@hlos-ai/schemas 0.4.2 → 0.7.1

package/dist/index.cjs.map

@@ -1 +1 @@
-{"version":3,"sources":["../src/index.ts","../src/surface.ts","../src/response.ts","../src/error-codes.ts","../src/receipt-v0.ts","../src/ids.ts","../src/shared-contract.ts","../src/w.ts","../src/agents.ts","../src/encoding.ts","../src/receipt-hash.ts","../src/finality.ts"],"sourcesContent":["/**\n * @hlos-ai/schemas - HLOS Kernel v2 API Contract Types\n *\n * This package defines the canonical types for HLOS Kernel v2:\n * - Response envelopes (SuccessResponse, ErrorResponse)\n * - Error codes (KernelErrorCode)\n * - Receipt format (SignedReceiptV0)\n * - Surface identifiers (Surface)\n * - Branded ID types (WalletId, PassportId, etc.)\n *\n * Surfaces (MCP, x402, Events, etc.) import from this package.\n * Kernel internals are NOT exported here.\n *\n * @packageDocumentation\n */\n\n// =============================================================================\n// Surface\n// =============================================================================\n\nexport {\n    SurfaceSchema,\n    type Surface,\n    SURFACES,\n} from './surface';\n\n// =============================================================================\n// Error Codes (legacy - superseded by shared-contract)\n// =============================================================================\n\n// NOTE: KernelErrorCodeSchema now exported from shared-contract with expanded codes.\n// Keeping error-codes.ts for backward compatibility, but shared-contract is canonical.\n\n\n// =============================================================================\n// Response Envelopes\n// =============================================================================\n\nexport {\n    type SuccessResponse,\n    type ErrorResponse,\n    success,\n    error,\n    SuccessResponseSchema,\n    ErrorResponseSchema,\n} from './response';\n\n// =============================================================================\n// SignedReceiptV0\n// =============================================================================\n\nexport {\n    RECEIPT_TYPE_URI,\n    RECEIPT_VERSION,\n    CONTENT_HASH_LENGTH,\n    SIGNATURE_LENGTH,\n    type SignedReceiptV0,\n    SignedReceiptV0Schema,\n    SignedReceiptV0LooseSchema,\n    isSignedReceiptV0,\n} from './receipt-v0';\n\n// =============================================================================\n// Branded IDs\n// =============================================================================\n\nexport {\n    type WalletId,\n    type PassportId,\n    type ReceiptId,\n    type CorrelationId,\n    type IdempotencyKey,\n    type CrossingId,\n    WalletIdSchema,\n    PassportIdSchema,\n    ReceiptIdSchema,\n    CorrelationIdSchema,\n    IdempotencyKeySchema,\n    CrossingIdSchema,\n    generateId,\n    generateWalletId,\n    generatePassportId,\n    generateReceiptId,\n    generateCrossingId,\n} from './ids';\n\n// =============================================================================\n// Shared Contract (LOCKED)\n// =============================================================================\n\nexport {\n    // Error codes (STRICT ENUM)\n    KernelErrorCodeSchema,\n    type KernelErrorCode,\n    ERROR_CODE_STATUS,\n\n    // Response envelopes\n    KernelOkSchema,\n    type KernelOk,\n    KernelErrorSchema,\n    type KernelError,\n    type ApiResponse,\n    kernelOk,\n    kernelError,\n\n    // ID format validators\n    CrossingIdFormatSchema,\n    ReceiptIdFormatSchema,\n    PassportIdFormatSchema,\n    WalletIdFormatSchema,\n\n    // Attribution\n    FundingSourceSchema,\n    type FundingSource,\n    CredentialSourceSchema,\n    type CredentialSource,\n    deriveFundingSource,\n\n    // Crossing hash input\n    CrossingSnapshotV0Schema,\n    type CrossingSnapshotV0,\n    CrossingHashInputV0Schema,\n    type CrossingHashInputV0,\n    isCrossingHashInputV0,\n\n    // Settlement receipt\n    SETTLEMENT_AUTHORITY,\n    CrossingSettledReceiptSchema,\n    type CrossingSettledReceipt,\n    isCrossingSettledReceipt,\n\n    // Stack primitives\n    AvailabilityTypeSchema,\n    type AvailabilityType,\n    ProviderRoleSchema,\n    type ProviderRole,\n    StackProviderSchema,\n    type StackProvider,\n    StackSchema,\n    type Stack,\n    StackConnectionSchema,\n    type StackConnection,\n\n    // Golden test fixtures\n    GOLDEN_FIXTURES,\n} from './shared-contract';\n\n// =============================================================================\n// Family W — Privacy-Preserving Proofs (Phase 1 LOCKED)\n// =============================================================================\n\nexport {\n    // Domain separators (frozen)\n    W_RPID_DOMAIN,\n    W_TXCTX_DOMAIN,\n\n    // Encoding utilities\n    encodeEpoch,\n\n    // Schemas\n    RelyingPartyIdSchema,\n    type RelyingPartyId,\n    RotationEpochSchema,\n    type RotationEpoch,\n    RPIDSchema,\n    type RPID,\n    TransactionContextSchema,\n    type TransactionContext,\n    TransactionContextHashSchema,\n    type TransactionContextHash,\n\n    // Validation helpers\n    validateTimeWindow,\n\n    // Golden fixtures\n    W_GOLDEN_FIXTURES,\n} from './w';\n\n// =============================================================================\n// Agents Contracts\n// =============================================================================\n\nexport {\n    // Agents list\n    AgentsListResponseSchema,\n    type AgentsListResponse,\n    AgentListItemSchema,\n    type AgentListItem,\n\n    // Agent passport stub\n    AgentPassportStubResponseSchema,\n    type AgentPassportStubResponse,\n\n    // Enums (forward-compatible)\n    AgentStatusSchema,\n    type AgentStatus,\n    AgentTypeSchema,\n    type AgentType,\n} from './agents';\n\n// =============================================================================\n// Encoding Utilities (Zero Dependencies)\n// =============================================================================\n\nexport {\n    // Encoding/decoding\n    bytesToBase64url,\n    base64urlToBytes,\n\n    // Schemas\n    Base64urlSha256Schema,\n    Base64urlEd25519SigSchema,\n    BASE64URL_SHA256_REGEX,\n} from './encoding';\n\n// =============================================================================\n// Receipt Hash Computation (Requires @noble/hashes)\n// =============================================================================\n\nexport {\n    // JCS canonicalization (RFC 8785)\n    jcsCanonicalize,\n\n    // Hash computation\n    computeReceiptHash,\n    computeContentHash,\n\n    // Schemas\n    ReceiptHashSchema,\n\n    // Golden fixtures (FROZEN)\n    RECEIPT_HASH_GOLDEN_FIXTURE,\n} from './receipt-hash';\n\n// =============================================================================\n// Finality — Notary Attestation & HARD Finality\n// =============================================================================\n\nexport {\n    // Constants\n    NA_ID_PREFIX,\n    FinalityLevel,\n\n    // ID format\n    NotaryAttestationIdFormatSchema,\n\n    // Notary Attestation (NA)\n    NotaryAttestationSchema,\n    type NotaryAttestation,\n    isNotaryAttestation,\n\n    // Notary Request (HLOS → STAAMPID)\n    NotaryRequestSchema,\n    type NotaryRequest,\n    isNotaryRequest,\n\n    // Notarize API response\n    NotarizeStatusSchema,\n    type NotarizeStatus,\n    NotarizeResponseSchema,\n    type NotarizeResponse,\n\n    // Merkle proof\n    LogInclusionProofSchema,\n    type LogInclusionProof,\n\n    // BRE artifact references\n    ArtifactRefSchema,\n    type ArtifactRef,\n\n    // Golden fixtures\n    FINALITY_GOLDEN_FIXTURES,\n} from './finality';\n\n","/**\n * @hlos-ai/schemas - Surface Types\n *\n * Canonical surface identifiers for idempotency scoping,\n * audit logging, and request attribution.\n */\n\nimport { z } from 'zod';\n\n/**\n * Known surfaces that interact with HLOS Kernel v2.\n * Used for idempotency scoping: (surface, idempotency_key) must be unique.\n */\nexport const SurfaceSchema = z.enum([\n    'mcp',      // Model Context Protocol servers\n    'x402',     // x402 micropayment protocol\n    'events',   // events.hlos.ai\n    'cli',      // HLOS CLI\n    'web',      // hlos.ai web app\n    'acp',      // Agent Commerce Protocol\n    'api',      // Direct API calls (default for unspecified)\n]);\n\nexport type Surface = z.infer<typeof SurfaceSchema>;\n\n/**\n * All known surfaces as a const array (for iteration).\n */\nexport const SURFACES = SurfaceSchema.options;\n","/**\n * @hlos-ai/schemas - Response Types\n *\n * Standard response envelopes for HLOS Kernel v2 API.\n *\n * - Reads return SuccessResponse<T>\n * - Mutations return SignedReceiptV0<T>\n * - Errors return ErrorResponse\n */\n\nimport { z } from 'zod';\nimport { KernelErrorCodeSchema, type KernelErrorCode } from './error-codes';\n\n// =============================================================================\n// Success Response (for reads)\n// =============================================================================\n\n/**\n * Standard success response for read operations.\n * Mutations return SignedReceiptV0 instead.\n */\nexport interface SuccessResponse<T> {\n    success: true;\n    data: T;\n    meta?: {\n        request_id?: string;\n        correlation_id: string;\n    };\n}\n\n/**\n * Create a SuccessResponse.\n */\nexport function success<T>(data: T, correlationId: string, requestId?: string): SuccessResponse<T> {\n    return {\n        success: true,\n        data,\n        meta: {\n            correlation_id: correlationId,\n            ...(requestId && { request_id: requestId }),\n        },\n    };\n}\n\n// =============================================================================\n// Error Response\n// =============================================================================\n\n/**\n * Standard error response.\n */\nexport interface ErrorResponse {\n    success: false;\n    error: {\n        code: KernelErrorCode;\n        message: string;\n        details?: unknown;\n        correlation_id: string;\n    };\n}\n\n/**\n * Create an ErrorResponse.\n */\nexport function error(\n    code: KernelErrorCode,\n    message: string,\n    correlationId: string,\n    details?: unknown\n): ErrorResponse {\n    return {\n        success: false,\n        error: {\n            code,\n            message,\n            correlation_id: correlationId,\n            ...(details !== undefined && { details }),\n        },\n    };\n}\n\n// =============================================================================\n// Zod Schemas (for runtime validation)\n// =============================================================================\n\nexport const SuccessResponseSchema = <T extends z.ZodType>(dataSchema: T) =>\n    z.object({\n        success: z.literal(true),\n        data: dataSchema,\n        meta: z.object({\n            request_id: z.string().optional(),\n            correlation_id: z.string(),\n        }).optional(),\n    });\n\nexport const ErrorResponseSchema = z.object({\n    success: z.literal(false),\n    error: z.object({\n        code: KernelErrorCodeSchema,\n        message: z.string(),\n        details: z.unknown().optional(),\n        correlation_id: z.string(),\n    }),\n});\n","/**\n * @hlos-ai/schemas - Error Codes\n *\n * Canonical error codes for HLOS Kernel v2 API.\n * These are FROZEN — additive changes only.\n */\n\nimport { z } from 'zod';\n\n/**\n * Kernel error codes (stable, exhaustive).\n */\nexport const KernelErrorCodeSchema = z.enum([\n    // 4xx Client Errors\n    'INVALID_REQUEST',        // 400 - Malformed request body\n    'UNAUTHORIZED',           // 401 - Missing/invalid auth\n    'FORBIDDEN',              // 403 - Insufficient permissions\n    'NOT_FOUND',              // 404 - Resource doesn't exist\n    'CONFLICT',               // 409 - General conflict\n    'IDEMPOTENCY_CONFLICT',   // 409 - Same idem_key, different request\n    'INSUFFICIENT_BALANCE',   // 402 - Wallet lacks funds\n    'SPEND_CAP_EXCEEDED',     // 402 - Spend cap hit\n    'RATE_LIMITED',           // 429 - Too many requests\n\n    // 5xx Server Errors\n    'INTERNAL_ERROR',         // 500 - Server error\n    'SERVICE_UNAVAILABLE',    // 503 - Temporarily unavailable\n]);\n\nexport type KernelErrorCode = z.infer<typeof KernelErrorCodeSchema>;\n\n/**\n * HTTP status code mapping for each error code.\n */\nexport const ERROR_CODE_STATUS: Record<KernelErrorCode, number> = {\n    INVALID_REQUEST: 400,\n    UNAUTHORIZED: 401,\n    FORBIDDEN: 403,\n    NOT_FOUND: 404,\n    CONFLICT: 409,\n    IDEMPOTENCY_CONFLICT: 409,\n    INSUFFICIENT_BALANCE: 402,\n    SPEND_CAP_EXCEEDED: 402,\n    RATE_LIMITED: 429,\n    INTERNAL_ERROR: 500,\n    SERVICE_UNAVAILABLE: 503,\n};\n","/**\n * @hlos-ai/schemas - SignedReceiptV0\n *\n * Canonical receipt format for HLOS Kernel v2 mutations.\n * All mutating operations emit this receipt type.\n *\n * FROZEN: Breaking changes require version bump.\n */\n\nimport { z } from 'zod';\nimport type { ReceiptId } from './ids';\n\n// =============================================================================\n// Constants\n// =============================================================================\n\n/**\n * Receipt type URI (JSON-LD style).\n */\nexport const RECEIPT_TYPE_URI = 'https://hlos.ai/schema/SignedReceiptV0' as const;\n\n/**\n * Current receipt format version.\n * This is a NUMBER, not semver.\n */\nexport const RECEIPT_VERSION = 0 as const;\n\n// =============================================================================\n// Types\n// =============================================================================\n\n/**\n * SignedReceiptV0: Canonical receipt for all v2 mutations.\n *\n * Content is JCS-canonicalized, SHA-256 hashed, Ed25519 signed.\n *\n * @template T - The content type (mutation-specific payload)\n */\nexport interface SignedReceiptV0<T = unknown> {\n    /**\n     * Type URI for JSON-LD compatibility.\n     */\n    '@type': typeof RECEIPT_TYPE_URI;\n\n    /**\n     * Format version (number, not semver).\n     * Increment for breaking format changes.\n     */\n    version: typeof RECEIPT_VERSION;\n\n    /**\n     * Unique receipt identifier.\n     */\n    receipt_id: ReceiptId | string;\n\n    /**\n     * The mutation payload (JCS-canonicalized before hashing).\n     */\n    content: T;\n\n    /**\n     * SHA-256 hash of JCS(content), base64url encoded.\n     *\n     * IMPORTANT: This is base64url of the raw 32-byte digest,\n     * NOT hex encoding. Matches signature input format.\n     */\n    content_hash: string;\n\n    /**\n     * Ed25519 signature over the raw 32-byte content_hash digest.\n     * base64url encoded.\n     *\n     * Signing process:\n     *   1. canonicalize = JCS(content)\n     *   2. digest = SHA-256(canonicalize) → 32 bytes\n     *   3. signature = Ed25519.sign(private_key, digest)\n     *   4. encode = base64url(signature)\n     */\n    signature: string;\n\n    /**\n     * Key identifier for signature verification.\n     * Resolves via JWKS endpoint: GET /api/v2/.well-known/keys\n     */\n    key_id: string;\n\n    /**\n     * ISO 8601 timestamp when receipt was issued.\n     */\n    issued_at: string;\n}\n\n// =============================================================================\n// Zod Schema\n// =============================================================================\n\n/**\n * Strict base64url length constants:\n * - SHA-256 digest (32 bytes) = 43 chars base64url (no padding)\n * - Ed25519 signature (64 bytes) = 86 chars base64url (no padding)\n */\nexport const CONTENT_HASH_LENGTH = 43;\nexport const SIGNATURE_LENGTH = 86;\n\nexport const SignedReceiptV0Schema = <T extends z.ZodType>(contentSchema: T) =>\n    z.object({\n        '@type': z.literal(RECEIPT_TYPE_URI),\n        version: z.literal(RECEIPT_VERSION),\n        receipt_id: z.string(),\n        content: contentSchema,\n        // SHA-256 digest (32 bytes) = exactly 43 chars base64url\n        content_hash: z.string().regex(\n            /^[A-Za-z0-9_-]{43}$/,\n            'content_hash must be 43-char base64url (32-byte SHA-256)'\n        ),\n        // Ed25519 signature (64 bytes) = exactly 86 chars base64url\n        signature: z.string().regex(\n            /^[A-Za-z0-9_-]{86}$/,\n            'signature must be 86-char base64url (64-byte Ed25519)'\n        ),\n        key_id: z.string().min(1),\n        issued_at: z.string().datetime(),\n    });\n\n/**\n * Loose schema for unknown content types.\n */\nexport const SignedReceiptV0LooseSchema = SignedReceiptV0Schema(z.unknown());\n\n// =============================================================================\n// Type Guards\n// =============================================================================\n\n/**\n * Check if a value is a SignedReceiptV0.\n */\nexport function isSignedReceiptV0(value: unknown): value is SignedReceiptV0 {\n    if (typeof value !== 'object' || value === null) return false;\n    const obj = value as Record<string, unknown>;\n    return (\n        obj['@type'] === RECEIPT_TYPE_URI &&\n        obj['version'] === RECEIPT_VERSION &&\n        typeof obj['receipt_id'] === 'string' &&\n        typeof obj['content_hash'] === 'string' &&\n        typeof obj['signature'] === 'string' &&\n        typeof obj['key_id'] === 'string' &&\n        typeof obj['issued_at'] === 'string'\n    );\n}\n","/**\n * @hlos-ai/schemas - Branded ID Types\n *\n * Strongly-typed ID strings to prevent cross-surface mistakes.\n * Use Zod for runtime validation.\n */\n\nimport { z } from 'zod';\n\n// =============================================================================\n// ID Patterns\n// =============================================================================\n\n/**\n * ULID pattern (26 chars, Crockford base32).\n */\nconst ULID_PATTERN = /^[0-9A-HJKMNP-TV-Z]{26}$/i;\n\n/**\n * CUID pattern (starts with 'c', 25+ chars).\n */\nconst CUID_PATTERN = /^c[a-z0-9]{24,}$/;\n\n/**\n * UUID v4 pattern.\n */\nconst UUID_V4_PATTERN = /^[0-9a-f]{8}-[0-9a-f]{4}-4[0-9a-f]{3}-[89ab][0-9a-f]{3}-[0-9a-f]{12}$/i;\n\n// =============================================================================\n// Branded Types (TypeScript compile-time safety)\n// =============================================================================\n\ndeclare const WalletIdBrand: unique symbol;\ndeclare const PassportIdBrand: unique symbol;\ndeclare const ReceiptIdBrand: unique symbol;\ndeclare const CorrelationIdBrand: unique symbol;\ndeclare const IdempotencyKeyBrand: unique symbol;\ndeclare const CrossingIdBrand: unique symbol;\n\nexport type WalletId = string & { readonly [WalletIdBrand]: true };\nexport type PassportId = string & { readonly [PassportIdBrand]: true };\nexport type ReceiptId = string & { readonly [ReceiptIdBrand]: true };\nexport type CorrelationId = string & { readonly [CorrelationIdBrand]: true };\nexport type IdempotencyKey = string & { readonly [IdempotencyKeyBrand]: true };\nexport type CrossingId = string & { readonly [CrossingIdBrand]: true };\n\n// =============================================================================\n// Zod Schemas (runtime validation)\n// =============================================================================\n\n/**\n * WalletId: prefixed CUID or ULID.\n */\nexport const WalletIdSchema = z.string()\n    .regex(/^wallet_[a-z0-9]{20,}$/i, 'Invalid WalletId format')\n    .transform((s) => s as WalletId);\n\n/**\n * PassportId: prefixed CUID or ULID.\n */\nexport const PassportIdSchema = z.string()\n    .regex(/^passport_[a-z0-9]{20,}$/i, 'Invalid PassportId format')\n    .transform((s) => s as PassportId);\n\n/**\n * ReceiptId: prefixed ULID.\n */\nexport const ReceiptIdSchema = z.string()\n    .regex(/^rcpt_[0-9A-HJKMNP-TV-Z]{26}$/i, 'Invalid ReceiptId format')\n    .transform((s) => s as ReceiptId);\n\n/**\n * CorrelationId: UUID v4 or custom format.\n */\nexport const CorrelationIdSchema = z.string()\n    .min(8)\n    .max(128)\n    .transform((s) => s as CorrelationId);\n\n/**\n * IdempotencyKey: client-provided, opaque.\n * Max 256 chars, printable ASCII.\n */\nexport const IdempotencyKeySchema = z.string()\n    .min(1)\n    .max(256)\n    .regex(/^[\\x20-\\x7E]+$/, 'IdempotencyKey must be printable ASCII')\n    .transform((s) => s as IdempotencyKey);\n\n/**\n * CrossingId: prefixed CUID.\n */\nexport const CrossingIdSchema = z.string()\n    .regex(/^cross_[a-z0-9]{20,}$/i, 'Invalid CrossingId format')\n    .transform((s) => s as CrossingId);\n\n// =============================================================================\n// ID Generation Helpers\n// =============================================================================\n\n/**\n * Generate a prefixed CUID-style ID.\n * Uses crypto.randomUUID() stripped of dashes + timestamp prefix.\n */\nexport function generateId(prefix: string): string {\n    const timestamp = Date.now().toString(36);\n    const random = crypto.randomUUID().replace(/-/g, '').slice(0, 16);\n    return `${prefix}_${timestamp}${random}`;\n}\n\nexport const generateWalletId = (): WalletId => generateId('wallet') as WalletId;\nexport const generatePassportId = (): PassportId => generateId('passport') as PassportId;\nexport const generateReceiptId = (): ReceiptId => generateId('rcpt') as ReceiptId;\nexport const generateCrossingId = (): CrossingId => generateId('cross') as CrossingId;\n","/**\n * @hlos-ai/schemas - Shared Contract Types\n *\n * LOCKED CONTRACT — All tracks must import from this file.\n * No local redefinitions allowed.\n *\n * Contains:\n * - Response envelopes (KernelOk, KernelError, ApiResponse)\n * - Error codes (KernelErrorCode) - STRICT ENUM\n * - Attribution enums (FundingSource, CredentialSource)\n * - Crossing types (CrossingSnapshotV0, CrossingHashInputV0, CrossingSettledReceipt)\n * - Stack primitives (Stack, StackProvider, StackConnection)\n * - Test fixtures (golden vectors for conformance)\n */\n\nimport { z } from 'zod';\n\n// =============================================================================\n// ERROR CODES (STRICT ENUM - P0)\n// =============================================================================\n\n/**\n * Kernel error codes - STRICT ENUM.\n * Uses KernelErrorCodeSchema instead of z.string() to prevent drift.\n */\nexport const KernelErrorCodeSchema = z.enum([\n    // Validation / Request errors\n    'VALIDATION_ERROR',           // 400 - Input validation failed\n    'INVALID_REQUEST',            // 400 - Malformed request\n\n    // Auth errors\n    'UNAUTHORIZED',               // 401 - Missing/invalid auth\n    'FORBIDDEN',                  // 403 - Insufficient permissions\n\n    // Resource errors\n    'NOT_FOUND',                  // 404 - Generic not found\n    'CROSSING_NOT_FOUND',         // 404 - Crossing not found\n    'STACK_NOT_FOUND',            // 404 - Stack not found\n    'STACK_CONNECTION_NOT_FOUND', // 404 - Stack connection not found\n\n    // Conflict errors\n    'CONFLICT',                 // 409 - Generic conflict\n    'INVALID_STATE_TRANSITION',   // 409 - State machine violation\n    'CROSSING_ALREADY_SETTLED',   // 409 - Crossing already settled\n    'IDEMPOTENCY_CONFLICT',       // 409 - Same key, different request\n\n    // Payment errors\n    'INSUFFICIENT_BALANCE',       // 402 - Wallet lacks funds\n    'SPEND_CAP_EXCEEDED',         // 402 - Spend cap hit\n\n    // Rate limiting\n    'RATE_LIMITED',               // 429 - Too many requests\n\n    // Server errors\n    'INTERNAL_ERROR',             // 500 - Server error\n    'SERVICE_UNAVAILABLE',        // 503 - Temporarily unavailable\n]);\n\nexport type KernelErrorCode = z.infer<typeof KernelErrorCodeSchema>;\n\n/**\n * HTTP status code mapping for each error code.\n */\nexport const ERROR_CODE_STATUS: Record<KernelErrorCode, number> = {\n    VALIDATION_ERROR: 400,\n    INVALID_REQUEST: 400,\n    UNAUTHORIZED: 401,\n    FORBIDDEN: 403,\n    NOT_FOUND: 404,\n    CROSSING_NOT_FOUND: 404,\n    STACK_NOT_FOUND: 404,\n    STACK_CONNECTION_NOT_FOUND: 404,\n    CONFLICT: 409,\n    INVALID_STATE_TRANSITION: 409,\n    CROSSING_ALREADY_SETTLED: 409,\n    IDEMPOTENCY_CONFLICT: 409,\n    INSUFFICIENT_BALANCE: 402,\n    SPEND_CAP_EXCEEDED: 402,\n    RATE_LIMITED: 429,\n    INTERNAL_ERROR: 500,\n    SERVICE_UNAVAILABLE: 503,\n};\n\n// =============================================================================\n// RESPONSE ENVELOPES\n// =============================================================================\n\n/**\n * KernelOk - Standard success envelope.\n * Status: 200-299 (success) OR 304 (not modified).\n * NOT arbitrary 3xx (302 implies navigation semantics, not API success).\n */\nexport const KernelOkSchema = <T extends z.ZodType>(dataSchema: T) =>\n    z.object({\n        ok: z.literal(true),\n        status: z.union([\n            z.number().int().min(200).max(299),\n            z.literal(304),\n        ]),\n        data: dataSchema,\n    });\n\nexport type KernelOk<T> = {\n    ok: true;\n    status: number;\n    data: T;\n};\n\n/**\n * KernelError - Standard error envelope.\n * Uses STRICT KernelErrorCodeSchema.\n */\nexport const KernelErrorSchema = z.object({\n    ok: z.literal(false),\n    status: z.number().int().min(400).max(599),\n    error: z.object({\n        code: KernelErrorCodeSchema, // P0 FIX: was z.string()\n        message: z.string(),\n        details: z.record(z.unknown()).optional(),\n    }),\n});\n\nexport type KernelError = z.infer<typeof KernelErrorSchema>;\n\n/**\n * ApiResponse - Union of success and error.\n */\nexport type ApiResponse<T> = KernelOk<T> | KernelError;\n\n// =============================================================================\n// ID SCHEMAS (P0 - Format validators)\n// =============================================================================\n\n/**\n * CrossingId format: cross_[a-z0-9]{20,}\n */\nexport const CrossingIdFormatSchema = z.string()\n    .regex(/^cross_[a-z0-9]{20,}$/i, 'Invalid CrossingId format (expected: cross_...)');\n\n/**\n * ReceiptId format: rcpt_[0-9A-HJKMNP-TV-Z]{26}\n */\nexport const ReceiptIdFormatSchema = z.string()\n    .regex(/^rcpt_[0-9A-HJKMNP-TV-Z]{26}$/i, 'Invalid ReceiptId format (expected: rcpt_...)');\n\n/**\n * PassportId format: passport_[a-z0-9]{20,}\n */\nexport const PassportIdFormatSchema = z.string()\n    .regex(/^passport_[a-z0-9]{20,}$/i, 'Invalid PassportId format (expected: passport_...)');\n\n/**\n * WalletId format: wallet_[a-z0-9]{20,}\n */\nexport const WalletIdFormatSchema = z.string()\n    .regex(/^wallet_[a-z0-9]{20,}$/i, 'Invalid WalletId format (expected: wallet_...)');\n\n// =============================================================================\n// ATTRIBUTION ENUMS\n// =============================================================================\n\n/**\n * FundingSource - Who paid for this crossing.\n * Determined by credential_source (see mapping rule below).\n */\nexport const FundingSourceSchema = z.enum(['SPONSOR', 'PLATFORM', 'USER']);\nexport type FundingSource = z.infer<typeof FundingSourceSchema>;\n\n/**\n * CredentialSource - Where the credential came from.\n */\nexport const CredentialSourceSchema = z.enum([\n    'SPONSOR_KEY',   // Sponsor-provisioned key\n    'BYOK',          // Bring Your Own Key (user-provided)\n    'HLOS_FALLBACK', // Platform fallback credential\n]);\nexport type CredentialSource = z.infer<typeof CredentialSourceSchema>;\n\n/**\n * Deterministic funding mapping rule.\n * INVARIANT: credential_source determines funding_source.\n */\nexport function deriveFundingSource(credentialSource: CredentialSource): FundingSource {\n    switch (credentialSource) {\n        case 'SPONSOR_KEY':\n            return 'SPONSOR';\n        case 'BYOK':\n            return 'USER';\n        case 'HLOS_FALLBACK':\n            return 'PLATFORM';\n    }\n}\n\n// =============================================================================\n// CROSSING HASH INPUT\n// =============================================================================\n\n/**\n * CrossingSnapshotV0 - Stable fields for hash computation.\n *\n * INVARIANT: Must NOT include any derived or mutable fields:\n * - state, receiptIds, settledAt, createdAt/updatedAt\n */\nexport const CrossingSnapshotV0Schema = z.object({\n    crossingId: CrossingIdFormatSchema,\n    capabilityId: z.string(),\n    passportId: PassportIdFormatSchema,\n\n    // Scoping\n    event_id: z.string().nullable(),\n    access_window_id: z.string().nullable(),\n    access_grant_id: z.string().nullable(),\n\n    // Attribution\n    attribution_org_id: z.string().nullable(),\n    funding_source: FundingSourceSchema.nullable(),\n    credential_source: CredentialSourceSchema,\n});\n\nexport type CrossingSnapshotV0 = z.infer<typeof CrossingSnapshotV0Schema>;\n\n/**\n * CrossingHashInputV0 - Input to hash function.\n * Uses version marker for future-proofing.\n */\nexport const CrossingHashInputV0Schema = z.object({\n    v: z.literal(0),\n    snapshot: CrossingSnapshotV0Schema,\n    attested_receipt_id: ReceiptIdFormatSchema,\n});\n\nexport type CrossingHashInputV0 = z.infer<typeof CrossingHashInputV0Schema>;\n\n// =============================================================================\n// CROSSING SETTLED RECEIPT\n// =============================================================================\n\n/**\n * SettlementAuthority - LITERAL (no drift).\n */\nexport const SETTLEMENT_AUTHORITY = 'hlos.ai' as const;\n\n/**\n * CrossingSettledReceipt - Issued when crossing reaches SETTLED state.\n */\nexport const CrossingSettledReceiptSchema = z.object({\n    type: z.literal('CrossingSettled'),\n    crossingId: CrossingIdFormatSchema,\n\n    // Scoping (powers adoption + ROI views)\n    event_id: z.string().nullable(),\n    access_window_id: z.string().nullable(),\n    access_grant_id: z.string().nullable(),\n\n    // Attribution\n    attribution_org_id: z.string().nullable(),\n    funding_source: FundingSourceSchema.nullable(),\n    credential_source: CredentialSourceSchema,\n\n    // Authority (LITERAL)\n    settlement_authority: z.literal(SETTLEMENT_AUTHORITY),\n\n    // Binding\n    crossing_hash: z.string(),        // sha256 base64url of CrossingHashInputV0\n    attested_receipt_id: z.string(),\n\n    // Timestamp\n    settled_at: z.string().datetime(),\n});\n\nexport type CrossingSettledReceipt = z.infer<typeof CrossingSettledReceiptSchema>;\n\n// =============================================================================\n// STACK PRIMITIVES (Product Layer)\n// =============================================================================\n\n/**\n * AvailabilityType - Provider availability classification.\n */\nexport const AvailabilityTypeSchema = z.enum([\n    'EVENT_SPONSOR', // Sponsor-funded for specific event\n    'EVERGREEN',     // Always available platform credit\n    'CATALOG',       // User-paid from catalog\n]);\nexport type AvailabilityType = z.infer<typeof AvailabilityTypeSchema>;\n\n/**\n * ProviderRole - P1: Constrained enum for provider roles.\n */\nexport const ProviderRoleSchema = z.enum([\n    'AI',         // AI/LLM providers (Gemini, GPT, Claude)\n    'DATABASE',   // Database providers (MongoDB, Supabase)\n    'AUTH',       // Auth providers (Clerk, Auth0)\n    'DEPLOY',     // Deployment providers (Vercel, Cloudflare)\n    'STORAGE',    // Storage providers (S3, R2)\n    'SEARCH',     // Search providers (Algolia, Pinecone)\n    'PAYMENTS',   // Payment providers (Stripe)\n    'COMPUTE',    // Compute providers (Modal, Replicate)\n    'OTHER',      // Catch-all for new categories\n]);\nexport type ProviderRole = z.infer<typeof ProviderRoleSchema>;\n\n/**\n * StackProvider - Provider within a stack.\n */\nexport const StackProviderSchema = z.object({\n    provider_id: z.string(),\n    role: ProviderRoleSchema, // P1: Now a constrained enum\n    display_name: z.string(),\n    budget_allocation: z.number().nonnegative(),\n    sku_ids: z.array(z.string()),\n    availability_type: AvailabilityTypeSchema,\n});\n\nexport type StackProvider = z.infer<typeof StackProviderSchema>;\n\n/**\n * Stack - Curated capability bundle.\n */\nexport const StackSchema = z.object({\n    id: z.string(),\n    slug: z.string(),\n    name: z.string(),\n    tagline: z.string(),\n    icon: z.string(),\n    providers: z.array(StackProviderSchema),\n    github_template: z.string().nullable(),\n    total_budget: z.number().nonnegative(),\n    event_id: z.string().nullable(), // null = evergreen\n});\n\nexport type Stack = z.infer<typeof StackSchema>;\n\n/**\n * StackConnection - User's connection to a stack.\n */\nexport const StackConnectionSchema = z.object({\n    id: z.string(),\n    stack_id: z.string(),\n    passport_id: z.string(),\n    team_id: z.string().nullable(),\n    environment_id: z.string(),\n    connected_at: z.string().datetime(),\n    connected_providers: z.array(z.string()),\n});\n\nexport type StackConnection = z.infer<typeof StackConnectionSchema>;\n\n// =============================================================================\n// HELPER FACTORIES\n// =============================================================================\n\n/**\n * Create a KernelOk response.\n */\nexport function kernelOk<T>(data: T, status: number = 200): KernelOk<T> {\n    return { ok: true, status, data };\n}\n\n/**\n * Create a KernelError response.\n */\nexport function kernelError(\n    code: KernelErrorCode, // P0: Now typed to KernelErrorCode\n    message: string,\n    status?: number,\n    details?: Record<string, unknown>\n): KernelError {\n    return {\n        ok: false,\n        status: status ?? ERROR_CODE_STATUS[code],\n        error: {\n            code,\n            message,\n            ...(details && { details }),\n        },\n    };\n}\n\n// =============================================================================\n// GOLDEN TEST FIXTURES (P1 - Conformance testing)\n// =============================================================================\n\n/**\n * Golden test fixtures for downstream conformance testing.\n * Surfaces (MCP, Agent Passport, Caravan, events-hlos) can import these\n * to verify they're hashing/encoding/typing identically.\n */\nexport const GOLDEN_FIXTURES = {\n    /**\n     * Sample CrossingHashInputV0 for hash conformance.\n     */\n    crossingHashInput: {\n        v: 0 as const,\n        snapshot: {\n            crossingId: 'cross_test123abc456def789ghi',\n            capabilityId: 'gemini.generate.v1',\n            passportId: 'passport_user123abc456def789g',\n            event_id: 'evt_hackathon2026',\n            access_window_id: 'aw_sponsor_mongodb',\n            access_grant_id: 'ag_team_001',\n            attribution_org_id: 'mongodb',\n            funding_source: 'SPONSOR' as const,\n            credential_source: 'SPONSOR_KEY' as const,\n        },\n        attested_receipt_id: 'rcpt_01HZABCDEF1234567890ABCDEF',\n    } satisfies CrossingHashInputV0,\n\n    /**\n     * Expected crossing_hash for the above input (FROZEN).\n     * Compute: JCS canonicalize → SHA-256 → base64url (no padding)\n     *\n     * This is the golden vector. If your hash differs, your implementation\n     * is not conformant. DO NOT CHANGE unless crossingHashInput changes.\n     */\n    expectedCrossingHash_base64url_sha256_jcs_v0: 'z8A2kCNck4rPL4ugNe-Fbxputdi3PkjkVpSrIBhojU0',\n\n    /**\n     * Sample CrossingSettledReceipt.\n     */\n    crossingSettledReceipt: {\n        type: 'CrossingSettled' as const,\n        crossingId: 'cross_test123abc456def789ghi',\n        event_id: 'evt_hackathon2026',\n        access_window_id: 'aw_sponsor_mongodb',\n        access_grant_id: 'ag_team_001',\n        attribution_org_id: 'mongodb',\n        funding_source: 'SPONSOR' as const,\n        credential_source: 'SPONSOR_KEY' as const,\n        settlement_authority: 'hlos.ai' as const,\n        crossing_hash: 'z8A2kCNck4rPL4ugNe-Fbxputdi3PkjkVpSrIBhojU0',\n        attested_receipt_id: 'rcpt_01HZABCDEF1234567890ABCDEF',\n        settled_at: '2026-01-24T12:00:00.000Z',\n    } satisfies CrossingSettledReceipt,\n} as const;\n\n/**\n * Type guard: check if a value is a valid CrossingHashInputV0.\n */\nexport function isCrossingHashInputV0(value: unknown): value is CrossingHashInputV0 {\n    return CrossingHashInputV0Schema.safeParse(value).success;\n}\n\n/**\n * Type guard: check if a value is a valid CrossingSettledReceipt.\n */\nexport function isCrossingSettledReceipt(value: unknown): value is CrossingSettledReceipt {\n    return CrossingSettledReceiptSchema.safeParse(value).success;\n}\n","/**\n * Family W — Privacy-Preserving Proofs (Phase 1 Lock)\n *\n * CC-W-01: RP-specific pseudonym derivation + rotation\n * CC-W-03: transaction_context_hash binding prevents replay\n *\n * Phase 1 schemas are LOCKED. Any changes require:\n * - Golden vector updates\n * - Invariants note\n * - Contract tests\n *\n * @packageDocumentation\n */\n\nimport { z } from 'zod';\n\n// =============================================================================\n// Domain Separators (FROZEN)\n// =============================================================================\n\n/**\n * RPID derivation domain separator.\n * Used in HKDF info: concat(W_RPID_DOMAIN, encodeEpoch(epoch))\n */\nexport const W_RPID_DOMAIN = new TextEncoder().encode('W:RPID:v1');\n\n/**\n * Transaction context domain separator (reserved for future use).\n */\nexport const W_TXCTX_DOMAIN = new TextEncoder().encode('W:TXCTX:v1');\n\n// =============================================================================\n// Epoch Encoding (FROZEN)\n// =============================================================================\n\n/**\n * Encode rotation epoch as u64 big-endian bytes.\n *\n * Input normalization:\n * - number: treated as milliseconds since Unix epoch\n * - string: parsed as RFC3339 datetime, converted to ms\n *\n * INVARIANT: All epochs normalize to millisecond timestamps with strict RFC3339 validation.\n *\n * @param epoch - Epoch as ms number or RFC3339 string\n * @returns 8-byte Uint8Array (u64 big-endian)\n * @throws Error if string is not valid RFC3339\n */\n/**\n * RFC3339 datetime pattern (requires timezone, excludes date-only).\n * Examples: 2026-01-29T00:00:00Z, 2026-01-29T00:00:00+00:00\n */\nconst RFC3339_CAPTURING =\n    /^(\\d{4})-(\\d{2})-(\\d{2})T(\\d{2}):(\\d{2}):(\\d{2})(\\.(\\d{1,9}))?(Z|([+-])(\\d{2}):(\\d{2}))$/;\n\nfunction isLeapYear(year: number): boolean {\n    return (year % 4 === 0 && year % 100 !== 0) || (year % 400 === 0);\n}\n\nfunction daysInMonth(year: number, month: number): number {\n    const days = [31, isLeapYear(year) ? 29 : 28, 31, 30, 31, 30, 31, 31, 30, 31, 30, 31];\n    return days[month - 1] ?? 0;\n}\n\nfunction parseRfc3339StrictToMs(value: string): number {\n    const match = RFC3339_CAPTURING.exec(value);\n    if (!match) {\n        throw new Error(\n            `Invalid epoch: \"${value}\" is not a valid RFC3339 datetime (requires time and timezone)`\n        );\n    }\n\n    const year = Number(match[1]);\n    const month = Number(match[2]);\n    const day = Number(match[3]);\n    const hour = Number(match[4]);\n    const minute = Number(match[5]);\n    const second = Number(match[6]);\n    const fraction = match[8] ?? '';\n    const tz = match[9];\n\n    if (month < 1 || month > 12) {\n        throw new Error('Invalid epoch: month out of range');\n    }\n    const maxDay = daysInMonth(year, month);\n    if (day < 1 || day > maxDay) {\n        throw new Error('Invalid epoch: day out of range');\n    }\n    if (hour > 23) {\n        throw new Error('Invalid epoch: hour out of range');\n    }\n    if (minute > 59) {\n        throw new Error('Invalid epoch: minute out of range');\n    }\n    if (second > 59) {\n        throw new Error('Invalid epoch: second out of range');\n    }\n\n    const msFraction = fraction.length ? Number((fraction + '000').slice(0, 3)) : 0;\n    const utcMs = Date.UTC(year, month - 1, day, hour, minute, second, msFraction);\n\n    let offsetMs = 0;\n    if (tz !== 'Z') {\n        const sign = match[10] === '-' ? -1 : 1;\n        const offsetHour = Number(match[11]);\n        const offsetMinute = Number(match[12]);\n        if (offsetHour > 23) {\n            throw new Error('Invalid epoch: tz hour out of range');\n        }\n        if (offsetMinute > 59) {\n            throw new Error('Invalid epoch: tz minute out of range');\n        }\n        offsetMs = sign * (offsetHour * 60 + offsetMinute) * 60_000;\n    }\n\n    const ms = utcMs - offsetMs;\n    if (!Number.isFinite(ms) || ms < 0) {\n        throw new Error('Invalid epoch: must be a non-negative timestamp');\n    }\n\n    return ms;\n}\n\nexport function encodeEpoch(epoch: number | string): Uint8Array {\n    let ms: number;\n\n    if (typeof epoch === 'string') {\n        ms = parseRfc3339StrictToMs(epoch);\n    } else {\n        if (!Number.isInteger(epoch) || epoch < 0) {\n            throw new Error(`Invalid epoch: ${epoch} must be a non-negative integer`);\n        }\n        ms = epoch;\n    }\n\n    const buf = new ArrayBuffer(8);\n    const view = new DataView(buf);\n    view.setBigUint64(0, BigInt(ms), false); // big-endian\n    return new Uint8Array(buf);\n}\n\n// =============================================================================\n// RelyingPartyId Schema\n// =============================================================================\n\n/**\n * Relying Party identifier.\n * Uniquely identifies a verifier/merchant for pseudonym derivation.\n */\nexport const RelyingPartyIdSchema = z.object({\n    /** RP domain (e.g., \"merchant.example.com\") */\n    domain: z.string().min(1).max(253),\n    /** Audience URI (e.g., \"https://merchant.example.com/verify\") */\n    audience_uri: z.string().url(),\n    /** SHA-256 hash of verifier's public key (hex, 64 chars) */\n    verifier_key_hash: z.string().regex(/^[a-f0-9]{64}$/, 'Must be 64-char lowercase hex'),\n});\n\nexport type RelyingPartyId = z.infer<typeof RelyingPartyIdSchema>;\n\n// =============================================================================\n// RotationEpoch Schema\n// =============================================================================\n\n/**\n * Rotation epoch for RPID derivation.\n *\n * Accepts:\n * - number: milliseconds since Unix epoch (non-negative integer)\n * - string: RFC3339 datetime (e.g., \"2026-01-29T00:00:00Z\")\n *\n * INVARIANT: All epochs normalize to millisecond timestamps via encodeEpoch().\n */\nexport const RotationEpochSchema = z.union([\n    z.number().int().nonnegative(),\n    z.string().datetime({ offset: true }), // Requires timezone offset (RFC3339)\n]);\n\nexport type RotationEpoch = z.infer<typeof RotationEpochSchema>;\n\n// =============================================================================\n// RPID Schema\n// =============================================================================\n\n/**\n * RP-specific pseudonym.\n * Base64url-encoded, 32 bytes = 43 chars without padding.\n * We prefer no-padding format per RFC 7515.\n */\nexport const RPIDSchema = z\n    .string()\n    .length(43, 'RPID must be base64url-encoded 32 bytes (43 chars, no padding)')\n    .regex(/^[A-Za-z0-9_-]+$/, 'Must be base64url (no padding)');\n\nexport type RPID = z.infer<typeof RPIDSchema>;\n\n// =============================================================================\n// TransactionContext Schema (Minimal Core)\n// =============================================================================\n\n/**\n * Transaction context for replay protection.\n *\n * Core fields (required, stable):\n * - relying_party_id: who is verifying\n * - operation_hash: sha256(JCS({ intent, request }))\n * - not_before/not_after: validity window\n *\n * Optional fields (part of hash, must be consistent):\n * - amount/currency: economic context\n * - surface_id/channel_id: routing context\n */\nexport const TransactionContextSchema = z.object({\n    // Required core (stable)\n    relying_party_id: RelyingPartyIdSchema,\n    /** sha256(JCS({ intent, request })) — see computeOperationHash() */\n    operation_hash: z.string().regex(/^[a-f0-9]{64}$/, 'Must be 64-char lowercase hex'),\n    /** Validity start (RFC3339) */\n    not_before: z.string().datetime({ offset: true }),\n    /** Validity end (RFC3339) */\n    not_after: z.string().datetime({ offset: true }),\n\n    // Optional (part of hash, must be consistent)\n    amount: z.number().nonnegative().optional(),\n    currency: z.string().length(3).optional(),\n    surface_id: z.string().optional(),\n    channel_id: z.string().optional(),\n});\n\nexport type TransactionContext = z.infer<typeof TransactionContextSchema>;\n\n// =============================================================================\n// TransactionContextHash Schema\n// =============================================================================\n\n/**\n * SHA-256 hash of JCS-canonicalized TransactionContext.\n * 64-character lowercase hex string.\n */\nexport const TransactionContextHashSchema = z\n    .string()\n    .regex(/^[a-f0-9]{64}$/, 'Must be 64-char lowercase hex');\n\nexport type TransactionContextHash = z.infer<typeof TransactionContextHashSchema>;\n\n// =============================================================================\n// Golden Fixtures (FROZEN)\n// =============================================================================\n\n/**\n * Golden fixtures for Phase 1 W schemas.\n * Used for drift detection and cross-repo alignment.\n */\nexport const W_GOLDEN_FIXTURES = {\n    /**\n     * encodeEpoch(1706486400000) = 2024-01-29T00:00:00.000Z\n     * Expected: 8 bytes, u64 big-endian\n     */\n    epochMs: 1706486400000,\n    expectedEpochBytes: new Uint8Array([0x00, 0x00, 0x01, 0x8d, 0x52, 0x84, 0x04, 0x00]),\n\n    /**\n     * Sample RelyingPartyId for test vectors\n     */\n    sampleRpId: {\n        domain: 'merchant.example.com',\n        audience_uri: 'https://merchant.example.com/verify',\n        verifier_key_hash: 'a'.repeat(64),\n    } satisfies RelyingPartyId,\n\n    /**\n     * Sample TransactionContext for test vectors\n     */\n    sampleTxContext: {\n        relying_party_id: {\n            domain: 'merchant.example.com',\n            audience_uri: 'https://merchant.example.com/verify',\n            verifier_key_hash: 'a'.repeat(64),\n        },\n        operation_hash: 'b'.repeat(64),\n        not_before: '2026-01-29T00:00:00Z',\n        not_after: '2026-01-29T00:05:00Z',\n    } satisfies TransactionContext,\n\n    /**\n     * MAX_WINDOW_MS: Maximum allowed not_after - not_before (5 minutes)\n     */\n    MAX_WINDOW_MS: 5 * 60 * 1000,\n} as const;\n\n// =============================================================================\n// Validation Helpers\n// =============================================================================\n\n/**\n * Validate transaction context time window.\n *\n * Enforces:\n * - not_after > not_before\n * - not_after - not_before <= MAX_WINDOW_MS\n *\n * @param context - Transaction context to validate\n * @returns true if valid, throws otherwise\n */\nexport function validateTimeWindow(context: TransactionContext): boolean {\n    let notBefore: number;\n    let notAfter: number;\n\n    try {\n        notBefore = parseRfc3339StrictToMs(context.not_before);\n        notAfter = parseRfc3339StrictToMs(context.not_after);\n    } catch {\n        throw new Error('Invalid timestamp: not_before/not_after must be RFC3339 with timezone');\n    }\n\n    if (notAfter <= notBefore) {\n        throw new Error('not_after must be greater than not_before');\n    }\n\n    const windowMs = notAfter - notBefore;\n    if (windowMs > W_GOLDEN_FIXTURES.MAX_WINDOW_MS) {\n        throw new Error(\n            `Time window ${windowMs}ms exceeds MAX_WINDOW_MS (${W_GOLDEN_FIXTURES.MAX_WINDOW_MS}ms)`\n        );\n    }\n\n    return true;\n}\n","/**\n * @hlos-ai/schemas - Agents Contracts\n *\n * Shared schemas for Agents Index + Passport Stub.\n * Routes are authoritative source of truth; these schemas validate conformance.\n *\n * Design choices:\n * - .passthrough() allows extra fields without breaking\n * - Enums use .or(z.string()) pattern for forward compatibility\n * - passport_id is z.null() as a boundary constraint\n */\n\nimport { z } from 'zod';\n\n// =============================================================================\n// AGENT ENUMS (Forward-compatible)\n// =============================================================================\n\n/**\n * AgentStatus - Known values documented, but accepts future additions.\n */\nexport const AgentStatusSchema = z\n    .enum(['ACTIVE', 'PENDING', 'SUSPENDED', 'REVOKED'])\n    .or(z.string().min(1));\n\nexport type AgentStatus = z.infer<typeof AgentStatusSchema>;\n\n/**\n * AgentType - Known values documented, but accepts future additions.\n */\nexport const AgentTypeSchema = z\n    .enum(['CUSTOM', 'CLAUDE', 'GPT', 'GEMINI', 'CURSOR', 'COPILOT', 'OTHER'])\n    .or(z.string().min(1));\n\nexport type AgentType = z.infer<typeof AgentTypeSchema>;\n\n// =============================================================================\n// AGENTS LIST RESPONSE\n// =============================================================================\n\n/**\n * Agent item in list response (snake_case wire format).\n */\nexport const AgentListItemSchema = z\n    .object({\n        id: z.string().min(1),\n        external_id: z.string().min(1),\n        name: z.string().min(1),\n        status: AgentStatusSchema,\n        agent_type: AgentTypeSchema,\n        trust_score: z.number().int().min(0).max(1000),\n        hosting_model: z.null(),\n        declared_tier: z.null(),\n        created_at: z.string().datetime(),\n    })\n    .passthrough();\n\nexport type AgentListItem = z.infer<typeof AgentListItemSchema>;\n\n/**\n * GET /api/agents response schema.\n * _meta.source: \"hlos\" (authoritative list)\n */\nexport const AgentsListResponseSchema = z\n    .object({\n        agents: z.array(AgentListItemSchema),\n        _meta: z.object({\n            source: z.literal('hlos'),\n        }),\n    })\n    .passthrough();\n\nexport type AgentsListResponse = z.infer<typeof AgentsListResponseSchema>;\n\n// =============================================================================\n// AGENT PASSPORT STUB RESPONSE\n// =============================================================================\n\n/**\n * GET /api/agents/[agentId]/passport response schema.\n *\n * BOUNDARY CONSTRAINT:\n * - passport_id MUST be null (HLOS does not mint passports)\n * - _meta.source: \"stub\" signals non-authoritative response\n * - All counters/tiers are null until backed by Agent-Passport system\n */\nexport const AgentPassportStubResponseSchema = z\n    .object({\n        passport_id: z.null(),\n        agent_id: z.string().min(1),\n        hosting_model: z.null(),\n        declared_tier: z.null(),\n        effective_tier: z.null(),\n        finality_level: z.null(),\n        graph: z\n            .object({\n                incoming_edges: z.null(),\n                outgoing_edges: z.null(),\n                active_visas: z.null(),\n            })\n            .passthrough(),\n        links: z\n            .object({\n                passport_url: z.string().startsWith('/agent-passport/agents/'),\n                docs_url: z.literal('/agents/passport'),\n            })\n            .passthrough(),\n        _meta: z.object({\n            source: z.literal('stub'),\n        }),\n    })\n    .passthrough();\n\nexport type AgentPassportStubResponse = z.infer<typeof AgentPassportStubResponseSchema>;\n","/**\n * @hlos-ai/schemas - Base64url Encoding Utilities\n *\n * RFC 4648 §5 compliant base64url encoding/decoding.\n * Zero external dependencies.\n *\n * Used for:\n * - receipt_hash: base64url(SHA-256(JCS(receipt)))\n * - content_hash: base64url(SHA-256(JCS(content)))\n * - crossing_hash: base64url(SHA-256(JCS(CrossingHashInputV0)))\n * - Ed25519 signatures and public keys\n */\n\nimport { z } from 'zod';\n\n// =============================================================================\n// Encoding\n// =============================================================================\n\n/**\n * Encode Uint8Array to base64url (RFC 4648 §5, no padding).\n */\nexport function bytesToBase64url(bytes: Uint8Array): string {\n    let binary = '';\n    for (let i = 0; i < bytes.length; i++) {\n        binary += String.fromCharCode(bytes[i]);\n    }\n    const base64 = btoa(binary);\n    return base64.replace(/\\+/g, '-').replace(/\\//g, '_').replace(/=+$/, '');\n}\n\n/**\n * Decode base64url string to Uint8Array.\n */\nexport function base64urlToBytes(str: string): Uint8Array {\n    const base64 = str.replace(/-/g, '+').replace(/_/g, '/');\n    const padded = base64 + '='.repeat((4 - (base64.length % 4)) % 4);\n    const binary = atob(padded);\n    const bytes = new Uint8Array(binary.length);\n    for (let i = 0; i < binary.length; i++) {\n        bytes[i] = binary.charCodeAt(i);\n    }\n    return bytes;\n}\n\n// =============================================================================\n// Schemas\n// =============================================================================\n\n/**\n * Regex for base64url-encoded SHA-256 hash (32 bytes = 43 chars, no padding).\n */\nexport const BASE64URL_SHA256_REGEX = /^[A-Za-z0-9_-]{43}$/;\n\n/**\n * Zod schema for a base64url-encoded SHA-256 hash.\n * 32 bytes = 43 chars base64url (no padding).\n */\nexport const Base64urlSha256Schema = z.string().regex(\n    BASE64URL_SHA256_REGEX,\n    'Must be 43-char base64url (32-byte SHA-256 digest)'\n);\n\n/**\n * Zod schema for a base64url-encoded Ed25519 signature.\n * 64 bytes = 86 chars base64url (no padding).\n */\nexport const Base64urlEd25519SigSchema = z.string().regex(\n    /^[A-Za-z0-9_-]{86}$/,\n    'Must be 86-char base64url (64-byte Ed25519 signature)'\n);\n","/**\n * @hlos-ai/schemas - Receipt Hash Computation\n *\n * Canonical hash computation for HLOS receipts.\n *\n * receipt_hash = base64url(SHA-256(JCS(receipt)))\n *\n * This is the hash that:\n * - BazaarReceiptEnvelope references (hash-first, per BRIDGE_SPEC.md §1.1)\n * - Notary Attestation (NA) binds to (per BRIDGE_SPEC.md §4.3)\n * - Surfaces use to reference kernel receipts unambiguously\n *\n * IMPORTANT: receipt_hash is computed over the ENTIRE SignedReceiptV0 envelope\n * (including content, content_hash, signature, key_id, etc.), NOT just content.\n * This binds the hash to a specific signed receipt version.\n *\n * Requires @noble/hashes as peer dependency.\n *\n * @see BRIDGE_SPEC.md §1.3 for canonical hashing requirements\n */\n\nimport { z } from 'zod';\nimport { bytesToBase64url, Base64urlSha256Schema } from './encoding';\nimport type { SignedReceiptV0 } from './receipt-v0';\n\nlet cachedSha256: ((data: Uint8Array) => Uint8Array) | null = null;\n\n// =============================================================================\n// JCS Canonicalization (RFC 8785)\n// =============================================================================\n\n/**\n * Recursively sort object keys lexicographically (RFC 8785 requirement).\n * @internal\n */\nfunction sortKeysDeep(value: unknown): unknown {\n    if (Array.isArray(value)) return value.map(sortKeysDeep);\n    if (value !== null && typeof value === 'object') {\n        const obj = value as Record<string, unknown>;\n        const out: Record<string, unknown> = {};\n        for (const key of Object.keys(obj).sort()) {\n            out[key] = sortKeysDeep(obj[key]);\n        }\n        return out;\n    }\n    return value;\n}\n\n/**\n * JCS (RFC 8785) canonical JSON serialization.\n *\n * Per RFC 8785:\n * - Object keys are lexicographically sorted\n * - Numbers use ES6 serialization\n * - Rejects: undefined, functions, symbols, bigint, non-finite numbers\n *\n * @throws Error if value contains non-canonicalizable types\n */\nexport function jcsCanonicalize(value: unknown): string {\n    return JSON.stringify(sortKeysDeep(value), (_key, v) => {\n        if (v === undefined) throw new Error('JCS: undefined is not allowed');\n        if (typeof v === 'function') throw new Error('JCS: function is not allowed');\n        if (typeof v === 'symbol') throw new Error('JCS: symbol is not allowed');\n        if (typeof v === 'bigint') throw new Error('JCS: bigint is not allowed');\n        if (typeof v === 'number' && !Number.isFinite(v))\n            throw new Error('JCS: non-finite number is not allowed');\n        return v;\n    });\n}\n\n// =============================================================================\n// Hash Computation\n// =============================================================================\n\n/**\n * Compute receipt_hash for a SignedReceiptV0.\n *\n * receipt_hash = base64url(SHA-256(JCS(receipt)))\n *\n * The hash is over the ENTIRE receipt envelope (content, content_hash,\n * signature, key_id, @type, version, receipt_id, issued_at).\n *\n * This is the canonical hash format per BRIDGE_SPEC.md §1.3:\n * 1. Canonicalize the receipt using RFC 8785 JCS\n * 2. Hash canonical bytes using SHA-256\n * 3. Encode as base64url (no padding)\n *\n * @param receipt - A fully-formed SignedReceiptV0 (must already be signed)\n * @returns 43-char base64url string (32-byte SHA-256 digest)\n *\n * @example\n * ```typescript\n * const receipt = issueReceiptV0(content);\n * const hash = computeReceiptHash(receipt);\n * // hash is e.g. \"z8A2kCNck4rPL4ugNe-Fbxputdi3PkjkVpSrIBhojU0\"\n * ```\n */\nexport function computeReceiptHash(receipt: SignedReceiptV0): string {\n    // Lazy-load to keep this module usable without @noble/hashes installed\n    // (only fails at call time if peer dep is missing)\n    const sha256 = loadSha256();\n    const canonical = jcsCanonicalize(receipt);\n    const digest = sha256(new TextEncoder().encode(canonical));\n    return bytesToBase64url(digest);\n}\n\n/**\n * Compute content_hash for arbitrary content.\n *\n * content_hash = base64url(SHA-256(JCS(content)))\n *\n * This is the hash stored in SignedReceiptV0.content_hash.\n * It hashes only the content field, NOT the entire receipt.\n *\n * @param content - The content to hash (will be JCS-canonicalized)\n * @returns 43-char base64url string (32-byte SHA-256 digest)\n */\nexport function computeContentHash(content: unknown): string {\n    const sha256 = loadSha256();\n    const canonical = jcsCanonicalize(content);\n    const digest = sha256(new TextEncoder().encode(canonical));\n    return bytesToBase64url(digest);\n}\n\n/**\n * Lazy-load SHA-256 from @noble/hashes (optional peer dependency).\n * @internal\n */\nfunction loadSha256(): (data: Uint8Array) => Uint8Array {\n    if (cachedSha256) return cachedSha256;\n\n    // Resolve require for both ESM and CJS contexts.\n    // In CJS (Jest/ts-jest): globalThis.require exists natively.\n    // In ESM (tsup build): createRequire bridges to Node's require.\n    let _require: NodeRequire;\n    try {\n        // eslint-disable-next-line @typescript-eslint/no-require-imports\n        const { createRequire } = require('node:module');\n        _require = createRequire(import.meta.url);\n    } catch {\n        // CJS context (e.g. Jest) — global require is available\n        // eslint-disable-next-line @typescript-eslint/no-require-imports\n        _require = require;\n    }\n\n    let sha256: (data: Uint8Array) => Uint8Array;\n    try {\n        // @noble/hashes v2.x exports from sha2.js\n        sha256 = _require('@noble/hashes/sha2.js').sha256;\n    } catch {\n        try {\n            // Fallback for bundlers that resolve without .js extension\n            sha256 = _require('@noble/hashes/sha2').sha256;\n        } catch {\n            throw new Error(\n                'computeReceiptHash/computeContentHash requires @noble/hashes as a peer dependency. ' +\n                'Install it: npm install @noble/hashes'\n            );\n        }\n    }\n    cachedSha256 = sha256;\n    return sha256;\n}\n\n// =============================================================================\n// Schemas\n// =============================================================================\n\n/**\n * Zod schema for receipt_hash field.\n * base64url(SHA-256(JCS(receipt))) — always 43 chars.\n */\nexport const ReceiptHashSchema = Base64urlSha256Schema.describe(\n    'receipt_hash: base64url(SHA-256(JCS(receipt)))'\n);\n\n// =============================================================================\n// Golden Fixtures\n// =============================================================================\n\n/**\n * Golden receipt fixture for hash conformance testing.\n *\n * This is a deterministic SignedReceiptV0 with fixed field values.\n * The receipt_hash computed over this fixture is FROZEN.\n *\n * If your computeReceiptHash() produces a different result for this input,\n * your implementation is non-conformant. DO NOT CHANGE these values.\n */\nexport const RECEIPT_HASH_GOLDEN_FIXTURE = {\n    receipt: {\n        '@type': 'https://hlos.ai/schema/SignedReceiptV0' as const,\n        version: 0 as const,\n        receipt_id: 'rcpt_01HZGOLDENTEST000000000000',\n        content: {\n            type: 'CrossingSettled' as const,\n            crossingId: 'cross_test123abc456def789ghi',\n            settlement_authority: 'hlos.ai',\n        },\n        // Placeholder bytes (NOT a valid cryptographic signature)\n        content_hash: 'AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA',\n        signature:\n            'AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA',\n        key_id: 'hlos-v2-1',\n        issued_at: '2026-01-27T00:00:00.000Z',\n    } satisfies SignedReceiptV0,\n\n    /**\n     * Expected JCS canonical form of the receipt.\n     * Keys are lexicographically sorted at all levels.\n     */\n    expectedJcs: '{\"@type\":\"https://hlos.ai/schema/SignedReceiptV0\",\"content\":{\"crossingId\":\"cross_test123abc456def789ghi\",\"settlement_authority\":\"hlos.ai\",\"type\":\"CrossingSettled\"},\"content_hash\":\"AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA\",\"issued_at\":\"2026-01-27T00:00:00.000Z\",\"key_id\":\"hlos-v2-1\",\"receipt_id\":\"rcpt_01HZGOLDENTEST000000000000\",\"signature\":\"AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA\",\"version\":0}',\n\n    /**\n     * Expected receipt_hash (FROZEN).\n     * Compute: JCS canonicalize receipt → SHA-256 → base64url (no padding)\n     *\n     * DO NOT CHANGE unless the receipt fixture above changes.\n     */\n    expectedReceiptHash: 'uLiQVUeVKcE35Rdje2fArZQfTcECDgwK6UbmQB_36Pg',\n} as const;\n","/**\n * @hlos-ai/schemas - Finality Schemas\n *\n * Defines the Notary Attestation (NA) schema and related types\n * for HLOS kernel-level HARD finality.\n *\n * Per BRIDGE_SPEC.md §4:\n * - SOFT finality: SignedReceiptV0 signed by settlement authority hlos.ai\n * - HARD finality: SignedReceiptV0 + NA where STAAMPID countersigns receipt_hash\n *\n * HARD finality is a platform feature (POST /api/finality/notarize),\n * not surface-specific. Any surface can request it.\n *\n * @see BRIDGE_SPEC.md §4.3 for NA schema\n * @see BRIDGE_SPEC.md §4.2 for notarize endpoint\n */\n\nimport { z } from 'zod';\nimport { Base64urlSha256Schema, Base64urlEd25519SigSchema } from './encoding';\nimport { SETTLEMENT_AUTHORITY } from './shared-contract';\n\n// =============================================================================\n// Constants\n// =============================================================================\n\n/**\n * NA ID prefix.\n */\nexport const NA_ID_PREFIX = 'na_' as const;\n\n/**\n * Finality levels.\n */\nexport const FinalityLevel = {\n    SOFT: 'SOFT',\n    HARD: 'HARD',\n} as const;\n\nexport type FinalityLevel = (typeof FinalityLevel)[keyof typeof FinalityLevel];\n\n// =============================================================================\n// ID Format\n// =============================================================================\n\n/**\n * Notary Attestation ID format: na_ + alphanumeric (20+ chars).\n */\nexport const NotaryAttestationIdFormatSchema = z.string().regex(\n    /^na_[a-zA-Z0-9]{20,}$/,\n    'NA ID must match na_[a-zA-Z0-9]{20,}'\n);\n\n// =============================================================================\n// Log Inclusion Proof (Optional Merkle Proof)\n// =============================================================================\n\n/**\n * Merkle proof for append-only log inclusion.\n * Future-proof: STAAMPID may provide this for auditable transparency.\n */\nexport const LogInclusionProofSchema = z.object({\n    /** Merkle root hash (base64url SHA-256) */\n    root: Base64urlSha256Schema,\n    /** Sibling hashes along the path (base64url SHA-256 each) */\n    proof: z.array(Base64urlSha256Schema),\n    /** Leaf index in the log */\n    index: z.number().int().nonnegative(),\n});\n\nexport type LogInclusionProof = z.infer<typeof LogInclusionProofSchema>;\n\n// =============================================================================\n// Notary Attestation (NA) — STAAMPID Response\n// =============================================================================\n\n/**\n * NotaryAttestation (NA): STAAMPID's countersignature over a receipt_hash.\n *\n * This is the artifact that promotes SOFT finality → HARD finality.\n * The notary binds to receipt_hash, NOT the receipt content directly.\n *\n * Required fields (per BRIDGE_SPEC.md §4.3):\n * - na_id: Unique NA identifier\n * - receipt_hash: The kernel receipt hash being attested\n * - notary_id: Identifier of the notary service\n * - issued_at: When the attestation was issued\n * - signature: The notary's countersignature\n * - signature_alg: Signature algorithm used\n *\n * Optional fields (future-proof):\n * - receipt_type, receipt_version: For schema evolution\n * - settlement_authority: Cross-check field\n * - validity_window_seconds, expires_at: TTL for NA validity\n * - log_inclusion: Merkle proof for append-only log\n */\nexport const NotaryAttestationSchema = z.object({\n    // --- Required ---\n    /** Unique NA identifier */\n    na_id: NotaryAttestationIdFormatSchema,\n    /** The receipt_hash this NA attests to */\n    receipt_hash: Base64urlSha256Schema,\n    /** Notary service identifier (e.g. \"staampid\") */\n    notary_id: z.string().min(1),\n    /** ISO 8601 timestamp when NA was issued */\n    issued_at: z.string().datetime(),\n    /** Notary's countersignature (base64url encoded) */\n    signature: z.string().min(1),\n    /** Signature algorithm (e.g. \"EdDSA\") */\n    signature_alg: z.string().min(1),\n\n    // --- Optional (future-proof) ---\n    /** Receipt type being attested */\n    receipt_type: z.string().optional(),\n    /** Receipt version being attested */\n    receipt_version: z.number().int().nonnegative().optional(),\n    /** Settlement authority that issued the receipt (cross-check) */\n    settlement_authority: z.string().optional(),\n    /** TTL in seconds for this attestation */\n    validity_window_seconds: z.number().int().positive().optional(),\n    /** ISO 8601 expiry (derived from issued_at + validity_window_seconds) */\n    expires_at: z.string().datetime().optional(),\n    /** Merkle proof for append-only log inclusion */\n    log_inclusion: LogInclusionProofSchema.optional(),\n});\n\nexport type NotaryAttestation = z.infer<typeof NotaryAttestationSchema>;\n\n// =============================================================================\n// Notary Request (HLOS → STAAMPID)\n// =============================================================================\n\n/**\n * NotaryRequest: The payload HLOS sends to STAAMPID to request a countersignature.\n *\n * This is a deterministic payload per BRIDGE_SPEC.md §4.3.\n * STAAMPID uses this to:\n * 1. Verify the receipt_hash is well-formed\n * 2. Log the attestation request\n * 3. Countersign and return NA\n */\nexport const NotaryRequestSchema = z.object({\n    /** receipt_hash to be attested (base64url SHA-256) */\n    receipt_hash: Base64urlSha256Schema,\n    /** Must be literal 'hlos.ai' */\n    settlement_authority: z.literal(SETTLEMENT_AUTHORITY),\n    /** Crossing this receipt belongs to */\n    crossing_id: z.string().min(1),\n    /** Type of the receipt being attested */\n    receipt_type: z.string().min(1),\n    /** Version of the receipt being attested */\n    receipt_version: z.number().int().nonnegative(),\n    /** ISO 8601 timestamp of the request */\n    timestamp: z.string().datetime(),\n    /** Optional: requested validity window in seconds */\n    validity_window_seconds: z.number().int().positive().optional(),\n});\n\nexport type NotaryRequest = z.infer<typeof NotaryRequestSchema>;\n\n// =============================================================================\n// Notarize API Response\n// =============================================================================\n\n/**\n * Status values for the notarize endpoint response.\n */\nexport const NotarizeStatusSchema = z.enum([\n    'HARD',          // NA obtained, finality upgraded\n    'PENDING',       // Notarization in progress (async)\n    'FAILED',        // Notarization failed\n    'ALREADY_HARD',  // Receipt already has NA\n]);\n\nexport type NotarizeStatus = z.infer<typeof NotarizeStatusSchema>;\n\n/**\n * Response from POST /api/finality/notarize.\n */\nexport const NotarizeResponseSchema = z.object({\n    /** Finality status after this operation */\n    status: NotarizeStatusSchema,\n    /** The receipt_hash that was notarized */\n    receipt_hash: Base64urlSha256Schema,\n    /** Hash of the NA itself (optional, present when status is HARD) */\n    na_hash: Base64urlSha256Schema.optional(),\n    /** The full NA object (optional embed) */\n    na: NotaryAttestationSchema.optional(),\n    /** Notary service identifier */\n    notary: z.string().min(1).optional(),\n    /** NA ID for retrieval */\n    notary_receipt_id: z.string().optional(),\n    /** ISO 8601 timestamp */\n    timestamp: z.string().datetime(),\n    /** Error details (present when status is FAILED) */\n    error: z.string().optional(),\n});\n\nexport type NotarizeResponse = z.infer<typeof NotarizeResponseSchema>;\n\n// =============================================================================\n// Type Guards\n// =============================================================================\n\n/**\n * Check if a value is a valid NotaryAttestation.\n */\nexport function isNotaryAttestation(value: unknown): value is NotaryAttestation {\n    return NotaryAttestationSchema.safeParse(value).success;\n}\n\n/**\n * Check if a value is a valid NotaryRequest.\n */\nexport function isNotaryRequest(value: unknown): value is NotaryRequest {\n    return NotaryRequestSchema.safeParse(value).success;\n}\n\n// =============================================================================\n// BazaarReceiptEnvelope Reference (for BRE assembly)\n// =============================================================================\n\n/**\n * ArtifactRef: A typed reference to a kernel artifact (for BRE assembly).\n * Per BRIDGE_SPEC.md §2.3.\n */\nexport const ArtifactRefSchema = z.object({\n    /** Artifact type */\n    type: z.enum(['CR', 'LAT', 'EGP', 'SA', 'SignedReceiptV0', 'NA']),\n    /** base64url SHA-256 hash of the artifact */\n    hash: Base64urlSha256Schema,\n    /** Issuer of the artifact */\n    issuer: z.string().min(1),\n    /** Schema version */\n    version: z.string().min(1),\n    /** Optional retrieval URI */\n    uri: z.string().url().optional(),\n});\n\nexport type ArtifactRef = z.infer<typeof ArtifactRefSchema>;\n\n// =============================================================================\n// Golden Fixtures\n// =============================================================================\n\n/**\n * Golden fixtures for finality schema conformance testing.\n *\n * These are deterministic test values. DO NOT CHANGE unless the\n * schema definition changes.\n */\nexport const FINALITY_GOLDEN_FIXTURES = {\n    /** Sample NotaryAttestation */\n    notaryAttestation: {\n        na_id: 'na_01HZGOLDENNATEST00000000',\n        receipt_hash: 'uLiQVUeVKcE35Rdje2fArZQfTcECDgwK6UbmQB_36Pg',\n        notary_id: 'staampid',\n        issued_at: '2026-01-27T00:01:00.000Z',\n        signature: 'dGVzdF9ub3Rhcnlfc2lnbmF0dXJlXzY0X2J5dGVzX3BhZGRlZF90b19maWxsXzg2X2NoYXJhY3RlcnNf',\n        signature_alg: 'EdDSA',\n        receipt_type: 'SignedReceiptV0',\n        receipt_version: 0,\n        settlement_authority: 'hlos.ai',\n    } satisfies NotaryAttestation,\n\n    /** Sample NotaryRequest */\n    notaryRequest: {\n        receipt_hash: 'uLiQVUeVKcE35Rdje2fArZQfTcECDgwK6UbmQB_36Pg',\n        settlement_authority: 'hlos.ai' as const,\n        crossing_id: 'cross_test123abc456def789ghi',\n        receipt_type: 'SignedReceiptV0',\n        receipt_version: 0,\n        timestamp: '2026-01-27T00:00:30.000Z',\n    } satisfies NotaryRequest,\n\n    /** Sample successful notarize response */\n    notarizeResponseHard: {\n        status: 'HARD' as const,\n        receipt_hash: 'uLiQVUeVKcE35Rdje2fArZQfTcECDgwK6UbmQB_36Pg',\n        na_hash: '_rkedsyWZhokzye55M9NRAvIKFTxFCYTHVOPjg9cAfU',\n        notary: 'staampid',\n        notary_receipt_id: 'na_01HZGOLDENNATEST00000000',\n        timestamp: '2026-01-27T00:01:00.000Z',\n    } satisfies NotarizeResponse,\n} as const;\n"],"mappings":";;;;;;;;;;;;;;;;;;;;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,+BAAAA;AAAA,EAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;;;ACOA,iBAAkB;AAMX,IAAM,gBAAgB,aAAE,KAAK;AAAA,EAChC;AAAA;AAAA,EACA;AAAA;AAAA,EACA;AAAA;AAAA,EACA;AAAA;AAAA,EACA;AAAA;AAAA,EACA;AAAA;AAAA,EACA;AAAA;AACJ,CAAC;AAOM,IAAM,WAAW,cAAc;;;AClBtC,IAAAC,cAAkB;;;ACHlB,IAAAC,cAAkB;AAKX,IAAM,wBAAwB,cAAE,KAAK;AAAA;AAAA,EAExC;AAAA;AAAA,EACA;AAAA;AAAA,EACA;AAAA;AAAA,EACA;AAAA;AAAA,EACA;AAAA;AAAA,EACA;AAAA;AAAA,EACA;AAAA;AAAA,EACA;AAAA;AAAA,EACA;AAAA;AAAA;AAAA,EAGA;AAAA;AAAA,EACA;AAAA;AACJ,CAAC;;;ADMM,SAAS,QAAW,MAAS,eAAuB,WAAwC;AAC/F,SAAO;AAAA,IACH,SAAS;AAAA,IACT;AAAA,IACA,MAAM;AAAA,MACF,gBAAgB;AAAA,MAChB,GAAI,aAAa,EAAE,YAAY,UAAU;AAAA,IAC7C;AAAA,EACJ;AACJ;AAsBO,SAAS,MACZ,MACA,SACA,eACA,SACa;AACb,SAAO;AAAA,IACH,SAAS;AAAA,IACT,OAAO;AAAA,MACH;AAAA,MACA;AAAA,MACA,gBAAgB;AAAA,MAChB,GAAI,YAAY,UAAa,EAAE,QAAQ;AAAA,IAC3C;AAAA,EACJ;AACJ;AAMO,IAAM,wBAAwB,CAAsB,eACvD,cAAE,OAAO;AAAA,EACL,SAAS,cAAE,QAAQ,IAAI;AAAA,EACvB,MAAM;AAAA,EACN,MAAM,cAAE,OAAO;AAAA,IACX,YAAY,cAAE,OAAO,EAAE,SAAS;AAAA,IAChC,gBAAgB,cAAE,OAAO;AAAA,EAC7B,CAAC,EAAE,SAAS;AAChB,CAAC;AAEE,IAAM,sBAAsB,cAAE,OAAO;AAAA,EACxC,SAAS,cAAE,QAAQ,KAAK;AAAA,EACxB,OAAO,cAAE,OAAO;AAAA,IACZ,MAAM;AAAA,IACN,SAAS,cAAE,OAAO;AAAA,IAClB,SAAS,cAAE,QAAQ,EAAE,SAAS;AAAA,IAC9B,gBAAgB,cAAE,OAAO;AAAA,EAC7B,CAAC;AACL,CAAC;;;AE9FD,IAAAC,cAAkB;AAUX,IAAM,mBAAmB;AAMzB,IAAM,kBAAkB;AA4ExB,IAAM,sBAAsB;AAC5B,IAAM,mBAAmB;AAEzB,IAAM,wBAAwB,CAAsB,kBACvD,cAAE,OAAO;AAAA,EACL,SAAS,cAAE,QAAQ,gBAAgB;AAAA,EACnC,SAAS,cAAE,QAAQ,eAAe;AAAA,EAClC,YAAY,cAAE,OAAO;AAAA,EACrB,SAAS;AAAA;AAAA,EAET,cAAc,cAAE,OAAO,EAAE;AAAA,IACrB;AAAA,IACA;AAAA,EACJ;AAAA;AAAA,EAEA,WAAW,cAAE,OAAO,EAAE;AAAA,IAClB;AAAA,IACA;AAAA,EACJ;AAAA,EACA,QAAQ,cAAE,OAAO,EAAE,IAAI,CAAC;AAAA,EACxB,WAAW,cAAE,OAAO,EAAE,SAAS;AACnC,CAAC;AAKE,IAAM,6BAA6B,sBAAsB,cAAE,QAAQ,CAAC;AASpE,SAAS,kBAAkB,OAA0C;AACxE,MAAI,OAAO,UAAU,YAAY,UAAU,KAAM,QAAO;AACxD,QAAM,MAAM;AACZ,SACI,IAAI,OAAO,MAAM,oBACjB,IAAI,SAAS,MAAM,mBACnB,OAAO,IAAI,YAAY,MAAM,YAC7B,OAAO,IAAI,cAAc,MAAM,YAC/B,OAAO,IAAI,WAAW,MAAM,YAC5B,OAAO,IAAI,QAAQ,MAAM,YACzB,OAAO,IAAI,WAAW,MAAM;AAEpC;;;AC7IA,IAAAC,cAAkB;AA8CX,IAAM,iBAAiB,cAAE,OAAO,EAClC,MAAM,2BAA2B,yBAAyB,EAC1D,UAAU,CAAC,MAAM,CAAa;AAK5B,IAAM,mBAAmB,cAAE,OAAO,EACpC,MAAM,6BAA6B,2BAA2B,EAC9D,UAAU,CAAC,MAAM,CAAe;AAK9B,IAAM,kBAAkB,cAAE,OAAO,EACnC,MAAM,kCAAkC,0BAA0B,EAClE,UAAU,CAAC,MAAM,CAAc;AAK7B,IAAM,sBAAsB,cAAE,OAAO,EACvC,IAAI,CAAC,EACL,IAAI,GAAG,EACP,UAAU,CAAC,MAAM,CAAkB;AAMjC,IAAM,uBAAuB,cAAE,OAAO,EACxC,IAAI,CAAC,EACL,IAAI,GAAG,EACP,MAAM,kBAAkB,wCAAwC,EAChE,UAAU,CAAC,MAAM,CAAmB;AAKlC,IAAM,mBAAmB,cAAE,OAAO,EACpC,MAAM,0BAA0B,2BAA2B,EAC3D,UAAU,CAAC,MAAM,CAAe;AAU9B,SAAS,WAAW,QAAwB;AAC/C,QAAM,YAAY,KAAK,IAAI,EAAE,SAAS,EAAE;AACxC,QAAM,SAAS,OAAO,WAAW,EAAE,QAAQ,MAAM,EAAE,EAAE,MAAM,GAAG,EAAE;AAChE,SAAO,GAAG,MAAM,IAAI,SAAS,GAAG,MAAM;AAC1C;AAEO,IAAM,mBAAmB,MAAgB,WAAW,QAAQ;AAC5D,IAAM,qBAAqB,MAAkB,WAAW,UAAU;AAClE,IAAM,oBAAoB,MAAiB,WAAW,MAAM;AAC5D,IAAM,qBAAqB,MAAkB,WAAW,OAAO;;;AClGtE,IAAAC,cAAkB;AAUX,IAAMC,yBAAwB,cAAE,KAAK;AAAA;AAAA,EAExC;AAAA;AAAA,EACA;AAAA;AAAA;AAAA,EAGA;AAAA;AAAA,EACA;AAAA;AAAA;AAAA,EAGA;AAAA;AAAA,EACA;AAAA;AAAA,EACA;AAAA;AAAA,EACA;AAAA;AAAA;AAAA,EAGA;AAAA;AAAA,EACA;AAAA;AAAA,EACA;AAAA;AAAA,EACA;AAAA;AAAA;AAAA,EAGA;AAAA;AAAA,EACA;AAAA;AAAA;AAAA,EAGA;AAAA;AAAA;AAAA,EAGA;AAAA;AAAA,EACA;AAAA;AACJ,CAAC;AAOM,IAAM,oBAAqD;AAAA,EAC9D,kBAAkB;AAAA,EAClB,iBAAiB;AAAA,EACjB,cAAc;AAAA,EACd,WAAW;AAAA,EACX,WAAW;AAAA,EACX,oBAAoB;AAAA,EACpB,iBAAiB;AAAA,EACjB,4BAA4B;AAAA,EAC5B,UAAU;AAAA,EACV,0BAA0B;AAAA,EAC1B,0BAA0B;AAAA,EAC1B,sBAAsB;AAAA,EACtB,sBAAsB;AAAA,EACtB,oBAAoB;AAAA,EACpB,cAAc;AAAA,EACd,gBAAgB;AAAA,EAChB,qBAAqB;AACzB;AAWO,IAAM,iBAAiB,CAAsB,eAChD,cAAE,OAAO;AAAA,EACL,IAAI,cAAE,QAAQ,IAAI;AAAA,EAClB,QAAQ,cAAE,MAAM;AAAA,IACZ,cAAE,OAAO,EAAE,IAAI,EAAE,IAAI,GAAG,EAAE,IAAI,GAAG;AAAA,IACjC,cAAE,QAAQ,GAAG;AAAA,EACjB,CAAC;AAAA,EACD,MAAM;AACV,CAAC;AAYE,IAAM,oBAAoB,cAAE,OAAO;AAAA,EACtC,IAAI,cAAE,QAAQ,KAAK;AAAA,EACnB,QAAQ,cAAE,OAAO,EAAE,IAAI,EAAE,IAAI,GAAG,EAAE,IAAI,GAAG;AAAA,EACzC,OAAO,cAAE,OAAO;AAAA,IACZ,MAAMA;AAAA;AAAA,IACN,SAAS,cAAE,OAAO;AAAA,IAClB,SAAS,cAAE,OAAO,cAAE,QAAQ,CAAC,EAAE,SAAS;AAAA,EAC5C,CAAC;AACL,CAAC;AAgBM,IAAM,yBAAyB,cAAE,OAAO,EAC1C,MAAM,0BAA0B,iDAAiD;AAK/E,IAAM,wBAAwB,cAAE,OAAO,EACzC,MAAM,kCAAkC,+CAA+C;AAKrF,IAAM,yBAAyB,cAAE,OAAO,EAC1C,MAAM,6BAA6B,oDAAoD;AAKrF,IAAM,uBAAuB,cAAE,OAAO,EACxC,MAAM,2BAA2B,gDAAgD;AAU/E,IAAM,sBAAsB,cAAE,KAAK,CAAC,WAAW,YAAY,MAAM,CAAC;AAMlE,IAAM,yBAAyB,cAAE,KAAK;AAAA,EACzC;AAAA;AAAA,EACA;AAAA;AAAA,EACA;AAAA;AACJ,CAAC;AAOM,SAAS,oBAAoB,kBAAmD;AACnF,UAAQ,kBAAkB;AAAA,IACtB,KAAK;AACD,aAAO;AAAA,IACX,KAAK;AACD,aAAO;AAAA,IACX,KAAK;AACD,aAAO;AAAA,EACf;AACJ;AAYO,IAAM,2BAA2B,cAAE,OAAO;AAAA,EAC7C,YAAY;AAAA,EACZ,cAAc,cAAE,OAAO;AAAA,EACvB,YAAY;AAAA;AAAA,EAGZ,UAAU,cAAE,OAAO,EAAE,SAAS;AAAA,EAC9B,kBAAkB,cAAE,OAAO,EAAE,SAAS;AAAA,EACtC,iBAAiB,cAAE,OAAO,EAAE,SAAS;AAAA;AAAA,EAGrC,oBAAoB,cAAE,OAAO,EAAE,SAAS;AAAA,EACxC,gBAAgB,oBAAoB,SAAS;AAAA,EAC7C,mBAAmB;AACvB,CAAC;AAQM,IAAM,4BAA4B,cAAE,OAAO;AAAA,EAC9C,GAAG,cAAE,QAAQ,CAAC;AAAA,EACd,UAAU;AAAA,EACV,qBAAqB;AACzB,CAAC;AAWM,IAAM,uBAAuB;AAK7B,IAAM,+BAA+B,cAAE,OAAO;AAAA,EACjD,MAAM,cAAE,QAAQ,iBAAiB;AAAA,EACjC,YAAY;AAAA;AAAA,EAGZ,UAAU,cAAE,OAAO,EAAE,SAAS;AAAA,EAC9B,kBAAkB,cAAE,OAAO,EAAE,SAAS;AAAA,EACtC,iBAAiB,cAAE,OAAO,EAAE,SAAS;AAAA;AAAA,EAGrC,oBAAoB,cAAE,OAAO,EAAE,SAAS;AAAA,EACxC,gBAAgB,oBAAoB,SAAS;AAAA,EAC7C,mBAAmB;AAAA;AAAA,EAGnB,sBAAsB,cAAE,QAAQ,oBAAoB;AAAA;AAAA,EAGpD,eAAe,cAAE,OAAO;AAAA;AAAA,EACxB,qBAAqB,cAAE,OAAO;AAAA;AAAA,EAG9B,YAAY,cAAE,OAAO,EAAE,SAAS;AACpC,CAAC;AAWM,IAAM,yBAAyB,cAAE,KAAK;AAAA,EACzC;AAAA;AAAA,EACA;AAAA;AAAA,EACA;AAAA;AACJ,CAAC;AAMM,IAAM,qBAAqB,cAAE,KAAK;AAAA,EACrC;AAAA;AAAA,EACA;AAAA;AAAA,EACA;AAAA;AAAA,EACA;AAAA;AAAA,EACA;AAAA;AAAA,EACA;AAAA;AAAA,EACA;AAAA;AAAA,EACA;AAAA;AAAA,EACA;AAAA;AACJ,CAAC;AAMM,IAAM,sBAAsB,cAAE,OAAO;AAAA,EACxC,aAAa,cAAE,OAAO;AAAA,EACtB,MAAM;AAAA;AAAA,EACN,cAAc,cAAE,OAAO;AAAA,EACvB,mBAAmB,cAAE,OAAO,EAAE,YAAY;AAAA,EAC1C,SAAS,cAAE,MAAM,cAAE,OAAO,CAAC;AAAA,EAC3B,mBAAmB;AACvB,CAAC;AAOM,IAAM,cAAc,cAAE,OAAO;AAAA,EAChC,IAAI,cAAE,OAAO;AAAA,EACb,MAAM,cAAE,OAAO;AAAA,EACf,MAAM,cAAE,OAAO;AAAA,EACf,SAAS,cAAE,OAAO;AAAA,EAClB,MAAM,cAAE,OAAO;AAAA,EACf,WAAW,cAAE,MAAM,mBAAmB;AAAA,EACtC,iBAAiB,cAAE,OAAO,EAAE,SAAS;AAAA,EACrC,cAAc,cAAE,OAAO,EAAE,YAAY;AAAA,EACrC,UAAU,cAAE,OAAO,EAAE,SAAS;AAAA;AAClC,CAAC;AAOM,IAAM,wBAAwB,cAAE,OAAO;AAAA,EAC1C,IAAI,cAAE,OAAO;AAAA,EACb,UAAU,cAAE,OAAO;AAAA,EACnB,aAAa,cAAE,OAAO;AAAA,EACtB,SAAS,cAAE,OAAO,EAAE,SAAS;AAAA,EAC7B,gBAAgB,cAAE,OAAO;AAAA,EACzB,cAAc,cAAE,OAAO,EAAE,SAAS;AAAA,EAClC,qBAAqB,cAAE,MAAM,cAAE,OAAO,CAAC;AAC3C,CAAC;AAWM,SAAS,SAAY,MAAS,SAAiB,KAAkB;AACpE,SAAO,EAAE,IAAI,MAAM,QAAQ,KAAK;AACpC;AAKO,SAAS,YACZ,MACA,SACA,QACA,SACW;AACX,SAAO;AAAA,IACH,IAAI;AAAA,IACJ,QAAQ,UAAU,kBAAkB,IAAI;AAAA,IACxC,OAAO;AAAA,MACH;AAAA,MACA;AAAA,MACA,GAAI,WAAW,EAAE,QAAQ;AAAA,IAC7B;AAAA,EACJ;AACJ;AAWO,IAAM,kBAAkB;AAAA;AAAA;AAAA;AAAA,EAI3B,mBAAmB;AAAA,IACf,GAAG;AAAA,IACH,UAAU;AAAA,MACN,YAAY;AAAA,MACZ,cAAc;AAAA,MACd,YAAY;AAAA,MACZ,UAAU;AAAA,MACV,kBAAkB;AAAA,MAClB,iBAAiB;AAAA,MACjB,oBAAoB;AAAA,MACpB,gBAAgB;AAAA,MAChB,mBAAmB;AAAA,IACvB;AAAA,IACA,qBAAqB;AAAA,EACzB;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EASA,8CAA8C;AAAA;AAAA;AAAA;AAAA,EAK9C,wBAAwB;AAAA,IACpB,MAAM;AAAA,IACN,YAAY;AAAA,IACZ,UAAU;AAAA,IACV,kBAAkB;AAAA,IAClB,iBAAiB;AAAA,IACjB,oBAAoB;AAAA,IACpB,gBAAgB;AAAA,IAChB,mBAAmB;AAAA,IACnB,sBAAsB;AAAA,IACtB,eAAe;AAAA,IACf,qBAAqB;AAAA,IACrB,YAAY;AAAA,EAChB;AACJ;AAKO,SAAS,sBAAsB,OAA8C;AAChF,SAAO,0BAA0B,UAAU,KAAK,EAAE;AACtD;AAKO,SAAS,yBAAyB,OAAiD;AACtF,SAAO,6BAA6B,UAAU,KAAK,EAAE;AACzD;;;AClbA,IAAAC,cAAkB;AAUX,IAAM,gBAAgB,IAAI,YAAY,EAAE,OAAO,WAAW;AAK1D,IAAM,iBAAiB,IAAI,YAAY,EAAE,OAAO,YAAY;AAuBnE,IAAM,oBACF;AAEJ,SAAS,WAAW,MAAuB;AACvC,SAAQ,OAAO,MAAM,KAAK,OAAO,QAAQ,KAAO,OAAO,QAAQ;AACnE;AAEA,SAAS,YAAY,MAAc,OAAuB;AACtD,QAAM,OAAO,CAAC,IAAI,WAAW,IAAI,IAAI,KAAK,IAAI,IAAI,IAAI,IAAI,IAAI,IAAI,IAAI,IAAI,IAAI,IAAI,EAAE;AACpF,SAAO,KAAK,QAAQ,CAAC,KAAK;AAC9B;AAEA,SAAS,uBAAuB,OAAuB;AACnD,QAAM,QAAQ,kBAAkB,KAAK,KAAK;AAC1C,MAAI,CAAC,OAAO;AACR,UAAM,IAAI;AAAA,MACN,mBAAmB,KAAK;AAAA,IAC5B;AAAA,EACJ;AAEA,QAAM,OAAO,OAAO,MAAM,CAAC,CAAC;AAC5B,QAAM,QAAQ,OAAO,MAAM,CAAC,CAAC;AAC7B,QAAM,MAAM,OAAO,MAAM,CAAC,CAAC;AAC3B,QAAM,OAAO,OAAO,MAAM,CAAC,CAAC;AAC5B,QAAM,SAAS,OAAO,MAAM,CAAC,CAAC;AAC9B,QAAM,SAAS,OAAO,MAAM,CAAC,CAAC;AAC9B,QAAM,WAAW,MAAM,CAAC,KAAK;AAC7B,QAAM,KAAK,MAAM,CAAC;AAElB,MAAI,QAAQ,KAAK,QAAQ,IAAI;AACzB,UAAM,IAAI,MAAM,mCAAmC;AAAA,EACvD;AACA,QAAM,SAAS,YAAY,MAAM,KAAK;AACtC,MAAI,MAAM,KAAK,MAAM,QAAQ;AACzB,UAAM,IAAI,MAAM,iCAAiC;AAAA,EACrD;AACA,MAAI,OAAO,IAAI;AACX,UAAM,IAAI,MAAM,kCAAkC;AAAA,EACtD;AACA,MAAI,SAAS,IAAI;AACb,UAAM,IAAI,MAAM,oCAAoC;AAAA,EACxD;AACA,MAAI,SAAS,IAAI;AACb,UAAM,IAAI,MAAM,oCAAoC;AAAA,EACxD;AAEA,QAAM,aAAa,SAAS,SAAS,QAAQ,WAAW,OAAO,MAAM,GAAG,CAAC,CAAC,IAAI;AAC9E,QAAM,QAAQ,KAAK,IAAI,MAAM,QAAQ,GAAG,KAAK,MAAM,QAAQ,QAAQ,UAAU;AAE7E,MAAI,WAAW;AACf,MAAI,OAAO,KAAK;AACZ,UAAM,OAAO,MAAM,EAAE,MAAM,MAAM,KAAK;AACtC,UAAM,aAAa,OAAO,MAAM,EAAE,CAAC;AACnC,UAAM,eAAe,OAAO,MAAM,EAAE,CAAC;AACrC,QAAI,aAAa,IAAI;AACjB,YAAM,IAAI,MAAM,qCAAqC;AAAA,IACzD;AACA,QAAI,eAAe,IAAI;AACnB,YAAM,IAAI,MAAM,uCAAuC;AAAA,IAC3D;AACA,eAAW,QAAQ,aAAa,KAAK,gBAAgB;AAAA,EACzD;AAEA,QAAM,KAAK,QAAQ;AACnB,MAAI,CAAC,OAAO,SAAS,EAAE,KAAK,KAAK,GAAG;AAChC,UAAM,IAAI,MAAM,iDAAiD;AAAA,EACrE;AAEA,SAAO;AACX;AAEO,SAAS,YAAY,OAAoC;AAC5D,MAAI;AAEJ,MAAI,OAAO,UAAU,UAAU;AAC3B,SAAK,uBAAuB,KAAK;AAAA,EACrC,OAAO;AACH,QAAI,CAAC,OAAO,UAAU,KAAK,KAAK,QAAQ,GAAG;AACvC,YAAM,IAAI,MAAM,kBAAkB,KAAK,iCAAiC;AAAA,IAC5E;AACA,SAAK;AAAA,EACT;AAEA,QAAM,MAAM,IAAI,YAAY,CAAC;AAC7B,QAAM,OAAO,IAAI,SAAS,GAAG;AAC7B,OAAK,aAAa,GAAG,OAAO,EAAE,GAAG,KAAK;AACtC,SAAO,IAAI,WAAW,GAAG;AAC7B;AAUO,IAAM,uBAAuB,cAAE,OAAO;AAAA;AAAA,EAEzC,QAAQ,cAAE,OAAO,EAAE,IAAI,CAAC,EAAE,IAAI,GAAG;AAAA;AAAA,EAEjC,cAAc,cAAE,OAAO,EAAE,IAAI;AAAA;AAAA,EAE7B,mBAAmB,cAAE,OAAO,EAAE,MAAM,kBAAkB,+BAA+B;AACzF,CAAC;AAiBM,IAAM,sBAAsB,cAAE,MAAM;AAAA,EACvC,cAAE,OAAO,EAAE,IAAI,EAAE,YAAY;AAAA,EAC7B,cAAE,OAAO,EAAE,SAAS,EAAE,QAAQ,KAAK,CAAC;AAAA;AACxC,CAAC;AAaM,IAAM,aAAa,cACrB,OAAO,EACP,OAAO,IAAI,gEAAgE,EAC3E,MAAM,oBAAoB,gCAAgC;AAoBxD,IAAM,2BAA2B,cAAE,OAAO;AAAA;AAAA,EAE7C,kBAAkB;AAAA;AAAA,EAElB,gBAAgB,cAAE,OAAO,EAAE,MAAM,kBAAkB,+BAA+B;AAAA;AAAA,EAElF,YAAY,cAAE,OAAO,EAAE,SAAS,EAAE,QAAQ,KAAK,CAAC;AAAA;AAAA,EAEhD,WAAW,cAAE,OAAO,EAAE,SAAS,EAAE,QAAQ,KAAK,CAAC;AAAA;AAAA,EAG/C,QAAQ,cAAE,OAAO,EAAE,YAAY,EAAE,SAAS;AAAA,EAC1C,UAAU,cAAE,OAAO,EAAE,OAAO,CAAC,EAAE,SAAS;AAAA,EACxC,YAAY,cAAE,OAAO,EAAE,SAAS;AAAA,EAChC,YAAY,cAAE,OAAO,EAAE,SAAS;AACpC,CAAC;AAYM,IAAM,+BAA+B,cACvC,OAAO,EACP,MAAM,kBAAkB,+BAA+B;AAYrD,IAAM,oBAAoB;AAAA;AAAA;AAAA;AAAA;AAAA,EAK7B,SAAS;AAAA,EACT,oBAAoB,IAAI,WAAW,CAAC,GAAM,GAAM,GAAM,KAAM,IAAM,KAAM,GAAM,CAAI,CAAC;AAAA;AAAA;AAAA;AAAA,EAKnF,YAAY;AAAA,IACR,QAAQ;AAAA,IACR,cAAc;AAAA,IACd,mBAAmB,IAAI,OAAO,EAAE;AAAA,EACpC;AAAA;AAAA;AAAA;AAAA,EAKA,iBAAiB;AAAA,IACb,kBAAkB;AAAA,MACd,QAAQ;AAAA,MACR,cAAc;AAAA,MACd,mBAAmB,IAAI,OAAO,EAAE;AAAA,IACpC;AAAA,IACA,gBAAgB,IAAI,OAAO,EAAE;AAAA,IAC7B,YAAY;AAAA,IACZ,WAAW;AAAA,EACf;AAAA;AAAA;AAAA;AAAA,EAKA,eAAe,IAAI,KAAK;AAC5B;AAgBO,SAAS,mBAAmB,SAAsC;AACrE,MAAI;AACJ,MAAI;AAEJ,MAAI;AACA,gBAAY,uBAAuB,QAAQ,UAAU;AACrD,eAAW,uBAAuB,QAAQ,SAAS;AAAA,EACvD,QAAQ;AACJ,UAAM,IAAI,MAAM,uEAAuE;AAAA,EAC3F;AAEA,MAAI,YAAY,WAAW;AACvB,UAAM,IAAI,MAAM,2CAA2C;AAAA,EAC/D;AAEA,QAAM,WAAW,WAAW;AAC5B,MAAI,WAAW,kBAAkB,eAAe;AAC5C,UAAM,IAAI;AAAA,MACN,eAAe,QAAQ,6BAA6B,kBAAkB,aAAa;AAAA,IACvF;AAAA,EACJ;AAEA,SAAO;AACX;;;AC3TA,IAAAC,cAAkB;AASX,IAAM,oBAAoB,cAC5B,KAAK,CAAC,UAAU,WAAW,aAAa,SAAS,CAAC,EAClD,GAAG,cAAE,OAAO,EAAE,IAAI,CAAC,CAAC;AAOlB,IAAM,kBAAkB,cAC1B,KAAK,CAAC,UAAU,UAAU,OAAO,UAAU,UAAU,WAAW,OAAO,CAAC,EACxE,GAAG,cAAE,OAAO,EAAE,IAAI,CAAC,CAAC;AAWlB,IAAM,sBAAsB,cAC9B,OAAO;AAAA,EACJ,IAAI,cAAE,OAAO,EAAE,IAAI,CAAC;AAAA,EACpB,aAAa,cAAE,OAAO,EAAE,IAAI,CAAC;AAAA,EAC7B,MAAM,cAAE,OAAO,EAAE,IAAI,CAAC;AAAA,EACtB,QAAQ;AAAA,EACR,YAAY;AAAA,EACZ,aAAa,cAAE,OAAO,EAAE,IAAI,EAAE,IAAI,CAAC,EAAE,IAAI,GAAI;AAAA,EAC7C,eAAe,cAAE,KAAK;AAAA,EACtB,eAAe,cAAE,KAAK;AAAA,EACtB,YAAY,cAAE,OAAO,EAAE,SAAS;AACpC,CAAC,EACA,YAAY;AAQV,IAAM,2BAA2B,cACnC,OAAO;AAAA,EACJ,QAAQ,cAAE,MAAM,mBAAmB;AAAA,EACnC,OAAO,cAAE,OAAO;AAAA,IACZ,QAAQ,cAAE,QAAQ,MAAM;AAAA,EAC5B,CAAC;AACL,CAAC,EACA,YAAY;AAgBV,IAAM,kCAAkC,cAC1C,OAAO;AAAA,EACJ,aAAa,cAAE,KAAK;AAAA,EACpB,UAAU,cAAE,OAAO,EAAE,IAAI,CAAC;AAAA,EAC1B,eAAe,cAAE,KAAK;AAAA,EACtB,eAAe,cAAE,KAAK;AAAA,EACtB,gBAAgB,cAAE,KAAK;AAAA,EACvB,gBAAgB,cAAE,KAAK;AAAA,EACvB,OAAO,cACF,OAAO;AAAA,IACJ,gBAAgB,cAAE,KAAK;AAAA,IACvB,gBAAgB,cAAE,KAAK;AAAA,IACvB,cAAc,cAAE,KAAK;AAAA,EACzB,CAAC,EACA,YAAY;AAAA,EACjB,OAAO,cACF,OAAO;AAAA,IACJ,cAAc,cAAE,OAAO,EAAE,WAAW,yBAAyB;AAAA,IAC7D,UAAU,cAAE,QAAQ,kBAAkB;AAAA,EAC1C,CAAC,EACA,YAAY;AAAA,EACjB,OAAO,cAAE,OAAO;AAAA,IACZ,QAAQ,cAAE,QAAQ,MAAM;AAAA,EAC5B,CAAC;AACL,CAAC,EACA,YAAY;;;AClGjB,IAAAC,cAAkB;AASX,SAAS,iBAAiB,OAA2B;AACxD,MAAI,SAAS;AACb,WAAS,IAAI,GAAG,IAAI,MAAM,QAAQ,KAAK;AACnC,cAAU,OAAO,aAAa,MAAM,CAAC,CAAC;AAAA,EAC1C;AACA,QAAM,SAAS,KAAK,MAAM;AAC1B,SAAO,OAAO,QAAQ,OAAO,GAAG,EAAE,QAAQ,OAAO,GAAG,EAAE,QAAQ,OAAO,EAAE;AAC3E;AAKO,SAAS,iBAAiB,KAAyB;AACtD,QAAM,SAAS,IAAI,QAAQ,MAAM,GAAG,EAAE,QAAQ,MAAM,GAAG;AACvD,QAAM,SAAS,SAAS,IAAI,QAAQ,IAAK,OAAO,SAAS,KAAM,CAAC;AAChE,QAAM,SAAS,KAAK,MAAM;AAC1B,QAAM,QAAQ,IAAI,WAAW,OAAO,MAAM;AAC1C,WAAS,IAAI,GAAG,IAAI,OAAO,QAAQ,KAAK;AACpC,UAAM,CAAC,IAAI,OAAO,WAAW,CAAC;AAAA,EAClC;AACA,SAAO;AACX;AASO,IAAM,yBAAyB;AAM/B,IAAM,wBAAwB,cAAE,OAAO,EAAE;AAAA,EAC5C;AAAA,EACA;AACJ;AAMO,IAAM,4BAA4B,cAAE,OAAO,EAAE;AAAA,EAChD;AAAA,EACA;AACJ;;;ACtEA;AAyBA,IAAI,eAA0D;AAU9D,SAAS,aAAa,OAAyB;AAC3C,MAAI,MAAM,QAAQ,KAAK,EAAG,QAAO,MAAM,IAAI,YAAY;AACvD,MAAI,UAAU,QAAQ,OAAO,UAAU,UAAU;AAC7C,UAAM,MAAM;AACZ,UAAM,MAA+B,CAAC;AACtC,eAAW,OAAO,OAAO,KAAK,GAAG,EAAE,KAAK,GAAG;AACvC,UAAI,GAAG,IAAI,aAAa,IAAI,GAAG,CAAC;AAAA,IACpC;AACA,WAAO;AAAA,EACX;AACA,SAAO;AACX;AAYO,SAAS,gBAAgB,OAAwB;AACpD,SAAO,KAAK,UAAU,aAAa,KAAK,GAAG,CAAC,MAAM,MAAM;AACpD,QAAI,MAAM,OAAW,OAAM,IAAI,MAAM,+BAA+B;AACpE,QAAI,OAAO,MAAM,WAAY,OAAM,IAAI,MAAM,8BAA8B;AAC3E,QAAI,OAAO,MAAM,SAAU,OAAM,IAAI,MAAM,4BAA4B;AACvE,QAAI,OAAO,MAAM,SAAU,OAAM,IAAI,MAAM,4BAA4B;AACvE,QAAI,OAAO,MAAM,YAAY,CAAC,OAAO,SAAS,CAAC;AAC3C,YAAM,IAAI,MAAM,uCAAuC;AAC3D,WAAO;AAAA,EACX,CAAC;AACL;AA6BO,SAAS,mBAAmB,SAAkC;AAGjE,QAAM,SAAS,WAAW;AAC1B,QAAM,YAAY,gBAAgB,OAAO;AACzC,QAAM,SAAS,OAAO,IAAI,YAAY,EAAE,OAAO,SAAS,CAAC;AACzD,SAAO,iBAAiB,MAAM;AAClC;AAaO,SAAS,mBAAmB,SAA0B;AACzD,QAAM,SAAS,WAAW;AAC1B,QAAM,YAAY,gBAAgB,OAAO;AACzC,QAAM,SAAS,OAAO,IAAI,YAAY,EAAE,OAAO,SAAS,CAAC;AACzD,SAAO,iBAAiB,MAAM;AAClC;AAMA,SAAS,aAA+C;AACpD,MAAI,aAAc,QAAO;AAKzB,MAAI;AACJ,MAAI;AAEA,UAAM,EAAE,cAAc,IAAI,QAAQ,QAAa;AAC/C,eAAW,cAAc,YAAY,GAAG;AAAA,EAC5C,QAAQ;AAGJ,eAAW;AAAA,EACf;AAEA,MAAI;AACJ,MAAI;AAEA,aAAS,SAAS,uBAAuB,EAAE;AAAA,EAC/C,QAAQ;AACJ,QAAI;AAEA,eAAS,SAAS,oBAAoB,EAAE;AAAA,IAC5C,QAAQ;AACJ,YAAM,IAAI;AAAA,QACN;AAAA,MAEJ;AAAA,IACJ;AAAA,EACJ;AACA,iBAAe;AACf,SAAO;AACX;AAUO,IAAM,oBAAoB,sBAAsB;AAAA,EACnD;AACJ;AAeO,IAAM,8BAA8B;AAAA,EACvC,SAAS;AAAA,IACL,SAAS;AAAA,IACT,SAAS;AAAA,IACT,YAAY;AAAA,IACZ,SAAS;AAAA,MACL,MAAM;AAAA,MACN,YAAY;AAAA,MACZ,sBAAsB;AAAA,IAC1B;AAAA;AAAA,IAEA,cAAc;AAAA,IACd,WACI;AAAA,IACJ,QAAQ;AAAA,IACR,WAAW;AAAA,EACf;AAAA;AAAA;AAAA;AAAA;AAAA,EAMA,aAAa;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAQb,qBAAqB;AACzB;;;AC3MA,IAAAC,eAAkB;AAWX,IAAM,eAAe;AAKrB,IAAM,gBAAgB;AAAA,EACzB,MAAM;AAAA,EACN,MAAM;AACV;AAWO,IAAM,kCAAkC,eAAE,OAAO,EAAE;AAAA,EACtD;AAAA,EACA;AACJ;AAUO,IAAM,0BAA0B,eAAE,OAAO;AAAA;AAAA,EAE5C,MAAM;AAAA;AAAA,EAEN,OAAO,eAAE,MAAM,qBAAqB;AAAA;AAAA,EAEpC,OAAO,eAAE,OAAO,EAAE,IAAI,EAAE,YAAY;AACxC,CAAC;AA4BM,IAAM,0BAA0B,eAAE,OAAO;AAAA;AAAA;AAAA,EAG5C,OAAO;AAAA;AAAA,EAEP,cAAc;AAAA;AAAA,EAEd,WAAW,eAAE,OAAO,EAAE,IAAI,CAAC;AAAA;AAAA,EAE3B,WAAW,eAAE,OAAO,EAAE,SAAS;AAAA;AAAA,EAE/B,WAAW,eAAE,OAAO,EAAE,IAAI,CAAC;AAAA;AAAA,EAE3B,eAAe,eAAE,OAAO,EAAE,IAAI,CAAC;AAAA;AAAA;AAAA,EAI/B,cAAc,eAAE,OAAO,EAAE,SAAS;AAAA;AAAA,EAElC,iBAAiB,eAAE,OAAO,EAAE,IAAI,EAAE,YAAY,EAAE,SAAS;AAAA;AAAA,EAEzD,sBAAsB,eAAE,OAAO,EAAE,SAAS;AAAA;AAAA,EAE1C,yBAAyB,eAAE,OAAO,EAAE,IAAI,EAAE,SAAS,EAAE,SAAS;AAAA;AAAA,EAE9D,YAAY,eAAE,OAAO,EAAE,SAAS,EAAE,SAAS;AAAA;AAAA,EAE3C,eAAe,wBAAwB,SAAS;AACpD,CAAC;AAiBM,IAAM,sBAAsB,eAAE,OAAO;AAAA;AAAA,EAExC,cAAc;AAAA;AAAA,EAEd,sBAAsB,eAAE,QAAQ,oBAAoB;AAAA;AAAA,EAEpD,aAAa,eAAE,OAAO,EAAE,IAAI,CAAC;AAAA;AAAA,EAE7B,cAAc,eAAE,OAAO,EAAE,IAAI,CAAC;AAAA;AAAA,EAE9B,iBAAiB,eAAE,OAAO,EAAE,IAAI,EAAE,YAAY;AAAA;AAAA,EAE9C,WAAW,eAAE,OAAO,EAAE,SAAS;AAAA;AAAA,EAE/B,yBAAyB,eAAE,OAAO,EAAE,IAAI,EAAE,SAAS,EAAE,SAAS;AAClE,CAAC;AAWM,IAAM,uBAAuB,eAAE,KAAK;AAAA,EACvC;AAAA;AAAA,EACA;AAAA;AAAA,EACA;AAAA;AAAA,EACA;AAAA;AACJ,CAAC;AAOM,IAAM,yBAAyB,eAAE,OAAO;AAAA;AAAA,EAE3C,QAAQ;AAAA;AAAA,EAER,cAAc;AAAA;AAAA,EAEd,SAAS,sBAAsB,SAAS;AAAA;AAAA,EAExC,IAAI,wBAAwB,SAAS;AAAA;AAAA,EAErC,QAAQ,eAAE,OAAO,EAAE,IAAI,CAAC,EAAE,SAAS;AAAA;AAAA,EAEnC,mBAAmB,eAAE,OAAO,EAAE,SAAS;AAAA;AAAA,EAEvC,WAAW,eAAE,OAAO,EAAE,SAAS;AAAA;AAAA,EAE/B,OAAO,eAAE,OAAO,EAAE,SAAS;AAC/B,CAAC;AAWM,SAAS,oBAAoB,OAA4C;AAC5E,SAAO,wBAAwB,UAAU,KAAK,EAAE;AACpD;AAKO,SAAS,gBAAgB,OAAwC;AACpE,SAAO,oBAAoB,UAAU,KAAK,EAAE;AAChD;AAUO,IAAM,oBAAoB,eAAE,OAAO;AAAA;AAAA,EAEtC,MAAM,eAAE,KAAK,CAAC,MAAM,OAAO,OAAO,MAAM,mBAAmB,IAAI,CAAC;AAAA;AAAA,EAEhE,MAAM;AAAA;AAAA,EAEN,QAAQ,eAAE,OAAO,EAAE,IAAI,CAAC;AAAA;AAAA,EAExB,SAAS,eAAE,OAAO,EAAE,IAAI,CAAC;AAAA;AAAA,EAEzB,KAAK,eAAE,OAAO,EAAE,IAAI,EAAE,SAAS;AACnC,CAAC;AAcM,IAAM,2BAA2B;AAAA;AAAA,EAEpC,mBAAmB;AAAA,IACf,OAAO;AAAA,IACP,cAAc;AAAA,IACd,WAAW;AAAA,IACX,WAAW;AAAA,IACX,WAAW;AAAA,IACX,eAAe;AAAA,IACf,cAAc;AAAA,IACd,iBAAiB;AAAA,IACjB,sBAAsB;AAAA,EAC1B;AAAA;AAAA,EAGA,eAAe;AAAA,IACX,cAAc;AAAA,IACd,sBAAsB;AAAA,IACtB,aAAa;AAAA,IACb,cAAc;AAAA,IACd,iBAAiB;AAAA,IACjB,WAAW;AAAA,EACf;AAAA;AAAA,EAGA,sBAAsB;AAAA,IAClB,QAAQ;AAAA,IACR,cAAc;AAAA,IACd,SAAS;AAAA,IACT,QAAQ;AAAA,IACR,mBAAmB;AAAA,IACnB,WAAW;AAAA,EACf;AACJ;","names":["KernelErrorCodeSchema","import_zod","import_zod","import_zod","import_zod","import_zod","KernelErrorCodeSchema","import_zod","import_zod","import_zod","import_zod"]}
+{"version":3,"sources":["../src/index.ts","../src/aar-envelope-v0.ts","../src/encoding.ts","../src/receipt-hash.ts","../src/verify-aar.ts","../src/surface.ts","../src/response.ts","../src/error-codes.ts","../src/receipt-v0.ts","../src/ids.ts","../src/shared-contract.ts","../src/w.ts","../src/agents.ts","../src/dispatch-chain.ts","../src/finality.ts","../src/eval-artifact.ts","../src/settlement-execute.ts","../src/srr-v0.ts","../src/liability-waiver-terms-v0.ts","../src/srr-v1.ts","../src/srr-signing.ts","../src/srr-verify.ts"],"sourcesContent":["/**\n * @hlos-ai/schemas - HLOS Kernel v2 API Contract Types\n *\n * This package defines the canonical types for HLOS Kernel v2:\n * - Response envelopes (SuccessResponse, ErrorResponse)\n * - Error codes (KernelErrorCode)\n * - Receipt format (SignedReceiptV0)\n * - Surface identifiers (Surface)\n * - Branded ID types (WalletId, PassportId, etc.)\n *\n * Surfaces (MCP, x402, Events, etc.) import from this package.\n * Kernel internals are NOT exported here.\n *\n * @packageDocumentation\n */\n\nexport {\n    AAR_ENVELOPE_TYPE,\n    AAR_ENVELOPE_VERSION,\n    AAREnvelopeV0Schema,\n    AAREnvelopeV0TypedSchema,\n    type AAREnvelopeV0,\n} from './aar-envelope-v0';\n\nexport {\n    verifyAAR,\n} from './verify-aar';\n\n// =============================================================================\n// Surface\n// =============================================================================\n\nexport {\n    SurfaceSchema,\n    type Surface,\n    SURFACES,\n} from './surface';\n\n// =============================================================================\n// Error Codes (legacy - superseded by shared-contract)\n// =============================================================================\n\n// NOTE: KernelErrorCodeSchema now exported from shared-contract with expanded codes.\n// Keeping error-codes.ts for backward compatibility, but shared-contract is canonical.\n\n\n// =============================================================================\n// Response Envelopes\n// =============================================================================\n\nexport {\n    type SuccessResponse,\n    type ErrorResponse,\n    success,\n    error,\n    SuccessResponseSchema,\n    ErrorResponseSchema,\n} from './response';\n\n// =============================================================================\n// SignedReceiptV0\n// =============================================================================\n\nexport {\n    RECEIPT_TYPE_URI,\n    RECEIPT_VERSION,\n    CONTENT_HASH_LENGTH,\n    SIGNATURE_LENGTH,\n    type SignedReceiptV0,\n    SignedReceiptV0Schema,\n    SignedReceiptV0LooseSchema,\n    isSignedReceiptV0,\n} from './receipt-v0';\n\n// =============================================================================\n// Branded IDs\n// =============================================================================\n\nexport {\n    type WalletId,\n    type PassportId,\n    type ReceiptId,\n    type CorrelationId,\n    type IdempotencyKey,\n    type CrossingId,\n    type DispatchId,\n    DispatchIdBrand,\n    WalletIdSchema,\n    PassportIdSchema,\n    ReceiptIdSchema,\n    CorrelationIdSchema,\n    IdempotencyKeySchema,\n    CrossingIdSchema,\n    DispatchIdSchema,\n    generateId,\n    generateWalletId,\n    generatePassportId,\n    generateReceiptId,\n    generateCrossingId,\n    generateDispatchId,\n} from './ids';\n\n// =============================================================================\n// Shared Contract (LOCKED)\n// =============================================================================\n\nexport {\n    // Error codes (STRICT ENUM)\n    KernelErrorCodeSchema,\n    type KernelErrorCode,\n    ERROR_CODE_STATUS,\n\n    // Response envelopes\n    KernelOkSchema,\n    type KernelOk,\n    KernelErrorSchema,\n    type KernelError,\n    type ApiResponse,\n    kernelOk,\n    kernelError,\n\n    // ID format validators\n    CrossingIdFormatSchema,\n    ReceiptIdFormatSchema,\n    PassportIdFormatSchema,\n    WalletIdFormatSchema,\n\n    // Attribution\n    FundingSourceSchema,\n    type FundingSource,\n    CredentialSourceSchema,\n    type CredentialSource,\n    deriveFundingSource,\n\n    // Crossing hash input\n    CrossingSnapshotV0Schema,\n    type CrossingSnapshotV0,\n    CrossingHashInputV0Schema,\n    type CrossingHashInputV0,\n    isCrossingHashInputV0,\n\n    // Settlement receipt\n    SETTLEMENT_AUTHORITY,\n    CrossingSettledReceiptSchema,\n    type CrossingSettledReceipt,\n    isCrossingSettledReceipt,\n\n    // Stack primitives\n    AvailabilityTypeSchema,\n    type AvailabilityType,\n    ProviderRoleSchema,\n    type ProviderRole,\n    StackProviderSchema,\n    type StackProvider,\n    StackSchema,\n    type Stack,\n    StackConnectionSchema,\n    type StackConnection,\n\n    // Golden test fixtures\n    GOLDEN_FIXTURES,\n} from './shared-contract';\n\n// =============================================================================\n// Family W — Privacy-Preserving Proofs (Phase 1 LOCKED)\n// =============================================================================\n\nexport {\n    // Domain separators (frozen)\n    W_RPID_DOMAIN,\n    W_TXCTX_DOMAIN,\n\n    // Encoding utilities\n    encodeEpoch,\n\n    // Schemas\n    RelyingPartyIdSchema,\n    type RelyingPartyId,\n    RotationEpochSchema,\n    type RotationEpoch,\n    RPIDSchema,\n    type RPID,\n    TransactionContextSchema,\n    type TransactionContext,\n    TransactionContextHashSchema,\n    type TransactionContextHash,\n\n    // Validation helpers\n    validateTimeWindow,\n\n    // Golden fixtures\n    W_GOLDEN_FIXTURES,\n} from './w';\n\n// =============================================================================\n// Agents Contracts\n// =============================================================================\n\nexport {\n    // Agents list\n    AgentsListResponseSchema,\n    type AgentsListResponse,\n    AgentListItemSchema,\n    type AgentListItem,\n\n    // Agent passport stub\n    AgentPassportStubResponseSchema,\n    type AgentPassportStubResponse,\n\n    // Enums (forward-compatible)\n    AgentStatusSchema,\n    type AgentStatus,\n    AgentTypeSchema,\n    type AgentType,\n} from './agents';\n\n// =============================================================================\n// Encoding Utilities (Zero Dependencies)\n// =============================================================================\n\nexport {\n    // Encoding/decoding\n    bytesToBase64url,\n    base64urlToBytes,\n\n    // Schemas\n    Base64urlSha256Schema,\n    Base64urlEd25519SigSchema,\n    BASE64URL_SHA256_REGEX,\n} from './encoding';\n\n// =============================================================================\n// Receipt Hash Computation (Requires @noble/hashes)\n// =============================================================================\n\nexport {\n    // JCS canonicalization (RFC 8785)\n    jcsCanonicalize,\n\n    // Hash computation\n    computeReceiptHash,\n    computeContentHash,\n\n    // Schemas\n    ReceiptHashSchema,\n\n    // Golden fixtures (FROZEN)\n    RECEIPT_HASH_GOLDEN_FIXTURE,\n} from './receipt-hash';\n\n// =============================================================================\n// Dispatch Chain (CR → LAT → EGP → SA)\n// =============================================================================\n\nexport {\n    CHAIN_STAGE_ORDER,\n    ChainStageTypeSchema,\n    type ChainStageType,\n    CustodyReceiptContentSchema,\n    type CustodyReceiptContent,\n    LiabilityAttestationContentSchema,\n    type LiabilityAttestationContent,\n    EconomicGateProofContentSchema,\n    type EconomicGateProofContent,\n    SettlementAnchorContentSchema,\n    type SettlementAnchorContent,\n    DispatchChainContentSchema,\n    type DispatchChainContent,\n    assertValidChainLink,\n    assertRootHash,\n} from './dispatch-chain';\n\n// =============================================================================\n// Finality — Notary Attestation & HARD Finality\n// =============================================================================\n\nexport {\n    // Constants\n    NA_ID_PREFIX,\n    FinalityLevel,\n\n    // ID format\n    NotaryAttestationIdFormatSchema,\n\n    // Notary Attestation (NA)\n    NotaryAttestationSchema,\n    type NotaryAttestation,\n    isNotaryAttestation,\n\n    // Notary Request (HLOS → STAAMPID)\n    NotaryRequestSchema,\n    type NotaryRequest,\n    isNotaryRequest,\n\n    // Notarize API response\n    NotarizeStatusSchema,\n    type NotarizeStatus,\n    NotarizeResponseSchema,\n    type NotarizeResponse,\n\n    // Merkle proof\n    LogInclusionProofSchema,\n    type LogInclusionProof,\n\n    // BRE artifact references\n    ArtifactRefSchema,\n    type ArtifactRef,\n\n    // Golden fixtures\n    FINALITY_GOLDEN_FIXTURES,\n} from './finality';\n\n// =============================================================================\n// Evaluation Artifact (EPIC 10)\n// =============================================================================\n\nexport {\n    EvalArtifactSchema,\n    type EvalArtifact,\n    EvalTranscriptStepSchema,\n    type EvalTranscriptStep,\n    EvalGraderResultSchema,\n    type EvalGraderResult,\n    EvalFailureSchema,\n    type EvalFailure,\n    EVAL_GOLDEN_FIXTURES,\n} from './eval-artifact';\n\n// =============================================================================\n// Settlement Execute Contract (EPIC 10 / K2 Bridge)\n// =============================================================================\n\nexport {\n    SettlementExecuteRequestSchema,\n    type SettlementExecuteRequest,\n    SettlementExecuteSuccessSchema,\n    type SettlementExecuteSuccess,\n    SettlementExecuteErrorSchema,\n    type SettlementExecuteError,\n    SettlementExecuteResponseSchema,\n    type SettlementExecuteResponse,\n    isSettlementExecuteSuccess,\n    isSettlementExecuteError,\n} from './settlement-execute';\n\n// =============================================================================\n// SignedRejectionReceiptV0 (U-family — Negative Finality)\n// =============================================================================\n\nexport {\n    // Constants\n    SRR_TYPE_URI,\n    SRR_VERSION,\n    SRR_REJECTION_DOMAIN,\n    SRR_SIGNATURE_ALGORITHM,\n    SRR_INITIAL_REASON_CODES,\n    REASON_CODE_PATTERN,\n\n    // Schema & types\n    SignedRejectionReceiptV0Schema,\n    type SignedRejectionReceiptV0,\n    type UnsignedSrrV0,\n} from './srr-v0';\n\nexport {\n    LIABILITY_WAIVER_TERMS_TYPE_URI,\n    LIABILITY_WAIVER_TERMS_VERSION,\n    LiabilityDispositionSchema,\n    type LiabilityDisposition,\n    LiabilityWaiverTermsPartiesSchema,\n    LiabilityWaiverTermsScopeSchema,\n    LiabilityWaiverTermsConditionsSchema,\n    LiabilityWaiverTermsHashInputSchema,\n    type LiabilityWaiverTermsHashInput,\n    LiabilityWaiverTermsRefV0Schema,\n    type LiabilityWaiverTermsRefV0,\n    LiabilityWaiverTermsV0Schema,\n    type LiabilityWaiverTermsV0,\n    toLiabilityWaiverTermsHashInput,\n    computeLiabilityWaiverTermsHash,\n} from './liability-waiver-terms-v0';\n\nexport {\n    SRR_V1_TYPE_URI,\n    SRR_V1_VERSION,\n    SRR_V1_REJECTION_DOMAIN,\n    SRR_V1_SIGNATURE_ALGORITHM,\n    SignedRejectionReceiptV1Schema,\n    type SignedRejectionReceiptV1,\n    type UnsignedSrrV1,\n} from './srr-v1';\n\nexport {\n    computeSrrSigningPayload,\n    computeSrrDigest,\n} from './srr-signing';\n\nexport {\n    verifyDetachedEd25519,\n    verifySignedRejectionReceipt,\n    type SrrVerificationResult,\n} from './srr-verify';\n","import { z } from 'zod';\nimport { Base64urlEd25519SigSchema, Base64urlSha256Schema } from './encoding';\n\nexport const AAR_ENVELOPE_TYPE = 'https://hlos.ai/schema/AAREnvelopeV0' as const;\nexport const AAR_ENVELOPE_VERSION = 0 as const;\n\n/**\n * Agent Action Receipt Envelope V0\n *\n * Wraps inner receipts or artifacts in a uniform, verifiable envelope.\n *\n * V0 intentionally uses z.unknown() for inner payloads.\n * Wiring PRs must narrow by content_type before production issuance.\n */\nexport const AAREnvelopeV0Schema = z.object({\n    '@type': z.literal(AAR_ENVELOPE_TYPE),\n    version: z.literal(AAR_ENVELOPE_VERSION),\n    content_type: z.string().min(1),\n    content_hash: Base64urlSha256Schema,\n    inner: z.unknown(),\n    signer_id: z.string().min(1),\n    signature: Base64urlEd25519SigSchema,\n    issued_at: z.string().datetime(),\n    previous_aar_hash: z.string().min(1),\n});\n\nexport const AAREnvelopeV0TypedSchema = <T extends z.ZodTypeAny>(\n    contentType: string,\n    innerSchema: T\n) =>\n    AAREnvelopeV0Schema.extend({\n        content_type: z.literal(contentType),\n        inner: innerSchema,\n    });\n\nexport type AAREnvelopeV0 = z.infer<typeof AAREnvelopeV0Schema>;\n","/**\n * @hlos-ai/schemas - Base64url Encoding Utilities\n *\n * RFC 4648 §5 compliant base64url encoding/decoding.\n * Zero external dependencies.\n *\n * Used for:\n * - receipt_hash: base64url(SHA-256(JCS(receipt)))\n * - content_hash: base64url(SHA-256(JCS(content)))\n * - crossing_hash: base64url(SHA-256(JCS(CrossingHashInputV0)))\n * - Ed25519 signatures and public keys\n */\n\nimport { z } from 'zod';\n\n// =============================================================================\n// Encoding\n// =============================================================================\n\n/**\n * Encode Uint8Array to base64url (RFC 4648 §5, no padding).\n */\nexport function bytesToBase64url(bytes: Uint8Array): string {\n    let binary = '';\n    for (let i = 0; i < bytes.length; i++) {\n        binary += String.fromCharCode(bytes[i]);\n    }\n    const base64 = btoa(binary);\n    return base64.replace(/\\+/g, '-').replace(/\\//g, '_').replace(/=+$/, '');\n}\n\n/**\n * Decode base64url string to Uint8Array.\n */\nexport function base64urlToBytes(str: string): Uint8Array {\n    const base64 = str.replace(/-/g, '+').replace(/_/g, '/');\n    const padded = base64 + '='.repeat((4 - (base64.length % 4)) % 4);\n    const binary = atob(padded);\n    const bytes = new Uint8Array(binary.length);\n    for (let i = 0; i < binary.length; i++) {\n        bytes[i] = binary.charCodeAt(i);\n    }\n    return bytes;\n}\n\n// =============================================================================\n// Schemas\n// =============================================================================\n\n/**\n * Regex for base64url-encoded SHA-256 hash (32 bytes = 43 chars, no padding).\n */\nexport const BASE64URL_SHA256_REGEX = /^[A-Za-z0-9_-]{43}$/;\n\n/**\n * Zod schema for a base64url-encoded SHA-256 hash.\n * 32 bytes = 43 chars base64url (no padding).\n */\nexport const Base64urlSha256Schema = z.string().regex(\n    BASE64URL_SHA256_REGEX,\n    'Must be 43-char base64url (32-byte SHA-256 digest)'\n);\n\n/**\n * Zod schema for a base64url-encoded Ed25519 signature.\n * 64 bytes = 86 chars base64url (no padding).\n */\nexport const Base64urlEd25519SigSchema = z.string().regex(\n    /^[A-Za-z0-9_-]{86}$/,\n    'Must be 86-char base64url (64-byte Ed25519 signature)'\n);\n","/**\n * @hlos-ai/schemas - Receipt Hash Computation\n *\n * Canonical hash computation for HLOS receipts.\n *\n * receipt_hash = base64url(SHA-256(JCS(receipt)))\n *\n * This is the hash that:\n * - BazaarReceiptEnvelope references (hash-first, per BRIDGE_SPEC.md §1.1)\n * - Notary Attestation (NA) binds to (per BRIDGE_SPEC.md §4.3)\n * - Surfaces use to reference kernel receipts unambiguously\n *\n * IMPORTANT: receipt_hash is computed over the ENTIRE SignedReceiptV0 envelope\n * (including content, content_hash, signature, key_id, etc.), NOT just content.\n * This binds the hash to a specific signed receipt version.\n *\n * Requires @noble/hashes as peer dependency.\n *\n * @see BRIDGE_SPEC.md §1.3 for canonical hashing requirements\n */\n\nimport { z } from 'zod';\nimport { bytesToBase64url, Base64urlSha256Schema } from './encoding';\nimport type { SignedReceiptV0 } from './receipt-v0';\n\nlet cachedSha256: ((data: Uint8Array) => Uint8Array) | null = null;\n\n// =============================================================================\n// JCS Canonicalization (RFC 8785)\n// =============================================================================\n\n/**\n * Recursively sort object keys lexicographically (RFC 8785 requirement).\n * @internal\n */\nfunction sortKeysDeep(value: unknown): unknown {\n    if (Array.isArray(value)) return value.map(sortKeysDeep);\n    if (value !== null && typeof value === 'object') {\n        const obj = value as Record<string, unknown>;\n        const out: Record<string, unknown> = {};\n        for (const key of Object.keys(obj).sort()) {\n            out[key] = sortKeysDeep(obj[key]);\n        }\n        return out;\n    }\n    return value;\n}\n\n/**\n * Detect lone surrogates (U+D800–U+DFFF) that are NOT part of a valid pair.\n * A high surrogate (D800–DBFF) must be followed by a low surrogate (DC00–DFFF).\n * Lone surrogates are invalid in well-formed UTF-8 / RFC 8259 JSON and can\n * cause parser differentials between JCS implementations.\n */\nfunction hasLoneSurrogate(s: string): boolean {\n    for (let i = 0; i < s.length; i++) {\n        const code = s.charCodeAt(i);\n        if (code >= 0xD800 && code <= 0xDBFF) {\n            const next = s.charCodeAt(i + 1);\n            if (isNaN(next) || next < 0xDC00 || next > 0xDFFF) return true;\n            i++;\n        } else if (code >= 0xDC00 && code <= 0xDFFF) {\n            return true;\n        }\n    }\n    return false;\n}\n\n/**\n * JCS (RFC 8785) canonical JSON serialization.\n *\n * Per RFC 8785:\n * - Object keys are lexicographically sorted\n * - Numbers use ES6 serialization\n * - Rejects: undefined, functions, symbols, bigint, non-finite numbers\n * - Rejects: strings containing lone surrogates (U+D800–U+DFFF)\n *\n * @throws Error if value contains non-canonicalizable types\n */\nexport function jcsCanonicalize(value: unknown): string {\n    return JSON.stringify(sortKeysDeep(value), (_key, v) => {\n        if (v === undefined) throw new Error('JCS: undefined is not allowed');\n        if (typeof v === 'function') throw new Error('JCS: function is not allowed');\n        if (typeof v === 'symbol') throw new Error('JCS: symbol is not allowed');\n        if (typeof v === 'bigint') throw new Error('JCS: bigint is not allowed');\n        if (typeof v === 'number' && !Number.isFinite(v))\n            throw new Error('JCS: non-finite number is not allowed');\n        if (typeof v === 'string' && hasLoneSurrogate(v))\n            throw new Error('JCS: lone surrogate (U+D800–U+DFFF) is not allowed');\n        return v;\n    });\n}\n\n// =============================================================================\n// Hash Computation\n// =============================================================================\n\n/**\n * Compute receipt_hash for a SignedReceiptV0.\n *\n * receipt_hash = base64url(SHA-256(JCS(receipt)))\n *\n * The hash is over the ENTIRE receipt envelope (content, content_hash,\n * signature, key_id, @type, version, receipt_id, issued_at).\n *\n * This is the canonical hash format per BRIDGE_SPEC.md §1.3:\n * 1. Canonicalize the receipt using RFC 8785 JCS\n * 2. Hash canonical bytes using SHA-256\n * 3. Encode as base64url (no padding)\n *\n * @param receipt - A fully-formed SignedReceiptV0 (must already be signed)\n * @returns 43-char base64url string (32-byte SHA-256 digest)\n *\n * @example\n * ```typescript\n * const receipt = issueReceiptV0(content);\n * const hash = computeReceiptHash(receipt);\n * // hash is e.g. \"z8A2kCNck4rPL4ugNe-Fbxputdi3PkjkVpSrIBhojU0\"\n * ```\n */\nexport function computeReceiptHash(receipt: SignedReceiptV0): string {\n    // Lazy-load to keep this module usable without @noble/hashes installed\n    // (only fails at call time if peer dep is missing)\n    const sha256 = loadSha256();\n    const canonical = jcsCanonicalize(receipt);\n    const digest = sha256(new TextEncoder().encode(canonical));\n    return bytesToBase64url(digest);\n}\n\n/**\n * Compute content_hash for arbitrary content.\n *\n * content_hash = base64url(SHA-256(JCS(content)))\n *\n * This is the hash stored in SignedReceiptV0.content_hash.\n * It hashes only the content field, NOT the entire receipt.\n *\n * @param content - The content to hash (will be JCS-canonicalized)\n * @returns 43-char base64url string (32-byte SHA-256 digest)\n */\nexport function computeContentHash(content: unknown): string {\n    const sha256 = loadSha256();\n    const canonical = jcsCanonicalize(content);\n    const digest = sha256(new TextEncoder().encode(canonical));\n    return bytesToBase64url(digest);\n}\n\n/**\n * Lazy-load SHA-256 from @noble/hashes (optional peer dependency).\n * @internal\n */\nfunction loadSha256(): (data: Uint8Array) => Uint8Array {\n    if (cachedSha256) return cachedSha256;\n\n    // Resolve require for both ESM and CJS contexts without import.meta so\n    // CommonJS test runners can parse this file directly.\n    // eslint-disable-next-line @typescript-eslint/no-explicit-any\n    const moduleApi = typeof process.getBuiltinModule === 'function'\n        // eslint-disable-next-line @typescript-eslint/no-explicit-any\n        ? (process.getBuiltinModule('module') as any)\n        : // eslint-disable-next-line @typescript-eslint/no-require-imports\n          require('node:module');\n    const createRequire = moduleApi.createRequire as (filename: string) => NodeRequire;\n    const requireBase = typeof __filename === 'string'\n        ? __filename\n        : `${process.cwd()}/package.json`;\n    const _require = createRequire(requireBase);\n\n    let sha256: (data: Uint8Array) => Uint8Array;\n    try {\n        // @noble/hashes v2.x exports from sha2.js\n        sha256 = _require('@noble/hashes/sha2.js').sha256;\n    } catch {\n        try {\n            // Fallback for bundlers that resolve without .js extension\n            sha256 = _require('@noble/hashes/sha2').sha256;\n        } catch {\n            throw new Error(\n                'computeReceiptHash/computeContentHash requires @noble/hashes as a peer dependency. ' +\n                'Install it: npm install @noble/hashes'\n            );\n        }\n    }\n    cachedSha256 = sha256;\n    return sha256;\n}\n\n// =============================================================================\n// Schemas\n// =============================================================================\n\n/**\n * Zod schema for receipt_hash field.\n * base64url(SHA-256(JCS(receipt))) — always 43 chars.\n */\nexport const ReceiptHashSchema = Base64urlSha256Schema.describe(\n    'receipt_hash: base64url(SHA-256(JCS(receipt)))'\n);\n\n// =============================================================================\n// Golden Fixtures\n// =============================================================================\n\n/**\n * Golden receipt fixture for hash conformance testing.\n *\n * This is a deterministic SignedReceiptV0 with fixed field values.\n * The receipt_hash computed over this fixture is FROZEN.\n *\n * If your computeReceiptHash() produces a different result for this input,\n * your implementation is non-conformant. DO NOT CHANGE these values.\n */\nexport const RECEIPT_HASH_GOLDEN_FIXTURE = {\n    receipt: {\n        '@type': 'https://hlos.ai/schema/SignedReceiptV0' as const,\n        version: 0 as const,\n        receipt_id: 'rcpt_01HZGOLDENTEST000000000000',\n        content: {\n            type: 'CrossingSettled' as const,\n            crossingId: 'cross_test123abc456def789ghi',\n            settlement_authority: 'hlos.ai',\n        },\n        // Placeholder bytes (NOT a valid cryptographic signature)\n        content_hash: 'AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA',\n        signature:\n            'AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA',\n        key_id: 'hlos-v2-1',\n        issued_at: '2026-01-27T00:00:00.000Z',\n    } satisfies SignedReceiptV0,\n\n    /**\n     * Expected JCS canonical form of the receipt.\n     * Keys are lexicographically sorted at all levels.\n     */\n    expectedJcs: '{\"@type\":\"https://hlos.ai/schema/SignedReceiptV0\",\"content\":{\"crossingId\":\"cross_test123abc456def789ghi\",\"settlement_authority\":\"hlos.ai\",\"type\":\"CrossingSettled\"},\"content_hash\":\"AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA\",\"issued_at\":\"2026-01-27T00:00:00.000Z\",\"key_id\":\"hlos-v2-1\",\"receipt_id\":\"rcpt_01HZGOLDENTEST000000000000\",\"signature\":\"AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA\",\"version\":0}',\n\n    /**\n     * Expected receipt_hash (FROZEN).\n     * Compute: JCS canonicalize receipt → SHA-256 → base64url (no padding)\n     *\n     * DO NOT CHANGE unless the receipt fixture above changes.\n     */\n    expectedReceiptHash: 'uLiQVUeVKcE35Rdje2fArZQfTcECDgwK6UbmQB_36Pg',\n} as const;\n","import { AAREnvelopeV0Schema, type AAREnvelopeV0 } from './aar-envelope-v0';\nimport { base64urlToBytes } from './encoding';\nimport { computeContentHash } from './receipt-hash';\n\ntype VerifyKey = CryptoKey | Uint8Array;\n\nfunction toBuffer(bytes: Uint8Array): ArrayBuffer {\n    const ab = new ArrayBuffer(bytes.byteLength);\n    new Uint8Array(ab).set(bytes);\n    return ab;\n}\n\nasync function importPublicKey(publicKey: VerifyKey): Promise<CryptoKey> {\n    if (typeof CryptoKey !== 'undefined' && publicKey instanceof CryptoKey) {\n        return publicKey;\n    }\n\n    const raw = publicKey as Uint8Array;\n    return crypto.subtle.importKey(\n        'raw',\n        toBuffer(raw),\n        'Ed25519',\n        false,\n        ['verify']\n    );\n}\n\nexport async function verifyAAR(\n    envelope: unknown,\n    publicKey: VerifyKey\n): Promise<AAREnvelopeV0> {\n    const parsed = AAREnvelopeV0Schema.parse(envelope);\n    const contentHash = computeContentHash(parsed.inner);\n\n    if (contentHash !== parsed.content_hash) {\n        throw new Error('AAR content hash mismatch');\n    }\n\n    const key = await importPublicKey(publicKey);\n    const verified = await crypto.subtle.verify(\n        'Ed25519',\n        key,\n        toBuffer(base64urlToBytes(parsed.signature)),\n        toBuffer(base64urlToBytes(parsed.content_hash))\n    );\n\n    if (!verified) {\n        throw new Error(`AAR signature verification failed for signer ${parsed.signer_id}`);\n    }\n\n    return parsed;\n}\n","/**\n * @hlos-ai/schemas - Surface Types\n *\n * Canonical surface identifiers for idempotency scoping,\n * audit logging, and request attribution.\n */\n\nimport { z } from 'zod';\n\n/**\n * Known surfaces that interact with HLOS Kernel v2.\n * Used for idempotency scoping: (surface, idempotency_key) must be unique.\n */\nexport const SurfaceSchema = z.enum([\n    'mcp',      // Model Context Protocol servers\n    'x402',     // x402 micropayment protocol\n    'events',   // events.hlos.ai\n    'cli',      // HLOS CLI\n    'web',      // hlos.ai web app\n    'acp',      // Agent Commerce Protocol\n    'api',      // Direct API calls (default for unspecified)\n]);\n\nexport type Surface = z.infer<typeof SurfaceSchema>;\n\n/**\n * All known surfaces as a const array (for iteration).\n */\nexport const SURFACES = SurfaceSchema.options;\n","/**\n * @hlos-ai/schemas - Response Types\n *\n * Standard response envelopes for HLOS Kernel v2 API.\n *\n * - Reads return SuccessResponse<T>\n * - Mutations return SignedReceiptV0<T>\n * - Errors return ErrorResponse\n */\n\nimport { z } from 'zod';\nimport { KernelErrorCodeSchema, type KernelErrorCode } from './error-codes';\n\n// =============================================================================\n// Success Response (for reads)\n// =============================================================================\n\n/**\n * Standard success response for read operations.\n * Mutations return SignedReceiptV0 instead.\n */\nexport interface SuccessResponse<T> {\n    success: true;\n    data: T;\n    meta?: {\n        request_id?: string;\n        correlation_id: string;\n    };\n}\n\n/**\n * Create a SuccessResponse.\n */\nexport function success<T>(data: T, correlationId: string, requestId?: string): SuccessResponse<T> {\n    return {\n        success: true,\n        data,\n        meta: {\n            correlation_id: correlationId,\n            ...(requestId && { request_id: requestId }),\n        },\n    };\n}\n\n// =============================================================================\n// Error Response\n// =============================================================================\n\n/**\n * Standard error response.\n */\nexport interface ErrorResponse {\n    success: false;\n    error: {\n        code: KernelErrorCode;\n        message: string;\n        details?: unknown;\n        correlation_id: string;\n    };\n}\n\n/**\n * Create an ErrorResponse.\n */\nexport function error(\n    code: KernelErrorCode,\n    message: string,\n    correlationId: string,\n    details?: unknown\n): ErrorResponse {\n    return {\n        success: false,\n        error: {\n            code,\n            message,\n            correlation_id: correlationId,\n            ...(details !== undefined && { details }),\n        },\n    };\n}\n\n// =============================================================================\n// Zod Schemas (for runtime validation)\n// =============================================================================\n\nexport const SuccessResponseSchema = <T extends z.ZodType>(dataSchema: T) =>\n    z.object({\n        success: z.literal(true),\n        data: dataSchema,\n        meta: z.object({\n            request_id: z.string().optional(),\n            correlation_id: z.string(),\n        }).optional(),\n    });\n\nexport const ErrorResponseSchema = z.object({\n    success: z.literal(false),\n    error: z.object({\n        code: KernelErrorCodeSchema,\n        message: z.string(),\n        details: z.unknown().optional(),\n        correlation_id: z.string(),\n    }),\n});\n","/**\n * @hlos-ai/schemas - Error Codes\n *\n * Canonical error codes for HLOS Kernel v2 API.\n * These are FROZEN — additive changes only.\n */\n\nimport { z } from 'zod';\n\n/**\n * Kernel error codes (stable, exhaustive).\n */\nexport const KernelErrorCodeSchema = z.enum([\n    // 4xx Client Errors\n    'INVALID_REQUEST',        // 400 - Malformed request body\n    'UNAUTHORIZED',           // 401 - Missing/invalid auth\n    'FORBIDDEN',              // 403 - Insufficient permissions\n    'NOT_FOUND',              // 404 - Resource doesn't exist\n    'CONFLICT',               // 409 - General conflict\n    'IDEMPOTENCY_CONFLICT',   // 409 - Same idem_key, different request\n    'INSUFFICIENT_BALANCE',   // 402 - Wallet lacks funds\n    'SPEND_CAP_EXCEEDED',     // 402 - Spend cap hit\n    'RATE_LIMITED',           // 429 - Too many requests\n\n    // 5xx Server Errors\n    'INTERNAL_ERROR',         // 500 - Server error\n    'SERVICE_UNAVAILABLE',    // 503 - Temporarily unavailable\n]);\n\nexport type KernelErrorCode = z.infer<typeof KernelErrorCodeSchema>;\n\n/**\n * HTTP status code mapping for each error code.\n */\nexport const ERROR_CODE_STATUS: Record<KernelErrorCode, number> = {\n    INVALID_REQUEST: 400,\n    UNAUTHORIZED: 401,\n    FORBIDDEN: 403,\n    NOT_FOUND: 404,\n    CONFLICT: 409,\n    IDEMPOTENCY_CONFLICT: 409,\n    INSUFFICIENT_BALANCE: 402,\n    SPEND_CAP_EXCEEDED: 402,\n    RATE_LIMITED: 429,\n    INTERNAL_ERROR: 500,\n    SERVICE_UNAVAILABLE: 503,\n};\n","/**\n * @hlos-ai/schemas - SignedReceiptV0\n *\n * Canonical receipt format for HLOS Kernel v2 mutations.\n * All mutating operations emit this receipt type.\n *\n * FROZEN: Breaking changes require version bump.\n */\n\nimport { z } from 'zod';\nimport type { ReceiptId } from './ids';\n\n// =============================================================================\n// Constants\n// =============================================================================\n\n/**\n * Receipt type URI (JSON-LD style).\n */\nexport const RECEIPT_TYPE_URI = 'https://hlos.ai/schema/SignedReceiptV0' as const;\n\n/**\n * Current receipt format version.\n * This is a NUMBER, not semver.\n */\nexport const RECEIPT_VERSION = 0 as const;\n\n// =============================================================================\n// Types\n// =============================================================================\n\n/**\n * SignedReceiptV0: Canonical receipt for all v2 mutations.\n *\n * Content is JCS-canonicalized, SHA-256 hashed, Ed25519 signed.\n *\n * @template T - The content type (mutation-specific payload)\n */\nexport interface SignedReceiptV0<T = unknown> {\n    /**\n     * Type URI for JSON-LD compatibility.\n     */\n    '@type': typeof RECEIPT_TYPE_URI;\n\n    /**\n     * Format version (number, not semver).\n     * Increment for breaking format changes.\n     */\n    version: typeof RECEIPT_VERSION;\n\n    /**\n     * Unique receipt identifier.\n     */\n    receipt_id: ReceiptId | string;\n\n    /**\n     * The mutation payload (JCS-canonicalized before hashing).\n     */\n    content: T;\n\n    /**\n     * SHA-256 hash of JCS(content), base64url encoded.\n     *\n     * IMPORTANT: This is base64url of the raw 32-byte digest,\n     * NOT hex encoding. Matches signature input format.\n     */\n    content_hash: string;\n\n    /**\n     * Ed25519 signature over the raw 32-byte content_hash digest.\n     * base64url encoded.\n     *\n     * Signing process:\n     *   1. canonicalize = JCS(content)\n     *   2. digest = SHA-256(canonicalize) → 32 bytes\n     *   3. signature = Ed25519.sign(private_key, digest)\n     *   4. encode = base64url(signature)\n     */\n    signature: string;\n\n    /**\n     * Key identifier for signature verification.\n     * Resolves via JWKS endpoint: GET /api/v2/.well-known/keys\n     */\n    key_id: string;\n\n    /**\n     * ISO 8601 timestamp when receipt was issued.\n     */\n    issued_at: string;\n}\n\n// =============================================================================\n// Zod Schema\n// =============================================================================\n\n/**\n * Strict base64url length constants:\n * - SHA-256 digest (32 bytes) = 43 chars base64url (no padding)\n * - Ed25519 signature (64 bytes) = 86 chars base64url (no padding)\n */\nexport const CONTENT_HASH_LENGTH = 43;\nexport const SIGNATURE_LENGTH = 86;\n\nexport const SignedReceiptV0Schema = <T extends z.ZodType>(contentSchema: T) =>\n    z.object({\n        '@type': z.literal(RECEIPT_TYPE_URI),\n        version: z.literal(RECEIPT_VERSION),\n        receipt_id: z.string(),\n        content: contentSchema,\n        // SHA-256 digest (32 bytes) = exactly 43 chars base64url\n        content_hash: z.string().regex(\n            /^[A-Za-z0-9_-]{43}$/,\n            'content_hash must be 43-char base64url (32-byte SHA-256)'\n        ),\n        // Ed25519 signature (64 bytes) = exactly 86 chars base64url\n        signature: z.string().regex(\n            /^[A-Za-z0-9_-]{86}$/,\n            'signature must be 86-char base64url (64-byte Ed25519)'\n        ),\n        key_id: z.string().min(1),\n        issued_at: z.string().datetime(),\n    });\n\n/**\n * Loose schema for unknown content types.\n */\nexport const SignedReceiptV0LooseSchema = SignedReceiptV0Schema(z.unknown());\n\n// =============================================================================\n// Type Guards\n// =============================================================================\n\n/**\n * Check if a value is a SignedReceiptV0.\n */\nexport function isSignedReceiptV0(value: unknown): value is SignedReceiptV0 {\n    if (typeof value !== 'object' || value === null) return false;\n    const obj = value as Record<string, unknown>;\n    return (\n        obj['@type'] === RECEIPT_TYPE_URI &&\n        obj['version'] === RECEIPT_VERSION &&\n        typeof obj['receipt_id'] === 'string' &&\n        typeof obj['content_hash'] === 'string' &&\n        typeof obj['signature'] === 'string' &&\n        typeof obj['key_id'] === 'string' &&\n        typeof obj['issued_at'] === 'string'\n    );\n}\n","/**\n * @hlos-ai/schemas - Branded ID Types\n *\n * Strongly-typed ID strings to prevent cross-surface mistakes.\n * Use Zod for runtime validation.\n */\n\nimport { z } from 'zod';\n\n// =============================================================================\n// ID Patterns\n// =============================================================================\n\n/**\n * ULID pattern (26 chars, Crockford base32).\n */\nconst ULID_PATTERN = /^[0-9A-HJKMNP-TV-Z]{26}$/i;\n\n/**\n * CUID pattern (starts with 'c', 25+ chars).\n */\nconst CUID_PATTERN = /^c[a-z0-9]{24,}$/;\n\n/**\n * UUID v4 pattern.\n */\nconst UUID_V4_PATTERN = /^[0-9a-f]{8}-[0-9a-f]{4}-4[0-9a-f]{3}-[89ab][0-9a-f]{3}-[0-9a-f]{12}$/i;\n\n// =============================================================================\n// Branded Types (TypeScript compile-time safety)\n// =============================================================================\n\ndeclare const WalletIdBrand: unique symbol;\ndeclare const PassportIdBrand: unique symbol;\ndeclare const ReceiptIdBrand: unique symbol;\ndeclare const CorrelationIdBrand: unique symbol;\ndeclare const IdempotencyKeyBrand: unique symbol;\ndeclare const CrossingIdBrand: unique symbol;\n/** Runtime symbol export keeps DTS declarations nameable across entrypoints. */\nexport const DispatchIdBrand = Symbol('DispatchIdBrand');\n\nexport type WalletId = string & { readonly [WalletIdBrand]: true };\nexport type PassportId = string & { readonly [PassportIdBrand]: true };\nexport type ReceiptId = string & { readonly [ReceiptIdBrand]: true };\nexport type CorrelationId = string & { readonly [CorrelationIdBrand]: true };\nexport type IdempotencyKey = string & { readonly [IdempotencyKeyBrand]: true };\nexport type CrossingId = string & { readonly [CrossingIdBrand]: true };\nexport type DispatchId = string & { readonly [DispatchIdBrand]: true };\n\n// =============================================================================\n// Zod Schemas (runtime validation)\n// =============================================================================\n\n/**\n * WalletId: prefixed CUID or ULID.\n */\nexport const WalletIdSchema = z.string()\n    .regex(/^wallet_[a-z0-9]{20,}$/i, 'Invalid WalletId format')\n    .transform((s) => s as WalletId);\n\n/**\n * PassportId: prefixed CUID or ULID.\n */\nexport const PassportIdSchema = z.string()\n    .regex(/^passport_[a-z0-9]{20,}$/i, 'Invalid PassportId format')\n    .transform((s) => s as PassportId);\n\n/**\n * ReceiptId: prefixed ULID.\n */\nexport const ReceiptIdSchema = z.string()\n    .regex(/^rcpt_[0-9A-HJKMNP-TV-Z]{26}$/i, 'Invalid ReceiptId format')\n    .transform((s) => s as ReceiptId);\n\n/**\n * CorrelationId: UUID v4 or custom format.\n */\nexport const CorrelationIdSchema = z.string()\n    .min(8)\n    .max(128)\n    .transform((s) => s as CorrelationId);\n\n/**\n * IdempotencyKey: client-provided, opaque.\n * Max 256 chars, printable ASCII.\n */\nexport const IdempotencyKeySchema = z.string()\n    .min(1)\n    .max(256)\n    .regex(/^[\\x20-\\x7E]+$/, 'IdempotencyKey must be printable ASCII')\n    .transform((s) => s as IdempotencyKey);\n\n/**\n * CrossingId: prefixed CUID.\n */\nexport const CrossingIdSchema = z.string()\n    .regex(/^cross_[a-z0-9]{20,}$/i, 'Invalid CrossingId format')\n    .transform((s) => s as CrossingId);\n\n/**\n * DispatchId: prefixed CUID, canonical lowercase.\n * No /i flag — deterministic for cryptographic contexts.\n */\nexport const DispatchIdSchema = z.string()\n    .regex(/^dispatch_[a-z0-9]{20,}$/, 'Invalid DispatchId format')\n    .transform((s) => s as DispatchId);\n\n// =============================================================================\n// ID Generation Helpers\n// =============================================================================\n\n/**\n * Generate a prefixed CUID-style ID.\n * Uses crypto.randomUUID() stripped of dashes + timestamp prefix.\n */\nexport function generateId(prefix: string): string {\n    const timestamp = Date.now().toString(36);\n    const random = crypto.randomUUID().replace(/-/g, '').slice(0, 16);\n    return `${prefix}_${timestamp}${random}`;\n}\n\nexport const generateWalletId = (): WalletId => generateId('wallet') as WalletId;\nexport const generatePassportId = (): PassportId => generateId('passport') as PassportId;\nexport const generateReceiptId = (): ReceiptId => generateId('rcpt') as ReceiptId;\nexport const generateCrossingId = (): CrossingId => generateId('cross') as CrossingId;\nexport const generateDispatchId = (): DispatchId => generateId('dispatch') as DispatchId;\n","/**\n * @hlos-ai/schemas - Shared Contract Types\n *\n * LOCKED CONTRACT — All tracks must import from this file.\n * No local redefinitions allowed.\n *\n * Contains:\n * - Response envelopes (KernelOk, KernelError, ApiResponse)\n * - Error codes (KernelErrorCode) - STRICT ENUM\n * - Attribution enums (FundingSource, CredentialSource)\n * - Crossing types (CrossingSnapshotV0, CrossingHashInputV0, CrossingSettledReceipt)\n * - Stack primitives (Stack, StackProvider, StackConnection)\n * - Test fixtures (golden vectors for conformance)\n */\n\nimport { z } from 'zod';\n\n// =============================================================================\n// ERROR CODES (STRICT ENUM - P0)\n// =============================================================================\n\n/**\n * Kernel error codes - STRICT ENUM.\n * Uses KernelErrorCodeSchema instead of z.string() to prevent drift.\n */\nexport const KernelErrorCodeSchema = z.enum([\n    // Validation / Request errors\n    'VALIDATION_ERROR',           // 400 - Input validation failed\n    'INVALID_REQUEST',            // 400 - Malformed request\n\n    // Auth errors\n    'UNAUTHORIZED',               // 401 - Missing/invalid auth\n    'FORBIDDEN',                  // 403 - Insufficient permissions\n\n    // Resource errors\n    'NOT_FOUND',                  // 404 - Generic not found\n    'CROSSING_NOT_FOUND',         // 404 - Crossing not found\n    'STACK_NOT_FOUND',            // 404 - Stack not found\n    'STACK_CONNECTION_NOT_FOUND', // 404 - Stack connection not found\n\n    // Conflict errors\n    'CONFLICT',                 // 409 - Generic conflict\n    'INVALID_STATE_TRANSITION',   // 409 - State machine violation\n    'CROSSING_ALREADY_SETTLED',   // 409 - Crossing already settled\n    'IDEMPOTENCY_CONFLICT',       // 409 - Same key, different request\n\n    // Payment errors\n    'INSUFFICIENT_BALANCE',       // 402 - Wallet lacks funds\n    'SPEND_CAP_EXCEEDED',         // 402 - Spend cap hit\n\n    // Rate limiting\n    'RATE_LIMITED',               // 429 - Too many requests\n\n    // Server errors\n    'INTERNAL_ERROR',             // 500 - Server error\n    'SERVICE_UNAVAILABLE',        // 503 - Temporarily unavailable\n]);\n\nexport type KernelErrorCode = z.infer<typeof KernelErrorCodeSchema>;\n\n/**\n * HTTP status code mapping for each error code.\n */\nexport const ERROR_CODE_STATUS: Record<KernelErrorCode, number> = {\n    VALIDATION_ERROR: 400,\n    INVALID_REQUEST: 400,\n    UNAUTHORIZED: 401,\n    FORBIDDEN: 403,\n    NOT_FOUND: 404,\n    CROSSING_NOT_FOUND: 404,\n    STACK_NOT_FOUND: 404,\n    STACK_CONNECTION_NOT_FOUND: 404,\n    CONFLICT: 409,\n    INVALID_STATE_TRANSITION: 409,\n    CROSSING_ALREADY_SETTLED: 409,\n    IDEMPOTENCY_CONFLICT: 409,\n    INSUFFICIENT_BALANCE: 402,\n    SPEND_CAP_EXCEEDED: 402,\n    RATE_LIMITED: 429,\n    INTERNAL_ERROR: 500,\n    SERVICE_UNAVAILABLE: 503,\n};\n\n// =============================================================================\n// RESPONSE ENVELOPES\n// =============================================================================\n\n/**\n * KernelOk - Standard success envelope.\n * Status: 200-299 (success) OR 304 (not modified).\n * NOT arbitrary 3xx (302 implies navigation semantics, not API success).\n */\nexport const KernelOkSchema = <T extends z.ZodType>(dataSchema: T) =>\n    z.object({\n        ok: z.literal(true),\n        status: z.union([\n            z.number().int().min(200).max(299),\n            z.literal(304),\n        ]),\n        data: dataSchema,\n    });\n\nexport type KernelOk<T> = {\n    ok: true;\n    status: number;\n    data: T;\n};\n\n/**\n * KernelError - Standard error envelope.\n * Uses STRICT KernelErrorCodeSchema.\n */\nexport const KernelErrorSchema = z.object({\n    ok: z.literal(false),\n    status: z.number().int().min(400).max(599),\n    error: z.object({\n        code: KernelErrorCodeSchema, // P0 FIX: was z.string()\n        message: z.string(),\n        details: z.record(z.unknown()).optional(),\n    }),\n});\n\nexport type KernelError = z.infer<typeof KernelErrorSchema>;\n\n/**\n * ApiResponse - Union of success and error.\n */\nexport type ApiResponse<T> = KernelOk<T> | KernelError;\n\n// =============================================================================\n// ID SCHEMAS (P0 - Format validators)\n// =============================================================================\n\n/**\n * CrossingId format: cross_[a-z0-9]{20,}\n */\nexport const CrossingIdFormatSchema = z.string()\n    .regex(/^cross_[a-z0-9]{20,}$/i, 'Invalid CrossingId format (expected: cross_...)');\n\n/**\n * ReceiptId format: rcpt_[0-9A-HJKMNP-TV-Z]{26}\n */\nexport const ReceiptIdFormatSchema = z.string()\n    .regex(/^rcpt_[0-9A-HJKMNP-TV-Z]{26}$/i, 'Invalid ReceiptId format (expected: rcpt_...)');\n\n/**\n * PassportId format: passport_[a-z0-9]{20,}\n */\nexport const PassportIdFormatSchema = z.string()\n    .regex(/^passport_[a-z0-9]{20,}$/i, 'Invalid PassportId format (expected: passport_...)');\n\n/**\n * WalletId format: wallet_[a-z0-9]{20,}\n */\nexport const WalletIdFormatSchema = z.string()\n    .regex(/^wallet_[a-z0-9]{20,}$/i, 'Invalid WalletId format (expected: wallet_...)');\n\n// =============================================================================\n// ATTRIBUTION ENUMS\n// =============================================================================\n\n/**\n * FundingSource - Who paid for this crossing.\n * Determined by credential_source (see mapping rule below).\n */\nexport const FundingSourceSchema = z.enum(['SPONSOR', 'PLATFORM', 'USER']);\nexport type FundingSource = z.infer<typeof FundingSourceSchema>;\n\n/**\n * CredentialSource - Where the credential came from.\n */\nexport const CredentialSourceSchema = z.enum([\n    'SPONSOR_KEY',   // Sponsor-provisioned key\n    'BYOK',          // Bring Your Own Key (user-provided)\n    'HLOS_FALLBACK', // Platform fallback credential\n]);\nexport type CredentialSource = z.infer<typeof CredentialSourceSchema>;\n\n/**\n * Deterministic funding mapping rule.\n * INVARIANT: credential_source determines funding_source.\n */\nexport function deriveFundingSource(credentialSource: CredentialSource): FundingSource {\n    switch (credentialSource) {\n        case 'SPONSOR_KEY':\n            return 'SPONSOR';\n        case 'BYOK':\n            return 'USER';\n        case 'HLOS_FALLBACK':\n            return 'PLATFORM';\n    }\n}\n\n// =============================================================================\n// CROSSING HASH INPUT\n// =============================================================================\n\n/**\n * CrossingSnapshotV0 - Stable fields for hash computation.\n *\n * INVARIANT: Must NOT include any derived or mutable fields:\n * - state, receiptIds, settledAt, createdAt/updatedAt\n */\nexport const CrossingSnapshotV0Schema = z.object({\n    crossingId: CrossingIdFormatSchema,\n    capabilityId: z.string(),\n    passportId: PassportIdFormatSchema,\n\n    // Scoping\n    event_id: z.string().nullable(),\n    access_window_id: z.string().nullable(),\n    access_grant_id: z.string().nullable(),\n\n    // Attribution\n    attribution_org_id: z.string().nullable(),\n    funding_source: FundingSourceSchema.nullable(),\n    credential_source: CredentialSourceSchema,\n});\n\nexport type CrossingSnapshotV0 = z.infer<typeof CrossingSnapshotV0Schema>;\n\n/**\n * CrossingHashInputV0 - Input to hash function.\n * Uses version marker for future-proofing.\n */\nexport const CrossingHashInputV0Schema = z.object({\n    v: z.literal(0),\n    snapshot: CrossingSnapshotV0Schema,\n    attested_receipt_id: ReceiptIdFormatSchema,\n});\n\nexport type CrossingHashInputV0 = z.infer<typeof CrossingHashInputV0Schema>;\n\n// =============================================================================\n// CROSSING SETTLED RECEIPT\n// =============================================================================\n\n/**\n * SettlementAuthority - LITERAL (no drift).\n */\nexport const SETTLEMENT_AUTHORITY = 'hlos.ai' as const;\n\n/**\n * CrossingSettledReceipt - Issued when crossing reaches SETTLED state.\n */\nexport const CrossingSettledReceiptSchema = z.object({\n    type: z.literal('CrossingSettled'),\n    crossingId: CrossingIdFormatSchema,\n\n    // Scoping (powers adoption + ROI views)\n    event_id: z.string().nullable(),\n    access_window_id: z.string().nullable(),\n    access_grant_id: z.string().nullable(),\n\n    // Attribution\n    attribution_org_id: z.string().nullable(),\n    funding_source: FundingSourceSchema.nullable(),\n    credential_source: CredentialSourceSchema,\n\n    // Authority (LITERAL)\n    settlement_authority: z.literal(SETTLEMENT_AUTHORITY),\n\n    // Binding\n    crossing_hash: z.string(),        // sha256 base64url of CrossingHashInputV0\n    attested_receipt_id: z.string(),\n\n    // Timestamp\n    settled_at: z.string().datetime(),\n});\n\nexport type CrossingSettledReceipt = z.infer<typeof CrossingSettledReceiptSchema>;\n\n// =============================================================================\n// STACK PRIMITIVES (Product Layer)\n// =============================================================================\n\n/**\n * AvailabilityType - Provider availability classification.\n */\nexport const AvailabilityTypeSchema = z.enum([\n    'EVENT_SPONSOR', // Sponsor-funded for specific event\n    'EVERGREEN',     // Always available platform credit\n    'CATALOG',       // User-paid from catalog\n]);\nexport type AvailabilityType = z.infer<typeof AvailabilityTypeSchema>;\n\n/**\n * ProviderRole - P1: Constrained enum for provider roles.\n */\nexport const ProviderRoleSchema = z.enum([\n    'AI',         // AI/LLM providers (Gemini, GPT, Claude)\n    'DATABASE',   // Database providers (MongoDB, Supabase)\n    'AUTH',       // Auth providers (Clerk, Auth0)\n    'DEPLOY',     // Deployment providers (Vercel, Cloudflare)\n    'STORAGE',    // Storage providers (S3, R2)\n    'SEARCH',     // Search providers (Algolia, Pinecone)\n    'PAYMENTS',   // Payment providers (Stripe)\n    'COMPUTE',    // Compute providers (Modal, Replicate)\n    'OTHER',      // Catch-all for new categories\n]);\nexport type ProviderRole = z.infer<typeof ProviderRoleSchema>;\n\n/**\n * StackProvider - Provider within a stack.\n */\nexport const StackProviderSchema = z.object({\n    provider_id: z.string(),\n    role: ProviderRoleSchema, // P1: Now a constrained enum\n    display_name: z.string(),\n    budget_allocation: z.number().nonnegative(),\n    sku_ids: z.array(z.string()),\n    availability_type: AvailabilityTypeSchema,\n});\n\nexport type StackProvider = z.infer<typeof StackProviderSchema>;\n\n/**\n * Stack - Curated capability bundle.\n */\nexport const StackSchema = z.object({\n    id: z.string(),\n    slug: z.string(),\n    name: z.string(),\n    tagline: z.string(),\n    icon: z.string(),\n    providers: z.array(StackProviderSchema),\n    github_template: z.string().nullable(),\n    total_budget: z.number().nonnegative(),\n    event_id: z.string().nullable(), // null = evergreen\n});\n\nexport type Stack = z.infer<typeof StackSchema>;\n\n/**\n * StackConnection - User's connection to a stack.\n */\nexport const StackConnectionSchema = z.object({\n    id: z.string(),\n    stack_id: z.string(),\n    passport_id: z.string(),\n    team_id: z.string().nullable(),\n    environment_id: z.string(),\n    connected_at: z.string().datetime(),\n    connected_providers: z.array(z.string()),\n});\n\nexport type StackConnection = z.infer<typeof StackConnectionSchema>;\n\n// =============================================================================\n// HELPER FACTORIES\n// =============================================================================\n\n/**\n * Create a KernelOk response.\n */\nexport function kernelOk<T>(data: T, status: number = 200): KernelOk<T> {\n    return { ok: true, status, data };\n}\n\n/**\n * Create a KernelError response.\n */\nexport function kernelError(\n    code: KernelErrorCode, // P0: Now typed to KernelErrorCode\n    message: string,\n    status?: number,\n    details?: Record<string, unknown>\n): KernelError {\n    return {\n        ok: false,\n        status: status ?? ERROR_CODE_STATUS[code],\n        error: {\n            code,\n            message,\n            ...(details && { details }),\n        },\n    };\n}\n\n// =============================================================================\n// GOLDEN TEST FIXTURES (P1 - Conformance testing)\n// =============================================================================\n\n/**\n * Golden test fixtures for downstream conformance testing.\n * Surfaces (MCP, Agent Passport, Caravan, events-hlos) can import these\n * to verify they're hashing/encoding/typing identically.\n */\nexport const GOLDEN_FIXTURES = {\n    /**\n     * Sample CrossingHashInputV0 for hash conformance.\n     */\n    crossingHashInput: {\n        v: 0 as const,\n        snapshot: {\n            crossingId: 'cross_test123abc456def789ghi',\n            capabilityId: 'gemini.generate.v1',\n            passportId: 'passport_user123abc456def789g',\n            event_id: 'evt_hackathon2026',\n            access_window_id: 'aw_sponsor_mongodb',\n            access_grant_id: 'ag_team_001',\n            attribution_org_id: 'mongodb',\n            funding_source: 'SPONSOR' as const,\n            credential_source: 'SPONSOR_KEY' as const,\n        },\n        attested_receipt_id: 'rcpt_01HZABCDEF1234567890ABCDEF',\n    } satisfies CrossingHashInputV0,\n\n    /**\n     * Expected crossing_hash for the above input (FROZEN).\n     * Compute: JCS canonicalize → SHA-256 → base64url (no padding)\n     *\n     * This is the golden vector. If your hash differs, your implementation\n     * is not conformant. DO NOT CHANGE unless crossingHashInput changes.\n     */\n    expectedCrossingHash_base64url_sha256_jcs_v0: 'z8A2kCNck4rPL4ugNe-Fbxputdi3PkjkVpSrIBhojU0',\n\n    /**\n     * Sample CrossingSettledReceipt.\n     */\n    crossingSettledReceipt: {\n        type: 'CrossingSettled' as const,\n        crossingId: 'cross_test123abc456def789ghi',\n        event_id: 'evt_hackathon2026',\n        access_window_id: 'aw_sponsor_mongodb',\n        access_grant_id: 'ag_team_001',\n        attribution_org_id: 'mongodb',\n        funding_source: 'SPONSOR' as const,\n        credential_source: 'SPONSOR_KEY' as const,\n        settlement_authority: 'hlos.ai' as const,\n        crossing_hash: 'z8A2kCNck4rPL4ugNe-Fbxputdi3PkjkVpSrIBhojU0',\n        attested_receipt_id: 'rcpt_01HZABCDEF1234567890ABCDEF',\n        settled_at: '2026-01-24T12:00:00.000Z',\n    } satisfies CrossingSettledReceipt,\n} as const;\n\n/**\n * Type guard: check if a value is a valid CrossingHashInputV0.\n */\nexport function isCrossingHashInputV0(value: unknown): value is CrossingHashInputV0 {\n    return CrossingHashInputV0Schema.safeParse(value).success;\n}\n\n/**\n * Type guard: check if a value is a valid CrossingSettledReceipt.\n */\nexport function isCrossingSettledReceipt(value: unknown): value is CrossingSettledReceipt {\n    return CrossingSettledReceiptSchema.safeParse(value).success;\n}\n","/**\n * Family W — Privacy-Preserving Proofs (Phase 1 Lock)\n *\n * CC-W-01: RP-specific pseudonym derivation + rotation\n * CC-W-03: transaction_context_hash binding prevents replay\n *\n * Phase 1 schemas are LOCKED. Any changes require:\n * - Golden vector updates\n * - Invariants note\n * - Contract tests\n *\n * @packageDocumentation\n */\n\nimport { z } from 'zod';\n\n// =============================================================================\n// Domain Separators (FROZEN)\n// =============================================================================\n\n/**\n * RPID derivation domain separator.\n * Used in HKDF info: concat(W_RPID_DOMAIN, encodeEpoch(epoch))\n */\nexport const W_RPID_DOMAIN = new TextEncoder().encode('W:RPID:v1');\n\n/**\n * Transaction context domain separator (reserved for future use).\n */\nexport const W_TXCTX_DOMAIN = new TextEncoder().encode('W:TXCTX:v1');\n\n// =============================================================================\n// Epoch Encoding (FROZEN)\n// =============================================================================\n\n/**\n * Encode rotation epoch as u64 big-endian bytes.\n *\n * Input normalization:\n * - number: treated as milliseconds since Unix epoch\n * - string: parsed as RFC3339 datetime, converted to ms\n *\n * INVARIANT: All epochs normalize to millisecond timestamps with strict RFC3339 validation.\n *\n * @param epoch - Epoch as ms number or RFC3339 string\n * @returns 8-byte Uint8Array (u64 big-endian)\n * @throws Error if string is not valid RFC3339\n */\n/**\n * RFC3339 datetime pattern (requires timezone, excludes date-only).\n * Examples: 2026-01-29T00:00:00Z, 2026-01-29T00:00:00+00:00\n */\nconst RFC3339_CAPTURING =\n    /^(\\d{4})-(\\d{2})-(\\d{2})T(\\d{2}):(\\d{2}):(\\d{2})(\\.(\\d{1,9}))?(Z|([+-])(\\d{2}):(\\d{2}))$/;\n\nfunction isLeapYear(year: number): boolean {\n    return (year % 4 === 0 && year % 100 !== 0) || (year % 400 === 0);\n}\n\nfunction daysInMonth(year: number, month: number): number {\n    const days = [31, isLeapYear(year) ? 29 : 28, 31, 30, 31, 30, 31, 31, 30, 31, 30, 31];\n    return days[month - 1] ?? 0;\n}\n\nfunction parseRfc3339StrictToMs(value: string): number {\n    const match = RFC3339_CAPTURING.exec(value);\n    if (!match) {\n        throw new Error(\n            `Invalid epoch: \"${value}\" is not a valid RFC3339 datetime (requires time and timezone)`\n        );\n    }\n\n    const year = Number(match[1]);\n    const month = Number(match[2]);\n    const day = Number(match[3]);\n    const hour = Number(match[4]);\n    const minute = Number(match[5]);\n    const second = Number(match[6]);\n    const fraction = match[8] ?? '';\n    const tz = match[9];\n\n    if (month < 1 || month > 12) {\n        throw new Error('Invalid epoch: month out of range');\n    }\n    const maxDay = daysInMonth(year, month);\n    if (day < 1 || day > maxDay) {\n        throw new Error('Invalid epoch: day out of range');\n    }\n    if (hour > 23) {\n        throw new Error('Invalid epoch: hour out of range');\n    }\n    if (minute > 59) {\n        throw new Error('Invalid epoch: minute out of range');\n    }\n    if (second > 59) {\n        throw new Error('Invalid epoch: second out of range');\n    }\n\n    const msFraction = fraction.length ? Number((fraction + '000').slice(0, 3)) : 0;\n    const utcMs = Date.UTC(year, month - 1, day, hour, minute, second, msFraction);\n\n    let offsetMs = 0;\n    if (tz !== 'Z') {\n        const sign = match[10] === '-' ? -1 : 1;\n        const offsetHour = Number(match[11]);\n        const offsetMinute = Number(match[12]);\n        if (offsetHour > 23) {\n            throw new Error('Invalid epoch: tz hour out of range');\n        }\n        if (offsetMinute > 59) {\n            throw new Error('Invalid epoch: tz minute out of range');\n        }\n        offsetMs = sign * (offsetHour * 60 + offsetMinute) * 60_000;\n    }\n\n    const ms = utcMs - offsetMs;\n    if (!Number.isFinite(ms) || ms < 0) {\n        throw new Error('Invalid epoch: must be a non-negative timestamp');\n    }\n\n    return ms;\n}\n\nexport function encodeEpoch(epoch: number | string): Uint8Array {\n    let ms: number;\n\n    if (typeof epoch === 'string') {\n        ms = parseRfc3339StrictToMs(epoch);\n    } else {\n        if (!Number.isInteger(epoch) || epoch < 0) {\n            throw new Error(`Invalid epoch: ${epoch} must be a non-negative integer`);\n        }\n        ms = epoch;\n    }\n\n    const buf = new ArrayBuffer(8);\n    const view = new DataView(buf);\n    view.setBigUint64(0, BigInt(ms), false); // big-endian\n    return new Uint8Array(buf);\n}\n\n// =============================================================================\n// RelyingPartyId Schema\n// =============================================================================\n\n/**\n * Relying Party identifier.\n * Uniquely identifies a verifier/merchant for pseudonym derivation.\n */\nexport const RelyingPartyIdSchema = z.object({\n    /** RP domain (e.g., \"merchant.example.com\") */\n    domain: z.string().min(1).max(253),\n    /** Audience URI (e.g., \"https://merchant.example.com/verify\") */\n    audience_uri: z.string().url(),\n    /** SHA-256 hash of verifier's public key (hex, 64 chars) */\n    verifier_key_hash: z.string().regex(/^[a-f0-9]{64}$/, 'Must be 64-char lowercase hex'),\n});\n\nexport type RelyingPartyId = z.infer<typeof RelyingPartyIdSchema>;\n\n// =============================================================================\n// RotationEpoch Schema\n// =============================================================================\n\n/**\n * Rotation epoch for RPID derivation.\n *\n * Accepts:\n * - number: milliseconds since Unix epoch (non-negative integer)\n * - string: RFC3339 datetime (e.g., \"2026-01-29T00:00:00Z\")\n *\n * INVARIANT: All epochs normalize to millisecond timestamps via encodeEpoch().\n */\nexport const RotationEpochSchema = z.union([\n    z.number().int().nonnegative(),\n    z.string().datetime({ offset: true }), // Requires timezone offset (RFC3339)\n]);\n\nexport type RotationEpoch = z.infer<typeof RotationEpochSchema>;\n\n// =============================================================================\n// RPID Schema\n// =============================================================================\n\n/**\n * RP-specific pseudonym.\n * Base64url-encoded, 32 bytes = 43 chars without padding.\n * We prefer no-padding format per RFC 7515.\n */\nexport const RPIDSchema = z\n    .string()\n    .length(43, 'RPID must be base64url-encoded 32 bytes (43 chars, no padding)')\n    .regex(/^[A-Za-z0-9_-]+$/, 'Must be base64url (no padding)');\n\nexport type RPID = z.infer<typeof RPIDSchema>;\n\n// =============================================================================\n// TransactionContext Schema (Minimal Core)\n// =============================================================================\n\n/**\n * Transaction context for replay protection.\n *\n * Core fields (required, stable):\n * - relying_party_id: who is verifying\n * - operation_hash: sha256(JCS({ intent, request }))\n * - not_before/not_after: validity window\n *\n * Optional fields (part of hash, must be consistent):\n * - amount/currency: economic context\n * - surface_id/channel_id: routing context\n */\nexport const TransactionContextSchema = z.object({\n    // Required core (stable)\n    relying_party_id: RelyingPartyIdSchema,\n    /** sha256(JCS({ intent, request })) — see computeOperationHash() */\n    operation_hash: z.string().regex(/^[a-f0-9]{64}$/, 'Must be 64-char lowercase hex'),\n    /** Validity start (RFC3339) */\n    not_before: z.string().datetime({ offset: true }),\n    /** Validity end (RFC3339) */\n    not_after: z.string().datetime({ offset: true }),\n\n    // Optional (part of hash, must be consistent)\n    amount: z.number().nonnegative().optional(),\n    currency: z.string().length(3).optional(),\n    surface_id: z.string().optional(),\n    channel_id: z.string().optional(),\n});\n\nexport type TransactionContext = z.infer<typeof TransactionContextSchema>;\n\n// =============================================================================\n// TransactionContextHash Schema\n// =============================================================================\n\n/**\n * SHA-256 hash of JCS-canonicalized TransactionContext.\n * 64-character lowercase hex string.\n */\nexport const TransactionContextHashSchema = z\n    .string()\n    .regex(/^[a-f0-9]{64}$/, 'Must be 64-char lowercase hex');\n\nexport type TransactionContextHash = z.infer<typeof TransactionContextHashSchema>;\n\n// =============================================================================\n// Golden Fixtures (FROZEN)\n// =============================================================================\n\n/**\n * Golden fixtures for Phase 1 W schemas.\n * Used for drift detection and cross-repo alignment.\n */\nexport const W_GOLDEN_FIXTURES = {\n    /**\n     * encodeEpoch(1706486400000) = 2024-01-29T00:00:00.000Z\n     * Expected: 8 bytes, u64 big-endian\n     */\n    epochMs: 1706486400000,\n    expectedEpochBytes: new Uint8Array([0x00, 0x00, 0x01, 0x8d, 0x52, 0x84, 0x04, 0x00]),\n\n    /**\n     * Sample RelyingPartyId for test vectors\n     */\n    sampleRpId: {\n        domain: 'merchant.example.com',\n        audience_uri: 'https://merchant.example.com/verify',\n        verifier_key_hash: 'a'.repeat(64),\n    } satisfies RelyingPartyId,\n\n    /**\n     * Sample TransactionContext for test vectors\n     */\n    sampleTxContext: {\n        relying_party_id: {\n            domain: 'merchant.example.com',\n            audience_uri: 'https://merchant.example.com/verify',\n            verifier_key_hash: 'a'.repeat(64),\n        },\n        operation_hash: 'b'.repeat(64),\n        not_before: '2026-01-29T00:00:00Z',\n        not_after: '2026-01-29T00:05:00Z',\n    } satisfies TransactionContext,\n\n    /**\n     * MAX_WINDOW_MS: Maximum allowed not_after - not_before (5 minutes)\n     */\n    MAX_WINDOW_MS: 5 * 60 * 1000,\n} as const;\n\n// =============================================================================\n// Validation Helpers\n// =============================================================================\n\n/**\n * Validate transaction context time window.\n *\n * Enforces:\n * - not_after > not_before\n * - not_after - not_before <= MAX_WINDOW_MS\n *\n * @param context - Transaction context to validate\n * @returns true if valid, throws otherwise\n */\nexport function validateTimeWindow(context: TransactionContext): boolean {\n    let notBefore: number;\n    let notAfter: number;\n\n    try {\n        notBefore = parseRfc3339StrictToMs(context.not_before);\n        notAfter = parseRfc3339StrictToMs(context.not_after);\n    } catch {\n        throw new Error('Invalid timestamp: not_before/not_after must be RFC3339 with timezone');\n    }\n\n    if (notAfter <= notBefore) {\n        throw new Error('not_after must be greater than not_before');\n    }\n\n    const windowMs = notAfter - notBefore;\n    if (windowMs > W_GOLDEN_FIXTURES.MAX_WINDOW_MS) {\n        throw new Error(\n            `Time window ${windowMs}ms exceeds MAX_WINDOW_MS (${W_GOLDEN_FIXTURES.MAX_WINDOW_MS}ms)`\n        );\n    }\n\n    return true;\n}\n","/**\n * @hlos-ai/schemas - Agents Contracts\n *\n * Shared schemas for Agents Index + Passport Stub.\n * Routes are authoritative source of truth; these schemas validate conformance.\n *\n * Design choices:\n * - .passthrough() allows extra fields without breaking\n * - Enums use .or(z.string()) pattern for forward compatibility\n * - passport_id is z.null() as a boundary constraint\n */\n\nimport { z } from 'zod';\n\n// =============================================================================\n// AGENT ENUMS (Forward-compatible)\n// =============================================================================\n\n/**\n * AgentStatus - Known values documented, but accepts future additions.\n */\nexport const AgentStatusSchema = z\n    .enum(['ACTIVE', 'PENDING', 'SUSPENDED', 'REVOKED'])\n    .or(z.string().min(1));\n\nexport type AgentStatus = z.infer<typeof AgentStatusSchema>;\n\n/**\n * AgentType - Known values documented, but accepts future additions.\n */\nexport const AgentTypeSchema = z\n    .enum(['CUSTOM', 'CLAUDE', 'GPT', 'GEMINI', 'CURSOR', 'COPILOT', 'OTHER'])\n    .or(z.string().min(1));\n\nexport type AgentType = z.infer<typeof AgentTypeSchema>;\n\n// =============================================================================\n// AGENTS LIST RESPONSE\n// =============================================================================\n\n/**\n * Agent item in list response (snake_case wire format).\n */\nexport const AgentListItemSchema = z\n    .object({\n        id: z.string().min(1),\n        external_id: z.string().min(1),\n        name: z.string().min(1),\n        status: AgentStatusSchema,\n        agent_type: AgentTypeSchema,\n        trust_score: z.number().int().min(0).max(1000),\n        hosting_model: z.null(),\n        declared_tier: z.null(),\n        created_at: z.string().datetime(),\n    })\n    .passthrough();\n\nexport type AgentListItem = z.infer<typeof AgentListItemSchema>;\n\n/**\n * GET /api/agents response schema.\n * _meta.source: \"hlos\" (authoritative list)\n */\nexport const AgentsListResponseSchema = z\n    .object({\n        agents: z.array(AgentListItemSchema),\n        _meta: z.object({\n            source: z.literal('hlos'),\n        }),\n    })\n    .passthrough();\n\nexport type AgentsListResponse = z.infer<typeof AgentsListResponseSchema>;\n\n// =============================================================================\n// AGENT PASSPORT STUB RESPONSE\n// =============================================================================\n\n/**\n * GET /api/agents/[agentId]/passport response schema.\n *\n * BOUNDARY CONSTRAINT:\n * - passport_id MUST be null (HLOS does not mint passports)\n * - _meta.source: \"stub\" signals non-authoritative response\n * - All counters/tiers are null until backed by Agent-Passport system\n */\nexport const AgentPassportStubResponseSchema = z\n    .object({\n        passport_id: z.null(),\n        agent_id: z.string().min(1),\n        hosting_model: z.null(),\n        declared_tier: z.null(),\n        effective_tier: z.null(),\n        finality_level: z.null(),\n        graph: z\n            .object({\n                incoming_edges: z.null(),\n                outgoing_edges: z.null(),\n                active_visas: z.null(),\n            })\n            .passthrough(),\n        links: z\n            .object({\n                passport_url: z.string().startsWith('/agent-passport/agents/'),\n                docs_url: z.literal('/agents/passport'),\n            })\n            .passthrough(),\n        _meta: z.object({\n            source: z.literal('stub'),\n        }),\n    })\n    .passthrough();\n\nexport type AgentPassportStubResponse = z.infer<typeof AgentPassportStubResponseSchema>;\n","/**\n * @hlos-ai/schemas - Dispatch Chain Content Types\n *\n * Four-stage receipt chain for OpenClaw dispatch flows:\n *   CR (CustodyReceipt) → LAT (LiabilityAttestation) → EGP (EconomicGateProof) → SA (SettlementAnchor)\n *\n * Each stage is issued as SignedReceiptV0<StageContent> by the HLOS kernel.\n * Surfaces MUST NOT sign these; they reference them by receipt_hash.\n *\n * Chain linking:\n * - previous_receipt_hash: the prior stage's SignedReceiptV0 receipt_hash\n *   = base64url(SHA-256(JCS(entire_receipt_envelope)))\n * - chain_root_content_hash: the CR's content_hash\n *   = base64url(SHA-256(JCS(content_field_only)))\n *   (Only on LAT/EGP/SA — CR omits this to avoid circular hash dependency.)\n *\n * IMPORTANT: previous_receipt_hash commits to the full signed envelope\n * (including key_id, issued_at, signature). chain_root_content_hash commits\n * to content only. These are intentionally different hash scopes.\n *\n * @see BRIDGE_SPEC.md §2 for UCP artifact chain assembly rules\n */\n\nimport { z } from 'zod';\nimport { Base64urlSha256Schema } from './encoding';\nimport { DispatchIdSchema, DispatchIdBrand } from './ids';\nimport { SETTLEMENT_AUTHORITY } from './shared-contract';\n\n// Re-export brand so tsup DTS can name DispatchId across entry boundaries\nexport { DispatchIdBrand } from './ids';\n\n// =============================================================================\n// Constants\n// =============================================================================\n\nexport const CHAIN_STAGE_ORDER = ['CR', 'LAT', 'EGP', 'SA'] as const;\n\nexport const ChainStageTypeSchema = z.enum(CHAIN_STAGE_ORDER);\nexport type ChainStageType = z.infer<typeof ChainStageTypeSchema>;\n\n\n// =============================================================================\n// Hash Schema Aliases (prevent accidental mixing)\n// =============================================================================\n\n/**\n * Schema for previous_receipt_hash fields.\n * Value is a receipt_hash: base64url(SHA-256(JCS(entire_receipt_envelope))).\n */\nconst ReceiptHashRefSchema = Base64urlSha256Schema.describe(\n    'receipt_hash: base64url(SHA-256(JCS(entire_receipt_envelope)))'\n);\n\n/**\n * Schema for chain_root_content_hash fields.\n * Value is a content_hash: base64url(SHA-256(JCS(content_field_only))).\n */\nconst ContentHashRefSchema = Base64urlSha256Schema.describe(\n    'content_hash reference: base64url(SHA-256(JCS(content_field_only)))'\n);\n\n// =============================================================================\n// CR — Custody Receipt (stage 0: dispatch starts, actor takes custody)\n// =============================================================================\n// CR is the chain root. It does NOT include chain_root_content_hash\n// (that would create a circular hash dependency since CR's content_hash\n// depends on its own content).\n\nexport const CustodyReceiptContentSchema = z.object({\n    type: z.literal('CustodyReceipt'),\n    stage_type: z.literal('CR'),\n    stage_version: z.literal(0),\n    stage_index: z.literal(0),\n    dispatch_id: DispatchIdSchema,\n    previous_receipt_hash: z.null(),\n    // CR-specific\n    actor_passport_id: z.string().min(1),\n    surface: z.string().min(1),\n    task_scope: z.string().min(1),\n    settlement_authority: z.literal(SETTLEMENT_AUTHORITY),\n}).strict();\n\nexport type CustodyReceiptContent = z.infer<typeof CustodyReceiptContentSchema>;\n\n// =============================================================================\n// LAT — Liability Attestation Token (stage 1: authorization to act)\n// =============================================================================\n\nexport const LiabilityAttestationContentSchema = z.object({\n    type: z.literal('LiabilityAttestation'),\n    stage_type: z.literal('LAT'),\n    stage_version: z.literal(0),\n    stage_index: z.literal(1),\n    dispatch_id: DispatchIdSchema,\n    previous_receipt_hash: ReceiptHashRefSchema,\n    chain_root_content_hash: ContentHashRefSchema,\n    // LAT-specific\n    policy_snapshot_hash: Base64urlSha256Schema,\n    capabilities_granted: z.array(z.string().min(1)).min(1),\n    authorization_scope: z.string().min(1),\n    /** Receipt issuer authority (HLOS issues all chain artifacts). */\n    settlement_authority: z.literal(SETTLEMENT_AUTHORITY),\n}).strict();\n\nexport type LiabilityAttestationContent = z.infer<typeof LiabilityAttestationContentSchema>;\n\n// =============================================================================\n// EGP — Economic Gate Proof (stage 2: hold/budget cleared)\n// =============================================================================\n\nexport const EconomicGateProofContentSchema = z.object({\n    type: z.literal('EconomicGateProof'),\n    stage_type: z.literal('EGP'),\n    stage_version: z.literal(0),\n    stage_index: z.literal(2),\n    dispatch_id: DispatchIdSchema,\n    previous_receipt_hash: ReceiptHashRefSchema,\n    chain_root_content_hash: ContentHashRefSchema,\n    // EGP-specific\n    wallet_id: z.string().min(1),\n    hold_id: z.string().min(1).optional(),\n    amount_mills: z.number().int().nonnegative(),\n    currency: z.literal('USD'),\n    settlement_authority: z.literal(SETTLEMENT_AUTHORITY),\n}).strict();\n\nexport type EconomicGateProofContent = z.infer<typeof EconomicGateProofContentSchema>;\n\n// =============================================================================\n// SA — Settlement Anchor (stage 3: final settlement, chain closes)\n// =============================================================================\n\nexport const SettlementAnchorContentSchema = z.object({\n    type: z.literal('SettlementAnchor'),\n    stage_type: z.literal('SA'),\n    stage_version: z.literal(0),\n    stage_index: z.literal(3),\n    dispatch_id: DispatchIdSchema,\n    previous_receipt_hash: ReceiptHashRefSchema,\n    chain_root_content_hash: ContentHashRefSchema,\n    // SA-specific\n    settlement_receipt_hash: ReceiptHashRefSchema,\n    crossing_id: z.string().optional(),\n    final_amount_mills: z.number().int().nonnegative(),\n    settlement_authority: z.literal(SETTLEMENT_AUTHORITY),\n}).strict();\n\nexport type SettlementAnchorContent = z.infer<typeof SettlementAnchorContentSchema>;\n\n// =============================================================================\n// Discriminated Union\n// =============================================================================\n\nexport const DispatchChainContentSchema = z.discriminatedUnion('type', [\n    CustodyReceiptContentSchema,\n    LiabilityAttestationContentSchema,\n    EconomicGateProofContentSchema,\n    SettlementAnchorContentSchema,\n]);\n\nexport type DispatchChainContent = z.infer<typeof DispatchChainContentSchema>;\n\n// =============================================================================\n// Chain Integrity Verification Helpers\n// =============================================================================\n\n/**\n * Assert that a stage's previous_receipt_hash matches the expected prior receipt_hash.\n * @throws Error if hashes don't match\n */\nexport function assertValidChainLink(\n    expectedPreviousHash: string | null,\n    actualPreviousHash: string | null,\n    stageType: ChainStageType,\n): void {\n    if (expectedPreviousHash !== actualPreviousHash) {\n        throw new Error(\n            `Chain link broken at ${stageType}: ` +\n            `expected previous_receipt_hash=${expectedPreviousHash}, ` +\n            `got=${actualPreviousHash}`\n        );\n    }\n}\n\n/**\n * Assert that a stage's chain_root_content_hash matches the CR's content_hash.\n * @throws Error if root hash doesn't match\n */\nexport function assertRootHash(\n    actualRootHash: string,\n    expectedRootHash: string,\n    stageType: ChainStageType,\n): void {\n    if (actualRootHash !== expectedRootHash) {\n        throw new Error(\n            `Chain root mismatch at ${stageType}: ` +\n            `expected chain_root_content_hash=${expectedRootHash}, ` +\n            `got=${actualRootHash}`\n        );\n    }\n}\n","/**\n * @hlos-ai/schemas - Finality Schemas\n *\n * Defines the Notary Attestation (NA) schema and related types\n * for HLOS kernel-level HARD finality.\n *\n * Per BRIDGE_SPEC.md §4:\n * - SOFT finality: SignedReceiptV0 signed by settlement authority hlos.ai\n * - HARD finality: SignedReceiptV0 + NA where STAAMPID countersigns receipt_hash\n *\n * HARD finality is a platform feature (POST /api/finality/notarize),\n * not surface-specific. Any surface can request it.\n *\n * @see BRIDGE_SPEC.md §4.3 for NA schema\n * @see BRIDGE_SPEC.md §4.2 for notarize endpoint\n */\n\nimport { z } from 'zod';\nimport { Base64urlSha256Schema, Base64urlEd25519SigSchema } from './encoding';\nimport { SETTLEMENT_AUTHORITY } from './shared-contract';\n\n// =============================================================================\n// Constants\n// =============================================================================\n\n/**\n * NA ID prefix.\n */\nexport const NA_ID_PREFIX = 'na_' as const;\n\n/**\n * Finality levels.\n */\nexport const FinalityLevel = {\n    SOFT: 'SOFT',\n    HARD: 'HARD',\n} as const;\n\nexport type FinalityLevel = (typeof FinalityLevel)[keyof typeof FinalityLevel];\n\n// =============================================================================\n// ID Format\n// =============================================================================\n\n/**\n * Notary Attestation ID format: na_ + alphanumeric (20+ chars).\n */\nexport const NotaryAttestationIdFormatSchema = z.string().regex(\n    /^na_[a-zA-Z0-9]{20,}$/,\n    'NA ID must match na_[a-zA-Z0-9]{20,}'\n);\n\n// =============================================================================\n// Log Inclusion Proof (Optional Merkle Proof)\n// =============================================================================\n\n/**\n * Merkle proof for append-only log inclusion.\n * Future-proof: STAAMPID may provide this for auditable transparency.\n */\nexport const LogInclusionProofSchema = z.object({\n    /** Merkle root hash (base64url SHA-256) */\n    root: Base64urlSha256Schema,\n    /** Sibling hashes along the path (base64url SHA-256 each) */\n    proof: z.array(Base64urlSha256Schema),\n    /** Leaf index in the log */\n    index: z.number().int().nonnegative(),\n});\n\nexport type LogInclusionProof = z.infer<typeof LogInclusionProofSchema>;\n\n// =============================================================================\n// Notary Attestation (NA) — STAAMPID Response\n// =============================================================================\n\n/**\n * NotaryAttestation (NA): STAAMPID's countersignature over a receipt_hash.\n *\n * This is the artifact that promotes SOFT finality → HARD finality.\n * The notary binds to receipt_hash, NOT the receipt content directly.\n *\n * Required fields (per BRIDGE_SPEC.md §4.3):\n * - na_id: Unique NA identifier\n * - receipt_hash: The kernel receipt hash being attested\n * - notary_id: Identifier of the notary service\n * - issued_at: When the attestation was issued\n * - signature: The notary's countersignature\n * - signature_alg: Signature algorithm used\n *\n * Optional fields (future-proof):\n * - receipt_type, receipt_version: For schema evolution\n * - settlement_authority: Cross-check field\n * - validity_window_seconds, expires_at: TTL for NA validity\n * - log_inclusion: Merkle proof for append-only log\n */\nexport const NotaryAttestationSchema = z.object({\n    // --- Required ---\n    /** Unique NA identifier */\n    na_id: NotaryAttestationIdFormatSchema,\n    /** The receipt_hash this NA attests to */\n    receipt_hash: Base64urlSha256Schema,\n    /** Notary service identifier (e.g. \"staampid\") */\n    notary_id: z.string().min(1),\n    /** ISO 8601 timestamp when NA was issued */\n    issued_at: z.string().datetime(),\n    /** Notary's countersignature (base64url encoded) */\n    signature: z.string().min(1),\n    /** Signature algorithm (e.g. \"EdDSA\") */\n    signature_alg: z.string().min(1),\n\n    // --- Optional (future-proof) ---\n    /** Receipt type being attested */\n    receipt_type: z.string().optional(),\n    /** Receipt version being attested */\n    receipt_version: z.number().int().nonnegative().optional(),\n    /** Settlement authority that issued the receipt (cross-check) */\n    settlement_authority: z.string().optional(),\n    /** TTL in seconds for this attestation */\n    validity_window_seconds: z.number().int().positive().optional(),\n    /** ISO 8601 expiry (derived from issued_at + validity_window_seconds) */\n    expires_at: z.string().datetime().optional(),\n    /** Merkle proof for append-only log inclusion */\n    log_inclusion: LogInclusionProofSchema.optional(),\n});\n\nexport type NotaryAttestation = z.infer<typeof NotaryAttestationSchema>;\n\n// =============================================================================\n// Notary Request (HLOS → STAAMPID)\n// =============================================================================\n\n/**\n * NotaryRequest: The payload HLOS sends to STAAMPID to request a countersignature.\n *\n * This is a deterministic payload per BRIDGE_SPEC.md §4.3.\n * STAAMPID uses this to:\n * 1. Verify the receipt_hash is well-formed\n * 2. Log the attestation request\n * 3. Countersign and return NA\n */\nexport const NotaryRequestSchema = z.object({\n    /** receipt_hash to be attested (base64url SHA-256) */\n    receipt_hash: Base64urlSha256Schema,\n    /** Must be literal 'hlos.ai' */\n    settlement_authority: z.literal(SETTLEMENT_AUTHORITY),\n    /** Crossing this receipt belongs to */\n    crossing_id: z.string().min(1),\n    /** Type of the receipt being attested */\n    receipt_type: z.string().min(1),\n    /** Version of the receipt being attested */\n    receipt_version: z.number().int().nonnegative(),\n    /** ISO 8601 timestamp of the request */\n    timestamp: z.string().datetime(),\n    /** Optional: requested validity window in seconds */\n    validity_window_seconds: z.number().int().positive().optional(),\n});\n\nexport type NotaryRequest = z.infer<typeof NotaryRequestSchema>;\n\n// =============================================================================\n// Notarize API Response\n// =============================================================================\n\n/**\n * Status values for the notarize endpoint response.\n */\nexport const NotarizeStatusSchema = z.enum([\n    'HARD',          // NA obtained, finality upgraded\n    'PENDING',       // Notarization in progress (async)\n    'FAILED',        // Notarization failed\n    'ALREADY_HARD',  // Receipt already has NA\n]);\n\nexport type NotarizeStatus = z.infer<typeof NotarizeStatusSchema>;\n\n/**\n * Response from POST /api/finality/notarize.\n */\nexport const NotarizeResponseSchema = z.object({\n    /** Finality status after this operation */\n    status: NotarizeStatusSchema,\n    /** The receipt_hash that was notarized */\n    receipt_hash: Base64urlSha256Schema,\n    /** Hash of the NA itself (optional, present when status is HARD) */\n    na_hash: Base64urlSha256Schema.optional(),\n    /** The full NA object (optional embed) */\n    na: NotaryAttestationSchema.optional(),\n    /** Notary service identifier */\n    notary: z.string().min(1).optional(),\n    /** NA ID for retrieval */\n    notary_receipt_id: z.string().optional(),\n    /** ISO 8601 timestamp */\n    timestamp: z.string().datetime(),\n    /** Error details (present when status is FAILED) */\n    error: z.string().optional(),\n});\n\nexport type NotarizeResponse = z.infer<typeof NotarizeResponseSchema>;\n\n// =============================================================================\n// Type Guards\n// =============================================================================\n\n/**\n * Check if a value is a valid NotaryAttestation.\n */\nexport function isNotaryAttestation(value: unknown): value is NotaryAttestation {\n    return NotaryAttestationSchema.safeParse(value).success;\n}\n\n/**\n * Check if a value is a valid NotaryRequest.\n */\nexport function isNotaryRequest(value: unknown): value is NotaryRequest {\n    return NotaryRequestSchema.safeParse(value).success;\n}\n\n// =============================================================================\n// BazaarReceiptEnvelope Reference (for BRE assembly)\n// =============================================================================\n\n/**\n * ArtifactRef: A typed reference to a kernel artifact (for BRE assembly).\n * Per BRIDGE_SPEC.md §2.3.\n */\nexport const ArtifactRefSchema = z.object({\n    /** Artifact type */\n    type: z.enum(['CR', 'LAT', 'EGP', 'SA', 'SignedReceiptV0', 'NA']),\n    /** base64url SHA-256 hash of the artifact */\n    hash: Base64urlSha256Schema,\n    /** Issuer of the artifact */\n    issuer: z.string().min(1),\n    /** Schema version */\n    version: z.string().min(1),\n    /** Optional retrieval URI */\n    uri: z.string().url().optional(),\n});\n\nexport type ArtifactRef = z.infer<typeof ArtifactRefSchema>;\n\n// =============================================================================\n// Golden Fixtures\n// =============================================================================\n\n/**\n * Golden fixtures for finality schema conformance testing.\n *\n * These are deterministic test values. DO NOT CHANGE unless the\n * schema definition changes.\n */\nexport const FINALITY_GOLDEN_FIXTURES = {\n    /** Sample NotaryAttestation */\n    notaryAttestation: {\n        na_id: 'na_01HZGOLDENNATEST00000000',\n        receipt_hash: 'uLiQVUeVKcE35Rdje2fArZQfTcECDgwK6UbmQB_36Pg',\n        notary_id: 'staampid',\n        issued_at: '2026-01-27T00:01:00.000Z',\n        signature: 'dGVzdF9ub3Rhcnlfc2lnbmF0dXJlXzY0X2J5dGVzX3BhZGRlZF90b19maWxsXzg2X2NoYXJhY3RlcnNf',\n        signature_alg: 'EdDSA',\n        receipt_type: 'SignedReceiptV0',\n        receipt_version: 0,\n        settlement_authority: 'hlos.ai',\n    } satisfies NotaryAttestation,\n\n    /** Sample NotaryRequest */\n    notaryRequest: {\n        receipt_hash: 'uLiQVUeVKcE35Rdje2fArZQfTcECDgwK6UbmQB_36Pg',\n        settlement_authority: 'hlos.ai' as const,\n        crossing_id: 'cross_test123abc456def789ghi',\n        receipt_type: 'SignedReceiptV0',\n        receipt_version: 0,\n        timestamp: '2026-01-27T00:00:30.000Z',\n    } satisfies NotaryRequest,\n\n    /** Sample successful notarize response */\n    notarizeResponseHard: {\n        status: 'HARD' as const,\n        receipt_hash: 'uLiQVUeVKcE35Rdje2fArZQfTcECDgwK6UbmQB_36Pg',\n        na_hash: '_rkedsyWZhokzye55M9NRAvIKFTxFCYTHVOPjg9cAfU',\n        notary: 'staampid',\n        notary_receipt_id: 'na_01HZGOLDENNATEST00000000',\n        timestamp: '2026-01-27T00:01:00.000Z',\n    } satisfies NotarizeResponse,\n} as const;\n","/**\n * @hlos-ai/schemas - Evaluation Artifact (EPIC 10)\n *\n * Canonical schema for evaluation trial results. Used by:\n * - Kernel invariant graders (CR ∧ LAT ∧ EGP bound by SA)\n * - Settlement reliability framework (pass^k)\n * - CI production gates\n *\n * @packageDocumentation\n */\n\nimport { z } from 'zod';\nimport { ChainStageTypeSchema } from './dispatch-chain';\nimport { Base64urlSha256Schema } from './encoding';\n\n// =============================================================================\n// Constants\n// =============================================================================\n\n/** Crockford Base32 ULID pattern (26 characters). */\nconst ULID_REGEX = /^[0-9A-HJKMNP-TV-Z]{26}$/;\n\n// =============================================================================\n// Sub-schemas\n// =============================================================================\n\n/**\n * A single step in the evaluation transcript.\n */\nconst EvalTranscriptStageSchema = z.union([\n    ChainStageTypeSchema,\n    z.literal('HTTP'),\n]);\n\nexport const EvalTranscriptStepSchema = z.object({\n    step_index: z.number().int().nonnegative(),\n    stage: EvalTranscriptStageSchema,\n    input_hash: Base64urlSha256Schema,\n    output_hash: Base64urlSha256Schema.nullable(),\n    verdict: z.enum(['pass', 'fail', 'skip']),\n    error: z.string().nullable(),\n    elapsed_ms: z.number().int().nonnegative(),\n}).strict();\n\nexport type EvalTranscriptStep = z.infer<typeof EvalTranscriptStepSchema>;\n\n/**\n * Result from a single grader.\n */\nexport const EvalGraderResultSchema = z.object({\n    grader_id: z.string().min(1),\n    verdict: z.enum(['pass', 'fail']),\n    confidence: z.number().min(0).max(1),\n    details: z.string().nullable(),\n}).strict();\n\nexport type EvalGraderResult = z.infer<typeof EvalGraderResultSchema>;\n\n/**\n * Compact failure record for debugging without log scraping.\n */\nexport const EvalFailureSchema = z.object({\n    step_index: z.number().int().nonnegative(),\n    grader_id: z.string().min(1),\n    code: z.string().min(1),\n    message: z.string().nullable(),\n}).strict();\n\nexport type EvalFailure = z.infer<typeof EvalFailureSchema>;\n\n// =============================================================================\n// EvalArtifact Schema\n// =============================================================================\n\n/**\n * Unified evaluation artifact — the canonical record for a trial run.\n *\n * Metrics:\n * - pass_rate: successes / total_runs (empirical)\n * - consecutive_pass_rate: longest consecutive pass streak / total_runs\n *   (observed max streak ratio, NOT \"probability of k consecutive\")\n */\nexport const EvalArtifactSchema = z.object({\n    schema_version: z.literal(1),\n\n    // Trial metadata\n    trial_id: z.string().regex(ULID_REGEX, 'Expected ULID format'),\n    seed: z.string().nullable(),\n    suite: z.string().min(1),\n    environment: z.enum(['local', 'ci', 'staging', 'production']),\n    started_at: z.string().datetime(),\n    completed_at: z.string().datetime().nullable(),\n    duration_ms: z.number().int().nonnegative().nullable(),\n\n    // Transcript — ordered steps\n    transcript: z.array(EvalTranscriptStepSchema),\n\n    // Grader results\n    grader_results: z.array(EvalGraderResultSchema),\n\n    // Compact failure records\n    failures: z.array(EvalFailureSchema),\n\n    // Aggregate metrics\n    pass_rate: z.number().min(0).max(1),\n    consecutive_pass_rate: z.number().min(0).max(1),\n    k: z.number().int().positive(),\n}).strict();\n\nexport type EvalArtifact = z.infer<typeof EvalArtifactSchema>;\n\n// =============================================================================\n// Golden Fixtures (FROZEN)\n// =============================================================================\n\nconst DUMMY_HASH = 'AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA' as const;\n\n/**\n * Golden fixtures for conformance testing.\n * DO NOT MODIFY unless schema_version changes.\n */\nexport const EVAL_GOLDEN_FIXTURES = {\n    /**\n     * Valid 4-step transcript (CR→LAT→EGP→SA, all pass).\n     */\n    valid_full_pass: {\n        schema_version: 1 as const,\n        trial_id: '01HZABCDEF1234567890ABCDEF',\n        seed: 'test-seed-001',\n        suite: 'kernel-invariant',\n        environment: 'ci' as const,\n        started_at: '2026-02-22T10:00:00.000Z',\n        completed_at: '2026-02-22T10:00:01.234Z',\n        duration_ms: 1234,\n        transcript: [\n            { step_index: 0, stage: 'CR' as const, input_hash: DUMMY_HASH, output_hash: DUMMY_HASH, verdict: 'pass' as const, error: null, elapsed_ms: 5 },\n            { step_index: 1, stage: 'LAT' as const, input_hash: DUMMY_HASH, output_hash: DUMMY_HASH, verdict: 'pass' as const, error: null, elapsed_ms: 8 },\n            { step_index: 2, stage: 'EGP' as const, input_hash: DUMMY_HASH, output_hash: DUMMY_HASH, verdict: 'pass' as const, error: null, elapsed_ms: 3 },\n            { step_index: 3, stage: 'SA' as const, input_hash: DUMMY_HASH, output_hash: DUMMY_HASH, verdict: 'pass' as const, error: null, elapsed_ms: 12 },\n        ],\n        grader_results: [\n            { grader_id: 'cr_grader', verdict: 'pass' as const, confidence: 1.0, details: null },\n            { grader_id: 'lat_grader', verdict: 'pass' as const, confidence: 1.0, details: null },\n            { grader_id: 'egp_grader', verdict: 'pass' as const, confidence: 1.0, details: null },\n            { grader_id: 'sa_grader', verdict: 'pass' as const, confidence: 1.0, details: null },\n        ],\n        failures: [],\n        pass_rate: 1.0,\n        consecutive_pass_rate: 1.0,\n        k: 10,\n    } satisfies EvalArtifact,\n\n    /**\n     * Single failure: LAT grader fails (broken CR→LAT binding).\n     */\n    lat_failure: {\n        schema_version: 1 as const,\n        trial_id: '01HZABCDEF1234567890ABCDEG',\n        seed: 'test-seed-002',\n        suite: 'kernel-invariant',\n        environment: 'ci' as const,\n        started_at: '2026-02-22T10:01:00.000Z',\n        completed_at: '2026-02-22T10:01:00.456Z',\n        duration_ms: 456,\n        transcript: [\n            { step_index: 0, stage: 'CR' as const, input_hash: DUMMY_HASH, output_hash: DUMMY_HASH, verdict: 'pass' as const, error: null, elapsed_ms: 5 },\n            { step_index: 1, stage: 'LAT' as const, input_hash: DUMMY_HASH, output_hash: null, verdict: 'fail' as const, error: 'CR hash mismatch', elapsed_ms: 3 },\n            { step_index: 2, stage: 'EGP' as const, input_hash: DUMMY_HASH, output_hash: null, verdict: 'skip' as const, error: null, elapsed_ms: 0 },\n            { step_index: 3, stage: 'SA' as const, input_hash: DUMMY_HASH, output_hash: null, verdict: 'skip' as const, error: null, elapsed_ms: 0 },\n        ],\n        grader_results: [\n            { grader_id: 'cr_grader', verdict: 'pass' as const, confidence: 1.0, details: null },\n            { grader_id: 'lat_grader', verdict: 'fail' as const, confidence: 1.0, details: 'LAT.cr_hash does not match computed CR hash' },\n            { grader_id: 'egp_grader', verdict: 'pass' as const, confidence: 0.0, details: 'Skipped: LAT failed' },\n            { grader_id: 'sa_grader', verdict: 'pass' as const, confidence: 0.0, details: 'Skipped: upstream failure' },\n        ],\n        failures: [\n            { step_index: 1, grader_id: 'lat_grader', code: 'BINDING_MISMATCH', message: 'LAT.cr_hash does not match computed CR hash' },\n        ],\n        pass_rate: 0.9,\n        consecutive_pass_rate: 0.9,\n        k: 10,\n    } satisfies EvalArtifact,\n\n    /**\n     * Partial artifact: run crashed mid-flight.\n     */\n    partial_crash: {\n        schema_version: 1 as const,\n        trial_id: '01HZABCDEF1234567890ABCDEH',\n        seed: null,\n        suite: 'kernel-invariant',\n        environment: 'local' as const,\n        started_at: '2026-02-22T10:02:00.000Z',\n        completed_at: null,\n        duration_ms: null,\n        transcript: [\n            { step_index: 0, stage: 'CR' as const, input_hash: DUMMY_HASH, output_hash: DUMMY_HASH, verdict: 'pass' as const, error: null, elapsed_ms: 5 },\n        ],\n        grader_results: [\n            { grader_id: 'cr_grader', verdict: 'pass' as const, confidence: 1.0, details: null },\n        ],\n        failures: [],\n        pass_rate: 0.0,\n        consecutive_pass_rate: 0.0,\n        k: 10,\n    } satisfies EvalArtifact,\n} as const;\n","/**\n * @hlos-ai/schemas - Settlement Execute Contract (EPIC 10 / K2 Bridge)\n *\n * Zod schemas for POST /api/v2/settlement/execute.\n *\n * Design invariants:\n * - Response returns the four kernel artifacts (cr, lat, egp, sa) in their\n *   existing shapes, so gradeKernelInvariant() works with zero branching.\n * - Hashes are always explicit and version-tagged (no silent V1/V2 drift).\n * - All public IDs are externally stable (ULID/UUID), never internal DB row IDs.\n * - Failure responses include partial artifacts and timing for EvalArtifact\n *   creation (nullable completed_at / duration_ms support).\n *\n * @packageDocumentation\n */\n\nimport { z } from 'zod';\nimport { Base64urlSha256Schema } from './encoding';\n\n// =============================================================================\n// Constants\n// =============================================================================\n\nconst ULID_REGEX = /^[0-9A-HJKMNP-TV-Z]{26}$/;\nconst UlidSchema = z.string().regex(ULID_REGEX, 'Expected ULID format');\nconst UlidOrUuidSchema = z.string().min(1);\n\nconst HashVersionSchema = z.enum(['v1', 'v2']);\nconst SettlementModeSchema = z.enum(['execute', 'dry_run']);\nconst NotaryStatusSchema = z.enum(['skipped', 'verified', 'failed']);\n\n// =============================================================================\n// Request Schema\n// =============================================================================\n\nexport const SettlementExecuteRequestSchema = z.object({\n    idempotency_key: UlidOrUuidSchema,\n    seed: z.string().nullable().optional(),\n    hash_version: HashVersionSchema.default('v2'),\n    mode: SettlementModeSchema.default('execute'),\n    flow: z.object({\n        wallet_id: z.string().min(1),\n        sku: z.string().min(1),\n        amount: z.string().min(1),\n        currency: z.literal('USD'),\n        metadata: z.record(z.unknown()).optional(),\n    }),\n}).strict();\n\nexport type SettlementExecuteRequest = z.infer<typeof SettlementExecuteRequestSchema>;\n\n// =============================================================================\n// Shared Sub-schemas\n// =============================================================================\n\nconst ArtifactsBlockSchema = z.object({\n    cr: z.record(z.unknown()).nullable(),\n    lat: z.record(z.unknown()).nullable(),\n    egp: z.record(z.unknown()).nullable(),\n    sa: z.record(z.unknown()).nullable(),\n});\n\nconst HashesBlockSchema = z.object({\n    cr_hash: Base64urlSha256Schema.nullable(),\n    lat_hash: Base64urlSha256Schema.nullable(),\n    egp_hash: Base64urlSha256Schema.nullable(),\n    sa_hash: Base64urlSha256Schema.nullable(),\n});\n\nconst SignatureEnvelopeSchema = z.object({\n    alg: z.literal('ed25519'),\n    sig: z.string().min(1),\n    pub: z.string().min(1),\n});\n\nconst NotaryBlockSchema = z.object({\n    status: NotaryStatusSchema,\n    run_notary: z.object({\n        subject_hash: Base64urlSha256Schema,\n        sig: z.string().min(1),\n        pub: z.string().min(1),\n    }).nullable(),\n    graph_notary: z.object({\n        subject_hash: Base64urlSha256Schema,\n        sig: z.string().min(1),\n        pub: z.string().min(1),\n    }).nullable(),\n});\n\nconst TimingBlockSchema = z.object({\n    started_at: z.string().datetime(),\n    completed_at: z.string().datetime().nullable(),\n    duration_ms: z.number().int().nonnegative().nullable(),\n});\n\n// =============================================================================\n// Success Response\n// =============================================================================\n\nexport const SettlementExecuteSuccessSchema = z.object({\n    schema_version: z.literal(1),\n    flow_id: UlidSchema,\n    suite_id: z.string().min(1),\n    seed: z.string().nullable(),\n    hash_version: HashVersionSchema,\n\n    artifacts: ArtifactsBlockSchema.extend({\n        cr: z.record(z.unknown()),\n        lat: z.record(z.unknown()),\n        egp: z.record(z.unknown()),\n        sa: z.record(z.unknown()),\n    }),\n\n    hashes: HashesBlockSchema.extend({\n        cr_hash: Base64urlSha256Schema,\n        lat_hash: Base64urlSha256Schema,\n        egp_hash: Base64urlSha256Schema,\n        sa_hash: Base64urlSha256Schema,\n    }),\n\n    signatures: z.object({\n        settlement: z.object({\n            cr_sig: SignatureEnvelopeSchema,\n            lat_sig: SignatureEnvelopeSchema,\n            sa_sig: SignatureEnvelopeSchema,\n        }),\n        notary: NotaryBlockSchema,\n    }),\n\n    receipt: z.object({\n        // Kernel receipt IDs currently follow rcpt_ + variable base36/random suffix.\n        receipt_id: z.string().regex(/^rcpt_/, 'Expected kernel receipt ID (rcpt_... format)'),\n        status: z.enum(['stored', 'pending']),\n        receipt_hash: Base64urlSha256Schema,\n    }),\n\n    run: z.object({\n        run_id: UlidSchema,\n        final_state_hash: Base64urlSha256Schema,\n        terminal_event_hash: Base64urlSha256Schema,\n        sealed_at: z.string().datetime(),\n    }),\n\n    timing: TimingBlockSchema.extend({\n        completed_at: z.string().datetime(),\n        duration_ms: z.number().int().nonnegative(),\n    }),\n});\n\nexport type SettlementExecuteSuccess = z.infer<typeof SettlementExecuteSuccessSchema>;\n\n// =============================================================================\n// Error Response\n// =============================================================================\n\nconst SettlementErrorCodeSchema = z.enum([\n    'INSUFFICIENT_FUNDS',\n    'POLICY_DENIED',\n    'INVARIANT_FAILED',\n    'INVALID_AMOUNT_FORMAT',\n    'INVALID_AMOUNT_NEGATIVE',\n    'INVALID_JSON',\n    'INTERNAL',\n]);\n\nexport const SettlementExecuteErrorSchema = z.object({\n    schema_version: z.literal(1),\n    flow_id: UlidSchema,\n    suite_id: z.string().min(1),\n    seed: z.string().nullable(),\n    hash_version: HashVersionSchema,\n\n    error: z.object({\n        code: SettlementErrorCodeSchema,\n        message: z.string(),\n        details: z.record(z.unknown()).optional(),\n    }),\n\n    partial: z.object({\n        artifacts: ArtifactsBlockSchema,\n        hashes: HashesBlockSchema,\n    }),\n\n    timing: TimingBlockSchema,\n});\n\nexport type SettlementExecuteError = z.infer<typeof SettlementExecuteErrorSchema>;\n\n// =============================================================================\n// Discriminated Response\n// =============================================================================\n\n/**\n * Parse a settlement execute response.\n * Success has `artifacts` at top level; error has `error` + `partial`.\n *\n * Usage in E2E gate:\n *   const parsed = SettlementExecuteResponseSchema.safeParse(responseBody);\n *   if (!parsed.success) throw new Error('Contract drift detected');\n *   if ('error' in parsed.data) {\n *     // handle failure — still produces EvalArtifact via partial\n *   } else {\n *     gradeKernelInvariant(parsed.data.artifacts);\n *   }\n */\nexport const SettlementExecuteResponseSchema = z.union([\n    SettlementExecuteSuccessSchema,\n    SettlementExecuteErrorSchema,\n]);\n\nexport type SettlementExecuteResponse = z.infer<typeof SettlementExecuteResponseSchema>;\n\n// =============================================================================\n// Type Guards\n// =============================================================================\n\nexport function isSettlementExecuteSuccess(\n    response: SettlementExecuteResponse\n): response is SettlementExecuteSuccess {\n    return 'artifacts' in response && !('error' in response);\n}\n\nexport function isSettlementExecuteError(\n    response: SettlementExecuteResponse\n): response is SettlementExecuteError {\n    return 'error' in response;\n}\n","/**\n * @hlos-ai/schemas - SignedRejectionReceiptV0\n *\n * Canonical SRR artifact for terminal negative finality.\n * Fresh U-family substrate contract — NOT a continuation of K-08.\n *\n * Lineage: K-08 uses @type '.../SignedRejectionReceipt', version 1, ksrr_ IDs.\n * This contract uses V0, version 0, srr_ IDs. Informed by K-08 field matrix\n * and signing semantics but is its own artifact.\n *\n * FROZEN: Breaking changes require version bump.\n */\n\nimport { z } from 'zod';\nimport { Base64urlSha256Schema, Base64urlEd25519SigSchema } from './encoding';\n\n// =============================================================================\n// Constants\n// =============================================================================\n\nexport const SRR_TYPE_URI = 'https://hlos.ai/schema/SignedRejectionReceiptV0' as const;\nexport const SRR_VERSION = 0 as const;\nexport const SRR_REJECTION_DOMAIN = 'kernel:k:rejection:v1' as const;\nexport const SRR_SIGNATURE_ALGORITHM = 'Ed25519' as const;\n\n// =============================================================================\n// Reason Code Registry (initial — open, not closed)\n// =============================================================================\n\nexport const SRR_INITIAL_REASON_CODES = [\n    'BUDGET_EXCEEDED',\n    'POLICY_VIOLATION',\n    'SAFETY_GATE_FAILED',\n    'DELEGATION_REVOKED',\n    'SETTLEMENT_TIMEOUT',\n] as const;\n\n/**\n * Reason code format: uppercase letters, digits, underscores. 3–64 chars.\n * Producers should prefer a registered code when one exists.\n * Consumers must tolerate unknown codes.\n */\nexport const REASON_CODE_PATTERN = /^[A-Z][A-Z0-9_]{2,63}$/;\n\n// =============================================================================\n// Zod Schema\n// =============================================================================\n\nexport const SignedRejectionReceiptV0Schema = z.object({\n    '@type': z.literal(SRR_TYPE_URI),\n    version: z.literal(SRR_VERSION),\n    receipt_id: z.string().regex(\n        /^srr_[0-9A-HJKMNP-TV-Z]{26}$/i,\n        'receipt_id must be srr_ + 26-char ULID'\n    ),\n    crossing_id: z.string().min(1),\n    reason_code: z.string().regex(REASON_CODE_PATTERN, 'reason_code must be UPPER_SNAKE_CASE, 3-64 chars'),\n    reason_message: z.string().min(1),\n    details: z.record(z.unknown()).optional(),\n    commitment_hash: Base64urlSha256Schema.optional(),\n    issuer_id: z.string().min(1),\n    rejected_at: z.string().datetime(),\n    issuer_public_key_ref: z.string().min(1),\n    signature_algorithm: z.literal(SRR_SIGNATURE_ALGORITHM),\n    signature: Base64urlEd25519SigSchema,\n}).strict();\n\n// =============================================================================\n// Types\n// =============================================================================\n\nexport type SignedRejectionReceiptV0 = z.infer<typeof SignedRejectionReceiptV0Schema>;\n\n/**\n * All signed fields — everything except `signature`.\n * Used as input to computeSrrSigningPayload.\n */\nexport type UnsignedSrrV0 = Omit<SignedRejectionReceiptV0, 'signature'>;\n","import { z } from 'zod';\nimport { Base64urlSha256Schema, bytesToBase64url } from './encoding';\nimport { jcsCanonicalize } from './receipt-hash';\n\nexport const LIABILITY_WAIVER_TERMS_TYPE_URI = 'https://hlos.ai/schema/LiabilityWaiverTermsV0' as const;\nexport const LIABILITY_WAIVER_TERMS_VERSION = 0 as const;\n\nexport const LiabilityDispositionSchema = z.enum([\n    'ABSORB',\n    'RELEASE',\n    'TRANSFER',\n    'DISPUTE',\n]);\n\nexport type LiabilityDisposition = z.infer<typeof LiabilityDispositionSchema>;\n\nexport const LiabilityWaiverTermsPartiesSchema = z.object({\n    offered_by: z.string().min(1).optional(),\n    offered_to: z.string().min(1).optional(),\n    beneficiary: z.string().min(1).optional(),\n    burdened_party: z.string().min(1).optional(),\n}).strict();\n\nexport const LiabilityWaiverTermsScopeSchema = z.object({\n    crossing_id: z.string().min(1).optional(),\n    commitment_hash: Base64urlSha256Schema.optional(),\n    claim_scope: z.string().min(1).optional(),\n}).strict();\n\nexport const LiabilityWaiverTermsConditionsSchema = z.object({\n    effective_if: z.record(z.unknown()).optional(),\n    expires_at: z.string().datetime().optional(),\n    jurisdiction: z.string().min(1).optional(),\n}).strict();\n\nexport const LiabilityWaiverTermsHashInputSchema = z.object({\n    parties: LiabilityWaiverTermsPartiesSchema,\n    liability_effect: LiabilityDispositionSchema,\n    scope: LiabilityWaiverTermsScopeSchema,\n    conditions: LiabilityWaiverTermsConditionsSchema.optional(),\n    canonical_terms: z.record(z.unknown()).optional(),\n}).strict();\n\nexport type LiabilityWaiverTermsHashInput = z.infer<typeof LiabilityWaiverTermsHashInputSchema>;\n\nexport const LiabilityWaiverTermsRefV0Schema = z.object({\n    waiver_id: z.string().min(1).optional(),\n    terms_hash: Base64urlSha256Schema,\n    type: z.literal(LIABILITY_WAIVER_TERMS_TYPE_URI),\n    version: z.literal(LIABILITY_WAIVER_TERMS_VERSION),\n}).strict();\n\nexport const LiabilityWaiverTermsV0Schema = z.object({\n    '@type': z.literal(LIABILITY_WAIVER_TERMS_TYPE_URI),\n    version: z.literal(LIABILITY_WAIVER_TERMS_VERSION),\n    waiver_id: z.string().min(1),\n    terms_hash: Base64urlSha256Schema,\n    parties: LiabilityWaiverTermsPartiesSchema,\n    liability_effect: LiabilityDispositionSchema,\n    scope: LiabilityWaiverTermsScopeSchema,\n    conditions: LiabilityWaiverTermsConditionsSchema.optional(),\n    human_readable_summary: z.string().min(1).optional(),\n    canonical_terms: z.record(z.unknown()).optional(),\n}).strict();\n\nexport type LiabilityWaiverTermsRefV0 = z.infer<typeof LiabilityWaiverTermsRefV0Schema>;\nexport type LiabilityWaiverTermsV0 = z.infer<typeof LiabilityWaiverTermsV0Schema>;\n\nlet cachedSha256: ((data: Uint8Array) => Uint8Array) | null = null;\n\nfunction loadSha256(): (data: Uint8Array) => Uint8Array {\n    if (cachedSha256) return cachedSha256;\n\n    const moduleApi = typeof process.getBuiltinModule === 'function'\n        ? (process.getBuiltinModule('module') as any)\n        : require('node:module');\n    const createRequire = moduleApi.createRequire as (filename: string) => NodeRequire;\n    const requireBase = typeof __filename === 'string'\n        ? __filename\n        : `${process.cwd()}/package.json`;\n    const _require = createRequire(requireBase);\n\n    let sha256: (data: Uint8Array) => Uint8Array;\n    try {\n        sha256 = _require('@noble/hashes/sha2.js').sha256;\n    } catch {\n        try {\n            sha256 = _require('@noble/hashes/sha2').sha256;\n        } catch {\n            throw new Error(\n                'Liability waiver hashing requires @noble/hashes as a peer dependency. ' +\n                'Install it: npm install @noble/hashes'\n            );\n        }\n    }\n    cachedSha256 = sha256;\n    return sha256;\n}\n\nexport function toLiabilityWaiverTermsHashInput(\n    terms: Pick<\n        LiabilityWaiverTermsV0,\n        'parties' | 'liability_effect' | 'scope' | 'conditions' | 'canonical_terms'\n    >,\n): LiabilityWaiverTermsHashInput {\n    return {\n        parties: terms.parties,\n        liability_effect: terms.liability_effect,\n        scope: terms.scope,\n        ...(terms.conditions !== undefined ? { conditions: terms.conditions } : {}),\n        ...(terms.canonical_terms !== undefined ? { canonical_terms: terms.canonical_terms } : {}),\n    };\n}\n\nexport function computeLiabilityWaiverTermsHash(input: LiabilityWaiverTermsHashInput): string {\n    const sha256 = loadSha256();\n    const canonical = jcsCanonicalize(input);\n    const digest = sha256(new TextEncoder().encode(canonical));\n    return bytesToBase64url(digest);\n}\n","import { z } from 'zod';\nimport { Base64urlEd25519SigSchema, Base64urlSha256Schema } from './encoding';\nimport {\n    LiabilityDispositionSchema,\n    LiabilityWaiverTermsRefV0Schema,\n} from './liability-waiver-terms-v0';\nimport { REASON_CODE_PATTERN, SRR_SIGNATURE_ALGORITHM } from './srr-v0';\n\nexport const SRR_V1_TYPE_URI = 'https://hlos.ai/schema/SignedRejectionReceiptV1' as const;\nexport const SRR_V1_VERSION = 1 as const;\nexport const SRR_V1_REJECTION_DOMAIN = 'kernel:u:rejection:v1' as const;\nexport const SRR_V1_SIGNATURE_ALGORITHM = SRR_SIGNATURE_ALGORITHM;\n\nexport const SignedRejectionReceiptV1Schema = z.object({\n    '@type': z.literal(SRR_V1_TYPE_URI),\n    version: z.literal(SRR_V1_VERSION),\n    receipt_id: z.string().regex(\n        /^srr_[0-9A-HJKMNP-TV-Z]{26}$/i,\n        'receipt_id must be srr_ + 26-char ULID'\n    ),\n    crossing_id: z.string().min(1),\n    reason_code: z.string().regex(REASON_CODE_PATTERN, 'reason_code must be UPPER_SNAKE_CASE, 3-64 chars'),\n    reason_message: z.string().min(1),\n    details: z.record(z.unknown()).optional(),\n    commitment_hash: Base64urlSha256Schema.optional(),\n    issuer_id: z.string().min(1),\n    rejected_at: z.string().datetime(),\n    issuer_public_key_ref: z.string().min(1),\n    signature_algorithm: z.literal(SRR_V1_SIGNATURE_ALGORITHM),\n    liability_disposition: LiabilityDispositionSchema,\n    waiver_terms_ref: LiabilityWaiverTermsRefV0Schema.optional(),\n    signature: Base64urlEd25519SigSchema,\n}).strict().superRefine((value, ctx) => {\n    if (\n        (value.liability_disposition === 'RELEASE' || value.liability_disposition === 'TRANSFER')\n        && value.waiver_terms_ref === undefined\n    ) {\n        ctx.addIssue({\n            code: z.ZodIssueCode.custom,\n            path: ['waiver_terms_ref'],\n            message: 'waiver_terms_ref is required for RELEASE and TRANSFER',\n        });\n    }\n});\n\nexport type SignedRejectionReceiptV1 = z.infer<typeof SignedRejectionReceiptV1Schema>;\nexport type UnsignedSrrV1 = Omit<SignedRejectionReceiptV1, 'signature'>;\n","/**\n * @hlos-ai/schemas - SRR Signing Payload and Digest\n *\n * Domain-separated signing payload construction for SignedRejectionReceipt (V0 and V1).\n * Canonical SRR signing construction:\n *   signingPayload = UTF8(DOMAIN) || SHA-256(JCS(unsignedFields))\n *\n * Each version uses its own domain prefix for formal domain separation:\n *   V0: 'kernel:k:rejection:v1'\n *   V1: 'kernel:u:rejection:v1'\n *\n * This is an intentional tightening over K-08, which requires domain separation\n * and deterministic payloads but does not prescribe this exact byte recipe.\n *\n * Requires @noble/hashes as peer dependency.\n */\n\nimport { jcsCanonicalize } from './receipt-hash';\nimport { bytesToBase64url } from './encoding';\nimport {\n    SRR_REJECTION_DOMAIN,\n    SRR_TYPE_URI,\n    type UnsignedSrrV0,\n    type SignedRejectionReceiptV0,\n} from './srr-v0';\nimport {\n    SRR_V1_REJECTION_DOMAIN,\n    SRR_V1_TYPE_URI,\n    type UnsignedSrrV1,\n    type SignedRejectionReceiptV1,\n} from './srr-v1';\n\nconst textEncoder = new TextEncoder();\nconst DOMAIN_BYTES_V0 = textEncoder.encode(SRR_REJECTION_DOMAIN);\nconst DOMAIN_BYTES_V1 = textEncoder.encode(SRR_V1_REJECTION_DOMAIN);\n\n/**\n * Lazy-load SHA-256 from @noble/hashes.\n * Follows the same lazy-load pattern as receipt-hash.ts.\n */\nlet cachedSha256: ((data: Uint8Array) => Uint8Array) | null = null;\n\nfunction loadSha256(): (data: Uint8Array) => Uint8Array {\n    if (cachedSha256) return cachedSha256;\n\n    const moduleApi = typeof process.getBuiltinModule === 'function'\n        ? (process.getBuiltinModule('module') as any)\n        : require('node:module');\n    const createRequire = moduleApi.createRequire as (filename: string) => NodeRequire;\n    const requireBase = typeof __filename === 'string'\n        ? __filename\n        : `${process.cwd()}/package.json`;\n    const _require = createRequire(requireBase);\n\n    let sha256: (data: Uint8Array) => Uint8Array;\n    try {\n        sha256 = _require('@noble/hashes/sha2.js').sha256;\n    } catch {\n        try {\n            sha256 = _require('@noble/hashes/sha2').sha256;\n        } catch {\n            throw new Error(\n                'SRR signing requires @noble/hashes as a peer dependency. ' +\n                'Install it: npm install @noble/hashes'\n            );\n        }\n    }\n    cachedSha256 = sha256;\n    return sha256;\n}\n\n/**\n * Compute the domain-separated signing payload for an unsigned SRR.\n *\n * signingPayload = UTF8(DOMAIN) || SHA-256(JCS(unsignedFields))\n *\n * DOMAIN is version-specific (V0: 'kernel:k:rejection:v1', V1: 'kernel:u:rejection:v1').\n *\n * @param unsignedSrr - All SRR fields EXCEPT signature\n * @returns Uint8Array payload (domain bytes + 32 SHA-256)\n */\nexport function computeSrrSigningPayload(unsignedSrr: UnsignedSrrV0 | UnsignedSrrV1): Uint8Array {\n    const sha256 = loadSha256();\n    const canonical = jcsCanonicalize(unsignedSrr);\n    const digest = sha256(textEncoder.encode(canonical));\n    const domainBytes = unsignedSrr['@type'] === SRR_V1_TYPE_URI\n        ? DOMAIN_BYTES_V1\n        : unsignedSrr['@type'] === SRR_TYPE_URI\n            ? DOMAIN_BYTES_V0\n            : (() => { throw new Error('Unsupported SRR type for signing payload construction'); })();\n\n    const payload = new Uint8Array(domainBytes.length + digest.length);\n    payload.set(domainBytes, 0);\n    payload.set(digest, domainBytes.length);\n    return payload;\n}\n\n/**\n * Compute the replay/idempotency digest for a full signed SRR.\n *\n * srr_digest = base64url(SHA-256(JCS(signedSrr)))\n *\n * This is over the ENTIRE stored artifact including signature,\n * distinct from the signing payload which excludes signature.\n *\n * @param signedSrr - Complete signed SRR\n * @returns 43-char base64url string\n */\nexport function computeSrrDigest(signedSrr: SignedRejectionReceiptV0 | SignedRejectionReceiptV1): string {\n    const sha256 = loadSha256();\n    const canonical = jcsCanonicalize(signedSrr);\n    return bytesToBase64url(sha256(textEncoder.encode(canonical)));\n}\n","/**\n * @hlos-ai/schemas - SRR Verification\n *\n * Ed25519 signature verification for SignedRejectionReceipt (V0 and V1).\n * Shared primitive (verifyDetachedEd25519) + SRR-specific entrypoint.\n *\n * Requires @noble/ed25519 as peer dependency.\n */\n\nimport { base64urlToBytes } from './encoding';\nimport { computeSrrSigningPayload } from './srr-signing';\nimport {\n    SRR_TYPE_URI,\n    SignedRejectionReceiptV0Schema,\n    SRR_SIGNATURE_ALGORITHM,\n    type SignedRejectionReceiptV0,\n    type UnsignedSrrV0,\n} from './srr-v0';\nimport {\n    SRR_V1_TYPE_URI,\n    SignedRejectionReceiptV1Schema,\n    type SignedRejectionReceiptV1,\n    type UnsignedSrrV1,\n} from './srr-v1';\n\n// =============================================================================\n// Lazy-loaded Ed25519 verify\n// =============================================================================\n\n/**\n * Lazy-load verify from @noble/ed25519.\n * Follows the same lazy-load pattern as receipt-hash.ts / srr-signing.ts\n * to keep @noble/ed25519 as a peer dependency.\n */\nlet cachedVerify: ((sig: Uint8Array, msg: Uint8Array, pubKey: Uint8Array) => Promise<boolean>) | null = null;\n\nfunction loadVerify(): (sig: Uint8Array, msg: Uint8Array, pubKey: Uint8Array) => Promise<boolean> {\n    if (cachedVerify) return cachedVerify;\n\n    const moduleApi = typeof process.getBuiltinModule === 'function'\n        ? (process.getBuiltinModule('module') as any)\n        : require('node:module');\n    const createRequire = moduleApi.createRequire as (filename: string) => NodeRequire;\n    const requireBase = typeof __filename === 'string'\n        ? __filename\n        : `${process.cwd()}/package.json`;\n    const _require = createRequire(requireBase);\n\n    let ed25519Module: any;\n    try {\n        ed25519Module = _require('@noble/ed25519');\n    } catch {\n        throw new Error(\n            'SRR verification requires @noble/ed25519 as a peer dependency. ' +\n            'Install it: npm install @noble/ed25519'\n        );\n    }\n\n    // Configure sha512 for @noble/ed25519 v3.x if not already set\n    if (!ed25519Module.hashes?.sha512) {\n        let sha512Fn: (...m: Uint8Array[]) => Uint8Array;\n        try {\n            const sha2 = _require('@noble/hashes/sha2.js');\n            sha512Fn = (...m: Uint8Array[]) => sha2.sha512(ed25519Module.etc.concatBytes(...m));\n        } catch {\n            try {\n                const sha2 = _require('@noble/hashes/sha2');\n                sha512Fn = (...m: Uint8Array[]) => sha2.sha512(ed25519Module.etc.concatBytes(...m));\n            } catch {\n                throw new Error(\n                    'SRR verification requires @noble/hashes as a peer dependency. ' +\n                    'Install it: npm install @noble/hashes'\n                );\n            }\n        }\n        if (!ed25519Module.hashes) ed25519Module.hashes = {};\n        ed25519Module.hashes.sha512 = sha512Fn;\n    }\n\n    const verify: (sig: Uint8Array, msg: Uint8Array, pubKey: Uint8Array) => Promise<boolean> = ed25519Module.verify;\n    cachedVerify = verify;\n    return verify;\n}\n\n// =============================================================================\n// Shared Crypto Primitive\n// =============================================================================\n\n/**\n * Verify a detached Ed25519 signature.\n * Artifact-agnostic — knows nothing about SRR, receipts, or domains.\n */\nexport async function verifyDetachedEd25519(params: {\n    signingPayload: Uint8Array;\n    signature: Uint8Array;\n    publicKey: Uint8Array;\n}): Promise<boolean> {\n    const verify = loadVerify(); // let env/peer-dep errors propagate\n    try {\n        return await verify(params.signature, params.signingPayload, params.publicKey);\n    } catch {\n        return false;\n    }\n}\n\n// =============================================================================\n// SRR Verification\n// =============================================================================\n\nexport type SrrVerificationResult =\n    | { valid: true }\n    | { valid: false; reason: 'UNSUPPORTED_ALGORITHM' | 'SCHEMA_VIOLATION' | 'PAYLOAD_CONSTRUCTION_ERROR' | 'INVALID_SIGNATURE' };\n\n/**\n * Verify a SignedRejectionReceipt artifact.\n *\n * 1. Algorithm check (must be Ed25519) — checked BEFORE schema so the\n *    caller gets a meaningful UNSUPPORTED_ALGORITHM rather than a\n *    generic SCHEMA_VIOLATION from the z.literal('Ed25519') constraint.\n * 2. Schema validation (Zod parse)\n * 3. Reconstruct signing payload from unsigned fields\n * 4. Decode signature from base64url\n * 5. Ed25519 verify\n *\n * Does NOT check:\n * - Mutual exclusion (SA ⊕ SRR) — runtime invariant\n * - Crossing existence — verifier doesn't know\n * - Issuer authorization — only checks signature matches key\n */\nexport async function verifySignedRejectionReceipt(params: {\n    srr: SignedRejectionReceiptV0 | SignedRejectionReceiptV1 | unknown;\n    publicKey: Uint8Array;\n}): Promise<SrrVerificationResult> {\n    const { srr, publicKey } = params;\n\n    // 0. Guard: reject null/undefined/non-object before any property access\n    if (!srr || typeof srr !== 'object') {\n        return { valid: false, reason: 'SCHEMA_VIOLATION' };\n    }\n\n    // 1. Algorithm check (before schema) only when an algorithm value is present.\n    // Missing/non-string values should remain SCHEMA_VIOLATION.\n    if (\n        typeof (srr as { signature_algorithm?: unknown }).signature_algorithm === 'string'\n        && (srr as any).signature_algorithm !== SRR_SIGNATURE_ALGORITHM\n    ) {\n        return { valid: false, reason: 'UNSUPPORTED_ALGORITHM' };\n    }\n\n    // 2. Schema validation — dispatch on @type discriminant\n    const wireType = (srr as any)['@type'];\n    if (wireType !== SRR_V1_TYPE_URI && wireType !== SRR_TYPE_URI) {\n        return { valid: false, reason: 'SCHEMA_VIOLATION' };\n    }\n    const parseResult = wireType === SRR_V1_TYPE_URI\n        ? SignedRejectionReceiptV1Schema.safeParse(srr)\n        : SignedRejectionReceiptV0Schema.safeParse(srr);\n    if (!parseResult.success) {\n        return { valid: false, reason: 'SCHEMA_VIOLATION' };\n    }\n    const parsedSrr = parseResult.data;\n\n    // 3. Extract unsigned fields and compute signing payload\n    let signingPayload: Uint8Array;\n    try {\n        const { signature, ...unsignedFields } = parsedSrr;\n        signingPayload = computeSrrSigningPayload(unsignedFields as UnsignedSrrV0 | UnsignedSrrV1);\n    } catch {\n        return { valid: false, reason: 'PAYLOAD_CONSTRUCTION_ERROR' };\n    }\n\n    // 4. Decode signature\n    let signatureBytes: Uint8Array;\n    try {\n        signatureBytes = base64urlToBytes(parsedSrr.signature);\n    } catch {\n        return { valid: false, reason: 'INVALID_SIGNATURE' };\n    }\n\n    // 5. Verify\n    const valid = await verifyDetachedEd25519({\n        signingPayload,\n        signature: signatureBytes,\n        publicKey,\n    });\n\n    return valid ? { valid: true } : { valid: false, reason: 'INVALID_SIGNATURE' };\n}\n"],"mappings":";;;;;;;;;;;;;;;;;;;;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,+BAAAA;AAAA,EAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;;;ACAA,IAAAC,cAAkB;;;ACalB,iBAAkB;AASX,SAAS,iBAAiB,OAA2B;AACxD,MAAI,SAAS;AACb,WAAS,IAAI,GAAG,IAAI,MAAM,QAAQ,KAAK;AACnC,cAAU,OAAO,aAAa,MAAM,CAAC,CAAC;AAAA,EAC1C;AACA,QAAM,SAAS,KAAK,MAAM;AAC1B,SAAO,OAAO,QAAQ,OAAO,GAAG,EAAE,QAAQ,OAAO,GAAG,EAAE,QAAQ,OAAO,EAAE;AAC3E;AAKO,SAAS,iBAAiB,KAAyB;AACtD,QAAM,SAAS,IAAI,QAAQ,MAAM,GAAG,EAAE,QAAQ,MAAM,GAAG;AACvD,QAAM,SAAS,SAAS,IAAI,QAAQ,IAAK,OAAO,SAAS,KAAM,CAAC;AAChE,QAAM,SAAS,KAAK,MAAM;AAC1B,QAAM,QAAQ,IAAI,WAAW,OAAO,MAAM;AAC1C,WAAS,IAAI,GAAG,IAAI,OAAO,QAAQ,KAAK;AACpC,UAAM,CAAC,IAAI,OAAO,WAAW,CAAC;AAAA,EAClC;AACA,SAAO;AACX;AASO,IAAM,yBAAyB;AAM/B,IAAM,wBAAwB,aAAE,OAAO,EAAE;AAAA,EAC5C;AAAA,EACA;AACJ;AAMO,IAAM,4BAA4B,aAAE,OAAO,EAAE;AAAA,EAChD;AAAA,EACA;AACJ;;;ADnEO,IAAM,oBAAoB;AAC1B,IAAM,uBAAuB;AAU7B,IAAM,sBAAsB,cAAE,OAAO;AAAA,EACxC,SAAS,cAAE,QAAQ,iBAAiB;AAAA,EACpC,SAAS,cAAE,QAAQ,oBAAoB;AAAA,EACvC,cAAc,cAAE,OAAO,EAAE,IAAI,CAAC;AAAA,EAC9B,cAAc;AAAA,EACd,OAAO,cAAE,QAAQ;AAAA,EACjB,WAAW,cAAE,OAAO,EAAE,IAAI,CAAC;AAAA,EAC3B,WAAW;AAAA,EACX,WAAW,cAAE,OAAO,EAAE,SAAS;AAAA,EAC/B,mBAAmB,cAAE,OAAO,EAAE,IAAI,CAAC;AACvC,CAAC;AAEM,IAAM,2BAA2B,CACpC,aACA,gBAEA,oBAAoB,OAAO;AAAA,EACvB,cAAc,cAAE,QAAQ,WAAW;AAAA,EACnC,OAAO;AACX,CAAC;;;AERL,IAAI,eAA0D;AAU9D,SAAS,aAAa,OAAyB;AAC3C,MAAI,MAAM,QAAQ,KAAK,EAAG,QAAO,MAAM,IAAI,YAAY;AACvD,MAAI,UAAU,QAAQ,OAAO,UAAU,UAAU;AAC7C,UAAM,MAAM;AACZ,UAAM,MAA+B,CAAC;AACtC,eAAW,OAAO,OAAO,KAAK,GAAG,EAAE,KAAK,GAAG;AACvC,UAAI,GAAG,IAAI,aAAa,IAAI,GAAG,CAAC;AAAA,IACpC;AACA,WAAO;AAAA,EACX;AACA,SAAO;AACX;AAQA,SAAS,iBAAiB,GAAoB;AAC1C,WAAS,IAAI,GAAG,IAAI,EAAE,QAAQ,KAAK;AAC/B,UAAM,OAAO,EAAE,WAAW,CAAC;AAC3B,QAAI,QAAQ,SAAU,QAAQ,OAAQ;AAClC,YAAM,OAAO,EAAE,WAAW,IAAI,CAAC;AAC/B,UAAI,MAAM,IAAI,KAAK,OAAO,SAAU,OAAO,MAAQ,QAAO;AAC1D;AAAA,IACJ,WAAW,QAAQ,SAAU,QAAQ,OAAQ;AACzC,aAAO;AAAA,IACX;AAAA,EACJ;AACA,SAAO;AACX;AAaO,SAAS,gBAAgB,OAAwB;AACpD,SAAO,KAAK,UAAU,aAAa,KAAK,GAAG,CAAC,MAAM,MAAM;AACpD,QAAI,MAAM,OAAW,OAAM,IAAI,MAAM,+BAA+B;AACpE,QAAI,OAAO,MAAM,WAAY,OAAM,IAAI,MAAM,8BAA8B;AAC3E,QAAI,OAAO,MAAM,SAAU,OAAM,IAAI,MAAM,4BAA4B;AACvE,QAAI,OAAO,MAAM,SAAU,OAAM,IAAI,MAAM,4BAA4B;AACvE,QAAI,OAAO,MAAM,YAAY,CAAC,OAAO,SAAS,CAAC;AAC3C,YAAM,IAAI,MAAM,uCAAuC;AAC3D,QAAI,OAAO,MAAM,YAAY,iBAAiB,CAAC;AAC3C,YAAM,IAAI,MAAM,yDAAoD;AACxE,WAAO;AAAA,EACX,CAAC;AACL;AA6BO,SAAS,mBAAmB,SAAkC;AAGjE,QAAM,SAAS,WAAW;AAC1B,QAAM,YAAY,gBAAgB,OAAO;AACzC,QAAM,SAAS,OAAO,IAAI,YAAY,EAAE,OAAO,SAAS,CAAC;AACzD,SAAO,iBAAiB,MAAM;AAClC;AAaO,SAAS,mBAAmB,SAA0B;AACzD,QAAM,SAAS,WAAW;AAC1B,QAAM,YAAY,gBAAgB,OAAO;AACzC,QAAM,SAAS,OAAO,IAAI,YAAY,EAAE,OAAO,SAAS,CAAC;AACzD,SAAO,iBAAiB,MAAM;AAClC;AAMA,SAAS,aAA+C;AACpD,MAAI,aAAc,QAAO;AAKzB,QAAM,YAAY,OAAO,QAAQ,qBAAqB,aAE/C,QAAQ,iBAAiB,QAAQ;AAAA;AAAA,IAElC,QAAQ,QAAa;AAAA;AAC3B,QAAM,gBAAgB,UAAU;AAChC,QAAM,cAAc,OAAO,eAAe,WACpC,aACA,GAAG,QAAQ,IAAI,CAAC;AACtB,QAAM,WAAW,cAAc,WAAW;AAE1C,MAAI;AACJ,MAAI;AAEA,aAAS,SAAS,uBAAuB,EAAE;AAAA,EAC/C,QAAQ;AACJ,QAAI;AAEA,eAAS,SAAS,oBAAoB,EAAE;AAAA,IAC5C,QAAQ;AACJ,YAAM,IAAI;AAAA,QACN;AAAA,MAEJ;AAAA,IACJ;AAAA,EACJ;AACA,iBAAe;AACf,SAAO;AACX;AAUO,IAAM,oBAAoB,sBAAsB;AAAA,EACnD;AACJ;AAeO,IAAM,8BAA8B;AAAA,EACvC,SAAS;AAAA,IACL,SAAS;AAAA,IACT,SAAS;AAAA,IACT,YAAY;AAAA,IACZ,SAAS;AAAA,MACL,MAAM;AAAA,MACN,YAAY;AAAA,MACZ,sBAAsB;AAAA,IAC1B;AAAA;AAAA,IAEA,cAAc;AAAA,IACd,WACI;AAAA,IACJ,QAAQ;AAAA,IACR,WAAW;AAAA,EACf;AAAA;AAAA;AAAA;AAAA;AAAA,EAMA,aAAa;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAQb,qBAAqB;AACzB;;;AC7OA,SAAS,SAAS,OAAgC;AAC9C,QAAM,KAAK,IAAI,YAAY,MAAM,UAAU;AAC3C,MAAI,WAAW,EAAE,EAAE,IAAI,KAAK;AAC5B,SAAO;AACX;AAEA,eAAe,gBAAgB,WAA0C;AACrE,MAAI,OAAO,cAAc,eAAe,qBAAqB,WAAW;AACpE,WAAO;AAAA,EACX;AAEA,QAAM,MAAM;AACZ,SAAO,OAAO,OAAO;AAAA,IACjB;AAAA,IACA,SAAS,GAAG;AAAA,IACZ;AAAA,IACA;AAAA,IACA,CAAC,QAAQ;AAAA,EACb;AACJ;AAEA,eAAsB,UAClB,UACA,WACsB;AACtB,QAAM,SAAS,oBAAoB,MAAM,QAAQ;AACjD,QAAM,cAAc,mBAAmB,OAAO,KAAK;AAEnD,MAAI,gBAAgB,OAAO,cAAc;AACrC,UAAM,IAAI,MAAM,2BAA2B;AAAA,EAC/C;AAEA,QAAM,MAAM,MAAM,gBAAgB,SAAS;AAC3C,QAAM,WAAW,MAAM,OAAO,OAAO;AAAA,IACjC;AAAA,IACA;AAAA,IACA,SAAS,iBAAiB,OAAO,SAAS,CAAC;AAAA,IAC3C,SAAS,iBAAiB,OAAO,YAAY,CAAC;AAAA,EAClD;AAEA,MAAI,CAAC,UAAU;AACX,UAAM,IAAI,MAAM,gDAAgD,OAAO,SAAS,EAAE;AAAA,EACtF;AAEA,SAAO;AACX;;;AC5CA,IAAAC,cAAkB;AAMX,IAAM,gBAAgB,cAAE,KAAK;AAAA,EAChC;AAAA;AAAA,EACA;AAAA;AAAA,EACA;AAAA;AAAA,EACA;AAAA;AAAA,EACA;AAAA;AAAA,EACA;AAAA;AAAA,EACA;AAAA;AACJ,CAAC;AAOM,IAAM,WAAW,cAAc;;;AClBtC,IAAAC,cAAkB;;;ACHlB,IAAAC,cAAkB;AAKX,IAAM,wBAAwB,cAAE,KAAK;AAAA;AAAA,EAExC;AAAA;AAAA,EACA;AAAA;AAAA,EACA;AAAA;AAAA,EACA;AAAA;AAAA,EACA;AAAA;AAAA,EACA;AAAA;AAAA,EACA;AAAA;AAAA,EACA;AAAA;AAAA,EACA;AAAA;AAAA;AAAA,EAGA;AAAA;AAAA,EACA;AAAA;AACJ,CAAC;;;ADMM,SAAS,QAAW,MAAS,eAAuB,WAAwC;AAC/F,SAAO;AAAA,IACH,SAAS;AAAA,IACT;AAAA,IACA,MAAM;AAAA,MACF,gBAAgB;AAAA,MAChB,GAAI,aAAa,EAAE,YAAY,UAAU;AAAA,IAC7C;AAAA,EACJ;AACJ;AAsBO,SAAS,MACZ,MACA,SACA,eACA,SACa;AACb,SAAO;AAAA,IACH,SAAS;AAAA,IACT,OAAO;AAAA,MACH;AAAA,MACA;AAAA,MACA,gBAAgB;AAAA,MAChB,GAAI,YAAY,UAAa,EAAE,QAAQ;AAAA,IAC3C;AAAA,EACJ;AACJ;AAMO,IAAM,wBAAwB,CAAsB,eACvD,cAAE,OAAO;AAAA,EACL,SAAS,cAAE,QAAQ,IAAI;AAAA,EACvB,MAAM;AAAA,EACN,MAAM,cAAE,OAAO;AAAA,IACX,YAAY,cAAE,OAAO,EAAE,SAAS;AAAA,IAChC,gBAAgB,cAAE,OAAO;AAAA,EAC7B,CAAC,EAAE,SAAS;AAChB,CAAC;AAEE,IAAM,sBAAsB,cAAE,OAAO;AAAA,EACxC,SAAS,cAAE,QAAQ,KAAK;AAAA,EACxB,OAAO,cAAE,OAAO;AAAA,IACZ,MAAM;AAAA,IACN,SAAS,cAAE,OAAO;AAAA,IAClB,SAAS,cAAE,QAAQ,EAAE,SAAS;AAAA,IAC9B,gBAAgB,cAAE,OAAO;AAAA,EAC7B,CAAC;AACL,CAAC;;;AE9FD,IAAAC,cAAkB;AAUX,IAAM,mBAAmB;AAMzB,IAAM,kBAAkB;AA4ExB,IAAM,sBAAsB;AAC5B,IAAM,mBAAmB;AAEzB,IAAM,wBAAwB,CAAsB,kBACvD,cAAE,OAAO;AAAA,EACL,SAAS,cAAE,QAAQ,gBAAgB;AAAA,EACnC,SAAS,cAAE,QAAQ,eAAe;AAAA,EAClC,YAAY,cAAE,OAAO;AAAA,EACrB,SAAS;AAAA;AAAA,EAET,cAAc,cAAE,OAAO,EAAE;AAAA,IACrB;AAAA,IACA;AAAA,EACJ;AAAA;AAAA,EAEA,WAAW,cAAE,OAAO,EAAE;AAAA,IAClB;AAAA,IACA;AAAA,EACJ;AAAA,EACA,QAAQ,cAAE,OAAO,EAAE,IAAI,CAAC;AAAA,EACxB,WAAW,cAAE,OAAO,EAAE,SAAS;AACnC,CAAC;AAKE,IAAM,6BAA6B,sBAAsB,cAAE,QAAQ,CAAC;AASpE,SAAS,kBAAkB,OAA0C;AACxE,MAAI,OAAO,UAAU,YAAY,UAAU,KAAM,QAAO;AACxD,QAAM,MAAM;AACZ,SACI,IAAI,OAAO,MAAM,oBACjB,IAAI,SAAS,MAAM,mBACnB,OAAO,IAAI,YAAY,MAAM,YAC7B,OAAO,IAAI,cAAc,MAAM,YAC/B,OAAO,IAAI,WAAW,MAAM,YAC5B,OAAO,IAAI,QAAQ,MAAM,YACzB,OAAO,IAAI,WAAW,MAAM;AAEpC;;;AC7IA,IAAAC,cAAkB;AAgCX,IAAM,kBAAkB,uBAAO,iBAAiB;AAiBhD,IAAM,iBAAiB,cAAE,OAAO,EAClC,MAAM,2BAA2B,yBAAyB,EAC1D,UAAU,CAAC,MAAM,CAAa;AAK5B,IAAM,mBAAmB,cAAE,OAAO,EACpC,MAAM,6BAA6B,2BAA2B,EAC9D,UAAU,CAAC,MAAM,CAAe;AAK9B,IAAM,kBAAkB,cAAE,OAAO,EACnC,MAAM,kCAAkC,0BAA0B,EAClE,UAAU,CAAC,MAAM,CAAc;AAK7B,IAAM,sBAAsB,cAAE,OAAO,EACvC,IAAI,CAAC,EACL,IAAI,GAAG,EACP,UAAU,CAAC,MAAM,CAAkB;AAMjC,IAAM,uBAAuB,cAAE,OAAO,EACxC,IAAI,CAAC,EACL,IAAI,GAAG,EACP,MAAM,kBAAkB,wCAAwC,EAChE,UAAU,CAAC,MAAM,CAAmB;AAKlC,IAAM,mBAAmB,cAAE,OAAO,EACpC,MAAM,0BAA0B,2BAA2B,EAC3D,UAAU,CAAC,MAAM,CAAe;AAM9B,IAAM,mBAAmB,cAAE,OAAO,EACpC,MAAM,4BAA4B,2BAA2B,EAC7D,UAAU,CAAC,MAAM,CAAe;AAU9B,SAAS,WAAW,QAAwB;AAC/C,QAAM,YAAY,KAAK,IAAI,EAAE,SAAS,EAAE;AACxC,QAAM,SAAS,OAAO,WAAW,EAAE,QAAQ,MAAM,EAAE,EAAE,MAAM,GAAG,EAAE;AAChE,SAAO,GAAG,MAAM,IAAI,SAAS,GAAG,MAAM;AAC1C;AAEO,IAAM,mBAAmB,MAAgB,WAAW,QAAQ;AAC5D,IAAM,qBAAqB,MAAkB,WAAW,UAAU;AAClE,IAAM,oBAAoB,MAAiB,WAAW,MAAM;AAC5D,IAAM,qBAAqB,MAAkB,WAAW,OAAO;AAC/D,IAAM,qBAAqB,MAAkB,WAAW,UAAU;;;AC9GzE,IAAAC,cAAkB;AAUX,IAAMC,yBAAwB,cAAE,KAAK;AAAA;AAAA,EAExC;AAAA;AAAA,EACA;AAAA;AAAA;AAAA,EAGA;AAAA;AAAA,EACA;AAAA;AAAA;AAAA,EAGA;AAAA;AAAA,EACA;AAAA;AAAA,EACA;AAAA;AAAA,EACA;AAAA;AAAA;AAAA,EAGA;AAAA;AAAA,EACA;AAAA;AAAA,EACA;AAAA;AAAA,EACA;AAAA;AAAA;AAAA,EAGA;AAAA;AAAA,EACA;AAAA;AAAA;AAAA,EAGA;AAAA;AAAA;AAAA,EAGA;AAAA;AAAA,EACA;AAAA;AACJ,CAAC;AAOM,IAAM,oBAAqD;AAAA,EAC9D,kBAAkB;AAAA,EAClB,iBAAiB;AAAA,EACjB,cAAc;AAAA,EACd,WAAW;AAAA,EACX,WAAW;AAAA,EACX,oBAAoB;AAAA,EACpB,iBAAiB;AAAA,EACjB,4BAA4B;AAAA,EAC5B,UAAU;AAAA,EACV,0BAA0B;AAAA,EAC1B,0BAA0B;AAAA,EAC1B,sBAAsB;AAAA,EACtB,sBAAsB;AAAA,EACtB,oBAAoB;AAAA,EACpB,cAAc;AAAA,EACd,gBAAgB;AAAA,EAChB,qBAAqB;AACzB;AAWO,IAAM,iBAAiB,CAAsB,eAChD,cAAE,OAAO;AAAA,EACL,IAAI,cAAE,QAAQ,IAAI;AAAA,EAClB,QAAQ,cAAE,MAAM;AAAA,IACZ,cAAE,OAAO,EAAE,IAAI,EAAE,IAAI,GAAG,EAAE,IAAI,GAAG;AAAA,IACjC,cAAE,QAAQ,GAAG;AAAA,EACjB,CAAC;AAAA,EACD,MAAM;AACV,CAAC;AAYE,IAAM,oBAAoB,cAAE,OAAO;AAAA,EACtC,IAAI,cAAE,QAAQ,KAAK;AAAA,EACnB,QAAQ,cAAE,OAAO,EAAE,IAAI,EAAE,IAAI,GAAG,EAAE,IAAI,GAAG;AAAA,EACzC,OAAO,cAAE,OAAO;AAAA,IACZ,MAAMA;AAAA;AAAA,IACN,SAAS,cAAE,OAAO;AAAA,IAClB,SAAS,cAAE,OAAO,cAAE,QAAQ,CAAC,EAAE,SAAS;AAAA,EAC5C,CAAC;AACL,CAAC;AAgBM,IAAM,yBAAyB,cAAE,OAAO,EAC1C,MAAM,0BAA0B,iDAAiD;AAK/E,IAAM,wBAAwB,cAAE,OAAO,EACzC,MAAM,kCAAkC,+CAA+C;AAKrF,IAAM,yBAAyB,cAAE,OAAO,EAC1C,MAAM,6BAA6B,oDAAoD;AAKrF,IAAM,uBAAuB,cAAE,OAAO,EACxC,MAAM,2BAA2B,gDAAgD;AAU/E,IAAM,sBAAsB,cAAE,KAAK,CAAC,WAAW,YAAY,MAAM,CAAC;AAMlE,IAAM,yBAAyB,cAAE,KAAK;AAAA,EACzC;AAAA;AAAA,EACA;AAAA;AAAA,EACA;AAAA;AACJ,CAAC;AAOM,SAAS,oBAAoB,kBAAmD;AACnF,UAAQ,kBAAkB;AAAA,IACtB,KAAK;AACD,aAAO;AAAA,IACX,KAAK;AACD,aAAO;AAAA,IACX,KAAK;AACD,aAAO;AAAA,EACf;AACJ;AAYO,IAAM,2BAA2B,cAAE,OAAO;AAAA,EAC7C,YAAY;AAAA,EACZ,cAAc,cAAE,OAAO;AAAA,EACvB,YAAY;AAAA;AAAA,EAGZ,UAAU,cAAE,OAAO,EAAE,SAAS;AAAA,EAC9B,kBAAkB,cAAE,OAAO,EAAE,SAAS;AAAA,EACtC,iBAAiB,cAAE,OAAO,EAAE,SAAS;AAAA;AAAA,EAGrC,oBAAoB,cAAE,OAAO,EAAE,SAAS;AAAA,EACxC,gBAAgB,oBAAoB,SAAS;AAAA,EAC7C,mBAAmB;AACvB,CAAC;AAQM,IAAM,4BAA4B,cAAE,OAAO;AAAA,EAC9C,GAAG,cAAE,QAAQ,CAAC;AAAA,EACd,UAAU;AAAA,EACV,qBAAqB;AACzB,CAAC;AAWM,IAAM,uBAAuB;AAK7B,IAAM,+BAA+B,cAAE,OAAO;AAAA,EACjD,MAAM,cAAE,QAAQ,iBAAiB;AAAA,EACjC,YAAY;AAAA;AAAA,EAGZ,UAAU,cAAE,OAAO,EAAE,SAAS;AAAA,EAC9B,kBAAkB,cAAE,OAAO,EAAE,SAAS;AAAA,EACtC,iBAAiB,cAAE,OAAO,EAAE,SAAS;AAAA;AAAA,EAGrC,oBAAoB,cAAE,OAAO,EAAE,SAAS;AAAA,EACxC,gBAAgB,oBAAoB,SAAS;AAAA,EAC7C,mBAAmB;AAAA;AAAA,EAGnB,sBAAsB,cAAE,QAAQ,oBAAoB;AAAA;AAAA,EAGpD,eAAe,cAAE,OAAO;AAAA;AAAA,EACxB,qBAAqB,cAAE,OAAO;AAAA;AAAA,EAG9B,YAAY,cAAE,OAAO,EAAE,SAAS;AACpC,CAAC;AAWM,IAAM,yBAAyB,cAAE,KAAK;AAAA,EACzC;AAAA;AAAA,EACA;AAAA;AAAA,EACA;AAAA;AACJ,CAAC;AAMM,IAAM,qBAAqB,cAAE,KAAK;AAAA,EACrC;AAAA;AAAA,EACA;AAAA;AAAA,EACA;AAAA;AAAA,EACA;AAAA;AAAA,EACA;AAAA;AAAA,EACA;AAAA;AAAA,EACA;AAAA;AAAA,EACA;AAAA;AAAA,EACA;AAAA;AACJ,CAAC;AAMM,IAAM,sBAAsB,cAAE,OAAO;AAAA,EACxC,aAAa,cAAE,OAAO;AAAA,EACtB,MAAM;AAAA;AAAA,EACN,cAAc,cAAE,OAAO;AAAA,EACvB,mBAAmB,cAAE,OAAO,EAAE,YAAY;AAAA,EAC1C,SAAS,cAAE,MAAM,cAAE,OAAO,CAAC;AAAA,EAC3B,mBAAmB;AACvB,CAAC;AAOM,IAAM,cAAc,cAAE,OAAO;AAAA,EAChC,IAAI,cAAE,OAAO;AAAA,EACb,MAAM,cAAE,OAAO;AAAA,EACf,MAAM,cAAE,OAAO;AAAA,EACf,SAAS,cAAE,OAAO;AAAA,EAClB,MAAM,cAAE,OAAO;AAAA,EACf,WAAW,cAAE,MAAM,mBAAmB;AAAA,EACtC,iBAAiB,cAAE,OAAO,EAAE,SAAS;AAAA,EACrC,cAAc,cAAE,OAAO,EAAE,YAAY;AAAA,EACrC,UAAU,cAAE,OAAO,EAAE,SAAS;AAAA;AAClC,CAAC;AAOM,IAAM,wBAAwB,cAAE,OAAO;AAAA,EAC1C,IAAI,cAAE,OAAO;AAAA,EACb,UAAU,cAAE,OAAO;AAAA,EACnB,aAAa,cAAE,OAAO;AAAA,EACtB,SAAS,cAAE,OAAO,EAAE,SAAS;AAAA,EAC7B,gBAAgB,cAAE,OAAO;AAAA,EACzB,cAAc,cAAE,OAAO,EAAE,SAAS;AAAA,EAClC,qBAAqB,cAAE,MAAM,cAAE,OAAO,CAAC;AAC3C,CAAC;AAWM,SAAS,SAAY,MAAS,SAAiB,KAAkB;AACpE,SAAO,EAAE,IAAI,MAAM,QAAQ,KAAK;AACpC;AAKO,SAAS,YACZ,MACA,SACA,QACA,SACW;AACX,SAAO;AAAA,IACH,IAAI;AAAA,IACJ,QAAQ,UAAU,kBAAkB,IAAI;AAAA,IACxC,OAAO;AAAA,MACH;AAAA,MACA;AAAA,MACA,GAAI,WAAW,EAAE,QAAQ;AAAA,IAC7B;AAAA,EACJ;AACJ;AAWO,IAAM,kBAAkB;AAAA;AAAA;AAAA;AAAA,EAI3B,mBAAmB;AAAA,IACf,GAAG;AAAA,IACH,UAAU;AAAA,MACN,YAAY;AAAA,MACZ,cAAc;AAAA,MACd,YAAY;AAAA,MACZ,UAAU;AAAA,MACV,kBAAkB;AAAA,MAClB,iBAAiB;AAAA,MACjB,oBAAoB;AAAA,MACpB,gBAAgB;AAAA,MAChB,mBAAmB;AAAA,IACvB;AAAA,IACA,qBAAqB;AAAA,EACzB;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EASA,8CAA8C;AAAA;AAAA;AAAA;AAAA,EAK9C,wBAAwB;AAAA,IACpB,MAAM;AAAA,IACN,YAAY;AAAA,IACZ,UAAU;AAAA,IACV,kBAAkB;AAAA,IAClB,iBAAiB;AAAA,IACjB,oBAAoB;AAAA,IACpB,gBAAgB;AAAA,IAChB,mBAAmB;AAAA,IACnB,sBAAsB;AAAA,IACtB,eAAe;AAAA,IACf,qBAAqB;AAAA,IACrB,YAAY;AAAA,EAChB;AACJ;AAKO,SAAS,sBAAsB,OAA8C;AAChF,SAAO,0BAA0B,UAAU,KAAK,EAAE;AACtD;AAKO,SAAS,yBAAyB,OAAiD;AACtF,SAAO,6BAA6B,UAAU,KAAK,EAAE;AACzD;;;AClbA,IAAAC,cAAkB;AAUX,IAAM,gBAAgB,IAAI,YAAY,EAAE,OAAO,WAAW;AAK1D,IAAM,iBAAiB,IAAI,YAAY,EAAE,OAAO,YAAY;AAuBnE,IAAM,oBACF;AAEJ,SAAS,WAAW,MAAuB;AACvC,SAAQ,OAAO,MAAM,KAAK,OAAO,QAAQ,KAAO,OAAO,QAAQ;AACnE;AAEA,SAAS,YAAY,MAAc,OAAuB;AACtD,QAAM,OAAO,CAAC,IAAI,WAAW,IAAI,IAAI,KAAK,IAAI,IAAI,IAAI,IAAI,IAAI,IAAI,IAAI,IAAI,IAAI,IAAI,EAAE;AACpF,SAAO,KAAK,QAAQ,CAAC,KAAK;AAC9B;AAEA,SAAS,uBAAuB,OAAuB;AACnD,QAAM,QAAQ,kBAAkB,KAAK,KAAK;AAC1C,MAAI,CAAC,OAAO;AACR,UAAM,IAAI;AAAA,MACN,mBAAmB,KAAK;AAAA,IAC5B;AAAA,EACJ;AAEA,QAAM,OAAO,OAAO,MAAM,CAAC,CAAC;AAC5B,QAAM,QAAQ,OAAO,MAAM,CAAC,CAAC;AAC7B,QAAM,MAAM,OAAO,MAAM,CAAC,CAAC;AAC3B,QAAM,OAAO,OAAO,MAAM,CAAC,CAAC;AAC5B,QAAM,SAAS,OAAO,MAAM,CAAC,CAAC;AAC9B,QAAM,SAAS,OAAO,MAAM,CAAC,CAAC;AAC9B,QAAM,WAAW,MAAM,CAAC,KAAK;AAC7B,QAAM,KAAK,MAAM,CAAC;AAElB,MAAI,QAAQ,KAAK,QAAQ,IAAI;AACzB,UAAM,IAAI,MAAM,mCAAmC;AAAA,EACvD;AACA,QAAM,SAAS,YAAY,MAAM,KAAK;AACtC,MAAI,MAAM,KAAK,MAAM,QAAQ;AACzB,UAAM,IAAI,MAAM,iCAAiC;AAAA,EACrD;AACA,MAAI,OAAO,IAAI;AACX,UAAM,IAAI,MAAM,kCAAkC;AAAA,EACtD;AACA,MAAI,SAAS,IAAI;AACb,UAAM,IAAI,MAAM,oCAAoC;AAAA,EACxD;AACA,MAAI,SAAS,IAAI;AACb,UAAM,IAAI,MAAM,oCAAoC;AAAA,EACxD;AAEA,QAAM,aAAa,SAAS,SAAS,QAAQ,WAAW,OAAO,MAAM,GAAG,CAAC,CAAC,IAAI;AAC9E,QAAM,QAAQ,KAAK,IAAI,MAAM,QAAQ,GAAG,KAAK,MAAM,QAAQ,QAAQ,UAAU;AAE7E,MAAI,WAAW;AACf,MAAI,OAAO,KAAK;AACZ,UAAM,OAAO,MAAM,EAAE,MAAM,MAAM,KAAK;AACtC,UAAM,aAAa,OAAO,MAAM,EAAE,CAAC;AACnC,UAAM,eAAe,OAAO,MAAM,EAAE,CAAC;AACrC,QAAI,aAAa,IAAI;AACjB,YAAM,IAAI,MAAM,qCAAqC;AAAA,IACzD;AACA,QAAI,eAAe,IAAI;AACnB,YAAM,IAAI,MAAM,uCAAuC;AAAA,IAC3D;AACA,eAAW,QAAQ,aAAa,KAAK,gBAAgB;AAAA,EACzD;AAEA,QAAM,KAAK,QAAQ;AACnB,MAAI,CAAC,OAAO,SAAS,EAAE,KAAK,KAAK,GAAG;AAChC,UAAM,IAAI,MAAM,iDAAiD;AAAA,EACrE;AAEA,SAAO;AACX;AAEO,SAAS,YAAY,OAAoC;AAC5D,MAAI;AAEJ,MAAI,OAAO,UAAU,UAAU;AAC3B,SAAK,uBAAuB,KAAK;AAAA,EACrC,OAAO;AACH,QAAI,CAAC,OAAO,UAAU,KAAK,KAAK,QAAQ,GAAG;AACvC,YAAM,IAAI,MAAM,kBAAkB,KAAK,iCAAiC;AAAA,IAC5E;AACA,SAAK;AAAA,EACT;AAEA,QAAM,MAAM,IAAI,YAAY,CAAC;AAC7B,QAAM,OAAO,IAAI,SAAS,GAAG;AAC7B,OAAK,aAAa,GAAG,OAAO,EAAE,GAAG,KAAK;AACtC,SAAO,IAAI,WAAW,GAAG;AAC7B;AAUO,IAAM,uBAAuB,cAAE,OAAO;AAAA;AAAA,EAEzC,QAAQ,cAAE,OAAO,EAAE,IAAI,CAAC,EAAE,IAAI,GAAG;AAAA;AAAA,EAEjC,cAAc,cAAE,OAAO,EAAE,IAAI;AAAA;AAAA,EAE7B,mBAAmB,cAAE,OAAO,EAAE,MAAM,kBAAkB,+BAA+B;AACzF,CAAC;AAiBM,IAAM,sBAAsB,cAAE,MAAM;AAAA,EACvC,cAAE,OAAO,EAAE,IAAI,EAAE,YAAY;AAAA,EAC7B,cAAE,OAAO,EAAE,SAAS,EAAE,QAAQ,KAAK,CAAC;AAAA;AACxC,CAAC;AAaM,IAAM,aAAa,cACrB,OAAO,EACP,OAAO,IAAI,gEAAgE,EAC3E,MAAM,oBAAoB,gCAAgC;AAoBxD,IAAM,2BAA2B,cAAE,OAAO;AAAA;AAAA,EAE7C,kBAAkB;AAAA;AAAA,EAElB,gBAAgB,cAAE,OAAO,EAAE,MAAM,kBAAkB,+BAA+B;AAAA;AAAA,EAElF,YAAY,cAAE,OAAO,EAAE,SAAS,EAAE,QAAQ,KAAK,CAAC;AAAA;AAAA,EAEhD,WAAW,cAAE,OAAO,EAAE,SAAS,EAAE,QAAQ,KAAK,CAAC;AAAA;AAAA,EAG/C,QAAQ,cAAE,OAAO,EAAE,YAAY,EAAE,SAAS;AAAA,EAC1C,UAAU,cAAE,OAAO,EAAE,OAAO,CAAC,EAAE,SAAS;AAAA,EACxC,YAAY,cAAE,OAAO,EAAE,SAAS;AAAA,EAChC,YAAY,cAAE,OAAO,EAAE,SAAS;AACpC,CAAC;AAYM,IAAM,+BAA+B,cACvC,OAAO,EACP,MAAM,kBAAkB,+BAA+B;AAYrD,IAAM,oBAAoB;AAAA;AAAA;AAAA;AAAA;AAAA,EAK7B,SAAS;AAAA,EACT,oBAAoB,IAAI,WAAW,CAAC,GAAM,GAAM,GAAM,KAAM,IAAM,KAAM,GAAM,CAAI,CAAC;AAAA;AAAA;AAAA;AAAA,EAKnF,YAAY;AAAA,IACR,QAAQ;AAAA,IACR,cAAc;AAAA,IACd,mBAAmB,IAAI,OAAO,EAAE;AAAA,EACpC;AAAA;AAAA;AAAA;AAAA,EAKA,iBAAiB;AAAA,IACb,kBAAkB;AAAA,MACd,QAAQ;AAAA,MACR,cAAc;AAAA,MACd,mBAAmB,IAAI,OAAO,EAAE;AAAA,IACpC;AAAA,IACA,gBAAgB,IAAI,OAAO,EAAE;AAAA,IAC7B,YAAY;AAAA,IACZ,WAAW;AAAA,EACf;AAAA;AAAA;AAAA;AAAA,EAKA,eAAe,IAAI,KAAK;AAC5B;AAgBO,SAAS,mBAAmB,SAAsC;AACrE,MAAI;AACJ,MAAI;AAEJ,MAAI;AACA,gBAAY,uBAAuB,QAAQ,UAAU;AACrD,eAAW,uBAAuB,QAAQ,SAAS;AAAA,EACvD,QAAQ;AACJ,UAAM,IAAI,MAAM,uEAAuE;AAAA,EAC3F;AAEA,MAAI,YAAY,WAAW;AACvB,UAAM,IAAI,MAAM,2CAA2C;AAAA,EAC/D;AAEA,QAAM,WAAW,WAAW;AAC5B,MAAI,WAAW,kBAAkB,eAAe;AAC5C,UAAM,IAAI;AAAA,MACN,eAAe,QAAQ,6BAA6B,kBAAkB,aAAa;AAAA,IACvF;AAAA,EACJ;AAEA,SAAO;AACX;;;AC3TA,IAAAC,eAAkB;AASX,IAAM,oBAAoB,eAC5B,KAAK,CAAC,UAAU,WAAW,aAAa,SAAS,CAAC,EAClD,GAAG,eAAE,OAAO,EAAE,IAAI,CAAC,CAAC;AAOlB,IAAM,kBAAkB,eAC1B,KAAK,CAAC,UAAU,UAAU,OAAO,UAAU,UAAU,WAAW,OAAO,CAAC,EACxE,GAAG,eAAE,OAAO,EAAE,IAAI,CAAC,CAAC;AAWlB,IAAM,sBAAsB,eAC9B,OAAO;AAAA,EACJ,IAAI,eAAE,OAAO,EAAE,IAAI,CAAC;AAAA,EACpB,aAAa,eAAE,OAAO,EAAE,IAAI,CAAC;AAAA,EAC7B,MAAM,eAAE,OAAO,EAAE,IAAI,CAAC;AAAA,EACtB,QAAQ;AAAA,EACR,YAAY;AAAA,EACZ,aAAa,eAAE,OAAO,EAAE,IAAI,EAAE,IAAI,CAAC,EAAE,IAAI,GAAI;AAAA,EAC7C,eAAe,eAAE,KAAK;AAAA,EACtB,eAAe,eAAE,KAAK;AAAA,EACtB,YAAY,eAAE,OAAO,EAAE,SAAS;AACpC,CAAC,EACA,YAAY;AAQV,IAAM,2BAA2B,eACnC,OAAO;AAAA,EACJ,QAAQ,eAAE,MAAM,mBAAmB;AAAA,EACnC,OAAO,eAAE,OAAO;AAAA,IACZ,QAAQ,eAAE,QAAQ,MAAM;AAAA,EAC5B,CAAC;AACL,CAAC,EACA,YAAY;AAgBV,IAAM,kCAAkC,eAC1C,OAAO;AAAA,EACJ,aAAa,eAAE,KAAK;AAAA,EACpB,UAAU,eAAE,OAAO,EAAE,IAAI,CAAC;AAAA,EAC1B,eAAe,eAAE,KAAK;AAAA,EACtB,eAAe,eAAE,KAAK;AAAA,EACtB,gBAAgB,eAAE,KAAK;AAAA,EACvB,gBAAgB,eAAE,KAAK;AAAA,EACvB,OAAO,eACF,OAAO;AAAA,IACJ,gBAAgB,eAAE,KAAK;AAAA,IACvB,gBAAgB,eAAE,KAAK;AAAA,IACvB,cAAc,eAAE,KAAK;AAAA,EACzB,CAAC,EACA,YAAY;AAAA,EACjB,OAAO,eACF,OAAO;AAAA,IACJ,cAAc,eAAE,OAAO,EAAE,WAAW,yBAAyB;AAAA,IAC7D,UAAU,eAAE,QAAQ,kBAAkB;AAAA,EAC1C,CAAC,EACA,YAAY;AAAA,EACjB,OAAO,eAAE,OAAO;AAAA,IACZ,QAAQ,eAAE,QAAQ,MAAM;AAAA,EAC5B,CAAC;AACL,CAAC,EACA,YAAY;;;ACxFjB,IAAAC,eAAkB;AAYX,IAAM,oBAAoB,CAAC,MAAM,OAAO,OAAO,IAAI;AAEnD,IAAM,uBAAuB,eAAE,KAAK,iBAAiB;AAY5D,IAAM,uBAAuB,sBAAsB;AAAA,EAC/C;AACJ;AAMA,IAAM,uBAAuB,sBAAsB;AAAA,EAC/C;AACJ;AASO,IAAM,8BAA8B,eAAE,OAAO;AAAA,EAChD,MAAM,eAAE,QAAQ,gBAAgB;AAAA,EAChC,YAAY,eAAE,QAAQ,IAAI;AAAA,EAC1B,eAAe,eAAE,QAAQ,CAAC;AAAA,EAC1B,aAAa,eAAE,QAAQ,CAAC;AAAA,EACxB,aAAa;AAAA,EACb,uBAAuB,eAAE,KAAK;AAAA;AAAA,EAE9B,mBAAmB,eAAE,OAAO,EAAE,IAAI,CAAC;AAAA,EACnC,SAAS,eAAE,OAAO,EAAE,IAAI,CAAC;AAAA,EACzB,YAAY,eAAE,OAAO,EAAE,IAAI,CAAC;AAAA,EAC5B,sBAAsB,eAAE,QAAQ,oBAAoB;AACxD,CAAC,EAAE,OAAO;AAQH,IAAM,oCAAoC,eAAE,OAAO;AAAA,EACtD,MAAM,eAAE,QAAQ,sBAAsB;AAAA,EACtC,YAAY,eAAE,QAAQ,KAAK;AAAA,EAC3B,eAAe,eAAE,QAAQ,CAAC;AAAA,EAC1B,aAAa,eAAE,QAAQ,CAAC;AAAA,EACxB,aAAa;AAAA,EACb,uBAAuB;AAAA,EACvB,yBAAyB;AAAA;AAAA,EAEzB,sBAAsB;AAAA,EACtB,sBAAsB,eAAE,MAAM,eAAE,OAAO,EAAE,IAAI,CAAC,CAAC,EAAE,IAAI,CAAC;AAAA,EACtD,qBAAqB,eAAE,OAAO,EAAE,IAAI,CAAC;AAAA;AAAA,EAErC,sBAAsB,eAAE,QAAQ,oBAAoB;AACxD,CAAC,EAAE,OAAO;AAQH,IAAM,iCAAiC,eAAE,OAAO;AAAA,EACnD,MAAM,eAAE,QAAQ,mBAAmB;AAAA,EACnC,YAAY,eAAE,QAAQ,KAAK;AAAA,EAC3B,eAAe,eAAE,QAAQ,CAAC;AAAA,EAC1B,aAAa,eAAE,QAAQ,CAAC;AAAA,EACxB,aAAa;AAAA,EACb,uBAAuB;AAAA,EACvB,yBAAyB;AAAA;AAAA,EAEzB,WAAW,eAAE,OAAO,EAAE,IAAI,CAAC;AAAA,EAC3B,SAAS,eAAE,OAAO,EAAE,IAAI,CAAC,EAAE,SAAS;AAAA,EACpC,cAAc,eAAE,OAAO,EAAE,IAAI,EAAE,YAAY;AAAA,EAC3C,UAAU,eAAE,QAAQ,KAAK;AAAA,EACzB,sBAAsB,eAAE,QAAQ,oBAAoB;AACxD,CAAC,EAAE,OAAO;AAQH,IAAM,gCAAgC,eAAE,OAAO;AAAA,EAClD,MAAM,eAAE,QAAQ,kBAAkB;AAAA,EAClC,YAAY,eAAE,QAAQ,IAAI;AAAA,EAC1B,eAAe,eAAE,QAAQ,CAAC;AAAA,EAC1B,aAAa,eAAE,QAAQ,CAAC;AAAA,EACxB,aAAa;AAAA,EACb,uBAAuB;AAAA,EACvB,yBAAyB;AAAA;AAAA,EAEzB,yBAAyB;AAAA,EACzB,aAAa,eAAE,OAAO,EAAE,SAAS;AAAA,EACjC,oBAAoB,eAAE,OAAO,EAAE,IAAI,EAAE,YAAY;AAAA,EACjD,sBAAsB,eAAE,QAAQ,oBAAoB;AACxD,CAAC,EAAE,OAAO;AAQH,IAAM,6BAA6B,eAAE,mBAAmB,QAAQ;AAAA,EACnE;AAAA,EACA;AAAA,EACA;AAAA,EACA;AACJ,CAAC;AAYM,SAAS,qBACZ,sBACA,oBACA,WACI;AACJ,MAAI,yBAAyB,oBAAoB;AAC7C,UAAM,IAAI;AAAA,MACN,wBAAwB,SAAS,oCACC,oBAAoB,SAC/C,kBAAkB;AAAA,IAC7B;AAAA,EACJ;AACJ;AAMO,SAAS,eACZ,gBACA,kBACA,WACI;AACJ,MAAI,mBAAmB,kBAAkB;AACrC,UAAM,IAAI;AAAA,MACN,0BAA0B,SAAS,sCACC,gBAAgB,SAC7C,cAAc;AAAA,IACzB;AAAA,EACJ;AACJ;;;ACvLA,IAAAC,eAAkB;AAWX,IAAM,eAAe;AAKrB,IAAM,gBAAgB;AAAA,EACzB,MAAM;AAAA,EACN,MAAM;AACV;AAWO,IAAM,kCAAkC,eAAE,OAAO,EAAE;AAAA,EACtD;AAAA,EACA;AACJ;AAUO,IAAM,0BAA0B,eAAE,OAAO;AAAA;AAAA,EAE5C,MAAM;AAAA;AAAA,EAEN,OAAO,eAAE,MAAM,qBAAqB;AAAA;AAAA,EAEpC,OAAO,eAAE,OAAO,EAAE,IAAI,EAAE,YAAY;AACxC,CAAC;AA4BM,IAAM,0BAA0B,eAAE,OAAO;AAAA;AAAA;AAAA,EAG5C,OAAO;AAAA;AAAA,EAEP,cAAc;AAAA;AAAA,EAEd,WAAW,eAAE,OAAO,EAAE,IAAI,CAAC;AAAA;AAAA,EAE3B,WAAW,eAAE,OAAO,EAAE,SAAS;AAAA;AAAA,EAE/B,WAAW,eAAE,OAAO,EAAE,IAAI,CAAC;AAAA;AAAA,EAE3B,eAAe,eAAE,OAAO,EAAE,IAAI,CAAC;AAAA;AAAA;AAAA,EAI/B,cAAc,eAAE,OAAO,EAAE,SAAS;AAAA;AAAA,EAElC,iBAAiB,eAAE,OAAO,EAAE,IAAI,EAAE,YAAY,EAAE,SAAS;AAAA;AAAA,EAEzD,sBAAsB,eAAE,OAAO,EAAE,SAAS;AAAA;AAAA,EAE1C,yBAAyB,eAAE,OAAO,EAAE,IAAI,EAAE,SAAS,EAAE,SAAS;AAAA;AAAA,EAE9D,YAAY,eAAE,OAAO,EAAE,SAAS,EAAE,SAAS;AAAA;AAAA,EAE3C,eAAe,wBAAwB,SAAS;AACpD,CAAC;AAiBM,IAAM,sBAAsB,eAAE,OAAO;AAAA;AAAA,EAExC,cAAc;AAAA;AAAA,EAEd,sBAAsB,eAAE,QAAQ,oBAAoB;AAAA;AAAA,EAEpD,aAAa,eAAE,OAAO,EAAE,IAAI,CAAC;AAAA;AAAA,EAE7B,cAAc,eAAE,OAAO,EAAE,IAAI,CAAC;AAAA;AAAA,EAE9B,iBAAiB,eAAE,OAAO,EAAE,IAAI,EAAE,YAAY;AAAA;AAAA,EAE9C,WAAW,eAAE,OAAO,EAAE,SAAS;AAAA;AAAA,EAE/B,yBAAyB,eAAE,OAAO,EAAE,IAAI,EAAE,SAAS,EAAE,SAAS;AAClE,CAAC;AAWM,IAAM,uBAAuB,eAAE,KAAK;AAAA,EACvC;AAAA;AAAA,EACA;AAAA;AAAA,EACA;AAAA;AAAA,EACA;AAAA;AACJ,CAAC;AAOM,IAAM,yBAAyB,eAAE,OAAO;AAAA;AAAA,EAE3C,QAAQ;AAAA;AAAA,EAER,cAAc;AAAA;AAAA,EAEd,SAAS,sBAAsB,SAAS;AAAA;AAAA,EAExC,IAAI,wBAAwB,SAAS;AAAA;AAAA,EAErC,QAAQ,eAAE,OAAO,EAAE,IAAI,CAAC,EAAE,SAAS;AAAA;AAAA,EAEnC,mBAAmB,eAAE,OAAO,EAAE,SAAS;AAAA;AAAA,EAEvC,WAAW,eAAE,OAAO,EAAE,SAAS;AAAA;AAAA,EAE/B,OAAO,eAAE,OAAO,EAAE,SAAS;AAC/B,CAAC;AAWM,SAAS,oBAAoB,OAA4C;AAC5E,SAAO,wBAAwB,UAAU,KAAK,EAAE;AACpD;AAKO,SAAS,gBAAgB,OAAwC;AACpE,SAAO,oBAAoB,UAAU,KAAK,EAAE;AAChD;AAUO,IAAM,oBAAoB,eAAE,OAAO;AAAA;AAAA,EAEtC,MAAM,eAAE,KAAK,CAAC,MAAM,OAAO,OAAO,MAAM,mBAAmB,IAAI,CAAC;AAAA;AAAA,EAEhE,MAAM;AAAA;AAAA,EAEN,QAAQ,eAAE,OAAO,EAAE,IAAI,CAAC;AAAA;AAAA,EAExB,SAAS,eAAE,OAAO,EAAE,IAAI,CAAC;AAAA;AAAA,EAEzB,KAAK,eAAE,OAAO,EAAE,IAAI,EAAE,SAAS;AACnC,CAAC;AAcM,IAAM,2BAA2B;AAAA;AAAA,EAEpC,mBAAmB;AAAA,IACf,OAAO;AAAA,IACP,cAAc;AAAA,IACd,WAAW;AAAA,IACX,WAAW;AAAA,IACX,WAAW;AAAA,IACX,eAAe;AAAA,IACf,cAAc;AAAA,IACd,iBAAiB;AAAA,IACjB,sBAAsB;AAAA,EAC1B;AAAA;AAAA,EAGA,eAAe;AAAA,IACX,cAAc;AAAA,IACd,sBAAsB;AAAA,IACtB,aAAa;AAAA,IACb,cAAc;AAAA,IACd,iBAAiB;AAAA,IACjB,WAAW;AAAA,EACf;AAAA;AAAA,EAGA,sBAAsB;AAAA,IAClB,QAAQ;AAAA,IACR,cAAc;AAAA,IACd,SAAS;AAAA,IACT,QAAQ;AAAA,IACR,mBAAmB;AAAA,IACnB,WAAW;AAAA,EACf;AACJ;;;AChRA,IAAAC,eAAkB;AASlB,IAAM,aAAa;AASnB,IAAM,4BAA4B,eAAE,MAAM;AAAA,EACtC;AAAA,EACA,eAAE,QAAQ,MAAM;AACpB,CAAC;AAEM,IAAM,2BAA2B,eAAE,OAAO;AAAA,EAC7C,YAAY,eAAE,OAAO,EAAE,IAAI,EAAE,YAAY;AAAA,EACzC,OAAO;AAAA,EACP,YAAY;AAAA,EACZ,aAAa,sBAAsB,SAAS;AAAA,EAC5C,SAAS,eAAE,KAAK,CAAC,QAAQ,QAAQ,MAAM,CAAC;AAAA,EACxC,OAAO,eAAE,OAAO,EAAE,SAAS;AAAA,EAC3B,YAAY,eAAE,OAAO,EAAE,IAAI,EAAE,YAAY;AAC7C,CAAC,EAAE,OAAO;AAOH,IAAM,yBAAyB,eAAE,OAAO;AAAA,EAC3C,WAAW,eAAE,OAAO,EAAE,IAAI,CAAC;AAAA,EAC3B,SAAS,eAAE,KAAK,CAAC,QAAQ,MAAM,CAAC;AAAA,EAChC,YAAY,eAAE,OAAO,EAAE,IAAI,CAAC,EAAE,IAAI,CAAC;AAAA,EACnC,SAAS,eAAE,OAAO,EAAE,SAAS;AACjC,CAAC,EAAE,OAAO;AAOH,IAAM,oBAAoB,eAAE,OAAO;AAAA,EACtC,YAAY,eAAE,OAAO,EAAE,IAAI,EAAE,YAAY;AAAA,EACzC,WAAW,eAAE,OAAO,EAAE,IAAI,CAAC;AAAA,EAC3B,MAAM,eAAE,OAAO,EAAE,IAAI,CAAC;AAAA,EACtB,SAAS,eAAE,OAAO,EAAE,SAAS;AACjC,CAAC,EAAE,OAAO;AAgBH,IAAM,qBAAqB,eAAE,OAAO;AAAA,EACvC,gBAAgB,eAAE,QAAQ,CAAC;AAAA;AAAA,EAG3B,UAAU,eAAE,OAAO,EAAE,MAAM,YAAY,sBAAsB;AAAA,EAC7D,MAAM,eAAE,OAAO,EAAE,SAAS;AAAA,EAC1B,OAAO,eAAE,OAAO,EAAE,IAAI,CAAC;AAAA,EACvB,aAAa,eAAE,KAAK,CAAC,SAAS,MAAM,WAAW,YAAY,CAAC;AAAA,EAC5D,YAAY,eAAE,OAAO,EAAE,SAAS;AAAA,EAChC,cAAc,eAAE,OAAO,EAAE,SAAS,EAAE,SAAS;AAAA,EAC7C,aAAa,eAAE,OAAO,EAAE,IAAI,EAAE,YAAY,EAAE,SAAS;AAAA;AAAA,EAGrD,YAAY,eAAE,MAAM,wBAAwB;AAAA;AAAA,EAG5C,gBAAgB,eAAE,MAAM,sBAAsB;AAAA;AAAA,EAG9C,UAAU,eAAE,MAAM,iBAAiB;AAAA;AAAA,EAGnC,WAAW,eAAE,OAAO,EAAE,IAAI,CAAC,EAAE,IAAI,CAAC;AAAA,EAClC,uBAAuB,eAAE,OAAO,EAAE,IAAI,CAAC,EAAE,IAAI,CAAC;AAAA,EAC9C,GAAG,eAAE,OAAO,EAAE,IAAI,EAAE,SAAS;AACjC,CAAC,EAAE,OAAO;AAQV,IAAM,aAAa;AAMZ,IAAM,uBAAuB;AAAA;AAAA;AAAA;AAAA,EAIhC,iBAAiB;AAAA,IACb,gBAAgB;AAAA,IAChB,UAAU;AAAA,IACV,MAAM;AAAA,IACN,OAAO;AAAA,IACP,aAAa;AAAA,IACb,YAAY;AAAA,IACZ,cAAc;AAAA,IACd,aAAa;AAAA,IACb,YAAY;AAAA,MACR,EAAE,YAAY,GAAG,OAAO,MAAe,YAAY,YAAY,aAAa,YAAY,SAAS,QAAiB,OAAO,MAAM,YAAY,EAAE;AAAA,MAC7I,EAAE,YAAY,GAAG,OAAO,OAAgB,YAAY,YAAY,aAAa,YAAY,SAAS,QAAiB,OAAO,MAAM,YAAY,EAAE;AAAA,MAC9I,EAAE,YAAY,GAAG,OAAO,OAAgB,YAAY,YAAY,aAAa,YAAY,SAAS,QAAiB,OAAO,MAAM,YAAY,EAAE;AAAA,MAC9I,EAAE,YAAY,GAAG,OAAO,MAAe,YAAY,YAAY,aAAa,YAAY,SAAS,QAAiB,OAAO,MAAM,YAAY,GAAG;AAAA,IAClJ;AAAA,IACA,gBAAgB;AAAA,MACZ,EAAE,WAAW,aAAa,SAAS,QAAiB,YAAY,GAAK,SAAS,KAAK;AAAA,MACnF,EAAE,WAAW,cAAc,SAAS,QAAiB,YAAY,GAAK,SAAS,KAAK;AAAA,MACpF,EAAE,WAAW,cAAc,SAAS,QAAiB,YAAY,GAAK,SAAS,KAAK;AAAA,MACpF,EAAE,WAAW,aAAa,SAAS,QAAiB,YAAY,GAAK,SAAS,KAAK;AAAA,IACvF;AAAA,IACA,UAAU,CAAC;AAAA,IACX,WAAW;AAAA,IACX,uBAAuB;AAAA,IACvB,GAAG;AAAA,EACP;AAAA;AAAA;AAAA;AAAA,EAKA,aAAa;AAAA,IACT,gBAAgB;AAAA,IAChB,UAAU;AAAA,IACV,MAAM;AAAA,IACN,OAAO;AAAA,IACP,aAAa;AAAA,IACb,YAAY;AAAA,IACZ,cAAc;AAAA,IACd,aAAa;AAAA,IACb,YAAY;AAAA,MACR,EAAE,YAAY,GAAG,OAAO,MAAe,YAAY,YAAY,aAAa,YAAY,SAAS,QAAiB,OAAO,MAAM,YAAY,EAAE;AAAA,MAC7I,EAAE,YAAY,GAAG,OAAO,OAAgB,YAAY,YAAY,aAAa,MAAM,SAAS,QAAiB,OAAO,oBAAoB,YAAY,EAAE;AAAA,MACtJ,EAAE,YAAY,GAAG,OAAO,OAAgB,YAAY,YAAY,aAAa,MAAM,SAAS,QAAiB,OAAO,MAAM,YAAY,EAAE;AAAA,MACxI,EAAE,YAAY,GAAG,OAAO,MAAe,YAAY,YAAY,aAAa,MAAM,SAAS,QAAiB,OAAO,MAAM,YAAY,EAAE;AAAA,IAC3I;AAAA,IACA,gBAAgB;AAAA,MACZ,EAAE,WAAW,aAAa,SAAS,QAAiB,YAAY,GAAK,SAAS,KAAK;AAAA,MACnF,EAAE,WAAW,cAAc,SAAS,QAAiB,YAAY,GAAK,SAAS,8CAA8C;AAAA,MAC7H,EAAE,WAAW,cAAc,SAAS,QAAiB,YAAY,GAAK,SAAS,sBAAsB;AAAA,MACrG,EAAE,WAAW,aAAa,SAAS,QAAiB,YAAY,GAAK,SAAS,4BAA4B;AAAA,IAC9G;AAAA,IACA,UAAU;AAAA,MACN,EAAE,YAAY,GAAG,WAAW,cAAc,MAAM,oBAAoB,SAAS,8CAA8C;AAAA,IAC/H;AAAA,IACA,WAAW;AAAA,IACX,uBAAuB;AAAA,IACvB,GAAG;AAAA,EACP;AAAA;AAAA;AAAA;AAAA,EAKA,eAAe;AAAA,IACX,gBAAgB;AAAA,IAChB,UAAU;AAAA,IACV,MAAM;AAAA,IACN,OAAO;AAAA,IACP,aAAa;AAAA,IACb,YAAY;AAAA,IACZ,cAAc;AAAA,IACd,aAAa;AAAA,IACb,YAAY;AAAA,MACR,EAAE,YAAY,GAAG,OAAO,MAAe,YAAY,YAAY,aAAa,YAAY,SAAS,QAAiB,OAAO,MAAM,YAAY,EAAE;AAAA,IACjJ;AAAA,IACA,gBAAgB;AAAA,MACZ,EAAE,WAAW,aAAa,SAAS,QAAiB,YAAY,GAAK,SAAS,KAAK;AAAA,IACvF;AAAA,IACA,UAAU,CAAC;AAAA,IACX,WAAW;AAAA,IACX,uBAAuB;AAAA,IACvB,GAAG;AAAA,EACP;AACJ;;;AC/LA,IAAAC,eAAkB;AAOlB,IAAMC,cAAa;AACnB,IAAM,aAAa,eAAE,OAAO,EAAE,MAAMA,aAAY,sBAAsB;AACtE,IAAM,mBAAmB,eAAE,OAAO,EAAE,IAAI,CAAC;AAEzC,IAAM,oBAAoB,eAAE,KAAK,CAAC,MAAM,IAAI,CAAC;AAC7C,IAAM,uBAAuB,eAAE,KAAK,CAAC,WAAW,SAAS,CAAC;AAC1D,IAAM,qBAAqB,eAAE,KAAK,CAAC,WAAW,YAAY,QAAQ,CAAC;AAM5D,IAAM,iCAAiC,eAAE,OAAO;AAAA,EACnD,iBAAiB;AAAA,EACjB,MAAM,eAAE,OAAO,EAAE,SAAS,EAAE,SAAS;AAAA,EACrC,cAAc,kBAAkB,QAAQ,IAAI;AAAA,EAC5C,MAAM,qBAAqB,QAAQ,SAAS;AAAA,EAC5C,MAAM,eAAE,OAAO;AAAA,IACX,WAAW,eAAE,OAAO,EAAE,IAAI,CAAC;AAAA,IAC3B,KAAK,eAAE,OAAO,EAAE,IAAI,CAAC;AAAA,IACrB,QAAQ,eAAE,OAAO,EAAE,IAAI,CAAC;AAAA,IACxB,UAAU,eAAE,QAAQ,KAAK;AAAA,IACzB,UAAU,eAAE,OAAO,eAAE,QAAQ,CAAC,EAAE,SAAS;AAAA,EAC7C,CAAC;AACL,CAAC,EAAE,OAAO;AAQV,IAAM,uBAAuB,eAAE,OAAO;AAAA,EAClC,IAAI,eAAE,OAAO,eAAE,QAAQ,CAAC,EAAE,SAAS;AAAA,EACnC,KAAK,eAAE,OAAO,eAAE,QAAQ,CAAC,EAAE,SAAS;AAAA,EACpC,KAAK,eAAE,OAAO,eAAE,QAAQ,CAAC,EAAE,SAAS;AAAA,EACpC,IAAI,eAAE,OAAO,eAAE,QAAQ,CAAC,EAAE,SAAS;AACvC,CAAC;AAED,IAAM,oBAAoB,eAAE,OAAO;AAAA,EAC/B,SAAS,sBAAsB,SAAS;AAAA,EACxC,UAAU,sBAAsB,SAAS;AAAA,EACzC,UAAU,sBAAsB,SAAS;AAAA,EACzC,SAAS,sBAAsB,SAAS;AAC5C,CAAC;AAED,IAAM,0BAA0B,eAAE,OAAO;AAAA,EACrC,KAAK,eAAE,QAAQ,SAAS;AAAA,EACxB,KAAK,eAAE,OAAO,EAAE,IAAI,CAAC;AAAA,EACrB,KAAK,eAAE,OAAO,EAAE,IAAI,CAAC;AACzB,CAAC;AAED,IAAM,oBAAoB,eAAE,OAAO;AAAA,EAC/B,QAAQ;AAAA,EACR,YAAY,eAAE,OAAO;AAAA,IACjB,cAAc;AAAA,IACd,KAAK,eAAE,OAAO,EAAE,IAAI,CAAC;AAAA,IACrB,KAAK,eAAE,OAAO,EAAE,IAAI,CAAC;AAAA,EACzB,CAAC,EAAE,SAAS;AAAA,EACZ,cAAc,eAAE,OAAO;AAAA,IACnB,cAAc;AAAA,IACd,KAAK,eAAE,OAAO,EAAE,IAAI,CAAC;AAAA,IACrB,KAAK,eAAE,OAAO,EAAE,IAAI,CAAC;AAAA,EACzB,CAAC,EAAE,SAAS;AAChB,CAAC;AAED,IAAM,oBAAoB,eAAE,OAAO;AAAA,EAC/B,YAAY,eAAE,OAAO,EAAE,SAAS;AAAA,EAChC,cAAc,eAAE,OAAO,EAAE,SAAS,EAAE,SAAS;AAAA,EAC7C,aAAa,eAAE,OAAO,EAAE,IAAI,EAAE,YAAY,EAAE,SAAS;AACzD,CAAC;AAMM,IAAM,iCAAiC,eAAE,OAAO;AAAA,EACnD,gBAAgB,eAAE,QAAQ,CAAC;AAAA,EAC3B,SAAS;AAAA,EACT,UAAU,eAAE,OAAO,EAAE,IAAI,CAAC;AAAA,EAC1B,MAAM,eAAE,OAAO,EAAE,SAAS;AAAA,EAC1B,cAAc;AAAA,EAEd,WAAW,qBAAqB,OAAO;AAAA,IACnC,IAAI,eAAE,OAAO,eAAE,QAAQ,CAAC;AAAA,IACxB,KAAK,eAAE,OAAO,eAAE,QAAQ,CAAC;AAAA,IACzB,KAAK,eAAE,OAAO,eAAE,QAAQ,CAAC;AAAA,IACzB,IAAI,eAAE,OAAO,eAAE,QAAQ,CAAC;AAAA,EAC5B,CAAC;AAAA,EAED,QAAQ,kBAAkB,OAAO;AAAA,IAC7B,SAAS;AAAA,IACT,UAAU;AAAA,IACV,UAAU;AAAA,IACV,SAAS;AAAA,EACb,CAAC;AAAA,EAED,YAAY,eAAE,OAAO;AAAA,IACjB,YAAY,eAAE,OAAO;AAAA,MACjB,QAAQ;AAAA,MACR,SAAS;AAAA,MACT,QAAQ;AAAA,IACZ,CAAC;AAAA,IACD,QAAQ;AAAA,EACZ,CAAC;AAAA,EAED,SAAS,eAAE,OAAO;AAAA;AAAA,IAEd,YAAY,eAAE,OAAO,EAAE,MAAM,UAAU,8CAA8C;AAAA,IACrF,QAAQ,eAAE,KAAK,CAAC,UAAU,SAAS,CAAC;AAAA,IACpC,cAAc;AAAA,EAClB,CAAC;AAAA,EAED,KAAK,eAAE,OAAO;AAAA,IACV,QAAQ;AAAA,IACR,kBAAkB;AAAA,IAClB,qBAAqB;AAAA,IACrB,WAAW,eAAE,OAAO,EAAE,SAAS;AAAA,EACnC,CAAC;AAAA,EAED,QAAQ,kBAAkB,OAAO;AAAA,IAC7B,cAAc,eAAE,OAAO,EAAE,SAAS;AAAA,IAClC,aAAa,eAAE,OAAO,EAAE,IAAI,EAAE,YAAY;AAAA,EAC9C,CAAC;AACL,CAAC;AAQD,IAAM,4BAA4B,eAAE,KAAK;AAAA,EACrC;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AACJ,CAAC;AAEM,IAAM,+BAA+B,eAAE,OAAO;AAAA,EACjD,gBAAgB,eAAE,QAAQ,CAAC;AAAA,EAC3B,SAAS;AAAA,EACT,UAAU,eAAE,OAAO,EAAE,IAAI,CAAC;AAAA,EAC1B,MAAM,eAAE,OAAO,EAAE,SAAS;AAAA,EAC1B,cAAc;AAAA,EAEd,OAAO,eAAE,OAAO;AAAA,IACZ,MAAM;AAAA,IACN,SAAS,eAAE,OAAO;AAAA,IAClB,SAAS,eAAE,OAAO,eAAE,QAAQ,CAAC,EAAE,SAAS;AAAA,EAC5C,CAAC;AAAA,EAED,SAAS,eAAE,OAAO;AAAA,IACd,WAAW;AAAA,IACX,QAAQ;AAAA,EACZ,CAAC;AAAA,EAED,QAAQ;AACZ,CAAC;AAqBM,IAAM,kCAAkC,eAAE,MAAM;AAAA,EACnD;AAAA,EACA;AACJ,CAAC;AAQM,SAAS,2BACZ,UACoC;AACpC,SAAO,eAAe,YAAY,EAAE,WAAW;AACnD;AAEO,SAAS,yBACZ,UACkC;AAClC,SAAO,WAAW;AACtB;;;ACrNA,IAAAC,eAAkB;AAOX,IAAM,eAAe;AACrB,IAAM,cAAc;AACpB,IAAM,uBAAuB;AAC7B,IAAM,0BAA0B;AAMhC,IAAM,2BAA2B;AAAA,EACpC;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AACJ;AAOO,IAAM,sBAAsB;AAM5B,IAAM,iCAAiC,eAAE,OAAO;AAAA,EACnD,SAAS,eAAE,QAAQ,YAAY;AAAA,EAC/B,SAAS,eAAE,QAAQ,WAAW;AAAA,EAC9B,YAAY,eAAE,OAAO,EAAE;AAAA,IACnB;AAAA,IACA;AAAA,EACJ;AAAA,EACA,aAAa,eAAE,OAAO,EAAE,IAAI,CAAC;AAAA,EAC7B,aAAa,eAAE,OAAO,EAAE,MAAM,qBAAqB,kDAAkD;AAAA,EACrG,gBAAgB,eAAE,OAAO,EAAE,IAAI,CAAC;AAAA,EAChC,SAAS,eAAE,OAAO,eAAE,QAAQ,CAAC,EAAE,SAAS;AAAA,EACxC,iBAAiB,sBAAsB,SAAS;AAAA,EAChD,WAAW,eAAE,OAAO,EAAE,IAAI,CAAC;AAAA,EAC3B,aAAa,eAAE,OAAO,EAAE,SAAS;AAAA,EACjC,uBAAuB,eAAE,OAAO,EAAE,IAAI,CAAC;AAAA,EACvC,qBAAqB,eAAE,QAAQ,uBAAuB;AAAA,EACtD,WAAW;AACf,CAAC,EAAE,OAAO;;;ACjEV,IAAAC,eAAkB;AAIX,IAAM,kCAAkC;AACxC,IAAM,iCAAiC;AAEvC,IAAM,6BAA6B,eAAE,KAAK;AAAA,EAC7C;AAAA,EACA;AAAA,EACA;AAAA,EACA;AACJ,CAAC;AAIM,IAAM,oCAAoC,eAAE,OAAO;AAAA,EACtD,YAAY,eAAE,OAAO,EAAE,IAAI,CAAC,EAAE,SAAS;AAAA,EACvC,YAAY,eAAE,OAAO,EAAE,IAAI,CAAC,EAAE,SAAS;AAAA,EACvC,aAAa,eAAE,OAAO,EAAE,IAAI,CAAC,EAAE,SAAS;AAAA,EACxC,gBAAgB,eAAE,OAAO,EAAE,IAAI,CAAC,EAAE,SAAS;AAC/C,CAAC,EAAE,OAAO;AAEH,IAAM,kCAAkC,eAAE,OAAO;AAAA,EACpD,aAAa,eAAE,OAAO,EAAE,IAAI,CAAC,EAAE,SAAS;AAAA,EACxC,iBAAiB,sBAAsB,SAAS;AAAA,EAChD,aAAa,eAAE,OAAO,EAAE,IAAI,CAAC,EAAE,SAAS;AAC5C,CAAC,EAAE,OAAO;AAEH,IAAM,uCAAuC,eAAE,OAAO;AAAA,EACzD,cAAc,eAAE,OAAO,eAAE,QAAQ,CAAC,EAAE,SAAS;AAAA,EAC7C,YAAY,eAAE,OAAO,EAAE,SAAS,EAAE,SAAS;AAAA,EAC3C,cAAc,eAAE,OAAO,EAAE,IAAI,CAAC,EAAE,SAAS;AAC7C,CAAC,EAAE,OAAO;AAEH,IAAM,sCAAsC,eAAE,OAAO;AAAA,EACxD,SAAS;AAAA,EACT,kBAAkB;AAAA,EAClB,OAAO;AAAA,EACP,YAAY,qCAAqC,SAAS;AAAA,EAC1D,iBAAiB,eAAE,OAAO,eAAE,QAAQ,CAAC,EAAE,SAAS;AACpD,CAAC,EAAE,OAAO;AAIH,IAAM,kCAAkC,eAAE,OAAO;AAAA,EACpD,WAAW,eAAE,OAAO,EAAE,IAAI,CAAC,EAAE,SAAS;AAAA,EACtC,YAAY;AAAA,EACZ,MAAM,eAAE,QAAQ,+BAA+B;AAAA,EAC/C,SAAS,eAAE,QAAQ,8BAA8B;AACrD,CAAC,EAAE,OAAO;AAEH,IAAM,+BAA+B,eAAE,OAAO;AAAA,EACjD,SAAS,eAAE,QAAQ,+BAA+B;AAAA,EAClD,SAAS,eAAE,QAAQ,8BAA8B;AAAA,EACjD,WAAW,eAAE,OAAO,EAAE,IAAI,CAAC;AAAA,EAC3B,YAAY;AAAA,EACZ,SAAS;AAAA,EACT,kBAAkB;AAAA,EAClB,OAAO;AAAA,EACP,YAAY,qCAAqC,SAAS;AAAA,EAC1D,wBAAwB,eAAE,OAAO,EAAE,IAAI,CAAC,EAAE,SAAS;AAAA,EACnD,iBAAiB,eAAE,OAAO,eAAE,QAAQ,CAAC,EAAE,SAAS;AACpD,CAAC,EAAE,OAAO;AAKV,IAAIC,gBAA0D;AAE9D,SAASC,cAA+C;AACpD,MAAID,cAAc,QAAOA;AAEzB,QAAM,YAAY,OAAO,QAAQ,qBAAqB,aAC/C,QAAQ,iBAAiB,QAAQ,IAClC,QAAQ,QAAa;AAC3B,QAAM,gBAAgB,UAAU;AAChC,QAAM,cAAc,OAAO,eAAe,WACpC,aACA,GAAG,QAAQ,IAAI,CAAC;AACtB,QAAM,WAAW,cAAc,WAAW;AAE1C,MAAI;AACJ,MAAI;AACA,aAAS,SAAS,uBAAuB,EAAE;AAAA,EAC/C,QAAQ;AACJ,QAAI;AACA,eAAS,SAAS,oBAAoB,EAAE;AAAA,IAC5C,QAAQ;AACJ,YAAM,IAAI;AAAA,QACN;AAAA,MAEJ;AAAA,IACJ;AAAA,EACJ;AACA,EAAAA,gBAAe;AACf,SAAO;AACX;AAEO,SAAS,gCACZ,OAI6B;AAC7B,SAAO;AAAA,IACH,SAAS,MAAM;AAAA,IACf,kBAAkB,MAAM;AAAA,IACxB,OAAO,MAAM;AAAA,IACb,GAAI,MAAM,eAAe,SAAY,EAAE,YAAY,MAAM,WAAW,IAAI,CAAC;AAAA,IACzE,GAAI,MAAM,oBAAoB,SAAY,EAAE,iBAAiB,MAAM,gBAAgB,IAAI,CAAC;AAAA,EAC5F;AACJ;AAEO,SAAS,gCAAgC,OAA8C;AAC1F,QAAM,SAASC,YAAW;AAC1B,QAAM,YAAY,gBAAgB,KAAK;AACvC,QAAM,SAAS,OAAO,IAAI,YAAY,EAAE,OAAO,SAAS,CAAC;AACzD,SAAO,iBAAiB,MAAM;AAClC;;;ACvHA,IAAAC,eAAkB;AAQX,IAAM,kBAAkB;AACxB,IAAM,iBAAiB;AACvB,IAAM,0BAA0B;AAChC,IAAM,6BAA6B;AAEnC,IAAM,iCAAiC,eAAE,OAAO;AAAA,EACnD,SAAS,eAAE,QAAQ,eAAe;AAAA,EAClC,SAAS,eAAE,QAAQ,cAAc;AAAA,EACjC,YAAY,eAAE,OAAO,EAAE;AAAA,IACnB;AAAA,IACA;AAAA,EACJ;AAAA,EACA,aAAa,eAAE,OAAO,EAAE,IAAI,CAAC;AAAA,EAC7B,aAAa,eAAE,OAAO,EAAE,MAAM,qBAAqB,kDAAkD;AAAA,EACrG,gBAAgB,eAAE,OAAO,EAAE,IAAI,CAAC;AAAA,EAChC,SAAS,eAAE,OAAO,eAAE,QAAQ,CAAC,EAAE,SAAS;AAAA,EACxC,iBAAiB,sBAAsB,SAAS;AAAA,EAChD,WAAW,eAAE,OAAO,EAAE,IAAI,CAAC;AAAA,EAC3B,aAAa,eAAE,OAAO,EAAE,SAAS;AAAA,EACjC,uBAAuB,eAAE,OAAO,EAAE,IAAI,CAAC;AAAA,EACvC,qBAAqB,eAAE,QAAQ,0BAA0B;AAAA,EACzD,uBAAuB;AAAA,EACvB,kBAAkB,gCAAgC,SAAS;AAAA,EAC3D,WAAW;AACf,CAAC,EAAE,OAAO,EAAE,YAAY,CAAC,OAAO,QAAQ;AACpC,OACK,MAAM,0BAA0B,aAAa,MAAM,0BAA0B,eAC3E,MAAM,qBAAqB,QAChC;AACE,QAAI,SAAS;AAAA,MACT,MAAM,eAAE,aAAa;AAAA,MACrB,MAAM,CAAC,kBAAkB;AAAA,MACzB,SAAS;AAAA,IACb,CAAC;AAAA,EACL;AACJ,CAAC;;;ACXD,IAAM,cAAc,IAAI,YAAY;AACpC,IAAM,kBAAkB,YAAY,OAAO,oBAAoB;AAC/D,IAAM,kBAAkB,YAAY,OAAO,uBAAuB;AAMlE,IAAIC,gBAA0D;AAE9D,SAASC,cAA+C;AACpD,MAAID,cAAc,QAAOA;AAEzB,QAAM,YAAY,OAAO,QAAQ,qBAAqB,aAC/C,QAAQ,iBAAiB,QAAQ,IAClC,QAAQ,QAAa;AAC3B,QAAM,gBAAgB,UAAU;AAChC,QAAM,cAAc,OAAO,eAAe,WACpC,aACA,GAAG,QAAQ,IAAI,CAAC;AACtB,QAAM,WAAW,cAAc,WAAW;AAE1C,MAAI;AACJ,MAAI;AACA,aAAS,SAAS,uBAAuB,EAAE;AAAA,EAC/C,QAAQ;AACJ,QAAI;AACA,eAAS,SAAS,oBAAoB,EAAE;AAAA,IAC5C,QAAQ;AACJ,YAAM,IAAI;AAAA,QACN;AAAA,MAEJ;AAAA,IACJ;AAAA,EACJ;AACA,EAAAA,gBAAe;AACf,SAAO;AACX;AAYO,SAAS,yBAAyB,aAAwD;AAC7F,QAAM,SAASC,YAAW;AAC1B,QAAM,YAAY,gBAAgB,WAAW;AAC7C,QAAM,SAAS,OAAO,YAAY,OAAO,SAAS,CAAC;AACnD,QAAM,cAAc,YAAY,OAAO,MAAM,kBACvC,kBACA,YAAY,OAAO,MAAM,eACrB,mBACC,MAAM;AAAE,UAAM,IAAI,MAAM,uDAAuD;AAAA,EAAG,GAAG;AAEhG,QAAM,UAAU,IAAI,WAAW,YAAY,SAAS,OAAO,MAAM;AACjE,UAAQ,IAAI,aAAa,CAAC;AAC1B,UAAQ,IAAI,QAAQ,YAAY,MAAM;AACtC,SAAO;AACX;AAaO,SAAS,iBAAiB,WAAwE;AACrG,QAAM,SAASA,YAAW;AAC1B,QAAM,YAAY,gBAAgB,SAAS;AAC3C,SAAO,iBAAiB,OAAO,YAAY,OAAO,SAAS,CAAC,CAAC;AACjE;;;AC9EA,IAAI,eAAoG;AAExG,SAAS,aAAyF;AAC9F,MAAI,aAAc,QAAO;AAEzB,QAAM,YAAY,OAAO,QAAQ,qBAAqB,aAC/C,QAAQ,iBAAiB,QAAQ,IAClC,QAAQ,QAAa;AAC3B,QAAM,gBAAgB,UAAU;AAChC,QAAM,cAAc,OAAO,eAAe,WACpC,aACA,GAAG,QAAQ,IAAI,CAAC;AACtB,QAAM,WAAW,cAAc,WAAW;AAE1C,MAAI;AACJ,MAAI;AACA,oBAAgB,SAAS,gBAAgB;AAAA,EAC7C,QAAQ;AACJ,UAAM,IAAI;AAAA,MACN;AAAA,IAEJ;AAAA,EACJ;AAGA,MAAI,CAAC,cAAc,QAAQ,QAAQ;AAC/B,QAAI;AACJ,QAAI;AACA,YAAM,OAAO,SAAS,uBAAuB;AAC7C,iBAAW,IAAI,MAAoB,KAAK,OAAO,cAAc,IAAI,YAAY,GAAG,CAAC,CAAC;AAAA,IACtF,QAAQ;AACJ,UAAI;AACA,cAAM,OAAO,SAAS,oBAAoB;AAC1C,mBAAW,IAAI,MAAoB,KAAK,OAAO,cAAc,IAAI,YAAY,GAAG,CAAC,CAAC;AAAA,MACtF,QAAQ;AACJ,cAAM,IAAI;AAAA,UACN;AAAA,QAEJ;AAAA,MACJ;AAAA,IACJ;AACA,QAAI,CAAC,cAAc,OAAQ,eAAc,SAAS,CAAC;AACnD,kBAAc,OAAO,SAAS;AAAA,EAClC;AAEA,QAAM,SAAqF,cAAc;AACzG,iBAAe;AACf,SAAO;AACX;AAUA,eAAsB,sBAAsB,QAIvB;AACjB,QAAM,SAAS,WAAW;AAC1B,MAAI;AACA,WAAO,MAAM,OAAO,OAAO,WAAW,OAAO,gBAAgB,OAAO,SAAS;AAAA,EACjF,QAAQ;AACJ,WAAO;AAAA,EACX;AACJ;AA0BA,eAAsB,6BAA6B,QAGhB;AAC/B,QAAM,EAAE,KAAK,UAAU,IAAI;AAG3B,MAAI,CAAC,OAAO,OAAO,QAAQ,UAAU;AACjC,WAAO,EAAE,OAAO,OAAO,QAAQ,mBAAmB;AAAA,EACtD;AAIA,MACI,OAAQ,IAA0C,wBAAwB,YACtE,IAAY,wBAAwB,yBAC1C;AACE,WAAO,EAAE,OAAO,OAAO,QAAQ,wBAAwB;AAAA,EAC3D;AAGA,QAAM,WAAY,IAAY,OAAO;AACrC,MAAI,aAAa,mBAAmB,aAAa,cAAc;AAC3D,WAAO,EAAE,OAAO,OAAO,QAAQ,mBAAmB;AAAA,EACtD;AACA,QAAM,cAAc,aAAa,kBAC3B,+BAA+B,UAAU,GAAG,IAC5C,+BAA+B,UAAU,GAAG;AAClD,MAAI,CAAC,YAAY,SAAS;AACtB,WAAO,EAAE,OAAO,OAAO,QAAQ,mBAAmB;AAAA,EACtD;AACA,QAAM,YAAY,YAAY;AAG9B,MAAI;AACJ,MAAI;AACA,UAAM,EAAE,WAAW,GAAG,eAAe,IAAI;AACzC,qBAAiB,yBAAyB,cAA+C;AAAA,EAC7F,QAAQ;AACJ,WAAO,EAAE,OAAO,OAAO,QAAQ,6BAA6B;AAAA,EAChE;AAGA,MAAI;AACJ,MAAI;AACA,qBAAiB,iBAAiB,UAAU,SAAS;AAAA,EACzD,QAAQ;AACJ,WAAO,EAAE,OAAO,OAAO,QAAQ,oBAAoB;AAAA,EACvD;AAGA,QAAM,QAAQ,MAAM,sBAAsB;AAAA,IACtC;AAAA,IACA,WAAW;AAAA,IACX;AAAA,EACJ,CAAC;AAED,SAAO,QAAQ,EAAE,OAAO,KAAK,IAAI,EAAE,OAAO,OAAO,QAAQ,oBAAoB;AACjF;","names":["KernelErrorCodeSchema","import_zod","import_zod","import_zod","import_zod","import_zod","import_zod","import_zod","KernelErrorCodeSchema","import_zod","import_zod","import_zod","import_zod","import_zod","import_zod","ULID_REGEX","import_zod","import_zod","cachedSha256","loadSha256","import_zod","cachedSha256","loadSha256"]}