@peac/mcp-server 0.16.0 → 0.16.2

This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
Files changed (13) hide show
  1. package/dist/cli.cjs +1 -1
  2. package/dist/cli.cjs.map +1 -1
  3. package/dist/cli.mjs +1 -1
  4. package/dist/cli.mjs.map +1 -1
  5. package/dist/index.cjs +1 -1
  6. package/dist/index.cjs.map +1 -1
  7. package/dist/index.mjs +1 -1
  8. package/dist/index.mjs.map +1 -1
  9. package/dist/infra/constants.d.ts +1 -1
  10. package/manifest.json +2 -2
  11. package/package.json +5 -5
  12. package/server.json +4 -4
  13. package/smithery.yaml +2 -2
package/dist/cli.cjs.map CHANGED
@@ -1 +1 @@
1
- {"version":3,"sources":["../src/infra/constants.ts","../src/session-manager.ts","../src/http-transport.ts","../src/cli.ts","../src/infra/errors.ts","../src/infra/policy.ts","../src/infra/key-loader.ts","../src/infra/jwks-loader.ts","../src/stdout-fence.ts","../src/server.ts","../src/handlers/guards.ts","../src/handlers/verify.ts","../src/handlers/inspect.ts","../src/handlers/decode.ts","../src/handlers/issue.ts","../src/infra/path-safety.ts","../src/handlers/bundle.ts","../src/schemas/verify.ts","../src/schemas/inspect.ts","../src/schemas/decode.ts","../src/schemas/issue.ts","../src/schemas/bundle.ts"],"names":["randomUUID","StreamableHTTPServerTransport","createServer","entry","resolve","z","sha256Hex","readFile","stat","validateKeypair","base64urlDecode","derivePublicKey","base64urlEncode","total","decode","verifyLocal","checks","parseReceiptClaims","issueWire02","IssueError","nodePath","lstat","rename","rm","mkdtemp","buildKeyPatterns","join","mkdir","writeFile","sign","MetaSchema","ERRORS","McpServer","Command","fsStat","realpath","createHttpTransport"],"mappings":";;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;AAAA,IAIa,WAAA,CAAA,CACA,gBACA,oBAAA;AANb,IAAA,cAAA,GAAA,KAAA,CAAA;AAAA,EAAA,wBAAA,GAAA;AAIO,IAAM,WAAA,GAAc,iBAAA;AACpB,IAAM,cAAA,GAAiB,QAAA;AACvB,IAAM,oBAAA,GAAuB,YAAA;AAcY,EAAA;AAAA,CAAA,CAAA;ACpBhD,IAqCa,cAAA;AArCb,IAAA,oBAAA,GAAA,KAAA,CAAA;AAAA,EAAA,wBAAA,GAAA;AAqCO,IAAM,iBAAN,MAAqB;AAAA,MAQ1B,WAAA,CAA6B,OAAA,GAAiC,EAAC,EAAG;AAArC,QAAA,IAAA,CAAA,OAAA,GAAA,OAAA;AAC3B,QAAA,IAAA,CAAK,KAAA,GAAQ,OAAA,CAAQ,KAAA,IAAS,EAAA,GAAK,EAAA,GAAK,GAAA;AACxC,QAAA,IAAA,CAAK,WAAA,GAAc,QAAQ,WAAA,IAAe,GAAA;AAC1C,QAAA,IAAA,CAAK,gBAAA,GAAmB,QAAQ,gBAAA,IAAoB,EAAA;AAAA,MACtD;AAAA,MAXiB,QAAA,uBAAe,GAAA,EAA0B;AAAA,MACzC,cAAA,uBAAqB,GAAA,EAAoB;AAAA,MACzC,KAAA;AAAA,MACA,WAAA;AAAA,MACA,gBAAA;AAAA,MACT,UAAA;AAAA;AAAA,MASR,UAAA,GAAmB;AACjB,QAAA,MAAM,UAAA,GAAa,IAAA,CAAK,OAAA,CAAQ,eAAA,IAAmB,GAAA;AACnD,QAAA,IAAA,CAAK,aAAa,WAAA,CAAY,MAAM,IAAA,CAAK,UAAA,IAAc,UAAU,CAAA;AACjE,QAAA,IAAA,CAAK,WAAW,KAAA,EAAM;AAAA,MACxB;AAAA;AAAA,MAGA,MAAM,aAAA,CAAc,aAAA,EAA8B,QAAA,GAAW,SAAA,EAAkC;AAE7F,QAAA,IAAA,CAAK,UAAA,EAAW;AAGhB,QAAA,IAAI,IAAA,CAAK,QAAA,CAAS,IAAA,IAAQ,IAAA,CAAK,WAAA,EAAa;AAC1C,UAAA,MAAM,IAAI,KAAA,CAAM,CAAA,uBAAA,EAA0B,IAAA,CAAK,WAAW,CAAA,mBAAA,CAAqB,CAAA;AAAA,QACjF;AAGA,QAAA,MAAM,OAAA,GAAU,IAAA,CAAK,cAAA,CAAe,GAAA,CAAI,QAAQ,CAAA,IAAK,CAAA;AACrD,QAAA,IAAI,OAAA,IAAW,KAAK,gBAAA,EAAkB;AACpC,UAAA,MAAM,IAAI,KAAA;AAAA,YACR,CAAA,8BAAA,EAAiC,IAAA,CAAK,gBAAgB,CAAA,KAAA,EAAQ,QAAQ,CAAA,mBAAA;AAAA,WACxE;AAAA,QACF;AAEA,QAAA,MAAM,YAAYA,mBAAAA,EAAW;AAC7B,QAAA,MAAM,SAAS,aAAA,EAAc;AAC7B,QAAA,MAAM,SAAA,GAAY,IAAIC,+CAAA,CAA8B;AAAA,UAClD,oBAAoB,MAAM;AAAA,SAC3B,CAAA;AAED,QAAA,MAAM,MAAA,CAAO,QAAQ,SAAS,CAAA;AAE9B,QAAA,MAAM,GAAA,GAAM,KAAK,GAAA,EAAI;AACrB,QAAA,MAAM,KAAA,GAAsB;AAAA,UAC1B,SAAA;AAAA,UACA,MAAA;AAAA,UACA,SAAA;AAAA,UACA,QAAA;AAAA,UACA,SAAA,EAAW,GAAA;AAAA,UACX,QAAA,EAAU;AAAA,SACZ;AAEA,QAAA,IAAA,CAAK,QAAA,CAAS,GAAA,CAAI,SAAA,EAAW,KAAK,CAAA;AAClC,QAAA,IAAA,CAAK,cAAA,CAAe,GAAA,CAAI,QAAA,EAAU,OAAA,GAAU,CAAC,CAAA;AAC7C,QAAA,OAAO,KAAA;AAAA,MACT;AAAA;AAAA,MAGA,WAAW,SAAA,EAA6C;AACtD,QAAA,MAAM,KAAA,GAAQ,IAAA,CAAK,QAAA,CAAS,GAAA,CAAI,SAAS,CAAA;AACzC,QAAA,IAAI,KAAA,EAAO;AACT,UAAA,KAAA,CAAM,QAAA,GAAW,KAAK,GAAA,EAAI;AAAA,QAC5B;AACA,QAAA,OAAO,KAAA;AAAA,MACT;AAAA;AAAA,MAGA,MAAM,iBAAiB,SAAA,EAAqC;AAC1D,QAAA,MAAM,KAAA,GAAQ,IAAA,CAAK,QAAA,CAAS,GAAA,CAAI,SAAS,CAAA;AACzC,QAAA,IAAI,CAAC,OAAO,OAAO,KAAA;AAEnB,QAAA,IAAA,CAAK,QAAA,CAAS,OAAO,SAAS,CAAA;AAC9B,QAAA,IAAA,CAAK,gBAAA,CAAiB,MAAM,QAAQ,CAAA;AACpC,QAAA,IAAI;AACF,UAAA,MAAM,KAAA,CAAM,UAAU,KAAA,EAAM;AAC5B,UAAA,MAAM,KAAA,CAAM,OAAO,KAAA,EAAM;AAAA,QAC3B,CAAA,CAAA,MAAQ;AAAA,QAER;AACA,QAAA,OAAO,IAAA;AAAA,MACT;AAAA;AAAA,MAGA,MAAM,OAAA,GAAyB;AAC7B,QAAA,IAAI,KAAK,UAAA,EAAY;AACnB,UAAA,aAAA,CAAc,KAAK,UAAU,CAAA;AAC7B,UAAA,IAAA,CAAK,UAAA,GAAa,MAAA;AAAA,QACpB;AAEA,QAAA,MAAM,UAAU,CAAC,GAAG,IAAA,CAAK,QAAA,CAAS,QAAQ,CAAA;AAC1C,QAAA,IAAA,CAAK,SAAS,KAAA,EAAM;AACpB,QAAA,IAAA,CAAK,eAAe,KAAA,EAAM;AAE1B,QAAA,MAAM,OAAA,CAAQ,UAAA;AAAA,UACZ,OAAA,CAAQ,GAAA,CAAI,OAAO,KAAA,KAAU;AAC3B,YAAA,IAAI;AACF,cAAA,MAAM,KAAA,CAAM,UAAU,KAAA,EAAM;AAC5B,cAAA,MAAM,KAAA,CAAM,OAAO,KAAA,EAAM;AAAA,YAC3B,CAAA,CAAA,MAAQ;AAAA,YAER;AAAA,UACF,CAAC;AAAA,SACH;AAAA,MACF;AAAA;AAAA,MAGA,IAAI,IAAA,GAAe;AACjB,QAAA,OAAO,KAAK,QAAA,CAAS,IAAA;AAAA,MACvB;AAAA;AAAA,MAGQ,UAAA,GAAmB;AACzB,QAAA,MAAM,GAAA,GAAM,KAAK,GAAA,EAAI;AACrB,QAAA,KAAA,MAAW,CAAC,EAAA,EAAI,KAAK,CAAA,IAAK,KAAK,QAAA,EAAU;AACvC,UAAA,IAAI,GAAA,GAAM,KAAA,CAAM,QAAA,GAAW,IAAA,CAAK,KAAA,EAAO;AACrC,YAAA,IAAA,CAAK,QAAA,CAAS,OAAO,EAAE,CAAA;AACvB,YAAA,IAAA,CAAK,gBAAA,CAAiB,MAAM,QAAQ,CAAA;AAEpC,YAAA,KAAK,KAAA,CAAM,SAAA,CAAU,KAAA,EAAM,CAAE,MAAM,MAAM;AAAA,YAAC,CAAC,CAAA;AAC3C,YAAA,KAAK,KAAA,CAAM,MAAA,CAAO,KAAA,EAAM,CAAE,MAAM,MAAM;AAAA,YAAC,CAAC,CAAA;AAAA,UAC1C;AAAA,QACF;AAAA,MACF;AAAA;AAAA,MAGQ,iBAAiB,EAAA,EAAkB;AACzC,QAAA,MAAM,KAAA,GAAQ,IAAA,CAAK,cAAA,CAAe,GAAA,CAAI,EAAE,CAAA,IAAK,CAAA;AAC7C,QAAA,IAAI,SAAS,CAAA,EAAG;AACd,UAAA,IAAA,CAAK,cAAA,CAAe,OAAO,EAAE,CAAA;AAAA,QAC/B,CAAA,MAAO;AACL,UAAA,IAAA,CAAK,cAAA,CAAe,GAAA,CAAI,EAAA,EAAI,KAAA,GAAQ,CAAC,CAAA;AAAA,QACvC;AAAA,MACF;AAAA,KACF;AAAA,EAAA;AAAA,CAAA,CAAA;;;AC/KA,IAAA,sBAAA,GAAA,EAAA;AAAA,QAAA,CAAA,sBAAA,EAAA;AAAA,EAAA,mBAAA,EAAA,MAAA;AAAA,CAAA,CAAA;AA8EA,SAAS,iBAAiB,EAAA,EAAqB;AAC7C,EAAA,IAAI,GAAG,MAAA,KAAW,CAAA,IAAK,EAAA,CAAG,MAAA,GAAS,uBAAuB,OAAO,KAAA;AACjE,EAAA,KAAA,IAAS,CAAA,GAAI,CAAA,EAAG,CAAA,GAAI,EAAA,CAAG,QAAQ,CAAA,EAAA,EAAK;AAClC,IAAA,MAAM,IAAA,GAAO,EAAA,CAAG,UAAA,CAAW,CAAC,CAAA;AAC5B,IAAA,IAAI,IAAA,GAAO,EAAA,IAAQ,IAAA,GAAO,GAAA,EAAM,OAAO,KAAA;AAAA,EACzC;AACA,EAAA,OAAO,IAAA;AACT;AAMA,SAAS,eAAe,IAAA,EAAuB;AAC7C,EAAA,OAAO,KAAK,UAAA,CAAW,MAAM,CAAA,IAAK,IAAA,KAAS,SAAS,IAAA,KAAS,kBAAA;AAC/D;AACA,SAAS,gBAAgB,IAAA,EAAuB;AAC9C,EAAA,IAAI,cAAA,CAAe,IAAI,CAAA,EAAG,OAAO,IAAA;AACjC,EAAA,OAAO,KAAK,UAAA,CAAW,UAAU,CAAA,IAAK,IAAA,CAAK,WAAW,MAAM,CAAA;AAC9D;AACA,SAAS,cAAc,IAAA,EAAuB;AAC5C,EAAA,IAAI,eAAA,CAAgB,IAAI,CAAA,EAAG,OAAO,IAAA;AAClC,EAAA,OACE,IAAA,CAAK,UAAA,CAAW,KAAK,CAAA,IACrB,IAAA,CAAK,UAAA,CAAW,UAAU,CAAA,IAC1B,4BAAA,CAA6B,IAAA,CAAK,IAAI,CAAA,IACtC,KAAK,UAAA,CAAW,IAAI,CAAA,IACpB,IAAA,CAAK,UAAA,CAAW,IAAI,CAAA,IACpB,IAAA,CAAK,UAAA,CAAW,YAAY,CAAA,IAC5B,IAAA,CAAK,UAAA,CAAW,iBAAiB,CAAA,IACjC,mCAAA,CAAoC,KAAK,IAAI,CAAA;AAEjD;AAKA,SAAS,cAAA,CAAe,YAAoB,UAAA,EAAsC;AAChF,EAAA,IAAI,UAAA,KAAe,OAAO,OAAO,KAAA;AACjC,EAAA,IAAI,UAAA,KAAe,OAAO,OAAO,IAAA;AACjC,EAAA,IAAI,UAAA,KAAe,UAAA,EAAY,OAAO,cAAA,CAAe,UAAU,CAAA;AAC/D,EAAA,IAAI,UAAA,KAAe,WAAA,EAAa,OAAO,eAAA,CAAgB,UAAU,CAAA;AACjE,EAAA,IAAI,UAAA,KAAe,SAAA,EAAW,OAAO,aAAA,CAAc,UAAU,CAAA;AAE7D,EAAA,MAAM,OAAA,GAAU,UAAA,CAAW,KAAA,CAAM,GAAG,CAAA,CAAE,IAAI,CAAC,CAAA,KAAM,CAAA,CAAE,IAAA,EAAM,CAAA;AACzD,EAAA,OAAO,OAAA,CAAQ,SAAS,UAAU,CAAA;AACpC;AAQA,SAAS,kBAAkB,MAAA,EAAsE;AAC/F,EAAA,IAAI,CAAA;AACJ,EAAA,IAAI;AACF,IAAA,CAAA,GAAI,IAAI,IAAI,MAAM,CAAA;AAAA,EACpB,CAAA,CAAA,MAAQ;AACN,IAAA,OAAO,EAAE,KAAA,EAAO,CAAA,aAAA,EAAgB,MAAM,CAAA,CAAA,EAAG;AAAA,EAC3C;AACA,EAAA,IAAI,EAAE,IAAA,EAAM;AACV,IAAA,OAAO,EAAE,OAAO,2CAAA,EAA4C;AAAA,EAC9D;AACA,EAAA,MAAM,UAAA,GACJ,EAAE,QAAA,KAAa,WAAA,IAAe,EAAE,QAAA,KAAa,WAAA,IAAe,EAAE,QAAA,KAAa,KAAA;AAC7E,EAAA,IAAI,CAAA,CAAE,QAAA,KAAa,QAAA,IAAY,CAAC,UAAA,EAAY;AAC1C,IAAA,OAAO,EAAE,OAAO,qEAAA,EAAsE;AAAA,EACxF;AAEA,EAAA,MAAM,aAAa,CAAA,CAAE,IAAA,CAAK,QAAQ,MAAA,EAAQ,EAAE,KAAK,CAAA,CAAE,MAAA;AACnD,EAAA,OAAO,EAAE,GAAA,EAAK,CAAA,EAAG,UAAA,EAAW;AAC9B;AAMA,eAAsB,oBACpB,OAAA,EAC2C;AAC3C,EAAA,MAAM,IAAA,GAAO,QAAQ,IAAA,IAAQ,GAAA;AAC7B,EAAA,MAAM,IAAA,GAAO,QAAQ,IAAA,IAAQ,WAAA;AAC7B,EAAA,MAAM,cAAc,IAAI,GAAA,CAAI,OAAA,CAAQ,WAAA,IAAe,EAAE,CAAA;AACrD,EAAA,MAAM,eAAA,GAAkB,QAAQ,eAAA,IAAmB,yBAAA;AACnD,EAAA,MAAM,YAAA,GAAe,QAAQ,YAAA,IAAgB,sBAAA;AAE7C,EAAA,MAAM,cAAA,GAAiB,IAAI,cAAA,CAAe;AAAA,IACxC,OAAO,OAAA,CAAQ,YAAA;AAAA,IACf,aAAa,OAAA,CAAQ,WAAA;AAAA,IACrB,kBAAkB,OAAA,CAAQ;AAAA,GAC3B,CAAA;AACD,EAAA,cAAA,CAAe,UAAA,EAAW;AAI1B,EAAA,MAAM,UAAA,uBAAiB,GAAA,EAA4B;AAEnD,EAAA,SAAS,eAAe,GAAA,EAAsB;AAC5C,IAAA,MAAM,GAAA,GAAM,KAAK,GAAA,EAAI;AACrB,IAAA,IAAI,KAAA,GAAQ,UAAA,CAAW,GAAA,CAAI,GAAG,CAAA;AAC9B,IAAA,IAAI,CAAC,KAAA,IAAS,GAAA,GAAM,KAAA,CAAM,cAAc,aAAA,EAAe;AACrD,MAAA,KAAA,GAAQ,EAAE,KAAA,EAAO,CAAA,EAAG,WAAA,EAAa,GAAA,EAAI;AACrC,MAAA,UAAA,CAAW,GAAA,CAAI,KAAK,KAAK,CAAA;AAAA,IAC3B;AACA,IAAA,KAAA,CAAM,KAAA,EAAA;AACN,IAAA,OAAO,MAAM,KAAA,IAAS,YAAA;AAAA,EACxB;AAEA,EAAA,MAAM,eAAA,GAAmC,QAAQ,UAAA,IAAc,KAAA;AAgB/D,EAAA,SAAS,YAAY,GAAA,EAA8B;AACjD,IAAA,MAAM,MAAA,GAAS,GAAA,CAAI,MAAA,CAAO,aAAA,IAAiB,SAAA;AAC3C,IAAA,IAAI,eAAA,KAAoB,KAAA,IAAS,cAAA,CAAe,MAAA,EAAQ,eAAe,CAAA,EAAG;AACxE,MAAA,MAAM,GAAA,GAAM,GAAA,CAAI,OAAA,CAAQ,iBAAiB,CAAA;AACzC,MAAA,IAAI,OAAO,QAAQ,QAAA,EAAU;AAC3B,QAAA,MAAM,QAAQ,GAAA,CAAI,KAAA,CAAM,GAAG,CAAA,CAAE,CAAC,GAAG,IAAA,EAAK;AACtC,QAAA,IAAI,OAAO,OAAO,KAAA;AAAA,MACpB;AAAA,IACF;AACA,IAAA,OAAO,MAAA;AAAA,EACT;AAGA,EAAA,MAAM,YAAA,uBAAmB,GAAA,EAAY;AACrC,EAAA,YAAA,CAAa,GAAA,CAAI,CAAA,EAAG,IAAI,CAAA,CAAA,EAAI,IAAI,CAAA,CAAE,CAAA;AAClC,EAAA,YAAA,CAAa,GAAA,CAAI,IAAA,KAAS,SAAA,GAAY,CAAA,UAAA,EAAa,IAAI,KAAK,CAAA,EAAG,IAAI,CAAA,CAAA,EAAI,IAAI,CAAA,CAAE,CAAA;AAC7E,EAAA,IAAI,IAAA,KAAS,WAAA,IAAe,IAAA,KAAS,SAAA,EAAW;AAC9C,IAAA,YAAA,CAAa,GAAA,CAAI,CAAA,UAAA,EAAa,IAAI,CAAA,CAAE,CAAA;AACpC,IAAA,YAAA,CAAa,GAAA,CAAI,CAAA,UAAA,EAAa,IAAI,CAAA,CAAE,CAAA;AAAA,EACtC;AACA,EAAA,IAAI,QAAQ,SAAA,EAAW;AACrB,IAAA,IAAI;AACF,MAAA,MAAM,CAAA,GAAI,IAAI,GAAA,CAAI,OAAA,CAAQ,SAAS,CAAA;AACnC,MAAA,YAAA,CAAa,GAAA,CAAI,EAAE,IAAI,CAAA;AAAA,IACzB,CAAA,CAAA,MAAQ;AAAA,IAER;AAAA,EACF;AAGA,EAAA,MAAM,cAAA,GAAiB,IAAI,GAAA,CAAY,WAAW,CAAA;AAElD,EAAA,SAAS,cAAA,CAAe,KAAsB,GAAA,EAA8B;AAC1E,IAAA,MAAM,MAAA,GAAS,IAAI,OAAA,CAAQ,MAAA;AAC3B,IAAA,IAAI,CAAC,QAAQ,OAAO,IAAA;AACpB,IAAA,IAAI,cAAA,CAAe,SAAS,CAAA,EAAG;AAE7B,MAAA,GAAA,CAAI,SAAA,CAAU,GAAA,EAAK,EAAE,cAAA,EAAgB,oBAAoB,CAAA;AACzD,MAAA,GAAA,CAAI,IAAI,IAAA,CAAK,SAAA,CAAU,EAAE,KAAA,EAAO,oBAAA,EAAsB,CAAC,CAAA;AACvD,MAAA,OAAO,KAAA;AAAA,IACT;AACA,IAAA,IAAI,CAAC,cAAA,CAAe,GAAA,CAAI,MAAM,CAAA,EAAG;AAC/B,MAAA,GAAA,CAAI,SAAA,CAAU,GAAA,EAAK,EAAE,cAAA,EAAgB,oBAAoB,CAAA;AACzD,MAAA,GAAA,CAAI,IAAI,IAAA,CAAK,SAAA,CAAU,EAAE,KAAA,EAAO,oBAAA,EAAsB,CAAC,CAAA;AACvD,MAAA,OAAO,KAAA;AAAA,IACT;AACA,IAAA,OAAO,IAAA;AAAA,EACT;AAEA,EAAA,SAAS,cAAA,CAAe,KAAsB,GAAA,EAA2B;AACvE,IAAA,MAAM,MAAA,GAAS,IAAI,OAAA,CAAQ,MAAA;AAC3B,IAAA,IAAI,MAAA,IAAU,cAAA,CAAe,GAAA,CAAI,MAAM,CAAA,EAAG;AACxC,MAAA,GAAA,CAAI,SAAA,CAAU,+BAA+B,MAAM,CAAA;AACnD,MAAA,GAAA,CAAI,SAAA,CAAU,gCAAgC,4BAA4B,CAAA;AAC1E,MAAA,GAAA,CAAI,SAAA;AAAA,QACF,8BAAA;AAAA,QACA;AAAA,OACF;AACA,MAAA,GAAA,CAAI,SAAA,CAAU,iCAAiC,gBAAgB,CAAA;AAAA,IACjE;AAAA,EACF;AAEA,EAAA,SAAS,QAAA,CAAS,GAAA,EAAqB,MAAA,EAAgB,IAAA,EAAqB;AAC1E,IAAA,MAAM,IAAA,GAAO,IAAA,CAAK,SAAA,CAAU,IAAI,CAAA;AAChC,IAAA,GAAA,CAAI,SAAA,CAAU,MAAA,EAAQ,EAAE,cAAA,EAAgB,oBAAoB,CAAA;AAC5D,IAAA,GAAA,CAAI,IAAI,IAAI,CAAA;AAAA,EACd;AAEA,EAAA,eAAe,SAAS,GAAA,EAAuC;AAC7D,IAAA,MAAM,SAAmB,EAAC;AAC1B,IAAA,IAAI,UAAA,GAAa,CAAA;AACjB,IAAA,WAAA,MAAiB,SAAS,GAAA,EAAK;AAC7B,MAAA,UAAA,IAAe,KAAA,CAAiB,MAAA;AAChC,MAAA,IAAI,aAAa,eAAA,EAAiB;AAChC,QAAA,MAAM,IAAI,KAAA,CAAM,CAAA,qBAAA,EAAwB,eAAe,CAAA,MAAA,CAAQ,CAAA;AAAA,MACjE;AACA,MAAA,MAAA,CAAO,KAAK,KAAe,CAAA;AAAA,IAC7B;AACA,IAAA,OAAO,MAAA,CAAO,OAAO,MAAM,CAAA;AAAA,EAC7B;AAIA,EAAA,MAAM,WAAA,GAAA,CAAe,OAAA,CAAQ,oBAAA,IAAwB,EAAC,EAAG,MAAA,CAAO,CAAC,CAAA,KAAM,CAAA,CAAE,IAAA,EAAK,CAAE,MAAA,GAAS,CAAC,CAAA;AAC1F,EAAA,IAAI,OAAA,CAAQ,oBAAA,EAAsB,MAAA,IAAU,WAAA,CAAY,WAAW,CAAA,EAAG;AACpE,IAAA,OAAA,CAAQ,MAAA,CAAO,KAAA;AAAA,MACb,IAAI,WAAW,CAAA;AAAA;AAAA,KACjB;AAAA,EACF;AACA,EAAA,IAAI,WAAA,CAAY,MAAA,GAAS,CAAA,IAAK,CAAC,QAAQ,SAAA,EAAW;AAChD,IAAA,OAAA,CAAQ,MAAA,CAAO,KAAA;AAAA,MACb,IAAI,WAAW,CAAA;AAAA;AAAA,KACjB;AAAA,EACF;AACA,EAAA,IAAI,OAAA,CAAQ,SAAA,IAAa,WAAA,CAAY,MAAA,KAAW,CAAA,EAAG;AACjD,IAAA,OAAA,CAAQ,MAAA,CAAO,KAAA;AAAA,MACb,IAAI,WAAW,CAAA;AAAA;AAAA,KACjB;AAAA,EACF;AACA,EAAA,MAAM,aAAa,CAAC,EAAE,WAAA,CAAY,MAAA,GAAS,KAAK,OAAA,CAAQ,SAAA,CAAA;AACxD,EAAA,IAAI,OAAA,GAAU,uCAAA;AACd,EAAA,IAAI,WAAA;AACJ,EAAA,IAAI,UAAA,IAAc,QAAQ,SAAA,EAAW;AACnC,IAAA,MAAM,UAAA,GAAa,iBAAA,CAAkB,OAAA,CAAQ,SAAS,CAAA;AACtD,IAAA,IAAI,WAAW,UAAA,EAAY;AACzB,MAAA,OAAA,CAAQ,MAAA,CAAO,KAAA;AAAA,QACb,CAAA,CAAA,EAAI,WAAW,CAAA,+CAAA,EAAkD,UAAA,CAAW,KAAK;AAAA;AAAA,OACnF;AAAA,IACF,CAAA,MAAO;AACL,MAAA,MAAM,EAAE,GAAA,EAAK,CAAA,EAAG,UAAA,EAAW,GAAI,UAAA;AAE/B,MAAA,MAAM,YAAA,GAAe,CAAA,CAAE,QAAA,CAAS,OAAA,CAAQ,QAAQ,EAAE,CAAA;AAClD,MAAA,IAAI,YAAA,IAAgB,iBAAiB,GAAA,EAAK;AACxC,QAAA,OAAA,GAAU,wCAAwC,YAAY,CAAA,CAAA;AAAA,MAChE;AACA,MAAA,WAAA,GAAc;AAAA,QACZ,QAAA,EAAU,UAAA;AAAA,QACV,qBAAA,EAAuB;AAAA,OACzB;AAAA,IACF;AAAA,EACF;AAEA,EAAA,MAAM,MAAA,GAASC,iBAAA,CAAa,OAAO,GAAA,EAAsB,GAAA,KAAwB;AAC/E,IAAA,MAAM,GAAA,GAAM,IAAI,GAAA,CAAI,GAAA,CAAI,GAAA,IAAO,GAAA,EAAK,CAAA,OAAA,EAAU,GAAA,CAAI,OAAA,CAAQ,IAAA,IAAQ,WAAW,CAAA,CAAE,CAAA;AAC/E,IAAA,MAAM,WAAW,GAAA,CAAI,QAAA;AAIrB,IAAA,GAAA,CAAI,WAAW,GAAM,CAAA;AAGrB,IAAA,IAAI,GAAA,CAAI,WAAW,SAAA,EAAW;AAC5B,MAAA,cAAA,CAAe,KAAK,GAAG,CAAA;AACvB,MAAA,GAAA,CAAI,UAAU,GAAG,CAAA;AACjB,MAAA,GAAA,CAAI,GAAA,EAAI;AACR,MAAA;AAAA,IACF;AAEA,IAAA,cAAA,CAAe,KAAK,GAAG,CAAA;AAGvB,IAAA,MAAM,UAAA,GAAa,IAAI,OAAA,CAAQ,IAAA;AAC/B,IAAA,IAAI,UAAA,IAAc,CAAC,YAAA,CAAa,GAAA,CAAI,UAAU,CAAA,EAAG;AAC/C,MAAA,QAAA,CAAS,GAAA,EAAK,GAAA,EAAK,EAAE,KAAA,EAAO,uBAAuB,CAAA;AACnD,MAAA;AAAA,IACF;AAGA,IAAA,IAAI,CAAC,cAAA,CAAe,GAAA,EAAK,GAAG,CAAA,EAAG;AAG/B,IAAA,IAAI,QAAA,KAAa,SAAA,IAAa,GAAA,CAAI,MAAA,KAAW,KAAA,EAAO;AAClD,MAAA,QAAA,CAAS,KAAK,GAAA,EAAK;AAAA,QACjB,EAAA,EAAI,IAAA;AAAA,QACJ,OAAA,EAAS,cAAA;AAAA,QACT,eAAA,EAAiB;AAAA,OAClB,CAAA;AACD,MAAA;AAAA,IACF;AAGA,IAAA,IAAI,QAAA,KAAa,OAAA,IAAW,GAAA,CAAI,MAAA,KAAW,KAAA,EAAO;AAChD,MAAA,IAAI,cAAc,WAAA,EAAa;AAC7B,QAAA,QAAA,CAAS,GAAA,EAAK,KAAK,WAAW,CAAA;AAAA,MAChC,CAAA,MAAO;AACL,QAAA,QAAA,CAAS,GAAA,EAAK,GAAA,EAAK,EAAE,KAAA,EAAO,aAAa,CAAA;AAAA,MAC3C;AACA,MAAA;AAAA,IACF;AAGA,IAAA,IAAI,aAAa,MAAA,EAAQ;AAEvB,MAAA,IAAI,GAAA,CAAI,WAAW,KAAA,EAAO;AACxB,QAAA,GAAA,CAAI,UAAU,GAAA,EAAK,EAAE,OAAO,cAAA,EAAgB,cAAA,EAAgB,oBAAoB,CAAA;AAChF,QAAA,GAAA,CAAI,IAAI,IAAA,CAAK,SAAA,CAAU,EAAE,KAAA,EAAO,qDAAA,EAAuD,CAAC,CAAA;AACxF,QAAA;AAAA,MACF;AAGA,MAAA,IAAI,GAAA,CAAI,WAAW,QAAA,EAAU;AAC3B,QAAA,MAAM,SAAA,GAAY,GAAA,CAAI,OAAA,CAAQ,gBAAgB,CAAA;AAC9C,QAAA,IAAI,CAAC,SAAA,EAAW;AACd,UAAA,QAAA,CAAS,GAAA,EAAK,GAAA,EAAK,EAAE,KAAA,EAAO,iCAAiC,CAAA;AAC7D,UAAA;AAAA,QACF;AACA,QAAA,IAAI,CAAC,gBAAA,CAAiB,SAAS,CAAA,EAAG;AAChC,UAAA,QAAA,CAAS,KAAK,GAAA,EAAK;AAAA,YACjB,KAAA,EAAO;AAAA,WACR,CAAA;AACD,UAAA;AAAA,QACF;AACA,QAAA,MAAM,UAAA,GAAa,MAAM,cAAA,CAAe,gBAAA,CAAiB,SAAS,CAAA;AAClE,QAAA,IAAI,UAAA,EAAY;AACd,UAAA,QAAA,CAAS,GAAA,EAAK,GAAA,EAAK,EAAE,EAAA,EAAI,MAAM,CAAA;AAAA,QACjC,CAAA,MAAO;AACL,UAAA,QAAA,CAAS,GAAA,EAAK,GAAA,EAAK,EAAE,KAAA,EAAO,2CAA2C,CAAA;AAAA,QACzE;AACA,QAAA;AAAA,MACF;AAGA,MAAA,IAAI,GAAA,CAAI,WAAW,MAAA,EAAQ;AAEzB,QAAA,MAAM,SAAA,GAAY,GAAA,CAAI,OAAA,CAAQ,gBAAgB,CAAA;AAC9C,QAAA,MAAM,YAAA,GAAe,SAAA,IAAa,CAAA,GAAA,EAAM,WAAA,CAAY,GAAG,CAAC,CAAA,CAAA;AACxD,QAAA,IAAI,CAAC,cAAA,CAAe,YAAY,CAAA,EAAG;AACjC,UAAA,GAAA,CAAI,UAAU,GAAA,EAAK,EAAE,gBAAgB,kBAAA,EAAoB,aAAA,EAAe,MAAM,CAAA;AAC9E,UAAA,GAAA,CAAI,IAAI,IAAA,CAAK,SAAA,CAAU,EAAE,KAAA,EAAO,qBAAA,EAAuB,CAAC,CAAA;AACxD,UAAA;AAAA,QACF;AAGA,QAAA,IAAI,IAAA;AACJ,QAAA,IAAI;AACF,UAAA,MAAM,GAAA,GAAM,MAAM,QAAA,CAAS,GAAG,CAAA;AAC9B,UAAA,IAAA,GAAO,IAAA,CAAK,KAAA,CAAM,GAAA,CAAI,QAAA,CAAS,OAAO,CAAC,CAAA;AAAA,QACzC,SAAS,GAAA,EAAK;AACZ,UAAA,MAAM,GAAA,GAAM,GAAA,YAAe,KAAA,GAAQ,GAAA,CAAI,OAAA,GAAU,sBAAA;AACjD,UAAA,QAAA,CAAS,GAAA,EAAK,GAAA,EAAK,EAAE,KAAA,EAAO,KAAK,CAAA;AACjC,UAAA;AAAA,QACF;AAGA,QAAA,MAAM,MAAA,GACJ,OAAO,IAAA,KAAS,QAAA,IAChB,SAAS,IAAA,IACT,QAAA,IAAY,IAAA,IACX,IAAA,CAA4B,MAAA,KAAW,YAAA;AAE1C,QAAA,IAAI,MAAA,EAAQ;AAEV,UAAA,MAAM,eAAA,GAAkB,GAAA,CAAI,OAAA,CAAQ,sBAAsB,CAAA;AAC1D,UAAA,IACE,eAAA,IACA,eAAA,KAAoB,oBAAA,IACpB,eAAA,KAAoB,YAAA,EACpB;AACA,YAAA,QAAA,CAAS,KAAK,GAAA,EAAK,EAAE,OAAO,CAAA,kCAAA,EAAqC,eAAe,IAAI,CAAA;AACpF,YAAA;AAAA,UACF;AAGA,UAAA,MAAM,MAAA,GAAS,IAAI,OAAA,CAAQ,MAAA;AAC3B,UAAA,IAAI,CAAC,MAAA,EAAQ;AACX,YAAA,OAAA,CAAQ,MAAA,CAAO,KAAA;AAAA,cACb,IAAI,WAAW,CAAA;AAAA;AAAA,aACjB;AAAA,UACF;AAGA,UAAA,IAAIC,MAAAA;AACJ,UAAA,IAAI;AACF,YAAAA,MAAAA,GAAQ,MAAM,cAAA,CAAe,aAAA,CAAc,QAAQ,aAAA,EAAe,WAAA,CAAY,GAAG,CAAC,CAAA;AAAA,UACpF,SAAS,GAAA,EAAK;AACZ,YAAA,MAAM,GAAA,GAAM,GAAA,YAAe,KAAA,GAAQ,GAAA,CAAI,OAAA,GAAU,0BAAA;AACjD,YAAA,QAAA,CAAS,GAAA,EAAK,GAAA,EAAK,EAAE,KAAA,EAAO,KAAK,CAAA;AACjC,YAAA;AAAA,UACF;AAGA,UAAA,MAAMA,MAAAA,CAAM,SAAA,CAAU,aAAA,CAAc,GAAA,EAAK,KAAK,IAAI,CAAA;AAClD,UAAA;AAAA,QACF;AAGA,QAAA,IAAI,CAAC,SAAA,EAAW;AACd,UAAA,QAAA,CAAS,GAAA,EAAK,GAAA,EAAK,EAAE,KAAA,EAAO,iCAAiC,CAAA;AAC7D,UAAA;AAAA,QACF;AACA,QAAA,IAAI,CAAC,gBAAA,CAAiB,SAAS,CAAA,EAAG;AAChC,UAAA,QAAA,CAAS,KAAK,GAAA,EAAK;AAAA,YACjB,KAAA,EAAO;AAAA,WACR,CAAA;AACD,UAAA;AAAA,QACF;AAEA,QAAA,MAAM,KAAA,GAAQ,cAAA,CAAe,UAAA,CAAW,SAAS,CAAA;AACjD,QAAA,IAAI,CAAC,KAAA,EAAO;AACV,UAAA,QAAA,CAAS,GAAA,EAAK,GAAA,EAAK,EAAE,KAAA,EAAO,mCAAmC,CAAA;AAC/D,UAAA;AAAA,QACF;AAGA,QAAA,MAAM,KAAA,CAAM,SAAA,CAAU,aAAA,CAAc,GAAA,EAAK,KAAK,IAAI,CAAA;AAClD,QAAA;AAAA,MACF;AAGA,MAAA,GAAA,CAAI,UAAU,GAAA,EAAK,EAAE,OAAO,cAAA,EAAgB,cAAA,EAAgB,oBAAoB,CAAA;AAChF,MAAA,GAAA,CAAI,IAAI,IAAA,CAAK,SAAA,CAAU,EAAE,KAAA,EAAO,oBAAA,EAAsB,CAAC,CAAA;AACvD,MAAA;AAAA,IACF;AAGA,IAAA,QAAA,CAAS,GAAA,EAAK,GAAA,EAAK,EAAE,KAAA,EAAO,aAAa,CAAA;AAAA,EAC3C,CAAC,CAAA;AAGD,EAAA,MAAA,CAAO,cAAA,GAAiB,GAAA;AACxB,EAAA,MAAA,CAAO,cAAA,GAAiB,GAAA;AACxB,EAAA,MAAA,CAAO,gBAAA,GAAmB,GAAA;AAE1B,EAAA,OAAO,IAAI,OAAA,CAAQ,CAACC,QAAAA,EAAS,MAAA,KAAW;AACtC,IAAA,MAAA,CAAO,EAAA,CAAG,SAAS,MAAM,CAAA;AACzB,IAAA,MAAA,CAAO,MAAA,CAAO,IAAA,EAAM,IAAA,EAAM,MAAM;AAC9B,MAAA,OAAA,CAAQ,OAAO,KAAA,CAAM,CAAA,CAAA,EAAI,WAAW,CAAA,qCAAA,EAAwC,IAAI,IAAI,IAAI;AAAA,CAAI,CAAA;AAC5F,MAAA,OAAA,CAAQ,MAAA,CAAO,KAAA,CAAM,CAAA,kCAAA,EAAqC,oBAAoB,CAAA;AAAA,CAAK,CAAA;AACnF,MAAA,OAAA,CAAQ,MAAA,CAAO,KAAA;AAAA,QACb,CAAA;AAAA;AAAA,OACF;AACA,MAAA,OAAA,CAAQ,OAAO,KAAA,CAAM,CAAA;AAAA,CAAoD,CAAA;AACzE,MAAA,IAAI,UAAA,EAAY;AACd,QAAA,OAAA,CAAQ,MAAA,CAAO,KAAA,CAAM,CAAA,WAAA,EAAc,OAAO,CAAA;AAAA,CAAqC,CAAA;AAAA,MACjF,CAAA,MAAO;AACL,QAAA,OAAA,CAAQ,MAAA,CAAO,KAAA;AAAA,UACb,CAAA;AAAA;AAAA,SACF;AAAA,MACF;AACA,MAAA,OAAA,CAAQ,MAAA,CAAO,KAAA;AAAA,QACb,CAAA,gBAAA,EAAmB,OAAA,CAAQ,WAAA,IAAe,GAAG,CAAA,EAAA,EAAK,OAAA,CAAQ,gBAAA,IAAoB,EAAE,CAAA,UAAA,EAAA,CAAc,OAAA,CAAQ,YAAA,IAAgB,IAAA,IAAa,GAAI,CAAA;AAAA;AAAA,OACzI;AACA,MAAA,OAAA,CAAQ,MAAA,CAAO,KAAA,CAAM,CAAA,cAAA,EAAiB,YAAY,CAAA;AAAA,CAAwB,CAAA;AAC1E,MAAA,OAAA,CAAQ,MAAA,CAAO,KAAA;AAAA,QACb,CAAA,QAAA,EAAW,WAAA,CAAY,IAAA,GAAO,CAAA,GAAI,CAAC,GAAG,WAAW,CAAA,CAAE,IAAA,CAAK,IAAI,CAAA,GAAI,UAAU;AAAA;AAAA,OAC5E;AACA,MAAA,OAAA,CAAQ,MAAA,CAAO,KAAA;AAAA,QACb,CAAA;AAAA;AAAA,OACF;AAEA,MAAAA,QAAAA,CAAQ;AAAA,QACN,SAAS,YAAY;AACnB,UAAA,MAAM,eAAe,OAAA,EAAQ;AAC7B,UAAA,MAAM,IAAI,QAAc,CAAC,GAAA,KAAQ,OAAO,KAAA,CAAM,MAAM,GAAA,EAAK,CAAC,CAAA;AAAA,QAC5D;AAAA,OACD,CAAA;AAAA,IACH,CAAC,CAAA;AAAA,EACH,CAAC,CAAA;AACH;AA7hBA,IAqEM,aAAA,EACA,2BACA,sBAAA,EACA,qBAAA;AAxEN,IAAA,mBAAA,GAAA,KAAA,CAAA;AAAA,EAAA,uBAAA,GAAA;AAgBA,IAAA,oBAAA,EAAA;AACA,IAAA,cAAA,EAAA;AAoDA,IAAM,aAAA,GAAgB,GAAA;AACtB,IAAM,yBAAA,GAA4B,OAAA;AAClC,IAAM,sBAAA,GAAyB,GAAA;AAC/B,IAAM,qBAAA,GAAwB,GAAA;AAAA,EAAA;AAAA,CAAA,CAAA;;;AC1D9B,cAAA,EAAA;;;ACcO,IAAM,cAAA,GAAN,cAA6B,KAAA,CAAM;AAAA,EAC/B,IAAA;AAAA,EAET,WAAA,CAAY,IAAA,EAA0B,OAAA,EAAiB,OAAA,EAAwB;AAC7E,IAAA,KAAA,CAAM,SAAS,OAAO,CAAA;AACtB,IAAA,IAAA,CAAK,IAAA,GAAO,gBAAA;AACZ,IAAA,IAAA,CAAK,IAAA,GAAO,IAAA;AAAA,EACd;AACF,CAAA;AAEO,IAAM,YAAA,GAAN,cAA2B,cAAA,CAAe;AAAA,EAC/C,WAAA,CAAY,SAAiB,OAAA,EAAwB;AACnD,IAAA,KAAA,CAAM,gBAAA,EAAkB,SAAS,OAAO,CAAA;AACxC,IAAA,IAAA,CAAK,IAAA,GAAO,cAAA;AAAA,EACd;AACF,CAAA;AAEO,IAAM,eAAA,GAAN,cAA8B,cAAA,CAAe;AAAA,EAClD,WAAA,CAAY,SAAiB,OAAA,EAAwB;AACnD,IAAA,KAAA,CAAM,mBAAA,EAAqB,SAAS,OAAO,CAAA;AAC3C,IAAA,IAAA,CAAK,IAAA,GAAO,iBAAA;AAAA,EACd;AACF,CAAA;AAEO,IAAM,aAAA,GAAN,cAA4B,cAAA,CAAe;AAAA,EAChD,WAAA,CAAY,SAAiB,OAAA,EAAwB;AACnD,IAAA,KAAA,CAAM,iBAAA,EAAmB,SAAS,OAAO,CAAA;AACzC,IAAA,IAAA,CAAK,IAAA,GAAO,eAAA;AAAA,EACd;AACF,CAAA;AAgBO,IAAM,kBAAA,GAAN,cAAiC,cAAA,CAAe;AAAA,EACrD,WAAA,CAAY,SAAiB,OAAA,EAAwB;AACnD,IAAA,KAAA,CAAM,sBAAA,EAAwB,SAAS,OAAO,CAAA;AAC9C,IAAA,IAAA,CAAK,IAAA,GAAO,oBAAA;AAAA,EACd;AACF,CAAA;AAOO,SAAS,cAAA,CAAe,MAAc,iBAAA,EAAqC;AAChF,EAAA,IAAI,MAAA,GAAS,IAAA;AACb,EAAA,KAAA,MAAW,WAAW,iBAAA,EAAmB;AACvC,IAAA,MAAA,GAAS,MAAA,CAAO,OAAA,CAAQ,OAAA,EAAS,YAAY,CAAA;AAAA,EAC/C;AACA,EAAA,OAAO,MAAA;AACT;;;AClFA,IAAM,gBAAA,GAAmBC,MAAE,MAAA,CAAO;AAAA,EAChC,OAAA,EAASA,KAAA,CAAE,OAAA,EAAQ,CAAE,QAAQ,IAAI,CAAA;AAAA,EACjC,eAAeA,KAAA,CAAE,KAAA,CAAMA,MAAE,MAAA,EAAQ,EAAE,QAAA;AACrC,CAAC,CAAA;AAED,IAAM,eAAA,GAAkBA,MAAE,MAAA,CAAO;AAAA,EAC/B,cAAA,EAAgBA,KAAA,CAAE,OAAA,EAAQ,CAAE,QAAQ,KAAK,CAAA;AAAA,EACzC,aAAA,EAAeA,KAAA,CAAE,OAAA,EAAQ,CAAE,QAAQ,KAAK,CAAA;AAAA,EACxC,mBAAA,EAAqBA,KAAA,CAAE,OAAA,EAAQ,CAAE,QAAQ,KAAK;AAChD,CAAC,CAAA;AAED,IAAM,YAAA,GAAeA,MAAE,MAAA,CAAO;AAAA,EAC5B,aAAA,EAAeA,MAAE,MAAA,EAAO,CAAE,KAAI,CAAE,QAAA,EAAS,CAAE,OAAA,CAAQ,KAAM,CAAA;AAAA,EACzD,kBAAA,EAAoBA,MAAE,MAAA,EAAO,CAAE,KAAI,CAAE,QAAA,EAAS,CAAE,OAAA,CAAQ,KAAM,CAAA;AAAA,EAC9D,eAAA,EAAiBA,MAAE,MAAA,EAAO,CAAE,KAAI,CAAE,QAAA,EAAS,CAAE,OAAA,CAAQ,GAAM,CAAA;AAAA,EAC3D,eAAA,EAAiBA,MAAE,MAAA,EAAO,CAAE,KAAI,CAAE,QAAA,EAAS,CAAE,OAAA,CAAQ,EAAE,CAAA;AAAA,EACvD,gBAAA,EAAkBA,MAAE,MAAA,EAAO,CAAE,KAAI,CAAE,QAAA,EAAS,CAAE,OAAA,CAAQ,MAAO,CAAA;AAAA,EAC7D,mBAAA,EAAqBA,MAAE,MAAA,EAAO,CAAE,KAAI,CAAE,QAAA,EAAS,CAAE,OAAA,CAAQ,GAAG,CAAA;AAAA,EAC5D,gBAAA,EAAkBA,MAAE,MAAA,EAAO,CAAE,KAAI,CAAE,QAAA,EAAS,CAAE,OAAA,CAAQ,QAAU,CAAA;AAAA,EAChE,eAAA,EAAiBA,MAAE,MAAA,EAAO,CAAE,KAAI,CAAE,QAAA,EAAS,CAAE,OAAA,CAAQ,KAAM;AAC7D,CAAC,CAAA;AAKD,IAAM,gBAAA,GAAmBA,MAAE,MAAA,CAAO;AAAA,EAChC,IAAA,EAAMA,KAAA,CAAE,MAAA,EAAO,CAAE,QAAA;AACnB,CAAC,CAAA;AAEM,IAAM,YAAA,GAAeA,MAAE,MAAA,CAAO;AAAA,EACnC,OAAA,EAASA,KAAA,CAAE,OAAA,CAAQ,GAAG,CAAA;AAAA,EACtB,aAAA,EAAeA,KAAA,CAAE,OAAA,EAAQ,CAAE,QAAQ,KAAK,CAAA;AAAA,EACxC,SAAA,EAAW,eAAA,CAAgB,QAAA,CAAS,EAAE,CAAA;AAAA,EACtC,KAAA,EAAOA,KAAA,CAAE,MAAA,CAAOA,KAAA,CAAE,MAAA,IAAU,gBAAgB,CAAA,CAAE,QAAA,CAAS,EAAE,CAAA;AAAA,EACzD,MAAA,EAAQ,YAAA,CAAa,QAAA,CAAS,EAAE,CAAA;AAAA,EAChC,IAAA,EAAM,iBAAiB,QAAA;AACzB,CAAC,CAAA;AAID,IAAM,cAAA,GAA+B;AAAA,EACnC,OAAA,EAAS,GAAA;AAAA,EACT,aAAA,EAAe,KAAA;AAAA,EACf,WAAW,EAAE,cAAA,EAAgB,OAAO,aAAA,EAAe,KAAA,EAAO,qBAAqB,KAAA,EAAM;AAAA,EACrF,OAAO,EAAC;AAAA,EACR,MAAA,EAAQ;AAAA,IACN,aAAA,EAAe,KAAA;AAAA,IACf,kBAAA,EAAoB,KAAA;AAAA,IACpB,eAAA,EAAiB,GAAA;AAAA,IACjB,eAAA,EAAiB,EAAA;AAAA,IACjB,gBAAA,EAAkB,MAAA;AAAA,IAClB,mBAAA,EAAqB,GAAA;AAAA,IACrB,gBAAA,EAAkB,QAAA;AAAA,IAClB,eAAA,EAAiB;AAAA;AAErB,CAAA;AAEO,SAAS,gBAAA,GAAiC;AAC/C,EAAA,OAAO,gBAAgB,cAAc,CAAA;AACvC;AAOA,SAAS,oBAAoB,KAAA,EAAwB;AACnD,EAAA,IAAI,KAAA,KAAU,IAAA,IAAQ,OAAO,KAAA,KAAU,QAAA,EAAU;AAC/C,IAAA,OAAO,IAAA,CAAK,UAAU,KAAK,CAAA;AAAA,EAC7B;AACA,EAAA,IAAI,KAAA,CAAM,OAAA,CAAQ,KAAK,CAAA,EAAG;AACxB,IAAA,OAAO,MAAM,KAAA,CAAM,GAAA,CAAI,mBAAmB,CAAA,CAAE,IAAA,CAAK,GAAG,CAAA,GAAI,GAAA;AAAA,EAC1D;AACA,EAAA,MAAM,GAAA,GAAM,KAAA;AACZ,EAAA,MAAM,IAAA,GAAO,MAAA,CAAO,IAAA,CAAK,GAAG,EAAE,IAAA,EAAK;AACnC,EAAA,MAAM,KAAA,GAAQ,IAAA,CAAK,GAAA,CAAI,CAAC,MAAM,IAAA,CAAK,SAAA,CAAU,CAAC,CAAA,GAAI,GAAA,GAAM,mBAAA,CAAoB,GAAA,CAAI,CAAC,CAAC,CAAC,CAAA;AACnF,EAAA,OAAO,GAAA,GAAM,KAAA,CAAM,IAAA,CAAK,GAAG,CAAA,GAAI,GAAA;AACjC;AAQA,eAAsB,kBAAkB,KAAA,EAA+C;AACrF,EAAA,MAAM,YAAY,OAAO,KAAA,KAAU,QAAA,GAAW,KAAA,GAAQ,oBAAoB,KAAK,CAAA;AAC/E,EAAA,OAAOC,iBAAU,SAAS,CAAA;AAC5B;AAEA,eAAsB,WACpB,QAAA,EACiD;AACjD,EAAA,IAAI,GAAA;AACJ,EAAA,IAAI;AACF,IAAA,GAAA,GAAM,MAAMC,iBAAA,CAAS,QAAA,EAAU,OAAO,CAAA;AAAA,EACxC,SAAS,GAAA,EAAK;AACZ,IAAA,MAAM,IAAI,eAAA;AAAA,MACR,CAAA,4BAAA,EAA+B,QAAQ,CAAA,IAAA,EAAO,GAAA,YAAe,QAAQ,GAAA,CAAI,OAAA,GAAU,MAAA,CAAO,GAAG,CAAC,CAAA,CAAA;AAAA,MAC9F,EAAE,OAAO,GAAA;AAAI,KACf;AAAA,EACF;AAGA,EAAA,IAAI;AACF,IAAA,MAAM,CAAA,GAAI,MAAMC,aAAA,CAAK,QAAQ,CAAA;AAC7B,IAAA,IAAI,CAAA,CAAE,OAAO,CAAA,EAAO;AAClB,MAAA,OAAA,CAAQ,MAAA,CAAO,KAAA;AAAA,QACb,0CAA0C,QAAQ,CAAA;AAAA;AAAA,OACpD;AAAA,IACF;AAAA,EACF,CAAA,CAAA,MAAQ;AAAA,EAER;AAEA,EAAA,IAAI,MAAA;AACJ,EAAA,IAAI;AACF,IAAA,MAAA,GAAS,IAAA,CAAK,MAAM,GAAG,CAAA;AAAA,EACzB,SAAS,GAAA,EAAK;AACZ,IAAA,MAAM,IAAI,gBAAgB,CAAA,+BAAA,EAAkC,QAAQ,IAAI,EAAE,KAAA,EAAO,KAAK,CAAA;AAAA,EACxF;AAEA,EAAA,MAAM,MAAA,GAAS,YAAA,CAAa,SAAA,CAAU,MAAM,CAAA;AAC5C,EAAA,IAAI,CAAC,OAAO,OAAA,EAAS;AACnB,IAAA,MAAM,SAAS,MAAA,CAAO,KAAA,CAAM,OAAO,GAAA,CAAI,CAAC,MAAM,CAAA,EAAG,CAAA,CAAE,KAAK,IAAA,CAAK,GAAG,CAAC,CAAA,EAAA,EAAK,CAAA,CAAE,OAAO,CAAA,CAAE,CAAA,CAAE,KAAK,IAAI,CAAA;AAC5F,IAAA,MAAM,IAAI,eAAA,CAAgB,CAAA,0BAAA,EAA6B,MAAM,CAAA,CAAE,CAAA;AAAA,EACjE;AAGA,EAAA,MAAM,IAAA,GAAO,MAAM,iBAAA,CAAkB,MAAA,CAAO,IAAI,CAAA;AAChD,EAAA,OAAO,EAAE,MAAA,EAAQ,MAAA,CAAO,IAAA,EAAM,IAAA,EAAK;AACrC;ACnHA,eAAsB,cAAc,SAAA,EAAuC;AACzE,EAAA,IAAI,GAAA;AAEJ,EAAA,IAAI,SAAA,CAAU,UAAA,CAAW,MAAM,CAAA,EAAG;AAChC,IAAA,MAAM,OAAA,GAAU,SAAA,CAAU,KAAA,CAAM,CAAC,CAAA;AACjC,IAAA,MAAM,QAAA,GAAW,OAAA,CAAQ,GAAA,CAAI,OAAO,CAAA;AACpC,IAAA,IAAI,CAAC,QAAA,EAAU;AACb,MAAA,MAAM,IAAI,YAAA,CAAa,CAAA,qBAAA,EAAwB,OAAO,CAAA,oBAAA,CAAsB,CAAA;AAAA,IAC9E;AACA,IAAA,GAAA,GAAM,QAAA;AAAA,EACR,CAAA,MAAA,IAAW,SAAA,CAAU,UAAA,CAAW,OAAO,CAAA,EAAG;AACxC,IAAA,MAAM,QAAA,GAAW,SAAA,CAAU,KAAA,CAAM,CAAC,CAAA;AAClC,IAAA,IAAI;AACF,MAAA,GAAA,GAAM,MAAMD,iBAAAA,CAAS,QAAA,EAAU,OAAO,CAAA;AAAA,IACxC,SAAS,GAAA,EAAK;AACZ,MAAA,MAAM,IAAI,YAAA;AAAA,QACR,CAAA,yBAAA,EAA4B,QAAQ,CAAA,IAAA,EAAO,GAAA,YAAe,QAAQ,GAAA,CAAI,OAAA,GAAU,MAAA,CAAO,GAAG,CAAC,CAAA,CAAA;AAAA,QAC3F,EAAE,OAAO,GAAA;AAAI,OACf;AAAA,IACF;AAAA,EACF,CAAA,MAAO;AACL,IAAA,MAAM,IAAI,YAAA;AAAA,MACR,2BAA2B,SAAS,CAAA,sCAAA;AAAA,KACtC;AAAA,EACF;AAEA,EAAA,IAAI,GAAA;AACJ,EAAA,IAAI;AACF,IAAA,GAAA,GAAM,IAAA,CAAK,MAAM,GAAG,CAAA;AAAA,EACtB,SAAS,GAAA,EAAK;AACZ,IAAA,MAAM,IAAI,YAAA,CAAa,4BAAA,EAA8B,EAAE,KAAA,EAAO,KAAK,CAAA;AAAA,EACrE;AAGA,EAAA,IACE,OAAO,GAAA,KAAQ,QAAA,IACf,GAAA,KAAQ,IAAA,IACR,EAAE,KAAA,IAAS,GAAA,CAAA,IACX,EAAE,KAAA,IAAS,GAAA,CAAA,IACX,EAAE,OAAO,GAAA,CAAA,EACT;AACA,IAAA,MAAM,IAAI,aAAa,yCAAyC,CAAA;AAAA,EAClE;AAEA,EAAA,MAAM,CAAA,GAAI,GAAA;AACV,EAAA,IAAI,CAAA,CAAE,GAAA,KAAQ,KAAA,IAAS,CAAA,CAAE,QAAQ,SAAA,EAAW;AAC1C,IAAA,MAAM,IAAI,YAAA;AAAA,MACR,CAAA,sDAAA,EAAyD,OAAO,CAAA,CAAE,GAAG,CAAC,CAAA,KAAA,EAAQ,MAAA,CAAO,CAAA,CAAE,GAAG,CAAC,CAAA;AAAA,KAC7F;AAAA,EACF;AAEA,EAAA,IAAI,OAAO,CAAA,CAAE,CAAA,KAAM,YAAY,OAAO,CAAA,CAAE,MAAM,QAAA,EAAU;AACtD,IAAA,MAAM,IAAI,aAAa,8CAA8C,CAAA;AAAA,EACvE;AAEA,EAAA,MAAM,UAAA,GAAgC;AAAA,IACpC,GAAA,EAAK,KAAA;AAAA,IACL,GAAA,EAAK,SAAA;AAAA,IACL,GAAG,CAAA,CAAE,CAAA;AAAA,IACL,GAAG,CAAA,CAAE;AAAA,GACP;AAGA,EAAA,MAAM,KAAA,GAAQ,MAAME,sBAAA,CAAgB,UAAU,CAAA;AAC9C,EAAA,IAAI,CAAC,KAAA,EAAO;AACV,IAAA,MAAM,IAAI,aAAa,uDAAuD,CAAA;AAAA,EAChF;AAEA,EAAA,MAAM,UAAA,GAAaC,sBAAA,CAAgB,UAAA,CAAW,CAAC,CAAA;AAC/C,EAAA,MAAM,SAAA,GAAY,MAAMC,sBAAA,CAAgB,UAAU,CAAA;AAIlD,EAAA,IAAI,GAAA;AACJ,EAAA,IAAI,OAAO,CAAA,CAAE,GAAA,KAAQ,QAAA,EAAU;AAC7B,IAAA,GAAA,GAAM,CAAA,CAAE,GAAA;AAAA,EACV,CAAA,MAAO;AACL,IAAA,MAAM,MAAA,GAASC,uBAAgB,SAAS,CAAA;AACxC,IAAA,MAAM,IAAA,GAAO,MAAMN,gBAAAA,CAAU,MAAM,CAAA;AACnC,IAAA,GAAA,GAAM,IAAA,CAAK,KAAA,CAAM,CAAA,EAAG,EAAE,CAAA;AAAA,EACxB;AAEA,EAAA,OAAO,EAAE,UAAA,EAAY,SAAA,EAAW,GAAA,EAAI;AACtC;AC5FA,eAAsB,aAAa,QAAA,EAA2C;AAC5E,EAAA,IAAI,GAAA;AACJ,EAAA,IAAI;AACF,IAAA,GAAA,GAAM,MAAMC,iBAAAA,CAAS,QAAA,EAAU,OAAO,CAAA;AAAA,EACxC,SAAS,GAAA,EAAK;AACZ,IAAA,MAAM,IAAI,aAAA;AAAA,MACR,CAAA,0BAAA,EAA6B,QAAQ,CAAA,IAAA,EAAO,GAAA,YAAe,QAAQ,GAAA,CAAI,OAAA,GAAU,MAAA,CAAO,GAAG,CAAC,CAAA,CAAA;AAAA,MAC5F,EAAE,OAAO,GAAA;AAAI,KACf;AAAA,EACF;AAEA,EAAA,IAAI,MAAA;AACJ,EAAA,IAAI;AACF,IAAA,MAAA,GAAS,IAAA,CAAK,MAAM,GAAG,CAAA;AAAA,EACzB,SAAS,GAAA,EAAK;AACZ,IAAA,MAAM,IAAI,cAAc,CAAA,6BAAA,EAAgC,QAAQ,IAAI,EAAE,KAAA,EAAO,KAAK,CAAA;AAAA,EACpF;AAEA,EAAA,IAAI,OAAO,MAAA,KAAW,QAAA,IAAY,WAAW,IAAA,IAAQ,EAAE,UAAU,MAAA,CAAA,EAAS;AACxE,IAAA,MAAM,IAAI,cAAc,kCAAkC,CAAA;AAAA,EAC5D;AAEA,EAAA,MAAM,IAAA,GAAO,MAAA;AACb,EAAA,IAAI,CAAC,KAAA,CAAM,OAAA,CAAQ,IAAA,CAAK,IAAI,CAAA,EAAG;AAC7B,IAAA,MAAM,IAAI,cAAc,8BAA8B,CAAA;AAAA,EACxD;AAEA,EAAA,MAAM,UAA0B,EAAC;AACjC,EAAA,KAAA,MAAW,GAAA,IAAO,KAAK,IAAA,EAAM;AAC3B,IAAA,IAAI,OAAO,GAAA,KAAQ,QAAA,IAAY,GAAA,KAAQ,IAAA,EAAM;AAC7C,IAAA,MAAM,CAAA,GAAI,GAAA;AAGV,IAAA,IAAI,CAAA,CAAE,GAAA,KAAQ,KAAA,IAAS,CAAA,CAAE,QAAQ,SAAA,EAAW;AAC5C,IAAA,IAAI,OAAO,CAAA,CAAE,CAAA,KAAM,QAAA,EAAU;AAC7B,IAAA,IAAI,CAAA,CAAE,GAAA,KAAQ,MAAA,IAAa,CAAA,CAAE,QAAQ,OAAA,EAAS;AAE9C,IAAA,MAAM,GAAA,GAAM,OAAO,CAAA,CAAE,GAAA,KAAQ,WAAW,CAAA,CAAE,GAAA,GAAM,CAAA,IAAA,EAAO,OAAA,CAAQ,MAAM,CAAA,CAAA;AACrE,IAAA,IAAI;AACF,MAAA,MAAM,SAAA,GAAYG,sBAAAA,CAAgB,CAAA,CAAE,CAAC,CAAA;AACrC,MAAA,IAAI,SAAA,CAAU,WAAW,EAAA,EAAI;AAC3B,QAAA,OAAA,CAAQ,IAAA,CAAK,EAAE,GAAA,EAAK,SAAA,EAAW,CAAA;AAAA,MACjC;AAAA,IACF,CAAA,CAAA,MAAQ;AAAA,IAER;AAAA,EACF;AAEA,EAAA,OAAO,OAAA;AACT;AAEO,SAAS,eAAA,CAAgB,MAAsB,GAAA,EAAqC;AACzF,EAAA,MAAM,QAAQ,IAAA,CAAK,IAAA,CAAK,CAAC,CAAA,KAAM,CAAA,CAAE,QAAQ,GAAG,CAAA;AAC5C,EAAA,OAAO,KAAA,EAAO,SAAA;AAChB;;;ACtDA,IAAM,cAAA,GAAiB,IAAI,IAAA,GAAO,IAAA;AAE3B,SAAS,kBAAA,GAAiC;AAC/C,EAAA,MAAM,gBAAgB,OAAA,CAAQ,MAAA,CAAO,KAAA,CAAM,IAAA,CAAK,QAAQ,MAAM,CAAA;AAC9D,EAAA,IAAI,MAAA,GAAS,EAAA;AACb,EAAA,IAAI,WAAA,GAAc,CAAA;AAElB,EAAA,SAAS,oBAAoB,IAAA,EAAoB;AAE/C,IAAA,MAAM,YAAY,IAAI,WAAA,EAAY,CAAE,MAAA,CAAO,IAAI,CAAA,CAAE,MAAA;AACjD,IAAA,IAAI,YAAY,cAAA,EAAgB;AAC9B,MAAA,MAAM,IAAI,cAAA;AAAA,QACR,8BAAA;AAAA,QACA,CAAA,sBAAA,EAAyB,SAAS,CAAA,2BAAA,EAA8B,cAAc,CAAA;AAAA,OAChF;AAAA,IACF;AAEA,IAAA,IAAI,MAAA;AACJ,IAAA,IAAI;AACF,MAAA,MAAA,GAAS,IAAA,CAAK,MAAM,IAAI,CAAA;AAAA,IAC1B,CAAA,CAAA,MAAQ;AACN,MAAA,MAAM,IAAI,cAAA;AAAA,QACR,8BAAA;AAAA,QACA,CAAA,sCAAA,EAAyC,IAAA,CAAK,KAAA,CAAM,CAAA,EAAG,GAAG,CAAC,CAAA;AAAA,OAC7D;AAAA,IACF;AAEA,IAAA,IAAI,OAAO,MAAA,KAAW,QAAA,IAAY,MAAA,KAAW,IAAA,EAAM;AACjD,MAAA,MAAM,IAAI,cAAA;AAAA,QACR,8BAAA;AAAA,QACA,CAAA,iDAAA,EAAoD,IAAA,CAAK,KAAA,CAAM,CAAA,EAAG,GAAG,CAAC,CAAA;AAAA,OACxE;AAAA,IACF;AAEA,IAAA,MAAM,GAAA,GAAM,MAAA;AAEZ,IAAA,IAAI,GAAA,CAAI,YAAY,KAAA,EAAO;AACzB,MAAA,MAAM,IAAI,cAAA;AAAA,QACR,8BAAA;AAAA,QACA,CAAA,iDAAA,EAAoD,IAAA,CAAK,KAAA,CAAM,CAAA,EAAG,GAAG,CAAC,CAAA;AAAA,OACxE;AAAA,IACF;AAIA,IAAA,MAAM,QAAQ,IAAA,IAAQ,GAAA;AACtB,IAAA,MAAM,YAAY,QAAA,IAAY,GAAA;AAC9B,IAAA,MAAM,WAAW,OAAA,IAAW,GAAA;AAC5B,IAAA,MAAM,YAAY,QAAA,IAAY,GAAA;AAE9B,IAAA,IAAI,KAAA,KAAU,aAAa,QAAA,CAAA,EAAW;AAEpC,MAAA;AAAA,IACF;AACA,IAAA,IAAI,SAAA,IAAa,CAAC,KAAA,EAAO;AAEvB,MAAA;AAAA,IACF;AAEA,IAAA,MAAM,IAAI,cAAA;AAAA,MACR,8BAAA;AAAA,MACA,CAAA,kFAAA,EAAqF,IAAA,CAAK,KAAA,CAAM,CAAA,EAAG,GAAG,CAAC,CAAA;AAAA,KACzG;AAAA,EACF;AAEA,EAAA,SAAS,aAAA,GAAsB;AAC7B,IAAA,MAAM,KAAA,GAAQ,MAAA,CAAO,KAAA,CAAM,IAAI,CAAA;AAE/B,IAAA,MAAA,GAAS,MAAM,GAAA,EAAI;AACnB,IAAA,WAAA,GAAc,IAAI,WAAA,EAAY,CAAE,MAAA,CAAO,MAAM,CAAA,CAAE,MAAA;AAE/C,IAAA,KAAA,MAAW,QAAQ,KAAA,EAAO;AACxB,MAAA,MAAM,OAAA,GAAU,KAAK,IAAA,EAAK;AAC1B,MAAA,IAAI,OAAA,CAAQ,WAAW,CAAA,EAAG;AAC1B,MAAA,mBAAA,CAAoB,OAAO,CAAA;AAAA,IAC7B;AAAA,EACF;AAEA,EAAA,MAAM,YAAA,GAAe,SACnB,KAAA,EACA,kBAAA,EACA,QAAA,EACS;AAET,IAAA,IAAI,QAAA;AACJ,IAAA,IAAI,EAAA;AAEJ,IAAA,IAAI,OAAO,uBAAuB,UAAA,EAAY;AAC5C,MAAA,EAAA,GAAK,kBAAA;AAAA,IACP,CAAA,MAAO;AACL,MAAA,QAAA,GAAW,kBAAA;AACX,MAAA,EAAA,GAAK,QAAA;AAAA,IACP;AAGA,IAAA,MAAM,GAAA,GAAM,OAAO,KAAA,KAAU,QAAA,GAAW,QAAQ,IAAI,WAAA,EAAY,CAAE,MAAA,CAAO,KAAK,CAAA;AAI9E,IAAA,MAAM,aAAa,IAAI,WAAA,EAAY,CAAE,MAAA,CAAO,GAAG,CAAA,CAAE,MAAA;AACjD,IAAA,IAAI,WAAA,GAAc,aAAa,cAAA,EAAgB;AAC7C,MAAA,MAAM,IAAI,cAAA;AAAA,QACR,8BAAA;AAAA,QACA,iCAAiC,cAAc,CAAA,wBAAA;AAAA,OACjD;AAAA,IACF;AAEA,IAAA,MAAA,IAAU,GAAA;AACV,IAAA,WAAA,IAAe,UAAA;AACf,IAAA,aAAA,EAAc;AAGd,IAAA,IAAI,QAAA,EAAU;AACZ,MAAA,OAAO,aAAA,CAAc,KAAA,EAAO,QAAA,EAAU,EAAE,CAAA;AAAA,IAC1C;AACA,IAAA,OAAO,aAAA,CAAc,OAAO,EAAmB,CAAA;AAAA,EACjD,CAAA;AAEA,EAAA,OAAA,CAAQ,OAAO,KAAA,GAAQ,YAAA;AAGvB,EAAA,OAAO,SAAS,QAAA,GAAiB;AAE/B,IAAA,IAAI,MAAA,CAAO,IAAA,EAAK,CAAE,MAAA,GAAS,CAAA,EAAG;AAC5B,MAAA,mBAAA,CAAoB,MAAA,CAAO,MAAM,CAAA;AAAA,IACnC;AACA,IAAA,MAAA,GAAS,EAAA;AACT,IAAA,WAAA,GAAc,CAAA;AACd,IAAA,OAAA,CAAQ,OAAO,KAAA,GAAQ,aAAA;AAAA,EACzB,CAAA;AACF;;;ACxIA,cAAA,EAAA;;;ACGO,SAAS,YAAA,CAAa,KAAa,MAAA,EAAiD;AACzF,EAAA,MAAM,aAAa,IAAI,WAAA,EAAY,CAAE,MAAA,CAAO,GAAG,CAAA,CAAE,MAAA;AACjD,EAAA,IAAI,UAAA,GAAa,MAAA,CAAO,MAAA,CAAO,aAAA,EAAe;AAC5C,IAAA,OAAO;AAAA,MACL,MAAM,CAAA,uBAAA,EAA0B,UAAU,CAAA,2BAAA,EAA8B,MAAA,CAAO,OAAO,aAAa,CAAA,MAAA,CAAA;AAAA,MACnG,UAAA,EAAY;AAAA,QACV,EAAA,EAAI,KAAA;AAAA,QACJ,IAAA,EAAM,uBAAA;AAAA,QACN,SAAS,CAAA,aAAA,EAAgB,UAAU,CAAA,iBAAA,EAAoB,MAAA,CAAO,OAAO,aAAa,CAAA;AAAA,OACpF;AAAA,MACA,OAAA,EAAS;AAAA,KACX;AAAA,EACF;AACA,EAAA,OAAO,MAAA;AACT;AAMO,SAAS,gBAAA,CACd,UACA,MAAA,EAC2B;AAC3B,EAAA,MAAM,UAAA,GAAa,MAAA,CAAO,KAAA,CAAM,QAAQ,CAAA;AACxC,EAAA,IAAI,UAAA,IAAc,UAAA,CAAW,OAAA,KAAY,KAAA,EAAO;AAC9C,IAAA,OAAO;AAAA,MACL,IAAA,EAAM,SAAS,QAAQ,CAAA,8BAAA,CAAA;AAAA,MACvB,UAAA,EAAY;AAAA,QACV,EAAA,EAAI,KAAA;AAAA,QACJ,IAAA,EAAM,qBAAA;AAAA,QACN,OAAA,EAAS,SAAS,QAAQ,CAAA,8BAAA;AAAA,OAC5B;AAAA,MACA,OAAA,EAAS;AAAA,KACX;AAAA,EACF;AACA,EAAA,OAAO,MAAA;AACT;AAOA,SAAS,cAAA,CAAe,OAAgB,IAAA,EAAgC;AACtE,EAAA,IAAI,OAAO,UAAU,QAAA,EAAU;AAC7B,IAAA,OAAO,IAAI,WAAA,EAAY,CAAE,MAAA,CAAO,KAAK,CAAA,CAAE,MAAA;AAAA,EACzC;AACA,EAAA,IAAI,OAAO,KAAA,KAAU,QAAA,IAAY,KAAA,KAAU,MAAM,OAAO,CAAA;AAGxD,EAAA,MAAM,OAAA,GAAU,IAAA,oBAAQ,IAAI,OAAA,EAAgB;AAC5C,EAAA,IAAI,OAAA,CAAQ,GAAA,CAAI,KAAe,CAAA,EAAG,OAAO,CAAA;AACzC,EAAA,OAAA,CAAQ,IAAI,KAAe,CAAA;AAE3B,EAAA,IAAI,KAAA,CAAM,OAAA,CAAQ,KAAK,CAAA,EAAG;AACxB,IAAA,IAAIG,MAAAA,GAAQ,CAAA;AACZ,IAAA,KAAA,MAAW,QAAQ,KAAA,EAAO;AACxB,MAAAA,MAAAA,IAAS,cAAA,CAAe,IAAA,EAAM,OAAO,CAAA;AAAA,IACvC;AACA,IAAA,OAAOA,MAAAA;AAAA,EACT;AACA,EAAA,IAAI,KAAA,GAAQ,CAAA;AACZ,EAAA,KAAA,MAAW,CAAA,IAAK,MAAA,CAAO,MAAA,CAAO,KAAgC,CAAA,EAAG;AAC/D,IAAA,KAAA,IAAS,cAAA,CAAe,GAAG,OAAO,CAAA;AAAA,EACpC;AACA,EAAA,OAAO,KAAA;AACT;AAaA,SAAS,uBAAA,CAAwB,KAAA,EAAgB,KAAA,EAAe,IAAA,EAAgC;AAC9F,EAAA,IAAI,KAAA,KAAU,MAAM,OAAO,CAAA;AAC3B,EAAA,IAAI,KAAA,KAAU,QAAW,OAAO,CAAA;AAChC,EAAA,IAAI,OAAO,KAAA,KAAU,SAAA,EAAW,OAAO,QAAQ,CAAA,GAAI,CAAA;AACnD,EAAA,IAAI,OAAO,KAAA,KAAU,QAAA,EAAU,OAAO,MAAA,CAAO,KAAK,CAAA,CAAE,MAAA;AACpD,EAAA,IAAI,OAAO,KAAA,KAAU,QAAA,EAAU,OAAO,MAAA,CAAO,WAAW,IAAA,CAAK,SAAA,CAAU,KAAK,CAAA,EAAG,MAAM,CAAA;AAErF,EAAA,IAAI,OAAO,KAAA,KAAU,QAAA,EAAU,OAAO,CAAA;AAEtC,EAAA,MAAM,OAAA,GAAU,IAAA,oBAAQ,IAAI,OAAA,EAAgB;AAC5C,EAAA,IAAI,OAAA,CAAQ,GAAA,CAAI,KAAe,CAAA,EAAG,OAAO,CAAA;AACzC,EAAA,OAAA,CAAQ,IAAI,KAAe,CAAA;AAE3B,EAAA,IAAI,KAAA,GAAQ,CAAA;AAEZ,EAAA,IAAI,KAAA,CAAM,OAAA,CAAQ,KAAK,CAAA,EAAG;AACxB,IAAA,KAAA,IAAS,CAAA,GAAI,CAAA,EAAG,CAAA,GAAI,KAAA,CAAM,QAAQ,CAAA,EAAA,EAAK;AACrC,MAAA,IAAI,CAAA,GAAI,GAAG,KAAA,IAAS,CAAA;AACpB,MAAA,KAAA,IAAS,uBAAA,CAAwB,KAAA,CAAM,CAAC,CAAA,EAAG,OAAO,OAAO,CAAA;AACzD,MAAA,IAAI,KAAA,GAAQ,OAAO,OAAO,QAAA;AAAA,IAC5B;AACA,IAAA,OAAO,KAAA;AAAA,EACT;AAEA,EAAA,MAAM,OAAA,GAAU,MAAA,CAAO,OAAA,CAAQ,KAAgC,CAAA;AAC/D,EAAA,KAAA,IAAS,CAAA,GAAI,CAAA,EAAG,CAAA,GAAI,OAAA,CAAQ,QAAQ,CAAA,EAAA,EAAK;AACvC,IAAA,IAAI,CAAA,GAAI,GAAG,KAAA,IAAS,CAAA;AACpB,IAAA,MAAM,CAAC,CAAA,EAAG,CAAC,CAAA,GAAI,QAAQ,CAAC,CAAA;AACxB,IAAA,KAAA,IAAS,OAAO,UAAA,CAAW,IAAA,CAAK,UAAU,CAAC,CAAA,EAAG,MAAM,CAAA,GAAI,CAAA;AACxD,IAAA,KAAA,IAAS,uBAAA,CAAwB,CAAA,EAAG,KAAA,EAAO,OAAO,CAAA;AAClD,IAAA,IAAI,KAAA,GAAQ,OAAO,OAAO,QAAA;AAAA,EAC5B;AACA,EAAA,OAAO,KAAA;AACT;AAYO,SAAS,eAAA,CACd,OACA,MAAA,EAC2B;AAC3B,EAAA,MAAM,KAAA,GAAQ,MAAA,CAAO,MAAA,CAAO,aAAA,GAAgB,CAAA;AAG5C,EAAA,MAAM,UAAA,GAAa,eAAe,KAAK,CAAA;AACvC,EAAA,IAAI,aAAa,KAAA,EAAO;AACtB,IAAA,OAAO;AAAA,MACL,IAAA,EAAM,CAAA,+BAAA,EAAkC,UAAU,CAAA,2BAAA,EAA8B,KAAK,CAAA,MAAA,CAAA;AAAA,MACrF,UAAA,EAAY;AAAA,QACV,EAAA,EAAI,KAAA;AAAA,QACJ,IAAA,EAAM,uBAAA;AAAA,QACN,OAAA,EAAS,CAAA,eAAA,EAAkB,UAAU,CAAA,iBAAA,EAAoB,KAAK,CAAA;AAAA,OAChE;AAAA,MACA,OAAA,EAAS;AAAA,KACX;AAAA,EACF;AAIA,EAAA,MAAM,cAAA,GAAiB,uBAAA,CAAwB,KAAA,EAAO,KAAK,CAAA;AAC3D,EAAA,IAAI,iBAAiB,KAAA,EAAO;AAC1B,IAAA,OAAO;AAAA,MACL,IAAA,EAAM,+DAA+D,KAAK,CAAA,MAAA,CAAA;AAAA,MAC1E,UAAA,EAAY;AAAA,QACV,EAAA,EAAI,KAAA;AAAA,QACJ,IAAA,EAAM,uBAAA;AAAA,QACN,OAAA,EAAS,+CAA+C,KAAK,CAAA,MAAA;AAAA,OAC/D;AAAA,MACA,OAAA,EAAS;AAAA,KACX;AAAA,EACF;AAEA,EAAA,OAAO,MAAA;AACT;AAMO,SAAS,gBAAA,CACd,GAAA,EACA,QAAA,GAAmB,EAAA,EACnB,eAAuB,CAAA,EACd;AACT,EAAA,IAAI,YAAA,GAAe,UAAU,OAAO,KAAA;AACpC,EAAA,IAAI,OAAO,GAAA,KAAQ,QAAA,IAAY,GAAA,KAAQ,MAAM,OAAO,IAAA;AACpD,EAAA,IAAI,KAAA,CAAM,OAAA,CAAQ,GAAG,CAAA,EAAG;AACtB,IAAA,OAAO,GAAA,CAAI,MAAM,CAAC,IAAA,KAAS,iBAAiB,IAAA,EAAM,QAAA,EAAU,YAAA,GAAe,CAAC,CAAC,CAAA;AAAA,EAC/E;AACA,EAAA,OAAO,MAAA,CAAO,MAAA,CAAO,GAA8B,CAAA,CAAE,KAAA;AAAA,IAAM,CAAC,KAAA,KAC1D,gBAAA,CAAiB,KAAA,EAAO,QAAA,EAAU,eAAe,CAAC;AAAA,GACpD;AACF;AASA,IAAM,2BAAA,GAA8B,sCAAA;AAU7B,SAAS,oBAAA,CACd,cAAA,EAKA,EAAA,GAAsB,2BAAA,EACd;AACR,EAAA,MAAM,QAAA,GAAW;AAAA,IACf,OAAA,EAAS,KAAA;AAAA,IACT,EAAA;AAAA,IACA,MAAA,EAAQ;AAAA,MACN,SAAS,cAAA,CAAe,OAAA;AAAA,MACxB,mBAAmB,cAAA,CAAe,iBAAA;AAAA,MAClC,SAAS,cAAA,CAAe;AAAA;AAC1B,GACF;AACA,EAAA,OAAO,OAAO,UAAA,CAAW,IAAA,CAAK,UAAU,QAAQ,CAAA,EAAG,MAAM,CAAA,GAAI,CAAA;AAC/D;AASA,IAAM,iBAAA,GAAoB,iDAAA;AAC1B,IAAM,0BAA0B,IAAI,WAAA,EAAY,CAAE,MAAA,CAAO,iBAAiB,CAAA,CAAE,MAAA;AAQrE,SAAS,gBAAA,CAAiB,MAAc,MAAA,EAAwC;AACrF,EAAA,MAAM,QAAA,GAAW,OAAO,MAAA,CAAO,kBAAA;AAC/B,EAAA,MAAM,OAAA,GAAU,IAAI,WAAA,EAAY,CAAE,OAAO,IAAI,CAAA;AAC7C,EAAA,IAAI,OAAA,CAAQ,UAAU,QAAA,EAAU;AAC9B,IAAA,OAAO,EAAE,MAAM,SAAA,EAAW,KAAA,EAAO,eAAe,OAAA,CAAQ,MAAA,EAAQ,aAAA,EAAe,OAAA,CAAQ,MAAA,EAAO;AAAA,EAChG;AAIA,EAAA,MAAM,UAAA,GAAa,IAAA,CAAK,GAAA,CAAI,CAAA,EAAG,WAAW,uBAAuB,CAAA;AAEjE,EAAA,MAAM,aAAA,GAAgB,IAAI,WAAA,EAAY,CAAE,OAAO,OAAA,CAAQ,KAAA,CAAM,CAAA,EAAG,UAAU,CAAC,CAAA;AAC3E,EAAA,MAAM,YAAY,aAAA,GAAgB,iBAAA;AAClC,EAAA,MAAM,YAAA,GAAe,IAAI,WAAA,EAAY,CAAE,OAAO,SAAS,CAAA;AACvD,EAAA,OAAO;AAAA,IACL,IAAA,EAAM,SAAA;AAAA,IACN,SAAA,EAAW,IAAA;AAAA,IACX,eAAe,OAAA,CAAQ,MAAA;AAAA,IACvB,eAAe,YAAA,CAAa;AAAA,GAC9B;AACF;;;AC5PA,SAAS,iBAAiB,MAAA,EAGxB;AACA,EAAA,MAAM,EAAE,KAAA,EAAO,OAAA,EAAQ,GAAI,MAAA;AAG3B,EAAA,IAAI,MAAM,oBAAA,EAAsB;AAC9B,IAAA,OAAO;AAAA,MACL,SAAA,EAAWH,sBAAAA,CAAgB,KAAA,CAAM,oBAAoB,CAAA;AAAA,MACrD,SAAA,EAAW;AAAA,KACb;AAAA,EACF;AAGA,EAAA,IAAI,MAAM,IAAA,EAAM;AACd,IAAA,MAAM,IAAA,GAAO,IAAA,CAAK,KAAA,CAAM,KAAA,CAAM,IAAI,CAAA;AAClC,IAAA,IAAI,CAAC,IAAA,CAAK,IAAA,EAAM,MAAA,EAAQ;AACtB,MAAA,MAAM,IAAI,MAAM,gCAAgC,CAAA;AAAA,IAClD;AAEA,IAAA,MAAM,EAAE,MAAA,EAAO,GAAII,aAAA,CAAO,MAAM,GAAG,CAAA;AACnC,IAAA,MAAM,MAAM,MAAA,CAAO,GAAA;AAGnB,IAAA,MAAM,WAAA,GAAc,KAAK,IAAA,CAAK,MAAA;AAAA,MAC5B,CAAC,CAAA,KACC,CAAA,CAAE,GAAA,KAAQ,KAAA,IACV,EAAE,GAAA,KAAQ,SAAA,IACV,OAAO,CAAA,CAAE,MAAM,QAAA,KACd,CAAA,CAAE,GAAA,KAAQ,MAAA,IAAa,EAAE,GAAA,KAAQ,OAAA;AAAA,KACtC;AAEA,IAAA,IAAI,WAAA,CAAY,WAAW,CAAA,EAAG;AAC5B,MAAA,MAAM,IAAI,MAAM,wCAAwC,CAAA;AAAA,IAC1D;AAGA,IAAA,IAAI,GAAA,EAAK;AACP,MAAA,MAAM,UAAU,WAAA,CAAY,IAAA,CAAK,CAAC,CAAA,KAAM,CAAA,CAAE,QAAQ,GAAG,CAAA;AACrD,MAAA,IAAI,OAAA,EAAS;AACX,QAAA,OAAO;AAAA,UACL,SAAA,EAAWJ,sBAAAA,CAAgB,OAAA,CAAQ,CAAW,CAAA;AAAA,UAC9C,SAAA,EAAW;AAAA,SACb;AAAA,MACF;AACA,MAAA,MAAM,MAAA,CAAO,MAAA;AAAA,QACX,IAAI,KAAA,CAAM,CAAA,wDAAA,EAA2D,GAAG,CAAA,CAAA,CAAG,CAAA;AAAA,QAC3E,EAAE,WAAW,qBAAA;AAA+B,OAC9C;AAAA,IACF;AAGA,IAAA,IAAI,WAAA,CAAY,WAAW,CAAA,EAAG;AAC5B,MAAA,OAAO;AAAA,QACL,SAAA,EAAWA,sBAAAA,CAAgB,WAAA,CAAY,CAAC,EAAE,CAAW,CAAA;AAAA,QACrD,SAAA,EAAW;AAAA,OACb;AAAA,IACF;AAEA,IAAA,MAAM,MAAA,CAAO,MAAA;AAAA,MACX,IAAI,KAAA;AAAA,QACF,CAAA,iCAAA,EAAoC,YAAY,MAAM,CAAA,sCAAA;AAAA,OACxD;AAAA,MACA,EAAE,WAAW,oBAAA;AAA8B,KAC7C;AAAA,EACF;AAGA,EAAA,IAAI,OAAA,CAAQ,UAAU,MAAA,EAAQ;AAC5B,IAAA,MAAM,EAAE,MAAA,EAAO,GAAII,aAAA,CAAO,MAAM,GAAG,CAAA;AACnC,IAAA,MAAM,MAAM,MAAA,CAAO,GAAA;AAEnB,IAAA,IAAI,GAAA,EAAK;AACP,MAAA,MAAM,GAAA,GAAM,eAAA,CAAgB,OAAA,CAAQ,QAAA,EAAU,GAAG,CAAA;AACjD,MAAA,IAAI,GAAA,EAAK;AACP,QAAA,OAAO,EAAE,SAAA,EAAW,GAAA,EAAK,SAAA,EAAW,aAAA,EAAc;AAAA,MACpD;AACA,MAAA,MAAM,OAAO,MAAA,CAAO,IAAI,MAAM,CAAA,wCAAA,EAA2C,GAAG,GAAG,CAAA,EAAG;AAAA,QAChF,SAAA,EAAW;AAAA,OACZ,CAAA;AAAA,IACH;AAGA,IAAA,IAAI,OAAA,CAAQ,QAAA,CAAS,MAAA,KAAW,CAAA,EAAG;AACjC,MAAA,OAAO,EAAE,WAAW,OAAA,CAAQ,QAAA,CAAS,CAAC,CAAA,CAAE,SAAA,EAAW,WAAW,aAAA,EAAc;AAAA,IAC9E;AAEA,IAAA,MAAM,MAAA,CAAO,MAAA;AAAA,MACX,IAAI,KAAA;AAAA,QACF,CAAA,wCAAA,EAA2C,OAAA,CAAQ,QAAA,CAAS,MAAM,CAAA,8BAAA;AAAA,OACpE;AAAA,MACA,EAAE,WAAW,oBAAA;AAA8B,KAC7C;AAAA,EACF;AAEA,EAAA,MAAM,MAAA,CAAO,MAAA;AAAA,IACX,IAAI,KAAA;AAAA,MACF;AAAA,KACF;AAAA,IACA,EAAE,WAAW,sBAAA;AAAgC,GAC/C;AACF;AAEA,eAAsB,aAAa,MAAA,EAA4D;AAC7F,EAAA,MAAM,EAAE,KAAA,EAAO,MAAA,EAAO,GAAI,MAAA;AAG1B,EAAA,MAAM,cAAA,GAAiB,gBAAA,CAAiB,aAAA,EAAe,MAAM,CAAA;AAC7D,EAAA,IAAI,gBAAgB,OAAO,cAAA;AAG3B,EAAA,MAAM,UAAA,GAAa,YAAA,CAAa,KAAA,CAAM,GAAA,EAAK,MAAM,CAAA;AACjD,EAAA,IAAI,YAAY,OAAO,UAAA;AAEvB,EAAA,IAAI,SAAA;AACJ,EAAA,IAAI,SAAA;AACJ,EAAA,IAAI;AACF,IAAA,MAAM,QAAA,GAAW,iBAAiB,MAAM,CAAA;AACxC,IAAA,SAAA,GAAY,QAAA,CAAS,SAAA;AACrB,IAAA,SAAA,GAAY,QAAA,CAAS,SAAA;AAAA,EACvB,SAAS,GAAA,EAAK;AACZ,IAAA,MAAM,IAAA,GACF,IAAgC,SAAA,IAAoC,sBAAA;AACxE,IAAA,OAAO;AAAA,MACL,IAAA,EAAM,wBAAwB,GAAA,YAAe,KAAA,GAAQ,IAAI,OAAA,GAAU,MAAA,CAAO,GAAG,CAAC,CAAA,CAAA;AAAA,MAC9E,UAAA,EAAY;AAAA,QACV,EAAA,EAAI,KAAA;AAAA,QACJ,IAAA;AAAA,QACA,SAAS,GAAA,YAAe,KAAA,GAAQ,GAAA,CAAI,OAAA,GAAU,OAAO,GAAG,CAAA;AAAA,QACxD,QAAQ;AAAC,OACX;AAAA,MACA,OAAA,EAAS;AAAA,KACX;AAAA,EACF;AAEA,EAAA,MAAM,MAAA,GAAS,MAAMC,oBAAA,CAAY,KAAA,CAAM,KAAK,SAAA,EAAW;AAAA,IACrD,QAAQ,KAAA,CAAM,MAAA;AAAA,IACd,UAAU,KAAA,CAAM;AAAA,GACjB,CAAA;AAED,EAAA,IAAI,OAAO,KAAA,EAAO;AAChB,IAAA,MAAMC,OAAAA,GAAS;AAAA,MACb,EAAE,IAAA,EAAM,WAAA,EAAa,MAAA,EAAQ,IAAA,EAAK;AAAA,MAClC,EAAE,IAAA,EAAM,QAAA,EAAU,MAAA,EAAQ,IAAA,EAAK;AAAA,MAC/B,EAAE,IAAA,EAAM,QAAA,EAAU,MAAA,EAAQ,IAAA;AAAK,KACjC;AAEA,IAAA,IAAI,MAAM,MAAA,EAAQ;AAChB,MAAAA,QAAO,IAAA,CAAK,EAAE,MAAM,gBAAA,EAAkB,MAAA,EAAQ,MAAM,CAAA;AAAA,IACtD;AACA,IAAA,IAAI,MAAM,QAAA,EAAU;AAClB,MAAAA,QAAO,IAAA,CAAK,EAAE,MAAM,kBAAA,EAAoB,MAAA,EAAQ,MAAM,CAAA;AAAA,IACxD;AAEA,IAAA,MAAM,SAAS,MAAA,CAAO,MAAA;AACtB,IAAA,MAAM,aAAA,GAAyC;AAAA,MAC7C,KAAK,MAAA,CAAO,GAAA;AAAA,MACZ,MAAM,MAAA,CAAO,IAAA;AAAA,MACb,MAAM,MAAA,CAAO,IAAA;AAAA,MACb,KAAK,MAAA,CAAO,GAAA;AAAA,MACZ,GAAI,MAAA,CAAO,GAAA,KAAQ,UAAa,EAAE,GAAA,EAAK,OAAO,GAAA,EAAI;AAAA,MAClD,SAAS,MAAA,CAAO,OAAA;AAAA,MAChB,aAAa,MAAA,CAAO;AAAA,KACtB;AAEA,IAAA,MAAM,EAAA,GAAK,gBAAA;AAAA,MACT,CAAA,qBAAA,EAAwB,OAAO,OAAO,CAAA,eAAA,EAAkB,OAAO,IAAA,IAAQ,SAAS,CAAA,MAAA,EAAS,MAAA,CAAO,GAAG,CAAA,CAAA,CAAA;AAAA,MACnG;AAAA,KACF;AACA,IAAA,OAAO;AAAA,MACL,MAAM,EAAA,CAAG,IAAA;AAAA,MACT,UAAA,EAAY;AAAA,QACV,EAAA,EAAI,IAAA;AAAA,QACJ,SAAS,MAAA,CAAO,OAAA;AAAA,QAChB,MAAA,EAAAA,OAAAA;AAAA,QACA,aAAA;AAAA,QACA,SAAA;AAAA,QACA,GAAI,GAAG,SAAA,GACH;AAAA,UACE,WAAA,EAAa;AAAA,YACX,WAAW,EAAA,CAAG,SAAA;AAAA,YACd,eAAe,EAAA,CAAG,aAAA;AAAA,YAClB,eAAe,EAAA,CAAG;AAAA;AACpB,YAEF;AAAC;AACP,KACF;AAAA,EACF;AAGA,EAAA,MAAM,SAAqE,EAAC;AAC5E,EAAA,IAAI,MAAA,CAAO,SAAS,qBAAA,EAAuB;AACzC,IAAA,MAAA,CAAO,IAAA,CAAK,EAAE,IAAA,EAAM,WAAA,EAAa,QAAQ,KAAA,EAAO,OAAA,EAAS,MAAA,CAAO,OAAA,EAAS,CAAA;AAAA,EAC3E,CAAA,MAAA,IAAW,MAAA,CAAO,IAAA,KAAS,kBAAA,EAAoB;AAC7C,IAAA,MAAA,CAAO,KAAK,EAAE,IAAA,EAAM,WAAA,EAAa,MAAA,EAAQ,MAAM,CAAA;AAC/C,IAAA,MAAA,CAAO,IAAA,CAAK,EAAE,IAAA,EAAM,QAAA,EAAU,QAAQ,KAAA,EAAO,OAAA,EAAS,MAAA,CAAO,OAAA,EAAS,CAAA;AAAA,EACxE,CAAA,MAAA,IAAW,MAAA,CAAO,IAAA,KAAS,WAAA,EAAa;AACtC,IAAA,MAAA,CAAO,KAAK,EAAE,IAAA,EAAM,WAAA,EAAa,MAAA,EAAQ,MAAM,CAAA;AAC/C,IAAA,MAAA,CAAO,KAAK,EAAE,IAAA,EAAM,QAAA,EAAU,MAAA,EAAQ,MAAM,CAAA;AAC5C,IAAA,MAAA,CAAO,IAAA,CAAK,EAAE,IAAA,EAAM,QAAA,EAAU,QAAQ,KAAA,EAAO,OAAA,EAAS,MAAA,CAAO,OAAA,EAAS,CAAA;AAAA,EACxE,CAAA,MAAA,IAAW,MAAA,CAAO,IAAA,KAAS,kBAAA,EAAoB;AAC7C,IAAA,MAAA,CAAO,KAAK,EAAE,IAAA,EAAM,WAAA,EAAa,MAAA,EAAQ,MAAM,CAAA;AAC/C,IAAA,MAAA,CAAO,KAAK,EAAE,IAAA,EAAM,QAAA,EAAU,MAAA,EAAQ,MAAM,CAAA;AAC5C,IAAA,MAAA,CAAO,IAAA,CAAK,EAAE,IAAA,EAAM,gBAAA,EAAkB,QAAQ,KAAA,EAAO,OAAA,EAAS,MAAA,CAAO,OAAA,EAAS,CAAA;AAAA,EAChF,CAAA,MAAA,IAAW,MAAA,CAAO,IAAA,KAAS,oBAAA,EAAsB;AAC/C,IAAA,MAAA,CAAO,KAAK,EAAE,IAAA,EAAM,WAAA,EAAa,MAAA,EAAQ,MAAM,CAAA;AAC/C,IAAA,MAAA,CAAO,KAAK,EAAE,IAAA,EAAM,QAAA,EAAU,MAAA,EAAQ,MAAM,CAAA;AAC5C,IAAA,MAAA,CAAO,IAAA,CAAK,EAAE,IAAA,EAAM,kBAAA,EAAoB,QAAQ,KAAA,EAAO,OAAA,EAAS,MAAA,CAAO,OAAA,EAAS,CAAA;AAAA,EAClF,CAAA,MAAO;AACL,IAAA,MAAA,CAAO,IAAA,CAAK,EAAE,IAAA,EAAM,MAAA,CAAO,IAAA,EAAM,QAAQ,KAAA,EAAO,OAAA,EAAS,MAAA,CAAO,OAAA,EAAS,CAAA;AAAA,EAC3E;AAEA,EAAA,MAAM,MAAA,GAAS,gBAAA;AAAA,IACb,CAAA,qBAAA,EAAwB,MAAA,CAAO,IAAI,CAAA,IAAA,EAAO,OAAO,OAAO,CAAA,CAAA;AAAA,IACxD;AAAA,GACF;AACA,EAAA,OAAO;AAAA,IACL,MAAM,MAAA,CAAO,IAAA;AAAA,IACb,UAAA,EAAY;AAAA,MACV,EAAA,EAAI,KAAA;AAAA,MACJ,MAAM,MAAA,CAAO,IAAA;AAAA,MACb,SAAS,MAAA,CAAO,OAAA;AAAA,MAChB,MAAA;AAAA,MACA,SAAA;AAAA,MACA,GAAI,OAAO,SAAA,GACP;AAAA,QACE,WAAA,EAAa;AAAA,UACX,WAAW,MAAA,CAAO,SAAA;AAAA,UAClB,eAAe,MAAA,CAAO,aAAA;AAAA,UACtB,eAAe,MAAA,CAAO;AAAA;AACxB,UAEF;AAAC;AACP,GACF;AACF;AChPA,eAAsB,cAAc,MAAA,EAA6D;AAC/F,EAAA,MAAM,EAAE,KAAA,EAAO,MAAA,EAAO,GAAI,MAAA;AAG1B,EAAA,MAAM,cAAA,GAAiB,gBAAA,CAAiB,cAAA,EAAgB,MAAM,CAAA;AAC9D,EAAA,IAAI,gBAAgB,OAAO,cAAA;AAG3B,EAAA,MAAM,UAAA,GAAa,YAAA,CAAa,KAAA,CAAM,GAAA,EAAK,MAAM,CAAA;AACjD,EAAA,IAAI,YAAY,OAAO,UAAA;AAEvB,EAAA,IAAI,MAAA;AACJ,EAAA,IAAI,OAAA;AACJ,EAAA,IAAI;AACF,IAAA,MAAM,OAAA,GAAUF,aAAAA,CAAgC,KAAA,CAAM,GAAG,CAAA;AACzD,IAAA,MAAA,GAAS,OAAA,CAAQ,MAAA;AACjB,IAAA,OAAA,GAAU,OAAA,CAAQ,OAAA;AAAA,EACpB,SAAS,GAAA,EAAK;AACZ,IAAA,OAAO;AAAA,MACL,IAAA,EAAM,mBAAmB,GAAA,YAAe,KAAA,GAAQ,IAAI,OAAA,GAAU,MAAA,CAAO,GAAG,CAAC,CAAA,CAAA;AAAA,MACzE,UAAA,EAAY;AAAA,QACV,OAAO,GAAA,YAAe,KAAA,GAAQ,GAAA,CAAI,OAAA,GAAU,OAAO,GAAG,CAAA;AAAA,QACtD,IAAA,EAAM;AAAA,OACR;AAAA,MACA,OAAA,EAAS;AAAA,KACX;AAAA,EACF;AAGA,EAAA,IAAI,OAAA,GAAU,SAAA;AACd,EAAA,IAAI;AACF,IAAA,MAAM,EAAA,GAAKG,0BAAmB,OAAO,CAAA;AACrC,IAAA,IAAI,GAAG,EAAA,EAAI;AACT,MAAA,OAAA,GAAU,EAAA,CAAG,OAAA;AAAA,IACf;AAAA,EACF,CAAA,CAAA,MAAQ;AAAA,EAER;AAEA,EAAA,MAAM,WAAA,GAAuC;AAAA,IAC3C,OAAA;AAAA,IACA,QAAQ,OAAA,CAAQ,GAAA;AAAA,IAChB,UAAU,OAAA,CAAQ;AAAA,GACpB;AAEA,EAAA,IAAI,OAAO,OAAA,CAAQ,GAAA,KAAQ,QAAA,EAAU;AACnC,IAAA,WAAA,CAAY,WAAW,IAAI,IAAA,CAAK,QAAQ,GAAA,GAAM,GAAI,EAAE,WAAA,EAAY;AAAA,EAClE;AACA,EAAA,IAAI,OAAO,OAAA,CAAQ,GAAA,KAAQ,QAAA,EAAU;AACnC,IAAA,WAAA,CAAY,YAAY,IAAI,IAAA,CAAK,QAAQ,GAAA,GAAM,GAAI,EAAE,WAAA,EAAY;AAAA,EACnE;AACA,EAAA,IAAI,OAAO,OAAA,CAAQ,GAAA,KAAQ,QAAA,EAAU;AACnC,IAAA,WAAA,CAAY,YAAY,OAAA,CAAQ,GAAA;AAAA,EAClC;AAGA,EAAA,IAAI,QAAA,GAAW,KAAA;AACf,EAAA,IAAI,WAAA;AAGJ,EAAA,MAAM,mBAAA,GAAsB,KAAA,CAAM,WAAA,IAAe,MAAA,CAAO,SAAA,CAAU,mBAAA;AAClE,EAAA,IAAI,mBAAA,EAAqB;AACvB,IAAA,WAAA,GAAc,EAAE,GAAG,OAAA,EAAQ;AAE3B,IAAA,IAAI,MAAA,CAAO,SAAA,CAAU,cAAA,IAAkB,UAAA,IAAc,WAAA,EAAa;AAChE,MAAA,WAAA,CAAY,QAAA,GAAW,sBAAA;AACvB,MAAA,QAAA,GAAW,IAAA;AAAA,IACb;AACA,IAAA,IAAI,MAAA,CAAO,SAAA,CAAU,aAAA,IAAiB,SAAA,IAAa,WAAA,EAAa;AAC9D,MAAA,WAAA,CAAY,OAAA,GAAU,sBAAA;AACtB,MAAA,QAAA,GAAW,IAAA;AAAA,IACb;AAAA,EACF;AAEA,EAAA,MAAM,KAAA,GAAQ;AAAA,IACZ,6DAAA;AAAA,IACA,EAAA;AAAA,IACA,YAAY,OAAO,CAAA,CAAA;AAAA,IACnB,CAAA,QAAA,EAAW,OAAA,CAAQ,GAAA,IAAO,KAAK,CAAA,CAAA;AAAA,IAC/B,CAAA,UAAA,EAAa,OAAA,CAAQ,GAAA,IAAO,KAAK,CAAA;AAAA,GACnC;AAEA,EAAA,IAAI,YAAY,QAAA,EAAU,KAAA,CAAM,KAAK,CAAA,WAAA,EAAc,WAAA,CAAY,QAAQ,CAAA,CAAE,CAAA;AACzE,EAAA,IAAI,YAAY,SAAA,EAAW,KAAA,CAAM,KAAK,CAAA,YAAA,EAAe,WAAA,CAAY,SAAS,CAAA,CAAE,CAAA;AAC5E,EAAA,IAAI,YAAY,SAAA,EAAW,KAAA,CAAM,KAAK,CAAA,YAAA,EAAe,WAAA,CAAY,SAAS,CAAA,CAAE,CAAA;AAC5E,EAAA,IAAI,QAAA,EAAU,KAAA,CAAM,IAAA,CAAK,EAAA,EAAI,sCAAsC,CAAA;AAEnE,EAAA,MAAM,KAAK,gBAAA,CAAiB,KAAA,CAAM,IAAA,CAAK,IAAI,GAAG,MAAM,CAAA;AACpD,EAAA,OAAO;AAAA,IACL,MAAM,EAAA,CAAG,IAAA;AAAA,IACT,UAAA,EAAY;AAAA,MACV,MAAA;AAAA,MACA,WAAA;AAAA,MACA,GAAI,WAAA,KAAgB,MAAA,GAAY,EAAE,WAAA,KAAgB,EAAC;AAAA,MACnD,QAAA;AAAA,MACA,QAAA,EAAU,KAAA;AAAA,MACV,GAAI,GAAG,SAAA,GACH;AAAA,QACE,WAAA,EAAa;AAAA,UACX,WAAW,EAAA,CAAG,SAAA;AAAA,UACd,eAAe,EAAA,CAAG,aAAA;AAAA,UAClB,eAAe,EAAA,CAAG;AAAA;AACpB,UAEF;AAAC;AACP,GACF;AACF;AC5GA,eAAsB,aAAa,MAAA,EAA4D;AAC7F,EAAA,MAAM,EAAE,KAAA,EAAO,MAAA,EAAO,GAAI,MAAA;AAG1B,EAAA,MAAM,cAAA,GAAiB,gBAAA,CAAiB,aAAA,EAAe,MAAM,CAAA;AAC7D,EAAA,IAAI,gBAAgB,OAAO,cAAA;AAG3B,EAAA,MAAM,UAAA,GAAa,YAAA,CAAa,KAAA,CAAM,GAAA,EAAK,MAAM,CAAA;AACjD,EAAA,IAAI,YAAY,OAAO,UAAA;AAEvB,EAAA,IAAI;AACF,IAAA,MAAM,OAAA,GAAUH,aAAAA,CAAgC,KAAA,CAAM,GAAG,CAAA;AACzD,IAAA,MAAM,SAAS,OAAA,CAAQ,MAAA;AACvB,IAAA,MAAM,UAAU,OAAA,CAAQ,OAAA;AAExB,IAAA,MAAM,EAAA,GAAK,gBAAA;AAAA,MACT;AAAA,QACE,iCAAA;AAAA,QACA,EAAA;AAAA,QACA,WAAW,IAAA,CAAK,SAAA,CAAU,MAAA,EAAQ,IAAA,EAAM,CAAC,CAAC,CAAA,CAAA;AAAA,QAC1C,EAAA;AAAA,QACA,YAAY,IAAA,CAAK,SAAA,CAAU,OAAA,EAAS,IAAA,EAAM,CAAC,CAAC,CAAA;AAAA,OAC9C,CAAE,KAAK,IAAI,CAAA;AAAA,MACX;AAAA,KACF;AAEA,IAAA,OAAO;AAAA,MACL,MAAM,EAAA,CAAG,IAAA;AAAA,MACT,UAAA,EAAY;AAAA,QACV,MAAA;AAAA,QACA,OAAA;AAAA,QACA,QAAA,EAAU,KAAA;AAAA,QACV,GAAI,GAAG,SAAA,GACH;AAAA,UACE,WAAA,EAAa;AAAA,YACX,WAAW,EAAA,CAAG,SAAA;AAAA,YACd,eAAe,EAAA,CAAG,aAAA;AAAA,YAClB,eAAe,EAAA,CAAG;AAAA;AACpB,YAEF;AAAC;AACP,KACF;AAAA,EACF,SAAS,GAAA,EAAK;AACZ,IAAA,OAAO;AAAA,MACL,IAAA,EAAM,kBAAkB,GAAA,YAAe,KAAA,GAAQ,IAAI,OAAA,GAAU,MAAA,CAAO,GAAG,CAAC,CAAA,CAAA;AAAA,MACxE,UAAA,EAAY;AAAA,QACV,OAAO,GAAA,YAAe,KAAA,GAAQ,GAAA,CAAI,OAAA,GAAU,OAAO,GAAG,CAAA;AAAA,QACtD,IAAA,EAAM;AAAA,OACR;AAAA,MACA,OAAA,EAAS;AAAA,KACX;AAAA,EACF;AACF;AChDA,SAAS,gBAAA,CAAiB,YAAwB,SAAA,EAAiC;AACjF,EAAA,MAAM,OAAA,GAAUF,uBAAgB,UAAU,CAAA;AAC1C,EAAA,MAAM,MAAA,GAASA,uBAAgB,SAAS,CAAA;AAExC,EAAA,MAAM,OAAA,GAAU,OAAA,CAAQ,OAAA,CAAQ,qBAAA,EAAuB,MAAM,CAAA;AAC7D,EAAA,MAAM,MAAA,GAAS,MAAA,CAAO,OAAA,CAAQ,qBAAA,EAAuB,MAAM,CAAA;AAC3D,EAAA,OAAO,CAAC,IAAI,MAAA,CAAO,OAAA,EAAS,GAAG,GAAG,IAAI,MAAA,CAAO,MAAA,EAAQ,GAAG,CAAC,CAAA;AAC3D;AAEA,eAAsB,YAAY,MAAA,EAA2D;AAC3F,EAAA,MAAM,EAAE,KAAA,EAAO,MAAA,EAAQ,OAAA,EAAQ,GAAI,MAAA;AAGnC,EAAA,MAAM,cAAA,GAAiB,gBAAA,CAAiB,YAAA,EAAc,MAAM,CAAA;AAC5D,EAAA,IAAI,gBAAgB,OAAO,cAAA;AAG3B,EAAA,IAAI,CAAC,OAAA,CAAQ,SAAA,IAAa,CAAC,QAAQ,QAAA,EAAU;AAC3C,IAAA,OAAO;AAAA,MACL,IAAA,EAAM,yFAAA;AAAA,MACN,UAAA,EAAY;AAAA,QACV,EAAA,EAAI,KAAA;AAAA,QACJ,IAAA,EAAM,oBAAA;AAAA,QACN,OAAA,EAAS;AAAA,OACX;AAAA,MACA,OAAA,EAAS;AAAA,KACX;AAAA,EACF;AAGA,EAAA,MAAM,SAAA,GAAY,IAAA,CAAK,SAAA,CAAU,KAAK,CAAA;AACtC,EAAA,MAAM,aAAa,IAAI,WAAA,EAAY,CAAE,MAAA,CAAO,SAAS,CAAA,CAAE,MAAA;AACvD,EAAA,IAAI,UAAA,GAAa,MAAA,CAAO,MAAA,CAAO,gBAAA,EAAkB;AAC/C,IAAA,OAAO;AAAA,MACL,MAAM,CAAA,2BAAA,EAA8B,UAAU,CAAA,2BAAA,EAA8B,MAAA,CAAO,OAAO,gBAAgB,CAAA,MAAA,CAAA;AAAA,MAC1G,UAAA,EAAY;AAAA,QACV,EAAA,EAAI,KAAA;AAAA,QACJ,IAAA,EAAM,uBAAA;AAAA,QACN,SAAS,CAAA,gBAAA,EAAmB,UAAU,CAAA,iBAAA,EAAoB,MAAA,CAAO,OAAO,gBAAgB,CAAA;AAAA,OAC1F;AAAA,MACA,OAAA,EAAS;AAAA,KACX;AAAA,EACF;AAGA,EAAA,MAAM,cAAc,gBAAA,CAAiB,OAAA,CAAQ,UAAU,UAAA,EAAY,OAAA,CAAQ,UAAU,SAAS,CAAA;AAE9F,EAAA,IAAI;AAIF,IAAA,IAAI,KAAA,CAAM,MAAA,IAAU,CAAC,KAAA,CAAM,OAAO,MAAA,EAAQ;AACxC,MAAA,OAAO;AAAA,QACL,IAAA,EAAM,uEAAA;AAAA,QACN,UAAA,EAAY;AAAA,UACV,EAAA,EAAI,KAAA;AAAA,UACJ,IAAA,EAAM,oBAAA;AAAA,UACN,OAAA,EACE;AAAA,SACJ;AAAA,QACA,OAAA,EAAS;AAAA,OACX;AAAA,IACF;AACA,IAAA,MAAM,cAAc,KAAA,CAAM,MAAA,EAAQ,MAAA,GAC9B,EAAE,QAAQ,KAAA,CAAM,MAAA,CAAO,MAAA,EAAQ,GAAA,EAAK,MAAM,MAAA,CAAO,GAAA,EAAK,SAAS,KAAA,CAAM,MAAA,CAAO,SAAQ,GACpF,KAAA,CAAA;AAEJ,IAAA,MAAM,MAAA,GAAS,MAAMM,oBAAA,CAAY;AAAA,MAC/B,KAAK,OAAA,CAAQ,QAAA;AAAA,MACb,MAAM,KAAA,CAAM,IAAA;AAAA,MACZ,MAAM,KAAA,CAAM,IAAA;AAAA,MACZ,KAAK,KAAA,CAAM,GAAA;AAAA,MACX,SAAS,KAAA,CAAM,OAAA;AAAA,MACf,aAAa,KAAA,CAAM,WAAA;AAAA,MACnB,YAAY,KAAA,CAAM,UAAA;AAAA,MAClB,MAAA,EAAQ,WAAA;AAAA,MACR,UAAA,EAAY,QAAQ,SAAA,CAAU,UAAA;AAAA,MAC9B,GAAA,EAAK,QAAQ,SAAA,CAAU;AAAA,KACxB,CAAA;AAGD,IAAA,MAAM,EAAE,OAAA,EAAQ,GAAIJ,aAAAA,CAAgC,OAAO,GAAG,CAAA;AAC9D,IAAA,MAAM,aAAA,GAAgB;AAAA,MACpB,KAAK,OAAA,CAAQ,GAAA;AAAA,MACb,MAAM,OAAA,CAAQ,IAAA;AAAA,MACd,MAAM,OAAA,CAAQ,IAAA;AAAA,MACd,KAAK,OAAA,CAAQ,GAAA;AAAA,MACb,KAAK,OAAA,CAAQ,GAAA;AAAA,MACb,GAAI,QAAQ,GAAA,KAAQ,KAAA,CAAA,GAAY,EAAE,GAAA,EAAK,OAAA,CAAQ,GAAA,EAAc,GAAI,EAAC;AAAA,MAClE,GAAI,QAAQ,OAAA,KAAY,KAAA,CAAA,GAAY,EAAE,OAAA,EAAS,OAAA,CAAQ,OAAA,EAAoB,GAAI;AAAC,KAClF;AAGA,IAAA,MAAM,EAAA,GAAK,gBAAA;AAAA,MACT,CAAA,oBAAA,EAAuB,cAAc,GAAG,CAAA,OAAA,EAAU,cAAc,IAAI,CAAA,OAAA,EAAU,cAAc,IAAI,CAAA,CAAA;AAAA,MAChG;AAAA,KACF;AACA,IAAA,MAAM,QAAA,GAAW,cAAA,CAAe,EAAA,CAAG,IAAA,EAAM,WAAW,CAAA;AAEpD,IAAA,OAAO;AAAA,MACL,IAAA,EAAM,QAAA;AAAA,MACN,UAAA,EAAY;AAAA,QACV,EAAA,EAAI,IAAA;AAAA,QACJ,KAAK,MAAA,CAAO,GAAA;AAAA,QACZ;AAAA;AACF,KACF;AAAA,EACF,SAAS,GAAA,EAAK;AAEZ,IAAA,MAAM,aAAa,GAAA,YAAe,KAAA,GAAQ,GAAA,CAAI,OAAA,GAAU,OAAO,GAAG,CAAA;AAClE,IAAA,MAAM,WAAA,GAAc,cAAA,CAAe,UAAA,EAAY,WAAW,CAAA;AAE1D,IAAA,IAAI,eAAeK,mBAAA,EAAY;AAC7B,MAAA,OAAO;AAAA,QACL,IAAA,EAAM,iBAAiB,WAAW,CAAA,CAAA;AAAA,QAClC,UAAA,EAAY;AAAA,UACV,EAAA,EAAI,KAAA;AAAA,UACJ,IAAA,EAAM,oBAAA;AAAA,UACN,OAAA,EAAS;AAAA,SACX;AAAA,QACA,OAAA,EAAS;AAAA,OACX;AAAA,IACF;AAEA,IAAA,IAAI,eAAe,cAAA,EAAgB;AACjC,MAAA,OAAO;AAAA,QACL,IAAA,EAAM,iBAAiB,WAAW,CAAA,CAAA;AAAA,QAClC,UAAA,EAAY;AAAA,UACV,EAAA,EAAI,KAAA;AAAA,UACJ,MAAM,GAAA,CAAI,IAAA;AAAA,UACV,OAAA,EAAS;AAAA,SACX;AAAA,QACA,OAAA,EAAS;AAAA,OACX;AAAA,IACF;AAEA,IAAA,OAAO;AAAA,MACL,IAAA,EAAM,iBAAiB,WAAW,CAAA,CAAA;AAAA,MAClC,UAAA,EAAY;AAAA,QACV,EAAA,EAAI,KAAA;AAAA,QACJ,IAAA,EAAM,oBAAA;AAAA,QACN,OAAA,EAAS;AAAA,OACX;AAAA,MACA,OAAA,EAAS;AAAA,KACX;AAAA,EACF;AACF;ACpJA,IAAM,sBAAA,uBAA6B,GAAA,CAAI;AAAA,EACrC,KAAA;AAAA,EACA,KAAA;AAAA,EACA,KAAA;AAAA,EACA,KAAA;AAAA,EACA,MAAA;AAAA,EACA,MAAA;AAAA,EACA,MAAA;AAAA,EACA,MAAA;AAAA,EACA,MAAA;AAAA,EACA,MAAA;AAAA,EACA,MAAA;AAAA,EACA,MAAA;AAAA,EACA,MAAA;AAAA,EACA,MAAA;AAAA,EACA,MAAA;AAAA,EACA,MAAA;AAAA,EACA,MAAA;AAAA,EACA,MAAA;AAAA,EACA,MAAA;AAAA,EACA,MAAA;AAAA,EACA,MAAA;AAAA,EACA;AACF,CAAC,CAAA;AAUM,SAAS,mBAAmB,CAAA,EAAiB;AAClD,EAAA,IAAI,CAAC,CAAA,IAAK,CAAA,CAAE,IAAA,EAAK,CAAE,WAAW,CAAA,EAAG;AAC/B,IAAA,MAAM,IAAI,mBAAmB,wBAAwB,CAAA;AAAA,EACvD;AAGA,EAAA,IAAI,CAAA,CAAE,QAAA,CAAS,IAAI,CAAA,EAAG;AACpB,IAAA,MAAM,IAAI,mBAAmB,qCAAqC,CAAA;AAAA,EACpE;AAGA,EAAA,IAAI,CAAA,CAAE,QAAA,CAAS,GAAG,CAAA,EAAG;AACnB,IAAA,MAAM,IAAI,mBAAmB,2DAA2D,CAAA;AAAA,EAC1F;AAEA,EAAA,IAAaC,mBAAA,CAAA,UAAA,CAAW,CAAC,CAAA,EAAG;AAC1B,IAAA,MAAM,IAAI,mBAAmB,gCAAgC,CAAA;AAAA,EAC/D;AAGA,EAAA,MAAM,UAAA,GAAsBA,8BAAU,CAAC,CAAA;AACvC,EAAA,IAAI,UAAA,CAAW,UAAA,CAAW,IAAI,CAAA,IAAK,UAAA,CAAW,QAAA,CAAS,KAAK,CAAA,IAAK,UAAA,CAAW,QAAA,CAAS,MAAM,CAAA,EAAG;AAC5F,IAAA,MAAM,IAAI,mBAAmB,oCAAoC,CAAA;AAAA,EACnE;AAGA,EAAA,IAAI,EAAE,QAAA,CAAS,GAAG,KAAK,CAAA,CAAE,QAAA,CAAS,IAAI,CAAA,EAAG;AACvC,IAAA,MAAM,IAAI,mBAAmB,0DAA0D,CAAA;AAAA,EACzF;AAEA,EAAA,IAAI,CAAA,CAAE,SAAS,GAAA,EAAK;AAClB,IAAA,MAAM,IAAI,kBAAA,CAAmB,CAAA,yCAAA,EAA4C,CAAA,CAAE,MAAM,CAAA,CAAA,CAAG,CAAA;AAAA,EACtF;AAGA,EAAA,IAAI,CAAA,CAAE,UAAA,CAAW,GAAG,CAAA,EAAG;AACrB,IAAA,MAAM,IAAI,mBAAmB,gDAAgD,CAAA;AAAA,EAC/E;AAGA,EAAA,IAAI,EAAE,QAAA,CAAS,GAAG,KAAK,CAAA,CAAE,QAAA,CAAS,GAAG,CAAA,EAAG;AACtC,IAAA,MAAM,IAAI,mBAAmB,0CAA0C,CAAA;AAAA,EACzE;AAIA,EAAA,MAAM,QAAA,GAAW,CAAA,CAAE,OAAA,CAAQ,GAAG,CAAA;AAC9B,EAAA,MAAM,QAAA,GAAA,CAAY,YAAY,CAAA,GAAI,CAAA,CAAE,MAAM,CAAA,EAAG,QAAQ,CAAA,GAAI,CAAA,EAAG,WAAA,EAAY;AACxE,EAAA,IAAI,sBAAA,CAAuB,GAAA,CAAI,QAAQ,CAAA,EAAG;AACxC,IAAA,MAAM,IAAI,kBAAA,CAAmB,CAAA,8BAAA,EAAiC,QAAA,CAAS,WAAA,EAAa,CAAA,CAAE,CAAA;AAAA,EACxF;AACF;AA2BA,eAAe,iBAAiB,aAAA,EAAsC;AACpE,EAAA,IAAI;AACF,IAAA,MAAM,KAAA,GAAQ,MAAMC,cAAA,CAAM,aAAa,CAAA;AACvC,IAAA,IAAI,KAAA,CAAM,gBAAe,EAAG;AAC1B,MAAA,MAAM,IAAI,kBAAA,CAAmB,CAAA,oBAAA,EAAuB,aAAa,CAAA,CAAE,CAAA;AAAA,IACrE;AAAA,EACF,SAAS,GAAA,EAAK;AACZ,IAAA,IAAI,GAAA,YAAe,oBAAoB,MAAM,GAAA;AAE7C,IAAA,IAAK,GAAA,CAA8B,SAAS,QAAA,EAAU;AACtD,IAAA,MAAM,GAAA;AAAA,EACR;AACF;AAwBA,eAAsB,cAAA,CAAe,SAAiB,SAAA,EAAkC;AACtF,EAAA,IAAI;AACF,IAAA,MAAMC,eAAA,CAAO,SAAS,SAAS,CAAA;AAAA,EACjC,SAAS,GAAA,EAAK;AAEZ,IAAA,IAAI;AACF,MAAA,MAAMC,YAAG,OAAA,EAAS,EAAE,WAAW,IAAA,EAAM,KAAA,EAAO,MAAM,CAAA;AAAA,IACpD,CAAA,CAAA,MAAQ;AAAA,IAER;AACA,IAAA,MAAM,GAAA;AAAA,EACR;AACF;AAMA,eAAsB,cAAc,QAAA,EAAmC;AACrE,EAAA,MAAM,iBAAiB,QAAQ,CAAA;AAC/B,EAAA,MAAM,MAAA,GAAkBH,mBAAA,CAAA,IAAA,CAAK,QAAA,EAAU,CAAA,KAAA,EAAQpB,mBAAA,GAAa,KAAA,CAAM,CAAA,EAAG,CAAC,CAAC,CAAA,CAAA,CAAG,CAAA;AAC1E,EAAA,OAAOwB,iBAAQ,MAAM,CAAA;AACvB;;;ACzKA,cAAA,EAAA;AAOA,SAAS,oBAAoB,KAAA,EAAwB;AACnD,EAAA,OACE,IAAA,CAAK,SAAA;AAAA,IACH,KAAA;AAAA,IACA,CAAC,MAAM,GAAA,KAAQ;AACb,MAAA,IAAI,GAAA,KAAQ,QAAQ,OAAO,GAAA,KAAQ,YAAY,CAAC,KAAA,CAAM,OAAA,CAAQ,GAAG,CAAA,EAAG;AAClE,QAAA,MAAM,SAAkC,EAAC;AACzC,QAAA,KAAA,MAAW,KAAK,MAAA,CAAO,IAAA,CAAK,GAA8B,CAAA,CAAE,MAAK,EAAG;AAClE,UAAA,MAAA,CAAO,CAAC,CAAA,GAAK,GAAA,CAAgC,CAAC,CAAA;AAAA,QAChD;AACA,QAAA,OAAO,MAAA;AAAA,MACT;AACA,MAAA,OAAO,GAAA;AAAA,IACT,CAAA;AAAA,IACA;AAAA,GACF,GAAI,IAAA;AAER;AAKA,SAASC,iBAAAA,CAAiB,YAAwB,SAAA,EAAiC;AACjF,EAAA,MAAM,OAAA,GAAUb,uBAAgB,UAAU,CAAA;AAC1C,EAAA,MAAM,MAAA,GAASA,uBAAgB,SAAS,CAAA;AACxC,EAAA,MAAM,OAAA,GAAU,OAAA,CAAQ,OAAA,CAAQ,qBAAA,EAAuB,MAAM,CAAA;AAC7D,EAAA,MAAM,MAAA,GAAS,MAAA,CAAO,OAAA,CAAQ,qBAAA,EAAuB,MAAM,CAAA;AAC3D,EAAA,OAAO,CAAC,IAAI,MAAA,CAAO,OAAA,EAAS,GAAG,GAAG,IAAI,MAAA,CAAO,MAAA,EAAQ,GAAG,CAAC,CAAA;AAC3D;AAKA,SAAS,kBAAA,GAA6B;AACpC,EAAA,MAAM,EAAA,GAAA,qBAAS,IAAA,EAAK,EAAE,aAAY,CAAE,OAAA,CAAQ,SAAS,GAAG,CAAA;AACxD,EAAA,MAAM,IAAA,GAAOZ,mBAAAA,EAAW,CAAE,KAAA,CAAM,GAAG,CAAC,CAAA;AACpC,EAAA,OAAO,CAAA,OAAA,EAAU,EAAE,CAAA,CAAA,EAAI,IAAI,CAAA,CAAA;AAC7B;AAEA,eAAsB,mBACpB,MAAA,EACwB;AACxB,EAAA,MAAM,EAAE,KAAA,EAAO,MAAA,EAAQ,OAAA,EAAQ,GAAI,MAAA;AAGnC,EAAA,MAAM,cAAA,GAAiB,gBAAA,CAAiB,oBAAA,EAAsB,MAAM,CAAA;AACpE,EAAA,IAAI,gBAAgB,OAAO,cAAA;AAG3B,EAAA,IAAI,CAAC,QAAQ,SAAA,EAAW;AACtB,IAAA,OAAO;AAAA,MACL,IAAA,EAAM,iEAAA;AAAA,MACN,UAAA,EAAY;AAAA,QACV,EAAA,EAAI,KAAA;AAAA,QACJ,IAAA,EAAM,2BAAA;AAAA,QACN,OAAA,EAAS;AAAA,OACX;AAAA,MACA,OAAA,EAAS;AAAA,KACX;AAAA,EACF;AAGA,EAAA,IAAI,CAAC,OAAA,CAAQ,SAAA,IAAa,CAAC,QAAQ,QAAA,EAAU;AAC3C,IAAA,OAAO;AAAA,MACL,IAAA,EAAM,sEAAA;AAAA,MACN,UAAA,EAAY;AAAA,QACV,EAAA,EAAI,KAAA;AAAA,QACJ,IAAA,EAAM,oBAAA;AAAA,QACN,OAAA,EAAS;AAAA,OACX;AAAA,MACA,OAAA,EAAS;AAAA,KACX;AAAA,EACF;AAGA,EAAA,IAAI,KAAA,CAAM,QAAA,CAAS,MAAA,GAAS,MAAA,CAAO,OAAO,mBAAA,EAAqB;AAC7D,IAAA,OAAO;AAAA,MACL,IAAA,EAAM,mBAAmB,KAAA,CAAM,QAAA,CAAS,MAAM,CAAA,2BAAA,EAA8B,MAAA,CAAO,OAAO,mBAAmB,CAAA,CAAA;AAAA,MAC7G,UAAA,EAAY;AAAA,QACV,EAAA,EAAI,KAAA;AAAA,QACJ,IAAA,EAAM,uBAAA;AAAA,QACN,OAAA,EAAS,GAAG,KAAA,CAAM,QAAA,CAAS,MAAM,CAAA,2BAAA,EAA8B,MAAA,CAAO,OAAO,mBAAmB,CAAA;AAAA,OAClG;AAAA,MACA,OAAA,EAAS;AAAA,KACX;AAAA,EACF;AAGA,EAAA,IAAI,iBAAA,GAAoB,CAAA;AACxB,EAAA,KAAA,MAAW,CAAA,IAAK,MAAM,QAAA,EAAU;AAC9B,IAAA,iBAAA,IAAqB,IAAI,WAAA,EAAY,CAAE,MAAA,CAAO,CAAC,CAAA,CAAE,MAAA;AAAA,EACnD;AACA,EAAA,IAAI,iBAAA,GAAoB,MAAA,CAAO,MAAA,CAAO,gBAAA,EAAkB;AACtD,IAAA,OAAO;AAAA,MACL,MAAM,CAAA,oCAAA,EAAuC,iBAAiB,CAAA,kBAAA,EAAqB,MAAA,CAAO,OAAO,gBAAgB,CAAA,CAAA;AAAA,MACjH,UAAA,EAAY;AAAA,QACV,EAAA,EAAI,KAAA;AAAA,QACJ,IAAA,EAAM,uBAAA;AAAA,QACN,SAAS,CAAA,oBAAA,EAAuB,iBAAiB,CAAA,kBAAA,EAAqB,MAAA,CAAO,OAAO,gBAAgB,CAAA;AAAA,OACtG;AAAA,MACA,OAAA,EAAS;AAAA,KACX;AAAA,EACF;AAGA,EAAA,MAAM,UAAA,GAAa,KAAA,CAAM,WAAA,IAAe,kBAAA,EAAmB;AAC3D,EAAA,IAAI;AACF,IAAA,kBAAA,CAAmB,UAAU,CAAA;AAAA,EAC/B,SAAS,GAAA,EAAK;AACZ,IAAA,OAAO;AAAA,MACL,IAAA,EAAM,2BAA2B,GAAA,YAAe,KAAA,GAAQ,IAAI,OAAA,GAAU,MAAA,CAAO,GAAG,CAAC,CAAA,CAAA;AAAA,MACjF,UAAA,EAAY;AAAA,QACV,EAAA,EAAI,KAAA;AAAA,QACJ,IAAA,EAAM,sBAAA;AAAA,QACN,SAAS,GAAA,YAAe,KAAA,GAAQ,GAAA,CAAI,OAAA,GAAU,OAAO,GAAG;AAAA,OAC1D;AAAA,MACA,OAAA,EAAS;AAAA,KACX;AAAA,EACF;AAGA,EAAA,MAAM,cAAcyB,iBAAAA,CAAiB,OAAA,CAAQ,UAAU,UAAA,EAAY,OAAA,CAAQ,UAAU,SAAS,CAAA;AAE9F,EAAA,IAAI,OAAA;AACJ,EAAA,IAAI;AAEF,IAAA,OAAA,GAAU,MAAM,aAAA,CAAc,OAAA,CAAQ,SAAS,CAAA;AAG/C,IAAA,MAAM,WAAA,GAAcC,aAAAA,CAAK,OAAA,EAAS,UAAU,CAAA;AAC5C,IAAA,MAAMC,cAAAA,CAAM,WAAA,EAAa,EAAE,IAAA,EAAM,KAAO,CAAA;AASxC,IAAA,MAAM,UAA0B,EAAC;AACjC,IAAA,IAAI,UAAA,GAAa,CAAA;AAIjB,IAAA,MAAM,UAAA,uBAAiB,GAAA,EAAY;AACnC,IAAA,MAAM,gBAA0B,EAAC;AAEjC,IAAA,KAAA,IAAS,IAAI,CAAA,EAAG,CAAA,GAAI,KAAA,CAAM,QAAA,CAAS,QAAQ,CAAA,EAAA,EAAK;AAE9C,MAAA,IAAI,MAAA,CAAO,QAAQ,OAAA,EAAS;AAC1B,QAAA,MAAM,IAAI,cAAA,CAAe,iBAAA,EAAmB,0CAA0C,CAAA;AAAA,MACxF;AAEA,MAAA,MAAM,GAAA,GAAM,KAAA,CAAM,QAAA,CAAS,CAAC,CAAA;AAC5B,MAAA,MAAM,IAAA,GAAO,IAAI,WAAA,EAAY,CAAE,OAAO,GAAG,CAAA;AACzC,MAAA,MAAM,IAAA,GAAO,MAAMrB,gBAAAA,CAAU,IAAI,CAAA;AAEjC,MAAA,IAAI,UAAA,CAAW,GAAA,CAAI,IAAI,CAAA,EAAG;AAC1B,MAAA,UAAA,CAAW,IAAI,IAAI,CAAA;AACnB,MAAA,aAAA,CAAc,KAAK,IAAI,CAAA;AAIvB,MAAA,MAAM,QAAA,GAAW,GAAG,IAAI,CAAA,IAAA,CAAA;AACxB,MAAA,MAAM,QAAA,GAAWoB,aAAAA,CAAK,WAAA,EAAa,QAAQ,CAAA;AAC3C,MAAA,MAAME,mBAAU,QAAA,EAAU,IAAA,EAAM,EAAE,IAAA,EAAM,KAAO,CAAA;AAC/C,MAAA,OAAA,CAAQ,IAAA,CAAK;AAAA,QACX,KAAA,EAAO,CAAA;AAAA,QACP,IAAA,EAAM,YAAY,QAAQ,CAAA,CAAA;AAAA,QAC1B,MAAA,EAAQ,IAAA;AAAA,QACR,QAAQ,IAAA,CAAK;AAAA,OACd,CAAA;AACD,MAAA,UAAA,IAAc,IAAA,CAAK,MAAA;AAAA,IACrB;AAMA,IAAA,OAAA,CAAQ,IAAA,CAAK,CAAC,CAAA,EAAG,CAAA,KAAM,EAAE,MAAA,CAAO,aAAA,CAAc,CAAA,CAAE,MAAM,CAAC,CAAA;AAIvD,IAAA,MAAM,YAAA,GAAe,CAAC,GAAG,aAAa,EAAE,IAAA,EAAK;AAC7C,IAAA,MAAM,aAAA,GAAgB,GAAG,OAAA,CAAQ,UAAU,IAAI,YAAA,CAAa,IAAA,CAAK,GAAG,CAAC,CAAA,CAAA;AACrE,IAAA,MAAM,QAAA,GAAW,MAAMtB,gBAAAA,CAAU,IAAI,aAAY,CAAE,MAAA,CAAO,aAAa,CAAC,CAAA;AAExE,IAAA,MAAM,QAAA,GAAW;AAAA,MACf,SAAA,EAAW,QAAA;AAAA,MACX,YAAA,EAAc,cAAA;AAAA,MACd,UAAA,EAAA,iBAAY,IAAI,IAAA,EAAK,EAAE,WAAA,EAAY;AAAA,MACnC,aAAa,OAAA,CAAQ,UAAA;AAAA,MACrB,eAAe,OAAA,CAAQ,MAAA;AAAA,MACvB,QAAA,EAAU,OAAA;AAAA,MACV,GAAI,MAAM,QAAA,GAAW,EAAE,UAAU,KAAA,CAAM,QAAA,KAAa;AAAC,KACvD;AAGA,IAAA,MAAM,YAAA,GAAe,oBAAoB,QAAQ,CAAA;AACjD,IAAA,MAAMsB,kBAAA,CAAUF,cAAK,OAAA,EAAS,eAAe,GAAG,YAAA,EAAc,EAAE,IAAA,EAAM,GAAA,EAAO,CAAA;AAC7E,IAAA,UAAA,IAAc,IAAI,WAAA,EAAY,CAAE,MAAA,CAAO,YAAY,CAAA,CAAE,MAAA;AAGrD,IAAA,MAAM,aAAA,GAAgB,IAAI,WAAA,EAAY,CAAE,OAAO,YAAY,CAAA;AAC3D,IAAA,MAAM,cAAA,GAAiB,MAAMpB,gBAAAA,CAAU,aAAa,CAAA;AAMpD,IAAA,MAAM,iBAAA,GAAoB,IAAA,CAAK,KAAA,CAAM,YAAY,CAAA;AACjD,IAAA,MAAM,cAAc,MAAMuB,WAAA;AAAA,MACxB,iBAAA;AAAA,MACA,QAAQ,SAAA,CAAU,UAAA;AAAA,MAClB,QAAQ,SAAA,CAAU;AAAA,KACpB;AACA,IAAA,MAAMD,kBAAA,CAAUF,cAAK,OAAA,EAAS,cAAc,GAAG,WAAA,EAAa,EAAE,IAAA,EAAM,GAAA,EAAO,CAAA;AAC3E,IAAA,UAAA,IAAc,IAAI,WAAA,EAAY,CAAE,MAAA,CAAO,WAAW,CAAA,CAAE,MAAA;AAGpD,IAAA,MAAM,SAAA,GAAY,QAAQ,MAAA,GAAS,CAAA;AAGnC,IAAA,MAAM,SAAA,GAAYA,aAAAA,CAAK,OAAA,CAAQ,SAAA,EAAW,UAAU,CAAA;AAGpD,IAAA,IAAI;AACF,MAAA,MAAMlB,cAAK,SAAS,CAAA;AAEpB,MAAA,OAAO;AAAA,QACL,IAAA,EAAM,uDAAuD,UAAU,CAAA,CAAA;AAAA,QACvE,UAAA,EAAY;AAAA,UACV,EAAA,EAAI,KAAA;AAAA,UACJ,IAAA,EAAM,qBAAA;AAAA,UACN,OAAA,EAAS,+BAA+B,UAAU,CAAA;AAAA,SACpD;AAAA,QACA,OAAA,EAAS;AAAA,OACX;AAAA,IACF,SAAS,GAAA,EAAK;AAEZ,MAAA,IAAK,GAAA,CAA8B,SAAS,QAAA,EAAU;AACpD,QAAA,MAAM,GAAA;AAAA,MACR;AAAA,IACF;AAEA,IAAA,MAAM,cAAA,CAAe,SAAS,SAAS,CAAA;AACvC,IAAA,OAAA,GAAU,KAAA,CAAA;AAEV,IAAA,MAAM,EAAA,GAAK,gBAAA;AAAA,MACT,CAAA,gBAAA,EAAmB,UAAU,CAAA,EAAA,EAAK,SAAS,WAAW,UAAU,CAAA,OAAA,CAAA;AAAA,MAChE;AAAA,KACF;AACA,IAAA,MAAM,QAAA,GAAW,cAAA,CAAe,EAAA,CAAG,IAAA,EAAM,WAAW,CAAA;AAMpD,IAAA,OAAO;AAAA,MACL,IAAA,EAAM,QAAA;AAAA,MACN,UAAA,EAAY;AAAA,QACV,EAAA,EAAI,IAAA;AAAA,QACJ,QAAA;AAAA,QACA,UAAA,EAAY,UAAA;AAAA,QACZ,cAAc,OAAA,CAAQ,MAAA;AAAA,QACtB,SAAA;AAAA,QACA,UAAA;AAAA,QACA,WAAW,QAAA,CAAS,UAAA;AAAA,QACpB;AAAA;AACF,KACF;AAAA,EACF,SAAS,GAAA,EAAK;AAEZ,IAAA,IAAI,OAAA,EAAS;AACX,MAAA,IAAI;AACF,QAAA,MAAMe,YAAG,OAAA,EAAS,EAAE,WAAW,IAAA,EAAM,KAAA,EAAO,MAAM,CAAA;AAAA,MACpD,CAAA,CAAA,MAAQ;AAAA,MAER;AAAA,IACF;AAEA,IAAA,MAAM,aAAa,GAAA,YAAe,KAAA,GAAQ,GAAA,CAAI,OAAA,GAAU,OAAO,GAAG,CAAA;AAClE,IAAA,MAAM,WAAA,GAAc,cAAA,CAAe,UAAA,EAAY,WAAW,CAAA;AAE1D,IAAA,IAAI,eAAe,cAAA,EAAgB;AACjC,MAAA,OAAO;AAAA,QACL,IAAA,EAAM,2BAA2B,WAAW,CAAA,CAAA;AAAA,QAC5C,UAAA,EAAY;AAAA,UACV,EAAA,EAAI,KAAA;AAAA,UACJ,MAAM,GAAA,CAAI,IAAA;AAAA,UACV,OAAA,EAAS;AAAA,SACX;AAAA,QACA,OAAA,EAAS;AAAA,OACX;AAAA,IACF;AAEA,IAAA,OAAO;AAAA,MACL,IAAA,EAAM,2BAA2B,WAAW,CAAA,CAAA;AAAA,MAC5C,UAAA,EAAY;AAAA,QACV,EAAA,EAAI,KAAA;AAAA,QACJ,IAAA,EAAM,qBAAA;AAAA,QACN,OAAA,EAAS;AAAA,OACX;AAAA,MACA,OAAA,EAAS;AAAA,KACX;AAAA,EACF;AACF;ACnUO,IAAM,iBAAA,GAAoBlB,MAAE,MAAA,CAAO;AAAA,EACxC,GAAA,EAAKA,KAAAA,CAAE,MAAA,EAAO,CAAE,SAAS,sDAAsD,CAAA;AAAA,EAC/E,sBAAsBA,KAAAA,CACnB,MAAA,GACA,QAAA,EAAS,CACT,SAAS,qDAAqD,CAAA;AAAA,EACjE,MAAMA,KAAAA,CAAE,MAAA,GAAS,QAAA,EAAS,CAAE,SAAS,+CAA+C,CAAA;AAAA,EACpF,QAAQA,KAAAA,CAAE,MAAA,GAAS,QAAA,EAAS,CAAE,SAAS,uCAAuC,CAAA;AAAA,EAC9E,UAAUA,KAAAA,CAAE,MAAA,GAAS,QAAA,EAAS,CAAE,SAAS,yCAAyC;AACpF,CAAC,CAAA;AAID,IAAM,UAAA,GAAaA,MAAE,MAAA,CAAO;AAAA,EAC1B,aAAA,EAAeA,MAAE,MAAA,EAAO;AAAA,EACxB,UAAA,EAAYA,MAAE,MAAA,EAAO;AAAA,EACrB,eAAA,EAAiBA,MAAE,MAAA;AACrB,CAAC,CAAA;AAED,IAAM,WAAA,GAAcA,MAAE,MAAA,CAAO;AAAA,EAC3B,IAAA,EAAMA,MAAE,MAAA,EAAO;AAAA,EACf,MAAA,EAAQA,MAAE,OAAA,EAAQ;AAAA,EAClB,OAAA,EAASA,KAAAA,CAAE,MAAA,EAAO,CAAE,QAAA;AACtB,CAAC,CAAA;AAEM,IAAM,kBAAA,GAAqBA,MAAE,MAAA,CAAO;AAAA,EACzC,KAAA,EAAO,UAAA;AAAA,EACP,EAAA,EAAIA,MAAE,OAAA,EAAQ;AAAA,EACd,IAAA,EAAMA,KAAAA,CAAE,MAAA,EAAO,CAAE,QAAA,EAAS;AAAA,EAC1B,OAAA,EAASA,KAAAA,CAAE,MAAA,EAAO,CAAE,QAAA,EAAS;AAAA,EAC7B,OAAA,EAASA,KAAAA,CAAE,MAAA,EAAO,CAAE,QAAA,EAAS;AAAA,EAC7B,MAAA,EAAQA,KAAAA,CAAE,KAAA,CAAM,WAAW,CAAA;AAAA,EAC3B,aAAA,EAAeA,KAAAA,CAAE,MAAA,CAAOA,KAAAA,CAAE,MAAA,IAAUA,KAAAA,CAAE,OAAA,EAAS,CAAA,CAAE,QAAA,EAAS;AAAA,EAC1D,SAAA,EAAWA,KAAAA,CAAE,MAAA,EAAO,CAAE,QAAA;AACxB,CAAC,CAAA;AClCM,IAAM,kBAAA,GAAqBA,MAAE,MAAA,CAAO;AAAA,EACzC,GAAA,EAAKA,KAAAA,CAAE,MAAA,EAAO,CAAE,SAAS,sCAAsC,CAAA;AAAA,EAC/D,WAAA,EAAaA,KAAAA,CACV,OAAA,EAAQ,CACR,QAAA,GACA,OAAA,CAAQ,KAAK,CAAA,CACb,QAAA,CAAS,yDAAyD;AACvE,CAAC,CAAA;AAID,IAAMyB,WAAAA,GAAazB,MAAE,MAAA,CAAO;AAAA,EAC1B,aAAA,EAAeA,MAAE,MAAA,EAAO;AAAA,EACxB,UAAA,EAAYA,MAAE,MAAA,EAAO;AAAA,EACrB,eAAA,EAAiBA,MAAE,MAAA;AACrB,CAAC,CAAA;AAEM,IAAM,mBAAA,GAAsBA,MAAE,MAAA,CAAO;AAAA,EAC1C,KAAA,EAAOyB,WAAAA;AAAA,EACP,MAAA,EAAQzB,MAAE,MAAA,CAAOA,KAAAA,CAAE,QAAO,EAAGA,KAAAA,CAAE,SAAS,CAAA;AAAA,EACxC,WAAA,EAAaA,MAAE,MAAA,CAAO;AAAA,IACpB,OAAA,EAASA,MAAE,MAAA,EAAO;AAAA,IAClB,MAAA,EAAQA,KAAAA,CAAE,MAAA,EAAO,CAAE,QAAA,EAAS;AAAA,IAC5B,QAAA,EAAUA,KAAAA,CAAE,MAAA,EAAO,CAAE,QAAA,EAAS;AAAA,IAC9B,QAAA,EAAUA,KAAAA,CAAE,MAAA,EAAO,CAAE,QAAA,EAAS;AAAA,IAC9B,SAAA,EAAWA,KAAAA,CAAE,MAAA,EAAO,CAAE,QAAA,EAAS;AAAA,IAC/B,SAAA,EAAWA,KAAAA,CAAE,MAAA,EAAO,CAAE,QAAA;AAAS,GAChC,CAAA;AAAA,EACD,WAAA,EAAaA,KAAAA,CAAE,MAAA,CAAOA,KAAAA,CAAE,MAAA,IAAUA,KAAAA,CAAE,OAAA,EAAS,CAAA,CAAE,QAAA,EAAS;AAAA,EACxD,QAAA,EAAUA,MAAE,OAAA,EAAQ;AAAA,EACpB,QAAA,EAAUA,KAAAA,CAAE,OAAA,CAAQ,KAAK;AAC3B,CAAC,CAAA;AC/BM,IAAM,iBAAA,GAAoBA,MAAE,MAAA,CAAO;AAAA,EACxC,GAAA,EAAKA,KAAAA,CAAE,MAAA,EAAO,CAAE,SAAS,qCAAqC;AAChE,CAAC,CAAA;AAID,IAAMyB,WAAAA,GAAazB,MAAE,MAAA,CAAO;AAAA,EAC1B,aAAA,EAAeA,MAAE,MAAA,EAAO;AAAA,EACxB,UAAA,EAAYA,MAAE,MAAA,EAAO;AAAA,EACrB,eAAA,EAAiBA,MAAE,MAAA;AACrB,CAAC,CAAA;AAEM,IAAM,kBAAA,GAAqBA,MAAE,MAAA,CAAO;AAAA,EACzC,KAAA,EAAOyB,WAAAA;AAAA,EACP,MAAA,EAAQzB,MAAE,MAAA,CAAOA,KAAAA,CAAE,QAAO,EAAGA,KAAAA,CAAE,SAAS,CAAA;AAAA,EACxC,OAAA,EAASA,MAAE,MAAA,CAAOA,KAAAA,CAAE,QAAO,EAAGA,KAAAA,CAAE,SAAS,CAAA;AAAA,EACzC,QAAA,EAAUA,KAAAA,CAAE,OAAA,CAAQ,KAAK;AAC3B,CAAC,CAAA;ACbM,IAAM,gBAAA,GAAmBA,MAAE,MAAA,CAAO;AAAA,EACvC,IAAA,EAAMA,MACH,IAAA,CAAK,CAAC,YAAY,WAAW,CAAC,CAAA,CAC9B,QAAA,CAAS,gFAAgF,CAAA;AAAA,EAC5F,IAAA,EAAMA,MACH,MAAA,EAAO,CACP,IAAI,CAAC,CAAA,CACL,GAAA,CAAI,GAAG,CAAA,CACP,MAAA;AAAA,IACC,CAAC,MACC,cAAA,CAAe,IAAA,CAAK,CAAC,CAAA,IACrB,2DAAA,CAA4D,KAAK,CAAC,CAAA;AAAA,IACpE;AAAA,MACE,OAAA,EACE;AAAA;AACJ,GACF,CACC,SAAS,mFAAmF,CAAA;AAAA,EAC/F,GAAA,EAAKA,KAAAA,CACF,MAAA,EAAO,CACP,GAAA,CAAI,IAAI,CAAA,CACR,QAAA,EAAS,CACT,QAAA,CAAS,qDAAqD,CAAA;AAAA,EACjE,SAASA,KAAAA,CACN,KAAA;AAAA,IACCA,MAAE,IAAA,CAAK;AAAA,MACL,QAAA;AAAA,MACA,aAAA;AAAA,MACA,UAAA;AAAA,MACA,YAAA;AAAA,MACA,SAAA;AAAA,MACA,UAAA;AAAA,MACA,SAAA;AAAA,MACA,YAAA;AAAA,MACA,SAAA;AAAA,MACA;AAAA,KACD;AAAA,GACH,CACC,UAAS,CACT,MAAA;AAAA,IACC,CAAC,GAAA,KACC,CAAC,GAAA,IAAQ,IAAI,IAAI,GAAG,CAAA,CAAE,IAAA,KAAS,GAAA,CAAI,MAAA,IAAU,CAAC,GAAG,GAAG,CAAA,CAAE,IAAA,EAAK,CAAE,KAAA,CAAM,CAAC,GAAG,CAAA,KAAM,CAAA,KAAM,GAAA,CAAI,CAAC,CAAC,CAAA;AAAA,IAC3F,EAAE,SAAS,6CAAA;AAA8C,GAC3D,CACC,SAAS,mEAAmE,CAAA;AAAA,EAC/E,aAAaA,KAAAA,CACV,MAAA,EAAO,CACP,QAAA,GACA,MAAA,CAAO,CAAC,CAAA,KAAM,CAAC,KAAK,CAAC,KAAA,CAAM,KAAK,KAAA,CAAM,CAAC,CAAC,CAAA,EAAG;AAAA,IAC1C,OAAA,EAAS;AAAA,GACV,CAAA,CACA,QAAA,CAAS,mEAAmE,CAAA;AAAA,EAC/E,UAAA,EAAYA,KAAAA,CACT,MAAA,CAAOA,KAAAA,CAAE,MAAA,EAAO,EAAGA,KAAAA,CAAE,OAAA,EAAS,CAAA,CAC9B,QAAA,EAAS,CACT,SAAS,kDAAkD,CAAA;AAAA,EAC9D,MAAA,EAAQA,MACL,MAAA,CAAO;AAAA,IACN,GAAA,EAAKA,MACF,MAAA,EAAO,CACP,KAAI,CACJ,GAAA,CAAI,IAAI,CAAA,CACR,MAAA,CAAO,CAAC,MAAM,CAAA,CAAE,UAAA,CAAW,UAAU,CAAA,EAAG,EAAE,SAAS,2BAAA,EAA6B,CAAA,CAChF,QAAA,CAAS,kCAAkC,CAAA;AAAA,IAC9C,OAAA,EAASA,KAAAA,CAAE,MAAA,EAAO,CAAE,GAAA,CAAI,GAAG,CAAA,CAAE,QAAA,EAAS,CAAE,QAAA,CAAS,gBAAgB,CAAA;AAAA,IACjE,MAAA,EAAQA,KAAAA,CACL,MAAA,EAAO,CACP,KAAA,CAAM,uBAAuB,CAAA,CAC7B,QAAA,EAAS,CACT,QAAA,CAAS,yCAAyC;AAAA,GACtD,CAAA,CACA,QAAA,EAAS,CACT,SAAS,sBAAsB,CAAA;AAAA,EAClC,WAAA,EAAaA,KAAAA,CACV,MAAA,EAAO,CACP,GAAA,EAAI,CACJ,QAAA,EAAS,CACT,QAAA,EAAS,CACT,QAAA,CAAS,2DAA2D;AACzE,CAAC,CAAA;AAID,IAAMyB,WAAAA,GAAazB,MAAE,MAAA,CAAO;AAAA,EAC1B,aAAA,EAAeA,MAAE,MAAA,EAAO;AAAA,EACxB,UAAA,EAAYA,MAAE,MAAA,EAAO;AAAA,EACrB,eAAA,EAAiBA,MAAE,MAAA;AACrB,CAAC,CAAA;AAED,IAAM,mBAAA,GAAsBA,MAAE,MAAA,CAAO;AAAA,EACnC,GAAA,EAAKA,MAAE,MAAA,EAAO;AAAA,EACd,IAAA,EAAMA,MAAE,MAAA,EAAO;AAAA,EACf,IAAA,EAAMA,MAAE,MAAA,EAAO;AAAA,EACf,GAAA,EAAKA,MAAE,MAAA,EAAO;AAAA,EACd,GAAA,EAAKA,MAAE,MAAA,EAAO;AAAA,EACd,GAAA,EAAKA,KAAAA,CAAE,MAAA,EAAO,CAAE,QAAA,EAAS;AAAA,EACzB,SAASA,KAAAA,CAAE,KAAA,CAAMA,MAAE,MAAA,EAAQ,EAAE,QAAA;AAC/B,CAAC,CAAA;AAEM,IAAM,iBAAA,GAAoBA,MAAE,MAAA,CAAO;AAAA,EACxC,KAAA,EAAOyB,WAAAA;AAAA,EACP,EAAA,EAAIzB,MAAE,OAAA,EAAQ;AAAA,EACd,GAAA,EAAKA,MAAE,MAAA,EAAO;AAAA,EACd,aAAA,EAAe;AACjB,CAAC,CAAA;AC5GM,IAAM,iBAAA,GAAoBA,MAAE,MAAA,CAAO;AAAA,EACxC,UAAUA,KAAAA,CACP,KAAA,CAAMA,KAAAA,CAAE,MAAA,GAAS,GAAA,CAAI,KAAM,CAAC,CAAA,CAC5B,IAAI,CAAC,CAAA,CACL,IAAI,GAAG,CAAA,CACP,SAAS,uCAAuC,CAAA;AAAA,EACnD,QAAA,EAAUA,KAAAA,CACP,MAAA,CAAOA,KAAAA,CAAE,MAAA,EAAO,EAAGA,KAAAA,CAAE,OAAA,EAAS,CAAA,CAC9B,QAAA,EAAS,CACT,SAAS,8CAA8C,CAAA;AAAA,EAC1D,WAAA,EAAaA,KAAAA,CACV,MAAA,EAAO,CACP,GAAA,CAAI,GAAG,CAAA,CACP,QAAA,EAAS,CACT,QAAA,CAAS,4DAA4D;AAC1E,CAAC,CAAA;AAID,IAAMyB,WAAAA,GAAazB,MAAE,MAAA,CAAO;AAAA,EAC1B,aAAA,EAAeA,MAAE,MAAA,EAAO;AAAA,EACxB,UAAA,EAAYA,MAAE,MAAA,EAAO;AAAA,EACrB,eAAA,EAAiBA,MAAE,MAAA;AACrB,CAAC,CAAA;AAEM,IAAM,kBAAA,GAAqBA,MAAE,MAAA,CAAO;AAAA,EACzC,KAAA,EAAOyB,WAAAA;AAAA,EACP,EAAA,EAAIzB,MAAE,OAAA,EAAQ;AAAA,EACd,QAAA,EAAUA,MAAE,MAAA,EAAO;AAAA,EACnB,UAAA,EAAYA,MAAE,MAAA,EAAO;AAAA,EACrB,YAAA,EAAcA,MAAE,MAAA,EAAO;AAAA,EACvB,SAAA,EAAWA,MAAE,MAAA,EAAO;AAAA,EACpB,UAAA,EAAYA,MAAE,MAAA,EAAO;AAAA,EACrB,SAAA,EAAWA,MAAE,MAAA,EAAO;AAAA,EACpB,cAAA,EAAgBA,MAAE,MAAA;AACpB,CAAC,CAAA;;;AZHD,SAAS,QAAA,CAAS,KAAoB,UAAA,EAA6C;AACjF,EAAA,OAAO;AAAA,IACL,UAAA;AAAA,IACA,eAAe,GAAA,CAAI,OAAA;AAAA,IACnB,YAAY,GAAA,CAAI,UAAA;AAAA,IAChB,iBAAiB,GAAA,CAAI,eAAA;AAAA,IACrB,iBAAA,EAAmB;AAAA,GACrB;AACF;AAEA,SAAS,6BAAA,CACP,QACA,IAAA,EACgB;AAChB,EAAA,OAAO;AAAA,IACL,OAAA,EAAS,CAAC,EAAE,IAAA,EAAM,QAAiB,IAAA,EAAM,MAAA,CAAO,MAAM,CAAA;AAAA,IACtD,mBAAmB,EAAE,KAAA,EAAO,IAAA,EAAM,GAAG,OAAO,UAAA,EAAW;AAAA,IACvD,SAAS,MAAA,CAAO;AAAA,GAClB;AACF;AAEA,IAAM,qBAAA,GAAyC;AAAA,EAC7C,YAAA,EAAc,IAAA;AAAA,EACd,eAAA,EAAiB,KAAA;AAAA,EACjB,cAAA,EAAgB,IAAA;AAAA,EAChB,aAAA,EAAe;AACjB,CAAA;AAMA,IAAM,sBAAA,GAA0C;AAAA,EAC9C,YAAA,EAAc,IAAA;AAAA,EACd,eAAA,EAAiB,KAAA;AAAA,EACjB,cAAA,EAAgB,KAAA;AAAA,EAChB,aAAA,EAAe;AACjB,CAAA;AAEA,IAAM,uBAAA,GAA2C;AAAA,EAC/C,YAAA,EAAc,KAAA;AAAA,EACd,eAAA,EAAiB,IAAA;AAAA,EACjB,cAAA,EAAgB,KAAA;AAAA,EAChB,aAAA,EAAe;AACjB,CAAA;AAEA,IAAM,eAAA,GAAkB,EAAA;AAExB,SAAS,mBAAA,CACP,IAAA,EACA,IAAA,EACA,OAAA,EACgB;AAChB,EAAA,MAAM,QAAA,GAAW0B,cAAO,IAAI,CAAA;AAC5B,EAAA,OAAO;AAAA,IACL,SAAS,CAAC,EAAE,MAAM,MAAA,EAAiB,IAAA,EAAM,SAAS,CAAA;AAAA,IAClD,iBAAA,EAAmB;AAAA,MACjB,KAAA,EAAO,IAAA;AAAA,MACP,EAAA,EAAI,KAAA;AAAA,MACJ,IAAA;AAAA,MACA,OAAA;AAAA,MACA,SAAA,EAAW,UAAU,SAAA,IAAa,KAAA;AAAA,MAClC,WAAA,EAAa,UAAU,WAAA,IAAe;AAAA,KACxC;AAAA,IACA,OAAA,EAAS;AAAA,GACX;AACF;AA2BO,SAAS,oBAAoB,OAAA,EAAmC;AACrE,EAAA,MAAM,EAAE,OAAA,EAAS,MAAA,EAAQ,OAAA,EAAQ,GAAI,OAAA;AAGrC,EAAA,MAAM,eAAA,GAAkB,CAAC,aAAA,EAAe,cAAA,EAAgB,aAAa,CAAA;AACrE,EAAA,IAAI,OAAA,CAAQ,SAAA,IAAa,OAAA,CAAQ,QAAA,EAAU;AACzC,IAAA,eAAA,CAAgB,KAAK,YAAY,CAAA;AACjC,IAAA,IAAI,QAAQ,SAAA,EAAW;AACrB,MAAA,eAAA,CAAgB,KAAK,oBAAoB,CAAA;AAAA,IAC3C;AAAA,EACF;AAEA,EAAA,MAAM,OAAO,EAAE,GAAG,SAAS,OAAA,EAAS,WAAW,GAAG,eAAA,EAAgB;AAClE,EAAA,MAAM,cAAA,GAAiB,OAAO,MAAA,CAAO,eAAA;AACrC,EAAA,IAAI,cAAA,GAAiB,CAAA;AAErB,EAAA,eAAe,WAAA,CACb,QAAA,EACA,IAAA,EACA,SAAA,EACA,MAAA,EACyB;AAEzB,IAAA,IAAI,QAAQ,OAAA,EAAS;AACnB,MAAA,OAAO,mBAAA,CAAoB,IAAA,EAAM,iBAAA,EAAmB,mBAAmB,CAAA;AAAA,IACzE;AAGA,IAAA,IAAI,kBAAkB,cAAA,EAAgB;AACpC,MAAA,OAAO,mBAAA;AAAA,QACL,IAAA;AAAA,QACA,yBAAA;AAAA,QACA,uBAAuB,cAAc,CAAA,qBAAA;AAAA,OACvC;AAAA,IACF;AAGA,IAAA,IAAI,CAAC,gBAAA,CAAiB,IAAA,EAAM,eAAe,CAAA,EAAG;AAC5C,MAAA,OAAO,mBAAA;AAAA,QACL,IAAA;AAAA,QACA,sBAAA;AAAA,QACA,0CAA0C,eAAe,CAAA;AAAA,OAC3D;AAAA,IACF;AAGA,IAAA,MAAM,eAAA,GAAkB,eAAA,CAAgB,IAAA,EAAM,MAAM,CAAA;AACpD,IAAA,IAAI,eAAA,EAAiB;AACnB,MAAA,OAAO,6BAAA,CAA8B,iBAAiB,IAAI,CAAA;AAAA,IAC5D;AAcA,IAAA,cAAA,EAAA;AACA,IAAA,MAAM,cAAA,GAAiB,UAAU,MAAM,CAAA;AAIvC,IAAA,KAAK,cAAA,CACF,QAAQ,MAAM;AACb,MAAA,cAAA,EAAA;AAAA,IACF,CAAC,CAAA,CACA,KAAA,CAAM,MAAM;AAAA,IAAC,CAAC,CAAA;AAKjB,IAAA,IAAI,QAAA,GAAW,KAAA;AACf,IAAA,IAAI,SAAA,GAAY,KAAA;AAChB,IAAA,IAAI,KAAA;AACJ,IAAA,MAAM,cAAA,GAAiB,IAAI,OAAA,CAAe,CAAC,UAAU,MAAA,KAAW;AAC9D,MAAA,KAAA,GAAQ,WAAW,MAAM;AACvB,QAAA,QAAA,GAAW,IAAA;AACX,QAAA,MAAA,CAAO,IAAI,MAAM,CAAA,MAAA,EAAS,QAAQ,qBAAqB,MAAA,CAAO,MAAA,CAAO,eAAe,CAAA,EAAA,CAAI,CAAC,CAAA;AAAA,MAC3F,CAAA,EAAG,MAAA,CAAO,MAAA,CAAO,eAAe,CAAA;AAEhC,MAAA,KAAA,CAAM,KAAA,IAAQ;AAAA,IAChB,CAAC,CAAA;AAGD,IAAA,MAAM,gBAAA,GAA6C,CAAC,cAAA,EAAgB,cAAc,CAAA;AAElF,IAAA,IAAI,YAAA;AACJ,IAAA,IAAI,MAAA,IAAU,CAAC,MAAA,CAAO,OAAA,EAAS;AAC7B,MAAA,MAAM,aAAA,GAAgB,IAAI,OAAA,CAAe,CAAC,UAAU,MAAA,KAAW;AAC7D,QAAA,MAAM,UAAU,MAAM;AACpB,UAAA,SAAA,GAAY,IAAA;AACZ,UAAA,MAAA,CAAO,IAAI,KAAA,CAAM,mBAAmB,CAAC,CAAA;AAAA,QACvC,CAAA;AACA,QAAA,MAAA,CAAO,iBAAiB,OAAA,EAAS,OAAA,EAAS,EAAE,IAAA,EAAM,MAAM,CAAA;AACxD,QAAA,YAAA,GAAe,MAAM,MAAA,CAAO,mBAAA,CAAoB,OAAA,EAAS,OAAO,CAAA;AAAA,MAClE,CAAC,CAAA;AACD,MAAA,gBAAA,CAAiB,KAAK,aAAa,CAAA;AAAA,IACrC;AAEA,IAAA,IAAI;AACF,MAAA,MAAM,MAAA,GAAS,MAAM,OAAA,CAAQ,IAAA,CAAK,gBAAgB,CAAA;AAOlD,MAAA,MAAM,UAAA,GAAa,6BAAA,CAA8B,MAAA,EAAQ,IAAI,CAAA;AAC7D,MAAA,MAAM,WAAA,GAAc,qBAAqB,UAAU,CAAA;AACnD,MAAA,IAAI,WAAA,GAAc,MAAA,CAAO,MAAA,CAAO,kBAAA,EAAoB;AAClD,QAAA,OAAO,mBAAA;AAAA,UACL,IAAA;AAAA,UACA,wBAAA;AAAA,UACA,CAAA,YAAA,EAAe,WAAW,CAAA,2BAAA,EAA8B,MAAA,CAAO,OAAO,kBAAkB,CAAA;AAAA,SAC1F;AAAA,MACF;AAEA,MAAA,OAAO,UAAA;AAAA,IACT,SAAS,GAAA,EAAK;AACZ,MAAA,MAAM,UAAU,GAAA,YAAe,KAAA,GAAQ,GAAA,CAAI,OAAA,GAAU,OAAO,GAAG,CAAA;AAC/D,MAAA,IAAI,SAAA,EAAW;AACb,QAAA,OAAO,mBAAA,CAAoB,IAAA,EAAM,iBAAA,EAAmB,mBAAmB,CAAA;AAAA,MACzE;AACA,MAAA,IAAI,QAAA,EAAU;AACZ,QAAA,OAAO,mBAAA,CAAoB,IAAA,EAAM,oBAAA,EAAsB,OAAO,CAAA;AAAA,MAChE;AACA,MAAA,OAAO,mBAAA,CAAoB,IAAA,EAAM,gBAAA,EAAkB,OAAO,CAAA;AAAA,IAC5D,CAAA,SAAE;AACA,MAAA,YAAA,CAAa,KAAK,CAAA;AAClB,MAAA,YAAA,IAAe;AAAA,IACjB;AAAA,EACF;AAEA,EAAA,MAAM,SAAS,IAAIC,gBAAA;AAAA,IACjB,EAAE,IAAA,EAAM,WAAA,EAAa,OAAA,EAAQ;AAAA;AAAA;AAAA,IAG7B,EAAE,cAAc,EAAE,KAAA,EAAO,EAAE,WAAA,EAAa,KAAA,IAAQ;AAAE,GACpD;AAGA,EAAA,MAAM,QAAA,GAAW,MAAA,CAAO,YAAA,CAAa,IAAA,CAAK,MAAM,CAAA;AAGhD,EAAA,QAAA;AAAA,IACE,aAAA;AAAA,IACA;AAAA,MACE,KAAA,EAAO,qBAAA;AAAA,MACP,WAAA,EACE,mIAAA;AAAA,MACF,WAAA,EAAa,iBAAA;AAAA,MACb,YAAA,EAAc,kBAAA;AAAA,MACd,WAAA,EAAa;AAAA,KACf;AAAA,IACA,OAAO,MAAM,KAAA,KACX,WAAA;AAAA,MACE,aAAA;AAAA,MACA,IAAA;AAAA,MACA,CAAC,WAAW,YAAA,CAAa,EAAE,OAAO,IAAA,EAAqB,MAAA,EAAQ,OAAA,EAAS,MAAA,EAAQ,CAAA;AAAA,MAC/E,KAAA,CAAmC;AAAA;AACtC,GACJ;AAGA,EAAA,QAAA;AAAA,IACE,cAAA;AAAA,IACA;AAAA,MACE,KAAA,EAAO,sBAAA;AAAA,MACP,WAAA,EACE,8HAAA;AAAA,MACF,WAAA,EAAa,kBAAA;AAAA,MACb,YAAA,EAAc,mBAAA;AAAA,MACd,WAAA,EAAa;AAAA,KACf;AAAA,IACA,OAAO,MAAM,KAAA,KACX,WAAA;AAAA,MACE,cAAA;AAAA,MACA,IAAA;AAAA,MACA,CAAC,WAAW,aAAA,CAAc,EAAE,OAAO,IAAA,EAAsB,MAAwB,CAAC,CAAA;AAAA,MACjF,KAAA,CAAmC;AAAA;AACtC,GACJ;AAGA,EAAA,QAAA;AAAA,IACE,aAAA;AAAA,IACA;AAAA,MACE,KAAA,EAAO,qBAAA;AAAA,MACP,WAAA,EACE,yHAAA;AAAA,MACF,WAAA,EAAa,iBAAA;AAAA,MACb,YAAA,EAAc,kBAAA;AAAA,MACd,WAAA,EAAa;AAAA,KACf;AAAA,IACA,OAAO,MAAM,KAAA,KACX,WAAA;AAAA,MACE,aAAA;AAAA,MACA,IAAA;AAAA,MACA,CAAC,WAAW,YAAA,CAAa,EAAE,OAAO,IAAA,EAAqB,MAAwB,CAAC,CAAA;AAAA,MAC/E,KAAA,CAAmC;AAAA;AACtC,GACJ;AAKA,EAAA,IAAI,OAAA,CAAQ,SAAA,IAAa,OAAA,CAAQ,QAAA,EAAU;AACzC,IAAA,QAAA;AAAA,MACE,YAAA;AAAA,MACA;AAAA,QACE,KAAA,EAAO,6BAAA;AAAA,QACP,WAAA,EACE,iPAAA;AAAA,QACF,WAAA,EAAa,gBAAA;AAAA,QACb,YAAA,EAAc,iBAAA;AAAA,QACd,WAAA,EAAa;AAAA,OACf;AAAA,MACA,OAAO,MAAM,KAAA,KACX,WAAA;AAAA,QACE,YAAA;AAAA,QACA,IAAA;AAAA,QACA,CAAC,WAAW,WAAA,CAAY,EAAE,OAAO,IAAA,EAAoB,MAAA,EAAQ,OAAgB,CAAC,CAAA;AAAA,QAC7E,KAAA,CAAmC;AAAA;AACtC,KACJ;AAGA,IAAA,IAAI,QAAQ,SAAA,EAAW;AACrB,MAAA,QAAA;AAAA,QACE,oBAAA;AAAA,QACA;AAAA,UACE,KAAA,EAAO,wBAAA;AAAA,UACP,WAAA,EACE,6JAAA;AAAA,UACF,WAAA,EAAa,iBAAA;AAAA,UACb,YAAA,EAAc,kBAAA;AAAA,UACd,WAAA,EAAa;AAAA,SACf;AAAA,QACA,OAAO,MAAM,KAAA,KACX,WAAA;AAAA,UACE,oBAAA;AAAA,UACA,IAAA;AAAA,UACA,CAAC,WAAW,kBAAA,CAAmB,EAAE,OAAO,IAAA,EAAqB,MAAA,EAAQ,OAAA,EAAS,MAAA,EAAQ,CAAA;AAAA,UACrF,KAAA,CAAmC;AAAA;AACtC,OACJ;AAAA,IACF;AAAA,EACF;AAEA,EAAA,OAAO,MAAA;AACT;;;ANzWA,IAAM,OAAA,GAAU,IAAIC,iBAAA,EAAQ;AAE5B,OAAA,CACG,IAAA,CAAK,WAAW,CAAA,CAChB,OAAA,CAAQ,cAAc,CAAA,CACtB,WAAA,CAAY,sCAAsC,CAAA,CAClD,MAAA,CAAO,sBAAsB,8CAA8C,CAAA,CAC3E,OAAO,mBAAA,EAAqB,uBAAuB,EACnD,MAAA,CAAO,iBAAA,EAAmB,gCAAgC,CAAA,CAC1D,MAAA,CAAO,oBAAA,EAAsB,uCAAuC,CAAA,CACpE,MAAA,CAAO,uBAAuB,sCAAsC,CAAA,CACpE,OAAO,oBAAA,EAAsB,oCAAA,EAAsC,OAAO,CAAA,CAC1E,MAAA,CAAO,iBAAA,EAAmB,wCAAwC,MAAM,CAAA,CACxE,OAAO,kBAAA,EAAoB,wCAAA,EAA0C,WAAW,CAAA,CAChF,MAAA,CAAO,uBAAA,EAAyB,wCAAwC,CAAA,CACxE,MAAA;AAAA,EACC,gCAAA;AAAA,EACA;AACF,CAAA,CACC,MAAA,CAAO,oBAAA,EAAsB,wDAAwD,CAAA,CACrF,MAAA;AAAA,EACC,uBAAA;AAAA,EACA,+GAAA;AAAA,EACA;AACF,CAAA,CACC,MAAA,CAAO,OAAO,IAAA,KAAS;AAEtB,EAAA,MAAM,gBAAgB,IAAA,CAAK,SAAA;AAC3B,EAAA,IAAI,aAAA,KAAkB,OAAA,IAAW,aAAA,KAAkB,MAAA,EAAQ;AACzD,IAAA,OAAA,CAAQ,MAAA,CAAO,KAAA;AAAA,MACb,sDAAsD,aAAa,CAAA;AAAA;AAAA,KACrE;AACA,IAAA,OAAA,CAAQ,KAAK,CAAC,CAAA;AAAA,EAChB;AAGA,EAAA,IAAI,IAAA,CAAK,SAAA,IAAa,CAAC,IAAA,CAAK,QAAA,EAAU;AACpC,IAAA,OAAA,CAAQ,MAAA,CAAO,MAAM,4CAA4C,CAAA;AACjE,IAAA,OAAA,CAAQ,KAAK,CAAC,CAAA;AAAA,EAChB;AACA,EAAA,IAAI,IAAA,CAAK,QAAA,IAAY,CAAC,IAAA,CAAK,SAAA,EAAW;AACpC,IAAA,OAAA,CAAQ,MAAA,CAAO,MAAM,4CAA4C,CAAA;AACjE,IAAA,OAAA,CAAQ,KAAK,CAAC,CAAA;AAAA,EAChB;AAGA,EAAA,IAAI,MAAA;AACJ,EAAA,IAAI,UAAA;AACJ,EAAA,IAAI,KAAK,MAAA,EAAQ;AACf,IAAA,MAAM,MAAA,GAAS,MAAM,UAAA,CAAW,IAAA,CAAK,MAAM,CAAA;AAC3C,IAAA,MAAA,GAAS,MAAA,CAAO,MAAA;AAChB,IAAA,UAAA,GAAa,MAAA,CAAO,IAAA;AAAA,EACtB,CAAA,MAAO;AACL,IAAA,MAAA,GAAS,gBAAA,EAAiB;AAC1B,IAAA,UAAA,GAAa,MAAM,iBAAA,CAAkB,IAAA,CAAK,SAAA,CAAU,MAAM,CAAC,CAAA;AAAA,EAC7D;AAGA,EAAA,IAAI,SAAA;AACJ,EAAA,IAAI,KAAK,SAAA,EAAW;AAClB,IAAA,SAAA,GAAY,MAAM,aAAA,CAAc,IAAA,CAAK,SAAS,CAAA;AAAA,EAChD;AAGA,EAAA,IAAI,QAAA;AACJ,EAAA,IAAI,KAAK,QAAA,EAAU;AACjB,IAAA,QAAA,GAAW,MAAM,YAAA,CAAa,IAAA,CAAK,QAAQ,CAAA;AAAA,EAC7C;AAGA,EAAA,IAAI,SAAA;AACJ,EAAA,IAAI,KAAK,SAAA,EAAW;AAClB,IAAA,IAAI;AACF,MAAA,MAAM,CAAA,GAAI,MAAMC,aAAA,CAAO,IAAA,CAAK,SAAS,CAAA;AACrC,MAAA,IAAI,CAAC,CAAA,CAAE,WAAA,EAAY,EAAG;AACpB,QAAA,OAAA,CAAQ,MAAA,CAAO,KAAA,CAAM,CAAA,wCAAA,EAA2C,IAAA,CAAK,SAAS;AAAA,CAAI,CAAA;AAClF,QAAA,OAAA,CAAQ,KAAK,CAAC,CAAA;AAAA,MAChB;AACA,MAAA,SAAA,GAAY,MAAMC,iBAAA,CAAS,IAAA,CAAK,SAAS,CAAA;AAAA,IAC3C,SAAS,GAAA,EAAK;AACZ,MAAA,OAAA,CAAQ,MAAA,CAAO,KAAA;AAAA,QACb,CAAA,oCAAA,EAAuC,IAAA,CAAK,SAAS,CAAA,IAAA,EAAO,GAAA,YAAe,QAAQ,GAAA,CAAI,OAAA,GAAU,MAAA,CAAO,GAAG,CAAC;AAAA;AAAA,OAC9G;AACA,MAAA,OAAA,CAAQ,KAAK,CAAC,CAAA;AAAA,IAChB;AAAA,EACF;AAGA,EAAA,MAAM,OAAA,GAAyB;AAAA,IAC7B,OAAA,EAAS,cAAA;AAAA,IACT,UAAA;AAAA,IACA,eAAA,EAAiB,oBAAA;AAAA,IACjB,SAAA;AAAA,IACA,QAAA;AAAA,IACA,UAAU,IAAA,CAAK,QAAA;AAAA,IACf;AAAA,GACF;AAGA,EAAA,MAAM,KAAA,GAAQ,CAAC,aAAA,EAAe,cAAA,EAAgB,aAAa,CAAA;AAC3D,EAAA,IAAI,SAAA,IAAa,KAAK,QAAA,EAAU;AAC9B,IAAA,KAAA,CAAM,KAAK,YAAY,CAAA;AACvB,IAAA,IAAI,SAAA,EAAW;AACb,MAAA,KAAA,CAAM,KAAK,oBAAoB,CAAA;AAAA,IACjC;AAAA,EACF;AAGA,EAAA,MAAM,aAAA,GAA+B;AAAA,IACnC,OAAA,EAAS,cAAA;AAAA,IACT,MAAA;AAAA,IAGA;AAAA,GACF;AAGA,EAAA,OAAA,CAAQ,MAAA,CAAO,KAAA;AAAA,IACb,CAAA,CAAA,EAAI,WAAW,CAAA,GAAA,EAAM,cAAc,eAAe,oBAAoB;AAAA;AAAA,GACxE;AACA,EAAA,OAAA,CAAQ,MAAA,CAAO,KAAA,CAAM,CAAA,aAAA,EAAgB,aAAa;AAAA,CAAI,CAAA;AACtD,EAAA,OAAA,CAAQ,OAAO,KAAA,CAAM,CAAA,SAAA,EAAY,KAAA,CAAM,IAAA,CAAK,IAAI,CAAC;AAAA,CAAI,CAAA;AACrD,EAAA,OAAA,CAAQ,MAAA,CAAO,KAAA,CAAM,CAAA,OAAA,EAAU,SAAA,GAAY,WAAW,MAAM;AAAA,CAAI,CAAA;AAChE,EAAA,OAAA,CAAQ,MAAA,CAAO,MAAM,CAAA,QAAA,EAAW,QAAA,GAAW,GAAG,QAAA,CAAS,MAAM,YAAY,MAAM;AAAA,CAAI,CAAA;AACnF,EAAA,OAAA,CAAQ,MAAA,CAAO,KAAA,CAAM,CAAA,cAAA,EAAiB,SAAA,IAAa,MAAM;AAAA,CAAI,CAAA;AAC7D,EAAA,OAAA,CAAQ,OAAO,KAAA,CAAM,CAAA,eAAA,EAAkB,WAAW,KAAA,CAAM,CAAA,EAAG,EAAE,CAAC,CAAA;AAAA,CAAO,CAAA;AAErE,EAAA,IAAI,kBAAkB,MAAA,EAAQ;AAE5B,IAAA,MAAM,EAAE,mBAAA,EAAAC,oBAAAA,EAAoB,GAAI,MAAM,OAAA,CAAA,OAAA,EAAA,CAAA,IAAA,CAAA,OAAA,mBAAA,EAAA,EAAA,sBAAA,CAAA,CAAA;AAEtC,IAAA,MAAM,WAAA,GAAc,IAAA,CAAK,WAAA,GACpB,IAAA,CAAK,YAAuB,KAAA,CAAM,GAAG,CAAA,CAAE,GAAA,CAAI,CAAC,CAAA,KAAc,CAAA,CAAE,IAAA,EAAM,CAAA,GACnE,MAAA;AACJ,IAAA,MAAM,oBAAA,GAAuB,IAAA,CAAK,oBAAA,GAC7B,IAAA,CAAK,qBAAgC,KAAA,CAAM,GAAG,CAAA,CAAE,GAAA,CAAI,CAAC,CAAA,KAAc,CAAA,CAAE,IAAA,EAAM,CAAA,GAC5E,MAAA;AAEJ,IAAA,MAAM,EAAE,OAAA,EAAQ,GAAI,MAAMA,oBAAAA,CAAoB;AAAA,MAC5C,IAAA,EAAM,QAAA,CAAS,IAAA,CAAK,IAAA,EAAgB,EAAE,CAAA;AAAA,MACtC,MAAM,IAAA,CAAK,IAAA;AAAA,MACX,WAAA;AAAA,MACA,oBAAA;AAAA,MACA,WAAW,IAAA,CAAK,SAAA;AAAA,MAChB,UAAA,EAAa,KAAK,UAAA,IAAyB,KAAA;AAAA,MAC3C,aAAA,EAAe,MAAM,mBAAA,CAAoB,aAAa;AAAA,KACvD,CAAA;AAGD,IAAA,MAAM,WAAW,YAAY;AAC3B,MAAA,OAAA,CAAQ,MAAA,CAAO,KAAA,CAAM,CAAA,CAAA,EAAI,WAAW,CAAA;AAAA,CAAsB,CAAA;AAC1D,MAAA,MAAM,OAAA,EAAQ;AACd,MAAA,OAAA,CAAQ,KAAK,CAAC,CAAA;AAAA,IAChB,CAAA;AAEA,IAAA,OAAA,CAAQ,EAAA,CAAG,UAAU,QAAQ,CAAA;AAC7B,IAAA,OAAA,CAAQ,EAAA,CAAG,WAAW,QAAQ,CAAA;AAAA,EAChC,CAAA,MAAO;AAEL,IAAA,MAAM,EAAE,oBAAA,EAAqB,GAAI,MAAM,OAAO,2CAA2C,CAAA;AAGzF,IAAA,MAAM,gBAAgB,kBAAA,EAAmB;AAEzC,IAAA,MAAM,MAAA,GAAS,oBAAoB,aAAa,CAAA;AAChD,IAAA,MAAM,SAAA,GAAY,IAAI,oBAAA,EAAqB;AAG3C,IAAA,MAAM,WAAW,YAAY;AAC3B,MAAA,OAAA,CAAQ,MAAA,CAAO,KAAA,CAAM,CAAA,CAAA,EAAI,WAAW,CAAA;AAAA,CAAsB,CAAA;AAC1D,MAAA,MAAM,OAAO,KAAA,EAAM;AACnB,MAAA,aAAA,EAAc;AACd,MAAA,OAAA,CAAQ,KAAK,CAAC,CAAA;AAAA,IAChB,CAAA;AAEA,IAAA,OAAA,CAAQ,EAAA,CAAG,UAAU,QAAQ,CAAA;AAC7B,IAAA,OAAA,CAAQ,EAAA,CAAG,WAAW,QAAQ,CAAA;AAE9B,IAAA,MAAM,MAAA,CAAO,QAAQ,SAAS,CAAA;AAAA,EAChC;AACF,CAAC,CAAA;AAEH,KAAK,QAAQ,UAAA,CAAW,OAAA,CAAQ,IAAI,CAAA,CAAE,KAAA,CAAM,CAAC,GAAA,KAAiB;AAC5D,EAAA,OAAA,CAAQ,MAAA,CAAO,KAAA;AAAA,IACb,CAAA,CAAA,EAAI,WAAW,CAAA,SAAA,EAAY,GAAA,YAAe,QAAQ,GAAA,CAAI,OAAA,GAAU,MAAA,CAAO,GAAG,CAAC;AAAA;AAAA,GAC7E;AACA,EAAA,OAAA,CAAQ,KAAK,CAAC,CAAA;AAChB,CAAC,CAAA","file":"cli.cjs","sourcesContent":["/**\n * MCP Server constants -- zero imports\n */\n\nexport const SERVER_NAME = 'peac-mcp-server';\nexport const SERVER_VERSION = '0.16.0';\nexport const MCP_PROTOCOL_VERSION = '2025-11-25';\nexport const DEFAULT_MAX_JWS_BYTES = 16_384; // 16 KB\nexport const DEFAULT_MAX_RESPONSE_BYTES = 65_536; // 64 KB\nexport const DEFAULT_TOOL_TIMEOUT_MS = 30_000; // 30 s\nexport const DEFAULT_MAX_CLAIMS_BYTES = 262_144; // 256 KB\nexport const DEFAULT_MAX_BUNDLE_RECEIPTS = 256;\nexport const DEFAULT_MAX_BUNDLE_BYTES = 16_777_216; // 16 MB\nexport const DEFAULT_MAX_TTL_SECONDS = 86_400; // 24 hours\n\n// HTTP transport defaults\nexport const DEFAULT_HTTP_PORT = 3000;\nexport const DEFAULT_HTTP_HOST = '127.0.0.1'; // localhost only; 0.0.0.0 requires explicit opt-in\nexport const DEFAULT_MAX_REQUEST_BYTES = 1_048_576; // 1 MB\nexport const DEFAULT_RATE_LIMIT_RPM = 100;\nexport const DEFAULT_SESSION_TTL_MS = 30 * 60 * 1000; // 30 min\nexport const DEFAULT_MAX_SESSIONS = 100;\n","/**\n * MCP Session Manager -- Mcp-Session-Id lifecycle, eviction, isolation\n *\n * Each HTTP session gets its own McpServer + StreamableHTTPServerTransport\n * pair. This is the primary defense against CVE-2026-25536 (cross-client\n * response data leak when a single transport is reused across connections).\n *\n * INVARIANT: NEVER reuse a single transport instance across multiple\n * client sessions. Each session is fully isolated.\n */\n\nimport { randomUUID } from 'node:crypto';\nimport type { McpServer } from '@modelcontextprotocol/sdk/server/mcp.js';\nimport { StreamableHTTPServerTransport } from '@modelcontextprotocol/sdk/server/streamableHttp.js';\n\nexport interface SessionEntry {\n readonly sessionId: string;\n readonly server: McpServer;\n readonly transport: StreamableHTTPServerTransport;\n readonly createdAt: number;\n readonly clientIp: string;\n lastSeen: number;\n}\n\nexport interface SessionManagerOptions {\n /** Max idle time before eviction (ms). Default: 30 min */\n ttlMs?: number;\n /** Max concurrent sessions. Default: 100 */\n maxSessions?: number;\n /** Max sessions per client IP. Default: 10 */\n maxSessionsPerIp?: number;\n /** Eviction sweep interval (ms). Default: 60s */\n sweepIntervalMs?: number;\n}\n\ntype ServerFactory = () => McpServer;\n\nexport class SessionManager {\n private readonly sessions = new Map<string, SessionEntry>();\n private readonly ipSessionCount = new Map<string, number>();\n private readonly ttlMs: number;\n private readonly maxSessions: number;\n private readonly maxSessionsPerIp: number;\n private sweepTimer: ReturnType<typeof setInterval> | undefined;\n\n constructor(private readonly options: SessionManagerOptions = {}) {\n this.ttlMs = options.ttlMs ?? 30 * 60 * 1000; // 30 min\n this.maxSessions = options.maxSessions ?? 100;\n this.maxSessionsPerIp = options.maxSessionsPerIp ?? 10;\n }\n\n /** Start periodic eviction sweep */\n startSweep(): void {\n const intervalMs = this.options.sweepIntervalMs ?? 60_000;\n this.sweepTimer = setInterval(() => this.evictStale(), intervalMs);\n this.sweepTimer.unref();\n }\n\n /** Create a new isolated session with its own McpServer + transport */\n async createSession(serverFactory: ServerFactory, clientIp = 'unknown'): Promise<SessionEntry> {\n // Evict stale sessions first\n this.evictStale();\n\n // Check global capacity\n if (this.sessions.size >= this.maxSessions) {\n throw new Error(`Session limit reached (${this.maxSessions}). Try again later.`);\n }\n\n // Check per-IP capacity (prevents one IP exhausting the global pool)\n const ipCount = this.ipSessionCount.get(clientIp) ?? 0;\n if (ipCount >= this.maxSessionsPerIp) {\n throw new Error(\n `Per-IP session limit reached (${this.maxSessionsPerIp} for ${clientIp}). Try again later.`\n );\n }\n\n const sessionId = randomUUID();\n const server = serverFactory();\n const transport = new StreamableHTTPServerTransport({\n sessionIdGenerator: () => sessionId,\n });\n\n await server.connect(transport);\n\n const now = Date.now();\n const entry: SessionEntry = {\n sessionId,\n server,\n transport,\n clientIp,\n createdAt: now,\n lastSeen: now,\n };\n\n this.sessions.set(sessionId, entry);\n this.ipSessionCount.set(clientIp, ipCount + 1);\n return entry;\n }\n\n /** Look up an existing session by ID */\n getSession(sessionId: string): SessionEntry | undefined {\n const entry = this.sessions.get(sessionId);\n if (entry) {\n entry.lastSeen = Date.now();\n }\n return entry;\n }\n\n /** Terminate and clean up a specific session */\n async terminateSession(sessionId: string): Promise<boolean> {\n const entry = this.sessions.get(sessionId);\n if (!entry) return false;\n\n this.sessions.delete(sessionId);\n this.decrementIpCount(entry.clientIp);\n try {\n await entry.transport.close();\n await entry.server.close();\n } catch {\n // Best effort cleanup\n }\n return true;\n }\n\n /** Terminate all sessions and stop sweep */\n async cleanup(): Promise<void> {\n if (this.sweepTimer) {\n clearInterval(this.sweepTimer);\n this.sweepTimer = undefined;\n }\n\n const entries = [...this.sessions.values()];\n this.sessions.clear();\n this.ipSessionCount.clear();\n\n await Promise.allSettled(\n entries.map(async (entry) => {\n try {\n await entry.transport.close();\n await entry.server.close();\n } catch {\n // Best effort\n }\n })\n );\n }\n\n /** Get current session count */\n get size(): number {\n return this.sessions.size;\n }\n\n /** Evict sessions past TTL */\n private evictStale(): void {\n const now = Date.now();\n for (const [id, entry] of this.sessions) {\n if (now - entry.lastSeen > this.ttlMs) {\n this.sessions.delete(id);\n this.decrementIpCount(entry.clientIp);\n // Fire-and-forget cleanup\n void entry.transport.close().catch(() => {});\n void entry.server.close().catch(() => {});\n }\n }\n }\n\n /** Decrement per-IP session count, removing the key when it reaches 0 */\n private decrementIpCount(ip: string): void {\n const count = this.ipSessionCount.get(ip) ?? 0;\n if (count <= 1) {\n this.ipSessionCount.delete(ip);\n } else {\n this.ipSessionCount.set(ip, count - 1);\n }\n }\n}\n","/**\n * MCP Streamable HTTP transport\n *\n * Adds HTTP transport alongside stdio. Unprotected mode only (v0.11.0).\n * Each session gets its own McpServer + transport (CVE-2026-25536 defense).\n *\n * Endpoints:\n * POST /mcp JSON-RPC tool calls (requires Mcp-Session-Id after init)\n * DELETE /mcp Terminate session\n * GET /health Health check (no auth)\n * GET /.well-known/oauth-protected-resource[/<path>] PRM (conditional)\n * GET /mcp 405 Method Not Allowed\n */\n\nimport { createServer, type IncomingMessage, type ServerResponse } from 'node:http';\nimport type { McpServer } from '@modelcontextprotocol/sdk/server/mcp.js';\nimport { SessionManager } from './session-manager.js';\nimport { SERVER_NAME, SERVER_VERSION, MCP_PROTOCOL_VERSION } from './infra/constants.js';\n\n/**\n * Trust-proxy configuration for X-Forwarded-For interpretation.\n *\n * Presets:\n * - 'off': never trust forwarded headers (default; safe for direct clients)\n * - 'loopback': trust only from 127.0.0.0/8 and ::1\n * - 'linklocal': trust loopback + link-local (169.254.0.0/16, fe80::/10)\n * - 'private': trust loopback + link-local + RFC 1918 (10.0.0.0/8, 172.16.0.0/12, 192.168.0.0/16)\n * - 'all': trust any remote address (DISCOURAGED; use only when behind a fully trusted proxy chain)\n *\n * Explicit addresses:\n * - comma-separated IPs: trust only from listed addresses (e.g., '10.0.0.1,10.0.0.2')\n *\n * WARNING: only enable behind a trusted reverse proxy. An attacker can forge\n * X-Forwarded-For from an untrusted peer to bypass per-IP rate limiting.\n */\nexport type TrustProxyValue = 'off' | 'loopback' | 'linklocal' | 'private' | 'all' | string;\n\nexport interface HttpTransportOptions {\n /** Port to listen on. Default: 3000 */\n port?: number;\n /** Bind address. Default: '127.0.0.1' (localhost only) */\n host?: string;\n /** Allowed CORS origins (empty = deny all). */\n corsOrigins?: string[];\n /** OAuth authorization server URIs (enables PRM with publicUrl). */\n authorizationServers?: string[];\n /** Canonical public URL of this server (required for PRM). */\n publicUrl?: string;\n /** Trust X-Forwarded-For for rate limiting. Default: 'off' */\n trustProxy?: TrustProxyValue;\n /** Max request body bytes. Default: 1MB */\n maxRequestBytes?: number;\n /** Rate limit: requests per minute per session. Default: 100 */\n rateLimitRpm?: number;\n /** Session TTL in ms. Default: 30 min */\n sessionTtlMs?: number;\n /** Max concurrent sessions. Default: 100 */\n maxSessions?: number;\n /** Max sessions per client IP. Default: 10 */\n maxSessionsPerIp?: number;\n /** Factory to create new McpServer instances (one per session) */\n serverFactory: () => McpServer;\n}\n\ninterface RateLimitEntry {\n count: number;\n windowStart: number;\n}\n\nconst ONE_MINUTE_MS = 60_000;\nconst DEFAULT_MAX_REQUEST_BYTES = 1_048_576; // 1 MB\nconst DEFAULT_RATE_LIMIT_RPM = 100;\nconst MAX_SESSION_ID_LENGTH = 128;\n\n/**\n * Validate Mcp-Session-Id: visible ASCII (0x21-0x7E), max 128 chars.\n * MCP spec requires session IDs to be visible ASCII characters only.\n */\nfunction isValidSessionId(id: string): boolean {\n if (id.length === 0 || id.length > MAX_SESSION_ID_LENGTH) return false;\n for (let i = 0; i < id.length; i++) {\n const code = id.charCodeAt(i);\n if (code < 0x21 || code > 0x7e) return false;\n }\n return true;\n}\n\n/**\n * Check if an IPv4 address falls within a well-known range.\n * Does NOT perform CIDR parsing; uses prefix matching for known ranges.\n */\nfunction isLoopbackAddr(addr: string): boolean {\n return addr.startsWith('127.') || addr === '::1' || addr === '::ffff:127.0.0.1';\n}\nfunction isLinkLocalAddr(addr: string): boolean {\n if (isLoopbackAddr(addr)) return true;\n return addr.startsWith('169.254.') || addr.startsWith('fe80');\n}\nfunction isPrivateAddr(addr: string): boolean {\n if (isLinkLocalAddr(addr)) return true;\n return (\n addr.startsWith('10.') ||\n addr.startsWith('192.168.') ||\n /^172\\.(1[6-9]|2\\d|3[01])\\./.test(addr) ||\n addr.startsWith('fc') ||\n addr.startsWith('fd') ||\n addr.startsWith('::ffff:10.') ||\n addr.startsWith('::ffff:192.168.') ||\n /^::ffff:172\\.(1[6-9]|2\\d|3[01])\\./.test(addr)\n );\n}\n\n/**\n * Check if a remote address is a trusted proxy based on trust-proxy config.\n */\nfunction isTrustedProxy(remoteAddr: string, trustProxy: TrustProxyValue): boolean {\n if (trustProxy === 'off') return false;\n if (trustProxy === 'all') return true;\n if (trustProxy === 'loopback') return isLoopbackAddr(remoteAddr);\n if (trustProxy === 'linklocal') return isLinkLocalAddr(remoteAddr);\n if (trustProxy === 'private') return isPrivateAddr(remoteAddr);\n // Comma-separated trusted IPs\n const trusted = trustProxy.split(',').map((s) => s.trim());\n return trusted.includes(remoteAddr);\n}\n\n/**\n * Validate --public-url for RFC 9728 PRM correctness:\n * - Must be https (unless loopback for dev ergonomics)\n * - Must not contain fragments\n * - Trailing slashes normalized\n */\nfunction validatePublicUrl(rawUrl: string): { url: URL; normalized: string } | { error: string } {\n let u: URL;\n try {\n u = new URL(rawUrl);\n } catch {\n return { error: `Invalid URL: ${rawUrl}` };\n }\n if (u.hash) {\n return { error: 'Public URL must not contain fragments (#)' };\n }\n const isLoopback =\n u.hostname === 'localhost' || u.hostname === '127.0.0.1' || u.hostname === '::1';\n if (u.protocol !== 'https:' && !isLoopback) {\n return { error: 'Public URL must use https (except for localhost/loopback dev usage)' };\n }\n // Normalize: strip trailing slash for path matching consistency\n const normalized = u.href.replace(/\\/+$/, '') || u.origin;\n return { url: u, normalized };\n}\n\n/**\n * Create and start an HTTP server for MCP Streamable HTTP transport.\n * Returns a cleanup function to shut everything down.\n */\nexport async function createHttpTransport(\n options: HttpTransportOptions\n): Promise<{ cleanup: () => Promise<void> }> {\n const port = options.port ?? 3000;\n const host = options.host ?? '127.0.0.1';\n const corsOrigins = new Set(options.corsOrigins ?? []);\n const maxRequestBytes = options.maxRequestBytes ?? DEFAULT_MAX_REQUEST_BYTES;\n const rateLimitRpm = options.rateLimitRpm ?? DEFAULT_RATE_LIMIT_RPM;\n\n const sessionManager = new SessionManager({\n ttlMs: options.sessionTtlMs,\n maxSessions: options.maxSessions,\n maxSessionsPerIp: options.maxSessionsPerIp,\n });\n sessionManager.startSweep();\n\n // Per-session + per-IP rate limiting (token bucket keyed on session ID,\n // falling back to IP for unauthenticated init requests)\n const rateLimits = new Map<string, RateLimitEntry>();\n\n function checkRateLimit(key: string): boolean {\n const now = Date.now();\n let entry = rateLimits.get(key);\n if (!entry || now - entry.windowStart > ONE_MINUTE_MS) {\n entry = { count: 0, windowStart: now };\n rateLimits.set(key, entry);\n }\n entry.count++;\n return entry.count <= rateLimitRpm;\n }\n\n const trustProxyValue: TrustProxyValue = options.trustProxy ?? 'off';\n\n /**\n * Resolve the client IP for rate limiting and per-IP session caps.\n *\n * Terminology:\n * - peer_ip: the TCP socket remote address (req.socket.remoteAddress).\n * This is the IP the OS reports; it cannot be spoofed at the application layer.\n * - client_ip: the resolved end-client IP after trust-proxy evaluation.\n * When trust-proxy is 'off' (default), client_ip === peer_ip.\n * When trust-proxy is enabled AND the peer_ip matches the trusted range,\n * client_ip is taken from the first entry in X-Forwarded-For.\n * When trust-proxy is enabled but the peer_ip is NOT in the trusted range,\n * X-Forwarded-For is IGNORED (peer_ip used as client_ip) to prevent\n * spoofing from untrusted peers.\n */\n function getClientIp(req: IncomingMessage): string {\n const peerIp = req.socket.remoteAddress ?? 'unknown';\n if (trustProxyValue !== 'off' && isTrustedProxy(peerIp, trustProxyValue)) {\n const xff = req.headers['x-forwarded-for'];\n if (typeof xff === 'string') {\n const first = xff.split(',')[0]?.trim();\n if (first) return first;\n }\n }\n return peerIp;\n }\n\n // Allowed hosts for Host header validation\n const allowedHosts = new Set<string>();\n allowedHosts.add(`${host}:${port}`);\n allowedHosts.add(host === '0.0.0.0' ? `localhost:${port}` : `${host}:${port}`);\n if (host === '127.0.0.1' || host === '0.0.0.0') {\n allowedHosts.add(`localhost:${port}`);\n allowedHosts.add(`127.0.0.1:${port}`);\n }\n if (options.publicUrl) {\n try {\n const u = new URL(options.publicUrl);\n allowedHosts.add(u.host);\n } catch {\n // Invalid publicUrl, ignore\n }\n }\n\n // Origin allowlist for DNS rebinding defense (MCP spec MUST requirement)\n const allowedOrigins = new Set<string>(corsOrigins);\n\n function validateOrigin(req: IncomingMessage, res: ServerResponse): boolean {\n const origin = req.headers.origin;\n if (!origin) return true; // No origin = same-origin or non-browser\n if (allowedOrigins.size === 0) {\n // Deny all cross-origin by default\n res.writeHead(403, { 'Content-Type': 'application/json' });\n res.end(JSON.stringify({ error: 'Origin not allowed' }));\n return false;\n }\n if (!allowedOrigins.has(origin)) {\n res.writeHead(403, { 'Content-Type': 'application/json' });\n res.end(JSON.stringify({ error: 'Origin not allowed' }));\n return false;\n }\n return true;\n }\n\n function setCorsHeaders(req: IncomingMessage, res: ServerResponse): void {\n const origin = req.headers.origin;\n if (origin && allowedOrigins.has(origin)) {\n res.setHeader('Access-Control-Allow-Origin', origin);\n res.setHeader('Access-Control-Allow-Methods', 'POST, DELETE, GET, OPTIONS');\n res.setHeader(\n 'Access-Control-Allow-Headers',\n 'Content-Type, Mcp-Session-Id, Accept, MCP-Protocol-Version'\n );\n res.setHeader('Access-Control-Expose-Headers', 'Mcp-Session-Id');\n }\n }\n\n function sendJson(res: ServerResponse, status: number, body: unknown): void {\n const json = JSON.stringify(body);\n res.writeHead(status, { 'Content-Type': 'application/json' });\n res.end(json);\n }\n\n async function readBody(req: IncomingMessage): Promise<Buffer> {\n const chunks: Buffer[] = [];\n let totalBytes = 0;\n for await (const chunk of req) {\n totalBytes += (chunk as Buffer).length;\n if (totalBytes > maxRequestBytes) {\n throw new Error(`Request body exceeds ${maxRequestBytes} bytes`);\n }\n chunks.push(chunk as Buffer);\n }\n return Buffer.concat(chunks);\n }\n\n // PRM configuration (RFC 9728 path-aware discovery)\n // Both authorizationServers (non-empty) and publicUrl are required for PRM.\n const authServers = (options.authorizationServers ?? []).filter((s) => s.trim().length > 0);\n if (options.authorizationServers?.length && authServers.length === 0) {\n process.stderr.write(\n `[${SERVER_NAME}] WARNING: --authorization-servers contains only empty entries, PRM disabled\\n`\n );\n }\n if (authServers.length > 0 && !options.publicUrl) {\n process.stderr.write(\n `[${SERVER_NAME}] WARNING: --authorization-servers set without --public-url, PRM disabled\\n`\n );\n }\n if (options.publicUrl && authServers.length === 0) {\n process.stderr.write(\n `[${SERVER_NAME}] WARNING: --public-url set without --authorization-servers, PRM disabled\\n`\n );\n }\n const prmEnabled = !!(authServers.length > 0 && options.publicUrl);\n let prmPath = '/.well-known/oauth-protected-resource';\n let prmDocument: object | undefined;\n if (prmEnabled && options.publicUrl) {\n const validation = validatePublicUrl(options.publicUrl);\n if ('error' in validation) {\n process.stderr.write(\n `[${SERVER_NAME}] WARNING: --public-url invalid, PRM disabled: ${validation.error}\\n`\n );\n } else {\n const { url: u, normalized } = validation;\n // RFC 9728 path insertion: /.well-known/oauth-protected-resource/<resource-path>\n const resourcePath = u.pathname.replace(/\\/+$/, '');\n if (resourcePath && resourcePath !== '/') {\n prmPath = `/.well-known/oauth-protected-resource${resourcePath}`;\n }\n prmDocument = {\n resource: normalized,\n authorization_servers: authServers,\n };\n }\n }\n\n const server = createServer(async (req: IncomingMessage, res: ServerResponse) => {\n const url = new URL(req.url ?? '/', `http://${req.headers.host ?? 'localhost'}`);\n const pathname = url.pathname;\n\n // Node.js server timeouts (slowloris defense)\n // These are set per-request since createServer options apply globally\n res.setTimeout(30_000);\n\n // CORS preflight\n if (req.method === 'OPTIONS') {\n setCorsHeaders(req, res);\n res.writeHead(204);\n res.end();\n return;\n }\n\n setCorsHeaders(req, res);\n\n // Host header validation\n const hostHeader = req.headers.host;\n if (hostHeader && !allowedHosts.has(hostHeader)) {\n sendJson(res, 400, { error: 'Invalid Host header' });\n return;\n }\n\n // Origin validation (DNS rebinding defense)\n if (!validateOrigin(req, res)) return;\n\n // --- Health endpoint ---\n if (pathname === '/health' && req.method === 'GET') {\n sendJson(res, 200, {\n ok: true,\n version: SERVER_VERSION,\n protocolVersion: MCP_PROTOCOL_VERSION,\n });\n return;\n }\n\n // --- PRM endpoint ---\n if (pathname === prmPath && req.method === 'GET') {\n if (prmEnabled && prmDocument) {\n sendJson(res, 200, prmDocument);\n } else {\n sendJson(res, 404, { error: 'Not found' });\n }\n return;\n }\n\n // --- MCP endpoint ---\n if (pathname === '/mcp') {\n // GET /mcp -> 405 (SSE streaming deferred)\n if (req.method === 'GET') {\n res.writeHead(405, { Allow: 'POST, DELETE', 'Content-Type': 'application/json' });\n res.end(JSON.stringify({ error: 'Method Not Allowed. Use POST for JSON-RPC requests.' }));\n return;\n }\n\n // DELETE /mcp -> terminate session\n if (req.method === 'DELETE') {\n const sessionId = req.headers['mcp-session-id'] as string | undefined;\n if (!sessionId) {\n sendJson(res, 400, { error: 'Missing Mcp-Session-Id header' });\n return;\n }\n if (!isValidSessionId(sessionId)) {\n sendJson(res, 400, {\n error: 'Invalid Mcp-Session-Id: must be visible ASCII (0x21-0x7E), max 128 chars',\n });\n return;\n }\n const terminated = await sessionManager.terminateSession(sessionId);\n if (terminated) {\n sendJson(res, 200, { ok: true });\n } else {\n sendJson(res, 404, { error: 'Session not found or already terminated' });\n }\n return;\n }\n\n // POST /mcp -> JSON-RPC\n if (req.method === 'POST') {\n // Rate limit check\n const sessionId = req.headers['mcp-session-id'] as string | undefined;\n const rateLimitKey = sessionId ?? `ip:${getClientIp(req)}`;\n if (!checkRateLimit(rateLimitKey)) {\n res.writeHead(429, { 'Content-Type': 'application/json', 'Retry-After': '60' });\n res.end(JSON.stringify({ error: 'Rate limit exceeded' }));\n return;\n }\n\n // Read and parse body\n let body: unknown;\n try {\n const raw = await readBody(req);\n body = JSON.parse(raw.toString('utf-8'));\n } catch (err) {\n const msg = err instanceof Error ? err.message : 'Invalid request body';\n sendJson(res, 400, { error: msg });\n return;\n }\n\n // Check if this is an initialization request\n const isInit =\n typeof body === 'object' &&\n body !== null &&\n 'method' in body &&\n (body as { method: string }).method === 'initialize';\n\n if (isInit) {\n // MCP-Protocol-Version validation (on init)\n const protocolVersion = req.headers['mcp-protocol-version'] as string | undefined;\n if (\n protocolVersion &&\n protocolVersion !== MCP_PROTOCOL_VERSION &&\n protocolVersion !== '2025-03-26'\n ) {\n sendJson(res, 400, { error: `Unsupported MCP protocol version: ${protocolVersion}` });\n return;\n }\n\n // Accept header tolerance\n const accept = req.headers.accept;\n if (!accept) {\n process.stderr.write(\n `[${SERVER_NAME}] Warning: missing Accept header on init request\\n`\n );\n }\n\n // Create new session\n let entry;\n try {\n entry = await sessionManager.createSession(options.serverFactory, getClientIp(req));\n } catch (err) {\n const msg = err instanceof Error ? err.message : 'Failed to create session';\n sendJson(res, 503, { error: msg });\n return;\n }\n\n // Delegate to transport (it will set Mcp-Session-Id header)\n await entry.transport.handleRequest(req, res, body);\n return;\n }\n\n // Non-init requests require Mcp-Session-Id\n if (!sessionId) {\n sendJson(res, 400, { error: 'Missing Mcp-Session-Id header' });\n return;\n }\n if (!isValidSessionId(sessionId)) {\n sendJson(res, 400, {\n error: 'Invalid Mcp-Session-Id: must be visible ASCII (0x21-0x7E), max 128 chars',\n });\n return;\n }\n\n const entry = sessionManager.getSession(sessionId);\n if (!entry) {\n sendJson(res, 404, { error: 'Session not found or terminated' });\n return;\n }\n\n // Delegate to session's transport\n await entry.transport.handleRequest(req, res, body);\n return;\n }\n\n // Other methods on /mcp\n res.writeHead(405, { Allow: 'POST, DELETE', 'Content-Type': 'application/json' });\n res.end(JSON.stringify({ error: 'Method Not Allowed' }));\n return;\n }\n\n // --- Not found ---\n sendJson(res, 404, { error: 'Not found' });\n });\n\n // Node.js server timeouts (slowloris defense)\n server.headersTimeout = 10_000; // 10s for headers\n server.requestTimeout = 30_000; // 30s for full request\n server.keepAliveTimeout = 5_000; // 5s keep-alive\n\n return new Promise((resolve, reject) => {\n server.on('error', reject);\n server.listen(port, host, () => {\n process.stderr.write(`[${SERVER_NAME}] HTTP transport listening on http://${host}:${port}\\n`);\n process.stderr.write(` Transport: Streamable HTTP (MCP ${MCP_PROTOCOL_VERSION})\\n`);\n process.stderr.write(\n ` Auth: unprotected mode (no token validation); PRM discovery per RFC 9728\\n`\n );\n process.stderr.write(` Endpoints: POST /mcp, DELETE /mcp, GET /health\\n`);\n if (prmEnabled) {\n process.stderr.write(` PRM: GET ${prmPath} (implemented, enabled by config)\\n`);\n } else {\n process.stderr.write(\n ` PRM: disabled (set --authorization-servers + --public-url to enable)\\n`\n );\n }\n process.stderr.write(\n ` Sessions: max ${options.maxSessions ?? 100} (${options.maxSessionsPerIp ?? 10}/IP), TTL ${(options.sessionTtlMs ?? 1_800_000) / 1000}s\\n`\n );\n process.stderr.write(` Rate limit: ${rateLimitRpm} req/min per session\\n`);\n process.stderr.write(\n ` CORS: ${corsOrigins.size > 0 ? [...corsOrigins].join(', ') : 'deny all'}\\n`\n );\n process.stderr.write(\n ` Mode: unprotected (token validation deferred to v0.11.x+; deployer auth via reverse proxy)\\n`\n );\n\n resolve({\n cleanup: async () => {\n await sessionManager.cleanup();\n await new Promise<void>((res) => server.close(() => res()));\n },\n });\n });\n });\n}\n","#!/usr/bin/env node\n/**\n * peac-mcp-server CLI entry point\n *\n * Startup: parse args -> load policy -> load key -> load JWKS ->\n * select transport -> create server -> connect\n *\n * Transports:\n * stdio (default): stdin/stdout JSON-RPC, stdout fence\n * http: Streamable HTTP on configurable port, session-isolated\n */\n\nimport { stat as fsStat, realpath } from 'node:fs/promises';\nimport { Command } from 'commander';\nimport { SERVER_NAME, SERVER_VERSION, MCP_PROTOCOL_VERSION } from './infra/constants.js';\nimport { loadPolicy, getDefaultPolicy, computePolicyHash } from './infra/policy.js';\nimport { loadIssuerKey } from './infra/key-loader.js';\nimport { loadJwksFile } from './infra/jwks-loader.js';\nimport type { JwksKeyEntry } from './infra/jwks-loader.js';\nimport type { PolicyConfig } from './infra/policy.js';\nimport type { LoadedKey } from './infra/key-loader.js';\nimport type { ServerContext } from './handlers/types.js';\nimport { installStdoutFence } from './stdout-fence.js';\nimport { createPeacMcpServer } from './server.js';\nimport type { ServerOptions } from './server.js';\n\nconst program = new Command();\n\nprogram\n .name(SERVER_NAME)\n .version(SERVER_VERSION)\n .description('PEAC receipt operations as MCP tools')\n .option('--issuer-key <ref>', 'Issuer key reference (env:VAR or file:/path)')\n .option('--issuer-id <uri>', 'Issuer identifier URI')\n .option('--policy <path>', 'Policy configuration file path')\n .option('--jwks-file <path>', 'JWKS file for verifier key resolution')\n .option('--bundle-dir <path>', 'Directory for evidence bundle output')\n .option('--transport <type>', 'Transport: stdio (default) or http', 'stdio')\n .option('--port <number>', 'HTTP port (default: 3000, http only)', '3000')\n .option('--host <address>', 'HTTP bind address (default: 127.0.0.1)', '127.0.0.1')\n .option('--cors-origins <list>', 'Allowed CORS origins (comma-separated)')\n .option(\n '--authorization-servers <list>',\n 'OAuth authorization server URIs (enables PRM with --public-url)'\n )\n .option('--public-url <url>', 'Canonical public URL of this server (required for PRM)')\n .option(\n '--trust-proxy <value>',\n 'Trust X-Forwarded-For: off (default), loopback, linklocal, private, all (discouraged), or comma-separated IPs',\n 'off'\n )\n .action(async (opts) => {\n // Validate transport\n const transportType = opts.transport as string;\n if (transportType !== 'stdio' && transportType !== 'http') {\n process.stderr.write(\n `ERROR: --transport must be \"stdio\" or \"http\", got \"${transportType}\"\\n`\n );\n process.exit(1);\n }\n\n // Validate key flag pairing\n if (opts.issuerKey && !opts.issuerId) {\n process.stderr.write('ERROR: --issuer-key requires --issuer-id\\n');\n process.exit(1);\n }\n if (opts.issuerId && !opts.issuerKey) {\n process.stderr.write('ERROR: --issuer-id requires --issuer-key\\n');\n process.exit(1);\n }\n\n // Load policy\n let policy: PolicyConfig;\n let policyHash: string;\n if (opts.policy) {\n const loaded = await loadPolicy(opts.policy);\n policy = loaded.policy;\n policyHash = loaded.hash;\n } else {\n policy = getDefaultPolicy();\n policyHash = await computePolicyHash(JSON.stringify(policy));\n }\n\n // Load issuer key (optional, for issue tool)\n let issuerKey: LoadedKey | undefined;\n if (opts.issuerKey) {\n issuerKey = await loadIssuerKey(opts.issuerKey);\n }\n\n // Load JWKS (optional, for verifier key resolution)\n let jwksKeys: JwksKeyEntry[] | undefined;\n if (opts.jwksFile) {\n jwksKeys = await loadJwksFile(opts.jwksFile);\n }\n\n // Validate bundle-dir (optional, for bundle tool)\n let bundleDir: string | undefined;\n if (opts.bundleDir) {\n try {\n const s = await fsStat(opts.bundleDir);\n if (!s.isDirectory()) {\n process.stderr.write(`ERROR: --bundle-dir is not a directory: ${opts.bundleDir}\\n`);\n process.exit(1);\n }\n bundleDir = await realpath(opts.bundleDir);\n } catch (err) {\n process.stderr.write(\n `ERROR: --bundle-dir not accessible: ${opts.bundleDir} -- ${err instanceof Error ? err.message : String(err)}\\n`\n );\n process.exit(1);\n }\n }\n\n // Build server context\n const context: ServerContext = {\n version: SERVER_VERSION,\n policyHash,\n protocolVersion: MCP_PROTOCOL_VERSION,\n issuerKey,\n jwksKeys,\n issuerId: opts.issuerId,\n bundleDir,\n };\n\n // Compute tool list for banner\n const tools = ['peac_verify', 'peac_inspect', 'peac_decode'];\n if (issuerKey && opts.issuerId) {\n tools.push('peac_issue');\n if (bundleDir) {\n tools.push('peac_create_bundle');\n }\n }\n\n // Server options (shared between stdio and http)\n const serverOptions: ServerOptions = {\n version: SERVER_VERSION,\n policy,\n policyHash,\n protocolVersion: MCP_PROTOCOL_VERSION,\n context,\n };\n\n // Banner to stderr (never stdout)\n process.stderr.write(\n `[${SERVER_NAME}] v${SERVER_VERSION} | protocol ${MCP_PROTOCOL_VERSION}\\n`\n );\n process.stderr.write(` Transport: ${transportType}\\n`);\n process.stderr.write(` Tools: ${tools.join(', ')}\\n`);\n process.stderr.write(` Key: ${issuerKey ? 'loaded' : 'none'}\\n`);\n process.stderr.write(` JWKS: ${jwksKeys ? `${jwksKeys.length} key(s)` : 'none'}\\n`);\n process.stderr.write(` Bundle dir: ${bundleDir ?? 'none'}\\n`);\n process.stderr.write(` Policy hash: ${policyHash.slice(0, 16)}...\\n`);\n\n if (transportType === 'http') {\n // --- HTTP transport ---\n const { createHttpTransport } = await import('./http-transport.js');\n\n const corsOrigins = opts.corsOrigins\n ? (opts.corsOrigins as string).split(',').map((s: string) => s.trim())\n : undefined;\n const authorizationServers = opts.authorizationServers\n ? (opts.authorizationServers as string).split(',').map((s: string) => s.trim())\n : undefined;\n\n const { cleanup } = await createHttpTransport({\n port: parseInt(opts.port as string, 10),\n host: opts.host as string,\n corsOrigins,\n authorizationServers,\n publicUrl: opts.publicUrl as string | undefined,\n trustProxy: (opts.trustProxy as string) || 'off',\n serverFactory: () => createPeacMcpServer(serverOptions),\n });\n\n // Graceful shutdown\n const shutdown = async () => {\n process.stderr.write(`[${SERVER_NAME}] Shutting down...\\n`);\n await cleanup();\n process.exit(0);\n };\n\n process.on('SIGINT', shutdown);\n process.on('SIGTERM', shutdown);\n } else {\n // --- stdio transport (default, unchanged) ---\n const { StdioServerTransport } = await import('@modelcontextprotocol/sdk/server/stdio.js');\n\n // Install stdout fence BEFORE connecting transport\n const teardownFence = installStdoutFence();\n\n const server = createPeacMcpServer(serverOptions);\n const transport = new StdioServerTransport();\n\n // Graceful shutdown\n const shutdown = async () => {\n process.stderr.write(`[${SERVER_NAME}] Shutting down...\\n`);\n await server.close();\n teardownFence();\n process.exit(0);\n };\n\n process.on('SIGINT', shutdown);\n process.on('SIGTERM', shutdown);\n\n await server.connect(transport);\n }\n });\n\nvoid program.parseAsync(process.argv).catch((err: unknown) => {\n process.stderr.write(\n `[${SERVER_NAME}] Fatal: ${err instanceof Error ? err.message : String(err)}\\n`\n );\n process.exit(1);\n});\n","/**\n * MCP Server error hierarchy -- zero external imports\n *\n * Error codes use the E_MCP_* taxonomy for MCP-server-specific errors.\n * Protocol errors (E_INVALID_SIGNATURE, etc.) are passed through as nested detail.\n */\n\nexport type McpServerErrorCode =\n | 'E_MCP_KEY_LOAD'\n | 'E_MCP_POLICY_LOAD'\n | 'E_MCP_JWKS_LOAD'\n | 'E_MCP_INPUT_TOO_LARGE'\n | 'E_MCP_OUTPUT_TOO_LARGE'\n | 'E_MCP_TOOL_DISABLED'\n | 'E_MCP_TOOL_TIMEOUT'\n | 'E_MCP_KEY_RESOLUTION'\n | 'E_MCP_KID_REQUIRED'\n | 'E_MCP_JWKS_NO_MATCH'\n | 'E_MCP_INVALID_INPUT'\n | 'E_MCP_HANDLER_ERROR'\n | 'E_MCP_STDOUT_FENCE_VIOLATION'\n | 'E_MCP_KEY_REQUIRED'\n | 'E_MCP_ISSUE_FAILED'\n | 'E_MCP_BUNDLE_FAILED'\n | 'E_MCP_PATH_TRAVERSAL'\n | 'E_MCP_BUNDLE_DIR_REQUIRED'\n | 'E_MCP_CANCELLED';\n\nexport class McpServerError extends Error {\n readonly code: McpServerErrorCode;\n\n constructor(code: McpServerErrorCode, message: string, options?: ErrorOptions) {\n super(message, options);\n this.name = 'McpServerError';\n this.code = code;\n }\n}\n\nexport class KeyLoadError extends McpServerError {\n constructor(message: string, options?: ErrorOptions) {\n super('E_MCP_KEY_LOAD', message, options);\n this.name = 'KeyLoadError';\n }\n}\n\nexport class PolicyLoadError extends McpServerError {\n constructor(message: string, options?: ErrorOptions) {\n super('E_MCP_POLICY_LOAD', message, options);\n this.name = 'PolicyLoadError';\n }\n}\n\nexport class JwksLoadError extends McpServerError {\n constructor(message: string, options?: ErrorOptions) {\n super('E_MCP_JWKS_LOAD', message, options);\n this.name = 'JwksLoadError';\n }\n}\n\nexport class IssueToolError extends McpServerError {\n constructor(message: string, options?: ErrorOptions) {\n super('E_MCP_ISSUE_FAILED', message, options);\n this.name = 'IssueToolError';\n }\n}\n\nexport class BundleToolError extends McpServerError {\n constructor(message: string, options?: ErrorOptions) {\n super('E_MCP_BUNDLE_FAILED', message, options);\n this.name = 'BundleToolError';\n }\n}\n\nexport class PathTraversalError extends McpServerError {\n constructor(message: string, options?: ErrorOptions) {\n super('E_MCP_PATH_TRAVERSAL', message, options);\n this.name = 'PathTraversalError';\n }\n}\n\n/**\n * Strip key-like material from output strings (Trust Gate 1 helper).\n *\n * Replaces matches of each pattern with `[REDACTED]`.\n */\nexport function sanitizeOutput(text: string, sensitivePatterns: RegExp[]): string {\n let result = text;\n for (const pattern of sensitivePatterns) {\n result = result.replace(pattern, '[REDACTED]');\n }\n return result;\n}\n","/**\n * Static policy loader (load once, hash, never reload)\n */\n\nimport { readFile, stat } from 'node:fs/promises';\nimport { z } from 'zod';\nimport { sha256Hex } from '@peac/crypto';\nimport { PolicyLoadError } from './errors.js';\n\nconst ToolPolicySchema = z.object({\n enabled: z.boolean().default(true),\n allowed_kinds: z.array(z.string()).optional(),\n});\n\nconst RedactionSchema = z.object({\n strip_evidence: z.boolean().default(false),\n strip_payment: z.boolean().default(false),\n inspect_full_claims: z.boolean().default(false),\n});\n\nconst LimitsSchema = z.object({\n max_jws_bytes: z.number().int().positive().default(16_384),\n max_response_bytes: z.number().int().positive().default(65_536),\n tool_timeout_ms: z.number().int().positive().default(30_000),\n max_concurrency: z.number().int().positive().default(10),\n max_claims_bytes: z.number().int().positive().default(262_144),\n max_bundle_receipts: z.number().int().positive().default(256),\n max_bundle_bytes: z.number().int().positive().default(16_777_216),\n max_ttl_seconds: z.number().int().positive().default(86_400),\n});\n\n// JWKS config: file-only. URL fetch is not implemented (SSRF surface).\n// When allow_network + URL fetch is added, gate it behind allow_network\n// with strict allowlist, timeouts, max-size, and no-redirect policy.\nconst JwksConfigSchema = z.object({\n file: z.string().optional(),\n});\n\nexport const PolicySchema = z.object({\n version: z.literal('1'),\n allow_network: z.boolean().default(false),\n redaction: RedactionSchema.prefault({}),\n tools: z.record(z.string(), ToolPolicySchema).prefault({}),\n limits: LimitsSchema.prefault({}),\n jwks: JwksConfigSchema.optional(),\n});\n\nexport type PolicyConfig = z.infer<typeof PolicySchema>;\n\nconst DEFAULT_POLICY: PolicyConfig = {\n version: '1',\n allow_network: false,\n redaction: { strip_evidence: false, strip_payment: false, inspect_full_claims: false },\n tools: {},\n limits: {\n max_jws_bytes: 16_384,\n max_response_bytes: 65_536,\n tool_timeout_ms: 30_000,\n max_concurrency: 10,\n max_claims_bytes: 262_144,\n max_bundle_receipts: 256,\n max_bundle_bytes: 16_777_216,\n max_ttl_seconds: 86_400,\n },\n};\n\nexport function getDefaultPolicy(): PolicyConfig {\n return structuredClone(DEFAULT_POLICY);\n}\n\n/**\n * Deep stable stringify: recursively sorts all object keys at every level\n * so semantically identical policies always produce the same hash regardless\n * of insertion order. Arrays preserve element order (order-significant).\n */\nfunction deepStableStringify(value: unknown): string {\n if (value === null || typeof value !== 'object') {\n return JSON.stringify(value);\n }\n if (Array.isArray(value)) {\n return '[' + value.map(deepStableStringify).join(',') + ']';\n }\n const obj = value as Record<string, unknown>;\n const keys = Object.keys(obj).sort();\n const pairs = keys.map((k) => JSON.stringify(k) + ':' + deepStableStringify(obj[k]));\n return '{' + pairs.join(',') + '}';\n}\n\n/**\n * Compute the policy hash from a canonical JSON representation.\n * Accepts either raw JSON string or a PolicyConfig object.\n * When given a PolicyConfig, uses deep stable stringify (recursive key sort)\n * so semantically identical policies always hash identically.\n */\nexport async function computePolicyHash(input: string | PolicyConfig): Promise<string> {\n const canonical = typeof input === 'string' ? input : deepStableStringify(input);\n return sha256Hex(canonical);\n}\n\nexport async function loadPolicy(\n filePath: string\n): Promise<{ policy: PolicyConfig; hash: string }> {\n let raw: string;\n try {\n raw = await readFile(filePath, 'utf-8');\n } catch (err) {\n throw new PolicyLoadError(\n `Failed to read policy file: ${filePath} -- ${err instanceof Error ? err.message : String(err)}`,\n { cause: err }\n );\n }\n\n // Warn on world-writable permissions (0o002)\n try {\n const s = await stat(filePath);\n if (s.mode & 0o002) {\n process.stderr.write(\n `[peac-mcp-server] WARNING: Policy file ${filePath} is world-writable\\n`\n );\n }\n } catch {\n // stat failure is non-fatal\n }\n\n let parsed: unknown;\n try {\n parsed = JSON.parse(raw);\n } catch (err) {\n throw new PolicyLoadError(`Policy file is not valid JSON: ${filePath}`, { cause: err });\n }\n\n const result = PolicySchema.safeParse(parsed);\n if (!result.success) {\n const issues = result.error.issues.map((i) => `${i.path.join('.')}: ${i.message}`).join('; ');\n throw new PolicyLoadError(`Policy validation failed: ${issues}`);\n }\n\n // Hash the materialized policy (after Zod defaults applied) for determinism\n const hash = await computePolicyHash(result.data);\n return { policy: result.data, hash };\n}\n","/**\n * Issuer key loader (no ambient key discovery)\n *\n * Supports `env:VAR_NAME` and `file:/path` schemes.\n * Reads JWK JSON, validates Ed25519, derives public key.\n * NEVER logs key bytes.\n */\n\nimport { readFile } from 'node:fs/promises';\nimport {\n base64urlDecode,\n base64urlEncode,\n derivePublicKey,\n validateKeypair,\n sha256Hex,\n} from '@peac/crypto';\nimport type { Ed25519PrivateJwk } from '@peac/crypto';\nimport { KeyLoadError } from './errors.js';\n\nexport interface LoadedKey {\n privateKey: Uint8Array;\n publicKey: Uint8Array;\n kid: string;\n}\n\nexport async function loadIssuerKey(schemeUri: string): Promise<LoadedKey> {\n let raw: string;\n\n if (schemeUri.startsWith('env:')) {\n const varName = schemeUri.slice(4);\n const envValue = process.env[varName];\n if (!envValue) {\n throw new KeyLoadError(`Environment variable ${varName} is not set or empty`);\n }\n raw = envValue;\n } else if (schemeUri.startsWith('file:')) {\n const filePath = schemeUri.slice(5);\n try {\n raw = await readFile(filePath, 'utf-8');\n } catch (err) {\n throw new KeyLoadError(\n `Failed to read key file: ${filePath} -- ${err instanceof Error ? err.message : String(err)}`,\n { cause: err }\n );\n }\n } else {\n throw new KeyLoadError(\n `Unsupported key scheme: ${schemeUri} (expected env:VAR_NAME or file:/path)`\n );\n }\n\n let jwk: unknown;\n try {\n jwk = JSON.parse(raw);\n } catch (err) {\n throw new KeyLoadError('Key data is not valid JSON', { cause: err });\n }\n\n // Validate JWK structure\n if (\n typeof jwk !== 'object' ||\n jwk === null ||\n !('kty' in jwk) ||\n !('crv' in jwk) ||\n !('d' in jwk)\n ) {\n throw new KeyLoadError('JWK must contain kty, crv, and d fields');\n }\n\n const j = jwk as Record<string, unknown>;\n if (j.kty !== 'OKP' || j.crv !== 'Ed25519') {\n throw new KeyLoadError(\n `JWK must be Ed25519 (kty: OKP, crv: Ed25519), got kty=${String(j.kty)} crv=${String(j.crv)}`\n );\n }\n\n if (typeof j.d !== 'string' || typeof j.x !== 'string') {\n throw new KeyLoadError('JWK d and x fields must be base64url strings');\n }\n\n const ed25519Jwk: Ed25519PrivateJwk = {\n kty: 'OKP',\n crv: 'Ed25519',\n x: j.x as string,\n d: j.d as string,\n };\n\n // Validate keypair consistency\n const valid = await validateKeypair(ed25519Jwk);\n if (!valid) {\n throw new KeyLoadError('JWK keypair validation failed: d does not derive to x');\n }\n\n const privateKey = base64urlDecode(ed25519Jwk.d);\n const publicKey = await derivePublicKey(privateKey);\n\n // Extract kid. Falls back to a deterministic derivation from the public key\n // (truncated SHA-256 of base64url-encoded public key) so runs are reproducible.\n let kid: string;\n if (typeof j.kid === 'string') {\n kid = j.kid;\n } else {\n const pubB64 = base64urlEncode(publicKey);\n const hash = await sha256Hex(pubB64);\n kid = hash.slice(0, 16);\n }\n\n return { privateKey, publicKey, kid };\n}\n","/**\n * JWKS file loader for verifier-side key resolution\n *\n * Loads a local JWKS JSON file, filters for Ed25519 keys,\n * and provides kid-based lookup.\n */\n\nimport { readFile } from 'node:fs/promises';\nimport { base64urlDecode } from '@peac/crypto';\nimport { JwksLoadError } from './errors.js';\n\nexport interface JwksKeyEntry {\n kid: string;\n publicKey: Uint8Array;\n}\n\nexport async function loadJwksFile(filePath: string): Promise<JwksKeyEntry[]> {\n let raw: string;\n try {\n raw = await readFile(filePath, 'utf-8');\n } catch (err) {\n throw new JwksLoadError(\n `Failed to read JWKS file: ${filePath} -- ${err instanceof Error ? err.message : String(err)}`,\n { cause: err }\n );\n }\n\n let parsed: unknown;\n try {\n parsed = JSON.parse(raw);\n } catch (err) {\n throw new JwksLoadError(`JWKS file is not valid JSON: ${filePath}`, { cause: err });\n }\n\n if (typeof parsed !== 'object' || parsed === null || !('keys' in parsed)) {\n throw new JwksLoadError('JWKS must contain a \"keys\" array');\n }\n\n const jwks = parsed as { keys: unknown[] };\n if (!Array.isArray(jwks.keys)) {\n throw new JwksLoadError('JWKS \"keys\" must be an array');\n }\n\n const entries: JwksKeyEntry[] = [];\n for (const key of jwks.keys) {\n if (typeof key !== 'object' || key === null) continue;\n const k = key as Record<string, unknown>;\n\n // Filter for Ed25519 only (reject non-EdDSA alg values)\n if (k.kty !== 'OKP' || k.crv !== 'Ed25519') continue;\n if (typeof k.x !== 'string') continue;\n if (k.alg !== undefined && k.alg !== 'EdDSA') continue;\n\n const kid = typeof k.kid === 'string' ? k.kid : `key-${entries.length}`;\n try {\n const publicKey = base64urlDecode(k.x);\n if (publicKey.length === 32) {\n entries.push({ kid, publicKey });\n }\n } catch {\n // Skip keys with invalid base64url encoding\n }\n }\n\n return entries;\n}\n\nexport function resolveKeyByKid(keys: JwksKeyEntry[], kid: string): Uint8Array | undefined {\n const entry = keys.find((k) => k.kid === kid);\n return entry?.publicKey;\n}\n","/**\n * Stdout fence (line-buffered JSON-RPC validator)\n *\n * Monkey-patches process.stdout.write at startup.\n * Buffers bytes, splits on newline, validates each complete line\n * as JSON-RPC 2.0. Invalid lines cause a fail-fast throw.\n *\n * Returns a teardown function that restores the original write.\n */\n\nimport { McpServerError } from './infra/errors.js';\n\ntype WriteCallback = (err?: Error | null) => void;\n\n// 4 MB max line/buffer length -- prevents memory exhaustion from\n// unbounded writes without newlines or a single huge JSON-RPC message\nconst MAX_LINE_BYTES = 4 * 1024 * 1024;\n\nexport function installStdoutFence(): () => void {\n const originalWrite = process.stdout.write.bind(process.stdout);\n let buffer = '';\n let bufferBytes = 0;\n\n function validateJsonRpcLine(line: string): void {\n // Guard: reject lines that exceed the byte budget before attempting JSON.parse\n const lineBytes = new TextEncoder().encode(line).length;\n if (lineBytes > MAX_LINE_BYTES) {\n throw new McpServerError(\n 'E_MCP_STDOUT_FENCE_VIOLATION',\n `Stdout fence: line is ${lineBytes} bytes, exceeding limit of ${MAX_LINE_BYTES}`\n );\n }\n\n let parsed: unknown;\n try {\n parsed = JSON.parse(line);\n } catch {\n throw new McpServerError(\n 'E_MCP_STDOUT_FENCE_VIOLATION',\n `Stdout fence: non-JSON line detected: ${line.slice(0, 100)}`\n );\n }\n\n if (typeof parsed !== 'object' || parsed === null) {\n throw new McpServerError(\n 'E_MCP_STDOUT_FENCE_VIOLATION',\n `Stdout fence: non-JSON-RPC 2.0 object on stdout: ${line.slice(0, 100)}`\n );\n }\n\n const obj = parsed as Record<string, unknown>;\n\n if (obj.jsonrpc !== '2.0') {\n throw new McpServerError(\n 'E_MCP_STDOUT_FENCE_VIOLATION',\n `Stdout fence: non-JSON-RPC 2.0 object on stdout: ${line.slice(0, 100)}`\n );\n }\n\n // Require valid JSON-RPC 2.0 response shape: id + (result or error),\n // or a notification (method without id). Reject anything else.\n const hasId = 'id' in obj;\n const hasResult = 'result' in obj;\n const hasError = 'error' in obj;\n const hasMethod = 'method' in obj;\n\n if (hasId && (hasResult || hasError)) {\n // Valid response\n return;\n }\n if (hasMethod && !hasId) {\n // Valid notification (server -> client, e.g. notifications/*)\n return;\n }\n\n throw new McpServerError(\n 'E_MCP_STDOUT_FENCE_VIOLATION',\n `Stdout fence: malformed JSON-RPC 2.0 message (expected response or notification): ${line.slice(0, 100)}`\n );\n }\n\n function processBuffer(): void {\n const lines = buffer.split('\\n');\n // Keep the last segment (incomplete line or empty string after trailing newline)\n buffer = lines.pop()!;\n bufferBytes = new TextEncoder().encode(buffer).length;\n\n for (const line of lines) {\n const trimmed = line.trim();\n if (trimmed.length === 0) continue; // skip blank lines\n validateJsonRpcLine(trimmed);\n }\n }\n\n const patchedWrite = function (\n chunk: string | Uint8Array,\n encodingOrCallback?: BufferEncoding | WriteCallback,\n callback?: WriteCallback\n ): boolean {\n // Normalize arguments\n let encoding: BufferEncoding | undefined;\n let cb: WriteCallback | undefined;\n\n if (typeof encodingOrCallback === 'function') {\n cb = encodingOrCallback;\n } else {\n encoding = encodingOrCallback;\n cb = callback;\n }\n\n // Convert chunk to string\n const str = typeof chunk === 'string' ? chunk : new TextDecoder().decode(chunk);\n\n // Cap buffer growth before appending -- prevents memory exhaustion from\n // writes that never include a newline (e.g. broken serializer)\n const chunkBytes = new TextEncoder().encode(str).length;\n if (bufferBytes + chunkBytes > MAX_LINE_BYTES) {\n throw new McpServerError(\n 'E_MCP_STDOUT_FENCE_VIOLATION',\n `Stdout fence: buffer exceeded ${MAX_LINE_BYTES} bytes without a newline`\n );\n }\n\n buffer += str;\n bufferBytes += chunkBytes;\n processBuffer();\n\n // Forward to original write\n if (encoding) {\n return originalWrite(chunk, encoding, cb);\n }\n return originalWrite(chunk, cb as WriteCallback);\n };\n\n process.stdout.write = patchedWrite as typeof process.stdout.write;\n\n // Teardown: flush remaining buffer, restore original\n return function teardown(): void {\n // Validate any remaining buffered content\n if (buffer.trim().length > 0) {\n validateJsonRpcLine(buffer.trim());\n }\n buffer = '';\n bufferBytes = 0;\n process.stdout.write = originalWrite;\n };\n}\n","/**\n * MCP Server binding -- ONLY file importing @modelcontextprotocol/sdk\n *\n * Registers pure tool handlers with the MCP server.\n * Injects _meta audit block into every response.\n */\n\nimport { McpServer } from '@modelcontextprotocol/sdk/server/mcp.js';\nimport type { CallToolResult, ToolAnnotations } from '@modelcontextprotocol/sdk/types.js';\nimport { ERRORS } from '@peac/kernel';\nimport { SERVER_NAME } from './infra/constants.js';\nimport type { PolicyConfig } from './infra/policy.js';\nimport type { ServerContext, HandlerResult } from './handlers/types.js';\nimport { handleVerify } from './handlers/verify.js';\nimport { handleInspect } from './handlers/inspect.js';\nimport { handleDecode } from './handlers/decode.js';\nimport { handleIssue } from './handlers/issue.js';\nimport { handleCreateBundle } from './handlers/bundle.js';\nimport { checkInputSizes, checkObjectDepth, measureEnvelopeBytes } from './handlers/guards.js';\nimport type { VerifyInput } from './schemas/verify.js';\nimport type { InspectInput } from './schemas/inspect.js';\nimport type { DecodeInput } from './schemas/decode.js';\nimport type { IssueInput } from './schemas/issue.js';\nimport type { BundleInput } from './schemas/bundle.js';\nimport { VerifyInputSchema, VerifyOutputSchema } from './schemas/verify.js';\nimport { InspectInputSchema, InspectOutputSchema } from './schemas/inspect.js';\nimport { DecodeInputSchema, DecodeOutputSchema } from './schemas/decode.js';\nimport { IssueInputSchema, IssueOutputSchema } from './schemas/issue.js';\nimport { BundleInputSchema, BundleOutputSchema } from './schemas/bundle.js';\n\nexport interface ServerOptions {\n version: string;\n policy: PolicyConfig;\n policyHash: string;\n protocolVersion: string;\n context: ServerContext;\n}\n\nfunction makeMeta(ctx: ServerContext, serverName: string): Record<string, unknown> {\n return {\n serverName,\n serverVersion: ctx.version,\n policyHash: ctx.policyHash,\n protocolVersion: ctx.protocolVersion,\n wireFormatVersion: '0.2',\n };\n}\n\nfunction handlerResultToCallToolResult(\n result: HandlerResult,\n meta: Record<string, unknown>\n): CallToolResult {\n return {\n content: [{ type: 'text' as const, text: result.text }],\n structuredContent: { _meta: meta, ...result.structured },\n isError: result.isError,\n };\n}\n\nconst PURE_TOOL_ANNOTATIONS: ToolAnnotations = {\n readOnlyHint: true,\n destructiveHint: false,\n idempotentHint: true,\n openWorldHint: false,\n};\n\n// peac_issue: pure in-memory signing, no filesystem or network side-effects.\n// readOnlyHint: true -- produces a JWS string, does not mutate state.\n// idempotentHint: false -- each call includes a fresh `iat` timestamp.\n// openWorldHint: false -- closed world; no external I/O or filesystem access.\nconst ISSUE_TOOL_ANNOTATIONS: ToolAnnotations = {\n readOnlyHint: true,\n destructiveHint: false,\n idempotentHint: false,\n openWorldHint: false,\n};\n\nconst BUNDLE_TOOL_ANNOTATIONS: ToolAnnotations = {\n readOnlyHint: false,\n destructiveHint: true,\n idempotentHint: false,\n openWorldHint: true,\n};\n\nconst MAX_INPUT_DEPTH = 10;\n\nfunction errorCallToolResult(\n meta: Record<string, unknown>,\n code: string,\n message: string\n): CallToolResult {\n const errorDef = ERRORS[code];\n return {\n content: [{ type: 'text' as const, text: message }],\n structuredContent: {\n _meta: meta,\n ok: false,\n code,\n message,\n retryable: errorDef?.retryable ?? false,\n next_action: errorDef?.next_action ?? 'none',\n },\n isError: true,\n };\n}\n\n/**\n * Narrowed type for McpServer.registerTool that avoids TS2589\n * deep instantiation errors from cross-version Zod generics.\n *\n * The MCP SDK and our workspace may pin different Zod versions.\n * Zod schema objects are structurally identical at runtime (the SDK\n * duck-types via _def presence check), but TypeScript cannot resolve\n * the deep generic chain across version boundaries.\n *\n * This type accurately describes the runtime contract: inputSchema\n * accepts any object with Zod-like structure (which our schemas are).\n * See package.json for actual pinned versions.\n */\ntype RegisterToolBridge = (\n name: string,\n config: {\n title?: string;\n description?: string;\n inputSchema?: unknown;\n outputSchema?: unknown;\n annotations?: ToolAnnotations;\n },\n cb: (args: Record<string, unknown>, extra: Record<string, unknown>) => Promise<CallToolResult>\n) => unknown;\n\nexport function createPeacMcpServer(options: ServerOptions): McpServer {\n const { version, policy, context } = options;\n\n // Compute registered tool list upfront for capability discovery\n const registeredTools = ['peac_verify', 'peac_inspect', 'peac_decode'];\n if (context.issuerKey && context.issuerId) {\n registeredTools.push('peac_issue');\n if (context.bundleDir) {\n registeredTools.push('peac_create_bundle');\n }\n }\n\n const meta = { ...makeMeta(context, SERVER_NAME), registeredTools };\n const maxConcurrency = policy.limits.max_concurrency;\n let activeHandlers = 0;\n\n async function wrapHandler(\n toolName: string,\n args: Record<string, unknown>,\n handlerFn: (signal?: AbortSignal) => Promise<HandlerResult>,\n signal?: AbortSignal\n ): Promise<CallToolResult> {\n // Cancellation: if already aborted before we start, return immediately\n if (signal?.aborted) {\n return errorCallToolResult(meta, 'E_MCP_CANCELLED', 'Request cancelled');\n }\n\n // Concurrency guard\n if (activeHandlers >= maxConcurrency) {\n return errorCallToolResult(\n meta,\n 'E_MCP_CONCURRENCY_LIMIT',\n `Server at capacity (${maxConcurrency} concurrent handlers)`\n );\n }\n\n // Input depth guard\n if (!checkObjectDepth(args, MAX_INPUT_DEPTH)) {\n return errorCallToolResult(\n meta,\n 'E_MCP_INPUT_TOO_DEEP',\n `Input exceeds maximum nesting depth of ${MAX_INPUT_DEPTH}`\n );\n }\n\n // Input size guard (recursive sum of all string bytes)\n const inputSizeResult = checkInputSizes(args, policy);\n if (inputSizeResult) {\n return handlerResultToCallToolResult(inputSizeResult, meta);\n }\n\n // Reserve concurrency slot. Released when the handler settles (not when\n // timeout fires), so inflight CPU work stays bounded by maxConcurrency.\n // The slot release is detached -- wrapHandler returns the timeout error\n // immediately without waiting for the handler to finish.\n //\n // IMPORTANT: If a handler promise never settles, the concurrency slot is\n // permanently leaked. This is by design -- Node.js cannot forcibly cancel\n // arbitrary user code. All built-in handlers (verify, inspect, decode) are\n // pure synchronous-ish operations that will always settle. Future handlers\n // with network I/O should accept AbortSignal and honor cancellation.\n // If leaked slots become an operational concern, add a watchdog that logs\n // when a handler exceeds 2x tool_timeout_ms without settling.\n activeHandlers++;\n const handlerPromise = handlerFn(signal);\n\n // Detached slot release: fires when handler settles, regardless of timeout.\n // The void + catch ensure no unhandled rejection if handler throws.\n void handlerPromise\n .finally(() => {\n activeHandlers--;\n })\n .catch(() => {});\n\n // Timeout + cancellation race -- handlerPromise keeps running even if\n // timeout or cancellation fires. Timer is cleared when the handler\n // resolves to avoid unnecessary timers accumulating under load.\n let timedOut = false;\n let cancelled = false;\n let timer: ReturnType<typeof setTimeout> | undefined;\n const timeoutPromise = new Promise<never>((_resolve, reject) => {\n timer = setTimeout(() => {\n timedOut = true;\n reject(new Error(`Tool \"${toolName}\" timed out after ${policy.limits.tool_timeout_ms}ms`));\n }, policy.limits.tool_timeout_ms);\n // Prevent timeout timer from keeping Node.js alive during shutdown\n timer.unref?.();\n });\n\n // Build race participants: handler vs timeout vs (optional) cancellation\n const raceParticipants: Promise<HandlerResult>[] = [handlerPromise, timeoutPromise];\n\n let abortCleanup: (() => void) | undefined;\n if (signal && !signal.aborted) {\n const cancelPromise = new Promise<never>((_resolve, reject) => {\n const onAbort = () => {\n cancelled = true;\n reject(new Error('Request cancelled'));\n };\n signal.addEventListener('abort', onAbort, { once: true });\n abortCleanup = () => signal.removeEventListener('abort', onAbort);\n });\n raceParticipants.push(cancelPromise);\n }\n\n try {\n const result = await Promise.race(raceParticipants);\n\n // Output size cap -- measure the full JSON-RPC envelope that will be\n // serialized to stdout, not just the tool result. This is the actual\n // risk surface for downstream clients parsing the response line.\n // Uses conservative UUID-length id placeholder (default) since the\n // MCP SDK doesn't expose the request id to tool handlers.\n const callResult = handlerResultToCallToolResult(result, meta);\n const outputBytes = measureEnvelopeBytes(callResult);\n if (outputBytes > policy.limits.max_response_bytes) {\n return errorCallToolResult(\n meta,\n 'E_MCP_OUTPUT_TOO_LARGE',\n `Response is ${outputBytes} bytes, exceeding limit of ${policy.limits.max_response_bytes}`\n );\n }\n\n return callResult;\n } catch (err) {\n const message = err instanceof Error ? err.message : String(err);\n if (cancelled) {\n return errorCallToolResult(meta, 'E_MCP_CANCELLED', 'Request cancelled');\n }\n if (timedOut) {\n return errorCallToolResult(meta, 'E_MCP_TOOL_TIMEOUT', message);\n }\n return errorCallToolResult(meta, 'E_MCP_INTERNAL', message);\n } finally {\n clearTimeout(timer);\n abortCleanup?.();\n }\n }\n\n const server = new McpServer(\n { name: SERVER_NAME, version },\n // listChanged: false -- tool set is static per server instance (determined\n // at startup from CLI flags). The server never emits notifications/tools/list_changed.\n { capabilities: { tools: { listChanged: false } } }\n );\n\n // Bind with narrowed types to bridge workspace Zod <-> SDK Zod boundary\n const register = server.registerTool.bind(server) as RegisterToolBridge;\n\n // -- peac_verify --\n register(\n 'peac_verify',\n {\n title: 'Verify PEAC Receipt',\n description:\n 'Verify a PEAC receipt: check Ed25519 signature, validate claims, and return structured check results. Read-only, no side effects.',\n inputSchema: VerifyInputSchema,\n outputSchema: VerifyOutputSchema,\n annotations: PURE_TOOL_ANNOTATIONS,\n },\n async (args, extra) =>\n wrapHandler(\n 'peac_verify',\n args,\n (signal) => handleVerify({ input: args as VerifyInput, policy, context, signal }),\n (extra as { signal?: AbortSignal }).signal\n )\n );\n\n // -- peac_inspect --\n register(\n 'peac_inspect',\n {\n title: 'Inspect PEAC Receipt',\n description:\n 'Inspect a PEAC receipt without verifying the signature. Returns decoded header, payload metadata, and timestamps. Read-only.',\n inputSchema: InspectInputSchema,\n outputSchema: InspectOutputSchema,\n annotations: PURE_TOOL_ANNOTATIONS,\n },\n async (args, extra) =>\n wrapHandler(\n 'peac_inspect',\n args,\n (signal) => handleInspect({ input: args as InspectInput, policy, context, signal }),\n (extra as { signal?: AbortSignal }).signal\n )\n );\n\n // -- peac_decode --\n register(\n 'peac_decode',\n {\n title: 'Decode PEAC Receipt',\n description:\n 'Raw-decode a PEAC receipt JWS into header and payload objects. No signature check. Use peac_verify for trusted results.',\n inputSchema: DecodeInputSchema,\n outputSchema: DecodeOutputSchema,\n annotations: PURE_TOOL_ANNOTATIONS,\n },\n async (args, extra) =>\n wrapHandler(\n 'peac_decode',\n args,\n (signal) => handleDecode({ input: args as DecodeInput, policy, context, signal }),\n (extra as { signal?: AbortSignal }).signal\n )\n );\n\n // -- Privileged tools (conditionally registered) --\n\n // peac_issue: requires issuerKey + issuerId\n if (context.issuerKey && context.issuerId) {\n register(\n 'peac_issue',\n {\n title: 'Issue Wire 0.2 PEAC Receipt',\n description:\n 'Sign and return a Wire 0.2 PEAC receipt JWS. Accepts kind, type, pillars, extensions, and policy fields. Wire 0.2 only: Wire 0.1 fields are not accepted. Requires server configured with an Ed25519 issuer key (--issuer-key and --issuer-id).',\n inputSchema: IssueInputSchema,\n outputSchema: IssueOutputSchema,\n annotations: ISSUE_TOOL_ANNOTATIONS,\n },\n async (args, extra) =>\n wrapHandler(\n 'peac_issue',\n args,\n (signal) => handleIssue({ input: args as IssueInput, policy, context, signal }),\n (extra as { signal?: AbortSignal }).signal\n )\n );\n\n // peac_create_bundle: additionally requires bundleDir\n if (context.bundleDir) {\n register(\n 'peac_create_bundle',\n {\n title: 'Create Evidence Bundle',\n description:\n 'Create a signed evidence bundle directory from one or more receipt JWS strings. Writes files to disk. Requires --issuer-key, --issuer-id, and --bundle-dir.',\n inputSchema: BundleInputSchema,\n outputSchema: BundleOutputSchema,\n annotations: BUNDLE_TOOL_ANNOTATIONS,\n },\n async (args, extra) =>\n wrapHandler(\n 'peac_create_bundle',\n args,\n (signal) => handleCreateBundle({ input: args as BundleInput, policy, context, signal }),\n (extra as { signal?: AbortSignal }).signal\n )\n );\n }\n }\n\n return server;\n}\n\nexport { McpServer };\n","/**\n * Handler guards -- enforces policy limits and tool enablement\n *\n * ZERO MCP SDK imports.\n */\n\nimport type { PolicyConfig } from '../infra/policy.js';\nimport type { HandlerResult } from './types.js';\n\n/**\n * Check if the JWS input exceeds the configured max size.\n * Returns an error result if too large, undefined if OK.\n */\nexport function checkJwsSize(jws: string, policy: PolicyConfig): HandlerResult | undefined {\n const byteLength = new TextEncoder().encode(jws).length;\n if (byteLength > policy.limits.max_jws_bytes) {\n return {\n text: `Input rejected: JWS is ${byteLength} bytes, exceeding limit of ${policy.limits.max_jws_bytes} bytes`,\n structured: {\n ok: false,\n code: 'E_MCP_INPUT_TOO_LARGE',\n message: `JWS input is ${byteLength} bytes, limit is ${policy.limits.max_jws_bytes}`,\n },\n isError: true,\n };\n }\n return undefined;\n}\n\n/**\n * Check if the tool is enabled in policy.\n * Returns an error result if disabled, undefined if OK.\n */\nexport function checkToolEnabled(\n toolName: string,\n policy: PolicyConfig\n): HandlerResult | undefined {\n const toolConfig = policy.tools[toolName];\n if (toolConfig && toolConfig.enabled === false) {\n return {\n text: `Tool \"${toolName}\" is disabled by server policy`,\n structured: {\n ok: false,\n code: 'E_MCP_TOOL_DISABLED',\n message: `Tool \"${toolName}\" is disabled by server policy`,\n },\n isError: true,\n };\n }\n return undefined;\n}\n\n/**\n * Recursively sum byte lengths of all string values in an object graph.\n * Depth is bounded by checkObjectDepth (called first in wrapHandler).\n * Uses a WeakSet to guard against cyclic references.\n */\nfunction sumStringBytes(value: unknown, seen?: WeakSet<object>): number {\n if (typeof value === 'string') {\n return new TextEncoder().encode(value).length;\n }\n if (typeof value !== 'object' || value === null) return 0;\n\n // Cycle guard: skip objects we've already visited\n const visited = seen ?? new WeakSet<object>();\n if (visited.has(value as object)) return 0;\n visited.add(value as object);\n\n if (Array.isArray(value)) {\n let total = 0;\n for (const item of value) {\n total += sumStringBytes(item, visited);\n }\n return total;\n }\n let total = 0;\n for (const v of Object.values(value as Record<string, unknown>)) {\n total += sumStringBytes(v, visited);\n }\n return total;\n}\n\n/**\n * Bounded serialized-size estimator. Walks the object graph and estimates\n * JSON serialized bytes WITHOUT materializing the full string. Aborts early\n * when the estimate exceeds the limit (returns Infinity). This prevents\n * memory exhaustion from adversarial inputs with many small non-string values\n * (e.g. large arrays of numbers) that would bypass string-only counting.\n *\n * Accuracy: conservative overestimate for numbers (uses String(n).length),\n * exact for strings (JSON.stringify escapes), exact for structural overhead.\n * Uses a WeakSet cycle guard consistent with sumStringBytes.\n */\nfunction estimateSerializedBytes(value: unknown, limit: number, seen?: WeakSet<object>): number {\n if (value === null) return 4; // \"null\"\n if (value === undefined) return 0; // omitted in JSON\n if (typeof value === 'boolean') return value ? 4 : 5; // \"true\" / \"false\"\n if (typeof value === 'number') return String(value).length;\n if (typeof value === 'string') return Buffer.byteLength(JSON.stringify(value), 'utf8');\n\n if (typeof value !== 'object') return 0;\n\n const visited = seen ?? new WeakSet<object>();\n if (visited.has(value as object)) return 0;\n visited.add(value as object);\n\n let total = 2; // {} or []\n\n if (Array.isArray(value)) {\n for (let i = 0; i < value.length; i++) {\n if (i > 0) total += 1; // comma\n total += estimateSerializedBytes(value[i], limit, visited);\n if (total > limit) return Infinity; // early exit\n }\n return total;\n }\n\n const entries = Object.entries(value as Record<string, unknown>);\n for (let i = 0; i < entries.length; i++) {\n if (i > 0) total += 1; // comma\n const [k, v] = entries[i];\n total += Buffer.byteLength(JSON.stringify(k), 'utf8') + 1; // key + colon\n total += estimateSerializedBytes(v, limit, visited);\n if (total > limit) return Infinity; // early exit\n }\n return total;\n}\n\n/**\n * Check total input size across all string fields (recursive).\n * Prevents memory exhaustion from oversized jwks, public_key_base64url, etc.\n * Traverses the full object graph so nested payloads cannot bypass the limit.\n * Uses 2x max_jws_bytes as the total budget.\n *\n * Also applies a bounded serialized-size estimate (without materializing\n * the full JSON string) to catch large non-string structures like arrays\n * of numbers that bypass string-only counting.\n */\nexport function checkInputSizes(\n input: Record<string, unknown>,\n policy: PolicyConfig\n): HandlerResult | undefined {\n const limit = policy.limits.max_jws_bytes * 2;\n\n // Primary check: recursive string byte sum\n const totalBytes = sumStringBytes(input);\n if (totalBytes > limit) {\n return {\n text: `Input rejected: total input is ${totalBytes} bytes, exceeding limit of ${limit} bytes`,\n structured: {\n ok: false,\n code: 'E_MCP_INPUT_TOO_LARGE',\n message: `Total input is ${totalBytes} bytes, limit is ${limit}`,\n },\n isError: true,\n };\n }\n\n // Fallback: bounded serialized-size estimate catches large non-string structures\n // without materializing the full JSON string (prevents allocation attacks)\n const estimatedBytes = estimateSerializedBytes(input, limit);\n if (estimatedBytes > limit) {\n return {\n text: `Input rejected: estimated serialized input exceeds limit of ${limit} bytes`,\n structured: {\n ok: false,\n code: 'E_MCP_INPUT_TOO_LARGE',\n message: `Estimated serialized input exceeds limit of ${limit} bytes`,\n },\n isError: true,\n };\n }\n\n return undefined;\n}\n\n/**\n * Check that an object does not exceed maximum nesting depth.\n * Prevents stack overflow from deeply nested input params.\n */\nexport function checkObjectDepth(\n obj: unknown,\n maxDepth: number = 10,\n currentDepth: number = 0\n): boolean {\n if (currentDepth > maxDepth) return false;\n if (typeof obj !== 'object' || obj === null) return true;\n if (Array.isArray(obj)) {\n return obj.every((item) => checkObjectDepth(item, maxDepth, currentDepth + 1));\n }\n return Object.values(obj as Record<string, unknown>).every((value) =>\n checkObjectDepth(value, maxDepth, currentDepth + 1)\n );\n}\n\n/**\n * Conservative placeholder id for envelope size estimation.\n * The MCP SDK does not expose the JSON-RPC request id to tool handlers,\n * so we budget for a typical UUID-length string id (36 chars + quotes = 38\n * bytes in JSON). This ensures the size cap is never underestimated due to\n * a longer-than-expected id from the client.\n */\nconst CONSERVATIVE_ID_PLACEHOLDER = '00000000-0000-0000-0000-000000000000';\n\n/**\n * Measure the byte length of a full JSON-RPC 2.0 response envelope.\n * This models the exact line that will be serialized to stdout by the\n * MCP SDK, including the request id and trailing newline.\n *\n * The +1 accounts for the line-feed delimiter that separates JSON-RPC\n * messages on the stdio transport.\n */\nexport function measureEnvelopeBytes(\n callToolResult: {\n content: unknown;\n structuredContent?: unknown;\n isError?: boolean;\n },\n id: string | number = CONSERVATIVE_ID_PLACEHOLDER\n): number {\n const envelope = {\n jsonrpc: '2.0',\n id,\n result: {\n content: callToolResult.content,\n structuredContent: callToolResult.structuredContent,\n isError: callToolResult.isError,\n },\n };\n return Buffer.byteLength(JSON.stringify(envelope), 'utf8') + 1; // +1 for \\n\n}\n\nexport interface TruncationResult {\n text: string;\n truncated: boolean;\n originalBytes: number;\n returnedBytes: number;\n}\n\nconst TRUNCATION_SUFFIX = '\\n\\n[TRUNCATED: response exceeded policy limit]';\nconst TRUNCATION_SUFFIX_BYTES = new TextEncoder().encode(TRUNCATION_SUFFIX).length;\n\n/**\n * Truncate response text to stay within max_response_bytes.\n * Guarantees the final byte length is <= maxBytes by computing the\n * suffix size exactly and slicing the body budget accordingly.\n * Returns truncation metadata for structured output signaling.\n */\nexport function truncateResponse(text: string, policy: PolicyConfig): TruncationResult {\n const maxBytes = policy.limits.max_response_bytes;\n const encoded = new TextEncoder().encode(text);\n if (encoded.length <= maxBytes) {\n return { text, truncated: false, originalBytes: encoded.length, returnedBytes: encoded.length };\n }\n\n // Budget for body = maxBytes - suffix bytes. If maxBytes is tiny,\n // clamp to 0 so we still return the suffix as signal.\n const bodyBudget = Math.max(0, maxBytes - TRUNCATION_SUFFIX_BYTES);\n // Truncate at byte boundary, avoiding mid-character cuts via TextDecoder\n const truncatedText = new TextDecoder().decode(encoded.slice(0, bodyBudget));\n const finalText = truncatedText + TRUNCATION_SUFFIX;\n const finalEncoded = new TextEncoder().encode(finalText);\n return {\n text: finalText,\n truncated: true,\n originalBytes: encoded.length,\n returnedBytes: finalEncoded.length,\n };\n}\n","/**\n * Verify handler -- ZERO MCP SDK imports\n *\n * Resolves key from input or context, delegates to verifyLocal.\n *\n * Append-only check name registry (stable contract):\n * signature, schema, expiry, issuer_binding, audience_binding\n */\n\nimport { verifyLocal } from '@peac/protocol';\nimport { base64urlDecode, decode } from '@peac/crypto';\nimport type { HandlerParams, HandlerResult } from './types.js';\nimport type { VerifyInput } from '../schemas/verify.js';\nimport { resolveKeyByKid } from '../infra/jwks-loader.js';\nimport { checkJwsSize, checkToolEnabled, truncateResponse } from './guards.js';\n\nfunction resolvePublicKey(params: HandlerParams<VerifyInput>): {\n publicKey: Uint8Array;\n keySource: string;\n} {\n const { input, context } = params;\n\n // Priority 1: inline public key\n if (input.public_key_base64url) {\n return {\n publicKey: base64urlDecode(input.public_key_base64url),\n keySource: 'inline',\n };\n }\n\n // Priority 2: inline JWKS\n if (input.jwks) {\n const jwks = JSON.parse(input.jwks) as { keys?: Array<Record<string, unknown>> };\n if (!jwks.keys?.length) {\n throw new Error('Provided JWKS contains no keys');\n }\n\n const { header } = decode(input.jws);\n const kid = header.kid;\n\n // Collect Ed25519 keys (reject non-EdDSA alg values)\n const ed25519Keys = jwks.keys.filter(\n (k) =>\n k.kty === 'OKP' &&\n k.crv === 'Ed25519' &&\n typeof k.x === 'string' &&\n (k.alg === undefined || k.alg === 'EdDSA')\n );\n\n if (ed25519Keys.length === 0) {\n throw new Error('Provided JWKS contains no Ed25519 keys');\n }\n\n // If kid present, match by kid\n if (kid) {\n const matched = ed25519Keys.find((k) => k.kid === kid);\n if (matched) {\n return {\n publicKey: base64urlDecode(matched.x as string),\n keySource: 'inline-jwks',\n };\n }\n throw Object.assign(\n new Error(`No matching Ed25519 key found in provided JWKS for kid=\"${kid}\"`),\n { errorCode: 'E_MCP_JWKS_NO_MATCH' as const }\n );\n }\n\n // No kid: single-key fallback\n if (ed25519Keys.length === 1) {\n return {\n publicKey: base64urlDecode(ed25519Keys[0].x as string),\n keySource: 'inline-jwks',\n };\n }\n\n throw Object.assign(\n new Error(\n `JWS has no kid and JWKS contains ${ed25519Keys.length} Ed25519 keys -- provide kid to select`\n ),\n { errorCode: 'E_MCP_KID_REQUIRED' as const }\n );\n }\n\n // Priority 3: server-configured JWKS\n if (context.jwksKeys?.length) {\n const { header } = decode(input.jws);\n const kid = header.kid;\n\n if (kid) {\n const key = resolveKeyByKid(context.jwksKeys, kid);\n if (key) {\n return { publicKey: key, keySource: 'server-jwks' };\n }\n throw Object.assign(new Error(`No matching key in server JWKS for kid=\"${kid}\"`), {\n errorCode: 'E_MCP_JWKS_NO_MATCH' as const,\n });\n }\n\n // No kid: single-key fallback\n if (context.jwksKeys.length === 1) {\n return { publicKey: context.jwksKeys[0].publicKey, keySource: 'server-jwks' };\n }\n\n throw Object.assign(\n new Error(\n `JWS has no kid and server JWKS contains ${context.jwksKeys.length} keys -- provide kid to select`\n ),\n { errorCode: 'E_MCP_KID_REQUIRED' as const }\n );\n }\n\n throw Object.assign(\n new Error(\n 'No public key available: provide public_key_base64url, jwks, or configure --jwks-file'\n ),\n { errorCode: 'E_MCP_KEY_RESOLUTION' as const }\n );\n}\n\nexport async function handleVerify(params: HandlerParams<VerifyInput>): Promise<HandlerResult> {\n const { input, policy } = params;\n\n // Guard: tool enablement\n const disabledResult = checkToolEnabled('peac_verify', policy);\n if (disabledResult) return disabledResult;\n\n // Guard: JWS size limit\n const sizeResult = checkJwsSize(input.jws, policy);\n if (sizeResult) return sizeResult;\n\n let publicKey: Uint8Array;\n let keySource: string;\n try {\n const resolved = resolvePublicKey(params);\n publicKey = resolved.publicKey;\n keySource = resolved.keySource;\n } catch (err) {\n const code =\n ((err as Record<string, unknown>).errorCode as string | undefined) ?? 'E_MCP_KEY_RESOLUTION';\n return {\n text: `Verification failed: ${err instanceof Error ? err.message : String(err)}`,\n structured: {\n ok: false,\n code,\n message: err instanceof Error ? err.message : String(err),\n checks: [],\n },\n isError: true,\n };\n }\n\n const result = await verifyLocal(input.jws, publicKey, {\n issuer: input.issuer,\n audience: input.audience,\n });\n\n if (result.valid) {\n const checks = [\n { name: 'signature', passed: true },\n { name: 'schema', passed: true },\n { name: 'expiry', passed: true },\n ];\n\n if (input.issuer) {\n checks.push({ name: 'issuer_binding', passed: true });\n }\n if (input.audience) {\n checks.push({ name: 'audience_binding', passed: true });\n }\n\n const claims = result.claims as Record<string, unknown>;\n const claimsSummary: Record<string, unknown> = {\n iss: claims.iss,\n kind: claims.kind,\n type: claims.type,\n jti: claims.jti,\n ...(claims.sub !== undefined && { sub: claims.sub }),\n variant: result.variant,\n wireVersion: result.wireVersion,\n };\n\n const tr = truncateResponse(\n `Verification PASSED (${result.variant} receipt, kind=${claims.kind ?? 'unknown'}, kid=${result.kid})`,\n policy\n );\n return {\n text: tr.text,\n structured: {\n ok: true,\n variant: result.variant,\n checks,\n claimsSummary,\n keySource,\n ...(tr.truncated\n ? {\n _truncation: {\n truncated: tr.truncated,\n originalBytes: tr.originalBytes,\n returnedBytes: tr.returnedBytes,\n },\n }\n : {}),\n },\n };\n }\n\n // Failure case\n const checks: Array<{ name: string; passed: boolean; message?: string }> = [];\n if (result.code === 'E_INVALID_SIGNATURE') {\n checks.push({ name: 'signature', passed: false, message: result.message });\n } else if (result.code === 'E_INVALID_FORMAT') {\n checks.push({ name: 'signature', passed: true });\n checks.push({ name: 'schema', passed: false, message: result.message });\n } else if (result.code === 'E_EXPIRED') {\n checks.push({ name: 'signature', passed: true });\n checks.push({ name: 'schema', passed: true });\n checks.push({ name: 'expiry', passed: false, message: result.message });\n } else if (result.code === 'E_INVALID_ISSUER') {\n checks.push({ name: 'signature', passed: true });\n checks.push({ name: 'schema', passed: true });\n checks.push({ name: 'issuer_binding', passed: false, message: result.message });\n } else if (result.code === 'E_INVALID_AUDIENCE') {\n checks.push({ name: 'signature', passed: true });\n checks.push({ name: 'schema', passed: true });\n checks.push({ name: 'audience_binding', passed: false, message: result.message });\n } else {\n checks.push({ name: result.code, passed: false, message: result.message });\n }\n\n const trFail = truncateResponse(\n `Verification FAILED: ${result.code} -- ${result.message}`,\n policy\n );\n return {\n text: trFail.text,\n structured: {\n ok: false,\n code: result.code,\n message: result.message,\n checks,\n keySource,\n ...(trFail.truncated\n ? {\n _truncation: {\n truncated: trFail.truncated,\n originalBytes: trFail.originalBytes,\n returnedBytes: trFail.returnedBytes,\n },\n }\n : {}),\n },\n };\n}\n","/**\n * Inspect handler -- ZERO MCP SDK imports\n *\n * Decodes JWS (without verifying) and extracts metadata.\n * Respects policy redaction settings.\n */\n\nimport { decode } from '@peac/crypto';\nimport { parseReceiptClaims } from '@peac/schema';\nimport type { HandlerParams, HandlerResult } from './types.js';\nimport type { InspectInput } from '../schemas/inspect.js';\nimport { checkJwsSize, checkToolEnabled, truncateResponse } from './guards.js';\n\nexport async function handleInspect(params: HandlerParams<InspectInput>): Promise<HandlerResult> {\n const { input, policy } = params;\n\n // Guard: tool enablement\n const disabledResult = checkToolEnabled('peac_inspect', policy);\n if (disabledResult) return disabledResult;\n\n // Guard: JWS size limit\n const sizeResult = checkJwsSize(input.jws, policy);\n if (sizeResult) return sizeResult;\n\n let header: Record<string, unknown>;\n let payload: Record<string, unknown>;\n try {\n const decoded = decode<Record<string, unknown>>(input.jws);\n header = decoded.header as unknown as Record<string, unknown>;\n payload = decoded.payload;\n } catch (err) {\n return {\n text: `Inspect failed: ${err instanceof Error ? err.message : String(err)}`,\n structured: {\n error: err instanceof Error ? err.message : String(err),\n code: 'E_MCP_INVALID_INPUT',\n },\n isError: true,\n };\n }\n\n // Classify variant (don't throw on failure)\n let variant = 'unknown';\n try {\n const pr = parseReceiptClaims(payload);\n if (pr.ok) {\n variant = pr.variant;\n }\n } catch {\n // classification failure is non-fatal\n }\n\n const payloadMeta: Record<string, unknown> = {\n variant,\n issuer: payload.iss,\n audience: payload.aud,\n };\n\n if (typeof payload.iat === 'number') {\n payloadMeta.issuedAt = new Date(payload.iat * 1000).toISOString();\n }\n if (typeof payload.exp === 'number') {\n payloadMeta.expiresAt = new Date(payload.exp * 1000).toISOString();\n }\n if (typeof payload.rid === 'string') {\n payloadMeta.receiptId = payload.rid;\n }\n\n // Apply redaction\n let redacted = false;\n let fullPayload: Record<string, unknown> | undefined;\n\n // Gate: full_claims only honored when policy permits (inspect_full_claims)\n const effectiveFullClaims = input.full_claims && policy.redaction.inspect_full_claims;\n if (effectiveFullClaims) {\n fullPayload = { ...payload };\n\n if (policy.redaction.strip_evidence && 'evidence' in fullPayload) {\n fullPayload.evidence = '[REDACTED by policy]';\n redacted = true;\n }\n if (policy.redaction.strip_payment && 'payment' in fullPayload) {\n fullPayload.payment = '[REDACTED by policy]';\n redacted = true;\n }\n }\n\n const lines = [\n 'WARNING: Signature NOT verified (use peac_verify to verify)',\n '',\n `Variant: ${variant}`,\n `Issuer: ${payload.iss ?? 'N/A'}`,\n `Audience: ${payload.aud ?? 'N/A'}`,\n ];\n\n if (payloadMeta.issuedAt) lines.push(`Issued At: ${payloadMeta.issuedAt}`);\n if (payloadMeta.expiresAt) lines.push(`Expires At: ${payloadMeta.expiresAt}`);\n if (payloadMeta.receiptId) lines.push(`Receipt ID: ${payloadMeta.receiptId}`);\n if (redacted) lines.push('', 'Note: Some fields redacted by policy');\n\n const tr = truncateResponse(lines.join('\\n'), policy);\n return {\n text: tr.text,\n structured: {\n header,\n payloadMeta,\n ...(fullPayload !== undefined ? { fullPayload } : {}),\n redacted,\n verified: false,\n ...(tr.truncated\n ? {\n _truncation: {\n truncated: tr.truncated,\n originalBytes: tr.originalBytes,\n returnedBytes: tr.returnedBytes,\n },\n }\n : {}),\n },\n };\n}\n","/**\n * Decode handler -- ZERO MCP SDK imports\n *\n * Raw JWS decode. Returns header and payload without verification.\n * Text output is bounded by policy limits.\n */\n\nimport { decode } from '@peac/crypto';\nimport type { HandlerParams, HandlerResult } from './types.js';\nimport type { DecodeInput } from '../schemas/decode.js';\nimport { checkJwsSize, checkToolEnabled, truncateResponse } from './guards.js';\n\nexport async function handleDecode(params: HandlerParams<DecodeInput>): Promise<HandlerResult> {\n const { input, policy } = params;\n\n // Guard: tool enablement\n const disabledResult = checkToolEnabled('peac_decode', policy);\n if (disabledResult) return disabledResult;\n\n // Guard: JWS size limit\n const sizeResult = checkJwsSize(input.jws, policy);\n if (sizeResult) return sizeResult;\n\n try {\n const decoded = decode<Record<string, unknown>>(input.jws);\n const header = decoded.header as unknown as Record<string, unknown>;\n const payload = decoded.payload;\n\n const tr = truncateResponse(\n [\n 'WARNING: Signature NOT verified',\n '',\n `Header: ${JSON.stringify(header, null, 2)}`,\n '',\n `Payload: ${JSON.stringify(payload, null, 2)}`,\n ].join('\\n'),\n policy\n );\n\n return {\n text: tr.text,\n structured: {\n header,\n payload,\n verified: false,\n ...(tr.truncated\n ? {\n _truncation: {\n truncated: tr.truncated,\n originalBytes: tr.originalBytes,\n returnedBytes: tr.returnedBytes,\n },\n }\n : {}),\n },\n };\n } catch (err) {\n return {\n text: `Decode failed: ${err instanceof Error ? err.message : String(err)}`,\n structured: {\n error: err instanceof Error ? err.message : String(err),\n code: 'E_MCP_INVALID_INPUT',\n },\n isError: true,\n };\n }\n}\n","/**\n * Issue handler -- Wire 0.2 only, ZERO MCP SDK imports\n *\n * Signs and returns a Wire 0.2 PEAC record JWS (in-memory only, no side-effects).\n * Requires issuerKey + issuerId on ServerContext.\n */\n\nimport { issueWire02, IssueError } from '@peac/protocol';\nimport { decode, base64urlEncode } from '@peac/crypto';\nimport type { HandlerParams, HandlerResult } from './types.js';\nimport type { IssueInput } from '../schemas/issue.js';\nimport { McpServerError, sanitizeOutput } from '../infra/errors.js';\nimport { checkToolEnabled, truncateResponse } from './guards.js';\n\n/**\n * Build Trust Gate 1 patterns from the actual loaded key.\n * Matches base64url-encoded private key bytes and public key bytes.\n */\nfunction buildKeyPatterns(privateKey: Uint8Array, publicKey: Uint8Array): RegExp[] {\n const privB64 = base64urlEncode(privateKey);\n const pubB64 = base64urlEncode(publicKey);\n // Escape any regex-special chars in base64url strings (none expected, but defensive)\n const escPriv = privB64.replace(/[.*+?^${}()|[\\]\\\\]/g, '\\\\$&');\n const escPub = pubB64.replace(/[.*+?^${}()|[\\]\\\\]/g, '\\\\$&');\n return [new RegExp(escPriv, 'g'), new RegExp(escPub, 'g')];\n}\n\nexport async function handleIssue(params: HandlerParams<IssueInput>): Promise<HandlerResult> {\n const { input, policy, context } = params;\n\n // Guard: tool enablement\n const disabledResult = checkToolEnabled('peac_issue', policy);\n if (disabledResult) return disabledResult;\n\n // Guard: issuer key + id must be configured\n if (!context.issuerKey || !context.issuerId) {\n return {\n text: 'Issue failed: server not configured with issuer key and ID (--issuer-key + --issuer-id)',\n structured: {\n ok: false,\n code: 'E_MCP_KEY_REQUIRED',\n message: 'Server requires --issuer-key and --issuer-id for peac_issue',\n },\n isError: true,\n };\n }\n\n // Guard: check claims byte size\n const inputJson = JSON.stringify(input);\n const inputBytes = new TextEncoder().encode(inputJson).length;\n if (inputBytes > policy.limits.max_claims_bytes) {\n return {\n text: `Input rejected: claims are ${inputBytes} bytes, exceeding limit of ${policy.limits.max_claims_bytes} bytes`,\n structured: {\n ok: false,\n code: 'E_MCP_INPUT_TOO_LARGE',\n message: `Claims input is ${inputBytes} bytes, limit is ${policy.limits.max_claims_bytes}`,\n },\n isError: true,\n };\n }\n\n // Build Trust Gate 1 patterns from actual key\n const keyPatterns = buildKeyPatterns(context.issuerKey.privateKey, context.issuerKey.publicKey);\n\n try {\n // Build policy block: PolicyBlock requires digest (non-optional per kernel type).\n // If caller provides policy without digest, return a clear error rather than\n // silently discarding the policy metadata.\n if (input.policy && !input.policy.digest) {\n return {\n text: 'Issue failed: policy.digest is required when policy block is provided',\n structured: {\n ok: false,\n code: 'E_MCP_ISSUE_FAILED',\n message:\n 'policy.digest is required when policy block is provided (uri/version alone is insufficient for binding)',\n },\n isError: true,\n };\n }\n const policyBlock = input.policy?.digest\n ? { digest: input.policy.digest, uri: input.policy.uri, version: input.policy.version }\n : undefined;\n\n const result = await issueWire02({\n iss: context.issuerId,\n kind: input.kind,\n type: input.type,\n sub: input.sub,\n pillars: input.pillars,\n occurred_at: input.occurred_at,\n extensions: input.extensions,\n policy: policyBlock,\n privateKey: context.issuerKey.privateKey,\n kid: context.issuerKey.kid,\n });\n\n // Decode JWS to extract claims summary\n const { payload } = decode<Record<string, unknown>>(result.jws);\n const claimsSummary = {\n iss: payload.iss as string,\n kind: payload.kind as string,\n type: payload.type as string,\n iat: payload.iat as number,\n jti: payload.jti as string,\n ...(payload.sub !== undefined ? { sub: payload.sub as string } : {}),\n ...(payload.pillars !== undefined ? { pillars: payload.pillars as string[] } : {}),\n };\n\n // Trust Gate 1: scan output for key bytes\n const tr = truncateResponse(\n `Receipt issued: jti=${claimsSummary.jti}, kind=${claimsSummary.kind}, type=${claimsSummary.type}`,\n policy\n );\n const safeText = sanitizeOutput(tr.text, keyPatterns);\n\n return {\n text: safeText,\n structured: {\n ok: true,\n jws: result.jws,\n claimsSummary,\n },\n };\n } catch (err) {\n // Sanitize error messages -- never expose key bytes\n const rawMessage = err instanceof Error ? err.message : String(err);\n const safeMessage = sanitizeOutput(rawMessage, keyPatterns);\n\n if (err instanceof IssueError) {\n return {\n text: `Issue failed: ${safeMessage}`,\n structured: {\n ok: false,\n code: 'E_MCP_ISSUE_FAILED',\n message: safeMessage,\n },\n isError: true,\n };\n }\n\n if (err instanceof McpServerError) {\n return {\n text: `Issue failed: ${safeMessage}`,\n structured: {\n ok: false,\n code: err.code,\n message: safeMessage,\n },\n isError: true,\n };\n }\n\n return {\n text: `Issue failed: ${safeMessage}`,\n structured: {\n ok: false,\n code: 'E_MCP_ISSUE_FAILED',\n message: safeMessage,\n },\n isError: true,\n };\n }\n}\n","/**\n * TOCTOU-hardened filesystem utilities for bundle creation\n *\n * All path operations validate against symlink injection and traversal.\n * Zero MCP SDK imports.\n */\n\nimport { lstat, mkdir, rename, rm, mkdtemp } from 'node:fs/promises';\nimport * as nodePath from 'node:path';\nimport { randomUUID } from 'node:crypto';\nimport { PathTraversalError } from './errors.js';\n\n/**\n * Windows reserved device names (case-insensitive, even with extensions).\n * Windows treats CON, CON.txt, NUL, PRN, COM1..COM9, LPT1..LPT9 as special.\n */\nconst WINDOWS_RESERVED_NAMES = new Set([\n 'con',\n 'prn',\n 'aux',\n 'nul',\n 'com1',\n 'com2',\n 'com3',\n 'com4',\n 'com5',\n 'com6',\n 'com7',\n 'com8',\n 'com9',\n 'lpt1',\n 'lpt2',\n 'lpt3',\n 'lpt4',\n 'lpt5',\n 'lpt6',\n 'lpt7',\n 'lpt8',\n 'lpt9',\n]);\n\n/**\n * Assert that a path is a safe single-segment relative name.\n *\n * v1 restriction: no nested directories (single path segment only).\n * Rejects absolute paths, `..`, empty strings, multi-segment paths, names >255 chars,\n * null bytes, colons (drive letters, NTFS ADS), Windows reserved device names,\n * and trailing dots/spaces (Windows normalizes these).\n */\nexport function assertRelativePath(p: string): void {\n if (!p || p.trim().length === 0) {\n throw new PathTraversalError('Path must not be empty');\n }\n\n // Reject null bytes (injection vector)\n if (p.includes('\\0')) {\n throw new PathTraversalError('Null bytes are not allowed in paths');\n }\n\n // Reject colons (blocks drive letters C: and NTFS ADS file.txt:stream)\n if (p.includes(':')) {\n throw new PathTraversalError('Colons are not allowed in paths (drive letters, NTFS ADS)');\n }\n\n if (nodePath.isAbsolute(p)) {\n throw new PathTraversalError('Absolute paths are not allowed');\n }\n\n // Normalize to detect .. traversal\n const normalized = nodePath.normalize(p);\n if (normalized.startsWith('..') || normalized.includes('/..') || normalized.includes('\\\\..')) {\n throw new PathTraversalError('Path traversal (..) is not allowed');\n }\n\n // v1: single segment only -- no slashes\n if (p.includes('/') || p.includes('\\\\')) {\n throw new PathTraversalError('Nested directories are not allowed (single segment only)');\n }\n\n if (p.length > 255) {\n throw new PathTraversalError(`Path segment exceeds 255 characters (got ${p.length})`);\n }\n\n // Reject hidden files/dirs\n if (p.startsWith('.')) {\n throw new PathTraversalError('Hidden paths (starting with .) are not allowed');\n }\n\n // Reject trailing dots and spaces (Windows normalizes these, causing confusion)\n if (p.endsWith('.') || p.endsWith(' ')) {\n throw new PathTraversalError('Trailing dots and spaces are not allowed');\n }\n\n // Reject Windows reserved device names (case-insensitive, even with extensions)\n // Check the base name before the first dot: \"CON.txt\" -> \"con\"\n const dotIndex = p.indexOf('.');\n const baseName = (dotIndex >= 0 ? p.slice(0, dotIndex) : p).toLowerCase();\n if (WINDOWS_RESERVED_NAMES.has(baseName)) {\n throw new PathTraversalError(`Windows reserved device name: ${baseName.toUpperCase()}`);\n }\n}\n\n/**\n * Validate and resolve an output path within a base directory.\n * Does NOT create the directory -- only validates and returns the resolved path.\n */\nexport function resolveOutputPath(basePath: string, relativePath: string): string {\n assertRelativePath(relativePath);\n\n const normalizedBase = nodePath.resolve(basePath);\n const resolved = nodePath.resolve(normalizedBase, relativePath);\n\n // Defense-in-depth: use path.relative to check containment.\n // If the resolved path escapes basePath, relative() produces a string\n // starting with '..' -- this is cross-platform safe unlike string prefix checks.\n const rel = nodePath.relative(normalizedBase, resolved);\n if (rel.startsWith('..') || rel.startsWith('/') || nodePath.isAbsolute(rel)) {\n throw new PathTraversalError('Resolved path escapes base directory');\n }\n\n return resolved;\n}\n\n/**\n * Check that a path component is not a symlink.\n * Throws PathTraversalError if the component is a symlink.\n */\nasync function assertNotSymlink(componentPath: string): Promise<void> {\n try {\n const stats = await lstat(componentPath);\n if (stats.isSymbolicLink()) {\n throw new PathTraversalError(`Symlink detected at ${componentPath}`);\n }\n } catch (err) {\n if (err instanceof PathTraversalError) throw err;\n // ENOENT is fine -- the component doesn't exist yet\n if ((err as NodeJS.ErrnoException).code === 'ENOENT') return;\n throw err;\n }\n}\n\n/**\n * Create a directory under basePath with per-component symlink checks.\n * Returns the resolved path of the created directory.\n */\nexport async function safeMkdir(basePath: string, relativePath: string): Promise<string> {\n const resolved = resolveOutputPath(basePath, relativePath);\n\n // Check base path itself is not a symlink\n await assertNotSymlink(basePath);\n\n // Check that target does not already exist as a symlink\n await assertNotSymlink(resolved);\n\n await mkdir(resolved, { recursive: false, mode: 0o700 });\n return resolved;\n}\n\n/**\n * Atomically move a temp directory to a final path.\n * Uses rename() which is atomic on the same filesystem.\n * Cleans up temp dir on failure.\n */\nexport async function atomicWriteDir(tempDir: string, finalPath: string): Promise<void> {\n try {\n await rename(tempDir, finalPath);\n } catch (err) {\n // Clean up temp dir on failure\n try {\n await rm(tempDir, { recursive: true, force: true });\n } catch {\n // Best-effort cleanup\n }\n throw err;\n }\n}\n\n/**\n * Create a temporary directory under basePath.\n * Uses a `.tmp-<uuid>` prefix to avoid collisions.\n */\nexport async function createTempDir(basePath: string): Promise<string> {\n await assertNotSymlink(basePath);\n const prefix = nodePath.join(basePath, `.tmp-${randomUUID().slice(0, 8)}-`);\n return mkdtemp(prefix);\n}\n","/**\n * Bundle handler -- ZERO MCP SDK imports\n *\n * Creates a signed evidence bundle directory from receipt JWS strings.\n * Requires issuerKey + issuerId + bundleDir on ServerContext.\n */\n\nimport { writeFile, rm, stat, mkdir } from 'node:fs/promises';\nimport { join } from 'node:path';\nimport { randomUUID } from 'node:crypto';\nimport { sign, sha256Hex, base64urlEncode } from '@peac/crypto';\nimport type { HandlerParams, HandlerResult } from './types.js';\nimport type { BundleInput } from '../schemas/bundle.js';\nimport { McpServerError, sanitizeOutput } from '../infra/errors.js';\nimport { checkToolEnabled, truncateResponse } from './guards.js';\nimport { assertRelativePath, createTempDir, atomicWriteDir } from '../infra/path-safety.js';\nimport { SERVER_VERSION } from '../infra/constants.js';\n\n/**\n * Stable JSON stringify with sorted keys at all levels.\n * Produces deterministic output regardless of property insertion order.\n * Uses 2-space indentation for human readability.\n */\nfunction stableJsonStringify(value: unknown): string {\n return (\n JSON.stringify(\n value,\n (_key, val) => {\n if (val !== null && typeof val === 'object' && !Array.isArray(val)) {\n const sorted: Record<string, unknown> = {};\n for (const k of Object.keys(val as Record<string, unknown>).sort()) {\n sorted[k] = (val as Record<string, unknown>)[k];\n }\n return sorted;\n }\n return val;\n },\n 2\n ) + '\\n'\n );\n}\n\n/**\n * Build Trust Gate 1 patterns from the actual loaded key.\n */\nfunction buildKeyPatterns(privateKey: Uint8Array, publicKey: Uint8Array): RegExp[] {\n const privB64 = base64urlEncode(privateKey);\n const pubB64 = base64urlEncode(publicKey);\n const escPriv = privB64.replace(/[.*+?^${}()|[\\]\\\\]/g, '\\\\$&');\n const escPub = pubB64.replace(/[.*+?^${}()|[\\]\\\\]/g, '\\\\$&');\n return [new RegExp(escPriv, 'g'), new RegExp(escPub, 'g')];\n}\n\n/**\n * Generate a default bundle directory name with timestamp + random suffix.\n */\nfunction generateBundleName(): string {\n const ts = new Date().toISOString().replace(/[:.]/g, '-');\n const rand = randomUUID().slice(0, 8);\n return `bundle-${ts}-${rand}`;\n}\n\nexport async function handleCreateBundle(\n params: HandlerParams<BundleInput>\n): Promise<HandlerResult> {\n const { input, policy, context } = params;\n\n // Guard: tool enablement\n const disabledResult = checkToolEnabled('peac_create_bundle', policy);\n if (disabledResult) return disabledResult;\n\n // Guard: bundleDir must be configured\n if (!context.bundleDir) {\n return {\n text: 'Bundle creation failed: server not configured with --bundle-dir',\n structured: {\n ok: false,\n code: 'E_MCP_BUNDLE_DIR_REQUIRED',\n message: 'Server requires --bundle-dir for peac_create_bundle',\n },\n isError: true,\n };\n }\n\n // Guard: issuer key + id must be configured (for manifest signing)\n if (!context.issuerKey || !context.issuerId) {\n return {\n text: 'Bundle creation failed: server not configured with issuer key and ID',\n structured: {\n ok: false,\n code: 'E_MCP_KEY_REQUIRED',\n message: 'Server requires --issuer-key and --issuer-id for peac_create_bundle',\n },\n isError: true,\n };\n }\n\n // Guard: receipt count limit\n if (input.receipts.length > policy.limits.max_bundle_receipts) {\n return {\n text: `Input rejected: ${input.receipts.length} receipts exceeds limit of ${policy.limits.max_bundle_receipts}`,\n structured: {\n ok: false,\n code: 'E_MCP_INPUT_TOO_LARGE',\n message: `${input.receipts.length} receipts exceeds limit of ${policy.limits.max_bundle_receipts}`,\n },\n isError: true,\n };\n }\n\n // Guard: total byte size\n let totalReceiptBytes = 0;\n for (const r of input.receipts) {\n totalReceiptBytes += new TextEncoder().encode(r).length;\n }\n if (totalReceiptBytes > policy.limits.max_bundle_bytes) {\n return {\n text: `Input rejected: total receipt bytes ${totalReceiptBytes} exceeds limit of ${policy.limits.max_bundle_bytes}`,\n structured: {\n ok: false,\n code: 'E_MCP_INPUT_TOO_LARGE',\n message: `Total receipt bytes ${totalReceiptBytes} exceeds limit of ${policy.limits.max_bundle_bytes}`,\n },\n isError: true,\n };\n }\n\n // Validate or generate output_path\n const outputName = input.output_path ?? generateBundleName();\n try {\n assertRelativePath(outputName);\n } catch (err) {\n return {\n text: `Bundle creation failed: ${err instanceof Error ? err.message : String(err)}`,\n structured: {\n ok: false,\n code: 'E_MCP_PATH_TRAVERSAL',\n message: err instanceof Error ? err.message : String(err),\n },\n isError: true,\n };\n }\n\n // Build Trust Gate 1 patterns\n const keyPatterns = buildKeyPatterns(context.issuerKey.privateKey, context.issuerKey.publicKey);\n\n let tempDir: string | undefined;\n try {\n // Create temp working directory (0o700: owner-only access)\n tempDir = await createTempDir(context.bundleDir);\n\n // Write receipts and compute hashes\n const receiptsDir = join(tempDir, 'receipts');\n await mkdir(receiptsDir, { mode: 0o700 });\n\n interface ReceiptEntry {\n index: number;\n file: string;\n sha256: string;\n length: number;\n }\n\n const entries: ReceiptEntry[] = [];\n let totalBytes = 0;\n\n // Dedup by sha256: identical receipts produce one file and one manifest\n // entry. This is explicit behavior, not an accident of hash-named files.\n const seenHashes = new Set<string>();\n const receiptHashes: string[] = [];\n\n for (let i = 0; i < input.receipts.length; i++) {\n // Check cancellation at each iteration to avoid unnecessary disk I/O\n if (params.signal?.aborted) {\n throw new McpServerError('E_MCP_CANCELLED', 'Request cancelled during bundle creation');\n }\n\n const jws = input.receipts[i];\n const data = new TextEncoder().encode(jws);\n const hash = await sha256Hex(data);\n\n if (seenHashes.has(hash)) continue; // skip duplicate receipt\n seenHashes.add(hash);\n receiptHashes.push(hash);\n\n // Name receipt files by content hash for input-order independence.\n // Same receipt set in any order produces identical file structure.\n const fileName = `${hash}.jws`;\n const filePath = join(receiptsDir, fileName);\n await writeFile(filePath, data, { mode: 0o600 });\n entries.push({\n index: i,\n file: `receipts/${fileName}`,\n sha256: hash,\n length: data.length,\n });\n totalBytes += data.length;\n }\n\n // Sort entries by sha256 for canonical ordering.\n // Note: the manifest includes `created_at` (wall-clock time), so manifest\n // content and its signature will differ across runs. Only `bundle_id` is\n // fully deterministic (content-addressable from policy + receipt hashes).\n entries.sort((a, b) => a.sha256.localeCompare(b.sha256));\n\n // Compute content-addressable bundle_id: deterministic identifier\n // independent of wall-clock time. Same policy + same receipts = same bundle_id.\n const sortedHashes = [...receiptHashes].sort();\n const bundleIdInput = `${context.policyHash}:${sortedHashes.join(':')}`;\n const bundleId = await sha256Hex(new TextEncoder().encode(bundleIdInput));\n\n const manifest = {\n bundle_id: bundleId,\n tool_version: SERVER_VERSION,\n created_at: new Date().toISOString(),\n policy_hash: context.policyHash,\n receipt_count: entries.length,\n receipts: entries,\n ...(input.metadata ? { metadata: input.metadata } : {}),\n };\n\n // Write manifest.json with canonical key ordering (0o600: owner rw)\n const manifestJson = stableJsonStringify(manifest);\n await writeFile(join(tempDir, 'manifest.json'), manifestJson, { mode: 0o600 });\n totalBytes += new TextEncoder().encode(manifestJson).length;\n\n // Compute manifest hash for the response (caller uses this for integrity checks)\n const manifestBytes = new TextEncoder().encode(manifestJson);\n const manifestSha256 = await sha256Hex(manifestBytes);\n\n // Sign the canonical manifest object. The signature covers the full\n // manifest including `created_at`, so it is NOT reproducible across runs.\n // Parse the stable-stringified JSON back so the sign() function\n // receives an object whose property order matches the on-disk file.\n const canonicalManifest = JSON.parse(manifestJson) as Record<string, unknown>;\n const manifestJws = await sign(\n canonicalManifest,\n context.issuerKey.privateKey,\n context.issuerKey.kid\n );\n await writeFile(join(tempDir, 'manifest.jws'), manifestJws, { mode: 0o600 });\n totalBytes += new TextEncoder().encode(manifestJws).length;\n\n // File count: unique receipts + manifest.json + manifest.jws\n const fileCount = entries.length + 2;\n\n // Atomic move to final path\n const finalPath = join(context.bundleDir, outputName);\n\n // Check final path doesn't already exist\n try {\n await stat(finalPath);\n // If we get here, it exists -- error\n return {\n text: `Bundle creation failed: output path already exists: ${outputName}`,\n structured: {\n ok: false,\n code: 'E_MCP_BUNDLE_FAILED',\n message: `Output path already exists: ${outputName}`,\n },\n isError: true,\n };\n } catch (err) {\n // ENOENT is expected -- path doesn't exist yet\n if ((err as NodeJS.ErrnoException).code !== 'ENOENT') {\n throw err;\n }\n }\n\n await atomicWriteDir(tempDir, finalPath);\n tempDir = undefined; // Don't clean up -- rename succeeded\n\n const tr = truncateResponse(\n `Bundle created: ${outputName} (${fileCount} files, ${totalBytes} bytes)`,\n policy\n );\n const safeText = sanitizeOutput(tr.text, keyPatterns);\n\n // Return metadata only -- full manifest and manifestJws live on disk.\n // This prevents multi-KB JSON in MCP responses (client/UI stability).\n // Return bundleName (relative to --bundle-dir), not absolute path --\n // the absolute path leaks host filesystem layout to the LLM context.\n return {\n text: safeText,\n structured: {\n ok: true,\n bundleId: bundleId,\n bundleName: outputName,\n receiptCount: entries.length,\n fileCount,\n totalBytes,\n createdAt: manifest.created_at,\n manifestSha256,\n },\n };\n } catch (err) {\n // Clean up temp dir on failure\n if (tempDir) {\n try {\n await rm(tempDir, { recursive: true, force: true });\n } catch {\n // Best-effort cleanup\n }\n }\n\n const rawMessage = err instanceof Error ? err.message : String(err);\n const safeMessage = sanitizeOutput(rawMessage, keyPatterns);\n\n if (err instanceof McpServerError) {\n return {\n text: `Bundle creation failed: ${safeMessage}`,\n structured: {\n ok: false,\n code: err.code,\n message: safeMessage,\n },\n isError: true,\n };\n }\n\n return {\n text: `Bundle creation failed: ${safeMessage}`,\n structured: {\n ok: false,\n code: 'E_MCP_BUNDLE_FAILED',\n message: safeMessage,\n },\n isError: true,\n };\n }\n}\n","/**\n * Verify tool schemas -- ZERO MCP SDK imports\n */\n\nimport { z } from 'zod';\n\nexport const VerifyInputSchema = z.object({\n jws: z.string().describe('JWS compact serialization (header.payload.signature)'),\n public_key_base64url: z\n .string()\n .optional()\n .describe('Ed25519 public key in base64url encoding (32 bytes)'),\n jwks: z.string().optional().describe('Inline JWKS JSON containing the verifying key'),\n issuer: z.string().optional().describe('Expected issuer URI for binding check'),\n audience: z.string().optional().describe('Expected audience URI for binding check'),\n});\n\nexport type VerifyInput = z.infer<typeof VerifyInputSchema>;\n\nconst MetaSchema = z.object({\n serverVersion: z.string(),\n policyHash: z.string(),\n protocolVersion: z.string(),\n});\n\nconst CheckSchema = z.object({\n name: z.string(),\n passed: z.boolean(),\n message: z.string().optional(),\n});\n\nexport const VerifyOutputSchema = z.object({\n _meta: MetaSchema,\n ok: z.boolean(),\n code: z.string().optional(),\n message: z.string().optional(),\n variant: z.string().optional(),\n checks: z.array(CheckSchema),\n claimsSummary: z.record(z.string(), z.unknown()).optional(),\n keySource: z.string().optional(),\n});\n\nexport type VerifyOutput = z.infer<typeof VerifyOutputSchema>;\n","/**\n * Inspect tool schemas -- ZERO MCP SDK imports\n */\n\nimport { z } from 'zod';\n\nexport const InspectInputSchema = z.object({\n jws: z.string().describe('JWS compact serialization to inspect'),\n full_claims: z\n .boolean()\n .optional()\n .default(false)\n .describe('Include full decoded claims (may be redacted by policy)'),\n});\n\nexport type InspectInput = z.infer<typeof InspectInputSchema>;\n\nconst MetaSchema = z.object({\n serverVersion: z.string(),\n policyHash: z.string(),\n protocolVersion: z.string(),\n});\n\nexport const InspectOutputSchema = z.object({\n _meta: MetaSchema,\n header: z.record(z.string(), z.unknown()),\n payloadMeta: z.object({\n variant: z.string(),\n issuer: z.string().optional(),\n audience: z.string().optional(),\n issuedAt: z.string().optional(),\n expiresAt: z.string().optional(),\n receiptId: z.string().optional(),\n }),\n fullPayload: z.record(z.string(), z.unknown()).optional(),\n redacted: z.boolean(),\n verified: z.literal(false),\n});\n\nexport type InspectOutput = z.infer<typeof InspectOutputSchema>;\n","/**\n * Decode tool schemas -- ZERO MCP SDK imports\n */\n\nimport { z } from 'zod';\n\nexport const DecodeInputSchema = z.object({\n jws: z.string().describe('JWS compact serialization to decode'),\n});\n\nexport type DecodeInput = z.infer<typeof DecodeInputSchema>;\n\nconst MetaSchema = z.object({\n serverVersion: z.string(),\n policyHash: z.string(),\n protocolVersion: z.string(),\n});\n\nexport const DecodeOutputSchema = z.object({\n _meta: MetaSchema,\n header: z.record(z.string(), z.unknown()),\n payload: z.record(z.string(), z.unknown()),\n verified: z.literal(false),\n});\n\nexport type DecodeOutput = z.infer<typeof DecodeOutputSchema>;\n","/**\n * Issue tool schemas -- Wire 0.2 only\n *\n * The MCP peac_issue tool accepts Wire 0.2 fields exclusively.\n * No wire_version discriminator: the MCP server is a forward-looking\n * adoption surface; agents should only issue Wire 0.2 receipts.\n */\n\nimport { z } from 'zod';\n\nexport const IssueInputSchema = z.object({\n kind: z\n .enum(['evidence', 'challenge'])\n .describe('Structural kind: evidence (records interaction) or challenge (requests action)'),\n type: z\n .string()\n .min(1)\n .max(256)\n .refine(\n (v) =>\n /^https?:\\/\\//.test(v) ||\n /^[a-zA-Z0-9][a-zA-Z0-9._-]*\\.[a-zA-Z0-9._-]+\\/[a-zA-Z0-9]/.test(v),\n {\n message:\n 'type must be reverse-DNS (e.g. org.peacprotocol/payment) or absolute URI (https://...)',\n }\n )\n .describe('Semantic type in reverse-DNS or absolute URI form (e.g. org.peacprotocol/payment)'),\n sub: z\n .string()\n .max(2048)\n .optional()\n .describe('Subject identifier (resource or interaction target)'),\n pillars: z\n .array(\n z.enum([\n 'access',\n 'attribution',\n 'commerce',\n 'compliance',\n 'consent',\n 'identity',\n 'privacy',\n 'provenance',\n 'purpose',\n 'safety',\n ])\n )\n .optional()\n .refine(\n (arr) =>\n !arr || (new Set(arr).size === arr.length && [...arr].sort().every((v, i) => v === arr[i])),\n { message: 'pillars must be unique and sorted ascending' }\n )\n .describe('Evidence pillars from closed 10-value taxonomy (sorted ascending)'),\n occurred_at: z\n .string()\n .optional()\n .refine((v) => !v || !isNaN(Date.parse(v)), {\n message: 'occurred_at must be a valid ISO 8601 timestamp',\n })\n .describe('ISO 8601 timestamp when interaction occurred (evidence kind only)'),\n extensions: z\n .record(z.string(), z.unknown())\n .optional()\n .describe('Extension groups keyed by reverse-DNS identifier'),\n policy: z\n .object({\n uri: z\n .string()\n .url()\n .max(2048)\n .refine((v) => v.startsWith('https://'), { message: 'policy.uri must use HTTPS' })\n .describe('Policy document URI (HTTPS only)'),\n version: z.string().max(256).optional().describe('Policy version'),\n digest: z\n .string()\n .regex(/^sha256:[0-9a-f]{64}$/)\n .optional()\n .describe('Policy digest in sha256:<64 hex> format'),\n })\n .optional()\n .describe('Policy binding block'),\n ttl_seconds: z\n .number()\n .int()\n .positive()\n .optional()\n .describe('Reserved for future use (Wire 0.2 receipts do not expire)'),\n});\n\nexport type IssueInput = z.infer<typeof IssueInputSchema>;\n\nconst MetaSchema = z.object({\n serverVersion: z.string(),\n policyHash: z.string(),\n protocolVersion: z.string(),\n});\n\nconst ClaimsSummarySchema = z.object({\n iss: z.string(),\n kind: z.string(),\n type: z.string(),\n iat: z.number(),\n jti: z.string(),\n sub: z.string().optional(),\n pillars: z.array(z.string()).optional(),\n});\n\nexport const IssueOutputSchema = z.object({\n _meta: MetaSchema,\n ok: z.boolean(),\n jws: z.string(),\n claimsSummary: ClaimsSummarySchema,\n});\n\nexport type IssueOutput = z.infer<typeof IssueOutputSchema>;\n","/**\n * Bundle tool schemas -- ZERO MCP SDK imports\n */\n\nimport { z } from 'zod';\n\nexport const BundleInputSchema = z.object({\n receipts: z\n .array(z.string().max(16_384))\n .min(1)\n .max(256)\n .describe('Receipt JWS strings to bundle (1-256)'),\n metadata: z\n .record(z.string(), z.unknown())\n .optional()\n .describe('Optional metadata to include in the manifest'),\n output_path: z\n .string()\n .max(255)\n .optional()\n .describe('Output directory name (single segment within --bundle-dir)'),\n});\n\nexport type BundleInput = z.infer<typeof BundleInputSchema>;\n\nconst MetaSchema = z.object({\n serverVersion: z.string(),\n policyHash: z.string(),\n protocolVersion: z.string(),\n});\n\nexport const BundleOutputSchema = z.object({\n _meta: MetaSchema,\n ok: z.boolean(),\n bundleId: z.string(),\n bundleName: z.string(),\n receiptCount: z.number(),\n fileCount: z.number(),\n totalBytes: z.number(),\n createdAt: z.string(),\n manifestSha256: z.string(),\n});\n\nexport type BundleOutput = z.infer<typeof BundleOutputSchema>;\n"]}
1
+ {"version":3,"sources":["../src/infra/constants.ts","../src/session-manager.ts","../src/http-transport.ts","../src/cli.ts","../src/infra/errors.ts","../src/infra/policy.ts","../src/infra/key-loader.ts","../src/infra/jwks-loader.ts","../src/stdout-fence.ts","../src/server.ts","../src/handlers/guards.ts","../src/handlers/verify.ts","../src/handlers/inspect.ts","../src/handlers/decode.ts","../src/handlers/issue.ts","../src/infra/path-safety.ts","../src/handlers/bundle.ts","../src/schemas/verify.ts","../src/schemas/inspect.ts","../src/schemas/decode.ts","../src/schemas/issue.ts","../src/schemas/bundle.ts"],"names":["randomUUID","StreamableHTTPServerTransport","createServer","entry","resolve","z","sha256Hex","readFile","stat","validateKeypair","base64urlDecode","derivePublicKey","base64urlEncode","total","decode","verifyLocal","checks","parseReceiptClaims","issueWire02","IssueError","nodePath","lstat","rename","rm","mkdtemp","buildKeyPatterns","join","mkdir","writeFile","sign","MetaSchema","ERRORS","McpServer","Command","fsStat","realpath","createHttpTransport"],"mappings":";;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;AAAA,IAIa,WAAA,CAAA,CACA,gBACA,oBAAA;AANb,IAAA,cAAA,GAAA,KAAA,CAAA;AAAA,EAAA,wBAAA,GAAA;AAIO,IAAM,WAAA,GAAc,iBAAA;AACpB,IAAM,cAAA,GAAiB,QAAA;AACvB,IAAM,oBAAA,GAAuB,YAAA;AAcY,EAAA;AAAA,CAAA,CAAA;ACpBhD,IAqCa,cAAA;AArCb,IAAA,oBAAA,GAAA,KAAA,CAAA;AAAA,EAAA,wBAAA,GAAA;AAqCO,IAAM,iBAAN,MAAqB;AAAA,MAQ1B,WAAA,CAA6B,OAAA,GAAiC,EAAC,EAAG;AAArC,QAAA,IAAA,CAAA,OAAA,GAAA,OAAA;AAC3B,QAAA,IAAA,CAAK,KAAA,GAAQ,OAAA,CAAQ,KAAA,IAAS,EAAA,GAAK,EAAA,GAAK,GAAA;AACxC,QAAA,IAAA,CAAK,WAAA,GAAc,QAAQ,WAAA,IAAe,GAAA;AAC1C,QAAA,IAAA,CAAK,gBAAA,GAAmB,QAAQ,gBAAA,IAAoB,EAAA;AAAA,MACtD;AAAA,MAXiB,QAAA,uBAAe,GAAA,EAA0B;AAAA,MACzC,cAAA,uBAAqB,GAAA,EAAoB;AAAA,MACzC,KAAA;AAAA,MACA,WAAA;AAAA,MACA,gBAAA;AAAA,MACT,UAAA;AAAA;AAAA,MASR,UAAA,GAAmB;AACjB,QAAA,MAAM,UAAA,GAAa,IAAA,CAAK,OAAA,CAAQ,eAAA,IAAmB,GAAA;AACnD,QAAA,IAAA,CAAK,aAAa,WAAA,CAAY,MAAM,IAAA,CAAK,UAAA,IAAc,UAAU,CAAA;AACjE,QAAA,IAAA,CAAK,WAAW,KAAA,EAAM;AAAA,MACxB;AAAA;AAAA,MAGA,MAAM,aAAA,CAAc,aAAA,EAA8B,QAAA,GAAW,SAAA,EAAkC;AAE7F,QAAA,IAAA,CAAK,UAAA,EAAW;AAGhB,QAAA,IAAI,IAAA,CAAK,QAAA,CAAS,IAAA,IAAQ,IAAA,CAAK,WAAA,EAAa;AAC1C,UAAA,MAAM,IAAI,KAAA,CAAM,CAAA,uBAAA,EAA0B,IAAA,CAAK,WAAW,CAAA,mBAAA,CAAqB,CAAA;AAAA,QACjF;AAGA,QAAA,MAAM,OAAA,GAAU,IAAA,CAAK,cAAA,CAAe,GAAA,CAAI,QAAQ,CAAA,IAAK,CAAA;AACrD,QAAA,IAAI,OAAA,IAAW,KAAK,gBAAA,EAAkB;AACpC,UAAA,MAAM,IAAI,KAAA;AAAA,YACR,CAAA,8BAAA,EAAiC,IAAA,CAAK,gBAAgB,CAAA,KAAA,EAAQ,QAAQ,CAAA,mBAAA;AAAA,WACxE;AAAA,QACF;AAEA,QAAA,MAAM,YAAYA,mBAAAA,EAAW;AAC7B,QAAA,MAAM,SAAS,aAAA,EAAc;AAC7B,QAAA,MAAM,SAAA,GAAY,IAAIC,+CAAA,CAA8B;AAAA,UAClD,oBAAoB,MAAM;AAAA,SAC3B,CAAA;AAED,QAAA,MAAM,MAAA,CAAO,QAAQ,SAAS,CAAA;AAE9B,QAAA,MAAM,GAAA,GAAM,KAAK,GAAA,EAAI;AACrB,QAAA,MAAM,KAAA,GAAsB;AAAA,UAC1B,SAAA;AAAA,UACA,MAAA;AAAA,UACA,SAAA;AAAA,UACA,QAAA;AAAA,UACA,SAAA,EAAW,GAAA;AAAA,UACX,QAAA,EAAU;AAAA,SACZ;AAEA,QAAA,IAAA,CAAK,QAAA,CAAS,GAAA,CAAI,SAAA,EAAW,KAAK,CAAA;AAClC,QAAA,IAAA,CAAK,cAAA,CAAe,GAAA,CAAI,QAAA,EAAU,OAAA,GAAU,CAAC,CAAA;AAC7C,QAAA,OAAO,KAAA;AAAA,MACT;AAAA;AAAA,MAGA,WAAW,SAAA,EAA6C;AACtD,QAAA,MAAM,KAAA,GAAQ,IAAA,CAAK,QAAA,CAAS,GAAA,CAAI,SAAS,CAAA;AACzC,QAAA,IAAI,KAAA,EAAO;AACT,UAAA,KAAA,CAAM,QAAA,GAAW,KAAK,GAAA,EAAI;AAAA,QAC5B;AACA,QAAA,OAAO,KAAA;AAAA,MACT;AAAA;AAAA,MAGA,MAAM,iBAAiB,SAAA,EAAqC;AAC1D,QAAA,MAAM,KAAA,GAAQ,IAAA,CAAK,QAAA,CAAS,GAAA,CAAI,SAAS,CAAA;AACzC,QAAA,IAAI,CAAC,OAAO,OAAO,KAAA;AAEnB,QAAA,IAAA,CAAK,QAAA,CAAS,OAAO,SAAS,CAAA;AAC9B,QAAA,IAAA,CAAK,gBAAA,CAAiB,MAAM,QAAQ,CAAA;AACpC,QAAA,IAAI;AACF,UAAA,MAAM,KAAA,CAAM,UAAU,KAAA,EAAM;AAC5B,UAAA,MAAM,KAAA,CAAM,OAAO,KAAA,EAAM;AAAA,QAC3B,CAAA,CAAA,MAAQ;AAAA,QAER;AACA,QAAA,OAAO,IAAA;AAAA,MACT;AAAA;AAAA,MAGA,MAAM,OAAA,GAAyB;AAC7B,QAAA,IAAI,KAAK,UAAA,EAAY;AACnB,UAAA,aAAA,CAAc,KAAK,UAAU,CAAA;AAC7B,UAAA,IAAA,CAAK,UAAA,GAAa,MAAA;AAAA,QACpB;AAEA,QAAA,MAAM,UAAU,CAAC,GAAG,IAAA,CAAK,QAAA,CAAS,QAAQ,CAAA;AAC1C,QAAA,IAAA,CAAK,SAAS,KAAA,EAAM;AACpB,QAAA,IAAA,CAAK,eAAe,KAAA,EAAM;AAE1B,QAAA,MAAM,OAAA,CAAQ,UAAA;AAAA,UACZ,OAAA,CAAQ,GAAA,CAAI,OAAO,KAAA,KAAU;AAC3B,YAAA,IAAI;AACF,cAAA,MAAM,KAAA,CAAM,UAAU,KAAA,EAAM;AAC5B,cAAA,MAAM,KAAA,CAAM,OAAO,KAAA,EAAM;AAAA,YAC3B,CAAA,CAAA,MAAQ;AAAA,YAER;AAAA,UACF,CAAC;AAAA,SACH;AAAA,MACF;AAAA;AAAA,MAGA,IAAI,IAAA,GAAe;AACjB,QAAA,OAAO,KAAK,QAAA,CAAS,IAAA;AAAA,MACvB;AAAA;AAAA,MAGQ,UAAA,GAAmB;AACzB,QAAA,MAAM,GAAA,GAAM,KAAK,GAAA,EAAI;AACrB,QAAA,KAAA,MAAW,CAAC,EAAA,EAAI,KAAK,CAAA,IAAK,KAAK,QAAA,EAAU;AACvC,UAAA,IAAI,GAAA,GAAM,KAAA,CAAM,QAAA,GAAW,IAAA,CAAK,KAAA,EAAO;AACrC,YAAA,IAAA,CAAK,QAAA,CAAS,OAAO,EAAE,CAAA;AACvB,YAAA,IAAA,CAAK,gBAAA,CAAiB,MAAM,QAAQ,CAAA;AAEpC,YAAA,KAAK,KAAA,CAAM,SAAA,CAAU,KAAA,EAAM,CAAE,MAAM,MAAM;AAAA,YAAC,CAAC,CAAA;AAC3C,YAAA,KAAK,KAAA,CAAM,MAAA,CAAO,KAAA,EAAM,CAAE,MAAM,MAAM;AAAA,YAAC,CAAC,CAAA;AAAA,UAC1C;AAAA,QACF;AAAA,MACF;AAAA;AAAA,MAGQ,iBAAiB,EAAA,EAAkB;AACzC,QAAA,MAAM,KAAA,GAAQ,IAAA,CAAK,cAAA,CAAe,GAAA,CAAI,EAAE,CAAA,IAAK,CAAA;AAC7C,QAAA,IAAI,SAAS,CAAA,EAAG;AACd,UAAA,IAAA,CAAK,cAAA,CAAe,OAAO,EAAE,CAAA;AAAA,QAC/B,CAAA,MAAO;AACL,UAAA,IAAA,CAAK,cAAA,CAAe,GAAA,CAAI,EAAA,EAAI,KAAA,GAAQ,CAAC,CAAA;AAAA,QACvC;AAAA,MACF;AAAA,KACF;AAAA,EAAA;AAAA,CAAA,CAAA;;;AC/KA,IAAA,sBAAA,GAAA,EAAA;AAAA,QAAA,CAAA,sBAAA,EAAA;AAAA,EAAA,mBAAA,EAAA,MAAA;AAAA,CAAA,CAAA;AA8EA,SAAS,iBAAiB,EAAA,EAAqB;AAC7C,EAAA,IAAI,GAAG,MAAA,KAAW,CAAA,IAAK,EAAA,CAAG,MAAA,GAAS,uBAAuB,OAAO,KAAA;AACjE,EAAA,KAAA,IAAS,CAAA,GAAI,CAAA,EAAG,CAAA,GAAI,EAAA,CAAG,QAAQ,CAAA,EAAA,EAAK;AAClC,IAAA,MAAM,IAAA,GAAO,EAAA,CAAG,UAAA,CAAW,CAAC,CAAA;AAC5B,IAAA,IAAI,IAAA,GAAO,EAAA,IAAQ,IAAA,GAAO,GAAA,EAAM,OAAO,KAAA;AAAA,EACzC;AACA,EAAA,OAAO,IAAA;AACT;AAMA,SAAS,eAAe,IAAA,EAAuB;AAC7C,EAAA,OAAO,KAAK,UAAA,CAAW,MAAM,CAAA,IAAK,IAAA,KAAS,SAAS,IAAA,KAAS,kBAAA;AAC/D;AACA,SAAS,gBAAgB,IAAA,EAAuB;AAC9C,EAAA,IAAI,cAAA,CAAe,IAAI,CAAA,EAAG,OAAO,IAAA;AACjC,EAAA,OAAO,KAAK,UAAA,CAAW,UAAU,CAAA,IAAK,IAAA,CAAK,WAAW,MAAM,CAAA;AAC9D;AACA,SAAS,cAAc,IAAA,EAAuB;AAC5C,EAAA,IAAI,eAAA,CAAgB,IAAI,CAAA,EAAG,OAAO,IAAA;AAClC,EAAA,OACE,IAAA,CAAK,UAAA,CAAW,KAAK,CAAA,IACrB,IAAA,CAAK,UAAA,CAAW,UAAU,CAAA,IAC1B,4BAAA,CAA6B,IAAA,CAAK,IAAI,CAAA,IACtC,KAAK,UAAA,CAAW,IAAI,CAAA,IACpB,IAAA,CAAK,UAAA,CAAW,IAAI,CAAA,IACpB,IAAA,CAAK,UAAA,CAAW,YAAY,CAAA,IAC5B,IAAA,CAAK,UAAA,CAAW,iBAAiB,CAAA,IACjC,mCAAA,CAAoC,KAAK,IAAI,CAAA;AAEjD;AAKA,SAAS,cAAA,CAAe,YAAoB,UAAA,EAAsC;AAChF,EAAA,IAAI,UAAA,KAAe,OAAO,OAAO,KAAA;AACjC,EAAA,IAAI,UAAA,KAAe,OAAO,OAAO,IAAA;AACjC,EAAA,IAAI,UAAA,KAAe,UAAA,EAAY,OAAO,cAAA,CAAe,UAAU,CAAA;AAC/D,EAAA,IAAI,UAAA,KAAe,WAAA,EAAa,OAAO,eAAA,CAAgB,UAAU,CAAA;AACjE,EAAA,IAAI,UAAA,KAAe,SAAA,EAAW,OAAO,aAAA,CAAc,UAAU,CAAA;AAE7D,EAAA,MAAM,OAAA,GAAU,UAAA,CAAW,KAAA,CAAM,GAAG,CAAA,CAAE,IAAI,CAAC,CAAA,KAAM,CAAA,CAAE,IAAA,EAAM,CAAA;AACzD,EAAA,OAAO,OAAA,CAAQ,SAAS,UAAU,CAAA;AACpC;AAQA,SAAS,kBAAkB,MAAA,EAAsE;AAC/F,EAAA,IAAI,CAAA;AACJ,EAAA,IAAI;AACF,IAAA,CAAA,GAAI,IAAI,IAAI,MAAM,CAAA;AAAA,EACpB,CAAA,CAAA,MAAQ;AACN,IAAA,OAAO,EAAE,KAAA,EAAO,CAAA,aAAA,EAAgB,MAAM,CAAA,CAAA,EAAG;AAAA,EAC3C;AACA,EAAA,IAAI,EAAE,IAAA,EAAM;AACV,IAAA,OAAO,EAAE,OAAO,2CAAA,EAA4C;AAAA,EAC9D;AACA,EAAA,MAAM,UAAA,GACJ,EAAE,QAAA,KAAa,WAAA,IAAe,EAAE,QAAA,KAAa,WAAA,IAAe,EAAE,QAAA,KAAa,KAAA;AAC7E,EAAA,IAAI,CAAA,CAAE,QAAA,KAAa,QAAA,IAAY,CAAC,UAAA,EAAY;AAC1C,IAAA,OAAO,EAAE,OAAO,qEAAA,EAAsE;AAAA,EACxF;AAEA,EAAA,MAAM,aAAa,CAAA,CAAE,IAAA,CAAK,QAAQ,MAAA,EAAQ,EAAE,KAAK,CAAA,CAAE,MAAA;AACnD,EAAA,OAAO,EAAE,GAAA,EAAK,CAAA,EAAG,UAAA,EAAW;AAC9B;AAMA,eAAsB,oBACpB,OAAA,EAC2C;AAC3C,EAAA,MAAM,IAAA,GAAO,QAAQ,IAAA,IAAQ,GAAA;AAC7B,EAAA,MAAM,IAAA,GAAO,QAAQ,IAAA,IAAQ,WAAA;AAC7B,EAAA,MAAM,cAAc,IAAI,GAAA,CAAI,OAAA,CAAQ,WAAA,IAAe,EAAE,CAAA;AACrD,EAAA,MAAM,eAAA,GAAkB,QAAQ,eAAA,IAAmB,yBAAA;AACnD,EAAA,MAAM,YAAA,GAAe,QAAQ,YAAA,IAAgB,sBAAA;AAE7C,EAAA,MAAM,cAAA,GAAiB,IAAI,cAAA,CAAe;AAAA,IACxC,OAAO,OAAA,CAAQ,YAAA;AAAA,IACf,aAAa,OAAA,CAAQ,WAAA;AAAA,IACrB,kBAAkB,OAAA,CAAQ;AAAA,GAC3B,CAAA;AACD,EAAA,cAAA,CAAe,UAAA,EAAW;AAI1B,EAAA,MAAM,UAAA,uBAAiB,GAAA,EAA4B;AAEnD,EAAA,SAAS,eAAe,GAAA,EAAsB;AAC5C,IAAA,MAAM,GAAA,GAAM,KAAK,GAAA,EAAI;AACrB,IAAA,IAAI,KAAA,GAAQ,UAAA,CAAW,GAAA,CAAI,GAAG,CAAA;AAC9B,IAAA,IAAI,CAAC,KAAA,IAAS,GAAA,GAAM,KAAA,CAAM,cAAc,aAAA,EAAe;AACrD,MAAA,KAAA,GAAQ,EAAE,KAAA,EAAO,CAAA,EAAG,WAAA,EAAa,GAAA,EAAI;AACrC,MAAA,UAAA,CAAW,GAAA,CAAI,KAAK,KAAK,CAAA;AAAA,IAC3B;AACA,IAAA,KAAA,CAAM,KAAA,EAAA;AACN,IAAA,OAAO,MAAM,KAAA,IAAS,YAAA;AAAA,EACxB;AAEA,EAAA,MAAM,eAAA,GAAmC,QAAQ,UAAA,IAAc,KAAA;AAgB/D,EAAA,SAAS,YAAY,GAAA,EAA8B;AACjD,IAAA,MAAM,MAAA,GAAS,GAAA,CAAI,MAAA,CAAO,aAAA,IAAiB,SAAA;AAC3C,IAAA,IAAI,eAAA,KAAoB,KAAA,IAAS,cAAA,CAAe,MAAA,EAAQ,eAAe,CAAA,EAAG;AACxE,MAAA,MAAM,GAAA,GAAM,GAAA,CAAI,OAAA,CAAQ,iBAAiB,CAAA;AACzC,MAAA,IAAI,OAAO,QAAQ,QAAA,EAAU;AAC3B,QAAA,MAAM,QAAQ,GAAA,CAAI,KAAA,CAAM,GAAG,CAAA,CAAE,CAAC,GAAG,IAAA,EAAK;AACtC,QAAA,IAAI,OAAO,OAAO,KAAA;AAAA,MACpB;AAAA,IACF;AACA,IAAA,OAAO,MAAA;AAAA,EACT;AAGA,EAAA,MAAM,YAAA,uBAAmB,GAAA,EAAY;AACrC,EAAA,YAAA,CAAa,GAAA,CAAI,CAAA,EAAG,IAAI,CAAA,CAAA,EAAI,IAAI,CAAA,CAAE,CAAA;AAClC,EAAA,YAAA,CAAa,GAAA,CAAI,IAAA,KAAS,SAAA,GAAY,CAAA,UAAA,EAAa,IAAI,KAAK,CAAA,EAAG,IAAI,CAAA,CAAA,EAAI,IAAI,CAAA,CAAE,CAAA;AAC7E,EAAA,IAAI,IAAA,KAAS,WAAA,IAAe,IAAA,KAAS,SAAA,EAAW;AAC9C,IAAA,YAAA,CAAa,GAAA,CAAI,CAAA,UAAA,EAAa,IAAI,CAAA,CAAE,CAAA;AACpC,IAAA,YAAA,CAAa,GAAA,CAAI,CAAA,UAAA,EAAa,IAAI,CAAA,CAAE,CAAA;AAAA,EACtC;AACA,EAAA,IAAI,QAAQ,SAAA,EAAW;AACrB,IAAA,IAAI;AACF,MAAA,MAAM,CAAA,GAAI,IAAI,GAAA,CAAI,OAAA,CAAQ,SAAS,CAAA;AACnC,MAAA,YAAA,CAAa,GAAA,CAAI,EAAE,IAAI,CAAA;AAAA,IACzB,CAAA,CAAA,MAAQ;AAAA,IAER;AAAA,EACF;AAGA,EAAA,MAAM,cAAA,GAAiB,IAAI,GAAA,CAAY,WAAW,CAAA;AAElD,EAAA,SAAS,cAAA,CAAe,KAAsB,GAAA,EAA8B;AAC1E,IAAA,MAAM,MAAA,GAAS,IAAI,OAAA,CAAQ,MAAA;AAC3B,IAAA,IAAI,CAAC,QAAQ,OAAO,IAAA;AACpB,IAAA,IAAI,cAAA,CAAe,SAAS,CAAA,EAAG;AAE7B,MAAA,GAAA,CAAI,SAAA,CAAU,GAAA,EAAK,EAAE,cAAA,EAAgB,oBAAoB,CAAA;AACzD,MAAA,GAAA,CAAI,IAAI,IAAA,CAAK,SAAA,CAAU,EAAE,KAAA,EAAO,oBAAA,EAAsB,CAAC,CAAA;AACvD,MAAA,OAAO,KAAA;AAAA,IACT;AACA,IAAA,IAAI,CAAC,cAAA,CAAe,GAAA,CAAI,MAAM,CAAA,EAAG;AAC/B,MAAA,GAAA,CAAI,SAAA,CAAU,GAAA,EAAK,EAAE,cAAA,EAAgB,oBAAoB,CAAA;AACzD,MAAA,GAAA,CAAI,IAAI,IAAA,CAAK,SAAA,CAAU,EAAE,KAAA,EAAO,oBAAA,EAAsB,CAAC,CAAA;AACvD,MAAA,OAAO,KAAA;AAAA,IACT;AACA,IAAA,OAAO,IAAA;AAAA,EACT;AAEA,EAAA,SAAS,cAAA,CAAe,KAAsB,GAAA,EAA2B;AACvE,IAAA,MAAM,MAAA,GAAS,IAAI,OAAA,CAAQ,MAAA;AAC3B,IAAA,IAAI,MAAA,IAAU,cAAA,CAAe,GAAA,CAAI,MAAM,CAAA,EAAG;AACxC,MAAA,GAAA,CAAI,SAAA,CAAU,+BAA+B,MAAM,CAAA;AACnD,MAAA,GAAA,CAAI,SAAA,CAAU,gCAAgC,4BAA4B,CAAA;AAC1E,MAAA,GAAA,CAAI,SAAA;AAAA,QACF,8BAAA;AAAA,QACA;AAAA,OACF;AACA,MAAA,GAAA,CAAI,SAAA,CAAU,iCAAiC,gBAAgB,CAAA;AAAA,IACjE;AAAA,EACF;AAEA,EAAA,SAAS,QAAA,CAAS,GAAA,EAAqB,MAAA,EAAgB,IAAA,EAAqB;AAC1E,IAAA,MAAM,IAAA,GAAO,IAAA,CAAK,SAAA,CAAU,IAAI,CAAA;AAChC,IAAA,GAAA,CAAI,SAAA,CAAU,MAAA,EAAQ,EAAE,cAAA,EAAgB,oBAAoB,CAAA;AAC5D,IAAA,GAAA,CAAI,IAAI,IAAI,CAAA;AAAA,EACd;AAEA,EAAA,eAAe,SAAS,GAAA,EAAuC;AAC7D,IAAA,MAAM,SAAmB,EAAC;AAC1B,IAAA,IAAI,UAAA,GAAa,CAAA;AACjB,IAAA,WAAA,MAAiB,SAAS,GAAA,EAAK;AAC7B,MAAA,UAAA,IAAe,KAAA,CAAiB,MAAA;AAChC,MAAA,IAAI,aAAa,eAAA,EAAiB;AAChC,QAAA,MAAM,IAAI,KAAA,CAAM,CAAA,qBAAA,EAAwB,eAAe,CAAA,MAAA,CAAQ,CAAA;AAAA,MACjE;AACA,MAAA,MAAA,CAAO,KAAK,KAAe,CAAA;AAAA,IAC7B;AACA,IAAA,OAAO,MAAA,CAAO,OAAO,MAAM,CAAA;AAAA,EAC7B;AAIA,EAAA,MAAM,WAAA,GAAA,CAAe,OAAA,CAAQ,oBAAA,IAAwB,EAAC,EAAG,MAAA,CAAO,CAAC,CAAA,KAAM,CAAA,CAAE,IAAA,EAAK,CAAE,MAAA,GAAS,CAAC,CAAA;AAC1F,EAAA,IAAI,OAAA,CAAQ,oBAAA,EAAsB,MAAA,IAAU,WAAA,CAAY,WAAW,CAAA,EAAG;AACpE,IAAA,OAAA,CAAQ,MAAA,CAAO,KAAA;AAAA,MACb,IAAI,WAAW,CAAA;AAAA;AAAA,KACjB;AAAA,EACF;AACA,EAAA,IAAI,WAAA,CAAY,MAAA,GAAS,CAAA,IAAK,CAAC,QAAQ,SAAA,EAAW;AAChD,IAAA,OAAA,CAAQ,MAAA,CAAO,KAAA;AAAA,MACb,IAAI,WAAW,CAAA;AAAA;AAAA,KACjB;AAAA,EACF;AACA,EAAA,IAAI,OAAA,CAAQ,SAAA,IAAa,WAAA,CAAY,MAAA,KAAW,CAAA,EAAG;AACjD,IAAA,OAAA,CAAQ,MAAA,CAAO,KAAA;AAAA,MACb,IAAI,WAAW,CAAA;AAAA;AAAA,KACjB;AAAA,EACF;AACA,EAAA,MAAM,aAAa,CAAC,EAAE,WAAA,CAAY,MAAA,GAAS,KAAK,OAAA,CAAQ,SAAA,CAAA;AACxD,EAAA,IAAI,OAAA,GAAU,uCAAA;AACd,EAAA,IAAI,WAAA;AACJ,EAAA,IAAI,UAAA,IAAc,QAAQ,SAAA,EAAW;AACnC,IAAA,MAAM,UAAA,GAAa,iBAAA,CAAkB,OAAA,CAAQ,SAAS,CAAA;AACtD,IAAA,IAAI,WAAW,UAAA,EAAY;AACzB,MAAA,OAAA,CAAQ,MAAA,CAAO,KAAA;AAAA,QACb,CAAA,CAAA,EAAI,WAAW,CAAA,+CAAA,EAAkD,UAAA,CAAW,KAAK;AAAA;AAAA,OACnF;AAAA,IACF,CAAA,MAAO;AACL,MAAA,MAAM,EAAE,GAAA,EAAK,CAAA,EAAG,UAAA,EAAW,GAAI,UAAA;AAE/B,MAAA,MAAM,YAAA,GAAe,CAAA,CAAE,QAAA,CAAS,OAAA,CAAQ,QAAQ,EAAE,CAAA;AAClD,MAAA,IAAI,YAAA,IAAgB,iBAAiB,GAAA,EAAK;AACxC,QAAA,OAAA,GAAU,wCAAwC,YAAY,CAAA,CAAA;AAAA,MAChE;AACA,MAAA,WAAA,GAAc;AAAA,QACZ,QAAA,EAAU,UAAA;AAAA,QACV,qBAAA,EAAuB;AAAA,OACzB;AAAA,IACF;AAAA,EACF;AAEA,EAAA,MAAM,MAAA,GAASC,iBAAA,CAAa,OAAO,GAAA,EAAsB,GAAA,KAAwB;AAC/E,IAAA,MAAM,GAAA,GAAM,IAAI,GAAA,CAAI,GAAA,CAAI,GAAA,IAAO,GAAA,EAAK,CAAA,OAAA,EAAU,GAAA,CAAI,OAAA,CAAQ,IAAA,IAAQ,WAAW,CAAA,CAAE,CAAA;AAC/E,IAAA,MAAM,WAAW,GAAA,CAAI,QAAA;AAIrB,IAAA,GAAA,CAAI,WAAW,GAAM,CAAA;AAGrB,IAAA,IAAI,GAAA,CAAI,WAAW,SAAA,EAAW;AAC5B,MAAA,cAAA,CAAe,KAAK,GAAG,CAAA;AACvB,MAAA,GAAA,CAAI,UAAU,GAAG,CAAA;AACjB,MAAA,GAAA,CAAI,GAAA,EAAI;AACR,MAAA;AAAA,IACF;AAEA,IAAA,cAAA,CAAe,KAAK,GAAG,CAAA;AAGvB,IAAA,MAAM,UAAA,GAAa,IAAI,OAAA,CAAQ,IAAA;AAC/B,IAAA,IAAI,UAAA,IAAc,CAAC,YAAA,CAAa,GAAA,CAAI,UAAU,CAAA,EAAG;AAC/C,MAAA,QAAA,CAAS,GAAA,EAAK,GAAA,EAAK,EAAE,KAAA,EAAO,uBAAuB,CAAA;AACnD,MAAA;AAAA,IACF;AAGA,IAAA,IAAI,CAAC,cAAA,CAAe,GAAA,EAAK,GAAG,CAAA,EAAG;AAG/B,IAAA,IAAI,QAAA,KAAa,SAAA,IAAa,GAAA,CAAI,MAAA,KAAW,KAAA,EAAO;AAClD,MAAA,QAAA,CAAS,KAAK,GAAA,EAAK;AAAA,QACjB,EAAA,EAAI,IAAA;AAAA,QACJ,OAAA,EAAS,cAAA;AAAA,QACT,eAAA,EAAiB;AAAA,OAClB,CAAA;AACD,MAAA;AAAA,IACF;AAGA,IAAA,IAAI,QAAA,KAAa,OAAA,IAAW,GAAA,CAAI,MAAA,KAAW,KAAA,EAAO;AAChD,MAAA,IAAI,cAAc,WAAA,EAAa;AAC7B,QAAA,QAAA,CAAS,GAAA,EAAK,KAAK,WAAW,CAAA;AAAA,MAChC,CAAA,MAAO;AACL,QAAA,QAAA,CAAS,GAAA,EAAK,GAAA,EAAK,EAAE,KAAA,EAAO,aAAa,CAAA;AAAA,MAC3C;AACA,MAAA;AAAA,IACF;AAGA,IAAA,IAAI,aAAa,MAAA,EAAQ;AAEvB,MAAA,IAAI,GAAA,CAAI,WAAW,KAAA,EAAO;AACxB,QAAA,GAAA,CAAI,UAAU,GAAA,EAAK,EAAE,OAAO,cAAA,EAAgB,cAAA,EAAgB,oBAAoB,CAAA;AAChF,QAAA,GAAA,CAAI,IAAI,IAAA,CAAK,SAAA,CAAU,EAAE,KAAA,EAAO,qDAAA,EAAuD,CAAC,CAAA;AACxF,QAAA;AAAA,MACF;AAGA,MAAA,IAAI,GAAA,CAAI,WAAW,QAAA,EAAU;AAC3B,QAAA,MAAM,SAAA,GAAY,GAAA,CAAI,OAAA,CAAQ,gBAAgB,CAAA;AAC9C,QAAA,IAAI,CAAC,SAAA,EAAW;AACd,UAAA,QAAA,CAAS,GAAA,EAAK,GAAA,EAAK,EAAE,KAAA,EAAO,iCAAiC,CAAA;AAC7D,UAAA;AAAA,QACF;AACA,QAAA,IAAI,CAAC,gBAAA,CAAiB,SAAS,CAAA,EAAG;AAChC,UAAA,QAAA,CAAS,KAAK,GAAA,EAAK;AAAA,YACjB,KAAA,EAAO;AAAA,WACR,CAAA;AACD,UAAA;AAAA,QACF;AACA,QAAA,MAAM,UAAA,GAAa,MAAM,cAAA,CAAe,gBAAA,CAAiB,SAAS,CAAA;AAClE,QAAA,IAAI,UAAA,EAAY;AACd,UAAA,QAAA,CAAS,GAAA,EAAK,GAAA,EAAK,EAAE,EAAA,EAAI,MAAM,CAAA;AAAA,QACjC,CAAA,MAAO;AACL,UAAA,QAAA,CAAS,GAAA,EAAK,GAAA,EAAK,EAAE,KAAA,EAAO,2CAA2C,CAAA;AAAA,QACzE;AACA,QAAA;AAAA,MACF;AAGA,MAAA,IAAI,GAAA,CAAI,WAAW,MAAA,EAAQ;AAEzB,QAAA,MAAM,SAAA,GAAY,GAAA,CAAI,OAAA,CAAQ,gBAAgB,CAAA;AAC9C,QAAA,MAAM,YAAA,GAAe,SAAA,IAAa,CAAA,GAAA,EAAM,WAAA,CAAY,GAAG,CAAC,CAAA,CAAA;AACxD,QAAA,IAAI,CAAC,cAAA,CAAe,YAAY,CAAA,EAAG;AACjC,UAAA,GAAA,CAAI,UAAU,GAAA,EAAK,EAAE,gBAAgB,kBAAA,EAAoB,aAAA,EAAe,MAAM,CAAA;AAC9E,UAAA,GAAA,CAAI,IAAI,IAAA,CAAK,SAAA,CAAU,EAAE,KAAA,EAAO,qBAAA,EAAuB,CAAC,CAAA;AACxD,UAAA;AAAA,QACF;AAGA,QAAA,IAAI,IAAA;AACJ,QAAA,IAAI;AACF,UAAA,MAAM,GAAA,GAAM,MAAM,QAAA,CAAS,GAAG,CAAA;AAC9B,UAAA,IAAA,GAAO,IAAA,CAAK,KAAA,CAAM,GAAA,CAAI,QAAA,CAAS,OAAO,CAAC,CAAA;AAAA,QACzC,SAAS,GAAA,EAAK;AACZ,UAAA,MAAM,GAAA,GAAM,GAAA,YAAe,KAAA,GAAQ,GAAA,CAAI,OAAA,GAAU,sBAAA;AACjD,UAAA,QAAA,CAAS,GAAA,EAAK,GAAA,EAAK,EAAE,KAAA,EAAO,KAAK,CAAA;AACjC,UAAA;AAAA,QACF;AAGA,QAAA,MAAM,MAAA,GACJ,OAAO,IAAA,KAAS,QAAA,IAChB,SAAS,IAAA,IACT,QAAA,IAAY,IAAA,IACX,IAAA,CAA4B,MAAA,KAAW,YAAA;AAE1C,QAAA,IAAI,MAAA,EAAQ;AAEV,UAAA,MAAM,eAAA,GAAkB,GAAA,CAAI,OAAA,CAAQ,sBAAsB,CAAA;AAC1D,UAAA,IACE,eAAA,IACA,eAAA,KAAoB,oBAAA,IACpB,eAAA,KAAoB,YAAA,EACpB;AACA,YAAA,QAAA,CAAS,KAAK,GAAA,EAAK,EAAE,OAAO,CAAA,kCAAA,EAAqC,eAAe,IAAI,CAAA;AACpF,YAAA;AAAA,UACF;AAGA,UAAA,MAAM,MAAA,GAAS,IAAI,OAAA,CAAQ,MAAA;AAC3B,UAAA,IAAI,CAAC,MAAA,EAAQ;AACX,YAAA,OAAA,CAAQ,MAAA,CAAO,KAAA;AAAA,cACb,IAAI,WAAW,CAAA;AAAA;AAAA,aACjB;AAAA,UACF;AAGA,UAAA,IAAIC,MAAAA;AACJ,UAAA,IAAI;AACF,YAAAA,MAAAA,GAAQ,MAAM,cAAA,CAAe,aAAA,CAAc,QAAQ,aAAA,EAAe,WAAA,CAAY,GAAG,CAAC,CAAA;AAAA,UACpF,SAAS,GAAA,EAAK;AACZ,YAAA,MAAM,GAAA,GAAM,GAAA,YAAe,KAAA,GAAQ,GAAA,CAAI,OAAA,GAAU,0BAAA;AACjD,YAAA,QAAA,CAAS,GAAA,EAAK,GAAA,EAAK,EAAE,KAAA,EAAO,KAAK,CAAA;AACjC,YAAA;AAAA,UACF;AAGA,UAAA,MAAMA,MAAAA,CAAM,SAAA,CAAU,aAAA,CAAc,GAAA,EAAK,KAAK,IAAI,CAAA;AAClD,UAAA;AAAA,QACF;AAGA,QAAA,IAAI,CAAC,SAAA,EAAW;AACd,UAAA,QAAA,CAAS,GAAA,EAAK,GAAA,EAAK,EAAE,KAAA,EAAO,iCAAiC,CAAA;AAC7D,UAAA;AAAA,QACF;AACA,QAAA,IAAI,CAAC,gBAAA,CAAiB,SAAS,CAAA,EAAG;AAChC,UAAA,QAAA,CAAS,KAAK,GAAA,EAAK;AAAA,YACjB,KAAA,EAAO;AAAA,WACR,CAAA;AACD,UAAA;AAAA,QACF;AAEA,QAAA,MAAM,KAAA,GAAQ,cAAA,CAAe,UAAA,CAAW,SAAS,CAAA;AACjD,QAAA,IAAI,CAAC,KAAA,EAAO;AACV,UAAA,QAAA,CAAS,GAAA,EAAK,GAAA,EAAK,EAAE,KAAA,EAAO,mCAAmC,CAAA;AAC/D,UAAA;AAAA,QACF;AAGA,QAAA,MAAM,KAAA,CAAM,SAAA,CAAU,aAAA,CAAc,GAAA,EAAK,KAAK,IAAI,CAAA;AAClD,QAAA;AAAA,MACF;AAGA,MAAA,GAAA,CAAI,UAAU,GAAA,EAAK,EAAE,OAAO,cAAA,EAAgB,cAAA,EAAgB,oBAAoB,CAAA;AAChF,MAAA,GAAA,CAAI,IAAI,IAAA,CAAK,SAAA,CAAU,EAAE,KAAA,EAAO,oBAAA,EAAsB,CAAC,CAAA;AACvD,MAAA;AAAA,IACF;AAGA,IAAA,QAAA,CAAS,GAAA,EAAK,GAAA,EAAK,EAAE,KAAA,EAAO,aAAa,CAAA;AAAA,EAC3C,CAAC,CAAA;AAGD,EAAA,MAAA,CAAO,cAAA,GAAiB,GAAA;AACxB,EAAA,MAAA,CAAO,cAAA,GAAiB,GAAA;AACxB,EAAA,MAAA,CAAO,gBAAA,GAAmB,GAAA;AAE1B,EAAA,OAAO,IAAI,OAAA,CAAQ,CAACC,QAAAA,EAAS,MAAA,KAAW;AACtC,IAAA,MAAA,CAAO,EAAA,CAAG,SAAS,MAAM,CAAA;AACzB,IAAA,MAAA,CAAO,MAAA,CAAO,IAAA,EAAM,IAAA,EAAM,MAAM;AAC9B,MAAA,OAAA,CAAQ,OAAO,KAAA,CAAM,CAAA,CAAA,EAAI,WAAW,CAAA,qCAAA,EAAwC,IAAI,IAAI,IAAI;AAAA,CAAI,CAAA;AAC5F,MAAA,OAAA,CAAQ,MAAA,CAAO,KAAA,CAAM,CAAA,kCAAA,EAAqC,oBAAoB,CAAA;AAAA,CAAK,CAAA;AACnF,MAAA,OAAA,CAAQ,MAAA,CAAO,KAAA;AAAA,QACb,CAAA;AAAA;AAAA,OACF;AACA,MAAA,OAAA,CAAQ,OAAO,KAAA,CAAM,CAAA;AAAA,CAAoD,CAAA;AACzE,MAAA,IAAI,UAAA,EAAY;AACd,QAAA,OAAA,CAAQ,MAAA,CAAO,KAAA,CAAM,CAAA,WAAA,EAAc,OAAO,CAAA;AAAA,CAAqC,CAAA;AAAA,MACjF,CAAA,MAAO;AACL,QAAA,OAAA,CAAQ,MAAA,CAAO,KAAA;AAAA,UACb,CAAA;AAAA;AAAA,SACF;AAAA,MACF;AACA,MAAA,OAAA,CAAQ,MAAA,CAAO,KAAA;AAAA,QACb,CAAA,gBAAA,EAAmB,OAAA,CAAQ,WAAA,IAAe,GAAG,CAAA,EAAA,EAAK,OAAA,CAAQ,gBAAA,IAAoB,EAAE,CAAA,UAAA,EAAA,CAAc,OAAA,CAAQ,YAAA,IAAgB,IAAA,IAAa,GAAI,CAAA;AAAA;AAAA,OACzI;AACA,MAAA,OAAA,CAAQ,MAAA,CAAO,KAAA,CAAM,CAAA,cAAA,EAAiB,YAAY,CAAA;AAAA,CAAwB,CAAA;AAC1E,MAAA,OAAA,CAAQ,MAAA,CAAO,KAAA;AAAA,QACb,CAAA,QAAA,EAAW,WAAA,CAAY,IAAA,GAAO,CAAA,GAAI,CAAC,GAAG,WAAW,CAAA,CAAE,IAAA,CAAK,IAAI,CAAA,GAAI,UAAU;AAAA;AAAA,OAC5E;AACA,MAAA,OAAA,CAAQ,MAAA,CAAO,KAAA;AAAA,QACb,CAAA;AAAA;AAAA,OACF;AAEA,MAAAA,QAAAA,CAAQ;AAAA,QACN,SAAS,YAAY;AACnB,UAAA,MAAM,eAAe,OAAA,EAAQ;AAC7B,UAAA,MAAM,IAAI,QAAc,CAAC,GAAA,KAAQ,OAAO,KAAA,CAAM,MAAM,GAAA,EAAK,CAAC,CAAA;AAAA,QAC5D;AAAA,OACD,CAAA;AAAA,IACH,CAAC,CAAA;AAAA,EACH,CAAC,CAAA;AACH;AA7hBA,IAqEM,aAAA,EACA,2BACA,sBAAA,EACA,qBAAA;AAxEN,IAAA,mBAAA,GAAA,KAAA,CAAA;AAAA,EAAA,uBAAA,GAAA;AAgBA,IAAA,oBAAA,EAAA;AACA,IAAA,cAAA,EAAA;AAoDA,IAAM,aAAA,GAAgB,GAAA;AACtB,IAAM,yBAAA,GAA4B,OAAA;AAClC,IAAM,sBAAA,GAAyB,GAAA;AAC/B,IAAM,qBAAA,GAAwB,GAAA;AAAA,EAAA;AAAA,CAAA,CAAA;;;AC1D9B,cAAA,EAAA;;;ACcO,IAAM,cAAA,GAAN,cAA6B,KAAA,CAAM;AAAA,EAC/B,IAAA;AAAA,EAET,WAAA,CAAY,IAAA,EAA0B,OAAA,EAAiB,OAAA,EAAwB;AAC7E,IAAA,KAAA,CAAM,SAAS,OAAO,CAAA;AACtB,IAAA,IAAA,CAAK,IAAA,GAAO,gBAAA;AACZ,IAAA,IAAA,CAAK,IAAA,GAAO,IAAA;AAAA,EACd;AACF,CAAA;AAEO,IAAM,YAAA,GAAN,cAA2B,cAAA,CAAe;AAAA,EAC/C,WAAA,CAAY,SAAiB,OAAA,EAAwB;AACnD,IAAA,KAAA,CAAM,gBAAA,EAAkB,SAAS,OAAO,CAAA;AACxC,IAAA,IAAA,CAAK,IAAA,GAAO,cAAA;AAAA,EACd;AACF,CAAA;AAEO,IAAM,eAAA,GAAN,cAA8B,cAAA,CAAe;AAAA,EAClD,WAAA,CAAY,SAAiB,OAAA,EAAwB;AACnD,IAAA,KAAA,CAAM,mBAAA,EAAqB,SAAS,OAAO,CAAA;AAC3C,IAAA,IAAA,CAAK,IAAA,GAAO,iBAAA;AAAA,EACd;AACF,CAAA;AAEO,IAAM,aAAA,GAAN,cAA4B,cAAA,CAAe;AAAA,EAChD,WAAA,CAAY,SAAiB,OAAA,EAAwB;AACnD,IAAA,KAAA,CAAM,iBAAA,EAAmB,SAAS,OAAO,CAAA;AACzC,IAAA,IAAA,CAAK,IAAA,GAAO,eAAA;AAAA,EACd;AACF,CAAA;AAgBO,IAAM,kBAAA,GAAN,cAAiC,cAAA,CAAe;AAAA,EACrD,WAAA,CAAY,SAAiB,OAAA,EAAwB;AACnD,IAAA,KAAA,CAAM,sBAAA,EAAwB,SAAS,OAAO,CAAA;AAC9C,IAAA,IAAA,CAAK,IAAA,GAAO,oBAAA;AAAA,EACd;AACF,CAAA;AAOO,SAAS,cAAA,CAAe,MAAc,iBAAA,EAAqC;AAChF,EAAA,IAAI,MAAA,GAAS,IAAA;AACb,EAAA,KAAA,MAAW,WAAW,iBAAA,EAAmB;AACvC,IAAA,MAAA,GAAS,MAAA,CAAO,OAAA,CAAQ,OAAA,EAAS,YAAY,CAAA;AAAA,EAC/C;AACA,EAAA,OAAO,MAAA;AACT;;;AClFA,IAAM,gBAAA,GAAmBC,MAAE,MAAA,CAAO;AAAA,EAChC,OAAA,EAASA,KAAA,CAAE,OAAA,EAAQ,CAAE,QAAQ,IAAI,CAAA;AAAA,EACjC,eAAeA,KAAA,CAAE,KAAA,CAAMA,MAAE,MAAA,EAAQ,EAAE,QAAA;AACrC,CAAC,CAAA;AAED,IAAM,eAAA,GAAkBA,MAAE,MAAA,CAAO;AAAA,EAC/B,cAAA,EAAgBA,KAAA,CAAE,OAAA,EAAQ,CAAE,QAAQ,KAAK,CAAA;AAAA,EACzC,aAAA,EAAeA,KAAA,CAAE,OAAA,EAAQ,CAAE,QAAQ,KAAK,CAAA;AAAA,EACxC,mBAAA,EAAqBA,KAAA,CAAE,OAAA,EAAQ,CAAE,QAAQ,KAAK;AAChD,CAAC,CAAA;AAED,IAAM,YAAA,GAAeA,MAAE,MAAA,CAAO;AAAA,EAC5B,aAAA,EAAeA,MAAE,MAAA,EAAO,CAAE,KAAI,CAAE,QAAA,EAAS,CAAE,OAAA,CAAQ,KAAM,CAAA;AAAA,EACzD,kBAAA,EAAoBA,MAAE,MAAA,EAAO,CAAE,KAAI,CAAE,QAAA,EAAS,CAAE,OAAA,CAAQ,KAAM,CAAA;AAAA,EAC9D,eAAA,EAAiBA,MAAE,MAAA,EAAO,CAAE,KAAI,CAAE,QAAA,EAAS,CAAE,OAAA,CAAQ,GAAM,CAAA;AAAA,EAC3D,eAAA,EAAiBA,MAAE,MAAA,EAAO,CAAE,KAAI,CAAE,QAAA,EAAS,CAAE,OAAA,CAAQ,EAAE,CAAA;AAAA,EACvD,gBAAA,EAAkBA,MAAE,MAAA,EAAO,CAAE,KAAI,CAAE,QAAA,EAAS,CAAE,OAAA,CAAQ,MAAO,CAAA;AAAA,EAC7D,mBAAA,EAAqBA,MAAE,MAAA,EAAO,CAAE,KAAI,CAAE,QAAA,EAAS,CAAE,OAAA,CAAQ,GAAG,CAAA;AAAA,EAC5D,gBAAA,EAAkBA,MAAE,MAAA,EAAO,CAAE,KAAI,CAAE,QAAA,EAAS,CAAE,OAAA,CAAQ,QAAU,CAAA;AAAA,EAChE,eAAA,EAAiBA,MAAE,MAAA,EAAO,CAAE,KAAI,CAAE,QAAA,EAAS,CAAE,OAAA,CAAQ,KAAM;AAC7D,CAAC,CAAA;AAKD,IAAM,gBAAA,GAAmBA,MAAE,MAAA,CAAO;AAAA,EAChC,IAAA,EAAMA,KAAA,CAAE,MAAA,EAAO,CAAE,QAAA;AACnB,CAAC,CAAA;AAEM,IAAM,YAAA,GAAeA,MAAE,MAAA,CAAO;AAAA,EACnC,OAAA,EAASA,KAAA,CAAE,OAAA,CAAQ,GAAG,CAAA;AAAA,EACtB,aAAA,EAAeA,KAAA,CAAE,OAAA,EAAQ,CAAE,QAAQ,KAAK,CAAA;AAAA,EACxC,SAAA,EAAW,eAAA,CAAgB,QAAA,CAAS,EAAE,CAAA;AAAA,EACtC,KAAA,EAAOA,KAAA,CAAE,MAAA,CAAOA,KAAA,CAAE,MAAA,IAAU,gBAAgB,CAAA,CAAE,QAAA,CAAS,EAAE,CAAA;AAAA,EACzD,MAAA,EAAQ,YAAA,CAAa,QAAA,CAAS,EAAE,CAAA;AAAA,EAChC,IAAA,EAAM,iBAAiB,QAAA;AACzB,CAAC,CAAA;AAID,IAAM,cAAA,GAA+B;AAAA,EACnC,OAAA,EAAS,GAAA;AAAA,EACT,aAAA,EAAe,KAAA;AAAA,EACf,WAAW,EAAE,cAAA,EAAgB,OAAO,aAAA,EAAe,KAAA,EAAO,qBAAqB,KAAA,EAAM;AAAA,EACrF,OAAO,EAAC;AAAA,EACR,MAAA,EAAQ;AAAA,IACN,aAAA,EAAe,KAAA;AAAA,IACf,kBAAA,EAAoB,KAAA;AAAA,IACpB,eAAA,EAAiB,GAAA;AAAA,IACjB,eAAA,EAAiB,EAAA;AAAA,IACjB,gBAAA,EAAkB,MAAA;AAAA,IAClB,mBAAA,EAAqB,GAAA;AAAA,IACrB,gBAAA,EAAkB,QAAA;AAAA,IAClB,eAAA,EAAiB;AAAA;AAErB,CAAA;AAEO,SAAS,gBAAA,GAAiC;AAC/C,EAAA,OAAO,gBAAgB,cAAc,CAAA;AACvC;AAOA,SAAS,oBAAoB,KAAA,EAAwB;AACnD,EAAA,IAAI,KAAA,KAAU,IAAA,IAAQ,OAAO,KAAA,KAAU,QAAA,EAAU;AAC/C,IAAA,OAAO,IAAA,CAAK,UAAU,KAAK,CAAA;AAAA,EAC7B;AACA,EAAA,IAAI,KAAA,CAAM,OAAA,CAAQ,KAAK,CAAA,EAAG;AACxB,IAAA,OAAO,MAAM,KAAA,CAAM,GAAA,CAAI,mBAAmB,CAAA,CAAE,IAAA,CAAK,GAAG,CAAA,GAAI,GAAA;AAAA,EAC1D;AACA,EAAA,MAAM,GAAA,GAAM,KAAA;AACZ,EAAA,MAAM,IAAA,GAAO,MAAA,CAAO,IAAA,CAAK,GAAG,EAAE,IAAA,EAAK;AACnC,EAAA,MAAM,KAAA,GAAQ,IAAA,CAAK,GAAA,CAAI,CAAC,MAAM,IAAA,CAAK,SAAA,CAAU,CAAC,CAAA,GAAI,GAAA,GAAM,mBAAA,CAAoB,GAAA,CAAI,CAAC,CAAC,CAAC,CAAA;AACnF,EAAA,OAAO,GAAA,GAAM,KAAA,CAAM,IAAA,CAAK,GAAG,CAAA,GAAI,GAAA;AACjC;AAQA,eAAsB,kBAAkB,KAAA,EAA+C;AACrF,EAAA,MAAM,YAAY,OAAO,KAAA,KAAU,QAAA,GAAW,KAAA,GAAQ,oBAAoB,KAAK,CAAA;AAC/E,EAAA,OAAOC,iBAAU,SAAS,CAAA;AAC5B;AAEA,eAAsB,WACpB,QAAA,EACiD;AACjD,EAAA,IAAI,GAAA;AACJ,EAAA,IAAI;AACF,IAAA,GAAA,GAAM,MAAMC,iBAAA,CAAS,QAAA,EAAU,OAAO,CAAA;AAAA,EACxC,SAAS,GAAA,EAAK;AACZ,IAAA,MAAM,IAAI,eAAA;AAAA,MACR,CAAA,4BAAA,EAA+B,QAAQ,CAAA,IAAA,EAAO,GAAA,YAAe,QAAQ,GAAA,CAAI,OAAA,GAAU,MAAA,CAAO,GAAG,CAAC,CAAA,CAAA;AAAA,MAC9F,EAAE,OAAO,GAAA;AAAI,KACf;AAAA,EACF;AAGA,EAAA,IAAI;AACF,IAAA,MAAM,CAAA,GAAI,MAAMC,aAAA,CAAK,QAAQ,CAAA;AAC7B,IAAA,IAAI,CAAA,CAAE,OAAO,CAAA,EAAO;AAClB,MAAA,OAAA,CAAQ,MAAA,CAAO,KAAA;AAAA,QACb,0CAA0C,QAAQ,CAAA;AAAA;AAAA,OACpD;AAAA,IACF;AAAA,EACF,CAAA,CAAA,MAAQ;AAAA,EAER;AAEA,EAAA,IAAI,MAAA;AACJ,EAAA,IAAI;AACF,IAAA,MAAA,GAAS,IAAA,CAAK,MAAM,GAAG,CAAA;AAAA,EACzB,SAAS,GAAA,EAAK;AACZ,IAAA,MAAM,IAAI,gBAAgB,CAAA,+BAAA,EAAkC,QAAQ,IAAI,EAAE,KAAA,EAAO,KAAK,CAAA;AAAA,EACxF;AAEA,EAAA,MAAM,MAAA,GAAS,YAAA,CAAa,SAAA,CAAU,MAAM,CAAA;AAC5C,EAAA,IAAI,CAAC,OAAO,OAAA,EAAS;AACnB,IAAA,MAAM,SAAS,MAAA,CAAO,KAAA,CAAM,OAAO,GAAA,CAAI,CAAC,MAAM,CAAA,EAAG,CAAA,CAAE,KAAK,IAAA,CAAK,GAAG,CAAC,CAAA,EAAA,EAAK,CAAA,CAAE,OAAO,CAAA,CAAE,CAAA,CAAE,KAAK,IAAI,CAAA;AAC5F,IAAA,MAAM,IAAI,eAAA,CAAgB,CAAA,0BAAA,EAA6B,MAAM,CAAA,CAAE,CAAA;AAAA,EACjE;AAGA,EAAA,MAAM,IAAA,GAAO,MAAM,iBAAA,CAAkB,MAAA,CAAO,IAAI,CAAA;AAChD,EAAA,OAAO,EAAE,MAAA,EAAQ,MAAA,CAAO,IAAA,EAAM,IAAA,EAAK;AACrC;ACnHA,eAAsB,cAAc,SAAA,EAAuC;AACzE,EAAA,IAAI,GAAA;AAEJ,EAAA,IAAI,SAAA,CAAU,UAAA,CAAW,MAAM,CAAA,EAAG;AAChC,IAAA,MAAM,OAAA,GAAU,SAAA,CAAU,KAAA,CAAM,CAAC,CAAA;AACjC,IAAA,MAAM,QAAA,GAAW,OAAA,CAAQ,GAAA,CAAI,OAAO,CAAA;AACpC,IAAA,IAAI,CAAC,QAAA,EAAU;AACb,MAAA,MAAM,IAAI,YAAA,CAAa,CAAA,qBAAA,EAAwB,OAAO,CAAA,oBAAA,CAAsB,CAAA;AAAA,IAC9E;AACA,IAAA,GAAA,GAAM,QAAA;AAAA,EACR,CAAA,MAAA,IAAW,SAAA,CAAU,UAAA,CAAW,OAAO,CAAA,EAAG;AACxC,IAAA,MAAM,QAAA,GAAW,SAAA,CAAU,KAAA,CAAM,CAAC,CAAA;AAClC,IAAA,IAAI;AACF,MAAA,GAAA,GAAM,MAAMD,iBAAAA,CAAS,QAAA,EAAU,OAAO,CAAA;AAAA,IACxC,SAAS,GAAA,EAAK;AACZ,MAAA,MAAM,IAAI,YAAA;AAAA,QACR,CAAA,yBAAA,EAA4B,QAAQ,CAAA,IAAA,EAAO,GAAA,YAAe,QAAQ,GAAA,CAAI,OAAA,GAAU,MAAA,CAAO,GAAG,CAAC,CAAA,CAAA;AAAA,QAC3F,EAAE,OAAO,GAAA;AAAI,OACf;AAAA,IACF;AAAA,EACF,CAAA,MAAO;AACL,IAAA,MAAM,IAAI,YAAA;AAAA,MACR,2BAA2B,SAAS,CAAA,sCAAA;AAAA,KACtC;AAAA,EACF;AAEA,EAAA,IAAI,GAAA;AACJ,EAAA,IAAI;AACF,IAAA,GAAA,GAAM,IAAA,CAAK,MAAM,GAAG,CAAA;AAAA,EACtB,SAAS,GAAA,EAAK;AACZ,IAAA,MAAM,IAAI,YAAA,CAAa,4BAAA,EAA8B,EAAE,KAAA,EAAO,KAAK,CAAA;AAAA,EACrE;AAGA,EAAA,IACE,OAAO,GAAA,KAAQ,QAAA,IACf,GAAA,KAAQ,IAAA,IACR,EAAE,KAAA,IAAS,GAAA,CAAA,IACX,EAAE,KAAA,IAAS,GAAA,CAAA,IACX,EAAE,OAAO,GAAA,CAAA,EACT;AACA,IAAA,MAAM,IAAI,aAAa,yCAAyC,CAAA;AAAA,EAClE;AAEA,EAAA,MAAM,CAAA,GAAI,GAAA;AACV,EAAA,IAAI,CAAA,CAAE,GAAA,KAAQ,KAAA,IAAS,CAAA,CAAE,QAAQ,SAAA,EAAW;AAC1C,IAAA,MAAM,IAAI,YAAA;AAAA,MACR,CAAA,sDAAA,EAAyD,OAAO,CAAA,CAAE,GAAG,CAAC,CAAA,KAAA,EAAQ,MAAA,CAAO,CAAA,CAAE,GAAG,CAAC,CAAA;AAAA,KAC7F;AAAA,EACF;AAEA,EAAA,IAAI,OAAO,CAAA,CAAE,CAAA,KAAM,YAAY,OAAO,CAAA,CAAE,MAAM,QAAA,EAAU;AACtD,IAAA,MAAM,IAAI,aAAa,8CAA8C,CAAA;AAAA,EACvE;AAEA,EAAA,MAAM,UAAA,GAAgC;AAAA,IACpC,GAAA,EAAK,KAAA;AAAA,IACL,GAAA,EAAK,SAAA;AAAA,IACL,GAAG,CAAA,CAAE,CAAA;AAAA,IACL,GAAG,CAAA,CAAE;AAAA,GACP;AAGA,EAAA,MAAM,KAAA,GAAQ,MAAME,sBAAA,CAAgB,UAAU,CAAA;AAC9C,EAAA,IAAI,CAAC,KAAA,EAAO;AACV,IAAA,MAAM,IAAI,aAAa,uDAAuD,CAAA;AAAA,EAChF;AAEA,EAAA,MAAM,UAAA,GAAaC,sBAAA,CAAgB,UAAA,CAAW,CAAC,CAAA;AAC/C,EAAA,MAAM,SAAA,GAAY,MAAMC,sBAAA,CAAgB,UAAU,CAAA;AAIlD,EAAA,IAAI,GAAA;AACJ,EAAA,IAAI,OAAO,CAAA,CAAE,GAAA,KAAQ,QAAA,EAAU;AAC7B,IAAA,GAAA,GAAM,CAAA,CAAE,GAAA;AAAA,EACV,CAAA,MAAO;AACL,IAAA,MAAM,MAAA,GAASC,uBAAgB,SAAS,CAAA;AACxC,IAAA,MAAM,IAAA,GAAO,MAAMN,gBAAAA,CAAU,MAAM,CAAA;AACnC,IAAA,GAAA,GAAM,IAAA,CAAK,KAAA,CAAM,CAAA,EAAG,EAAE,CAAA;AAAA,EACxB;AAEA,EAAA,OAAO,EAAE,UAAA,EAAY,SAAA,EAAW,GAAA,EAAI;AACtC;AC5FA,eAAsB,aAAa,QAAA,EAA2C;AAC5E,EAAA,IAAI,GAAA;AACJ,EAAA,IAAI;AACF,IAAA,GAAA,GAAM,MAAMC,iBAAAA,CAAS,QAAA,EAAU,OAAO,CAAA;AAAA,EACxC,SAAS,GAAA,EAAK;AACZ,IAAA,MAAM,IAAI,aAAA;AAAA,MACR,CAAA,0BAAA,EAA6B,QAAQ,CAAA,IAAA,EAAO,GAAA,YAAe,QAAQ,GAAA,CAAI,OAAA,GAAU,MAAA,CAAO,GAAG,CAAC,CAAA,CAAA;AAAA,MAC5F,EAAE,OAAO,GAAA;AAAI,KACf;AAAA,EACF;AAEA,EAAA,IAAI,MAAA;AACJ,EAAA,IAAI;AACF,IAAA,MAAA,GAAS,IAAA,CAAK,MAAM,GAAG,CAAA;AAAA,EACzB,SAAS,GAAA,EAAK;AACZ,IAAA,MAAM,IAAI,cAAc,CAAA,6BAAA,EAAgC,QAAQ,IAAI,EAAE,KAAA,EAAO,KAAK,CAAA;AAAA,EACpF;AAEA,EAAA,IAAI,OAAO,MAAA,KAAW,QAAA,IAAY,WAAW,IAAA,IAAQ,EAAE,UAAU,MAAA,CAAA,EAAS;AACxE,IAAA,MAAM,IAAI,cAAc,kCAAkC,CAAA;AAAA,EAC5D;AAEA,EAAA,MAAM,IAAA,GAAO,MAAA;AACb,EAAA,IAAI,CAAC,KAAA,CAAM,OAAA,CAAQ,IAAA,CAAK,IAAI,CAAA,EAAG;AAC7B,IAAA,MAAM,IAAI,cAAc,8BAA8B,CAAA;AAAA,EACxD;AAEA,EAAA,MAAM,UAA0B,EAAC;AACjC,EAAA,KAAA,MAAW,GAAA,IAAO,KAAK,IAAA,EAAM;AAC3B,IAAA,IAAI,OAAO,GAAA,KAAQ,QAAA,IAAY,GAAA,KAAQ,IAAA,EAAM;AAC7C,IAAA,MAAM,CAAA,GAAI,GAAA;AAGV,IAAA,IAAI,CAAA,CAAE,GAAA,KAAQ,KAAA,IAAS,CAAA,CAAE,QAAQ,SAAA,EAAW;AAC5C,IAAA,IAAI,OAAO,CAAA,CAAE,CAAA,KAAM,QAAA,EAAU;AAC7B,IAAA,IAAI,CAAA,CAAE,GAAA,KAAQ,MAAA,IAAa,CAAA,CAAE,QAAQ,OAAA,EAAS;AAE9C,IAAA,MAAM,GAAA,GAAM,OAAO,CAAA,CAAE,GAAA,KAAQ,WAAW,CAAA,CAAE,GAAA,GAAM,CAAA,IAAA,EAAO,OAAA,CAAQ,MAAM,CAAA,CAAA;AACrE,IAAA,IAAI;AACF,MAAA,MAAM,SAAA,GAAYG,sBAAAA,CAAgB,CAAA,CAAE,CAAC,CAAA;AACrC,MAAA,IAAI,SAAA,CAAU,WAAW,EAAA,EAAI;AAC3B,QAAA,OAAA,CAAQ,IAAA,CAAK,EAAE,GAAA,EAAK,SAAA,EAAW,CAAA;AAAA,MACjC;AAAA,IACF,CAAA,CAAA,MAAQ;AAAA,IAER;AAAA,EACF;AAEA,EAAA,OAAO,OAAA;AACT;AAEO,SAAS,eAAA,CAAgB,MAAsB,GAAA,EAAqC;AACzF,EAAA,MAAM,QAAQ,IAAA,CAAK,IAAA,CAAK,CAAC,CAAA,KAAM,CAAA,CAAE,QAAQ,GAAG,CAAA;AAC5C,EAAA,OAAO,KAAA,EAAO,SAAA;AAChB;;;ACtDA,IAAM,cAAA,GAAiB,IAAI,IAAA,GAAO,IAAA;AAE3B,SAAS,kBAAA,GAAiC;AAC/C,EAAA,MAAM,gBAAgB,OAAA,CAAQ,MAAA,CAAO,KAAA,CAAM,IAAA,CAAK,QAAQ,MAAM,CAAA;AAC9D,EAAA,IAAI,MAAA,GAAS,EAAA;AACb,EAAA,IAAI,WAAA,GAAc,CAAA;AAElB,EAAA,SAAS,oBAAoB,IAAA,EAAoB;AAE/C,IAAA,MAAM,YAAY,IAAI,WAAA,EAAY,CAAE,MAAA,CAAO,IAAI,CAAA,CAAE,MAAA;AACjD,IAAA,IAAI,YAAY,cAAA,EAAgB;AAC9B,MAAA,MAAM,IAAI,cAAA;AAAA,QACR,8BAAA;AAAA,QACA,CAAA,sBAAA,EAAyB,SAAS,CAAA,2BAAA,EAA8B,cAAc,CAAA;AAAA,OAChF;AAAA,IACF;AAEA,IAAA,IAAI,MAAA;AACJ,IAAA,IAAI;AACF,MAAA,MAAA,GAAS,IAAA,CAAK,MAAM,IAAI,CAAA;AAAA,IAC1B,CAAA,CAAA,MAAQ;AACN,MAAA,MAAM,IAAI,cAAA;AAAA,QACR,8BAAA;AAAA,QACA,CAAA,sCAAA,EAAyC,IAAA,CAAK,KAAA,CAAM,CAAA,EAAG,GAAG,CAAC,CAAA;AAAA,OAC7D;AAAA,IACF;AAEA,IAAA,IAAI,OAAO,MAAA,KAAW,QAAA,IAAY,MAAA,KAAW,IAAA,EAAM;AACjD,MAAA,MAAM,IAAI,cAAA;AAAA,QACR,8BAAA;AAAA,QACA,CAAA,iDAAA,EAAoD,IAAA,CAAK,KAAA,CAAM,CAAA,EAAG,GAAG,CAAC,CAAA;AAAA,OACxE;AAAA,IACF;AAEA,IAAA,MAAM,GAAA,GAAM,MAAA;AAEZ,IAAA,IAAI,GAAA,CAAI,YAAY,KAAA,EAAO;AACzB,MAAA,MAAM,IAAI,cAAA;AAAA,QACR,8BAAA;AAAA,QACA,CAAA,iDAAA,EAAoD,IAAA,CAAK,KAAA,CAAM,CAAA,EAAG,GAAG,CAAC,CAAA;AAAA,OACxE;AAAA,IACF;AAIA,IAAA,MAAM,QAAQ,IAAA,IAAQ,GAAA;AACtB,IAAA,MAAM,YAAY,QAAA,IAAY,GAAA;AAC9B,IAAA,MAAM,WAAW,OAAA,IAAW,GAAA;AAC5B,IAAA,MAAM,YAAY,QAAA,IAAY,GAAA;AAE9B,IAAA,IAAI,KAAA,KAAU,aAAa,QAAA,CAAA,EAAW;AAEpC,MAAA;AAAA,IACF;AACA,IAAA,IAAI,SAAA,IAAa,CAAC,KAAA,EAAO;AAEvB,MAAA;AAAA,IACF;AAEA,IAAA,MAAM,IAAI,cAAA;AAAA,MACR,8BAAA;AAAA,MACA,CAAA,kFAAA,EAAqF,IAAA,CAAK,KAAA,CAAM,CAAA,EAAG,GAAG,CAAC,CAAA;AAAA,KACzG;AAAA,EACF;AAEA,EAAA,SAAS,aAAA,GAAsB;AAC7B,IAAA,MAAM,KAAA,GAAQ,MAAA,CAAO,KAAA,CAAM,IAAI,CAAA;AAE/B,IAAA,MAAA,GAAS,MAAM,GAAA,EAAI;AACnB,IAAA,WAAA,GAAc,IAAI,WAAA,EAAY,CAAE,MAAA,CAAO,MAAM,CAAA,CAAE,MAAA;AAE/C,IAAA,KAAA,MAAW,QAAQ,KAAA,EAAO;AACxB,MAAA,MAAM,OAAA,GAAU,KAAK,IAAA,EAAK;AAC1B,MAAA,IAAI,OAAA,CAAQ,WAAW,CAAA,EAAG;AAC1B,MAAA,mBAAA,CAAoB,OAAO,CAAA;AAAA,IAC7B;AAAA,EACF;AAEA,EAAA,MAAM,YAAA,GAAe,SACnB,KAAA,EACA,kBAAA,EACA,QAAA,EACS;AAET,IAAA,IAAI,QAAA;AACJ,IAAA,IAAI,EAAA;AAEJ,IAAA,IAAI,OAAO,uBAAuB,UAAA,EAAY;AAC5C,MAAA,EAAA,GAAK,kBAAA;AAAA,IACP,CAAA,MAAO;AACL,MAAA,QAAA,GAAW,kBAAA;AACX,MAAA,EAAA,GAAK,QAAA;AAAA,IACP;AAGA,IAAA,MAAM,GAAA,GAAM,OAAO,KAAA,KAAU,QAAA,GAAW,QAAQ,IAAI,WAAA,EAAY,CAAE,MAAA,CAAO,KAAK,CAAA;AAI9E,IAAA,MAAM,aAAa,IAAI,WAAA,EAAY,CAAE,MAAA,CAAO,GAAG,CAAA,CAAE,MAAA;AACjD,IAAA,IAAI,WAAA,GAAc,aAAa,cAAA,EAAgB;AAC7C,MAAA,MAAM,IAAI,cAAA;AAAA,QACR,8BAAA;AAAA,QACA,iCAAiC,cAAc,CAAA,wBAAA;AAAA,OACjD;AAAA,IACF;AAEA,IAAA,MAAA,IAAU,GAAA;AACV,IAAA,WAAA,IAAe,UAAA;AACf,IAAA,aAAA,EAAc;AAGd,IAAA,IAAI,QAAA,EAAU;AACZ,MAAA,OAAO,aAAA,CAAc,KAAA,EAAO,QAAA,EAAU,EAAE,CAAA;AAAA,IAC1C;AACA,IAAA,OAAO,aAAA,CAAc,OAAO,EAAmB,CAAA;AAAA,EACjD,CAAA;AAEA,EAAA,OAAA,CAAQ,OAAO,KAAA,GAAQ,YAAA;AAGvB,EAAA,OAAO,SAAS,QAAA,GAAiB;AAE/B,IAAA,IAAI,MAAA,CAAO,IAAA,EAAK,CAAE,MAAA,GAAS,CAAA,EAAG;AAC5B,MAAA,mBAAA,CAAoB,MAAA,CAAO,MAAM,CAAA;AAAA,IACnC;AACA,IAAA,MAAA,GAAS,EAAA;AACT,IAAA,WAAA,GAAc,CAAA;AACd,IAAA,OAAA,CAAQ,OAAO,KAAA,GAAQ,aAAA;AAAA,EACzB,CAAA;AACF;;;ACxIA,cAAA,EAAA;;;ACGO,SAAS,YAAA,CAAa,KAAa,MAAA,EAAiD;AACzF,EAAA,MAAM,aAAa,IAAI,WAAA,EAAY,CAAE,MAAA,CAAO,GAAG,CAAA,CAAE,MAAA;AACjD,EAAA,IAAI,UAAA,GAAa,MAAA,CAAO,MAAA,CAAO,aAAA,EAAe;AAC5C,IAAA,OAAO;AAAA,MACL,MAAM,CAAA,uBAAA,EAA0B,UAAU,CAAA,2BAAA,EAA8B,MAAA,CAAO,OAAO,aAAa,CAAA,MAAA,CAAA;AAAA,MACnG,UAAA,EAAY;AAAA,QACV,EAAA,EAAI,KAAA;AAAA,QACJ,IAAA,EAAM,uBAAA;AAAA,QACN,SAAS,CAAA,aAAA,EAAgB,UAAU,CAAA,iBAAA,EAAoB,MAAA,CAAO,OAAO,aAAa,CAAA;AAAA,OACpF;AAAA,MACA,OAAA,EAAS;AAAA,KACX;AAAA,EACF;AACA,EAAA,OAAO,MAAA;AACT;AAMO,SAAS,gBAAA,CACd,UACA,MAAA,EAC2B;AAC3B,EAAA,MAAM,UAAA,GAAa,MAAA,CAAO,KAAA,CAAM,QAAQ,CAAA;AACxC,EAAA,IAAI,UAAA,IAAc,UAAA,CAAW,OAAA,KAAY,KAAA,EAAO;AAC9C,IAAA,OAAO;AAAA,MACL,IAAA,EAAM,SAAS,QAAQ,CAAA,8BAAA,CAAA;AAAA,MACvB,UAAA,EAAY;AAAA,QACV,EAAA,EAAI,KAAA;AAAA,QACJ,IAAA,EAAM,qBAAA;AAAA,QACN,OAAA,EAAS,SAAS,QAAQ,CAAA,8BAAA;AAAA,OAC5B;AAAA,MACA,OAAA,EAAS;AAAA,KACX;AAAA,EACF;AACA,EAAA,OAAO,MAAA;AACT;AAOA,SAAS,cAAA,CAAe,OAAgB,IAAA,EAAgC;AACtE,EAAA,IAAI,OAAO,UAAU,QAAA,EAAU;AAC7B,IAAA,OAAO,IAAI,WAAA,EAAY,CAAE,MAAA,CAAO,KAAK,CAAA,CAAE,MAAA;AAAA,EACzC;AACA,EAAA,IAAI,OAAO,KAAA,KAAU,QAAA,IAAY,KAAA,KAAU,MAAM,OAAO,CAAA;AAGxD,EAAA,MAAM,OAAA,GAAU,IAAA,oBAAQ,IAAI,OAAA,EAAgB;AAC5C,EAAA,IAAI,OAAA,CAAQ,GAAA,CAAI,KAAe,CAAA,EAAG,OAAO,CAAA;AACzC,EAAA,OAAA,CAAQ,IAAI,KAAe,CAAA;AAE3B,EAAA,IAAI,KAAA,CAAM,OAAA,CAAQ,KAAK,CAAA,EAAG;AACxB,IAAA,IAAIG,MAAAA,GAAQ,CAAA;AACZ,IAAA,KAAA,MAAW,QAAQ,KAAA,EAAO;AACxB,MAAAA,MAAAA,IAAS,cAAA,CAAe,IAAA,EAAM,OAAO,CAAA;AAAA,IACvC;AACA,IAAA,OAAOA,MAAAA;AAAA,EACT;AACA,EAAA,IAAI,KAAA,GAAQ,CAAA;AACZ,EAAA,KAAA,MAAW,CAAA,IAAK,MAAA,CAAO,MAAA,CAAO,KAAgC,CAAA,EAAG;AAC/D,IAAA,KAAA,IAAS,cAAA,CAAe,GAAG,OAAO,CAAA;AAAA,EACpC;AACA,EAAA,OAAO,KAAA;AACT;AAaA,SAAS,uBAAA,CAAwB,KAAA,EAAgB,KAAA,EAAe,IAAA,EAAgC;AAC9F,EAAA,IAAI,KAAA,KAAU,MAAM,OAAO,CAAA;AAC3B,EAAA,IAAI,KAAA,KAAU,QAAW,OAAO,CAAA;AAChC,EAAA,IAAI,OAAO,KAAA,KAAU,SAAA,EAAW,OAAO,QAAQ,CAAA,GAAI,CAAA;AACnD,EAAA,IAAI,OAAO,KAAA,KAAU,QAAA,EAAU,OAAO,MAAA,CAAO,KAAK,CAAA,CAAE,MAAA;AACpD,EAAA,IAAI,OAAO,KAAA,KAAU,QAAA,EAAU,OAAO,MAAA,CAAO,WAAW,IAAA,CAAK,SAAA,CAAU,KAAK,CAAA,EAAG,MAAM,CAAA;AAErF,EAAA,IAAI,OAAO,KAAA,KAAU,QAAA,EAAU,OAAO,CAAA;AAEtC,EAAA,MAAM,OAAA,GAAU,IAAA,oBAAQ,IAAI,OAAA,EAAgB;AAC5C,EAAA,IAAI,OAAA,CAAQ,GAAA,CAAI,KAAe,CAAA,EAAG,OAAO,CAAA;AACzC,EAAA,OAAA,CAAQ,IAAI,KAAe,CAAA;AAE3B,EAAA,IAAI,KAAA,GAAQ,CAAA;AAEZ,EAAA,IAAI,KAAA,CAAM,OAAA,CAAQ,KAAK,CAAA,EAAG;AACxB,IAAA,KAAA,IAAS,CAAA,GAAI,CAAA,EAAG,CAAA,GAAI,KAAA,CAAM,QAAQ,CAAA,EAAA,EAAK;AACrC,MAAA,IAAI,CAAA,GAAI,GAAG,KAAA,IAAS,CAAA;AACpB,MAAA,KAAA,IAAS,uBAAA,CAAwB,KAAA,CAAM,CAAC,CAAA,EAAG,OAAO,OAAO,CAAA;AACzD,MAAA,IAAI,KAAA,GAAQ,OAAO,OAAO,QAAA;AAAA,IAC5B;AACA,IAAA,OAAO,KAAA;AAAA,EACT;AAEA,EAAA,MAAM,OAAA,GAAU,MAAA,CAAO,OAAA,CAAQ,KAAgC,CAAA;AAC/D,EAAA,KAAA,IAAS,CAAA,GAAI,CAAA,EAAG,CAAA,GAAI,OAAA,CAAQ,QAAQ,CAAA,EAAA,EAAK;AACvC,IAAA,IAAI,CAAA,GAAI,GAAG,KAAA,IAAS,CAAA;AACpB,IAAA,MAAM,CAAC,CAAA,EAAG,CAAC,CAAA,GAAI,QAAQ,CAAC,CAAA;AACxB,IAAA,KAAA,IAAS,OAAO,UAAA,CAAW,IAAA,CAAK,UAAU,CAAC,CAAA,EAAG,MAAM,CAAA,GAAI,CAAA;AACxD,IAAA,KAAA,IAAS,uBAAA,CAAwB,CAAA,EAAG,KAAA,EAAO,OAAO,CAAA;AAClD,IAAA,IAAI,KAAA,GAAQ,OAAO,OAAO,QAAA;AAAA,EAC5B;AACA,EAAA,OAAO,KAAA;AACT;AAYO,SAAS,eAAA,CACd,OACA,MAAA,EAC2B;AAC3B,EAAA,MAAM,KAAA,GAAQ,MAAA,CAAO,MAAA,CAAO,aAAA,GAAgB,CAAA;AAG5C,EAAA,MAAM,UAAA,GAAa,eAAe,KAAK,CAAA;AACvC,EAAA,IAAI,aAAa,KAAA,EAAO;AACtB,IAAA,OAAO;AAAA,MACL,IAAA,EAAM,CAAA,+BAAA,EAAkC,UAAU,CAAA,2BAAA,EAA8B,KAAK,CAAA,MAAA,CAAA;AAAA,MACrF,UAAA,EAAY;AAAA,QACV,EAAA,EAAI,KAAA;AAAA,QACJ,IAAA,EAAM,uBAAA;AAAA,QACN,OAAA,EAAS,CAAA,eAAA,EAAkB,UAAU,CAAA,iBAAA,EAAoB,KAAK,CAAA;AAAA,OAChE;AAAA,MACA,OAAA,EAAS;AAAA,KACX;AAAA,EACF;AAIA,EAAA,MAAM,cAAA,GAAiB,uBAAA,CAAwB,KAAA,EAAO,KAAK,CAAA;AAC3D,EAAA,IAAI,iBAAiB,KAAA,EAAO;AAC1B,IAAA,OAAO;AAAA,MACL,IAAA,EAAM,+DAA+D,KAAK,CAAA,MAAA,CAAA;AAAA,MAC1E,UAAA,EAAY;AAAA,QACV,EAAA,EAAI,KAAA;AAAA,QACJ,IAAA,EAAM,uBAAA;AAAA,QACN,OAAA,EAAS,+CAA+C,KAAK,CAAA,MAAA;AAAA,OAC/D;AAAA,MACA,OAAA,EAAS;AAAA,KACX;AAAA,EACF;AAEA,EAAA,OAAO,MAAA;AACT;AAMO,SAAS,gBAAA,CACd,GAAA,EACA,QAAA,GAAmB,EAAA,EACnB,eAAuB,CAAA,EACd;AACT,EAAA,IAAI,YAAA,GAAe,UAAU,OAAO,KAAA;AACpC,EAAA,IAAI,OAAO,GAAA,KAAQ,QAAA,IAAY,GAAA,KAAQ,MAAM,OAAO,IAAA;AACpD,EAAA,IAAI,KAAA,CAAM,OAAA,CAAQ,GAAG,CAAA,EAAG;AACtB,IAAA,OAAO,GAAA,CAAI,MAAM,CAAC,IAAA,KAAS,iBAAiB,IAAA,EAAM,QAAA,EAAU,YAAA,GAAe,CAAC,CAAC,CAAA;AAAA,EAC/E;AACA,EAAA,OAAO,MAAA,CAAO,MAAA,CAAO,GAA8B,CAAA,CAAE,KAAA;AAAA,IAAM,CAAC,KAAA,KAC1D,gBAAA,CAAiB,KAAA,EAAO,QAAA,EAAU,eAAe,CAAC;AAAA,GACpD;AACF;AASA,IAAM,2BAAA,GAA8B,sCAAA;AAU7B,SAAS,oBAAA,CACd,cAAA,EAKA,EAAA,GAAsB,2BAAA,EACd;AACR,EAAA,MAAM,QAAA,GAAW;AAAA,IACf,OAAA,EAAS,KAAA;AAAA,IACT,EAAA;AAAA,IACA,MAAA,EAAQ;AAAA,MACN,SAAS,cAAA,CAAe,OAAA;AAAA,MACxB,mBAAmB,cAAA,CAAe,iBAAA;AAAA,MAClC,SAAS,cAAA,CAAe;AAAA;AAC1B,GACF;AACA,EAAA,OAAO,OAAO,UAAA,CAAW,IAAA,CAAK,UAAU,QAAQ,CAAA,EAAG,MAAM,CAAA,GAAI,CAAA;AAC/D;AASA,IAAM,iBAAA,GAAoB,iDAAA;AAC1B,IAAM,0BAA0B,IAAI,WAAA,EAAY,CAAE,MAAA,CAAO,iBAAiB,CAAA,CAAE,MAAA;AAQrE,SAAS,gBAAA,CAAiB,MAAc,MAAA,EAAwC;AACrF,EAAA,MAAM,QAAA,GAAW,OAAO,MAAA,CAAO,kBAAA;AAC/B,EAAA,MAAM,OAAA,GAAU,IAAI,WAAA,EAAY,CAAE,OAAO,IAAI,CAAA;AAC7C,EAAA,IAAI,OAAA,CAAQ,UAAU,QAAA,EAAU;AAC9B,IAAA,OAAO,EAAE,MAAM,SAAA,EAAW,KAAA,EAAO,eAAe,OAAA,CAAQ,MAAA,EAAQ,aAAA,EAAe,OAAA,CAAQ,MAAA,EAAO;AAAA,EAChG;AAIA,EAAA,MAAM,UAAA,GAAa,IAAA,CAAK,GAAA,CAAI,CAAA,EAAG,WAAW,uBAAuB,CAAA;AAEjE,EAAA,MAAM,aAAA,GAAgB,IAAI,WAAA,EAAY,CAAE,OAAO,OAAA,CAAQ,KAAA,CAAM,CAAA,EAAG,UAAU,CAAC,CAAA;AAC3E,EAAA,MAAM,YAAY,aAAA,GAAgB,iBAAA;AAClC,EAAA,MAAM,YAAA,GAAe,IAAI,WAAA,EAAY,CAAE,OAAO,SAAS,CAAA;AACvD,EAAA,OAAO;AAAA,IACL,IAAA,EAAM,SAAA;AAAA,IACN,SAAA,EAAW,IAAA;AAAA,IACX,eAAe,OAAA,CAAQ,MAAA;AAAA,IACvB,eAAe,YAAA,CAAa;AAAA,GAC9B;AACF;;;AC5PA,SAAS,iBAAiB,MAAA,EAGxB;AACA,EAAA,MAAM,EAAE,KAAA,EAAO,OAAA,EAAQ,GAAI,MAAA;AAG3B,EAAA,IAAI,MAAM,oBAAA,EAAsB;AAC9B,IAAA,OAAO;AAAA,MACL,SAAA,EAAWH,sBAAAA,CAAgB,KAAA,CAAM,oBAAoB,CAAA;AAAA,MACrD,SAAA,EAAW;AAAA,KACb;AAAA,EACF;AAGA,EAAA,IAAI,MAAM,IAAA,EAAM;AACd,IAAA,MAAM,IAAA,GAAO,IAAA,CAAK,KAAA,CAAM,KAAA,CAAM,IAAI,CAAA;AAClC,IAAA,IAAI,CAAC,IAAA,CAAK,IAAA,EAAM,MAAA,EAAQ;AACtB,MAAA,MAAM,IAAI,MAAM,gCAAgC,CAAA;AAAA,IAClD;AAEA,IAAA,MAAM,EAAE,MAAA,EAAO,GAAII,aAAA,CAAO,MAAM,GAAG,CAAA;AACnC,IAAA,MAAM,MAAM,MAAA,CAAO,GAAA;AAGnB,IAAA,MAAM,WAAA,GAAc,KAAK,IAAA,CAAK,MAAA;AAAA,MAC5B,CAAC,CAAA,KACC,CAAA,CAAE,GAAA,KAAQ,KAAA,IACV,EAAE,GAAA,KAAQ,SAAA,IACV,OAAO,CAAA,CAAE,MAAM,QAAA,KACd,CAAA,CAAE,GAAA,KAAQ,MAAA,IAAa,EAAE,GAAA,KAAQ,OAAA;AAAA,KACtC;AAEA,IAAA,IAAI,WAAA,CAAY,WAAW,CAAA,EAAG;AAC5B,MAAA,MAAM,IAAI,MAAM,wCAAwC,CAAA;AAAA,IAC1D;AAGA,IAAA,IAAI,GAAA,EAAK;AACP,MAAA,MAAM,UAAU,WAAA,CAAY,IAAA,CAAK,CAAC,CAAA,KAAM,CAAA,CAAE,QAAQ,GAAG,CAAA;AACrD,MAAA,IAAI,OAAA,EAAS;AACX,QAAA,OAAO;AAAA,UACL,SAAA,EAAWJ,sBAAAA,CAAgB,OAAA,CAAQ,CAAW,CAAA;AAAA,UAC9C,SAAA,EAAW;AAAA,SACb;AAAA,MACF;AACA,MAAA,MAAM,MAAA,CAAO,MAAA;AAAA,QACX,IAAI,KAAA,CAAM,CAAA,wDAAA,EAA2D,GAAG,CAAA,CAAA,CAAG,CAAA;AAAA,QAC3E,EAAE,WAAW,qBAAA;AAA+B,OAC9C;AAAA,IACF;AAGA,IAAA,IAAI,WAAA,CAAY,WAAW,CAAA,EAAG;AAC5B,MAAA,OAAO;AAAA,QACL,SAAA,EAAWA,sBAAAA,CAAgB,WAAA,CAAY,CAAC,EAAE,CAAW,CAAA;AAAA,QACrD,SAAA,EAAW;AAAA,OACb;AAAA,IACF;AAEA,IAAA,MAAM,MAAA,CAAO,MAAA;AAAA,MACX,IAAI,KAAA;AAAA,QACF,CAAA,iCAAA,EAAoC,YAAY,MAAM,CAAA,sCAAA;AAAA,OACxD;AAAA,MACA,EAAE,WAAW,oBAAA;AAA8B,KAC7C;AAAA,EACF;AAGA,EAAA,IAAI,OAAA,CAAQ,UAAU,MAAA,EAAQ;AAC5B,IAAA,MAAM,EAAE,MAAA,EAAO,GAAII,aAAA,CAAO,MAAM,GAAG,CAAA;AACnC,IAAA,MAAM,MAAM,MAAA,CAAO,GAAA;AAEnB,IAAA,IAAI,GAAA,EAAK;AACP,MAAA,MAAM,GAAA,GAAM,eAAA,CAAgB,OAAA,CAAQ,QAAA,EAAU,GAAG,CAAA;AACjD,MAAA,IAAI,GAAA,EAAK;AACP,QAAA,OAAO,EAAE,SAAA,EAAW,GAAA,EAAK,SAAA,EAAW,aAAA,EAAc;AAAA,MACpD;AACA,MAAA,MAAM,OAAO,MAAA,CAAO,IAAI,MAAM,CAAA,wCAAA,EAA2C,GAAG,GAAG,CAAA,EAAG;AAAA,QAChF,SAAA,EAAW;AAAA,OACZ,CAAA;AAAA,IACH;AAGA,IAAA,IAAI,OAAA,CAAQ,QAAA,CAAS,MAAA,KAAW,CAAA,EAAG;AACjC,MAAA,OAAO,EAAE,WAAW,OAAA,CAAQ,QAAA,CAAS,CAAC,CAAA,CAAE,SAAA,EAAW,WAAW,aAAA,EAAc;AAAA,IAC9E;AAEA,IAAA,MAAM,MAAA,CAAO,MAAA;AAAA,MACX,IAAI,KAAA;AAAA,QACF,CAAA,wCAAA,EAA2C,OAAA,CAAQ,QAAA,CAAS,MAAM,CAAA,8BAAA;AAAA,OACpE;AAAA,MACA,EAAE,WAAW,oBAAA;AAA8B,KAC7C;AAAA,EACF;AAEA,EAAA,MAAM,MAAA,CAAO,MAAA;AAAA,IACX,IAAI,KAAA;AAAA,MACF;AAAA,KACF;AAAA,IACA,EAAE,WAAW,sBAAA;AAAgC,GAC/C;AACF;AAEA,eAAsB,aAAa,MAAA,EAA4D;AAC7F,EAAA,MAAM,EAAE,KAAA,EAAO,MAAA,EAAO,GAAI,MAAA;AAG1B,EAAA,MAAM,cAAA,GAAiB,gBAAA,CAAiB,aAAA,EAAe,MAAM,CAAA;AAC7D,EAAA,IAAI,gBAAgB,OAAO,cAAA;AAG3B,EAAA,MAAM,UAAA,GAAa,YAAA,CAAa,KAAA,CAAM,GAAA,EAAK,MAAM,CAAA;AACjD,EAAA,IAAI,YAAY,OAAO,UAAA;AAEvB,EAAA,IAAI,SAAA;AACJ,EAAA,IAAI,SAAA;AACJ,EAAA,IAAI;AACF,IAAA,MAAM,QAAA,GAAW,iBAAiB,MAAM,CAAA;AACxC,IAAA,SAAA,GAAY,QAAA,CAAS,SAAA;AACrB,IAAA,SAAA,GAAY,QAAA,CAAS,SAAA;AAAA,EACvB,SAAS,GAAA,EAAK;AACZ,IAAA,MAAM,IAAA,GACF,IAAgC,SAAA,IAAoC,sBAAA;AACxE,IAAA,OAAO;AAAA,MACL,IAAA,EAAM,wBAAwB,GAAA,YAAe,KAAA,GAAQ,IAAI,OAAA,GAAU,MAAA,CAAO,GAAG,CAAC,CAAA,CAAA;AAAA,MAC9E,UAAA,EAAY;AAAA,QACV,EAAA,EAAI,KAAA;AAAA,QACJ,IAAA;AAAA,QACA,SAAS,GAAA,YAAe,KAAA,GAAQ,GAAA,CAAI,OAAA,GAAU,OAAO,GAAG,CAAA;AAAA,QACxD,QAAQ;AAAC,OACX;AAAA,MACA,OAAA,EAAS;AAAA,KACX;AAAA,EACF;AAEA,EAAA,MAAM,MAAA,GAAS,MAAMC,oBAAA,CAAY,KAAA,CAAM,KAAK,SAAA,EAAW;AAAA,IACrD,QAAQ,KAAA,CAAM,MAAA;AAAA,IACd,UAAU,KAAA,CAAM;AAAA,GACjB,CAAA;AAED,EAAA,IAAI,OAAO,KAAA,EAAO;AAChB,IAAA,MAAMC,OAAAA,GAAS;AAAA,MACb,EAAE,IAAA,EAAM,WAAA,EAAa,MAAA,EAAQ,IAAA,EAAK;AAAA,MAClC,EAAE,IAAA,EAAM,QAAA,EAAU,MAAA,EAAQ,IAAA,EAAK;AAAA,MAC/B,EAAE,IAAA,EAAM,QAAA,EAAU,MAAA,EAAQ,IAAA;AAAK,KACjC;AAEA,IAAA,IAAI,MAAM,MAAA,EAAQ;AAChB,MAAAA,QAAO,IAAA,CAAK,EAAE,MAAM,gBAAA,EAAkB,MAAA,EAAQ,MAAM,CAAA;AAAA,IACtD;AACA,IAAA,IAAI,MAAM,QAAA,EAAU;AAClB,MAAAA,QAAO,IAAA,CAAK,EAAE,MAAM,kBAAA,EAAoB,MAAA,EAAQ,MAAM,CAAA;AAAA,IACxD;AAEA,IAAA,MAAM,SAAS,MAAA,CAAO,MAAA;AACtB,IAAA,MAAM,aAAA,GAAyC;AAAA,MAC7C,KAAK,MAAA,CAAO,GAAA;AAAA,MACZ,MAAM,MAAA,CAAO,IAAA;AAAA,MACb,MAAM,MAAA,CAAO,IAAA;AAAA,MACb,KAAK,MAAA,CAAO,GAAA;AAAA,MACZ,GAAI,MAAA,CAAO,GAAA,KAAQ,UAAa,EAAE,GAAA,EAAK,OAAO,GAAA,EAAI;AAAA,MAClD,SAAS,MAAA,CAAO,OAAA;AAAA,MAChB,aAAa,MAAA,CAAO;AAAA,KACtB;AAEA,IAAA,MAAM,EAAA,GAAK,gBAAA;AAAA,MACT,CAAA,qBAAA,EAAwB,OAAO,OAAO,CAAA,eAAA,EAAkB,OAAO,IAAA,IAAQ,SAAS,CAAA,MAAA,EAAS,MAAA,CAAO,GAAG,CAAA,CAAA,CAAA;AAAA,MACnG;AAAA,KACF;AACA,IAAA,OAAO;AAAA,MACL,MAAM,EAAA,CAAG,IAAA;AAAA,MACT,UAAA,EAAY;AAAA,QACV,EAAA,EAAI,IAAA;AAAA,QACJ,SAAS,MAAA,CAAO,OAAA;AAAA,QAChB,MAAA,EAAAA,OAAAA;AAAA,QACA,aAAA;AAAA,QACA,SAAA;AAAA,QACA,GAAI,GAAG,SAAA,GACH;AAAA,UACE,WAAA,EAAa;AAAA,YACX,WAAW,EAAA,CAAG,SAAA;AAAA,YACd,eAAe,EAAA,CAAG,aAAA;AAAA,YAClB,eAAe,EAAA,CAAG;AAAA;AACpB,YAEF;AAAC;AACP,KACF;AAAA,EACF;AAGA,EAAA,MAAM,SAAqE,EAAC;AAC5E,EAAA,IAAI,MAAA,CAAO,SAAS,qBAAA,EAAuB;AACzC,IAAA,MAAA,CAAO,IAAA,CAAK,EAAE,IAAA,EAAM,WAAA,EAAa,QAAQ,KAAA,EAAO,OAAA,EAAS,MAAA,CAAO,OAAA,EAAS,CAAA;AAAA,EAC3E,CAAA,MAAA,IAAW,MAAA,CAAO,IAAA,KAAS,kBAAA,EAAoB;AAC7C,IAAA,MAAA,CAAO,KAAK,EAAE,IAAA,EAAM,WAAA,EAAa,MAAA,EAAQ,MAAM,CAAA;AAC/C,IAAA,MAAA,CAAO,IAAA,CAAK,EAAE,IAAA,EAAM,QAAA,EAAU,QAAQ,KAAA,EAAO,OAAA,EAAS,MAAA,CAAO,OAAA,EAAS,CAAA;AAAA,EACxE,CAAA,MAAA,IAAW,MAAA,CAAO,IAAA,KAAS,WAAA,EAAa;AACtC,IAAA,MAAA,CAAO,KAAK,EAAE,IAAA,EAAM,WAAA,EAAa,MAAA,EAAQ,MAAM,CAAA;AAC/C,IAAA,MAAA,CAAO,KAAK,EAAE,IAAA,EAAM,QAAA,EAAU,MAAA,EAAQ,MAAM,CAAA;AAC5C,IAAA,MAAA,CAAO,IAAA,CAAK,EAAE,IAAA,EAAM,QAAA,EAAU,QAAQ,KAAA,EAAO,OAAA,EAAS,MAAA,CAAO,OAAA,EAAS,CAAA;AAAA,EACxE,CAAA,MAAA,IAAW,MAAA,CAAO,IAAA,KAAS,kBAAA,EAAoB;AAC7C,IAAA,MAAA,CAAO,KAAK,EAAE,IAAA,EAAM,WAAA,EAAa,MAAA,EAAQ,MAAM,CAAA;AAC/C,IAAA,MAAA,CAAO,KAAK,EAAE,IAAA,EAAM,QAAA,EAAU,MAAA,EAAQ,MAAM,CAAA;AAC5C,IAAA,MAAA,CAAO,IAAA,CAAK,EAAE,IAAA,EAAM,gBAAA,EAAkB,QAAQ,KAAA,EAAO,OAAA,EAAS,MAAA,CAAO,OAAA,EAAS,CAAA;AAAA,EAChF,CAAA,MAAA,IAAW,MAAA,CAAO,IAAA,KAAS,oBAAA,EAAsB;AAC/C,IAAA,MAAA,CAAO,KAAK,EAAE,IAAA,EAAM,WAAA,EAAa,MAAA,EAAQ,MAAM,CAAA;AAC/C,IAAA,MAAA,CAAO,KAAK,EAAE,IAAA,EAAM,QAAA,EAAU,MAAA,EAAQ,MAAM,CAAA;AAC5C,IAAA,MAAA,CAAO,IAAA,CAAK,EAAE,IAAA,EAAM,kBAAA,EAAoB,QAAQ,KAAA,EAAO,OAAA,EAAS,MAAA,CAAO,OAAA,EAAS,CAAA;AAAA,EAClF,CAAA,MAAO;AACL,IAAA,MAAA,CAAO,IAAA,CAAK,EAAE,IAAA,EAAM,MAAA,CAAO,IAAA,EAAM,QAAQ,KAAA,EAAO,OAAA,EAAS,MAAA,CAAO,OAAA,EAAS,CAAA;AAAA,EAC3E;AAEA,EAAA,MAAM,MAAA,GAAS,gBAAA;AAAA,IACb,CAAA,qBAAA,EAAwB,MAAA,CAAO,IAAI,CAAA,IAAA,EAAO,OAAO,OAAO,CAAA,CAAA;AAAA,IACxD;AAAA,GACF;AACA,EAAA,OAAO;AAAA,IACL,MAAM,MAAA,CAAO,IAAA;AAAA,IACb,UAAA,EAAY;AAAA,MACV,EAAA,EAAI,KAAA;AAAA,MACJ,MAAM,MAAA,CAAO,IAAA;AAAA,MACb,SAAS,MAAA,CAAO,OAAA;AAAA,MAChB,MAAA;AAAA,MACA,SAAA;AAAA,MACA,GAAI,OAAO,SAAA,GACP;AAAA,QACE,WAAA,EAAa;AAAA,UACX,WAAW,MAAA,CAAO,SAAA;AAAA,UAClB,eAAe,MAAA,CAAO,aAAA;AAAA,UACtB,eAAe,MAAA,CAAO;AAAA;AACxB,UAEF;AAAC;AACP,GACF;AACF;AChPA,eAAsB,cAAc,MAAA,EAA6D;AAC/F,EAAA,MAAM,EAAE,KAAA,EAAO,MAAA,EAAO,GAAI,MAAA;AAG1B,EAAA,MAAM,cAAA,GAAiB,gBAAA,CAAiB,cAAA,EAAgB,MAAM,CAAA;AAC9D,EAAA,IAAI,gBAAgB,OAAO,cAAA;AAG3B,EAAA,MAAM,UAAA,GAAa,YAAA,CAAa,KAAA,CAAM,GAAA,EAAK,MAAM,CAAA;AACjD,EAAA,IAAI,YAAY,OAAO,UAAA;AAEvB,EAAA,IAAI,MAAA;AACJ,EAAA,IAAI,OAAA;AACJ,EAAA,IAAI;AACF,IAAA,MAAM,OAAA,GAAUF,aAAAA,CAAgC,KAAA,CAAM,GAAG,CAAA;AACzD,IAAA,MAAA,GAAS,OAAA,CAAQ,MAAA;AACjB,IAAA,OAAA,GAAU,OAAA,CAAQ,OAAA;AAAA,EACpB,SAAS,GAAA,EAAK;AACZ,IAAA,OAAO;AAAA,MACL,IAAA,EAAM,mBAAmB,GAAA,YAAe,KAAA,GAAQ,IAAI,OAAA,GAAU,MAAA,CAAO,GAAG,CAAC,CAAA,CAAA;AAAA,MACzE,UAAA,EAAY;AAAA,QACV,OAAO,GAAA,YAAe,KAAA,GAAQ,GAAA,CAAI,OAAA,GAAU,OAAO,GAAG,CAAA;AAAA,QACtD,IAAA,EAAM;AAAA,OACR;AAAA,MACA,OAAA,EAAS;AAAA,KACX;AAAA,EACF;AAGA,EAAA,IAAI,OAAA,GAAU,SAAA;AACd,EAAA,IAAI;AACF,IAAA,MAAM,EAAA,GAAKG,0BAAmB,OAAO,CAAA;AACrC,IAAA,IAAI,GAAG,EAAA,EAAI;AACT,MAAA,OAAA,GAAU,EAAA,CAAG,OAAA;AAAA,IACf;AAAA,EACF,CAAA,CAAA,MAAQ;AAAA,EAER;AAEA,EAAA,MAAM,WAAA,GAAuC;AAAA,IAC3C,OAAA;AAAA,IACA,QAAQ,OAAA,CAAQ,GAAA;AAAA,IAChB,UAAU,OAAA,CAAQ;AAAA,GACpB;AAEA,EAAA,IAAI,OAAO,OAAA,CAAQ,GAAA,KAAQ,QAAA,EAAU;AACnC,IAAA,WAAA,CAAY,WAAW,IAAI,IAAA,CAAK,QAAQ,GAAA,GAAM,GAAI,EAAE,WAAA,EAAY;AAAA,EAClE;AACA,EAAA,IAAI,OAAO,OAAA,CAAQ,GAAA,KAAQ,QAAA,EAAU;AACnC,IAAA,WAAA,CAAY,YAAY,IAAI,IAAA,CAAK,QAAQ,GAAA,GAAM,GAAI,EAAE,WAAA,EAAY;AAAA,EACnE;AACA,EAAA,IAAI,OAAO,OAAA,CAAQ,GAAA,KAAQ,QAAA,EAAU;AACnC,IAAA,WAAA,CAAY,YAAY,OAAA,CAAQ,GAAA;AAAA,EAClC;AAGA,EAAA,IAAI,QAAA,GAAW,KAAA;AACf,EAAA,IAAI,WAAA;AAGJ,EAAA,MAAM,mBAAA,GAAsB,KAAA,CAAM,WAAA,IAAe,MAAA,CAAO,SAAA,CAAU,mBAAA;AAClE,EAAA,IAAI,mBAAA,EAAqB;AACvB,IAAA,WAAA,GAAc,EAAE,GAAG,OAAA,EAAQ;AAE3B,IAAA,IAAI,MAAA,CAAO,SAAA,CAAU,cAAA,IAAkB,UAAA,IAAc,WAAA,EAAa;AAChE,MAAA,WAAA,CAAY,QAAA,GAAW,sBAAA;AACvB,MAAA,QAAA,GAAW,IAAA;AAAA,IACb;AACA,IAAA,IAAI,MAAA,CAAO,SAAA,CAAU,aAAA,IAAiB,SAAA,IAAa,WAAA,EAAa;AAC9D,MAAA,WAAA,CAAY,OAAA,GAAU,sBAAA;AACtB,MAAA,QAAA,GAAW,IAAA;AAAA,IACb;AAAA,EACF;AAEA,EAAA,MAAM,KAAA,GAAQ;AAAA,IACZ,6DAAA;AAAA,IACA,EAAA;AAAA,IACA,YAAY,OAAO,CAAA,CAAA;AAAA,IACnB,CAAA,QAAA,EAAW,OAAA,CAAQ,GAAA,IAAO,KAAK,CAAA,CAAA;AAAA,IAC/B,CAAA,UAAA,EAAa,OAAA,CAAQ,GAAA,IAAO,KAAK,CAAA;AAAA,GACnC;AAEA,EAAA,IAAI,YAAY,QAAA,EAAU,KAAA,CAAM,KAAK,CAAA,WAAA,EAAc,WAAA,CAAY,QAAQ,CAAA,CAAE,CAAA;AACzE,EAAA,IAAI,YAAY,SAAA,EAAW,KAAA,CAAM,KAAK,CAAA,YAAA,EAAe,WAAA,CAAY,SAAS,CAAA,CAAE,CAAA;AAC5E,EAAA,IAAI,YAAY,SAAA,EAAW,KAAA,CAAM,KAAK,CAAA,YAAA,EAAe,WAAA,CAAY,SAAS,CAAA,CAAE,CAAA;AAC5E,EAAA,IAAI,QAAA,EAAU,KAAA,CAAM,IAAA,CAAK,EAAA,EAAI,sCAAsC,CAAA;AAEnE,EAAA,MAAM,KAAK,gBAAA,CAAiB,KAAA,CAAM,IAAA,CAAK,IAAI,GAAG,MAAM,CAAA;AACpD,EAAA,OAAO;AAAA,IACL,MAAM,EAAA,CAAG,IAAA;AAAA,IACT,UAAA,EAAY;AAAA,MACV,MAAA;AAAA,MACA,WAAA;AAAA,MACA,GAAI,WAAA,KAAgB,MAAA,GAAY,EAAE,WAAA,KAAgB,EAAC;AAAA,MACnD,QAAA;AAAA,MACA,QAAA,EAAU,KAAA;AAAA,MACV,GAAI,GAAG,SAAA,GACH;AAAA,QACE,WAAA,EAAa;AAAA,UACX,WAAW,EAAA,CAAG,SAAA;AAAA,UACd,eAAe,EAAA,CAAG,aAAA;AAAA,UAClB,eAAe,EAAA,CAAG;AAAA;AACpB,UAEF;AAAC;AACP,GACF;AACF;AC5GA,eAAsB,aAAa,MAAA,EAA4D;AAC7F,EAAA,MAAM,EAAE,KAAA,EAAO,MAAA,EAAO,GAAI,MAAA;AAG1B,EAAA,MAAM,cAAA,GAAiB,gBAAA,CAAiB,aAAA,EAAe,MAAM,CAAA;AAC7D,EAAA,IAAI,gBAAgB,OAAO,cAAA;AAG3B,EAAA,MAAM,UAAA,GAAa,YAAA,CAAa,KAAA,CAAM,GAAA,EAAK,MAAM,CAAA;AACjD,EAAA,IAAI,YAAY,OAAO,UAAA;AAEvB,EAAA,IAAI;AACF,IAAA,MAAM,OAAA,GAAUH,aAAAA,CAAgC,KAAA,CAAM,GAAG,CAAA;AACzD,IAAA,MAAM,SAAS,OAAA,CAAQ,MAAA;AACvB,IAAA,MAAM,UAAU,OAAA,CAAQ,OAAA;AAExB,IAAA,MAAM,EAAA,GAAK,gBAAA;AAAA,MACT;AAAA,QACE,iCAAA;AAAA,QACA,EAAA;AAAA,QACA,WAAW,IAAA,CAAK,SAAA,CAAU,MAAA,EAAQ,IAAA,EAAM,CAAC,CAAC,CAAA,CAAA;AAAA,QAC1C,EAAA;AAAA,QACA,YAAY,IAAA,CAAK,SAAA,CAAU,OAAA,EAAS,IAAA,EAAM,CAAC,CAAC,CAAA;AAAA,OAC9C,CAAE,KAAK,IAAI,CAAA;AAAA,MACX;AAAA,KACF;AAEA,IAAA,OAAO;AAAA,MACL,MAAM,EAAA,CAAG,IAAA;AAAA,MACT,UAAA,EAAY;AAAA,QACV,MAAA;AAAA,QACA,OAAA;AAAA,QACA,QAAA,EAAU,KAAA;AAAA,QACV,GAAI,GAAG,SAAA,GACH;AAAA,UACE,WAAA,EAAa;AAAA,YACX,WAAW,EAAA,CAAG,SAAA;AAAA,YACd,eAAe,EAAA,CAAG,aAAA;AAAA,YAClB,eAAe,EAAA,CAAG;AAAA;AACpB,YAEF;AAAC;AACP,KACF;AAAA,EACF,SAAS,GAAA,EAAK;AACZ,IAAA,OAAO;AAAA,MACL,IAAA,EAAM,kBAAkB,GAAA,YAAe,KAAA,GAAQ,IAAI,OAAA,GAAU,MAAA,CAAO,GAAG,CAAC,CAAA,CAAA;AAAA,MACxE,UAAA,EAAY;AAAA,QACV,OAAO,GAAA,YAAe,KAAA,GAAQ,GAAA,CAAI,OAAA,GAAU,OAAO,GAAG,CAAA;AAAA,QACtD,IAAA,EAAM;AAAA,OACR;AAAA,MACA,OAAA,EAAS;AAAA,KACX;AAAA,EACF;AACF;AChDA,SAAS,gBAAA,CAAiB,YAAwB,SAAA,EAAiC;AACjF,EAAA,MAAM,OAAA,GAAUF,uBAAgB,UAAU,CAAA;AAC1C,EAAA,MAAM,MAAA,GAASA,uBAAgB,SAAS,CAAA;AAExC,EAAA,MAAM,OAAA,GAAU,OAAA,CAAQ,OAAA,CAAQ,qBAAA,EAAuB,MAAM,CAAA;AAC7D,EAAA,MAAM,MAAA,GAAS,MAAA,CAAO,OAAA,CAAQ,qBAAA,EAAuB,MAAM,CAAA;AAC3D,EAAA,OAAO,CAAC,IAAI,MAAA,CAAO,OAAA,EAAS,GAAG,GAAG,IAAI,MAAA,CAAO,MAAA,EAAQ,GAAG,CAAC,CAAA;AAC3D;AAEA,eAAsB,YAAY,MAAA,EAA2D;AAC3F,EAAA,MAAM,EAAE,KAAA,EAAO,MAAA,EAAQ,OAAA,EAAQ,GAAI,MAAA;AAGnC,EAAA,MAAM,cAAA,GAAiB,gBAAA,CAAiB,YAAA,EAAc,MAAM,CAAA;AAC5D,EAAA,IAAI,gBAAgB,OAAO,cAAA;AAG3B,EAAA,IAAI,CAAC,OAAA,CAAQ,SAAA,IAAa,CAAC,QAAQ,QAAA,EAAU;AAC3C,IAAA,OAAO;AAAA,MACL,IAAA,EAAM,yFAAA;AAAA,MACN,UAAA,EAAY;AAAA,QACV,EAAA,EAAI,KAAA;AAAA,QACJ,IAAA,EAAM,oBAAA;AAAA,QACN,OAAA,EAAS;AAAA,OACX;AAAA,MACA,OAAA,EAAS;AAAA,KACX;AAAA,EACF;AAGA,EAAA,MAAM,SAAA,GAAY,IAAA,CAAK,SAAA,CAAU,KAAK,CAAA;AACtC,EAAA,MAAM,aAAa,IAAI,WAAA,EAAY,CAAE,MAAA,CAAO,SAAS,CAAA,CAAE,MAAA;AACvD,EAAA,IAAI,UAAA,GAAa,MAAA,CAAO,MAAA,CAAO,gBAAA,EAAkB;AAC/C,IAAA,OAAO;AAAA,MACL,MAAM,CAAA,2BAAA,EAA8B,UAAU,CAAA,2BAAA,EAA8B,MAAA,CAAO,OAAO,gBAAgB,CAAA,MAAA,CAAA;AAAA,MAC1G,UAAA,EAAY;AAAA,QACV,EAAA,EAAI,KAAA;AAAA,QACJ,IAAA,EAAM,uBAAA;AAAA,QACN,SAAS,CAAA,gBAAA,EAAmB,UAAU,CAAA,iBAAA,EAAoB,MAAA,CAAO,OAAO,gBAAgB,CAAA;AAAA,OAC1F;AAAA,MACA,OAAA,EAAS;AAAA,KACX;AAAA,EACF;AAGA,EAAA,MAAM,cAAc,gBAAA,CAAiB,OAAA,CAAQ,UAAU,UAAA,EAAY,OAAA,CAAQ,UAAU,SAAS,CAAA;AAE9F,EAAA,IAAI;AAIF,IAAA,IAAI,KAAA,CAAM,MAAA,IAAU,CAAC,KAAA,CAAM,OAAO,MAAA,EAAQ;AACxC,MAAA,OAAO;AAAA,QACL,IAAA,EAAM,uEAAA;AAAA,QACN,UAAA,EAAY;AAAA,UACV,EAAA,EAAI,KAAA;AAAA,UACJ,IAAA,EAAM,oBAAA;AAAA,UACN,OAAA,EACE;AAAA,SACJ;AAAA,QACA,OAAA,EAAS;AAAA,OACX;AAAA,IACF;AACA,IAAA,MAAM,cAAc,KAAA,CAAM,MAAA,EAAQ,MAAA,GAC9B,EAAE,QAAQ,KAAA,CAAM,MAAA,CAAO,MAAA,EAAQ,GAAA,EAAK,MAAM,MAAA,CAAO,GAAA,EAAK,SAAS,KAAA,CAAM,MAAA,CAAO,SAAQ,GACpF,KAAA,CAAA;AAEJ,IAAA,MAAM,MAAA,GAAS,MAAMM,oBAAA,CAAY;AAAA,MAC/B,KAAK,OAAA,CAAQ,QAAA;AAAA,MACb,MAAM,KAAA,CAAM,IAAA;AAAA,MACZ,MAAM,KAAA,CAAM,IAAA;AAAA,MACZ,KAAK,KAAA,CAAM,GAAA;AAAA,MACX,SAAS,KAAA,CAAM,OAAA;AAAA,MACf,aAAa,KAAA,CAAM,WAAA;AAAA,MACnB,YAAY,KAAA,CAAM,UAAA;AAAA,MAClB,MAAA,EAAQ,WAAA;AAAA,MACR,UAAA,EAAY,QAAQ,SAAA,CAAU,UAAA;AAAA,MAC9B,GAAA,EAAK,QAAQ,SAAA,CAAU;AAAA,KACxB,CAAA;AAGD,IAAA,MAAM,EAAE,OAAA,EAAQ,GAAIJ,aAAAA,CAAgC,OAAO,GAAG,CAAA;AAC9D,IAAA,MAAM,aAAA,GAAgB;AAAA,MACpB,KAAK,OAAA,CAAQ,GAAA;AAAA,MACb,MAAM,OAAA,CAAQ,IAAA;AAAA,MACd,MAAM,OAAA,CAAQ,IAAA;AAAA,MACd,KAAK,OAAA,CAAQ,GAAA;AAAA,MACb,KAAK,OAAA,CAAQ,GAAA;AAAA,MACb,GAAI,QAAQ,GAAA,KAAQ,KAAA,CAAA,GAAY,EAAE,GAAA,EAAK,OAAA,CAAQ,GAAA,EAAc,GAAI,EAAC;AAAA,MAClE,GAAI,QAAQ,OAAA,KAAY,KAAA,CAAA,GAAY,EAAE,OAAA,EAAS,OAAA,CAAQ,OAAA,EAAoB,GAAI;AAAC,KAClF;AAGA,IAAA,MAAM,EAAA,GAAK,gBAAA;AAAA,MACT,CAAA,oBAAA,EAAuB,cAAc,GAAG,CAAA,OAAA,EAAU,cAAc,IAAI,CAAA,OAAA,EAAU,cAAc,IAAI,CAAA,CAAA;AAAA,MAChG;AAAA,KACF;AACA,IAAA,MAAM,QAAA,GAAW,cAAA,CAAe,EAAA,CAAG,IAAA,EAAM,WAAW,CAAA;AAEpD,IAAA,OAAO;AAAA,MACL,IAAA,EAAM,QAAA;AAAA,MACN,UAAA,EAAY;AAAA,QACV,EAAA,EAAI,IAAA;AAAA,QACJ,KAAK,MAAA,CAAO,GAAA;AAAA,QACZ;AAAA;AACF,KACF;AAAA,EACF,SAAS,GAAA,EAAK;AAEZ,IAAA,MAAM,aAAa,GAAA,YAAe,KAAA,GAAQ,GAAA,CAAI,OAAA,GAAU,OAAO,GAAG,CAAA;AAClE,IAAA,MAAM,WAAA,GAAc,cAAA,CAAe,UAAA,EAAY,WAAW,CAAA;AAE1D,IAAA,IAAI,eAAeK,mBAAA,EAAY;AAC7B,MAAA,OAAO;AAAA,QACL,IAAA,EAAM,iBAAiB,WAAW,CAAA,CAAA;AAAA,QAClC,UAAA,EAAY;AAAA,UACV,EAAA,EAAI,KAAA;AAAA,UACJ,IAAA,EAAM,oBAAA;AAAA,UACN,OAAA,EAAS;AAAA,SACX;AAAA,QACA,OAAA,EAAS;AAAA,OACX;AAAA,IACF;AAEA,IAAA,IAAI,eAAe,cAAA,EAAgB;AACjC,MAAA,OAAO;AAAA,QACL,IAAA,EAAM,iBAAiB,WAAW,CAAA,CAAA;AAAA,QAClC,UAAA,EAAY;AAAA,UACV,EAAA,EAAI,KAAA;AAAA,UACJ,MAAM,GAAA,CAAI,IAAA;AAAA,UACV,OAAA,EAAS;AAAA,SACX;AAAA,QACA,OAAA,EAAS;AAAA,OACX;AAAA,IACF;AAEA,IAAA,OAAO;AAAA,MACL,IAAA,EAAM,iBAAiB,WAAW,CAAA,CAAA;AAAA,MAClC,UAAA,EAAY;AAAA,QACV,EAAA,EAAI,KAAA;AAAA,QACJ,IAAA,EAAM,oBAAA;AAAA,QACN,OAAA,EAAS;AAAA,OACX;AAAA,MACA,OAAA,EAAS;AAAA,KACX;AAAA,EACF;AACF;ACpJA,IAAM,sBAAA,uBAA6B,GAAA,CAAI;AAAA,EACrC,KAAA;AAAA,EACA,KAAA;AAAA,EACA,KAAA;AAAA,EACA,KAAA;AAAA,EACA,MAAA;AAAA,EACA,MAAA;AAAA,EACA,MAAA;AAAA,EACA,MAAA;AAAA,EACA,MAAA;AAAA,EACA,MAAA;AAAA,EACA,MAAA;AAAA,EACA,MAAA;AAAA,EACA,MAAA;AAAA,EACA,MAAA;AAAA,EACA,MAAA;AAAA,EACA,MAAA;AAAA,EACA,MAAA;AAAA,EACA,MAAA;AAAA,EACA,MAAA;AAAA,EACA,MAAA;AAAA,EACA,MAAA;AAAA,EACA;AACF,CAAC,CAAA;AAUM,SAAS,mBAAmB,CAAA,EAAiB;AAClD,EAAA,IAAI,CAAC,CAAA,IAAK,CAAA,CAAE,IAAA,EAAK,CAAE,WAAW,CAAA,EAAG;AAC/B,IAAA,MAAM,IAAI,mBAAmB,wBAAwB,CAAA;AAAA,EACvD;AAGA,EAAA,IAAI,CAAA,CAAE,QAAA,CAAS,IAAI,CAAA,EAAG;AACpB,IAAA,MAAM,IAAI,mBAAmB,qCAAqC,CAAA;AAAA,EACpE;AAGA,EAAA,IAAI,CAAA,CAAE,QAAA,CAAS,GAAG,CAAA,EAAG;AACnB,IAAA,MAAM,IAAI,mBAAmB,2DAA2D,CAAA;AAAA,EAC1F;AAEA,EAAA,IAAaC,mBAAA,CAAA,UAAA,CAAW,CAAC,CAAA,EAAG;AAC1B,IAAA,MAAM,IAAI,mBAAmB,gCAAgC,CAAA;AAAA,EAC/D;AAGA,EAAA,MAAM,UAAA,GAAsBA,8BAAU,CAAC,CAAA;AACvC,EAAA,IAAI,UAAA,CAAW,UAAA,CAAW,IAAI,CAAA,IAAK,UAAA,CAAW,QAAA,CAAS,KAAK,CAAA,IAAK,UAAA,CAAW,QAAA,CAAS,MAAM,CAAA,EAAG;AAC5F,IAAA,MAAM,IAAI,mBAAmB,oCAAoC,CAAA;AAAA,EACnE;AAGA,EAAA,IAAI,EAAE,QAAA,CAAS,GAAG,KAAK,CAAA,CAAE,QAAA,CAAS,IAAI,CAAA,EAAG;AACvC,IAAA,MAAM,IAAI,mBAAmB,0DAA0D,CAAA;AAAA,EACzF;AAEA,EAAA,IAAI,CAAA,CAAE,SAAS,GAAA,EAAK;AAClB,IAAA,MAAM,IAAI,kBAAA,CAAmB,CAAA,yCAAA,EAA4C,CAAA,CAAE,MAAM,CAAA,CAAA,CAAG,CAAA;AAAA,EACtF;AAGA,EAAA,IAAI,CAAA,CAAE,UAAA,CAAW,GAAG,CAAA,EAAG;AACrB,IAAA,MAAM,IAAI,mBAAmB,gDAAgD,CAAA;AAAA,EAC/E;AAGA,EAAA,IAAI,EAAE,QAAA,CAAS,GAAG,KAAK,CAAA,CAAE,QAAA,CAAS,GAAG,CAAA,EAAG;AACtC,IAAA,MAAM,IAAI,mBAAmB,0CAA0C,CAAA;AAAA,EACzE;AAIA,EAAA,MAAM,QAAA,GAAW,CAAA,CAAE,OAAA,CAAQ,GAAG,CAAA;AAC9B,EAAA,MAAM,QAAA,GAAA,CAAY,YAAY,CAAA,GAAI,CAAA,CAAE,MAAM,CAAA,EAAG,QAAQ,CAAA,GAAI,CAAA,EAAG,WAAA,EAAY;AACxE,EAAA,IAAI,sBAAA,CAAuB,GAAA,CAAI,QAAQ,CAAA,EAAG;AACxC,IAAA,MAAM,IAAI,kBAAA,CAAmB,CAAA,8BAAA,EAAiC,QAAA,CAAS,WAAA,EAAa,CAAA,CAAE,CAAA;AAAA,EACxF;AACF;AA2BA,eAAe,iBAAiB,aAAA,EAAsC;AACpE,EAAA,IAAI;AACF,IAAA,MAAM,KAAA,GAAQ,MAAMC,cAAA,CAAM,aAAa,CAAA;AACvC,IAAA,IAAI,KAAA,CAAM,gBAAe,EAAG;AAC1B,MAAA,MAAM,IAAI,kBAAA,CAAmB,CAAA,oBAAA,EAAuB,aAAa,CAAA,CAAE,CAAA;AAAA,IACrE;AAAA,EACF,SAAS,GAAA,EAAK;AACZ,IAAA,IAAI,GAAA,YAAe,oBAAoB,MAAM,GAAA;AAE7C,IAAA,IAAK,GAAA,CAA8B,SAAS,QAAA,EAAU;AACtD,IAAA,MAAM,GAAA;AAAA,EACR;AACF;AAwBA,eAAsB,cAAA,CAAe,SAAiB,SAAA,EAAkC;AACtF,EAAA,IAAI;AACF,IAAA,MAAMC,eAAA,CAAO,SAAS,SAAS,CAAA;AAAA,EACjC,SAAS,GAAA,EAAK;AAEZ,IAAA,IAAI;AACF,MAAA,MAAMC,YAAG,OAAA,EAAS,EAAE,WAAW,IAAA,EAAM,KAAA,EAAO,MAAM,CAAA;AAAA,IACpD,CAAA,CAAA,MAAQ;AAAA,IAER;AACA,IAAA,MAAM,GAAA;AAAA,EACR;AACF;AAMA,eAAsB,cAAc,QAAA,EAAmC;AACrE,EAAA,MAAM,iBAAiB,QAAQ,CAAA;AAC/B,EAAA,MAAM,MAAA,GAAkBH,mBAAA,CAAA,IAAA,CAAK,QAAA,EAAU,CAAA,KAAA,EAAQpB,mBAAA,GAAa,KAAA,CAAM,CAAA,EAAG,CAAC,CAAC,CAAA,CAAA,CAAG,CAAA;AAC1E,EAAA,OAAOwB,iBAAQ,MAAM,CAAA;AACvB;;;ACzKA,cAAA,EAAA;AAOA,SAAS,oBAAoB,KAAA,EAAwB;AACnD,EAAA,OACE,IAAA,CAAK,SAAA;AAAA,IACH,KAAA;AAAA,IACA,CAAC,MAAM,GAAA,KAAQ;AACb,MAAA,IAAI,GAAA,KAAQ,QAAQ,OAAO,GAAA,KAAQ,YAAY,CAAC,KAAA,CAAM,OAAA,CAAQ,GAAG,CAAA,EAAG;AAClE,QAAA,MAAM,SAAkC,EAAC;AACzC,QAAA,KAAA,MAAW,KAAK,MAAA,CAAO,IAAA,CAAK,GAA8B,CAAA,CAAE,MAAK,EAAG;AAClE,UAAA,MAAA,CAAO,CAAC,CAAA,GAAK,GAAA,CAAgC,CAAC,CAAA;AAAA,QAChD;AACA,QAAA,OAAO,MAAA;AAAA,MACT;AACA,MAAA,OAAO,GAAA;AAAA,IACT,CAAA;AAAA,IACA;AAAA,GACF,GAAI,IAAA;AAER;AAKA,SAASC,iBAAAA,CAAiB,YAAwB,SAAA,EAAiC;AACjF,EAAA,MAAM,OAAA,GAAUb,uBAAgB,UAAU,CAAA;AAC1C,EAAA,MAAM,MAAA,GAASA,uBAAgB,SAAS,CAAA;AACxC,EAAA,MAAM,OAAA,GAAU,OAAA,CAAQ,OAAA,CAAQ,qBAAA,EAAuB,MAAM,CAAA;AAC7D,EAAA,MAAM,MAAA,GAAS,MAAA,CAAO,OAAA,CAAQ,qBAAA,EAAuB,MAAM,CAAA;AAC3D,EAAA,OAAO,CAAC,IAAI,MAAA,CAAO,OAAA,EAAS,GAAG,GAAG,IAAI,MAAA,CAAO,MAAA,EAAQ,GAAG,CAAC,CAAA;AAC3D;AAKA,SAAS,kBAAA,GAA6B;AACpC,EAAA,MAAM,EAAA,GAAA,qBAAS,IAAA,EAAK,EAAE,aAAY,CAAE,OAAA,CAAQ,SAAS,GAAG,CAAA;AACxD,EAAA,MAAM,IAAA,GAAOZ,mBAAAA,EAAW,CAAE,KAAA,CAAM,GAAG,CAAC,CAAA;AACpC,EAAA,OAAO,CAAA,OAAA,EAAU,EAAE,CAAA,CAAA,EAAI,IAAI,CAAA,CAAA;AAC7B;AAEA,eAAsB,mBACpB,MAAA,EACwB;AACxB,EAAA,MAAM,EAAE,KAAA,EAAO,MAAA,EAAQ,OAAA,EAAQ,GAAI,MAAA;AAGnC,EAAA,MAAM,cAAA,GAAiB,gBAAA,CAAiB,oBAAA,EAAsB,MAAM,CAAA;AACpE,EAAA,IAAI,gBAAgB,OAAO,cAAA;AAG3B,EAAA,IAAI,CAAC,QAAQ,SAAA,EAAW;AACtB,IAAA,OAAO;AAAA,MACL,IAAA,EAAM,iEAAA;AAAA,MACN,UAAA,EAAY;AAAA,QACV,EAAA,EAAI,KAAA;AAAA,QACJ,IAAA,EAAM,2BAAA;AAAA,QACN,OAAA,EAAS;AAAA,OACX;AAAA,MACA,OAAA,EAAS;AAAA,KACX;AAAA,EACF;AAGA,EAAA,IAAI,CAAC,OAAA,CAAQ,SAAA,IAAa,CAAC,QAAQ,QAAA,EAAU;AAC3C,IAAA,OAAO;AAAA,MACL,IAAA,EAAM,sEAAA;AAAA,MACN,UAAA,EAAY;AAAA,QACV,EAAA,EAAI,KAAA;AAAA,QACJ,IAAA,EAAM,oBAAA;AAAA,QACN,OAAA,EAAS;AAAA,OACX;AAAA,MACA,OAAA,EAAS;AAAA,KACX;AAAA,EACF;AAGA,EAAA,IAAI,KAAA,CAAM,QAAA,CAAS,MAAA,GAAS,MAAA,CAAO,OAAO,mBAAA,EAAqB;AAC7D,IAAA,OAAO;AAAA,MACL,IAAA,EAAM,mBAAmB,KAAA,CAAM,QAAA,CAAS,MAAM,CAAA,2BAAA,EAA8B,MAAA,CAAO,OAAO,mBAAmB,CAAA,CAAA;AAAA,MAC7G,UAAA,EAAY;AAAA,QACV,EAAA,EAAI,KAAA;AAAA,QACJ,IAAA,EAAM,uBAAA;AAAA,QACN,OAAA,EAAS,GAAG,KAAA,CAAM,QAAA,CAAS,MAAM,CAAA,2BAAA,EAA8B,MAAA,CAAO,OAAO,mBAAmB,CAAA;AAAA,OAClG;AAAA,MACA,OAAA,EAAS;AAAA,KACX;AAAA,EACF;AAGA,EAAA,IAAI,iBAAA,GAAoB,CAAA;AACxB,EAAA,KAAA,MAAW,CAAA,IAAK,MAAM,QAAA,EAAU;AAC9B,IAAA,iBAAA,IAAqB,IAAI,WAAA,EAAY,CAAE,MAAA,CAAO,CAAC,CAAA,CAAE,MAAA;AAAA,EACnD;AACA,EAAA,IAAI,iBAAA,GAAoB,MAAA,CAAO,MAAA,CAAO,gBAAA,EAAkB;AACtD,IAAA,OAAO;AAAA,MACL,MAAM,CAAA,oCAAA,EAAuC,iBAAiB,CAAA,kBAAA,EAAqB,MAAA,CAAO,OAAO,gBAAgB,CAAA,CAAA;AAAA,MACjH,UAAA,EAAY;AAAA,QACV,EAAA,EAAI,KAAA;AAAA,QACJ,IAAA,EAAM,uBAAA;AAAA,QACN,SAAS,CAAA,oBAAA,EAAuB,iBAAiB,CAAA,kBAAA,EAAqB,MAAA,CAAO,OAAO,gBAAgB,CAAA;AAAA,OACtG;AAAA,MACA,OAAA,EAAS;AAAA,KACX;AAAA,EACF;AAGA,EAAA,MAAM,UAAA,GAAa,KAAA,CAAM,WAAA,IAAe,kBAAA,EAAmB;AAC3D,EAAA,IAAI;AACF,IAAA,kBAAA,CAAmB,UAAU,CAAA;AAAA,EAC/B,SAAS,GAAA,EAAK;AACZ,IAAA,OAAO;AAAA,MACL,IAAA,EAAM,2BAA2B,GAAA,YAAe,KAAA,GAAQ,IAAI,OAAA,GAAU,MAAA,CAAO,GAAG,CAAC,CAAA,CAAA;AAAA,MACjF,UAAA,EAAY;AAAA,QACV,EAAA,EAAI,KAAA;AAAA,QACJ,IAAA,EAAM,sBAAA;AAAA,QACN,SAAS,GAAA,YAAe,KAAA,GAAQ,GAAA,CAAI,OAAA,GAAU,OAAO,GAAG;AAAA,OAC1D;AAAA,MACA,OAAA,EAAS;AAAA,KACX;AAAA,EACF;AAGA,EAAA,MAAM,cAAcyB,iBAAAA,CAAiB,OAAA,CAAQ,UAAU,UAAA,EAAY,OAAA,CAAQ,UAAU,SAAS,CAAA;AAE9F,EAAA,IAAI,OAAA;AACJ,EAAA,IAAI;AAEF,IAAA,OAAA,GAAU,MAAM,aAAA,CAAc,OAAA,CAAQ,SAAS,CAAA;AAG/C,IAAA,MAAM,WAAA,GAAcC,aAAAA,CAAK,OAAA,EAAS,UAAU,CAAA;AAC5C,IAAA,MAAMC,cAAAA,CAAM,WAAA,EAAa,EAAE,IAAA,EAAM,KAAO,CAAA;AASxC,IAAA,MAAM,UAA0B,EAAC;AACjC,IAAA,IAAI,UAAA,GAAa,CAAA;AAIjB,IAAA,MAAM,UAAA,uBAAiB,GAAA,EAAY;AACnC,IAAA,MAAM,gBAA0B,EAAC;AAEjC,IAAA,KAAA,IAAS,IAAI,CAAA,EAAG,CAAA,GAAI,KAAA,CAAM,QAAA,CAAS,QAAQ,CAAA,EAAA,EAAK;AAE9C,MAAA,IAAI,MAAA,CAAO,QAAQ,OAAA,EAAS;AAC1B,QAAA,MAAM,IAAI,cAAA,CAAe,iBAAA,EAAmB,0CAA0C,CAAA;AAAA,MACxF;AAEA,MAAA,MAAM,GAAA,GAAM,KAAA,CAAM,QAAA,CAAS,CAAC,CAAA;AAC5B,MAAA,MAAM,IAAA,GAAO,IAAI,WAAA,EAAY,CAAE,OAAO,GAAG,CAAA;AACzC,MAAA,MAAM,IAAA,GAAO,MAAMrB,gBAAAA,CAAU,IAAI,CAAA;AAEjC,MAAA,IAAI,UAAA,CAAW,GAAA,CAAI,IAAI,CAAA,EAAG;AAC1B,MAAA,UAAA,CAAW,IAAI,IAAI,CAAA;AACnB,MAAA,aAAA,CAAc,KAAK,IAAI,CAAA;AAIvB,MAAA,MAAM,QAAA,GAAW,GAAG,IAAI,CAAA,IAAA,CAAA;AACxB,MAAA,MAAM,QAAA,GAAWoB,aAAAA,CAAK,WAAA,EAAa,QAAQ,CAAA;AAC3C,MAAA,MAAME,mBAAU,QAAA,EAAU,IAAA,EAAM,EAAE,IAAA,EAAM,KAAO,CAAA;AAC/C,MAAA,OAAA,CAAQ,IAAA,CAAK;AAAA,QACX,KAAA,EAAO,CAAA;AAAA,QACP,IAAA,EAAM,YAAY,QAAQ,CAAA,CAAA;AAAA,QAC1B,MAAA,EAAQ,IAAA;AAAA,QACR,QAAQ,IAAA,CAAK;AAAA,OACd,CAAA;AACD,MAAA,UAAA,IAAc,IAAA,CAAK,MAAA;AAAA,IACrB;AAMA,IAAA,OAAA,CAAQ,IAAA,CAAK,CAAC,CAAA,EAAG,CAAA,KAAM,EAAE,MAAA,CAAO,aAAA,CAAc,CAAA,CAAE,MAAM,CAAC,CAAA;AAIvD,IAAA,MAAM,YAAA,GAAe,CAAC,GAAG,aAAa,EAAE,IAAA,EAAK;AAC7C,IAAA,MAAM,aAAA,GAAgB,GAAG,OAAA,CAAQ,UAAU,IAAI,YAAA,CAAa,IAAA,CAAK,GAAG,CAAC,CAAA,CAAA;AACrE,IAAA,MAAM,QAAA,GAAW,MAAMtB,gBAAAA,CAAU,IAAI,aAAY,CAAE,MAAA,CAAO,aAAa,CAAC,CAAA;AAExE,IAAA,MAAM,QAAA,GAAW;AAAA,MACf,SAAA,EAAW,QAAA;AAAA,MACX,YAAA,EAAc,cAAA;AAAA,MACd,UAAA,EAAA,iBAAY,IAAI,IAAA,EAAK,EAAE,WAAA,EAAY;AAAA,MACnC,aAAa,OAAA,CAAQ,UAAA;AAAA,MACrB,eAAe,OAAA,CAAQ,MAAA;AAAA,MACvB,QAAA,EAAU,OAAA;AAAA,MACV,GAAI,MAAM,QAAA,GAAW,EAAE,UAAU,KAAA,CAAM,QAAA,KAAa;AAAC,KACvD;AAGA,IAAA,MAAM,YAAA,GAAe,oBAAoB,QAAQ,CAAA;AACjD,IAAA,MAAMsB,kBAAA,CAAUF,cAAK,OAAA,EAAS,eAAe,GAAG,YAAA,EAAc,EAAE,IAAA,EAAM,GAAA,EAAO,CAAA;AAC7E,IAAA,UAAA,IAAc,IAAI,WAAA,EAAY,CAAE,MAAA,CAAO,YAAY,CAAA,CAAE,MAAA;AAGrD,IAAA,MAAM,aAAA,GAAgB,IAAI,WAAA,EAAY,CAAE,OAAO,YAAY,CAAA;AAC3D,IAAA,MAAM,cAAA,GAAiB,MAAMpB,gBAAAA,CAAU,aAAa,CAAA;AAMpD,IAAA,MAAM,iBAAA,GAAoB,IAAA,CAAK,KAAA,CAAM,YAAY,CAAA;AACjD,IAAA,MAAM,cAAc,MAAMuB,WAAA;AAAA,MACxB,iBAAA;AAAA,MACA,QAAQ,SAAA,CAAU,UAAA;AAAA,MAClB,QAAQ,SAAA,CAAU;AAAA,KACpB;AACA,IAAA,MAAMD,kBAAA,CAAUF,cAAK,OAAA,EAAS,cAAc,GAAG,WAAA,EAAa,EAAE,IAAA,EAAM,GAAA,EAAO,CAAA;AAC3E,IAAA,UAAA,IAAc,IAAI,WAAA,EAAY,CAAE,MAAA,CAAO,WAAW,CAAA,CAAE,MAAA;AAGpD,IAAA,MAAM,SAAA,GAAY,QAAQ,MAAA,GAAS,CAAA;AAGnC,IAAA,MAAM,SAAA,GAAYA,aAAAA,CAAK,OAAA,CAAQ,SAAA,EAAW,UAAU,CAAA;AAGpD,IAAA,IAAI;AACF,MAAA,MAAMlB,cAAK,SAAS,CAAA;AAEpB,MAAA,OAAO;AAAA,QACL,IAAA,EAAM,uDAAuD,UAAU,CAAA,CAAA;AAAA,QACvE,UAAA,EAAY;AAAA,UACV,EAAA,EAAI,KAAA;AAAA,UACJ,IAAA,EAAM,qBAAA;AAAA,UACN,OAAA,EAAS,+BAA+B,UAAU,CAAA;AAAA,SACpD;AAAA,QACA,OAAA,EAAS;AAAA,OACX;AAAA,IACF,SAAS,GAAA,EAAK;AAEZ,MAAA,IAAK,GAAA,CAA8B,SAAS,QAAA,EAAU;AACpD,QAAA,MAAM,GAAA;AAAA,MACR;AAAA,IACF;AAEA,IAAA,MAAM,cAAA,CAAe,SAAS,SAAS,CAAA;AACvC,IAAA,OAAA,GAAU,KAAA,CAAA;AAEV,IAAA,MAAM,EAAA,GAAK,gBAAA;AAAA,MACT,CAAA,gBAAA,EAAmB,UAAU,CAAA,EAAA,EAAK,SAAS,WAAW,UAAU,CAAA,OAAA,CAAA;AAAA,MAChE;AAAA,KACF;AACA,IAAA,MAAM,QAAA,GAAW,cAAA,CAAe,EAAA,CAAG,IAAA,EAAM,WAAW,CAAA;AAMpD,IAAA,OAAO;AAAA,MACL,IAAA,EAAM,QAAA;AAAA,MACN,UAAA,EAAY;AAAA,QACV,EAAA,EAAI,IAAA;AAAA,QACJ,QAAA;AAAA,QACA,UAAA,EAAY,UAAA;AAAA,QACZ,cAAc,OAAA,CAAQ,MAAA;AAAA,QACtB,SAAA;AAAA,QACA,UAAA;AAAA,QACA,WAAW,QAAA,CAAS,UAAA;AAAA,QACpB;AAAA;AACF,KACF;AAAA,EACF,SAAS,GAAA,EAAK;AAEZ,IAAA,IAAI,OAAA,EAAS;AACX,MAAA,IAAI;AACF,QAAA,MAAMe,YAAG,OAAA,EAAS,EAAE,WAAW,IAAA,EAAM,KAAA,EAAO,MAAM,CAAA;AAAA,MACpD,CAAA,CAAA,MAAQ;AAAA,MAER;AAAA,IACF;AAEA,IAAA,MAAM,aAAa,GAAA,YAAe,KAAA,GAAQ,GAAA,CAAI,OAAA,GAAU,OAAO,GAAG,CAAA;AAClE,IAAA,MAAM,WAAA,GAAc,cAAA,CAAe,UAAA,EAAY,WAAW,CAAA;AAE1D,IAAA,IAAI,eAAe,cAAA,EAAgB;AACjC,MAAA,OAAO;AAAA,QACL,IAAA,EAAM,2BAA2B,WAAW,CAAA,CAAA;AAAA,QAC5C,UAAA,EAAY;AAAA,UACV,EAAA,EAAI,KAAA;AAAA,UACJ,MAAM,GAAA,CAAI,IAAA;AAAA,UACV,OAAA,EAAS;AAAA,SACX;AAAA,QACA,OAAA,EAAS;AAAA,OACX;AAAA,IACF;AAEA,IAAA,OAAO;AAAA,MACL,IAAA,EAAM,2BAA2B,WAAW,CAAA,CAAA;AAAA,MAC5C,UAAA,EAAY;AAAA,QACV,EAAA,EAAI,KAAA;AAAA,QACJ,IAAA,EAAM,qBAAA;AAAA,QACN,OAAA,EAAS;AAAA,OACX;AAAA,MACA,OAAA,EAAS;AAAA,KACX;AAAA,EACF;AACF;ACnUO,IAAM,iBAAA,GAAoBlB,MAAE,MAAA,CAAO;AAAA,EACxC,GAAA,EAAKA,KAAAA,CAAE,MAAA,EAAO,CAAE,SAAS,sDAAsD,CAAA;AAAA,EAC/E,sBAAsBA,KAAAA,CACnB,MAAA,GACA,QAAA,EAAS,CACT,SAAS,qDAAqD,CAAA;AAAA,EACjE,MAAMA,KAAAA,CAAE,MAAA,GAAS,QAAA,EAAS,CAAE,SAAS,+CAA+C,CAAA;AAAA,EACpF,QAAQA,KAAAA,CAAE,MAAA,GAAS,QAAA,EAAS,CAAE,SAAS,uCAAuC,CAAA;AAAA,EAC9E,UAAUA,KAAAA,CAAE,MAAA,GAAS,QAAA,EAAS,CAAE,SAAS,yCAAyC;AACpF,CAAC,CAAA;AAID,IAAM,UAAA,GAAaA,MAAE,MAAA,CAAO;AAAA,EAC1B,aAAA,EAAeA,MAAE,MAAA,EAAO;AAAA,EACxB,UAAA,EAAYA,MAAE,MAAA,EAAO;AAAA,EACrB,eAAA,EAAiBA,MAAE,MAAA;AACrB,CAAC,CAAA;AAED,IAAM,WAAA,GAAcA,MAAE,MAAA,CAAO;AAAA,EAC3B,IAAA,EAAMA,MAAE,MAAA,EAAO;AAAA,EACf,MAAA,EAAQA,MAAE,OAAA,EAAQ;AAAA,EAClB,OAAA,EAASA,KAAAA,CAAE,MAAA,EAAO,CAAE,QAAA;AACtB,CAAC,CAAA;AAEM,IAAM,kBAAA,GAAqBA,MAAE,MAAA,CAAO;AAAA,EACzC,KAAA,EAAO,UAAA;AAAA,EACP,EAAA,EAAIA,MAAE,OAAA,EAAQ;AAAA,EACd,IAAA,EAAMA,KAAAA,CAAE,MAAA,EAAO,CAAE,QAAA,EAAS;AAAA,EAC1B,OAAA,EAASA,KAAAA,CAAE,MAAA,EAAO,CAAE,QAAA,EAAS;AAAA,EAC7B,OAAA,EAASA,KAAAA,CAAE,MAAA,EAAO,CAAE,QAAA,EAAS;AAAA,EAC7B,MAAA,EAAQA,KAAAA,CAAE,KAAA,CAAM,WAAW,CAAA;AAAA,EAC3B,aAAA,EAAeA,KAAAA,CAAE,MAAA,CAAOA,KAAAA,CAAE,MAAA,IAAUA,KAAAA,CAAE,OAAA,EAAS,CAAA,CAAE,QAAA,EAAS;AAAA,EAC1D,SAAA,EAAWA,KAAAA,CAAE,MAAA,EAAO,CAAE,QAAA;AACxB,CAAC,CAAA;AClCM,IAAM,kBAAA,GAAqBA,MAAE,MAAA,CAAO;AAAA,EACzC,GAAA,EAAKA,KAAAA,CAAE,MAAA,EAAO,CAAE,SAAS,sCAAsC,CAAA;AAAA,EAC/D,WAAA,EAAaA,KAAAA,CACV,OAAA,EAAQ,CACR,QAAA,GACA,OAAA,CAAQ,KAAK,CAAA,CACb,QAAA,CAAS,yDAAyD;AACvE,CAAC,CAAA;AAID,IAAMyB,WAAAA,GAAazB,MAAE,MAAA,CAAO;AAAA,EAC1B,aAAA,EAAeA,MAAE,MAAA,EAAO;AAAA,EACxB,UAAA,EAAYA,MAAE,MAAA,EAAO;AAAA,EACrB,eAAA,EAAiBA,MAAE,MAAA;AACrB,CAAC,CAAA;AAEM,IAAM,mBAAA,GAAsBA,MAAE,MAAA,CAAO;AAAA,EAC1C,KAAA,EAAOyB,WAAAA;AAAA,EACP,MAAA,EAAQzB,MAAE,MAAA,CAAOA,KAAAA,CAAE,QAAO,EAAGA,KAAAA,CAAE,SAAS,CAAA;AAAA,EACxC,WAAA,EAAaA,MAAE,MAAA,CAAO;AAAA,IACpB,OAAA,EAASA,MAAE,MAAA,EAAO;AAAA,IAClB,MAAA,EAAQA,KAAAA,CAAE,MAAA,EAAO,CAAE,QAAA,EAAS;AAAA,IAC5B,QAAA,EAAUA,KAAAA,CAAE,MAAA,EAAO,CAAE,QAAA,EAAS;AAAA,IAC9B,QAAA,EAAUA,KAAAA,CAAE,MAAA,EAAO,CAAE,QAAA,EAAS;AAAA,IAC9B,SAAA,EAAWA,KAAAA,CAAE,MAAA,EAAO,CAAE,QAAA,EAAS;AAAA,IAC/B,SAAA,EAAWA,KAAAA,CAAE,MAAA,EAAO,CAAE,QAAA;AAAS,GAChC,CAAA;AAAA,EACD,WAAA,EAAaA,KAAAA,CAAE,MAAA,CAAOA,KAAAA,CAAE,MAAA,IAAUA,KAAAA,CAAE,OAAA,EAAS,CAAA,CAAE,QAAA,EAAS;AAAA,EACxD,QAAA,EAAUA,MAAE,OAAA,EAAQ;AAAA,EACpB,QAAA,EAAUA,KAAAA,CAAE,OAAA,CAAQ,KAAK;AAC3B,CAAC,CAAA;AC/BM,IAAM,iBAAA,GAAoBA,MAAE,MAAA,CAAO;AAAA,EACxC,GAAA,EAAKA,KAAAA,CAAE,MAAA,EAAO,CAAE,SAAS,qCAAqC;AAChE,CAAC,CAAA;AAID,IAAMyB,WAAAA,GAAazB,MAAE,MAAA,CAAO;AAAA,EAC1B,aAAA,EAAeA,MAAE,MAAA,EAAO;AAAA,EACxB,UAAA,EAAYA,MAAE,MAAA,EAAO;AAAA,EACrB,eAAA,EAAiBA,MAAE,MAAA;AACrB,CAAC,CAAA;AAEM,IAAM,kBAAA,GAAqBA,MAAE,MAAA,CAAO;AAAA,EACzC,KAAA,EAAOyB,WAAAA;AAAA,EACP,MAAA,EAAQzB,MAAE,MAAA,CAAOA,KAAAA,CAAE,QAAO,EAAGA,KAAAA,CAAE,SAAS,CAAA;AAAA,EACxC,OAAA,EAASA,MAAE,MAAA,CAAOA,KAAAA,CAAE,QAAO,EAAGA,KAAAA,CAAE,SAAS,CAAA;AAAA,EACzC,QAAA,EAAUA,KAAAA,CAAE,OAAA,CAAQ,KAAK;AAC3B,CAAC,CAAA;ACbM,IAAM,gBAAA,GAAmBA,MAAE,MAAA,CAAO;AAAA,EACvC,IAAA,EAAMA,MACH,IAAA,CAAK,CAAC,YAAY,WAAW,CAAC,CAAA,CAC9B,QAAA,CAAS,gFAAgF,CAAA;AAAA,EAC5F,IAAA,EAAMA,MACH,MAAA,EAAO,CACP,IAAI,CAAC,CAAA,CACL,GAAA,CAAI,GAAG,CAAA,CACP,MAAA;AAAA,IACC,CAAC,MACC,cAAA,CAAe,IAAA,CAAK,CAAC,CAAA,IACrB,2DAAA,CAA4D,KAAK,CAAC,CAAA;AAAA,IACpE;AAAA,MACE,OAAA,EACE;AAAA;AACJ,GACF,CACC,SAAS,mFAAmF,CAAA;AAAA,EAC/F,GAAA,EAAKA,KAAAA,CACF,MAAA,EAAO,CACP,GAAA,CAAI,IAAI,CAAA,CACR,QAAA,EAAS,CACT,QAAA,CAAS,qDAAqD,CAAA;AAAA,EACjE,SAASA,KAAAA,CACN,KAAA;AAAA,IACCA,MAAE,IAAA,CAAK;AAAA,MACL,QAAA;AAAA,MACA,aAAA;AAAA,MACA,UAAA;AAAA,MACA,YAAA;AAAA,MACA,SAAA;AAAA,MACA,UAAA;AAAA,MACA,SAAA;AAAA,MACA,YAAA;AAAA,MACA,SAAA;AAAA,MACA;AAAA,KACD;AAAA,GACH,CACC,UAAS,CACT,MAAA;AAAA,IACC,CAAC,GAAA,KACC,CAAC,GAAA,IAAQ,IAAI,IAAI,GAAG,CAAA,CAAE,IAAA,KAAS,GAAA,CAAI,MAAA,IAAU,CAAC,GAAG,GAAG,CAAA,CAAE,IAAA,EAAK,CAAE,KAAA,CAAM,CAAC,GAAG,CAAA,KAAM,CAAA,KAAM,GAAA,CAAI,CAAC,CAAC,CAAA;AAAA,IAC3F,EAAE,SAAS,6CAAA;AAA8C,GAC3D,CACC,SAAS,mEAAmE,CAAA;AAAA,EAC/E,aAAaA,KAAAA,CACV,MAAA,EAAO,CACP,QAAA,GACA,MAAA,CAAO,CAAC,CAAA,KAAM,CAAC,KAAK,CAAC,KAAA,CAAM,KAAK,KAAA,CAAM,CAAC,CAAC,CAAA,EAAG;AAAA,IAC1C,OAAA,EAAS;AAAA,GACV,CAAA,CACA,QAAA,CAAS,mEAAmE,CAAA;AAAA,EAC/E,UAAA,EAAYA,KAAAA,CACT,MAAA,CAAOA,KAAAA,CAAE,MAAA,EAAO,EAAGA,KAAAA,CAAE,OAAA,EAAS,CAAA,CAC9B,QAAA,EAAS,CACT,SAAS,kDAAkD,CAAA;AAAA,EAC9D,MAAA,EAAQA,MACL,MAAA,CAAO;AAAA,IACN,GAAA,EAAKA,MACF,MAAA,EAAO,CACP,KAAI,CACJ,GAAA,CAAI,IAAI,CAAA,CACR,MAAA,CAAO,CAAC,MAAM,CAAA,CAAE,UAAA,CAAW,UAAU,CAAA,EAAG,EAAE,SAAS,2BAAA,EAA6B,CAAA,CAChF,QAAA,CAAS,kCAAkC,CAAA;AAAA,IAC9C,OAAA,EAASA,KAAAA,CAAE,MAAA,EAAO,CAAE,GAAA,CAAI,GAAG,CAAA,CAAE,QAAA,EAAS,CAAE,QAAA,CAAS,gBAAgB,CAAA;AAAA,IACjE,MAAA,EAAQA,KAAAA,CACL,MAAA,EAAO,CACP,KAAA,CAAM,uBAAuB,CAAA,CAC7B,QAAA,EAAS,CACT,QAAA,CAAS,yCAAyC;AAAA,GACtD,CAAA,CACA,QAAA,EAAS,CACT,SAAS,sBAAsB,CAAA;AAAA,EAClC,WAAA,EAAaA,KAAAA,CACV,MAAA,EAAO,CACP,GAAA,EAAI,CACJ,QAAA,EAAS,CACT,QAAA,EAAS,CACT,QAAA,CAAS,2DAA2D;AACzE,CAAC,CAAA;AAID,IAAMyB,WAAAA,GAAazB,MAAE,MAAA,CAAO;AAAA,EAC1B,aAAA,EAAeA,MAAE,MAAA,EAAO;AAAA,EACxB,UAAA,EAAYA,MAAE,MAAA,EAAO;AAAA,EACrB,eAAA,EAAiBA,MAAE,MAAA;AACrB,CAAC,CAAA;AAED,IAAM,mBAAA,GAAsBA,MAAE,MAAA,CAAO;AAAA,EACnC,GAAA,EAAKA,MAAE,MAAA,EAAO;AAAA,EACd,IAAA,EAAMA,MAAE,MAAA,EAAO;AAAA,EACf,IAAA,EAAMA,MAAE,MAAA,EAAO;AAAA,EACf,GAAA,EAAKA,MAAE,MAAA,EAAO;AAAA,EACd,GAAA,EAAKA,MAAE,MAAA,EAAO;AAAA,EACd,GAAA,EAAKA,KAAAA,CAAE,MAAA,EAAO,CAAE,QAAA,EAAS;AAAA,EACzB,SAASA,KAAAA,CAAE,KAAA,CAAMA,MAAE,MAAA,EAAQ,EAAE,QAAA;AAC/B,CAAC,CAAA;AAEM,IAAM,iBAAA,GAAoBA,MAAE,MAAA,CAAO;AAAA,EACxC,KAAA,EAAOyB,WAAAA;AAAA,EACP,EAAA,EAAIzB,MAAE,OAAA,EAAQ;AAAA,EACd,GAAA,EAAKA,MAAE,MAAA,EAAO;AAAA,EACd,aAAA,EAAe;AACjB,CAAC,CAAA;AC5GM,IAAM,iBAAA,GAAoBA,MAAE,MAAA,CAAO;AAAA,EACxC,UAAUA,KAAAA,CACP,KAAA,CAAMA,KAAAA,CAAE,MAAA,GAAS,GAAA,CAAI,KAAM,CAAC,CAAA,CAC5B,IAAI,CAAC,CAAA,CACL,IAAI,GAAG,CAAA,CACP,SAAS,uCAAuC,CAAA;AAAA,EACnD,QAAA,EAAUA,KAAAA,CACP,MAAA,CAAOA,KAAAA,CAAE,MAAA,EAAO,EAAGA,KAAAA,CAAE,OAAA,EAAS,CAAA,CAC9B,QAAA,EAAS,CACT,SAAS,8CAA8C,CAAA;AAAA,EAC1D,WAAA,EAAaA,KAAAA,CACV,MAAA,EAAO,CACP,GAAA,CAAI,GAAG,CAAA,CACP,QAAA,EAAS,CACT,QAAA,CAAS,4DAA4D;AAC1E,CAAC,CAAA;AAID,IAAMyB,WAAAA,GAAazB,MAAE,MAAA,CAAO;AAAA,EAC1B,aAAA,EAAeA,MAAE,MAAA,EAAO;AAAA,EACxB,UAAA,EAAYA,MAAE,MAAA,EAAO;AAAA,EACrB,eAAA,EAAiBA,MAAE,MAAA;AACrB,CAAC,CAAA;AAEM,IAAM,kBAAA,GAAqBA,MAAE,MAAA,CAAO;AAAA,EACzC,KAAA,EAAOyB,WAAAA;AAAA,EACP,EAAA,EAAIzB,MAAE,OAAA,EAAQ;AAAA,EACd,QAAA,EAAUA,MAAE,MAAA,EAAO;AAAA,EACnB,UAAA,EAAYA,MAAE,MAAA,EAAO;AAAA,EACrB,YAAA,EAAcA,MAAE,MAAA,EAAO;AAAA,EACvB,SAAA,EAAWA,MAAE,MAAA,EAAO;AAAA,EACpB,UAAA,EAAYA,MAAE,MAAA,EAAO;AAAA,EACrB,SAAA,EAAWA,MAAE,MAAA,EAAO;AAAA,EACpB,cAAA,EAAgBA,MAAE,MAAA;AACpB,CAAC,CAAA;;;AZHD,SAAS,QAAA,CAAS,KAAoB,UAAA,EAA6C;AACjF,EAAA,OAAO;AAAA,IACL,UAAA;AAAA,IACA,eAAe,GAAA,CAAI,OAAA;AAAA,IACnB,YAAY,GAAA,CAAI,UAAA;AAAA,IAChB,iBAAiB,GAAA,CAAI,eAAA;AAAA,IACrB,iBAAA,EAAmB;AAAA,GACrB;AACF;AAEA,SAAS,6BAAA,CACP,QACA,IAAA,EACgB;AAChB,EAAA,OAAO;AAAA,IACL,OAAA,EAAS,CAAC,EAAE,IAAA,EAAM,QAAiB,IAAA,EAAM,MAAA,CAAO,MAAM,CAAA;AAAA,IACtD,mBAAmB,EAAE,KAAA,EAAO,IAAA,EAAM,GAAG,OAAO,UAAA,EAAW;AAAA,IACvD,SAAS,MAAA,CAAO;AAAA,GAClB;AACF;AAEA,IAAM,qBAAA,GAAyC;AAAA,EAC7C,YAAA,EAAc,IAAA;AAAA,EACd,eAAA,EAAiB,KAAA;AAAA,EACjB,cAAA,EAAgB,IAAA;AAAA,EAChB,aAAA,EAAe;AACjB,CAAA;AAMA,IAAM,sBAAA,GAA0C;AAAA,EAC9C,YAAA,EAAc,IAAA;AAAA,EACd,eAAA,EAAiB,KAAA;AAAA,EACjB,cAAA,EAAgB,KAAA;AAAA,EAChB,aAAA,EAAe;AACjB,CAAA;AAEA,IAAM,uBAAA,GAA2C;AAAA,EAC/C,YAAA,EAAc,KAAA;AAAA,EACd,eAAA,EAAiB,IAAA;AAAA,EACjB,cAAA,EAAgB,KAAA;AAAA,EAChB,aAAA,EAAe;AACjB,CAAA;AAEA,IAAM,eAAA,GAAkB,EAAA;AAExB,SAAS,mBAAA,CACP,IAAA,EACA,IAAA,EACA,OAAA,EACgB;AAChB,EAAA,MAAM,QAAA,GAAW0B,cAAO,IAAI,CAAA;AAC5B,EAAA,OAAO;AAAA,IACL,SAAS,CAAC,EAAE,MAAM,MAAA,EAAiB,IAAA,EAAM,SAAS,CAAA;AAAA,IAClD,iBAAA,EAAmB;AAAA,MACjB,KAAA,EAAO,IAAA;AAAA,MACP,EAAA,EAAI,KAAA;AAAA,MACJ,IAAA;AAAA,MACA,OAAA;AAAA,MACA,SAAA,EAAW,UAAU,SAAA,IAAa,KAAA;AAAA,MAClC,WAAA,EAAa,UAAU,WAAA,IAAe;AAAA,KACxC;AAAA,IACA,OAAA,EAAS;AAAA,GACX;AACF;AA2BO,SAAS,oBAAoB,OAAA,EAAmC;AACrE,EAAA,MAAM,EAAE,OAAA,EAAS,MAAA,EAAQ,OAAA,EAAQ,GAAI,OAAA;AAGrC,EAAA,MAAM,eAAA,GAAkB,CAAC,aAAA,EAAe,cAAA,EAAgB,aAAa,CAAA;AACrE,EAAA,IAAI,OAAA,CAAQ,SAAA,IAAa,OAAA,CAAQ,QAAA,EAAU;AACzC,IAAA,eAAA,CAAgB,KAAK,YAAY,CAAA;AACjC,IAAA,IAAI,QAAQ,SAAA,EAAW;AACrB,MAAA,eAAA,CAAgB,KAAK,oBAAoB,CAAA;AAAA,IAC3C;AAAA,EACF;AAEA,EAAA,MAAM,OAAO,EAAE,GAAG,SAAS,OAAA,EAAS,WAAW,GAAG,eAAA,EAAgB;AAClE,EAAA,MAAM,cAAA,GAAiB,OAAO,MAAA,CAAO,eAAA;AACrC,EAAA,IAAI,cAAA,GAAiB,CAAA;AAErB,EAAA,eAAe,WAAA,CACb,QAAA,EACA,IAAA,EACA,SAAA,EACA,MAAA,EACyB;AAEzB,IAAA,IAAI,QAAQ,OAAA,EAAS;AACnB,MAAA,OAAO,mBAAA,CAAoB,IAAA,EAAM,iBAAA,EAAmB,mBAAmB,CAAA;AAAA,IACzE;AAGA,IAAA,IAAI,kBAAkB,cAAA,EAAgB;AACpC,MAAA,OAAO,mBAAA;AAAA,QACL,IAAA;AAAA,QACA,yBAAA;AAAA,QACA,uBAAuB,cAAc,CAAA,qBAAA;AAAA,OACvC;AAAA,IACF;AAGA,IAAA,IAAI,CAAC,gBAAA,CAAiB,IAAA,EAAM,eAAe,CAAA,EAAG;AAC5C,MAAA,OAAO,mBAAA;AAAA,QACL,IAAA;AAAA,QACA,sBAAA;AAAA,QACA,0CAA0C,eAAe,CAAA;AAAA,OAC3D;AAAA,IACF;AAGA,IAAA,MAAM,eAAA,GAAkB,eAAA,CAAgB,IAAA,EAAM,MAAM,CAAA;AACpD,IAAA,IAAI,eAAA,EAAiB;AACnB,MAAA,OAAO,6BAAA,CAA8B,iBAAiB,IAAI,CAAA;AAAA,IAC5D;AAcA,IAAA,cAAA,EAAA;AACA,IAAA,MAAM,cAAA,GAAiB,UAAU,MAAM,CAAA;AAIvC,IAAA,KAAK,cAAA,CACF,QAAQ,MAAM;AACb,MAAA,cAAA,EAAA;AAAA,IACF,CAAC,CAAA,CACA,KAAA,CAAM,MAAM;AAAA,IAAC,CAAC,CAAA;AAKjB,IAAA,IAAI,QAAA,GAAW,KAAA;AACf,IAAA,IAAI,SAAA,GAAY,KAAA;AAChB,IAAA,IAAI,KAAA;AACJ,IAAA,MAAM,cAAA,GAAiB,IAAI,OAAA,CAAe,CAAC,UAAU,MAAA,KAAW;AAC9D,MAAA,KAAA,GAAQ,WAAW,MAAM;AACvB,QAAA,QAAA,GAAW,IAAA;AACX,QAAA,MAAA,CAAO,IAAI,MAAM,CAAA,MAAA,EAAS,QAAQ,qBAAqB,MAAA,CAAO,MAAA,CAAO,eAAe,CAAA,EAAA,CAAI,CAAC,CAAA;AAAA,MAC3F,CAAA,EAAG,MAAA,CAAO,MAAA,CAAO,eAAe,CAAA;AAEhC,MAAA,KAAA,CAAM,KAAA,IAAQ;AAAA,IAChB,CAAC,CAAA;AAGD,IAAA,MAAM,gBAAA,GAA6C,CAAC,cAAA,EAAgB,cAAc,CAAA;AAElF,IAAA,IAAI,YAAA;AACJ,IAAA,IAAI,MAAA,IAAU,CAAC,MAAA,CAAO,OAAA,EAAS;AAC7B,MAAA,MAAM,aAAA,GAAgB,IAAI,OAAA,CAAe,CAAC,UAAU,MAAA,KAAW;AAC7D,QAAA,MAAM,UAAU,MAAM;AACpB,UAAA,SAAA,GAAY,IAAA;AACZ,UAAA,MAAA,CAAO,IAAI,KAAA,CAAM,mBAAmB,CAAC,CAAA;AAAA,QACvC,CAAA;AACA,QAAA,MAAA,CAAO,iBAAiB,OAAA,EAAS,OAAA,EAAS,EAAE,IAAA,EAAM,MAAM,CAAA;AACxD,QAAA,YAAA,GAAe,MAAM,MAAA,CAAO,mBAAA,CAAoB,OAAA,EAAS,OAAO,CAAA;AAAA,MAClE,CAAC,CAAA;AACD,MAAA,gBAAA,CAAiB,KAAK,aAAa,CAAA;AAAA,IACrC;AAEA,IAAA,IAAI;AACF,MAAA,MAAM,MAAA,GAAS,MAAM,OAAA,CAAQ,IAAA,CAAK,gBAAgB,CAAA;AAOlD,MAAA,MAAM,UAAA,GAAa,6BAAA,CAA8B,MAAA,EAAQ,IAAI,CAAA;AAC7D,MAAA,MAAM,WAAA,GAAc,qBAAqB,UAAU,CAAA;AACnD,MAAA,IAAI,WAAA,GAAc,MAAA,CAAO,MAAA,CAAO,kBAAA,EAAoB;AAClD,QAAA,OAAO,mBAAA;AAAA,UACL,IAAA;AAAA,UACA,wBAAA;AAAA,UACA,CAAA,YAAA,EAAe,WAAW,CAAA,2BAAA,EAA8B,MAAA,CAAO,OAAO,kBAAkB,CAAA;AAAA,SAC1F;AAAA,MACF;AAEA,MAAA,OAAO,UAAA;AAAA,IACT,SAAS,GAAA,EAAK;AACZ,MAAA,MAAM,UAAU,GAAA,YAAe,KAAA,GAAQ,GAAA,CAAI,OAAA,GAAU,OAAO,GAAG,CAAA;AAC/D,MAAA,IAAI,SAAA,EAAW;AACb,QAAA,OAAO,mBAAA,CAAoB,IAAA,EAAM,iBAAA,EAAmB,mBAAmB,CAAA;AAAA,MACzE;AACA,MAAA,IAAI,QAAA,EAAU;AACZ,QAAA,OAAO,mBAAA,CAAoB,IAAA,EAAM,oBAAA,EAAsB,OAAO,CAAA;AAAA,MAChE;AACA,MAAA,OAAO,mBAAA,CAAoB,IAAA,EAAM,gBAAA,EAAkB,OAAO,CAAA;AAAA,IAC5D,CAAA,SAAE;AACA,MAAA,YAAA,CAAa,KAAK,CAAA;AAClB,MAAA,YAAA,IAAe;AAAA,IACjB;AAAA,EACF;AAEA,EAAA,MAAM,SAAS,IAAIC,gBAAA;AAAA,IACjB,EAAE,IAAA,EAAM,WAAA,EAAa,OAAA,EAAQ;AAAA;AAAA;AAAA,IAG7B,EAAE,cAAc,EAAE,KAAA,EAAO,EAAE,WAAA,EAAa,KAAA,IAAQ;AAAE,GACpD;AAGA,EAAA,MAAM,QAAA,GAAW,MAAA,CAAO,YAAA,CAAa,IAAA,CAAK,MAAM,CAAA;AAGhD,EAAA,QAAA;AAAA,IACE,aAAA;AAAA,IACA;AAAA,MACE,KAAA,EAAO,qBAAA;AAAA,MACP,WAAA,EACE,mIAAA;AAAA,MACF,WAAA,EAAa,iBAAA;AAAA,MACb,YAAA,EAAc,kBAAA;AAAA,MACd,WAAA,EAAa;AAAA,KACf;AAAA,IACA,OAAO,MAAM,KAAA,KACX,WAAA;AAAA,MACE,aAAA;AAAA,MACA,IAAA;AAAA,MACA,CAAC,WAAW,YAAA,CAAa,EAAE,OAAO,IAAA,EAAqB,MAAA,EAAQ,OAAA,EAAS,MAAA,EAAQ,CAAA;AAAA,MAC/E,KAAA,CAAmC;AAAA;AACtC,GACJ;AAGA,EAAA,QAAA;AAAA,IACE,cAAA;AAAA,IACA;AAAA,MACE,KAAA,EAAO,sBAAA;AAAA,MACP,WAAA,EACE,8HAAA;AAAA,MACF,WAAA,EAAa,kBAAA;AAAA,MACb,YAAA,EAAc,mBAAA;AAAA,MACd,WAAA,EAAa;AAAA,KACf;AAAA,IACA,OAAO,MAAM,KAAA,KACX,WAAA;AAAA,MACE,cAAA;AAAA,MACA,IAAA;AAAA,MACA,CAAC,WAAW,aAAA,CAAc,EAAE,OAAO,IAAA,EAAsB,MAAwB,CAAC,CAAA;AAAA,MACjF,KAAA,CAAmC;AAAA;AACtC,GACJ;AAGA,EAAA,QAAA;AAAA,IACE,aAAA;AAAA,IACA;AAAA,MACE,KAAA,EAAO,qBAAA;AAAA,MACP,WAAA,EACE,yHAAA;AAAA,MACF,WAAA,EAAa,iBAAA;AAAA,MACb,YAAA,EAAc,kBAAA;AAAA,MACd,WAAA,EAAa;AAAA,KACf;AAAA,IACA,OAAO,MAAM,KAAA,KACX,WAAA;AAAA,MACE,aAAA;AAAA,MACA,IAAA;AAAA,MACA,CAAC,WAAW,YAAA,CAAa,EAAE,OAAO,IAAA,EAAqB,MAAwB,CAAC,CAAA;AAAA,MAC/E,KAAA,CAAmC;AAAA;AACtC,GACJ;AAKA,EAAA,IAAI,OAAA,CAAQ,SAAA,IAAa,OAAA,CAAQ,QAAA,EAAU;AACzC,IAAA,QAAA;AAAA,MACE,YAAA;AAAA,MACA;AAAA,QACE,KAAA,EAAO,6BAAA;AAAA,QACP,WAAA,EACE,iPAAA;AAAA,QACF,WAAA,EAAa,gBAAA;AAAA,QACb,YAAA,EAAc,iBAAA;AAAA,QACd,WAAA,EAAa;AAAA,OACf;AAAA,MACA,OAAO,MAAM,KAAA,KACX,WAAA;AAAA,QACE,YAAA;AAAA,QACA,IAAA;AAAA,QACA,CAAC,WAAW,WAAA,CAAY,EAAE,OAAO,IAAA,EAAoB,MAAA,EAAQ,OAAgB,CAAC,CAAA;AAAA,QAC7E,KAAA,CAAmC;AAAA;AACtC,KACJ;AAGA,IAAA,IAAI,QAAQ,SAAA,EAAW;AACrB,MAAA,QAAA;AAAA,QACE,oBAAA;AAAA,QACA;AAAA,UACE,KAAA,EAAO,wBAAA;AAAA,UACP,WAAA,EACE,6JAAA;AAAA,UACF,WAAA,EAAa,iBAAA;AAAA,UACb,YAAA,EAAc,kBAAA;AAAA,UACd,WAAA,EAAa;AAAA,SACf;AAAA,QACA,OAAO,MAAM,KAAA,KACX,WAAA;AAAA,UACE,oBAAA;AAAA,UACA,IAAA;AAAA,UACA,CAAC,WAAW,kBAAA,CAAmB,EAAE,OAAO,IAAA,EAAqB,MAAA,EAAQ,OAAA,EAAS,MAAA,EAAQ,CAAA;AAAA,UACrF,KAAA,CAAmC;AAAA;AACtC,OACJ;AAAA,IACF;AAAA,EACF;AAEA,EAAA,OAAO,MAAA;AACT;;;ANzWA,IAAM,OAAA,GAAU,IAAIC,iBAAA,EAAQ;AAE5B,OAAA,CACG,IAAA,CAAK,WAAW,CAAA,CAChB,OAAA,CAAQ,cAAc,CAAA,CACtB,WAAA,CAAY,sCAAsC,CAAA,CAClD,MAAA,CAAO,sBAAsB,8CAA8C,CAAA,CAC3E,OAAO,mBAAA,EAAqB,uBAAuB,EACnD,MAAA,CAAO,iBAAA,EAAmB,gCAAgC,CAAA,CAC1D,MAAA,CAAO,oBAAA,EAAsB,uCAAuC,CAAA,CACpE,MAAA,CAAO,uBAAuB,sCAAsC,CAAA,CACpE,OAAO,oBAAA,EAAsB,oCAAA,EAAsC,OAAO,CAAA,CAC1E,MAAA,CAAO,iBAAA,EAAmB,wCAAwC,MAAM,CAAA,CACxE,OAAO,kBAAA,EAAoB,wCAAA,EAA0C,WAAW,CAAA,CAChF,MAAA,CAAO,uBAAA,EAAyB,wCAAwC,CAAA,CACxE,MAAA;AAAA,EACC,gCAAA;AAAA,EACA;AACF,CAAA,CACC,MAAA,CAAO,oBAAA,EAAsB,wDAAwD,CAAA,CACrF,MAAA;AAAA,EACC,uBAAA;AAAA,EACA,+GAAA;AAAA,EACA;AACF,CAAA,CACC,MAAA,CAAO,OAAO,IAAA,KAAS;AAEtB,EAAA,MAAM,gBAAgB,IAAA,CAAK,SAAA;AAC3B,EAAA,IAAI,aAAA,KAAkB,OAAA,IAAW,aAAA,KAAkB,MAAA,EAAQ;AACzD,IAAA,OAAA,CAAQ,MAAA,CAAO,KAAA;AAAA,MACb,sDAAsD,aAAa,CAAA;AAAA;AAAA,KACrE;AACA,IAAA,OAAA,CAAQ,KAAK,CAAC,CAAA;AAAA,EAChB;AAGA,EAAA,IAAI,IAAA,CAAK,SAAA,IAAa,CAAC,IAAA,CAAK,QAAA,EAAU;AACpC,IAAA,OAAA,CAAQ,MAAA,CAAO,MAAM,4CAA4C,CAAA;AACjE,IAAA,OAAA,CAAQ,KAAK,CAAC,CAAA;AAAA,EAChB;AACA,EAAA,IAAI,IAAA,CAAK,QAAA,IAAY,CAAC,IAAA,CAAK,SAAA,EAAW;AACpC,IAAA,OAAA,CAAQ,MAAA,CAAO,MAAM,4CAA4C,CAAA;AACjE,IAAA,OAAA,CAAQ,KAAK,CAAC,CAAA;AAAA,EAChB;AAGA,EAAA,IAAI,MAAA;AACJ,EAAA,IAAI,UAAA;AACJ,EAAA,IAAI,KAAK,MAAA,EAAQ;AACf,IAAA,MAAM,MAAA,GAAS,MAAM,UAAA,CAAW,IAAA,CAAK,MAAM,CAAA;AAC3C,IAAA,MAAA,GAAS,MAAA,CAAO,MAAA;AAChB,IAAA,UAAA,GAAa,MAAA,CAAO,IAAA;AAAA,EACtB,CAAA,MAAO;AACL,IAAA,MAAA,GAAS,gBAAA,EAAiB;AAC1B,IAAA,UAAA,GAAa,MAAM,iBAAA,CAAkB,IAAA,CAAK,SAAA,CAAU,MAAM,CAAC,CAAA;AAAA,EAC7D;AAGA,EAAA,IAAI,SAAA;AACJ,EAAA,IAAI,KAAK,SAAA,EAAW;AAClB,IAAA,SAAA,GAAY,MAAM,aAAA,CAAc,IAAA,CAAK,SAAS,CAAA;AAAA,EAChD;AAGA,EAAA,IAAI,QAAA;AACJ,EAAA,IAAI,KAAK,QAAA,EAAU;AACjB,IAAA,QAAA,GAAW,MAAM,YAAA,CAAa,IAAA,CAAK,QAAQ,CAAA;AAAA,EAC7C;AAGA,EAAA,IAAI,SAAA;AACJ,EAAA,IAAI,KAAK,SAAA,EAAW;AAClB,IAAA,IAAI;AACF,MAAA,MAAM,CAAA,GAAI,MAAMC,aAAA,CAAO,IAAA,CAAK,SAAS,CAAA;AACrC,MAAA,IAAI,CAAC,CAAA,CAAE,WAAA,EAAY,EAAG;AACpB,QAAA,OAAA,CAAQ,MAAA,CAAO,KAAA,CAAM,CAAA,wCAAA,EAA2C,IAAA,CAAK,SAAS;AAAA,CAAI,CAAA;AAClF,QAAA,OAAA,CAAQ,KAAK,CAAC,CAAA;AAAA,MAChB;AACA,MAAA,SAAA,GAAY,MAAMC,iBAAA,CAAS,IAAA,CAAK,SAAS,CAAA;AAAA,IAC3C,SAAS,GAAA,EAAK;AACZ,MAAA,OAAA,CAAQ,MAAA,CAAO,KAAA;AAAA,QACb,CAAA,oCAAA,EAAuC,IAAA,CAAK,SAAS,CAAA,IAAA,EAAO,GAAA,YAAe,QAAQ,GAAA,CAAI,OAAA,GAAU,MAAA,CAAO,GAAG,CAAC;AAAA;AAAA,OAC9G;AACA,MAAA,OAAA,CAAQ,KAAK,CAAC,CAAA;AAAA,IAChB;AAAA,EACF;AAGA,EAAA,MAAM,OAAA,GAAyB;AAAA,IAC7B,OAAA,EAAS,cAAA;AAAA,IACT,UAAA;AAAA,IACA,eAAA,EAAiB,oBAAA;AAAA,IACjB,SAAA;AAAA,IACA,QAAA;AAAA,IACA,UAAU,IAAA,CAAK,QAAA;AAAA,IACf;AAAA,GACF;AAGA,EAAA,MAAM,KAAA,GAAQ,CAAC,aAAA,EAAe,cAAA,EAAgB,aAAa,CAAA;AAC3D,EAAA,IAAI,SAAA,IAAa,KAAK,QAAA,EAAU;AAC9B,IAAA,KAAA,CAAM,KAAK,YAAY,CAAA;AACvB,IAAA,IAAI,SAAA,EAAW;AACb,MAAA,KAAA,CAAM,KAAK,oBAAoB,CAAA;AAAA,IACjC;AAAA,EACF;AAGA,EAAA,MAAM,aAAA,GAA+B;AAAA,IACnC,OAAA,EAAS,cAAA;AAAA,IACT,MAAA;AAAA,IAGA;AAAA,GACF;AAGA,EAAA,OAAA,CAAQ,MAAA,CAAO,KAAA;AAAA,IACb,CAAA,CAAA,EAAI,WAAW,CAAA,GAAA,EAAM,cAAc,eAAe,oBAAoB;AAAA;AAAA,GACxE;AACA,EAAA,OAAA,CAAQ,MAAA,CAAO,KAAA,CAAM,CAAA,aAAA,EAAgB,aAAa;AAAA,CAAI,CAAA;AACtD,EAAA,OAAA,CAAQ,OAAO,KAAA,CAAM,CAAA,SAAA,EAAY,KAAA,CAAM,IAAA,CAAK,IAAI,CAAC;AAAA,CAAI,CAAA;AACrD,EAAA,OAAA,CAAQ,MAAA,CAAO,KAAA,CAAM,CAAA,OAAA,EAAU,SAAA,GAAY,WAAW,MAAM;AAAA,CAAI,CAAA;AAChE,EAAA,OAAA,CAAQ,MAAA,CAAO,MAAM,CAAA,QAAA,EAAW,QAAA,GAAW,GAAG,QAAA,CAAS,MAAM,YAAY,MAAM;AAAA,CAAI,CAAA;AACnF,EAAA,OAAA,CAAQ,MAAA,CAAO,KAAA,CAAM,CAAA,cAAA,EAAiB,SAAA,IAAa,MAAM;AAAA,CAAI,CAAA;AAC7D,EAAA,OAAA,CAAQ,OAAO,KAAA,CAAM,CAAA,eAAA,EAAkB,WAAW,KAAA,CAAM,CAAA,EAAG,EAAE,CAAC,CAAA;AAAA,CAAO,CAAA;AAErE,EAAA,IAAI,kBAAkB,MAAA,EAAQ;AAE5B,IAAA,MAAM,EAAE,mBAAA,EAAAC,oBAAAA,EAAoB,GAAI,MAAM,OAAA,CAAA,OAAA,EAAA,CAAA,IAAA,CAAA,OAAA,mBAAA,EAAA,EAAA,sBAAA,CAAA,CAAA;AAEtC,IAAA,MAAM,WAAA,GAAc,IAAA,CAAK,WAAA,GACpB,IAAA,CAAK,YAAuB,KAAA,CAAM,GAAG,CAAA,CAAE,GAAA,CAAI,CAAC,CAAA,KAAc,CAAA,CAAE,IAAA,EAAM,CAAA,GACnE,MAAA;AACJ,IAAA,MAAM,oBAAA,GAAuB,IAAA,CAAK,oBAAA,GAC7B,IAAA,CAAK,qBAAgC,KAAA,CAAM,GAAG,CAAA,CAAE,GAAA,CAAI,CAAC,CAAA,KAAc,CAAA,CAAE,IAAA,EAAM,CAAA,GAC5E,MAAA;AAEJ,IAAA,MAAM,EAAE,OAAA,EAAQ,GAAI,MAAMA,oBAAAA,CAAoB;AAAA,MAC5C,IAAA,EAAM,QAAA,CAAS,IAAA,CAAK,IAAA,EAAgB,EAAE,CAAA;AAAA,MACtC,MAAM,IAAA,CAAK,IAAA;AAAA,MACX,WAAA;AAAA,MACA,oBAAA;AAAA,MACA,WAAW,IAAA,CAAK,SAAA;AAAA,MAChB,UAAA,EAAa,KAAK,UAAA,IAAyB,KAAA;AAAA,MAC3C,aAAA,EAAe,MAAM,mBAAA,CAAoB,aAAa;AAAA,KACvD,CAAA;AAGD,IAAA,MAAM,WAAW,YAAY;AAC3B,MAAA,OAAA,CAAQ,MAAA,CAAO,KAAA,CAAM,CAAA,CAAA,EAAI,WAAW,CAAA;AAAA,CAAsB,CAAA;AAC1D,MAAA,MAAM,OAAA,EAAQ;AACd,MAAA,OAAA,CAAQ,KAAK,CAAC,CAAA;AAAA,IAChB,CAAA;AAEA,IAAA,OAAA,CAAQ,EAAA,CAAG,UAAU,QAAQ,CAAA;AAC7B,IAAA,OAAA,CAAQ,EAAA,CAAG,WAAW,QAAQ,CAAA;AAAA,EAChC,CAAA,MAAO;AAEL,IAAA,MAAM,EAAE,oBAAA,EAAqB,GAAI,MAAM,OAAO,2CAA2C,CAAA;AAGzF,IAAA,MAAM,gBAAgB,kBAAA,EAAmB;AAEzC,IAAA,MAAM,MAAA,GAAS,oBAAoB,aAAa,CAAA;AAChD,IAAA,MAAM,SAAA,GAAY,IAAI,oBAAA,EAAqB;AAG3C,IAAA,MAAM,WAAW,YAAY;AAC3B,MAAA,OAAA,CAAQ,MAAA,CAAO,KAAA,CAAM,CAAA,CAAA,EAAI,WAAW,CAAA;AAAA,CAAsB,CAAA;AAC1D,MAAA,MAAM,OAAO,KAAA,EAAM;AACnB,MAAA,aAAA,EAAc;AACd,MAAA,OAAA,CAAQ,KAAK,CAAC,CAAA;AAAA,IAChB,CAAA;AAEA,IAAA,OAAA,CAAQ,EAAA,CAAG,UAAU,QAAQ,CAAA;AAC7B,IAAA,OAAA,CAAQ,EAAA,CAAG,WAAW,QAAQ,CAAA;AAE9B,IAAA,MAAM,MAAA,CAAO,QAAQ,SAAS,CAAA;AAAA,EAChC;AACF,CAAC,CAAA;AAEH,KAAK,QAAQ,UAAA,CAAW,OAAA,CAAQ,IAAI,CAAA,CAAE,KAAA,CAAM,CAAC,GAAA,KAAiB;AAC5D,EAAA,OAAA,CAAQ,MAAA,CAAO,KAAA;AAAA,IACb,CAAA,CAAA,EAAI,WAAW,CAAA,SAAA,EAAY,GAAA,YAAe,QAAQ,GAAA,CAAI,OAAA,GAAU,MAAA,CAAO,GAAG,CAAC;AAAA;AAAA,GAC7E;AACA,EAAA,OAAA,CAAQ,KAAK,CAAC,CAAA;AAChB,CAAC,CAAA","file":"cli.cjs","sourcesContent":["/**\n * MCP Server constants -- zero imports\n */\n\nexport const SERVER_NAME = 'peac-mcp-server';\nexport const SERVER_VERSION = '0.16.2';\nexport const MCP_PROTOCOL_VERSION = '2025-11-25';\nexport const DEFAULT_MAX_JWS_BYTES = 16_384; // 16 KB\nexport const DEFAULT_MAX_RESPONSE_BYTES = 65_536; // 64 KB\nexport const DEFAULT_TOOL_TIMEOUT_MS = 30_000; // 30 s\nexport const DEFAULT_MAX_CLAIMS_BYTES = 262_144; // 256 KB\nexport const DEFAULT_MAX_BUNDLE_RECEIPTS = 256;\nexport const DEFAULT_MAX_BUNDLE_BYTES = 16_777_216; // 16 MB\nexport const DEFAULT_MAX_TTL_SECONDS = 86_400; // 24 hours\n\n// HTTP transport defaults\nexport const DEFAULT_HTTP_PORT = 3000;\nexport const DEFAULT_HTTP_HOST = '127.0.0.1'; // localhost only; 0.0.0.0 requires explicit opt-in\nexport const DEFAULT_MAX_REQUEST_BYTES = 1_048_576; // 1 MB\nexport const DEFAULT_RATE_LIMIT_RPM = 100;\nexport const DEFAULT_SESSION_TTL_MS = 30 * 60 * 1000; // 30 min\nexport const DEFAULT_MAX_SESSIONS = 100;\n","/**\n * MCP Session Manager -- Mcp-Session-Id lifecycle, eviction, isolation\n *\n * Each HTTP session gets its own McpServer + StreamableHTTPServerTransport\n * pair. This is the primary defense against CVE-2026-25536 (cross-client\n * response data leak when a single transport is reused across connections).\n *\n * INVARIANT: NEVER reuse a single transport instance across multiple\n * client sessions. Each session is fully isolated.\n */\n\nimport { randomUUID } from 'node:crypto';\nimport type { McpServer } from '@modelcontextprotocol/sdk/server/mcp.js';\nimport { StreamableHTTPServerTransport } from '@modelcontextprotocol/sdk/server/streamableHttp.js';\n\nexport interface SessionEntry {\n readonly sessionId: string;\n readonly server: McpServer;\n readonly transport: StreamableHTTPServerTransport;\n readonly createdAt: number;\n readonly clientIp: string;\n lastSeen: number;\n}\n\nexport interface SessionManagerOptions {\n /** Max idle time before eviction (ms). Default: 30 min */\n ttlMs?: number;\n /** Max concurrent sessions. Default: 100 */\n maxSessions?: number;\n /** Max sessions per client IP. Default: 10 */\n maxSessionsPerIp?: number;\n /** Eviction sweep interval (ms). Default: 60s */\n sweepIntervalMs?: number;\n}\n\ntype ServerFactory = () => McpServer;\n\nexport class SessionManager {\n private readonly sessions = new Map<string, SessionEntry>();\n private readonly ipSessionCount = new Map<string, number>();\n private readonly ttlMs: number;\n private readonly maxSessions: number;\n private readonly maxSessionsPerIp: number;\n private sweepTimer: ReturnType<typeof setInterval> | undefined;\n\n constructor(private readonly options: SessionManagerOptions = {}) {\n this.ttlMs = options.ttlMs ?? 30 * 60 * 1000; // 30 min\n this.maxSessions = options.maxSessions ?? 100;\n this.maxSessionsPerIp = options.maxSessionsPerIp ?? 10;\n }\n\n /** Start periodic eviction sweep */\n startSweep(): void {\n const intervalMs = this.options.sweepIntervalMs ?? 60_000;\n this.sweepTimer = setInterval(() => this.evictStale(), intervalMs);\n this.sweepTimer.unref();\n }\n\n /** Create a new isolated session with its own McpServer + transport */\n async createSession(serverFactory: ServerFactory, clientIp = 'unknown'): Promise<SessionEntry> {\n // Evict stale sessions first\n this.evictStale();\n\n // Check global capacity\n if (this.sessions.size >= this.maxSessions) {\n throw new Error(`Session limit reached (${this.maxSessions}). Try again later.`);\n }\n\n // Check per-IP capacity (prevents one IP exhausting the global pool)\n const ipCount = this.ipSessionCount.get(clientIp) ?? 0;\n if (ipCount >= this.maxSessionsPerIp) {\n throw new Error(\n `Per-IP session limit reached (${this.maxSessionsPerIp} for ${clientIp}). Try again later.`\n );\n }\n\n const sessionId = randomUUID();\n const server = serverFactory();\n const transport = new StreamableHTTPServerTransport({\n sessionIdGenerator: () => sessionId,\n });\n\n await server.connect(transport);\n\n const now = Date.now();\n const entry: SessionEntry = {\n sessionId,\n server,\n transport,\n clientIp,\n createdAt: now,\n lastSeen: now,\n };\n\n this.sessions.set(sessionId, entry);\n this.ipSessionCount.set(clientIp, ipCount + 1);\n return entry;\n }\n\n /** Look up an existing session by ID */\n getSession(sessionId: string): SessionEntry | undefined {\n const entry = this.sessions.get(sessionId);\n if (entry) {\n entry.lastSeen = Date.now();\n }\n return entry;\n }\n\n /** Terminate and clean up a specific session */\n async terminateSession(sessionId: string): Promise<boolean> {\n const entry = this.sessions.get(sessionId);\n if (!entry) return false;\n\n this.sessions.delete(sessionId);\n this.decrementIpCount(entry.clientIp);\n try {\n await entry.transport.close();\n await entry.server.close();\n } catch {\n // Best effort cleanup\n }\n return true;\n }\n\n /** Terminate all sessions and stop sweep */\n async cleanup(): Promise<void> {\n if (this.sweepTimer) {\n clearInterval(this.sweepTimer);\n this.sweepTimer = undefined;\n }\n\n const entries = [...this.sessions.values()];\n this.sessions.clear();\n this.ipSessionCount.clear();\n\n await Promise.allSettled(\n entries.map(async (entry) => {\n try {\n await entry.transport.close();\n await entry.server.close();\n } catch {\n // Best effort\n }\n })\n );\n }\n\n /** Get current session count */\n get size(): number {\n return this.sessions.size;\n }\n\n /** Evict sessions past TTL */\n private evictStale(): void {\n const now = Date.now();\n for (const [id, entry] of this.sessions) {\n if (now - entry.lastSeen > this.ttlMs) {\n this.sessions.delete(id);\n this.decrementIpCount(entry.clientIp);\n // Fire-and-forget cleanup\n void entry.transport.close().catch(() => {});\n void entry.server.close().catch(() => {});\n }\n }\n }\n\n /** Decrement per-IP session count, removing the key when it reaches 0 */\n private decrementIpCount(ip: string): void {\n const count = this.ipSessionCount.get(ip) ?? 0;\n if (count <= 1) {\n this.ipSessionCount.delete(ip);\n } else {\n this.ipSessionCount.set(ip, count - 1);\n }\n }\n}\n","/**\n * MCP Streamable HTTP transport\n *\n * Adds HTTP transport alongside stdio. Unprotected mode only (v0.11.0).\n * Each session gets its own McpServer + transport (CVE-2026-25536 defense).\n *\n * Endpoints:\n * POST /mcp JSON-RPC tool calls (requires Mcp-Session-Id after init)\n * DELETE /mcp Terminate session\n * GET /health Health check (no auth)\n * GET /.well-known/oauth-protected-resource[/<path>] PRM (conditional)\n * GET /mcp 405 Method Not Allowed\n */\n\nimport { createServer, type IncomingMessage, type ServerResponse } from 'node:http';\nimport type { McpServer } from '@modelcontextprotocol/sdk/server/mcp.js';\nimport { SessionManager } from './session-manager.js';\nimport { SERVER_NAME, SERVER_VERSION, MCP_PROTOCOL_VERSION } from './infra/constants.js';\n\n/**\n * Trust-proxy configuration for X-Forwarded-For interpretation.\n *\n * Presets:\n * - 'off': never trust forwarded headers (default; safe for direct clients)\n * - 'loopback': trust only from 127.0.0.0/8 and ::1\n * - 'linklocal': trust loopback + link-local (169.254.0.0/16, fe80::/10)\n * - 'private': trust loopback + link-local + RFC 1918 (10.0.0.0/8, 172.16.0.0/12, 192.168.0.0/16)\n * - 'all': trust any remote address (DISCOURAGED; use only when behind a fully trusted proxy chain)\n *\n * Explicit addresses:\n * - comma-separated IPs: trust only from listed addresses (e.g., '10.0.0.1,10.0.0.2')\n *\n * WARNING: only enable behind a trusted reverse proxy. An attacker can forge\n * X-Forwarded-For from an untrusted peer to bypass per-IP rate limiting.\n */\nexport type TrustProxyValue = 'off' | 'loopback' | 'linklocal' | 'private' | 'all' | string;\n\nexport interface HttpTransportOptions {\n /** Port to listen on. Default: 3000 */\n port?: number;\n /** Bind address. Default: '127.0.0.1' (localhost only) */\n host?: string;\n /** Allowed CORS origins (empty = deny all). */\n corsOrigins?: string[];\n /** OAuth authorization server URIs (enables PRM with publicUrl). */\n authorizationServers?: string[];\n /** Canonical public URL of this server (required for PRM). */\n publicUrl?: string;\n /** Trust X-Forwarded-For for rate limiting. Default: 'off' */\n trustProxy?: TrustProxyValue;\n /** Max request body bytes. Default: 1MB */\n maxRequestBytes?: number;\n /** Rate limit: requests per minute per session. Default: 100 */\n rateLimitRpm?: number;\n /** Session TTL in ms. Default: 30 min */\n sessionTtlMs?: number;\n /** Max concurrent sessions. Default: 100 */\n maxSessions?: number;\n /** Max sessions per client IP. Default: 10 */\n maxSessionsPerIp?: number;\n /** Factory to create new McpServer instances (one per session) */\n serverFactory: () => McpServer;\n}\n\ninterface RateLimitEntry {\n count: number;\n windowStart: number;\n}\n\nconst ONE_MINUTE_MS = 60_000;\nconst DEFAULT_MAX_REQUEST_BYTES = 1_048_576; // 1 MB\nconst DEFAULT_RATE_LIMIT_RPM = 100;\nconst MAX_SESSION_ID_LENGTH = 128;\n\n/**\n * Validate Mcp-Session-Id: visible ASCII (0x21-0x7E), max 128 chars.\n * MCP spec requires session IDs to be visible ASCII characters only.\n */\nfunction isValidSessionId(id: string): boolean {\n if (id.length === 0 || id.length > MAX_SESSION_ID_LENGTH) return false;\n for (let i = 0; i < id.length; i++) {\n const code = id.charCodeAt(i);\n if (code < 0x21 || code > 0x7e) return false;\n }\n return true;\n}\n\n/**\n * Check if an IPv4 address falls within a well-known range.\n * Does NOT perform CIDR parsing; uses prefix matching for known ranges.\n */\nfunction isLoopbackAddr(addr: string): boolean {\n return addr.startsWith('127.') || addr === '::1' || addr === '::ffff:127.0.0.1';\n}\nfunction isLinkLocalAddr(addr: string): boolean {\n if (isLoopbackAddr(addr)) return true;\n return addr.startsWith('169.254.') || addr.startsWith('fe80');\n}\nfunction isPrivateAddr(addr: string): boolean {\n if (isLinkLocalAddr(addr)) return true;\n return (\n addr.startsWith('10.') ||\n addr.startsWith('192.168.') ||\n /^172\\.(1[6-9]|2\\d|3[01])\\./.test(addr) ||\n addr.startsWith('fc') ||\n addr.startsWith('fd') ||\n addr.startsWith('::ffff:10.') ||\n addr.startsWith('::ffff:192.168.') ||\n /^::ffff:172\\.(1[6-9]|2\\d|3[01])\\./.test(addr)\n );\n}\n\n/**\n * Check if a remote address is a trusted proxy based on trust-proxy config.\n */\nfunction isTrustedProxy(remoteAddr: string, trustProxy: TrustProxyValue): boolean {\n if (trustProxy === 'off') return false;\n if (trustProxy === 'all') return true;\n if (trustProxy === 'loopback') return isLoopbackAddr(remoteAddr);\n if (trustProxy === 'linklocal') return isLinkLocalAddr(remoteAddr);\n if (trustProxy === 'private') return isPrivateAddr(remoteAddr);\n // Comma-separated trusted IPs\n const trusted = trustProxy.split(',').map((s) => s.trim());\n return trusted.includes(remoteAddr);\n}\n\n/**\n * Validate --public-url for RFC 9728 PRM correctness:\n * - Must be https (unless loopback for dev ergonomics)\n * - Must not contain fragments\n * - Trailing slashes normalized\n */\nfunction validatePublicUrl(rawUrl: string): { url: URL; normalized: string } | { error: string } {\n let u: URL;\n try {\n u = new URL(rawUrl);\n } catch {\n return { error: `Invalid URL: ${rawUrl}` };\n }\n if (u.hash) {\n return { error: 'Public URL must not contain fragments (#)' };\n }\n const isLoopback =\n u.hostname === 'localhost' || u.hostname === '127.0.0.1' || u.hostname === '::1';\n if (u.protocol !== 'https:' && !isLoopback) {\n return { error: 'Public URL must use https (except for localhost/loopback dev usage)' };\n }\n // Normalize: strip trailing slash for path matching consistency\n const normalized = u.href.replace(/\\/+$/, '') || u.origin;\n return { url: u, normalized };\n}\n\n/**\n * Create and start an HTTP server for MCP Streamable HTTP transport.\n * Returns a cleanup function to shut everything down.\n */\nexport async function createHttpTransport(\n options: HttpTransportOptions\n): Promise<{ cleanup: () => Promise<void> }> {\n const port = options.port ?? 3000;\n const host = options.host ?? '127.0.0.1';\n const corsOrigins = new Set(options.corsOrigins ?? []);\n const maxRequestBytes = options.maxRequestBytes ?? DEFAULT_MAX_REQUEST_BYTES;\n const rateLimitRpm = options.rateLimitRpm ?? DEFAULT_RATE_LIMIT_RPM;\n\n const sessionManager = new SessionManager({\n ttlMs: options.sessionTtlMs,\n maxSessions: options.maxSessions,\n maxSessionsPerIp: options.maxSessionsPerIp,\n });\n sessionManager.startSweep();\n\n // Per-session + per-IP rate limiting (token bucket keyed on session ID,\n // falling back to IP for unauthenticated init requests)\n const rateLimits = new Map<string, RateLimitEntry>();\n\n function checkRateLimit(key: string): boolean {\n const now = Date.now();\n let entry = rateLimits.get(key);\n if (!entry || now - entry.windowStart > ONE_MINUTE_MS) {\n entry = { count: 0, windowStart: now };\n rateLimits.set(key, entry);\n }\n entry.count++;\n return entry.count <= rateLimitRpm;\n }\n\n const trustProxyValue: TrustProxyValue = options.trustProxy ?? 'off';\n\n /**\n * Resolve the client IP for rate limiting and per-IP session caps.\n *\n * Terminology:\n * - peer_ip: the TCP socket remote address (req.socket.remoteAddress).\n * This is the IP the OS reports; it cannot be spoofed at the application layer.\n * - client_ip: the resolved end-client IP after trust-proxy evaluation.\n * When trust-proxy is 'off' (default), client_ip === peer_ip.\n * When trust-proxy is enabled AND the peer_ip matches the trusted range,\n * client_ip is taken from the first entry in X-Forwarded-For.\n * When trust-proxy is enabled but the peer_ip is NOT in the trusted range,\n * X-Forwarded-For is IGNORED (peer_ip used as client_ip) to prevent\n * spoofing from untrusted peers.\n */\n function getClientIp(req: IncomingMessage): string {\n const peerIp = req.socket.remoteAddress ?? 'unknown';\n if (trustProxyValue !== 'off' && isTrustedProxy(peerIp, trustProxyValue)) {\n const xff = req.headers['x-forwarded-for'];\n if (typeof xff === 'string') {\n const first = xff.split(',')[0]?.trim();\n if (first) return first;\n }\n }\n return peerIp;\n }\n\n // Allowed hosts for Host header validation\n const allowedHosts = new Set<string>();\n allowedHosts.add(`${host}:${port}`);\n allowedHosts.add(host === '0.0.0.0' ? `localhost:${port}` : `${host}:${port}`);\n if (host === '127.0.0.1' || host === '0.0.0.0') {\n allowedHosts.add(`localhost:${port}`);\n allowedHosts.add(`127.0.0.1:${port}`);\n }\n if (options.publicUrl) {\n try {\n const u = new URL(options.publicUrl);\n allowedHosts.add(u.host);\n } catch {\n // Invalid publicUrl, ignore\n }\n }\n\n // Origin allowlist for DNS rebinding defense (MCP spec MUST requirement)\n const allowedOrigins = new Set<string>(corsOrigins);\n\n function validateOrigin(req: IncomingMessage, res: ServerResponse): boolean {\n const origin = req.headers.origin;\n if (!origin) return true; // No origin = same-origin or non-browser\n if (allowedOrigins.size === 0) {\n // Deny all cross-origin by default\n res.writeHead(403, { 'Content-Type': 'application/json' });\n res.end(JSON.stringify({ error: 'Origin not allowed' }));\n return false;\n }\n if (!allowedOrigins.has(origin)) {\n res.writeHead(403, { 'Content-Type': 'application/json' });\n res.end(JSON.stringify({ error: 'Origin not allowed' }));\n return false;\n }\n return true;\n }\n\n function setCorsHeaders(req: IncomingMessage, res: ServerResponse): void {\n const origin = req.headers.origin;\n if (origin && allowedOrigins.has(origin)) {\n res.setHeader('Access-Control-Allow-Origin', origin);\n res.setHeader('Access-Control-Allow-Methods', 'POST, DELETE, GET, OPTIONS');\n res.setHeader(\n 'Access-Control-Allow-Headers',\n 'Content-Type, Mcp-Session-Id, Accept, MCP-Protocol-Version'\n );\n res.setHeader('Access-Control-Expose-Headers', 'Mcp-Session-Id');\n }\n }\n\n function sendJson(res: ServerResponse, status: number, body: unknown): void {\n const json = JSON.stringify(body);\n res.writeHead(status, { 'Content-Type': 'application/json' });\n res.end(json);\n }\n\n async function readBody(req: IncomingMessage): Promise<Buffer> {\n const chunks: Buffer[] = [];\n let totalBytes = 0;\n for await (const chunk of req) {\n totalBytes += (chunk as Buffer).length;\n if (totalBytes > maxRequestBytes) {\n throw new Error(`Request body exceeds ${maxRequestBytes} bytes`);\n }\n chunks.push(chunk as Buffer);\n }\n return Buffer.concat(chunks);\n }\n\n // PRM configuration (RFC 9728 path-aware discovery)\n // Both authorizationServers (non-empty) and publicUrl are required for PRM.\n const authServers = (options.authorizationServers ?? []).filter((s) => s.trim().length > 0);\n if (options.authorizationServers?.length && authServers.length === 0) {\n process.stderr.write(\n `[${SERVER_NAME}] WARNING: --authorization-servers contains only empty entries, PRM disabled\\n`\n );\n }\n if (authServers.length > 0 && !options.publicUrl) {\n process.stderr.write(\n `[${SERVER_NAME}] WARNING: --authorization-servers set without --public-url, PRM disabled\\n`\n );\n }\n if (options.publicUrl && authServers.length === 0) {\n process.stderr.write(\n `[${SERVER_NAME}] WARNING: --public-url set without --authorization-servers, PRM disabled\\n`\n );\n }\n const prmEnabled = !!(authServers.length > 0 && options.publicUrl);\n let prmPath = '/.well-known/oauth-protected-resource';\n let prmDocument: object | undefined;\n if (prmEnabled && options.publicUrl) {\n const validation = validatePublicUrl(options.publicUrl);\n if ('error' in validation) {\n process.stderr.write(\n `[${SERVER_NAME}] WARNING: --public-url invalid, PRM disabled: ${validation.error}\\n`\n );\n } else {\n const { url: u, normalized } = validation;\n // RFC 9728 path insertion: /.well-known/oauth-protected-resource/<resource-path>\n const resourcePath = u.pathname.replace(/\\/+$/, '');\n if (resourcePath && resourcePath !== '/') {\n prmPath = `/.well-known/oauth-protected-resource${resourcePath}`;\n }\n prmDocument = {\n resource: normalized,\n authorization_servers: authServers,\n };\n }\n }\n\n const server = createServer(async (req: IncomingMessage, res: ServerResponse) => {\n const url = new URL(req.url ?? '/', `http://${req.headers.host ?? 'localhost'}`);\n const pathname = url.pathname;\n\n // Node.js server timeouts (slowloris defense)\n // These are set per-request since createServer options apply globally\n res.setTimeout(30_000);\n\n // CORS preflight\n if (req.method === 'OPTIONS') {\n setCorsHeaders(req, res);\n res.writeHead(204);\n res.end();\n return;\n }\n\n setCorsHeaders(req, res);\n\n // Host header validation\n const hostHeader = req.headers.host;\n if (hostHeader && !allowedHosts.has(hostHeader)) {\n sendJson(res, 400, { error: 'Invalid Host header' });\n return;\n }\n\n // Origin validation (DNS rebinding defense)\n if (!validateOrigin(req, res)) return;\n\n // --- Health endpoint ---\n if (pathname === '/health' && req.method === 'GET') {\n sendJson(res, 200, {\n ok: true,\n version: SERVER_VERSION,\n protocolVersion: MCP_PROTOCOL_VERSION,\n });\n return;\n }\n\n // --- PRM endpoint ---\n if (pathname === prmPath && req.method === 'GET') {\n if (prmEnabled && prmDocument) {\n sendJson(res, 200, prmDocument);\n } else {\n sendJson(res, 404, { error: 'Not found' });\n }\n return;\n }\n\n // --- MCP endpoint ---\n if (pathname === '/mcp') {\n // GET /mcp -> 405 (SSE streaming deferred)\n if (req.method === 'GET') {\n res.writeHead(405, { Allow: 'POST, DELETE', 'Content-Type': 'application/json' });\n res.end(JSON.stringify({ error: 'Method Not Allowed. Use POST for JSON-RPC requests.' }));\n return;\n }\n\n // DELETE /mcp -> terminate session\n if (req.method === 'DELETE') {\n const sessionId = req.headers['mcp-session-id'] as string | undefined;\n if (!sessionId) {\n sendJson(res, 400, { error: 'Missing Mcp-Session-Id header' });\n return;\n }\n if (!isValidSessionId(sessionId)) {\n sendJson(res, 400, {\n error: 'Invalid Mcp-Session-Id: must be visible ASCII (0x21-0x7E), max 128 chars',\n });\n return;\n }\n const terminated = await sessionManager.terminateSession(sessionId);\n if (terminated) {\n sendJson(res, 200, { ok: true });\n } else {\n sendJson(res, 404, { error: 'Session not found or already terminated' });\n }\n return;\n }\n\n // POST /mcp -> JSON-RPC\n if (req.method === 'POST') {\n // Rate limit check\n const sessionId = req.headers['mcp-session-id'] as string | undefined;\n const rateLimitKey = sessionId ?? `ip:${getClientIp(req)}`;\n if (!checkRateLimit(rateLimitKey)) {\n res.writeHead(429, { 'Content-Type': 'application/json', 'Retry-After': '60' });\n res.end(JSON.stringify({ error: 'Rate limit exceeded' }));\n return;\n }\n\n // Read and parse body\n let body: unknown;\n try {\n const raw = await readBody(req);\n body = JSON.parse(raw.toString('utf-8'));\n } catch (err) {\n const msg = err instanceof Error ? err.message : 'Invalid request body';\n sendJson(res, 400, { error: msg });\n return;\n }\n\n // Check if this is an initialization request\n const isInit =\n typeof body === 'object' &&\n body !== null &&\n 'method' in body &&\n (body as { method: string }).method === 'initialize';\n\n if (isInit) {\n // MCP-Protocol-Version validation (on init)\n const protocolVersion = req.headers['mcp-protocol-version'] as string | undefined;\n if (\n protocolVersion &&\n protocolVersion !== MCP_PROTOCOL_VERSION &&\n protocolVersion !== '2025-03-26'\n ) {\n sendJson(res, 400, { error: `Unsupported MCP protocol version: ${protocolVersion}` });\n return;\n }\n\n // Accept header tolerance\n const accept = req.headers.accept;\n if (!accept) {\n process.stderr.write(\n `[${SERVER_NAME}] Warning: missing Accept header on init request\\n`\n );\n }\n\n // Create new session\n let entry;\n try {\n entry = await sessionManager.createSession(options.serverFactory, getClientIp(req));\n } catch (err) {\n const msg = err instanceof Error ? err.message : 'Failed to create session';\n sendJson(res, 503, { error: msg });\n return;\n }\n\n // Delegate to transport (it will set Mcp-Session-Id header)\n await entry.transport.handleRequest(req, res, body);\n return;\n }\n\n // Non-init requests require Mcp-Session-Id\n if (!sessionId) {\n sendJson(res, 400, { error: 'Missing Mcp-Session-Id header' });\n return;\n }\n if (!isValidSessionId(sessionId)) {\n sendJson(res, 400, {\n error: 'Invalid Mcp-Session-Id: must be visible ASCII (0x21-0x7E), max 128 chars',\n });\n return;\n }\n\n const entry = sessionManager.getSession(sessionId);\n if (!entry) {\n sendJson(res, 404, { error: 'Session not found or terminated' });\n return;\n }\n\n // Delegate to session's transport\n await entry.transport.handleRequest(req, res, body);\n return;\n }\n\n // Other methods on /mcp\n res.writeHead(405, { Allow: 'POST, DELETE', 'Content-Type': 'application/json' });\n res.end(JSON.stringify({ error: 'Method Not Allowed' }));\n return;\n }\n\n // --- Not found ---\n sendJson(res, 404, { error: 'Not found' });\n });\n\n // Node.js server timeouts (slowloris defense)\n server.headersTimeout = 10_000; // 10s for headers\n server.requestTimeout = 30_000; // 30s for full request\n server.keepAliveTimeout = 5_000; // 5s keep-alive\n\n return new Promise((resolve, reject) => {\n server.on('error', reject);\n server.listen(port, host, () => {\n process.stderr.write(`[${SERVER_NAME}] HTTP transport listening on http://${host}:${port}\\n`);\n process.stderr.write(` Transport: Streamable HTTP (MCP ${MCP_PROTOCOL_VERSION})\\n`);\n process.stderr.write(\n ` Auth: unprotected mode (no token validation); PRM discovery per RFC 9728\\n`\n );\n process.stderr.write(` Endpoints: POST /mcp, DELETE /mcp, GET /health\\n`);\n if (prmEnabled) {\n process.stderr.write(` PRM: GET ${prmPath} (implemented, enabled by config)\\n`);\n } else {\n process.stderr.write(\n ` PRM: disabled (set --authorization-servers + --public-url to enable)\\n`\n );\n }\n process.stderr.write(\n ` Sessions: max ${options.maxSessions ?? 100} (${options.maxSessionsPerIp ?? 10}/IP), TTL ${(options.sessionTtlMs ?? 1_800_000) / 1000}s\\n`\n );\n process.stderr.write(` Rate limit: ${rateLimitRpm} req/min per session\\n`);\n process.stderr.write(\n ` CORS: ${corsOrigins.size > 0 ? [...corsOrigins].join(', ') : 'deny all'}\\n`\n );\n process.stderr.write(\n ` Mode: unprotected (token validation deferred to v0.11.x+; deployer auth via reverse proxy)\\n`\n );\n\n resolve({\n cleanup: async () => {\n await sessionManager.cleanup();\n await new Promise<void>((res) => server.close(() => res()));\n },\n });\n });\n });\n}\n","#!/usr/bin/env node\n/**\n * peac-mcp-server CLI entry point\n *\n * Startup: parse args -> load policy -> load key -> load JWKS ->\n * select transport -> create server -> connect\n *\n * Transports:\n * stdio (default): stdin/stdout JSON-RPC, stdout fence\n * http: Streamable HTTP on configurable port, session-isolated\n */\n\nimport { stat as fsStat, realpath } from 'node:fs/promises';\nimport { Command } from 'commander';\nimport { SERVER_NAME, SERVER_VERSION, MCP_PROTOCOL_VERSION } from './infra/constants.js';\nimport { loadPolicy, getDefaultPolicy, computePolicyHash } from './infra/policy.js';\nimport { loadIssuerKey } from './infra/key-loader.js';\nimport { loadJwksFile } from './infra/jwks-loader.js';\nimport type { JwksKeyEntry } from './infra/jwks-loader.js';\nimport type { PolicyConfig } from './infra/policy.js';\nimport type { LoadedKey } from './infra/key-loader.js';\nimport type { ServerContext } from './handlers/types.js';\nimport { installStdoutFence } from './stdout-fence.js';\nimport { createPeacMcpServer } from './server.js';\nimport type { ServerOptions } from './server.js';\n\nconst program = new Command();\n\nprogram\n .name(SERVER_NAME)\n .version(SERVER_VERSION)\n .description('PEAC receipt operations as MCP tools')\n .option('--issuer-key <ref>', 'Issuer key reference (env:VAR or file:/path)')\n .option('--issuer-id <uri>', 'Issuer identifier URI')\n .option('--policy <path>', 'Policy configuration file path')\n .option('--jwks-file <path>', 'JWKS file for verifier key resolution')\n .option('--bundle-dir <path>', 'Directory for evidence bundle output')\n .option('--transport <type>', 'Transport: stdio (default) or http', 'stdio')\n .option('--port <number>', 'HTTP port (default: 3000, http only)', '3000')\n .option('--host <address>', 'HTTP bind address (default: 127.0.0.1)', '127.0.0.1')\n .option('--cors-origins <list>', 'Allowed CORS origins (comma-separated)')\n .option(\n '--authorization-servers <list>',\n 'OAuth authorization server URIs (enables PRM with --public-url)'\n )\n .option('--public-url <url>', 'Canonical public URL of this server (required for PRM)')\n .option(\n '--trust-proxy <value>',\n 'Trust X-Forwarded-For: off (default), loopback, linklocal, private, all (discouraged), or comma-separated IPs',\n 'off'\n )\n .action(async (opts) => {\n // Validate transport\n const transportType = opts.transport as string;\n if (transportType !== 'stdio' && transportType !== 'http') {\n process.stderr.write(\n `ERROR: --transport must be \"stdio\" or \"http\", got \"${transportType}\"\\n`\n );\n process.exit(1);\n }\n\n // Validate key flag pairing\n if (opts.issuerKey && !opts.issuerId) {\n process.stderr.write('ERROR: --issuer-key requires --issuer-id\\n');\n process.exit(1);\n }\n if (opts.issuerId && !opts.issuerKey) {\n process.stderr.write('ERROR: --issuer-id requires --issuer-key\\n');\n process.exit(1);\n }\n\n // Load policy\n let policy: PolicyConfig;\n let policyHash: string;\n if (opts.policy) {\n const loaded = await loadPolicy(opts.policy);\n policy = loaded.policy;\n policyHash = loaded.hash;\n } else {\n policy = getDefaultPolicy();\n policyHash = await computePolicyHash(JSON.stringify(policy));\n }\n\n // Load issuer key (optional, for issue tool)\n let issuerKey: LoadedKey | undefined;\n if (opts.issuerKey) {\n issuerKey = await loadIssuerKey(opts.issuerKey);\n }\n\n // Load JWKS (optional, for verifier key resolution)\n let jwksKeys: JwksKeyEntry[] | undefined;\n if (opts.jwksFile) {\n jwksKeys = await loadJwksFile(opts.jwksFile);\n }\n\n // Validate bundle-dir (optional, for bundle tool)\n let bundleDir: string | undefined;\n if (opts.bundleDir) {\n try {\n const s = await fsStat(opts.bundleDir);\n if (!s.isDirectory()) {\n process.stderr.write(`ERROR: --bundle-dir is not a directory: ${opts.bundleDir}\\n`);\n process.exit(1);\n }\n bundleDir = await realpath(opts.bundleDir);\n } catch (err) {\n process.stderr.write(\n `ERROR: --bundle-dir not accessible: ${opts.bundleDir} -- ${err instanceof Error ? err.message : String(err)}\\n`\n );\n process.exit(1);\n }\n }\n\n // Build server context\n const context: ServerContext = {\n version: SERVER_VERSION,\n policyHash,\n protocolVersion: MCP_PROTOCOL_VERSION,\n issuerKey,\n jwksKeys,\n issuerId: opts.issuerId,\n bundleDir,\n };\n\n // Compute tool list for banner\n const tools = ['peac_verify', 'peac_inspect', 'peac_decode'];\n if (issuerKey && opts.issuerId) {\n tools.push('peac_issue');\n if (bundleDir) {\n tools.push('peac_create_bundle');\n }\n }\n\n // Server options (shared between stdio and http)\n const serverOptions: ServerOptions = {\n version: SERVER_VERSION,\n policy,\n policyHash,\n protocolVersion: MCP_PROTOCOL_VERSION,\n context,\n };\n\n // Banner to stderr (never stdout)\n process.stderr.write(\n `[${SERVER_NAME}] v${SERVER_VERSION} | protocol ${MCP_PROTOCOL_VERSION}\\n`\n );\n process.stderr.write(` Transport: ${transportType}\\n`);\n process.stderr.write(` Tools: ${tools.join(', ')}\\n`);\n process.stderr.write(` Key: ${issuerKey ? 'loaded' : 'none'}\\n`);\n process.stderr.write(` JWKS: ${jwksKeys ? `${jwksKeys.length} key(s)` : 'none'}\\n`);\n process.stderr.write(` Bundle dir: ${bundleDir ?? 'none'}\\n`);\n process.stderr.write(` Policy hash: ${policyHash.slice(0, 16)}...\\n`);\n\n if (transportType === 'http') {\n // --- HTTP transport ---\n const { createHttpTransport } = await import('./http-transport.js');\n\n const corsOrigins = opts.corsOrigins\n ? (opts.corsOrigins as string).split(',').map((s: string) => s.trim())\n : undefined;\n const authorizationServers = opts.authorizationServers\n ? (opts.authorizationServers as string).split(',').map((s: string) => s.trim())\n : undefined;\n\n const { cleanup } = await createHttpTransport({\n port: parseInt(opts.port as string, 10),\n host: opts.host as string,\n corsOrigins,\n authorizationServers,\n publicUrl: opts.publicUrl as string | undefined,\n trustProxy: (opts.trustProxy as string) || 'off',\n serverFactory: () => createPeacMcpServer(serverOptions),\n });\n\n // Graceful shutdown\n const shutdown = async () => {\n process.stderr.write(`[${SERVER_NAME}] Shutting down...\\n`);\n await cleanup();\n process.exit(0);\n };\n\n process.on('SIGINT', shutdown);\n process.on('SIGTERM', shutdown);\n } else {\n // --- stdio transport (default, unchanged) ---\n const { StdioServerTransport } = await import('@modelcontextprotocol/sdk/server/stdio.js');\n\n // Install stdout fence BEFORE connecting transport\n const teardownFence = installStdoutFence();\n\n const server = createPeacMcpServer(serverOptions);\n const transport = new StdioServerTransport();\n\n // Graceful shutdown\n const shutdown = async () => {\n process.stderr.write(`[${SERVER_NAME}] Shutting down...\\n`);\n await server.close();\n teardownFence();\n process.exit(0);\n };\n\n process.on('SIGINT', shutdown);\n process.on('SIGTERM', shutdown);\n\n await server.connect(transport);\n }\n });\n\nvoid program.parseAsync(process.argv).catch((err: unknown) => {\n process.stderr.write(\n `[${SERVER_NAME}] Fatal: ${err instanceof Error ? err.message : String(err)}\\n`\n );\n process.exit(1);\n});\n","/**\n * MCP Server error hierarchy -- zero external imports\n *\n * Error codes use the E_MCP_* taxonomy for MCP-server-specific errors.\n * Protocol errors (E_INVALID_SIGNATURE, etc.) are passed through as nested detail.\n */\n\nexport type McpServerErrorCode =\n | 'E_MCP_KEY_LOAD'\n | 'E_MCP_POLICY_LOAD'\n | 'E_MCP_JWKS_LOAD'\n | 'E_MCP_INPUT_TOO_LARGE'\n | 'E_MCP_OUTPUT_TOO_LARGE'\n | 'E_MCP_TOOL_DISABLED'\n | 'E_MCP_TOOL_TIMEOUT'\n | 'E_MCP_KEY_RESOLUTION'\n | 'E_MCP_KID_REQUIRED'\n | 'E_MCP_JWKS_NO_MATCH'\n | 'E_MCP_INVALID_INPUT'\n | 'E_MCP_HANDLER_ERROR'\n | 'E_MCP_STDOUT_FENCE_VIOLATION'\n | 'E_MCP_KEY_REQUIRED'\n | 'E_MCP_ISSUE_FAILED'\n | 'E_MCP_BUNDLE_FAILED'\n | 'E_MCP_PATH_TRAVERSAL'\n | 'E_MCP_BUNDLE_DIR_REQUIRED'\n | 'E_MCP_CANCELLED';\n\nexport class McpServerError extends Error {\n readonly code: McpServerErrorCode;\n\n constructor(code: McpServerErrorCode, message: string, options?: ErrorOptions) {\n super(message, options);\n this.name = 'McpServerError';\n this.code = code;\n }\n}\n\nexport class KeyLoadError extends McpServerError {\n constructor(message: string, options?: ErrorOptions) {\n super('E_MCP_KEY_LOAD', message, options);\n this.name = 'KeyLoadError';\n }\n}\n\nexport class PolicyLoadError extends McpServerError {\n constructor(message: string, options?: ErrorOptions) {\n super('E_MCP_POLICY_LOAD', message, options);\n this.name = 'PolicyLoadError';\n }\n}\n\nexport class JwksLoadError extends McpServerError {\n constructor(message: string, options?: ErrorOptions) {\n super('E_MCP_JWKS_LOAD', message, options);\n this.name = 'JwksLoadError';\n }\n}\n\nexport class IssueToolError extends McpServerError {\n constructor(message: string, options?: ErrorOptions) {\n super('E_MCP_ISSUE_FAILED', message, options);\n this.name = 'IssueToolError';\n }\n}\n\nexport class BundleToolError extends McpServerError {\n constructor(message: string, options?: ErrorOptions) {\n super('E_MCP_BUNDLE_FAILED', message, options);\n this.name = 'BundleToolError';\n }\n}\n\nexport class PathTraversalError extends McpServerError {\n constructor(message: string, options?: ErrorOptions) {\n super('E_MCP_PATH_TRAVERSAL', message, options);\n this.name = 'PathTraversalError';\n }\n}\n\n/**\n * Strip key-like material from output strings (Trust Gate 1 helper).\n *\n * Replaces matches of each pattern with `[REDACTED]`.\n */\nexport function sanitizeOutput(text: string, sensitivePatterns: RegExp[]): string {\n let result = text;\n for (const pattern of sensitivePatterns) {\n result = result.replace(pattern, '[REDACTED]');\n }\n return result;\n}\n","/**\n * Static policy loader (load once, hash, never reload)\n */\n\nimport { readFile, stat } from 'node:fs/promises';\nimport { z } from 'zod';\nimport { sha256Hex } from '@peac/crypto';\nimport { PolicyLoadError } from './errors.js';\n\nconst ToolPolicySchema = z.object({\n enabled: z.boolean().default(true),\n allowed_kinds: z.array(z.string()).optional(),\n});\n\nconst RedactionSchema = z.object({\n strip_evidence: z.boolean().default(false),\n strip_payment: z.boolean().default(false),\n inspect_full_claims: z.boolean().default(false),\n});\n\nconst LimitsSchema = z.object({\n max_jws_bytes: z.number().int().positive().default(16_384),\n max_response_bytes: z.number().int().positive().default(65_536),\n tool_timeout_ms: z.number().int().positive().default(30_000),\n max_concurrency: z.number().int().positive().default(10),\n max_claims_bytes: z.number().int().positive().default(262_144),\n max_bundle_receipts: z.number().int().positive().default(256),\n max_bundle_bytes: z.number().int().positive().default(16_777_216),\n max_ttl_seconds: z.number().int().positive().default(86_400),\n});\n\n// JWKS config: file-only. URL fetch is not implemented (SSRF surface).\n// When allow_network + URL fetch is added, gate it behind allow_network\n// with strict allowlist, timeouts, max-size, and no-redirect policy.\nconst JwksConfigSchema = z.object({\n file: z.string().optional(),\n});\n\nexport const PolicySchema = z.object({\n version: z.literal('1'),\n allow_network: z.boolean().default(false),\n redaction: RedactionSchema.prefault({}),\n tools: z.record(z.string(), ToolPolicySchema).prefault({}),\n limits: LimitsSchema.prefault({}),\n jwks: JwksConfigSchema.optional(),\n});\n\nexport type PolicyConfig = z.infer<typeof PolicySchema>;\n\nconst DEFAULT_POLICY: PolicyConfig = {\n version: '1',\n allow_network: false,\n redaction: { strip_evidence: false, strip_payment: false, inspect_full_claims: false },\n tools: {},\n limits: {\n max_jws_bytes: 16_384,\n max_response_bytes: 65_536,\n tool_timeout_ms: 30_000,\n max_concurrency: 10,\n max_claims_bytes: 262_144,\n max_bundle_receipts: 256,\n max_bundle_bytes: 16_777_216,\n max_ttl_seconds: 86_400,\n },\n};\n\nexport function getDefaultPolicy(): PolicyConfig {\n return structuredClone(DEFAULT_POLICY);\n}\n\n/**\n * Deep stable stringify: recursively sorts all object keys at every level\n * so semantically identical policies always produce the same hash regardless\n * of insertion order. Arrays preserve element order (order-significant).\n */\nfunction deepStableStringify(value: unknown): string {\n if (value === null || typeof value !== 'object') {\n return JSON.stringify(value);\n }\n if (Array.isArray(value)) {\n return '[' + value.map(deepStableStringify).join(',') + ']';\n }\n const obj = value as Record<string, unknown>;\n const keys = Object.keys(obj).sort();\n const pairs = keys.map((k) => JSON.stringify(k) + ':' + deepStableStringify(obj[k]));\n return '{' + pairs.join(',') + '}';\n}\n\n/**\n * Compute the policy hash from a canonical JSON representation.\n * Accepts either raw JSON string or a PolicyConfig object.\n * When given a PolicyConfig, uses deep stable stringify (recursive key sort)\n * so semantically identical policies always hash identically.\n */\nexport async function computePolicyHash(input: string | PolicyConfig): Promise<string> {\n const canonical = typeof input === 'string' ? input : deepStableStringify(input);\n return sha256Hex(canonical);\n}\n\nexport async function loadPolicy(\n filePath: string\n): Promise<{ policy: PolicyConfig; hash: string }> {\n let raw: string;\n try {\n raw = await readFile(filePath, 'utf-8');\n } catch (err) {\n throw new PolicyLoadError(\n `Failed to read policy file: ${filePath} -- ${err instanceof Error ? err.message : String(err)}`,\n { cause: err }\n );\n }\n\n // Warn on world-writable permissions (0o002)\n try {\n const s = await stat(filePath);\n if (s.mode & 0o002) {\n process.stderr.write(\n `[peac-mcp-server] WARNING: Policy file ${filePath} is world-writable\\n`\n );\n }\n } catch {\n // stat failure is non-fatal\n }\n\n let parsed: unknown;\n try {\n parsed = JSON.parse(raw);\n } catch (err) {\n throw new PolicyLoadError(`Policy file is not valid JSON: ${filePath}`, { cause: err });\n }\n\n const result = PolicySchema.safeParse(parsed);\n if (!result.success) {\n const issues = result.error.issues.map((i) => `${i.path.join('.')}: ${i.message}`).join('; ');\n throw new PolicyLoadError(`Policy validation failed: ${issues}`);\n }\n\n // Hash the materialized policy (after Zod defaults applied) for determinism\n const hash = await computePolicyHash(result.data);\n return { policy: result.data, hash };\n}\n","/**\n * Issuer key loader (no ambient key discovery)\n *\n * Supports `env:VAR_NAME` and `file:/path` schemes.\n * Reads JWK JSON, validates Ed25519, derives public key.\n * NEVER logs key bytes.\n */\n\nimport { readFile } from 'node:fs/promises';\nimport {\n base64urlDecode,\n base64urlEncode,\n derivePublicKey,\n validateKeypair,\n sha256Hex,\n} from '@peac/crypto';\nimport type { Ed25519PrivateJwk } from '@peac/crypto';\nimport { KeyLoadError } from './errors.js';\n\nexport interface LoadedKey {\n privateKey: Uint8Array;\n publicKey: Uint8Array;\n kid: string;\n}\n\nexport async function loadIssuerKey(schemeUri: string): Promise<LoadedKey> {\n let raw: string;\n\n if (schemeUri.startsWith('env:')) {\n const varName = schemeUri.slice(4);\n const envValue = process.env[varName];\n if (!envValue) {\n throw new KeyLoadError(`Environment variable ${varName} is not set or empty`);\n }\n raw = envValue;\n } else if (schemeUri.startsWith('file:')) {\n const filePath = schemeUri.slice(5);\n try {\n raw = await readFile(filePath, 'utf-8');\n } catch (err) {\n throw new KeyLoadError(\n `Failed to read key file: ${filePath} -- ${err instanceof Error ? err.message : String(err)}`,\n { cause: err }\n );\n }\n } else {\n throw new KeyLoadError(\n `Unsupported key scheme: ${schemeUri} (expected env:VAR_NAME or file:/path)`\n );\n }\n\n let jwk: unknown;\n try {\n jwk = JSON.parse(raw);\n } catch (err) {\n throw new KeyLoadError('Key data is not valid JSON', { cause: err });\n }\n\n // Validate JWK structure\n if (\n typeof jwk !== 'object' ||\n jwk === null ||\n !('kty' in jwk) ||\n !('crv' in jwk) ||\n !('d' in jwk)\n ) {\n throw new KeyLoadError('JWK must contain kty, crv, and d fields');\n }\n\n const j = jwk as Record<string, unknown>;\n if (j.kty !== 'OKP' || j.crv !== 'Ed25519') {\n throw new KeyLoadError(\n `JWK must be Ed25519 (kty: OKP, crv: Ed25519), got kty=${String(j.kty)} crv=${String(j.crv)}`\n );\n }\n\n if (typeof j.d !== 'string' || typeof j.x !== 'string') {\n throw new KeyLoadError('JWK d and x fields must be base64url strings');\n }\n\n const ed25519Jwk: Ed25519PrivateJwk = {\n kty: 'OKP',\n crv: 'Ed25519',\n x: j.x as string,\n d: j.d as string,\n };\n\n // Validate keypair consistency\n const valid = await validateKeypair(ed25519Jwk);\n if (!valid) {\n throw new KeyLoadError('JWK keypair validation failed: d does not derive to x');\n }\n\n const privateKey = base64urlDecode(ed25519Jwk.d);\n const publicKey = await derivePublicKey(privateKey);\n\n // Extract kid. Falls back to a deterministic derivation from the public key\n // (truncated SHA-256 of base64url-encoded public key) so runs are reproducible.\n let kid: string;\n if (typeof j.kid === 'string') {\n kid = j.kid;\n } else {\n const pubB64 = base64urlEncode(publicKey);\n const hash = await sha256Hex(pubB64);\n kid = hash.slice(0, 16);\n }\n\n return { privateKey, publicKey, kid };\n}\n","/**\n * JWKS file loader for verifier-side key resolution\n *\n * Loads a local JWKS JSON file, filters for Ed25519 keys,\n * and provides kid-based lookup.\n */\n\nimport { readFile } from 'node:fs/promises';\nimport { base64urlDecode } from '@peac/crypto';\nimport { JwksLoadError } from './errors.js';\n\nexport interface JwksKeyEntry {\n kid: string;\n publicKey: Uint8Array;\n}\n\nexport async function loadJwksFile(filePath: string): Promise<JwksKeyEntry[]> {\n let raw: string;\n try {\n raw = await readFile(filePath, 'utf-8');\n } catch (err) {\n throw new JwksLoadError(\n `Failed to read JWKS file: ${filePath} -- ${err instanceof Error ? err.message : String(err)}`,\n { cause: err }\n );\n }\n\n let parsed: unknown;\n try {\n parsed = JSON.parse(raw);\n } catch (err) {\n throw new JwksLoadError(`JWKS file is not valid JSON: ${filePath}`, { cause: err });\n }\n\n if (typeof parsed !== 'object' || parsed === null || !('keys' in parsed)) {\n throw new JwksLoadError('JWKS must contain a \"keys\" array');\n }\n\n const jwks = parsed as { keys: unknown[] };\n if (!Array.isArray(jwks.keys)) {\n throw new JwksLoadError('JWKS \"keys\" must be an array');\n }\n\n const entries: JwksKeyEntry[] = [];\n for (const key of jwks.keys) {\n if (typeof key !== 'object' || key === null) continue;\n const k = key as Record<string, unknown>;\n\n // Filter for Ed25519 only (reject non-EdDSA alg values)\n if (k.kty !== 'OKP' || k.crv !== 'Ed25519') continue;\n if (typeof k.x !== 'string') continue;\n if (k.alg !== undefined && k.alg !== 'EdDSA') continue;\n\n const kid = typeof k.kid === 'string' ? k.kid : `key-${entries.length}`;\n try {\n const publicKey = base64urlDecode(k.x);\n if (publicKey.length === 32) {\n entries.push({ kid, publicKey });\n }\n } catch {\n // Skip keys with invalid base64url encoding\n }\n }\n\n return entries;\n}\n\nexport function resolveKeyByKid(keys: JwksKeyEntry[], kid: string): Uint8Array | undefined {\n const entry = keys.find((k) => k.kid === kid);\n return entry?.publicKey;\n}\n","/**\n * Stdout fence (line-buffered JSON-RPC validator)\n *\n * Monkey-patches process.stdout.write at startup.\n * Buffers bytes, splits on newline, validates each complete line\n * as JSON-RPC 2.0. Invalid lines cause a fail-fast throw.\n *\n * Returns a teardown function that restores the original write.\n */\n\nimport { McpServerError } from './infra/errors.js';\n\ntype WriteCallback = (err?: Error | null) => void;\n\n// 4 MB max line/buffer length -- prevents memory exhaustion from\n// unbounded writes without newlines or a single huge JSON-RPC message\nconst MAX_LINE_BYTES = 4 * 1024 * 1024;\n\nexport function installStdoutFence(): () => void {\n const originalWrite = process.stdout.write.bind(process.stdout);\n let buffer = '';\n let bufferBytes = 0;\n\n function validateJsonRpcLine(line: string): void {\n // Guard: reject lines that exceed the byte budget before attempting JSON.parse\n const lineBytes = new TextEncoder().encode(line).length;\n if (lineBytes > MAX_LINE_BYTES) {\n throw new McpServerError(\n 'E_MCP_STDOUT_FENCE_VIOLATION',\n `Stdout fence: line is ${lineBytes} bytes, exceeding limit of ${MAX_LINE_BYTES}`\n );\n }\n\n let parsed: unknown;\n try {\n parsed = JSON.parse(line);\n } catch {\n throw new McpServerError(\n 'E_MCP_STDOUT_FENCE_VIOLATION',\n `Stdout fence: non-JSON line detected: ${line.slice(0, 100)}`\n );\n }\n\n if (typeof parsed !== 'object' || parsed === null) {\n throw new McpServerError(\n 'E_MCP_STDOUT_FENCE_VIOLATION',\n `Stdout fence: non-JSON-RPC 2.0 object on stdout: ${line.slice(0, 100)}`\n );\n }\n\n const obj = parsed as Record<string, unknown>;\n\n if (obj.jsonrpc !== '2.0') {\n throw new McpServerError(\n 'E_MCP_STDOUT_FENCE_VIOLATION',\n `Stdout fence: non-JSON-RPC 2.0 object on stdout: ${line.slice(0, 100)}`\n );\n }\n\n // Require valid JSON-RPC 2.0 response shape: id + (result or error),\n // or a notification (method without id). Reject anything else.\n const hasId = 'id' in obj;\n const hasResult = 'result' in obj;\n const hasError = 'error' in obj;\n const hasMethod = 'method' in obj;\n\n if (hasId && (hasResult || hasError)) {\n // Valid response\n return;\n }\n if (hasMethod && !hasId) {\n // Valid notification (server -> client, e.g. notifications/*)\n return;\n }\n\n throw new McpServerError(\n 'E_MCP_STDOUT_FENCE_VIOLATION',\n `Stdout fence: malformed JSON-RPC 2.0 message (expected response or notification): ${line.slice(0, 100)}`\n );\n }\n\n function processBuffer(): void {\n const lines = buffer.split('\\n');\n // Keep the last segment (incomplete line or empty string after trailing newline)\n buffer = lines.pop()!;\n bufferBytes = new TextEncoder().encode(buffer).length;\n\n for (const line of lines) {\n const trimmed = line.trim();\n if (trimmed.length === 0) continue; // skip blank lines\n validateJsonRpcLine(trimmed);\n }\n }\n\n const patchedWrite = function (\n chunk: string | Uint8Array,\n encodingOrCallback?: BufferEncoding | WriteCallback,\n callback?: WriteCallback\n ): boolean {\n // Normalize arguments\n let encoding: BufferEncoding | undefined;\n let cb: WriteCallback | undefined;\n\n if (typeof encodingOrCallback === 'function') {\n cb = encodingOrCallback;\n } else {\n encoding = encodingOrCallback;\n cb = callback;\n }\n\n // Convert chunk to string\n const str = typeof chunk === 'string' ? chunk : new TextDecoder().decode(chunk);\n\n // Cap buffer growth before appending -- prevents memory exhaustion from\n // writes that never include a newline (e.g. broken serializer)\n const chunkBytes = new TextEncoder().encode(str).length;\n if (bufferBytes + chunkBytes > MAX_LINE_BYTES) {\n throw new McpServerError(\n 'E_MCP_STDOUT_FENCE_VIOLATION',\n `Stdout fence: buffer exceeded ${MAX_LINE_BYTES} bytes without a newline`\n );\n }\n\n buffer += str;\n bufferBytes += chunkBytes;\n processBuffer();\n\n // Forward to original write\n if (encoding) {\n return originalWrite(chunk, encoding, cb);\n }\n return originalWrite(chunk, cb as WriteCallback);\n };\n\n process.stdout.write = patchedWrite as typeof process.stdout.write;\n\n // Teardown: flush remaining buffer, restore original\n return function teardown(): void {\n // Validate any remaining buffered content\n if (buffer.trim().length > 0) {\n validateJsonRpcLine(buffer.trim());\n }\n buffer = '';\n bufferBytes = 0;\n process.stdout.write = originalWrite;\n };\n}\n","/**\n * MCP Server binding -- ONLY file importing @modelcontextprotocol/sdk\n *\n * Registers pure tool handlers with the MCP server.\n * Injects _meta audit block into every response.\n */\n\nimport { McpServer } from '@modelcontextprotocol/sdk/server/mcp.js';\nimport type { CallToolResult, ToolAnnotations } from '@modelcontextprotocol/sdk/types.js';\nimport { ERRORS } from '@peac/kernel';\nimport { SERVER_NAME } from './infra/constants.js';\nimport type { PolicyConfig } from './infra/policy.js';\nimport type { ServerContext, HandlerResult } from './handlers/types.js';\nimport { handleVerify } from './handlers/verify.js';\nimport { handleInspect } from './handlers/inspect.js';\nimport { handleDecode } from './handlers/decode.js';\nimport { handleIssue } from './handlers/issue.js';\nimport { handleCreateBundle } from './handlers/bundle.js';\nimport { checkInputSizes, checkObjectDepth, measureEnvelopeBytes } from './handlers/guards.js';\nimport type { VerifyInput } from './schemas/verify.js';\nimport type { InspectInput } from './schemas/inspect.js';\nimport type { DecodeInput } from './schemas/decode.js';\nimport type { IssueInput } from './schemas/issue.js';\nimport type { BundleInput } from './schemas/bundle.js';\nimport { VerifyInputSchema, VerifyOutputSchema } from './schemas/verify.js';\nimport { InspectInputSchema, InspectOutputSchema } from './schemas/inspect.js';\nimport { DecodeInputSchema, DecodeOutputSchema } from './schemas/decode.js';\nimport { IssueInputSchema, IssueOutputSchema } from './schemas/issue.js';\nimport { BundleInputSchema, BundleOutputSchema } from './schemas/bundle.js';\n\nexport interface ServerOptions {\n version: string;\n policy: PolicyConfig;\n policyHash: string;\n protocolVersion: string;\n context: ServerContext;\n}\n\nfunction makeMeta(ctx: ServerContext, serverName: string): Record<string, unknown> {\n return {\n serverName,\n serverVersion: ctx.version,\n policyHash: ctx.policyHash,\n protocolVersion: ctx.protocolVersion,\n wireFormatVersion: '0.2',\n };\n}\n\nfunction handlerResultToCallToolResult(\n result: HandlerResult,\n meta: Record<string, unknown>\n): CallToolResult {\n return {\n content: [{ type: 'text' as const, text: result.text }],\n structuredContent: { _meta: meta, ...result.structured },\n isError: result.isError,\n };\n}\n\nconst PURE_TOOL_ANNOTATIONS: ToolAnnotations = {\n readOnlyHint: true,\n destructiveHint: false,\n idempotentHint: true,\n openWorldHint: false,\n};\n\n// peac_issue: pure in-memory signing, no filesystem or network side-effects.\n// readOnlyHint: true -- produces a JWS string, does not mutate state.\n// idempotentHint: false -- each call includes a fresh `iat` timestamp.\n// openWorldHint: false -- closed world; no external I/O or filesystem access.\nconst ISSUE_TOOL_ANNOTATIONS: ToolAnnotations = {\n readOnlyHint: true,\n destructiveHint: false,\n idempotentHint: false,\n openWorldHint: false,\n};\n\nconst BUNDLE_TOOL_ANNOTATIONS: ToolAnnotations = {\n readOnlyHint: false,\n destructiveHint: true,\n idempotentHint: false,\n openWorldHint: true,\n};\n\nconst MAX_INPUT_DEPTH = 10;\n\nfunction errorCallToolResult(\n meta: Record<string, unknown>,\n code: string,\n message: string\n): CallToolResult {\n const errorDef = ERRORS[code];\n return {\n content: [{ type: 'text' as const, text: message }],\n structuredContent: {\n _meta: meta,\n ok: false,\n code,\n message,\n retryable: errorDef?.retryable ?? false,\n next_action: errorDef?.next_action ?? 'none',\n },\n isError: true,\n };\n}\n\n/**\n * Narrowed type for McpServer.registerTool that avoids TS2589\n * deep instantiation errors from cross-version Zod generics.\n *\n * The MCP SDK and our workspace may pin different Zod versions.\n * Zod schema objects are structurally identical at runtime (the SDK\n * duck-types via _def presence check), but TypeScript cannot resolve\n * the deep generic chain across version boundaries.\n *\n * This type accurately describes the runtime contract: inputSchema\n * accepts any object with Zod-like structure (which our schemas are).\n * See package.json for actual pinned versions.\n */\ntype RegisterToolBridge = (\n name: string,\n config: {\n title?: string;\n description?: string;\n inputSchema?: unknown;\n outputSchema?: unknown;\n annotations?: ToolAnnotations;\n },\n cb: (args: Record<string, unknown>, extra: Record<string, unknown>) => Promise<CallToolResult>\n) => unknown;\n\nexport function createPeacMcpServer(options: ServerOptions): McpServer {\n const { version, policy, context } = options;\n\n // Compute registered tool list upfront for capability discovery\n const registeredTools = ['peac_verify', 'peac_inspect', 'peac_decode'];\n if (context.issuerKey && context.issuerId) {\n registeredTools.push('peac_issue');\n if (context.bundleDir) {\n registeredTools.push('peac_create_bundle');\n }\n }\n\n const meta = { ...makeMeta(context, SERVER_NAME), registeredTools };\n const maxConcurrency = policy.limits.max_concurrency;\n let activeHandlers = 0;\n\n async function wrapHandler(\n toolName: string,\n args: Record<string, unknown>,\n handlerFn: (signal?: AbortSignal) => Promise<HandlerResult>,\n signal?: AbortSignal\n ): Promise<CallToolResult> {\n // Cancellation: if already aborted before we start, return immediately\n if (signal?.aborted) {\n return errorCallToolResult(meta, 'E_MCP_CANCELLED', 'Request cancelled');\n }\n\n // Concurrency guard\n if (activeHandlers >= maxConcurrency) {\n return errorCallToolResult(\n meta,\n 'E_MCP_CONCURRENCY_LIMIT',\n `Server at capacity (${maxConcurrency} concurrent handlers)`\n );\n }\n\n // Input depth guard\n if (!checkObjectDepth(args, MAX_INPUT_DEPTH)) {\n return errorCallToolResult(\n meta,\n 'E_MCP_INPUT_TOO_DEEP',\n `Input exceeds maximum nesting depth of ${MAX_INPUT_DEPTH}`\n );\n }\n\n // Input size guard (recursive sum of all string bytes)\n const inputSizeResult = checkInputSizes(args, policy);\n if (inputSizeResult) {\n return handlerResultToCallToolResult(inputSizeResult, meta);\n }\n\n // Reserve concurrency slot. Released when the handler settles (not when\n // timeout fires), so inflight CPU work stays bounded by maxConcurrency.\n // The slot release is detached -- wrapHandler returns the timeout error\n // immediately without waiting for the handler to finish.\n //\n // IMPORTANT: If a handler promise never settles, the concurrency slot is\n // permanently leaked. This is by design -- Node.js cannot forcibly cancel\n // arbitrary user code. All built-in handlers (verify, inspect, decode) are\n // pure synchronous-ish operations that will always settle. Future handlers\n // with network I/O should accept AbortSignal and honor cancellation.\n // If leaked slots become an operational concern, add a watchdog that logs\n // when a handler exceeds 2x tool_timeout_ms without settling.\n activeHandlers++;\n const handlerPromise = handlerFn(signal);\n\n // Detached slot release: fires when handler settles, regardless of timeout.\n // The void + catch ensure no unhandled rejection if handler throws.\n void handlerPromise\n .finally(() => {\n activeHandlers--;\n })\n .catch(() => {});\n\n // Timeout + cancellation race -- handlerPromise keeps running even if\n // timeout or cancellation fires. Timer is cleared when the handler\n // resolves to avoid unnecessary timers accumulating under load.\n let timedOut = false;\n let cancelled = false;\n let timer: ReturnType<typeof setTimeout> | undefined;\n const timeoutPromise = new Promise<never>((_resolve, reject) => {\n timer = setTimeout(() => {\n timedOut = true;\n reject(new Error(`Tool \"${toolName}\" timed out after ${policy.limits.tool_timeout_ms}ms`));\n }, policy.limits.tool_timeout_ms);\n // Prevent timeout timer from keeping Node.js alive during shutdown\n timer.unref?.();\n });\n\n // Build race participants: handler vs timeout vs (optional) cancellation\n const raceParticipants: Promise<HandlerResult>[] = [handlerPromise, timeoutPromise];\n\n let abortCleanup: (() => void) | undefined;\n if (signal && !signal.aborted) {\n const cancelPromise = new Promise<never>((_resolve, reject) => {\n const onAbort = () => {\n cancelled = true;\n reject(new Error('Request cancelled'));\n };\n signal.addEventListener('abort', onAbort, { once: true });\n abortCleanup = () => signal.removeEventListener('abort', onAbort);\n });\n raceParticipants.push(cancelPromise);\n }\n\n try {\n const result = await Promise.race(raceParticipants);\n\n // Output size cap -- measure the full JSON-RPC envelope that will be\n // serialized to stdout, not just the tool result. This is the actual\n // risk surface for downstream clients parsing the response line.\n // Uses conservative UUID-length id placeholder (default) since the\n // MCP SDK doesn't expose the request id to tool handlers.\n const callResult = handlerResultToCallToolResult(result, meta);\n const outputBytes = measureEnvelopeBytes(callResult);\n if (outputBytes > policy.limits.max_response_bytes) {\n return errorCallToolResult(\n meta,\n 'E_MCP_OUTPUT_TOO_LARGE',\n `Response is ${outputBytes} bytes, exceeding limit of ${policy.limits.max_response_bytes}`\n );\n }\n\n return callResult;\n } catch (err) {\n const message = err instanceof Error ? err.message : String(err);\n if (cancelled) {\n return errorCallToolResult(meta, 'E_MCP_CANCELLED', 'Request cancelled');\n }\n if (timedOut) {\n return errorCallToolResult(meta, 'E_MCP_TOOL_TIMEOUT', message);\n }\n return errorCallToolResult(meta, 'E_MCP_INTERNAL', message);\n } finally {\n clearTimeout(timer);\n abortCleanup?.();\n }\n }\n\n const server = new McpServer(\n { name: SERVER_NAME, version },\n // listChanged: false -- tool set is static per server instance (determined\n // at startup from CLI flags). The server never emits notifications/tools/list_changed.\n { capabilities: { tools: { listChanged: false } } }\n );\n\n // Bind with narrowed types to bridge workspace Zod <-> SDK Zod boundary\n const register = server.registerTool.bind(server) as RegisterToolBridge;\n\n // -- peac_verify --\n register(\n 'peac_verify',\n {\n title: 'Verify PEAC Receipt',\n description:\n 'Verify a PEAC receipt: check Ed25519 signature, validate claims, and return structured check results. Read-only, no side effects.',\n inputSchema: VerifyInputSchema,\n outputSchema: VerifyOutputSchema,\n annotations: PURE_TOOL_ANNOTATIONS,\n },\n async (args, extra) =>\n wrapHandler(\n 'peac_verify',\n args,\n (signal) => handleVerify({ input: args as VerifyInput, policy, context, signal }),\n (extra as { signal?: AbortSignal }).signal\n )\n );\n\n // -- peac_inspect --\n register(\n 'peac_inspect',\n {\n title: 'Inspect PEAC Receipt',\n description:\n 'Inspect a PEAC receipt without verifying the signature. Returns decoded header, payload metadata, and timestamps. Read-only.',\n inputSchema: InspectInputSchema,\n outputSchema: InspectOutputSchema,\n annotations: PURE_TOOL_ANNOTATIONS,\n },\n async (args, extra) =>\n wrapHandler(\n 'peac_inspect',\n args,\n (signal) => handleInspect({ input: args as InspectInput, policy, context, signal }),\n (extra as { signal?: AbortSignal }).signal\n )\n );\n\n // -- peac_decode --\n register(\n 'peac_decode',\n {\n title: 'Decode PEAC Receipt',\n description:\n 'Raw-decode a PEAC receipt JWS into header and payload objects. No signature check. Use peac_verify for trusted results.',\n inputSchema: DecodeInputSchema,\n outputSchema: DecodeOutputSchema,\n annotations: PURE_TOOL_ANNOTATIONS,\n },\n async (args, extra) =>\n wrapHandler(\n 'peac_decode',\n args,\n (signal) => handleDecode({ input: args as DecodeInput, policy, context, signal }),\n (extra as { signal?: AbortSignal }).signal\n )\n );\n\n // -- Privileged tools (conditionally registered) --\n\n // peac_issue: requires issuerKey + issuerId\n if (context.issuerKey && context.issuerId) {\n register(\n 'peac_issue',\n {\n title: 'Issue Wire 0.2 PEAC Receipt',\n description:\n 'Sign and return a Wire 0.2 PEAC receipt JWS. Accepts kind, type, pillars, extensions, and policy fields. Wire 0.2 only: Wire 0.1 fields are not accepted. Requires server configured with an Ed25519 issuer key (--issuer-key and --issuer-id).',\n inputSchema: IssueInputSchema,\n outputSchema: IssueOutputSchema,\n annotations: ISSUE_TOOL_ANNOTATIONS,\n },\n async (args, extra) =>\n wrapHandler(\n 'peac_issue',\n args,\n (signal) => handleIssue({ input: args as IssueInput, policy, context, signal }),\n (extra as { signal?: AbortSignal }).signal\n )\n );\n\n // peac_create_bundle: additionally requires bundleDir\n if (context.bundleDir) {\n register(\n 'peac_create_bundle',\n {\n title: 'Create Evidence Bundle',\n description:\n 'Create a signed evidence bundle directory from one or more receipt JWS strings. Writes files to disk. Requires --issuer-key, --issuer-id, and --bundle-dir.',\n inputSchema: BundleInputSchema,\n outputSchema: BundleOutputSchema,\n annotations: BUNDLE_TOOL_ANNOTATIONS,\n },\n async (args, extra) =>\n wrapHandler(\n 'peac_create_bundle',\n args,\n (signal) => handleCreateBundle({ input: args as BundleInput, policy, context, signal }),\n (extra as { signal?: AbortSignal }).signal\n )\n );\n }\n }\n\n return server;\n}\n\nexport { McpServer };\n","/**\n * Handler guards -- enforces policy limits and tool enablement\n *\n * ZERO MCP SDK imports.\n */\n\nimport type { PolicyConfig } from '../infra/policy.js';\nimport type { HandlerResult } from './types.js';\n\n/**\n * Check if the JWS input exceeds the configured max size.\n * Returns an error result if too large, undefined if OK.\n */\nexport function checkJwsSize(jws: string, policy: PolicyConfig): HandlerResult | undefined {\n const byteLength = new TextEncoder().encode(jws).length;\n if (byteLength > policy.limits.max_jws_bytes) {\n return {\n text: `Input rejected: JWS is ${byteLength} bytes, exceeding limit of ${policy.limits.max_jws_bytes} bytes`,\n structured: {\n ok: false,\n code: 'E_MCP_INPUT_TOO_LARGE',\n message: `JWS input is ${byteLength} bytes, limit is ${policy.limits.max_jws_bytes}`,\n },\n isError: true,\n };\n }\n return undefined;\n}\n\n/**\n * Check if the tool is enabled in policy.\n * Returns an error result if disabled, undefined if OK.\n */\nexport function checkToolEnabled(\n toolName: string,\n policy: PolicyConfig\n): HandlerResult | undefined {\n const toolConfig = policy.tools[toolName];\n if (toolConfig && toolConfig.enabled === false) {\n return {\n text: `Tool \"${toolName}\" is disabled by server policy`,\n structured: {\n ok: false,\n code: 'E_MCP_TOOL_DISABLED',\n message: `Tool \"${toolName}\" is disabled by server policy`,\n },\n isError: true,\n };\n }\n return undefined;\n}\n\n/**\n * Recursively sum byte lengths of all string values in an object graph.\n * Depth is bounded by checkObjectDepth (called first in wrapHandler).\n * Uses a WeakSet to guard against cyclic references.\n */\nfunction sumStringBytes(value: unknown, seen?: WeakSet<object>): number {\n if (typeof value === 'string') {\n return new TextEncoder().encode(value).length;\n }\n if (typeof value !== 'object' || value === null) return 0;\n\n // Cycle guard: skip objects we've already visited\n const visited = seen ?? new WeakSet<object>();\n if (visited.has(value as object)) return 0;\n visited.add(value as object);\n\n if (Array.isArray(value)) {\n let total = 0;\n for (const item of value) {\n total += sumStringBytes(item, visited);\n }\n return total;\n }\n let total = 0;\n for (const v of Object.values(value as Record<string, unknown>)) {\n total += sumStringBytes(v, visited);\n }\n return total;\n}\n\n/**\n * Bounded serialized-size estimator. Walks the object graph and estimates\n * JSON serialized bytes WITHOUT materializing the full string. Aborts early\n * when the estimate exceeds the limit (returns Infinity). This prevents\n * memory exhaustion from adversarial inputs with many small non-string values\n * (e.g. large arrays of numbers) that would bypass string-only counting.\n *\n * Accuracy: conservative overestimate for numbers (uses String(n).length),\n * exact for strings (JSON.stringify escapes), exact for structural overhead.\n * Uses a WeakSet cycle guard consistent with sumStringBytes.\n */\nfunction estimateSerializedBytes(value: unknown, limit: number, seen?: WeakSet<object>): number {\n if (value === null) return 4; // \"null\"\n if (value === undefined) return 0; // omitted in JSON\n if (typeof value === 'boolean') return value ? 4 : 5; // \"true\" / \"false\"\n if (typeof value === 'number') return String(value).length;\n if (typeof value === 'string') return Buffer.byteLength(JSON.stringify(value), 'utf8');\n\n if (typeof value !== 'object') return 0;\n\n const visited = seen ?? new WeakSet<object>();\n if (visited.has(value as object)) return 0;\n visited.add(value as object);\n\n let total = 2; // {} or []\n\n if (Array.isArray(value)) {\n for (let i = 0; i < value.length; i++) {\n if (i > 0) total += 1; // comma\n total += estimateSerializedBytes(value[i], limit, visited);\n if (total > limit) return Infinity; // early exit\n }\n return total;\n }\n\n const entries = Object.entries(value as Record<string, unknown>);\n for (let i = 0; i < entries.length; i++) {\n if (i > 0) total += 1; // comma\n const [k, v] = entries[i];\n total += Buffer.byteLength(JSON.stringify(k), 'utf8') + 1; // key + colon\n total += estimateSerializedBytes(v, limit, visited);\n if (total > limit) return Infinity; // early exit\n }\n return total;\n}\n\n/**\n * Check total input size across all string fields (recursive).\n * Prevents memory exhaustion from oversized jwks, public_key_base64url, etc.\n * Traverses the full object graph so nested payloads cannot bypass the limit.\n * Uses 2x max_jws_bytes as the total budget.\n *\n * Also applies a bounded serialized-size estimate (without materializing\n * the full JSON string) to catch large non-string structures like arrays\n * of numbers that bypass string-only counting.\n */\nexport function checkInputSizes(\n input: Record<string, unknown>,\n policy: PolicyConfig\n): HandlerResult | undefined {\n const limit = policy.limits.max_jws_bytes * 2;\n\n // Primary check: recursive string byte sum\n const totalBytes = sumStringBytes(input);\n if (totalBytes > limit) {\n return {\n text: `Input rejected: total input is ${totalBytes} bytes, exceeding limit of ${limit} bytes`,\n structured: {\n ok: false,\n code: 'E_MCP_INPUT_TOO_LARGE',\n message: `Total input is ${totalBytes} bytes, limit is ${limit}`,\n },\n isError: true,\n };\n }\n\n // Fallback: bounded serialized-size estimate catches large non-string structures\n // without materializing the full JSON string (prevents allocation attacks)\n const estimatedBytes = estimateSerializedBytes(input, limit);\n if (estimatedBytes > limit) {\n return {\n text: `Input rejected: estimated serialized input exceeds limit of ${limit} bytes`,\n structured: {\n ok: false,\n code: 'E_MCP_INPUT_TOO_LARGE',\n message: `Estimated serialized input exceeds limit of ${limit} bytes`,\n },\n isError: true,\n };\n }\n\n return undefined;\n}\n\n/**\n * Check that an object does not exceed maximum nesting depth.\n * Prevents stack overflow from deeply nested input params.\n */\nexport function checkObjectDepth(\n obj: unknown,\n maxDepth: number = 10,\n currentDepth: number = 0\n): boolean {\n if (currentDepth > maxDepth) return false;\n if (typeof obj !== 'object' || obj === null) return true;\n if (Array.isArray(obj)) {\n return obj.every((item) => checkObjectDepth(item, maxDepth, currentDepth + 1));\n }\n return Object.values(obj as Record<string, unknown>).every((value) =>\n checkObjectDepth(value, maxDepth, currentDepth + 1)\n );\n}\n\n/**\n * Conservative placeholder id for envelope size estimation.\n * The MCP SDK does not expose the JSON-RPC request id to tool handlers,\n * so we budget for a typical UUID-length string id (36 chars + quotes = 38\n * bytes in JSON). This ensures the size cap is never underestimated due to\n * a longer-than-expected id from the client.\n */\nconst CONSERVATIVE_ID_PLACEHOLDER = '00000000-0000-0000-0000-000000000000';\n\n/**\n * Measure the byte length of a full JSON-RPC 2.0 response envelope.\n * This models the exact line that will be serialized to stdout by the\n * MCP SDK, including the request id and trailing newline.\n *\n * The +1 accounts for the line-feed delimiter that separates JSON-RPC\n * messages on the stdio transport.\n */\nexport function measureEnvelopeBytes(\n callToolResult: {\n content: unknown;\n structuredContent?: unknown;\n isError?: boolean;\n },\n id: string | number = CONSERVATIVE_ID_PLACEHOLDER\n): number {\n const envelope = {\n jsonrpc: '2.0',\n id,\n result: {\n content: callToolResult.content,\n structuredContent: callToolResult.structuredContent,\n isError: callToolResult.isError,\n },\n };\n return Buffer.byteLength(JSON.stringify(envelope), 'utf8') + 1; // +1 for \\n\n}\n\nexport interface TruncationResult {\n text: string;\n truncated: boolean;\n originalBytes: number;\n returnedBytes: number;\n}\n\nconst TRUNCATION_SUFFIX = '\\n\\n[TRUNCATED: response exceeded policy limit]';\nconst TRUNCATION_SUFFIX_BYTES = new TextEncoder().encode(TRUNCATION_SUFFIX).length;\n\n/**\n * Truncate response text to stay within max_response_bytes.\n * Guarantees the final byte length is <= maxBytes by computing the\n * suffix size exactly and slicing the body budget accordingly.\n * Returns truncation metadata for structured output signaling.\n */\nexport function truncateResponse(text: string, policy: PolicyConfig): TruncationResult {\n const maxBytes = policy.limits.max_response_bytes;\n const encoded = new TextEncoder().encode(text);\n if (encoded.length <= maxBytes) {\n return { text, truncated: false, originalBytes: encoded.length, returnedBytes: encoded.length };\n }\n\n // Budget for body = maxBytes - suffix bytes. If maxBytes is tiny,\n // clamp to 0 so we still return the suffix as signal.\n const bodyBudget = Math.max(0, maxBytes - TRUNCATION_SUFFIX_BYTES);\n // Truncate at byte boundary, avoiding mid-character cuts via TextDecoder\n const truncatedText = new TextDecoder().decode(encoded.slice(0, bodyBudget));\n const finalText = truncatedText + TRUNCATION_SUFFIX;\n const finalEncoded = new TextEncoder().encode(finalText);\n return {\n text: finalText,\n truncated: true,\n originalBytes: encoded.length,\n returnedBytes: finalEncoded.length,\n };\n}\n","/**\n * Verify handler -- ZERO MCP SDK imports\n *\n * Resolves key from input or context, delegates to verifyLocal.\n *\n * Append-only check name registry (stable contract):\n * signature, schema, expiry, issuer_binding, audience_binding\n */\n\nimport { verifyLocal } from '@peac/protocol';\nimport { base64urlDecode, decode } from '@peac/crypto';\nimport type { HandlerParams, HandlerResult } from './types.js';\nimport type { VerifyInput } from '../schemas/verify.js';\nimport { resolveKeyByKid } from '../infra/jwks-loader.js';\nimport { checkJwsSize, checkToolEnabled, truncateResponse } from './guards.js';\n\nfunction resolvePublicKey(params: HandlerParams<VerifyInput>): {\n publicKey: Uint8Array;\n keySource: string;\n} {\n const { input, context } = params;\n\n // Priority 1: inline public key\n if (input.public_key_base64url) {\n return {\n publicKey: base64urlDecode(input.public_key_base64url),\n keySource: 'inline',\n };\n }\n\n // Priority 2: inline JWKS\n if (input.jwks) {\n const jwks = JSON.parse(input.jwks) as { keys?: Array<Record<string, unknown>> };\n if (!jwks.keys?.length) {\n throw new Error('Provided JWKS contains no keys');\n }\n\n const { header } = decode(input.jws);\n const kid = header.kid;\n\n // Collect Ed25519 keys (reject non-EdDSA alg values)\n const ed25519Keys = jwks.keys.filter(\n (k) =>\n k.kty === 'OKP' &&\n k.crv === 'Ed25519' &&\n typeof k.x === 'string' &&\n (k.alg === undefined || k.alg === 'EdDSA')\n );\n\n if (ed25519Keys.length === 0) {\n throw new Error('Provided JWKS contains no Ed25519 keys');\n }\n\n // If kid present, match by kid\n if (kid) {\n const matched = ed25519Keys.find((k) => k.kid === kid);\n if (matched) {\n return {\n publicKey: base64urlDecode(matched.x as string),\n keySource: 'inline-jwks',\n };\n }\n throw Object.assign(\n new Error(`No matching Ed25519 key found in provided JWKS for kid=\"${kid}\"`),\n { errorCode: 'E_MCP_JWKS_NO_MATCH' as const }\n );\n }\n\n // No kid: single-key fallback\n if (ed25519Keys.length === 1) {\n return {\n publicKey: base64urlDecode(ed25519Keys[0].x as string),\n keySource: 'inline-jwks',\n };\n }\n\n throw Object.assign(\n new Error(\n `JWS has no kid and JWKS contains ${ed25519Keys.length} Ed25519 keys -- provide kid to select`\n ),\n { errorCode: 'E_MCP_KID_REQUIRED' as const }\n );\n }\n\n // Priority 3: server-configured JWKS\n if (context.jwksKeys?.length) {\n const { header } = decode(input.jws);\n const kid = header.kid;\n\n if (kid) {\n const key = resolveKeyByKid(context.jwksKeys, kid);\n if (key) {\n return { publicKey: key, keySource: 'server-jwks' };\n }\n throw Object.assign(new Error(`No matching key in server JWKS for kid=\"${kid}\"`), {\n errorCode: 'E_MCP_JWKS_NO_MATCH' as const,\n });\n }\n\n // No kid: single-key fallback\n if (context.jwksKeys.length === 1) {\n return { publicKey: context.jwksKeys[0].publicKey, keySource: 'server-jwks' };\n }\n\n throw Object.assign(\n new Error(\n `JWS has no kid and server JWKS contains ${context.jwksKeys.length} keys -- provide kid to select`\n ),\n { errorCode: 'E_MCP_KID_REQUIRED' as const }\n );\n }\n\n throw Object.assign(\n new Error(\n 'No public key available: provide public_key_base64url, jwks, or configure --jwks-file'\n ),\n { errorCode: 'E_MCP_KEY_RESOLUTION' as const }\n );\n}\n\nexport async function handleVerify(params: HandlerParams<VerifyInput>): Promise<HandlerResult> {\n const { input, policy } = params;\n\n // Guard: tool enablement\n const disabledResult = checkToolEnabled('peac_verify', policy);\n if (disabledResult) return disabledResult;\n\n // Guard: JWS size limit\n const sizeResult = checkJwsSize(input.jws, policy);\n if (sizeResult) return sizeResult;\n\n let publicKey: Uint8Array;\n let keySource: string;\n try {\n const resolved = resolvePublicKey(params);\n publicKey = resolved.publicKey;\n keySource = resolved.keySource;\n } catch (err) {\n const code =\n ((err as Record<string, unknown>).errorCode as string | undefined) ?? 'E_MCP_KEY_RESOLUTION';\n return {\n text: `Verification failed: ${err instanceof Error ? err.message : String(err)}`,\n structured: {\n ok: false,\n code,\n message: err instanceof Error ? err.message : String(err),\n checks: [],\n },\n isError: true,\n };\n }\n\n const result = await verifyLocal(input.jws, publicKey, {\n issuer: input.issuer,\n audience: input.audience,\n });\n\n if (result.valid) {\n const checks = [\n { name: 'signature', passed: true },\n { name: 'schema', passed: true },\n { name: 'expiry', passed: true },\n ];\n\n if (input.issuer) {\n checks.push({ name: 'issuer_binding', passed: true });\n }\n if (input.audience) {\n checks.push({ name: 'audience_binding', passed: true });\n }\n\n const claims = result.claims as Record<string, unknown>;\n const claimsSummary: Record<string, unknown> = {\n iss: claims.iss,\n kind: claims.kind,\n type: claims.type,\n jti: claims.jti,\n ...(claims.sub !== undefined && { sub: claims.sub }),\n variant: result.variant,\n wireVersion: result.wireVersion,\n };\n\n const tr = truncateResponse(\n `Verification PASSED (${result.variant} receipt, kind=${claims.kind ?? 'unknown'}, kid=${result.kid})`,\n policy\n );\n return {\n text: tr.text,\n structured: {\n ok: true,\n variant: result.variant,\n checks,\n claimsSummary,\n keySource,\n ...(tr.truncated\n ? {\n _truncation: {\n truncated: tr.truncated,\n originalBytes: tr.originalBytes,\n returnedBytes: tr.returnedBytes,\n },\n }\n : {}),\n },\n };\n }\n\n // Failure case\n const checks: Array<{ name: string; passed: boolean; message?: string }> = [];\n if (result.code === 'E_INVALID_SIGNATURE') {\n checks.push({ name: 'signature', passed: false, message: result.message });\n } else if (result.code === 'E_INVALID_FORMAT') {\n checks.push({ name: 'signature', passed: true });\n checks.push({ name: 'schema', passed: false, message: result.message });\n } else if (result.code === 'E_EXPIRED') {\n checks.push({ name: 'signature', passed: true });\n checks.push({ name: 'schema', passed: true });\n checks.push({ name: 'expiry', passed: false, message: result.message });\n } else if (result.code === 'E_INVALID_ISSUER') {\n checks.push({ name: 'signature', passed: true });\n checks.push({ name: 'schema', passed: true });\n checks.push({ name: 'issuer_binding', passed: false, message: result.message });\n } else if (result.code === 'E_INVALID_AUDIENCE') {\n checks.push({ name: 'signature', passed: true });\n checks.push({ name: 'schema', passed: true });\n checks.push({ name: 'audience_binding', passed: false, message: result.message });\n } else {\n checks.push({ name: result.code, passed: false, message: result.message });\n }\n\n const trFail = truncateResponse(\n `Verification FAILED: ${result.code} -- ${result.message}`,\n policy\n );\n return {\n text: trFail.text,\n structured: {\n ok: false,\n code: result.code,\n message: result.message,\n checks,\n keySource,\n ...(trFail.truncated\n ? {\n _truncation: {\n truncated: trFail.truncated,\n originalBytes: trFail.originalBytes,\n returnedBytes: trFail.returnedBytes,\n },\n }\n : {}),\n },\n };\n}\n","/**\n * Inspect handler -- ZERO MCP SDK imports\n *\n * Decodes JWS (without verifying) and extracts metadata.\n * Respects policy redaction settings.\n */\n\nimport { decode } from '@peac/crypto';\nimport { parseReceiptClaims } from '@peac/schema';\nimport type { HandlerParams, HandlerResult } from './types.js';\nimport type { InspectInput } from '../schemas/inspect.js';\nimport { checkJwsSize, checkToolEnabled, truncateResponse } from './guards.js';\n\nexport async function handleInspect(params: HandlerParams<InspectInput>): Promise<HandlerResult> {\n const { input, policy } = params;\n\n // Guard: tool enablement\n const disabledResult = checkToolEnabled('peac_inspect', policy);\n if (disabledResult) return disabledResult;\n\n // Guard: JWS size limit\n const sizeResult = checkJwsSize(input.jws, policy);\n if (sizeResult) return sizeResult;\n\n let header: Record<string, unknown>;\n let payload: Record<string, unknown>;\n try {\n const decoded = decode<Record<string, unknown>>(input.jws);\n header = decoded.header as unknown as Record<string, unknown>;\n payload = decoded.payload;\n } catch (err) {\n return {\n text: `Inspect failed: ${err instanceof Error ? err.message : String(err)}`,\n structured: {\n error: err instanceof Error ? err.message : String(err),\n code: 'E_MCP_INVALID_INPUT',\n },\n isError: true,\n };\n }\n\n // Classify variant (don't throw on failure)\n let variant = 'unknown';\n try {\n const pr = parseReceiptClaims(payload);\n if (pr.ok) {\n variant = pr.variant;\n }\n } catch {\n // classification failure is non-fatal\n }\n\n const payloadMeta: Record<string, unknown> = {\n variant,\n issuer: payload.iss,\n audience: payload.aud,\n };\n\n if (typeof payload.iat === 'number') {\n payloadMeta.issuedAt = new Date(payload.iat * 1000).toISOString();\n }\n if (typeof payload.exp === 'number') {\n payloadMeta.expiresAt = new Date(payload.exp * 1000).toISOString();\n }\n if (typeof payload.rid === 'string') {\n payloadMeta.receiptId = payload.rid;\n }\n\n // Apply redaction\n let redacted = false;\n let fullPayload: Record<string, unknown> | undefined;\n\n // Gate: full_claims only honored when policy permits (inspect_full_claims)\n const effectiveFullClaims = input.full_claims && policy.redaction.inspect_full_claims;\n if (effectiveFullClaims) {\n fullPayload = { ...payload };\n\n if (policy.redaction.strip_evidence && 'evidence' in fullPayload) {\n fullPayload.evidence = '[REDACTED by policy]';\n redacted = true;\n }\n if (policy.redaction.strip_payment && 'payment' in fullPayload) {\n fullPayload.payment = '[REDACTED by policy]';\n redacted = true;\n }\n }\n\n const lines = [\n 'WARNING: Signature NOT verified (use peac_verify to verify)',\n '',\n `Variant: ${variant}`,\n `Issuer: ${payload.iss ?? 'N/A'}`,\n `Audience: ${payload.aud ?? 'N/A'}`,\n ];\n\n if (payloadMeta.issuedAt) lines.push(`Issued At: ${payloadMeta.issuedAt}`);\n if (payloadMeta.expiresAt) lines.push(`Expires At: ${payloadMeta.expiresAt}`);\n if (payloadMeta.receiptId) lines.push(`Receipt ID: ${payloadMeta.receiptId}`);\n if (redacted) lines.push('', 'Note: Some fields redacted by policy');\n\n const tr = truncateResponse(lines.join('\\n'), policy);\n return {\n text: tr.text,\n structured: {\n header,\n payloadMeta,\n ...(fullPayload !== undefined ? { fullPayload } : {}),\n redacted,\n verified: false,\n ...(tr.truncated\n ? {\n _truncation: {\n truncated: tr.truncated,\n originalBytes: tr.originalBytes,\n returnedBytes: tr.returnedBytes,\n },\n }\n : {}),\n },\n };\n}\n","/**\n * Decode handler -- ZERO MCP SDK imports\n *\n * Raw JWS decode. Returns header and payload without verification.\n * Text output is bounded by policy limits.\n */\n\nimport { decode } from '@peac/crypto';\nimport type { HandlerParams, HandlerResult } from './types.js';\nimport type { DecodeInput } from '../schemas/decode.js';\nimport { checkJwsSize, checkToolEnabled, truncateResponse } from './guards.js';\n\nexport async function handleDecode(params: HandlerParams<DecodeInput>): Promise<HandlerResult> {\n const { input, policy } = params;\n\n // Guard: tool enablement\n const disabledResult = checkToolEnabled('peac_decode', policy);\n if (disabledResult) return disabledResult;\n\n // Guard: JWS size limit\n const sizeResult = checkJwsSize(input.jws, policy);\n if (sizeResult) return sizeResult;\n\n try {\n const decoded = decode<Record<string, unknown>>(input.jws);\n const header = decoded.header as unknown as Record<string, unknown>;\n const payload = decoded.payload;\n\n const tr = truncateResponse(\n [\n 'WARNING: Signature NOT verified',\n '',\n `Header: ${JSON.stringify(header, null, 2)}`,\n '',\n `Payload: ${JSON.stringify(payload, null, 2)}`,\n ].join('\\n'),\n policy\n );\n\n return {\n text: tr.text,\n structured: {\n header,\n payload,\n verified: false,\n ...(tr.truncated\n ? {\n _truncation: {\n truncated: tr.truncated,\n originalBytes: tr.originalBytes,\n returnedBytes: tr.returnedBytes,\n },\n }\n : {}),\n },\n };\n } catch (err) {\n return {\n text: `Decode failed: ${err instanceof Error ? err.message : String(err)}`,\n structured: {\n error: err instanceof Error ? err.message : String(err),\n code: 'E_MCP_INVALID_INPUT',\n },\n isError: true,\n };\n }\n}\n","/**\n * Issue handler -- Wire 0.2 only, ZERO MCP SDK imports\n *\n * Signs and returns a Wire 0.2 PEAC record JWS (in-memory only, no side-effects).\n * Requires issuerKey + issuerId on ServerContext.\n */\n\nimport { issueWire02, IssueError } from '@peac/protocol';\nimport { decode, base64urlEncode } from '@peac/crypto';\nimport type { HandlerParams, HandlerResult } from './types.js';\nimport type { IssueInput } from '../schemas/issue.js';\nimport { McpServerError, sanitizeOutput } from '../infra/errors.js';\nimport { checkToolEnabled, truncateResponse } from './guards.js';\n\n/**\n * Build Trust Gate 1 patterns from the actual loaded key.\n * Matches base64url-encoded private key bytes and public key bytes.\n */\nfunction buildKeyPatterns(privateKey: Uint8Array, publicKey: Uint8Array): RegExp[] {\n const privB64 = base64urlEncode(privateKey);\n const pubB64 = base64urlEncode(publicKey);\n // Escape any regex-special chars in base64url strings (none expected, but defensive)\n const escPriv = privB64.replace(/[.*+?^${}()|[\\]\\\\]/g, '\\\\$&');\n const escPub = pubB64.replace(/[.*+?^${}()|[\\]\\\\]/g, '\\\\$&');\n return [new RegExp(escPriv, 'g'), new RegExp(escPub, 'g')];\n}\n\nexport async function handleIssue(params: HandlerParams<IssueInput>): Promise<HandlerResult> {\n const { input, policy, context } = params;\n\n // Guard: tool enablement\n const disabledResult = checkToolEnabled('peac_issue', policy);\n if (disabledResult) return disabledResult;\n\n // Guard: issuer key + id must be configured\n if (!context.issuerKey || !context.issuerId) {\n return {\n text: 'Issue failed: server not configured with issuer key and ID (--issuer-key + --issuer-id)',\n structured: {\n ok: false,\n code: 'E_MCP_KEY_REQUIRED',\n message: 'Server requires --issuer-key and --issuer-id for peac_issue',\n },\n isError: true,\n };\n }\n\n // Guard: check claims byte size\n const inputJson = JSON.stringify(input);\n const inputBytes = new TextEncoder().encode(inputJson).length;\n if (inputBytes > policy.limits.max_claims_bytes) {\n return {\n text: `Input rejected: claims are ${inputBytes} bytes, exceeding limit of ${policy.limits.max_claims_bytes} bytes`,\n structured: {\n ok: false,\n code: 'E_MCP_INPUT_TOO_LARGE',\n message: `Claims input is ${inputBytes} bytes, limit is ${policy.limits.max_claims_bytes}`,\n },\n isError: true,\n };\n }\n\n // Build Trust Gate 1 patterns from actual key\n const keyPatterns = buildKeyPatterns(context.issuerKey.privateKey, context.issuerKey.publicKey);\n\n try {\n // Build policy block: PolicyBlock requires digest (non-optional per kernel type).\n // If caller provides policy without digest, return a clear error rather than\n // silently discarding the policy metadata.\n if (input.policy && !input.policy.digest) {\n return {\n text: 'Issue failed: policy.digest is required when policy block is provided',\n structured: {\n ok: false,\n code: 'E_MCP_ISSUE_FAILED',\n message:\n 'policy.digest is required when policy block is provided (uri/version alone is insufficient for binding)',\n },\n isError: true,\n };\n }\n const policyBlock = input.policy?.digest\n ? { digest: input.policy.digest, uri: input.policy.uri, version: input.policy.version }\n : undefined;\n\n const result = await issueWire02({\n iss: context.issuerId,\n kind: input.kind,\n type: input.type,\n sub: input.sub,\n pillars: input.pillars,\n occurred_at: input.occurred_at,\n extensions: input.extensions,\n policy: policyBlock,\n privateKey: context.issuerKey.privateKey,\n kid: context.issuerKey.kid,\n });\n\n // Decode JWS to extract claims summary\n const { payload } = decode<Record<string, unknown>>(result.jws);\n const claimsSummary = {\n iss: payload.iss as string,\n kind: payload.kind as string,\n type: payload.type as string,\n iat: payload.iat as number,\n jti: payload.jti as string,\n ...(payload.sub !== undefined ? { sub: payload.sub as string } : {}),\n ...(payload.pillars !== undefined ? { pillars: payload.pillars as string[] } : {}),\n };\n\n // Trust Gate 1: scan output for key bytes\n const tr = truncateResponse(\n `Receipt issued: jti=${claimsSummary.jti}, kind=${claimsSummary.kind}, type=${claimsSummary.type}`,\n policy\n );\n const safeText = sanitizeOutput(tr.text, keyPatterns);\n\n return {\n text: safeText,\n structured: {\n ok: true,\n jws: result.jws,\n claimsSummary,\n },\n };\n } catch (err) {\n // Sanitize error messages -- never expose key bytes\n const rawMessage = err instanceof Error ? err.message : String(err);\n const safeMessage = sanitizeOutput(rawMessage, keyPatterns);\n\n if (err instanceof IssueError) {\n return {\n text: `Issue failed: ${safeMessage}`,\n structured: {\n ok: false,\n code: 'E_MCP_ISSUE_FAILED',\n message: safeMessage,\n },\n isError: true,\n };\n }\n\n if (err instanceof McpServerError) {\n return {\n text: `Issue failed: ${safeMessage}`,\n structured: {\n ok: false,\n code: err.code,\n message: safeMessage,\n },\n isError: true,\n };\n }\n\n return {\n text: `Issue failed: ${safeMessage}`,\n structured: {\n ok: false,\n code: 'E_MCP_ISSUE_FAILED',\n message: safeMessage,\n },\n isError: true,\n };\n }\n}\n","/**\n * TOCTOU-hardened filesystem utilities for bundle creation\n *\n * All path operations validate against symlink injection and traversal.\n * Zero MCP SDK imports.\n */\n\nimport { lstat, mkdir, rename, rm, mkdtemp } from 'node:fs/promises';\nimport * as nodePath from 'node:path';\nimport { randomUUID } from 'node:crypto';\nimport { PathTraversalError } from './errors.js';\n\n/**\n * Windows reserved device names (case-insensitive, even with extensions).\n * Windows treats CON, CON.txt, NUL, PRN, COM1..COM9, LPT1..LPT9 as special.\n */\nconst WINDOWS_RESERVED_NAMES = new Set([\n 'con',\n 'prn',\n 'aux',\n 'nul',\n 'com1',\n 'com2',\n 'com3',\n 'com4',\n 'com5',\n 'com6',\n 'com7',\n 'com8',\n 'com9',\n 'lpt1',\n 'lpt2',\n 'lpt3',\n 'lpt4',\n 'lpt5',\n 'lpt6',\n 'lpt7',\n 'lpt8',\n 'lpt9',\n]);\n\n/**\n * Assert that a path is a safe single-segment relative name.\n *\n * v1 restriction: no nested directories (single path segment only).\n * Rejects absolute paths, `..`, empty strings, multi-segment paths, names >255 chars,\n * null bytes, colons (drive letters, NTFS ADS), Windows reserved device names,\n * and trailing dots/spaces (Windows normalizes these).\n */\nexport function assertRelativePath(p: string): void {\n if (!p || p.trim().length === 0) {\n throw new PathTraversalError('Path must not be empty');\n }\n\n // Reject null bytes (injection vector)\n if (p.includes('\\0')) {\n throw new PathTraversalError('Null bytes are not allowed in paths');\n }\n\n // Reject colons (blocks drive letters C: and NTFS ADS file.txt:stream)\n if (p.includes(':')) {\n throw new PathTraversalError('Colons are not allowed in paths (drive letters, NTFS ADS)');\n }\n\n if (nodePath.isAbsolute(p)) {\n throw new PathTraversalError('Absolute paths are not allowed');\n }\n\n // Normalize to detect .. traversal\n const normalized = nodePath.normalize(p);\n if (normalized.startsWith('..') || normalized.includes('/..') || normalized.includes('\\\\..')) {\n throw new PathTraversalError('Path traversal (..) is not allowed');\n }\n\n // v1: single segment only -- no slashes\n if (p.includes('/') || p.includes('\\\\')) {\n throw new PathTraversalError('Nested directories are not allowed (single segment only)');\n }\n\n if (p.length > 255) {\n throw new PathTraversalError(`Path segment exceeds 255 characters (got ${p.length})`);\n }\n\n // Reject hidden files/dirs\n if (p.startsWith('.')) {\n throw new PathTraversalError('Hidden paths (starting with .) are not allowed');\n }\n\n // Reject trailing dots and spaces (Windows normalizes these, causing confusion)\n if (p.endsWith('.') || p.endsWith(' ')) {\n throw new PathTraversalError('Trailing dots and spaces are not allowed');\n }\n\n // Reject Windows reserved device names (case-insensitive, even with extensions)\n // Check the base name before the first dot: \"CON.txt\" -> \"con\"\n const dotIndex = p.indexOf('.');\n const baseName = (dotIndex >= 0 ? p.slice(0, dotIndex) : p).toLowerCase();\n if (WINDOWS_RESERVED_NAMES.has(baseName)) {\n throw new PathTraversalError(`Windows reserved device name: ${baseName.toUpperCase()}`);\n }\n}\n\n/**\n * Validate and resolve an output path within a base directory.\n * Does NOT create the directory -- only validates and returns the resolved path.\n */\nexport function resolveOutputPath(basePath: string, relativePath: string): string {\n assertRelativePath(relativePath);\n\n const normalizedBase = nodePath.resolve(basePath);\n const resolved = nodePath.resolve(normalizedBase, relativePath);\n\n // Defense-in-depth: use path.relative to check containment.\n // If the resolved path escapes basePath, relative() produces a string\n // starting with '..' -- this is cross-platform safe unlike string prefix checks.\n const rel = nodePath.relative(normalizedBase, resolved);\n if (rel.startsWith('..') || rel.startsWith('/') || nodePath.isAbsolute(rel)) {\n throw new PathTraversalError('Resolved path escapes base directory');\n }\n\n return resolved;\n}\n\n/**\n * Check that a path component is not a symlink.\n * Throws PathTraversalError if the component is a symlink.\n */\nasync function assertNotSymlink(componentPath: string): Promise<void> {\n try {\n const stats = await lstat(componentPath);\n if (stats.isSymbolicLink()) {\n throw new PathTraversalError(`Symlink detected at ${componentPath}`);\n }\n } catch (err) {\n if (err instanceof PathTraversalError) throw err;\n // ENOENT is fine -- the component doesn't exist yet\n if ((err as NodeJS.ErrnoException).code === 'ENOENT') return;\n throw err;\n }\n}\n\n/**\n * Create a directory under basePath with per-component symlink checks.\n * Returns the resolved path of the created directory.\n */\nexport async function safeMkdir(basePath: string, relativePath: string): Promise<string> {\n const resolved = resolveOutputPath(basePath, relativePath);\n\n // Check base path itself is not a symlink\n await assertNotSymlink(basePath);\n\n // Check that target does not already exist as a symlink\n await assertNotSymlink(resolved);\n\n await mkdir(resolved, { recursive: false, mode: 0o700 });\n return resolved;\n}\n\n/**\n * Atomically move a temp directory to a final path.\n * Uses rename() which is atomic on the same filesystem.\n * Cleans up temp dir on failure.\n */\nexport async function atomicWriteDir(tempDir: string, finalPath: string): Promise<void> {\n try {\n await rename(tempDir, finalPath);\n } catch (err) {\n // Clean up temp dir on failure\n try {\n await rm(tempDir, { recursive: true, force: true });\n } catch {\n // Best-effort cleanup\n }\n throw err;\n }\n}\n\n/**\n * Create a temporary directory under basePath.\n * Uses a `.tmp-<uuid>` prefix to avoid collisions.\n */\nexport async function createTempDir(basePath: string): Promise<string> {\n await assertNotSymlink(basePath);\n const prefix = nodePath.join(basePath, `.tmp-${randomUUID().slice(0, 8)}-`);\n return mkdtemp(prefix);\n}\n","/**\n * Bundle handler -- ZERO MCP SDK imports\n *\n * Creates a signed evidence bundle directory from receipt JWS strings.\n * Requires issuerKey + issuerId + bundleDir on ServerContext.\n */\n\nimport { writeFile, rm, stat, mkdir } from 'node:fs/promises';\nimport { join } from 'node:path';\nimport { randomUUID } from 'node:crypto';\nimport { sign, sha256Hex, base64urlEncode } from '@peac/crypto';\nimport type { HandlerParams, HandlerResult } from './types.js';\nimport type { BundleInput } from '../schemas/bundle.js';\nimport { McpServerError, sanitizeOutput } from '../infra/errors.js';\nimport { checkToolEnabled, truncateResponse } from './guards.js';\nimport { assertRelativePath, createTempDir, atomicWriteDir } from '../infra/path-safety.js';\nimport { SERVER_VERSION } from '../infra/constants.js';\n\n/**\n * Stable JSON stringify with sorted keys at all levels.\n * Produces deterministic output regardless of property insertion order.\n * Uses 2-space indentation for human readability.\n */\nfunction stableJsonStringify(value: unknown): string {\n return (\n JSON.stringify(\n value,\n (_key, val) => {\n if (val !== null && typeof val === 'object' && !Array.isArray(val)) {\n const sorted: Record<string, unknown> = {};\n for (const k of Object.keys(val as Record<string, unknown>).sort()) {\n sorted[k] = (val as Record<string, unknown>)[k];\n }\n return sorted;\n }\n return val;\n },\n 2\n ) + '\\n'\n );\n}\n\n/**\n * Build Trust Gate 1 patterns from the actual loaded key.\n */\nfunction buildKeyPatterns(privateKey: Uint8Array, publicKey: Uint8Array): RegExp[] {\n const privB64 = base64urlEncode(privateKey);\n const pubB64 = base64urlEncode(publicKey);\n const escPriv = privB64.replace(/[.*+?^${}()|[\\]\\\\]/g, '\\\\$&');\n const escPub = pubB64.replace(/[.*+?^${}()|[\\]\\\\]/g, '\\\\$&');\n return [new RegExp(escPriv, 'g'), new RegExp(escPub, 'g')];\n}\n\n/**\n * Generate a default bundle directory name with timestamp + random suffix.\n */\nfunction generateBundleName(): string {\n const ts = new Date().toISOString().replace(/[:.]/g, '-');\n const rand = randomUUID().slice(0, 8);\n return `bundle-${ts}-${rand}`;\n}\n\nexport async function handleCreateBundle(\n params: HandlerParams<BundleInput>\n): Promise<HandlerResult> {\n const { input, policy, context } = params;\n\n // Guard: tool enablement\n const disabledResult = checkToolEnabled('peac_create_bundle', policy);\n if (disabledResult) return disabledResult;\n\n // Guard: bundleDir must be configured\n if (!context.bundleDir) {\n return {\n text: 'Bundle creation failed: server not configured with --bundle-dir',\n structured: {\n ok: false,\n code: 'E_MCP_BUNDLE_DIR_REQUIRED',\n message: 'Server requires --bundle-dir for peac_create_bundle',\n },\n isError: true,\n };\n }\n\n // Guard: issuer key + id must be configured (for manifest signing)\n if (!context.issuerKey || !context.issuerId) {\n return {\n text: 'Bundle creation failed: server not configured with issuer key and ID',\n structured: {\n ok: false,\n code: 'E_MCP_KEY_REQUIRED',\n message: 'Server requires --issuer-key and --issuer-id for peac_create_bundle',\n },\n isError: true,\n };\n }\n\n // Guard: receipt count limit\n if (input.receipts.length > policy.limits.max_bundle_receipts) {\n return {\n text: `Input rejected: ${input.receipts.length} receipts exceeds limit of ${policy.limits.max_bundle_receipts}`,\n structured: {\n ok: false,\n code: 'E_MCP_INPUT_TOO_LARGE',\n message: `${input.receipts.length} receipts exceeds limit of ${policy.limits.max_bundle_receipts}`,\n },\n isError: true,\n };\n }\n\n // Guard: total byte size\n let totalReceiptBytes = 0;\n for (const r of input.receipts) {\n totalReceiptBytes += new TextEncoder().encode(r).length;\n }\n if (totalReceiptBytes > policy.limits.max_bundle_bytes) {\n return {\n text: `Input rejected: total receipt bytes ${totalReceiptBytes} exceeds limit of ${policy.limits.max_bundle_bytes}`,\n structured: {\n ok: false,\n code: 'E_MCP_INPUT_TOO_LARGE',\n message: `Total receipt bytes ${totalReceiptBytes} exceeds limit of ${policy.limits.max_bundle_bytes}`,\n },\n isError: true,\n };\n }\n\n // Validate or generate output_path\n const outputName = input.output_path ?? generateBundleName();\n try {\n assertRelativePath(outputName);\n } catch (err) {\n return {\n text: `Bundle creation failed: ${err instanceof Error ? err.message : String(err)}`,\n structured: {\n ok: false,\n code: 'E_MCP_PATH_TRAVERSAL',\n message: err instanceof Error ? err.message : String(err),\n },\n isError: true,\n };\n }\n\n // Build Trust Gate 1 patterns\n const keyPatterns = buildKeyPatterns(context.issuerKey.privateKey, context.issuerKey.publicKey);\n\n let tempDir: string | undefined;\n try {\n // Create temp working directory (0o700: owner-only access)\n tempDir = await createTempDir(context.bundleDir);\n\n // Write receipts and compute hashes\n const receiptsDir = join(tempDir, 'receipts');\n await mkdir(receiptsDir, { mode: 0o700 });\n\n interface ReceiptEntry {\n index: number;\n file: string;\n sha256: string;\n length: number;\n }\n\n const entries: ReceiptEntry[] = [];\n let totalBytes = 0;\n\n // Dedup by sha256: identical receipts produce one file and one manifest\n // entry. This is explicit behavior, not an accident of hash-named files.\n const seenHashes = new Set<string>();\n const receiptHashes: string[] = [];\n\n for (let i = 0; i < input.receipts.length; i++) {\n // Check cancellation at each iteration to avoid unnecessary disk I/O\n if (params.signal?.aborted) {\n throw new McpServerError('E_MCP_CANCELLED', 'Request cancelled during bundle creation');\n }\n\n const jws = input.receipts[i];\n const data = new TextEncoder().encode(jws);\n const hash = await sha256Hex(data);\n\n if (seenHashes.has(hash)) continue; // skip duplicate receipt\n seenHashes.add(hash);\n receiptHashes.push(hash);\n\n // Name receipt files by content hash for input-order independence.\n // Same receipt set in any order produces identical file structure.\n const fileName = `${hash}.jws`;\n const filePath = join(receiptsDir, fileName);\n await writeFile(filePath, data, { mode: 0o600 });\n entries.push({\n index: i,\n file: `receipts/${fileName}`,\n sha256: hash,\n length: data.length,\n });\n totalBytes += data.length;\n }\n\n // Sort entries by sha256 for canonical ordering.\n // Note: the manifest includes `created_at` (wall-clock time), so manifest\n // content and its signature will differ across runs. Only `bundle_id` is\n // fully deterministic (content-addressable from policy + receipt hashes).\n entries.sort((a, b) => a.sha256.localeCompare(b.sha256));\n\n // Compute content-addressable bundle_id: deterministic identifier\n // independent of wall-clock time. Same policy + same receipts = same bundle_id.\n const sortedHashes = [...receiptHashes].sort();\n const bundleIdInput = `${context.policyHash}:${sortedHashes.join(':')}`;\n const bundleId = await sha256Hex(new TextEncoder().encode(bundleIdInput));\n\n const manifest = {\n bundle_id: bundleId,\n tool_version: SERVER_VERSION,\n created_at: new Date().toISOString(),\n policy_hash: context.policyHash,\n receipt_count: entries.length,\n receipts: entries,\n ...(input.metadata ? { metadata: input.metadata } : {}),\n };\n\n // Write manifest.json with canonical key ordering (0o600: owner rw)\n const manifestJson = stableJsonStringify(manifest);\n await writeFile(join(tempDir, 'manifest.json'), manifestJson, { mode: 0o600 });\n totalBytes += new TextEncoder().encode(manifestJson).length;\n\n // Compute manifest hash for the response (caller uses this for integrity checks)\n const manifestBytes = new TextEncoder().encode(manifestJson);\n const manifestSha256 = await sha256Hex(manifestBytes);\n\n // Sign the canonical manifest object. The signature covers the full\n // manifest including `created_at`, so it is NOT reproducible across runs.\n // Parse the stable-stringified JSON back so the sign() function\n // receives an object whose property order matches the on-disk file.\n const canonicalManifest = JSON.parse(manifestJson) as Record<string, unknown>;\n const manifestJws = await sign(\n canonicalManifest,\n context.issuerKey.privateKey,\n context.issuerKey.kid\n );\n await writeFile(join(tempDir, 'manifest.jws'), manifestJws, { mode: 0o600 });\n totalBytes += new TextEncoder().encode(manifestJws).length;\n\n // File count: unique receipts + manifest.json + manifest.jws\n const fileCount = entries.length + 2;\n\n // Atomic move to final path\n const finalPath = join(context.bundleDir, outputName);\n\n // Check final path doesn't already exist\n try {\n await stat(finalPath);\n // If we get here, it exists -- error\n return {\n text: `Bundle creation failed: output path already exists: ${outputName}`,\n structured: {\n ok: false,\n code: 'E_MCP_BUNDLE_FAILED',\n message: `Output path already exists: ${outputName}`,\n },\n isError: true,\n };\n } catch (err) {\n // ENOENT is expected -- path doesn't exist yet\n if ((err as NodeJS.ErrnoException).code !== 'ENOENT') {\n throw err;\n }\n }\n\n await atomicWriteDir(tempDir, finalPath);\n tempDir = undefined; // Don't clean up -- rename succeeded\n\n const tr = truncateResponse(\n `Bundle created: ${outputName} (${fileCount} files, ${totalBytes} bytes)`,\n policy\n );\n const safeText = sanitizeOutput(tr.text, keyPatterns);\n\n // Return metadata only -- full manifest and manifestJws live on disk.\n // This prevents multi-KB JSON in MCP responses (client/UI stability).\n // Return bundleName (relative to --bundle-dir), not absolute path --\n // the absolute path leaks host filesystem layout to the LLM context.\n return {\n text: safeText,\n structured: {\n ok: true,\n bundleId: bundleId,\n bundleName: outputName,\n receiptCount: entries.length,\n fileCount,\n totalBytes,\n createdAt: manifest.created_at,\n manifestSha256,\n },\n };\n } catch (err) {\n // Clean up temp dir on failure\n if (tempDir) {\n try {\n await rm(tempDir, { recursive: true, force: true });\n } catch {\n // Best-effort cleanup\n }\n }\n\n const rawMessage = err instanceof Error ? err.message : String(err);\n const safeMessage = sanitizeOutput(rawMessage, keyPatterns);\n\n if (err instanceof McpServerError) {\n return {\n text: `Bundle creation failed: ${safeMessage}`,\n structured: {\n ok: false,\n code: err.code,\n message: safeMessage,\n },\n isError: true,\n };\n }\n\n return {\n text: `Bundle creation failed: ${safeMessage}`,\n structured: {\n ok: false,\n code: 'E_MCP_BUNDLE_FAILED',\n message: safeMessage,\n },\n isError: true,\n };\n }\n}\n","/**\n * Verify tool schemas -- ZERO MCP SDK imports\n */\n\nimport { z } from 'zod';\n\nexport const VerifyInputSchema = z.object({\n jws: z.string().describe('JWS compact serialization (header.payload.signature)'),\n public_key_base64url: z\n .string()\n .optional()\n .describe('Ed25519 public key in base64url encoding (32 bytes)'),\n jwks: z.string().optional().describe('Inline JWKS JSON containing the verifying key'),\n issuer: z.string().optional().describe('Expected issuer URI for binding check'),\n audience: z.string().optional().describe('Expected audience URI for binding check'),\n});\n\nexport type VerifyInput = z.infer<typeof VerifyInputSchema>;\n\nconst MetaSchema = z.object({\n serverVersion: z.string(),\n policyHash: z.string(),\n protocolVersion: z.string(),\n});\n\nconst CheckSchema = z.object({\n name: z.string(),\n passed: z.boolean(),\n message: z.string().optional(),\n});\n\nexport const VerifyOutputSchema = z.object({\n _meta: MetaSchema,\n ok: z.boolean(),\n code: z.string().optional(),\n message: z.string().optional(),\n variant: z.string().optional(),\n checks: z.array(CheckSchema),\n claimsSummary: z.record(z.string(), z.unknown()).optional(),\n keySource: z.string().optional(),\n});\n\nexport type VerifyOutput = z.infer<typeof VerifyOutputSchema>;\n","/**\n * Inspect tool schemas -- ZERO MCP SDK imports\n */\n\nimport { z } from 'zod';\n\nexport const InspectInputSchema = z.object({\n jws: z.string().describe('JWS compact serialization to inspect'),\n full_claims: z\n .boolean()\n .optional()\n .default(false)\n .describe('Include full decoded claims (may be redacted by policy)'),\n});\n\nexport type InspectInput = z.infer<typeof InspectInputSchema>;\n\nconst MetaSchema = z.object({\n serverVersion: z.string(),\n policyHash: z.string(),\n protocolVersion: z.string(),\n});\n\nexport const InspectOutputSchema = z.object({\n _meta: MetaSchema,\n header: z.record(z.string(), z.unknown()),\n payloadMeta: z.object({\n variant: z.string(),\n issuer: z.string().optional(),\n audience: z.string().optional(),\n issuedAt: z.string().optional(),\n expiresAt: z.string().optional(),\n receiptId: z.string().optional(),\n }),\n fullPayload: z.record(z.string(), z.unknown()).optional(),\n redacted: z.boolean(),\n verified: z.literal(false),\n});\n\nexport type InspectOutput = z.infer<typeof InspectOutputSchema>;\n","/**\n * Decode tool schemas -- ZERO MCP SDK imports\n */\n\nimport { z } from 'zod';\n\nexport const DecodeInputSchema = z.object({\n jws: z.string().describe('JWS compact serialization to decode'),\n});\n\nexport type DecodeInput = z.infer<typeof DecodeInputSchema>;\n\nconst MetaSchema = z.object({\n serverVersion: z.string(),\n policyHash: z.string(),\n protocolVersion: z.string(),\n});\n\nexport const DecodeOutputSchema = z.object({\n _meta: MetaSchema,\n header: z.record(z.string(), z.unknown()),\n payload: z.record(z.string(), z.unknown()),\n verified: z.literal(false),\n});\n\nexport type DecodeOutput = z.infer<typeof DecodeOutputSchema>;\n","/**\n * Issue tool schemas -- Wire 0.2 only\n *\n * The MCP peac_issue tool accepts Wire 0.2 fields exclusively.\n * No wire_version discriminator: the MCP server is a forward-looking\n * adoption surface; agents should only issue Wire 0.2 receipts.\n */\n\nimport { z } from 'zod';\n\nexport const IssueInputSchema = z.object({\n kind: z\n .enum(['evidence', 'challenge'])\n .describe('Structural kind: evidence (records interaction) or challenge (requests action)'),\n type: z\n .string()\n .min(1)\n .max(256)\n .refine(\n (v) =>\n /^https?:\\/\\//.test(v) ||\n /^[a-zA-Z0-9][a-zA-Z0-9._-]*\\.[a-zA-Z0-9._-]+\\/[a-zA-Z0-9]/.test(v),\n {\n message:\n 'type must be reverse-DNS (e.g. org.peacprotocol/payment) or absolute URI (https://...)',\n }\n )\n .describe('Semantic type in reverse-DNS or absolute URI form (e.g. org.peacprotocol/payment)'),\n sub: z\n .string()\n .max(2048)\n .optional()\n .describe('Subject identifier (resource or interaction target)'),\n pillars: z\n .array(\n z.enum([\n 'access',\n 'attribution',\n 'commerce',\n 'compliance',\n 'consent',\n 'identity',\n 'privacy',\n 'provenance',\n 'purpose',\n 'safety',\n ])\n )\n .optional()\n .refine(\n (arr) =>\n !arr || (new Set(arr).size === arr.length && [...arr].sort().every((v, i) => v === arr[i])),\n { message: 'pillars must be unique and sorted ascending' }\n )\n .describe('Evidence pillars from closed 10-value taxonomy (sorted ascending)'),\n occurred_at: z\n .string()\n .optional()\n .refine((v) => !v || !isNaN(Date.parse(v)), {\n message: 'occurred_at must be a valid ISO 8601 timestamp',\n })\n .describe('ISO 8601 timestamp when interaction occurred (evidence kind only)'),\n extensions: z\n .record(z.string(), z.unknown())\n .optional()\n .describe('Extension groups keyed by reverse-DNS identifier'),\n policy: z\n .object({\n uri: z\n .string()\n .url()\n .max(2048)\n .refine((v) => v.startsWith('https://'), { message: 'policy.uri must use HTTPS' })\n .describe('Policy document URI (HTTPS only)'),\n version: z.string().max(256).optional().describe('Policy version'),\n digest: z\n .string()\n .regex(/^sha256:[0-9a-f]{64}$/)\n .optional()\n .describe('Policy digest in sha256:<64 hex> format'),\n })\n .optional()\n .describe('Policy binding block'),\n ttl_seconds: z\n .number()\n .int()\n .positive()\n .optional()\n .describe('Reserved for future use (Wire 0.2 receipts do not expire)'),\n});\n\nexport type IssueInput = z.infer<typeof IssueInputSchema>;\n\nconst MetaSchema = z.object({\n serverVersion: z.string(),\n policyHash: z.string(),\n protocolVersion: z.string(),\n});\n\nconst ClaimsSummarySchema = z.object({\n iss: z.string(),\n kind: z.string(),\n type: z.string(),\n iat: z.number(),\n jti: z.string(),\n sub: z.string().optional(),\n pillars: z.array(z.string()).optional(),\n});\n\nexport const IssueOutputSchema = z.object({\n _meta: MetaSchema,\n ok: z.boolean(),\n jws: z.string(),\n claimsSummary: ClaimsSummarySchema,\n});\n\nexport type IssueOutput = z.infer<typeof IssueOutputSchema>;\n","/**\n * Bundle tool schemas -- ZERO MCP SDK imports\n */\n\nimport { z } from 'zod';\n\nexport const BundleInputSchema = z.object({\n receipts: z\n .array(z.string().max(16_384))\n .min(1)\n .max(256)\n .describe('Receipt JWS strings to bundle (1-256)'),\n metadata: z\n .record(z.string(), z.unknown())\n .optional()\n .describe('Optional metadata to include in the manifest'),\n output_path: z\n .string()\n .max(255)\n .optional()\n .describe('Output directory name (single segment within --bundle-dir)'),\n});\n\nexport type BundleInput = z.infer<typeof BundleInputSchema>;\n\nconst MetaSchema = z.object({\n serverVersion: z.string(),\n policyHash: z.string(),\n protocolVersion: z.string(),\n});\n\nexport const BundleOutputSchema = z.object({\n _meta: MetaSchema,\n ok: z.boolean(),\n bundleId: z.string(),\n bundleName: z.string(),\n receiptCount: z.number(),\n fileCount: z.number(),\n totalBytes: z.number(),\n createdAt: z.string(),\n manifestSha256: z.string(),\n});\n\nexport type BundleOutput = z.infer<typeof BundleOutputSchema>;\n"]}