@oxyhq/crowdsource-contracts 0.1.0

package/dist/policies.js

@@ -0,0 +1,178 @@
+"use strict";
+/**
+ * The application-policy layer (§6.1 layer 2) and policy versioning (§6.4).
+ *
+ * The taxonomy says what the material contains; a policy set says whether that
+ * violates THIS application's rules. The two are versioned independently and
+ * every decision records both (plus the Oxy conduct policy version), because
+ * §6.4 forbids a policy update from silently changing what a past decision
+ * meant.
+ *
+ * The security boundary of this module is §6.4's last line: "rules must be
+ * expressed as data, not as arbitrary code supplied by the tenant". A rule here
+ * therefore has an id, a title, the taxonomy codes it responds to, a default
+ * severity and recommended actions — and no expression, predicate, script,
+ * template or callback field of any kind. That absence is the control. It is
+ * enforced by `.strict()`: a policy set carrying an unrecognised key is
+ * rejected outright rather than accepted with the key quietly dropped, because
+ * "dropped" and "never evaluated" look identical right up until something
+ * decides to evaluate it.
+ */
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.PolicySetVersionSchema = exports.PolicyRuleSchema = exports.PolicySetStatusSchema = exports.POLICY_SET_STATUSES = exports.ReputationPolicyVersionsSchema = exports.DecisionPolicyVersionsSchema = exports.CasePolicyRefSchema = exports.OXY_CONDUCT_POLICY_VERSION = exports.PolicyVersionSchema = exports.PolicyRuleIdSchema = exports.PolicySetIdSchema = void 0;
+const zod_1 = require("zod");
+const primitives_1 = require("./primitives");
+const taxonomy_1 = require("./taxonomy");
+/** A namespaced policy set id, e.g. `mention.community`. */
+exports.PolicySetIdSchema = zod_1.z
+    .string()
+    .min(3)
+    .max(primitives_1.CONTRACT_LIMITS.IDENTIFIER_MAX_LENGTH)
+    .regex(/^[a-z][a-z0-9_]*(\.[a-z0-9_]+)+$/, 'must be a dotted lowercase namespace, e.g. "mention.community"');
+/** A rule id within a policy set, e.g. `mention.harassment.2`. */
+exports.PolicyRuleIdSchema = zod_1.z
+    .string()
+    .min(3)
+    .max(primitives_1.CONTRACT_LIMITS.IDENTIFIER_MAX_LENGTH)
+    .regex(/^[a-z][a-z0-9_]*(\.[a-z0-9_]+)+$/, 'must be a dotted lowercase namespace, e.g. "mention.harassment.2"');
+/**
+ * An immutable policy version token, e.g. `2026.07`, `mention.2026.07`,
+ * `oxy.2026.1`.
+ *
+ * Deliberately not semver: the plan's own tokens are calendar-shaped and
+ * tenant-prefixed, and a policy version is an opaque label pointing at a frozen
+ * document — nothing compares two of them for ordering.
+ */
+exports.PolicyVersionSchema = zod_1.z
+    .string()
+    .min(1)
+    .max(64)
+    .regex(/^[A-Za-z0-9][A-Za-z0-9._-]*$/, 'must start with a letter or digit and contain only letters, digits, ".", "_" or "-"');
+/**
+ * The version of the Oxy Conduct Policy every decision is stamped with (§6.4).
+ *
+ * §6.1 assigns the third layer — "should this conduct affect global Oxy trust?"
+ * — to the Oxy Conduct Policy, evaluated by the Reputation Bridge. That bridge
+ * does not exist yet, and this constant is deliberately NOT a promise that it
+ * does. What it is: the label a decision published today records, so that when
+ * the bridge arrives it can tell which conduct policy a historical decision was
+ * decided under and refuse to re-interpret it under a newer one. §6.4's "a
+ * policy update never silently rewrites historical decisions" is unenforceable
+ * without a version on every decision from the first one.
+ *
+ * The value is Appendix B's. It is pinned here, in the package both the
+ * decision DTO and the reputation event import, so the two cannot drift into
+ * describing the same decision under two different conduct policies.
+ */
+exports.OXY_CONDUCT_POLICY_VERSION = 'oxy.2026.1';
+/**
+ * The policy an envelope asks to be evaluated under (§5.1 `policy`).
+ *
+ * `locale` selects the language the policy text is shown to the reviewer in
+ * (Appendix A), and is not the language of the reported material — that is
+ * `resource.language`.
+ */
+exports.CasePolicyRefSchema = zod_1.z.strictObject({
+    policySetId: exports.PolicySetIdSchema,
+    version: exports.PolicyVersionSchema,
+    locale: primitives_1.LanguageTagSchema.optional(),
+});
+/**
+ * The three policy versions a decision is decided under (§6.4).
+ *
+ * Field names follow Appendix B (`taxonomy`), which is the reference Decision.
+ * §6.4's prose calls the same field `universalTaxonomyVersion` and §11.6's
+ * internal event calls it `universal`; see `ReputationPolicyVersionsSchema` for
+ * why both spellings survive.
+ */
+exports.DecisionPolicyVersionsSchema = zod_1.z.looseObject({
+    taxonomy: exports.PolicyVersionSchema,
+    application: exports.PolicyVersionSchema,
+    oxyConduct: exports.PolicyVersionSchema,
+});
+/**
+ * The same three versions as carried by the internal reputation event (§11.6).
+ *
+ * §11.6 spells the first key `universal` where Appendix B spells it `taxonomy`.
+ * Both are reference payloads in the approved plan and both are load-bearing
+ * for a different consumer, so each surface keeps the spelling its own
+ * reference document uses rather than one of the two documents being quietly
+ * rewritten here. Unifying them is a one-line change and worth doing when the
+ * event contract is agreed with OxyHQServices — it is called out in the package
+ * README as the single naming inconsistency the contract preserves on purpose.
+ */
+exports.ReputationPolicyVersionsSchema = zod_1.z.strictObject({
+    universal: exports.PolicyVersionSchema,
+    application: exports.PolicyVersionSchema,
+    oxyConduct: exports.PolicyVersionSchema,
+});
+/** §6.4: a draft may be edited, a published version may not. */
+exports.POLICY_SET_STATUSES = ['draft', 'published'];
+exports.PolicySetStatusSchema = zod_1.z.enum(exports.POLICY_SET_STATUSES);
+/**
+ * One rule inside a policy version — data, never code.
+ *
+ * `taxonomyCodes` is what binds layer 2 back to layer 1: the rule declares
+ * which universal findings it responds to, so a jury classifies once (§9.2 step
+ * one) and any number of applications evaluate that same classification against
+ * their own rules (§6.2).
+ */
+exports.PolicyRuleSchema = zod_1.z.strictObject({
+    id: exports.PolicyRuleIdSchema,
+    title: zod_1.z.string().min(1).max(primitives_1.CONTRACT_LIMITS.SHORT_TEXT_MAX_LENGTH),
+    description: zod_1.z.string().max(primitives_1.CONTRACT_LIMITS.LONG_TEXT_MAX_LENGTH).optional(),
+    taxonomyCodes: zod_1.z.array(taxonomy_1.TaxonomyCodeSchema).min(1).max(primitives_1.CONTRACT_LIMITS.FINDINGS_MAX),
+    defaultSeverity: taxonomy_1.SeveritySchema.optional(),
+    recommendedActions: zod_1.z
+        .array(taxonomy_1.RecommendedActionSchema)
+        .max(primitives_1.CONTRACT_LIMITS.RECOMMENDED_ACTIONS_MAX)
+        .optional(),
+});
+const POLICY_RULES_MAX = 500;
+/**
+ * A policy set at one version (§6.4).
+ *
+ * The `status`/`publishedAt` pairing is the immutability rule expressed where a
+ * schema can express it: a published version must record when it was published,
+ * and a draft must not claim to have been. Actual immutability — never
+ * rewriting a published version's rules — is a storage rule the registry
+ * enforces; no parse can see a second write.
+ */
+exports.PolicySetVersionSchema = zod_1.z
+    .strictObject({
+    policySetId: exports.PolicySetIdSchema,
+    version: exports.PolicyVersionSchema,
+    status: exports.PolicySetStatusSchema,
+    title: zod_1.z.string().min(1).max(primitives_1.CONTRACT_LIMITS.SHORT_TEXT_MAX_LENGTH),
+    locale: primitives_1.LanguageTagSchema.optional(),
+    publishedAt: primitives_1.TimestampSchema.optional(),
+    rules: zod_1.z.array(exports.PolicyRuleSchema).min(1).max(POLICY_RULES_MAX),
+})
+    .superRefine((policySet, ctx) => {
+    if (policySet.status === 'published' && policySet.publishedAt === undefined) {
+        ctx.addIssue({
+            code: 'custom',
+            path: ['publishedAt'],
+            message: 'a published policy version must record publishedAt',
+        });
+    }
+    if (policySet.status === 'draft' && policySet.publishedAt !== undefined) {
+        ctx.addIssue({
+            code: 'custom',
+            path: ['publishedAt'],
+            message: 'a draft policy version must not record publishedAt',
+        });
+    }
+    const seen = new Set();
+    policySet.rules.forEach((rule, index) => {
+        if (seen.has(rule.id)) {
+            ctx.addIssue({
+                code: 'custom',
+                path: ['rules', index, 'id'],
+                message: `duplicate rule id "${rule.id}"`,
+            });
+        }
+        seen.add(rule.id);
+    });
+});
+//# sourceMappingURL=policies.js.map

package/dist/policies.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"policies.js","sourceRoot":"","sources":["../src/policies.ts"],"names":[],"mappings":";AAAA;;;;;;;;;;;;;;;;;;GAkBG;;;AAEH,6BAAwB;AAExB,6CAAmF;AACnF,yCAAyF;AAEzF,4DAA4D;AAC/C,QAAA,iBAAiB,GAAG,OAAC;KAC/B,MAAM,EAAE;KACR,GAAG,CAAC,CAAC,CAAC;KACN,GAAG,CAAC,4BAAe,CAAC,qBAAqB,CAAC;KAC1C,KAAK,CACJ,kCAAkC,EAClC,gEAAgE,CACjE,CAAC;AAEJ,kEAAkE;AACrD,QAAA,kBAAkB,GAAG,OAAC;KAChC,MAAM,EAAE;KACR,GAAG,CAAC,CAAC,CAAC;KACN,GAAG,CAAC,4BAAe,CAAC,qBAAqB,CAAC;KAC1C,KAAK,CACJ,kCAAkC,EAClC,mEAAmE,CACpE,CAAC;AAEJ;;;;;;;GAOG;AACU,QAAA,mBAAmB,GAAG,OAAC;KACjC,MAAM,EAAE;KACR,GAAG,CAAC,CAAC,CAAC;KACN,GAAG,CAAC,EAAE,CAAC;KACP,KAAK,CACJ,8BAA8B,EAC9B,qFAAqF,CACtF,CAAC;AAEJ;;;;;;;;;;;;;;;GAeG;AACU,QAAA,0BAA0B,GAAG,YAAY,CAAC;AAEvD;;;;;;GAMG;AACU,QAAA,mBAAmB,GAAG,OAAC,CAAC,YAAY,CAAC;IAChD,WAAW,EAAE,yBAAiB;IAC9B,OAAO,EAAE,2BAAmB;IAC5B,MAAM,EAAE,8BAAiB,CAAC,QAAQ,EAAE;CACrC,CAAC,CAAC;AAGH;;;;;;;GAOG;AACU,QAAA,4BAA4B,GAAG,OAAC,CAAC,WAAW,CAAC;IACxD,QAAQ,EAAE,2BAAmB;IAC7B,WAAW,EAAE,2BAAmB;IAChC,UAAU,EAAE,2BAAmB;CAChC,CAAC,CAAC;AAGH;;;;;;;;;;GAUG;AACU,QAAA,8BAA8B,GAAG,OAAC,CAAC,YAAY,CAAC;IAC3D,SAAS,EAAE,2BAAmB;IAC9B,WAAW,EAAE,2BAAmB;IAChC,UAAU,EAAE,2BAAmB;CAChC,CAAC,CAAC;AAGH,gEAAgE;AACnD,QAAA,mBAAmB,GAAG,CAAC,OAAO,EAAE,WAAW,CAAU,CAAC;AACtD,QAAA,qBAAqB,GAAG,OAAC,CAAC,IAAI,CAAC,2BAAmB,CAAC,CAAC;AAGjE;;;;;;;GAOG;AACU,QAAA,gBAAgB,GAAG,OAAC,CAAC,YAAY,CAAC;IAC7C,EAAE,EAAE,0BAAkB;IACtB,KAAK,EAAE,OAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,4BAAe,CAAC,qBAAqB,CAAC;IACnE,WAAW,EAAE,OAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,4BAAe,CAAC,oBAAoB,CAAC,CAAC,QAAQ,EAAE;IAC5E,aAAa,EAAE,OAAC,CAAC,KAAK,CAAC,6BAAkB,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,4BAAe,CAAC,YAAY,CAAC;IACnF,eAAe,EAAE,yBAAc,CAAC,QAAQ,EAAE;IAC1C,kBAAkB,EAAE,OAAC;SAClB,KAAK,CAAC,kCAAuB,CAAC;SAC9B,GAAG,CAAC,4BAAe,CAAC,uBAAuB,CAAC;SAC5C,QAAQ,EAAE;CACd,CAAC,CAAC;AAGH,MAAM,gBAAgB,GAAG,GAAG,CAAC;AAE7B;;;;;;;;GAQG;AACU,QAAA,sBAAsB,GAAG,OAAC;KACpC,YAAY,CAAC;IACZ,WAAW,EAAE,yBAAiB;IAC9B,OAAO,EAAE,2BAAmB;IAC5B,MAAM,EAAE,6BAAqB;IAC7B,KAAK,EAAE,OAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,4BAAe,CAAC,qBAAqB,CAAC;IACnE,MAAM,EAAE,8BAAiB,CAAC,QAAQ,EAAE;IACpC,WAAW,EAAE,4BAAe,CAAC,QAAQ,EAAE;IACvC,KAAK,EAAE,OAAC,CAAC,KAAK,CAAC,wBAAgB,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,gBAAgB,CAAC;CAC9D,CAAC;KACD,WAAW,CAAC,CAAC,SAAS,EAAE,GAAG,EAAE,EAAE;IAC9B,IAAI,SAAS,CAAC,MAAM,KAAK,WAAW,IAAI,SAAS,CAAC,WAAW,KAAK,SAAS,EAAE,CAAC;QAC5E,GAAG,CAAC,QAAQ,CAAC;YACX,IAAI,EAAE,QAAQ;YACd,IAAI,EAAE,CAAC,aAAa,CAAC;YACrB,OAAO,EAAE,oDAAoD;SAC9D,CAAC,CAAC;IACL,CAAC;IACD,IAAI,SAAS,CAAC,MAAM,KAAK,OAAO,IAAI,SAAS,CAAC,WAAW,KAAK,SAAS,EAAE,CAAC;QACxE,GAAG,CAAC,QAAQ,CAAC;YACX,IAAI,EAAE,QAAQ;YACd,IAAI,EAAE,CAAC,aAAa,CAAC;YACrB,OAAO,EAAE,oDAAoD;SAC9D,CAAC,CAAC;IACL,CAAC;IAED,MAAM,IAAI,GAAG,IAAI,GAAG,EAAU,CAAC;IAC/B,SAAS,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,IAAI,EAAE,KAAK,EAAE,EAAE;QACtC,IAAI,IAAI,CAAC,GAAG,CAAC,IAAI,CAAC,EAAE,CAAC,EAAE,CAAC;YACtB,GAAG,CAAC,QAAQ,CAAC;gBACX,IAAI,EAAE,QAAQ;gBACd,IAAI,EAAE,CAAC,OAAO,EAAE,KAAK,EAAE,IAAI,CAAC;gBAC5B,OAAO,EAAE,sBAAsB,IAAI,CAAC,EAAE,GAAG;aAC1C,CAAC,CAAC;QACL,CAAC;QACD,IAAI,CAAC,GAAG,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;IACpB,CAAC,CAAC,CAAC;AACL,CAAC,CAAC,CAAC"}

package/dist/primitives.d.ts

@@ -0,0 +1,185 @@
+/**
+ * Scalar contracts shared by every CrowdSource surface.
+ *
+ * Nothing here belongs to a single contract module; everything here is depended
+ * on by several of them. Two properties drive most of the choices below:
+ *
+ *   1. **The envelope is content-addressed.** §7.3 derives `caseDedupKey` from
+ *      `applicationId`, `subject.externalId`, the canonical envelope hash and
+ *      the policy version. Two byte-different representations of the SAME value
+ *      produce two different keys, therefore two cases, therefore two penalties
+ *      for one incident — the exact opposite of the "one penalty per incident"
+ *      invariant. So every scalar that can travel in more than one shape is
+ *      pinned to ONE canonical shape here: digests are always `sha256:<hex>`,
+ *      timestamps are always millisecond-precision UTC.
+ *
+ *   2. **`:` is a structural separator.** §7.3 joins the dedup key components
+ *      with `:`. An identifier that may itself contain `:` makes that join
+ *      ambiguous — two distinct tuples can flatten to the same string and merge
+ *      two unrelated cases. Every identifier schema below therefore excludes
+ *      `:`. (The same character is independently forbidden in BullMQ queue and
+ *      job ids, so this also keeps identifiers usable as dispatch keys.)
+ */
+import { z } from 'zod';
+/**
+ * Bounds applied across the contracts.
+ *
+ * §7.2.3 requires ingress to check "size limits, number of resources and MIME
+ * types" but the plan never states the numbers. These are the contract's own
+ * declared limits: generous enough not to reject real moderation material,
+ * finite so that no array or string in the contract is unbounded. A tenant may
+ * be held to something tighter by quota; nothing may exceed these.
+ */
+export declare const CONTRACT_LIMITS: Readonly<{
+    /** Envelope-local ids (`res_post`), policy ids, principal refs. */
+    readonly IDENTIFIER_MAX_LENGTH: 128;
+    /** Ids minted by the application (`mention_report_123`, `post_987`). */
+    readonly EXTERNAL_ID_MAX_LENGTH: 200;
+    readonly RESOURCES_PER_ENVELOPE_MAX: 50;
+    readonly RELATIONS_PER_ENVELOPE_MAX: 200;
+    readonly ALLEGATIONS_PER_ENVELOPE_MAX: 20;
+    readonly PRINCIPAL_BINDINGS_PER_ENVELOPE_MAX: 50;
+    /** A reported text resource. Long enough for an article, not a corpus. */
+    readonly TEXT_RESOURCE_MAX_LENGTH: 100000;
+    /** Titles, labels, display names, place names. */
+    readonly SHORT_TEXT_MAX_LENGTH: 500;
+    /** Descriptions, bios, reporter details, reviewer notes. */
+    readonly LONG_TEXT_MAX_LENGTH: 5000;
+    /** Audio transcript, document extracted text, link snapshot. */
+    readonly EXTRACTED_TEXT_MAX_LENGTH: 200000;
+    readonly METADATA_KEYS_MAX: 50;
+    readonly METADATA_KEY_MAX_LENGTH: 64;
+    readonly METADATA_STRING_VALUE_MAX_LENGTH: 1000;
+    /** §5.7 custom payloads: data, bounded, never a document tree. */
+    readonly CUSTOM_PAYLOAD_MAX_DEPTH: 5;
+    readonly CUSTOM_PAYLOAD_ARRAY_MAX_LENGTH: 100;
+    readonly CUSTOM_PAYLOAD_STRING_MAX_LENGTH: 10000;
+    readonly CONVERSATION_MESSAGES_MAX: 50;
+    readonly LISTING_MEDIA_REFS_MAX: 20;
+    readonly PROFILE_CLAIMS_MAX: 20;
+    readonly FINDINGS_MAX: 20;
+    readonly RESOURCE_REFS_PER_FINDING_MAX: 50;
+    readonly POLICY_RULE_IDS_MAX: 20;
+    readonly RECOMMENDED_ACTIONS_MAX: 10;
+    /** §13.6 defaults to 30 days "configurable by policy"; this is the ceiling. */
+    readonly RETENTION_DAYS_MAX: 3650;
+    /** A jury is 3, 5 or 7 today (§9.4). The bound only stops absurd values. */
+    readonly JURY_SIZE_MAX: 99;
+}>;
+/**
+ * Keys that must never appear in a caller-supplied object, at any depth.
+ *
+ * A payload is data. These three names are how a data payload stops being data
+ * the moment anything merges, clones or `Object.assign`s it into a prototype
+ * chain. Rejecting them at the contract boundary is cheap and total; sanitising
+ * them later depends on every consumer remembering to.
+ *
+ * One of the three behaves differently and it is worth knowing which, because
+ * the list reads as though it were doing all the work: Zod removes an own
+ * `__proto__` property from any input before a key schema or a strict-key check
+ * ever sees it, so `__proto__` is DROPPED rather than rejected, and this list
+ * never fires for it. The safety outcome is the same — nothing is polluted, and
+ * the key cannot survive into parsed output — but a test asserting that
+ * `__proto__` is *rejected* would fail, and a reader assuming this constant is
+ * what prevents pollution would be assuming the wrong thing. `constructor` and
+ * `prototype` are ordinary keys to Zod and are rejected here.
+ */
+export declare const FORBIDDEN_OBJECT_KEYS: readonly string[];
+/**
+ * An id that is local to one envelope, policy set or contract payload.
+ *
+ * Deliberately opaque: the plan writes both slugs (`app_mention`,
+ * `mention.community`) and ULID-prefixed ids (`case_01...`) in the same fields,
+ * so pinning the format would reject the plan's own reference documents. What
+ * IS pinned is the character set — see the `:` note in the module comment.
+ */
+export declare const IdentifierSchema: z.ZodString;
+/** An id minted by the reporting application, echoed back but never trusted. */
+export declare const ExternalIdSchema: z.ZodString;
+/**
+ * `sha256:<64 lowercase hex>` — the ONLY accepted digest form.
+ *
+ * Appendix A writes `"sha256:..."`; §5.8 writes `"..."`. Accepting both would
+ * let the same bytes be described two ways, and the canonical envelope hash
+ * would differ between them (see property 1 in the module comment). Appendix A
+ * is the reference document, so the prefixed form wins and the bare form is
+ * rejected rather than silently normalised — normalising would mean the digest
+ * CrowdSource stores is not the digest the application sent.
+ */
+export declare const Sha256DigestSchema: z.ZodString;
+/**
+ * Millisecond-precision UTC, e.g. `2026-07-28T18:00:00.000Z`.
+ *
+ * Every timestamp in the plan is written this way, and it is what
+ * `Date.prototype.toISOString()` produces, so the canonical form costs a
+ * JavaScript integrator nothing. Offsets are rejected: `18:00+02:00` and
+ * `16:00Z` are the same instant and would hash differently.
+ */
+export declare const TimestampSchema: z.ZodISODateTime;
+/**
+ * BCP 47, restricted to `language[-Script][-Region][-variant…]`.
+ *
+ * A syntactic subset, not the full grammar (no extensions, no private use, no
+ * grandfathered tags). Covers `es` and `es-ES` from the plan and everything a
+ * real application sends; a tag outside the subset is a signal worth rejecting
+ * at ingress rather than carrying into reviewer language eligibility.
+ */
+export declare const LanguageTagSchema: z.ZodString;
+/**
+ * An absolute `http`/`https` URL.
+ *
+ * §7.2.7 rejects "dangerous schemes and executable resources". Scheme is a
+ * purely syntactic property, so the contract enforces it. Host reachability is
+ * NOT enforced here: deciding whether a host is internal needs DNS resolution
+ * and belongs to `safeFetch` at ingestion time. A scheme check that pretended
+ * to be an SSRF control would be the more dangerous of the two.
+ */
+export declare const HttpUrlSchema: z.ZodURL;
+/** A `type/subtype` media type, without parameters. */
+export declare const MimeTypeSchema: z.ZodString;
+/** A key in any caller-supplied open bag. */
+export declare const ObjectKeySchema: z.ZodString;
+/** A single metadata value: scalar only, never a nested structure. */
+export declare const MetadataValueSchema: z.ZodUnion<readonly [z.ZodString, z.ZodNumber, z.ZodBoolean, z.ZodNull]>;
+/**
+ * An open key/value bag (§5.1 `metadata`, §5.3 the `metadata` resource type).
+ *
+ * Open by definition — the plan calls it "typed key value fields" and every
+ * tenant's keys differ — but flat and bounded. Allowing nesting here would make
+ * this the one field in the envelope through which an application could ship an
+ * arbitrary document tree past every other constraint in the contract.
+ */
+export declare const MetadataBagSchema: z.ZodRecord<z.ZodString, z.ZodUnion<readonly [z.ZodString, z.ZodNumber, z.ZodBoolean, z.ZodNull]>>;
+/** A JSON value that a §5.7 custom payload may contain. */
+export type CustomPayloadValue = string | number | boolean | null | CustomPayloadValue[] | {
+    [key: string]: CustomPayloadValue;
+};
+/**
+ * The value grammar for a §5.7 custom payload.
+ *
+ * Nesting is unrolled to a fixed depth rather than made recursive so the bound
+ * is part of the type, enforced by the same parse as everything else, and
+ * visible in the exported JSON Schema. Depth is what stops a payload being a
+ * document; `ObjectKeySchema` is what stops it being a prototype.
+ *
+ * Note what is deliberately absent: no lexical filter on string values. A
+ * moderation payload legitimately carries the exact hostile text under review —
+ * markup, script fragments, `javascript:` URLs quoted inside a harassment
+ * report. Rejecting those strings would reject the material the system exists
+ * to review. §5.7's boundary is structural, not lexical: the contract has no
+ * field anywhere that carries markup, a template, a component or a remote URL
+ * to be rendered, so there is nothing for such a string to be interpreted as.
+ */
+export declare const CustomPayloadValueSchema: z.ZodType<CustomPayloadValue, unknown, z.core.$ZodTypeInternals<CustomPayloadValue, unknown>>;
+/** The top level of a §5.7 custom payload: always an object, never an array. */
+export declare const CustomPayloadSchema: z.ZodRecord<z.ZodString, z.ZodType<CustomPayloadValue, unknown, z.core.$ZodTypeInternals<CustomPayloadValue, unknown>>>;
+/** A number in the closed interval [0, 1] — §9.5 clamps confidence to it. */
+export declare const UnitIntervalSchema: z.ZodNumber;
+export type Identifier = z.infer<typeof IdentifierSchema>;
+export type ExternalId = z.infer<typeof ExternalIdSchema>;
+export type Sha256Digest = z.infer<typeof Sha256DigestSchema>;
+export type Timestamp = z.infer<typeof TimestampSchema>;
+export type LanguageTag = z.infer<typeof LanguageTagSchema>;
+export type MetadataBag = z.infer<typeof MetadataBagSchema>;
+export type CustomPayload = z.infer<typeof CustomPayloadSchema>;
+//# sourceMappingURL=primitives.d.ts.map

package/dist/primitives.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"primitives.d.ts","sourceRoot":"","sources":["../src/primitives.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;GAqBG;AAEH,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AAExB;;;;;;;;GAQG;AACH,eAAO,MAAM,eAAe;IAC1B,mEAAmE;;IAEnE,wEAAwE;;;;;;IAQxE,0EAA0E;;IAE1E,kDAAkD;;IAElD,4DAA4D;;IAE5D,gEAAgE;;;;;IAOhE,kEAAkE;;;;;;;;;;;IAclE,+EAA+E;;IAE/E,4EAA4E;;EAEnE,CAAC;AAEZ;;;;;;;;;;;;;;;;;GAiBG;AACH,eAAO,MAAM,qBAAqB,EAAE,SAAS,MAAM,EAIjD,CAAC;AAIH;;;;;;;GAOG;AACH,eAAO,MAAM,gBAAgB,aAO1B,CAAC;AAEJ,gFAAgF;AAChF,eAAO,MAAM,gBAAgB,aAO1B,CAAC;AAEJ;;;;;;;;;GASG;AACH,eAAO,MAAM,kBAAkB,aAE+D,CAAC;AAE/F;;;;;;;GAOG;AACH,eAAO,MAAM,eAAe,kBAAkD,CAAC;AAE/E;;;;;;;GAOG;AACH,eAAO,MAAM,iBAAiB,aAK3B,CAAC;AAEJ;;;;;;;;GAQG;AACH,eAAO,MAAM,aAAa,UAA6C,CAAC;AAExE,uDAAuD;AACvD,eAAO,MAAM,cAAc,aAMxB,CAAC;AAIJ,6CAA6C;AAC7C,eAAO,MAAM,eAAe,aAOxB,CAAC;AAEL,sEAAsE;AACtE,eAAO,MAAM,mBAAmB,0EAK9B,CAAC;AAEH;;;;;;;GAOG;AACH,eAAO,MAAM,iBAAiB,oGAI1B,CAAC;AAEL,2DAA2D;AAC3D,MAAM,MAAM,kBAAkB,GAC1B,MAAM,GACN,MAAM,GACN,OAAO,GACP,IAAI,GACJ,kBAAkB,EAAE,GACpB;IAAE,CAAC,GAAG,EAAE,MAAM,GAAG,kBAAkB,CAAA;CAAE,CAAC;AAqB1C;;;;;;;;;;;;;;;GAeG;AACH,eAAO,MAAM,wBAAwB,+FAAkC,CAAC;AAExE,gFAAgF;AAChF,eAAO,MAAM,mBAAmB,yHAAsD,CAAC;AAEvF,6EAA6E;AAC7E,eAAO,MAAM,kBAAkB,aAA2B,CAAC;AAE3D,MAAM,MAAM,UAAU,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,gBAAgB,CAAC,CAAC;AAC1D,MAAM,MAAM,UAAU,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,gBAAgB,CAAC,CAAC;AAC1D,MAAM,MAAM,YAAY,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,kBAAkB,CAAC,CAAC;AAC9D,MAAM,MAAM,SAAS,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,eAAe,CAAC,CAAC;AACxD,MAAM,MAAM,WAAW,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,iBAAiB,CAAC,CAAC;AAC5D,MAAM,MAAM,WAAW,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,iBAAiB,CAAC,CAAC;AAC5D,MAAM,MAAM,aAAa,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,mBAAmB,CAAC,CAAC"}

package/dist/primitives.js

@@ -0,0 +1,231 @@
+"use strict";
+/**
+ * Scalar contracts shared by every CrowdSource surface.
+ *
+ * Nothing here belongs to a single contract module; everything here is depended
+ * on by several of them. Two properties drive most of the choices below:
+ *
+ *   1. **The envelope is content-addressed.** §7.3 derives `caseDedupKey` from
+ *      `applicationId`, `subject.externalId`, the canonical envelope hash and
+ *      the policy version. Two byte-different representations of the SAME value
+ *      produce two different keys, therefore two cases, therefore two penalties
+ *      for one incident — the exact opposite of the "one penalty per incident"
+ *      invariant. So every scalar that can travel in more than one shape is
+ *      pinned to ONE canonical shape here: digests are always `sha256:<hex>`,
+ *      timestamps are always millisecond-precision UTC.
+ *
+ *   2. **`:` is a structural separator.** §7.3 joins the dedup key components
+ *      with `:`. An identifier that may itself contain `:` makes that join
+ *      ambiguous — two distinct tuples can flatten to the same string and merge
+ *      two unrelated cases. Every identifier schema below therefore excludes
+ *      `:`. (The same character is independently forbidden in BullMQ queue and
+ *      job ids, so this also keeps identifiers usable as dispatch keys.)
+ */
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.UnitIntervalSchema = exports.CustomPayloadSchema = exports.CustomPayloadValueSchema = exports.MetadataBagSchema = exports.MetadataValueSchema = exports.ObjectKeySchema = exports.MimeTypeSchema = exports.HttpUrlSchema = exports.LanguageTagSchema = exports.TimestampSchema = exports.Sha256DigestSchema = exports.ExternalIdSchema = exports.IdentifierSchema = exports.FORBIDDEN_OBJECT_KEYS = exports.CONTRACT_LIMITS = void 0;
+const zod_1 = require("zod");
+/**
+ * Bounds applied across the contracts.
+ *
+ * §7.2.3 requires ingress to check "size limits, number of resources and MIME
+ * types" but the plan never states the numbers. These are the contract's own
+ * declared limits: generous enough not to reject real moderation material,
+ * finite so that no array or string in the contract is unbounded. A tenant may
+ * be held to something tighter by quota; nothing may exceed these.
+ */
+exports.CONTRACT_LIMITS = Object.freeze({
+    /** Envelope-local ids (`res_post`), policy ids, principal refs. */
+    IDENTIFIER_MAX_LENGTH: 128,
+    /** Ids minted by the application (`mention_report_123`, `post_987`). */
+    EXTERNAL_ID_MAX_LENGTH: 200,
+    RESOURCES_PER_ENVELOPE_MAX: 50,
+    RELATIONS_PER_ENVELOPE_MAX: 200,
+    ALLEGATIONS_PER_ENVELOPE_MAX: 20,
+    PRINCIPAL_BINDINGS_PER_ENVELOPE_MAX: 50,
+    /** A reported text resource. Long enough for an article, not a corpus. */
+    TEXT_RESOURCE_MAX_LENGTH: 100000,
+    /** Titles, labels, display names, place names. */
+    SHORT_TEXT_MAX_LENGTH: 500,
+    /** Descriptions, bios, reporter details, reviewer notes. */
+    LONG_TEXT_MAX_LENGTH: 5000,
+    /** Audio transcript, document extracted text, link snapshot. */
+    EXTRACTED_TEXT_MAX_LENGTH: 200000,
+    METADATA_KEYS_MAX: 50,
+    METADATA_KEY_MAX_LENGTH: 64,
+    METADATA_STRING_VALUE_MAX_LENGTH: 1000,
+    /** §5.7 custom payloads: data, bounded, never a document tree. */
+    CUSTOM_PAYLOAD_MAX_DEPTH: 5,
+    CUSTOM_PAYLOAD_ARRAY_MAX_LENGTH: 100,
+    CUSTOM_PAYLOAD_STRING_MAX_LENGTH: 10000,
+    CONVERSATION_MESSAGES_MAX: 50,
+    LISTING_MEDIA_REFS_MAX: 20,
+    PROFILE_CLAIMS_MAX: 20,
+    FINDINGS_MAX: 20,
+    RESOURCE_REFS_PER_FINDING_MAX: 50,
+    POLICY_RULE_IDS_MAX: 20,
+    RECOMMENDED_ACTIONS_MAX: 10,
+    /** §13.6 defaults to 30 days "configurable by policy"; this is the ceiling. */
+    RETENTION_DAYS_MAX: 3650,
+    /** A jury is 3, 5 or 7 today (§9.4). The bound only stops absurd values. */
+    JURY_SIZE_MAX: 99,
+});
+/**
+ * Keys that must never appear in a caller-supplied object, at any depth.
+ *
+ * A payload is data. These three names are how a data payload stops being data
+ * the moment anything merges, clones or `Object.assign`s it into a prototype
+ * chain. Rejecting them at the contract boundary is cheap and total; sanitising
+ * them later depends on every consumer remembering to.
+ *
+ * One of the three behaves differently and it is worth knowing which, because
+ * the list reads as though it were doing all the work: Zod removes an own
+ * `__proto__` property from any input before a key schema or a strict-key check
+ * ever sees it, so `__proto__` is DROPPED rather than rejected, and this list
+ * never fires for it. The safety outcome is the same — nothing is polluted, and
+ * the key cannot survive into parsed output — but a test asserting that
+ * `__proto__` is *rejected* would fail, and a reader assuming this constant is
+ * what prevents pollution would be assuming the wrong thing. `constructor` and
+ * `prototype` are ordinary keys to Zod and are rejected here.
+ */
+exports.FORBIDDEN_OBJECT_KEYS = Object.freeze([
+    '__proto__',
+    'constructor',
+    'prototype',
+]);
+const IDENTIFIER_PATTERN = /^[A-Za-z0-9][A-Za-z0-9._-]*$/;
+/**
+ * An id that is local to one envelope, policy set or contract payload.
+ *
+ * Deliberately opaque: the plan writes both slugs (`app_mention`,
+ * `mention.community`) and ULID-prefixed ids (`case_01...`) in the same fields,
+ * so pinning the format would reject the plan's own reference documents. What
+ * IS pinned is the character set — see the `:` note in the module comment.
+ */
+exports.IdentifierSchema = zod_1.z
+    .string()
+    .min(1)
+    .max(exports.CONTRACT_LIMITS.IDENTIFIER_MAX_LENGTH)
+    .regex(IDENTIFIER_PATTERN, 'must start with a letter or digit and contain only letters, digits, ".", "_" or "-"');
+/** An id minted by the reporting application, echoed back but never trusted. */
+exports.ExternalIdSchema = zod_1.z
+    .string()
+    .min(1)
+    .max(exports.CONTRACT_LIMITS.EXTERNAL_ID_MAX_LENGTH)
+    .regex(IDENTIFIER_PATTERN, 'must start with a letter or digit and contain only letters, digits, ".", "_" or "-"');
+/**
+ * `sha256:<64 lowercase hex>` — the ONLY accepted digest form.
+ *
+ * Appendix A writes `"sha256:..."`; §5.8 writes `"..."`. Accepting both would
+ * let the same bytes be described two ways, and the canonical envelope hash
+ * would differ between them (see property 1 in the module comment). Appendix A
+ * is the reference document, so the prefixed form wins and the bare form is
+ * rejected rather than silently normalised — normalising would mean the digest
+ * CrowdSource stores is not the digest the application sent.
+ */
+exports.Sha256DigestSchema = zod_1.z
+    .string()
+    .regex(/^sha256:[0-9a-f]{64}$/, 'must be "sha256:" followed by 64 lowercase hex characters');
+/**
+ * Millisecond-precision UTC, e.g. `2026-07-28T18:00:00.000Z`.
+ *
+ * Every timestamp in the plan is written this way, and it is what
+ * `Date.prototype.toISOString()` produces, so the canonical form costs a
+ * JavaScript integrator nothing. Offsets are rejected: `18:00+02:00` and
+ * `16:00Z` are the same instant and would hash differently.
+ */
+exports.TimestampSchema = zod_1.z.iso.datetime({ offset: false, precision: 3 });
+/**
+ * BCP 47, restricted to `language[-Script][-Region][-variant…]`.
+ *
+ * A syntactic subset, not the full grammar (no extensions, no private use, no
+ * grandfathered tags). Covers `es` and `es-ES` from the plan and everything a
+ * real application sends; a tag outside the subset is a signal worth rejecting
+ * at ingress rather than carrying into reviewer language eligibility.
+ */
+exports.LanguageTagSchema = zod_1.z
+    .string()
+    .regex(/^[a-z]{2,3}(-[A-Z][a-z]{3})?(-([A-Z]{2}|[0-9]{3}))?(-([0-9][A-Za-z0-9]{3}|[A-Za-z0-9]{5,8}))*$/, 'must be a BCP 47 tag of the form language[-Script][-Region][-variant]');
+/**
+ * An absolute `http`/`https` URL.
+ *
+ * §7.2.7 rejects "dangerous schemes and executable resources". Scheme is a
+ * purely syntactic property, so the contract enforces it. Host reachability is
+ * NOT enforced here: deciding whether a host is internal needs DNS resolution
+ * and belongs to `safeFetch` at ingestion time. A scheme check that pretended
+ * to be an SSRF control would be the more dangerous of the two.
+ */
+exports.HttpUrlSchema = zod_1.z.url({ protocol: /^https?$/ }).max(2048);
+/** A `type/subtype` media type, without parameters. */
+exports.MimeTypeSchema = zod_1.z
+    .string()
+    .max(255)
+    .regex(/^[a-z0-9][a-z0-9!#$&^_.+-]*\/[a-z0-9][a-z0-9!#$&^_.+-]*$/, 'must be a lowercase "type/subtype" media type without parameters');
+const METADATA_KEY_PATTERN = /^[A-Za-z][A-Za-z0-9._-]*$/;
+/** A key in any caller-supplied open bag. */
+exports.ObjectKeySchema = zod_1.z
+    .string()
+    .min(1)
+    .max(exports.CONTRACT_LIMITS.METADATA_KEY_MAX_LENGTH)
+    .regex(METADATA_KEY_PATTERN, 'must start with a letter and contain only letters, digits, ".", "_" or "-"')
+    .refine((key) => !exports.FORBIDDEN_OBJECT_KEYS.includes(key), {
+    message: 'must not be a prototype-bearing key',
+});
+/** A single metadata value: scalar only, never a nested structure. */
+exports.MetadataValueSchema = zod_1.z.union([
+    zod_1.z.string().max(exports.CONTRACT_LIMITS.METADATA_STRING_VALUE_MAX_LENGTH),
+    zod_1.z.number().finite(),
+    zod_1.z.boolean(),
+    zod_1.z.null(),
+]);
+/**
+ * An open key/value bag (§5.1 `metadata`, §5.3 the `metadata` resource type).
+ *
+ * Open by definition — the plan calls it "typed key value fields" and every
+ * tenant's keys differ — but flat and bounded. Allowing nesting here would make
+ * this the one field in the envelope through which an application could ship an
+ * arbitrary document tree past every other constraint in the contract.
+ */
+exports.MetadataBagSchema = zod_1.z
+    .record(exports.ObjectKeySchema, exports.MetadataValueSchema)
+    .refine((bag) => Object.keys(bag).length <= exports.CONTRACT_LIMITS.METADATA_KEYS_MAX, {
+    message: `must not have more than ${exports.CONTRACT_LIMITS.METADATA_KEYS_MAX} keys`,
+});
+const customPayloadScalarSchema = zod_1.z.union([
+    zod_1.z.string().max(exports.CONTRACT_LIMITS.CUSTOM_PAYLOAD_STRING_MAX_LENGTH),
+    zod_1.z.number().finite(),
+    zod_1.z.boolean(),
+    zod_1.z.null(),
+]);
+const buildCustomPayloadValueSchema = () => {
+    let value = customPayloadScalarSchema;
+    for (let depth = 1; depth < exports.CONTRACT_LIMITS.CUSTOM_PAYLOAD_MAX_DEPTH; depth += 1) {
+        value = zod_1.z.union([
+            customPayloadScalarSchema,
+            zod_1.z.array(value).max(exports.CONTRACT_LIMITS.CUSTOM_PAYLOAD_ARRAY_MAX_LENGTH),
+            zod_1.z.record(exports.ObjectKeySchema, value),
+        ]);
+    }
+    return value;
+};
+/**
+ * The value grammar for a §5.7 custom payload.
+ *
+ * Nesting is unrolled to a fixed depth rather than made recursive so the bound
+ * is part of the type, enforced by the same parse as everything else, and
+ * visible in the exported JSON Schema. Depth is what stops a payload being a
+ * document; `ObjectKeySchema` is what stops it being a prototype.
+ *
+ * Note what is deliberately absent: no lexical filter on string values. A
+ * moderation payload legitimately carries the exact hostile text under review —
+ * markup, script fragments, `javascript:` URLs quoted inside a harassment
+ * report. Rejecting those strings would reject the material the system exists
+ * to review. §5.7's boundary is structural, not lexical: the contract has no
+ * field anywhere that carries markup, a template, a component or a remote URL
+ * to be rendered, so there is nothing for such a string to be interpreted as.
+ */
+exports.CustomPayloadValueSchema = buildCustomPayloadValueSchema();
+/** The top level of a §5.7 custom payload: always an object, never an array. */
+exports.CustomPayloadSchema = zod_1.z.record(exports.ObjectKeySchema, exports.CustomPayloadValueSchema);
+/** A number in the closed interval [0, 1] — §9.5 clamps confidence to it. */
+exports.UnitIntervalSchema = zod_1.z.number().min(0).max(1);
+//# sourceMappingURL=primitives.js.map

package/dist/primitives.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"primitives.js","sourceRoot":"","sources":["../src/primitives.ts"],"names":[],"mappings":";AAAA;;;;;;;;;;;;;;;;;;;;;GAqBG;;;AAEH,6BAAwB;AAExB;;;;;;;;GAQG;AACU,QAAA,eAAe,GAAG,MAAM,CAAC,MAAM,CAAC;IAC3C,mEAAmE;IACnE,qBAAqB,EAAE,GAAG;IAC1B,wEAAwE;IACxE,sBAAsB,EAAE,GAAG;IAE3B,0BAA0B,EAAE,EAAE;IAC9B,0BAA0B,EAAE,GAAG;IAC/B,4BAA4B,EAAE,EAAE;IAChC,mCAAmC,EAAE,EAAE;IAEvC,0EAA0E;IAC1E,wBAAwB,EAAE,MAAO;IACjC,kDAAkD;IAClD,qBAAqB,EAAE,GAAG;IAC1B,4DAA4D;IAC5D,oBAAoB,EAAE,IAAK;IAC3B,gEAAgE;IAChE,yBAAyB,EAAE,MAAO;IAElC,iBAAiB,EAAE,EAAE;IACrB,uBAAuB,EAAE,EAAE;IAC3B,gCAAgC,EAAE,IAAK;IAEvC,kEAAkE;IAClE,wBAAwB,EAAE,CAAC;IAC3B,+BAA+B,EAAE,GAAG;IACpC,gCAAgC,EAAE,KAAM;IAExC,yBAAyB,EAAE,EAAE;IAC7B,sBAAsB,EAAE,EAAE;IAC1B,kBAAkB,EAAE,EAAE;IAEtB,YAAY,EAAE,EAAE;IAChB,6BAA6B,EAAE,EAAE;IACjC,mBAAmB,EAAE,EAAE;IACvB,uBAAuB,EAAE,EAAE;IAE3B,+EAA+E;IAC/E,kBAAkB,EAAE,IAAK;IACzB,4EAA4E;IAC5E,aAAa,EAAE,EAAE;CACT,CAAC,CAAC;AAEZ;;;;;;;;;;;;;;;;;GAiBG;AACU,QAAA,qBAAqB,GAAsB,MAAM,CAAC,MAAM,CAAC;IACpE,WAAW;IACX,aAAa;IACb,WAAW;CACZ,CAAC,CAAC;AAEH,MAAM,kBAAkB,GAAG,8BAA8B,CAAC;AAE1D;;;;;;;GAOG;AACU,QAAA,gBAAgB,GAAG,OAAC;KAC9B,MAAM,EAAE;KACR,GAAG,CAAC,CAAC,CAAC;KACN,GAAG,CAAC,uBAAe,CAAC,qBAAqB,CAAC;KAC1C,KAAK,CACJ,kBAAkB,EAClB,qFAAqF,CACtF,CAAC;AAEJ,gFAAgF;AACnE,QAAA,gBAAgB,GAAG,OAAC;KAC9B,MAAM,EAAE;KACR,GAAG,CAAC,CAAC,CAAC;KACN,GAAG,CAAC,uBAAe,CAAC,sBAAsB,CAAC;KAC3C,KAAK,CACJ,kBAAkB,EAClB,qFAAqF,CACtF,CAAC;AAEJ;;;;;;;;;GASG;AACU,QAAA,kBAAkB,GAAG,OAAC;KAChC,MAAM,EAAE;KACR,KAAK,CAAC,uBAAuB,EAAE,2DAA2D,CAAC,CAAC;AAE/F;;;;;;;GAOG;AACU,QAAA,eAAe,GAAG,OAAC,CAAC,GAAG,CAAC,QAAQ,CAAC,EAAE,MAAM,EAAE,KAAK,EAAE,SAAS,EAAE,CAAC,EAAE,CAAC,CAAC;AAE/E;;;;;;;GAOG;AACU,QAAA,iBAAiB,GAAG,OAAC;KAC/B,MAAM,EAAE;KACR,KAAK,CACJ,gGAAgG,EAChG,uEAAuE,CACxE,CAAC;AAEJ;;;;;;;;GAQG;AACU,QAAA,aAAa,GAAG,OAAC,CAAC,GAAG,CAAC,EAAE,QAAQ,EAAE,UAAU,EAAE,CAAC,CAAC,GAAG,CAAC,IAAK,CAAC,CAAC;AAExE,uDAAuD;AAC1C,QAAA,cAAc,GAAG,OAAC;KAC5B,MAAM,EAAE;KACR,GAAG,CAAC,GAAG,CAAC;KACR,KAAK,CACJ,0DAA0D,EAC1D,kEAAkE,CACnE,CAAC;AAEJ,MAAM,oBAAoB,GAAG,2BAA2B,CAAC;AAEzD,6CAA6C;AAChC,QAAA,eAAe,GAAG,OAAC;KAC7B,MAAM,EAAE;KACR,GAAG,CAAC,CAAC,CAAC;KACN,GAAG,CAAC,uBAAe,CAAC,uBAAuB,CAAC;KAC5C,KAAK,CAAC,oBAAoB,EAAE,4EAA4E,CAAC;KACzG,MAAM,CAAC,CAAC,GAAG,EAAE,EAAE,CAAC,CAAC,6BAAqB,CAAC,QAAQ,CAAC,GAAG,CAAC,EAAE;IACrD,OAAO,EAAE,qCAAqC;CAC/C,CAAC,CAAC;AAEL,sEAAsE;AACzD,QAAA,mBAAmB,GAAG,OAAC,CAAC,KAAK,CAAC;IACzC,OAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,uBAAe,CAAC,gCAAgC,CAAC;IAChE,OAAC,CAAC,MAAM,EAAE,CAAC,MAAM,EAAE;IACnB,OAAC,CAAC,OAAO,EAAE;IACX,OAAC,CAAC,IAAI,EAAE;CACT,CAAC,CAAC;AAEH;;;;;;;GAOG;AACU,QAAA,iBAAiB,GAAG,OAAC;KAC/B,MAAM,CAAC,uBAAe,EAAE,2BAAmB,CAAC;KAC5C,MAAM,CAAC,CAAC,GAAG,EAAE,EAAE,CAAC,MAAM,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,MAAM,IAAI,uBAAe,CAAC,iBAAiB,EAAE;IAC7E,OAAO,EAAE,2BAA2B,uBAAe,CAAC,iBAAiB,OAAO;CAC7E,CAAC,CAAC;AAWL,MAAM,yBAAyB,GAAG,OAAC,CAAC,KAAK,CAAC;IACxC,OAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,uBAAe,CAAC,gCAAgC,CAAC;IAChE,OAAC,CAAC,MAAM,EAAE,CAAC,MAAM,EAAE;IACnB,OAAC,CAAC,OAAO,EAAE;IACX,OAAC,CAAC,IAAI,EAAE;CACT,CAAC,CAAC;AAEH,MAAM,6BAA6B,GAAG,GAAkC,EAAE;IACxE,IAAI,KAAK,GAAkC,yBAAyB,CAAC;IACrE,KAAK,IAAI,KAAK,GAAG,CAAC,EAAE,KAAK,GAAG,uBAAe,CAAC,wBAAwB,EAAE,KAAK,IAAI,CAAC,EAAE,CAAC;QACjF,KAAK,GAAG,OAAC,CAAC,KAAK,CAAC;YACd,yBAAyB;YACzB,OAAC,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC,GAAG,CAAC,uBAAe,CAAC,+BAA+B,CAAC;YACnE,OAAC,CAAC,MAAM,CAAC,uBAAe,EAAE,KAAK,CAAC;SACjC,CAAC,CAAC;IACL,CAAC;IACD,OAAO,KAAK,CAAC;AACf,CAAC,CAAC;AAEF;;;;;;;;;;;;;;;GAeG;AACU,QAAA,wBAAwB,GAAG,6BAA6B,EAAE,CAAC;AAExE,gFAAgF;AACnE,QAAA,mBAAmB,GAAG,OAAC,CAAC,MAAM,CAAC,uBAAe,EAAE,gCAAwB,CAAC,CAAC;AAEvF,6EAA6E;AAChE,QAAA,kBAAkB,GAAG,OAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC"}