@hlos-ai/schemas 0.4.2

package/dist/index.cjs.map

@@ -0,0 +1 @@
+{"version":3,"sources":["../src/index.ts","../src/surface.ts","../src/response.ts","../src/error-codes.ts","../src/receipt-v0.ts","../src/ids.ts","../src/shared-contract.ts","../src/w.ts","../src/agents.ts","../src/encoding.ts","../src/receipt-hash.ts","../src/finality.ts"],"sourcesContent":["/**\n * @hlos-ai/schemas - HLOS Kernel v2 API Contract Types\n *\n * This package defines the canonical types for HLOS Kernel v2:\n * - Response envelopes (SuccessResponse, ErrorResponse)\n * - Error codes (KernelErrorCode)\n * - Receipt format (SignedReceiptV0)\n * - Surface identifiers (Surface)\n * - Branded ID types (WalletId, PassportId, etc.)\n *\n * Surfaces (MCP, x402, Events, etc.) import from this package.\n * Kernel internals are NOT exported here.\n *\n * @packageDocumentation\n */\n\n// =============================================================================\n// Surface\n// =============================================================================\n\nexport {\n    SurfaceSchema,\n    type Surface,\n    SURFACES,\n} from './surface';\n\n// =============================================================================\n// Error Codes (legacy - superseded by shared-contract)\n// =============================================================================\n\n// NOTE: KernelErrorCodeSchema now exported from shared-contract with expanded codes.\n// Keeping error-codes.ts for backward compatibility, but shared-contract is canonical.\n\n\n// =============================================================================\n// Response Envelopes\n// =============================================================================\n\nexport {\n    type SuccessResponse,\n    type ErrorResponse,\n    success,\n    error,\n    SuccessResponseSchema,\n    ErrorResponseSchema,\n} from './response';\n\n// =============================================================================\n// SignedReceiptV0\n// =============================================================================\n\nexport {\n    RECEIPT_TYPE_URI,\n    RECEIPT_VERSION,\n    CONTENT_HASH_LENGTH,\n    SIGNATURE_LENGTH,\n    type SignedReceiptV0,\n    SignedReceiptV0Schema,\n    SignedReceiptV0LooseSchema,\n    isSignedReceiptV0,\n} from './receipt-v0';\n\n// =============================================================================\n// Branded IDs\n// =============================================================================\n\nexport {\n    type WalletId,\n    type PassportId,\n    type ReceiptId,\n    type CorrelationId,\n    type IdempotencyKey,\n    type CrossingId,\n    WalletIdSchema,\n    PassportIdSchema,\n    ReceiptIdSchema,\n    CorrelationIdSchema,\n    IdempotencyKeySchema,\n    CrossingIdSchema,\n    generateId,\n    generateWalletId,\n    generatePassportId,\n    generateReceiptId,\n    generateCrossingId,\n} from './ids';\n\n// =============================================================================\n// Shared Contract (LOCKED)\n// =============================================================================\n\nexport {\n    // Error codes (STRICT ENUM)\n    KernelErrorCodeSchema,\n    type KernelErrorCode,\n    ERROR_CODE_STATUS,\n\n    // Response envelopes\n    KernelOkSchema,\n    type KernelOk,\n    KernelErrorSchema,\n    type KernelError,\n    type ApiResponse,\n    kernelOk,\n    kernelError,\n\n    // ID format validators\n    CrossingIdFormatSchema,\n    ReceiptIdFormatSchema,\n    PassportIdFormatSchema,\n    WalletIdFormatSchema,\n\n    // Attribution\n    FundingSourceSchema,\n    type FundingSource,\n    CredentialSourceSchema,\n    type CredentialSource,\n    deriveFundingSource,\n\n    // Crossing hash input\n    CrossingSnapshotV0Schema,\n    type CrossingSnapshotV0,\n    CrossingHashInputV0Schema,\n    type CrossingHashInputV0,\n    isCrossingHashInputV0,\n\n    // Settlement receipt\n    SETTLEMENT_AUTHORITY,\n    CrossingSettledReceiptSchema,\n    type CrossingSettledReceipt,\n    isCrossingSettledReceipt,\n\n    // Stack primitives\n    AvailabilityTypeSchema,\n    type AvailabilityType,\n    ProviderRoleSchema,\n    type ProviderRole,\n    StackProviderSchema,\n    type StackProvider,\n    StackSchema,\n    type Stack,\n    StackConnectionSchema,\n    type StackConnection,\n\n    // Golden test fixtures\n    GOLDEN_FIXTURES,\n} from './shared-contract';\n\n// =============================================================================\n// Family W — Privacy-Preserving Proofs (Phase 1 LOCKED)\n// =============================================================================\n\nexport {\n    // Domain separators (frozen)\n    W_RPID_DOMAIN,\n    W_TXCTX_DOMAIN,\n\n    // Encoding utilities\n    encodeEpoch,\n\n    // Schemas\n    RelyingPartyIdSchema,\n    type RelyingPartyId,\n    RotationEpochSchema,\n    type RotationEpoch,\n    RPIDSchema,\n    type RPID,\n    TransactionContextSchema,\n    type TransactionContext,\n    TransactionContextHashSchema,\n    type TransactionContextHash,\n\n    // Validation helpers\n    validateTimeWindow,\n\n    // Golden fixtures\n    W_GOLDEN_FIXTURES,\n} from './w';\n\n// =============================================================================\n// Agents Contracts\n// =============================================================================\n\nexport {\n    // Agents list\n    AgentsListResponseSchema,\n    type AgentsListResponse,\n    AgentListItemSchema,\n    type AgentListItem,\n\n    // Agent passport stub\n    AgentPassportStubResponseSchema,\n    type AgentPassportStubResponse,\n\n    // Enums (forward-compatible)\n    AgentStatusSchema,\n    type AgentStatus,\n    AgentTypeSchema,\n    type AgentType,\n} from './agents';\n\n// =============================================================================\n// Encoding Utilities (Zero Dependencies)\n// =============================================================================\n\nexport {\n    // Encoding/decoding\n    bytesToBase64url,\n    base64urlToBytes,\n\n    // Schemas\n    Base64urlSha256Schema,\n    Base64urlEd25519SigSchema,\n    BASE64URL_SHA256_REGEX,\n} from './encoding';\n\n// =============================================================================\n// Receipt Hash Computation (Requires @noble/hashes)\n// =============================================================================\n\nexport {\n    // JCS canonicalization (RFC 8785)\n    jcsCanonicalize,\n\n    // Hash computation\n    computeReceiptHash,\n    computeContentHash,\n\n    // Schemas\n    ReceiptHashSchema,\n\n    // Golden fixtures (FROZEN)\n    RECEIPT_HASH_GOLDEN_FIXTURE,\n} from './receipt-hash';\n\n// =============================================================================\n// Finality — Notary Attestation & HARD Finality\n// =============================================================================\n\nexport {\n    // Constants\n    NA_ID_PREFIX,\n    FinalityLevel,\n\n    // ID format\n    NotaryAttestationIdFormatSchema,\n\n    // Notary Attestation (NA)\n    NotaryAttestationSchema,\n    type NotaryAttestation,\n    isNotaryAttestation,\n\n    // Notary Request (HLOS → STAAMPID)\n    NotaryRequestSchema,\n    type NotaryRequest,\n    isNotaryRequest,\n\n    // Notarize API response\n    NotarizeStatusSchema,\n    type NotarizeStatus,\n    NotarizeResponseSchema,\n    type NotarizeResponse,\n\n    // Merkle proof\n    LogInclusionProofSchema,\n    type LogInclusionProof,\n\n    // BRE artifact references\n    ArtifactRefSchema,\n    type ArtifactRef,\n\n    // Golden fixtures\n    FINALITY_GOLDEN_FIXTURES,\n} from './finality';\n\n","/**\n * @hlos-ai/schemas - Surface Types\n *\n * Canonical surface identifiers for idempotency scoping,\n * audit logging, and request attribution.\n */\n\nimport { z } from 'zod';\n\n/**\n * Known surfaces that interact with HLOS Kernel v2.\n * Used for idempotency scoping: (surface, idempotency_key) must be unique.\n */\nexport const SurfaceSchema = z.enum([\n    'mcp',      // Model Context Protocol servers\n    'x402',     // x402 micropayment protocol\n    'events',   // events.hlos.ai\n    'cli',      // HLOS CLI\n    'web',      // hlos.ai web app\n    'acp',      // Agent Commerce Protocol\n    'api',      // Direct API calls (default for unspecified)\n]);\n\nexport type Surface = z.infer<typeof SurfaceSchema>;\n\n/**\n * All known surfaces as a const array (for iteration).\n */\nexport const SURFACES = SurfaceSchema.options;\n","/**\n * @hlos-ai/schemas - Response Types\n *\n * Standard response envelopes for HLOS Kernel v2 API.\n *\n * - Reads return SuccessResponse<T>\n * - Mutations return SignedReceiptV0<T>\n * - Errors return ErrorResponse\n */\n\nimport { z } from 'zod';\nimport { KernelErrorCodeSchema, type KernelErrorCode } from './error-codes';\n\n// =============================================================================\n// Success Response (for reads)\n// =============================================================================\n\n/**\n * Standard success response for read operations.\n * Mutations return SignedReceiptV0 instead.\n */\nexport interface SuccessResponse<T> {\n    success: true;\n    data: T;\n    meta?: {\n        request_id?: string;\n        correlation_id: string;\n    };\n}\n\n/**\n * Create a SuccessResponse.\n */\nexport function success<T>(data: T, correlationId: string, requestId?: string): SuccessResponse<T> {\n    return {\n        success: true,\n        data,\n        meta: {\n            correlation_id: correlationId,\n            ...(requestId && { request_id: requestId }),\n        },\n    };\n}\n\n// =============================================================================\n// Error Response\n// =============================================================================\n\n/**\n * Standard error response.\n */\nexport interface ErrorResponse {\n    success: false;\n    error: {\n        code: KernelErrorCode;\n        message: string;\n        details?: unknown;\n        correlation_id: string;\n    };\n}\n\n/**\n * Create an ErrorResponse.\n */\nexport function error(\n    code: KernelErrorCode,\n    message: string,\n    correlationId: string,\n    details?: unknown\n): ErrorResponse {\n    return {\n        success: false,\n        error: {\n            code,\n            message,\n            correlation_id: correlationId,\n            ...(details !== undefined && { details }),\n        },\n    };\n}\n\n// =============================================================================\n// Zod Schemas (for runtime validation)\n// =============================================================================\n\nexport const SuccessResponseSchema = <T extends z.ZodType>(dataSchema: T) =>\n    z.object({\n        success: z.literal(true),\n        data: dataSchema,\n        meta: z.object({\n            request_id: z.string().optional(),\n            correlation_id: z.string(),\n        }).optional(),\n    });\n\nexport const ErrorResponseSchema = z.object({\n    success: z.literal(false),\n    error: z.object({\n        code: KernelErrorCodeSchema,\n        message: z.string(),\n        details: z.unknown().optional(),\n        correlation_id: z.string(),\n    }),\n});\n","/**\n * @hlos-ai/schemas - Error Codes\n *\n * Canonical error codes for HLOS Kernel v2 API.\n * These are FROZEN — additive changes only.\n */\n\nimport { z } from 'zod';\n\n/**\n * Kernel error codes (stable, exhaustive).\n */\nexport const KernelErrorCodeSchema = z.enum([\n    // 4xx Client Errors\n    'INVALID_REQUEST',        // 400 - Malformed request body\n    'UNAUTHORIZED',           // 401 - Missing/invalid auth\n    'FORBIDDEN',              // 403 - Insufficient permissions\n    'NOT_FOUND',              // 404 - Resource doesn't exist\n    'CONFLICT',               // 409 - General conflict\n    'IDEMPOTENCY_CONFLICT',   // 409 - Same idem_key, different request\n    'INSUFFICIENT_BALANCE',   // 402 - Wallet lacks funds\n    'SPEND_CAP_EXCEEDED',     // 402 - Spend cap hit\n    'RATE_LIMITED',           // 429 - Too many requests\n\n    // 5xx Server Errors\n    'INTERNAL_ERROR',         // 500 - Server error\n    'SERVICE_UNAVAILABLE',    // 503 - Temporarily unavailable\n]);\n\nexport type KernelErrorCode = z.infer<typeof KernelErrorCodeSchema>;\n\n/**\n * HTTP status code mapping for each error code.\n */\nexport const ERROR_CODE_STATUS: Record<KernelErrorCode, number> = {\n    INVALID_REQUEST: 400,\n    UNAUTHORIZED: 401,\n    FORBIDDEN: 403,\n    NOT_FOUND: 404,\n    CONFLICT: 409,\n    IDEMPOTENCY_CONFLICT: 409,\n    INSUFFICIENT_BALANCE: 402,\n    SPEND_CAP_EXCEEDED: 402,\n    RATE_LIMITED: 429,\n    INTERNAL_ERROR: 500,\n    SERVICE_UNAVAILABLE: 503,\n};\n","/**\n * @hlos-ai/schemas - SignedReceiptV0\n *\n * Canonical receipt format for HLOS Kernel v2 mutations.\n * All mutating operations emit this receipt type.\n *\n * FROZEN: Breaking changes require version bump.\n */\n\nimport { z } from 'zod';\nimport type { ReceiptId } from './ids';\n\n// =============================================================================\n// Constants\n// =============================================================================\n\n/**\n * Receipt type URI (JSON-LD style).\n */\nexport const RECEIPT_TYPE_URI = 'https://hlos.ai/schema/SignedReceiptV0' as const;\n\n/**\n * Current receipt format version.\n * This is a NUMBER, not semver.\n */\nexport const RECEIPT_VERSION = 0 as const;\n\n// =============================================================================\n// Types\n// =============================================================================\n\n/**\n * SignedReceiptV0: Canonical receipt for all v2 mutations.\n *\n * Content is JCS-canonicalized, SHA-256 hashed, Ed25519 signed.\n *\n * @template T - The content type (mutation-specific payload)\n */\nexport interface SignedReceiptV0<T = unknown> {\n    /**\n     * Type URI for JSON-LD compatibility.\n     */\n    '@type': typeof RECEIPT_TYPE_URI;\n\n    /**\n     * Format version (number, not semver).\n     * Increment for breaking format changes.\n     */\n    version: typeof RECEIPT_VERSION;\n\n    /**\n     * Unique receipt identifier.\n     */\n    receipt_id: ReceiptId | string;\n\n    /**\n     * The mutation payload (JCS-canonicalized before hashing).\n     */\n    content: T;\n\n    /**\n     * SHA-256 hash of JCS(content), base64url encoded.\n     *\n     * IMPORTANT: This is base64url of the raw 32-byte digest,\n     * NOT hex encoding. Matches signature input format.\n     */\n    content_hash: string;\n\n    /**\n     * Ed25519 signature over the raw 32-byte content_hash digest.\n     * base64url encoded.\n     *\n     * Signing process:\n     *   1. canonicalize = JCS(content)\n     *   2. digest = SHA-256(canonicalize) → 32 bytes\n     *   3. signature = Ed25519.sign(private_key, digest)\n     *   4. encode = base64url(signature)\n     */\n    signature: string;\n\n    /**\n     * Key identifier for signature verification.\n     * Resolves via JWKS endpoint: GET /api/v2/.well-known/keys\n     */\n    key_id: string;\n\n    /**\n     * ISO 8601 timestamp when receipt was issued.\n     */\n    issued_at: string;\n}\n\n// =============================================================================\n// Zod Schema\n// =============================================================================\n\n/**\n * Strict base64url length constants:\n * - SHA-256 digest (32 bytes) = 43 chars base64url (no padding)\n * - Ed25519 signature (64 bytes) = 86 chars base64url (no padding)\n */\nexport const CONTENT_HASH_LENGTH = 43;\nexport const SIGNATURE_LENGTH = 86;\n\nexport const SignedReceiptV0Schema = <T extends z.ZodType>(contentSchema: T) =>\n    z.object({\n        '@type': z.literal(RECEIPT_TYPE_URI),\n        version: z.literal(RECEIPT_VERSION),\n        receipt_id: z.string(),\n        content: contentSchema,\n        // SHA-256 digest (32 bytes) = exactly 43 chars base64url\n        content_hash: z.string().regex(\n            /^[A-Za-z0-9_-]{43}$/,\n            'content_hash must be 43-char base64url (32-byte SHA-256)'\n        ),\n        // Ed25519 signature (64 bytes) = exactly 86 chars base64url\n        signature: z.string().regex(\n            /^[A-Za-z0-9_-]{86}$/,\n            'signature must be 86-char base64url (64-byte Ed25519)'\n        ),\n        key_id: z.string().min(1),\n        issued_at: z.string().datetime(),\n    });\n\n/**\n * Loose schema for unknown content types.\n */\nexport const SignedReceiptV0LooseSchema = SignedReceiptV0Schema(z.unknown());\n\n// =============================================================================\n// Type Guards\n// =============================================================================\n\n/**\n * Check if a value is a SignedReceiptV0.\n */\nexport function isSignedReceiptV0(value: unknown): value is SignedReceiptV0 {\n    if (typeof value !== 'object' || value === null) return false;\n    const obj = value as Record<string, unknown>;\n    return (\n        obj['@type'] === RECEIPT_TYPE_URI &&\n        obj['version'] === RECEIPT_VERSION &&\n        typeof obj['receipt_id'] === 'string' &&\n        typeof obj['content_hash'] === 'string' &&\n        typeof obj['signature'] === 'string' &&\n        typeof obj['key_id'] === 'string' &&\n        typeof obj['issued_at'] === 'string'\n    );\n}\n","/**\n * @hlos-ai/schemas - Branded ID Types\n *\n * Strongly-typed ID strings to prevent cross-surface mistakes.\n * Use Zod for runtime validation.\n */\n\nimport { z } from 'zod';\n\n// =============================================================================\n// ID Patterns\n// =============================================================================\n\n/**\n * ULID pattern (26 chars, Crockford base32).\n */\nconst ULID_PATTERN = /^[0-9A-HJKMNP-TV-Z]{26}$/i;\n\n/**\n * CUID pattern (starts with 'c', 25+ chars).\n */\nconst CUID_PATTERN = /^c[a-z0-9]{24,}$/;\n\n/**\n * UUID v4 pattern.\n */\nconst UUID_V4_PATTERN = /^[0-9a-f]{8}-[0-9a-f]{4}-4[0-9a-f]{3}-[89ab][0-9a-f]{3}-[0-9a-f]{12}$/i;\n\n// =============================================================================\n// Branded Types (TypeScript compile-time safety)\n// =============================================================================\n\ndeclare const WalletIdBrand: unique symbol;\ndeclare const PassportIdBrand: unique symbol;\ndeclare const ReceiptIdBrand: unique symbol;\ndeclare const CorrelationIdBrand: unique symbol;\ndeclare const IdempotencyKeyBrand: unique symbol;\ndeclare const CrossingIdBrand: unique symbol;\n\nexport type WalletId = string & { readonly [WalletIdBrand]: true };\nexport type PassportId = string & { readonly [PassportIdBrand]: true };\nexport type ReceiptId = string & { readonly [ReceiptIdBrand]: true };\nexport type CorrelationId = string & { readonly [CorrelationIdBrand]: true };\nexport type IdempotencyKey = string & { readonly [IdempotencyKeyBrand]: true };\nexport type CrossingId = string & { readonly [CrossingIdBrand]: true };\n\n// =============================================================================\n// Zod Schemas (runtime validation)\n// =============================================================================\n\n/**\n * WalletId: prefixed CUID or ULID.\n */\nexport const WalletIdSchema = z.string()\n    .regex(/^wallet_[a-z0-9]{20,}$/i, 'Invalid WalletId format')\n    .transform((s) => s as WalletId);\n\n/**\n * PassportId: prefixed CUID or ULID.\n */\nexport const PassportIdSchema = z.string()\n    .regex(/^passport_[a-z0-9]{20,}$/i, 'Invalid PassportId format')\n    .transform((s) => s as PassportId);\n\n/**\n * ReceiptId: prefixed ULID.\n */\nexport const ReceiptIdSchema = z.string()\n    .regex(/^rcpt_[0-9A-HJKMNP-TV-Z]{26}$/i, 'Invalid ReceiptId format')\n    .transform((s) => s as ReceiptId);\n\n/**\n * CorrelationId: UUID v4 or custom format.\n */\nexport const CorrelationIdSchema = z.string()\n    .min(8)\n    .max(128)\n    .transform((s) => s as CorrelationId);\n\n/**\n * IdempotencyKey: client-provided, opaque.\n * Max 256 chars, printable ASCII.\n */\nexport const IdempotencyKeySchema = z.string()\n    .min(1)\n    .max(256)\n    .regex(/^[\\x20-\\x7E]+$/, 'IdempotencyKey must be printable ASCII')\n    .transform((s) => s as IdempotencyKey);\n\n/**\n * CrossingId: prefixed CUID.\n */\nexport const CrossingIdSchema = z.string()\n    .regex(/^cross_[a-z0-9]{20,}$/i, 'Invalid CrossingId format')\n    .transform((s) => s as CrossingId);\n\n// =============================================================================\n// ID Generation Helpers\n// =============================================================================\n\n/**\n * Generate a prefixed CUID-style ID.\n * Uses crypto.randomUUID() stripped of dashes + timestamp prefix.\n */\nexport function generateId(prefix: string): string {\n    const timestamp = Date.now().toString(36);\n    const random = crypto.randomUUID().replace(/-/g, '').slice(0, 16);\n    return `${prefix}_${timestamp}${random}`;\n}\n\nexport const generateWalletId = (): WalletId => generateId('wallet') as WalletId;\nexport const generatePassportId = (): PassportId => generateId('passport') as PassportId;\nexport const generateReceiptId = (): ReceiptId => generateId('rcpt') as ReceiptId;\nexport const generateCrossingId = (): CrossingId => generateId('cross') as CrossingId;\n","/**\n * @hlos-ai/schemas - Shared Contract Types\n *\n * LOCKED CONTRACT — All tracks must import from this file.\n * No local redefinitions allowed.\n *\n * Contains:\n * - Response envelopes (KernelOk, KernelError, ApiResponse)\n * - Error codes (KernelErrorCode) - STRICT ENUM\n * - Attribution enums (FundingSource, CredentialSource)\n * - Crossing types (CrossingSnapshotV0, CrossingHashInputV0, CrossingSettledReceipt)\n * - Stack primitives (Stack, StackProvider, StackConnection)\n * - Test fixtures (golden vectors for conformance)\n */\n\nimport { z } from 'zod';\n\n// =============================================================================\n// ERROR CODES (STRICT ENUM - P0)\n// =============================================================================\n\n/**\n * Kernel error codes - STRICT ENUM.\n * Uses KernelErrorCodeSchema instead of z.string() to prevent drift.\n */\nexport const KernelErrorCodeSchema = z.enum([\n    // Validation / Request errors\n    'VALIDATION_ERROR',           // 400 - Input validation failed\n    'INVALID_REQUEST',            // 400 - Malformed request\n\n    // Auth errors\n    'UNAUTHORIZED',               // 401 - Missing/invalid auth\n    'FORBIDDEN',                  // 403 - Insufficient permissions\n\n    // Resource errors\n    'NOT_FOUND',                  // 404 - Generic not found\n    'CROSSING_NOT_FOUND',         // 404 - Crossing not found\n    'STACK_NOT_FOUND',            // 404 - Stack not found\n    'STACK_CONNECTION_NOT_FOUND', // 404 - Stack connection not found\n\n    // Conflict errors\n    'CONFLICT',                 // 409 - Generic conflict\n    'INVALID_STATE_TRANSITION',   // 409 - State machine violation\n    'CROSSING_ALREADY_SETTLED',   // 409 - Crossing already settled\n    'IDEMPOTENCY_CONFLICT',       // 409 - Same key, different request\n\n    // Payment errors\n    'INSUFFICIENT_BALANCE',       // 402 - Wallet lacks funds\n    'SPEND_CAP_EXCEEDED',         // 402 - Spend cap hit\n\n    // Rate limiting\n    'RATE_LIMITED',               // 429 - Too many requests\n\n    // Server errors\n    'INTERNAL_ERROR',             // 500 - Server error\n    'SERVICE_UNAVAILABLE',        // 503 - Temporarily unavailable\n]);\n\nexport type KernelErrorCode = z.infer<typeof KernelErrorCodeSchema>;\n\n/**\n * HTTP status code mapping for each error code.\n */\nexport const ERROR_CODE_STATUS: Record<KernelErrorCode, number> = {\n    VALIDATION_ERROR: 400,\n    INVALID_REQUEST: 400,\n    UNAUTHORIZED: 401,\n    FORBIDDEN: 403,\n    NOT_FOUND: 404,\n    CROSSING_NOT_FOUND: 404,\n    STACK_NOT_FOUND: 404,\n    STACK_CONNECTION_NOT_FOUND: 404,\n    CONFLICT: 409,\n    INVALID_STATE_TRANSITION: 409,\n    CROSSING_ALREADY_SETTLED: 409,\n    IDEMPOTENCY_CONFLICT: 409,\n    INSUFFICIENT_BALANCE: 402,\n    SPEND_CAP_EXCEEDED: 402,\n    RATE_LIMITED: 429,\n    INTERNAL_ERROR: 500,\n    SERVICE_UNAVAILABLE: 503,\n};\n\n// =============================================================================\n// RESPONSE ENVELOPES\n// =============================================================================\n\n/**\n * KernelOk - Standard success envelope.\n * Status: 200-299 (success) OR 304 (not modified).\n * NOT arbitrary 3xx (302 implies navigation semantics, not API success).\n */\nexport const KernelOkSchema = <T extends z.ZodType>(dataSchema: T) =>\n    z.object({\n        ok: z.literal(true),\n        status: z.union([\n            z.number().int().min(200).max(299),\n            z.literal(304),\n        ]),\n        data: dataSchema,\n    });\n\nexport type KernelOk<T> = {\n    ok: true;\n    status: number;\n    data: T;\n};\n\n/**\n * KernelError - Standard error envelope.\n * Uses STRICT KernelErrorCodeSchema.\n */\nexport const KernelErrorSchema = z.object({\n    ok: z.literal(false),\n    status: z.number().int().min(400).max(599),\n    error: z.object({\n        code: KernelErrorCodeSchema, // P0 FIX: was z.string()\n        message: z.string(),\n        details: z.record(z.unknown()).optional(),\n    }),\n});\n\nexport type KernelError = z.infer<typeof KernelErrorSchema>;\n\n/**\n * ApiResponse - Union of success and error.\n */\nexport type ApiResponse<T> = KernelOk<T> | KernelError;\n\n// =============================================================================\n// ID SCHEMAS (P0 - Format validators)\n// =============================================================================\n\n/**\n * CrossingId format: cross_[a-z0-9]{20,}\n */\nexport const CrossingIdFormatSchema = z.string()\n    .regex(/^cross_[a-z0-9]{20,}$/i, 'Invalid CrossingId format (expected: cross_...)');\n\n/**\n * ReceiptId format: rcpt_[0-9A-HJKMNP-TV-Z]{26}\n */\nexport const ReceiptIdFormatSchema = z.string()\n    .regex(/^rcpt_[0-9A-HJKMNP-TV-Z]{26}$/i, 'Invalid ReceiptId format (expected: rcpt_...)');\n\n/**\n * PassportId format: passport_[a-z0-9]{20,}\n */\nexport const PassportIdFormatSchema = z.string()\n    .regex(/^passport_[a-z0-9]{20,}$/i, 'Invalid PassportId format (expected: passport_...)');\n\n/**\n * WalletId format: wallet_[a-z0-9]{20,}\n */\nexport const WalletIdFormatSchema = z.string()\n    .regex(/^wallet_[a-z0-9]{20,}$/i, 'Invalid WalletId format (expected: wallet_...)');\n\n// =============================================================================\n// ATTRIBUTION ENUMS\n// =============================================================================\n\n/**\n * FundingSource - Who paid for this crossing.\n * Determined by credential_source (see mapping rule below).\n */\nexport const FundingSourceSchema = z.enum(['SPONSOR', 'PLATFORM', 'USER']);\nexport type FundingSource = z.infer<typeof FundingSourceSchema>;\n\n/**\n * CredentialSource - Where the credential came from.\n */\nexport const CredentialSourceSchema = z.enum([\n    'SPONSOR_KEY',   // Sponsor-provisioned key\n    'BYOK',          // Bring Your Own Key (user-provided)\n    'HLOS_FALLBACK', // Platform fallback credential\n]);\nexport type CredentialSource = z.infer<typeof CredentialSourceSchema>;\n\n/**\n * Deterministic funding mapping rule.\n * INVARIANT: credential_source determines funding_source.\n */\nexport function deriveFundingSource(credentialSource: CredentialSource): FundingSource {\n    switch (credentialSource) {\n        case 'SPONSOR_KEY':\n            return 'SPONSOR';\n        case 'BYOK':\n            return 'USER';\n        case 'HLOS_FALLBACK':\n            return 'PLATFORM';\n    }\n}\n\n// =============================================================================\n// CROSSING HASH INPUT\n// =============================================================================\n\n/**\n * CrossingSnapshotV0 - Stable fields for hash computation.\n *\n * INVARIANT: Must NOT include any derived or mutable fields:\n * - state, receiptIds, settledAt, createdAt/updatedAt\n */\nexport const CrossingSnapshotV0Schema = z.object({\n    crossingId: CrossingIdFormatSchema,\n    capabilityId: z.string(),\n    passportId: PassportIdFormatSchema,\n\n    // Scoping\n    event_id: z.string().nullable(),\n    access_window_id: z.string().nullable(),\n    access_grant_id: z.string().nullable(),\n\n    // Attribution\n    attribution_org_id: z.string().nullable(),\n    funding_source: FundingSourceSchema.nullable(),\n    credential_source: CredentialSourceSchema,\n});\n\nexport type CrossingSnapshotV0 = z.infer<typeof CrossingSnapshotV0Schema>;\n\n/**\n * CrossingHashInputV0 - Input to hash function.\n * Uses version marker for future-proofing.\n */\nexport const CrossingHashInputV0Schema = z.object({\n    v: z.literal(0),\n    snapshot: CrossingSnapshotV0Schema,\n    attested_receipt_id: ReceiptIdFormatSchema,\n});\n\nexport type CrossingHashInputV0 = z.infer<typeof CrossingHashInputV0Schema>;\n\n// =============================================================================\n// CROSSING SETTLED RECEIPT\n// =============================================================================\n\n/**\n * SettlementAuthority - LITERAL (no drift).\n */\nexport const SETTLEMENT_AUTHORITY = 'hlos.ai' as const;\n\n/**\n * CrossingSettledReceipt - Issued when crossing reaches SETTLED state.\n */\nexport const CrossingSettledReceiptSchema = z.object({\n    type: z.literal('CrossingSettled'),\n    crossingId: CrossingIdFormatSchema,\n\n    // Scoping (powers adoption + ROI views)\n    event_id: z.string().nullable(),\n    access_window_id: z.string().nullable(),\n    access_grant_id: z.string().nullable(),\n\n    // Attribution\n    attribution_org_id: z.string().nullable(),\n    funding_source: FundingSourceSchema.nullable(),\n    credential_source: CredentialSourceSchema,\n\n    // Authority (LITERAL)\n    settlement_authority: z.literal(SETTLEMENT_AUTHORITY),\n\n    // Binding\n    crossing_hash: z.string(),        // sha256 base64url of CrossingHashInputV0\n    attested_receipt_id: z.string(),\n\n    // Timestamp\n    settled_at: z.string().datetime(),\n});\n\nexport type CrossingSettledReceipt = z.infer<typeof CrossingSettledReceiptSchema>;\n\n// =============================================================================\n// STACK PRIMITIVES (Product Layer)\n// =============================================================================\n\n/**\n * AvailabilityType - Provider availability classification.\n */\nexport const AvailabilityTypeSchema = z.enum([\n    'EVENT_SPONSOR', // Sponsor-funded for specific event\n    'EVERGREEN',     // Always available platform credit\n    'CATALOG',       // User-paid from catalog\n]);\nexport type AvailabilityType = z.infer<typeof AvailabilityTypeSchema>;\n\n/**\n * ProviderRole - P1: Constrained enum for provider roles.\n */\nexport const ProviderRoleSchema = z.enum([\n    'AI',         // AI/LLM providers (Gemini, GPT, Claude)\n    'DATABASE',   // Database providers (MongoDB, Supabase)\n    'AUTH',       // Auth providers (Clerk, Auth0)\n    'DEPLOY',     // Deployment providers (Vercel, Cloudflare)\n    'STORAGE',    // Storage providers (S3, R2)\n    'SEARCH',     // Search providers (Algolia, Pinecone)\n    'PAYMENTS',   // Payment providers (Stripe)\n    'COMPUTE',    // Compute providers (Modal, Replicate)\n    'OTHER',      // Catch-all for new categories\n]);\nexport type ProviderRole = z.infer<typeof ProviderRoleSchema>;\n\n/**\n * StackProvider - Provider within a stack.\n */\nexport const StackProviderSchema = z.object({\n    provider_id: z.string(),\n    role: ProviderRoleSchema, // P1: Now a constrained enum\n    display_name: z.string(),\n    budget_allocation: z.number().nonnegative(),\n    sku_ids: z.array(z.string()),\n    availability_type: AvailabilityTypeSchema,\n});\n\nexport type StackProvider = z.infer<typeof StackProviderSchema>;\n\n/**\n * Stack - Curated capability bundle.\n */\nexport const StackSchema = z.object({\n    id: z.string(),\n    slug: z.string(),\n    name: z.string(),\n    tagline: z.string(),\n    icon: z.string(),\n    providers: z.array(StackProviderSchema),\n    github_template: z.string().nullable(),\n    total_budget: z.number().nonnegative(),\n    event_id: z.string().nullable(), // null = evergreen\n});\n\nexport type Stack = z.infer<typeof StackSchema>;\n\n/**\n * StackConnection - User's connection to a stack.\n */\nexport const StackConnectionSchema = z.object({\n    id: z.string(),\n    stack_id: z.string(),\n    passport_id: z.string(),\n    team_id: z.string().nullable(),\n    environment_id: z.string(),\n    connected_at: z.string().datetime(),\n    connected_providers: z.array(z.string()),\n});\n\nexport type StackConnection = z.infer<typeof StackConnectionSchema>;\n\n// =============================================================================\n// HELPER FACTORIES\n// =============================================================================\n\n/**\n * Create a KernelOk response.\n */\nexport function kernelOk<T>(data: T, status: number = 200): KernelOk<T> {\n    return { ok: true, status, data };\n}\n\n/**\n * Create a KernelError response.\n */\nexport function kernelError(\n    code: KernelErrorCode, // P0: Now typed to KernelErrorCode\n    message: string,\n    status?: number,\n    details?: Record<string, unknown>\n): KernelError {\n    return {\n        ok: false,\n        status: status ?? ERROR_CODE_STATUS[code],\n        error: {\n            code,\n            message,\n            ...(details && { details }),\n        },\n    };\n}\n\n// =============================================================================\n// GOLDEN TEST FIXTURES (P1 - Conformance testing)\n// =============================================================================\n\n/**\n * Golden test fixtures for downstream conformance testing.\n * Surfaces (MCP, Agent Passport, Caravan, events-hlos) can import these\n * to verify they're hashing/encoding/typing identically.\n */\nexport const GOLDEN_FIXTURES = {\n    /**\n     * Sample CrossingHashInputV0 for hash conformance.\n     */\n    crossingHashInput: {\n        v: 0 as const,\n        snapshot: {\n            crossingId: 'cross_test123abc456def789ghi',\n            capabilityId: 'gemini.generate.v1',\n            passportId: 'passport_user123abc456def789g',\n            event_id: 'evt_hackathon2026',\n            access_window_id: 'aw_sponsor_mongodb',\n            access_grant_id: 'ag_team_001',\n            attribution_org_id: 'mongodb',\n            funding_source: 'SPONSOR' as const,\n            credential_source: 'SPONSOR_KEY' as const,\n        },\n        attested_receipt_id: 'rcpt_01HZABCDEF1234567890ABCDEF',\n    } satisfies CrossingHashInputV0,\n\n    /**\n     * Expected crossing_hash for the above input (FROZEN).\n     * Compute: JCS canonicalize → SHA-256 → base64url (no padding)\n     *\n     * This is the golden vector. If your hash differs, your implementation\n     * is not conformant. DO NOT CHANGE unless crossingHashInput changes.\n     */\n    expectedCrossingHash_base64url_sha256_jcs_v0: 'z8A2kCNck4rPL4ugNe-Fbxputdi3PkjkVpSrIBhojU0',\n\n    /**\n     * Sample CrossingSettledReceipt.\n     */\n    crossingSettledReceipt: {\n        type: 'CrossingSettled' as const,\n        crossingId: 'cross_test123abc456def789ghi',\n        event_id: 'evt_hackathon2026',\n        access_window_id: 'aw_sponsor_mongodb',\n        access_grant_id: 'ag_team_001',\n        attribution_org_id: 'mongodb',\n        funding_source: 'SPONSOR' as const,\n        credential_source: 'SPONSOR_KEY' as const,\n        settlement_authority: 'hlos.ai' as const,\n        crossing_hash: 'z8A2kCNck4rPL4ugNe-Fbxputdi3PkjkVpSrIBhojU0',\n        attested_receipt_id: 'rcpt_01HZABCDEF1234567890ABCDEF',\n        settled_at: '2026-01-24T12:00:00.000Z',\n    } satisfies CrossingSettledReceipt,\n} as const;\n\n/**\n * Type guard: check if a value is a valid CrossingHashInputV0.\n */\nexport function isCrossingHashInputV0(value: unknown): value is CrossingHashInputV0 {\n    return CrossingHashInputV0Schema.safeParse(value).success;\n}\n\n/**\n * Type guard: check if a value is a valid CrossingSettledReceipt.\n */\nexport function isCrossingSettledReceipt(value: unknown): value is CrossingSettledReceipt {\n    return CrossingSettledReceiptSchema.safeParse(value).success;\n}\n","/**\n * Family W — Privacy-Preserving Proofs (Phase 1 Lock)\n *\n * CC-W-01: RP-specific pseudonym derivation + rotation\n * CC-W-03: transaction_context_hash binding prevents replay\n *\n * Phase 1 schemas are LOCKED. Any changes require:\n * - Golden vector updates\n * - Invariants note\n * - Contract tests\n *\n * @packageDocumentation\n */\n\nimport { z } from 'zod';\n\n// =============================================================================\n// Domain Separators (FROZEN)\n// =============================================================================\n\n/**\n * RPID derivation domain separator.\n * Used in HKDF info: concat(W_RPID_DOMAIN, encodeEpoch(epoch))\n */\nexport const W_RPID_DOMAIN = new TextEncoder().encode('W:RPID:v1');\n\n/**\n * Transaction context domain separator (reserved for future use).\n */\nexport const W_TXCTX_DOMAIN = new TextEncoder().encode('W:TXCTX:v1');\n\n// =============================================================================\n// Epoch Encoding (FROZEN)\n// =============================================================================\n\n/**\n * Encode rotation epoch as u64 big-endian bytes.\n *\n * Input normalization:\n * - number: treated as milliseconds since Unix epoch\n * - string: parsed as RFC3339 datetime, converted to ms\n *\n * INVARIANT: All epochs normalize to millisecond timestamps with strict RFC3339 validation.\n *\n * @param epoch - Epoch as ms number or RFC3339 string\n * @returns 8-byte Uint8Array (u64 big-endian)\n * @throws Error if string is not valid RFC3339\n */\n/**\n * RFC3339 datetime pattern (requires timezone, excludes date-only).\n * Examples: 2026-01-29T00:00:00Z, 2026-01-29T00:00:00+00:00\n */\nconst RFC3339_CAPTURING =\n    /^(\\d{4})-(\\d{2})-(\\d{2})T(\\d{2}):(\\d{2}):(\\d{2})(\\.(\\d{1,9}))?(Z|([+-])(\\d{2}):(\\d{2}))$/;\n\nfunction isLeapYear(year: number): boolean {\n    return (year % 4 === 0 && year % 100 !== 0) || (year % 400 === 0);\n}\n\nfunction daysInMonth(year: number, month: number): number {\n    const days = [31, isLeapYear(year) ? 29 : 28, 31, 30, 31, 30, 31, 31, 30, 31, 30, 31];\n    return days[month - 1] ?? 0;\n}\n\nfunction parseRfc3339StrictToMs(value: string): number {\n    const match = RFC3339_CAPTURING.exec(value);\n    if (!match) {\n        throw new Error(\n            `Invalid epoch: \"${value}\" is not a valid RFC3339 datetime (requires time and timezone)`\n        );\n    }\n\n    const year = Number(match[1]);\n    const month = Number(match[2]);\n    const day = Number(match[3]);\n    const hour = Number(match[4]);\n    const minute = Number(match[5]);\n    const second = Number(match[6]);\n    const fraction = match[8] ?? '';\n    const tz = match[9];\n\n    if (month < 1 || month > 12) {\n        throw new Error('Invalid epoch: month out of range');\n    }\n    const maxDay = daysInMonth(year, month);\n    if (day < 1 || day > maxDay) {\n        throw new Error('Invalid epoch: day out of range');\n    }\n    if (hour > 23) {\n        throw new Error('Invalid epoch: hour out of range');\n    }\n    if (minute > 59) {\n        throw new Error('Invalid epoch: minute out of range');\n    }\n    if (second > 59) {\n        throw new Error('Invalid epoch: second out of range');\n    }\n\n    const msFraction = fraction.length ? Number((fraction + '000').slice(0, 3)) : 0;\n    const utcMs = Date.UTC(year, month - 1, day, hour, minute, second, msFraction);\n\n    let offsetMs = 0;\n    if (tz !== 'Z') {\n        const sign = match[10] === '-' ? -1 : 1;\n        const offsetHour = Number(match[11]);\n        const offsetMinute = Number(match[12]);\n        if (offsetHour > 23) {\n            throw new Error('Invalid epoch: tz hour out of range');\n        }\n        if (offsetMinute > 59) {\n            throw new Error('Invalid epoch: tz minute out of range');\n        }\n        offsetMs = sign * (offsetHour * 60 + offsetMinute) * 60_000;\n    }\n\n    const ms = utcMs - offsetMs;\n    if (!Number.isFinite(ms) || ms < 0) {\n        throw new Error('Invalid epoch: must be a non-negative timestamp');\n    }\n\n    return ms;\n}\n\nexport function encodeEpoch(epoch: number | string): Uint8Array {\n    let ms: number;\n\n    if (typeof epoch === 'string') {\n        ms = parseRfc3339StrictToMs(epoch);\n    } else {\n        if (!Number.isInteger(epoch) || epoch < 0) {\n            throw new Error(`Invalid epoch: ${epoch} must be a non-negative integer`);\n        }\n        ms = epoch;\n    }\n\n    const buf = new ArrayBuffer(8);\n    const view = new DataView(buf);\n    view.setBigUint64(0, BigInt(ms), false); // big-endian\n    return new Uint8Array(buf);\n}\n\n// =============================================================================\n// RelyingPartyId Schema\n// =============================================================================\n\n/**\n * Relying Party identifier.\n * Uniquely identifies a verifier/merchant for pseudonym derivation.\n */\nexport const RelyingPartyIdSchema = z.object({\n    /** RP domain (e.g., \"merchant.example.com\") */\n    domain: z.string().min(1).max(253),\n    /** Audience URI (e.g., \"https://merchant.example.com/verify\") */\n    audience_uri: z.string().url(),\n    /** SHA-256 hash of verifier's public key (hex, 64 chars) */\n    verifier_key_hash: z.string().regex(/^[a-f0-9]{64}$/, 'Must be 64-char lowercase hex'),\n});\n\nexport type RelyingPartyId = z.infer<typeof RelyingPartyIdSchema>;\n\n// =============================================================================\n// RotationEpoch Schema\n// =============================================================================\n\n/**\n * Rotation epoch for RPID derivation.\n *\n * Accepts:\n * - number: milliseconds since Unix epoch (non-negative integer)\n * - string: RFC3339 datetime (e.g., \"2026-01-29T00:00:00Z\")\n *\n * INVARIANT: All epochs normalize to millisecond timestamps via encodeEpoch().\n */\nexport const RotationEpochSchema = z.union([\n    z.number().int().nonnegative(),\n    z.string().datetime({ offset: true }), // Requires timezone offset (RFC3339)\n]);\n\nexport type RotationEpoch = z.infer<typeof RotationEpochSchema>;\n\n// =============================================================================\n// RPID Schema\n// =============================================================================\n\n/**\n * RP-specific pseudonym.\n * Base64url-encoded, 32 bytes = 43 chars without padding.\n * We prefer no-padding format per RFC 7515.\n */\nexport const RPIDSchema = z\n    .string()\n    .length(43, 'RPID must be base64url-encoded 32 bytes (43 chars, no padding)')\n    .regex(/^[A-Za-z0-9_-]+$/, 'Must be base64url (no padding)');\n\nexport type RPID = z.infer<typeof RPIDSchema>;\n\n// =============================================================================\n// TransactionContext Schema (Minimal Core)\n// =============================================================================\n\n/**\n * Transaction context for replay protection.\n *\n * Core fields (required, stable):\n * - relying_party_id: who is verifying\n * - operation_hash: sha256(JCS({ intent, request }))\n * - not_before/not_after: validity window\n *\n * Optional fields (part of hash, must be consistent):\n * - amount/currency: economic context\n * - surface_id/channel_id: routing context\n */\nexport const TransactionContextSchema = z.object({\n    // Required core (stable)\n    relying_party_id: RelyingPartyIdSchema,\n    /** sha256(JCS({ intent, request })) — see computeOperationHash() */\n    operation_hash: z.string().regex(/^[a-f0-9]{64}$/, 'Must be 64-char lowercase hex'),\n    /** Validity start (RFC3339) */\n    not_before: z.string().datetime({ offset: true }),\n    /** Validity end (RFC3339) */\n    not_after: z.string().datetime({ offset: true }),\n\n    // Optional (part of hash, must be consistent)\n    amount: z.number().nonnegative().optional(),\n    currency: z.string().length(3).optional(),\n    surface_id: z.string().optional(),\n    channel_id: z.string().optional(),\n});\n\nexport type TransactionContext = z.infer<typeof TransactionContextSchema>;\n\n// =============================================================================\n// TransactionContextHash Schema\n// =============================================================================\n\n/**\n * SHA-256 hash of JCS-canonicalized TransactionContext.\n * 64-character lowercase hex string.\n */\nexport const TransactionContextHashSchema = z\n    .string()\n    .regex(/^[a-f0-9]{64}$/, 'Must be 64-char lowercase hex');\n\nexport type TransactionContextHash = z.infer<typeof TransactionContextHashSchema>;\n\n// =============================================================================\n// Golden Fixtures (FROZEN)\n// =============================================================================\n\n/**\n * Golden fixtures for Phase 1 W schemas.\n * Used for drift detection and cross-repo alignment.\n */\nexport const W_GOLDEN_FIXTURES = {\n    /**\n     * encodeEpoch(1706486400000) = 2024-01-29T00:00:00.000Z\n     * Expected: 8 bytes, u64 big-endian\n     */\n    epochMs: 1706486400000,\n    expectedEpochBytes: new Uint8Array([0x00, 0x00, 0x01, 0x8d, 0x52, 0x84, 0x04, 0x00]),\n\n    /**\n     * Sample RelyingPartyId for test vectors\n     */\n    sampleRpId: {\n        domain: 'merchant.example.com',\n        audience_uri: 'https://merchant.example.com/verify',\n        verifier_key_hash: 'a'.repeat(64),\n    } satisfies RelyingPartyId,\n\n    /**\n     * Sample TransactionContext for test vectors\n     */\n    sampleTxContext: {\n        relying_party_id: {\n            domain: 'merchant.example.com',\n            audience_uri: 'https://merchant.example.com/verify',\n            verifier_key_hash: 'a'.repeat(64),\n        },\n        operation_hash: 'b'.repeat(64),\n        not_before: '2026-01-29T00:00:00Z',\n        not_after: '2026-01-29T00:05:00Z',\n    } satisfies TransactionContext,\n\n    /**\n     * MAX_WINDOW_MS: Maximum allowed not_after - not_before (5 minutes)\n     */\n    MAX_WINDOW_MS: 5 * 60 * 1000,\n} as const;\n\n// =============================================================================\n// Validation Helpers\n// =============================================================================\n\n/**\n * Validate transaction context time window.\n *\n * Enforces:\n * - not_after > not_before\n * - not_after - not_before <= MAX_WINDOW_MS\n *\n * @param context - Transaction context to validate\n * @returns true if valid, throws otherwise\n */\nexport function validateTimeWindow(context: TransactionContext): boolean {\n    let notBefore: number;\n    let notAfter: number;\n\n    try {\n        notBefore = parseRfc3339StrictToMs(context.not_before);\n        notAfter = parseRfc3339StrictToMs(context.not_after);\n    } catch {\n        throw new Error('Invalid timestamp: not_before/not_after must be RFC3339 with timezone');\n    }\n\n    if (notAfter <= notBefore) {\n        throw new Error('not_after must be greater than not_before');\n    }\n\n    const windowMs = notAfter - notBefore;\n    if (windowMs > W_GOLDEN_FIXTURES.MAX_WINDOW_MS) {\n        throw new Error(\n            `Time window ${windowMs}ms exceeds MAX_WINDOW_MS (${W_GOLDEN_FIXTURES.MAX_WINDOW_MS}ms)`\n        );\n    }\n\n    return true;\n}\n","/**\n * @hlos-ai/schemas - Agents Contracts\n *\n * Shared schemas for Agents Index + Passport Stub.\n * Routes are authoritative source of truth; these schemas validate conformance.\n *\n * Design choices:\n * - .passthrough() allows extra fields without breaking\n * - Enums use .or(z.string()) pattern for forward compatibility\n * - passport_id is z.null() as a boundary constraint\n */\n\nimport { z } from 'zod';\n\n// =============================================================================\n// AGENT ENUMS (Forward-compatible)\n// =============================================================================\n\n/**\n * AgentStatus - Known values documented, but accepts future additions.\n */\nexport const AgentStatusSchema = z\n    .enum(['ACTIVE', 'PENDING', 'SUSPENDED', 'REVOKED'])\n    .or(z.string().min(1));\n\nexport type AgentStatus = z.infer<typeof AgentStatusSchema>;\n\n/**\n * AgentType - Known values documented, but accepts future additions.\n */\nexport const AgentTypeSchema = z\n    .enum(['CUSTOM', 'CLAUDE', 'GPT', 'GEMINI', 'CURSOR', 'COPILOT', 'OTHER'])\n    .or(z.string().min(1));\n\nexport type AgentType = z.infer<typeof AgentTypeSchema>;\n\n// =============================================================================\n// AGENTS LIST RESPONSE\n// =============================================================================\n\n/**\n * Agent item in list response (snake_case wire format).\n */\nexport const AgentListItemSchema = z\n    .object({\n        id: z.string().min(1),\n        external_id: z.string().min(1),\n        name: z.string().min(1),\n        status: AgentStatusSchema,\n        agent_type: AgentTypeSchema,\n        trust_score: z.number().int().min(0).max(1000),\n        hosting_model: z.null(),\n        declared_tier: z.null(),\n        created_at: z.string().datetime(),\n    })\n    .passthrough();\n\nexport type AgentListItem = z.infer<typeof AgentListItemSchema>;\n\n/**\n * GET /api/agents response schema.\n * _meta.source: \"hlos\" (authoritative list)\n */\nexport const AgentsListResponseSchema = z\n    .object({\n        agents: z.array(AgentListItemSchema),\n        _meta: z.object({\n            source: z.literal('hlos'),\n        }),\n    })\n    .passthrough();\n\nexport type AgentsListResponse = z.infer<typeof AgentsListResponseSchema>;\n\n// =============================================================================\n// AGENT PASSPORT STUB RESPONSE\n// =============================================================================\n\n/**\n * GET /api/agents/[agentId]/passport response schema.\n *\n * BOUNDARY CONSTRAINT:\n * - passport_id MUST be null (HLOS does not mint passports)\n * - _meta.source: \"stub\" signals non-authoritative response\n * - All counters/tiers are null until backed by Agent-Passport system\n */\nexport const AgentPassportStubResponseSchema = z\n    .object({\n        passport_id: z.null(),\n        agent_id: z.string().min(1),\n        hosting_model: z.null(),\n        declared_tier: z.null(),\n        effective_tier: z.null(),\n        finality_level: z.null(),\n        graph: z\n            .object({\n                incoming_edges: z.null(),\n                outgoing_edges: z.null(),\n                active_visas: z.null(),\n            })\n            .passthrough(),\n        links: z\n            .object({\n                passport_url: z.string().startsWith('/agent-passport/agents/'),\n                docs_url: z.literal('/agents/passport'),\n            })\n            .passthrough(),\n        _meta: z.object({\n            source: z.literal('stub'),\n        }),\n    })\n    .passthrough();\n\nexport type AgentPassportStubResponse = z.infer<typeof AgentPassportStubResponseSchema>;\n","/**\n * @hlos-ai/schemas - Base64url Encoding Utilities\n *\n * RFC 4648 §5 compliant base64url encoding/decoding.\n * Zero external dependencies.\n *\n * Used for:\n * - receipt_hash: base64url(SHA-256(JCS(receipt)))\n * - content_hash: base64url(SHA-256(JCS(content)))\n * - crossing_hash: base64url(SHA-256(JCS(CrossingHashInputV0)))\n * - Ed25519 signatures and public keys\n */\n\nimport { z } from 'zod';\n\n// =============================================================================\n// Encoding\n// =============================================================================\n\n/**\n * Encode Uint8Array to base64url (RFC 4648 §5, no padding).\n */\nexport function bytesToBase64url(bytes: Uint8Array): string {\n    let binary = '';\n    for (let i = 0; i < bytes.length; i++) {\n        binary += String.fromCharCode(bytes[i]);\n    }\n    const base64 = btoa(binary);\n    return base64.replace(/\\+/g, '-').replace(/\\//g, '_').replace(/=+$/, '');\n}\n\n/**\n * Decode base64url string to Uint8Array.\n */\nexport function base64urlToBytes(str: string): Uint8Array {\n    const base64 = str.replace(/-/g, '+').replace(/_/g, '/');\n    const padded = base64 + '='.repeat((4 - (base64.length % 4)) % 4);\n    const binary = atob(padded);\n    const bytes = new Uint8Array(binary.length);\n    for (let i = 0; i < binary.length; i++) {\n        bytes[i] = binary.charCodeAt(i);\n    }\n    return bytes;\n}\n\n// =============================================================================\n// Schemas\n// =============================================================================\n\n/**\n * Regex for base64url-encoded SHA-256 hash (32 bytes = 43 chars, no padding).\n */\nexport const BASE64URL_SHA256_REGEX = /^[A-Za-z0-9_-]{43}$/;\n\n/**\n * Zod schema for a base64url-encoded SHA-256 hash.\n * 32 bytes = 43 chars base64url (no padding).\n */\nexport const Base64urlSha256Schema = z.string().regex(\n    BASE64URL_SHA256_REGEX,\n    'Must be 43-char base64url (32-byte SHA-256 digest)'\n);\n\n/**\n * Zod schema for a base64url-encoded Ed25519 signature.\n * 64 bytes = 86 chars base64url (no padding).\n */\nexport const Base64urlEd25519SigSchema = z.string().regex(\n    /^[A-Za-z0-9_-]{86}$/,\n    'Must be 86-char base64url (64-byte Ed25519 signature)'\n);\n","/**\n * @hlos-ai/schemas - Receipt Hash Computation\n *\n * Canonical hash computation for HLOS receipts.\n *\n * receipt_hash = base64url(SHA-256(JCS(receipt)))\n *\n * This is the hash that:\n * - BazaarReceiptEnvelope references (hash-first, per BRIDGE_SPEC.md §1.1)\n * - Notary Attestation (NA) binds to (per BRIDGE_SPEC.md §4.3)\n * - Surfaces use to reference kernel receipts unambiguously\n *\n * IMPORTANT: receipt_hash is computed over the ENTIRE SignedReceiptV0 envelope\n * (including content, content_hash, signature, key_id, etc.), NOT just content.\n * This binds the hash to a specific signed receipt version.\n *\n * Requires @noble/hashes as peer dependency.\n *\n * @see BRIDGE_SPEC.md §1.3 for canonical hashing requirements\n */\n\nimport { z } from 'zod';\nimport { bytesToBase64url, Base64urlSha256Schema } from './encoding';\nimport type { SignedReceiptV0 } from './receipt-v0';\n\nlet cachedSha256: ((data: Uint8Array) => Uint8Array) | null = null;\n\n// =============================================================================\n// JCS Canonicalization (RFC 8785)\n// =============================================================================\n\n/**\n * Recursively sort object keys lexicographically (RFC 8785 requirement).\n * @internal\n */\nfunction sortKeysDeep(value: unknown): unknown {\n    if (Array.isArray(value)) return value.map(sortKeysDeep);\n    if (value !== null && typeof value === 'object') {\n        const obj = value as Record<string, unknown>;\n        const out: Record<string, unknown> = {};\n        for (const key of Object.keys(obj).sort()) {\n            out[key] = sortKeysDeep(obj[key]);\n        }\n        return out;\n    }\n    return value;\n}\n\n/**\n * JCS (RFC 8785) canonical JSON serialization.\n *\n * Per RFC 8785:\n * - Object keys are lexicographically sorted\n * - Numbers use ES6 serialization\n * - Rejects: undefined, functions, symbols, bigint, non-finite numbers\n *\n * @throws Error if value contains non-canonicalizable types\n */\nexport function jcsCanonicalize(value: unknown): string {\n    return JSON.stringify(sortKeysDeep(value), (_key, v) => {\n        if (v === undefined) throw new Error('JCS: undefined is not allowed');\n        if (typeof v === 'function') throw new Error('JCS: function is not allowed');\n        if (typeof v === 'symbol') throw new Error('JCS: symbol is not allowed');\n        if (typeof v === 'bigint') throw new Error('JCS: bigint is not allowed');\n        if (typeof v === 'number' && !Number.isFinite(v))\n            throw new Error('JCS: non-finite number is not allowed');\n        return v;\n    });\n}\n\n// =============================================================================\n// Hash Computation\n// =============================================================================\n\n/**\n * Compute receipt_hash for a SignedReceiptV0.\n *\n * receipt_hash = base64url(SHA-256(JCS(receipt)))\n *\n * The hash is over the ENTIRE receipt envelope (content, content_hash,\n * signature, key_id, @type, version, receipt_id, issued_at).\n *\n * This is the canonical hash format per BRIDGE_SPEC.md §1.3:\n * 1. Canonicalize the receipt using RFC 8785 JCS\n * 2. Hash canonical bytes using SHA-256\n * 3. Encode as base64url (no padding)\n *\n * @param receipt - A fully-formed SignedReceiptV0 (must already be signed)\n * @returns 43-char base64url string (32-byte SHA-256 digest)\n *\n * @example\n * ```typescript\n * const receipt = issueReceiptV0(content);\n * const hash = computeReceiptHash(receipt);\n * // hash is e.g. \"z8A2kCNck4rPL4ugNe-Fbxputdi3PkjkVpSrIBhojU0\"\n * ```\n */\nexport function computeReceiptHash(receipt: SignedReceiptV0): string {\n    // Lazy-load to keep this module usable without @noble/hashes installed\n    // (only fails at call time if peer dep is missing)\n    const sha256 = loadSha256();\n    const canonical = jcsCanonicalize(receipt);\n    const digest = sha256(new TextEncoder().encode(canonical));\n    return bytesToBase64url(digest);\n}\n\n/**\n * Compute content_hash for arbitrary content.\n *\n * content_hash = base64url(SHA-256(JCS(content)))\n *\n * This is the hash stored in SignedReceiptV0.content_hash.\n * It hashes only the content field, NOT the entire receipt.\n *\n * @param content - The content to hash (will be JCS-canonicalized)\n * @returns 43-char base64url string (32-byte SHA-256 digest)\n */\nexport function computeContentHash(content: unknown): string {\n    const sha256 = loadSha256();\n    const canonical = jcsCanonicalize(content);\n    const digest = sha256(new TextEncoder().encode(canonical));\n    return bytesToBase64url(digest);\n}\n\n/**\n * Lazy-load SHA-256 from @noble/hashes (optional peer dependency).\n * @internal\n */\nfunction loadSha256(): (data: Uint8Array) => Uint8Array {\n    if (cachedSha256) return cachedSha256;\n\n    // Resolve require for both ESM and CJS contexts.\n    // In CJS (Jest/ts-jest): globalThis.require exists natively.\n    // In ESM (tsup build): createRequire bridges to Node's require.\n    let _require: NodeRequire;\n    try {\n        // eslint-disable-next-line @typescript-eslint/no-require-imports\n        const { createRequire } = require('node:module');\n        _require = createRequire(import.meta.url);\n    } catch {\n        // CJS context (e.g. Jest) — global require is available\n        // eslint-disable-next-line @typescript-eslint/no-require-imports\n        _require = require;\n    }\n\n    let sha256: (data: Uint8Array) => Uint8Array;\n    try {\n        // @noble/hashes v2.x exports from sha2.js\n        sha256 = _require('@noble/hashes/sha2.js').sha256;\n    } catch {\n        try {\n            // Fallback for bundlers that resolve without .js extension\n            sha256 = _require('@noble/hashes/sha2').sha256;\n        } catch {\n            throw new Error(\n                'computeReceiptHash/computeContentHash requires @noble/hashes as a peer dependency. ' +\n                'Install it: npm install @noble/hashes'\n            );\n        }\n    }\n    cachedSha256 = sha256;\n    return sha256;\n}\n\n// =============================================================================\n// Schemas\n// =============================================================================\n\n/**\n * Zod schema for receipt_hash field.\n * base64url(SHA-256(JCS(receipt))) — always 43 chars.\n */\nexport const ReceiptHashSchema = Base64urlSha256Schema.describe(\n    'receipt_hash: base64url(SHA-256(JCS(receipt)))'\n);\n\n// =============================================================================\n// Golden Fixtures\n// =============================================================================\n\n/**\n * Golden receipt fixture for hash conformance testing.\n *\n * This is a deterministic SignedReceiptV0 with fixed field values.\n * The receipt_hash computed over this fixture is FROZEN.\n *\n * If your computeReceiptHash() produces a different result for this input,\n * your implementation is non-conformant. DO NOT CHANGE these values.\n */\nexport const RECEIPT_HASH_GOLDEN_FIXTURE = {\n    receipt: {\n        '@type': 'https://hlos.ai/schema/SignedReceiptV0' as const,\n        version: 0 as const,\n        receipt_id: 'rcpt_01HZGOLDENTEST000000000000',\n        content: {\n            type: 'CrossingSettled' as const,\n            crossingId: 'cross_test123abc456def789ghi',\n            settlement_authority: 'hlos.ai',\n        },\n        // Placeholder bytes (NOT a valid cryptographic signature)\n        content_hash: 'AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA',\n        signature:\n            'AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA',\n        key_id: 'hlos-v2-1',\n        issued_at: '2026-01-27T00:00:00.000Z',\n    } satisfies SignedReceiptV0,\n\n    /**\n     * Expected JCS canonical form of the receipt.\n     * Keys are lexicographically sorted at all levels.\n     */\n    expectedJcs: '{\"@type\":\"https://hlos.ai/schema/SignedReceiptV0\",\"content\":{\"crossingId\":\"cross_test123abc456def789ghi\",\"settlement_authority\":\"hlos.ai\",\"type\":\"CrossingSettled\"},\"content_hash\":\"AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA\",\"issued_at\":\"2026-01-27T00:00:00.000Z\",\"key_id\":\"hlos-v2-1\",\"receipt_id\":\"rcpt_01HZGOLDENTEST000000000000\",\"signature\":\"AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA\",\"version\":0}',\n\n    /**\n     * Expected receipt_hash (FROZEN).\n     * Compute: JCS canonicalize receipt → SHA-256 → base64url (no padding)\n     *\n     * DO NOT CHANGE unless the receipt fixture above changes.\n     */\n    expectedReceiptHash: 'uLiQVUeVKcE35Rdje2fArZQfTcECDgwK6UbmQB_36Pg',\n} as const;\n","/**\n * @hlos-ai/schemas - Finality Schemas\n *\n * Defines the Notary Attestation (NA) schema and related types\n * for HLOS kernel-level HARD finality.\n *\n * Per BRIDGE_SPEC.md §4:\n * - SOFT finality: SignedReceiptV0 signed by settlement authority hlos.ai\n * - HARD finality: SignedReceiptV0 + NA where STAAMPID countersigns receipt_hash\n *\n * HARD finality is a platform feature (POST /api/finality/notarize),\n * not surface-specific. Any surface can request it.\n *\n * @see BRIDGE_SPEC.md §4.3 for NA schema\n * @see BRIDGE_SPEC.md §4.2 for notarize endpoint\n */\n\nimport { z } from 'zod';\nimport { Base64urlSha256Schema, Base64urlEd25519SigSchema } from './encoding';\nimport { SETTLEMENT_AUTHORITY } from './shared-contract';\n\n// =============================================================================\n// Constants\n// =============================================================================\n\n/**\n * NA ID prefix.\n */\nexport const NA_ID_PREFIX = 'na_' as const;\n\n/**\n * Finality levels.\n */\nexport const FinalityLevel = {\n    SOFT: 'SOFT',\n    HARD: 'HARD',\n} as const;\n\nexport type FinalityLevel = (typeof FinalityLevel)[keyof typeof FinalityLevel];\n\n// =============================================================================\n// ID Format\n// =============================================================================\n\n/**\n * Notary Attestation ID format: na_ + alphanumeric (20+ chars).\n */\nexport const NotaryAttestationIdFormatSchema = z.string().regex(\n    /^na_[a-zA-Z0-9]{20,}$/,\n    'NA ID must match na_[a-zA-Z0-9]{20,}'\n);\n\n// =============================================================================\n// Log Inclusion Proof (Optional Merkle Proof)\n// =============================================================================\n\n/**\n * Merkle proof for append-only log inclusion.\n * Future-proof: STAAMPID may provide this for auditable transparency.\n */\nexport const LogInclusionProofSchema = z.object({\n    /** Merkle root hash (base64url SHA-256) */\n    root: Base64urlSha256Schema,\n    /** Sibling hashes along the path (base64url SHA-256 each) */\n    proof: z.array(Base64urlSha256Schema),\n    /** Leaf index in the log */\n    index: z.number().int().nonnegative(),\n});\n\nexport type LogInclusionProof = z.infer<typeof LogInclusionProofSchema>;\n\n// =============================================================================\n// Notary Attestation (NA) — STAAMPID Response\n// =============================================================================\n\n/**\n * NotaryAttestation (NA): STAAMPID's countersignature over a receipt_hash.\n *\n * This is the artifact that promotes SOFT finality → HARD finality.\n * The notary binds to receipt_hash, NOT the receipt content directly.\n *\n * Required fields (per BRIDGE_SPEC.md §4.3):\n * - na_id: Unique NA identifier\n * - receipt_hash: The kernel receipt hash being attested\n * - notary_id: Identifier of the notary service\n * - issued_at: When the attestation was issued\n * - signature: The notary's countersignature\n * - signature_alg: Signature algorithm used\n *\n * Optional fields (future-proof):\n * - receipt_type, receipt_version: For schema evolution\n * - settlement_authority: Cross-check field\n * - validity_window_seconds, expires_at: TTL for NA validity\n * - log_inclusion: Merkle proof for append-only log\n */\nexport const NotaryAttestationSchema = z.object({\n    // --- Required ---\n    /** Unique NA identifier */\n    na_id: NotaryAttestationIdFormatSchema,\n    /** The receipt_hash this NA attests to */\n    receipt_hash: Base64urlSha256Schema,\n    /** Notary service identifier (e.g. \"staampid\") */\n    notary_id: z.string().min(1),\n    /** ISO 8601 timestamp when NA was issued */\n    issued_at: z.string().datetime(),\n    /** Notary's countersignature (base64url encoded) */\n    signature: z.string().min(1),\n    /** Signature algorithm (e.g. \"EdDSA\") */\n    signature_alg: z.string().min(1),\n\n    // --- Optional (future-proof) ---\n    /** Receipt type being attested */\n    receipt_type: z.string().optional(),\n    /** Receipt version being attested */\n    receipt_version: z.number().int().nonnegative().optional(),\n    /** Settlement authority that issued the receipt (cross-check) */\n    settlement_authority: z.string().optional(),\n    /** TTL in seconds for this attestation */\n    validity_window_seconds: z.number().int().positive().optional(),\n    /** ISO 8601 expiry (derived from issued_at + validity_window_seconds) */\n    expires_at: z.string().datetime().optional(),\n    /** Merkle proof for append-only log inclusion */\n    log_inclusion: LogInclusionProofSchema.optional(),\n});\n\nexport type NotaryAttestation = z.infer<typeof NotaryAttestationSchema>;\n\n// =============================================================================\n// Notary Request (HLOS → STAAMPID)\n// =============================================================================\n\n/**\n * NotaryRequest: The payload HLOS sends to STAAMPID to request a countersignature.\n *\n * This is a deterministic payload per BRIDGE_SPEC.md §4.3.\n * STAAMPID uses this to:\n * 1. Verify the receipt_hash is well-formed\n * 2. Log the attestation request\n * 3. Countersign and return NA\n */\nexport const NotaryRequestSchema = z.object({\n    /** receipt_hash to be attested (base64url SHA-256) */\n    receipt_hash: Base64urlSha256Schema,\n    /** Must be literal 'hlos.ai' */\n    settlement_authority: z.literal(SETTLEMENT_AUTHORITY),\n    /** Crossing this receipt belongs to */\n    crossing_id: z.string().min(1),\n    /** Type of the receipt being attested */\n    receipt_type: z.string().min(1),\n    /** Version of the receipt being attested */\n    receipt_version: z.number().int().nonnegative(),\n    /** ISO 8601 timestamp of the request */\n    timestamp: z.string().datetime(),\n    /** Optional: requested validity window in seconds */\n    validity_window_seconds: z.number().int().positive().optional(),\n});\n\nexport type NotaryRequest = z.infer<typeof NotaryRequestSchema>;\n\n// =============================================================================\n// Notarize API Response\n// =============================================================================\n\n/**\n * Status values for the notarize endpoint response.\n */\nexport const NotarizeStatusSchema = z.enum([\n    'HARD',          // NA obtained, finality upgraded\n    'PENDING',       // Notarization in progress (async)\n    'FAILED',        // Notarization failed\n    'ALREADY_HARD',  // Receipt already has NA\n]);\n\nexport type NotarizeStatus = z.infer<typeof NotarizeStatusSchema>;\n\n/**\n * Response from POST /api/finality/notarize.\n */\nexport const NotarizeResponseSchema = z.object({\n    /** Finality status after this operation */\n    status: NotarizeStatusSchema,\n    /** The receipt_hash that was notarized */\n    receipt_hash: Base64urlSha256Schema,\n    /** Hash of the NA itself (optional, present when status is HARD) */\n    na_hash: Base64urlSha256Schema.optional(),\n    /** The full NA object (optional embed) */\n    na: NotaryAttestationSchema.optional(),\n    /** Notary service identifier */\n    notary: z.string().min(1).optional(),\n    /** NA ID for retrieval */\n    notary_receipt_id: z.string().optional(),\n    /** ISO 8601 timestamp */\n    timestamp: z.string().datetime(),\n    /** Error details (present when status is FAILED) */\n    error: z.string().optional(),\n});\n\nexport type NotarizeResponse = z.infer<typeof NotarizeResponseSchema>;\n\n// =============================================================================\n// Type Guards\n// =============================================================================\n\n/**\n * Check if a value is a valid NotaryAttestation.\n */\nexport function isNotaryAttestation(value: unknown): value is NotaryAttestation {\n    return NotaryAttestationSchema.safeParse(value).success;\n}\n\n/**\n * Check if a value is a valid NotaryRequest.\n */\nexport function isNotaryRequest(value: unknown): value is NotaryRequest {\n    return NotaryRequestSchema.safeParse(value).success;\n}\n\n// =============================================================================\n// BazaarReceiptEnvelope Reference (for BRE assembly)\n// =============================================================================\n\n/**\n * ArtifactRef: A typed reference to a kernel artifact (for BRE assembly).\n * Per BRIDGE_SPEC.md §2.3.\n */\nexport const ArtifactRefSchema = z.object({\n    /** Artifact type */\n    type: z.enum(['CR', 'LAT', 'EGP', 'SA', 'SignedReceiptV0', 'NA']),\n    /** base64url SHA-256 hash of the artifact */\n    hash: Base64urlSha256Schema,\n    /** Issuer of the artifact */\n    issuer: z.string().min(1),\n    /** Schema version */\n    version: z.string().min(1),\n    /** Optional retrieval URI */\n    uri: z.string().url().optional(),\n});\n\nexport type ArtifactRef = z.infer<typeof ArtifactRefSchema>;\n\n// =============================================================================\n// Golden Fixtures\n// =============================================================================\n\n/**\n * Golden fixtures for finality schema conformance testing.\n *\n * These are deterministic test values. DO NOT CHANGE unless the\n * schema definition changes.\n */\nexport const FINALITY_GOLDEN_FIXTURES = {\n    /** Sample NotaryAttestation */\n    notaryAttestation: {\n        na_id: 'na_01HZGOLDENNATEST00000000',\n        receipt_hash: 'uLiQVUeVKcE35Rdje2fArZQfTcECDgwK6UbmQB_36Pg',\n        notary_id: 'staampid',\n        issued_at: '2026-01-27T00:01:00.000Z',\n        signature: 'dGVzdF9ub3Rhcnlfc2lnbmF0dXJlXzY0X2J5dGVzX3BhZGRlZF90b19maWxsXzg2X2NoYXJhY3RlcnNf',\n        signature_alg: 'EdDSA',\n        receipt_type: 'SignedReceiptV0',\n        receipt_version: 0,\n        settlement_authority: 'hlos.ai',\n    } satisfies NotaryAttestation,\n\n    /** Sample NotaryRequest */\n    notaryRequest: {\n        receipt_hash: 'uLiQVUeVKcE35Rdje2fArZQfTcECDgwK6UbmQB_36Pg',\n        settlement_authority: 'hlos.ai' as const,\n        crossing_id: 'cross_test123abc456def789ghi',\n        receipt_type: 'SignedReceiptV0',\n        receipt_version: 0,\n        timestamp: '2026-01-27T00:00:30.000Z',\n    } satisfies NotaryRequest,\n\n    /** Sample successful notarize response */\n    notarizeResponseHard: {\n        status: 'HARD' as const,\n        receipt_hash: 'uLiQVUeVKcE35Rdje2fArZQfTcECDgwK6UbmQB_36Pg',\n        na_hash: '_rkedsyWZhokzye55M9NRAvIKFTxFCYTHVOPjg9cAfU',\n        notary: 'staampid',\n        notary_receipt_id: 'na_01HZGOLDENNATEST00000000',\n        timestamp: '2026-01-27T00:01:00.000Z',\n    } satisfies NotarizeResponse,\n} as const;\n"],"mappings":";;;;;;;;;;;;;;;;;;;;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,+BAAAA;AAAA,EAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;;;ACOA,iBAAkB;AAMX,IAAM,gBAAgB,aAAE,KAAK;AAAA,EAChC;AAAA;AAAA,EACA;AAAA;AAAA,EACA;AAAA;AAAA,EACA;AAAA;AAAA,EACA;AAAA;AAAA,EACA;AAAA;AAAA,EACA;AAAA;AACJ,CAAC;AAOM,IAAM,WAAW,cAAc;;;AClBtC,IAAAC,cAAkB;;;ACHlB,IAAAC,cAAkB;AAKX,IAAM,wBAAwB,cAAE,KAAK;AAAA;AAAA,EAExC;AAAA;AAAA,EACA;AAAA;AAAA,EACA;AAAA;AAAA,EACA;AAAA;AAAA,EACA;AAAA;AAAA,EACA;AAAA;AAAA,EACA;AAAA;AAAA,EACA;AAAA;AAAA,EACA;AAAA;AAAA;AAAA,EAGA;AAAA;AAAA,EACA;AAAA;AACJ,CAAC;;;ADMM,SAAS,QAAW,MAAS,eAAuB,WAAwC;AAC/F,SAAO;AAAA,IACH,SAAS;AAAA,IACT;AAAA,IACA,MAAM;AAAA,MACF,gBAAgB;AAAA,MAChB,GAAI,aAAa,EAAE,YAAY,UAAU;AAAA,IAC7C;AAAA,EACJ;AACJ;AAsBO,SAAS,MACZ,MACA,SACA,eACA,SACa;AACb,SAAO;AAAA,IACH,SAAS;AAAA,IACT,OAAO;AAAA,MACH;AAAA,MACA;AAAA,MACA,gBAAgB;AAAA,MAChB,GAAI,YAAY,UAAa,EAAE,QAAQ;AAAA,IAC3C;AAAA,EACJ;AACJ;AAMO,IAAM,wBAAwB,CAAsB,eACvD,cAAE,OAAO;AAAA,EACL,SAAS,cAAE,QAAQ,IAAI;AAAA,EACvB,MAAM;AAAA,EACN,MAAM,cAAE,OAAO;AAAA,IACX,YAAY,cAAE,OAAO,EAAE,SAAS;AAAA,IAChC,gBAAgB,cAAE,OAAO;AAAA,EAC7B,CAAC,EAAE,SAAS;AAChB,CAAC;AAEE,IAAM,sBAAsB,cAAE,OAAO;AAAA,EACxC,SAAS,cAAE,QAAQ,KAAK;AAAA,EACxB,OAAO,cAAE,OAAO;AAAA,IACZ,MAAM;AAAA,IACN,SAAS,cAAE,OAAO;AAAA,IAClB,SAAS,cAAE,QAAQ,EAAE,SAAS;AAAA,IAC9B,gBAAgB,cAAE,OAAO;AAAA,EAC7B,CAAC;AACL,CAAC;;;AE9FD,IAAAC,cAAkB;AAUX,IAAM,mBAAmB;AAMzB,IAAM,kBAAkB;AA4ExB,IAAM,sBAAsB;AAC5B,IAAM,mBAAmB;AAEzB,IAAM,wBAAwB,CAAsB,kBACvD,cAAE,OAAO;AAAA,EACL,SAAS,cAAE,QAAQ,gBAAgB;AAAA,EACnC,SAAS,cAAE,QAAQ,eAAe;AAAA,EAClC,YAAY,cAAE,OAAO;AAAA,EACrB,SAAS;AAAA;AAAA,EAET,cAAc,cAAE,OAAO,EAAE;AAAA,IACrB;AAAA,IACA;AAAA,EACJ;AAAA;AAAA,EAEA,WAAW,cAAE,OAAO,EAAE;AAAA,IAClB;AAAA,IACA;AAAA,EACJ;AAAA,EACA,QAAQ,cAAE,OAAO,EAAE,IAAI,CAAC;AAAA,EACxB,WAAW,cAAE,OAAO,EAAE,SAAS;AACnC,CAAC;AAKE,IAAM,6BAA6B,sBAAsB,cAAE,QAAQ,CAAC;AASpE,SAAS,kBAAkB,OAA0C;AACxE,MAAI,OAAO,UAAU,YAAY,UAAU,KAAM,QAAO;AACxD,QAAM,MAAM;AACZ,SACI,IAAI,OAAO,MAAM,oBACjB,IAAI,SAAS,MAAM,mBACnB,OAAO,IAAI,YAAY,MAAM,YAC7B,OAAO,IAAI,cAAc,MAAM,YAC/B,OAAO,IAAI,WAAW,MAAM,YAC5B,OAAO,IAAI,QAAQ,MAAM,YACzB,OAAO,IAAI,WAAW,MAAM;AAEpC;;;AC7IA,IAAAC,cAAkB;AA8CX,IAAM,iBAAiB,cAAE,OAAO,EAClC,MAAM,2BAA2B,yBAAyB,EAC1D,UAAU,CAAC,MAAM,CAAa;AAK5B,IAAM,mBAAmB,cAAE,OAAO,EACpC,MAAM,6BAA6B,2BAA2B,EAC9D,UAAU,CAAC,MAAM,CAAe;AAK9B,IAAM,kBAAkB,cAAE,OAAO,EACnC,MAAM,kCAAkC,0BAA0B,EAClE,UAAU,CAAC,MAAM,CAAc;AAK7B,IAAM,sBAAsB,cAAE,OAAO,EACvC,IAAI,CAAC,EACL,IAAI,GAAG,EACP,UAAU,CAAC,MAAM,CAAkB;AAMjC,IAAM,uBAAuB,cAAE,OAAO,EACxC,IAAI,CAAC,EACL,IAAI,GAAG,EACP,MAAM,kBAAkB,wCAAwC,EAChE,UAAU,CAAC,MAAM,CAAmB;AAKlC,IAAM,mBAAmB,cAAE,OAAO,EACpC,MAAM,0BAA0B,2BAA2B,EAC3D,UAAU,CAAC,MAAM,CAAe;AAU9B,SAAS,WAAW,QAAwB;AAC/C,QAAM,YAAY,KAAK,IAAI,EAAE,SAAS,EAAE;AACxC,QAAM,SAAS,OAAO,WAAW,EAAE,QAAQ,MAAM,EAAE,EAAE,MAAM,GAAG,EAAE;AAChE,SAAO,GAAG,MAAM,IAAI,SAAS,GAAG,MAAM;AAC1C;AAEO,IAAM,mBAAmB,MAAgB,WAAW,QAAQ;AAC5D,IAAM,qBAAqB,MAAkB,WAAW,UAAU;AAClE,IAAM,oBAAoB,MAAiB,WAAW,MAAM;AAC5D,IAAM,qBAAqB,MAAkB,WAAW,OAAO;;;AClGtE,IAAAC,cAAkB;AAUX,IAAMC,yBAAwB,cAAE,KAAK;AAAA;AAAA,EAExC;AAAA;AAAA,EACA;AAAA;AAAA;AAAA,EAGA;AAAA;AAAA,EACA;AAAA;AAAA;AAAA,EAGA;AAAA;AAAA,EACA;AAAA;AAAA,EACA;AAAA;AAAA,EACA;AAAA;AAAA;AAAA,EAGA;AAAA;AAAA,EACA;AAAA;AAAA,EACA;AAAA;AAAA,EACA;AAAA;AAAA;AAAA,EAGA;AAAA;AAAA,EACA;AAAA;AAAA;AAAA,EAGA;AAAA;AAAA;AAAA,EAGA;AAAA;AAAA,EACA;AAAA;AACJ,CAAC;AAOM,IAAM,oBAAqD;AAAA,EAC9D,kBAAkB;AAAA,EAClB,iBAAiB;AAAA,EACjB,cAAc;AAAA,EACd,WAAW;AAAA,EACX,WAAW;AAAA,EACX,oBAAoB;AAAA,EACpB,iBAAiB;AAAA,EACjB,4BAA4B;AAAA,EAC5B,UAAU;AAAA,EACV,0BAA0B;AAAA,EAC1B,0BAA0B;AAAA,EAC1B,sBAAsB;AAAA,EACtB,sBAAsB;AAAA,EACtB,oBAAoB;AAAA,EACpB,cAAc;AAAA,EACd,gBAAgB;AAAA,EAChB,qBAAqB;AACzB;AAWO,IAAM,iBAAiB,CAAsB,eAChD,cAAE,OAAO;AAAA,EACL,IAAI,cAAE,QAAQ,IAAI;AAAA,EAClB,QAAQ,cAAE,MAAM;AAAA,IACZ,cAAE,OAAO,EAAE,IAAI,EAAE,IAAI,GAAG,EAAE,IAAI,GAAG;AAAA,IACjC,cAAE,QAAQ,GAAG;AAAA,EACjB,CAAC;AAAA,EACD,MAAM;AACV,CAAC;AAYE,IAAM,oBAAoB,cAAE,OAAO;AAAA,EACtC,IAAI,cAAE,QAAQ,KAAK;AAAA,EACnB,QAAQ,cAAE,OAAO,EAAE,IAAI,EAAE,IAAI,GAAG,EAAE,IAAI,GAAG;AAAA,EACzC,OAAO,cAAE,OAAO;AAAA,IACZ,MAAMA;AAAA;AAAA,IACN,SAAS,cAAE,OAAO;AAAA,IAClB,SAAS,cAAE,OAAO,cAAE,QAAQ,CAAC,EAAE,SAAS;AAAA,EAC5C,CAAC;AACL,CAAC;AAgBM,IAAM,yBAAyB,cAAE,OAAO,EAC1C,MAAM,0BAA0B,iDAAiD;AAK/E,IAAM,wBAAwB,cAAE,OAAO,EACzC,MAAM,kCAAkC,+CAA+C;AAKrF,IAAM,yBAAyB,cAAE,OAAO,EAC1C,MAAM,6BAA6B,oDAAoD;AAKrF,IAAM,uBAAuB,cAAE,OAAO,EACxC,MAAM,2BAA2B,gDAAgD;AAU/E,IAAM,sBAAsB,cAAE,KAAK,CAAC,WAAW,YAAY,MAAM,CAAC;AAMlE,IAAM,yBAAyB,cAAE,KAAK;AAAA,EACzC;AAAA;AAAA,EACA;AAAA;AAAA,EACA;AAAA;AACJ,CAAC;AAOM,SAAS,oBAAoB,kBAAmD;AACnF,UAAQ,kBAAkB;AAAA,IACtB,KAAK;AACD,aAAO;AAAA,IACX,KAAK;AACD,aAAO;AAAA,IACX,KAAK;AACD,aAAO;AAAA,EACf;AACJ;AAYO,IAAM,2BAA2B,cAAE,OAAO;AAAA,EAC7C,YAAY;AAAA,EACZ,cAAc,cAAE,OAAO;AAAA,EACvB,YAAY;AAAA;AAAA,EAGZ,UAAU,cAAE,OAAO,EAAE,SAAS;AAAA,EAC9B,kBAAkB,cAAE,OAAO,EAAE,SAAS;AAAA,EACtC,iBAAiB,cAAE,OAAO,EAAE,SAAS;AAAA;AAAA,EAGrC,oBAAoB,cAAE,OAAO,EAAE,SAAS;AAAA,EACxC,gBAAgB,oBAAoB,SAAS;AAAA,EAC7C,mBAAmB;AACvB,CAAC;AAQM,IAAM,4BAA4B,cAAE,OAAO;AAAA,EAC9C,GAAG,cAAE,QAAQ,CAAC;AAAA,EACd,UAAU;AAAA,EACV,qBAAqB;AACzB,CAAC;AAWM,IAAM,uBAAuB;AAK7B,IAAM,+BAA+B,cAAE,OAAO;AAAA,EACjD,MAAM,cAAE,QAAQ,iBAAiB;AAAA,EACjC,YAAY;AAAA;AAAA,EAGZ,UAAU,cAAE,OAAO,EAAE,SAAS;AAAA,EAC9B,kBAAkB,cAAE,OAAO,EAAE,SAAS;AAAA,EACtC,iBAAiB,cAAE,OAAO,EAAE,SAAS;AAAA;AAAA,EAGrC,oBAAoB,cAAE,OAAO,EAAE,SAAS;AAAA,EACxC,gBAAgB,oBAAoB,SAAS;AAAA,EAC7C,mBAAmB;AAAA;AAAA,EAGnB,sBAAsB,cAAE,QAAQ,oBAAoB;AAAA;AAAA,EAGpD,eAAe,cAAE,OAAO;AAAA;AAAA,EACxB,qBAAqB,cAAE,OAAO;AAAA;AAAA,EAG9B,YAAY,cAAE,OAAO,EAAE,SAAS;AACpC,CAAC;AAWM,IAAM,yBAAyB,cAAE,KAAK;AAAA,EACzC;AAAA;AAAA,EACA;AAAA;AAAA,EACA;AAAA;AACJ,CAAC;AAMM,IAAM,qBAAqB,cAAE,KAAK;AAAA,EACrC;AAAA;AAAA,EACA;AAAA;AAAA,EACA;AAAA;AAAA,EACA;AAAA;AAAA,EACA;AAAA;AAAA,EACA;AAAA;AAAA,EACA;AAAA;AAAA,EACA;AAAA;AAAA,EACA;AAAA;AACJ,CAAC;AAMM,IAAM,sBAAsB,cAAE,OAAO;AAAA,EACxC,aAAa,cAAE,OAAO;AAAA,EACtB,MAAM;AAAA;AAAA,EACN,cAAc,cAAE,OAAO;AAAA,EACvB,mBAAmB,cAAE,OAAO,EAAE,YAAY;AAAA,EAC1C,SAAS,cAAE,MAAM,cAAE,OAAO,CAAC;AAAA,EAC3B,mBAAmB;AACvB,CAAC;AAOM,IAAM,cAAc,cAAE,OAAO;AAAA,EAChC,IAAI,cAAE,OAAO;AAAA,EACb,MAAM,cAAE,OAAO;AAAA,EACf,MAAM,cAAE,OAAO;AAAA,EACf,SAAS,cAAE,OAAO;AAAA,EAClB,MAAM,cAAE,OAAO;AAAA,EACf,WAAW,cAAE,MAAM,mBAAmB;AAAA,EACtC,iBAAiB,cAAE,OAAO,EAAE,SAAS;AAAA,EACrC,cAAc,cAAE,OAAO,EAAE,YAAY;AAAA,EACrC,UAAU,cAAE,OAAO,EAAE,SAAS;AAAA;AAClC,CAAC;AAOM,IAAM,wBAAwB,cAAE,OAAO;AAAA,EAC1C,IAAI,cAAE,OAAO;AAAA,EACb,UAAU,cAAE,OAAO;AAAA,EACnB,aAAa,cAAE,OAAO;AAAA,EACtB,SAAS,cAAE,OAAO,EAAE,SAAS;AAAA,EAC7B,gBAAgB,cAAE,OAAO;AAAA,EACzB,cAAc,cAAE,OAAO,EAAE,SAAS;AAAA,EAClC,qBAAqB,cAAE,MAAM,cAAE,OAAO,CAAC;AAC3C,CAAC;AAWM,SAAS,SAAY,MAAS,SAAiB,KAAkB;AACpE,SAAO,EAAE,IAAI,MAAM,QAAQ,KAAK;AACpC;AAKO,SAAS,YACZ,MACA,SACA,QACA,SACW;AACX,SAAO;AAAA,IACH,IAAI;AAAA,IACJ,QAAQ,UAAU,kBAAkB,IAAI;AAAA,IACxC,OAAO;AAAA,MACH;AAAA,MACA;AAAA,MACA,GAAI,WAAW,EAAE,QAAQ;AAAA,IAC7B;AAAA,EACJ;AACJ;AAWO,IAAM,kBAAkB;AAAA;AAAA;AAAA;AAAA,EAI3B,mBAAmB;AAAA,IACf,GAAG;AAAA,IACH,UAAU;AAAA,MACN,YAAY;AAAA,MACZ,cAAc;AAAA,MACd,YAAY;AAAA,MACZ,UAAU;AAAA,MACV,kBAAkB;AAAA,MAClB,iBAAiB;AAAA,MACjB,oBAAoB;AAAA,MACpB,gBAAgB;AAAA,MAChB,mBAAmB;AAAA,IACvB;AAAA,IACA,qBAAqB;AAAA,EACzB;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EASA,8CAA8C;AAAA;AAAA;AAAA;AAAA,EAK9C,wBAAwB;AAAA,IACpB,MAAM;AAAA,IACN,YAAY;AAAA,IACZ,UAAU;AAAA,IACV,kBAAkB;AAAA,IAClB,iBAAiB;AAAA,IACjB,oBAAoB;AAAA,IACpB,gBAAgB;AAAA,IAChB,mBAAmB;AAAA,IACnB,sBAAsB;AAAA,IACtB,eAAe;AAAA,IACf,qBAAqB;AAAA,IACrB,YAAY;AAAA,EAChB;AACJ;AAKO,SAAS,sBAAsB,OAA8C;AAChF,SAAO,0BAA0B,UAAU,KAAK,EAAE;AACtD;AAKO,SAAS,yBAAyB,OAAiD;AACtF,SAAO,6BAA6B,UAAU,KAAK,EAAE;AACzD;;;AClbA,IAAAC,cAAkB;AAUX,IAAM,gBAAgB,IAAI,YAAY,EAAE,OAAO,WAAW;AAK1D,IAAM,iBAAiB,IAAI,YAAY,EAAE,OAAO,YAAY;AAuBnE,IAAM,oBACF;AAEJ,SAAS,WAAW,MAAuB;AACvC,SAAQ,OAAO,MAAM,KAAK,OAAO,QAAQ,KAAO,OAAO,QAAQ;AACnE;AAEA,SAAS,YAAY,MAAc,OAAuB;AACtD,QAAM,OAAO,CAAC,IAAI,WAAW,IAAI,IAAI,KAAK,IAAI,IAAI,IAAI,IAAI,IAAI,IAAI,IAAI,IAAI,IAAI,IAAI,EAAE;AACpF,SAAO,KAAK,QAAQ,CAAC,KAAK;AAC9B;AAEA,SAAS,uBAAuB,OAAuB;AACnD,QAAM,QAAQ,kBAAkB,KAAK,KAAK;AAC1C,MAAI,CAAC,OAAO;AACR,UAAM,IAAI;AAAA,MACN,mBAAmB,KAAK;AAAA,IAC5B;AAAA,EACJ;AAEA,QAAM,OAAO,OAAO,MAAM,CAAC,CAAC;AAC5B,QAAM,QAAQ,OAAO,MAAM,CAAC,CAAC;AAC7B,QAAM,MAAM,OAAO,MAAM,CAAC,CAAC;AAC3B,QAAM,OAAO,OAAO,MAAM,CAAC,CAAC;AAC5B,QAAM,SAAS,OAAO,MAAM,CAAC,CAAC;AAC9B,QAAM,SAAS,OAAO,MAAM,CAAC,CAAC;AAC9B,QAAM,WAAW,MAAM,CAAC,KAAK;AAC7B,QAAM,KAAK,MAAM,CAAC;AAElB,MAAI,QAAQ,KAAK,QAAQ,IAAI;AACzB,UAAM,IAAI,MAAM,mCAAmC;AAAA,EACvD;AACA,QAAM,SAAS,YAAY,MAAM,KAAK;AACtC,MAAI,MAAM,KAAK,MAAM,QAAQ;AACzB,UAAM,IAAI,MAAM,iCAAiC;AAAA,EACrD;AACA,MAAI,OAAO,IAAI;AACX,UAAM,IAAI,MAAM,kCAAkC;AAAA,EACtD;AACA,MAAI,SAAS,IAAI;AACb,UAAM,IAAI,MAAM,oCAAoC;AAAA,EACxD;AACA,MAAI,SAAS,IAAI;AACb,UAAM,IAAI,MAAM,oCAAoC;AAAA,EACxD;AAEA,QAAM,aAAa,SAAS,SAAS,QAAQ,WAAW,OAAO,MAAM,GAAG,CAAC,CAAC,IAAI;AAC9E,QAAM,QAAQ,KAAK,IAAI,MAAM,QAAQ,GAAG,KAAK,MAAM,QAAQ,QAAQ,UAAU;AAE7E,MAAI,WAAW;AACf,MAAI,OAAO,KAAK;AACZ,UAAM,OAAO,MAAM,EAAE,MAAM,MAAM,KAAK;AACtC,UAAM,aAAa,OAAO,MAAM,EAAE,CAAC;AACnC,UAAM,eAAe,OAAO,MAAM,EAAE,CAAC;AACrC,QAAI,aAAa,IAAI;AACjB,YAAM,IAAI,MAAM,qCAAqC;AAAA,IACzD;AACA,QAAI,eAAe,IAAI;AACnB,YAAM,IAAI,MAAM,uCAAuC;AAAA,IAC3D;AACA,eAAW,QAAQ,aAAa,KAAK,gBAAgB;AAAA,EACzD;AAEA,QAAM,KAAK,QAAQ;AACnB,MAAI,CAAC,OAAO,SAAS,EAAE,KAAK,KAAK,GAAG;AAChC,UAAM,IAAI,MAAM,iDAAiD;AAAA,EACrE;AAEA,SAAO;AACX;AAEO,SAAS,YAAY,OAAoC;AAC5D,MAAI;AAEJ,MAAI,OAAO,UAAU,UAAU;AAC3B,SAAK,uBAAuB,KAAK;AAAA,EACrC,OAAO;AACH,QAAI,CAAC,OAAO,UAAU,KAAK,KAAK,QAAQ,GAAG;AACvC,YAAM,IAAI,MAAM,kBAAkB,KAAK,iCAAiC;AAAA,IAC5E;AACA,SAAK;AAAA,EACT;AAEA,QAAM,MAAM,IAAI,YAAY,CAAC;AAC7B,QAAM,OAAO,IAAI,SAAS,GAAG;AAC7B,OAAK,aAAa,GAAG,OAAO,EAAE,GAAG,KAAK;AACtC,SAAO,IAAI,WAAW,GAAG;AAC7B;AAUO,IAAM,uBAAuB,cAAE,OAAO;AAAA;AAAA,EAEzC,QAAQ,cAAE,OAAO,EAAE,IAAI,CAAC,EAAE,IAAI,GAAG;AAAA;AAAA,EAEjC,cAAc,cAAE,OAAO,EAAE,IAAI;AAAA;AAAA,EAE7B,mBAAmB,cAAE,OAAO,EAAE,MAAM,kBAAkB,+BAA+B;AACzF,CAAC;AAiBM,IAAM,sBAAsB,cAAE,MAAM;AAAA,EACvC,cAAE,OAAO,EAAE,IAAI,EAAE,YAAY;AAAA,EAC7B,cAAE,OAAO,EAAE,SAAS,EAAE,QAAQ,KAAK,CAAC;AAAA;AACxC,CAAC;AAaM,IAAM,aAAa,cACrB,OAAO,EACP,OAAO,IAAI,gEAAgE,EAC3E,MAAM,oBAAoB,gCAAgC;AAoBxD,IAAM,2BAA2B,cAAE,OAAO;AAAA;AAAA,EAE7C,kBAAkB;AAAA;AAAA,EAElB,gBAAgB,cAAE,OAAO,EAAE,MAAM,kBAAkB,+BAA+B;AAAA;AAAA,EAElF,YAAY,cAAE,OAAO,EAAE,SAAS,EAAE,QAAQ,KAAK,CAAC;AAAA;AAAA,EAEhD,WAAW,cAAE,OAAO,EAAE,SAAS,EAAE,QAAQ,KAAK,CAAC;AAAA;AAAA,EAG/C,QAAQ,cAAE,OAAO,EAAE,YAAY,EAAE,SAAS;AAAA,EAC1C,UAAU,cAAE,OAAO,EAAE,OAAO,CAAC,EAAE,SAAS;AAAA,EACxC,YAAY,cAAE,OAAO,EAAE,SAAS;AAAA,EAChC,YAAY,cAAE,OAAO,EAAE,SAAS;AACpC,CAAC;AAYM,IAAM,+BAA+B,cACvC,OAAO,EACP,MAAM,kBAAkB,+BAA+B;AAYrD,IAAM,oBAAoB;AAAA;AAAA;AAAA;AAAA;AAAA,EAK7B,SAAS;AAAA,EACT,oBAAoB,IAAI,WAAW,CAAC,GAAM,GAAM,GAAM,KAAM,IAAM,KAAM,GAAM,CAAI,CAAC;AAAA;AAAA;AAAA;AAAA,EAKnF,YAAY;AAAA,IACR,QAAQ;AAAA,IACR,cAAc;AAAA,IACd,mBAAmB,IAAI,OAAO,EAAE;AAAA,EACpC;AAAA;AAAA;AAAA;AAAA,EAKA,iBAAiB;AAAA,IACb,kBAAkB;AAAA,MACd,QAAQ;AAAA,MACR,cAAc;AAAA,MACd,mBAAmB,IAAI,OAAO,EAAE;AAAA,IACpC;AAAA,IACA,gBAAgB,IAAI,OAAO,EAAE;AAAA,IAC7B,YAAY;AAAA,IACZ,WAAW;AAAA,EACf;AAAA;AAAA;AAAA;AAAA,EAKA,eAAe,IAAI,KAAK;AAC5B;AAgBO,SAAS,mBAAmB,SAAsC;AACrE,MAAI;AACJ,MAAI;AAEJ,MAAI;AACA,gBAAY,uBAAuB,QAAQ,UAAU;AACrD,eAAW,uBAAuB,QAAQ,SAAS;AAAA,EACvD,QAAQ;AACJ,UAAM,IAAI,MAAM,uEAAuE;AAAA,EAC3F;AAEA,MAAI,YAAY,WAAW;AACvB,UAAM,IAAI,MAAM,2CAA2C;AAAA,EAC/D;AAEA,QAAM,WAAW,WAAW;AAC5B,MAAI,WAAW,kBAAkB,eAAe;AAC5C,UAAM,IAAI;AAAA,MACN,eAAe,QAAQ,6BAA6B,kBAAkB,aAAa;AAAA,IACvF;AAAA,EACJ;AAEA,SAAO;AACX;;;AC3TA,IAAAC,cAAkB;AASX,IAAM,oBAAoB,cAC5B,KAAK,CAAC,UAAU,WAAW,aAAa,SAAS,CAAC,EAClD,GAAG,cAAE,OAAO,EAAE,IAAI,CAAC,CAAC;AAOlB,IAAM,kBAAkB,cAC1B,KAAK,CAAC,UAAU,UAAU,OAAO,UAAU,UAAU,WAAW,OAAO,CAAC,EACxE,GAAG,cAAE,OAAO,EAAE,IAAI,CAAC,CAAC;AAWlB,IAAM,sBAAsB,cAC9B,OAAO;AAAA,EACJ,IAAI,cAAE,OAAO,EAAE,IAAI,CAAC;AAAA,EACpB,aAAa,cAAE,OAAO,EAAE,IAAI,CAAC;AAAA,EAC7B,MAAM,cAAE,OAAO,EAAE,IAAI,CAAC;AAAA,EACtB,QAAQ;AAAA,EACR,YAAY;AAAA,EACZ,aAAa,cAAE,OAAO,EAAE,IAAI,EAAE,IAAI,CAAC,EAAE,IAAI,GAAI;AAAA,EAC7C,eAAe,cAAE,KAAK;AAAA,EACtB,eAAe,cAAE,KAAK;AAAA,EACtB,YAAY,cAAE,OAAO,EAAE,SAAS;AACpC,CAAC,EACA,YAAY;AAQV,IAAM,2BAA2B,cACnC,OAAO;AAAA,EACJ,QAAQ,cAAE,MAAM,mBAAmB;AAAA,EACnC,OAAO,cAAE,OAAO;AAAA,IACZ,QAAQ,cAAE,QAAQ,MAAM;AAAA,EAC5B,CAAC;AACL,CAAC,EACA,YAAY;AAgBV,IAAM,kCAAkC,cAC1C,OAAO;AAAA,EACJ,aAAa,cAAE,KAAK;AAAA,EACpB,UAAU,cAAE,OAAO,EAAE,IAAI,CAAC;AAAA,EAC1B,eAAe,cAAE,KAAK;AAAA,EACtB,eAAe,cAAE,KAAK;AAAA,EACtB,gBAAgB,cAAE,KAAK;AAAA,EACvB,gBAAgB,cAAE,KAAK;AAAA,EACvB,OAAO,cACF,OAAO;AAAA,IACJ,gBAAgB,cAAE,KAAK;AAAA,IACvB,gBAAgB,cAAE,KAAK;AAAA,IACvB,cAAc,cAAE,KAAK;AAAA,EACzB,CAAC,EACA,YAAY;AAAA,EACjB,OAAO,cACF,OAAO;AAAA,IACJ,cAAc,cAAE,OAAO,EAAE,WAAW,yBAAyB;AAAA,IAC7D,UAAU,cAAE,QAAQ,kBAAkB;AAAA,EAC1C,CAAC,EACA,YAAY;AAAA,EACjB,OAAO,cAAE,OAAO;AAAA,IACZ,QAAQ,cAAE,QAAQ,MAAM;AAAA,EAC5B,CAAC;AACL,CAAC,EACA,YAAY;;;AClGjB,IAAAC,cAAkB;AASX,SAAS,iBAAiB,OAA2B;AACxD,MAAI,SAAS;AACb,WAAS,IAAI,GAAG,IAAI,MAAM,QAAQ,KAAK;AACnC,cAAU,OAAO,aAAa,MAAM,CAAC,CAAC;AAAA,EAC1C;AACA,QAAM,SAAS,KAAK,MAAM;AAC1B,SAAO,OAAO,QAAQ,OAAO,GAAG,EAAE,QAAQ,OAAO,GAAG,EAAE,QAAQ,OAAO,EAAE;AAC3E;AAKO,SAAS,iBAAiB,KAAyB;AACtD,QAAM,SAAS,IAAI,QAAQ,MAAM,GAAG,EAAE,QAAQ,MAAM,GAAG;AACvD,QAAM,SAAS,SAAS,IAAI,QAAQ,IAAK,OAAO,SAAS,KAAM,CAAC;AAChE,QAAM,SAAS,KAAK,MAAM;AAC1B,QAAM,QAAQ,IAAI,WAAW,OAAO,MAAM;AAC1C,WAAS,IAAI,GAAG,IAAI,OAAO,QAAQ,KAAK;AACpC,UAAM,CAAC,IAAI,OAAO,WAAW,CAAC;AAAA,EAClC;AACA,SAAO;AACX;AASO,IAAM,yBAAyB;AAM/B,IAAM,wBAAwB,cAAE,OAAO,EAAE;AAAA,EAC5C;AAAA,EACA;AACJ;AAMO,IAAM,4BAA4B,cAAE,OAAO,EAAE;AAAA,EAChD;AAAA,EACA;AACJ;;;ACtEA;AAyBA,IAAI,eAA0D;AAU9D,SAAS,aAAa,OAAyB;AAC3C,MAAI,MAAM,QAAQ,KAAK,EAAG,QAAO,MAAM,IAAI,YAAY;AACvD,MAAI,UAAU,QAAQ,OAAO,UAAU,UAAU;AAC7C,UAAM,MAAM;AACZ,UAAM,MAA+B,CAAC;AACtC,eAAW,OAAO,OAAO,KAAK,GAAG,EAAE,KAAK,GAAG;AACvC,UAAI,GAAG,IAAI,aAAa,IAAI,GAAG,CAAC;AAAA,IACpC;AACA,WAAO;AAAA,EACX;AACA,SAAO;AACX;AAYO,SAAS,gBAAgB,OAAwB;AACpD,SAAO,KAAK,UAAU,aAAa,KAAK,GAAG,CAAC,MAAM,MAAM;AACpD,QAAI,MAAM,OAAW,OAAM,IAAI,MAAM,+BAA+B;AACpE,QAAI,OAAO,MAAM,WAAY,OAAM,IAAI,MAAM,8BAA8B;AAC3E,QAAI,OAAO,MAAM,SAAU,OAAM,IAAI,MAAM,4BAA4B;AACvE,QAAI,OAAO,MAAM,SAAU,OAAM,IAAI,MAAM,4BAA4B;AACvE,QAAI,OAAO,MAAM,YAAY,CAAC,OAAO,SAAS,CAAC;AAC3C,YAAM,IAAI,MAAM,uCAAuC;AAC3D,WAAO;AAAA,EACX,CAAC;AACL;AA6BO,SAAS,mBAAmB,SAAkC;AAGjE,QAAM,SAAS,WAAW;AAC1B,QAAM,YAAY,gBAAgB,OAAO;AACzC,QAAM,SAAS,OAAO,IAAI,YAAY,EAAE,OAAO,SAAS,CAAC;AACzD,SAAO,iBAAiB,MAAM;AAClC;AAaO,SAAS,mBAAmB,SAA0B;AACzD,QAAM,SAAS,WAAW;AAC1B,QAAM,YAAY,gBAAgB,OAAO;AACzC,QAAM,SAAS,OAAO,IAAI,YAAY,EAAE,OAAO,SAAS,CAAC;AACzD,SAAO,iBAAiB,MAAM;AAClC;AAMA,SAAS,aAA+C;AACpD,MAAI,aAAc,QAAO;AAKzB,MAAI;AACJ,MAAI;AAEA,UAAM,EAAE,cAAc,IAAI,QAAQ,QAAa;AAC/C,eAAW,cAAc,YAAY,GAAG;AAAA,EAC5C,QAAQ;AAGJ,eAAW;AAAA,EACf;AAEA,MAAI;AACJ,MAAI;AAEA,aAAS,SAAS,uBAAuB,EAAE;AAAA,EAC/C,QAAQ;AACJ,QAAI;AAEA,eAAS,SAAS,oBAAoB,EAAE;AAAA,IAC5C,QAAQ;AACJ,YAAM,IAAI;AAAA,QACN;AAAA,MAEJ;AAAA,IACJ;AAAA,EACJ;AACA,iBAAe;AACf,SAAO;AACX;AAUO,IAAM,oBAAoB,sBAAsB;AAAA,EACnD;AACJ;AAeO,IAAM,8BAA8B;AAAA,EACvC,SAAS;AAAA,IACL,SAAS;AAAA,IACT,SAAS;AAAA,IACT,YAAY;AAAA,IACZ,SAAS;AAAA,MACL,MAAM;AAAA,MACN,YAAY;AAAA,MACZ,sBAAsB;AAAA,IAC1B;AAAA;AAAA,IAEA,cAAc;AAAA,IACd,WACI;AAAA,IACJ,QAAQ;AAAA,IACR,WAAW;AAAA,EACf;AAAA;AAAA;AAAA;AAAA;AAAA,EAMA,aAAa;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAQb,qBAAqB;AACzB;;;AC3MA,IAAAC,eAAkB;AAWX,IAAM,eAAe;AAKrB,IAAM,gBAAgB;AAAA,EACzB,MAAM;AAAA,EACN,MAAM;AACV;AAWO,IAAM,kCAAkC,eAAE,OAAO,EAAE;AAAA,EACtD;AAAA,EACA;AACJ;AAUO,IAAM,0BAA0B,eAAE,OAAO;AAAA;AAAA,EAE5C,MAAM;AAAA;AAAA,EAEN,OAAO,eAAE,MAAM,qBAAqB;AAAA;AAAA,EAEpC,OAAO,eAAE,OAAO,EAAE,IAAI,EAAE,YAAY;AACxC,CAAC;AA4BM,IAAM,0BAA0B,eAAE,OAAO;AAAA;AAAA;AAAA,EAG5C,OAAO;AAAA;AAAA,EAEP,cAAc;AAAA;AAAA,EAEd,WAAW,eAAE,OAAO,EAAE,IAAI,CAAC;AAAA;AAAA,EAE3B,WAAW,eAAE,OAAO,EAAE,SAAS;AAAA;AAAA,EAE/B,WAAW,eAAE,OAAO,EAAE,IAAI,CAAC;AAAA;AAAA,EAE3B,eAAe,eAAE,OAAO,EAAE,IAAI,CAAC;AAAA;AAAA;AAAA,EAI/B,cAAc,eAAE,OAAO,EAAE,SAAS;AAAA;AAAA,EAElC,iBAAiB,eAAE,OAAO,EAAE,IAAI,EAAE,YAAY,EAAE,SAAS;AAAA;AAAA,EAEzD,sBAAsB,eAAE,OAAO,EAAE,SAAS;AAAA;AAAA,EAE1C,yBAAyB,eAAE,OAAO,EAAE,IAAI,EAAE,SAAS,EAAE,SAAS;AAAA;AAAA,EAE9D,YAAY,eAAE,OAAO,EAAE,SAAS,EAAE,SAAS;AAAA;AAAA,EAE3C,eAAe,wBAAwB,SAAS;AACpD,CAAC;AAiBM,IAAM,sBAAsB,eAAE,OAAO;AAAA;AAAA,EAExC,cAAc;AAAA;AAAA,EAEd,sBAAsB,eAAE,QAAQ,oBAAoB;AAAA;AAAA,EAEpD,aAAa,eAAE,OAAO,EAAE,IAAI,CAAC;AAAA;AAAA,EAE7B,cAAc,eAAE,OAAO,EAAE,IAAI,CAAC;AAAA;AAAA,EAE9B,iBAAiB,eAAE,OAAO,EAAE,IAAI,EAAE,YAAY;AAAA;AAAA,EAE9C,WAAW,eAAE,OAAO,EAAE,SAAS;AAAA;AAAA,EAE/B,yBAAyB,eAAE,OAAO,EAAE,IAAI,EAAE,SAAS,EAAE,SAAS;AAClE,CAAC;AAWM,IAAM,uBAAuB,eAAE,KAAK;AAAA,EACvC;AAAA;AAAA,EACA;AAAA;AAAA,EACA;AAAA;AAAA,EACA;AAAA;AACJ,CAAC;AAOM,IAAM,yBAAyB,eAAE,OAAO;AAAA;AAAA,EAE3C,QAAQ;AAAA;AAAA,EAER,cAAc;AAAA;AAAA,EAEd,SAAS,sBAAsB,SAAS;AAAA;AAAA,EAExC,IAAI,wBAAwB,SAAS;AAAA;AAAA,EAErC,QAAQ,eAAE,OAAO,EAAE,IAAI,CAAC,EAAE,SAAS;AAAA;AAAA,EAEnC,mBAAmB,eAAE,OAAO,EAAE,SAAS;AAAA;AAAA,EAEvC,WAAW,eAAE,OAAO,EAAE,SAAS;AAAA;AAAA,EAE/B,OAAO,eAAE,OAAO,EAAE,SAAS;AAC/B,CAAC;AAWM,SAAS,oBAAoB,OAA4C;AAC5E,SAAO,wBAAwB,UAAU,KAAK,EAAE;AACpD;AAKO,SAAS,gBAAgB,OAAwC;AACpE,SAAO,oBAAoB,UAAU,KAAK,EAAE;AAChD;AAUO,IAAM,oBAAoB,eAAE,OAAO;AAAA;AAAA,EAEtC,MAAM,eAAE,KAAK,CAAC,MAAM,OAAO,OAAO,MAAM,mBAAmB,IAAI,CAAC;AAAA;AAAA,EAEhE,MAAM;AAAA;AAAA,EAEN,QAAQ,eAAE,OAAO,EAAE,IAAI,CAAC;AAAA;AAAA,EAExB,SAAS,eAAE,OAAO,EAAE,IAAI,CAAC;AAAA;AAAA,EAEzB,KAAK,eAAE,OAAO,EAAE,IAAI,EAAE,SAAS;AACnC,CAAC;AAcM,IAAM,2BAA2B;AAAA;AAAA,EAEpC,mBAAmB;AAAA,IACf,OAAO;AAAA,IACP,cAAc;AAAA,IACd,WAAW;AAAA,IACX,WAAW;AAAA,IACX,WAAW;AAAA,IACX,eAAe;AAAA,IACf,cAAc;AAAA,IACd,iBAAiB;AAAA,IACjB,sBAAsB;AAAA,EAC1B;AAAA;AAAA,EAGA,eAAe;AAAA,IACX,cAAc;AAAA,IACd,sBAAsB;AAAA,IACtB,aAAa;AAAA,IACb,cAAc;AAAA,IACd,iBAAiB;AAAA,IACjB,WAAW;AAAA,EACf;AAAA;AAAA,EAGA,sBAAsB;AAAA,IAClB,QAAQ;AAAA,IACR,cAAc;AAAA,IACd,SAAS;AAAA,IACT,QAAQ;AAAA,IACR,mBAAmB;AAAA,IACnB,WAAW;AAAA,EACf;AACJ;","names":["KernelErrorCodeSchema","import_zod","import_zod","import_zod","import_zod","import_zod","KernelErrorCodeSchema","import_zod","import_zod","import_zod","import_zod"]}