@opengeni/contracts 5.5.0 → 5.5.2-canary.40656248492001

package/dist/chunk-VLUKBV6Y.js.map

@@ -0,0 +1 @@
+{"version":3,"sources":["../src/secret-references.ts","../src/secret-value-masking.ts"],"sourcesContent":["/**\n * The one secret reference grammar (design §10B.2, normative).\n *\n * ```\n * reference = \"{{\" kind \":\" body \"}}\"        ; no whitespace after \"{{\" or before \"}}\"\n * kind      = \"secret\" | \"secretfile\"\n * body      = id-form | path-form\n * id-form   = \"id:\" uuid [ \"/\" segment ] [ \"/otp\" ] [ \"#previous\" ]\n * path-form = segment *2( \"/\" segment ) [ \"/otp\" ] [ \"#previous\" ]\n * segment   = 1*120( any char except \"/\" \"{\" \"}\" \"#\" \"\\\" and control chars ),\n *             no leading/trailing whitespace\n * escape    = \"\\\" reference                  ; the reference text, literally\n * ```\n *\n * Text that starts with `{{secret:` or `{{secretfile:` and does not parse is\n * an `invalid` token: callers fail it with `invalid_reference` and never pass\n * it through. References are at most 300 characters long.\n *\n * Pure and isomorphic: no I/O, no runtime imports from `./index`.\n */\nimport { isValidSecretName, VAULT_LIMITS } from \"./vaults\";\n\nexport type SecretReferenceKind = \"secret\" | \"secretfile\";\nexport type SecretReferenceTarget =\n  | { form: \"id\"; itemId: string; field: string | null }\n  | { form: \"path\"; segments: [string] | [string, string] | [string, string, string] };\nexport interface SecretReference {\n  kind: SecretReferenceKind;\n  raw: string;\n  /** Offsets in the source text; `end` is exclusive. */\n  start: number;\n  end: number;\n  target: SecretReferenceTarget;\n  otp: boolean;\n  previous: boolean;\n}\nexport type SecretTextToken =\n  /** Escapes already unescaped. */\n  | { type: \"text\"; value: string }\n  | { type: \"reference\"; reference: SecretReference }\n  | { type: \"invalid\"; raw: string; start: number; end: number; reason: string };\n\n/** Fast-path needle; also matches `{{secretfile:`. */\nexport const SECRET_REFERENCE_MARKER = \"{{secret\";\n\nexport class SecretReferenceSyntaxError extends Error {\n  readonly reason: string;\n  constructor(reason: string, message?: string) {\n    super(message ?? `invalid secret reference: ${reason}`);\n    this.name = \"SecretReferenceSyntaxError\";\n    this.reason = reason;\n  }\n}\n\nconst PREFIXES: ReadonlyArray<{ prefix: string; kind: SecretReferenceKind }> = [\n  // Longest first: \"{{secretfile:\" must win over \"{{secret\".\n  { prefix: \"{{secretfile:\", kind: \"secretfile\" },\n  { prefix: \"{{secret:\", kind: \"secret\" },\n];\nconst UUID_PATTERN = /^[0-9a-f]{8}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{12}$/i;\nconst PREVIOUS_SUFFIX = \"#previous\";\nconst ID_PREFIX = \"id:\";\n\nexport function containsSecretReference(text: string): boolean {\n  return text.includes(SECRET_REFERENCE_MARKER);\n}\n\nfunction prefixAt(\n  text: string,\n  index: number,\n): { prefix: string; kind: SecretReferenceKind } | null {\n  for (const candidate of PREFIXES) {\n    if (text.startsWith(candidate.prefix, index)) return candidate;\n  }\n  return null;\n}\n\nfunction isControl(code: number): boolean {\n  return code <= 0x1f || (code >= 0x7f && code <= 0x9f);\n}\n\n/** Parse the body (between `kind:` and `}}`). Throws SecretReferenceSyntaxError. */\nfunction parseBody(body: string): {\n  target: SecretReferenceTarget;\n  otp: boolean;\n  previous: boolean;\n} {\n  if (body.length === 0)\n    throw new SecretReferenceSyntaxError(\"empty_body\", \"secret reference is empty\");\n  let rest = body;\n  let previous = false;\n  if (rest.endsWith(PREVIOUS_SUFFIX)) {\n    previous = true;\n    rest = rest.slice(0, -PREVIOUS_SUFFIX.length);\n  }\n  if (rest.includes(\"#\")) {\n    throw new SecretReferenceSyntaxError(\n      \"unsupported_version_suffix\",\n      \"only #previous is supported, and it must be last\",\n    );\n  }\n  const parts = rest.split(\"/\");\n  let otp = false;\n  if (parts.length >= 2 && parts[parts.length - 1]!.toLowerCase() === \"otp\") {\n    otp = true;\n    parts.pop();\n  }\n  if (parts[0]!.toLowerCase().startsWith(ID_PREFIX)) {\n    const itemId = parts[0]!.slice(ID_PREFIX.length);\n    if (!UUID_PATTERN.test(itemId)) {\n      throw new SecretReferenceSyntaxError(\"invalid_id\", \"id: must be followed by an item UUID\");\n    }\n    if (parts.length > 2) {\n      throw new SecretReferenceSyntaxError(\"too_many_segments\", \"id form takes at most one field\");\n    }\n    const field = parts[1] ?? null;\n    if (field !== null) assertSegment(field);\n    return { target: { form: \"id\", itemId: itemId.toLowerCase(), field }, otp, previous };\n  }\n  if (parts.length > 3) {\n    throw new SecretReferenceSyntaxError(\n      \"too_many_segments\",\n      \"a reference has at most Vault/Item/field\",\n    );\n  }\n  for (const segment of parts) assertSegment(segment);\n  return {\n    target: {\n      form: \"path\",\n      segments: parts as [string] | [string, string] | [string, string, string],\n    },\n    otp,\n    previous,\n  };\n}\n\nfunction assertSegment(segment: string): void {\n  if (segment.length === 0) {\n    throw new SecretReferenceSyntaxError(\"empty_segment\", \"a reference has an empty name\");\n  }\n  if (!isValidSecretName(segment)) {\n    throw new SecretReferenceSyntaxError(\n      \"invalid_segment\",\n      `\"${segment.slice(0, 40)}\" is not a valid vault, item or field name`,\n    );\n  }\n}\n\n/**\n * Scan one candidate starting at `index` (where a prefix matched). Returns the\n * candidate's end (exclusive) and either the parsed reference or a reason.\n */\nfunction scanCandidate(\n  text: string,\n  index: number,\n  prefix: { prefix: string; kind: SecretReferenceKind },\n):\n  | { ok: true; end: number; reference: SecretReference }\n  | { ok: false; end: number; reason: string } {\n  const bodyStart = index + prefix.prefix.length;\n  const limit = Math.min(text.length, index + VAULT_LIMITS.referenceMaxChars);\n  let cursor = bodyStart;\n  while (cursor < text.length) {\n    const code = text.charCodeAt(cursor);\n    const character = text[cursor]!;\n    if (character === \"}\" && text[cursor + 1] === \"}\") {\n      const end = cursor + 2;\n      if (end - index > VAULT_LIMITS.referenceMaxChars) {\n        return { ok: false, end, reason: \"too_long\" };\n      }\n      const raw = text.slice(index, end);\n      try {\n        const parsed = parseBody(text.slice(bodyStart, cursor));\n        return {\n          ok: true,\n          end,\n          reference: { kind: prefix.kind, raw, start: index, end, ...parsed },\n        };\n      } catch (error) {\n        return {\n          ok: false,\n          end,\n          reason: error instanceof SecretReferenceSyntaxError ? error.reason : \"invalid\",\n        };\n      }\n    }\n    if (character === \"{\" || character === \"}\" || isControl(code) || cursor >= limit) {\n      // Unterminated: the invalid token stops before the offending character.\n      const end = Math.max(cursor, bodyStart);\n      return { ok: false, end, reason: cursor >= limit ? \"too_long\" : \"unterminated\" };\n    }\n    cursor += 1;\n  }\n  return { ok: false, end: text.length, reason: \"unterminated\" };\n}\n\n/**\n * Split text into literal text, references and invalid candidates. Adjacent\n * text is merged; an escaped reference (`\\{{secret:…}}`) becomes literal\n * text without the backslash. Never throws.\n */\nexport function tokenizeSecretText(text: string): SecretTextToken[] {\n  if (!containsSecretReference(text)) return text.length > 0 ? [{ type: \"text\", value: text }] : [];\n  const tokens: SecretTextToken[] = [];\n  let buffer = \"\";\n  let cursor = 0;\n  const flush = () => {\n    if (buffer.length > 0) tokens.push({ type: \"text\", value: buffer });\n    buffer = \"\";\n  };\n  while (cursor < text.length) {\n    const next = text.indexOf(SECRET_REFERENCE_MARKER, cursor);\n    if (next < 0) {\n      buffer += text.slice(cursor);\n      break;\n    }\n    const prefix = prefixAt(text, next);\n    if (prefix === null) {\n      // \"{{secret\" not followed by \":\" or \"file:\" is ordinary text.\n      buffer += text.slice(cursor, next + SECRET_REFERENCE_MARKER.length);\n      cursor = next + SECRET_REFERENCE_MARKER.length;\n      continue;\n    }\n    // A backslash immediately before the candidate (and not already consumed)\n    // escapes it: the candidate is emitted literally, without the backslash.\n    const escaped = next - 1 >= cursor && text[next - 1] === \"\\\\\";\n    const scanned = scanCandidate(text, next, prefix);\n    if (escaped) {\n      buffer += text.slice(cursor, next - 1) + text.slice(next, scanned.end);\n      cursor = scanned.end;\n      continue;\n    }\n    buffer += text.slice(cursor, next);\n    flush();\n    if (scanned.ok) {\n      tokens.push({ type: \"reference\", reference: scanned.reference });\n    } else {\n      tokens.push({\n        type: \"invalid\",\n        raw: text.slice(next, scanned.end),\n        start: next,\n        end: scanned.end,\n        reason: scanned.reason,\n      });\n    }\n    cursor = scanned.end;\n  }\n  flush();\n  return tokens;\n}\n\n/** Valid references only, in text order. */\nexport function findSecretReferences(text: string): SecretReference[] {\n  if (!containsSecretReference(text)) return [];\n  return tokenizeSecretText(text).flatMap((token) =>\n    token.type === \"reference\" ? [token.reference] : [],\n  );\n}\n\n/** Invalid candidates only, in text order. */\nexport function findInvalidSecretReferences(\n  text: string,\n): Array<Extract<SecretTextToken, { type: \"invalid\" }>> {\n  if (!containsSecretReference(text)) return [];\n  return tokenizeSecretText(text).filter(\n    (token): token is Extract<SecretTextToken, { type: \"invalid\" }> => token.type === \"invalid\",\n  );\n}\n\n/** Parse exactly one reference (`{{…}}`). Throws SecretReferenceSyntaxError. */\nexport function parseSecretReference(raw: string): SecretReference {\n  const prefix = prefixAt(raw, 0);\n  if (prefix === null) {\n    throw new SecretReferenceSyntaxError(\n      \"missing_prefix\",\n      \"a secret reference starts with {{secret: or {{secretfile:\",\n    );\n  }\n  const scanned = scanCandidate(raw, 0, prefix);\n  if (!scanned.ok) throw new SecretReferenceSyntaxError(scanned.reason);\n  if (scanned.end !== raw.length) {\n    throw new SecretReferenceSyntaxError(\"trailing_text\", \"unexpected text after the reference\");\n  }\n  return scanned.reference;\n}\n\nexport type FormatSecretReferenceInput =\n  | {\n      kind?: SecretReferenceKind;\n      vault?: string;\n      item: string;\n      field?: string;\n      otp?: boolean;\n      previous?: boolean;\n    }\n  | {\n      kind?: SecretReferenceKind;\n      itemId: string;\n      field?: string;\n      otp?: boolean;\n      previous?: boolean;\n    };\n\n/** Build a reference. Throws SecretReferenceSyntaxError when a name cannot be referenced. */\nexport function formatSecretReference(input: FormatSecretReferenceInput): string {\n  const kind = input.kind ?? \"secret\";\n  const parts: string[] = [];\n  if (\"itemId\" in input) {\n    if (!UUID_PATTERN.test(input.itemId)) throw new SecretReferenceSyntaxError(\"invalid_id\");\n    parts.push(`${ID_PREFIX}${input.itemId.toLowerCase()}`);\n  } else {\n    if (input.vault !== undefined) parts.push(input.vault);\n    parts.push(input.item);\n  }\n  if (input.field !== undefined) parts.push(input.field);\n  for (const part of \"itemId\" in input ? parts.slice(1) : parts) assertSegment(part);\n  const body = `${parts.join(\"/\")}${input.otp ? \"/otp\" : \"\"}${input.previous ? PREVIOUS_SUFFIX : \"\"}`;\n  const raw = `{{${kind}:${body}}}`;\n  if (raw.length > VAULT_LIMITS.referenceMaxChars) throw new SecretReferenceSyntaxError(\"too_long\");\n  return raw;\n}\n\n/** NFC + trim + lowercase. For UI and dedupe only; SQL `vault_name_key` is authoritative. */\nexport function secretNameKey(name: string): string {\n  return name.normalize(\"NFC\").trim().toLowerCase();\n}\n\n/** Canonical dedupe key within one call (same target and modifiers → same key). */\nexport function referenceKey(ref: SecretReference): string {\n  const target =\n    ref.target.form === \"id\"\n      ? `id:${ref.target.itemId.toLowerCase()}/${ref.target.field === null ? \"\" : secretNameKey(ref.target.field)}`\n      : `path:${ref.target.segments.map(secretNameKey).join(\"/\")}`;\n  return `${ref.kind}|${target}|${ref.otp ? \"otp\" : \"\"}|${ref.previous ? \"previous\" : \"\"}`;\n}\n\n/** Remove escapes (`\\{{secret:…}}` → `{{secret:…}}`); references stay as written. */\nexport function unescapeSecretText(text: string): string {\n  if (!containsSecretReference(text)) return text;\n  return tokenizeSecretText(text)\n    .map((token) =>\n      token.type === \"text\"\n        ? token.value\n        : token.type === \"reference\"\n          ? token.reference.raw\n          : token.raw,\n    )\n    .join(\"\");\n}\n\nfunction walkStrings(value: unknown, visit: (text: string) => void, seen: Set<object>): void {\n  if (typeof value === \"string\") {\n    visit(value);\n    return;\n  }\n  if (value === null || typeof value !== \"object\") return;\n  if (seen.has(value)) return;\n  seen.add(value);\n  if (Array.isArray(value)) {\n    for (const entry of value) walkStrings(entry, visit, seen);\n    return;\n  }\n  for (const entry of Object.values(value as Record<string, unknown>))\n    walkStrings(entry, visit, seen);\n}\n\n/** Every valid reference in every string value of a JSON-like structure. */\nexport function collectReferencesDeep(value: unknown): SecretReference[] {\n  const out: SecretReference[] = [];\n  walkStrings(value, (text) => out.push(...findSecretReferences(text)), new Set());\n  return out;\n}\n\n/** Every invalid candidate in every string value of a JSON-like structure. */\nexport function collectInvalidReferencesDeep(\n  value: unknown,\n): Array<Extract<SecretTextToken, { type: \"invalid\" }>> {\n  const out: Array<Extract<SecretTextToken, { type: \"invalid\" }>> = [];\n  walkStrings(value, (text) => out.push(...findInvalidSecretReferences(text)), new Set());\n  return out;\n}\n\n/**\n * Deep copy with each reference replaced by `replace(ref)` and escapes\n * removed. Strings without the marker are copied unchanged; invalid\n * candidates are kept verbatim (callers reject them before replacing).\n * Object keys are not rewritten.\n */\nexport function replaceReferencesDeep<T>(value: T, replace: (ref: SecretReference) => string): T {\n  const replaceText = (text: string): string => {\n    if (!containsSecretReference(text)) return text;\n    return tokenizeSecretText(text)\n      .map((token) =>\n        token.type === \"text\"\n          ? token.value\n          : token.type === \"reference\"\n            ? replace(token.reference)\n            : token.raw,\n      )\n      .join(\"\");\n  };\n  const copy = (input: unknown): unknown => {\n    if (typeof input === \"string\") return replaceText(input);\n    if (input === null || typeof input !== \"object\") return input;\n    if (Array.isArray(input)) return input.map(copy);\n    if (input instanceof Uint8Array || input instanceof Date) return input;\n    const out: Record<string, unknown> = {};\n    for (const [key, entry] of Object.entries(input as Record<string, unknown>)) {\n      out[key] = copy(entry);\n    }\n    return out;\n  };\n  return copy(value) as T;\n}\n","/**\n * Known-value secret masking: one deterministic engine for every place that\n * must not show a secret value it knows about (tool results, stored history\n * and events, browser and desktop observations, history scrubbing).\n *\n * A value is searched for in the forms it takes in text: as written, trimmed,\n * line by line, JSON-escaped (once and twice), percent-encoded (URI component,\n * `+` for spaces, form encoding) and, optionally, base64 (standard and\n * URL-safe, standalone and inside a longer base64 run). Each match is replaced\n * by the value's label, normally the reference that resolved it\n * (`{{secret:Vault/Item/field}}`), so whoever reads the text knows which secret\n * it was and can keep using it by reference.\n *\n * Properties:\n * - Values shorter than the minimum (8 characters by default) are never\n *   searched for: a short value such as a PIN would mangle unrelated text.\n * - The longest form wins where several match at one position.\n * - Idempotent: the labels and Opengeni's markers already in the text are\n *   kept, so masking masked text changes nothing. Other reference-shaped text\n *   is searched like any text: a value inside it is still the value.\n * - A text that ends, or reaches a truncation mark (`...`, `…`), partway\n *   through a value has that clipped start replaced too, when the start is\n *   distinctive (at least 16 characters and half of the value).\n * - Pure and isomorphic: no I/O, no clock, no randomness.\n *\n * Labels must be safe inside JSON strings and URLs. `secretReferenceMaskLabel`\n * guarantees this for references; `secretCredentialMaskLabel` for Opengeni's\n * own credentials.\n */\nimport { formatSecretReference, parseSecretReference } from \"./secret-references\";\nimport type { ResolvedSecretValue, SecretResolver } from \"./secret-resolution\";\nimport { isBase64DataUrl, isTextMediaType, mapSecretMaskableStrings } from \"./secret-mask-strings\";\nimport {\n  collectSecretShapes,\n  maskSecretShapes,\n  maskSecretShapesInText,\n  secretShapeMaskLabel,\n  type SecretShapeMatch,\n} from \"./secret-shape-masking\";\n\nexport { isBase64DataUrl, isTextMediaType, mapSecretMaskableStrings };\n\n/** Values shorter than this are not masked by default. Eight characters keeps\n * PINs, one-time codes, ports and short words out while still covering real\n * passwords, tokens and keys (which are almost always longer). */\nexport const SECRET_VALUE_MASK_MIN_CHARS = 8;\n\n/** A text that ends (or reaches a truncation mark) partway through a value\n * has that clipped start masked only when it is distinctive: at least this\n * many characters... */\nexport const SECRET_VALUE_CLIPPED_MIN_CHARS = 16;\n/** ...and at least this share of the value's form. A shared prefix (a URL\n * scheme, a token's fixed header, `-----BEGIN`) is never enough on its own. */\nexport const SECRET_VALUE_CLIPPED_MIN_SHARE = 0.5;\n\n/** Distinct values one memory keeps; the oldest drop first. */\nexport const SECRET_VALUE_MEMORY_MAX_ENTRIES = 512;\n\nexport type SecretValueMaskEntry = {\n  /** The plaintext to find. Never logged or returned by this module. */\n  value: string;\n  /** What replaces it: a reference or a fixed marker. Must be JSON- and URL-safe text. */\n  label: string;\n};\n\nexport type SecretValueMaskOptions = {\n  /** Values (and derived forms) shorter than this are skipped. Default 8. */\n  minChars?: number;\n  /** Also search base64 forms. Default true. */\n  base64?: boolean;\n  /** Minimum characters for a clipped start (default 16, never below `minChars`). */\n  clippedMinChars?: number;\n  /** Minimum share of the form for a clipped start, 0 to 1 (default 0.5). */\n  clippedMinShare?: number;\n  /**\n   * The end of a text counts as a cut only when the text has at least this\n   * many characters (default 1,024: output clipped to a size). Truncation\n   * marks always count.\n   */\n  clippedTextEndMinChars?: number;\n  /**\n   * Lines of a multi-line value searched on their own. \"key-material\"\n   * (default): lines of at least 16 characters made only of base64 or hex\n   * characters (PEM body lines), so a structured value's ordinary lines\n   * (`NODE_ENV=production`) stay searchable text; \"all\": every line of at\n   * least `minChars`.\n   */\n  lines?: \"key-material\" | \"all\";\n  /**\n   * Which forms are indexed for clipped starts. \"primary\" (default): the\n   * value as written, trimmed and JSON-escaped once, which bounds memory for\n   * long values. \"all\": every form, including lines and percent-encoded\n   * forms (short typed values in browser and desktop results).\n   */\n  clippedForms?: \"primary\" | \"all\";\n  /**\n   * Object keys whose string values stay untouched (identifiers, digests).\n   * Binary payloads are always skipped: a string that is entirely a base64\n   * data URL (`data:<type>/<subtype>;base64,<base64>`) and the `data` of an\n   * object that also carries a MIME type (image and file content). Payloads\n   * of a text type are searched decoded and encoded again.\n   */\n  skipKey?: (key: string) => boolean;\n};\n\nexport type SecretValueMaskDiagnostic = {\n  /** Where masking failed, for example `tool_result` or `event_writer`. */\n  stage: string;\n  /** The error's class name only; never its message, which could carry text. */\n  error: string;\n};\n\n/** The marker that replaces a credential Opengeni itself put into the attempt. */\nconst CREDENTIAL_LABEL_OPEN = \"[opengeni credential: \";\n/** How a `[masked <kind>]` marker (a shape value that has no reference) starts. */\nconst SHAPE_MARKER_OPEN = \"[masked \";\n\nexport function secretCredentialMaskLabel(kind: string): string {\n  const safe = kind.replace(/[^A-Za-z0-9 ._-]/gu, \"\").slice(0, 60) || \"credential\";\n  return `${CREDENTIAL_LABEL_OPEN}${safe}]`;\n}\n\n/** Generic replacement when no usable reference exists. */\nexport const SECRET_VALUE_GENERIC_MASK_LABEL = \"[secret]\";\n\nconst REFERENCE_OPEN = \"\\u007B\\u007Bsecret:\";\nconst FILE_REFERENCE_OPEN = \"\\u007B\\u007Bsecretfile:\";\nconst JSON_UNSAFE = /[\"\\\\\\u0000-\\u001f\\u007f-\\u009f\\u2028\\u2029]/u;\n\n/**\n * The label for a value a reference resolved to: the reference as written\n * (a `secretfile` reference is shown as the equivalent `secret` reference,\n * since what appears in text is the value, not the file path). A reference\n * whose text is unsafe inside JSON (a name with a quote) is written in its ID\n * form instead, which resolves to the same field.\n */\nexport function secretReferenceMaskLabel(input: {\n  raw: string;\n  itemId?: string | null;\n  fieldName?: string | null;\n}): string {\n  let raw = input.raw;\n  if (raw.startsWith(FILE_REFERENCE_OPEN)) {\n    raw = REFERENCE_OPEN + raw.slice(FILE_REFERENCE_OPEN.length);\n  }\n  if (raw.startsWith(REFERENCE_OPEN) && !JSON_UNSAFE.test(raw)) return raw;\n  if (input.itemId) {\n    try {\n      let previous = false;\n      try {\n        previous = parseSecretReference(raw).previous;\n      } catch {\n        previous = false;\n      }\n      const id = formatSecretReference({\n        itemId: input.itemId,\n        ...(input.fieldName ? { field: input.fieldName } : {}),\n        ...(previous ? { previous: true } : {}),\n      });\n      if (!JSON_UNSAFE.test(id)) return id;\n    } catch {\n      // Fall through to the generic marker.\n    }\n  }\n  return SECRET_VALUE_GENERIC_MASK_LABEL;\n}\n\nexport function isSecretReferenceMaskLabel(label: string): boolean {\n  return label.startsWith(REFERENCE_OPEN);\n}\n\n// ---------------------------------------------------------------------------\n// Forms\n// ---------------------------------------------------------------------------\n\nconst BASE64_ALPHABET = \"ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+/\";\n\nfunction utf8Bytes(value: string): Uint8Array | null {\n  try {\n    return new TextEncoder().encode(value);\n  } catch {\n    return null;\n  }\n}\n\nfunction base64(bytes: Uint8Array): string {\n  let out = \"\";\n  for (let index = 0; index < bytes.length; index += 3) {\n    const a = bytes[index]!;\n    const b = index + 1 < bytes.length ? bytes[index + 1]! : 0;\n    const c = index + 2 < bytes.length ? bytes[index + 2]! : 0;\n    const triple = (a << 16) | (b << 8) | c;\n    out += BASE64_ALPHABET[(triple >> 18) & 63]!;\n    out += BASE64_ALPHABET[(triple >> 12) & 63]!;\n    out += index + 1 < bytes.length ? BASE64_ALPHABET[(triple >> 6) & 63]! : \"=\";\n    out += index + 2 < bytes.length ? BASE64_ALPHABET[triple & 63]! : \"=\";\n  }\n  return out;\n}\n\n/** Standalone base64 (padded and unpadded) and the part of the encoding that\n * depends only on the value at each of the three byte alignments a value can\n * have inside a longer base64 run (for example `user:token` in Basic auth). */\nfunction base64Forms(value: string): string[] {\n  const bytes = utf8Bytes(value);\n  if (bytes === null || bytes.length === 0) return [];\n  const forms: string[] = [];\n  const whole = base64(bytes);\n  forms.push(whole, whole.replace(/=+$/u, \"\"));\n  for (let offset = 0; offset < 3; offset += 1) {\n    const padded = new Uint8Array(offset + bytes.length);\n    padded.set(bytes, offset);\n    const encoded = base64(padded);\n    const start = Math.ceil((offset * 8) / 6);\n    const end = Math.floor(((offset + bytes.length) * 8) / 6);\n    if (end > start) forms.push(encoded.slice(start, end));\n  }\n  const withUrlSafe: string[] = [];\n  for (const form of forms) {\n    withUrlSafe.push(form, form.replaceAll(\"+\", \"-\").replaceAll(\"/\", \"_\"));\n  }\n  return withUrlSafe;\n}\n\nconst PEM_BOUNDARY = /^-----(BEGIN|END) [A-Z0-9 ]+-----$/u;\n\n/**\n * A line of key material (a PEM body line): pure hex, or base64 characters\n * with an upper-case letter, a lower-case letter and a digit. Not `NAME=value`\n * and not identifier-like lines such as `production-cluster-name`.\n */\nconst KEY_MATERIAL_LINE =\n  /^(?:[0-9A-Fa-f]+|(?=[^\\n]*[A-Z])(?=[^\\n]*[a-z])(?=[^\\n]*[0-9])[A-Za-z0-9+/_-]+={0,2})$/u;\n\n/**\n * Every form of one value searched for in text, longest first. Forms shorter\n * than `minChars` are dropped; a value shorter than it has no forms.\n */\nexport function secretValueForms(value: string, options: SecretValueMaskOptions = {}): string[] {\n  const minChars = options.minChars ?? SECRET_VALUE_MASK_MIN_CHARS;\n  if (typeof value !== \"string\" || value.length < minChars) return [];\n  const forms = new Set<string>();\n  const add = (form: string | null | undefined) => {\n    if (form && form.length >= minChars) forms.add(form);\n  };\n  add(value);\n  // Tools trim the text they report and keep its first line, so a value's\n  // trimmed form and each line of a multi-line value are searched too (but\n  // not PEM boundary lines, which are the same in every key).\n  add(value.trim());\n  // By default only lines that look like key material (base64 or hex only,\n  // at least 16 characters), so a structured value's ordinary lines\n  // (`NODE_ENV=production`) stay searchable text.\n  const lines = value.split(/\\r?\\n|\\r/u);\n  if (lines.length > 1) {\n    for (const line of lines) {\n      const trimmed = line.trim();\n      if (PEM_BOUNDARY.test(trimmed)) continue;\n      if (options.lines === \"all\" || (trimmed.length >= 16 && KEY_MATERIAL_LINE.test(trimmed))) {\n        add(trimmed);\n      }\n    }\n  }\n  const escaped = JSON.stringify(value).slice(1, -1);\n  add(escaped);\n  add(JSON.stringify(escaped).slice(1, -1));\n  try {\n    const uri = encodeURIComponent(value);\n    add(uri);\n    add(uri.replaceAll(\"%20\", \"+\"));\n    add(uri.replace(/%[0-9A-F]{2}/gu, (match) => match.toLowerCase()));\n  } catch {\n    // A lone surrogate has no URI form; the raw value is still searched.\n  }\n  // Submitted forms and URLSearchParams encode more characters (for example\n  // \"!\" as \"%21\") than encodeURIComponent does.\n  try {\n    add(new URLSearchParams({ v: value }).toString().slice(2));\n  } catch {\n    // Same as above.\n  }\n  if (options.base64 !== false) for (const form of base64Forms(value)) add(form);\n  return [...forms].sort((left, right) => right.length - left.length);\n}\n\n// ---------------------------------------------------------------------------\n// Compiled masks\n// ---------------------------------------------------------------------------\n\n/**\n * Markers that are never searched inside: Opengeni's own credential and\n * capture markers and the generic `[secret]`. A compiled set also keeps its\n * own labels exactly. Other reference-shaped text is searched like any text:\n * a value written inside reference syntax is still the value.\n */\nconst PROTECTED_PATTERNS = [\n  \"\\\\[opengeni credential: [A-Za-z0-9 ._-]{1,60}\\\\]\",\n  \"\\\\[masked [a-z0-9 _-]{1,40}\\\\]\",\n  \"\\\\[secret\\\\]\",\n];\n\nfunction escapeRegExp(text: string): string {\n  return text.replace(/[.*+?^${}()|[\\]\\\\]/gu, \"\\\\$&\");\n}\n\n/** Where text may have been cut: its end, and each truncation mark a tool\n * leaves where it clipped a longer text before adding more after it. */\nconst TRUNCATION_MARK = /\\.\\.\\.|\\u2026/gu;\n\nexport type CompiledSecretValueMasks = {\n  readonly empty: boolean;\n  readonly minChars: number;\n  readonly skipKey: ((key: string) => boolean) | undefined;\n  /** Labels and markers kept as they are; null when there is nothing to search for. */\n  readonly pattern: RegExp | null;\n  readonly labels: ReadonlyMap<string, string>;\n  /** Forms longest first. */\n  readonly forms: readonly string[];\n  /** Forms by their first `minChars` characters, longest first. */\n  readonly byPrefix: ReadonlyMap<string, readonly string[]>;\n  /** The first two character codes of every form, as one number. */\n  readonly firstPairs: ReadonlySet<number>;\n  /** Clipped starts: at least this many characters... */\n  readonly clippedMinChars: number;\n  /** ...and at least this share of the form. */\n  readonly clippedMinShare: number;\n  /** The end of a text is a cut only for texts at least this long. */\n  readonly clippedTextEndMinChars: number;\n  /**\n   * Clipped starts of forms by their last `clippedMinChars` characters,\n   * longest first, so a cut needs one lookup.\n   */\n  readonly byClippedEnd: ReadonlyMap<string, readonly ClippedStart[]>;\n  readonly longestForm: number;\n};\n\n/** A distinctive start of a form: `form.slice(0, length)`. */\ntype ClippedStart = { form: string; length: number };\n\n/** Forms longer than this are not indexed for clipped starts (bounded memory). */\nconst CLIPPED_INDEX_MAX_FORM_CHARS = 8_192;\n/**\n * Index entries for clipped starts across all values; once reached, the\n * remaining (longest) forms are matched whole only.\n */\nconst CLIPPED_INDEX_MAX_ENTRIES = 200_000;\n/** Truncation marks examined per text, and candidates per mark. */\nconst CLIPPED_MAX_CUTS = 256;\nconst CLIPPED_MAX_CANDIDATES = 32;\n/** The end of a text counts as a cut only for long texts (output clipped to a size). */\nexport const SECRET_VALUE_CLIPPED_TEXT_END_MIN_CHARS = 1_024;\n\n/** Compile entries once for repeated masking. A form keeps the label of the first entry that has it. */\nexport function compileSecretValueMasks(\n  entries: readonly SecretValueMaskEntry[],\n  options: SecretValueMaskOptions = {},\n): CompiledSecretValueMasks {\n  const minChars = Math.max(2, options.minChars ?? SECRET_VALUE_MASK_MIN_CHARS);\n  const clippedMinChars = Math.max(\n    minChars,\n    options.clippedMinChars ?? SECRET_VALUE_CLIPPED_MIN_CHARS,\n  );\n  const clippedMinShare = Math.min(\n    1,\n    Math.max(0, options.clippedMinShare ?? SECRET_VALUE_CLIPPED_MIN_SHARE),\n  );\n  const labels = new Map<string, string>();\n  const labelTexts = new Set<string>();\n  // Clipped starts are indexed for the forms text usually shows (as written,\n  // trimmed, JSON-escaped once), not the encoded variants.\n  const clippable = new Set<string>();\n  for (const entry of entries) {\n    if (typeof entry?.value !== \"string\" || typeof entry.label !== \"string\") continue;\n    const forms = secretValueForms(entry.value, { ...options, minChars });\n    if (forms.length === 0) continue;\n    labelTexts.add(entry.label);\n    for (const form of forms) if (!labels.has(form)) labels.set(form, entry.label);\n    clippable.add(entry.value);\n    clippable.add(entry.value.trim());\n    clippable.add(JSON.stringify(entry.value).slice(1, -1));\n  }\n  const forms = [...labels.keys()].sort((left, right) => right.length - left.length);\n  const byPrefix = new Map<string, string[]>();\n  const byClippedEnd = new Map<string, ClippedStart[]>();\n  const firstPairs = new Set<number>();\n  for (const form of forms) {\n    const prefix = form.slice(0, minChars);\n    const bucket = byPrefix.get(prefix);\n    if (bucket) bucket.push(form);\n    else byPrefix.set(prefix, [form]);\n    firstPairs.add(form.charCodeAt(0) * 65_536 + form.charCodeAt(1));\n  }\n  // Shortest forms first, so the global cap leaves out the longest values.\n  let indexed = 0;\n  for (let index = forms.length - 1; index >= 0; index -= 1) {\n    const form = forms[index]!;\n    if (options.clippedForms !== \"all\" && !clippable.has(form)) continue;\n    if (form.length <= clippedMinChars || form.length > CLIPPED_INDEX_MAX_FORM_CHARS) continue;\n    const shortest = Math.max(clippedMinChars, Math.ceil(form.length * clippedMinShare));\n    if (indexed + (form.length - shortest) > CLIPPED_INDEX_MAX_ENTRIES) break;\n    for (let length = shortest; length < form.length; length += 1) {\n      const key = form.slice(length - clippedMinChars, length);\n      const starts = byClippedEnd.get(key);\n      if (starts) starts.push({ form, length });\n      else byClippedEnd.set(key, [{ form, length }]);\n    }\n    indexed += form.length - shortest;\n  }\n  for (const starts of byClippedEnd.values()) {\n    starts.sort((left, right) => right.length - left.length);\n  }\n  const pattern =\n    forms.length === 0\n      ? null\n      : new RegExp(\n          [\n            ...[...labelTexts].sort((left, right) => right.length - left.length).map(escapeRegExp),\n            ...PROTECTED_PATTERNS,\n          ]\n            .map((source) => `(?:${source})`)\n            .join(\"|\"),\n          \"gu\",\n        );\n  return {\n    empty: forms.length === 0,\n    minChars,\n    skipKey: options.skipKey,\n    pattern,\n    labels,\n    forms,\n    byPrefix,\n    firstPairs,\n    clippedMinChars,\n    clippedMinShare,\n    clippedTextEndMinChars: Math.max(\n      0,\n      options.clippedTextEndMinChars ?? SECRET_VALUE_CLIPPED_TEXT_END_MIN_CHARS,\n    ),\n    byClippedEnd,\n    longestForm: forms[0]?.length ?? 0,\n  };\n}\n\n/**\n * The longest start of a form that `text` ends with at `cut` (text clipped to\n * a length can end partway through a value, and that partial value is still\n * the secret's start). Only distinctive starts count: at least\n * `clippedMinChars` characters and `clippedMinShare` of the form, so a\n * shared prefix such as a URL scheme or a token's fixed header is not one.\n */\nfunction clippedSecretTail(\n  text: string,\n  cut: number,\n  masks: CompiledSecretValueMasks,\n): { length: number; label: string } | null {\n  const probe = masks.clippedMinChars;\n  if (cut < probe || masks.byClippedEnd.size === 0) return null;\n  const candidates = masks.byClippedEnd.get(text.slice(cut - probe, cut));\n  if (!candidates) return null;\n  // Longest first: the longest clipped value wins.\n  let checked = 0;\n  for (const { form, length } of candidates) {\n    if (length > cut) continue;\n    if (checked++ >= CLIPPED_MAX_CANDIDATES) break;\n    if (!text.startsWith(form.slice(0, length), cut - length)) continue;\n    const label = masks.labels.get(form);\n    if (label !== undefined) return { length, label };\n  }\n  return null;\n}\n\nfunction overlapsKept(start: number, end: number, kept: ReadonlyArray<[number, number]>): boolean {\n  for (const [from, to] of kept) if (start < to && from < end) return true;\n  return false;\n}\n\nfunction keptRanges(text: string, pattern: RegExp): Array<[number, number]> {\n  const kept: Array<[number, number]> = [];\n  pattern.lastIndex = 0;\n  for (const match of text.matchAll(pattern)) {\n    if (match[0].length > 0) kept.push([match.index, match.index + match[0].length]);\n  }\n  return kept;\n}\n\n/** Mask one text with compiled entries. */\nexport function maskSecretValuesInText(text: string, masks: CompiledSecretValueMasks): string {\n  if (masks.empty || masks.pattern === null || text.length < masks.minChars) return text;\n  const size = masks.minChars;\n  // Existing labels and markers are skipped; where one starts, it wins, and\n  // no match may run into one.\n  const kept = keptRanges(text, masks.pattern);\n  let out = \"\";\n  let copied = 0;\n  let next = 0;\n  for (let at = 0; at <= text.length - size;) {\n    while (next < kept.length && kept[next]![1] <= at) next += 1;\n    if (next < kept.length && kept[next]![0] <= at) {\n      at = kept[next]![1];\n      next += 1;\n      continue;\n    }\n    if (!masks.firstPairs.has(text.charCodeAt(at) * 65_536 + text.charCodeAt(at + 1))) {\n      at += 1;\n      continue;\n    }\n    const candidates = masks.byPrefix.get(text.slice(at, at + size));\n    const limit = next < kept.length ? kept[next]![0] : text.length;\n    const form = candidates?.find(\n      (candidate) => at + candidate.length <= limit && text.startsWith(candidate, at),\n    );\n    if (form === undefined) {\n      at += 1;\n      continue;\n    }\n    out += text.slice(copied, at) + masks.labels.get(form)!;\n    at += form.length;\n    copied = at;\n  }\n  out += text.slice(copied);\n  if (masks.byClippedEnd.size === 0) return out;\n  // Truncation marks (not one right after another, as in `......`), and the\n  // end of a long text. From the last cut back, so earlier positions stay valid.\n  const cuts: number[] = out.length >= masks.clippedTextEndMinChars ? [out.length] : [];\n  const marks = [...out.matchAll(TRUNCATION_MARK)];\n  for (let index = marks.length - 1; index >= 0; index -= 1) {\n    if (cuts.length >= CLIPPED_MAX_CUTS) break;\n    const mark = marks[index]!;\n    const previous = marks[index - 1];\n    if (previous && previous.index + previous[0].length === mark.index) continue;\n    cuts.push(mark.index);\n  }\n  if (cuts.length === 0) return out;\n  const keptBefore = keptRanges(out, masks.pattern);\n  let changedFrom = out.length + 1;\n  for (const cut of cuts) {\n    // A tail replaced at a later cut already covers this one.\n    if (cut > changedFrom) continue;\n    const tail = clippedSecretTail(out, cut, masks);\n    if (!tail) continue;\n    const start = cut - tail.length;\n    if (overlapsKept(start, cut, keptBefore)) continue;\n    out = out.slice(0, start) + tail.label + out.slice(cut);\n    changedFrom = start;\n  }\n  return out;\n}\n\n/**\n * Deep copy of `value` with every known secret value replaced in every string\n * (object keys are kept). Inputs that need no change keep their identity.\n */\nexport function maskSecretValues<T>(\n  value: T,\n  entries: readonly SecretValueMaskEntry[] | CompiledSecretValueMasks,\n  options: SecretValueMaskOptions = {},\n): T {\n  const masks = Array.isArray(entries)\n    ? compileSecretValueMasks(entries as readonly SecretValueMaskEntry[], options)\n    : (entries as CompiledSecretValueMasks);\n  if (masks.empty) return value;\n  return mapSecretMaskableStrings(\n    value,\n    (text) => maskSecretValuesInText(text, masks),\n    masks.skipKey,\n  );\n}\n\n// ---------------------------------------------------------------------------\n// First-party call metadata\n// ---------------------------------------------------------------------------\n\n/**\n * The MCP `_meta` key on a worker's call to Opengeni's own server that\n * carries the values its arguments resolved to (with their references), so\n * the server masks them in what it stores and returns. Never logged.\n */\nexport const FIRST_PARTY_SECRET_VALUES_META_KEY = \"opengeniSecretValues\";\n\n/** The resolved values a first-party call's `_meta` carries, if any. */\nexport function firstPartySecretValuesFromMeta(meta: unknown): SecretValueMaskEntry[] {\n  if (meta === null || typeof meta !== \"object\") return [];\n  const entries = (meta as Record<string, unknown>)[FIRST_PARTY_SECRET_VALUES_META_KEY];\n  if (!Array.isArray(entries)) return [];\n  return entries.filter(\n    (entry): entry is SecretValueMaskEntry =>\n      entry !== null &&\n      typeof entry === \"object\" &&\n      typeof (entry as SecretValueMaskEntry).value === \"string\" &&\n      typeof (entry as SecretValueMaskEntry).label === \"string\",\n  );\n}\n\n/**\n * Whether a secret-shaped value is distinctive enough to search for in any\n * text: at least 16 characters with three kinds of characters (lower case,\n * upper case, digits, others), or 24 with two, and not the user name beside it.\n */\nfunction isDistinctiveSecret(value: string, username?: string): boolean {\n  if (username !== undefined && value === username) return false;\n  const kinds =\n    Number(/[a-z]/.test(value)) +\n    Number(/[A-Z]/.test(value)) +\n    Number(/[0-9]/.test(value)) +\n    Number(/[^A-Za-z0-9]/.test(value));\n  return (value.length >= 16 && kinds >= 3) || (value.length >= 24 && kinds >= 2);\n}\n\n/** A revealed value as it appears in text: as written and JSON-escaped. */\nfunction revealedForms(value: string): string[] {\n  if (value.length === 0) return [];\n  const escaped = JSON.stringify(value).slice(1, -1);\n  return escaped === value ? [value] : [value, escaped];\n}\n\n// ---------------------------------------------------------------------------\n// Memory\n// ---------------------------------------------------------------------------\n\n/**\n * Saves detected secret-shaped values somewhere they can be used by\n * reference (the task vault) and returns, per value it saved, the reference\n * to write instead. Values it leaves out are masked with a fixed marker.\n */\nexport type SecretShapeCapturer = (\n  matches: readonly SecretShapeMatch[],\n) => Promise<ReadonlyMap<string, string>>;\n\n/** Distinct new values captured from one tool result; the rest get a marker. */\nexport const SECRET_SHAPE_CAPTURES_PER_RESULT = 16;\n\n/**\n * The secret values one owner (an agent attempt, a browser session) knows\n * about, with their labels, and masking against all of them. Masking never\n * throws: an internal failure returns the input unchanged and reports a\n * metadata-only diagnostic.\n */\nexport class SecretValueMemory {\n  private readonly values = new Map<string, string>();\n  private readonly operations = new Map<string, SecretValueMaskEntry[]>();\n  private compiled: CompiledSecretValueMasks | null = null;\n  /** Masks without values that only have a `[masked <kind>]` marker, by version. */\n  private compiledReferenced: { version: number; masks: CompiledSecretValueMasks } | null = null;\n  private changes = 0;\n  private readonly options: SecretValueMaskOptions;\n  private readonly maxEntries: number;\n  private onDiagnostic: ((diagnostic: SecretValueMaskDiagnostic) => void) | undefined;\n  private refresher: (() => Promise<void>) | undefined;\n  /** Values an explicit, audited reveal (`secret_get`) handed to the agent. */\n  private readonly revealed = new Set<string>();\n  private disposed = false;\n  /** Secret-shaped values seen in tool output, with what replaces them (any length). */\n  private readonly shapes = new Map<string, string>();\n  private shapeCapturer: SecretShapeCapturer | undefined;\n\n  constructor(\n    options: SecretValueMaskOptions & {\n      maxEntries?: number;\n      onDiagnostic?: (diagnostic: SecretValueMaskDiagnostic) => void;\n    } = {},\n  ) {\n    const { maxEntries, onDiagnostic, ...maskOptions } = options;\n    this.options = maskOptions;\n    this.maxEntries = maxEntries ?? SECRET_VALUE_MEMORY_MAX_ENTRIES;\n    this.onDiagnostic = onDiagnostic;\n  }\n\n  /** Replace the diagnostic sink (for example once observability is ready). */\n  setDiagnosticSink(sink: ((diagnostic: SecretValueMaskDiagnostic) => void) | undefined): void {\n    this.onDiagnostic = sink;\n  }\n\n  /**\n   * Attach a loader that may remember more values (for example uses recorded\n   * by another process). It owns its own throttling.\n   */\n  setRefresher(refresher: (() => Promise<void>) | undefined): void {\n    this.refresher = refresher;\n  }\n\n  /** Run the refresher, waiting at most `maxWaitMs`; never throws. */\n  async refresh(maxWaitMs = 2_000): Promise<void> {\n    const refresher = this.refresher;\n    if (!refresher) return;\n    let timer: ReturnType<typeof setTimeout> | undefined;\n    try {\n      await Promise.race([\n        refresher(),\n        new Promise<void>((resolve) => {\n          timer = setTimeout(resolve, maxWaitMs);\n        }),\n      ]);\n    } catch (error) {\n      this.report(\"refresh\", error);\n    } finally {\n      if (timer !== undefined) clearTimeout(timer);\n    }\n  }\n\n  get minChars(): number {\n    return this.options.minChars ?? SECRET_VALUE_MASK_MIN_CHARS;\n  }\n\n  get size(): number {\n    return this.values.size;\n  }\n\n  /** Increases whenever the searched values change (for memoized masking). */\n  get version(): number {\n    return this.changes;\n  }\n\n  /**\n   * Remember a value. Returns whether it is searched for (false when shorter\n   * than the minimum). A value keeps its first reference label; a reference\n   * label replaces a credential marker, because it is the more useful name.\n   */\n  remember(value: string, label: string): boolean {\n    try {\n      if (typeof value !== \"string\" || typeof label !== \"string\") return false;\n      if (this.disposed || value.length < this.minChars || this.isRevealed(value)) return false;\n      const existing = this.values.get(value);\n      const keep =\n        existing !== undefined &&\n        (existing === label ||\n          isSecretReferenceMaskLabel(existing) ||\n          !isSecretReferenceMaskLabel(label));\n      this.values.delete(value);\n      this.values.set(value, keep ? existing! : label);\n      this.evict();\n      if (!keep) {\n        this.compiled = null;\n        this.changes += 1;\n      }\n      return true;\n    } catch (error) {\n      this.report(\"remember\", error);\n      return false;\n    }\n  }\n\n  /**\n   * Over the limit, the oldest values go first, but Opengeni's own\n   * credentials (`[opengeni credential: …]`) stay while others can go.\n   */\n  private evict(): void {\n    if (this.values.size <= this.maxEntries) return;\n    for (const [value, label] of this.values) {\n      if (this.values.size <= this.maxEntries) break;\n      if (label.startsWith(CREDENTIAL_LABEL_OPEN)) continue;\n      this.values.delete(value);\n    }\n    while (this.values.size > this.maxEntries) {\n      const oldest = this.values.keys().next().value;\n      if (oldest === undefined) break;\n      this.values.delete(oldest);\n    }\n    this.compiled = null;\n    this.changes += 1;\n  }\n\n  /**\n   * An explicit, audited plaintext read (`secret_get`) handed this value to\n   * the agent on purpose: it is not masked for the rest of this memory's\n   * life. Never throws.\n   */\n  reveal(value: string): void {\n    try {\n      if (typeof value !== \"string\" || value.length === 0) return;\n      this.revealed.add(value);\n      // A value inside the revealed one (the password of a revealed URL) was\n      // handed over with it, so it is released too; Opengeni's own\n      // credentials stay masked.\n      let changed = false;\n      for (const [known, label] of this.values) {\n        if (label.startsWith(CREDENTIAL_LABEL_OPEN) || !value.includes(known)) continue;\n        this.values.delete(known);\n        changed = true;\n      }\n      for (const known of this.shapes.keys()) {\n        if (value.includes(known)) this.shapes.delete(known);\n      }\n      if (changed) {\n        this.compiled = null;\n        this.changes += 1;\n      }\n    } catch (error) {\n      this.report(\"reveal\", error);\n    }\n  }\n\n  /**\n   * Whether `value` is, or lies within, a value `secret_get` revealed. Only a\n   * value of at least the minimum length counts as lying within one, so a\n   * short value is not released by a chance match.\n   */\n  private isRevealed(value: string): boolean {\n    if (this.revealed.size === 0) return false;\n    if (this.revealed.has(value)) return true;\n    if (value.length < this.minChars) return false;\n    for (const revealed of this.revealed) if (revealed.includes(value)) return true;\n    return false;\n  }\n\n  /**\n   * Forget every value at the end of the owner's life (an attempt), so work\n   * that outlives it neither keeps the plaintext nor masks with it.\n   */\n  dispose(): void {\n    this.disposed = true;\n    this.values.clear();\n    this.operations.clear();\n    this.revealed.clear();\n    this.shapes.clear();\n    this.shapeCapturer = undefined;\n    this.refresher = undefined;\n    this.compiled = null;\n    this.compiledReferenced = null;\n    this.changes += 1;\n  }\n\n  /**\n   * Remember a value and note that one tool call (its operation ID) used it,\n   * so the receiver of that call can mask its own stored text with exactly\n   * the values it was given.\n   */\n  rememberForOperation(operationId: string, value: string, label: string): boolean {\n    const searched = this.remember(value, label);\n    if (!searched || !operationId) return searched;\n    try {\n      const entries = this.operations.get(operationId) ?? [];\n      if (!entries.some((entry) => entry.value === value)) entries.push({ value, label });\n      this.operations.delete(operationId);\n      this.operations.set(operationId, entries);\n      while (this.operations.size > 256) {\n        const oldest = this.operations.keys().next().value;\n        if (oldest === undefined) break;\n        this.operations.delete(oldest);\n      }\n    } catch (error) {\n      this.report(\"remember\", error);\n    }\n    return searched;\n  }\n\n  /** The values one tool call used (see `rememberForOperation`). */\n  operationEntries(operationId: string): SecretValueMaskEntry[] {\n    return [...(this.operations.get(operationId) ?? [])];\n  }\n\n  /** Whether a value is remembered (for tests and dedupe; never exposes values). */\n  has(value: string): boolean {\n    return this.values.has(value);\n  }\n\n  entries(): SecretValueMaskEntry[] {\n    return [...this.values].map(([value, label]) => ({ value, label }));\n  }\n\n  private masks(): CompiledSecretValueMasks {\n    this.compiled ??= compileSecretValueMasks(this.entries(), this.options);\n    return this.compiled;\n  }\n\n  /** Deep copy with every remembered value replaced; never throws. */\n  mask<T>(value: T, stage = \"mask\"): T {\n    if (this.values.size === 0) return value;\n    try {\n      return maskSecretValues(value, this.masks());\n    } catch (error) {\n      this.report(stage, error);\n      return value;\n    }\n  }\n\n  /** `mask` without the values whose label is only a `[masked <kind>]` marker. */\n  private maskReferenced<T>(value: T, stage: string): T {\n    if (this.values.size === 0) return value;\n    let markers = false;\n    for (const label of this.values.values()) {\n      if (label.startsWith(SHAPE_MARKER_OPEN)) {\n        markers = true;\n        break;\n      }\n    }\n    if (!markers) return this.mask(value, stage);\n    try {\n      if (this.compiledReferenced?.version !== this.changes) {\n        this.compiledReferenced = {\n          version: this.changes,\n          masks: compileSecretValueMasks(\n            this.entries().filter((entry) => !entry.label.startsWith(SHAPE_MARKER_OPEN)),\n            this.options,\n          ),\n        };\n      }\n      return maskSecretValues(value, this.compiledReferenced.masks);\n    } catch (error) {\n      this.report(stage, error);\n      return value;\n    }\n  }\n\n  /** Mask one text; never throws. */\n  maskText(text: string, stage = \"mask\"): string {\n    if (this.values.size === 0 || typeof text !== \"string\") return text;\n    try {\n      return maskSecretValuesInText(text, this.masks());\n    } catch (error) {\n      this.report(stage, error);\n      return text;\n    }\n  }\n\n  /** Mask with the remembered values plus, for this call only, extra ones. */\n  maskWith<T>(value: T, extra: readonly SecretValueMaskEntry[], stage = \"mask\"): T {\n    if (extra.length === 0) return this.mask(value, stage);\n    try {\n      return maskSecretValues(value, [...this.entries(), ...extra], this.options);\n    } catch (error) {\n      this.report(stage, error);\n      return value;\n    }\n  }\n\n  /**\n   * Attach the capturer that saves secret-shaped values found in tool output\n   * (normally into the task vault). Without one they are masked with a marker.\n   */\n  setShapeCapturer(capturer: SecretShapeCapturer | undefined): void {\n    this.shapeCapturer = capturer;\n  }\n\n  /**\n   * Remember a secret-shaped value from tool output: it is replaced wherever\n   * a shape detector finds it, and (when long enough) searched for as a known\n   * value everywhere else. A reference replaces an earlier marker.\n   */\n  rememberShape(value: string, label: string, username?: string): void {\n    try {\n      if (typeof value !== \"string\" || typeof label !== \"string\" || value.length === 0) return;\n      // An ended attempt keeps nothing; a value `secret_get` revealed stays readable.\n      if (this.disposed || this.isRevealed(value)) return;\n      const existing = this.shapes.get(value);\n      if (\n        existing === undefined ||\n        (!isSecretReferenceMaskLabel(existing) && isSecretReferenceMaskLabel(label))\n      ) {\n        this.shapes.set(value, label);\n        while (this.shapes.size > this.maxEntries) {\n          const oldest = this.shapes.keys().next().value;\n          if (oldest === undefined) break;\n          this.shapes.delete(oldest);\n        }\n      }\n      // Searched everywhere else only when it is distinctive: a weak or\n      // common password (`postgres`, the URL's own user name) would mask\n      // ordinary words. Where a detector finds it, it is masked regardless.\n      if (isDistinctiveSecret(value, username)) {\n        this.remember(value, this.shapes.get(value) ?? label);\n      }\n    } catch (error) {\n      this.report(\"remember_shape\", error);\n    }\n  }\n\n  /**\n   * Find secret-shaped values in tool output that are not known yet and\n   * capture them, waiting at most `maxWaitMs`. Values the capturer does not\n   * return a reference for (or all of them, without a capturer or on any\n   * failure) are remembered with a `[masked <kind>]` marker. Never throws.\n   */\n  async captureShapes(value: unknown, stage = \"tool_result\", maxWaitMs = 5_000): Promise<void> {\n    let pending: SecretShapeMatch[];\n    try {\n      // Known values are masked first (a detected part of a vault secret is\n      // not captured again), except values that only have a marker: those\n      // are detected again, so a failed or skipped capture is retried.\n      const known = this.maskReferenced(value, stage);\n      // Values that already have a reference are done; markers are retried.\n      pending = collectSecretShapes(known, 256, {\n        ...(this.options.skipKey ? { skipKey: this.options.skipKey } : {}),\n        keep: (match, text) => !this.insideRevealed(match, text) && !this.isRevealed(match.value),\n      }).filter((match) => !isSecretReferenceMaskLabel(this.shapes.get(match.value) ?? \"\"));\n    } catch (error) {\n      this.report(stage, error);\n      return;\n    }\n    if (pending.length === 0) return;\n    const capturable = pending.slice(0, SECRET_SHAPE_CAPTURES_PER_RESULT);\n    const usernames = new Map(pending.map((match) => [match.value, match.username]));\n    let captured: ReadonlyMap<string, string> = new Map();\n    const capturer = this.shapeCapturer;\n    if (capturer) {\n      let timer: ReturnType<typeof setTimeout> | undefined;\n      try {\n        const late = capturer(capturable);\n        // A capture that finishes after the wait still upgrades the markers.\n        late.then(\n          (references) => {\n            for (const [secret, reference] of references) {\n              if (!isSecretReferenceMaskLabel(reference)) continue;\n              this.rememberShape(secret, reference, usernames.get(secret));\n            }\n          },\n          () => {},\n        );\n        captured =\n          (await Promise.race([\n            late,\n            new Promise<null>((resolve) => {\n              timer = setTimeout(() => resolve(null), maxWaitMs);\n            }),\n          ])) ?? new Map();\n      } catch (error) {\n        this.report(\"shape_capture\", error);\n      } finally {\n        if (timer !== undefined) clearTimeout(timer);\n      }\n    }\n    for (const match of pending) {\n      const reference = captured.get(match.value);\n      this.rememberShape(\n        match.value,\n        reference && isSecretReferenceMaskLabel(reference)\n          ? reference\n          : secretShapeMaskLabel(match.kind),\n        match.username,\n      );\n    }\n  }\n\n  /**\n   * Whether a detected part lies within a value `secret_get` revealed (as\n   * written or JSON-escaped), for example the password of a revealed URL.\n   */\n  private insideRevealed(match: SecretShapeMatch, text: string): boolean {\n    if (this.revealed.size === 0) return false;\n    for (const value of this.revealed) {\n      for (const form of revealedForms(value)) {\n        const at = text.indexOf(form, Math.max(0, match.start - form.length + 1));\n        if (at >= 0 && at < match.end) return true;\n      }\n    }\n    return false;\n  }\n\n  /** What replaces a detected shape: its capture, a known label, a marker, or nothing when revealed. */\n  private shapeLabel = (match: SecretShapeMatch, text: string): string | null =>\n    this.insideRevealed(match, text) || this.isRevealed(match.value)\n      ? null\n      : (this.shapes.get(match.value) ??\n        this.values.get(match.value) ??\n        secretShapeMaskLabel(match.kind));\n\n  /**\n   * Mask tool output: known values first, then every secret-shaped part\n   * (with its captured reference, or a marker). Never throws.\n   */\n  maskToolOutput<T>(value: T, stage = \"tool_result\"): T {\n    const known = this.mask(value, stage);\n    try {\n      return maskSecretShapes(known, this.shapeLabel, this.options.skipKey);\n    } catch (error) {\n      this.report(stage, error);\n      return known;\n    }\n  }\n\n  /** `maskToolOutput` for one text. */\n  maskToolOutputText(text: string, stage = \"tool_result\"): string {\n    const known = this.maskText(text, stage);\n    if (typeof known !== \"string\") return known;\n    try {\n      return maskSecretShapesInText(known, this.shapeLabel);\n    } catch (error) {\n      this.report(stage, error);\n      return known;\n    }\n  }\n\n  private report(stage: string, error: unknown): void {\n    try {\n      this.onDiagnostic?.({ stage, error: error instanceof Error ? error.name : typeof error });\n    } catch {\n      // Diagnostics never affect masking.\n    }\n  }\n}\n\n/**\n * Mask an error's message, stack, causes and inner errors (`AggregateError`)\n * in place with `memory` (bounded depth) and return it, so a rethrown error\n * carries references, not values. In \"tool_output\" mode secret-shaped parts\n * are masked too.\n * Never throws: on failure the original error is returned as it is.\n */\nexport function maskSecretValuesInError<E>(\n  error: E,\n  memory: SecretValueMemory | null | undefined,\n  mode: \"known\" | \"tool_output\" = \"known\",\n  depth = 0,\n): E {\n  // Tool output also masks secret-shaped parts (with or without known values).\n  if (!memory || !(error instanceof Error) || depth > 4) return error;\n  if (mode === \"known\" && memory.size === 0) return error;\n  // Each part on its own, so one read-only field does not stop the rest.\n  const field = (name: \"message\" | \"stack\") => {\n    try {\n      const text = error[name];\n      if (typeof text !== \"string\") return;\n      const masked =\n        mode === \"tool_output\"\n          ? memory.maskToolOutputText(text, \"tool_error\")\n          : memory.maskText(text, \"tool_error\");\n      if (masked !== text) error[name] = masked;\n    } catch {\n      // The original text stays.\n    }\n  };\n  field(\"message\");\n  field(\"stack\");\n  try {\n    if (error.cause !== undefined) maskSecretValuesInError(error.cause, memory, mode, depth + 1);\n  } catch {\n    // The cause stays as it is.\n  }\n  try {\n    const inner = (error as { errors?: unknown }).errors;\n    if (Array.isArray(inner)) {\n      for (const item of inner.slice(0, 32)) {\n        maskSecretValuesInError(item, memory, mode, depth + 1);\n      }\n    }\n  } catch {\n    // The inner errors stay as they are.\n  }\n  return error;\n}\n\n// ---------------------------------------------------------------------------\n// Explicit reveals\n// ---------------------------------------------------------------------------\n\n/**\n * Opengeni's audited plaintext read, which hands a value to the agent on\n * purpose: exactly its own `secret_get` (as the agent sees it, bare or with\n * the first-party prefix). A connector's tool of the same name is not one.\n */\nexport function isSecretRevealToolName(name: string): boolean {\n  return name === \"secret_get\" || name === \"opengeni__secret_get\";\n}\n\nfunction decodedBase64Text(value: string): string | null {\n  try {\n    const binary = atob(value.replace(/\\s+/gu, \"\"));\n    const bytes = new Uint8Array(binary.length);\n    for (let index = 0; index < binary.length; index += 1) bytes[index] = binary.charCodeAt(index);\n    return new TextDecoder(\"utf-8\", { fatal: true }).decode(bytes);\n  } catch {\n    return null;\n  }\n}\n\n/**\n * The values a `secret_get` result reveals (`{ value, encoding }`, possibly\n * as JSON text). A base64 result reveals both the encoded text and the\n * decoded UTF-8 text, since the memory holds the decoded value.\n */\nexport function secretGetRevealedValues(result: unknown, depth = 0): string[] {\n  if (depth > 6) return [];\n  if (typeof result === \"string\") {\n    const trimmed = result.trim();\n    if (!trimmed.startsWith(\"{\") && !trimmed.startsWith(\"[\")) return [];\n    try {\n      return secretGetRevealedValues(JSON.parse(trimmed), depth + 1);\n    } catch {\n      return [];\n    }\n  }\n  if (result === null || typeof result !== \"object\") return [];\n  if (Array.isArray(result)) {\n    return result.flatMap((item) => secretGetRevealedValues(item, depth + 1));\n  }\n  const record = result as Record<string, unknown>;\n  if (typeof record.value === \"string\" && record.encoding === \"utf8\") return [record.value];\n  if (typeof record.value === \"string\" && record.encoding === \"base64\") {\n    const decoded = decodedBase64Text(record.value);\n    return decoded === null ? [record.value] : [record.value, decoded];\n  }\n  return Object.values(record).flatMap((value) => secretGetRevealedValues(value, depth + 1));\n}\n\n/**\n * When `toolName` is `secret_get`, mark what its result reveals as readable\n * for the rest of the memory's life, so masking the result leaves it intact.\n * Never throws.\n */\nexport function revealSecretGetResult(\n  memory: SecretValueMemory | null | undefined,\n  toolName: string,\n  result: unknown,\n): void {\n  if (!memory) return;\n  try {\n    if (!isSecretRevealToolName(toolName)) return;\n    for (const value of secretGetRevealedValues(result)) memory.reveal(value);\n  } catch {\n    // Masking applies as usual.\n  }\n}\n\n// ---------------------------------------------------------------------------\n// Resolver integration\n// ---------------------------------------------------------------------------\n\nfunction textMaterial(value: ResolvedSecretValue): string | null {\n  const material = value.material;\n  if (material.type === \"text\") return material.value;\n  if (material.type === \"bytes\") {\n    try {\n      return new TextDecoder(\"utf-8\", { fatal: true }).decode(material.value);\n    } catch {\n      return null;\n    }\n  }\n  // A one-time code is six or eight digits that change every period: below\n  // the useful minimum and not worth searching for.\n  return null;\n}\n\n/** Remember what one resolver call returned, labelled by reference; never throws. */\nexport function rememberResolvedSecretValues(\n  memory: SecretValueMemory | null | undefined,\n  resolved: ReadonlyMap<string, ResolvedSecretValue>,\n  operationId?: string,\n): void {\n  if (!memory) return;\n  for (const value of resolved.values()) {\n    try {\n      // A plain text field (a username, a host name) is not secret: masking it\n      // would rewrite every page, log line and URL that mentions it.\n      if (value.fieldKind === \"text\") continue;\n      const text = textMaterial(value);\n      if (text === null) continue;\n      const label = secretReferenceMaskLabel({\n        raw: value.reference.raw,\n        itemId: value.itemId,\n        fieldName: value.fieldName,\n      });\n      if (operationId) memory.rememberForOperation(operationId, text, label);\n      else memory.remember(text, label);\n    } catch {\n      // Remembering never fails a resolution.\n    }\n  }\n}\n\n/** The same resolver, remembering every value it returns in the memory `target` names at resolution time. */\nexport function rememberingSecretResolver(\n  resolver: SecretResolver,\n  target: SecretValueMemory | (() => SecretValueMemory | null | undefined),\n): SecretResolver {\n  return {\n    get principal() {\n      return resolver.principal;\n    },\n    get enabled() {\n      return resolver.enabled;\n    },\n    async resolve(refs, use) {\n      const resolved = await resolver.resolve(refs, use);\n      let memory: SecretValueMemory | null | undefined;\n      try {\n        memory = typeof target === \"function\" ? target() : target;\n      } catch {\n        memory = null;\n      }\n      rememberResolvedSecretValues(memory, resolved, use.operationId);\n      return resolved;\n    },\n  };\n}\n"],"mappings":";;;;;;;;;;;;;AA2CO,IAAM,0BAA0B;AAEhC,IAAM,6BAAN,cAAyC,MAAM;AAAA,EAC3C;AAAA,EACT,YAAY,QAAgB,SAAkB;AAC5C,UAAM,WAAW,6BAA6B,MAAM,EAAE;AACtD,SAAK,OAAO;AACZ,SAAK,SAAS;AAAA,EAChB;AACF;AAEA,IAAM,WAAyE;AAAA;AAAA,EAE7E,EAAE,QAAQ,iBAAiB,MAAM,aAAa;AAAA,EAC9C,EAAE,QAAQ,aAAa,MAAM,SAAS;AACxC;AACA,IAAM,eAAe;AACrB,IAAM,kBAAkB;AACxB,IAAM,YAAY;AAEX,SAAS,wBAAwB,MAAuB;AAC7D,SAAO,KAAK,SAAS,uBAAuB;AAC9C;AAEA,SAAS,SACP,MACA,OACsD;AACtD,aAAW,aAAa,UAAU;AAChC,QAAI,KAAK,WAAW,UAAU,QAAQ,KAAK,EAAG,QAAO;AAAA,EACvD;AACA,SAAO;AACT;AAEA,SAAS,UAAU,MAAuB;AACxC,SAAO,QAAQ,MAAS,QAAQ,OAAQ,QAAQ;AAClD;AAGA,SAAS,UAAU,MAIjB;AACA,MAAI,KAAK,WAAW;AAClB,UAAM,IAAI,2BAA2B,cAAc,2BAA2B;AAChF,MAAI,OAAO;AACX,MAAI,WAAW;AACf,MAAI,KAAK,SAAS,eAAe,GAAG;AAClC,eAAW;AACX,WAAO,KAAK,MAAM,GAAG,CAAC,gBAAgB,MAAM;AAAA,EAC9C;AACA,MAAI,KAAK,SAAS,GAAG,GAAG;AACtB,UAAM,IAAI;AAAA,MACR;AAAA,MACA;AAAA,IACF;AAAA,EACF;AACA,QAAM,QAAQ,KAAK,MAAM,GAAG;AAC5B,MAAI,MAAM;AACV,MAAI,MAAM,UAAU,KAAK,MAAM,MAAM,SAAS,CAAC,EAAG,YAAY,MAAM,OAAO;AACzE,UAAM;AACN,UAAM,IAAI;AAAA,EACZ;AACA,MAAI,MAAM,CAAC,EAAG,YAAY,EAAE,WAAW,SAAS,GAAG;AACjD,UAAM,SAAS,MAAM,CAAC,EAAG,MAAM,UAAU,MAAM;AAC/C,QAAI,CAAC,aAAa,KAAK,MAAM,GAAG;AAC9B,YAAM,IAAI,2BAA2B,cAAc,sCAAsC;AAAA,IAC3F;AACA,QAAI,MAAM,SAAS,GAAG;AACpB,YAAM,IAAI,2BAA2B,qBAAqB,iCAAiC;AAAA,IAC7F;AACA,UAAM,QAAQ,MAAM,CAAC,KAAK;AAC1B,QAAI,UAAU,KAAM,eAAc,KAAK;AACvC,WAAO,EAAE,QAAQ,EAAE,MAAM,MAAM,QAAQ,OAAO,YAAY,GAAG,MAAM,GAAG,KAAK,SAAS;AAAA,EACtF;AACA,MAAI,MAAM,SAAS,GAAG;AACpB,UAAM,IAAI;AAAA,MACR;AAAA,MACA;AAAA,IACF;AAAA,EACF;AACA,aAAW,WAAW,MAAO,eAAc,OAAO;AAClD,SAAO;AAAA,IACL,QAAQ;AAAA,MACN,MAAM;AAAA,MACN,UAAU;AAAA,IACZ;AAAA,IACA;AAAA,IACA;AAAA,EACF;AACF;AAEA,SAAS,cAAc,SAAuB;AAC5C,MAAI,QAAQ,WAAW,GAAG;AACxB,UAAM,IAAI,2BAA2B,iBAAiB,+BAA+B;AAAA,EACvF;AACA,MAAI,CAAC,kBAAkB,OAAO,GAAG;AAC/B,UAAM,IAAI;AAAA,MACR;AAAA,MACA,IAAI,QAAQ,MAAM,GAAG,EAAE,CAAC;AAAA,IAC1B;AAAA,EACF;AACF;AAMA,SAAS,cACP,MACA,OACA,QAG6C;AAC7C,QAAM,YAAY,QAAQ,OAAO,OAAO;AACxC,QAAM,QAAQ,KAAK,IAAI,KAAK,QAAQ,QAAQ,aAAa,iBAAiB;AAC1E,MAAI,SAAS;AACb,SAAO,SAAS,KAAK,QAAQ;AAC3B,UAAM,OAAO,KAAK,WAAW,MAAM;AACnC,UAAM,YAAY,KAAK,MAAM;AAC7B,QAAI,cAAc,OAAO,KAAK,SAAS,CAAC,MAAM,KAAK;AACjD,YAAM,MAAM,SAAS;AACrB,UAAI,MAAM,QAAQ,aAAa,mBAAmB;AAChD,eAAO,EAAE,IAAI,OAAO,KAAK,QAAQ,WAAW;AAAA,MAC9C;AACA,YAAM,MAAM,KAAK,MAAM,OAAO,GAAG;AACjC,UAAI;AACF,cAAM,SAAS,UAAU,KAAK,MAAM,WAAW,MAAM,CAAC;AACtD,eAAO;AAAA,UACL,IAAI;AAAA,UACJ;AAAA,UACA,WAAW,EAAE,MAAM,OAAO,MAAM,KAAK,OAAO,OAAO,KAAK,GAAG,OAAO;AAAA,QACpE;AAAA,MACF,SAAS,OAAO;AACd,eAAO;AAAA,UACL,IAAI;AAAA,UACJ;AAAA,UACA,QAAQ,iBAAiB,6BAA6B,MAAM,SAAS;AAAA,QACvE;AAAA,MACF;AAAA,IACF;AACA,QAAI,cAAc,OAAO,cAAc,OAAO,UAAU,IAAI,KAAK,UAAU,OAAO;AAEhF,YAAM,MAAM,KAAK,IAAI,QAAQ,SAAS;AACtC,aAAO,EAAE,IAAI,OAAO,KAAK,QAAQ,UAAU,QAAQ,aAAa,eAAe;AAAA,IACjF;AACA,cAAU;AAAA,EACZ;AACA,SAAO,EAAE,IAAI,OAAO,KAAK,KAAK,QAAQ,QAAQ,eAAe;AAC/D;AAOO,SAAS,mBAAmB,MAAiC;AAClE,MAAI,CAAC,wBAAwB,IAAI,EAAG,QAAO,KAAK,SAAS,IAAI,CAAC,EAAE,MAAM,QAAQ,OAAO,KAAK,CAAC,IAAI,CAAC;AAChG,QAAM,SAA4B,CAAC;AACnC,MAAI,SAAS;AACb,MAAI,SAAS;AACb,QAAM,QAAQ,MAAM;AAClB,QAAI,OAAO,SAAS,EAAG,QAAO,KAAK,EAAE,MAAM,QAAQ,OAAO,OAAO,CAAC;AAClE,aAAS;AAAA,EACX;AACA,SAAO,SAAS,KAAK,QAAQ;AAC3B,UAAM,OAAO,KAAK,QAAQ,yBAAyB,MAAM;AACzD,QAAI,OAAO,GAAG;AACZ,gBAAU,KAAK,MAAM,MAAM;AAC3B;AAAA,IACF;AACA,UAAM,SAAS,SAAS,MAAM,IAAI;AAClC,QAAI,WAAW,MAAM;AAEnB,gBAAU,KAAK,MAAM,QAAQ,OAAO,wBAAwB,MAAM;AAClE,eAAS,OAAO,wBAAwB;AACxC;AAAA,IACF;AAGA,UAAM,UAAU,OAAO,KAAK,UAAU,KAAK,OAAO,CAAC,MAAM;AACzD,UAAM,UAAU,cAAc,MAAM,MAAM,MAAM;AAChD,QAAI,SAAS;AACX,gBAAU,KAAK,MAAM,QAAQ,OAAO,CAAC,IAAI,KAAK,MAAM,MAAM,QAAQ,GAAG;AACrE,eAAS,QAAQ;AACjB;AAAA,IACF;AACA,cAAU,KAAK,MAAM,QAAQ,IAAI;AACjC,UAAM;AACN,QAAI,QAAQ,IAAI;AACd,aAAO,KAAK,EAAE,MAAM,aAAa,WAAW,QAAQ,UAAU,CAAC;AAAA,IACjE,OAAO;AACL,aAAO,KAAK;AAAA,QACV,MAAM;AAAA,QACN,KAAK,KAAK,MAAM,MAAM,QAAQ,GAAG;AAAA,QACjC,OAAO;AAAA,QACP,KAAK,QAAQ;AAAA,QACb,QAAQ,QAAQ;AAAA,MAClB,CAAC;AAAA,IACH;AACA,aAAS,QAAQ;AAAA,EACnB;AACA,QAAM;AACN,SAAO;AACT;AAGO,SAAS,qBAAqB,MAAiC;AACpE,MAAI,CAAC,wBAAwB,IAAI,EAAG,QAAO,CAAC;AAC5C,SAAO,mBAAmB,IAAI,EAAE;AAAA,IAAQ,CAAC,UACvC,MAAM,SAAS,cAAc,CAAC,MAAM,SAAS,IAAI,CAAC;AAAA,EACpD;AACF;AAGO,SAAS,4BACd,MACsD;AACtD,MAAI,CAAC,wBAAwB,IAAI,EAAG,QAAO,CAAC;AAC5C,SAAO,mBAAmB,IAAI,EAAE;AAAA,IAC9B,CAAC,UAAkE,MAAM,SAAS;AAAA,EACpF;AACF;AAGO,SAAS,qBAAqB,KAA8B;AACjE,QAAM,SAAS,SAAS,KAAK,CAAC;AAC9B,MAAI,WAAW,MAAM;AACnB,UAAM,IAAI;AAAA,MACR;AAAA,MACA;AAAA,IACF;AAAA,EACF;AACA,QAAM,UAAU,cAAc,KAAK,GAAG,MAAM;AAC5C,MAAI,CAAC,QAAQ,GAAI,OAAM,IAAI,2BAA2B,QAAQ,MAAM;AACpE,MAAI,QAAQ,QAAQ,IAAI,QAAQ;AAC9B,UAAM,IAAI,2BAA2B,iBAAiB,qCAAqC;AAAA,EAC7F;AACA,SAAO,QAAQ;AACjB;AAoBO,SAAS,sBAAsB,OAA2C;AAC/E,QAAM,OAAO,MAAM,QAAQ;AAC3B,QAAM,QAAkB,CAAC;AACzB,MAAI,YAAY,OAAO;AACrB,QAAI,CAAC,aAAa,KAAK,MAAM,MAAM,EAAG,OAAM,IAAI,2BAA2B,YAAY;AACvF,UAAM,KAAK,GAAG,SAAS,GAAG,MAAM,OAAO,YAAY,CAAC,EAAE;AAAA,EACxD,OAAO;AACL,QAAI,MAAM,UAAU,OAAW,OAAM,KAAK,MAAM,KAAK;AACrD,UAAM,KAAK,MAAM,IAAI;AAAA,EACvB;AACA,MAAI,MAAM,UAAU,OAAW,OAAM,KAAK,MAAM,KAAK;AACrD,aAAW,QAAQ,YAAY,QAAQ,MAAM,MAAM,CAAC,IAAI,MAAO,eAAc,IAAI;AACjF,QAAM,OAAO,GAAG,MAAM,KAAK,GAAG,CAAC,GAAG,MAAM,MAAM,SAAS,EAAE,GAAG,MAAM,WAAW,kBAAkB,EAAE;AACjG,QAAM,MAAM,KAAK,IAAI,IAAI,IAAI;AAC7B,MAAI,IAAI,SAAS,aAAa,kBAAmB,OAAM,IAAI,2BAA2B,UAAU;AAChG,SAAO;AACT;AAGO,SAAS,cAAc,MAAsB;AAClD,SAAO,KAAK,UAAU,KAAK,EAAE,KAAK,EAAE,YAAY;AAClD;AAGO,SAAS,aAAa,KAA8B;AACzD,QAAM,SACJ,IAAI,OAAO,SAAS,OAChB,MAAM,IAAI,OAAO,OAAO,YAAY,CAAC,IAAI,IAAI,OAAO,UAAU,OAAO,KAAK,cAAc,IAAI,OAAO,KAAK,CAAC,KACzG,QAAQ,IAAI,OAAO,SAAS,IAAI,aAAa,EAAE,KAAK,GAAG,CAAC;AAC9D,SAAO,GAAG,IAAI,IAAI,IAAI,MAAM,IAAI,IAAI,MAAM,QAAQ,EAAE,IAAI,IAAI,WAAW,aAAa,EAAE;AACxF;AAGO,SAAS,mBAAmB,MAAsB;AACvD,MAAI,CAAC,wBAAwB,IAAI,EAAG,QAAO;AAC3C,SAAO,mBAAmB,IAAI,EAC3B;AAAA,IAAI,CAAC,UACJ,MAAM,SAAS,SACX,MAAM,QACN,MAAM,SAAS,cACb,MAAM,UAAU,MAChB,MAAM;AAAA,EACd,EACC,KAAK,EAAE;AACZ;AAEA,SAAS,YAAY,OAAgB,OAA+B,MAAyB;AAC3F,MAAI,OAAO,UAAU,UAAU;AAC7B,UAAM,KAAK;AACX;AAAA,EACF;AACA,MAAI,UAAU,QAAQ,OAAO,UAAU,SAAU;AACjD,MAAI,KAAK,IAAI,KAAK,EAAG;AACrB,OAAK,IAAI,KAAK;AACd,MAAI,MAAM,QAAQ,KAAK,GAAG;AACxB,eAAW,SAAS,MAAO,aAAY,OAAO,OAAO,IAAI;AACzD;AAAA,EACF;AACA,aAAW,SAAS,OAAO,OAAO,KAAgC;AAChE,gBAAY,OAAO,OAAO,IAAI;AAClC;AAGO,SAAS,sBAAsB,OAAmC;AACvE,QAAM,MAAyB,CAAC;AAChC,cAAY,OAAO,CAAC,SAAS,IAAI,KAAK,GAAG,qBAAqB,IAAI,CAAC,GAAG,oBAAI,IAAI,CAAC;AAC/E,SAAO;AACT;AAGO,SAAS,6BACd,OACsD;AACtD,QAAM,MAA4D,CAAC;AACnE,cAAY,OAAO,CAAC,SAAS,IAAI,KAAK,GAAG,4BAA4B,IAAI,CAAC,GAAG,oBAAI,IAAI,CAAC;AACtF,SAAO;AACT;AAQO,SAAS,sBAAyB,OAAU,SAA8C;AAC/F,QAAM,cAAc,CAAC,SAAyB;AAC5C,QAAI,CAAC,wBAAwB,IAAI,EAAG,QAAO;AAC3C,WAAO,mBAAmB,IAAI,EAC3B;AAAA,MAAI,CAAC,UACJ,MAAM,SAAS,SACX,MAAM,QACN,MAAM,SAAS,cACb,QAAQ,MAAM,SAAS,IACvB,MAAM;AAAA,IACd,EACC,KAAK,EAAE;AAAA,EACZ;AACA,QAAM,OAAO,CAAC,UAA4B;AACxC,QAAI,OAAO,UAAU,SAAU,QAAO,YAAY,KAAK;AACvD,QAAI,UAAU,QAAQ,OAAO,UAAU,SAAU,QAAO;AACxD,QAAI,MAAM,QAAQ,KAAK,EAAG,QAAO,MAAM,IAAI,IAAI;AAC/C,QAAI,iBAAiB,cAAc,iBAAiB,KAAM,QAAO;AACjE,UAAM,MAA+B,CAAC;AACtC,eAAW,CAAC,KAAK,KAAK,KAAK,OAAO,QAAQ,KAAgC,GAAG;AAC3E,UAAI,GAAG,IAAI,KAAK,KAAK;AAAA,IACvB;AACA,WAAO;AAAA,EACT;AACA,SAAO,KAAK,KAAK;AACnB;;;AChXO,IAAM,8BAA8B;AAKpC,IAAM,iCAAiC;AAGvC,IAAM,iCAAiC;AAGvC,IAAM,kCAAkC;AAyD/C,IAAM,wBAAwB;AAE9B,IAAM,oBAAoB;AAEnB,SAAS,0BAA0B,MAAsB;AAC9D,QAAM,OAAO,KAAK,QAAQ,sBAAsB,EAAE,EAAE,MAAM,GAAG,EAAE,KAAK;AACpE,SAAO,GAAG,qBAAqB,GAAG,IAAI;AACxC;AAGO,IAAM,kCAAkC;AAE/C,IAAM,iBAAiB;AACvB,IAAM,sBAAsB;AAC5B,IAAM,cAAc;AASb,SAAS,yBAAyB,OAI9B;AACT,MAAI,MAAM,MAAM;AAChB,MAAI,IAAI,WAAW,mBAAmB,GAAG;AACvC,UAAM,iBAAiB,IAAI,MAAM,oBAAoB,MAAM;AAAA,EAC7D;AACA,MAAI,IAAI,WAAW,cAAc,KAAK,CAAC,YAAY,KAAK,GAAG,EAAG,QAAO;AACrE,MAAI,MAAM,QAAQ;AAChB,QAAI;AACF,UAAI,WAAW;AACf,UAAI;AACF,mBAAW,qBAAqB,GAAG,EAAE;AAAA,MACvC,QAAQ;AACN,mBAAW;AAAA,MACb;AACA,YAAM,KAAK,sBAAsB;AAAA,QAC/B,QAAQ,MAAM;AAAA,QACd,GAAI,MAAM,YAAY,EAAE,OAAO,MAAM,UAAU,IAAI,CAAC;AAAA,QACpD,GAAI,WAAW,EAAE,UAAU,KAAK,IAAI,CAAC;AAAA,MACvC,CAAC;AACD,UAAI,CAAC,YAAY,KAAK,EAAE,EAAG,QAAO;AAAA,IACpC,QAAQ;AAAA,IAER;AAAA,EACF;AACA,SAAO;AACT;AAEO,SAAS,2BAA2B,OAAwB;AACjE,SAAO,MAAM,WAAW,cAAc;AACxC;AAMA,IAAM,kBAAkB;AAExB,SAAS,UAAU,OAAkC;AACnD,MAAI;AACF,WAAO,IAAI,YAAY,EAAE,OAAO,KAAK;AAAA,EACvC,QAAQ;AACN,WAAO;AAAA,EACT;AACF;AAEA,SAAS,OAAO,OAA2B;AACzC,MAAI,MAAM;AACV,WAAS,QAAQ,GAAG,QAAQ,MAAM,QAAQ,SAAS,GAAG;AACpD,UAAM,IAAI,MAAM,KAAK;AACrB,UAAM,IAAI,QAAQ,IAAI,MAAM,SAAS,MAAM,QAAQ,CAAC,IAAK;AACzD,UAAM,IAAI,QAAQ,IAAI,MAAM,SAAS,MAAM,QAAQ,CAAC,IAAK;AACzD,UAAM,SAAU,KAAK,KAAO,KAAK,IAAK;AACtC,WAAO,gBAAiB,UAAU,KAAM,EAAE;AAC1C,WAAO,gBAAiB,UAAU,KAAM,EAAE;AAC1C,WAAO,QAAQ,IAAI,MAAM,SAAS,gBAAiB,UAAU,IAAK,EAAE,IAAK;AACzE,WAAO,QAAQ,IAAI,MAAM,SAAS,gBAAgB,SAAS,EAAE,IAAK;AAAA,EACpE;AACA,SAAO;AACT;AAKA,SAAS,YAAY,OAAyB;AAC5C,QAAM,QAAQ,UAAU,KAAK;AAC7B,MAAI,UAAU,QAAQ,MAAM,WAAW,EAAG,QAAO,CAAC;AAClD,QAAM,QAAkB,CAAC;AACzB,QAAM,QAAQ,OAAO,KAAK;AAC1B,QAAM,KAAK,OAAO,MAAM,QAAQ,QAAQ,EAAE,CAAC;AAC3C,WAAS,SAAS,GAAG,SAAS,GAAG,UAAU,GAAG;AAC5C,UAAM,SAAS,IAAI,WAAW,SAAS,MAAM,MAAM;AACnD,WAAO,IAAI,OAAO,MAAM;AACxB,UAAM,UAAU,OAAO,MAAM;AAC7B,UAAM,QAAQ,KAAK,KAAM,SAAS,IAAK,CAAC;AACxC,UAAM,MAAM,KAAK,OAAQ,SAAS,MAAM,UAAU,IAAK,CAAC;AACxD,QAAI,MAAM,MAAO,OAAM,KAAK,QAAQ,MAAM,OAAO,GAAG,CAAC;AAAA,EACvD;AACA,QAAM,cAAwB,CAAC;AAC/B,aAAW,QAAQ,OAAO;AACxB,gBAAY,KAAK,MAAM,KAAK,WAAW,KAAK,GAAG,EAAE,WAAW,KAAK,GAAG,CAAC;AAAA,EACvE;AACA,SAAO;AACT;AAEA,IAAM,eAAe;AAOrB,IAAM,oBACJ;AAMK,SAAS,iBAAiB,OAAe,UAAkC,CAAC,GAAa;AAC9F,QAAM,WAAW,QAAQ,YAAY;AACrC,MAAI,OAAO,UAAU,YAAY,MAAM,SAAS,SAAU,QAAO,CAAC;AAClE,QAAM,QAAQ,oBAAI,IAAY;AAC9B,QAAM,MAAM,CAAC,SAAoC;AAC/C,QAAI,QAAQ,KAAK,UAAU,SAAU,OAAM,IAAI,IAAI;AAAA,EACrD;AACA,MAAI,KAAK;AAIT,MAAI,MAAM,KAAK,CAAC;AAIhB,QAAM,QAAQ,MAAM,MAAM,WAAW;AACrC,MAAI,MAAM,SAAS,GAAG;AACpB,eAAW,QAAQ,OAAO;AACxB,YAAM,UAAU,KAAK,KAAK;AAC1B,UAAI,aAAa,KAAK,OAAO,EAAG;AAChC,UAAI,QAAQ,UAAU,SAAU,QAAQ,UAAU,MAAM,kBAAkB,KAAK,OAAO,GAAI;AACxF,YAAI,OAAO;AAAA,MACb;AAAA,IACF;AAAA,EACF;AACA,QAAM,UAAU,KAAK,UAAU,KAAK,EAAE,MAAM,GAAG,EAAE;AACjD,MAAI,OAAO;AACX,MAAI,KAAK,UAAU,OAAO,EAAE,MAAM,GAAG,EAAE,CAAC;AACxC,MAAI;AACF,UAAM,MAAM,mBAAmB,KAAK;AACpC,QAAI,GAAG;AACP,QAAI,IAAI,WAAW,OAAO,GAAG,CAAC;AAC9B,QAAI,IAAI,QAAQ,kBAAkB,CAAC,UAAU,MAAM,YAAY,CAAC,CAAC;AAAA,EACnE,QAAQ;AAAA,EAER;AAGA,MAAI;AACF,QAAI,IAAI,gBAAgB,EAAE,GAAG,MAAM,CAAC,EAAE,SAAS,EAAE,MAAM,CAAC,CAAC;AAAA,EAC3D,QAAQ;AAAA,EAER;AACA,MAAI,QAAQ,WAAW,MAAO,YAAW,QAAQ,YAAY,KAAK,EAAG,KAAI,IAAI;AAC7E,SAAO,CAAC,GAAG,KAAK,EAAE,KAAK,CAAC,MAAM,UAAU,MAAM,SAAS,KAAK,MAAM;AACpE;AAYA,IAAM,qBAAqB;AAAA,EACzB;AAAA,EACA;AAAA,EACA;AACF;AAEA,SAAS,aAAa,MAAsB;AAC1C,SAAO,KAAK,QAAQ,wBAAwB,MAAM;AACpD;AAIA,IAAM,kBAAkB;AAiCxB,IAAM,+BAA+B;AAKrC,IAAM,4BAA4B;AAElC,IAAM,mBAAmB;AACzB,IAAM,yBAAyB;AAExB,IAAM,0CAA0C;AAGhD,SAAS,wBACd,SACA,UAAkC,CAAC,GACT;AAC1B,QAAM,WAAW,KAAK,IAAI,GAAG,QAAQ,YAAY,2BAA2B;AAC5E,QAAM,kBAAkB,KAAK;AAAA,IAC3B;AAAA,IACA,QAAQ,mBAAmB;AAAA,EAC7B;AACA,QAAM,kBAAkB,KAAK;AAAA,IAC3B;AAAA,IACA,KAAK,IAAI,GAAG,QAAQ,mBAAmB,8BAA8B;AAAA,EACvE;AACA,QAAM,SAAS,oBAAI,IAAoB;AACvC,QAAM,aAAa,oBAAI,IAAY;AAGnC,QAAM,YAAY,oBAAI,IAAY;AAClC,aAAW,SAAS,SAAS;AAC3B,QAAI,OAAO,OAAO,UAAU,YAAY,OAAO,MAAM,UAAU,SAAU;AACzE,UAAMA,SAAQ,iBAAiB,MAAM,OAAO,EAAE,GAAG,SAAS,SAAS,CAAC;AACpE,QAAIA,OAAM,WAAW,EAAG;AACxB,eAAW,IAAI,MAAM,KAAK;AAC1B,eAAW,QAAQA,OAAO,KAAI,CAAC,OAAO,IAAI,IAAI,EAAG,QAAO,IAAI,MAAM,MAAM,KAAK;AAC7E,cAAU,IAAI,MAAM,KAAK;AACzB,cAAU,IAAI,MAAM,MAAM,KAAK,CAAC;AAChC,cAAU,IAAI,KAAK,UAAU,MAAM,KAAK,EAAE,MAAM,GAAG,EAAE,CAAC;AAAA,EACxD;AACA,QAAM,QAAQ,CAAC,GAAG,OAAO,KAAK,CAAC,EAAE,KAAK,CAAC,MAAM,UAAU,MAAM,SAAS,KAAK,MAAM;AACjF,QAAM,WAAW,oBAAI,IAAsB;AAC3C,QAAM,eAAe,oBAAI,IAA4B;AACrD,QAAM,aAAa,oBAAI,IAAY;AACnC,aAAW,QAAQ,OAAO;AACxB,UAAM,SAAS,KAAK,MAAM,GAAG,QAAQ;AACrC,UAAM,SAAS,SAAS,IAAI,MAAM;AAClC,QAAI,OAAQ,QAAO,KAAK,IAAI;AAAA,QACvB,UAAS,IAAI,QAAQ,CAAC,IAAI,CAAC;AAChC,eAAW,IAAI,KAAK,WAAW,CAAC,IAAI,QAAS,KAAK,WAAW,CAAC,CAAC;AAAA,EACjE;AAEA,MAAI,UAAU;AACd,WAAS,QAAQ,MAAM,SAAS,GAAG,SAAS,GAAG,SAAS,GAAG;AACzD,UAAM,OAAO,MAAM,KAAK;AACxB,QAAI,QAAQ,iBAAiB,SAAS,CAAC,UAAU,IAAI,IAAI,EAAG;AAC5D,QAAI,KAAK,UAAU,mBAAmB,KAAK,SAAS,6BAA8B;AAClF,UAAM,WAAW,KAAK,IAAI,iBAAiB,KAAK,KAAK,KAAK,SAAS,eAAe,CAAC;AACnF,QAAI,WAAW,KAAK,SAAS,YAAY,0BAA2B;AACpE,aAAS,SAAS,UAAU,SAAS,KAAK,QAAQ,UAAU,GAAG;AAC7D,YAAM,MAAM,KAAK,MAAM,SAAS,iBAAiB,MAAM;AACvD,YAAM,SAAS,aAAa,IAAI,GAAG;AACnC,UAAI,OAAQ,QAAO,KAAK,EAAE,MAAM,OAAO,CAAC;AAAA,UACnC,cAAa,IAAI,KAAK,CAAC,EAAE,MAAM,OAAO,CAAC,CAAC;AAAA,IAC/C;AACA,eAAW,KAAK,SAAS;AAAA,EAC3B;AACA,aAAW,UAAU,aAAa,OAAO,GAAG;AAC1C,WAAO,KAAK,CAAC,MAAM,UAAU,MAAM,SAAS,KAAK,MAAM;AAAA,EACzD;AACA,QAAM,UACJ,MAAM,WAAW,IACb,OACA,IAAI;AAAA,IACF;AAAA,MACE,GAAG,CAAC,GAAG,UAAU,EAAE,KAAK,CAAC,MAAM,UAAU,MAAM,SAAS,KAAK,MAAM,EAAE,IAAI,YAAY;AAAA,MACrF,GAAG;AAAA,IACL,EACG,IAAI,CAAC,WAAW,MAAM,MAAM,GAAG,EAC/B,KAAK,GAAG;AAAA,IACX;AAAA,EACF;AACN,SAAO;AAAA,IACL,OAAO,MAAM,WAAW;AAAA,IACxB;AAAA,IACA,SAAS,QAAQ;AAAA,IACjB;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA,wBAAwB,KAAK;AAAA,MAC3B;AAAA,MACA,QAAQ,0BAA0B;AAAA,IACpC;AAAA,IACA;AAAA,IACA,aAAa,MAAM,CAAC,GAAG,UAAU;AAAA,EACnC;AACF;AASA,SAAS,kBACP,MACA,KACA,OAC0C;AAC1C,QAAM,QAAQ,MAAM;AACpB,MAAI,MAAM,SAAS,MAAM,aAAa,SAAS,EAAG,QAAO;AACzD,QAAM,aAAa,MAAM,aAAa,IAAI,KAAK,MAAM,MAAM,OAAO,GAAG,CAAC;AACtE,MAAI,CAAC,WAAY,QAAO;AAExB,MAAI,UAAU;AACd,aAAW,EAAE,MAAM,OAAO,KAAK,YAAY;AACzC,QAAI,SAAS,IAAK;AAClB,QAAI,aAAa,uBAAwB;AACzC,QAAI,CAAC,KAAK,WAAW,KAAK,MAAM,GAAG,MAAM,GAAG,MAAM,MAAM,EAAG;AAC3D,UAAM,QAAQ,MAAM,OAAO,IAAI,IAAI;AACnC,QAAI,UAAU,OAAW,QAAO,EAAE,QAAQ,MAAM;AAAA,EAClD;AACA,SAAO;AACT;AAEA,SAAS,aAAa,OAAe,KAAa,MAAgD;AAChG,aAAW,CAAC,MAAM,EAAE,KAAK,KAAM,KAAI,QAAQ,MAAM,OAAO,IAAK,QAAO;AACpE,SAAO;AACT;AAEA,SAAS,WAAW,MAAc,SAA0C;AAC1E,QAAM,OAAgC,CAAC;AACvC,UAAQ,YAAY;AACpB,aAAW,SAAS,KAAK,SAAS,OAAO,GAAG;AAC1C,QAAI,MAAM,CAAC,EAAE,SAAS,EAAG,MAAK,KAAK,CAAC,MAAM,OAAO,MAAM,QAAQ,MAAM,CAAC,EAAE,MAAM,CAAC;AAAA,EACjF;AACA,SAAO;AACT;AAGO,SAAS,uBAAuB,MAAc,OAAyC;AAC5F,MAAI,MAAM,SAAS,MAAM,YAAY,QAAQ,KAAK,SAAS,MAAM,SAAU,QAAO;AAClF,QAAM,OAAO,MAAM;AAGnB,QAAM,OAAO,WAAW,MAAM,MAAM,OAAO;AAC3C,MAAI,MAAM;AACV,MAAI,SAAS;AACb,MAAI,OAAO;AACX,WAAS,KAAK,GAAG,MAAM,KAAK,SAAS,QAAO;AAC1C,WAAO,OAAO,KAAK,UAAU,KAAK,IAAI,EAAG,CAAC,KAAK,GAAI,SAAQ;AAC3D,QAAI,OAAO,KAAK,UAAU,KAAK,IAAI,EAAG,CAAC,KAAK,IAAI;AAC9C,WAAK,KAAK,IAAI,EAAG,CAAC;AAClB,cAAQ;AACR;AAAA,IACF;AACA,QAAI,CAAC,MAAM,WAAW,IAAI,KAAK,WAAW,EAAE,IAAI,QAAS,KAAK,WAAW,KAAK,CAAC,CAAC,GAAG;AACjF,YAAM;AACN;AAAA,IACF;AACA,UAAM,aAAa,MAAM,SAAS,IAAI,KAAK,MAAM,IAAI,KAAK,IAAI,CAAC;AAC/D,UAAM,QAAQ,OAAO,KAAK,SAAS,KAAK,IAAI,EAAG,CAAC,IAAI,KAAK;AACzD,UAAM,OAAO,YAAY;AAAA,MACvB,CAAC,cAAc,KAAK,UAAU,UAAU,SAAS,KAAK,WAAW,WAAW,EAAE;AAAA,IAChF;AACA,QAAI,SAAS,QAAW;AACtB,YAAM;AACN;AAAA,IACF;AACA,WAAO,KAAK,MAAM,QAAQ,EAAE,IAAI,MAAM,OAAO,IAAI,IAAI;AACrD,UAAM,KAAK;AACX,aAAS;AAAA,EACX;AACA,SAAO,KAAK,MAAM,MAAM;AACxB,MAAI,MAAM,aAAa,SAAS,EAAG,QAAO;AAG1C,QAAM,OAAiB,IAAI,UAAU,MAAM,yBAAyB,CAAC,IAAI,MAAM,IAAI,CAAC;AACpF,QAAM,QAAQ,CAAC,GAAG,IAAI,SAAS,eAAe,CAAC;AAC/C,WAAS,QAAQ,MAAM,SAAS,GAAG,SAAS,GAAG,SAAS,GAAG;AACzD,QAAI,KAAK,UAAU,iBAAkB;AACrC,UAAM,OAAO,MAAM,KAAK;AACxB,UAAM,WAAW,MAAM,QAAQ,CAAC;AAChC,QAAI,YAAY,SAAS,QAAQ,SAAS,CAAC,EAAE,WAAW,KAAK,MAAO;AACpE,SAAK,KAAK,KAAK,KAAK;AAAA,EACtB;AACA,MAAI,KAAK,WAAW,EAAG,QAAO;AAC9B,QAAM,aAAa,WAAW,KAAK,MAAM,OAAO;AAChD,MAAI,cAAc,IAAI,SAAS;AAC/B,aAAW,OAAO,MAAM;AAEtB,QAAI,MAAM,YAAa;AACvB,UAAM,OAAO,kBAAkB,KAAK,KAAK,KAAK;AAC9C,QAAI,CAAC,KAAM;AACX,UAAM,QAAQ,MAAM,KAAK;AACzB,QAAI,aAAa,OAAO,KAAK,UAAU,EAAG;AAC1C,UAAM,IAAI,MAAM,GAAG,KAAK,IAAI,KAAK,QAAQ,IAAI,MAAM,GAAG;AACtD,kBAAc;AAAA,EAChB;AACA,SAAO;AACT;AAMO,SAAS,iBACd,OACA,SACA,UAAkC,CAAC,GAChC;AACH,QAAM,QAAQ,MAAM,QAAQ,OAAO,IAC/B,wBAAwB,SAA4C,OAAO,IAC1E;AACL,MAAI,MAAM,MAAO,QAAO;AACxB,SAAO;AAAA,IACL;AAAA,IACA,CAAC,SAAS,uBAAuB,MAAM,KAAK;AAAA,IAC5C,MAAM;AAAA,EACR;AACF;AAWO,IAAM,qCAAqC;AAG3C,SAAS,+BAA+B,MAAuC;AACpF,MAAI,SAAS,QAAQ,OAAO,SAAS,SAAU,QAAO,CAAC;AACvD,QAAM,UAAW,KAAiC,kCAAkC;AACpF,MAAI,CAAC,MAAM,QAAQ,OAAO,EAAG,QAAO,CAAC;AACrC,SAAO,QAAQ;AAAA,IACb,CAAC,UACC,UAAU,QACV,OAAO,UAAU,YACjB,OAAQ,MAA+B,UAAU,YACjD,OAAQ,MAA+B,UAAU;AAAA,EACrD;AACF;AAOA,SAAS,oBAAoB,OAAe,UAA4B;AACtE,MAAI,aAAa,UAAa,UAAU,SAAU,QAAO;AACzD,QAAM,QACJ,OAAO,QAAQ,KAAK,KAAK,CAAC,IAC1B,OAAO,QAAQ,KAAK,KAAK,CAAC,IAC1B,OAAO,QAAQ,KAAK,KAAK,CAAC,IAC1B,OAAO,eAAe,KAAK,KAAK,CAAC;AACnC,SAAQ,MAAM,UAAU,MAAM,SAAS,KAAO,MAAM,UAAU,MAAM,SAAS;AAC/E;AAGA,SAAS,cAAc,OAAyB;AAC9C,MAAI,MAAM,WAAW,EAAG,QAAO,CAAC;AAChC,QAAM,UAAU,KAAK,UAAU,KAAK,EAAE,MAAM,GAAG,EAAE;AACjD,SAAO,YAAY,QAAQ,CAAC,KAAK,IAAI,CAAC,OAAO,OAAO;AACtD;AAgBO,IAAM,mCAAmC;AAQzC,IAAM,oBAAN,MAAwB;AAAA,EACZ,SAAS,oBAAI,IAAoB;AAAA,EACjC,aAAa,oBAAI,IAAoC;AAAA,EAC9D,WAA4C;AAAA;AAAA,EAE5C,qBAAkF;AAAA,EAClF,UAAU;AAAA,EACD;AAAA,EACA;AAAA,EACT;AAAA,EACA;AAAA;AAAA,EAES,WAAW,oBAAI,IAAY;AAAA,EACpC,WAAW;AAAA;AAAA,EAEF,SAAS,oBAAI,IAAoB;AAAA,EAC1C;AAAA,EAER,YACE,UAGI,CAAC,GACL;AACA,UAAM,EAAE,YAAY,cAAc,GAAG,YAAY,IAAI;AACrD,SAAK,UAAU;AACf,SAAK,aAAa,cAAc;AAChC,SAAK,eAAe;AAAA,EACtB;AAAA;AAAA,EAGA,kBAAkB,MAA2E;AAC3F,SAAK,eAAe;AAAA,EACtB;AAAA;AAAA;AAAA;AAAA;AAAA,EAMA,aAAa,WAAoD;AAC/D,SAAK,YAAY;AAAA,EACnB;AAAA;AAAA,EAGA,MAAM,QAAQ,YAAY,KAAsB;AAC9C,UAAM,YAAY,KAAK;AACvB,QAAI,CAAC,UAAW;AAChB,QAAI;AACJ,QAAI;AACF,YAAM,QAAQ,KAAK;AAAA,QACjB,UAAU;AAAA,QACV,IAAI,QAAc,CAAC,YAAY;AAC7B,kBAAQ,WAAW,SAAS,SAAS;AAAA,QACvC,CAAC;AAAA,MACH,CAAC;AAAA,IACH,SAAS,OAAO;AACd,WAAK,OAAO,WAAW,KAAK;AAAA,IAC9B,UAAE;AACA,UAAI,UAAU,OAAW,cAAa,KAAK;AAAA,IAC7C;AAAA,EACF;AAAA,EAEA,IAAI,WAAmB;AACrB,WAAO,KAAK,QAAQ,YAAY;AAAA,EAClC;AAAA,EAEA,IAAI,OAAe;AACjB,WAAO,KAAK,OAAO;AAAA,EACrB;AAAA;AAAA,EAGA,IAAI,UAAkB;AACpB,WAAO,KAAK;AAAA,EACd;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAOA,SAAS,OAAe,OAAwB;AAC9C,QAAI;AACF,UAAI,OAAO,UAAU,YAAY,OAAO,UAAU,SAAU,QAAO;AACnE,UAAI,KAAK,YAAY,MAAM,SAAS,KAAK,YAAY,KAAK,WAAW,KAAK,EAAG,QAAO;AACpF,YAAM,WAAW,KAAK,OAAO,IAAI,KAAK;AACtC,YAAM,OACJ,aAAa,WACZ,aAAa,SACZ,2BAA2B,QAAQ,KACnC,CAAC,2BAA2B,KAAK;AACrC,WAAK,OAAO,OAAO,KAAK;AACxB,WAAK,OAAO,IAAI,OAAO,OAAO,WAAY,KAAK;AAC/C,WAAK,MAAM;AACX,UAAI,CAAC,MAAM;AACT,aAAK,WAAW;AAChB,aAAK,WAAW;AAAA,MAClB;AACA,aAAO;AAAA,IACT,SAAS,OAAO;AACd,WAAK,OAAO,YAAY,KAAK;AAC7B,aAAO;AAAA,IACT;AAAA,EACF;AAAA;AAAA;AAAA;AAAA;AAAA,EAMQ,QAAc;AACpB,QAAI,KAAK,OAAO,QAAQ,KAAK,WAAY;AACzC,eAAW,CAAC,OAAO,KAAK,KAAK,KAAK,QAAQ;AACxC,UAAI,KAAK,OAAO,QAAQ,KAAK,WAAY;AACzC,UAAI,MAAM,WAAW,qBAAqB,EAAG;AAC7C,WAAK,OAAO,OAAO,KAAK;AAAA,IAC1B;AACA,WAAO,KAAK,OAAO,OAAO,KAAK,YAAY;AACzC,YAAM,SAAS,KAAK,OAAO,KAAK,EAAE,KAAK,EAAE;AACzC,UAAI,WAAW,OAAW;AAC1B,WAAK,OAAO,OAAO,MAAM;AAAA,IAC3B;AACA,SAAK,WAAW;AAChB,SAAK,WAAW;AAAA,EAClB;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAOA,OAAO,OAAqB;AAC1B,QAAI;AACF,UAAI,OAAO,UAAU,YAAY,MAAM,WAAW,EAAG;AACrD,WAAK,SAAS,IAAI,KAAK;AAIvB,UAAI,UAAU;AACd,iBAAW,CAAC,OAAO,KAAK,KAAK,KAAK,QAAQ;AACxC,YAAI,MAAM,WAAW,qBAAqB,KAAK,CAAC,MAAM,SAAS,KAAK,EAAG;AACvE,aAAK,OAAO,OAAO,KAAK;AACxB,kBAAU;AAAA,MACZ;AACA,iBAAW,SAAS,KAAK,OAAO,KAAK,GAAG;AACtC,YAAI,MAAM,SAAS,KAAK,EAAG,MAAK,OAAO,OAAO,KAAK;AAAA,MACrD;AACA,UAAI,SAAS;AACX,aAAK,WAAW;AAChB,aAAK,WAAW;AAAA,MAClB;AAAA,IACF,SAAS,OAAO;AACd,WAAK,OAAO,UAAU,KAAK;AAAA,IAC7B;AAAA,EACF;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAOQ,WAAW,OAAwB;AACzC,QAAI,KAAK,SAAS,SAAS,EAAG,QAAO;AACrC,QAAI,KAAK,SAAS,IAAI,KAAK,EAAG,QAAO;AACrC,QAAI,MAAM,SAAS,KAAK,SAAU,QAAO;AACzC,eAAW,YAAY,KAAK,SAAU,KAAI,SAAS,SAAS,KAAK,EAAG,QAAO;AAC3E,WAAO;AAAA,EACT;AAAA;AAAA;AAAA;AAAA;AAAA,EAMA,UAAgB;AACd,SAAK,WAAW;AAChB,SAAK,OAAO,MAAM;AAClB,SAAK,WAAW,MAAM;AACtB,SAAK,SAAS,MAAM;AACpB,SAAK,OAAO,MAAM;AAClB,SAAK,gBAAgB;AACrB,SAAK,YAAY;AACjB,SAAK,WAAW;AAChB,SAAK,qBAAqB;AAC1B,SAAK,WAAW;AAAA,EAClB;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAOA,qBAAqB,aAAqB,OAAe,OAAwB;AAC/E,UAAM,WAAW,KAAK,SAAS,OAAO,KAAK;AAC3C,QAAI,CAAC,YAAY,CAAC,YAAa,QAAO;AACtC,QAAI;AACF,YAAM,UAAU,KAAK,WAAW,IAAI,WAAW,KAAK,CAAC;AACrD,UAAI,CAAC,QAAQ,KAAK,CAAC,UAAU,MAAM,UAAU,KAAK,EAAG,SAAQ,KAAK,EAAE,OAAO,MAAM,CAAC;AAClF,WAAK,WAAW,OAAO,WAAW;AAClC,WAAK,WAAW,IAAI,aAAa,OAAO;AACxC,aAAO,KAAK,WAAW,OAAO,KAAK;AACjC,cAAM,SAAS,KAAK,WAAW,KAAK,EAAE,KAAK,EAAE;AAC7C,YAAI,WAAW,OAAW;AAC1B,aAAK,WAAW,OAAO,MAAM;AAAA,MAC/B;AAAA,IACF,SAAS,OAAO;AACd,WAAK,OAAO,YAAY,KAAK;AAAA,IAC/B;AACA,WAAO;AAAA,EACT;AAAA;AAAA,EAGA,iBAAiB,aAA6C;AAC5D,WAAO,CAAC,GAAI,KAAK,WAAW,IAAI,WAAW,KAAK,CAAC,CAAE;AAAA,EACrD;AAAA;AAAA,EAGA,IAAI,OAAwB;AAC1B,WAAO,KAAK,OAAO,IAAI,KAAK;AAAA,EAC9B;AAAA,EAEA,UAAkC;AAChC,WAAO,CAAC,GAAG,KAAK,MAAM,EAAE,IAAI,CAAC,CAAC,OAAO,KAAK,OAAO,EAAE,OAAO,MAAM,EAAE;AAAA,EACpE;AAAA,EAEQ,QAAkC;AACxC,SAAK,aAAa,wBAAwB,KAAK,QAAQ,GAAG,KAAK,OAAO;AACtE,WAAO,KAAK;AAAA,EACd;AAAA;AAAA,EAGA,KAAQ,OAAU,QAAQ,QAAW;AACnC,QAAI,KAAK,OAAO,SAAS,EAAG,QAAO;AACnC,QAAI;AACF,aAAO,iBAAiB,OAAO,KAAK,MAAM,CAAC;AAAA,IAC7C,SAAS,OAAO;AACd,WAAK,OAAO,OAAO,KAAK;AACxB,aAAO;AAAA,IACT;AAAA,EACF;AAAA;AAAA,EAGQ,eAAkB,OAAU,OAAkB;AACpD,QAAI,KAAK,OAAO,SAAS,EAAG,QAAO;AACnC,QAAI,UAAU;AACd,eAAW,SAAS,KAAK,OAAO,OAAO,GAAG;AACxC,UAAI,MAAM,WAAW,iBAAiB,GAAG;AACvC,kBAAU;AACV;AAAA,MACF;AAAA,IACF;AACA,QAAI,CAAC,QAAS,QAAO,KAAK,KAAK,OAAO,KAAK;AAC3C,QAAI;AACF,UAAI,KAAK,oBAAoB,YAAY,KAAK,SAAS;AACrD,aAAK,qBAAqB;AAAA,UACxB,SAAS,KAAK;AAAA,UACd,OAAO;AAAA,YACL,KAAK,QAAQ,EAAE,OAAO,CAAC,UAAU,CAAC,MAAM,MAAM,WAAW,iBAAiB,CAAC;AAAA,YAC3E,KAAK;AAAA,UACP;AAAA,QACF;AAAA,MACF;AACA,aAAO,iBAAiB,OAAO,KAAK,mBAAmB,KAAK;AAAA,IAC9D,SAAS,OAAO;AACd,WAAK,OAAO,OAAO,KAAK;AACxB,aAAO;AAAA,IACT;AAAA,EACF;AAAA;AAAA,EAGA,SAAS,MAAc,QAAQ,QAAgB;AAC7C,QAAI,KAAK,OAAO,SAAS,KAAK,OAAO,SAAS,SAAU,QAAO;AAC/D,QAAI;AACF,aAAO,uBAAuB,MAAM,KAAK,MAAM,CAAC;AAAA,IAClD,SAAS,OAAO;AACd,WAAK,OAAO,OAAO,KAAK;AACxB,aAAO;AAAA,IACT;AAAA,EACF;AAAA;AAAA,EAGA,SAAY,OAAU,OAAwC,QAAQ,QAAW;AAC/E,QAAI,MAAM,WAAW,EAAG,QAAO,KAAK,KAAK,OAAO,KAAK;AACrD,QAAI;AACF,aAAO,iBAAiB,OAAO,CAAC,GAAG,KAAK,QAAQ,GAAG,GAAG,KAAK,GAAG,KAAK,OAAO;AAAA,IAC5E,SAAS,OAAO;AACd,WAAK,OAAO,OAAO,KAAK;AACxB,aAAO;AAAA,IACT;AAAA,EACF;AAAA;AAAA;AAAA;AAAA;AAAA,EAMA,iBAAiB,UAAiD;AAChE,SAAK,gBAAgB;AAAA,EACvB;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAOA,cAAc,OAAe,OAAe,UAAyB;AACnE,QAAI;AACF,UAAI,OAAO,UAAU,YAAY,OAAO,UAAU,YAAY,MAAM,WAAW,EAAG;AAElF,UAAI,KAAK,YAAY,KAAK,WAAW,KAAK,EAAG;AAC7C,YAAM,WAAW,KAAK,OAAO,IAAI,KAAK;AACtC,UACE,aAAa,UACZ,CAAC,2BAA2B,QAAQ,KAAK,2BAA2B,KAAK,GAC1E;AACA,aAAK,OAAO,IAAI,OAAO,KAAK;AAC5B,eAAO,KAAK,OAAO,OAAO,KAAK,YAAY;AACzC,gBAAM,SAAS,KAAK,OAAO,KAAK,EAAE,KAAK,EAAE;AACzC,cAAI,WAAW,OAAW;AAC1B,eAAK,OAAO,OAAO,MAAM;AAAA,QAC3B;AAAA,MACF;AAIA,UAAI,oBAAoB,OAAO,QAAQ,GAAG;AACxC,aAAK,SAAS,OAAO,KAAK,OAAO,IAAI,KAAK,KAAK,KAAK;AAAA,MACtD;AAAA,IACF,SAAS,OAAO;AACd,WAAK,OAAO,kBAAkB,KAAK;AAAA,IACrC;AAAA,EACF;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAQA,MAAM,cAAc,OAAgB,QAAQ,eAAe,YAAY,KAAsB;AAC3F,QAAI;AACJ,QAAI;AAIF,YAAM,QAAQ,KAAK,eAAe,OAAO,KAAK;AAE9C,gBAAU,oBAAoB,OAAO,KAAK;AAAA,QACxC,GAAI,KAAK,QAAQ,UAAU,EAAE,SAAS,KAAK,QAAQ,QAAQ,IAAI,CAAC;AAAA,QAChE,MAAM,CAAC,OAAO,SAAS,CAAC,KAAK,eAAe,OAAO,IAAI,KAAK,CAAC,KAAK,WAAW,MAAM,KAAK;AAAA,MAC1F,CAAC,EAAE,OAAO,CAAC,UAAU,CAAC,2BAA2B,KAAK,OAAO,IAAI,MAAM,KAAK,KAAK,EAAE,CAAC;AAAA,IACtF,SAAS,OAAO;AACd,WAAK,OAAO,OAAO,KAAK;AACxB;AAAA,IACF;AACA,QAAI,QAAQ,WAAW,EAAG;AAC1B,UAAM,aAAa,QAAQ,MAAM,GAAG,gCAAgC;AACpE,UAAM,YAAY,IAAI,IAAI,QAAQ,IAAI,CAAC,UAAU,CAAC,MAAM,OAAO,MAAM,QAAQ,CAAC,CAAC;AAC/E,QAAI,WAAwC,oBAAI,IAAI;AACpD,UAAM,WAAW,KAAK;AACtB,QAAI,UAAU;AACZ,UAAI;AACJ,UAAI;AACF,cAAM,OAAO,SAAS,UAAU;AAEhC,aAAK;AAAA,UACH,CAAC,eAAe;AACd,uBAAW,CAAC,QAAQ,SAAS,KAAK,YAAY;AAC5C,kBAAI,CAAC,2BAA2B,SAAS,EAAG;AAC5C,mBAAK,cAAc,QAAQ,WAAW,UAAU,IAAI,MAAM,CAAC;AAAA,YAC7D;AAAA,UACF;AAAA,UACA,MAAM;AAAA,UAAC;AAAA,QACT;AACA,mBACG,MAAM,QAAQ,KAAK;AAAA,UAClB;AAAA,UACA,IAAI,QAAc,CAAC,YAAY;AAC7B,oBAAQ,WAAW,MAAM,QAAQ,IAAI,GAAG,SAAS;AAAA,UACnD,CAAC;AAAA,QACH,CAAC,KAAM,oBAAI,IAAI;AAAA,MACnB,SAAS,OAAO;AACd,aAAK,OAAO,iBAAiB,KAAK;AAAA,MACpC,UAAE;AACA,YAAI,UAAU,OAAW,cAAa,KAAK;AAAA,MAC7C;AAAA,IACF;AACA,eAAW,SAAS,SAAS;AAC3B,YAAM,YAAY,SAAS,IAAI,MAAM,KAAK;AAC1C,WAAK;AAAA,QACH,MAAM;AAAA,QACN,aAAa,2BAA2B,SAAS,IAC7C,YACA,qBAAqB,MAAM,IAAI;AAAA,QACnC,MAAM;AAAA,MACR;AAAA,IACF;AAAA,EACF;AAAA;AAAA;AAAA;AAAA;AAAA,EAMQ,eAAe,OAAyB,MAAuB;AACrE,QAAI,KAAK,SAAS,SAAS,EAAG,QAAO;AACrC,eAAW,SAAS,KAAK,UAAU;AACjC,iBAAW,QAAQ,cAAc,KAAK,GAAG;AACvC,cAAM,KAAK,KAAK,QAAQ,MAAM,KAAK,IAAI,GAAG,MAAM,QAAQ,KAAK,SAAS,CAAC,CAAC;AACxE,YAAI,MAAM,KAAK,KAAK,MAAM,IAAK,QAAO;AAAA,MACxC;AAAA,IACF;AACA,WAAO;AAAA,EACT;AAAA;AAAA,EAGQ,aAAa,CAAC,OAAyB,SAC7C,KAAK,eAAe,OAAO,IAAI,KAAK,KAAK,WAAW,MAAM,KAAK,IAC3D,OACC,KAAK,OAAO,IAAI,MAAM,KAAK,KAC5B,KAAK,OAAO,IAAI,MAAM,KAAK,KAC3B,qBAAqB,MAAM,IAAI;AAAA;AAAA;AAAA;AAAA;AAAA,EAMrC,eAAkB,OAAU,QAAQ,eAAkB;AACpD,UAAM,QAAQ,KAAK,KAAK,OAAO,KAAK;AACpC,QAAI;AACF,aAAO,iBAAiB,OAAO,KAAK,YAAY,KAAK,QAAQ,OAAO;AAAA,IACtE,SAAS,OAAO;AACd,WAAK,OAAO,OAAO,KAAK;AACxB,aAAO;AAAA,IACT;AAAA,EACF;AAAA;AAAA,EAGA,mBAAmB,MAAc,QAAQ,eAAuB;AAC9D,UAAM,QAAQ,KAAK,SAAS,MAAM,KAAK;AACvC,QAAI,OAAO,UAAU,SAAU,QAAO;AACtC,QAAI;AACF,aAAO,uBAAuB,OAAO,KAAK,UAAU;AAAA,IACtD,SAAS,OAAO;AACd,WAAK,OAAO,OAAO,KAAK;AACxB,aAAO;AAAA,IACT;AAAA,EACF;AAAA,EAEQ,OAAO,OAAe,OAAsB;AAClD,QAAI;AACF,WAAK,eAAe,EAAE,OAAO,OAAO,iBAAiB,QAAQ,MAAM,OAAO,OAAO,MAAM,CAAC;AAAA,IAC1F,QAAQ;AAAA,IAER;AAAA,EACF;AACF;AASO,SAAS,wBACd,OACA,QACA,OAAgC,SAChC,QAAQ,GACL;AAEH,MAAI,CAAC,UAAU,EAAE,iBAAiB,UAAU,QAAQ,EAAG,QAAO;AAC9D,MAAI,SAAS,WAAW,OAAO,SAAS,EAAG,QAAO;AAElD,QAAM,QAAQ,CAAC,SAA8B;AAC3C,QAAI;AACF,YAAM,OAAO,MAAM,IAAI;AACvB,UAAI,OAAO,SAAS,SAAU;AAC9B,YAAM,SACJ,SAAS,gBACL,OAAO,mBAAmB,MAAM,YAAY,IAC5C,OAAO,SAAS,MAAM,YAAY;AACxC,UAAI,WAAW,KAAM,OAAM,IAAI,IAAI;AAAA,IACrC,QAAQ;AAAA,IAER;AAAA,EACF;AACA,QAAM,SAAS;AACf,QAAM,OAAO;AACb,MAAI;AACF,QAAI,MAAM,UAAU,OAAW,yBAAwB,MAAM,OAAO,QAAQ,MAAM,QAAQ,CAAC;AAAA,EAC7F,QAAQ;AAAA,EAER;AACA,MAAI;AACF,UAAM,QAAS,MAA+B;AAC9C,QAAI,MAAM,QAAQ,KAAK,GAAG;AACxB,iBAAW,QAAQ,MAAM,MAAM,GAAG,EAAE,GAAG;AACrC,gCAAwB,MAAM,QAAQ,MAAM,QAAQ,CAAC;AAAA,MACvD;AAAA,IACF;AAAA,EACF,QAAQ;AAAA,EAER;AACA,SAAO;AACT;AAWO,SAAS,uBAAuB,MAAuB;AAC5D,SAAO,SAAS,gBAAgB,SAAS;AAC3C;AAEA,SAAS,kBAAkB,OAA8B;AACvD,MAAI;AACF,UAAM,SAAS,KAAK,MAAM,QAAQ,SAAS,EAAE,CAAC;AAC9C,UAAM,QAAQ,IAAI,WAAW,OAAO,MAAM;AAC1C,aAAS,QAAQ,GAAG,QAAQ,OAAO,QAAQ,SAAS,EAAG,OAAM,KAAK,IAAI,OAAO,WAAW,KAAK;AAC7F,WAAO,IAAI,YAAY,SAAS,EAAE,OAAO,KAAK,CAAC,EAAE,OAAO,KAAK;AAAA,EAC/D,QAAQ;AACN,WAAO;AAAA,EACT;AACF;AAOO,SAAS,wBAAwB,QAAiB,QAAQ,GAAa;AAC5E,MAAI,QAAQ,EAAG,QAAO,CAAC;AACvB,MAAI,OAAO,WAAW,UAAU;AAC9B,UAAM,UAAU,OAAO,KAAK;AAC5B,QAAI,CAAC,QAAQ,WAAW,GAAG,KAAK,CAAC,QAAQ,WAAW,GAAG,EAAG,QAAO,CAAC;AAClE,QAAI;AACF,aAAO,wBAAwB,KAAK,MAAM,OAAO,GAAG,QAAQ,CAAC;AAAA,IAC/D,QAAQ;AACN,aAAO,CAAC;AAAA,IACV;AAAA,EACF;AACA,MAAI,WAAW,QAAQ,OAAO,WAAW,SAAU,QAAO,CAAC;AAC3D,MAAI,MAAM,QAAQ,MAAM,GAAG;AACzB,WAAO,OAAO,QAAQ,CAAC,SAAS,wBAAwB,MAAM,QAAQ,CAAC,CAAC;AAAA,EAC1E;AACA,QAAM,SAAS;AACf,MAAI,OAAO,OAAO,UAAU,YAAY,OAAO,aAAa,OAAQ,QAAO,CAAC,OAAO,KAAK;AACxF,MAAI,OAAO,OAAO,UAAU,YAAY,OAAO,aAAa,UAAU;AACpE,UAAM,UAAU,kBAAkB,OAAO,KAAK;AAC9C,WAAO,YAAY,OAAO,CAAC,OAAO,KAAK,IAAI,CAAC,OAAO,OAAO,OAAO;AAAA,EACnE;AACA,SAAO,OAAO,OAAO,MAAM,EAAE,QAAQ,CAAC,UAAU,wBAAwB,OAAO,QAAQ,CAAC,CAAC;AAC3F;AAOO,SAAS,sBACd,QACA,UACA,QACM;AACN,MAAI,CAAC,OAAQ;AACb,MAAI;AACF,QAAI,CAAC,uBAAuB,QAAQ,EAAG;AACvC,eAAW,SAAS,wBAAwB,MAAM,EAAG,QAAO,OAAO,KAAK;AAAA,EAC1E,QAAQ;AAAA,EAER;AACF;AAMA,SAAS,aAAa,OAA2C;AAC/D,QAAM,WAAW,MAAM;AACvB,MAAI,SAAS,SAAS,OAAQ,QAAO,SAAS;AAC9C,MAAI,SAAS,SAAS,SAAS;AAC7B,QAAI;AACF,aAAO,IAAI,YAAY,SAAS,EAAE,OAAO,KAAK,CAAC,EAAE,OAAO,SAAS,KAAK;AAAA,IACxE,QAAQ;AACN,aAAO;AAAA,IACT;AAAA,EACF;AAGA,SAAO;AACT;AAGO,SAAS,6BACd,QACA,UACA,aACM;AACN,MAAI,CAAC,OAAQ;AACb,aAAW,SAAS,SAAS,OAAO,GAAG;AACrC,QAAI;AAGF,UAAI,MAAM,cAAc,OAAQ;AAChC,YAAM,OAAO,aAAa,KAAK;AAC/B,UAAI,SAAS,KAAM;AACnB,YAAM,QAAQ,yBAAyB;AAAA,QACrC,KAAK,MAAM,UAAU;AAAA,QACrB,QAAQ,MAAM;AAAA,QACd,WAAW,MAAM;AAAA,MACnB,CAAC;AACD,UAAI,YAAa,QAAO,qBAAqB,aAAa,MAAM,KAAK;AAAA,UAChE,QAAO,SAAS,MAAM,KAAK;AAAA,IAClC,QAAQ;AAAA,IAER;AAAA,EACF;AACF;AAGO,SAAS,0BACd,UACA,QACgB;AAChB,SAAO;AAAA,IACL,IAAI,YAAY;AACd,aAAO,SAAS;AAAA,IAClB;AAAA,IACA,IAAI,UAAU;AACZ,aAAO,SAAS;AAAA,IAClB;AAAA,IACA,MAAM,QAAQ,MAAM,KAAK;AACvB,YAAM,WAAW,MAAM,SAAS,QAAQ,MAAM,GAAG;AACjD,UAAI;AACJ,UAAI;AACF,iBAAS,OAAO,WAAW,aAAa,OAAO,IAAI;AAAA,MACrD,QAAQ;AACN,iBAAS;AAAA,MACX;AACA,mCAA6B,QAAQ,UAAU,IAAI,WAAW;AAC9D,aAAO;AAAA,IACT;AAAA,EACF;AACF;","names":["forms"]}

package/dist/chunk-W2QQ5Y6K.js

@@ -0,0 +1,55 @@
+import {
+  positiveInteger,
+  string
+} from "./chunk-AQYDZUJV.js";
+import {
+  defineSchema
+} from "./chunk-56SNIMDO.js";
+
+// src/subscription-personal-authority-v2.ts
+import { z } from "zod";
+var PositiveSafeInteger = /* @__PURE__ */ defineSchema(
+  () => positiveInteger.max(Number.MAX_SAFE_INTEGER)
+);
+var CanonicalUuid = /* @__PURE__ */ defineSchema(
+  () => string.regex(
+    /^[0-9a-f]{8}-[0-9a-f]{4}-[1-8][0-9a-f]{3}-[89ab][0-9a-f]{3}-[0-9a-f]{12}$/
+  )
+);
+var SubscriptionPersonalAuthorityV2 = /* @__PURE__ */ defineSchema(
+  () => z.object({
+    version: z.literal(2),
+    personal: z.array(
+      z.object({
+        provider: z.enum(["codex", "claude", "xai"]),
+        ownerMembershipId: CanonicalUuid,
+        authorityGeneration: PositiveSafeInteger,
+        /**
+         * Explicit personal consent accepted in a shared chat. Unlike the
+         * historical private-work pool, this authorizes only this connection
+         * in this session. Copies retain the restriction verbatim.
+         */
+        sharedSessionChoice: z.object({ sessionId: CanonicalUuid, connectionId: CanonicalUuid }).strict().optional()
+      }).strict()
+    ).max(3)
+  }).strict().superRefine((snapshot, ctx) => {
+    const providers = snapshot.personal.map((authority) => authority.provider);
+    if (new Set(providers).size !== providers.length) {
+      ctx.addIssue({ code: "custom", message: "Duplicate provider personal authority" });
+    }
+  })
+);
+function subscriptionPersonalAuthorityForProviderV2(snapshot, provider) {
+  return snapshot.personal.find((authority) => authority.provider === provider) ?? null;
+}
+var EMPTY_SUBSCRIPTION_PERSONAL_AUTHORITY_V2 = {
+  version: 2,
+  personal: []
+};
+
+export {
+  SubscriptionPersonalAuthorityV2,
+  subscriptionPersonalAuthorityForProviderV2,
+  EMPTY_SUBSCRIPTION_PERSONAL_AUTHORITY_V2
+};
+//# sourceMappingURL=chunk-W2QQ5Y6K.js.map

package/dist/chunk-W2QQ5Y6K.js.map

@@ -0,0 +1 @@
+{"version":3,"sources":["../src/subscription-personal-authority-v2.ts"],"sourcesContent":["import * as primitives from \"./primitives\";\nimport { defineSchema } from \"./define-schema\";\nimport { z } from \"zod\";\n\nconst PositiveSafeInteger = /* @__PURE__ */ defineSchema(() =>\n  primitives.positiveInteger.max(Number.MAX_SAFE_INTEGER),\n);\n/**\n * Canonical lowercase UUID, matching PostgreSQL uuid::text and the\n * session_turns CHECK, so an accepted snapshot can never silently mismatch.\n */\nconst CanonicalUuid = /* @__PURE__ */ defineSchema(() =>\n  primitives.string.regex(\n    /^[0-9a-f]{8}-[0-9a-f]{4}-[1-8][0-9a-f]{3}-[89ab][0-9a-f]{3}-[0-9a-f]{12}$/,\n  ),\n);\n\n/**\n * Immutable personal authority for accepted subscription work. Shared pool\n * eligibility is live and deliberately absent from this snapshot.\n */\nexport const SubscriptionPersonalAuthorityV2 = /* @__PURE__ */ defineSchema(() =>\n  z\n    .object({\n      version: z.literal(2),\n      personal: z\n        .array(\n          z\n            .object({\n              provider: z.enum([\"codex\", \"claude\", \"xai\"]),\n              ownerMembershipId: CanonicalUuid,\n              authorityGeneration: PositiveSafeInteger,\n              /**\n               * Explicit personal consent accepted in a shared chat. Unlike the\n               * historical private-work pool, this authorizes only this connection\n               * in this session. Copies retain the restriction verbatim.\n               */\n              sharedSessionChoice: z\n                .object({ sessionId: CanonicalUuid, connectionId: CanonicalUuid })\n                .strict()\n                .optional(),\n            })\n            .strict(),\n        )\n        .max(3),\n    })\n    .strict()\n    .superRefine((snapshot, ctx) => {\n      const providers = snapshot.personal.map((authority) => authority.provider);\n      if (new Set(providers).size !== providers.length) {\n        ctx.addIssue({ code: \"custom\", message: \"Duplicate provider personal authority\" });\n      }\n    }),\n);\n\nexport type SubscriptionPersonalAuthorityV2 = z.infer<typeof SubscriptionPersonalAuthorityV2>;\n\n/** Return one provider's immutable personal authority from a parsed snapshot. */\nexport function subscriptionPersonalAuthorityForProviderV2(\n  snapshot: SubscriptionPersonalAuthorityV2,\n  provider: SubscriptionPersonalAuthorityV2[\"personal\"][number][\"provider\"],\n): SubscriptionPersonalAuthorityV2[\"personal\"][number] | null {\n  return snapshot.personal.find((authority) => authority.provider === provider) ?? null;\n}\n\nexport const EMPTY_SUBSCRIPTION_PERSONAL_AUTHORITY_V2 = {\n  version: 2,\n  personal: [],\n} as const satisfies SubscriptionPersonalAuthorityV2;\n"],"mappings":";;;;;;;;;AAEA,SAAS,SAAS;AAElB,IAAM,sBAAsC;AAAA,EAAa,MAC5C,gBAAgB,IAAI,OAAO,gBAAgB;AACxD;AAKA,IAAM,gBAAgC;AAAA,EAAa,MACtC,OAAO;AAAA,IAChB;AAAA,EACF;AACF;AAMO,IAAM,kCAAkD;AAAA,EAAa,MAC1E,EACG,OAAO;AAAA,IACN,SAAS,EAAE,QAAQ,CAAC;AAAA,IACpB,UAAU,EACP;AAAA,MACC,EACG,OAAO;AAAA,QACN,UAAU,EAAE,KAAK,CAAC,SAAS,UAAU,KAAK,CAAC;AAAA,QAC3C,mBAAmB;AAAA,QACnB,qBAAqB;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,QAMrB,qBAAqB,EAClB,OAAO,EAAE,WAAW,eAAe,cAAc,cAAc,CAAC,EAChE,OAAO,EACP,SAAS;AAAA,MACd,CAAC,EACA,OAAO;AAAA,IACZ,EACC,IAAI,CAAC;AAAA,EACV,CAAC,EACA,OAAO,EACP,YAAY,CAAC,UAAU,QAAQ;AAC9B,UAAM,YAAY,SAAS,SAAS,IAAI,CAAC,cAAc,UAAU,QAAQ;AACzE,QAAI,IAAI,IAAI,SAAS,EAAE,SAAS,UAAU,QAAQ;AAChD,UAAI,SAAS,EAAE,MAAM,UAAU,SAAS,wCAAwC,CAAC;AAAA,IACnF;AAAA,EACF,CAAC;AACL;AAKO,SAAS,2CACd,UACA,UAC4D;AAC5D,SAAO,SAAS,SAAS,KAAK,CAAC,cAAc,UAAU,aAAa,QAAQ,KAAK;AACnF;AAEO,IAAM,2CAA2C;AAAA,EACtD,SAAS;AAAA,EACT,UAAU,CAAC;AACb;","names":[]}

package/dist/{chunk-Y3KNXVTD.js → chunk-W3NBPR4E.js}

@@ -1,8 +1,14 @@
 import {
+  SPREADSHEET_DEFAULT_COLUMN_WIDTH,
+  SPREADSHEET_DEFAULT_ROW_HEIGHT,
+  SPREADSHEET_MAX_DIMENSION_PIXELS,
   canonicalSpreadsheetDateFromMilliseconds,
   canonicalSpreadsheetDateMilliseconds,
   spreadsheetSheetId
-} from "./chunk-TXTQIYCV.js";
+} from "./chunk-RUQ4I6DO.js";
+import {
+  fnv1a64
+} from "./chunk-WQI7VNN4.js";
 
 // src/spreadsheet-artifact-query.ts
 var SPREADSHEET_ARTIFACT_QUERY_VERSION = 1;
@@ -23,10 +29,15 @@ var VIEWPORT_QUERY_PAYLOAD_BYTES = 32;
 var VIEWPORT_PROJECTION_PREFIX_BYTES = 48;
 var METADATA_PROJECTION_PREFIX_BYTES = 4;
 var GENERATIONS_FLAG = 1;
+var DIMENSIONS_FLAG = 2;
+var DIMENSION_KEYS = [
+  "defaultRowHeight",
+  "defaultColumnWidth",
+  "rowHeights",
+  "columnWidths"
+];
 var UINT32_MAX = 4294967295;
 var UINT64_MAX = 0xffffffffffffffffn;
-var FNV_OFFSET = 0xcbf29ce484222325n;
-var FNV_PRIME = 0x100000001b3n;
 var textEncoder = new TextEncoder();
 var textDecoder = new TextDecoder("utf-8", { fatal: true });
 function encodeSpreadsheetViewportKernelQuery(input) {
@@ -107,6 +118,8 @@ function encodeSpreadsheetViewportKernelProjection(input, maximumBytes = SPREADS
   payload.u32(projection.startColumn);
   payload.u32(projection.rowCount);
   payload.u32(projection.columnCount);
+  const hasDimensions = projection.defaultRowHeight !== void 0;
+  if (hasDimensions) writeDimensions(payload, projection);
   for (const cell of projection.cells) {
     payload.u32(cell.row - projection.startRow);
     payload.u32(cell.column - projection.startColumn);
@@ -115,7 +128,7 @@ function encodeSpreadsheetViewportKernelProjection(input, maximumBytes = SPREADS
   return encodeProjectionFrame(
     0,
     projection.revision,
-    projection.generationId === null ? 0 : GENERATIONS_FLAG,
+    (projection.generationId === null ? 0 : GENERATIONS_FLAG) | (hasDimensions ? DIMENSIONS_FLAG : 0),
     projection.cells.length,
     payload.finish(),
     maximum
@@ -128,7 +141,7 @@ function encodeSpreadsheetMetadataKernelProjection(input, maximumBytes = SPREADS
     SPREADSHEET_ARTIFACT_METADATA_MIN_RESPONSE_BYTES
   );
   const payload = new DynamicWriter(maximum - PROJECTION_HEADER_BYTES - CHECKSUM_BYTES);
-  payload.u32(0);
+  payload.u32(projection.modeledFeatures.dimensions ? 1 : 0);
   for (const sheet of projection.sheets) {
     payload.stableId(sheet.sheetId);
     payload.optionalStableId(sheet.generationId);
@@ -142,12 +155,13 @@ function encodeSpreadsheetMetadataKernelProjection(input, maximumBytes = SPREADS
       payload.u32(sheet.usedBounds.endRow);
       payload.u32(sheet.usedBounds.endColumn);
     }
+    if (projection.modeledFeatures.dimensions) writeDimensions(payload, sheet);
   }
   const generations = projection.sheets.length > 0 && projection.sheets[0].generationId !== null;
   return encodeProjectionFrame(
     1,
     projection.revision,
-    generations ? GENERATIONS_FLAG : 0,
+    (generations ? GENERATIONS_FLAG : 0) | (projection.modeledFeatures.dimensions ? DIMENSIONS_FLAG : 0),
     projection.sheets.length,
     payload.finish(),
     maximum
@@ -310,7 +324,7 @@ function decodeProjectionFrame(bytes) {
     throw projectionError(`unsupported spreadsheet projection version: ${version}`);
   }
   const flags = reader.u16();
-  if ((flags & ~GENERATIONS_FLAG) !== 0) {
+  if ((flags & ~(GENERATIONS_FLAG | DIMENSIONS_FLAG)) !== 0) {
     throw projectionError("spreadsheet projection flags are noncanonical");
   }
   const kindTag = reader.u8();
@@ -360,6 +374,8 @@ function decodeViewportPayload(frame) {
   const rowCount = reader.u32();
   const columnCount = reader.u32();
   validateViewportGeometry(startRow, startColumn, rowCount, columnCount);
+  const dimensions = (frame.flags & DIMENSIONS_FLAG) !== 0 ? readDimensions(reader) : {};
+  validateDimensionExtent(dimensions, startRow, rowCount, startColumn, columnCount);
   const cells = [];
   let previousOrdinal = -1;
   for (let index = 0; index < frame.itemCount; index += 1) {
@@ -390,6 +406,7 @@ function decodeViewportPayload(frame) {
   reader.done("viewport projection payload contains trailing bytes");
   return Object.freeze({
     revision: frame.revision,
+    ...dimensions,
     sheetId,
     generationId,
     startRow,
@@ -407,7 +424,8 @@ function decodeMetadataPayload(frame) {
     throw projectionError("metadata projection payload is truncated");
   }
   const reader = new Reader(frame.payload);
-  if (reader.u32() !== 0) {
+  const features = reader.u32();
+  if ((features & ~1) !== 0 || features === 1 !== ((frame.flags & DIMENSIONS_FLAG) !== 0)) {
     throw projectionError("metadata projection contains unknown modeled feature bits");
   }
   const hasGenerations = (frame.flags & GENERATIONS_FLAG) !== 0;
@@ -441,12 +459,13 @@ function decodeMetadataPayload(frame) {
       }
       usedBounds = Object.freeze({ startRow, startColumn, endRow, endColumn });
     }
-    sheets.push(Object.freeze({ sheetId, generationId, name, usedBounds }));
+    const dimensions = (frame.flags & DIMENSIONS_FLAG) !== 0 ? readDimensions(reader) : {};
+    sheets.push(Object.freeze({ sheetId, generationId, name, usedBounds, ...dimensions }));
   }
   reader.done("metadata projection payload contains trailing bytes");
   return Object.freeze({
     revision: frame.revision,
-    modeledFeatures: MODELED_FEATURES_NONE,
+    modeledFeatures: Object.freeze({ dimensions: features === 1, hidden: false, merges: false }),
     sheets: Object.freeze(sheets)
   });
 }
@@ -500,8 +519,9 @@ function normalizeViewportProjection(input) {
       "rowCount",
       "sheetId",
       "startColumn",
-      "startRow"
-    ],
+      "startRow",
+      ...projection.defaultRowHeight === void 0 ? [] : DIMENSION_KEYS
+    ].sort(),
     "spreadsheet viewport projection"
   );
   const revision = uint64(projection.revision, "viewport revision");
@@ -512,6 +532,8 @@ function normalizeViewportProjection(input) {
   const rowCount = positiveUint32(projection.rowCount, "viewport rowCount");
   const columnCount = positiveUint32(projection.columnCount, "viewport columnCount");
   validateViewportGeometry(startRow, startColumn, rowCount, columnCount);
+  const dimensions = projection.defaultRowHeight === void 0 ? {} : normalizeDimensions(projection);
+  validateDimensionExtent(dimensions, startRow, rowCount, startColumn, columnCount);
   if (!Array.isArray(projection.cells)) throw projectionError("viewport cells must be an array");
   if (projection.cells.length > SPREADSHEET_ARTIFACT_VIEWPORT_MAX_CELLS) {
     throw projectionError("viewport projection exceeds its hard cell limit");
@@ -535,6 +557,7 @@ function normalizeViewportProjection(input) {
   }
   return Object.freeze({
     revision,
+    ...dimensions,
     sheetId,
     generationId,
     startRow,
@@ -554,8 +577,8 @@ function normalizeMetadataProjection(input) {
   const revision = uint64(projection.revision, "metadata revision");
   const features = exactRecord(projection.modeledFeatures, "metadata modeledFeatures");
   exactKeys(features, ["dimensions", "hidden", "merges"], "metadata modeledFeatures");
-  if (features.dimensions !== false || features.hidden !== false || features.merges !== false) {
-    throw projectionError("version 1 metadata modeled features must all be false");
+  if (typeof features.dimensions !== "boolean" || features.hidden !== false || features.merges !== false) {
+    throw projectionError("metadata modeled features are invalid");
   }
   if (!Array.isArray(projection.sheets)) throw projectionError("metadata sheets must be an array");
   if (projection.sheets.length > SPREADSHEET_ARTIFACT_METADATA_MAX_SHEETS) {
@@ -570,7 +593,17 @@ function normalizeMetadataProjection(input) {
       ownArrayElement(projection.sheets, index, "metadata sheets"),
       "metadata sheet"
     );
-    exactKeys(value, ["generationId", "name", "sheetId", "usedBounds"], "metadata sheet");
+    exactKeys(
+      value,
+      [
+        "generationId",
+        "name",
+        "sheetId",
+        "usedBounds",
+        ...features.dimensions ? DIMENSION_KEYS : []
+      ].sort(),
+      "metadata sheet"
+    );
     const sheetId = spreadsheetSheetId(requireString(value.sheetId, "metadata sheetId"));
     if (ids.has(sheetId)) throw projectionError("metadata projection contains duplicate sheet ids");
     ids.add(sheetId);
@@ -590,14 +623,94 @@ function normalizeMetadataProjection(input) {
     }
     names.add(foldedName);
     const usedBounds = value.usedBounds === null ? null : normalizeUsedBounds(value.usedBounds);
-    sheets.push(Object.freeze({ sheetId, generationId, name, usedBounds }));
+    sheets.push(
+      Object.freeze({
+        sheetId,
+        generationId,
+        name,
+        usedBounds,
+        ...features.dimensions ? normalizeDimensions(value) : {}
+      })
+    );
   }
   return Object.freeze({
     revision,
-    modeledFeatures: MODELED_FEATURES_NONE,
+    modeledFeatures: Object.freeze({
+      dimensions: features.dimensions,
+      hidden: false,
+      merges: false
+    }),
     sheets: Object.freeze(sheets)
   });
 }
+function normalizeDimensions(input) {
+  if (input.defaultRowHeight !== SPREADSHEET_DEFAULT_ROW_HEIGHT || input.defaultColumnWidth !== SPREADSHEET_DEFAULT_COLUMN_WIDTH) {
+    throw projectionError("dimension defaults are invalid");
+  }
+  const normalizeEntries = (value, defaultPixels) => {
+    if (!Array.isArray(value) || value.length > SPREADSHEET_ARTIFACT_PROJECTION_MAX_BYTES / 8)
+      throw projectionError("dimension entries exceed limits");
+    let previous = -1;
+    const entries = [];
+    for (let offset = 0; offset < value.length; offset += 1) {
+      const entry = ownArrayElement(value, offset, "dimension entries");
+      if (!Array.isArray(entry) || entry.length !== 2)
+        throw projectionError("dimension entry must be an index/pixels pair");
+      const index = uint32(ownArrayElement(entry, 0, "dimension index"), `dimension ${offset}`);
+      const pixels = positiveUint32(
+        ownArrayElement(entry, 1, "dimension pixels"),
+        "dimension pixels"
+      );
+      if (index <= previous || pixels > SPREADSHEET_MAX_DIMENSION_PIXELS || pixels === defaultPixels)
+        throw projectionError("dimensions must be sorted unique non-default entries within bounds");
+      previous = index;
+      entries.push(Object.freeze([index, pixels]));
+    }
+    return Object.freeze(entries);
+  };
+  return Object.freeze({
+    defaultRowHeight: SPREADSHEET_DEFAULT_ROW_HEIGHT,
+    defaultColumnWidth: SPREADSHEET_DEFAULT_COLUMN_WIDTH,
+    rowHeights: normalizeEntries(input.rowHeights, SPREADSHEET_DEFAULT_ROW_HEIGHT),
+    columnWidths: normalizeEntries(input.columnWidths, SPREADSHEET_DEFAULT_COLUMN_WIDTH)
+  });
+}
+function writeDimensions(writer, dimensions) {
+  writer.u32(dimensions.defaultRowHeight);
+  writer.u32(dimensions.defaultColumnWidth);
+  for (const entries of [dimensions.rowHeights, dimensions.columnWidths]) {
+    writer.u32(entries.length);
+    for (const [index, pixels] of entries) {
+      writer.u32(index);
+      writer.u32(pixels);
+    }
+  }
+}
+function readDimensions(reader) {
+  const defaultRowHeight = reader.u32();
+  const defaultColumnWidth = reader.u32();
+  const axes = [];
+  for (let axis = 0; axis < 2; axis += 1) {
+    const count = reader.u32();
+    if (count > SPREADSHEET_ARTIFACT_PROJECTION_MAX_BYTES / 8)
+      throw projectionError("dimension entries exceed limits");
+    const entries = [];
+    for (let index = 0; index < count; index += 1) entries.push([reader.u32(), reader.u32()]);
+    axes.push(entries);
+  }
+  return normalizeDimensions({
+    defaultRowHeight,
+    defaultColumnWidth,
+    rowHeights: axes[0],
+    columnWidths: axes[1]
+  });
+}
+function validateDimensionExtent(dimensions, startRow, rowCount, startColumn, columnCount) {
+  if (dimensions.rowHeights?.some(([index]) => index < startRow || index - startRow >= rowCount) || dimensions.columnWidths?.some(
+    ([index]) => index < startColumn || index - startColumn >= columnCount
+  ))
+    throw projectionError("dimensions lie outside viewport");
+}
 function normalizeProjectedCell(input) {
   const cell = exactRecord(input, "projected cell");
   exactKeys(cell, ["column", "formula", "row", "value"], "projected cell");
@@ -796,25 +909,12 @@ function boundedUtf8(value, maximum, label) {
 function equalBytes(left, right) {
   return left.byteLength === right.byteLength && left.every((byte, index) => byte === right[index]);
 }
-function fnv1a64(bytes) {
-  let hash = FNV_OFFSET;
-  for (const byte of bytes) {
-    hash ^= BigInt(byte);
-    hash = BigInt.asUintN(64, hash * FNV_PRIME);
-  }
-  return hash;
-}
 function queryError(message) {
   return new TypeError(message);
 }
 function projectionError(message) {
   return new TypeError(message);
 }
-var MODELED_FEATURES_NONE = Object.freeze({
-  dimensions: false,
-  hidden: false,
-  merges: false
-});
 var EMPTY_VALUE = Object.freeze({
   kind: "empty"
 });
@@ -1142,4 +1242,4 @@ export {
   decodeSpreadsheetMetadataKernelProjection,
   assertCanonicalSpreadsheetArtifactKernelProjectionBytes
 };
-//# sourceMappingURL=chunk-Y3KNXVTD.js.map
+//# sourceMappingURL=chunk-W3NBPR4E.js.map