@kybernesis/arp-scope-catalog 0.2.0

package/dist/index.js

@@ -0,0 +1,501 @@
+import { readFileSync, statSync, readdirSync } from 'fs';
+import { resolve } from 'path';
+import { parse } from 'yaml';
+import { ScopeTemplateSchema, ScopeCatalogManifestSchema, DID_URI_REGEX } from '@kybernesis/arp-spec';
+import { createHash } from 'crypto';
+import Handlebars from 'handlebars';
+
+// src/loader.ts
+var ScopeLoadError = class extends Error {
+  file;
+  issues;
+  constructor(message, opts) {
+    super(message);
+    this.name = "ScopeLoadError";
+    if (opts?.file !== void 0) this.file = opts.file;
+    if (opts?.issues !== void 0) this.issues = opts.issues;
+  }
+};
+function loadScopeFile(filePath) {
+  let raw;
+  try {
+    raw = readFileSync(filePath, "utf8");
+  } catch (e) {
+    throw new ScopeLoadError(`cannot read ${filePath}: ${e.message}`, {
+      file: filePath
+    });
+  }
+  let parsed;
+  try {
+    parsed = parse(raw);
+  } catch (e) {
+    throw new ScopeLoadError(`invalid YAML in ${filePath}: ${e.message}`, {
+      file: filePath
+    });
+  }
+  const result = ScopeTemplateSchema.safeParse(parsed);
+  if (!result.success) {
+    throw new ScopeLoadError(`scope ${filePath} failed schema validation`, {
+      file: filePath,
+      issues: result.error.issues
+    });
+  }
+  return result.data;
+}
+function loadScopesFromDirectory(scopesDir) {
+  const st = statSync(scopesDir);
+  if (!st.isDirectory()) {
+    throw new ScopeLoadError(`${scopesDir} is not a directory`);
+  }
+  const files = readdirSync(scopesDir).filter((f) => f.endsWith(".yaml") || f.endsWith(".yml")).sort();
+  const seen = /* @__PURE__ */ new Set();
+  const scopes = [];
+  for (const file of files) {
+    const full = resolve(scopesDir, file);
+    const scope = loadScopeFile(full);
+    const expected = `${scope.id}.yaml`;
+    if (file !== expected && !(file === `${scope.id}.yml`)) {
+      throw new ScopeLoadError(
+        `filename ${file} does not match scope id ${scope.id} (expected ${expected})`,
+        { file: full }
+      );
+    }
+    if (seen.has(scope.id)) {
+      throw new ScopeLoadError(`duplicate scope id ${scope.id}`, { file: full });
+    }
+    seen.add(scope.id);
+    scopes.push(scope);
+  }
+  scopes.sort((a, b) => a.id.localeCompare(b.id));
+  return scopes;
+}
+function canonicalize(value) {
+  if (value === null) return "null";
+  if (typeof value === "number" && !Number.isFinite(value)) {
+    throw new Error("canonicalize: non-finite numbers are not allowed");
+  }
+  if (typeof value !== "object") {
+    return JSON.stringify(value);
+  }
+  if (Array.isArray(value)) {
+    return `[${value.map(canonicalize).join(",")}]`;
+  }
+  const obj = value;
+  const keys = Object.keys(obj).sort();
+  const parts = keys.map((k) => `${JSON.stringify(k)}:${canonicalize(obj[k])}`);
+  return `{${parts.join(",")}}`;
+}
+function sha256Hex(input) {
+  return createHash("sha256").update(input, "utf8").digest("hex");
+}
+function buildCatalogManifest(scopes, options = {}) {
+  const sorted = [...scopes].sort((a, b) => a.id.localeCompare(b.id));
+  const canonical = canonicalize(sorted);
+  const checksum = `sha256:${sha256Hex(canonical)}`;
+  const manifest = {
+    version: options.version ?? "v1",
+    updated_at: options.updatedAt ?? (/* @__PURE__ */ new Date()).toISOString(),
+    scope_count: sorted.length,
+    checksum,
+    scopes: sorted
+  };
+  const parsed = ScopeCatalogManifestSchema.parse(manifest);
+  return parsed;
+}
+var ScopeCompileError = class extends Error {
+  scopeId;
+  parameter;
+  constructor(message, opts) {
+    super(message);
+    this.name = "ScopeCompileError";
+    if (opts?.scopeId !== void 0) this.scopeId = opts.scopeId;
+    if (opts?.parameter !== void 0) this.parameter = opts.parameter;
+  }
+};
+function parseRangeValidation(validation) {
+  const match = /^(-?\d+(?:\.\d+)?)\.\.(-?\d+(?:\.\d+)?)$/.exec(validation);
+  if (!match) return null;
+  return { min: Number(match[1]), max: Number(match[2]) };
+}
+function coerceToNumber(value) {
+  if (typeof value === "number" && Number.isFinite(value)) return value;
+  if (typeof value === "string" && value.trim() !== "") {
+    const n = Number(value);
+    if (Number.isFinite(n)) return n;
+  }
+  return null;
+}
+function validateParameter(scopeId, def, initial) {
+  let value = initial;
+  const present = value !== void 0 && value !== null;
+  if (!present) {
+    if (def.default !== void 0) {
+      value = def.default;
+    } else if (def.required) {
+      throw new ScopeCompileError(
+        `missing required parameter '${def.name}' for scope ${scopeId}`,
+        { scopeId, parameter: def.name }
+      );
+    } else {
+      return void 0;
+    }
+  }
+  switch (def.type) {
+    case "Integer": {
+      const n = coerceToNumber(value);
+      if (n === null || !Number.isInteger(n)) {
+        throw new ScopeCompileError(
+          `parameter '${def.name}' must be an integer`,
+          { scopeId, parameter: def.name }
+        );
+      }
+      if (typeof def.validation === "string") {
+        const range = parseRangeValidation(def.validation);
+        if (range && (n < range.min || n > range.max)) {
+          throw new ScopeCompileError(
+            `parameter '${def.name}'=${n} out of range ${def.validation}`,
+            { scopeId, parameter: def.name }
+          );
+        }
+      }
+      return n;
+    }
+    case "Decimal": {
+      const n = coerceToNumber(value);
+      if (n === null) {
+        throw new ScopeCompileError(
+          `parameter '${def.name}' must be a number`,
+          { scopeId, parameter: def.name }
+        );
+      }
+      if (typeof def.validation === "string") {
+        const range = parseRangeValidation(def.validation);
+        if (range && (n < range.min || n > range.max)) {
+          throw new ScopeCompileError(
+            `parameter '${def.name}'=${n} out of range ${def.validation}`,
+            { scopeId, parameter: def.name }
+          );
+        }
+      }
+      return n;
+    }
+    case "Enum": {
+      if (Array.isArray(def.validation) && !def.validation.includes(String(value))) {
+        throw new ScopeCompileError(
+          `parameter '${def.name}'='${String(value)}' is not one of [${def.validation.join(", ")}]`,
+          { scopeId, parameter: def.name }
+        );
+      }
+      return value;
+    }
+    case "AgentDID": {
+      if (typeof value !== "string" || !DID_URI_REGEX.test(value)) {
+        throw new ScopeCompileError(
+          `parameter '${def.name}' must be a valid DID URI`,
+          { scopeId, parameter: def.name }
+        );
+      }
+      return value;
+    }
+    case "AgentDIDList": {
+      if (!Array.isArray(value) || value.length === 0) {
+        throw new ScopeCompileError(
+          `parameter '${def.name}' must be a non-empty array of DID URIs`,
+          { scopeId, parameter: def.name }
+        );
+      }
+      for (const entry of value) {
+        if (typeof entry !== "string" || !DID_URI_REGEX.test(entry)) {
+          throw new ScopeCompileError(
+            `parameter '${def.name}' contains an invalid DID URI: ${String(entry)}`,
+            { scopeId, parameter: def.name }
+          );
+        }
+      }
+      return value;
+    }
+    case "ToolIDList":
+    case "AttributeList":
+    case "EmailList": {
+      if (!Array.isArray(value)) {
+        throw new ScopeCompileError(
+          `parameter '${def.name}' must be an array`,
+          { scopeId, parameter: def.name }
+        );
+      }
+      return value;
+    }
+    case "ProjectID": {
+      if (typeof value !== "string" || value.trim() === "") {
+        throw new ScopeCompileError(
+          `parameter '${def.name}' must be a non-empty string`,
+          { scopeId, parameter: def.name }
+        );
+      }
+      return value;
+    }
+    case "Duration":
+    case "Timezone":
+    case "IANATimezone": {
+      if (typeof value !== "string" || value.trim() === "") {
+        throw new ScopeCompileError(
+          `parameter '${def.name}' must be a non-empty string`,
+          { scopeId, parameter: def.name }
+        );
+      }
+      return value;
+    }
+  }
+}
+function buildHandlebarsContext(audienceDid, scope, validated) {
+  const ctx = {
+    audience_did: audienceDid,
+    ...validated
+  };
+  for (const [key, value] of Object.entries(validated)) {
+    if (Array.isArray(value)) {
+      ctx[`${key}_json`] = JSON.stringify(value);
+      ctx[`${key}_display`] = value.map((v) => String(v)).join(", ");
+    }
+  }
+  if (scope.id === "calendar.events.read") {
+    ctx.include_private_flag = (validated.include_private ?? scope.parameters.find((p) => p.name === "include_private")?.default) === "yes";
+  }
+  return ctx;
+}
+function compileScope({
+  scope,
+  params = {},
+  audienceDid
+}) {
+  if (!DID_URI_REGEX.test(audienceDid)) {
+    throw new ScopeCompileError(`audienceDid '${audienceDid}' is not a valid DID URI`, {
+      scopeId: scope.id
+    });
+  }
+  const validated = {};
+  for (const def of scope.parameters) {
+    validated[def.name] = validateParameter(scope.id, def, params[def.name]);
+  }
+  const ctx = buildHandlebarsContext(audienceDid, scope, validated);
+  const template = Handlebars.compile(scope.cedar_template, { noEscape: true });
+  const rendered = template(ctx);
+  return normalizeBareEntityTypes(rendered.trim());
+}
+function normalizeBareEntityTypes(cedar) {
+  return cedar.replace(
+    /(principal|resource)\s*==\s*([A-Z][A-Za-z0-9_]*)(?=\s*[,)\n])/g,
+    "$1 is $2"
+  );
+}
+
+// src/bundle-compiler.ts
+var BundleCompileError = class extends Error {
+  scopeId;
+  conflict;
+  constructor(message, opts) {
+    super(message);
+    this.name = "BundleCompileError";
+    if (opts?.scopeId !== void 0) this.scopeId = opts.scopeId;
+    if (opts?.conflict !== void 0) this.conflict = opts.conflict;
+  }
+};
+function indexCatalog(catalog) {
+  const map = /* @__PURE__ */ new Map();
+  for (const scope of catalog) {
+    map.set(scope.id, scope);
+  }
+  return map;
+}
+function expandImplications(seed, catalog) {
+  const order = [];
+  const visited = /* @__PURE__ */ new Set();
+  const impliedBy = /* @__PURE__ */ new Map();
+  const queue = seed.map((id) => ({
+    id,
+    parent: null
+  }));
+  while (queue.length > 0) {
+    const { id, parent } = queue.shift();
+    if (visited.has(id)) continue;
+    visited.add(id);
+    const scope = catalog.get(id);
+    if (!scope) {
+      throw new BundleCompileError(`unknown scope id '${id}'`, { scopeId: id });
+    }
+    order.push(id);
+    if (parent !== null && !impliedBy.has(id)) impliedBy.set(id, parent);
+    for (const implied of scope.implies) {
+      if (!visited.has(implied)) {
+        queue.push({ id: implied, parent: id });
+      }
+    }
+  }
+  return { order, impliedBy };
+}
+function detectConflicts(expanded, catalog) {
+  const set = new Set(expanded);
+  for (const id of expanded) {
+    const scope = catalog.get(id);
+    if (!scope) continue;
+    for (const conflict of scope.conflicts_with) {
+      if (set.has(conflict)) {
+        throw new BundleCompileError(
+          `scope '${id}' conflicts with '${conflict}' \u2014 cannot coexist in the same bundle`,
+          { conflict: [id, conflict] }
+        );
+      }
+    }
+  }
+}
+function resolveParamsForScope(scope, paramsMap, impliedBy, idx) {
+  const own = { ...paramsMap[scope.id] ?? {} };
+  let parentId = impliedBy.get(scope.id);
+  while (parentId) {
+    const parentParams = paramsMap[parentId];
+    if (parentParams) {
+      for (const [k, v] of Object.entries(parentParams)) {
+        if (own[k] === void 0) own[k] = v;
+      }
+    }
+    const grandparentId = impliedBy.get(parentId);
+    parentId = grandparentId && grandparentId !== parentId ? grandparentId : void 0;
+  }
+  return own;
+}
+function compileBundle({
+  scopeIds,
+  paramsMap = {},
+  audienceDid,
+  catalog
+}) {
+  const idx = indexCatalog(catalog);
+  const { order, impliedBy } = expandImplications(scopeIds, idx);
+  detectConflicts(order, idx);
+  const policies = [];
+  const obligations = [];
+  for (const id of order) {
+    const scope = idx.get(id);
+    if (!scope) continue;
+    const params = resolveParamsForScope(scope, paramsMap, impliedBy);
+    try {
+      policies.push(
+        compileScope({
+          scope,
+          audienceDid,
+          params
+        })
+      );
+    } catch (e) {
+      if (e instanceof ScopeCompileError) throw e;
+      throw new BundleCompileError(
+        `failed to compile scope '${id}': ${e.message}`,
+        { scopeId: id }
+      );
+    }
+    for (const ob of scope.obligations_forced) {
+      obligations.push({ type: ob.type, params: ob.params });
+    }
+  }
+  return { policies, obligations, expandedScopeIds: order };
+}
+
+// src/bundles.ts
+var BUNDLES = [
+  {
+    id: "bundle.project_collaboration.v1",
+    version: "1.0.0",
+    label: "Project collaboration",
+    description: "Collaborate on a project \u2014 read files, task status, and notes; no writes or external sharing.",
+    scopes: [
+      { id: "files.projects.list" },
+      { id: "files.project.metadata.read", params: { project_id: "<user-picks>" } },
+      { id: "files.project.files.read", params: { project_id: "<user-picks>", max_size_mb: 25 } },
+      { id: "files.project.files.summarize", params: { project_id: "<user-picks>", max_output_words: 2e3 } },
+      { id: "tasks.list", params: { project_id: "<user-picks>" } },
+      { id: "tasks.read", params: { project_id: "<user-picks>" } },
+      { id: "tasks.status.update", params: { project_id: "<user-picks>" } },
+      { id: "notes.search", params: { collection_id: "<user-picks>" } },
+      { id: "notes.read", params: { collection_id: "<user-picks>" } }
+    ]
+  },
+  {
+    id: "bundle.scheduling_assistant.v1",
+    version: "1.0.0",
+    label: "Scheduling assistant",
+    description: "Coordinate meetings on your calendar.",
+    scopes: [
+      { id: "calendar.availability.read", params: { days_ahead: 14 } },
+      {
+        id: "calendar.events.propose",
+        params: { max_attendees: 10, max_duration_min: 60 }
+      },
+      { id: "contacts.search", params: { attribute_allowlist: ["name", "email"] } },
+      { id: "messaging.relay.to_principal" }
+    ]
+  },
+  {
+    id: "bundle.research_agent.v1",
+    version: "1.0.0",
+    label: "Research agent",
+    description: "Pull research without writing.",
+    scopes: [
+      { id: "files.projects.list" },
+      { id: "files.project.files.read", params: { project_id: "<user-picks>", max_size_mb: 25 } },
+      { id: "files.project.files.summarize", params: { project_id: "<user-picks>", max_output_words: 2e3 } },
+      { id: "notes.search", params: { collection_id: "<user-picks>" } },
+      { id: "notes.read", params: { collection_id: "<user-picks>" } },
+      { id: "knowledge.query", params: { kb_id: "<user-picks>", max_tokens: 8e3 } },
+      { id: "credentials.proof.zk.request", params: { attribute: "verified_human" } }
+    ]
+  },
+  {
+    id: "bundle.procurement_agent.v1",
+    version: "1.0.0",
+    label: "Procurement agent",
+    description: "Buy things under tight caps.",
+    scopes: [
+      { id: "payments.quote.request" },
+      {
+        id: "payments.authorize.capped",
+        params: { max_per_txn_usd: 25, max_per_30d_usd: 200 }
+      },
+      { id: "payments.history.read", params: { days_back: 90 } },
+      { id: "messaging.relay.to_principal" }
+    ]
+  },
+  {
+    id: "bundle.executive_assistant.v1",
+    version: "1.0.0",
+    label: "Executive assistant",
+    description: "Broad assistant; step-up on anything external-facing.",
+    scopes: [
+      { id: "calendar.availability.read", params: { days_ahead: 14 } },
+      {
+        id: "calendar.events.propose",
+        params: { max_attendees: 10, max_duration_min: 60 }
+      },
+      { id: "calendar.events.modify" },
+      { id: "messaging.email.summary" },
+      { id: "messaging.email.draft.compose" },
+      { id: "messaging.email.send.reviewed", params: { recipient_allowlist: [] } },
+      { id: "contacts.search", params: { attribute_allowlist: ["name", "email"] } },
+      { id: "tasks.list", params: { project_id: "<user-picks>" } },
+      { id: "tasks.read", params: { project_id: "<user-picks>" } },
+      { id: "tasks.create", params: { project_id: "<user-picks>", max_per_day: 50 } },
+      { id: "tasks.status.update", params: { project_id: "<user-picks>" } },
+      { id: "notes.search", params: { collection_id: "<user-picks>" } },
+      { id: "notes.read", params: { collection_id: "<user-picks>" } },
+      { id: "notes.write", params: { collection_id: "<user-picks>", max_per_day: 100 } },
+      { id: "work.status.read" },
+      { id: "work.reports.summary", params: { period: "week" } }
+    ]
+  }
+];
+function findBundle(id) {
+  return BUNDLES.find((b) => b.id === id);
+}
+
+export { BUNDLES, BundleCompileError, ScopeCompileError, ScopeLoadError, buildCatalogManifest, canonicalize, compileBundle, compileScope, findBundle, loadScopeFile, loadScopesFromDirectory, sha256Hex };
+//# sourceMappingURL=index.js.map
+//# sourceMappingURL=index.js.map

package/dist/index.js.map

@@ -0,0 +1 @@
+{"version":3,"sources":["../src/loader.ts","../src/catalog-manifest.ts","../src/compiler.ts","../src/bundle-compiler.ts","../src/bundles.ts"],"names":["parseYaml"],"mappings":";;;;;;;;AAKO,IAAM,cAAA,GAAN,cAA6B,KAAA,CAAM;AAAA,EACxB,IAAA;AAAA,EACA,MAAA;AAAA,EAEhB,WAAA,CAAY,SAAiB,IAAA,EAA4C;AACvE,IAAA,KAAA,CAAM,OAAO,CAAA;AACb,IAAA,IAAA,CAAK,IAAA,GAAO,gBAAA;AACZ,IAAA,IAAI,IAAA,EAAM,IAAA,KAAS,MAAA,EAAW,IAAA,CAAK,OAAO,IAAA,CAAK,IAAA;AAC/C,IAAA,IAAI,IAAA,EAAM,MAAA,KAAW,MAAA,EAAW,IAAA,CAAK,SAAS,IAAA,CAAK,MAAA;AAAA,EACrD;AACF;AAOO,SAAS,cAAc,QAAA,EAAiC;AAC7D,EAAA,IAAI,GAAA;AACJ,EAAA,IAAI;AACF,IAAA,GAAA,GAAM,YAAA,CAAa,UAAU,MAAM,CAAA;AAAA,EACrC,SAAS,CAAA,EAAG;AACV,IAAA,MAAM,IAAI,cAAA,CAAe,CAAA,YAAA,EAAe,QAAQ,CAAA,EAAA,EAAM,CAAA,CAAY,OAAO,CAAA,CAAA,EAAI;AAAA,MAC3E,IAAA,EAAM;AAAA,KACP,CAAA;AAAA,EACH;AAEA,EAAA,IAAI,MAAA;AACJ,EAAA,IAAI;AACF,IAAA,MAAA,GAASA,MAAU,GAAG,CAAA;AAAA,EACxB,SAAS,CAAA,EAAG;AACV,IAAA,MAAM,IAAI,cAAA,CAAe,CAAA,gBAAA,EAAmB,QAAQ,CAAA,EAAA,EAAM,CAAA,CAAY,OAAO,CAAA,CAAA,EAAI;AAAA,MAC/E,IAAA,EAAM;AAAA,KACP,CAAA;AAAA,EACH;AAEA,EAAA,MAAM,MAAA,GAAS,mBAAA,CAAoB,SAAA,CAAU,MAAM,CAAA;AACnD,EAAA,IAAI,CAAC,OAAO,OAAA,EAAS;AACnB,IAAA,MAAM,IAAI,cAAA,CAAe,CAAA,MAAA,EAAS,QAAQ,CAAA,yBAAA,CAAA,EAA6B;AAAA,MACrE,IAAA,EAAM,QAAA;AAAA,MACN,MAAA,EAAQ,OAAO,KAAA,CAAM;AAAA,KACtB,CAAA;AAAA,EACH;AACA,EAAA,OAAO,MAAA,CAAO,IAAA;AAChB;AAOO,SAAS,wBAAwB,SAAA,EAAoC;AAC1E,EAAA,MAAM,EAAA,GAAK,SAAS,SAAS,CAAA;AAC7B,EAAA,IAAI,CAAC,EAAA,CAAG,WAAA,EAAY,EAAG;AACrB,IAAA,MAAM,IAAI,cAAA,CAAe,CAAA,EAAG,SAAS,CAAA,mBAAA,CAAqB,CAAA;AAAA,EAC5D;AAEA,EAAA,MAAM,QAAQ,WAAA,CAAY,SAAS,CAAA,CAChC,MAAA,CAAO,CAAC,CAAA,KAAM,CAAA,CAAE,QAAA,CAAS,OAAO,KAAK,CAAA,CAAE,QAAA,CAAS,MAAM,CAAC,EACvD,IAAA,EAAK;AAER,EAAA,MAAM,IAAA,uBAAW,GAAA,EAAY;AAC7B,EAAA,MAAM,SAA0B,EAAC;AAEjC,EAAA,KAAA,MAAW,QAAQ,KAAA,EAAO;AACxB,IAAA,MAAM,IAAA,GAAO,OAAA,CAAQ,SAAA,EAAW,IAAI,CAAA;AACpC,IAAA,MAAM,KAAA,GAAQ,cAAc,IAAI,CAAA;AAChC,IAAA,MAAM,QAAA,GAAW,CAAA,EAAG,KAAA,CAAM,EAAE,CAAA,KAAA,CAAA;AAC5B,IAAA,IAAI,SAAS,QAAA,IAAY,EAAE,SAAS,CAAA,EAAG,KAAA,CAAM,EAAE,CAAA,IAAA,CAAA,CAAA,EAAS;AACtD,MAAA,MAAM,IAAI,cAAA;AAAA,QACR,YAAY,IAAI,CAAA,yBAAA,EAA4B,KAAA,CAAM,EAAE,cAAc,QAAQ,CAAA,CAAA,CAAA;AAAA,QAC1E,EAAE,MAAM,IAAA;AAAK,OACf;AAAA,IACF;AACA,IAAA,IAAI,IAAA,CAAK,GAAA,CAAI,KAAA,CAAM,EAAE,CAAA,EAAG;AACtB,MAAA,MAAM,IAAI,eAAe,CAAA,mBAAA,EAAsB,KAAA,CAAM,EAAE,CAAA,CAAA,EAAI,EAAE,IAAA,EAAM,IAAA,EAAM,CAAA;AAAA,IAC3E;AACA,IAAA,IAAA,CAAK,GAAA,CAAI,MAAM,EAAE,CAAA;AACjB,IAAA,MAAA,CAAO,KAAK,KAAK,CAAA;AAAA,EACnB;AAEA,EAAA,MAAA,CAAO,IAAA,CAAK,CAAC,CAAA,EAAG,CAAA,KAAM,EAAE,EAAA,CAAG,aAAA,CAAc,CAAA,CAAE,EAAE,CAAC,CAAA;AAC9C,EAAA,OAAO,MAAA;AACT;ACxEO,SAAS,aAAa,KAAA,EAAwB;AACnD,EAAA,IAAI,KAAA,KAAU,MAAM,OAAO,MAAA;AAC3B,EAAA,IAAI,OAAO,KAAA,KAAU,QAAA,IAAY,CAAC,MAAA,CAAO,QAAA,CAAS,KAAK,CAAA,EAAG;AACxD,IAAA,MAAM,IAAI,MAAM,kDAAkD,CAAA;AAAA,EACpE;AACA,EAAA,IAAI,OAAO,UAAU,QAAA,EAAU;AAC7B,IAAA,OAAO,IAAA,CAAK,UAAU,KAAK,CAAA;AAAA,EAC7B;AACA,EAAA,IAAI,KAAA,CAAM,OAAA,CAAQ,KAAK,CAAA,EAAG;AACxB,IAAA,OAAO,IAAI,KAAA,CAAM,GAAA,CAAI,YAAY,CAAA,CAAE,IAAA,CAAK,GAAG,CAAC,CAAA,CAAA,CAAA;AAAA,EAC9C;AACA,EAAA,MAAM,GAAA,GAAM,KAAA;AACZ,EAAA,MAAM,IAAA,GAAO,MAAA,CAAO,IAAA,CAAK,GAAG,EAAE,IAAA,EAAK;AACnC,EAAA,MAAM,QAAQ,IAAA,CAAK,GAAA,CAAI,CAAC,CAAA,KAAM,GAAG,IAAA,CAAK,SAAA,CAAU,CAAC,CAAC,IAAI,YAAA,CAAa,GAAA,CAAI,CAAC,CAAC,CAAC,CAAA,CAAE,CAAA;AAC5E,EAAA,OAAO,CAAA,CAAA,EAAI,KAAA,CAAM,IAAA,CAAK,GAAG,CAAC,CAAA,CAAA,CAAA;AAC5B;AAEO,SAAS,UAAU,KAAA,EAAuB;AAC/C,EAAA,OAAO,UAAA,CAAW,QAAQ,CAAA,CAAE,MAAA,CAAO,OAAO,MAAM,CAAA,CAAE,OAAO,KAAK,CAAA;AAChE;AAkBO,SAAS,oBAAA,CACd,MAAA,EACA,OAAA,GAAgC,EAAC,EACX;AACtB,EAAA,MAAM,MAAA,GAAS,CAAC,GAAG,MAAM,EAAE,IAAA,CAAK,CAAC,CAAA,EAAG,CAAA,KAAM,CAAA,CAAE,EAAA,CAAG,aAAA,CAAc,CAAA,CAAE,EAAE,CAAC,CAAA;AAClE,EAAA,MAAM,SAAA,GAAY,aAAa,MAAM,CAAA;AACrC,EAAA,MAAM,QAAA,GAAW,CAAA,OAAA,EAAU,SAAA,CAAU,SAAS,CAAC,CAAA,CAAA;AAE/C,EAAA,MAAM,QAAA,GAAW;AAAA,IACf,OAAA,EAAS,QAAQ,OAAA,IAAW,IAAA;AAAA,IAC5B,YAAY,OAAA,CAAQ,SAAA,IAAA,iBAAa,IAAI,IAAA,IAAO,WAAA,EAAY;AAAA,IACxD,aAAa,MAAA,CAAO,MAAA;AAAA,IACpB,QAAA;AAAA,IACA,MAAA,EAAQ;AAAA,GACV;AAEA,EAAA,MAAM,MAAA,GAAS,0BAAA,CAA2B,KAAA,CAAM,QAAQ,CAAA;AACxD,EAAA,OAAO,MAAA;AACT;ACpEO,IAAM,iBAAA,GAAN,cAAgC,KAAA,CAAM;AAAA,EAC3B,OAAA;AAAA,EACA,SAAA;AAAA,EAEhB,WAAA,CAAY,SAAiB,IAAA,EAAiD;AAC5E,IAAA,KAAA,CAAM,OAAO,CAAA;AACb,IAAA,IAAA,CAAK,IAAA,GAAO,mBAAA;AACZ,IAAA,IAAI,IAAA,EAAM,OAAA,KAAY,MAAA,EAAW,IAAA,CAAK,UAAU,IAAA,CAAK,OAAA;AACrD,IAAA,IAAI,IAAA,EAAM,SAAA,KAAc,MAAA,EAAW,IAAA,CAAK,YAAY,IAAA,CAAK,SAAA;AAAA,EAC3D;AACF;AAEA,SAAS,qBACP,UAAA,EACqC;AACrC,EAAA,MAAM,KAAA,GAAQ,0CAAA,CAA2C,IAAA,CAAK,UAAU,CAAA;AACxE,EAAA,IAAI,CAAC,OAAO,OAAO,IAAA;AACnB,EAAA,OAAO,EAAE,GAAA,EAAK,MAAA,CAAO,KAAA,CAAM,CAAC,CAAC,CAAA,EAAG,GAAA,EAAK,MAAA,CAAO,KAAA,CAAM,CAAC,CAAC,CAAA,EAAE;AACxD;AAEA,SAAS,eAAe,KAAA,EAA+B;AACrD,EAAA,IAAI,OAAO,KAAA,KAAU,QAAA,IAAY,OAAO,QAAA,CAAS,KAAK,GAAG,OAAO,KAAA;AAChE,EAAA,IAAI,OAAO,KAAA,KAAU,QAAA,IAAY,KAAA,CAAM,IAAA,OAAW,EAAA,EAAI;AACpD,IAAA,MAAM,CAAA,GAAI,OAAO,KAAK,CAAA;AACtB,IAAA,IAAI,MAAA,CAAO,QAAA,CAAS,CAAC,CAAA,EAAG,OAAO,CAAA;AAAA,EACjC;AACA,EAAA,OAAO,IAAA;AACT;AAEA,SAAS,iBAAA,CACP,OAAA,EACA,GAAA,EACA,OAAA,EACS;AACT,EAAA,IAAI,KAAA,GAAQ,OAAA;AACZ,EAAA,MAAM,OAAA,GAAU,KAAA,KAAU,MAAA,IAAa,KAAA,KAAU,IAAA;AACjD,EAAA,IAAI,CAAC,OAAA,EAAS;AACZ,IAAA,IAAI,GAAA,CAAI,YAAY,MAAA,EAAW;AAK7B,MAAA,KAAA,GAAQ,GAAA,CAAI,OAAA;AAAA,IACd,CAAA,MAAA,IAAW,IAAI,QAAA,EAAU;AACvB,MAAA,MAAM,IAAI,iBAAA;AAAA,QACR,CAAA,4BAAA,EAA+B,GAAA,CAAI,IAAI,CAAA,YAAA,EAAe,OAAO,CAAA,CAAA;AAAA,QAC7D,EAAE,OAAA,EAAS,SAAA,EAAW,GAAA,CAAI,IAAA;AAAK,OACjC;AAAA,IACF,CAAA,MAAO;AACL,MAAA,OAAO,MAAA;AAAA,IACT;AAAA,EACF;AAEA,EAAA,QAAQ,IAAI,IAAA;AAAM,IAChB,KAAK,SAAA,EAAW;AACd,MAAA,MAAM,CAAA,GAAI,eAAe,KAAK,CAAA;AAC9B,MAAA,IAAI,MAAM,IAAA,IAAQ,CAAC,MAAA,CAAO,SAAA,CAAU,CAAC,CAAA,EAAG;AACtC,QAAA,MAAM,IAAI,iBAAA;AAAA,UACR,CAAA,WAAA,EAAc,IAAI,IAAI,CAAA,oBAAA,CAAA;AAAA,UACtB,EAAE,OAAA,EAAS,SAAA,EAAW,GAAA,CAAI,IAAA;AAAK,SACjC;AAAA,MACF;AACA,MAAA,IAAI,OAAO,GAAA,CAAI,UAAA,KAAe,QAAA,EAAU;AACtC,QAAA,MAAM,KAAA,GAAQ,oBAAA,CAAqB,GAAA,CAAI,UAAU,CAAA;AACjD,QAAA,IAAI,UAAU,CAAA,GAAI,KAAA,CAAM,GAAA,IAAO,CAAA,GAAI,MAAM,GAAA,CAAA,EAAM;AAC7C,UAAA,MAAM,IAAI,iBAAA;AAAA,YACR,cAAc,GAAA,CAAI,IAAI,KAAK,CAAC,CAAA,cAAA,EAAiB,IAAI,UAAU,CAAA,CAAA;AAAA,YAC3D,EAAE,OAAA,EAAS,SAAA,EAAW,GAAA,CAAI,IAAA;AAAK,WACjC;AAAA,QACF;AAAA,MACF;AACA,MAAA,OAAO,CAAA;AAAA,IACT;AAAA,IACA,KAAK,SAAA,EAAW;AACd,MAAA,MAAM,CAAA,GAAI,eAAe,KAAK,CAAA;AAC9B,MAAA,IAAI,MAAM,IAAA,EAAM;AACd,QAAA,MAAM,IAAI,iBAAA;AAAA,UACR,CAAA,WAAA,EAAc,IAAI,IAAI,CAAA,kBAAA,CAAA;AAAA,UACtB,EAAE,OAAA,EAAS,SAAA,EAAW,GAAA,CAAI,IAAA;AAAK,SACjC;AAAA,MACF;AACA,MAAA,IAAI,OAAO,GAAA,CAAI,UAAA,KAAe,QAAA,EAAU;AACtC,QAAA,MAAM,KAAA,GAAQ,oBAAA,CAAqB,GAAA,CAAI,UAAU,CAAA;AACjD,QAAA,IAAI,UAAU,CAAA,GAAI,KAAA,CAAM,GAAA,IAAO,CAAA,GAAI,MAAM,GAAA,CAAA,EAAM;AAC7C,UAAA,MAAM,IAAI,iBAAA;AAAA,YACR,cAAc,GAAA,CAAI,IAAI,KAAK,CAAC,CAAA,cAAA,EAAiB,IAAI,UAAU,CAAA,CAAA;AAAA,YAC3D,EAAE,OAAA,EAAS,SAAA,EAAW,GAAA,CAAI,IAAA;AAAK,WACjC;AAAA,QACF;AAAA,MACF;AACA,MAAA,OAAO,CAAA;AAAA,IACT;AAAA,IACA,KAAK,MAAA,EAAQ;AACX,MAAA,IAAI,KAAA,CAAM,OAAA,CAAQ,GAAA,CAAI,UAAU,CAAA,IAAK,CAAC,GAAA,CAAI,UAAA,CAAW,QAAA,CAAS,MAAA,CAAO,KAAK,CAAC,CAAA,EAAG;AAC5E,QAAA,MAAM,IAAI,iBAAA;AAAA,UACR,CAAA,WAAA,EAAc,GAAA,CAAI,IAAI,CAAA,GAAA,EAAM,MAAA,CAAO,KAAK,CAAC,CAAA,iBAAA,EAAoB,GAAA,CAAI,UAAA,CAAW,IAAA,CAAK,IAAI,CAAC,CAAA,CAAA,CAAA;AAAA,UACtF,EAAE,OAAA,EAAS,SAAA,EAAW,GAAA,CAAI,IAAA;AAAK,SACjC;AAAA,MACF;AACA,MAAA,OAAO,KAAA;AAAA,IACT;AAAA,IACA,KAAK,UAAA,EAAY;AACf,MAAA,IAAI,OAAO,KAAA,KAAU,QAAA,IAAY,CAAC,aAAA,CAAc,IAAA,CAAK,KAAK,CAAA,EAAG;AAC3D,QAAA,MAAM,IAAI,iBAAA;AAAA,UACR,CAAA,WAAA,EAAc,IAAI,IAAI,CAAA,yBAAA,CAAA;AAAA,UACtB,EAAE,OAAA,EAAS,SAAA,EAAW,GAAA,CAAI,IAAA;AAAK,SACjC;AAAA,MACF;AACA,MAAA,OAAO,KAAA;AAAA,IACT;AAAA,IACA,KAAK,cAAA,EAAgB;AACnB,MAAA,IAAI,CAAC,KAAA,CAAM,OAAA,CAAQ,KAAK,CAAA,IAAK,KAAA,CAAM,WAAW,CAAA,EAAG;AAC/C,QAAA,MAAM,IAAI,iBAAA;AAAA,UACR,CAAA,WAAA,EAAc,IAAI,IAAI,CAAA,uCAAA,CAAA;AAAA,UACtB,EAAE,OAAA,EAAS,SAAA,EAAW,GAAA,CAAI,IAAA;AAAK,SACjC;AAAA,MACF;AACA,MAAA,KAAA,MAAW,SAAS,KAAA,EAAO;AACzB,QAAA,IAAI,OAAO,KAAA,KAAU,QAAA,IAAY,CAAC,aAAA,CAAc,IAAA,CAAK,KAAK,CAAA,EAAG;AAC3D,UAAA,MAAM,IAAI,iBAAA;AAAA,YACR,cAAc,GAAA,CAAI,IAAI,CAAA,+BAAA,EAAkC,MAAA,CAAO,KAAK,CAAC,CAAA,CAAA;AAAA,YACrE,EAAE,OAAA,EAAS,SAAA,EAAW,GAAA,CAAI,IAAA;AAAK,WACjC;AAAA,QACF;AAAA,MACF;AACA,MAAA,OAAO,KAAA;AAAA,IACT;AAAA,IACA,KAAK,YAAA;AAAA,IACL,KAAK,eAAA;AAAA,IACL,KAAK,WAAA,EAAa;AAChB,MAAA,IAAI,CAAC,KAAA,CAAM,OAAA,CAAQ,KAAK,CAAA,EAAG;AACzB,QAAA,MAAM,IAAI,iBAAA;AAAA,UACR,CAAA,WAAA,EAAc,IAAI,IAAI,CAAA,kBAAA,CAAA;AAAA,UACtB,EAAE,OAAA,EAAS,SAAA,EAAW,GAAA,CAAI,IAAA;AAAK,SACjC;AAAA,MACF;AACA,MAAA,OAAO,KAAA;AAAA,IACT;AAAA,IACA,KAAK,WAAA,EAAa;AAChB,MAAA,IAAI,OAAO,KAAA,KAAU,QAAA,IAAY,KAAA,CAAM,IAAA,OAAW,EAAA,EAAI;AACpD,QAAA,MAAM,IAAI,iBAAA;AAAA,UACR,CAAA,WAAA,EAAc,IAAI,IAAI,CAAA,4BAAA,CAAA;AAAA,UACtB,EAAE,OAAA,EAAS,SAAA,EAAW,GAAA,CAAI,IAAA;AAAK,SACjC;AAAA,MACF;AACA,MAAA,OAAO,KAAA;AAAA,IACT;AAAA,IACA,KAAK,UAAA;AAAA,IACL,KAAK,UAAA;AAAA,IACL,KAAK,cAAA,EAAgB;AACnB,MAAA,IAAI,OAAO,KAAA,KAAU,QAAA,IAAY,KAAA,CAAM,IAAA,OAAW,EAAA,EAAI;AACpD,QAAA,MAAM,IAAI,iBAAA;AAAA,UACR,CAAA,WAAA,EAAc,IAAI,IAAI,CAAA,4BAAA,CAAA;AAAA,UACtB,EAAE,OAAA,EAAS,SAAA,EAAW,GAAA,CAAI,IAAA;AAAK,SACjC;AAAA,MACF;AACA,MAAA,OAAO,KAAA;AAAA,IACT;AAAA;AAEJ;AAOA,SAAS,sBAAA,CACP,WAAA,EACA,KAAA,EACA,SAAA,EACyB;AACzB,EAAA,MAAM,GAAA,GAA+B;AAAA,IACnC,YAAA,EAAc,WAAA;AAAA,IACd,GAAG;AAAA,GACL;AAEA,EAAA,KAAA,MAAW,CAAC,GAAA,EAAK,KAAK,KAAK,MAAA,CAAO,OAAA,CAAQ,SAAS,CAAA,EAAG;AACpD,IAAA,IAAI,KAAA,CAAM,OAAA,CAAQ,KAAK,CAAA,EAAG;AACxB,MAAA,GAAA,CAAI,GAAG,GAAG,CAAA,KAAA,CAAO,CAAA,GAAI,IAAA,CAAK,UAAU,KAAK,CAAA;AACzC,MAAA,GAAA,CAAI,CAAA,EAAG,GAAG,CAAA,QAAA,CAAU,CAAA,GAAI,KAAA,CAAM,GAAA,CAAI,CAAC,CAAA,KAAM,MAAA,CAAO,CAAC,CAAC,CAAA,CAAE,KAAK,IAAI,CAAA;AAAA,IAC/D;AAAA,EACF;AAKA,EAAA,IAAI,KAAA,CAAM,OAAO,sBAAA,EAAwB;AACvC,IAAA,GAAA,CAAI,oBAAA,GAAA,CACD,SAAA,CAAU,eAAA,IAAmB,KAAA,CAAM,UAAA,CAAW,IAAA,CAAK,CAAC,CAAA,KAAM,CAAA,CAAE,IAAA,KAAS,iBAAiB,CAAA,EAAG,OAAA,MAC1F,KAAA;AAAA,EACJ;AAEA,EAAA,OAAO,GAAA;AACT;AAmBO,SAAS,YAAA,CAAa;AAAA,EAC3B,KAAA;AAAA,EACA,SAAS,EAAC;AAAA,EACV;AACF,CAAA,EAAgC;AAC9B,EAAA,IAAI,CAAC,aAAA,CAAc,IAAA,CAAK,WAAW,CAAA,EAAG;AACpC,IAAA,MAAM,IAAI,iBAAA,CAAkB,CAAA,aAAA,EAAgB,WAAW,CAAA,wBAAA,CAAA,EAA4B;AAAA,MACjF,SAAS,KAAA,CAAM;AAAA,KAChB,CAAA;AAAA,EACH;AAEA,EAAA,MAAM,YAAqC,EAAC;AAC5C,EAAA,KAAA,MAAW,GAAA,IAAO,MAAM,UAAA,EAAY;AAClC,IAAA,SAAA,CAAU,GAAA,CAAI,IAAI,CAAA,GAAI,iBAAA,CAAkB,KAAA,CAAM,IAAI,GAAA,EAAK,MAAA,CAAO,GAAA,CAAI,IAAI,CAAC,CAAA;AAAA,EACzE;AAEA,EAAA,MAAM,GAAA,GAAM,sBAAA,CAAuB,WAAA,EAAa,KAAA,EAAO,SAAS,CAAA;AAEhE,EAAA,MAAM,QAAA,GAAW,WAAW,OAAA,CAAQ,KAAA,CAAM,gBAAgB,EAAE,QAAA,EAAU,MAAM,CAAA;AAC5E,EAAA,MAAM,QAAA,GAAW,SAAS,GAAG,CAAA;AAC7B,EAAA,OAAO,wBAAA,CAAyB,QAAA,CAAS,IAAA,EAAM,CAAA;AACjD;AAiBA,SAAS,yBAAyB,KAAA,EAAuB;AACvD,EAAA,OAAO,KAAA,CAAM,OAAA;AAAA,IACX,gEAAA;AAAA,IACA;AAAA,GACF;AACF;;;AChPO,IAAM,kBAAA,GAAN,cAAiC,KAAA,CAAM;AAAA,EAC5B,OAAA;AAAA,EACA,QAAA;AAAA,EAEhB,WAAA,CAAY,SAAiB,IAAA,EAA0D;AACrF,IAAA,KAAA,CAAM,OAAO,CAAA;AACb,IAAA,IAAA,CAAK,IAAA,GAAO,oBAAA;AACZ,IAAA,IAAI,IAAA,EAAM,OAAA,KAAY,MAAA,EAAW,IAAA,CAAK,UAAU,IAAA,CAAK,OAAA;AACrD,IAAA,IAAI,IAAA,EAAM,QAAA,KAAa,MAAA,EAAW,IAAA,CAAK,WAAW,IAAA,CAAK,QAAA;AAAA,EACzD;AACF;AAEA,SAAS,aAAa,OAAA,EAA+D;AACnF,EAAA,MAAM,GAAA,uBAAU,GAAA,EAA2B;AAC3C,EAAA,KAAA,MAAW,SAAS,OAAA,EAAS;AAC3B,IAAA,GAAA,CAAI,GAAA,CAAI,KAAA,CAAM,EAAA,EAAI,KAAK,CAAA;AAAA,EACzB;AACA,EAAA,OAAO,GAAA;AACT;AAgBA,SAAS,kBAAA,CACP,MACA,OAAA,EACiB;AACjB,EAAA,MAAM,QAAkB,EAAC;AACzB,EAAA,MAAM,OAAA,uBAAc,GAAA,EAAY;AAChC,EAAA,MAAM,SAAA,uBAAgB,GAAA,EAAoB;AAC1C,EAAA,MAAM,KAAA,GAAsD,IAAA,CAAK,GAAA,CAAI,CAAC,EAAA,MAAQ;AAAA,IAC5E,EAAA;AAAA,IACA,MAAA,EAAQ;AAAA,GACV,CAAE,CAAA;AAEF,EAAA,OAAO,KAAA,CAAM,SAAS,CAAA,EAAG;AACvB,IAAA,MAAM,EAAE,EAAA,EAAI,MAAA,EAAO,GAAI,MAAM,KAAA,EAAM;AACnC,IAAA,IAAI,OAAA,CAAQ,GAAA,CAAI,EAAE,CAAA,EAAG;AACrB,IAAA,OAAA,CAAQ,IAAI,EAAE,CAAA;AACd,IAAA,MAAM,KAAA,GAAQ,OAAA,CAAQ,GAAA,CAAI,EAAE,CAAA;AAC5B,IAAA,IAAI,CAAC,KAAA,EAAO;AACV,MAAA,MAAM,IAAI,mBAAmB,CAAA,kBAAA,EAAqB,EAAE,KAAK,EAAE,OAAA,EAAS,IAAI,CAAA;AAAA,IAC1E;AACA,IAAA,KAAA,CAAM,KAAK,EAAE,CAAA;AACb,IAAA,IAAI,MAAA,KAAW,IAAA,IAAQ,CAAC,SAAA,CAAU,GAAA,CAAI,EAAE,CAAA,EAAG,SAAA,CAAU,GAAA,CAAI,EAAA,EAAI,MAAM,CAAA;AACnE,IAAA,KAAA,MAAW,OAAA,IAAW,MAAM,OAAA,EAAS;AACnC,MAAA,IAAI,CAAC,OAAA,CAAQ,GAAA,CAAI,OAAO,CAAA,EAAG;AACzB,QAAA,KAAA,CAAM,KAAK,EAAE,EAAA,EAAI,OAAA,EAAS,MAAA,EAAQ,IAAI,CAAA;AAAA,MACxC;AAAA,IACF;AAAA,EACF;AAEA,EAAA,OAAO,EAAE,OAAO,SAAA,EAAU;AAC5B;AAEA,SAAS,eAAA,CACP,UACA,OAAA,EACM;AACN,EAAA,MAAM,GAAA,GAAM,IAAI,GAAA,CAAI,QAAQ,CAAA;AAC5B,EAAA,KAAA,MAAW,MAAM,QAAA,EAAU;AACzB,IAAA,MAAM,KAAA,GAAQ,OAAA,CAAQ,GAAA,CAAI,EAAE,CAAA;AAE5B,IAAA,IAAI,CAAC,KAAA,EAAO;AACZ,IAAA,KAAA,MAAW,QAAA,IAAY,MAAM,cAAA,EAAgB;AAC3C,MAAA,IAAI,GAAA,CAAI,GAAA,CAAI,QAAQ,CAAA,EAAG;AACrB,QAAA,MAAM,IAAI,kBAAA;AAAA,UACR,CAAA,OAAA,EAAU,EAAE,CAAA,kBAAA,EAAqB,QAAQ,CAAA,0CAAA,CAAA;AAAA,UACzC,EAAE,QAAA,EAAU,CAAC,EAAA,EAAI,QAAQ,CAAA;AAAE,SAC7B;AAAA,MACF;AAAA,IACF;AAAA,EACF;AACF;AASA,SAAS,qBAAA,CACP,KAAA,EACA,SAAA,EACA,SAAA,EACA,GAAA,EACyB;AACzB,EAAA,MAAM,GAAA,GAAM,EAAE,GAAI,SAAA,CAAU,MAAM,EAAE,CAAA,IAAK,EAAC,EAAG;AAC7C,EAAA,IAAI,QAAA,GAAW,SAAA,CAAU,GAAA,CAAI,KAAA,CAAM,EAAE,CAAA;AACrC,EAAA,OAAO,QAAA,EAAU;AACf,IAAA,MAAM,YAAA,GAAe,UAAU,QAAQ,CAAA;AACvC,IAAA,IAAI,YAAA,EAAc;AAChB,MAAA,KAAA,MAAW,CAAC,CAAA,EAAG,CAAC,KAAK,MAAA,CAAO,OAAA,CAAQ,YAAY,CAAA,EAAG;AACjD,QAAA,IAAI,IAAI,CAAC,CAAA,KAAM,MAAA,EAAW,GAAA,CAAI,CAAC,CAAA,GAAI,CAAA;AAAA,MACrC;AAAA,IACF;AAEA,IAAA,MAAM,aAAA,GAAgB,SAAA,CAAU,GAAA,CAAI,QAAQ,CAAA;AAC5C,IAAA,QAAA,GAAW,aAAA,IAAiB,aAAA,KAAkB,QAAA,GAAW,aAAA,GAAgB,MAAA;AAAA,EAC3E;AAIA,EAAA,OAAO,GAAA;AACT;AAkBO,SAAS,aAAA,CAAc;AAAA,EAC5B,QAAA;AAAA,EACA,YAAY,EAAC;AAAA,EACb,WAAA;AAAA,EACA;AACF,CAAA,EAAuC;AACrC,EAAA,MAAM,GAAA,GAAM,aAAa,OAAO,CAAA;AAChC,EAAA,MAAM,EAAE,KAAA,EAAO,SAAA,EAAU,GAAI,kBAAA,CAAmB,UAAU,GAAG,CAAA;AAC7D,EAAA,eAAA,CAAgB,OAAO,GAAG,CAAA;AAE1B,EAAA,MAAM,WAAqB,EAAC;AAC5B,EAAA,MAAM,cAA4B,EAAC;AAEnC,EAAA,KAAA,MAAW,MAAM,KAAA,EAAO;AACtB,IAAA,MAAM,KAAA,GAAQ,GAAA,CAAI,GAAA,CAAI,EAAE,CAAA;AACxB,IAAA,IAAI,CAAC,KAAA,EAAO;AACZ,IAAA,MAAM,MAAA,GAAS,qBAAA,CAAsB,KAAA,EAAO,SAAA,EAAW,SAAc,CAAA;AACrE,IAAA,IAAI;AACF,MAAA,QAAA,CAAS,IAAA;AAAA,QACP,YAAA,CAAa;AAAA,UACX,KAAA;AAAA,UACA,WAAA;AAAA,UACA;AAAA,SACD;AAAA,OACH;AAAA,IACF,SAAS,CAAA,EAAG;AACV,MAAA,IAAI,CAAA,YAAa,mBAAmB,MAAM,CAAA;AAC1C,MAAA,MAAM,IAAI,kBAAA;AAAA,QACR,CAAA,yBAAA,EAA4B,EAAE,CAAA,GAAA,EAAO,CAAA,CAAY,OAAO,CAAA,CAAA;AAAA,QACxD,EAAE,SAAS,EAAA;AAAG,OAChB;AAAA,IACF;AACA,IAAA,KAAA,MAAW,EAAA,IAAM,MAAM,kBAAA,EAAoB;AACzC,MAAA,WAAA,CAAY,IAAA,CAAK,EAAE,IAAA,EAAM,EAAA,CAAG,MAAM,MAAA,EAAQ,EAAA,CAAG,QAAQ,CAAA;AAAA,IACvD;AAAA,EACF;AAEA,EAAA,OAAO,EAAE,QAAA,EAAU,WAAA,EAAa,gBAAA,EAAkB,KAAA,EAAM;AAC1D;;;ACrKO,IAAM,OAAA,GAAuC;AAAA,EAClD;AAAA,IACE,EAAA,EAAI,iCAAA;AAAA,IACJ,OAAA,EAAS,OAAA;AAAA,IACT,KAAA,EAAO,uBAAA;AAAA,IACP,WAAA,EACE,oGAAA;AAAA,IACF,MAAA,EAAQ;AAAA,MACN,EAAE,IAAI,qBAAA,EAAsB;AAAA,MAC5B,EAAE,EAAA,EAAI,6BAAA,EAA+B,QAAQ,EAAE,UAAA,EAAY,gBAAe,EAAE;AAAA,MAC5E,EAAE,IAAI,0BAAA,EAA4B,MAAA,EAAQ,EAAE,UAAA,EAAY,cAAA,EAAgB,WAAA,EAAa,EAAA,EAAG,EAAE;AAAA,MAC1F,EAAE,IAAI,+BAAA,EAAiC,MAAA,EAAQ,EAAE,UAAA,EAAY,cAAA,EAAgB,gBAAA,EAAkB,GAAA,EAAK,EAAE;AAAA,MACtG,EAAE,EAAA,EAAI,YAAA,EAAc,QAAQ,EAAE,UAAA,EAAY,gBAAe,EAAE;AAAA,MAC3D,EAAE,EAAA,EAAI,YAAA,EAAc,QAAQ,EAAE,UAAA,EAAY,gBAAe,EAAE;AAAA,MAC3D,EAAE,EAAA,EAAI,qBAAA,EAAuB,QAAQ,EAAE,UAAA,EAAY,gBAAe,EAAE;AAAA,MACpE,EAAE,EAAA,EAAI,cAAA,EAAgB,QAAQ,EAAE,aAAA,EAAe,gBAAe,EAAE;AAAA,MAChE,EAAE,EAAA,EAAI,YAAA,EAAc,QAAQ,EAAE,aAAA,EAAe,gBAAe;AAAE;AAChE,GACF;AAAA,EACA;AAAA,IACE,EAAA,EAAI,gCAAA;AAAA,IACJ,OAAA,EAAS,OAAA;AAAA,IACT,KAAA,EAAO,sBAAA;AAAA,IACP,WAAA,EAAa,uCAAA;AAAA,IACb,MAAA,EAAQ;AAAA,MACN,EAAE,EAAA,EAAI,4BAAA,EAA8B,QAAQ,EAAE,UAAA,EAAY,IAAG,EAAE;AAAA,MAC/D;AAAA,QACE,EAAA,EAAI,yBAAA;AAAA,QACJ,MAAA,EAAQ,EAAE,aAAA,EAAe,EAAA,EAAI,kBAAkB,EAAA;AAAG,OACpD;AAAA,MACA,EAAE,EAAA,EAAI,iBAAA,EAAmB,MAAA,EAAQ,EAAE,qBAAqB,CAAC,MAAA,EAAQ,OAAO,CAAA,EAAE,EAAE;AAAA,MAC5E,EAAE,IAAI,8BAAA;AAA+B;AACvC,GACF;AAAA,EACA;AAAA,IACE,EAAA,EAAI,0BAAA;AAAA,IACJ,OAAA,EAAS,OAAA;AAAA,IACT,KAAA,EAAO,gBAAA;AAAA,IACP,WAAA,EAAa,gCAAA;AAAA,IACb,MAAA,EAAQ;AAAA,MACN,EAAE,IAAI,qBAAA,EAAsB;AAAA,MAC5B,EAAE,IAAI,0BAAA,EAA4B,MAAA,EAAQ,EAAE,UAAA,EAAY,cAAA,EAAgB,WAAA,EAAa,EAAA,EAAG,EAAE;AAAA,MAC1F,EAAE,IAAI,+BAAA,EAAiC,MAAA,EAAQ,EAAE,UAAA,EAAY,cAAA,EAAgB,gBAAA,EAAkB,GAAA,EAAK,EAAE;AAAA,MACtG,EAAE,EAAA,EAAI,cAAA,EAAgB,QAAQ,EAAE,aAAA,EAAe,gBAAe,EAAE;AAAA,MAChE,EAAE,EAAA,EAAI,YAAA,EAAc,QAAQ,EAAE,aAAA,EAAe,gBAAe,EAAE;AAAA,MAC9D,EAAE,IAAI,iBAAA,EAAmB,MAAA,EAAQ,EAAE,KAAA,EAAO,cAAA,EAAgB,UAAA,EAAY,GAAA,EAAK,EAAE;AAAA,MAC7E,EAAE,EAAA,EAAI,8BAAA,EAAgC,QAAQ,EAAE,SAAA,EAAW,kBAAiB;AAAE;AAChF,GACF;AAAA,EACA;AAAA,IACE,EAAA,EAAI,6BAAA;AAAA,IACJ,OAAA,EAAS,OAAA;AAAA,IACT,KAAA,EAAO,mBAAA;AAAA,IACP,WAAA,EAAa,8BAAA;AAAA,IACb,MAAA,EAAQ;AAAA,MACN,EAAE,IAAI,wBAAA,EAAyB;AAAA,MAC/B;AAAA,QACE,EAAA,EAAI,2BAAA;AAAA,QACJ,MAAA,EAAQ,EAAE,eAAA,EAAiB,EAAA,EAAI,iBAAiB,GAAA;AAAI,OACtD;AAAA,MACA,EAAE,EAAA,EAAI,uBAAA,EAAyB,QAAQ,EAAE,SAAA,EAAW,IAAG,EAAE;AAAA,MACzD,EAAE,IAAI,8BAAA;AAA+B;AACvC,GACF;AAAA,EACA;AAAA,IACE,EAAA,EAAI,+BAAA;AAAA,IACJ,OAAA,EAAS,OAAA;AAAA,IACT,KAAA,EAAO,qBAAA;AAAA,IACP,WAAA,EAAa,uDAAA;AAAA,IACb,MAAA,EAAQ;AAAA,MACN,EAAE,EAAA,EAAI,4BAAA,EAA8B,QAAQ,EAAE,UAAA,EAAY,IAAG,EAAE;AAAA,MAC/D;AAAA,QACE,EAAA,EAAI,yBAAA;AAAA,QACJ,MAAA,EAAQ,EAAE,aAAA,EAAe,EAAA,EAAI,kBAAkB,EAAA;AAAG,OACpD;AAAA,MACA,EAAE,IAAI,wBAAA,EAAyB;AAAA,MAC/B,EAAE,IAAI,yBAAA,EAA0B;AAAA,MAChC,EAAE,IAAI,+BAAA,EAAgC;AAAA,MACtC,EAAE,IAAI,+BAAA,EAAiC,MAAA,EAAQ,EAAE,mBAAA,EAAqB,IAAG,EAAE;AAAA,MAC3E,EAAE,EAAA,EAAI,iBAAA,EAAmB,MAAA,EAAQ,EAAE,qBAAqB,CAAC,MAAA,EAAQ,OAAO,CAAA,EAAE,EAAE;AAAA,MAC5E,EAAE,EAAA,EAAI,YAAA,EAAc,QAAQ,EAAE,UAAA,EAAY,gBAAe,EAAE;AAAA,MAC3D,EAAE,EAAA,EAAI,YAAA,EAAc,QAAQ,EAAE,UAAA,EAAY,gBAAe,EAAE;AAAA,MAC3D,EAAE,IAAI,cAAA,EAAgB,MAAA,EAAQ,EAAE,UAAA,EAAY,cAAA,EAAgB,WAAA,EAAa,EAAA,EAAG,EAAE;AAAA,MAC9E,EAAE,EAAA,EAAI,qBAAA,EAAuB,QAAQ,EAAE,UAAA,EAAY,gBAAe,EAAE;AAAA,MACpE,EAAE,EAAA,EAAI,cAAA,EAAgB,QAAQ,EAAE,aAAA,EAAe,gBAAe,EAAE;AAAA,MAChE,EAAE,EAAA,EAAI,YAAA,EAAc,QAAQ,EAAE,aAAA,EAAe,gBAAe,EAAE;AAAA,MAC9D,EAAE,IAAI,aAAA,EAAe,MAAA,EAAQ,EAAE,aAAA,EAAe,cAAA,EAAgB,WAAA,EAAa,GAAA,EAAI,EAAE;AAAA,MACjF,EAAE,IAAI,kBAAA,EAAmB;AAAA,MACzB,EAAE,EAAA,EAAI,sBAAA,EAAwB,QAAQ,EAAE,MAAA,EAAQ,QAAO;AAAE;AAC3D;AAEJ;AAEO,SAAS,WAAW,EAAA,EAA0C;AACnE,EAAA,OAAO,QAAQ,IAAA,CAAK,CAAC,CAAA,KAAM,CAAA,CAAE,OAAO,EAAE,CAAA;AACxC","file":"index.js","sourcesContent":["import { readdirSync, readFileSync, statSync } from 'node:fs';\nimport { resolve } from 'node:path';\nimport { parse as parseYaml } from 'yaml';\nimport { ScopeTemplateSchema, type ScopeTemplate } from '@kybernesis/arp-spec';\n\nexport class ScopeLoadError extends Error {\n  public readonly file?: string;\n  public readonly issues?: unknown;\n\n  constructor(message: string, opts?: { file?: string; issues?: unknown }) {\n    super(message);\n    this.name = 'ScopeLoadError';\n    if (opts?.file !== undefined) this.file = opts.file;\n    if (opts?.issues !== undefined) this.issues = opts.issues;\n  }\n}\n\n/**\n * Load a single YAML scope file, validate it against `ScopeTemplateSchema`,\n * and return the parsed value. Throws `ScopeLoadError` on YAML parse errors\n * or schema validation failures.\n */\nexport function loadScopeFile(filePath: string): ScopeTemplate {\n  let raw: string;\n  try {\n    raw = readFileSync(filePath, 'utf8');\n  } catch (e) {\n    throw new ScopeLoadError(`cannot read ${filePath}: ${(e as Error).message}`, {\n      file: filePath,\n    });\n  }\n\n  let parsed: unknown;\n  try {\n    parsed = parseYaml(raw);\n  } catch (e) {\n    throw new ScopeLoadError(`invalid YAML in ${filePath}: ${(e as Error).message}`, {\n      file: filePath,\n    });\n  }\n\n  const result = ScopeTemplateSchema.safeParse(parsed);\n  if (!result.success) {\n    throw new ScopeLoadError(`scope ${filePath} failed schema validation`, {\n      file: filePath,\n      issues: result.error.issues,\n    });\n  }\n  return result.data;\n}\n\n/**\n * Load every `*.yaml` file under `scopesDir`, validate each, and return the\n * sorted-by-id array. Also verifies that every filename matches the scope's\n * `id` field (`<id>.yaml`) — cheap but valuable invariant.\n */\nexport function loadScopesFromDirectory(scopesDir: string): ScopeTemplate[] {\n  const st = statSync(scopesDir);\n  if (!st.isDirectory()) {\n    throw new ScopeLoadError(`${scopesDir} is not a directory`);\n  }\n\n  const files = readdirSync(scopesDir)\n    .filter((f) => f.endsWith('.yaml') || f.endsWith('.yml'))\n    .sort();\n\n  const seen = new Set<string>();\n  const scopes: ScopeTemplate[] = [];\n\n  for (const file of files) {\n    const full = resolve(scopesDir, file);\n    const scope = loadScopeFile(full);\n    const expected = `${scope.id}.yaml`;\n    if (file !== expected && !(file === `${scope.id}.yml`)) {\n      throw new ScopeLoadError(\n        `filename ${file} does not match scope id ${scope.id} (expected ${expected})`,\n        { file: full }\n      );\n    }\n    if (seen.has(scope.id)) {\n      throw new ScopeLoadError(`duplicate scope id ${scope.id}`, { file: full });\n    }\n    seen.add(scope.id);\n    scopes.push(scope);\n  }\n\n  scopes.sort((a, b) => a.id.localeCompare(b.id));\n  return scopes;\n}\n","import { createHash } from 'node:crypto';\nimport {\n  ScopeCatalogManifestSchema,\n  type ScopeCatalogManifest,\n  type ScopeTemplate,\n} from '@kybernesis/arp-spec';\n\n/**\n * Deterministically canonicalize a value for checksum computation.\n *\n * We implement a minimal RFC 8785 JCS subset here (objects sorted by key,\n * arrays in order, primitives as JSON.stringify encodes them) rather than\n * pulling in the `canonicalize` dep — the catalog only needs this inside the\n * build step, and we control the inputs. Phase 2 (which actually signs\n * canonicalized payloads) will import `canonicalize` properly.\n */\nexport function canonicalize(value: unknown): string {\n  if (value === null) return 'null';\n  if (typeof value === 'number' && !Number.isFinite(value)) {\n    throw new Error('canonicalize: non-finite numbers are not allowed');\n  }\n  if (typeof value !== 'object') {\n    return JSON.stringify(value);\n  }\n  if (Array.isArray(value)) {\n    return `[${value.map(canonicalize).join(',')}]`;\n  }\n  const obj = value as Record<string, unknown>;\n  const keys = Object.keys(obj).sort();\n  const parts = keys.map((k) => `${JSON.stringify(k)}:${canonicalize(obj[k])}`);\n  return `{${parts.join(',')}}`;\n}\n\nexport function sha256Hex(input: string): string {\n  return createHash('sha256').update(input, 'utf8').digest('hex');\n}\n\nexport interface BuildManifestOptions {\n  /** Catalog version label, default \"v1\". */\n  version?: string;\n  /**\n   * `updated_at` timestamp. When computing deterministic checksums, pass a\n   * fixed ISO string. Defaults to the current time.\n   */\n  updatedAt?: string;\n}\n\n/**\n * Build a `ScopeCatalogManifest` from a list of scope templates. The checksum\n * covers the sorted scopes array (not the top-level metadata) so it is\n * stable across re-runs with different `updated_at` values but identical\n * scope content.\n */\nexport function buildCatalogManifest(\n  scopes: readonly ScopeTemplate[],\n  options: BuildManifestOptions = {}\n): ScopeCatalogManifest {\n  const sorted = [...scopes].sort((a, b) => a.id.localeCompare(b.id));\n  const canonical = canonicalize(sorted);\n  const checksum = `sha256:${sha256Hex(canonical)}`;\n\n  const manifest = {\n    version: options.version ?? 'v1',\n    updated_at: options.updatedAt ?? new Date().toISOString(),\n    scope_count: sorted.length,\n    checksum,\n    scopes: sorted,\n  };\n\n  const parsed = ScopeCatalogManifestSchema.parse(manifest);\n  return parsed;\n}\n","import Handlebars from 'handlebars';\nimport { DID_URI_REGEX, type ScopeTemplate, type ScopeParameter } from '@kybernesis/arp-spec';\n\nexport class ScopeCompileError extends Error {\n  public readonly scopeId?: string;\n  public readonly parameter?: string;\n\n  constructor(message: string, opts?: { scopeId?: string; parameter?: string }) {\n    super(message);\n    this.name = 'ScopeCompileError';\n    if (opts?.scopeId !== undefined) this.scopeId = opts.scopeId;\n    if (opts?.parameter !== undefined) this.parameter = opts.parameter;\n  }\n}\n\nfunction parseRangeValidation(\n  validation: string\n): { min: number; max: number } | null {\n  const match = /^(-?\\d+(?:\\.\\d+)?)\\.\\.(-?\\d+(?:\\.\\d+)?)$/.exec(validation);\n  if (!match) return null;\n  return { min: Number(match[1]), max: Number(match[2]) };\n}\n\nfunction coerceToNumber(value: unknown): number | null {\n  if (typeof value === 'number' && Number.isFinite(value)) return value;\n  if (typeof value === 'string' && value.trim() !== '') {\n    const n = Number(value);\n    if (Number.isFinite(n)) return n;\n  }\n  return null;\n}\n\nfunction validateParameter(\n  scopeId: string,\n  def: ScopeParameter,\n  initial: unknown\n): unknown {\n  let value = initial;\n  const present = value !== undefined && value !== null;\n  if (!present) {\n    if (def.default !== undefined) {\n      // Required + default is a valid combo in the catalog — \"required\" here\n      // means the compiler must end up with a value. If the caller omits,\n      // fall through to type-validate the default the same way we'd validate\n      // a caller-supplied value.\n      value = def.default;\n    } else if (def.required) {\n      throw new ScopeCompileError(\n        `missing required parameter '${def.name}' for scope ${scopeId}`,\n        { scopeId, parameter: def.name }\n      );\n    } else {\n      return undefined;\n    }\n  }\n\n  switch (def.type) {\n    case 'Integer': {\n      const n = coerceToNumber(value);\n      if (n === null || !Number.isInteger(n)) {\n        throw new ScopeCompileError(\n          `parameter '${def.name}' must be an integer`,\n          { scopeId, parameter: def.name }\n        );\n      }\n      if (typeof def.validation === 'string') {\n        const range = parseRangeValidation(def.validation);\n        if (range && (n < range.min || n > range.max)) {\n          throw new ScopeCompileError(\n            `parameter '${def.name}'=${n} out of range ${def.validation}`,\n            { scopeId, parameter: def.name }\n          );\n        }\n      }\n      return n;\n    }\n    case 'Decimal': {\n      const n = coerceToNumber(value);\n      if (n === null) {\n        throw new ScopeCompileError(\n          `parameter '${def.name}' must be a number`,\n          { scopeId, parameter: def.name }\n        );\n      }\n      if (typeof def.validation === 'string') {\n        const range = parseRangeValidation(def.validation);\n        if (range && (n < range.min || n > range.max)) {\n          throw new ScopeCompileError(\n            `parameter '${def.name}'=${n} out of range ${def.validation}`,\n            { scopeId, parameter: def.name }\n          );\n        }\n      }\n      return n;\n    }\n    case 'Enum': {\n      if (Array.isArray(def.validation) && !def.validation.includes(String(value))) {\n        throw new ScopeCompileError(\n          `parameter '${def.name}'='${String(value)}' is not one of [${def.validation.join(', ')}]`,\n          { scopeId, parameter: def.name }\n        );\n      }\n      return value;\n    }\n    case 'AgentDID': {\n      if (typeof value !== 'string' || !DID_URI_REGEX.test(value)) {\n        throw new ScopeCompileError(\n          `parameter '${def.name}' must be a valid DID URI`,\n          { scopeId, parameter: def.name }\n        );\n      }\n      return value;\n    }\n    case 'AgentDIDList': {\n      if (!Array.isArray(value) || value.length === 0) {\n        throw new ScopeCompileError(\n          `parameter '${def.name}' must be a non-empty array of DID URIs`,\n          { scopeId, parameter: def.name }\n        );\n      }\n      for (const entry of value) {\n        if (typeof entry !== 'string' || !DID_URI_REGEX.test(entry)) {\n          throw new ScopeCompileError(\n            `parameter '${def.name}' contains an invalid DID URI: ${String(entry)}`,\n            { scopeId, parameter: def.name }\n          );\n        }\n      }\n      return value;\n    }\n    case 'ToolIDList':\n    case 'AttributeList':\n    case 'EmailList': {\n      if (!Array.isArray(value)) {\n        throw new ScopeCompileError(\n          `parameter '${def.name}' must be an array`,\n          { scopeId, parameter: def.name }\n        );\n      }\n      return value;\n    }\n    case 'ProjectID': {\n      if (typeof value !== 'string' || value.trim() === '') {\n        throw new ScopeCompileError(\n          `parameter '${def.name}' must be a non-empty string`,\n          { scopeId, parameter: def.name }\n        );\n      }\n      return value;\n    }\n    case 'Duration':\n    case 'Timezone':\n    case 'IANATimezone': {\n      if (typeof value !== 'string' || value.trim() === '') {\n        throw new ScopeCompileError(\n          `parameter '${def.name}' must be a non-empty string`,\n          { scopeId, parameter: def.name }\n        );\n      }\n      return value;\n    }\n  }\n}\n\n/**\n * Build the Handlebars context for a scope template. Derives list-shaped\n * helpers (`<name>_json`, `<name>_display`, and flag-style `<name>_flag` for\n * enum parameters) so Cedar templates stay declarative.\n */\nfunction buildHandlebarsContext(\n  audienceDid: string,\n  scope: ScopeTemplate,\n  validated: Record<string, unknown>\n): Record<string, unknown> {\n  const ctx: Record<string, unknown> = {\n    audience_did: audienceDid,\n    ...validated,\n  };\n\n  for (const [key, value] of Object.entries(validated)) {\n    if (Array.isArray(value)) {\n      ctx[`${key}_json`] = JSON.stringify(value);\n      ctx[`${key}_display`] = value.map((v) => String(v)).join(', ');\n    }\n  }\n\n  // Per-scope helpers. Keeping the catalog's consent_text_template compile\n  // path decoupled from the Cedar path would duplicate this for both — we\n  // share the same context for both.\n  if (scope.id === 'calendar.events.read') {\n    ctx.include_private_flag =\n      (validated.include_private ?? scope.parameters.find((p) => p.name === 'include_private')?.default) ===\n      'yes';\n  }\n\n  return ctx;\n}\n\nexport interface CompileScopeOptions {\n  scope: ScopeTemplate;\n  params?: Record<string, unknown>;\n  audienceDid: string;\n}\n\n/**\n * Compile a scope template + parameters + audience DID into a Cedar policy\n * string.\n *\n * - Validates parameters against the scope's declared types + validation\n *   rules (ranges, enum values, DID shape). Throws `ScopeCompileError` on\n *   any mismatch.\n * - Uses Handlebars under the hood; `{{audience_did}}` is always in scope,\n *   plus any validated parameters and the derived `<name>_json` /\n *   `<name>_display` helpers.\n */\nexport function compileScope({\n  scope,\n  params = {},\n  audienceDid,\n}: CompileScopeOptions): string {\n  if (!DID_URI_REGEX.test(audienceDid)) {\n    throw new ScopeCompileError(`audienceDid '${audienceDid}' is not a valid DID URI`, {\n      scopeId: scope.id,\n    });\n  }\n\n  const validated: Record<string, unknown> = {};\n  for (const def of scope.parameters) {\n    validated[def.name] = validateParameter(scope.id, def, params[def.name]);\n  }\n\n  const ctx = buildHandlebarsContext(audienceDid, scope, validated);\n\n  const template = Handlebars.compile(scope.cedar_template, { noEscape: true });\n  const rendered = template(ctx);\n  return normalizeBareEntityTypes(rendered.trim());\n}\n\n/**\n * Post-process the Handlebars output to produce valid Cedar.\n *\n * Several scope templates in ARP-scope-catalog-v1.md §5 use the shorthand\n * `resource == Tool` (and similar bare-type forms) to mean \"any entity of\n * type Tool\". Cedar's parser requires an entity UID on the right-hand side\n * of `==`, not a bare type name — the idiomatic form is `resource is Tool`.\n *\n * We rewrite `<scope> == <TypeName>` → `<scope> is <TypeName>` whenever the\n * right-hand side is a bare UpperCamelCase identifier (no `::\"...\"` UID and\n * no lower-case head, which would indicate a variable or attribute access).\n *\n * Keeps the YAML sources faithful to the spec doc while guaranteeing the\n * compiled output parses with @cedar-policy/cedar-wasm.\n */\nfunction normalizeBareEntityTypes(cedar: string): string {\n  return cedar.replace(\n    /(principal|resource)\\s*==\\s*([A-Z][A-Za-z0-9_]*)(?=\\s*[,)\\n])/g,\n    '$1 is $2'\n  );\n}\n","import type { ScopeTemplate, Obligation } from '@kybernesis/arp-spec';\nimport { compileScope, ScopeCompileError } from './compiler.js';\n\nexport interface CompileBundleInput {\n  scopeIds: readonly string[];\n  paramsMap?: Record<string, Record<string, unknown>>;\n  audienceDid: string;\n  /** Lookup table from scope id → template. Usually the loader's output. */\n  catalog: readonly ScopeTemplate[];\n}\n\nexport interface CompiledBundle {\n  policies: string[];\n  obligations: Obligation[];\n  /** Fully-expanded scope IDs (original + implied, deduped and topologically sorted). */\n  expandedScopeIds: string[];\n}\n\nexport class BundleCompileError extends Error {\n  public readonly scopeId?: string;\n  public readonly conflict?: [string, string];\n\n  constructor(message: string, opts?: { scopeId?: string; conflict?: [string, string] }) {\n    super(message);\n    this.name = 'BundleCompileError';\n    if (opts?.scopeId !== undefined) this.scopeId = opts.scopeId;\n    if (opts?.conflict !== undefined) this.conflict = opts.conflict;\n  }\n}\n\nfunction indexCatalog(catalog: readonly ScopeTemplate[]): Map<string, ScopeTemplate> {\n  const map = new Map<string, ScopeTemplate>();\n  for (const scope of catalog) {\n    map.set(scope.id, scope);\n  }\n  return map;\n}\n\ninterface ExpansionResult {\n  order: string[];\n  /** For each implied scope, the id of the scope that pulled it in. */\n  impliedBy: Map<string, string>;\n}\n\n/**\n * Transitively expand `implies` relations starting from `seed`.\n * Returns a stable-ordered array: requested scopes first (in their original\n * order), then any implied scopes added by the expansion (in discovery\n * order). Also records the parent that pulled each implied scope in, so\n * callers can inherit parameter values along the implication edge.\n * Guards against cycles.\n */\nfunction expandImplications(\n  seed: readonly string[],\n  catalog: Map<string, ScopeTemplate>\n): ExpansionResult {\n  const order: string[] = [];\n  const visited = new Set<string>();\n  const impliedBy = new Map<string, string>();\n  const queue: Array<{ id: string; parent: string | null }> = seed.map((id) => ({\n    id,\n    parent: null,\n  }));\n\n  while (queue.length > 0) {\n    const { id, parent } = queue.shift() as { id: string; parent: string | null };\n    if (visited.has(id)) continue;\n    visited.add(id);\n    const scope = catalog.get(id);\n    if (!scope) {\n      throw new BundleCompileError(`unknown scope id '${id}'`, { scopeId: id });\n    }\n    order.push(id);\n    if (parent !== null && !impliedBy.has(id)) impliedBy.set(id, parent);\n    for (const implied of scope.implies) {\n      if (!visited.has(implied)) {\n        queue.push({ id: implied, parent: id });\n      }\n    }\n  }\n\n  return { order, impliedBy };\n}\n\nfunction detectConflicts(\n  expanded: readonly string[],\n  catalog: Map<string, ScopeTemplate>\n): void {\n  const set = new Set(expanded);\n  for (const id of expanded) {\n    const scope = catalog.get(id);\n    // Existence already checked in expandImplications.\n    if (!scope) continue;\n    for (const conflict of scope.conflicts_with) {\n      if (set.has(conflict)) {\n        throw new BundleCompileError(\n          `scope '${id}' conflicts with '${conflict}' — cannot coexist in the same bundle`,\n          { conflict: [id, conflict] }\n        );\n      }\n    }\n  }\n}\n\n/**\n * Resolve the parameter map for `scopeId`. Starts from any explicit entry in\n * `paramsMap`, then — if the scope was pulled in via implication — walks up\n * the chain and fills in any missing required parameters that the parent\n * scope also declares (e.g., `project_id` propagates from\n * `files.project.files.read` down to its implied `.list` / `.metadata.read`).\n */\nfunction resolveParamsForScope(\n  scope: ScopeTemplate,\n  paramsMap: Record<string, Record<string, unknown>>,\n  impliedBy: Map<string, string>,\n  idx: Map<string, ScopeTemplate>\n): Record<string, unknown> {\n  const own = { ...(paramsMap[scope.id] ?? {}) };\n  let parentId = impliedBy.get(scope.id);\n  while (parentId) {\n    const parentParams = paramsMap[parentId];\n    if (parentParams) {\n      for (const [k, v] of Object.entries(parentParams)) {\n        if (own[k] === undefined) own[k] = v;\n      }\n    }\n    // follow any further implication chain (e.g., A→B→C)\n    const grandparentId = impliedBy.get(parentId);\n    parentId = grandparentId && grandparentId !== parentId ? grandparentId : undefined;\n  }\n  // nothing more to do — missing required-with-default params are handled by\n  // the per-scope compiler using catalog defaults.\n  void idx; // reserved for richer inheritance in the future\n  return own;\n}\n\n/**\n * Compile a bundle of scopes into a Cedar policy string list + aggregated\n * obligations.\n *\n * Semantics:\n *   1. Expand `implies` transitively (user-requested ids first, implied\n *      later). Each implied scope remembers which scope pulled it in.\n *   2. Check `conflicts_with` across the expanded set; throw if any pair\n *      conflicts.\n *   3. Compile each scope using `compileScope`. Implied scopes inherit any\n *      required parameters (`project_id`, `collection_id`, …) from the\n *      scope that implied them if the caller didn't provide their own\n *      `paramsMap` entry.\n *   4. Concatenate `obligations_forced` from every expanded scope into the\n *      bundle's obligations array.\n */\nexport function compileBundle({\n  scopeIds,\n  paramsMap = {},\n  audienceDid,\n  catalog,\n}: CompileBundleInput): CompiledBundle {\n  const idx = indexCatalog(catalog);\n  const { order, impliedBy } = expandImplications(scopeIds, idx);\n  detectConflicts(order, idx);\n\n  const policies: string[] = [];\n  const obligations: Obligation[] = [];\n\n  for (const id of order) {\n    const scope = idx.get(id);\n    if (!scope) continue;\n    const params = resolveParamsForScope(scope, paramsMap, impliedBy, idx);\n    try {\n      policies.push(\n        compileScope({\n          scope,\n          audienceDid,\n          params,\n        })\n      );\n    } catch (e) {\n      if (e instanceof ScopeCompileError) throw e;\n      throw new BundleCompileError(\n        `failed to compile scope '${id}': ${(e as Error).message}`,\n        { scopeId: id }\n      );\n    }\n    for (const ob of scope.obligations_forced) {\n      obligations.push({ type: ob.type, params: ob.params });\n    }\n  }\n\n  return { policies, obligations, expandedScopeIds: order };\n}\n","/**\n * Named multi-scope bundles offered as one-tap presets in the consent UI.\n *\n * Source: ARP-scope-catalog-v1.md §6.\n *\n * `params` values marked `null` are user-picked (the UI prompts at\n * bundle-activation time). Values marked with a concrete number/string are\n * presets baked into the bundle.\n */\nexport interface BundleDefinition {\n  id: string;\n  version: string;\n  label: string;\n  description: string;\n  /**\n   * Ordered list of scopes. Each has an optional `params` object; values\n   * that are `'<user-picks>'` (string) indicate user-supplied inputs at\n   * activation time (the UI collects them).\n   */\n  scopes: Array<{\n    id: string;\n    params?: Record<string, unknown>;\n  }>;\n}\n\nexport const BUNDLES: readonly BundleDefinition[] = [\n  {\n    id: 'bundle.project_collaboration.v1',\n    version: '1.0.0',\n    label: 'Project collaboration',\n    description:\n      'Collaborate on a project — read files, task status, and notes; no writes or external sharing.',\n    scopes: [\n      { id: 'files.projects.list' },\n      { id: 'files.project.metadata.read', params: { project_id: '<user-picks>' } },\n      { id: 'files.project.files.read', params: { project_id: '<user-picks>', max_size_mb: 25 } },\n      { id: 'files.project.files.summarize', params: { project_id: '<user-picks>', max_output_words: 2000 } },\n      { id: 'tasks.list', params: { project_id: '<user-picks>' } },\n      { id: 'tasks.read', params: { project_id: '<user-picks>' } },\n      { id: 'tasks.status.update', params: { project_id: '<user-picks>' } },\n      { id: 'notes.search', params: { collection_id: '<user-picks>' } },\n      { id: 'notes.read', params: { collection_id: '<user-picks>' } },\n    ],\n  },\n  {\n    id: 'bundle.scheduling_assistant.v1',\n    version: '1.0.0',\n    label: 'Scheduling assistant',\n    description: 'Coordinate meetings on your calendar.',\n    scopes: [\n      { id: 'calendar.availability.read', params: { days_ahead: 14 } },\n      {\n        id: 'calendar.events.propose',\n        params: { max_attendees: 10, max_duration_min: 60 },\n      },\n      { id: 'contacts.search', params: { attribute_allowlist: ['name', 'email'] } },\n      { id: 'messaging.relay.to_principal' },\n    ],\n  },\n  {\n    id: 'bundle.research_agent.v1',\n    version: '1.0.0',\n    label: 'Research agent',\n    description: 'Pull research without writing.',\n    scopes: [\n      { id: 'files.projects.list' },\n      { id: 'files.project.files.read', params: { project_id: '<user-picks>', max_size_mb: 25 } },\n      { id: 'files.project.files.summarize', params: { project_id: '<user-picks>', max_output_words: 2000 } },\n      { id: 'notes.search', params: { collection_id: '<user-picks>' } },\n      { id: 'notes.read', params: { collection_id: '<user-picks>' } },\n      { id: 'knowledge.query', params: { kb_id: '<user-picks>', max_tokens: 8000 } },\n      { id: 'credentials.proof.zk.request', params: { attribute: 'verified_human' } },\n    ],\n  },\n  {\n    id: 'bundle.procurement_agent.v1',\n    version: '1.0.0',\n    label: 'Procurement agent',\n    description: 'Buy things under tight caps.',\n    scopes: [\n      { id: 'payments.quote.request' },\n      {\n        id: 'payments.authorize.capped',\n        params: { max_per_txn_usd: 25, max_per_30d_usd: 200 },\n      },\n      { id: 'payments.history.read', params: { days_back: 90 } },\n      { id: 'messaging.relay.to_principal' },\n    ],\n  },\n  {\n    id: 'bundle.executive_assistant.v1',\n    version: '1.0.0',\n    label: 'Executive assistant',\n    description: 'Broad assistant; step-up on anything external-facing.',\n    scopes: [\n      { id: 'calendar.availability.read', params: { days_ahead: 14 } },\n      {\n        id: 'calendar.events.propose',\n        params: { max_attendees: 10, max_duration_min: 60 },\n      },\n      { id: 'calendar.events.modify' },\n      { id: 'messaging.email.summary' },\n      { id: 'messaging.email.draft.compose' },\n      { id: 'messaging.email.send.reviewed', params: { recipient_allowlist: [] } },\n      { id: 'contacts.search', params: { attribute_allowlist: ['name', 'email'] } },\n      { id: 'tasks.list', params: { project_id: '<user-picks>' } },\n      { id: 'tasks.read', params: { project_id: '<user-picks>' } },\n      { id: 'tasks.create', params: { project_id: '<user-picks>', max_per_day: 50 } },\n      { id: 'tasks.status.update', params: { project_id: '<user-picks>' } },\n      { id: 'notes.search', params: { collection_id: '<user-picks>' } },\n      { id: 'notes.read', params: { collection_id: '<user-picks>' } },\n      { id: 'notes.write', params: { collection_id: '<user-picks>', max_per_day: 100 } },\n      { id: 'work.status.read' },\n      { id: 'work.reports.summary', params: { period: 'week' } },\n    ],\n  },\n] as const;\n\nexport function findBundle(id: string): BundleDefinition | undefined {\n  return BUNDLES.find((b) => b.id === id);\n}\n"]}