;AAEA,SAAS,aAAa,OAAgB,OAAwC;AAC7E,MAAI,CAAC,SAAS,OAAO,UAAU,YAAY,MAAM,QAAQ,KAAK,EAAG,OAAM,IAAI,MAAM,mBAAmB,KAAK,qBAAqB;AAC9H,SAAO;AACR;AAEA,SAAS,qBAAqB,OAAgB,OAAwC;AACrF,MAAI,OAAO,UAAU,YAAY,CAAC,MAAO,OAAM,IAAI,MAAM,mBAAmB,KAAK,eAAe;AACjG;AAEA,SAAS,gBAAgB,OAAgB,OAAwC;AAChF,MAAI,OAAO,UAAU,YAAY,CAAC,WAAW,KAAK,KAAK,EAAG,OAAM,IAAI,MAAM,mBAAmB,KAAK,qCAAqC;AACxI;AAEA,SAAS,0BAA0B,OAAgB,OAA0D;AAC5G,MAAI,OAAO,UAAU,YAAY,CAAC,MAAM,WAAW,eAAe,EAAG,OAAM,IAAI,MAAM,mBAAmB,KAAK,wBAAwB;AACtI;AAEA,SAAS,oBAAoB,QAAmB,OAAe,UAA4C;AAC1G,QAAM,OAAO,oBAAI,IAAY;AAC7B,aAAW,SAAS,QAAQ;AAC3B,UAAM,MAAM,SAAS,KAAK;AAC1B,QAAI,KAAK,IAAI,GAAG,EAAG,OAAM,IAAI,MAAM,mCAAmC,KAAK,GAAG;AAC9E,SAAK,IAAI,GAAG;AAAA,EACb;AACD;AAEA,eAAsB,8BAA8B,OAOjB;AAClC,QAAM,UAAU,MAAM,+BAA+B;AAAA,IACpD,YAAY,MAAM;AAAA,IAClB,cAAc;AAAA,IACd,QAAQ,MAAM;AAAA,IACd,OAAO,MAAM;AAAA,EACd,CAAC;AACD,8BAA4B,OAAO;AACnC,MAAI,QAAQ,WAAW,MAAM,SAAS,UAClC,QAAQ,gBAAgB,MAAM,SAAS,eACvC,QAAQ,YAAY,MAAM,SAAS,SAAS;AAC/C,UAAM,IAAI,MAAM,uFAAuF;AAAA,EACxG;AACA,QAAM,OAAO,MAAM,OAAO,oBAAI,KAAK,GAAG,QAAQ;AAC9C,MAAI,QAAQ,cAAc,UAAa,MAAM,eAAe,QAAQ,WAAW,WAAW,GAAG;AAC5F,UAAM,IAAI,MAAM,4CAA4C;AAAA,EAC7D;AACA,MAAI,QAAQ,cAAc,UAAa,OAAO,eAAe,QAAQ,WAAW,WAAW,GAAG;AAC7F,UAAM,IAAI,MAAM,sCAAsC;AAAA,EACvD;AACA,QAAM,gBAAgB,GAAG,QAAQ,MAAM,IAAI,QAAQ,WAAW,IAAI,QAAQ,OAAO;AACjF,QAAM,qBAAqB,MAAM,MAAM,OAAO,aAAa,QAAQ,OAAO,gBAAgB,OAAO,CAAC,CAAC;AACnG,QAAM,gBAAgB,CAAC,GAAG,kBAAkB,EAAE,IAAI,CAAC,SAAS,KAAK,SAAS,EAAE,EAAE,SAAS,GAAG,GAAG,CAAC,EAAE,KAAK,EAAE;AACvG,QAAM,UAAU,MAAM,MAAM,YAAY,IAAI,aAAa;AACzD,MAAI,YAAY,UAAa,QAAQ,aAAa,QAAQ,YAAY;AACrE,UAAM,IAAI,MAAM,gEAAgE;AAAA,EACjF;AACA,MAAI,SAAS,eAAe,QAAQ,cAAc,QAAQ,kBAAkB,eAAe;AAC1F,UAAM,IAAI,MAAM,4EAA4E;AAAA,EAC7F;AACA,MAAI,SAAS,eAAe,QAAQ,YAAY;AAC/C,UAAM,WAAW,MAAM,MAAM,YAAY,eAAe,eAAe,QAAQ,YAAY,aAAa;AACxG,QAAI,CAAC,UAAU;AACd,YAAM,QAAQ,MAAM,MAAM,YAAY,IAAI,aAAa;AACvD,UAAI,OAAO,eAAe,QAAQ,cAAc,MAAM,kBAAkB,eAAe;AACtF,cAAM,IAAI,MAAM,4EAA4E;AAAA,MAC7F;AAAA,IACD;AAAA,EACD;AACA,SAAO;AACR;AAEO,SAAS,4BAA4B,OAAwD;AACnG,MAAI,CAAC,SAAS,OAAO,UAAU,YAAY,MAAM,QAAQ,KAAK,EAAG,OAAM,IAAI,MAAM,4CAA4C;AAC7H,QAAM,UAAU;AAChB,MAAI,QAAQ,kBAAkB,0CAA0C,QAAQ,SAAS,2BAA2B;AACnH,UAAM,IAAI,MAAM,oDAAoD;AAAA,EACrE;AACA,aAAW,SAAS,CAAC,UAAU,eAAe,WAAW,UAAU,GAAY;AAC9E,QAAI,OAAO,QAAQ,KAAK,MAAM,YAAY,CAAC,QAAQ,KAAK,EAAG,OAAM,IAAI,MAAM,2BAA2B,KAAK,eAAe;AAAA,EAC3H;AACA,MAAI,CAAC,OAAO,cAAc,QAAQ,UAAU,KAAM,QAAQ,aAAwB,EAAG,OAAM,IAAI,MAAM,yEAAyE;AAC9K,MAAI,CAAC,WAAW,KAAK,OAAO,QAAQ,mBAAmB,CAAC,KAAK,CAAC,WAAW,KAAK,OAAO,QAAQ,cAAc,CAAC,GAAG;AAC9G,UAAM,IAAI,MAAM,mEAAmE;AAAA,EACpF;AACA,MAAI,QAAQ,2BAA2B,WAClC,CAAC,MAAM,QAAQ,QAAQ,sBAAsB,KAC7C,CAAC,QAAQ,uBAAuB,MAAM,CAAC,WAAW,OAAO,WAAW,YAAY,WAAW,KAAK,MAAM,CAAC,KACvG,IAAI,IAAI,QAAQ,sBAAsB,EAAE,SAAS,QAAQ,uBAAuB,SAAS;AAC7F,UAAM,IAAI,MAAM,8FAA8F;AAAA,EAC/G;AACA,iBAAe,QAAQ,UAAoB,UAAU;AACtD;AAEA,SAAS,aAAa,SAAiB,OAAwC;AAC9E,SAAO,eAAe,gBAAgB,OAAO,GAAG,KAAK;AACtD;AAEA,SAAS,eAAe,OAAmB,OAAwC;AAClF,MAAI;AACJ,MAAI;AAAE,YAAQ,KAAK,MAAM,QAAQ,OAAO,KAAK,CAAC;AAAA,EAAG,QAC3C;AAAE,UAAM,IAAI,MAAM,8BAA8B,KAAK,2BAA2B;AAAA,EAAG;AACzF,MAAI,CAAC,SAAS,OAAO,UAAU,YAAY,MAAM,QAAQ,KAAK,EAAG,OAAM,IAAI,MAAM,8BAA8B,KAAK,qBAAqB;AACzI,SAAO;AACR;AAEA,SAAS,gBAAgB,OAA2B;AACnD,MAAI,CAAC,mBAAmB,KAAK,KAAK,EAAG,OAAM,IAAI,MAAM,wDAAwD;AAC7G,QAAM,SAAS,MAAM,QAAQ,MAAM,GAAG,EAAE,QAAQ,MAAM,GAAG,EAAE,OAAO,KAAK,KAAK,MAAM,SAAS,CAAC,IAAI,GAAG,GAAG;AACtG,MAAI;AACJ,MAAI;AAAE,aAAS,KAAK,MAAM;AAAA,EAAG,QACvB;AAAE,UAAM,IAAI,MAAM,wDAAwD;AAAA,EAAG;AACnF,SAAO,WAAW,KAAK,QAAQ,CAAC,cAAc,UAAU,WAAW,CAAC,CAAC;AACtE;AAEA,SAAS,eAAe,OAAe,OAAuB;AAC7D,MAAI,CAAC,yBAAyB,KAAK,KAAK,EAAG,OAAM,IAAI,MAAM,2BAA2B,KAAK,4CAA4C;AACvI,QAAM,SAAS,KAAK,MAAM,KAAK;AAC/B,MAAI,OAAO,MAAM,MAAM,EAAG,OAAM,IAAI,MAAM,2BAA2B,KAAK,cAAc;AACxF,SAAO;AACR;","names":[]}