@fabricorg/sdui-release 0.3.0 → 0.5.0

package/dist/index.cjs.map

@@ -1 +1 @@
-{"version":3,"sources":["../index.ts","../types.ts","../structural.ts","../helpers.ts","../validate.ts","../digest.ts","../capabilities.ts","../walker.ts","../channel.ts","../schemas.ts"],"sourcesContent":["// ── Public API ──────────────────────────────────────────────────────────────\n//\n// The SDUI release package is split into cohesive private modules. This file\n// is the single public entry point: it re-exports every type, constant, and\n// function that consumers import. The internal modules (types, helpers,\n// structural, digest, capabilities, walker, channel, schemas, validate) are\n// implementation details and are not separately exported.\n\n// Format version constants\nexport {\n\tSDUI_DOCUMENT_FORMAT_VERSION,\n\tSDUI_TOKEN_SET_FORMAT_VERSION,\n\tSDUI_COMPONENT_PACK_FORMAT_VERSION,\n\tSDUI_RELEASE_FORMAT_VERSION,\n} from \"./types\";\n\n// Types\nexport type {\n\tSduiCapabilityRef,\n\tSduiFragmentValue,\n\tSduiActionRef,\n\tSduiFragment,\n\tSduiTokenType,\n\tSduiToken,\n\tSduiTokenSet,\n\tSduiComponentDefinition,\n\tSduiComponentPack,\n\tSduiComponentPackReference,\n\tSduiTokenSetReference,\n\tSduiDocument,\n\tResolvedSduiComponentPack,\n\tSduiRelease,\n\tSduiFindingCode,\n\tSduiFinding,\n\tSduiValidationResult,\n\tSduiAuthorizationGrants,\n\tSduiValidationInput,\n\tJsonValue,\n} from \"./types\";\n\n// Structural validation\nexport {\n\tassertSduiTokenSet,\n\tassertSduiComponentPack,\n\tassertSduiFragment,\n\tassertSduiDocument,\n\tassertSduiAuthorizationGrants,\n\tassertSduiRelease,\n} from \"./structural\";\n\n// Release validation\nexport {\n\tvalidateSduiRelease,\n\tassertSduiReleaseValid,\n} from \"./validate\";\n\n// Release digest\nexport { assertSduiReleaseIntegrity, computeReleaseDigest } from \"./digest\";\n\n// Channel consumption\nexport {\n\tcreateSduiChannel,\n\ttype SduiChannel,\n\ttype SduiChannelConsumptionResult,\n} from \"./channel\";\n\n// JSON schemas\nexport {\n\tSDUI_DOCUMENT_JSON_SCHEMA,\n\tSDUI_RELEASE_JSON_SCHEMA,\n} from \"./schemas\";\n","import type { JsonValue, PortableJsonSchema } from \"@fabricorg/platform\";\nimport type { UsageContractDocument } from \"@fabricorg/gen-capability\";\nimport type { AssemblyLockfile } from \"@fabricorg/assembly\";\n\n/**\n * Version of the SDUI document contract. A vertical negotiates on this, not on\n * this package's version, and it moves only when the serialized shape changes.\n */\nexport const SDUI_DOCUMENT_FORMAT_VERSION = 1 as const;\n\n/**\n * Version of the SDUI token-set contract.\n */\nexport const SDUI_TOKEN_SET_FORMAT_VERSION = 1 as const;\n\n/**\n * Version of the SDUI component-pack contract.\n */\nexport const SDUI_COMPONENT_PACK_FORMAT_VERSION = 1 as const;\n\n/**\n * Version of the promoted SDUI release contract.\n */\nexport const SDUI_RELEASE_FORMAT_VERSION = 2 as const;\n\n// ── Fragment value: literal or capability read reference ────────────────────\n\n/**\n * A capability read reference embedded in fragment props. The `capability://`\n * scheme ties a data binding to a published view; the host resolves it through\n * `ProjectionHost`, never through a direct query.\n */\nexport interface SduiCapabilityRef {\n\t$ref: `capability://${string}`;\n}\n\n/**\n * A value that may appear in fragment props: a JSON literal, an array, an\n * object, or a `capability://` read reference. Direct mutation endpoints,\n * API URLs, or code strings are not valid fragment values.\n */\nexport type SduiFragmentValue =\n\t| string\n\t| number\n\t| boolean\n\t| null\n\t| SduiFragmentValue[]\n\t| SduiCapabilityRef\n\t| { [key: string]: SduiFragmentValue };\n\n// ── Action reference: must route through a governed action ─────────────────\n\n/**\n * An action declared on a fragment. The `intent` must be a `capability://`\n * reference to a published action intent; the host dispatches it through\n * `PlatformHost`, preserving governance. A bare endpoint URL, function name,\n * or inline script is a mutation bypass and is rejected.\n */\nexport interface SduiActionRef {\n\tintent: `capability://${string}`;\n\tparams?: Record<string, SduiFragmentValue>;\n}\n\n// ── Fragment: a node in the document tree ───────────────────────────────────\n\n/**\n * A node in an SDUI document tree. A fragment either renders a component from\n * a declared pack, binds data from a capability view, or both. Actions on a\n * fragment are always capability action-intent references — never direct\n * mutations.\n */\nexport interface SduiFragment {\n\t/** Unique identifier within the document. */\n\tid: string;\n\t/** Namespaced component (`pack.Component`) or a core component name. */\n\tcomponent?: string;\n\t/** Props for the component; values may be literals or capability refs. */\n\tprops?: Record<string, SduiFragmentValue>;\n\t/** Named slot this fragment fills in its parent component. */\n\tslot?: string;\n\t/** A capability view reference for data-driven fragments. */\n\tdataRef?: `capability://${string}`;\n\t/** Action handlers; every entry must be a capability action-intent reference. */\n\tactions?: Record<string, SduiActionRef>;\n\t/** Child fragments. */\n\tchildren?: SduiFragment[];\n}\n\n// ── Token set: renderer-neutral design tokens ───────────────────────────────\n\nexport type SduiTokenType = \"color\" | \"spacing\" | \"fontSize\" | \"fontWeight\" | \"radius\" | \"border\" | \"shadow\";\n\nexport interface SduiToken {\n\ttype: SduiTokenType;\n\tvalue: string;\n\tdescription?: string;\n}\n\n/**\n * A versioned set of design tokens. Tokens are semantic, not literal CSS — a\n * renderer maps them to its own platform. Two channels consuming the same\n * token set apply the same visual intent through different renderings.\n */\nexport interface SduiTokenSet {\n\tformatVersion: typeof SDUI_TOKEN_SET_FORMAT_VERSION;\n\tname: string;\n\tversion: string;\n\ttokens: Record<string, SduiToken>;\n}\n\n// ── Component pack: available components for rendering ──────────────────────\n\nexport interface SduiComponentDefinition {\n\t/** Roles this component implements (for adoption-binding validation). */\n\timplements?: string[];\n\t/** JSON Schema for component props. */\n\tpropsSchema?: PortableJsonSchema;\n\t/** Named slots this component accepts. */\n\tslots?: string[];\n}\n\n/**\n * A versioned pack of SDUI components. Compatible with the adoption-bindings\n * `ComponentPackManifest` but adds prop schemas and slot declarations so a\n * document can be validated without a renderer.\n */\nexport interface SduiComponentPack {\n\tformatVersion: typeof SDUI_COMPONENT_PACK_FORMAT_VERSION;\n\tpack: string;\n\tnamespace: string;\n\tversion: string;\n\t/** SHA-256 digest of the published component-pack artifact. */\n\tartifactDigest: string;\n\t/**\n\t * Where this pack is loaded from when it is delivered as a federated\n\t * remote. The artifact digest identifies the pack that was reviewed; this\n\t * is what a shell actually executes, so validation requires the two to be\n\t * locked together or the review covers something other than what runs.\n\t */\n\tremote?: SduiComponentPackRemote;\n\tcomponents: Record<string, SduiComponentDefinition>;\n}\n\n/** Delivery binding for a federated component pack. */\nexport interface SduiComponentPackRemote {\n\t/** Remote entry URL the shell loads. */\n\tentry: string;\n\t/** Subresource-integrity value for that entry, e.g. `sha384-…`. */\n\tintegrity: string;\n\t/** Exposed module path keyed by the component name it provides. */\n\texposes: Record<string, string>;\n}\n\n// ── Document: a versioned tree of fragments ──────────────────────────────────\n\nexport interface SduiComponentPackReference {\n\tpack: string;\n\tnamespace: string;\n\t/** Semver range, e.g. `^1.0.0`. */\n\trange: string;\n}\n\nexport interface SduiTokenSetReference {\n\tname: string;\n\tversion: string;\n}\n\n/**\n * A versioned SDUI document: a tree of fragments, a token-set reference, and\n * the component packs it depends on. This is the build-time input; the release\n * is the validated, resolved output.\n */\nexport interface SduiDocument {\n\tformatVersion: typeof SDUI_DOCUMENT_FORMAT_VERSION;\n\tname: string;\n\tversion: string;\n\t/** The tree rendered when no variant is selected. */\n\troot: SduiFragment;\n\t/**\n\t * Alternative trees a compositor may select at request time, for experiment\n\t * arms and personalization. Every variant is enumerated here and validated\n\t * against the same grants as `root`, and all of them are covered by the\n\t * release digest.\n\t *\n\t * Enumeration is what makes selection safe. A selector that can produce a\n\t * tree outside this set cannot be validated at promotion, so \"selection may\n\t * never widen grants\" would be unenforceable rather than merely unenforced.\n\t */\n\tvariants?: SduiVariant[];\n\ttokenSet: SduiTokenSetReference;\n\tcomponentPacks: SduiComponentPackReference[];\n}\n\n/** One selectable alternative to a document's default tree. */\nexport interface SduiVariant {\n\t/** Stable key the compositor matches on. Unique within the document. */\n\tid: string;\n\t/** The audience or experiment arm this arm serves. */\n\tdescription?: string;\n\troot: SduiFragment;\n}\n\n// ── Release: a promoted, validated, immutable bundle ─────────────────────────\n\nexport interface ResolvedSduiComponentPack {\n\tpack: string;\n\tnamespace: string;\n\tversion: string;\n\trange: string;\n\tartifactDigest: string;\n\t/**\n\t * The locked delivery binding, carried onto the release so the digest\n\t * identifies which remote a channel is expected to load. Omitting it would\n\t * let two releases differing only in their remote share a digest.\n\t */\n\tremote?: SduiComponentPackRemote;\n}\n\n/**\n * A promoted, validated, immutable SDUI release. It bundles a document, a\n * resolved token set, and locked component packs. Two channels (web, mobile,\n * CLI) can consume the same release and render it through their own renderers\n * while reads and actions remain capability references.\n */\nexport interface SduiRelease {\n\tformatVersion: typeof SDUI_RELEASE_FORMAT_VERSION;\n\t/** SHA-256 of the canonical document, token set, resolved packs, grants, and assembly identity. */\n\treleaseDigest: string;\n\t/** Approved application assembly this release was validated against. */\n\tassemblyDigest: string;\n\tdocument: SduiDocument;\n\ttokenSet: SduiTokenSet;\n\tcomponentPacks: ResolvedSduiComponentPack[];\n\tgrants: SduiAuthorizationGrants;\n}\n\n// ── Findings ─────────────────────────────────────────────────────────────────\n\nexport type SduiFindingCode =\n\t| \"unknown_component\"\n\t| \"incompatible_pack\"\n\t| \"unauthorized_data_ref\"\n\t| \"denied_view_ref\"\n\t| \"mutation_bypass\"\n\t| \"denied_intent_ref\"\n\t| \"intent_action_not_found\"\n\t| \"invalid_fragment\"\n\t| \"invalid_action_ref\"\n\t| \"unknown_token\"\n\t| \"duplicate_fragment_id\"\n\t| \"invalid_token_set\"\n\t| \"invalid_component_pack\"\n\t| \"invalid_document\"\n\t| \"missing_token_set\"\n\t| \"missing_component_pack\"\n\t| \"component_pack_not_in_assembly\"\n\t| \"capability_contract_not_in_assembly\"\n\t| \"duplicate_variant_id\"\n\t| \"fragment_grant_exceeds_release\"\n\t| \"remote_not_locked\";\n\nexport interface SduiFinding {\n\tcode: SduiFindingCode;\n\tpath: string;\n\tmessage: string;\n}\n\nexport interface SduiValidationResult {\n\tvalid: boolean;\n\tfindings: SduiFinding[];\n\trelease: SduiRelease | undefined;\n}\n\n// ── Validation input ─────────────────────────────────────────────────────────\n\n/**\n * Explicit capability references authorized for an SDUI release.\n *\n * The presence of a view or action in a supplied usage contract proves that\n * the capability publishes it, not that this document may use it. The\n * experience host must therefore provide both grant lists explicitly.\n */\nexport interface SduiAuthorizationGrants {\n\t/** Full `capability://namespace/view` references allowed in data bindings. */\n\tviews: readonly string[];\n\t/** Full `capability://namespace/intent` references allowed in actions. */\n\tintents: readonly string[];\n\t/**\n\t * Per-fragment narrowing, keyed by fragment id.\n\t *\n\t * The release-wide lists above are the ceiling. A listed fragment may use\n\t * only the references named for it, and the narrowing is inherited by that\n\t * fragment's children, so a page assembled from several teams' fragments\n\t * gets least privilege rather than the union of everything any of them\n\t * needs. A fragment entry can only ever narrow: naming a reference outside\n\t * the release-wide list is an authoring error and is reported rather than\n\t * silently granted.\n\t *\n\t * Keys are fragment ids, which are unique within a tree but may repeat\n\t * across variants, so two variants using the same fragment id share one\n\t * entry. Give them distinct ids when they need distinct narrowing. This\n\t * cannot widen either fragment, since narrowing stays an intersection.\n\t */\n\tfragments?: Record<string, SduiFragmentGrants>;\n}\n\n/** References one fragment subtree may use, drawn from the release-wide lists. */\nexport interface SduiFragmentGrants {\n\tviews?: readonly string[];\n\tintents?: readonly string[];\n}\n\nexport interface SduiValidationInput {\n\tdocument: SduiDocument;\n\ttokenSet: SduiTokenSet;\n\t/** Available component packs for version resolution. */\n\tcomponentPacks: SduiComponentPack[];\n\t/** Capability contracts available for data-ref and action validation. */\n\tcontracts: UsageContractDocument[];\n\t/**\n\t * Explicit authorization grants for every capability view and action\n\t * reference used by the document. Contract membership alone never grants\n\t * access.\n\t */\n\tgrants: SduiAuthorizationGrants;\n\t/** Approved resolved application composition. */\n\tassembly: AssemblyLockfile;\n\t/** Core component vocabulary every renderer implements. */\n\tcoreComponents?: readonly string[];\n}\n\n// Re-export JsonValue for consumers that build contracts programmatically.\nexport type { JsonValue };\n","import { assertPortableJsonSchema, type PortableJsonSchema } from \"@fabricorg/platform\";\nimport { parseSemverRange } from \"@fabricorg/assembly\";\nimport type {\n\tSduiAuthorizationGrants,\n\tSduiComponentPack,\n\tSduiDocument,\n\tSduiFragment,\n\tSduiRelease,\n\tSduiTokenSet,\n\tSduiTokenType,\n} from \"./types\";\nimport { fail, parseCapabilityRef, requireArray, requireRecord, requireString } from \"./helpers\";\n\n// ── Token set structural validation ──────────────────────────────────────────\n\nconst TOKEN_TYPES = new Set<SduiTokenType>([\"color\", \"spacing\", \"fontSize\", \"fontWeight\", \"radius\", \"border\", \"shadow\"]);\n\nexport function assertSduiTokenSet(value: unknown, path = \"tokenSet\"): asserts value is SduiTokenSet {\n\tconst tokenSet = requireRecord(value, path);\n\tif (tokenSet.formatVersion !== 1) {\n\t\tfail(`${path}.formatVersion`, `must be 1, received ${JSON.stringify(tokenSet.formatVersion)}`);\n\t}\n\tif (!/^[a-z][a-z0-9-]*$/.test(requireString(tokenSet.name, `${path}.name`))) {\n\t\tfail(`${path}.name`, \"must be lowercase letters, numbers and hyphens\");\n\t}\n\tif (!/^\\d+\\.\\d+\\.\\d+(?:-[0-9A-Za-z.-]+)?$/.test(requireString(tokenSet.version, `${path}.version`))) {\n\t\tfail(`${path}.version`, \"must be a semver version\");\n\t}\n\tconst tokens = requireRecord(tokenSet.tokens, `${path}.tokens`);\n\tfor (const [name, token] of Object.entries(tokens)) {\n\t\tconst tokenPath = `${path}.tokens.${name}`;\n\t\tif (!/^[a-z][a-z0-9-]*$/.test(name)) fail(tokenPath, \"token name must be lowercase letters, numbers and hyphens\");\n\t\tconst entry = requireRecord(token, tokenPath);\n\t\tconst type = requireString(entry.type, `${tokenPath}.type`);\n\t\tif (!TOKEN_TYPES.has(type as SduiTokenType)) fail(`${tokenPath}.type`, `must be one of ${[...TOKEN_TYPES].join(\", \")}`);\n\t\trequireString(entry.value, `${tokenPath}.value`);\n\t}\n}\n\n// ── Component pack structural validation ────────────────────────────────────\n\nexport function assertSduiComponentPack(value: unknown, path = \"componentPack\"): asserts value is SduiComponentPack {\n\tconst pack = requireRecord(value, path);\n\tif (pack.formatVersion !== 1) {\n\t\tfail(`${path}.formatVersion`, `must be 1, received ${JSON.stringify(pack.formatVersion)}`);\n\t}\n\tif (!/^[a-z][a-z0-9-]*$/.test(requireString(pack.pack, `${path}.pack`))) {\n\t\tfail(`${path}.pack`, \"must be lowercase letters, numbers and hyphens\");\n\t}\n\tif (!/^[a-z][a-z0-9-]*$/.test(requireString(pack.namespace, `${path}.namespace`))) {\n\t\tfail(`${path}.namespace`, \"must be lowercase letters, numbers and hyphens\");\n\t}\n\tif (!/^\\d+\\.\\d+\\.\\d+(?:-[0-9A-Za-z.-]+)?$/.test(requireString(pack.version, `${path}.version`))) {\n\t\tfail(`${path}.version`, \"must be a semver version\");\n\t}\n\tif (!/^[0-9a-f]{64}$/.test(requireString(pack.artifactDigest, `${path}.artifactDigest`))) {\n\t\tfail(`${path}.artifactDigest`, \"must be a lowercase SHA-256 digest\");\n\t}\n\tif (pack.remote !== undefined) {\n\t\tconst remote = requireRecord(pack.remote, `${path}.remote`);\n\t\trequireString(remote.entry, `${path}.remote.entry`);\n\t\tif (!/^sha(256|384|512)-[A-Za-z0-9+/]+={0,2}$/.test(requireString(remote.integrity, `${path}.remote.integrity`))) {\n\t\t\tfail(`${path}.remote.integrity`, \"must be a subresource-integrity value, e.g. \\\"sha384-…\\\"\");\n\t\t}\n\t\tconst exposes = requireRecord(remote.exposes, `${path}.remote.exposes`);\n\t\tfor (const [component, modulePath] of Object.entries(exposes)) {\n\t\t\trequireString(modulePath, `${path}.remote.exposes.${component}`);\n\t\t}\n\t}\n\tconst components = requireRecord(pack.components, `${path}.components`);\n\tfor (const [name, definition] of Object.entries(components)) {\n\t\tconst componentPath = `${path}.components.${name}`;\n\t\tif (!/^[a-z][a-z0-9-]*$/.test(name)) fail(componentPath, \"component name must be lowercase letters, numbers and hyphens\");\n\t\tconst def = requireRecord(definition, componentPath);\n\t\tif (def.implements !== undefined) {\n\t\t\tif (!Array.isArray(def.implements)) fail(`${componentPath}.implements`, \"must be an array\");\n\t\t\tfor (const impl of def.implements as unknown[]) {\n\t\t\t\tif (typeof impl !== \"string\" || !impl.trim()) fail(`${componentPath}.implements`, \"entries must be non-empty strings\");\n\t\t\t}\n\t\t}\n\t\tif (def.propsSchema !== undefined) {\n\t\t\ttry { assertPortableJsonSchema(def.propsSchema as PortableJsonSchema, `${componentPath}.propsSchema`); }\n\t\t\tcatch (error) { fail(componentPath, error instanceof Error ? error.message : String(error)); }\n\t\t}\n\t\tif (def.slots !== undefined) {\n\t\t\tif (!Array.isArray(def.slots)) fail(`${componentPath}.slots`, \"must be an array\");\n\t\t\tfor (const slot of def.slots as unknown[]) {\n\t\t\t\tif (typeof slot !== \"string\" || !/^[a-z][a-z0-9-]*$/.test(slot)) fail(`${componentPath}.slots`, \"slot names must be lowercase letters, numbers and hyphens\");\n\t\t\t}\n\t\t}\n\t}\n}\n\n// ── Fragment structural validation ──────────────────────────────────────────\n\nexport function assertSduiFragment(value: unknown, path = \"fragment\"): asserts value is SduiFragment {\n\tconst fragment = requireRecord(value, path);\n\trequireString(fragment.id, `${path}.id`);\n\tif (fragment.component !== undefined) requireString(fragment.component, `${path}.component`);\n\tif (fragment.slot !== undefined) {\n\t\tif (!/^[a-z][a-z0-9-]*$/.test(requireString(fragment.slot, `${path}.slot`))) {\n\t\t\tfail(`${path}.slot`, \"must be lowercase letters, numbers and hyphens\");\n\t\t}\n\t}\n\tif (fragment.dataRef !== undefined) {\n\t\tconst dataRef = requireString(fragment.dataRef, `${path}.dataRef`);\n\t\tif (!dataRef.startsWith(\"capability://\")) fail(`${path}.dataRef`, \"must be a capability:// reference\");\n\t}\n\tif (fragment.props !== undefined) {\n\t\trequireRecord(fragment.props, `${path}.props`);\n\t}\n\tif (fragment.actions !== undefined) {\n\t\tconst actions = requireRecord(fragment.actions, `${path}.actions`);\n\t\tfor (const [name, ref] of Object.entries(actions)) {\n\t\t\tconst actionPath = `${path}.actions.${name}`;\n\t\t\tconst actionRef = requireRecord(ref, actionPath);\n\t\t\trequireString(actionRef.intent, `${actionPath}.intent`);\n\t\t}\n\t}\n\tif (fragment.children !== undefined) {\n\t\tconst children = requireArray(fragment.children, `${path}.children`);\n\t\tchildren.forEach((child, index) => assertSduiFragment(child, `${path}.children[${index}]`));\n\t}\n}\n\n// ── Document structural validation ───────────────────────────────────────────\n\nexport function assertSduiDocument(value: unknown, path = \"document\"): asserts value is SduiDocument {\n\tconst document = requireRecord(value, path);\n\tif (document.formatVersion !== 1) {\n\t\tfail(`${path}.formatVersion`, `must be 1, received ${JSON.stringify(document.formatVersion)}`);\n\t}\n\tif (!/^[a-z][a-z0-9-]*$/.test(requireString(document.name, `${path}.name`))) {\n\t\tfail(`${path}.name`, \"must be lowercase letters, numbers and hyphens\");\n\t}\n\tif (!/^\\d+\\.\\d+\\.\\d+(?:-[0-9A-Za-z.-]+)?$/.test(requireString(document.version, `${path}.version`))) {\n\t\tfail(`${path}.version`, \"must be a semver version\");\n\t}\n\tassertSduiFragment(document.root, `${path}.root`);\n\tif (document.variants !== undefined) {\n\t\trequireArray(document.variants, `${path}.variants`).forEach((entry, index) => {\n\t\t\tconst variantPath = `${path}.variants[${index}]`;\n\t\t\tconst variant = requireRecord(entry, variantPath);\n\t\t\tif (!/^[a-z][a-z0-9-]*$/.test(requireString(variant.id, `${variantPath}.id`))) {\n\t\t\t\tfail(`${variantPath}.id`, \"must be lowercase letters, numbers and hyphens\");\n\t\t\t}\n\t\t\tif (variant.description !== undefined) requireString(variant.description, `${variantPath}.description`);\n\t\t\tassertSduiFragment(variant.root, `${variantPath}.root`);\n\t\t});\n\t}\n\tconst tokenSet = requireRecord(document.tokenSet, `${path}.tokenSet`);\n\trequireString(tokenSet.name, `${path}.tokenSet.name`);\n\trequireString(tokenSet.version, `${path}.tokenSet.version`);\n\trequireArray(document.componentPacks, `${path}.componentPacks`).forEach((entry, index) => {\n\t\tconst pack = requireRecord(entry, `${path}.componentPacks[${index}]`);\n\t\trequireString(pack.pack, `${path}.componentPacks[${index}].pack`);\n\t\trequireString(pack.namespace, `${path}.componentPacks[${index}].namespace`);\n\t\trequireString(pack.range, `${path}.componentPacks[${index}].range`);\n\t});\n}\n\n// ── Authorization grants structural validation ──────────────────────────────\n\n/**\n * Validate the grant envelope before semantic release checks. Grants are\n * intentionally references rather than capability names: a capability may\n * publish several views and intents with different authorization decisions.\n */\nexport function assertSduiAuthorizationGrants(\n\tvalue: unknown,\n\tpath = \"grants\",\n): asserts value is SduiAuthorizationGrants {\n\tconst grants = requireRecord(value, path);\n\tconst views = requireArray(grants.views, `${path}.views`);\n\tconst intents = requireArray(grants.intents, `${path}.intents`);\n\tfor (const [index, reference] of views.entries()) {\n\t\tconst referencePath = `${path}.views[${index}]`;\n\t\tif (!parseCapabilityRef(requireString(reference, referencePath))) {\n\t\t\tfail(referencePath, \"must be a valid capability:// reference\");\n\t\t}\n\t}\n\tfor (const [index, reference] of intents.entries()) {\n\t\tconst referencePath = `${path}.intents[${index}]`;\n\t\tif (!parseCapabilityRef(requireString(reference, referencePath))) {\n\t\t\tfail(referencePath, \"must be a valid capability:// reference\");\n\t\t}\n\t}\n\tif (grants.fragments !== undefined) {\n\t\tconst fragments = requireRecord(grants.fragments, `${path}.fragments`);\n\t\t// An object literal written `{ __proto__: { … } }` sets the prototype\n\t\t// instead of creating the entry, so the narrowing would disappear and the\n\t\t// fragment would keep release-wide grants. Fail rather than silently widen.\n\t\tconst prototype = Object.getPrototypeOf(fragments);\n\t\tif (prototype !== Object.prototype && prototype !== null) {\n\t\t\tfail(`${path}.fragments`, \"must be a plain object; a fragment grant assigned through __proto__ would be silently discarded\");\n\t\t}\n\t\tfor (const [fragmentId, declared] of Object.entries(fragments)) {\n\t\t\tconst fragmentPath = `${path}.fragments.${fragmentId}`;\n\t\t\tconst scoped = requireRecord(declared, fragmentPath);\n\t\t\tfor (const field of [\"views\", \"intents\"] as const) {\n\t\t\t\tif (scoped[field] === undefined) continue;\n\t\t\t\trequireArray(scoped[field], `${fragmentPath}.${field}`).forEach((reference, index) => {\n\t\t\t\t\tconst referencePath = `${fragmentPath}.${field}[${index}]`;\n\t\t\t\t\tif (!parseCapabilityRef(requireString(reference, referencePath))) {\n\t\t\t\t\t\tfail(referencePath, \"must be a valid capability:// reference\");\n\t\t\t\t\t}\n\t\t\t\t});\n\t\t\t}\n\t\t}\n\t}\n}\n\n/** Validate a promoted release loaded from an untyped persistence or network seam. */\nexport function assertSduiRelease(value: unknown, path = \"release\"): asserts value is SduiRelease {\n\tconst release = requireRecord(value, path);\n\tif (release.formatVersion !== 2) {\n\t\tfail(`${path}.formatVersion`, `must be 2, received ${JSON.stringify(release.formatVersion)}`);\n\t}\n\tfor (const field of [\"releaseDigest\", \"assemblyDigest\"] as const) {\n\t\tif (!/^[0-9a-f]{64}$/.test(requireString(release[field], `${path}.${field}`))) {\n\t\t\tfail(`${path}.${field}`, \"must be a lowercase SHA-256 digest\");\n\t\t}\n\t}\n\tassertSduiDocument(release.document, `${path}.document`);\n\tassertSduiTokenSet(release.tokenSet, `${path}.tokenSet`);\n\tassertSduiAuthorizationGrants(release.grants, `${path}.grants`);\n\trequireArray(release.componentPacks, `${path}.componentPacks`).forEach((value, index) => {\n\t\tconst packPath = `${path}.componentPacks[${index}]`;\n\t\tconst pack = requireRecord(value, packPath);\n\t\tfor (const field of [\"pack\", \"namespace\"] as const) {\n\t\t\tif (!/^[a-z][a-z0-9-]*$/.test(requireString(pack[field], `${packPath}.${field}`))) {\n\t\t\t\tfail(`${packPath}.${field}`, \"must be lowercase letters, numbers and hyphens\");\n\t\t\t}\n\t\t}\n\t\tif (!/^\\d+\\.\\d+\\.\\d+(?:-[0-9A-Za-z.-]+)?$/.test(\n\t\t\trequireString(pack.version, `${packPath}.version`),\n\t\t)) {\n\t\t\tfail(`${packPath}.version`, \"must be a semver version\");\n\t\t}\n\t\tconst range = requireString(pack.range, `${packPath}.range`);\n\t\tif (!parseSemverRange(range)) {\n\t\t\tfail(`${packPath}.range`, \"must be a supported semver range\");\n\t\t}\n\t\tif (!/^[0-9a-f]{64}$/.test(requireString(pack.artifactDigest, `${packPath}.artifactDigest`))) {\n\t\t\tfail(`${packPath}.artifactDigest`, \"must be a lowercase SHA-256 digest\");\n\t\t}\n\t});\n}\n","// ── Shared validation helpers ───────────────────────────────────────────────\n\nexport function fail(path: string, message: string): never {\n\tthrow new Error(`SDUI ${path} ${message}.`);\n}\n\nexport function requireString(value: unknown, path: string): string {\n\tif (typeof value !== \"string\" || !value.trim()) fail(path, \"must be a non-empty string\");\n\treturn value;\n}\n\nexport function requireRecord(value: unknown, path: string): Record<string, unknown> {\n\tif (!value || typeof value !== \"object\" || Array.isArray(value)) fail(path, \"must be an object\");\n\treturn value as Record<string, unknown>;\n}\n\nexport function requireArray(value: unknown, path: string): unknown[] {\n\tif (!Array.isArray(value)) fail(path, \"must be an array\");\n\treturn value;\n}\n\n// ── Capability reference parsing ────────────────────────────────────────────\n\nexport function parseCapabilityRef(ref: string): { namespace: string; name: string } | undefined {\n\tconst match = /^capability:\\/\\/([a-z][a-z0-9-]*)\\/(.+)$/.exec(ref);\n\tif (!match) return undefined;\n\treturn { namespace: match[1]!, name: match[2]! };\n}\n","import {\n\tassertAssemblyLockfile,\n\tcomputeUsageContractDocumentDigest,\n\tparseSemverRange,\n\tresolveVersionRange,\n} from \"@fabricorg/assembly\";\nimport { assertUsageContractDocument } from \"@fabricorg/gen-capability\";\nimport type {\n\tResolvedSduiComponentPack,\n\tSduiComponentPack,\n\tSduiDocument,\n\tSduiFinding,\n\tSduiFindingCode,\n\tSduiRelease,\n\tSduiTokenSet,\n\tSduiValidationInput,\n\tSduiValidationResult,\n} from \"./types\";\nimport { canonicalFragmentGrants, releaseDigest } from \"./digest\";\nimport { assertSduiAuthorizationGrants, assertSduiComponentPack, assertSduiDocument, assertSduiTokenSet } from \"./structural\";\nimport {\n\tbuildGrantedReferences,\n\tbuildKnownActionIntents,\n\tbuildKnownViews,\n\tvalidateIntentActionDeclarations,\n} from \"./capabilities\";\nimport { walkFragment } from \"./walker\";\n\n/**\n * Validate an SDUI document and its dependencies, producing a promoted release\n * when every check passes. This is the single build gate: it rejects unknown\n * components, incompatible packs, unauthorized data references, and mutation\n * bypasses. Returns every finding rather than throwing, so one CI run tells a\n * vertical everything it has to change. Use {@link assertSduiReleaseValid} to\n * throw on the first invalid result.\n */\nexport function validateSduiRelease(input: SduiValidationInput): SduiValidationResult {\n\t// ── Structural validation ────────────────────────────────────────────\n\tif (!input.assembly) throw new Error(\"An approved assembly lockfile is required for every SDUI release.\");\n\tassertSduiDocument(input.document);\n\tassertSduiTokenSet(input.tokenSet);\n\tfor (const pack of input.componentPacks) assertSduiComponentPack(pack);\n\tfor (const contract of input.contracts) assertUsageContractDocument(contract);\n\tassertSduiAuthorizationGrants(input.grants);\n\tassertAssemblyLockfile(input.assembly);\n\tconst contracts = input.contracts.map((document) => document.capability);\n\n\tconst findings: SduiFinding[] = [];\n\tconst add = (code: SduiFindingCode, path: string, message: string): void => {\n\t\tfindings.push({ code, path, message });\n\t};\n\n\t// ── Token set reference matches ─────────────────────────────────────\n\tif (input.document.tokenSet.name !== input.tokenSet.name) {\n\t\tadd(\"missing_token_set\", \"document.tokenSet.name\",\n\t\t\t`document references token set \"${input.document.tokenSet.name}\" but the provided set is \"${input.tokenSet.name}\"`);\n\t}\n\tif (input.document.tokenSet.version !== input.tokenSet.version) {\n\t\tadd(\"missing_token_set\", \"document.tokenSet.version\",\n\t\t\t`document references token set version \"${input.document.tokenSet.version}\" but the provided set is version \"${input.tokenSet.version}\"`);\n\t}\n\n\t// ── Component pack resolution ──────────────────────────────────────\n\tconst packsByKey = new Map<string, SduiComponentPack[]>();\n\tfor (const pack of input.componentPacks) {\n\t\tconst key = `${pack.namespace}/${pack.pack}`;\n\t\tconst list = packsByKey.get(key) ?? [];\n\t\tlist.push(pack);\n\t\tpacksByKey.set(key, list);\n\t}\n\n\tconst resolvedPacks: ResolvedSduiComponentPack[] = [];\n\tconst resolvedPackDefinitions: SduiComponentPack[] = [];\n\tfor (const ref of input.document.componentPacks) {\n\t\tconst key = `${ref.namespace}/${ref.pack}`;\n\t\tconst available = packsByKey.get(key) ?? [];\n\t\tconst range = parseSemverRange(ref.range);\n\t\tif (!range) {\n\t\t\tadd(\"incompatible_pack\", `document.componentPacks.${key}`,\n\t\t\t\t`no available version of pack \"${key}\" satisfies range \"${ref.range}\"`);\n\t\t\tcontinue;\n\t\t}\n\t\tconst resolvedVersion = resolveVersionRange(range, available.map((pack) => pack.version));\n\t\tif (!resolvedVersion) {\n\t\t\tadd(\"incompatible_pack\", `document.componentPacks.${key}`,\n\t\t\t\t`no available version of pack \"${key}\" satisfies range \"${ref.range}\"`);\n\t\t\tcontinue;\n\t\t}\n\t\tconst resolved = available.find((pack) => pack.version === resolvedVersion)!;\n\t\tresolvedPackDefinitions.push(resolved);\n\t\tresolvedPacks.push({\n\t\t\tpack: resolved.pack,\n\t\t\tnamespace: resolved.namespace,\n\t\t\tversion: resolved.version,\n\t\t\trange: ref.range,\n\t\t\tartifactDigest: resolved.artifactDigest,\n\t\t\t...(resolved.remote ? { remote: resolved.remote } : {}),\n\t\t});\n\t}\n\n\t// ── Approved assembly identity ─────────────────────────────────────\n\t{\n\t\tfor (const pack of resolvedPacks) {\n\t\t\tconst approved = input.assembly.componentPacks.find((candidate) =>\n\t\t\t\tcandidate.namespace === pack.namespace &&\n\t\t\t\tcandidate.pack === pack.pack &&\n\t\t\t\tcandidate.version === pack.version &&\n\t\t\t\tcandidate.artifactDigest === pack.artifactDigest\n\t\t\t);\n\t\t\tif (!approved) {\n\t\t\t\tadd(\"component_pack_not_in_assembly\", `componentPacks.${pack.namespace}/${pack.pack}`,\n\t\t\t\t\t`pack \"${pack.namespace}/${pack.pack}@${pack.version}\" with artifact digest \"${pack.artifactDigest}\" is not in assembly \"${input.assembly.assemblyDigest}\"`);\n\t\t\t\tcontinue;\n\t\t\t}\n\n\t\t\t// A federated pack executes whatever its remote entry serves. Unless\n\t\t\t// the entry and its integrity are the ones assembly locked, the\n\t\t\t// approved artifact digest says nothing about what actually runs.\n\t\t\tconst declaredRemote = resolvedPackDefinitions.find((definition) =>\n\t\t\t\tdefinition.namespace === pack.namespace &&\n\t\t\t\tdefinition.pack === pack.pack &&\n\t\t\t\tdefinition.version === pack.version &&\n\t\t\t\tdefinition.artifactDigest === pack.artifactDigest)?.remote;\n\t\t\tconst remotePath = `componentPacks.${pack.namespace}/${pack.pack}.remote`;\n\t\t\tif (declaredRemote && !approved.remote) {\n\t\t\t\tadd(\"remote_not_locked\", remotePath,\n\t\t\t\t\t`pack \"${pack.namespace}/${pack.pack}\" is delivered as a federated remote, which assembly \"${input.assembly.assemblyDigest}\" has not locked`);\n\t\t\t} else if (declaredRemote && approved.remote) {\n\t\t\t\tif (declaredRemote.entry !== approved.remote.entry) {\n\t\t\t\t\tadd(\"remote_not_locked\", `${remotePath}.entry`,\n\t\t\t\t\t\t`remote entry \"${declaredRemote.entry}\" does not match the locked entry \"${approved.remote.entry}\"`);\n\t\t\t\t}\n\t\t\t\tif (declaredRemote.integrity !== approved.remote.integrity) {\n\t\t\t\t\tadd(\"remote_not_locked\", `${remotePath}.integrity`,\n\t\t\t\t\t\t`remote integrity \"${declaredRemote.integrity}\" does not match the locked integrity \"${approved.remote.integrity}\"`);\n\t\t\t\t}\n\t\t\t\tif (canonicalExposes(declaredRemote.exposes) !== canonicalExposes(approved.remote.exposes)) {\n\t\t\t\t\tadd(\"remote_not_locked\", `${remotePath}.exposes`,\n\t\t\t\t\t\t\"remote exposed modules do not match the locked mapping\");\n\t\t\t\t}\n\t\t\t} else if (!declaredRemote && approved.remote) {\n\t\t\t\tadd(\"remote_not_locked\", remotePath,\n\t\t\t\t\t`assembly \"${input.assembly.assemblyDigest}\" locks a federated remote for \"${pack.namespace}/${pack.pack}\", but the supplied pack declares none`);\n\t\t\t}\n\t\t}\n\t\tfor (const document of input.contracts) {\n\t\t\tconst approved = input.assembly.capabilities.find((capability) =>\n\t\t\t\tcapability.namespace === document.capability.namespace &&\n\t\t\t\tcapability.usageContractDigest === computeUsageContractDocumentDigest(document)\n\t\t\t);\n\t\t\tif (!approved) {\n\t\t\t\tadd(\"capability_contract_not_in_assembly\", `contracts.${document.capability.namespace}`,\n\t\t\t\t\t`contract \"${document.capability.namespace}\" is not the generated usage-contract document approved by assembly \"${input.assembly.assemblyDigest}\"`);\n\t\t\t}\n\t\t}\n\t}\n\n\t// ── Build known component set from resolved packs ───────────────────\n\tconst knownComponents = new Set<string>();\n\tfor (const pack of resolvedPackDefinitions) {\n\t\tfor (const name of Object.keys(pack.components)) {\n\t\t\tknownComponents.add(`${pack.namespace}.${name}`);\n\t\t}\n\t}\n\tconst coreComponents = new Set(input.coreComponents ?? []);\n\n\t// ── Build known views and action intents from contracts ─────────────\n\tconst knownViews = buildKnownViews(contracts);\n\tconst knownIntents = buildKnownActionIntents(contracts);\n\tconst grantedViews = buildGrantedReferences(input.grants.views, \"grants.views\");\n\tconst grantedIntents = buildGrantedReferences(input.grants.intents, \"grants.intents\");\n\n\t// ── Verify experience intents resolve to governed actions ───────────\n\tvalidateIntentActionDeclarations(contracts, add);\n\n\t// ── Per-fragment narrowing may only narrow ──────────────────────────\n\t// Intersection in the walker already makes an out-of-release reference\n\t// unusable; reporting it here turns a silently ineffective grant into an\n\t// authoring error, which is what the author actually needs to know.\n\tconst fragmentGrants = new Map<string, { views?: readonly string[]; intents?: readonly string[] }>();\n\tfor (const [fragmentId, declared] of Object.entries(input.grants.fragments ?? {})) {\n\t\tfor (const view of declared.views ?? []) {\n\t\t\tif (!grantedViews.has(view)) {\n\t\t\t\tadd(\"fragment_grant_exceeds_release\", `grants.fragments.${fragmentId}.views`,\n\t\t\t\t\t`fragment \"${fragmentId}\" is granted view \"${view}\", which the release itself does not grant`);\n\t\t\t}\n\t\t}\n\t\tfor (const intent of declared.intents ?? []) {\n\t\t\tif (!grantedIntents.has(intent)) {\n\t\t\t\tadd(\"fragment_grant_exceeds_release\", `grants.fragments.${fragmentId}.intents`,\n\t\t\t\t\t`fragment \"${fragmentId}\" is granted intent \"${intent}\", which the release itself does not grant`);\n\t\t\t}\n\t\t}\n\t\tfragmentGrants.set(fragmentId, declared);\n\t}\n\n\t// ── Walk the default tree and every selectable variant ──────────────\n\t// Each tree gets its own id set: ids must be unique within a tree, but two\n\t// variants of the same page naturally reuse them, and only one ever renders.\n\tconst walkTree = (root: typeof input.document.root, path: string): void => {\n\t\twalkFragment(root, path, {\n\t\t\tids: new Set(),\n\t\t\tknownComponents,\n\t\t\tknownViews,\n\t\t\tgrantedViews,\n\t\t\tknownIntents,\n\t\t\tgrantedIntents,\n\t\t\tfragmentGrants,\n\t\t\tcoreComponents,\n\t\t\tfindings,\n\t\t\tadd,\n\t\t});\n\t};\n\n\twalkTree(input.document.root, \"document.root\");\n\n\tconst seenVariantIds = new Set<string>();\n\t(input.document.variants ?? []).forEach((variant, index) => {\n\t\tif (seenVariantIds.has(variant.id)) {\n\t\t\tadd(\"duplicate_variant_id\", `document.variants[${index}].id`,\n\t\t\t\t`variant id \"${variant.id}\" is declared more than once`);\n\t\t} else {\n\t\t\tseenVariantIds.add(variant.id);\n\t\t}\n\t\twalkTree(variant.root, `document.variants[${index}].root`);\n\t});\n\n\t// ── Produce release ─────────────────────────────────────────────────\n\tif (findings.length > 0) {\n\t\treturn { valid: false, findings, release: undefined };\n\t}\n\n\tconst release: SduiRelease = {\n\t\tformatVersion: 2,\n\t\treleaseDigest: releaseDigest(\n\t\t\tinput.document,\n\t\t\tinput.tokenSet,\n\t\t\tresolvedPacks,\n\t\t\tinput.grants,\n\t\t\tinput.assembly.assemblyDigest,\n\t\t),\n\t\tassemblyDigest: input.assembly.assemblyDigest,\n\t\tdocument: input.document,\n\t\ttokenSet: input.tokenSet,\n\t\tcomponentPacks: [...resolvedPacks].sort((a, b) => {\n\t\t\tconst key = (e: ResolvedSduiComponentPack) => `${e.namespace}/${e.pack}`;\n\t\t\treturn key(a) < key(b) ? -1 : key(a) > key(b) ? 1 : 0;\n\t\t}),\n\t\tgrants: {\n\t\t\tviews: [...input.grants.views].sort(),\n\t\t\tintents: [...input.grants.intents].sort(),\n\t\t\t...(input.grants.fragments ? { fragments: canonicalFragmentGrants(input.grants.fragments) } : {}),\n\t\t},\n\t};\n\n\treturn { valid: true, findings: [], release };\n}\n\n/**\n * Throw with every finding listed, for use as a build step. Returns the\n * promoted release when valid.\n */\nexport function assertSduiReleaseValid(input: SduiValidationInput): SduiRelease {\n\tconst result = validateSduiRelease(input);\n\tif (result.valid) return result.release!;\n\tthrow new Error([\n\t\t`SDUI release \"${input.document.name}@${input.document.version}\" is not valid:`,\n\t\t...result.findings.map((finding) => `  - [${finding.code}] ${finding.path}: ${finding.message}`),\n\t].join(\"\\n\"));\n}\n\n\n/** Stable comparison key for an exposed-module mapping. */\nfunction canonicalExposes(exposes: Record<string, string>): string {\n\treturn JSON.stringify(\n\t\tObject.keys(exposes).sort().map((component) => [component, exposes[component]]),\n\t);\n}\n","import { createHash } from \"node:crypto\";\nimport type {\n\tResolvedSduiComponentPack,\n\tSduiAuthorizationGrants,\n\tSduiComponentPackReference,\n\tSduiDocument,\n\tSduiRelease,\n\tSduiTokenSet,\n} from \"./types\";\nimport { assertSduiRelease } from \"./structural\";\n\n// ── Stable serialization ───────────────────────────────────────────────────\n\nfunction sortJson(value: unknown): unknown {\n\tif (Array.isArray(value)) return value.map(sortJson);\n\tif (value && typeof value === \"object\") {\n\t\treturn Object.fromEntries(\n\t\t\tObject.entries(value as Record<string, unknown>)\n\t\t\t\t.sort(([left], [right]) => (left < right ? -1 : left > right ? 1 : 0))\n\t\t\t\t.map(([key, child]) => [key, sortJson(child)]),\n\t\t);\n\t}\n\treturn value;\n}\n\nfunction stableStringify(value: unknown): string {\n\treturn JSON.stringify(sortJson(value));\n}\n\n/**\n * Canonical form for per-fragment grants: fragment ids and their reference\n * lists in sorted order.\n *\n * The digest and the promoted release must both use this. Hashing the caller's\n * raw grants while storing a canonicalised copy produces a release that fails\n * its own integrity check the moment a hand-authored grant file is not already\n * sorted. `Object.fromEntries` is deliberate: plain assignment to a key named\n * `__proto__` sets the prototype instead of recording the entry, which would\n * drop that fragment's narrowing from the release.\n */\nexport function canonicalFragmentGrants(\n\tfragments: Record<string, { views?: readonly string[]; intents?: readonly string[] }> | undefined,\n): Record<string, { views?: string[]; intents?: string[] }> {\n\tif (!fragments) return {};\n\treturn Object.fromEntries(\n\t\tObject.keys(fragments)\n\t\t\t.sort()\n\t\t\t.map((fragmentId) => {\n\t\t\t\tconst declared = fragments[fragmentId] as { views?: readonly string[]; intents?: readonly string[] };\n\t\t\t\treturn [fragmentId, {\n\t\t\t\t\t...(declared.views ? { views: [...declared.views].sort() } : {}),\n\t\t\t\t\t...(declared.intents ? { intents: [...declared.intents].sort() } : {}),\n\t\t\t\t}];\n\t\t\t}),\n\t);\n}\n\nexport function releaseDigest(\n\tdocument: SduiDocument,\n\ttokenSet: SduiTokenSet,\n\tcomponentPacks: ResolvedSduiComponentPack[],\n\tgrants: SduiAuthorizationGrants,\n\tassemblyDigest: string,\n): string {\n\tconst canonical = stableStringify({\n\t\tdocument: {\n\t\t\tformatVersion: document.formatVersion,\n\t\t\tname: document.name,\n\t\t\tversion: document.version,\n\t\t\troot: document.root,\n\t\t\t// Selectable trees, so two documents differing only in their variants\n\t\t\t// must not share a digest. Sorted by id, because reordering the same\n\t\t\t// set does not change which trees can render. Omitted entirely when\n\t\t\t// absent, so a document that declares none digests exactly as it did\n\t\t\t// before variants existed.\n\t\t\t...(document.variants?.length\n\t\t\t\t? {\n\t\t\t\t\tvariants: [...document.variants].sort((left, right) =>\n\t\t\t\t\t\tleft.id < right.id ? -1 : left.id > right.id ? 1 : 0),\n\t\t\t\t}\n\t\t\t\t: {}),\n\t\t\ttokenSet: document.tokenSet,\n\t\t\tcomponentPacks: [...document.componentPacks].sort((a: SduiComponentPackReference, b: SduiComponentPackReference) => {\n\t\t\t\tconst key = (e: SduiComponentPackReference) => `${e.namespace}/${e.pack}`;\n\t\t\t\treturn key(a) < key(b) ? -1 : key(a) > key(b) ? 1 : 0;\n\t\t\t}),\n\t\t},\n\t\ttokenSet: {\n\t\t\tformatVersion: tokenSet.formatVersion,\n\t\t\tname: tokenSet.name,\n\t\t\tversion: tokenSet.version,\n\t\t\ttokens: tokenSet.tokens,\n\t\t},\n\t\tcomponentPacks: [...componentPacks].sort((a, b) => {\n\t\t\tconst key = (e: ResolvedSduiComponentPack) => `${e.namespace}/${e.pack}`;\n\t\t\treturn key(a) < key(b) ? -1 : key(a) > key(b) ? 1 : 0;\n\t\t}),\n\t\tgrants: {\n\t\t\tviews: [...grants.views].sort(),\n\t\t\tintents: [...grants.intents].sort(),\n\t\t\t// Omitted when absent for the same reason as variants: a release with\n\t\t\t// no per-fragment narrowing must digest as it did before the field\n\t\t\t// existed, or every previously promoted release stops verifying.\n\t\t\t...(grants.fragments && Object.keys(grants.fragments).length\n\t\t\t\t? { fragments: canonicalFragmentGrants(grants.fragments) }\n\t\t\t\t: {}),\n\t\t},\n\t\tassemblyDigest,\n\t});\n\treturn createHash(\"sha256\").update(canonical).digest(\"hex\");\n}\n\n/**\n * Compute the canonical release digest for a valid release. Two releases with\n * the same document, token set, and resolved packs produce the same digest,\n * so a channel can verify it is consuming the exact release it was built for.\n */\nexport function computeReleaseDigest(\n\tdocument: SduiDocument,\n\ttokenSet: SduiTokenSet,\n\tcomponentPacks: ResolvedSduiComponentPack[],\n\tgrants: SduiAuthorizationGrants,\n\tassemblyDigest: string,\n): string {\n\treturn releaseDigest(document, tokenSet, componentPacks, grants, assemblyDigest);\n}\n\n/** Reject promoted release content that no longer matches its immutable digest. */\nexport function assertSduiReleaseIntegrity(release: SduiRelease): void {\n\tassertSduiRelease(release);\n\tconst expected = releaseDigest(\n\t\trelease.document,\n\t\trelease.tokenSet,\n\t\trelease.componentPacks,\n\t\trelease.grants,\n\t\trelease.assemblyDigest,\n\t);\n\tif (release.releaseDigest !== expected) {\n\t\tthrow new Error(`SDUI release releaseDigest does not match promoted content; expected \"${expected}\".`);\n\t}\n}\n","import type { UsageContract } from \"@fabricorg/gen-capability\";\nimport type { SduiFindingCode } from \"./types\";\nimport { fail, parseCapabilityRef } from \"./helpers\";\n\nexport function buildKnownViews(contracts: readonly UsageContract[]): Set<string> {\n\tconst views = new Set<string>();\n\tfor (const contract of contracts) {\n\t\tfor (const view of contract.views) {\n\t\t\tconst name = view.name.startsWith(`${contract.namespace}/`)\n\t\t\t\t? view.name.slice(contract.namespace.length + 1)\n\t\t\t\t: view.name;\n\t\t\tviews.add(`${contract.namespace}/${name}`);\n\t\t}\n\t}\n\treturn views;\n}\n\nexport function buildKnownActionIntents(contracts: readonly UsageContract[]): Set<string> {\n\tconst intents = new Set<string>();\n\tfor (const contract of contracts) {\n\t\tconst experience = contract.extensions?.[\"fabric.experience/v1\"] as\n\t\t\t| { actionIntents?: Array<{ name: string; actionId: string }> }\n\t\t\t| undefined;\n\t\tfor (const intent of experience?.actionIntents ?? []) {\n\t\t\t// The intent name is dotted (e.g., \"orders.submit\"); the capability\n\t\t\t// ref uses the part after the namespace prefix.\n\t\t\tconst shortName = intent.name.startsWith(`${contract.namespace}.`)\n\t\t\t\t? intent.name.slice(contract.namespace.length + 1)\n\t\t\t\t: intent.name;\n\t\t\tintents.add(`${contract.namespace}/${shortName}`);\n\t\t}\n\t}\n\treturn intents;\n}\n\nexport function buildGrantedReferences(\n\treferences: readonly string[],\n\tpath: string,\n): Set<string> {\n\tconst granted = new Set<string>();\n\tfor (const [index, reference] of references.entries()) {\n\t\tconst referencePath = `${path}[${index}]`;\n\t\tif (!parseCapabilityRef(reference)) {\n\t\t\tfail(referencePath, \"must be a valid capability:// reference\");\n\t\t}\n\t\tgranted.add(reference);\n\t}\n\treturn granted;\n}\n\nexport function validateIntentActionDeclarations(\n\tcontracts: readonly UsageContract[],\n\tadd: (code: SduiFindingCode, path: string, message: string) => void,\n): void {\n\tfor (const contract of contracts) {\n\t\tconst experience = contract.extensions?.[\"fabric.experience/v1\"] as\n\t\t\t| { actionIntents?: Array<{ name: string; actionId: string }> }\n\t\t\t| undefined;\n\t\tconst actions = new Set(contract.actions.map((action) => action.actionId));\n\t\tfor (const [index, intent] of (experience?.actionIntents ?? []).entries()) {\n\t\t\tif (!actions.has(intent.actionId)) {\n\t\t\t\tadd(\n\t\t\t\t\t\"intent_action_not_found\",\n\t\t\t\t\t`contracts.${contract.namespace}.actionIntents[${index}].actionId`,\n\t\t\t\t\t`intent \"${intent.name}\" references action \"${intent.actionId}\", which the capability does not declare`,\n\t\t\t\t);\n\t\t\t}\n\t\t}\n\t}\n}\n","import type { SduiCapabilityRef, SduiFinding, SduiFindingCode, SduiFragment, SduiFragmentValue } from \"./types\";\nimport { parseCapabilityRef } from \"./helpers\";\n\n/** Deep enough for any authored document; shallow enough to bound a cycle. */\nconst MAX_PROP_DEPTH = 64;\n\n// ── Fragment tree walker ────────────────────────────────────────────────────\n\nexport interface FragmentWalkContext {\n\tids: Set<string>;\n\tknownComponents: Set<string>;\n\tknownViews: Set<string>;\n\t/** Grants in force for the fragment being walked, already narrowed. */\n\tgrantedViews: ReadonlySet<string>;\n\tknownIntents: Set<string>;\n\tgrantedIntents: ReadonlySet<string>;\n\t/** Per-fragment narrowing declared by the release, keyed by fragment id. */\n\tfragmentGrants?: ReadonlyMap<string, { views?: readonly string[]; intents?: readonly string[] }>;\n\tcoreComponents: Set<string>;\n\tfindings: SduiFinding[];\n\tadd: (code: SduiFindingCode, path: string, message: string) => void;\n}\n\nexport function isCapabilityRefValue(value: unknown): value is SduiCapabilityRef {\n\treturn (\n\t\tvalue !== null &&\n\t\ttypeof value === \"object\" &&\n\t\t!Array.isArray(value) &&\n\t\ttypeof (value as SduiCapabilityRef).$ref === \"string\" &&\n\t\t(value as SduiCapabilityRef).$ref.startsWith(\"capability://\")\n\t);\n}\n\n/**\n * Intersect the grants in force with what a fragment declares. Intersection\n * rather than replacement is what makes a fragment entry unable to widen: a\n * reference the release never granted cannot re-enter through a subtree.\n */\nfunction narrowGrants(current: ReadonlySet<string>, declared: readonly string[] | undefined): ReadonlySet<string> {\n\tif (declared === undefined) return current;\n\treturn new Set(declared.filter((reference) => current.has(reference)));\n}\n\nexport function walkFragment(fragment: SduiFragment, path: string, context: FragmentWalkContext): void {\n\t// ── Narrow grants for this fragment and everything beneath it ───────\n\tconst declared = context.fragmentGrants?.get(fragment.id);\n\tconst scoped: FragmentWalkContext = declared\n\t\t? {\n\t\t\t...context,\n\t\t\tgrantedViews: narrowGrants(context.grantedViews, declared.views),\n\t\t\tgrantedIntents: narrowGrants(context.grantedIntents, declared.intents),\n\t\t}\n\t\t: context;\n\n\t// ── Duplicate fragment IDs ──────────────────────────────────────────\n\tif (scoped.ids.has(fragment.id)) {\n\t\tscoped.add(\"duplicate_fragment_id\", `${path}.id`, `fragment id \"${fragment.id}\" is declared more than once`);\n\t} else {\n\t\tscoped.ids.add(fragment.id);\n\t}\n\n\t// ── Unknown components ──────────────────────────────────────────────\n\tif (fragment.component !== undefined) {\n\t\tconst separator = fragment.component.indexOf(\".\");\n\t\tif (separator === -1) {\n\t\t\tif (!scoped.coreComponents.has(fragment.component)) {\n\t\t\t\tscoped.add(\"unknown_component\", `${path}.component`,\n\t\t\t\t\t`component \"${fragment.component}\" is not a core component or in any declared pack`);\n\t\t\t}\n\t\t} else if (!scoped.knownComponents.has(fragment.component)) {\n\t\t\tscoped.add(\"unknown_component\", `${path}.component`,\n\t\t\t\t`component \"${fragment.component}\" is not in any declared component pack`);\n\t\t}\n\t}\n\n\t// ── Unauthorized data references ────────────────────────────────────\n\tif (fragment.dataRef !== undefined) {\n\t\tconst ref = parseCapabilityRef(fragment.dataRef);\n\t\tif (!ref) {\n\t\t\tscoped.add(\"unauthorized_data_ref\", `${path}.dataRef`,\n\t\t\t\t`\"${fragment.dataRef}\" is not a valid capability:// view reference`);\n\t\t} else if (!scoped.knownViews.has(`${ref.namespace}/${ref.name}`)) {\n\t\t\tscoped.add(\"unauthorized_data_ref\", `${path}.dataRef`,\n\t\t\t\t`fragment references view \"${fragment.dataRef}\" which no known capability publishes`);\n\t\t} else if (!scoped.grantedViews.has(fragment.dataRef)) {\n\t\t\tscoped.add(\"denied_view_ref\", `${path}.dataRef`,\n\t\t\t\t`fragment references view \"${fragment.dataRef}\" which is published but not granted to this release`);\n\t\t}\n\t}\n\n\t// ── Mutation bypass: actions must be capability action-intent refs ──\n\tfor (const [name, actionRef] of Object.entries(fragment.actions ?? {})) {\n\t\tconst actionPath = `${path}.actions.${name}`;\n\t\tconst ref = parseCapabilityRef(actionRef.intent);\n\t\tif (!ref) {\n\t\t\tscoped.add(\"mutation_bypass\", `${actionPath}.intent`,\n\t\t\t\t`action \"${name}\" intent \"${actionRef.intent}\" is not a capability:// reference; direct mutations bypass governance`);\n\t\t\tcontinue;\n\t\t}\n\t\tif (!scoped.knownIntents.has(`${ref.namespace}/${ref.name}`)) {\n\t\t\tscoped.add(\"mutation_bypass\", `${actionPath}.intent`,\n\t\t\t\t`action \"${name}\" references intent \"${actionRef.intent}\" which no known capability declares`);\n\t\t} else if (!scoped.grantedIntents.has(actionRef.intent)) {\n\t\t\tscoped.add(\"denied_intent_ref\", `${actionPath}.intent`,\n\t\t\t\t`action \"${name}\" references intent \"${actionRef.intent}\" which is published but not granted to this release`);\n\t\t}\n\t\tif (actionRef.params !== undefined) {\n\t\t\tcheckPropValues(actionRef.params, `${actionPath}.params`, scoped);\n\t\t}\n\t}\n\n\t// ── Check prop values for unauthorized data refs ───────────────────\n\tif (fragment.props !== undefined) {\n\t\tcheckPropValues(fragment.props, `${path}.props`, scoped);\n\t}\n\n\t// ── Recurse into children ───────────────────────────────────────────\n\tif (fragment.children !== undefined) {\n\t\tfragment.children.forEach((child, index) => {\n\t\t\twalkFragment(child, `${path}.children[${index}]`, scoped);\n\t\t});\n\t}\n}\n\n/**\n * Check one prop value wherever it sits: at a key, inside an array, or nested\n * in either. Every container routes back through this function, so a\n * capability reference resolves against the grant list at any depth. Checking\n * only at key positions leaves array elements unvalidated, and an array is the\n * ordinary shape for list props, so that gap is a grant bypass rather than an\n * edge case.\n */\nexport function checkValue(value: SduiFragmentValue, path: string, context: FragmentWalkContext, depth = 0): void {\n\tif (depth > MAX_PROP_DEPTH) {\n\t\tcontext.add(\"invalid_fragment\", path,\n\t\t\t`prop nesting exceeds ${MAX_PROP_DEPTH} levels; a cyclic or pathologically deep value cannot be checked`);\n\t\treturn;\n\t}\n\tif (isCapabilityRefValue(value)) {\n\t\tconst ref = parseCapabilityRef(value.$ref);\n\t\tif (!ref) {\n\t\t\tcontext.add(\"unauthorized_data_ref\", `${path}.$ref`,\n\t\t\t\t`\"${value.$ref}\" is not a valid capability:// view reference`);\n\t\t} else if (!context.knownViews.has(`${ref.namespace}/${ref.name}`)) {\n\t\t\tcontext.add(\"unauthorized_data_ref\", `${path}.$ref`,\n\t\t\t\t`prop references view \"${value.$ref}\" which no known capability publishes`);\n\t\t} else if (!context.grantedViews.has(value.$ref)) {\n\t\t\tcontext.add(\"denied_view_ref\", `${path}.$ref`,\n\t\t\t\t`prop references view \"${value.$ref}\" which is published but not granted to this release`);\n\t\t}\n\t\t// A reference object is not a leaf. Returning here would let a granted\n\t\t// reference shield ungranted ones parked beside it on the same object.\n\t\tfor (const [key, sibling] of Object.entries(value)) {\n\t\t\tif (key === \"$ref\") continue;\n\t\t\tcheckValue(sibling as SduiFragmentValue, `${path}.${key}`, context, depth + 1);\n\t\t}\n\t\treturn;\n\t}\n\tif (Array.isArray(value)) {\n\t\tvalue.forEach((item, index) => checkValue(item, `${path}[${index}]`, context, depth + 1));\n\t\treturn;\n\t}\n\tif (value !== null && typeof value === \"object\") {\n\t\tcheckPropValues(value as Record<string, SduiFragmentValue>, path, context, depth + 1);\n\t}\n}\n\nexport function checkPropValues(props: Record<string, SduiFragmentValue>, path: string, context: FragmentWalkContext, depth = 0): void {\n\tfor (const [key, value] of Object.entries(props)) {\n\t\tcheckValue(value, `${path}.${key}`, context, depth);\n\t}\n}\n","import type { SduiFragment, SduiRelease } from \"./types\";\nimport { assertSduiReleaseIntegrity } from \"./digest\";\n\n// ── Channel consumption contract ────────────────────────────────────────────\n\n/**\n * A channel is a rendering target (web, mobile, CLI). A channel consumes a\n * validated release and resolves capability references through its own host\n * adapters. Reads go through `ProjectionHost`; actions go through\n * `PlatformHost`. The channel never interprets or bypasses capability\n * references — it renders fragments and forwards action intents.\n */\nexport interface SduiChannel {\n\tid: string;\n\t/** Core components this channel renderer implements. */\n\tcoreComponents: readonly string[];\n\t/** Consume a validated release; returns the release if the channel's core\n\t *  vocabulary covers every core component the document uses. */\n\tconsume(release: SduiRelease): SduiChannelConsumptionResult;\n}\n\nexport interface SduiChannelConsumptionResult {\n\t/** The release the channel consumed. */\n\trelease: SduiRelease;\n\t/** Whether the channel's core vocabulary covers the document. */\n\tcompatible: boolean;\n\t/** Core components the document uses that the channel does not implement. */\n\tmissingCoreComponents: string[];\n}\n\n/**\n * Create a channel that consumes a release. The channel verifies that every\n * core component the document references is in its vocabulary; pack-namespaced\n * components are resolved from the release's locked packs, not the channel.\n */\nexport function createSduiChannel(id: string, coreComponents: readonly string[]): SduiChannel {\n\treturn {\n\t\tid,\n\t\tcoreComponents,\n\t\tconsume(release) {\n\t\t\tassertSduiReleaseIntegrity(release);\n\t\t\tconst used = collectCoreComponents(release.document.root);\n\t\t\tfor (const variant of release.document.variants ?? []) {\n\t\t\t\tfor (const component of collectCoreComponents(variant.root)) used.add(component);\n\t\t\t}\n\t\t\tconst missing = [...used].filter((component) => !coreComponents.includes(component));\n\t\t\treturn {\n\t\t\t\trelease,\n\t\t\t\tcompatible: missing.length === 0,\n\t\t\t\tmissingCoreComponents: missing,\n\t\t\t};\n\t\t},\n\t};\n}\n\nfunction collectCoreComponents(fragment: SduiFragment): Set<string> {\n\tconst used = new Set<string>();\n\tif (fragment.component !== undefined && !fragment.component.includes(\".\")) {\n\t\tused.add(fragment.component);\n\t}\n\tif (fragment.children !== undefined) {\n\t\tfor (const child of fragment.children) {\n\t\t\tfor (const component of collectCoreComponents(child)) used.add(component);\n\t\t}\n\t}\n\treturn used;\n}\n","import type { PortableJsonSchema } from \"@fabricorg/platform\";\n\n// ── JSON Schema for the release document (machine-readable) ─────────────────\n\nexport const SDUI_DOCUMENT_JSON_SCHEMA: PortableJsonSchema = {\n\t$schema: \"https://json-schema.org/draft/2020-12/schema\",\n\ttitle: \"Fabric SDUI document\",\n\ttype: \"object\",\n\trequired: [\"formatVersion\", \"name\", \"version\", \"root\", \"tokenSet\", \"componentPacks\"],\n\tproperties: {\n\t\tformatVersion: { type: \"integer\", enum: [1] },\n\t\tname: { type: \"string\", pattern: \"^[a-z][a-z0-9-]*$\" },\n\t\tversion: { type: \"string\", pattern: \"^\\\\d+\\\\.\\\\d+\\\\.\\\\d+\" },\n\t\troot: { type: \"object\" },\n\t\ttokenSet: { type: \"object\", required: [\"name\", \"version\"] },\n\t\tcomponentPacks: { type: \"array\" },\n\t},\n} as unknown as PortableJsonSchema;\n\nexport const SDUI_RELEASE_JSON_SCHEMA: PortableJsonSchema = {\n\t$schema: \"https://json-schema.org/draft/2020-12/schema\",\n\ttitle: \"Fabric SDUI promoted release\",\n\ttype: \"object\",\n\trequired: [\"formatVersion\", \"releaseDigest\", \"assemblyDigest\", \"document\", \"tokenSet\", \"componentPacks\", \"grants\"],\n\tproperties: {\n\t\tformatVersion: { type: \"integer\", enum: [2] },\n\t\treleaseDigest: { type: \"string\", pattern: \"^[0-9a-f]{64}$\" },\n\t\tassemblyDigest: { type: \"string\", pattern: \"^[0-9a-f]{64}$\" },\n\t\tdocument: { type: \"object\" },\n\t\ttokenSet: { type: \"object\" },\n\t\tcomponentPacks: { type: \"array\" },\n\t\tgrants: { type: \"object\", required: [\"views\", \"intents\"] },\n\t},\n} as unknown as PortableJsonSchema;\n"],"mappings":";;;;;;;;;;;;;;;;;;;;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;;;ACQO,IAAM,+BAA+B;AAKrC,IAAM,gCAAgC;AAKtC,IAAM,qCAAqC;AAK3C,IAAM,8BAA8B;;;ACvB3C,sBAAkE;AAClE,sBAAiC;;;ACC1B,SAAS,KAAK,MAAc,SAAwB;AAC1D,QAAM,IAAI,MAAM,QAAQ,IAAI,IAAI,OAAO,GAAG;AAC3C;AAEO,SAAS,cAAc,OAAgB,MAAsB;AACnE,MAAI,OAAO,UAAU,YAAY,CAAC,MAAM,KAAK,EAAG,MAAK,MAAM,4BAA4B;AACvF,SAAO;AACR;AAEO,SAAS,cAAc,OAAgB,MAAuC;AACpF,MAAI,CAAC,SAAS,OAAO,UAAU,YAAY,MAAM,QAAQ,KAAK,EAAG,MAAK,MAAM,mBAAmB;AAC/F,SAAO;AACR;AAEO,SAAS,aAAa,OAAgB,MAAyB;AACrE,MAAI,CAAC,MAAM,QAAQ,KAAK,EAAG,MAAK,MAAM,kBAAkB;AACxD,SAAO;AACR;AAIO,SAAS,mBAAmB,KAA8D;AAChG,QAAM,QAAQ,2CAA2C,KAAK,GAAG;AACjE,MAAI,CAAC,MAAO,QAAO;AACnB,SAAO,EAAE,WAAW,MAAM,CAAC,GAAI,MAAM,MAAM,CAAC,EAAG;AAChD;;;ADZA,IAAM,cAAc,oBAAI,IAAmB,CAAC,SAAS,WAAW,YAAY,cAAc,UAAU,UAAU,QAAQ,CAAC;AAEhH,SAAS,mBAAmB,OAAgB,OAAO,YAA2C;AACpG,QAAM,WAAW,cAAc,OAAO,IAAI;AAC1C,MAAI,SAAS,kBAAkB,GAAG;AACjC,SAAK,GAAG,IAAI,kBAAkB,uBAAuB,KAAK,UAAU,SAAS,aAAa,CAAC,EAAE;AAAA,EAC9F;AACA,MAAI,CAAC,oBAAoB,KAAK,cAAc,SAAS,MAAM,GAAG,IAAI,OAAO,CAAC,GAAG;AAC5E,SAAK,GAAG,IAAI,SAAS,gDAAgD;AAAA,EACtE;AACA,MAAI,CAAC,sCAAsC,KAAK,cAAc,SAAS,SAAS,GAAG,IAAI,UAAU,CAAC,GAAG;AACpG,SAAK,GAAG,IAAI,YAAY,0BAA0B;AAAA,EACnD;AACA,QAAM,SAAS,cAAc,SAAS,QAAQ,GAAG,IAAI,SAAS;AAC9D,aAAW,CAAC,MAAM,KAAK,KAAK,OAAO,QAAQ,MAAM,GAAG;AACnD,UAAM,YAAY,GAAG,IAAI,WAAW,IAAI;AACxC,QAAI,CAAC,oBAAoB,KAAK,IAAI,EAAG,MAAK,WAAW,2DAA2D;AAChH,UAAM,QAAQ,cAAc,OAAO,SAAS;AAC5C,UAAM,OAAO,cAAc,MAAM,MAAM,GAAG,SAAS,OAAO;AAC1D,QAAI,CAAC,YAAY,IAAI,IAAqB,EAAG,MAAK,GAAG,SAAS,SAAS,kBAAkB,CAAC,GAAG,WAAW,EAAE,KAAK,IAAI,CAAC,EAAE;AACtH,kBAAc,MAAM,OAAO,GAAG,SAAS,QAAQ;AAAA,EAChD;AACD;AAIO,SAAS,wBAAwB,OAAgB,OAAO,iBAAqD;AACnH,QAAM,OAAO,cAAc,OAAO,IAAI;AACtC,MAAI,KAAK,kBAAkB,GAAG;AAC7B,SAAK,GAAG,IAAI,kBAAkB,uBAAuB,KAAK,UAAU,KAAK,aAAa,CAAC,EAAE;AAAA,EAC1F;AACA,MAAI,CAAC,oBAAoB,KAAK,cAAc,KAAK,MAAM,GAAG,IAAI,OAAO,CAAC,GAAG;AACxE,SAAK,GAAG,IAAI,SAAS,gDAAgD;AAAA,EACtE;AACA,MAAI,CAAC,oBAAoB,KAAK,cAAc,KAAK,WAAW,GAAG,IAAI,YAAY,CAAC,GAAG;AAClF,SAAK,GAAG,IAAI,cAAc,gDAAgD;AAAA,EAC3E;AACA,MAAI,CAAC,sCAAsC,KAAK,cAAc,KAAK,SAAS,GAAG,IAAI,UAAU,CAAC,GAAG;AAChG,SAAK,GAAG,IAAI,YAAY,0BAA0B;AAAA,EACnD;AACA,MAAI,CAAC,iBAAiB,KAAK,cAAc,KAAK,gBAAgB,GAAG,IAAI,iBAAiB,CAAC,GAAG;AACzF,SAAK,GAAG,IAAI,mBAAmB,oCAAoC;AAAA,EACpE;AACA,MAAI,KAAK,WAAW,QAAW;AAC9B,UAAM,SAAS,cAAc,KAAK,QAAQ,GAAG,IAAI,SAAS;AAC1D,kBAAc,OAAO,OAAO,GAAG,IAAI,eAAe;AAClD,QAAI,CAAC,0CAA0C,KAAK,cAAc,OAAO,WAAW,GAAG,IAAI,mBAAmB,CAAC,GAAG;AACjH,WAAK,GAAG,IAAI,qBAAqB,6DAA0D;AAAA,IAC5F;AACA,UAAM,UAAU,cAAc,OAAO,SAAS,GAAG,IAAI,iBAAiB;AACtE,eAAW,CAAC,WAAW,UAAU,KAAK,OAAO,QAAQ,OAAO,GAAG;AAC9D,oBAAc,YAAY,GAAG,IAAI,mBAAmB,SAAS,EAAE;AAAA,IAChE;AAAA,EACD;AACA,QAAM,aAAa,cAAc,KAAK,YAAY,GAAG,IAAI,aAAa;AACtE,aAAW,CAAC,MAAM,UAAU,KAAK,OAAO,QAAQ,UAAU,GAAG;AAC5D,UAAM,gBAAgB,GAAG,IAAI,eAAe,IAAI;AAChD,QAAI,CAAC,oBAAoB,KAAK,IAAI,EAAG,MAAK,eAAe,+DAA+D;AACxH,UAAM,MAAM,cAAc,YAAY,aAAa;AACnD,QAAI,IAAI,eAAe,QAAW;AACjC,UAAI,CAAC,MAAM,QAAQ,IAAI,UAAU,EAAG,MAAK,GAAG,aAAa,eAAe,kBAAkB;AAC1F,iBAAW,QAAQ,IAAI,YAAyB;AAC/C,YAAI,OAAO,SAAS,YAAY,CAAC,KAAK,KAAK,EAAG,MAAK,GAAG,aAAa,eAAe,mCAAmC;AAAA,MACtH;AAAA,IACD;AACA,QAAI,IAAI,gBAAgB,QAAW;AAClC,UAAI;AAAE,sDAAyB,IAAI,aAAmC,GAAG,aAAa,cAAc;AAAA,MAAG,SAChG,OAAO;AAAE,aAAK,eAAe,iBAAiB,QAAQ,MAAM,UAAU,OAAO,KAAK,CAAC;AAAA,MAAG;AAAA,IAC9F;AACA,QAAI,IAAI,UAAU,QAAW;AAC5B,UAAI,CAAC,MAAM,QAAQ,IAAI,KAAK,EAAG,MAAK,GAAG,aAAa,UAAU,kBAAkB;AAChF,iBAAW,QAAQ,IAAI,OAAoB;AAC1C,YAAI,OAAO,SAAS,YAAY,CAAC,oBAAoB,KAAK,IAAI,EAAG,MAAK,GAAG,aAAa,UAAU,2DAA2D;AAAA,MAC5J;AAAA,IACD;AAAA,EACD;AACD;AAIO,SAAS,mBAAmB,OAAgB,OAAO,YAA2C;AACpG,QAAM,WAAW,cAAc,OAAO,IAAI;AAC1C,gBAAc,SAAS,IAAI,GAAG,IAAI,KAAK;AACvC,MAAI,SAAS,cAAc,OAAW,eAAc,SAAS,WAAW,GAAG,IAAI,YAAY;AAC3F,MAAI,SAAS,SAAS,QAAW;AAChC,QAAI,CAAC,oBAAoB,KAAK,cAAc,SAAS,MAAM,GAAG,IAAI,OAAO,CAAC,GAAG;AAC5E,WAAK,GAAG,IAAI,SAAS,gDAAgD;AAAA,IACtE;AAAA,EACD;AACA,MAAI,SAAS,YAAY,QAAW;AACnC,UAAM,UAAU,cAAc,SAAS,SAAS,GAAG,IAAI,UAAU;AACjE,QAAI,CAAC,QAAQ,WAAW,eAAe,EAAG,MAAK,GAAG,IAAI,YAAY,mCAAmC;AAAA,EACtG;AACA,MAAI,SAAS,UAAU,QAAW;AACjC,kBAAc,SAAS,OAAO,GAAG,IAAI,QAAQ;AAAA,EAC9C;AACA,MAAI,SAAS,YAAY,QAAW;AACnC,UAAM,UAAU,cAAc,SAAS,SAAS,GAAG,IAAI,UAAU;AACjE,eAAW,CAAC,MAAM,GAAG,KAAK,OAAO,QAAQ,OAAO,GAAG;AAClD,YAAM,aAAa,GAAG,IAAI,YAAY,IAAI;AAC1C,YAAM,YAAY,cAAc,KAAK,UAAU;AAC/C,oBAAc,UAAU,QAAQ,GAAG,UAAU,SAAS;AAAA,IACvD;AAAA,EACD;AACA,MAAI,SAAS,aAAa,QAAW;AACpC,UAAM,WAAW,aAAa,SAAS,UAAU,GAAG,IAAI,WAAW;AACnE,aAAS,QAAQ,CAAC,OAAO,UAAU,mBAAmB,OAAO,GAAG,IAAI,aAAa,KAAK,GAAG,CAAC;AAAA,EAC3F;AACD;AAIO,SAAS,mBAAmB,OAAgB,OAAO,YAA2C;AACpG,QAAM,WAAW,cAAc,OAAO,IAAI;AAC1C,MAAI,SAAS,kBAAkB,GAAG;AACjC,SAAK,GAAG,IAAI,kBAAkB,uBAAuB,KAAK,UAAU,SAAS,aAAa,CAAC,EAAE;AAAA,EAC9F;AACA,MAAI,CAAC,oBAAoB,KAAK,cAAc,SAAS,MAAM,GAAG,IAAI,OAAO,CAAC,GAAG;AAC5E,SAAK,GAAG,IAAI,SAAS,gDAAgD;AAAA,EACtE;AACA,MAAI,CAAC,sCAAsC,KAAK,cAAc,SAAS,SAAS,GAAG,IAAI,UAAU,CAAC,GAAG;AACpG,SAAK,GAAG,IAAI,YAAY,0BAA0B;AAAA,EACnD;AACA,qBAAmB,SAAS,MAAM,GAAG,IAAI,OAAO;AAChD,MAAI,SAAS,aAAa,QAAW;AACpC,iBAAa,SAAS,UAAU,GAAG,IAAI,WAAW,EAAE,QAAQ,CAAC,OAAO,UAAU;AAC7E,YAAM,cAAc,GAAG,IAAI,aAAa,KAAK;AAC7C,YAAM,UAAU,cAAc,OAAO,WAAW;AAChD,UAAI,CAAC,oBAAoB,KAAK,cAAc,QAAQ,IAAI,GAAG,WAAW,KAAK,CAAC,GAAG;AAC9E,aAAK,GAAG,WAAW,OAAO,gDAAgD;AAAA,MAC3E;AACA,UAAI,QAAQ,gBAAgB,OAAW,eAAc,QAAQ,aAAa,GAAG,WAAW,cAAc;AACtG,yBAAmB,QAAQ,MAAM,GAAG,WAAW,OAAO;AAAA,IACvD,CAAC;AAAA,EACF;AACA,QAAM,WAAW,cAAc,SAAS,UAAU,GAAG,IAAI,WAAW;AACpE,gBAAc,SAAS,MAAM,GAAG,IAAI,gBAAgB;AACpD,gBAAc,SAAS,SAAS,GAAG,IAAI,mBAAmB;AAC1D,eAAa,SAAS,gBAAgB,GAAG,IAAI,iBAAiB,EAAE,QAAQ,CAAC,OAAO,UAAU;AACzF,UAAM,OAAO,cAAc,OAAO,GAAG,IAAI,mBAAmB,KAAK,GAAG;AACpE,kBAAc,KAAK,MAAM,GAAG,IAAI,mBAAmB,KAAK,QAAQ;AAChE,kBAAc,KAAK,WAAW,GAAG,IAAI,mBAAmB,KAAK,aAAa;AAC1E,kBAAc,KAAK,OAAO,GAAG,IAAI,mBAAmB,KAAK,SAAS;AAAA,EACnE,CAAC;AACF;AASO,SAAS,8BACf,OACA,OAAO,UACoC;AAC3C,QAAM,SAAS,cAAc,OAAO,IAAI;AACxC,QAAM,QAAQ,aAAa,OAAO,OAAO,GAAG,IAAI,QAAQ;AACxD,QAAM,UAAU,aAAa,OAAO,SAAS,GAAG,IAAI,UAAU;AAC9D,aAAW,CAAC,OAAO,SAAS,KAAK,MAAM,QAAQ,GAAG;AACjD,UAAM,gBAAgB,GAAG,IAAI,UAAU,KAAK;AAC5C,QAAI,CAAC,mBAAmB,cAAc,WAAW,aAAa,CAAC,GAAG;AACjE,WAAK,eAAe,yCAAyC;AAAA,IAC9D;AAAA,EACD;AACA,aAAW,CAAC,OAAO,SAAS,KAAK,QAAQ,QAAQ,GAAG;AACnD,UAAM,gBAAgB,GAAG,IAAI,YAAY,KAAK;AAC9C,QAAI,CAAC,mBAAmB,cAAc,WAAW,aAAa,CAAC,GAAG;AACjE,WAAK,eAAe,yCAAyC;AAAA,IAC9D;AAAA,EACD;AACA,MAAI,OAAO,cAAc,QAAW;AACnC,UAAM,YAAY,cAAc,OAAO,WAAW,GAAG,IAAI,YAAY;AAIrE,UAAM,YAAY,OAAO,eAAe,SAAS;AACjD,QAAI,cAAc,OAAO,aAAa,cAAc,MAAM;AACzD,WAAK,GAAG,IAAI,cAAc,iGAAiG;AAAA,IAC5H;AACA,eAAW,CAAC,YAAY,QAAQ,KAAK,OAAO,QAAQ,SAAS,GAAG;AAC/D,YAAM,eAAe,GAAG,IAAI,cAAc,UAAU;AACpD,YAAM,SAAS,cAAc,UAAU,YAAY;AACnD,iBAAW,SAAS,CAAC,SAAS,SAAS,GAAY;AAClD,YAAI,OAAO,KAAK,MAAM,OAAW;AACjC,qBAAa,OAAO,KAAK,GAAG,GAAG,YAAY,IAAI,KAAK,EAAE,EAAE,QAAQ,CAAC,WAAW,UAAU;AACrF,gBAAM,gBAAgB,GAAG,YAAY,IAAI,KAAK,IAAI,KAAK;AACvD,cAAI,CAAC,mBAAmB,cAAc,WAAW,aAAa,CAAC,GAAG;AACjE,iBAAK,eAAe,yCAAyC;AAAA,UAC9D;AAAA,QACD,CAAC;AAAA,MACF;AAAA,IACD;AAAA,EACD;AACD;AAGO,SAAS,kBAAkB,OAAgB,OAAO,WAAyC;AACjG,QAAM,UAAU,cAAc,OAAO,IAAI;AACzC,MAAI,QAAQ,kBAAkB,GAAG;AAChC,SAAK,GAAG,IAAI,kBAAkB,uBAAuB,KAAK,UAAU,QAAQ,aAAa,CAAC,EAAE;AAAA,EAC7F;AACA,aAAW,SAAS,CAAC,iBAAiB,gBAAgB,GAAY;AACjE,QAAI,CAAC,iBAAiB,KAAK,cAAc,QAAQ,KAAK,GAAG,GAAG,IAAI,IAAI,KAAK,EAAE,CAAC,GAAG;AAC9E,WAAK,GAAG,IAAI,IAAI,KAAK,IAAI,oCAAoC;AAAA,IAC9D;AAAA,EACD;AACA,qBAAmB,QAAQ,UAAU,GAAG,IAAI,WAAW;AACvD,qBAAmB,QAAQ,UAAU,GAAG,IAAI,WAAW;AACvD,gCAA8B,QAAQ,QAAQ,GAAG,IAAI,SAAS;AAC9D,eAAa,QAAQ,gBAAgB,GAAG,IAAI,iBAAiB,EAAE,QAAQ,CAACA,QAAO,UAAU;AACxF,UAAM,WAAW,GAAG,IAAI,mBAAmB,KAAK;AAChD,UAAM,OAAO,cAAcA,QAAO,QAAQ;AAC1C,eAAW,SAAS,CAAC,QAAQ,WAAW,GAAY;AACnD,UAAI,CAAC,oBAAoB,KAAK,cAAc,KAAK,KAAK,GAAG,GAAG,QAAQ,IAAI,KAAK,EAAE,CAAC,GAAG;AAClF,aAAK,GAAG,QAAQ,IAAI,KAAK,IAAI,gDAAgD;AAAA,MAC9E;AAAA,IACD;AACA,QAAI,CAAC,sCAAsC;AAAA,MAC1C,cAAc,KAAK,SAAS,GAAG,QAAQ,UAAU;AAAA,IAClD,GAAG;AACF,WAAK,GAAG,QAAQ,YAAY,0BAA0B;AAAA,IACvD;AACA,UAAM,QAAQ,cAAc,KAAK,OAAO,GAAG,QAAQ,QAAQ;AAC3D,QAAI,KAAC,kCAAiB,KAAK,GAAG;AAC7B,WAAK,GAAG,QAAQ,UAAU,kCAAkC;AAAA,IAC7D;AACA,QAAI,CAAC,iBAAiB,KAAK,cAAc,KAAK,gBAAgB,GAAG,QAAQ,iBAAiB,CAAC,GAAG;AAC7F,WAAK,GAAG,QAAQ,mBAAmB,oCAAoC;AAAA,IACxE;AAAA,EACD,CAAC;AACF;;;AEvPA,IAAAC,mBAKO;AACP,4BAA4C;;;ACN5C,yBAA2B;AAa3B,SAAS,SAAS,OAAyB;AAC1C,MAAI,MAAM,QAAQ,KAAK,EAAG,QAAO,MAAM,IAAI,QAAQ;AACnD,MAAI,SAAS,OAAO,UAAU,UAAU;AACvC,WAAO,OAAO;AAAA,MACb,OAAO,QAAQ,KAAgC,EAC7C,KAAK,CAAC,CAAC,IAAI,GAAG,CAAC,KAAK,MAAO,OAAO,QAAQ,KAAK,OAAO,QAAQ,IAAI,CAAE,EACpE,IAAI,CAAC,CAAC,KAAK,KAAK,MAAM,CAAC,KAAK,SAAS,KAAK,CAAC,CAAC;AAAA,IAC/C;AAAA,EACD;AACA,SAAO;AACR;AAEA,SAAS,gBAAgB,OAAwB;AAChD,SAAO,KAAK,UAAU,SAAS,KAAK,CAAC;AACtC;AAaO,SAAS,wBACf,WAC2D;AAC3D,MAAI,CAAC,UAAW,QAAO,CAAC;AACxB,SAAO,OAAO;AAAA,IACb,OAAO,KAAK,SAAS,EACnB,KAAK,EACL,IAAI,CAAC,eAAe;AACpB,YAAM,WAAW,UAAU,UAAU;AACrC,aAAO,CAAC,YAAY;AAAA,QACnB,GAAI,SAAS,QAAQ,EAAE,OAAO,CAAC,GAAG,SAAS,KAAK,EAAE,KAAK,EAAE,IAAI,CAAC;AAAA,QAC9D,GAAI,SAAS,UAAU,EAAE,SAAS,CAAC,GAAG,SAAS,OAAO,EAAE,KAAK,EAAE,IAAI,CAAC;AAAA,MACrE,CAAC;AAAA,IACF,CAAC;AAAA,EACH;AACD;AAEO,SAAS,cACf,UACA,UACA,gBACA,QACA,gBACS;AACT,QAAM,YAAY,gBAAgB;AAAA,IACjC,UAAU;AAAA,MACT,eAAe,SAAS;AAAA,MACxB,MAAM,SAAS;AAAA,MACf,SAAS,SAAS;AAAA,MAClB,MAAM,SAAS;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,MAMf,GAAI,SAAS,UAAU,SACpB;AAAA,QACD,UAAU,CAAC,GAAG,SAAS,QAAQ,EAAE,KAAK,CAAC,MAAM,UAC5C,KAAK,KAAK,MAAM,KAAK,KAAK,KAAK,KAAK,MAAM,KAAK,IAAI,CAAC;AAAA,MACtD,IACE,CAAC;AAAA,MACJ,UAAU,SAAS;AAAA,MACnB,gBAAgB,CAAC,GAAG,SAAS,cAAc,EAAE,KAAK,CAAC,GAA+B,MAAkC;AACnH,cAAM,MAAM,CAAC,MAAkC,GAAG,EAAE,SAAS,IAAI,EAAE,IAAI;AACvE,eAAO,IAAI,CAAC,IAAI,IAAI,CAAC,IAAI,KAAK,IAAI,CAAC,IAAI,IAAI,CAAC,IAAI,IAAI;AAAA,MACrD,CAAC;AAAA,IACF;AAAA,IACA,UAAU;AAAA,MACT,eAAe,SAAS;AAAA,MACxB,MAAM,SAAS;AAAA,MACf,SAAS,SAAS;AAAA,MAClB,QAAQ,SAAS;AAAA,IAClB;AAAA,IACA,gBAAgB,CAAC,GAAG,cAAc,EAAE,KAAK,CAAC,GAAG,MAAM;AAClD,YAAM,MAAM,CAAC,MAAiC,GAAG,EAAE,SAAS,IAAI,EAAE,IAAI;AACtE,aAAO,IAAI,CAAC,IAAI,IAAI,CAAC,IAAI,KAAK,IAAI,CAAC,IAAI,IAAI,CAAC,IAAI,IAAI;AAAA,IACrD,CAAC;AAAA,IACD,QAAQ;AAAA,MACP,OAAO,CAAC,GAAG,OAAO,KAAK,EAAE,KAAK;AAAA,MAC9B,SAAS,CAAC,GAAG,OAAO,OAAO,EAAE,KAAK;AAAA;AAAA;AAAA;AAAA,MAIlC,GAAI,OAAO,aAAa,OAAO,KAAK,OAAO,SAAS,EAAE,SACnD,EAAE,WAAW,wBAAwB,OAAO,SAAS,EAAE,IACvD,CAAC;AAAA,IACL;AAAA,IACA;AAAA,EACD,CAAC;AACD,aAAO,+BAAW,QAAQ,EAAE,OAAO,SAAS,EAAE,OAAO,KAAK;AAC3D;AAOO,SAAS,qBACf,UACA,UACA,gBACA,QACA,gBACS;AACT,SAAO,cAAc,UAAU,UAAU,gBAAgB,QAAQ,cAAc;AAChF;AAGO,SAAS,2BAA2B,SAA4B;AACtE,oBAAkB,OAAO;AACzB,QAAM,WAAW;AAAA,IAChB,QAAQ;AAAA,IACR,QAAQ;AAAA,IACR,QAAQ;AAAA,IACR,QAAQ;AAAA,IACR,QAAQ;AAAA,EACT;AACA,MAAI,QAAQ,kBAAkB,UAAU;AACvC,UAAM,IAAI,MAAM,yEAAyE,QAAQ,IAAI;AAAA,EACtG;AACD;;;ACxIO,SAAS,gBAAgB,WAAkD;AACjF,QAAM,QAAQ,oBAAI,IAAY;AAC9B,aAAW,YAAY,WAAW;AACjC,eAAW,QAAQ,SAAS,OAAO;AAClC,YAAM,OAAO,KAAK,KAAK,WAAW,GAAG,SAAS,SAAS,GAAG,IACvD,KAAK,KAAK,MAAM,SAAS,UAAU,SAAS,CAAC,IAC7C,KAAK;AACR,YAAM,IAAI,GAAG,SAAS,SAAS,IAAI,IAAI,EAAE;AAAA,IAC1C;AAAA,EACD;AACA,SAAO;AACR;AAEO,SAAS,wBAAwB,WAAkD;AACzF,QAAM,UAAU,oBAAI,IAAY;AAChC,aAAW,YAAY,WAAW;AACjC,UAAM,aAAa,SAAS,aAAa,sBAAsB;AAG/D,eAAW,UAAU,YAAY,iBAAiB,CAAC,GAAG;AAGrD,YAAM,YAAY,OAAO,KAAK,WAAW,GAAG,SAAS,SAAS,GAAG,IAC9D,OAAO,KAAK,MAAM,SAAS,UAAU,SAAS,CAAC,IAC/C,OAAO;AACV,cAAQ,IAAI,GAAG,SAAS,SAAS,IAAI,SAAS,EAAE;AAAA,IACjD;AAAA,EACD;AACA,SAAO;AACR;AAEO,SAAS,uBACf,YACA,MACc;AACd,QAAM,UAAU,oBAAI,IAAY;AAChC,aAAW,CAAC,OAAO,SAAS,KAAK,WAAW,QAAQ,GAAG;AACtD,UAAM,gBAAgB,GAAG,IAAI,IAAI,KAAK;AACtC,QAAI,CAAC,mBAAmB,SAAS,GAAG;AACnC,WAAK,eAAe,yCAAyC;AAAA,IAC9D;AACA,YAAQ,IAAI,SAAS;AAAA,EACtB;AACA,SAAO;AACR;AAEO,SAAS,iCACf,WACA,KACO;AACP,aAAW,YAAY,WAAW;AACjC,UAAM,aAAa,SAAS,aAAa,sBAAsB;AAG/D,UAAM,UAAU,IAAI,IAAI,SAAS,QAAQ,IAAI,CAAC,WAAW,OAAO,QAAQ,CAAC;AACzE,eAAW,CAAC,OAAO,MAAM,MAAM,YAAY,iBAAiB,CAAC,GAAG,QAAQ,GAAG;AAC1E,UAAI,CAAC,QAAQ,IAAI,OAAO,QAAQ,GAAG;AAClC;AAAA,UACC;AAAA,UACA,aAAa,SAAS,SAAS,kBAAkB,KAAK;AAAA,UACtD,WAAW,OAAO,IAAI,wBAAwB,OAAO,QAAQ;AAAA,QAC9D;AAAA,MACD;AAAA,IACD;AAAA,EACD;AACD;;;ACjEA,IAAM,iBAAiB;AAmBhB,SAAS,qBAAqB,OAA4C;AAChF,SACC,UAAU,QACV,OAAO,UAAU,YACjB,CAAC,MAAM,QAAQ,KAAK,KACpB,OAAQ,MAA4B,SAAS,YAC5C,MAA4B,KAAK,WAAW,eAAe;AAE9D;AAOA,SAAS,aAAa,SAA8B,UAA8D;AACjH,MAAI,aAAa,OAAW,QAAO;AACnC,SAAO,IAAI,IAAI,SAAS,OAAO,CAAC,cAAc,QAAQ,IAAI,SAAS,CAAC,CAAC;AACtE;AAEO,SAAS,aAAa,UAAwB,MAAc,SAAoC;AAEtG,QAAM,WAAW,QAAQ,gBAAgB,IAAI,SAAS,EAAE;AACxD,QAAM,SAA8B,WACjC;AAAA,IACD,GAAG;AAAA,IACH,cAAc,aAAa,QAAQ,cAAc,SAAS,KAAK;AAAA,IAC/D,gBAAgB,aAAa,QAAQ,gBAAgB,SAAS,OAAO;AAAA,EACtE,IACE;AAGH,MAAI,OAAO,IAAI,IAAI,SAAS,EAAE,GAAG;AAChC,WAAO,IAAI,yBAAyB,GAAG,IAAI,OAAO,gBAAgB,SAAS,EAAE,8BAA8B;AAAA,EAC5G,OAAO;AACN,WAAO,IAAI,IAAI,SAAS,EAAE;AAAA,EAC3B;AAGA,MAAI,SAAS,cAAc,QAAW;AACrC,UAAM,YAAY,SAAS,UAAU,QAAQ,GAAG;AAChD,QAAI,cAAc,IAAI;AACrB,UAAI,CAAC,OAAO,eAAe,IAAI,SAAS,SAAS,GAAG;AACnD,eAAO;AAAA,UAAI;AAAA,UAAqB,GAAG,IAAI;AAAA,UACtC,cAAc,SAAS,SAAS;AAAA,QAAmD;AAAA,MACrF;AAAA,IACD,WAAW,CAAC,OAAO,gBAAgB,IAAI,SAAS,SAAS,GAAG;AAC3D,aAAO;AAAA,QAAI;AAAA,QAAqB,GAAG,IAAI;AAAA,QACtC,cAAc,SAAS,SAAS;AAAA,MAAyC;AAAA,IAC3E;AAAA,EACD;AAGA,MAAI,SAAS,YAAY,QAAW;AACnC,UAAM,MAAM,mBAAmB,SAAS,OAAO;AAC/C,QAAI,CAAC,KAAK;AACT,aAAO;AAAA,QAAI;AAAA,QAAyB,GAAG,IAAI;AAAA,QAC1C,IAAI,SAAS,OAAO;AAAA,MAA+C;AAAA,IACrE,WAAW,CAAC,OAAO,WAAW,IAAI,GAAG,IAAI,SAAS,IAAI,IAAI,IAAI,EAAE,GAAG;AAClE,aAAO;AAAA,QAAI;AAAA,QAAyB,GAAG,IAAI;AAAA,QAC1C,6BAA6B,SAAS,OAAO;AAAA,MAAuC;AAAA,IACtF,WAAW,CAAC,OAAO,aAAa,IAAI,SAAS,OAAO,GAAG;AACtD,aAAO;AAAA,QAAI;AAAA,QAAmB,GAAG,IAAI;AAAA,QACpC,6BAA6B,SAAS,OAAO;AAAA,MAAsD;AAAA,IACrG;AAAA,EACD;AAGA,aAAW,CAAC,MAAM,SAAS,KAAK,OAAO,QAAQ,SAAS,WAAW,CAAC,CAAC,GAAG;AACvE,UAAM,aAAa,GAAG,IAAI,YAAY,IAAI;AAC1C,UAAM,MAAM,mBAAmB,UAAU,MAAM;AAC/C,QAAI,CAAC,KAAK;AACT,aAAO;AAAA,QAAI;AAAA,QAAmB,GAAG,UAAU;AAAA,QAC1C,WAAW,IAAI,aAAa,UAAU,MAAM;AAAA,MAAwE;AACrH;AAAA,IACD;AACA,QAAI,CAAC,OAAO,aAAa,IAAI,GAAG,IAAI,SAAS,IAAI,IAAI,IAAI,EAAE,GAAG;AAC7D,aAAO;AAAA,QAAI;AAAA,QAAmB,GAAG,UAAU;AAAA,QAC1C,WAAW,IAAI,wBAAwB,UAAU,MAAM;AAAA,MAAsC;AAAA,IAC/F,WAAW,CAAC,OAAO,eAAe,IAAI,UAAU,MAAM,GAAG;AACxD,aAAO;AAAA,QAAI;AAAA,QAAqB,GAAG,UAAU;AAAA,QAC5C,WAAW,IAAI,wBAAwB,UAAU,MAAM;AAAA,MAAsD;AAAA,IAC/G;AACA,QAAI,UAAU,WAAW,QAAW;AACnC,sBAAgB,UAAU,QAAQ,GAAG,UAAU,WAAW,MAAM;AAAA,IACjE;AAAA,EACD;AAGA,MAAI,SAAS,UAAU,QAAW;AACjC,oBAAgB,SAAS,OAAO,GAAG,IAAI,UAAU,MAAM;AAAA,EACxD;AAGA,MAAI,SAAS,aAAa,QAAW;AACpC,aAAS,SAAS,QAAQ,CAAC,OAAO,UAAU;AAC3C,mBAAa,OAAO,GAAG,IAAI,aAAa,KAAK,KAAK,MAAM;AAAA,IACzD,CAAC;AAAA,EACF;AACD;AAUO,SAAS,WAAW,OAA0B,MAAc,SAA8B,QAAQ,GAAS;AACjH,MAAI,QAAQ,gBAAgB;AAC3B,YAAQ;AAAA,MAAI;AAAA,MAAoB;AAAA,MAC/B,wBAAwB,cAAc;AAAA,IAAkE;AACzG;AAAA,EACD;AACA,MAAI,qBAAqB,KAAK,GAAG;AAChC,UAAM,MAAM,mBAAmB,MAAM,IAAI;AACzC,QAAI,CAAC,KAAK;AACT,cAAQ;AAAA,QAAI;AAAA,QAAyB,GAAG,IAAI;AAAA,QAC3C,IAAI,MAAM,IAAI;AAAA,MAA+C;AAAA,IAC/D,WAAW,CAAC,QAAQ,WAAW,IAAI,GAAG,IAAI,SAAS,IAAI,IAAI,IAAI,EAAE,GAAG;AACnE,cAAQ;AAAA,QAAI;AAAA,QAAyB,GAAG,IAAI;AAAA,QAC3C,yBAAyB,MAAM,IAAI;AAAA,MAAuC;AAAA,IAC5E,WAAW,CAAC,QAAQ,aAAa,IAAI,MAAM,IAAI,GAAG;AACjD,cAAQ;AAAA,QAAI;AAAA,QAAmB,GAAG,IAAI;AAAA,QACrC,yBAAyB,MAAM,IAAI;AAAA,MAAsD;AAAA,IAC3F;AAGA,eAAW,CAAC,KAAK,OAAO,KAAK,OAAO,QAAQ,KAAK,GAAG;AACnD,UAAI,QAAQ,OAAQ;AACpB,iBAAW,SAA8B,GAAG,IAAI,IAAI,GAAG,IAAI,SAAS,QAAQ,CAAC;AAAA,IAC9E;AACA;AAAA,EACD;AACA,MAAI,MAAM,QAAQ,KAAK,GAAG;AACzB,UAAM,QAAQ,CAAC,MAAM,UAAU,WAAW,MAAM,GAAG,IAAI,IAAI,KAAK,KAAK,SAAS,QAAQ,CAAC,CAAC;AACxF;AAAA,EACD;AACA,MAAI,UAAU,QAAQ,OAAO,UAAU,UAAU;AAChD,oBAAgB,OAA4C,MAAM,SAAS,QAAQ,CAAC;AAAA,EACrF;AACD;AAEO,SAAS,gBAAgB,OAA0C,MAAc,SAA8B,QAAQ,GAAS;AACtI,aAAW,CAAC,KAAK,KAAK,KAAK,OAAO,QAAQ,KAAK,GAAG;AACjD,eAAW,OAAO,GAAG,IAAI,IAAI,GAAG,IAAI,SAAS,KAAK;AAAA,EACnD;AACD;;;AHvIO,SAAS,oBAAoB,OAAkD;AAErF,MAAI,CAAC,MAAM,SAAU,OAAM,IAAI,MAAM,mEAAmE;AACxG,qBAAmB,MAAM,QAAQ;AACjC,qBAAmB,MAAM,QAAQ;AACjC,aAAW,QAAQ,MAAM,eAAgB,yBAAwB,IAAI;AACrE,aAAW,YAAY,MAAM,UAAW,wDAA4B,QAAQ;AAC5E,gCAA8B,MAAM,MAAM;AAC1C,+CAAuB,MAAM,QAAQ;AACrC,QAAM,YAAY,MAAM,UAAU,IAAI,CAAC,aAAa,SAAS,UAAU;AAEvE,QAAM,WAA0B,CAAC;AACjC,QAAM,MAAM,CAAC,MAAuB,MAAc,YAA0B;AAC3E,aAAS,KAAK,EAAE,MAAM,MAAM,QAAQ,CAAC;AAAA,EACtC;AAGA,MAAI,MAAM,SAAS,SAAS,SAAS,MAAM,SAAS,MAAM;AACzD;AAAA,MAAI;AAAA,MAAqB;AAAA,MACxB,kCAAkC,MAAM,SAAS,SAAS,IAAI,8BAA8B,MAAM,SAAS,IAAI;AAAA,IAAG;AAAA,EACpH;AACA,MAAI,MAAM,SAAS,SAAS,YAAY,MAAM,SAAS,SAAS;AAC/D;AAAA,MAAI;AAAA,MAAqB;AAAA,MACxB,0CAA0C,MAAM,SAAS,SAAS,OAAO,sCAAsC,MAAM,SAAS,OAAO;AAAA,IAAG;AAAA,EAC1I;AAGA,QAAM,aAAa,oBAAI,IAAiC;AACxD,aAAW,QAAQ,MAAM,gBAAgB;AACxC,UAAM,MAAM,GAAG,KAAK,SAAS,IAAI,KAAK,IAAI;AAC1C,UAAM,OAAO,WAAW,IAAI,GAAG,KAAK,CAAC;AACrC,SAAK,KAAK,IAAI;AACd,eAAW,IAAI,KAAK,IAAI;AAAA,EACzB;AAEA,QAAM,gBAA6C,CAAC;AACpD,QAAM,0BAA+C,CAAC;AACtD,aAAW,OAAO,MAAM,SAAS,gBAAgB;AAChD,UAAM,MAAM,GAAG,IAAI,SAAS,IAAI,IAAI,IAAI;AACxC,UAAM,YAAY,WAAW,IAAI,GAAG,KAAK,CAAC;AAC1C,UAAM,YAAQ,mCAAiB,IAAI,KAAK;AACxC,QAAI,CAAC,OAAO;AACX;AAAA,QAAI;AAAA,QAAqB,2BAA2B,GAAG;AAAA,QACtD,iCAAiC,GAAG,sBAAsB,IAAI,KAAK;AAAA,MAAG;AACvE;AAAA,IACD;AACA,UAAM,sBAAkB,sCAAoB,OAAO,UAAU,IAAI,CAAC,SAAS,KAAK,OAAO,CAAC;AACxF,QAAI,CAAC,iBAAiB;AACrB;AAAA,QAAI;AAAA,QAAqB,2BAA2B,GAAG;AAAA,QACtD,iCAAiC,GAAG,sBAAsB,IAAI,KAAK;AAAA,MAAG;AACvE;AAAA,IACD;AACA,UAAM,WAAW,UAAU,KAAK,CAAC,SAAS,KAAK,YAAY,eAAe;AAC1E,4BAAwB,KAAK,QAAQ;AACrC,kBAAc,KAAK;AAAA,MAClB,MAAM,SAAS;AAAA,MACf,WAAW,SAAS;AAAA,MACpB,SAAS,SAAS;AAAA,MAClB,OAAO,IAAI;AAAA,MACX,gBAAgB,SAAS;AAAA,MACzB,GAAI,SAAS,SAAS,EAAE,QAAQ,SAAS,OAAO,IAAI,CAAC;AAAA,IACtD,CAAC;AAAA,EACF;AAGA;AACC,eAAW,QAAQ,eAAe;AACjC,YAAM,WAAW,MAAM,SAAS,eAAe;AAAA,QAAK,CAAC,cACpD,UAAU,cAAc,KAAK,aAC7B,UAAU,SAAS,KAAK,QACxB,UAAU,YAAY,KAAK,WAC3B,UAAU,mBAAmB,KAAK;AAAA,MACnC;AACA,UAAI,CAAC,UAAU;AACd;AAAA,UAAI;AAAA,UAAkC,kBAAkB,KAAK,SAAS,IAAI,KAAK,IAAI;AAAA,UAClF,SAAS,KAAK,SAAS,IAAI,KAAK,IAAI,IAAI,KAAK,OAAO,2BAA2B,KAAK,cAAc,yBAAyB,MAAM,SAAS,cAAc;AAAA,QAAG;AAC5J;AAAA,MACD;AAKA,YAAM,iBAAiB,wBAAwB,KAAK,CAAC,eACpD,WAAW,cAAc,KAAK,aAC9B,WAAW,SAAS,KAAK,QACzB,WAAW,YAAY,KAAK,WAC5B,WAAW,mBAAmB,KAAK,cAAc,GAAG;AACrD,YAAM,aAAa,kBAAkB,KAAK,SAAS,IAAI,KAAK,IAAI;AAChE,UAAI,kBAAkB,CAAC,SAAS,QAAQ;AACvC;AAAA,UAAI;AAAA,UAAqB;AAAA,UACxB,SAAS,KAAK,SAAS,IAAI,KAAK,IAAI,yDAAyD,MAAM,SAAS,cAAc;AAAA,QAAkB;AAAA,MAC9I,WAAW,kBAAkB,SAAS,QAAQ;AAC7C,YAAI,eAAe,UAAU,SAAS,OAAO,OAAO;AACnD;AAAA,YAAI;AAAA,YAAqB,GAAG,UAAU;AAAA,YACrC,iBAAiB,eAAe,KAAK,sCAAsC,SAAS,OAAO,KAAK;AAAA,UAAG;AAAA,QACrG;AACA,YAAI,eAAe,cAAc,SAAS,OAAO,WAAW;AAC3D;AAAA,YAAI;AAAA,YAAqB,GAAG,UAAU;AAAA,YACrC,qBAAqB,eAAe,SAAS,0CAA0C,SAAS,OAAO,SAAS;AAAA,UAAG;AAAA,QACrH;AACA,YAAI,iBAAiB,eAAe,OAAO,MAAM,iBAAiB,SAAS,OAAO,OAAO,GAAG;AAC3F;AAAA,YAAI;AAAA,YAAqB,GAAG,UAAU;AAAA,YACrC;AAAA,UAAwD;AAAA,QAC1D;AAAA,MACD,WAAW,CAAC,kBAAkB,SAAS,QAAQ;AAC9C;AAAA,UAAI;AAAA,UAAqB;AAAA,UACxB,aAAa,MAAM,SAAS,cAAc,mCAAmC,KAAK,SAAS,IAAI,KAAK,IAAI;AAAA,QAAwC;AAAA,MAClJ;AAAA,IACD;AACA,eAAW,YAAY,MAAM,WAAW;AACvC,YAAM,WAAW,MAAM,SAAS,aAAa;AAAA,QAAK,CAAC,eAClD,WAAW,cAAc,SAAS,WAAW,aAC7C,WAAW,4BAAwB,qDAAmC,QAAQ;AAAA,MAC/E;AACA,UAAI,CAAC,UAAU;AACd;AAAA,UAAI;AAAA,UAAuC,aAAa,SAAS,WAAW,SAAS;AAAA,UACpF,aAAa,SAAS,WAAW,SAAS,wEAAwE,MAAM,SAAS,cAAc;AAAA,QAAG;AAAA,MACpJ;AAAA,IACD;AAAA,EACD;AAGA,QAAM,kBAAkB,oBAAI,IAAY;AACxC,aAAW,QAAQ,yBAAyB;AAC3C,eAAW,QAAQ,OAAO,KAAK,KAAK,UAAU,GAAG;AAChD,sBAAgB,IAAI,GAAG,KAAK,SAAS,IAAI,IAAI,EAAE;AAAA,IAChD;AAAA,EACD;AACA,QAAM,iBAAiB,IAAI,IAAI,MAAM,kBAAkB,CAAC,CAAC;AAGzD,QAAM,aAAa,gBAAgB,SAAS;AAC5C,QAAM,eAAe,wBAAwB,SAAS;AACtD,QAAM,eAAe,uBAAuB,MAAM,OAAO,OAAO,cAAc;AAC9E,QAAM,iBAAiB,uBAAuB,MAAM,OAAO,SAAS,gBAAgB;AAGpF,mCAAiC,WAAW,GAAG;AAM/C,QAAM,iBAAiB,oBAAI,IAAwE;AACnG,aAAW,CAAC,YAAY,QAAQ,KAAK,OAAO,QAAQ,MAAM,OAAO,aAAa,CAAC,CAAC,GAAG;AAClF,eAAW,QAAQ,SAAS,SAAS,CAAC,GAAG;AACxC,UAAI,CAAC,aAAa,IAAI,IAAI,GAAG;AAC5B;AAAA,UAAI;AAAA,UAAkC,oBAAoB,UAAU;AAAA,UACnE,aAAa,UAAU,sBAAsB,IAAI;AAAA,QAA4C;AAAA,MAC/F;AAAA,IACD;AACA,eAAW,UAAU,SAAS,WAAW,CAAC,GAAG;AAC5C,UAAI,CAAC,eAAe,IAAI,MAAM,GAAG;AAChC;AAAA,UAAI;AAAA,UAAkC,oBAAoB,UAAU;AAAA,UACnE,aAAa,UAAU,wBAAwB,MAAM;AAAA,QAA4C;AAAA,MACnG;AAAA,IACD;AACA,mBAAe,IAAI,YAAY,QAAQ;AAAA,EACxC;AAKA,QAAM,WAAW,CAAC,MAAkC,SAAuB;AAC1E,iBAAa,MAAM,MAAM;AAAA,MACxB,KAAK,oBAAI,IAAI;AAAA,MACb;AAAA,MACA;AAAA,MACA;AAAA,MACA;AAAA,MACA;AAAA,MACA;AAAA,MACA;AAAA,MACA;AAAA,MACA;AAAA,IACD,CAAC;AAAA,EACF;AAEA,WAAS,MAAM,SAAS,MAAM,eAAe;AAE7C,QAAM,iBAAiB,oBAAI,IAAY;AACvC,GAAC,MAAM,SAAS,YAAY,CAAC,GAAG,QAAQ,CAAC,SAAS,UAAU;AAC3D,QAAI,eAAe,IAAI,QAAQ,EAAE,GAAG;AACnC;AAAA,QAAI;AAAA,QAAwB,qBAAqB,KAAK;AAAA,QACrD,eAAe,QAAQ,EAAE;AAAA,MAA8B;AAAA,IACzD,OAAO;AACN,qBAAe,IAAI,QAAQ,EAAE;AAAA,IAC9B;AACA,aAAS,QAAQ,MAAM,qBAAqB,KAAK,QAAQ;AAAA,EAC1D,CAAC;AAGD,MAAI,SAAS,SAAS,GAAG;AACxB,WAAO,EAAE,OAAO,OAAO,UAAU,SAAS,OAAU;AAAA,EACrD;AAEA,QAAM,UAAuB;AAAA,IAC5B,eAAe;AAAA,IACf,eAAe;AAAA,MACd,MAAM;AAAA,MACN,MAAM;AAAA,MACN;AAAA,MACA,MAAM;AAAA,MACN,MAAM,SAAS;AAAA,IAChB;AAAA,IACA,gBAAgB,MAAM,SAAS;AAAA,IAC/B,UAAU,MAAM;AAAA,IAChB,UAAU,MAAM;AAAA,IAChB,gBAAgB,CAAC,GAAG,aAAa,EAAE,KAAK,CAAC,GAAG,MAAM;AACjD,YAAM,MAAM,CAAC,MAAiC,GAAG,EAAE,SAAS,IAAI,EAAE,IAAI;AACtE,aAAO,IAAI,CAAC,IAAI,IAAI,CAAC,IAAI,KAAK,IAAI,CAAC,IAAI,IAAI,CAAC,IAAI,IAAI;AAAA,IACrD,CAAC;AAAA,IACD,QAAQ;AAAA,MACP,OAAO,CAAC,GAAG,MAAM,OAAO,KAAK,EAAE,KAAK;AAAA,MACpC,SAAS,CAAC,GAAG,MAAM,OAAO,OAAO,EAAE,KAAK;AAAA,MACxC,GAAI,MAAM,OAAO,YAAY,EAAE,WAAW,wBAAwB,MAAM,OAAO,SAAS,EAAE,IAAI,CAAC;AAAA,IAChG;AAAA,EACD;AAEA,SAAO,EAAE,OAAO,MAAM,UAAU,CAAC,GAAG,QAAQ;AAC7C;AAMO,SAAS,uBAAuB,OAAyC;AAC/E,QAAM,SAAS,oBAAoB,KAAK;AACxC,MAAI,OAAO,MAAO,QAAO,OAAO;AAChC,QAAM,IAAI,MAAM;AAAA,IACf,iBAAiB,MAAM,SAAS,IAAI,IAAI,MAAM,SAAS,OAAO;AAAA,IAC9D,GAAG,OAAO,SAAS,IAAI,CAAC,YAAY,QAAQ,QAAQ,IAAI,KAAK,QAAQ,IAAI,KAAK,QAAQ,OAAO,EAAE;AAAA,EAChG,EAAE,KAAK,IAAI,CAAC;AACb;AAIA,SAAS,iBAAiB,SAAyC;AAClE,SAAO,KAAK;AAAA,IACX,OAAO,KAAK,OAAO,EAAE,KAAK,EAAE,IAAI,CAAC,cAAc,CAAC,WAAW,QAAQ,SAAS,CAAC,CAAC;AAAA,EAC/E;AACD;;;AIlPO,SAAS,kBAAkB,IAAY,gBAAgD;AAC7F,SAAO;AAAA,IACN;AAAA,IACA;AAAA,IACA,QAAQ,SAAS;AAChB,iCAA2B,OAAO;AAClC,YAAM,OAAO,sBAAsB,QAAQ,SAAS,IAAI;AACxD,iBAAW,WAAW,QAAQ,SAAS,YAAY,CAAC,GAAG;AACtD,mBAAW,aAAa,sBAAsB,QAAQ,IAAI,EAAG,MAAK,IAAI,SAAS;AAAA,MAChF;AACA,YAAM,UAAU,CAAC,GAAG,IAAI,EAAE,OAAO,CAAC,cAAc,CAAC,eAAe,SAAS,SAAS,CAAC;AACnF,aAAO;AAAA,QACN;AAAA,QACA,YAAY,QAAQ,WAAW;AAAA,QAC/B,uBAAuB;AAAA,MACxB;AAAA,IACD;AAAA,EACD;AACD;AAEA,SAAS,sBAAsB,UAAqC;AACnE,QAAM,OAAO,oBAAI,IAAY;AAC7B,MAAI,SAAS,cAAc,UAAa,CAAC,SAAS,UAAU,SAAS,GAAG,GAAG;AAC1E,SAAK,IAAI,SAAS,SAAS;AAAA,EAC5B;AACA,MAAI,SAAS,aAAa,QAAW;AACpC,eAAW,SAAS,SAAS,UAAU;AACtC,iBAAW,aAAa,sBAAsB,KAAK,EAAG,MAAK,IAAI,SAAS;AAAA,IACzE;AAAA,EACD;AACA,SAAO;AACR;;;AC9DO,IAAM,4BAAgD;AAAA,EAC5D,SAAS;AAAA,EACT,OAAO;AAAA,EACP,MAAM;AAAA,EACN,UAAU,CAAC,iBAAiB,QAAQ,WAAW,QAAQ,YAAY,gBAAgB;AAAA,EACnF,YAAY;AAAA,IACX,eAAe,EAAE,MAAM,WAAW,MAAM,CAAC,CAAC,EAAE;AAAA,IAC5C,MAAM,EAAE,MAAM,UAAU,SAAS,oBAAoB;AAAA,IACrD,SAAS,EAAE,MAAM,UAAU,SAAS,sBAAsB;AAAA,IAC1D,MAAM,EAAE,MAAM,SAAS;AAAA,IACvB,UAAU,EAAE,MAAM,UAAU,UAAU,CAAC,QAAQ,SAAS,EAAE;AAAA,IAC1D,gBAAgB,EAAE,MAAM,QAAQ;AAAA,EACjC;AACD;AAEO,IAAM,2BAA+C;AAAA,EAC3D,SAAS;AAAA,EACT,OAAO;AAAA,EACP,MAAM;AAAA,EACN,UAAU,CAAC,iBAAiB,iBAAiB,kBAAkB,YAAY,YAAY,kBAAkB,QAAQ;AAAA,EACjH,YAAY;AAAA,IACX,eAAe,EAAE,MAAM,WAAW,MAAM,CAAC,CAAC,EAAE;AAAA,IAC5C,eAAe,EAAE,MAAM,UAAU,SAAS,iBAAiB;AAAA,IAC3D,gBAAgB,EAAE,MAAM,UAAU,SAAS,iBAAiB;AAAA,IAC5D,UAAU,EAAE,MAAM,SAAS;AAAA,IAC3B,UAAU,EAAE,MAAM,SAAS;AAAA,IAC3B,gBAAgB,EAAE,MAAM,QAAQ;AAAA,IAChC,QAAQ,EAAE,MAAM,UAAU,UAAU,CAAC,SAAS,SAAS,EAAE;AAAA,EAC1D;AACD;","names":["value","import_assembly"]}
+{"version":3,"sources":["../index.ts","../types.ts","../structural.ts","../helpers.ts","../validate.ts","../digest.ts","../capabilities.ts","../walker.ts","../channel.ts","../references.ts","../entitlements.ts","../schemas.ts","../contracts.ts"],"sourcesContent":["// ── Public API ──────────────────────────────────────────────────────────────\n//\n// The SDUI release package is split into cohesive private modules. This file\n// is the single public entry point: it re-exports every type, constant, and\n// function that consumers import. The internal modules (types, helpers,\n// structural, digest, capabilities, walker, channel, schemas, validate) are\n// implementation details and are not separately exported.\n\n// Format version constants\nexport {\n\tSDUI_DOCUMENT_FORMAT_VERSION,\n\tSDUI_TOKEN_SET_FORMAT_VERSION,\n\tSDUI_COMPONENT_PACK_FORMAT_VERSION,\n\tSDUI_RELEASE_FORMAT_VERSION,\n} from \"./types\";\n\n// Types\nexport type {\n\tSduiCapabilityRef,\n\tSduiFragmentValue,\n\tSduiActionRef,\n\tSduiFragment,\n\tSduiTokenType,\n\tSduiToken,\n\tSduiTokenSet,\n\tSduiComponentDefinition,\n\tSduiComponentPack,\n\tSduiComponentPackReference,\n\tSduiTokenSetReference,\n\tSduiDocument,\n\tResolvedSduiComponentPack,\n\tSduiRelease,\n\tSduiFindingCode,\n\tSduiFinding,\n\tSduiValidationResult,\n\tSduiAuthorizationGrants,\n\tSduiValidationInput,\n\tJsonValue,\n} from \"./types\";\n\n// Structural validation\nexport {\n\tassertSduiTokenSet,\n\tassertSduiComponentPack,\n\tassertSduiFragment,\n\tassertSduiDocument,\n\tassertSduiAuthorizationGrants,\n\tassertSduiRelease,\n} from \"./structural\";\n\n// Release validation\nexport {\n\tvalidateSduiRelease,\n\tassertSduiReleaseValid,\n} from \"./validate\";\n\n// Release digest\nexport { assertSduiReleaseIntegrity, computeReleaseDigest } from \"./digest\";\n\n// The single capability-reference grammar. Exported so every gate downstream\n// shares it rather than reimplementing a subtly different one.\nexport { parseCapabilityRef } from \"./helpers\";\n\n// Channel consumption\nexport {\n\tcreateSduiChannel,\n\trunSduiChannelChecks,\n\tsduiChannelChecks,\n\ttype SduiChannel,\n\ttype SduiChannelCheck,\n\ttype SduiChannelConformanceResult,\n\ttype SduiChannelConformanceSubject,\n\ttype SduiChannelConsumptionResult,\n} from \"./channel\";\n\n// Entitlement-derived grants\nexport {\n\tderiveAuthorizationGrants,\n\ttype ActorEntitlements,\n\ttype DerivedGrants,\n\ttype WithheldCapability,\n} from \"./entitlements\";\n\n// JSON schemas\nexport {\n\tSDUI_DOCUMENT_JSON_SCHEMA,\n\tSDUI_RELEASE_JSON_SCHEMA,\n} from \"./schemas\";\n\n// Signed v3 contracts are also available from the browser-safe\n// `@fabricorg/sdui-release/contracts` subpath.\nexport {\n\tSDUI_RELEASE_V3_FORMAT_VERSION,\n\tRELEASE_CHANNEL_POINTER_FORMAT_VERSION,\n\tcanonicalizeJcs,\n\tverifySignedExperienceArtifact,\n\tverifySignedExperienceRelease,\n\tassertSduiReleaseV3,\n\tactivateReleaseChannelPointer,\n\tassertReleaseChannelPointer,\n} from \"./contracts\";\nexport type {\n\tExperienceViewRoute,\n\tExperienceIntentRoute,\n\tEffectiveFragmentGrant,\n\tSduiReleaseV3,\n\tReleaseChannelPointer,\n\tReleaseVerificationKey,\n\tReleaseTrustStore,\n\tReleaseCryptoPort,\n\tReleaseGenerationStore,\n\tVerifySignedExperienceArtifactInput,\n} from \"./contracts\";\n","import type { JsonValue, PortableJsonSchema } from \"@fabricorg/platform\";\nimport type { UsageContractDocument } from \"@fabricorg/gen-capability\";\nimport type { AssemblyLockfile } from \"@fabricorg/assembly\";\n\n/**\n * Version of the SDUI document contract. A vertical negotiates on this, not on\n * this package's version, and it moves only when the serialized shape changes.\n */\nexport const SDUI_DOCUMENT_FORMAT_VERSION = 1 as const;\n\n/**\n * Version of the SDUI token-set contract.\n */\nexport const SDUI_TOKEN_SET_FORMAT_VERSION = 1 as const;\n\n/**\n * Version of the SDUI component-pack contract.\n */\nexport const SDUI_COMPONENT_PACK_FORMAT_VERSION = 1 as const;\n\n/**\n * Version of the promoted SDUI release contract.\n */\nexport const SDUI_RELEASE_FORMAT_VERSION = 2 as const;\n\n// ── Fragment value: literal or capability read reference ────────────────────\n\n/**\n * A capability read reference embedded in fragment props. The `capability://`\n * scheme ties a data binding to a published view; the host resolves it through\n * `ProjectionHost`, never through a direct query.\n */\nexport interface SduiCapabilityRef {\n\t$ref: `capability://${string}`;\n}\n\n/**\n * A value that may appear in fragment props: a JSON literal, an array, an\n * object, or a `capability://` read reference. Direct mutation endpoints,\n * API URLs, or code strings are not valid fragment values.\n */\nexport type SduiFragmentValue =\n\t| string\n\t| number\n\t| boolean\n\t| null\n\t| SduiFragmentValue[]\n\t| SduiCapabilityRef\n\t| { [key: string]: SduiFragmentValue };\n\n// ── Action reference: must route through a governed action ─────────────────\n\n/**\n * An action declared on a fragment. The `intent` must be a `capability://`\n * reference to a published action intent; the host dispatches it through\n * `PlatformHost`, preserving governance. A bare endpoint URL, function name,\n * or inline script is a mutation bypass and is rejected.\n */\nexport interface SduiActionRef {\n\tintent: `capability://${string}`;\n\tparams?: Record<string, SduiFragmentValue>;\n}\n\n// ── Fragment: a node in the document tree ───────────────────────────────────\n\n/**\n * A node in an SDUI document tree. A fragment either renders a component from\n * a declared pack, binds data from a capability view, or both. Actions on a\n * fragment are always capability action-intent references — never direct\n * mutations.\n */\nexport interface SduiFragment {\n\t/** Unique identifier within the document. */\n\tid: string;\n\t/** Namespaced component (`pack.Component`) or a core component name. */\n\tcomponent?: string;\n\t/** Props for the component; values may be literals or capability refs. */\n\tprops?: Record<string, SduiFragmentValue>;\n\t/** Named slot this fragment fills in its parent component. */\n\tslot?: string;\n\t/** A capability view reference for data-driven fragments. */\n\tdataRef?: `capability://${string}`;\n\t/** Action handlers; every entry must be a capability action-intent reference. */\n\tactions?: Record<string, SduiActionRef>;\n\t/** Child fragments. */\n\tchildren?: SduiFragment[];\n}\n\n// ── Token set: renderer-neutral design tokens ───────────────────────────────\n\nexport type SduiTokenType = \"color\" | \"spacing\" | \"fontSize\" | \"fontWeight\" | \"radius\" | \"border\" | \"shadow\";\n\nexport interface SduiToken {\n\ttype: SduiTokenType;\n\tvalue: string;\n\tdescription?: string;\n}\n\n/**\n * A versioned set of design tokens. Tokens are semantic, not literal CSS — a\n * renderer maps them to its own platform. Two channels consuming the same\n * token set apply the same visual intent through different renderings.\n */\nexport interface SduiTokenSet {\n\tformatVersion: typeof SDUI_TOKEN_SET_FORMAT_VERSION;\n\tname: string;\n\tversion: string;\n\ttokens: Record<string, SduiToken>;\n}\n\n// ── Component pack: available components for rendering ──────────────────────\n\nexport interface SduiComponentDefinition {\n\t/** Roles this component implements (for adoption-binding validation). */\n\timplements?: string[];\n\t/** JSON Schema for component props. */\n\tpropsSchema?: PortableJsonSchema;\n\t/** Named slots this component accepts. */\n\tslots?: string[];\n}\n\n/**\n * A versioned pack of SDUI components. Compatible with the adoption-bindings\n * `ComponentPackManifest` but adds prop schemas and slot declarations so a\n * document can be validated without a renderer.\n */\nexport interface SduiComponentPack {\n\tformatVersion: typeof SDUI_COMPONENT_PACK_FORMAT_VERSION;\n\tpack: string;\n\tnamespace: string;\n\tversion: string;\n\t/** SHA-256 digest of the published component-pack artifact. */\n\tartifactDigest: string;\n\t/**\n\t * Where this pack is loaded from when it is delivered as a federated\n\t * remote. The artifact digest identifies the pack that was reviewed; this\n\t * is what a shell actually executes, so validation requires the two to be\n\t * locked together or the review covers something other than what runs.\n\t */\n\tremote?: SduiComponentPackRemote;\n\tcomponents: Record<string, SduiComponentDefinition>;\n}\n\n/** Delivery binding for a federated component pack. */\nexport interface SduiComponentPackRemote {\n\t/** Remote entry URL the shell loads. */\n\tentry: string;\n\t/** Subresource-integrity value for that entry, e.g. `sha384-…`. */\n\tintegrity: string;\n\t/** Exposed module path keyed by the component name it provides. */\n\texposes: Record<string, string>;\n}\n\n// ── Document: a versioned tree of fragments ──────────────────────────────────\n\nexport interface SduiComponentPackReference {\n\tpack: string;\n\tnamespace: string;\n\t/** Semver range, e.g. `^1.0.0`. */\n\trange: string;\n}\n\nexport interface SduiTokenSetReference {\n\tname: string;\n\tversion: string;\n}\n\n/**\n * A versioned SDUI document: a tree of fragments, a token-set reference, and\n * the component packs it depends on. This is the build-time input; the release\n * is the validated, resolved output.\n */\nexport interface SduiDocument {\n\tformatVersion: typeof SDUI_DOCUMENT_FORMAT_VERSION;\n\tname: string;\n\tversion: string;\n\t/** The tree rendered when no variant is selected. */\n\troot: SduiFragment;\n\t/**\n\t * Alternative trees a compositor may select at request time, for experiment\n\t * arms and personalization. Every variant is enumerated here and validated\n\t * against the same grants as `root`, and all of them are covered by the\n\t * release digest.\n\t *\n\t * Enumeration is what makes selection safe. A selector that can produce a\n\t * tree outside this set cannot be validated at promotion, so \"selection may\n\t * never widen grants\" would be unenforceable rather than merely unenforced.\n\t */\n\tvariants?: SduiVariant[];\n\t/** The token set this document is authored against. */\n\ttokenSet: SduiTokenSetReference;\n\t/**\n\t * Other token sets this same document may be promoted against, so one\n\t * authored document serves several brands without forking.\n\t *\n\t * Each promotion still pins exactly one resolved token set, and the release\n\t * digest still identifies precisely what a viewer receives. Carrying several\n\t * token sets inside a single release would author once at the cost of that\n\t * property, which is much harder to get back than it is to keep.\n\t */\n\tsupportedTokenSets?: SduiTokenSetReference[];\n\tcomponentPacks: SduiComponentPackReference[];\n}\n\n/** One selectable alternative to a document's default tree. */\nexport interface SduiVariant {\n\t/** Stable key the compositor matches on. Unique within the document. */\n\tid: string;\n\t/** The audience or experiment arm this arm serves. */\n\tdescription?: string;\n\troot: SduiFragment;\n}\n\n// ── Release: a promoted, validated, immutable bundle ─────────────────────────\n\nexport interface ResolvedSduiComponentPack {\n\tpack: string;\n\tnamespace: string;\n\tversion: string;\n\trange: string;\n\tartifactDigest: string;\n\t/**\n\t * The locked delivery binding, carried onto the release so the digest\n\t * identifies which remote a channel is expected to load. Omitting it would\n\t * let two releases differing only in their remote share a digest.\n\t */\n\tremote?: SduiComponentPackRemote;\n}\n\n/**\n * A promoted, validated, immutable SDUI release. It bundles a document, a\n * resolved token set, and locked component packs. Two channels (web, mobile,\n * CLI) can consume the same release and render it through their own renderers\n * while reads and actions remain capability references.\n */\nexport interface SduiRelease {\n\tformatVersion: typeof SDUI_RELEASE_FORMAT_VERSION;\n\t/** SHA-256 of the canonical document, token set, resolved packs, grants, and assembly identity. */\n\treleaseDigest: string;\n\t/** Approved application assembly this release was validated against. */\n\tassemblyDigest: string;\n\tdocument: SduiDocument;\n\ttokenSet: SduiTokenSet;\n\tcomponentPacks: ResolvedSduiComponentPack[];\n\tgrants: SduiAuthorizationGrants;\n}\n\n// ── Findings ─────────────────────────────────────────────────────────────────\n\nexport type SduiFindingCode =\n\t| \"unknown_component\"\n\t| \"incompatible_pack\"\n\t| \"unauthorized_data_ref\"\n\t| \"denied_view_ref\"\n\t| \"mutation_bypass\"\n\t| \"denied_intent_ref\"\n\t| \"intent_action_not_found\"\n\t| \"invalid_fragment\"\n\t| \"invalid_action_ref\"\n\t| \"unknown_token\"\n\t| \"duplicate_fragment_id\"\n\t| \"invalid_token_set\"\n\t| \"invalid_component_pack\"\n\t| \"invalid_document\"\n\t| \"missing_token_set\"\n\t| \"missing_component_pack\"\n\t| \"component_pack_not_in_assembly\"\n\t| \"capability_contract_not_in_assembly\"\n\t| \"duplicate_variant_id\"\n\t| \"fragment_grant_exceeds_release\"\n\t| \"remote_not_locked\"\n\t| \"ambiguous_capability_reference\";\n\nexport interface SduiFinding {\n\tcode: SduiFindingCode;\n\tpath: string;\n\tmessage: string;\n}\n\nexport interface SduiValidationResult {\n\tvalid: boolean;\n\tfindings: SduiFinding[];\n\trelease: SduiRelease | undefined;\n}\n\n// ── Validation input ─────────────────────────────────────────────────────────\n\n/**\n * Explicit capability references authorized for an SDUI release.\n *\n * The presence of a view or action in a supplied usage contract proves that\n * the capability publishes it, not that this document may use it. The\n * experience host must therefore provide both grant lists explicitly.\n */\nexport interface SduiAuthorizationGrants {\n\t/** Full `capability://namespace/view` references allowed in data bindings. */\n\tviews: readonly string[];\n\t/** Full `capability://namespace/intent` references allowed in actions. */\n\tintents: readonly string[];\n\t/**\n\t * Per-fragment narrowing, keyed by fragment id.\n\t *\n\t * The release-wide lists above are the ceiling. A listed fragment may use\n\t * only the references named for it, and the narrowing is inherited by that\n\t * fragment's children, so a page assembled from several teams' fragments\n\t * gets least privilege rather than the union of everything any of them\n\t * needs. A fragment entry can only ever narrow: naming a reference outside\n\t * the release-wide list is an authoring error and is reported rather than\n\t * silently granted.\n\t *\n\t * Keys are fragment ids, which are unique within a tree but may repeat\n\t * across variants, so two variants using the same fragment id share one\n\t * entry. Give them distinct ids when they need distinct narrowing. This\n\t * cannot widen either fragment, since narrowing stays an intersection.\n\t */\n\tfragments?: Record<string, SduiFragmentGrants>;\n}\n\n/** References one fragment subtree may use, drawn from the release-wide lists. */\nexport interface SduiFragmentGrants {\n\tviews?: readonly string[];\n\tintents?: readonly string[];\n}\n\nexport interface SduiValidationInput {\n\tdocument: SduiDocument;\n\ttokenSet: SduiTokenSet;\n\t/** Available component packs for version resolution. */\n\tcomponentPacks: SduiComponentPack[];\n\t/** Capability contracts available for data-ref and action validation. */\n\tcontracts: UsageContractDocument[];\n\t/**\n\t * Explicit authorization grants for every capability view and action\n\t * reference used by the document. Contract membership alone never grants\n\t * access.\n\t */\n\tgrants: SduiAuthorizationGrants;\n\t/** Approved resolved application composition. */\n\tassembly: AssemblyLockfile;\n\t/** Core component vocabulary every renderer implements. */\n\tcoreComponents?: readonly string[];\n}\n\n// Re-export JsonValue for consumers that build contracts programmatically.\nexport type { JsonValue };\n","import { assertPortableJsonSchema, type PortableJsonSchema } from \"@fabricorg/platform\";\nimport { parseSemverRange } from \"@fabricorg/assembly\";\nimport type {\n\tSduiAuthorizationGrants,\n\tSduiComponentPack,\n\tSduiDocument,\n\tSduiFragment,\n\tSduiRelease,\n\tSduiTokenSet,\n\tSduiTokenType,\n} from \"./types\";\nimport { fail, parseCapabilityRef, requireArray, requireRecord, requireString } from \"./helpers\";\n\n// ── Token set structural validation ──────────────────────────────────────────\n\nconst TOKEN_TYPES = new Set<SduiTokenType>([\"color\", \"spacing\", \"fontSize\", \"fontWeight\", \"radius\", \"border\", \"shadow\"]);\n\nexport function assertSduiTokenSet(value: unknown, path = \"tokenSet\"): asserts value is SduiTokenSet {\n\tconst tokenSet = requireRecord(value, path);\n\tif (tokenSet.formatVersion !== 1) {\n\t\tfail(`${path}.formatVersion`, `must be 1, received ${JSON.stringify(tokenSet.formatVersion)}`);\n\t}\n\tif (!/^[a-z][a-z0-9-]*$/.test(requireString(tokenSet.name, `${path}.name`))) {\n\t\tfail(`${path}.name`, \"must be lowercase letters, numbers and hyphens\");\n\t}\n\tif (!/^\\d+\\.\\d+\\.\\d+(?:-[0-9A-Za-z.-]+)?$/.test(requireString(tokenSet.version, `${path}.version`))) {\n\t\tfail(`${path}.version`, \"must be a semver version\");\n\t}\n\tconst tokens = requireRecord(tokenSet.tokens, `${path}.tokens`);\n\tfor (const [name, token] of Object.entries(tokens)) {\n\t\tconst tokenPath = `${path}.tokens.${name}`;\n\t\tif (!/^[a-z][a-z0-9-]*$/.test(name)) fail(tokenPath, \"token name must be lowercase letters, numbers and hyphens\");\n\t\tconst entry = requireRecord(token, tokenPath);\n\t\tconst type = requireString(entry.type, `${tokenPath}.type`);\n\t\tif (!TOKEN_TYPES.has(type as SduiTokenType)) fail(`${tokenPath}.type`, `must be one of ${[...TOKEN_TYPES].join(\", \")}`);\n\t\trequireString(entry.value, `${tokenPath}.value`);\n\t}\n}\n\n// ── Component pack structural validation ────────────────────────────────────\n\nexport function assertSduiComponentPack(value: unknown, path = \"componentPack\"): asserts value is SduiComponentPack {\n\tconst pack = requireRecord(value, path);\n\tif (pack.formatVersion !== 1) {\n\t\tfail(`${path}.formatVersion`, `must be 1, received ${JSON.stringify(pack.formatVersion)}`);\n\t}\n\tif (!/^[a-z][a-z0-9-]*$/.test(requireString(pack.pack, `${path}.pack`))) {\n\t\tfail(`${path}.pack`, \"must be lowercase letters, numbers and hyphens\");\n\t}\n\tif (!/^[a-z][a-z0-9-]*$/.test(requireString(pack.namespace, `${path}.namespace`))) {\n\t\tfail(`${path}.namespace`, \"must be lowercase letters, numbers and hyphens\");\n\t}\n\tif (!/^\\d+\\.\\d+\\.\\d+(?:-[0-9A-Za-z.-]+)?$/.test(requireString(pack.version, `${path}.version`))) {\n\t\tfail(`${path}.version`, \"must be a semver version\");\n\t}\n\tif (!/^[0-9a-f]{64}$/.test(requireString(pack.artifactDigest, `${path}.artifactDigest`))) {\n\t\tfail(`${path}.artifactDigest`, \"must be a lowercase SHA-256 digest\");\n\t}\n\tif (pack.remote !== undefined) {\n\t\tconst remote = requireRecord(pack.remote, `${path}.remote`);\n\t\trequireString(remote.entry, `${path}.remote.entry`);\n\t\tif (!/^sha(256|384|512)-[A-Za-z0-9+/]+={0,2}$/.test(requireString(remote.integrity, `${path}.remote.integrity`))) {\n\t\t\tfail(`${path}.remote.integrity`, \"must be a subresource-integrity value, e.g. \\\"sha384-…\\\"\");\n\t\t}\n\t\tconst exposes = requireRecord(remote.exposes, `${path}.remote.exposes`);\n\t\tfor (const [component, modulePath] of Object.entries(exposes)) {\n\t\t\trequireString(modulePath, `${path}.remote.exposes.${component}`);\n\t\t}\n\t}\n\tconst components = requireRecord(pack.components, `${path}.components`);\n\tfor (const [name, definition] of Object.entries(components)) {\n\t\tconst componentPath = `${path}.components.${name}`;\n\t\tif (!/^[a-z][a-z0-9-]*$/.test(name)) fail(componentPath, \"component name must be lowercase letters, numbers and hyphens\");\n\t\tconst def = requireRecord(definition, componentPath);\n\t\tif (def.implements !== undefined) {\n\t\t\tif (!Array.isArray(def.implements)) fail(`${componentPath}.implements`, \"must be an array\");\n\t\t\tfor (const impl of def.implements as unknown[]) {\n\t\t\t\tif (typeof impl !== \"string\" || !impl.trim()) fail(`${componentPath}.implements`, \"entries must be non-empty strings\");\n\t\t\t}\n\t\t}\n\t\tif (def.propsSchema !== undefined) {\n\t\t\ttry { assertPortableJsonSchema(def.propsSchema as PortableJsonSchema, `${componentPath}.propsSchema`); }\n\t\t\tcatch (error) { fail(componentPath, error instanceof Error ? error.message : String(error)); }\n\t\t}\n\t\tif (def.slots !== undefined) {\n\t\t\tif (!Array.isArray(def.slots)) fail(`${componentPath}.slots`, \"must be an array\");\n\t\t\tfor (const slot of def.slots as unknown[]) {\n\t\t\t\tif (typeof slot !== \"string\" || !/^[a-z][a-z0-9-]*$/.test(slot)) fail(`${componentPath}.slots`, \"slot names must be lowercase letters, numbers and hyphens\");\n\t\t\t}\n\t\t}\n\t}\n}\n\n// ── Fragment structural validation ──────────────────────────────────────────\n\nexport function assertSduiFragment(value: unknown, path = \"fragment\"): asserts value is SduiFragment {\n\tconst fragment = requireRecord(value, path);\n\trequireString(fragment.id, `${path}.id`);\n\tif (fragment.component !== undefined) requireString(fragment.component, `${path}.component`);\n\tif (fragment.slot !== undefined) {\n\t\tif (!/^[a-z][a-z0-9-]*$/.test(requireString(fragment.slot, `${path}.slot`))) {\n\t\t\tfail(`${path}.slot`, \"must be lowercase letters, numbers and hyphens\");\n\t\t}\n\t}\n\tif (fragment.dataRef !== undefined) {\n\t\tconst dataRef = requireString(fragment.dataRef, `${path}.dataRef`);\n\t\tif (!dataRef.startsWith(\"capability://\")) fail(`${path}.dataRef`, \"must be a capability:// reference\");\n\t}\n\tif (fragment.props !== undefined) {\n\t\trequireRecord(fragment.props, `${path}.props`);\n\t}\n\tif (fragment.actions !== undefined) {\n\t\tconst actions = requireRecord(fragment.actions, `${path}.actions`);\n\t\tfor (const [name, ref] of Object.entries(actions)) {\n\t\t\tconst actionPath = `${path}.actions.${name}`;\n\t\t\tconst actionRef = requireRecord(ref, actionPath);\n\t\t\trequireString(actionRef.intent, `${actionPath}.intent`);\n\t\t}\n\t}\n\tif (fragment.children !== undefined) {\n\t\tconst children = requireArray(fragment.children, `${path}.children`);\n\t\tchildren.forEach((child, index) => assertSduiFragment(child, `${path}.children[${index}]`));\n\t}\n}\n\n// ── Document structural validation ───────────────────────────────────────────\n\nexport function assertSduiDocument(value: unknown, path = \"document\"): asserts value is SduiDocument {\n\tconst document = requireRecord(value, path);\n\tif (document.formatVersion !== 1) {\n\t\tfail(`${path}.formatVersion`, `must be 1, received ${JSON.stringify(document.formatVersion)}`);\n\t}\n\tif (!/^[a-z][a-z0-9-]*$/.test(requireString(document.name, `${path}.name`))) {\n\t\tfail(`${path}.name`, \"must be lowercase letters, numbers and hyphens\");\n\t}\n\tif (!/^\\d+\\.\\d+\\.\\d+(?:-[0-9A-Za-z.-]+)?$/.test(requireString(document.version, `${path}.version`))) {\n\t\tfail(`${path}.version`, \"must be a semver version\");\n\t}\n\tassertSduiFragment(document.root, `${path}.root`);\n\tif (document.variants !== undefined) {\n\t\trequireArray(document.variants, `${path}.variants`).forEach((entry, index) => {\n\t\t\tconst variantPath = `${path}.variants[${index}]`;\n\t\t\tconst variant = requireRecord(entry, variantPath);\n\t\t\tif (!/^[a-z][a-z0-9-]*$/.test(requireString(variant.id, `${variantPath}.id`))) {\n\t\t\t\tfail(`${variantPath}.id`, \"must be lowercase letters, numbers and hyphens\");\n\t\t\t}\n\t\t\tif (variant.description !== undefined) requireString(variant.description, `${variantPath}.description`);\n\t\t\tassertSduiFragment(variant.root, `${variantPath}.root`);\n\t\t});\n\t}\n\tconst tokenSet = requireRecord(document.tokenSet, `${path}.tokenSet`);\n\t// The same grammar supportedTokenSets enforces. `promotableTokenSets`\n\t// treats the two fields as interchangeable, so a value legal in one and\n\t// rejected in the other is a contradiction rather than a strictness choice.\n\tassertTokenSetReference(tokenSet, `${path}.tokenSet`);\n\tif (document.supportedTokenSets !== undefined) {\n\t\tconst seenTokenSets = new Set<string>();\n\t\trequireArray(document.supportedTokenSets, `${path}.supportedTokenSets`).forEach((entry, index) => {\n\t\t\tconst supportedPath = `${path}.supportedTokenSets[${index}]`;\n\t\t\tconst supported = requireRecord(entry, supportedPath);\n\t\t\tassertTokenSetReference(supported, supportedPath);\n\t\t\t// Two entries naming the same token set make canonical order\n\t\t\t// declaration-dependent, and the digest would follow.\n\t\t\tconst identity = `${String(supported.name)}\\u0000${String(supported.version)}`;\n\t\t\tif (seenTokenSets.has(identity)) {\n\t\t\t\tfail(supportedPath, `declares token set \"${String(supported.name)}@${String(supported.version)}\" a second time`);\n\t\t\t}\n\t\t\tseenTokenSets.add(identity);\n\t\t});\n\t}\n\trequireArray(document.componentPacks, `${path}.componentPacks`).forEach((entry, index) => {\n\t\tconst pack = requireRecord(entry, `${path}.componentPacks[${index}]`);\n\t\trequireString(pack.pack, `${path}.componentPacks[${index}].pack`);\n\t\trequireString(pack.namespace, `${path}.componentPacks[${index}].namespace`);\n\t\trequireString(pack.range, `${path}.componentPacks[${index}].range`);\n\t});\n}\n\n// ── Authorization grants structural validation ──────────────────────────────\n\n/**\n * Validate the grant envelope before semantic release checks. Grants are\n * intentionally references rather than capability names: a capability may\n * publish several views and intents with different authorization decisions.\n */\nexport function assertSduiAuthorizationGrants(\n\tvalue: unknown,\n\tpath = \"grants\",\n): asserts value is SduiAuthorizationGrants {\n\tconst grants = requireRecord(value, path);\n\tconst views = requireArray(grants.views, `${path}.views`);\n\tconst intents = requireArray(grants.intents, `${path}.intents`);\n\tfor (const [index, reference] of views.entries()) {\n\t\tconst referencePath = `${path}.views[${index}]`;\n\t\tif (!parseCapabilityRef(requireString(reference, referencePath))) {\n\t\t\tfail(referencePath, \"must be a valid capability:// reference\");\n\t\t}\n\t}\n\tfor (const [index, reference] of intents.entries()) {\n\t\tconst referencePath = `${path}.intents[${index}]`;\n\t\tif (!parseCapabilityRef(requireString(reference, referencePath))) {\n\t\t\tfail(referencePath, \"must be a valid capability:// reference\");\n\t\t}\n\t}\n\tif (grants.fragments !== undefined) {\n\t\tconst fragments = requireRecord(grants.fragments, `${path}.fragments`);\n\t\t// An object literal written `{ __proto__: { … } }` sets the prototype\n\t\t// instead of creating the entry, so the narrowing would disappear and the\n\t\t// fragment would keep release-wide grants. Fail rather than silently widen.\n\t\tconst prototype = Object.getPrototypeOf(fragments);\n\t\tif (prototype !== Object.prototype && prototype !== null) {\n\t\t\tfail(`${path}.fragments`, \"must be a plain object; a fragment grant assigned through __proto__ would be silently discarded\");\n\t\t}\n\t\tfor (const [fragmentId, declared] of Object.entries(fragments)) {\n\t\t\tconst fragmentPath = `${path}.fragments.${fragmentId}`;\n\t\t\tconst scoped = requireRecord(declared, fragmentPath);\n\t\t\tfor (const field of [\"views\", \"intents\"] as const) {\n\t\t\t\tif (scoped[field] === undefined) continue;\n\t\t\t\trequireArray(scoped[field], `${fragmentPath}.${field}`).forEach((reference, index) => {\n\t\t\t\t\tconst referencePath = `${fragmentPath}.${field}[${index}]`;\n\t\t\t\t\tif (!parseCapabilityRef(requireString(reference, referencePath))) {\n\t\t\t\t\t\tfail(referencePath, \"must be a valid capability:// reference\");\n\t\t\t\t\t}\n\t\t\t\t});\n\t\t\t}\n\t\t}\n\t}\n}\n\n/** Validate a promoted release loaded from an untyped persistence or network seam. */\nexport function assertSduiRelease(value: unknown, path = \"release\"): asserts value is SduiRelease {\n\tconst release = requireRecord(value, path);\n\tif (release.formatVersion !== 2) {\n\t\tfail(`${path}.formatVersion`, `must be 2, received ${JSON.stringify(release.formatVersion)}`);\n\t}\n\tfor (const field of [\"releaseDigest\", \"assemblyDigest\"] as const) {\n\t\tif (!/^[0-9a-f]{64}$/.test(requireString(release[field], `${path}.${field}`))) {\n\t\t\tfail(`${path}.${field}`, \"must be a lowercase SHA-256 digest\");\n\t\t}\n\t}\n\tassertSduiDocument(release.document, `${path}.document`);\n\tassertSduiTokenSet(release.tokenSet, `${path}.tokenSet`);\n\tassertSduiAuthorizationGrants(release.grants, `${path}.grants`);\n\trequireArray(release.componentPacks, `${path}.componentPacks`).forEach((value, index) => {\n\t\tconst packPath = `${path}.componentPacks[${index}]`;\n\t\tconst pack = requireRecord(value, packPath);\n\t\tfor (const field of [\"pack\", \"namespace\"] as const) {\n\t\t\tif (!/^[a-z][a-z0-9-]*$/.test(requireString(pack[field], `${packPath}.${field}`))) {\n\t\t\t\tfail(`${packPath}.${field}`, \"must be lowercase letters, numbers and hyphens\");\n\t\t\t}\n\t\t}\n\t\tif (!/^\\d+\\.\\d+\\.\\d+(?:-[0-9A-Za-z.-]+)?$/.test(\n\t\t\trequireString(pack.version, `${packPath}.version`),\n\t\t)) {\n\t\t\tfail(`${packPath}.version`, \"must be a semver version\");\n\t\t}\n\t\tconst range = requireString(pack.range, `${packPath}.range`);\n\t\tif (!parseSemverRange(range)) {\n\t\t\tfail(`${packPath}.range`, \"must be a supported semver range\");\n\t\t}\n\t\tif (!/^[0-9a-f]{64}$/.test(requireString(pack.artifactDigest, `${packPath}.artifactDigest`))) {\n\t\t\tfail(`${packPath}.artifactDigest`, \"must be a lowercase SHA-256 digest\");\n\t\t}\n\t});\n}\n\n/** One grammar for a token-set reference, wherever it appears. */\nfunction assertTokenSetReference(reference: Record<string, unknown>, path: string): void {\n\tif (!/^[a-z][a-z0-9-]*$/.test(requireString(reference.name, `${path}.name`))) {\n\t\tfail(`${path}.name`, \"must be lowercase letters, numbers and hyphens\");\n\t}\n\tif (!/^\\d+\\.\\d+\\.\\d+(?:-[0-9A-Za-z.-]+)?$/.test(requireString(reference.version, `${path}.version`))) {\n\t\tfail(`${path}.version`, \"must be a semver version\");\n\t}\n}\n","// ── Shared validation helpers ───────────────────────────────────────────────\n\nexport function fail(path: string, message: string): never {\n\tthrow new Error(`SDUI ${path} ${message}.`);\n}\n\nexport function requireString(value: unknown, path: string): string {\n\tif (typeof value !== \"string\" || !value.trim()) fail(path, \"must be a non-empty string\");\n\treturn value;\n}\n\nexport function requireRecord(value: unknown, path: string): Record<string, unknown> {\n\tif (!value || typeof value !== \"object\" || Array.isArray(value)) fail(path, \"must be an object\");\n\treturn value as Record<string, unknown>;\n}\n\nexport function requireArray(value: unknown, path: string): unknown[] {\n\tif (!Array.isArray(value)) fail(path, \"must be an array\");\n\treturn value;\n}\n\n// ── Capability reference parsing ────────────────────────────────────────────\n\n/**\n * The one grammar for a capability reference.\n *\n * A name is lowercase path segments, matching what the platform permits for a\n * view name (`[a-z][a-z0-9/_-]*` after the namespace) and for a dotted action\n * intent. Only the first segment must start with a letter, so a legal view such\n * as `orders/reports/2024` parses.\n *\n * Not identical to the platform's view-name rule, deliberately. It is looser on\n * `.` so a dotted intent parses, and tighter on empty segments: the platform's\n * character class admits `orders/a//b` and a trailing slash, and neither names\n * anything a capability publishes. A view named that way is refused here rather\n * than resolving to nothing later.\n *\n * Every gate must share it. Two grammars means a reference one gate accepts and\n * the next rejects, and the release that dies between them was valid by\n * construction.\n */\nconst CAPABILITY_REF = /^capability:\\/\\/([a-z][a-z0-9-]*)\\/([a-z][a-z0-9._-]*(?:\\/[a-z0-9._-]+)*)$/;\n\nexport function parseCapabilityRef(ref: string): { namespace: string; name: string } | undefined {\n\tconst match = CAPABILITY_REF.exec(ref);\n\tif (!match) return undefined;\n\treturn { namespace: match[1]!, name: match[2]! };\n}\n","import {\n\tassertAssemblyLockfile,\n\tcomputeUsageContractDocumentDigest,\n\tparseSemverRange,\n\tresolveVersionRange,\n} from \"@fabricorg/assembly\";\nimport { assertUsageContractDocument } from \"@fabricorg/gen-capability\";\nimport type {\n\tResolvedSduiComponentPack,\n\tSduiComponentPack,\n\tSduiDocument,\n\tSduiFinding,\n\tSduiFindingCode,\n\tSduiRelease,\n\tSduiTokenSet,\n\tSduiValidationInput,\n\tSduiValidationResult,\n} from \"./types\";\nimport { canonicalFragmentGrants, releaseDigest } from \"./digest\";\nimport { assertSduiAuthorizationGrants, assertSduiComponentPack, assertSduiDocument, assertSduiTokenSet } from \"./structural\";\nimport {\n\tbuildGrantedReferences,\n\tbuildKnownActionIntents,\n\tbuildKnownViews,\n\treportAmbiguousGrantedViews,\n\tvalidateIntentActionDeclarations,\n} from \"./capabilities\";\nimport { walkFragment } from \"./walker\";\n\n/**\n * Validate an SDUI document and its dependencies, producing a promoted release\n * when every check passes. This is the single build gate: it rejects unknown\n * components, incompatible packs, unauthorized data references, and mutation\n * bypasses. Returns every finding rather than throwing, so one CI run tells a\n * vertical everything it has to change. Use {@link assertSduiReleaseValid} to\n * throw on the first invalid result.\n */\nexport function validateSduiRelease(input: SduiValidationInput): SduiValidationResult {\n\t// ── Structural validation ────────────────────────────────────────────\n\tif (!input.assembly) throw new Error(\"An approved assembly lockfile is required for every SDUI release.\");\n\tassertSduiDocument(input.document);\n\tassertSduiTokenSet(input.tokenSet);\n\tfor (const pack of input.componentPacks) assertSduiComponentPack(pack);\n\tfor (const contract of input.contracts) assertUsageContractDocument(contract);\n\tassertSduiAuthorizationGrants(input.grants);\n\tassertAssemblyLockfile(input.assembly);\n\tconst contracts = input.contracts.map((document) => document.capability);\n\n\tconst findings: SduiFinding[] = [];\n\tconst add = (code: SduiFindingCode, path: string, message: string): void => {\n\t\tfindings.push({ code, path, message });\n\t};\n\n\t// ── Token set reference matches ─────────────────────────────────────\n\t// One document may be promoted against any token set it declares support\n\t// for. Each release still pins exactly one, so the digest keeps identifying\n\t// what a viewer actually received.\n\tconst promotableTokenSets = [input.document.tokenSet, ...(input.document.supportedTokenSets ?? [])];\n\tconst promotedAgainst = promotableTokenSets.some((candidate) =>\n\t\tcandidate.name === input.tokenSet.name && candidate.version === input.tokenSet.version);\n\tif (!promotedAgainst) {\n\t\tadd(\"missing_token_set\", \"document.tokenSet\",\n\t\t\t`document supports token sets [${promotableTokenSets.map((set) => `${set.name}@${set.version}`).join(\", \")}] but the provided set is \"${input.tokenSet.name}@${input.tokenSet.version}\"`);\n\t}\n\n\t// ── Component pack resolution ──────────────────────────────────────\n\tconst packsByKey = new Map<string, SduiComponentPack[]>();\n\tfor (const pack of input.componentPacks) {\n\t\tconst key = `${pack.namespace}/${pack.pack}`;\n\t\tconst list = packsByKey.get(key) ?? [];\n\t\tlist.push(pack);\n\t\tpacksByKey.set(key, list);\n\t}\n\n\tconst resolvedPacks: ResolvedSduiComponentPack[] = [];\n\tconst resolvedPackDefinitions: SduiComponentPack[] = [];\n\tfor (const ref of input.document.componentPacks) {\n\t\tconst key = `${ref.namespace}/${ref.pack}`;\n\t\tconst available = packsByKey.get(key) ?? [];\n\t\tconst range = parseSemverRange(ref.range);\n\t\tif (!range) {\n\t\t\tadd(\"incompatible_pack\", `document.componentPacks.${key}`,\n\t\t\t\t`no available version of pack \"${key}\" satisfies range \"${ref.range}\"`);\n\t\t\tcontinue;\n\t\t}\n\t\tconst resolvedVersion = resolveVersionRange(range, available.map((pack) => pack.version));\n\t\tif (!resolvedVersion) {\n\t\t\tadd(\"incompatible_pack\", `document.componentPacks.${key}`,\n\t\t\t\t`no available version of pack \"${key}\" satisfies range \"${ref.range}\"`);\n\t\t\tcontinue;\n\t\t}\n\t\tconst resolved = available.find((pack) => pack.version === resolvedVersion)!;\n\t\tresolvedPackDefinitions.push(resolved);\n\t\tresolvedPacks.push({\n\t\t\tpack: resolved.pack,\n\t\t\tnamespace: resolved.namespace,\n\t\t\tversion: resolved.version,\n\t\t\trange: ref.range,\n\t\t\tartifactDigest: resolved.artifactDigest,\n\t\t\t...(resolved.remote ? { remote: resolved.remote } : {}),\n\t\t});\n\t}\n\n\t// ── Approved assembly identity ─────────────────────────────────────\n\t{\n\t\tfor (const pack of resolvedPacks) {\n\t\t\tconst approved = input.assembly.componentPacks.find((candidate) =>\n\t\t\t\tcandidate.namespace === pack.namespace &&\n\t\t\t\tcandidate.pack === pack.pack &&\n\t\t\t\tcandidate.version === pack.version &&\n\t\t\t\tcandidate.artifactDigest === pack.artifactDigest\n\t\t\t);\n\t\t\tif (!approved) {\n\t\t\t\tadd(\"component_pack_not_in_assembly\", `componentPacks.${pack.namespace}/${pack.pack}`,\n\t\t\t\t\t`pack \"${pack.namespace}/${pack.pack}@${pack.version}\" with artifact digest \"${pack.artifactDigest}\" is not in assembly \"${input.assembly.assemblyDigest}\"`);\n\t\t\t\tcontinue;\n\t\t\t}\n\n\t\t\t// A federated pack executes whatever its remote entry serves. Unless\n\t\t\t// the entry and its integrity are the ones assembly locked, the\n\t\t\t// approved artifact digest says nothing about what actually runs.\n\t\t\tconst declaredRemote = resolvedPackDefinitions.find((definition) =>\n\t\t\t\tdefinition.namespace === pack.namespace &&\n\t\t\t\tdefinition.pack === pack.pack &&\n\t\t\t\tdefinition.version === pack.version &&\n\t\t\t\tdefinition.artifactDigest === pack.artifactDigest)?.remote;\n\t\t\tconst remotePath = `componentPacks.${pack.namespace}/${pack.pack}.remote`;\n\t\t\tif (declaredRemote && !approved.remote) {\n\t\t\t\tadd(\"remote_not_locked\", remotePath,\n\t\t\t\t\t`pack \"${pack.namespace}/${pack.pack}\" is delivered as a federated remote, which assembly \"${input.assembly.assemblyDigest}\" has not locked`);\n\t\t\t} else if (declaredRemote && approved.remote) {\n\t\t\t\tif (declaredRemote.entry !== approved.remote.entry) {\n\t\t\t\t\tadd(\"remote_not_locked\", `${remotePath}.entry`,\n\t\t\t\t\t\t`remote entry \"${declaredRemote.entry}\" does not match the locked entry \"${approved.remote.entry}\"`);\n\t\t\t\t}\n\t\t\t\tif (declaredRemote.integrity !== approved.remote.integrity) {\n\t\t\t\t\tadd(\"remote_not_locked\", `${remotePath}.integrity`,\n\t\t\t\t\t\t`remote integrity \"${declaredRemote.integrity}\" does not match the locked integrity \"${approved.remote.integrity}\"`);\n\t\t\t\t}\n\t\t\t\tif (canonicalExposes(declaredRemote.exposes) !== canonicalExposes(approved.remote.exposes)) {\n\t\t\t\t\tadd(\"remote_not_locked\", `${remotePath}.exposes`,\n\t\t\t\t\t\t\"remote exposed modules do not match the locked mapping\");\n\t\t\t\t}\n\t\t\t} else if (!declaredRemote && approved.remote) {\n\t\t\t\tadd(\"remote_not_locked\", remotePath,\n\t\t\t\t\t`assembly \"${input.assembly.assemblyDigest}\" locks a federated remote for \"${pack.namespace}/${pack.pack}\", but the supplied pack declares none`);\n\t\t\t}\n\t\t}\n\t\tfor (const document of input.contracts) {\n\t\t\tconst approved = input.assembly.capabilities.find((capability) =>\n\t\t\t\tcapability.namespace === document.capability.namespace &&\n\t\t\t\tcapability.usageContractDigest === computeUsageContractDocumentDigest(document)\n\t\t\t);\n\t\t\tif (!approved) {\n\t\t\t\tadd(\"capability_contract_not_in_assembly\", `contracts.${document.capability.namespace}`,\n\t\t\t\t\t`contract \"${document.capability.namespace}\" is not the generated usage-contract document approved by assembly \"${input.assembly.assemblyDigest}\"`);\n\t\t\t}\n\t\t}\n\t}\n\n\t// ── Build known component set from resolved packs ───────────────────\n\tconst knownComponents = new Set<string>();\n\tfor (const pack of resolvedPackDefinitions) {\n\t\tfor (const name of Object.keys(pack.components)) {\n\t\t\tknownComponents.add(`${pack.namespace}.${name}`);\n\t\t}\n\t}\n\tconst coreComponents = new Set(input.coreComponents ?? []);\n\n\t// ── Build known views and action intents from contracts ─────────────\n\tconst knownViews = buildKnownViews(contracts);\n\tconst grantedViews = buildGrantedReferences(input.grants.views, \"grants.views\");\n\tconst grantedIntents = buildGrantedReferences(input.grants.intents, \"grants.intents\");\n\tconst knownIntents = buildKnownActionIntents(contracts, add, grantedIntents);\n\n\t// A granted reference that addresses two views cannot be routed. Checked\n\t// against the grants rather than every declared view, because publishing a\n\t// view at two versions is intended and common.\n\treportAmbiguousGrantedViews(contracts, grantedViews, add);\n\n\t// A contract supplied twice makes every one of its references look ambiguous.\n\tconst contractNamespaces = new Set<string>();\n\tfor (const contract of contracts) {\n\t\tif (contractNamespaces.has(contract.namespace)) {\n\t\t\tadd(\"ambiguous_capability_reference\", `contracts.${contract.namespace}`,\n\t\t\t\t`contract for \"${contract.namespace}\" is supplied more than once`);\n\t\t}\n\t\tcontractNamespaces.add(contract.namespace);\n\t}\n\n\t// ── Verify experience intents resolve to governed actions ───────────\n\tvalidateIntentActionDeclarations(contracts, add);\n\n\t// ── Per-fragment narrowing may only narrow ──────────────────────────\n\t// Intersection in the walker already makes an out-of-release reference\n\t// unusable; reporting it here turns a silently ineffective grant into an\n\t// authoring error, which is what the author actually needs to know.\n\tconst fragmentGrants = new Map<string, { views?: readonly string[]; intents?: readonly string[] }>();\n\tfor (const [fragmentId, declared] of Object.entries(input.grants.fragments ?? {})) {\n\t\tfor (const view of declared.views ?? []) {\n\t\t\tif (!grantedViews.has(view)) {\n\t\t\t\tadd(\"fragment_grant_exceeds_release\", `grants.fragments.${fragmentId}.views`,\n\t\t\t\t\t`fragment \"${fragmentId}\" is granted view \"${view}\", which the release itself does not grant`);\n\t\t\t}\n\t\t}\n\t\tfor (const intent of declared.intents ?? []) {\n\t\t\tif (!grantedIntents.has(intent)) {\n\t\t\t\tadd(\"fragment_grant_exceeds_release\", `grants.fragments.${fragmentId}.intents`,\n\t\t\t\t\t`fragment \"${fragmentId}\" is granted intent \"${intent}\", which the release itself does not grant`);\n\t\t\t}\n\t\t}\n\t\tfragmentGrants.set(fragmentId, declared);\n\t}\n\n\t// ── Walk the default tree and every selectable variant ──────────────\n\t// Each tree gets its own id set: ids must be unique within a tree, but two\n\t// variants of the same page naturally reuse them, and only one ever renders.\n\tconst walkTree = (root: typeof input.document.root, path: string): void => {\n\t\twalkFragment(root, path, {\n\t\t\tids: new Set(),\n\t\t\tknownComponents,\n\t\t\tknownViews,\n\t\t\tgrantedViews,\n\t\t\tknownIntents,\n\t\t\tgrantedIntents,\n\t\t\tfragmentGrants,\n\t\t\tcoreComponents,\n\t\t\tfindings,\n\t\t\tadd,\n\t\t});\n\t};\n\n\twalkTree(input.document.root, \"document.root\");\n\n\tconst seenVariantIds = new Set<string>();\n\t(input.document.variants ?? []).forEach((variant, index) => {\n\t\tif (seenVariantIds.has(variant.id)) {\n\t\t\tadd(\"duplicate_variant_id\", `document.variants[${index}].id`,\n\t\t\t\t`variant id \"${variant.id}\" is declared more than once`);\n\t\t} else {\n\t\t\tseenVariantIds.add(variant.id);\n\t\t}\n\t\twalkTree(variant.root, `document.variants[${index}].root`);\n\t});\n\n\t// ── Produce release ─────────────────────────────────────────────────\n\tif (findings.length > 0) {\n\t\treturn { valid: false, findings, release: undefined };\n\t}\n\n\tconst release: SduiRelease = {\n\t\tformatVersion: 2,\n\t\treleaseDigest: releaseDigest(\n\t\t\tinput.document,\n\t\t\tinput.tokenSet,\n\t\t\tresolvedPacks,\n\t\t\tinput.grants,\n\t\t\tinput.assembly.assemblyDigest,\n\t\t),\n\t\tassemblyDigest: input.assembly.assemblyDigest,\n\t\tdocument: input.document,\n\t\ttokenSet: input.tokenSet,\n\t\tcomponentPacks: [...resolvedPacks].sort((a, b) => {\n\t\t\tconst key = (e: ResolvedSduiComponentPack) => `${e.namespace}/${e.pack}`;\n\t\t\treturn key(a) < key(b) ? -1 : key(a) > key(b) ? 1 : 0;\n\t\t}),\n\t\tgrants: {\n\t\t\tviews: [...input.grants.views].sort(),\n\t\t\tintents: [...input.grants.intents].sort(),\n\t\t\t...(input.grants.fragments ? { fragments: canonicalFragmentGrants(input.grants.fragments) } : {}),\n\t\t},\n\t};\n\n\treturn { valid: true, findings: [], release };\n}\n\n/**\n * Throw with every finding listed, for use as a build step. Returns the\n * promoted release when valid.\n */\nexport function assertSduiReleaseValid(input: SduiValidationInput): SduiRelease {\n\tconst result = validateSduiRelease(input);\n\tif (result.valid) return result.release!;\n\tthrow new Error([\n\t\t`SDUI release \"${input.document.name}@${input.document.version}\" is not valid:`,\n\t\t...result.findings.map((finding) => `  - [${finding.code}] ${finding.path}: ${finding.message}`),\n\t].join(\"\\n\"));\n}\n\n\n/** Stable comparison key for an exposed-module mapping. */\nfunction canonicalExposes(exposes: Record<string, string>): string {\n\treturn JSON.stringify(\n\t\tObject.keys(exposes).sort().map((component) => [component, exposes[component]]),\n\t);\n}\n","import { createHash } from \"node:crypto\";\nimport type {\n\tResolvedSduiComponentPack,\n\tSduiAuthorizationGrants,\n\tSduiComponentPackReference,\n\tSduiDocument,\n\tSduiRelease,\n\tSduiTokenSet,\n} from \"./types\";\nimport { assertSduiRelease } from \"./structural\";\n\n// ── Stable serialization ───────────────────────────────────────────────────\n\nfunction sortJson(value: unknown): unknown {\n\tif (Array.isArray(value)) return value.map(sortJson);\n\tif (value && typeof value === \"object\") {\n\t\treturn Object.fromEntries(\n\t\t\tObject.entries(value as Record<string, unknown>)\n\t\t\t\t.sort(([left], [right]) => (left < right ? -1 : left > right ? 1 : 0))\n\t\t\t\t.map(([key, child]) => [key, sortJson(child)]),\n\t\t);\n\t}\n\treturn value;\n}\n\nfunction stableStringify(value: unknown): string {\n\treturn JSON.stringify(sortJson(value));\n}\n\n/**\n * Canonical form for per-fragment grants: fragment ids and their reference\n * lists in sorted order.\n *\n * The digest and the promoted release must both use this. Hashing the caller's\n * raw grants while storing a canonicalised copy produces a release that fails\n * its own integrity check the moment a hand-authored grant file is not already\n * sorted. `Object.fromEntries` is deliberate: plain assignment to a key named\n * `__proto__` sets the prototype instead of recording the entry, which would\n * drop that fragment's narrowing from the release.\n */\nexport function canonicalFragmentGrants(\n\tfragments: Record<string, { views?: readonly string[]; intents?: readonly string[] }> | undefined,\n): Record<string, { views?: string[]; intents?: string[] }> {\n\tif (!fragments) return {};\n\treturn Object.fromEntries(\n\t\tObject.keys(fragments)\n\t\t\t.sort()\n\t\t\t.map((fragmentId) => {\n\t\t\t\tconst declared = fragments[fragmentId] as { views?: readonly string[]; intents?: readonly string[] };\n\t\t\t\treturn [fragmentId, {\n\t\t\t\t\t...(declared.views ? { views: [...declared.views].sort() } : {}),\n\t\t\t\t\t...(declared.intents ? { intents: [...declared.intents].sort() } : {}),\n\t\t\t\t}];\n\t\t\t}),\n\t);\n}\n\nexport function releaseDigest(\n\tdocument: SduiDocument,\n\ttokenSet: SduiTokenSet,\n\tcomponentPacks: ResolvedSduiComponentPack[],\n\tgrants: SduiAuthorizationGrants,\n\tassemblyDigest: string,\n): string {\n\tconst canonical = stableStringify({\n\t\tdocument: {\n\t\t\tformatVersion: document.formatVersion,\n\t\t\tname: document.name,\n\t\t\tversion: document.version,\n\t\t\troot: document.root,\n\t\t\t// Selectable trees, so two documents differing only in their variants\n\t\t\t// must not share a digest. Sorted by id, because reordering the same\n\t\t\t// set does not change which trees can render. Omitted entirely when\n\t\t\t// absent, so a document that declares none digests exactly as it did\n\t\t\t// before variants existed.\n\t\t\t...(document.variants?.length\n\t\t\t\t? {\n\t\t\t\t\tvariants: [...document.variants].sort((left, right) =>\n\t\t\t\t\t\tleft.id < right.id ? -1 : left.id > right.id ? 1 : 0),\n\t\t\t\t}\n\t\t\t\t: {}),\n\t\t\ttokenSet: document.tokenSet,\n\t\t\t// Which brands a document may be promoted against is part of what was\n\t\t\t// authored. Sorted, and omitted when absent so a document declaring\n\t\t\t// none digests exactly as it did before the field existed.\n\t\t\t...(document.supportedTokenSets?.length\n\t\t\t\t? {\n\t\t\t\t\tsupportedTokenSets: [...document.supportedTokenSets].sort((left, right) => {\n\t\t\t\t\t\t// Compare fields, not an interpolated key: \"a@b@c\" is\n\t\t\t\t\t\t// ambiguous, and returning 1 for equals is not a total order.\n\t\t\t\t\t\tif (left.name !== right.name) return left.name < right.name ? -1 : 1;\n\t\t\t\t\t\tif (left.version !== right.version) return left.version < right.version ? -1 : 1;\n\t\t\t\t\t\treturn 0;\n\t\t\t\t\t}),\n\t\t\t\t}\n\t\t\t\t: {}),\n\t\t\tcomponentPacks: [...document.componentPacks].sort((a: SduiComponentPackReference, b: SduiComponentPackReference) => {\n\t\t\t\tconst key = (e: SduiComponentPackReference) => `${e.namespace}/${e.pack}`;\n\t\t\t\treturn key(a) < key(b) ? -1 : key(a) > key(b) ? 1 : 0;\n\t\t\t}),\n\t\t},\n\t\ttokenSet: {\n\t\t\tformatVersion: tokenSet.formatVersion,\n\t\t\tname: tokenSet.name,\n\t\t\tversion: tokenSet.version,\n\t\t\ttokens: tokenSet.tokens,\n\t\t},\n\t\tcomponentPacks: [...componentPacks].sort((a, b) => {\n\t\t\tconst key = (e: ResolvedSduiComponentPack) => `${e.namespace}/${e.pack}`;\n\t\t\treturn key(a) < key(b) ? -1 : key(a) > key(b) ? 1 : 0;\n\t\t}),\n\t\tgrants: {\n\t\t\tviews: [...grants.views].sort(),\n\t\t\tintents: [...grants.intents].sort(),\n\t\t\t// Omitted when absent for the same reason as variants: a release with\n\t\t\t// no per-fragment narrowing must digest as it did before the field\n\t\t\t// existed, or every previously promoted release stops verifying.\n\t\t\t...(grants.fragments && Object.keys(grants.fragments).length\n\t\t\t\t? { fragments: canonicalFragmentGrants(grants.fragments) }\n\t\t\t\t: {}),\n\t\t},\n\t\tassemblyDigest,\n\t});\n\treturn createHash(\"sha256\").update(canonical).digest(\"hex\");\n}\n\n/**\n * Compute the canonical release digest for a valid release. Two releases with\n * the same document, token set, and resolved packs produce the same digest,\n * so a channel can verify it is consuming the exact release it was built for.\n */\nexport function computeReleaseDigest(\n\tdocument: SduiDocument,\n\ttokenSet: SduiTokenSet,\n\tcomponentPacks: ResolvedSduiComponentPack[],\n\tgrants: SduiAuthorizationGrants,\n\tassemblyDigest: string,\n): string {\n\treturn releaseDigest(document, tokenSet, componentPacks, grants, assemblyDigest);\n}\n\n/** Reject promoted release content that no longer matches its immutable digest. */\nexport function assertSduiReleaseIntegrity(release: SduiRelease): void {\n\tassertSduiRelease(release);\n\tconst expected = releaseDigest(\n\t\trelease.document,\n\t\trelease.tokenSet,\n\t\trelease.componentPacks,\n\t\trelease.grants,\n\t\trelease.assemblyDigest,\n\t);\n\tif (release.releaseDigest !== expected) {\n\t\tthrow new Error(`SDUI release releaseDigest does not match promoted content; expected \"${expected}\".`);\n\t}\n}\n","import type { UsageContract } from \"@fabricorg/gen-capability\";\nimport type { SduiFindingCode } from \"./types\";\nimport { fail, parseCapabilityRef } from \"./helpers\";\n\nexport function buildKnownViews(\n\tcontracts: readonly UsageContract[],\n): Set<string> {\n\tconst views = new Set<string>();\n\tfor (const contract of contracts) {\n\t\tfor (const view of contract.views) {\n\t\t\tviews.add(`${contract.namespace}/${shortViewName(view.name, contract.namespace)}`);\n\t\t}\n\t}\n\treturn views;\n}\n\nfunction shortViewName(name: string, namespace: string): string {\n\treturn name.startsWith(`${namespace}/`) ? name.slice(namespace.length + 1) : name;\n}\n\n/**\n * Report grants whose reference cannot address a single view.\n *\n * A versionless `capability://` reference cannot pick between two versions of\n * one view, and promotion requires exactly one match, so a release that grants\n * such a reference validates and then dies at promotion.\n *\n * Only *granted* references, though. Publishing a view at two versions is a\n * first-class pattern — the platform and the usage contract both key a view on\n * `name@version` — so flagging every declared view would make view versioning\n * unusable, and would fail a release over a capability it never touches.\n */\nexport function reportAmbiguousGrantedViews(\n\tcontracts: readonly UsageContract[],\n\tgrantedViews: ReadonlySet<string>,\n\tadd: (code: SduiFindingCode, path: string, message: string) => void,\n): void {\n\tconst occurrences = new Map<string, string[]>();\n\tfor (const contract of contracts) {\n\t\tfor (const view of contract.views) {\n\t\t\tconst reference = `capability://${contract.namespace}/${shortViewName(view.name, contract.namespace)}`;\n\t\t\tif (!grantedViews.has(reference)) continue;\n\t\t\toccurrences.set(reference, [...(occurrences.get(reference) ?? []), `${view.name}@${view.version}`]);\n\t\t}\n\t}\n\tfor (const [reference, declarations] of occurrences) {\n\t\tif (declarations.length > 1) {\n\t\t\tadd(\"ambiguous_capability_reference\", `grants.views.${reference}`,\n\t\t\t\t`\"${reference}\" is granted but addresses ${declarations.length} views (${declarations.join(\", \")}); a versionless reference cannot pick one`);\n\t\t}\n\t}\n}\n\nexport function buildKnownActionIntents(\n\tcontracts: readonly UsageContract[],\n\tadd?: (code: SduiFindingCode, path: string, message: string) => void,\n\tgrantedIntents?: ReadonlySet<string>,\n): Set<string> {\n\tconst intents = new Set<string>();\n\t// Intents collide the same way views do, and are never validated upstream:\n\t// action intents live in opaque `extensions`, so assertUsageContract never\n\t// sees them. Reported only for granted references, for the same reason.\n\tconst occurrences = new Map<string, string[]>();\n\tfor (const contract of contracts) {\n\t\tconst experience = contract.extensions?.[\"fabric.experience/v1\"] as\n\t\t\t| { actionIntents?: Array<{ name: string; actionId: string }> }\n\t\t\t| undefined;\n\t\tfor (const intent of experience?.actionIntents ?? []) {\n\t\t\t// The intent name is dotted (e.g., \"orders.submit\"); the capability\n\t\t\t// ref uses the part after the namespace prefix.\n\t\t\tconst shortName = intent.name.startsWith(`${contract.namespace}.`)\n\t\t\t\t? intent.name.slice(contract.namespace.length + 1)\n\t\t\t\t: intent.name;\n\t\t\tconst reference = `${contract.namespace}/${shortName}`;\n\t\t\tif (grantedIntents === undefined || grantedIntents.has(`capability://${reference}`)) {\n\t\t\t\toccurrences.set(reference, [...(occurrences.get(reference) ?? []), intent.name]);\n\t\t\t}\n\t\t\tintents.add(reference);\n\t\t}\n\t}\n\tfor (const [reference, declarations] of occurrences) {\n\t\tif (declarations.length > 1) {\n\t\t\tadd?.(\"ambiguous_capability_reference\", `contracts.actionIntents.${reference}`,\n\t\t\t\t`\"capability://${reference}\" is declared ${declarations.length} times (${declarations.join(\", \")}), so a route for it cannot be resolved`);\n\t\t}\n\t}\n\treturn intents;\n}\n\nexport function buildGrantedReferences(\n\treferences: readonly string[],\n\tpath: string,\n): Set<string> {\n\tconst granted = new Set<string>();\n\tfor (const [index, reference] of references.entries()) {\n\t\tconst referencePath = `${path}[${index}]`;\n\t\tif (!parseCapabilityRef(reference)) {\n\t\t\tfail(referencePath, \"must be a valid capability:// reference\");\n\t\t}\n\t\tgranted.add(reference);\n\t}\n\treturn granted;\n}\n\nexport function validateIntentActionDeclarations(\n\tcontracts: readonly UsageContract[],\n\tadd: (code: SduiFindingCode, path: string, message: string) => void,\n): void {\n\tfor (const contract of contracts) {\n\t\tconst experience = contract.extensions?.[\"fabric.experience/v1\"] as\n\t\t\t| { actionIntents?: Array<{ name: string; actionId: string }> }\n\t\t\t| undefined;\n\t\tconst actions = new Set(contract.actions.map((action) => action.actionId));\n\t\tfor (const [index, intent] of (experience?.actionIntents ?? []).entries()) {\n\t\t\tif (!actions.has(intent.actionId)) {\n\t\t\t\tadd(\n\t\t\t\t\t\"intent_action_not_found\",\n\t\t\t\t\t`contracts.${contract.namespace}.actionIntents[${index}].actionId`,\n\t\t\t\t\t`intent \"${intent.name}\" references action \"${intent.actionId}\", which the capability does not declare`,\n\t\t\t\t);\n\t\t\t}\n\t\t}\n\t}\n}\n","import type { SduiCapabilityRef, SduiFinding, SduiFindingCode, SduiFragment, SduiFragmentValue } from \"./types\";\nimport { parseCapabilityRef } from \"./helpers\";\n\n/** Deep enough for any authored document; shallow enough to bound a cycle. */\nconst MAX_PROP_DEPTH = 64;\n\n// ── Fragment tree walker ────────────────────────────────────────────────────\n\nexport interface FragmentWalkContext {\n\tids: Set<string>;\n\tknownComponents: Set<string>;\n\tknownViews: Set<string>;\n\t/** Grants in force for the fragment being walked, already narrowed. */\n\tgrantedViews: ReadonlySet<string>;\n\tknownIntents: Set<string>;\n\tgrantedIntents: ReadonlySet<string>;\n\t/** Per-fragment narrowing declared by the release, keyed by fragment id. */\n\tfragmentGrants?: ReadonlyMap<string, { views?: readonly string[]; intents?: readonly string[] }>;\n\tcoreComponents: Set<string>;\n\tfindings: SduiFinding[];\n\tadd: (code: SduiFindingCode, path: string, message: string) => void;\n}\n\nexport function isCapabilityRefValue(value: unknown): value is SduiCapabilityRef {\n\treturn (\n\t\tvalue !== null &&\n\t\ttypeof value === \"object\" &&\n\t\t!Array.isArray(value) &&\n\t\ttypeof (value as SduiCapabilityRef).$ref === \"string\" &&\n\t\t(value as SduiCapabilityRef).$ref.startsWith(\"capability://\")\n\t);\n}\n\n/**\n * Intersect the grants in force with what a fragment declares. Intersection\n * rather than replacement is what makes a fragment entry unable to widen: a\n * reference the release never granted cannot re-enter through a subtree.\n */\nfunction narrowGrants(current: ReadonlySet<string>, declared: readonly string[] | undefined): ReadonlySet<string> {\n\tif (declared === undefined) return current;\n\treturn new Set(declared.filter((reference) => current.has(reference)));\n}\n\nexport function walkFragment(fragment: SduiFragment, path: string, context: FragmentWalkContext): void {\n\t// ── Narrow grants for this fragment and everything beneath it ───────\n\tconst declared = context.fragmentGrants?.get(fragment.id);\n\tconst scoped: FragmentWalkContext = declared\n\t\t? {\n\t\t\t...context,\n\t\t\tgrantedViews: narrowGrants(context.grantedViews, declared.views),\n\t\t\tgrantedIntents: narrowGrants(context.grantedIntents, declared.intents),\n\t\t}\n\t\t: context;\n\n\t// ── Duplicate fragment IDs ──────────────────────────────────────────\n\tif (scoped.ids.has(fragment.id)) {\n\t\tscoped.add(\"duplicate_fragment_id\", `${path}.id`, `fragment id \"${fragment.id}\" is declared more than once`);\n\t} else {\n\t\tscoped.ids.add(fragment.id);\n\t}\n\n\t// ── Unknown components ──────────────────────────────────────────────\n\tif (fragment.component !== undefined) {\n\t\tconst separator = fragment.component.indexOf(\".\");\n\t\tif (separator === -1) {\n\t\t\tif (!scoped.coreComponents.has(fragment.component)) {\n\t\t\t\tscoped.add(\"unknown_component\", `${path}.component`,\n\t\t\t\t\t`component \"${fragment.component}\" is not a core component or in any declared pack`);\n\t\t\t}\n\t\t} else if (!scoped.knownComponents.has(fragment.component)) {\n\t\t\tscoped.add(\"unknown_component\", `${path}.component`,\n\t\t\t\t`component \"${fragment.component}\" is not in any declared component pack`);\n\t\t}\n\t}\n\n\t// ── Unauthorized data references ────────────────────────────────────\n\tif (fragment.dataRef !== undefined) {\n\t\tconst ref = parseCapabilityRef(fragment.dataRef);\n\t\tif (!ref) {\n\t\t\tscoped.add(\"unauthorized_data_ref\", `${path}.dataRef`,\n\t\t\t\t`\"${fragment.dataRef}\" is not a valid capability:// view reference`);\n\t\t} else if (!scoped.knownViews.has(`${ref.namespace}/${ref.name}`)) {\n\t\t\tscoped.add(\"unauthorized_data_ref\", `${path}.dataRef`,\n\t\t\t\t`fragment references view \"${fragment.dataRef}\" which no known capability publishes`);\n\t\t} else if (!scoped.grantedViews.has(fragment.dataRef)) {\n\t\t\tscoped.add(\"denied_view_ref\", `${path}.dataRef`,\n\t\t\t\t`fragment references view \"${fragment.dataRef}\" which is published but not granted to this release`);\n\t\t}\n\t}\n\n\t// ── Mutation bypass: actions must be capability action-intent refs ──\n\tfor (const [name, actionRef] of Object.entries(fragment.actions ?? {})) {\n\t\tconst actionPath = `${path}.actions.${name}`;\n\t\tconst ref = parseCapabilityRef(actionRef.intent);\n\t\tif (!ref) {\n\t\t\tscoped.add(\"mutation_bypass\", `${actionPath}.intent`,\n\t\t\t\t`action \"${name}\" intent \"${actionRef.intent}\" is not a capability:// reference; direct mutations bypass governance`);\n\t\t\tcontinue;\n\t\t}\n\t\tif (!scoped.knownIntents.has(`${ref.namespace}/${ref.name}`)) {\n\t\t\tscoped.add(\"mutation_bypass\", `${actionPath}.intent`,\n\t\t\t\t`action \"${name}\" references intent \"${actionRef.intent}\" which no known capability declares`);\n\t\t} else if (!scoped.grantedIntents.has(actionRef.intent)) {\n\t\t\tscoped.add(\"denied_intent_ref\", `${actionPath}.intent`,\n\t\t\t\t`action \"${name}\" references intent \"${actionRef.intent}\" which is published but not granted to this release`);\n\t\t}\n\t\tif (actionRef.params !== undefined) {\n\t\t\tcheckPropValues(actionRef.params, `${actionPath}.params`, scoped);\n\t\t}\n\t}\n\n\t// ── Check prop values for unauthorized data refs ───────────────────\n\tif (fragment.props !== undefined) {\n\t\tcheckPropValues(fragment.props, `${path}.props`, scoped);\n\t}\n\n\t// ── Recurse into children ───────────────────────────────────────────\n\tif (fragment.children !== undefined) {\n\t\tfragment.children.forEach((child, index) => {\n\t\t\twalkFragment(child, `${path}.children[${index}]`, scoped);\n\t\t});\n\t}\n}\n\n/**\n * Check one prop value wherever it sits: at a key, inside an array, or nested\n * in either. Every container routes back through this function, so a\n * capability reference resolves against the grant list at any depth. Checking\n * only at key positions leaves array elements unvalidated, and an array is the\n * ordinary shape for list props, so that gap is a grant bypass rather than an\n * edge case.\n */\nexport function checkValue(value: SduiFragmentValue, path: string, context: FragmentWalkContext, depth = 0): void {\n\tif (depth > MAX_PROP_DEPTH) {\n\t\tcontext.add(\"invalid_fragment\", path,\n\t\t\t`prop nesting exceeds ${MAX_PROP_DEPTH} levels; a cyclic or pathologically deep value cannot be checked`);\n\t\treturn;\n\t}\n\tif (isCapabilityRefValue(value)) {\n\t\tconst ref = parseCapabilityRef(value.$ref);\n\t\tif (!ref) {\n\t\t\tcontext.add(\"unauthorized_data_ref\", `${path}.$ref`,\n\t\t\t\t`\"${value.$ref}\" is not a valid capability:// view reference`);\n\t\t} else if (!context.knownViews.has(`${ref.namespace}/${ref.name}`)) {\n\t\t\tcontext.add(\"unauthorized_data_ref\", `${path}.$ref`,\n\t\t\t\t`prop references view \"${value.$ref}\" which no known capability publishes`);\n\t\t} else if (!context.grantedViews.has(value.$ref)) {\n\t\t\tcontext.add(\"denied_view_ref\", `${path}.$ref`,\n\t\t\t\t`prop references view \"${value.$ref}\" which is published but not granted to this release`);\n\t\t}\n\t\t// A reference object is not a leaf. Returning here would let a granted\n\t\t// reference shield ungranted ones parked beside it on the same object.\n\t\tfor (const [key, sibling] of Object.entries(value)) {\n\t\t\tif (key === \"$ref\") continue;\n\t\t\tcheckValue(sibling as SduiFragmentValue, `${path}.${key}`, context, depth + 1);\n\t\t}\n\t\treturn;\n\t}\n\tif (Array.isArray(value)) {\n\t\tvalue.forEach((item, index) => checkValue(item, `${path}[${index}]`, context, depth + 1));\n\t\treturn;\n\t}\n\tif (value !== null && typeof value === \"object\") {\n\t\tcheckPropValues(value as Record<string, SduiFragmentValue>, path, context, depth + 1);\n\t}\n}\n\nexport function checkPropValues(props: Record<string, SduiFragmentValue>, path: string, context: FragmentWalkContext, depth = 0): void {\n\tfor (const [key, value] of Object.entries(props)) {\n\t\tcheckValue(value, `${path}.${key}`, context, depth);\n\t}\n}\n","import type { SduiFragment, SduiRelease } from \"./types\";\nimport { assertSduiReleaseIntegrity } from \"./digest\";\n\n// ── Channel consumption contract ────────────────────────────────────────────\n\n/**\n * A channel is a rendering target (web, mobile, CLI). A channel consumes a\n * validated release and resolves capability references through its own host\n * adapters. Reads go through `ProjectionHost`; actions go through\n * `PlatformHost`. The channel never interprets or bypasses capability\n * references — it renders fragments and forwards action intents.\n */\nexport interface SduiChannel {\n\tid: string;\n\t/** Core components this channel renderer implements. */\n\tcoreComponents: readonly string[];\n\t/** Consume a validated release; returns the release if the channel's core\n\t *  vocabulary covers every core component the document uses. */\n\tconsume(release: SduiRelease): SduiChannelConsumptionResult;\n}\n\nexport interface SduiChannelConsumptionResult {\n\t/** The release the channel consumed. */\n\trelease: SduiRelease;\n\t/** Whether the channel's core vocabulary covers the document. */\n\tcompatible: boolean;\n\t/** Core components the document uses that the channel does not implement. */\n\tmissingCoreComponents: string[];\n}\n\n/**\n * Create a channel that consumes a release. The channel verifies that every\n * core component the document references is in its vocabulary; pack-namespaced\n * components are resolved from the release's locked packs, not the channel.\n */\nexport function createSduiChannel(id: string, coreComponents: readonly string[]): SduiChannel {\n\treturn {\n\t\tid,\n\t\tcoreComponents,\n\t\tconsume(release) {\n\t\t\tassertSduiReleaseIntegrity(release);\n\t\t\tconst used = collectCoreComponents(release.document.root);\n\t\t\tfor (const variant of release.document.variants ?? []) {\n\t\t\t\tfor (const component of collectCoreComponents(variant.root)) used.add(component);\n\t\t\t}\n\t\t\tconst missing = [...used].filter((component) => !coreComponents.includes(component));\n\t\t\treturn {\n\t\t\t\trelease,\n\t\t\t\tcompatible: missing.length === 0,\n\t\t\t\tmissingCoreComponents: missing,\n\t\t\t};\n\t\t},\n\t};\n}\n\nfunction collectCoreComponents(fragment: SduiFragment): Set<string> {\n\tconst used = new Set<string>();\n\tif (fragment.component !== undefined && !fragment.component.includes(\".\")) {\n\t\tused.add(fragment.component);\n\t}\n\tif (fragment.children !== undefined) {\n\t\tfor (const child of fragment.children) {\n\t\t\tfor (const component of collectCoreComponents(child)) used.add(component);\n\t\t}\n\t}\n\treturn used;\n}\n\n// ── Channel conformance ─────────────────────────────────────────────────────\n\n/**\n * The subject a channel implementation supplies to be certified.\n *\n * `validRelease` must be a genuinely promoted release, and it must use\n * `unimplementedCoreComponent`, which the channel must not implement. The suite\n * certifies that a channel *reports* what it cannot render, so the fixture has\n * to be one that requires reporting: consuming `validRelease` is therefore\n * expected to come back incompatible. The suite derives its own tampered and\n * unpromoted variants from it, so an implementer never has to hand-construct an\n * invalid release correctly.\n */\nexport interface SduiChannelConformanceSubject {\n\tchannel: SduiChannel;\n\tvalidRelease: SduiRelease;\n\t/** A core component the channel does not implement, used to prove it reports rather than renders. */\n\tunimplementedCoreComponent: string;\n}\n\nexport interface SduiChannelCheck {\n\tid:\n\t\t| \"fabric.sdui-channel.verified-release.v1\"\n\t\t| \"fabric.sdui-channel.tampered-release-denial.v1\"\n\t\t| \"fabric.sdui-channel.unpromoted-document-denial.v1\"\n\t\t| \"fabric.sdui-channel.reports-missing-vocabulary.v1\"\n\t\t| \"fabric.sdui-channel.consumption-is-pure.v1\";\n\trun(subject: SduiChannelConformanceSubject): Promise<string[]>;\n}\n\nexport interface SduiChannelConformanceResult {\n\tpassed: boolean;\n\tchecks: Array<{ id: SduiChannelCheck[\"id\"]; status: \"passed\" | \"failed\"; evidence: string[]; error?: string }>;\n}\n\n/**\n * A channel refuses input by throwing, but not every throw is a refusal: an\n * unrelated crash would otherwise certify as correct behaviour. The rejection\n * has to name what it rejected.\n */\nasync function refusalReason(run: () => unknown, expect: RegExp): Promise<string | null> {\n\ttry {\n\t\tawait run();\n\t\treturn null;\n\t} catch (error) {\n\t\tconst message = error instanceof Error ? error.message : String(error);\n\t\treturn expect.test(message) ? message : null;\n\t}\n}\n\n/**\n * The suite any channel must pass before it is allowed to render.\n *\n * The governed path holds only if a channel refuses anything that is not a\n * promoted, digest-verified release. A renderer that accepts a composed\n * document directly never runs `validateSduiRelease`, so grants, variants and\n * locked remotes apply to nothing. That is the single failure this suite\n * exists to make impossible to ship.\n */\nexport function sduiChannelChecks(): readonly SduiChannelCheck[] {\n\treturn [\n\t\t{\n\t\t\tid: \"fabric.sdui-channel.verified-release.v1\",\n\t\t\tasync run(subject) {\n\t\t\t\tassertSduiReleaseIntegrity(subject.validRelease);\n\t\t\t\tconst result = subject.channel.consume(subject.validRelease);\n\t\t\t\tif (result.release.releaseDigest !== subject.validRelease.releaseDigest) {\n\t\t\t\t\tthrow new Error(\"channel returned a release other than the one it was given\");\n\t\t\t\t}\n\t\t\t\treturn [subject.validRelease.releaseDigest];\n\t\t\t},\n\t\t},\n\t\t{\n\t\t\tid: \"fabric.sdui-channel.tampered-release-denial.v1\",\n\t\t\tasync run(subject) {\n\t\t\t\t// Content edited after promotion, digest left alone.\n\t\t\t\tconst tampered = {\n\t\t\t\t\t...subject.validRelease,\n\t\t\t\t\tdocument: { ...subject.validRelease.document, name: `${subject.validRelease.document.name}-tampered` },\n\t\t\t\t} as SduiRelease;\n\t\t\t\tconst reason = await refusalReason(() => subject.channel.consume(tampered), /digest|integrity/i);\n\t\t\t\tif (reason === null) {\n\t\t\t\t\tthrow new Error(\"channel did not refuse a release whose content no longer matches its digest, citing the digest\");\n\t\t\t\t}\n\n\t\t\t\t// A channel that special-cases one fixture is not verifying. Every\n\t\t\t\t// field that participates in the digest must be refused when edited.\n\t\t\t\tfor (const [label, mutate] of [\n\t\t\t\t\t[\"version\", (release: SduiRelease) => ({ ...release, document: { ...release.document, version: \"9.9.9\" } })],\n\t\t\t\t\t[\"grants\", (release: SduiRelease) => ({ ...release, grants: { ...release.grants, views: [...release.grants.views, \"capability://smuggled/view\"] } })],\n\t\t\t\t\t[\"assembly\", (release: SduiRelease) => ({ ...release, assemblyDigest: \"f\".repeat(64) })],\n\t\t\t\t] as const) {\n\t\t\t\t\tconst edited = mutate(subject.validRelease) as SduiRelease;\n\t\t\t\t\tif ((await refusalReason(() => subject.channel.consume(edited), /digest|integrity/i)) === null) {\n\t\t\t\t\t\tthrow new Error(`channel accepted a release whose ${label} was edited after promotion`);\n\t\t\t\t\t}\n\t\t\t\t}\n\t\t\t\treturn [\"tampered document refused\", \"edited version, grants and assembly refused\"];\n\t\t\t},\n\t\t},\n\t\t{\n\t\t\tid: \"fabric.sdui-channel.unpromoted-document-denial.v1\",\n\t\t\tasync run(subject) {\n\t\t\t\t// The shape a compositor emits: a document, never promoted.\n\t\t\t\tconst expected = /digest|integrity|release|formatVersion|must be/i;\n\t\t\t\tconst unpromoted = { document: subject.validRelease.document } as unknown as SduiRelease;\n\t\t\t\tif ((await refusalReason(() => subject.channel.consume(unpromoted), expected)) === null) {\n\t\t\t\t\tthrow new Error(\"channel did not refuse a bare document that was never promoted, citing what was wrong with it\");\n\t\t\t\t}\n\t\t\t\tconst digestless = { ...subject.validRelease, releaseDigest: undefined } as unknown as SduiRelease;\n\t\t\t\tif ((await refusalReason(() => subject.channel.consume(digestless), expected)) === null) {\n\t\t\t\t\tthrow new Error(\"channel did not refuse a release carrying no digest, citing what was wrong with it\");\n\t\t\t\t}\n\t\t\t\treturn [\"bare document refused\", \"digestless release refused\"];\n\t\t\t},\n\t\t},\n\t\t{\n\t\t\tid: \"fabric.sdui-channel.reports-missing-vocabulary.v1\",\n\t\t\tasync run(subject) {\n\t\t\t\t// The subject itself must report, so the fixture has to use a\n\t\t\t\t// component the subject genuinely does not implement. A release\n\t\t\t\t// that never exercises it proves nothing and is a bad fixture\n\t\t\t\t// rather than a pass.\n\t\t\t\tconst used = collectCoreComponents(subject.validRelease.document.root);\n\t\t\t\tfor (const variant of subject.validRelease.document.variants ?? []) {\n\t\t\t\t\tfor (const component of collectCoreComponents(variant.root)) used.add(component);\n\t\t\t\t}\n\t\t\t\tif (!used.has(subject.unimplementedCoreComponent)) {\n\t\t\t\t\tthrow new Error(\n\t\t\t\t\t\t`conformance subject is vacuous: validRelease never uses \"${subject.unimplementedCoreComponent}\", so the channel is never asked to report it`,\n\t\t\t\t\t);\n\t\t\t\t}\n\t\t\t\tif (subject.channel.coreComponents.includes(subject.unimplementedCoreComponent)) {\n\t\t\t\t\tthrow new Error(\n\t\t\t\t\t\t`conformance subject is contradictory: the channel implements \"${subject.unimplementedCoreComponent}\"`,\n\t\t\t\t\t);\n\t\t\t\t}\n\t\t\t\tconst result = subject.channel.consume(subject.validRelease);\n\t\t\t\tif (result.compatible) {\n\t\t\t\t\tthrow new Error(\"channel reported compatible for a release using a component it does not implement\");\n\t\t\t\t}\n\t\t\t\tif (!result.missingCoreComponents.includes(subject.unimplementedCoreComponent)) {\n\t\t\t\t\tthrow new Error(\"channel reported incompatible without naming the component it cannot render\");\n\t\t\t\t}\n\t\t\t\treturn [`missing: ${result.missingCoreComponents.join(\", \")}`];\n\t\t\t},\n\t\t},\n\t\t{\n\t\t\tid: \"fabric.sdui-channel.consumption-is-pure.v1\",\n\t\t\tasync run(subject) {\n\t\t\t\tconst before = JSON.stringify(subject.validRelease);\n\t\t\t\tsubject.channel.consume(subject.validRelease);\n\t\t\t\tsubject.channel.consume(subject.validRelease);\n\t\t\t\tif (JSON.stringify(subject.validRelease) !== before) {\n\t\t\t\t\tthrow new Error(\"channel mutated the release it consumed\");\n\t\t\t\t}\n\t\t\t\treturn [\"release unchanged after two consumptions\"];\n\t\t\t},\n\t\t},\n\t];\n}\n\n/** Run every channel check, returning each result rather than throwing on the first. */\nexport async function runSduiChannelChecks(\n\tsubject: SduiChannelConformanceSubject,\n): Promise<SduiChannelConformanceResult> {\n\tconst checks: SduiChannelConformanceResult[\"checks\"] = [];\n\tfor (const check of sduiChannelChecks()) {\n\t\ttry {\n\t\t\tchecks.push({ id: check.id, status: \"passed\", evidence: await check.run(subject) });\n\t\t} catch (error) {\n\t\t\tchecks.push({\n\t\t\t\tid: check.id,\n\t\t\t\tstatus: \"failed\",\n\t\t\t\tevidence: [],\n\t\t\t\terror: error instanceof Error ? error.message : String(error),\n\t\t\t});\n\t\t}\n\t}\n\treturn { passed: checks.every((check) => check.status === \"passed\"), checks };\n}\n","import type { SduiDocument, SduiFragment, SduiFragmentValue } from \"./types\";\n\n/**\n * Every capability reference a document actually binds.\n *\n * Used to keep derived grants equal to what a screen renders. It walks the\n * default tree and every variant, because a variant can render and its\n * references are as real as the default tree's.\n */\nexport function collectDocumentReferences(document: SduiDocument): {\n\tviews: Set<string>;\n\tintents: Set<string>;\n} {\n\tconst views = new Set<string>();\n\tconst intents = new Set<string>();\n\tconst trees = [document.root, ...(document.variants ?? []).map((variant) => variant.root)];\n\tfor (const tree of trees) walk(tree, views, intents);\n\treturn { views, intents };\n}\n\nfunction walk(fragment: SduiFragment, views: Set<string>, intents: Set<string>): void {\n\tif (fragment.dataRef) views.add(fragment.dataRef);\n\tfor (const action of Object.values(fragment.actions ?? {})) {\n\t\tintents.add(action.intent);\n\t\tif (action.params) collectValues(action.params, views);\n\t}\n\tif (fragment.props) collectValues(fragment.props, views);\n\tfor (const child of fragment.children ?? []) walk(child, views, intents);\n}\n\nfunction collectValues(props: Record<string, SduiFragmentValue>, views: Set<string>): void {\n\tfor (const value of Object.values(props)) collectValue(value, views);\n}\n\nfunction collectValue(value: SduiFragmentValue, views: Set<string>): void {\n\tif (value !== null && typeof value === \"object\" && !Array.isArray(value) && \"$ref\" in value) {\n\t\tviews.add((value as { $ref: string }).$ref);\n\t\tfor (const [key, sibling] of Object.entries(value)) {\n\t\t\tif (key !== \"$ref\") collectValue(sibling as SduiFragmentValue, views);\n\t\t}\n\t\treturn;\n\t}\n\tif (Array.isArray(value)) {\n\t\tfor (const item of value) collectValue(item, views);\n\t\treturn;\n\t}\n\tif (value !== null && typeof value === \"object\") collectValues(value as Record<string, SduiFragmentValue>, views);\n}\n","import type { UsageContract } from \"@fabricorg/gen-capability\";\nimport type { SduiAuthorizationGrants, SduiDocument, SduiFragment } from \"./types\";\nimport { collectDocumentReferences } from \"./references\";\n\n// ── Entitlement-derived grants ──────────────────────────────────────────────\n\n/**\n * What an actor holds, as the surrounding system already models it.\n *\n * These come from wherever entitlements are administered — a plan, a licence,\n * a role assignment, an identity provider's scopes. Fabric does not administer\n * them; it decides what they add up to.\n */\nexport interface ActorEntitlements {\n\tpermissions?: readonly string[];\n\tentitlements?: readonly string[];\n\tfeatureFlags?: readonly string[];\n}\n\n/** A capability the actor cannot use, and the first requirement they are missing. */\nexport interface WithheldCapability {\n\tnamespace: string;\n\tmissing: { kind: \"permission\" | \"entitlement\" | \"featureFlag\"; name: string };\n}\n\nexport interface DerivedGrants {\n\tgrants: SduiAuthorizationGrants;\n\t/** Capabilities deliberately left out, so an absent navigation entry is explainable. */\n\twithheld: WithheldCapability[];\n}\n\nexport interface DeriveGrantsOptions {\n\t/**\n\t * Restrict the result to references this document actually binds.\n\t *\n\t * Supply it whenever the grants will be promoted. Grants are not only a\n\t * navigation hint: `validateSduiRelease` carries them onto the release\n\t * unexamined, and promotion compiles a signed route for every one, so a\n\t * surplus grant becomes a signed route to a capability the screen never\n\t * uses. Scoping to the document is what keeps the release's exposed surface\n\t * equal to what it actually renders.\n\t */\n\tdocument?: SduiDocument;\n\t/**\n\t * What to do with a capability that declares no requirements at all.\n\t *\n\t * Defaults to `\"withhold\"`. Requirements are optional metadata, so silence\n\t * is the common case, and reading silence as \"available to everyone\" makes\n\t * the default open. Pass `\"grant\"` only for a contract set you have decided\n\t * is unrestricted.\n\t */\n\tundeclaredRequirements?: \"withhold\" | \"grant\";\n}\n\n/**\n * Derive release grants from what an actor holds.\n *\n * A shell has to decide what to show. If it answers that from its own\n * configuration while grants are hand-maintained somewhere else and enforcement\n * happens in a third place, the three drift, and the one the user sees drifts\n * from the one that enforces. Deriving grants here makes navigation a\n * projection of the same declarations rather than a parallel guess at them.\n *\n * This is navigation-shaped, not enforcement. It decides what a viewer is\n * offered; `PlatformHost` still re-checks authority when an action executes and\n * `ProjectionHost` still authorizes every query, so stale navigation is a\n * cosmetic problem rather than a security one. Nothing here is a gate.\n *\n * A capability contributes nothing unless every requirement it declares is\n * held. Partial access is not modelled on purpose: a capability that publishes\n * a view behind a permission the actor lacks has said the whole capability is\n * gated, and inferring finer structure from silence would be inventing policy.\n */\nexport function deriveAuthorizationGrants(\n\tcontracts: readonly UsageContract[],\n\theld: ActorEntitlements,\n\toptions: DeriveGrantsOptions = {},\n): DerivedGrants {\n\tconst undeclared = options.undeclaredRequirements ?? \"withhold\";\n\tconst bound = options.document ? collectDocumentReferences(options.document) : undefined;\n\tconst permissions = new Set(held.permissions ?? []);\n\tconst entitlements = new Set(held.entitlements ?? []);\n\tconst featureFlags = new Set(held.featureFlags ?? []);\n\n\tconst views: string[] = [];\n\tconst intents: string[] = [];\n\tconst withheld: WithheldCapability[] = [];\n\n\tfor (const contract of contracts) {\n\t\tif (undeclared === \"withhold\" && !declaresAnyRequirement(contract)) {\n\t\t\twithheld.push({ namespace: contract.namespace, missing: { kind: \"permission\", name: \"(none declared)\" } });\n\t\t\tcontinue;\n\t\t}\n\t\tconst missing = firstMissingRequirement(contract, { permissions, entitlements, featureFlags });\n\t\tif (missing) {\n\t\t\twithheld.push({ namespace: contract.namespace, missing });\n\t\t\tcontinue;\n\t\t}\n\t\tfor (const view of contract.views) {\n\t\t\tconst reference = `capability://${contract.namespace}/${shortName(view.name, contract.namespace, \"/\")}`;\n\t\t\tif (!bound || bound.views.has(reference)) views.push(reference);\n\t\t}\n\t\tfor (const intent of actionIntentsOf(contract)) {\n\t\t\tconst reference = `capability://${contract.namespace}/${shortName(intent.name, contract.namespace, \".\")}`;\n\t\t\tif (!bound || bound.intents.has(reference)) intents.push(reference);\n\t\t}\n\t}\n\n\treturn {\n\t\tgrants: { views: [...new Set(views)].sort(), intents: [...new Set(intents)].sort() },\n\t\twithheld: withheld.sort((left, right) => (left.namespace < right.namespace ? -1 : left.namespace > right.namespace ? 1 : 0)),\n\t};\n}\n\n/**\n * Whether a capability said anything at all about who may use it. Silence is\n * not permission: a capability that declares nothing has not been reviewed for\n * entitlement, and inferring \"everyone\" from that is inventing policy.\n */\nfunction declaresAnyRequirement(contract: UsageContract): boolean {\n\tconst requirements = contract.requirements;\n\treturn Boolean(\n\t\trequirements\n\t\t&& ((requirements.permissions?.length ?? 0) > 0\n\t\t\t|| (requirements.entitlements?.length ?? 0) > 0\n\t\t\t|| (requirements.featureFlags?.length ?? 0) > 0),\n\t);\n}\n\nfunction firstMissingRequirement(\n\tcontract: UsageContract,\n\theld: { permissions: Set<string>; entitlements: Set<string>; featureFlags: Set<string> },\n): WithheldCapability[\"missing\"] | undefined {\n\tconst requirements = contract.requirements;\n\tfor (const name of requirements?.permissions ?? []) {\n\t\tif (!held.permissions.has(name)) return { kind: \"permission\", name };\n\t}\n\tfor (const name of requirements?.entitlements ?? []) {\n\t\tif (!held.entitlements.has(name)) return { kind: \"entitlement\", name };\n\t}\n\tfor (const name of requirements?.featureFlags ?? []) {\n\t\tif (!held.featureFlags.has(name)) return { kind: \"featureFlag\", name };\n\t}\n\treturn undefined;\n}\n\nfunction actionIntentsOf(contract: UsageContract): Array<{ name: string; actionId: string }> {\n\tconst experience = contract.extensions?.[\"fabric.experience/v1\"] as\n\t\t| { actionIntents?: Array<{ name: string; actionId: string }> }\n\t\t| undefined;\n\treturn experience?.actionIntents ?? [];\n}\n\n/** Contracts name views as `ns/view` and intents as `ns.intent`; refs use the tail. */\nfunction shortName(name: string, namespace: string, separator: \"/\" | \".\"): string {\n\tconst prefix = `${namespace}${separator}`;\n\treturn name.startsWith(prefix) ? name.slice(prefix.length) : name;\n}\n","import type { PortableJsonSchema } from \"@fabricorg/platform\";\n\n// ── JSON Schema for the release document (machine-readable) ─────────────────\n\nexport const SDUI_DOCUMENT_JSON_SCHEMA: PortableJsonSchema = {\n\t$schema: \"https://json-schema.org/draft/2020-12/schema\",\n\ttitle: \"Fabric SDUI document\",\n\ttype: \"object\",\n\trequired: [\"formatVersion\", \"name\", \"version\", \"root\", \"tokenSet\", \"componentPacks\"],\n\tproperties: {\n\t\tformatVersion: { type: \"integer\", enum: [1] },\n\t\tname: { type: \"string\", pattern: \"^[a-z][a-z0-9-]*$\" },\n\t\tversion: { type: \"string\", pattern: \"^\\\\d+\\\\.\\\\d+\\\\.\\\\d+\" },\n\t\troot: { type: \"object\" },\n\t\ttokenSet: { type: \"object\", required: [\"name\", \"version\"] },\n\t\tcomponentPacks: { type: \"array\" },\n\t},\n} as unknown as PortableJsonSchema;\n\nexport const SDUI_RELEASE_JSON_SCHEMA: PortableJsonSchema = {\n\t$schema: \"https://json-schema.org/draft/2020-12/schema\",\n\ttitle: \"Fabric SDUI promoted release\",\n\ttype: \"object\",\n\trequired: [\"formatVersion\", \"releaseDigest\", \"assemblyDigest\", \"document\", \"tokenSet\", \"componentPacks\", \"grants\"],\n\tproperties: {\n\t\tformatVersion: { type: \"integer\", enum: [2] },\n\t\treleaseDigest: { type: \"string\", pattern: \"^[0-9a-f]{64}$\" },\n\t\tassemblyDigest: { type: \"string\", pattern: \"^[0-9a-f]{64}$\" },\n\t\tdocument: { type: \"object\" },\n\t\ttokenSet: { type: \"object\" },\n\t\tcomponentPacks: { type: \"array\" },\n\t\tgrants: { type: \"object\", required: [\"views\", \"intents\"] },\n\t},\n} as unknown as PortableJsonSchema;\n","import type { ActionExecutionContract, PortableJsonSchema } from \"@fabricorg/platform\";\nimport type { SduiDocument, SduiTokenSet, ResolvedSduiComponentPack } from \"./types\";\nexport type {\n\tSduiActionRef,\n\tSduiDocument,\n\tSduiFragment,\n\tSduiFragmentValue,\n\tSduiTokenSet,\n\tResolvedSduiComponentPack,\n} from \"./types\";\n\nexport const SDUI_RELEASE_V3_FORMAT_VERSION = 3 as const;\nexport const RELEASE_CHANNEL_POINTER_FORMAT_VERSION = 1 as const;\n\nexport interface ExperienceViewRoute {\n\treference: `capability://${string}`;\n\tname: `${string}/${string}`;\n\tversion: string;\n\tparameterSchema?: PortableJsonSchema;\n\tparameterSchemaDigest?: string;\n}\n\nexport interface ExperienceIntentRoute {\n\treference: `capability://${string}`;\n\tactionId: `${string}.${string}`;\n\tversion: number;\n\tparameterSchema?: PortableJsonSchema;\n\tparameterSchemaDigest?: string;\n\texecution?: ActionExecutionContract;\n}\n\nexport interface EffectiveFragmentGrant {\n\ttreeId: \"root\" | string;\n\tfragmentId: string;\n\tviews: readonly string[];\n\tintents: readonly string[];\n}\n\nexport interface SduiReleaseV3 {\n\tformatVersion: typeof SDUI_RELEASE_V3_FORMAT_VERSION;\n\tkind: \"experience-release\";\n\tissuer: string;\n\tapplication: string;\n\treleaseDigest: string;\n\tassemblyDigest: string;\n\tdocument: SduiDocument;\n\ttokenSet: SduiTokenSet;\n\tcomponentPacks: ResolvedSduiComponentPack[];\n\troutes: {\n\t\tviews: ExperienceViewRoute[];\n\t\tintents: ExperienceIntentRoute[];\n\t};\n\teffectiveGrants: EffectiveFragmentGrant[];\n}\n\nexport interface ReleaseChannelPointer {\n\tformatVersion: typeof RELEASE_CHANNEL_POINTER_FORMAT_VERSION;\n\tkind: \"release-channel-pointer\";\n\tissuer: string;\n\tapplication: string;\n\tchannel: string;\n\tgeneration: number;\n\tactiveReleaseDigest: string;\n\tassemblyDigest: string;\n\tissuedAt: string;\n\tnotBefore?: string;\n\texpiresAt?: string;\n\tfallbackReleaseDigests?: readonly string[];\n}\n\nexport interface ReleaseVerificationKey {\n\tkeyId: string;\n\talgorithm: \"ES256\";\n\tkey: unknown;\n}\n\nexport interface ReleaseTrustStore {\n\tresolveKey(input: { keyId: string; issuer: string; algorithm: \"ES256\" }): ReleaseVerificationKey | undefined | Promise<ReleaseVerificationKey | undefined>;\n}\n\nexport interface ReleaseCryptoPort {\n\tverify(input: {\n\t\talgorithm: \"ES256\";\n\t\tkey: unknown;\n\t\tsigningInput: Uint8Array;\n\t\tsignature: Uint8Array;\n\t}): Promise<boolean>;\n\tdigestSha256(bytes: Uint8Array): Promise<Uint8Array>;\n}\n\nexport interface ReleaseGenerationStore {\n\tget(key: string): Promise<{ generation: number; pointerDigest: string } | undefined>;\n\t/**\n\t * Atomically accepts `generation` only when it is greater than the stored\n\t * value for `key`. Implementations must compare and write in one operation.\n\t */\n\tacceptIfHigher(key: string, generation: number, pointerDigest: string): Promise<boolean>;\n}\n\nexport interface VerifySignedExperienceArtifactInput {\n\tcompactJws: string;\n\texpectedType: \"fabric-experience-release+jws\" | \"fabric-release-channel-pointer+jws\";\n\tcrypto: ReleaseCryptoPort;\n\ttrust: ReleaseTrustStore;\n\tmaxBytes?: number;\n}\n\nconst encoder = new TextEncoder();\nconst decoder = new TextDecoder(\"utf-8\", { fatal: true });\nconst HEX_DIGEST = /^[a-f0-9]{64}$/;\n\n/**\n * RFC 8785 JSON Canonicalization Scheme for values already restricted to the\n * JSON data model. Invalid Unicode, non-finite numbers and non-JSON values are\n * rejected rather than normalized differently by another runtime.\n */\nexport function canonicalizeJcs(value: unknown): string {\n\treturn canonical(value, 0);\n}\n\nfunction canonical(value: unknown, depth: number): string {\n\tif (depth > 64) throw new Error(\"Canonical JSON exceeds the maximum depth of 64.\");\n\tif (value === null) return \"null\";\n\tif (typeof value === \"boolean\") return value ? \"true\" : \"false\";\n\tif (typeof value === \"number\") {\n\t\tif (!Number.isFinite(value)) throw new Error(\"Canonical JSON numbers must be finite.\");\n\t\treturn Object.is(value, -0) ? \"0\" : JSON.stringify(value);\n\t}\n\tif (typeof value === \"string\") {\n\t\tassertValidUnicode(value);\n\t\treturn JSON.stringify(value);\n\t}\n\tif (Array.isArray(value)) return `[${value.map((entry) => canonical(entry, depth + 1)).join(\",\")}]`;\n\tif (typeof value !== \"object\") throw new Error(`Canonical JSON cannot encode ${typeof value}.`);\n\tconst record = value as Record<string, unknown>;\n\tconst keys = Object.keys(record).sort();\n\treturn `{${keys.map((key) => {\n\t\tassertValidUnicode(key);\n\t\treturn `${JSON.stringify(key)}:${canonical(record[key], depth + 1)}`;\n\t}).join(\",\")}}`;\n}\n\nfunction assertValidUnicode(value: string): void {\n\tfor (let index = 0; index < value.length; index += 1) {\n\t\tconst code = value.charCodeAt(index);\n\t\tif (code >= 0xd800 && code <= 0xdbff) {\n\t\t\tconst next = value.charCodeAt(index + 1);\n\t\t\tif (!(next >= 0xdc00 && next <= 0xdfff)) throw new Error(\"Canonical JSON contains an unpaired Unicode surrogate.\");\n\t\t\tindex += 1;\n\t\t} else if (code >= 0xdc00 && code <= 0xdfff) {\n\t\t\tthrow new Error(\"Canonical JSON contains an unpaired Unicode surrogate.\");\n\t\t}\n\t}\n}\n\nexport async function verifySignedExperienceArtifact(\n\tinput: VerifySignedExperienceArtifactInput,\n): Promise<Record<string, unknown>> {\n\tconst maxBytes = input.maxBytes ?? 1_048_576;\n\tif (encoder.encode(input.compactJws).byteLength > maxBytes) {\n\t\tthrow new Error(`Signed experience artifact exceeds the ${maxBytes}-byte size limit.`);\n\t}\n\tconst parts = input.compactJws.split(\".\");\n\tif (parts.length !== 3 || parts.some((part) => part.length === 0)) throw new Error(\"Signed experience artifact must be a compact JWS.\");\n\tconst header = parseSegment(parts[0]!, \"protected header\");\n\tif (header.alg !== \"ES256\") throw new Error(\"Signed experience artifacts must use ES256.\");\n\tif (header.typ !== input.expectedType) throw new Error(`Signed experience artifact type must be ${input.expectedType}.`);\n\tif (typeof header.kid !== \"string\" || !header.kid) throw new Error(\"Signed experience artifact requires a key id.\");\n\tconst payloadBytes = decodeBase64Url(parts[1]!);\n\tconst payload = parseJsonBytes(payloadBytes, \"payload\");\n\tif (typeof payload.issuer !== \"string\" || !payload.issuer) throw new Error(\"Signed experience artifact requires an issuer.\");\n\tconst key = await input.trust.resolveKey({ keyId: header.kid, issuer: payload.issuer, algorithm: \"ES256\" });\n\tif (!key || key.algorithm !== \"ES256\") throw new Error(\"Signed experience artifact has no trusted key.\");\n\tconst signature = decodeBase64Url(parts[2]!);\n\tif (signature.byteLength !== 64) throw new Error(\"ES256 signatures must be 64-byte JOSE signatures.\");\n\tconst verified = await input.crypto.verify({\n\t\talgorithm: \"ES256\",\n\t\tkey: key.key,\n\t\tsigningInput: encoder.encode(`${parts[0]}.${parts[1]}`),\n\t\tsignature,\n\t});\n\tif (!verified) throw new Error(\"Signed experience artifact signature is invalid.\");\n\treturn payload;\n}\n\nexport async function verifySignedExperienceRelease(input: {\n\tcompactJws: string;\n\tcrypto: ReleaseCryptoPort;\n\ttrust: ReleaseTrustStore;\n\texpected: { issuer: string; application: string; assemblyDigest: string };\n\tmaxBytes?: number;\n}): Promise<SduiReleaseV3> {\n\tconst payload = await verifySignedExperienceArtifact({\n\t\tcompactJws: input.compactJws,\n\t\texpectedType: \"fabric-experience-release+jws\",\n\t\tcrypto: input.crypto,\n\t\ttrust: input.trust,\n\t\t...(input.maxBytes === undefined ? {} : { maxBytes: input.maxBytes }),\n\t});\n\tassertSduiReleaseV3(payload);\n\tif (payload.issuer !== input.expected.issuer\n\t\t|| payload.application !== input.expected.application\n\t\t|| payload.assemblyDigest !== input.expected.assemblyDigest) {\n\t\tthrow new Error(\"Signed experience release does not match the expected issuer, application, and assembly.\");\n\t}\n\tconst { releaseDigest, ...body } = payload;\n\tconst digest = await input.crypto.digestSha256(encoder.encode(canonicalizeJcs(body)));\n\tconst expectedDigest = [...digest].map((byte) => byte.toString(16).padStart(2, \"0\")).join(\"\");\n\tif (releaseDigest !== expectedDigest) throw new Error(\"Signed experience release digest does not match its canonical content.\");\n\treturn payload;\n}\n\nexport function assertSduiReleaseV3(value: unknown): asserts value is SduiReleaseV3 {\n\tif (!value || typeof value !== \"object\" || Array.isArray(value)) throw new Error(\"SDUI Release v3 must be an object.\");\n\tconst release = value as Record<string, unknown>;\n\tif (release.formatVersion !== SDUI_RELEASE_V3_FORMAT_VERSION || release.kind !== \"experience-release\") {\n\t\tthrow new Error(\"SDUI Release v3 has an unsupported format.\");\n\t}\n\tfor (const field of [\"issuer\", \"application\", \"releaseDigest\", \"assemblyDigest\"] as const) {\n\t\tif (typeof release[field] !== \"string\" || !release[field]) throw new Error(`SDUI Release v3 ${field} is required.`);\n\t}\n\tif (!HEX_DIGEST.test(release.releaseDigest as string) || !HEX_DIGEST.test(release.assemblyDigest as string)) {\n\t\tthrow new Error(\"SDUI Release v3 digests must be lowercase SHA-256 values.\");\n\t}\n\tif (!release.document || typeof release.document !== \"object\"\n\t\t|| !release.tokenSet || typeof release.tokenSet !== \"object\"\n\t\t|| !Array.isArray(release.componentPacks)\n\t\t|| !release.routes || typeof release.routes !== \"object\"\n\t\t|| !Array.isArray((release.routes as Record<string, unknown>).views)\n\t\t|| !Array.isArray((release.routes as Record<string, unknown>).intents)\n\t\t|| !Array.isArray(release.effectiveGrants)) {\n\t\tthrow new Error(\"SDUI Release v3 is structurally incomplete.\");\n\t}\n\tconst routes = release.routes as { views: unknown[]; intents: unknown[] };\n\tassertUniqueRecords(routes.views, \"view route\", (route) => {\n\t\tconst record = assertRecord(route, \"view route\");\n\t\tassertCapabilityReference(record.reference, \"view route\");\n\t\tassertNonEmptyString(record.name, \"view route name\");\n\t\tassertNonEmptyString(record.version, \"view route version\");\n\t\tif (record.parameterSchemaDigest !== undefined) {\n\t\t\tassertHexDigest(record.parameterSchemaDigest, \"view route parameterSchemaDigest\");\n\t\t}\n\t\treturn record.reference as string;\n\t});\n\tassertUniqueRecords(routes.intents, \"intent route\", (route) => {\n\t\tconst record = assertRecord(route, \"intent route\");\n\t\tassertCapabilityReference(record.reference, \"intent route\");\n\t\tassertNonEmptyString(record.actionId, \"intent route actionId\");\n\t\tif (!Number.isSafeInteger(record.version) || (record.version as number) < 1) {\n\t\t\tthrow new Error(\"SDUI Release v3 intent route version must be a positive integer.\");\n\t\t}\n\t\tif (record.parameterSchemaDigest !== undefined) {\n\t\t\tassertHexDigest(record.parameterSchemaDigest, \"intent route parameterSchemaDigest\");\n\t\t}\n\t\treturn record.reference as string;\n\t});\n\tassertUniqueRecords(release.effectiveGrants as unknown[], \"effective grant\", (grant) => {\n\t\tconst record = assertRecord(grant, \"effective grant\");\n\t\tassertNonEmptyString(record.treeId, \"effective grant treeId\");\n\t\tassertNonEmptyString(record.fragmentId, \"effective grant fragmentId\");\n\t\tif (!Array.isArray(record.views) || !record.views.every((item) => typeof item === \"string\")\n\t\t\t|| !Array.isArray(record.intents) || !record.intents.every((item) => typeof item === \"string\")) {\n\t\t\tthrow new Error(\"SDUI Release v3 effective grant routes must be string arrays.\");\n\t\t}\n\t\treturn `${record.treeId as string}\\0${record.fragmentId as string}`;\n\t});\n}\n\nfunction assertRecord(value: unknown, label: string): Record<string, unknown> {\n\tif (!value || typeof value !== \"object\" || Array.isArray(value)) throw new Error(`SDUI Release v3 ${label} must be an object.`);\n\treturn value as Record<string, unknown>;\n}\n\nfunction assertNonEmptyString(value: unknown, label: string): asserts value is string {\n\tif (typeof value !== \"string\" || !value) throw new Error(`SDUI Release v3 ${label} is required.`);\n}\n\nfunction assertHexDigest(value: unknown, label: string): asserts value is string {\n\tif (typeof value !== \"string\" || !HEX_DIGEST.test(value)) throw new Error(`SDUI Release v3 ${label} must be a lowercase SHA-256 value.`);\n}\n\nfunction assertCapabilityReference(value: unknown, label: string): asserts value is `capability://${string}` {\n\tif (typeof value !== \"string\" || !value.startsWith(\"capability://\")) throw new Error(`SDUI Release v3 ${label} reference is invalid.`);\n}\n\nfunction assertUniqueRecords(values: unknown[], label: string, identity: (value: unknown) => string): void {\n\tconst seen = new Set<string>();\n\tfor (const value of values) {\n\t\tconst key = identity(value);\n\t\tif (seen.has(key)) throw new Error(`SDUI Release v3 has a duplicate ${label}.`);\n\t\tseen.add(key);\n\t}\n}\n\nexport async function activateReleaseChannelPointer(input: {\n\tcompactJws: string;\n\tcrypto: ReleaseCryptoPort;\n\ttrust: ReleaseTrustStore;\n\tgenerations: ReleaseGenerationStore;\n\texpected: { issuer: string; application: string; channel: string };\n\tnow?: Date;\n}): Promise<ReleaseChannelPointer> {\n\tconst payload = await verifySignedExperienceArtifact({\n\t\tcompactJws: input.compactJws,\n\t\texpectedType: \"fabric-release-channel-pointer+jws\",\n\t\tcrypto: input.crypto,\n\t\ttrust: input.trust,\n\t});\n\tassertReleaseChannelPointer(payload);\n\tif (payload.issuer !== input.expected.issuer\n\t\t|| payload.application !== input.expected.application\n\t\t|| payload.channel !== input.expected.channel) {\n\t\tthrow new Error(\"Release channel pointer does not match the expected issuer, application, and channel.\");\n\t}\n\tconst now = (input.now ?? new Date()).getTime();\n\tif (payload.notBefore !== undefined && now < parseTimestamp(payload.notBefore, \"notBefore\")) {\n\t\tthrow new Error(\"Release channel pointer is not active yet.\");\n\t}\n\tif (payload.expiresAt !== undefined && now >= parseTimestamp(payload.expiresAt, \"expiresAt\")) {\n\t\tthrow new Error(\"Release channel pointer has expired.\");\n\t}\n\tconst generationKey = `${payload.issuer}:${payload.application}:${payload.channel}`;\n\tconst pointerDigestBytes = await input.crypto.digestSha256(encoder.encode(canonicalizeJcs(payload)));\n\tconst pointerDigest = [...pointerDigestBytes].map((byte) => byte.toString(16).padStart(2, \"0\")).join(\"\");\n\tconst current = await input.generations.get(generationKey);\n\tif (current !== undefined && payload.generation < current.generation) {\n\t\tthrow new Error(\"Release channel pointer is older than the accepted generation.\");\n\t}\n\tif (current?.generation === payload.generation && current.pointerDigest !== pointerDigest) {\n\t\tthrow new Error(\"Release channel generation is already bound to a different signed pointer.\");\n\t}\n\tif (current?.generation !== payload.generation) {\n\t\tconst accepted = await input.generations.acceptIfHigher(generationKey, payload.generation, pointerDigest);\n\t\tif (!accepted) {\n\t\t\tconst raced = await input.generations.get(generationKey);\n\t\t\tif (raced?.generation !== payload.generation || raced.pointerDigest !== pointerDigest) {\n\t\t\t\tthrow new Error(\"Release channel pointer lost an activation race to a different generation.\");\n\t\t\t}\n\t\t}\n\t}\n\treturn payload;\n}\n\nexport function assertReleaseChannelPointer(value: unknown): asserts value is ReleaseChannelPointer {\n\tif (!value || typeof value !== \"object\" || Array.isArray(value)) throw new Error(\"Release channel pointer must be an object.\");\n\tconst pointer = value as Record<string, unknown>;\n\tif (pointer.formatVersion !== RELEASE_CHANNEL_POINTER_FORMAT_VERSION || pointer.kind !== \"release-channel-pointer\") {\n\t\tthrow new Error(\"Release channel pointer has an unsupported format.\");\n\t}\n\tfor (const field of [\"issuer\", \"application\", \"channel\", \"issuedAt\"] as const) {\n\t\tif (typeof pointer[field] !== \"string\" || !pointer[field]) throw new Error(`Release channel pointer ${field} is required.`);\n\t}\n\tif (!Number.isSafeInteger(pointer.generation) || (pointer.generation as number) < 0) throw new Error(\"Release channel pointer generation must be a non-negative safe integer.\");\n\tif (!HEX_DIGEST.test(String(pointer.activeReleaseDigest)) || !HEX_DIGEST.test(String(pointer.assemblyDigest))) {\n\t\tthrow new Error(\"Release channel pointer digests must be lowercase SHA-256 values.\");\n\t}\n\tif (pointer.fallbackReleaseDigests !== undefined\n\t\t&& (!Array.isArray(pointer.fallbackReleaseDigests)\n\t\t\t|| !pointer.fallbackReleaseDigests.every((digest) => typeof digest === \"string\" && HEX_DIGEST.test(digest))\n\t\t\t|| new Set(pointer.fallbackReleaseDigests).size !== pointer.fallbackReleaseDigests.length)) {\n\t\tthrow new Error(\"Release channel pointer fallbackReleaseDigests must contain unique lowercase SHA-256 values.\");\n\t}\n\tparseTimestamp(pointer.issuedAt as string, \"issuedAt\");\n}\n\nfunction parseSegment(segment: string, label: string): Record<string, unknown> {\n\treturn parseJsonBytes(decodeBase64Url(segment), label);\n}\n\nfunction parseJsonBytes(bytes: Uint8Array, label: string): Record<string, unknown> {\n\tlet value: unknown;\n\ttry { value = JSON.parse(decoder.decode(bytes)); }\n\tcatch { throw new Error(`Signed experience artifact ${label} is not valid UTF-8 JSON.`); }\n\tif (!value || typeof value !== \"object\" || Array.isArray(value)) throw new Error(`Signed experience artifact ${label} must be an object.`);\n\treturn value as Record<string, unknown>;\n}\n\nfunction decodeBase64Url(value: string): Uint8Array {\n\tif (!/^[A-Za-z0-9_-]+$/.test(value)) throw new Error(\"Signed experience artifact contains invalid base64url.\");\n\tconst padded = value.replace(/-/g, \"+\").replace(/_/g, \"/\").padEnd(Math.ceil(value.length / 4) * 4, \"=\");\n\tlet binary: string;\n\ttry { binary = atob(padded); }\n\tcatch { throw new Error(\"Signed experience artifact contains invalid base64url.\"); }\n\treturn Uint8Array.from(binary, (character) => character.charCodeAt(0));\n}\n\nfunction parseTimestamp(value: string, field: string): number {\n\tif (!/(?:Z|[+-]\\d{2}:\\d{2})$/.test(value)) throw new Error(`Release channel pointer ${field} must be RFC 3339 with an explicit offset.`);\n\tconst parsed = Date.parse(value);\n\tif (Number.isNaN(parsed)) throw new Error(`Release channel pointer ${field} is invalid.`);\n\treturn parsed;\n}\n"],"mappings":";;;;;;;;;;;;;;;;;;;;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;;;ACQO,IAAM,+BAA+B;AAKrC,IAAM,gCAAgC;AAKtC,IAAM,qCAAqC;AAK3C,IAAM,8BAA8B;;;ACvB3C,sBAAkE;AAClE,sBAAiC;;;ACC1B,SAAS,KAAK,MAAc,SAAwB;AAC1D,QAAM,IAAI,MAAM,QAAQ,IAAI,IAAI,OAAO,GAAG;AAC3C;AAEO,SAAS,cAAc,OAAgB,MAAsB;AACnE,MAAI,OAAO,UAAU,YAAY,CAAC,MAAM,KAAK,EAAG,MAAK,MAAM,4BAA4B;AACvF,SAAO;AACR;AAEO,SAAS,cAAc,OAAgB,MAAuC;AACpF,MAAI,CAAC,SAAS,OAAO,UAAU,YAAY,MAAM,QAAQ,KAAK,EAAG,MAAK,MAAM,mBAAmB;AAC/F,SAAO;AACR;AAEO,SAAS,aAAa,OAAgB,MAAyB;AACrE,MAAI,CAAC,MAAM,QAAQ,KAAK,EAAG,MAAK,MAAM,kBAAkB;AACxD,SAAO;AACR;AAsBA,IAAM,iBAAiB;AAEhB,SAAS,mBAAmB,KAA8D;AAChG,QAAM,QAAQ,eAAe,KAAK,GAAG;AACrC,MAAI,CAAC,MAAO,QAAO;AACnB,SAAO,EAAE,WAAW,MAAM,CAAC,GAAI,MAAM,MAAM,CAAC,EAAG;AAChD;;;ADhCA,IAAM,cAAc,oBAAI,IAAmB,CAAC,SAAS,WAAW,YAAY,cAAc,UAAU,UAAU,QAAQ,CAAC;AAEhH,SAAS,mBAAmB,OAAgB,OAAO,YAA2C;AACpG,QAAM,WAAW,cAAc,OAAO,IAAI;AAC1C,MAAI,SAAS,kBAAkB,GAAG;AACjC,SAAK,GAAG,IAAI,kBAAkB,uBAAuB,KAAK,UAAU,SAAS,aAAa,CAAC,EAAE;AAAA,EAC9F;AACA,MAAI,CAAC,oBAAoB,KAAK,cAAc,SAAS,MAAM,GAAG,IAAI,OAAO,CAAC,GAAG;AAC5E,SAAK,GAAG,IAAI,SAAS,gDAAgD;AAAA,EACtE;AACA,MAAI,CAAC,sCAAsC,KAAK,cAAc,SAAS,SAAS,GAAG,IAAI,UAAU,CAAC,GAAG;AACpG,SAAK,GAAG,IAAI,YAAY,0BAA0B;AAAA,EACnD;AACA,QAAM,SAAS,cAAc,SAAS,QAAQ,GAAG,IAAI,SAAS;AAC9D,aAAW,CAAC,MAAM,KAAK,KAAK,OAAO,QAAQ,MAAM,GAAG;AACnD,UAAM,YAAY,GAAG,IAAI,WAAW,IAAI;AACxC,QAAI,CAAC,oBAAoB,KAAK,IAAI,EAAG,MAAK,WAAW,2DAA2D;AAChH,UAAM,QAAQ,cAAc,OAAO,SAAS;AAC5C,UAAM,OAAO,cAAc,MAAM,MAAM,GAAG,SAAS,OAAO;AAC1D,QAAI,CAAC,YAAY,IAAI,IAAqB,EAAG,MAAK,GAAG,SAAS,SAAS,kBAAkB,CAAC,GAAG,WAAW,EAAE,KAAK,IAAI,CAAC,EAAE;AACtH,kBAAc,MAAM,OAAO,GAAG,SAAS,QAAQ;AAAA,EAChD;AACD;AAIO,SAAS,wBAAwB,OAAgB,OAAO,iBAAqD;AACnH,QAAM,OAAO,cAAc,OAAO,IAAI;AACtC,MAAI,KAAK,kBAAkB,GAAG;AAC7B,SAAK,GAAG,IAAI,kBAAkB,uBAAuB,KAAK,UAAU,KAAK,aAAa,CAAC,EAAE;AAAA,EAC1F;AACA,MAAI,CAAC,oBAAoB,KAAK,cAAc,KAAK,MAAM,GAAG,IAAI,OAAO,CAAC,GAAG;AACxE,SAAK,GAAG,IAAI,SAAS,gDAAgD;AAAA,EACtE;AACA,MAAI,CAAC,oBAAoB,KAAK,cAAc,KAAK,WAAW,GAAG,IAAI,YAAY,CAAC,GAAG;AAClF,SAAK,GAAG,IAAI,cAAc,gDAAgD;AAAA,EAC3E;AACA,MAAI,CAAC,sCAAsC,KAAK,cAAc,KAAK,SAAS,GAAG,IAAI,UAAU,CAAC,GAAG;AAChG,SAAK,GAAG,IAAI,YAAY,0BAA0B;AAAA,EACnD;AACA,MAAI,CAAC,iBAAiB,KAAK,cAAc,KAAK,gBAAgB,GAAG,IAAI,iBAAiB,CAAC,GAAG;AACzF,SAAK,GAAG,IAAI,mBAAmB,oCAAoC;AAAA,EACpE;AACA,MAAI,KAAK,WAAW,QAAW;AAC9B,UAAM,SAAS,cAAc,KAAK,QAAQ,GAAG,IAAI,SAAS;AAC1D,kBAAc,OAAO,OAAO,GAAG,IAAI,eAAe;AAClD,QAAI,CAAC,0CAA0C,KAAK,cAAc,OAAO,WAAW,GAAG,IAAI,mBAAmB,CAAC,GAAG;AACjH,WAAK,GAAG,IAAI,qBAAqB,6DAA0D;AAAA,IAC5F;AACA,UAAM,UAAU,cAAc,OAAO,SAAS,GAAG,IAAI,iBAAiB;AACtE,eAAW,CAAC,WAAW,UAAU,KAAK,OAAO,QAAQ,OAAO,GAAG;AAC9D,oBAAc,YAAY,GAAG,IAAI,mBAAmB,SAAS,EAAE;AAAA,IAChE;AAAA,EACD;AACA,QAAM,aAAa,cAAc,KAAK,YAAY,GAAG,IAAI,aAAa;AACtE,aAAW,CAAC,MAAM,UAAU,KAAK,OAAO,QAAQ,UAAU,GAAG;AAC5D,UAAM,gBAAgB,GAAG,IAAI,eAAe,IAAI;AAChD,QAAI,CAAC,oBAAoB,KAAK,IAAI,EAAG,MAAK,eAAe,+DAA+D;AACxH,UAAM,MAAM,cAAc,YAAY,aAAa;AACnD,QAAI,IAAI,eAAe,QAAW;AACjC,UAAI,CAAC,MAAM,QAAQ,IAAI,UAAU,EAAG,MAAK,GAAG,aAAa,eAAe,kBAAkB;AAC1F,iBAAW,QAAQ,IAAI,YAAyB;AAC/C,YAAI,OAAO,SAAS,YAAY,CAAC,KAAK,KAAK,EAAG,MAAK,GAAG,aAAa,eAAe,mCAAmC;AAAA,MACtH;AAAA,IACD;AACA,QAAI,IAAI,gBAAgB,QAAW;AAClC,UAAI;AAAE,sDAAyB,IAAI,aAAmC,GAAG,aAAa,cAAc;AAAA,MAAG,SAChG,OAAO;AAAE,aAAK,eAAe,iBAAiB,QAAQ,MAAM,UAAU,OAAO,KAAK,CAAC;AAAA,MAAG;AAAA,IAC9F;AACA,QAAI,IAAI,UAAU,QAAW;AAC5B,UAAI,CAAC,MAAM,QAAQ,IAAI,KAAK,EAAG,MAAK,GAAG,aAAa,UAAU,kBAAkB;AAChF,iBAAW,QAAQ,IAAI,OAAoB;AAC1C,YAAI,OAAO,SAAS,YAAY,CAAC,oBAAoB,KAAK,IAAI,EAAG,MAAK,GAAG,aAAa,UAAU,2DAA2D;AAAA,MAC5J;AAAA,IACD;AAAA,EACD;AACD;AAIO,SAAS,mBAAmB,OAAgB,OAAO,YAA2C;AACpG,QAAM,WAAW,cAAc,OAAO,IAAI;AAC1C,gBAAc,SAAS,IAAI,GAAG,IAAI,KAAK;AACvC,MAAI,SAAS,cAAc,OAAW,eAAc,SAAS,WAAW,GAAG,IAAI,YAAY;AAC3F,MAAI,SAAS,SAAS,QAAW;AAChC,QAAI,CAAC,oBAAoB,KAAK,cAAc,SAAS,MAAM,GAAG,IAAI,OAAO,CAAC,GAAG;AAC5E,WAAK,GAAG,IAAI,SAAS,gDAAgD;AAAA,IACtE;AAAA,EACD;AACA,MAAI,SAAS,YAAY,QAAW;AACnC,UAAM,UAAU,cAAc,SAAS,SAAS,GAAG,IAAI,UAAU;AACjE,QAAI,CAAC,QAAQ,WAAW,eAAe,EAAG,MAAK,GAAG,IAAI,YAAY,mCAAmC;AAAA,EACtG;AACA,MAAI,SAAS,UAAU,QAAW;AACjC,kBAAc,SAAS,OAAO,GAAG,IAAI,QAAQ;AAAA,EAC9C;AACA,MAAI,SAAS,YAAY,QAAW;AACnC,UAAM,UAAU,cAAc,SAAS,SAAS,GAAG,IAAI,UAAU;AACjE,eAAW,CAAC,MAAM,GAAG,KAAK,OAAO,QAAQ,OAAO,GAAG;AAClD,YAAM,aAAa,GAAG,IAAI,YAAY,IAAI;AAC1C,YAAM,YAAY,cAAc,KAAK,UAAU;AAC/C,oBAAc,UAAU,QAAQ,GAAG,UAAU,SAAS;AAAA,IACvD;AAAA,EACD;AACA,MAAI,SAAS,aAAa,QAAW;AACpC,UAAM,WAAW,aAAa,SAAS,UAAU,GAAG,IAAI,WAAW;AACnE,aAAS,QAAQ,CAAC,OAAO,UAAU,mBAAmB,OAAO,GAAG,IAAI,aAAa,KAAK,GAAG,CAAC;AAAA,EAC3F;AACD;AAIO,SAAS,mBAAmB,OAAgB,OAAO,YAA2C;AACpG,QAAM,WAAW,cAAc,OAAO,IAAI;AAC1C,MAAI,SAAS,kBAAkB,GAAG;AACjC,SAAK,GAAG,IAAI,kBAAkB,uBAAuB,KAAK,UAAU,SAAS,aAAa,CAAC,EAAE;AAAA,EAC9F;AACA,MAAI,CAAC,oBAAoB,KAAK,cAAc,SAAS,MAAM,GAAG,IAAI,OAAO,CAAC,GAAG;AAC5E,SAAK,GAAG,IAAI,SAAS,gDAAgD;AAAA,EACtE;AACA,MAAI,CAAC,sCAAsC,KAAK,cAAc,SAAS,SAAS,GAAG,IAAI,UAAU,CAAC,GAAG;AACpG,SAAK,GAAG,IAAI,YAAY,0BAA0B;AAAA,EACnD;AACA,qBAAmB,SAAS,MAAM,GAAG,IAAI,OAAO;AAChD,MAAI,SAAS,aAAa,QAAW;AACpC,iBAAa,SAAS,UAAU,GAAG,IAAI,WAAW,EAAE,QAAQ,CAAC,OAAO,UAAU;AAC7E,YAAM,cAAc,GAAG,IAAI,aAAa,KAAK;AAC7C,YAAM,UAAU,cAAc,OAAO,WAAW;AAChD,UAAI,CAAC,oBAAoB,KAAK,cAAc,QAAQ,IAAI,GAAG,WAAW,KAAK,CAAC,GAAG;AAC9E,aAAK,GAAG,WAAW,OAAO,gDAAgD;AAAA,MAC3E;AACA,UAAI,QAAQ,gBAAgB,OAAW,eAAc,QAAQ,aAAa,GAAG,WAAW,cAAc;AACtG,yBAAmB,QAAQ,MAAM,GAAG,WAAW,OAAO;AAAA,IACvD,CAAC;AAAA,EACF;AACA,QAAM,WAAW,cAAc,SAAS,UAAU,GAAG,IAAI,WAAW;AAIpE,0BAAwB,UAAU,GAAG,IAAI,WAAW;AACpD,MAAI,SAAS,uBAAuB,QAAW;AAC9C,UAAM,gBAAgB,oBAAI,IAAY;AACtC,iBAAa,SAAS,oBAAoB,GAAG,IAAI,qBAAqB,EAAE,QAAQ,CAAC,OAAO,UAAU;AACjG,YAAM,gBAAgB,GAAG,IAAI,uBAAuB,KAAK;AACzD,YAAM,YAAY,cAAc,OAAO,aAAa;AACpD,8BAAwB,WAAW,aAAa;AAGhD,YAAM,WAAW,GAAG,OAAO,UAAU,IAAI,CAAC,KAAS,OAAO,UAAU,OAAO,CAAC;AAC5E,UAAI,cAAc,IAAI,QAAQ,GAAG;AAChC,aAAK,eAAe,uBAAuB,OAAO,UAAU,IAAI,CAAC,IAAI,OAAO,UAAU,OAAO,CAAC,iBAAiB;AAAA,MAChH;AACA,oBAAc,IAAI,QAAQ;AAAA,IAC3B,CAAC;AAAA,EACF;AACA,eAAa,SAAS,gBAAgB,GAAG,IAAI,iBAAiB,EAAE,QAAQ,CAAC,OAAO,UAAU;AACzF,UAAM,OAAO,cAAc,OAAO,GAAG,IAAI,mBAAmB,KAAK,GAAG;AACpE,kBAAc,KAAK,MAAM,GAAG,IAAI,mBAAmB,KAAK,QAAQ;AAChE,kBAAc,KAAK,WAAW,GAAG,IAAI,mBAAmB,KAAK,aAAa;AAC1E,kBAAc,KAAK,OAAO,GAAG,IAAI,mBAAmB,KAAK,SAAS;AAAA,EACnE,CAAC;AACF;AASO,SAAS,8BACf,OACA,OAAO,UACoC;AAC3C,QAAM,SAAS,cAAc,OAAO,IAAI;AACxC,QAAM,QAAQ,aAAa,OAAO,OAAO,GAAG,IAAI,QAAQ;AACxD,QAAM,UAAU,aAAa,OAAO,SAAS,GAAG,IAAI,UAAU;AAC9D,aAAW,CAAC,OAAO,SAAS,KAAK,MAAM,QAAQ,GAAG;AACjD,UAAM,gBAAgB,GAAG,IAAI,UAAU,KAAK;AAC5C,QAAI,CAAC,mBAAmB,cAAc,WAAW,aAAa,CAAC,GAAG;AACjE,WAAK,eAAe,yCAAyC;AAAA,IAC9D;AAAA,EACD;AACA,aAAW,CAAC,OAAO,SAAS,KAAK,QAAQ,QAAQ,GAAG;AACnD,UAAM,gBAAgB,GAAG,IAAI,YAAY,KAAK;AAC9C,QAAI,CAAC,mBAAmB,cAAc,WAAW,aAAa,CAAC,GAAG;AACjE,WAAK,eAAe,yCAAyC;AAAA,IAC9D;AAAA,EACD;AACA,MAAI,OAAO,cAAc,QAAW;AACnC,UAAM,YAAY,cAAc,OAAO,WAAW,GAAG,IAAI,YAAY;AAIrE,UAAM,YAAY,OAAO,eAAe,SAAS;AACjD,QAAI,cAAc,OAAO,aAAa,cAAc,MAAM;AACzD,WAAK,GAAG,IAAI,cAAc,iGAAiG;AAAA,IAC5H;AACA,eAAW,CAAC,YAAY,QAAQ,KAAK,OAAO,QAAQ,SAAS,GAAG;AAC/D,YAAM,eAAe,GAAG,IAAI,cAAc,UAAU;AACpD,YAAM,SAAS,cAAc,UAAU,YAAY;AACnD,iBAAW,SAAS,CAAC,SAAS,SAAS,GAAY;AAClD,YAAI,OAAO,KAAK,MAAM,OAAW;AACjC,qBAAa,OAAO,KAAK,GAAG,GAAG,YAAY,IAAI,KAAK,EAAE,EAAE,QAAQ,CAAC,WAAW,UAAU;AACrF,gBAAM,gBAAgB,GAAG,YAAY,IAAI,KAAK,IAAI,KAAK;AACvD,cAAI,CAAC,mBAAmB,cAAc,WAAW,aAAa,CAAC,GAAG;AACjE,iBAAK,eAAe,yCAAyC;AAAA,UAC9D;AAAA,QACD,CAAC;AAAA,MACF;AAAA,IACD;AAAA,EACD;AACD;AAGO,SAAS,kBAAkB,OAAgB,OAAO,WAAyC;AACjG,QAAM,UAAU,cAAc,OAAO,IAAI;AACzC,MAAI,QAAQ,kBAAkB,GAAG;AAChC,SAAK,GAAG,IAAI,kBAAkB,uBAAuB,KAAK,UAAU,QAAQ,aAAa,CAAC,EAAE;AAAA,EAC7F;AACA,aAAW,SAAS,CAAC,iBAAiB,gBAAgB,GAAY;AACjE,QAAI,CAAC,iBAAiB,KAAK,cAAc,QAAQ,KAAK,GAAG,GAAG,IAAI,IAAI,KAAK,EAAE,CAAC,GAAG;AAC9E,WAAK,GAAG,IAAI,IAAI,KAAK,IAAI,oCAAoC;AAAA,IAC9D;AAAA,EACD;AACA,qBAAmB,QAAQ,UAAU,GAAG,IAAI,WAAW;AACvD,qBAAmB,QAAQ,UAAU,GAAG,IAAI,WAAW;AACvD,gCAA8B,QAAQ,QAAQ,GAAG,IAAI,SAAS;AAC9D,eAAa,QAAQ,gBAAgB,GAAG,IAAI,iBAAiB,EAAE,QAAQ,CAACA,QAAO,UAAU;AACxF,UAAM,WAAW,GAAG,IAAI,mBAAmB,KAAK;AAChD,UAAM,OAAO,cAAcA,QAAO,QAAQ;AAC1C,eAAW,SAAS,CAAC,QAAQ,WAAW,GAAY;AACnD,UAAI,CAAC,oBAAoB,KAAK,cAAc,KAAK,KAAK,GAAG,GAAG,QAAQ,IAAI,KAAK,EAAE,CAAC,GAAG;AAClF,aAAK,GAAG,QAAQ,IAAI,KAAK,IAAI,gDAAgD;AAAA,MAC9E;AAAA,IACD;AACA,QAAI,CAAC,sCAAsC;AAAA,MAC1C,cAAc,KAAK,SAAS,GAAG,QAAQ,UAAU;AAAA,IAClD,GAAG;AACF,WAAK,GAAG,QAAQ,YAAY,0BAA0B;AAAA,IACvD;AACA,UAAM,QAAQ,cAAc,KAAK,OAAO,GAAG,QAAQ,QAAQ;AAC3D,QAAI,KAAC,kCAAiB,KAAK,GAAG;AAC7B,WAAK,GAAG,QAAQ,UAAU,kCAAkC;AAAA,IAC7D;AACA,QAAI,CAAC,iBAAiB,KAAK,cAAc,KAAK,gBAAgB,GAAG,QAAQ,iBAAiB,CAAC,GAAG;AAC7F,WAAK,GAAG,QAAQ,mBAAmB,oCAAoC;AAAA,IACxE;AAAA,EACD,CAAC;AACF;AAGA,SAAS,wBAAwB,WAAoC,MAAoB;AACxF,MAAI,CAAC,oBAAoB,KAAK,cAAc,UAAU,MAAM,GAAG,IAAI,OAAO,CAAC,GAAG;AAC7E,SAAK,GAAG,IAAI,SAAS,gDAAgD;AAAA,EACtE;AACA,MAAI,CAAC,sCAAsC,KAAK,cAAc,UAAU,SAAS,GAAG,IAAI,UAAU,CAAC,GAAG;AACrG,SAAK,GAAG,IAAI,YAAY,0BAA0B;AAAA,EACnD;AACD;;;AElRA,IAAAC,mBAKO;AACP,4BAA4C;;;ACN5C,yBAA2B;AAa3B,SAAS,SAAS,OAAyB;AAC1C,MAAI,MAAM,QAAQ,KAAK,EAAG,QAAO,MAAM,IAAI,QAAQ;AACnD,MAAI,SAAS,OAAO,UAAU,UAAU;AACvC,WAAO,OAAO;AAAA,MACb,OAAO,QAAQ,KAAgC,EAC7C,KAAK,CAAC,CAAC,IAAI,GAAG,CAAC,KAAK,MAAO,OAAO,QAAQ,KAAK,OAAO,QAAQ,IAAI,CAAE,EACpE,IAAI,CAAC,CAAC,KAAK,KAAK,MAAM,CAAC,KAAK,SAAS,KAAK,CAAC,CAAC;AAAA,IAC/C;AAAA,EACD;AACA,SAAO;AACR;AAEA,SAAS,gBAAgB,OAAwB;AAChD,SAAO,KAAK,UAAU,SAAS,KAAK,CAAC;AACtC;AAaO,SAAS,wBACf,WAC2D;AAC3D,MAAI,CAAC,UAAW,QAAO,CAAC;AACxB,SAAO,OAAO;AAAA,IACb,OAAO,KAAK,SAAS,EACnB,KAAK,EACL,IAAI,CAAC,eAAe;AACpB,YAAM,WAAW,UAAU,UAAU;AACrC,aAAO,CAAC,YAAY;AAAA,QACnB,GAAI,SAAS,QAAQ,EAAE,OAAO,CAAC,GAAG,SAAS,KAAK,EAAE,KAAK,EAAE,IAAI,CAAC;AAAA,QAC9D,GAAI,SAAS,UAAU,EAAE,SAAS,CAAC,GAAG,SAAS,OAAO,EAAE,KAAK,EAAE,IAAI,CAAC;AAAA,MACrE,CAAC;AAAA,IACF,CAAC;AAAA,EACH;AACD;AAEO,SAAS,cACf,UACA,UACA,gBACA,QACA,gBACS;AACT,QAAMC,aAAY,gBAAgB;AAAA,IACjC,UAAU;AAAA,MACT,eAAe,SAAS;AAAA,MACxB,MAAM,SAAS;AAAA,MACf,SAAS,SAAS;AAAA,MAClB,MAAM,SAAS;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,MAMf,GAAI,SAAS,UAAU,SACpB;AAAA,QACD,UAAU,CAAC,GAAG,SAAS,QAAQ,EAAE,KAAK,CAAC,MAAM,UAC5C,KAAK,KAAK,MAAM,KAAK,KAAK,KAAK,KAAK,MAAM,KAAK,IAAI,CAAC;AAAA,MACtD,IACE,CAAC;AAAA,MACJ,UAAU,SAAS;AAAA;AAAA;AAAA;AAAA,MAInB,GAAI,SAAS,oBAAoB,SAC9B;AAAA,QACD,oBAAoB,CAAC,GAAG,SAAS,kBAAkB,EAAE,KAAK,CAAC,MAAM,UAAU;AAG1E,cAAI,KAAK,SAAS,MAAM,KAAM,QAAO,KAAK,OAAO,MAAM,OAAO,KAAK;AACnE,cAAI,KAAK,YAAY,MAAM,QAAS,QAAO,KAAK,UAAU,MAAM,UAAU,KAAK;AAC/E,iBAAO;AAAA,QACR,CAAC;AAAA,MACF,IACE,CAAC;AAAA,MACJ,gBAAgB,CAAC,GAAG,SAAS,cAAc,EAAE,KAAK,CAAC,GAA+B,MAAkC;AACnH,cAAM,MAAM,CAAC,MAAkC,GAAG,EAAE,SAAS,IAAI,EAAE,IAAI;AACvE,eAAO,IAAI,CAAC,IAAI,IAAI,CAAC,IAAI,KAAK,IAAI,CAAC,IAAI,IAAI,CAAC,IAAI,IAAI;AAAA,MACrD,CAAC;AAAA,IACF;AAAA,IACA,UAAU;AAAA,MACT,eAAe,SAAS;AAAA,MACxB,MAAM,SAAS;AAAA,MACf,SAAS,SAAS;AAAA,MAClB,QAAQ,SAAS;AAAA,IAClB;AAAA,IACA,gBAAgB,CAAC,GAAG,cAAc,EAAE,KAAK,CAAC,GAAG,MAAM;AAClD,YAAM,MAAM,CAAC,MAAiC,GAAG,EAAE,SAAS,IAAI,EAAE,IAAI;AACtE,aAAO,IAAI,CAAC,IAAI,IAAI,CAAC,IAAI,KAAK,IAAI,CAAC,IAAI,IAAI,CAAC,IAAI,IAAI;AAAA,IACrD,CAAC;AAAA,IACD,QAAQ;AAAA,MACP,OAAO,CAAC,GAAG,OAAO,KAAK,EAAE,KAAK;AAAA,MAC9B,SAAS,CAAC,GAAG,OAAO,OAAO,EAAE,KAAK;AAAA;AAAA;AAAA;AAAA,MAIlC,GAAI,OAAO,aAAa,OAAO,KAAK,OAAO,SAAS,EAAE,SACnD,EAAE,WAAW,wBAAwB,OAAO,SAAS,EAAE,IACvD,CAAC;AAAA,IACL;AAAA,IACA;AAAA,EACD,CAAC;AACD,aAAO,+BAAW,QAAQ,EAAE,OAAOA,UAAS,EAAE,OAAO,KAAK;AAC3D;AAOO,SAAS,qBACf,UACA,UACA,gBACA,QACA,gBACS;AACT,SAAO,cAAc,UAAU,UAAU,gBAAgB,QAAQ,cAAc;AAChF;AAGO,SAAS,2BAA2B,SAA4B;AACtE,oBAAkB,OAAO;AACzB,QAAM,WAAW;AAAA,IAChB,QAAQ;AAAA,IACR,QAAQ;AAAA,IACR,QAAQ;AAAA,IACR,QAAQ;AAAA,IACR,QAAQ;AAAA,EACT;AACA,MAAI,QAAQ,kBAAkB,UAAU;AACvC,UAAM,IAAI,MAAM,yEAAyE,QAAQ,IAAI;AAAA,EACtG;AACD;;;ACtJO,SAAS,gBACf,WACc;AACd,QAAM,QAAQ,oBAAI,IAAY;AAC9B,aAAW,YAAY,WAAW;AACjC,eAAW,QAAQ,SAAS,OAAO;AAClC,YAAM,IAAI,GAAG,SAAS,SAAS,IAAI,cAAc,KAAK,MAAM,SAAS,SAAS,CAAC,EAAE;AAAA,IAClF;AAAA,EACD;AACA,SAAO;AACR;AAEA,SAAS,cAAc,MAAc,WAA2B;AAC/D,SAAO,KAAK,WAAW,GAAG,SAAS,GAAG,IAAI,KAAK,MAAM,UAAU,SAAS,CAAC,IAAI;AAC9E;AAcO,SAAS,4BACf,WACA,cACA,KACO;AACP,QAAM,cAAc,oBAAI,IAAsB;AAC9C,aAAW,YAAY,WAAW;AACjC,eAAW,QAAQ,SAAS,OAAO;AAClC,YAAM,YAAY,gBAAgB,SAAS,SAAS,IAAI,cAAc,KAAK,MAAM,SAAS,SAAS,CAAC;AACpG,UAAI,CAAC,aAAa,IAAI,SAAS,EAAG;AAClC,kBAAY,IAAI,WAAW,CAAC,GAAI,YAAY,IAAI,SAAS,KAAK,CAAC,GAAI,GAAG,KAAK,IAAI,IAAI,KAAK,OAAO,EAAE,CAAC;AAAA,IACnG;AAAA,EACD;AACA,aAAW,CAAC,WAAW,YAAY,KAAK,aAAa;AACpD,QAAI,aAAa,SAAS,GAAG;AAC5B;AAAA,QAAI;AAAA,QAAkC,gBAAgB,SAAS;AAAA,QAC9D,IAAI,SAAS,8BAA8B,aAAa,MAAM,WAAW,aAAa,KAAK,IAAI,CAAC;AAAA,MAA4C;AAAA,IAC9I;AAAA,EACD;AACD;AAEO,SAAS,wBACf,WACA,KACA,gBACc;AACd,QAAM,UAAU,oBAAI,IAAY;AAIhC,QAAM,cAAc,oBAAI,IAAsB;AAC9C,aAAW,YAAY,WAAW;AACjC,UAAM,aAAa,SAAS,aAAa,sBAAsB;AAG/D,eAAW,UAAU,YAAY,iBAAiB,CAAC,GAAG;AAGrD,YAAMC,aAAY,OAAO,KAAK,WAAW,GAAG,SAAS,SAAS,GAAG,IAC9D,OAAO,KAAK,MAAM,SAAS,UAAU,SAAS,CAAC,IAC/C,OAAO;AACV,YAAM,YAAY,GAAG,SAAS,SAAS,IAAIA,UAAS;AACpD,UAAI,mBAAmB,UAAa,eAAe,IAAI,gBAAgB,SAAS,EAAE,GAAG;AACpF,oBAAY,IAAI,WAAW,CAAC,GAAI,YAAY,IAAI,SAAS,KAAK,CAAC,GAAI,OAAO,IAAI,CAAC;AAAA,MAChF;AACA,cAAQ,IAAI,SAAS;AAAA,IACtB;AAAA,EACD;AACA,aAAW,CAAC,WAAW,YAAY,KAAK,aAAa;AACpD,QAAI,aAAa,SAAS,GAAG;AAC5B;AAAA,QAAM;AAAA,QAAkC,2BAA2B,SAAS;AAAA,QAC3E,iBAAiB,SAAS,iBAAiB,aAAa,MAAM,WAAW,aAAa,KAAK,IAAI,CAAC;AAAA,MAAyC;AAAA,IAC3I;AAAA,EACD;AACA,SAAO;AACR;AAEO,SAAS,uBACf,YACA,MACc;AACd,QAAM,UAAU,oBAAI,IAAY;AAChC,aAAW,CAAC,OAAO,SAAS,KAAK,WAAW,QAAQ,GAAG;AACtD,UAAM,gBAAgB,GAAG,IAAI,IAAI,KAAK;AACtC,QAAI,CAAC,mBAAmB,SAAS,GAAG;AACnC,WAAK,eAAe,yCAAyC;AAAA,IAC9D;AACA,YAAQ,IAAI,SAAS;AAAA,EACtB;AACA,SAAO;AACR;AAEO,SAAS,iCACf,WACA,KACO;AACP,aAAW,YAAY,WAAW;AACjC,UAAM,aAAa,SAAS,aAAa,sBAAsB;AAG/D,UAAM,UAAU,IAAI,IAAI,SAAS,QAAQ,IAAI,CAAC,WAAW,OAAO,QAAQ,CAAC;AACzE,eAAW,CAAC,OAAO,MAAM,MAAM,YAAY,iBAAiB,CAAC,GAAG,QAAQ,GAAG;AAC1E,UAAI,CAAC,QAAQ,IAAI,OAAO,QAAQ,GAAG;AAClC;AAAA,UACC;AAAA,UACA,aAAa,SAAS,SAAS,kBAAkB,KAAK;AAAA,UACtD,WAAW,OAAO,IAAI,wBAAwB,OAAO,QAAQ;AAAA,QAC9D;AAAA,MACD;AAAA,IACD;AAAA,EACD;AACD;;;ACvHA,IAAM,iBAAiB;AAmBhB,SAAS,qBAAqB,OAA4C;AAChF,SACC,UAAU,QACV,OAAO,UAAU,YACjB,CAAC,MAAM,QAAQ,KAAK,KACpB,OAAQ,MAA4B,SAAS,YAC5C,MAA4B,KAAK,WAAW,eAAe;AAE9D;AAOA,SAAS,aAAa,SAA8B,UAA8D;AACjH,MAAI,aAAa,OAAW,QAAO;AACnC,SAAO,IAAI,IAAI,SAAS,OAAO,CAAC,cAAc,QAAQ,IAAI,SAAS,CAAC,CAAC;AACtE;AAEO,SAAS,aAAa,UAAwB,MAAc,SAAoC;AAEtG,QAAM,WAAW,QAAQ,gBAAgB,IAAI,SAAS,EAAE;AACxD,QAAM,SAA8B,WACjC;AAAA,IACD,GAAG;AAAA,IACH,cAAc,aAAa,QAAQ,cAAc,SAAS,KAAK;AAAA,IAC/D,gBAAgB,aAAa,QAAQ,gBAAgB,SAAS,OAAO;AAAA,EACtE,IACE;AAGH,MAAI,OAAO,IAAI,IAAI,SAAS,EAAE,GAAG;AAChC,WAAO,IAAI,yBAAyB,GAAG,IAAI,OAAO,gBAAgB,SAAS,EAAE,8BAA8B;AAAA,EAC5G,OAAO;AACN,WAAO,IAAI,IAAI,SAAS,EAAE;AAAA,EAC3B;AAGA,MAAI,SAAS,cAAc,QAAW;AACrC,UAAM,YAAY,SAAS,UAAU,QAAQ,GAAG;AAChD,QAAI,cAAc,IAAI;AACrB,UAAI,CAAC,OAAO,eAAe,IAAI,SAAS,SAAS,GAAG;AACnD,eAAO;AAAA,UAAI;AAAA,UAAqB,GAAG,IAAI;AAAA,UACtC,cAAc,SAAS,SAAS;AAAA,QAAmD;AAAA,MACrF;AAAA,IACD,WAAW,CAAC,OAAO,gBAAgB,IAAI,SAAS,SAAS,GAAG;AAC3D,aAAO;AAAA,QAAI;AAAA,QAAqB,GAAG,IAAI;AAAA,QACtC,cAAc,SAAS,SAAS;AAAA,MAAyC;AAAA,IAC3E;AAAA,EACD;AAGA,MAAI,SAAS,YAAY,QAAW;AACnC,UAAM,MAAM,mBAAmB,SAAS,OAAO;AAC/C,QAAI,CAAC,KAAK;AACT,aAAO;AAAA,QAAI;AAAA,QAAyB,GAAG,IAAI;AAAA,QAC1C,IAAI,SAAS,OAAO;AAAA,MAA+C;AAAA,IACrE,WAAW,CAAC,OAAO,WAAW,IAAI,GAAG,IAAI,SAAS,IAAI,IAAI,IAAI,EAAE,GAAG;AAClE,aAAO;AAAA,QAAI;AAAA,QAAyB,GAAG,IAAI;AAAA,QAC1C,6BAA6B,SAAS,OAAO;AAAA,MAAuC;AAAA,IACtF,WAAW,CAAC,OAAO,aAAa,IAAI,SAAS,OAAO,GAAG;AACtD,aAAO;AAAA,QAAI;AAAA,QAAmB,GAAG,IAAI;AAAA,QACpC,6BAA6B,SAAS,OAAO;AAAA,MAAsD;AAAA,IACrG;AAAA,EACD;AAGA,aAAW,CAAC,MAAM,SAAS,KAAK,OAAO,QAAQ,SAAS,WAAW,CAAC,CAAC,GAAG;AACvE,UAAM,aAAa,GAAG,IAAI,YAAY,IAAI;AAC1C,UAAM,MAAM,mBAAmB,UAAU,MAAM;AAC/C,QAAI,CAAC,KAAK;AACT,aAAO;AAAA,QAAI;AAAA,QAAmB,GAAG,UAAU;AAAA,QAC1C,WAAW,IAAI,aAAa,UAAU,MAAM;AAAA,MAAwE;AACrH;AAAA,IACD;AACA,QAAI,CAAC,OAAO,aAAa,IAAI,GAAG,IAAI,SAAS,IAAI,IAAI,IAAI,EAAE,GAAG;AAC7D,aAAO;AAAA,QAAI;AAAA,QAAmB,GAAG,UAAU;AAAA,QAC1C,WAAW,IAAI,wBAAwB,UAAU,MAAM;AAAA,MAAsC;AAAA,IAC/F,WAAW,CAAC,OAAO,eAAe,IAAI,UAAU,MAAM,GAAG;AACxD,aAAO;AAAA,QAAI;AAAA,QAAqB,GAAG,UAAU;AAAA,QAC5C,WAAW,IAAI,wBAAwB,UAAU,MAAM;AAAA,MAAsD;AAAA,IAC/G;AACA,QAAI,UAAU,WAAW,QAAW;AACnC,sBAAgB,UAAU,QAAQ,GAAG,UAAU,WAAW,MAAM;AAAA,IACjE;AAAA,EACD;AAGA,MAAI,SAAS,UAAU,QAAW;AACjC,oBAAgB,SAAS,OAAO,GAAG,IAAI,UAAU,MAAM;AAAA,EACxD;AAGA,MAAI,SAAS,aAAa,QAAW;AACpC,aAAS,SAAS,QAAQ,CAAC,OAAO,UAAU;AAC3C,mBAAa,OAAO,GAAG,IAAI,aAAa,KAAK,KAAK,MAAM;AAAA,IACzD,CAAC;AAAA,EACF;AACD;AAUO,SAAS,WAAW,OAA0B,MAAc,SAA8B,QAAQ,GAAS;AACjH,MAAI,QAAQ,gBAAgB;AAC3B,YAAQ;AAAA,MAAI;AAAA,MAAoB;AAAA,MAC/B,wBAAwB,cAAc;AAAA,IAAkE;AACzG;AAAA,EACD;AACA,MAAI,qBAAqB,KAAK,GAAG;AAChC,UAAM,MAAM,mBAAmB,MAAM,IAAI;AACzC,QAAI,CAAC,KAAK;AACT,cAAQ;AAAA,QAAI;AAAA,QAAyB,GAAG,IAAI;AAAA,QAC3C,IAAI,MAAM,IAAI;AAAA,MAA+C;AAAA,IAC/D,WAAW,CAAC,QAAQ,WAAW,IAAI,GAAG,IAAI,SAAS,IAAI,IAAI,IAAI,EAAE,GAAG;AACnE,cAAQ;AAAA,QAAI;AAAA,QAAyB,GAAG,IAAI;AAAA,QAC3C,yBAAyB,MAAM,IAAI;AAAA,MAAuC;AAAA,IAC5E,WAAW,CAAC,QAAQ,aAAa,IAAI,MAAM,IAAI,GAAG;AACjD,cAAQ;AAAA,QAAI;AAAA,QAAmB,GAAG,IAAI;AAAA,QACrC,yBAAyB,MAAM,IAAI;AAAA,MAAsD;AAAA,IAC3F;AAGA,eAAW,CAAC,KAAK,OAAO,KAAK,OAAO,QAAQ,KAAK,GAAG;AACnD,UAAI,QAAQ,OAAQ;AACpB,iBAAW,SAA8B,GAAG,IAAI,IAAI,GAAG,IAAI,SAAS,QAAQ,CAAC;AAAA,IAC9E;AACA;AAAA,EACD;AACA,MAAI,MAAM,QAAQ,KAAK,GAAG;AACzB,UAAM,QAAQ,CAAC,MAAM,UAAU,WAAW,MAAM,GAAG,IAAI,IAAI,KAAK,KAAK,SAAS,QAAQ,CAAC,CAAC;AACxF;AAAA,EACD;AACA,MAAI,UAAU,QAAQ,OAAO,UAAU,UAAU;AAChD,oBAAgB,OAA4C,MAAM,SAAS,QAAQ,CAAC;AAAA,EACrF;AACD;AAEO,SAAS,gBAAgB,OAA0C,MAAc,SAA8B,QAAQ,GAAS;AACtI,aAAW,CAAC,KAAK,KAAK,KAAK,OAAO,QAAQ,KAAK,GAAG;AACjD,eAAW,OAAO,GAAG,IAAI,IAAI,GAAG,IAAI,SAAS,KAAK;AAAA,EACnD;AACD;;;AHtIO,SAAS,oBAAoB,OAAkD;AAErF,MAAI,CAAC,MAAM,SAAU,OAAM,IAAI,MAAM,mEAAmE;AACxG,qBAAmB,MAAM,QAAQ;AACjC,qBAAmB,MAAM,QAAQ;AACjC,aAAW,QAAQ,MAAM,eAAgB,yBAAwB,IAAI;AACrE,aAAW,YAAY,MAAM,UAAW,wDAA4B,QAAQ;AAC5E,gCAA8B,MAAM,MAAM;AAC1C,+CAAuB,MAAM,QAAQ;AACrC,QAAM,YAAY,MAAM,UAAU,IAAI,CAAC,aAAa,SAAS,UAAU;AAEvE,QAAM,WAA0B,CAAC;AACjC,QAAM,MAAM,CAAC,MAAuB,MAAc,YAA0B;AAC3E,aAAS,KAAK,EAAE,MAAM,MAAM,QAAQ,CAAC;AAAA,EACtC;AAMA,QAAM,sBAAsB,CAAC,MAAM,SAAS,UAAU,GAAI,MAAM,SAAS,sBAAsB,CAAC,CAAE;AAClG,QAAM,kBAAkB,oBAAoB,KAAK,CAAC,cACjD,UAAU,SAAS,MAAM,SAAS,QAAQ,UAAU,YAAY,MAAM,SAAS,OAAO;AACvF,MAAI,CAAC,iBAAiB;AACrB;AAAA,MAAI;AAAA,MAAqB;AAAA,MACxB,iCAAiC,oBAAoB,IAAI,CAAC,QAAQ,GAAG,IAAI,IAAI,IAAI,IAAI,OAAO,EAAE,EAAE,KAAK,IAAI,CAAC,8BAA8B,MAAM,SAAS,IAAI,IAAI,MAAM,SAAS,OAAO;AAAA,IAAG;AAAA,EAC1L;AAGA,QAAM,aAAa,oBAAI,IAAiC;AACxD,aAAW,QAAQ,MAAM,gBAAgB;AACxC,UAAM,MAAM,GAAG,KAAK,SAAS,IAAI,KAAK,IAAI;AAC1C,UAAM,OAAO,WAAW,IAAI,GAAG,KAAK,CAAC;AACrC,SAAK,KAAK,IAAI;AACd,eAAW,IAAI,KAAK,IAAI;AAAA,EACzB;AAEA,QAAM,gBAA6C,CAAC;AACpD,QAAM,0BAA+C,CAAC;AACtD,aAAW,OAAO,MAAM,SAAS,gBAAgB;AAChD,UAAM,MAAM,GAAG,IAAI,SAAS,IAAI,IAAI,IAAI;AACxC,UAAM,YAAY,WAAW,IAAI,GAAG,KAAK,CAAC;AAC1C,UAAM,YAAQ,mCAAiB,IAAI,KAAK;AACxC,QAAI,CAAC,OAAO;AACX;AAAA,QAAI;AAAA,QAAqB,2BAA2B,GAAG;AAAA,QACtD,iCAAiC,GAAG,sBAAsB,IAAI,KAAK;AAAA,MAAG;AACvE;AAAA,IACD;AACA,UAAM,sBAAkB,sCAAoB,OAAO,UAAU,IAAI,CAAC,SAAS,KAAK,OAAO,CAAC;AACxF,QAAI,CAAC,iBAAiB;AACrB;AAAA,QAAI;AAAA,QAAqB,2BAA2B,GAAG;AAAA,QACtD,iCAAiC,GAAG,sBAAsB,IAAI,KAAK;AAAA,MAAG;AACvE;AAAA,IACD;AACA,UAAM,WAAW,UAAU,KAAK,CAAC,SAAS,KAAK,YAAY,eAAe;AAC1E,4BAAwB,KAAK,QAAQ;AACrC,kBAAc,KAAK;AAAA,MAClB,MAAM,SAAS;AAAA,MACf,WAAW,SAAS;AAAA,MACpB,SAAS,SAAS;AAAA,MAClB,OAAO,IAAI;AAAA,MACX,gBAAgB,SAAS;AAAA,MACzB,GAAI,SAAS,SAAS,EAAE,QAAQ,SAAS,OAAO,IAAI,CAAC;AAAA,IACtD,CAAC;AAAA,EACF;AAGA;AACC,eAAW,QAAQ,eAAe;AACjC,YAAM,WAAW,MAAM,SAAS,eAAe;AAAA,QAAK,CAAC,cACpD,UAAU,cAAc,KAAK,aAC7B,UAAU,SAAS,KAAK,QACxB,UAAU,YAAY,KAAK,WAC3B,UAAU,mBAAmB,KAAK;AAAA,MACnC;AACA,UAAI,CAAC,UAAU;AACd;AAAA,UAAI;AAAA,UAAkC,kBAAkB,KAAK,SAAS,IAAI,KAAK,IAAI;AAAA,UAClF,SAAS,KAAK,SAAS,IAAI,KAAK,IAAI,IAAI,KAAK,OAAO,2BAA2B,KAAK,cAAc,yBAAyB,MAAM,SAAS,cAAc;AAAA,QAAG;AAC5J;AAAA,MACD;AAKA,YAAM,iBAAiB,wBAAwB,KAAK,CAAC,eACpD,WAAW,cAAc,KAAK,aAC9B,WAAW,SAAS,KAAK,QACzB,WAAW,YAAY,KAAK,WAC5B,WAAW,mBAAmB,KAAK,cAAc,GAAG;AACrD,YAAM,aAAa,kBAAkB,KAAK,SAAS,IAAI,KAAK,IAAI;AAChE,UAAI,kBAAkB,CAAC,SAAS,QAAQ;AACvC;AAAA,UAAI;AAAA,UAAqB;AAAA,UACxB,SAAS,KAAK,SAAS,IAAI,KAAK,IAAI,yDAAyD,MAAM,SAAS,cAAc;AAAA,QAAkB;AAAA,MAC9I,WAAW,kBAAkB,SAAS,QAAQ;AAC7C,YAAI,eAAe,UAAU,SAAS,OAAO,OAAO;AACnD;AAAA,YAAI;AAAA,YAAqB,GAAG,UAAU;AAAA,YACrC,iBAAiB,eAAe,KAAK,sCAAsC,SAAS,OAAO,KAAK;AAAA,UAAG;AAAA,QACrG;AACA,YAAI,eAAe,cAAc,SAAS,OAAO,WAAW;AAC3D;AAAA,YAAI;AAAA,YAAqB,GAAG,UAAU;AAAA,YACrC,qBAAqB,eAAe,SAAS,0CAA0C,SAAS,OAAO,SAAS;AAAA,UAAG;AAAA,QACrH;AACA,YAAI,iBAAiB,eAAe,OAAO,MAAM,iBAAiB,SAAS,OAAO,OAAO,GAAG;AAC3F;AAAA,YAAI;AAAA,YAAqB,GAAG,UAAU;AAAA,YACrC;AAAA,UAAwD;AAAA,QAC1D;AAAA,MACD,WAAW,CAAC,kBAAkB,SAAS,QAAQ;AAC9C;AAAA,UAAI;AAAA,UAAqB;AAAA,UACxB,aAAa,MAAM,SAAS,cAAc,mCAAmC,KAAK,SAAS,IAAI,KAAK,IAAI;AAAA,QAAwC;AAAA,MAClJ;AAAA,IACD;AACA,eAAW,YAAY,MAAM,WAAW;AACvC,YAAM,WAAW,MAAM,SAAS,aAAa;AAAA,QAAK,CAAC,eAClD,WAAW,cAAc,SAAS,WAAW,aAC7C,WAAW,4BAAwB,qDAAmC,QAAQ;AAAA,MAC/E;AACA,UAAI,CAAC,UAAU;AACd;AAAA,UAAI;AAAA,UAAuC,aAAa,SAAS,WAAW,SAAS;AAAA,UACpF,aAAa,SAAS,WAAW,SAAS,wEAAwE,MAAM,SAAS,cAAc;AAAA,QAAG;AAAA,MACpJ;AAAA,IACD;AAAA,EACD;AAGA,QAAM,kBAAkB,oBAAI,IAAY;AACxC,aAAW,QAAQ,yBAAyB;AAC3C,eAAW,QAAQ,OAAO,KAAK,KAAK,UAAU,GAAG;AAChD,sBAAgB,IAAI,GAAG,KAAK,SAAS,IAAI,IAAI,EAAE;AAAA,IAChD;AAAA,EACD;AACA,QAAM,iBAAiB,IAAI,IAAI,MAAM,kBAAkB,CAAC,CAAC;AAGzD,QAAM,aAAa,gBAAgB,SAAS;AAC5C,QAAM,eAAe,uBAAuB,MAAM,OAAO,OAAO,cAAc;AAC9E,QAAM,iBAAiB,uBAAuB,MAAM,OAAO,SAAS,gBAAgB;AACpF,QAAM,eAAe,wBAAwB,WAAW,KAAK,cAAc;AAK3E,8BAA4B,WAAW,cAAc,GAAG;AAGxD,QAAM,qBAAqB,oBAAI,IAAY;AAC3C,aAAW,YAAY,WAAW;AACjC,QAAI,mBAAmB,IAAI,SAAS,SAAS,GAAG;AAC/C;AAAA,QAAI;AAAA,QAAkC,aAAa,SAAS,SAAS;AAAA,QACpE,iBAAiB,SAAS,SAAS;AAAA,MAA8B;AAAA,IACnE;AACA,uBAAmB,IAAI,SAAS,SAAS;AAAA,EAC1C;AAGA,mCAAiC,WAAW,GAAG;AAM/C,QAAM,iBAAiB,oBAAI,IAAwE;AACnG,aAAW,CAAC,YAAY,QAAQ,KAAK,OAAO,QAAQ,MAAM,OAAO,aAAa,CAAC,CAAC,GAAG;AAClF,eAAW,QAAQ,SAAS,SAAS,CAAC,GAAG;AACxC,UAAI,CAAC,aAAa,IAAI,IAAI,GAAG;AAC5B;AAAA,UAAI;AAAA,UAAkC,oBAAoB,UAAU;AAAA,UACnE,aAAa,UAAU,sBAAsB,IAAI;AAAA,QAA4C;AAAA,MAC/F;AAAA,IACD;AACA,eAAW,UAAU,SAAS,WAAW,CAAC,GAAG;AAC5C,UAAI,CAAC,eAAe,IAAI,MAAM,GAAG;AAChC;AAAA,UAAI;AAAA,UAAkC,oBAAoB,UAAU;AAAA,UACnE,aAAa,UAAU,wBAAwB,MAAM;AAAA,QAA4C;AAAA,MACnG;AAAA,IACD;AACA,mBAAe,IAAI,YAAY,QAAQ;AAAA,EACxC;AAKA,QAAM,WAAW,CAAC,MAAkC,SAAuB;AAC1E,iBAAa,MAAM,MAAM;AAAA,MACxB,KAAK,oBAAI,IAAI;AAAA,MACb;AAAA,MACA;AAAA,MACA;AAAA,MACA;AAAA,MACA;AAAA,MACA;AAAA,MACA;AAAA,MACA;AAAA,MACA;AAAA,IACD,CAAC;AAAA,EACF;AAEA,WAAS,MAAM,SAAS,MAAM,eAAe;AAE7C,QAAM,iBAAiB,oBAAI,IAAY;AACvC,GAAC,MAAM,SAAS,YAAY,CAAC,GAAG,QAAQ,CAAC,SAAS,UAAU;AAC3D,QAAI,eAAe,IAAI,QAAQ,EAAE,GAAG;AACnC;AAAA,QAAI;AAAA,QAAwB,qBAAqB,KAAK;AAAA,QACrD,eAAe,QAAQ,EAAE;AAAA,MAA8B;AAAA,IACzD,OAAO;AACN,qBAAe,IAAI,QAAQ,EAAE;AAAA,IAC9B;AACA,aAAS,QAAQ,MAAM,qBAAqB,KAAK,QAAQ;AAAA,EAC1D,CAAC;AAGD,MAAI,SAAS,SAAS,GAAG;AACxB,WAAO,EAAE,OAAO,OAAO,UAAU,SAAS,OAAU;AAAA,EACrD;AAEA,QAAM,UAAuB;AAAA,IAC5B,eAAe;AAAA,IACf,eAAe;AAAA,MACd,MAAM;AAAA,MACN,MAAM;AAAA,MACN;AAAA,MACA,MAAM;AAAA,MACN,MAAM,SAAS;AAAA,IAChB;AAAA,IACA,gBAAgB,MAAM,SAAS;AAAA,IAC/B,UAAU,MAAM;AAAA,IAChB,UAAU,MAAM;AAAA,IAChB,gBAAgB,CAAC,GAAG,aAAa,EAAE,KAAK,CAAC,GAAG,MAAM;AACjD,YAAM,MAAM,CAAC,MAAiC,GAAG,EAAE,SAAS,IAAI,EAAE,IAAI;AACtE,aAAO,IAAI,CAAC,IAAI,IAAI,CAAC,IAAI,KAAK,IAAI,CAAC,IAAI,IAAI,CAAC,IAAI,IAAI;AAAA,IACrD,CAAC;AAAA,IACD,QAAQ;AAAA,MACP,OAAO,CAAC,GAAG,MAAM,OAAO,KAAK,EAAE,KAAK;AAAA,MACpC,SAAS,CAAC,GAAG,MAAM,OAAO,OAAO,EAAE,KAAK;AAAA,MACxC,GAAI,MAAM,OAAO,YAAY,EAAE,WAAW,wBAAwB,MAAM,OAAO,SAAS,EAAE,IAAI,CAAC;AAAA,IAChG;AAAA,EACD;AAEA,SAAO,EAAE,OAAO,MAAM,UAAU,CAAC,GAAG,QAAQ;AAC7C;AAMO,SAAS,uBAAuB,OAAyC;AAC/E,QAAM,SAAS,oBAAoB,KAAK;AACxC,MAAI,OAAO,MAAO,QAAO,OAAO;AAChC,QAAM,IAAI,MAAM;AAAA,IACf,iBAAiB,MAAM,SAAS,IAAI,IAAI,MAAM,SAAS,OAAO;AAAA,IAC9D,GAAG,OAAO,SAAS,IAAI,CAAC,YAAY,QAAQ,QAAQ,IAAI,KAAK,QAAQ,IAAI,KAAK,QAAQ,OAAO,EAAE;AAAA,EAChG,EAAE,KAAK,IAAI,CAAC;AACb;AAIA,SAAS,iBAAiB,SAAyC;AAClE,SAAO,KAAK;AAAA,IACX,OAAO,KAAK,OAAO,EAAE,KAAK,EAAE,IAAI,CAAC,cAAc,CAAC,WAAW,QAAQ,SAAS,CAAC,CAAC;AAAA,EAC/E;AACD;;;AIpQO,SAAS,kBAAkB,IAAY,gBAAgD;AAC7F,SAAO;AAAA,IACN;AAAA,IACA;AAAA,IACA,QAAQ,SAAS;AAChB,iCAA2B,OAAO;AAClC,YAAM,OAAO,sBAAsB,QAAQ,SAAS,IAAI;AACxD,iBAAW,WAAW,QAAQ,SAAS,YAAY,CAAC,GAAG;AACtD,mBAAW,aAAa,sBAAsB,QAAQ,IAAI,EAAG,MAAK,IAAI,SAAS;AAAA,MAChF;AACA,YAAM,UAAU,CAAC,GAAG,IAAI,EAAE,OAAO,CAAC,cAAc,CAAC,eAAe,SAAS,SAAS,CAAC;AACnF,aAAO;AAAA,QACN;AAAA,QACA,YAAY,QAAQ,WAAW;AAAA,QAC/B,uBAAuB;AAAA,MACxB;AAAA,IACD;AAAA,EACD;AACD;AAEA,SAAS,sBAAsB,UAAqC;AACnE,QAAM,OAAO,oBAAI,IAAY;AAC7B,MAAI,SAAS,cAAc,UAAa,CAAC,SAAS,UAAU,SAAS,GAAG,GAAG;AAC1E,SAAK,IAAI,SAAS,SAAS;AAAA,EAC5B;AACA,MAAI,SAAS,aAAa,QAAW;AACpC,eAAW,SAAS,SAAS,UAAU;AACtC,iBAAW,aAAa,sBAAsB,KAAK,EAAG,MAAK,IAAI,SAAS;AAAA,IACzE;AAAA,EACD;AACA,SAAO;AACR;AA0CA,eAAe,cAAc,KAAoB,QAAwC;AACxF,MAAI;AACH,UAAM,IAAI;AACV,WAAO;AAAA,EACR,SAAS,OAAO;AACf,UAAM,UAAU,iBAAiB,QAAQ,MAAM,UAAU,OAAO,KAAK;AACrE,WAAO,OAAO,KAAK,OAAO,IAAI,UAAU;AAAA,EACzC;AACD;AAWO,SAAS,oBAAiD;AAChE,SAAO;AAAA,IACN;AAAA,MACC,IAAI;AAAA,MACJ,MAAM,IAAI,SAAS;AAClB,mCAA2B,QAAQ,YAAY;AAC/C,cAAM,SAAS,QAAQ,QAAQ,QAAQ,QAAQ,YAAY;AAC3D,YAAI,OAAO,QAAQ,kBAAkB,QAAQ,aAAa,eAAe;AACxE,gBAAM,IAAI,MAAM,4DAA4D;AAAA,QAC7E;AACA,eAAO,CAAC,QAAQ,aAAa,aAAa;AAAA,MAC3C;AAAA,IACD;AAAA,IACA;AAAA,MACC,IAAI;AAAA,MACJ,MAAM,IAAI,SAAS;AAElB,cAAM,WAAW;AAAA,UAChB,GAAG,QAAQ;AAAA,UACX,UAAU,EAAE,GAAG,QAAQ,aAAa,UAAU,MAAM,GAAG,QAAQ,aAAa,SAAS,IAAI,YAAY;AAAA,QACtG;AACA,cAAM,SAAS,MAAM,cAAc,MAAM,QAAQ,QAAQ,QAAQ,QAAQ,GAAG,mBAAmB;AAC/F,YAAI,WAAW,MAAM;AACpB,gBAAM,IAAI,MAAM,gGAAgG;AAAA,QACjH;AAIA,mBAAW,CAAC,OAAO,MAAM,KAAK;AAAA,UAC7B,CAAC,WAAW,CAAC,aAA0B,EAAE,GAAG,SAAS,UAAU,EAAE,GAAG,QAAQ,UAAU,SAAS,QAAQ,EAAE,EAAE;AAAA,UAC3G,CAAC,UAAU,CAAC,aAA0B,EAAE,GAAG,SAAS,QAAQ,EAAE,GAAG,QAAQ,QAAQ,OAAO,CAAC,GAAG,QAAQ,OAAO,OAAO,4BAA4B,EAAE,EAAE,EAAE;AAAA,UACpJ,CAAC,YAAY,CAAC,aAA0B,EAAE,GAAG,SAAS,gBAAgB,IAAI,OAAO,EAAE,EAAE,EAAE;AAAA,QACxF,GAAY;AACX,gBAAM,SAAS,OAAO,QAAQ,YAAY;AAC1C,cAAK,MAAM,cAAc,MAAM,QAAQ,QAAQ,QAAQ,MAAM,GAAG,mBAAmB,MAAO,MAAM;AAC/F,kBAAM,IAAI,MAAM,oCAAoC,KAAK,6BAA6B;AAAA,UACvF;AAAA,QACD;AACA,eAAO,CAAC,6BAA6B,6CAA6C;AAAA,MACnF;AAAA,IACD;AAAA,IACA;AAAA,MACC,IAAI;AAAA,MACJ,MAAM,IAAI,SAAS;AAElB,cAAM,WAAW;AACjB,cAAM,aAAa,EAAE,UAAU,QAAQ,aAAa,SAAS;AAC7D,YAAK,MAAM,cAAc,MAAM,QAAQ,QAAQ,QAAQ,UAAU,GAAG,QAAQ,MAAO,MAAM;AACxF,gBAAM,IAAI,MAAM,+FAA+F;AAAA,QAChH;AACA,cAAM,aAAa,EAAE,GAAG,QAAQ,cAAc,eAAe,OAAU;AACvE,YAAK,MAAM,cAAc,MAAM,QAAQ,QAAQ,QAAQ,UAAU,GAAG,QAAQ,MAAO,MAAM;AACxF,gBAAM,IAAI,MAAM,oFAAoF;AAAA,QACrG;AACA,eAAO,CAAC,yBAAyB,4BAA4B;AAAA,MAC9D;AAAA,IACD;AAAA,IACA;AAAA,MACC,IAAI;AAAA,MACJ,MAAM,IAAI,SAAS;AAKlB,cAAM,OAAO,sBAAsB,QAAQ,aAAa,SAAS,IAAI;AACrE,mBAAW,WAAW,QAAQ,aAAa,SAAS,YAAY,CAAC,GAAG;AACnE,qBAAW,aAAa,sBAAsB,QAAQ,IAAI,EAAG,MAAK,IAAI,SAAS;AAAA,QAChF;AACA,YAAI,CAAC,KAAK,IAAI,QAAQ,0BAA0B,GAAG;AAClD,gBAAM,IAAI;AAAA,YACT,4DAA4D,QAAQ,0BAA0B;AAAA,UAC/F;AAAA,QACD;AACA,YAAI,QAAQ,QAAQ,eAAe,SAAS,QAAQ,0BAA0B,GAAG;AAChF,gBAAM,IAAI;AAAA,YACT,iEAAiE,QAAQ,0BAA0B;AAAA,UACpG;AAAA,QACD;AACA,cAAM,SAAS,QAAQ,QAAQ,QAAQ,QAAQ,YAAY;AAC3D,YAAI,OAAO,YAAY;AACtB,gBAAM,IAAI,MAAM,mFAAmF;AAAA,QACpG;AACA,YAAI,CAAC,OAAO,sBAAsB,SAAS,QAAQ,0BAA0B,GAAG;AAC/E,gBAAM,IAAI,MAAM,6EAA6E;AAAA,QAC9F;AACA,eAAO,CAAC,YAAY,OAAO,sBAAsB,KAAK,IAAI,CAAC,EAAE;AAAA,MAC9D;AAAA,IACD;AAAA,IACA;AAAA,MACC,IAAI;AAAA,MACJ,MAAM,IAAI,SAAS;AAClB,cAAM,SAAS,KAAK,UAAU,QAAQ,YAAY;AAClD,gBAAQ,QAAQ,QAAQ,QAAQ,YAAY;AAC5C,gBAAQ,QAAQ,QAAQ,QAAQ,YAAY;AAC5C,YAAI,KAAK,UAAU,QAAQ,YAAY,MAAM,QAAQ;AACpD,gBAAM,IAAI,MAAM,yCAAyC;AAAA,QAC1D;AACA,eAAO,CAAC,0CAA0C;AAAA,MACnD;AAAA,IACD;AAAA,EACD;AACD;AAGA,eAAsB,qBACrB,SACwC;AACxC,QAAM,SAAiD,CAAC;AACxD,aAAW,SAAS,kBAAkB,GAAG;AACxC,QAAI;AACH,aAAO,KAAK,EAAE,IAAI,MAAM,IAAI,QAAQ,UAAU,UAAU,MAAM,MAAM,IAAI,OAAO,EAAE,CAAC;AAAA,IACnF,SAAS,OAAO;AACf,aAAO,KAAK;AAAA,QACX,IAAI,MAAM;AAAA,QACV,QAAQ;AAAA,QACR,UAAU,CAAC;AAAA,QACX,OAAO,iBAAiB,QAAQ,MAAM,UAAU,OAAO,KAAK;AAAA,MAC7D,CAAC;AAAA,IACF;AAAA,EACD;AACA,SAAO,EAAE,QAAQ,OAAO,MAAM,CAAC,UAAU,MAAM,WAAW,QAAQ,GAAG,OAAO;AAC7E;;;AC/OO,SAAS,0BAA0B,UAGxC;AACD,QAAM,QAAQ,oBAAI,IAAY;AAC9B,QAAM,UAAU,oBAAI,IAAY;AAChC,QAAM,QAAQ,CAAC,SAAS,MAAM,IAAI,SAAS,YAAY,CAAC,GAAG,IAAI,CAAC,YAAY,QAAQ,IAAI,CAAC;AACzF,aAAW,QAAQ,MAAO,MAAK,MAAM,OAAO,OAAO;AACnD,SAAO,EAAE,OAAO,QAAQ;AACzB;AAEA,SAAS,KAAK,UAAwB,OAAoB,SAA4B;AACrF,MAAI,SAAS,QAAS,OAAM,IAAI,SAAS,OAAO;AAChD,aAAW,UAAU,OAAO,OAAO,SAAS,WAAW,CAAC,CAAC,GAAG;AAC3D,YAAQ,IAAI,OAAO,MAAM;AACzB,QAAI,OAAO,OAAQ,eAAc,OAAO,QAAQ,KAAK;AAAA,EACtD;AACA,MAAI,SAAS,MAAO,eAAc,SAAS,OAAO,KAAK;AACvD,aAAW,SAAS,SAAS,YAAY,CAAC,EAAG,MAAK,OAAO,OAAO,OAAO;AACxE;AAEA,SAAS,cAAc,OAA0C,OAA0B;AAC1F,aAAW,SAAS,OAAO,OAAO,KAAK,EAAG,cAAa,OAAO,KAAK;AACpE;AAEA,SAAS,aAAa,OAA0B,OAA0B;AACzE,MAAI,UAAU,QAAQ,OAAO,UAAU,YAAY,CAAC,MAAM,QAAQ,KAAK,KAAK,UAAU,OAAO;AAC5F,UAAM,IAAK,MAA2B,IAAI;AAC1C,eAAW,CAAC,KAAK,OAAO,KAAK,OAAO,QAAQ,KAAK,GAAG;AACnD,UAAI,QAAQ,OAAQ,cAAa,SAA8B,KAAK;AAAA,IACrE;AACA;AAAA,EACD;AACA,MAAI,MAAM,QAAQ,KAAK,GAAG;AACzB,eAAW,QAAQ,MAAO,cAAa,MAAM,KAAK;AAClD;AAAA,EACD;AACA,MAAI,UAAU,QAAQ,OAAO,UAAU,SAAU,eAAc,OAA4C,KAAK;AACjH;;;AC0BO,SAAS,0BACf,WACA,MACA,UAA+B,CAAC,GAChB;AAChB,QAAM,aAAa,QAAQ,0BAA0B;AACrD,QAAM,QAAQ,QAAQ,WAAW,0BAA0B,QAAQ,QAAQ,IAAI;AAC/E,QAAM,cAAc,IAAI,IAAI,KAAK,eAAe,CAAC,CAAC;AAClD,QAAM,eAAe,IAAI,IAAI,KAAK,gBAAgB,CAAC,CAAC;AACpD,QAAM,eAAe,IAAI,IAAI,KAAK,gBAAgB,CAAC,CAAC;AAEpD,QAAM,QAAkB,CAAC;AACzB,QAAM,UAAoB,CAAC;AAC3B,QAAM,WAAiC,CAAC;AAExC,aAAW,YAAY,WAAW;AACjC,QAAI,eAAe,cAAc,CAAC,uBAAuB,QAAQ,GAAG;AACnE,eAAS,KAAK,EAAE,WAAW,SAAS,WAAW,SAAS,EAAE,MAAM,cAAc,MAAM,kBAAkB,EAAE,CAAC;AACzG;AAAA,IACD;AACA,UAAM,UAAU,wBAAwB,UAAU,EAAE,aAAa,cAAc,aAAa,CAAC;AAC7F,QAAI,SAAS;AACZ,eAAS,KAAK,EAAE,WAAW,SAAS,WAAW,QAAQ,CAAC;AACxD;AAAA,IACD;AACA,eAAW,QAAQ,SAAS,OAAO;AAClC,YAAM,YAAY,gBAAgB,SAAS,SAAS,IAAI,UAAU,KAAK,MAAM,SAAS,WAAW,GAAG,CAAC;AACrG,UAAI,CAAC,SAAS,MAAM,MAAM,IAAI,SAAS,EAAG,OAAM,KAAK,SAAS;AAAA,IAC/D;AACA,eAAW,UAAU,gBAAgB,QAAQ,GAAG;AAC/C,YAAM,YAAY,gBAAgB,SAAS,SAAS,IAAI,UAAU,OAAO,MAAM,SAAS,WAAW,GAAG,CAAC;AACvG,UAAI,CAAC,SAAS,MAAM,QAAQ,IAAI,SAAS,EAAG,SAAQ,KAAK,SAAS;AAAA,IACnE;AAAA,EACD;AAEA,SAAO;AAAA,IACN,QAAQ,EAAE,OAAO,CAAC,GAAG,IAAI,IAAI,KAAK,CAAC,EAAE,KAAK,GAAG,SAAS,CAAC,GAAG,IAAI,IAAI,OAAO,CAAC,EAAE,KAAK,EAAE;AAAA,IACnF,UAAU,SAAS,KAAK,CAAC,MAAM,UAAW,KAAK,YAAY,MAAM,YAAY,KAAK,KAAK,YAAY,MAAM,YAAY,IAAI,CAAE;AAAA,EAC5H;AACD;AAOA,SAAS,uBAAuB,UAAkC;AACjE,QAAM,eAAe,SAAS;AAC9B,SAAO;AAAA,IACN,kBACK,aAAa,aAAa,UAAU,KAAK,MACzC,aAAa,cAAc,UAAU,KAAK,MAC1C,aAAa,cAAc,UAAU,KAAK;AAAA,EAChD;AACD;AAEA,SAAS,wBACR,UACA,MAC4C;AAC5C,QAAM,eAAe,SAAS;AAC9B,aAAW,QAAQ,cAAc,eAAe,CAAC,GAAG;AACnD,QAAI,CAAC,KAAK,YAAY,IAAI,IAAI,EAAG,QAAO,EAAE,MAAM,cAAc,KAAK;AAAA,EACpE;AACA,aAAW,QAAQ,cAAc,gBAAgB,CAAC,GAAG;AACpD,QAAI,CAAC,KAAK,aAAa,IAAI,IAAI,EAAG,QAAO,EAAE,MAAM,eAAe,KAAK;AAAA,EACtE;AACA,aAAW,QAAQ,cAAc,gBAAgB,CAAC,GAAG;AACpD,QAAI,CAAC,KAAK,aAAa,IAAI,IAAI,EAAG,QAAO,EAAE,MAAM,eAAe,KAAK;AAAA,EACtE;AACA,SAAO;AACR;AAEA,SAAS,gBAAgB,UAAoE;AAC5F,QAAM,aAAa,SAAS,aAAa,sBAAsB;AAG/D,SAAO,YAAY,iBAAiB,CAAC;AACtC;AAGA,SAAS,UAAU,MAAc,WAAmB,WAA8B;AACjF,QAAM,SAAS,GAAG,SAAS,GAAG,SAAS;AACvC,SAAO,KAAK,WAAW,MAAM,IAAI,KAAK,MAAM,OAAO,MAAM,IAAI;AAC9D;;;ACzJO,IAAM,4BAAgD;AAAA,EAC5D,SAAS;AAAA,EACT,OAAO;AAAA,EACP,MAAM;AAAA,EACN,UAAU,CAAC,iBAAiB,QAAQ,WAAW,QAAQ,YAAY,gBAAgB;AAAA,EACnF,YAAY;AAAA,IACX,eAAe,EAAE,MAAM,WAAW,MAAM,CAAC,CAAC,EAAE;AAAA,IAC5C,MAAM,EAAE,MAAM,UAAU,SAAS,oBAAoB;AAAA,IACrD,SAAS,EAAE,MAAM,UAAU,SAAS,sBAAsB;AAAA,IAC1D,MAAM,EAAE,MAAM,SAAS;AAAA,IACvB,UAAU,EAAE,MAAM,UAAU,UAAU,CAAC,QAAQ,SAAS,EAAE;AAAA,IAC1D,gBAAgB,EAAE,MAAM,QAAQ;AAAA,EACjC;AACD;AAEO,IAAM,2BAA+C;AAAA,EAC3D,SAAS;AAAA,EACT,OAAO;AAAA,EACP,MAAM;AAAA,EACN,UAAU,CAAC,iBAAiB,iBAAiB,kBAAkB,YAAY,YAAY,kBAAkB,QAAQ;AAAA,EACjH,YAAY;AAAA,IACX,eAAe,EAAE,MAAM,WAAW,MAAM,CAAC,CAAC,EAAE;AAAA,IAC5C,eAAe,EAAE,MAAM,UAAU,SAAS,iBAAiB;AAAA,IAC3D,gBAAgB,EAAE,MAAM,UAAU,SAAS,iBAAiB;AAAA,IAC5D,UAAU,EAAE,MAAM,SAAS;AAAA,IAC3B,UAAU,EAAE,MAAM,SAAS;AAAA,IAC3B,gBAAgB,EAAE,MAAM,QAAQ;AAAA,IAChC,QAAQ,EAAE,MAAM,UAAU,UAAU,CAAC,SAAS,SAAS,EAAE;AAAA,EAC1D;AACD;;;ACtBO,IAAM,iCAAiC;AACvC,IAAM,yCAAyC;AA+FtD,IAAM,UAAU,IAAI,YAAY;AAChC,IAAM,UAAU,IAAI,YAAY,SAAS,EAAE,OAAO,KAAK,CAAC;AACxD,IAAM,aAAa;AAOZ,SAAS,gBAAgB,OAAwB;AACvD,SAAO,UAAU,OAAO,CAAC;AAC1B;AAEA,SAAS,UAAU,OAAgB,OAAuB;AACzD,MAAI,QAAQ,GAAI,OAAM,IAAI,MAAM,iDAAiD;AACjF,MAAI,UAAU,KAAM,QAAO;AAC3B,MAAI,OAAO,UAAU,UAAW,QAAO,QAAQ,SAAS;AACxD,MAAI,OAAO,UAAU,UAAU;AAC9B,QAAI,CAAC,OAAO,SAAS,KAAK,EAAG,OAAM,IAAI,MAAM,wCAAwC;AACrF,WAAO,OAAO,GAAG,OAAO,EAAE,IAAI,MAAM,KAAK,UAAU,KAAK;AAAA,EACzD;AACA,MAAI,OAAO,UAAU,UAAU;AAC9B,uBAAmB,KAAK;AACxB,WAAO,KAAK,UAAU,KAAK;AAAA,EAC5B;AACA,MAAI,MAAM,QAAQ,KAAK,EAAG,QAAO,IAAI,MAAM,IAAI,CAAC,UAAU,UAAU,OAAO,QAAQ,CAAC,CAAC,EAAE,KAAK,GAAG,CAAC;AAChG,MAAI,OAAO,UAAU,SAAU,OAAM,IAAI,MAAM,gCAAgC,OAAO,KAAK,GAAG;AAC9F,QAAM,SAAS;AACf,QAAM,OAAO,OAAO,KAAK,MAAM,EAAE,KAAK;AACtC,SAAO,IAAI,KAAK,IAAI,CAAC,QAAQ;AAC5B,uBAAmB,GAAG;AACtB,WAAO,GAAG,KAAK,UAAU,GAAG,CAAC,IAAI,UAAU,OAAO,GAAG,GAAG,QAAQ,CAAC,CAAC;AAAA,EACnE,CAAC,EAAE,KAAK,GAAG,CAAC;AACb;AAEA,SAAS,mBAAmB,OAAqB;AAChD,WAAS,QAAQ,GAAG,QAAQ,MAAM,QAAQ,SAAS,GAAG;AACrD,UAAM,OAAO,MAAM,WAAW,KAAK;AACnC,QAAI,QAAQ,SAAU,QAAQ,OAAQ;AACrC,YAAM,OAAO,MAAM,WAAW,QAAQ,CAAC;AACvC,UAAI,EAAE,QAAQ,SAAU,QAAQ,OAAS,OAAM,IAAI,MAAM,wDAAwD;AACjH,eAAS;AAAA,IACV,WAAW,QAAQ,SAAU,QAAQ,OAAQ;AAC5C,YAAM,IAAI,MAAM,wDAAwD;AAAA,IACzE;AAAA,EACD;AACD;AAEA,eAAsB,+BACrB,OACmC;AACnC,QAAM,WAAW,MAAM,YAAY;AACnC,MAAI,QAAQ,OAAO,MAAM,UAAU,EAAE,aAAa,UAAU;AAC3D,UAAM,IAAI,MAAM,0CAA0C,QAAQ,mBAAmB;AAAA,EACtF;AACA,QAAM,QAAQ,MAAM,WAAW,MAAM,GAAG;AACxC,MAAI,MAAM,WAAW,KAAK,MAAM,KAAK,CAAC,SAAS,KAAK,WAAW,CAAC,EAAG,OAAM,IAAI,MAAM,mDAAmD;AACtI,QAAM,SAAS,aAAa,MAAM,CAAC,GAAI,kBAAkB;AACzD,MAAI,OAAO,QAAQ,QAAS,OAAM,IAAI,MAAM,6CAA6C;AACzF,MAAI,OAAO,QAAQ,MAAM,aAAc,OAAM,IAAI,MAAM,2CAA2C,MAAM,YAAY,GAAG;AACvH,MAAI,OAAO,OAAO,QAAQ,YAAY,CAAC,OAAO,IAAK,OAAM,IAAI,MAAM,+CAA+C;AAClH,QAAM,eAAe,gBAAgB,MAAM,CAAC,CAAE;AAC9C,QAAM,UAAU,eAAe,cAAc,SAAS;AACtD,MAAI,OAAO,QAAQ,WAAW,YAAY,CAAC,QAAQ,OAAQ,OAAM,IAAI,MAAM,gDAAgD;AAC3H,QAAM,MAAM,MAAM,MAAM,MAAM,WAAW,EAAE,OAAO,OAAO,KAAK,QAAQ,QAAQ,QAAQ,WAAW,QAAQ,CAAC;AAC1G,MAAI,CAAC,OAAO,IAAI,cAAc,QAAS,OAAM,IAAI,MAAM,gDAAgD;AACvG,QAAM,YAAY,gBAAgB,MAAM,CAAC,CAAE;AAC3C,MAAI,UAAU,eAAe,GAAI,OAAM,IAAI,MAAM,mDAAmD;AACpG,QAAM,WAAW,MAAM,MAAM,OAAO,OAAO;AAAA,IAC1C,WAAW;AAAA,IACX,KAAK,IAAI;AAAA,IACT,cAAc,QAAQ,OAAO,GAAG,MAAM,CAAC,CAAC,IAAI,MAAM,CAAC,CAAC,EAAE;AAAA,IACtD;AAAA,EACD,CAAC;AACD,MAAI,CAAC,SAAU,OAAM,IAAI,MAAM,kDAAkD;AACjF,SAAO;AACR;AAEA,eAAsB,8BAA8B,OAMzB;AAC1B,QAAM,UAAU,MAAM,+BAA+B;AAAA,IACpD,YAAY,MAAM;AAAA,IAClB,cAAc;AAAA,IACd,QAAQ,MAAM;AAAA,IACd,OAAO,MAAM;AAAA,IACb,GAAI,MAAM,aAAa,SAAY,CAAC,IAAI,EAAE,UAAU,MAAM,SAAS;AAAA,EACpE,CAAC;AACD,sBAAoB,OAAO;AAC3B,MAAI,QAAQ,WAAW,MAAM,SAAS,UAClC,QAAQ,gBAAgB,MAAM,SAAS,eACvC,QAAQ,mBAAmB,MAAM,SAAS,gBAAgB;AAC7D,UAAM,IAAI,MAAM,0FAA0F;AAAA,EAC3G;AACA,QAAM,EAAE,eAAAC,gBAAe,GAAG,KAAK,IAAI;AACnC,QAAM,SAAS,MAAM,MAAM,OAAO,aAAa,QAAQ,OAAO,gBAAgB,IAAI,CAAC,CAAC;AACpF,QAAM,iBAAiB,CAAC,GAAG,MAAM,EAAE,IAAI,CAAC,SAAS,KAAK,SAAS,EAAE,EAAE,SAAS,GAAG,GAAG,CAAC,EAAE,KAAK,EAAE;AAC5F,MAAIA,mBAAkB,eAAgB,OAAM,IAAI,MAAM,wEAAwE;AAC9H,SAAO;AACR;AAEO,SAAS,oBAAoB,OAAgD;AACnF,MAAI,CAAC,SAAS,OAAO,UAAU,YAAY,MAAM,QAAQ,KAAK,EAAG,OAAM,IAAI,MAAM,oCAAoC;AACrH,QAAM,UAAU;AAChB,MAAI,QAAQ,kBAAkB,kCAAkC,QAAQ,SAAS,sBAAsB;AACtG,UAAM,IAAI,MAAM,4CAA4C;AAAA,EAC7D;AACA,aAAW,SAAS,CAAC,UAAU,eAAe,iBAAiB,gBAAgB,GAAY;AAC1F,QAAI,OAAO,QAAQ,KAAK,MAAM,YAAY,CAAC,QAAQ,KAAK,EAAG,OAAM,IAAI,MAAM,mBAAmB,KAAK,eAAe;AAAA,EACnH;AACA,MAAI,CAAC,WAAW,KAAK,QAAQ,aAAuB,KAAK,CAAC,WAAW,KAAK,QAAQ,cAAwB,GAAG;AAC5G,UAAM,IAAI,MAAM,2DAA2D;AAAA,EAC5E;AACA,MAAI,CAAC,QAAQ,YAAY,OAAO,QAAQ,aAAa,YACjD,CAAC,QAAQ,YAAY,OAAO,QAAQ,aAAa,YACjD,CAAC,MAAM,QAAQ,QAAQ,cAAc,KACrC,CAAC,QAAQ,UAAU,OAAO,QAAQ,WAAW,YAC7C,CAAC,MAAM,QAAS,QAAQ,OAAmC,KAAK,KAChE,CAAC,MAAM,QAAS,QAAQ,OAAmC,OAAO,KAClE,CAAC,MAAM,QAAQ,QAAQ,eAAe,GAAG;AAC5C,UAAM,IAAI,MAAM,6CAA6C;AAAA,EAC9D;AACA,QAAM,SAAS,QAAQ;AACvB,sBAAoB,OAAO,OAAO,cAAc,CAAC,UAAU;AAC1D,UAAM,SAAS,aAAa,OAAO,YAAY;AAC/C,8BAA0B,OAAO,WAAW,YAAY;AACxD,yBAAqB,OAAO,MAAM,iBAAiB;AACnD,yBAAqB,OAAO,SAAS,oBAAoB;AACzD,QAAI,OAAO,0BAA0B,QAAW;AAC/C,sBAAgB,OAAO,uBAAuB,kCAAkC;AAAA,IACjF;AACA,WAAO,OAAO;AAAA,EACf,CAAC;AACD,sBAAoB,OAAO,SAAS,gBAAgB,CAAC,UAAU;AAC9D,UAAM,SAAS,aAAa,OAAO,cAAc;AACjD,8BAA0B,OAAO,WAAW,cAAc;AAC1D,yBAAqB,OAAO,UAAU,uBAAuB;AAC7D,QAAI,CAAC,OAAO,cAAc,OAAO,OAAO,KAAM,OAAO,UAAqB,GAAG;AAC5E,YAAM,IAAI,MAAM,kEAAkE;AAAA,IACnF;AACA,QAAI,OAAO,0BAA0B,QAAW;AAC/C,sBAAgB,OAAO,uBAAuB,oCAAoC;AAAA,IACnF;AACA,WAAO,OAAO;AAAA,EACf,CAAC;AACD,sBAAoB,QAAQ,iBAA8B,mBAAmB,CAAC,UAAU;AACvF,UAAM,SAAS,aAAa,OAAO,iBAAiB;AACpD,yBAAqB,OAAO,QAAQ,wBAAwB;AAC5D,yBAAqB,OAAO,YAAY,4BAA4B;AACpE,QAAI,CAAC,MAAM,QAAQ,OAAO,KAAK,KAAK,CAAC,OAAO,MAAM,MAAM,CAAC,SAAS,OAAO,SAAS,QAAQ,KACtF,CAAC,MAAM,QAAQ,OAAO,OAAO,KAAK,CAAC,OAAO,QAAQ,MAAM,CAAC,SAAS,OAAO,SAAS,QAAQ,GAAG;AAChG,YAAM,IAAI,MAAM,+DAA+D;AAAA,IAChF;AACA,WAAO,GAAG,OAAO,MAAgB,KAAK,OAAO,UAAoB;AAAA,EAClE,CAAC;AACF;AAEA,SAAS,aAAa,OAAgB,OAAwC;AAC7E,MAAI,CAAC,SAAS,OAAO,UAAU,YAAY,MAAM,QAAQ,KAAK,EAAG,OAAM,IAAI,MAAM,mBAAmB,KAAK,qBAAqB;AAC9H,SAAO;AACR;AAEA,SAAS,qBAAqB,OAAgB,OAAwC;AACrF,MAAI,OAAO,UAAU,YAAY,CAAC,MAAO,OAAM,IAAI,MAAM,mBAAmB,KAAK,eAAe;AACjG;AAEA,SAAS,gBAAgB,OAAgB,OAAwC;AAChF,MAAI,OAAO,UAAU,YAAY,CAAC,WAAW,KAAK,KAAK,EAAG,OAAM,IAAI,MAAM,mBAAmB,KAAK,qCAAqC;AACxI;AAEA,SAAS,0BAA0B,OAAgB,OAA0D;AAC5G,MAAI,OAAO,UAAU,YAAY,CAAC,MAAM,WAAW,eAAe,EAAG,OAAM,IAAI,MAAM,mBAAmB,KAAK,wBAAwB;AACtI;AAEA,SAAS,oBAAoB,QAAmB,OAAe,UAA4C;AAC1G,QAAM,OAAO,oBAAI,IAAY;AAC7B,aAAW,SAAS,QAAQ;AAC3B,UAAM,MAAM,SAAS,KAAK;AAC1B,QAAI,KAAK,IAAI,GAAG,EAAG,OAAM,IAAI,MAAM,mCAAmC,KAAK,GAAG;AAC9E,SAAK,IAAI,GAAG;AAAA,EACb;AACD;AAEA,eAAsB,8BAA8B,OAOjB;AAClC,QAAM,UAAU,MAAM,+BAA+B;AAAA,IACpD,YAAY,MAAM;AAAA,IAClB,cAAc;AAAA,IACd,QAAQ,MAAM;AAAA,IACd,OAAO,MAAM;AAAA,EACd,CAAC;AACD,8BAA4B,OAAO;AACnC,MAAI,QAAQ,WAAW,MAAM,SAAS,UAClC,QAAQ,gBAAgB,MAAM,SAAS,eACvC,QAAQ,YAAY,MAAM,SAAS,SAAS;AAC/C,UAAM,IAAI,MAAM,uFAAuF;AAAA,EACxG;AACA,QAAM,OAAO,MAAM,OAAO,oBAAI,KAAK,GAAG,QAAQ;AAC9C,MAAI,QAAQ,cAAc,UAAa,MAAM,eAAe,QAAQ,WAAW,WAAW,GAAG;AAC5F,UAAM,IAAI,MAAM,4CAA4C;AAAA,EAC7D;AACA,MAAI,QAAQ,cAAc,UAAa,OAAO,eAAe,QAAQ,WAAW,WAAW,GAAG;AAC7F,UAAM,IAAI,MAAM,sCAAsC;AAAA,EACvD;AACA,QAAM,gBAAgB,GAAG,QAAQ,MAAM,IAAI,QAAQ,WAAW,IAAI,QAAQ,OAAO;AACjF,QAAM,qBAAqB,MAAM,MAAM,OAAO,aAAa,QAAQ,OAAO,gBAAgB,OAAO,CAAC,CAAC;AACnG,QAAM,gBAAgB,CAAC,GAAG,kBAAkB,EAAE,IAAI,CAAC,SAAS,KAAK,SAAS,EAAE,EAAE,SAAS,GAAG,GAAG,CAAC,EAAE,KAAK,EAAE;AACvG,QAAM,UAAU,MAAM,MAAM,YAAY,IAAI,aAAa;AACzD,MAAI,YAAY,UAAa,QAAQ,aAAa,QAAQ,YAAY;AACrE,UAAM,IAAI,MAAM,gEAAgE;AAAA,EACjF;AACA,MAAI,SAAS,eAAe,QAAQ,cAAc,QAAQ,kBAAkB,eAAe;AAC1F,UAAM,IAAI,MAAM,4EAA4E;AAAA,EAC7F;AACA,MAAI,SAAS,eAAe,QAAQ,YAAY;AAC/C,UAAM,WAAW,MAAM,MAAM,YAAY,eAAe,eAAe,QAAQ,YAAY,aAAa;AACxG,QAAI,CAAC,UAAU;AACd,YAAM,QAAQ,MAAM,MAAM,YAAY,IAAI,aAAa;AACvD,UAAI,OAAO,eAAe,QAAQ,cAAc,MAAM,kBAAkB,eAAe;AACtF,cAAM,IAAI,MAAM,4EAA4E;AAAA,MAC7F;AAAA,IACD;AAAA,EACD;AACA,SAAO;AACR;AAEO,SAAS,4BAA4B,OAAwD;AACnG,MAAI,CAAC,SAAS,OAAO,UAAU,YAAY,MAAM,QAAQ,KAAK,EAAG,OAAM,IAAI,MAAM,4CAA4C;AAC7H,QAAM,UAAU;AAChB,MAAI,QAAQ,kBAAkB,0CAA0C,QAAQ,SAAS,2BAA2B;AACnH,UAAM,IAAI,MAAM,oDAAoD;AAAA,EACrE;AACA,aAAW,SAAS,CAAC,UAAU,eAAe,WAAW,UAAU,GAAY;AAC9E,QAAI,OAAO,QAAQ,KAAK,MAAM,YAAY,CAAC,QAAQ,KAAK,EAAG,OAAM,IAAI,MAAM,2BAA2B,KAAK,eAAe;AAAA,EAC3H;AACA,MAAI,CAAC,OAAO,cAAc,QAAQ,UAAU,KAAM,QAAQ,aAAwB,EAAG,OAAM,IAAI,MAAM,yEAAyE;AAC9K,MAAI,CAAC,WAAW,KAAK,OAAO,QAAQ,mBAAmB,CAAC,KAAK,CAAC,WAAW,KAAK,OAAO,QAAQ,cAAc,CAAC,GAAG;AAC9G,UAAM,IAAI,MAAM,mEAAmE;AAAA,EACpF;AACA,MAAI,QAAQ,2BAA2B,WAClC,CAAC,MAAM,QAAQ,QAAQ,sBAAsB,KAC7C,CAAC,QAAQ,uBAAuB,MAAM,CAAC,WAAW,OAAO,WAAW,YAAY,WAAW,KAAK,MAAM,CAAC,KACvG,IAAI,IAAI,QAAQ,sBAAsB,EAAE,SAAS,QAAQ,uBAAuB,SAAS;AAC7F,UAAM,IAAI,MAAM,8FAA8F;AAAA,EAC/G;AACA,iBAAe,QAAQ,UAAoB,UAAU;AACtD;AAEA,SAAS,aAAa,SAAiB,OAAwC;AAC9E,SAAO,eAAe,gBAAgB,OAAO,GAAG,KAAK;AACtD;AAEA,SAAS,eAAe,OAAmB,OAAwC;AAClF,MAAI;AACJ,MAAI;AAAE,YAAQ,KAAK,MAAM,QAAQ,OAAO,KAAK,CAAC;AAAA,EAAG,QAC3C;AAAE,UAAM,IAAI,MAAM,8BAA8B,KAAK,2BAA2B;AAAA,EAAG;AACzF,MAAI,CAAC,SAAS,OAAO,UAAU,YAAY,MAAM,QAAQ,KAAK,EAAG,OAAM,IAAI,MAAM,8BAA8B,KAAK,qBAAqB;AACzI,SAAO;AACR;AAEA,SAAS,gBAAgB,OAA2B;AACnD,MAAI,CAAC,mBAAmB,KAAK,KAAK,EAAG,OAAM,IAAI,MAAM,wDAAwD;AAC7G,QAAM,SAAS,MAAM,QAAQ,MAAM,GAAG,EAAE,QAAQ,MAAM,GAAG,EAAE,OAAO,KAAK,KAAK,MAAM,SAAS,CAAC,IAAI,GAAG,GAAG;AACtG,MAAI;AACJ,MAAI;AAAE,aAAS,KAAK,MAAM;AAAA,EAAG,QACvB;AAAE,UAAM,IAAI,MAAM,wDAAwD;AAAA,EAAG;AACnF,SAAO,WAAW,KAAK,QAAQ,CAAC,cAAc,UAAU,WAAW,CAAC,CAAC;AACtE;AAEA,SAAS,eAAe,OAAe,OAAuB;AAC7D,MAAI,CAAC,yBAAyB,KAAK,KAAK,EAAG,OAAM,IAAI,MAAM,2BAA2B,KAAK,4CAA4C;AACvI,QAAM,SAAS,KAAK,MAAM,KAAK;AAC/B,MAAI,OAAO,MAAM,MAAM,EAAG,OAAM,IAAI,MAAM,2BAA2B,KAAK,cAAc;AACxF,SAAO;AACR;","names":["value","import_assembly","canonical","shortName","releaseDigest"]}