@peac/protocol 0.16.4 → 0.16.5

This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
Files changed (12) hide show
  1. package/dist/_internal/address-policy.d.ts +28 -0
  2. package/dist/_internal/address-policy.d.ts.map +1 -0
  3. package/dist/index.cjs +334 -90
  4. package/dist/index.cjs.map +1 -1
  5. package/dist/index.mjs +334 -90
  6. package/dist/index.mjs.map +1 -1
  7. package/dist/jwks-resolver.d.ts +1 -1
  8. package/dist/jwks-resolver.d.ts.map +1 -1
  9. package/dist/ssrf-safe-fetch.d.ts +18 -11
  10. package/dist/ssrf-safe-fetch.d.ts.map +1 -1
  11. package/dist/verifier-core.d.ts.map +1 -1
  12. package/package.json +5 -5
package/dist/index.mjs.map CHANGED
@@ -1 +1 @@
1
- {"version":3,"sources":["../src/_internal/record-core/codec/types.ts","../src/_internal/record-core/codec/jws-jwt.ts","../src/_internal/record-core/validators/kernel-constraints.ts","../src/_internal/record-core/validators/type-extension-mapping.ts","../src/_internal/record-core/validators/jose-hardening.ts","../src/_internal/record-core/validators/issuer-form.ts","../src/_internal/record-core/validators/temporal.ts","../src/_internal/record-core/validators/extension-budget.ts","../src/_internal/record-core/validators/schema-parse.ts","../src/_internal/record-core/validators/jose-typ-strictness.ts","../src/_internal/record-core/validators/iat-not-yet-valid.ts","../src/_internal/record-core/validators/policy-binding.ts","../src/_internal/record-core/validators/unknown-extension-grammar.ts","../src/type-extension-check.ts","../src/_internal/record-core/validators/type-extension-enforcement.ts","../src/_internal/record-core/bounded-validator.ts","../src/_internal/record-core/validation-gate.ts","../src/_internal/shadow-redact.ts","../src/_internal/shadow.ts","../src/_internal/legacy-path.ts","../src/_internal/shadow-observe.ts","../src/telemetry.ts","../src/issue.ts","../src/discovery.ts","../src/ssrf-safe-fetch.ts","../src/jwks-resolver.ts","../src/_internal/signature.ts","../src/verify.ts","../src/_internal/record-core/shadow-hook.ts","../src/verify-local.ts","../src/headers.ts","../src/document-binding.ts","../src/policy-binding.ts","../src/verifier-types.ts","../src/verification-report.ts","../src/verifier-core.ts","../src/transport-profiles.ts","../src/pointer-fetch.ts","../src/replay-guard.ts"],"names":["cryptoVerify","ACCEPTED","escapeJsonPointerSegment","REJECTED","REGISTERED_EXTENSION_GROUP_KEYS","isValidExtensionKey","ACCEPTED_NO_WARN","TYPE_TO_EXTENSION_MAP","issue","validateKernelConstraints","body","rawBytes","PEAC_ISSUER_CONFIG_MAX_BYTES","VERIFIER_LIMITS","ReceiptClaims","jwsVerify","validateSubjectSnapshot","parseReceiptClaims","REGISTERED_RECEIPT_TYPES","WARNING_TYPE_UNREGISTERED","WARNING_UNKNOWN_EXTENSION","WARNING_EXTENSION_GROUP_MISSING","WARNING_EXTENSION_GROUP_MISMATCH","verifyPolicyBinding","HASH","VERIFIER_NETWORK","sha256Hex","VERIFICATION_REPORT_VERSION","decode","WIRE_TYPE","base64urlDecode"],"mappings":";;;;;;;;;;;AAsCO,IAAM,UAAA,GAAN,cAAyB,KAAA,CAAM;AAAA,EACpC,WAAA,CACkB,MAChB,OAAA,EACA;AACA,IAAA,KAAA,CAAM,OAAO,CAAA;AAHG,IAAA,IAAA,CAAA,IAAA,GAAA,IAAA;AAIhB,IAAA,IAAA,CAAK,IAAA,GAAO,YAAA;AAAA,EACd;AACF,CAAA;;;ACpBA,IAAM,cAAN,MAAyC;AAAA,EAC9B,IAAA,GAAO,SAAA;AAAA,EAEhB,MAAM,MAAA,CAAO,OAAA,EAAkB,UAAA,EAAwB,GAAA,EAA8B;AACnF,IAAA,OAAO,UAAA,CAAW,OAAA,EAAS,UAAA,EAAY,GAAG,CAAA;AAAA,EAC5C;AAAA,EAEA,MAAM,MAAA,CAAoB,UAAA,EAAoB,SAAA,EAAiD;AAC7F,IAAA,OAAOA,MAAA,CAAgB,YAAY,SAAS,CAAA;AAAA,EAC9C;AAAA,EAEA,WAAW,UAAA,EAAiC;AAG1C,IAAA,MAAM,QAAA,GAAW,UAAA,CAAW,KAAA,CAAM,GAAG,CAAA;AACrC,IAAA,IAAI,QAAA,CAAS,WAAW,CAAA,EAAG;AACzB,MAAA,MAAM,IAAI,UAAA;AAAA,QACR,sBAAA;AAAA,QACA,CAAA,yDAAA,EAA4D,SAAS,MAAM,CAAA,CAAA;AAAA,OAC7E;AAAA,IACF;AACA,IAAA,MAAM,CAAC,SAAA,EAAW,UAAA,EAAY,YAAY,CAAA,GAAI,QAAA;AAC9C,IAAA,IAAI,SAAA,CAAU,WAAW,CAAA,EAAG;AAC1B,MAAA,MAAM,IAAI,UAAA;AAAA,QACR,sBAAA;AAAA,QACA;AAAA,OACF;AAAA,IACF;AACA,IAAA,IAAI,UAAA,CAAW,WAAW,CAAA,EAAG;AAC3B,MAAA,MAAM,IAAI,UAAA;AAAA,QACR,sBAAA;AAAA,QACA;AAAA,OACF;AAAA,IACF;AACA,IAAA,IAAI,YAAA,CAAa,WAAW,CAAA,EAAG;AAC7B,MAAA,MAAM,IAAI,UAAA;AAAA,QACR,sBAAA;AAAA,QACA;AAAA,OACF;AAAA,IACF;AAEA,IAAA,IAAI,MAAA;AACJ,IAAA,IAAI;AAIF,MAAA,MAAM,UAAA,GAAa,sBAAsB,SAAS,CAAA;AAClD,MAAA,MAAA,GAAS,IAAA,CAAK,MAAM,UAAU,CAAA;AAAA,IAChC,SAAS,GAAA,EAAK;AACZ,MAAA,MAAM,IAAI,UAAA;AAAA,QACR,2BAAA;AAAA,QACA,CAAA,6CAAA,EAAiD,IAAc,OAAO,CAAA;AAAA,OACxE;AAAA,IACF;AAEA,IAAA,IAAI,OAAO,MAAA,CAAO,GAAA,KAAQ,QAAA,EAAU;AAClC,MAAA,MAAM,IAAI,UAAA;AAAA,QACR,wBAAA;AAAA,QACA;AAAA,OACF;AAAA,IACF;AACA,IAAA,IAAI,OAAO,MAAA,CAAO,GAAA,KAAQ,QAAA,EAAU;AAClC,MAAA,MAAM,IAAI,UAAA;AAAA,QACR,wBAAA;AAAA,QACA;AAAA,OACF;AAAA,IACF;AAEA,IAAA,OAAO;AAAA,MACL,KAAK,MAAA,CAAO,GAAA;AAAA,MACZ,KAAK,MAAA,CAAO,GAAA;AAAA,MACZ,KAAK,OAAO,MAAA,CAAO,GAAA,KAAQ,QAAA,GAAW,OAAO,GAAA,GAAM,MAAA;AAAA,MACnD,GAAA,EAAK;AAAA,KACP;AAAA,EACF;AACF,CAAA;AAOO,IAAM,YAAA,GAA4B,IAAI,WAAA,EAAY;AC3DlD,SAAS,kCAAkC,MAAA,EAA6C;AAC7F,EAAA,MAAM,aAAoC,EAAC;AAE3C,EAAA,IAAI,WAAW,IAAA,IAAQ,MAAA,KAAW,MAAA,IAAa,OAAO,WAAW,QAAA,EAAU;AACzE,IAAA,OAAO,EAAE,KAAA,EAAO,IAAA,EAAM,UAAA,EAAW;AAAA,EACnC;AAEA,EAAA,IAAI,UAAA,GAAa,CAAA;AACjB,EAAA,MAAM,KAAA,GAAgE;AAAA,IACpE,EAAE,KAAA,EAAO,MAAA,EAAQ,KAAA,EAAO,CAAA,EAAG,MAAM,EAAA;AAAG,GACtC;AAEA,EAAA,OAAO,KAAA,CAAM,SAAS,CAAA,EAAG;AACvB,IAAA,MAAM,IAAA,GAAO,MAAM,GAAA,EAAI;AACvB,IAAA,UAAA,EAAA;AAEA,IAAA,IAAI,UAAA,GAAa,mBAAmB,eAAA,EAAiB;AACnD,MAAA,UAAA,CAAW,IAAA,CAAK;AAAA,QACd,UAAA,EAAY,iBAAA;AAAA,QACZ,MAAA,EAAQ,UAAA;AAAA,QACR,OAAO,kBAAA,CAAmB,eAAA;AAAA,QAC1B,MAAM,IAAA,CAAK;AAAA,OACZ,CAAA;AACD,MAAA;AAAA,IACF;AAEA,IAAA,IAAI,IAAA,CAAK,KAAA,GAAQ,kBAAA,CAAmB,gBAAA,EAAkB;AACpD,MAAA,UAAA,CAAW,IAAA,CAAK;AAAA,QACd,UAAA,EAAY,kBAAA;AAAA,QACZ,QAAQ,IAAA,CAAK,KAAA;AAAA,QACb,OAAO,kBAAA,CAAmB,gBAAA;AAAA,QAC1B,MAAM,IAAA,CAAK;AAAA,OACZ,CAAA;AACD,MAAA;AAAA,IACF;AAEA,IAAA,IAAI,KAAK,KAAA,KAAU,IAAA,IAAQ,OAAO,IAAA,CAAK,UAAU,QAAA,EAAU;AACzD,MAAA,IAAI,OAAO,IAAA,CAAK,KAAA,KAAU,QAAA,EAAU;AAClC,QAAA,IAAI,IAAA,CAAK,KAAA,CAAM,MAAA,GAAS,kBAAA,CAAmB,iBAAA,EAAmB;AAC5D,UAAA,UAAA,CAAW,IAAA,CAAK;AAAA,YACd,UAAA,EAAY,mBAAA;AAAA,YACZ,MAAA,EAAQ,KAAK,KAAA,CAAM,MAAA;AAAA,YACnB,OAAO,kBAAA,CAAmB,iBAAA;AAAA,YAC1B,MAAM,IAAA,CAAK;AAAA,WACZ,CAAA;AAAA,QACH;AAAA,MACF;AACA,MAAA;AAAA,IACF;AAEA,IAAA,IAAI,KAAA,CAAM,OAAA,CAAQ,IAAA,CAAK,KAAK,CAAA,EAAG;AAC7B,MAAA,IAAI,IAAA,CAAK,KAAA,CAAM,MAAA,GAAS,kBAAA,CAAmB,gBAAA,EAAkB;AAC3D,QAAA,UAAA,CAAW,IAAA,CAAK;AAAA,UACd,UAAA,EAAY,kBAAA;AAAA,UACZ,MAAA,EAAQ,KAAK,KAAA,CAAM,MAAA;AAAA,UACnB,OAAO,kBAAA,CAAmB,gBAAA;AAAA,UAC1B,MAAM,IAAA,CAAK;AAAA,SACZ,CAAA;AAAA,MACH;AACA,MAAA,KAAA,IAAS,IAAI,IAAA,CAAK,KAAA,CAAM,SAAS,CAAA,EAAG,CAAA,IAAK,GAAG,CAAA,EAAA,EAAK;AAC/C,QAAA,KAAA,CAAM,IAAA,CAAK;AAAA,UACT,KAAA,EAAO,IAAA,CAAK,KAAA,CAAM,CAAC,CAAA;AAAA,UACnB,KAAA,EAAO,KAAK,KAAA,GAAQ,CAAA;AAAA,UACpB,IAAA,EAAM,CAAA,EAAG,IAAA,CAAK,IAAI,IAAI,CAAC,CAAA,CAAA;AAAA,SACxB,CAAA;AAAA,MACH;AACA,MAAA;AAAA,IACF;AAEA,IAAA,MAAM,IAAA,GAAO,MAAA,CAAO,IAAA,CAAK,IAAA,CAAK,KAAgC,CAAA;AAC9D,IAAA,IAAI,IAAA,CAAK,MAAA,GAAS,kBAAA,CAAmB,eAAA,EAAiB;AACpD,MAAA,UAAA,CAAW,IAAA,CAAK;AAAA,QACd,UAAA,EAAY,iBAAA;AAAA,QACZ,QAAQ,IAAA,CAAK,MAAA;AAAA,QACb,OAAO,kBAAA,CAAmB,eAAA;AAAA,QAC1B,MAAM,IAAA,CAAK;AAAA,OACZ,CAAA;AAAA,IACH;AACA,IAAA,KAAA,IAAS,IAAI,IAAA,CAAK,MAAA,GAAS,CAAA,EAAG,CAAA,IAAK,GAAG,CAAA,EAAA,EAAK;AACzC,MAAA,MAAM,GAAA,GAAM,KAAK,CAAC,CAAA;AAClB,MAAA,MAAM,SAAA,GAAY,KAAK,IAAA,GAAO,CAAA,EAAG,KAAK,IAAI,CAAA,CAAA,EAAI,GAAG,CAAA,CAAA,GAAK,GAAA;AACtD,MAAA,KAAA,CAAM,IAAA,CAAK;AAAA,QACT,KAAA,EAAQ,IAAA,CAAK,KAAA,CAAkC,GAAG,CAAA;AAAA,QAClD,KAAA,EAAO,KAAK,KAAA,GAAQ,CAAA;AAAA,QACpB,IAAA,EAAM;AAAA,OACP,CAAA;AAAA,IACH;AAAA,EACF;AAEA,EAAA,OAAO,EAAE,KAAA,EAAO,UAAA,CAAW,MAAA,KAAW,GAAG,UAAA,EAAW;AACtD;ACjFA,SAAS,yBAAyB,OAAA,EAAyB;AACzD,EAAA,OAAO,QAAQ,OAAA,CAAQ,IAAA,EAAM,IAAI,CAAA,CAAE,OAAA,CAAQ,OAAO,IAAI,CAAA;AACxD;AAOA,SAAS,qBAAA,CACP,IAAA,EACA,IAAA,EACA,UAAA,EACwC;AACxC,EAAA,IAAI,IAAA,KAAS,aAAa,OAAO,MAAA;AACjC,EAAA,MAAM,aAAA,GAAgB,qBAAA,CAAsB,GAAA,CAAI,IAAI,CAAA;AACpD,EAAA,IAAI,aAAA,KAAkB,QAAW,OAAO,MAAA;AACxC,EAAA,IAAI,UAAA,KAAe,UAAa,MAAA,CAAO,SAAA,CAAU,eAAe,IAAA,CAAK,UAAA,EAAY,aAAa,CAAA,EAAG;AAC/F,IAAA,OAAO,IAAA;AAAA,EACT;AACA,EAAA,IAAI,eAAe,MAAA,EAAW;AAC5B,IAAA,KAAA,MAAW,GAAA,IAAO,MAAA,CAAO,IAAA,CAAK,UAAU,CAAA,EAAG;AACzC,MAAA,IAAI,GAAA,KAAQ,aAAA,IAAiB,+BAAA,CAAgC,GAAA,CAAI,GAAG,CAAA,EAAG;AACrE,QAAA,OAAO,UAAA;AAAA,MACT;AAAA,IACF;AAAA,EACF;AACA,EAAA,OAAO,SAAA;AACT;AAQO,SAAS,qCACd,KAAA,EAC+B;AAC/B,EAAA,MAAM,WAA0C,EAAC;AAGjD,EAAA,IAAI,CAAC,wBAAA,CAAyB,GAAA,CAAI,KAAA,CAAM,IAAI,CAAA,EAAG;AAC7C,IAAA,QAAA,CAAS,KAAK,EAAE,IAAA,EAAM,yBAAA,EAA2B,OAAA,EAAS,SAAS,CAAA;AAAA,EACrE;AAGA,EAAA,IAAI,KAAA,CAAM,eAAe,MAAA,EAAW;AAClC,IAAA,KAAA,MAAW,GAAA,IAAO,MAAA,CAAO,IAAA,CAAK,KAAA,CAAM,UAAU,CAAA,EAAG;AAC/C,MAAA,IAAI,CAAC,+BAAA,CAAgC,GAAA,CAAI,GAAG,CAAA,IAAK,mBAAA,CAAoB,GAAG,CAAA,EAAG;AACzE,QAAA,QAAA,CAAS,IAAA,CAAK;AAAA,UACZ,IAAA,EAAM,yBAAA;AAAA,UACN,OAAA,EAAS,CAAA,YAAA,EAAe,wBAAA,CAAyB,GAAG,CAAC,CAAA;AAAA,SACtD,CAAA;AAAA,MACH;AAAA,IACF;AAAA,EACF;AAGA,EAAA,MAAM,SAAS,qBAAA,CAAsB,KAAA,CAAM,MAAM,KAAA,CAAM,IAAA,EAAM,MAAM,UAAU,CAAA;AAC7E,EAAA,IAAI,WAAW,SAAA,EAAW;AACxB,IAAA,QAAA,CAAS,KAAK,EAAE,IAAA,EAAM,+BAAA,EAAiC,OAAA,EAAS,SAAS,CAAA;AAAA,EAC3E,CAAA,MAAA,IAAW,WAAW,UAAA,EAAY;AAChC,IAAA,QAAA,CAAS,KAAK,EAAE,IAAA,EAAM,gCAAA,EAAkC,OAAA,EAAS,SAAS,CAAA;AAAA,EAC5E;AAEA,EAAA,OAAO,QAAA;AACT;;;ACrEA,IAAM,kBAAA,GAAqB,GAAA;AAgB3B,SAAS,gBAAgB,GAAA,EAA6B;AACpD,EAAA,IAAI,OAAO,GAAA,KAAQ,QAAA,IAAY,GAAA,CAAI,MAAA,KAAW,GAAG,OAAO,KAAA;AACxD,EAAA,IAAI,KAAA,GAAQ,CAAA;AACZ,EAAA,KAAA,IAAS,CAAA,GAAI,CAAA,EAAG,CAAA,GAAI,GAAA,CAAI,QAAQ,CAAA,EAAA,EAAK;AACnC,IAAA,MAAM,CAAA,GAAI,GAAA,CAAI,UAAA,CAAW,CAAC,CAAA;AAC1B,IAAA,IAAI,CAAA,GAAI,KAAM,KAAA,IAAS,CAAA;AAAA,SAAA,IACd,CAAA,GAAI,MAAO,KAAA,IAAS,CAAA;AAAA,SAAA,IACpB,CAAA,IAAK,KAAA,IAAU,CAAA,IAAK,KAAA,EAAQ;AACnC,MAAA,MAAM,IAAA,GAAO,IAAI,CAAA,GAAI,GAAA,CAAI,SAAS,GAAA,CAAI,UAAA,CAAW,CAAA,GAAI,CAAC,CAAA,GAAI,CAAA;AAC1D,MAAA,IAAI,IAAA,GAAO,KAAA,IAAU,IAAA,GAAO,KAAA,EAAQ,OAAO,KAAA;AAC3C,MAAA,KAAA,IAAS,CAAA;AACT,MAAA,CAAA,EAAA;AAAA,IACF,CAAA,MAAA,IAAW,CAAA,IAAK,KAAA,IAAU,CAAA,IAAK,KAAA,EAAQ;AACrC,MAAA,OAAO,KAAA;AAAA,IACT,OAAO,KAAA,IAAS,CAAA;AAChB,IAAA,IAAI,KAAA,GAAQ,oBAAoB,OAAO,KAAA;AAAA,EACzC;AACA,EAAA,OAAO,IAAA;AACT;AAEA,IAAM,QAAA,GAAgC,EAAE,QAAA,EAAU,IAAA,EAAK;AAEvD,SAAS,SAAS,SAAA,EAAwC;AACxD,EAAA,OAAO,EAAE,QAAA,EAAU,KAAA,EAAO,SAAA,EAAU;AACtC;AAEO,SAAS,8BAA8B,MAAA,EAAiD;AAE7F,EAAA,IAAI,CAAC,eAAA,CAAgB,MAAA,CAAO,GAAG,CAAA,EAAG;AAChC,IAAA,OAAO,SAAS,wBAAwB,CAAA;AAAA,EAC1C;AAGA,EAAA,IACE,MAAA,CAAO,GAAA,KAAQ,MAAA,IACf,MAAA,CAAO,GAAA,KAAQ,MAAA,IACf,MAAA,CAAO,GAAA,KAAQ,MAAA,IACf,MAAA,CAAO,GAAA,KAAQ,MAAA,EACf;AACA,IAAA,OAAO,SAAS,yBAAyB,CAAA;AAAA,EAC3C;AAGA,EAAA,IAAI,MAAA,CAAO,SAAS,MAAA,EAAW;AAC7B,IAAA,OAAO,SAAS,0BAA0B,CAAA;AAAA,EAC5C;AAGA,EAAA,IAAI,MAAA,CAAO,QAAQ,KAAA,EAAO;AACxB,IAAA,OAAO,SAAS,yBAAyB,CAAA;AAAA,EAC3C;AAGA,EAAA,IAAI,MAAA,CAAO,QAAQ,MAAA,EAAW;AAC5B,IAAA,OAAO,SAAS,yBAAyB,CAAA;AAAA,EAC3C;AAEA,EAAA,OAAO,QAAA;AACT;ACzEA,IAAMC,SAAAA,GAA6B,EAAE,QAAA,EAAU,IAAA,EAAK;AACpD,IAAM,QAAA,GAA6B,EAAE,QAAA,EAAU,KAAA,EAAO,WAAW,qBAAA,EAAsB;AAGvF,IAAM,WAAA,GAAc,yBAAA;AAEb,SAAS,2BAA2B,GAAA,EAAgC;AAEzE,EAAA,IAAI,OAAO,QAAQ,QAAA,IAAY,GAAA,CAAI,WAAW,CAAA,IAAK,GAAA,CAAI,MAAA,GAAS,aAAA,CAAc,SAAA,EAAW;AACvF,IAAA,OAAO,QAAA;AAAA,EACT;AAGA,EAAA,IAAI,GAAA,CAAI,UAAA,CAAW,MAAM,CAAA,EAAG;AAC1B,IAAA,OAAO,WAAA,CAAY,IAAA,CAAK,GAAG,CAAA,GAAIA,SAAAA,GAAW,QAAA;AAAA,EAC5C;AAGA,EAAA,IAAI,GAAA;AACJ,EAAA,IAAI;AACF,IAAA,GAAA,GAAM,IAAI,IAAI,GAAG,CAAA;AAAA,EACnB,CAAA,CAAA,MAAQ;AACN,IAAA,OAAO,QAAA;AAAA,EACT;AAEA,EAAA,IAAI,GAAA,CAAI,QAAA,KAAa,QAAA,EAAU,OAAO,QAAA;AACtC,EAAA,IAAI,CAAC,GAAA,CAAI,QAAA,EAAU,OAAO,QAAA;AAC1B,EAAA,IAAI,IAAI,QAAA,KAAa,EAAA,IAAM,GAAA,CAAI,QAAA,KAAa,IAAI,OAAO,QAAA;AAEvD,EAAA,MAAM,SAAS,CAAA,EAAG,GAAA,CAAI,QAAQ,CAAA,EAAA,EAAK,IAAI,IAAI,CAAA,CAAA;AAC3C,EAAA,OAAO,GAAA,KAAQ,SAASA,SAAAA,GAAW,QAAA;AACrC;ACxCA,IAAMA,SAAAA,GAA2B,EAAE,QAAA,EAAU,IAAA,EAAK;AAE3C,SAAS,wBAAA,CACd,UAAA,EACA,GAAA,EACA,GAAA,EACA,YAAoB,6BAAA,EACJ;AAChB,EAAA,IAAI,UAAA,KAAe,QAAW,OAAOA,SAAAA;AAErC,EAAA,MAAM,EAAA,GAAK,IAAA,CAAK,KAAA,CAAM,UAAU,CAAA,GAAI,GAAA;AACpC,EAAA,IAAI,KAAA,CAAM,EAAE,CAAA,EAAG,OAAOA,SAAAA;AAEtB,EAAA,IAAI,EAAA,GAAK,MAAM,SAAA,EAAW;AACxB,IAAA,OAAO;AAAA,MACL,QAAA,EAAU,KAAA;AAAA,MACV,SAAA,EAAW,sBAAA;AAAA,MACX,OAAA,EAAS;AAAA,KACX;AAAA,EACF;AAEA,EAAA,IAAI,KAAK,GAAA,EAAK;AACZ,IAAA,OAAO;AAAA,MACL,QAAA,EAAU,IAAA;AAAA,MACV,UAAU,CAAC,EAAE,MAAM,kBAAA,EAAoB,OAAA,EAAS,gBAAgB;AAAA,KAClE;AAAA,EACF;AAEA,EAAA,OAAOA,SAAAA;AACT;AC3BA,IAAMA,YAAkC,EAAE,QAAA,EAAU,IAAA,EAAM,UAAA,EAAY,EAAC,EAAE;AACzE,IAAM,aAAA,GAAgB,2BAAA;AAEtB,IAAM,WAAA,GAAc,IAAI,WAAA,EAAY;AAOpC,SAAS,mBAAmB,KAAA,EAAwB;AAClD,EAAA,IAAI;AACF,IAAA,OAAO,YAAY,MAAA,CAAO,IAAA,CAAK,SAAA,CAAU,KAAK,CAAC,CAAA,CAAE,UAAA;AAAA,EACnD,CAAA,CAAA,MAAQ;AACN,IAAA,OAAO,QAAA;AAAA,EACT;AACF;AAGA,SAASC,0BAAyB,OAAA,EAAyB;AACzD,EAAA,OAAO,QAAQ,OAAA,CAAQ,IAAA,EAAM,IAAI,CAAA,CAAE,OAAA,CAAQ,OAAO,IAAI,CAAA;AACxD;AAEO,SAAS,gCACd,UAAA,EACuB;AACvB,EAAA,IAAI,UAAA,KAAe,QAAW,OAAOD,SAAAA;AAErC,EAAA,MAAM,UAAA,GAAa,mBAAmB,UAAU,CAAA;AAChD,EAAA,IAAI,UAAA,GAAa,iBAAiB,aAAA,EAAe;AAG/C,IAAA,OAAO;AAAA,MACL,QAAA,EAAU,KAAA;AAAA,MACV,YAAY,CAAC,EAAE,MAAM,aAAA,EAAe,IAAA,EAAM,eAAe;AAAA,KAC3D;AAAA,EACF;AAEA,EAAA,MAAM,aAAyC,EAAC;AAChD,EAAA,KAAA,MAAW,GAAA,IAAO,MAAA,CAAO,IAAA,CAAK,UAAU,CAAA,EAAG;AACzC,IAAA,MAAM,UAAA,GAAa,kBAAA,CAAmB,UAAA,CAAW,GAAG,CAAC,CAAA;AACrD,IAAA,IAAI,UAAA,GAAa,iBAAiB,aAAA,EAAe;AAC/C,MAAA,UAAA,CAAW,IAAA,CAAK;AAAA,QACd,IAAA,EAAM,aAAA;AAAA,QACN,IAAA,EAAM,CAAA,YAAA,EAAeC,yBAAAA,CAAyB,GAAG,CAAC,CAAA;AAAA,OACnD,CAAA;AAAA,IACH;AAAA,EACF;AAEA,EAAA,IAAI,UAAA,CAAW,MAAA,KAAW,CAAA,EAAG,OAAOD,SAAAA;AACpC,EAAA,OAAO,EAAE,QAAA,EAAU,KAAA,EAAO,UAAA,EAAW;AACvC;AC3BO,SAAS,4BAA4B,OAAA,EAAqC;AAC/E,EAAA,MAAM,EAAA,GAAK,mBAAmB,OAAO,CAAA;AACrC,EAAA,IAAI,CAAC,GAAG,EAAA,EAAI;AACV,IAAA,OAAO;AAAA,MACL,QAAA,EAAU,KAAA;AAAA,MACV,SAAA,EAAW,GAAG,KAAA,CAAM,IAAA;AAAA,MACpB,YAAA,EAAc,GAAG,KAAA,CAAM,OAAA;AAAA,MACvB,GAAI,GAAG,KAAA,CAAM,MAAA,KAAW,UAAa,EAAE,WAAA,EAAa,EAAA,CAAG,KAAA,CAAM,MAAA;AAAO,KACtE;AAAA,EACF;AACA,EAAA,IAAI,EAAA,CAAG,gBAAgB,KAAA,EAAO;AAC5B,IAAA,OAAO;AAAA,MACL,QAAA,EAAU,KAAA;AAAA,MACV,SAAA,EAAW,4BAAA;AAAA,MACX,YAAA,EAAc,CAAA,0BAAA,EAA6B,EAAA,CAAG,WAAW,CAAA;AAAA,KAC3D;AAAA,EACF;AACA,EAAA,OAAO;AAAA,IACL,QAAA,EAAU,IAAA;AAAA,IACV,QAAQ,EAAA,CAAG,MAAA;AAAA,IACX,WAAA,EAAa,KAAA;AAAA,IACb,UAAU,EAAA,CAAG;AAAA,GACf;AACF;;;AC5DA,IAAM,gBAAA,GAA4C,EAAE,QAAA,EAAU,IAAA,EAAK;AACnE,IAAM,oBAAA,GAAgD;AAAA,EACpD,QAAA,EAAU,IAAA;AAAA,EACV,QAAA,EAAU,CAAC,EAAE,IAAA,EAAM,eAAe;AACpC,CAAA;AACA,IAAM,uBAAA,GAAmD;AAAA,EACvD,QAAA,EAAU,KAAA;AAAA,EACV,SAAA,EAAW;AACb,CAAA;AAEO,SAAS,iCAAA,CACd,KACA,UAAA,EACyB;AACzB,EAAA,MAAM,OAAA,GAAU,OAAO,GAAA,KAAQ,QAAA,IAAY,IAAI,MAAA,GAAS,CAAA;AACxD,EAAA,IAAI,SAAS,OAAO,gBAAA;AACpB,EAAA,IAAI,UAAA,KAAe,UAAU,OAAO,uBAAA;AACpC,EAAA,OAAO,oBAAA;AACT;;;AC1BA,IAAMA,SAAAA,GAAiC,EAAE,QAAA,EAAU,IAAA,EAAK;AACxD,IAAME,SAAAA,GAAiC;AAAA,EACrC,QAAA,EAAU,KAAA;AAAA,EACV,SAAA,EAAW;AACb,CAAA;AAEO,SAAS,8BAAA,CACd,GAAA,EACA,GAAA,EACA,YAAA,EACsB;AACtB,EAAA,IAAI,GAAA,GAAM,GAAA,GAAM,YAAA,EAAc,OAAOA,SAAAA;AACrC,EAAA,OAAOF,SAAAA;AACT;ACPO,SAAS,6BAAA,CACd,qBACA,iBAAA,EACqB;AACrB,EAAA,IAAI,mBAAA,KAAwB,MAAA,IAAa,iBAAA,KAAsB,MAAA,EAAW;AACxE,IAAA,OAAO,EAAE,QAAA,EAAU,IAAA,EAAM,MAAA,EAAQ,aAAA,EAAc;AAAA,EACjD;AACA,EAAA,MAAM,MAAA,GAAS,mBAAA,CAAoB,mBAAA,EAAqB,iBAAiB,CAAA;AACzE,EAAA,IAAI,WAAW,QAAA,EAAU;AACvB,IAAA,OAAO,EAAE,QAAA,EAAU,KAAA,EAAO,SAAA,EAAW,2BAA2B,MAAA,EAAO;AAAA,EACzE;AACA,EAAA,OAAO,EAAE,QAAA,EAAU,IAAA,EAAM,MAAA,EAAO;AAClC;ACLA,IAAM,cAAA,GAAgD;AAAA,EACpD,QAAA,EAAU,IAAA;AAAA,EACV,UAAU;AACZ,CAAA;AAMA,SAAS,kBAAkB,KAAA,EAAuB;AAChD,EAAA,OAAO,MAAM,OAAA,CAAQ,IAAA,EAAM,IAAI,CAAA,CAAE,OAAA,CAAQ,OAAO,IAAI,CAAA;AACtD;AAEO,SAAS,wCACd,UAAA,EAC+B;AAC/B,EAAA,IAAI,UAAA,KAAe,QAAW,OAAO,cAAA;AACrC,EAAA,MAAM,IAAA,GAAO,MAAA,CAAO,IAAA,CAAK,UAAU,CAAA;AACnC,EAAA,IAAI,IAAA,CAAK,MAAA,KAAW,CAAA,EAAG,OAAO,cAAA;AAE9B,EAAA,MAAM,WAAsC,EAAC;AAC7C,EAAA,KAAA,MAAW,OAAO,IAAA,EAAM;AACtB,IAAA,IAAI,CAACG,+BAAAA,CAAgC,GAAA,CAAI,GAAG,CAAA,IAAKC,mBAAAA,CAAoB,GAAG,CAAA,EAAG;AACzE,MAAA,QAAA,CAAS,IAAA,CAAK;AAAA,QACZ,IAAA,EAAM,6BAAA;AAAA,QACN,OAAA,EAAS,CAAA,YAAA,EAAe,iBAAA,CAAkB,GAAG,CAAC,CAAA;AAAA,OAC/C,CAAA;AAAA,IACH;AAAA,EACF;AACA,EAAA,OAAO,EAAE,QAAA,EAAU,IAAA,EAAM,QAAA,EAAS;AACpC;;;AC7BO,SAAS,yBAAA,CACd,IAAA,EACA,IAAA,EACA,UAAA,EACA,oBACA,4BAAA,EAC0B;AAE1B,EAAA,IAAI,SAAS,WAAA,EAAa;AACxB,IAAA,OAAO,EAAE,QAAQ,MAAA,EAAO;AAAA,EAC1B;AAEA,EAAA,MAAM,aAAA,GAAgB,kBAAA,CAAmB,GAAA,CAAI,IAAI,CAAA;AAGjD,EAAA,IAAI,kBAAkB,MAAA,EAAW;AAC/B,IAAA,OAAO,EAAE,QAAQ,MAAA,EAAO;AAAA,EAC1B;AAGA,EAAA,IAAI,UAAA,KAAe,UAAa,MAAA,CAAO,SAAA,CAAU,eAAe,IAAA,CAAK,UAAA,EAAY,aAAa,CAAA,EAAG;AAC/F,IAAA,OAAO,EAAE,QAAQ,IAAA,EAAK;AAAA,EACxB;AAIA,EAAA,MAAM,oBAA8B,EAAC;AACrC,EAAA,IAAI,eAAe,MAAA,EAAW;AAC5B,IAAA,KAAA,MAAW,GAAA,IAAO,MAAA,CAAO,IAAA,CAAK,UAAU,CAAA,EAAG;AACzC,MAAA,IAAI,GAAA,KAAQ,aAAA,IAAiB,4BAAA,CAA6B,GAAA,CAAI,GAAG,CAAA,EAAG;AAClE,QAAA,iBAAA,CAAkB,KAAK,GAAG,CAAA;AAAA,MAC5B;AAAA,IACF;AAAA,EACF;AAEA,EAAA,OAAO;AAAA,IACL,MAAA,EAAQ,iBAAA,CAAkB,MAAA,GAAS,CAAA,GAAI,UAAA,GAAa,SAAA;AAAA,IACpD,wBAAA,EAA0B,aAAA;AAAA,IAC1B,mCAAA,EAAqC;AAAA,GACvC;AACF;;;ACzCA,IAAMC,iBAAAA,GAAmD,EAAE,QAAA,EAAU,IAAA,EAAK;AAEnE,SAAS,wCAAA,CACd,IAAA,EACA,IAAA,EACA,UAAA,EACA,UAAA,EACgC;AAChC,EAAA,MAAM,MAAA,GAAS,yBAAA;AAAA,IACb,IAAA;AAAA,IACA,IAAA;AAAA,IACA,UAAA;AAAA,IACAC,qBAAAA;AAAA,IACAH;AAAA,GACF;AAEA,EAAA,IAAI,MAAA,CAAO,MAAA,KAAW,IAAA,IAAQ,MAAA,CAAO,WAAW,MAAA,EAAQ;AACtD,IAAA,OAAOE,iBAAAA;AAAA,EACT;AAEA,EAAA,IAAI,eAAe,QAAA,EAAU;AAC3B,IAAA,MAAM,SAAA,GACJ,MAAA,CAAO,MAAA,KAAW,SAAA,GAAY,4BAAA,GAA+B,4BAAA;AAC/D,IAAA,OAAO,EAAE,QAAA,EAAU,KAAA,EAAO,SAAA,EAAW,SAAS,OAAA,EAAQ;AAAA,EACxD;AAGA,EAAA,MAAM,WAAA,GACJ,MAAA,CAAO,MAAA,KAAW,SAAA,GAAY,yBAAA,GAA4B,0BAAA;AAC5D,EAAA,OAAO;AAAA,IACL,QAAA,EAAU,IAAA;AAAA,IACV,UAAU,CAAC,EAAE,MAAM,WAAA,EAAa,OAAA,EAAS,SAAS;AAAA,GACpD;AACF;;;ACkFO,SAAS,0BAA0B,KAAA,EAAwD;AAChG,EAAA,MAAM,aAAiC,EAAC;AACxC,EAAA,MAAM,WAA6B,EAAC;AAGpC,EAAA,MAAM,SAAA,GAAY,iCAAA,CAAkC,KAAA,CAAM,MAAM,CAAA;AAChE,EAAA,IAAI,CAAC,UAAU,KAAA,EAAO;AACpB,IAAA,KAAA,MAAW,CAAA,IAAK,UAAU,UAAA,EAAY;AACpC,MAAA,UAAA,CAAW,IAAA,CAAK;AAAA,QACd,KAAA,EAAO,oBAAA;AAAA,QACP,MAAM,CAAA,CAAE,UAAA;AAAA,QACR,IAAA,EAAM,EAAE,IAAA,IAAQ;AAAA,OACjB,CAAA;AAAA,IACH;AAAA,EACF;AAGA,EAAA,MAAM,MAAA,GAAS,0BAAA,CAA2B,KAAA,CAAM,MAAA,CAAO,GAAG,CAAA;AAC1D,EAAA,IAAI,CAAC,OAAO,QAAA,EAAU;AACpB,IAAA,UAAA,CAAW,KAAK,EAAE,KAAA,EAAO,eAAe,IAAA,EAAM,MAAA,CAAO,WAAW,CAAA;AAAA,EAClE;AAGA,EAAA,IAAI,KAAA,CAAM,WAAW,MAAA,EAAW;AAC9B,IAAA,MAAM,OAAA,GAAU,6BAAA,CAA8B,KAAA,CAAM,MAAM,CAAA;AAC1D,IAAA,IAAI,CAAC,QAAQ,QAAA,EAAU;AACrB,MAAA,UAAA,CAAW,KAAK,EAAE,KAAA,EAAO,yBAAyB,IAAA,EAAM,OAAA,CAAQ,WAAW,CAAA;AAAA,IAC7E;AAAA,EACF;AAGA,EAAA,MAAM,kBACJ,oCAAA,CAAqC;AAAA,IACnC,IAAA,EAAM,MAAM,MAAA,CAAO,IAAA;AAAA,IACnB,IAAA,EAAM,MAAM,MAAA,CAAO,IAAA;AAAA,IACnB,UAAA,EAAY,MAAM,MAAA,CAAO;AAAA,GAC1B,CAAA;AACH,EAAA,KAAA,MAAW,KAAK,eAAA,EAAiB;AAC/B,IAAA,QAAA,CAAS,IAAA,CAAK,EAAE,KAAA,EAAO,wBAAA,EAA0B,IAAA,EAAM,EAAE,IAAA,EAAM,IAAA,EAAM,CAAA,CAAE,OAAA,EAAS,CAAA;AAAA,EAClF;AAKA,EAAA,IAAI,KAAA,CAAM,MAAA,CAAO,IAAA,KAAS,UAAA,EAAY;AACpC,IAAA,MAAM,WAAA,GAAc,wBAAA;AAAA,MAClB,MAAM,MAAA,CAAO,WAAA;AAAA,MACb,MAAM,MAAA,CAAO,GAAA;AAAA,MACb,KAAA,CAAM;AAAA,KACR;AACA,IAAA,IAAI,CAAC,YAAY,QAAA,EAAU;AACzB,MAAA,UAAA,CAAW,IAAA,CAAK;AAAA,QACd,KAAA,EAAO,UAAA;AAAA,QACP,MAAM,WAAA,CAAY,SAAA;AAAA,QAClB,MAAM,WAAA,CAAY;AAAA,OACnB,CAAA;AAAA,IACH,CAAA,MAAA,IAAW,YAAY,QAAA,EAAU;AAC/B,MAAA,MAAM,OAAmC,WAAA,CAAY,QAAA;AACrD,MAAA,KAAA,MAAW,KAAK,IAAA,EAAM;AACpB,QAAA,QAAA,CAAS,IAAA,CAAK,EAAE,KAAA,EAAO,UAAA,EAAY,IAAA,EAAM,EAAE,IAAA,EAAM,IAAA,EAAM,CAAA,CAAE,OAAA,EAAS,CAAA;AAAA,MACpE;AAAA,IACF;AAAA,EACF;AAGA,EAAA,MAAM,SAAA,GAAY,+BAAA,CAAgC,KAAA,CAAM,MAAA,CAAO,UAAU,CAAA;AACzE,EAAA,IAAI,CAAC,UAAU,QAAA,EAAU;AACvB,IAAA,MAAM,OAA4C,SAAA,CAAU,UAAA;AAC5D,IAAA,KAAA,MAAW,KAAK,IAAA,EAAM;AACpB,MAAA,UAAA,CAAW,IAAA,CAAK,EAAE,KAAA,EAAO,kBAAA,EAAoB,IAAA,EAAM,EAAE,IAAA,EAAM,IAAA,EAAM,CAAA,CAAE,IAAA,EAAM,CAAA;AAAA,IAC3E;AAAA,EACF;AAOA,EAAA,IAAI,KAAA,CAAM,eAAe,MAAA,EAAW;AAClC,IAAA,MAAM,SAAA,GAAY,2BAAA,CAA4B,KAAA,CAAM,UAAU,CAAA;AAC9D,IAAA,IAAI,CAAC,SAAA,CAAU,QAAA,IAAY,SAAA,CAAU,cAAc,MAAA,EAAW;AAC5D,MAAA,UAAA,CAAW,KAAK,EAAE,KAAA,EAAO,gBAAgB,IAAA,EAAM,SAAA,CAAU,WAAW,CAAA;AAAA,IACtE;AAAA,EACF;AAMA,EAAA,IAAI,KAAA,CAAM,MAAA,KAAW,MAAA,IAAa,KAAA,CAAM,eAAe,MAAA,EAAW;AAChE,IAAA,MAAM,SAAS,iCAAA,CAAkC,KAAA,CAAM,MAAA,CAAO,GAAA,EAAK,MAAM,UAAU,CAAA;AACnF,IAAA,IAAI,CAAC,OAAO,QAAA,EAAU;AACpB,MAAA,UAAA,CAAW,KAAK,EAAE,KAAA,EAAO,uBAAuB,IAAA,EAAM,MAAA,CAAO,WAAW,CAAA;AAAA,IAC1E,CAAA,MAAA,IAAW,OAAO,QAAA,EAAU;AAC1B,MAAA,KAAA,MAAW,CAAA,IAAK,OAAO,QAAA,EAAU;AAC/B,QAAA,QAAA,CAAS,KAAK,EAAE,KAAA,EAAO,uBAAuB,IAAA,EAAM,CAAA,CAAE,MAAM,CAAA;AAAA,MAC9D;AAAA,IACF;AAAA,EACF;AAKA,EAAA,IAAI,KAAA,CAAM,iBAAiB,MAAA,EAAW;AACpC,IAAA,MAAM,MAAA,GAAS,+BAA+B,KAAA,CAAM,MAAA,CAAO,KAAK,KAAA,CAAM,GAAA,EAAK,MAAM,YAAY,CAAA;AAC7F,IAAA,IAAI,CAAC,MAAA,CAAO,QAAA,IAAY,MAAA,CAAO,cAAc,MAAA,EAAW;AACtD,MAAA,UAAA,CAAW,KAAK,EAAE,KAAA,EAAO,qBAAqB,IAAA,EAAM,MAAA,CAAO,WAAW,CAAA;AAAA,IACxE;AAAA,EACF;AAMA,EAAA,IAAI,KAAA,CAAM,mBAAA,KAAwB,MAAA,IAAa,KAAA,CAAM,sBAAsB,MAAA,EAAW;AACpF,IAAA,MAAM,SAAA,GAAY,6BAAA;AAAA,MAChB,KAAA,CAAM,mBAAA;AAAA,MACN,KAAA,CAAM;AAAA,KACR;AACA,IAAA,IAAI,CAAC,SAAA,CAAU,QAAA,IAAY,SAAA,CAAU,cAAc,MAAA,EAAW;AAC5D,MAAA,UAAA,CAAW,KAAK,EAAE,KAAA,EAAO,kBAAkB,IAAA,EAAM,SAAA,CAAU,WAAW,CAAA;AAAA,IACxE;AAAA,EACF;AAGA,EAAA,MAAM,aAAA,GAAgB,uCAAA,CAAwC,KAAA,CAAM,MAAA,CAAO,UAAU,CAAA;AACrF,EAAA,KAAA,MAAW,CAAA,IAAK,cAAc,QAAA,EAAgD;AAC5E,IAAA,QAAA,CAAS,IAAA,CAAK;AAAA,MACZ,KAAA,EAAO,2BAAA;AAAA,MACP,MAAM,CAAA,CAAE,IAAA;AAAA,MACR,MAAM,CAAA,CAAE;AAAA,KACT,CAAA;AAAA,EACH;AAKA,EAAA,IAAI,KAAA,CAAM,eAAe,MAAA,EAAW;AAClC,IAAA,MAAM,UAAA,GAAa,wCAAA;AAAA,MACjB,MAAM,MAAA,CAAO,IAAA;AAAA,MACb,MAAM,MAAA,CAAO,IAAA;AAAA,MACb,MAAM,MAAA,CAAO,UAAA;AAAA,MACb,KAAA,CAAM;AAAA,KACR;AACA,IAAA,IAAI,CAAC,WAAW,QAAA,EAAU;AACxB,MAAA,UAAA,CAAW,IAAA,CAAK;AAAA,QACd,KAAA,EAAO,4BAAA;AAAA,QACP,MAAM,UAAA,CAAW,SAAA;AAAA,QACjB,MAAM,UAAA,CAAW;AAAA,OAClB,CAAA;AAAA,IACH,CAAA,MAAA,IAAW,WAAW,QAAA,EAAU;AAC9B,MAAA,KAAA,MAAW,CAAA,IAAK,WAAW,QAAA,EAAwD;AACjF,QAAA,QAAA,CAAS,IAAA,CAAK;AAAA,UACZ,KAAA,EAAO,4BAAA;AAAA,UACP,MAAM,CAAA,CAAE,IAAA;AAAA,UACR,MAAM,CAAA,CAAE;AAAA,SACT,CAAA;AAAA,MACH;AAAA,IACF;AAAA,EACF;AAEA,EAAA,OAAO;AAAA,IACL,QAAA,EAAU,WAAW,MAAA,KAAW,CAAA;AAAA,IAChC,UAAA;AAAA,IACA;AAAA,GACF;AACF;AC5NA,IAAM,oBAAA,GAAuB,EAAA;AAE7B,SAAS,eAAe,MAAA,EAA6D;AACnF,EAAA,IAAI,CAAC,KAAA,CAAM,OAAA,CAAQ,MAAM,GAAG,OAAO,MAAA;AACnC,EAAA,OAAO,OAAO,KAAA,CAAM,CAAA,EAAG,oBAAoB,CAAA,CAAE,GAAA,CAAI,CAACE,MAAAA,KAAU;AAC1D,IAAA,MAAM,SAAA,GAAYA,MAAAA;AAClB,IAAA,MAAM,OAAO,KAAA,CAAM,OAAA,CAAQ,UAAU,IAAI,CAAA,GACrC,UAAU,IAAA,CACP,GAAA;AAAA,MAAI,CAAC,OAAA,KACJ,OAAO,OAAA,KAAY,QAAA,IAAY,OAAO,OAAA,KAAY,QAAA,GAAW,MAAA,CAAO,OAAO,CAAA,GAAI;AAAA,KACjF,CACC,IAAA,CAAK,GAAG,CAAA,GACX,EAAA;AACJ,IAAA,MAAM,OAAA,GACJ,OAAO,SAAA,CAAU,OAAA,KAAY,QAAA,GACzB,UAAU,OAAA,GACV,MAAA,CAAO,SAAA,CAAU,OAAA,IAAWA,MAAK,CAAA;AACvC,IAAA,OAAO,EAAE,MAAM,OAAA,EAAQ;AAAA,EACzB,CAAC,CAAA;AACH;AAYO,SAAS,yBAAyB,KAAA,EAAkD;AACzF,EAAA,IAAI,KAAA,CAAM,YAAY,aAAA,EAAe;AACnC,IAAA,OAAO,cAAA,CAAe,MAAM,OAAO,CAAA;AAAA,EACrC;AACA,EAAA,OAAO,cAAA,CAAe,MAAM,OAAO,CAAA;AACrC;AAEA,SAAS,eAAe,OAAA,EAAwC;AAI9D,EAAA,MAAM,SAAA,GAAY,4BAA4B,OAAO,CAAA;AACrD,EAAA,IAAI,CAAC,UAAU,QAAA,EAAU;AACvB,IAAA,MAAM,iBAAA,GAAoB,SAAA,CAAU,WAAA,GAAc,CAAC,CAAA,EAAG,OAAA;AACtD,IAAA,OAAO;AAAA,MACL,EAAA,EAAI,KAAA;AAAA,MACJ,IAAA,EAAM,kBAAA;AAAA,MACN,OAAA,EAAS,CAAA,0CAAA,EAA6C,iBAAA,IAAqB,SAAS,CAAA;AAAA,KACtF;AAAA,EACF;AACA,EAAA,OAAO,EAAE,IAAI,IAAA,EAAK;AACpB;AAEA,SAAS,eAAe,OAAA,EAAwC;AAI9D,EAAA,MAAM,SAAA,GAAY,0BAA0B,OAAO,CAAA;AACnD,EAAA,IAAI,CAAC,UAAU,KAAA,EAAO;AACpB,IAAA,MAAM,CAAA,GAAI,SAAA,CAAU,UAAA,CAAW,CAAC,CAAA;AAChC,IAAA,OAAO;AAAA,MACL,EAAA,EAAI,KAAA;AAAA,MACJ,IAAA,EAAM,wBAAA;AAAA,MACN,OAAA,EAAS,+BAA+B,CAAA,CAAE,UAAU,aAAa,CAAA,CAAE,MAAM,CAAA,SAAA,EAAY,CAAA,CAAE,KAAK,CAAA,CAAA;AAAA,KAC9F;AAAA,EACF;AAWA,EAAA,MAAM,SAAA,GAAY,4BAA4B,OAAO,CAAA;AACrD,EAAA,IAAI,CAAC,UAAU,QAAA,EAAU;AACvB,IAAA,IAAI,SAAA,CAAU,cAAc,4BAAA,EAA8B;AACxD,MAAA,OAAO;AAAA,QACL,EAAA,EAAI,KAAA;AAAA,QACJ,IAAA,EAAM,4BAAA;AAAA,QACN,OAAA,EAAS;AAAA,OACX;AAAA,IACF;AACA,IAAA,MAAM,SAAA,GAAY,cAAA,CAAe,SAAA,CAAU,WAAW,CAAA;AACtD,IAAA,MAAM,UAAwC,EAAC;AAC/C,IAAA,IAAI,SAAA,CAAU,cAAc,MAAA,EAAW;AACrC,MAAA,MAAA,CAAO,OAAO,OAAA,EAAS,EAAE,UAAA,EAAY,SAAA,CAAU,WAAW,CAAA;AAAA,IAC5D;AACA,IAAA,IAAI,cAAc,MAAA,EAAW;AAC3B,MAAA,MAAA,CAAO,MAAA,CAAO,OAAA,EAAS,EAAE,MAAA,EAAQ,WAAW,CAAA;AAAA,IAC9C;AACA,IAAA,OAAO;AAAA,MACL,EAAA,EAAI,KAAA;AAAA,MACJ,IAAA,EAAM,kBAAA;AAAA,MACN,OAAA,EAAS,CAAA,kCAAA,EAAqC,SAAA,CAAU,YAAA,IAAgB,SAAS,CAAA,CAAA;AAAA,MACjF,GAAI,OAAO,IAAA,CAAK,OAAO,EAAE,MAAA,GAAS,CAAA,IAAK,EAAE,OAAA;AAAQ,KACnD;AAAA,EACF;AAEA,EAAA,IAAI,SAAA,CAAU,WAAA,KAAgB,KAAA,IAAS,SAAA,CAAU,WAAW,MAAA,EAAW;AACrE,IAAA,OAAO;AAAA,MACL,EAAA,EAAI,KAAA;AAAA,MACJ,IAAA,EAAM,4BAAA;AAAA,MACN,OAAA,EAAS;AAAA,KACX;AAAA,EACF;AAEA,EAAA,OAAO;AAAA,IACL,EAAA,EAAI,IAAA;AAAA,IACJ,MAAA,EAAQ;AAAA,MACN,WAAA,EAAa,KAAA;AAAA,MACb,QAAQ,SAAA,CAAU,MAAA;AAAA,MAClB,cAAA,EAAgB,SAAA,CAAU,QAAA,IAAY;AAAC;AACzC,GACF;AACF;ACpLA,IAAM,eAAA,GAAqC;AAAA;AAAA,EAEzC,wDAAA;AAAA;AAAA;AAAA,EAIA,6DAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAQA,+BAAA;AAAA;AAAA,EAGA,gCAAA;AAAA;AAAA;AAAA,EAIA,+BAAA;AAAA;AAAA,EAGA,0CAAA;AAAA;AAAA,EAGA,wBAAA;AAAA;AAAA,EAGA,4BAAA;AAAA;AAAA,EAGA,iEAAA;AAAA;AAAA,EAGA,uBAAA;AAAA;AAAA,EAGA,iDAAA;AAAA;AAAA;AAAA;AAAA,EAKA,uBAAA;AAAA,EACA,gCAAA;AAAA,EACA;AACF,CAAA;AAOA,IAAM,gBAAA,GAAmB,YAAA;AAEzB,IAAM,YAAA,uBAAmC,WAAA,EAAY;AACrD,IAAM,+BAA+B,IAAI,WAAA,CAAY,SAAS,EAAE,KAAA,EAAO,OAAO,CAAA;AAE9E,IAAM,sBAAA,GAAyB,YAAA,CAAa,MAAA,CAAO,gBAAgB,CAAA,CAAE,MAAA;AAQ9D,SAAS,eAAe,KAAA,EAAuB;AACpD,EAAA,OAAO,YAAA,CAAa,MAAA,CAAO,KAAK,CAAA,CAAE,MAAA;AACpC;AAcO,SAAS,UAAA,CAAW,OAAe,QAAA,EAA0B;AAClE,EAAA,IAAI,OAAO,KAAA,KAAU,QAAA,EAAU,OAAO,gBAAA;AAEtC,EAAA,IAAI,QAAA,GAAW,KAAA;AACf,EAAA,KAAA,MAAW,WAAW,eAAA,EAAiB;AACrC,IAAA,QAAA,GAAW,QAAA,CAAS,OAAA,CAAQ,OAAA,EAAS,gBAAgB,CAAA;AAAA,EACvD;AAEA,EAAA,MAAM,KAAA,GAAQ,YAAA,CAAa,MAAA,CAAO,QAAQ,CAAA;AAC1C,EAAA,IAAI,KAAA,CAAM,MAAA,IAAU,QAAA,EAAU,OAAO,QAAA;AAErC,EAAA,IAAI,YAAY,sBAAA,EAAwB;AACtC,IAAA,OAAO,gBAAA,CAAiB,KAAA,CAAM,CAAA,EAAG,QAAQ,CAAA;AAAA,EAC3C;AAEA,EAAA,MAAM,YAAY,QAAA,GAAW,sBAAA;AAC7B,EAAA,OAAO,aAAA,CAAc,KAAA,EAAO,SAAS,CAAA,GAAI,gBAAA;AAC3C;AAeA,eAAsB,gBAAgB,KAAA,EAAiC;AACrE,EAAA,OAAO,SAAA,CAAU,kBAAA,CAAmB,KAAK,CAAC,CAAA;AAC5C;AAQA,eAAsB,QAAQ,GAAA,EAA8B;AAC1D,EAAA,OAAO,UAAU,GAAG,CAAA;AACtB;AAMA,SAAS,mBAAmB,KAAA,EAAwB;AAClD,EAAA,IAAI,KAAA,KAAU,MAAM,OAAO,MAAA;AAC3B,EAAA,IAAI,OAAO,KAAA,KAAU,WAAA,EAAa,OAAO,MAAA;AACzC,EAAA,IAAI,OAAO,KAAA,KAAU,QAAA,EAAU,OAAO,IAAA,CAAK,UAAU,KAAK,CAAA;AAC1D,EAAA,IAAI,OAAO,UAAU,QAAA,EAAU;AAC7B,IAAA,OAAO,OAAO,QAAA,CAAS,KAAK,CAAA,GAAI,MAAA,CAAO,KAAK,CAAA,GAAI,MAAA;AAAA,EAClD;AACA,EAAA,IAAI,OAAO,KAAA,KAAU,SAAA,EAAW,OAAO,OAAO,KAAK,CAAA;AACnD,EAAA,IAAI,OAAO,KAAA,KAAU,QAAA,EAAU,OAAO,OAAO,KAAK,CAAA;AAClD,EAAA,IAAI,KAAA,CAAM,OAAA,CAAQ,KAAK,CAAA,EAAG;AACxB,IAAA,OAAO,MAAM,KAAA,CAAM,GAAA,CAAI,kBAAkB,CAAA,CAAE,IAAA,CAAK,GAAG,CAAA,GAAI,GAAA;AAAA,EACzD;AACA,EAAA,IAAI,iBAAiB,UAAA,EAAY;AAC/B,IAAA,OAAO,IAAA,CAAK,SAAA,CAAU,eAAA,CAAgB,KAAK,CAAC,CAAA;AAAA,EAC9C;AACA,EAAA,IAAI,OAAO,UAAU,QAAA,EAAU;AAC7B,IAAA,MAAM,GAAA,GAAM,KAAA;AACZ,IAAA,MAAM,IAAA,GAAO,MAAA,CAAO,IAAA,CAAK,GAAG,EAAE,IAAA,EAAK;AACnC,IAAA,OACE,MAAM,IAAA,CAAK,GAAA,CAAI,CAAC,CAAA,KAAM,IAAA,CAAK,UAAU,CAAC,CAAA,GAAI,GAAA,GAAM,kBAAA,CAAmB,IAAI,CAAC,CAAC,CAAC,CAAA,CAAE,IAAA,CAAK,GAAG,CAAA,GAAI,GAAA;AAAA,EAE5F;AACA,EAAA,OAAO,MAAA;AACT;AAOA,SAAS,aAAA,CAAc,OAAmB,OAAA,EAAyB;AACjE,EAAA,IAAI,OAAA,IAAW,GAAG,OAAO,EAAA;AACzB,EAAA,IAAI,MAAM,MAAA,IAAU,OAAA,EAAS,OAAO,YAAA,CAAa,OAAO,KAAK,CAAA;AAE7D,EAAA,IAAI,GAAA,GAAM,OAAA;AAGV,EAAA,OAAO,MAAM,CAAA,IAAA,CAAM,KAAA,CAAM,GAAG,CAAA,GAAI,SAAU,GAAA,EAAM;AAC9C,IAAA,GAAA,IAAO,CAAA;AAAA,EACT;AACA,EAAA,OAAO,aAAa,MAAA,CAAO,KAAA,CAAM,QAAA,CAAS,CAAA,EAAG,GAAG,CAAC,CAAA;AACnD;;;AClKA,IAAM,eAAA,GAAkB,GAAA;AACxB,IAAM,cAAA,GAAiB,GAAA;AACvB,IAAM,YAAA,GAAe,CAAA,GAAI,EAAA,GAAK,EAAA,GAAK,EAAA,GAAK,GAAA;AACxC,IAAM,iBAAA,GAAoB,GAAA;AAE1B,IAAM,aAAiC,EAAC;AACxC,IAAM,oBAAA,uBAA+C,GAAA,EAAI;AAuBlD,SAAS,gBAAgB,OAAA,EAAwC;AACtE,EAAA,IAAI,OAAA,EAAS,SAAA,EAAW,UAAA,KAAe,IAAA,EAAM,OAAO,IAAA;AACpD,EAAA,OAAO,WAAA,EAAY;AACrB;AAEA,SAAS,WAAA,GAAuB;AAC9B,EAAA,IAAI,OAAO,OAAA,KAAY,WAAA,IAAe,OAAA,KAAY,MAAM,OAAO,KAAA;AAC/D,EAAA,MAAM,MAAO,OAAA,CAAyD,GAAA;AACtE,EAAA,OAAO,KAAK,yBAAA,KAA8B,GAAA;AAC5C;AAyCO,SAAS,eAAkB,IAAA,EAAmC;AAEnE,EAAA,UAAA,CAAW,MAAM;AAEf,IAAA,MAAM,IAAA,GAAO,cAAc,IAAI,CAAA;AAC/B,IAAA,oBAAA,CAAqB,IAAI,IAAI,CAAA;AAO7B,IAAA,MAAM,oBAAoB,MAAY;AACpC,MAAA,oBAAA,CAAqB,OAAO,IAAI,CAAA;AAAA,IAClC,CAAA;AACA,IAAA,KAAK,IAAA,CAAK,IAAA,CAAK,iBAAA,EAAmB,iBAAiB,CAAA;AAAA,EACrD,GAAG,CAAC,CAAA;AACN;AAEA,eAAe,cAAiB,IAAA,EAA4C;AAC1E,EAAA,MAAM,aAAA,GAAgB,MAAM,OAAA,CAAQ,IAAA,CAAK,SAAS,CAAA;AAClD,EAAA,IAAI,YAAA;AACJ,EAAA,IAAI,eAAA;AAEJ,EAAA,IAAI;AACF,IAAA,YAAA,GAAe,MAAM,cAAA,CAAe,IAAA,CAAK,QAAA,EAAU,iBAAiB,CAAA;AAAA,EACtE,SAAS,GAAA,EAAK;AACZ,IAAA,eAAA,GAAkB,iBAAiB,GAAG,CAAA;AACtC,IAAA,gBAAA,CAAiB;AAAA,MACf,IAAA,EAAM,eAAA,KAAoB,gBAAA,GAAmB,aAAA,GAAgB,cAAA;AAAA,MAC7D,MAAM,IAAA,CAAK,IAAA;AAAA,MACX,aAAA;AAAA,MACA,aAAA,EAAe,KAAK,SAAA,EAAW,IAAA;AAAA,MAC/B,eAAA;AAAA,MACA,KAAA,EAAO,UAAA,CAAW,CAAA,aAAA,EAAgB,eAAe,IAAI,cAAc,CAAA;AAAA,MACnE,SAAA,EAAA,iBAAW,IAAI,IAAA,EAAK,EAAE,WAAA;AAAY,KACnC,CAAA;AACD,IAAA;AAAA,EACF;AAEA,EAAA,MAAM,UAAA,GAAa,MAAM,cAAA,CAAe,IAAA,EAAM,cAAc,aAAa,CAAA;AACzE,EAAA,IAAI,UAAA,mBAA6B,UAAU,CAAA;AAC7C;AAMA,SAAS,cAAA,CAAkB,IAA0C,EAAA,EAAwB;AAC3F,EAAA,MAAM,UAAA,GAAa,IAAI,eAAA,EAAgB;AACvC,EAAA,OAAO,IAAI,OAAA,CAAQ,CAAC,OAAA,EAAS,MAAA,KAAW;AACtC,IAAA,MAAM,KAAA,GAAQ,WAAW,MAAM;AAC7B,MAAA,UAAA,CAAW,KAAA,EAAM;AACjB,MAAA,MAAA,CAAO,IAAI,KAAA,CAAM,gBAAgB,CAAC,CAAA;AAAA,IACpC,GAAG,EAAE,CAAA;AACL,IAAA,EAAA,CAAG,UAAA,CAAW,MAAM,CAAA,CAAE,IAAA;AAAA,MACpB,CAAC,CAAA,KAAM;AACL,QAAA,YAAA,CAAa,KAAK,CAAA;AAClB,QAAA,OAAA,CAAQ,CAAC,CAAA;AAAA,MACX,CAAA;AAAA,MACA,CAAC,CAAA,KAAM;AACL,QAAA,YAAA,CAAa,KAAK,CAAA;AAClB,QAAA,MAAA,CAAO,CAAC,CAAA;AAAA,MACV;AAAA,KACF;AAAA,EACF,CAAC,CAAA;AACH;AAEA,eAAe,cAAA,CACb,IAAA,EACA,YAAA,EACA,aAAA,EACkC;AAClC,EAAA,MAAM,EAAA,GAAA,iBAAK,IAAI,IAAA,EAAK,EAAE,WAAA,EAAY;AAGlC,EAAA,IAAI,CAAC,IAAA,CAAK,SAAA,IAAa,iBAAiB,MAAA,IAAa,IAAA,CAAK,eAAe,MAAA,EAAW;AAClF,IAAA,MAAM,QAAA,GAAW,MAAM,eAAA,CAAgB,IAAA,CAAK,UAAU,CAAA;AACtD,IAAA,MAAM,UAAA,GAAa,MAAM,eAAA,CAAgB,YAAY,CAAA;AACrD,IAAA,IAAI,aAAa,UAAA,EAAY;AAC3B,MAAA,OAAO;AAAA,QACL,IAAA,EAAM,kBAAA;AAAA,QACN,MAAM,IAAA,CAAK,IAAA;AAAA,QACX,aAAA;AAAA,QACA,cAAA,EAAgB,QAAA;AAAA,QAChB,gBAAA,EAAkB,UAAA;AAAA,QAClB,WAAA,EAAa,SAAA,CAAU,IAAA,CAAK,UAAU,CAAA;AAAA,QACtC,aAAA,EAAe,UAAU,YAAY,CAAA;AAAA,QACrC,KAAA,EAAO,yBAAA;AAAA,QACP,SAAA,EAAW;AAAA,OACb;AAAA,IACF;AACA,IAAA,OAAO,IAAA;AAAA,EACT;AAGA,EAAA,IAAI,IAAA,CAAK,SAAA,IAAa,YAAA,KAAiB,MAAA,EAAW;AAChD,IAAA,OAAO,IAAA;AAAA,EACT;AAGA,EAAA,OAAO;AAAA,IACL,IAAA,EAAM,iBAAA;AAAA,IACN,MAAM,IAAA,CAAK,IAAA;AAAA,IACX,aAAA;AAAA,IACA,aAAA,EAAe,KAAK,SAAA,EAAW,IAAA;AAAA,IAC/B,KAAA,EAAO,IAAA,CAAK,SAAA,GAAY,+BAAA,GAAkC,+BAAA;AAAA,IAC1D,SAAA,EAAW;AAAA,GACb;AACF;AAEA,SAAS,UAAU,KAAA,EAAwB;AACzC,EAAA,IAAI,OAAO,KAAA,KAAU,QAAA,EAAU,OAAO,eAAe,KAAK,CAAA;AAC1D,EAAA,IAAI,KAAA,YAAiB,UAAA,EAAY,OAAO,KAAA,CAAM,UAAA;AAC9C,EAAA,OAAO,cAAA,CAAe,IAAA,CAAK,SAAA,CAAU,KAAK,KAAK,EAAE,CAAA;AACnD;AAEA,SAAS,iBAAiB,GAAA,EAAsB;AAC9C,EAAA,IAAI,GAAA,IAAO,OAAO,GAAA,KAAQ,QAAA,EAAU;AAClC,IAAA,MAAM,YAAa,GAAA,CAA8C,IAAA;AACjE,IAAA,IAAI,OAAO,SAAA,KAAc,QAAA,IAAY,SAAA,CAAU,MAAA,GAAS,GAAG,OAAO,SAAA;AAClE,IAAA,MAAM,UAAW,GAAA,CAA8B,OAAA;AAC/C,IAAA,IAAI,OAAO,OAAA,KAAY,QAAA,IAAY,qBAAqB,IAAA,CAAK,OAAO,GAAG,OAAO,OAAA;AAAA,EAChF;AACA,EAAA,OAAO,sBAAA;AACT;AAEA,SAAS,iBAAiB,CAAA,EAA2B;AACnD,EAAA,UAAA,EAAW;AACX,EAAA,IAAI,UAAA,CAAW,MAAA,IAAU,eAAA,EAAiB,UAAA,CAAW,KAAA,EAAM;AAC3D,EAAA,UAAA,CAAW,KAAK,CAAC,CAAA;AACnB;AAEA,SAAS,UAAA,GAAmB;AAC1B,EAAA,MAAM,SAAA,GAAY,IAAI,IAAA,CAAK,IAAA,CAAK,KAAI,GAAI,YAAY,EAAE,WAAA,EAAY;AAClE,EAAA,OAAO,UAAA,CAAW,SAAS,CAAA,IAAK,UAAA,CAAW,CAAC,CAAA,CAAE,SAAA,GAAY,SAAA,EAAW,UAAA,CAAW,KAAA,EAAM;AACxF;;;AC3NO,SAAS,mBAAmB,OAAA,EAAsC;AACvE,EAAA,IAAI,OAAA,EAAS,SAAA,EAAW,UAAA,KAAe,IAAA,EAAM,OAAO,IAAA;AACpD,EAAA,IAAI,OAAO,OAAA,KAAY,WAAA,IAAe,OAAA,KAAY,MAAM,OAAO,KAAA;AAC/D,EAAA,MAAM,MAAO,OAAA,CAAyD,GAAA;AACtE,EAAA,OAAO,KAAK,yBAAA,KAA8B,GAAA;AAC5C;;;ACUO,SAAS,uBAAA,GAA6C;AAC3D,EAAA,OAAO,cAAA;AACT;AASO,SAAS,qCACd,QAAA,EACmB;AACnB,EAAA,IAAI,CAAC,QAAA,IAAY,QAAA,CAAS,MAAA,KAAW,GAAG,OAAO,cAAA;AAC/C,EAAA,OAAO;AAAA,IACL,QAAA,EAAU,IAAA;AAAA,IACV,gBAAgB,EAAC;AAAA,IACjB,YAAA,EAAc,mBAAmB,QAAA,CAAS,GAAA,CAAI,CAAC,CAAA,KAAM,CAAA,CAAE,IAAI,CAAC;AAAA,GAC9D;AACF;AAUO,SAAS,6BAA6B,OAAA,EAAqD;AAChG,EAAA,OAAO;AAAA,IACL,UAAU,OAAA,CAAQ,QAAA;AAAA,IAClB,cAAA,EAAgB,mBAAmB,OAAA,CAAQ,UAAA,CAAW,IAAI,CAAC,CAAA,KAAM,CAAA,CAAE,IAAI,CAAC,CAAA;AAAA,IACxE,YAAA,EAAc,mBAAmB,OAAA,CAAQ,QAAA,CAAS,IAAI,CAAC,CAAA,KAAM,CAAA,CAAE,IAAI,CAAC;AAAA,GACtE;AACF;AAYO,SAAS,yCACd,OAAA,EACmB;AACnB,EAAA,OAAO;AAAA,IACL,UAAU,OAAA,CAAQ,QAAA;AAAA,IAClB,cAAA,EAAgB,mBAAmB,OAAA,CAAQ,UAAA,CAAW,IAAI,CAAC,CAAA,KAAM,CAAA,CAAE,IAAI,CAAC,CAAA;AAAA,IACxE,cAAc;AAAC,GACjB;AACF;AAEA,IAAM,cAAA,GAAoC,OAAO,MAAA,CAAO;AAAA,EACtD,QAAA,EAAU,IAAA;AAAA,EACV,cAAA,EAAgB,MAAA,CAAO,MAAA,CAAO,EAAE,CAAA;AAAA,EAChC,YAAA,EAAc,MAAA,CAAO,MAAA,CAAO,EAAE;AAChC,CAAC,CAAA;AAED,SAAS,mBAAmB,KAAA,EAA6C;AACvE,EAAA,IAAI,KAAA,CAAM,MAAA,KAAW,CAAA,EAAG,OAAO,EAAC;AAChC,EAAA,OAAO,MAAM,IAAA,CAAK,IAAI,IAAI,KAAK,CAAC,EAAE,IAAA,EAAK;AACzC;AChFO,SAAS,iBAAA,CACd,IACA,KAAA,EACM;AACN,EAAA,IAAI,CAAC,EAAA,EAAI;AACT,EAAA,IAAI;AACF,IAAA,MAAM,MAAA,GAAS,GAAG,KAAK,CAAA;AAEvB,IAAA,IAAI,MAAA,IAAU,OAAQ,MAAA,CAAyB,KAAA,KAAU,UAAA,EAAY;AACnE,MAAC,MAAA,CAAyB,MAAM,MAAM;AAAA,MAAC,CAAC,CAAA;AAAA,IAC1C;AAAA,EACF,CAAA,CAAA,MAAQ;AAAA,EAER;AACF;AAQO,SAAS,YAAY,GAAA,EAAqB;AAC/C,EAAA,MAAM,IAAA,GAAO,WAAW,QAAQ,CAAA,CAAE,OAAO,GAAG,CAAA,CAAE,OAAO,KAAK,CAAA;AAC1D,EAAA,OAAO,CAAA,OAAA,EAAU,IAAA,CAAK,KAAA,CAAM,CAAA,EAAG,EAAE,CAAC,CAAA,CAAA;AACpC;;;ACuFO,IAAM,UAAA,GAAN,cAAyB,KAAA,CAAM;AAAA;AAAA,EAE3B,SAAA;AAAA,EAET,YAAY,SAAA,EAAsB;AAChC,IAAA,MAAM,UAAU,SAAA,CAAU,OAAA;AAC1B,IAAA,KAAA,CAAM,OAAA,EAAS,OAAA,IAAW,SAAA,CAAU,IAAI,CAAA;AACxC,IAAA,IAAA,CAAK,IAAA,GAAO,YAAA;AACZ,IAAA,IAAA,CAAK,SAAA,GAAY,SAAA;AAAA,EACnB;AACF;AAcA,IAAM,wBAAA,GAAmD;AAAA,EACvD,sBAAA,EAAwB,mBAAA;AAAA,EACxB,2BAAA,EAA6B,wBAAA;AAAA,EAC7B,gCAAA,EAAkC,6BAAA;AAAA,EAClC,kCAAA,EAAoC;AACtC,CAAA;AAEA,SAAS,0BAA0B,GAAA,EAA8B;AAC/D,EAAA,MAAM,IAAA,GAAO,wBAAA,CAAyB,GAAA,CAAI,IAAI,CAAA,IAAK,kBAAA;AACnD,EAAA,MAAM,UAAA,GAAa,IAAI,UAAA,CAAW;AAAA,IAChC,IAAA;AAAA,IACA,QAAA,EAAU,YAAA;AAAA,IACV,QAAA,EAAU,OAAA;AAAA,IACV,SAAA,EAAW,KAAA;AAAA,IACX,WAAA,EAAa,GAAA;AAAA,IACb,OAAA,EAAS,EAAE,OAAA,EAAS,GAAA,CAAI,OAAA;AAAQ,GACpB,CAAA;AAEd,EAAC,WAAmC,KAAA,GAAQ,GAAA;AAC5C,EAAA,OAAO,UAAA;AACT;AAaA,eAAsB,YAAY,OAAA,EAAmD;AAEnF,EAAA,IAAI,CAAC,OAAA,CAAQ,GAAA,CAAI,UAAA,CAAW,UAAU,CAAA,EAAG;AACvC,IAAA,MAAM,IAAI,MAAM,qCAAqC,CAAA;AAAA,EACvD;AACA,EAAA,IAAI,CAAC,OAAA,CAAQ,GAAA,CAAI,UAAA,CAAW,UAAU,CAAA,EAAG;AACvC,IAAA,MAAM,IAAI,MAAM,uCAAuC,CAAA;AAAA,EACzD;AACA,EAAA,IAAI,QAAQ,OAAA,IAAW,CAAC,QAAQ,OAAA,CAAQ,UAAA,CAAW,UAAU,CAAA,EAAG;AAC9D,IAAA,MAAM,IAAI,MAAM,sCAAsC,CAAA;AAAA,EACxD;AAGA,EAAA,IAAI,CAAC,YAAA,CAAa,IAAA,CAAK,OAAA,CAAQ,GAAG,CAAA,EAAG;AACnC,IAAA,MAAM,IAAI,MAAM,iDAAiD,CAAA;AAAA,EACnE;AAGA,EAAA,IAAI,CAAC,OAAO,SAAA,CAAU,OAAA,CAAQ,GAAG,CAAA,IAAK,OAAA,CAAQ,MAAM,CAAA,EAAG;AACrD,IAAA,MAAM,IAAI,MAAM,uCAAuC,CAAA;AAAA,EACzD;AAGA,EAAA,IAAI,OAAA,CAAQ,QAAQ,MAAA,EAAW;AAC7B,IAAA,IAAI,CAAC,OAAO,SAAA,CAAU,OAAA,CAAQ,GAAG,CAAA,IAAK,OAAA,CAAQ,MAAM,CAAA,EAAG;AACrD,MAAA,MAAM,IAAI,MAAM,uCAAuC,CAAA;AAAA,IACzD;AAAA,EACF;AAGA,EAAA,IAAI,eAAA;AACJ,EAAA,IAAI,OAAA,CAAQ,YAAY,MAAA,EAAW;AAEjC,IAAA,MAAM,WAAA,GAAc,KAAA,CAAM,OAAA,CAAQ,OAAA,CAAQ,OAAO,IAAI,OAAA,CAAQ,OAAA,GAAU,CAAC,OAAA,CAAQ,OAAO,CAAA;AAGvF,IAAA,MAAM,gBAA0B,EAAC;AACjC,IAAA,KAAA,MAAW,SAAS,WAAA,EAAa;AAC/B,MAAA,IAAI,CAAC,mBAAA,CAAoB,KAAK,CAAA,EAAG;AAC/B,QAAA,aAAA,CAAc,KAAK,KAAK,CAAA;AAAA,MAC1B;AAAA,IACF;AACA,IAAA,IAAI,aAAA,CAAc,SAAS,CAAA,EAAG;AAC5B,MAAA,MAAM,IAAI,KAAA,CAAM,CAAA,wBAAA,EAA2B,cAAc,IAAA,CAAK,IAAI,CAAC,CAAA,CAAE,CAAA;AAAA,IACvE;AAGA,IAAA,IAAI,WAAA,CAAY,QAAA,CAAS,YAAY,CAAA,EAAG;AACtC,MAAA,MAAM,IAAI,MAAM,oEAAoE,CAAA;AAAA,IACtF;AAEA,IAAA,eAAA,GAAkB,WAAA;AAAA,EACpB;AAGA,EAAA,IAAI,OAAA,CAAQ,qBAAqB,MAAA,EAAW;AAC1C,IAAA,IAAI,CAAC,kBAAA,CAAmB,OAAA,CAAQ,gBAAgB,CAAA,EAAG;AACjD,MAAA,MAAM,IAAI,KAAA;AAAA,QACR,CAAA,mDAAA,EAAsD,QAAQ,gBAAgB,CAAA;AAAA,OAChF;AAAA,IACF;AAAA,EACF;AAGA,EAAA,IAAI,OAAA,CAAQ,mBAAmB,MAAA,EAAW;AACxC,IAAA,IAAI,CAAC,oBAAA,CAAqB,OAAA,CAAQ,cAAc,CAAA,EAAG;AACjD,MAAA,MAAM,IAAI,KAAA,CAAM,CAAA,wBAAA,EAA2B,OAAA,CAAQ,cAAc,CAAA,CAAE,CAAA;AAAA,IACrE;AAAA,EACF;AAGA,EAAA,IAAI,OAAA,CAAQ,qBAAqB,MAAA,EAAW;AAC1C,IAAA,IAAI,CAAC,sBAAA,CAAuB,OAAA,CAAQ,gBAAgB,CAAA,EAAG;AACrD,MAAA,MAAM,IAAI,UAAA;AAAA,QACR,kCAAkC,2CAA2C;AAAA,OAC/E;AAAA,IACF;AACA,IAAA,IAAI,CAAC,oBAAA,CAAqB,OAAA,CAAQ,gBAAgB,CAAA,EAAG;AAEnD,MAAA,MAAM,MAAM,OAAA,CAAQ,gBAAA;AACpB,MAAA,MAAM,YAAA,GAAe,GAAA,CAAI,eAAA,CAAgB,QAAA,CAAS,IAAI,OAAO,CAAA;AAC7D,MAAA,MAAM,aAAA,GAAgB,IAAI,GAAA,CAAI,GAAA,CAAI,eAAe,CAAA,CAAE,IAAA,KAAS,IAAI,eAAA,CAAgB,MAAA;AAChF,MAAA,MAAM,MAAA,GAAS,YAAA,GAAe,aAAA,GAAgB,aAAA,GAAgB,kBAAA,GAAqB,OAAA;AACnF,MAAA,MAAM,IAAI,UAAA,CAAW,6BAAA,CAA8B,MAAM,CAAC,CAAA;AAAA,IAC5D;AAAA,EACF;AAGA,EAAA,MAAM,MAAM,MAAA,EAAO;AAGnB,EAAA,MAAM,MAAM,IAAA,CAAK,KAAA,CAAM,IAAA,CAAK,GAAA,KAAQ,GAAI,CAAA;AAGxC,EAAA,MAAM,MAAA,GAA4B;AAAA,IAChC,KAAK,OAAA,CAAQ,GAAA;AAAA,IACb,KAAK,OAAA,CAAQ,GAAA;AAAA,IACb,GAAA;AAAA,IACA,GAAA;AAAA,IACA,KAAK,OAAA,CAAQ,GAAA;AAAA,IACb,KAAK,OAAA,CAAQ,GAAA;AAAA,IACb,OAAA,EAAS;AAAA,MACP,MAAM,OAAA,CAAQ,IAAA;AAAA,MACd,WAAW,OAAA,CAAQ,SAAA;AAAA,MACnB,QAAQ,OAAA,CAAQ,GAAA;AAAA,MAChB,UAAU,OAAA,CAAQ,GAAA;AAAA,MAClB,KAAA,EAAO,OAAA,CAAQ,KAAA,IAAS,OAAA,CAAQ,GAAA;AAAA;AAAA,MAChC,GAAA,EAAK,QAAQ,GAAA,IAAO,MAAA;AAAA;AAAA,MACpB,QAAA,EAAU,OAAA,CAAQ,QAAA,IAAY,EAAC;AAAA;AAAA,MAC/B,GAAI,OAAA,CAAQ,OAAA,IAAW,EAAE,OAAA,EAAS,QAAQ,OAAA,EAAQ;AAAA,MAClD,GAAI,OAAA,CAAQ,eAAA,IAAmB,EAAE,eAAA,EAAiB,QAAQ,eAAA,EAAgB;AAAA,MAC1E,GAAI,OAAA,CAAQ,eAAA,IAAmB,EAAE,eAAA,EAAiB,QAAQ,eAAA,EAAgB;AAAA,MAC1E,GAAI,OAAA,CAAQ,QAAA,IAAY,EAAE,QAAA,EAAU,QAAQ,QAAA;AAAS,KACvD;AAAA,IACA,GAAI,OAAA,CAAQ,GAAA,IAAO,EAAE,GAAA,EAAK,QAAQ,GAAA,EAAI;AAAA,IACtC,GAAI,QAAQ,OAAA,IAAW,EAAE,SAAS,EAAE,GAAA,EAAK,OAAA,CAAQ,OAAA,EAAQ,EAAE;AAAA;AAAA,IAE3D,GAAA,CAAK,OAAA,CAAQ,GAAA,IAAO,OAAA,CAAQ,gBAAA,KAAqB;AAAA,MAC/C,GAAA,EAAK;AAAA,QACH,GAAG,OAAA,CAAQ,GAAA;AAAA,QACX,GAAI,QAAQ,gBAAA,IAAoB;AAAA,UAC9B,CAAC,sBAAsB,GAAG,OAAA,CAAQ;AAAA;AACpC;AACF,KACF;AAAA;AAAA,IAEA,GAAI,eAAA,IAAmB,EAAE,gBAAA,EAAkB,eAAA,EAAgB;AAAA,IAC3D,GAAI,OAAA,CAAQ,gBAAA,IAAoB,EAAE,gBAAA,EAAkB,QAAQ,gBAAA,EAAiB;AAAA,IAC7E,GAAI,OAAA,CAAQ,cAAA,IAAkB,EAAE,cAAA,EAAgB,QAAQ,cAAA;AAAe,GACzE;AAGA,EAAA,MAAM,gBAAA,GAAmBC,0BAA0B,MAAM,CAAA;AACzD,EAAA,IAAI,CAAC,iBAAiB,KAAA,EAAO;AAC3B,IAAA,MAAM,IAAI,UAAA,CAAW,8BAAA,CAA+B,gBAAA,CAAiB,UAAU,CAAC,CAAA;AAAA,EAClF;AAGA,EAAA,IAAI;AACF,IAAA,aAAA,CAAc,MAAM,MAAM,CAAA;AAAA,EAC5B,SAAS,GAAA,EAAc;AACrB,IAAA,IAAI,eAAe,QAAA,EAAU;AAE3B,MAAA,MAAM,aAAA,GAAgB,IAAI,MAAA,CAAO,IAAA;AAAA,QAAK,CAACD,MAAAA,KACrCA,MAAAA,CAAM,IAAA,CAAK,IAAA,CAAK,CAAC,CAAA,KAAM,CAAA,KAAM,UAAA,IAAc,CAAA,KAAM,SAAS;AAAA,OAC5D;AACA,MAAA,IAAI,aAAA,IAAiB,aAAA,CAAc,IAAA,CAAK,QAAA,CAAS,UAAU,CAAA,EAAG;AAC5D,QAAA,MAAM,SAAA,GAAY,0BAAA;AAAA,UAChB,aAAA,CAAc,OAAA;AAAA,UACd,aAAA,CAAc;AAAA,SAChB;AACA,QAAA,MAAM,IAAI,WAAW,SAAS,CAAA;AAAA,MAChC;AAAA,IACF;AACA,IAAA,MAAM,GAAA;AAAA,EACR;AAIA,EAAA,MAAM,iBAAA,GAAoB,uBAAA,CAAwB,OAAA,CAAQ,gBAAgB,CAAA;AAG1E,EAAA,MAAM,SAAA,GAAY,YAAY,GAAA,EAAI;AAGlC,EAAA,MAAM,MAAM,MAAM,IAAA,CAAK,QAAQ,OAAA,CAAQ,UAAA,EAAY,QAAQ,GAAG,CAAA;AAG9D,EAAA,iBAAA,CAAkB,OAAA,CAAQ,WAAW,eAAA,EAAiB;AAAA,IACpD,WAAA,EAAa,YAAY,GAAG,CAAA;AAAA,IAC5B,QAAQ,OAAA,CAAQ,GAAA;AAAA,IAChB,KAAK,OAAA,CAAQ,GAAA;AAAA,IACb,UAAA,EAAY,WAAA,CAAY,GAAA,EAAI,GAAI;AAAA,GACjC,CAAA;AAED,EAAA,OAAO;AAAA,IACL,GAAA;AAAA,IACA,GAAI,iBAAA,IAAqB,EAAE,gBAAA,EAAkB,iBAAA;AAAkB,GACjE;AACF;AAUA,eAAsB,SAAS,OAAA,EAA8C;AAC3E,EAAA,MAAM,MAAA,GAAS,MAAM,WAAA,CAAY,OAAO,CAAA;AACxC,EAAA,OAAO,MAAA,CAAO,GAAA;AAChB;AAaA,eAAsB,MAAM,OAAA,EAAmD;AAC7E,EAAA,OAAO,YAAY,OAAO,CAAA;AAC5B;AAuFA,eAAsB,YAAY,OAAA,EAAmD;AAKnF,EAAA,MAAM,UAAA,GAAa,mBAAmB,OAAuC,CAAA;AAG7E,EAAA,IAAI,CAAC,cAAA,CAAe,OAAA,CAAQ,GAAG,CAAA,EAAG;AAChC,IAAA,MAAM,IAAI,UAAA,CAAW;AAAA,MACnB,IAAA,EAAM,qBAAA;AAAA,MACN,QAAA,EAAU,YAAA;AAAA,MACV,QAAA,EAAU,OAAA;AAAA,MACV,SAAA,EAAW,KAAA;AAAA,MACX,WAAA,EAAa,GAAA;AAAA,MACb,OAAA,EAAS;AAAA,QACP,OAAA,EAAS,CAAA,+BAAA,EAAkC,OAAA,CAAQ,GAAG,CAAA,sDAAA;AAAA;AACxD,KACY,CAAA;AAAA,EAChB;AAGA,EAAA,MAAM,GAAA,GAAM,OAAA,CAAQ,GAAA,IAAO,MAAA,EAAO;AAGlC,EAAA,MAAM,MAAM,IAAA,CAAK,KAAA,CAAM,IAAA,CAAK,GAAA,KAAQ,GAAI,CAAA;AAGxC,EAAA,MAAM,MAAA,GAAuB;AAAA,IAC3B,YAAA,EAAc,KAAA;AAAA,IACd,MAAM,OAAA,CAAQ,IAAA;AAAA,IACd,MAAM,OAAA,CAAQ,IAAA;AAAA,IACd,KAAK,OAAA,CAAQ,GAAA;AAAA,IACb,GAAA;AAAA,IACA,GAAA;AAAA,IACA,GAAI,OAAA,CAAQ,GAAA,KAAQ,UAAa,EAAE,GAAA,EAAK,QAAQ,GAAA,EAAI;AAAA,IACpD,GAAI,OAAA,CAAQ,OAAA,KAAY,UAAa,EAAE,OAAA,EAAS,QAAQ,OAAA,EAAQ;AAAA,IAChE,GAAI,OAAA,CAAQ,WAAA,KAAgB,UAAa,EAAE,WAAA,EAAa,QAAQ,WAAA,EAAY;AAAA,IAC5E,GAAI,OAAA,CAAQ,gBAAA,KAAqB,UAAa,EAAE,gBAAA,EAAkB,QAAQ,gBAAA,EAAiB;AAAA,IAC3F,GAAI,OAAA,CAAQ,MAAA,KAAW,UAAa,EAAE,MAAA,EAAQ,QAAQ,MAAA,EAAO;AAAA,IAC7D,GAAI,OAAA,CAAQ,UAAA,KAAe,UAAa,EAAE,UAAA,EAAY,QAAQ,UAAA;AAAW,GAC3E;AAMA,EAAA,IAAI,UAAA,EAAY;AACd,IAAA,MAAM,WAAA,GAAc,kBAAA,CAAmB,SAAA,CAAU,MAAM,CAAA;AACvD,IAAA,IAAI,CAAC,YAAY,OAAA,EAAS;AACxB,MAAA,MAAM,UAAA,GAAa,WAAA,CAAY,KAAA,CAAM,MAAA,CAAO,CAAC,CAAA;AAC7C,MAAA,MAAM,IAAI,UAAA,CAAW;AAAA,QACnB,IAAA,EAAM,kBAAA;AAAA,QACN,QAAA,EAAU,YAAA;AAAA,QACV,QAAA,EAAU,OAAA;AAAA,QACV,SAAA,EAAW,KAAA;AAAA,QACX,WAAA,EAAa,GAAA;AAAA,QACb,OAAA,EAAS;AAAA,UACP,OAAA,EAAS,CAAA,0CAAA,EAA6C,UAAA,EAAY,OAAA,IAAW,SAAS,CAAA;AAAA;AACxF,OACY,CAAA;AAAA,IAChB;AAAA,EACF,CAAA,MAAO;AACL,IAAA,MAAM,aAAa,wBAAA,CAAyB;AAAA,MAC1C,OAAA,EAAS,aAAA;AAAA,MACT,OAAA,EAAS;AAAA,KACV,CAAA;AACD,IAAA,IAAI,CAAC,WAAW,EAAA,EAAI;AAClB,MAAA,MAAM,IAAI,UAAA,CAAW;AAAA,QACnB,MAAM,UAAA,CAAW,IAAA;AAAA,QACjB,QAAA,EAAU,YAAA;AAAA,QACV,QAAA,EAAU,OAAA;AAAA,QACV,SAAA,EAAW,KAAA;AAAA,QACX,WAAA,EAAa,GAAA;AAAA,QACb,OAAA,EAAS,EAAE,OAAA,EAAS,UAAA,CAAW,OAAA;AAAQ,OAC3B,CAAA;AAAA,IAChB;AAAA,EACF;AASA,EAAA,IAAI,GAAA;AACJ,EAAA,IAAI;AACF,IAAA,GAAA,GAAM,MAAM,YAAA,CAAa,MAAA,CAAO,QAAQ,OAAA,CAAQ,UAAA,EAAY,QAAQ,GAAG,CAAA;AAAA,EACzE,SAAS,GAAA,EAAK;AACZ,IAAA,IAAI,eAAe,WAAA,EAAa;AAC9B,MAAA,MAAM,0BAA0B,GAAG,CAAA;AAAA,IACrC;AACA,IAAA,MAAM,GAAA;AAAA,EACR;AAOA,EAAA,IAAI,UAAA,IAAc,eAAA,CAAgB,OAAyC,CAAA,EAAG;AAC5E,IAAA,cAAA,CAAkC;AAAA,MAChC,IAAA,EAAM,OAAA;AAAA,MACN,YAAY,uBAAA,EAAwB;AAAA,MACpC,SAAA,EAAW,MAAA;AAAA,MACX,UAAU,YACR,wCAAA;AAAA,QACE,yBAAA,CAA0B;AAAA,UACxB,MAAA,EAAQ;AAAA,YACN,MAAM,MAAA,CAAO,IAAA;AAAA,YACb,MAAM,MAAA,CAAO,IAAA;AAAA,YACb,KAAK,MAAA,CAAO,GAAA;AAAA,YACZ,KAAK,MAAA,CAAO,GAAA;AAAA,YACZ,aAAa,MAAA,CAAO,WAAA;AAAA,YACpB,YAAY,MAAA,CAAO;AAAA,WACrB;AAAA,UACA,GAAA,EAAK;AAAA,SACN;AAAA,OACH;AAAA,MACF,SAAA,EAAW;AAAA,KACZ,CAAA;AAAA,EACH;AAEA,EAAA,OAAO,EAAE,GAAA,EAAI;AACf;AC7lBO,SAAS,kBAAkB,IAAA,EAAyC;AACzE,EAAA,IAAI,MAAA;AAEJ,EAAA,IAAI,OAAO,SAAS,QAAA,EAAU;AAC5B,IAAA,MAAM,QAAQ,IAAI,WAAA,EAAY,CAAE,MAAA,CAAO,IAAI,CAAA,CAAE,MAAA;AAC7C,IAAA,IAAI,QAAQ,4BAAA,EAA8B;AACxC,MAAA,MAAM,IAAI,KAAA,CAAM,CAAA,sBAAA,EAAyB,4BAA4B,CAAA,YAAA,EAAe,KAAK,CAAA,CAAA,CAAG,CAAA;AAAA,IAC9F;AAEA,IAAA,IAAI;AACF,MAAA,MAAA,GAAS,IAAA,CAAK,MAAM,IAAI,CAAA;AAAA,IAC1B,SAAS,GAAA,EAAK;AACZ,MAAA,MAAM,IAAI,KAAA,CAAM,iCAAA,EAAmC,EAAE,KAAA,EAAO,KAAK,CAAA;AAAA,IACnE;AAAA,EACF,CAAA,MAAO;AACL,IAAA,MAAA,GAAS,IAAA;AAAA,EACX;AAEA,EAAA,IAAI,OAAO,MAAA,KAAW,QAAA,IAAY,MAAA,KAAW,IAAA,EAAM;AACjD,IAAA,MAAM,IAAI,MAAM,iCAAiC,CAAA;AAAA,EACnD;AAEA,EAAA,MAAM,GAAA,GAAM,MAAA;AAGZ,EAAA,IAAI,OAAO,GAAA,CAAI,OAAA,KAAY,QAAA,IAAY,CAAC,IAAI,OAAA,EAAS;AACnD,IAAA,MAAM,IAAI,MAAM,iCAAiC,CAAA;AAAA,EACnD;AACA,EAAA,IAAI,OAAO,GAAA,CAAI,MAAA,KAAW,QAAA,IAAY,CAAC,IAAI,MAAA,EAAQ;AACjD,IAAA,MAAM,IAAI,MAAM,gCAAgC,CAAA;AAAA,EAClD;AACA,EAAA,IAAI,OAAO,GAAA,CAAI,QAAA,KAAa,QAAA,IAAY,CAAC,IAAI,QAAA,EAAU;AACrD,IAAA,MAAM,IAAI,MAAM,kCAAkC,CAAA;AAAA,EACpD;AAGA,EAAA,IAAI,CAAC,GAAA,CAAI,MAAA,CAAO,UAAA,CAAW,UAAU,CAAA,EAAG;AACtC,IAAA,MAAM,IAAI,MAAM,6BAA6B,CAAA;AAAA,EAC/C;AAIA,EAAA,IAAI;AACF,IAAA,IAAI,GAAA,CAAI,IAAI,QAAQ,CAAA;AAAA,EACtB,SAAS,GAAA,EAAK;AACZ,IAAA,MAAM,IAAI,KAAA,CAAM,8BAAA,EAAgC,EAAE,KAAA,EAAO,KAAK,CAAA;AAAA,EAChE;AAGA,EAAA,IAAI,GAAA,CAAI,oBAAoB,MAAA,EAAW;AACrC,IAAA,IAAI,OAAO,GAAA,CAAI,eAAA,KAAoB,QAAA,EAAU;AAC3C,MAAA,MAAM,IAAI,MAAM,kCAAkC,CAAA;AAAA,IACpD;AACA,IAAA,IAAI,CAAC,GAAA,CAAI,eAAA,CAAgB,UAAA,CAAW,UAAU,CAAA,EAAG;AAC/C,MAAA,MAAM,IAAI,MAAM,sCAAsC,CAAA;AAAA,IACxD;AAAA,EACF;AAEA,EAAA,IAAI,GAAA,CAAI,qBAAqB,MAAA,EAAW;AACtC,IAAA,IAAI,CAAC,KAAA,CAAM,OAAA,CAAQ,GAAA,CAAI,gBAAgB,CAAA,EAAG;AACxC,MAAA,MAAM,IAAI,MAAM,mCAAmC,CAAA;AAAA,IACrD;AAAA,EACF;AAEA,EAAA,IAAI,GAAA,CAAI,eAAe,MAAA,EAAW;AAChC,IAAA,IAAI,CAAC,KAAA,CAAM,OAAA,CAAQ,GAAA,CAAI,UAAU,CAAA,EAAG;AAClC,MAAA,MAAM,IAAI,MAAM,6BAA6B,CAAA;AAAA,IAC/C;AAAA,EACF;AAEA,EAAA,IAAI,GAAA,CAAI,kBAAkB,MAAA,EAAW;AACnC,IAAA,IAAI,CAAC,KAAA,CAAM,OAAA,CAAQ,GAAA,CAAI,aAAa,CAAA,EAAG;AACrC,MAAA,MAAM,IAAI,MAAM,gCAAgC,CAAA;AAAA,IAClD;AAAA,EACF;AAGA,EAAA,IAAI,WAAA;AACJ,EAAA,IAAI,GAAA,CAAI,iBAAiB,MAAA,EAAW;AAClC,IAAA,IAAI,CAAC,KAAA,CAAM,OAAA,CAAQ,GAAA,CAAI,YAAY,CAAA,EAAG;AACpC,MAAA,MAAM,IAAI,MAAM,+BAA+B,CAAA;AAAA,IACjD;AACA,IAAA,MAAM,MAAA,GAAS,mBAAA,CAAoB,GAAA,CAAI,YAAY,CAAA;AACnD,IAAA,IAAI,CAAC,OAAO,EAAA,EAAI;AACd,MAAA,MAAM,IAAI,KAAA,CAAM,CAAA,sBAAA,EAAyB,MAAA,CAAO,KAAK,CAAA,CAAE,CAAA;AAAA,IACzD;AACA,IAAA,WAAA,GAAc,MAAA,CAAO,KAAA;AAAA,EACvB;AAEA,EAAA,OAAO;AAAA,IACL,SAAS,GAAA,CAAI,OAAA;AAAA,IACb,QAAQ,GAAA,CAAI,MAAA;AAAA,IACZ,UAAU,GAAA,CAAI,QAAA;AAAA,IACd,iBAAiB,GAAA,CAAI,eAAA;AAAA,IACrB,kBAAkB,GAAA,CAAI,gBAAA;AAAA,IACtB,YAAY,GAAA,CAAI,UAAA;AAAA,IAChB,eAAe,GAAA,CAAI,aAAA;AAAA,IACnB,kBAAkB,GAAA,CAAI,gBAAA;AAAA,IACtB,YAAA,EAAc;AAAA,GAChB;AACF;AASA,eAAsB,kBAAkB,SAAA,EAA8C;AACpF,EAAA,IAAI,CAAC,SAAA,CAAU,UAAA,CAAW,UAAU,CAAA,EAAG;AACrC,IAAA,MAAM,IAAI,MAAM,6BAA6B,CAAA;AAAA,EAC/C;AAGA,EAAA,MAAM,OAAA,GAAU,SAAA,CAAU,OAAA,CAAQ,KAAA,EAAO,EAAE,CAAA;AAC3C,EAAA,MAAM,SAAA,GAAY,CAAA,EAAG,OAAO,CAAA,EAAG,uBAAuB,CAAA,CAAA;AAEtD,EAAA,IAAI;AACF,IAAA,MAAM,IAAA,GAAO,MAAM,KAAA,CAAM,SAAA,EAAW;AAAA,MAClC,OAAA,EAAS,EAAE,MAAA,EAAQ,kBAAA,EAAmB;AAAA,MACtC,MAAA,EAAQ,WAAA,CAAY,OAAA,CAAQ,GAAK;AAAA,KAClC,CAAA;AAED,IAAA,IAAI,CAAC,KAAK,EAAA,EAAI;AACZ,MAAA,MAAM,IAAI,KAAA,CAAM,CAAA,4BAAA,EAA+B,IAAA,CAAK,MAAM,CAAA,CAAE,CAAA;AAAA,IAC9D;AAEA,IAAA,MAAM,IAAA,GAAO,MAAM,IAAA,CAAK,IAAA,EAAK;AAC7B,IAAA,MAAM,MAAA,GAAS,kBAAkB,IAAI,CAAA;AAGrC,IAAA,MAAM,kBAAA,GAAqB,OAAA,CAAQ,OAAA,CAAQ,KAAA,EAAO,EAAE,CAAA;AACpD,IAAA,MAAM,gBAAA,GAAmB,MAAA,CAAO,MAAA,CAAO,OAAA,CAAQ,OAAO,EAAE,CAAA;AACxD,IAAA,IAAI,qBAAqB,kBAAA,EAAoB;AAC3C,MAAA,MAAM,IAAI,KAAA,CAAM,CAAA,0BAAA,EAA6B,kBAAkB,CAAA,MAAA,EAAS,gBAAgB,CAAA,CAAE,CAAA;AAAA,IAC5F;AAEA,IAAA,OAAO,MAAA;AAAA,EACT,SAAS,GAAA,EAAK;AACZ,IAAA,MAAM,IAAI,KAAA;AAAA,MACR,CAAA,mCAAA,EAAsC,SAAS,CAAA,EAAA,EAC7C,GAAA,YAAe,QAAQ,GAAA,CAAI,OAAA,GAAU,MAAA,CAAO,GAAG,CACjD,CAAA,CAAA;AAAA,MACA,EAAE,OAAO,GAAA;AAAI,KACf;AAAA,EACF;AACF;AASA,SAAS,aAAA,CAAc,MAAc,WAAA,EAA+B;AAClE,EAAA,IAAI,WAAA,EAAa,QAAA,CAAS,kBAAkB,CAAA,EAAG;AAC7C,IAAA,OAAO,IAAA;AAAA,EACT;AACA,EAAA,MAAM,SAAA,GAAY,IAAA,CAAK,SAAA,EAAU,CAAE,CAAC,CAAA;AACpC,EAAA,OAAO,SAAA,KAAc,GAAA;AACvB;AAUO,SAAS,mBAAA,CAAoB,MAAc,WAAA,EAA0C;AAC1F,EAAA,MAAM,QAAQ,IAAI,WAAA,EAAY,CAAE,MAAA,CAAO,IAAI,CAAA,CAAE,MAAA;AAC7C,EAAA,IAAI,QAAQ,qBAAA,EAAuB;AACjC,IAAA,MAAM,IAAI,KAAA,CAAM,CAAA,wBAAA,EAA2B,qBAAqB,CAAA,YAAA,EAAe,KAAK,CAAA,CAAA,CAAG,CAAA;AAAA,EACzF;AAEA,EAAA,IAAI,QAAA;AAEJ,EAAA,IAAI,aAAA,CAAc,IAAA,EAAM,WAAW,CAAA,EAAG;AAEpC,IAAA,IAAI;AACF,MAAA,QAAA,GAAW,IAAA,CAAK,MAAM,IAAI,CAAA;AAAA,IAC5B,SAAS,GAAA,EAAK;AACZ,MAAA,MAAM,IAAI,KAAA,CAAM,mCAAA,EAAqC,EAAE,KAAA,EAAO,KAAK,CAAA;AAAA,IACrE;AAAA,EACF,CAAA,MAAO;AAEL,IAAA,QAAA,GAAW,gBAAgB,IAAI,CAAA;AAAA,EACjC;AAGA,EAAA,IAAI,OAAO,QAAA,CAAS,OAAA,KAAY,QAAA,IAAY,CAAC,SAAS,OAAA,EAAS;AAC7D,IAAA,MAAM,IAAI,MAAM,iCAAiC,CAAA;AAAA,EACnD;AAGA,EAAA,IAAI,CAAC,QAAA,CAAS,OAAA,CAAQ,UAAA,CAAW,cAAc,CAAA,EAAG;AAChD,IAAA,MAAM,IAAI,KAAA;AAAA,MACR,CAAA,yBAAA,EAA4B,SAAS,OAAO,CAAA,2DAAA;AAAA,KAC9C;AAAA,EACF;AAEA,EAAA,IAAI,QAAA,CAAS,KAAA,KAAU,MAAA,IAAU,QAAA,CAAS,UAAU,aAAA,EAAe;AACjE,IAAA,MAAM,IAAI,MAAM,mEAAmE,CAAA;AAAA,EACrF;AAEA,EAAA,OAAO;AAAA,IACL,SAAS,QAAA,CAAS,OAAA;AAAA,IAClB,OAAO,QAAA,CAAS,KAAA;AAAA,IAChB,UAAU,QAAA,CAAS,QAAA;AAAA,IACnB,UAAU,QAAA,CAAS,QAAA;AAAA,IACnB,aAAa,QAAA,CAAS,WAAA;AAAA,IACtB,YAAY,QAAA,CAAS,UAAA;AAAA,IACrB,aAAa,QAAA,CAAS,WAAA;AAAA,IACtB,WAAW,QAAA,CAAS,SAAA;AAAA,IACpB,SAAS,QAAA,CAAS,OAAA;AAAA,IAClB,SAAS,QAAA,CAAS,OAAA;AAAA,IAClB,OAAO,QAAA,CAAS,KAAA;AAAA,IAChB,UAAU,QAAA,CAAS,QAAA;AAAA,IACnB,iBAAiB,QAAA,CAAS,eAAA;AAAA,IAC1B,kBAAkB,QAAA,CAAS;AAAA,GAC7B;AACF;AAMA,SAAS,gBAAgB,IAAA,EAAuC;AAC9D,EAAA,MAAM,KAAA,GAAQ,IAAA,CAAK,KAAA,CAAM,IAAI,CAAA;AAC7B,EAAA,MAAM,SAAkC,EAAC;AAIzC,EAAA,IAAI,IAAA,CAAK,QAAA,CAAS,KAAK,CAAA,EAAG;AACxB,IAAA,MAAM,IAAI,MAAM,iCAAiC,CAAA;AAAA,EACnD;AACA,EAAA,IAAI,KAAK,QAAA,CAAS,GAAG,KAAK,IAAA,CAAK,QAAA,CAAS,GAAG,CAAA,EAAG;AAC5C,IAAA,MAAM,IAAI,MAAM,0CAA0C,CAAA;AAAA,EAC5D;AACA,EAAA,IAAI,MAAA,CAAO,IAAA,CAAK,IAAI,CAAA,EAAG;AACrB,IAAA,MAAM,IAAI,MAAM,kCAAkC,CAAA;AAAA,EACpD;AAGA,EAAA,MAAM,aAAA,GAAgB,IAAA,CAAK,KAAA,CAAM,SAAS,CAAA;AAC1C,EAAA,IAAI,aAAA,IAAiB,aAAA,CAAc,MAAA,GAAS,CAAA,EAAG;AAC7C,IAAA,MAAM,IAAI,MAAM,oCAAoC,CAAA;AAAA,EACtD;AAEA,EAAA,KAAA,MAAW,QAAQ,KAAA,EAAO;AACxB,IAAA,MAAM,OAAA,GAAU,KAAK,IAAA,EAAK;AAG1B,IAAA,IAAI,CAAC,OAAA,IAAW,OAAA,CAAQ,WAAW,GAAG,CAAA,IAAK,YAAY,KAAA,EAAO;AAC5D,MAAA;AAAA,IACF;AAGA,IAAA,MAAM,UAAA,GAAa,OAAA,CAAQ,OAAA,CAAQ,GAAG,CAAA;AACtC,IAAA,IAAI,eAAe,EAAA,EAAI;AAEvB,IAAA,MAAM,MAAM,OAAA,CAAQ,KAAA,CAAM,CAAA,EAAG,UAAU,EAAE,IAAA,EAAK;AAC9C,IAAA,IAAI,QAAiB,OAAA,CAAQ,KAAA,CAAM,UAAA,GAAa,CAAC,EAAE,IAAA,EAAK;AAGxD,IAAA,IAAI,UAAU,EAAA,EAAI;AAChB,MAAA,KAAA,GAAQ,MAAA;AAAA,IACV,CAAA,MAAA,IAAW,OAAO,KAAA,KAAU,QAAA,EAAU;AAEpC,MAAA,IACG,KAAA,CAAM,UAAA,CAAW,GAAG,CAAA,IAAK,MAAM,QAAA,CAAS,GAAG,CAAA,IAC3C,KAAA,CAAM,WAAW,GAAG,CAAA,IAAK,KAAA,CAAM,QAAA,CAAS,GAAG,CAAA,EAC5C;AACA,QAAA,KAAA,GAAQ,KAAA,CAAM,KAAA,CAAM,CAAA,EAAG,EAAE,CAAA;AAAA,MAC3B,CAAA,MAAA,IAES,MAAM,UAAA,CAAW,GAAG,KAAK,KAAA,CAAM,QAAA,CAAS,GAAG,CAAA,EAAG;AACrD,QAAA,MAAM,KAAA,GAAQ,KAAA,CAAM,KAAA,CAAM,CAAA,EAAG,EAAE,CAAA;AAC/B,QAAA,KAAA,GAAQ,MACL,KAAA,CAAM,GAAG,CAAA,CACT,GAAA,CAAI,CAAC,CAAA,KAAM,CAAA,CAAE,IAAA,EAAM,EACnB,MAAA,CAAO,CAAC,CAAA,KAAM,CAAA,CAAE,SAAS,CAAC,CAAA;AAAA,MAC/B,CAAA,MAAA,IAES,iBAAA,CAAkB,IAAA,CAAK,KAAK,CAAA,EAAG;AACtC,QAAA,KAAA,GAAQ,WAAW,KAAK,CAAA;AAAA,MAC1B,CAAA,MAAA,IAES,UAAU,MAAA,EAAQ;AACzB,QAAA,KAAA,GAAQ,IAAA;AAAA,MACV,CAAA,MAAA,IAAW,UAAU,OAAA,EAAS;AAC5B,QAAA,KAAA,GAAQ,KAAA;AAAA,MACV;AAAA,IACF;AAEA,IAAA,IAAI,UAAU,MAAA,EAAW;AACvB,MAAA,MAAA,CAAO,GAAG,CAAA,GAAI,KAAA;AAAA,IAChB;AAAA,EACF;AAEA,EAAA,OAAO,MAAA;AACT;AASA,eAAsB,oBAAoB,OAAA,EAA8C;AACtF,EAAA,IAAI,CAAC,QAAQ,UAAA,CAAW,UAAU,KAAK,CAAC,OAAA,CAAQ,UAAA,CAAW,kBAAkB,CAAA,EAAG;AAC9E,IAAA,MAAM,IAAI,MAAM,2BAA2B,CAAA;AAAA,EAC7C;AAEA,EAAA,MAAM,cAAA,GAAiB,OAAA,CAAQ,OAAA,CAAQ,KAAA,EAAO,EAAE,CAAA;AAChD,EAAA,MAAM,UAAA,GAAa,CAAA,EAAG,cAAc,CAAA,EAAG,gBAAgB,CAAA,CAAA;AACvD,EAAA,MAAM,WAAA,GAAc,CAAA,EAAG,cAAc,CAAA,EAAG,yBAAyB,CAAA,CAAA;AAGjE,EAAA,IAAI;AACF,IAAA,MAAM,IAAA,GAAO,MAAM,KAAA,CAAM,UAAA,EAAY;AAAA,MACnC,OAAA,EAAS,EAAE,MAAA,EAAQ,8BAAA,EAA+B;AAAA,MAClD,MAAA,EAAQ,WAAA,CAAY,OAAA,CAAQ,GAAI;AAAA,KACjC,CAAA;AAED,IAAA,IAAI,KAAK,EAAA,EAAI;AACX,MAAA,MAAM,IAAA,GAAO,MAAM,IAAA,CAAK,IAAA,EAAK;AAC7B,MAAA,MAAM,WAAA,GAAc,IAAA,CAAK,OAAA,CAAQ,GAAA,CAAI,cAAc,CAAA,IAAK,KAAA,CAAA;AACxD,MAAA,OAAO,mBAAA,CAAoB,MAAM,WAAW,CAAA;AAAA,IAC9C;AAGA,IAAA,IAAI,IAAA,CAAK,WAAW,GAAA,EAAK;AACvB,MAAA,MAAM,YAAA,GAAe,MAAM,KAAA,CAAM,WAAA,EAAa;AAAA,QAC5C,OAAA,EAAS,EAAE,MAAA,EAAQ,8BAAA,EAA+B;AAAA,QAClD,MAAA,EAAQ,WAAA,CAAY,OAAA,CAAQ,GAAI;AAAA,OACjC,CAAA;AAED,MAAA,IAAI,aAAa,EAAA,EAAI;AACnB,QAAA,MAAM,IAAA,GAAO,MAAM,YAAA,CAAa,IAAA,EAAK;AACrC,QAAA,MAAM,WAAA,GAAc,YAAA,CAAa,OAAA,CAAQ,GAAA,CAAI,cAAc,CAAA,IAAK,KAAA,CAAA;AAChE,QAAA,OAAO,mBAAA,CAAoB,MAAM,WAAW,CAAA;AAAA,MAC9C;AAEA,MAAA,MAAM,IAAI,MAAM,2DAA2D,CAAA;AAAA,IAC7E;AAEA,IAAA,MAAM,IAAI,KAAA,CAAM,CAAA,8BAAA,EAAiC,IAAA,CAAK,MAAM,CAAA,CAAE,CAAA;AAAA,EAChE,SAAS,GAAA,EAAK;AACZ,IAAA,MAAM,IAAI,KAAA;AAAA,MACR,CAAA,qCAAA,EAAwC,OAAO,CAAA,EAAA,EAC7C,GAAA,YAAe,QAAQ,GAAA,CAAI,OAAA,GAAU,MAAA,CAAO,GAAG,CACjD,CAAA,CAAA;AAAA,MACA,EAAE,OAAO,GAAA;AAAI,KACf;AAAA,EACF;AACF;AAmBO,SAAS,eAAe,IAAA,EAA6B;AAC1D,EAAA,MAAM,QAAQ,IAAI,WAAA,EAAY,CAAE,MAAA,CAAO,IAAI,CAAA,CAAE,MAAA;AAC7C,EAAA,IAAI,QAAQ,GAAA,EAAM;AAChB,IAAA,MAAM,IAAI,KAAA,CAAM,CAAA,2CAAA,EAA8C,KAAK,CAAA,CAAA,CAAG,CAAA;AAAA,EACxE;AAEA,EAAA,MAAM,KAAA,GAAQ,IAAA,CAAK,IAAA,EAAK,CAAE,MAAM,IAAI,CAAA;AACpC,EAAA,IAAI,KAAA,CAAM,SAAS,EAAA,EAAI;AACrB,IAAA,MAAM,IAAI,KAAA,CAAM,CAAA,yCAAA,EAA4C,KAAA,CAAM,MAAM,CAAA,CAAA,CAAG,CAAA;AAAA,EAC7E;AAEA,EAAA,MAAM,YAAuC,EAAC;AAE9C,EAAA,KAAA,MAAW,QAAQ,KAAA,EAAO;AACxB,IAAA,MAAM,OAAA,GAAU,KAAK,IAAA,EAAK;AAC1B,IAAA,IAAI,CAAC,OAAA,IAAW,OAAA,CAAQ,UAAA,CAAW,GAAG,CAAA,EAAG;AACvC,MAAA;AAAA,IACF;AAEA,IAAA,IAAI,OAAA,CAAQ,QAAA,CAAS,GAAG,CAAA,EAAG;AACzB,MAAA,MAAM,CAAC,GAAA,EAAK,GAAG,UAAU,CAAA,GAAI,OAAA,CAAQ,MAAM,GAAG,CAAA;AAC9C,MAAA,MAAM,KAAA,GAAQ,UAAA,CAAW,IAAA,CAAK,GAAG,EAAE,IAAA,EAAK;AAExC,MAAA,QAAQ,GAAA,CAAI,MAAK;AAAG,QAClB,KAAK,SAAA;AACH,UAAA,SAAA,CAAU,OAAA,GAAU,KAAA;AACpB,UAAA;AAAA,QACF,KAAK,QAAA;AACH,UAAA,SAAA,CAAU,MAAA,GAAS,KAAA;AACnB,UAAA;AAAA,QACF,KAAK,QAAA;AACH,UAAA,SAAA,CAAU,eAAA,GAAkB,KAAA;AAC5B,UAAA;AAAA,QACF,KAAK,MAAA;AACH,UAAA,SAAA,CAAU,QAAA,GAAW,KAAA;AACrB,UAAA;AAAA,QACF,KAAK,UAAA;AACH,UAAA,SAAA,CAAU,gBAAA,GAAmB,KAAA;AAC7B,UAAA;AAAA;AACJ,IACF;AAAA,EACF;AAGA,EAAA,IAAI,CAAC,SAAA,CAAU,OAAA,EAAS,MAAM,IAAI,MAAM,iCAAiC,CAAA;AACzE,EAAA,IAAI,CAAC,SAAA,CAAU,MAAA,EAAQ,MAAM,IAAI,MAAM,gCAAgC,CAAA;AACvE,EAAA,IAAI,CAAC,SAAA,CAAU,eAAA,EAAiB,MAAM,IAAI,MAAM,gCAAgC,CAAA;AAChF,EAAA,IAAI,CAAC,SAAA,CAAU,QAAA,EAAU,MAAM,IAAI,MAAM,8BAA8B,CAAA;AAEvE,EAAA,OAAO,SAAA;AACT;AAgBA,eAAsB,eAAe,SAAA,EAA2C;AAC9E,EAAA,IAAI,CAAC,SAAA,CAAU,UAAA,CAAW,UAAU,CAAA,EAAG;AACrC,IAAA,MAAM,IAAI,MAAM,6BAA6B,CAAA;AAAA,EAC/C;AAEA,EAAA,MAAM,YAAA,GAAe,GAAG,SAAS,CAAA,qBAAA,CAAA;AAEjC,EAAA,IAAI;AACF,IAAA,MAAM,IAAA,GAAO,MAAM,KAAA,CAAM,YAAA,EAAc;AAAA,MACrC,OAAA,EAAS,EAAE,MAAA,EAAQ,YAAA,EAAa;AAAA,MAChC,MAAA,EAAQ,WAAA,CAAY,OAAA,CAAQ,GAAI;AAAA,KACjC,CAAA;AAED,IAAA,IAAI,CAAC,KAAK,EAAA,EAAI;AACZ,MAAA,MAAM,IAAI,KAAA,CAAM,CAAA,wBAAA,EAA2B,IAAA,CAAK,MAAM,CAAA,CAAE,CAAA;AAAA,IAC1D;AAEA,IAAA,MAAM,IAAA,GAAO,MAAM,IAAA,CAAK,IAAA,EAAK;AAC7B,IAAA,OAAO,eAAe,IAAI,CAAA;AAAA,EAC5B,SAAS,GAAA,EAAK;AACZ,IAAA,MAAM,IAAI,KAAA;AAAA,MACR,CAAA,+BAAA,EAAkC,SAAS,CAAA,EAAA,EACzC,GAAA,YAAe,QAAQ,GAAA,CAAI,OAAA,GAAU,MAAA,CAAO,GAAG,CACjD,CAAA,CAAA;AAAA,MACA,EAAE,OAAO,GAAA;AAAI,KACf;AAAA,EACF;AACF;AC5YA,IAAI,kBAAA,GAA8C,IAAA;AAkB3C,SAAS,mBAAA,GAAwC;AACtD,EAAA,IAAI,kBAAA,EAAoB;AACtB,IAAA,OAAO,kBAAA;AAAA,EACT;AAEA,EAAA,kBAAA,GAAqB,kBAAA,EAAmB;AACxC,EAAA,OAAO,kBAAA;AACT;AAKA,SAAS,kBAAA,GAAuC;AAE9C,EAAA,IAAI,OAAO,OAAA,KAAY,WAAA,IAAe,OAAA,CAAQ,UAAU,IAAA,EAAM;AAC5D,IAAA,OAAO;AAAA,MACL,OAAA,EAAS,MAAA;AAAA,MACT,gBAAA,EAAkB,IAAA;AAAA,MAClB,UAAA,EAAY,IAAA;AAAA,MACZ,gBAAA,EAAkB,KAAA;AAAA,MAClB,eAAA,EAAiB,MAAA;AAAA,MACjB,KAAA,EAAO;AAAA,QACL,uDAAA;AAAA,QACA,+CAAA;AAAA,QACA;AAAA;AACF,KACF;AAAA,EACF;AAGA,EAAA,IAAI,OAAO,OAAA,KAAY,WAAA,IAAe,OAAA,CAAQ,UAAU,GAAA,EAAK;AAC3D,IAAA,OAAO;AAAA,MACL,OAAA,EAAS,KAAA;AAAA,MACT,gBAAA,EAAkB,IAAA;AAAA,MAClB,UAAA,EAAY,IAAA;AAAA,MACZ,gBAAA,EAAkB,KAAA;AAAA,MAClB,eAAA,EAAiB,MAAA;AAAA,MACjB,KAAA,EAAO;AAAA,QACL,0DAAA;AAAA,QACA;AAAA;AACF,KACF;AAAA,EACF;AAGA,EAAA,IAAI,OAAO,UAAA,KAAe,WAAA,IAAe,MAAA,IAAU,UAAA,EAAY;AAC7D,IAAA,OAAO;AAAA,MACL,OAAA,EAAS,MAAA;AAAA,MACT,gBAAA,EAAkB,KAAA;AAAA,MAClB,UAAA,EAAY,KAAA;AAAA,MACZ,gBAAA,EAAkB,KAAA;AAAA,MAClB,eAAA,EAAiB,SAAA;AAAA,MACjB,KAAA,EAAO;AAAA,QACL,qDAAA;AAAA,QACA,+DAAA;AAAA,QACA;AAAA;AACF,KACF;AAAA,EACF;AAGA,EAAA,IACE,OAAO,UAAA,KAAe,WAAA,IACtB,OAAQ,UAAA,CAAuC,WAAW,WAAA,IAC1D,OAAQ,UAAA,CAAuC,YAAA,KAAiB,WAAA,EAChE;AACA,IAAA,OAAO;AAAA,MACL,OAAA,EAAS,oBAAA;AAAA,MACT,gBAAA,EAAkB,KAAA;AAAA,MAClB,UAAA,EAAY,KAAA;AAAA,MACZ,gBAAA,EAAkB,IAAA;AAAA,MAClB,eAAA,EAAiB,SAAA;AAAA,MACjB,KAAA,EAAO;AAAA,QACL,oDAAA;AAAA,QACA,qDAAA;AAAA,QACA,6DAAA;AAAA,QACA;AAAA;AACF,KACF;AAAA,EACF;AAIA,EAAA,MAAM,CAAA,GAAI,UAAA;AACV,EAAA,IAAI,OAAO,CAAA,CAAE,MAAA,KAAW,eAAe,OAAO,CAAA,CAAE,aAAa,WAAA,EAAa;AACxE,IAAA,OAAO;AAAA,MACL,OAAA,EAAS,SAAA;AAAA,MACT,gBAAA,EAAkB,KAAA;AAAA,MAClB,UAAA,EAAY,KAAA;AAAA,MACZ,gBAAA,EAAkB,KAAA;AAAA,MAClB,eAAA,EAAiB,SAAA;AAAA,MACjB,KAAA,EAAO;AAAA,QACL,gEAAA;AAAA,QACA,kDAAA;AAAA,QACA,2DAAA;AAAA,QACA;AAAA;AACF,KACF;AAAA,EACF;AAGA,EAAA,OAAO;AAAA,IACL,OAAA,EAAS,cAAA;AAAA,IACT,gBAAA,EAAkB,KAAA;AAAA,IAClB,UAAA,EAAY,KAAA;AAAA,IACZ,gBAAA,EAAkB,KAAA;AAAA,IAClB,eAAA,EAAiB,SAAA;AAAA,IACjB,KAAA,EAAO;AAAA,MACL,gEAAA;AAAA,MACA,+DAAA;AAAA,MACA;AAAA;AACF,GACF;AACF;AAMO,SAAS,0BAAA,GAAmC;AACjD,EAAA,kBAAA,GAAqB,IAAA;AACvB;AAsFA,SAAS,UAAU,EAAA,EAAgC;AACjD,EAAA,MAAM,KAAA,GAAQ,EAAA,CAAG,KAAA,CAAM,GAAG,CAAA;AAC1B,EAAA,IAAI,KAAA,CAAM,MAAA,KAAW,CAAA,EAAG,OAAO,IAAA;AAE/B,EAAA,MAAM,SAAmB,EAAC;AAC1B,EAAA,KAAA,MAAW,QAAQ,KAAA,EAAO;AACxB,IAAA,MAAM,GAAA,GAAM,QAAA,CAAS,IAAA,EAAM,EAAE,CAAA;AAC7B,IAAA,IAAI,MAAM,GAAG,CAAA,IAAK,MAAM,CAAA,IAAK,GAAA,GAAM,KAAK,OAAO,IAAA;AAC/C,IAAA,MAAA,CAAO,KAAK,GAAG,CAAA;AAAA,EACjB;AAEA,EAAA,OAAO,EAAE,MAAA,EAAmD;AAC9D;AAKA,SAAS,QAAA,CAAS,IAAiB,IAAA,EAAuB;AACxD,EAAA,MAAM,CAAC,QAAA,EAAU,OAAO,CAAA,GAAI,IAAA,CAAK,MAAM,GAAG,CAAA;AAC1C,EAAA,MAAM,KAAA,GAAQ,UAAU,QAAQ,CAAA;AAChC,EAAA,IAAI,CAAC,OAAO,OAAO,KAAA;AAEnB,EAAA,MAAM,QAAA,GAAW,QAAA,CAAS,OAAA,EAAS,EAAE,CAAA;AACrC,EAAA,IAAI,MAAM,QAAQ,CAAA,IAAK,WAAW,CAAA,IAAK,QAAA,GAAW,IAAI,OAAO,KAAA;AAG7D,EAAA,MAAM,QAAS,EAAA,CAAG,MAAA,CAAO,CAAC,CAAA,IAAK,EAAA,GAAO,GAAG,MAAA,CAAO,CAAC,CAAA,IAAK,EAAA,GAAO,GAAG,MAAA,CAAO,CAAC,KAAK,CAAA,GAAK,EAAA,CAAG,OAAO,CAAC,CAAA;AAC7F,EAAA,MAAM,WACH,KAAA,CAAM,MAAA,CAAO,CAAC,CAAA,IAAK,EAAA,GAAO,MAAM,MAAA,CAAO,CAAC,CAAA,IAAK,EAAA,GAAO,MAAM,MAAA,CAAO,CAAC,KAAK,CAAA,GAAK,KAAA,CAAM,OAAO,CAAC,CAAA;AAG7F,EAAA,MAAM,OAAO,QAAA,KAAa,CAAA,GAAI,IAAI,EAAA,CAAG,CAAA,IAAM,KAAK,QAAA,IAAa,CAAA,CAAA;AAE7D,EAAA,OAAA,CAAQ,KAAA,GAAQ,WAAW,QAAA,GAAW,IAAA,CAAA;AACxC;AAKA,SAAS,eAAe,EAAA,EAAqB;AAC3C,EAAA,MAAM,aAAa,EAAA,CAAG,WAAA,EAAY,CAAE,OAAA,CAAQ,YAAY,EAAE,CAAA;AAC1D,EAAA,OAAO,UAAA,KAAe,SAAS,UAAA,KAAe,iBAAA;AAChD;AAKA,SAAS,gBAAgB,EAAA,EAAqB;AAC5C,EAAA,MAAM,UAAA,GAAa,GAAG,WAAA,EAAY;AAClC,EAAA,OACE,UAAA,CAAW,UAAA,CAAW,KAAK,CAAA,IAC3B,WAAW,UAAA,CAAW,KAAK,CAAA,IAC3B,UAAA,CAAW,UAAA,CAAW,KAAK,CAAA,IAC3B,UAAA,CAAW,WAAW,KAAK,CAAA;AAE/B;AAKO,SAAS,YACd,EAAA,EAC0F;AAE1F,EAAA,MAAM,SAAA,GAAY,EAAA,CAAG,KAAA,CAAM,gCAAgC,CAAA;AAC3D,EAAA,MAAM,WAAA,GAAc,SAAA,GAAY,SAAA,CAAU,CAAC,CAAA,GAAI,EAAA;AAG/C,EAAA,MAAM,IAAA,GAAO,UAAU,WAAW,CAAA;AAClC,EAAA,IAAI,IAAA,EAAM;AAER,IAAA,IACE,QAAA,CAAS,IAAA,EAAM,YAAY,CAAA,IAC3B,QAAA,CAAS,IAAA,EAAM,eAAe,CAAA,IAC9B,QAAA,CAAS,IAAA,EAAM,gBAAgB,CAAA,EAC/B;AACA,MAAA,OAAO,EAAE,OAAA,EAAS,IAAA,EAAM,MAAA,EAAQ,YAAA,EAAa;AAAA,IAC/C;AAGA,IAAA,IAAI,QAAA,CAAS,IAAA,EAAM,aAAa,CAAA,EAAG;AACjC,MAAA,OAAO,EAAE,OAAA,EAAS,IAAA,EAAM,MAAA,EAAQ,UAAA,EAAW;AAAA,IAC7C;AAGA,IAAA,IAAI,QAAA,CAAS,IAAA,EAAM,gBAAgB,CAAA,EAAG;AACpC,MAAA,OAAO,EAAE,OAAA,EAAS,IAAA,EAAM,MAAA,EAAQ,YAAA,EAAa;AAAA,IAC/C;AAEA,IAAA,OAAO,EAAE,SAAS,KAAA,EAAM;AAAA,EAC1B;AAGA,EAAA,IAAI,cAAA,CAAe,EAAE,CAAA,EAAG;AACtB,IAAA,OAAO,EAAE,OAAA,EAAS,IAAA,EAAM,MAAA,EAAQ,UAAA,EAAW;AAAA,EAC7C;AACA,EAAA,IAAI,eAAA,CAAgB,EAAE,CAAA,EAAG;AACvB,IAAA,OAAO,EAAE,OAAA,EAAS,IAAA,EAAM,MAAA,EAAQ,YAAA,EAAa;AAAA,EAC/C;AAEA,EAAA,OAAO,EAAE,SAAS,KAAA,EAAM;AAC1B;AA8BA,eAAe,gBACb,QAAA,EACqD;AAErD,EAAA,IAAI,OAAO,OAAA,KAAY,WAAA,IAAe,OAAA,CAAQ,UAAU,IAAA,EAAM;AAC5D,IAAA,IAAI;AACF,MAAA,MAAM,GAAA,GAAM,MAAM,OAAO,KAAK,CAAA;AAC9B,MAAA,MAAM,EAAE,SAAA,EAAU,GAAI,MAAM,OAAO,MAAM,CAAA;AACzC,MAAA,MAAM,QAAA,GAAW,SAAA,CAAU,GAAA,CAAI,QAAQ,CAAA;AACvC,MAAA,MAAM,QAAA,GAAW,SAAA,CAAU,GAAA,CAAI,QAAQ,CAAA;AAEvC,MAAA,MAAM,UAAoB,EAAC;AAC3B,MAAA,IAAI,SAAA,GAA0B,IAAA;AAC9B,MAAA,IAAI,SAAA,GAA0B,IAAA;AAE9B,MAAA,IAAI;AACF,QAAA,MAAM,IAAA,GAAO,MAAM,QAAA,CAAS,QAAQ,CAAA;AACpC,QAAA,OAAA,CAAQ,IAAA,CAAK,GAAG,IAAI,CAAA;AAAA,MACtB,SAAS,GAAA,EAAK;AACZ,QAAA,SAAA,GAAY,GAAA;AAAA,MACd;AAEA,MAAA,IAAI;AACF,QAAA,MAAM,IAAA,GAAO,MAAM,QAAA,CAAS,QAAQ,CAAA;AACpC,QAAA,OAAA,CAAQ,IAAA,CAAK,GAAG,IAAI,CAAA;AAAA,MACtB,SAAS,GAAA,EAAK;AACZ,QAAA,SAAA,GAAY,GAAA;AAAA,MACd;AAGA,MAAA,IAAI,OAAA,CAAQ,SAAS,CAAA,EAAG;AACtB,QAAA,OAAO,EAAE,EAAA,EAAI,IAAA,EAAM,GAAA,EAAK,OAAA,EAAS,SAAS,KAAA,EAAM;AAAA,MAClD;AAGA,MAAA,IAAI,aAAa,SAAA,EAAW;AAC1B,QAAA,OAAO;AAAA,UACL,EAAA,EAAI,KAAA;AAAA,UACJ,OAAA,EAAS,CAAA,0BAAA,EAA6B,QAAQ,CAAA,EAAA,EAAK,UAAU,OAAO,CAAA;AAAA,SACtE;AAAA,MACF;AAGA,MAAA,OAAO,EAAE,EAAA,EAAI,IAAA,EAAM,KAAK,EAAC,EAAG,SAAS,KAAA,EAAM;AAAA,IAC7C,SAAS,GAAA,EAAK;AAEZ,MAAA,OAAO;AAAA,QACL,EAAA,EAAI,KAAA;AAAA,QACJ,OAAA,EAAS,yBAAyB,GAAA,YAAe,KAAA,GAAQ,IAAI,OAAA,GAAU,MAAA,CAAO,GAAG,CAAC,CAAA;AAAA,OACpF;AAAA,IACF;AAAA,EACF;AAIA,EAAA,OAAO,EAAE,EAAA,EAAI,IAAA,EAAM,KAAK,EAAC,EAAG,SAAS,IAAA,EAAK;AAC5C;AAiBA,eAAsB,aAAA,CACpB,GAAA,EACA,OAAA,GAA4B,EAAC,EACc;AAC3C,EAAA,MAAM;AAAA,IACJ,YAAY,eAAA,CAAgB,cAAA;AAAA,IAC5B,WAAW,eAAA,CAAgB,gBAAA;AAAA,IAC3B,YAAA,GAAe,CAAA;AAAA,IACf,iBAAiB,gBAAA,CAAiB,cAAA;AAAA,IAClC,yBAAA,GAA4B,IAAA;AAAA;AAAA,IAC5B,kBAAA,GAAqB,OAAA;AAAA;AAAA,IACrB,UAAU;AAAC,GACb,GAAI,OAAA;AAGJ,EAAA,IAAI,SAAA;AACJ,EAAA,IAAI;AACF,IAAA,SAAA,GAAY,IAAI,IAAI,GAAG,CAAA;AAAA,EACzB,CAAA,CAAA,MAAQ;AACN,IAAA,OAAO;AAAA,MACL,EAAA,EAAI,KAAA;AAAA,MACJ,MAAA,EAAQ,aAAA;AAAA,MACR,OAAA,EAAS,gBAAgB,GAAG,CAAA,CAAA;AAAA,MAC5B,UAAA,EAAY;AAAA,KACd;AAAA,EACF;AAGA,EAAA,IAAI,SAAA,CAAU,aAAa,QAAA,EAAU;AACnC,IAAA,OAAO;AAAA,MACL,EAAA,EAAI,KAAA;AAAA,MACJ,MAAA,EAAQ,WAAA;AAAA,MACR,OAAA,EAAS,uBAAuB,GAAG,CAAA,CAAA;AAAA,MACnC,UAAA,EAAY;AAAA,KACd;AAAA,EACF;AAGA,EAAA,MAAM,SAAA,GAAY,MAAM,eAAA,CAAgB,SAAA,CAAU,QAAQ,CAAA;AAG1D,EAAA,IAAI,CAAC,UAAU,EAAA,EAAI;AACjB,IAAA,IAAI,uBAAuB,OAAA,EAAS;AAClC,MAAA,OAAO;AAAA,QACL,EAAA,EAAI,KAAA;AAAA,QACJ,MAAA,EAAQ,aAAA;AAAA,QACR,OAAA,EAAS,CAAA,wBAAA,EAA2B,SAAA,CAAU,OAAO,CAAA,CAAA;AAAA,QACrD,UAAA,EAAY;AAAA,OACd;AAAA,IACF;AAEA,IAAA,OAAO;AAAA,MACL,EAAA,EAAI,KAAA;AAAA,MACJ,MAAA,EAAQ,eAAA;AAAA,MACR,SAAS,SAAA,CAAU,OAAA;AAAA,MACnB,UAAA,EAAY;AAAA,KACd;AAAA,EACF;AAGA,EAAA,IAAI,CAAC,UAAU,OAAA,EAAS;AACtB,IAAA,KAAA,MAAW,EAAA,IAAM,UAAU,GAAA,EAAK;AAC9B,MAAA,MAAM,WAAA,GAAc,YAAY,EAAE,CAAA;AAClC,MAAA,IAAI,YAAY,OAAA,EAAS;AACvB,QAAA,OAAO;AAAA,UACL,EAAA,EAAI,KAAA;AAAA,UACJ,QAAQ,WAAA,CAAY,MAAA;AAAA,UACpB,SAAS,CAAA,QAAA,EAAW,WAAA,CAAY,MAAM,CAAA,UAAA,EAAa,EAAE,QAAQ,GAAG,CAAA,CAAA;AAAA,UAChE,UAAA,EAAY;AAAA,SACd;AAAA,MACF;AAAA,IACF;AAAA,EACF;AAGA,EAAA,IAAI,aAAA,GAAgB,CAAA;AACpB,EAAA,IAAI,UAAA,GAAa,GAAA;AACjB,EAAA,MAAM,iBAAiB,SAAA,CAAU,MAAA;AAEjC,EAAA,OAAO,IAAA,EAAM;AACX,IAAA,IAAI;AACF,MAAA,MAAM,UAAA,GAAa,IAAI,eAAA,EAAgB;AACvC,MAAA,MAAM,YAAY,UAAA,CAAW,MAAM,UAAA,CAAW,KAAA,IAAS,SAAS,CAAA;AAEhE,MAAA,MAAM,QAAA,GAAW,MAAM,KAAA,CAAM,UAAA,EAAY;AAAA,QACvC,OAAA,EAAS;AAAA,UACP,MAAA,EAAQ,8BAAA;AAAA,UACR,GAAG;AAAA,SACL;AAAA,QACA,QAAQ,UAAA,CAAW,MAAA;AAAA,QACnB,QAAA,EAAU;AAAA;AAAA,OACX,CAAA;AAED,MAAA,YAAA,CAAa,SAAS,CAAA;AAGtB,MAAA,IAAI,QAAA,CAAS,MAAA,IAAU,GAAA,IAAO,QAAA,CAAS,SAAS,GAAA,EAAK;AACnD,QAAA,MAAM,QAAA,GAAW,QAAA,CAAS,OAAA,CAAQ,GAAA,CAAI,UAAU,CAAA;AAEhD,QAAA,IAAI,CAAC,QAAA,EAAU;AACb,UAAA,OAAO;AAAA,YACL,EAAA,EAAI,KAAA;AAAA,YACJ,MAAA,EAAQ,eAAA;AAAA,YACR,OAAA,EAAS,yCAAyC,UAAU,CAAA;AAAA,WAC9D;AAAA,QACF;AAGA,QAAA,IAAI,CAAC,cAAA,EAAgB;AACnB,UAAA,OAAO;AAAA,YACL,EAAA,EAAI,KAAA;AAAA,YACJ,MAAA,EAAQ,oBAAA;AAAA,YACR,OAAA,EAAS,CAAA,uBAAA,EAA0B,UAAU,CAAA,IAAA,EAAO,QAAQ,CAAA,CAAA;AAAA,YAC5D,UAAA,EAAY;AAAA,WACd;AAAA,QACF;AAGA,QAAA,aAAA,EAAA;AACA,QAAA,IAAI,gBAAgB,YAAA,EAAc;AAChC,UAAA,OAAO;AAAA,YACL,EAAA,EAAI,KAAA;AAAA,YACJ,MAAA,EAAQ,oBAAA;AAAA,YACR,OAAA,EAAS,CAAA,oBAAA,EAAuB,aAAa,CAAA,GAAA,EAAM,YAAY,CAAA,CAAA,CAAA;AAAA,YAC/D,UAAA,EAAY;AAAA,WACd;AAAA,QACF;AAGA,QAAA,IAAI,WAAA;AACJ,QAAA,IAAI;AACF,UAAA,WAAA,GAAc,IAAI,GAAA,CAAI,QAAA,EAAU,UAAU,CAAA;AAAA,QAC5C,CAAA,CAAA,MAAQ;AACN,UAAA,OAAO;AAAA,YACL,EAAA,EAAI,KAAA;AAAA,YACJ,MAAA,EAAQ,aAAA;AAAA,YACR,OAAA,EAAS,yBAAyB,QAAQ,CAAA,CAAA;AAAA,YAC1C,UAAA,EAAY;AAAA,WACd;AAAA,QACF;AAGA,QAAA,IAAI,WAAA,CAAY,aAAa,QAAA,EAAU;AACrC,UAAA,OAAO;AAAA,YACL,EAAA,EAAI,KAAA;AAAA,YACJ,MAAA,EAAQ,kBAAA;AAAA,YACR,OAAA,EAAS,CAAA,qCAAA,EAAwC,UAAU,CAAA,IAAA,EAAO,YAAY,IAAI,CAAA,CAAA;AAAA,YAClF,YAAY,WAAA,CAAY;AAAA,WAC1B;AAAA,QACF;AAGA,QAAA,IAAI,WAAA,CAAY,MAAA,KAAW,cAAA,IAAkB,CAAC,yBAAA,EAA2B;AACvE,UAAA,OAAO;AAAA,YACL,EAAA,EAAI,KAAA;AAAA,YACJ,MAAA,EAAQ,uBAAA;AAAA,YACR,OAAA,EAAS,CAAA,mCAAA,EAAsC,cAAc,CAAA,IAAA,EAAO,YAAY,MAAM,CAAA,CAAA;AAAA,YACtF,YAAY,WAAA,CAAY;AAAA,WAC1B;AAAA,QACF;AAGA,QAAA,MAAM,iBAAA,GAAoB,MAAM,eAAA,CAAgB,WAAA,CAAY,QAAQ,CAAA;AAGpE,QAAA,IAAI,CAAC,kBAAkB,EAAA,EAAI;AACzB,UAAA,IAAI,uBAAuB,OAAA,EAAS;AAClC,YAAA,OAAO;AAAA,cACL,EAAA,EAAI,KAAA;AAAA,cACJ,MAAA,EAAQ,aAAA;AAAA,cACR,OAAA,EAAS,CAAA,iCAAA,EAAoC,iBAAA,CAAkB,OAAO,CAAA,CAAA;AAAA,cACtE,YAAY,WAAA,CAAY;AAAA,aAC1B;AAAA,UACF;AACA,UAAA,OAAO;AAAA,YACL,EAAA,EAAI,KAAA;AAAA,YACJ,MAAA,EAAQ,eAAA;AAAA,YACR,SAAS,iBAAA,CAAkB,OAAA;AAAA,YAC3B,YAAY,WAAA,CAAY;AAAA,WAC1B;AAAA,QACF;AAGA,QAAA,IAAI,CAAC,kBAAkB,OAAA,EAAS;AAC9B,UAAA,KAAA,MAAW,EAAA,IAAM,kBAAkB,GAAA,EAAK;AACtC,YAAA,MAAM,WAAA,GAAc,YAAY,EAAE,CAAA;AAClC,YAAA,IAAI,YAAY,OAAA,EAAS;AACvB,cAAA,OAAO;AAAA,gBACL,EAAA,EAAI,KAAA;AAAA,gBACJ,QAAQ,WAAA,CAAY,MAAA;AAAA,gBACpB,OAAA,EAAS,CAAA,oBAAA,EAAuB,WAAA,CAAY,MAAM,aAAa,EAAE,CAAA,CAAA;AAAA,gBACjE,YAAY,WAAA,CAAY;AAAA,eAC1B;AAAA,YACF;AAAA,UACF;AAAA,QACF;AAEA,QAAA,UAAA,GAAa,WAAA,CAAY,IAAA;AACzB,QAAA;AAAA,MACF;AAGA,MAAA,MAAM,aAAA,GAAgB,QAAA,CAAS,OAAA,CAAQ,GAAA,CAAI,gBAAgB,CAAA;AAC3D,MAAA,IAAI,aAAA,IAAiB,QAAA,CAAS,aAAA,EAAe,EAAE,IAAI,QAAA,EAAU;AAC3D,QAAA,OAAO;AAAA,UACL,EAAA,EAAI,KAAA;AAAA,UACJ,MAAA,EAAQ,oBAAA;AAAA,UACR,OAAA,EAAS,CAAA,oBAAA,EAAuB,aAAa,CAAA,SAAA,EAAY,QAAQ,CAAA,IAAA;AAAA,SACnE;AAAA,MACF;AAGA,MAAA,MAAM,MAAA,GAAS,QAAA,CAAS,IAAA,EAAM,SAAA,EAAU;AACxC,MAAA,IAAI,CAAC,MAAA,EAAQ;AACX,QAAA,MAAME,KAAAA,GAAO,MAAM,QAAA,CAAS,IAAA,EAAK;AACjC,QAAA,IAAIA,KAAAA,CAAK,SAAS,QAAA,EAAU;AAC1B,UAAA,OAAO;AAAA,YACL,EAAA,EAAI,KAAA;AAAA,YACJ,MAAA,EAAQ,oBAAA;AAAA,YACR,OAAA,EAAS,CAAA,oBAAA,EAAuBA,KAAAA,CAAK,MAAM,YAAY,QAAQ,CAAA,IAAA;AAAA,WACjE;AAAA,QACF;AAEA,QAAA,MAAMC,SAAAA,GAAW,IAAI,WAAA,EAAY,CAAE,OAAOD,KAAI,CAAA;AAC9C,QAAA,OAAO;AAAA,UACL,EAAA,EAAI,IAAA;AAAA,UACJ,QAAQ,QAAA,CAAS,MAAA;AAAA,UACjB,IAAA,EAAAA,KAAAA;AAAA,UACA,QAAA,EAAAC,SAAAA;AAAA,UACA,WAAA,EAAa,QAAA,CAAS,OAAA,CAAQ,GAAA,CAAI,cAAc,CAAA,IAAK,KAAA;AAAA,SACvD;AAAA,MACF;AAGA,MAAA,MAAM,SAAuB,EAAC;AAC9B,MAAA,IAAI,SAAA,GAAY,CAAA;AAEhB,MAAA,OAAO,IAAA,EAAM;AACX,QAAA,MAAM,EAAE,IAAA,EAAM,KAAA,EAAM,GAAI,MAAM,OAAO,IAAA,EAAK;AAC1C,QAAA,IAAI,IAAA,EAAM;AAEV,QAAA,SAAA,IAAa,KAAA,CAAM,MAAA;AACnB,QAAA,IAAI,YAAY,QAAA,EAAU;AACxB,UAAA,MAAA,CAAO,MAAA,EAAO;AACd,UAAA,OAAO;AAAA,YACL,EAAA,EAAI,KAAA;AAAA,YACJ,MAAA,EAAQ,oBAAA;AAAA,YACR,OAAA,EAAS,CAAA,oBAAA,EAAuB,SAAS,CAAA,SAAA,EAAY,QAAQ,CAAA,IAAA;AAAA,WAC/D;AAAA,QACF;AAEA,QAAA,MAAA,CAAO,KAAK,KAAK,CAAA;AAAA,MACnB;AAGA,MAAA,MAAM,QAAA,GAAW,MAAA,CAAO,MAAA,CAAO,CAAC,KAAK,KAAA,KAAU;AAC7C,QAAA,MAAM,SAAS,IAAI,UAAA,CAAW,GAAA,CAAI,MAAA,GAAS,MAAM,MAAM,CAAA;AACvD,QAAA,MAAA,CAAO,IAAI,GAAG,CAAA;AACd,QAAA,MAAA,CAAO,GAAA,CAAI,KAAA,EAAO,GAAA,CAAI,MAAM,CAAA;AAC5B,QAAA,OAAO,MAAA;AAAA,MACT,CAAA,EAAG,IAAI,UAAA,EAAY,CAAA;AAGnB,MAAA,MAAM,IAAA,GAAO,IAAI,WAAA,EAAY,CAAE,OAAO,QAAQ,CAAA;AAE9C,MAAA,OAAO;AAAA,QACL,EAAA,EAAI,IAAA;AAAA,QACJ,QAAQ,QAAA,CAAS,MAAA;AAAA,QACjB,IAAA;AAAA,QACA,QAAA;AAAA,QACA,WAAA,EAAa,QAAA,CAAS,OAAA,CAAQ,GAAA,CAAI,cAAc,CAAA,IAAK,KAAA;AAAA,OACvD;AAAA,IACF,SAAS,GAAA,EAAK;AACZ,MAAA,IAAI,eAAe,KAAA,EAAO;AACxB,QAAA,IAAI,IAAI,IAAA,KAAS,YAAA,IAAgB,IAAI,OAAA,CAAQ,QAAA,CAAS,SAAS,CAAA,EAAG;AAChE,UAAA,OAAO;AAAA,YACL,EAAA,EAAI,KAAA;AAAA,YACJ,MAAA,EAAQ,SAAA;AAAA,YACR,OAAA,EAAS,CAAA,oBAAA,EAAuB,SAAS,CAAA,IAAA,EAAO,UAAU,CAAA;AAAA,WAC5D;AAAA,QACF;AAAA,MACF;AAEA,MAAA,OAAO;AAAA,QACL,EAAA,EAAI,KAAA;AAAA,QACJ,MAAA,EAAQ,eAAA;AAAA,QACR,OAAA,EAAS,kBAAkB,GAAA,YAAe,KAAA,GAAQ,IAAI,OAAA,GAAU,MAAA,CAAO,GAAG,CAAC,CAAA;AAAA,OAC7E;AAAA,IACF;AAAA,EACF;AACF;AAKA,eAAsB,aAAA,CACpB,SACA,OAAA,EAC2C;AAC3C,EAAA,OAAO,cAAc,OAAA,EAAS;AAAA,IAC5B,GAAG,OAAA;AAAA,IACH,UAAU,eAAA,CAAgB,YAAA;AAAA,IAC1B,OAAA,EAAS;AAAA,MACP,MAAA,EAAQ,kBAAA;AAAA,MACR,GAAG,OAAA,EAAS;AAAA;AACd,GACD,CAAA;AACH;AAKA,eAAsB,gBAAA,CACpB,YACA,OAAA,EAC2C;AAC3C,EAAA,OAAO,cAAc,UAAA,EAAY;AAAA,IAC/B,GAAG,OAAA;AAAA,IACH,UAAU,eAAA,CAAgB,eAAA;AAAA,IAC1B,OAAA,EAAS;AAAA,MACP,MAAA,EAAQ,oCAAA;AAAA,MACR,GAAG,OAAA,EAAS;AAAA;AACd,GACD,CAAA;AACH;;;ACvvBA,IAAM,yBAAA,GAA4B,IAAI,EAAA,GAAK,GAAA;AAC3C,IAAM,8BAAA,GAAiC,GAAA;AAchC,SAAS,qBAAA,CACd,IAAA,EACA,QAAA,EACA,GAAA,GAA0C,OAAO,YAAY,WAAA,GACxD,OAAA,CAAQ,GAAA,GACT,EAAC,EACG;AACR,EAAA,MAAM,GAAA,GAAM,IAAI,IAAI,CAAA;AACpB,EAAA,IAAI,CAAC,KAAK,OAAO,QAAA;AACjB,EAAA,IAAI,CAAC,eAAA,CAAgB,IAAA,CAAK,GAAG,GAAG,OAAO,QAAA;AACvC,EAAA,MAAM,MAAA,GAAS,QAAA,CAAS,GAAA,EAAK,EAAE,CAAA;AAC/B,EAAA,OAAO,MAAA,GAAS,IAAI,MAAA,GAAS,QAAA;AAC/B;AAEA,IAAM,oBAAA,GAAuB,qBAAA;AAAA,EAC3B,wBAAA;AAAA,EACA;AACF,CAAA;AACA,IAAM,yBAAA,GAA4B,qBAAA;AAAA,EAChC,6BAAA;AAAA,EACA;AACF,CAAA;AAMA,IAAM,SAAA,uBAAgB,GAAA,EAA4B;AAiBlD,IAAM,gBAAA,GAAmB,EAAA,GAAK,EAAA,GAAK,EAAA,GAAK,EAAA,GAAK,GAAA;AAM7C,IAAM,0BAAA,GAA6B,GAAA;AAEnC,IAAM,cAAA,uBAAqB,GAAA,EAAgC;AAM3D,SAAS,uBAAuB,GAAA,EAAmB;AACjD,EAAA,KAAA,MAAW,CAAC,GAAA,EAAK,KAAK,CAAA,IAAK,cAAA,EAAgB;AACzC,IAAA,IAAI,GAAA,GAAM,KAAA,CAAM,SAAA,IAAa,gBAAA,EAAkB;AAC7C,MAAA,cAAA,CAAe,OAAO,GAAG,CAAA;AAAA,IAC3B;AAAA,EACF;AACF;AAMA,SAAS,qBAAA,GAA8B;AACrC,EAAA,IAAI,cAAA,CAAe,QAAQ,0BAAA,EAA4B;AAGvD,EAAA,MAAM,UAAU,KAAA,CAAM,IAAA,CAAK,cAAA,CAAe,OAAA,EAAS,CAAA,CAAE,IAAA;AAAA,IACnD,CAAC,GAAG,CAAA,KAAM,CAAA,CAAE,CAAC,CAAA,CAAE,SAAA,GAAY,CAAA,CAAE,CAAC,CAAA,CAAE;AAAA,GAClC;AAGA,EAAA,MAAM,QAAA,GAAW,eAAe,IAAA,GAAO,0BAAA;AACvC,EAAA,KAAA,IAAS,CAAA,GAAI,CAAA,EAAG,CAAA,GAAI,QAAA,EAAU,CAAA,EAAA,EAAK;AACjC,IAAA,cAAA,CAAe,MAAA,CAAO,OAAA,CAAQ,CAAC,CAAA,CAAE,CAAC,CAAC,CAAA;AAAA,EACrC;AACF;AAWA,SAAS,aAAA,CAAc,MAAA,EAAgB,IAAA,EAAY,GAAA,EAA4B;AAE7E,EAAA,sBAAA,CAAuB,GAAG,CAAA;AAE1B,EAAA,KAAA,MAAW,GAAA,IAAO,KAAK,IAAA,EAAM;AAC3B,IAAA,IAAI,CAAC,GAAA,CAAI,GAAA,IAAO,CAAC,IAAI,CAAA,EAAG;AACxB,IAAA,MAAM,MAAA,GAAS,CAAA,EAAG,MAAM,CAAA,CAAA,EAAI,IAAI,GAAG,CAAA,CAAA;AACnC,IAAA,MAAM,QAAA,GAAW,cAAA,CAAe,GAAA,CAAI,MAAM,CAAA;AAE1C,IAAA,IAAI,QAAA,EAAU;AAEZ,MAAA,IAAI,GAAA,GAAM,QAAA,CAAS,SAAA,GAAY,gBAAA,EAAkB;AAC/C,QAAA,IAAI,QAAA,CAAS,UAAA,KAAe,GAAA,CAAI,CAAA,EAAG;AACjC,UAAA,OAAO,CAAA,wBAAA,EAA2B,GAAA,CAAI,GAAG,CAAA,YAAA,EAAe,MAAM,CAAA,+BAAA,CAAA;AAAA,QAChE;AAAA,MACF,CAAA,MAAO;AAEL,QAAA,cAAA,CAAe,GAAA,CAAI,QAAQ,EAAE,UAAA,EAAY,IAAI,CAAA,EAAG,SAAA,EAAW,KAAK,CAAA;AAAA,MAClE;AAAA,IACF,CAAA,MAAO;AAEL,MAAA,cAAA,CAAe,GAAA,CAAI,QAAQ,EAAE,UAAA,EAAY,IAAI,CAAA,EAAG,SAAA,EAAW,KAAK,CAAA;AAAA,IAClE;AAAA,EACF;AAGA,EAAA,qBAAA,EAAsB;AAEtB,EAAA,OAAO,IAAA;AACT;AAMO,SAAS,mBAAA,GAA4B;AAC1C,EAAA,cAAA,CAAe,KAAA,EAAM;AACvB;AAMO,SAAS,oBAAA,GAA+B;AAC7C,EAAA,OAAO,cAAA,CAAe,IAAA;AACxB;AAMA,SAAS,QAAA,CAAS,KAAa,GAAA,EAAyC;AACtE,EAAA,MAAM,KAAA,GAAQ,SAAA,CAAU,GAAA,CAAI,GAAG,CAAA;AAC/B,EAAA,IAAI,CAAC,OAAO,OAAO,MAAA;AACnB,EAAA,IAAI,KAAA,CAAM,aAAa,GAAA,EAAK;AAC1B,IAAA,SAAA,CAAU,OAAO,GAAG,CAAA;AACpB,IAAA,OAAO,MAAA;AAAA,EACT;AAEA,EAAA,SAAA,CAAU,OAAO,GAAG,CAAA;AACpB,EAAA,SAAA,CAAU,GAAA,CAAI,KAAK,KAAK,CAAA;AACxB,EAAA,OAAO,KAAA;AACT;AAKA,SAAS,QAAA,CAAS,GAAA,EAAa,KAAA,EAAuB,UAAA,EAA0B;AAC9E,EAAA,IAAI,UAAU,GAAA,CAAI,GAAG,CAAA,EAAG,SAAA,CAAU,OAAO,GAAG,CAAA;AAC5C,EAAA,SAAA,CAAU,GAAA,CAAI,KAAK,KAAK,CAAA;AAExB,EAAA,OAAO,SAAA,CAAU,OAAO,UAAA,EAAY;AAClC,IAAA,MAAM,SAAA,GAAY,SAAA,CAAU,IAAA,EAAK,CAAE,MAAK,CAAE,KAAA;AAC1C,IAAA,IAAI,SAAA,KAAc,MAAA,EAAW,SAAA,CAAU,MAAA,CAAO,SAAS,CAAA;AAAA,EACzD;AACF;AAKO,SAAS,cAAA,GAAuB;AACrC,EAAA,SAAA,CAAU,KAAA,EAAM;AAClB;AAMO,SAAS,gBAAA,GAA2B;AACzC,EAAA,OAAO,SAAA,CAAU,IAAA;AACnB;AAqBA,SAAS,yBACP,SAAA,EAC+D;AAC/D,EAAA,IAAI;AACF,IAAA,MAAM,MAAA,GAAS,IAAI,GAAA,CAAI,SAAS,CAAA,CAAE,MAAA;AAElC,IAAA,IAAI,WAAW,MAAA,EAAQ;AACrB,MAAA,OAAO,EAAE,EAAA,EAAI,KAAA,EAAO,OAAA,EAAS,CAAA,gCAAA,EAAmC,SAAS,CAAA,CAAA,EAAG;AAAA,IAC9E;AACA,IAAA,OAAO,EAAE,EAAA,EAAI,IAAA,EAAM,MAAA,EAAO;AAAA,EAC5B,CAAA,CAAA,MAAQ;AACN,IAAA,OAAO,EAAE,EAAA,EAAI,KAAA,EAAO,OAAA,EAAS,CAAA,+BAAA,EAAkC,SAAS,CAAA,CAAA,EAAG;AAAA,EAC7E;AACF;AAUA,SAAS,YAAA,CACP,QACA,OAAA,EACoD;AACpD,EAAA,IAAI,IAAA;AACJ,EAAA,QAAQ,MAAA;AAAQ,IACd,KAAK,WAAA;AACH,MAAA,IAAA,GAAO,kCAAA;AACP,MAAA;AAAA,IACF,KAAK,YAAA;AAAA,IACL,KAAK,UAAA;AAAA,IACL,KAAK,YAAA;AACH,MAAA,IAAA,GAAO,4BAAA;AACP,MAAA;AAAA,IACF,KAAK,SAAA;AACH,MAAA,IAAA,GAAO,4BAAA;AACP,MAAA;AAAA,IACF,KAAK,oBAAA;AACH,MAAA,IAAA,GAAO,OAAA,KAAY,SAAS,yBAAA,GAA4B,2BAAA;AACxD,MAAA;AAAA,IACF,KAAK,aAAA;AAAA,IACL,KAAK,eAAA;AAAA,IACL,KAAK,oBAAA;AAAA,IACL,KAAK,kBAAA;AAAA,IACL,KAAK,uBAAA;AAAA,IACL,KAAK,aAAA;AACH,MAAA,IAAA,GACE,OAAA,KAAY,kBACR,gCAAA,GACA,2BAAA;AACN,MAAA;AAAA,IACF,KAAK,oBAAA;AACH,MAAA,IAAA,GAAO,6BAAA;AACP,MAAA;AAAA,IACF;AACE,MAAA,IAAA,GAAO,2BAAA;AACP,MAAA;AAAA;AAEJ,EAAA,OAAO,EAAE,MAAM,MAAA,EAAO;AACxB;AAgBA,eAAsB,WAAA,CACpB,WACA,OAAA,EAC4B;AAC5B,EAAA,MAAM,UAAA,GAAa,SAAS,UAAA,IAAc,oBAAA;AAC1C,EAAA,MAAM,eAAA,GAAkB,SAAS,eAAA,IAAmB,yBAAA;AACpD,EAAA,MAAM,OAAA,GAAU,SAAS,OAAA,IAAW,KAAA;AAGpC,EAAA,MAAM,UAAA,GAAa,yBAAyB,SAAS,CAAA;AACrD,EAAA,IAAI,CAAC,WAAW,EAAA,EAAI;AAClB,IAAA,OAAO;AAAA,MACL,EAAA,EAAI,KAAA;AAAA,MACJ,IAAA,EAAM,gCAAA;AAAA,MACN,SAAS,UAAA,CAAW,OAAA;AAAA,MACpB,UAAA,EAAY;AAAA,KACd;AAAA,EACF;AACA,EAAA,MAAM,mBAAmB,UAAA,CAAW,MAAA;AACpC,EAAA,MAAM,GAAA,GAAM,KAAK,GAAA,EAAI;AAGrB,EAAA,IAAI,CAAC,OAAA,EAAS;AACZ,IAAA,MAAM,MAAA,GAAS,QAAA,CAAS,gBAAA,EAAkB,GAAG,CAAA;AAC7C,IAAA,IAAI,MAAA,EAAQ;AACV,MAAA,OAAO,EAAE,EAAA,EAAI,IAAA,EAAM,IAAA,EAAM,MAAA,CAAO,MAAM,SAAA,EAAW,IAAA,EAAM,WAAA,EAAa,MAAA,CAAO,WAAA,EAAY;AAAA,IACzF;AAAA,EACF;AAGA,EAAA,IAAI,CAAC,gBAAA,CAAiB,UAAA,CAAW,UAAU,CAAA,EAAG;AAC5C,IAAA,OAAO;AAAA,MACL,EAAA,EAAI,KAAA;AAAA,MACJ,IAAA,EAAM,kCAAA;AAAA,MACN,OAAA,EAAS,6BAA6B,gBAAgB,CAAA,CAAA;AAAA,MACtD,UAAA,EAAY;AAAA,KACd;AAAA,EACF;AAGA,EAAA,MAAM,SAAA,GAAY,GAAG,gBAAgB,CAAA,6BAAA,CAAA;AACrC,EAAA,MAAM,YAAA,GAAe,MAAM,aAAA,CAAc,SAAA,EAAW;AAAA,IAClD,QAAA,EAAUC,4BAAAA;AAAA,IACV,OAAA,EAAS,EAAE,MAAA,EAAQ,kBAAA;AAAmB,GACvC,CAAA;AAED,EAAA,IAAI,CAAC,aAAa,EAAA,EAAI;AACpB,IAAA,MAAM,MAAA,GAAS,YAAA,CAAa,YAAA,CAAa,MAAA,EAAQ,eAAe,CAAA;AAChE,IAAA,OAAO;AAAA,MACL,EAAA,EAAI,KAAA;AAAA,MACJ,MAAM,MAAA,CAAO,IAAA;AAAA,MACb,OAAA,EAAS,CAAA,kCAAA,EAAqC,YAAA,CAAa,OAAO,CAAA,CAAA;AAAA,MAClE,QAAQ,MAAA,CAAO,MAAA;AAAA,MACf,YAAY,YAAA,CAAa;AAAA,KAC3B;AAAA,EACF;AAGA,EAAA,IAAI,YAAA;AACJ,EAAA,IAAI;AACF,IAAA,YAAA,GAAe,iBAAA,CAAkB,aAAa,IAAI,CAAA;AAAA,EACpD,SAAS,GAAA,EAAK;AACZ,IAAA,OAAO;AAAA,MACL,EAAA,EAAI,KAAA;AAAA,MACJ,IAAA,EAAM,gCAAA;AAAA,MACN,OAAA,EAAS,6BAA6B,GAAA,YAAe,KAAA,GAAQ,IAAI,OAAA,GAAU,MAAA,CAAO,GAAG,CAAC,CAAA;AAAA,KACxF;AAAA,EACF;AAGA,EAAA,MAAM,kBAAA,GAAqB,wBAAA,CAAyB,YAAA,CAAa,MAAM,CAAA;AACvE,EAAA,MAAM,YAAA,GAAe,kBAAA,CAAmB,EAAA,GAAK,kBAAA,CAAmB,SAAS,YAAA,CAAa,MAAA;AACtF,EAAA,IAAI,iBAAiB,gBAAA,EAAkB;AACrC,IAAA,OAAO;AAAA,MACL,EAAA,EAAI,KAAA;AAAA,MACJ,IAAA,EAAM,0BAAA;AAAA,MACN,OAAA,EAAS,CAAA,0BAAA,EAA6B,gBAAgB,CAAA,MAAA,EAAS,YAAY,CAAA;AAAA,KAC7E;AAAA,EACF;AAGA,EAAA,IAAI,CAAC,aAAa,QAAA,EAAU;AAC1B,IAAA,OAAO;AAAA,MACL,EAAA,EAAI,KAAA;AAAA,MACJ,IAAA,EAAM,2BAAA;AAAA,MACN,OAAA,EAAS;AAAA,KACX;AAAA,EACF;AAEA,EAAA,IAAI,CAAC,YAAA,CAAa,QAAA,CAAS,UAAA,CAAW,UAAU,CAAA,EAAG;AACjD,IAAA,OAAO;AAAA,MACL,EAAA,EAAI,KAAA;AAAA,MACJ,IAAA,EAAM,2BAAA;AAAA,MACN,OAAA,EAAS,CAAA,wBAAA,EAA2B,YAAA,CAAa,QAAQ,CAAA,CAAA;AAAA,MACzD,YAAY,YAAA,CAAa;AAAA,KAC3B;AAAA,EACF;AAGA,EAAA,MAAM,UAAA,GAAa,MAAM,aAAA,CAAc,YAAA,CAAa,QAAQ,CAAA;AAE5D,EAAA,IAAI,CAAC,WAAW,EAAA,EAAI;AAClB,IAAA,MAAM,MAAA,GAAS,YAAA,CAAa,UAAA,CAAW,MAAA,EAAQ,MAAM,CAAA;AACrD,IAAA,OAAO;AAAA,MACL,EAAA,EAAI,KAAA;AAAA,MACJ,MAAM,MAAA,CAAO,IAAA;AAAA,MACb,SAAS,CAAA,0BAAA,EAA6B,YAAA,CAAa,QAAQ,CAAA,EAAA,EAAK,WAAW,OAAO,CAAA,CAAA;AAAA,MAClF,QAAQ,MAAA,CAAO,MAAA;AAAA,MACf,YAAY,UAAA,CAAW;AAAA,KACzB;AAAA,EACF;AAGA,EAAA,IAAI,IAAA;AACJ,EAAA,IAAI;AACF,IAAA,IAAA,GAAO,IAAA,CAAK,KAAA,CAAM,UAAA,CAAW,IAAI,CAAA;AAAA,EACnC,CAAA,CAAA,MAAQ;AACN,IAAA,OAAO;AAAA,MACL,EAAA,EAAI,KAAA;AAAA,MACJ,IAAA,EAAM,uBAAA;AAAA,MACN,OAAA,EAAS;AAAA,KACX;AAAA,EACF;AAEA,EAAA,IAAI,CAAC,KAAK,IAAA,IAAQ,CAAC,MAAM,OAAA,CAAQ,IAAA,CAAK,IAAI,CAAA,EAAG;AAC3C,IAAA,OAAO;AAAA,MACL,EAAA,EAAI,KAAA;AAAA,MACJ,IAAA,EAAM,uBAAA;AAAA,MACN,OAAA,EAAS;AAAA,KACX;AAAA,EACF;AAEA,EAAA,IAAI,IAAA,CAAK,IAAA,CAAK,MAAA,GAASC,eAAAA,CAAgB,WAAA,EAAa;AAClD,IAAA,OAAO;AAAA,MACL,EAAA,EAAI,KAAA;AAAA,MACJ,IAAA,EAAM,6BAAA;AAAA,MACN,SAAS,CAAA,wBAAA,EAA2B,IAAA,CAAK,KAAK,MAAM,CAAA,GAAA,EAAMA,gBAAgB,WAAW,CAAA;AAAA,KACvF;AAAA,EACF;AAGA,EAAA,MAAM,aAAA,GAAgB,aAAA,CAAc,gBAAA,EAAkB,IAAA,EAAM,GAAG,CAAA;AAC/D,EAAA,IAAI,aAAA,EAAe;AACjB,IAAA,OAAO;AAAA,MACL,EAAA,EAAI,KAAA;AAAA,MACJ,IAAA,EAAM,sBAAA;AAAA,MACN,OAAA,EAAS;AAAA,KACX;AAAA,EACF;AAGA,EAAA,MAAM,WAAA,GAAc,YAAA,CAAa,YAAA,EAAc,GAAA,CAAI,CAAC,KAAA,MAAW;AAAA,IAC7D,KAAK,KAAA,CAAM,GAAA;AAAA,IACX,YAAY,KAAA,CAAM,UAAA;AAAA,IAClB,QAAQ,KAAA,CAAM;AAAA,GAChB,CAAE,CAAA;AAGF,EAAA,IAAI,CAAC,OAAA,EAAS;AACZ,IAAA,QAAA,CAAS,gBAAA,EAAkB,EAAE,IAAA,EAAM,SAAA,EAAW,MAAM,UAAA,EAAY,WAAA,IAAe,eAAe,CAAA;AAAA,EAChG;AAEA,EAAA,OAAO;AAAA,IACL,EAAA,EAAI,IAAA;AAAA,IACJ,IAAA;AAAA,IACA,SAAA,EAAW,KAAA;AAAA,IACX,UAAU,UAAA,CAAW,QAAA;AAAA,IACrB;AAAA,GACF;AACF;AC/iBO,IAAM,uBAAA,GAA0B,EAAA;AAUhC,SAAS,2BAA2B,GAAA,EAA4B;AACrE,EAAA,MAAM,KAAA,GAAQ,GAAA,CAAI,KAAA,CAAM,GAAG,CAAA;AAC3B,EAAA,IAAI,KAAA,CAAM,WAAW,CAAA,EAAG;AACtB,IAAA,OAAO,IAAA;AAAA,EACT;AACA,EAAA,IAAI;AACF,IAAA,OAAO,eAAA,CAAgB,KAAA,CAAM,CAAC,CAAC,CAAA,CAAE,MAAA;AAAA,EACnC,CAAA,CAAA,MAAQ;AACN,IAAA,OAAO,IAAA;AAAA,EACT;AACF;;;ACRA,SAAS,eAAe,GAAA,EAAsB;AAC5C,EAAA,IAAI,GAAA,CAAI,GAAA,KAAQ,KAAA,IAAS,GAAA,CAAI,QAAQ,SAAA,EAAW;AAC9C,IAAA,MAAM,IAAI,MAAM,+CAA+C,CAAA;AAAA,EACjE;AAGA,EAAA,MAAM,MAAA,GAAS,MAAA,CAAO,IAAA,CAAK,GAAA,CAAI,GAAG,WAAW,CAAA;AAC7C,EAAA,IAAI,MAAA,CAAO,WAAW,EAAA,EAAI;AACxB,IAAA,MAAM,IAAI,MAAM,qCAAqC,CAAA;AAAA,EACvD;AAEA,EAAA,OAAO,IAAI,WAAW,MAAM,CAAA;AAC9B;AAkEA,eAAsB,cACpB,YAAA,EACuC;AAGvC,EAAA,MAAM,iBAAA,GACJ,OAAO,YAAA,KAAiB,QAAA,GAAW,MAAA,GAAa,YAAA;AAClD,EAAA,KAAK,mBAAmB,iBAAiB,CAAA;AAGzC,EAAA,MAAM,UAAA,GAAa,OAAO,YAAA,KAAiB,QAAA,GAAW,eAAe,YAAA,CAAa,UAAA;AAClF,EAAA,MAAM,aAAA,GACJ,OAAO,YAAA,KAAiB,QAAA,GAAW,SAAY,YAAA,CAAa,gBAAA;AAC9D,EAAA,MAAM,SAAA,GAAY,OAAO,YAAA,KAAiB,QAAA,GAAW,SAAY,YAAA,CAAa,SAAA;AAC9E,EAAA,MAAM,SAAA,GAAY,YAAY,GAAA,EAAI;AAClC,EAAA,IAAI,aAAA;AAEJ,EAAA,IAAI;AAEF,IAAA,MAAM,EAAE,MAAA,EAAQ,OAAA,EAAQ,GAAI,OAA0B,UAAU,CAAA;AAGhE,IAAA,MAAM,gBAAA,GAAmBJ,0BAA0B,OAAO,CAAA;AAC1D,IAAA,IAAI,CAAC,iBAAiB,KAAA,EAAO;AAC3B,MAAA,MAAM,CAAA,GAAI,gBAAA,CAAiB,UAAA,CAAW,CAAC,CAAA;AACvC,MAAA,OAAO;AAAA,QACL,EAAA,EAAI,KAAA;AAAA,QACJ,MAAA,EAAQ,sBAAA;AAAA,QACR,OAAA,EAAS,+BAA+B,CAAA,CAAE,UAAU,aAAa,CAAA,CAAE,MAAM,CAAA,SAAA,EAAY,CAAA,CAAE,KAAK,CAAA,CAAA;AAAA,OAC9F;AAAA,IACF;AAGA,IAAAK,aAAAA,CAAc,MAAM,OAAO,CAAA;AAG3B,IAAA,IAAI,OAAA,CAAQ,GAAA,IAAO,OAAA,CAAQ,GAAA,GAAM,IAAA,CAAK,MAAM,IAAA,CAAK,GAAA,EAAI,GAAI,GAAI,CAAA,EAAG;AAC9D,MAAA,MAAM,UAAA,GAAa,WAAA,CAAY,GAAA,EAAI,GAAI,SAAA;AACvC,MAAA,iBAAA,CAAkB,WAAW,iBAAA,EAAmB;AAAA,QAC9C,WAAA,EAAa,YAAY,UAAU,CAAA;AAAA,QACnC,KAAA,EAAO,KAAA;AAAA,QACP,UAAA,EAAY,SAAA;AAAA,QACZ,QAAQ,OAAA,CAAQ,GAAA;AAAA,QAChB,KAAK,MAAA,CAAO,GAAA;AAAA,QACZ;AAAA,OACD,CAAA;AACD,MAAA,OAAO;AAAA,QACL,EAAA,EAAI,KAAA;AAAA,QACJ,MAAA,EAAQ,SAAA;AAAA,QACR,OAAA,EAAS,sBAAsB,IAAI,IAAA,CAAK,QAAQ,GAAA,GAAM,GAAI,CAAA,CAAE,WAAA,EAAa,CAAA;AAAA,OAC3E;AAAA,IACF;AAGA,IAAA,MAAM,cAAA,GAAiB,YAAY,GAAA,EAAI;AACvC,IAAA,MAAM,UAAA,GAAa,MAAM,WAAA,CAAY,OAAA,CAAQ,GAAG,CAAA;AAEhD,IAAA,IAAI,CAAC,WAAW,EAAA,EAAI;AAClB,MAAA,OAAO;AAAA,QACL,EAAA,EAAI,KAAA;AAAA,QACJ,QAAQ,UAAA,CAAW,IAAA;AAAA,QACnB,SAAS,UAAA,CAAW;AAAA,OACtB;AAAA,IACF;AAEA,IAAA,IAAI,CAAC,WAAW,SAAA,EAAW;AACzB,MAAA,aAAA,GAAgB,WAAA,CAAY,KAAI,GAAI,cAAA;AAAA,IACtC;AAGA,IAAA,IAAI,WAAW,WAAA,EAAa;AAC1B,MAAA,MAAM,YAAA,GAAe,WAAW,WAAA,CAAY,IAAA,CAAK,CAAC,EAAA,KAAO,EAAA,CAAG,GAAA,KAAQ,MAAA,CAAO,GAAG,CAAA;AAC9E,MAAA,IAAI,YAAA,EAAc;AAChB,QAAA,MAAM,UAAA,GAAa,WAAA,CAAY,GAAA,EAAI,GAAI,SAAA;AACvC,QAAA,iBAAA,CAAkB,WAAW,iBAAA,EAAmB;AAAA,UAC9C,WAAA,EAAa,YAAY,UAAU,CAAA;AAAA,UACnC,KAAA,EAAO,KAAA;AAAA,UACP,UAAA,EAAY,aAAA;AAAA,UACZ,QAAQ,OAAA,CAAQ,GAAA;AAAA,UAChB,KAAK,MAAA,CAAO,GAAA;AAAA,UACZ;AAAA,SACD,CAAA;AACD,QAAA,OAAO;AAAA,UACL,EAAA,EAAI,KAAA;AAAA,UACJ,MAAA,EAAQ,aAAA;AAAA,UACR,OAAA,EAAS,CAAA,QAAA,EAAW,MAAA,CAAO,GAAG,mBAAmB,YAAA,CAAa,UAAU,CAAA,EAAG,YAAA,CAAa,MAAA,GAAS,CAAA,UAAA,EAAa,YAAA,CAAa,MAAM,MAAM,EAAE,CAAA;AAAA,SAC3I;AAAA,MACF;AAAA,IACF;AAGA,IAAA,MAAM,GAAA,GAAM,UAAA,CAAW,IAAA,CAAK,IAAA,CAAK,IAAA,CAAK,CAAC,CAAA,KAAM,CAAA,CAAE,GAAA,KAAQ,MAAA,CAAO,GAAG,CAAA;AACjE,IAAA,IAAI,CAAC,GAAA,EAAK;AACR,MAAA,MAAM,UAAA,GAAa,WAAA,CAAY,GAAA,EAAI,GAAI,SAAA;AACvC,MAAA,iBAAA,CAAkB,WAAW,iBAAA,EAAmB;AAAA,QAC9C,WAAA,EAAa,YAAY,UAAU,CAAA;AAAA,QACnC,KAAA,EAAO,KAAA;AAAA,QACP,UAAA,EAAY,aAAA;AAAA,QACZ,QAAQ,OAAA,CAAQ,GAAA;AAAA,QAChB,KAAK,MAAA,CAAO,GAAA;AAAA,QACZ;AAAA,OACD,CAAA;AACD,MAAA,OAAO;AAAA,QACL,EAAA,EAAI,KAAA;AAAA,QACJ,MAAA,EAAQ,aAAA;AAAA,QACR,OAAA,EAAS,CAAA,sBAAA,EAAyB,MAAA,CAAO,GAAG,CAAA;AAAA,OAC9C;AAAA,IACF;AAGA,IAAA,MAAM,SAAA,GAAY,eAAe,GAAG,CAAA;AAOpC,IAAA,MAAM,cAAA,GAAiB,2BAA2B,UAAU,CAAA;AAC5D,IAAA,IAAI,cAAA,KAAmB,IAAA,IAAQ,cAAA,KAAmB,uBAAA,EAAyB;AACzE,MAAA,MAAM,UAAA,GAAa,WAAA,CAAY,GAAA,EAAI,GAAI,SAAA;AACvC,MAAA,iBAAA,CAAkB,WAAW,iBAAA,EAAmB;AAAA,QAC9C,WAAA,EAAa,YAAY,UAAU,CAAA;AAAA,QACnC,KAAA,EAAO,KAAA;AAAA,QACP,UAAA,EAAY,mBAAA;AAAA,QACZ,QAAQ,OAAA,CAAQ,GAAA;AAAA,QAChB,KAAK,MAAA,CAAO,GAAA;AAAA,QACZ;AAAA,OACD,CAAA;AACD,MAAA,OAAO;AAAA,QACL,EAAA,EAAI,KAAA;AAAA,QACJ,MAAA,EAAQ,mBAAA;AAAA,QACR,OAAA,EAAS;AAAA,OACX;AAAA,IACF;AAGA,IAAA,MAAM,MAAA,GAAS,MAAMC,MAAA,CAA6B,UAAA,EAAY,SAAS,CAAA;AAEvE,IAAA,IAAI,CAAC,OAAO,KAAA,EAAO;AACjB,MAAA,MAAM,UAAA,GAAa,WAAA,CAAY,GAAA,EAAI,GAAI,SAAA;AACvC,MAAA,iBAAA,CAAkB,WAAW,iBAAA,EAAmB;AAAA,QAC9C,WAAA,EAAa,YAAY,UAAU,CAAA;AAAA,QACnC,KAAA,EAAO,KAAA;AAAA,QACP,UAAA,EAAY,mBAAA;AAAA,QACZ,QAAQ,OAAA,CAAQ,GAAA;AAAA,QAChB,KAAK,MAAA,CAAO,GAAA;AAAA,QACZ;AAAA,OACD,CAAA;AACD,MAAA,OAAO;AAAA,QACL,EAAA,EAAI,KAAA;AAAA,QACJ,MAAA,EAAQ,mBAAA;AAAA,QACR,OAAA,EAAS;AAAA,OACX;AAAA,IACF;AAIA,IAAA,MAAM,iBAAA,GAAoBC,wBAAwB,aAAa,CAAA;AAE/D,IAAA,MAAM,UAAA,GAAa,WAAA,CAAY,GAAA,EAAI,GAAI,SAAA;AAGvC,IAAA,iBAAA,CAAkB,WAAW,iBAAA,EAAmB;AAAA,MAC9C,WAAA,EAAa,YAAY,UAAU,CAAA;AAAA,MACnC,KAAA,EAAO,IAAA;AAAA,MACP,QAAQ,OAAA,CAAQ,GAAA;AAAA,MAChB,KAAK,MAAA,CAAO,GAAA;AAAA,MACZ,UAAA,EAAY;AAAA,KACb,CAAA;AAED,IAAA,OAAO;AAAA,MACL,EAAA,EAAI,IAAA;AAAA,MACJ,MAAA,EAAQ,OAAA;AAAA,MACR,GAAI,iBAAA,IAAqB,EAAE,gBAAA,EAAkB,iBAAA,EAAkB;AAAA,MAC/D,IAAA,EAAM;AAAA,QACJ,SAAA,EAAW,UAAA;AAAA,QACX,GAAI,aAAA,IAAiB,EAAE,aAAA,EAAe,aAAA;AAAc;AACtD,KACF;AAAA,EACF,CAAA,CAAA,MAAQ;AACN,IAAA,MAAM,UAAA,GAAa,WAAA,CAAY,GAAA,EAAI,GAAI,SAAA;AACvC,IAAA,iBAAA,CAAkB,WAAW,iBAAA,EAAmB;AAAA,MAC9C,WAAA,EAAa,YAAY,UAAU,CAAA;AAAA,MACnC,KAAA,EAAO,KAAA;AAAA,MACP,UAAA,EAAY,oBAAA;AAAA,MACZ;AAAA,KACD,CAAA;AAGD,IAAA,OAAO;AAAA,MACL,EAAA,EAAI,KAAA;AAAA,MACJ,MAAA,EAAQ,oBAAA;AAAA,MACR,OAAA,EAAS;AAAA,KACX;AAAA,EACF;AACF;;;AC1PO,SAAS,yBAAyB,KAAA,EAAyC;AAChF,EAA+B,OAAO,MAAA;AAExC;;;ACIA,SAAS,cAAc,GAAA,EAAsC;AAC3D,EAAA,OACE,GAAA,KAAQ,IAAA,IACR,OAAO,GAAA,KAAQ,QAAA,IACf,UAAU,GAAA,IACV,GAAA,CAAI,IAAA,KAAS,aAAA,IACb,MAAA,IAAU,GAAA,IACV,OAAO,GAAA,CAAI,IAAA,KAAS,QAAA,IACpB,GAAA,CAAI,IAAA,CAAK,UAAA,CAAW,SAAS,CAAA,IAC7B,SAAA,IAAa,GAAA,IACb,OAAO,GAAA,CAAI,OAAA,KAAY,QAAA;AAE3B;AAwOA,IAAM,kBAAA,uBAAyB,GAAA,CAAI;AAAA,EACjC,2BAAA;AAAA,EACA,oBAAA;AAAA,EACA,oBAAA;AAAA,EACA;AACF,CAAC,CAAA;AASD,IAAM,aAAA,GAAsD;AAAA,EAC1D,uBAAA,EAAyB,oBAAA;AAAA,EACzB,wBAAA,EAA0B,qBAAA;AAAA,EAC1B,sBAAA,EAAwB,mBAAA;AAAA,EACxB,uBAAA,EAAyB,oBAAA;AAAA,EACzB,uBAAA,EAAyB,oBAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAKzB,kCAAA,EAAoC,+BAAA;AAAA,EACpC,gCAAA,EAAkC,6BAAA;AAAA,EAClC,2BAAA,EAA6B;AAC/B,CAAA;AAGA,IAAM,gBAAA,GAAmB,EAAA;AAMzB,SAAS,oBACP,MAAA,EAC8D;AAC9D,EAAA,IAAI,CAAC,KAAA,CAAM,OAAA,CAAQ,MAAM,GAAG,OAAO,MAAA;AACnC,EAAA,OAAO,OAAO,KAAA,CAAM,CAAA,EAAG,gBAAgB,CAAA,CAAE,GAAA,CAAI,CAACR,MAAAA,MAAW;AAAA,IACvD,IAAA,EAAM,KAAA,CAAM,OAAA,CAAQA,MAAAA,EAAO,IAAI,IAAIA,MAAAA,CAAM,IAAA,CAAK,IAAA,CAAK,GAAG,CAAA,GAAI,EAAA;AAAA,IAC1D,OAAA,EAAS,OAAOA,MAAAA,EAAO,OAAA,KAAY,WAAWA,MAAAA,CAAM,OAAA,GAAU,OAAOA,MAAK;AAAA,GAC5E,CAAE,CAAA;AACJ;AAiCA,eAAsB,WAAA,CACpB,GAAA,EACA,SAAA,EACA,OAAA,GAA8B,EAAC,EACH;AAM5B,EAAA,MAAM,UAAA,GAAa,mBAAmB,OAAuC,CAAA;AAE7E,EAAA,MAAM;AAAA,IACJ,MAAA;AAAA,IACA,UAAA;AAAA,IACA,YAAA,GAAe,GAAA;AAAA,IACf,UAAA,GAAa,QAAA;AAAA,IACb,YAAA;AAAA,IACA,QAAA,EAAU;AAAA,GACZ,GAAI,OAAA;AACJ,EAAA,MAAM,GAAA,GAAM,QAAQ,GAAA,IAAO,IAAA,CAAK,MAAM,IAAA,CAAK,GAAA,KAAQ,GAAI,CAAA;AAEvD,EAAA,IAAI;AAQF,IAAA,MAAM,MAAA,GAAS,MAAM,YAAA,CAAa,MAAA,CAAgB,KAAK,SAAS,CAAA;AAEhE,IAAA,IAAI,CAAC,OAAO,KAAA,EAAO;AAIjB,MAAA,MAAM,cAAA,GAAiB,2BAA2B,GAAG,CAAA;AACrD,MAAA,MAAM,aAAA,GAAgB,cAAA,KAAmB,IAAA,IAAQ,cAAA,KAAmB,uBAAA;AACpE,MAAA,OAAO;AAAA,QACL,KAAA,EAAO,KAAA;AAAA,QACP,IAAA,EAAM,qBAAA;AAAA,QACN,OAAA,EAAS,gBACL,sCAAA,GACA;AAAA,OACN;AAAA,IACF;AAGA,IAAA,MAAM,sBAA6C,EAAC;AAGpD,IAAA,IAAI,MAAA,CAAO,MAAA,CAAO,GAAA,KAAQ,KAAA,CAAA,EAAW;AACnC,MAAA,IAAI,eAAe,QAAA,EAAU;AAC3B,QAAA,OAAO;AAAA,UACL,KAAA,EAAO,KAAA;AAAA,UACP,IAAA,EAAM,kBAAA;AAAA,UACN,OAAA,EAAS;AAAA,SACX;AAAA,MACF;AAEA,MAAA,mBAAA,CAAoB,IAAA,CAAK;AAAA,QACvB,IAAA,EAAM,mBAAA;AAAA,QACN,OAAA,EAAS;AAAA,OACV,CAAA;AAAA,IACH;AAiBA,IAAA,IAAI,EAAA;AAEJ,IAAA,IAAI,UAAA,EAAY;AACd,MAAA,MAAM,gBAAA,GAAmBC,yBAAAA,CAA0B,MAAA,CAAO,OAAO,CAAA;AACjE,MAAA,IAAI,CAAC,iBAAiB,KAAA,EAAO;AAC3B,QAAA,MAAM,CAAA,GAAI,gBAAA,CAAiB,UAAA,CAAW,CAAC,CAAA;AACvC,QAAA,OAAO;AAAA,UACL,KAAA,EAAO,KAAA;AAAA,UACP,IAAA,EAAM,wBAAA;AAAA,UACN,OAAA,EAAS,+BAA+B,CAAA,CAAE,UAAU,aAAa,CAAA,CAAE,MAAM,CAAA,SAAA,EAAY,CAAA,CAAE,KAAK,CAAA,CAAA;AAAA,SAC9F;AAAA,MACF;AACA,MAAA,MAAM,MAAA,GAASQ,kBAAAA,CAAmB,MAAA,CAAO,OAAO,CAAA;AAChD,MAAA,IAAI,CAAC,OAAO,EAAA,EAAI;AACd,QAAA,OAAO;AAAA,UACL,KAAA,EAAO,KAAA;AAAA,UACP,IAAA,EAAM,kBAAA;AAAA,UACN,OAAA,EAAS,CAAA,kCAAA,EAAqC,MAAA,CAAO,KAAA,CAAM,OAAO,CAAA,CAAA;AAAA,UAClE,OAAA,EAAS;AAAA,YACP,UAAA,EAAY,OAAO,KAAA,CAAM,IAAA;AAAA,YACzB,MAAA,EAAQ,mBAAA,CAAoB,MAAA,CAAO,KAAA,CAAM,MAAM;AAAA;AACjD,SACF;AAAA,MACF;AACA,MAAA,EAAA,GAAK,MAAA;AAAA,IACP,CAAA,MAAO;AACL,MAAA,MAAM,aAAa,wBAAA,CAAyB;AAAA,QAC1C,OAAA,EAAS,aAAA;AAAA,QACT,SAAS,MAAA,CAAO;AAAA,OACjB,CAAA;AACD,MAAA,IAAI,CAAC,WAAW,EAAA,EAAI;AAClB,QAAA,OAAO;AAAA,UACL,KAAA,EAAO,KAAA;AAAA,UACP,MAAM,UAAA,CAAW,IAAA;AAAA,UACjB,SAAS,UAAA,CAAW,OAAA;AAAA,UACpB,GAAI,UAAA,CAAW,OAAA,KAAY,UAAa,EAAE,OAAA,EAAS,WAAW,OAAA;AAAQ,SACxE;AAAA,MACF;AACA,MAAA,MAAM,iBAAiB,UAAA,CAAW,MAAA;AAClC,MAAA,IAAI,mBAAmB,KAAA,CAAA,EAAW;AAChC,QAAA,OAAO;AAAA,UACL,KAAA,EAAO,KAAA;AAAA,UACP,IAAA,EAAM,YAAA;AAAA,UACN,OAAA,EAAS;AAAA,SACX;AAAA,MACF;AACA,MAAA,EAAA,GAAK;AAAA,QACH,EAAA,EAAI,IAAA;AAAA,QACJ,aAAa,cAAA,CAAe,WAAA;AAAA,QAC5B,UAAU,cAAA,CAAe,cAAA;AAAA,QACzB,QAAQ,cAAA,CAAe;AAAA,OACzB;AAAA,IACF;AAGA,IAAA,IAAI,EAAA,CAAG,gBAAgB,KAAA,EAAO;AAC5B,MAAA,mBAAA,CAAoB,IAAA,CAAK,GAAG,EAAA,CAAG,QAAQ,CAAA;AAAA,IACzC;AAGA,IAAA,IAAI,EAAA,CAAG,gBAAgB,KAAA,EAAO;AAC5B,MAAA,MAAM,SAAS,EAAA,CAAG,MAAA;AAOlB,MAAA,wBAAA,CAAyB,EAAE,IAAA,EAAM,UAAA,EAAY,MAAA,EAAQ,CAAA;AAGrD,MAAA,IAAI,MAAA,KAAW,KAAA,CAAA,IAAa,MAAA,CAAO,GAAA,KAAQ,MAAA,EAAQ;AACjD,QAAA,OAAO;AAAA,UACL,KAAA,EAAO,KAAA;AAAA,UACP,IAAA,EAAM,kBAAA;AAAA,UACN,OAAA,EAAS,CAAA,2BAAA,EAA8B,MAAM,CAAA,QAAA,EAAW,OAAO,GAAG,CAAA,CAAA;AAAA,SACpE;AAAA,MACF;AAGA,MAAA,IAAI,UAAA,KAAe,KAAA,CAAA,IAAa,MAAA,CAAO,GAAA,KAAQ,UAAA,EAAY;AACzD,QAAA,OAAO;AAAA,UACL,KAAA,EAAO,KAAA;AAAA,UACP,IAAA,EAAM,mBAAA;AAAA,UACN,SAAS,CAAA,4BAAA,EAA+B,UAAU,CAAA,QAAA,EAAW,MAAA,CAAO,OAAO,WAAW,CAAA,CAAA;AAAA,SACxF;AAAA,MACF;AAGA,MAAA,IAAI,MAAA,CAAO,GAAA,GAAM,GAAA,GAAM,YAAA,EAAc;AACnC,QAAA,OAAO;AAAA,UACL,KAAA,EAAO,KAAA;AAAA,UACP,IAAA,EAAM,iBAAA;AAAA,UACN,SAAS,CAAA,iCAAA,EAAoC,IAAI,IAAA,CAAK,MAAA,CAAO,MAAM,GAAI,CAAA,CAAE,WAAA,EAAa,YAAY,IAAI,IAAA,CAAK,MAAM,GAAI,CAAA,CAAE,aAAa,CAAA;AAAA,SACtI;AAAA,MACF;AAGA,MAAA,IAAI,MAAA,CAAO,SAAS,UAAA,EAAY;AAC9B,QAAA,MAAM,aAAa,mBAAA,CAAoB,MAAA,CAAO,aAAa,MAAA,CAAO,GAAA,EAAK,KAAK,YAAY,CAAA;AACxF,QAAA,IAAI,eAAe,cAAA,EAAgB;AACjC,UAAA,OAAO;AAAA,YACL,KAAA,EAAO,KAAA;AAAA,YACP,IAAA,EAAM,sBAAA;AAAA,YACN,OAAA,EAAS,kDAAkD,YAAY,CAAA,EAAA;AAAA,WACzE;AAAA,QACF;AACA,QAAA,IAAI,eAAe,IAAA,EAAM;AACvB,UAAA,mBAAA,CAAoB,KAAK,UAAU,CAAA;AAAA,QACrC;AAAA,MACF;AAGA,MAAA,IAAI,CAACC,wBAAAA,CAAyB,GAAA,CAAI,MAAA,CAAO,IAAI,CAAA,EAAG;AAC9C,QAAA,mBAAA,CAAoB,IAAA,CAAK;AAAA,UACvB,IAAA,EAAMC,yBAAAA;AAAA,UACN,OAAA,EAAS,sDAAA;AAAA,UACT,OAAA,EAAS;AAAA,SACV,CAAA;AAAA,MACH;AAIA,MAAA,IAAI,MAAA,CAAO,eAAe,KAAA,CAAA,EAAW;AACnC,QAAA,KAAA,MAAW,GAAA,IAAO,MAAA,CAAO,IAAA,CAAK,MAAA,CAAO,UAAU,CAAA,EAAG;AAChD,UAAA,IAAI,CAACf,+BAAAA,CAAgC,GAAA,CAAI,GAAG,CAAA,IAAKC,mBAAAA,CAAoB,GAAG,CAAA,EAAG;AAEzE,YAAA,MAAM,UAAA,GAAa,IAAI,OAAA,CAAQ,IAAA,EAAM,IAAI,CAAA,CAAE,OAAA,CAAQ,OAAO,IAAI,CAAA;AAC9D,YAAA,mBAAA,CAAoB,IAAA,CAAK;AAAA,cACvB,IAAA,EAAMe,yBAAAA;AAAA,cACN,OAAA,EAAS,2DAAA;AAAA,cACT,OAAA,EAAS,eAAe,UAAU,CAAA;AAAA,aACnC,CAAA;AAAA,UACH;AAAA,QACF;AAAA,MACF;AAGA,MAAA,MAAM,YAAA,GAAe,yBAAA;AAAA,QACnB,MAAA,CAAO,IAAA;AAAA,QACP,MAAA,CAAO,IAAA;AAAA,QACP,MAAA,CAAO,UAAA;AAAA,QACPb,qBAAAA;AAAA,QACAH;AAAA,OACF;AAEA,MAAA,IAAI,YAAA,CAAa,MAAA,KAAW,SAAA,IAAa,YAAA,CAAa,WAAW,UAAA,EAAY;AAC3E,QAAA,MAAM,WAAA,GACJ,YAAA,CAAa,MAAA,KAAW,SAAA,GACpBiB,+BAAAA,GACAC,gCAAAA;AACN,QAAA,MAAM,SAAA,GACJ,YAAA,CAAa,MAAA,KAAW,SAAA,GACpB,4BAAA,GACA,4BAAA;AAEN,QAAA,IAAI,eAAe,QAAA,EAAU;AAC3B,UAAA,OAAO;AAAA,YACL,KAAA,EAAO,KAAA;AAAA,YACP,IAAA,EAAM,SAAA;AAAA,YACN,OAAA,EAAS,CAAA,MAAA,EAAS,MAAA,CAAO,IAAI,CAAA,2BAAA,EAA8B,YAAA,CAAa,wBAAwB,CAAA,YAAA,EAAe,YAAA,CAAa,MAAA,KAAW,UAAA,GAAa,0CAAA,GAA6C,QAAQ,CAAA,CAAA;AAAA,YACzM,OAAA,EAAS;AAAA,cACP,MAAM,MAAA,CAAO,IAAA;AAAA,cACb,0BAA0B,YAAA,CAAa,wBAAA;AAAA,cACvC,qCAAqC,YAAA,CAAa;AAAA;AACpD,WACF;AAAA,QACF;AAGA,QAAA,mBAAA,CAAoB,IAAA,CAAK;AAAA,UACvB,IAAA,EAAM,WAAA;AAAA,UACN,SAAS,CAAA,MAAA,EAAS,MAAA,CAAO,IAAI,CAAA,2BAAA,EAA8B,aAAa,wBAAwB,CAAA,CAAA,CAAA;AAAA,UAChG,OAAA,EAAS;AAAA,SACV,CAAA;AAAA,MACH;AAGA,MAAA,IAAI,iBAAiB,KAAA,CAAA,IAAa,CAAC,KAAK,OAAA,CAAQ,IAAA,CAAK,YAAY,CAAA,EAAG;AAClE,QAAA,OAAO;AAAA,UACL,KAAA,EAAO,KAAA;AAAA,UACP,IAAA,EAAM,kBAAA;AAAA,UACN,OAAA,EAAS;AAAA,SACX;AAAA,MACF;AAKA,MAAA,MAAM,mBAAA,GAAsB,OAAO,MAAA,EAAQ,MAAA;AAC3C,MAAA,MAAM,aAAA,GACJ,wBAAwB,KAAA,CAAA,IAAa,YAAA,KAAiB,SAClD,aAAA,GACAC,mBAAAA,CAAoB,qBAAqB,YAAY,CAAA;AAC3D,MAAA,IAAI,kBAAkB,QAAA,EAAU;AAC9B,QAAA,OAAO;AAAA,UACL,KAAA,EAAO,KAAA;AAAA,UACP,IAAA,EAAM,yBAAA;AAAA,UACN,OAAA,EAAS,gFAAA;AAAA,UACT,OAAA,EAAS;AAAA,YACP,qBAAA,EAAuB,mBAAA;AAAA,YACvB,mBAAA,EAAqB,YAAA;AAAA,YACrB,GAAI,OAAO,MAAA,EAAQ,GAAA,KAAQ,UAAa,EAAE,UAAA,EAAY,MAAA,CAAO,MAAA,CAAO,GAAA;AAAI;AAC1E,SACF;AAAA,MACF;AAOA,MAAA,MAAM,QAAA,GAA2D;AAAA,QAC/D,MAAA,EAAQ,aAAA;AAAA,QACR,GAAI,cAAA,EAAgB,KAAA,KAAU,UAAa,EAAE,KAAA,EAAO,eAAe,KAAA,EAAM;AAAA,QACzE,GAAI,cAAA,EAAgB,SAAA,KAAc,KAAA,CAAA,IAChC,cAAA,CAAe,SAAA,CAAU,MAAA,GAAS,CAAA,IAAK,EAAE,SAAA,EAAW,cAAA,CAAe,SAAA;AAAU,OACjF;AAEA,MAAA,MAAM,cAAA,GAAiB,aAAa,mBAAmB,CAAA;AAOvD,MAAA,IAAI,UAAA,IAAc,eAAA,CAAgB,OAAyC,CAAA,EAAG;AAC5E,QAAA,MAAM,cAAA,GAAiB,EAAE,GAAG,MAAA,CAAO,MAAA,EAAO;AAC1C,QAAA,cAAA,CAAkC;AAAA,UAChC,IAAA,EAAM,aAAA;AAAA,UACN,UAAA,EAAY,qCAAqC,cAAc,CAAA;AAAA,UAC/D,SAAA,EAAW,KAAA,CAAA;AAAA,UACX,UAAU,YACR,4BAAA;AAAA,YACE,yBAAA,CAA0B;AAAA,cACxB,MAAA,EAAQ;AAAA,gBACN,MAAM,MAAA,CAAO,IAAA;AAAA,gBACb,MAAM,MAAA,CAAO,IAAA;AAAA,gBACb,KAAK,MAAA,CAAO,GAAA;AAAA,gBACZ,KAAK,MAAA,CAAO,GAAA;AAAA,gBACZ,aAAa,MAAA,CAAO,WAAA;AAAA,gBACpB,YAAY,MAAA,CAAO;AAAA,eACrB;AAAA,cACA,MAAA,EAAQ,cAAA;AAAA,cACR;AAAA,aACD;AAAA,WACH;AAAA,UACF,SAAA,EAAW;AAAA,SACZ,CAAA;AAAA,MACH;AAEA,MAAA,OAAO;AAAA,QACL,KAAA,EAAO,IAAA;AAAA,QACP,OAAA,EAAS,SAAA;AAAA,QACT,MAAA;AAAA,QACA,GAAA,EAAK,OAAO,MAAA,CAAO,GAAA;AAAA,QACnB,WAAA,EAAa,KAAA;AAAA,QACb,QAAA,EAAU,cAAA;AAAA,QACV,cAAA,EAAgB,aAAA;AAAA,QAChB;AAAA,OACF;AAAA,IACF;AAGA,IAAA,OAAO;AAAA,MACL,KAAA,EAAO,KAAA;AAAA,MACP,IAAA,EAAM,4BAAA;AAAA,MACN,OAAA,EAAS;AAAA,KACX;AAAA,EACF,SAAS,GAAA,EAAK;AAMZ,IAAA,IAAI,aAAA,CAAc,GAAG,CAAA,EAAG;AAEtB,MAAA,IAAI,OAAO,SAAA,CAAU,cAAA,CAAe,KAAK,aAAA,EAAe,GAAA,CAAI,IAAI,CAAA,EAAG;AACjE,QAAA,OAAO;AAAA,UACL,KAAA,EAAO,KAAA;AAAA,UACP,IAAA,EAAM,aAAA,CAAc,GAAA,CAAI,IAAI,CAAA;AAAA,UAC5B,SAAS,GAAA,CAAI;AAAA,SACf;AAAA,MACF;AAEA,MAAA,IAAI,kBAAA,CAAmB,GAAA,CAAI,GAAA,CAAI,IAAI,CAAA,EAAG;AACpC,QAAA,OAAO;AAAA,UACL,KAAA,EAAO,KAAA;AAAA,UACP,IAAA,EAAM,kBAAA;AAAA,UACN,SAAS,GAAA,CAAI;AAAA,SACf;AAAA,MACF;AACA,MAAA,IAAI,GAAA,CAAI,SAAS,0BAAA,EAA4B;AAC3C,QAAA,OAAO;AAAA,UACL,KAAA,EAAO,KAAA;AAAA,UACP,IAAA,EAAM,qBAAA;AAAA,UACN,SAAS,GAAA,CAAI;AAAA,SACf;AAAA,MACF;AACA,MAAA,IAAI,GAAA,CAAI,SAAS,8BAAA,EAAgC;AAC/C,QAAA,OAAO;AAAA,UACL,KAAA,EAAO,KAAA;AAAA,UACP,IAAA,EAAM,yBAAA;AAAA,UACN,SAAS,GAAA,CAAI;AAAA,SACf;AAAA,MACF;AAAA,IACF;AAIA,IAAA,IACE,GAAA,KAAQ,QACR,OAAO,GAAA,KAAQ,YACf,MAAA,IAAU,GAAA,IACT,GAAA,CAA0B,IAAA,KAAS,aAAA,EACpC;AACA,MAAA,MAAM,aAAA,GACJ,aAAa,GAAA,IAAO,OAAQ,IAA6B,OAAA,KAAY,QAAA,GAChE,IAA4B,OAAA,GAC7B,cAAA;AACN,MAAA,OAAO;AAAA,QACL,KAAA,EAAO,KAAA;AAAA,QACP,IAAA,EAAM,kBAAA;AAAA,QACN,OAAA,EAAS,4BAA4B,aAAa,CAAA;AAAA,OACpD;AAAA,IACF;AASA,IAAA,MAAM,cAAA,GAAiB,2BAA2B,GAAG,CAAA;AACrD,IAAA,IAAI,cAAA,KAAmB,IAAA,IAAQ,cAAA,KAAmB,uBAAA,EAAyB;AACzE,MAAA,OAAO;AAAA,QACL,KAAA,EAAO,KAAA;AAAA,QACP,IAAA,EAAM,qBAAA;AAAA,QACN,OAAA,EAAS;AAAA,OACX;AAAA,IACF;AAKA,IAAA,OAAO;AAAA,MACL,KAAA,EAAO,KAAA;AAAA,MACP,IAAA,EAAM,YAAA;AAAA,MACN,OAAA,EAAS;AAAA,KACX;AAAA,EACF;AACF;AAMO,SAAS,iBACd,CAAA,EACkD;AAElD,EAAA,OAAO,KAAA;AACT;AAMO,SAAS,oBACd,CAAA,EACkD;AAElD,EAAA,OAAO,KAAA;AACT;AAQO,SAAS,eACd,CAAA,EACkD;AAClD,EAAA,OAAO,CAAA,CAAE,KAAA,KAAU,IAAA,IAAQ,CAAA,CAAE,OAAA,KAAY,SAAA;AAC3C;ACrzBO,SAAS,gBAAA,CAAiB,SAAkB,UAAA,EAA0B;AAC3E,EAAA,OAAA,CAAQ,GAAA,CAAI,qBAAqB,UAAU,CAAA;AAC7C;AAQO,SAAS,iBAAiB,OAAA,EAAiC;AAChE,EAAA,OAAO,OAAA,CAAQ,IAAI,mBAAmB,CAAA;AACxC;AAOO,SAAS,cAAc,OAAA,EAAwB;AACpD,EAAA,MAAM,QAAA,GAAW,OAAA,CAAQ,GAAA,CAAI,MAAM,CAAA;AACnC,EAAA,IAAI,QAAA,EAAU;AAEZ,IAAA,MAAM,MAAA,GAAS,QAAA,CAAS,KAAA,CAAM,GAAG,CAAA,CAAE,IAAI,CAAC,CAAA,KAAM,CAAA,CAAE,IAAA,EAAM,CAAA;AACtD,IAAA,IAAI,CAAC,MAAA,CAAO,QAAA,CAAS,mBAAmB,CAAA,EAAG;AACzC,MAAA,OAAA,CAAQ,IAAI,MAAA,EAAQ,CAAA,EAAG,QAAQ,CAAA,EAAA,EAAK,mBAAmB,CAAA,CAAE,CAAA;AAAA,IAC3D;AAAA,EACF,CAAA,MAAO;AACL,IAAA,OAAA,CAAQ,GAAA,CAAI,QAAQ,mBAAmB,CAAA;AAAA,EACzC;AACF;AAeO,SAAS,iBAAiB,OAAA,EAAkC;AACjE,EAAA,MAAM,KAAA,GAAQ,OAAA,CAAQ,GAAA,CAAI,mBAAmB,CAAA;AAC7C,EAAA,IAAI,CAAC,KAAA,EAAO;AACV,IAAA,OAAO,EAAC;AAAA,EACV;AACA,EAAA,OAAO,mBAAmB,KAAK,CAAA;AACjC;AAUO,SAAS,uBAAA,CAAwB,SAAkB,OAAA,EAAiC;AACzF,EAAA,OAAA,CAAQ,GAAA,CAAI,6BAA6B,OAAO,CAAA;AAClD;AAUO,SAAS,sBAAA,CAAuB,SAAkB,MAAA,EAA6B;AACpF,EAAA,OAAA,CAAQ,GAAA,CAAI,4BAA4B,MAAM,CAAA;AAChD;AASO,SAAS,qBAAqB,OAAA,EAAwB;AAC3D,EAAA,MAAM,QAAA,GAAW,OAAA,CAAQ,GAAA,CAAI,MAAM,CAAA;AACnC,EAAA,IAAI,QAAA,EAAU;AACZ,IAAA,MAAM,MAAA,GAAS,QAAA,CAAS,KAAA,CAAM,GAAG,CAAA,CAAE,IAAI,CAAC,CAAA,KAAM,CAAA,CAAE,IAAA,EAAM,CAAA;AACtD,IAAA,IAAI,CAAC,MAAA,CAAO,QAAA,CAAS,mBAAmB,CAAA,EAAG;AACzC,MAAA,OAAA,CAAQ,IAAI,MAAA,EAAQ,CAAA,EAAG,QAAQ,CAAA,EAAA,EAAK,mBAAmB,CAAA,CAAE,CAAA;AAAA,IAC3D;AAAA,EACF,CAAA,MAAO;AACL,IAAA,OAAA,CAAQ,GAAA,CAAI,QAAQ,mBAAmB,CAAA;AAAA,EACzC;AACF;AC1EA,eAAsB,6BAA6B,KAAA,EAAmC;AACpF,EAAA,MAAM,GAAA,GAAM,MAAM,OAAA,CAAQ,KAAK,CAAA;AAC/B,EAAA,OAAO,CAAA,EAAGC,IAAAA,CAAK,MAAM,CAAA,EAAG,GAAG,CAAA,CAAA;AAC7B;AA0BA,eAAsB,6BAAA,CACpB,OACA,eAAA,EACiB;AACjB,EAAA,MAAM,UAAA,GAAa,KAAA,CAAM,OAAA,CAAQ,OAAA,EAAS,IAAI,CAAA,CAAE,OAAA,CAAQ,KAAA,EAAO,IAAI,CAAA,CAAE,SAAA,CAAU,KAAK,CAAA;AACpF,EAAA,MAAM,GAAA,GAAM,IAAI,WAAA,EAAY,CAAE,OAAO,UAAU,CAAA;AAC/C,EAAA,MAAM,aAAa,MAAM,MAAA,CAAO,MAAA,CAAO,MAAA,CAAO,WAAW,GAAG,CAAA;AAC5D,EAAA,MAAM,YAAY,KAAA,CAAM,IAAA,CAAK,IAAI,UAAA,CAAW,UAAU,CAAC,CAAA;AACvD,EAAA,MAAM,GAAA,GAAM,SAAA,CAAU,GAAA,CAAI,CAAC,MAAM,CAAA,CAAE,QAAA,CAAS,EAAE,CAAA,CAAE,SAAS,CAAA,EAAG,GAAG,CAAC,CAAA,CAAE,KAAK,EAAE,CAAA;AACzE,EAAA,OAAO,CAAA,EAAGA,IAAAA,CAAK,MAAM,CAAA,EAAG,GAAG,CAAA,CAAA;AAC7B;AAaA,eAAsB,sBACpB,KAAA,EAIiC;AACjC,EAAA,QAAQ,MAAM,cAAA;AAAgB,IAC5B,KAAK,MAAA;AACH,MAAA,OAAO,4BAAA,CAA6B,MAAM,KAAK,CAAA;AAAA,IACjD,KAAK,UAAA;AAAA,IACL,KAAK,WAAA;AACH,MAAA,OAAO,6BAAA,CAA8B,KAAA,CAAM,KAAA,EAAO,KAAA,CAAM,cAAc,CAAA;AAAA,IACxE,KAAK,KAAA;AACH,MAAA,IAAI,OAAO,KAAA,CAAM,KAAA,KAAU,QAAA,EAAU,OAAO,aAAA;AAC5C,MAAA,OAAO,6BAAA,CAA8B,KAAA,CAAM,KAAkB,CAAA;AAAA;AAEnE;AAWO,SAAS,oBAAA,CACd,eACA,WAAA,EACqB;AACrB,EAAA,IAAI,aAAA,KAAkB,MAAA,IAAa,WAAA,KAAgB,MAAA,EAAW;AAC5D,IAAA,OAAO,aAAA;AAAA,EACT;AACA,EAAA,OAAOD,mBAAAA,CAAoB,eAAe,WAAW,CAAA;AACvD;;;ACtFA,eAAsB,uBAAuB,MAAA,EAAoC;AAC/E,EAAA,OAAO,6BAA6B,MAAM,CAAA;AAC5C;AAwBO,SAAS,kBAAA,CACd,eACA,WAAA,EACqB;AACrB,EAAA,OAAO,oBAAA,CAAqB,eAAe,WAAW,CAAA;AACxD;ACiGO,IAAM,uBAAA,GAA0C;AAAA,EACrD,mBAAmBV,eAAAA,CAAgB,eAAA;AAAA,EACnC,gBAAgBA,eAAAA,CAAgB,YAAA;AAAA,EAChC,eAAeA,eAAAA,CAAgB,WAAA;AAAA,EAC/B,eAAeA,eAAAA,CAAgB,YAAA;AAAA,EAC/B,kBAAkBA,eAAAA,CAAgB,cAAA;AAAA,EAClC,qBAAqBA,eAAAA,CAAgB;AACvC;AAiCO,IAAM,wBAAA,GAA4C;AAAA,EACvD,YAAYY,gBAAAA,CAAiB,SAAA;AAAA,EAC7B,mBAAmBA,gBAAAA,CAAiB,eAAA;AAAA,EACpC,iBAAiBA,gBAAAA,CAAiB,cAAA;AAAA,EAClC,4BAAA,EAA8B,IAAA;AAAA;AAAA,EAC9B,oBAAA,EAAsB;AAAA;AACxB;AA8BO,SAAS,oBAAoB,IAAA,EAAwC;AAC1E,EAAA,OAAO;AAAA,IACL,cAAA,EAAgB,uBAAA;AAAA,IAChB,IAAA;AAAA,IACA,MAAA,EAAQ,EAAE,GAAG,uBAAA,EAAwB;AAAA,IACrC,OAAA,EAAS,EAAE,GAAG,wBAAA;AAAyB,GACzC;AACF;AAmCO,IAAM,SAAA,GAAY;AAAA,EACvB,WAAA;AAAA,EACA,sBAAA;AAAA,EACA,sBAAA;AAAA,EACA,0BAAA;AAAA,EACA,qBAAA;AAAA,EACA,kBAAA;AAAA,EACA,aAAA;AAAA,EACA,eAAA;AAAA,EACA,oBAAA;AAAA,EACA,mBAAA;AAAA,EACA,2BAAA;AAAA,EACA;AACF;AA2LO,IAAM,+BAAA,GAAmE;AAAA,EAC9E;AACF;AA+DO,SAAS,aAAa,QAAA,EAAgC;AAC3D,EAAA,OAAO;AAAA,IACL,GAAA,EAAK,SAAA;AAAA,IACL,KAAA,EAAO,SAAS,WAAA;AAAY,GAC9B;AACF;AAKO,SAAS,kBACd,MAAA,EACyD;AACzD,EAAA,OAAO;AAAA,IACL,cAAA,EAAgB,2BAAA;AAAA,IAChB;AAAA,GACF;AACF;AAKO,SAAS,qBAAA,CACd,YACA,SAAA,EACY;AACZ,EAAA,MAAM,MAAA,GAAS,SAAA,KAAc,KAAA,GAAQ,WAAA,GAAc,eAAA;AAEnD,EAAA,QAAQ,UAAA;AAAY,IAClB,KAAK,WAAA;AAAA,IACL,KAAK,YAAA;AAAA,IACL,KAAK,UAAA;AAAA,IACL,KAAK,YAAA;AAAA,IACL,KAAK,uBAAA;AAAA,IACL,KAAK,aAAA;AACH,MAAA,OAAO,GAAG,MAAM,CAAA,QAAA,CAAA;AAAA,IAClB,KAAK,SAAA;AACH,MAAA,OAAO,GAAG,MAAM,CAAA,QAAA,CAAA;AAAA,IAClB,KAAK,oBAAA;AACH,MAAA,OAAO,SAAA,KAAc,YAAY,yBAAA,GAA4B,gBAAA;AAAA,IAC/D,KAAK,oBAAA;AACH,MAAA,OAAO,oBAAA;AAAA,IACT,KAAK,oBAAA;AAAA,IACL,KAAK,kBAAA;AAAA,IACL,KAAK,eAAA;AAAA,IACL,KAAK,aAAA;AAAA,IACL;AACE,MAAA,OAAO,GAAG,MAAM,CAAA,OAAA,CAAA;AAAA;AAEtB;AAKO,SAAS,qBAAqB,MAAA,EAAoC;AACvE,EAAA,IAAI,MAAA,KAAW,MAAM,OAAO,MAAA;AAC5B,EAAA,OAAO,OAAA;AACT;AAKO,SAAS,sBAAsB,MAAA,EAA4B;AAChE,EAAA,MAAM,OAAA,GAAsC;AAAA,IAC1C,EAAA,EAAI,EAAA;AAAA,IACJ,iBAAA,EAAmB,4BAAA;AAAA,IACnB,iBAAA,EAAmB,4BAAA;AAAA,IACnB,iBAAA,EAAmB,4BAAA;AAAA,IACnB,kBAAA,EAAoB,6BAAA;AAAA,IACpB,aAAA,EAAe,wBAAA;AAAA,IACf,iBAAA,EAAmB,4BAAA;AAAA,IACnB,gBAAA,EAAkB,2BAAA;AAAA,IAClB,iBAAA,EAAmB,4BAAA;AAAA,IACnB,qBAAA,EAAuB,gCAAA;AAAA,IACvB,oBAAA,EAAsB,+BAAA;AAAA,IACtB,qBAAA,EAAuB,gCAAA;AAAA,IACvB,uBAAA,EAAyB,kCAAA;AAAA,IACzB,uBAAA,EAAyB,kCAAA;AAAA,IACzB,cAAA,EAAgB,yBAAA;AAAA,IAChB,kBAAA,EAAoB,6BAAA;AAAA,IACpB,OAAA,EAAS,kBAAA;AAAA,IACT,aAAA,EAAe,wBAAA;AAAA,IACf,iBAAA,EAAmB,4BAAA;AAAA,IACnB,cAAA,EAAgB,yBAAA;AAAA,IAChB,gBAAA,EAAkB,2BAAA;AAAA,IAClB,mBAAA,EAAqB,8BAAA;AAAA,IACrB,iBAAA,EAAmB;AAAA,GACrB;AACA,EAAA,OAAO,OAAA,CAAQ,MAAM,CAAA,IAAK,2BAAA;AAC5B;AC3kBO,IAAM,4BAAN,MAAgC;AAAA,EAC7B,KAAA;AAAA,EAER,YAAY,MAAA,EAAwB;AAClC,IAAA,IAAA,CAAK,KAAA,GAAQ;AAAA,MACX,MAAA;AAAA,MACA,MAAA,sBAAY,GAAA,EAAI;AAAA,MAChB,cAAA,EAAgB;AAAA,KAClB;AAAA,EACF;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAUA,kBAAA,CACE,SAAA,EACA,IAAA,GAAuC,aAAA,EACjC;AACN,IAAA,IAAA,CAAK,MAAM,gBAAA,GAAmB,SAAA;AAC9B,IAAA,IAAA,CAAK,MAAM,KAAA,GAAQ;AAAA,MACjB,IAAA;AAAA,MACA,cAAA,EAAgB,aAAa,SAAS;AAAA,KACxC;AACA,IAAA,OAAO,IAAA;AAAA,EACT;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAQA,MAAM,aAAA,CACJ,YAAA,EACA,IAAA,GAAuC,aAAA,EACxB;AACf,IAAA,MAAM,SAAA,GAAY,MAAMC,SAAAA,CAAU,YAAY,CAAA;AAC9C,IAAA,OAAO,IAAA,CAAK,kBAAA,CAAmB,SAAA,EAAW,IAAI,CAAA;AAAA,EAChD;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAQA,QAAA,CACE,EAAA,EACA,MAAA,EACA,MAAA,EACA,SAAA,EACM;AACN,IAAA,MAAM,KAAA,GAAqB,EAAE,EAAA,EAAI,MAAA,EAAO;AACxC,IAAA,IAAI,UAAU,MAAA,CAAO,IAAA,CAAK,MAAM,CAAA,CAAE,SAAS,CAAA,EAAG;AAC5C,MAAA,KAAA,CAAM,MAAA,GAAS,MAAA;AAAA,IACjB;AACA,IAAA,IAAI,SAAA,EAAW;AACb,MAAA,KAAA,CAAM,UAAA,GAAa,SAAA;AAAA,IACrB;AAEA,IAAA,IAAA,CAAK,KAAA,CAAM,MAAA,CAAO,GAAA,CAAI,EAAA,EAAI,KAAK,CAAA;AAG/B,IAAA,IAAI,MAAA,KAAW,MAAA,IAAU,CAAC,IAAA,CAAK,MAAM,cAAA,EAAgB;AACnD,MAAA,IAAA,CAAK,MAAM,cAAA,GAAiB,IAAA;AAC5B,MAAA,IAAA,CAAK,MAAM,aAAA,GAAgB,EAAA;AAAA,IAC7B;AAEA,IAAA,OAAO,IAAA;AAAA,EACT;AAAA;AAAA;AAAA;AAAA,EAKA,IAAA,CAAK,IAAa,MAAA,EAAwC;AACxD,IAAA,OAAO,IAAA,CAAK,QAAA,CAAS,EAAA,EAAI,MAAA,EAAQ,MAAM,CAAA;AAAA,EACzC;AAAA;AAAA;AAAA;AAAA,EAKA,IAAA,CAAK,EAAA,EAAa,SAAA,EAAmB,MAAA,EAAwC;AAC3E,IAAA,OAAO,IAAA,CAAK,QAAA,CAAS,EAAA,EAAI,MAAA,EAAQ,QAAQ,SAAS,CAAA;AAAA,EACpD;AAAA;AAAA;AAAA;AAAA,EAKA,IAAA,CAAK,IAAa,MAAA,EAAwC;AACxD,IAAA,OAAO,IAAA,CAAK,QAAA,CAAS,EAAA,EAAI,MAAA,EAAQ,MAAM,CAAA;AAAA,EACzC;AAAA;AAAA;AAAA;AAAA,EAKA,SAAA,CACE,KAAA,EACA,MAAA,EACA,OAAA,EAKM;AACN,IAAA,IAAA,CAAK,MAAM,MAAA,GAAS;AAAA,MAClB,KAAA;AAAA,MACA,MAAA;AAAA,MACA,QAAA,EAAU,qBAAqB,MAAM,CAAA;AAAA,MACrC,YAAA,EAAc,SAAS,WAAA,IAAe,SAAA;AAAA;AAAA,MAEtC,cAAA,EAAgB,aAAA;AAAA,MAChB,GAAI,OAAA,EAAS,MAAA,IAAU,EAAE,MAAA,EAAQ,QAAQ,MAAA,EAAO;AAAA,MAChD,GAAI,OAAA,EAAS,GAAA,IAAO,EAAE,GAAA,EAAK,QAAQ,GAAA;AAAI,KACzC;AACA,IAAA,OAAO,IAAA;AAAA,EACT;AAAA;AAAA;AAAA;AAAA,EAKA,OAAA,CAAQ,QAAgB,GAAA,EAAmB;AACzC,IAAA,OAAO,KAAK,SAAA,CAAU,IAAA,EAAM,MAAM,EAAE,MAAA,EAAQ,KAAK,CAAA;AAAA,EACnD;AAAA;AAAA;AAAA;AAAA,EAKA,OAAA,CAAQ,MAAA,EAAoB,MAAA,EAAiB,GAAA,EAAoB;AAC/D,IAAA,OAAO,KAAK,SAAA,CAAU,KAAA,EAAO,QAAQ,EAAE,MAAA,EAAQ,KAAK,CAAA;AAAA,EACtD;AAAA;AAAA;AAAA;AAAA,EAKA,WAAA,CAAY,KAAa,KAAA,EAAsB;AAC7C,IAAA,IAAI,CAAC,IAAA,CAAK,KAAA,CAAM,SAAA,EAAW;AACzB,MAAA,IAAA,CAAK,KAAA,CAAM,YAAY,EAAC;AAAA,IAC1B;AACA,IAAA,IAAA,CAAK,KAAA,CAAM,SAAA,CAAU,GAAG,CAAA,GAAI,KAAA;AAC5B,IAAA,OAAO,IAAA;AAAA,EACT;AAAA;AAAA;AAAA;AAAA,EAKA,QAAQ,IAAA,EAA8B;AACpC,IAAA,IAAA,CAAK,MAAM,IAAA,GAAO,IAAA;AAClB,IAAA,OAAO,IAAA;AAAA,EACT;AAAA;AAAA;AAAA;AAAA,EAKA,YAAA,GAAqB;AACnB,IAAA,IAAI,CAAC,IAAA,CAAK,KAAA,CAAM,IAAA,EAAM;AACpB,MAAA,IAAA,CAAK,KAAA,CAAM,OAAO,EAAC;AAAA,IACrB;AACA,IAAA,IAAA,CAAK,MAAM,IAAA,CAAK,YAAA,GAAA,iBAAe,IAAI,IAAA,IAAO,WAAA,EAAY;AACtD,IAAA,OAAO,IAAA;AAAA,EACT;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EASA,KAAA,GAA4B;AAE1B,IAAA,IAAI,CAAC,IAAA,CAAK,KAAA,CAAM,KAAA,EAAO;AACrB,MAAA,MAAM,IAAI,MAAM,wEAAwE,CAAA;AAAA,IAC1F;AACA,IAAA,IAAI,CAAC,IAAA,CAAK,KAAA,CAAM,MAAA,EAAQ;AACtB,MAAA,MAAM,IAAI,MAAM,oEAAoE,CAAA;AAAA,IACtF;AAGA,IAAA,MAAM,SAAwB,EAAC;AAC/B,IAAA,MAAM,WAAA,GAAc,KAAK,KAAA,CAAM,aAAA,GAAgB,UAAU,OAAA,CAAQ,IAAA,CAAK,KAAA,CAAM,aAAa,CAAA,GAAI,EAAA;AAE7F,IAAA,KAAA,IAAS,CAAA,GAAI,CAAA,EAAG,CAAA,GAAI,SAAA,CAAU,QAAQ,CAAA,EAAA,EAAK;AACzC,MAAA,MAAM,OAAA,GAAU,UAAU,CAAC,CAAA;AAC3B,MAAA,MAAM,QAAA,GAAW,IAAA,CAAK,KAAA,CAAM,MAAA,CAAO,IAAI,OAAO,CAAA;AAE9C,MAAA,IAAI,QAAA,EAAU;AACZ,QAAA,MAAA,CAAO,KAAK,QAAQ,CAAA;AAAA,MACtB,CAAA,MAAA,IAAW,IAAA,CAAK,KAAA,CAAM,cAAA,IAAkB,IAAI,WAAA,EAAa;AAEvD,QAAA,MAAA,CAAO,IAAA,CAAK,EAAE,EAAA,EAAI,OAAA,EAAS,MAAA,EAAQ,MAAA,EAAQ,MAAA,EAAQ,EAAE,MAAA,EAAQ,eAAA,EAAgB,EAAG,CAAA;AAAA,MAClF,CAAA,MAAO;AAGL,QAAA,IAAI,YAAY,2BAAA,EAA6B;AAC3C,UAAA,MAAA,CAAO,IAAA,CAAK,EAAE,EAAA,EAAI,OAAA,EAAS,MAAA,EAAQ,MAAA,EAAQ,MAAA,EAAQ,EAAE,MAAA,EAAQ,gBAAA,EAAiB,EAAG,CAAA;AAAA,QACnF,CAAA,MAAA,IAAW,YAAY,gBAAA,EAAkB;AAEvC,UAAA,MAAA,CAAO,IAAA,CAAK;AAAA,YACV,EAAA,EAAI,OAAA;AAAA,YACJ,MAAA,EAAQ,MAAA;AAAA,YACR,MAAA,EAAQ,EAAE,MAAA,EAAQ,0BAAA;AAA2B,WAC9C,CAAA;AAAA,QACH,CAAA,MAAO;AAEL,UAAA,MAAA,CAAO,IAAA,CAAK,EAAE,EAAA,EAAI,OAAA,EAAS,MAAA,EAAQ,MAAA,EAAQ,MAAA,EAAQ,EAAE,MAAA,EAAQ,cAAA,EAAe,EAAG,CAAA;AAAA,QACjF;AAAA,MACF;AAAA,IACF;AAEA,IAAA,MAAM,MAAA,GAA6B;AAAA,MACjC,cAAA,EAAgBC,2BAAAA;AAAA,MAChB,KAAA,EAAO,KAAK,KAAA,CAAM,KAAA;AAAA,MAClB,MAAA,EAAQ,KAAK,KAAA,CAAM,MAAA;AAAA,MACnB,MAAA,EAAQ,KAAK,KAAA,CAAM,MAAA;AAAA,MACnB;AAAA,KACF;AAEA,IAAA,IAAI,IAAA,CAAK,KAAA,CAAM,SAAA,IAAa,MAAA,CAAO,IAAA,CAAK,KAAK,KAAA,CAAM,SAAS,CAAA,CAAE,MAAA,GAAS,CAAA,EAAG;AACxE,MAAA,MAAA,CAAO,SAAA,GAAY,KAAK,KAAA,CAAM,SAAA;AAAA,IAChC;AAEA,IAAA,IAAI,IAAA,CAAK,MAAM,IAAA,EAAM;AACnB,MAAA,MAAA,CAAO,IAAA,GAAO,KAAK,KAAA,CAAM,IAAA;AAAA,IAC3B;AAEA,IAAA,OAAO,MAAA;AAAA,EACT;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAcA,kBAAA,GAAuD;AACrD,IAAA,MAAM,MAAA,GAAS,KAAK,KAAA,EAAM;AAC1B,IAAA,MAAM,EAAE,IAAA,EAAM,KAAA,EAAO,GAAG,eAAc,GAAI,MAAA;AAG1C,IAAA,IAAI,cAAc,SAAA,EAAW;AAC3B,MAAA,MAAM,iBAAA,GAAoD,EAAE,GAAG,aAAA,CAAc,SAAA,EAAU;AACvF,MAAA,KAAA,MAAW,OAAO,+BAAA,EAAiC;AACjD,QAAA,OAAO,kBAAkB,GAAG,CAAA;AAAA,MAC9B;AAGA,MAAA,IAAI,MAAA,CAAO,IAAA,CAAK,iBAAiB,CAAA,CAAE,WAAW,CAAA,EAAG;AAC/C,QAAA,OAAO,aAAA,CAAc,SAAA;AAAA,MACvB,CAAA,MAAO;AACL,QAAA,aAAA,CAAc,SAAA,GAAY,iBAAA;AAAA,MAC5B;AAAA,IACF;AAEA,IAAA,OAAO,aAAA;AAAA,EACT;AACF;AAKO,SAAS,oBAAoB,MAAA,EAAmD;AACrF,EAAA,OAAO,IAAI,0BAA0B,MAAM,CAAA;AAC7C;AAQA,eAAsB,qBAAqB,YAAA,EAAoD;AAC7F,EAAA,MAAM,KAAA,GACJ,OAAO,YAAA,KAAiB,QAAA,GAAW,IAAI,WAAA,EAAY,CAAE,MAAA,CAAO,YAAY,CAAA,GAAI,YAAA;AAC9E,EAAA,OAAOD,UAAU,KAAK,CAAA;AACxB;AAQA,eAAsB,mBACpB,MAAA,EACA,YAAA,EACA,QACA,aAAA,EACA,SAAA,EACA,QACA,OAAA,EAK6B;AAC7B,EAAA,MAAM,KAAA,GACJ,OAAO,YAAA,KAAiB,QAAA,GAAW,IAAI,WAAA,EAAY,CAAE,MAAA,CAAO,YAAY,CAAA,GAAI,YAAA;AAC9E,EAAA,MAAM,SAAA,GAAY,MAAMA,SAAAA,CAAU,KAAK,CAAA;AAEvC,EAAA,MAAM,OAAA,GAAU,mBAAA,CAAoB,MAAM,CAAA,CACvC,kBAAA,CAAmB,SAAS,CAAA,CAC5B,OAAA,CAAQ,MAAA,EAAQ,OAAA,EAAS,MAAA,EAAQ,OAAA,EAAS,GAAG,CAAA;AAGhD,EAAA,MAAM,WAAA,GAAc,SAAA,CAAU,OAAA,CAAQ,aAAa,CAAA;AACnD,EAAA,KAAA,IAAS,CAAA,GAAI,CAAA,EAAG,CAAA,GAAI,SAAA,CAAU,QAAQ,CAAA,EAAA,EAAK;AACzC,IAAA,MAAM,OAAA,GAAU,UAAU,CAAC,CAAA;AAC3B,IAAA,IAAI,IAAI,WAAA,EAAa;AACnB,MAAA,OAAA,CAAQ,KAAK,OAAO,CAAA;AAAA,IACtB,CAAA,MAAA,IAAW,MAAM,WAAA,EAAa;AAC5B,MAAA,OAAA,CAAQ,KAAK,OAAA,EAAS,SAAA,IAAa,qBAAA,CAAsB,MAAM,GAAG,MAAM,CAAA;AAAA,IAC1E;AAAA,EAEF;AAEA,EAAA,IAAI,SAAS,IAAA,EAAM;AACjB,IAAA,OAAA,CAAQ,OAAA,CAAQ,QAAQ,IAAI,CAAA;AAAA,EAC9B;AAEA,EAAA,OAAO,QAAQ,KAAA,EAAM;AACvB;AAKA,eAAsB,mBACpB,MAAA,EACA,YAAA,EACA,MAAA,EACA,GAAA,EACA,cACA,OAAA,EAI6B;AAC7B,EAAA,MAAM,KAAA,GACJ,OAAO,YAAA,KAAiB,QAAA,GAAW,IAAI,WAAA,EAAY,CAAE,MAAA,CAAO,YAAY,CAAA,GAAI,YAAA;AAC9E,EAAA,MAAM,SAAA,GAAY,MAAMA,SAAAA,CAAU,KAAK,CAAA;AAEvC,EAAA,MAAM,OAAA,GAAU,oBAAoB,MAAM,CAAA,CAAE,mBAAmB,SAAS,CAAA,CAAE,OAAA,CAAQ,MAAA,EAAQ,GAAG,CAAA;AAG7F,EAAA,KAAA,MAAW,WAAW,SAAA,EAAW;AAE/B,IAAA,IAAI,OAAA,KAAY,kBAAA,IAAsB,MAAA,CAAO,IAAA,KAAS,cAAA,EAAgB;AACpE,MAAA,OAAA,CAAQ,IAAA,CAAK,OAAA,EAAS,EAAE,MAAA,EAAQ,gBAAgB,CAAA;AAChD,MAAA;AAAA,IACF;AAGA,IAAA,IAAI,YAAY,2BAAA,EAA6B;AAC3C,MAAA,IAAI,YAAA,GAAe,OAAO,CAAA,EAAG;AAC3B,QAAA,OAAA,CAAQ,IAAA,CAAK,OAAA,EAAS,YAAA,CAAa,OAAO,CAAC,CAAA;AAAA,MAC7C;AAEA,MAAA;AAAA,IACF;AAGA,IAAA,IAAI,YAAY,gBAAA,EAAkB;AAEhC,MAAA;AAAA,IACF;AAEA,IAAA,OAAA,CAAQ,IAAA,CAAK,OAAA,EAAS,YAAA,GAAe,OAAO,CAAC,CAAA;AAAA,EAC/C;AAEA,EAAA,IAAI,SAAS,SAAA,EAAW;AACtB,IAAA,KAAA,MAAW,CAAC,KAAK,KAAK,CAAA,IAAK,OAAO,OAAA,CAAQ,OAAA,CAAQ,SAAS,CAAA,EAAG;AAC5D,MAAA,OAAA,CAAQ,WAAA,CAAY,KAAK,KAAK,CAAA;AAAA,IAChC;AAAA,EACF;AAEA,EAAA,IAAI,SAAS,IAAA,EAAM;AACjB,IAAA,OAAA,CAAQ,OAAA,CAAQ,QAAQ,IAAI,CAAA;AAAA,EAC9B;AAEA,EAAA,OAAO,QAAQ,KAAA,EAAM;AACvB;;;AC9VA,SAAS,gBAAgB,MAAA,EAAwB;AAC/C,EAAA,IAAI;AACF,IAAA,MAAM,GAAA,GAAM,IAAI,GAAA,CAAI,MAAM,CAAA;AAE1B,IAAA,IAAI,GAAA,CAAI,IAAA,IAAQ,GAAA,CAAI,IAAA,KAAS,KAAA,EAAO;AAClC,MAAA,OAAO,CAAA,EAAG,IAAI,QAAQ,CAAA,EAAA,EAAK,IAAI,QAAQ,CAAA,CAAA,EAAI,IAAI,IAAI,CAAA,CAAA;AAAA,IACrD;AACA,IAAA,OAAO,CAAA,EAAG,GAAA,CAAI,QAAQ,CAAA,EAAA,EAAK,IAAI,QAAQ,CAAA,CAAA;AAAA,EACzC,CAAA,CAAA,MAAQ;AACN,IAAA,OAAO,MAAA;AAAA,EACT;AACF;AAKA,SAAS,eAAA,CAAgB,QAAgB,SAAA,EAA+B;AACtE,EAAA,IAAI,CAAC,SAAA,IAAa,SAAA,CAAU,MAAA,KAAW,CAAA,EAAG;AAExC,IAAA,OAAO,IAAA;AAAA,EACT;AAEA,EAAA,MAAM,UAAA,GAAa,gBAAgB,MAAM,CAAA;AACzC,EAAA,OAAO,UAAU,IAAA,CAAK,CAAC,YAAY,eAAA,CAAgB,OAAO,MAAM,UAAU,CAAA;AAC5E;AAKA,SAAS,aAAA,CACP,MAAA,EACA,GAAA,EACA,UAAA,EACuB;AACvB,EAAA,IAAI,CAAC,UAAA,IAAc,UAAA,CAAW,MAAA,KAAW,CAAA,EAAG;AAC1C,IAAA,OAAO,MAAA;AAAA,EACT;AAEA,EAAA,MAAM,gBAAA,GAAmB,gBAAgB,MAAM,CAAA;AAC/C,EAAA,OAAO,UAAA,CAAW,IAAA,CAAK,CAAC,EAAA,KAAO,eAAA,CAAgB,EAAA,CAAG,MAAM,CAAA,KAAM,gBAAA,IAAoB,EAAA,CAAG,GAAA,KAAQ,GAAG,CAAA;AAClG;AAmBA,eAAe,gBACb,YAAA,EACuD;AACvD,EAAA,MAAM,MAAA,GAAS,MAAM,WAAA,CAAY,YAAY,CAAA;AAE7C,EAAA,IAAI,CAAC,OAAO,EAAA,EAAI;AACd,IAAA,OAAO;AAAA,MACL,KAAA,EAAO;AAAA,QACL,EAAA,EAAI,KAAA;AAAA,QACJ,MAAA,EAAQ,OAAO,MAAA,IAAU,eAAA;AAAA,QACzB,SAAS,MAAA,CAAO,OAAA;AAAA,QAChB,YAAY,MAAA,CAAO;AAAA;AACrB,KACF;AAAA,EACF;AAEA,EAAA,OAAO;AAAA,IACL,MAAM,MAAA,CAAO,IAAA;AAAA,IACb,WAAW,MAAA,CAAO,SAAA;AAAA,IAClB,UAAU,MAAA,CAAO;AAAA,GACnB;AACF;AAqBA,eAAsB,kBAAkB,OAAA,EAAuD;AAC7F,EAAA,MAAM;AAAA,IACJ,OAAA;AAAA,IACA,MAAA,GAAS,oBAAoB,mBAAmB,CAAA;AAAA,IAChD,aAAA;AAAA,IACA,WAAA,GAAc;AAAA,GAChB,GAAI,OAAA;AAGJ,EAAA,MAAM,UAAA,GAAa,OAAO,OAAA,KAAY,QAAA,GAAW,UAAU,IAAI,WAAA,EAAY,CAAE,MAAA,CAAO,OAAO,CAAA;AAC3F,EAAA,MAAM,YAAA,GAAe,OAAO,OAAA,KAAY,QAAA,GAAW,IAAI,WAAA,EAAY,CAAE,MAAA,CAAO,OAAO,CAAA,GAAI,OAAA;AAGvF,EAAA,MAAM,gBAAA,GAAmB,MAAMA,SAAAA,CAAU,YAAY,CAAA;AAGrD,EAAA,MAAM,OAAA,GAAU,oBAAoB,MAAM,CAAA;AAC1C,EAAA,OAAA,CAAQ,mBAAmB,gBAAgB,CAAA;AAG3C,EAAA,MAAM,aAAa,aAAA,IAAiB,IAAA,CAAK,MAAM,IAAA,CAAK,GAAA,KAAQ,GAAI,CAAA;AAGhE,EAAA,IAAI,MAAA;AACJ,EAAA,IAAI,GAAA;AACJ,EAAA,IAAI,YAAA;AAKJ,EAAA,IAAI,MAAA;AACJ,EAAA,IAAI,OAAA;AAEJ,EAAA,IAAI;AACF,IAAA,MAAM,OAAA,GAAUE,OAA0B,UAAU,CAAA;AACpD,IAAA,MAAA,GAAS,OAAA,CAAQ,MAAA;AACjB,IAAA,OAAA,GAAU,OAAA,CAAQ,OAAA;AAClB,IAAA,OAAA,CAAQ,KAAK,WAAW,CAAA;AAAA,EAC1B,SAAS,GAAA,EAAK;AACZ,IAAA,OAAA,CAAQ,IAAA,CAAK,aAAa,4BAAA,EAA8B;AAAA,MACtD,OAAO,GAAA,YAAe,KAAA,GAAQ,GAAA,CAAI,OAAA,GAAU,OAAO,GAAG;AAAA,KACvD,CAAA;AACD,IAAA,OAAA,CAAQ,QAAQ,mBAAmB,CAAA;AACnC,IAAA,OAAO,EAAE,KAAA,EAAO,KAAA,EAAO,MAAA,EAAQ,WAAA,GAAc,OAAA,CAAQ,YAAA,EAAa,CAAE,KAAA,EAAM,GAAI,OAAA,CAAQ,KAAA,EAAM,EAAE;AAAA,EAChG;AAKA,EAAA,IAAI,YAAA,CAAa,MAAA,GAAS,MAAA,CAAO,MAAA,CAAO,iBAAA,EAAmB;AACzD,IAAA,OAAA,CAAQ,IAAA,CAAK,wBAAwB,4BAAA,EAA8B;AAAA,MACjE,MAAM,YAAA,CAAa,MAAA;AAAA,MACnB,KAAA,EAAO,OAAO,MAAA,CAAO;AAAA,KACtB,CAAA;AACD,IAAA,OAAA,CAAQ,QAAQ,mBAAmB,CAAA;AACnC,IAAA,OAAO,EAAE,KAAA,EAAO,KAAA,EAAO,MAAA,EAAQ,WAAA,GAAc,OAAA,CAAQ,YAAA,EAAa,CAAE,KAAA,EAAM,GAAI,OAAA,CAAQ,KAAA,EAAM,EAAE;AAAA,EAChG;AACA,EAAA,OAAA,CAAQ,KAAK,sBAAA,EAAwB,EAAE,IAAA,EAAM,YAAA,CAAa,QAAQ,CAAA;AAKlE,EAAA,IAAI,MAAA,CAAO,QAAQ,OAAA,EAAS;AAC1B,IAAA,OAAA,CAAQ,IAAA,CAAK,wBAAwB,4BAAA,EAA8B;AAAA,MACjE,YAAA,EAAc,OAAA;AAAA,MACd,YAAY,MAAA,CAAO;AAAA,KACpB,CAAA;AACD,IAAA,OAAA,CAAQ,QAAQ,mBAAmB,CAAA;AACnC,IAAA,OAAO,EAAE,KAAA,EAAO,KAAA,EAAO,MAAA,EAAQ,WAAA,GAAc,OAAA,CAAQ,YAAA,EAAa,CAAE,KAAA,EAAM,GAAI,OAAA,CAAQ,KAAA,EAAM,EAAE;AAAA,EAChG;AACA,EAAA,IAAI,MAAA,CAAO,QAAQC,SAAAA,EAAW;AAC5B,IAAA,OAAA,CAAQ,IAAA,CAAK,wBAAwB,4BAAA,EAA8B;AAAA,MACjE,YAAA,EAAcA,SAAAA;AAAA,MACd,YAAY,MAAA,CAAO;AAAA,KACpB,CAAA;AACD,IAAA,OAAA,CAAQ,QAAQ,mBAAmB,CAAA;AACnC,IAAA,OAAO,EAAE,KAAA,EAAO,KAAA,EAAO,MAAA,EAAQ,WAAA,GAAc,OAAA,CAAQ,YAAA,EAAa,CAAE,KAAA,EAAM,GAAI,OAAA,CAAQ,KAAA,EAAM,EAAE;AAAA,EAChG;AACA,EAAA,IAAI,CAAC,OAAO,GAAA,EAAK;AACf,IAAA,OAAA,CAAQ,IAAA,CAAK,wBAAwB,4BAAA,EAA8B;AAAA,MACjE,KAAA,EAAO;AAAA,KACR,CAAA;AACD,IAAA,OAAA,CAAQ,QAAQ,mBAAmB,CAAA;AACnC,IAAA,OAAO,EAAE,KAAA,EAAO,KAAA,EAAO,MAAA,EAAQ,WAAA,GAAc,OAAA,CAAQ,YAAA,EAAa,CAAE,KAAA,EAAM,GAAI,OAAA,CAAQ,KAAA,EAAM,EAAE;AAAA,EAChG;AACA,EAAA,GAAA,GAAM,MAAA,CAAO,GAAA;AACb,EAAA,OAAA,CAAQ,IAAA,CAAK,sBAAA,EAAwB,EAAE,GAAA,EAAK,MAAA,CAAO,GAAA,EAAK,GAAA,EAAK,MAAA,CAAO,GAAA,EAAK,GAAA,EAAK,MAAA,CAAO,GAAA,EAAK,CAAA;AAK1F,EAAA,IAAI;AACF,IAAAf,aAAAA,CAAc,MAAM,OAAO,CAAA;AAC3B,IAAA,MAAA,GAAS,OAAA,CAAQ,GAAA;AACjB,IAAA,OAAA,CAAQ,KAAK,0BAA0B,CAAA;AAAA,EACzC,SAAS,GAAA,EAAK;AACZ,IAAA,OAAA,CAAQ,IAAA,CAAK,4BAA4B,yBAAA,EAA2B;AAAA,MAClE,OAAO,GAAA,YAAe,KAAA,GAAQ,GAAA,CAAI,OAAA,GAAU,OAAO,GAAG;AAAA,KACvD,CAAA;AACD,IAAA,OAAA,CAAQ,QAAQ,gBAAgB,CAAA;AAChC,IAAA,OAAO,EAAE,KAAA,EAAO,KAAA,EAAO,MAAA,EAAQ,WAAA,GAAc,OAAA,CAAQ,YAAA,EAAa,CAAE,KAAA,EAAM,GAAI,OAAA,CAAQ,KAAA,EAAM,EAAE;AAAA,EAChG;AAKA,EAAA,MAAM,gBAAA,GAAmB,gBAAgB,MAAO,CAAA;AAEhD,EAAA,IAAI,CAAC,eAAA,CAAgB,MAAA,EAAS,MAAA,CAAO,gBAAgB,CAAA,EAAG;AACtD,IAAA,OAAA,CAAQ,IAAA,CAAK,uBAAuB,6BAAA,EAA+B;AAAA,MACjE,MAAA,EAAQ,gBAAA;AAAA,MACR,WAAW,MAAA,CAAO;AAAA,KACnB,CAAA;AACD,IAAA,OAAA,CAAQ,OAAA,CAAQ,oBAAA,EAAsB,gBAAA,EAAkB,GAAG,CAAA;AAC3D,IAAA,OAAO,EAAE,KAAA,EAAO,KAAA,EAAO,MAAA,EAAQ,WAAA,GAAc,OAAA,CAAQ,YAAA,EAAa,CAAE,KAAA,EAAM,GAAI,OAAA,CAAQ,KAAA,EAAM,EAAE;AAAA,EAChG;AACA,EAAA,OAAA,CAAQ,IAAA,CAAK,qBAAA,EAAuB,EAAE,MAAA,EAAQ,kBAAkB,CAAA;AAMhE,EAAA,IAAI,SAAA;AACJ,EAAA,IAAI,SAAA;AACJ,EAAA,IAAI,aAAA;AACJ,EAAA,IAAI,YAAA;AAGJ,EAAA,MAAM,SAAA,GAAY,aAAA,CAAc,MAAA,EAAS,GAAA,EAAM,OAAO,WAAW,CAAA;AAEjE,EAAA,IAAI,SAAA,EAAW;AAEb,IAAA,OAAA,CAAQ,IAAA,CAAK,kBAAA,EAAoB,EAAE,MAAA,EAAQ,wBAAwB,CAAA;AAGnE,IAAA,IAAI,UAAU,GAAA,EAAK;AAEjB,MAAA,MAAM,gBAAA,GAAmB,MAAM,oBAAA,CAAqB,SAAA,CAAU,GAAG,CAAA;AACjE,MAAA,IAAI,gBAAA,KAAqB,UAAU,qBAAA,EAAuB;AACxD,QAAA,OAAA,CAAQ,IAAA,CAAK,eAAe,2BAAA,EAA6B;AAAA,UACvD,KAAA,EAAO,0DAAA;AAAA,UACP,UAAU,SAAA,CAAU,qBAAA;AAAA,UACpB,MAAA,EAAQ;AAAA,SACT,CAAA;AACD,QAAA,OAAA,CAAQ,OAAA,CAAQ,kBAAA,EAAoB,gBAAA,EAAkB,GAAG,CAAA;AACzD,QAAA,OAAO;AAAA,UACL,KAAA,EAAO,KAAA;AAAA,UACP,MAAA,EAAQ,cAAc,OAAA,CAAQ,YAAA,GAAe,KAAA,EAAM,GAAI,QAAQ,KAAA;AAAM,SACvE;AAAA,MACF;AACA,MAAA,SAAA,GAAY,mBAAA,CAAoB,UAAU,GAAG,CAAA;AAC7C,MAAA,SAAA,GAAY,aAAA;AACZ,MAAA,aAAA,GAAgB,gBAAA;AAChB,MAAA,OAAA,CAAQ,KAAK,aAAA,EAAe;AAAA,QAC1B,MAAA,EAAQ,SAAA;AAAA,QACR,GAAA;AAAA,QACA,mBAAA,EAAqB,IAAA;AAAA,QACrB,OAAA,EAAS;AAAA,OACV,CAAA;AAAA,IACH,CAAA,MAAA,IAAW,UAAU,UAAA,EAAY;AAE/B,MAAA,IAAI;AACF,QAAA,SAAA,GAAYgB,eAAAA,CAAgB,UAAU,UAAU,CAAA;AAChD,QAAA,IAAI,SAAA,CAAU,WAAW,EAAA,EAAI;AAC3B,UAAA,MAAM,IAAI,KAAA,CAAM,CAAA,uBAAA,EAA0B,SAAA,CAAU,MAAM,CAAA,CAAE,CAAA;AAAA,QAC9D;AACA,QAAA,SAAA,GAAY,aAAA;AAIZ,QAAA,aAAA,GAAgB,SAAA,CAAU,qBAAA;AAC1B,QAAA,OAAA,CAAQ,KAAK,aAAA,EAAe;AAAA,UAC1B,MAAA,EAAQ,SAAA;AAAA,UACR,GAAA;AAAA,UACA,OAAA,EAAS,IAAA;AAAA,UACT,mBAAA,EAAqB;AAAA,SACtB,CAAA;AAAA,MACH,SAAS,GAAA,EAAK;AACZ,QAAA,OAAA,CAAQ,IAAA,CAAK,eAAe,wBAAA,EAA0B;AAAA,UACpD,KAAA,EAAO,8BAA8B,GAAA,YAAe,KAAA,GAAQ,IAAI,OAAA,GAAU,MAAA,CAAO,GAAG,CAAC,CAAA;AAAA,SACtF,CAAA;AACD,QAAA,OAAA,CAAQ,OAAA,CAAQ,eAAA,EAAiB,gBAAA,EAAkB,GAAG,CAAA;AACtD,QAAA,OAAO;AAAA,UACL,KAAA,EAAO,KAAA;AAAA,UACP,MAAA,EAAQ,cAAc,OAAA,CAAQ,YAAA,GAAe,KAAA,EAAM,GAAI,QAAQ,KAAA;AAAM,SACvE;AAAA,MACF;AAAA,IACF,CAAA,MAAA,IAAW,MAAA,CAAO,IAAA,KAAS,cAAA,EAAgB;AAEzC,MAAA,OAAA,CAAQ,IAAA,CAAK,eAAe,wBAAA,EAA0B;AAAA,QACpD,KAAA,EAAO;AAAA,OACR,CAAA;AACD,MAAA,OAAA,CAAQ,OAAA,CAAQ,eAAA,EAAiB,gBAAA,EAAkB,GAAG,CAAA;AACtD,MAAA,OAAO;AAAA,QACL,KAAA,EAAO,KAAA;AAAA,QACP,MAAA,EAAQ,cAAc,OAAA,CAAQ,YAAA,GAAe,KAAA,EAAM,GAAI,QAAQ,KAAA;AAAM,OACvE;AAAA,IACF,CAAA,MAAO;AAEL,MAAA,MAAM,UAAA,GAAa,MAAM,eAAA,CAAgB,gBAAgB,CAAA;AAEzD,MAAA,IAAI,WAAW,UAAA,EAAY;AACzB,QAAA,MAAM,MAAA,GAAS,qBAAA,CAAsB,UAAA,CAAW,KAAA,CAAM,QAAQ,KAAK,CAAA;AACnE,QAAA,OAAA,CAAQ,IAAA,CAAK,kBAAA,EAAoB,qBAAA,CAAsB,MAAM,CAAA,EAAG;AAAA,UAC9D,KAAA,EAAO,WAAW,KAAA,CAAM,OAAA;AAAA,UACxB,GAAA,EAAK,WAAW,KAAA,CAAM;AAAA,SACvB,CAAA;AACD,QAAA,OAAA,CAAQ,OAAA,CAAQ,MAAA,EAAQ,gBAAA,EAAkB,GAAG,CAAA;AAC7C,QAAA,OAAO;AAAA,UACL,KAAA,EAAO,KAAA;AAAA,UACP,MAAA,EAAQ,cAAc,OAAA,CAAQ,YAAA,GAAe,KAAA,EAAM,GAAI,QAAQ,KAAA;AAAM,SACvE;AAAA,MACF;AAGA,MAAA,IAAI,WAAW,QAAA,EAAU;AACvB,QAAA,YAAA,GAAe,UAAA,CAAW,QAAA;AAAA,MAC5B;AAEA,MAAA,OAAA,CAAQ,KAAK,kBAAA,EAAoB;AAAA,QAC/B,YAAY,UAAA,CAAW,SAAA;AAAA,QACvB,UAAA,EAAY,UAAA,CAAW,IAAA,CAAK,IAAA,CAAK;AAAA,OAClC,CAAA;AAGD,MAAA,MAAM,GAAA,GAAM,WAAW,IAAA,CAAK,IAAA,CAAK,KAAK,CAAC,CAAA,KAAM,CAAA,CAAE,GAAA,KAAQ,GAAG,CAAA;AAC1D,MAAA,IAAI,CAAC,GAAA,EAAK;AACR,QAAA,OAAA,CAAQ,IAAA,CAAK,eAAe,wBAAA,EAA0B;AAAA,UACpD,GAAA;AAAA,UACA,cAAA,EAAgB,WAAW,IAAA,CAAK,IAAA,CAAK,IAAI,CAAC,CAAA,KAAM,EAAE,GAAG;AAAA,SACtD,CAAA;AACD,QAAA,OAAA,CAAQ,OAAA,CAAQ,eAAA,EAAiB,gBAAA,EAAkB,GAAG,CAAA;AACtD,QAAA,OAAO;AAAA,UACL,KAAA,EAAO,KAAA;AAAA,UACP,MAAA,EAAQ,cAAc,OAAA,CAAQ,YAAA,GAAe,KAAA,EAAM,GAAI,QAAQ,KAAA;AAAM,SACvE;AAAA,MACF;AAGA,MAAA,MAAM,gBAAA,GAAmB,MAAM,oBAAA,CAAqB,GAAG,CAAA;AACvD,MAAA,IAAI,gBAAA,KAAqB,UAAU,qBAAA,EAAuB;AACxD,QAAA,OAAA,CAAQ,IAAA,CAAK,eAAe,2BAAA,EAA6B;AAAA,UACvD,KAAA,EAAO,0CAAA;AAAA,UACP,UAAU,SAAA,CAAU,qBAAA;AAAA,UACpB,MAAA,EAAQ;AAAA,SACT,CAAA;AACD,QAAA,OAAA,CAAQ,OAAA,CAAQ,kBAAA,EAAoB,gBAAA,EAAkB,GAAG,CAAA;AACzD,QAAA,OAAO;AAAA,UACL,KAAA,EAAO,KAAA;AAAA,UACP,MAAA,EAAQ,cAAc,OAAA,CAAQ,YAAA,GAAe,KAAA,EAAM,GAAI,QAAQ,KAAA;AAAM,SACvE;AAAA,MACF;AAEA,MAAA,SAAA,GAAY,oBAAoB,GAAG,CAAA;AACnC,MAAA,SAAA,GAAY,aAAA;AACZ,MAAA,aAAA,GAAgB,gBAAA;AAChB,MAAA,OAAA,CAAQ,IAAA,CAAK,eAAe,EAAE,MAAA,EAAQ,WAAW,GAAA,EAAK,mBAAA,EAAqB,MAAM,CAAA;AAAA,IACnF;AAAA,EACF,CAAA,MAAO;AAEL,IAAA,IAAI,MAAA,CAAO,SAAS,cAAA,EAAgB;AAClC,MAAA,OAAA,CAAQ,IAAA,CAAK,oBAAoB,wBAAA,EAA0B;AAAA,QACzD,KAAA,EAAO;AAAA,OACR,CAAA;AACD,MAAA,OAAA,CAAQ,OAAA,CAAQ,eAAA,EAAiB,gBAAA,EAAkB,GAAG,CAAA;AACtD,MAAA,OAAO;AAAA,QACL,KAAA,EAAO,KAAA;AAAA,QACP,MAAA,EAAQ,cAAc,OAAA,CAAQ,YAAA,GAAe,KAAA,EAAM,GAAI,QAAQ,KAAA;AAAM,OACvE;AAAA,IACF;AAEA,IAAA,MAAM,UAAA,GAAa,MAAM,eAAA,CAAgB,gBAAgB,CAAA;AAEzD,IAAA,IAAI,WAAW,UAAA,EAAY;AACzB,MAAA,MAAM,MAAA,GAAS,qBAAA,CAAsB,UAAA,CAAW,KAAA,CAAM,QAAQ,KAAK,CAAA;AACnE,MAAA,OAAA,CAAQ,IAAA,CAAK,kBAAA,EAAoB,qBAAA,CAAsB,MAAM,CAAA,EAAG;AAAA,QAC9D,KAAA,EAAO,WAAW,KAAA,CAAM,OAAA;AAAA,QACxB,GAAA,EAAK,WAAW,KAAA,CAAM;AAAA,OACvB,CAAA;AACD,MAAA,OAAA,CAAQ,OAAA,CAAQ,MAAA,EAAQ,gBAAA,EAAkB,GAAG,CAAA;AAC7C,MAAA,OAAO;AAAA,QACL,KAAA,EAAO,KAAA;AAAA,QACP,MAAA,EAAQ,cAAc,OAAA,CAAQ,YAAA,GAAe,KAAA,EAAM,GAAI,QAAQ,KAAA;AAAM,OACvE;AAAA,IACF;AAGA,IAAA,IAAI,WAAW,QAAA,EAAU;AACvB,MAAA,YAAA,GAAe,UAAA,CAAW,QAAA;AAAA,IAC5B;AAEA,IAAA,OAAA,CAAQ,KAAK,kBAAA,EAAoB;AAAA,MAC/B,YAAY,UAAA,CAAW,SAAA;AAAA,MACvB,UAAA,EAAY,UAAA,CAAW,IAAA,CAAK,IAAA,CAAK;AAAA,KAClC,CAAA;AAGD,IAAA,MAAM,GAAA,GAAM,WAAW,IAAA,CAAK,IAAA,CAAK,KAAK,CAAC,CAAA,KAAM,CAAA,CAAE,GAAA,KAAQ,GAAG,CAAA;AAC1D,IAAA,IAAI,CAAC,GAAA,EAAK;AACR,MAAA,OAAA,CAAQ,IAAA,CAAK,eAAe,wBAAA,EAA0B;AAAA,QACpD,GAAA;AAAA,QACA,cAAA,EAAgB,WAAW,IAAA,CAAK,IAAA,CAAK,IAAI,CAAC,CAAA,KAAM,EAAE,GAAG;AAAA,OACtD,CAAA;AACD,MAAA,OAAA,CAAQ,OAAA,CAAQ,eAAA,EAAiB,gBAAA,EAAkB,GAAG,CAAA;AACtD,MAAA,OAAO;AAAA,QACL,KAAA,EAAO,KAAA;AAAA,QACP,MAAA,EAAQ,cAAc,OAAA,CAAQ,YAAA,GAAe,KAAA,EAAM,GAAI,QAAQ,KAAA;AAAM,OACvE;AAAA,IACF;AAEA,IAAA,SAAA,GAAY,oBAAoB,GAAG,CAAA;AACnC,IAAA,SAAA,GAAY,gBAAA;AACZ,IAAA,aAAA,GAAgB,MAAM,qBAAqB,GAAG,CAAA;AAC9C,IAAA,OAAA,CAAQ,IAAA,CAAK,eAAe,EAAE,MAAA,EAAQ,WAAW,GAAA,EAAK,UAAA,EAAY,eAAe,CAAA;AAAA,EACnF;AAKA,EAAA,IAAI;AACF,IAAA,MAAM,MAAA,GAAS,MAAMf,MAAAA,CAA6B,UAAA,EAAY,SAAS,CAAA;AAEvE,IAAA,IAAI,CAAC,OAAO,KAAA,EAAO;AACjB,MAAA,OAAA,CAAQ,IAAA,CAAK,iBAAiB,4BAAA,EAA8B;AAAA,QAC1D,KAAA,EAAO;AAAA,OACR,CAAA;AACD,MAAA,OAAA,CAAQ,OAAA,CAAQ,mBAAA,EAAqB,gBAAA,EAAkB,GAAG,CAAA;AAC1D,MAAA,OAAO;AAAA,QACL,KAAA,EAAO,KAAA;AAAA,QACP,MAAA,EAAQ,cAAc,OAAA,CAAQ,YAAA,GAAe,KAAA,EAAM,GAAI,QAAQ,KAAA;AAAM,OACvE;AAAA,IACF;AAEA,IAAA,YAAA,GAAe,MAAA,CAAO,OAAA;AACtB,IAAA,OAAA,CAAQ,KAAK,eAAe,CAAA;AAAA,EAC9B,SAAS,GAAA,EAAK;AACZ,IAAA,OAAA,CAAQ,IAAA,CAAK,iBAAiB,4BAAA,EAA8B;AAAA,MAC1D,OAAO,GAAA,YAAe,KAAA,GAAQ,GAAA,CAAI,OAAA,GAAU,OAAO,GAAG;AAAA,KACvD,CAAA;AACD,IAAA,OAAA,CAAQ,OAAA,CAAQ,mBAAA,EAAqB,gBAAA,EAAkB,GAAG,CAAA;AAC1D,IAAA,OAAO,EAAE,KAAA,EAAO,KAAA,EAAO,MAAA,EAAQ,WAAA,GAAc,OAAA,CAAQ,YAAA,EAAa,CAAE,KAAA,EAAM,GAAI,OAAA,CAAQ,KAAA,EAAM,EAAE;AAAA,EAChG;AAKA,EAAA,MAAM,YAAA,GAAe,EAAA;AAGrB,EAAA,IAAI,YAAA,CAAc,GAAA,GAAM,UAAA,GAAa,YAAA,EAAc;AACjD,IAAA,OAAA,CAAQ,IAAA,CAAK,sBAAsB,wBAAA,EAA0B;AAAA,MAC3D,KAAA,EAAO,8BAAA;AAAA,MACP,KAAK,YAAA,CAAc,GAAA;AAAA,MACnB,GAAA,EAAK,UAAA;AAAA,MACL,SAAA,EAAW;AAAA,KACZ,CAAA;AACD,IAAA,OAAA,CAAQ,OAAA,CAAQ,eAAA,EAAiB,gBAAA,EAAkB,GAAG,CAAA;AACtD,IAAA,OAAO,EAAE,KAAA,EAAO,KAAA,EAAO,MAAA,EAAQ,WAAA,GAAc,OAAA,CAAQ,YAAA,EAAa,CAAE,KAAA,EAAM,GAAI,OAAA,CAAQ,KAAA,EAAM,EAAE;AAAA,EAChG;AAGA,EAAA,IAAI,aAAc,GAAA,EAAK;AACrB,IAAA,IAAI,YAAA,CAAc,MAAM,UAAA,EAAY;AAClC,MAAA,OAAA,CAAQ,IAAA,CAAK,sBAAsB,kBAAA,EAAoB;AAAA,QACrD,KAAA,EAAO,iBAAA;AAAA,QACP,KAAK,YAAA,CAAc,GAAA;AAAA,QACnB,GAAA,EAAK;AAAA,OACN,CAAA;AACD,MAAA,OAAA,CAAQ,OAAA,CAAQ,SAAA,EAAW,gBAAA,EAAkB,GAAG,CAAA;AAChD,MAAA,OAAO;AAAA,QACL,KAAA,EAAO,KAAA;AAAA,QACP,MAAA,EAAQ,cAAc,OAAA,CAAQ,YAAA,GAAe,KAAA,EAAM,GAAI,QAAQ,KAAA;AAAM,OACvE;AAAA,IACF;AAAA,EACF;AAEA,EAAA,OAAA,CAAQ,KAAK,oBAAA,EAAsB;AAAA,IACjC,KAAK,YAAA,CAAc,GAAA;AAAA,IACnB,KAAK,YAAA,CAAc,GAAA;AAAA,IACnB,GAAA,EAAK;AAAA,GACN,CAAA;AAMD,EAAA,IAAI,aAAc,GAAA,EAAK;AACrB,IAAA,KAAA,MAAW,CAAC,QAAQ,QAAQ,CAAA,IAAK,OAAO,OAAA,CAAQ,YAAA,CAAc,GAAG,CAAA,EAAG;AAClE,MAAA,IAAI,aAAa,MAAA,EAAW;AAC1B,QAAA,MAAM,OAAA,GAAU,IAAA,CAAK,SAAA,CAAU,QAAQ,CAAA;AACvC,QAAA,IAAI,OAAA,CAAQ,MAAA,GAAS,MAAA,CAAO,MAAA,CAAO,mBAAA,EAAqB;AACtD,UAAA,OAAA,CAAQ,IAAA,CAAK,qBAAqB,8BAAA,EAAgC;AAAA,YAChE,SAAA,EAAW,MAAA;AAAA,YACX,MAAM,OAAA,CAAQ,MAAA;AAAA,YACd,KAAA,EAAO,OAAO,MAAA,CAAO;AAAA,WACtB,CAAA;AACD,UAAA,OAAA,CAAQ,OAAA,CAAQ,qBAAA,EAAuB,gBAAA,EAAkB,GAAG,CAAA;AAC5D,UAAA,OAAO;AAAA,YACL,KAAA,EAAO,KAAA;AAAA,YACP,MAAA,EAAQ,cAAc,OAAA,CAAQ,YAAA,GAAe,KAAA,EAAM,GAAI,QAAQ,KAAA;AAAM,WACvE;AAAA,QACF;AAAA,MACF;AAAA,IACF;AAAA,EACF;AAEA,EAAA,OAAA,CAAQ,KAAK,mBAAmB,CAAA;AAKhC,EAAA,OAAA,CAAQ,OAAA,CAAQ,kBAAkB,GAAI,CAAA;AAItC,EAAA,MAAM,iBAAA,GAAoB,SAAA,KAAc,aAAA,GAAgB,QAAA,GAAW,YAAA;AACnE,EAAA,OAAA,CAAQ,WAAA,CAAY,qBAAqB,iBAAiB,CAAA;AAE1D,EAAA,IAAI,aAAA,EAAe;AACjB,IAAA,OAAA,CAAQ,WAAA,CAAY,yBAAyB,aAAa,CAAA;AAAA,EAC5D;AAIA,EAAA,IAAI,YAAA,EAAc;AAChB,IAAA,MAAM,aAAA,GAAgB,MAAMW,SAAAA,CAAU,YAAY,CAAA;AAClD,IAAA,OAAA,CAAQ,WAAA,CAAY,oBAAA,EAAsB,YAAA,CAAa,aAAa,CAAC,CAAA;AAAA,EACvE;AAEA,EAAA,MAAM,MAAA,GAAS,cAAc,OAAA,CAAQ,YAAA,GAAe,KAAA,EAAM,GAAI,QAAQ,KAAA,EAAM;AAE5E,EAAA,OAAO;AAAA,IACL,KAAA,EAAO,IAAA;AAAA,IACP,MAAA;AAAA,IACA,MAAA,EAAQ;AAAA,GACV;AACF;;;ACrhBO,SAAS,mBACd,WAAA,EACkD;AAElD,EAAA,IAAI,WAAA,KAAgB,MAAA,IAAa,WAAA,KAAgB,EAAA,EAAI;AACnD,IAAA,OAAO;AAAA,MACL,EAAA,EAAI,KAAA;AAAA,MACJ,MAAA,EAAQ,mBAAA;AAAA,MACR,SAAA,EAAW,4BAAA;AAAA,MACX,OAAA,EAAS;AAAA,KACX;AAAA,EACF;AAGA,EAAA,IAAI,KAAA,CAAM,OAAA,CAAQ,WAAW,CAAA,EAAG;AAC9B,IAAA,OAAO;AAAA,MACL,EAAA,EAAI,KAAA;AAAA,MACJ,MAAA,EAAQ,mBAAA;AAAA,MACR,SAAA,EAAW,4BAAA;AAAA,MACX,OAAA,EAAS;AAAA,KACX;AAAA,EACF;AAGA,EAAA,IAAI,WAAA,CAAY,QAAA,CAAS,GAAG,CAAA,EAAG;AAG7B,IAAA,MAAM,KAAA,GAAQ,WAAA,CAAY,KAAA,CAAM,GAAG,CAAA;AACnC,IAAA,IAAI,KAAA,CAAM,MAAA,KAAW,CAAA,IAAK,KAAA,CAAM,IAAA,CAAK,CAAC,CAAA,KAAM,CAAA,CAAE,QAAA,CAAS,GAAG,CAAC,CAAA,EAAG;AAC5D,MAAA,OAAO;AAAA,QACL,EAAA,EAAI,KAAA;AAAA,QACJ,MAAA,EAAQ,mBAAA;AAAA,QACR,SAAA,EAAW,4BAAA;AAAA,QACX,OAAA,EAAS;AAAA,OACX;AAAA,IACF;AAAA,EACF;AAGA,EAAA,MAAM,QAAA,GAAW,WAAA,CAAY,KAAA,CAAM,GAAG,CAAA;AACtC,EAAA,IAAI,QAAA,CAAS,WAAW,CAAA,EAAG;AACzB,IAAA,OAAO;AAAA,MACL,EAAA,EAAI,KAAA;AAAA,MACJ,MAAA,EAAQ,mBAAA;AAAA,MACR,SAAA,EAAW,4BAAA;AAAA,MACX,OAAA,EAAS,CAAA,4DAAA,EAA+D,QAAA,CAAS,MAAM,CAAA;AAAA,KACzF;AAAA,EACF;AAGA,EAAA,MAAM,cAAA,GAAiB,kBAAA;AACvB,EAAA,KAAA,IAAS,CAAA,GAAI,CAAA,EAAG,CAAA,GAAI,QAAA,CAAS,QAAQ,CAAA,EAAA,EAAK;AACxC,IAAA,MAAM,OAAA,GAAU,SAAS,CAAC,CAAA;AAC1B,IAAA,IAAI,OAAA,CAAQ,WAAW,CAAA,EAAG;AACxB,MAAA,OAAO;AAAA,QACL,EAAA,EAAI,KAAA;AAAA,QACJ,MAAA,EAAQ,mBAAA;AAAA,QACR,SAAA,EAAW,4BAAA;AAAA,QACX,OAAA,EAAS,CAAA,2CAAA,EAA8C,CAAA,GAAI,CAAC,CAAA,SAAA;AAAA,OAC9D;AAAA,IACF;AACA,IAAA,IAAI,CAAC,cAAA,CAAe,IAAA,CAAK,OAAO,CAAA,EAAG;AACjC,MAAA,OAAO;AAAA,QACL,EAAA,EAAI,KAAA;AAAA,QACJ,MAAA,EAAQ,mBAAA;AAAA,QACR,SAAA,EAAW,4BAAA;AAAA,QACX,OAAA,EAAS,CAAA,2CAAA,EAA8C,CAAA,GAAI,CAAC,CAAA,4BAAA;AAAA,OAC9D;AAAA,IACF;AAAA,EACF;AAEA,EAAA,OAAO;AAAA,IACL,EAAA,EAAI,IAAA;AAAA,IACJ,MAAA,EAAQ;AAAA,MACN,OAAA,EAAS,QAAA;AAAA,MACT,OAAA,EAAS;AAAA;AACX,GACF;AACF;AAmBO,SAAS,oBACd,WAAA,EACmD;AAEnD,EAAA,IAAI,WAAA,KAAgB,MAAA,IAAa,WAAA,KAAgB,EAAA,EAAI;AACnD,IAAA,OAAO;AAAA,MACL,EAAA,EAAI,KAAA;AAAA,MACJ,MAAA,EAAQ,mBAAA;AAAA,MACR,SAAA,EAAW,4BAAA;AAAA,MACX,OAAA,EAAS;AAAA,KACX;AAAA,EACF;AAGA,EAAA,IAAI,KAAA,CAAM,OAAA,CAAQ,WAAW,CAAA,EAAG;AAC9B,IAAA,OAAO;AAAA,MACL,EAAA,EAAI,KAAA;AAAA,MACJ,MAAA,EAAQ,mBAAA;AAAA,MACR,SAAA,EAAW,4BAAA;AAAA,MACX,OAAA,EAAS;AAAA,KACX;AAAA,EACF;AAMA,EAAA,MAAM,WAAA,GAAc,sBAAsB,WAAW,CAAA;AAGrD,EAAA,IAAI,WAAA,CAAY,UAAA,CAAW,MAAA,GAAS,CAAA,EAAG;AACrC,IAAA,OAAO;AAAA,MACL,EAAA,EAAI,KAAA;AAAA,MACJ,MAAA,EAAQ,mBAAA;AAAA,MACR,SAAA,EAAW,4BAAA;AAAA,MACX,OAAA,EAAS,CAAA,8CAAA,EAAiD,WAAA,CAAY,UAAA,CAAW,CAAC,CAAC,CAAA;AAAA,KACrF;AAAA,EACF;AAIA,EAAA,MAAM,+BAAe,IAAI,GAAA,CAAI,CAAC,QAAA,EAAU,KAAK,CAAC,CAAA;AAC9C,EAAA,MAAM,WAAA,GAAc,WAAA,CAAY,IAAA,CAAK,MAAA,CAAO,CAAC,CAAA,KAAM,CAAC,YAAA,CAAa,GAAA,CAAI,CAAC,CAAA,IAAK,CAAC,CAAA,CAAE,UAAA,CAAW,MAAM,CAAC,CAAA;AAChG,EAAA,IAAI,WAAA,CAAY,SAAS,CAAA,EAAG;AAC1B,IAAA,OAAO;AAAA,MACL,EAAA,EAAI,KAAA;AAAA,MACJ,MAAA,EAAQ,mBAAA;AAAA,MACR,SAAA,EAAW,4BAAA;AAAA,MACX,OAAA,EAAS,CAAA,4CAAA,EAA+C,WAAA,CAAY,CAAC,CAAC,CAAA;AAAA,KACxE;AAAA,EACF;AAEA,EAAA,MAAM,SAAS,WAAA,CAAY,MAAA;AAE3B,EAAA,IAAI,CAAC,OAAO,MAAA,EAAQ;AAClB,IAAA,OAAO;AAAA,MACL,EAAA,EAAI,KAAA;AAAA,MACJ,MAAA,EAAQ,mBAAA;AAAA,MACR,SAAA,EAAW,4BAAA;AAAA,MACX,OAAA,EAAS;AAAA,KACX;AAAA,EACF;AAEA,EAAA,IAAI,CAAC,OAAO,GAAA,EAAK;AACf,IAAA,OAAO;AAAA,MACL,EAAA,EAAI,KAAA;AAAA,MACJ,MAAA,EAAQ,mBAAA;AAAA,MACR,SAAA,EAAW,4BAAA;AAAA,MACX,OAAA,EAAS;AAAA,KACX;AAAA,EACF;AAGA,EAAA,MAAM,QAAA,GAAW,gBAAA;AACjB,EAAA,IAAI,CAAC,QAAA,CAAS,IAAA,CAAK,MAAA,CAAO,MAAM,CAAA,EAAG;AACjC,IAAA,OAAO;AAAA,MACL,EAAA,EAAI,KAAA;AAAA,MACJ,MAAA,EAAQ,mBAAA;AAAA,MACR,SAAA,EAAW,4BAAA;AAAA,MACX,OAAA,EAAS;AAAA,KACX;AAAA,EACF;AAGA,EAAA,IAAI;AACF,IAAA,MAAM,GAAA,GAAM,IAAI,GAAA,CAAI,MAAA,CAAO,GAAG,CAAA;AAC9B,IAAA,IAAI,GAAA,CAAI,aAAa,QAAA,EAAU;AAC7B,MAAA,OAAO;AAAA,QACL,EAAA,EAAI,KAAA;AAAA,QACJ,MAAA,EAAQ,uBAAA;AAAA,QACR,SAAA,EAAW,gCAAA;AAAA,QACX,OAAA,EAAS;AAAA,OACX;AAAA,IACF;AAAA,EACF,CAAA,CAAA,MAAQ;AACN,IAAA,OAAO;AAAA,MACL,EAAA,EAAI,KAAA;AAAA,MACJ,MAAA,EAAQ,mBAAA;AAAA,MACR,SAAA,EAAW,4BAAA;AAAA,MACX,OAAA,EAAS;AAAA,KACX;AAAA,EACF;AAGA,EAAA,MAAM,aAAqC,EAAC;AAC5C,EAAA,KAAA,MAAW,GAAA,IAAO,YAAY,IAAA,EAAM;AAClC,IAAA,IAAI,GAAA,CAAI,UAAA,CAAW,MAAM,CAAA,EAAG;AAC1B,MAAA,UAAA,CAAW,GAAG,CAAA,GAAI,MAAA,CAAO,GAAG,CAAA;AAAA,IAC9B;AAAA,EACF;AAEA,EAAA,OAAO;AAAA,IACL,EAAA,EAAI,IAAA;AAAA,IACJ,MAAA,EAAQ;AAAA,MACN,OAAA,EAAS,SAAA;AAAA,MACT,SAAA,EAAW,QAAA;AAAA,MACX,aAAa,MAAA,CAAO,MAAA;AAAA,MACpB,KAAK,MAAA,CAAO,GAAA;AAAA,MACZ,GAAI,OAAO,IAAA,CAAK,UAAU,EAAE,MAAA,GAAS,CAAA,IAAK,EAAE,UAAA;AAAW;AACzD,GACF;AACF;AAuBA,SAAS,sBAAsB,KAAA,EAAsC;AACnE,EAAA,MAAM,SAAiC,EAAC;AACxC,EAAA,MAAM,aAAuB,EAAC;AAC9B,EAAA,MAAM,OAAiB,EAAC;AAExB,EAAA,IAAI,CAAA,GAAI,CAAA;AACR,EAAA,MAAM,MAAM,KAAA,CAAM,MAAA;AAElB,EAAA,OAAO,IAAI,GAAA,EAAK;AAEd,IAAA,OAAO,CAAA,GAAI,GAAA,KAAQ,KAAA,CAAM,CAAC,CAAA,KAAM,GAAA,IAAO,KAAA,CAAM,CAAC,CAAA,KAAM,GAAA,IAAO,KAAA,CAAM,CAAC,MAAM,GAAA,CAAA,EAAO;AAC7E,MAAA,CAAA,EAAA;AAAA,IACF;AACA,IAAA,IAAI,KAAK,GAAA,EAAK;AAGd,IAAA,MAAM,QAAA,GAAW,CAAA;AACjB,IAAA,OAAO,IAAI,GAAA,IAAO,IAAA,CAAK,KAAK,KAAA,CAAM,CAAC,CAAC,CAAA,EAAG;AACrC,MAAA,CAAA,EAAA;AAAA,IACF;AACA,IAAA,MAAM,GAAA,GAAM,KAAA,CAAM,KAAA,CAAM,QAAA,EAAU,CAAC,CAAA;AACnC,IAAA,IAAI,CAAC,GAAA,EAAK;AAGV,IAAA,OAAO,CAAA,GAAI,GAAA,IAAO,KAAA,CAAM,CAAC,MAAM,GAAA,EAAK,CAAA,EAAA;AAGpC,IAAA,IAAI,CAAA,IAAK,GAAA,IAAO,KAAA,CAAM,CAAC,MAAM,GAAA,EAAK;AAClC,IAAA,CAAA,EAAA;AAGA,IAAA,OAAO,CAAA,GAAI,GAAA,IAAO,KAAA,CAAM,CAAC,MAAM,GAAA,EAAK,CAAA,EAAA;AAGpC,IAAA,IAAI,KAAA;AACJ,IAAA,IAAI,KAAA,CAAM,CAAC,CAAA,KAAM,GAAA,EAAK;AAEpB,MAAA,CAAA,EAAA;AACA,MAAA,MAAM,UAAA,GAAa,CAAA;AACnB,MAAA,OAAO,CAAA,GAAI,GAAA,IAAO,KAAA,CAAM,CAAC,MAAM,GAAA,EAAK;AAClC,QAAA,CAAA,EAAA;AAAA,MACF;AACA,MAAA,KAAA,GAAQ,KAAA,CAAM,KAAA,CAAM,UAAA,EAAY,CAAC,CAAA;AACjC,MAAA,IAAI,IAAI,GAAA,EAAK,CAAA,EAAA;AAAA,IACf,CAAA,MAAO;AAEL,MAAA,MAAM,UAAA,GAAa,CAAA;AACnB,MAAA,OAAO,CAAA,GAAI,GAAA,IAAO,KAAA,CAAM,CAAC,CAAA,KAAM,GAAA,IAAO,KAAA,CAAM,CAAC,CAAA,KAAM,GAAA,IAAO,KAAA,CAAM,CAAC,MAAM,GAAA,EAAM;AAC3E,QAAA,CAAA,EAAA;AAAA,MACF;AACA,MAAA,KAAA,GAAQ,KAAA,CAAM,KAAA,CAAM,UAAA,EAAY,CAAC,CAAA;AAAA,IACnC;AAEA,IAAA,IAAA,CAAK,KAAK,GAAG,CAAA;AAGb,IAAA,IAAI,OAAO,MAAA,EAAQ;AACjB,MAAA,UAAA,CAAW,KAAK,GAAG,CAAA;AAAA,IACrB;AAEA,IAAA,MAAA,CAAO,GAAG,CAAA,GAAI,KAAA;AAAA,EAChB;AAEA,EAAA,OAAO,EAAE,MAAA,EAAQ,UAAA,EAAY,IAAA,EAAK;AACpC;AAgBO,SAAS,iBAAiB,IAAA,EAA+D;AAC9F,EAAA,IAAI,IAAA,KAAS,IAAA,IAAQ,OAAO,IAAA,KAAS,QAAA,EAAU;AAC7C,IAAA,OAAO;AAAA,MACL,EAAA,EAAI,KAAA;AAAA,MACJ,MAAA,EAAQ,mBAAA;AAAA,MACR,SAAA,EAAW,4BAAA;AAAA,MACX,OAAA,EAAS;AAAA,KACX;AAAA,EACF;AAEA,EAAA,MAAM,GAAA,GAAM,IAAA;AAGZ,EAAA,IAAI,mBAAmB,GAAA,EAAK;AAC1B,IAAA,IAAI,CAAC,KAAA,CAAM,OAAA,CAAQ,GAAA,CAAI,aAAa,CAAA,EAAG;AACrC,MAAA,OAAO;AAAA,QACL,EAAA,EAAI,KAAA;AAAA,QACJ,MAAA,EAAQ,mBAAA;AAAA,QACR,SAAA,EAAW,4BAAA;AAAA,QACX,OAAA,EAAS;AAAA,OACX;AAAA,IACF;AAEA,IAAA,MAAM,WAAqB,EAAC;AAC5B,IAAA,KAAA,IAAS,IAAI,CAAA,EAAG,CAAA,GAAI,GAAA,CAAI,aAAA,CAAc,QAAQ,CAAA,EAAA,EAAK;AACjD,MAAA,MAAM,OAAA,GAAU,GAAA,CAAI,aAAA,CAAc,CAAC,CAAA;AACnC,MAAA,IAAI,OAAO,YAAY,QAAA,EAAU;AAC/B,QAAA,OAAO;AAAA,UACL,EAAA,EAAI,KAAA;AAAA,UACJ,MAAA,EAAQ,mBAAA;AAAA,UACR,SAAA,EAAW,4BAAA;AAAA,UACX,OAAA,EAAS,iBAAiB,CAAC,CAAA,kBAAA;AAAA,SAC7B;AAAA,MACF;AACA,MAAA,QAAA,CAAS,KAAK,OAAO,CAAA;AAAA,IACvB;AAEA,IAAA,IAAI,QAAA,CAAS,WAAW,CAAA,EAAG;AACzB,MAAA,OAAO;AAAA,QACL,EAAA,EAAI,KAAA;AAAA,QACJ,MAAA,EAAQ,mBAAA;AAAA,QACR,SAAA,EAAW,4BAAA;AAAA,QACX,OAAA,EAAS;AAAA,OACX;AAAA,IACF;AAEA,IAAA,OAAO;AAAA,MACL,EAAA,EAAI,IAAA;AAAA,MACJ,MAAA,EAAQ;AAAA,QACN,OAAA,EAAS,MAAA;AAAA,QACT;AAAA;AACF,KACF;AAAA,EACF;AAGA,EAAA,IAAI,kBAAkB,GAAA,EAAK;AACzB,IAAA,IAAI,OAAO,GAAA,CAAI,YAAA,KAAiB,QAAA,EAAU;AACxC,MAAA,OAAO;AAAA,QACL,EAAA,EAAI,KAAA;AAAA,QACJ,MAAA,EAAQ,mBAAA;AAAA,QACR,SAAA,EAAW,4BAAA;AAAA,QACX,OAAA,EAAS;AAAA,OACX;AAAA,IACF;AAEA,IAAA,IAAI,GAAA,CAAI,YAAA,CAAa,MAAA,KAAW,CAAA,EAAG;AACjC,MAAA,OAAO;AAAA,QACL,EAAA,EAAI,KAAA;AAAA,QACJ,MAAA,EAAQ,mBAAA;AAAA,QACR,SAAA,EAAW,4BAAA;AAAA,QACX,OAAA,EAAS;AAAA,OACX;AAAA,IACF;AAEA,IAAA,OAAO;AAAA,MACL,EAAA,EAAI,IAAA;AAAA,MACJ,MAAA,EAAQ;AAAA,QACN,OAAA,EAAS,MAAA;AAAA,QACT,QAAA,EAAU,CAAC,GAAA,CAAI,YAAY;AAAA;AAC7B,KACF;AAAA,EACF;AAEA,EAAA,OAAO;AAAA,IACL,EAAA,EAAI,KAAA;AAAA,IACJ,MAAA,EAAQ,mBAAA;AAAA,IACR,SAAA,EAAW,4BAAA;AAAA,IACX,OAAA,EAAS;AAAA,GACX;AACF;AAYO,SAAS,sBAAsB,OAAA,EAGN;AAC9B,EAAA,MAAM,cAAc,OAAA,CAAQ,OAAA,CAAQ,cAAc,CAAA,IAAK,OAAA,CAAQ,QAAQ,cAAc,CAAA;AACrF,EAAA,MAAM,cACJ,OAAA,CAAQ,OAAA,CAAQ,sBAAsB,CAAA,IAAK,OAAA,CAAQ,QAAQ,sBAAsB,CAAA;AAGnF,EAAA,IAAI,gBAAgB,MAAA,EAAW;AAC7B,IAAA,OAAO,mBAAmB,WAAW,CAAA;AAAA,EACvC;AAGA,EAAA,IAAI,gBAAgB,MAAA,EAAW;AAC7B,IAAA,OAAO,oBAAoB,WAAW,CAAA;AAAA,EACxC;AAGA,EAAA,IAAI,OAAA,CAAQ,SAAS,MAAA,EAAW;AAC9B,IAAA,OAAO,gBAAA,CAAiB,QAAQ,IAAI,CAAA;AAAA,EACtC;AAEA,EAAA,OAAO;AAAA,IACL,EAAA,EAAI,KAAA;AAAA,IACJ,MAAA,EAAQ,mBAAA;AAAA,IACR,SAAA,EAAW,4BAAA;AAAA,IACX,OAAA,EACE;AAAA,GACJ;AACF;ACjdA,SAAS,aAAa,SAAA,EAA8C;AAClE,EAAA,MAAM,SAAS,SAAA,CAAU,MAAA;AAEzB,EAAA,QAAQ,MAAA;AAAQ,IACd,KAAK,WAAA;AAAA,IACL,KAAK,YAAA;AAAA,IACL,KAAK,UAAA;AAAA,IACL,KAAK,YAAA;AAAA,IACL,KAAK,aAAA;AAAA,IACL,KAAK,uBAAA;AACH,MAAA,OAAO;AAAA,QACL,EAAA,EAAI,KAAA;AAAA,QACJ,MAAA,EAAQ,uBAAA;AAAA,QACR,SAAA,EAAW,gCAAA;AAAA,QACX,SAAS,SAAA,CAAU;AAAA,OACrB;AAAA,IAEF,KAAK,SAAA;AACH,MAAA,OAAO;AAAA,QACL,EAAA,EAAI,KAAA;AAAA,QACJ,MAAA,EAAQ,uBAAA;AAAA,QACR,SAAA,EAAW,gCAAA;AAAA,QACX,SAAS,SAAA,CAAU;AAAA,OACrB;AAAA,IAEF,KAAK,oBAAA;AACH,MAAA,OAAO;AAAA,QACL,EAAA,EAAI,KAAA;AAAA,QACJ,MAAA,EAAQ,yBAAA;AAAA,QACR,SAAA,EAAW,kCAAA;AAAA,QACX,SAAS,SAAA,CAAU;AAAA,OACrB;AAAA,IAEF;AACE,MAAA,OAAO;AAAA,QACL,EAAA,EAAI,KAAA;AAAA,QACJ,MAAA,EAAQ,sBAAA;AAAA,QACR,SAAA,EAAW,+BAAA;AAAA,QACX,SAAS,SAAA,CAAU;AAAA,OACrB;AAAA;AAEN;AAkBA,eAAsB,uBACpB,OAAA,EAC6B;AAC7B,EAAA,MAAM,EAAE,GAAA,EAAK,cAAA,EAAgB,YAAA,GAAe,IAAG,GAAI,OAAA;AAGnD,EAAA,MAAM,QAAA,GAAW,gBAAA;AACjB,EAAA,IAAI,CAAC,QAAA,CAAS,IAAA,CAAK,cAAc,CAAA,EAAG;AAClC,IAAA,OAAO;AAAA,MACL,EAAA,EAAI,KAAA;AAAA,MACJ,MAAA,EAAQ,sBAAA;AAAA,MACR,SAAA,EAAW,+BAAA;AAAA,MACX,OAAA,EAAS;AAAA,KACX;AAAA,EACF;AAGA,EAAA,IAAI;AACF,IAAA,MAAM,SAAA,GAAY,IAAI,GAAA,CAAI,GAAG,CAAA;AAC7B,IAAA,IAAI,SAAA,CAAU,aAAa,QAAA,EAAU;AACnC,MAAA,OAAO;AAAA,QACL,EAAA,EAAI,KAAA;AAAA,QACJ,MAAA,EAAQ,uBAAA;AAAA,QACR,SAAA,EAAW,gCAAA;AAAA,QACX,OAAA,EAAS;AAAA,OACX;AAAA,IACF;AAAA,EACF,CAAA,CAAA,MAAQ;AACN,IAAA,OAAO;AAAA,MACL,EAAA,EAAI,KAAA;AAAA,MACJ,MAAA,EAAQ,sBAAA;AAAA,MACR,SAAA,EAAW,+BAAA;AAAA,MACX,OAAA,EAAS;AAAA,KACX;AAAA,EACF;AAMA,EAAA,MAAM,WAAA,GAAc,MAAM,aAAA,CAAc,GAAA,EAAK;AAAA,IAC3C,GAAG,YAAA;AAAA,IACH,UAAUb,eAAAA,CAAgB,eAAA;AAAA,IAC1B,cAAA,EAAgB,KAAA;AAAA;AAAA,IAChB,SAAA,EAAW,YAAA,EAAc,SAAA,IAAaA,eAAAA,CAAgB,cAAA;AAAA,IACtD,OAAA,EAAS;AAAA,MACP,MAAA,EAAQ,gDAAA;AAAA,MACR,GAAG,YAAA,CAAa;AAAA;AAClB,GACD,CAAA;AAED,EAAA,IAAI,CAAC,YAAY,EAAA,EAAI;AACnB,IAAA,OAAO,aAAa,WAAW,CAAA;AAAA,EACjC;AAEA,EAAA,MAAM,UAAU,WAAA,CAAY,IAAA;AAI5B,EAAA,MAAM,cAAc,WAAA,CAAY,WAAA;AAChC,EAAA,MAAM,oBAAA,GAAuB,CAAC,kBAAA,EAAoB,kBAAA,EAAoB,YAAY,CAAA;AAClF,EAAA,MAAM,kBAAA,GACJ,WAAA,IAAe,CAAC,oBAAA,CAAqB,KAAK,CAAC,QAAA,KAAa,WAAA,CAAY,UAAA,CAAW,QAAQ,CAAC,CAAA,GACpF,CAAA,yBAAA,EAA4B,WAAW,CAAA,4DAAA,CAAA,GACvC,MAAA;AAGN,EAAA,IAAI,CAAC,OAAA,IAAW,OAAA,CAAQ,IAAA,EAAK,CAAE,WAAW,CAAA,EAAG;AAC3C,IAAA,OAAO;AAAA,MACL,EAAA,EAAI,KAAA;AAAA,MACJ,MAAA,EAAQ,mBAAA;AAAA,MACR,SAAA,EAAW,4BAAA;AAAA,MACX,OAAA,EAAS;AAAA,KACX;AAAA,EACF;AAGA,EAAA,MAAM,aAAA,GAAgB,4BAA4B,OAAO,CAAA;AACzD,EAAA,IAAI,CAAC,cAAc,KAAA,EAAO;AACxB,IAAA,OAAO;AAAA,MACL,EAAA,EAAI,KAAA;AAAA,MACJ,MAAA,EAAQ,mBAAA;AAAA,MACR,SAAA,EAAW,4BAAA;AAAA,MACX,SAAS,aAAA,CAAc;AAAA,KACzB;AAAA,EACF;AAGA,EAAA,MAAM,YAAA,GAAe,MAAMa,SAAAA,CAAU,OAAO,CAAA;AAG5C,EAAA,IAAI,iBAAiB,cAAA,EAAgB;AACnC,IAAA,OAAO;AAAA,MACL,EAAA,EAAI,KAAA;AAAA,MACJ,MAAA,EAAQ,yBAAA;AAAA,MACR,SAAA,EAAW,kCAAA;AAAA,MACX,OAAA,EAAS,uDAAA;AAAA,MACT,YAAA;AAAA,MACA;AAAA,KACF;AAAA,EACF;AAEA,EAAA,OAAO;AAAA,IACL,EAAA,EAAI,IAAA;AAAA,IACJ,OAAA;AAAA,IACA,YAAA;AAAA,IACA,aAAA,EAAe,IAAA;AAAA,IACf,aAAa,WAAA,CAAY,WAAA;AAAA,IACzB,GAAI,kBAAA,IAAsB,EAAE,kBAAA;AAAmB,GACjD;AACF;AAUA,SAAS,4BACP,KAAA,EACqD;AACrD,EAAA,MAAM,QAAA,GAAW,KAAA,CAAM,KAAA,CAAM,GAAG,CAAA;AAEhC,EAAA,IAAI,QAAA,CAAS,WAAW,CAAA,EAAG;AACzB,IAAA,OAAO;AAAA,MACL,KAAA,EAAO,KAAA;AAAA,MACP,OAAA,EAAS,CAAA,4DAAA,EAA+D,QAAA,CAAS,MAAM,CAAA;AAAA,KACzF;AAAA,EACF;AAGA,EAAA,MAAM,cAAA,GAAiB,kBAAA;AAEvB,EAAA,KAAA,IAAS,CAAA,GAAI,CAAA,EAAG,CAAA,GAAI,QAAA,CAAS,QAAQ,CAAA,EAAA,EAAK;AACxC,IAAA,MAAM,OAAA,GAAU,SAAS,CAAC,CAAA;AAC1B,IAAA,IAAI,OAAA,CAAQ,WAAW,CAAA,EAAG;AACxB,MAAA,OAAO;AAAA,QACL,KAAA,EAAO,KAAA;AAAA,QACP,OAAA,EAAS,CAAA,2CAAA,EAA8C,CAAA,GAAI,CAAC,CAAA,SAAA;AAAA,OAC9D;AAAA,IACF;AACA,IAAA,IAAI,CAAC,cAAA,CAAe,IAAA,CAAK,OAAO,CAAA,EAAG;AACjC,MAAA,OAAO;AAAA,QACL,KAAA,EAAO,KAAA;AAAA,QACP,OAAA,EAAS,CAAA,2CAAA,EAA8C,CAAA,GAAI,CAAC,CAAA,4BAAA;AAAA,OAC9D;AAAA,IACF;AAAA,EACF;AAEA,EAAA,OAAO,EAAE,OAAO,IAAA,EAAK;AACvB;AAOA,SAAS,mBAAmB,KAAA,EAAuC;AACjE,EAAA,MAAM,SAAiC,EAAC;AACxC,EAAA,IAAI,CAAA,GAAI,CAAA;AACR,EAAA,MAAM,MAAM,KAAA,CAAM,MAAA;AAElB,EAAA,OAAO,IAAI,GAAA,EAAK;AAEd,IAAA,OAAO,CAAA,GAAI,GAAA,KAAQ,KAAA,CAAM,CAAC,CAAA,KAAM,GAAA,IAAO,KAAA,CAAM,CAAC,CAAA,KAAM,GAAA,IAAO,KAAA,CAAM,CAAC,MAAM,GAAA,CAAA,EAAO;AAC7E,MAAA,CAAA,EAAA;AAAA,IACF;AACA,IAAA,IAAI,KAAK,GAAA,EAAK;AAGd,IAAA,MAAM,QAAA,GAAW,CAAA;AACjB,IAAA,OAAO,IAAI,GAAA,IAAO,IAAA,CAAK,KAAK,KAAA,CAAM,CAAC,CAAC,CAAA,EAAG;AACrC,MAAA,CAAA,EAAA;AAAA,IACF;AACA,IAAA,MAAM,GAAA,GAAM,KAAA,CAAM,KAAA,CAAM,QAAA,EAAU,CAAC,CAAA;AACnC,IAAA,IAAI,CAAC,GAAA,EAAK;AAGV,IAAA,OAAO,CAAA,GAAI,GAAA,IAAO,KAAA,CAAM,CAAC,MAAM,GAAA,EAAK,CAAA,EAAA;AAGpC,IAAA,IAAI,CAAA,IAAK,GAAA,IAAO,KAAA,CAAM,CAAC,MAAM,GAAA,EAAK;AAClC,IAAA,CAAA,EAAA;AAGA,IAAA,OAAO,CAAA,GAAI,GAAA,IAAO,KAAA,CAAM,CAAC,MAAM,GAAA,EAAK,CAAA,EAAA;AAGpC,IAAA,IAAI,KAAA;AACJ,IAAA,IAAI,KAAA,CAAM,CAAC,CAAA,KAAM,GAAA,EAAK;AAEpB,MAAA,CAAA,EAAA;AACA,MAAA,MAAM,UAAA,GAAa,CAAA;AACnB,MAAA,OAAO,CAAA,GAAI,GAAA,IAAO,KAAA,CAAM,CAAC,MAAM,GAAA,EAAK;AAClC,QAAA,CAAA,EAAA;AAAA,MACF;AACA,MAAA,KAAA,GAAQ,KAAA,CAAM,KAAA,CAAM,UAAA,EAAY,CAAC,CAAA;AACjC,MAAA,IAAI,IAAI,GAAA,EAAK,CAAA,EAAA;AAAA,IACf,CAAA,MAAO;AAEL,MAAA,MAAM,UAAA,GAAa,CAAA;AACnB,MAAA,OAAO,CAAA,GAAI,GAAA,IAAO,KAAA,CAAM,CAAC,CAAA,KAAM,GAAA,IAAO,KAAA,CAAM,CAAC,CAAA,KAAM,GAAA,IAAO,KAAA,CAAM,CAAC,MAAM,GAAA,EAAM;AAC3E,QAAA,CAAA,EAAA;AAAA,MACF;AACA,MAAA,KAAA,GAAQ,KAAA,CAAM,KAAA,CAAM,UAAA,EAAY,CAAC,CAAA;AAAA,IACnC;AAEA,IAAA,MAAA,CAAO,GAAG,CAAA,GAAI,KAAA;AAAA,EAChB;AAEA,EAAA,OAAO,MAAA;AACT;AAWA,eAAsB,qBAAA,CACpB,eACA,YAAA,EAC6B;AAI7B,EAAA,MAAM,MAAA,GAAS,mBAAmB,aAAa,CAAA;AAE/C,EAAA,IAAI,CAAC,OAAO,MAAA,EAAQ;AAClB,IAAA,OAAO;AAAA,MACL,EAAA,EAAI,KAAA;AAAA,MACJ,MAAA,EAAQ,sBAAA;AAAA,MACR,SAAA,EAAW,+BAAA;AAAA,MACX,OAAA,EAAS;AAAA,KACX;AAAA,EACF;AAEA,EAAA,IAAI,CAAC,OAAO,GAAA,EAAK;AACf,IAAA,OAAO;AAAA,MACL,EAAA,EAAI,KAAA;AAAA,MACJ,MAAA,EAAQ,sBAAA;AAAA,MACR,SAAA,EAAW,+BAAA;AAAA,MACX,OAAA,EAAS;AAAA,KACX;AAAA,EACF;AAEA,EAAA,OAAO,sBAAA,CAAuB;AAAA,IAC5B,KAAK,MAAA,CAAO,GAAA;AAAA,IACZ,gBAAgB,MAAA,CAAO,MAAA;AAAA,IACvB;AAAA,GACD,CAAA;AACH;;;AC1XA,IAAM,8BAAA,GAAiC,GAAA;AAEvC,IAAM,mBAAA,GAAsB,GAAA;AA+B5B,SAAS,WAAA,CAAY,OAAe,IAAA,EAAsB;AAIxD,EAAA,IAAI,CAAC,MAAA,CAAO,aAAA,CAAc,KAAK,CAAA,EAAG;AAChC,IAAA,MAAM,IAAI,KAAA,CAAM,CAAA,mBAAA,EAAsB,IAAI,CAAA,uBAAA,CAAyB,CAAA;AAAA,EACrE;AACA,EAAA,OAAO,KAAA;AACT;AAEA,SAAS,WAAA,CAAY,OAAe,IAAA,EAAsB;AACxD,EAAA,WAAA,CAAY,OAAO,IAAI,CAAA;AACvB,EAAA,IAAI,SAAS,CAAA,EAAG;AACd,IAAA,MAAM,IAAI,KAAA,CAAM,CAAA,mBAAA,EAAsB,IAAI,CAAA,2BAAA,CAA6B,CAAA;AAAA,EACzE;AACA,EAAA,OAAO,KAAA;AACT;AAEA,SAAS,cAAA,CAAe,OAAe,IAAA,EAAsB;AAC3D,EAAA,WAAA,CAAY,OAAO,IAAI,CAAA;AACvB,EAAA,IAAI,QAAQ,CAAA,EAAG;AACb,IAAA,MAAM,IAAI,KAAA,CAAM,CAAA,mBAAA,EAAsB,IAAI,CAAA,+BAAA,CAAiC,CAAA;AAAA,EAC7E;AACA,EAAA,OAAO,KAAA;AACT;AAEA,SAAS,cAAA,CAAe,OAAe,IAAA,EAAsB;AAC3D,EAAA,IAAI,OAAO,KAAA,KAAU,QAAA,IAAY,KAAA,CAAM,WAAW,CAAA,EAAG;AACnD,IAAA,MAAM,IAAI,KAAA,CAAM,CAAA,mBAAA,EAAsB,IAAI,CAAA,2BAAA,CAA6B,CAAA;AAAA,EACzE;AACA,EAAA,OAAO,KAAA;AACT;AAQO,SAAS,kBAAkB,OAAA,EAA0C;AAC1E,EAAA,MAAM,aAAA,GAAgB,WAAA,CAAY,OAAA,CAAQ,aAAA,EAAe,eAAe,CAAA;AACxE,EAAA,MAAM,mBAAA,GACJ,QAAQ,mBAAA,KAAwB,MAAA,GAC5B,iCACA,cAAA,CAAe,OAAA,CAAQ,qBAAqB,qBAAqB,CAAA;AACvE,EAAA,MAAM,UAAA,GACJ,QAAQ,UAAA,KAAe,MAAA,GACnB,sBACA,WAAA,CAAY,OAAA,CAAQ,YAAY,YAAY,CAAA;AAClD,EAAA,MAAM,GAAA,GAAM,QAAQ,GAAA,KAAQ,MAAM,KAAK,KAAA,CAAM,IAAA,CAAK,GAAA,EAAI,GAAI,GAAI,CAAA,CAAA;AAK9D,EAAA,IAAI,UAAU,MAAA,CAAO,iBAAA;AACrB,EAAA,MAAM,aAAa,MAAc;AAC/B,IAAA,MAAM,GAAA,GAAM,WAAA,CAAY,GAAA,EAAI,EAAG,OAAO,CAAA;AACtC,IAAA,IAAI,GAAA,GAAM,SAAS,OAAO,OAAA;AAC1B,IAAA,OAAA,GAAU,GAAA;AACV,IAAA,OAAO,GAAA;AAAA,EACT,CAAA;AAOA,EAAA,MAAM,IAAA,uBAAW,GAAA,EAAyB;AAG1C,EAAA,MAAM,KAAA,GAAQ,CAAC,GAAA,EAAa,GAAA,KAAwB,CAAA,EAAG,GAAA,CAAI,MAAM,CAAA,CAAA,EAAI,GAAG,CAAA,EAAG,GAAA,CAAI,MAAM,IAAI,GAAG,CAAA,CAAA;AAE5F,EAAA,MAAM,YAAA,GAAe,CAAC,UAAA,KAA6B;AACjD,IAAA,KAAA,MAAW,CAAC,GAAA,EAAK,KAAK,CAAA,IAAK,IAAA,EAAM;AAC/B,MAAA,IAAI,KAAA,CAAM,YAAY,UAAA,EAAY;AAClC,MAAA,IAAA,CAAK,OAAO,GAAG,CAAA;AAAA,IACjB;AAAA,EACF,CAAA;AAEA,EAAA,OAAO;AAAA,IACL,MAAM,MAAA,EAAuE;AAG3E,MAAA,MAAM,GAAA,GAAM,WAAA,CAAY,MAAA,CAAO,GAAA,EAAK,YAAY,CAAA;AAChD,MAAA,MAAM,GAAA,GAAM,cAAA,CAAe,MAAA,CAAO,GAAA,EAAK,YAAY,CAAA;AACnD,MAAA,MAAM,GAAA,GAAM,cAAA,CAAe,MAAA,CAAO,GAAA,EAAK,YAAY,CAAA;AACnD,MAAA,MAAM,IAAI,UAAA,EAAW;AAGrB,MAAA,YAAA,CAAa,CAAC,CAAA;AAId,MAAA,IAAI,GAAA,GAAM,CAAA,GAAI,aAAA,IAAiB,GAAA,GAAM,IAAI,mBAAA,EAAqB;AAC5D,QAAA,OAAO,gBAAA;AAAA,MACT;AAEA,MAAA,MAAM,GAAA,GAAM,KAAA,CAAM,GAAA,EAAK,GAAG,CAAA;AAC1B,MAAA,IAAI,IAAA,CAAK,GAAA,CAAI,GAAG,CAAA,EAAG;AACjB,QAAA,OAAO,UAAA;AAAA,MACT;AASA,MAAA,MAAM,SAAA,GAAY,WAAA,CAAY,CAAA,GAAI,aAAA,GAAgB,qBAAqB,cAAc,CAAA;AAGrF,MAAA,IAAI,IAAA,CAAK,QAAQ,UAAA,EAAY;AAC3B,QAAA,MAAM,MAAA,GAAS,IAAA,CAAK,IAAA,EAAK,CAAE,MAAK,CAAE,KAAA;AAClC,QAAA,IAAI,MAAA,KAAW,MAAA,EAAW,IAAA,CAAK,MAAA,CAAO,MAAM,CAAA;AAAA,MAC9C;AACA,MAAA,IAAA,CAAK,GAAA,CAAI,GAAA,EAAK,EAAE,SAAA,EAAW,CAAA;AAC3B,MAAA,OAAO,OAAA;AAAA,IACT;AAAA,GACF;AACF","file":"index.mjs","sourcesContent":["/**\n * Internal codec strategy types.\n *\n * @internal\n *\n * These types MUST NOT be re-exported from packages/protocol/src/index.ts.\n * The dist-leak gate (Tier 2) asserts that these names never appear in\n * @peac/protocol's public root declaration (dist/index.d.ts) or any\n * subpath in @peac/protocol/package.json `exports`.\n *\n * The canonical implementation of these types lives at\n * packages/protocol/src/_internal/record-core/codec/jws-jwt.ts and is\n * imported via RELATIVE paths from issue.ts / verify-local.ts.\n */\n\nimport type { VerifyResult } from '@peac/crypto';\n\n/**\n * Header view returned by codec.peekHeader().\n *\n * @internal\n */\nexport interface CodecHeader {\n /** JOSE typ value. Required at peek time; not defaulted. */\n readonly typ: string;\n /** Algorithm identifier. JWS string (e.g., 'EdDSA'). */\n readonly alg: string;\n /** Key identifier (when present). */\n readonly kid?: string;\n /** Full raw protected-header object for downstream policy inspection. */\n readonly raw: Readonly<Record<string, unknown>>;\n}\n\n/**\n * Codec error with a structured code.\n *\n * @internal\n */\nexport class CodecError extends Error {\n constructor(\n public readonly code: string,\n message: string\n ) {\n super(message);\n this.name = 'CodecError';\n }\n}\n\n/**\n * Internal codec strategy. v0.13.1 ships exactly one implementation:\n * jws-jwt. Signature mirrors @peac/crypto.signWire02 / verify exactly;\n * concrete Uint8Array keys (Ed25519 at this layer); parametric only on\n * the optional payload type T of VerifyResult<T>. Future codecs with\n * different key shapes register a different interface; they MAY NOT\n * shoehorn into this interface via parametric generics.\n *\n * @internal\n */\nexport interface RecordCodec {\n /** Codec name. Used for registry lookup. */\n readonly name: string;\n\n /**\n * Sign and serialize. Pure pass-through to the underlying signer; never\n * accepts a typ override (the signer hardcodes typ per the wire format).\n */\n encode(payload: unknown, privateKey: Uint8Array, kid: string): Promise<string>;\n\n /**\n * Verify and decode. Returns the underlying crypto verifier's result\n * unchanged. Throws structured CodecError on malformed input;\n * propagates the underlying CryptoError on signature mismatch.\n */\n decode<T = unknown>(serialized: string, publicKey: Uint8Array): Promise<VerifyResult<T>>;\n\n /**\n * Header-only decode. Structural strictness only: throws CodecError on\n * missing typ, missing alg, malformed protected header JSON, or\n * malformed compact JWS (must be exactly three non-empty\n * dot-separated segments). Does NOT enforce policy on crit / zip /\n * b64 / unsupported alg; those rejections are downstream JOSE-hardening\n * responsibilities and are surfaced via the raw header for inspection.\n *\n * Note: this codec is JWS/JWT string-based. The `serialized` parameter\n * is typed as `string` for that reason. Future codecs that operate on\n * binary inputs (e.g., COSE/CBOR over `Uint8Array`) MUST register a\n * different interface; do not generalize this one to imply binary\n * support that the JWS codec does not provide.\n */\n peekHeader(serialized: string): CodecHeader;\n}\n","/**\n * Default codec: pure pass-through to @peac/crypto.signWire02 / verify.\n *\n * @internal\n *\n * Byte-identical encode output to signWire02 is guaranteed by the\n * golden-vector test (codec-jws-jwt-byte-identical.test.ts). Decode\n * returns the underlying cryptoVerify result unchanged.\n *\n * peekHeader is structural-only: it requires typ + alg presence and a\n * structurally valid compact JWS, but does NOT enforce policy on\n * unsupported alg, crit, zip, or b64:false. Those rejections are\n * downstream responsibilities (kernel constraints, JOSE hardening).\n *\n * The canonical implementation lives here. Tests import via relative\n * paths from packages/protocol/__tests__/_internal/.\n */\n\nimport {\n signWire02,\n verify as cryptoVerify,\n base64urlDecodeString,\n type VerifyResult,\n} from '@peac/crypto';\nimport { CodecError, type CodecHeader, type RecordCodec } from './types.js';\n\nclass JwsJwtCodec implements RecordCodec {\n readonly name = 'jws-jwt' as const;\n\n async encode(payload: unknown, privateKey: Uint8Array, kid: string): Promise<string> {\n return signWire02(payload, privateKey, kid);\n }\n\n async decode<T = unknown>(serialized: string, publicKey: Uint8Array): Promise<VerifyResult<T>> {\n return cryptoVerify<T>(serialized, publicKey);\n }\n\n peekHeader(serialized: string): CodecHeader {\n // Structural compact-JWS shape: exactly three non-empty\n // dot-separated segments: header.payload.signature.\n const segments = serialized.split('.');\n if (segments.length !== 3) {\n throw new CodecError(\n 'CODEC_PEEK_MALFORMED',\n `jws-jwt: malformed compact JWS (expected 3 segments, got ${segments.length})`\n );\n }\n const [headerB64, payloadB64, signatureB64] = segments;\n if (headerB64.length === 0) {\n throw new CodecError(\n 'CODEC_PEEK_MALFORMED',\n 'jws-jwt: malformed compact JWS (empty header segment)'\n );\n }\n if (payloadB64.length === 0) {\n throw new CodecError(\n 'CODEC_PEEK_MALFORMED',\n 'jws-jwt: malformed compact JWS (empty payload segment)'\n );\n }\n if (signatureB64.length === 0) {\n throw new CodecError(\n 'CODEC_PEEK_MALFORMED',\n 'jws-jwt: malformed compact JWS (empty signature segment)'\n );\n }\n\n let header: Record<string, unknown>;\n try {\n // Runtime-neutral base64url -> UTF-8 string decode\n // (TextDecoder + Uint8Array via @peac/crypto.base64urlDecodeString;\n // no Node Buffer dependency: works in browser, edge worker, Deno).\n const headerJson = base64urlDecodeString(headerB64);\n header = JSON.parse(headerJson) as Record<string, unknown>;\n } catch (err) {\n throw new CodecError(\n 'CODEC_PEEK_INVALID_HEADER',\n `jws-jwt: protected header JSON parse failed: ${(err as Error).message}`\n );\n }\n\n if (typeof header.typ !== 'string') {\n throw new CodecError(\n 'CODEC_PEEK_MISSING_TYP',\n 'jws-jwt: protected header missing required field \"typ\" (string)'\n );\n }\n if (typeof header.alg !== 'string') {\n throw new CodecError(\n 'CODEC_PEEK_MISSING_ALG',\n 'jws-jwt: protected header missing required field \"alg\" (string)'\n );\n }\n\n return {\n typ: header.typ,\n alg: header.alg,\n kid: typeof header.kid === 'string' ? header.kid : undefined,\n raw: header,\n };\n }\n}\n\n/**\n * Default codec instance. Internal-only.\n *\n * @internal\n */\nexport const defaultCodec: RecordCodec = new JwsJwtCodec();\n","/**\n * Bounded internal kernel-constraints validator.\n *\n * INTERNAL ONLY. This is the parity-observed counterpart of\n * @peac/schema.validateKernelConstraints; both implementations consume\n * the same KERNEL_CONSTRAINTS constants from @peac/kernel and emit the\n * same ConstraintValidationResult shape. The differential parity test\n * asserts byte-identical equality between the two on every eligible\n * fixture; any divergence is stop-the-line.\n *\n * Existing validation in @peac/schema remains canonical. This module\n * is observational only; it is NOT re-exported from\n * packages/protocol/src/index.ts and is NOT wired into runtime paths\n * (issue.ts, verify-local.ts) in v0.13.1.\n *\n * Implementation invariants (must mirror @peac/schema/src/constraints.ts\n * verbatim; any drift fails the parity test):\n * - iterative stack-based traversal (stack-safe; no recursion)\n * - every value (primitives, arrays, objects) is pushed and counted as\n * a node when popped\n * - total-nodes check evaluated FIRST per pop; over-limit pushes the\n * violation with the current totalNodes count and breaks (preserves\n * first-violation semantics)\n * - depth check evaluated SECOND per pop; over-limit pushes a\n * violation and continues (no-op for primitives, prevents deeper\n * descent for containers)\n * - string-length check (primitives only) uses .length (code units)\n * - array-length and object-key-count checks pushed BEFORE descending\n * into children\n * - children pushed in reverse index/key order so traversal visits\n * them in original order (LIFO)\n * - empty path for root; bracket notation for arrays (`a[0]`); dot\n * notation for object keys (`a.b`)\n * - returns { valid: violations.length === 0, violations }\n * - never throws\n * - assumes acyclic input\n */\n\nimport { KERNEL_CONSTRAINTS } from '@peac/schema';\nimport type { ConstraintValidationResult, ConstraintViolation } from '@peac/schema';\n\n/**\n * Validate claims against structural kernel constraints. Mirrors the\n * canonical implementation in @peac/schema for parity.\n *\n * Distinct exported name (validateKernelConstraintsInternal) to avoid\n * collision with the canonical @peac/schema export when both are\n * imported into the same parity test file.\n */\nexport function validateKernelConstraintsInternal(claims: unknown): ConstraintValidationResult {\n const violations: ConstraintViolation[] = [];\n\n if (claims === null || claims === undefined || typeof claims !== 'object') {\n return { valid: true, violations };\n }\n\n let totalNodes = 0;\n const stack: Array<{ value: unknown; depth: number; path: string }> = [\n { value: claims, depth: 0, path: '' },\n ];\n\n while (stack.length > 0) {\n const item = stack.pop()!;\n totalNodes++;\n\n if (totalNodes > KERNEL_CONSTRAINTS.MAX_TOTAL_NODES) {\n violations.push({\n constraint: 'MAX_TOTAL_NODES',\n actual: totalNodes,\n limit: KERNEL_CONSTRAINTS.MAX_TOTAL_NODES,\n path: item.path,\n });\n break;\n }\n\n if (item.depth > KERNEL_CONSTRAINTS.MAX_NESTED_DEPTH) {\n violations.push({\n constraint: 'MAX_NESTED_DEPTH',\n actual: item.depth,\n limit: KERNEL_CONSTRAINTS.MAX_NESTED_DEPTH,\n path: item.path,\n });\n continue;\n }\n\n if (item.value === null || typeof item.value !== 'object') {\n if (typeof item.value === 'string') {\n if (item.value.length > KERNEL_CONSTRAINTS.MAX_STRING_LENGTH) {\n violations.push({\n constraint: 'MAX_STRING_LENGTH',\n actual: item.value.length,\n limit: KERNEL_CONSTRAINTS.MAX_STRING_LENGTH,\n path: item.path,\n });\n }\n }\n continue;\n }\n\n if (Array.isArray(item.value)) {\n if (item.value.length > KERNEL_CONSTRAINTS.MAX_ARRAY_LENGTH) {\n violations.push({\n constraint: 'MAX_ARRAY_LENGTH',\n actual: item.value.length,\n limit: KERNEL_CONSTRAINTS.MAX_ARRAY_LENGTH,\n path: item.path,\n });\n }\n for (let i = item.value.length - 1; i >= 0; i--) {\n stack.push({\n value: item.value[i],\n depth: item.depth + 1,\n path: `${item.path}[${i}]`,\n });\n }\n continue;\n }\n\n const keys = Object.keys(item.value as Record<string, unknown>);\n if (keys.length > KERNEL_CONSTRAINTS.MAX_OBJECT_KEYS) {\n violations.push({\n constraint: 'MAX_OBJECT_KEYS',\n actual: keys.length,\n limit: KERNEL_CONSTRAINTS.MAX_OBJECT_KEYS,\n path: item.path,\n });\n }\n for (let i = keys.length - 1; i >= 0; i--) {\n const key = keys[i];\n const childPath = item.path ? `${item.path}.${key}` : key;\n stack.push({\n value: (item.value as Record<string, unknown>)[key],\n depth: item.depth + 1,\n path: childPath,\n });\n }\n }\n\n return { valid: violations.length === 0, violations };\n}\n","/**\n * Bounded internal type-extension mapping validator.\n *\n * INTERNAL ONLY. This is the parity-observed counterpart of the\n * type/extension warning-emission block at verify-local.ts:477-540\n * (interop strictness branch). Both implementations consume the same\n * registries (REGISTERED_RECEIPT_TYPES, REGISTERED_EXTENSION_GROUP_KEYS,\n * TYPE_TO_EXTENSION_MAP) and the same warning-code constants from\n * @peac/schema; behavioral parity is proven byte-equal by the parity\n * tests, not by code copy.\n *\n * Existing canonical emission in @peac/protocol/verifyLocal remains\n * canonical. This module is observational only; it is NOT re-exported\n * from packages/protocol/src/index.ts and is NOT wired into runtime\n * paths (issue.ts, verify-local.ts) in v0.13.1.\n *\n * Output shape: a deterministically-ordered list of warning records,\n * each carrying only `code` and `pointer`. The canonical emission also\n * carries a `message` field; messages are intentionally omitted from\n * the parity comparison because the missing/mismatch messages embed\n * claim values (claims.type and the expected extension group), and\n * comparison on (code, pointer) is what the verifier output API\n * actually exposes to consumers via the warning code/pointer pair.\n *\n * Emission order (must mirror verify-local.ts exactly; tests assert):\n * 1. type_unregistered (when claims.type is not in REGISTERED_RECEIPT_TYPES)\n * 2. unknown_extension_preserved (one per unknown-but-well-formed\n * extension key, in Object.keys iteration order)\n * 3. extension_group_missing OR extension_group_mismatch (when\n * checkTypeExtensionMapping returns missing/mismatch; not emitted\n * for kind === 'challenge' or for unmapped/custom types)\n */\n\nimport {\n REGISTERED_EXTENSION_GROUP_KEYS,\n REGISTERED_RECEIPT_TYPES,\n WARNING_EXTENSION_GROUP_MISMATCH,\n WARNING_EXTENSION_GROUP_MISSING,\n WARNING_TYPE_UNREGISTERED,\n WARNING_UNKNOWN_EXTENSION,\n isValidExtensionKey,\n} from '@peac/schema';\nimport { TYPE_TO_EXTENSION_MAP } from '@peac/kernel';\n\n/** Minimal claims shape required by the type-extension warning surface. */\nexport interface TypeExtensionMappingInput {\n readonly kind: string;\n readonly type: string;\n readonly extensions?: Record<string, unknown>;\n}\n\n/** Normalized warning entry. Comparison shape; canonical messages omitted. */\nexport interface TypeExtensionMappingWarning {\n readonly code: string;\n readonly pointer: string;\n}\n\n/** Escape `~` and `/` per RFC 6901 for JSON Pointer fragments. */\nfunction escapeJsonPointerSegment(segment: string): string {\n return segment.replace(/~/g, '~0').replace(/\\//g, '~1');\n}\n\n/**\n * Mirror of @peac/protocol/src/type-extension-check.ts:checkTypeExtensionMapping.\n * Returns a status discriminator only; the bounded validator decides whether\n * the discriminator translates to a warning code.\n */\nfunction classifyExpectedGroup(\n kind: string,\n type: string,\n extensions: Record<string, unknown> | undefined\n): 'ok' | 'skip' | 'missing' | 'mismatch' {\n if (kind === 'challenge') return 'skip';\n const expectedGroup = TYPE_TO_EXTENSION_MAP.get(type);\n if (expectedGroup === undefined) return 'skip';\n if (extensions !== undefined && Object.prototype.hasOwnProperty.call(extensions, expectedGroup)) {\n return 'ok';\n }\n if (extensions !== undefined) {\n for (const key of Object.keys(extensions)) {\n if (key !== expectedGroup && REGISTERED_EXTENSION_GROUP_KEYS.has(key)) {\n return 'mismatch';\n }\n }\n }\n return 'missing';\n}\n\n/**\n * Evaluate the type-extension mapping warning surface for parsed Wire 0.2\n * claims. Returns warnings in canonical emission order; emits no warnings\n * when the claims are fully registered and the expected extension group\n * is present (or when no expected group exists for the given type).\n */\nexport function validateTypeExtensionMappingInternal(\n input: TypeExtensionMappingInput\n): TypeExtensionMappingWarning[] {\n const warnings: TypeExtensionMappingWarning[] = [];\n\n // Step 1: type_unregistered\n if (!REGISTERED_RECEIPT_TYPES.has(input.type)) {\n warnings.push({ code: WARNING_TYPE_UNREGISTERED, pointer: '/type' });\n }\n\n // Step 2: unknown_extension_preserved (one per unknown well-formed key)\n if (input.extensions !== undefined) {\n for (const key of Object.keys(input.extensions)) {\n if (!REGISTERED_EXTENSION_GROUP_KEYS.has(key) && isValidExtensionKey(key)) {\n warnings.push({\n code: WARNING_UNKNOWN_EXTENSION,\n pointer: `/extensions/${escapeJsonPointerSegment(key)}`,\n });\n }\n }\n }\n\n // Step 3: extension_group_missing | extension_group_mismatch\n const status = classifyExpectedGroup(input.kind, input.type, input.extensions);\n if (status === 'missing') {\n warnings.push({ code: WARNING_EXTENSION_GROUP_MISSING, pointer: '/type' });\n } else if (status === 'mismatch') {\n warnings.push({ code: WARNING_EXTENSION_GROUP_MISMATCH, pointer: '/type' });\n }\n\n return warnings;\n}\n","/**\n * Bounded internal JOSE header hardening validator.\n *\n * INTERNAL ONLY. This is the parity-observed counterpart of\n * @peac/crypto.validateWire02Header. Both implementations consume the\n * same JOSE protected-header object and apply the same five hardening\n * checks in the same order; behavioral parity is proven byte-equal by\n * the parity tests, not by code copy.\n *\n * Existing canonical hardening in @peac/crypto remains canonical. This\n * module is observational only; it is NOT re-exported from\n * packages/protocol/src/index.ts and is NOT wired into runtime paths\n * (issue.ts, verify-local.ts, peekHeader) in v0.13.1.\n *\n * Scope (must mirror validateWire02Header in packages/crypto/src/jws.ts):\n *\n * 1. kid presence and length:\n * - missing kid (undefined / non-string / empty) -> CRYPTO_JWS_MISSING_KID\n * - kid malformed, or longer than 256 UTF-8 bytes -> CRYPTO_JWS_MISSING_KID\n *\n * 2. embedded key material (jwk, x5c, x5u, jku):\n * - any of the four set -> CRYPTO_JWS_EMBEDDED_KEY\n *\n * 3. crit header:\n * - any value (including null / empty array) -> CRYPTO_JWS_CRIT_REJECTED\n *\n * 4. b64: false (RFC 7797 unencoded payload):\n * - the only rejected value is the boolean false; other values pass through\n * - rejection -> CRYPTO_JWS_B64_REJECTED\n *\n * 5. zip header:\n * - any value -> CRYPTO_JWS_ZIP_REJECTED\n *\n * Out of scope for this module (mirroring validateWire02Header exactly):\n * - alg validation (lives in buildHeader, not validateWire02Header)\n * - typ validation (lives in buildHeader)\n * - signature verification\n * - compact-JWS shape / size checks\n *\n * Order is significant: the canonical function returns the FIRST\n * matching violation per call (it throws on the first hit). The\n * internal validator emits the same first-hit code.\n */\n\n/** Header input shape (matches the parsed JOSE protected header). */\nexport type JoseHardeningInput = Record<string, unknown>;\n\n/**\n * Normalized result. accepted=true means the header passes all five\n * hardening checks. accepted=false carries the canonical CryptoError\n * code emitted by the corresponding canonical check.\n */\nexport type JoseHardeningResult =\n | { readonly accepted: true }\n | { readonly accepted: false; readonly errorCode: string };\n\nconst KID_MAX_UTF8_BYTES = 256;\n\n/**\n * Independent implementation of the canonical kid rule.\n *\n * Deliberately NOT imported from @peac/crypto. This module observes the canonical validator's\n * behaviour from a separate implementation, and sharing the predicate would make the parity tests\n * compare a function with itself.\n *\n * The rule: a non-empty, well-formed Unicode string whose UTF-8 serialization is at most 256 bytes.\n * Length is measured in UTF-8 bytes because that is what bounds the serialized protected header;\n * counting UTF-16 code units admits a 256-unit astral kid (128 code points) that serializes to 512\n * bytes. Lone surrogates are rejected rather than silently replaced with U+FFFD during encoding,\n * which would change the supplied identifier; a header carrying one is refused by the I-JSON gate\n * regardless.\n */\nfunction isAcceptableKid(kid: unknown): kid is string {\n if (typeof kid !== 'string' || kid.length === 0) return false;\n let bytes = 0;\n for (let i = 0; i < kid.length; i++) {\n const c = kid.charCodeAt(i);\n if (c < 0x80) bytes += 1;\n else if (c < 0x800) bytes += 2;\n else if (c >= 0xd800 && c <= 0xdbff) {\n const next = i + 1 < kid.length ? kid.charCodeAt(i + 1) : 0;\n if (next < 0xdc00 || next > 0xdfff) return false;\n bytes += 4;\n i++;\n } else if (c >= 0xdc00 && c <= 0xdfff) {\n return false;\n } else bytes += 3;\n if (bytes > KID_MAX_UTF8_BYTES) return false;\n }\n return true;\n}\n\nconst ACCEPTED: JoseHardeningResult = { accepted: true } as const;\n\nfunction rejected(errorCode: string): JoseHardeningResult {\n return { accepted: false, errorCode };\n}\n\nexport function validateJoseHardeningInternal(header: JoseHardeningInput): JoseHardeningResult {\n // 1. kid presence and validity\n if (!isAcceptableKid(header.kid)) {\n return rejected('CRYPTO_JWS_MISSING_KID');\n }\n\n // 2. embedded key material\n if (\n header.jwk !== undefined ||\n header.x5c !== undefined ||\n header.x5u !== undefined ||\n header.jku !== undefined\n ) {\n return rejected('CRYPTO_JWS_EMBEDDED_KEY');\n }\n\n // 3. crit\n if (header.crit !== undefined) {\n return rejected('CRYPTO_JWS_CRIT_REJECTED');\n }\n\n // 4. b64: false (RFC 7797 unencoded payload)\n if (header.b64 === false) {\n return rejected('CRYPTO_JWS_B64_REJECTED');\n }\n\n // 5. zip\n if (header.zip !== undefined) {\n return rejected('CRYPTO_JWS_ZIP_REJECTED');\n }\n\n return ACCEPTED;\n}\n","/**\n * Bounded internal issuer-form validator.\n *\n * INTERNAL ONLY. This is the parity-observed counterpart of\n * @peac/schema.isCanonicalIss (referenced by Wire 0.2's CanonicalIssSchema\n * and by issue.ts pre-sign validation). Both implementations consume the\n * same ISS_CANONICAL.maxLength constant from @peac/kernel and apply the\n * same accept/reject rules in the same order; behavioral parity is proven\n * byte-equal by the parity tests, not by code copy.\n *\n * Existing canonical isCanonicalIss in @peac/schema remains canonical.\n * This module is observational only; it is NOT re-exported from\n * packages/protocol/src/index.ts and is NOT wired into runtime paths\n * (issue.ts, verify-local.ts) in v0.13.1.\n *\n * Scope (must mirror isCanonicalIss in packages/schema/src/wire-02-envelope.ts):\n *\n * 1. Type and length:\n * - Non-string iss -> rejected\n * - Empty string -> rejected\n * - Length > ISS_CANONICAL.maxLength (2048) -> rejected\n *\n * 2. did: branch (checked before URL parsing because did: is a valid\n * URL scheme in some parsers):\n * - Pattern: ^did:[a-z0-9]+:[^#?/]+$\n * - Method: lowercase letters and digits only, non-empty\n * - Method-specific-id: non-empty, no '/', '?', or '#'\n *\n * 3. https:// branch (URL-constructor based):\n * - new URL(iss) must succeed\n * - url.protocol === 'https:'\n * - Non-empty url.hostname\n * - No userinfo (url.username and url.password both empty)\n * - iss must equal the canonical reconstructed origin\n * ('https://${url.host}'). This rejects:\n * - uppercase host (URL spec lowercases hostname)\n * - explicit default port (:443 is dropped from url.host)\n * - trailing slash, path, query, fragment, userinfo\n * - raw Unicode hostname (URL emits punycode in url.host)\n *\n * 4. All other schemes -> rejected with E_ISS_NOT_CANONICAL.\n */\n\nimport { ISS_CANONICAL } from '@peac/kernel';\n\n/**\n * Normalized result. accepted=true means iss is in canonical form.\n * accepted=false carries the canonical error code E_ISS_NOT_CANONICAL.\n *\n * The canonical surface emits a single error code for any rejection;\n * no path field is attached, so the comparison is on (accepted, errorCode)\n * only.\n */\nexport type IssuerFormResult =\n | { readonly accepted: true }\n | { readonly accepted: false; readonly errorCode: string };\n\nconst ACCEPTED: IssuerFormResult = { accepted: true } as const;\nconst REJECTED: IssuerFormResult = { accepted: false, errorCode: 'E_ISS_NOT_CANONICAL' } as const;\n\n/** did:<method>:<method-specific-id> grammar (mirrors canonical regex). */\nconst DID_PATTERN = /^did:[a-z0-9]+:[^#?/]+$/;\n\nexport function validateIssuerFormInternal(iss: unknown): IssuerFormResult {\n // 1. Type and length\n if (typeof iss !== 'string' || iss.length === 0 || iss.length > ISS_CANONICAL.maxLength) {\n return REJECTED;\n }\n\n // 2. did: branch (check before URL parsing)\n if (iss.startsWith('did:')) {\n return DID_PATTERN.test(iss) ? ACCEPTED : REJECTED;\n }\n\n // 3. https:// branch (URL-constructor based)\n let url: URL;\n try {\n url = new URL(iss);\n } catch {\n return REJECTED;\n }\n\n if (url.protocol !== 'https:') return REJECTED;\n if (!url.hostname) return REJECTED;\n if (url.username !== '' || url.password !== '') return REJECTED;\n\n const origin = `${url.protocol}//${url.host}`;\n return iss === origin ? ACCEPTED : REJECTED;\n}\n","/**\n * Bounded internal temporal validator (occurred_at skew only).\n *\n * INTERNAL ONLY. This is the parity-observed counterpart of\n * @peac/schema.checkOccurredAtSkew (referenced by verify-local.ts when\n * claims.kind === 'evidence'). Both implementations consume the same\n * OCCURRED_AT_TOLERANCE_SECONDS constant from @peac/kernel and apply\n * the same skew classification rules in the same order; behavioral\n * parity is proven byte-equal by the parity tests, not by code copy.\n *\n * Existing canonical checkOccurredAtSkew in @peac/schema remains\n * canonical. This module is observational only; it is NOT re-exported\n * from packages/protocol/src/index.ts and is NOT wired into runtime\n * paths (issue.ts, verify-local.ts) in v0.13.1.\n *\n * SCOPE (deliberately narrow):\n * - occurred_at canonical skew classification ONLY\n * - the iat-not-yet-valid check (`iat > now + maxClockSkew`) lives\n * inline at verify-local.ts:454 with no helper to import; wrapping\n * it would make LEFT and RIGHT identical 1-line predicates that\n * prove nothing, so it is explicitly deferred to a later step\n * (extraction first, parity second)\n *\n * Rules (must mirror checkOccurredAtSkew exactly; evidence-kind-only\n * is the caller's responsibility):\n * 1. occurredAt undefined -> accepted, no warning\n * 2. parse occurredAt as ISO/RFC 3339; if NaN -> accepted, no warning\n * (the parse failure surfaces from schema validation elsewhere)\n * 3. ts > now + tolerance -> rejected with E_OCCURRED_AT_FUTURE\n * 4. ts > iat (within tolerance) -> accepted with occurred_at_skew\n * warning at pointer /occurred_at\n * 5. ts <= iat -> accepted, no warning\n *\n * The injected `now` parameter is required; this module never reads\n * Date.now() so tests are deterministic.\n */\n\nimport { OCCURRED_AT_TOLERANCE_SECONDS } from '@peac/kernel';\n\nexport interface TemporalWarning {\n readonly code: string;\n readonly pointer?: string;\n}\n\nexport type TemporalResult =\n | { readonly accepted: true; readonly warnings?: readonly TemporalWarning[] }\n | { readonly accepted: false; readonly errorCode: string; readonly pointer?: string };\n\nconst ACCEPTED: TemporalResult = { accepted: true } as const;\n\nexport function validateTemporalInternal(\n occurredAt: string | undefined,\n iat: number,\n now: number,\n tolerance: number = OCCURRED_AT_TOLERANCE_SECONDS\n): TemporalResult {\n if (occurredAt === undefined) return ACCEPTED;\n\n const ts = Date.parse(occurredAt) / 1000;\n if (isNaN(ts)) return ACCEPTED;\n\n if (ts > now + tolerance) {\n return {\n accepted: false,\n errorCode: 'E_OCCURRED_AT_FUTURE',\n pointer: '/occurred_at',\n };\n }\n\n if (ts > iat) {\n return {\n accepted: true,\n warnings: [{ code: 'occurred_at_skew', pointer: '/occurred_at' }],\n };\n }\n\n return ACCEPTED;\n}\n","/**\n * Bounded internal extension-budget validator.\n *\n * INTERNAL ONLY. This is the parity-observed counterpart of the\n * byte-budget portion (steps 4 + 5) of validateKnownExtensions in\n * @peac/schema/src/wire-02-extensions/validation.ts. Both sides import\n * EXTENSION_BUDGET from @peac/kernel; behavioral parity is proven\n * byte-equal by the parity tests, not by code copy.\n *\n * Existing canonical validateKnownExtensions in @peac/schema remains\n * canonical. This module is observational only; it is NOT re-exported\n * from packages/protocol/src/index.ts and is NOT wired into runtime\n * paths (issue.ts, verify-local.ts) in v0.13.1.\n *\n * SCOPE (deliberately narrow):\n * - byte-budget enforcement on the extensions record only\n * - the other three steps in validateKnownExtensions (key grammar,\n * plain-JSON guard, typed extension schema parse) are NOT in\n * scope here; they belong to other parity work and would require\n * their own validators\n *\n * Measurement basis (must mirror canonical exactly):\n * - bytes = TextEncoder.encode(JSON.stringify(value)).byteLength\n * (UTF-8 byte length of ECMAScript JSON.stringify output)\n * - serialization failure (circular references, BigInt, etc.) yields\n * Infinity, which the comparison treats as over-budget\n *\n * Order of checks (must mirror canonical exactly):\n * 1. Total: jsonUtf8ByteLength(extensions) > maxTotalBytes\n * -> violation at path '/extensions'; EARLY STOP (no per-group)\n * 2. Per-group, in Object.keys(extensions) iteration order:\n * jsonUtf8ByteLength(extensions[key]) > maxGroupBytes\n * -> violation at path '/extensions/<escaped-key>'\n *\n * Comparison uses '>' (strictly greater than), so values exactly equal\n * to the limit are accepted.\n */\n\nimport { EXTENSION_BUDGET } from '@peac/kernel';\n\nexport interface ExtensionBudgetViolation {\n readonly code: string;\n readonly path: string;\n}\n\nexport interface ExtensionBudgetResult {\n readonly accepted: boolean;\n readonly violations: readonly ExtensionBudgetViolation[];\n}\n\nconst ACCEPTED: ExtensionBudgetResult = { accepted: true, violations: [] } as const;\nconst SIZE_EXCEEDED = 'E_EXTENSION_SIZE_EXCEEDED' as const;\n\nconst textEncoder = new TextEncoder();\n\n/**\n * UTF-8 byte length of JSON.stringify(value). Returns Infinity if\n * serialization fails (circular references, BigInt, etc.); callers\n * treat Infinity as over-budget.\n */\nfunction jsonUtf8ByteLength(value: unknown): number {\n try {\n return textEncoder.encode(JSON.stringify(value)).byteLength;\n } catch {\n return Infinity;\n }\n}\n\n/** RFC 6901 JSON pointer segment escape: '~' -> '~0', '/' -> '~1'. */\nfunction escapeJsonPointerSegment(segment: string): string {\n return segment.replace(/~/g, '~0').replace(/\\//g, '~1');\n}\n\nexport function validateExtensionBudgetInternal(\n extensions: Record<string, unknown> | undefined\n): ExtensionBudgetResult {\n if (extensions === undefined) return ACCEPTED;\n\n const totalBytes = jsonUtf8ByteLength(extensions);\n if (totalBytes > EXTENSION_BUDGET.maxTotalBytes) {\n // Early stop: canonical returns immediately after pushing the\n // total-budget violation; per-group checks are not reached.\n return {\n accepted: false,\n violations: [{ code: SIZE_EXCEEDED, path: '/extensions' }],\n };\n }\n\n const violations: ExtensionBudgetViolation[] = [];\n for (const key of Object.keys(extensions)) {\n const groupBytes = jsonUtf8ByteLength(extensions[key]);\n if (groupBytes > EXTENSION_BUDGET.maxGroupBytes) {\n violations.push({\n code: SIZE_EXCEEDED,\n path: `/extensions/${escapeJsonPointerSegment(key)}`,\n });\n }\n }\n\n if (violations.length === 0) return ACCEPTED;\n return { accepted: false, violations };\n}\n","/**\n * Bounded internal schema-parse validator.\n *\n * INTERNAL ONLY. Thin wrapper around the canonical\n * `parseReceiptClaims` from `@peac/schema`. Projects the canonical\n * accept/reject signal plus the full canonical projection (parsed\n * claims, parser warnings, canonical error triple) so production\n * callers can reproduce the canonical surface byte-equally without\n * re-invoking `parseReceiptClaims`.\n *\n * Module is internal-only; not re-exported from\n * `packages/protocol/src/index.ts`.\n *\n * SCOPE:\n * - Run `parseReceiptClaims(payload)` and surface its accept/reject.\n * - On acceptance: surface `wireVersion`, parsed `claims`, and\n * parser `warnings` (e.g., `type_unregistered`,\n * `unknown_extension_preserved`). Higher-layer aggregation merges\n * these into the caller's warning array.\n * - On rejection: surface the canonical error triple\n * (`errorCode`, `errorMessage`, `errorIssues`) so callers can\n * project the canonical `details: { parse_code, issues }` and\n * `message: 'Receipt schema validation failed: <message>'`\n * surface byte-equally.\n */\n\nimport type { ZodError } from 'zod';\nimport type { VerificationWarning } from '@peac/kernel';\nimport { parseReceiptClaims } from '@peac/schema';\nimport type { Wire02Claims } from '@peac/schema';\n\nexport interface SchemaParseResult {\n readonly accepted: boolean;\n /**\n * Canonical parse-error code from `parseReceiptClaims` when the\n * parse rejects. Mirrors `pr.error.code`.\n */\n readonly errorCode?: string;\n /**\n * Canonical parse-error message from `parseReceiptClaims` when the\n * parse rejects. Mirrors `pr.error.message`. Required for callers\n * that reproduce the canonical surface message\n * `Receipt schema validation failed: <message>` byte-equally.\n */\n readonly errorMessage?: string;\n /**\n * Canonical parse-error issues from `parseReceiptClaims` when the\n * parse rejects. Mirrors `pr.error.issues`. Callers downstream\n * apply their own bounded sanitization (path-join, length cap)\n * before surfacing on a public verifier-result `details` payload.\n */\n readonly errorIssues?: ZodError['issues'];\n /**\n * Parsed Wire 0.2 claims when accepted. Internal-only; does not\n * appear on any emitted record or public surface.\n */\n readonly claims?: Wire02Claims;\n /**\n * Wire version surfaced from `parseReceiptClaims` on acceptance.\n * The bounded surface only admits `'0.2'`; Wire 0.1 acceptance from\n * the canonical parser is rejected at this layer with\n * `E_UNSUPPORTED_WIRE_VERSION` because the bounded composition is\n * keyed on Wire 0.2 claim shapes.\n */\n readonly wireVersion?: '0.2';\n /**\n * Parser warnings surfaced on acceptance. Mirrors `pr.warnings` for\n * Wire 0.2 acceptance. Callers that aggregate into a single\n * canonical warning array merge this list at the canonical-equivalent\n * flow position before the canonical sort.\n */\n readonly warnings?: readonly VerificationWarning[];\n}\n\nexport function validateSchemaParseInternal(payload: unknown): SchemaParseResult {\n const pr = parseReceiptClaims(payload);\n if (!pr.ok) {\n return {\n accepted: false,\n errorCode: pr.error.code,\n errorMessage: pr.error.message,\n ...(pr.error.issues !== undefined && { errorIssues: pr.error.issues }),\n };\n }\n if (pr.wireVersion !== '0.2') {\n return {\n accepted: false,\n errorCode: 'E_UNSUPPORTED_WIRE_VERSION',\n errorMessage: `Unsupported wire version: ${pr.wireVersion}`,\n };\n }\n return {\n accepted: true,\n claims: pr.claims as Wire02Claims,\n wireVersion: '0.2',\n warnings: pr.warnings,\n };\n}\n","/**\n * Bounded internal JOSE typ-strictness validator.\n *\n * INTERNAL ONLY. Parity-observed counterpart of the typ-strictness\n * routing in `verify-local.ts` (the block that rejects a missing typ\n * under `'strict'` mode and surfaces a `typ_missing` warning under\n * `'interop'` mode). Both implementations consume the same protected-\n * header `typ` value plus a `strictness` parameter and apply the same\n * accept/reject/warning rules.\n *\n * Existing canonical strictness routing in `verify-local.ts` remains\n * canonical. This module is observational only; not re-exported and\n * not wired into the public runtime path.\n *\n * SCOPE:\n * - typ present (any string) -> accepted, no warning.\n * - typ absent (undefined or non-string) and strictness === 'strict'\n * -> rejected with E_INVALID_FORMAT.\n * - typ absent and strictness === 'interop' -> accepted with\n * typ_missing warning.\n *\n * Out of scope:\n * - typ value validation (`'interaction-record+jwt'` enforcement lives\n * in `@peac/crypto.validateWire02Header` / the JOSE-hardening layer).\n * - alg / kid / crit / b64 / zip checks (handled by `jose-hardening.ts`).\n */\n\nexport type Strictness = 'strict' | 'interop';\n\nexport interface JoseTypStrictnessWarning {\n readonly code: string;\n}\n\nexport type JoseTypStrictnessResult =\n | { readonly accepted: true; readonly warnings?: readonly JoseTypStrictnessWarning[] }\n | { readonly accepted: false; readonly errorCode: string };\n\nconst ACCEPTED_NO_WARN: JoseTypStrictnessResult = { accepted: true } as const;\nconst ACCEPTED_TYP_MISSING: JoseTypStrictnessResult = {\n accepted: true,\n warnings: [{ code: 'typ_missing' }],\n} as const;\nconst REJECTED_INVALID_FORMAT: JoseTypStrictnessResult = {\n accepted: false,\n errorCode: 'E_INVALID_FORMAT',\n} as const;\n\nexport function validateJoseTypStrictnessInternal(\n typ: unknown,\n strictness: Strictness\n): JoseTypStrictnessResult {\n const present = typeof typ === 'string' && typ.length > 0;\n if (present) return ACCEPTED_NO_WARN;\n if (strictness === 'strict') return REJECTED_INVALID_FORMAT;\n return ACCEPTED_TYP_MISSING;\n}\n","/**\n * Bounded internal iat-not-yet-valid validator.\n *\n * INTERNAL ONLY. Parity-observed counterpart of the inline iat-not-yet-valid\n * check in `verify-local.ts` (`if (claims.iat > now + maxClockSkew) ...`).\n * Both implementations consume the same `iat`, `now`, and `maxClockSkew`\n * inputs and apply the same comparison; behavioral parity is proven\n * byte-equal by the parity tests.\n *\n * Existing canonical iat handling in `verify-local.ts` remains canonical.\n * This module is observational only; it is not re-exported from\n * `packages/protocol/src/index.ts` and is not wired into the public\n * runtime path.\n *\n * SCOPE:\n * - Reject when `iat > now + maxClockSkew` (claim issued too far in the future).\n * - Accept when `iat <= now + maxClockSkew`.\n * - Never reads `Date.now()`; the caller injects `now` for determinism.\n *\n * Out of scope:\n * - `exp` / `nbf` checks (Wire 0.2 records do not expire and have no nbf).\n * - `occurred_at` skew (handled by `temporal.ts`).\n */\n\nexport interface IatNotYetValidResult {\n readonly accepted: boolean;\n readonly errorCode?: string;\n}\n\nconst ACCEPTED: IatNotYetValidResult = { accepted: true } as const;\nconst REJECTED: IatNotYetValidResult = {\n accepted: false,\n errorCode: 'E_NOT_YET_VALID',\n} as const;\n\nexport function validateIatNotYetValidInternal(\n iat: number,\n now: number,\n maxClockSkew: number\n): IatNotYetValidResult {\n if (iat > now + maxClockSkew) return REJECTED;\n return ACCEPTED;\n}\n","/**\n * Bounded internal policy-binding validator (canonical-composed).\n *\n * INTERNAL ONLY. Thin wrapper around `verifyPolicyBinding` from\n * `@peac/schema`. Surfaces the canonical three-state result\n * (`verified` / `failed` / `unavailable`) projected into the bounded\n * validator's accept/reject contract, where `failed` is the only\n * rejection.\n *\n * This is observational equivalence by construction, not a divergent\n * binding check. Module is observational only; not re-exported from\n * `packages/protocol/src/index.ts` and not wired into the public\n * runtime path.\n *\n * SCOPE:\n * - Both digests present and equal -> accepted (`verified`).\n * - Either digest absent -> accepted (`unavailable`); no policy\n * check is performed when the receipt or caller omits the digest.\n * - Both present but unequal -> rejected with E_POLICY_BINDING_FAILED.\n *\n * Out of scope:\n * - Policy-document fetch and digest computation (lives in\n * `verifyLocal()` / caller responsibility).\n * - Policy URI handling (`policy.uri` is informational only).\n */\n\nimport { verifyPolicyBinding } from '@peac/schema';\n\nexport interface PolicyBindingResult {\n readonly accepted: boolean;\n readonly errorCode?: string;\n /** 'verified' | 'failed' | 'unavailable'. Surfaced unchanged from canonical. */\n readonly status: 'verified' | 'failed' | 'unavailable';\n}\n\nexport function validatePolicyBindingInternal(\n receiptPolicyDigest: string | undefined,\n localPolicyDigest: string | undefined\n): PolicyBindingResult {\n if (receiptPolicyDigest === undefined || localPolicyDigest === undefined) {\n return { accepted: true, status: 'unavailable' };\n }\n const status = verifyPolicyBinding(receiptPolicyDigest, localPolicyDigest);\n if (status === 'failed') {\n return { accepted: false, errorCode: 'E_POLICY_BINDING_FAILED', status };\n }\n return { accepted: true, status };\n}\n","/**\n * Bounded internal unknown-extension-grammar validator (canonical-composed).\n *\n * INTERNAL ONLY. Thin wrapper around `isValidExtensionKey` and\n * `REGISTERED_EXTENSION_GROUP_KEYS` from `@peac/schema`. Identifies\n * unknown-but-well-formed extension keys and surfaces them as\n * non-blocking warnings, mirroring the canonical\n * `unknown_extension_preserved` warning emitted by `verifyLocal`.\n *\n * Malformed extension keys (failing `isValidExtensionKey`) are NOT\n * surfaced here as warnings; they are hard errors at the canonical\n * schema-parse layer (`E_INVALID_EXTENSION_KEY`) and therefore never\n * reach this layer on an accepted record.\n *\n * Module is observational only; not re-exported from\n * `packages/protocol/src/index.ts` and not wired into the public\n * runtime path.\n *\n * SCOPE:\n * - Walk `claims.extensions` keys.\n * - For every key that is well-formed but not registered, emit a\n * warning with code `unknown_extension_preserved` and an\n * RFC 6901 JSON-pointer-encoded path.\n * - Always accepted; this layer never rejects.\n *\n * Out of scope:\n * - Malformed-key rejection (canonical schema-parse owns this).\n * - Per-extension content validation (extension-specific schemas).\n */\n\nimport { REGISTERED_EXTENSION_GROUP_KEYS, isValidExtensionKey } from '@peac/schema';\n\nexport interface UnknownExtensionWarning {\n readonly code: string;\n readonly pointer: string;\n}\n\nexport interface UnknownExtensionGrammarResult {\n readonly accepted: true;\n readonly warnings: readonly UnknownExtensionWarning[];\n}\n\nconst ACCEPTED_EMPTY: UnknownExtensionGrammarResult = {\n accepted: true,\n warnings: [],\n} as const;\n\n/**\n * Encode a JSON-pointer reference token per RFC 6901: `~` -> `~0`,\n * `/` -> `~1`. Order matters: `~` must be replaced before `/`.\n */\nfunction escapeJsonPointer(token: string): string {\n return token.replace(/~/g, '~0').replace(/\\//g, '~1');\n}\n\nexport function validateUnknownExtensionGrammarInternal(\n extensions: Record<string, unknown> | undefined\n): UnknownExtensionGrammarResult {\n if (extensions === undefined) return ACCEPTED_EMPTY;\n const keys = Object.keys(extensions);\n if (keys.length === 0) return ACCEPTED_EMPTY;\n\n const warnings: UnknownExtensionWarning[] = [];\n for (const key of keys) {\n if (!REGISTERED_EXTENSION_GROUP_KEYS.has(key) && isValidExtensionKey(key)) {\n warnings.push({\n code: 'unknown_extension_preserved',\n pointer: `/extensions/${escapeJsonPointer(key)}`,\n });\n }\n }\n return { accepted: true, warnings };\n}\n","/**\n * Type-to-extension enforcement check (Layer 3)\n *\n * Pure helper: given a receipt kind, type, extensions record, and\n * registry data, determines whether the expected extension group is\n * present, absent, or replaced by a different registered group.\n *\n * This module has no side effects, no I/O, and no strictness logic.\n * Strictness (error vs warning) is decided by the caller (verifyLocal).\n *\n * Decision tree:\n * 1. challenge-kind receipt -> skip\n * 2. unmapped/custom type -> skip\n * 3. expected extension present -> ok\n * 4. expected absent + other registered present -> mismatch\n * 5. expected absent + none present -> missing\n *\n * Unknown third-party extension keys never count as mismatch.\n */\n\n/** Result of the type-to-extension mapping check */\nexport type TypeExtensionCheckResult =\n | { status: 'ok' }\n | { status: 'skip' }\n | {\n status: 'missing' | 'mismatch';\n expected_extension_group: string;\n present_registered_extension_groups: string[];\n };\n\n/**\n * Check whether a receipt's extensions match the expected extension\n * group for its registered type.\n *\n * Performance: O(1) lookup for the common ok/skip paths. Only iterates\n * extension keys when the expected group is absent (error path).\n *\n * @param kind - Receipt kind (evidence or challenge)\n * @param type - Receipt type value (e.g., org.peacprotocol/payment)\n * @param extensions - Extensions record from receipt claims (may be undefined)\n * @param typeToExtensionMap - Generated TYPE_TO_EXTENSION_MAP\n * @param registeredExtensionGroupKeys - Generated REGISTERED_EXTENSION_GROUP_KEYS set\n */\nexport function checkTypeExtensionMapping(\n kind: string,\n type: string,\n extensions: Record<string, unknown> | undefined,\n typeToExtensionMap: ReadonlyMap<string, string>,\n registeredExtensionGroupKeys: ReadonlySet<string>\n): TypeExtensionCheckResult {\n // Challenge-kind receipts skip: they indicate requirements, not evidence\n if (kind === 'challenge') {\n return { status: 'skip' };\n }\n\n const expectedGroup = typeToExtensionMap.get(type);\n\n // Unmapped/custom type: no check\n if (expectedGroup === undefined) {\n return { status: 'skip' };\n }\n\n // Expected group present: pass (O(1) check)\n if (extensions !== undefined && Object.prototype.hasOwnProperty.call(extensions, expectedGroup)) {\n return { status: 'ok' };\n }\n\n // Expected group absent: determine missing vs mismatch\n // Only build the present-registered list on this (uncommon) path\n const presentRegistered: string[] = [];\n if (extensions !== undefined) {\n for (const key of Object.keys(extensions)) {\n if (key !== expectedGroup && registeredExtensionGroupKeys.has(key)) {\n presentRegistered.push(key);\n }\n }\n }\n\n return {\n status: presentRegistered.length > 0 ? 'mismatch' : 'missing',\n expected_extension_group: expectedGroup,\n present_registered_extension_groups: presentRegistered,\n };\n}\n","/**\n * Bounded internal type-extension-enforcement validator (canonical-composed).\n *\n * INTERNAL ONLY. Thin wrapper around `checkTypeExtensionMapping` from\n * `@peac/protocol/src/type-extension-check` plus the strictness-mode\n * routing performed by `verifyLocal`. Surfaces the canonical mapping\n * result projected into the bounded validator's accept/reject and\n * warning contract.\n *\n * Distinct from `type-extension-mapping.ts` (warnings-only) in this\n * module's directory: this layer covers the strictness-mode path that\n * promotes `missing` and `mismatch` to hard errors when\n * `strictness === 'strict'`. Both layers consume the same canonical\n * mapping result; they differ only in how they project it.\n *\n * Module is observational only; not re-exported from\n * `packages/protocol/src/index.ts` and not wired into the public\n * runtime path.\n *\n * SCOPE:\n * - `skip` -> accepted, no warning, no error.\n * - `ok` -> accepted, no warning, no error.\n * - `missing` + strict -> rejected with E_EXTENSION_GROUP_REQUIRED.\n * - `mismatch` + strict -> rejected with E_EXTENSION_GROUP_MISMATCH.\n * - `missing` + interop -> accepted with extension_group_missing warning at /type.\n * - `mismatch` + interop -> accepted with extension_group_mismatch warning at /type.\n */\n\nimport { TYPE_TO_EXTENSION_MAP } from '@peac/kernel';\nimport { REGISTERED_EXTENSION_GROUP_KEYS } from '@peac/schema';\nimport { checkTypeExtensionMapping } from '../../../type-extension-check.js';\nimport type { Strictness } from './jose-typ-strictness.js';\n\nexport interface TypeExtensionEnforcementWarning {\n readonly code: string;\n readonly pointer: string;\n}\n\nexport type TypeExtensionEnforcementResult =\n | { readonly accepted: true; readonly warnings?: readonly TypeExtensionEnforcementWarning[] }\n | { readonly accepted: false; readonly errorCode: string; readonly pointer?: string };\n\nconst ACCEPTED_NO_WARN: TypeExtensionEnforcementResult = { accepted: true } as const;\n\nexport function validateTypeExtensionEnforcementInternal(\n kind: string,\n type: string,\n extensions: Record<string, unknown> | undefined,\n strictness: Strictness\n): TypeExtensionEnforcementResult {\n const result = checkTypeExtensionMapping(\n kind,\n type,\n extensions,\n TYPE_TO_EXTENSION_MAP,\n REGISTERED_EXTENSION_GROUP_KEYS\n );\n\n if (result.status === 'ok' || result.status === 'skip') {\n return ACCEPTED_NO_WARN;\n }\n\n if (strictness === 'strict') {\n const errorCode =\n result.status === 'missing' ? 'E_EXTENSION_GROUP_REQUIRED' : 'E_EXTENSION_GROUP_MISMATCH';\n return { accepted: false, errorCode, pointer: '/type' };\n }\n\n // interop mode: surface as warning, accept the record.\n const warningCode =\n result.status === 'missing' ? 'extension_group_missing' : 'extension_group_mismatch';\n return {\n accepted: true,\n warnings: [{ code: warningCode, pointer: '/type' }],\n };\n}\n","/**\n * Canonical-composed shadow validation: composition aggregator.\n *\n * INTERNAL ONLY. Composes layer validators into a single aggregated\n * result. Each layer either delegates to a canonical helper from\n * `@peac/schema` / `@peac/crypto` / `@peac/protocol` (canonical-\n * composed wrapper pattern) or mirrors a canonical inline check\n * verbatim. The canonical-vs-candidate differential test asserts\n * byte-equality of the candidate verdict with the canonical verdict\n * on every eligible fixture; any divergence indicates a defect in\n * the projection logic.\n *\n * Always-on layers (run on every input):\n * - kernel-constraints (depth / array / keys / string / nodes)\n * - issuer-form (canonical iss)\n * - type-extension-mapping (warnings only)\n * - extension-byte-budget\n * - unknown-extension-grammar (warnings only)\n *\n * Optional-input layers (skip when their inputs are absent):\n * - jose-header-hardening (header)\n * - temporal occurred_at skew (evidence kind)\n * - schema-parse (fullClaims)\n * - jose-typ-strictness (header + strictness)\n * - iat-not-yet-valid (maxClockSkew)\n * - policy-binding (receiptPolicyDigest + localPolicyDigest)\n * - type-extension-enforcement (strictness)\n *\n * Out of scope:\n * - signature verification (the standalone `validateSignatureInternal`\n * export is async and is not composed here; callers that need it\n * invoke it directly with serialized + publicKey)\n * - any control-plane behavior (issuer resolver, JWKS fetch, etc.)\n *\n * Public-facing wording for this module: \"canonical-composed shadow\n * validation\" or \"observational equivalence harness\". Never\n * \"complete validator\", \"primary validator\", or \"divergent validator\".\n */\n\nimport {\n validateExtensionBudgetInternal,\n validateIatNotYetValidInternal,\n validateIssuerFormInternal,\n validateJoseHardeningInternal,\n validateJoseTypStrictnessInternal,\n validateKernelConstraintsInternal,\n validatePolicyBindingInternal,\n validateSchemaParseInternal,\n validateTemporalInternal,\n validateTypeExtensionEnforcementInternal,\n validateTypeExtensionMappingInternal,\n validateUnknownExtensionGrammarInternal,\n type ExtensionBudgetViolation,\n type Strictness,\n type TemporalWarning,\n type TypeExtensionEnforcementWarning,\n type TypeExtensionMappingWarning,\n type UnknownExtensionWarning,\n} from './validators/index.js';\n\n/** Minimal claims shape required by the bounded subset. */\nexport interface BoundedClaimsInput {\n readonly kind: string;\n readonly type: string;\n readonly iss: unknown;\n readonly iat: number;\n readonly occurred_at?: string;\n readonly extensions?: Record<string, unknown>;\n}\n\n/** Optional JOSE header (from the JWS protected header). */\nexport type BoundedHeaderInput = Record<string, unknown> | undefined;\n\n/** Aggregated input to the bounded observation subset. */\nexport interface BoundedValidationInput {\n readonly claims: BoundedClaimsInput;\n readonly header?: BoundedHeaderInput;\n /** Fixed Unix-second clock for temporal evaluation; required. */\n readonly now: number;\n /**\n * Strictness profile for layers that promote warnings to errors\n * under `'strict'` mode. When omitted, layers that consume\n * strictness skip (they do not run). Mirrors the canonical\n * `verifyLocal({ strictness })` option.\n */\n readonly strictness?: Strictness;\n /**\n * Maximum permitted clock skew in seconds for the iat-not-yet-valid\n * check. When omitted, the iat layer skips. Mirrors\n * `verifyLocal({ maxClockSkew })`; canonical default is 300.\n */\n readonly maxClockSkew?: number;\n /**\n * Receipt-side policy digest (`claims.policy.digest`). Used together\n * with `localPolicyDigest` by the policy-binding layer. Either\n * absent skips the layer.\n */\n readonly receiptPolicyDigest?: string;\n /**\n * Caller-supplied policy digest. Used together with\n * `receiptPolicyDigest`. Either absent skips the layer.\n */\n readonly localPolicyDigest?: string;\n /**\n * Full receipt-claims object for the schema-parse layer. When\n * omitted, the schema-parse layer falls back to running on the\n * minimal `BoundedClaimsInput` projection (which may not surface\n * field-level parse errors that depend on optional fields outside\n * the bounded subset).\n */\n readonly fullClaims?: Record<string, unknown>;\n}\n\n/**\n * Layer tag identifies which underlying validator emitted each entry.\n * Useful for downstream filtering (e.g., a future shadow-mode reporter\n * that ignores warning-class entries from one layer but not another).\n */\nexport type BoundedLayer =\n | 'kernel-constraints'\n | 'type-extension-mapping'\n | 'jose-header-hardening'\n | 'issuer-form'\n | 'temporal'\n | 'extension-budget'\n | 'schema-parse'\n | 'jose-typ-strictness'\n | 'iat-not-yet-valid'\n | 'policy-binding'\n | 'unknown-extension-grammar'\n | 'type-extension-enforcement';\n\nexport interface BoundedViolation {\n readonly layer: BoundedLayer;\n readonly code: string;\n readonly path?: string;\n}\n\nexport interface BoundedWarning {\n readonly layer: BoundedLayer;\n readonly code: string;\n readonly path?: string;\n}\n\nexport interface BoundedValidationResult {\n /** True iff every in-scope layer accepted the input. */\n readonly accepted: boolean;\n readonly violations: readonly BoundedViolation[];\n readonly warnings: readonly BoundedWarning[];\n}\n\n/**\n * Run the bounded observation subset. Composes the six layer\n * validators in a stable order; aggregates violations and warnings\n * with explicit layer tags; never throws. Pure: same input always\n * yields the same result.\n */\nexport function runBoundedValidatorShadow(input: BoundedValidationInput): BoundedValidationResult {\n const violations: BoundedViolation[] = [];\n const warnings: BoundedWarning[] = [];\n\n // 1. Kernel constraints (depth / array / keys / string / nodes).\n const kernelRes = validateKernelConstraintsInternal(input.claims);\n if (!kernelRes.valid) {\n for (const v of kernelRes.violations) {\n violations.push({\n layer: 'kernel-constraints',\n code: v.constraint,\n path: v.path || undefined,\n });\n }\n }\n\n // 2. Issuer form (canonical iss).\n const issRes = validateIssuerFormInternal(input.claims.iss);\n if (!issRes.accepted) {\n violations.push({ layer: 'issuer-form', code: issRes.errorCode });\n }\n\n // 3. JOSE header hardening (only when a header is supplied).\n if (input.header !== undefined) {\n const joseRes = validateJoseHardeningInternal(input.header);\n if (!joseRes.accepted) {\n violations.push({ layer: 'jose-header-hardening', code: joseRes.errorCode });\n }\n }\n\n // 4. Type-extension mapping warnings.\n const typeExtWarnings: readonly TypeExtensionMappingWarning[] =\n validateTypeExtensionMappingInternal({\n kind: input.claims.kind,\n type: input.claims.type,\n extensions: input.claims.extensions,\n });\n for (const w of typeExtWarnings) {\n warnings.push({ layer: 'type-extension-mapping', code: w.code, path: w.pointer });\n }\n\n // 5. Temporal occurred_at skew (evidence-kind-only is the caller's\n // responsibility; we mirror the canonical behavior of treating\n // non-evidence kinds as a no-op by skipping the call).\n if (input.claims.kind === 'evidence') {\n const temporalRes = validateTemporalInternal(\n input.claims.occurred_at,\n input.claims.iat,\n input.now\n );\n if (!temporalRes.accepted) {\n violations.push({\n layer: 'temporal',\n code: temporalRes.errorCode,\n path: temporalRes.pointer,\n });\n } else if (temporalRes.warnings) {\n const list: readonly TemporalWarning[] = temporalRes.warnings;\n for (const w of list) {\n warnings.push({ layer: 'temporal', code: w.code, path: w.pointer });\n }\n }\n }\n\n // 6. Extension byte budget.\n const budgetRes = validateExtensionBudgetInternal(input.claims.extensions);\n if (!budgetRes.accepted) {\n const list: readonly ExtensionBudgetViolation[] = budgetRes.violations;\n for (const v of list) {\n violations.push({ layer: 'extension-budget', code: v.code, path: v.path });\n }\n }\n\n // 7. Schema-parse projection (canonical-composed; delegates to\n // parseReceiptClaims). Skips when `fullClaims` is not supplied;\n // `BoundedClaimsInput` is a 6-field subset and would never satisfy\n // the canonical Wire 0.2 schema. Callers that want the schema-parse\n // layer to fire MUST pass the full claims object via `fullClaims`.\n if (input.fullClaims !== undefined) {\n const schemaRes = validateSchemaParseInternal(input.fullClaims);\n if (!schemaRes.accepted && schemaRes.errorCode !== undefined) {\n violations.push({ layer: 'schema-parse', code: schemaRes.errorCode });\n }\n }\n\n // 8. JOSE typ-strictness (canonical-composed; mirrors verify-local\n // strictness routing). Skip when no header or no strictness\n // supplied; canonical surface only routes typ-missing under a\n // declared strictness.\n if (input.header !== undefined && input.strictness !== undefined) {\n const typRes = validateJoseTypStrictnessInternal(input.header.typ, input.strictness);\n if (!typRes.accepted) {\n violations.push({ layer: 'jose-typ-strictness', code: typRes.errorCode });\n } else if (typRes.warnings) {\n for (const w of typRes.warnings) {\n warnings.push({ layer: 'jose-typ-strictness', code: w.code });\n }\n }\n }\n\n // 9. iat-not-yet-valid (mirrors the inline verify-local check).\n // Skip when no maxClockSkew supplied; canonical surface only runs\n // this check inside verifyLocal where maxClockSkew is bound.\n if (input.maxClockSkew !== undefined) {\n const iatRes = validateIatNotYetValidInternal(input.claims.iat, input.now, input.maxClockSkew);\n if (!iatRes.accepted && iatRes.errorCode !== undefined) {\n violations.push({ layer: 'iat-not-yet-valid', code: iatRes.errorCode });\n }\n }\n\n // 10. Policy-binding (canonical-composed; delegates to\n // verifyPolicyBinding). The `unavailable` projection (either\n // digest absent) is accepted with no surfacing; only `failed`\n // produces a violation.\n if (input.receiptPolicyDigest !== undefined && input.localPolicyDigest !== undefined) {\n const policyRes = validatePolicyBindingInternal(\n input.receiptPolicyDigest,\n input.localPolicyDigest\n );\n if (!policyRes.accepted && policyRes.errorCode !== undefined) {\n violations.push({ layer: 'policy-binding', code: policyRes.errorCode });\n }\n }\n\n // 11. Unknown-extension grammar (canonical-composed; warnings only).\n const unknownExtRes = validateUnknownExtensionGrammarInternal(input.claims.extensions);\n for (const w of unknownExtRes.warnings as readonly UnknownExtensionWarning[]) {\n warnings.push({\n layer: 'unknown-extension-grammar',\n code: w.code,\n path: w.pointer,\n });\n }\n\n // 12. Type-extension enforcement (canonical-composed; promotes\n // missing/mismatch to errors under strict mode, surfaces them as\n // warnings under interop). Skip when no strictness supplied.\n if (input.strictness !== undefined) {\n const enforceRes = validateTypeExtensionEnforcementInternal(\n input.claims.kind,\n input.claims.type,\n input.claims.extensions,\n input.strictness\n );\n if (!enforceRes.accepted) {\n violations.push({\n layer: 'type-extension-enforcement',\n code: enforceRes.errorCode,\n path: enforceRes.pointer,\n });\n } else if (enforceRes.warnings) {\n for (const w of enforceRes.warnings as readonly TypeExtensionEnforcementWarning[]) {\n warnings.push({\n layer: 'type-extension-enforcement',\n code: w.code,\n path: w.pointer,\n });\n }\n }\n }\n\n return {\n accepted: violations.length === 0,\n violations,\n warnings,\n };\n}\n","/**\n * Production-facing bounded validation gate.\n *\n * INTERNAL ONLY. Not re-exported from `packages/protocol/src/index.ts`.\n *\n * The gate is the only production wrapper for the bounded validation\n * path. The pre-existing `runBoundedValidatorShadow` from\n * `bounded-validator.ts` remains the entry point for shadow / corpus\n * / parity-harness consumers and is not the primary admission path\n * for the protocol entry points; the production-wrapper boundary is\n * enforced by `tests/tooling/production-gate-boundary.test.ts`.\n *\n * The gate is entrypoint-aware: callers identify themselves with a\n * `surface` discriminator, and the gate applies a per-surface\n * production projection allowlist. Layers in the bounded validator's\n * broader composition that fall outside the allowlist for a given\n * surface stay available to shadow / parity tests through\n * `runBoundedValidatorShadow` but are not surfaced as production\n * failure or production warning here.\n *\n * Allowlist for surface 'issueWire02':\n * - schema-parse only.\n *\n * Allowlist for surface 'verifyLocal':\n * - kernel-constraints (via canonical `validateKernelConstraints`).\n * - schema-parse (via the extended `validateSchemaParseInternal`).\n *\n * Out of scope here (kept inline-canonical on both branches by the\n * caller): caller-option-bearing checks (issuer mismatch, subjectUri\n * mismatch, policyDigest format), strictness routing for missing typ,\n * iat-not-yet-valid, occurred_at temporal, type-extension warnings,\n * type-extension enforcement, policy-binding compute, bindings\n * construction, sortWarnings.\n *\n * The canonical materializer (claim encoding, JWS signing, JWS\n * decoding, result-shape construction) is shared between the\n * bounded-default and rollback branches and is not touched by the\n * gate.\n */\n\nimport { validateKernelConstraints } from '@peac/schema';\nimport type { VerificationWarning } from '@peac/kernel';\nimport type { Wire02Claims } from '@peac/schema';\nimport { validateSchemaParseInternal } from './validators/schema-parse.js';\n\n/**\n * Discriminator identifying which protocol entry point invoked the\n * gate. Drives the production projection allowlist. Adding a third\n * surface requires a deliberate plan amendment, not an unannounced\n * source change.\n */\nexport type GateSurface = 'issueWire02' | 'verifyLocal';\n\n/** Sanitized parse-issue projection surfaced on rejection. */\nexport interface SanitizedParseIssue {\n readonly path: string;\n readonly message: string;\n}\n\n/** Parsed-claims projection surfaced on `verifyLocal` acceptance. */\nexport interface ValidationGateParsed {\n readonly wireVersion: '0.2';\n readonly claims: Wire02Claims;\n readonly parserWarnings: readonly VerificationWarning[];\n}\n\n/** Failure-detail projection. Smaller than the bounded layer set. */\nexport interface ValidationGateFailureDetails {\n readonly parse_code?: string;\n readonly issues?: readonly SanitizedParseIssue[];\n}\n\n/** Successful gate result. */\nexport interface ValidationGateSuccess {\n readonly ok: true;\n readonly parsed?: ValidationGateParsed;\n}\n\n/** Failed gate result. */\nexport interface ValidationGateFailure {\n readonly ok: false;\n readonly code: string;\n readonly message: string;\n readonly details?: ValidationGateFailureDetails;\n}\n\nexport type ValidationGateResult = ValidationGateSuccess | ValidationGateFailure;\n\n/** Inputs to the gate. Only `surface` and `payload` are required. */\nexport interface ValidationGateInput {\n readonly surface: GateSurface;\n /**\n * Full claims object. For surface 'issueWire02' this is the just-\n * constructed `Wire02Claims` cast to a plain record (the same\n * object that today flows through `Wire02ClaimsSchema.safeParse`).\n * For surface 'verifyLocal' this is the decoded JWS payload (the\n * same object that today flows through `validateKernelConstraints`\n * and `parseReceiptClaims`).\n */\n readonly payload: unknown;\n}\n\n/** Maximum sanitized-issue list length surfaced to a verifier report. */\nconst MAX_SANITIZED_ISSUES = 25;\n\nfunction sanitizeIssues(issues: unknown): readonly SanitizedParseIssue[] | undefined {\n if (!Array.isArray(issues)) return undefined;\n return issues.slice(0, MAX_SANITIZED_ISSUES).map((issue) => {\n const candidate = issue as { path?: unknown; message?: unknown };\n const path = Array.isArray(candidate.path)\n ? candidate.path\n .map((segment) =>\n typeof segment === 'string' || typeof segment === 'number' ? String(segment) : ''\n )\n .join('.')\n : '';\n const message =\n typeof candidate.message === 'string'\n ? candidate.message\n : String(candidate.message ?? issue);\n return { path, message };\n });\n}\n\n/**\n * Run the production projection of the bounded validation path.\n *\n * Behavior is byte-equivalent to the inline canonical sequences at\n * `issue.ts` and `verify-local.ts` for every input on the covered\n * runtime matrix. Any cross-branch divergence on JWS bytes, result\n * shape, error code, warning order, thrown error class, success /\n * failure classification, or observable default behavior is a\n * validation-equivalence regression.\n */\nexport function runBoundedValidationGate(input: ValidationGateInput): ValidationGateResult {\n if (input.surface === 'issueWire02') {\n return runIssueWire02(input.payload);\n }\n return runVerifyLocal(input.payload);\n}\n\nfunction runIssueWire02(payload: unknown): ValidationGateResult {\n // Issuance projection mirrors `issue.ts` Wire02ClaimsSchema.safeParse.\n // Today's canonical issuance reports the first Zod issue message in\n // the IssueError details. The gate reproduces that surface here.\n const schemaRes = validateSchemaParseInternal(payload);\n if (!schemaRes.accepted) {\n const firstIssueMessage = schemaRes.errorIssues?.[0]?.message;\n return {\n ok: false,\n code: 'E_INVALID_FORMAT',\n message: `Wire 0.2 claims schema validation failed: ${firstIssueMessage ?? 'unknown'}`,\n };\n }\n return { ok: true };\n}\n\nfunction runVerifyLocal(payload: unknown): ValidationGateResult {\n // Kernel constraints first (canonical-helper delegation preserves\n // the existing `Kernel constraint violated: <constraint>\n // (actual: <actual>, limit: <limit>)` message byte-equally).\n const kernelRes = validateKernelConstraints(payload);\n if (!kernelRes.valid) {\n const v = kernelRes.violations[0];\n return {\n ok: false,\n code: 'E_CONSTRAINT_VIOLATION',\n message: `Kernel constraint violated: ${v.constraint} (actual: ${v.actual}, limit: ${v.limit})`,\n };\n }\n\n // Schema parse next. Surface the canonical\n // `Receipt schema validation failed: <message>` shape with\n // `details: { parse_code, issues }` byte-equally.\n //\n // Wire 0.1 payloads parse successfully under the canonical parser\n // but are rejected at the bounded layer with errorCode\n // 'E_UNSUPPORTED_WIRE_VERSION'. The verify-local canonical surface\n // routes Wire 0.1 to a distinct error code (not E_INVALID_FORMAT)\n // and a distinct message; preserve that branch here.\n const schemaRes = validateSchemaParseInternal(payload);\n if (!schemaRes.accepted) {\n if (schemaRes.errorCode === 'E_UNSUPPORTED_WIRE_VERSION') {\n return {\n ok: false,\n code: 'E_UNSUPPORTED_WIRE_VERSION',\n message: 'Wire 0.1 receipts are not supported. Re-issue as Wire 0.2 using issue().',\n };\n }\n const sanitized = sanitizeIssues(schemaRes.errorIssues);\n const details: ValidationGateFailureDetails = {};\n if (schemaRes.errorCode !== undefined) {\n Object.assign(details, { parse_code: schemaRes.errorCode });\n }\n if (sanitized !== undefined) {\n Object.assign(details, { issues: sanitized });\n }\n return {\n ok: false,\n code: 'E_INVALID_FORMAT',\n message: `Receipt schema validation failed: ${schemaRes.errorMessage ?? 'unknown'}`,\n ...(Object.keys(details).length > 0 && { details }),\n };\n }\n\n if (schemaRes.wireVersion !== '0.2' || schemaRes.claims === undefined) {\n return {\n ok: false,\n code: 'E_UNSUPPORTED_WIRE_VERSION',\n message: 'Wire 0.1 receipts are not supported. Re-issue as Wire 0.2 using issue().',\n };\n }\n\n return {\n ok: true,\n parsed: {\n wireVersion: '0.2',\n claims: schemaRes.claims,\n parserWarnings: schemaRes.warnings ?? [],\n },\n };\n}\n","/**\n * Shadow-mode telemetry redaction and canonical hashing.\n *\n * @internal\n *\n * INTERNAL ONLY. Not re-exported from packages/protocol/src/index.ts.\n *\n * Two responsibilities:\n *\n * 1. `redactNote(input, maxBytes)`: scrub known secret classes from\n * a free-form string and bound it to a UTF-8 byte ceiling. Used\n * for the `notes` field on every shadow divergence record so\n * that an accidental string concatenation cannot leak credential\n * material into the in-memory shadow log.\n *\n * 2. `canonicalHashOf(value)` / `hashJws(jws)`: produce a SHA-256\n * hex digest of a canonicalized representation. Used as the\n * comparison primitive between real-path and shadow-path results\n * so the divergence log never needs to store raw output.\n *\n * SECRET_PATTERNS is the ground-truth contract for what counts as a\n * leakable secret class. Adding a regex here REQUIRES a paired\n * adversarial test vector in shadow-redact-adversarial.test.ts (one\n * matching vector + one adjacent benign-not-matched vector). Removing\n * a regex here REQUIRES the same justification.\n *\n * Platform neutrality: this module avoids Node-only globals (`Buffer`,\n * `node:crypto`) so it can ship inside the platform-neutral\n * @peac/protocol bundle. UTF-8 byte work uses TextEncoder/TextDecoder;\n * SHA-256 hashing delegates to @peac/crypto.sha256Hex which uses the\n * Web Crypto API with a dynamic Node fallback.\n */\n\nimport { base64urlEncode, sha256Hex } from '@peac/crypto';\n\n/**\n * Known secret-class patterns. Order matters only for performance\n * (broader patterns first reduce the search space for narrower ones).\n *\n * @internal\n */\nconst SECRET_PATTERNS: readonly RegExp[] = [\n // Compact JWS / JWT (header.payload.signature with eyJ-prefixed header).\n /eyJ[A-Za-z0-9_-]{20,}\\.[A-Za-z0-9_-]+\\.[A-Za-z0-9_-]+/g,\n\n // PEM-encoded blocks. Covers RSA / EC / OPENSSH / generic PRIVATE KEY\n // header variants in a single pattern.\n /-----BEGIN [A-Z0-9 ]+-----[\\s\\S]+?-----END [A-Z0-9 ]+-----/g,\n\n // Long base64 runs (>=40 chars). The character class is the standard\n // base64 alphabet only (no `_` or `-`) so that kebab-case and\n // snake_case identifier strings do not collateral-match. base64url\n // payloads carrying credentials are reached via more specific patterns\n // (compact JWS, Bearer, URL query token) and via the wrapper headers\n // they appear in.\n /\\b[A-Za-z0-9+/]{40,}={0,2}\\b/g,\n\n // Bearer token (Authorization header value with Bearer scheme).\n /Bearer\\s+[A-Za-z0-9._\\-/+=]+/gi,\n\n // Generic Authorization header line (any scheme, including Basic /\n // Digest / Negotiate). Multiline-anchored.\n /^authorization:\\s*[^\\r\\n]+/gim,\n\n // Generic auth-token header line (X-Auth-Token, X-API-Key).\n /^x-(?:auth-token|api-key):\\s*[^\\r\\n]+/gim,\n\n // Cookie request header line (raw client cookies).\n /^cookie:\\s*[^\\r\\n]+/gim,\n\n // Set-Cookie response header line (server-issued sessions).\n /^set-cookie:\\s*[^\\r\\n]+/gim,\n\n // URL query token / API key / secret / access_token.\n /[?&](?:token|key|secret|access_token|api_key|apikey)=[^&\\s#]+/gi,\n\n // AWS access key ID (AKIA + 16 alphanumeric).\n /\\bAKIA[0-9A-Z]{16}\\b/g,\n\n // Email address (PII).\n /[A-Za-z0-9._%+-]+@[A-Za-z0-9.-]+\\.[A-Za-z]{2,}/g,\n\n // Phone numbers. Three explicit forms (E.164 + parenthesized NA + dashed\n // NA / international) so plain consecutive-digit runs (sequence\n // numbers, hashes, identifiers) do not collateral-match.\n /\\+\\d[\\d\\s().-]{6,}\\d/g,\n /\\(\\d{3}\\)\\s*\\d{3}[\\s.-]?\\d{4}/g,\n /\\b\\d{3}[\\s.-]\\d{3}[\\s.-]\\d{4}\\b/g,\n];\n\n/**\n * Redaction marker used in place of any matched secret class.\n *\n * @internal\n */\nconst REDACTION_MARKER = '[REDACTED]';\n\nconst TEXT_ENCODER = /* @__PURE__ */ new TextEncoder();\nconst TEXT_DECODER = /* @__PURE__ */ new TextDecoder('utf-8', { fatal: false });\n\nconst REDACTION_MARKER_BYTES = TEXT_ENCODER.encode(REDACTION_MARKER).length;\n\n/**\n * UTF-8 byte length of a string. Platform-neutral replacement for\n * `Buffer.byteLength(s, 'utf8')`.\n *\n * @internal\n */\nexport function utf8ByteLength(value: string): number {\n return TEXT_ENCODER.encode(value).length;\n}\n\n/**\n * Redact known secret classes from `input` and bound the result to\n * `maxBytes` UTF-8 bytes. The output always either matches the input\n * (when no secret was found and the byte budget permits) or contains\n * the `[REDACTED]` marker.\n *\n * Truncation is byte-aware so multibyte UTF-8 sequences are not split\n * mid-character. When the redacted string exceeds `maxBytes`, the\n * tail is replaced with the marker.\n *\n * @internal\n */\nexport function redactNote(input: string, maxBytes: number): string {\n if (typeof input !== 'string') return REDACTION_MARKER;\n\n let redacted = input;\n for (const pattern of SECRET_PATTERNS) {\n redacted = redacted.replace(pattern, REDACTION_MARKER);\n }\n\n const bytes = TEXT_ENCODER.encode(redacted);\n if (bytes.length <= maxBytes) return redacted;\n\n if (maxBytes <= REDACTION_MARKER_BYTES) {\n return REDACTION_MARKER.slice(0, maxBytes);\n }\n\n const headBytes = maxBytes - REDACTION_MARKER_BYTES;\n return safeUtf8Slice(bytes, headBytes) + REDACTION_MARKER;\n}\n\n/**\n * SHA-256 hex digest of a canonical-stringified value. Used by the\n * shadow comparator to detect output-byte-diff WITHOUT logging raw\n * content. Object keys are sorted recursively so equivalent objects\n * with different key orders produce identical digests.\n *\n * Async because SHA-256 hashing in this codebase is platform-neutral\n * via @peac/crypto.sha256Hex (Web Crypto API with dynamic Node\n * fallback). Callers run inside the shadow scheduler's microtask /\n * macrotask boundary, so an additional await is free.\n *\n * @internal\n */\nexport async function canonicalHashOf(value: unknown): Promise<string> {\n return sha256Hex(canonicalStringify(value));\n}\n\n/**\n * SHA-256 hex digest of a JWS string. Used as the primary\n * `recordRefHash` input for divergence records.\n *\n * @internal\n */\nexport async function hashJws(jws: string): Promise<string> {\n return sha256Hex(jws);\n}\n\n/**\n * Canonical JSON serialization with stable key order. Internal helper\n * for `canonicalHashOf`. Not exported.\n */\nfunction canonicalStringify(value: unknown): string {\n if (value === null) return 'null';\n if (typeof value === 'undefined') return 'null';\n if (typeof value === 'string') return JSON.stringify(value);\n if (typeof value === 'number') {\n return Number.isFinite(value) ? String(value) : 'null';\n }\n if (typeof value === 'boolean') return String(value);\n if (typeof value === 'bigint') return String(value);\n if (Array.isArray(value)) {\n return '[' + value.map(canonicalStringify).join(',') + ']';\n }\n if (value instanceof Uint8Array) {\n return JSON.stringify(base64urlEncode(value));\n }\n if (typeof value === 'object') {\n const obj = value as Record<string, unknown>;\n const keys = Object.keys(obj).sort();\n return (\n '{' + keys.map((k) => JSON.stringify(k) + ':' + canonicalStringify(obj[k])).join(',') + '}'\n );\n }\n return 'null';\n}\n\n/**\n * Slice a UTF-8 byte buffer to at most `byteLen` bytes without\n * splitting a multi-byte sequence mid-character. Returns a decoded\n * string. Internal helper for `redactNote`. Not exported.\n */\nfunction safeUtf8Slice(bytes: Uint8Array, byteLen: number): string {\n if (byteLen <= 0) return '';\n if (bytes.length <= byteLen) return TEXT_DECODER.decode(bytes);\n\n let end = byteLen;\n // Walk back over UTF-8 continuation bytes (0b10xxxxxx) so the slice\n // ends on a complete code-point boundary.\n while (end > 0 && (bytes[end] & 0xc0) === 0x80) {\n end -= 1;\n }\n return TEXT_DECODER.decode(bytes.subarray(0, end));\n}\n","/**\n * Shadow-mode scheduler.\n *\n * @internal\n *\n * INTERNAL ONLY. Not re-exported from packages/protocol/src/index.ts.\n *\n * Schedules a shadow function to run AFTER the public-call boundary\n * has returned its real-path result to the caller. The shadow run:\n *\n * - is gated by `isShadowEnabled(options)` (env or programmatic);\n * - starts on a MACROTASK boundary (`setTimeout(..., 0)`), NOT on a\n * microtask, because microtasks can run before promise\n * continuations attached to the public async call and would still\n * add observable latency for CPU-heavy shadow work;\n * - has a bounded wall-clock REPORTING timeout (250ms by default;\n * see \"Timeout guarantee class\" below);\n * - reports comparison results into a bounded in-memory log;\n * - SWALLOWS every error, never propagating to the real-path return\n * value or surfacing as an unhandled-rejection event.\n *\n * The public function:\n *\n * - returns the real-path value FIRST (the macrotask boundary is\n * past every async continuation already attached to the call\n * site);\n * - never awaits shadow work;\n * - is byte-identical in its return value with shadow ON vs OFF.\n *\n * Timeout guarantee class. The 250ms timeout is a REPORTING bound,\n * not a hard preemption guarantee. Where the shadow function consults\n * the supplied `AbortSignal`, the runner aborts and bounds CPU; where\n * the shadow function is pure-CPU and ignores the signal (the v0.13.1\n * record-core validators are this shape), JavaScript cannot preempt\n * it. The runner stops awaiting and records `timing-diff`; the work\n * may continue to completion off the runner's await chain. Either\n * way, the public-call boundary returns its real-path value\n * immediately.\n *\n * Test-only helpers (`_peekShadowLog`, `_resetShadowLog`,\n * `_drainShadowQueueForTests`) are exposed for deterministic\n * assertions in vitest. Production code MUST NOT call them.\n *\n * Platform neutrality: this module avoids Node-only globals\n * (`Buffer`, `node:crypto`, unguarded `process`). Hashing delegates\n * to @peac/crypto; environment reads guard for the absence of\n * `process` so the module loads cleanly under browser / edge\n * runtimes.\n */\n\nimport type { ShadowCall, ShadowDivergence } from './shadow-types.js';\nimport { canonicalHashOf, hashJws, redactNote, utf8ByteLength } from './shadow-redact.js';\n\nconst MAX_LOG_ENTRIES = 1000;\nconst MAX_NOTE_BYTES = 128;\nconst RETENTION_MS = 7 * 24 * 60 * 60 * 1000; // 7 days\nconst SHADOW_TIMEOUT_MS = 250;\n\nconst SHADOW_LOG: ShadowDivergence[] = [];\nconst PENDING_SHADOW_TASKS: Set<Promise<void>> = new Set();\nlet pendingScheduleCount = 0;\n\n/**\n * Programmatic-flag shape. Internal-only; never appears in any\n * exported public option type.\n *\n * @internal\n */\nexport interface ShadowEnableOptions {\n readonly _internal?: {\n readonly shadowCore?: boolean;\n };\n}\n\n/**\n * Read the shadow-enable flag from environment or programmatic\n * options. Read once per call, NOT cached at module scope, so tests\n * can toggle the env var dynamically. Environment access is guarded\n * for browser / edge runtimes that do not expose `process`.\n *\n * @internal\n */\nexport function isShadowEnabled(options?: ShadowEnableOptions): boolean {\n if (options?._internal?.shadowCore === true) return true;\n return readEnvFlag();\n}\n\nfunction readEnvFlag(): boolean {\n if (typeof process === 'undefined' || process === null) return false;\n const env = (process as { env?: Record<string, string | undefined> }).env;\n return env?.PEAC_INTERNAL_SHADOW_CORE === '1';\n}\n\n/**\n * Inputs to `scheduleShadow`. The `shadowFn` factory receives an\n * `AbortSignal` so cancellable implementations can opt in. v0.13.1\n * shadow paths are pure-CPU and ignore the signal; the runner still\n * passes one for forward-compat.\n *\n * @internal\n */\nexport interface ScheduleShadowArgs<T> {\n readonly call: ShadowCall;\n readonly realResult: T | undefined;\n readonly realError: { code?: string } | undefined;\n readonly shadowFn: (signal?: AbortSignal) => Promise<T>;\n readonly recordRef: string;\n}\n\n/**\n * Schedule shadow work AFTER the real-path return.\n *\n * The shadow run starts on the next MACROTASK boundary (via\n * `setTimeout(..., 0)`). The public function returns its real-path\n * value before the macrotask fires, including for async callers\n * whose `.then` / `await` continuations execute on microtasks.\n * `queueMicrotask` would interleave with those continuations and is\n * intentionally avoided.\n *\n * Tasks are tracked internally so test helpers can drain them for\n * deterministic assertions; production callers ignore the (void)\n * return.\n *\n * Failures inside the shadow path are converted to divergence records\n * inside the task body. The outer `task.catch(() => {})` is defense\n * in depth: if anything inside `runShadowTask` throws after the inner\n * try/catch (e.g., a hash failure during canonical comparison), the\n * outer catch swallows the rejection so no unhandled-rejection event\n * fires.\n *\n * @internal\n */\nexport function scheduleShadow<T>(args: ScheduleShadowArgs<T>): void {\n pendingScheduleCount += 1;\n setTimeout(() => {\n pendingScheduleCount -= 1;\n const task = runShadowTask(args);\n PENDING_SHADOW_TASKS.add(task);\n // Cleanup runs on both fulfillment and rejection. Using\n // `task.then(remove, remove)` instead of `task.finally(remove)`\n // avoids creating a derived rejected promise that would surface\n // as an unhandled-rejection event when the inner task rejects.\n // The two-arg `then` form swallows any rejection and runs the\n // cleanup on either branch.\n const removeFromPending = (): void => {\n PENDING_SHADOW_TASKS.delete(task);\n };\n void task.then(removeFromPending, removeFromPending);\n }, 0);\n}\n\nasync function runShadowTask<T>(args: ScheduleShadowArgs<T>): Promise<void> {\n const recordRefHash = await hashJws(args.recordRef);\n let shadowResult: T | undefined;\n let shadowErrorCode: string | undefined;\n\n try {\n shadowResult = await runWithTimeout(args.shadowFn, SHADOW_TIMEOUT_MS);\n } catch (err) {\n shadowErrorCode = extractErrorCode(err);\n appendDivergence({\n kind: shadowErrorCode === 'SHADOW_TIMEOUT' ? 'timing-diff' : 'shadow-error',\n call: args.call,\n recordRefHash,\n realErrorCode: args.realError?.code,\n shadowErrorCode,\n notes: redactNote(`shadow threw ${shadowErrorCode}`, MAX_NOTE_BYTES),\n timestamp: new Date().toISOString(),\n });\n return;\n }\n\n const divergence = await compareResults(args, shadowResult, recordRefHash);\n if (divergence) appendDivergence(divergence);\n}\n\n/**\n * Bounded REPORTING timeout for shadow work. NOT a hard preemption\n * guarantee. See the module-level \"Timeout guarantee class\" comment.\n */\nfunction runWithTimeout<T>(fn: (signal?: AbortSignal) => Promise<T>, ms: number): Promise<T> {\n const controller = new AbortController();\n return new Promise((resolve, reject) => {\n const timer = setTimeout(() => {\n controller.abort();\n reject(new Error('SHADOW_TIMEOUT'));\n }, ms);\n fn(controller.signal).then(\n (v) => {\n clearTimeout(timer);\n resolve(v);\n },\n (e) => {\n clearTimeout(timer);\n reject(e);\n }\n );\n });\n}\n\nasync function compareResults<T>(\n args: ScheduleShadowArgs<T>,\n shadowResult: T | undefined,\n recordRefHash: string\n): Promise<ShadowDivergence | null> {\n const ts = new Date().toISOString();\n\n // Both succeeded: compare canonical hashes.\n if (!args.realError && shadowResult !== undefined && args.realResult !== undefined) {\n const realHash = await canonicalHashOf(args.realResult);\n const shadowHash = await canonicalHashOf(shadowResult);\n if (realHash !== shadowHash) {\n return {\n kind: 'output-byte-diff',\n call: args.call,\n recordRefHash,\n realResultHash: realHash,\n shadowResultHash: shadowHash,\n realByteLen: byteLenOf(args.realResult),\n shadowByteLen: byteLenOf(shadowResult),\n notes: 'canonical-hash-mismatch',\n timestamp: ts,\n };\n }\n return null;\n }\n\n // Both errored: comparator already handled in catch path; no record here.\n if (args.realError && shadowResult === undefined) {\n return null;\n }\n\n // Asymmetric: one succeeded, one failed.\n return {\n kind: 'error-code-diff',\n call: args.call,\n recordRefHash,\n realErrorCode: args.realError?.code,\n notes: args.realError ? 'real-errored-shadow-succeeded' : 'real-succeeded-shadow-errored',\n timestamp: ts,\n };\n}\n\nfunction byteLenOf(value: unknown): number {\n if (typeof value === 'string') return utf8ByteLength(value);\n if (value instanceof Uint8Array) return value.byteLength;\n return utf8ByteLength(JSON.stringify(value) ?? '');\n}\n\nfunction extractErrorCode(err: unknown): string {\n if (err && typeof err === 'object') {\n const candidate = (err as { code?: unknown; message?: unknown }).code;\n if (typeof candidate === 'string' && candidate.length > 0) return candidate;\n const message = (err as { message?: unknown }).message;\n if (typeof message === 'string' && /^[A-Z_][A-Z0-9_]*$/.test(message)) return message;\n }\n return 'SHADOW_UNKNOWN_ERROR';\n}\n\nfunction appendDivergence(d: ShadowDivergence): void {\n pruneStale();\n if (SHADOW_LOG.length >= MAX_LOG_ENTRIES) SHADOW_LOG.shift();\n SHADOW_LOG.push(d);\n}\n\nfunction pruneStale(): void {\n const cutoffIso = new Date(Date.now() - RETENTION_MS).toISOString();\n while (SHADOW_LOG.length > 0 && SHADOW_LOG[0].timestamp < cutoffIso) SHADOW_LOG.shift();\n}\n\n/**\n * Read the in-memory shadow log without mutating it. TEST USE ONLY.\n *\n * @internal\n */\nexport function _peekShadowLog(): readonly ShadowDivergence[] {\n return SHADOW_LOG.slice();\n}\n\n/**\n * Clear the in-memory shadow log. TEST USE ONLY.\n *\n * @internal\n */\nexport function _resetShadowLog(): void {\n SHADOW_LOG.length = 0;\n}\n\n/**\n * Drain the pending-shadow-tasks set so deterministic assertions can\n * run after a sequence of shadow-enabled calls. Yields to the event\n * loop until every scheduled `setTimeout` has fired AND every\n * resulting task has settled. TEST USE ONLY. Production code MUST\n * NOT call this.\n *\n * @internal\n */\nexport async function _drainShadowQueueForTests(): Promise<void> {\n while (pendingScheduleCount > 0 || PENDING_SHADOW_TASKS.size > 0) {\n if (pendingScheduleCount > 0) {\n // Yield so any pending setTimeout(..., 0) fires.\n await new Promise<void>((resolve) => setTimeout(resolve, 0));\n }\n if (PENDING_SHADOW_TASKS.size > 0) {\n await Promise.allSettled(Array.from(PENDING_SHADOW_TASKS));\n }\n }\n}\n","/**\n * Internal rollback-path flag.\n *\n * INTERNAL ONLY. Both flag values currently use the same protocol path.\n * The flag reader is exercised so rollback-path plumbing can be validated\n * without changing public behavior.\n *\n * Public option types MUST NOT declare `_internal.legacyPath`; callers\n * inside this package access the programmatic option only through\n * internal casts. Flag identifiers are forbidden on the public TypeScript\n * surface by `scripts/verify-dist-private-leaks.mjs` (Tier 1 + scoped\n * runtime allowlist for `@peac/protocol` runtime files only) and by\n * `scripts/verify-no-semantic-widening.mjs`.\n */\n\n/**\n * Programmatic-flag shape. Internal-only; never appears on any\n * exported public option type. Mirrors the existing shadow-flag\n * pattern at `_internal/shadow.ts` so the dist-leak gates and the\n * semantic-widening gates apply uniformly.\n *\n * @internal\n */\nexport interface LegacyPathOptions {\n readonly _internal?: {\n readonly legacyPath?: boolean;\n };\n}\n\n/**\n * Read the rollback-path flag from environment or programmatic\n * options. Read once per call, NOT cached at module scope, so tests\n * can toggle the env var dynamically. Strict semantics: only the\n * literal string `'1'` activates the flag, mirroring\n * `PEAC_INTERNAL_SHADOW_CORE`.\n *\n * Environment access is guarded for browser / edge runtimes that do\n * not expose `process`; the function never throws.\n *\n * Caller pattern at protocol hot paths:\n *\n * void readLegacyPathFlag(options as unknown as LegacyPathOptions);\n *\n * The `void` discards the returned boolean intentionally: both flag\n * values currently use the same protocol path, and the call exists\n * so the read path is exercised.\n *\n * @internal\n */\nexport function readLegacyPathFlag(options?: LegacyPathOptions): boolean {\n if (options?._internal?.legacyPath === true) return true;\n if (typeof process === 'undefined' || process === null) return false;\n const env = (process as { env?: Record<string, string | undefined> }).env;\n return env?.PEAC_INTERNAL_LEGACY_PATH === '1';\n}\n","/**\n * Normalized internal observation shape for shadow-vs-real comparison.\n *\n * @internal\n *\n * INTERNAL ONLY. Not re-exported from packages/protocol/src/index.ts.\n *\n * The shadow scheduler compares real-path and shadow-path results via\n * canonical hashes. To make that comparison meaningful (not just an\n * accept/reject boolean) and free of false positives, both sides\n * project onto the SAME stable normalized `ShadowObservation` shape\n * before the hash:\n *\n * - `accepted`: did the validator accept the input?\n * - `violationCodes`: sorted, deduplicated registered error codes.\n * - `warningCodes`: sorted, deduplicated registered warning codes.\n *\n * Layer-tag metadata is intentionally NOT part of the comparable\n * shape. The bounded validator emits per-layer tags; the canonical\n * Zod path does not. Including them would cause a hash divergence\n * even on full functional agreement, masking true divergence as\n * noise.\n *\n * Issue path projection:\n *\n * `IssueResult` does not expose warning codes; canonical issuance\n * either succeeds (and surfaces no warnings to the caller) or\n * throws. To prevent the bounded validator's warnings from\n * producing false `output-byte-diff` records on a successful\n * issuance, the issue-side comparison runs in ACCEPTED-ONLY mode:\n * `warningCodes` is projected to `[]` on BOTH sides.\n *\n * VerifyLocal success path projection:\n *\n * `VerifyLocalSuccess` exposes a `warnings` array of registered\n * warning codes. The verifyLocal-side comparison includes\n * `warningCodes` from both sides (canonical surfaces them\n * directly; the bounded validator's warningCodes are mapped from\n * `BoundedWarning.code`).\n */\n\nimport type { BoundedValidationResult } from './record-core/bounded-validator.js';\n\n/**\n * Canonical observation projected from either the real path or the\n * shadow path.\n *\n * @internal\n */\nexport interface ShadowObservation {\n readonly accepted: boolean;\n /** Registered error codes, sorted, deduplicated. */\n readonly violationCodes: readonly string[];\n /** Registered warning codes, sorted, deduplicated. */\n readonly warningCodes: readonly string[];\n}\n\n/**\n * Real-path observation for a successful `issue()` call. Always\n * projects to the empty accepted-only shape; canonical issuance\n * surfaces no warning codes through `IssueResult`.\n *\n * @internal\n */\nexport function realObservationForIssue(): ShadowObservation {\n return EMPTY_ACCEPTED;\n}\n\n/**\n * Real-path observation for a successful `verifyLocal()` call. Maps\n * the canonical `warnings: VerificationWarning[]` array onto the\n * normalized warningCodes set.\n *\n * @internal\n */\nexport function realObservationForVerifyLocalSuccess(\n warnings: readonly { code: string }[] | undefined\n): ShadowObservation {\n if (!warnings || warnings.length === 0) return EMPTY_ACCEPTED;\n return {\n accepted: true,\n violationCodes: [],\n warningCodes: sortedDedupedCodes(warnings.map((w) => w.code)),\n };\n}\n\n/**\n * Project a `BoundedValidationResult` into the shared observation\n * shape with full warning-code parity. Use on the verifyLocal path\n * where canonical exposes warning codes through\n * `VerifyLocalSuccess.warnings`.\n *\n * @internal\n */\nexport function shadowObservationFromBounded(bounded: BoundedValidationResult): ShadowObservation {\n return {\n accepted: bounded.accepted,\n violationCodes: sortedDedupedCodes(bounded.violations.map((v) => v.code)),\n warningCodes: sortedDedupedCodes(bounded.warnings.map((w) => w.code)),\n };\n}\n\n/**\n * Project a `BoundedValidationResult` into the shared observation\n * shape with `warningCodes` flattened to `[]`. Use on the issue path\n * where canonical issuance does not surface warning codes through\n * `IssueResult`. Without this projection the bounded validator's\n * type-extension or temporal warnings would create false\n * `output-byte-diff` records on every otherwise-successful issuance.\n *\n * @internal\n */\nexport function shadowObservationFromBoundedAcceptedOnly(\n bounded: BoundedValidationResult\n): ShadowObservation {\n return {\n accepted: bounded.accepted,\n violationCodes: sortedDedupedCodes(bounded.violations.map((v) => v.code)),\n warningCodes: [],\n };\n}\n\nconst EMPTY_ACCEPTED: ShadowObservation = Object.freeze({\n accepted: true,\n violationCodes: Object.freeze([]) as readonly string[],\n warningCodes: Object.freeze([]) as readonly string[],\n});\n\nfunction sortedDedupedCodes(codes: readonly string[]): readonly string[] {\n if (codes.length === 0) return [];\n return Array.from(new Set(codes)).sort();\n}\n","/**\n * Telemetry utilities for protocol package\n *\n * TelemetryHook is the protocol-local interface for observability.\n * Hooks are best-effort side effects: fire-and-forget, never awaited,\n * guarded against both sync throws and async rejections.\n */\n\nimport { createHash } from 'node:crypto';\n\n/**\n * Input for receipt issued telemetry event\n */\nexport interface ReceiptIssuedHookInput {\n receiptHash: string;\n issuer?: string;\n kid?: string;\n durationMs?: number;\n}\n\n/**\n * Input for receipt verified telemetry event\n */\nexport interface ReceiptVerifiedHookInput {\n receiptHash: string;\n valid: boolean;\n reasonCode?: string;\n issuer?: string;\n kid?: string;\n durationMs?: number;\n}\n\n/**\n * Telemetry hook interface for protocol observability\n *\n * Implementations SHOULD be no-throw. Protocol guards all calls,\n * but well-behaved hooks should not throw.\n *\n * Hooks may be sync or async -- protocol will NOT await the result.\n */\nexport type TelemetryHook = {\n onReceiptIssued?(input: ReceiptIssuedHookInput): void | Promise<void>;\n onReceiptVerified?(input: ReceiptVerifiedHookInput): void | Promise<void>;\n};\n\n/**\n * Safely invoke a telemetry hook (fire-and-forget)\n *\n * Guards both sync throws and async rejections.\n * Telemetry MUST NOT break core flow.\n */\nexport function fireTelemetryHook<T>(\n fn: ((input: T) => void | Promise<void>) | undefined,\n input: T\n): void {\n if (!fn) return;\n try {\n const result = fn(input);\n // Swallow async rejections\n if (result && typeof (result as Promise<void>).catch === 'function') {\n (result as Promise<void>).catch(() => {});\n }\n } catch {\n // Telemetry MUST NOT break core flow\n }\n}\n\n/**\n * Compute a SHA-256 hash of a receipt JWS\n *\n * Returns format: sha256:{hex prefix}\n * Uses first 16 chars of hex for brevity in logs/spans.\n */\nexport function hashReceipt(jws: string): string {\n const hash = createHash('sha256').update(jws).digest('hex');\n return `sha256:${hash.slice(0, 16)}`;\n}\n","/**\n * Receipt issuance\n * Validates input, generates UUIDv7 rid, and signs with Ed25519\n */\n\nimport { uuidv7 } from 'uuidv7';\nimport { sign, CryptoError } from '@peac/crypto';\nimport { defaultCodec } from './_internal/record-core/codec/jws-jwt.js';\nimport { runBoundedValidatorShadow } from './_internal/record-core/bounded-validator.js';\nimport { runBoundedValidationGate } from './_internal/record-core/validation-gate.js';\nimport { isShadowEnabled, scheduleShadow, type ShadowEnableOptions } from './_internal/shadow.js';\nimport { readLegacyPathFlag, type LegacyPathOptions } from './_internal/legacy-path.js';\nimport {\n realObservationForIssue,\n shadowObservationFromBoundedAcceptedOnly,\n type ShadowObservation,\n} from './_internal/shadow-observe.js';\nimport type { JsonValue, EvidencePillar, PolicyBlock } from '@peac/kernel';\nimport { ZodError } from 'zod';\nimport {\n PEACReceiptClaims,\n ReceiptClaims,\n SubjectProfileSnapshot,\n validateSubjectSnapshot,\n createEvidenceNotJsonError,\n createConstraintViolationError,\n createWorkflowContextInvalidError,\n createWorkflowDagInvalidError,\n validateKernelConstraints,\n type PEACError,\n type PurposeToken,\n type CanonicalPurpose,\n type PurposeReason,\n isValidPurposeToken,\n isCanonicalPurpose,\n isValidPurposeReason,\n // Workflow correlation (v0.10.2+)\n type WorkflowContext,\n isValidWorkflowContext,\n hasValidDagSemantics,\n WORKFLOW_EXTENSION_KEY,\n // Wire 0.2 (v0.12.0-preview.1)\n isCanonicalIss,\n Wire02ClaimsSchema,\n type Wire02Claims,\n} from '@peac/schema';\nimport { hashReceipt, fireTelemetryHook, type TelemetryHook } from './telemetry.js';\n\n/**\n * Wire 0.1 record options (frozen legacy).\n *\n * @deprecated Use {@link IssueWire02Options} (or the {@link IssueOptions} alias)\n * for current stable issuance.\n */\nexport interface IssueWire01Options {\n /** Issuer URL (https://) */\n iss: string;\n\n /** Audience / resource URL (https://) */\n aud: string;\n\n /** Amount in smallest currency unit */\n amt: number;\n\n /** ISO 4217 currency code (uppercase) */\n cur: string;\n\n /** Payment rail identifier */\n rail: string;\n\n /** Rail-specific payment reference */\n reference: string;\n\n /** Asset transferred (e.g., \"USD\", \"USDC\", \"BTC\") - defaults to currency if not provided */\n asset?: string;\n\n /** Environment (\"live\" or \"test\") - defaults to \"test\" */\n env?: 'live' | 'test';\n\n /** Network/rail identifier (optional, SHOULD for crypto) */\n network?: string;\n\n /** Facilitator reference (optional) */\n facilitator_ref?: string;\n\n /** Rail-specific evidence (JSON-safe) - defaults to empty object if not provided */\n evidence?: JsonValue;\n\n /** Idempotency key (optional) */\n idempotency_key?: string;\n\n /** Rail-specific metadata (optional) */\n metadata?: Record<string, unknown>;\n\n /** Subject URI (optional) */\n subject?: string;\n\n /** Extensions (optional) */\n ext?: PEACReceiptClaims['ext'];\n\n /** Expiry timestamp (Unix seconds, optional) */\n exp?: number;\n\n /** Subject profile snapshot for envelope (v0.9.17+, optional) */\n subject_snapshot?: SubjectProfileSnapshot;\n\n /**\n * Purposes declared by the requesting agent (v0.9.24+, optional)\n *\n * From PEAC-Purpose request header. Accepts single token or array.\n * Unknown tokens are preserved for forward compatibility.\n */\n purpose?: PurposeToken | PurposeToken[];\n\n /**\n * Single purpose enforced by policy (v0.9.24+, optional)\n *\n * MUST be one of declared purposes OR a more restrictive downgrade.\n * Only canonical purposes have enforcement semantics.\n */\n purpose_enforced?: CanonicalPurpose;\n\n /**\n * Reason for enforcement decision (v0.9.24+, optional)\n *\n * The audit spine - explains WHY purpose was enforced as it was.\n */\n purpose_reason?: PurposeReason;\n\n /**\n * Workflow correlation context (v0.10.2+, optional)\n *\n * Links this receipt into a multi-step workflow DAG.\n * Added to ext['org.peacprotocol/workflow'].\n */\n workflow_context?: WorkflowContext;\n\n /** Ed25519 private key (32 bytes) */\n privateKey: Uint8Array;\n\n /** Key ID; non-empty, well-formed Unicode, at most 256 UTF-8 bytes */\n kid: string;\n\n /** Telemetry hook (optional, fire-and-forget) */\n telemetry?: TelemetryHook;\n}\n\n/**\n * Result of issuing a receipt\n */\nexport interface IssueResult {\n /** JWS compact serialization */\n jws: string;\n\n /** Validated subject snapshot (if provided) */\n subject_snapshot?: SubjectProfileSnapshot;\n}\n\n/**\n * Error thrown during receipt issuance\n *\n * Wraps a structured PEACError for programmatic handling.\n */\nexport class IssueError extends Error {\n /** Structured error details */\n readonly peacError: PEACError;\n\n constructor(peacError: PEACError) {\n const details = peacError.details as { message?: string } | undefined;\n super(details?.message ?? peacError.code);\n this.name = 'IssueError';\n this.peacError = peacError;\n }\n}\n\n/**\n * Protocol code for a crypto signing failure at the issuance boundary.\n *\n * The signer enforces the I-JSON gate (RFC 7493) and the kid rule on the exact bytes it signs, so a\n * claim value that passed schema validation but is not I-JSON, an out-of-range number, or an invalid\n * kid is rejected there rather than emitted. These are the crypto codes reachable when serializing a\n * well-formed claims object, mapped to the same protocol code the verifier reports for the identical\n * raw bytes, so issuance and verification classify the failure the same way. A well-formed claims\n * object cannot produce duplicate member names, but the mapping is complete for robustness. Any other\n * crypto code (for example an invalid key length) falls back to the generic validation code; the\n * original CryptoError is always retained as the cause.\n */\nconst CRYPTO_ISSUANCE_CODE_MAP: Record<string, string> = {\n CRYPTO_JWS_MISSING_KID: 'E_JWS_MISSING_KID',\n CRYPTO_IJSON_INVALID_STRING: 'E_IJSON_INVALID_STRING',\n CRYPTO_IJSON_NUMBER_OUT_OF_RANGE: 'E_IJSON_NUMBER_OUT_OF_RANGE',\n CRYPTO_IJSON_DUPLICATE_MEMBER_NAME: 'E_IJSON_DUPLICATE_MEMBER_NAME',\n};\n\nfunction issueErrorFromCryptoError(err: CryptoError): IssueError {\n const code = CRYPTO_ISSUANCE_CODE_MAP[err.code] ?? 'E_INVALID_FORMAT';\n const issueError = new IssueError({\n code,\n category: 'validation',\n severity: 'error',\n retryable: false,\n http_status: 400,\n details: { message: err.message },\n } as PEACError);\n // Retain the exact crypto classification for diagnostics without widening the public code surface.\n (issueError as { cause?: unknown }).cause = err;\n return issueError;\n}\n\n/**\n * Issues a legacy Wire 0.1 receipt.\n *\n * @deprecated Use {@link issue} for current stable issuance. Wire 0.1\n * issuance is retained for backward compatibility but discouraged for new\n * applications.\n *\n * @param options - Wire 0.1 record options\n * @returns Issue result with JWS and optional subject_snapshot\n * @throws IssueError if evidence contains non-JSON-safe values\n */\nexport async function issueWire01(options: IssueWire01Options): Promise<IssueResult> {\n // Validate URLs\n if (!options.iss.startsWith('https://')) {\n throw new Error('Issuer URL must start with https://');\n }\n if (!options.aud.startsWith('https://')) {\n throw new Error('Audience URL must start with https://');\n }\n if (options.subject && !options.subject.startsWith('https://')) {\n throw new Error('Subject URI must start with https://');\n }\n\n // Validate currency code\n if (!/^[A-Z]{3}$/.test(options.cur)) {\n throw new Error('Currency must be ISO 4217 uppercase (e.g., USD)');\n }\n\n // Validate amount\n if (!Number.isInteger(options.amt) || options.amt < 0) {\n throw new Error('Amount must be a non-negative integer');\n }\n\n // Validate expiry (if provided)\n if (options.exp !== undefined) {\n if (!Number.isInteger(options.exp) || options.exp < 0) {\n throw new Error('Expiry must be a non-negative integer');\n }\n }\n\n // Normalize and validate purpose (v0.9.24+)\n let purposeDeclared: PurposeToken[] | undefined;\n if (options.purpose !== undefined) {\n // Normalize to array\n const rawPurposes = Array.isArray(options.purpose) ? options.purpose : [options.purpose];\n\n // Validate each token\n const invalidTokens: string[] = [];\n for (const token of rawPurposes) {\n if (!isValidPurposeToken(token)) {\n invalidTokens.push(token);\n }\n }\n if (invalidTokens.length > 0) {\n throw new Error(`Invalid purpose tokens: ${invalidTokens.join(', ')}`);\n }\n\n // Check for explicit 'undeclared' which is invalid on wire\n if (rawPurposes.includes('undeclared')) {\n throw new Error(\"Explicit 'undeclared' is not a valid purpose token (internal-only)\");\n }\n\n purposeDeclared = rawPurposes;\n }\n\n // Validate purpose_enforced (must be canonical)\n if (options.purpose_enforced !== undefined) {\n if (!isCanonicalPurpose(options.purpose_enforced)) {\n throw new Error(\n `purpose_enforced must be a canonical purpose, got: ${options.purpose_enforced}`\n );\n }\n }\n\n // Validate purpose_reason\n if (options.purpose_reason !== undefined) {\n if (!isValidPurposeReason(options.purpose_reason)) {\n throw new Error(`Invalid purpose_reason: ${options.purpose_reason}`);\n }\n }\n\n // Validate workflow_context (v0.10.2+)\n if (options.workflow_context !== undefined) {\n if (!isValidWorkflowContext(options.workflow_context)) {\n throw new IssueError(\n createWorkflowContextInvalidError('Does not conform to WorkflowContextSchema')\n );\n }\n if (!hasValidDagSemantics(options.workflow_context)) {\n // Determine specific reason\n const ctx = options.workflow_context;\n const isSelfParent = ctx.parent_step_ids.includes(ctx.step_id);\n const hasDuplicates = new Set(ctx.parent_step_ids).size !== ctx.parent_step_ids.length;\n const reason = isSelfParent ? 'self_parent' : hasDuplicates ? 'duplicate_parent' : 'cycle';\n throw new IssueError(createWorkflowDagInvalidError(reason));\n }\n }\n\n // Generate UUIDv7 for receipt ID\n const rid = uuidv7();\n\n // Get current timestamp\n const iat = Math.floor(Date.now() / 1000);\n\n // Build receipt claims\n const claims: PEACReceiptClaims = {\n iss: options.iss,\n aud: options.aud,\n iat,\n rid,\n amt: options.amt,\n cur: options.cur,\n payment: {\n rail: options.rail,\n reference: options.reference,\n amount: options.amt,\n currency: options.cur,\n asset: options.asset ?? options.cur, // Default asset to currency for backward compatibility\n env: options.env ?? 'test', // Default to test environment for backward compatibility\n evidence: options.evidence ?? {}, // Default to empty object for backward compatibility\n ...(options.network && { network: options.network }),\n ...(options.facilitator_ref && { facilitator_ref: options.facilitator_ref }),\n ...(options.idempotency_key && { idempotency_key: options.idempotency_key }),\n ...(options.metadata && { metadata: options.metadata }),\n },\n ...(options.exp && { exp: options.exp }),\n ...(options.subject && { subject: { uri: options.subject } }),\n // Build extensions (merge user-provided ext with workflow_context)\n ...((options.ext || options.workflow_context) && {\n ext: {\n ...options.ext,\n ...(options.workflow_context && {\n [WORKFLOW_EXTENSION_KEY]: options.workflow_context,\n }),\n },\n }),\n // Purpose claims (v0.9.24+)\n ...(purposeDeclared && { purpose_declared: purposeDeclared }),\n ...(options.purpose_enforced && { purpose_enforced: options.purpose_enforced }),\n ...(options.purpose_reason && { purpose_reason: options.purpose_reason }),\n };\n\n // Validate structural kernel constraints before signing (fail-closed)\n const constraintResult = validateKernelConstraints(claims);\n if (!constraintResult.valid) {\n throw new IssueError(createConstraintViolationError(constraintResult.violations));\n }\n\n // Validate claims with Zod - map evidence errors to typed error\n try {\n ReceiptClaims.parse(claims);\n } catch (err: unknown) {\n if (err instanceof ZodError) {\n // Check if any error path touches evidence\n const evidenceIssue = err.issues.find((issue) =>\n issue.path.some((p) => p === 'evidence' || p === 'payment')\n );\n if (evidenceIssue && evidenceIssue.path.includes('evidence')) {\n const peacError = createEvidenceNotJsonError(\n evidenceIssue.message,\n evidenceIssue.path as (string | number)[]\n );\n throw new IssueError(peacError);\n }\n }\n throw err;\n }\n\n // Validate subject_snapshot if provided (v0.9.17+)\n // This validates schema and logs advisory PII warning if applicable\n const validatedSnapshot = validateSubjectSnapshot(options.subject_snapshot);\n\n // Track start time for telemetry\n const startTime = performance.now();\n\n // Sign with Ed25519\n const jws = await sign(claims, options.privateKey, options.kid);\n\n // Emit telemetry (fire-and-forget, guarded)\n fireTelemetryHook(options.telemetry?.onReceiptIssued, {\n receiptHash: hashReceipt(jws),\n issuer: options.iss,\n kid: options.kid,\n durationMs: performance.now() - startTime,\n });\n\n return {\n jws,\n ...(validatedSnapshot && { subject_snapshot: validatedSnapshot }),\n };\n}\n\n/**\n * Issue a Wire 0.1 PEAC record and return just the JWS string\n *\n * @deprecated Wire 0.1 issuance is frozen legacy. Use {@link issue} for the current stable format.\n *\n * @param options - Wire 0.1 record options\n * @returns JWS compact serialization\n */\nexport async function issueJws(options: IssueWire01Options): Promise<string> {\n const result = await issueWire01(options);\n return result.jws;\n}\n\n/**\n * Issue a PEAC record in the current stable public format.\n *\n * This is the canonical public issuance API. It issues Wire 0.2 records\n * (`typ: interaction-record+jwt`). For an explicit wire-pinned API, use\n * {@link issueWire02} directly.\n *\n * @param options - Record options (same as {@link IssueWire02Options})\n * @returns Issue result with JWS\n * @throws IssueError if iss is not canonical or schema validation fails\n */\nexport async function issue(options: IssueWire02Options): Promise<IssueResult> {\n return issueWire02(options);\n}\n\n// ---------------------------------------------------------------------------\n// Wire 0.2 issuance (v0.12.0-preview.1)\n// ---------------------------------------------------------------------------\n\n/**\n * Options for issuing a Wire 0.2 record\n */\nexport interface IssueWire02Options {\n /**\n * Canonical issuer.\n * Accepted: https:// ASCII origin or did: identifier.\n * Non-canonical values produce an IssueError.\n */\n iss: string;\n\n /** Structural kind: 'evidence' or 'challenge' */\n kind: 'evidence' | 'challenge';\n\n /**\n * Open semantic type.\n * Accepted: reverse-DNS notation (e.g., 'org.example/flow') or absolute URI.\n */\n type: string;\n\n /** Ed25519 private key (32 bytes) */\n privateKey: Uint8Array;\n\n /** Key ID: non-empty, well-formed Unicode, at most 256 UTF-8 bytes (a PEAC constraint; RFC 7515 leaves kid structure unspecified) */\n kid: string;\n\n /**\n * Unique receipt identifier.\n * Generated via uuidv7 if not provided.\n */\n jti?: string;\n\n /** Subject identifier (max 2048 chars, optional) */\n sub?: string;\n\n /**\n * Evidence pillars (sorted ascending, closed 10-value taxonomy).\n * Validated against Wire02ClaimsSchema before signing.\n */\n pillars?: EvidencePillar[];\n\n /**\n * ISO 8601 / RFC 3339 timestamp when the interaction occurred.\n * Evidence kind only; rejected on challenge kind with E_OCCURRED_AT_ON_CHALLENGE.\n */\n occurred_at?: string;\n\n /** Declared purpose string (max 256 chars, optional) */\n purpose_declared?: string;\n\n /**\n * Policy binding block.\n * digest must be 'sha256:<64 lowercase hex>' format (use computePolicyDigestJcs from @peac/protocol).\n */\n policy?: PolicyBlock;\n\n /** Extension groups (open; caller-provided, not validated here) */\n extensions?: Record<string, unknown>;\n}\n\n/**\n * Canonical issuance options type.\n *\n * Alias for {@link IssueWire02Options}: the current stable receipt format.\n */\nexport type IssueOptions = IssueWire02Options;\n\n/**\n * Issue a Wire 0.2 record (explicit wire-pinned API).\n *\n * Most callers should use {@link issue} instead, which delegates here.\n * Use `issueWire02` directly for conformance tests, benchmarks, and\n * callers that need explicit wire version pinning.\n *\n * Validates the iss canonical form and Wire02ClaimsSchema before signing.\n * Always sets typ to 'interaction-record+jwt' (WIRE_02_JWS_TYP).\n *\n * @param options - Wire 0.2 record options\n * @returns Issue result with JWS\n * @throws IssueError if iss is not canonical or schema validation fails\n */\nexport async function issueWire02(options: IssueWire02Options): Promise<IssueResult> {\n // Internal rollback-path flag. Selects the bounded-validation\n // admission gate (default) or the inline canonical schema check\n // (rollback). Both branches share the canonical materializer that\n // builds the IssueResult and the JWS bytes.\n const legacyPath = readLegacyPathFlag(options as unknown as LegacyPathOptions);\n\n // Validate canonical iss before signing\n if (!isCanonicalIss(options.iss)) {\n throw new IssueError({\n code: 'E_ISS_NOT_CANONICAL',\n category: 'validation',\n severity: 'error',\n retryable: false,\n http_status: 400,\n details: {\n message: `iss is not in canonical form: \"${options.iss}\". Use an https://<origin> or did:<method> identifier.`,\n },\n } as PEACError);\n }\n\n // Generate jti if not provided\n const jti = options.jti ?? uuidv7();\n\n // Get current timestamp\n const iat = Math.floor(Date.now() / 1000);\n\n // Build Wire 0.2 claims\n const claims: Wire02Claims = {\n peac_version: '0.2',\n kind: options.kind,\n type: options.type,\n iss: options.iss,\n iat,\n jti,\n ...(options.sub !== undefined && { sub: options.sub }),\n ...(options.pillars !== undefined && { pillars: options.pillars }),\n ...(options.occurred_at !== undefined && { occurred_at: options.occurred_at }),\n ...(options.purpose_declared !== undefined && { purpose_declared: options.purpose_declared }),\n ...(options.policy !== undefined && { policy: options.policy }),\n ...(options.extensions !== undefined && { extensions: options.extensions }),\n };\n\n // Validate schema before signing (fail-closed). The default branch\n // routes through the bounded validation gate; the rollback branch\n // retains the inline canonical schema check. Both branches produce\n // byte-identical JWS bytes for every input both branches accept.\n if (legacyPath) {\n const parseResult = Wire02ClaimsSchema.safeParse(claims);\n if (!parseResult.success) {\n const firstIssue = parseResult.error.issues[0];\n throw new IssueError({\n code: 'E_INVALID_FORMAT',\n category: 'validation',\n severity: 'error',\n retryable: false,\n http_status: 400,\n details: {\n message: `Wire 0.2 claims schema validation failed: ${firstIssue?.message ?? 'unknown'}`,\n },\n } as PEACError);\n }\n } else {\n const gateResult = runBoundedValidationGate({\n surface: 'issueWire02',\n payload: claims as unknown,\n });\n if (!gateResult.ok) {\n throw new IssueError({\n code: gateResult.code,\n category: 'validation',\n severity: 'error',\n retryable: false,\n http_status: 400,\n details: { message: gateResult.message },\n } as PEACError);\n }\n }\n\n // Sign with Wire 0.2 via the internal codec boundary (always sets\n // typ: 'interaction-record+jwt'). Default codec is a pure pass-through\n // to @peac/crypto.signWire02; serialized output is byte-identical to\n // the prior release. The signer enforces the raw-bytes I-JSON gate and\n // the kid rule; present any such failure through the same structured\n // IssueError surface as every other issuance failure rather than leaking\n // a raw crypto error from this public API.\n let jws: string;\n try {\n jws = await defaultCodec.encode(claims, options.privateKey, options.kid);\n } catch (err) {\n if (err instanceof CryptoError) {\n throw issueErrorFromCryptoError(err);\n }\n throw err;\n }\n\n // Shadow scheduling fires only on the rollback branch where the\n // bounded validator is genuinely a comparison path; under the\n // default branch the bounded validator runs as the production\n // admission gate, so a duplicate shadow run would compare the same\n // code path against itself.\n if (legacyPath && isShadowEnabled(options as unknown as ShadowEnableOptions)) {\n scheduleShadow<ShadowObservation>({\n call: 'issue',\n realResult: realObservationForIssue(),\n realError: undefined,\n shadowFn: async () =>\n shadowObservationFromBoundedAcceptedOnly(\n runBoundedValidatorShadow({\n claims: {\n kind: claims.kind,\n type: claims.type,\n iss: claims.iss,\n iat: claims.iat,\n occurred_at: claims.occurred_at,\n extensions: claims.extensions,\n },\n now: iat,\n })\n ),\n recordRef: jws,\n });\n }\n\n return { jws };\n}\n","/**\n * PEAC Discovery - Issuer Configuration and Policy Manifest\n *\n * This module provides functions for:\n * - Issuer configuration discovery (/.well-known/peac-issuer.json)\n * - Policy manifest parsing (/.well-known/peac.txt)\n *\n * @see docs/specs/PEAC-ISSUER.md\n * @see docs/specs/PEAC-TXT.md\n */\n\nimport {\n PEACIssuerConfig,\n PEACPolicyManifest,\n PEACDiscovery,\n PEAC_ISSUER_CONFIG_PATH,\n PEAC_ISSUER_CONFIG_MAX_BYTES,\n PEAC_POLICY_PATH,\n PEAC_POLICY_FALLBACK_PATH,\n PEAC_POLICY_MAX_BYTES,\n validateRevokedKeys,\n} from '@peac/schema';\n\n// ============================================================================\n// Issuer Configuration (/.well-known/peac-issuer.json)\n// ============================================================================\n\n/**\n * Parse PEAC issuer configuration from JSON\n *\n * @param json - JSON string or object\n * @returns Parsed issuer configuration\n * @throws Error if validation fails\n */\nexport function parseIssuerConfig(json: string | object): PEACIssuerConfig {\n let config: unknown;\n\n if (typeof json === 'string') {\n const bytes = new TextEncoder().encode(json).length;\n if (bytes > PEAC_ISSUER_CONFIG_MAX_BYTES) {\n throw new Error(`Issuer config exceeds ${PEAC_ISSUER_CONFIG_MAX_BYTES} bytes (got ${bytes})`);\n }\n\n try {\n config = JSON.parse(json);\n } catch (err) {\n throw new Error('Issuer config is not valid JSON', { cause: err });\n }\n } else {\n config = json;\n }\n\n if (typeof config !== 'object' || config === null) {\n throw new Error('Issuer config must be an object');\n }\n\n const obj = config as Record<string, unknown>;\n\n // Validate required fields\n if (typeof obj.version !== 'string' || !obj.version) {\n throw new Error('Missing required field: version');\n }\n if (typeof obj.issuer !== 'string' || !obj.issuer) {\n throw new Error('Missing required field: issuer');\n }\n if (typeof obj.jwks_uri !== 'string' || !obj.jwks_uri) {\n throw new Error('Missing required field: jwks_uri');\n }\n\n // Validate URL fields\n if (!obj.issuer.startsWith('https://')) {\n throw new Error('issuer must be an HTTPS URL');\n }\n // jwks_uri: validate URL syntax only. HTTPS enforcement is the resolver's\n // responsibility (jwks-resolver.ts), keeping parser and protocol concerns\n // separated. This makes E_VERIFY_JWKS_URI_INVALID a reachable error code.\n try {\n new URL(obj.jwks_uri);\n } catch (err) {\n throw new Error('jwks_uri must be a valid URL', { cause: err });\n }\n\n // Validate optional fields\n if (obj.verify_endpoint !== undefined) {\n if (typeof obj.verify_endpoint !== 'string') {\n throw new Error('verify_endpoint must be a string');\n }\n if (!obj.verify_endpoint.startsWith('https://')) {\n throw new Error('verify_endpoint must be an HTTPS URL');\n }\n }\n\n if (obj.receipt_versions !== undefined) {\n if (!Array.isArray(obj.receipt_versions)) {\n throw new Error('receipt_versions must be an array');\n }\n }\n\n if (obj.algorithms !== undefined) {\n if (!Array.isArray(obj.algorithms)) {\n throw new Error('algorithms must be an array');\n }\n }\n\n if (obj.payment_rails !== undefined) {\n if (!Array.isArray(obj.payment_rails)) {\n throw new Error('payment_rails must be an array');\n }\n }\n\n // Validate revoked_keys (v0.11.3+)\n let revokedKeys: PEACIssuerConfig['revoked_keys'];\n if (obj.revoked_keys !== undefined) {\n if (!Array.isArray(obj.revoked_keys)) {\n throw new Error('revoked_keys must be an array');\n }\n const result = validateRevokedKeys(obj.revoked_keys);\n if (!result.ok) {\n throw new Error(`Invalid revoked_keys: ${result.error}`);\n }\n revokedKeys = result.value;\n }\n\n return {\n version: obj.version,\n issuer: obj.issuer,\n jwks_uri: obj.jwks_uri,\n verify_endpoint: obj.verify_endpoint as string | undefined,\n receipt_versions: obj.receipt_versions as string[] | undefined,\n algorithms: obj.algorithms as string[] | undefined,\n payment_rails: obj.payment_rails as string[] | undefined,\n security_contact: obj.security_contact as string | undefined,\n revoked_keys: revokedKeys,\n };\n}\n\n/**\n * Fetch PEAC issuer configuration from an issuer URL\n *\n * @param issuerUrl - Issuer URL (https://)\n * @returns Parsed issuer configuration\n * @throws Error if fetch or validation fails\n */\nexport async function fetchIssuerConfig(issuerUrl: string): Promise<PEACIssuerConfig> {\n if (!issuerUrl.startsWith('https://')) {\n throw new Error('Issuer URL must be https://');\n }\n\n // Remove trailing slash for consistent URL construction\n const baseUrl = issuerUrl.replace(/\\/$/, '');\n const configUrl = `${baseUrl}${PEAC_ISSUER_CONFIG_PATH}`;\n\n try {\n const resp = await fetch(configUrl, {\n headers: { Accept: 'application/json' },\n signal: AbortSignal.timeout(10000),\n });\n\n if (!resp.ok) {\n throw new Error(`Issuer config fetch failed: ${resp.status}`);\n }\n\n const text = await resp.text();\n const config = parseIssuerConfig(text);\n\n // Verify issuer matches\n const normalizedExpected = baseUrl.replace(/\\/$/, '');\n const normalizedActual = config.issuer.replace(/\\/$/, '');\n if (normalizedActual !== normalizedExpected) {\n throw new Error(`Issuer mismatch: expected ${normalizedExpected}, got ${normalizedActual}`);\n }\n\n return config;\n } catch (err) {\n throw new Error(\n `Failed to fetch issuer config from ${issuerUrl}: ${\n err instanceof Error ? err.message : String(err)\n }`,\n { cause: err }\n );\n }\n}\n\n// ============================================================================\n// Policy Manifest (/.well-known/peac.txt)\n// ============================================================================\n\n/**\n * Detect if content is JSON or YAML\n */\nfunction isJsonContent(text: string, contentType?: string): boolean {\n if (contentType?.includes('application/json')) {\n return true;\n }\n const firstChar = text.trimStart()[0];\n return firstChar === '{';\n}\n\n/**\n * Parse PEAC policy manifest from YAML or JSON\n *\n * @param text - Policy manifest text (YAML or JSON)\n * @param contentType - Optional Content-Type header value\n * @returns Parsed policy manifest\n * @throws Error if validation fails\n */\nexport function parsePolicyManifest(text: string, contentType?: string): PEACPolicyManifest {\n const bytes = new TextEncoder().encode(text).length;\n if (bytes > PEAC_POLICY_MAX_BYTES) {\n throw new Error(`Policy manifest exceeds ${PEAC_POLICY_MAX_BYTES} bytes (got ${bytes})`);\n }\n\n let manifest: Record<string, unknown>;\n\n if (isJsonContent(text, contentType)) {\n // Parse as JSON\n try {\n manifest = JSON.parse(text);\n } catch (err) {\n throw new Error('Policy manifest is not valid JSON', { cause: err });\n }\n } else {\n // Parse as simple YAML (key: value format)\n manifest = parseSimpleYaml(text);\n }\n\n // Validate required fields\n if (typeof manifest.version !== 'string' || !manifest.version) {\n throw new Error('Missing required field: version');\n }\n\n // Validate version format: must be peac-policy/<major>.<minor>\n if (!manifest.version.startsWith('peac-policy/')) {\n throw new Error(\n `Invalid version format: \"${manifest.version}\". Must start with \"peac-policy/\" (e.g., \"peac-policy/0.1\")`\n );\n }\n\n if (manifest.usage !== 'open' && manifest.usage !== 'conditional') {\n throw new Error('Missing or invalid field: usage (must be \"open\" or \"conditional\")');\n }\n\n return {\n version: manifest.version,\n usage: manifest.usage as 'open' | 'conditional',\n purposes: manifest.purposes as string[] | undefined,\n receipts: manifest.receipts as 'required' | 'optional' | 'omit' | undefined,\n attribution: manifest.attribution as 'required' | 'optional' | 'none' | undefined,\n rate_limit: manifest.rate_limit as string | undefined,\n daily_limit: manifest.daily_limit as number | undefined,\n negotiate: manifest.negotiate as string | undefined,\n contact: manifest.contact as string | undefined,\n license: manifest.license as string | undefined,\n price: manifest.price as number | undefined,\n currency: manifest.currency as string | undefined,\n payment_methods: manifest.payment_methods as string[] | undefined,\n payment_endpoint: manifest.payment_endpoint as string | undefined,\n };\n}\n\n/**\n * Parse simple YAML (key: value format, no complex features)\n * Rejects YAML features that are security risks (anchors, aliases, tags)\n */\nfunction parseSimpleYaml(text: string): Record<string, unknown> {\n const lines = text.split('\\n');\n const result: Record<string, unknown> = {};\n\n // Security: reject YAML features that are dangerous\n // Check merge keys first (they contain * which would trigger anchor check)\n if (text.includes('<<:')) {\n throw new Error('YAML merge keys are not allowed');\n }\n if (text.includes('&') || text.includes('*')) {\n throw new Error('YAML anchors and aliases are not allowed');\n }\n if (/!\\w+/.test(text)) {\n throw new Error('YAML custom tags are not allowed');\n }\n\n // Count document separators\n const docSeparators = text.match(/^---$/gm);\n if (docSeparators && docSeparators.length > 1) {\n throw new Error('Multi-document YAML is not allowed');\n }\n\n for (const line of lines) {\n const trimmed = line.trim();\n\n // Skip empty lines, comments, and document markers\n if (!trimmed || trimmed.startsWith('#') || trimmed === '---') {\n continue;\n }\n\n // Parse key: value\n const colonIndex = trimmed.indexOf(':');\n if (colonIndex === -1) continue;\n\n const key = trimmed.slice(0, colonIndex).trim();\n let value: unknown = trimmed.slice(colonIndex + 1).trim();\n\n // Parse value types\n if (value === '') {\n value = undefined;\n } else if (typeof value === 'string') {\n // Remove quotes if present\n if (\n (value.startsWith('\"') && value.endsWith('\"')) ||\n (value.startsWith(\"'\") && value.endsWith(\"'\"))\n ) {\n value = value.slice(1, -1);\n }\n // Parse arrays [a, b, c]\n else if (value.startsWith('[') && value.endsWith(']')) {\n const inner = value.slice(1, -1);\n value = inner\n .split(',')\n .map((s) => s.trim())\n .filter((s) => s.length > 0);\n }\n // Parse numbers\n else if (/^-?\\d+(\\.\\d+)?$/.test(value)) {\n value = parseFloat(value);\n }\n // Parse booleans\n else if (value === 'true') {\n value = true;\n } else if (value === 'false') {\n value = false;\n }\n }\n\n if (value !== undefined) {\n result[key] = value;\n }\n }\n\n return result;\n}\n\n/**\n * Fetch PEAC policy manifest from a domain\n *\n * @param baseUrl - Base URL (https://example.com)\n * @returns Parsed policy manifest\n * @throws Error if fetch or validation fails\n */\nexport async function fetchPolicyManifest(baseUrl: string): Promise<PEACPolicyManifest> {\n if (!baseUrl.startsWith('https://') && !baseUrl.startsWith('http://localhost')) {\n throw new Error('Base URL must be https://');\n }\n\n const normalizedBase = baseUrl.replace(/\\/$/, '');\n const primaryUrl = `${normalizedBase}${PEAC_POLICY_PATH}`;\n const fallbackUrl = `${normalizedBase}${PEAC_POLICY_FALLBACK_PATH}`;\n\n // Try primary location first\n try {\n const resp = await fetch(primaryUrl, {\n headers: { Accept: 'text/plain, application/json' },\n signal: AbortSignal.timeout(5000),\n });\n\n if (resp.ok) {\n const text = await resp.text();\n const contentType = resp.headers.get('content-type') || undefined;\n return parsePolicyManifest(text, contentType);\n }\n\n // If 404, try fallback\n if (resp.status === 404) {\n const fallbackResp = await fetch(fallbackUrl, {\n headers: { Accept: 'text/plain, application/json' },\n signal: AbortSignal.timeout(5000),\n });\n\n if (fallbackResp.ok) {\n const text = await fallbackResp.text();\n const contentType = fallbackResp.headers.get('content-type') || undefined;\n return parsePolicyManifest(text, contentType);\n }\n\n throw new Error('Policy manifest not found at primary or fallback location');\n }\n\n throw new Error(`Policy manifest fetch failed: ${resp.status}`);\n } catch (err) {\n throw new Error(\n `Failed to fetch policy manifest from ${baseUrl}: ${\n err instanceof Error ? err.message : String(err)\n }`,\n { cause: err }\n );\n }\n}\n\n// ============================================================================\n// Deprecated Legacy API (for backward compatibility)\n// ============================================================================\n\n/**\n * @deprecated Parses a legacy dual-purpose `peac.txt` manifest that carried\n * both policy hints and key-discovery fields (`verify`, `jwks`). This shape\n * is retired: `peac.txt` is a policy-document surface per\n * `docs/specs/PEAC-TXT.md`, and the normative key-discovery chain is\n * `iss` -> /.well-known/peac-issuer.json -> `jwks_uri` -> JWKS\n * (see `docs/specs/PEAC-ISSUER.md`). Use `parseIssuerConfig` for issuer\n * metadata, and `@peac/policy-kit.parsePolicyDocument` for `peac-policy/0.1`\n * documents referenced from `peac.txt`. Removal target: next cleanup release.\n *\n * Parse a PEAC discovery manifest from YAML-like text. Retained only for\n * backward compatibility with callers that have not yet migrated.\n */\nexport function parseDiscovery(text: string): PEACDiscovery {\n const bytes = new TextEncoder().encode(text).length;\n if (bytes > 2000) {\n throw new Error(`Discovery manifest exceeds 2000 bytes (got ${bytes})`);\n }\n\n const lines = text.trim().split('\\n');\n if (lines.length > 20) {\n throw new Error(`Discovery manifest exceeds 20 lines (got ${lines.length})`);\n }\n\n const discovery: Partial<PEACIssuerConfig> = {};\n\n for (const line of lines) {\n const trimmed = line.trim();\n if (!trimmed || trimmed.startsWith('#')) {\n continue;\n }\n\n if (trimmed.includes(':')) {\n const [key, ...valueParts] = trimmed.split(':');\n const value = valueParts.join(':').trim();\n\n switch (key.trim()) {\n case 'version':\n discovery.version = value;\n break;\n case 'issuer':\n discovery.issuer = value;\n break;\n case 'verify':\n discovery.verify_endpoint = value;\n break;\n case 'jwks':\n discovery.jwks_uri = value;\n break;\n case 'security':\n discovery.security_contact = value;\n break;\n }\n }\n }\n\n // Validate required fields\n if (!discovery.version) throw new Error('Missing required field: version');\n if (!discovery.issuer) throw new Error('Missing required field: issuer');\n if (!discovery.verify_endpoint) throw new Error('Missing required field: verify');\n if (!discovery.jwks_uri) throw new Error('Missing required field: jwks');\n\n return discovery as PEACDiscovery;\n}\n\n/**\n * @deprecated Fetches /.well-known/peac.txt and parses it as a legacy\n * dual-purpose manifest. This shape is retired: `peac.txt` is a policy\n * document (see `docs/specs/PEAC-TXT.md`) and key discovery flows through\n * `iss` -> /.well-known/peac-issuer.json -> `jwks_uri` -> JWKS\n * (see `docs/specs/PEAC-ISSUER.md`). Use `fetchIssuerConfig` for issuer\n * metadata. To parse the `peac-policy/0.1` document referenced from\n * `peac.txt`, fetch its bytes and call\n * `@peac/policy-kit.parsePolicyDocument`. Removal target: next cleanup\n * release.\n *\n * Fetch and parse PEAC discovery from an issuer URL. Retained only for\n * backward compatibility with callers that have not yet migrated.\n */\nexport async function fetchDiscovery(issuerUrl: string): Promise<PEACDiscovery> {\n if (!issuerUrl.startsWith('https://')) {\n throw new Error('Issuer URL must be https://');\n }\n\n const discoveryUrl = `${issuerUrl}/.well-known/peac.txt`;\n\n try {\n const resp = await fetch(discoveryUrl, {\n headers: { Accept: 'text/plain' },\n signal: AbortSignal.timeout(5000),\n });\n\n if (!resp.ok) {\n throw new Error(`Discovery fetch failed: ${resp.status}`);\n }\n\n const text = await resp.text();\n return parseDiscovery(text);\n } catch (err) {\n throw new Error(\n `Failed to fetch discovery from ${issuerUrl}: ${\n err instanceof Error ? err.message : String(err)\n }`,\n { cause: err }\n );\n }\n}\n","/**\n * SSRF-safe fetch utility for PEAC verifiers\n *\n * Implements SSRF protection per VERIFIER-SECURITY-MODEL.md:\n * - HTTPS only\n * - Block private IP ranges (RFC 1918)\n * - Block link-local addresses\n * - Block loopback addresses\n * - Redirect limits and scheme downgrade protection\n *\n * ## Security Model: Best-Effort Protection\n *\n * **IMPORTANT**: SSRF protection is BEST-EFFORT, not a guarantee. The level of\n * protection depends on the runtime environment's capabilities. In environments\n * without DNS pre-resolution (browsers, edge workers), protection is limited to\n * URL scheme validation and response limits. Defense-in-depth: combine with\n * network-level controls (firewalls, egress filtering) in production.\n *\n * ## Hard Invariants (ALWAYS Enforced)\n *\n * These protections are enforced in ALL runtimes:\n *\n * | Invariant | Enforcement |\n * |-----------|-------------|\n * | HTTPS only | URL scheme validation before fetch |\n * | No redirects (pointer fetch) | `redirect: 'manual'` + policy check |\n * | Response size cap | Streaming with byte counter, abort on limit |\n * | Timeout | AbortController with configurable timeout |\n * | No scheme downgrade | Redirect target scheme validation |\n *\n * ## Runtime-Dependent Protections\n *\n * These protections require DNS pre-resolution capability:\n *\n * | Protection | Requires |\n * |------------|----------|\n * | Private IP blocking (RFC 1918) | DNS pre-resolution |\n * | Loopback blocking (127.0.0.0/8) | DNS pre-resolution |\n * | Link-local blocking (169.254.0.0/16) | DNS pre-resolution |\n *\n * ## Runtime Capability Model\n *\n * SSRF protection capabilities vary by runtime environment:\n *\n * | Runtime | DNS Pre-Resolution | IP Blocking | Notes |\n * |-------------------|-------------------|-------------|-------|\n * | Node.js | YES | YES | Full protection via dns module |\n * | Browser | NO | NO | Relies on server-side validation |\n * | Cloudflare Workers| NO | NO | No DNS access, relies on CF network |\n * | Deno | NO | NO | dns module not available by default |\n * | Bun | YES | YES | Compatible with Node.js dns module |\n *\n * Use `getSSRFCapabilities()` to detect runtime capabilities.\n *\n * @packageDocumentation\n */\n\nimport { VERIFIER_LIMITS, VERIFIER_NETWORK } from '@peac/kernel';\n\n// ---------------------------------------------------------------------------\n// SSRF Capability Model\n// ---------------------------------------------------------------------------\n\n/**\n * Runtime environment where SSRF protection is running\n */\nexport type SSRFRuntime =\n | 'node'\n | 'bun'\n | 'deno'\n | 'browser'\n | 'cloudflare-workers'\n | 'edge-generic'\n | 'unknown';\n\n/**\n * SSRF protection capabilities available in the current runtime\n *\n * These capabilities determine what security measures can be applied:\n * - `dnsPreResolution`: Can resolve hostnames to IPs before connecting\n * - `ipBlocking`: Can inspect and block connections based on resolved IPs\n * - `networkIsolation`: Runtime provides network-level isolation (e.g., CF Workers)\n *\n * When `dnsPreResolution` is false, SSRF protection is limited to:\n * - URL scheme validation (HTTPS only)\n * - Hostname pattern matching (if configured)\n * - Response size limits\n * - Timeout enforcement\n *\n * This is a defense-in-depth model: even without DNS pre-resolution,\n * multiple layers of protection remain active.\n */\nexport interface SSRFCapabilities {\n /** Detected runtime environment */\n runtime: SSRFRuntime;\n /** Can resolve DNS before making HTTP connection */\n dnsPreResolution: boolean;\n /** Can block connections based on resolved IP addresses */\n ipBlocking: boolean;\n /** Runtime provides network-level isolation */\n networkIsolation: boolean;\n /** Human-readable description of protection level */\n protectionLevel: 'full' | 'partial' | 'minimal';\n /** Advisory notes for operators */\n notes: string[];\n}\n\n/**\n * Cached capabilities (detected once per process)\n */\nlet cachedCapabilities: SSRFCapabilities | null = null;\n\n/**\n * Detect SSRF protection capabilities for the current runtime\n *\n * This function performs runtime detection and returns a capability object\n * that describes what SSRF protections are available.\n *\n * @returns SSRF capabilities for the current runtime\n *\n * @example\n * ```typescript\n * const caps = getSSRFCapabilities();\n * if (!caps.dnsPreResolution) {\n * console.warn('Running without DNS pre-resolution; SSRF protection is limited');\n * }\n * ```\n */\nexport function getSSRFCapabilities(): SSRFCapabilities {\n if (cachedCapabilities) {\n return cachedCapabilities;\n }\n\n cachedCapabilities = detectCapabilities();\n return cachedCapabilities;\n}\n\n/**\n * Internal: Detect runtime capabilities\n */\nfunction detectCapabilities(): SSRFCapabilities {\n // Check for Node.js\n if (typeof process !== 'undefined' && process.versions?.node) {\n return {\n runtime: 'node',\n dnsPreResolution: true,\n ipBlocking: true,\n networkIsolation: false,\n protectionLevel: 'full',\n notes: [\n 'Full SSRF protection available via Node.js dns module',\n 'DNS resolution checked before HTTP connection',\n 'All RFC 1918 private ranges blocked',\n ],\n };\n }\n\n // Check for Bun\n if (typeof process !== 'undefined' && process.versions?.bun) {\n return {\n runtime: 'bun',\n dnsPreResolution: true,\n ipBlocking: true,\n networkIsolation: false,\n protectionLevel: 'full',\n notes: [\n 'Full SSRF protection available via Bun dns compatibility',\n 'DNS resolution checked before HTTP connection',\n ],\n };\n }\n\n // Check for Deno\n if (typeof globalThis !== 'undefined' && 'Deno' in globalThis) {\n return {\n runtime: 'deno',\n dnsPreResolution: false,\n ipBlocking: false,\n networkIsolation: false,\n protectionLevel: 'partial',\n notes: [\n 'DNS pre-resolution not available in Deno by default',\n 'SSRF protection limited to URL validation and response limits',\n 'Consider using Deno.connect with hostname resolution for enhanced protection',\n ],\n };\n }\n\n // Check for Cloudflare Workers\n if (\n typeof globalThis !== 'undefined' &&\n typeof (globalThis as Record<string, unknown>).caches !== 'undefined' &&\n typeof (globalThis as Record<string, unknown>).HTMLRewriter !== 'undefined'\n ) {\n return {\n runtime: 'cloudflare-workers',\n dnsPreResolution: false,\n ipBlocking: false,\n networkIsolation: true,\n protectionLevel: 'partial',\n notes: [\n 'Cloudflare Workers provide network-level isolation',\n 'DNS pre-resolution not available in Workers runtime',\n 'CF network blocks many SSRF vectors at infrastructure level',\n 'SSRF protection supplemented by URL validation and response limits',\n ],\n };\n }\n\n // Check for browser environment\n // Use globalThis to avoid DOM type references\n const g = globalThis as Record<string, unknown>;\n if (typeof g.window !== 'undefined' || typeof g.document !== 'undefined') {\n return {\n runtime: 'browser',\n dnsPreResolution: false,\n ipBlocking: false,\n networkIsolation: false,\n protectionLevel: 'minimal',\n notes: [\n 'Browser environment detected; DNS pre-resolution not available',\n 'SSRF protection limited to URL scheme validation',\n 'Consider validating URLs server-side before browser fetch',\n 'Same-origin policy provides some protection against SSRF',\n ],\n };\n }\n\n // Generic edge runtime\n return {\n runtime: 'edge-generic',\n dnsPreResolution: false,\n ipBlocking: false,\n networkIsolation: false,\n protectionLevel: 'partial',\n notes: [\n 'Edge runtime detected; DNS pre-resolution may not be available',\n 'SSRF protection limited to URL validation and response limits',\n 'Verify runtime provides additional network-level protections',\n ],\n };\n}\n\n/**\n * Reset cached capabilities (for testing)\n * @internal\n */\nexport function resetSSRFCapabilitiesCache(): void {\n cachedCapabilities = null;\n}\n\n/**\n * SSRF fetch options\n */\nexport interface SSRFFetchOptions {\n /** Timeout in milliseconds (default: VERIFIER_LIMITS.fetchTimeoutMs) */\n timeoutMs?: number;\n /** Maximum response size in bytes (default: VERIFIER_LIMITS.maxResponseBytes) */\n maxBytes?: number;\n /** Maximum redirects to follow (default: 0 for SSRF safety) */\n maxRedirects?: number;\n /** Allow redirects (default: VERIFIER_NETWORK.allowRedirects) */\n allowRedirects?: boolean;\n /**\n * Allow cross-origin redirects (default: true for CDN compatibility).\n * When true, redirects to different origins are allowed if the target passes SSRF checks.\n * When false, redirects must stay within the same origin.\n */\n allowCrossOriginRedirects?: boolean;\n /**\n * How to handle DNS resolution failures (default: 'block' for fail-closed security).\n * - 'block': Treat DNS failure as blocked (fail-closed, recommended)\n * - 'fail': Return network_error and allow caller to decide\n */\n dnsFailureBehavior?: 'block' | 'fail';\n /** Custom headers to include */\n headers?: Record<string, string>;\n}\n\n/**\n * SSRF fetch result\n */\nexport interface SSRFFetchResult {\n /** Whether the fetch succeeded */\n ok: true;\n /** Response status code */\n status: number;\n /** Response body as string */\n body: string;\n /**\n * Raw response bytes for digest computation.\n * Use this for computing digests to avoid encoding round-trip issues.\n */\n rawBytes: Uint8Array;\n /** Response content type */\n contentType?: string;\n}\n\n/**\n * SSRF fetch error\n */\nexport interface SSRFFetchError {\n /** Fetch failed */\n ok: false;\n /** Error reason code */\n reason:\n | 'invalid_url'\n | 'not_https'\n | 'private_ip'\n | 'loopback'\n | 'link_local'\n | 'dns_failure'\n | 'too_many_redirects'\n | 'scheme_downgrade'\n | 'cross_origin_redirect'\n | 'timeout'\n | 'response_too_large'\n | 'jwks_too_many_keys'\n | 'network_error';\n /** Human-readable error message */\n message: string;\n /** Blocked URL (if applicable) */\n blockedUrl?: string;\n}\n\n/**\n * IPv4 address parsed into components\n */\ninterface IPv4Address {\n octets: [number, number, number, number];\n}\n\n/**\n * Parse an IPv4 address string into octets\n */\nfunction parseIPv4(ip: string): IPv4Address | null {\n const parts = ip.split('.');\n if (parts.length !== 4) return null;\n\n const octets: number[] = [];\n for (const part of parts) {\n const num = parseInt(part, 10);\n if (isNaN(num) || num < 0 || num > 255) return null;\n octets.push(num);\n }\n\n return { octets: octets as [number, number, number, number] };\n}\n\n/**\n * Check if an IPv4 address is in a CIDR range\n */\nfunction isInCIDR(ip: IPv4Address, cidr: string): boolean {\n const [rangeStr, maskStr] = cidr.split('/');\n const range = parseIPv4(rangeStr);\n if (!range) return false;\n\n const maskBits = parseInt(maskStr, 10);\n if (isNaN(maskBits) || maskBits < 0 || maskBits > 32) return false;\n\n // Convert to 32-bit integers\n const ipNum = (ip.octets[0] << 24) | (ip.octets[1] << 16) | (ip.octets[2] << 8) | ip.octets[3];\n const rangeNum =\n (range.octets[0] << 24) | (range.octets[1] << 16) | (range.octets[2] << 8) | range.octets[3];\n\n // Create mask\n const mask = maskBits === 0 ? 0 : ~((1 << (32 - maskBits)) - 1);\n\n return (ipNum & mask) === (rangeNum & mask);\n}\n\n/**\n * Check if an IPv6 address is loopback (::1)\n */\nfunction isIPv6Loopback(ip: string): boolean {\n const normalized = ip.toLowerCase().replace(/^::ffff:/, '');\n return normalized === '::1' || normalized === '0:0:0:0:0:0:0:1';\n}\n\n/**\n * Check if an IPv6 address is link-local (fe80::/10)\n */\nfunction isIPv6LinkLocal(ip: string): boolean {\n const normalized = ip.toLowerCase();\n return (\n normalized.startsWith('fe8') ||\n normalized.startsWith('fe9') ||\n normalized.startsWith('fea') ||\n normalized.startsWith('feb')\n );\n}\n\n/**\n * Check if an IP address is private/blocked\n */\nexport function isBlockedIP(\n ip: string\n): { blocked: true; reason: 'private_ip' | 'loopback' | 'link_local' } | { blocked: false } {\n // Handle IPv4-mapped IPv6 addresses\n const ipv4Match = ip.match(/^::ffff:(\\d+\\.\\d+\\.\\d+\\.\\d+)$/i);\n const effectiveIP = ipv4Match ? ipv4Match[1] : ip;\n\n // Check IPv4\n const ipv4 = parseIPv4(effectiveIP);\n if (ipv4) {\n // RFC 1918 private ranges\n if (\n isInCIDR(ipv4, '10.0.0.0/8') ||\n isInCIDR(ipv4, '172.16.0.0/12') ||\n isInCIDR(ipv4, '192.168.0.0/16')\n ) {\n return { blocked: true, reason: 'private_ip' };\n }\n\n // Loopback\n if (isInCIDR(ipv4, '127.0.0.0/8')) {\n return { blocked: true, reason: 'loopback' };\n }\n\n // Link-local\n if (isInCIDR(ipv4, '169.254.0.0/16')) {\n return { blocked: true, reason: 'link_local' };\n }\n\n return { blocked: false };\n }\n\n // Check IPv6\n if (isIPv6Loopback(ip)) {\n return { blocked: true, reason: 'loopback' };\n }\n if (isIPv6LinkLocal(ip)) {\n return { blocked: true, reason: 'link_local' };\n }\n\n return { blocked: false };\n}\n\n/**\n * DNS resolution result\n */\ninterface DNSResolutionResult {\n /** Whether resolution succeeded */\n ok: true;\n /** Resolved IP addresses */\n ips: string[];\n /** Whether this is a browser environment (no pre-resolution possible) */\n browser: boolean;\n}\n\n/**\n * DNS resolution failure\n */\ninterface DNSResolutionFailure {\n /** Resolution failed */\n ok: false;\n /** Error message */\n message: string;\n}\n\n/**\n * Resolve hostname to IP addresses (platform-specific)\n *\n * In Node.js environments, this uses dns.resolve.\n * In browser environments, we cannot check IPs before fetch.\n */\nasync function resolveHostname(\n hostname: string\n): Promise<DNSResolutionResult | DNSResolutionFailure> {\n // Node.js environment detection\n if (typeof process !== 'undefined' && process.versions?.node) {\n try {\n const dns = await import('dns');\n const { promisify } = await import('util');\n const resolve4 = promisify(dns.resolve4);\n const resolve6 = promisify(dns.resolve6);\n\n const results: string[] = [];\n let ipv4Error: Error | null = null;\n let ipv6Error: Error | null = null;\n\n try {\n const ipv4 = await resolve4(hostname);\n results.push(...ipv4);\n } catch (err) {\n ipv4Error = err as Error;\n }\n\n try {\n const ipv6 = await resolve6(hostname);\n results.push(...ipv6);\n } catch (err) {\n ipv6Error = err as Error;\n }\n\n // If we got at least one result, resolution succeeded\n if (results.length > 0) {\n return { ok: true, ips: results, browser: false };\n }\n\n // Both failed - this is a DNS failure\n if (ipv4Error && ipv6Error) {\n return {\n ok: false,\n message: `DNS resolution failed for ${hostname}: ${ipv4Error.message}`,\n };\n }\n\n // No results but no errors either (unlikely)\n return { ok: true, ips: [], browser: false };\n } catch (err) {\n // DNS module import failed or other error\n return {\n ok: false,\n message: `DNS resolution error: ${err instanceof Error ? err.message : String(err)}`,\n };\n }\n }\n\n // Browser environment: cannot pre-resolve, return empty\n // SSRF check will rely on server-side validation\n return { ok: true, ips: [], browser: true };\n}\n\n/**\n * Perform an SSRF-safe fetch\n *\n * This function implements the SSRF protection algorithm from VERIFIER-SECURITY-MODEL.md:\n * 1. Parse URL; reject if not https://\n * 2. Resolve hostname to IP(s)\n * 3. For each IP: reject if private, link-local, or loopback\n * 4. Perform fetch with timeout\n * 5. On redirect: increment counter, reject if > max, apply checks to redirect URL\n * 6. Validate response size\n *\n * @param url - URL to fetch (must be https://)\n * @param options - Fetch options\n * @returns Fetch result or error\n */\nexport async function ssrfSafeFetch(\n url: string,\n options: SSRFFetchOptions = {}\n): Promise<SSRFFetchResult | SSRFFetchError> {\n const {\n timeoutMs = VERIFIER_LIMITS.fetchTimeoutMs,\n maxBytes = VERIFIER_LIMITS.maxResponseBytes,\n maxRedirects = 0,\n allowRedirects = VERIFIER_NETWORK.allowRedirects,\n allowCrossOriginRedirects = true, // Default: allow for CDN compatibility\n dnsFailureBehavior = 'block', // Default: fail-closed for security\n headers = {},\n } = options;\n\n // Step 1: Parse and validate URL\n let parsedUrl: URL;\n try {\n parsedUrl = new URL(url);\n } catch {\n return {\n ok: false,\n reason: 'invalid_url',\n message: `Invalid URL: ${url}`,\n blockedUrl: url,\n };\n }\n\n // Step 1b: Require HTTPS\n if (parsedUrl.protocol !== 'https:') {\n return {\n ok: false,\n reason: 'not_https',\n message: `URL must use HTTPS: ${url}`,\n blockedUrl: url,\n };\n }\n\n // Step 2: Resolve hostname to IPs\n const dnsResult = await resolveHostname(parsedUrl.hostname);\n\n // Step 2b: Handle DNS resolution failure (fail-closed by default)\n if (!dnsResult.ok) {\n if (dnsFailureBehavior === 'block') {\n return {\n ok: false,\n reason: 'dns_failure',\n message: `DNS resolution blocked: ${dnsResult.message}`,\n blockedUrl: url,\n };\n }\n // dnsFailureBehavior === 'fail': return network_error\n return {\n ok: false,\n reason: 'network_error',\n message: dnsResult.message,\n blockedUrl: url,\n };\n }\n\n // Step 3: Check each resolved IP (if not browser environment)\n if (!dnsResult.browser) {\n for (const ip of dnsResult.ips) {\n const blockResult = isBlockedIP(ip);\n if (blockResult.blocked) {\n return {\n ok: false,\n reason: blockResult.reason,\n message: `Blocked ${blockResult.reason} address: ${ip} for ${url}`,\n blockedUrl: url,\n };\n }\n }\n }\n\n // Step 4: Perform fetch with timeout\n let redirectCount = 0;\n let currentUrl = url;\n const originalOrigin = parsedUrl.origin;\n\n while (true) {\n try {\n const controller = new AbortController();\n const timeoutId = setTimeout(() => controller.abort(), timeoutMs);\n\n const response = await fetch(currentUrl, {\n headers: {\n Accept: 'application/json, text/plain',\n ...headers,\n },\n signal: controller.signal,\n redirect: 'manual', // Handle redirects manually for security\n });\n\n clearTimeout(timeoutId);\n\n // Step 5: Handle redirects\n if (response.status >= 300 && response.status < 400) {\n const location = response.headers.get('location');\n\n if (!location) {\n return {\n ok: false,\n reason: 'network_error',\n message: `Redirect without Location header from ${currentUrl}`,\n };\n }\n\n // Check redirect policy\n if (!allowRedirects) {\n return {\n ok: false,\n reason: 'too_many_redirects',\n message: `Redirects not allowed: ${currentUrl} -> ${location}`,\n blockedUrl: location,\n };\n }\n\n // Increment redirect counter\n redirectCount++;\n if (redirectCount > maxRedirects) {\n return {\n ok: false,\n reason: 'too_many_redirects',\n message: `Too many redirects (${redirectCount} > ${maxRedirects})`,\n blockedUrl: location,\n };\n }\n\n // Resolve redirect URL\n let redirectUrl: URL;\n try {\n redirectUrl = new URL(location, currentUrl);\n } catch {\n return {\n ok: false,\n reason: 'invalid_url',\n message: `Invalid redirect URL: ${location}`,\n blockedUrl: location,\n };\n }\n\n // Check for scheme downgrade (https -> http)\n if (redirectUrl.protocol !== 'https:') {\n return {\n ok: false,\n reason: 'scheme_downgrade',\n message: `HTTPS to HTTP downgrade not allowed: ${currentUrl} -> ${redirectUrl.href}`,\n blockedUrl: redirectUrl.href,\n };\n }\n\n // Check for cross-origin redirects (configurable for CDN compatibility)\n if (redirectUrl.origin !== originalOrigin && !allowCrossOriginRedirects) {\n return {\n ok: false,\n reason: 'cross_origin_redirect',\n message: `Cross-origin redirect not allowed: ${originalOrigin} -> ${redirectUrl.origin}`,\n blockedUrl: redirectUrl.href,\n };\n }\n\n // Check redirect target IPs (DNS resolution + SSRF checks)\n const redirectDnsResult = await resolveHostname(redirectUrl.hostname);\n\n // Handle DNS failure for redirect target\n if (!redirectDnsResult.ok) {\n if (dnsFailureBehavior === 'block') {\n return {\n ok: false,\n reason: 'dns_failure',\n message: `Redirect DNS resolution blocked: ${redirectDnsResult.message}`,\n blockedUrl: redirectUrl.href,\n };\n }\n return {\n ok: false,\n reason: 'network_error',\n message: redirectDnsResult.message,\n blockedUrl: redirectUrl.href,\n };\n }\n\n // Check redirect target IPs for SSRF (if not browser environment)\n if (!redirectDnsResult.browser) {\n for (const ip of redirectDnsResult.ips) {\n const blockResult = isBlockedIP(ip);\n if (blockResult.blocked) {\n return {\n ok: false,\n reason: blockResult.reason,\n message: `Redirect to blocked ${blockResult.reason} address: ${ip}`,\n blockedUrl: redirectUrl.href,\n };\n }\n }\n }\n\n currentUrl = redirectUrl.href;\n continue;\n }\n\n // Step 6: Validate response size\n const contentLength = response.headers.get('content-length');\n if (contentLength && parseInt(contentLength, 10) > maxBytes) {\n return {\n ok: false,\n reason: 'response_too_large',\n message: `Response too large: ${contentLength} bytes > ${maxBytes} max`,\n };\n }\n\n // Read response body with size limit\n const reader = response.body?.getReader();\n if (!reader) {\n const body = await response.text();\n if (body.length > maxBytes) {\n return {\n ok: false,\n reason: 'response_too_large',\n message: `Response too large: ${body.length} bytes > ${maxBytes} max`,\n };\n }\n // Convert body back to bytes for rawBytes (fallback path)\n const rawBytes = new TextEncoder().encode(body);\n return {\n ok: true,\n status: response.status,\n body,\n rawBytes,\n contentType: response.headers.get('content-type') ?? undefined,\n };\n }\n\n // Stream with size limit\n const chunks: Uint8Array[] = [];\n let totalSize = 0;\n\n while (true) {\n const { done, value } = await reader.read();\n if (done) break;\n\n totalSize += value.length;\n if (totalSize > maxBytes) {\n reader.cancel();\n return {\n ok: false,\n reason: 'response_too_large',\n message: `Response too large: ${totalSize} bytes > ${maxBytes} max`,\n };\n }\n\n chunks.push(value);\n }\n\n // Concatenate chunks into raw bytes (preserve original bytes for digest)\n const rawBytes = chunks.reduce((acc, chunk) => {\n const result = new Uint8Array(acc.length + chunk.length);\n result.set(acc);\n result.set(chunk, acc.length);\n return result;\n }, new Uint8Array());\n\n // Decode to string for body\n const body = new TextDecoder().decode(rawBytes);\n\n return {\n ok: true,\n status: response.status,\n body,\n rawBytes,\n contentType: response.headers.get('content-type') ?? undefined,\n };\n } catch (err) {\n if (err instanceof Error) {\n if (err.name === 'AbortError' || err.message.includes('timeout')) {\n return {\n ok: false,\n reason: 'timeout',\n message: `Fetch timeout after ${timeoutMs}ms: ${currentUrl}`,\n };\n }\n }\n\n return {\n ok: false,\n reason: 'network_error',\n message: `Network error: ${err instanceof Error ? err.message : String(err)}`,\n };\n }\n }\n}\n\n/**\n * Convenience function to fetch JWKS with SSRF protection\n */\nexport async function fetchJWKSSafe(\n jwksUrl: string,\n options?: Omit<SSRFFetchOptions, 'maxBytes'>\n): Promise<SSRFFetchResult | SSRFFetchError> {\n return ssrfSafeFetch(jwksUrl, {\n ...options,\n maxBytes: VERIFIER_LIMITS.maxJwksBytes,\n headers: {\n Accept: 'application/json',\n ...options?.headers,\n },\n });\n}\n\n/**\n * Convenience function to fetch pointer target with SSRF protection\n */\nexport async function fetchPointerSafe(\n pointerUrl: string,\n options?: Omit<SSRFFetchOptions, 'maxBytes'>\n): Promise<SSRFFetchResult | SSRFFetchError> {\n return ssrfSafeFetch(pointerUrl, {\n ...options,\n maxBytes: VERIFIER_LIMITS.maxReceiptBytes,\n headers: {\n Accept: 'application/jose, application/json',\n ...options?.headers,\n },\n });\n}\n","/**\n * Shared JWKS Resolver\n *\n * Centralizes JWKS resolution for both verify.ts and verifier-core.ts:\n * 1. Fetch peac-issuer.json from issuer origin (SSRF-safe)\n * 2. Validate issuer config (schema, issuer match)\n * 3. Validate jwks_uri is HTTPS (protocol-level enforcement)\n * 4. Fetch JWKS from jwks_uri (SSRF-safe, 64KB cap)\n * 5. Validate JWKS shape\n *\n * No fallback paths: peac-issuer.json with jwks_uri is the only\n * supported key discovery mechanism.\n *\n * @packageDocumentation\n */\n\nimport { VERIFIER_LIMITS } from '@peac/kernel';\nimport { PEAC_ISSUER_CONFIG_MAX_BYTES } from '@peac/schema';\nimport { parseIssuerConfig } from './discovery.js';\nimport type { SSRFFetchError } from './ssrf-safe-fetch.js';\nimport { fetchJWKSSafe, ssrfSafeFetch } from './ssrf-safe-fetch.js';\n\n// ---------------------------------------------------------------------------\n// Types\n// ---------------------------------------------------------------------------\n\n/**\n * JWK structure for Ed25519 keys\n */\nexport interface JWK {\n kty: string;\n crv: string;\n x: string;\n kid: string;\n}\n\n/**\n * JWKS document\n */\nexport interface JWKS {\n keys: JWK[];\n}\n\n/**\n * Revoked key entry from issuer configuration\n */\nexport interface RevokedKeyInfo {\n kid: string;\n revoked_at: string;\n reason?: string;\n}\n\n/**\n * Successful JWKS resolution\n */\nexport interface JWKSResolveSuccess {\n ok: true;\n jwks: JWKS;\n fromCache: boolean;\n /** Raw JWKS bytes for digest computation (only present when not from cache) */\n rawBytes?: Uint8Array;\n /** Revoked keys from issuer configuration (v0.11.3+) */\n revokedKeys?: RevokedKeyInfo[];\n}\n\n/**\n * JWKS resolution error\n */\nexport interface JWKSResolveError {\n ok: false;\n /** Kernel error code */\n code: string;\n /** Human-readable message */\n message: string;\n /** Original SSRF reason (preserved for diagnostic fidelity) */\n reason?: SSRFFetchError['reason'];\n /** Blocked URL (if applicable) */\n blockedUrl?: string;\n}\n\nexport type JWKSResolveResult = JWKSResolveSuccess | JWKSResolveError;\n\n/**\n * Options for JWKS resolution\n */\nexport interface ResolveJWKSOptions {\n /** Cache TTL in milliseconds (default: 300000 = 5 minutes) */\n cacheTtlMs?: number;\n /** Maximum cache entries before LRU eviction (default: 1000) */\n maxCacheEntries?: number;\n /** Bypass cache entirely (default: false) */\n noCache?: boolean;\n}\n\n// ---------------------------------------------------------------------------\n// Cache (LRU via Map insertion order)\n// ---------------------------------------------------------------------------\n\ninterface JWKSCacheEntry {\n jwks: JWKS;\n expiresAt: number;\n revokedKeys?: RevokedKeyInfo[];\n}\n\nconst HARD_CACHE_TTL_MS_BUILTIN = 5 * 60 * 1000;\nconst HARD_MAX_CACHE_ENTRIES_BUILTIN = 1000;\n\n/**\n * Read a positive integer from an environment variable. Returns the\n * fallback when the variable is unset, empty, or not a positive\n * integer. Defensive against operator typos: a malformed value never\n * silently uncaches the resolver. Pure function; the env source is\n * a parameter so tests do not have to mutate process.env.\n *\n * Accepts canonical decimal positive integers only (e.g. `300000`).\n * Rejects scientific notation (`1e3`), floats, zero, negatives, and\n * any non-decimal string. Malformed values fall back to the built-in\n * default so operator typos never silently disable the cache.\n */\nexport function __parseEnvPositiveInt(\n name: string,\n fallback: number,\n env: Record<string, string | undefined> = typeof process !== 'undefined'\n ? (process.env as Record<string, string | undefined>)\n : {}\n): number {\n const raw = env[name];\n if (!raw) return fallback;\n if (!/^[1-9][0-9]*$/.test(raw)) return fallback;\n const parsed = parseInt(raw, 10);\n return parsed > 0 ? parsed : fallback;\n}\n\nconst DEFAULT_CACHE_TTL_MS = __parseEnvPositiveInt(\n 'PEAC_JWKS_CACHE_TTL_MS',\n HARD_CACHE_TTL_MS_BUILTIN\n);\nconst DEFAULT_MAX_CACHE_ENTRIES = __parseEnvPositiveInt(\n 'PEAC_JWKS_CACHE_MAX_ENTRIES',\n HARD_MAX_CACHE_ENTRIES_BUILTIN\n);\n\n/** Exposes the module-load defaults for testing without mutating process.env. */\nexport function __getJwksCacheDefaults(): { ttlMs: number; maxEntries: number } {\n return { ttlMs: DEFAULT_CACHE_TTL_MS, maxEntries: DEFAULT_MAX_CACHE_ENTRIES };\n}\nconst jwksCache = new Map<string, JWKSCacheEntry>();\n\n// ---------------------------------------------------------------------------\n// Kid-to-Thumbprint Tracking (kid reuse detection)\n// ---------------------------------------------------------------------------\n\ninterface KidThumbprintEntry {\n /** Base64url-encoded x coordinate (canonical key material identifier) */\n thumbprint: string;\n /** Timestamp when first observed */\n firstSeen: number;\n}\n\n/**\n * Retention window for kid-to-thumbprint mappings.\n * Matches the normative overlap period (30 days).\n */\nconst KID_RETENTION_MS = 30 * 24 * 60 * 60 * 1000;\n\n/**\n * Maximum number of kid-to-thumbprint entries to prevent unbounded memory growth.\n * Evicts oldest entries (by firstSeen) when exceeded.\n */\nconst MAX_KID_THUMBPRINT_ENTRIES = 10_000;\n\nconst kidThumbprints = new Map<string, KidThumbprintEntry>();\n\n/**\n * Prune expired entries from the kid-to-thumbprint map.\n * Runs during checkKidReuse to bound memory growth.\n */\nfunction pruneExpiredKidEntries(now: number): void {\n for (const [key, entry] of kidThumbprints) {\n if (now - entry.firstSeen >= KID_RETENTION_MS) {\n kidThumbprints.delete(key);\n }\n }\n}\n\n/**\n * Evict oldest entries when the map exceeds the maximum size.\n * Uses firstSeen as the eviction criterion (oldest first).\n */\nfunction evictOldestKidEntries(): void {\n if (kidThumbprints.size <= MAX_KID_THUMBPRINT_ENTRIES) return;\n\n // Collect entries sorted by firstSeen (oldest first)\n const entries = Array.from(kidThumbprints.entries()).sort(\n (a, b) => a[1].firstSeen - b[1].firstSeen\n );\n\n // Remove oldest entries until within limit\n const toRemove = kidThumbprints.size - MAX_KID_THUMBPRINT_ENTRIES;\n for (let i = 0; i < toRemove; i++) {\n kidThumbprints.delete(entries[i][0]);\n }\n}\n\n/**\n * Check for kid reuse: same (iss, kid) mapping to different key material.\n * Returns error code string if reuse detected, null otherwise.\n *\n * Also prunes expired entries and enforces max size to prevent\n * unbounded memory growth in long-running processes.\n *\n * Stateful resolvers MUST reject (tiered enforcement).\n */\nfunction checkKidReuse(issuer: string, jwks: JWKS, now: number): string | null {\n // Prune expired entries first (bounded memory)\n pruneExpiredKidEntries(now);\n\n for (const key of jwks.keys) {\n if (!key.kid || !key.x) continue;\n const mapKey = `${issuer}|${key.kid}`;\n const existing = kidThumbprints.get(mapKey);\n\n if (existing) {\n // Check if within retention window\n if (now - existing.firstSeen < KID_RETENTION_MS) {\n if (existing.thumbprint !== key.x) {\n return `Kid reuse detected: kid=${key.kid} for issuer ${issuer} maps to different key material`;\n }\n } else {\n // Expired: update with new mapping\n kidThumbprints.set(mapKey, { thumbprint: key.x, firstSeen: now });\n }\n } else {\n // First time seeing this (iss, kid): record it\n kidThumbprints.set(mapKey, { thumbprint: key.x, firstSeen: now });\n }\n }\n\n // Enforce max size after insertions\n evictOldestKidEntries();\n\n return null;\n}\n\n/**\n * Clear kid-to-thumbprint tracking (for testing)\n * @internal\n */\nexport function clearKidThumbprints(): void {\n kidThumbprints.clear();\n}\n\n/**\n * Get kid-to-thumbprint map size (for testing bounded growth)\n * @internal\n */\nexport function getKidThumbprintSize(): number {\n return kidThumbprints.size;\n}\n\n/**\n * LRU cache get: promotes entry to most-recently-used position.\n * Returns undefined if expired or missing.\n */\nfunction cacheGet(key: string, now: number): JWKSCacheEntry | undefined {\n const entry = jwksCache.get(key);\n if (!entry) return undefined;\n if (entry.expiresAt <= now) {\n jwksCache.delete(key);\n return undefined;\n }\n // LRU promote: delete and re-insert to move to end (most recent)\n jwksCache.delete(key);\n jwksCache.set(key, entry);\n return entry;\n}\n\n/**\n * LRU cache set: inserts entry and evicts oldest if over capacity.\n */\nfunction cacheSet(key: string, entry: JWKSCacheEntry, maxEntries: number): void {\n if (jwksCache.has(key)) jwksCache.delete(key);\n jwksCache.set(key, entry);\n // Evict oldest entries (Map iteration order = insertion order)\n while (jwksCache.size > maxEntries) {\n const oldestKey = jwksCache.keys().next().value;\n if (oldestKey !== undefined) jwksCache.delete(oldestKey);\n }\n}\n\n/**\n * Clear the shared JWKS cache\n */\nexport function clearJWKSCache(): void {\n jwksCache.clear();\n}\n\n/**\n * Get JWKS cache size (for testing)\n * @internal\n */\nexport function getJWKSCacheSize(): number {\n return jwksCache.size;\n}\n\n// ---------------------------------------------------------------------------\n// Issuer Normalization\n// ---------------------------------------------------------------------------\n\n/**\n * Canonicalize an issuer URL to its origin (scheme + host + port).\n * Uses URL parsing for interop correctness: handles trailing slashes,\n * paths, default port elision, and IDN normalization.\n *\n * Returns a discriminated result so callers can distinguish malformed URLs\n * from valid non-HTTPS URLs (different error codes).\n *\n * Examples:\n * \"https://api.example.com/\" -> ok: \"https://api.example.com\"\n * \"https://api.example.com/v1\" -> ok: \"https://api.example.com\"\n * \"https://api.example.com:443\" -> ok: \"https://api.example.com\"\n * \"https://api.example.com:8443\" -> ok: \"https://api.example.com:8443\"\n * \"not-a-url\" -> error\n */\nfunction canonicalizeIssuerOrigin(\n issuerUrl: string\n): { ok: true; origin: string } | { ok: false; message: string } {\n try {\n const origin = new URL(issuerUrl).origin;\n // Non-hierarchical URIs (data:, blob:) return \"null\" as origin\n if (origin === 'null') {\n return { ok: false, message: `Issuer URL has no valid origin: ${issuerUrl}` };\n }\n return { ok: true, origin };\n } catch {\n return { ok: false, message: `Issuer URL is not a valid URL: ${issuerUrl}` };\n }\n}\n\n// ---------------------------------------------------------------------------\n// SSRF Error Mapping\n// ---------------------------------------------------------------------------\n\n/**\n * Map SSRFFetchError to kernel error code while preserving the original reason.\n * Returns both the kernel code and the original SSRF reason for diagnostic fidelity.\n */\nfunction mapSSRFError(\n reason: SSRFFetchError['reason'],\n context: 'issuer_config' | 'jwks'\n): { code: string; reason: SSRFFetchError['reason'] } {\n let code: string;\n switch (reason) {\n case 'not_https':\n code = 'E_VERIFY_INSECURE_SCHEME_BLOCKED';\n break;\n case 'private_ip':\n case 'loopback':\n case 'link_local':\n code = 'E_VERIFY_KEY_FETCH_BLOCKED';\n break;\n case 'timeout':\n code = 'E_VERIFY_KEY_FETCH_TIMEOUT';\n break;\n case 'response_too_large':\n code = context === 'jwks' ? 'E_VERIFY_JWKS_TOO_LARGE' : 'E_VERIFY_KEY_FETCH_FAILED';\n break;\n case 'dns_failure':\n case 'network_error':\n case 'too_many_redirects':\n case 'scheme_downgrade':\n case 'cross_origin_redirect':\n case 'invalid_url':\n code =\n context === 'issuer_config'\n ? 'E_VERIFY_ISSUER_CONFIG_MISSING'\n : 'E_VERIFY_KEY_FETCH_FAILED';\n break;\n case 'jwks_too_many_keys':\n code = 'E_VERIFY_JWKS_TOO_MANY_KEYS';\n break;\n default:\n code = 'E_VERIFY_KEY_FETCH_FAILED';\n break;\n }\n return { code, reason };\n}\n\n// ---------------------------------------------------------------------------\n// Main Resolution\n// ---------------------------------------------------------------------------\n\n/**\n * Resolve JWKS for an issuer using strict discovery:\n * peac-issuer.json -> jwks_uri -> JWKS\n *\n * No fallback to direct JWKS or peac.txt key discovery.\n *\n * @param issuerUrl - Issuer origin URL (e.g. \"https://api.example.com\")\n * @param options - Cache and resolution options\n * @returns Resolved JWKS or error\n */\nexport async function resolveJWKS(\n issuerUrl: string,\n options?: ResolveJWKSOptions\n): Promise<JWKSResolveResult> {\n const cacheTtlMs = options?.cacheTtlMs ?? DEFAULT_CACHE_TTL_MS;\n const maxCacheEntries = options?.maxCacheEntries ?? DEFAULT_MAX_CACHE_ENTRIES;\n const noCache = options?.noCache ?? false;\n\n // Normalize issuer to origin via URL parsing (interop-correct)\n const normalized = canonicalizeIssuerOrigin(issuerUrl);\n if (!normalized.ok) {\n return {\n ok: false,\n code: 'E_VERIFY_ISSUER_CONFIG_INVALID',\n message: normalized.message,\n blockedUrl: issuerUrl,\n };\n }\n const normalizedIssuer = normalized.origin;\n const now = Date.now();\n\n // Check cache first (unless bypassed)\n if (!noCache) {\n const cached = cacheGet(normalizedIssuer, now);\n if (cached) {\n return { ok: true, jwks: cached.jwks, fromCache: true, revokedKeys: cached.revokedKeys };\n }\n }\n\n // Step 1: Require HTTPS\n if (!normalizedIssuer.startsWith('https://')) {\n return {\n ok: false,\n code: 'E_VERIFY_INSECURE_SCHEME_BLOCKED',\n message: `Issuer URL must be HTTPS: ${normalizedIssuer}`,\n blockedUrl: normalizedIssuer,\n };\n }\n\n // Step 2: Fetch peac-issuer.json\n const configUrl = `${normalizedIssuer}/.well-known/peac-issuer.json`;\n const configResult = await ssrfSafeFetch(configUrl, {\n maxBytes: PEAC_ISSUER_CONFIG_MAX_BYTES,\n headers: { Accept: 'application/json' },\n });\n\n if (!configResult.ok) {\n const mapped = mapSSRFError(configResult.reason, 'issuer_config');\n return {\n ok: false,\n code: mapped.code,\n message: `Failed to fetch peac-issuer.json: ${configResult.message}`,\n reason: mapped.reason,\n blockedUrl: configResult.blockedUrl,\n };\n }\n\n // Step 3: Parse and validate issuer config\n let issuerConfig: ReturnType<typeof parseIssuerConfig>;\n try {\n issuerConfig = parseIssuerConfig(configResult.body);\n } catch (err) {\n return {\n ok: false,\n code: 'E_VERIFY_ISSUER_CONFIG_INVALID',\n message: `Invalid peac-issuer.json: ${err instanceof Error ? err.message : String(err)}`,\n };\n }\n\n // Step 4: Validate issuer match (both sides canonicalized to origin)\n const configIssuerResult = canonicalizeIssuerOrigin(issuerConfig.issuer);\n const configIssuer = configIssuerResult.ok ? configIssuerResult.origin : issuerConfig.issuer;\n if (configIssuer !== normalizedIssuer) {\n return {\n ok: false,\n code: 'E_VERIFY_ISSUER_MISMATCH',\n message: `Issuer mismatch: expected ${normalizedIssuer}, got ${configIssuer}`,\n };\n }\n\n // Step 5: Validate jwks_uri (HTTPS enforcement at resolver layer, not parser)\n if (!issuerConfig.jwks_uri) {\n return {\n ok: false,\n code: 'E_VERIFY_JWKS_URI_INVALID',\n message: 'peac-issuer.json missing required jwks_uri field',\n };\n }\n\n if (!issuerConfig.jwks_uri.startsWith('https://')) {\n return {\n ok: false,\n code: 'E_VERIFY_JWKS_URI_INVALID',\n message: `jwks_uri must be HTTPS: ${issuerConfig.jwks_uri}`,\n blockedUrl: issuerConfig.jwks_uri,\n };\n }\n\n // Step 6: Fetch JWKS from jwks_uri\n const jwksResult = await fetchJWKSSafe(issuerConfig.jwks_uri);\n\n if (!jwksResult.ok) {\n const mapped = mapSSRFError(jwksResult.reason, 'jwks');\n return {\n ok: false,\n code: mapped.code,\n message: `Failed to fetch JWKS from ${issuerConfig.jwks_uri}: ${jwksResult.message}`,\n reason: mapped.reason,\n blockedUrl: jwksResult.blockedUrl,\n };\n }\n\n // Step 7: Parse and validate JWKS\n let jwks: JWKS;\n try {\n jwks = JSON.parse(jwksResult.body) as JWKS;\n } catch {\n return {\n ok: false,\n code: 'E_VERIFY_JWKS_INVALID',\n message: 'JWKS response is not valid JSON',\n };\n }\n\n if (!jwks.keys || !Array.isArray(jwks.keys)) {\n return {\n ok: false,\n code: 'E_VERIFY_JWKS_INVALID',\n message: 'JWKS missing required keys array',\n };\n }\n\n if (jwks.keys.length > VERIFIER_LIMITS.maxJwksKeys) {\n return {\n ok: false,\n code: 'E_VERIFY_JWKS_TOO_MANY_KEYS',\n message: `JWKS has too many keys: ${jwks.keys.length} > ${VERIFIER_LIMITS.maxJwksKeys}`,\n };\n }\n\n // Step 8: Kid reuse detection (stateful MUST reject)\n const kidReuseError = checkKidReuse(normalizedIssuer, jwks, now);\n if (kidReuseError) {\n return {\n ok: false,\n code: 'E_KID_REUSE_DETECTED',\n message: kidReuseError,\n };\n }\n\n // Extract revoked_keys from issuer config\n const revokedKeys = issuerConfig.revoked_keys?.map((entry) => ({\n kid: entry.kid,\n revoked_at: entry.revoked_at,\n reason: entry.reason,\n }));\n\n // Cache and return (with LRU eviction)\n if (!noCache) {\n cacheSet(normalizedIssuer, { jwks, expiresAt: now + cacheTtlMs, revokedKeys }, maxCacheEntries);\n }\n\n return {\n ok: true,\n jwks,\n fromCache: false,\n rawBytes: jwksResult.rawBytes,\n revokedKeys,\n };\n}\n","/**\n * Internal Ed25519 signature-width guard for the verification paths.\n *\n * NOT re-exported from the package barrel (`index.ts` does\n * `export * from './verify'` / `'./verify-local'`, so anything exported from\n * those modules becomes public API). Keep this helper in `_internal` so the\n * guard adds no public surface.\n */\n\nimport { base64urlDecode } from '@peac/crypto';\n\n/** Ed25519 signatures are fixed-width 64 bytes (RFC 8032 / RFC 8709). */\nexport const ED25519_SIGNATURE_BYTES = 64;\n\n/**\n * Return the decoded byte length of a compact JWS signature segment, or `null`\n * when the token is not a well-formed three-part compact JWS or the signature\n * segment is not decodable base64url. Those `null` cases are deliberately left\n * to the existing format/verification error paths (this guard does not change\n * their classification); only a well-formed token whose signature decodes to a\n * non-64-byte width is surfaced to the caller as a wrong-length signature.\n */\nexport function ed25519SignatureByteLength(jws: string): number | null {\n const parts = jws.split('.');\n if (parts.length !== 3) {\n return null;\n }\n try {\n return base64urlDecode(parts[2]).length;\n } catch {\n return null;\n }\n}\n","/**\n * Receipt verification with strict issuer-config-based JWKS discovery\n *\n * Key discovery uses peac-issuer.json -> jwks_uri exclusively.\n * No legacy fallbacks (peac.txt, direct JWKS).\n * JWKS caching is centralized in jwks-resolver.ts.\n */\n\nimport { verify as jwsVerify, decode } from '@peac/crypto';\nimport {\n PEACReceiptClaims,\n ReceiptClaims,\n SubjectProfileSnapshot,\n validateSubjectSnapshot,\n validateKernelConstraints,\n} from '@peac/schema';\nimport { resolveJWKS, type JWK } from './jwks-resolver.js';\nimport { hashReceipt, fireTelemetryHook, type TelemetryHook } from './telemetry.js';\nimport { readLegacyPathFlag, type LegacyPathOptions } from './_internal/legacy-path.js';\nimport { ED25519_SIGNATURE_BYTES, ed25519SignatureByteLength } from './_internal/signature.js';\n\n/**\n * Convert JWK x coordinate to Ed25519 public key\n */\nfunction jwkToPublicKey(jwk: JWK): Uint8Array {\n if (jwk.kty !== 'OKP' || jwk.crv !== 'Ed25519') {\n throw new Error('Only Ed25519 keys (OKP/Ed25519) are supported');\n }\n\n // Decode base64url x coordinate\n const xBytes = Buffer.from(jwk.x, 'base64url');\n if (xBytes.length !== 32) {\n throw new Error('Ed25519 public key must be 32 bytes');\n }\n\n return new Uint8Array(xBytes);\n}\n\n/**\n * Wire 0.1 verification result.\n * @deprecated Wire 0.1 is frozen legacy. Use {@link verifyLocal} (from `verify-local.ts`)\n * for the current stable format.\n */\nexport interface VerifyResult {\n /** Verification succeeded */\n ok: true;\n\n /** Receipt claims */\n claims: PEACReceiptClaims;\n\n /** Subject profile snapshot (v0.9.17+, if provided) */\n subject_snapshot?: SubjectProfileSnapshot;\n\n /** Performance metrics */\n perf?: {\n verify_ms: number;\n jwks_fetch_ms?: number;\n };\n}\n\n/**\n * Wire 0.1 verification failure.\n * @deprecated Wire 0.1 is frozen legacy. Use {@link verifyLocal} for the current stable format.\n */\nexport interface VerifyFailure {\n /** Verification failed */\n ok: false;\n\n /** Error reason */\n reason: string;\n\n /** Error details */\n details?: string;\n}\n\n/**\n * Wire 0.1 verification options.\n * @deprecated Wire 0.1 is frozen legacy. Use {@link verifyLocal} for the current stable format.\n */\nexport interface VerifyOptions {\n /** JWS compact serialization */\n receiptJws: string;\n\n /** Subject profile snapshot (v0.9.17+, optional envelope metadata) */\n subject_snapshot?: SubjectProfileSnapshot;\n\n /** Telemetry hook (optional, fire-and-forget) */\n telemetry?: TelemetryHook;\n}\n\n/**\n * Verify a Wire 0.1 PEAC receipt JWS via issuer-config discovery.\n *\n * Uses strict issuer-config discovery: peac-issuer.json -> jwks_uri -> JWKS.\n * No fallback to peac.txt or direct JWKS endpoints.\n *\n * @deprecated Wire 0.1 is frozen legacy. Use {@link verifyLocal} for the current stable\n * format (Interaction Record format, `interaction-record+jwt`).\n *\n * @param optionsOrJws - Verify options or JWS compact serialization (for backwards compatibility)\n * @returns Verification result or failure\n */\nexport async function verifyReceipt(\n optionsOrJws: string | VerifyOptions\n): Promise<VerifyResult | VerifyFailure> {\n // Internal rollback-path flag. See `_internal/legacy-path.ts` for\n // the full contract.\n const legacyPathOptions =\n typeof optionsOrJws === 'string' ? undefined : (optionsOrJws as unknown as LegacyPathOptions);\n void readLegacyPathFlag(legacyPathOptions);\n\n // Support both old (string) and new (options) signatures for backwards compatibility\n const receiptJws = typeof optionsOrJws === 'string' ? optionsOrJws : optionsOrJws.receiptJws;\n const inputSnapshot =\n typeof optionsOrJws === 'string' ? undefined : optionsOrJws.subject_snapshot;\n const telemetry = typeof optionsOrJws === 'string' ? undefined : optionsOrJws.telemetry;\n const startTime = performance.now();\n let jwksFetchTime: number | undefined;\n\n try {\n // Decode JWS to get issuer\n const { header, payload } = decode<PEACReceiptClaims>(receiptJws);\n\n // Validate structural kernel constraints (fail-closed)\n const constraintResult = validateKernelConstraints(payload);\n if (!constraintResult.valid) {\n const v = constraintResult.violations[0];\n return {\n ok: false,\n reason: 'constraint_violation',\n details: `Kernel constraint violated: ${v.constraint} (actual: ${v.actual}, limit: ${v.limit})`,\n };\n }\n\n // Validate claims structure\n ReceiptClaims.parse(payload);\n\n // Check expiry\n if (payload.exp && payload.exp < Math.floor(Date.now() / 1000)) {\n const durationMs = performance.now() - startTime;\n fireTelemetryHook(telemetry?.onReceiptVerified, {\n receiptHash: hashReceipt(receiptJws),\n valid: false,\n reasonCode: 'expired',\n issuer: payload.iss,\n kid: header.kid,\n durationMs,\n });\n return {\n ok: false,\n reason: 'expired',\n details: `Receipt expired at ${new Date(payload.exp * 1000).toISOString()}`,\n };\n }\n\n // Resolve JWKS via strict discovery (peac-issuer.json -> jwks_uri)\n const jwksFetchStart = performance.now();\n const jwksResult = await resolveJWKS(payload.iss);\n\n if (!jwksResult.ok) {\n return {\n ok: false,\n reason: jwksResult.code,\n details: jwksResult.message,\n };\n }\n\n if (!jwksResult.fromCache) {\n jwksFetchTime = performance.now() - jwksFetchStart;\n }\n\n // Check if key is revoked (v0.11.3+)\n if (jwksResult.revokedKeys) {\n const revokedEntry = jwksResult.revokedKeys.find((rk) => rk.kid === header.kid);\n if (revokedEntry) {\n const durationMs = performance.now() - startTime;\n fireTelemetryHook(telemetry?.onReceiptVerified, {\n receiptHash: hashReceipt(receiptJws),\n valid: false,\n reasonCode: 'key_revoked',\n issuer: payload.iss,\n kid: header.kid,\n durationMs,\n });\n return {\n ok: false,\n reason: 'key_revoked',\n details: `Key kid=${header.kid} was revoked at ${revokedEntry.revoked_at}${revokedEntry.reason ? ` (reason: ${revokedEntry.reason})` : ''}`,\n };\n }\n }\n\n // Find key by kid\n const jwk = jwksResult.jwks.keys.find((k) => k.kid === header.kid);\n if (!jwk) {\n const durationMs = performance.now() - startTime;\n fireTelemetryHook(telemetry?.onReceiptVerified, {\n receiptHash: hashReceipt(receiptJws),\n valid: false,\n reasonCode: 'unknown_key',\n issuer: payload.iss,\n kid: header.kid,\n durationMs,\n });\n return {\n ok: false,\n reason: 'unknown_key',\n details: `No key found with kid=${header.kid}`,\n };\n }\n\n // Convert JWK to public key\n const publicKey = jwkToPublicKey(jwk);\n\n // Reject fixed-width-violating Ed25519 signatures deterministically as an\n // invalid signature, immediately before cryptographic verification (after\n // key resolution/conversion). Placing it here -- rather than in the outer\n // catch -- ensures an unexpected failure in an earlier stage (JWKS, key\n // conversion, etc.) is never masked as invalid_signature.\n const signatureBytes = ed25519SignatureByteLength(receiptJws);\n if (signatureBytes !== null && signatureBytes !== ED25519_SIGNATURE_BYTES) {\n const durationMs = performance.now() - startTime;\n fireTelemetryHook(telemetry?.onReceiptVerified, {\n receiptHash: hashReceipt(receiptJws),\n valid: false,\n reasonCode: 'invalid_signature',\n issuer: payload.iss,\n kid: header.kid,\n durationMs,\n });\n return {\n ok: false,\n reason: 'invalid_signature',\n details: 'Ed25519 signature has invalid length',\n };\n }\n\n // Verify signature\n const result = await jwsVerify<PEACReceiptClaims>(receiptJws, publicKey);\n\n if (!result.valid) {\n const durationMs = performance.now() - startTime;\n fireTelemetryHook(telemetry?.onReceiptVerified, {\n receiptHash: hashReceipt(receiptJws),\n valid: false,\n reasonCode: 'invalid_signature',\n issuer: payload.iss,\n kid: header.kid,\n durationMs,\n });\n return {\n ok: false,\n reason: 'invalid_signature',\n details: 'Ed25519 signature verification failed',\n };\n }\n\n // Validate subject_snapshot if provided (v0.9.17+)\n // This validates schema and logs advisory PII warning if applicable\n const validatedSnapshot = validateSubjectSnapshot(inputSnapshot);\n\n const verifyTime = performance.now() - startTime;\n\n // Emit success telemetry (fire-and-forget, guarded)\n fireTelemetryHook(telemetry?.onReceiptVerified, {\n receiptHash: hashReceipt(receiptJws),\n valid: true,\n issuer: payload.iss,\n kid: header.kid,\n durationMs: verifyTime,\n });\n\n return {\n ok: true,\n claims: payload,\n ...(validatedSnapshot && { subject_snapshot: validatedSnapshot }),\n perf: {\n verify_ms: verifyTime,\n ...(jwksFetchTime && { jwks_fetch_ms: jwksFetchTime }),\n },\n };\n } catch {\n const durationMs = performance.now() - startTime;\n fireTelemetryHook(telemetry?.onReceiptVerified, {\n receiptHash: hashReceipt(receiptJws),\n valid: false,\n reasonCode: 'verification_error',\n durationMs,\n });\n // Do not surface raw exception text to callers (avoids leaking internal\n // paths/state); the stable reason carries the classification.\n return {\n ok: false,\n reason: 'verification_error',\n details: 'Unexpected verification error.',\n };\n }\n}\n","/**\n * Inert shadow-call boundary for the bounded validator foundation.\n *\n * INTERNAL ONLY. This module is the call-site placeholder that PR D\n * will wire to the bounded validator pipeline behind an internal\n * feature flag. In v0.13.1 the boundary is INERT by construction:\n *\n * - the only declared mode is `'disabled'`\n * - the function body is a single early return on `'disabled'`\n * - it imports no bounded validators (zero runtime weight at\n * verify-local.ts cold-start, even though the call site exists)\n * - it never throws into verifyLocal()\n * - it never mutates the input claims object\n * - it never logs\n * - it never reads environment variables\n * - it never affects the canonical verify-local result\n *\n * The function returns `undefined` for every call. The call site in\n * verify-local.ts ignores the return value and never awaits any work.\n *\n * NOT re-exported from packages/protocol/src/index.ts. Public surface\n * is byte-stable. PR D may extend the input shape when wiring the\n * actual flag plumbing; that is a future-internal change, not a\n * public API change.\n */\n\n/**\n * The only declared shadow validation mode. Adding new modes requires\n * a deliberate future change in PR D where the actual flag is wired.\n */\nexport type ShadowValidationMode = 'disabled';\n\n/**\n * Input shape for the shadow-call boundary. `claims` is intentionally\n * `unknown` so callers may pass parsed Wire 0.2 claims without a\n * coupling to the schema's exported type from this internal helper.\n */\nexport interface ShadowValidationInput {\n readonly mode: ShadowValidationMode;\n readonly claims: unknown;\n}\n\n/**\n * Inert shadow-call hook. Always returns `undefined`. The signature\n * is stable enough for PR D to extend (e.g., adding a `header` or\n * `now` field) without breaking the disabled-default contract.\n */\nexport function maybeRunShadowValidation(input: ShadowValidationInput): undefined {\n if (input.mode === 'disabled') return undefined;\n return undefined;\n}\n","/**\n * Local receipt verification with schema validation\n *\n * Use this for verifying receipts when you have the public key locally,\n * without JWKS discovery.\n */\n\nimport { type VerificationStrictness, type VerificationWarning, HASH } from '@peac/kernel';\nimport { defaultCodec } from './_internal/record-core/codec/jws-jwt.js';\nimport {\n parseReceiptClaims,\n validateKernelConstraints,\n type Wire02Claims,\n checkOccurredAtSkew,\n sortWarnings,\n WARNING_TYP_MISSING,\n WARNING_TYPE_UNREGISTERED,\n WARNING_UNKNOWN_EXTENSION,\n WARNING_EXTENSION_GROUP_MISSING,\n WARNING_EXTENSION_GROUP_MISMATCH,\n REGISTERED_RECEIPT_TYPES,\n REGISTERED_EXTENSION_GROUP_KEYS,\n isValidExtensionKey,\n verifyPolicyBinding,\n} from '@peac/schema';\nimport { TYPE_TO_EXTENSION_MAP } from '@peac/kernel';\nimport { checkTypeExtensionMapping } from './type-extension-check';\nimport { maybeRunShadowValidation } from './_internal/record-core/shadow-hook';\nimport { runBoundedValidatorShadow } from './_internal/record-core/bounded-validator.js';\nimport { runBoundedValidationGate } from './_internal/record-core/validation-gate.js';\nimport { isShadowEnabled, scheduleShadow, type ShadowEnableOptions } from './_internal/shadow.js';\nimport { readLegacyPathFlag, type LegacyPathOptions } from './_internal/legacy-path.js';\nimport { ED25519_SIGNATURE_BYTES, ed25519SignatureByteLength } from './_internal/signature.js';\nimport {\n realObservationForVerifyLocalSuccess,\n shadowObservationFromBounded,\n type ShadowObservation,\n} from './_internal/shadow-observe.js';\nimport type { PolicyBindingStatus } from './verifier-types';\n\n/**\n * Structural type for CryptoError\n * Used instead of instanceof for robustness across ESM/CJS boundaries\n */\ninterface CryptoErrorLike {\n name: 'CryptoError';\n code: string;\n message: string;\n}\n\n/**\n * Structural check for CryptoError\n * More robust than instanceof across module boundaries (ESM/CJS, duplicate packages)\n */\nfunction isCryptoError(err: unknown): err is CryptoErrorLike {\n return (\n err !== null &&\n typeof err === 'object' &&\n 'name' in err &&\n err.name === 'CryptoError' &&\n 'code' in err &&\n typeof err.code === 'string' &&\n err.code.startsWith('CRYPTO_') &&\n 'message' in err &&\n typeof err.message === 'string'\n );\n}\n\n/**\n * Canonical error codes for local verification\n *\n * These map to E_* codes in specs/kernel/errors.json.\n * JOSE hardening codes (E_JWS_*) are distinct from generic E_INVALID_FORMAT\n * so callers can distinguish key-injection, compression, and crit attacks from\n * ordinary format errors (v0.12.0-preview.1).\n */\nexport type VerifyLocalErrorCode =\n | 'E_INVALID_SIGNATURE'\n | 'E_INVALID_FORMAT'\n | 'E_CONSTRAINT_VIOLATION'\n | 'E_EXPIRED'\n | 'E_NOT_YET_VALID'\n | 'E_INVALID_ISSUER'\n | 'E_INVALID_AUDIENCE'\n | 'E_INVALID_SUBJECT'\n | 'E_INVALID_RECEIPT_ID'\n | 'E_MISSING_EXP'\n | 'E_WIRE_VERSION_MISMATCH'\n | 'E_UNSUPPORTED_WIRE_VERSION'\n | 'E_OCCURRED_AT_FUTURE'\n // JOSE hardening codes (Wire 0.2, v0.12.0-preview.1)\n | 'E_JWS_EMBEDDED_KEY'\n | 'E_JWS_CRIT_REJECTED'\n | 'E_JWS_MISSING_KID'\n | 'E_JWS_B64_REJECTED'\n | 'E_JWS_ZIP_REJECTED'\n // Policy binding (Wire 0.2, v0.12.0-preview.1)\n | 'E_POLICY_BINDING_FAILED'\n // Type-to-extension enforcement (Wire 0.2, v0.12.2)\n | 'E_EXTENSION_GROUP_REQUIRED'\n | 'E_EXTENSION_GROUP_MISMATCH'\n // Raw-input I-JSON gate (RFC 7493): runs on raw header/payload bytes before parse\n | 'E_IJSON_DUPLICATE_MEMBER_NAME'\n | 'E_IJSON_NUMBER_OUT_OF_RANGE'\n | 'E_IJSON_INVALID_STRING'\n | 'E_INTERNAL';\n\n/**\n * Options for local verification\n */\nexport interface VerifyLocalOptions {\n /**\n * Expected issuer URL\n *\n * If provided, verification fails if receipt.iss does not match.\n */\n issuer?: string;\n\n /**\n * @deprecated Wire 0.2 does not have an `aud` claim. This option is ignored.\n * Retained for source compatibility during migration; will be removed in v1.0.\n */\n audience?: string;\n\n /**\n * Expected subject URI\n *\n * If provided, verification fails if receipt.sub does not match.\n * Binds the receipt to a specific resource/interaction target.\n */\n subjectUri?: string;\n\n /**\n * @deprecated Wire 0.2 does not have a `rid` claim. Use `jti` for receipt identification.\n * This option is ignored. Retained for source compatibility; will be removed in v1.0.\n */\n rid?: string;\n\n /**\n * @deprecated Wire 0.2 receipts do not expire (permanent evidence by design).\n * This option is ignored. Retained for source compatibility; will be removed in v1.0.\n */\n requireExp?: boolean;\n\n /**\n * Current timestamp (Unix seconds)\n *\n * Defaults to Date.now() / 1000. Override for testing.\n */\n now?: number;\n\n /**\n * Maximum clock skew tolerance (seconds)\n *\n * Allows for clock drift between issuer and verifier.\n * Defaults to 300 (5 minutes).\n */\n maxClockSkew?: number;\n\n /**\n * Verification strictness profile (v0.12.0-preview.1).\n *\n * - 'strict' (default): missing typ is a hard error before schema validation.\n * - 'interop': missing typ emits a 'typ_missing' warning and routes by payload content.\n *\n * Strictness is EXCLUSIVELY controlled here (@peac/protocol). @peac/crypto has no strictness param.\n */\n strictness?: VerificationStrictness;\n\n /**\n * Pre-computed local policy digest for policy binding (Wire 0.2, v0.12.0-preview.1).\n *\n * Must be in 'sha256:<64 lowercase hex>' format, computed via computePolicyDigestJcs()\n * from @peac/protocol. When provided alongside a receipt that contains a policy block\n * (policy.digest), the binding check is performed:\n * - Match: policy_binding = 'verified'\n * - Mismatch: hard fail with E_POLICY_BINDING_FAILED\n * - Either absent: policy_binding = 'unavailable'\n *\n * Always 'unavailable' for Wire 0.1 receipts regardless of this option.\n */\n policyDigest?: string;\n\n /**\n * Pre-computed document-binding results for transaction-local terms\n * and any other referenced documents (v0.12.14).\n *\n * Per-representation envelope binding (status) and any optional\n * publisher-supplied canonical-JSON digest comparison are computed by\n * the caller using the helpers in `document-binding.ts`. `verifyLocal`\n * surfaces the results on the report's `bindings` field exactly as\n * supplied; it never synthesizes envelope or canonical-digest\n * comparisons internally.\n *\n * `bindings.policy` is populated by `verifyLocal` itself from the\n * receipt's `policy.digest` and the `policyDigest` option. `bindings.terms`\n * is populated from `terms` here. `bindings.documents` is populated from\n * `documents` here. None of these fields appear on the emitted record\n * or envelope; they are verifier-report-only.\n */\n bindings?: {\n terms?: import('./verifier-types.js').DocumentBindingResult;\n documents?: import('./verifier-types.js').DocumentBindingResult[];\n };\n}\n\n/**\n * Result of successful local verification (Wire 0.2 only)\n *\n * Wire 0.1 receipts are no longer accepted by verifyLocal() and return\n * E_UNSUPPORTED_WIRE_VERSION. Re-issue as Wire 0.2 using issue().\n */\nexport interface VerifyLocalSuccess {\n /** Verification succeeded */\n valid: true;\n /** Receipt variant (always 'wire-02') */\n variant: 'wire-02';\n /** Validated Wire 0.2 receipt claims */\n claims: Wire02Claims;\n /** Key ID from JWS header (for logging/indexing) */\n kid: string;\n /** Wire format version */\n wireVersion: '0.2';\n /** Verification warnings from schema parsing and strictness routing */\n warnings: VerificationWarning[];\n /**\n * Policy binding status.\n *\n * Three-state result:\n * - 'unavailable': either the receipt contains no policy block, or the\n * caller did not pass a policyDigest option to verifyLocal(). No check.\n * - 'verified': both digests present and match exactly.\n * - 'failed': not returned on success; verifyLocal() returns\n * E_POLICY_BINDING_FAILED (valid: false) before reaching this field.\n *\n * This field is the byte-stable legacy mirror of `bindings.policy`.\n */\n policy_binding: PolicyBindingStatus;\n\n /**\n * Top-level bindings object (v0.12.14).\n *\n * `bindings.policy` is always present and equal to `policy_binding`.\n * `bindings.terms` is present iff the caller supplied terms inputs.\n * `bindings.documents` is present iff the caller supplied a non-empty\n * `documentDigests` array. `bindings.terms` and `bindings.documents`\n * appear in verifier output only; they are NOT stamped into the\n * emitted record / envelope / artifact shape.\n */\n bindings: import('./verifier-types.js').VerifierBindings;\n}\n\n/**\n * Result of failed local verification\n */\nexport interface VerifyLocalFailure {\n /** Verification failed */\n valid: false;\n\n /** Canonical error code (maps to specs/kernel/errors.json) */\n code: VerifyLocalErrorCode;\n\n /** Human-readable error message */\n message: string;\n\n /** Structured details for debugging (stable error code preserved in `code`) */\n details?: {\n /** Precise parse error code from unified parser (e.g. E_PARSE_COMMERCE_INVALID) */\n parse_code?: string;\n /** Zod validation issues (bounded, stable shape; non-normative, may change) */\n issues?: ReadonlyArray<{ path: string; message: string }>;\n /**\n * Policy digest from the receipt (present when code is E_POLICY_BINDING_FAILED).\n * Both are SHA-256 hashes; safe to log without leaking policy content.\n */\n receipt_policy_digest?: string;\n /** Caller-supplied policy digest (present when code is E_POLICY_BINDING_FAILED). */\n local_policy_digest?: string;\n /** policy.uri hint from the receipt (present when code is E_POLICY_BINDING_FAILED and uri set). */\n policy_uri?: string;\n /** Receipt type value (present when code is E_EXTENSION_GROUP_REQUIRED or E_EXTENSION_GROUP_MISMATCH). */\n type?: string;\n /** Expected extension group key for the receipt type. */\n expected_extension_group?: string;\n /** Registered extension groups actually present in extensions. */\n present_registered_extension_groups?: string[];\n };\n}\n\n/**\n * Union type for local verification result\n */\nexport type VerifyLocalResult = VerifyLocalSuccess | VerifyLocalFailure;\n\n/**\n * Internal CRYPTO_* codes that map to generic E_INVALID_FORMAT.\n * These are format/encoding errors not security-specific.\n */\nconst FORMAT_ERROR_CODES = new Set([\n 'CRYPTO_INVALID_JWS_FORMAT',\n 'CRYPTO_INVALID_TYP',\n 'CRYPTO_INVALID_ALG',\n 'CRYPTO_INVALID_KEY_LENGTH',\n]);\n\n/**\n * JOSE hardening code mapping: CRYPTO_JWS_* → specific E_JWS_* (v0.12.0-preview.1).\n *\n * Each JOSE hazard code maps to its specific public E_JWS_* counterpart rather than\n * collapsing into the generic E_INVALID_FORMAT. This lets callers distinguish embedded-key\n * injection, crit-header abuse, and unencoded-payload attacks from ordinary format errors.\n */\nconst JOSE_CODE_MAP: Record<string, VerifyLocalErrorCode> = {\n CRYPTO_JWS_EMBEDDED_KEY: 'E_JWS_EMBEDDED_KEY',\n CRYPTO_JWS_CRIT_REJECTED: 'E_JWS_CRIT_REJECTED',\n CRYPTO_JWS_MISSING_KID: 'E_JWS_MISSING_KID',\n CRYPTO_JWS_B64_REJECTED: 'E_JWS_B64_REJECTED',\n CRYPTO_JWS_ZIP_REJECTED: 'E_JWS_ZIP_REJECTED',\n // Raw-input I-JSON gate (RFC 7493): specific E_IJSON_* codes so callers can\n // distinguish duplicate member names, out-of-range numbers, and invalid\n // strings from ordinary format errors. (Generic JSON syntax errors from the\n // gate use CRYPTO_INVALID_JWS_FORMAT -> E_INVALID_FORMAT via FORMAT_ERROR_CODES.)\n CRYPTO_IJSON_DUPLICATE_MEMBER_NAME: 'E_IJSON_DUPLICATE_MEMBER_NAME',\n CRYPTO_IJSON_NUMBER_OUT_OF_RANGE: 'E_IJSON_NUMBER_OUT_OF_RANGE',\n CRYPTO_IJSON_INVALID_STRING: 'E_IJSON_INVALID_STRING',\n};\n\n/** Max parse issues to include in details (prevents log bloat) */\nconst MAX_PARSE_ISSUES = 25;\n\n/**\n * Sanitize Zod issues into a bounded, stable structure.\n * Avoids exposing raw Zod internals or unbounded arrays in the public API.\n */\nfunction sanitizeParseIssues(\n issues: unknown\n): ReadonlyArray<{ path: string; message: string }> | undefined {\n if (!Array.isArray(issues)) return undefined;\n return issues.slice(0, MAX_PARSE_ISSUES).map((issue) => ({\n path: Array.isArray(issue?.path) ? issue.path.join('.') : '',\n message: typeof issue?.message === 'string' ? issue.message : String(issue),\n }));\n}\n\n/**\n * Verify a Wire 0.2 PEAC receipt locally with a known public key.\n *\n * Wire 0.2 only: Wire 0.1 receipts return E_UNSUPPORTED_WIRE_VERSION.\n * Re-issue Wire 0.1 receipts as Wire 0.2 using issueWire02().\n *\n * This function:\n * 1. Verifies the Ed25519 signature and header (typ, alg)\n * 2. Applies strictness routing for missing typ (strict: hard error; interop: warning)\n * 3. Validates the receipt schema with Zod (Wire 0.2 only)\n * 4. Checks issuer/subject binding (if options provided)\n * 5. Checks time validity (iat with clock skew tolerance)\n * 6. Checks occurred_at skew and collects parse warnings\n *\n * @param jws - JWS compact serialization\n * @param publicKey - Ed25519 public key (32 bytes)\n * @param options - Optional verification options (issuer, subject, clock skew, strictness, policyDigest)\n * @returns Typed verification result\n *\n * @example\n * ```typescript\n * const result = await verifyLocal(jws, publicKey, {\n * issuer: 'https://api.example.com',\n * strictness: 'strict',\n * });\n * if (result.valid) {\n * console.log('Kind:', result.claims.kind);\n * console.log('Warnings:', result.warnings);\n * }\n * ```\n */\nexport async function verifyLocal(\n jws: string,\n publicKey: Uint8Array,\n options: VerifyLocalOptions = {}\n): Promise<VerifyLocalResult> {\n // Internal rollback-path flag. Selects the bounded validation\n // admission gate (default) or the inline canonical sequence\n // (rollback). Both branches share the post-admission flow: caller-\n // option binding, temporal checks, type-extension enforcement,\n // policy-binding compute, bindings construction, sortWarnings.\n const legacyPath = readLegacyPathFlag(options as unknown as LegacyPathOptions);\n\n const {\n issuer,\n subjectUri,\n maxClockSkew = 300,\n strictness = 'strict',\n policyDigest,\n bindings: callerBindings,\n } = options;\n const now = options.now ?? Math.floor(Date.now() / 1000);\n\n try {\n // 1. Verify signature and header via the internal codec boundary\n // (typ, alg validated by @peac/crypto). Default codec is a pure\n // pass-through to @peac/crypto.verify; the returned VerifyResult is\n // byte-identical to the prior release for every fixture. Format errors\n // (bad typ/header/JSON) are thrown as typed CryptoErrors and handled in\n // the catch below (format-first), so the length discrimination here runs\n // only on a well-formed JWS whose signature simply failed to verify.\n const result = await defaultCodec.decode<unknown>(jws, publicKey);\n\n if (!result.valid) {\n // The Ed25519 verifier rejects a wrong-length signature by returning\n // false (it no longer throws); distinguish that specifically from a\n // genuine signature mismatch, matching verifyReceipt() in verify.ts.\n const signatureBytes = ed25519SignatureByteLength(jws);\n const invalidLength = signatureBytes !== null && signatureBytes !== ED25519_SIGNATURE_BYTES;\n return {\n valid: false,\n code: 'E_INVALID_SIGNATURE',\n message: invalidLength\n ? 'Ed25519 signature has invalid length'\n : 'Ed25519 signature verification failed',\n };\n }\n\n // Accumulated warnings for Wire 0.2 path\n const accumulatedWarnings: VerificationWarning[] = [];\n\n // 2. Strictness routing for missing typ (Correction 1)\n if (result.header.typ === undefined) {\n if (strictness === 'strict') {\n return {\n valid: false,\n code: 'E_INVALID_FORMAT',\n message: 'Missing JWS typ header: strict mode requires typ to be present',\n };\n }\n // interop mode: emit warning and continue\n accumulatedWarnings.push({\n code: WARNING_TYP_MISSING,\n message: 'JWS typ header is absent; accepted in interop mode',\n });\n }\n\n // 3-5. Admission: kernel constraints, schema parse, parser warnings.\n //\n // The default branch routes through the bounded validation gate,\n // which surfaces canonical-equivalent E_CONSTRAINT_VIOLATION /\n // E_INVALID_FORMAT / E_UNSUPPORTED_WIRE_VERSION verdicts on\n // rejection and the parsed Wire 0.2 claims plus parser warnings\n // on acceptance. The rollback branch retains the inline canonical\n // sequence (validateKernelConstraints + parseReceiptClaims). Both\n // branches feed the same post-admission flow.\n type AdmittedClaims = {\n readonly ok: true;\n readonly wireVersion: '0.1' | '0.2';\n readonly warnings: readonly VerificationWarning[];\n readonly claims: unknown;\n };\n let pr: AdmittedClaims;\n\n if (legacyPath) {\n const constraintResult = validateKernelConstraints(result.payload);\n if (!constraintResult.valid) {\n const v = constraintResult.violations[0];\n return {\n valid: false,\n code: 'E_CONSTRAINT_VIOLATION',\n message: `Kernel constraint violated: ${v.constraint} (actual: ${v.actual}, limit: ${v.limit})`,\n };\n }\n const parsed = parseReceiptClaims(result.payload);\n if (!parsed.ok) {\n return {\n valid: false,\n code: 'E_INVALID_FORMAT',\n message: `Receipt schema validation failed: ${parsed.error.message}`,\n details: {\n parse_code: parsed.error.code,\n issues: sanitizeParseIssues(parsed.error.issues),\n },\n };\n }\n pr = parsed;\n } else {\n const gateResult = runBoundedValidationGate({\n surface: 'verifyLocal',\n payload: result.payload,\n });\n if (!gateResult.ok) {\n return {\n valid: false,\n code: gateResult.code as VerifyLocalErrorCode,\n message: gateResult.message,\n ...(gateResult.details !== undefined && { details: gateResult.details }),\n };\n }\n const parsedFromGate = gateResult.parsed;\n if (parsedFromGate === undefined) {\n return {\n valid: false,\n code: 'E_INTERNAL',\n message: 'Bounded validation gate accepted without surfacing parsed claims',\n };\n }\n pr = {\n ok: true,\n wireVersion: parsedFromGate.wireVersion,\n warnings: parsedFromGate.parserWarnings,\n claims: parsedFromGate.claims,\n };\n }\n\n // Collect parser warnings (Wire 0.2 parser may emit type/extension warnings).\n if (pr.wireVersion === '0.2') {\n accumulatedWarnings.push(...pr.warnings);\n }\n\n // Wire 0.2 path\n if (pr.wireVersion === '0.2') {\n const claims = pr.claims as Wire02Claims;\n\n // Inert shadow-call boundary (default disabled in v0.13.1; PR D\n // wires the actual flag plumbing). The hook returns undefined\n // and never affects control flow or result; this call is a\n // structural placeholder so PR D can extend the boundary\n // without touching this file again.\n maybeRunShadowValidation({ mode: 'disabled', claims });\n\n // Issuer check\n if (issuer !== undefined && claims.iss !== issuer) {\n return {\n valid: false,\n code: 'E_INVALID_ISSUER',\n message: `Issuer mismatch: expected \"${issuer}\", got \"${claims.iss}\"`,\n };\n }\n\n // Subject check\n if (subjectUri !== undefined && claims.sub !== subjectUri) {\n return {\n valid: false,\n code: 'E_INVALID_SUBJECT',\n message: `Subject mismatch: expected \"${subjectUri}\", got \"${claims.sub ?? 'undefined'}\"`,\n };\n }\n\n // iat: not-yet-valid check (with clock skew)\n if (claims.iat > now + maxClockSkew) {\n return {\n valid: false,\n code: 'E_NOT_YET_VALID',\n message: `Receipt not yet valid: issued at ${new Date(claims.iat * 1000).toISOString()}, now is ${new Date(now * 1000).toISOString()}`,\n };\n }\n\n // occurred_at skew check (evidence kind only)\n if (claims.kind === 'evidence') {\n const skewResult = checkOccurredAtSkew(claims.occurred_at, claims.iat, now, maxClockSkew);\n if (skewResult === 'future_error') {\n return {\n valid: false,\n code: 'E_OCCURRED_AT_FUTURE',\n message: `occurred_at is in the future beyond tolerance (${maxClockSkew}s)`,\n };\n }\n if (skewResult !== null) {\n accumulatedWarnings.push(skewResult);\n }\n }\n\n // Emit type_unregistered warning for valid-but-unregistered type values\n if (!REGISTERED_RECEIPT_TYPES.has(claims.type)) {\n accumulatedWarnings.push({\n code: WARNING_TYPE_UNREGISTERED,\n message: 'Receipt type is not in the recommended type registry',\n pointer: '/type',\n });\n }\n\n // Emit unknown_extension_preserved warnings for unrecognized-but-well-formed keys\n // Malformed keys are already hard errors (E_INVALID_EXTENSION_KEY) at schema layer.\n if (claims.extensions !== undefined) {\n for (const key of Object.keys(claims.extensions)) {\n if (!REGISTERED_EXTENSION_GROUP_KEYS.has(key) && isValidExtensionKey(key)) {\n // RFC 6901: '~' -> '~0', '/' -> '~1'\n const escapedKey = key.replace(/~/g, '~0').replace(/\\//g, '~1');\n accumulatedWarnings.push({\n code: WARNING_UNKNOWN_EXTENSION,\n message: 'Unknown extension key preserved without schema validation',\n pointer: `/extensions/${escapedKey}`,\n });\n }\n }\n }\n\n // Type-to-extension enforcement: check that the expected extension group is present\n const typeExtCheck = checkTypeExtensionMapping(\n claims.kind,\n claims.type,\n claims.extensions,\n TYPE_TO_EXTENSION_MAP,\n REGISTERED_EXTENSION_GROUP_KEYS\n );\n\n if (typeExtCheck.status === 'missing' || typeExtCheck.status === 'mismatch') {\n const warningCode =\n typeExtCheck.status === 'missing'\n ? WARNING_EXTENSION_GROUP_MISSING\n : WARNING_EXTENSION_GROUP_MISMATCH;\n const errorCode =\n typeExtCheck.status === 'missing'\n ? 'E_EXTENSION_GROUP_REQUIRED'\n : 'E_EXTENSION_GROUP_MISMATCH';\n\n if (strictness === 'strict') {\n return {\n valid: false,\n code: errorCode,\n message: `Type \"${claims.type}\" expects extension group \"${typeExtCheck.expected_extension_group}\" but it is ${typeExtCheck.status === 'mismatch' ? 'replaced by a different registered group' : 'absent'}`,\n details: {\n type: claims.type,\n expected_extension_group: typeExtCheck.expected_extension_group,\n present_registered_extension_groups: typeExtCheck.present_registered_extension_groups,\n },\n };\n }\n\n // Interop mode: emit warning, continue verification\n accumulatedWarnings.push({\n code: warningCode,\n message: `Type \"${claims.type}\" expects extension group \"${typeExtCheck.expected_extension_group}\"`,\n pointer: '/type',\n });\n }\n\n // Validate policyDigest option format: must be sha256:<64 lowercase hex> if provided.\n if (policyDigest !== undefined && !HASH.pattern.test(policyDigest)) {\n return {\n valid: false,\n code: 'E_INVALID_FORMAT',\n message: 'policyDigest option must be in sha256:<64 lowercase hex> format',\n };\n }\n\n // Policy binding check: 3-state result.\n // 'unavailable' when either receipt has no policy block or caller omitted policyDigest.\n // 'verified' / 'failed' when both are present; 'failed' is a hard verification error.\n const receiptPolicyDigest = claims.policy?.digest;\n const bindingStatus: PolicyBindingStatus =\n receiptPolicyDigest === undefined || policyDigest === undefined\n ? 'unavailable'\n : verifyPolicyBinding(receiptPolicyDigest, policyDigest);\n if (bindingStatus === 'failed') {\n return {\n valid: false,\n code: 'E_POLICY_BINDING_FAILED',\n message: 'Policy binding check failed: receipt policy digest does not match local policy',\n details: {\n receipt_policy_digest: receiptPolicyDigest,\n local_policy_digest: policyDigest,\n ...(claims.policy?.uri !== undefined && { policy_uri: claims.policy.uri }),\n },\n };\n }\n\n // Build the top-level `bindings` object. `policy` always present and\n // mirrors the legacy `policy_binding` field byte-stable. `terms` and\n // `documents` are surfaced from caller-supplied results; verifyLocal\n // does not synthesize envelope or canonical-digest comparisons here.\n // Report-only; never stamped into emitted record / envelope shape.\n const bindings: import('./verifier-types.js').VerifierBindings = {\n policy: bindingStatus,\n ...(callerBindings?.terms !== undefined && { terms: callerBindings.terms }),\n ...(callerBindings?.documents !== undefined &&\n callerBindings.documents.length > 0 && { documents: callerBindings.documents }),\n };\n\n const sortedWarnings = sortWarnings(accumulatedWarnings);\n\n // Shadow scheduling fires only on the rollback branch where the\n // bounded validator is genuinely a comparison path. Under the\n // default branch the gate runs as the production admission\n // path, so a duplicate shadow run would compare the same code\n // path against itself.\n if (legacyPath && isShadowEnabled(options as unknown as ShadowEnableOptions)) {\n const headerSnapshot = { ...result.header } as Record<string, unknown>;\n scheduleShadow<ShadowObservation>({\n call: 'verifyLocal',\n realResult: realObservationForVerifyLocalSuccess(sortedWarnings),\n realError: undefined,\n shadowFn: async () =>\n shadowObservationFromBounded(\n runBoundedValidatorShadow({\n claims: {\n kind: claims.kind,\n type: claims.type,\n iss: claims.iss,\n iat: claims.iat,\n occurred_at: claims.occurred_at,\n extensions: claims.extensions,\n },\n header: headerSnapshot,\n now,\n })\n ),\n recordRef: jws,\n });\n }\n\n return {\n valid: true,\n variant: 'wire-02',\n claims,\n kid: result.header.kid,\n wireVersion: '0.2',\n warnings: sortedWarnings,\n policy_binding: bindingStatus,\n bindings,\n };\n }\n\n // Wire 0.1 receipts: reject with E_UNSUPPORTED_WIRE_VERSION.\n return {\n valid: false,\n code: 'E_UNSUPPORTED_WIRE_VERSION',\n message: 'Wire 0.1 receipts are not supported. Re-issue as Wire 0.2 using issue().',\n };\n } catch (err) {\n // Handle typed CryptoError from @peac/crypto\n // Use structural check instead of instanceof for robustness across ESM/CJS boundaries\n // Map internal CRYPTO_* codes to canonical E_* codes.\n // JOSE hardening codes get specific E_JWS_* (not generic E_INVALID_FORMAT) so callers\n // can distinguish key-injection attacks from ordinary encoding errors.\n if (isCryptoError(err)) {\n // 1. JOSE hardening: specific E_JWS_* codes (checked first)\n if (Object.prototype.hasOwnProperty.call(JOSE_CODE_MAP, err.code)) {\n return {\n valid: false,\n code: JOSE_CODE_MAP[err.code]!,\n message: err.message,\n };\n }\n // 2. Generic format errors\n if (FORMAT_ERROR_CODES.has(err.code)) {\n return {\n valid: false,\n code: 'E_INVALID_FORMAT',\n message: err.message,\n };\n }\n if (err.code === 'CRYPTO_INVALID_SIGNATURE') {\n return {\n valid: false,\n code: 'E_INVALID_SIGNATURE',\n message: err.message,\n };\n }\n if (err.code === 'CRYPTO_WIRE_VERSION_MISMATCH') {\n return {\n valid: false,\n code: 'E_WIRE_VERSION_MISMATCH',\n message: err.message,\n };\n }\n }\n\n // Handle JSON parse errors from malformed payloads\n // Use structural check for cross-boundary robustness (consistent with isCryptoError pattern)\n if (\n err !== null &&\n typeof err === 'object' &&\n 'name' in err &&\n (err as { name: unknown }).name === 'SyntaxError'\n ) {\n const syntaxMessage =\n 'message' in err && typeof (err as { message: unknown }).message === 'string'\n ? (err as { message: string }).message\n : 'Invalid JSON';\n return {\n valid: false,\n code: 'E_INVALID_FORMAT',\n message: `Invalid receipt payload: ${syntaxMessage}`,\n };\n }\n\n // Defense in depth: a wrong-length Ed25519 signature is rejected on the\n // happy path (the verifier returns false and the !result.valid branch above\n // classifies it). Should any verifier error nonetheless reach here, classify\n // a wrong-length signature deterministically as an invalid signature rather\n // than letting it fall through to E_INTERNAL. Typed format errors are\n // handled earlier, so a malformed header/payload still maps to\n // E_INVALID_FORMAT (format-first).\n const signatureBytes = ed25519SignatureByteLength(jws);\n if (signatureBytes !== null && signatureBytes !== ED25519_SIGNATURE_BYTES) {\n return {\n valid: false,\n code: 'E_INVALID_SIGNATURE',\n message: 'Ed25519 signature has invalid length',\n };\n }\n\n // All other errors -> E_INTERNAL\n // No message parsing - code-based mapping only; do not surface raw\n // exception text to callers (avoids leaking internal paths/state).\n return {\n valid: false,\n code: 'E_INTERNAL',\n message: 'Unexpected verification error.',\n };\n }\n}\n\n/**\n * @deprecated Removed: verifyLocal() is Wire 0.2 only and always returns variant 'wire-02'.\n * This guard always returns false. Remove usage and use isWire02Result() instead.\n */\nexport function isCommerceResult(\n r: VerifyLocalResult\n): r is VerifyLocalSuccess & { variant: 'wire-02' } {\n // Always false: verifyLocal() only returns variant 'wire-02'\n return false;\n}\n\n/**\n * @deprecated Removed: verifyLocal() is Wire 0.2 only and always returns variant 'wire-02'.\n * This guard always returns false. Remove usage and use isWire02Result() instead.\n */\nexport function isAttestationResult(\n r: VerifyLocalResult\n): r is VerifyLocalSuccess & { variant: 'wire-02' } {\n // Always false: verifyLocal() only returns variant 'wire-02'\n return false;\n}\n\n/**\n * Type guard: narrows a VerifyLocalResult to a Wire 0.2 success (v0.12.0-preview.1).\n *\n * Use instead of manual `result.valid && result.variant === 'wire-02'` checks\n * to get proper claims narrowing to Wire02Claims.\n */\nexport function isWire02Result(\n r: VerifyLocalResult\n): r is VerifyLocalSuccess & { variant: 'wire-02' } {\n return r.valid === true && r.variant === 'wire-02';\n}\n","/**\n * HTTP header utilities for PEAC receipts and purpose\n */\n\nimport {\n PEAC_RECEIPT_HEADER,\n PEAC_PURPOSE_HEADER,\n PEAC_PURPOSE_APPLIED_HEADER,\n PEAC_PURPOSE_REASON_HEADER,\n parsePurposeHeader,\n type PurposeToken,\n type CanonicalPurpose,\n type PurposeReason,\n} from '@peac/schema';\n\n/**\n * Set PEAC-Receipt header on a response\n *\n * @param headers - Headers object (e.g., Response.headers)\n * @param receiptJws - JWS compact serialization\n */\nexport function setReceiptHeader(headers: Headers, receiptJws: string): void {\n headers.set(PEAC_RECEIPT_HEADER, receiptJws);\n}\n\n/**\n * Get PEAC-Receipt header from a request/response\n *\n * @param headers - Headers object\n * @returns JWS compact serialization, or null if not present\n */\nexport function getReceiptHeader(headers: Headers): string | null {\n return headers.get(PEAC_RECEIPT_HEADER);\n}\n\n/**\n * Set Vary: PEAC-Receipt header for caching\n *\n * @param headers - Response headers\n */\nexport function setVaryHeader(headers: Headers): void {\n const existing = headers.get('Vary');\n if (existing) {\n // Append to existing Vary header\n const varies = existing.split(',').map((v) => v.trim());\n if (!varies.includes(PEAC_RECEIPT_HEADER)) {\n headers.set('Vary', `${existing}, ${PEAC_RECEIPT_HEADER}`);\n }\n } else {\n headers.set('Vary', PEAC_RECEIPT_HEADER);\n }\n}\n\n// -----------------------------------------------------------------------------\n// Purpose Header Utilities (v0.9.24+)\n// -----------------------------------------------------------------------------\n\n/**\n * Get PEAC-Purpose header from a request\n *\n * Parses the comma-separated purpose token list into an array.\n * Normalizes tokens (lowercase, trim whitespace), deduplicates.\n *\n * @param headers - Request headers\n * @returns Array of normalized PurposeToken values, empty if header missing\n */\nexport function getPurposeHeader(headers: Headers): PurposeToken[] {\n const value = headers.get(PEAC_PURPOSE_HEADER);\n if (!value) {\n return [];\n }\n return parsePurposeHeader(value);\n}\n\n/**\n * Set PEAC-Purpose-Applied header on a response\n *\n * Indicates which purpose(s) were enforced for this request.\n *\n * @param headers - Response headers\n * @param purpose - Single canonical purpose that was enforced\n */\nexport function setPurposeAppliedHeader(headers: Headers, purpose: CanonicalPurpose): void {\n headers.set(PEAC_PURPOSE_APPLIED_HEADER, purpose);\n}\n\n/**\n * Set PEAC-Purpose-Reason header on a response\n *\n * Explains WHY the purpose was enforced as it was (audit trail).\n *\n * @param headers - Response headers\n * @param reason - Purpose reason enum value\n */\nexport function setPurposeReasonHeader(headers: Headers, reason: PurposeReason): void {\n headers.set(PEAC_PURPOSE_REASON_HEADER, reason);\n}\n\n/**\n * Set Vary: PEAC-Purpose header for caching\n *\n * If response behavior varies by declared purpose, MUST set this header.\n *\n * @param headers - Response headers\n */\nexport function setVaryPurposeHeader(headers: Headers): void {\n const existing = headers.get('Vary');\n if (existing) {\n const varies = existing.split(',').map((v) => v.trim());\n if (!varies.includes(PEAC_PURPOSE_HEADER)) {\n headers.set('Vary', `${existing}, ${PEAC_PURPOSE_HEADER}`);\n }\n } else {\n headers.set('Vary', PEAC_PURPOSE_HEADER);\n }\n}\n","/**\n * Document binding utilities (Layer 3)\n *\n * Generalized binding helpers for `peac-policy/0.1` policy documents,\n * x402 PR #1986 `terms` representations, and any other referenced\n * document. Three-state semantics (`verified` / `failed` / `unavailable`)\n * are reused from `policy-binding`.\n *\n * Helper-naming rule (normative, see `docs/specs/DOCUMENT-BINDING.md`):\n * - `computeJsonDocumentDigestJcs` is JSON-only (RFC 8785 JCS + SHA-256).\n * - `computeTextDocumentDigestUtf8` is text-only (UTF-8 with `\\n` line\n * endings + NFC, preserving all other bytes including trailing\n * whitespace).\n * - `computeDocumentDigest` is the umbrella dispatcher.\n *\n * The `Jcs` suffix is reserved for JSON-only helpers; text-only helpers\n * name their scheme. This prevents the `aipref/resolver.ts` historical\n * bug where a sort-keys `JSON.stringify` digest was labelled `JCS-SHA256`.\n *\n * The `policy_binding` field on the verifier report is the byte-stable\n * legacy mirror of `bindings.policy`; both are populated identically.\n *\n * @see docs/specs/DOCUMENT-BINDING.md\n * @see packages/protocol/src/policy-binding.ts\n */\n\nimport { jcsHash } from '@peac/crypto';\nimport { HASH } from '@peac/kernel';\nimport type { JsonValue } from '@peac/kernel';\nimport type { PolicyBindingStatus } from './verifier-types.js';\nimport { verifyPolicyBinding } from '@peac/schema';\n\nexport type DocumentRepresentation = 'uri' | 'markdown' | 'plaintext' | 'json';\n\n/**\n * Compute the RFC 8785 JCS canonicalization + SHA-256 digest of a JSON\n * document. Returns the canonical PEAC self-describing hash format\n * `'sha256:<64 lowercase hex>'`. Suitable for `peac-policy/0.1` policy\n * docs and any other JSON-shaped document carried in or referenced from\n * a record.\n */\nexport async function computeJsonDocumentDigestJcs(value: JsonValue): Promise<string> {\n const hex = await jcsHash(value);\n return `${HASH.prefix}${hex}`;\n}\n\n/**\n * Compute the SHA-256 digest of a UTF-8 text document after the minimal\n * canonical normalization documented in `docs/specs/DOCUMENT-BINDING.md`:\n *\n * 1. Normalize line endings to `\\n` (strip `\\r` before `\\n`; replace a\n * lone `\\r` with `\\n`).\n * 2. Normalize Unicode to NFC.\n * 3. Preserve all other bytes exactly.\n *\n * Trailing whitespace is **not** stripped. Blank lines are **not**\n * collapsed. Case is **not** normalized. The intent is a deterministic\n * representation envelope identity, not a \"pretty-print before hashing\"\n * scheme. Text representations like `markdown` and `plaintext` are\n * frequently signed by publishers, and silent transformations would\n * break those signatures.\n *\n * Returns the canonical PEAC self-describing hash format\n * `'sha256:<64 lowercase hex>'`.\n *\n * @param bytes UTF-8 string to hash (single representation envelope).\n * @param representation Tag recorded by the caller; not currently\n * altering the hash but reserved so future representation-specific\n * normalization rules can be added without renaming the helper.\n */\nexport async function computeTextDocumentDigestUtf8(\n bytes: string,\n _representation: 'markdown' | 'plaintext'\n): Promise<string> {\n const normalized = bytes.replace(/\\r\\n/g, '\\n').replace(/\\r/g, '\\n').normalize('NFC');\n const buf = new TextEncoder().encode(normalized);\n const hashBuffer = await crypto.subtle.digest('SHA-256', buf);\n const hashArray = Array.from(new Uint8Array(hashBuffer));\n const hex = hashArray.map((b) => b.toString(16).padStart(2, '0')).join('');\n return `${HASH.prefix}${hex}`;\n}\n\n/**\n * Umbrella dispatcher. Selects the correct scheme-specific helper from\n * `input.representation`.\n *\n * For `representation: 'uri'`, the bytes the caller fetched from the URI\n * MUST be supplied via `bytes`. Without bytes the dispatcher returns\n * `'unavailable'`: the URI alone is not enough to bind, and PEAC does\n * not perform network I/O from this layer (callers fetch under their own\n * SSRF / redirect / timeout policy). When bytes are supplied for a URI,\n * they are hashed via the text helper.\n */\nexport async function computeDocumentDigest(\n input:\n | { representation: 'json'; value: JsonValue }\n | { representation: 'markdown' | 'plaintext'; bytes: string }\n | { representation: 'uri'; uri: string; bytes?: string }\n): Promise<string | 'unavailable'> {\n switch (input.representation) {\n case 'json':\n return computeJsonDocumentDigestJcs(input.value);\n case 'markdown':\n case 'plaintext':\n return computeTextDocumentDigestUtf8(input.bytes, input.representation);\n case 'uri':\n if (typeof input.bytes !== 'string') return 'unavailable';\n return computeTextDocumentDigestUtf8(input.bytes, 'plaintext');\n }\n}\n\n/**\n * Three-state binding check. Same semantics as `checkPolicyBinding`:\n *\n * - `'unavailable'` when either digest is missing.\n * - `'verified'` when both digests are present and match exactly.\n * - `'failed'` when both digests are present but do not match.\n *\n * The legacy `checkPolicyBinding` export delegates to this function.\n */\nexport function checkDocumentBinding(\n receiptDigest: string | undefined,\n localDigest: string | undefined\n): PolicyBindingStatus {\n if (receiptDigest === undefined || localDigest === undefined) {\n return 'unavailable';\n }\n return verifyPolicyBinding(receiptDigest, localDigest);\n}\n","/**\n * Policy binding utilities (Layer 3)\n *\n * Thin delegate over `document-binding.ts`. Preserves the pre-v0.12.14\n * API surface (`computePolicyDigestJcs`, `checkPolicyBinding`) with\n * byte-identical output. New callers should prefer the generalized\n * helpers in `document-binding.ts`.\n *\n * The pure string comparison (`verifyPolicyBinding`) lives in Layer 1\n * (`@peac/schema`) so consumers that only need to check pre-computed\n * digests do not pull in protocol-level dependencies.\n *\n * @see packages/protocol/src/document-binding.ts\n * @see docs/specs/DOCUMENT-BINDING.md\n */\n\nimport type { JsonValue } from '@peac/kernel';\nimport type { PolicyBindingStatus } from './verifier-types.js';\nimport { checkDocumentBinding, computeJsonDocumentDigestJcs } from './document-binding.js';\n\n/**\n * Compute the JCS+SHA-256 digest of a policy object.\n *\n * Canonicalizes the policy value via RFC 8785 (JSON Canonicalization\n * Scheme), computes SHA-256 over the resulting UTF-8 bytes, and returns\n * the result in the PEAC self-describing hash format\n * `'sha256:<64 lowercase hex>'`.\n *\n * This is the normative digest format for the policy.digest field in\n * Wire 0.2 records. The format is stable and identical across\n * implementations. Output is byte-identical to\n * `computeJsonDocumentDigestJcs(policy)` from `document-binding.ts`.\n *\n * Callers MUST pass the same JSON structure that was embedded in the\n * receipt's policy block when issuing. Key order is irrelevant; JCS\n * normalizes it.\n *\n * @param policy - Policy value (any JSON-serializable value)\n * @returns Digest string in 'sha256:<64 lowercase hex>' format\n * @throws Error if the value cannot be canonicalized (e.g., contains\n * functions or non-finite numbers)\n */\nexport async function computePolicyDigestJcs(policy: JsonValue): Promise<string> {\n return computeJsonDocumentDigestJcs(policy);\n}\n\n/**\n * Compute the 3-state policy binding result.\n *\n * Three-state semantics:\n * - `'unavailable'`: either digest is absent (receipt has no policy\n * block, or caller did not provide a local digest). No binding\n * check performed.\n * - `'verified'`: both digests present and match exactly.\n * - `'failed'`: both digests present but do not match.\n *\n * When the result is `'failed'`, `verifyLocal()` returns\n * `E_POLICY_BINDING_FAILED` as a hard verification error.\n *\n * Output is byte-identical to `checkDocumentBinding` from\n * `document-binding.ts`.\n *\n * @param receiptDigest - policy.digest from the receipt claims; undefined if\n * the receipt contains no policy block\n * @param localDigest - digest computed from the caller's local policy bytes via\n * `computePolicyDigestJcs()`; undefined if the caller has no policy to check\n * @returns Three-state PolicyBindingStatus\n */\nexport function checkPolicyBinding(\n receiptDigest: string | undefined,\n localDigest: string | undefined\n): PolicyBindingStatus {\n return checkDocumentBinding(receiptDigest, localDigest);\n}\n","/**\n * PEAC Verifier Types\n *\n * Types for verification policy, trust pinning, and verification reports\n * per VERIFIER-SECURITY-MODEL.md, TRUST-PINNING-POLICY.md, and\n * VERIFICATION-REPORT-FORMAT.md\n *\n * @packageDocumentation\n */\n\nimport {\n VERIFIER_LIMITS,\n VERIFIER_NETWORK,\n VERIFIER_POLICY_VERSION,\n VERIFICATION_REPORT_VERSION,\n} from '@peac/kernel';\n\n// ---------------------------------------------------------------------------\n// Policy Binding\n// ---------------------------------------------------------------------------\n\n/**\n * Three-state policy binding status\n *\n * - 'verified': Policy digest in receipt matches local policy bytes (Wire 0.2+)\n * - 'failed': Policy digest mismatch (Wire 0.2+)\n * - 'unavailable': No policy digest in receipt or no policy bytes available.\n * Always 'unavailable' for Wire 0.1 receipts.\n */\nexport type PolicyBindingStatus = 'verified' | 'failed' | 'unavailable';\n\n// ---------------------------------------------------------------------------\n// Document Binding (terms / policy / referenced documents)\n// ---------------------------------------------------------------------------\n\n/**\n * Representation envelope tag for a bound document. Matches the four\n * x402 PR #1986 `terms` representations and is shared by other binding\n * paths (policy docs, referenced documents).\n */\nexport type DocumentRepresentation = 'uri' | 'markdown' | 'plaintext' | 'json';\n\n/**\n * Result of a document-binding check.\n *\n * `status` carries the three-state outcome for the per-representation\n * envelope binding. `canonical_digest` and `canonical_digest_status` are\n * **publisher-supplied only**: a publisher MAY assert a canonical-JSON\n * digest that they consider equivalent across multiple representations.\n * Verifiers MAY compare it when both sides supply it; verifiers MUST\n * NOT synthesize it from non-JSON representations. Absence is\n * `'unavailable'`, NOT `'failed'`.\n *\n * @see docs/specs/DOCUMENT-BINDING.md\n */\nexport interface DocumentBindingResult {\n /** Caller-supplied identifier (free-form; useful when reporting multiple documents). */\n ref: string;\n /** Representation envelope this binding refers to. */\n representation?: DocumentRepresentation;\n /** Per-representation envelope binding status. */\n status: PolicyBindingStatus;\n /**\n * Publisher-supplied canonical-JSON digest (`sha256:<64 hex>`).\n * Verifiers compare only when both sides supply it; verifiers MUST\n * NOT synthesize from non-JSON representations.\n */\n canonical_digest?: string;\n /** Three-state outcome for the optional canonical-digest comparison. */\n canonical_digest_status?: PolicyBindingStatus;\n}\n\n/**\n * Top-level `bindings` object on the verifier report. `policy` is always\n * present (mirrors the legacy top-level `policy_binding` field\n * byte-stable). `terms` is present iff the caller supplied a terms\n * digest; `documents` is present iff the caller supplied a list of\n * document digests.\n *\n * `bindings.terms` and `bindings.documents` appear in the verifier\n * report output only; they are NOT stamped into the emitted record /\n * envelope / artifact shape.\n */\nexport interface VerifierBindings {\n policy: PolicyBindingStatus;\n terms?: DocumentBindingResult;\n documents?: DocumentBindingResult[];\n}\n\n// ---------------------------------------------------------------------------\n// Verification Mode\n// ---------------------------------------------------------------------------\n\n/**\n * Verification mode per VERIFIER-SECURITY-MODEL.md\n */\nexport type VerificationMode = 'offline_only' | 'offline_preferred' | 'network_allowed';\n\n// ---------------------------------------------------------------------------\n// Trust Pinning\n// ---------------------------------------------------------------------------\n\n/**\n * Pinned key entry per TRUST-PINNING-POLICY.md\n *\n * Uses RFC 7638 JWK Thumbprint with base64url encoding (NOT hex).\n * SHA-256 thumbprints are 43 characters in base64url.\n *\n * For offline verification, include either `public_key` (base64url 32 bytes)\n * or the full `jwk` object. If only thumbprint is provided, the key can only\n * be pin-checked after fetching JWKS (requires network mode).\n */\nexport interface PinnedKey {\n /** Issuer origin (https://host[:port]) */\n issuer: string;\n /** Key identifier (kid from JWKS) */\n kid: string;\n /** RFC 7638 JWK Thumbprint, SHA-256, base64url-encoded (43 chars) */\n jwk_thumbprint_sha256: string;\n /**\n * Ed25519 public key bytes, base64url-encoded (43 chars for 32 bytes).\n * If provided, enables offline verification without JWKS fetch.\n */\n public_key?: string;\n /**\n * Full JWK for offline verification.\n * If provided, enables offline verification without JWKS fetch.\n * Takes precedence over public_key.\n */\n jwk?: {\n kty: 'OKP';\n crv: 'Ed25519';\n x: string;\n kid?: string;\n };\n}\n\n/**\n * Issuer allowlist entry\n *\n * Full origin format: https://host[:port]\n * The port is only included if non-standard (not 443 for HTTPS).\n */\nexport type IssuerOrigin = string;\n\n// ---------------------------------------------------------------------------\n// Verifier Limits\n// ---------------------------------------------------------------------------\n\n/**\n * Verifier security limits\n */\nexport interface VerifierLimits {\n /** Maximum receipt size in bytes */\n max_receipt_bytes: number;\n /** Maximum JWKS document size in bytes */\n max_jwks_bytes: number;\n /** Maximum number of keys in a JWKS */\n max_jwks_keys: number;\n /** Maximum redirects to follow */\n max_redirects: number;\n /** Network fetch timeout in milliseconds */\n fetch_timeout_ms: number;\n /** Maximum extension size in bytes */\n max_extension_bytes: number;\n}\n\n/**\n * Default verifier limits from VERIFIER-SECURITY-MODEL.md\n */\nexport const DEFAULT_VERIFIER_LIMITS: VerifierLimits = {\n max_receipt_bytes: VERIFIER_LIMITS.maxReceiptBytes,\n max_jwks_bytes: VERIFIER_LIMITS.maxJwksBytes,\n max_jwks_keys: VERIFIER_LIMITS.maxJwksKeys,\n max_redirects: VERIFIER_LIMITS.maxRedirects,\n fetch_timeout_ms: VERIFIER_LIMITS.fetchTimeoutMs,\n max_extension_bytes: VERIFIER_LIMITS.maxExtensionBytes,\n};\n\n// ---------------------------------------------------------------------------\n// Network Security\n// ---------------------------------------------------------------------------\n\n/**\n * Network security settings\n */\nexport interface NetworkSecurity {\n /** Only allow HTTPS URLs */\n https_only: boolean;\n /** Block requests to private IP ranges */\n block_private_ips: boolean;\n /** Allow redirects */\n allow_redirects: boolean;\n /**\n * Allow cross-origin redirects (default: true for CDN compatibility).\n * When true, redirects to different origins are allowed if they pass SSRF checks.\n * When false, only same-origin redirects are allowed.\n */\n allow_cross_origin_redirects?: boolean;\n /**\n * Behavior on DNS resolution failure (default: 'block' for security).\n * - 'block': Treat DNS failure as blocked (fail-closed, more secure)\n * - 'fail': Return fetch error (allows retry, less restrictive)\n */\n dns_failure_behavior?: 'block' | 'fail';\n}\n\n/**\n * Default network security settings from VERIFIER-SECURITY-MODEL.md\n */\nexport const DEFAULT_NETWORK_SECURITY: NetworkSecurity = {\n https_only: VERIFIER_NETWORK.httpsOnly,\n block_private_ips: VERIFIER_NETWORK.blockPrivateIps,\n allow_redirects: VERIFIER_NETWORK.allowRedirects,\n allow_cross_origin_redirects: true, // Allow for CDN compatibility\n dns_failure_behavior: 'block', // Fail-closed by default\n};\n\n// ---------------------------------------------------------------------------\n// Verifier Policy\n// ---------------------------------------------------------------------------\n\n/**\n * Verifier policy configuration\n *\n * This structure echoes the policy used for verification, making trust\n * decisions auditable per VERIFICATION-REPORT-FORMAT.md.\n */\nexport interface VerifierPolicy {\n /** Policy schema version */\n policy_version: typeof VERIFIER_POLICY_VERSION;\n /** Verification mode */\n mode: VerificationMode;\n /** Allowed issuer origins (optional, if empty all issuers allowed) */\n issuer_allowlist?: IssuerOrigin[];\n /** Pinned keys for offline verification */\n pinned_keys?: PinnedKey[];\n /** Effective security limits */\n limits: VerifierLimits;\n /** Network security settings */\n network: NetworkSecurity;\n}\n\n/**\n * Create a default verifier policy\n */\nexport function createDefaultPolicy(mode: VerificationMode): VerifierPolicy {\n return {\n policy_version: VERIFIER_POLICY_VERSION,\n mode,\n limits: { ...DEFAULT_VERIFIER_LIMITS },\n network: { ...DEFAULT_NETWORK_SECURITY },\n };\n}\n\n// ---------------------------------------------------------------------------\n// Verification Checks\n// ---------------------------------------------------------------------------\n\n/**\n * Check status\n */\nexport type CheckStatus = 'pass' | 'fail' | 'skip';\n\n/**\n * Standard check IDs per VERIFIER-SECURITY-MODEL.md (in order).\n *\n * APPEND-ONLY CONTRACT:\n * - New checks MUST only be appended to the end of this array.\n * - Existing entries MUST NOT be removed, reordered, or renamed.\n * - Downstream consumers (conformance fixtures, report builders, dashboards)\n * depend on stable indices and the `as const` tuple type.\n * - Breaking this contract invalidates all existing verification reports\n * and conformance vectors.\n * - Enforced by prefix-pinning test in verification-report.test.ts.\n *\n * OUTPUT ORDER vs EVALUATION ORDER:\n * This array defines the report output (render) order only. Verifier\n * implementations MAY evaluate checks in any order internally (e.g.,\n * checking signature before discovery). The report builder normalizes\n * results into this canonical order regardless of evaluation sequence.\n *\n * To add a new check:\n * 1. Append the new ID to the end of this array.\n * 2. Update the conformance fixture: specs/conformance/fixtures/verifier/verification-report.json\n * 3. Update the spec: docs/specs/VERIFICATION-REPORT-FORMAT.md (Section 5.5)\n * 4. Update the spec: docs/specs/VERIFIER-SECURITY-MODEL.md (Section 6.1)\n */\nexport const CHECK_IDS = [\n 'jws.parse',\n 'limits.receipt_bytes',\n 'jws.protected_header',\n 'claims.schema_unverified',\n 'issuer.trust_policy',\n 'issuer.discovery',\n 'key.resolve',\n 'jws.signature',\n 'claims.time_window',\n 'extensions.limits',\n 'transport.profile_binding',\n 'policy.binding',\n] as const;\n\nexport type CheckId = (typeof CHECK_IDS)[number];\n\n/**\n * Single verification check result\n */\nexport interface CheckResult {\n /** Stable check identifier */\n id: CheckId;\n /** Check status */\n status: CheckStatus;\n /** Machine-readable details (optional) */\n detail?: Record<string, unknown>;\n /** Stable error code (if failed) */\n error_code?: string;\n}\n\n// ---------------------------------------------------------------------------\n// Verification Report Input\n// ---------------------------------------------------------------------------\n\n/**\n * Input type for verification\n */\nexport type InputType = 'receipt_jws' | 'bundle_entry';\n\n/**\n * Digest object (algorithm + value)\n */\nexport interface DigestObject {\n /** Hash algorithm */\n alg: 'sha-256';\n /** Hash value in lowercase hex */\n value: string;\n}\n\n/**\n * Bundle context for bundle_entry input type\n */\nexport interface BundleContext {\n /** Digest of bundle bytes */\n bundle_digest: DigestObject;\n /** 0-based entry index */\n entry_index: number;\n /** Stable entry ID (optional) */\n entry_id?: string;\n}\n\n/**\n * Verification input descriptor\n */\nexport interface VerificationInput {\n /** Input type */\n type: InputType;\n /** Digest of receipt bytes */\n receipt_digest: DigestObject;\n /** Bundle context (if type = bundle_entry) */\n bundle?: BundleContext;\n}\n\n// ---------------------------------------------------------------------------\n// Verification Report Result\n// ---------------------------------------------------------------------------\n\n/**\n * Result severity\n */\nexport type ResultSeverity = 'info' | 'warning' | 'error';\n\n/**\n * Reason codes per VERIFIER-SECURITY-MODEL.md\n */\nexport type ReasonCode =\n | 'ok'\n | 'receipt_too_large'\n | 'malformed_receipt'\n | 'signature_invalid'\n | 'issuer_not_allowed'\n | 'key_not_found'\n | 'key_fetch_blocked'\n | 'key_fetch_failed'\n | 'key_fetch_timeout'\n | 'pointer_fetch_blocked'\n | 'pointer_fetch_failed'\n | 'pointer_fetch_timeout'\n | 'pointer_fetch_too_large'\n | 'pointer_digest_mismatch'\n | 'jwks_too_large'\n | 'jwks_too_many_keys'\n | 'expired'\n | 'not_yet_valid'\n | 'audience_mismatch'\n | 'schema_invalid'\n | 'policy_violation'\n | 'extension_too_large'\n | 'invalid_transport';\n\n/**\n * High-level verification result\n */\nexport interface VerificationResult {\n /** Overall verification result */\n valid: boolean;\n /** Stable reason code */\n reason: ReasonCode;\n /** Result severity */\n severity: ResultSeverity;\n /** Receipt wire format (e.g., peac-receipt/0.1) */\n receipt_type: string;\n /** Normalized issuer origin (optional) */\n issuer?: string;\n /** Key ID used for verification (optional) */\n kid?: string;\n /**\n * Policy binding status.\n *\n * Always 'unavailable' for Wire 0.1 receipts.\n * Wire 0.2+ receipts with `peac.policy.digest` will report 'verified' or 'failed'.\n *\n * This field is ALWAYS present (never undefined). Consumers can rely on it\n * without null checks.\n */\n policy_binding: PolicyBindingStatus;\n}\n\n// ---------------------------------------------------------------------------\n// Verification Report Artifacts\n// ---------------------------------------------------------------------------\n\n/**\n * Pointer resolution details\n */\nexport interface PointerArtifact {\n /** Pointer URL */\n url: string;\n /** Expected digest from header */\n expected_digest: DigestObject;\n /** Actual digest of fetched content */\n actual_digest?: DigestObject;\n /** Whether digests matched */\n digest_matched?: boolean;\n}\n\n/**\n * Key source for enterprise debuggability\n */\nexport type KeySource = 'pinned' | 'jwks_fetch';\n\n/**\n * Additional verification artifacts\n *\n * Artifacts are divided into two categories:\n *\n * **Deterministic artifacts** (same inputs and policy -> same values):\n * - `issuer_key_source`: Always determined by policy and receipt\n * - `issuer_key_thumbprint`: Computed from the signing key\n * - `normalized_claims_digest`: Computed from the claims\n * - `receipt_pointer`: Derived from the input pointer header\n *\n * **Non-deterministic artifacts** (may vary based on runtime state):\n * - `issuer_jwks_digest`: Only present when JWKS is fetched fresh (not from cache)\n *\n * Use `buildDeterministic()` to exclude non-deterministic artifacts for\n * reproducible report generation.\n */\nexport interface VerificationArtifacts {\n /**\n * Digest of JWKS used for verification.\n *\n * NON-DETERMINISTIC: Only present when JWKS is fetched fresh (not from cache).\n * Excluded by `buildDeterministic()`.\n */\n issuer_jwks_digest?: DigestObject;\n /** Source of the signing key used for verification (DETERMINISTIC) */\n issuer_key_source?: KeySource;\n /** RFC 7638 JWK Thumbprint (SHA-256, base64url) of the key used (DETERMINISTIC) */\n issuer_key_thumbprint?: string;\n /** Digest of canonicalized claims (DETERMINISTIC) */\n normalized_claims_digest?: DigestObject;\n /** Pointer resolution details (DETERMINISTIC) */\n receipt_pointer?: PointerArtifact;\n}\n\n/**\n * Keys of artifacts that are non-deterministic (depend on runtime state)\n */\nexport const NON_DETERMINISTIC_ARTIFACT_KEYS: (keyof VerificationArtifacts)[] = [\n 'issuer_jwks_digest',\n];\n\n// ---------------------------------------------------------------------------\n// Verification Report Meta\n// ---------------------------------------------------------------------------\n\n/**\n * Verifier implementation info\n */\nexport interface VerifierInfo {\n /** Verifier name */\n name: string;\n /** Verifier version */\n version: string;\n}\n\n/**\n * Non-deterministic metadata (MUST be excluded from report hashes)\n */\nexport interface VerificationMeta {\n /** RFC 3339 timestamp when report was generated */\n generated_at?: string;\n /** Verifier implementation info */\n verifier?: VerifierInfo;\n}\n\n// ---------------------------------------------------------------------------\n// Verification Report\n// ---------------------------------------------------------------------------\n\n/**\n * PEAC Verification Report per VERIFICATION-REPORT-FORMAT.md\n *\n * This report is designed to be:\n * - Portable: shareable across organizations\n * - Deterministic: reproducible given same inputs\n * - Safe: bounded resource usage\n * - Policy-aware: trust decisions are explicit\n */\nexport interface VerificationReport {\n /** Format version identifier (REQUIRED) */\n report_version: typeof VERIFICATION_REPORT_VERSION;\n /** What was verified (REQUIRED) */\n input: VerificationInput;\n /** Policy used for verification (REQUIRED) */\n policy: VerifierPolicy;\n /** High-level outcome (REQUIRED) */\n result: VerificationResult;\n /** Ordered list of checks (REQUIRED) */\n checks: CheckResult[];\n /** Additional outputs (OPTIONAL) */\n artifacts?: VerificationArtifacts;\n /** Non-deterministic fields (OPTIONAL, excluded from hashes) */\n meta?: VerificationMeta;\n}\n\n// ---------------------------------------------------------------------------\n// Report Builder Utilities\n// ---------------------------------------------------------------------------\n\n/**\n * Create a digest object from a hex string\n */\nexport function createDigest(hexValue: string): DigestObject {\n return {\n alg: 'sha-256',\n value: hexValue.toLowerCase(),\n };\n}\n\n/**\n * Create an empty verification report structure\n */\nexport function createEmptyReport(\n policy: VerifierPolicy\n): Omit<VerificationReport, 'input' | 'result' | 'checks'> {\n return {\n report_version: VERIFICATION_REPORT_VERSION,\n policy,\n };\n}\n\n/**\n * Map SSRF fetch error reason to verification reason code\n */\nexport function ssrfErrorToReasonCode(\n ssrfReason: string,\n fetchType: 'key' | 'pointer'\n): ReasonCode {\n const prefix = fetchType === 'key' ? 'key_fetch' : 'pointer_fetch';\n\n switch (ssrfReason) {\n case 'not_https':\n case 'private_ip':\n case 'loopback':\n case 'link_local':\n case 'cross_origin_redirect':\n case 'dns_failure':\n return `${prefix}_blocked` as ReasonCode;\n case 'timeout':\n return `${prefix}_timeout` as ReasonCode;\n case 'response_too_large':\n return fetchType === 'pointer' ? 'pointer_fetch_too_large' : 'jwks_too_large';\n case 'jwks_too_many_keys':\n return 'jwks_too_many_keys';\n case 'too_many_redirects':\n case 'scheme_downgrade':\n case 'network_error':\n case 'invalid_url':\n default:\n return `${prefix}_failed` as ReasonCode;\n }\n}\n\n/**\n * Map reason code to severity\n */\nexport function reasonCodeToSeverity(reason: ReasonCode): ResultSeverity {\n if (reason === 'ok') return 'info';\n return 'error';\n}\n\n/**\n * Map reason code to error code\n */\nexport function reasonCodeToErrorCode(reason: ReasonCode): string {\n const mapping: Record<ReasonCode, string> = {\n ok: '',\n receipt_too_large: 'E_VERIFY_RECEIPT_TOO_LARGE',\n malformed_receipt: 'E_VERIFY_MALFORMED_RECEIPT',\n signature_invalid: 'E_VERIFY_SIGNATURE_INVALID',\n issuer_not_allowed: 'E_VERIFY_ISSUER_NOT_ALLOWED',\n key_not_found: 'E_VERIFY_KEY_NOT_FOUND',\n key_fetch_blocked: 'E_VERIFY_KEY_FETCH_BLOCKED',\n key_fetch_failed: 'E_VERIFY_KEY_FETCH_FAILED',\n key_fetch_timeout: 'E_VERIFY_KEY_FETCH_TIMEOUT',\n pointer_fetch_blocked: 'E_VERIFY_POINTER_FETCH_BLOCKED',\n pointer_fetch_failed: 'E_VERIFY_POINTER_FETCH_FAILED',\n pointer_fetch_timeout: 'E_VERIFY_POINTER_FETCH_TIMEOUT',\n pointer_fetch_too_large: 'E_VERIFY_POINTER_FETCH_TOO_LARGE',\n pointer_digest_mismatch: 'E_VERIFY_POINTER_DIGEST_MISMATCH',\n jwks_too_large: 'E_VERIFY_JWKS_TOO_LARGE',\n jwks_too_many_keys: 'E_VERIFY_JWKS_TOO_MANY_KEYS',\n expired: 'E_VERIFY_EXPIRED',\n not_yet_valid: 'E_VERIFY_NOT_YET_VALID',\n audience_mismatch: 'E_VERIFY_AUDIENCE_MISMATCH',\n schema_invalid: 'E_VERIFY_SCHEMA_INVALID',\n policy_violation: 'E_VERIFY_POLICY_VIOLATION',\n extension_too_large: 'E_VERIFY_EXTENSION_TOO_LARGE',\n invalid_transport: 'E_VERIFY_INVALID_TRANSPORT',\n };\n return mapping[reason] || 'E_VERIFY_POLICY_VIOLATION';\n}\n","/**\n * PEAC Verification Report Builder\n *\n * Constructs deterministic verification reports per VERIFICATION-REPORT-FORMAT.md.\n * Reports are designed to be portable, deterministic, safe, and policy-aware.\n *\n * @packageDocumentation\n */\n\nimport { sha256Hex } from '@peac/crypto';\nimport { VERIFICATION_REPORT_VERSION, WIRE_TYPE } from '@peac/kernel';\nimport type {\n CheckId,\n CheckResult,\n CheckStatus,\n DigestObject,\n ReasonCode,\n VerificationArtifacts,\n VerificationInput,\n VerificationMeta,\n VerificationReport,\n VerificationResult,\n VerifierPolicy,\n} from './verifier-types.js';\nimport {\n CHECK_IDS,\n createDigest,\n NON_DETERMINISTIC_ARTIFACT_KEYS,\n reasonCodeToErrorCode,\n reasonCodeToSeverity,\n} from './verifier-types.js';\n\n/**\n * Report builder state\n */\ninterface ReportBuilderState {\n input?: VerificationInput;\n receiptDigestHex?: string;\n policy: VerifierPolicy;\n checks: Map<CheckId, CheckResult>;\n result?: VerificationResult;\n artifacts?: Record<string, unknown>;\n meta?: VerificationMeta;\n shortCircuited: boolean;\n failedAtCheck?: CheckId;\n}\n\n/**\n * Verification Report Builder\n *\n * Builds verification reports with proper check ordering and short-circuit behavior.\n * Ensures reports conform to VERIFICATION-REPORT-FORMAT.md requirements.\n *\n * Shape-stable: Always emits all checks with pass/fail/skip status.\n */\nexport class VerificationReportBuilder {\n private state: ReportBuilderState;\n\n constructor(policy: VerifierPolicy) {\n this.state = {\n policy,\n checks: new Map(),\n shortCircuited: false,\n };\n }\n\n /**\n * Set the input descriptor with pre-computed digest\n *\n * Use this when you've already computed the SHA-256 hash.\n *\n * @param digestHex - SHA-256 digest as lowercase hex (64 chars)\n * @param type - Input type\n */\n setInputWithDigest(\n digestHex: string,\n type: 'receipt_jws' | 'bundle_entry' = 'receipt_jws'\n ): this {\n this.state.receiptDigestHex = digestHex;\n this.state.input = {\n type,\n receipt_digest: createDigest(digestHex),\n };\n return this;\n }\n\n /**\n * Set the input descriptor (async - computes SHA-256)\n *\n * @param receiptBytes - Raw receipt bytes\n * @param type - Input type\n */\n async setInputAsync(\n receiptBytes: Uint8Array,\n type: 'receipt_jws' | 'bundle_entry' = 'receipt_jws'\n ): Promise<this> {\n const digestHex = await sha256Hex(receiptBytes);\n return this.setInputWithDigest(digestHex, type);\n }\n\n /**\n * Add a check result\n *\n * Checks can be added in any order; they will be sorted in build().\n * If a previous check failed, subsequent checks should be marked as skip.\n */\n addCheck(\n id: CheckId,\n status: CheckStatus,\n detail?: Record<string, unknown>,\n errorCode?: string\n ): this {\n const check: CheckResult = { id, status };\n if (detail && Object.keys(detail).length > 0) {\n check.detail = detail;\n }\n if (errorCode) {\n check.error_code = errorCode;\n }\n\n this.state.checks.set(id, check);\n\n // Track short-circuit on failure\n if (status === 'fail' && !this.state.shortCircuited) {\n this.state.shortCircuited = true;\n this.state.failedAtCheck = id;\n }\n\n return this;\n }\n\n /**\n * Add a passing check\n */\n pass(id: CheckId, detail?: Record<string, unknown>): this {\n return this.addCheck(id, 'pass', detail);\n }\n\n /**\n * Add a failing check\n */\n fail(id: CheckId, errorCode: string, detail?: Record<string, unknown>): this {\n return this.addCheck(id, 'fail', detail, errorCode);\n }\n\n /**\n * Add a skipped check\n */\n skip(id: CheckId, detail?: Record<string, unknown>): this {\n return this.addCheck(id, 'skip', detail);\n }\n\n /**\n * Set the final result\n */\n setResult(\n valid: boolean,\n reason: ReasonCode,\n options?: {\n issuer?: string;\n kid?: string;\n receiptType?: string;\n }\n ): this {\n this.state.result = {\n valid,\n reason,\n severity: reasonCodeToSeverity(reason),\n receipt_type: options?.receiptType ?? WIRE_TYPE,\n // Wire 0.1: always 'unavailable'. Wire 0.2 will set this via options.\n policy_binding: 'unavailable',\n ...(options?.issuer && { issuer: options.issuer }),\n ...(options?.kid && { kid: options.kid }),\n };\n return this;\n }\n\n /**\n * Set success result\n */\n success(issuer: string, kid: string): this {\n return this.setResult(true, 'ok', { issuer, kid });\n }\n\n /**\n * Set failure result\n */\n failure(reason: ReasonCode, issuer?: string, kid?: string): this {\n return this.setResult(false, reason, { issuer, kid });\n }\n\n /**\n * Add artifacts\n */\n addArtifact(key: string, value: unknown): this {\n if (!this.state.artifacts) {\n this.state.artifacts = {};\n }\n this.state.artifacts[key] = value;\n return this;\n }\n\n /**\n * Set metadata (non-deterministic fields)\n */\n setMeta(meta: VerificationMeta): this {\n this.state.meta = meta;\n return this;\n }\n\n /**\n * Add current timestamp to meta\n */\n addTimestamp(): this {\n if (!this.state.meta) {\n this.state.meta = {};\n }\n this.state.meta.generated_at = new Date().toISOString();\n return this;\n }\n\n /**\n * Build the final report\n *\n * Ensures all checks are present (shape-stable).\n * Missing checks after a failure are marked as 'skip'.\n * Missing checks before a failure (or in success) are marked as 'pass'.\n */\n build(): VerificationReport {\n // Validate required fields\n if (!this.state.input) {\n throw new Error('Input is required. Call setInputWithDigest() or setInputAsync() first.');\n }\n if (!this.state.result) {\n throw new Error('Result is required. Call setResult() or success()/failure() first.');\n }\n\n // Build shape-stable checks array\n const checks: CheckResult[] = [];\n const failedIndex = this.state.failedAtCheck ? CHECK_IDS.indexOf(this.state.failedAtCheck) : -1;\n\n for (let i = 0; i < CHECK_IDS.length; i++) {\n const checkId = CHECK_IDS[i];\n const existing = this.state.checks.get(checkId);\n\n if (existing) {\n checks.push(existing);\n } else if (this.state.shortCircuited && i > failedIndex) {\n // After failure, missing checks are skipped\n checks.push({ id: checkId, status: 'skip', detail: { reason: 'short_circuit' } });\n } else {\n // Before failure or in success, missing checks get default status\n // For optional/deferred checks, mark as skip with appropriate reason\n if (checkId === 'transport.profile_binding') {\n checks.push({ id: checkId, status: 'skip', detail: { reason: 'not_applicable' } });\n } else if (checkId === 'policy.binding') {\n // Wire 0.1: always skip. Wire 0.2 will produce pass/fail.\n checks.push({\n id: checkId,\n status: 'skip',\n detail: { reason: 'wire_01_no_policy_digest' },\n });\n } else {\n // This shouldn't happen in well-formed builds - indicates a bug\n checks.push({ id: checkId, status: 'skip', detail: { reason: 'not_executed' } });\n }\n }\n }\n\n const report: VerificationReport = {\n report_version: VERIFICATION_REPORT_VERSION,\n input: this.state.input,\n policy: this.state.policy,\n result: this.state.result,\n checks,\n };\n\n if (this.state.artifacts && Object.keys(this.state.artifacts).length > 0) {\n report.artifacts = this.state.artifacts as VerificationReport['artifacts'];\n }\n\n if (this.state.meta) {\n report.meta = this.state.meta;\n }\n\n return report;\n }\n\n /**\n * Build in deterministic mode (excludes meta and non-deterministic artifacts)\n *\n * Deterministic mode ensures that the same inputs and policy always produce\n * the same report output, regardless of cache state or timing.\n *\n * Excludes:\n * - `meta`: Contains timestamps and verifier info\n * - Non-deterministic artifacts: `issuer_jwks_digest` (depends on cache state)\n *\n * @returns Report without meta and with only deterministic artifacts\n */\n buildDeterministic(): Omit<VerificationReport, 'meta'> {\n const report = this.build();\n const { meta: _meta, ...deterministic } = report;\n\n // Filter out non-deterministic artifacts\n if (deterministic.artifacts) {\n const filteredArtifacts: Partial<VerificationArtifacts> = { ...deterministic.artifacts };\n for (const key of NON_DETERMINISTIC_ARTIFACT_KEYS) {\n delete filteredArtifacts[key];\n }\n\n // Remove artifacts object if empty after filtering\n if (Object.keys(filteredArtifacts).length === 0) {\n delete deterministic.artifacts;\n } else {\n deterministic.artifacts = filteredArtifacts as VerificationArtifacts;\n }\n }\n\n return deterministic;\n }\n}\n\n/**\n * Create a new report builder\n */\nexport function createReportBuilder(policy: VerifierPolicy): VerificationReportBuilder {\n return new VerificationReportBuilder(policy);\n}\n\n/**\n * Compute receipt digest for report input\n *\n * @param receiptBytes - Raw receipt bytes (JWS string as UTF-8)\n * @returns SHA-256 digest as lowercase hex (64 chars)\n */\nexport async function computeReceiptDigest(receiptBytes: Uint8Array | string): Promise<string> {\n const bytes =\n typeof receiptBytes === 'string' ? new TextEncoder().encode(receiptBytes) : receiptBytes;\n return sha256Hex(bytes);\n}\n\n/**\n * Build a quick failure report without going through all checks\n *\n * Useful for early failures like receipt_too_large or malformed_receipt\n * where most checks are skipped.\n */\nexport async function buildFailureReport(\n policy: VerifierPolicy,\n receiptBytes: Uint8Array | string,\n reason: ReasonCode,\n failedCheckId: CheckId,\n errorCode?: string,\n detail?: Record<string, unknown>,\n options?: {\n issuer?: string;\n kid?: string;\n meta?: VerificationMeta;\n }\n): Promise<VerificationReport> {\n const bytes =\n typeof receiptBytes === 'string' ? new TextEncoder().encode(receiptBytes) : receiptBytes;\n const digestHex = await sha256Hex(bytes);\n\n const builder = createReportBuilder(policy)\n .setInputWithDigest(digestHex)\n .failure(reason, options?.issuer, options?.kid);\n\n // Add passing checks up to the failure point\n const failedIndex = CHECK_IDS.indexOf(failedCheckId);\n for (let i = 0; i < CHECK_IDS.length; i++) {\n const checkId = CHECK_IDS[i];\n if (i < failedIndex) {\n builder.pass(checkId);\n } else if (i === failedIndex) {\n builder.fail(checkId, errorCode ?? reasonCodeToErrorCode(reason), detail);\n }\n // Remaining checks will be auto-skipped by build()\n }\n\n if (options?.meta) {\n builder.setMeta(options.meta);\n }\n\n return builder.build();\n}\n\n/**\n * Build a success report\n */\nexport async function buildSuccessReport(\n policy: VerifierPolicy,\n receiptBytes: Uint8Array | string,\n issuer: string,\n kid: string,\n checkDetails?: Partial<Record<CheckId, Record<string, unknown>>>,\n options?: {\n artifacts?: VerificationReport['artifacts'];\n meta?: VerificationMeta;\n }\n): Promise<VerificationReport> {\n const bytes =\n typeof receiptBytes === 'string' ? new TextEncoder().encode(receiptBytes) : receiptBytes;\n const digestHex = await sha256Hex(bytes);\n\n const builder = createReportBuilder(policy).setInputWithDigest(digestHex).success(issuer, kid);\n\n // Add all checks as passing (except optional ones)\n for (const checkId of CHECK_IDS) {\n // Skip issuer.discovery for offline mode\n if (checkId === 'issuer.discovery' && policy.mode === 'offline_only') {\n builder.skip(checkId, { reason: 'offline_mode' });\n continue;\n }\n\n // transport.profile_binding is optional\n if (checkId === 'transport.profile_binding') {\n if (checkDetails?.[checkId]) {\n builder.pass(checkId, checkDetails[checkId]);\n }\n // Will be marked as skip by build() if not added\n continue;\n }\n\n // policy.binding: Wire 0.1 always skip\n if (checkId === 'policy.binding') {\n // Will be marked as skip with wire_01_no_policy_digest by build()\n continue;\n }\n\n builder.pass(checkId, checkDetails?.[checkId]);\n }\n\n if (options?.artifacts) {\n for (const [key, value] of Object.entries(options.artifacts)) {\n builder.addArtifact(key, value);\n }\n }\n\n if (options?.meta) {\n builder.setMeta(options.meta);\n }\n\n return builder.build();\n}\n","/**\n * PEAC Verifier Core\n *\n * Implements the verification flow per VERIFIER-SECURITY-MODEL.md with:\n * - Ordered checks with short-circuit behavior\n * - Trust pinning (issuer allowlist + RFC 7638 thumbprints)\n * - SSRF-safe network fetches\n * - Deterministic verification reports\n *\n * @packageDocumentation\n */\n\nimport {\n base64urlDecode,\n computeJwkThumbprint,\n decode,\n jwkToPublicKeyBytes,\n sha256Hex,\n verify as jwsVerify,\n} from '@peac/crypto';\nimport { WIRE_TYPE } from '@peac/kernel';\nimport { PEACReceiptClaims, ReceiptClaims } from '@peac/schema';\nimport type { SSRFFetchError } from './ssrf-safe-fetch.js';\nimport { resolveJWKS } from './jwks-resolver.js';\nimport { createReportBuilder } from './verification-report.js';\nimport type { PinnedKey, VerificationReport, VerifierPolicy } from './verifier-types.js';\nimport {\n createDefaultPolicy,\n createDigest,\n reasonCodeToErrorCode,\n ssrfErrorToReasonCode,\n} from './verifier-types.js';\n\n// ---------------------------------------------------------------------------\n// Types\n// ---------------------------------------------------------------------------\n\n/**\n * JWK structure for Ed25519 keys\n */\ninterface JWK {\n kty: string;\n crv: string;\n x: string;\n kid: string;\n}\n\n/**\n * JWKS document\n */\ninterface JWKS {\n keys: JWK[];\n}\n\n/**\n * Issuer configuration document (/.well-known/peac-issuer.json)\n */\ninterface IssuerConfig {\n issuer: string;\n jwks_uri: string;\n}\n\n/**\n * Verification options for verifier-core\n */\nexport interface VerifyCoreOptions {\n /** Receipt JWS (compact serialization) or raw bytes */\n receipt: string | Uint8Array;\n /** Verification policy */\n policy?: VerifierPolicy;\n /** Reference time for deterministic verification (seconds since epoch) */\n referenceTime?: number;\n /** Include non-deterministic metadata in report */\n includeMeta?: boolean;\n}\n\n/**\n * Verification result\n */\nexport interface VerifyCoreResult {\n /** Whether verification succeeded */\n valid: boolean;\n /** Verification report */\n report: VerificationReport;\n /** Parsed claims (if valid) */\n claims?: PEACReceiptClaims;\n}\n\n// ---------------------------------------------------------------------------\n// Helper Functions\n// ---------------------------------------------------------------------------\n\n/**\n * Normalize issuer to origin format (https://host[:port])\n */\nfunction normalizeIssuer(issuer: string): string {\n try {\n const url = new URL(issuer);\n // Include port only if non-standard for HTTPS\n if (url.port && url.port !== '443') {\n return `${url.protocol}//${url.hostname}:${url.port}`;\n }\n return `${url.protocol}//${url.hostname}`;\n } catch {\n return issuer;\n }\n}\n\n/**\n * Check if issuer is in the allowlist\n */\nfunction isIssuerAllowed(issuer: string, allowlist?: string[]): boolean {\n if (!allowlist || allowlist.length === 0) {\n // No allowlist means all issuers are allowed\n return true;\n }\n\n const normalized = normalizeIssuer(issuer);\n return allowlist.some((allowed) => normalizeIssuer(allowed) === normalized);\n}\n\n/**\n * Find pinned key for issuer and kid\n */\nfunction findPinnedKey(\n issuer: string,\n kid: string,\n pinnedKeys?: PinnedKey[]\n): PinnedKey | undefined {\n if (!pinnedKeys || pinnedKeys.length === 0) {\n return undefined;\n }\n\n const normalizedIssuer = normalizeIssuer(issuer);\n return pinnedKeys.find((pk) => normalizeIssuer(pk.issuer) === normalizedIssuer && pk.kid === kid);\n}\n\n/**\n * JWKS fetch result (success case)\n */\ninterface JWKSFetchSuccess {\n jwks: JWKS;\n fromCache: boolean;\n /** Raw JWKS bytes for digest computation (only present when not from cache) */\n rawBytes?: Uint8Array;\n}\n\n/**\n * Fetch JWKS from issuer via strict discovery (peac-issuer.json -> jwks_uri).\n * Delegates to the shared jwks-resolver module.\n *\n * The resolver preserves the original SSRF reason on errors, so no lossy\n * reverse-mapping is needed.\n */\nasync function fetchIssuerJWKS(\n issuerOrigin: string\n): Promise<JWKSFetchSuccess | { error: SSRFFetchError }> {\n const result = await resolveJWKS(issuerOrigin);\n\n if (!result.ok) {\n return {\n error: {\n ok: false,\n reason: result.reason ?? 'network_error',\n message: result.message,\n blockedUrl: result.blockedUrl,\n } as SSRFFetchError,\n };\n }\n\n return {\n jwks: result.jwks,\n fromCache: result.fromCache,\n rawBytes: result.rawBytes,\n };\n}\n\n// ---------------------------------------------------------------------------\n// Main Verification Function\n// ---------------------------------------------------------------------------\n\n/**\n * Verify a PEAC receipt with full security checks and report emission\n *\n * Implements the verification flow per VERIFIER-SECURITY-MODEL.md:\n * 1. jws.parse - Parse JWS structure\n * 2. limits.receipt_bytes - Check receipt size\n * 3. jws.protected_header - Validate protected header\n * 4. claims.schema_unverified - Pre-signature schema check\n * 5. issuer.trust_policy - Check issuer allowlist/pins\n * 6. issuer.discovery - Fetch JWKS (if network mode)\n * 7. key.resolve - Resolve signing key by kid\n * 8. jws.signature - Verify signature\n * 9. claims.time_window - Check iat/exp\n * 10. extensions.limits - Check extension sizes\n */\nexport async function verifyReceiptCore(options: VerifyCoreOptions): Promise<VerifyCoreResult> {\n const {\n receipt,\n policy = createDefaultPolicy('offline_preferred'),\n referenceTime,\n includeMeta = false,\n } = options;\n\n // Convert receipt to string if needed\n const receiptJws = typeof receipt === 'string' ? receipt : new TextDecoder().decode(receipt);\n const receiptBytes = typeof receipt === 'string' ? new TextEncoder().encode(receipt) : receipt;\n\n // Compute receipt digest for report\n const receiptDigestHex = await sha256Hex(receiptBytes);\n\n // Start building report\n const builder = createReportBuilder(policy);\n builder.setInputWithDigest(receiptDigestHex);\n\n // Current time (or reference time for deterministic verification)\n const nowSeconds = referenceTime ?? Math.floor(Date.now() / 1000);\n\n // Track issuer and kid for result\n let issuer: string | undefined;\n let kid: string | undefined;\n let parsedClaims: PEACReceiptClaims | undefined;\n\n // ---------------------------------------------------------------------------\n // Check 1: jws.parse - Parse JWS structure\n // ---------------------------------------------------------------------------\n let header: { alg: string; typ?: string; kid: string };\n let payload: PEACReceiptClaims;\n\n try {\n const decoded = decode<PEACReceiptClaims>(receiptJws);\n header = decoded.header;\n payload = decoded.payload;\n builder.pass('jws.parse');\n } catch (err) {\n builder.fail('jws.parse', 'E_VERIFY_MALFORMED_RECEIPT', {\n error: err instanceof Error ? err.message : String(err),\n });\n builder.failure('malformed_receipt');\n return { valid: false, report: includeMeta ? builder.addTimestamp().build() : builder.build() };\n }\n\n // ---------------------------------------------------------------------------\n // Check 2: limits.receipt_bytes - Check receipt size\n // ---------------------------------------------------------------------------\n if (receiptBytes.length > policy.limits.max_receipt_bytes) {\n builder.fail('limits.receipt_bytes', 'E_VERIFY_RECEIPT_TOO_LARGE', {\n size: receiptBytes.length,\n limit: policy.limits.max_receipt_bytes,\n });\n builder.failure('receipt_too_large');\n return { valid: false, report: includeMeta ? builder.addTimestamp().build() : builder.build() };\n }\n builder.pass('limits.receipt_bytes', { size: receiptBytes.length });\n\n // ---------------------------------------------------------------------------\n // Check 3: jws.protected_header - Validate protected header\n // ---------------------------------------------------------------------------\n if (header.alg !== 'EdDSA') {\n builder.fail('jws.protected_header', 'E_VERIFY_MALFORMED_RECEIPT', {\n expected_alg: 'EdDSA',\n actual_alg: header.alg,\n });\n builder.failure('malformed_receipt');\n return { valid: false, report: includeMeta ? builder.addTimestamp().build() : builder.build() };\n }\n if (header.typ !== WIRE_TYPE) {\n builder.fail('jws.protected_header', 'E_VERIFY_MALFORMED_RECEIPT', {\n expected_typ: WIRE_TYPE,\n actual_typ: header.typ,\n });\n builder.failure('malformed_receipt');\n return { valid: false, report: includeMeta ? builder.addTimestamp().build() : builder.build() };\n }\n if (!header.kid) {\n builder.fail('jws.protected_header', 'E_VERIFY_MALFORMED_RECEIPT', {\n error: 'Missing kid in protected header',\n });\n builder.failure('malformed_receipt');\n return { valid: false, report: includeMeta ? builder.addTimestamp().build() : builder.build() };\n }\n kid = header.kid;\n builder.pass('jws.protected_header', { alg: header.alg, typ: header.typ, kid: header.kid });\n\n // ---------------------------------------------------------------------------\n // Check 4: claims.schema_unverified - Pre-signature schema check\n // ---------------------------------------------------------------------------\n try {\n ReceiptClaims.parse(payload);\n issuer = payload.iss;\n builder.pass('claims.schema_unverified');\n } catch (err) {\n builder.fail('claims.schema_unverified', 'E_VERIFY_SCHEMA_INVALID', {\n error: err instanceof Error ? err.message : String(err),\n });\n builder.failure('schema_invalid');\n return { valid: false, report: includeMeta ? builder.addTimestamp().build() : builder.build() };\n }\n\n // ---------------------------------------------------------------------------\n // Check 5: issuer.trust_policy - Check issuer allowlist/pins\n // ---------------------------------------------------------------------------\n const normalizedIssuer = normalizeIssuer(issuer!);\n\n if (!isIssuerAllowed(issuer!, policy.issuer_allowlist)) {\n builder.fail('issuer.trust_policy', 'E_VERIFY_ISSUER_NOT_ALLOWED', {\n issuer: normalizedIssuer,\n allowlist: policy.issuer_allowlist,\n });\n builder.failure('issuer_not_allowed', normalizedIssuer, kid);\n return { valid: false, report: includeMeta ? builder.addTimestamp().build() : builder.build() };\n }\n builder.pass('issuer.trust_policy', { issuer: normalizedIssuer });\n\n // ---------------------------------------------------------------------------\n // Check 6: issuer.discovery - Fetch JWKS (if network mode)\n // Check 7: key.resolve - Resolve signing key by kid\n // ---------------------------------------------------------------------------\n let publicKey: Uint8Array;\n let keySource: 'pinned_keys' | 'jwks_discovery';\n let keyThumbprint: string | undefined;\n let jwksRawBytes: Uint8Array | undefined;\n\n // Check for pinned key first\n const pinnedKey = findPinnedKey(issuer!, kid!, policy.pinned_keys);\n\n if (pinnedKey) {\n // Use pinned key - skip discovery\n builder.skip('issuer.discovery', { reason: 'pinned_key_available' });\n\n // Check if pinned key has key material for offline verification\n if (pinnedKey.jwk) {\n // Full JWK provided - verify thumbprint and use directly\n const actualThumbprint = await computeJwkThumbprint(pinnedKey.jwk);\n if (actualThumbprint !== pinnedKey.jwk_thumbprint_sha256) {\n builder.fail('key.resolve', 'E_VERIFY_POLICY_VIOLATION', {\n error: 'Pinned JWK thumbprint does not match declared thumbprint',\n expected: pinnedKey.jwk_thumbprint_sha256,\n actual: actualThumbprint,\n });\n builder.failure('policy_violation', normalizedIssuer, kid);\n return {\n valid: false,\n report: includeMeta ? builder.addTimestamp().build() : builder.build(),\n };\n }\n publicKey = jwkToPublicKeyBytes(pinnedKey.jwk);\n keySource = 'pinned_keys';\n keyThumbprint = actualThumbprint;\n builder.pass('key.resolve', {\n source: keySource,\n kid,\n thumbprint_verified: true,\n offline: true,\n });\n } else if (pinnedKey.public_key) {\n // Raw public key bytes provided (base64url, 32 bytes for Ed25519)\n try {\n publicKey = base64urlDecode(pinnedKey.public_key);\n if (publicKey.length !== 32) {\n throw new Error(`Expected 32 bytes, got ${publicKey.length}`);\n }\n keySource = 'pinned_keys';\n // Note: We can't compute thumbprint from raw key bytes alone\n // The thumbprint is computed from canonical JWK JSON\n // Use the declared thumbprint from the pinned key entry\n keyThumbprint = pinnedKey.jwk_thumbprint_sha256;\n builder.pass('key.resolve', {\n source: keySource,\n kid,\n offline: true,\n thumbprint_verified: false,\n });\n } catch (err) {\n builder.fail('key.resolve', 'E_VERIFY_KEY_NOT_FOUND', {\n error: `Invalid pinned public_key: ${err instanceof Error ? err.message : String(err)}`,\n });\n builder.failure('key_not_found', normalizedIssuer, kid);\n return {\n valid: false,\n report: includeMeta ? builder.addTimestamp().build() : builder.build(),\n };\n }\n } else if (policy.mode === 'offline_only') {\n // Offline mode but pinned key has no key material - fail\n builder.fail('key.resolve', 'E_VERIFY_KEY_NOT_FOUND', {\n error: 'Offline mode requires key material (jwk or public_key) in pinned_keys',\n });\n builder.failure('key_not_found', normalizedIssuer, kid);\n return {\n valid: false,\n report: includeMeta ? builder.addTimestamp().build() : builder.build(),\n };\n } else {\n // Network mode - fetch JWKS and verify thumbprint\n const jwksResult = await fetchIssuerJWKS(normalizedIssuer);\n\n if ('error' in jwksResult) {\n const reason = ssrfErrorToReasonCode(jwksResult.error.reason, 'key');\n builder.fail('issuer.discovery', reasonCodeToErrorCode(reason), {\n error: jwksResult.error.message,\n url: jwksResult.error.blockedUrl,\n });\n builder.failure(reason, normalizedIssuer, kid);\n return {\n valid: false,\n report: includeMeta ? builder.addTimestamp().build() : builder.build(),\n };\n }\n\n // Store raw bytes for digest computation (only when not from cache)\n if (jwksResult.rawBytes) {\n jwksRawBytes = jwksResult.rawBytes;\n }\n\n builder.pass('issuer.discovery', {\n from_cache: jwksResult.fromCache,\n keys_count: jwksResult.jwks.keys.length,\n });\n\n // Find the key\n const jwk = jwksResult.jwks.keys.find((k) => k.kid === kid);\n if (!jwk) {\n builder.fail('key.resolve', 'E_VERIFY_KEY_NOT_FOUND', {\n kid,\n available_kids: jwksResult.jwks.keys.map((k) => k.kid),\n });\n builder.failure('key_not_found', normalizedIssuer, kid);\n return {\n valid: false,\n report: includeMeta ? builder.addTimestamp().build() : builder.build(),\n };\n }\n\n // Verify thumbprint matches\n const actualThumbprint = await computeJwkThumbprint(jwk);\n if (actualThumbprint !== pinnedKey.jwk_thumbprint_sha256) {\n builder.fail('key.resolve', 'E_VERIFY_POLICY_VIOLATION', {\n error: 'JWK thumbprint does not match pinned key',\n expected: pinnedKey.jwk_thumbprint_sha256,\n actual: actualThumbprint,\n });\n builder.failure('policy_violation', normalizedIssuer, kid);\n return {\n valid: false,\n report: includeMeta ? builder.addTimestamp().build() : builder.build(),\n };\n }\n\n publicKey = jwkToPublicKeyBytes(jwk);\n keySource = 'pinned_keys';\n keyThumbprint = actualThumbprint;\n builder.pass('key.resolve', { source: keySource, kid, thumbprint_verified: true });\n }\n } else {\n // No pinned key - need to discover\n if (policy.mode === 'offline_only') {\n builder.fail('issuer.discovery', 'E_VERIFY_KEY_NOT_FOUND', {\n error: 'Offline mode requires pinned keys',\n });\n builder.failure('key_not_found', normalizedIssuer, kid);\n return {\n valid: false,\n report: includeMeta ? builder.addTimestamp().build() : builder.build(),\n };\n }\n\n const jwksResult = await fetchIssuerJWKS(normalizedIssuer);\n\n if ('error' in jwksResult) {\n const reason = ssrfErrorToReasonCode(jwksResult.error.reason, 'key');\n builder.fail('issuer.discovery', reasonCodeToErrorCode(reason), {\n error: jwksResult.error.message,\n url: jwksResult.error.blockedUrl,\n });\n builder.failure(reason, normalizedIssuer, kid);\n return {\n valid: false,\n report: includeMeta ? builder.addTimestamp().build() : builder.build(),\n };\n }\n\n // Store raw bytes for digest computation (only when not from cache)\n if (jwksResult.rawBytes) {\n jwksRawBytes = jwksResult.rawBytes;\n }\n\n builder.pass('issuer.discovery', {\n from_cache: jwksResult.fromCache,\n keys_count: jwksResult.jwks.keys.length,\n });\n\n // Find the key\n const jwk = jwksResult.jwks.keys.find((k) => k.kid === kid);\n if (!jwk) {\n builder.fail('key.resolve', 'E_VERIFY_KEY_NOT_FOUND', {\n kid,\n available_kids: jwksResult.jwks.keys.map((k) => k.kid),\n });\n builder.failure('key_not_found', normalizedIssuer, kid);\n return {\n valid: false,\n report: includeMeta ? builder.addTimestamp().build() : builder.build(),\n };\n }\n\n publicKey = jwkToPublicKeyBytes(jwk);\n keySource = 'jwks_discovery';\n keyThumbprint = await computeJwkThumbprint(jwk);\n builder.pass('key.resolve', { source: keySource, kid, thumbprint: keyThumbprint });\n }\n\n // ---------------------------------------------------------------------------\n // Check 8: jws.signature - Verify signature\n // ---------------------------------------------------------------------------\n try {\n const result = await jwsVerify<PEACReceiptClaims>(receiptJws, publicKey);\n\n if (!result.valid) {\n builder.fail('jws.signature', 'E_VERIFY_SIGNATURE_INVALID', {\n error: 'Ed25519 signature verification failed',\n });\n builder.failure('signature_invalid', normalizedIssuer, kid);\n return {\n valid: false,\n report: includeMeta ? builder.addTimestamp().build() : builder.build(),\n };\n }\n\n parsedClaims = result.payload;\n builder.pass('jws.signature');\n } catch (err) {\n builder.fail('jws.signature', 'E_VERIFY_SIGNATURE_INVALID', {\n error: err instanceof Error ? err.message : String(err),\n });\n builder.failure('signature_invalid', normalizedIssuer, kid);\n return { valid: false, report: includeMeta ? builder.addTimestamp().build() : builder.build() };\n }\n\n // ---------------------------------------------------------------------------\n // Check 9: claims.time_window - Check iat/exp\n // ---------------------------------------------------------------------------\n const iatTolerance = 60; // 60 seconds tolerance for future iat\n\n // Check iat (issued at) - required field per schema\n if (parsedClaims!.iat > nowSeconds + iatTolerance) {\n builder.fail('claims.time_window', 'E_VERIFY_NOT_YET_VALID', {\n error: 'Receipt issued in the future',\n iat: parsedClaims!.iat,\n now: nowSeconds,\n tolerance: iatTolerance,\n });\n builder.failure('not_yet_valid', normalizedIssuer, kid);\n return { valid: false, report: includeMeta ? builder.addTimestamp().build() : builder.build() };\n }\n\n // Check exp (expiration) - no tolerance\n if (parsedClaims!.exp) {\n if (parsedClaims!.exp < nowSeconds) {\n builder.fail('claims.time_window', 'E_VERIFY_EXPIRED', {\n error: 'Receipt expired',\n exp: parsedClaims!.exp,\n now: nowSeconds,\n });\n builder.failure('expired', normalizedIssuer, kid);\n return {\n valid: false,\n report: includeMeta ? builder.addTimestamp().build() : builder.build(),\n };\n }\n }\n\n builder.pass('claims.time_window', {\n iat: parsedClaims!.iat,\n exp: parsedClaims!.exp,\n now: nowSeconds,\n });\n\n // ---------------------------------------------------------------------------\n // Check 10: extensions.limits - Check extension sizes\n // ---------------------------------------------------------------------------\n // Check for oversized extensions in ext object\n if (parsedClaims!.ext) {\n for (const [extKey, extValue] of Object.entries(parsedClaims!.ext)) {\n if (extValue !== undefined) {\n const extJson = JSON.stringify(extValue);\n if (extJson.length > policy.limits.max_extension_bytes) {\n builder.fail('extensions.limits', 'E_VERIFY_EXTENSION_TOO_LARGE', {\n extension: extKey,\n size: extJson.length,\n limit: policy.limits.max_extension_bytes,\n });\n builder.failure('extension_too_large', normalizedIssuer, kid);\n return {\n valid: false,\n report: includeMeta ? builder.addTimestamp().build() : builder.build(),\n };\n }\n }\n }\n }\n\n builder.pass('extensions.limits');\n\n // ---------------------------------------------------------------------------\n // Success!\n // ---------------------------------------------------------------------------\n builder.success(normalizedIssuer, kid!);\n\n // Add JWKS artifacts for enterprise debuggability\n // Map internal key source to artifact format\n const artifactKeySource = keySource === 'pinned_keys' ? 'pinned' : 'jwks_fetch';\n builder.addArtifact('issuer_key_source', artifactKeySource);\n\n if (keyThumbprint) {\n builder.addArtifact('issuer_key_thumbprint', keyThumbprint);\n }\n\n // Add JWKS digest when fetched (not from cache)\n // Computed over raw bytes to avoid encoding round-trip issues\n if (jwksRawBytes) {\n const jwksDigestHex = await sha256Hex(jwksRawBytes);\n builder.addArtifact('issuer_jwks_digest', createDigest(jwksDigestHex));\n }\n\n const report = includeMeta ? builder.addTimestamp().build() : builder.build();\n\n return {\n valid: true,\n report,\n claims: parsedClaims,\n };\n}\n\n// JWKS cache management is now in jwks-resolver.ts\n// Use clearJWKSCache() and getJWKSCacheSize() from '@peac/protocol'\n","/**\n * PEAC Transport Profile Parsers\n *\n * Implements parsing for transport profiles per TRANSPORT-PROFILES.md:\n * - Header profile (PEAC-Receipt header)\n * - Pointer profile (PEAC-Receipt-Pointer header)\n * - Body profile (peac_receipt/peac_receipts in JSON body)\n *\n * @packageDocumentation\n */\n\n// ---------------------------------------------------------------------------\n// Types\n// ---------------------------------------------------------------------------\n\n/**\n * Transport profile type\n */\nexport type TransportProfile = 'header' | 'pointer' | 'body';\n\n/**\n * Result of parsing a header transport profile\n */\nexport interface HeaderProfileResult {\n profile: 'header';\n receipt: string;\n}\n\n/**\n * Result of parsing a pointer transport profile\n */\nexport interface PointerProfileResult {\n profile: 'pointer';\n digestAlg: 'sha256';\n digestValue: string;\n url: string;\n /**\n * Extension parameters (keys starting with ext_).\n * Stored separately from normative fields for forward-compatibility.\n * Consumers SHOULD NOT rely on extension keys for core verification logic.\n */\n extensions?: Record<string, string>;\n}\n\n/**\n * Result of parsing a body transport profile\n */\nexport interface BodyProfileResult {\n profile: 'body';\n receipts: string[];\n}\n\n/**\n * Parsed transport profile (discriminated union)\n */\nexport type ParsedTransportProfile = HeaderProfileResult | PointerProfileResult | BodyProfileResult;\n\n/**\n * Transport profile parse error\n */\nexport interface TransportProfileError {\n ok: false;\n reason: 'invalid_transport' | 'malformed_receipt' | 'pointer_fetch_blocked';\n errorCode: string;\n message: string;\n}\n\n/**\n * Transport profile parse success\n */\nexport interface TransportProfileSuccess<\n T extends ParsedTransportProfile = ParsedTransportProfile,\n> {\n ok: true;\n result: T;\n}\n\n/**\n * Transport profile parse result\n */\nexport type TransportProfileParseResult<T extends ParsedTransportProfile = ParsedTransportProfile> =\n | TransportProfileSuccess<T>\n | TransportProfileError;\n\n// ---------------------------------------------------------------------------\n// Header Profile Parser\n// ---------------------------------------------------------------------------\n\n/**\n * Parse PEAC-Receipt header\n *\n * Per TRANSPORT-PROFILES.md:\n * - Multiple headers MUST be rejected\n * - Comma-separated values MUST be rejected\n * - Value MUST be JWS compact serialization (three dot-separated segments)\n *\n * @param headerValue - PEAC-Receipt header value (string or array if multiple)\n * @returns Parse result\n */\nexport function parseHeaderProfile(\n headerValue: string | string[] | undefined\n): TransportProfileParseResult<HeaderProfileResult> {\n // Check for missing header\n if (headerValue === undefined || headerValue === '') {\n return {\n ok: false,\n reason: 'invalid_transport',\n errorCode: 'E_VERIFY_INVALID_TRANSPORT',\n message: 'PEAC-Receipt header is missing',\n };\n }\n\n // Check for multiple headers (array)\n if (Array.isArray(headerValue)) {\n return {\n ok: false,\n reason: 'invalid_transport',\n errorCode: 'E_VERIFY_INVALID_TRANSPORT',\n message: 'Multiple PEAC-Receipt headers are not allowed',\n };\n }\n\n // Check for comma-separated values (HTTP header list syntax)\n if (headerValue.includes(',')) {\n // Could be comma in base64url, but JWS compact has exactly 2 periods\n // If there are commas between periods, it's likely multiple values\n const parts = headerValue.split('.');\n if (parts.length !== 3 || parts.some((p) => p.includes(','))) {\n return {\n ok: false,\n reason: 'invalid_transport',\n errorCode: 'E_VERIFY_INVALID_TRANSPORT',\n message: 'Comma-separated PEAC-Receipt values are not allowed',\n };\n }\n }\n\n // Validate JWS compact serialization structure (three segments)\n const segments = headerValue.split('.');\n if (segments.length !== 3) {\n return {\n ok: false,\n reason: 'malformed_receipt',\n errorCode: 'E_VERIFY_MALFORMED_RECEIPT',\n message: `Invalid JWS compact serialization: expected 3 segments, got ${segments.length}`,\n };\n }\n\n // All segments must be non-empty base64url strings\n const base64urlRegex = /^[A-Za-z0-9_-]*$/;\n for (let i = 0; i < segments.length; i++) {\n const segment = segments[i];\n if (segment.length === 0) {\n return {\n ok: false,\n reason: 'malformed_receipt',\n errorCode: 'E_VERIFY_MALFORMED_RECEIPT',\n message: `Invalid JWS compact serialization: segment ${i + 1} is empty`,\n };\n }\n if (!base64urlRegex.test(segment)) {\n return {\n ok: false,\n reason: 'malformed_receipt',\n errorCode: 'E_VERIFY_MALFORMED_RECEIPT',\n message: `Invalid JWS compact serialization: segment ${i + 1} contains invalid characters`,\n };\n }\n }\n\n return {\n ok: true,\n result: {\n profile: 'header',\n receipt: headerValue,\n },\n };\n}\n\n// ---------------------------------------------------------------------------\n// Pointer Profile Parser\n// ---------------------------------------------------------------------------\n\n/**\n * Parse PEAC-Receipt-Pointer header\n *\n * Per TRANSPORT-PROFILES.md:\n * - Format: RFC 9651 dictionary with sha256 and url parameters\n * - Multiple headers MUST be rejected\n * - URL MUST be HTTPS\n *\n * Example: sha256=\"7d8f...\", url=\"https://receipts.example.com/abc123\"\n *\n * @param headerValue - PEAC-Receipt-Pointer header value (string or array if multiple)\n * @returns Parse result\n */\nexport function parsePointerProfile(\n headerValue: string | string[] | undefined\n): TransportProfileParseResult<PointerProfileResult> {\n // Check for missing header\n if (headerValue === undefined || headerValue === '') {\n return {\n ok: false,\n reason: 'invalid_transport',\n errorCode: 'E_VERIFY_INVALID_TRANSPORT',\n message: 'PEAC-Receipt-Pointer header is missing',\n };\n }\n\n // Check for multiple headers (array)\n if (Array.isArray(headerValue)) {\n return {\n ok: false,\n reason: 'invalid_transport',\n errorCode: 'E_VERIFY_INVALID_TRANSPORT',\n message: 'Multiple PEAC-Receipt-Pointer headers are not allowed',\n };\n }\n\n // Parse RFC 9651 dictionary format\n // Format: sha256=\"<hex>\", url=\"<url>\"\n // We use a simple parser here instead of a full RFC 9651 implementation\n\n const parseResult = parseSimpleDictionary(headerValue);\n\n // Strict: Reject duplicate parameters\n if (parseResult.duplicates.length > 0) {\n return {\n ok: false,\n reason: 'invalid_transport',\n errorCode: 'E_VERIFY_INVALID_TRANSPORT',\n message: `PEAC-Receipt-Pointer has duplicate parameter: ${parseResult.duplicates[0]}`,\n };\n }\n\n // Strict: Reject unknown parameters (only sha256, url, and ext_* are valid)\n // Extension keys (ext_*) are allowed for forward-compatibility\n const ALLOWED_KEYS = new Set(['sha256', 'url']);\n const unknownKeys = parseResult.keys.filter((k) => !ALLOWED_KEYS.has(k) && !k.startsWith('ext_'));\n if (unknownKeys.length > 0) {\n return {\n ok: false,\n reason: 'invalid_transport',\n errorCode: 'E_VERIFY_INVALID_TRANSPORT',\n message: `PEAC-Receipt-Pointer has unknown parameter: ${unknownKeys[0]}`,\n };\n }\n\n const params = parseResult.params;\n\n if (!params.sha256) {\n return {\n ok: false,\n reason: 'invalid_transport',\n errorCode: 'E_VERIFY_INVALID_TRANSPORT',\n message: 'PEAC-Receipt-Pointer missing sha256 parameter',\n };\n }\n\n if (!params.url) {\n return {\n ok: false,\n reason: 'invalid_transport',\n errorCode: 'E_VERIFY_INVALID_TRANSPORT',\n message: 'PEAC-Receipt-Pointer missing url parameter',\n };\n }\n\n // Validate digest is lowercase hex\n const hexRegex = /^[0-9a-f]{64}$/;\n if (!hexRegex.test(params.sha256)) {\n return {\n ok: false,\n reason: 'invalid_transport',\n errorCode: 'E_VERIFY_INVALID_TRANSPORT',\n message: 'PEAC-Receipt-Pointer sha256 must be 64 lowercase hex characters',\n };\n }\n\n // Validate URL is HTTPS\n try {\n const url = new URL(params.url);\n if (url.protocol !== 'https:') {\n return {\n ok: false,\n reason: 'pointer_fetch_blocked',\n errorCode: 'E_VERIFY_POINTER_FETCH_BLOCKED',\n message: 'Pointer URL must use HTTPS',\n };\n }\n } catch {\n return {\n ok: false,\n reason: 'invalid_transport',\n errorCode: 'E_VERIFY_INVALID_TRANSPORT',\n message: 'PEAC-Receipt-Pointer url is not a valid URL',\n };\n }\n\n // Extract extension keys (ext_*) for forward-compatibility\n const extensions: Record<string, string> = {};\n for (const key of parseResult.keys) {\n if (key.startsWith('ext_')) {\n extensions[key] = params[key];\n }\n }\n\n return {\n ok: true,\n result: {\n profile: 'pointer',\n digestAlg: 'sha256',\n digestValue: params.sha256,\n url: params.url,\n ...(Object.keys(extensions).length > 0 && { extensions }),\n },\n };\n}\n\n/**\n * Simple RFC 9651-like dictionary parser result\n */\ninterface DictionaryParseResult {\n /** Parsed key-value pairs */\n params: Record<string, string>;\n /** Duplicate keys found (strict mode violation) */\n duplicates: string[];\n /** All keys found (for unknown key detection) */\n keys: string[];\n}\n\n/**\n * Simple RFC 9651-like dictionary parser (ReDoS-safe)\n *\n * Parses: key1=\"value1\", key2=\"value2\"\n * Returns map of key -> value (unquoted) plus metadata for strict validation\n *\n * Uses explicit character-by-character parsing to avoid ReDoS vulnerabilities\n * from regex alternation patterns.\n */\nfunction parseSimpleDictionary(input: string): DictionaryParseResult {\n const params: Record<string, string> = {};\n const duplicates: string[] = [];\n const keys: string[] = [];\n\n let i = 0;\n const len = input.length;\n\n while (i < len) {\n // Skip whitespace and commas\n while (i < len && (input[i] === ' ' || input[i] === ',' || input[i] === '\\t')) {\n i++;\n }\n if (i >= len) break;\n\n // Parse key (word characters only)\n const keyStart = i;\n while (i < len && /\\w/.test(input[i])) {\n i++;\n }\n const key = input.slice(keyStart, i);\n if (!key) break;\n\n // Skip whitespace before '='\n while (i < len && input[i] === ' ') i++;\n\n // Expect '='\n if (i >= len || input[i] !== '=') break;\n i++; // skip '='\n\n // Skip whitespace after '='\n while (i < len && input[i] === ' ') i++;\n\n // Parse value (quoted or unquoted)\n let value: string;\n if (input[i] === '\"') {\n // Quoted value - find closing quote\n i++; // skip opening quote\n const valueStart = i;\n while (i < len && input[i] !== '\"') {\n i++;\n }\n value = input.slice(valueStart, i);\n if (i < len) i++; // skip closing quote\n } else {\n // Unquoted value - read until comma or whitespace\n const valueStart = i;\n while (i < len && input[i] !== ',' && input[i] !== ' ' && input[i] !== '\\t') {\n i++;\n }\n value = input.slice(valueStart, i);\n }\n\n keys.push(key);\n\n // Track duplicates\n if (key in params) {\n duplicates.push(key);\n }\n\n params[key] = value;\n }\n\n return { params, duplicates, keys };\n}\n\n// ---------------------------------------------------------------------------\n// Body Profile Parser\n// ---------------------------------------------------------------------------\n\n/**\n * Parse body profile (JSON body with peac_receipt or peac_receipts)\n *\n * Per TRANSPORT-PROFILES.md:\n * - peac_receipt: single receipt (string)\n * - peac_receipts: multiple receipts (array of strings)\n *\n * @param body - Parsed JSON body object\n * @returns Parse result\n */\nexport function parseBodyProfile(body: unknown): TransportProfileParseResult<BodyProfileResult> {\n if (body === null || typeof body !== 'object') {\n return {\n ok: false,\n reason: 'invalid_transport',\n errorCode: 'E_VERIFY_INVALID_TRANSPORT',\n message: 'Body must be a JSON object',\n };\n }\n\n const obj = body as Record<string, unknown>;\n\n // Check for peac_receipts (array, takes precedence)\n if ('peac_receipts' in obj) {\n if (!Array.isArray(obj.peac_receipts)) {\n return {\n ok: false,\n reason: 'invalid_transport',\n errorCode: 'E_VERIFY_INVALID_TRANSPORT',\n message: 'peac_receipts must be an array',\n };\n }\n\n const receipts: string[] = [];\n for (let i = 0; i < obj.peac_receipts.length; i++) {\n const receipt = obj.peac_receipts[i];\n if (typeof receipt !== 'string') {\n return {\n ok: false,\n reason: 'invalid_transport',\n errorCode: 'E_VERIFY_INVALID_TRANSPORT',\n message: `peac_receipts[${i}] must be a string`,\n };\n }\n receipts.push(receipt);\n }\n\n if (receipts.length === 0) {\n return {\n ok: false,\n reason: 'invalid_transport',\n errorCode: 'E_VERIFY_INVALID_TRANSPORT',\n message: 'peac_receipts array is empty',\n };\n }\n\n return {\n ok: true,\n result: {\n profile: 'body',\n receipts,\n },\n };\n }\n\n // Check for peac_receipt (single)\n if ('peac_receipt' in obj) {\n if (typeof obj.peac_receipt !== 'string') {\n return {\n ok: false,\n reason: 'invalid_transport',\n errorCode: 'E_VERIFY_INVALID_TRANSPORT',\n message: 'peac_receipt must be a string',\n };\n }\n\n if (obj.peac_receipt.length === 0) {\n return {\n ok: false,\n reason: 'invalid_transport',\n errorCode: 'E_VERIFY_INVALID_TRANSPORT',\n message: 'peac_receipt is empty',\n };\n }\n\n return {\n ok: true,\n result: {\n profile: 'body',\n receipts: [obj.peac_receipt],\n },\n };\n }\n\n return {\n ok: false,\n reason: 'invalid_transport',\n errorCode: 'E_VERIFY_INVALID_TRANSPORT',\n message: 'Body must contain peac_receipt or peac_receipts',\n };\n}\n\n// ---------------------------------------------------------------------------\n// Auto-detect Parser\n// ---------------------------------------------------------------------------\n\n/**\n * Auto-detect and parse transport profile from request context\n *\n * @param context - Request context with headers and optional body\n * @returns Parse result\n */\nexport function parseTransportProfile(context: {\n headers: Record<string, string | string[] | undefined>;\n body?: unknown;\n}): TransportProfileParseResult {\n const peacReceipt = context.headers['peac-receipt'] ?? context.headers['PEAC-Receipt'];\n const peacPointer =\n context.headers['peac-receipt-pointer'] ?? context.headers['PEAC-Receipt-Pointer'];\n\n // Header profile takes precedence\n if (peacReceipt !== undefined) {\n return parseHeaderProfile(peacReceipt);\n }\n\n // Pointer profile second\n if (peacPointer !== undefined) {\n return parsePointerProfile(peacPointer);\n }\n\n // Body profile last (if body provided)\n if (context.body !== undefined) {\n return parseBodyProfile(context.body);\n }\n\n return {\n ok: false,\n reason: 'invalid_transport',\n errorCode: 'E_VERIFY_INVALID_TRANSPORT',\n message:\n 'No transport profile detected (missing PEAC-Receipt, PEAC-Receipt-Pointer, or body receipt)',\n };\n}\n","/**\n * PEAC Pointer Fetch with Digest Verification\n *\n * Implements secure receipt fetching via pointers per TRANSPORT-PROFILES.md:\n * - SSRF-safe fetch\n * - SHA-256 digest verification\n * - Size limits\n *\n * @packageDocumentation\n */\n\nimport { sha256Hex } from '@peac/crypto';\nimport { VERIFIER_LIMITS } from '@peac/kernel';\nimport { ssrfSafeFetch, type SSRFFetchOptions, type SSRFFetchError } from './ssrf-safe-fetch.js';\n\n// ---------------------------------------------------------------------------\n// Types\n// ---------------------------------------------------------------------------\n\n/**\n * Pointer fetch options\n */\nexport interface PointerFetchOptions {\n /** URL to fetch the receipt from */\n url: string;\n /** Expected SHA-256 digest (lowercase hex, 64 chars) */\n expectedDigest: string;\n /** Optional SSRF fetch options */\n fetchOptions?: Omit<SSRFFetchOptions, 'maxBytes'>;\n}\n\n/**\n * Successful pointer fetch result\n */\nexport interface PointerFetchSuccess {\n ok: true;\n /** Fetched receipt (JWS compact serialization) */\n receipt: string;\n /** Actual SHA-256 digest of fetched content */\n actualDigest: string;\n /** Whether digest matched expected */\n digestMatched: true;\n /** Content-Type header (if present) */\n contentType?: string;\n /**\n * Warning about unexpected Content-Type.\n * Present when Content-Type is not application/jose, application/json, or text/plain.\n * Does not cause rejection (for interoperability) but callers may want to log.\n */\n contentTypeWarning?: string;\n}\n\n/**\n * Failed pointer fetch result\n */\nexport interface PointerFetchError {\n ok: false;\n /** Error reason */\n reason:\n | 'pointer_fetch_blocked'\n | 'pointer_fetch_failed'\n | 'pointer_fetch_timeout'\n | 'pointer_fetch_too_large'\n | 'pointer_digest_mismatch'\n | 'malformed_receipt';\n /** Error code for reports */\n errorCode: string;\n /** Human-readable error message */\n message: string;\n /** Actual digest if computed (for mismatch errors) */\n actualDigest?: string;\n /** Expected digest */\n expectedDigest?: string;\n}\n\n/**\n * Pointer fetch result\n */\nexport type PointerFetchResult = PointerFetchSuccess | PointerFetchError;\n\n// ---------------------------------------------------------------------------\n// Error Mapping\n// ---------------------------------------------------------------------------\n\n/**\n * Map SSRF error reason to pointer error reason\n */\nfunction mapSsrfError(ssrfError: SSRFFetchError): PointerFetchError {\n const reason = ssrfError.reason;\n\n switch (reason) {\n case 'not_https':\n case 'private_ip':\n case 'loopback':\n case 'link_local':\n case 'dns_failure':\n case 'cross_origin_redirect':\n return {\n ok: false,\n reason: 'pointer_fetch_blocked',\n errorCode: 'E_VERIFY_POINTER_FETCH_BLOCKED',\n message: ssrfError.message,\n };\n\n case 'timeout':\n return {\n ok: false,\n reason: 'pointer_fetch_timeout',\n errorCode: 'E_VERIFY_POINTER_FETCH_TIMEOUT',\n message: ssrfError.message,\n };\n\n case 'response_too_large':\n return {\n ok: false,\n reason: 'pointer_fetch_too_large',\n errorCode: 'E_VERIFY_POINTER_FETCH_TOO_LARGE',\n message: ssrfError.message,\n };\n\n default:\n return {\n ok: false,\n reason: 'pointer_fetch_failed',\n errorCode: 'E_VERIFY_POINTER_FETCH_FAILED',\n message: ssrfError.message,\n };\n }\n}\n\n// ---------------------------------------------------------------------------\n// Pointer Fetch\n// ---------------------------------------------------------------------------\n\n/**\n * Fetch a receipt via pointer with digest verification\n *\n * Per TRANSPORT-PROFILES.md:\n * - Fetch the URL using SSRF-safe fetch\n * - Compute SHA-256 digest of response\n * - Verify digest matches expected value from header\n * - Return receipt only if digest matches\n *\n * @param options - Pointer fetch options\n * @returns Fetch result\n */\nexport async function fetchPointerWithDigest(\n options: PointerFetchOptions\n): Promise<PointerFetchResult> {\n const { url, expectedDigest, fetchOptions = {} } = options;\n\n // Validate expected digest format\n const hexRegex = /^[0-9a-f]{64}$/;\n if (!hexRegex.test(expectedDigest)) {\n return {\n ok: false,\n reason: 'pointer_fetch_failed',\n errorCode: 'E_VERIFY_POINTER_FETCH_FAILED',\n message: 'Invalid expected digest: must be 64 lowercase hex characters',\n };\n }\n\n // Validate URL is HTTPS (pre-check before fetch)\n try {\n const parsedUrl = new URL(url);\n if (parsedUrl.protocol !== 'https:') {\n return {\n ok: false,\n reason: 'pointer_fetch_blocked',\n errorCode: 'E_VERIFY_POINTER_FETCH_BLOCKED',\n message: 'Pointer URL must use HTTPS',\n };\n }\n } catch {\n return {\n ok: false,\n reason: 'pointer_fetch_failed',\n errorCode: 'E_VERIFY_POINTER_FETCH_FAILED',\n message: 'Invalid pointer URL',\n };\n }\n\n // Fetch with SSRF protection and DoS bounds\n // - Size cap: maxReceiptBytes (prevents memory exhaustion)\n // - No redirects: prevents redirect-based SSRF (pointer URL must be direct)\n // - Timeout: prevents slow-loris style attacks\n const fetchResult = await ssrfSafeFetch(url, {\n ...fetchOptions,\n maxBytes: VERIFIER_LIMITS.maxReceiptBytes,\n allowRedirects: false, // Pointer URL must be direct - no redirects\n timeoutMs: fetchOptions?.timeoutMs ?? VERIFIER_LIMITS.fetchTimeoutMs,\n headers: {\n Accept: 'application/jose, application/json, text/plain',\n ...fetchOptions.headers,\n },\n });\n\n if (!fetchResult.ok) {\n return mapSsrfError(fetchResult);\n }\n\n const receipt = fetchResult.body;\n\n // Validate Content-Type if present (warn but don't reject for interoperability)\n // Expected: application/jose, application/json, or text/plain\n const contentType = fetchResult.contentType;\n const expectedContentTypes = ['application/jose', 'application/json', 'text/plain'];\n const contentTypeWarning =\n contentType && !expectedContentTypes.some((expected) => contentType.startsWith(expected))\n ? `Unexpected Content-Type: ${contentType}; expected application/jose, application/json, or text/plain`\n : undefined;\n\n // Validate: reject empty body\n if (!receipt || receipt.trim().length === 0) {\n return {\n ok: false,\n reason: 'malformed_receipt',\n errorCode: 'E_VERIFY_MALFORMED_RECEIPT',\n message: 'Pointer target returned empty content',\n };\n }\n\n // Validate: content must look like JWS compact serialization (3 dot-separated segments)\n const jwsValidation = validateJwsCompactStructure(receipt);\n if (!jwsValidation.valid) {\n return {\n ok: false,\n reason: 'malformed_receipt',\n errorCode: 'E_VERIFY_MALFORMED_RECEIPT',\n message: jwsValidation.message,\n };\n }\n\n // Compute digest of fetched content (hash the raw string bytes)\n const actualDigest = await sha256Hex(receipt);\n\n // Verify digest matches\n if (actualDigest !== expectedDigest) {\n return {\n ok: false,\n reason: 'pointer_digest_mismatch',\n errorCode: 'E_VERIFY_POINTER_DIGEST_MISMATCH',\n message: 'Fetched receipt digest does not match expected digest',\n actualDigest,\n expectedDigest,\n };\n }\n\n return {\n ok: true,\n receipt,\n actualDigest,\n digestMatched: true,\n contentType: fetchResult.contentType,\n ...(contentTypeWarning && { contentTypeWarning }),\n };\n}\n\n/**\n * Validate that a string looks like JWS compact serialization\n *\n * A valid JWS compact has exactly 3 dot-separated base64url segments.\n *\n * @param value - String to validate\n * @returns Validation result\n */\nfunction validateJwsCompactStructure(\n value: string\n): { valid: true } | { valid: false; message: string } {\n const segments = value.split('.');\n\n if (segments.length !== 3) {\n return {\n valid: false,\n message: `Invalid JWS compact serialization: expected 3 segments, got ${segments.length}`,\n };\n }\n\n // All segments must be non-empty and contain only base64url characters\n const base64urlRegex = /^[A-Za-z0-9_-]+$/;\n\n for (let i = 0; i < segments.length; i++) {\n const segment = segments[i];\n if (segment.length === 0) {\n return {\n valid: false,\n message: `Invalid JWS compact serialization: segment ${i + 1} is empty`,\n };\n }\n if (!base64urlRegex.test(segment)) {\n return {\n valid: false,\n message: `Invalid JWS compact serialization: segment ${i + 1} contains invalid characters`,\n };\n }\n }\n\n return { valid: true };\n}\n\n/**\n * Parse pointer header key=value pairs (ReDoS-safe)\n *\n * Handles both quoted and unquoted values without complex regex alternation.\n */\nfunction parsePointerHeader(input: string): Record<string, string> {\n const params: Record<string, string> = {};\n let i = 0;\n const len = input.length;\n\n while (i < len) {\n // Skip whitespace and commas\n while (i < len && (input[i] === ' ' || input[i] === ',' || input[i] === '\\t')) {\n i++;\n }\n if (i >= len) break;\n\n // Parse key (word characters only)\n const keyStart = i;\n while (i < len && /\\w/.test(input[i])) {\n i++;\n }\n const key = input.slice(keyStart, i);\n if (!key) break;\n\n // Skip whitespace before '='\n while (i < len && input[i] === ' ') i++;\n\n // Expect '='\n if (i >= len || input[i] !== '=') break;\n i++; // skip '='\n\n // Skip whitespace after '='\n while (i < len && input[i] === ' ') i++;\n\n // Parse value (quoted or unquoted)\n let value: string;\n if (input[i] === '\"') {\n // Quoted value - find closing quote\n i++; // skip opening quote\n const valueStart = i;\n while (i < len && input[i] !== '\"') {\n i++;\n }\n value = input.slice(valueStart, i);\n if (i < len) i++; // skip closing quote\n } else {\n // Unquoted value - read until comma or whitespace\n const valueStart = i;\n while (i < len && input[i] !== ',' && input[i] !== ' ' && input[i] !== '\\t') {\n i++;\n }\n value = input.slice(valueStart, i);\n }\n\n params[key] = value;\n }\n\n return params;\n}\n\n/**\n * Verify a pointer header and fetch the receipt\n *\n * Combines parsing and fetching in a single operation.\n *\n * @param pointerHeader - PEAC-Receipt-Pointer header value\n * @param fetchOptions - Optional SSRF fetch options\n * @returns Fetch result\n */\nexport async function verifyAndFetchPointer(\n pointerHeader: string,\n fetchOptions?: Omit<SSRFFetchOptions, 'maxBytes'>\n): Promise<PointerFetchResult> {\n // Parse pointer header (RFC 9651 dictionary format)\n // Format: sha256=\"<hex>\", url=\"<url>\"\n // Using explicit parsing to avoid ReDoS in regex alternation\n const params = parsePointerHeader(pointerHeader);\n\n if (!params.sha256) {\n return {\n ok: false,\n reason: 'pointer_fetch_failed',\n errorCode: 'E_VERIFY_POINTER_FETCH_FAILED',\n message: 'PEAC-Receipt-Pointer missing sha256 parameter',\n };\n }\n\n if (!params.url) {\n return {\n ok: false,\n reason: 'pointer_fetch_failed',\n errorCode: 'E_VERIFY_POINTER_FETCH_FAILED',\n message: 'PEAC-Receipt-Pointer missing url parameter',\n };\n }\n\n return fetchPointerWithDigest({\n url: params.url,\n expectedDigest: params.sha256,\n fetchOptions,\n });\n}\n","/**\n * Optional, composable replay defense for online consumers of PEAC records.\n *\n * createReplayGuard() returns a stateful guard that classifies an already-verified\n * record as 'fresh', 'replayed', or 'outside-window'. The store is bounded by both\n * count (maxEntries) and time (a TTL purge plus an iat acceptance window), so\n * it is finite and bounded against unbounded state growth. The dedup key is\n * (iss, jti); iat gates the window. All timestamp/window values are safe integers\n * (epoch seconds); unsafe-integer input fails closed.\n *\n * This is an online acceptance policy, not a record property: PEAC adds no exp to\n * records, changes no wire bytes, and enforces nothing. The same record stays valid\n * and offline-verifiable indefinitely outside any window. The guard returns a\n * verdict; the deployer chooses the response. It is intentionally not wired into the\n * stateless verifyLocal path.\n *\n * The clock (now) returns epoch seconds; backward movement (e.g. an NTP or manual\n * wall-clock regression) is clamped internally to the last observed second, so the\n * guard stays correct even if the clock goes backward. TTL entries expire at\n * insertion-time + windowSeconds + maxClockSkewSeconds; with the clamped (monotonic)\n * clock, expiry order equals insertion order and purge is O(number expired).\n */\n\n/** Default future-skew tolerance for iat, in seconds (mirrors verifyLocal maxClockSkew). */\nconst DEFAULT_MAX_CLOCK_SKEW_SECONDS = 300;\n/** Default upper bound on retained (iss,jti) entries. */\nconst DEFAULT_MAX_ENTRIES = 100_000;\n\nexport interface ReplayGuardOptions {\n /**\n * Accept only records whose iat is within [now - windowSeconds, now + maxClockSkewSeconds].\n * Positive integer (seconds).\n */\n windowSeconds: number;\n /** Allowed future skew for iat (seconds). Default 300. Non-negative integer. */\n maxClockSkewSeconds?: number;\n /** Upper bound on retained entries. Default 100_000. Positive integer. */\n maxEntries?: number;\n /**\n * Injectable clock returning epoch seconds (tests/determinism). Backward movement\n * is clamped internally to the last observed second. Default Math.floor(Date.now() / 1000).\n */\n now?: () => number;\n}\n\nexport type ReplayGuardVerdict = 'fresh' | 'replayed' | 'outside-window';\n\nexport interface ReplayGuard {\n /** Classify a record that has already been verified (e.g. by verifyLocal). No I/O. */\n check(record: { iss: string; jti: string; iat: number }): ReplayGuardVerdict;\n}\n\n/** Internal retained-entry shape (not exported). */\ninterface ReplayEntry {\n expiresAt: number;\n}\n\nfunction safeInteger(value: number, name: string): number {\n // Use Number.isSafeInteger (not Number.isInteger) for all timestamp/window\n // arithmetic: values beyond MAX_SAFE_INTEGER lose exactness, so the guard\n // fails closed rather than computing imprecise window/TTL boundaries.\n if (!Number.isSafeInteger(value)) {\n throw new Error(`createReplayGuard: ${name} must be a safe integer`);\n }\n return value;\n}\n\nfunction positiveInt(value: number, name: string): number {\n safeInteger(value, name);\n if (value <= 0) {\n throw new Error(`createReplayGuard: ${name} must be a positive integer`);\n }\n return value;\n}\n\nfunction nonNegativeInt(value: number, name: string): number {\n safeInteger(value, name);\n if (value < 0) {\n throw new Error(`createReplayGuard: ${name} must be a non-negative integer`);\n }\n return value;\n}\n\nfunction nonEmptyString(value: string, name: string): string {\n if (typeof value !== 'string' || value.length === 0) {\n throw new Error(`createReplayGuard: ${name} must be a non-empty string`);\n }\n return value;\n}\n\n/**\n * Create a bounded replay guard for already-verified records.\n *\n * @param options - window, optional max clock skew, optional entry cap, optional clock.\n * @returns a guard whose `check(record)` returns 'fresh' | 'replayed' | 'outside-window'.\n */\nexport function createReplayGuard(options: ReplayGuardOptions): ReplayGuard {\n const windowSeconds = positiveInt(options.windowSeconds, 'windowSeconds');\n const maxClockSkewSeconds =\n options.maxClockSkewSeconds === undefined\n ? DEFAULT_MAX_CLOCK_SKEW_SECONDS\n : nonNegativeInt(options.maxClockSkewSeconds, 'maxClockSkewSeconds');\n const maxEntries =\n options.maxEntries === undefined\n ? DEFAULT_MAX_ENTRIES\n : positiveInt(options.maxEntries, 'maxEntries');\n const now = options.now ?? (() => Math.floor(Date.now() / 1000));\n\n // Date.now() is a wall clock and can move backward (NTP / manual time changes);\n // clamp to the last observed second so the insertion-order TTL purge stays correct\n // even if the clock regresses. now() is validated (safe integer) here too.\n let lastNow = Number.NEGATIVE_INFINITY;\n const currentNow = (): number => {\n const raw = safeInteger(now(), 'now()');\n if (raw < lastNow) return lastNow;\n lastNow = raw;\n return raw;\n };\n\n // key -> entry. JS Map preserves insertion order. expiresAt is computed from the\n // (clamped, monotonic) insertion-time clock, so the front of the map always holds\n // the soonest-expiring entry: a front-scan that breaks on the first not-yet-expired\n // entry is correct and O(number actually expired). A replay does not refresh the\n // entry (no recency/TTL bump), so insertion order remains the eviction order.\n const seen = new Map<string, ReplayEntry>();\n\n // Length-prefixed key so (iss=\"a\", jti=\"bc\") cannot collide with (iss=\"ab\", jti=\"c\").\n const keyOf = (iss: string, jti: string): string => `${iss.length}:${iss}${jti.length}:${jti}`;\n\n const purgeExpired = (nowSeconds: number): void => {\n for (const [key, entry] of seen) {\n if (entry.expiresAt > nowSeconds) break;\n seen.delete(key);\n }\n };\n\n return {\n check(record: { iss: string; jti: string; iat: number }): ReplayGuardVerdict {\n // Fail closed on runtime misuse (plain-JS callers bypass the TS types). Validate\n // the record before any state mutation so invalid input never changes the store.\n const iat = safeInteger(record.iat, 'record.iat');\n const iss = nonEmptyString(record.iss, 'record.iss');\n const jti = nonEmptyString(record.jti, 'record.jti');\n const t = currentNow(); // validates now() + clamps backward movement\n\n // Time bound: drop entries that can no longer match within any window.\n purgeExpired(t);\n\n // Window first: out-of-window records never consume store capacity, and the\n // verdict is unambiguous (reported outside-window without being recorded).\n if (iat < t - windowSeconds || iat > t + maxClockSkewSeconds) {\n return 'outside-window';\n }\n\n const key = keyOf(iss, jti);\n if (seen.has(key)) {\n return 'replayed';\n }\n\n // Conservative TTL: an upper bound on the latest time any record accepted now\n // could still be replayed within the acceptance window. May retain older-iat\n // entries slightly longer than their exact iat + windowSeconds horizon, but it\n // preserves monotonic expiry order and keeps the store time-bounded (a stale\n // entry re-checked short-circuits as outside-window before dedup regardless).\n // Validate the expiry sum is a safe integer before any store mutation, so an\n // overflow fails closed without evicting or inserting.\n const expiresAt = safeInteger(t + windowSeconds + maxClockSkewSeconds, 'entry expiry');\n\n // Count bound: apply the hard maxEntries cap before inserting.\n if (seen.size >= maxEntries) {\n const oldest = seen.keys().next().value;\n if (oldest !== undefined) seen.delete(oldest);\n }\n seen.set(key, { expiresAt });\n return 'fresh';\n },\n };\n}\n"]}
1
+ {"version":3,"sources":["../src/_internal/record-core/codec/types.ts","../src/_internal/record-core/codec/jws-jwt.ts","../src/_internal/record-core/validators/kernel-constraints.ts","../src/_internal/record-core/validators/type-extension-mapping.ts","../src/_internal/record-core/validators/jose-hardening.ts","../src/_internal/record-core/validators/issuer-form.ts","../src/_internal/record-core/validators/temporal.ts","../src/_internal/record-core/validators/extension-budget.ts","../src/_internal/record-core/validators/schema-parse.ts","../src/_internal/record-core/validators/jose-typ-strictness.ts","../src/_internal/record-core/validators/iat-not-yet-valid.ts","../src/_internal/record-core/validators/policy-binding.ts","../src/_internal/record-core/validators/unknown-extension-grammar.ts","../src/type-extension-check.ts","../src/_internal/record-core/validators/type-extension-enforcement.ts","../src/_internal/record-core/bounded-validator.ts","../src/_internal/record-core/validation-gate.ts","../src/_internal/shadow-redact.ts","../src/_internal/shadow.ts","../src/_internal/legacy-path.ts","../src/_internal/shadow-observe.ts","../src/telemetry.ts","../src/issue.ts","../src/discovery.ts","../src/_internal/address-policy.ts","../src/ssrf-safe-fetch.ts","../src/jwks-resolver.ts","../src/_internal/signature.ts","../src/verify.ts","../src/_internal/record-core/shadow-hook.ts","../src/verify-local.ts","../src/headers.ts","../src/document-binding.ts","../src/policy-binding.ts","../src/verifier-types.ts","../src/verification-report.ts","../src/verifier-core.ts","../src/transport-profiles.ts","../src/pointer-fetch.ts","../src/replay-guard.ts"],"names":["cryptoVerify","ACCEPTED","escapeJsonPointerSegment","REJECTED","REGISTERED_EXTENSION_GROUP_KEYS","isValidExtensionKey","ACCEPTED_NO_WARN","TYPE_TO_EXTENSION_MAP","issue","validateKernelConstraints","body","rawBytes","PEAC_ISSUER_CONFIG_MAX_BYTES","VERIFIER_LIMITS","ReceiptClaims","jwsVerify","validateSubjectSnapshot","parseReceiptClaims","REGISTERED_RECEIPT_TYPES","WARNING_TYPE_UNREGISTERED","WARNING_UNKNOWN_EXTENSION","WARNING_EXTENSION_GROUP_MISSING","WARNING_EXTENSION_GROUP_MISMATCH","verifyPolicyBinding","HASH","VERIFIER_NETWORK","sha256Hex","VERIFICATION_REPORT_VERSION","decode","WIRE_TYPE","base64urlDecode"],"mappings":";;;;;;;;;;;AAsCO,IAAM,UAAA,GAAN,cAAyB,KAAA,CAAM;AAAA,EACpC,WAAA,CACkB,MAChB,OAAA,EACA;AACA,IAAA,KAAA,CAAM,OAAO,CAAA;AAHG,IAAA,IAAA,CAAA,IAAA,GAAA,IAAA;AAIhB,IAAA,IAAA,CAAK,IAAA,GAAO,YAAA;AAAA,EACd;AACF,CAAA;;;ACpBA,IAAM,cAAN,MAAyC;AAAA,EAC9B,IAAA,GAAO,SAAA;AAAA,EAEhB,MAAM,MAAA,CAAO,OAAA,EAAkB,UAAA,EAAwB,GAAA,EAA8B;AACnF,IAAA,OAAO,UAAA,CAAW,OAAA,EAAS,UAAA,EAAY,GAAG,CAAA;AAAA,EAC5C;AAAA,EAEA,MAAM,MAAA,CAAoB,UAAA,EAAoB,SAAA,EAAiD;AAC7F,IAAA,OAAOA,MAAA,CAAgB,YAAY,SAAS,CAAA;AAAA,EAC9C;AAAA,EAEA,WAAW,UAAA,EAAiC;AAG1C,IAAA,MAAM,QAAA,GAAW,UAAA,CAAW,KAAA,CAAM,GAAG,CAAA;AACrC,IAAA,IAAI,QAAA,CAAS,WAAW,CAAA,EAAG;AACzB,MAAA,MAAM,IAAI,UAAA;AAAA,QACR,sBAAA;AAAA,QACA,CAAA,yDAAA,EAA4D,SAAS,MAAM,CAAA,CAAA;AAAA,OAC7E;AAAA,IACF;AACA,IAAA,MAAM,CAAC,SAAA,EAAW,UAAA,EAAY,YAAY,CAAA,GAAI,QAAA;AAC9C,IAAA,IAAI,SAAA,CAAU,WAAW,CAAA,EAAG;AAC1B,MAAA,MAAM,IAAI,UAAA;AAAA,QACR,sBAAA;AAAA,QACA;AAAA,OACF;AAAA,IACF;AACA,IAAA,IAAI,UAAA,CAAW,WAAW,CAAA,EAAG;AAC3B,MAAA,MAAM,IAAI,UAAA;AAAA,QACR,sBAAA;AAAA,QACA;AAAA,OACF;AAAA,IACF;AACA,IAAA,IAAI,YAAA,CAAa,WAAW,CAAA,EAAG;AAC7B,MAAA,MAAM,IAAI,UAAA;AAAA,QACR,sBAAA;AAAA,QACA;AAAA,OACF;AAAA,IACF;AAEA,IAAA,IAAI,MAAA;AACJ,IAAA,IAAI;AAIF,MAAA,MAAM,UAAA,GAAa,sBAAsB,SAAS,CAAA;AAClD,MAAA,MAAA,GAAS,IAAA,CAAK,MAAM,UAAU,CAAA;AAAA,IAChC,SAAS,GAAA,EAAK;AACZ,MAAA,MAAM,IAAI,UAAA;AAAA,QACR,2BAAA;AAAA,QACA,CAAA,6CAAA,EAAiD,IAAc,OAAO,CAAA;AAAA,OACxE;AAAA,IACF;AAEA,IAAA,IAAI,OAAO,MAAA,CAAO,GAAA,KAAQ,QAAA,EAAU;AAClC,MAAA,MAAM,IAAI,UAAA;AAAA,QACR,wBAAA;AAAA,QACA;AAAA,OACF;AAAA,IACF;AACA,IAAA,IAAI,OAAO,MAAA,CAAO,GAAA,KAAQ,QAAA,EAAU;AAClC,MAAA,MAAM,IAAI,UAAA;AAAA,QACR,wBAAA;AAAA,QACA;AAAA,OACF;AAAA,IACF;AAEA,IAAA,OAAO;AAAA,MACL,KAAK,MAAA,CAAO,GAAA;AAAA,MACZ,KAAK,MAAA,CAAO,GAAA;AAAA,MACZ,KAAK,OAAO,MAAA,CAAO,GAAA,KAAQ,QAAA,GAAW,OAAO,GAAA,GAAM,MAAA;AAAA,MACnD,GAAA,EAAK;AAAA,KACP;AAAA,EACF;AACF,CAAA;AAOO,IAAM,YAAA,GAA4B,IAAI,WAAA,EAAY;AC3DlD,SAAS,kCAAkC,MAAA,EAA6C;AAC7F,EAAA,MAAM,aAAoC,EAAC;AAE3C,EAAA,IAAI,WAAW,IAAA,IAAQ,MAAA,KAAW,MAAA,IAAa,OAAO,WAAW,QAAA,EAAU;AACzE,IAAA,OAAO,EAAE,KAAA,EAAO,IAAA,EAAM,UAAA,EAAW;AAAA,EACnC;AAEA,EAAA,IAAI,UAAA,GAAa,CAAA;AACjB,EAAA,MAAM,KAAA,GAAgE;AAAA,IACpE,EAAE,KAAA,EAAO,MAAA,EAAQ,KAAA,EAAO,CAAA,EAAG,MAAM,EAAA;AAAG,GACtC;AAEA,EAAA,OAAO,KAAA,CAAM,SAAS,CAAA,EAAG;AACvB,IAAA,MAAM,IAAA,GAAO,MAAM,GAAA,EAAI;AACvB,IAAA,UAAA,EAAA;AAEA,IAAA,IAAI,UAAA,GAAa,mBAAmB,eAAA,EAAiB;AACnD,MAAA,UAAA,CAAW,IAAA,CAAK;AAAA,QACd,UAAA,EAAY,iBAAA;AAAA,QACZ,MAAA,EAAQ,UAAA;AAAA,QACR,OAAO,kBAAA,CAAmB,eAAA;AAAA,QAC1B,MAAM,IAAA,CAAK;AAAA,OACZ,CAAA;AACD,MAAA;AAAA,IACF;AAEA,IAAA,IAAI,IAAA,CAAK,KAAA,GAAQ,kBAAA,CAAmB,gBAAA,EAAkB;AACpD,MAAA,UAAA,CAAW,IAAA,CAAK;AAAA,QACd,UAAA,EAAY,kBAAA;AAAA,QACZ,QAAQ,IAAA,CAAK,KAAA;AAAA,QACb,OAAO,kBAAA,CAAmB,gBAAA;AAAA,QAC1B,MAAM,IAAA,CAAK;AAAA,OACZ,CAAA;AACD,MAAA;AAAA,IACF;AAEA,IAAA,IAAI,KAAK,KAAA,KAAU,IAAA,IAAQ,OAAO,IAAA,CAAK,UAAU,QAAA,EAAU;AACzD,MAAA,IAAI,OAAO,IAAA,CAAK,KAAA,KAAU,QAAA,EAAU;AAClC,QAAA,IAAI,IAAA,CAAK,KAAA,CAAM,MAAA,GAAS,kBAAA,CAAmB,iBAAA,EAAmB;AAC5D,UAAA,UAAA,CAAW,IAAA,CAAK;AAAA,YACd,UAAA,EAAY,mBAAA;AAAA,YACZ,MAAA,EAAQ,KAAK,KAAA,CAAM,MAAA;AAAA,YACnB,OAAO,kBAAA,CAAmB,iBAAA;AAAA,YAC1B,MAAM,IAAA,CAAK;AAAA,WACZ,CAAA;AAAA,QACH;AAAA,MACF;AACA,MAAA;AAAA,IACF;AAEA,IAAA,IAAI,KAAA,CAAM,OAAA,CAAQ,IAAA,CAAK,KAAK,CAAA,EAAG;AAC7B,MAAA,IAAI,IAAA,CAAK,KAAA,CAAM,MAAA,GAAS,kBAAA,CAAmB,gBAAA,EAAkB;AAC3D,QAAA,UAAA,CAAW,IAAA,CAAK;AAAA,UACd,UAAA,EAAY,kBAAA;AAAA,UACZ,MAAA,EAAQ,KAAK,KAAA,CAAM,MAAA;AAAA,UACnB,OAAO,kBAAA,CAAmB,gBAAA;AAAA,UAC1B,MAAM,IAAA,CAAK;AAAA,SACZ,CAAA;AAAA,MACH;AACA,MAAA,KAAA,IAAS,IAAI,IAAA,CAAK,KAAA,CAAM,SAAS,CAAA,EAAG,CAAA,IAAK,GAAG,CAAA,EAAA,EAAK;AAC/C,QAAA,KAAA,CAAM,IAAA,CAAK;AAAA,UACT,KAAA,EAAO,IAAA,CAAK,KAAA,CAAM,CAAC,CAAA;AAAA,UACnB,KAAA,EAAO,KAAK,KAAA,GAAQ,CAAA;AAAA,UACpB,IAAA,EAAM,CAAA,EAAG,IAAA,CAAK,IAAI,IAAI,CAAC,CAAA,CAAA;AAAA,SACxB,CAAA;AAAA,MACH;AACA,MAAA;AAAA,IACF;AAEA,IAAA,MAAM,IAAA,GAAO,MAAA,CAAO,IAAA,CAAK,IAAA,CAAK,KAAgC,CAAA;AAC9D,IAAA,IAAI,IAAA,CAAK,MAAA,GAAS,kBAAA,CAAmB,eAAA,EAAiB;AACpD,MAAA,UAAA,CAAW,IAAA,CAAK;AAAA,QACd,UAAA,EAAY,iBAAA;AAAA,QACZ,QAAQ,IAAA,CAAK,MAAA;AAAA,QACb,OAAO,kBAAA,CAAmB,eAAA;AAAA,QAC1B,MAAM,IAAA,CAAK;AAAA,OACZ,CAAA;AAAA,IACH;AACA,IAAA,KAAA,IAAS,IAAI,IAAA,CAAK,MAAA,GAAS,CAAA,EAAG,CAAA,IAAK,GAAG,CAAA,EAAA,EAAK;AACzC,MAAA,MAAM,GAAA,GAAM,KAAK,CAAC,CAAA;AAClB,MAAA,MAAM,SAAA,GAAY,KAAK,IAAA,GAAO,CAAA,EAAG,KAAK,IAAI,CAAA,CAAA,EAAI,GAAG,CAAA,CAAA,GAAK,GAAA;AACtD,MAAA,KAAA,CAAM,IAAA,CAAK;AAAA,QACT,KAAA,EAAQ,IAAA,CAAK,KAAA,CAAkC,GAAG,CAAA;AAAA,QAClD,KAAA,EAAO,KAAK,KAAA,GAAQ,CAAA;AAAA,QACpB,IAAA,EAAM;AAAA,OACP,CAAA;AAAA,IACH;AAAA,EACF;AAEA,EAAA,OAAO,EAAE,KAAA,EAAO,UAAA,CAAW,MAAA,KAAW,GAAG,UAAA,EAAW;AACtD;ACjFA,SAAS,yBAAyB,OAAA,EAAyB;AACzD,EAAA,OAAO,QAAQ,OAAA,CAAQ,IAAA,EAAM,IAAI,CAAA,CAAE,OAAA,CAAQ,OAAO,IAAI,CAAA;AACxD;AAOA,SAAS,qBAAA,CACP,IAAA,EACA,IAAA,EACA,UAAA,EACwC;AACxC,EAAA,IAAI,IAAA,KAAS,aAAa,OAAO,MAAA;AACjC,EAAA,MAAM,aAAA,GAAgB,qBAAA,CAAsB,GAAA,CAAI,IAAI,CAAA;AACpD,EAAA,IAAI,aAAA,KAAkB,QAAW,OAAO,MAAA;AACxC,EAAA,IAAI,UAAA,KAAe,UAAa,MAAA,CAAO,SAAA,CAAU,eAAe,IAAA,CAAK,UAAA,EAAY,aAAa,CAAA,EAAG;AAC/F,IAAA,OAAO,IAAA;AAAA,EACT;AACA,EAAA,IAAI,eAAe,MAAA,EAAW;AAC5B,IAAA,KAAA,MAAW,GAAA,IAAO,MAAA,CAAO,IAAA,CAAK,UAAU,CAAA,EAAG;AACzC,MAAA,IAAI,GAAA,KAAQ,aAAA,IAAiB,+BAAA,CAAgC,GAAA,CAAI,GAAG,CAAA,EAAG;AACrE,QAAA,OAAO,UAAA;AAAA,MACT;AAAA,IACF;AAAA,EACF;AACA,EAAA,OAAO,SAAA;AACT;AAQO,SAAS,qCACd,KAAA,EAC+B;AAC/B,EAAA,MAAM,WAA0C,EAAC;AAGjD,EAAA,IAAI,CAAC,wBAAA,CAAyB,GAAA,CAAI,KAAA,CAAM,IAAI,CAAA,EAAG;AAC7C,IAAA,QAAA,CAAS,KAAK,EAAE,IAAA,EAAM,yBAAA,EAA2B,OAAA,EAAS,SAAS,CAAA;AAAA,EACrE;AAGA,EAAA,IAAI,KAAA,CAAM,eAAe,MAAA,EAAW;AAClC,IAAA,KAAA,MAAW,GAAA,IAAO,MAAA,CAAO,IAAA,CAAK,KAAA,CAAM,UAAU,CAAA,EAAG;AAC/C,MAAA,IAAI,CAAC,+BAAA,CAAgC,GAAA,CAAI,GAAG,CAAA,IAAK,mBAAA,CAAoB,GAAG,CAAA,EAAG;AACzE,QAAA,QAAA,CAAS,IAAA,CAAK;AAAA,UACZ,IAAA,EAAM,yBAAA;AAAA,UACN,OAAA,EAAS,CAAA,YAAA,EAAe,wBAAA,CAAyB,GAAG,CAAC,CAAA;AAAA,SACtD,CAAA;AAAA,MACH;AAAA,IACF;AAAA,EACF;AAGA,EAAA,MAAM,SAAS,qBAAA,CAAsB,KAAA,CAAM,MAAM,KAAA,CAAM,IAAA,EAAM,MAAM,UAAU,CAAA;AAC7E,EAAA,IAAI,WAAW,SAAA,EAAW;AACxB,IAAA,QAAA,CAAS,KAAK,EAAE,IAAA,EAAM,+BAAA,EAAiC,OAAA,EAAS,SAAS,CAAA;AAAA,EAC3E,CAAA,MAAA,IAAW,WAAW,UAAA,EAAY;AAChC,IAAA,QAAA,CAAS,KAAK,EAAE,IAAA,EAAM,gCAAA,EAAkC,OAAA,EAAS,SAAS,CAAA;AAAA,EAC5E;AAEA,EAAA,OAAO,QAAA;AACT;;;ACrEA,IAAM,kBAAA,GAAqB,GAAA;AAgB3B,SAAS,gBAAgB,GAAA,EAA6B;AACpD,EAAA,IAAI,OAAO,GAAA,KAAQ,QAAA,IAAY,GAAA,CAAI,MAAA,KAAW,GAAG,OAAO,KAAA;AACxD,EAAA,IAAI,KAAA,GAAQ,CAAA;AACZ,EAAA,KAAA,IAAS,CAAA,GAAI,CAAA,EAAG,CAAA,GAAI,GAAA,CAAI,QAAQ,CAAA,EAAA,EAAK;AACnC,IAAA,MAAM,CAAA,GAAI,GAAA,CAAI,UAAA,CAAW,CAAC,CAAA;AAC1B,IAAA,IAAI,CAAA,GAAI,KAAM,KAAA,IAAS,CAAA;AAAA,SAAA,IACd,CAAA,GAAI,MAAO,KAAA,IAAS,CAAA;AAAA,SAAA,IACpB,CAAA,IAAK,KAAA,IAAU,CAAA,IAAK,KAAA,EAAQ;AACnC,MAAA,MAAM,IAAA,GAAO,IAAI,CAAA,GAAI,GAAA,CAAI,SAAS,GAAA,CAAI,UAAA,CAAW,CAAA,GAAI,CAAC,CAAA,GAAI,CAAA;AAC1D,MAAA,IAAI,IAAA,GAAO,KAAA,IAAU,IAAA,GAAO,KAAA,EAAQ,OAAO,KAAA;AAC3C,MAAA,KAAA,IAAS,CAAA;AACT,MAAA,CAAA,EAAA;AAAA,IACF,CAAA,MAAA,IAAW,CAAA,IAAK,KAAA,IAAU,CAAA,IAAK,KAAA,EAAQ;AACrC,MAAA,OAAO,KAAA;AAAA,IACT,OAAO,KAAA,IAAS,CAAA;AAChB,IAAA,IAAI,KAAA,GAAQ,oBAAoB,OAAO,KAAA;AAAA,EACzC;AACA,EAAA,OAAO,IAAA;AACT;AAEA,IAAM,QAAA,GAAgC,EAAE,QAAA,EAAU,IAAA,EAAK;AAEvD,SAAS,SAAS,SAAA,EAAwC;AACxD,EAAA,OAAO,EAAE,QAAA,EAAU,KAAA,EAAO,SAAA,EAAU;AACtC;AAEO,SAAS,8BAA8B,MAAA,EAAiD;AAE7F,EAAA,IAAI,CAAC,eAAA,CAAgB,MAAA,CAAO,GAAG,CAAA,EAAG;AAChC,IAAA,OAAO,SAAS,wBAAwB,CAAA;AAAA,EAC1C;AAGA,EAAA,IACE,MAAA,CAAO,GAAA,KAAQ,MAAA,IACf,MAAA,CAAO,GAAA,KAAQ,MAAA,IACf,MAAA,CAAO,GAAA,KAAQ,MAAA,IACf,MAAA,CAAO,GAAA,KAAQ,MAAA,EACf;AACA,IAAA,OAAO,SAAS,yBAAyB,CAAA;AAAA,EAC3C;AAGA,EAAA,IAAI,MAAA,CAAO,SAAS,MAAA,EAAW;AAC7B,IAAA,OAAO,SAAS,0BAA0B,CAAA;AAAA,EAC5C;AAGA,EAAA,IAAI,MAAA,CAAO,QAAQ,KAAA,EAAO;AACxB,IAAA,OAAO,SAAS,yBAAyB,CAAA;AAAA,EAC3C;AAGA,EAAA,IAAI,MAAA,CAAO,QAAQ,MAAA,EAAW;AAC5B,IAAA,OAAO,SAAS,yBAAyB,CAAA;AAAA,EAC3C;AAEA,EAAA,OAAO,QAAA;AACT;ACzEA,IAAMC,SAAAA,GAA6B,EAAE,QAAA,EAAU,IAAA,EAAK;AACpD,IAAM,QAAA,GAA6B,EAAE,QAAA,EAAU,KAAA,EAAO,WAAW,qBAAA,EAAsB;AAGvF,IAAM,WAAA,GAAc,yBAAA;AAEb,SAAS,2BAA2B,GAAA,EAAgC;AAEzE,EAAA,IAAI,OAAO,QAAQ,QAAA,IAAY,GAAA,CAAI,WAAW,CAAA,IAAK,GAAA,CAAI,MAAA,GAAS,aAAA,CAAc,SAAA,EAAW;AACvF,IAAA,OAAO,QAAA;AAAA,EACT;AAGA,EAAA,IAAI,GAAA,CAAI,UAAA,CAAW,MAAM,CAAA,EAAG;AAC1B,IAAA,OAAO,WAAA,CAAY,IAAA,CAAK,GAAG,CAAA,GAAIA,SAAAA,GAAW,QAAA;AAAA,EAC5C;AAGA,EAAA,IAAI,GAAA;AACJ,EAAA,IAAI;AACF,IAAA,GAAA,GAAM,IAAI,IAAI,GAAG,CAAA;AAAA,EACnB,CAAA,CAAA,MAAQ;AACN,IAAA,OAAO,QAAA;AAAA,EACT;AAEA,EAAA,IAAI,GAAA,CAAI,QAAA,KAAa,QAAA,EAAU,OAAO,QAAA;AACtC,EAAA,IAAI,CAAC,GAAA,CAAI,QAAA,EAAU,OAAO,QAAA;AAC1B,EAAA,IAAI,IAAI,QAAA,KAAa,EAAA,IAAM,GAAA,CAAI,QAAA,KAAa,IAAI,OAAO,QAAA;AAEvD,EAAA,MAAM,SAAS,CAAA,EAAG,GAAA,CAAI,QAAQ,CAAA,EAAA,EAAK,IAAI,IAAI,CAAA,CAAA;AAC3C,EAAA,OAAO,GAAA,KAAQ,SAASA,SAAAA,GAAW,QAAA;AACrC;ACxCA,IAAMA,SAAAA,GAA2B,EAAE,QAAA,EAAU,IAAA,EAAK;AAE3C,SAAS,wBAAA,CACd,UAAA,EACA,GAAA,EACA,GAAA,EACA,YAAoB,6BAAA,EACJ;AAChB,EAAA,IAAI,UAAA,KAAe,QAAW,OAAOA,SAAAA;AAErC,EAAA,MAAM,EAAA,GAAK,IAAA,CAAK,KAAA,CAAM,UAAU,CAAA,GAAI,GAAA;AACpC,EAAA,IAAI,KAAA,CAAM,EAAE,CAAA,EAAG,OAAOA,SAAAA;AAEtB,EAAA,IAAI,EAAA,GAAK,MAAM,SAAA,EAAW;AACxB,IAAA,OAAO;AAAA,MACL,QAAA,EAAU,KAAA;AAAA,MACV,SAAA,EAAW,sBAAA;AAAA,MACX,OAAA,EAAS;AAAA,KACX;AAAA,EACF;AAEA,EAAA,IAAI,KAAK,GAAA,EAAK;AACZ,IAAA,OAAO;AAAA,MACL,QAAA,EAAU,IAAA;AAAA,MACV,UAAU,CAAC,EAAE,MAAM,kBAAA,EAAoB,OAAA,EAAS,gBAAgB;AAAA,KAClE;AAAA,EACF;AAEA,EAAA,OAAOA,SAAAA;AACT;AC3BA,IAAMA,YAAkC,EAAE,QAAA,EAAU,IAAA,EAAM,UAAA,EAAY,EAAC,EAAE;AACzE,IAAM,aAAA,GAAgB,2BAAA;AAEtB,IAAM,WAAA,GAAc,IAAI,WAAA,EAAY;AAOpC,SAAS,mBAAmB,KAAA,EAAwB;AAClD,EAAA,IAAI;AACF,IAAA,OAAO,YAAY,MAAA,CAAO,IAAA,CAAK,SAAA,CAAU,KAAK,CAAC,CAAA,CAAE,UAAA;AAAA,EACnD,CAAA,CAAA,MAAQ;AACN,IAAA,OAAO,QAAA;AAAA,EACT;AACF;AAGA,SAASC,0BAAyB,OAAA,EAAyB;AACzD,EAAA,OAAO,QAAQ,OAAA,CAAQ,IAAA,EAAM,IAAI,CAAA,CAAE,OAAA,CAAQ,OAAO,IAAI,CAAA;AACxD;AAEO,SAAS,gCACd,UAAA,EACuB;AACvB,EAAA,IAAI,UAAA,KAAe,QAAW,OAAOD,SAAAA;AAErC,EAAA,MAAM,UAAA,GAAa,mBAAmB,UAAU,CAAA;AAChD,EAAA,IAAI,UAAA,GAAa,iBAAiB,aAAA,EAAe;AAG/C,IAAA,OAAO;AAAA,MACL,QAAA,EAAU,KAAA;AAAA,MACV,YAAY,CAAC,EAAE,MAAM,aAAA,EAAe,IAAA,EAAM,eAAe;AAAA,KAC3D;AAAA,EACF;AAEA,EAAA,MAAM,aAAyC,EAAC;AAChD,EAAA,KAAA,MAAW,GAAA,IAAO,MAAA,CAAO,IAAA,CAAK,UAAU,CAAA,EAAG;AACzC,IAAA,MAAM,UAAA,GAAa,kBAAA,CAAmB,UAAA,CAAW,GAAG,CAAC,CAAA;AACrD,IAAA,IAAI,UAAA,GAAa,iBAAiB,aAAA,EAAe;AAC/C,MAAA,UAAA,CAAW,IAAA,CAAK;AAAA,QACd,IAAA,EAAM,aAAA;AAAA,QACN,IAAA,EAAM,CAAA,YAAA,EAAeC,yBAAAA,CAAyB,GAAG,CAAC,CAAA;AAAA,OACnD,CAAA;AAAA,IACH;AAAA,EACF;AAEA,EAAA,IAAI,UAAA,CAAW,MAAA,KAAW,CAAA,EAAG,OAAOD,SAAAA;AACpC,EAAA,OAAO,EAAE,QAAA,EAAU,KAAA,EAAO,UAAA,EAAW;AACvC;AC3BO,SAAS,4BAA4B,OAAA,EAAqC;AAC/E,EAAA,MAAM,EAAA,GAAK,mBAAmB,OAAO,CAAA;AACrC,EAAA,IAAI,CAAC,GAAG,EAAA,EAAI;AACV,IAAA,OAAO;AAAA,MACL,QAAA,EAAU,KAAA;AAAA,MACV,SAAA,EAAW,GAAG,KAAA,CAAM,IAAA;AAAA,MACpB,YAAA,EAAc,GAAG,KAAA,CAAM,OAAA;AAAA,MACvB,GAAI,GAAG,KAAA,CAAM,MAAA,KAAW,UAAa,EAAE,WAAA,EAAa,EAAA,CAAG,KAAA,CAAM,MAAA;AAAO,KACtE;AAAA,EACF;AACA,EAAA,IAAI,EAAA,CAAG,gBAAgB,KAAA,EAAO;AAC5B,IAAA,OAAO;AAAA,MACL,QAAA,EAAU,KAAA;AAAA,MACV,SAAA,EAAW,4BAAA;AAAA,MACX,YAAA,EAAc,CAAA,0BAAA,EAA6B,EAAA,CAAG,WAAW,CAAA;AAAA,KAC3D;AAAA,EACF;AACA,EAAA,OAAO;AAAA,IACL,QAAA,EAAU,IAAA;AAAA,IACV,QAAQ,EAAA,CAAG,MAAA;AAAA,IACX,WAAA,EAAa,KAAA;AAAA,IACb,UAAU,EAAA,CAAG;AAAA,GACf;AACF;;;AC5DA,IAAM,gBAAA,GAA4C,EAAE,QAAA,EAAU,IAAA,EAAK;AACnE,IAAM,oBAAA,GAAgD;AAAA,EACpD,QAAA,EAAU,IAAA;AAAA,EACV,QAAA,EAAU,CAAC,EAAE,IAAA,EAAM,eAAe;AACpC,CAAA;AACA,IAAM,uBAAA,GAAmD;AAAA,EACvD,QAAA,EAAU,KAAA;AAAA,EACV,SAAA,EAAW;AACb,CAAA;AAEO,SAAS,iCAAA,CACd,KACA,UAAA,EACyB;AACzB,EAAA,MAAM,OAAA,GAAU,OAAO,GAAA,KAAQ,QAAA,IAAY,IAAI,MAAA,GAAS,CAAA;AACxD,EAAA,IAAI,SAAS,OAAO,gBAAA;AACpB,EAAA,IAAI,UAAA,KAAe,UAAU,OAAO,uBAAA;AACpC,EAAA,OAAO,oBAAA;AACT;;;AC1BA,IAAMA,SAAAA,GAAiC,EAAE,QAAA,EAAU,IAAA,EAAK;AACxD,IAAME,SAAAA,GAAiC;AAAA,EACrC,QAAA,EAAU,KAAA;AAAA,EACV,SAAA,EAAW;AACb,CAAA;AAEO,SAAS,8BAAA,CACd,GAAA,EACA,GAAA,EACA,YAAA,EACsB;AACtB,EAAA,IAAI,GAAA,GAAM,GAAA,GAAM,YAAA,EAAc,OAAOA,SAAAA;AACrC,EAAA,OAAOF,SAAAA;AACT;ACPO,SAAS,6BAAA,CACd,qBACA,iBAAA,EACqB;AACrB,EAAA,IAAI,mBAAA,KAAwB,MAAA,IAAa,iBAAA,KAAsB,MAAA,EAAW;AACxE,IAAA,OAAO,EAAE,QAAA,EAAU,IAAA,EAAM,MAAA,EAAQ,aAAA,EAAc;AAAA,EACjD;AACA,EAAA,MAAM,MAAA,GAAS,mBAAA,CAAoB,mBAAA,EAAqB,iBAAiB,CAAA;AACzE,EAAA,IAAI,WAAW,QAAA,EAAU;AACvB,IAAA,OAAO,EAAE,QAAA,EAAU,KAAA,EAAO,SAAA,EAAW,2BAA2B,MAAA,EAAO;AAAA,EACzE;AACA,EAAA,OAAO,EAAE,QAAA,EAAU,IAAA,EAAM,MAAA,EAAO;AAClC;ACLA,IAAM,cAAA,GAAgD;AAAA,EACpD,QAAA,EAAU,IAAA;AAAA,EACV,UAAU;AACZ,CAAA;AAMA,SAAS,kBAAkB,KAAA,EAAuB;AAChD,EAAA,OAAO,MAAM,OAAA,CAAQ,IAAA,EAAM,IAAI,CAAA,CAAE,OAAA,CAAQ,OAAO,IAAI,CAAA;AACtD;AAEO,SAAS,wCACd,UAAA,EAC+B;AAC/B,EAAA,IAAI,UAAA,KAAe,QAAW,OAAO,cAAA;AACrC,EAAA,MAAM,IAAA,GAAO,MAAA,CAAO,IAAA,CAAK,UAAU,CAAA;AACnC,EAAA,IAAI,IAAA,CAAK,MAAA,KAAW,CAAA,EAAG,OAAO,cAAA;AAE9B,EAAA,MAAM,WAAsC,EAAC;AAC7C,EAAA,KAAA,MAAW,OAAO,IAAA,EAAM;AACtB,IAAA,IAAI,CAACG,+BAAAA,CAAgC,GAAA,CAAI,GAAG,CAAA,IAAKC,mBAAAA,CAAoB,GAAG,CAAA,EAAG;AACzE,MAAA,QAAA,CAAS,IAAA,CAAK;AAAA,QACZ,IAAA,EAAM,6BAAA;AAAA,QACN,OAAA,EAAS,CAAA,YAAA,EAAe,iBAAA,CAAkB,GAAG,CAAC,CAAA;AAAA,OAC/C,CAAA;AAAA,IACH;AAAA,EACF;AACA,EAAA,OAAO,EAAE,QAAA,EAAU,IAAA,EAAM,QAAA,EAAS;AACpC;;;AC7BO,SAAS,yBAAA,CACd,IAAA,EACA,IAAA,EACA,UAAA,EACA,oBACA,4BAAA,EAC0B;AAE1B,EAAA,IAAI,SAAS,WAAA,EAAa;AACxB,IAAA,OAAO,EAAE,QAAQ,MAAA,EAAO;AAAA,EAC1B;AAEA,EAAA,MAAM,aAAA,GAAgB,kBAAA,CAAmB,GAAA,CAAI,IAAI,CAAA;AAGjD,EAAA,IAAI,kBAAkB,MAAA,EAAW;AAC/B,IAAA,OAAO,EAAE,QAAQ,MAAA,EAAO;AAAA,EAC1B;AAGA,EAAA,IAAI,UAAA,KAAe,UAAa,MAAA,CAAO,SAAA,CAAU,eAAe,IAAA,CAAK,UAAA,EAAY,aAAa,CAAA,EAAG;AAC/F,IAAA,OAAO,EAAE,QAAQ,IAAA,EAAK;AAAA,EACxB;AAIA,EAAA,MAAM,oBAA8B,EAAC;AACrC,EAAA,IAAI,eAAe,MAAA,EAAW;AAC5B,IAAA,KAAA,MAAW,GAAA,IAAO,MAAA,CAAO,IAAA,CAAK,UAAU,CAAA,EAAG;AACzC,MAAA,IAAI,GAAA,KAAQ,aAAA,IAAiB,4BAAA,CAA6B,GAAA,CAAI,GAAG,CAAA,EAAG;AAClE,QAAA,iBAAA,CAAkB,KAAK,GAAG,CAAA;AAAA,MAC5B;AAAA,IACF;AAAA,EACF;AAEA,EAAA,OAAO;AAAA,IACL,MAAA,EAAQ,iBAAA,CAAkB,MAAA,GAAS,CAAA,GAAI,UAAA,GAAa,SAAA;AAAA,IACpD,wBAAA,EAA0B,aAAA;AAAA,IAC1B,mCAAA,EAAqC;AAAA,GACvC;AACF;;;ACzCA,IAAMC,iBAAAA,GAAmD,EAAE,QAAA,EAAU,IAAA,EAAK;AAEnE,SAAS,wCAAA,CACd,IAAA,EACA,IAAA,EACA,UAAA,EACA,UAAA,EACgC;AAChC,EAAA,MAAM,MAAA,GAAS,yBAAA;AAAA,IACb,IAAA;AAAA,IACA,IAAA;AAAA,IACA,UAAA;AAAA,IACAC,qBAAAA;AAAA,IACAH;AAAA,GACF;AAEA,EAAA,IAAI,MAAA,CAAO,MAAA,KAAW,IAAA,IAAQ,MAAA,CAAO,WAAW,MAAA,EAAQ;AACtD,IAAA,OAAOE,iBAAAA;AAAA,EACT;AAEA,EAAA,IAAI,eAAe,QAAA,EAAU;AAC3B,IAAA,MAAM,SAAA,GACJ,MAAA,CAAO,MAAA,KAAW,SAAA,GAAY,4BAAA,GAA+B,4BAAA;AAC/D,IAAA,OAAO,EAAE,QAAA,EAAU,KAAA,EAAO,SAAA,EAAW,SAAS,OAAA,EAAQ;AAAA,EACxD;AAGA,EAAA,MAAM,WAAA,GACJ,MAAA,CAAO,MAAA,KAAW,SAAA,GAAY,yBAAA,GAA4B,0BAAA;AAC5D,EAAA,OAAO;AAAA,IACL,QAAA,EAAU,IAAA;AAAA,IACV,UAAU,CAAC,EAAE,MAAM,WAAA,EAAa,OAAA,EAAS,SAAS;AAAA,GACpD;AACF;;;ACkFO,SAAS,0BAA0B,KAAA,EAAwD;AAChG,EAAA,MAAM,aAAiC,EAAC;AACxC,EAAA,MAAM,WAA6B,EAAC;AAGpC,EAAA,MAAM,SAAA,GAAY,iCAAA,CAAkC,KAAA,CAAM,MAAM,CAAA;AAChE,EAAA,IAAI,CAAC,UAAU,KAAA,EAAO;AACpB,IAAA,KAAA,MAAW,CAAA,IAAK,UAAU,UAAA,EAAY;AACpC,MAAA,UAAA,CAAW,IAAA,CAAK;AAAA,QACd,KAAA,EAAO,oBAAA;AAAA,QACP,MAAM,CAAA,CAAE,UAAA;AAAA,QACR,IAAA,EAAM,EAAE,IAAA,IAAQ;AAAA,OACjB,CAAA;AAAA,IACH;AAAA,EACF;AAGA,EAAA,MAAM,MAAA,GAAS,0BAAA,CAA2B,KAAA,CAAM,MAAA,CAAO,GAAG,CAAA;AAC1D,EAAA,IAAI,CAAC,OAAO,QAAA,EAAU;AACpB,IAAA,UAAA,CAAW,KAAK,EAAE,KAAA,EAAO,eAAe,IAAA,EAAM,MAAA,CAAO,WAAW,CAAA;AAAA,EAClE;AAGA,EAAA,IAAI,KAAA,CAAM,WAAW,MAAA,EAAW;AAC9B,IAAA,MAAM,OAAA,GAAU,6BAAA,CAA8B,KAAA,CAAM,MAAM,CAAA;AAC1D,IAAA,IAAI,CAAC,QAAQ,QAAA,EAAU;AACrB,MAAA,UAAA,CAAW,KAAK,EAAE,KAAA,EAAO,yBAAyB,IAAA,EAAM,OAAA,CAAQ,WAAW,CAAA;AAAA,IAC7E;AAAA,EACF;AAGA,EAAA,MAAM,kBACJ,oCAAA,CAAqC;AAAA,IACnC,IAAA,EAAM,MAAM,MAAA,CAAO,IAAA;AAAA,IACnB,IAAA,EAAM,MAAM,MAAA,CAAO,IAAA;AAAA,IACnB,UAAA,EAAY,MAAM,MAAA,CAAO;AAAA,GAC1B,CAAA;AACH,EAAA,KAAA,MAAW,KAAK,eAAA,EAAiB;AAC/B,IAAA,QAAA,CAAS,IAAA,CAAK,EAAE,KAAA,EAAO,wBAAA,EAA0B,IAAA,EAAM,EAAE,IAAA,EAAM,IAAA,EAAM,CAAA,CAAE,OAAA,EAAS,CAAA;AAAA,EAClF;AAKA,EAAA,IAAI,KAAA,CAAM,MAAA,CAAO,IAAA,KAAS,UAAA,EAAY;AACpC,IAAA,MAAM,WAAA,GAAc,wBAAA;AAAA,MAClB,MAAM,MAAA,CAAO,WAAA;AAAA,MACb,MAAM,MAAA,CAAO,GAAA;AAAA,MACb,KAAA,CAAM;AAAA,KACR;AACA,IAAA,IAAI,CAAC,YAAY,QAAA,EAAU;AACzB,MAAA,UAAA,CAAW,IAAA,CAAK;AAAA,QACd,KAAA,EAAO,UAAA;AAAA,QACP,MAAM,WAAA,CAAY,SAAA;AAAA,QAClB,MAAM,WAAA,CAAY;AAAA,OACnB,CAAA;AAAA,IACH,CAAA,MAAA,IAAW,YAAY,QAAA,EAAU;AAC/B,MAAA,MAAM,OAAmC,WAAA,CAAY,QAAA;AACrD,MAAA,KAAA,MAAW,KAAK,IAAA,EAAM;AACpB,QAAA,QAAA,CAAS,IAAA,CAAK,EAAE,KAAA,EAAO,UAAA,EAAY,IAAA,EAAM,EAAE,IAAA,EAAM,IAAA,EAAM,CAAA,CAAE,OAAA,EAAS,CAAA;AAAA,MACpE;AAAA,IACF;AAAA,EACF;AAGA,EAAA,MAAM,SAAA,GAAY,+BAAA,CAAgC,KAAA,CAAM,MAAA,CAAO,UAAU,CAAA;AACzE,EAAA,IAAI,CAAC,UAAU,QAAA,EAAU;AACvB,IAAA,MAAM,OAA4C,SAAA,CAAU,UAAA;AAC5D,IAAA,KAAA,MAAW,KAAK,IAAA,EAAM;AACpB,MAAA,UAAA,CAAW,IAAA,CAAK,EAAE,KAAA,EAAO,kBAAA,EAAoB,IAAA,EAAM,EAAE,IAAA,EAAM,IAAA,EAAM,CAAA,CAAE,IAAA,EAAM,CAAA;AAAA,IAC3E;AAAA,EACF;AAOA,EAAA,IAAI,KAAA,CAAM,eAAe,MAAA,EAAW;AAClC,IAAA,MAAM,SAAA,GAAY,2BAAA,CAA4B,KAAA,CAAM,UAAU,CAAA;AAC9D,IAAA,IAAI,CAAC,SAAA,CAAU,QAAA,IAAY,SAAA,CAAU,cAAc,MAAA,EAAW;AAC5D,MAAA,UAAA,CAAW,KAAK,EAAE,KAAA,EAAO,gBAAgB,IAAA,EAAM,SAAA,CAAU,WAAW,CAAA;AAAA,IACtE;AAAA,EACF;AAMA,EAAA,IAAI,KAAA,CAAM,MAAA,KAAW,MAAA,IAAa,KAAA,CAAM,eAAe,MAAA,EAAW;AAChE,IAAA,MAAM,SAAS,iCAAA,CAAkC,KAAA,CAAM,MAAA,CAAO,GAAA,EAAK,MAAM,UAAU,CAAA;AACnF,IAAA,IAAI,CAAC,OAAO,QAAA,EAAU;AACpB,MAAA,UAAA,CAAW,KAAK,EAAE,KAAA,EAAO,uBAAuB,IAAA,EAAM,MAAA,CAAO,WAAW,CAAA;AAAA,IAC1E,CAAA,MAAA,IAAW,OAAO,QAAA,EAAU;AAC1B,MAAA,KAAA,MAAW,CAAA,IAAK,OAAO,QAAA,EAAU;AAC/B,QAAA,QAAA,CAAS,KAAK,EAAE,KAAA,EAAO,uBAAuB,IAAA,EAAM,CAAA,CAAE,MAAM,CAAA;AAAA,MAC9D;AAAA,IACF;AAAA,EACF;AAKA,EAAA,IAAI,KAAA,CAAM,iBAAiB,MAAA,EAAW;AACpC,IAAA,MAAM,MAAA,GAAS,+BAA+B,KAAA,CAAM,MAAA,CAAO,KAAK,KAAA,CAAM,GAAA,EAAK,MAAM,YAAY,CAAA;AAC7F,IAAA,IAAI,CAAC,MAAA,CAAO,QAAA,IAAY,MAAA,CAAO,cAAc,MAAA,EAAW;AACtD,MAAA,UAAA,CAAW,KAAK,EAAE,KAAA,EAAO,qBAAqB,IAAA,EAAM,MAAA,CAAO,WAAW,CAAA;AAAA,IACxE;AAAA,EACF;AAMA,EAAA,IAAI,KAAA,CAAM,mBAAA,KAAwB,MAAA,IAAa,KAAA,CAAM,sBAAsB,MAAA,EAAW;AACpF,IAAA,MAAM,SAAA,GAAY,6BAAA;AAAA,MAChB,KAAA,CAAM,mBAAA;AAAA,MACN,KAAA,CAAM;AAAA,KACR;AACA,IAAA,IAAI,CAAC,SAAA,CAAU,QAAA,IAAY,SAAA,CAAU,cAAc,MAAA,EAAW;AAC5D,MAAA,UAAA,CAAW,KAAK,EAAE,KAAA,EAAO,kBAAkB,IAAA,EAAM,SAAA,CAAU,WAAW,CAAA;AAAA,IACxE;AAAA,EACF;AAGA,EAAA,MAAM,aAAA,GAAgB,uCAAA,CAAwC,KAAA,CAAM,MAAA,CAAO,UAAU,CAAA;AACrF,EAAA,KAAA,MAAW,CAAA,IAAK,cAAc,QAAA,EAAgD;AAC5E,IAAA,QAAA,CAAS,IAAA,CAAK;AAAA,MACZ,KAAA,EAAO,2BAAA;AAAA,MACP,MAAM,CAAA,CAAE,IAAA;AAAA,MACR,MAAM,CAAA,CAAE;AAAA,KACT,CAAA;AAAA,EACH;AAKA,EAAA,IAAI,KAAA,CAAM,eAAe,MAAA,EAAW;AAClC,IAAA,MAAM,UAAA,GAAa,wCAAA;AAAA,MACjB,MAAM,MAAA,CAAO,IAAA;AAAA,MACb,MAAM,MAAA,CAAO,IAAA;AAAA,MACb,MAAM,MAAA,CAAO,UAAA;AAAA,MACb,KAAA,CAAM;AAAA,KACR;AACA,IAAA,IAAI,CAAC,WAAW,QAAA,EAAU;AACxB,MAAA,UAAA,CAAW,IAAA,CAAK;AAAA,QACd,KAAA,EAAO,4BAAA;AAAA,QACP,MAAM,UAAA,CAAW,SAAA;AAAA,QACjB,MAAM,UAAA,CAAW;AAAA,OAClB,CAAA;AAAA,IACH,CAAA,MAAA,IAAW,WAAW,QAAA,EAAU;AAC9B,MAAA,KAAA,MAAW,CAAA,IAAK,WAAW,QAAA,EAAwD;AACjF,QAAA,QAAA,CAAS,IAAA,CAAK;AAAA,UACZ,KAAA,EAAO,4BAAA;AAAA,UACP,MAAM,CAAA,CAAE,IAAA;AAAA,UACR,MAAM,CAAA,CAAE;AAAA,SACT,CAAA;AAAA,MACH;AAAA,IACF;AAAA,EACF;AAEA,EAAA,OAAO;AAAA,IACL,QAAA,EAAU,WAAW,MAAA,KAAW,CAAA;AAAA,IAChC,UAAA;AAAA,IACA;AAAA,GACF;AACF;AC5NA,IAAM,oBAAA,GAAuB,EAAA;AAE7B,SAAS,eAAe,MAAA,EAA6D;AACnF,EAAA,IAAI,CAAC,KAAA,CAAM,OAAA,CAAQ,MAAM,GAAG,OAAO,MAAA;AACnC,EAAA,OAAO,OAAO,KAAA,CAAM,CAAA,EAAG,oBAAoB,CAAA,CAAE,GAAA,CAAI,CAACE,MAAAA,KAAU;AAC1D,IAAA,MAAM,SAAA,GAAYA,MAAAA;AAClB,IAAA,MAAM,OAAO,KAAA,CAAM,OAAA,CAAQ,UAAU,IAAI,CAAA,GACrC,UAAU,IAAA,CACP,GAAA;AAAA,MAAI,CAAC,OAAA,KACJ,OAAO,OAAA,KAAY,QAAA,IAAY,OAAO,OAAA,KAAY,QAAA,GAAW,MAAA,CAAO,OAAO,CAAA,GAAI;AAAA,KACjF,CACC,IAAA,CAAK,GAAG,CAAA,GACX,EAAA;AACJ,IAAA,MAAM,OAAA,GACJ,OAAO,SAAA,CAAU,OAAA,KAAY,QAAA,GACzB,UAAU,OAAA,GACV,MAAA,CAAO,SAAA,CAAU,OAAA,IAAWA,MAAK,CAAA;AACvC,IAAA,OAAO,EAAE,MAAM,OAAA,EAAQ;AAAA,EACzB,CAAC,CAAA;AACH;AAYO,SAAS,yBAAyB,KAAA,EAAkD;AACzF,EAAA,IAAI,KAAA,CAAM,YAAY,aAAA,EAAe;AACnC,IAAA,OAAO,cAAA,CAAe,MAAM,OAAO,CAAA;AAAA,EACrC;AACA,EAAA,OAAO,cAAA,CAAe,MAAM,OAAO,CAAA;AACrC;AAEA,SAAS,eAAe,OAAA,EAAwC;AAI9D,EAAA,MAAM,SAAA,GAAY,4BAA4B,OAAO,CAAA;AACrD,EAAA,IAAI,CAAC,UAAU,QAAA,EAAU;AACvB,IAAA,MAAM,iBAAA,GAAoB,SAAA,CAAU,WAAA,GAAc,CAAC,CAAA,EAAG,OAAA;AACtD,IAAA,OAAO;AAAA,MACL,EAAA,EAAI,KAAA;AAAA,MACJ,IAAA,EAAM,kBAAA;AAAA,MACN,OAAA,EAAS,CAAA,0CAAA,EAA6C,iBAAA,IAAqB,SAAS,CAAA;AAAA,KACtF;AAAA,EACF;AACA,EAAA,OAAO,EAAE,IAAI,IAAA,EAAK;AACpB;AAEA,SAAS,eAAe,OAAA,EAAwC;AAI9D,EAAA,MAAM,SAAA,GAAY,0BAA0B,OAAO,CAAA;AACnD,EAAA,IAAI,CAAC,UAAU,KAAA,EAAO;AACpB,IAAA,MAAM,CAAA,GAAI,SAAA,CAAU,UAAA,CAAW,CAAC,CAAA;AAChC,IAAA,OAAO;AAAA,MACL,EAAA,EAAI,KAAA;AAAA,MACJ,IAAA,EAAM,wBAAA;AAAA,MACN,OAAA,EAAS,+BAA+B,CAAA,CAAE,UAAU,aAAa,CAAA,CAAE,MAAM,CAAA,SAAA,EAAY,CAAA,CAAE,KAAK,CAAA,CAAA;AAAA,KAC9F;AAAA,EACF;AAWA,EAAA,MAAM,SAAA,GAAY,4BAA4B,OAAO,CAAA;AACrD,EAAA,IAAI,CAAC,UAAU,QAAA,EAAU;AACvB,IAAA,IAAI,SAAA,CAAU,cAAc,4BAAA,EAA8B;AACxD,MAAA,OAAO;AAAA,QACL,EAAA,EAAI,KAAA;AAAA,QACJ,IAAA,EAAM,4BAAA;AAAA,QACN,OAAA,EAAS;AAAA,OACX;AAAA,IACF;AACA,IAAA,MAAM,SAAA,GAAY,cAAA,CAAe,SAAA,CAAU,WAAW,CAAA;AACtD,IAAA,MAAM,UAAwC,EAAC;AAC/C,IAAA,IAAI,SAAA,CAAU,cAAc,MAAA,EAAW;AACrC,MAAA,MAAA,CAAO,OAAO,OAAA,EAAS,EAAE,UAAA,EAAY,SAAA,CAAU,WAAW,CAAA;AAAA,IAC5D;AACA,IAAA,IAAI,cAAc,MAAA,EAAW;AAC3B,MAAA,MAAA,CAAO,MAAA,CAAO,OAAA,EAAS,EAAE,MAAA,EAAQ,WAAW,CAAA;AAAA,IAC9C;AACA,IAAA,OAAO;AAAA,MACL,EAAA,EAAI,KAAA;AAAA,MACJ,IAAA,EAAM,kBAAA;AAAA,MACN,OAAA,EAAS,CAAA,kCAAA,EAAqC,SAAA,CAAU,YAAA,IAAgB,SAAS,CAAA,CAAA;AAAA,MACjF,GAAI,OAAO,IAAA,CAAK,OAAO,EAAE,MAAA,GAAS,CAAA,IAAK,EAAE,OAAA;AAAQ,KACnD;AAAA,EACF;AAEA,EAAA,IAAI,SAAA,CAAU,WAAA,KAAgB,KAAA,IAAS,SAAA,CAAU,WAAW,MAAA,EAAW;AACrE,IAAA,OAAO;AAAA,MACL,EAAA,EAAI,KAAA;AAAA,MACJ,IAAA,EAAM,4BAAA;AAAA,MACN,OAAA,EAAS;AAAA,KACX;AAAA,EACF;AAEA,EAAA,OAAO;AAAA,IACL,EAAA,EAAI,IAAA;AAAA,IACJ,MAAA,EAAQ;AAAA,MACN,WAAA,EAAa,KAAA;AAAA,MACb,QAAQ,SAAA,CAAU,MAAA;AAAA,MAClB,cAAA,EAAgB,SAAA,CAAU,QAAA,IAAY;AAAC;AACzC,GACF;AACF;ACpLA,IAAM,eAAA,GAAqC;AAAA;AAAA,EAEzC,wDAAA;AAAA;AAAA;AAAA,EAIA,6DAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAQA,+BAAA;AAAA;AAAA,EAGA,gCAAA;AAAA;AAAA;AAAA,EAIA,+BAAA;AAAA;AAAA,EAGA,0CAAA;AAAA;AAAA,EAGA,wBAAA;AAAA;AAAA,EAGA,4BAAA;AAAA;AAAA,EAGA,iEAAA;AAAA;AAAA,EAGA,uBAAA;AAAA;AAAA,EAGA,iDAAA;AAAA;AAAA;AAAA;AAAA,EAKA,uBAAA;AAAA,EACA,gCAAA;AAAA,EACA;AACF,CAAA;AAOA,IAAM,gBAAA,GAAmB,YAAA;AAEzB,IAAM,YAAA,uBAAmC,WAAA,EAAY;AACrD,IAAM,+BAA+B,IAAI,WAAA,CAAY,SAAS,EAAE,KAAA,EAAO,OAAO,CAAA;AAE9E,IAAM,sBAAA,GAAyB,YAAA,CAAa,MAAA,CAAO,gBAAgB,CAAA,CAAE,MAAA;AAQ9D,SAAS,eAAe,KAAA,EAAuB;AACpD,EAAA,OAAO,YAAA,CAAa,MAAA,CAAO,KAAK,CAAA,CAAE,MAAA;AACpC;AAcO,SAAS,UAAA,CAAW,OAAe,QAAA,EAA0B;AAClE,EAAA,IAAI,OAAO,KAAA,KAAU,QAAA,EAAU,OAAO,gBAAA;AAEtC,EAAA,IAAI,QAAA,GAAW,KAAA;AACf,EAAA,KAAA,MAAW,WAAW,eAAA,EAAiB;AACrC,IAAA,QAAA,GAAW,QAAA,CAAS,OAAA,CAAQ,OAAA,EAAS,gBAAgB,CAAA;AAAA,EACvD;AAEA,EAAA,MAAM,KAAA,GAAQ,YAAA,CAAa,MAAA,CAAO,QAAQ,CAAA;AAC1C,EAAA,IAAI,KAAA,CAAM,MAAA,IAAU,QAAA,EAAU,OAAO,QAAA;AAErC,EAAA,IAAI,YAAY,sBAAA,EAAwB;AACtC,IAAA,OAAO,gBAAA,CAAiB,KAAA,CAAM,CAAA,EAAG,QAAQ,CAAA;AAAA,EAC3C;AAEA,EAAA,MAAM,YAAY,QAAA,GAAW,sBAAA;AAC7B,EAAA,OAAO,aAAA,CAAc,KAAA,EAAO,SAAS,CAAA,GAAI,gBAAA;AAC3C;AAeA,eAAsB,gBAAgB,KAAA,EAAiC;AACrE,EAAA,OAAO,SAAA,CAAU,kBAAA,CAAmB,KAAK,CAAC,CAAA;AAC5C;AAQA,eAAsB,QAAQ,GAAA,EAA8B;AAC1D,EAAA,OAAO,UAAU,GAAG,CAAA;AACtB;AAMA,SAAS,mBAAmB,KAAA,EAAwB;AAClD,EAAA,IAAI,KAAA,KAAU,MAAM,OAAO,MAAA;AAC3B,EAAA,IAAI,OAAO,KAAA,KAAU,WAAA,EAAa,OAAO,MAAA;AACzC,EAAA,IAAI,OAAO,KAAA,KAAU,QAAA,EAAU,OAAO,IAAA,CAAK,UAAU,KAAK,CAAA;AAC1D,EAAA,IAAI,OAAO,UAAU,QAAA,EAAU;AAC7B,IAAA,OAAO,OAAO,QAAA,CAAS,KAAK,CAAA,GAAI,MAAA,CAAO,KAAK,CAAA,GAAI,MAAA;AAAA,EAClD;AACA,EAAA,IAAI,OAAO,KAAA,KAAU,SAAA,EAAW,OAAO,OAAO,KAAK,CAAA;AACnD,EAAA,IAAI,OAAO,KAAA,KAAU,QAAA,EAAU,OAAO,OAAO,KAAK,CAAA;AAClD,EAAA,IAAI,KAAA,CAAM,OAAA,CAAQ,KAAK,CAAA,EAAG;AACxB,IAAA,OAAO,MAAM,KAAA,CAAM,GAAA,CAAI,kBAAkB,CAAA,CAAE,IAAA,CAAK,GAAG,CAAA,GAAI,GAAA;AAAA,EACzD;AACA,EAAA,IAAI,iBAAiB,UAAA,EAAY;AAC/B,IAAA,OAAO,IAAA,CAAK,SAAA,CAAU,eAAA,CAAgB,KAAK,CAAC,CAAA;AAAA,EAC9C;AACA,EAAA,IAAI,OAAO,UAAU,QAAA,EAAU;AAC7B,IAAA,MAAM,GAAA,GAAM,KAAA;AACZ,IAAA,MAAM,IAAA,GAAO,MAAA,CAAO,IAAA,CAAK,GAAG,EAAE,IAAA,EAAK;AACnC,IAAA,OACE,MAAM,IAAA,CAAK,GAAA,CAAI,CAAC,CAAA,KAAM,IAAA,CAAK,UAAU,CAAC,CAAA,GAAI,GAAA,GAAM,kBAAA,CAAmB,IAAI,CAAC,CAAC,CAAC,CAAA,CAAE,IAAA,CAAK,GAAG,CAAA,GAAI,GAAA;AAAA,EAE5F;AACA,EAAA,OAAO,MAAA;AACT;AAOA,SAAS,aAAA,CAAc,OAAmB,OAAA,EAAyB;AACjE,EAAA,IAAI,OAAA,IAAW,GAAG,OAAO,EAAA;AACzB,EAAA,IAAI,MAAM,MAAA,IAAU,OAAA,EAAS,OAAO,YAAA,CAAa,OAAO,KAAK,CAAA;AAE7D,EAAA,IAAI,GAAA,GAAM,OAAA;AAGV,EAAA,OAAO,MAAM,CAAA,IAAA,CAAM,KAAA,CAAM,GAAG,CAAA,GAAI,SAAU,GAAA,EAAM;AAC9C,IAAA,GAAA,IAAO,CAAA;AAAA,EACT;AACA,EAAA,OAAO,aAAa,MAAA,CAAO,KAAA,CAAM,QAAA,CAAS,CAAA,EAAG,GAAG,CAAC,CAAA;AACnD;;;AClKA,IAAM,eAAA,GAAkB,GAAA;AACxB,IAAM,cAAA,GAAiB,GAAA;AACvB,IAAM,YAAA,GAAe,CAAA,GAAI,EAAA,GAAK,EAAA,GAAK,EAAA,GAAK,GAAA;AACxC,IAAM,iBAAA,GAAoB,GAAA;AAE1B,IAAM,aAAiC,EAAC;AACxC,IAAM,oBAAA,uBAA+C,GAAA,EAAI;AAuBlD,SAAS,gBAAgB,OAAA,EAAwC;AACtE,EAAA,IAAI,OAAA,EAAS,SAAA,EAAW,UAAA,KAAe,IAAA,EAAM,OAAO,IAAA;AACpD,EAAA,OAAO,WAAA,EAAY;AACrB;AAEA,SAAS,WAAA,GAAuB;AAC9B,EAAA,IAAI,OAAO,OAAA,KAAY,WAAA,IAAe,OAAA,KAAY,MAAM,OAAO,KAAA;AAC/D,EAAA,MAAM,MAAO,OAAA,CAAyD,GAAA;AACtE,EAAA,OAAO,KAAK,yBAAA,KAA8B,GAAA;AAC5C;AAyCO,SAAS,eAAkB,IAAA,EAAmC;AAEnE,EAAA,UAAA,CAAW,MAAM;AAEf,IAAA,MAAM,IAAA,GAAO,cAAc,IAAI,CAAA;AAC/B,IAAA,oBAAA,CAAqB,IAAI,IAAI,CAAA;AAO7B,IAAA,MAAM,oBAAoB,MAAY;AACpC,MAAA,oBAAA,CAAqB,OAAO,IAAI,CAAA;AAAA,IAClC,CAAA;AACA,IAAA,KAAK,IAAA,CAAK,IAAA,CAAK,iBAAA,EAAmB,iBAAiB,CAAA;AAAA,EACrD,GAAG,CAAC,CAAA;AACN;AAEA,eAAe,cAAiB,IAAA,EAA4C;AAC1E,EAAA,MAAM,aAAA,GAAgB,MAAM,OAAA,CAAQ,IAAA,CAAK,SAAS,CAAA;AAClD,EAAA,IAAI,YAAA;AACJ,EAAA,IAAI,eAAA;AAEJ,EAAA,IAAI;AACF,IAAA,YAAA,GAAe,MAAM,cAAA,CAAe,IAAA,CAAK,QAAA,EAAU,iBAAiB,CAAA;AAAA,EACtE,SAAS,GAAA,EAAK;AACZ,IAAA,eAAA,GAAkB,iBAAiB,GAAG,CAAA;AACtC,IAAA,gBAAA,CAAiB;AAAA,MACf,IAAA,EAAM,eAAA,KAAoB,gBAAA,GAAmB,aAAA,GAAgB,cAAA;AAAA,MAC7D,MAAM,IAAA,CAAK,IAAA;AAAA,MACX,aAAA;AAAA,MACA,aAAA,EAAe,KAAK,SAAA,EAAW,IAAA;AAAA,MAC/B,eAAA;AAAA,MACA,KAAA,EAAO,UAAA,CAAW,CAAA,aAAA,EAAgB,eAAe,IAAI,cAAc,CAAA;AAAA,MACnE,SAAA,EAAA,iBAAW,IAAI,IAAA,EAAK,EAAE,WAAA;AAAY,KACnC,CAAA;AACD,IAAA;AAAA,EACF;AAEA,EAAA,MAAM,UAAA,GAAa,MAAM,cAAA,CAAe,IAAA,EAAM,cAAc,aAAa,CAAA;AACzE,EAAA,IAAI,UAAA,mBAA6B,UAAU,CAAA;AAC7C;AAMA,SAAS,cAAA,CAAkB,IAA0C,EAAA,EAAwB;AAC3F,EAAA,MAAM,UAAA,GAAa,IAAI,eAAA,EAAgB;AACvC,EAAA,OAAO,IAAI,OAAA,CAAQ,CAAC,OAAA,EAAS,MAAA,KAAW;AACtC,IAAA,MAAM,KAAA,GAAQ,WAAW,MAAM;AAC7B,MAAA,UAAA,CAAW,KAAA,EAAM;AACjB,MAAA,MAAA,CAAO,IAAI,KAAA,CAAM,gBAAgB,CAAC,CAAA;AAAA,IACpC,GAAG,EAAE,CAAA;AACL,IAAA,EAAA,CAAG,UAAA,CAAW,MAAM,CAAA,CAAE,IAAA;AAAA,MACpB,CAAC,CAAA,KAAM;AACL,QAAA,YAAA,CAAa,KAAK,CAAA;AAClB,QAAA,OAAA,CAAQ,CAAC,CAAA;AAAA,MACX,CAAA;AAAA,MACA,CAAC,CAAA,KAAM;AACL,QAAA,YAAA,CAAa,KAAK,CAAA;AAClB,QAAA,MAAA,CAAO,CAAC,CAAA;AAAA,MACV;AAAA,KACF;AAAA,EACF,CAAC,CAAA;AACH;AAEA,eAAe,cAAA,CACb,IAAA,EACA,YAAA,EACA,aAAA,EACkC;AAClC,EAAA,MAAM,EAAA,GAAA,iBAAK,IAAI,IAAA,EAAK,EAAE,WAAA,EAAY;AAGlC,EAAA,IAAI,CAAC,IAAA,CAAK,SAAA,IAAa,iBAAiB,MAAA,IAAa,IAAA,CAAK,eAAe,MAAA,EAAW;AAClF,IAAA,MAAM,QAAA,GAAW,MAAM,eAAA,CAAgB,IAAA,CAAK,UAAU,CAAA;AACtD,IAAA,MAAM,UAAA,GAAa,MAAM,eAAA,CAAgB,YAAY,CAAA;AACrD,IAAA,IAAI,aAAa,UAAA,EAAY;AAC3B,MAAA,OAAO;AAAA,QACL,IAAA,EAAM,kBAAA;AAAA,QACN,MAAM,IAAA,CAAK,IAAA;AAAA,QACX,aAAA;AAAA,QACA,cAAA,EAAgB,QAAA;AAAA,QAChB,gBAAA,EAAkB,UAAA;AAAA,QAClB,WAAA,EAAa,SAAA,CAAU,IAAA,CAAK,UAAU,CAAA;AAAA,QACtC,aAAA,EAAe,UAAU,YAAY,CAAA;AAAA,QACrC,KAAA,EAAO,yBAAA;AAAA,QACP,SAAA,EAAW;AAAA,OACb;AAAA,IACF;AACA,IAAA,OAAO,IAAA;AAAA,EACT;AAGA,EAAA,IAAI,IAAA,CAAK,SAAA,IAAa,YAAA,KAAiB,MAAA,EAAW;AAChD,IAAA,OAAO,IAAA;AAAA,EACT;AAGA,EAAA,OAAO;AAAA,IACL,IAAA,EAAM,iBAAA;AAAA,IACN,MAAM,IAAA,CAAK,IAAA;AAAA,IACX,aAAA;AAAA,IACA,aAAA,EAAe,KAAK,SAAA,EAAW,IAAA;AAAA,IAC/B,KAAA,EAAO,IAAA,CAAK,SAAA,GAAY,+BAAA,GAAkC,+BAAA;AAAA,IAC1D,SAAA,EAAW;AAAA,GACb;AACF;AAEA,SAAS,UAAU,KAAA,EAAwB;AACzC,EAAA,IAAI,OAAO,KAAA,KAAU,QAAA,EAAU,OAAO,eAAe,KAAK,CAAA;AAC1D,EAAA,IAAI,KAAA,YAAiB,UAAA,EAAY,OAAO,KAAA,CAAM,UAAA;AAC9C,EAAA,OAAO,cAAA,CAAe,IAAA,CAAK,SAAA,CAAU,KAAK,KAAK,EAAE,CAAA;AACnD;AAEA,SAAS,iBAAiB,GAAA,EAAsB;AAC9C,EAAA,IAAI,GAAA,IAAO,OAAO,GAAA,KAAQ,QAAA,EAAU;AAClC,IAAA,MAAM,YAAa,GAAA,CAA8C,IAAA;AACjE,IAAA,IAAI,OAAO,SAAA,KAAc,QAAA,IAAY,SAAA,CAAU,MAAA,GAAS,GAAG,OAAO,SAAA;AAClE,IAAA,MAAM,UAAW,GAAA,CAA8B,OAAA;AAC/C,IAAA,IAAI,OAAO,OAAA,KAAY,QAAA,IAAY,qBAAqB,IAAA,CAAK,OAAO,GAAG,OAAO,OAAA;AAAA,EAChF;AACA,EAAA,OAAO,sBAAA;AACT;AAEA,SAAS,iBAAiB,CAAA,EAA2B;AACnD,EAAA,UAAA,EAAW;AACX,EAAA,IAAI,UAAA,CAAW,MAAA,IAAU,eAAA,EAAiB,UAAA,CAAW,KAAA,EAAM;AAC3D,EAAA,UAAA,CAAW,KAAK,CAAC,CAAA;AACnB;AAEA,SAAS,UAAA,GAAmB;AAC1B,EAAA,MAAM,SAAA,GAAY,IAAI,IAAA,CAAK,IAAA,CAAK,KAAI,GAAI,YAAY,EAAE,WAAA,EAAY;AAClE,EAAA,OAAO,UAAA,CAAW,SAAS,CAAA,IAAK,UAAA,CAAW,CAAC,CAAA,CAAE,SAAA,GAAY,SAAA,EAAW,UAAA,CAAW,KAAA,EAAM;AACxF;;;AC3NO,SAAS,mBAAmB,OAAA,EAAsC;AACvE,EAAA,IAAI,OAAA,EAAS,SAAA,EAAW,UAAA,KAAe,IAAA,EAAM,OAAO,IAAA;AACpD,EAAA,IAAI,OAAO,OAAA,KAAY,WAAA,IAAe,OAAA,KAAY,MAAM,OAAO,KAAA;AAC/D,EAAA,MAAM,MAAO,OAAA,CAAyD,GAAA;AACtE,EAAA,OAAO,KAAK,yBAAA,KAA8B,GAAA;AAC5C;;;ACUO,SAAS,uBAAA,GAA6C;AAC3D,EAAA,OAAO,cAAA;AACT;AASO,SAAS,qCACd,QAAA,EACmB;AACnB,EAAA,IAAI,CAAC,QAAA,IAAY,QAAA,CAAS,MAAA,KAAW,GAAG,OAAO,cAAA;AAC/C,EAAA,OAAO;AAAA,IACL,QAAA,EAAU,IAAA;AAAA,IACV,gBAAgB,EAAC;AAAA,IACjB,YAAA,EAAc,mBAAmB,QAAA,CAAS,GAAA,CAAI,CAAC,CAAA,KAAM,CAAA,CAAE,IAAI,CAAC;AAAA,GAC9D;AACF;AAUO,SAAS,6BAA6B,OAAA,EAAqD;AAChG,EAAA,OAAO;AAAA,IACL,UAAU,OAAA,CAAQ,QAAA;AAAA,IAClB,cAAA,EAAgB,mBAAmB,OAAA,CAAQ,UAAA,CAAW,IAAI,CAAC,CAAA,KAAM,CAAA,CAAE,IAAI,CAAC,CAAA;AAAA,IACxE,YAAA,EAAc,mBAAmB,OAAA,CAAQ,QAAA,CAAS,IAAI,CAAC,CAAA,KAAM,CAAA,CAAE,IAAI,CAAC;AAAA,GACtE;AACF;AAYO,SAAS,yCACd,OAAA,EACmB;AACnB,EAAA,OAAO;AAAA,IACL,UAAU,OAAA,CAAQ,QAAA;AAAA,IAClB,cAAA,EAAgB,mBAAmB,OAAA,CAAQ,UAAA,CAAW,IAAI,CAAC,CAAA,KAAM,CAAA,CAAE,IAAI,CAAC,CAAA;AAAA,IACxE,cAAc;AAAC,GACjB;AACF;AAEA,IAAM,cAAA,GAAoC,OAAO,MAAA,CAAO;AAAA,EACtD,QAAA,EAAU,IAAA;AAAA,EACV,cAAA,EAAgB,MAAA,CAAO,MAAA,CAAO,EAAE,CAAA;AAAA,EAChC,YAAA,EAAc,MAAA,CAAO,MAAA,CAAO,EAAE;AAChC,CAAC,CAAA;AAED,SAAS,mBAAmB,KAAA,EAA6C;AACvE,EAAA,IAAI,KAAA,CAAM,MAAA,KAAW,CAAA,EAAG,OAAO,EAAC;AAChC,EAAA,OAAO,MAAM,IAAA,CAAK,IAAI,IAAI,KAAK,CAAC,EAAE,IAAA,EAAK;AACzC;AChFO,SAAS,iBAAA,CACd,IACA,KAAA,EACM;AACN,EAAA,IAAI,CAAC,EAAA,EAAI;AACT,EAAA,IAAI;AACF,IAAA,MAAM,MAAA,GAAS,GAAG,KAAK,CAAA;AAEvB,IAAA,IAAI,MAAA,IAAU,OAAQ,MAAA,CAAyB,KAAA,KAAU,UAAA,EAAY;AACnE,MAAC,MAAA,CAAyB,MAAM,MAAM;AAAA,MAAC,CAAC,CAAA;AAAA,IAC1C;AAAA,EACF,CAAA,CAAA,MAAQ;AAAA,EAER;AACF;AAQO,SAAS,YAAY,GAAA,EAAqB;AAC/C,EAAA,MAAM,IAAA,GAAO,WAAW,QAAQ,CAAA,CAAE,OAAO,GAAG,CAAA,CAAE,OAAO,KAAK,CAAA;AAC1D,EAAA,OAAO,CAAA,OAAA,EAAU,IAAA,CAAK,KAAA,CAAM,CAAA,EAAG,EAAE,CAAC,CAAA,CAAA;AACpC;;;ACuFO,IAAM,UAAA,GAAN,cAAyB,KAAA,CAAM;AAAA;AAAA,EAE3B,SAAA;AAAA,EAET,YAAY,SAAA,EAAsB;AAChC,IAAA,MAAM,UAAU,SAAA,CAAU,OAAA;AAC1B,IAAA,KAAA,CAAM,OAAA,EAAS,OAAA,IAAW,SAAA,CAAU,IAAI,CAAA;AACxC,IAAA,IAAA,CAAK,IAAA,GAAO,YAAA;AACZ,IAAA,IAAA,CAAK,SAAA,GAAY,SAAA;AAAA,EACnB;AACF;AAcA,IAAM,wBAAA,GAAmD;AAAA,EACvD,sBAAA,EAAwB,mBAAA;AAAA,EACxB,2BAAA,EAA6B,wBAAA;AAAA,EAC7B,gCAAA,EAAkC,6BAAA;AAAA,EAClC,kCAAA,EAAoC;AACtC,CAAA;AAEA,SAAS,0BAA0B,GAAA,EAA8B;AAC/D,EAAA,MAAM,IAAA,GAAO,wBAAA,CAAyB,GAAA,CAAI,IAAI,CAAA,IAAK,kBAAA;AACnD,EAAA,MAAM,UAAA,GAAa,IAAI,UAAA,CAAW;AAAA,IAChC,IAAA;AAAA,IACA,QAAA,EAAU,YAAA;AAAA,IACV,QAAA,EAAU,OAAA;AAAA,IACV,SAAA,EAAW,KAAA;AAAA,IACX,WAAA,EAAa,GAAA;AAAA,IACb,OAAA,EAAS,EAAE,OAAA,EAAS,GAAA,CAAI,OAAA;AAAQ,GACpB,CAAA;AAEd,EAAC,WAAmC,KAAA,GAAQ,GAAA;AAC5C,EAAA,OAAO,UAAA;AACT;AAaA,eAAsB,YAAY,OAAA,EAAmD;AAEnF,EAAA,IAAI,CAAC,OAAA,CAAQ,GAAA,CAAI,UAAA,CAAW,UAAU,CAAA,EAAG;AACvC,IAAA,MAAM,IAAI,MAAM,qCAAqC,CAAA;AAAA,EACvD;AACA,EAAA,IAAI,CAAC,OAAA,CAAQ,GAAA,CAAI,UAAA,CAAW,UAAU,CAAA,EAAG;AACvC,IAAA,MAAM,IAAI,MAAM,uCAAuC,CAAA;AAAA,EACzD;AACA,EAAA,IAAI,QAAQ,OAAA,IAAW,CAAC,QAAQ,OAAA,CAAQ,UAAA,CAAW,UAAU,CAAA,EAAG;AAC9D,IAAA,MAAM,IAAI,MAAM,sCAAsC,CAAA;AAAA,EACxD;AAGA,EAAA,IAAI,CAAC,YAAA,CAAa,IAAA,CAAK,OAAA,CAAQ,GAAG,CAAA,EAAG;AACnC,IAAA,MAAM,IAAI,MAAM,iDAAiD,CAAA;AAAA,EACnE;AAGA,EAAA,IAAI,CAAC,OAAO,SAAA,CAAU,OAAA,CAAQ,GAAG,CAAA,IAAK,OAAA,CAAQ,MAAM,CAAA,EAAG;AACrD,IAAA,MAAM,IAAI,MAAM,uCAAuC,CAAA;AAAA,EACzD;AAGA,EAAA,IAAI,OAAA,CAAQ,QAAQ,MAAA,EAAW;AAC7B,IAAA,IAAI,CAAC,OAAO,SAAA,CAAU,OAAA,CAAQ,GAAG,CAAA,IAAK,OAAA,CAAQ,MAAM,CAAA,EAAG;AACrD,MAAA,MAAM,IAAI,MAAM,uCAAuC,CAAA;AAAA,IACzD;AAAA,EACF;AAGA,EAAA,IAAI,eAAA;AACJ,EAAA,IAAI,OAAA,CAAQ,YAAY,MAAA,EAAW;AAEjC,IAAA,MAAM,WAAA,GAAc,KAAA,CAAM,OAAA,CAAQ,OAAA,CAAQ,OAAO,IAAI,OAAA,CAAQ,OAAA,GAAU,CAAC,OAAA,CAAQ,OAAO,CAAA;AAGvF,IAAA,MAAM,gBAA0B,EAAC;AACjC,IAAA,KAAA,MAAW,SAAS,WAAA,EAAa;AAC/B,MAAA,IAAI,CAAC,mBAAA,CAAoB,KAAK,CAAA,EAAG;AAC/B,QAAA,aAAA,CAAc,KAAK,KAAK,CAAA;AAAA,MAC1B;AAAA,IACF;AACA,IAAA,IAAI,aAAA,CAAc,SAAS,CAAA,EAAG;AAC5B,MAAA,MAAM,IAAI,KAAA,CAAM,CAAA,wBAAA,EAA2B,cAAc,IAAA,CAAK,IAAI,CAAC,CAAA,CAAE,CAAA;AAAA,IACvE;AAGA,IAAA,IAAI,WAAA,CAAY,QAAA,CAAS,YAAY,CAAA,EAAG;AACtC,MAAA,MAAM,IAAI,MAAM,oEAAoE,CAAA;AAAA,IACtF;AAEA,IAAA,eAAA,GAAkB,WAAA;AAAA,EACpB;AAGA,EAAA,IAAI,OAAA,CAAQ,qBAAqB,MAAA,EAAW;AAC1C,IAAA,IAAI,CAAC,kBAAA,CAAmB,OAAA,CAAQ,gBAAgB,CAAA,EAAG;AACjD,MAAA,MAAM,IAAI,KAAA;AAAA,QACR,CAAA,mDAAA,EAAsD,QAAQ,gBAAgB,CAAA;AAAA,OAChF;AAAA,IACF;AAAA,EACF;AAGA,EAAA,IAAI,OAAA,CAAQ,mBAAmB,MAAA,EAAW;AACxC,IAAA,IAAI,CAAC,oBAAA,CAAqB,OAAA,CAAQ,cAAc,CAAA,EAAG;AACjD,MAAA,MAAM,IAAI,KAAA,CAAM,CAAA,wBAAA,EAA2B,OAAA,CAAQ,cAAc,CAAA,CAAE,CAAA;AAAA,IACrE;AAAA,EACF;AAGA,EAAA,IAAI,OAAA,CAAQ,qBAAqB,MAAA,EAAW;AAC1C,IAAA,IAAI,CAAC,sBAAA,CAAuB,OAAA,CAAQ,gBAAgB,CAAA,EAAG;AACrD,MAAA,MAAM,IAAI,UAAA;AAAA,QACR,kCAAkC,2CAA2C;AAAA,OAC/E;AAAA,IACF;AACA,IAAA,IAAI,CAAC,oBAAA,CAAqB,OAAA,CAAQ,gBAAgB,CAAA,EAAG;AAEnD,MAAA,MAAM,MAAM,OAAA,CAAQ,gBAAA;AACpB,MAAA,MAAM,YAAA,GAAe,GAAA,CAAI,eAAA,CAAgB,QAAA,CAAS,IAAI,OAAO,CAAA;AAC7D,MAAA,MAAM,aAAA,GAAgB,IAAI,GAAA,CAAI,GAAA,CAAI,eAAe,CAAA,CAAE,IAAA,KAAS,IAAI,eAAA,CAAgB,MAAA;AAChF,MAAA,MAAM,MAAA,GAAS,YAAA,GAAe,aAAA,GAAgB,aAAA,GAAgB,kBAAA,GAAqB,OAAA;AACnF,MAAA,MAAM,IAAI,UAAA,CAAW,6BAAA,CAA8B,MAAM,CAAC,CAAA;AAAA,IAC5D;AAAA,EACF;AAGA,EAAA,MAAM,MAAM,MAAA,EAAO;AAGnB,EAAA,MAAM,MAAM,IAAA,CAAK,KAAA,CAAM,IAAA,CAAK,GAAA,KAAQ,GAAI,CAAA;AAGxC,EAAA,MAAM,MAAA,GAA4B;AAAA,IAChC,KAAK,OAAA,CAAQ,GAAA;AAAA,IACb,KAAK,OAAA,CAAQ,GAAA;AAAA,IACb,GAAA;AAAA,IACA,GAAA;AAAA,IACA,KAAK,OAAA,CAAQ,GAAA;AAAA,IACb,KAAK,OAAA,CAAQ,GAAA;AAAA,IACb,OAAA,EAAS;AAAA,MACP,MAAM,OAAA,CAAQ,IAAA;AAAA,MACd,WAAW,OAAA,CAAQ,SAAA;AAAA,MACnB,QAAQ,OAAA,CAAQ,GAAA;AAAA,MAChB,UAAU,OAAA,CAAQ,GAAA;AAAA,MAClB,KAAA,EAAO,OAAA,CAAQ,KAAA,IAAS,OAAA,CAAQ,GAAA;AAAA;AAAA,MAChC,GAAA,EAAK,QAAQ,GAAA,IAAO,MAAA;AAAA;AAAA,MACpB,QAAA,EAAU,OAAA,CAAQ,QAAA,IAAY,EAAC;AAAA;AAAA,MAC/B,GAAI,OAAA,CAAQ,OAAA,IAAW,EAAE,OAAA,EAAS,QAAQ,OAAA,EAAQ;AAAA,MAClD,GAAI,OAAA,CAAQ,eAAA,IAAmB,EAAE,eAAA,EAAiB,QAAQ,eAAA,EAAgB;AAAA,MAC1E,GAAI,OAAA,CAAQ,eAAA,IAAmB,EAAE,eAAA,EAAiB,QAAQ,eAAA,EAAgB;AAAA,MAC1E,GAAI,OAAA,CAAQ,QAAA,IAAY,EAAE,QAAA,EAAU,QAAQ,QAAA;AAAS,KACvD;AAAA,IACA,GAAI,OAAA,CAAQ,GAAA,IAAO,EAAE,GAAA,EAAK,QAAQ,GAAA,EAAI;AAAA,IACtC,GAAI,QAAQ,OAAA,IAAW,EAAE,SAAS,EAAE,GAAA,EAAK,OAAA,CAAQ,OAAA,EAAQ,EAAE;AAAA;AAAA,IAE3D,GAAA,CAAK,OAAA,CAAQ,GAAA,IAAO,OAAA,CAAQ,gBAAA,KAAqB;AAAA,MAC/C,GAAA,EAAK;AAAA,QACH,GAAG,OAAA,CAAQ,GAAA;AAAA,QACX,GAAI,QAAQ,gBAAA,IAAoB;AAAA,UAC9B,CAAC,sBAAsB,GAAG,OAAA,CAAQ;AAAA;AACpC;AACF,KACF;AAAA;AAAA,IAEA,GAAI,eAAA,IAAmB,EAAE,gBAAA,EAAkB,eAAA,EAAgB;AAAA,IAC3D,GAAI,OAAA,CAAQ,gBAAA,IAAoB,EAAE,gBAAA,EAAkB,QAAQ,gBAAA,EAAiB;AAAA,IAC7E,GAAI,OAAA,CAAQ,cAAA,IAAkB,EAAE,cAAA,EAAgB,QAAQ,cAAA;AAAe,GACzE;AAGA,EAAA,MAAM,gBAAA,GAAmBC,0BAA0B,MAAM,CAAA;AACzD,EAAA,IAAI,CAAC,iBAAiB,KAAA,EAAO;AAC3B,IAAA,MAAM,IAAI,UAAA,CAAW,8BAAA,CAA+B,gBAAA,CAAiB,UAAU,CAAC,CAAA;AAAA,EAClF;AAGA,EAAA,IAAI;AACF,IAAA,aAAA,CAAc,MAAM,MAAM,CAAA;AAAA,EAC5B,SAAS,GAAA,EAAc;AACrB,IAAA,IAAI,eAAe,QAAA,EAAU;AAE3B,MAAA,MAAM,aAAA,GAAgB,IAAI,MAAA,CAAO,IAAA;AAAA,QAAK,CAACD,MAAAA,KACrCA,MAAAA,CAAM,IAAA,CAAK,IAAA,CAAK,CAAC,CAAA,KAAM,CAAA,KAAM,UAAA,IAAc,CAAA,KAAM,SAAS;AAAA,OAC5D;AACA,MAAA,IAAI,aAAA,IAAiB,aAAA,CAAc,IAAA,CAAK,QAAA,CAAS,UAAU,CAAA,EAAG;AAC5D,QAAA,MAAM,SAAA,GAAY,0BAAA;AAAA,UAChB,aAAA,CAAc,OAAA;AAAA,UACd,aAAA,CAAc;AAAA,SAChB;AACA,QAAA,MAAM,IAAI,WAAW,SAAS,CAAA;AAAA,MAChC;AAAA,IACF;AACA,IAAA,MAAM,GAAA;AAAA,EACR;AAIA,EAAA,MAAM,iBAAA,GAAoB,uBAAA,CAAwB,OAAA,CAAQ,gBAAgB,CAAA;AAG1E,EAAA,MAAM,SAAA,GAAY,YAAY,GAAA,EAAI;AAGlC,EAAA,MAAM,MAAM,MAAM,IAAA,CAAK,QAAQ,OAAA,CAAQ,UAAA,EAAY,QAAQ,GAAG,CAAA;AAG9D,EAAA,iBAAA,CAAkB,OAAA,CAAQ,WAAW,eAAA,EAAiB;AAAA,IACpD,WAAA,EAAa,YAAY,GAAG,CAAA;AAAA,IAC5B,QAAQ,OAAA,CAAQ,GAAA;AAAA,IAChB,KAAK,OAAA,CAAQ,GAAA;AAAA,IACb,UAAA,EAAY,WAAA,CAAY,GAAA,EAAI,GAAI;AAAA,GACjC,CAAA;AAED,EAAA,OAAO;AAAA,IACL,GAAA;AAAA,IACA,GAAI,iBAAA,IAAqB,EAAE,gBAAA,EAAkB,iBAAA;AAAkB,GACjE;AACF;AAUA,eAAsB,SAAS,OAAA,EAA8C;AAC3E,EAAA,MAAM,MAAA,GAAS,MAAM,WAAA,CAAY,OAAO,CAAA;AACxC,EAAA,OAAO,MAAA,CAAO,GAAA;AAChB;AAaA,eAAsB,MAAM,OAAA,EAAmD;AAC7E,EAAA,OAAO,YAAY,OAAO,CAAA;AAC5B;AAuFA,eAAsB,YAAY,OAAA,EAAmD;AAKnF,EAAA,MAAM,UAAA,GAAa,mBAAmB,OAAuC,CAAA;AAG7E,EAAA,IAAI,CAAC,cAAA,CAAe,OAAA,CAAQ,GAAG,CAAA,EAAG;AAChC,IAAA,MAAM,IAAI,UAAA,CAAW;AAAA,MACnB,IAAA,EAAM,qBAAA;AAAA,MACN,QAAA,EAAU,YAAA;AAAA,MACV,QAAA,EAAU,OAAA;AAAA,MACV,SAAA,EAAW,KAAA;AAAA,MACX,WAAA,EAAa,GAAA;AAAA,MACb,OAAA,EAAS;AAAA,QACP,OAAA,EAAS,CAAA,+BAAA,EAAkC,OAAA,CAAQ,GAAG,CAAA,sDAAA;AAAA;AACxD,KACY,CAAA;AAAA,EAChB;AAGA,EAAA,MAAM,GAAA,GAAM,OAAA,CAAQ,GAAA,IAAO,MAAA,EAAO;AAGlC,EAAA,MAAM,MAAM,IAAA,CAAK,KAAA,CAAM,IAAA,CAAK,GAAA,KAAQ,GAAI,CAAA;AAGxC,EAAA,MAAM,MAAA,GAAuB;AAAA,IAC3B,YAAA,EAAc,KAAA;AAAA,IACd,MAAM,OAAA,CAAQ,IAAA;AAAA,IACd,MAAM,OAAA,CAAQ,IAAA;AAAA,IACd,KAAK,OAAA,CAAQ,GAAA;AAAA,IACb,GAAA;AAAA,IACA,GAAA;AAAA,IACA,GAAI,OAAA,CAAQ,GAAA,KAAQ,UAAa,EAAE,GAAA,EAAK,QAAQ,GAAA,EAAI;AAAA,IACpD,GAAI,OAAA,CAAQ,OAAA,KAAY,UAAa,EAAE,OAAA,EAAS,QAAQ,OAAA,EAAQ;AAAA,IAChE,GAAI,OAAA,CAAQ,WAAA,KAAgB,UAAa,EAAE,WAAA,EAAa,QAAQ,WAAA,EAAY;AAAA,IAC5E,GAAI,OAAA,CAAQ,gBAAA,KAAqB,UAAa,EAAE,gBAAA,EAAkB,QAAQ,gBAAA,EAAiB;AAAA,IAC3F,GAAI,OAAA,CAAQ,MAAA,KAAW,UAAa,EAAE,MAAA,EAAQ,QAAQ,MAAA,EAAO;AAAA,IAC7D,GAAI,OAAA,CAAQ,UAAA,KAAe,UAAa,EAAE,UAAA,EAAY,QAAQ,UAAA;AAAW,GAC3E;AAMA,EAAA,IAAI,UAAA,EAAY;AACd,IAAA,MAAM,WAAA,GAAc,kBAAA,CAAmB,SAAA,CAAU,MAAM,CAAA;AACvD,IAAA,IAAI,CAAC,YAAY,OAAA,EAAS;AACxB,MAAA,MAAM,UAAA,GAAa,WAAA,CAAY,KAAA,CAAM,MAAA,CAAO,CAAC,CAAA;AAC7C,MAAA,MAAM,IAAI,UAAA,CAAW;AAAA,QACnB,IAAA,EAAM,kBAAA;AAAA,QACN,QAAA,EAAU,YAAA;AAAA,QACV,QAAA,EAAU,OAAA;AAAA,QACV,SAAA,EAAW,KAAA;AAAA,QACX,WAAA,EAAa,GAAA;AAAA,QACb,OAAA,EAAS;AAAA,UACP,OAAA,EAAS,CAAA,0CAAA,EAA6C,UAAA,EAAY,OAAA,IAAW,SAAS,CAAA;AAAA;AACxF,OACY,CAAA;AAAA,IAChB;AAAA,EACF,CAAA,MAAO;AACL,IAAA,MAAM,aAAa,wBAAA,CAAyB;AAAA,MAC1C,OAAA,EAAS,aAAA;AAAA,MACT,OAAA,EAAS;AAAA,KACV,CAAA;AACD,IAAA,IAAI,CAAC,WAAW,EAAA,EAAI;AAClB,MAAA,MAAM,IAAI,UAAA,CAAW;AAAA,QACnB,MAAM,UAAA,CAAW,IAAA;AAAA,QACjB,QAAA,EAAU,YAAA;AAAA,QACV,QAAA,EAAU,OAAA;AAAA,QACV,SAAA,EAAW,KAAA;AAAA,QACX,WAAA,EAAa,GAAA;AAAA,QACb,OAAA,EAAS,EAAE,OAAA,EAAS,UAAA,CAAW,OAAA;AAAQ,OAC3B,CAAA;AAAA,IAChB;AAAA,EACF;AASA,EAAA,IAAI,GAAA;AACJ,EAAA,IAAI;AACF,IAAA,GAAA,GAAM,MAAM,YAAA,CAAa,MAAA,CAAO,QAAQ,OAAA,CAAQ,UAAA,EAAY,QAAQ,GAAG,CAAA;AAAA,EACzE,SAAS,GAAA,EAAK;AACZ,IAAA,IAAI,eAAe,WAAA,EAAa;AAC9B,MAAA,MAAM,0BAA0B,GAAG,CAAA;AAAA,IACrC;AACA,IAAA,MAAM,GAAA;AAAA,EACR;AAOA,EAAA,IAAI,UAAA,IAAc,eAAA,CAAgB,OAAyC,CAAA,EAAG;AAC5E,IAAA,cAAA,CAAkC;AAAA,MAChC,IAAA,EAAM,OAAA;AAAA,MACN,YAAY,uBAAA,EAAwB;AAAA,MACpC,SAAA,EAAW,MAAA;AAAA,MACX,UAAU,YACR,wCAAA;AAAA,QACE,yBAAA,CAA0B;AAAA,UACxB,MAAA,EAAQ;AAAA,YACN,MAAM,MAAA,CAAO,IAAA;AAAA,YACb,MAAM,MAAA,CAAO,IAAA;AAAA,YACb,KAAK,MAAA,CAAO,GAAA;AAAA,YACZ,KAAK,MAAA,CAAO,GAAA;AAAA,YACZ,aAAa,MAAA,CAAO,WAAA;AAAA,YACpB,YAAY,MAAA,CAAO;AAAA,WACrB;AAAA,UACA,GAAA,EAAK;AAAA,SACN;AAAA,OACH;AAAA,MACF,SAAA,EAAW;AAAA,KACZ,CAAA;AAAA,EACH;AAEA,EAAA,OAAO,EAAE,GAAA,EAAI;AACf;AC7lBO,SAAS,kBAAkB,IAAA,EAAyC;AACzE,EAAA,IAAI,MAAA;AAEJ,EAAA,IAAI,OAAO,SAAS,QAAA,EAAU;AAC5B,IAAA,MAAM,QAAQ,IAAI,WAAA,EAAY,CAAE,MAAA,CAAO,IAAI,CAAA,CAAE,MAAA;AAC7C,IAAA,IAAI,QAAQ,4BAAA,EAA8B;AACxC,MAAA,MAAM,IAAI,KAAA,CAAM,CAAA,sBAAA,EAAyB,4BAA4B,CAAA,YAAA,EAAe,KAAK,CAAA,CAAA,CAAG,CAAA;AAAA,IAC9F;AAEA,IAAA,IAAI;AACF,MAAA,MAAA,GAAS,IAAA,CAAK,MAAM,IAAI,CAAA;AAAA,IAC1B,SAAS,GAAA,EAAK;AACZ,MAAA,MAAM,IAAI,KAAA,CAAM,iCAAA,EAAmC,EAAE,KAAA,EAAO,KAAK,CAAA;AAAA,IACnE;AAAA,EACF,CAAA,MAAO;AACL,IAAA,MAAA,GAAS,IAAA;AAAA,EACX;AAEA,EAAA,IAAI,OAAO,MAAA,KAAW,QAAA,IAAY,MAAA,KAAW,IAAA,EAAM;AACjD,IAAA,MAAM,IAAI,MAAM,iCAAiC,CAAA;AAAA,EACnD;AAEA,EAAA,MAAM,GAAA,GAAM,MAAA;AAGZ,EAAA,IAAI,OAAO,GAAA,CAAI,OAAA,KAAY,QAAA,IAAY,CAAC,IAAI,OAAA,EAAS;AACnD,IAAA,MAAM,IAAI,MAAM,iCAAiC,CAAA;AAAA,EACnD;AACA,EAAA,IAAI,OAAO,GAAA,CAAI,MAAA,KAAW,QAAA,IAAY,CAAC,IAAI,MAAA,EAAQ;AACjD,IAAA,MAAM,IAAI,MAAM,gCAAgC,CAAA;AAAA,EAClD;AACA,EAAA,IAAI,OAAO,GAAA,CAAI,QAAA,KAAa,QAAA,IAAY,CAAC,IAAI,QAAA,EAAU;AACrD,IAAA,MAAM,IAAI,MAAM,kCAAkC,CAAA;AAAA,EACpD;AAGA,EAAA,IAAI,CAAC,GAAA,CAAI,MAAA,CAAO,UAAA,CAAW,UAAU,CAAA,EAAG;AACtC,IAAA,MAAM,IAAI,MAAM,6BAA6B,CAAA;AAAA,EAC/C;AAIA,EAAA,IAAI;AACF,IAAA,IAAI,GAAA,CAAI,IAAI,QAAQ,CAAA;AAAA,EACtB,SAAS,GAAA,EAAK;AACZ,IAAA,MAAM,IAAI,KAAA,CAAM,8BAAA,EAAgC,EAAE,KAAA,EAAO,KAAK,CAAA;AAAA,EAChE;AAGA,EAAA,IAAI,GAAA,CAAI,oBAAoB,MAAA,EAAW;AACrC,IAAA,IAAI,OAAO,GAAA,CAAI,eAAA,KAAoB,QAAA,EAAU;AAC3C,MAAA,MAAM,IAAI,MAAM,kCAAkC,CAAA;AAAA,IACpD;AACA,IAAA,IAAI,CAAC,GAAA,CAAI,eAAA,CAAgB,UAAA,CAAW,UAAU,CAAA,EAAG;AAC/C,MAAA,MAAM,IAAI,MAAM,sCAAsC,CAAA;AAAA,IACxD;AAAA,EACF;AAEA,EAAA,IAAI,GAAA,CAAI,qBAAqB,MAAA,EAAW;AACtC,IAAA,IAAI,CAAC,KAAA,CAAM,OAAA,CAAQ,GAAA,CAAI,gBAAgB,CAAA,EAAG;AACxC,MAAA,MAAM,IAAI,MAAM,mCAAmC,CAAA;AAAA,IACrD;AAAA,EACF;AAEA,EAAA,IAAI,GAAA,CAAI,eAAe,MAAA,EAAW;AAChC,IAAA,IAAI,CAAC,KAAA,CAAM,OAAA,CAAQ,GAAA,CAAI,UAAU,CAAA,EAAG;AAClC,MAAA,MAAM,IAAI,MAAM,6BAA6B,CAAA;AAAA,IAC/C;AAAA,EACF;AAEA,EAAA,IAAI,GAAA,CAAI,kBAAkB,MAAA,EAAW;AACnC,IAAA,IAAI,CAAC,KAAA,CAAM,OAAA,CAAQ,GAAA,CAAI,aAAa,CAAA,EAAG;AACrC,MAAA,MAAM,IAAI,MAAM,gCAAgC,CAAA;AAAA,IAClD;AAAA,EACF;AAGA,EAAA,IAAI,WAAA;AACJ,EAAA,IAAI,GAAA,CAAI,iBAAiB,MAAA,EAAW;AAClC,IAAA,IAAI,CAAC,KAAA,CAAM,OAAA,CAAQ,GAAA,CAAI,YAAY,CAAA,EAAG;AACpC,MAAA,MAAM,IAAI,MAAM,+BAA+B,CAAA;AAAA,IACjD;AACA,IAAA,MAAM,MAAA,GAAS,mBAAA,CAAoB,GAAA,CAAI,YAAY,CAAA;AACnD,IAAA,IAAI,CAAC,OAAO,EAAA,EAAI;AACd,MAAA,MAAM,IAAI,KAAA,CAAM,CAAA,sBAAA,EAAyB,MAAA,CAAO,KAAK,CAAA,CAAE,CAAA;AAAA,IACzD;AACA,IAAA,WAAA,GAAc,MAAA,CAAO,KAAA;AAAA,EACvB;AAEA,EAAA,OAAO;AAAA,IACL,SAAS,GAAA,CAAI,OAAA;AAAA,IACb,QAAQ,GAAA,CAAI,MAAA;AAAA,IACZ,UAAU,GAAA,CAAI,QAAA;AAAA,IACd,iBAAiB,GAAA,CAAI,eAAA;AAAA,IACrB,kBAAkB,GAAA,CAAI,gBAAA;AAAA,IACtB,YAAY,GAAA,CAAI,UAAA;AAAA,IAChB,eAAe,GAAA,CAAI,aAAA;AAAA,IACnB,kBAAkB,GAAA,CAAI,gBAAA;AAAA,IACtB,YAAA,EAAc;AAAA,GAChB;AACF;AASA,eAAsB,kBAAkB,SAAA,EAA8C;AACpF,EAAA,IAAI,CAAC,SAAA,CAAU,UAAA,CAAW,UAAU,CAAA,EAAG;AACrC,IAAA,MAAM,IAAI,MAAM,6BAA6B,CAAA;AAAA,EAC/C;AAGA,EAAA,MAAM,OAAA,GAAU,SAAA,CAAU,OAAA,CAAQ,KAAA,EAAO,EAAE,CAAA;AAC3C,EAAA,MAAM,SAAA,GAAY,CAAA,EAAG,OAAO,CAAA,EAAG,uBAAuB,CAAA,CAAA;AAEtD,EAAA,IAAI;AACF,IAAA,MAAM,IAAA,GAAO,MAAM,KAAA,CAAM,SAAA,EAAW;AAAA,MAClC,OAAA,EAAS,EAAE,MAAA,EAAQ,kBAAA,EAAmB;AAAA,MACtC,MAAA,EAAQ,WAAA,CAAY,OAAA,CAAQ,GAAK;AAAA,KAClC,CAAA;AAED,IAAA,IAAI,CAAC,KAAK,EAAA,EAAI;AACZ,MAAA,MAAM,IAAI,KAAA,CAAM,CAAA,4BAAA,EAA+B,IAAA,CAAK,MAAM,CAAA,CAAE,CAAA;AAAA,IAC9D;AAEA,IAAA,MAAM,IAAA,GAAO,MAAM,IAAA,CAAK,IAAA,EAAK;AAC7B,IAAA,MAAM,MAAA,GAAS,kBAAkB,IAAI,CAAA;AAGrC,IAAA,MAAM,kBAAA,GAAqB,OAAA,CAAQ,OAAA,CAAQ,KAAA,EAAO,EAAE,CAAA;AACpD,IAAA,MAAM,gBAAA,GAAmB,MAAA,CAAO,MAAA,CAAO,OAAA,CAAQ,OAAO,EAAE,CAAA;AACxD,IAAA,IAAI,qBAAqB,kBAAA,EAAoB;AAC3C,MAAA,MAAM,IAAI,KAAA,CAAM,CAAA,0BAAA,EAA6B,kBAAkB,CAAA,MAAA,EAAS,gBAAgB,CAAA,CAAE,CAAA;AAAA,IAC5F;AAEA,IAAA,OAAO,MAAA;AAAA,EACT,SAAS,GAAA,EAAK;AACZ,IAAA,MAAM,IAAI,KAAA;AAAA,MACR,CAAA,mCAAA,EAAsC,SAAS,CAAA,EAAA,EAC7C,GAAA,YAAe,QAAQ,GAAA,CAAI,OAAA,GAAU,MAAA,CAAO,GAAG,CACjD,CAAA,CAAA;AAAA,MACA,EAAE,OAAO,GAAA;AAAI,KACf;AAAA,EACF;AACF;AASA,SAAS,aAAA,CAAc,MAAc,WAAA,EAA+B;AAClE,EAAA,IAAI,WAAA,EAAa,QAAA,CAAS,kBAAkB,CAAA,EAAG;AAC7C,IAAA,OAAO,IAAA;AAAA,EACT;AACA,EAAA,MAAM,SAAA,GAAY,IAAA,CAAK,SAAA,EAAU,CAAE,CAAC,CAAA;AACpC,EAAA,OAAO,SAAA,KAAc,GAAA;AACvB;AAUO,SAAS,mBAAA,CAAoB,MAAc,WAAA,EAA0C;AAC1F,EAAA,MAAM,QAAQ,IAAI,WAAA,EAAY,CAAE,MAAA,CAAO,IAAI,CAAA,CAAE,MAAA;AAC7C,EAAA,IAAI,QAAQ,qBAAA,EAAuB;AACjC,IAAA,MAAM,IAAI,KAAA,CAAM,CAAA,wBAAA,EAA2B,qBAAqB,CAAA,YAAA,EAAe,KAAK,CAAA,CAAA,CAAG,CAAA;AAAA,EACzF;AAEA,EAAA,IAAI,QAAA;AAEJ,EAAA,IAAI,aAAA,CAAc,IAAA,EAAM,WAAW,CAAA,EAAG;AAEpC,IAAA,IAAI;AACF,MAAA,QAAA,GAAW,IAAA,CAAK,MAAM,IAAI,CAAA;AAAA,IAC5B,SAAS,GAAA,EAAK;AACZ,MAAA,MAAM,IAAI,KAAA,CAAM,mCAAA,EAAqC,EAAE,KAAA,EAAO,KAAK,CAAA;AAAA,IACrE;AAAA,EACF,CAAA,MAAO;AAEL,IAAA,QAAA,GAAW,gBAAgB,IAAI,CAAA;AAAA,EACjC;AAGA,EAAA,IAAI,OAAO,QAAA,CAAS,OAAA,KAAY,QAAA,IAAY,CAAC,SAAS,OAAA,EAAS;AAC7D,IAAA,MAAM,IAAI,MAAM,iCAAiC,CAAA;AAAA,EACnD;AAGA,EAAA,IAAI,CAAC,QAAA,CAAS,OAAA,CAAQ,UAAA,CAAW,cAAc,CAAA,EAAG;AAChD,IAAA,MAAM,IAAI,KAAA;AAAA,MACR,CAAA,yBAAA,EAA4B,SAAS,OAAO,CAAA,2DAAA;AAAA,KAC9C;AAAA,EACF;AAEA,EAAA,IAAI,QAAA,CAAS,KAAA,KAAU,MAAA,IAAU,QAAA,CAAS,UAAU,aAAA,EAAe;AACjE,IAAA,MAAM,IAAI,MAAM,mEAAmE,CAAA;AAAA,EACrF;AAEA,EAAA,OAAO;AAAA,IACL,SAAS,QAAA,CAAS,OAAA;AAAA,IAClB,OAAO,QAAA,CAAS,KAAA;AAAA,IAChB,UAAU,QAAA,CAAS,QAAA;AAAA,IACnB,UAAU,QAAA,CAAS,QAAA;AAAA,IACnB,aAAa,QAAA,CAAS,WAAA;AAAA,IACtB,YAAY,QAAA,CAAS,UAAA;AAAA,IACrB,aAAa,QAAA,CAAS,WAAA;AAAA,IACtB,WAAW,QAAA,CAAS,SAAA;AAAA,IACpB,SAAS,QAAA,CAAS,OAAA;AAAA,IAClB,SAAS,QAAA,CAAS,OAAA;AAAA,IAClB,OAAO,QAAA,CAAS,KAAA;AAAA,IAChB,UAAU,QAAA,CAAS,QAAA;AAAA,IACnB,iBAAiB,QAAA,CAAS,eAAA;AAAA,IAC1B,kBAAkB,QAAA,CAAS;AAAA,GAC7B;AACF;AAMA,SAAS,gBAAgB,IAAA,EAAuC;AAC9D,EAAA,MAAM,KAAA,GAAQ,IAAA,CAAK,KAAA,CAAM,IAAI,CAAA;AAC7B,EAAA,MAAM,SAAkC,EAAC;AAIzC,EAAA,IAAI,IAAA,CAAK,QAAA,CAAS,KAAK,CAAA,EAAG;AACxB,IAAA,MAAM,IAAI,MAAM,iCAAiC,CAAA;AAAA,EACnD;AACA,EAAA,IAAI,KAAK,QAAA,CAAS,GAAG,KAAK,IAAA,CAAK,QAAA,CAAS,GAAG,CAAA,EAAG;AAC5C,IAAA,MAAM,IAAI,MAAM,0CAA0C,CAAA;AAAA,EAC5D;AACA,EAAA,IAAI,MAAA,CAAO,IAAA,CAAK,IAAI,CAAA,EAAG;AACrB,IAAA,MAAM,IAAI,MAAM,kCAAkC,CAAA;AAAA,EACpD;AAGA,EAAA,MAAM,aAAA,GAAgB,IAAA,CAAK,KAAA,CAAM,SAAS,CAAA;AAC1C,EAAA,IAAI,aAAA,IAAiB,aAAA,CAAc,MAAA,GAAS,CAAA,EAAG;AAC7C,IAAA,MAAM,IAAI,MAAM,oCAAoC,CAAA;AAAA,EACtD;AAEA,EAAA,KAAA,MAAW,QAAQ,KAAA,EAAO;AACxB,IAAA,MAAM,OAAA,GAAU,KAAK,IAAA,EAAK;AAG1B,IAAA,IAAI,CAAC,OAAA,IAAW,OAAA,CAAQ,WAAW,GAAG,CAAA,IAAK,YAAY,KAAA,EAAO;AAC5D,MAAA;AAAA,IACF;AAGA,IAAA,MAAM,UAAA,GAAa,OAAA,CAAQ,OAAA,CAAQ,GAAG,CAAA;AACtC,IAAA,IAAI,eAAe,EAAA,EAAI;AAEvB,IAAA,MAAM,MAAM,OAAA,CAAQ,KAAA,CAAM,CAAA,EAAG,UAAU,EAAE,IAAA,EAAK;AAC9C,IAAA,IAAI,QAAiB,OAAA,CAAQ,KAAA,CAAM,UAAA,GAAa,CAAC,EAAE,IAAA,EAAK;AAGxD,IAAA,IAAI,UAAU,EAAA,EAAI;AAChB,MAAA,KAAA,GAAQ,MAAA;AAAA,IACV,CAAA,MAAA,IAAW,OAAO,KAAA,KAAU,QAAA,EAAU;AAEpC,MAAA,IACG,KAAA,CAAM,UAAA,CAAW,GAAG,CAAA,IAAK,MAAM,QAAA,CAAS,GAAG,CAAA,IAC3C,KAAA,CAAM,WAAW,GAAG,CAAA,IAAK,KAAA,CAAM,QAAA,CAAS,GAAG,CAAA,EAC5C;AACA,QAAA,KAAA,GAAQ,KAAA,CAAM,KAAA,CAAM,CAAA,EAAG,EAAE,CAAA;AAAA,MAC3B,CAAA,MAAA,IAES,MAAM,UAAA,CAAW,GAAG,KAAK,KAAA,CAAM,QAAA,CAAS,GAAG,CAAA,EAAG;AACrD,QAAA,MAAM,KAAA,GAAQ,KAAA,CAAM,KAAA,CAAM,CAAA,EAAG,EAAE,CAAA;AAC/B,QAAA,KAAA,GAAQ,MACL,KAAA,CAAM,GAAG,CAAA,CACT,GAAA,CAAI,CAAC,CAAA,KAAM,CAAA,CAAE,IAAA,EAAM,EACnB,MAAA,CAAO,CAAC,CAAA,KAAM,CAAA,CAAE,SAAS,CAAC,CAAA;AAAA,MAC/B,CAAA,MAAA,IAES,iBAAA,CAAkB,IAAA,CAAK,KAAK,CAAA,EAAG;AACtC,QAAA,KAAA,GAAQ,WAAW,KAAK,CAAA;AAAA,MAC1B,CAAA,MAAA,IAES,UAAU,MAAA,EAAQ;AACzB,QAAA,KAAA,GAAQ,IAAA;AAAA,MACV,CAAA,MAAA,IAAW,UAAU,OAAA,EAAS;AAC5B,QAAA,KAAA,GAAQ,KAAA;AAAA,MACV;AAAA,IACF;AAEA,IAAA,IAAI,UAAU,MAAA,EAAW;AACvB,MAAA,MAAA,CAAO,GAAG,CAAA,GAAI,KAAA;AAAA,IAChB;AAAA,EACF;AAEA,EAAA,OAAO,MAAA;AACT;AASA,eAAsB,oBAAoB,OAAA,EAA8C;AACtF,EAAA,IAAI,CAAC,QAAQ,UAAA,CAAW,UAAU,KAAK,CAAC,OAAA,CAAQ,UAAA,CAAW,kBAAkB,CAAA,EAAG;AAC9E,IAAA,MAAM,IAAI,MAAM,2BAA2B,CAAA;AAAA,EAC7C;AAEA,EAAA,MAAM,cAAA,GAAiB,OAAA,CAAQ,OAAA,CAAQ,KAAA,EAAO,EAAE,CAAA;AAChD,EAAA,MAAM,UAAA,GAAa,CAAA,EAAG,cAAc,CAAA,EAAG,gBAAgB,CAAA,CAAA;AACvD,EAAA,MAAM,WAAA,GAAc,CAAA,EAAG,cAAc,CAAA,EAAG,yBAAyB,CAAA,CAAA;AAGjE,EAAA,IAAI;AACF,IAAA,MAAM,IAAA,GAAO,MAAM,KAAA,CAAM,UAAA,EAAY;AAAA,MACnC,OAAA,EAAS,EAAE,MAAA,EAAQ,8BAAA,EAA+B;AAAA,MAClD,MAAA,EAAQ,WAAA,CAAY,OAAA,CAAQ,GAAI;AAAA,KACjC,CAAA;AAED,IAAA,IAAI,KAAK,EAAA,EAAI;AACX,MAAA,MAAM,IAAA,GAAO,MAAM,IAAA,CAAK,IAAA,EAAK;AAC7B,MAAA,MAAM,WAAA,GAAc,IAAA,CAAK,OAAA,CAAQ,GAAA,CAAI,cAAc,CAAA,IAAK,KAAA,CAAA;AACxD,MAAA,OAAO,mBAAA,CAAoB,MAAM,WAAW,CAAA;AAAA,IAC9C;AAGA,IAAA,IAAI,IAAA,CAAK,WAAW,GAAA,EAAK;AACvB,MAAA,MAAM,YAAA,GAAe,MAAM,KAAA,CAAM,WAAA,EAAa;AAAA,QAC5C,OAAA,EAAS,EAAE,MAAA,EAAQ,8BAAA,EAA+B;AAAA,QAClD,MAAA,EAAQ,WAAA,CAAY,OAAA,CAAQ,GAAI;AAAA,OACjC,CAAA;AAED,MAAA,IAAI,aAAa,EAAA,EAAI;AACnB,QAAA,MAAM,IAAA,GAAO,MAAM,YAAA,CAAa,IAAA,EAAK;AACrC,QAAA,MAAM,WAAA,GAAc,YAAA,CAAa,OAAA,CAAQ,GAAA,CAAI,cAAc,CAAA,IAAK,KAAA,CAAA;AAChE,QAAA,OAAO,mBAAA,CAAoB,MAAM,WAAW,CAAA;AAAA,MAC9C;AAEA,MAAA,MAAM,IAAI,MAAM,2DAA2D,CAAA;AAAA,IAC7E;AAEA,IAAA,MAAM,IAAI,KAAA,CAAM,CAAA,8BAAA,EAAiC,IAAA,CAAK,MAAM,CAAA,CAAE,CAAA;AAAA,EAChE,SAAS,GAAA,EAAK;AACZ,IAAA,MAAM,IAAI,KAAA;AAAA,MACR,CAAA,qCAAA,EAAwC,OAAO,CAAA,EAAA,EAC7C,GAAA,YAAe,QAAQ,GAAA,CAAI,OAAA,GAAU,MAAA,CAAO,GAAG,CACjD,CAAA,CAAA;AAAA,MACA,EAAE,OAAO,GAAA;AAAI,KACf;AAAA,EACF;AACF;AAmBO,SAAS,eAAe,IAAA,EAA6B;AAC1D,EAAA,MAAM,QAAQ,IAAI,WAAA,EAAY,CAAE,MAAA,CAAO,IAAI,CAAA,CAAE,MAAA;AAC7C,EAAA,IAAI,QAAQ,GAAA,EAAM;AAChB,IAAA,MAAM,IAAI,KAAA,CAAM,CAAA,2CAAA,EAA8C,KAAK,CAAA,CAAA,CAAG,CAAA;AAAA,EACxE;AAEA,EAAA,MAAM,KAAA,GAAQ,IAAA,CAAK,IAAA,EAAK,CAAE,MAAM,IAAI,CAAA;AACpC,EAAA,IAAI,KAAA,CAAM,SAAS,EAAA,EAAI;AACrB,IAAA,MAAM,IAAI,KAAA,CAAM,CAAA,yCAAA,EAA4C,KAAA,CAAM,MAAM,CAAA,CAAA,CAAG,CAAA;AAAA,EAC7E;AAEA,EAAA,MAAM,YAAuC,EAAC;AAE9C,EAAA,KAAA,MAAW,QAAQ,KAAA,EAAO;AACxB,IAAA,MAAM,OAAA,GAAU,KAAK,IAAA,EAAK;AAC1B,IAAA,IAAI,CAAC,OAAA,IAAW,OAAA,CAAQ,UAAA,CAAW,GAAG,CAAA,EAAG;AACvC,MAAA;AAAA,IACF;AAEA,IAAA,IAAI,OAAA,CAAQ,QAAA,CAAS,GAAG,CAAA,EAAG;AACzB,MAAA,MAAM,CAAC,GAAA,EAAK,GAAG,UAAU,CAAA,GAAI,OAAA,CAAQ,MAAM,GAAG,CAAA;AAC9C,MAAA,MAAM,KAAA,GAAQ,UAAA,CAAW,IAAA,CAAK,GAAG,EAAE,IAAA,EAAK;AAExC,MAAA,QAAQ,GAAA,CAAI,MAAK;AAAG,QAClB,KAAK,SAAA;AACH,UAAA,SAAA,CAAU,OAAA,GAAU,KAAA;AACpB,UAAA;AAAA,QACF,KAAK,QAAA;AACH,UAAA,SAAA,CAAU,MAAA,GAAS,KAAA;AACnB,UAAA;AAAA,QACF,KAAK,QAAA;AACH,UAAA,SAAA,CAAU,eAAA,GAAkB,KAAA;AAC5B,UAAA;AAAA,QACF,KAAK,MAAA;AACH,UAAA,SAAA,CAAU,QAAA,GAAW,KAAA;AACrB,UAAA;AAAA,QACF,KAAK,UAAA;AACH,UAAA,SAAA,CAAU,gBAAA,GAAmB,KAAA;AAC7B,UAAA;AAAA;AACJ,IACF;AAAA,EACF;AAGA,EAAA,IAAI,CAAC,SAAA,CAAU,OAAA,EAAS,MAAM,IAAI,MAAM,iCAAiC,CAAA;AACzE,EAAA,IAAI,CAAC,SAAA,CAAU,MAAA,EAAQ,MAAM,IAAI,MAAM,gCAAgC,CAAA;AACvE,EAAA,IAAI,CAAC,SAAA,CAAU,eAAA,EAAiB,MAAM,IAAI,MAAM,gCAAgC,CAAA;AAChF,EAAA,IAAI,CAAC,SAAA,CAAU,QAAA,EAAU,MAAM,IAAI,MAAM,8BAA8B,CAAA;AAEvE,EAAA,OAAO,SAAA;AACT;AAgBA,eAAsB,eAAe,SAAA,EAA2C;AAC9E,EAAA,IAAI,CAAC,SAAA,CAAU,UAAA,CAAW,UAAU,CAAA,EAAG;AACrC,IAAA,MAAM,IAAI,MAAM,6BAA6B,CAAA;AAAA,EAC/C;AAEA,EAAA,MAAM,YAAA,GAAe,GAAG,SAAS,CAAA,qBAAA,CAAA;AAEjC,EAAA,IAAI;AACF,IAAA,MAAM,IAAA,GAAO,MAAM,KAAA,CAAM,YAAA,EAAc;AAAA,MACrC,OAAA,EAAS,EAAE,MAAA,EAAQ,YAAA,EAAa;AAAA,MAChC,MAAA,EAAQ,WAAA,CAAY,OAAA,CAAQ,GAAI;AAAA,KACjC,CAAA;AAED,IAAA,IAAI,CAAC,KAAK,EAAA,EAAI;AACZ,MAAA,MAAM,IAAI,KAAA,CAAM,CAAA,wBAAA,EAA2B,IAAA,CAAK,MAAM,CAAA,CAAE,CAAA;AAAA,IAC1D;AAEA,IAAA,MAAM,IAAA,GAAO,MAAM,IAAA,CAAK,IAAA,EAAK;AAC7B,IAAA,OAAO,eAAe,IAAI,CAAA;AAAA,EAC5B,SAAS,GAAA,EAAK;AACZ,IAAA,MAAM,IAAI,KAAA;AAAA,MACR,CAAA,+BAAA,EAAkC,SAAS,CAAA,EAAA,EACzC,GAAA,YAAe,QAAQ,GAAA,CAAI,OAAA,GAAU,MAAA,CAAO,GAAG,CACjD,CAAA,CAAA;AAAA,MACA,EAAE,OAAO,GAAA;AAAI,KACf;AAAA,EACF;AACF;;;AC1eA,IAAM,UAAA,GAAa,sBAAA;AACnB,IAAM,UAAA,GAAa,oBAAA;AAMnB,SAAS,UAAU,IAAA,EAA6B;AAC9C,EAAA,MAAM,KAAA,GAAQ,IAAA,CAAK,KAAA,CAAM,GAAG,CAAA;AAC5B,EAAA,IAAI,KAAA,CAAM,MAAA,KAAW,CAAA,EAAG,OAAO,IAAA;AAC/B,EAAA,IAAI,KAAA,GAAQ,CAAA;AACZ,EAAA,KAAA,MAAW,QAAQ,KAAA,EAAO;AACxB,IAAA,IAAI,CAAC,UAAA,CAAW,IAAA,CAAK,IAAI,GAAG,OAAO,IAAA;AACnC,IAAA,MAAM,KAAA,GAAQ,OAAO,IAAI,CAAA;AACzB,IAAA,IAAI,KAAA,GAAQ,KAAK,OAAO,IAAA;AACxB,IAAA,KAAA,GAAQ,QAAQ,GAAA,GAAM,KAAA;AAAA,EACxB;AACA,EAAA,OAAO,KAAA;AACT;AAEA,SAAS,YAAY,IAAA,EAA+B;AAClD,EAAA,IAAI,IAAA,KAAS,EAAA,EAAI,OAAO,EAAC;AACzB,EAAA,MAAM,SAAmB,EAAC;AAC1B,EAAA,KAAA,MAAW,KAAA,IAAS,IAAA,CAAK,KAAA,CAAM,GAAG,CAAA,EAAG;AACnC,IAAA,IAAI,CAAC,UAAA,CAAW,IAAA,CAAK,KAAK,GAAG,OAAO,IAAA;AACpC,IAAA,MAAA,CAAO,IAAA,CAAK,QAAA,CAAS,KAAA,EAAO,EAAE,CAAC,CAAA;AAAA,EACjC;AACA,EAAA,OAAO,MAAA;AACT;AAMA,SAAS,UAAU,IAAA,EAA+B;AAChD,EAAA,IAAI,KAAK,MAAA,KAAW,CAAA,IAAK,IAAA,CAAK,MAAA,GAAS,IAAI,OAAO,IAAA;AAClD,EAAA,IAAI,IAAA,GAAO,IAAA;AACX,EAAA,MAAM,SAAA,GAAY,IAAA,CAAK,WAAA,CAAY,GAAG,CAAA;AACtC,EAAA,IAAI,SAAA,KAAc,IAAI,OAAO,IAAA;AAC7B,EAAA,MAAM,IAAA,GAAO,IAAA,CAAK,KAAA,CAAM,SAAA,GAAY,CAAC,CAAA;AACrC,EAAA,IAAI,IAAA,CAAK,QAAA,CAAS,GAAG,CAAA,EAAG;AACtB,IAAA,MAAM,EAAA,GAAK,UAAU,IAAI,CAAA;AACzB,IAAA,IAAI,EAAA,KAAO,MAAM,OAAO,IAAA;AACxB,IAAA,IAAA,GAAO,CAAA,EAAG,KAAK,KAAA,CAAM,CAAA,EAAG,YAAY,CAAC,CAAC,GAAG,IAAA,CAAK,KAAA,CAAM,KAAK,KAAO,CAAA,CAAE,SAAS,EAAE,CAAC,KAAK,EAAA,GAAK,KAAA,EAAS,QAAA,CAAS,EAAE,CAAC,CAAA,CAAA;AAAA,EAC/G;AACA,EAAA,MAAM,MAAA,GAAS,IAAA,CAAK,KAAA,CAAM,IAAI,CAAA;AAC9B,EAAA,IAAI,MAAA,CAAO,MAAA,GAAS,CAAA,EAAG,OAAO,IAAA;AAC9B,EAAA,MAAM,IAAA,GAAO,WAAA,CAAY,MAAA,CAAO,CAAC,CAAC,CAAA;AAClC,EAAA,IAAI,IAAA,KAAS,MAAM,OAAO,IAAA;AAC1B,EAAA,IAAI,OAAO,MAAA,KAAW,CAAA,SAAU,IAAA,CAAK,MAAA,KAAW,IAAI,IAAA,GAAO,IAAA;AAC3D,EAAA,MAAM,IAAA,GAAO,WAAA,CAAY,MAAA,CAAO,CAAC,CAAC,CAAA;AAClC,EAAA,IAAI,IAAA,KAAS,MAAM,OAAO,IAAA;AAC1B,EAAA,MAAM,IAAA,GAAO,CAAA,GAAI,IAAA,CAAK,MAAA,GAAS,IAAA,CAAK,MAAA;AACpC,EAAA,IAAI,IAAA,GAAO,GAAG,OAAO,IAAA;AACrB,EAAA,OAAO,CAAC,GAAG,IAAA,EAAM,GAAG,IAAI,KAAA,CAAc,IAAI,CAAA,CAAE,IAAA,CAAK,CAAC,CAAA,EAAG,GAAG,IAAI,CAAA;AAC9D;AAKA,IAAM,WAAA,GAAoC;AAAA,EACxC,CAAC,SAAA,EAAW,CAAA,EAAG,YAAY,CAAA;AAAA,EAC3B,CAAC,UAAA,EAAY,CAAA,EAAG,YAAY,CAAA;AAAA,EAC5B,CAAC,YAAA,EAAc,EAAA,EAAI,YAAY,CAAA;AAAA,EAC/B,CAAC,WAAA,EAAa,CAAA,EAAG,UAAU,CAAA;AAAA,EAC3B,CAAC,aAAA,EAAe,EAAA,EAAI,YAAY,CAAA;AAAA,EAChC,CAAC,YAAA,EAAc,EAAA,EAAI,YAAY,CAAA;AAAA,EAC/B,CAAC,WAAA,EAAa,EAAA,EAAI,YAAY,CAAA;AAAA,EAC9B,CAAC,WAAA,EAAa,EAAA,EAAI,YAAY,CAAA;AAAA,EAC9B,CAAC,cAAA,EAAgB,EAAA,EAAI,YAAY,CAAA;AAAA,EACjC,CAAC,cAAA,EAAgB,EAAA,EAAI,YAAY,CAAA;AAAA,EACjC,CAAC,aAAA,EAAe,EAAA,EAAI,YAAY,CAAA;AAAA,EAChC,CAAC,aAAA,EAAe,EAAA,EAAI,YAAY,CAAA;AAAA,EAChC,CAAC,cAAA,EAAgB,EAAA,EAAI,YAAY,CAAA;AAAA,EACjC,CAAC,YAAA,EAAc,EAAA,EAAI,YAAY,CAAA;AAAA,EAC/B,CAAC,cAAA,EAAgB,EAAA,EAAI,YAAY,CAAA;AAAA,EACjC,CAAC,aAAA,EAAe,EAAA,EAAI,YAAY,CAAA;AAAA,EAChC,CAAC,WAAA,EAAa,CAAA,EAAG,YAAY,CAAA;AAAA,EAC7B,CAAC,WAAA,EAAa,CAAA,EAAG,YAAY;AAC/B,CAAA;AAEA,IAAM,gBAAA,GAAmB,YAAY,GAAA,CAAI,CAAC,CAAC,OAAA,EAAS,MAAA,EAAQ,MAAM,CAAA,KAAM;AACtE,EAAA,MAAM,IAAA,GAAO,UAAU,OAAO,CAAA;AAC9B,EAAA,MAAM,IAAA,GAAO,MAAM,EAAA,GAAK,MAAA,CAAA;AACxB,EAAA,OAAO,EAAE,KAAA,EAAO,IAAA,EAAM,KAAK,IAAA,GAAO,IAAA,GAAO,GAAG,MAAA,EAAO;AACrD,CAAC,CAAA;AAED,SAAS,aAAa,KAAA,EAA+B;AACnD,EAAA,KAAA,MAAW,SAAS,gBAAA,EAAkB;AACpC,IAAA,IAAI,KAAA,IAAS,KAAA,CAAM,KAAA,IAAS,KAAA,IAAS,MAAM,GAAA,EAAK;AAC9C,MAAA,OAAO,EAAE,OAAA,EAAS,KAAA,EAAO,MAAA,EAAQ,MAAM,MAAA,EAAO;AAAA,IAChD;AAAA,EACF;AACA,EAAA,OAAO,EAAE,SAAS,IAAA,EAAK;AACzB;AAEA,SAAS,aAAA,CACP,MAAA,EACA,OAAA,EACA,IAAA,EACS;AACT,EAAA,KAAA,IAAS,CAAA,GAAI,CAAA,EAAG,CAAA,GAAI,CAAA,EAAG,CAAA,EAAA,EAAK;AAC1B,IAAA,MAAM,QAAA,GAAW,IAAA,CAAK,GAAA,CAAI,EAAA,EAAI,IAAA,CAAK,IAAI,CAAA,EAAG,IAAA,GAAO,EAAA,GAAK,CAAC,CAAC,CAAA;AACxD,IAAA,IAAI,QAAA,KAAa,GAAG,OAAO,IAAA;AAC3B,IAAA,MAAM,IAAA,GAAQ,KAAA,IAAW,EAAA,GAAK,QAAA,GAAa,KAAA;AAC3C,IAAA,IAAA,CAAK,MAAA,CAAO,CAAC,CAAA,GAAI,IAAA,OAAW,QAAQ,CAAC,CAAA,GAAI,OAAO,OAAO,KAAA;AAAA,EACzD;AACA,EAAA,OAAO,IAAA;AACT;AAEA,SAAS,GAAG,IAAA,EAAwB;AAClC,EAAA,OAAO,UAAU,IAAI,CAAA;AACvB;AAEA,IAAM,iBAAA,GAAoB,GAAG,QAAQ,CAAA;AAGrC,IAAM,qBAAA,GAAoE;AAAA,EACxE,CAAC,EAAA,CAAG,QAAQ,CAAA,EAAG,EAAE,CAAA;AAAA,EACjB,CAAC,EAAA,CAAG,YAAY,CAAA,EAAG,EAAE,CAAA;AAAA,EACrB,CAAC,EAAA,CAAG,QAAQ,CAAA,EAAG,EAAE,CAAA;AAAA,EACjB,CAAC,EAAA,CAAG,gBAAgB,CAAA,EAAG,EAAE,CAAA;AAAA,EACzB,CAAC,EAAA,CAAG,QAAQ,CAAA,EAAG,EAAE;AACnB,CAAA;AAEA,IAAM,aAAA,GAAgB,GAAG,KAAK,CAAA;AAC9B,IAAM,eAAA,GAAkB,GAAG,QAAQ,CAAA;AACnC,IAAM,WAAA,GAAc,GAAG,YAAY,CAAA;AACnC,IAAM,gBAAA,GAAmB,GAAG,WAAW,CAAA;AAEvC,SAAS,aAAa,MAAA,EAA2C;AAC/D,EAAA,IAAI,aAAA,CAAc,QAAQ,WAAA,EAAa,EAAE,KAAK,aAAA,CAAc,MAAA,EAAQ,gBAAA,EAAkB,EAAE,CAAA,EAAG;AACzF,IAAA,OAAO,aAAa,MAAA,CAAO,CAAC,IAAI,KAAA,GAAU,MAAA,CAAO,CAAC,CAAC,CAAA;AAAA,EACrD;AACA,EAAA,IAAI,CAAC,aAAA,CAAc,MAAA,EAAQ,iBAAA,EAAmB,CAAC,CAAA,EAAG;AAChD,IAAA,IAAI,aAAA,CAAc,MAAA,EAAQ,aAAA,EAAe,GAAG,CAAA,SAAU,EAAE,OAAA,EAAS,KAAA,EAAO,MAAA,EAAQ,UAAA,EAAW;AAC3F,IAAA,IAAI,aAAA,CAAc,MAAA,EAAQ,eAAA,EAAiB,EAAE,CAAA,SAAU,EAAE,OAAA,EAAS,KAAA,EAAO,MAAA,EAAQ,YAAA,EAAa;AAC9F,IAAA,OAAO,EAAE,OAAA,EAAS,KAAA,EAAO,MAAA,EAAQ,YAAA,EAAa;AAAA,EAChD;AACA,EAAA,KAAA,MAAW,CAAC,OAAA,EAAS,IAAI,CAAA,IAAK,qBAAA,EAAuB;AACnD,IAAA,IAAI,aAAA,CAAc,MAAA,EAAQ,OAAA,EAAS,IAAI,CAAA,SAAU,EAAE,OAAA,EAAS,KAAA,EAAO,MAAA,EAAQ,YAAA,EAAa;AAAA,EAC1F;AACA,EAAA,OAAO,EAAE,SAAS,IAAA,EAAK;AACzB;AAKO,SAAS,gBAAgB,EAAA,EAA4B;AAC1D,EAAA,MAAM,EAAA,GAAK,UAAU,EAAE,CAAA;AACvB,EAAA,IAAI,EAAA,KAAO,IAAA,EAAM,OAAO,YAAA,CAAa,EAAE,CAAA;AACvC,EAAA,MAAM,MAAA,GAAS,UAAU,EAAE,CAAA;AAC3B,EAAA,IAAI,MAAA,KAAW,IAAA,EAAM,OAAO,YAAA,CAAa,MAAM,CAAA;AAC/C,EAAA,OAAO,EAAE,OAAA,EAAS,KAAA,EAAO,MAAA,EAAQ,YAAA,EAAa;AAChD;AAMO,SAAS,cAAc,QAAA,EAAiC;AAC7D,EAAA,IAAI,QAAA,CAAS,UAAA,CAAW,GAAG,CAAA,IAAK,QAAA,CAAS,QAAA,CAAS,GAAG,CAAA,EAAG,OAAO,QAAA,CAAS,KAAA,CAAM,CAAA,EAAG,EAAE,CAAA;AACnF,EAAA,IAAI,WAAA,CAAY,IAAA,CAAK,QAAQ,CAAA,EAAG,OAAO,QAAA;AACvC,EAAA,OAAO,IAAA;AACT;;;AClEA,IAAI,kBAAA,GAA8C,IAAA;AAkB3C,SAAS,mBAAA,GAAwC;AACtD,EAAA,IAAI,kBAAA,EAAoB;AACtB,IAAA,OAAO,kBAAA;AAAA,EACT;AAEA,EAAA,kBAAA,GAAqB,kBAAA,EAAmB;AACxC,EAAA,OAAO,kBAAA;AACT;AAKA,SAAS,kBAAA,GAAuC;AAE9C,EAAA,IAAI,OAAO,OAAA,KAAY,WAAA,IAAe,OAAA,CAAQ,UAAU,IAAA,EAAM;AAC5D,IAAA,OAAO;AAAA,MACL,OAAA,EAAS,MAAA;AAAA,MACT,gBAAA,EAAkB,IAAA;AAAA,MAClB,UAAA,EAAY,IAAA;AAAA,MACZ,gBAAA,EAAkB,KAAA;AAAA,MAClB,eAAA,EAAiB,MAAA;AAAA,MACjB,KAAA,EAAO;AAAA,QACL,wDAAA;AAAA,QACA,yDAAA;AAAA,QACA;AAAA;AACF,KACF;AAAA,EACF;AAGA,EAAA,IAAI,OAAO,OAAA,KAAY,WAAA,IAAe,OAAA,CAAQ,UAAU,GAAA,EAAK;AAC3D,IAAA,OAAO;AAAA,MACL,OAAA,EAAS,KAAA;AAAA,MACT,gBAAA,EAAkB,IAAA;AAAA,MAClB,UAAA,EAAY,IAAA;AAAA,MACZ,gBAAA,EAAkB,KAAA;AAAA,MAClB,eAAA,EAAiB,MAAA;AAAA,MACjB,KAAA,EAAO;AAAA,QACL,0DAAA;AAAA,QACA;AAAA;AACF,KACF;AAAA,EACF;AAGA,EAAA,IAAI,OAAO,UAAA,KAAe,WAAA,IAAe,MAAA,IAAU,UAAA,EAAY;AAC7D,IAAA,OAAO;AAAA,MACL,OAAA,EAAS,MAAA;AAAA,MACT,gBAAA,EAAkB,KAAA;AAAA,MAClB,UAAA,EAAY,KAAA;AAAA,MACZ,gBAAA,EAAkB,KAAA;AAAA,MAClB,eAAA,EAAiB,SAAA;AAAA,MACjB,KAAA,EAAO;AAAA,QACL,qDAAA;AAAA,QACA,+DAAA;AAAA,QACA;AAAA;AACF,KACF;AAAA,EACF;AAGA,EAAA,IACE,OAAO,UAAA,KAAe,WAAA,IACtB,OAAQ,UAAA,CAAuC,WAAW,WAAA,IAC1D,OAAQ,UAAA,CAAuC,YAAA,KAAiB,WAAA,EAChE;AACA,IAAA,OAAO;AAAA,MACL,OAAA,EAAS,oBAAA;AAAA,MACT,gBAAA,EAAkB,KAAA;AAAA,MAClB,UAAA,EAAY,KAAA;AAAA,MACZ,gBAAA,EAAkB,IAAA;AAAA,MAClB,eAAA,EAAiB,SAAA;AAAA,MACjB,KAAA,EAAO;AAAA,QACL,oDAAA;AAAA,QACA,qDAAA;AAAA,QACA,6DAAA;AAAA,QACA;AAAA;AACF,KACF;AAAA,EACF;AAIA,EAAA,MAAM,CAAA,GAAI,UAAA;AACV,EAAA,IAAI,OAAO,CAAA,CAAE,MAAA,KAAW,eAAe,OAAO,CAAA,CAAE,aAAa,WAAA,EAAa;AACxE,IAAA,OAAO;AAAA,MACL,OAAA,EAAS,SAAA;AAAA,MACT,gBAAA,EAAkB,KAAA;AAAA,MAClB,UAAA,EAAY,KAAA;AAAA,MACZ,gBAAA,EAAkB,KAAA;AAAA,MAClB,eAAA,EAAiB,SAAA;AAAA,MACjB,KAAA,EAAO;AAAA,QACL,gEAAA;AAAA,QACA,kDAAA;AAAA,QACA,2DAAA;AAAA,QACA;AAAA;AACF,KACF;AAAA,EACF;AAGA,EAAA,OAAO;AAAA,IACL,OAAA,EAAS,cAAA;AAAA,IACT,gBAAA,EAAkB,KAAA;AAAA,IAClB,UAAA,EAAY,KAAA;AAAA,IACZ,gBAAA,EAAkB,KAAA;AAAA,IAClB,eAAA,EAAiB,SAAA;AAAA,IACjB,KAAA,EAAO;AAAA,MACL,gEAAA;AAAA,MACA,+DAAA;AAAA,MACA;AAAA;AACF,GACF;AACF;AAMO,SAAS,0BAAA,GAAmC;AACjD,EAAA,kBAAA,GAAqB,IAAA;AACvB;AAoFO,SAAS,YACd,EAAA,EAC0F;AAC1F,EAAA,MAAM,OAAA,GAAU,gBAAgB,EAAE,CAAA;AAClC,EAAA,OAAO,OAAA,CAAQ,OAAA,GAAU,EAAE,OAAA,EAAS,KAAA,EAAM,GAAI,EAAE,OAAA,EAAS,IAAA,EAAM,MAAA,EAAQ,OAAA,CAAQ,MAAA,EAAO;AACxF;AA8BA,eAAe,gBACb,QAAA,EACqD;AAErD,EAAA,MAAM,OAAA,GAAU,cAAc,QAAQ,CAAA;AACtC,EAAA,IAAI,YAAY,IAAA,EAAM;AACpB,IAAA,MAAM,cAAc,OAAO,OAAA,KAAY,eAAe,OAAA,CAAQ,OAAA,CAAQ,UAAU,IAAI,CAAA;AACpF,IAAA,OAAO,EAAE,IAAI,IAAA,EAAM,GAAA,EAAK,CAAC,OAAO,CAAA,EAAG,OAAA,EAAS,CAAC,WAAA,EAAY;AAAA,EAC3D;AAGA,EAAA,IAAI,OAAO,OAAA,KAAY,WAAA,IAAe,OAAA,CAAQ,UAAU,IAAA,EAAM;AAC5D,IAAA,IAAI;AACF,MAAA,MAAM,GAAA,GAAM,MAAM,OAAO,KAAK,CAAA;AAC9B,MAAA,MAAM,EAAE,SAAA,EAAU,GAAI,MAAM,OAAO,MAAM,CAAA;AACzC,MAAA,MAAM,QAAA,GAAW,SAAA,CAAU,GAAA,CAAI,QAAQ,CAAA;AACvC,MAAA,MAAM,QAAA,GAAW,SAAA,CAAU,GAAA,CAAI,QAAQ,CAAA;AAEvC,MAAA,MAAM,UAAoB,EAAC;AAC3B,MAAA,IAAI,SAAA,GAA0B,IAAA;AAC9B,MAAA,IAAI,SAAA,GAA0B,IAAA;AAE9B,MAAA,IAAI;AACF,QAAA,MAAM,IAAA,GAAO,MAAM,QAAA,CAAS,QAAQ,CAAA;AACpC,QAAA,OAAA,CAAQ,IAAA,CAAK,GAAG,IAAI,CAAA;AAAA,MACtB,SAAS,GAAA,EAAK;AACZ,QAAA,SAAA,GAAY,GAAA;AAAA,MACd;AAEA,MAAA,IAAI;AACF,QAAA,MAAM,IAAA,GAAO,MAAM,QAAA,CAAS,QAAQ,CAAA;AACpC,QAAA,OAAA,CAAQ,IAAA,CAAK,GAAG,IAAI,CAAA;AAAA,MACtB,SAAS,GAAA,EAAK;AACZ,QAAA,SAAA,GAAY,GAAA;AAAA,MACd;AAGA,MAAA,IAAI,OAAA,CAAQ,SAAS,CAAA,EAAG;AACtB,QAAA,OAAO,EAAE,EAAA,EAAI,IAAA,EAAM,GAAA,EAAK,OAAA,EAAS,SAAS,KAAA,EAAM;AAAA,MAClD;AAGA,MAAA,IAAI,aAAa,SAAA,EAAW;AAC1B,QAAA,OAAO;AAAA,UACL,EAAA,EAAI,KAAA;AAAA,UACJ,OAAA,EAAS,CAAA,0BAAA,EAA6B,QAAQ,CAAA,EAAA,EAAK,UAAU,OAAO,CAAA;AAAA,SACtE;AAAA,MACF;AAGA,MAAA,OAAO;AAAA,QACL,EAAA,EAAI,KAAA;AAAA,QACJ,OAAA,EAAS,4CAA4C,QAAQ,CAAA;AAAA,OAC/D;AAAA,IACF,SAAS,GAAA,EAAK;AAEZ,MAAA,OAAO;AAAA,QACL,EAAA,EAAI,KAAA;AAAA,QACJ,OAAA,EAAS,yBAAyB,GAAA,YAAe,KAAA,GAAQ,IAAI,OAAA,GAAU,MAAA,CAAO,GAAG,CAAC,CAAA;AAAA,OACpF;AAAA,IACF;AAAA,EACF;AAIA,EAAA,OAAO,EAAE,EAAA,EAAI,IAAA,EAAM,KAAK,EAAC,EAAG,SAAS,IAAA,EAAK;AAC5C;AAEA,IAAM,kBAAA,uBAAyB,GAAA,CAAI,CAAC,KAAK,GAAA,EAAK,GAAA,EAAK,GAAA,EAAK,GAAG,CAAC,CAAA;AAG5D,eAAe,YAAY,QAAA,EAAmC;AAC5D,EAAA,MAAM,QAAA,CAAS,MAAM,MAAA,EAAO;AAC9B;AASA,eAAe,wBAAA,CACb,GAAA,EACA,SAAA,EACA,OAAA,EACA,MAAA,EACmB;AACnB,EAAA,MAAM,KAAA,GAAQ,MAAM,OAAO,OAAO,CAAA;AAClC,EAAA,MAAM,EAAE,IAAA,EAAK,GAAI,MAAM,OAAO,KAAK,CAAA;AACnC,EAAA,MAAM,MAAA,GAAS,IAAI,GAAA,CAAI,GAAG,CAAA;AAC1B,EAAA,MAAM,IAAA,GAAO,aAAA,CAAc,MAAA,CAAO,QAAQ,KAAK,MAAA,CAAO,QAAA;AACtD,EAAA,IAAI,SAAA,CAAU,MAAA,KAAW,CAAA,IAAM,IAAA,CAAK,IAAI,CAAA,KAAM,CAAA,IAAK,CAAC,SAAA,CAAU,QAAA,CAAS,IAAI,CAAA,EAAI;AAC7E,IAAA,MAAM,IAAI,KAAA,CAAM,CAAA,uDAAA,EAA0D,IAAI,CAAA,CAAE,CAAA;AAAA,EAClF;AACA,EAAA,MAAM,OAAA,GAA2B,SAAA,CAAU,GAAA,CAAI,CAAC,OAAA,MAAa;AAAA,IAC3D,OAAA;AAAA,IACA,MAAA,EAAQ,OAAA,CAAQ,QAAA,CAAS,GAAG,IAAI,CAAA,GAAI;AAAA,GACtC,CAAE,CAAA;AAEF,EAAA,MAAM,MAAA,GAAS,CACb,SAAA,EACA,OAAA,EACA,QAAA,KAKS;AACT,IAAA,IAAI,QAAQ,GAAA,EAAK;AACf,MAAA,QAAA,CAAS,MAAM,OAAO,CAAA;AAAA,IACxB,CAAA,MAAO;AACL,MAAA,QAAA,CAAS,IAAA,EAAM,QAAQ,CAAC,CAAA,CAAE,SAAS,OAAA,CAAQ,CAAC,EAAE,MAAM,CAAA;AAAA,IACtD;AAAA,EACF,CAAA;AAEA,EAAA,OAAO,IAAI,OAAA,CAAkB,CAAC,OAAA,EAAS,MAAA,KAAW;AAChD,IAAA,MAAM,MAAM,KAAA,CAAM,OAAA;AAAA,MAChB,MAAA;AAAA,MACA,EAAE,MAAA,EAAQ,KAAA,EAAO,SAAS,MAAA,EAAQ,KAAA,EAAO,OAAO,MAAA,EAAO;AAAA,MACvD,CAAC,GAAA,KAAQ;AACP,QAAA,IAAI;AACF,UAAA,MAAM,MAAA,GAAS,IAAI,UAAA,IAAc,CAAA;AACjC,UAAA,MAAM,eAAA,GAAkB,IAAI,OAAA,EAAQ;AACpC,UAAA,KAAA,MAAW,CAAC,MAAM,KAAK,CAAA,IAAK,OAAO,OAAA,CAAQ,GAAA,CAAI,OAAO,CAAA,EAAG;AACvD,YAAA,IAAI,UAAU,KAAA,CAAA,EAAW;AACzB,YAAA,IAAI,KAAA,CAAM,OAAA,CAAQ,KAAK,CAAA,EAAG;AACxB,cAAA,KAAA,MAAW,IAAA,IAAQ,KAAA,EAAO,eAAA,CAAgB,MAAA,CAAO,MAAM,IAAI,CAAA;AAAA,YAC7D,CAAA,MAAO;AACL,cAAA,eAAA,CAAgB,GAAA,CAAI,MAAM,KAAK,CAAA;AAAA,YACjC;AAAA,UACF;AAEA,UAAA,IAAI,kBAAA,CAAmB,GAAA,CAAI,MAAM,CAAA,EAAG;AAClC,YAAA,GAAA,CAAI,MAAA,EAAO;AACX,YAAA,OAAA,CAAQ,IAAI,SAAS,IAAA,EAAM,EAAE,QAAQ,OAAA,EAAS,eAAA,EAAiB,CAAC,CAAA;AAChE,YAAA;AAAA,UACF;AAEA,UAAA,IAAI,OAAA,GAAU,KAAA;AACd,UAAA,MAAM,IAAA,GAAO,IAAI,cAAA,CAA2B;AAAA,YAC1C,MAAM,UAAA,EAAY;AAChB,cAAA,GAAA,CAAI,EAAA,CAAG,MAAA,EAAQ,CAAC,KAAA,KAAkB;AAChC,gBAAA,IAAI,OAAA,EAAS;AACb,gBAAA,UAAA,CAAW,OAAA,CAAQ,IAAI,UAAA,CAAW,KAAK,CAAC,CAAA;AACxC,gBAAA,IAAA,CAAK,UAAA,CAAW,WAAA,IAAe,CAAA,KAAM,CAAA,MAAO,KAAA,EAAM;AAAA,cACpD,CAAC,CAAA;AACD,cAAA,GAAA,CAAI,EAAA,CAAG,OAAO,MAAM;AAClB,gBAAA,IAAI,OAAA,EAAS;AACb,gBAAA,OAAA,GAAU,IAAA;AACV,gBAAA,UAAA,CAAW,KAAA,EAAM;AAAA,cACnB,CAAC,CAAA;AACD,cAAA,GAAA,CAAI,EAAA,CAAG,OAAA,EAAS,CAAC,GAAA,KAAQ;AACvB,gBAAA,IAAI,OAAA,EAAS;AACb,gBAAA,OAAA,GAAU,IAAA;AACV,gBAAA,UAAA,CAAW,MAAM,GAAG,CAAA;AAAA,cACtB,CAAC,CAAA;AAAA,YACH,CAAA;AAAA,YACA,IAAA,GAAO;AACL,cAAA,GAAA,CAAI,MAAA,EAAO;AAAA,YACb,CAAA;AAAA,YACA,MAAA,GAAS;AACP,cAAA,OAAA,GAAU,IAAA;AACV,cAAA,GAAA,CAAI,OAAA,EAAQ;AAAA,YACd;AAAA,WACD,CAAA;AACD,UAAA,OAAA,CAAQ,IAAI,SAAS,IAAA,EAAM,EAAE,QAAQ,OAAA,EAAS,eAAA,EAAiB,CAAC,CAAA;AAAA,QAClE,SAAS,GAAA,EAAK;AACZ,UAAA,GAAA,CAAI,OAAA,EAAQ;AACZ,UAAA,MAAA,CAAO,GAAG,CAAA;AAAA,QACZ;AAAA,MACF;AAAA,KACF;AACA,IAAA,GAAA,CAAI,EAAA,CAAG,SAAS,MAAM,CAAA;AACtB,IAAA,GAAA,CAAI,GAAA,EAAI;AAAA,EACV,CAAC,CAAA;AACH;AAiBA,eAAsB,aAAA,CACpB,GAAA,EACA,OAAA,GAA4B,EAAC,EACc;AAC3C,EAAA,MAAM;AAAA,IACJ,YAAY,eAAA,CAAgB,cAAA;AAAA,IAC5B,WAAW,eAAA,CAAgB,gBAAA;AAAA,IAC3B,YAAA,GAAe,CAAA;AAAA,IACf,iBAAiB,gBAAA,CAAiB,cAAA;AAAA,IAClC,yBAAA,GAA4B,IAAA;AAAA;AAAA,IAC5B,kBAAA,GAAqB,OAAA;AAAA;AAAA,IACrB,UAAU;AAAC,GACb,GAAI,OAAA;AAGJ,EAAA,IAAI,SAAA;AACJ,EAAA,IAAI;AACF,IAAA,SAAA,GAAY,IAAI,IAAI,GAAG,CAAA;AAAA,EACzB,CAAA,CAAA,MAAQ;AACN,IAAA,OAAO;AAAA,MACL,EAAA,EAAI,KAAA;AAAA,MACJ,MAAA,EAAQ,aAAA;AAAA,MACR,OAAA,EAAS,gBAAgB,GAAG,CAAA,CAAA;AAAA,MAC5B,UAAA,EAAY;AAAA,KACd;AAAA,EACF;AAGA,EAAA,IAAI,SAAA,CAAU,aAAa,QAAA,EAAU;AACnC,IAAA,OAAO;AAAA,MACL,EAAA,EAAI,KAAA;AAAA,MACJ,MAAA,EAAQ,WAAA;AAAA,MACR,OAAA,EAAS,uBAAuB,GAAG,CAAA,CAAA;AAAA,MACnC,UAAA,EAAY;AAAA,KACd;AAAA,EACF;AAGA,EAAA,MAAM,SAAA,GAAY,MAAM,eAAA,CAAgB,SAAA,CAAU,QAAQ,CAAA;AAG1D,EAAA,IAAI,CAAC,UAAU,EAAA,EAAI;AACjB,IAAA,IAAI,uBAAuB,OAAA,EAAS;AAClC,MAAA,OAAO;AAAA,QACL,EAAA,EAAI,KAAA;AAAA,QACJ,MAAA,EAAQ,aAAA;AAAA,QACR,OAAA,EAAS,CAAA,wBAAA,EAA2B,SAAA,CAAU,OAAO,CAAA,CAAA;AAAA,QACrD,UAAA,EAAY;AAAA,OACd;AAAA,IACF;AAEA,IAAA,OAAO;AAAA,MACL,EAAA,EAAI,KAAA;AAAA,MACJ,MAAA,EAAQ,eAAA;AAAA,MACR,SAAS,SAAA,CAAU,OAAA;AAAA,MACnB,UAAA,EAAY;AAAA,KACd;AAAA,EACF;AAGA,EAAA,KAAA,MAAW,EAAA,IAAM,UAAU,GAAA,EAAK;AAC9B,IAAA,MAAM,WAAA,GAAc,YAAY,EAAE,CAAA;AAClC,IAAA,IAAI,YAAY,OAAA,EAAS;AACvB,MAAA,OAAO;AAAA,QACL,EAAA,EAAI,KAAA;AAAA,QACJ,QAAQ,WAAA,CAAY,MAAA;AAAA,QACpB,SAAS,CAAA,QAAA,EAAW,WAAA,CAAY,MAAM,CAAA,UAAA,EAAa,EAAE,QAAQ,GAAG,CAAA,CAAA;AAAA,QAChE,UAAA,EAAY;AAAA,OACd;AAAA,IACF;AAAA,EACF;AAGA,EAAA,IAAI,aAAA,GAAgB,CAAA;AACpB,EAAA,IAAI,UAAA,GAAa,GAAA;AACjB,EAAA,IAAI,eAAA,GAA4C,SAAA,CAAU,OAAA,GAAU,IAAA,GAAO,SAAA,CAAU,GAAA;AACrF,EAAA,MAAM,iBAAiB,SAAA,CAAU,MAAA;AAEjC,EAAA,OAAO,IAAA,EAAM;AACX,IAAA,IAAI;AACF,MAAA,MAAM,UAAA,GAAa,IAAI,eAAA,EAAgB;AACvC,MAAA,MAAM,YAAY,UAAA,CAAW,MAAM,UAAA,CAAW,KAAA,IAAS,SAAS,CAAA;AAEhE,MAAA,MAAM,cAAA,GAAiB;AAAA,QACrB,MAAA,EAAQ,8BAAA;AAAA,QACR,GAAG;AAAA,OACL;AACA,MAAA,MAAM,QAAA,GACJ,eAAA,KAAoB,IAAA,GAChB,MAAM,MAAM,UAAA,EAAY;AAAA,QACtB,OAAA,EAAS,cAAA;AAAA,QACT,QAAQ,UAAA,CAAW,MAAA;AAAA,QACnB,QAAA,EAAU;AAAA;AAAA,OACX,IACD,MAAM,wBAAA;AAAA,QACJ,UAAA;AAAA,QACA,eAAA;AAAA,QACA,cAAA;AAAA,QACA,UAAA,CAAW;AAAA,OACb;AAEN,MAAA,YAAA,CAAa,SAAS,CAAA;AAGtB,MAAA,IAAI,QAAA,CAAS,MAAA,IAAU,GAAA,IAAO,QAAA,CAAS,SAAS,GAAA,EAAK;AACnD,QAAA,MAAM,QAAA,GAAW,QAAA,CAAS,OAAA,CAAQ,GAAA,CAAI,UAAU,CAAA;AAChD,QAAA,MAAM,YAAY,QAAQ,CAAA;AAE1B,QAAA,IAAI,CAAC,QAAA,EAAU;AACb,UAAA,OAAO;AAAA,YACL,EAAA,EAAI,KAAA;AAAA,YACJ,MAAA,EAAQ,eAAA;AAAA,YACR,OAAA,EAAS,yCAAyC,UAAU,CAAA;AAAA,WAC9D;AAAA,QACF;AAGA,QAAA,IAAI,CAAC,cAAA,EAAgB;AACnB,UAAA,OAAO;AAAA,YACL,EAAA,EAAI,KAAA;AAAA,YACJ,MAAA,EAAQ,oBAAA;AAAA,YACR,OAAA,EAAS,CAAA,uBAAA,EAA0B,UAAU,CAAA,IAAA,EAAO,QAAQ,CAAA,CAAA;AAAA,YAC5D,UAAA,EAAY;AAAA,WACd;AAAA,QACF;AAGA,QAAA,aAAA,EAAA;AACA,QAAA,IAAI,gBAAgB,YAAA,EAAc;AAChC,UAAA,OAAO;AAAA,YACL,EAAA,EAAI,KAAA;AAAA,YACJ,MAAA,EAAQ,oBAAA;AAAA,YACR,OAAA,EAAS,CAAA,oBAAA,EAAuB,aAAa,CAAA,GAAA,EAAM,YAAY,CAAA,CAAA,CAAA;AAAA,YAC/D,UAAA,EAAY;AAAA,WACd;AAAA,QACF;AAGA,QAAA,IAAI,WAAA;AACJ,QAAA,IAAI;AACF,UAAA,WAAA,GAAc,IAAI,GAAA,CAAI,QAAA,EAAU,UAAU,CAAA;AAAA,QAC5C,CAAA,CAAA,MAAQ;AACN,UAAA,OAAO;AAAA,YACL,EAAA,EAAI,KAAA;AAAA,YACJ,MAAA,EAAQ,aAAA;AAAA,YACR,OAAA,EAAS,yBAAyB,QAAQ,CAAA,CAAA;AAAA,YAC1C,UAAA,EAAY;AAAA,WACd;AAAA,QACF;AAGA,QAAA,IAAI,WAAA,CAAY,aAAa,QAAA,EAAU;AACrC,UAAA,OAAO;AAAA,YACL,EAAA,EAAI,KAAA;AAAA,YACJ,MAAA,EAAQ,kBAAA;AAAA,YACR,OAAA,EAAS,CAAA,qCAAA,EAAwC,UAAU,CAAA,IAAA,EAAO,YAAY,IAAI,CAAA,CAAA;AAAA,YAClF,YAAY,WAAA,CAAY;AAAA,WAC1B;AAAA,QACF;AAGA,QAAA,IAAI,WAAA,CAAY,MAAA,KAAW,cAAA,IAAkB,CAAC,yBAAA,EAA2B;AACvE,UAAA,OAAO;AAAA,YACL,EAAA,EAAI,KAAA;AAAA,YACJ,MAAA,EAAQ,uBAAA;AAAA,YACR,OAAA,EAAS,CAAA,mCAAA,EAAsC,cAAc,CAAA,IAAA,EAAO,YAAY,MAAM,CAAA,CAAA;AAAA,YACtF,YAAY,WAAA,CAAY;AAAA,WAC1B;AAAA,QACF;AAGA,QAAA,MAAM,iBAAA,GAAoB,MAAM,eAAA,CAAgB,WAAA,CAAY,QAAQ,CAAA;AAGpE,QAAA,IAAI,CAAC,kBAAkB,EAAA,EAAI;AACzB,UAAA,IAAI,uBAAuB,OAAA,EAAS;AAClC,YAAA,OAAO;AAAA,cACL,EAAA,EAAI,KAAA;AAAA,cACJ,MAAA,EAAQ,aAAA;AAAA,cACR,OAAA,EAAS,CAAA,iCAAA,EAAoC,iBAAA,CAAkB,OAAO,CAAA,CAAA;AAAA,cACtE,YAAY,WAAA,CAAY;AAAA,aAC1B;AAAA,UACF;AACA,UAAA,OAAO;AAAA,YACL,EAAA,EAAI,KAAA;AAAA,YACJ,MAAA,EAAQ,eAAA;AAAA,YACR,SAAS,iBAAA,CAAkB,OAAA;AAAA,YAC3B,YAAY,WAAA,CAAY;AAAA,WAC1B;AAAA,QACF;AAGA,QAAA,KAAA,MAAW,EAAA,IAAM,kBAAkB,GAAA,EAAK;AACtC,UAAA,MAAM,WAAA,GAAc,YAAY,EAAE,CAAA;AAClC,UAAA,IAAI,YAAY,OAAA,EAAS;AACvB,YAAA,OAAO;AAAA,cACL,EAAA,EAAI,KAAA;AAAA,cACJ,QAAQ,WAAA,CAAY,MAAA;AAAA,cACpB,OAAA,EAAS,CAAA,oBAAA,EAAuB,WAAA,CAAY,MAAM,aAAa,EAAE,CAAA,CAAA;AAAA,cACjE,YAAY,WAAA,CAAY;AAAA,aAC1B;AAAA,UACF;AAAA,QACF;AAEA,QAAA,UAAA,GAAa,WAAA,CAAY,IAAA;AACzB,QAAA,eAAA,GAAkB,iBAAA,CAAkB,OAAA,GAAU,IAAA,GAAO,iBAAA,CAAkB,GAAA;AACvE,QAAA;AAAA,MACF;AAGA,MAAA,MAAM,aAAA,GAAgB,QAAA,CAAS,OAAA,CAAQ,GAAA,CAAI,gBAAgB,CAAA;AAC3D,MAAA,IAAI,aAAA,IAAiB,QAAA,CAAS,aAAA,EAAe,EAAE,IAAI,QAAA,EAAU;AAC3D,QAAA,MAAM,YAAY,QAAQ,CAAA;AAC1B,QAAA,OAAO;AAAA,UACL,EAAA,EAAI,KAAA;AAAA,UACJ,MAAA,EAAQ,oBAAA;AAAA,UACR,OAAA,EAAS,CAAA,oBAAA,EAAuB,aAAa,CAAA,SAAA,EAAY,QAAQ,CAAA,IAAA;AAAA,SACnE;AAAA,MACF;AAGA,MAAA,MAAM,MAAA,GAAS,QAAA,CAAS,IAAA,EAAM,SAAA,EAAU;AACxC,MAAA,IAAI,CAAC,MAAA,EAAQ;AACX,QAAA,MAAME,KAAAA,GAAO,MAAM,QAAA,CAAS,IAAA,EAAK;AACjC,QAAA,IAAIA,KAAAA,CAAK,SAAS,QAAA,EAAU;AAC1B,UAAA,OAAO;AAAA,YACL,EAAA,EAAI,KAAA;AAAA,YACJ,MAAA,EAAQ,oBAAA;AAAA,YACR,OAAA,EAAS,CAAA,oBAAA,EAAuBA,KAAAA,CAAK,MAAM,YAAY,QAAQ,CAAA,IAAA;AAAA,WACjE;AAAA,QACF;AAEA,QAAA,MAAMC,SAAAA,GAAW,IAAI,WAAA,EAAY,CAAE,OAAOD,KAAI,CAAA;AAC9C,QAAA,OAAO;AAAA,UACL,EAAA,EAAI,IAAA;AAAA,UACJ,QAAQ,QAAA,CAAS,MAAA;AAAA,UACjB,IAAA,EAAAA,KAAAA;AAAA,UACA,QAAA,EAAAC,SAAAA;AAAA,UACA,WAAA,EAAa,QAAA,CAAS,OAAA,CAAQ,GAAA,CAAI,cAAc,CAAA,IAAK,KAAA;AAAA,SACvD;AAAA,MACF;AAGA,MAAA,MAAM,SAAuB,EAAC;AAC9B,MAAA,IAAI,SAAA,GAAY,CAAA;AAEhB,MAAA,OAAO,IAAA,EAAM;AACX,QAAA,MAAM,EAAE,IAAA,EAAM,KAAA,EAAM,GAAI,MAAM,OAAO,IAAA,EAAK;AAC1C,QAAA,IAAI,IAAA,EAAM;AAEV,QAAA,SAAA,IAAa,KAAA,CAAM,MAAA;AACnB,QAAA,IAAI,YAAY,QAAA,EAAU;AACxB,UAAA,MAAA,CAAO,MAAA,EAAO;AACd,UAAA,OAAO;AAAA,YACL,EAAA,EAAI,KAAA;AAAA,YACJ,MAAA,EAAQ,oBAAA;AAAA,YACR,OAAA,EAAS,CAAA,oBAAA,EAAuB,SAAS,CAAA,SAAA,EAAY,QAAQ,CAAA,IAAA;AAAA,WAC/D;AAAA,QACF;AAEA,QAAA,MAAA,CAAO,KAAK,KAAK,CAAA;AAAA,MACnB;AAGA,MAAA,MAAM,QAAA,GAAW,MAAA,CAAO,MAAA,CAAO,CAAC,KAAK,KAAA,KAAU;AAC7C,QAAA,MAAM,SAAS,IAAI,UAAA,CAAW,GAAA,CAAI,MAAA,GAAS,MAAM,MAAM,CAAA;AACvD,QAAA,MAAA,CAAO,IAAI,GAAG,CAAA;AACd,QAAA,MAAA,CAAO,GAAA,CAAI,KAAA,EAAO,GAAA,CAAI,MAAM,CAAA;AAC5B,QAAA,OAAO,MAAA;AAAA,MACT,CAAA,EAAG,IAAI,UAAA,EAAY,CAAA;AAGnB,MAAA,MAAM,IAAA,GAAO,IAAI,WAAA,EAAY,CAAE,OAAO,QAAQ,CAAA;AAE9C,MAAA,OAAO;AAAA,QACL,EAAA,EAAI,IAAA;AAAA,QACJ,QAAQ,QAAA,CAAS,MAAA;AAAA,QACjB,IAAA;AAAA,QACA,QAAA;AAAA,QACA,WAAA,EAAa,QAAA,CAAS,OAAA,CAAQ,GAAA,CAAI,cAAc,CAAA,IAAK,KAAA;AAAA,OACvD;AAAA,IACF,SAAS,GAAA,EAAK;AACZ,MAAA,IAAI,eAAe,KAAA,EAAO;AACxB,QAAA,IAAI,IAAI,IAAA,KAAS,YAAA,IAAgB,IAAI,OAAA,CAAQ,QAAA,CAAS,SAAS,CAAA,EAAG;AAChE,UAAA,OAAO;AAAA,YACL,EAAA,EAAI,KAAA;AAAA,YACJ,MAAA,EAAQ,SAAA;AAAA,YACR,OAAA,EAAS,CAAA,oBAAA,EAAuB,SAAS,CAAA,IAAA,EAAO,UAAU,CAAA;AAAA,WAC5D;AAAA,QACF;AAAA,MACF;AAEA,MAAA,OAAO;AAAA,QACL,EAAA,EAAI,KAAA;AAAA,QACJ,MAAA,EAAQ,eAAA;AAAA,QACR,OAAA,EAAS,kBAAkB,GAAA,YAAe,KAAA,GAAQ,IAAI,OAAA,GAAU,MAAA,CAAO,GAAG,CAAC,CAAA;AAAA,OAC7E;AAAA,IACF;AAAA,EACF;AACF;AAKA,eAAsB,aAAA,CACpB,SACA,OAAA,EAC2C;AAC3C,EAAA,OAAO,cAAc,OAAA,EAAS;AAAA,IAC5B,GAAG,OAAA;AAAA,IACH,UAAU,eAAA,CAAgB,YAAA;AAAA,IAC1B,OAAA,EAAS;AAAA,MACP,MAAA,EAAQ,kBAAA;AAAA,MACR,GAAG,OAAA,EAAS;AAAA;AACd,GACD,CAAA;AACH;AAKA,eAAsB,gBAAA,CACpB,YACA,OAAA,EAC2C;AAC3C,EAAA,OAAO,cAAc,UAAA,EAAY;AAAA,IAC/B,GAAG,OAAA;AAAA,IACH,UAAU,eAAA,CAAgB,eAAA;AAAA,IAC1B,OAAA,EAAS;AAAA,MACP,MAAA,EAAQ,oCAAA;AAAA,MACR,GAAG,OAAA,EAAS;AAAA;AACd,GACD,CAAA;AACH;;;AC1xBA,IAAM,yBAAA,GAA4B,IAAI,EAAA,GAAK,GAAA;AAC3C,IAAM,8BAAA,GAAiC,GAAA;AAchC,SAAS,qBAAA,CACd,IAAA,EACA,QAAA,EACA,GAAA,GAA0C,OAAO,YAAY,WAAA,GACxD,OAAA,CAAQ,GAAA,GACT,EAAC,EACG;AACR,EAAA,MAAM,GAAA,GAAM,IAAI,IAAI,CAAA;AACpB,EAAA,IAAI,CAAC,KAAK,OAAO,QAAA;AACjB,EAAA,IAAI,CAAC,eAAA,CAAgB,IAAA,CAAK,GAAG,GAAG,OAAO,QAAA;AACvC,EAAA,MAAM,MAAA,GAAS,QAAA,CAAS,GAAA,EAAK,EAAE,CAAA;AAC/B,EAAA,OAAO,MAAA,GAAS,IAAI,MAAA,GAAS,QAAA;AAC/B;AAEA,IAAM,oBAAA,GAAuB,qBAAA;AAAA,EAC3B,wBAAA;AAAA,EACA;AACF,CAAA;AACA,IAAM,yBAAA,GAA4B,qBAAA;AAAA,EAChC,6BAAA;AAAA,EACA;AACF,CAAA;AAMA,IAAM,SAAA,uBAAgB,GAAA,EAA4B;AAiBlD,IAAM,gBAAA,GAAmB,EAAA,GAAK,EAAA,GAAK,EAAA,GAAK,EAAA,GAAK,GAAA;AAM7C,IAAM,0BAAA,GAA6B,GAAA;AAEnC,IAAM,cAAA,uBAAqB,GAAA,EAAgC;AAM3D,SAAS,uBAAuB,GAAA,EAAmB;AACjD,EAAA,KAAA,MAAW,CAAC,GAAA,EAAK,KAAK,CAAA,IAAK,cAAA,EAAgB;AACzC,IAAA,IAAI,GAAA,GAAM,KAAA,CAAM,SAAA,IAAa,gBAAA,EAAkB;AAC7C,MAAA,cAAA,CAAe,OAAO,GAAG,CAAA;AAAA,IAC3B;AAAA,EACF;AACF;AAMA,SAAS,qBAAA,GAA8B;AACrC,EAAA,IAAI,cAAA,CAAe,QAAQ,0BAAA,EAA4B;AAGvD,EAAA,MAAM,UAAU,KAAA,CAAM,IAAA,CAAK,cAAA,CAAe,OAAA,EAAS,CAAA,CAAE,IAAA;AAAA,IACnD,CAAC,GAAG,CAAA,KAAM,CAAA,CAAE,CAAC,CAAA,CAAE,SAAA,GAAY,CAAA,CAAE,CAAC,CAAA,CAAE;AAAA,GAClC;AAGA,EAAA,MAAM,QAAA,GAAW,eAAe,IAAA,GAAO,0BAAA;AACvC,EAAA,KAAA,IAAS,CAAA,GAAI,CAAA,EAAG,CAAA,GAAI,QAAA,EAAU,CAAA,EAAA,EAAK;AACjC,IAAA,cAAA,CAAe,MAAA,CAAO,OAAA,CAAQ,CAAC,CAAA,CAAE,CAAC,CAAC,CAAA;AAAA,EACrC;AACF;AAWA,SAAS,aAAA,CAAc,MAAA,EAAgB,IAAA,EAAY,GAAA,EAA4B;AAE7E,EAAA,sBAAA,CAAuB,GAAG,CAAA;AAE1B,EAAA,KAAA,MAAW,GAAA,IAAO,KAAK,IAAA,EAAM;AAC3B,IAAA,IAAI,CAAC,GAAA,CAAI,GAAA,IAAO,CAAC,IAAI,CAAA,EAAG;AACxB,IAAA,MAAM,MAAA,GAAS,CAAA,EAAG,MAAM,CAAA,CAAA,EAAI,IAAI,GAAG,CAAA,CAAA;AACnC,IAAA,MAAM,QAAA,GAAW,cAAA,CAAe,GAAA,CAAI,MAAM,CAAA;AAE1C,IAAA,IAAI,QAAA,EAAU;AAEZ,MAAA,IAAI,GAAA,GAAM,QAAA,CAAS,SAAA,GAAY,gBAAA,EAAkB;AAC/C,QAAA,IAAI,QAAA,CAAS,UAAA,KAAe,GAAA,CAAI,CAAA,EAAG;AACjC,UAAA,OAAO,CAAA,wBAAA,EAA2B,GAAA,CAAI,GAAG,CAAA,YAAA,EAAe,MAAM,CAAA,+BAAA,CAAA;AAAA,QAChE;AAAA,MACF,CAAA,MAAO;AAEL,QAAA,cAAA,CAAe,GAAA,CAAI,QAAQ,EAAE,UAAA,EAAY,IAAI,CAAA,EAAG,SAAA,EAAW,KAAK,CAAA;AAAA,MAClE;AAAA,IACF,CAAA,MAAO;AAEL,MAAA,cAAA,CAAe,GAAA,CAAI,QAAQ,EAAE,UAAA,EAAY,IAAI,CAAA,EAAG,SAAA,EAAW,KAAK,CAAA;AAAA,IAClE;AAAA,EACF;AAGA,EAAA,qBAAA,EAAsB;AAEtB,EAAA,OAAO,IAAA;AACT;AAMO,SAAS,mBAAA,GAA4B;AAC1C,EAAA,cAAA,CAAe,KAAA,EAAM;AACvB;AAMO,SAAS,oBAAA,GAA+B;AAC7C,EAAA,OAAO,cAAA,CAAe,IAAA;AACxB;AAMA,SAAS,QAAA,CAAS,KAAa,GAAA,EAAyC;AACtE,EAAA,MAAM,KAAA,GAAQ,SAAA,CAAU,GAAA,CAAI,GAAG,CAAA;AAC/B,EAAA,IAAI,CAAC,OAAO,OAAO,MAAA;AACnB,EAAA,IAAI,KAAA,CAAM,aAAa,GAAA,EAAK;AAC1B,IAAA,SAAA,CAAU,OAAO,GAAG,CAAA;AACpB,IAAA,OAAO,MAAA;AAAA,EACT;AAEA,EAAA,SAAA,CAAU,OAAO,GAAG,CAAA;AACpB,EAAA,SAAA,CAAU,GAAA,CAAI,KAAK,KAAK,CAAA;AACxB,EAAA,OAAO,KAAA;AACT;AAKA,SAAS,QAAA,CAAS,GAAA,EAAa,KAAA,EAAuB,UAAA,EAA0B;AAC9E,EAAA,IAAI,UAAU,GAAA,CAAI,GAAG,CAAA,EAAG,SAAA,CAAU,OAAO,GAAG,CAAA;AAC5C,EAAA,SAAA,CAAU,GAAA,CAAI,KAAK,KAAK,CAAA;AAExB,EAAA,OAAO,SAAA,CAAU,OAAO,UAAA,EAAY;AAClC,IAAA,MAAM,SAAA,GAAY,SAAA,CAAU,IAAA,EAAK,CAAE,MAAK,CAAE,KAAA;AAC1C,IAAA,IAAI,SAAA,KAAc,MAAA,EAAW,SAAA,CAAU,MAAA,CAAO,SAAS,CAAA;AAAA,EACzD;AACF;AAKO,SAAS,cAAA,GAAuB;AACrC,EAAA,SAAA,CAAU,KAAA,EAAM;AAClB;AAMO,SAAS,gBAAA,GAA2B;AACzC,EAAA,OAAO,SAAA,CAAU,IAAA;AACnB;AAqBA,SAAS,yBACP,SAAA,EAC+D;AAC/D,EAAA,IAAI;AACF,IAAA,MAAM,MAAA,GAAS,IAAI,GAAA,CAAI,SAAS,CAAA,CAAE,MAAA;AAElC,IAAA,IAAI,WAAW,MAAA,EAAQ;AACrB,MAAA,OAAO,EAAE,EAAA,EAAI,KAAA,EAAO,OAAA,EAAS,CAAA,gCAAA,EAAmC,SAAS,CAAA,CAAA,EAAG;AAAA,IAC9E;AACA,IAAA,OAAO,EAAE,EAAA,EAAI,IAAA,EAAM,MAAA,EAAO;AAAA,EAC5B,CAAA,CAAA,MAAQ;AACN,IAAA,OAAO,EAAE,EAAA,EAAI,KAAA,EAAO,OAAA,EAAS,CAAA,+BAAA,EAAkC,SAAS,CAAA,CAAA,EAAG;AAAA,EAC7E;AACF;AAUA,SAAS,YAAA,CACP,QACA,OAAA,EACoD;AACpD,EAAA,IAAI,IAAA;AACJ,EAAA,QAAQ,MAAA;AAAQ,IACd,KAAK,WAAA;AACH,MAAA,IAAA,GAAO,kCAAA;AACP,MAAA;AAAA,IACF,KAAK,YAAA;AAAA,IACL,KAAK,UAAA;AAAA,IACL,KAAK,YAAA;AACH,MAAA,IAAA,GAAO,4BAAA;AACP,MAAA;AAAA,IACF,KAAK,SAAA;AACH,MAAA,IAAA,GAAO,4BAAA;AACP,MAAA;AAAA,IACF,KAAK,oBAAA;AACH,MAAA,IAAA,GAAO,OAAA,KAAY,SAAS,yBAAA,GAA4B,2BAAA;AACxD,MAAA;AAAA,IACF,KAAK,aAAA;AAAA,IACL,KAAK,eAAA;AAAA,IACL,KAAK,oBAAA;AAAA,IACL,KAAK,kBAAA;AAAA,IACL,KAAK,uBAAA;AAAA,IACL,KAAK,aAAA;AACH,MAAA,IAAA,GACE,OAAA,KAAY,kBACR,gCAAA,GACA,2BAAA;AACN,MAAA;AAAA,IACF,KAAK,oBAAA;AACH,MAAA,IAAA,GAAO,6BAAA;AACP,MAAA;AAAA,IACF;AACE,MAAA,IAAA,GAAO,2BAAA;AACP,MAAA;AAAA;AAEJ,EAAA,OAAO,EAAE,MAAM,MAAA,EAAO;AACxB;AAOA,IAAM,mBAAA,GAAsB,uCAAA;AAE5B,SAAS,cAAc,KAAA,EAAkD;AACvE,EAAA,OAAO,OAAO,UAAU,QAAA,IAAY,KAAA,KAAU,QAAQ,CAAC,KAAA,CAAM,QAAQ,KAAK,CAAA;AAC5E;AAMA,SAAS,gBAAgB,KAAA,EAA+B;AACtD,EAAA,IAAI,CAAC,aAAA,CAAc,KAAK,CAAA,EAAG,OAAO,eAAA;AAClC,EAAA,IAAI,KAAA,CAAM,GAAA,KAAQ,KAAA,EAAO,OAAO,iBAAA;AAChC,EAAA,IAAI,KAAA,CAAM,GAAA,KAAQ,SAAA,EAAW,OAAO,qBAAA;AACpC,EAAA,IAAI,OAAO,MAAM,CAAA,KAAM,QAAA,IAAY,CAAC,mBAAA,CAAoB,IAAA,CAAK,KAAA,CAAM,CAAC,CAAA,EAAG;AACrE,IAAA,OAAO,+CAAA;AAAA,EACT;AACA,EAAA,IAAI,OAAO,SAAA,CAAU,cAAA,CAAe,KAAK,KAAA,EAAO,GAAG,GAAG,OAAO,8BAAA;AAC7D,EAAA,IAAI,MAAM,GAAA,KAAQ,MAAA,IAAa,OAAO,KAAA,CAAM,GAAA,KAAQ,UAAU,OAAO,sBAAA;AACrE,EAAA,IAAI,MAAM,GAAA,KAAQ,MAAA,IAAa,KAAA,CAAM,GAAA,KAAQ,OAAO,OAAO,iBAAA;AAC3D,EAAA,IAAI,KAAA,CAAM,QAAQ,MAAA,IAAa,KAAA,CAAM,QAAQ,OAAA,IAAW,KAAA,CAAM,QAAQ,SAAA,EAAW;AAC/E,IAAA,OAAO,8BAAA;AAAA,EACT;AACA,EAAA,OAAO,IAAA;AACT;AAgBA,eAAsB,WAAA,CACpB,WACA,OAAA,EAC4B;AAC5B,EAAA,MAAM,UAAA,GAAa,SAAS,UAAA,IAAc,oBAAA;AAC1C,EAAA,MAAM,eAAA,GAAkB,SAAS,eAAA,IAAmB,yBAAA;AACpD,EAAA,MAAM,OAAA,GAAU,SAAS,OAAA,IAAW,KAAA;AAGpC,EAAA,MAAM,UAAA,GAAa,yBAAyB,SAAS,CAAA;AACrD,EAAA,IAAI,CAAC,WAAW,EAAA,EAAI;AAClB,IAAA,OAAO;AAAA,MACL,EAAA,EAAI,KAAA;AAAA,MACJ,IAAA,EAAM,gCAAA;AAAA,MACN,SAAS,UAAA,CAAW,OAAA;AAAA,MACpB,UAAA,EAAY;AAAA,KACd;AAAA,EACF;AACA,EAAA,MAAM,mBAAmB,UAAA,CAAW,MAAA;AACpC,EAAA,MAAM,GAAA,GAAM,KAAK,GAAA,EAAI;AAGrB,EAAA,IAAI,CAAC,OAAA,EAAS;AACZ,IAAA,MAAM,MAAA,GAAS,QAAA,CAAS,gBAAA,EAAkB,GAAG,CAAA;AAC7C,IAAA,IAAI,MAAA,EAAQ;AACV,MAAA,OAAO,EAAE,EAAA,EAAI,IAAA,EAAM,IAAA,EAAM,MAAA,CAAO,MAAM,SAAA,EAAW,IAAA,EAAM,WAAA,EAAa,MAAA,CAAO,WAAA,EAAY;AAAA,IACzF;AAAA,EACF;AAGA,EAAA,IAAI,CAAC,gBAAA,CAAiB,UAAA,CAAW,UAAU,CAAA,EAAG;AAC5C,IAAA,OAAO;AAAA,MACL,EAAA,EAAI,KAAA;AAAA,MACJ,IAAA,EAAM,kCAAA;AAAA,MACN,OAAA,EAAS,6BAA6B,gBAAgB,CAAA,CAAA;AAAA,MACtD,UAAA,EAAY;AAAA,KACd;AAAA,EACF;AAGA,EAAA,MAAM,SAAA,GAAY,GAAG,gBAAgB,CAAA,6BAAA,CAAA;AACrC,EAAA,MAAM,YAAA,GAAe,MAAM,aAAA,CAAc,SAAA,EAAW;AAAA,IAClD,QAAA,EAAUC,4BAAAA;AAAA,IACV,OAAA,EAAS,EAAE,MAAA,EAAQ,kBAAA;AAAmB,GACvC,CAAA;AAED,EAAA,IAAI,CAAC,aAAa,EAAA,EAAI;AACpB,IAAA,MAAM,MAAA,GAAS,YAAA,CAAa,YAAA,CAAa,MAAA,EAAQ,eAAe,CAAA;AAChE,IAAA,OAAO;AAAA,MACL,EAAA,EAAI,KAAA;AAAA,MACJ,MAAM,MAAA,CAAO,IAAA;AAAA,MACb,OAAA,EAAS,CAAA,kCAAA,EAAqC,YAAA,CAAa,OAAO,CAAA,CAAA;AAAA,MAClE,QAAQ,MAAA,CAAO,MAAA;AAAA,MACf,YAAY,YAAA,CAAa;AAAA,KAC3B;AAAA,EACF;AAGA,EAAA,IAAI,YAAA;AACJ,EAAA,IAAI;AACF,IAAA,YAAA,GAAe,iBAAA,CAAkB,aAAa,IAAI,CAAA;AAAA,EACpD,SAAS,GAAA,EAAK;AACZ,IAAA,OAAO;AAAA,MACL,EAAA,EAAI,KAAA;AAAA,MACJ,IAAA,EAAM,gCAAA;AAAA,MACN,OAAA,EAAS,6BAA6B,GAAA,YAAe,KAAA,GAAQ,IAAI,OAAA,GAAU,MAAA,CAAO,GAAG,CAAC,CAAA;AAAA,KACxF;AAAA,EACF;AAGA,EAAA,MAAM,kBAAA,GAAqB,wBAAA,CAAyB,YAAA,CAAa,MAAM,CAAA;AACvE,EAAA,MAAM,YAAA,GAAe,kBAAA,CAAmB,EAAA,GAAK,kBAAA,CAAmB,SAAS,YAAA,CAAa,MAAA;AACtF,EAAA,IAAI,iBAAiB,gBAAA,EAAkB;AACrC,IAAA,OAAO;AAAA,MACL,EAAA,EAAI,KAAA;AAAA,MACJ,IAAA,EAAM,0BAAA;AAAA,MACN,OAAA,EAAS,CAAA,0BAAA,EAA6B,gBAAgB,CAAA,MAAA,EAAS,YAAY,CAAA;AAAA,KAC7E;AAAA,EACF;AAGA,EAAA,IAAI,CAAC,aAAa,QAAA,EAAU;AAC1B,IAAA,OAAO;AAAA,MACL,EAAA,EAAI,KAAA;AAAA,MACJ,IAAA,EAAM,2BAAA;AAAA,MACN,OAAA,EAAS;AAAA,KACX;AAAA,EACF;AAEA,EAAA,IAAI,CAAC,YAAA,CAAa,QAAA,CAAS,UAAA,CAAW,UAAU,CAAA,EAAG;AACjD,IAAA,OAAO;AAAA,MACL,EAAA,EAAI,KAAA;AAAA,MACJ,IAAA,EAAM,2BAAA;AAAA,MACN,OAAA,EAAS,CAAA,wBAAA,EAA2B,YAAA,CAAa,QAAQ,CAAA,CAAA;AAAA,MACzD,YAAY,YAAA,CAAa;AAAA,KAC3B;AAAA,EACF;AAGA,EAAA,MAAM,UAAA,GAAa,MAAM,aAAA,CAAc,YAAA,CAAa,QAAQ,CAAA;AAE5D,EAAA,IAAI,CAAC,WAAW,EAAA,EAAI;AAClB,IAAA,MAAM,MAAA,GAAS,YAAA,CAAa,UAAA,CAAW,MAAA,EAAQ,MAAM,CAAA;AACrD,IAAA,OAAO;AAAA,MACL,EAAA,EAAI,KAAA;AAAA,MACJ,MAAM,MAAA,CAAO,IAAA;AAAA,MACb,SAAS,CAAA,0BAAA,EAA6B,YAAA,CAAa,QAAQ,CAAA,EAAA,EAAK,WAAW,OAAO,CAAA,CAAA;AAAA,MAClF,QAAQ,MAAA,CAAO,MAAA;AAAA,MACf,YAAY,UAAA,CAAW;AAAA,KACzB;AAAA,EACF;AAGA,EAAA,IAAI,MAAA;AACJ,EAAA,IAAI;AACF,IAAA,MAAA,GAAS,IAAA,CAAK,KAAA,CAAM,UAAA,CAAW,IAAI,CAAA;AAAA,EACrC,CAAA,CAAA,MAAQ;AACN,IAAA,OAAO;AAAA,MACL,EAAA,EAAI,KAAA;AAAA,MACJ,IAAA,EAAM,uBAAA;AAAA,MACN,OAAA,EAAS;AAAA,KACX;AAAA,EACF;AAEA,EAAA,MAAM,OAAA,GAAU,aAAA,CAAc,MAAM,CAAA,GAAI,OAAO,IAAA,GAAO,MAAA;AACtD,EAAA,IAAI,CAAC,KAAA,CAAM,OAAA,CAAQ,OAAO,CAAA,EAAG;AAC3B,IAAA,OAAO;AAAA,MACL,EAAA,EAAI,KAAA;AAAA,MACJ,IAAA,EAAM,uBAAA;AAAA,MACN,OAAA,EAAS;AAAA,KACX;AAAA,EACF;AAEA,EAAA,IAAI,OAAA,CAAQ,MAAA,GAASC,eAAAA,CAAgB,WAAA,EAAa;AAChD,IAAA,OAAO;AAAA,MACL,EAAA,EAAI,KAAA;AAAA,MACJ,IAAA,EAAM,6BAAA;AAAA,MACN,SAAS,CAAA,wBAAA,EAA2B,OAAA,CAAQ,MAAM,CAAA,GAAA,EAAMA,gBAAgB,WAAW,CAAA;AAAA,KACrF;AAAA,EACF;AAEA,EAAA,MAAM,YAAmB,EAAC;AAC1B,EAAA,MAAM,UAAoB,EAAC;AAC3B,EAAA,OAAA,CAAQ,OAAA,CAAQ,CAAC,KAAA,EAAgB,KAAA,KAAkB;AACjD,IAAA,MAAM,OAAA,GAAU,gBAAgB,KAAK,CAAA;AACrC,IAAA,IAAI,YAAY,IAAA,EAAM;AACpB,MAAA,SAAA,CAAU,KAAK,KAAY,CAAA;AAAA,IAC7B,CAAA,MAAO;AACL,MAAA,OAAA,CAAQ,IAAA,CAAK,CAAA,CAAA,EAAI,KAAK,CAAA,EAAA,EAAK,OAAO,CAAA,CAAE,CAAA;AAAA,IACtC;AAAA,EACF,CAAC,CAAA;AACD,EAAA,IAAI,OAAA,CAAQ,SAAS,CAAA,EAAG;AACtB,IAAA,OAAA,CAAQ,IAAA;AAAA,MACN,CAAA,oBAAA,EAAuB,OAAA,CAAQ,MAAM,CAAA,kBAAA,EAAqB,QAAQ,MAAA,KAAW,CAAA,GAAI,GAAA,GAAM,KAAK,QAAQ,gBAAgB,CAAA,EAAA,EAAK,OAAA,CAAQ,IAAA,CAAK,IAAI,CAAC,CAAA,CAAA;AAAA,KAC7I;AAAA,EACF;AACA,EAAA,MAAM,IAAA,GAAa,EAAE,IAAA,EAAM,SAAA,EAAU;AAGrC,EAAA,MAAM,aAAA,GAAgB,aAAA,CAAc,gBAAA,EAAkB,IAAA,EAAM,GAAG,CAAA;AAC/D,EAAA,IAAI,aAAA,EAAe;AACjB,IAAA,OAAO;AAAA,MACL,EAAA,EAAI,KAAA;AAAA,MACJ,IAAA,EAAM,sBAAA;AAAA,MACN,OAAA,EAAS;AAAA,KACX;AAAA,EACF;AAGA,EAAA,MAAM,WAAA,GAAc,YAAA,CAAa,YAAA,EAAc,GAAA,CAAI,CAAC,KAAA,MAAW;AAAA,IAC7D,KAAK,KAAA,CAAM,GAAA;AAAA,IACX,YAAY,KAAA,CAAM,UAAA;AAAA,IAClB,QAAQ,KAAA,CAAM;AAAA,GAChB,CAAE,CAAA;AAGF,EAAA,IAAI,CAAC,OAAA,EAAS;AACZ,IAAA,QAAA,CAAS,gBAAA,EAAkB,EAAE,IAAA,EAAM,SAAA,EAAW,MAAM,UAAA,EAAY,WAAA,IAAe,eAAe,CAAA;AAAA,EAChG;AAEA,EAAA,OAAO;AAAA,IACL,EAAA,EAAI,IAAA;AAAA,IACJ,IAAA;AAAA,IACA,SAAA,EAAW,KAAA;AAAA,IACX,UAAU,UAAA,CAAW,QAAA;AAAA,IACrB;AAAA,GACF;AACF;AChmBO,IAAM,uBAAA,GAA0B,EAAA;AAUhC,SAAS,2BAA2B,GAAA,EAA4B;AACrE,EAAA,MAAM,KAAA,GAAQ,GAAA,CAAI,KAAA,CAAM,GAAG,CAAA;AAC3B,EAAA,IAAI,KAAA,CAAM,WAAW,CAAA,EAAG;AACtB,IAAA,OAAO,IAAA;AAAA,EACT;AACA,EAAA,IAAI;AACF,IAAA,OAAO,eAAA,CAAgB,KAAA,CAAM,CAAC,CAAC,CAAA,CAAE,MAAA;AAAA,EACnC,CAAA,CAAA,MAAQ;AACN,IAAA,OAAO,IAAA;AAAA,EACT;AACF;;;ACRA,SAAS,eAAe,GAAA,EAAsB;AAC5C,EAAA,IAAI,GAAA,CAAI,GAAA,KAAQ,KAAA,IAAS,GAAA,CAAI,QAAQ,SAAA,EAAW;AAC9C,IAAA,MAAM,IAAI,MAAM,+CAA+C,CAAA;AAAA,EACjE;AAGA,EAAA,MAAM,MAAA,GAAS,MAAA,CAAO,IAAA,CAAK,GAAA,CAAI,GAAG,WAAW,CAAA;AAC7C,EAAA,IAAI,MAAA,CAAO,WAAW,EAAA,EAAI;AACxB,IAAA,MAAM,IAAI,MAAM,qCAAqC,CAAA;AAAA,EACvD;AAEA,EAAA,OAAO,IAAI,WAAW,MAAM,CAAA;AAC9B;AAkEA,eAAsB,cACpB,YAAA,EACuC;AAGvC,EAAA,MAAM,iBAAA,GACJ,OAAO,YAAA,KAAiB,QAAA,GAAW,MAAA,GAAa,YAAA;AAClD,EAAA,KAAK,mBAAmB,iBAAiB,CAAA;AAGzC,EAAA,MAAM,UAAA,GAAa,OAAO,YAAA,KAAiB,QAAA,GAAW,eAAe,YAAA,CAAa,UAAA;AAClF,EAAA,MAAM,aAAA,GACJ,OAAO,YAAA,KAAiB,QAAA,GAAW,SAAY,YAAA,CAAa,gBAAA;AAC9D,EAAA,MAAM,SAAA,GAAY,OAAO,YAAA,KAAiB,QAAA,GAAW,SAAY,YAAA,CAAa,SAAA;AAC9E,EAAA,MAAM,SAAA,GAAY,YAAY,GAAA,EAAI;AAClC,EAAA,IAAI,aAAA;AAEJ,EAAA,IAAI;AAEF,IAAA,MAAM,EAAE,MAAA,EAAQ,OAAA,EAAQ,GAAI,OAA0B,UAAU,CAAA;AAGhE,IAAA,MAAM,gBAAA,GAAmBJ,0BAA0B,OAAO,CAAA;AAC1D,IAAA,IAAI,CAAC,iBAAiB,KAAA,EAAO;AAC3B,MAAA,MAAM,CAAA,GAAI,gBAAA,CAAiB,UAAA,CAAW,CAAC,CAAA;AACvC,MAAA,OAAO;AAAA,QACL,EAAA,EAAI,KAAA;AAAA,QACJ,MAAA,EAAQ,sBAAA;AAAA,QACR,OAAA,EAAS,+BAA+B,CAAA,CAAE,UAAU,aAAa,CAAA,CAAE,MAAM,CAAA,SAAA,EAAY,CAAA,CAAE,KAAK,CAAA,CAAA;AAAA,OAC9F;AAAA,IACF;AAGA,IAAAK,aAAAA,CAAc,MAAM,OAAO,CAAA;AAG3B,IAAA,IAAI,OAAA,CAAQ,GAAA,IAAO,OAAA,CAAQ,GAAA,GAAM,IAAA,CAAK,MAAM,IAAA,CAAK,GAAA,EAAI,GAAI,GAAI,CAAA,EAAG;AAC9D,MAAA,MAAM,UAAA,GAAa,WAAA,CAAY,GAAA,EAAI,GAAI,SAAA;AACvC,MAAA,iBAAA,CAAkB,WAAW,iBAAA,EAAmB;AAAA,QAC9C,WAAA,EAAa,YAAY,UAAU,CAAA;AAAA,QACnC,KAAA,EAAO,KAAA;AAAA,QACP,UAAA,EAAY,SAAA;AAAA,QACZ,QAAQ,OAAA,CAAQ,GAAA;AAAA,QAChB,KAAK,MAAA,CAAO,GAAA;AAAA,QACZ;AAAA,OACD,CAAA;AACD,MAAA,OAAO;AAAA,QACL,EAAA,EAAI,KAAA;AAAA,QACJ,MAAA,EAAQ,SAAA;AAAA,QACR,OAAA,EAAS,sBAAsB,IAAI,IAAA,CAAK,QAAQ,GAAA,GAAM,GAAI,CAAA,CAAE,WAAA,EAAa,CAAA;AAAA,OAC3E;AAAA,IACF;AAGA,IAAA,MAAM,cAAA,GAAiB,YAAY,GAAA,EAAI;AACvC,IAAA,MAAM,UAAA,GAAa,MAAM,WAAA,CAAY,OAAA,CAAQ,GAAG,CAAA;AAEhD,IAAA,IAAI,CAAC,WAAW,EAAA,EAAI;AAClB,MAAA,OAAO;AAAA,QACL,EAAA,EAAI,KAAA;AAAA,QACJ,QAAQ,UAAA,CAAW,IAAA;AAAA,QACnB,SAAS,UAAA,CAAW;AAAA,OACtB;AAAA,IACF;AAEA,IAAA,IAAI,CAAC,WAAW,SAAA,EAAW;AACzB,MAAA,aAAA,GAAgB,WAAA,CAAY,KAAI,GAAI,cAAA;AAAA,IACtC;AAGA,IAAA,IAAI,WAAW,WAAA,EAAa;AAC1B,MAAA,MAAM,YAAA,GAAe,WAAW,WAAA,CAAY,IAAA,CAAK,CAAC,EAAA,KAAO,EAAA,CAAG,GAAA,KAAQ,MAAA,CAAO,GAAG,CAAA;AAC9E,MAAA,IAAI,YAAA,EAAc;AAChB,QAAA,MAAM,UAAA,GAAa,WAAA,CAAY,GAAA,EAAI,GAAI,SAAA;AACvC,QAAA,iBAAA,CAAkB,WAAW,iBAAA,EAAmB;AAAA,UAC9C,WAAA,EAAa,YAAY,UAAU,CAAA;AAAA,UACnC,KAAA,EAAO,KAAA;AAAA,UACP,UAAA,EAAY,aAAA;AAAA,UACZ,QAAQ,OAAA,CAAQ,GAAA;AAAA,UAChB,KAAK,MAAA,CAAO,GAAA;AAAA,UACZ;AAAA,SACD,CAAA;AACD,QAAA,OAAO;AAAA,UACL,EAAA,EAAI,KAAA;AAAA,UACJ,MAAA,EAAQ,aAAA;AAAA,UACR,OAAA,EAAS,CAAA,QAAA,EAAW,MAAA,CAAO,GAAG,mBAAmB,YAAA,CAAa,UAAU,CAAA,EAAG,YAAA,CAAa,MAAA,GAAS,CAAA,UAAA,EAAa,YAAA,CAAa,MAAM,MAAM,EAAE,CAAA;AAAA,SAC3I;AAAA,MACF;AAAA,IACF;AAGA,IAAA,MAAM,GAAA,GAAM,UAAA,CAAW,IAAA,CAAK,IAAA,CAAK,IAAA,CAAK,CAAC,CAAA,KAAM,CAAA,CAAE,GAAA,KAAQ,MAAA,CAAO,GAAG,CAAA;AACjE,IAAA,IAAI,CAAC,GAAA,EAAK;AACR,MAAA,MAAM,UAAA,GAAa,WAAA,CAAY,GAAA,EAAI,GAAI,SAAA;AACvC,MAAA,iBAAA,CAAkB,WAAW,iBAAA,EAAmB;AAAA,QAC9C,WAAA,EAAa,YAAY,UAAU,CAAA;AAAA,QACnC,KAAA,EAAO,KAAA;AAAA,QACP,UAAA,EAAY,aAAA;AAAA,QACZ,QAAQ,OAAA,CAAQ,GAAA;AAAA,QAChB,KAAK,MAAA,CAAO,GAAA;AAAA,QACZ;AAAA,OACD,CAAA;AACD,MAAA,OAAO;AAAA,QACL,EAAA,EAAI,KAAA;AAAA,QACJ,MAAA,EAAQ,aAAA;AAAA,QACR,OAAA,EAAS,CAAA,sBAAA,EAAyB,MAAA,CAAO,GAAG,CAAA;AAAA,OAC9C;AAAA,IACF;AAGA,IAAA,MAAM,SAAA,GAAY,eAAe,GAAG,CAAA;AAOpC,IAAA,MAAM,cAAA,GAAiB,2BAA2B,UAAU,CAAA;AAC5D,IAAA,IAAI,cAAA,KAAmB,IAAA,IAAQ,cAAA,KAAmB,uBAAA,EAAyB;AACzE,MAAA,MAAM,UAAA,GAAa,WAAA,CAAY,GAAA,EAAI,GAAI,SAAA;AACvC,MAAA,iBAAA,CAAkB,WAAW,iBAAA,EAAmB;AAAA,QAC9C,WAAA,EAAa,YAAY,UAAU,CAAA;AAAA,QACnC,KAAA,EAAO,KAAA;AAAA,QACP,UAAA,EAAY,mBAAA;AAAA,QACZ,QAAQ,OAAA,CAAQ,GAAA;AAAA,QAChB,KAAK,MAAA,CAAO,GAAA;AAAA,QACZ;AAAA,OACD,CAAA;AACD,MAAA,OAAO;AAAA,QACL,EAAA,EAAI,KAAA;AAAA,QACJ,MAAA,EAAQ,mBAAA;AAAA,QACR,OAAA,EAAS;AAAA,OACX;AAAA,IACF;AAGA,IAAA,MAAM,MAAA,GAAS,MAAMC,MAAA,CAA6B,UAAA,EAAY,SAAS,CAAA;AAEvE,IAAA,IAAI,CAAC,OAAO,KAAA,EAAO;AACjB,MAAA,MAAM,UAAA,GAAa,WAAA,CAAY,GAAA,EAAI,GAAI,SAAA;AACvC,MAAA,iBAAA,CAAkB,WAAW,iBAAA,EAAmB;AAAA,QAC9C,WAAA,EAAa,YAAY,UAAU,CAAA;AAAA,QACnC,KAAA,EAAO,KAAA;AAAA,QACP,UAAA,EAAY,mBAAA;AAAA,QACZ,QAAQ,OAAA,CAAQ,GAAA;AAAA,QAChB,KAAK,MAAA,CAAO,GAAA;AAAA,QACZ;AAAA,OACD,CAAA;AACD,MAAA,OAAO;AAAA,QACL,EAAA,EAAI,KAAA;AAAA,QACJ,MAAA,EAAQ,mBAAA;AAAA,QACR,OAAA,EAAS;AAAA,OACX;AAAA,IACF;AAIA,IAAA,MAAM,iBAAA,GAAoBC,wBAAwB,aAAa,CAAA;AAE/D,IAAA,MAAM,UAAA,GAAa,WAAA,CAAY,GAAA,EAAI,GAAI,SAAA;AAGvC,IAAA,iBAAA,CAAkB,WAAW,iBAAA,EAAmB;AAAA,MAC9C,WAAA,EAAa,YAAY,UAAU,CAAA;AAAA,MACnC,KAAA,EAAO,IAAA;AAAA,MACP,QAAQ,OAAA,CAAQ,GAAA;AAAA,MAChB,KAAK,MAAA,CAAO,GAAA;AAAA,MACZ,UAAA,EAAY;AAAA,KACb,CAAA;AAED,IAAA,OAAO;AAAA,MACL,EAAA,EAAI,IAAA;AAAA,MACJ,MAAA,EAAQ,OAAA;AAAA,MACR,GAAI,iBAAA,IAAqB,EAAE,gBAAA,EAAkB,iBAAA,EAAkB;AAAA,MAC/D,IAAA,EAAM;AAAA,QACJ,SAAA,EAAW,UAAA;AAAA,QACX,GAAI,aAAA,IAAiB,EAAE,aAAA,EAAe,aAAA;AAAc;AACtD,KACF;AAAA,EACF,CAAA,CAAA,MAAQ;AACN,IAAA,MAAM,UAAA,GAAa,WAAA,CAAY,GAAA,EAAI,GAAI,SAAA;AACvC,IAAA,iBAAA,CAAkB,WAAW,iBAAA,EAAmB;AAAA,MAC9C,WAAA,EAAa,YAAY,UAAU,CAAA;AAAA,MACnC,KAAA,EAAO,KAAA;AAAA,MACP,UAAA,EAAY,oBAAA;AAAA,MACZ;AAAA,KACD,CAAA;AAGD,IAAA,OAAO;AAAA,MACL,EAAA,EAAI,KAAA;AAAA,MACJ,MAAA,EAAQ,oBAAA;AAAA,MACR,OAAA,EAAS;AAAA,KACX;AAAA,EACF;AACF;;;AC1PO,SAAS,yBAAyB,KAAA,EAAyC;AAChF,EAA+B,OAAO,MAAA;AAExC;;;ACIA,SAAS,cAAc,GAAA,EAAsC;AAC3D,EAAA,OACE,GAAA,KAAQ,IAAA,IACR,OAAO,GAAA,KAAQ,QAAA,IACf,UAAU,GAAA,IACV,GAAA,CAAI,IAAA,KAAS,aAAA,IACb,MAAA,IAAU,GAAA,IACV,OAAO,GAAA,CAAI,IAAA,KAAS,QAAA,IACpB,GAAA,CAAI,IAAA,CAAK,UAAA,CAAW,SAAS,CAAA,IAC7B,SAAA,IAAa,GAAA,IACb,OAAO,GAAA,CAAI,OAAA,KAAY,QAAA;AAE3B;AAwOA,IAAM,kBAAA,uBAAyB,GAAA,CAAI;AAAA,EACjC,2BAAA;AAAA,EACA,oBAAA;AAAA,EACA,oBAAA;AAAA,EACA;AACF,CAAC,CAAA;AASD,IAAM,aAAA,GAAsD;AAAA,EAC1D,uBAAA,EAAyB,oBAAA;AAAA,EACzB,wBAAA,EAA0B,qBAAA;AAAA,EAC1B,sBAAA,EAAwB,mBAAA;AAAA,EACxB,uBAAA,EAAyB,oBAAA;AAAA,EACzB,uBAAA,EAAyB,oBAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAKzB,kCAAA,EAAoC,+BAAA;AAAA,EACpC,gCAAA,EAAkC,6BAAA;AAAA,EAClC,2BAAA,EAA6B;AAC/B,CAAA;AAGA,IAAM,gBAAA,GAAmB,EAAA;AAMzB,SAAS,oBACP,MAAA,EAC8D;AAC9D,EAAA,IAAI,CAAC,KAAA,CAAM,OAAA,CAAQ,MAAM,GAAG,OAAO,MAAA;AACnC,EAAA,OAAO,OAAO,KAAA,CAAM,CAAA,EAAG,gBAAgB,CAAA,CAAE,GAAA,CAAI,CAACR,MAAAA,MAAW;AAAA,IACvD,IAAA,EAAM,KAAA,CAAM,OAAA,CAAQA,MAAAA,EAAO,IAAI,IAAIA,MAAAA,CAAM,IAAA,CAAK,IAAA,CAAK,GAAG,CAAA,GAAI,EAAA;AAAA,IAC1D,OAAA,EAAS,OAAOA,MAAAA,EAAO,OAAA,KAAY,WAAWA,MAAAA,CAAM,OAAA,GAAU,OAAOA,MAAK;AAAA,GAC5E,CAAE,CAAA;AACJ;AAiCA,eAAsB,WAAA,CACpB,GAAA,EACA,SAAA,EACA,OAAA,GAA8B,EAAC,EACH;AAM5B,EAAA,MAAM,UAAA,GAAa,mBAAmB,OAAuC,CAAA;AAE7E,EAAA,MAAM;AAAA,IACJ,MAAA;AAAA,IACA,UAAA;AAAA,IACA,YAAA,GAAe,GAAA;AAAA,IACf,UAAA,GAAa,QAAA;AAAA,IACb,YAAA;AAAA,IACA,QAAA,EAAU;AAAA,GACZ,GAAI,OAAA;AACJ,EAAA,MAAM,GAAA,GAAM,QAAQ,GAAA,IAAO,IAAA,CAAK,MAAM,IAAA,CAAK,GAAA,KAAQ,GAAI,CAAA;AAEvD,EAAA,IAAI;AAQF,IAAA,MAAM,MAAA,GAAS,MAAM,YAAA,CAAa,MAAA,CAAgB,KAAK,SAAS,CAAA;AAEhE,IAAA,IAAI,CAAC,OAAO,KAAA,EAAO;AAIjB,MAAA,MAAM,cAAA,GAAiB,2BAA2B,GAAG,CAAA;AACrD,MAAA,MAAM,aAAA,GAAgB,cAAA,KAAmB,IAAA,IAAQ,cAAA,KAAmB,uBAAA;AACpE,MAAA,OAAO;AAAA,QACL,KAAA,EAAO,KAAA;AAAA,QACP,IAAA,EAAM,qBAAA;AAAA,QACN,OAAA,EAAS,gBACL,sCAAA,GACA;AAAA,OACN;AAAA,IACF;AAGA,IAAA,MAAM,sBAA6C,EAAC;AAGpD,IAAA,IAAI,MAAA,CAAO,MAAA,CAAO,GAAA,KAAQ,KAAA,CAAA,EAAW;AACnC,MAAA,IAAI,eAAe,QAAA,EAAU;AAC3B,QAAA,OAAO;AAAA,UACL,KAAA,EAAO,KAAA;AAAA,UACP,IAAA,EAAM,kBAAA;AAAA,UACN,OAAA,EAAS;AAAA,SACX;AAAA,MACF;AAEA,MAAA,mBAAA,CAAoB,IAAA,CAAK;AAAA,QACvB,IAAA,EAAM,mBAAA;AAAA,QACN,OAAA,EAAS;AAAA,OACV,CAAA;AAAA,IACH;AAiBA,IAAA,IAAI,EAAA;AAEJ,IAAA,IAAI,UAAA,EAAY;AACd,MAAA,MAAM,gBAAA,GAAmBC,yBAAAA,CAA0B,MAAA,CAAO,OAAO,CAAA;AACjE,MAAA,IAAI,CAAC,iBAAiB,KAAA,EAAO;AAC3B,QAAA,MAAM,CAAA,GAAI,gBAAA,CAAiB,UAAA,CAAW,CAAC,CAAA;AACvC,QAAA,OAAO;AAAA,UACL,KAAA,EAAO,KAAA;AAAA,UACP,IAAA,EAAM,wBAAA;AAAA,UACN,OAAA,EAAS,+BAA+B,CAAA,CAAE,UAAU,aAAa,CAAA,CAAE,MAAM,CAAA,SAAA,EAAY,CAAA,CAAE,KAAK,CAAA,CAAA;AAAA,SAC9F;AAAA,MACF;AACA,MAAA,MAAM,MAAA,GAASQ,kBAAAA,CAAmB,MAAA,CAAO,OAAO,CAAA;AAChD,MAAA,IAAI,CAAC,OAAO,EAAA,EAAI;AACd,QAAA,OAAO;AAAA,UACL,KAAA,EAAO,KAAA;AAAA,UACP,IAAA,EAAM,kBAAA;AAAA,UACN,OAAA,EAAS,CAAA,kCAAA,EAAqC,MAAA,CAAO,KAAA,CAAM,OAAO,CAAA,CAAA;AAAA,UAClE,OAAA,EAAS;AAAA,YACP,UAAA,EAAY,OAAO,KAAA,CAAM,IAAA;AAAA,YACzB,MAAA,EAAQ,mBAAA,CAAoB,MAAA,CAAO,KAAA,CAAM,MAAM;AAAA;AACjD,SACF;AAAA,MACF;AACA,MAAA,EAAA,GAAK,MAAA;AAAA,IACP,CAAA,MAAO;AACL,MAAA,MAAM,aAAa,wBAAA,CAAyB;AAAA,QAC1C,OAAA,EAAS,aAAA;AAAA,QACT,SAAS,MAAA,CAAO;AAAA,OACjB,CAAA;AACD,MAAA,IAAI,CAAC,WAAW,EAAA,EAAI;AAClB,QAAA,OAAO;AAAA,UACL,KAAA,EAAO,KAAA;AAAA,UACP,MAAM,UAAA,CAAW,IAAA;AAAA,UACjB,SAAS,UAAA,CAAW,OAAA;AAAA,UACpB,GAAI,UAAA,CAAW,OAAA,KAAY,UAAa,EAAE,OAAA,EAAS,WAAW,OAAA;AAAQ,SACxE;AAAA,MACF;AACA,MAAA,MAAM,iBAAiB,UAAA,CAAW,MAAA;AAClC,MAAA,IAAI,mBAAmB,KAAA,CAAA,EAAW;AAChC,QAAA,OAAO;AAAA,UACL,KAAA,EAAO,KAAA;AAAA,UACP,IAAA,EAAM,YAAA;AAAA,UACN,OAAA,EAAS;AAAA,SACX;AAAA,MACF;AACA,MAAA,EAAA,GAAK;AAAA,QACH,EAAA,EAAI,IAAA;AAAA,QACJ,aAAa,cAAA,CAAe,WAAA;AAAA,QAC5B,UAAU,cAAA,CAAe,cAAA;AAAA,QACzB,QAAQ,cAAA,CAAe;AAAA,OACzB;AAAA,IACF;AAGA,IAAA,IAAI,EAAA,CAAG,gBAAgB,KAAA,EAAO;AAC5B,MAAA,mBAAA,CAAoB,IAAA,CAAK,GAAG,EAAA,CAAG,QAAQ,CAAA;AAAA,IACzC;AAGA,IAAA,IAAI,EAAA,CAAG,gBAAgB,KAAA,EAAO;AAC5B,MAAA,MAAM,SAAS,EAAA,CAAG,MAAA;AAOlB,MAAA,wBAAA,CAAyB,EAAE,IAAA,EAAM,UAAA,EAAY,MAAA,EAAQ,CAAA;AAGrD,MAAA,IAAI,MAAA,KAAW,KAAA,CAAA,IAAa,MAAA,CAAO,GAAA,KAAQ,MAAA,EAAQ;AACjD,QAAA,OAAO;AAAA,UACL,KAAA,EAAO,KAAA;AAAA,UACP,IAAA,EAAM,kBAAA;AAAA,UACN,OAAA,EAAS,CAAA,2BAAA,EAA8B,MAAM,CAAA,QAAA,EAAW,OAAO,GAAG,CAAA,CAAA;AAAA,SACpE;AAAA,MACF;AAGA,MAAA,IAAI,UAAA,KAAe,KAAA,CAAA,IAAa,MAAA,CAAO,GAAA,KAAQ,UAAA,EAAY;AACzD,QAAA,OAAO;AAAA,UACL,KAAA,EAAO,KAAA;AAAA,UACP,IAAA,EAAM,mBAAA;AAAA,UACN,SAAS,CAAA,4BAAA,EAA+B,UAAU,CAAA,QAAA,EAAW,MAAA,CAAO,OAAO,WAAW,CAAA,CAAA;AAAA,SACxF;AAAA,MACF;AAGA,MAAA,IAAI,MAAA,CAAO,GAAA,GAAM,GAAA,GAAM,YAAA,EAAc;AACnC,QAAA,OAAO;AAAA,UACL,KAAA,EAAO,KAAA;AAAA,UACP,IAAA,EAAM,iBAAA;AAAA,UACN,SAAS,CAAA,iCAAA,EAAoC,IAAI,IAAA,CAAK,MAAA,CAAO,MAAM,GAAI,CAAA,CAAE,WAAA,EAAa,YAAY,IAAI,IAAA,CAAK,MAAM,GAAI,CAAA,CAAE,aAAa,CAAA;AAAA,SACtI;AAAA,MACF;AAGA,MAAA,IAAI,MAAA,CAAO,SAAS,UAAA,EAAY;AAC9B,QAAA,MAAM,aAAa,mBAAA,CAAoB,MAAA,CAAO,aAAa,MAAA,CAAO,GAAA,EAAK,KAAK,YAAY,CAAA;AACxF,QAAA,IAAI,eAAe,cAAA,EAAgB;AACjC,UAAA,OAAO;AAAA,YACL,KAAA,EAAO,KAAA;AAAA,YACP,IAAA,EAAM,sBAAA;AAAA,YACN,OAAA,EAAS,kDAAkD,YAAY,CAAA,EAAA;AAAA,WACzE;AAAA,QACF;AACA,QAAA,IAAI,eAAe,IAAA,EAAM;AACvB,UAAA,mBAAA,CAAoB,KAAK,UAAU,CAAA;AAAA,QACrC;AAAA,MACF;AAGA,MAAA,IAAI,CAACC,wBAAAA,CAAyB,GAAA,CAAI,MAAA,CAAO,IAAI,CAAA,EAAG;AAC9C,QAAA,mBAAA,CAAoB,IAAA,CAAK;AAAA,UACvB,IAAA,EAAMC,yBAAAA;AAAA,UACN,OAAA,EAAS,sDAAA;AAAA,UACT,OAAA,EAAS;AAAA,SACV,CAAA;AAAA,MACH;AAIA,MAAA,IAAI,MAAA,CAAO,eAAe,KAAA,CAAA,EAAW;AACnC,QAAA,KAAA,MAAW,GAAA,IAAO,MAAA,CAAO,IAAA,CAAK,MAAA,CAAO,UAAU,CAAA,EAAG;AAChD,UAAA,IAAI,CAACf,+BAAAA,CAAgC,GAAA,CAAI,GAAG,CAAA,IAAKC,mBAAAA,CAAoB,GAAG,CAAA,EAAG;AAEzE,YAAA,MAAM,UAAA,GAAa,IAAI,OAAA,CAAQ,IAAA,EAAM,IAAI,CAAA,CAAE,OAAA,CAAQ,OAAO,IAAI,CAAA;AAC9D,YAAA,mBAAA,CAAoB,IAAA,CAAK;AAAA,cACvB,IAAA,EAAMe,yBAAAA;AAAA,cACN,OAAA,EAAS,2DAAA;AAAA,cACT,OAAA,EAAS,eAAe,UAAU,CAAA;AAAA,aACnC,CAAA;AAAA,UACH;AAAA,QACF;AAAA,MACF;AAGA,MAAA,MAAM,YAAA,GAAe,yBAAA;AAAA,QACnB,MAAA,CAAO,IAAA;AAAA,QACP,MAAA,CAAO,IAAA;AAAA,QACP,MAAA,CAAO,UAAA;AAAA,QACPb,qBAAAA;AAAA,QACAH;AAAA,OACF;AAEA,MAAA,IAAI,YAAA,CAAa,MAAA,KAAW,SAAA,IAAa,YAAA,CAAa,WAAW,UAAA,EAAY;AAC3E,QAAA,MAAM,WAAA,GACJ,YAAA,CAAa,MAAA,KAAW,SAAA,GACpBiB,+BAAAA,GACAC,gCAAAA;AACN,QAAA,MAAM,SAAA,GACJ,YAAA,CAAa,MAAA,KAAW,SAAA,GACpB,4BAAA,GACA,4BAAA;AAEN,QAAA,IAAI,eAAe,QAAA,EAAU;AAC3B,UAAA,OAAO;AAAA,YACL,KAAA,EAAO,KAAA;AAAA,YACP,IAAA,EAAM,SAAA;AAAA,YACN,OAAA,EAAS,CAAA,MAAA,EAAS,MAAA,CAAO,IAAI,CAAA,2BAAA,EAA8B,YAAA,CAAa,wBAAwB,CAAA,YAAA,EAAe,YAAA,CAAa,MAAA,KAAW,UAAA,GAAa,0CAAA,GAA6C,QAAQ,CAAA,CAAA;AAAA,YACzM,OAAA,EAAS;AAAA,cACP,MAAM,MAAA,CAAO,IAAA;AAAA,cACb,0BAA0B,YAAA,CAAa,wBAAA;AAAA,cACvC,qCAAqC,YAAA,CAAa;AAAA;AACpD,WACF;AAAA,QACF;AAGA,QAAA,mBAAA,CAAoB,IAAA,CAAK;AAAA,UACvB,IAAA,EAAM,WAAA;AAAA,UACN,SAAS,CAAA,MAAA,EAAS,MAAA,CAAO,IAAI,CAAA,2BAAA,EAA8B,aAAa,wBAAwB,CAAA,CAAA,CAAA;AAAA,UAChG,OAAA,EAAS;AAAA,SACV,CAAA;AAAA,MACH;AAGA,MAAA,IAAI,iBAAiB,KAAA,CAAA,IAAa,CAAC,KAAK,OAAA,CAAQ,IAAA,CAAK,YAAY,CAAA,EAAG;AAClE,QAAA,OAAO;AAAA,UACL,KAAA,EAAO,KAAA;AAAA,UACP,IAAA,EAAM,kBAAA;AAAA,UACN,OAAA,EAAS;AAAA,SACX;AAAA,MACF;AAKA,MAAA,MAAM,mBAAA,GAAsB,OAAO,MAAA,EAAQ,MAAA;AAC3C,MAAA,MAAM,aAAA,GACJ,wBAAwB,KAAA,CAAA,IAAa,YAAA,KAAiB,SAClD,aAAA,GACAC,mBAAAA,CAAoB,qBAAqB,YAAY,CAAA;AAC3D,MAAA,IAAI,kBAAkB,QAAA,EAAU;AAC9B,QAAA,OAAO;AAAA,UACL,KAAA,EAAO,KAAA;AAAA,UACP,IAAA,EAAM,yBAAA;AAAA,UACN,OAAA,EAAS,gFAAA;AAAA,UACT,OAAA,EAAS;AAAA,YACP,qBAAA,EAAuB,mBAAA;AAAA,YACvB,mBAAA,EAAqB,YAAA;AAAA,YACrB,GAAI,OAAO,MAAA,EAAQ,GAAA,KAAQ,UAAa,EAAE,UAAA,EAAY,MAAA,CAAO,MAAA,CAAO,GAAA;AAAI;AAC1E,SACF;AAAA,MACF;AAOA,MAAA,MAAM,QAAA,GAA2D;AAAA,QAC/D,MAAA,EAAQ,aAAA;AAAA,QACR,GAAI,cAAA,EAAgB,KAAA,KAAU,UAAa,EAAE,KAAA,EAAO,eAAe,KAAA,EAAM;AAAA,QACzE,GAAI,cAAA,EAAgB,SAAA,KAAc,KAAA,CAAA,IAChC,cAAA,CAAe,SAAA,CAAU,MAAA,GAAS,CAAA,IAAK,EAAE,SAAA,EAAW,cAAA,CAAe,SAAA;AAAU,OACjF;AAEA,MAAA,MAAM,cAAA,GAAiB,aAAa,mBAAmB,CAAA;AAOvD,MAAA,IAAI,UAAA,IAAc,eAAA,CAAgB,OAAyC,CAAA,EAAG;AAC5E,QAAA,MAAM,cAAA,GAAiB,EAAE,GAAG,MAAA,CAAO,MAAA,EAAO;AAC1C,QAAA,cAAA,CAAkC;AAAA,UAChC,IAAA,EAAM,aAAA;AAAA,UACN,UAAA,EAAY,qCAAqC,cAAc,CAAA;AAAA,UAC/D,SAAA,EAAW,KAAA,CAAA;AAAA,UACX,UAAU,YACR,4BAAA;AAAA,YACE,yBAAA,CAA0B;AAAA,cACxB,MAAA,EAAQ;AAAA,gBACN,MAAM,MAAA,CAAO,IAAA;AAAA,gBACb,MAAM,MAAA,CAAO,IAAA;AAAA,gBACb,KAAK,MAAA,CAAO,GAAA;AAAA,gBACZ,KAAK,MAAA,CAAO,GAAA;AAAA,gBACZ,aAAa,MAAA,CAAO,WAAA;AAAA,gBACpB,YAAY,MAAA,CAAO;AAAA,eACrB;AAAA,cACA,MAAA,EAAQ,cAAA;AAAA,cACR;AAAA,aACD;AAAA,WACH;AAAA,UACF,SAAA,EAAW;AAAA,SACZ,CAAA;AAAA,MACH;AAEA,MAAA,OAAO;AAAA,QACL,KAAA,EAAO,IAAA;AAAA,QACP,OAAA,EAAS,SAAA;AAAA,QACT,MAAA;AAAA,QACA,GAAA,EAAK,OAAO,MAAA,CAAO,GAAA;AAAA,QACnB,WAAA,EAAa,KAAA;AAAA,QACb,QAAA,EAAU,cAAA;AAAA,QACV,cAAA,EAAgB,aAAA;AAAA,QAChB;AAAA,OACF;AAAA,IACF;AAGA,IAAA,OAAO;AAAA,MACL,KAAA,EAAO,KAAA;AAAA,MACP,IAAA,EAAM,4BAAA;AAAA,MACN,OAAA,EAAS;AAAA,KACX;AAAA,EACF,SAAS,GAAA,EAAK;AAMZ,IAAA,IAAI,aAAA,CAAc,GAAG,CAAA,EAAG;AAEtB,MAAA,IAAI,OAAO,SAAA,CAAU,cAAA,CAAe,KAAK,aAAA,EAAe,GAAA,CAAI,IAAI,CAAA,EAAG;AACjE,QAAA,OAAO;AAAA,UACL,KAAA,EAAO,KAAA;AAAA,UACP,IAAA,EAAM,aAAA,CAAc,GAAA,CAAI,IAAI,CAAA;AAAA,UAC5B,SAAS,GAAA,CAAI;AAAA,SACf;AAAA,MACF;AAEA,MAAA,IAAI,kBAAA,CAAmB,GAAA,CAAI,GAAA,CAAI,IAAI,CAAA,EAAG;AACpC,QAAA,OAAO;AAAA,UACL,KAAA,EAAO,KAAA;AAAA,UACP,IAAA,EAAM,kBAAA;AAAA,UACN,SAAS,GAAA,CAAI;AAAA,SACf;AAAA,MACF;AACA,MAAA,IAAI,GAAA,CAAI,SAAS,0BAAA,EAA4B;AAC3C,QAAA,OAAO;AAAA,UACL,KAAA,EAAO,KAAA;AAAA,UACP,IAAA,EAAM,qBAAA;AAAA,UACN,SAAS,GAAA,CAAI;AAAA,SACf;AAAA,MACF;AACA,MAAA,IAAI,GAAA,CAAI,SAAS,8BAAA,EAAgC;AAC/C,QAAA,OAAO;AAAA,UACL,KAAA,EAAO,KAAA;AAAA,UACP,IAAA,EAAM,yBAAA;AAAA,UACN,SAAS,GAAA,CAAI;AAAA,SACf;AAAA,MACF;AAAA,IACF;AAIA,IAAA,IACE,GAAA,KAAQ,QACR,OAAO,GAAA,KAAQ,YACf,MAAA,IAAU,GAAA,IACT,GAAA,CAA0B,IAAA,KAAS,aAAA,EACpC;AACA,MAAA,MAAM,aAAA,GACJ,aAAa,GAAA,IAAO,OAAQ,IAA6B,OAAA,KAAY,QAAA,GAChE,IAA4B,OAAA,GAC7B,cAAA;AACN,MAAA,OAAO;AAAA,QACL,KAAA,EAAO,KAAA;AAAA,QACP,IAAA,EAAM,kBAAA;AAAA,QACN,OAAA,EAAS,4BAA4B,aAAa,CAAA;AAAA,OACpD;AAAA,IACF;AASA,IAAA,MAAM,cAAA,GAAiB,2BAA2B,GAAG,CAAA;AACrD,IAAA,IAAI,cAAA,KAAmB,IAAA,IAAQ,cAAA,KAAmB,uBAAA,EAAyB;AACzE,MAAA,OAAO;AAAA,QACL,KAAA,EAAO,KAAA;AAAA,QACP,IAAA,EAAM,qBAAA;AAAA,QACN,OAAA,EAAS;AAAA,OACX;AAAA,IACF;AAKA,IAAA,OAAO;AAAA,MACL,KAAA,EAAO,KAAA;AAAA,MACP,IAAA,EAAM,YAAA;AAAA,MACN,OAAA,EAAS;AAAA,KACX;AAAA,EACF;AACF;AAMO,SAAS,iBACd,CAAA,EACkD;AAElD,EAAA,OAAO,KAAA;AACT;AAMO,SAAS,oBACd,CAAA,EACkD;AAElD,EAAA,OAAO,KAAA;AACT;AAQO,SAAS,eACd,CAAA,EACkD;AAClD,EAAA,OAAO,CAAA,CAAE,KAAA,KAAU,IAAA,IAAQ,CAAA,CAAE,OAAA,KAAY,SAAA;AAC3C;ACrzBO,SAAS,gBAAA,CAAiB,SAAkB,UAAA,EAA0B;AAC3E,EAAA,OAAA,CAAQ,GAAA,CAAI,qBAAqB,UAAU,CAAA;AAC7C;AAQO,SAAS,iBAAiB,OAAA,EAAiC;AAChE,EAAA,OAAO,OAAA,CAAQ,IAAI,mBAAmB,CAAA;AACxC;AAOO,SAAS,cAAc,OAAA,EAAwB;AACpD,EAAA,MAAM,QAAA,GAAW,OAAA,CAAQ,GAAA,CAAI,MAAM,CAAA;AACnC,EAAA,IAAI,QAAA,EAAU;AAEZ,IAAA,MAAM,MAAA,GAAS,QAAA,CAAS,KAAA,CAAM,GAAG,CAAA,CAAE,IAAI,CAAC,CAAA,KAAM,CAAA,CAAE,IAAA,EAAM,CAAA;AACtD,IAAA,IAAI,CAAC,MAAA,CAAO,QAAA,CAAS,mBAAmB,CAAA,EAAG;AACzC,MAAA,OAAA,CAAQ,IAAI,MAAA,EAAQ,CAAA,EAAG,QAAQ,CAAA,EAAA,EAAK,mBAAmB,CAAA,CAAE,CAAA;AAAA,IAC3D;AAAA,EACF,CAAA,MAAO;AACL,IAAA,OAAA,CAAQ,GAAA,CAAI,QAAQ,mBAAmB,CAAA;AAAA,EACzC;AACF;AAeO,SAAS,iBAAiB,OAAA,EAAkC;AACjE,EAAA,MAAM,KAAA,GAAQ,OAAA,CAAQ,GAAA,CAAI,mBAAmB,CAAA;AAC7C,EAAA,IAAI,CAAC,KAAA,EAAO;AACV,IAAA,OAAO,EAAC;AAAA,EACV;AACA,EAAA,OAAO,mBAAmB,KAAK,CAAA;AACjC;AAUO,SAAS,uBAAA,CAAwB,SAAkB,OAAA,EAAiC;AACzF,EAAA,OAAA,CAAQ,GAAA,CAAI,6BAA6B,OAAO,CAAA;AAClD;AAUO,SAAS,sBAAA,CAAuB,SAAkB,MAAA,EAA6B;AACpF,EAAA,OAAA,CAAQ,GAAA,CAAI,4BAA4B,MAAM,CAAA;AAChD;AASO,SAAS,qBAAqB,OAAA,EAAwB;AAC3D,EAAA,MAAM,QAAA,GAAW,OAAA,CAAQ,GAAA,CAAI,MAAM,CAAA;AACnC,EAAA,IAAI,QAAA,EAAU;AACZ,IAAA,MAAM,MAAA,GAAS,QAAA,CAAS,KAAA,CAAM,GAAG,CAAA,CAAE,IAAI,CAAC,CAAA,KAAM,CAAA,CAAE,IAAA,EAAM,CAAA;AACtD,IAAA,IAAI,CAAC,MAAA,CAAO,QAAA,CAAS,mBAAmB,CAAA,EAAG;AACzC,MAAA,OAAA,CAAQ,IAAI,MAAA,EAAQ,CAAA,EAAG,QAAQ,CAAA,EAAA,EAAK,mBAAmB,CAAA,CAAE,CAAA;AAAA,IAC3D;AAAA,EACF,CAAA,MAAO;AACL,IAAA,OAAA,CAAQ,GAAA,CAAI,QAAQ,mBAAmB,CAAA;AAAA,EACzC;AACF;AC1EA,eAAsB,6BAA6B,KAAA,EAAmC;AACpF,EAAA,MAAM,GAAA,GAAM,MAAM,OAAA,CAAQ,KAAK,CAAA;AAC/B,EAAA,OAAO,CAAA,EAAGC,IAAAA,CAAK,MAAM,CAAA,EAAG,GAAG,CAAA,CAAA;AAC7B;AA0BA,eAAsB,6BAAA,CACpB,OACA,eAAA,EACiB;AACjB,EAAA,MAAM,UAAA,GAAa,KAAA,CAAM,OAAA,CAAQ,OAAA,EAAS,IAAI,CAAA,CAAE,OAAA,CAAQ,KAAA,EAAO,IAAI,CAAA,CAAE,SAAA,CAAU,KAAK,CAAA;AACpF,EAAA,MAAM,GAAA,GAAM,IAAI,WAAA,EAAY,CAAE,OAAO,UAAU,CAAA;AAC/C,EAAA,MAAM,aAAa,MAAM,MAAA,CAAO,MAAA,CAAO,MAAA,CAAO,WAAW,GAAG,CAAA;AAC5D,EAAA,MAAM,YAAY,KAAA,CAAM,IAAA,CAAK,IAAI,UAAA,CAAW,UAAU,CAAC,CAAA;AACvD,EAAA,MAAM,GAAA,GAAM,SAAA,CAAU,GAAA,CAAI,CAAC,MAAM,CAAA,CAAE,QAAA,CAAS,EAAE,CAAA,CAAE,SAAS,CAAA,EAAG,GAAG,CAAC,CAAA,CAAE,KAAK,EAAE,CAAA;AACzE,EAAA,OAAO,CAAA,EAAGA,IAAAA,CAAK,MAAM,CAAA,EAAG,GAAG,CAAA,CAAA;AAC7B;AAaA,eAAsB,sBACpB,KAAA,EAIiC;AACjC,EAAA,QAAQ,MAAM,cAAA;AAAgB,IAC5B,KAAK,MAAA;AACH,MAAA,OAAO,4BAAA,CAA6B,MAAM,KAAK,CAAA;AAAA,IACjD,KAAK,UAAA;AAAA,IACL,KAAK,WAAA;AACH,MAAA,OAAO,6BAAA,CAA8B,KAAA,CAAM,KAAA,EAAO,KAAA,CAAM,cAAc,CAAA;AAAA,IACxE,KAAK,KAAA;AACH,MAAA,IAAI,OAAO,KAAA,CAAM,KAAA,KAAU,QAAA,EAAU,OAAO,aAAA;AAC5C,MAAA,OAAO,6BAAA,CAA8B,KAAA,CAAM,KAAkB,CAAA;AAAA;AAEnE;AAWO,SAAS,oBAAA,CACd,eACA,WAAA,EACqB;AACrB,EAAA,IAAI,aAAA,KAAkB,MAAA,IAAa,WAAA,KAAgB,MAAA,EAAW;AAC5D,IAAA,OAAO,aAAA;AAAA,EACT;AACA,EAAA,OAAOD,mBAAAA,CAAoB,eAAe,WAAW,CAAA;AACvD;;;ACtFA,eAAsB,uBAAuB,MAAA,EAAoC;AAC/E,EAAA,OAAO,6BAA6B,MAAM,CAAA;AAC5C;AAwBO,SAAS,kBAAA,CACd,eACA,WAAA,EACqB;AACrB,EAAA,OAAO,oBAAA,CAAqB,eAAe,WAAW,CAAA;AACxD;ACiGO,IAAM,uBAAA,GAA0C;AAAA,EACrD,mBAAmBV,eAAAA,CAAgB,eAAA;AAAA,EACnC,gBAAgBA,eAAAA,CAAgB,YAAA;AAAA,EAChC,eAAeA,eAAAA,CAAgB,WAAA;AAAA,EAC/B,eAAeA,eAAAA,CAAgB,YAAA;AAAA,EAC/B,kBAAkBA,eAAAA,CAAgB,cAAA;AAAA,EAClC,qBAAqBA,eAAAA,CAAgB;AACvC;AAiCO,IAAM,wBAAA,GAA4C;AAAA,EACvD,YAAYY,gBAAAA,CAAiB,SAAA;AAAA,EAC7B,mBAAmBA,gBAAAA,CAAiB,eAAA;AAAA,EACpC,iBAAiBA,gBAAAA,CAAiB,cAAA;AAAA,EAClC,4BAAA,EAA8B,IAAA;AAAA;AAAA,EAC9B,oBAAA,EAAsB;AAAA;AACxB;AA8BO,SAAS,oBAAoB,IAAA,EAAwC;AAC1E,EAAA,OAAO;AAAA,IACL,cAAA,EAAgB,uBAAA;AAAA,IAChB,IAAA;AAAA,IACA,MAAA,EAAQ,EAAE,GAAG,uBAAA,EAAwB;AAAA,IACrC,OAAA,EAAS,EAAE,GAAG,wBAAA;AAAyB,GACzC;AACF;AAmCO,IAAM,SAAA,GAAY;AAAA,EACvB,WAAA;AAAA,EACA,sBAAA;AAAA,EACA,sBAAA;AAAA,EACA,0BAAA;AAAA,EACA,qBAAA;AAAA,EACA,kBAAA;AAAA,EACA,aAAA;AAAA,EACA,eAAA;AAAA,EACA,oBAAA;AAAA,EACA,mBAAA;AAAA,EACA,2BAAA;AAAA,EACA;AACF;AA2LO,IAAM,+BAAA,GAAmE;AAAA,EAC9E;AACF;AA+DO,SAAS,aAAa,QAAA,EAAgC;AAC3D,EAAA,OAAO;AAAA,IACL,GAAA,EAAK,SAAA;AAAA,IACL,KAAA,EAAO,SAAS,WAAA;AAAY,GAC9B;AACF;AAKO,SAAS,kBACd,MAAA,EACyD;AACzD,EAAA,OAAO;AAAA,IACL,cAAA,EAAgB,2BAAA;AAAA,IAChB;AAAA,GACF;AACF;AAKO,SAAS,qBAAA,CACd,YACA,SAAA,EACY;AACZ,EAAA,MAAM,MAAA,GAAS,SAAA,KAAc,KAAA,GAAQ,WAAA,GAAc,eAAA;AAEnD,EAAA,QAAQ,UAAA;AAAY,IAClB,KAAK,WAAA;AAAA,IACL,KAAK,YAAA;AAAA,IACL,KAAK,UAAA;AAAA,IACL,KAAK,YAAA;AAAA,IACL,KAAK,uBAAA;AAAA,IACL,KAAK,aAAA;AACH,MAAA,OAAO,GAAG,MAAM,CAAA,QAAA,CAAA;AAAA,IAClB,KAAK,SAAA;AACH,MAAA,OAAO,GAAG,MAAM,CAAA,QAAA,CAAA;AAAA,IAClB,KAAK,oBAAA;AACH,MAAA,OAAO,SAAA,KAAc,YAAY,yBAAA,GAA4B,gBAAA;AAAA,IAC/D,KAAK,oBAAA;AACH,MAAA,OAAO,oBAAA;AAAA,IACT,KAAK,oBAAA;AAAA,IACL,KAAK,kBAAA;AAAA,IACL,KAAK,eAAA;AAAA,IACL,KAAK,aAAA;AAAA,IACL;AACE,MAAA,OAAO,GAAG,MAAM,CAAA,OAAA,CAAA;AAAA;AAEtB;AAKO,SAAS,qBAAqB,MAAA,EAAoC;AACvE,EAAA,IAAI,MAAA,KAAW,MAAM,OAAO,MAAA;AAC5B,EAAA,OAAO,OAAA;AACT;AAKO,SAAS,sBAAsB,MAAA,EAA4B;AAChE,EAAA,MAAM,OAAA,GAAsC;AAAA,IAC1C,EAAA,EAAI,EAAA;AAAA,IACJ,iBAAA,EAAmB,4BAAA;AAAA,IACnB,iBAAA,EAAmB,4BAAA;AAAA,IACnB,iBAAA,EAAmB,4BAAA;AAAA,IACnB,kBAAA,EAAoB,6BAAA;AAAA,IACpB,aAAA,EAAe,wBAAA;AAAA,IACf,iBAAA,EAAmB,4BAAA;AAAA,IACnB,gBAAA,EAAkB,2BAAA;AAAA,IAClB,iBAAA,EAAmB,4BAAA;AAAA,IACnB,qBAAA,EAAuB,gCAAA;AAAA,IACvB,oBAAA,EAAsB,+BAAA;AAAA,IACtB,qBAAA,EAAuB,gCAAA;AAAA,IACvB,uBAAA,EAAyB,kCAAA;AAAA,IACzB,uBAAA,EAAyB,kCAAA;AAAA,IACzB,cAAA,EAAgB,yBAAA;AAAA,IAChB,kBAAA,EAAoB,6BAAA;AAAA,IACpB,OAAA,EAAS,kBAAA;AAAA,IACT,aAAA,EAAe,wBAAA;AAAA,IACf,iBAAA,EAAmB,4BAAA;AAAA,IACnB,cAAA,EAAgB,yBAAA;AAAA,IAChB,gBAAA,EAAkB,2BAAA;AAAA,IAClB,mBAAA,EAAqB,8BAAA;AAAA,IACrB,iBAAA,EAAmB;AAAA,GACrB;AACA,EAAA,OAAO,OAAA,CAAQ,MAAM,CAAA,IAAK,2BAAA;AAC5B;AC3kBO,IAAM,4BAAN,MAAgC;AAAA,EAC7B,KAAA;AAAA,EAER,YAAY,MAAA,EAAwB;AAClC,IAAA,IAAA,CAAK,KAAA,GAAQ;AAAA,MACX,MAAA;AAAA,MACA,MAAA,sBAAY,GAAA,EAAI;AAAA,MAChB,cAAA,EAAgB;AAAA,KAClB;AAAA,EACF;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAUA,kBAAA,CACE,SAAA,EACA,IAAA,GAAuC,aAAA,EACjC;AACN,IAAA,IAAA,CAAK,MAAM,gBAAA,GAAmB,SAAA;AAC9B,IAAA,IAAA,CAAK,MAAM,KAAA,GAAQ;AAAA,MACjB,IAAA;AAAA,MACA,cAAA,EAAgB,aAAa,SAAS;AAAA,KACxC;AACA,IAAA,OAAO,IAAA;AAAA,EACT;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAQA,MAAM,aAAA,CACJ,YAAA,EACA,IAAA,GAAuC,aAAA,EACxB;AACf,IAAA,MAAM,SAAA,GAAY,MAAMC,SAAAA,CAAU,YAAY,CAAA;AAC9C,IAAA,OAAO,IAAA,CAAK,kBAAA,CAAmB,SAAA,EAAW,IAAI,CAAA;AAAA,EAChD;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAQA,QAAA,CACE,EAAA,EACA,MAAA,EACA,MAAA,EACA,SAAA,EACM;AACN,IAAA,MAAM,KAAA,GAAqB,EAAE,EAAA,EAAI,MAAA,EAAO;AACxC,IAAA,IAAI,UAAU,MAAA,CAAO,IAAA,CAAK,MAAM,CAAA,CAAE,SAAS,CAAA,EAAG;AAC5C,MAAA,KAAA,CAAM,MAAA,GAAS,MAAA;AAAA,IACjB;AACA,IAAA,IAAI,SAAA,EAAW;AACb,MAAA,KAAA,CAAM,UAAA,GAAa,SAAA;AAAA,IACrB;AAEA,IAAA,IAAA,CAAK,KAAA,CAAM,MAAA,CAAO,GAAA,CAAI,EAAA,EAAI,KAAK,CAAA;AAG/B,IAAA,IAAI,MAAA,KAAW,MAAA,IAAU,CAAC,IAAA,CAAK,MAAM,cAAA,EAAgB;AACnD,MAAA,IAAA,CAAK,MAAM,cAAA,GAAiB,IAAA;AAC5B,MAAA,IAAA,CAAK,MAAM,aAAA,GAAgB,EAAA;AAAA,IAC7B;AAEA,IAAA,OAAO,IAAA;AAAA,EACT;AAAA;AAAA;AAAA;AAAA,EAKA,IAAA,CAAK,IAAa,MAAA,EAAwC;AACxD,IAAA,OAAO,IAAA,CAAK,QAAA,CAAS,EAAA,EAAI,MAAA,EAAQ,MAAM,CAAA;AAAA,EACzC;AAAA;AAAA;AAAA;AAAA,EAKA,IAAA,CAAK,EAAA,EAAa,SAAA,EAAmB,MAAA,EAAwC;AAC3E,IAAA,OAAO,IAAA,CAAK,QAAA,CAAS,EAAA,EAAI,MAAA,EAAQ,QAAQ,SAAS,CAAA;AAAA,EACpD;AAAA;AAAA;AAAA;AAAA,EAKA,IAAA,CAAK,IAAa,MAAA,EAAwC;AACxD,IAAA,OAAO,IAAA,CAAK,QAAA,CAAS,EAAA,EAAI,MAAA,EAAQ,MAAM,CAAA;AAAA,EACzC;AAAA;AAAA;AAAA;AAAA,EAKA,SAAA,CACE,KAAA,EACA,MAAA,EACA,OAAA,EAKM;AACN,IAAA,IAAA,CAAK,MAAM,MAAA,GAAS;AAAA,MAClB,KAAA;AAAA,MACA,MAAA;AAAA,MACA,QAAA,EAAU,qBAAqB,MAAM,CAAA;AAAA,MACrC,YAAA,EAAc,SAAS,WAAA,IAAe,SAAA;AAAA;AAAA,MAEtC,cAAA,EAAgB,aAAA;AAAA,MAChB,GAAI,OAAA,EAAS,MAAA,IAAU,EAAE,MAAA,EAAQ,QAAQ,MAAA,EAAO;AAAA,MAChD,GAAI,OAAA,EAAS,GAAA,IAAO,EAAE,GAAA,EAAK,QAAQ,GAAA;AAAI,KACzC;AACA,IAAA,OAAO,IAAA;AAAA,EACT;AAAA;AAAA;AAAA;AAAA,EAKA,OAAA,CAAQ,QAAgB,GAAA,EAAmB;AACzC,IAAA,OAAO,KAAK,SAAA,CAAU,IAAA,EAAM,MAAM,EAAE,MAAA,EAAQ,KAAK,CAAA;AAAA,EACnD;AAAA;AAAA;AAAA;AAAA,EAKA,OAAA,CAAQ,MAAA,EAAoB,MAAA,EAAiB,GAAA,EAAoB;AAC/D,IAAA,OAAO,KAAK,SAAA,CAAU,KAAA,EAAO,QAAQ,EAAE,MAAA,EAAQ,KAAK,CAAA;AAAA,EACtD;AAAA;AAAA;AAAA;AAAA,EAKA,WAAA,CAAY,KAAa,KAAA,EAAsB;AAC7C,IAAA,IAAI,CAAC,IAAA,CAAK,KAAA,CAAM,SAAA,EAAW;AACzB,MAAA,IAAA,CAAK,KAAA,CAAM,YAAY,EAAC;AAAA,IAC1B;AACA,IAAA,IAAA,CAAK,KAAA,CAAM,SAAA,CAAU,GAAG,CAAA,GAAI,KAAA;AAC5B,IAAA,OAAO,IAAA;AAAA,EACT;AAAA;AAAA;AAAA;AAAA,EAKA,QAAQ,IAAA,EAA8B;AACpC,IAAA,IAAA,CAAK,MAAM,IAAA,GAAO,IAAA;AAClB,IAAA,OAAO,IAAA;AAAA,EACT;AAAA;AAAA;AAAA;AAAA,EAKA,YAAA,GAAqB;AACnB,IAAA,IAAI,CAAC,IAAA,CAAK,KAAA,CAAM,IAAA,EAAM;AACpB,MAAA,IAAA,CAAK,KAAA,CAAM,OAAO,EAAC;AAAA,IACrB;AACA,IAAA,IAAA,CAAK,MAAM,IAAA,CAAK,YAAA,GAAA,iBAAe,IAAI,IAAA,IAAO,WAAA,EAAY;AACtD,IAAA,OAAO,IAAA;AAAA,EACT;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EASA,KAAA,GAA4B;AAE1B,IAAA,IAAI,CAAC,IAAA,CAAK,KAAA,CAAM,KAAA,EAAO;AACrB,MAAA,MAAM,IAAI,MAAM,wEAAwE,CAAA;AAAA,IAC1F;AACA,IAAA,IAAI,CAAC,IAAA,CAAK,KAAA,CAAM,MAAA,EAAQ;AACtB,MAAA,MAAM,IAAI,MAAM,oEAAoE,CAAA;AAAA,IACtF;AAGA,IAAA,MAAM,SAAwB,EAAC;AAC/B,IAAA,MAAM,WAAA,GAAc,KAAK,KAAA,CAAM,aAAA,GAAgB,UAAU,OAAA,CAAQ,IAAA,CAAK,KAAA,CAAM,aAAa,CAAA,GAAI,EAAA;AAE7F,IAAA,KAAA,IAAS,CAAA,GAAI,CAAA,EAAG,CAAA,GAAI,SAAA,CAAU,QAAQ,CAAA,EAAA,EAAK;AACzC,MAAA,MAAM,OAAA,GAAU,UAAU,CAAC,CAAA;AAC3B,MAAA,MAAM,QAAA,GAAW,IAAA,CAAK,KAAA,CAAM,MAAA,CAAO,IAAI,OAAO,CAAA;AAE9C,MAAA,IAAI,QAAA,EAAU;AACZ,QAAA,MAAA,CAAO,KAAK,QAAQ,CAAA;AAAA,MACtB,CAAA,MAAA,IAAW,IAAA,CAAK,KAAA,CAAM,cAAA,IAAkB,IAAI,WAAA,EAAa;AAEvD,QAAA,MAAA,CAAO,IAAA,CAAK,EAAE,EAAA,EAAI,OAAA,EAAS,MAAA,EAAQ,MAAA,EAAQ,MAAA,EAAQ,EAAE,MAAA,EAAQ,eAAA,EAAgB,EAAG,CAAA;AAAA,MAClF,CAAA,MAAO;AAGL,QAAA,IAAI,YAAY,2BAAA,EAA6B;AAC3C,UAAA,MAAA,CAAO,IAAA,CAAK,EAAE,EAAA,EAAI,OAAA,EAAS,MAAA,EAAQ,MAAA,EAAQ,MAAA,EAAQ,EAAE,MAAA,EAAQ,gBAAA,EAAiB,EAAG,CAAA;AAAA,QACnF,CAAA,MAAA,IAAW,YAAY,gBAAA,EAAkB;AAEvC,UAAA,MAAA,CAAO,IAAA,CAAK;AAAA,YACV,EAAA,EAAI,OAAA;AAAA,YACJ,MAAA,EAAQ,MAAA;AAAA,YACR,MAAA,EAAQ,EAAE,MAAA,EAAQ,0BAAA;AAA2B,WAC9C,CAAA;AAAA,QACH,CAAA,MAAO;AAEL,UAAA,MAAA,CAAO,IAAA,CAAK,EAAE,EAAA,EAAI,OAAA,EAAS,MAAA,EAAQ,MAAA,EAAQ,MAAA,EAAQ,EAAE,MAAA,EAAQ,cAAA,EAAe,EAAG,CAAA;AAAA,QACjF;AAAA,MACF;AAAA,IACF;AAEA,IAAA,MAAM,MAAA,GAA6B;AAAA,MACjC,cAAA,EAAgBC,2BAAAA;AAAA,MAChB,KAAA,EAAO,KAAK,KAAA,CAAM,KAAA;AAAA,MAClB,MAAA,EAAQ,KAAK,KAAA,CAAM,MAAA;AAAA,MACnB,MAAA,EAAQ,KAAK,KAAA,CAAM,MAAA;AAAA,MACnB;AAAA,KACF;AAEA,IAAA,IAAI,IAAA,CAAK,KAAA,CAAM,SAAA,IAAa,MAAA,CAAO,IAAA,CAAK,KAAK,KAAA,CAAM,SAAS,CAAA,CAAE,MAAA,GAAS,CAAA,EAAG;AACxE,MAAA,MAAA,CAAO,SAAA,GAAY,KAAK,KAAA,CAAM,SAAA;AAAA,IAChC;AAEA,IAAA,IAAI,IAAA,CAAK,MAAM,IAAA,EAAM;AACnB,MAAA,MAAA,CAAO,IAAA,GAAO,KAAK,KAAA,CAAM,IAAA;AAAA,IAC3B;AAEA,IAAA,OAAO,MAAA;AAAA,EACT;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAcA,kBAAA,GAAuD;AACrD,IAAA,MAAM,MAAA,GAAS,KAAK,KAAA,EAAM;AAC1B,IAAA,MAAM,EAAE,IAAA,EAAM,KAAA,EAAO,GAAG,eAAc,GAAI,MAAA;AAG1C,IAAA,IAAI,cAAc,SAAA,EAAW;AAC3B,MAAA,MAAM,iBAAA,GAAoD,EAAE,GAAG,aAAA,CAAc,SAAA,EAAU;AACvF,MAAA,KAAA,MAAW,OAAO,+BAAA,EAAiC;AACjD,QAAA,OAAO,kBAAkB,GAAG,CAAA;AAAA,MAC9B;AAGA,MAAA,IAAI,MAAA,CAAO,IAAA,CAAK,iBAAiB,CAAA,CAAE,WAAW,CAAA,EAAG;AAC/C,QAAA,OAAO,aAAA,CAAc,SAAA;AAAA,MACvB,CAAA,MAAO;AACL,QAAA,aAAA,CAAc,SAAA,GAAY,iBAAA;AAAA,MAC5B;AAAA,IACF;AAEA,IAAA,OAAO,aAAA;AAAA,EACT;AACF;AAKO,SAAS,oBAAoB,MAAA,EAAmD;AACrF,EAAA,OAAO,IAAI,0BAA0B,MAAM,CAAA;AAC7C;AAQA,eAAsB,qBAAqB,YAAA,EAAoD;AAC7F,EAAA,MAAM,KAAA,GACJ,OAAO,YAAA,KAAiB,QAAA,GAAW,IAAI,WAAA,EAAY,CAAE,MAAA,CAAO,YAAY,CAAA,GAAI,YAAA;AAC9E,EAAA,OAAOD,UAAU,KAAK,CAAA;AACxB;AAQA,eAAsB,mBACpB,MAAA,EACA,YAAA,EACA,QACA,aAAA,EACA,SAAA,EACA,QACA,OAAA,EAK6B;AAC7B,EAAA,MAAM,KAAA,GACJ,OAAO,YAAA,KAAiB,QAAA,GAAW,IAAI,WAAA,EAAY,CAAE,MAAA,CAAO,YAAY,CAAA,GAAI,YAAA;AAC9E,EAAA,MAAM,SAAA,GAAY,MAAMA,SAAAA,CAAU,KAAK,CAAA;AAEvC,EAAA,MAAM,OAAA,GAAU,mBAAA,CAAoB,MAAM,CAAA,CACvC,kBAAA,CAAmB,SAAS,CAAA,CAC5B,OAAA,CAAQ,MAAA,EAAQ,OAAA,EAAS,MAAA,EAAQ,OAAA,EAAS,GAAG,CAAA;AAGhD,EAAA,MAAM,WAAA,GAAc,SAAA,CAAU,OAAA,CAAQ,aAAa,CAAA;AACnD,EAAA,KAAA,IAAS,CAAA,GAAI,CAAA,EAAG,CAAA,GAAI,SAAA,CAAU,QAAQ,CAAA,EAAA,EAAK;AACzC,IAAA,MAAM,OAAA,GAAU,UAAU,CAAC,CAAA;AAC3B,IAAA,IAAI,IAAI,WAAA,EAAa;AACnB,MAAA,OAAA,CAAQ,KAAK,OAAO,CAAA;AAAA,IACtB,CAAA,MAAA,IAAW,MAAM,WAAA,EAAa;AAC5B,MAAA,OAAA,CAAQ,KAAK,OAAA,EAAS,SAAA,IAAa,qBAAA,CAAsB,MAAM,GAAG,MAAM,CAAA;AAAA,IAC1E;AAAA,EAEF;AAEA,EAAA,IAAI,SAAS,IAAA,EAAM;AACjB,IAAA,OAAA,CAAQ,OAAA,CAAQ,QAAQ,IAAI,CAAA;AAAA,EAC9B;AAEA,EAAA,OAAO,QAAQ,KAAA,EAAM;AACvB;AAKA,eAAsB,mBACpB,MAAA,EACA,YAAA,EACA,MAAA,EACA,GAAA,EACA,cACA,OAAA,EAI6B;AAC7B,EAAA,MAAM,KAAA,GACJ,OAAO,YAAA,KAAiB,QAAA,GAAW,IAAI,WAAA,EAAY,CAAE,MAAA,CAAO,YAAY,CAAA,GAAI,YAAA;AAC9E,EAAA,MAAM,SAAA,GAAY,MAAMA,SAAAA,CAAU,KAAK,CAAA;AAEvC,EAAA,MAAM,OAAA,GAAU,oBAAoB,MAAM,CAAA,CAAE,mBAAmB,SAAS,CAAA,CAAE,OAAA,CAAQ,MAAA,EAAQ,GAAG,CAAA;AAG7F,EAAA,KAAA,MAAW,WAAW,SAAA,EAAW;AAE/B,IAAA,IAAI,OAAA,KAAY,kBAAA,IAAsB,MAAA,CAAO,IAAA,KAAS,cAAA,EAAgB;AACpE,MAAA,OAAA,CAAQ,IAAA,CAAK,OAAA,EAAS,EAAE,MAAA,EAAQ,gBAAgB,CAAA;AAChD,MAAA;AAAA,IACF;AAGA,IAAA,IAAI,YAAY,2BAAA,EAA6B;AAC3C,MAAA,IAAI,YAAA,GAAe,OAAO,CAAA,EAAG;AAC3B,QAAA,OAAA,CAAQ,IAAA,CAAK,OAAA,EAAS,YAAA,CAAa,OAAO,CAAC,CAAA;AAAA,MAC7C;AAEA,MAAA;AAAA,IACF;AAGA,IAAA,IAAI,YAAY,gBAAA,EAAkB;AAEhC,MAAA;AAAA,IACF;AAEA,IAAA,OAAA,CAAQ,IAAA,CAAK,OAAA,EAAS,YAAA,GAAe,OAAO,CAAC,CAAA;AAAA,EAC/C;AAEA,EAAA,IAAI,SAAS,SAAA,EAAW;AACtB,IAAA,KAAA,MAAW,CAAC,KAAK,KAAK,CAAA,IAAK,OAAO,OAAA,CAAQ,OAAA,CAAQ,SAAS,CAAA,EAAG;AAC5D,MAAA,OAAA,CAAQ,WAAA,CAAY,KAAK,KAAK,CAAA;AAAA,IAChC;AAAA,EACF;AAEA,EAAA,IAAI,SAAS,IAAA,EAAM;AACjB,IAAA,OAAA,CAAQ,OAAA,CAAQ,QAAQ,IAAI,CAAA;AAAA,EAC9B;AAEA,EAAA,OAAO,QAAQ,KAAA,EAAM;AACvB;;;AC7VA,SAAS,gBAAgB,MAAA,EAAwB;AAC/C,EAAA,IAAI;AACF,IAAA,MAAM,GAAA,GAAM,IAAI,GAAA,CAAI,MAAM,CAAA;AAE1B,IAAA,IAAI,GAAA,CAAI,IAAA,IAAQ,GAAA,CAAI,IAAA,KAAS,KAAA,EAAO;AAClC,MAAA,OAAO,CAAA,EAAG,IAAI,QAAQ,CAAA,EAAA,EAAK,IAAI,QAAQ,CAAA,CAAA,EAAI,IAAI,IAAI,CAAA,CAAA;AAAA,IACrD;AACA,IAAA,OAAO,CAAA,EAAG,GAAA,CAAI,QAAQ,CAAA,EAAA,EAAK,IAAI,QAAQ,CAAA,CAAA;AAAA,EACzC,CAAA,CAAA,MAAQ;AACN,IAAA,OAAO,MAAA;AAAA,EACT;AACF;AAKA,SAAS,eAAA,CAAgB,QAAgB,SAAA,EAA+B;AACtE,EAAA,IAAI,CAAC,SAAA,IAAa,SAAA,CAAU,MAAA,KAAW,CAAA,EAAG;AAExC,IAAA,OAAO,IAAA;AAAA,EACT;AAEA,EAAA,MAAM,UAAA,GAAa,gBAAgB,MAAM,CAAA;AACzC,EAAA,OAAO,UAAU,IAAA,CAAK,CAAC,YAAY,eAAA,CAAgB,OAAO,MAAM,UAAU,CAAA;AAC5E;AAKA,SAAS,aAAA,CACP,MAAA,EACA,GAAA,EACA,UAAA,EACuB;AACvB,EAAA,IAAI,CAAC,UAAA,IAAc,UAAA,CAAW,MAAA,KAAW,CAAA,EAAG;AAC1C,IAAA,OAAO,MAAA;AAAA,EACT;AAEA,EAAA,MAAM,gBAAA,GAAmB,gBAAgB,MAAM,CAAA;AAC/C,EAAA,OAAO,UAAA,CAAW,IAAA,CAAK,CAAC,EAAA,KAAO,eAAA,CAAgB,EAAA,CAAG,MAAM,CAAA,KAAM,gBAAA,IAAoB,EAAA,CAAG,GAAA,KAAQ,GAAG,CAAA;AAClG;AAqBA,eAAe,gBACb,YAAA,EACuD;AACvD,EAAA,MAAM,MAAA,GAAS,MAAM,WAAA,CAAY,YAAY,CAAA;AAE7C,EAAA,IAAI,CAAC,OAAO,EAAA,EAAI;AACd,IAAA,OAAO;AAAA,MACL,KAAA,EAAO;AAAA,QACL,EAAA,EAAI,KAAA;AAAA,QACJ,MAAA,EAAQ,OAAO,MAAA,IAAU,eAAA;AAAA,QACzB,SAAS,MAAA,CAAO,OAAA;AAAA,QAChB,YAAY,MAAA,CAAO;AAAA;AACrB,KACF;AAAA,EACF;AAEA,EAAA,OAAO;AAAA,IACL,MAAM,MAAA,CAAO,IAAA;AAAA,IACb,WAAW,MAAA,CAAO,SAAA;AAAA,IAClB,UAAU,MAAA,CAAO,QAAA;AAAA,IACjB,aAAa,MAAA,CAAO;AAAA,GACtB;AACF;AAKA,SAAS,cAAA,CAAe,KAAa,WAAA,EAA4D;AAC/F,EAAA,OAAO,aAAa,IAAA,CAAK,CAAC,EAAA,KAAO,EAAA,CAAG,QAAQ,GAAG,CAAA;AACjD;AAqBA,eAAsB,kBAAkB,OAAA,EAAuD;AAC7F,EAAA,MAAM;AAAA,IACJ,OAAA;AAAA,IACA,MAAA,GAAS,oBAAoB,mBAAmB,CAAA;AAAA,IAChD,aAAA;AAAA,IACA,WAAA,GAAc;AAAA,GAChB,GAAI,OAAA;AAGJ,EAAA,MAAM,UAAA,GAAa,OAAO,OAAA,KAAY,QAAA,GAAW,UAAU,IAAI,WAAA,EAAY,CAAE,MAAA,CAAO,OAAO,CAAA;AAC3F,EAAA,MAAM,YAAA,GAAe,OAAO,OAAA,KAAY,QAAA,GAAW,IAAI,WAAA,EAAY,CAAE,MAAA,CAAO,OAAO,CAAA,GAAI,OAAA;AAGvF,EAAA,MAAM,gBAAA,GAAmB,MAAMA,SAAAA,CAAU,YAAY,CAAA;AAGrD,EAAA,MAAM,OAAA,GAAU,oBAAoB,MAAM,CAAA;AAC1C,EAAA,OAAA,CAAQ,mBAAmB,gBAAgB,CAAA;AAG3C,EAAA,MAAM,aAAa,aAAA,IAAiB,IAAA,CAAK,MAAM,IAAA,CAAK,GAAA,KAAQ,GAAI,CAAA;AAGhE,EAAA,IAAI,MAAA;AACJ,EAAA,IAAI,GAAA;AACJ,EAAA,IAAI,YAAA;AAKJ,EAAA,IAAI,MAAA;AACJ,EAAA,IAAI,OAAA;AAEJ,EAAA,IAAI;AACF,IAAA,MAAM,OAAA,GAAUE,OAA0B,UAAU,CAAA;AACpD,IAAA,MAAA,GAAS,OAAA,CAAQ,MAAA;AACjB,IAAA,OAAA,GAAU,OAAA,CAAQ,OAAA;AAClB,IAAA,OAAA,CAAQ,KAAK,WAAW,CAAA;AAAA,EAC1B,SAAS,GAAA,EAAK;AACZ,IAAA,OAAA,CAAQ,IAAA,CAAK,aAAa,4BAAA,EAA8B;AAAA,MACtD,OAAO,GAAA,YAAe,KAAA,GAAQ,GAAA,CAAI,OAAA,GAAU,OAAO,GAAG;AAAA,KACvD,CAAA;AACD,IAAA,OAAA,CAAQ,QAAQ,mBAAmB,CAAA;AACnC,IAAA,OAAO,EAAE,KAAA,EAAO,KAAA,EAAO,MAAA,EAAQ,WAAA,GAAc,OAAA,CAAQ,YAAA,EAAa,CAAE,KAAA,EAAM,GAAI,OAAA,CAAQ,KAAA,EAAM,EAAE;AAAA,EAChG;AAKA,EAAA,IAAI,YAAA,CAAa,MAAA,GAAS,MAAA,CAAO,MAAA,CAAO,iBAAA,EAAmB;AACzD,IAAA,OAAA,CAAQ,IAAA,CAAK,wBAAwB,4BAAA,EAA8B;AAAA,MACjE,MAAM,YAAA,CAAa,MAAA;AAAA,MACnB,KAAA,EAAO,OAAO,MAAA,CAAO;AAAA,KACtB,CAAA;AACD,IAAA,OAAA,CAAQ,QAAQ,mBAAmB,CAAA;AACnC,IAAA,OAAO,EAAE,KAAA,EAAO,KAAA,EAAO,MAAA,EAAQ,WAAA,GAAc,OAAA,CAAQ,YAAA,EAAa,CAAE,KAAA,EAAM,GAAI,OAAA,CAAQ,KAAA,EAAM,EAAE;AAAA,EAChG;AACA,EAAA,OAAA,CAAQ,KAAK,sBAAA,EAAwB,EAAE,IAAA,EAAM,YAAA,CAAa,QAAQ,CAAA;AAKlE,EAAA,IAAI,MAAA,CAAO,QAAQ,OAAA,EAAS;AAC1B,IAAA,OAAA,CAAQ,IAAA,CAAK,wBAAwB,4BAAA,EAA8B;AAAA,MACjE,YAAA,EAAc,OAAA;AAAA,MACd,YAAY,MAAA,CAAO;AAAA,KACpB,CAAA;AACD,IAAA,OAAA,CAAQ,QAAQ,mBAAmB,CAAA;AACnC,IAAA,OAAO,EAAE,KAAA,EAAO,KAAA,EAAO,MAAA,EAAQ,WAAA,GAAc,OAAA,CAAQ,YAAA,EAAa,CAAE,KAAA,EAAM,GAAI,OAAA,CAAQ,KAAA,EAAM,EAAE;AAAA,EAChG;AACA,EAAA,IAAI,MAAA,CAAO,QAAQC,SAAAA,EAAW;AAC5B,IAAA,OAAA,CAAQ,IAAA,CAAK,wBAAwB,4BAAA,EAA8B;AAAA,MACjE,YAAA,EAAcA,SAAAA;AAAA,MACd,YAAY,MAAA,CAAO;AAAA,KACpB,CAAA;AACD,IAAA,OAAA,CAAQ,QAAQ,mBAAmB,CAAA;AACnC,IAAA,OAAO,EAAE,KAAA,EAAO,KAAA,EAAO,MAAA,EAAQ,WAAA,GAAc,OAAA,CAAQ,YAAA,EAAa,CAAE,KAAA,EAAM,GAAI,OAAA,CAAQ,KAAA,EAAM,EAAE;AAAA,EAChG;AACA,EAAA,IAAI,CAAC,OAAO,GAAA,EAAK;AACf,IAAA,OAAA,CAAQ,IAAA,CAAK,wBAAwB,4BAAA,EAA8B;AAAA,MACjE,KAAA,EAAO;AAAA,KACR,CAAA;AACD,IAAA,OAAA,CAAQ,QAAQ,mBAAmB,CAAA;AACnC,IAAA,OAAO,EAAE,KAAA,EAAO,KAAA,EAAO,MAAA,EAAQ,WAAA,GAAc,OAAA,CAAQ,YAAA,EAAa,CAAE,KAAA,EAAM,GAAI,OAAA,CAAQ,KAAA,EAAM,EAAE;AAAA,EAChG;AACA,EAAA,GAAA,GAAM,MAAA,CAAO,GAAA;AACb,EAAA,OAAA,CAAQ,IAAA,CAAK,sBAAA,EAAwB,EAAE,GAAA,EAAK,MAAA,CAAO,GAAA,EAAK,GAAA,EAAK,MAAA,CAAO,GAAA,EAAK,GAAA,EAAK,MAAA,CAAO,GAAA,EAAK,CAAA;AAK1F,EAAA,IAAI;AACF,IAAAf,aAAAA,CAAc,MAAM,OAAO,CAAA;AAC3B,IAAA,MAAA,GAAS,OAAA,CAAQ,GAAA;AACjB,IAAA,OAAA,CAAQ,KAAK,0BAA0B,CAAA;AAAA,EACzC,SAAS,GAAA,EAAK;AACZ,IAAA,OAAA,CAAQ,IAAA,CAAK,4BAA4B,yBAAA,EAA2B;AAAA,MAClE,OAAO,GAAA,YAAe,KAAA,GAAQ,GAAA,CAAI,OAAA,GAAU,OAAO,GAAG;AAAA,KACvD,CAAA;AACD,IAAA,OAAA,CAAQ,QAAQ,gBAAgB,CAAA;AAChC,IAAA,OAAO,EAAE,KAAA,EAAO,KAAA,EAAO,MAAA,EAAQ,WAAA,GAAc,OAAA,CAAQ,YAAA,EAAa,CAAE,KAAA,EAAM,GAAI,OAAA,CAAQ,KAAA,EAAM,EAAE;AAAA,EAChG;AAKA,EAAA,MAAM,gBAAA,GAAmB,gBAAgB,MAAO,CAAA;AAEhD,EAAA,IAAI,CAAC,eAAA,CAAgB,MAAA,EAAS,MAAA,CAAO,gBAAgB,CAAA,EAAG;AACtD,IAAA,OAAA,CAAQ,IAAA,CAAK,uBAAuB,6BAAA,EAA+B;AAAA,MACjE,MAAA,EAAQ,gBAAA;AAAA,MACR,WAAW,MAAA,CAAO;AAAA,KACnB,CAAA;AACD,IAAA,OAAA,CAAQ,OAAA,CAAQ,oBAAA,EAAsB,gBAAA,EAAkB,GAAG,CAAA;AAC3D,IAAA,OAAO,EAAE,KAAA,EAAO,KAAA,EAAO,MAAA,EAAQ,WAAA,GAAc,OAAA,CAAQ,YAAA,EAAa,CAAE,KAAA,EAAM,GAAI,OAAA,CAAQ,KAAA,EAAM,EAAE;AAAA,EAChG;AACA,EAAA,OAAA,CAAQ,IAAA,CAAK,qBAAA,EAAuB,EAAE,MAAA,EAAQ,kBAAkB,CAAA;AAMhE,EAAA,IAAI,SAAA;AACJ,EAAA,IAAI,SAAA;AACJ,EAAA,IAAI,aAAA;AACJ,EAAA,IAAI,YAAA;AAGJ,EAAA,MAAM,SAAA,GAAY,aAAA,CAAc,MAAA,EAAS,GAAA,EAAM,OAAO,WAAW,CAAA;AAEjE,EAAA,IAAI,SAAA,EAAW;AAEb,IAAA,OAAA,CAAQ,IAAA,CAAK,kBAAA,EAAoB,EAAE,MAAA,EAAQ,wBAAwB,CAAA;AAGnE,IAAA,IAAI,UAAU,GAAA,EAAK;AAEjB,MAAA,MAAM,gBAAA,GAAmB,MAAM,oBAAA,CAAqB,SAAA,CAAU,GAAG,CAAA;AACjE,MAAA,IAAI,gBAAA,KAAqB,UAAU,qBAAA,EAAuB;AACxD,QAAA,OAAA,CAAQ,IAAA,CAAK,eAAe,2BAAA,EAA6B;AAAA,UACvD,KAAA,EAAO,0DAAA;AAAA,UACP,UAAU,SAAA,CAAU,qBAAA;AAAA,UACpB,MAAA,EAAQ;AAAA,SACT,CAAA;AACD,QAAA,OAAA,CAAQ,OAAA,CAAQ,kBAAA,EAAoB,gBAAA,EAAkB,GAAG,CAAA;AACzD,QAAA,OAAO;AAAA,UACL,KAAA,EAAO,KAAA;AAAA,UACP,MAAA,EAAQ,cAAc,OAAA,CAAQ,YAAA,GAAe,KAAA,EAAM,GAAI,QAAQ,KAAA;AAAM,SACvE;AAAA,MACF;AACA,MAAA,SAAA,GAAY,mBAAA,CAAoB,UAAU,GAAG,CAAA;AAC7C,MAAA,SAAA,GAAY,aAAA;AACZ,MAAA,aAAA,GAAgB,gBAAA;AAChB,MAAA,OAAA,CAAQ,KAAK,aAAA,EAAe;AAAA,QAC1B,MAAA,EAAQ,SAAA;AAAA,QACR,GAAA;AAAA,QACA,mBAAA,EAAqB,IAAA;AAAA,QACrB,OAAA,EAAS;AAAA,OACV,CAAA;AAAA,IACH,CAAA,MAAA,IAAW,UAAU,UAAA,EAAY;AAE/B,MAAA,IAAI;AACF,QAAA,SAAA,GAAYgB,eAAAA,CAAgB,UAAU,UAAU,CAAA;AAChD,QAAA,IAAI,SAAA,CAAU,WAAW,EAAA,EAAI;AAC3B,UAAA,MAAM,IAAI,KAAA,CAAM,CAAA,uBAAA,EAA0B,SAAA,CAAU,MAAM,CAAA,CAAE,CAAA;AAAA,QAC9D;AACA,QAAA,SAAA,GAAY,aAAA;AAIZ,QAAA,aAAA,GAAgB,SAAA,CAAU,qBAAA;AAC1B,QAAA,OAAA,CAAQ,KAAK,aAAA,EAAe;AAAA,UAC1B,MAAA,EAAQ,SAAA;AAAA,UACR,GAAA;AAAA,UACA,OAAA,EAAS,IAAA;AAAA,UACT,mBAAA,EAAqB;AAAA,SACtB,CAAA;AAAA,MACH,SAAS,GAAA,EAAK;AACZ,QAAA,OAAA,CAAQ,IAAA,CAAK,eAAe,wBAAA,EAA0B;AAAA,UACpD,KAAA,EAAO,8BAA8B,GAAA,YAAe,KAAA,GAAQ,IAAI,OAAA,GAAU,MAAA,CAAO,GAAG,CAAC,CAAA;AAAA,SACtF,CAAA;AACD,QAAA,OAAA,CAAQ,OAAA,CAAQ,eAAA,EAAiB,gBAAA,EAAkB,GAAG,CAAA;AACtD,QAAA,OAAO;AAAA,UACL,KAAA,EAAO,KAAA;AAAA,UACP,MAAA,EAAQ,cAAc,OAAA,CAAQ,YAAA,GAAe,KAAA,EAAM,GAAI,QAAQ,KAAA;AAAM,SACvE;AAAA,MACF;AAAA,IACF,CAAA,MAAA,IAAW,MAAA,CAAO,IAAA,KAAS,cAAA,EAAgB;AAEzC,MAAA,OAAA,CAAQ,IAAA,CAAK,eAAe,wBAAA,EAA0B;AAAA,QACpD,KAAA,EAAO;AAAA,OACR,CAAA;AACD,MAAA,OAAA,CAAQ,OAAA,CAAQ,eAAA,EAAiB,gBAAA,EAAkB,GAAG,CAAA;AACtD,MAAA,OAAO;AAAA,QACL,KAAA,EAAO,KAAA;AAAA,QACP,MAAA,EAAQ,cAAc,OAAA,CAAQ,YAAA,GAAe,KAAA,EAAM,GAAI,QAAQ,KAAA;AAAM,OACvE;AAAA,IACF,CAAA,MAAO;AAEL,MAAA,MAAM,UAAA,GAAa,MAAM,eAAA,CAAgB,gBAAgB,CAAA;AAEzD,MAAA,IAAI,WAAW,UAAA,EAAY;AACzB,QAAA,MAAM,MAAA,GAAS,qBAAA,CAAsB,UAAA,CAAW,KAAA,CAAM,QAAQ,KAAK,CAAA;AACnE,QAAA,OAAA,CAAQ,IAAA,CAAK,kBAAA,EAAoB,qBAAA,CAAsB,MAAM,CAAA,EAAG;AAAA,UAC9D,KAAA,EAAO,WAAW,KAAA,CAAM,OAAA;AAAA,UACxB,GAAA,EAAK,WAAW,KAAA,CAAM;AAAA,SACvB,CAAA;AACD,QAAA,OAAA,CAAQ,OAAA,CAAQ,MAAA,EAAQ,gBAAA,EAAkB,GAAG,CAAA;AAC7C,QAAA,OAAO;AAAA,UACL,KAAA,EAAO,KAAA;AAAA,UACP,MAAA,EAAQ,cAAc,OAAA,CAAQ,YAAA,GAAe,KAAA,EAAM,GAAI,QAAQ,KAAA;AAAM,SACvE;AAAA,MACF;AAGA,MAAA,IAAI,WAAW,QAAA,EAAU;AACvB,QAAA,YAAA,GAAe,UAAA,CAAW,QAAA;AAAA,MAC5B;AAEA,MAAA,OAAA,CAAQ,KAAK,kBAAA,EAAoB;AAAA,QAC/B,YAAY,UAAA,CAAW,SAAA;AAAA,QACvB,UAAA,EAAY,UAAA,CAAW,IAAA,CAAK,IAAA,CAAK;AAAA,OAClC,CAAA;AAED,MAAA,MAAM,aAAA,GAAgB,cAAA,CAAe,GAAA,EAAM,UAAA,CAAW,WAAW,CAAA;AACjE,MAAA,IAAI,aAAA,EAAe;AACjB,QAAA,OAAA,CAAQ,IAAA,CAAK,eAAe,oBAAA,EAAsB;AAAA,UAChD,GAAA;AAAA,UACA,YAAY,aAAA,CAAc,UAAA;AAAA,UAC1B,GAAI,aAAA,CAAc,MAAA,IAAU,EAAE,MAAA,EAAQ,cAAc,MAAA;AAAO,SAC5D,CAAA;AACD,QAAA,OAAA,CAAQ,OAAA,CAAQ,eAAA,EAAiB,gBAAA,EAAkB,GAAG,CAAA;AACtD,QAAA,OAAO;AAAA,UACL,KAAA,EAAO,KAAA;AAAA,UACP,MAAA,EAAQ,cAAc,OAAA,CAAQ,YAAA,GAAe,KAAA,EAAM,GAAI,QAAQ,KAAA;AAAM,SACvE;AAAA,MACF;AAGA,MAAA,MAAM,GAAA,GAAM,WAAW,IAAA,CAAK,IAAA,CAAK,KAAK,CAAC,CAAA,KAAM,CAAA,CAAE,GAAA,KAAQ,GAAG,CAAA;AAC1D,MAAA,IAAI,CAAC,GAAA,EAAK;AACR,QAAA,OAAA,CAAQ,IAAA,CAAK,eAAe,wBAAA,EAA0B;AAAA,UACpD,GAAA;AAAA,UACA,cAAA,EAAgB,WAAW,IAAA,CAAK,IAAA,CAAK,IAAI,CAAC,CAAA,KAAM,EAAE,GAAG;AAAA,SACtD,CAAA;AACD,QAAA,OAAA,CAAQ,OAAA,CAAQ,eAAA,EAAiB,gBAAA,EAAkB,GAAG,CAAA;AACtD,QAAA,OAAO;AAAA,UACL,KAAA,EAAO,KAAA;AAAA,UACP,MAAA,EAAQ,cAAc,OAAA,CAAQ,YAAA,GAAe,KAAA,EAAM,GAAI,QAAQ,KAAA;AAAM,SACvE;AAAA,MACF;AAGA,MAAA,MAAM,gBAAA,GAAmB,MAAM,oBAAA,CAAqB,GAAG,CAAA;AACvD,MAAA,IAAI,gBAAA,KAAqB,UAAU,qBAAA,EAAuB;AACxD,QAAA,OAAA,CAAQ,IAAA,CAAK,eAAe,2BAAA,EAA6B;AAAA,UACvD,KAAA,EAAO,0CAAA;AAAA,UACP,UAAU,SAAA,CAAU,qBAAA;AAAA,UACpB,MAAA,EAAQ;AAAA,SACT,CAAA;AACD,QAAA,OAAA,CAAQ,OAAA,CAAQ,kBAAA,EAAoB,gBAAA,EAAkB,GAAG,CAAA;AACzD,QAAA,OAAO;AAAA,UACL,KAAA,EAAO,KAAA;AAAA,UACP,MAAA,EAAQ,cAAc,OAAA,CAAQ,YAAA,GAAe,KAAA,EAAM,GAAI,QAAQ,KAAA;AAAM,SACvE;AAAA,MACF;AAEA,MAAA,SAAA,GAAY,oBAAoB,GAAG,CAAA;AACnC,MAAA,SAAA,GAAY,aAAA;AACZ,MAAA,aAAA,GAAgB,gBAAA;AAChB,MAAA,OAAA,CAAQ,IAAA,CAAK,eAAe,EAAE,MAAA,EAAQ,WAAW,GAAA,EAAK,mBAAA,EAAqB,MAAM,CAAA;AAAA,IACnF;AAAA,EACF,CAAA,MAAO;AAEL,IAAA,IAAI,MAAA,CAAO,SAAS,cAAA,EAAgB;AAClC,MAAA,OAAA,CAAQ,IAAA,CAAK,oBAAoB,wBAAA,EAA0B;AAAA,QACzD,KAAA,EAAO;AAAA,OACR,CAAA;AACD,MAAA,OAAA,CAAQ,OAAA,CAAQ,eAAA,EAAiB,gBAAA,EAAkB,GAAG,CAAA;AACtD,MAAA,OAAO;AAAA,QACL,KAAA,EAAO,KAAA;AAAA,QACP,MAAA,EAAQ,cAAc,OAAA,CAAQ,YAAA,GAAe,KAAA,EAAM,GAAI,QAAQ,KAAA;AAAM,OACvE;AAAA,IACF;AAEA,IAAA,MAAM,UAAA,GAAa,MAAM,eAAA,CAAgB,gBAAgB,CAAA;AAEzD,IAAA,IAAI,WAAW,UAAA,EAAY;AACzB,MAAA,MAAM,MAAA,GAAS,qBAAA,CAAsB,UAAA,CAAW,KAAA,CAAM,QAAQ,KAAK,CAAA;AACnE,MAAA,OAAA,CAAQ,IAAA,CAAK,kBAAA,EAAoB,qBAAA,CAAsB,MAAM,CAAA,EAAG;AAAA,QAC9D,KAAA,EAAO,WAAW,KAAA,CAAM,OAAA;AAAA,QACxB,GAAA,EAAK,WAAW,KAAA,CAAM;AAAA,OACvB,CAAA;AACD,MAAA,OAAA,CAAQ,OAAA,CAAQ,MAAA,EAAQ,gBAAA,EAAkB,GAAG,CAAA;AAC7C,MAAA,OAAO;AAAA,QACL,KAAA,EAAO,KAAA;AAAA,QACP,MAAA,EAAQ,cAAc,OAAA,CAAQ,YAAA,GAAe,KAAA,EAAM,GAAI,QAAQ,KAAA;AAAM,OACvE;AAAA,IACF;AAGA,IAAA,IAAI,WAAW,QAAA,EAAU;AACvB,MAAA,YAAA,GAAe,UAAA,CAAW,QAAA;AAAA,IAC5B;AAEA,IAAA,OAAA,CAAQ,KAAK,kBAAA,EAAoB;AAAA,MAC/B,YAAY,UAAA,CAAW,SAAA;AAAA,MACvB,UAAA,EAAY,UAAA,CAAW,IAAA,CAAK,IAAA,CAAK;AAAA,KAClC,CAAA;AAED,IAAA,MAAM,OAAA,GAAU,cAAA,CAAe,GAAA,EAAM,UAAA,CAAW,WAAW,CAAA;AAC3D,IAAA,IAAI,OAAA,EAAS;AACX,MAAA,OAAA,CAAQ,IAAA,CAAK,eAAe,oBAAA,EAAsB;AAAA,QAChD,GAAA;AAAA,QACA,YAAY,OAAA,CAAQ,UAAA;AAAA,QACpB,GAAI,OAAA,CAAQ,MAAA,IAAU,EAAE,MAAA,EAAQ,QAAQ,MAAA;AAAO,OAChD,CAAA;AACD,MAAA,OAAA,CAAQ,OAAA,CAAQ,eAAA,EAAiB,gBAAA,EAAkB,GAAG,CAAA;AACtD,MAAA,OAAO;AAAA,QACL,KAAA,EAAO,KAAA;AAAA,QACP,MAAA,EAAQ,cAAc,OAAA,CAAQ,YAAA,GAAe,KAAA,EAAM,GAAI,QAAQ,KAAA;AAAM,OACvE;AAAA,IACF;AAGA,IAAA,MAAM,GAAA,GAAM,WAAW,IAAA,CAAK,IAAA,CAAK,KAAK,CAAC,CAAA,KAAM,CAAA,CAAE,GAAA,KAAQ,GAAG,CAAA;AAC1D,IAAA,IAAI,CAAC,GAAA,EAAK;AACR,MAAA,OAAA,CAAQ,IAAA,CAAK,eAAe,wBAAA,EAA0B;AAAA,QACpD,GAAA;AAAA,QACA,cAAA,EAAgB,WAAW,IAAA,CAAK,IAAA,CAAK,IAAI,CAAC,CAAA,KAAM,EAAE,GAAG;AAAA,OACtD,CAAA;AACD,MAAA,OAAA,CAAQ,OAAA,CAAQ,eAAA,EAAiB,gBAAA,EAAkB,GAAG,CAAA;AACtD,MAAA,OAAO;AAAA,QACL,KAAA,EAAO,KAAA;AAAA,QACP,MAAA,EAAQ,cAAc,OAAA,CAAQ,YAAA,GAAe,KAAA,EAAM,GAAI,QAAQ,KAAA;AAAM,OACvE;AAAA,IACF;AAEA,IAAA,SAAA,GAAY,oBAAoB,GAAG,CAAA;AACnC,IAAA,SAAA,GAAY,gBAAA;AACZ,IAAA,aAAA,GAAgB,MAAM,qBAAqB,GAAG,CAAA;AAC9C,IAAA,OAAA,CAAQ,IAAA,CAAK,eAAe,EAAE,MAAA,EAAQ,WAAW,GAAA,EAAK,UAAA,EAAY,eAAe,CAAA;AAAA,EACnF;AAKA,EAAA,IAAI;AACF,IAAA,MAAM,MAAA,GAAS,MAAMf,MAAAA,CAA6B,UAAA,EAAY,SAAS,CAAA;AAEvE,IAAA,IAAI,CAAC,OAAO,KAAA,EAAO;AACjB,MAAA,OAAA,CAAQ,IAAA,CAAK,iBAAiB,4BAAA,EAA8B;AAAA,QAC1D,KAAA,EAAO;AAAA,OACR,CAAA;AACD,MAAA,OAAA,CAAQ,OAAA,CAAQ,mBAAA,EAAqB,gBAAA,EAAkB,GAAG,CAAA;AAC1D,MAAA,OAAO;AAAA,QACL,KAAA,EAAO,KAAA;AAAA,QACP,MAAA,EAAQ,cAAc,OAAA,CAAQ,YAAA,GAAe,KAAA,EAAM,GAAI,QAAQ,KAAA;AAAM,OACvE;AAAA,IACF;AAEA,IAAA,YAAA,GAAe,MAAA,CAAO,OAAA;AACtB,IAAA,OAAA,CAAQ,KAAK,eAAe,CAAA;AAAA,EAC9B,SAAS,GAAA,EAAK;AACZ,IAAA,OAAA,CAAQ,IAAA,CAAK,iBAAiB,4BAAA,EAA8B;AAAA,MAC1D,OAAO,GAAA,YAAe,KAAA,GAAQ,GAAA,CAAI,OAAA,GAAU,OAAO,GAAG;AAAA,KACvD,CAAA;AACD,IAAA,OAAA,CAAQ,OAAA,CAAQ,mBAAA,EAAqB,gBAAA,EAAkB,GAAG,CAAA;AAC1D,IAAA,OAAO,EAAE,KAAA,EAAO,KAAA,EAAO,MAAA,EAAQ,WAAA,GAAc,OAAA,CAAQ,YAAA,EAAa,CAAE,KAAA,EAAM,GAAI,OAAA,CAAQ,KAAA,EAAM,EAAE;AAAA,EAChG;AAKA,EAAA,MAAM,YAAA,GAAe,EAAA;AAGrB,EAAA,IAAI,YAAA,CAAc,GAAA,GAAM,UAAA,GAAa,YAAA,EAAc;AACjD,IAAA,OAAA,CAAQ,IAAA,CAAK,sBAAsB,wBAAA,EAA0B;AAAA,MAC3D,KAAA,EAAO,8BAAA;AAAA,MACP,KAAK,YAAA,CAAc,GAAA;AAAA,MACnB,GAAA,EAAK,UAAA;AAAA,MACL,SAAA,EAAW;AAAA,KACZ,CAAA;AACD,IAAA,OAAA,CAAQ,OAAA,CAAQ,eAAA,EAAiB,gBAAA,EAAkB,GAAG,CAAA;AACtD,IAAA,OAAO,EAAE,KAAA,EAAO,KAAA,EAAO,MAAA,EAAQ,WAAA,GAAc,OAAA,CAAQ,YAAA,EAAa,CAAE,KAAA,EAAM,GAAI,OAAA,CAAQ,KAAA,EAAM,EAAE;AAAA,EAChG;AAGA,EAAA,IAAI,aAAc,GAAA,EAAK;AACrB,IAAA,IAAI,YAAA,CAAc,MAAM,UAAA,EAAY;AAClC,MAAA,OAAA,CAAQ,IAAA,CAAK,sBAAsB,kBAAA,EAAoB;AAAA,QACrD,KAAA,EAAO,iBAAA;AAAA,QACP,KAAK,YAAA,CAAc,GAAA;AAAA,QACnB,GAAA,EAAK;AAAA,OACN,CAAA;AACD,MAAA,OAAA,CAAQ,OAAA,CAAQ,SAAA,EAAW,gBAAA,EAAkB,GAAG,CAAA;AAChD,MAAA,OAAO;AAAA,QACL,KAAA,EAAO,KAAA;AAAA,QACP,MAAA,EAAQ,cAAc,OAAA,CAAQ,YAAA,GAAe,KAAA,EAAM,GAAI,QAAQ,KAAA;AAAM,OACvE;AAAA,IACF;AAAA,EACF;AAEA,EAAA,OAAA,CAAQ,KAAK,oBAAA,EAAsB;AAAA,IACjC,KAAK,YAAA,CAAc,GAAA;AAAA,IACnB,KAAK,YAAA,CAAc,GAAA;AAAA,IACnB,GAAA,EAAK;AAAA,GACN,CAAA;AAMD,EAAA,IAAI,aAAc,GAAA,EAAK;AACrB,IAAA,KAAA,MAAW,CAAC,QAAQ,QAAQ,CAAA,IAAK,OAAO,OAAA,CAAQ,YAAA,CAAc,GAAG,CAAA,EAAG;AAClE,MAAA,IAAI,aAAa,MAAA,EAAW;AAC1B,QAAA,MAAM,OAAA,GAAU,IAAA,CAAK,SAAA,CAAU,QAAQ,CAAA;AACvC,QAAA,IAAI,OAAA,CAAQ,MAAA,GAAS,MAAA,CAAO,MAAA,CAAO,mBAAA,EAAqB;AACtD,UAAA,OAAA,CAAQ,IAAA,CAAK,qBAAqB,8BAAA,EAAgC;AAAA,YAChE,SAAA,EAAW,MAAA;AAAA,YACX,MAAM,OAAA,CAAQ,MAAA;AAAA,YACd,KAAA,EAAO,OAAO,MAAA,CAAO;AAAA,WACtB,CAAA;AACD,UAAA,OAAA,CAAQ,OAAA,CAAQ,qBAAA,EAAuB,gBAAA,EAAkB,GAAG,CAAA;AAC5D,UAAA,OAAO;AAAA,YACL,KAAA,EAAO,KAAA;AAAA,YACP,MAAA,EAAQ,cAAc,OAAA,CAAQ,YAAA,GAAe,KAAA,EAAM,GAAI,QAAQ,KAAA;AAAM,WACvE;AAAA,QACF;AAAA,MACF;AAAA,IACF;AAAA,EACF;AAEA,EAAA,OAAA,CAAQ,KAAK,mBAAmB,CAAA;AAKhC,EAAA,OAAA,CAAQ,OAAA,CAAQ,kBAAkB,GAAI,CAAA;AAItC,EAAA,MAAM,iBAAA,GAAoB,SAAA,KAAc,aAAA,GAAgB,QAAA,GAAW,YAAA;AACnE,EAAA,OAAA,CAAQ,WAAA,CAAY,qBAAqB,iBAAiB,CAAA;AAE1D,EAAA,IAAI,aAAA,EAAe;AACjB,IAAA,OAAA,CAAQ,WAAA,CAAY,yBAAyB,aAAa,CAAA;AAAA,EAC5D;AAIA,EAAA,IAAI,YAAA,EAAc;AAChB,IAAA,MAAM,aAAA,GAAgB,MAAMW,SAAAA,CAAU,YAAY,CAAA;AAClD,IAAA,OAAA,CAAQ,WAAA,CAAY,oBAAA,EAAsB,YAAA,CAAa,aAAa,CAAC,CAAA;AAAA,EACvE;AAEA,EAAA,MAAM,MAAA,GAAS,cAAc,OAAA,CAAQ,YAAA,GAAe,KAAA,EAAM,GAAI,QAAQ,KAAA,EAAM;AAE5E,EAAA,OAAO;AAAA,IACL,KAAA,EAAO,IAAA;AAAA,IACP,MAAA;AAAA,IACA,MAAA,EAAQ;AAAA,GACV;AACF;;;AC5jBO,SAAS,mBACd,WAAA,EACkD;AAElD,EAAA,IAAI,WAAA,KAAgB,MAAA,IAAa,WAAA,KAAgB,EAAA,EAAI;AACnD,IAAA,OAAO;AAAA,MACL,EAAA,EAAI,KAAA;AAAA,MACJ,MAAA,EAAQ,mBAAA;AAAA,MACR,SAAA,EAAW,4BAAA;AAAA,MACX,OAAA,EAAS;AAAA,KACX;AAAA,EACF;AAGA,EAAA,IAAI,KAAA,CAAM,OAAA,CAAQ,WAAW,CAAA,EAAG;AAC9B,IAAA,OAAO;AAAA,MACL,EAAA,EAAI,KAAA;AAAA,MACJ,MAAA,EAAQ,mBAAA;AAAA,MACR,SAAA,EAAW,4BAAA;AAAA,MACX,OAAA,EAAS;AAAA,KACX;AAAA,EACF;AAGA,EAAA,IAAI,WAAA,CAAY,QAAA,CAAS,GAAG,CAAA,EAAG;AAG7B,IAAA,MAAM,KAAA,GAAQ,WAAA,CAAY,KAAA,CAAM,GAAG,CAAA;AACnC,IAAA,IAAI,KAAA,CAAM,MAAA,KAAW,CAAA,IAAK,KAAA,CAAM,IAAA,CAAK,CAAC,CAAA,KAAM,CAAA,CAAE,QAAA,CAAS,GAAG,CAAC,CAAA,EAAG;AAC5D,MAAA,OAAO;AAAA,QACL,EAAA,EAAI,KAAA;AAAA,QACJ,MAAA,EAAQ,mBAAA;AAAA,QACR,SAAA,EAAW,4BAAA;AAAA,QACX,OAAA,EAAS;AAAA,OACX;AAAA,IACF;AAAA,EACF;AAGA,EAAA,MAAM,QAAA,GAAW,WAAA,CAAY,KAAA,CAAM,GAAG,CAAA;AACtC,EAAA,IAAI,QAAA,CAAS,WAAW,CAAA,EAAG;AACzB,IAAA,OAAO;AAAA,MACL,EAAA,EAAI,KAAA;AAAA,MACJ,MAAA,EAAQ,mBAAA;AAAA,MACR,SAAA,EAAW,4BAAA;AAAA,MACX,OAAA,EAAS,CAAA,4DAAA,EAA+D,QAAA,CAAS,MAAM,CAAA;AAAA,KACzF;AAAA,EACF;AAGA,EAAA,MAAM,cAAA,GAAiB,kBAAA;AACvB,EAAA,KAAA,IAAS,CAAA,GAAI,CAAA,EAAG,CAAA,GAAI,QAAA,CAAS,QAAQ,CAAA,EAAA,EAAK;AACxC,IAAA,MAAM,OAAA,GAAU,SAAS,CAAC,CAAA;AAC1B,IAAA,IAAI,OAAA,CAAQ,WAAW,CAAA,EAAG;AACxB,MAAA,OAAO;AAAA,QACL,EAAA,EAAI,KAAA;AAAA,QACJ,MAAA,EAAQ,mBAAA;AAAA,QACR,SAAA,EAAW,4BAAA;AAAA,QACX,OAAA,EAAS,CAAA,2CAAA,EAA8C,CAAA,GAAI,CAAC,CAAA,SAAA;AAAA,OAC9D;AAAA,IACF;AACA,IAAA,IAAI,CAAC,cAAA,CAAe,IAAA,CAAK,OAAO,CAAA,EAAG;AACjC,MAAA,OAAO;AAAA,QACL,EAAA,EAAI,KAAA;AAAA,QACJ,MAAA,EAAQ,mBAAA;AAAA,QACR,SAAA,EAAW,4BAAA;AAAA,QACX,OAAA,EAAS,CAAA,2CAAA,EAA8C,CAAA,GAAI,CAAC,CAAA,4BAAA;AAAA,OAC9D;AAAA,IACF;AAAA,EACF;AAEA,EAAA,OAAO;AAAA,IACL,EAAA,EAAI,IAAA;AAAA,IACJ,MAAA,EAAQ;AAAA,MACN,OAAA,EAAS,QAAA;AAAA,MACT,OAAA,EAAS;AAAA;AACX,GACF;AACF;AAmBO,SAAS,oBACd,WAAA,EACmD;AAEnD,EAAA,IAAI,WAAA,KAAgB,MAAA,IAAa,WAAA,KAAgB,EAAA,EAAI;AACnD,IAAA,OAAO;AAAA,MACL,EAAA,EAAI,KAAA;AAAA,MACJ,MAAA,EAAQ,mBAAA;AAAA,MACR,SAAA,EAAW,4BAAA;AAAA,MACX,OAAA,EAAS;AAAA,KACX;AAAA,EACF;AAGA,EAAA,IAAI,KAAA,CAAM,OAAA,CAAQ,WAAW,CAAA,EAAG;AAC9B,IAAA,OAAO;AAAA,MACL,EAAA,EAAI,KAAA;AAAA,MACJ,MAAA,EAAQ,mBAAA;AAAA,MACR,SAAA,EAAW,4BAAA;AAAA,MACX,OAAA,EAAS;AAAA,KACX;AAAA,EACF;AAMA,EAAA,MAAM,WAAA,GAAc,sBAAsB,WAAW,CAAA;AAGrD,EAAA,IAAI,WAAA,CAAY,UAAA,CAAW,MAAA,GAAS,CAAA,EAAG;AACrC,IAAA,OAAO;AAAA,MACL,EAAA,EAAI,KAAA;AAAA,MACJ,MAAA,EAAQ,mBAAA;AAAA,MACR,SAAA,EAAW,4BAAA;AAAA,MACX,OAAA,EAAS,CAAA,8CAAA,EAAiD,WAAA,CAAY,UAAA,CAAW,CAAC,CAAC,CAAA;AAAA,KACrF;AAAA,EACF;AAIA,EAAA,MAAM,+BAAe,IAAI,GAAA,CAAI,CAAC,QAAA,EAAU,KAAK,CAAC,CAAA;AAC9C,EAAA,MAAM,WAAA,GAAc,WAAA,CAAY,IAAA,CAAK,MAAA,CAAO,CAAC,CAAA,KAAM,CAAC,YAAA,CAAa,GAAA,CAAI,CAAC,CAAA,IAAK,CAAC,CAAA,CAAE,UAAA,CAAW,MAAM,CAAC,CAAA;AAChG,EAAA,IAAI,WAAA,CAAY,SAAS,CAAA,EAAG;AAC1B,IAAA,OAAO;AAAA,MACL,EAAA,EAAI,KAAA;AAAA,MACJ,MAAA,EAAQ,mBAAA;AAAA,MACR,SAAA,EAAW,4BAAA;AAAA,MACX,OAAA,EAAS,CAAA,4CAAA,EAA+C,WAAA,CAAY,CAAC,CAAC,CAAA;AAAA,KACxE;AAAA,EACF;AAEA,EAAA,MAAM,SAAS,WAAA,CAAY,MAAA;AAE3B,EAAA,IAAI,CAAC,OAAO,MAAA,EAAQ;AAClB,IAAA,OAAO;AAAA,MACL,EAAA,EAAI,KAAA;AAAA,MACJ,MAAA,EAAQ,mBAAA;AAAA,MACR,SAAA,EAAW,4BAAA;AAAA,MACX,OAAA,EAAS;AAAA,KACX;AAAA,EACF;AAEA,EAAA,IAAI,CAAC,OAAO,GAAA,EAAK;AACf,IAAA,OAAO;AAAA,MACL,EAAA,EAAI,KAAA;AAAA,MACJ,MAAA,EAAQ,mBAAA;AAAA,MACR,SAAA,EAAW,4BAAA;AAAA,MACX,OAAA,EAAS;AAAA,KACX;AAAA,EACF;AAGA,EAAA,MAAM,QAAA,GAAW,gBAAA;AACjB,EAAA,IAAI,CAAC,QAAA,CAAS,IAAA,CAAK,MAAA,CAAO,MAAM,CAAA,EAAG;AACjC,IAAA,OAAO;AAAA,MACL,EAAA,EAAI,KAAA;AAAA,MACJ,MAAA,EAAQ,mBAAA;AAAA,MACR,SAAA,EAAW,4BAAA;AAAA,MACX,OAAA,EAAS;AAAA,KACX;AAAA,EACF;AAGA,EAAA,IAAI;AACF,IAAA,MAAM,GAAA,GAAM,IAAI,GAAA,CAAI,MAAA,CAAO,GAAG,CAAA;AAC9B,IAAA,IAAI,GAAA,CAAI,aAAa,QAAA,EAAU;AAC7B,MAAA,OAAO;AAAA,QACL,EAAA,EAAI,KAAA;AAAA,QACJ,MAAA,EAAQ,uBAAA;AAAA,QACR,SAAA,EAAW,gCAAA;AAAA,QACX,OAAA,EAAS;AAAA,OACX;AAAA,IACF;AAAA,EACF,CAAA,CAAA,MAAQ;AACN,IAAA,OAAO;AAAA,MACL,EAAA,EAAI,KAAA;AAAA,MACJ,MAAA,EAAQ,mBAAA;AAAA,MACR,SAAA,EAAW,4BAAA;AAAA,MACX,OAAA,EAAS;AAAA,KACX;AAAA,EACF;AAGA,EAAA,MAAM,aAAqC,EAAC;AAC5C,EAAA,KAAA,MAAW,GAAA,IAAO,YAAY,IAAA,EAAM;AAClC,IAAA,IAAI,GAAA,CAAI,UAAA,CAAW,MAAM,CAAA,EAAG;AAC1B,MAAA,UAAA,CAAW,GAAG,CAAA,GAAI,MAAA,CAAO,GAAG,CAAA;AAAA,IAC9B;AAAA,EACF;AAEA,EAAA,OAAO;AAAA,IACL,EAAA,EAAI,IAAA;AAAA,IACJ,MAAA,EAAQ;AAAA,MACN,OAAA,EAAS,SAAA;AAAA,MACT,SAAA,EAAW,QAAA;AAAA,MACX,aAAa,MAAA,CAAO,MAAA;AAAA,MACpB,KAAK,MAAA,CAAO,GAAA;AAAA,MACZ,GAAI,OAAO,IAAA,CAAK,UAAU,EAAE,MAAA,GAAS,CAAA,IAAK,EAAE,UAAA;AAAW;AACzD,GACF;AACF;AAuBA,SAAS,sBAAsB,KAAA,EAAsC;AACnE,EAAA,MAAM,SAAiC,EAAC;AACxC,EAAA,MAAM,aAAuB,EAAC;AAC9B,EAAA,MAAM,OAAiB,EAAC;AAExB,EAAA,IAAI,CAAA,GAAI,CAAA;AACR,EAAA,MAAM,MAAM,KAAA,CAAM,MAAA;AAElB,EAAA,OAAO,IAAI,GAAA,EAAK;AAEd,IAAA,OAAO,CAAA,GAAI,GAAA,KAAQ,KAAA,CAAM,CAAC,CAAA,KAAM,GAAA,IAAO,KAAA,CAAM,CAAC,CAAA,KAAM,GAAA,IAAO,KAAA,CAAM,CAAC,MAAM,GAAA,CAAA,EAAO;AAC7E,MAAA,CAAA,EAAA;AAAA,IACF;AACA,IAAA,IAAI,KAAK,GAAA,EAAK;AAGd,IAAA,MAAM,QAAA,GAAW,CAAA;AACjB,IAAA,OAAO,IAAI,GAAA,IAAO,IAAA,CAAK,KAAK,KAAA,CAAM,CAAC,CAAC,CAAA,EAAG;AACrC,MAAA,CAAA,EAAA;AAAA,IACF;AACA,IAAA,MAAM,GAAA,GAAM,KAAA,CAAM,KAAA,CAAM,QAAA,EAAU,CAAC,CAAA;AACnC,IAAA,IAAI,CAAC,GAAA,EAAK;AAGV,IAAA,OAAO,CAAA,GAAI,GAAA,IAAO,KAAA,CAAM,CAAC,MAAM,GAAA,EAAK,CAAA,EAAA;AAGpC,IAAA,IAAI,CAAA,IAAK,GAAA,IAAO,KAAA,CAAM,CAAC,MAAM,GAAA,EAAK;AAClC,IAAA,CAAA,EAAA;AAGA,IAAA,OAAO,CAAA,GAAI,GAAA,IAAO,KAAA,CAAM,CAAC,MAAM,GAAA,EAAK,CAAA,EAAA;AAGpC,IAAA,IAAI,KAAA;AACJ,IAAA,IAAI,KAAA,CAAM,CAAC,CAAA,KAAM,GAAA,EAAK;AAEpB,MAAA,CAAA,EAAA;AACA,MAAA,MAAM,UAAA,GAAa,CAAA;AACnB,MAAA,OAAO,CAAA,GAAI,GAAA,IAAO,KAAA,CAAM,CAAC,MAAM,GAAA,EAAK;AAClC,QAAA,CAAA,EAAA;AAAA,MACF;AACA,MAAA,KAAA,GAAQ,KAAA,CAAM,KAAA,CAAM,UAAA,EAAY,CAAC,CAAA;AACjC,MAAA,IAAI,IAAI,GAAA,EAAK,CAAA,EAAA;AAAA,IACf,CAAA,MAAO;AAEL,MAAA,MAAM,UAAA,GAAa,CAAA;AACnB,MAAA,OAAO,CAAA,GAAI,GAAA,IAAO,KAAA,CAAM,CAAC,CAAA,KAAM,GAAA,IAAO,KAAA,CAAM,CAAC,CAAA,KAAM,GAAA,IAAO,KAAA,CAAM,CAAC,MAAM,GAAA,EAAM;AAC3E,QAAA,CAAA,EAAA;AAAA,MACF;AACA,MAAA,KAAA,GAAQ,KAAA,CAAM,KAAA,CAAM,UAAA,EAAY,CAAC,CAAA;AAAA,IACnC;AAEA,IAAA,IAAA,CAAK,KAAK,GAAG,CAAA;AAGb,IAAA,IAAI,OAAO,MAAA,EAAQ;AACjB,MAAA,UAAA,CAAW,KAAK,GAAG,CAAA;AAAA,IACrB;AAEA,IAAA,MAAA,CAAO,GAAG,CAAA,GAAI,KAAA;AAAA,EAChB;AAEA,EAAA,OAAO,EAAE,MAAA,EAAQ,UAAA,EAAY,IAAA,EAAK;AACpC;AAgBO,SAAS,iBAAiB,IAAA,EAA+D;AAC9F,EAAA,IAAI,IAAA,KAAS,IAAA,IAAQ,OAAO,IAAA,KAAS,QAAA,EAAU;AAC7C,IAAA,OAAO;AAAA,MACL,EAAA,EAAI,KAAA;AAAA,MACJ,MAAA,EAAQ,mBAAA;AAAA,MACR,SAAA,EAAW,4BAAA;AAAA,MACX,OAAA,EAAS;AAAA,KACX;AAAA,EACF;AAEA,EAAA,MAAM,GAAA,GAAM,IAAA;AAGZ,EAAA,IAAI,mBAAmB,GAAA,EAAK;AAC1B,IAAA,IAAI,CAAC,KAAA,CAAM,OAAA,CAAQ,GAAA,CAAI,aAAa,CAAA,EAAG;AACrC,MAAA,OAAO;AAAA,QACL,EAAA,EAAI,KAAA;AAAA,QACJ,MAAA,EAAQ,mBAAA;AAAA,QACR,SAAA,EAAW,4BAAA;AAAA,QACX,OAAA,EAAS;AAAA,OACX;AAAA,IACF;AAEA,IAAA,MAAM,WAAqB,EAAC;AAC5B,IAAA,KAAA,IAAS,IAAI,CAAA,EAAG,CAAA,GAAI,GAAA,CAAI,aAAA,CAAc,QAAQ,CAAA,EAAA,EAAK;AACjD,MAAA,MAAM,OAAA,GAAU,GAAA,CAAI,aAAA,CAAc,CAAC,CAAA;AACnC,MAAA,IAAI,OAAO,YAAY,QAAA,EAAU;AAC/B,QAAA,OAAO;AAAA,UACL,EAAA,EAAI,KAAA;AAAA,UACJ,MAAA,EAAQ,mBAAA;AAAA,UACR,SAAA,EAAW,4BAAA;AAAA,UACX,OAAA,EAAS,iBAAiB,CAAC,CAAA,kBAAA;AAAA,SAC7B;AAAA,MACF;AACA,MAAA,QAAA,CAAS,KAAK,OAAO,CAAA;AAAA,IACvB;AAEA,IAAA,IAAI,QAAA,CAAS,WAAW,CAAA,EAAG;AACzB,MAAA,OAAO;AAAA,QACL,EAAA,EAAI,KAAA;AAAA,QACJ,MAAA,EAAQ,mBAAA;AAAA,QACR,SAAA,EAAW,4BAAA;AAAA,QACX,OAAA,EAAS;AAAA,OACX;AAAA,IACF;AAEA,IAAA,OAAO;AAAA,MACL,EAAA,EAAI,IAAA;AAAA,MACJ,MAAA,EAAQ;AAAA,QACN,OAAA,EAAS,MAAA;AAAA,QACT;AAAA;AACF,KACF;AAAA,EACF;AAGA,EAAA,IAAI,kBAAkB,GAAA,EAAK;AACzB,IAAA,IAAI,OAAO,GAAA,CAAI,YAAA,KAAiB,QAAA,EAAU;AACxC,MAAA,OAAO;AAAA,QACL,EAAA,EAAI,KAAA;AAAA,QACJ,MAAA,EAAQ,mBAAA;AAAA,QACR,SAAA,EAAW,4BAAA;AAAA,QACX,OAAA,EAAS;AAAA,OACX;AAAA,IACF;AAEA,IAAA,IAAI,GAAA,CAAI,YAAA,CAAa,MAAA,KAAW,CAAA,EAAG;AACjC,MAAA,OAAO;AAAA,QACL,EAAA,EAAI,KAAA;AAAA,QACJ,MAAA,EAAQ,mBAAA;AAAA,QACR,SAAA,EAAW,4BAAA;AAAA,QACX,OAAA,EAAS;AAAA,OACX;AAAA,IACF;AAEA,IAAA,OAAO;AAAA,MACL,EAAA,EAAI,IAAA;AAAA,MACJ,MAAA,EAAQ;AAAA,QACN,OAAA,EAAS,MAAA;AAAA,QACT,QAAA,EAAU,CAAC,GAAA,CAAI,YAAY;AAAA;AAC7B,KACF;AAAA,EACF;AAEA,EAAA,OAAO;AAAA,IACL,EAAA,EAAI,KAAA;AAAA,IACJ,MAAA,EAAQ,mBAAA;AAAA,IACR,SAAA,EAAW,4BAAA;AAAA,IACX,OAAA,EAAS;AAAA,GACX;AACF;AAYO,SAAS,sBAAsB,OAAA,EAGN;AAC9B,EAAA,MAAM,cAAc,OAAA,CAAQ,OAAA,CAAQ,cAAc,CAAA,IAAK,OAAA,CAAQ,QAAQ,cAAc,CAAA;AACrF,EAAA,MAAM,cACJ,OAAA,CAAQ,OAAA,CAAQ,sBAAsB,CAAA,IAAK,OAAA,CAAQ,QAAQ,sBAAsB,CAAA;AAGnF,EAAA,IAAI,gBAAgB,MAAA,EAAW;AAC7B,IAAA,OAAO,mBAAmB,WAAW,CAAA;AAAA,EACvC;AAGA,EAAA,IAAI,gBAAgB,MAAA,EAAW;AAC7B,IAAA,OAAO,oBAAoB,WAAW,CAAA;AAAA,EACxC;AAGA,EAAA,IAAI,OAAA,CAAQ,SAAS,MAAA,EAAW;AAC9B,IAAA,OAAO,gBAAA,CAAiB,QAAQ,IAAI,CAAA;AAAA,EACtC;AAEA,EAAA,OAAO;AAAA,IACL,EAAA,EAAI,KAAA;AAAA,IACJ,MAAA,EAAQ,mBAAA;AAAA,IACR,SAAA,EAAW,4BAAA;AAAA,IACX,OAAA,EACE;AAAA,GACJ;AACF;ACjdA,SAAS,aAAa,SAAA,EAA8C;AAClE,EAAA,MAAM,SAAS,SAAA,CAAU,MAAA;AAEzB,EAAA,QAAQ,MAAA;AAAQ,IACd,KAAK,WAAA;AAAA,IACL,KAAK,YAAA;AAAA,IACL,KAAK,UAAA;AAAA,IACL,KAAK,YAAA;AAAA,IACL,KAAK,aAAA;AAAA,IACL,KAAK,uBAAA;AACH,MAAA,OAAO;AAAA,QACL,EAAA,EAAI,KAAA;AAAA,QACJ,MAAA,EAAQ,uBAAA;AAAA,QACR,SAAA,EAAW,gCAAA;AAAA,QACX,SAAS,SAAA,CAAU;AAAA,OACrB;AAAA,IAEF,KAAK,SAAA;AACH,MAAA,OAAO;AAAA,QACL,EAAA,EAAI,KAAA;AAAA,QACJ,MAAA,EAAQ,uBAAA;AAAA,QACR,SAAA,EAAW,gCAAA;AAAA,QACX,SAAS,SAAA,CAAU;AAAA,OACrB;AAAA,IAEF,KAAK,oBAAA;AACH,MAAA,OAAO;AAAA,QACL,EAAA,EAAI,KAAA;AAAA,QACJ,MAAA,EAAQ,yBAAA;AAAA,QACR,SAAA,EAAW,kCAAA;AAAA,QACX,SAAS,SAAA,CAAU;AAAA,OACrB;AAAA,IAEF;AACE,MAAA,OAAO;AAAA,QACL,EAAA,EAAI,KAAA;AAAA,QACJ,MAAA,EAAQ,sBAAA;AAAA,QACR,SAAA,EAAW,+BAAA;AAAA,QACX,SAAS,SAAA,CAAU;AAAA,OACrB;AAAA;AAEN;AAkBA,eAAsB,uBACpB,OAAA,EAC6B;AAC7B,EAAA,MAAM,EAAE,GAAA,EAAK,cAAA,EAAgB,YAAA,GAAe,IAAG,GAAI,OAAA;AAGnD,EAAA,MAAM,QAAA,GAAW,gBAAA;AACjB,EAAA,IAAI,CAAC,QAAA,CAAS,IAAA,CAAK,cAAc,CAAA,EAAG;AAClC,IAAA,OAAO;AAAA,MACL,EAAA,EAAI,KAAA;AAAA,MACJ,MAAA,EAAQ,sBAAA;AAAA,MACR,SAAA,EAAW,+BAAA;AAAA,MACX,OAAA,EAAS;AAAA,KACX;AAAA,EACF;AAGA,EAAA,IAAI;AACF,IAAA,MAAM,SAAA,GAAY,IAAI,GAAA,CAAI,GAAG,CAAA;AAC7B,IAAA,IAAI,SAAA,CAAU,aAAa,QAAA,EAAU;AACnC,MAAA,OAAO;AAAA,QACL,EAAA,EAAI,KAAA;AAAA,QACJ,MAAA,EAAQ,uBAAA;AAAA,QACR,SAAA,EAAW,gCAAA;AAAA,QACX,OAAA,EAAS;AAAA,OACX;AAAA,IACF;AAAA,EACF,CAAA,CAAA,MAAQ;AACN,IAAA,OAAO;AAAA,MACL,EAAA,EAAI,KAAA;AAAA,MACJ,MAAA,EAAQ,sBAAA;AAAA,MACR,SAAA,EAAW,+BAAA;AAAA,MACX,OAAA,EAAS;AAAA,KACX;AAAA,EACF;AAMA,EAAA,MAAM,WAAA,GAAc,MAAM,aAAA,CAAc,GAAA,EAAK;AAAA,IAC3C,GAAG,YAAA;AAAA,IACH,UAAUb,eAAAA,CAAgB,eAAA;AAAA,IAC1B,cAAA,EAAgB,KAAA;AAAA;AAAA,IAChB,SAAA,EAAW,YAAA,EAAc,SAAA,IAAaA,eAAAA,CAAgB,cAAA;AAAA,IACtD,OAAA,EAAS;AAAA,MACP,MAAA,EAAQ,gDAAA;AAAA,MACR,GAAG,YAAA,CAAa;AAAA;AAClB,GACD,CAAA;AAED,EAAA,IAAI,CAAC,YAAY,EAAA,EAAI;AACnB,IAAA,OAAO,aAAa,WAAW,CAAA;AAAA,EACjC;AAEA,EAAA,MAAM,UAAU,WAAA,CAAY,IAAA;AAI5B,EAAA,MAAM,cAAc,WAAA,CAAY,WAAA;AAChC,EAAA,MAAM,oBAAA,GAAuB,CAAC,kBAAA,EAAoB,kBAAA,EAAoB,YAAY,CAAA;AAClF,EAAA,MAAM,kBAAA,GACJ,WAAA,IAAe,CAAC,oBAAA,CAAqB,KAAK,CAAC,QAAA,KAAa,WAAA,CAAY,UAAA,CAAW,QAAQ,CAAC,CAAA,GACpF,CAAA,yBAAA,EAA4B,WAAW,CAAA,4DAAA,CAAA,GACvC,MAAA;AAGN,EAAA,IAAI,CAAC,OAAA,IAAW,OAAA,CAAQ,IAAA,EAAK,CAAE,WAAW,CAAA,EAAG;AAC3C,IAAA,OAAO;AAAA,MACL,EAAA,EAAI,KAAA;AAAA,MACJ,MAAA,EAAQ,mBAAA;AAAA,MACR,SAAA,EAAW,4BAAA;AAAA,MACX,OAAA,EAAS;AAAA,KACX;AAAA,EACF;AAGA,EAAA,MAAM,aAAA,GAAgB,4BAA4B,OAAO,CAAA;AACzD,EAAA,IAAI,CAAC,cAAc,KAAA,EAAO;AACxB,IAAA,OAAO;AAAA,MACL,EAAA,EAAI,KAAA;AAAA,MACJ,MAAA,EAAQ,mBAAA;AAAA,MACR,SAAA,EAAW,4BAAA;AAAA,MACX,SAAS,aAAA,CAAc;AAAA,KACzB;AAAA,EACF;AAGA,EAAA,MAAM,YAAA,GAAe,MAAMa,SAAAA,CAAU,OAAO,CAAA;AAG5C,EAAA,IAAI,iBAAiB,cAAA,EAAgB;AACnC,IAAA,OAAO;AAAA,MACL,EAAA,EAAI,KAAA;AAAA,MACJ,MAAA,EAAQ,yBAAA;AAAA,MACR,SAAA,EAAW,kCAAA;AAAA,MACX,OAAA,EAAS,uDAAA;AAAA,MACT,YAAA;AAAA,MACA;AAAA,KACF;AAAA,EACF;AAEA,EAAA,OAAO;AAAA,IACL,EAAA,EAAI,IAAA;AAAA,IACJ,OAAA;AAAA,IACA,YAAA;AAAA,IACA,aAAA,EAAe,IAAA;AAAA,IACf,aAAa,WAAA,CAAY,WAAA;AAAA,IACzB,GAAI,kBAAA,IAAsB,EAAE,kBAAA;AAAmB,GACjD;AACF;AAUA,SAAS,4BACP,KAAA,EACqD;AACrD,EAAA,MAAM,QAAA,GAAW,KAAA,CAAM,KAAA,CAAM,GAAG,CAAA;AAEhC,EAAA,IAAI,QAAA,CAAS,WAAW,CAAA,EAAG;AACzB,IAAA,OAAO;AAAA,MACL,KAAA,EAAO,KAAA;AAAA,MACP,OAAA,EAAS,CAAA,4DAAA,EAA+D,QAAA,CAAS,MAAM,CAAA;AAAA,KACzF;AAAA,EACF;AAGA,EAAA,MAAM,cAAA,GAAiB,kBAAA;AAEvB,EAAA,KAAA,IAAS,CAAA,GAAI,CAAA,EAAG,CAAA,GAAI,QAAA,CAAS,QAAQ,CAAA,EAAA,EAAK;AACxC,IAAA,MAAM,OAAA,GAAU,SAAS,CAAC,CAAA;AAC1B,IAAA,IAAI,OAAA,CAAQ,WAAW,CAAA,EAAG;AACxB,MAAA,OAAO;AAAA,QACL,KAAA,EAAO,KAAA;AAAA,QACP,OAAA,EAAS,CAAA,2CAAA,EAA8C,CAAA,GAAI,CAAC,CAAA,SAAA;AAAA,OAC9D;AAAA,IACF;AACA,IAAA,IAAI,CAAC,cAAA,CAAe,IAAA,CAAK,OAAO,CAAA,EAAG;AACjC,MAAA,OAAO;AAAA,QACL,KAAA,EAAO,KAAA;AAAA,QACP,OAAA,EAAS,CAAA,2CAAA,EAA8C,CAAA,GAAI,CAAC,CAAA,4BAAA;AAAA,OAC9D;AAAA,IACF;AAAA,EACF;AAEA,EAAA,OAAO,EAAE,OAAO,IAAA,EAAK;AACvB;AAOA,SAAS,mBAAmB,KAAA,EAAuC;AACjE,EAAA,MAAM,SAAiC,EAAC;AACxC,EAAA,IAAI,CAAA,GAAI,CAAA;AACR,EAAA,MAAM,MAAM,KAAA,CAAM,MAAA;AAElB,EAAA,OAAO,IAAI,GAAA,EAAK;AAEd,IAAA,OAAO,CAAA,GAAI,GAAA,KAAQ,KAAA,CAAM,CAAC,CAAA,KAAM,GAAA,IAAO,KAAA,CAAM,CAAC,CAAA,KAAM,GAAA,IAAO,KAAA,CAAM,CAAC,MAAM,GAAA,CAAA,EAAO;AAC7E,MAAA,CAAA,EAAA;AAAA,IACF;AACA,IAAA,IAAI,KAAK,GAAA,EAAK;AAGd,IAAA,MAAM,QAAA,GAAW,CAAA;AACjB,IAAA,OAAO,IAAI,GAAA,IAAO,IAAA,CAAK,KAAK,KAAA,CAAM,CAAC,CAAC,CAAA,EAAG;AACrC,MAAA,CAAA,EAAA;AAAA,IACF;AACA,IAAA,MAAM,GAAA,GAAM,KAAA,CAAM,KAAA,CAAM,QAAA,EAAU,CAAC,CAAA;AACnC,IAAA,IAAI,CAAC,GAAA,EAAK;AAGV,IAAA,OAAO,CAAA,GAAI,GAAA,IAAO,KAAA,CAAM,CAAC,MAAM,GAAA,EAAK,CAAA,EAAA;AAGpC,IAAA,IAAI,CAAA,IAAK,GAAA,IAAO,KAAA,CAAM,CAAC,MAAM,GAAA,EAAK;AAClC,IAAA,CAAA,EAAA;AAGA,IAAA,OAAO,CAAA,GAAI,GAAA,IAAO,KAAA,CAAM,CAAC,MAAM,GAAA,EAAK,CAAA,EAAA;AAGpC,IAAA,IAAI,KAAA;AACJ,IAAA,IAAI,KAAA,CAAM,CAAC,CAAA,KAAM,GAAA,EAAK;AAEpB,MAAA,CAAA,EAAA;AACA,MAAA,MAAM,UAAA,GAAa,CAAA;AACnB,MAAA,OAAO,CAAA,GAAI,GAAA,IAAO,KAAA,CAAM,CAAC,MAAM,GAAA,EAAK;AAClC,QAAA,CAAA,EAAA;AAAA,MACF;AACA,MAAA,KAAA,GAAQ,KAAA,CAAM,KAAA,CAAM,UAAA,EAAY,CAAC,CAAA;AACjC,MAAA,IAAI,IAAI,GAAA,EAAK,CAAA,EAAA;AAAA,IACf,CAAA,MAAO;AAEL,MAAA,MAAM,UAAA,GAAa,CAAA;AACnB,MAAA,OAAO,CAAA,GAAI,GAAA,IAAO,KAAA,CAAM,CAAC,CAAA,KAAM,GAAA,IAAO,KAAA,CAAM,CAAC,CAAA,KAAM,GAAA,IAAO,KAAA,CAAM,CAAC,MAAM,GAAA,EAAM;AAC3E,QAAA,CAAA,EAAA;AAAA,MACF;AACA,MAAA,KAAA,GAAQ,KAAA,CAAM,KAAA,CAAM,UAAA,EAAY,CAAC,CAAA;AAAA,IACnC;AAEA,IAAA,MAAA,CAAO,GAAG,CAAA,GAAI,KAAA;AAAA,EAChB;AAEA,EAAA,OAAO,MAAA;AACT;AAWA,eAAsB,qBAAA,CACpB,eACA,YAAA,EAC6B;AAI7B,EAAA,MAAM,MAAA,GAAS,mBAAmB,aAAa,CAAA;AAE/C,EAAA,IAAI,CAAC,OAAO,MAAA,EAAQ;AAClB,IAAA,OAAO;AAAA,MACL,EAAA,EAAI,KAAA;AAAA,MACJ,MAAA,EAAQ,sBAAA;AAAA,MACR,SAAA,EAAW,+BAAA;AAAA,MACX,OAAA,EAAS;AAAA,KACX;AAAA,EACF;AAEA,EAAA,IAAI,CAAC,OAAO,GAAA,EAAK;AACf,IAAA,OAAO;AAAA,MACL,EAAA,EAAI,KAAA;AAAA,MACJ,MAAA,EAAQ,sBAAA;AAAA,MACR,SAAA,EAAW,+BAAA;AAAA,MACX,OAAA,EAAS;AAAA,KACX;AAAA,EACF;AAEA,EAAA,OAAO,sBAAA,CAAuB;AAAA,IAC5B,KAAK,MAAA,CAAO,GAAA;AAAA,IACZ,gBAAgB,MAAA,CAAO,MAAA;AAAA,IACvB;AAAA,GACD,CAAA;AACH;;;AC1XA,IAAM,8BAAA,GAAiC,GAAA;AAEvC,IAAM,mBAAA,GAAsB,GAAA;AA+B5B,SAAS,WAAA,CAAY,OAAe,IAAA,EAAsB;AAIxD,EAAA,IAAI,CAAC,MAAA,CAAO,aAAA,CAAc,KAAK,CAAA,EAAG;AAChC,IAAA,MAAM,IAAI,KAAA,CAAM,CAAA,mBAAA,EAAsB,IAAI,CAAA,uBAAA,CAAyB,CAAA;AAAA,EACrE;AACA,EAAA,OAAO,KAAA;AACT;AAEA,SAAS,WAAA,CAAY,OAAe,IAAA,EAAsB;AACxD,EAAA,WAAA,CAAY,OAAO,IAAI,CAAA;AACvB,EAAA,IAAI,SAAS,CAAA,EAAG;AACd,IAAA,MAAM,IAAI,KAAA,CAAM,CAAA,mBAAA,EAAsB,IAAI,CAAA,2BAAA,CAA6B,CAAA;AAAA,EACzE;AACA,EAAA,OAAO,KAAA;AACT;AAEA,SAAS,cAAA,CAAe,OAAe,IAAA,EAAsB;AAC3D,EAAA,WAAA,CAAY,OAAO,IAAI,CAAA;AACvB,EAAA,IAAI,QAAQ,CAAA,EAAG;AACb,IAAA,MAAM,IAAI,KAAA,CAAM,CAAA,mBAAA,EAAsB,IAAI,CAAA,+BAAA,CAAiC,CAAA;AAAA,EAC7E;AACA,EAAA,OAAO,KAAA;AACT;AAEA,SAAS,cAAA,CAAe,OAAe,IAAA,EAAsB;AAC3D,EAAA,IAAI,OAAO,KAAA,KAAU,QAAA,IAAY,KAAA,CAAM,WAAW,CAAA,EAAG;AACnD,IAAA,MAAM,IAAI,KAAA,CAAM,CAAA,mBAAA,EAAsB,IAAI,CAAA,2BAAA,CAA6B,CAAA;AAAA,EACzE;AACA,EAAA,OAAO,KAAA;AACT;AAQO,SAAS,kBAAkB,OAAA,EAA0C;AAC1E,EAAA,MAAM,aAAA,GAAgB,WAAA,CAAY,OAAA,CAAQ,aAAA,EAAe,eAAe,CAAA;AACxE,EAAA,MAAM,mBAAA,GACJ,QAAQ,mBAAA,KAAwB,MAAA,GAC5B,iCACA,cAAA,CAAe,OAAA,CAAQ,qBAAqB,qBAAqB,CAAA;AACvE,EAAA,MAAM,UAAA,GACJ,QAAQ,UAAA,KAAe,MAAA,GACnB,sBACA,WAAA,CAAY,OAAA,CAAQ,YAAY,YAAY,CAAA;AAClD,EAAA,MAAM,GAAA,GAAM,QAAQ,GAAA,KAAQ,MAAM,KAAK,KAAA,CAAM,IAAA,CAAK,GAAA,EAAI,GAAI,GAAI,CAAA,CAAA;AAK9D,EAAA,IAAI,UAAU,MAAA,CAAO,iBAAA;AACrB,EAAA,MAAM,aAAa,MAAc;AAC/B,IAAA,MAAM,GAAA,GAAM,WAAA,CAAY,GAAA,EAAI,EAAG,OAAO,CAAA;AACtC,IAAA,IAAI,GAAA,GAAM,SAAS,OAAO,OAAA;AAC1B,IAAA,OAAA,GAAU,GAAA;AACV,IAAA,OAAO,GAAA;AAAA,EACT,CAAA;AAOA,EAAA,MAAM,IAAA,uBAAW,GAAA,EAAyB;AAG1C,EAAA,MAAM,KAAA,GAAQ,CAAC,GAAA,EAAa,GAAA,KAAwB,CAAA,EAAG,GAAA,CAAI,MAAM,CAAA,CAAA,EAAI,GAAG,CAAA,EAAG,GAAA,CAAI,MAAM,IAAI,GAAG,CAAA,CAAA;AAE5F,EAAA,MAAM,YAAA,GAAe,CAAC,UAAA,KAA6B;AACjD,IAAA,KAAA,MAAW,CAAC,GAAA,EAAK,KAAK,CAAA,IAAK,IAAA,EAAM;AAC/B,MAAA,IAAI,KAAA,CAAM,YAAY,UAAA,EAAY;AAClC,MAAA,IAAA,CAAK,OAAO,GAAG,CAAA;AAAA,IACjB;AAAA,EACF,CAAA;AAEA,EAAA,OAAO;AAAA,IACL,MAAM,MAAA,EAAuE;AAG3E,MAAA,MAAM,GAAA,GAAM,WAAA,CAAY,MAAA,CAAO,GAAA,EAAK,YAAY,CAAA;AAChD,MAAA,MAAM,GAAA,GAAM,cAAA,CAAe,MAAA,CAAO,GAAA,EAAK,YAAY,CAAA;AACnD,MAAA,MAAM,GAAA,GAAM,cAAA,CAAe,MAAA,CAAO,GAAA,EAAK,YAAY,CAAA;AACnD,MAAA,MAAM,IAAI,UAAA,EAAW;AAGrB,MAAA,YAAA,CAAa,CAAC,CAAA;AAId,MAAA,IAAI,GAAA,GAAM,CAAA,GAAI,aAAA,IAAiB,GAAA,GAAM,IAAI,mBAAA,EAAqB;AAC5D,QAAA,OAAO,gBAAA;AAAA,MACT;AAEA,MAAA,MAAM,GAAA,GAAM,KAAA,CAAM,GAAA,EAAK,GAAG,CAAA;AAC1B,MAAA,IAAI,IAAA,CAAK,GAAA,CAAI,GAAG,CAAA,EAAG;AACjB,QAAA,OAAO,UAAA;AAAA,MACT;AASA,MAAA,MAAM,SAAA,GAAY,WAAA,CAAY,CAAA,GAAI,aAAA,GAAgB,qBAAqB,cAAc,CAAA;AAGrF,MAAA,IAAI,IAAA,CAAK,QAAQ,UAAA,EAAY;AAC3B,QAAA,MAAM,MAAA,GAAS,IAAA,CAAK,IAAA,EAAK,CAAE,MAAK,CAAE,KAAA;AAClC,QAAA,IAAI,MAAA,KAAW,MAAA,EAAW,IAAA,CAAK,MAAA,CAAO,MAAM,CAAA;AAAA,MAC9C;AACA,MAAA,IAAA,CAAK,GAAA,CAAI,GAAA,EAAK,EAAE,SAAA,EAAW,CAAA;AAC3B,MAAA,OAAO,OAAA;AAAA,IACT;AAAA,GACF;AACF","file":"index.mjs","sourcesContent":["/**\n * Internal codec strategy types.\n *\n * @internal\n *\n * These types MUST NOT be re-exported from packages/protocol/src/index.ts.\n * The dist-leak gate (Tier 2) asserts that these names never appear in\n * @peac/protocol's public root declaration (dist/index.d.ts) or any\n * subpath in @peac/protocol/package.json `exports`.\n *\n * The canonical implementation of these types lives at\n * packages/protocol/src/_internal/record-core/codec/jws-jwt.ts and is\n * imported via RELATIVE paths from issue.ts / verify-local.ts.\n */\n\nimport type { VerifyResult } from '@peac/crypto';\n\n/**\n * Header view returned by codec.peekHeader().\n *\n * @internal\n */\nexport interface CodecHeader {\n /** JOSE typ value. Required at peek time; not defaulted. */\n readonly typ: string;\n /** Algorithm identifier. JWS string (e.g., 'EdDSA'). */\n readonly alg: string;\n /** Key identifier (when present). */\n readonly kid?: string;\n /** Full raw protected-header object for downstream policy inspection. */\n readonly raw: Readonly<Record<string, unknown>>;\n}\n\n/**\n * Codec error with a structured code.\n *\n * @internal\n */\nexport class CodecError extends Error {\n constructor(\n public readonly code: string,\n message: string\n ) {\n super(message);\n this.name = 'CodecError';\n }\n}\n\n/**\n * Internal codec strategy. v0.13.1 ships exactly one implementation:\n * jws-jwt. Signature mirrors @peac/crypto.signWire02 / verify exactly;\n * concrete Uint8Array keys (Ed25519 at this layer); parametric only on\n * the optional payload type T of VerifyResult<T>. Future codecs with\n * different key shapes register a different interface; they MAY NOT\n * shoehorn into this interface via parametric generics.\n *\n * @internal\n */\nexport interface RecordCodec {\n /** Codec name. Used for registry lookup. */\n readonly name: string;\n\n /**\n * Sign and serialize. Pure pass-through to the underlying signer; never\n * accepts a typ override (the signer hardcodes typ per the wire format).\n */\n encode(payload: unknown, privateKey: Uint8Array, kid: string): Promise<string>;\n\n /**\n * Verify and decode. Returns the underlying crypto verifier's result\n * unchanged. Throws structured CodecError on malformed input;\n * propagates the underlying CryptoError on signature mismatch.\n */\n decode<T = unknown>(serialized: string, publicKey: Uint8Array): Promise<VerifyResult<T>>;\n\n /**\n * Header-only decode. Structural strictness only: throws CodecError on\n * missing typ, missing alg, malformed protected header JSON, or\n * malformed compact JWS (must be exactly three non-empty\n * dot-separated segments). Does NOT enforce policy on crit / zip /\n * b64 / unsupported alg; those rejections are downstream JOSE-hardening\n * responsibilities and are surfaced via the raw header for inspection.\n *\n * Note: this codec is JWS/JWT string-based. The `serialized` parameter\n * is typed as `string` for that reason. Future codecs that operate on\n * binary inputs (e.g., COSE/CBOR over `Uint8Array`) MUST register a\n * different interface; do not generalize this one to imply binary\n * support that the JWS codec does not provide.\n */\n peekHeader(serialized: string): CodecHeader;\n}\n","/**\n * Default codec: pure pass-through to @peac/crypto.signWire02 / verify.\n *\n * @internal\n *\n * Byte-identical encode output to signWire02 is guaranteed by the\n * golden-vector test (codec-jws-jwt-byte-identical.test.ts). Decode\n * returns the underlying cryptoVerify result unchanged.\n *\n * peekHeader is structural-only: it requires typ + alg presence and a\n * structurally valid compact JWS, but does NOT enforce policy on\n * unsupported alg, crit, zip, or b64:false. Those rejections are\n * downstream responsibilities (kernel constraints, JOSE hardening).\n *\n * The canonical implementation lives here. Tests import via relative\n * paths from packages/protocol/__tests__/_internal/.\n */\n\nimport {\n signWire02,\n verify as cryptoVerify,\n base64urlDecodeString,\n type VerifyResult,\n} from '@peac/crypto';\nimport { CodecError, type CodecHeader, type RecordCodec } from './types.js';\n\nclass JwsJwtCodec implements RecordCodec {\n readonly name = 'jws-jwt' as const;\n\n async encode(payload: unknown, privateKey: Uint8Array, kid: string): Promise<string> {\n return signWire02(payload, privateKey, kid);\n }\n\n async decode<T = unknown>(serialized: string, publicKey: Uint8Array): Promise<VerifyResult<T>> {\n return cryptoVerify<T>(serialized, publicKey);\n }\n\n peekHeader(serialized: string): CodecHeader {\n // Structural compact-JWS shape: exactly three non-empty\n // dot-separated segments: header.payload.signature.\n const segments = serialized.split('.');\n if (segments.length !== 3) {\n throw new CodecError(\n 'CODEC_PEEK_MALFORMED',\n `jws-jwt: malformed compact JWS (expected 3 segments, got ${segments.length})`\n );\n }\n const [headerB64, payloadB64, signatureB64] = segments;\n if (headerB64.length === 0) {\n throw new CodecError(\n 'CODEC_PEEK_MALFORMED',\n 'jws-jwt: malformed compact JWS (empty header segment)'\n );\n }\n if (payloadB64.length === 0) {\n throw new CodecError(\n 'CODEC_PEEK_MALFORMED',\n 'jws-jwt: malformed compact JWS (empty payload segment)'\n );\n }\n if (signatureB64.length === 0) {\n throw new CodecError(\n 'CODEC_PEEK_MALFORMED',\n 'jws-jwt: malformed compact JWS (empty signature segment)'\n );\n }\n\n let header: Record<string, unknown>;\n try {\n // Runtime-neutral base64url -> UTF-8 string decode\n // (TextDecoder + Uint8Array via @peac/crypto.base64urlDecodeString;\n // no Node Buffer dependency: works in browser, edge worker, Deno).\n const headerJson = base64urlDecodeString(headerB64);\n header = JSON.parse(headerJson) as Record<string, unknown>;\n } catch (err) {\n throw new CodecError(\n 'CODEC_PEEK_INVALID_HEADER',\n `jws-jwt: protected header JSON parse failed: ${(err as Error).message}`\n );\n }\n\n if (typeof header.typ !== 'string') {\n throw new CodecError(\n 'CODEC_PEEK_MISSING_TYP',\n 'jws-jwt: protected header missing required field \"typ\" (string)'\n );\n }\n if (typeof header.alg !== 'string') {\n throw new CodecError(\n 'CODEC_PEEK_MISSING_ALG',\n 'jws-jwt: protected header missing required field \"alg\" (string)'\n );\n }\n\n return {\n typ: header.typ,\n alg: header.alg,\n kid: typeof header.kid === 'string' ? header.kid : undefined,\n raw: header,\n };\n }\n}\n\n/**\n * Default codec instance. Internal-only.\n *\n * @internal\n */\nexport const defaultCodec: RecordCodec = new JwsJwtCodec();\n","/**\n * Bounded internal kernel-constraints validator.\n *\n * INTERNAL ONLY. This is the parity-observed counterpart of\n * @peac/schema.validateKernelConstraints; both implementations consume\n * the same KERNEL_CONSTRAINTS constants from @peac/kernel and emit the\n * same ConstraintValidationResult shape. The differential parity test\n * asserts byte-identical equality between the two on every eligible\n * fixture; any divergence is stop-the-line.\n *\n * Existing validation in @peac/schema remains canonical. This module\n * is observational only; it is NOT re-exported from\n * packages/protocol/src/index.ts and is NOT wired into runtime paths\n * (issue.ts, verify-local.ts) in v0.13.1.\n *\n * Implementation invariants (must mirror @peac/schema/src/constraints.ts\n * verbatim; any drift fails the parity test):\n * - iterative stack-based traversal (stack-safe; no recursion)\n * - every value (primitives, arrays, objects) is pushed and counted as\n * a node when popped\n * - total-nodes check evaluated FIRST per pop; over-limit pushes the\n * violation with the current totalNodes count and breaks (preserves\n * first-violation semantics)\n * - depth check evaluated SECOND per pop; over-limit pushes a\n * violation and continues (no-op for primitives, prevents deeper\n * descent for containers)\n * - string-length check (primitives only) uses .length (code units)\n * - array-length and object-key-count checks pushed BEFORE descending\n * into children\n * - children pushed in reverse index/key order so traversal visits\n * them in original order (LIFO)\n * - empty path for root; bracket notation for arrays (`a[0]`); dot\n * notation for object keys (`a.b`)\n * - returns { valid: violations.length === 0, violations }\n * - never throws\n * - assumes acyclic input\n */\n\nimport { KERNEL_CONSTRAINTS } from '@peac/schema';\nimport type { ConstraintValidationResult, ConstraintViolation } from '@peac/schema';\n\n/**\n * Validate claims against structural kernel constraints. Mirrors the\n * canonical implementation in @peac/schema for parity.\n *\n * Distinct exported name (validateKernelConstraintsInternal) to avoid\n * collision with the canonical @peac/schema export when both are\n * imported into the same parity test file.\n */\nexport function validateKernelConstraintsInternal(claims: unknown): ConstraintValidationResult {\n const violations: ConstraintViolation[] = [];\n\n if (claims === null || claims === undefined || typeof claims !== 'object') {\n return { valid: true, violations };\n }\n\n let totalNodes = 0;\n const stack: Array<{ value: unknown; depth: number; path: string }> = [\n { value: claims, depth: 0, path: '' },\n ];\n\n while (stack.length > 0) {\n const item = stack.pop()!;\n totalNodes++;\n\n if (totalNodes > KERNEL_CONSTRAINTS.MAX_TOTAL_NODES) {\n violations.push({\n constraint: 'MAX_TOTAL_NODES',\n actual: totalNodes,\n limit: KERNEL_CONSTRAINTS.MAX_TOTAL_NODES,\n path: item.path,\n });\n break;\n }\n\n if (item.depth > KERNEL_CONSTRAINTS.MAX_NESTED_DEPTH) {\n violations.push({\n constraint: 'MAX_NESTED_DEPTH',\n actual: item.depth,\n limit: KERNEL_CONSTRAINTS.MAX_NESTED_DEPTH,\n path: item.path,\n });\n continue;\n }\n\n if (item.value === null || typeof item.value !== 'object') {\n if (typeof item.value === 'string') {\n if (item.value.length > KERNEL_CONSTRAINTS.MAX_STRING_LENGTH) {\n violations.push({\n constraint: 'MAX_STRING_LENGTH',\n actual: item.value.length,\n limit: KERNEL_CONSTRAINTS.MAX_STRING_LENGTH,\n path: item.path,\n });\n }\n }\n continue;\n }\n\n if (Array.isArray(item.value)) {\n if (item.value.length > KERNEL_CONSTRAINTS.MAX_ARRAY_LENGTH) {\n violations.push({\n constraint: 'MAX_ARRAY_LENGTH',\n actual: item.value.length,\n limit: KERNEL_CONSTRAINTS.MAX_ARRAY_LENGTH,\n path: item.path,\n });\n }\n for (let i = item.value.length - 1; i >= 0; i--) {\n stack.push({\n value: item.value[i],\n depth: item.depth + 1,\n path: `${item.path}[${i}]`,\n });\n }\n continue;\n }\n\n const keys = Object.keys(item.value as Record<string, unknown>);\n if (keys.length > KERNEL_CONSTRAINTS.MAX_OBJECT_KEYS) {\n violations.push({\n constraint: 'MAX_OBJECT_KEYS',\n actual: keys.length,\n limit: KERNEL_CONSTRAINTS.MAX_OBJECT_KEYS,\n path: item.path,\n });\n }\n for (let i = keys.length - 1; i >= 0; i--) {\n const key = keys[i];\n const childPath = item.path ? `${item.path}.${key}` : key;\n stack.push({\n value: (item.value as Record<string, unknown>)[key],\n depth: item.depth + 1,\n path: childPath,\n });\n }\n }\n\n return { valid: violations.length === 0, violations };\n}\n","/**\n * Bounded internal type-extension mapping validator.\n *\n * INTERNAL ONLY. This is the parity-observed counterpart of the\n * type/extension warning-emission block at verify-local.ts:477-540\n * (interop strictness branch). Both implementations consume the same\n * registries (REGISTERED_RECEIPT_TYPES, REGISTERED_EXTENSION_GROUP_KEYS,\n * TYPE_TO_EXTENSION_MAP) and the same warning-code constants from\n * @peac/schema; behavioral parity is proven byte-equal by the parity\n * tests, not by code copy.\n *\n * Existing canonical emission in @peac/protocol/verifyLocal remains\n * canonical. This module is observational only; it is NOT re-exported\n * from packages/protocol/src/index.ts and is NOT wired into runtime\n * paths (issue.ts, verify-local.ts) in v0.13.1.\n *\n * Output shape: a deterministically-ordered list of warning records,\n * each carrying only `code` and `pointer`. The canonical emission also\n * carries a `message` field; messages are intentionally omitted from\n * the parity comparison because the missing/mismatch messages embed\n * claim values (claims.type and the expected extension group), and\n * comparison on (code, pointer) is what the verifier output API\n * actually exposes to consumers via the warning code/pointer pair.\n *\n * Emission order (must mirror verify-local.ts exactly; tests assert):\n * 1. type_unregistered (when claims.type is not in REGISTERED_RECEIPT_TYPES)\n * 2. unknown_extension_preserved (one per unknown-but-well-formed\n * extension key, in Object.keys iteration order)\n * 3. extension_group_missing OR extension_group_mismatch (when\n * checkTypeExtensionMapping returns missing/mismatch; not emitted\n * for kind === 'challenge' or for unmapped/custom types)\n */\n\nimport {\n REGISTERED_EXTENSION_GROUP_KEYS,\n REGISTERED_RECEIPT_TYPES,\n WARNING_EXTENSION_GROUP_MISMATCH,\n WARNING_EXTENSION_GROUP_MISSING,\n WARNING_TYPE_UNREGISTERED,\n WARNING_UNKNOWN_EXTENSION,\n isValidExtensionKey,\n} from '@peac/schema';\nimport { TYPE_TO_EXTENSION_MAP } from '@peac/kernel';\n\n/** Minimal claims shape required by the type-extension warning surface. */\nexport interface TypeExtensionMappingInput {\n readonly kind: string;\n readonly type: string;\n readonly extensions?: Record<string, unknown>;\n}\n\n/** Normalized warning entry. Comparison shape; canonical messages omitted. */\nexport interface TypeExtensionMappingWarning {\n readonly code: string;\n readonly pointer: string;\n}\n\n/** Escape `~` and `/` per RFC 6901 for JSON Pointer fragments. */\nfunction escapeJsonPointerSegment(segment: string): string {\n return segment.replace(/~/g, '~0').replace(/\\//g, '~1');\n}\n\n/**\n * Mirror of @peac/protocol/src/type-extension-check.ts:checkTypeExtensionMapping.\n * Returns a status discriminator only; the bounded validator decides whether\n * the discriminator translates to a warning code.\n */\nfunction classifyExpectedGroup(\n kind: string,\n type: string,\n extensions: Record<string, unknown> | undefined\n): 'ok' | 'skip' | 'missing' | 'mismatch' {\n if (kind === 'challenge') return 'skip';\n const expectedGroup = TYPE_TO_EXTENSION_MAP.get(type);\n if (expectedGroup === undefined) return 'skip';\n if (extensions !== undefined && Object.prototype.hasOwnProperty.call(extensions, expectedGroup)) {\n return 'ok';\n }\n if (extensions !== undefined) {\n for (const key of Object.keys(extensions)) {\n if (key !== expectedGroup && REGISTERED_EXTENSION_GROUP_KEYS.has(key)) {\n return 'mismatch';\n }\n }\n }\n return 'missing';\n}\n\n/**\n * Evaluate the type-extension mapping warning surface for parsed Wire 0.2\n * claims. Returns warnings in canonical emission order; emits no warnings\n * when the claims are fully registered and the expected extension group\n * is present (or when no expected group exists for the given type).\n */\nexport function validateTypeExtensionMappingInternal(\n input: TypeExtensionMappingInput\n): TypeExtensionMappingWarning[] {\n const warnings: TypeExtensionMappingWarning[] = [];\n\n // Step 1: type_unregistered\n if (!REGISTERED_RECEIPT_TYPES.has(input.type)) {\n warnings.push({ code: WARNING_TYPE_UNREGISTERED, pointer: '/type' });\n }\n\n // Step 2: unknown_extension_preserved (one per unknown well-formed key)\n if (input.extensions !== undefined) {\n for (const key of Object.keys(input.extensions)) {\n if (!REGISTERED_EXTENSION_GROUP_KEYS.has(key) && isValidExtensionKey(key)) {\n warnings.push({\n code: WARNING_UNKNOWN_EXTENSION,\n pointer: `/extensions/${escapeJsonPointerSegment(key)}`,\n });\n }\n }\n }\n\n // Step 3: extension_group_missing | extension_group_mismatch\n const status = classifyExpectedGroup(input.kind, input.type, input.extensions);\n if (status === 'missing') {\n warnings.push({ code: WARNING_EXTENSION_GROUP_MISSING, pointer: '/type' });\n } else if (status === 'mismatch') {\n warnings.push({ code: WARNING_EXTENSION_GROUP_MISMATCH, pointer: '/type' });\n }\n\n return warnings;\n}\n","/**\n * Bounded internal JOSE header hardening validator.\n *\n * INTERNAL ONLY. This is the parity-observed counterpart of\n * @peac/crypto.validateWire02Header. Both implementations consume the\n * same JOSE protected-header object and apply the same five hardening\n * checks in the same order; behavioral parity is proven byte-equal by\n * the parity tests, not by code copy.\n *\n * Existing canonical hardening in @peac/crypto remains canonical. This\n * module is observational only; it is NOT re-exported from\n * packages/protocol/src/index.ts and is NOT wired into runtime paths\n * (issue.ts, verify-local.ts, peekHeader) in v0.13.1.\n *\n * Scope (must mirror validateWire02Header in packages/crypto/src/jws.ts):\n *\n * 1. kid presence and length:\n * - missing kid (undefined / non-string / empty) -> CRYPTO_JWS_MISSING_KID\n * - kid malformed, or longer than 256 UTF-8 bytes -> CRYPTO_JWS_MISSING_KID\n *\n * 2. embedded key material (jwk, x5c, x5u, jku):\n * - any of the four set -> CRYPTO_JWS_EMBEDDED_KEY\n *\n * 3. crit header:\n * - any value (including null / empty array) -> CRYPTO_JWS_CRIT_REJECTED\n *\n * 4. b64: false (RFC 7797 unencoded payload):\n * - the only rejected value is the boolean false; other values pass through\n * - rejection -> CRYPTO_JWS_B64_REJECTED\n *\n * 5. zip header:\n * - any value -> CRYPTO_JWS_ZIP_REJECTED\n *\n * Out of scope for this module (mirroring validateWire02Header exactly):\n * - alg validation (lives in buildHeader, not validateWire02Header)\n * - typ validation (lives in buildHeader)\n * - signature verification\n * - compact-JWS shape / size checks\n *\n * Order is significant: the canonical function returns the FIRST\n * matching violation per call (it throws on the first hit). The\n * internal validator emits the same first-hit code.\n */\n\n/** Header input shape (matches the parsed JOSE protected header). */\nexport type JoseHardeningInput = Record<string, unknown>;\n\n/**\n * Normalized result. accepted=true means the header passes all five\n * hardening checks. accepted=false carries the canonical CryptoError\n * code emitted by the corresponding canonical check.\n */\nexport type JoseHardeningResult =\n | { readonly accepted: true }\n | { readonly accepted: false; readonly errorCode: string };\n\nconst KID_MAX_UTF8_BYTES = 256;\n\n/**\n * Independent implementation of the canonical kid rule.\n *\n * Deliberately NOT imported from @peac/crypto. This module observes the canonical validator's\n * behaviour from a separate implementation, and sharing the predicate would make the parity tests\n * compare a function with itself.\n *\n * The rule: a non-empty, well-formed Unicode string whose UTF-8 serialization is at most 256 bytes.\n * Length is measured in UTF-8 bytes because that is what bounds the serialized protected header;\n * counting UTF-16 code units admits a 256-unit astral kid (128 code points) that serializes to 512\n * bytes. Lone surrogates are rejected rather than silently replaced with U+FFFD during encoding,\n * which would change the supplied identifier; a header carrying one is refused by the I-JSON gate\n * regardless.\n */\nfunction isAcceptableKid(kid: unknown): kid is string {\n if (typeof kid !== 'string' || kid.length === 0) return false;\n let bytes = 0;\n for (let i = 0; i < kid.length; i++) {\n const c = kid.charCodeAt(i);\n if (c < 0x80) bytes += 1;\n else if (c < 0x800) bytes += 2;\n else if (c >= 0xd800 && c <= 0xdbff) {\n const next = i + 1 < kid.length ? kid.charCodeAt(i + 1) : 0;\n if (next < 0xdc00 || next > 0xdfff) return false;\n bytes += 4;\n i++;\n } else if (c >= 0xdc00 && c <= 0xdfff) {\n return false;\n } else bytes += 3;\n if (bytes > KID_MAX_UTF8_BYTES) return false;\n }\n return true;\n}\n\nconst ACCEPTED: JoseHardeningResult = { accepted: true } as const;\n\nfunction rejected(errorCode: string): JoseHardeningResult {\n return { accepted: false, errorCode };\n}\n\nexport function validateJoseHardeningInternal(header: JoseHardeningInput): JoseHardeningResult {\n // 1. kid presence and validity\n if (!isAcceptableKid(header.kid)) {\n return rejected('CRYPTO_JWS_MISSING_KID');\n }\n\n // 2. embedded key material\n if (\n header.jwk !== undefined ||\n header.x5c !== undefined ||\n header.x5u !== undefined ||\n header.jku !== undefined\n ) {\n return rejected('CRYPTO_JWS_EMBEDDED_KEY');\n }\n\n // 3. crit\n if (header.crit !== undefined) {\n return rejected('CRYPTO_JWS_CRIT_REJECTED');\n }\n\n // 4. b64: false (RFC 7797 unencoded payload)\n if (header.b64 === false) {\n return rejected('CRYPTO_JWS_B64_REJECTED');\n }\n\n // 5. zip\n if (header.zip !== undefined) {\n return rejected('CRYPTO_JWS_ZIP_REJECTED');\n }\n\n return ACCEPTED;\n}\n","/**\n * Bounded internal issuer-form validator.\n *\n * INTERNAL ONLY. This is the parity-observed counterpart of\n * @peac/schema.isCanonicalIss (referenced by Wire 0.2's CanonicalIssSchema\n * and by issue.ts pre-sign validation). Both implementations consume the\n * same ISS_CANONICAL.maxLength constant from @peac/kernel and apply the\n * same accept/reject rules in the same order; behavioral parity is proven\n * byte-equal by the parity tests, not by code copy.\n *\n * Existing canonical isCanonicalIss in @peac/schema remains canonical.\n * This module is observational only; it is NOT re-exported from\n * packages/protocol/src/index.ts and is NOT wired into runtime paths\n * (issue.ts, verify-local.ts) in v0.13.1.\n *\n * Scope (must mirror isCanonicalIss in packages/schema/src/wire-02-envelope.ts):\n *\n * 1. Type and length:\n * - Non-string iss -> rejected\n * - Empty string -> rejected\n * - Length > ISS_CANONICAL.maxLength (2048) -> rejected\n *\n * 2. did: branch (checked before URL parsing because did: is a valid\n * URL scheme in some parsers):\n * - Pattern: ^did:[a-z0-9]+:[^#?/]+$\n * - Method: lowercase letters and digits only, non-empty\n * - Method-specific-id: non-empty, no '/', '?', or '#'\n *\n * 3. https:// branch (URL-constructor based):\n * - new URL(iss) must succeed\n * - url.protocol === 'https:'\n * - Non-empty url.hostname\n * - No userinfo (url.username and url.password both empty)\n * - iss must equal the canonical reconstructed origin\n * ('https://${url.host}'). This rejects:\n * - uppercase host (URL spec lowercases hostname)\n * - explicit default port (:443 is dropped from url.host)\n * - trailing slash, path, query, fragment, userinfo\n * - raw Unicode hostname (URL emits punycode in url.host)\n *\n * 4. All other schemes -> rejected with E_ISS_NOT_CANONICAL.\n */\n\nimport { ISS_CANONICAL } from '@peac/kernel';\n\n/**\n * Normalized result. accepted=true means iss is in canonical form.\n * accepted=false carries the canonical error code E_ISS_NOT_CANONICAL.\n *\n * The canonical surface emits a single error code for any rejection;\n * no path field is attached, so the comparison is on (accepted, errorCode)\n * only.\n */\nexport type IssuerFormResult =\n | { readonly accepted: true }\n | { readonly accepted: false; readonly errorCode: string };\n\nconst ACCEPTED: IssuerFormResult = { accepted: true } as const;\nconst REJECTED: IssuerFormResult = { accepted: false, errorCode: 'E_ISS_NOT_CANONICAL' } as const;\n\n/** did:<method>:<method-specific-id> grammar (mirrors canonical regex). */\nconst DID_PATTERN = /^did:[a-z0-9]+:[^#?/]+$/;\n\nexport function validateIssuerFormInternal(iss: unknown): IssuerFormResult {\n // 1. Type and length\n if (typeof iss !== 'string' || iss.length === 0 || iss.length > ISS_CANONICAL.maxLength) {\n return REJECTED;\n }\n\n // 2. did: branch (check before URL parsing)\n if (iss.startsWith('did:')) {\n return DID_PATTERN.test(iss) ? ACCEPTED : REJECTED;\n }\n\n // 3. https:// branch (URL-constructor based)\n let url: URL;\n try {\n url = new URL(iss);\n } catch {\n return REJECTED;\n }\n\n if (url.protocol !== 'https:') return REJECTED;\n if (!url.hostname) return REJECTED;\n if (url.username !== '' || url.password !== '') return REJECTED;\n\n const origin = `${url.protocol}//${url.host}`;\n return iss === origin ? ACCEPTED : REJECTED;\n}\n","/**\n * Bounded internal temporal validator (occurred_at skew only).\n *\n * INTERNAL ONLY. This is the parity-observed counterpart of\n * @peac/schema.checkOccurredAtSkew (referenced by verify-local.ts when\n * claims.kind === 'evidence'). Both implementations consume the same\n * OCCURRED_AT_TOLERANCE_SECONDS constant from @peac/kernel and apply\n * the same skew classification rules in the same order; behavioral\n * parity is proven byte-equal by the parity tests, not by code copy.\n *\n * Existing canonical checkOccurredAtSkew in @peac/schema remains\n * canonical. This module is observational only; it is NOT re-exported\n * from packages/protocol/src/index.ts and is NOT wired into runtime\n * paths (issue.ts, verify-local.ts) in v0.13.1.\n *\n * SCOPE (deliberately narrow):\n * - occurred_at canonical skew classification ONLY\n * - the iat-not-yet-valid check (`iat > now + maxClockSkew`) lives\n * inline at verify-local.ts:454 with no helper to import; wrapping\n * it would make LEFT and RIGHT identical 1-line predicates that\n * prove nothing, so it is explicitly deferred to a later step\n * (extraction first, parity second)\n *\n * Rules (must mirror checkOccurredAtSkew exactly; evidence-kind-only\n * is the caller's responsibility):\n * 1. occurredAt undefined -> accepted, no warning\n * 2. parse occurredAt as ISO/RFC 3339; if NaN -> accepted, no warning\n * (the parse failure surfaces from schema validation elsewhere)\n * 3. ts > now + tolerance -> rejected with E_OCCURRED_AT_FUTURE\n * 4. ts > iat (within tolerance) -> accepted with occurred_at_skew\n * warning at pointer /occurred_at\n * 5. ts <= iat -> accepted, no warning\n *\n * The injected `now` parameter is required; this module never reads\n * Date.now() so tests are deterministic.\n */\n\nimport { OCCURRED_AT_TOLERANCE_SECONDS } from '@peac/kernel';\n\nexport interface TemporalWarning {\n readonly code: string;\n readonly pointer?: string;\n}\n\nexport type TemporalResult =\n | { readonly accepted: true; readonly warnings?: readonly TemporalWarning[] }\n | { readonly accepted: false; readonly errorCode: string; readonly pointer?: string };\n\nconst ACCEPTED: TemporalResult = { accepted: true } as const;\n\nexport function validateTemporalInternal(\n occurredAt: string | undefined,\n iat: number,\n now: number,\n tolerance: number = OCCURRED_AT_TOLERANCE_SECONDS\n): TemporalResult {\n if (occurredAt === undefined) return ACCEPTED;\n\n const ts = Date.parse(occurredAt) / 1000;\n if (isNaN(ts)) return ACCEPTED;\n\n if (ts > now + tolerance) {\n return {\n accepted: false,\n errorCode: 'E_OCCURRED_AT_FUTURE',\n pointer: '/occurred_at',\n };\n }\n\n if (ts > iat) {\n return {\n accepted: true,\n warnings: [{ code: 'occurred_at_skew', pointer: '/occurred_at' }],\n };\n }\n\n return ACCEPTED;\n}\n","/**\n * Bounded internal extension-budget validator.\n *\n * INTERNAL ONLY. This is the parity-observed counterpart of the\n * byte-budget portion (steps 4 + 5) of validateKnownExtensions in\n * @peac/schema/src/wire-02-extensions/validation.ts. Both sides import\n * EXTENSION_BUDGET from @peac/kernel; behavioral parity is proven\n * byte-equal by the parity tests, not by code copy.\n *\n * Existing canonical validateKnownExtensions in @peac/schema remains\n * canonical. This module is observational only; it is NOT re-exported\n * from packages/protocol/src/index.ts and is NOT wired into runtime\n * paths (issue.ts, verify-local.ts) in v0.13.1.\n *\n * SCOPE (deliberately narrow):\n * - byte-budget enforcement on the extensions record only\n * - the other three steps in validateKnownExtensions (key grammar,\n * plain-JSON guard, typed extension schema parse) are NOT in\n * scope here; they belong to other parity work and would require\n * their own validators\n *\n * Measurement basis (must mirror canonical exactly):\n * - bytes = TextEncoder.encode(JSON.stringify(value)).byteLength\n * (UTF-8 byte length of ECMAScript JSON.stringify output)\n * - serialization failure (circular references, BigInt, etc.) yields\n * Infinity, which the comparison treats as over-budget\n *\n * Order of checks (must mirror canonical exactly):\n * 1. Total: jsonUtf8ByteLength(extensions) > maxTotalBytes\n * -> violation at path '/extensions'; EARLY STOP (no per-group)\n * 2. Per-group, in Object.keys(extensions) iteration order:\n * jsonUtf8ByteLength(extensions[key]) > maxGroupBytes\n * -> violation at path '/extensions/<escaped-key>'\n *\n * Comparison uses '>' (strictly greater than), so values exactly equal\n * to the limit are accepted.\n */\n\nimport { EXTENSION_BUDGET } from '@peac/kernel';\n\nexport interface ExtensionBudgetViolation {\n readonly code: string;\n readonly path: string;\n}\n\nexport interface ExtensionBudgetResult {\n readonly accepted: boolean;\n readonly violations: readonly ExtensionBudgetViolation[];\n}\n\nconst ACCEPTED: ExtensionBudgetResult = { accepted: true, violations: [] } as const;\nconst SIZE_EXCEEDED = 'E_EXTENSION_SIZE_EXCEEDED' as const;\n\nconst textEncoder = new TextEncoder();\n\n/**\n * UTF-8 byte length of JSON.stringify(value). Returns Infinity if\n * serialization fails (circular references, BigInt, etc.); callers\n * treat Infinity as over-budget.\n */\nfunction jsonUtf8ByteLength(value: unknown): number {\n try {\n return textEncoder.encode(JSON.stringify(value)).byteLength;\n } catch {\n return Infinity;\n }\n}\n\n/** RFC 6901 JSON pointer segment escape: '~' -> '~0', '/' -> '~1'. */\nfunction escapeJsonPointerSegment(segment: string): string {\n return segment.replace(/~/g, '~0').replace(/\\//g, '~1');\n}\n\nexport function validateExtensionBudgetInternal(\n extensions: Record<string, unknown> | undefined\n): ExtensionBudgetResult {\n if (extensions === undefined) return ACCEPTED;\n\n const totalBytes = jsonUtf8ByteLength(extensions);\n if (totalBytes > EXTENSION_BUDGET.maxTotalBytes) {\n // Early stop: canonical returns immediately after pushing the\n // total-budget violation; per-group checks are not reached.\n return {\n accepted: false,\n violations: [{ code: SIZE_EXCEEDED, path: '/extensions' }],\n };\n }\n\n const violations: ExtensionBudgetViolation[] = [];\n for (const key of Object.keys(extensions)) {\n const groupBytes = jsonUtf8ByteLength(extensions[key]);\n if (groupBytes > EXTENSION_BUDGET.maxGroupBytes) {\n violations.push({\n code: SIZE_EXCEEDED,\n path: `/extensions/${escapeJsonPointerSegment(key)}`,\n });\n }\n }\n\n if (violations.length === 0) return ACCEPTED;\n return { accepted: false, violations };\n}\n","/**\n * Bounded internal schema-parse validator.\n *\n * INTERNAL ONLY. Thin wrapper around the canonical\n * `parseReceiptClaims` from `@peac/schema`. Projects the canonical\n * accept/reject signal plus the full canonical projection (parsed\n * claims, parser warnings, canonical error triple) so production\n * callers can reproduce the canonical surface byte-equally without\n * re-invoking `parseReceiptClaims`.\n *\n * Module is internal-only; not re-exported from\n * `packages/protocol/src/index.ts`.\n *\n * SCOPE:\n * - Run `parseReceiptClaims(payload)` and surface its accept/reject.\n * - On acceptance: surface `wireVersion`, parsed `claims`, and\n * parser `warnings` (e.g., `type_unregistered`,\n * `unknown_extension_preserved`). Higher-layer aggregation merges\n * these into the caller's warning array.\n * - On rejection: surface the canonical error triple\n * (`errorCode`, `errorMessage`, `errorIssues`) so callers can\n * project the canonical `details: { parse_code, issues }` and\n * `message: 'Receipt schema validation failed: <message>'`\n * surface byte-equally.\n */\n\nimport type { ZodError } from 'zod';\nimport type { VerificationWarning } from '@peac/kernel';\nimport { parseReceiptClaims } from '@peac/schema';\nimport type { Wire02Claims } from '@peac/schema';\n\nexport interface SchemaParseResult {\n readonly accepted: boolean;\n /**\n * Canonical parse-error code from `parseReceiptClaims` when the\n * parse rejects. Mirrors `pr.error.code`.\n */\n readonly errorCode?: string;\n /**\n * Canonical parse-error message from `parseReceiptClaims` when the\n * parse rejects. Mirrors `pr.error.message`. Required for callers\n * that reproduce the canonical surface message\n * `Receipt schema validation failed: <message>` byte-equally.\n */\n readonly errorMessage?: string;\n /**\n * Canonical parse-error issues from `parseReceiptClaims` when the\n * parse rejects. Mirrors `pr.error.issues`. Callers downstream\n * apply their own bounded sanitization (path-join, length cap)\n * before surfacing on a public verifier-result `details` payload.\n */\n readonly errorIssues?: ZodError['issues'];\n /**\n * Parsed Wire 0.2 claims when accepted. Internal-only; does not\n * appear on any emitted record or public surface.\n */\n readonly claims?: Wire02Claims;\n /**\n * Wire version surfaced from `parseReceiptClaims` on acceptance.\n * The bounded surface only admits `'0.2'`; Wire 0.1 acceptance from\n * the canonical parser is rejected at this layer with\n * `E_UNSUPPORTED_WIRE_VERSION` because the bounded composition is\n * keyed on Wire 0.2 claim shapes.\n */\n readonly wireVersion?: '0.2';\n /**\n * Parser warnings surfaced on acceptance. Mirrors `pr.warnings` for\n * Wire 0.2 acceptance. Callers that aggregate into a single\n * canonical warning array merge this list at the canonical-equivalent\n * flow position before the canonical sort.\n */\n readonly warnings?: readonly VerificationWarning[];\n}\n\nexport function validateSchemaParseInternal(payload: unknown): SchemaParseResult {\n const pr = parseReceiptClaims(payload);\n if (!pr.ok) {\n return {\n accepted: false,\n errorCode: pr.error.code,\n errorMessage: pr.error.message,\n ...(pr.error.issues !== undefined && { errorIssues: pr.error.issues }),\n };\n }\n if (pr.wireVersion !== '0.2') {\n return {\n accepted: false,\n errorCode: 'E_UNSUPPORTED_WIRE_VERSION',\n errorMessage: `Unsupported wire version: ${pr.wireVersion}`,\n };\n }\n return {\n accepted: true,\n claims: pr.claims as Wire02Claims,\n wireVersion: '0.2',\n warnings: pr.warnings,\n };\n}\n","/**\n * Bounded internal JOSE typ-strictness validator.\n *\n * INTERNAL ONLY. Parity-observed counterpart of the typ-strictness\n * routing in `verify-local.ts` (the block that rejects a missing typ\n * under `'strict'` mode and surfaces a `typ_missing` warning under\n * `'interop'` mode). Both implementations consume the same protected-\n * header `typ` value plus a `strictness` parameter and apply the same\n * accept/reject/warning rules.\n *\n * Existing canonical strictness routing in `verify-local.ts` remains\n * canonical. This module is observational only; not re-exported and\n * not wired into the public runtime path.\n *\n * SCOPE:\n * - typ present (any string) -> accepted, no warning.\n * - typ absent (undefined or non-string) and strictness === 'strict'\n * -> rejected with E_INVALID_FORMAT.\n * - typ absent and strictness === 'interop' -> accepted with\n * typ_missing warning.\n *\n * Out of scope:\n * - typ value validation (`'interaction-record+jwt'` enforcement lives\n * in `@peac/crypto.validateWire02Header` / the JOSE-hardening layer).\n * - alg / kid / crit / b64 / zip checks (handled by `jose-hardening.ts`).\n */\n\nexport type Strictness = 'strict' | 'interop';\n\nexport interface JoseTypStrictnessWarning {\n readonly code: string;\n}\n\nexport type JoseTypStrictnessResult =\n | { readonly accepted: true; readonly warnings?: readonly JoseTypStrictnessWarning[] }\n | { readonly accepted: false; readonly errorCode: string };\n\nconst ACCEPTED_NO_WARN: JoseTypStrictnessResult = { accepted: true } as const;\nconst ACCEPTED_TYP_MISSING: JoseTypStrictnessResult = {\n accepted: true,\n warnings: [{ code: 'typ_missing' }],\n} as const;\nconst REJECTED_INVALID_FORMAT: JoseTypStrictnessResult = {\n accepted: false,\n errorCode: 'E_INVALID_FORMAT',\n} as const;\n\nexport function validateJoseTypStrictnessInternal(\n typ: unknown,\n strictness: Strictness\n): JoseTypStrictnessResult {\n const present = typeof typ === 'string' && typ.length > 0;\n if (present) return ACCEPTED_NO_WARN;\n if (strictness === 'strict') return REJECTED_INVALID_FORMAT;\n return ACCEPTED_TYP_MISSING;\n}\n","/**\n * Bounded internal iat-not-yet-valid validator.\n *\n * INTERNAL ONLY. Parity-observed counterpart of the inline iat-not-yet-valid\n * check in `verify-local.ts` (`if (claims.iat > now + maxClockSkew) ...`).\n * Both implementations consume the same `iat`, `now`, and `maxClockSkew`\n * inputs and apply the same comparison; behavioral parity is proven\n * byte-equal by the parity tests.\n *\n * Existing canonical iat handling in `verify-local.ts` remains canonical.\n * This module is observational only; it is not re-exported from\n * `packages/protocol/src/index.ts` and is not wired into the public\n * runtime path.\n *\n * SCOPE:\n * - Reject when `iat > now + maxClockSkew` (claim issued too far in the future).\n * - Accept when `iat <= now + maxClockSkew`.\n * - Never reads `Date.now()`; the caller injects `now` for determinism.\n *\n * Out of scope:\n * - `exp` / `nbf` checks (Wire 0.2 records do not expire and have no nbf).\n * - `occurred_at` skew (handled by `temporal.ts`).\n */\n\nexport interface IatNotYetValidResult {\n readonly accepted: boolean;\n readonly errorCode?: string;\n}\n\nconst ACCEPTED: IatNotYetValidResult = { accepted: true } as const;\nconst REJECTED: IatNotYetValidResult = {\n accepted: false,\n errorCode: 'E_NOT_YET_VALID',\n} as const;\n\nexport function validateIatNotYetValidInternal(\n iat: number,\n now: number,\n maxClockSkew: number\n): IatNotYetValidResult {\n if (iat > now + maxClockSkew) return REJECTED;\n return ACCEPTED;\n}\n","/**\n * Bounded internal policy-binding validator (canonical-composed).\n *\n * INTERNAL ONLY. Thin wrapper around `verifyPolicyBinding` from\n * `@peac/schema`. Surfaces the canonical three-state result\n * (`verified` / `failed` / `unavailable`) projected into the bounded\n * validator's accept/reject contract, where `failed` is the only\n * rejection.\n *\n * This is observational equivalence by construction, not a divergent\n * binding check. Module is observational only; not re-exported from\n * `packages/protocol/src/index.ts` and not wired into the public\n * runtime path.\n *\n * SCOPE:\n * - Both digests present and equal -> accepted (`verified`).\n * - Either digest absent -> accepted (`unavailable`); no policy\n * check is performed when the receipt or caller omits the digest.\n * - Both present but unequal -> rejected with E_POLICY_BINDING_FAILED.\n *\n * Out of scope:\n * - Policy-document fetch and digest computation (lives in\n * `verifyLocal()` / caller responsibility).\n * - Policy URI handling (`policy.uri` is informational only).\n */\n\nimport { verifyPolicyBinding } from '@peac/schema';\n\nexport interface PolicyBindingResult {\n readonly accepted: boolean;\n readonly errorCode?: string;\n /** 'verified' | 'failed' | 'unavailable'. Surfaced unchanged from canonical. */\n readonly status: 'verified' | 'failed' | 'unavailable';\n}\n\nexport function validatePolicyBindingInternal(\n receiptPolicyDigest: string | undefined,\n localPolicyDigest: string | undefined\n): PolicyBindingResult {\n if (receiptPolicyDigest === undefined || localPolicyDigest === undefined) {\n return { accepted: true, status: 'unavailable' };\n }\n const status = verifyPolicyBinding(receiptPolicyDigest, localPolicyDigest);\n if (status === 'failed') {\n return { accepted: false, errorCode: 'E_POLICY_BINDING_FAILED', status };\n }\n return { accepted: true, status };\n}\n","/**\n * Bounded internal unknown-extension-grammar validator (canonical-composed).\n *\n * INTERNAL ONLY. Thin wrapper around `isValidExtensionKey` and\n * `REGISTERED_EXTENSION_GROUP_KEYS` from `@peac/schema`. Identifies\n * unknown-but-well-formed extension keys and surfaces them as\n * non-blocking warnings, mirroring the canonical\n * `unknown_extension_preserved` warning emitted by `verifyLocal`.\n *\n * Malformed extension keys (failing `isValidExtensionKey`) are NOT\n * surfaced here as warnings; they are hard errors at the canonical\n * schema-parse layer (`E_INVALID_EXTENSION_KEY`) and therefore never\n * reach this layer on an accepted record.\n *\n * Module is observational only; not re-exported from\n * `packages/protocol/src/index.ts` and not wired into the public\n * runtime path.\n *\n * SCOPE:\n * - Walk `claims.extensions` keys.\n * - For every key that is well-formed but not registered, emit a\n * warning with code `unknown_extension_preserved` and an\n * RFC 6901 JSON-pointer-encoded path.\n * - Always accepted; this layer never rejects.\n *\n * Out of scope:\n * - Malformed-key rejection (canonical schema-parse owns this).\n * - Per-extension content validation (extension-specific schemas).\n */\n\nimport { REGISTERED_EXTENSION_GROUP_KEYS, isValidExtensionKey } from '@peac/schema';\n\nexport interface UnknownExtensionWarning {\n readonly code: string;\n readonly pointer: string;\n}\n\nexport interface UnknownExtensionGrammarResult {\n readonly accepted: true;\n readonly warnings: readonly UnknownExtensionWarning[];\n}\n\nconst ACCEPTED_EMPTY: UnknownExtensionGrammarResult = {\n accepted: true,\n warnings: [],\n} as const;\n\n/**\n * Encode a JSON-pointer reference token per RFC 6901: `~` -> `~0`,\n * `/` -> `~1`. Order matters: `~` must be replaced before `/`.\n */\nfunction escapeJsonPointer(token: string): string {\n return token.replace(/~/g, '~0').replace(/\\//g, '~1');\n}\n\nexport function validateUnknownExtensionGrammarInternal(\n extensions: Record<string, unknown> | undefined\n): UnknownExtensionGrammarResult {\n if (extensions === undefined) return ACCEPTED_EMPTY;\n const keys = Object.keys(extensions);\n if (keys.length === 0) return ACCEPTED_EMPTY;\n\n const warnings: UnknownExtensionWarning[] = [];\n for (const key of keys) {\n if (!REGISTERED_EXTENSION_GROUP_KEYS.has(key) && isValidExtensionKey(key)) {\n warnings.push({\n code: 'unknown_extension_preserved',\n pointer: `/extensions/${escapeJsonPointer(key)}`,\n });\n }\n }\n return { accepted: true, warnings };\n}\n","/**\n * Type-to-extension enforcement check (Layer 3)\n *\n * Pure helper: given a receipt kind, type, extensions record, and\n * registry data, determines whether the expected extension group is\n * present, absent, or replaced by a different registered group.\n *\n * This module has no side effects, no I/O, and no strictness logic.\n * Strictness (error vs warning) is decided by the caller (verifyLocal).\n *\n * Decision tree:\n * 1. challenge-kind receipt -> skip\n * 2. unmapped/custom type -> skip\n * 3. expected extension present -> ok\n * 4. expected absent + other registered present -> mismatch\n * 5. expected absent + none present -> missing\n *\n * Unknown third-party extension keys never count as mismatch.\n */\n\n/** Result of the type-to-extension mapping check */\nexport type TypeExtensionCheckResult =\n | { status: 'ok' }\n | { status: 'skip' }\n | {\n status: 'missing' | 'mismatch';\n expected_extension_group: string;\n present_registered_extension_groups: string[];\n };\n\n/**\n * Check whether a receipt's extensions match the expected extension\n * group for its registered type.\n *\n * Performance: O(1) lookup for the common ok/skip paths. Only iterates\n * extension keys when the expected group is absent (error path).\n *\n * @param kind - Receipt kind (evidence or challenge)\n * @param type - Receipt type value (e.g., org.peacprotocol/payment)\n * @param extensions - Extensions record from receipt claims (may be undefined)\n * @param typeToExtensionMap - Generated TYPE_TO_EXTENSION_MAP\n * @param registeredExtensionGroupKeys - Generated REGISTERED_EXTENSION_GROUP_KEYS set\n */\nexport function checkTypeExtensionMapping(\n kind: string,\n type: string,\n extensions: Record<string, unknown> | undefined,\n typeToExtensionMap: ReadonlyMap<string, string>,\n registeredExtensionGroupKeys: ReadonlySet<string>\n): TypeExtensionCheckResult {\n // Challenge-kind receipts skip: they indicate requirements, not evidence\n if (kind === 'challenge') {\n return { status: 'skip' };\n }\n\n const expectedGroup = typeToExtensionMap.get(type);\n\n // Unmapped/custom type: no check\n if (expectedGroup === undefined) {\n return { status: 'skip' };\n }\n\n // Expected group present: pass (O(1) check)\n if (extensions !== undefined && Object.prototype.hasOwnProperty.call(extensions, expectedGroup)) {\n return { status: 'ok' };\n }\n\n // Expected group absent: determine missing vs mismatch\n // Only build the present-registered list on this (uncommon) path\n const presentRegistered: string[] = [];\n if (extensions !== undefined) {\n for (const key of Object.keys(extensions)) {\n if (key !== expectedGroup && registeredExtensionGroupKeys.has(key)) {\n presentRegistered.push(key);\n }\n }\n }\n\n return {\n status: presentRegistered.length > 0 ? 'mismatch' : 'missing',\n expected_extension_group: expectedGroup,\n present_registered_extension_groups: presentRegistered,\n };\n}\n","/**\n * Bounded internal type-extension-enforcement validator (canonical-composed).\n *\n * INTERNAL ONLY. Thin wrapper around `checkTypeExtensionMapping` from\n * `@peac/protocol/src/type-extension-check` plus the strictness-mode\n * routing performed by `verifyLocal`. Surfaces the canonical mapping\n * result projected into the bounded validator's accept/reject and\n * warning contract.\n *\n * Distinct from `type-extension-mapping.ts` (warnings-only) in this\n * module's directory: this layer covers the strictness-mode path that\n * promotes `missing` and `mismatch` to hard errors when\n * `strictness === 'strict'`. Both layers consume the same canonical\n * mapping result; they differ only in how they project it.\n *\n * Module is observational only; not re-exported from\n * `packages/protocol/src/index.ts` and not wired into the public\n * runtime path.\n *\n * SCOPE:\n * - `skip` -> accepted, no warning, no error.\n * - `ok` -> accepted, no warning, no error.\n * - `missing` + strict -> rejected with E_EXTENSION_GROUP_REQUIRED.\n * - `mismatch` + strict -> rejected with E_EXTENSION_GROUP_MISMATCH.\n * - `missing` + interop -> accepted with extension_group_missing warning at /type.\n * - `mismatch` + interop -> accepted with extension_group_mismatch warning at /type.\n */\n\nimport { TYPE_TO_EXTENSION_MAP } from '@peac/kernel';\nimport { REGISTERED_EXTENSION_GROUP_KEYS } from '@peac/schema';\nimport { checkTypeExtensionMapping } from '../../../type-extension-check.js';\nimport type { Strictness } from './jose-typ-strictness.js';\n\nexport interface TypeExtensionEnforcementWarning {\n readonly code: string;\n readonly pointer: string;\n}\n\nexport type TypeExtensionEnforcementResult =\n | { readonly accepted: true; readonly warnings?: readonly TypeExtensionEnforcementWarning[] }\n | { readonly accepted: false; readonly errorCode: string; readonly pointer?: string };\n\nconst ACCEPTED_NO_WARN: TypeExtensionEnforcementResult = { accepted: true } as const;\n\nexport function validateTypeExtensionEnforcementInternal(\n kind: string,\n type: string,\n extensions: Record<string, unknown> | undefined,\n strictness: Strictness\n): TypeExtensionEnforcementResult {\n const result = checkTypeExtensionMapping(\n kind,\n type,\n extensions,\n TYPE_TO_EXTENSION_MAP,\n REGISTERED_EXTENSION_GROUP_KEYS\n );\n\n if (result.status === 'ok' || result.status === 'skip') {\n return ACCEPTED_NO_WARN;\n }\n\n if (strictness === 'strict') {\n const errorCode =\n result.status === 'missing' ? 'E_EXTENSION_GROUP_REQUIRED' : 'E_EXTENSION_GROUP_MISMATCH';\n return { accepted: false, errorCode, pointer: '/type' };\n }\n\n // interop mode: surface as warning, accept the record.\n const warningCode =\n result.status === 'missing' ? 'extension_group_missing' : 'extension_group_mismatch';\n return {\n accepted: true,\n warnings: [{ code: warningCode, pointer: '/type' }],\n };\n}\n","/**\n * Canonical-composed shadow validation: composition aggregator.\n *\n * INTERNAL ONLY. Composes layer validators into a single aggregated\n * result. Each layer either delegates to a canonical helper from\n * `@peac/schema` / `@peac/crypto` / `@peac/protocol` (canonical-\n * composed wrapper pattern) or mirrors a canonical inline check\n * verbatim. The canonical-vs-candidate differential test asserts\n * byte-equality of the candidate verdict with the canonical verdict\n * on every eligible fixture; any divergence indicates a defect in\n * the projection logic.\n *\n * Always-on layers (run on every input):\n * - kernel-constraints (depth / array / keys / string / nodes)\n * - issuer-form (canonical iss)\n * - type-extension-mapping (warnings only)\n * - extension-byte-budget\n * - unknown-extension-grammar (warnings only)\n *\n * Optional-input layers (skip when their inputs are absent):\n * - jose-header-hardening (header)\n * - temporal occurred_at skew (evidence kind)\n * - schema-parse (fullClaims)\n * - jose-typ-strictness (header + strictness)\n * - iat-not-yet-valid (maxClockSkew)\n * - policy-binding (receiptPolicyDigest + localPolicyDigest)\n * - type-extension-enforcement (strictness)\n *\n * Out of scope:\n * - signature verification (the standalone `validateSignatureInternal`\n * export is async and is not composed here; callers that need it\n * invoke it directly with serialized + publicKey)\n * - any control-plane behavior (issuer resolver, JWKS fetch, etc.)\n *\n * Public-facing wording for this module: \"canonical-composed shadow\n * validation\" or \"observational equivalence harness\". Never\n * \"complete validator\", \"primary validator\", or \"divergent validator\".\n */\n\nimport {\n validateExtensionBudgetInternal,\n validateIatNotYetValidInternal,\n validateIssuerFormInternal,\n validateJoseHardeningInternal,\n validateJoseTypStrictnessInternal,\n validateKernelConstraintsInternal,\n validatePolicyBindingInternal,\n validateSchemaParseInternal,\n validateTemporalInternal,\n validateTypeExtensionEnforcementInternal,\n validateTypeExtensionMappingInternal,\n validateUnknownExtensionGrammarInternal,\n type ExtensionBudgetViolation,\n type Strictness,\n type TemporalWarning,\n type TypeExtensionEnforcementWarning,\n type TypeExtensionMappingWarning,\n type UnknownExtensionWarning,\n} from './validators/index.js';\n\n/** Minimal claims shape required by the bounded subset. */\nexport interface BoundedClaimsInput {\n readonly kind: string;\n readonly type: string;\n readonly iss: unknown;\n readonly iat: number;\n readonly occurred_at?: string;\n readonly extensions?: Record<string, unknown>;\n}\n\n/** Optional JOSE header (from the JWS protected header). */\nexport type BoundedHeaderInput = Record<string, unknown> | undefined;\n\n/** Aggregated input to the bounded observation subset. */\nexport interface BoundedValidationInput {\n readonly claims: BoundedClaimsInput;\n readonly header?: BoundedHeaderInput;\n /** Fixed Unix-second clock for temporal evaluation; required. */\n readonly now: number;\n /**\n * Strictness profile for layers that promote warnings to errors\n * under `'strict'` mode. When omitted, layers that consume\n * strictness skip (they do not run). Mirrors the canonical\n * `verifyLocal({ strictness })` option.\n */\n readonly strictness?: Strictness;\n /**\n * Maximum permitted clock skew in seconds for the iat-not-yet-valid\n * check. When omitted, the iat layer skips. Mirrors\n * `verifyLocal({ maxClockSkew })`; canonical default is 300.\n */\n readonly maxClockSkew?: number;\n /**\n * Receipt-side policy digest (`claims.policy.digest`). Used together\n * with `localPolicyDigest` by the policy-binding layer. Either\n * absent skips the layer.\n */\n readonly receiptPolicyDigest?: string;\n /**\n * Caller-supplied policy digest. Used together with\n * `receiptPolicyDigest`. Either absent skips the layer.\n */\n readonly localPolicyDigest?: string;\n /**\n * Full receipt-claims object for the schema-parse layer. When\n * omitted, the schema-parse layer falls back to running on the\n * minimal `BoundedClaimsInput` projection (which may not surface\n * field-level parse errors that depend on optional fields outside\n * the bounded subset).\n */\n readonly fullClaims?: Record<string, unknown>;\n}\n\n/**\n * Layer tag identifies which underlying validator emitted each entry.\n * Useful for downstream filtering (e.g., a future shadow-mode reporter\n * that ignores warning-class entries from one layer but not another).\n */\nexport type BoundedLayer =\n | 'kernel-constraints'\n | 'type-extension-mapping'\n | 'jose-header-hardening'\n | 'issuer-form'\n | 'temporal'\n | 'extension-budget'\n | 'schema-parse'\n | 'jose-typ-strictness'\n | 'iat-not-yet-valid'\n | 'policy-binding'\n | 'unknown-extension-grammar'\n | 'type-extension-enforcement';\n\nexport interface BoundedViolation {\n readonly layer: BoundedLayer;\n readonly code: string;\n readonly path?: string;\n}\n\nexport interface BoundedWarning {\n readonly layer: BoundedLayer;\n readonly code: string;\n readonly path?: string;\n}\n\nexport interface BoundedValidationResult {\n /** True iff every in-scope layer accepted the input. */\n readonly accepted: boolean;\n readonly violations: readonly BoundedViolation[];\n readonly warnings: readonly BoundedWarning[];\n}\n\n/**\n * Run the bounded observation subset. Composes the six layer\n * validators in a stable order; aggregates violations and warnings\n * with explicit layer tags; never throws. Pure: same input always\n * yields the same result.\n */\nexport function runBoundedValidatorShadow(input: BoundedValidationInput): BoundedValidationResult {\n const violations: BoundedViolation[] = [];\n const warnings: BoundedWarning[] = [];\n\n // 1. Kernel constraints (depth / array / keys / string / nodes).\n const kernelRes = validateKernelConstraintsInternal(input.claims);\n if (!kernelRes.valid) {\n for (const v of kernelRes.violations) {\n violations.push({\n layer: 'kernel-constraints',\n code: v.constraint,\n path: v.path || undefined,\n });\n }\n }\n\n // 2. Issuer form (canonical iss).\n const issRes = validateIssuerFormInternal(input.claims.iss);\n if (!issRes.accepted) {\n violations.push({ layer: 'issuer-form', code: issRes.errorCode });\n }\n\n // 3. JOSE header hardening (only when a header is supplied).\n if (input.header !== undefined) {\n const joseRes = validateJoseHardeningInternal(input.header);\n if (!joseRes.accepted) {\n violations.push({ layer: 'jose-header-hardening', code: joseRes.errorCode });\n }\n }\n\n // 4. Type-extension mapping warnings.\n const typeExtWarnings: readonly TypeExtensionMappingWarning[] =\n validateTypeExtensionMappingInternal({\n kind: input.claims.kind,\n type: input.claims.type,\n extensions: input.claims.extensions,\n });\n for (const w of typeExtWarnings) {\n warnings.push({ layer: 'type-extension-mapping', code: w.code, path: w.pointer });\n }\n\n // 5. Temporal occurred_at skew (evidence-kind-only is the caller's\n // responsibility; we mirror the canonical behavior of treating\n // non-evidence kinds as a no-op by skipping the call).\n if (input.claims.kind === 'evidence') {\n const temporalRes = validateTemporalInternal(\n input.claims.occurred_at,\n input.claims.iat,\n input.now\n );\n if (!temporalRes.accepted) {\n violations.push({\n layer: 'temporal',\n code: temporalRes.errorCode,\n path: temporalRes.pointer,\n });\n } else if (temporalRes.warnings) {\n const list: readonly TemporalWarning[] = temporalRes.warnings;\n for (const w of list) {\n warnings.push({ layer: 'temporal', code: w.code, path: w.pointer });\n }\n }\n }\n\n // 6. Extension byte budget.\n const budgetRes = validateExtensionBudgetInternal(input.claims.extensions);\n if (!budgetRes.accepted) {\n const list: readonly ExtensionBudgetViolation[] = budgetRes.violations;\n for (const v of list) {\n violations.push({ layer: 'extension-budget', code: v.code, path: v.path });\n }\n }\n\n // 7. Schema-parse projection (canonical-composed; delegates to\n // parseReceiptClaims). Skips when `fullClaims` is not supplied;\n // `BoundedClaimsInput` is a 6-field subset and would never satisfy\n // the canonical Wire 0.2 schema. Callers that want the schema-parse\n // layer to fire MUST pass the full claims object via `fullClaims`.\n if (input.fullClaims !== undefined) {\n const schemaRes = validateSchemaParseInternal(input.fullClaims);\n if (!schemaRes.accepted && schemaRes.errorCode !== undefined) {\n violations.push({ layer: 'schema-parse', code: schemaRes.errorCode });\n }\n }\n\n // 8. JOSE typ-strictness (canonical-composed; mirrors verify-local\n // strictness routing). Skip when no header or no strictness\n // supplied; canonical surface only routes typ-missing under a\n // declared strictness.\n if (input.header !== undefined && input.strictness !== undefined) {\n const typRes = validateJoseTypStrictnessInternal(input.header.typ, input.strictness);\n if (!typRes.accepted) {\n violations.push({ layer: 'jose-typ-strictness', code: typRes.errorCode });\n } else if (typRes.warnings) {\n for (const w of typRes.warnings) {\n warnings.push({ layer: 'jose-typ-strictness', code: w.code });\n }\n }\n }\n\n // 9. iat-not-yet-valid (mirrors the inline verify-local check).\n // Skip when no maxClockSkew supplied; canonical surface only runs\n // this check inside verifyLocal where maxClockSkew is bound.\n if (input.maxClockSkew !== undefined) {\n const iatRes = validateIatNotYetValidInternal(input.claims.iat, input.now, input.maxClockSkew);\n if (!iatRes.accepted && iatRes.errorCode !== undefined) {\n violations.push({ layer: 'iat-not-yet-valid', code: iatRes.errorCode });\n }\n }\n\n // 10. Policy-binding (canonical-composed; delegates to\n // verifyPolicyBinding). The `unavailable` projection (either\n // digest absent) is accepted with no surfacing; only `failed`\n // produces a violation.\n if (input.receiptPolicyDigest !== undefined && input.localPolicyDigest !== undefined) {\n const policyRes = validatePolicyBindingInternal(\n input.receiptPolicyDigest,\n input.localPolicyDigest\n );\n if (!policyRes.accepted && policyRes.errorCode !== undefined) {\n violations.push({ layer: 'policy-binding', code: policyRes.errorCode });\n }\n }\n\n // 11. Unknown-extension grammar (canonical-composed; warnings only).\n const unknownExtRes = validateUnknownExtensionGrammarInternal(input.claims.extensions);\n for (const w of unknownExtRes.warnings as readonly UnknownExtensionWarning[]) {\n warnings.push({\n layer: 'unknown-extension-grammar',\n code: w.code,\n path: w.pointer,\n });\n }\n\n // 12. Type-extension enforcement (canonical-composed; promotes\n // missing/mismatch to errors under strict mode, surfaces them as\n // warnings under interop). Skip when no strictness supplied.\n if (input.strictness !== undefined) {\n const enforceRes = validateTypeExtensionEnforcementInternal(\n input.claims.kind,\n input.claims.type,\n input.claims.extensions,\n input.strictness\n );\n if (!enforceRes.accepted) {\n violations.push({\n layer: 'type-extension-enforcement',\n code: enforceRes.errorCode,\n path: enforceRes.pointer,\n });\n } else if (enforceRes.warnings) {\n for (const w of enforceRes.warnings as readonly TypeExtensionEnforcementWarning[]) {\n warnings.push({\n layer: 'type-extension-enforcement',\n code: w.code,\n path: w.pointer,\n });\n }\n }\n }\n\n return {\n accepted: violations.length === 0,\n violations,\n warnings,\n };\n}\n","/**\n * Production-facing bounded validation gate.\n *\n * INTERNAL ONLY. Not re-exported from `packages/protocol/src/index.ts`.\n *\n * The gate is the only production wrapper for the bounded validation\n * path. The pre-existing `runBoundedValidatorShadow` from\n * `bounded-validator.ts` remains the entry point for shadow / corpus\n * / parity-harness consumers and is not the primary admission path\n * for the protocol entry points; the production-wrapper boundary is\n * enforced by `tests/tooling/production-gate-boundary.test.ts`.\n *\n * The gate is entrypoint-aware: callers identify themselves with a\n * `surface` discriminator, and the gate applies a per-surface\n * production projection allowlist. Layers in the bounded validator's\n * broader composition that fall outside the allowlist for a given\n * surface stay available to shadow / parity tests through\n * `runBoundedValidatorShadow` but are not surfaced as production\n * failure or production warning here.\n *\n * Allowlist for surface 'issueWire02':\n * - schema-parse only.\n *\n * Allowlist for surface 'verifyLocal':\n * - kernel-constraints (via canonical `validateKernelConstraints`).\n * - schema-parse (via the extended `validateSchemaParseInternal`).\n *\n * Out of scope here (kept inline-canonical on both branches by the\n * caller): caller-option-bearing checks (issuer mismatch, subjectUri\n * mismatch, policyDigest format), strictness routing for missing typ,\n * iat-not-yet-valid, occurred_at temporal, type-extension warnings,\n * type-extension enforcement, policy-binding compute, bindings\n * construction, sortWarnings.\n *\n * The canonical materializer (claim encoding, JWS signing, JWS\n * decoding, result-shape construction) is shared between the\n * bounded-default and rollback branches and is not touched by the\n * gate.\n */\n\nimport { validateKernelConstraints } from '@peac/schema';\nimport type { VerificationWarning } from '@peac/kernel';\nimport type { Wire02Claims } from '@peac/schema';\nimport { validateSchemaParseInternal } from './validators/schema-parse.js';\n\n/**\n * Discriminator identifying which protocol entry point invoked the\n * gate. Drives the production projection allowlist. Adding a third\n * surface requires a deliberate plan amendment, not an unannounced\n * source change.\n */\nexport type GateSurface = 'issueWire02' | 'verifyLocal';\n\n/** Sanitized parse-issue projection surfaced on rejection. */\nexport interface SanitizedParseIssue {\n readonly path: string;\n readonly message: string;\n}\n\n/** Parsed-claims projection surfaced on `verifyLocal` acceptance. */\nexport interface ValidationGateParsed {\n readonly wireVersion: '0.2';\n readonly claims: Wire02Claims;\n readonly parserWarnings: readonly VerificationWarning[];\n}\n\n/** Failure-detail projection. Smaller than the bounded layer set. */\nexport interface ValidationGateFailureDetails {\n readonly parse_code?: string;\n readonly issues?: readonly SanitizedParseIssue[];\n}\n\n/** Successful gate result. */\nexport interface ValidationGateSuccess {\n readonly ok: true;\n readonly parsed?: ValidationGateParsed;\n}\n\n/** Failed gate result. */\nexport interface ValidationGateFailure {\n readonly ok: false;\n readonly code: string;\n readonly message: string;\n readonly details?: ValidationGateFailureDetails;\n}\n\nexport type ValidationGateResult = ValidationGateSuccess | ValidationGateFailure;\n\n/** Inputs to the gate. Only `surface` and `payload` are required. */\nexport interface ValidationGateInput {\n readonly surface: GateSurface;\n /**\n * Full claims object. For surface 'issueWire02' this is the just-\n * constructed `Wire02Claims` cast to a plain record (the same\n * object that today flows through `Wire02ClaimsSchema.safeParse`).\n * For surface 'verifyLocal' this is the decoded JWS payload (the\n * same object that today flows through `validateKernelConstraints`\n * and `parseReceiptClaims`).\n */\n readonly payload: unknown;\n}\n\n/** Maximum sanitized-issue list length surfaced to a verifier report. */\nconst MAX_SANITIZED_ISSUES = 25;\n\nfunction sanitizeIssues(issues: unknown): readonly SanitizedParseIssue[] | undefined {\n if (!Array.isArray(issues)) return undefined;\n return issues.slice(0, MAX_SANITIZED_ISSUES).map((issue) => {\n const candidate = issue as { path?: unknown; message?: unknown };\n const path = Array.isArray(candidate.path)\n ? candidate.path\n .map((segment) =>\n typeof segment === 'string' || typeof segment === 'number' ? String(segment) : ''\n )\n .join('.')\n : '';\n const message =\n typeof candidate.message === 'string'\n ? candidate.message\n : String(candidate.message ?? issue);\n return { path, message };\n });\n}\n\n/**\n * Run the production projection of the bounded validation path.\n *\n * Behavior is byte-equivalent to the inline canonical sequences at\n * `issue.ts` and `verify-local.ts` for every input on the covered\n * runtime matrix. Any cross-branch divergence on JWS bytes, result\n * shape, error code, warning order, thrown error class, success /\n * failure classification, or observable default behavior is a\n * validation-equivalence regression.\n */\nexport function runBoundedValidationGate(input: ValidationGateInput): ValidationGateResult {\n if (input.surface === 'issueWire02') {\n return runIssueWire02(input.payload);\n }\n return runVerifyLocal(input.payload);\n}\n\nfunction runIssueWire02(payload: unknown): ValidationGateResult {\n // Issuance projection mirrors `issue.ts` Wire02ClaimsSchema.safeParse.\n // Today's canonical issuance reports the first Zod issue message in\n // the IssueError details. The gate reproduces that surface here.\n const schemaRes = validateSchemaParseInternal(payload);\n if (!schemaRes.accepted) {\n const firstIssueMessage = schemaRes.errorIssues?.[0]?.message;\n return {\n ok: false,\n code: 'E_INVALID_FORMAT',\n message: `Wire 0.2 claims schema validation failed: ${firstIssueMessage ?? 'unknown'}`,\n };\n }\n return { ok: true };\n}\n\nfunction runVerifyLocal(payload: unknown): ValidationGateResult {\n // Kernel constraints first (canonical-helper delegation preserves\n // the existing `Kernel constraint violated: <constraint>\n // (actual: <actual>, limit: <limit>)` message byte-equally).\n const kernelRes = validateKernelConstraints(payload);\n if (!kernelRes.valid) {\n const v = kernelRes.violations[0];\n return {\n ok: false,\n code: 'E_CONSTRAINT_VIOLATION',\n message: `Kernel constraint violated: ${v.constraint} (actual: ${v.actual}, limit: ${v.limit})`,\n };\n }\n\n // Schema parse next. Surface the canonical\n // `Receipt schema validation failed: <message>` shape with\n // `details: { parse_code, issues }` byte-equally.\n //\n // Wire 0.1 payloads parse successfully under the canonical parser\n // but are rejected at the bounded layer with errorCode\n // 'E_UNSUPPORTED_WIRE_VERSION'. The verify-local canonical surface\n // routes Wire 0.1 to a distinct error code (not E_INVALID_FORMAT)\n // and a distinct message; preserve that branch here.\n const schemaRes = validateSchemaParseInternal(payload);\n if (!schemaRes.accepted) {\n if (schemaRes.errorCode === 'E_UNSUPPORTED_WIRE_VERSION') {\n return {\n ok: false,\n code: 'E_UNSUPPORTED_WIRE_VERSION',\n message: 'Wire 0.1 receipts are not supported. Re-issue as Wire 0.2 using issue().',\n };\n }\n const sanitized = sanitizeIssues(schemaRes.errorIssues);\n const details: ValidationGateFailureDetails = {};\n if (schemaRes.errorCode !== undefined) {\n Object.assign(details, { parse_code: schemaRes.errorCode });\n }\n if (sanitized !== undefined) {\n Object.assign(details, { issues: sanitized });\n }\n return {\n ok: false,\n code: 'E_INVALID_FORMAT',\n message: `Receipt schema validation failed: ${schemaRes.errorMessage ?? 'unknown'}`,\n ...(Object.keys(details).length > 0 && { details }),\n };\n }\n\n if (schemaRes.wireVersion !== '0.2' || schemaRes.claims === undefined) {\n return {\n ok: false,\n code: 'E_UNSUPPORTED_WIRE_VERSION',\n message: 'Wire 0.1 receipts are not supported. Re-issue as Wire 0.2 using issue().',\n };\n }\n\n return {\n ok: true,\n parsed: {\n wireVersion: '0.2',\n claims: schemaRes.claims,\n parserWarnings: schemaRes.warnings ?? [],\n },\n };\n}\n","/**\n * Shadow-mode telemetry redaction and canonical hashing.\n *\n * @internal\n *\n * INTERNAL ONLY. Not re-exported from packages/protocol/src/index.ts.\n *\n * Two responsibilities:\n *\n * 1. `redactNote(input, maxBytes)`: scrub known secret classes from\n * a free-form string and bound it to a UTF-8 byte ceiling. Used\n * for the `notes` field on every shadow divergence record so\n * that an accidental string concatenation cannot leak credential\n * material into the in-memory shadow log.\n *\n * 2. `canonicalHashOf(value)` / `hashJws(jws)`: produce a SHA-256\n * hex digest of a canonicalized representation. Used as the\n * comparison primitive between real-path and shadow-path results\n * so the divergence log never needs to store raw output.\n *\n * SECRET_PATTERNS is the ground-truth contract for what counts as a\n * leakable secret class. Adding a regex here REQUIRES a paired\n * adversarial test vector in shadow-redact-adversarial.test.ts (one\n * matching vector + one adjacent benign-not-matched vector). Removing\n * a regex here REQUIRES the same justification.\n *\n * Platform neutrality: this module avoids Node-only globals (`Buffer`,\n * `node:crypto`) so it can ship inside the platform-neutral\n * @peac/protocol bundle. UTF-8 byte work uses TextEncoder/TextDecoder;\n * SHA-256 hashing delegates to @peac/crypto.sha256Hex which uses the\n * Web Crypto API with a dynamic Node fallback.\n */\n\nimport { base64urlEncode, sha256Hex } from '@peac/crypto';\n\n/**\n * Known secret-class patterns. Order matters only for performance\n * (broader patterns first reduce the search space for narrower ones).\n *\n * @internal\n */\nconst SECRET_PATTERNS: readonly RegExp[] = [\n // Compact JWS / JWT (header.payload.signature with eyJ-prefixed header).\n /eyJ[A-Za-z0-9_-]{20,}\\.[A-Za-z0-9_-]+\\.[A-Za-z0-9_-]+/g,\n\n // PEM-encoded blocks. Covers RSA / EC / OPENSSH / generic PRIVATE KEY\n // header variants in a single pattern.\n /-----BEGIN [A-Z0-9 ]+-----[\\s\\S]+?-----END [A-Z0-9 ]+-----/g,\n\n // Long base64 runs (>=40 chars). The character class is the standard\n // base64 alphabet only (no `_` or `-`) so that kebab-case and\n // snake_case identifier strings do not collateral-match. base64url\n // payloads carrying credentials are reached via more specific patterns\n // (compact JWS, Bearer, URL query token) and via the wrapper headers\n // they appear in.\n /\\b[A-Za-z0-9+/]{40,}={0,2}\\b/g,\n\n // Bearer token (Authorization header value with Bearer scheme).\n /Bearer\\s+[A-Za-z0-9._\\-/+=]+/gi,\n\n // Generic Authorization header line (any scheme, including Basic /\n // Digest / Negotiate). Multiline-anchored.\n /^authorization:\\s*[^\\r\\n]+/gim,\n\n // Generic auth-token header line (X-Auth-Token, X-API-Key).\n /^x-(?:auth-token|api-key):\\s*[^\\r\\n]+/gim,\n\n // Cookie request header line (raw client cookies).\n /^cookie:\\s*[^\\r\\n]+/gim,\n\n // Set-Cookie response header line (server-issued sessions).\n /^set-cookie:\\s*[^\\r\\n]+/gim,\n\n // URL query token / API key / secret / access_token.\n /[?&](?:token|key|secret|access_token|api_key|apikey)=[^&\\s#]+/gi,\n\n // AWS access key ID (AKIA + 16 alphanumeric).\n /\\bAKIA[0-9A-Z]{16}\\b/g,\n\n // Email address (PII).\n /[A-Za-z0-9._%+-]+@[A-Za-z0-9.-]+\\.[A-Za-z]{2,}/g,\n\n // Phone numbers. Three explicit forms (E.164 + parenthesized NA + dashed\n // NA / international) so plain consecutive-digit runs (sequence\n // numbers, hashes, identifiers) do not collateral-match.\n /\\+\\d[\\d\\s().-]{6,}\\d/g,\n /\\(\\d{3}\\)\\s*\\d{3}[\\s.-]?\\d{4}/g,\n /\\b\\d{3}[\\s.-]\\d{3}[\\s.-]\\d{4}\\b/g,\n];\n\n/**\n * Redaction marker used in place of any matched secret class.\n *\n * @internal\n */\nconst REDACTION_MARKER = '[REDACTED]';\n\nconst TEXT_ENCODER = /* @__PURE__ */ new TextEncoder();\nconst TEXT_DECODER = /* @__PURE__ */ new TextDecoder('utf-8', { fatal: false });\n\nconst REDACTION_MARKER_BYTES = TEXT_ENCODER.encode(REDACTION_MARKER).length;\n\n/**\n * UTF-8 byte length of a string. Platform-neutral replacement for\n * `Buffer.byteLength(s, 'utf8')`.\n *\n * @internal\n */\nexport function utf8ByteLength(value: string): number {\n return TEXT_ENCODER.encode(value).length;\n}\n\n/**\n * Redact known secret classes from `input` and bound the result to\n * `maxBytes` UTF-8 bytes. The output always either matches the input\n * (when no secret was found and the byte budget permits) or contains\n * the `[REDACTED]` marker.\n *\n * Truncation is byte-aware so multibyte UTF-8 sequences are not split\n * mid-character. When the redacted string exceeds `maxBytes`, the\n * tail is replaced with the marker.\n *\n * @internal\n */\nexport function redactNote(input: string, maxBytes: number): string {\n if (typeof input !== 'string') return REDACTION_MARKER;\n\n let redacted = input;\n for (const pattern of SECRET_PATTERNS) {\n redacted = redacted.replace(pattern, REDACTION_MARKER);\n }\n\n const bytes = TEXT_ENCODER.encode(redacted);\n if (bytes.length <= maxBytes) return redacted;\n\n if (maxBytes <= REDACTION_MARKER_BYTES) {\n return REDACTION_MARKER.slice(0, maxBytes);\n }\n\n const headBytes = maxBytes - REDACTION_MARKER_BYTES;\n return safeUtf8Slice(bytes, headBytes) + REDACTION_MARKER;\n}\n\n/**\n * SHA-256 hex digest of a canonical-stringified value. Used by the\n * shadow comparator to detect output-byte-diff WITHOUT logging raw\n * content. Object keys are sorted recursively so equivalent objects\n * with different key orders produce identical digests.\n *\n * Async because SHA-256 hashing in this codebase is platform-neutral\n * via @peac/crypto.sha256Hex (Web Crypto API with dynamic Node\n * fallback). Callers run inside the shadow scheduler's microtask /\n * macrotask boundary, so an additional await is free.\n *\n * @internal\n */\nexport async function canonicalHashOf(value: unknown): Promise<string> {\n return sha256Hex(canonicalStringify(value));\n}\n\n/**\n * SHA-256 hex digest of a JWS string. Used as the primary\n * `recordRefHash` input for divergence records.\n *\n * @internal\n */\nexport async function hashJws(jws: string): Promise<string> {\n return sha256Hex(jws);\n}\n\n/**\n * Canonical JSON serialization with stable key order. Internal helper\n * for `canonicalHashOf`. Not exported.\n */\nfunction canonicalStringify(value: unknown): string {\n if (value === null) return 'null';\n if (typeof value === 'undefined') return 'null';\n if (typeof value === 'string') return JSON.stringify(value);\n if (typeof value === 'number') {\n return Number.isFinite(value) ? String(value) : 'null';\n }\n if (typeof value === 'boolean') return String(value);\n if (typeof value === 'bigint') return String(value);\n if (Array.isArray(value)) {\n return '[' + value.map(canonicalStringify).join(',') + ']';\n }\n if (value instanceof Uint8Array) {\n return JSON.stringify(base64urlEncode(value));\n }\n if (typeof value === 'object') {\n const obj = value as Record<string, unknown>;\n const keys = Object.keys(obj).sort();\n return (\n '{' + keys.map((k) => JSON.stringify(k) + ':' + canonicalStringify(obj[k])).join(',') + '}'\n );\n }\n return 'null';\n}\n\n/**\n * Slice a UTF-8 byte buffer to at most `byteLen` bytes without\n * splitting a multi-byte sequence mid-character. Returns a decoded\n * string. Internal helper for `redactNote`. Not exported.\n */\nfunction safeUtf8Slice(bytes: Uint8Array, byteLen: number): string {\n if (byteLen <= 0) return '';\n if (bytes.length <= byteLen) return TEXT_DECODER.decode(bytes);\n\n let end = byteLen;\n // Walk back over UTF-8 continuation bytes (0b10xxxxxx) so the slice\n // ends on a complete code-point boundary.\n while (end > 0 && (bytes[end] & 0xc0) === 0x80) {\n end -= 1;\n }\n return TEXT_DECODER.decode(bytes.subarray(0, end));\n}\n","/**\n * Shadow-mode scheduler.\n *\n * @internal\n *\n * INTERNAL ONLY. Not re-exported from packages/protocol/src/index.ts.\n *\n * Schedules a shadow function to run AFTER the public-call boundary\n * has returned its real-path result to the caller. The shadow run:\n *\n * - is gated by `isShadowEnabled(options)` (env or programmatic);\n * - starts on a MACROTASK boundary (`setTimeout(..., 0)`), NOT on a\n * microtask, because microtasks can run before promise\n * continuations attached to the public async call and would still\n * add observable latency for CPU-heavy shadow work;\n * - has a bounded wall-clock REPORTING timeout (250ms by default;\n * see \"Timeout guarantee class\" below);\n * - reports comparison results into a bounded in-memory log;\n * - SWALLOWS every error, never propagating to the real-path return\n * value or surfacing as an unhandled-rejection event.\n *\n * The public function:\n *\n * - returns the real-path value FIRST (the macrotask boundary is\n * past every async continuation already attached to the call\n * site);\n * - never awaits shadow work;\n * - is byte-identical in its return value with shadow ON vs OFF.\n *\n * Timeout guarantee class. The 250ms timeout is a REPORTING bound,\n * not a hard preemption guarantee. Where the shadow function consults\n * the supplied `AbortSignal`, the runner aborts and bounds CPU; where\n * the shadow function is pure-CPU and ignores the signal (the v0.13.1\n * record-core validators are this shape), JavaScript cannot preempt\n * it. The runner stops awaiting and records `timing-diff`; the work\n * may continue to completion off the runner's await chain. Either\n * way, the public-call boundary returns its real-path value\n * immediately.\n *\n * Test-only helpers (`_peekShadowLog`, `_resetShadowLog`,\n * `_drainShadowQueueForTests`) are exposed for deterministic\n * assertions in vitest. Production code MUST NOT call them.\n *\n * Platform neutrality: this module avoids Node-only globals\n * (`Buffer`, `node:crypto`, unguarded `process`). Hashing delegates\n * to @peac/crypto; environment reads guard for the absence of\n * `process` so the module loads cleanly under browser / edge\n * runtimes.\n */\n\nimport type { ShadowCall, ShadowDivergence } from './shadow-types.js';\nimport { canonicalHashOf, hashJws, redactNote, utf8ByteLength } from './shadow-redact.js';\n\nconst MAX_LOG_ENTRIES = 1000;\nconst MAX_NOTE_BYTES = 128;\nconst RETENTION_MS = 7 * 24 * 60 * 60 * 1000; // 7 days\nconst SHADOW_TIMEOUT_MS = 250;\n\nconst SHADOW_LOG: ShadowDivergence[] = [];\nconst PENDING_SHADOW_TASKS: Set<Promise<void>> = new Set();\nlet pendingScheduleCount = 0;\n\n/**\n * Programmatic-flag shape. Internal-only; never appears in any\n * exported public option type.\n *\n * @internal\n */\nexport interface ShadowEnableOptions {\n readonly _internal?: {\n readonly shadowCore?: boolean;\n };\n}\n\n/**\n * Read the shadow-enable flag from environment or programmatic\n * options. Read once per call, NOT cached at module scope, so tests\n * can toggle the env var dynamically. Environment access is guarded\n * for browser / edge runtimes that do not expose `process`.\n *\n * @internal\n */\nexport function isShadowEnabled(options?: ShadowEnableOptions): boolean {\n if (options?._internal?.shadowCore === true) return true;\n return readEnvFlag();\n}\n\nfunction readEnvFlag(): boolean {\n if (typeof process === 'undefined' || process === null) return false;\n const env = (process as { env?: Record<string, string | undefined> }).env;\n return env?.PEAC_INTERNAL_SHADOW_CORE === '1';\n}\n\n/**\n * Inputs to `scheduleShadow`. The `shadowFn` factory receives an\n * `AbortSignal` so cancellable implementations can opt in. v0.13.1\n * shadow paths are pure-CPU and ignore the signal; the runner still\n * passes one for forward-compat.\n *\n * @internal\n */\nexport interface ScheduleShadowArgs<T> {\n readonly call: ShadowCall;\n readonly realResult: T | undefined;\n readonly realError: { code?: string } | undefined;\n readonly shadowFn: (signal?: AbortSignal) => Promise<T>;\n readonly recordRef: string;\n}\n\n/**\n * Schedule shadow work AFTER the real-path return.\n *\n * The shadow run starts on the next MACROTASK boundary (via\n * `setTimeout(..., 0)`). The public function returns its real-path\n * value before the macrotask fires, including for async callers\n * whose `.then` / `await` continuations execute on microtasks.\n * `queueMicrotask` would interleave with those continuations and is\n * intentionally avoided.\n *\n * Tasks are tracked internally so test helpers can drain them for\n * deterministic assertions; production callers ignore the (void)\n * return.\n *\n * Failures inside the shadow path are converted to divergence records\n * inside the task body. The outer `task.catch(() => {})` is defense\n * in depth: if anything inside `runShadowTask` throws after the inner\n * try/catch (e.g., a hash failure during canonical comparison), the\n * outer catch swallows the rejection so no unhandled-rejection event\n * fires.\n *\n * @internal\n */\nexport function scheduleShadow<T>(args: ScheduleShadowArgs<T>): void {\n pendingScheduleCount += 1;\n setTimeout(() => {\n pendingScheduleCount -= 1;\n const task = runShadowTask(args);\n PENDING_SHADOW_TASKS.add(task);\n // Cleanup runs on both fulfillment and rejection. Using\n // `task.then(remove, remove)` instead of `task.finally(remove)`\n // avoids creating a derived rejected promise that would surface\n // as an unhandled-rejection event when the inner task rejects.\n // The two-arg `then` form swallows any rejection and runs the\n // cleanup on either branch.\n const removeFromPending = (): void => {\n PENDING_SHADOW_TASKS.delete(task);\n };\n void task.then(removeFromPending, removeFromPending);\n }, 0);\n}\n\nasync function runShadowTask<T>(args: ScheduleShadowArgs<T>): Promise<void> {\n const recordRefHash = await hashJws(args.recordRef);\n let shadowResult: T | undefined;\n let shadowErrorCode: string | undefined;\n\n try {\n shadowResult = await runWithTimeout(args.shadowFn, SHADOW_TIMEOUT_MS);\n } catch (err) {\n shadowErrorCode = extractErrorCode(err);\n appendDivergence({\n kind: shadowErrorCode === 'SHADOW_TIMEOUT' ? 'timing-diff' : 'shadow-error',\n call: args.call,\n recordRefHash,\n realErrorCode: args.realError?.code,\n shadowErrorCode,\n notes: redactNote(`shadow threw ${shadowErrorCode}`, MAX_NOTE_BYTES),\n timestamp: new Date().toISOString(),\n });\n return;\n }\n\n const divergence = await compareResults(args, shadowResult, recordRefHash);\n if (divergence) appendDivergence(divergence);\n}\n\n/**\n * Bounded REPORTING timeout for shadow work. NOT a hard preemption\n * guarantee. See the module-level \"Timeout guarantee class\" comment.\n */\nfunction runWithTimeout<T>(fn: (signal?: AbortSignal) => Promise<T>, ms: number): Promise<T> {\n const controller = new AbortController();\n return new Promise((resolve, reject) => {\n const timer = setTimeout(() => {\n controller.abort();\n reject(new Error('SHADOW_TIMEOUT'));\n }, ms);\n fn(controller.signal).then(\n (v) => {\n clearTimeout(timer);\n resolve(v);\n },\n (e) => {\n clearTimeout(timer);\n reject(e);\n }\n );\n });\n}\n\nasync function compareResults<T>(\n args: ScheduleShadowArgs<T>,\n shadowResult: T | undefined,\n recordRefHash: string\n): Promise<ShadowDivergence | null> {\n const ts = new Date().toISOString();\n\n // Both succeeded: compare canonical hashes.\n if (!args.realError && shadowResult !== undefined && args.realResult !== undefined) {\n const realHash = await canonicalHashOf(args.realResult);\n const shadowHash = await canonicalHashOf(shadowResult);\n if (realHash !== shadowHash) {\n return {\n kind: 'output-byte-diff',\n call: args.call,\n recordRefHash,\n realResultHash: realHash,\n shadowResultHash: shadowHash,\n realByteLen: byteLenOf(args.realResult),\n shadowByteLen: byteLenOf(shadowResult),\n notes: 'canonical-hash-mismatch',\n timestamp: ts,\n };\n }\n return null;\n }\n\n // Both errored: comparator already handled in catch path; no record here.\n if (args.realError && shadowResult === undefined) {\n return null;\n }\n\n // Asymmetric: one succeeded, one failed.\n return {\n kind: 'error-code-diff',\n call: args.call,\n recordRefHash,\n realErrorCode: args.realError?.code,\n notes: args.realError ? 'real-errored-shadow-succeeded' : 'real-succeeded-shadow-errored',\n timestamp: ts,\n };\n}\n\nfunction byteLenOf(value: unknown): number {\n if (typeof value === 'string') return utf8ByteLength(value);\n if (value instanceof Uint8Array) return value.byteLength;\n return utf8ByteLength(JSON.stringify(value) ?? '');\n}\n\nfunction extractErrorCode(err: unknown): string {\n if (err && typeof err === 'object') {\n const candidate = (err as { code?: unknown; message?: unknown }).code;\n if (typeof candidate === 'string' && candidate.length > 0) return candidate;\n const message = (err as { message?: unknown }).message;\n if (typeof message === 'string' && /^[A-Z_][A-Z0-9_]*$/.test(message)) return message;\n }\n return 'SHADOW_UNKNOWN_ERROR';\n}\n\nfunction appendDivergence(d: ShadowDivergence): void {\n pruneStale();\n if (SHADOW_LOG.length >= MAX_LOG_ENTRIES) SHADOW_LOG.shift();\n SHADOW_LOG.push(d);\n}\n\nfunction pruneStale(): void {\n const cutoffIso = new Date(Date.now() - RETENTION_MS).toISOString();\n while (SHADOW_LOG.length > 0 && SHADOW_LOG[0].timestamp < cutoffIso) SHADOW_LOG.shift();\n}\n\n/**\n * Read the in-memory shadow log without mutating it. TEST USE ONLY.\n *\n * @internal\n */\nexport function _peekShadowLog(): readonly ShadowDivergence[] {\n return SHADOW_LOG.slice();\n}\n\n/**\n * Clear the in-memory shadow log. TEST USE ONLY.\n *\n * @internal\n */\nexport function _resetShadowLog(): void {\n SHADOW_LOG.length = 0;\n}\n\n/**\n * Drain the pending-shadow-tasks set so deterministic assertions can\n * run after a sequence of shadow-enabled calls. Yields to the event\n * loop until every scheduled `setTimeout` has fired AND every\n * resulting task has settled. TEST USE ONLY. Production code MUST\n * NOT call this.\n *\n * @internal\n */\nexport async function _drainShadowQueueForTests(): Promise<void> {\n while (pendingScheduleCount > 0 || PENDING_SHADOW_TASKS.size > 0) {\n if (pendingScheduleCount > 0) {\n // Yield so any pending setTimeout(..., 0) fires.\n await new Promise<void>((resolve) => setTimeout(resolve, 0));\n }\n if (PENDING_SHADOW_TASKS.size > 0) {\n await Promise.allSettled(Array.from(PENDING_SHADOW_TASKS));\n }\n }\n}\n","/**\n * Internal rollback-path flag.\n *\n * INTERNAL ONLY. Both flag values currently use the same protocol path.\n * The flag reader is exercised so rollback-path plumbing can be validated\n * without changing public behavior.\n *\n * Public option types MUST NOT declare `_internal.legacyPath`; callers\n * inside this package access the programmatic option only through\n * internal casts. Flag identifiers are forbidden on the public TypeScript\n * surface by `scripts/verify-dist-private-leaks.mjs` (Tier 1 + scoped\n * runtime allowlist for `@peac/protocol` runtime files only) and by\n * `scripts/verify-no-semantic-widening.mjs`.\n */\n\n/**\n * Programmatic-flag shape. Internal-only; never appears on any\n * exported public option type. Mirrors the existing shadow-flag\n * pattern at `_internal/shadow.ts` so the dist-leak gates and the\n * semantic-widening gates apply uniformly.\n *\n * @internal\n */\nexport interface LegacyPathOptions {\n readonly _internal?: {\n readonly legacyPath?: boolean;\n };\n}\n\n/**\n * Read the rollback-path flag from environment or programmatic\n * options. Read once per call, NOT cached at module scope, so tests\n * can toggle the env var dynamically. Strict semantics: only the\n * literal string `'1'` activates the flag, mirroring\n * `PEAC_INTERNAL_SHADOW_CORE`.\n *\n * Environment access is guarded for browser / edge runtimes that do\n * not expose `process`; the function never throws.\n *\n * Caller pattern at protocol hot paths:\n *\n * void readLegacyPathFlag(options as unknown as LegacyPathOptions);\n *\n * The `void` discards the returned boolean intentionally: both flag\n * values currently use the same protocol path, and the call exists\n * so the read path is exercised.\n *\n * @internal\n */\nexport function readLegacyPathFlag(options?: LegacyPathOptions): boolean {\n if (options?._internal?.legacyPath === true) return true;\n if (typeof process === 'undefined' || process === null) return false;\n const env = (process as { env?: Record<string, string | undefined> }).env;\n return env?.PEAC_INTERNAL_LEGACY_PATH === '1';\n}\n","/**\n * Normalized internal observation shape for shadow-vs-real comparison.\n *\n * @internal\n *\n * INTERNAL ONLY. Not re-exported from packages/protocol/src/index.ts.\n *\n * The shadow scheduler compares real-path and shadow-path results via\n * canonical hashes. To make that comparison meaningful (not just an\n * accept/reject boolean) and free of false positives, both sides\n * project onto the SAME stable normalized `ShadowObservation` shape\n * before the hash:\n *\n * - `accepted`: did the validator accept the input?\n * - `violationCodes`: sorted, deduplicated registered error codes.\n * - `warningCodes`: sorted, deduplicated registered warning codes.\n *\n * Layer-tag metadata is intentionally NOT part of the comparable\n * shape. The bounded validator emits per-layer tags; the canonical\n * Zod path does not. Including them would cause a hash divergence\n * even on full functional agreement, masking true divergence as\n * noise.\n *\n * Issue path projection:\n *\n * `IssueResult` does not expose warning codes; canonical issuance\n * either succeeds (and surfaces no warnings to the caller) or\n * throws. To prevent the bounded validator's warnings from\n * producing false `output-byte-diff` records on a successful\n * issuance, the issue-side comparison runs in ACCEPTED-ONLY mode:\n * `warningCodes` is projected to `[]` on BOTH sides.\n *\n * VerifyLocal success path projection:\n *\n * `VerifyLocalSuccess` exposes a `warnings` array of registered\n * warning codes. The verifyLocal-side comparison includes\n * `warningCodes` from both sides (canonical surfaces them\n * directly; the bounded validator's warningCodes are mapped from\n * `BoundedWarning.code`).\n */\n\nimport type { BoundedValidationResult } from './record-core/bounded-validator.js';\n\n/**\n * Canonical observation projected from either the real path or the\n * shadow path.\n *\n * @internal\n */\nexport interface ShadowObservation {\n readonly accepted: boolean;\n /** Registered error codes, sorted, deduplicated. */\n readonly violationCodes: readonly string[];\n /** Registered warning codes, sorted, deduplicated. */\n readonly warningCodes: readonly string[];\n}\n\n/**\n * Real-path observation for a successful `issue()` call. Always\n * projects to the empty accepted-only shape; canonical issuance\n * surfaces no warning codes through `IssueResult`.\n *\n * @internal\n */\nexport function realObservationForIssue(): ShadowObservation {\n return EMPTY_ACCEPTED;\n}\n\n/**\n * Real-path observation for a successful `verifyLocal()` call. Maps\n * the canonical `warnings: VerificationWarning[]` array onto the\n * normalized warningCodes set.\n *\n * @internal\n */\nexport function realObservationForVerifyLocalSuccess(\n warnings: readonly { code: string }[] | undefined\n): ShadowObservation {\n if (!warnings || warnings.length === 0) return EMPTY_ACCEPTED;\n return {\n accepted: true,\n violationCodes: [],\n warningCodes: sortedDedupedCodes(warnings.map((w) => w.code)),\n };\n}\n\n/**\n * Project a `BoundedValidationResult` into the shared observation\n * shape with full warning-code parity. Use on the verifyLocal path\n * where canonical exposes warning codes through\n * `VerifyLocalSuccess.warnings`.\n *\n * @internal\n */\nexport function shadowObservationFromBounded(bounded: BoundedValidationResult): ShadowObservation {\n return {\n accepted: bounded.accepted,\n violationCodes: sortedDedupedCodes(bounded.violations.map((v) => v.code)),\n warningCodes: sortedDedupedCodes(bounded.warnings.map((w) => w.code)),\n };\n}\n\n/**\n * Project a `BoundedValidationResult` into the shared observation\n * shape with `warningCodes` flattened to `[]`. Use on the issue path\n * where canonical issuance does not surface warning codes through\n * `IssueResult`. Without this projection the bounded validator's\n * type-extension or temporal warnings would create false\n * `output-byte-diff` records on every otherwise-successful issuance.\n *\n * @internal\n */\nexport function shadowObservationFromBoundedAcceptedOnly(\n bounded: BoundedValidationResult\n): ShadowObservation {\n return {\n accepted: bounded.accepted,\n violationCodes: sortedDedupedCodes(bounded.violations.map((v) => v.code)),\n warningCodes: [],\n };\n}\n\nconst EMPTY_ACCEPTED: ShadowObservation = Object.freeze({\n accepted: true,\n violationCodes: Object.freeze([]) as readonly string[],\n warningCodes: Object.freeze([]) as readonly string[],\n});\n\nfunction sortedDedupedCodes(codes: readonly string[]): readonly string[] {\n if (codes.length === 0) return [];\n return Array.from(new Set(codes)).sort();\n}\n","/**\n * Telemetry utilities for protocol package\n *\n * TelemetryHook is the protocol-local interface for observability.\n * Hooks are best-effort side effects: fire-and-forget, never awaited,\n * guarded against both sync throws and async rejections.\n */\n\nimport { createHash } from 'node:crypto';\n\n/**\n * Input for receipt issued telemetry event\n */\nexport interface ReceiptIssuedHookInput {\n receiptHash: string;\n issuer?: string;\n kid?: string;\n durationMs?: number;\n}\n\n/**\n * Input for receipt verified telemetry event\n */\nexport interface ReceiptVerifiedHookInput {\n receiptHash: string;\n valid: boolean;\n reasonCode?: string;\n issuer?: string;\n kid?: string;\n durationMs?: number;\n}\n\n/**\n * Telemetry hook interface for protocol observability\n *\n * Implementations SHOULD be no-throw. Protocol guards all calls,\n * but well-behaved hooks should not throw.\n *\n * Hooks may be sync or async -- protocol will NOT await the result.\n */\nexport type TelemetryHook = {\n onReceiptIssued?(input: ReceiptIssuedHookInput): void | Promise<void>;\n onReceiptVerified?(input: ReceiptVerifiedHookInput): void | Promise<void>;\n};\n\n/**\n * Safely invoke a telemetry hook (fire-and-forget)\n *\n * Guards both sync throws and async rejections.\n * Telemetry MUST NOT break core flow.\n */\nexport function fireTelemetryHook<T>(\n fn: ((input: T) => void | Promise<void>) | undefined,\n input: T\n): void {\n if (!fn) return;\n try {\n const result = fn(input);\n // Swallow async rejections\n if (result && typeof (result as Promise<void>).catch === 'function') {\n (result as Promise<void>).catch(() => {});\n }\n } catch {\n // Telemetry MUST NOT break core flow\n }\n}\n\n/**\n * Compute a SHA-256 hash of a receipt JWS\n *\n * Returns format: sha256:{hex prefix}\n * Uses first 16 chars of hex for brevity in logs/spans.\n */\nexport function hashReceipt(jws: string): string {\n const hash = createHash('sha256').update(jws).digest('hex');\n return `sha256:${hash.slice(0, 16)}`;\n}\n","/**\n * Receipt issuance\n * Validates input, generates UUIDv7 rid, and signs with Ed25519\n */\n\nimport { uuidv7 } from 'uuidv7';\nimport { sign, CryptoError } from '@peac/crypto';\nimport { defaultCodec } from './_internal/record-core/codec/jws-jwt.js';\nimport { runBoundedValidatorShadow } from './_internal/record-core/bounded-validator.js';\nimport { runBoundedValidationGate } from './_internal/record-core/validation-gate.js';\nimport { isShadowEnabled, scheduleShadow, type ShadowEnableOptions } from './_internal/shadow.js';\nimport { readLegacyPathFlag, type LegacyPathOptions } from './_internal/legacy-path.js';\nimport {\n realObservationForIssue,\n shadowObservationFromBoundedAcceptedOnly,\n type ShadowObservation,\n} from './_internal/shadow-observe.js';\nimport type { JsonValue, EvidencePillar, PolicyBlock } from '@peac/kernel';\nimport { ZodError } from 'zod';\nimport {\n PEACReceiptClaims,\n ReceiptClaims,\n SubjectProfileSnapshot,\n validateSubjectSnapshot,\n createEvidenceNotJsonError,\n createConstraintViolationError,\n createWorkflowContextInvalidError,\n createWorkflowDagInvalidError,\n validateKernelConstraints,\n type PEACError,\n type PurposeToken,\n type CanonicalPurpose,\n type PurposeReason,\n isValidPurposeToken,\n isCanonicalPurpose,\n isValidPurposeReason,\n // Workflow correlation (v0.10.2+)\n type WorkflowContext,\n isValidWorkflowContext,\n hasValidDagSemantics,\n WORKFLOW_EXTENSION_KEY,\n // Wire 0.2 (v0.12.0-preview.1)\n isCanonicalIss,\n Wire02ClaimsSchema,\n type Wire02Claims,\n} from '@peac/schema';\nimport { hashReceipt, fireTelemetryHook, type TelemetryHook } from './telemetry.js';\n\n/**\n * Wire 0.1 record options (frozen legacy).\n *\n * @deprecated Use {@link IssueWire02Options} (or the {@link IssueOptions} alias)\n * for current stable issuance.\n */\nexport interface IssueWire01Options {\n /** Issuer URL (https://) */\n iss: string;\n\n /** Audience / resource URL (https://) */\n aud: string;\n\n /** Amount in smallest currency unit */\n amt: number;\n\n /** ISO 4217 currency code (uppercase) */\n cur: string;\n\n /** Payment rail identifier */\n rail: string;\n\n /** Rail-specific payment reference */\n reference: string;\n\n /** Asset transferred (e.g., \"USD\", \"USDC\", \"BTC\") - defaults to currency if not provided */\n asset?: string;\n\n /** Environment (\"live\" or \"test\") - defaults to \"test\" */\n env?: 'live' | 'test';\n\n /** Network/rail identifier (optional, SHOULD for crypto) */\n network?: string;\n\n /** Facilitator reference (optional) */\n facilitator_ref?: string;\n\n /** Rail-specific evidence (JSON-safe) - defaults to empty object if not provided */\n evidence?: JsonValue;\n\n /** Idempotency key (optional) */\n idempotency_key?: string;\n\n /** Rail-specific metadata (optional) */\n metadata?: Record<string, unknown>;\n\n /** Subject URI (optional) */\n subject?: string;\n\n /** Extensions (optional) */\n ext?: PEACReceiptClaims['ext'];\n\n /** Expiry timestamp (Unix seconds, optional) */\n exp?: number;\n\n /** Subject profile snapshot for envelope (v0.9.17+, optional) */\n subject_snapshot?: SubjectProfileSnapshot;\n\n /**\n * Purposes declared by the requesting agent (v0.9.24+, optional)\n *\n * From PEAC-Purpose request header. Accepts single token or array.\n * Unknown tokens are preserved for forward compatibility.\n */\n purpose?: PurposeToken | PurposeToken[];\n\n /**\n * Single purpose enforced by policy (v0.9.24+, optional)\n *\n * MUST be one of declared purposes OR a more restrictive downgrade.\n * Only canonical purposes have enforcement semantics.\n */\n purpose_enforced?: CanonicalPurpose;\n\n /**\n * Reason for enforcement decision (v0.9.24+, optional)\n *\n * The audit spine - explains WHY purpose was enforced as it was.\n */\n purpose_reason?: PurposeReason;\n\n /**\n * Workflow correlation context (v0.10.2+, optional)\n *\n * Links this receipt into a multi-step workflow DAG.\n * Added to ext['org.peacprotocol/workflow'].\n */\n workflow_context?: WorkflowContext;\n\n /** Ed25519 private key (32 bytes) */\n privateKey: Uint8Array;\n\n /** Key ID; non-empty, well-formed Unicode, at most 256 UTF-8 bytes */\n kid: string;\n\n /** Telemetry hook (optional, fire-and-forget) */\n telemetry?: TelemetryHook;\n}\n\n/**\n * Result of issuing a receipt\n */\nexport interface IssueResult {\n /** JWS compact serialization */\n jws: string;\n\n /** Validated subject snapshot (if provided) */\n subject_snapshot?: SubjectProfileSnapshot;\n}\n\n/**\n * Error thrown during receipt issuance\n *\n * Wraps a structured PEACError for programmatic handling.\n */\nexport class IssueError extends Error {\n /** Structured error details */\n readonly peacError: PEACError;\n\n constructor(peacError: PEACError) {\n const details = peacError.details as { message?: string } | undefined;\n super(details?.message ?? peacError.code);\n this.name = 'IssueError';\n this.peacError = peacError;\n }\n}\n\n/**\n * Protocol code for a crypto signing failure at the issuance boundary.\n *\n * The signer enforces the I-JSON gate (RFC 7493) and the kid rule on the exact bytes it signs, so a\n * claim value that passed schema validation but is not I-JSON, an out-of-range number, or an invalid\n * kid is rejected there rather than emitted. These are the crypto codes reachable when serializing a\n * well-formed claims object, mapped to the same protocol code the verifier reports for the identical\n * raw bytes, so issuance and verification classify the failure the same way. A well-formed claims\n * object cannot produce duplicate member names, but the mapping is complete for robustness. Any other\n * crypto code (for example an invalid key length) falls back to the generic validation code; the\n * original CryptoError is always retained as the cause.\n */\nconst CRYPTO_ISSUANCE_CODE_MAP: Record<string, string> = {\n CRYPTO_JWS_MISSING_KID: 'E_JWS_MISSING_KID',\n CRYPTO_IJSON_INVALID_STRING: 'E_IJSON_INVALID_STRING',\n CRYPTO_IJSON_NUMBER_OUT_OF_RANGE: 'E_IJSON_NUMBER_OUT_OF_RANGE',\n CRYPTO_IJSON_DUPLICATE_MEMBER_NAME: 'E_IJSON_DUPLICATE_MEMBER_NAME',\n};\n\nfunction issueErrorFromCryptoError(err: CryptoError): IssueError {\n const code = CRYPTO_ISSUANCE_CODE_MAP[err.code] ?? 'E_INVALID_FORMAT';\n const issueError = new IssueError({\n code,\n category: 'validation',\n severity: 'error',\n retryable: false,\n http_status: 400,\n details: { message: err.message },\n } as PEACError);\n // Retain the exact crypto classification for diagnostics without widening the public code surface.\n (issueError as { cause?: unknown }).cause = err;\n return issueError;\n}\n\n/**\n * Issues a legacy Wire 0.1 receipt.\n *\n * @deprecated Use {@link issue} for current stable issuance. Wire 0.1\n * issuance is retained for backward compatibility but discouraged for new\n * applications.\n *\n * @param options - Wire 0.1 record options\n * @returns Issue result with JWS and optional subject_snapshot\n * @throws IssueError if evidence contains non-JSON-safe values\n */\nexport async function issueWire01(options: IssueWire01Options): Promise<IssueResult> {\n // Validate URLs\n if (!options.iss.startsWith('https://')) {\n throw new Error('Issuer URL must start with https://');\n }\n if (!options.aud.startsWith('https://')) {\n throw new Error('Audience URL must start with https://');\n }\n if (options.subject && !options.subject.startsWith('https://')) {\n throw new Error('Subject URI must start with https://');\n }\n\n // Validate currency code\n if (!/^[A-Z]{3}$/.test(options.cur)) {\n throw new Error('Currency must be ISO 4217 uppercase (e.g., USD)');\n }\n\n // Validate amount\n if (!Number.isInteger(options.amt) || options.amt < 0) {\n throw new Error('Amount must be a non-negative integer');\n }\n\n // Validate expiry (if provided)\n if (options.exp !== undefined) {\n if (!Number.isInteger(options.exp) || options.exp < 0) {\n throw new Error('Expiry must be a non-negative integer');\n }\n }\n\n // Normalize and validate purpose (v0.9.24+)\n let purposeDeclared: PurposeToken[] | undefined;\n if (options.purpose !== undefined) {\n // Normalize to array\n const rawPurposes = Array.isArray(options.purpose) ? options.purpose : [options.purpose];\n\n // Validate each token\n const invalidTokens: string[] = [];\n for (const token of rawPurposes) {\n if (!isValidPurposeToken(token)) {\n invalidTokens.push(token);\n }\n }\n if (invalidTokens.length > 0) {\n throw new Error(`Invalid purpose tokens: ${invalidTokens.join(', ')}`);\n }\n\n // Check for explicit 'undeclared' which is invalid on wire\n if (rawPurposes.includes('undeclared')) {\n throw new Error(\"Explicit 'undeclared' is not a valid purpose token (internal-only)\");\n }\n\n purposeDeclared = rawPurposes;\n }\n\n // Validate purpose_enforced (must be canonical)\n if (options.purpose_enforced !== undefined) {\n if (!isCanonicalPurpose(options.purpose_enforced)) {\n throw new Error(\n `purpose_enforced must be a canonical purpose, got: ${options.purpose_enforced}`\n );\n }\n }\n\n // Validate purpose_reason\n if (options.purpose_reason !== undefined) {\n if (!isValidPurposeReason(options.purpose_reason)) {\n throw new Error(`Invalid purpose_reason: ${options.purpose_reason}`);\n }\n }\n\n // Validate workflow_context (v0.10.2+)\n if (options.workflow_context !== undefined) {\n if (!isValidWorkflowContext(options.workflow_context)) {\n throw new IssueError(\n createWorkflowContextInvalidError('Does not conform to WorkflowContextSchema')\n );\n }\n if (!hasValidDagSemantics(options.workflow_context)) {\n // Determine specific reason\n const ctx = options.workflow_context;\n const isSelfParent = ctx.parent_step_ids.includes(ctx.step_id);\n const hasDuplicates = new Set(ctx.parent_step_ids).size !== ctx.parent_step_ids.length;\n const reason = isSelfParent ? 'self_parent' : hasDuplicates ? 'duplicate_parent' : 'cycle';\n throw new IssueError(createWorkflowDagInvalidError(reason));\n }\n }\n\n // Generate UUIDv7 for receipt ID\n const rid = uuidv7();\n\n // Get current timestamp\n const iat = Math.floor(Date.now() / 1000);\n\n // Build receipt claims\n const claims: PEACReceiptClaims = {\n iss: options.iss,\n aud: options.aud,\n iat,\n rid,\n amt: options.amt,\n cur: options.cur,\n payment: {\n rail: options.rail,\n reference: options.reference,\n amount: options.amt,\n currency: options.cur,\n asset: options.asset ?? options.cur, // Default asset to currency for backward compatibility\n env: options.env ?? 'test', // Default to test environment for backward compatibility\n evidence: options.evidence ?? {}, // Default to empty object for backward compatibility\n ...(options.network && { network: options.network }),\n ...(options.facilitator_ref && { facilitator_ref: options.facilitator_ref }),\n ...(options.idempotency_key && { idempotency_key: options.idempotency_key }),\n ...(options.metadata && { metadata: options.metadata }),\n },\n ...(options.exp && { exp: options.exp }),\n ...(options.subject && { subject: { uri: options.subject } }),\n // Build extensions (merge user-provided ext with workflow_context)\n ...((options.ext || options.workflow_context) && {\n ext: {\n ...options.ext,\n ...(options.workflow_context && {\n [WORKFLOW_EXTENSION_KEY]: options.workflow_context,\n }),\n },\n }),\n // Purpose claims (v0.9.24+)\n ...(purposeDeclared && { purpose_declared: purposeDeclared }),\n ...(options.purpose_enforced && { purpose_enforced: options.purpose_enforced }),\n ...(options.purpose_reason && { purpose_reason: options.purpose_reason }),\n };\n\n // Validate structural kernel constraints before signing (fail-closed)\n const constraintResult = validateKernelConstraints(claims);\n if (!constraintResult.valid) {\n throw new IssueError(createConstraintViolationError(constraintResult.violations));\n }\n\n // Validate claims with Zod - map evidence errors to typed error\n try {\n ReceiptClaims.parse(claims);\n } catch (err: unknown) {\n if (err instanceof ZodError) {\n // Check if any error path touches evidence\n const evidenceIssue = err.issues.find((issue) =>\n issue.path.some((p) => p === 'evidence' || p === 'payment')\n );\n if (evidenceIssue && evidenceIssue.path.includes('evidence')) {\n const peacError = createEvidenceNotJsonError(\n evidenceIssue.message,\n evidenceIssue.path as (string | number)[]\n );\n throw new IssueError(peacError);\n }\n }\n throw err;\n }\n\n // Validate subject_snapshot if provided (v0.9.17+)\n // This validates schema and logs advisory PII warning if applicable\n const validatedSnapshot = validateSubjectSnapshot(options.subject_snapshot);\n\n // Track start time for telemetry\n const startTime = performance.now();\n\n // Sign with Ed25519\n const jws = await sign(claims, options.privateKey, options.kid);\n\n // Emit telemetry (fire-and-forget, guarded)\n fireTelemetryHook(options.telemetry?.onReceiptIssued, {\n receiptHash: hashReceipt(jws),\n issuer: options.iss,\n kid: options.kid,\n durationMs: performance.now() - startTime,\n });\n\n return {\n jws,\n ...(validatedSnapshot && { subject_snapshot: validatedSnapshot }),\n };\n}\n\n/**\n * Issue a Wire 0.1 PEAC record and return just the JWS string\n *\n * @deprecated Wire 0.1 issuance is frozen legacy. Use {@link issue} for the current stable format.\n *\n * @param options - Wire 0.1 record options\n * @returns JWS compact serialization\n */\nexport async function issueJws(options: IssueWire01Options): Promise<string> {\n const result = await issueWire01(options);\n return result.jws;\n}\n\n/**\n * Issue a PEAC record in the current stable public format.\n *\n * This is the canonical public issuance API. It issues Wire 0.2 records\n * (`typ: interaction-record+jwt`). For an explicit wire-pinned API, use\n * {@link issueWire02} directly.\n *\n * @param options - Record options (same as {@link IssueWire02Options})\n * @returns Issue result with JWS\n * @throws IssueError if iss is not canonical or schema validation fails\n */\nexport async function issue(options: IssueWire02Options): Promise<IssueResult> {\n return issueWire02(options);\n}\n\n// ---------------------------------------------------------------------------\n// Wire 0.2 issuance (v0.12.0-preview.1)\n// ---------------------------------------------------------------------------\n\n/**\n * Options for issuing a Wire 0.2 record\n */\nexport interface IssueWire02Options {\n /**\n * Canonical issuer.\n * Accepted: https:// ASCII origin or did: identifier.\n * Non-canonical values produce an IssueError.\n */\n iss: string;\n\n /** Structural kind: 'evidence' or 'challenge' */\n kind: 'evidence' | 'challenge';\n\n /**\n * Open semantic type.\n * Accepted: reverse-DNS notation (e.g., 'org.example/flow') or absolute URI.\n */\n type: string;\n\n /** Ed25519 private key (32 bytes) */\n privateKey: Uint8Array;\n\n /** Key ID: non-empty, well-formed Unicode, at most 256 UTF-8 bytes (a PEAC constraint; RFC 7515 leaves kid structure unspecified) */\n kid: string;\n\n /**\n * Unique receipt identifier.\n * Generated via uuidv7 if not provided.\n */\n jti?: string;\n\n /** Subject identifier (max 2048 chars, optional) */\n sub?: string;\n\n /**\n * Evidence pillars (sorted ascending, closed 10-value taxonomy).\n * Validated against Wire02ClaimsSchema before signing.\n */\n pillars?: EvidencePillar[];\n\n /**\n * ISO 8601 / RFC 3339 timestamp when the interaction occurred.\n * Evidence kind only; rejected on challenge kind with E_OCCURRED_AT_ON_CHALLENGE.\n */\n occurred_at?: string;\n\n /** Declared purpose string (max 256 chars, optional) */\n purpose_declared?: string;\n\n /**\n * Policy binding block.\n * digest must be 'sha256:<64 lowercase hex>' format (use computePolicyDigestJcs from @peac/protocol).\n */\n policy?: PolicyBlock;\n\n /** Extension groups (open; caller-provided, not validated here) */\n extensions?: Record<string, unknown>;\n}\n\n/**\n * Canonical issuance options type.\n *\n * Alias for {@link IssueWire02Options}: the current stable receipt format.\n */\nexport type IssueOptions = IssueWire02Options;\n\n/**\n * Issue a Wire 0.2 record (explicit wire-pinned API).\n *\n * Most callers should use {@link issue} instead, which delegates here.\n * Use `issueWire02` directly for conformance tests, benchmarks, and\n * callers that need explicit wire version pinning.\n *\n * Validates the iss canonical form and Wire02ClaimsSchema before signing.\n * Always sets typ to 'interaction-record+jwt' (WIRE_02_JWS_TYP).\n *\n * @param options - Wire 0.2 record options\n * @returns Issue result with JWS\n * @throws IssueError if iss is not canonical or schema validation fails\n */\nexport async function issueWire02(options: IssueWire02Options): Promise<IssueResult> {\n // Internal rollback-path flag. Selects the bounded-validation\n // admission gate (default) or the inline canonical schema check\n // (rollback). Both branches share the canonical materializer that\n // builds the IssueResult and the JWS bytes.\n const legacyPath = readLegacyPathFlag(options as unknown as LegacyPathOptions);\n\n // Validate canonical iss before signing\n if (!isCanonicalIss(options.iss)) {\n throw new IssueError({\n code: 'E_ISS_NOT_CANONICAL',\n category: 'validation',\n severity: 'error',\n retryable: false,\n http_status: 400,\n details: {\n message: `iss is not in canonical form: \"${options.iss}\". Use an https://<origin> or did:<method> identifier.`,\n },\n } as PEACError);\n }\n\n // Generate jti if not provided\n const jti = options.jti ?? uuidv7();\n\n // Get current timestamp\n const iat = Math.floor(Date.now() / 1000);\n\n // Build Wire 0.2 claims\n const claims: Wire02Claims = {\n peac_version: '0.2',\n kind: options.kind,\n type: options.type,\n iss: options.iss,\n iat,\n jti,\n ...(options.sub !== undefined && { sub: options.sub }),\n ...(options.pillars !== undefined && { pillars: options.pillars }),\n ...(options.occurred_at !== undefined && { occurred_at: options.occurred_at }),\n ...(options.purpose_declared !== undefined && { purpose_declared: options.purpose_declared }),\n ...(options.policy !== undefined && { policy: options.policy }),\n ...(options.extensions !== undefined && { extensions: options.extensions }),\n };\n\n // Validate schema before signing (fail-closed). The default branch\n // routes through the bounded validation gate; the rollback branch\n // retains the inline canonical schema check. Both branches produce\n // byte-identical JWS bytes for every input both branches accept.\n if (legacyPath) {\n const parseResult = Wire02ClaimsSchema.safeParse(claims);\n if (!parseResult.success) {\n const firstIssue = parseResult.error.issues[0];\n throw new IssueError({\n code: 'E_INVALID_FORMAT',\n category: 'validation',\n severity: 'error',\n retryable: false,\n http_status: 400,\n details: {\n message: `Wire 0.2 claims schema validation failed: ${firstIssue?.message ?? 'unknown'}`,\n },\n } as PEACError);\n }\n } else {\n const gateResult = runBoundedValidationGate({\n surface: 'issueWire02',\n payload: claims as unknown,\n });\n if (!gateResult.ok) {\n throw new IssueError({\n code: gateResult.code,\n category: 'validation',\n severity: 'error',\n retryable: false,\n http_status: 400,\n details: { message: gateResult.message },\n } as PEACError);\n }\n }\n\n // Sign with Wire 0.2 via the internal codec boundary (always sets\n // typ: 'interaction-record+jwt'). Default codec is a pure pass-through\n // to @peac/crypto.signWire02; serialized output is byte-identical to\n // the prior release. The signer enforces the raw-bytes I-JSON gate and\n // the kid rule; present any such failure through the same structured\n // IssueError surface as every other issuance failure rather than leaking\n // a raw crypto error from this public API.\n let jws: string;\n try {\n jws = await defaultCodec.encode(claims, options.privateKey, options.kid);\n } catch (err) {\n if (err instanceof CryptoError) {\n throw issueErrorFromCryptoError(err);\n }\n throw err;\n }\n\n // Shadow scheduling fires only on the rollback branch where the\n // bounded validator is genuinely a comparison path; under the\n // default branch the bounded validator runs as the production\n // admission gate, so a duplicate shadow run would compare the same\n // code path against itself.\n if (legacyPath && isShadowEnabled(options as unknown as ShadowEnableOptions)) {\n scheduleShadow<ShadowObservation>({\n call: 'issue',\n realResult: realObservationForIssue(),\n realError: undefined,\n shadowFn: async () =>\n shadowObservationFromBoundedAcceptedOnly(\n runBoundedValidatorShadow({\n claims: {\n kind: claims.kind,\n type: claims.type,\n iss: claims.iss,\n iat: claims.iat,\n occurred_at: claims.occurred_at,\n extensions: claims.extensions,\n },\n now: iat,\n })\n ),\n recordRef: jws,\n });\n }\n\n return { jws };\n}\n","/**\n * PEAC Discovery - Issuer Configuration and Policy Manifest\n *\n * This module provides functions for:\n * - Issuer configuration discovery (/.well-known/peac-issuer.json)\n * - Policy manifest parsing (/.well-known/peac.txt)\n *\n * @see docs/specs/PEAC-ISSUER.md\n * @see docs/specs/PEAC-TXT.md\n */\n\nimport {\n PEACIssuerConfig,\n PEACPolicyManifest,\n PEACDiscovery,\n PEAC_ISSUER_CONFIG_PATH,\n PEAC_ISSUER_CONFIG_MAX_BYTES,\n PEAC_POLICY_PATH,\n PEAC_POLICY_FALLBACK_PATH,\n PEAC_POLICY_MAX_BYTES,\n validateRevokedKeys,\n} from '@peac/schema';\n\n// ============================================================================\n// Issuer Configuration (/.well-known/peac-issuer.json)\n// ============================================================================\n\n/**\n * Parse PEAC issuer configuration from JSON\n *\n * @param json - JSON string or object\n * @returns Parsed issuer configuration\n * @throws Error if validation fails\n */\nexport function parseIssuerConfig(json: string | object): PEACIssuerConfig {\n let config: unknown;\n\n if (typeof json === 'string') {\n const bytes = new TextEncoder().encode(json).length;\n if (bytes > PEAC_ISSUER_CONFIG_MAX_BYTES) {\n throw new Error(`Issuer config exceeds ${PEAC_ISSUER_CONFIG_MAX_BYTES} bytes (got ${bytes})`);\n }\n\n try {\n config = JSON.parse(json);\n } catch (err) {\n throw new Error('Issuer config is not valid JSON', { cause: err });\n }\n } else {\n config = json;\n }\n\n if (typeof config !== 'object' || config === null) {\n throw new Error('Issuer config must be an object');\n }\n\n const obj = config as Record<string, unknown>;\n\n // Validate required fields\n if (typeof obj.version !== 'string' || !obj.version) {\n throw new Error('Missing required field: version');\n }\n if (typeof obj.issuer !== 'string' || !obj.issuer) {\n throw new Error('Missing required field: issuer');\n }\n if (typeof obj.jwks_uri !== 'string' || !obj.jwks_uri) {\n throw new Error('Missing required field: jwks_uri');\n }\n\n // Validate URL fields\n if (!obj.issuer.startsWith('https://')) {\n throw new Error('issuer must be an HTTPS URL');\n }\n // jwks_uri: validate URL syntax only. HTTPS enforcement is the resolver's\n // responsibility (jwks-resolver.ts), keeping parser and protocol concerns\n // separated. This makes E_VERIFY_JWKS_URI_INVALID a reachable error code.\n try {\n new URL(obj.jwks_uri);\n } catch (err) {\n throw new Error('jwks_uri must be a valid URL', { cause: err });\n }\n\n // Validate optional fields\n if (obj.verify_endpoint !== undefined) {\n if (typeof obj.verify_endpoint !== 'string') {\n throw new Error('verify_endpoint must be a string');\n }\n if (!obj.verify_endpoint.startsWith('https://')) {\n throw new Error('verify_endpoint must be an HTTPS URL');\n }\n }\n\n if (obj.receipt_versions !== undefined) {\n if (!Array.isArray(obj.receipt_versions)) {\n throw new Error('receipt_versions must be an array');\n }\n }\n\n if (obj.algorithms !== undefined) {\n if (!Array.isArray(obj.algorithms)) {\n throw new Error('algorithms must be an array');\n }\n }\n\n if (obj.payment_rails !== undefined) {\n if (!Array.isArray(obj.payment_rails)) {\n throw new Error('payment_rails must be an array');\n }\n }\n\n // Validate revoked_keys (v0.11.3+)\n let revokedKeys: PEACIssuerConfig['revoked_keys'];\n if (obj.revoked_keys !== undefined) {\n if (!Array.isArray(obj.revoked_keys)) {\n throw new Error('revoked_keys must be an array');\n }\n const result = validateRevokedKeys(obj.revoked_keys);\n if (!result.ok) {\n throw new Error(`Invalid revoked_keys: ${result.error}`);\n }\n revokedKeys = result.value;\n }\n\n return {\n version: obj.version,\n issuer: obj.issuer,\n jwks_uri: obj.jwks_uri,\n verify_endpoint: obj.verify_endpoint as string | undefined,\n receipt_versions: obj.receipt_versions as string[] | undefined,\n algorithms: obj.algorithms as string[] | undefined,\n payment_rails: obj.payment_rails as string[] | undefined,\n security_contact: obj.security_contact as string | undefined,\n revoked_keys: revokedKeys,\n };\n}\n\n/**\n * Fetch PEAC issuer configuration from an issuer URL\n *\n * @param issuerUrl - Issuer URL (https://)\n * @returns Parsed issuer configuration\n * @throws Error if fetch or validation fails\n */\nexport async function fetchIssuerConfig(issuerUrl: string): Promise<PEACIssuerConfig> {\n if (!issuerUrl.startsWith('https://')) {\n throw new Error('Issuer URL must be https://');\n }\n\n // Remove trailing slash for consistent URL construction\n const baseUrl = issuerUrl.replace(/\\/$/, '');\n const configUrl = `${baseUrl}${PEAC_ISSUER_CONFIG_PATH}`;\n\n try {\n const resp = await fetch(configUrl, {\n headers: { Accept: 'application/json' },\n signal: AbortSignal.timeout(10000),\n });\n\n if (!resp.ok) {\n throw new Error(`Issuer config fetch failed: ${resp.status}`);\n }\n\n const text = await resp.text();\n const config = parseIssuerConfig(text);\n\n // Verify issuer matches\n const normalizedExpected = baseUrl.replace(/\\/$/, '');\n const normalizedActual = config.issuer.replace(/\\/$/, '');\n if (normalizedActual !== normalizedExpected) {\n throw new Error(`Issuer mismatch: expected ${normalizedExpected}, got ${normalizedActual}`);\n }\n\n return config;\n } catch (err) {\n throw new Error(\n `Failed to fetch issuer config from ${issuerUrl}: ${\n err instanceof Error ? err.message : String(err)\n }`,\n { cause: err }\n );\n }\n}\n\n// ============================================================================\n// Policy Manifest (/.well-known/peac.txt)\n// ============================================================================\n\n/**\n * Detect if content is JSON or YAML\n */\nfunction isJsonContent(text: string, contentType?: string): boolean {\n if (contentType?.includes('application/json')) {\n return true;\n }\n const firstChar = text.trimStart()[0];\n return firstChar === '{';\n}\n\n/**\n * Parse PEAC policy manifest from YAML or JSON\n *\n * @param text - Policy manifest text (YAML or JSON)\n * @param contentType - Optional Content-Type header value\n * @returns Parsed policy manifest\n * @throws Error if validation fails\n */\nexport function parsePolicyManifest(text: string, contentType?: string): PEACPolicyManifest {\n const bytes = new TextEncoder().encode(text).length;\n if (bytes > PEAC_POLICY_MAX_BYTES) {\n throw new Error(`Policy manifest exceeds ${PEAC_POLICY_MAX_BYTES} bytes (got ${bytes})`);\n }\n\n let manifest: Record<string, unknown>;\n\n if (isJsonContent(text, contentType)) {\n // Parse as JSON\n try {\n manifest = JSON.parse(text);\n } catch (err) {\n throw new Error('Policy manifest is not valid JSON', { cause: err });\n }\n } else {\n // Parse as simple YAML (key: value format)\n manifest = parseSimpleYaml(text);\n }\n\n // Validate required fields\n if (typeof manifest.version !== 'string' || !manifest.version) {\n throw new Error('Missing required field: version');\n }\n\n // Validate version format: must be peac-policy/<major>.<minor>\n if (!manifest.version.startsWith('peac-policy/')) {\n throw new Error(\n `Invalid version format: \"${manifest.version}\". Must start with \"peac-policy/\" (e.g., \"peac-policy/0.1\")`\n );\n }\n\n if (manifest.usage !== 'open' && manifest.usage !== 'conditional') {\n throw new Error('Missing or invalid field: usage (must be \"open\" or \"conditional\")');\n }\n\n return {\n version: manifest.version,\n usage: manifest.usage as 'open' | 'conditional',\n purposes: manifest.purposes as string[] | undefined,\n receipts: manifest.receipts as 'required' | 'optional' | 'omit' | undefined,\n attribution: manifest.attribution as 'required' | 'optional' | 'none' | undefined,\n rate_limit: manifest.rate_limit as string | undefined,\n daily_limit: manifest.daily_limit as number | undefined,\n negotiate: manifest.negotiate as string | undefined,\n contact: manifest.contact as string | undefined,\n license: manifest.license as string | undefined,\n price: manifest.price as number | undefined,\n currency: manifest.currency as string | undefined,\n payment_methods: manifest.payment_methods as string[] | undefined,\n payment_endpoint: manifest.payment_endpoint as string | undefined,\n };\n}\n\n/**\n * Parse simple YAML (key: value format, no complex features)\n * Rejects YAML features that are security risks (anchors, aliases, tags)\n */\nfunction parseSimpleYaml(text: string): Record<string, unknown> {\n const lines = text.split('\\n');\n const result: Record<string, unknown> = {};\n\n // Security: reject YAML features that are dangerous\n // Check merge keys first (they contain * which would trigger anchor check)\n if (text.includes('<<:')) {\n throw new Error('YAML merge keys are not allowed');\n }\n if (text.includes('&') || text.includes('*')) {\n throw new Error('YAML anchors and aliases are not allowed');\n }\n if (/!\\w+/.test(text)) {\n throw new Error('YAML custom tags are not allowed');\n }\n\n // Count document separators\n const docSeparators = text.match(/^---$/gm);\n if (docSeparators && docSeparators.length > 1) {\n throw new Error('Multi-document YAML is not allowed');\n }\n\n for (const line of lines) {\n const trimmed = line.trim();\n\n // Skip empty lines, comments, and document markers\n if (!trimmed || trimmed.startsWith('#') || trimmed === '---') {\n continue;\n }\n\n // Parse key: value\n const colonIndex = trimmed.indexOf(':');\n if (colonIndex === -1) continue;\n\n const key = trimmed.slice(0, colonIndex).trim();\n let value: unknown = trimmed.slice(colonIndex + 1).trim();\n\n // Parse value types\n if (value === '') {\n value = undefined;\n } else if (typeof value === 'string') {\n // Remove quotes if present\n if (\n (value.startsWith('\"') && value.endsWith('\"')) ||\n (value.startsWith(\"'\") && value.endsWith(\"'\"))\n ) {\n value = value.slice(1, -1);\n }\n // Parse arrays [a, b, c]\n else if (value.startsWith('[') && value.endsWith(']')) {\n const inner = value.slice(1, -1);\n value = inner\n .split(',')\n .map((s) => s.trim())\n .filter((s) => s.length > 0);\n }\n // Parse numbers\n else if (/^-?\\d+(\\.\\d+)?$/.test(value)) {\n value = parseFloat(value);\n }\n // Parse booleans\n else if (value === 'true') {\n value = true;\n } else if (value === 'false') {\n value = false;\n }\n }\n\n if (value !== undefined) {\n result[key] = value;\n }\n }\n\n return result;\n}\n\n/**\n * Fetch PEAC policy manifest from a domain\n *\n * @param baseUrl - Base URL (https://example.com)\n * @returns Parsed policy manifest\n * @throws Error if fetch or validation fails\n */\nexport async function fetchPolicyManifest(baseUrl: string): Promise<PEACPolicyManifest> {\n if (!baseUrl.startsWith('https://') && !baseUrl.startsWith('http://localhost')) {\n throw new Error('Base URL must be https://');\n }\n\n const normalizedBase = baseUrl.replace(/\\/$/, '');\n const primaryUrl = `${normalizedBase}${PEAC_POLICY_PATH}`;\n const fallbackUrl = `${normalizedBase}${PEAC_POLICY_FALLBACK_PATH}`;\n\n // Try primary location first\n try {\n const resp = await fetch(primaryUrl, {\n headers: { Accept: 'text/plain, application/json' },\n signal: AbortSignal.timeout(5000),\n });\n\n if (resp.ok) {\n const text = await resp.text();\n const contentType = resp.headers.get('content-type') || undefined;\n return parsePolicyManifest(text, contentType);\n }\n\n // If 404, try fallback\n if (resp.status === 404) {\n const fallbackResp = await fetch(fallbackUrl, {\n headers: { Accept: 'text/plain, application/json' },\n signal: AbortSignal.timeout(5000),\n });\n\n if (fallbackResp.ok) {\n const text = await fallbackResp.text();\n const contentType = fallbackResp.headers.get('content-type') || undefined;\n return parsePolicyManifest(text, contentType);\n }\n\n throw new Error('Policy manifest not found at primary or fallback location');\n }\n\n throw new Error(`Policy manifest fetch failed: ${resp.status}`);\n } catch (err) {\n throw new Error(\n `Failed to fetch policy manifest from ${baseUrl}: ${\n err instanceof Error ? err.message : String(err)\n }`,\n { cause: err }\n );\n }\n}\n\n// ============================================================================\n// Deprecated Legacy API (for backward compatibility)\n// ============================================================================\n\n/**\n * @deprecated Parses a legacy dual-purpose `peac.txt` manifest that carried\n * both policy hints and key-discovery fields (`verify`, `jwks`). This shape\n * is retired: `peac.txt` is a policy-document surface per\n * `docs/specs/PEAC-TXT.md`, and the normative key-discovery chain is\n * `iss` -> /.well-known/peac-issuer.json -> `jwks_uri` -> JWKS\n * (see `docs/specs/PEAC-ISSUER.md`). Use `parseIssuerConfig` for issuer\n * metadata, and `@peac/policy-kit.parsePolicyDocument` for `peac-policy/0.1`\n * documents referenced from `peac.txt`. Removal target: next cleanup release.\n *\n * Parse a PEAC discovery manifest from YAML-like text. Retained only for\n * backward compatibility with callers that have not yet migrated.\n */\nexport function parseDiscovery(text: string): PEACDiscovery {\n const bytes = new TextEncoder().encode(text).length;\n if (bytes > 2000) {\n throw new Error(`Discovery manifest exceeds 2000 bytes (got ${bytes})`);\n }\n\n const lines = text.trim().split('\\n');\n if (lines.length > 20) {\n throw new Error(`Discovery manifest exceeds 20 lines (got ${lines.length})`);\n }\n\n const discovery: Partial<PEACIssuerConfig> = {};\n\n for (const line of lines) {\n const trimmed = line.trim();\n if (!trimmed || trimmed.startsWith('#')) {\n continue;\n }\n\n if (trimmed.includes(':')) {\n const [key, ...valueParts] = trimmed.split(':');\n const value = valueParts.join(':').trim();\n\n switch (key.trim()) {\n case 'version':\n discovery.version = value;\n break;\n case 'issuer':\n discovery.issuer = value;\n break;\n case 'verify':\n discovery.verify_endpoint = value;\n break;\n case 'jwks':\n discovery.jwks_uri = value;\n break;\n case 'security':\n discovery.security_contact = value;\n break;\n }\n }\n }\n\n // Validate required fields\n if (!discovery.version) throw new Error('Missing required field: version');\n if (!discovery.issuer) throw new Error('Missing required field: issuer');\n if (!discovery.verify_endpoint) throw new Error('Missing required field: verify');\n if (!discovery.jwks_uri) throw new Error('Missing required field: jwks');\n\n return discovery as PEACDiscovery;\n}\n\n/**\n * @deprecated Fetches /.well-known/peac.txt and parses it as a legacy\n * dual-purpose manifest. This shape is retired: `peac.txt` is a policy\n * document (see `docs/specs/PEAC-TXT.md`) and key discovery flows through\n * `iss` -> /.well-known/peac-issuer.json -> `jwks_uri` -> JWKS\n * (see `docs/specs/PEAC-ISSUER.md`). Use `fetchIssuerConfig` for issuer\n * metadata. To parse the `peac-policy/0.1` document referenced from\n * `peac.txt`, fetch its bytes and call\n * `@peac/policy-kit.parsePolicyDocument`. Removal target: next cleanup\n * release.\n *\n * Fetch and parse PEAC discovery from an issuer URL. Retained only for\n * backward compatibility with callers that have not yet migrated.\n */\nexport async function fetchDiscovery(issuerUrl: string): Promise<PEACDiscovery> {\n if (!issuerUrl.startsWith('https://')) {\n throw new Error('Issuer URL must be https://');\n }\n\n const discoveryUrl = `${issuerUrl}/.well-known/peac.txt`;\n\n try {\n const resp = await fetch(discoveryUrl, {\n headers: { Accept: 'text/plain' },\n signal: AbortSignal.timeout(5000),\n });\n\n if (!resp.ok) {\n throw new Error(`Discovery fetch failed: ${resp.status}`);\n }\n\n const text = await resp.text();\n return parseDiscovery(text);\n } catch (err) {\n throw new Error(\n `Failed to fetch discovery from ${issuerUrl}: ${\n err instanceof Error ? err.message : String(err)\n }`,\n { cause: err }\n );\n }\n}\n","/**\n * Address policy for outbound key and pointer fetches.\n *\n * An address is allowed only when it is a global unicast address outside every\n * block in the IANA IPv4 and IPv6 Special-Purpose Address Registries (RFC 6890\n * and updates). IPv4-mapped IPv6 addresses (::ffff:0:0/96) and NAT64\n * well-known prefix addresses (64:ff9b::/96) are judged by the embedded IPv4\n * address. Anything that does not parse as an address is refused.\n *\n * Pure function: no I/O, runtime-neutral.\n */\n\nexport type AddressBlockReason = 'private_ip' | 'loopback' | 'link_local';\n\nexport type AddressVerdict = { allowed: true } | { allowed: false; reason: AddressBlockReason };\n\nconst IPV4_OCTET = /^(?:0|[1-9]\\d{0,2})$/;\nconst IPV6_GROUP = /^[0-9a-fA-F]{1,4}$/;\n\n/**\n * Parse a dotted-quad IPv4 address into a 32-bit unsigned integer.\n * Leading zeros and non-decimal forms are refused.\n */\nfunction parseIPv4(text: string): number | null {\n const parts = text.split('.');\n if (parts.length !== 4) return null;\n let value = 0;\n for (const part of parts) {\n if (!IPV4_OCTET.test(part)) return null;\n const octet = Number(part);\n if (octet > 255) return null;\n value = value * 256 + octet;\n }\n return value;\n}\n\nfunction parseGroups(text: string): number[] | null {\n if (text === '') return [];\n const groups: number[] = [];\n for (const group of text.split(':')) {\n if (!IPV6_GROUP.test(group)) return null;\n groups.push(parseInt(group, 16));\n }\n return groups;\n}\n\n/**\n * Parse an IPv6 address into eight 16-bit groups. Accepts one `::` and a\n * trailing dotted IPv4 part. Zone identifiers and brackets are refused.\n */\nfunction parseIPv6(text: string): number[] | null {\n if (text.length === 0 || text.length > 45) return null;\n let body = text;\n const lastColon = body.lastIndexOf(':');\n if (lastColon === -1) return null;\n const last = body.slice(lastColon + 1);\n if (last.includes('.')) {\n const v4 = parseIPv4(last);\n if (v4 === null) return null;\n body = `${body.slice(0, lastColon + 1)}${Math.floor(v4 / 0x10000).toString(16)}:${(v4 % 0x10000).toString(16)}`;\n }\n const halves = body.split('::');\n if (halves.length > 2) return null;\n const head = parseGroups(halves[0]);\n if (head === null) return null;\n if (halves.length === 1) return head.length === 8 ? head : null;\n const tail = parseGroups(halves[1]);\n if (tail === null) return null;\n const fill = 8 - head.length - tail.length;\n if (fill < 1) return null;\n return [...head, ...new Array<number>(fill).fill(0), ...tail];\n}\n\ntype IPv4Block = readonly [network: string, prefix: number, reason: AddressBlockReason];\n\n// IANA IPv4 Special-Purpose Address Registry, plus multicast and the reserved block.\nconst IPV4_BLOCKS: readonly IPv4Block[] = [\n ['0.0.0.0', 8, 'private_ip'],\n ['10.0.0.0', 8, 'private_ip'],\n ['100.64.0.0', 10, 'private_ip'],\n ['127.0.0.0', 8, 'loopback'],\n ['169.254.0.0', 16, 'link_local'],\n ['172.16.0.0', 12, 'private_ip'],\n ['192.0.0.0', 24, 'private_ip'],\n ['192.0.2.0', 24, 'private_ip'],\n ['192.31.196.0', 24, 'private_ip'],\n ['192.52.193.0', 24, 'private_ip'],\n ['192.88.99.0', 24, 'private_ip'],\n ['192.168.0.0', 16, 'private_ip'],\n ['192.175.48.0', 24, 'private_ip'],\n ['198.18.0.0', 15, 'private_ip'],\n ['198.51.100.0', 24, 'private_ip'],\n ['203.0.113.0', 24, 'private_ip'],\n ['224.0.0.0', 4, 'private_ip'],\n ['240.0.0.0', 4, 'private_ip'],\n];\n\nconst IPV4_BLOCK_TABLE = IPV4_BLOCKS.map(([network, prefix, reason]) => {\n const base = parseIPv4(network) as number;\n const size = 2 ** (32 - prefix);\n return { start: base, end: base + size - 1, reason };\n});\n\nfunction classifyIPv4(value: number): AddressVerdict {\n for (const block of IPV4_BLOCK_TABLE) {\n if (value >= block.start && value <= block.end) {\n return { allowed: false, reason: block.reason };\n }\n }\n return { allowed: true };\n}\n\nfunction matchesPrefix(\n groups: readonly number[],\n network: readonly number[],\n bits: number\n): boolean {\n for (let i = 0; i < 8; i++) {\n const bitsHere = Math.min(16, Math.max(0, bits - 16 * i));\n if (bitsHere === 0) return true;\n const mask = (0xffff << (16 - bitsHere)) & 0xffff;\n if ((groups[i] & mask) !== (network[i] & mask)) return false;\n }\n return true;\n}\n\nfunction v6(text: string): number[] {\n return parseIPv6(text) as number[];\n}\n\nconst GLOBAL_UNICAST_V6 = v6('2000::');\n\n// Special-purpose blocks inside 2000::/3 (IANA IPv6 Special-Purpose Address Registry).\nconst IPV6_BLOCKS_IN_GLOBAL: ReadonlyArray<readonly [number[], number]> = [\n [v6('2001::'), 23],\n [v6('2001:db8::'), 32],\n [v6('2002::'), 16],\n [v6('2620:4f:8000::'), 48],\n [v6('3fff::'), 20],\n];\n\nconst IPV6_LOOPBACK = v6('::1');\nconst IPV6_LINK_LOCAL = v6('fe80::');\nconst IPV4_MAPPED = v6('::ffff:0:0');\nconst NAT64_WELL_KNOWN = v6('64:ff9b::');\n\nfunction classifyIPv6(groups: readonly number[]): AddressVerdict {\n if (matchesPrefix(groups, IPV4_MAPPED, 96) || matchesPrefix(groups, NAT64_WELL_KNOWN, 96)) {\n return classifyIPv4(groups[6] * 0x10000 + groups[7]);\n }\n if (!matchesPrefix(groups, GLOBAL_UNICAST_V6, 3)) {\n if (matchesPrefix(groups, IPV6_LOOPBACK, 128)) return { allowed: false, reason: 'loopback' };\n if (matchesPrefix(groups, IPV6_LINK_LOCAL, 10)) return { allowed: false, reason: 'link_local' };\n return { allowed: false, reason: 'private_ip' };\n }\n for (const [network, bits] of IPV6_BLOCKS_IN_GLOBAL) {\n if (matchesPrefix(groups, network, bits)) return { allowed: false, reason: 'private_ip' };\n }\n return { allowed: true };\n}\n\n/**\n * Classify an IP address string against the address policy.\n */\nexport function classifyAddress(ip: string): AddressVerdict {\n const v4 = parseIPv4(ip);\n if (v4 !== null) return classifyIPv4(v4);\n const groups = parseIPv6(ip);\n if (groups !== null) return classifyIPv6(groups);\n return { allowed: false, reason: 'private_ip' };\n}\n\n/**\n * Return the IP literal carried by a URL hostname (brackets removed), or null\n * for a domain name. WHATWG URL parsing has already normalised IPv4 forms.\n */\nexport function hostIpLiteral(hostname: string): string | null {\n if (hostname.startsWith('[') && hostname.endsWith(']')) return hostname.slice(1, -1);\n if (/^[0-9.]+$/.test(hostname)) return hostname;\n return null;\n}\n","/**\n * SSRF-safe fetch utility for PEAC verifiers\n *\n * Implements SSRF protection per VERIFIER-SECURITY-MODEL.md:\n * - HTTPS only\n * - Allow only global unicast addresses: every block in the IANA IPv4 and IPv6\n * special-purpose registries is refused, including private, loopback,\n * link-local, shared, multicast and reserved ranges; IPv4-mapped and NAT64\n * forms are judged by the embedded IPv4 address\n * - Fail closed when DNS returns no addresses\n * - Connect only to the vetted addresses (no second resolution)\n * - Redirect limits and scheme downgrade protection\n *\n * ## Security Model: Best-Effort Protection\n *\n * **IMPORTANT**: SSRF protection is BEST-EFFORT, not a guarantee. The level of\n * protection depends on the runtime environment's capabilities. In environments\n * without DNS pre-resolution (browsers, edge workers), protection is limited to\n * URL scheme validation and response limits. Defense-in-depth: combine with\n * network-level controls (firewalls, egress filtering) in production.\n *\n * ## Hard Invariants (ALWAYS Enforced)\n *\n * These protections are enforced in ALL runtimes:\n *\n * | Invariant | Enforcement |\n * |-----------|-------------|\n * | HTTPS only | URL scheme validation before fetch |\n * | No redirects (pointer fetch) | `redirect: 'manual'` + policy check |\n * | Response size cap | Streaming with byte counter, abort on limit |\n * | Timeout | AbortController with configurable timeout |\n * | No scheme downgrade | Redirect target scheme validation |\n *\n * ## Runtime-Dependent Protections\n *\n * These protections require DNS pre-resolution capability:\n *\n * | Protection | Requires |\n * |------------|----------|\n * | Special-purpose address blocking (global unicast only) | DNS pre-resolution |\n * | Connection to the vetted address only | DNS pre-resolution + `https` module |\n *\n * ## Runtime Capability Model\n *\n * SSRF protection capabilities vary by runtime environment:\n *\n * | Runtime | DNS Pre-Resolution | IP Blocking | Notes |\n * |-------------------|-------------------|-------------|-------|\n * | Node.js | YES | YES | Resolve once, vet, connect to the vetted address |\n * | Browser | NO | NO | Relies on server-side validation |\n * | Cloudflare Workers| NO | NO | No DNS access, relies on CF network |\n * | Deno | NO | NO | dns module not available by default |\n * | Bun | YES | YES | Compatible with Node.js dns module |\n *\n * Use `getSSRFCapabilities()` to detect runtime capabilities.\n *\n * @packageDocumentation\n */\n\nimport type { LookupAddress, LookupOptions } from 'dns';\nimport { VERIFIER_LIMITS, VERIFIER_NETWORK } from '@peac/kernel';\nimport { classifyAddress, hostIpLiteral } from './_internal/address-policy.js';\n\n// ---------------------------------------------------------------------------\n// SSRF Capability Model\n// ---------------------------------------------------------------------------\n\n/**\n * Runtime environment where SSRF protection is running\n */\nexport type SSRFRuntime =\n | 'node'\n | 'bun'\n | 'deno'\n | 'browser'\n | 'cloudflare-workers'\n | 'edge-generic'\n | 'unknown';\n\n/**\n * SSRF protection capabilities available in the current runtime\n *\n * These capabilities determine what security measures can be applied:\n * - `dnsPreResolution`: Can resolve hostnames to IPs before connecting\n * - `ipBlocking`: Can inspect and block connections based on resolved IPs\n * - `networkIsolation`: Runtime provides network-level isolation (e.g., CF Workers)\n *\n * When `dnsPreResolution` is false, SSRF protection is limited to:\n * - URL scheme validation (HTTPS only)\n * - Hostname pattern matching (if configured)\n * - Response size limits\n * - Timeout enforcement\n *\n * This is a defense-in-depth model: even without DNS pre-resolution,\n * multiple layers of protection remain active.\n */\nexport interface SSRFCapabilities {\n /** Detected runtime environment */\n runtime: SSRFRuntime;\n /** Can resolve DNS before making HTTP connection */\n dnsPreResolution: boolean;\n /** Can block connections based on resolved IP addresses */\n ipBlocking: boolean;\n /** Runtime provides network-level isolation */\n networkIsolation: boolean;\n /** Human-readable description of protection level */\n protectionLevel: 'full' | 'partial' | 'minimal';\n /** Advisory notes for operators */\n notes: string[];\n}\n\n/**\n * Cached capabilities (detected once per process)\n */\nlet cachedCapabilities: SSRFCapabilities | null = null;\n\n/**\n * Detect SSRF protection capabilities for the current runtime\n *\n * This function performs runtime detection and returns a capability object\n * that describes what SSRF protections are available.\n *\n * @returns SSRF capabilities for the current runtime\n *\n * @example\n * ```typescript\n * const caps = getSSRFCapabilities();\n * if (!caps.dnsPreResolution) {\n * console.warn('Running without DNS pre-resolution; SSRF protection is limited');\n * }\n * ```\n */\nexport function getSSRFCapabilities(): SSRFCapabilities {\n if (cachedCapabilities) {\n return cachedCapabilities;\n }\n\n cachedCapabilities = detectCapabilities();\n return cachedCapabilities;\n}\n\n/**\n * Internal: Detect runtime capabilities\n */\nfunction detectCapabilities(): SSRFCapabilities {\n // Check for Node.js\n if (typeof process !== 'undefined' && process.versions?.node) {\n return {\n runtime: 'node',\n dnsPreResolution: true,\n ipBlocking: true,\n networkIsolation: false,\n protectionLevel: 'full',\n notes: [\n 'Hostnames are resolved once via the Node.js dns module',\n 'Every resolved address must be a global unicast address',\n 'The connection is made only to a vetted address',\n ],\n };\n }\n\n // Check for Bun\n if (typeof process !== 'undefined' && process.versions?.bun) {\n return {\n runtime: 'bun',\n dnsPreResolution: true,\n ipBlocking: true,\n networkIsolation: false,\n protectionLevel: 'full',\n notes: [\n 'Full SSRF protection available via Bun dns compatibility',\n 'DNS resolution checked before HTTP connection',\n ],\n };\n }\n\n // Check for Deno\n if (typeof globalThis !== 'undefined' && 'Deno' in globalThis) {\n return {\n runtime: 'deno',\n dnsPreResolution: false,\n ipBlocking: false,\n networkIsolation: false,\n protectionLevel: 'partial',\n notes: [\n 'DNS pre-resolution not available in Deno by default',\n 'SSRF protection limited to URL validation and response limits',\n 'Consider using Deno.connect with hostname resolution for enhanced protection',\n ],\n };\n }\n\n // Check for Cloudflare Workers\n if (\n typeof globalThis !== 'undefined' &&\n typeof (globalThis as Record<string, unknown>).caches !== 'undefined' &&\n typeof (globalThis as Record<string, unknown>).HTMLRewriter !== 'undefined'\n ) {\n return {\n runtime: 'cloudflare-workers',\n dnsPreResolution: false,\n ipBlocking: false,\n networkIsolation: true,\n protectionLevel: 'partial',\n notes: [\n 'Cloudflare Workers provide network-level isolation',\n 'DNS pre-resolution not available in Workers runtime',\n 'CF network blocks many SSRF vectors at infrastructure level',\n 'SSRF protection supplemented by URL validation and response limits',\n ],\n };\n }\n\n // Check for browser environment\n // Use globalThis to avoid DOM type references\n const g = globalThis as Record<string, unknown>;\n if (typeof g.window !== 'undefined' || typeof g.document !== 'undefined') {\n return {\n runtime: 'browser',\n dnsPreResolution: false,\n ipBlocking: false,\n networkIsolation: false,\n protectionLevel: 'minimal',\n notes: [\n 'Browser environment detected; DNS pre-resolution not available',\n 'SSRF protection limited to URL scheme validation',\n 'Consider validating URLs server-side before browser fetch',\n 'Same-origin policy provides some protection against SSRF',\n ],\n };\n }\n\n // Generic edge runtime\n return {\n runtime: 'edge-generic',\n dnsPreResolution: false,\n ipBlocking: false,\n networkIsolation: false,\n protectionLevel: 'partial',\n notes: [\n 'Edge runtime detected; DNS pre-resolution may not be available',\n 'SSRF protection limited to URL validation and response limits',\n 'Verify runtime provides additional network-level protections',\n ],\n };\n}\n\n/**\n * Reset cached capabilities (for testing)\n * @internal\n */\nexport function resetSSRFCapabilitiesCache(): void {\n cachedCapabilities = null;\n}\n\n/**\n * SSRF fetch options\n */\nexport interface SSRFFetchOptions {\n /** Timeout in milliseconds (default: VERIFIER_LIMITS.fetchTimeoutMs) */\n timeoutMs?: number;\n /** Maximum response size in bytes (default: VERIFIER_LIMITS.maxResponseBytes) */\n maxBytes?: number;\n /** Maximum redirects to follow (default: 0 for SSRF safety) */\n maxRedirects?: number;\n /** Allow redirects (default: VERIFIER_NETWORK.allowRedirects) */\n allowRedirects?: boolean;\n /**\n * Allow cross-origin redirects (default: true for CDN compatibility).\n * When true, redirects to different origins are allowed if the target passes SSRF checks.\n * When false, redirects must stay within the same origin.\n */\n allowCrossOriginRedirects?: boolean;\n /**\n * How to handle DNS resolution failures (default: 'block' for fail-closed security).\n * - 'block': Treat DNS failure as blocked (fail-closed, recommended)\n * - 'fail': Return network_error and allow caller to decide\n */\n dnsFailureBehavior?: 'block' | 'fail';\n /** Custom headers to include */\n headers?: Record<string, string>;\n}\n\n/**\n * SSRF fetch result\n */\nexport interface SSRFFetchResult {\n /** Whether the fetch succeeded */\n ok: true;\n /** Response status code */\n status: number;\n /** Response body as string */\n body: string;\n /**\n * Raw response bytes for digest computation.\n * Use this for computing digests to avoid encoding round-trip issues.\n */\n rawBytes: Uint8Array;\n /** Response content type */\n contentType?: string;\n}\n\n/**\n * SSRF fetch error\n */\nexport interface SSRFFetchError {\n /** Fetch failed */\n ok: false;\n /** Error reason code */\n reason:\n | 'invalid_url'\n | 'not_https'\n | 'private_ip'\n | 'loopback'\n | 'link_local'\n | 'dns_failure'\n | 'too_many_redirects'\n | 'scheme_downgrade'\n | 'cross_origin_redirect'\n | 'timeout'\n | 'response_too_large'\n | 'jwks_too_many_keys'\n | 'network_error';\n /** Human-readable error message */\n message: string;\n /** Blocked URL (if applicable) */\n blockedUrl?: string;\n}\n\n/**\n * Check if an IP address is outside the allowed address space.\n *\n * Only global unicast addresses outside the IANA IPv4 and IPv6 special-purpose\n * blocks are allowed. IPv4-mapped and NAT64 (64:ff9b::/96) IPv6 addresses are\n * judged by the embedded IPv4 address; input that does not parse as an address\n * is blocked.\n */\nexport function isBlockedIP(\n ip: string\n): { blocked: true; reason: 'private_ip' | 'loopback' | 'link_local' } | { blocked: false } {\n const verdict = classifyAddress(ip);\n return verdict.allowed ? { blocked: false } : { blocked: true, reason: verdict.reason };\n}\n\n/**\n * DNS resolution result\n */\ninterface DNSResolutionResult {\n /** Whether resolution succeeded */\n ok: true;\n /** Resolved IP addresses */\n ips: string[];\n /** Whether this is a browser environment (no pre-resolution possible) */\n browser: boolean;\n}\n\n/**\n * DNS resolution failure\n */\ninterface DNSResolutionFailure {\n /** Resolution failed */\n ok: false;\n /** Error message */\n message: string;\n}\n\n/**\n * Resolve hostname to IP addresses (platform-specific)\n *\n * In Node.js environments, this uses dns.resolve.\n * In browser environments, we cannot check IPs before fetch.\n */\nasync function resolveHostname(\n hostname: string\n): Promise<DNSResolutionResult | DNSResolutionFailure> {\n // An IP literal is vetted as-is and never sent to DNS\n const literal = hostIpLiteral(hostname);\n if (literal !== null) {\n const nodeRuntime = typeof process !== 'undefined' && Boolean(process.versions?.node);\n return { ok: true, ips: [literal], browser: !nodeRuntime };\n }\n\n // Node.js environment detection\n if (typeof process !== 'undefined' && process.versions?.node) {\n try {\n const dns = await import('dns');\n const { promisify } = await import('util');\n const resolve4 = promisify(dns.resolve4);\n const resolve6 = promisify(dns.resolve6);\n\n const results: string[] = [];\n let ipv4Error: Error | null = null;\n let ipv6Error: Error | null = null;\n\n try {\n const ipv4 = await resolve4(hostname);\n results.push(...ipv4);\n } catch (err) {\n ipv4Error = err as Error;\n }\n\n try {\n const ipv6 = await resolve6(hostname);\n results.push(...ipv6);\n } catch (err) {\n ipv6Error = err as Error;\n }\n\n // If we got at least one result, resolution succeeded\n if (results.length > 0) {\n return { ok: true, ips: results, browser: false };\n }\n\n // Both failed - this is a DNS failure\n if (ipv4Error && ipv6Error) {\n return {\n ok: false,\n message: `DNS resolution failed for ${hostname}: ${ipv4Error.message}`,\n };\n }\n\n // An empty answer leaves nothing to vet: fail closed\n return {\n ok: false,\n message: `DNS resolution returned no addresses for ${hostname}`,\n };\n } catch (err) {\n // DNS module import failed or other error\n return {\n ok: false,\n message: `DNS resolution error: ${err instanceof Error ? err.message : String(err)}`,\n };\n }\n }\n\n // Browser environment: cannot pre-resolve, return empty\n // SSRF check will rely on server-side validation\n return { ok: true, ips: [], browser: true };\n}\n\nconst NULL_BODY_STATUSES = new Set([101, 103, 204, 205, 304]);\n\n// Cancelling an unlocked body does not reject; any error propagates to the caller.\nasync function discardBody(response: Response): Promise<void> {\n await response.body?.cancel();\n}\n\n/**\n * GET a URL over HTTPS, connecting only to the given vetted addresses.\n *\n * The hostname is never resolved again: the socket lookup returns the vetted\n * addresses, while the URL host is still used for the Host header, TLS SNI and\n * certificate verification. Redirects are not followed.\n */\nasync function fetchFromVettedAddresses(\n url: string,\n addresses: readonly string[],\n headers: Record<string, string>,\n signal: AbortSignal\n): Promise<Response> {\n const https = await import('https');\n const { isIP } = await import('net');\n const target = new URL(url);\n const host = hostIpLiteral(target.hostname) ?? target.hostname;\n if (addresses.length === 0 || (isIP(host) !== 0 && !addresses.includes(host))) {\n throw new Error(`Refusing to connect to an address that was not vetted: ${host}`);\n }\n const entries: LookupAddress[] = addresses.map((address) => ({\n address,\n family: address.includes(':') ? 6 : 4,\n }));\n\n const lookup = (\n _hostname: string,\n options: LookupOptions,\n callback: (\n err: NodeJS.ErrnoException | null,\n address: string | LookupAddress[],\n family?: number\n ) => void\n ): void => {\n if (options.all) {\n callback(null, entries);\n } else {\n callback(null, entries[0].address, entries[0].family);\n }\n };\n\n return new Promise<Response>((resolve, reject) => {\n const req = https.request(\n target,\n { method: 'GET', headers, lookup, agent: false, signal },\n (res) => {\n try {\n const status = res.statusCode ?? 0;\n const responseHeaders = new Headers();\n for (const [name, value] of Object.entries(res.headers)) {\n if (value === undefined) continue;\n if (Array.isArray(value)) {\n for (const item of value) responseHeaders.append(name, item);\n } else {\n responseHeaders.set(name, value);\n }\n }\n\n if (NULL_BODY_STATUSES.has(status)) {\n res.resume();\n resolve(new Response(null, { status, headers: responseHeaders }));\n return;\n }\n\n let settled = false;\n const body = new ReadableStream<Uint8Array>({\n start(controller) {\n res.on('data', (chunk: Buffer) => {\n if (settled) return;\n controller.enqueue(new Uint8Array(chunk));\n if ((controller.desiredSize ?? 0) <= 0) res.pause();\n });\n res.on('end', () => {\n if (settled) return;\n settled = true;\n controller.close();\n });\n res.on('error', (err) => {\n if (settled) return;\n settled = true;\n controller.error(err);\n });\n },\n pull() {\n res.resume();\n },\n cancel() {\n settled = true;\n res.destroy();\n },\n });\n resolve(new Response(body, { status, headers: responseHeaders }));\n } catch (err) {\n res.destroy();\n reject(err);\n }\n }\n );\n req.on('error', reject);\n req.end();\n });\n}\n\n/**\n * Perform an SSRF-safe fetch\n *\n * This function implements the SSRF protection algorithm from VERIFIER-SECURITY-MODEL.md:\n * 1. Parse URL; reject if not https://\n * 2. Resolve hostname to IP(s); an empty answer is a failure\n * 3. For each IP: reject unless it is a global unicast address\n * 4. Perform the request with timeout, connecting only to the vetted IPs\n * 5. On redirect: increment counter, reject if > max, apply checks to redirect URL\n * 6. Validate response size\n *\n * @param url - URL to fetch (must be https://)\n * @param options - Fetch options\n * @returns Fetch result or error\n */\nexport async function ssrfSafeFetch(\n url: string,\n options: SSRFFetchOptions = {}\n): Promise<SSRFFetchResult | SSRFFetchError> {\n const {\n timeoutMs = VERIFIER_LIMITS.fetchTimeoutMs,\n maxBytes = VERIFIER_LIMITS.maxResponseBytes,\n maxRedirects = 0,\n allowRedirects = VERIFIER_NETWORK.allowRedirects,\n allowCrossOriginRedirects = true, // Default: allow for CDN compatibility\n dnsFailureBehavior = 'block', // Default: fail-closed for security\n headers = {},\n } = options;\n\n // Step 1: Parse and validate URL\n let parsedUrl: URL;\n try {\n parsedUrl = new URL(url);\n } catch {\n return {\n ok: false,\n reason: 'invalid_url',\n message: `Invalid URL: ${url}`,\n blockedUrl: url,\n };\n }\n\n // Step 1b: Require HTTPS\n if (parsedUrl.protocol !== 'https:') {\n return {\n ok: false,\n reason: 'not_https',\n message: `URL must use HTTPS: ${url}`,\n blockedUrl: url,\n };\n }\n\n // Step 2: Resolve hostname to IPs\n const dnsResult = await resolveHostname(parsedUrl.hostname);\n\n // Step 2b: Handle DNS resolution failure (fail-closed by default)\n if (!dnsResult.ok) {\n if (dnsFailureBehavior === 'block') {\n return {\n ok: false,\n reason: 'dns_failure',\n message: `DNS resolution blocked: ${dnsResult.message}`,\n blockedUrl: url,\n };\n }\n // dnsFailureBehavior === 'fail': return network_error\n return {\n ok: false,\n reason: 'network_error',\n message: dnsResult.message,\n blockedUrl: url,\n };\n }\n\n // Step 3: Check each resolved IP (browsers resolve names themselves, so only literals are listed)\n for (const ip of dnsResult.ips) {\n const blockResult = isBlockedIP(ip);\n if (blockResult.blocked) {\n return {\n ok: false,\n reason: blockResult.reason,\n message: `Blocked ${blockResult.reason} address: ${ip} for ${url}`,\n blockedUrl: url,\n };\n }\n }\n\n // Step 4: Perform fetch with timeout, connecting only to vetted addresses\n let redirectCount = 0;\n let currentUrl = url;\n let vettedAddresses: readonly string[] | null = dnsResult.browser ? null : dnsResult.ips;\n const originalOrigin = parsedUrl.origin;\n\n while (true) {\n try {\n const controller = new AbortController();\n const timeoutId = setTimeout(() => controller.abort(), timeoutMs);\n\n const requestHeaders = {\n Accept: 'application/json, text/plain',\n ...headers,\n };\n const response =\n vettedAddresses === null\n ? await fetch(currentUrl, {\n headers: requestHeaders,\n signal: controller.signal,\n redirect: 'manual', // Handle redirects manually for security\n })\n : await fetchFromVettedAddresses(\n currentUrl,\n vettedAddresses,\n requestHeaders,\n controller.signal\n );\n\n clearTimeout(timeoutId);\n\n // Step 5: Handle redirects\n if (response.status >= 300 && response.status < 400) {\n const location = response.headers.get('location');\n await discardBody(response);\n\n if (!location) {\n return {\n ok: false,\n reason: 'network_error',\n message: `Redirect without Location header from ${currentUrl}`,\n };\n }\n\n // Check redirect policy\n if (!allowRedirects) {\n return {\n ok: false,\n reason: 'too_many_redirects',\n message: `Redirects not allowed: ${currentUrl} -> ${location}`,\n blockedUrl: location,\n };\n }\n\n // Increment redirect counter\n redirectCount++;\n if (redirectCount > maxRedirects) {\n return {\n ok: false,\n reason: 'too_many_redirects',\n message: `Too many redirects (${redirectCount} > ${maxRedirects})`,\n blockedUrl: location,\n };\n }\n\n // Resolve redirect URL\n let redirectUrl: URL;\n try {\n redirectUrl = new URL(location, currentUrl);\n } catch {\n return {\n ok: false,\n reason: 'invalid_url',\n message: `Invalid redirect URL: ${location}`,\n blockedUrl: location,\n };\n }\n\n // Check for scheme downgrade (https -> http)\n if (redirectUrl.protocol !== 'https:') {\n return {\n ok: false,\n reason: 'scheme_downgrade',\n message: `HTTPS to HTTP downgrade not allowed: ${currentUrl} -> ${redirectUrl.href}`,\n blockedUrl: redirectUrl.href,\n };\n }\n\n // Check for cross-origin redirects (configurable for CDN compatibility)\n if (redirectUrl.origin !== originalOrigin && !allowCrossOriginRedirects) {\n return {\n ok: false,\n reason: 'cross_origin_redirect',\n message: `Cross-origin redirect not allowed: ${originalOrigin} -> ${redirectUrl.origin}`,\n blockedUrl: redirectUrl.href,\n };\n }\n\n // Check redirect target IPs (DNS resolution + SSRF checks)\n const redirectDnsResult = await resolveHostname(redirectUrl.hostname);\n\n // Handle DNS failure for redirect target\n if (!redirectDnsResult.ok) {\n if (dnsFailureBehavior === 'block') {\n return {\n ok: false,\n reason: 'dns_failure',\n message: `Redirect DNS resolution blocked: ${redirectDnsResult.message}`,\n blockedUrl: redirectUrl.href,\n };\n }\n return {\n ok: false,\n reason: 'network_error',\n message: redirectDnsResult.message,\n blockedUrl: redirectUrl.href,\n };\n }\n\n // Check redirect target IPs (browsers resolve names themselves, so only literals are listed)\n for (const ip of redirectDnsResult.ips) {\n const blockResult = isBlockedIP(ip);\n if (blockResult.blocked) {\n return {\n ok: false,\n reason: blockResult.reason,\n message: `Redirect to blocked ${blockResult.reason} address: ${ip}`,\n blockedUrl: redirectUrl.href,\n };\n }\n }\n\n currentUrl = redirectUrl.href;\n vettedAddresses = redirectDnsResult.browser ? null : redirectDnsResult.ips;\n continue;\n }\n\n // Step 6: Validate response size\n const contentLength = response.headers.get('content-length');\n if (contentLength && parseInt(contentLength, 10) > maxBytes) {\n await discardBody(response);\n return {\n ok: false,\n reason: 'response_too_large',\n message: `Response too large: ${contentLength} bytes > ${maxBytes} max`,\n };\n }\n\n // Read response body with size limit\n const reader = response.body?.getReader();\n if (!reader) {\n const body = await response.text();\n if (body.length > maxBytes) {\n return {\n ok: false,\n reason: 'response_too_large',\n message: `Response too large: ${body.length} bytes > ${maxBytes} max`,\n };\n }\n // Convert body back to bytes for rawBytes (fallback path)\n const rawBytes = new TextEncoder().encode(body);\n return {\n ok: true,\n status: response.status,\n body,\n rawBytes,\n contentType: response.headers.get('content-type') ?? undefined,\n };\n }\n\n // Stream with size limit\n const chunks: Uint8Array[] = [];\n let totalSize = 0;\n\n while (true) {\n const { done, value } = await reader.read();\n if (done) break;\n\n totalSize += value.length;\n if (totalSize > maxBytes) {\n reader.cancel();\n return {\n ok: false,\n reason: 'response_too_large',\n message: `Response too large: ${totalSize} bytes > ${maxBytes} max`,\n };\n }\n\n chunks.push(value);\n }\n\n // Concatenate chunks into raw bytes (preserve original bytes for digest)\n const rawBytes = chunks.reduce((acc, chunk) => {\n const result = new Uint8Array(acc.length + chunk.length);\n result.set(acc);\n result.set(chunk, acc.length);\n return result;\n }, new Uint8Array());\n\n // Decode to string for body\n const body = new TextDecoder().decode(rawBytes);\n\n return {\n ok: true,\n status: response.status,\n body,\n rawBytes,\n contentType: response.headers.get('content-type') ?? undefined,\n };\n } catch (err) {\n if (err instanceof Error) {\n if (err.name === 'AbortError' || err.message.includes('timeout')) {\n return {\n ok: false,\n reason: 'timeout',\n message: `Fetch timeout after ${timeoutMs}ms: ${currentUrl}`,\n };\n }\n }\n\n return {\n ok: false,\n reason: 'network_error',\n message: `Network error: ${err instanceof Error ? err.message : String(err)}`,\n };\n }\n }\n}\n\n/**\n * Convenience function to fetch JWKS with SSRF protection\n */\nexport async function fetchJWKSSafe(\n jwksUrl: string,\n options?: Omit<SSRFFetchOptions, 'maxBytes'>\n): Promise<SSRFFetchResult | SSRFFetchError> {\n return ssrfSafeFetch(jwksUrl, {\n ...options,\n maxBytes: VERIFIER_LIMITS.maxJwksBytes,\n headers: {\n Accept: 'application/json',\n ...options?.headers,\n },\n });\n}\n\n/**\n * Convenience function to fetch pointer target with SSRF protection\n */\nexport async function fetchPointerSafe(\n pointerUrl: string,\n options?: Omit<SSRFFetchOptions, 'maxBytes'>\n): Promise<SSRFFetchResult | SSRFFetchError> {\n return ssrfSafeFetch(pointerUrl, {\n ...options,\n maxBytes: VERIFIER_LIMITS.maxReceiptBytes,\n headers: {\n Accept: 'application/jose, application/json',\n ...options?.headers,\n },\n });\n}\n","/**\n * Shared JWKS Resolver\n *\n * Centralizes JWKS resolution for both verify.ts and verifier-core.ts:\n * 1. Fetch peac-issuer.json from issuer origin (SSRF-safe)\n * 2. Validate issuer config (schema, issuer match)\n * 3. Validate jwks_uri is HTTPS (protocol-level enforcement)\n * 4. Fetch JWKS from jwks_uri (SSRF-safe, 64KB cap)\n * 5. Validate JWKS shape; skip entries that are not Ed25519 public verification keys\n *\n * No fallback paths: peac-issuer.json with jwks_uri is the only\n * supported key discovery mechanism.\n *\n * @packageDocumentation\n */\n\nimport { VERIFIER_LIMITS } from '@peac/kernel';\nimport { PEAC_ISSUER_CONFIG_MAX_BYTES } from '@peac/schema';\nimport { parseIssuerConfig } from './discovery.js';\nimport type { SSRFFetchError } from './ssrf-safe-fetch.js';\nimport { fetchJWKSSafe, ssrfSafeFetch } from './ssrf-safe-fetch.js';\n\n// ---------------------------------------------------------------------------\n// Types\n// ---------------------------------------------------------------------------\n\n/**\n * JWK structure for Ed25519 keys\n */\nexport interface JWK {\n kty: string;\n crv: string;\n x: string;\n kid: string;\n}\n\n/**\n * JWKS document\n */\nexport interface JWKS {\n keys: JWK[];\n}\n\n/**\n * Revoked key entry from issuer configuration\n */\nexport interface RevokedKeyInfo {\n kid: string;\n revoked_at: string;\n reason?: string;\n}\n\n/**\n * Successful JWKS resolution\n */\nexport interface JWKSResolveSuccess {\n ok: true;\n jwks: JWKS;\n fromCache: boolean;\n /** Raw JWKS bytes for digest computation (only present when not from cache) */\n rawBytes?: Uint8Array;\n /** Revoked keys from issuer configuration (v0.11.3+) */\n revokedKeys?: RevokedKeyInfo[];\n}\n\n/**\n * JWKS resolution error\n */\nexport interface JWKSResolveError {\n ok: false;\n /** Kernel error code */\n code: string;\n /** Human-readable message */\n message: string;\n /** Original SSRF reason (preserved for diagnostic fidelity) */\n reason?: SSRFFetchError['reason'];\n /** Blocked URL (if applicable) */\n blockedUrl?: string;\n}\n\nexport type JWKSResolveResult = JWKSResolveSuccess | JWKSResolveError;\n\n/**\n * Options for JWKS resolution\n */\nexport interface ResolveJWKSOptions {\n /** Cache TTL in milliseconds (default: 300000 = 5 minutes) */\n cacheTtlMs?: number;\n /** Maximum cache entries before LRU eviction (default: 1000) */\n maxCacheEntries?: number;\n /** Bypass cache entirely (default: false) */\n noCache?: boolean;\n}\n\n// ---------------------------------------------------------------------------\n// Cache (LRU via Map insertion order)\n// ---------------------------------------------------------------------------\n\ninterface JWKSCacheEntry {\n jwks: JWKS;\n expiresAt: number;\n revokedKeys?: RevokedKeyInfo[];\n}\n\nconst HARD_CACHE_TTL_MS_BUILTIN = 5 * 60 * 1000;\nconst HARD_MAX_CACHE_ENTRIES_BUILTIN = 1000;\n\n/**\n * Read a positive integer from an environment variable. Returns the\n * fallback when the variable is unset, empty, or not a positive\n * integer. Defensive against operator typos: a malformed value never\n * silently uncaches the resolver. Pure function; the env source is\n * a parameter so tests do not have to mutate process.env.\n *\n * Accepts canonical decimal positive integers only (e.g. `300000`).\n * Rejects scientific notation (`1e3`), floats, zero, negatives, and\n * any non-decimal string. Malformed values fall back to the built-in\n * default so operator typos never silently disable the cache.\n */\nexport function __parseEnvPositiveInt(\n name: string,\n fallback: number,\n env: Record<string, string | undefined> = typeof process !== 'undefined'\n ? (process.env as Record<string, string | undefined>)\n : {}\n): number {\n const raw = env[name];\n if (!raw) return fallback;\n if (!/^[1-9][0-9]*$/.test(raw)) return fallback;\n const parsed = parseInt(raw, 10);\n return parsed > 0 ? parsed : fallback;\n}\n\nconst DEFAULT_CACHE_TTL_MS = __parseEnvPositiveInt(\n 'PEAC_JWKS_CACHE_TTL_MS',\n HARD_CACHE_TTL_MS_BUILTIN\n);\nconst DEFAULT_MAX_CACHE_ENTRIES = __parseEnvPositiveInt(\n 'PEAC_JWKS_CACHE_MAX_ENTRIES',\n HARD_MAX_CACHE_ENTRIES_BUILTIN\n);\n\n/** Exposes the module-load defaults for testing without mutating process.env. */\nexport function __getJwksCacheDefaults(): { ttlMs: number; maxEntries: number } {\n return { ttlMs: DEFAULT_CACHE_TTL_MS, maxEntries: DEFAULT_MAX_CACHE_ENTRIES };\n}\nconst jwksCache = new Map<string, JWKSCacheEntry>();\n\n// ---------------------------------------------------------------------------\n// Kid-to-Thumbprint Tracking (kid reuse detection)\n// ---------------------------------------------------------------------------\n\ninterface KidThumbprintEntry {\n /** Base64url-encoded x coordinate (canonical key material identifier) */\n thumbprint: string;\n /** Timestamp when first observed */\n firstSeen: number;\n}\n\n/**\n * Retention window for kid-to-thumbprint mappings.\n * Matches the normative overlap period (30 days).\n */\nconst KID_RETENTION_MS = 30 * 24 * 60 * 60 * 1000;\n\n/**\n * Maximum number of kid-to-thumbprint entries to prevent unbounded memory growth.\n * Evicts oldest entries (by firstSeen) when exceeded.\n */\nconst MAX_KID_THUMBPRINT_ENTRIES = 10_000;\n\nconst kidThumbprints = new Map<string, KidThumbprintEntry>();\n\n/**\n * Prune expired entries from the kid-to-thumbprint map.\n * Runs during checkKidReuse to bound memory growth.\n */\nfunction pruneExpiredKidEntries(now: number): void {\n for (const [key, entry] of kidThumbprints) {\n if (now - entry.firstSeen >= KID_RETENTION_MS) {\n kidThumbprints.delete(key);\n }\n }\n}\n\n/**\n * Evict oldest entries when the map exceeds the maximum size.\n * Uses firstSeen as the eviction criterion (oldest first).\n */\nfunction evictOldestKidEntries(): void {\n if (kidThumbprints.size <= MAX_KID_THUMBPRINT_ENTRIES) return;\n\n // Collect entries sorted by firstSeen (oldest first)\n const entries = Array.from(kidThumbprints.entries()).sort(\n (a, b) => a[1].firstSeen - b[1].firstSeen\n );\n\n // Remove oldest entries until within limit\n const toRemove = kidThumbprints.size - MAX_KID_THUMBPRINT_ENTRIES;\n for (let i = 0; i < toRemove; i++) {\n kidThumbprints.delete(entries[i][0]);\n }\n}\n\n/**\n * Check for kid reuse: same (iss, kid) mapping to different key material.\n * Returns error code string if reuse detected, null otherwise.\n *\n * Also prunes expired entries and enforces max size to prevent\n * unbounded memory growth in long-running processes.\n *\n * Stateful resolvers MUST reject (tiered enforcement).\n */\nfunction checkKidReuse(issuer: string, jwks: JWKS, now: number): string | null {\n // Prune expired entries first (bounded memory)\n pruneExpiredKidEntries(now);\n\n for (const key of jwks.keys) {\n if (!key.kid || !key.x) continue;\n const mapKey = `${issuer}|${key.kid}`;\n const existing = kidThumbprints.get(mapKey);\n\n if (existing) {\n // Check if within retention window\n if (now - existing.firstSeen < KID_RETENTION_MS) {\n if (existing.thumbprint !== key.x) {\n return `Kid reuse detected: kid=${key.kid} for issuer ${issuer} maps to different key material`;\n }\n } else {\n // Expired: update with new mapping\n kidThumbprints.set(mapKey, { thumbprint: key.x, firstSeen: now });\n }\n } else {\n // First time seeing this (iss, kid): record it\n kidThumbprints.set(mapKey, { thumbprint: key.x, firstSeen: now });\n }\n }\n\n // Enforce max size after insertions\n evictOldestKidEntries();\n\n return null;\n}\n\n/**\n * Clear kid-to-thumbprint tracking (for testing)\n * @internal\n */\nexport function clearKidThumbprints(): void {\n kidThumbprints.clear();\n}\n\n/**\n * Get kid-to-thumbprint map size (for testing bounded growth)\n * @internal\n */\nexport function getKidThumbprintSize(): number {\n return kidThumbprints.size;\n}\n\n/**\n * LRU cache get: promotes entry to most-recently-used position.\n * Returns undefined if expired or missing.\n */\nfunction cacheGet(key: string, now: number): JWKSCacheEntry | undefined {\n const entry = jwksCache.get(key);\n if (!entry) return undefined;\n if (entry.expiresAt <= now) {\n jwksCache.delete(key);\n return undefined;\n }\n // LRU promote: delete and re-insert to move to end (most recent)\n jwksCache.delete(key);\n jwksCache.set(key, entry);\n return entry;\n}\n\n/**\n * LRU cache set: inserts entry and evicts oldest if over capacity.\n */\nfunction cacheSet(key: string, entry: JWKSCacheEntry, maxEntries: number): void {\n if (jwksCache.has(key)) jwksCache.delete(key);\n jwksCache.set(key, entry);\n // Evict oldest entries (Map iteration order = insertion order)\n while (jwksCache.size > maxEntries) {\n const oldestKey = jwksCache.keys().next().value;\n if (oldestKey !== undefined) jwksCache.delete(oldestKey);\n }\n}\n\n/**\n * Clear the shared JWKS cache\n */\nexport function clearJWKSCache(): void {\n jwksCache.clear();\n}\n\n/**\n * Get JWKS cache size (for testing)\n * @internal\n */\nexport function getJWKSCacheSize(): number {\n return jwksCache.size;\n}\n\n// ---------------------------------------------------------------------------\n// Issuer Normalization\n// ---------------------------------------------------------------------------\n\n/**\n * Canonicalize an issuer URL to its origin (scheme + host + port).\n * Uses URL parsing for interop correctness: handles trailing slashes,\n * paths, default port elision, and IDN normalization.\n *\n * Returns a discriminated result so callers can distinguish malformed URLs\n * from valid non-HTTPS URLs (different error codes).\n *\n * Examples:\n * \"https://api.example.com/\" -> ok: \"https://api.example.com\"\n * \"https://api.example.com/v1\" -> ok: \"https://api.example.com\"\n * \"https://api.example.com:443\" -> ok: \"https://api.example.com\"\n * \"https://api.example.com:8443\" -> ok: \"https://api.example.com:8443\"\n * \"not-a-url\" -> error\n */\nfunction canonicalizeIssuerOrigin(\n issuerUrl: string\n): { ok: true; origin: string } | { ok: false; message: string } {\n try {\n const origin = new URL(issuerUrl).origin;\n // Non-hierarchical URIs (data:, blob:) return \"null\" as origin\n if (origin === 'null') {\n return { ok: false, message: `Issuer URL has no valid origin: ${issuerUrl}` };\n }\n return { ok: true, origin };\n } catch {\n return { ok: false, message: `Issuer URL is not a valid URL: ${issuerUrl}` };\n }\n}\n\n// ---------------------------------------------------------------------------\n// SSRF Error Mapping\n// ---------------------------------------------------------------------------\n\n/**\n * Map SSRFFetchError to kernel error code while preserving the original reason.\n * Returns both the kernel code and the original SSRF reason for diagnostic fidelity.\n */\nfunction mapSSRFError(\n reason: SSRFFetchError['reason'],\n context: 'issuer_config' | 'jwks'\n): { code: string; reason: SSRFFetchError['reason'] } {\n let code: string;\n switch (reason) {\n case 'not_https':\n code = 'E_VERIFY_INSECURE_SCHEME_BLOCKED';\n break;\n case 'private_ip':\n case 'loopback':\n case 'link_local':\n code = 'E_VERIFY_KEY_FETCH_BLOCKED';\n break;\n case 'timeout':\n code = 'E_VERIFY_KEY_FETCH_TIMEOUT';\n break;\n case 'response_too_large':\n code = context === 'jwks' ? 'E_VERIFY_JWKS_TOO_LARGE' : 'E_VERIFY_KEY_FETCH_FAILED';\n break;\n case 'dns_failure':\n case 'network_error':\n case 'too_many_redirects':\n case 'scheme_downgrade':\n case 'cross_origin_redirect':\n case 'invalid_url':\n code =\n context === 'issuer_config'\n ? 'E_VERIFY_ISSUER_CONFIG_MISSING'\n : 'E_VERIFY_KEY_FETCH_FAILED';\n break;\n case 'jwks_too_many_keys':\n code = 'E_VERIFY_JWKS_TOO_MANY_KEYS';\n break;\n default:\n code = 'E_VERIFY_KEY_FETCH_FAILED';\n break;\n }\n return { code, reason };\n}\n\n// ---------------------------------------------------------------------------\n// Key Entry Validation\n// ---------------------------------------------------------------------------\n\n/** Unpadded base64url of exactly 32 bytes with zero trailing bits (canonical form). */\nconst CANONICAL_ED25519_X = /^[A-Za-z0-9_-]{42}[AEIMQUYcgkosw048]$/;\n\nfunction isPlainObject(value: unknown): value is Record<string, unknown> {\n return typeof value === 'object' && value !== null && !Array.isArray(value);\n}\n\n/**\n * Check one JWKS entry against the Ed25519 public verification key profile.\n * Returns a short description of the first problem, or null if the entry is usable.\n */\nfunction jwkEntryProblem(entry: unknown): string | null {\n if (!isPlainObject(entry)) return 'not an object';\n if (entry.kty !== 'OKP') return 'kty must be OKP';\n if (entry.crv !== 'Ed25519') return 'crv must be Ed25519';\n if (typeof entry.x !== 'string' || !CANONICAL_ED25519_X.test(entry.x)) {\n return 'x must be a canonical base64url 32-byte value';\n }\n if (Object.prototype.hasOwnProperty.call(entry, 'd')) return 'private key member d present';\n if (entry.kid !== undefined && typeof entry.kid !== 'string') return 'kid must be a string';\n if (entry.use !== undefined && entry.use !== 'sig') return 'use must be sig';\n if (entry.alg !== undefined && entry.alg !== 'EdDSA' && entry.alg !== 'Ed25519') {\n return 'alg must be EdDSA or Ed25519';\n }\n return null;\n}\n\n// ---------------------------------------------------------------------------\n// Main Resolution\n// ---------------------------------------------------------------------------\n\n/**\n * Resolve JWKS for an issuer using strict discovery:\n * peac-issuer.json -> jwks_uri -> JWKS\n *\n * No fallback to direct JWKS or peac.txt key discovery.\n *\n * @param issuerUrl - Issuer origin URL (e.g. \"https://api.example.com\")\n * @param options - Cache and resolution options\n * @returns Resolved JWKS or error\n */\nexport async function resolveJWKS(\n issuerUrl: string,\n options?: ResolveJWKSOptions\n): Promise<JWKSResolveResult> {\n const cacheTtlMs = options?.cacheTtlMs ?? DEFAULT_CACHE_TTL_MS;\n const maxCacheEntries = options?.maxCacheEntries ?? DEFAULT_MAX_CACHE_ENTRIES;\n const noCache = options?.noCache ?? false;\n\n // Normalize issuer to origin via URL parsing (interop-correct)\n const normalized = canonicalizeIssuerOrigin(issuerUrl);\n if (!normalized.ok) {\n return {\n ok: false,\n code: 'E_VERIFY_ISSUER_CONFIG_INVALID',\n message: normalized.message,\n blockedUrl: issuerUrl,\n };\n }\n const normalizedIssuer = normalized.origin;\n const now = Date.now();\n\n // Check cache first (unless bypassed)\n if (!noCache) {\n const cached = cacheGet(normalizedIssuer, now);\n if (cached) {\n return { ok: true, jwks: cached.jwks, fromCache: true, revokedKeys: cached.revokedKeys };\n }\n }\n\n // Step 1: Require HTTPS\n if (!normalizedIssuer.startsWith('https://')) {\n return {\n ok: false,\n code: 'E_VERIFY_INSECURE_SCHEME_BLOCKED',\n message: `Issuer URL must be HTTPS: ${normalizedIssuer}`,\n blockedUrl: normalizedIssuer,\n };\n }\n\n // Step 2: Fetch peac-issuer.json\n const configUrl = `${normalizedIssuer}/.well-known/peac-issuer.json`;\n const configResult = await ssrfSafeFetch(configUrl, {\n maxBytes: PEAC_ISSUER_CONFIG_MAX_BYTES,\n headers: { Accept: 'application/json' },\n });\n\n if (!configResult.ok) {\n const mapped = mapSSRFError(configResult.reason, 'issuer_config');\n return {\n ok: false,\n code: mapped.code,\n message: `Failed to fetch peac-issuer.json: ${configResult.message}`,\n reason: mapped.reason,\n blockedUrl: configResult.blockedUrl,\n };\n }\n\n // Step 3: Parse and validate issuer config\n let issuerConfig: ReturnType<typeof parseIssuerConfig>;\n try {\n issuerConfig = parseIssuerConfig(configResult.body);\n } catch (err) {\n return {\n ok: false,\n code: 'E_VERIFY_ISSUER_CONFIG_INVALID',\n message: `Invalid peac-issuer.json: ${err instanceof Error ? err.message : String(err)}`,\n };\n }\n\n // Step 4: Validate issuer match (both sides canonicalized to origin)\n const configIssuerResult = canonicalizeIssuerOrigin(issuerConfig.issuer);\n const configIssuer = configIssuerResult.ok ? configIssuerResult.origin : issuerConfig.issuer;\n if (configIssuer !== normalizedIssuer) {\n return {\n ok: false,\n code: 'E_VERIFY_ISSUER_MISMATCH',\n message: `Issuer mismatch: expected ${normalizedIssuer}, got ${configIssuer}`,\n };\n }\n\n // Step 5: Validate jwks_uri (HTTPS enforcement at resolver layer, not parser)\n if (!issuerConfig.jwks_uri) {\n return {\n ok: false,\n code: 'E_VERIFY_JWKS_URI_INVALID',\n message: 'peac-issuer.json missing required jwks_uri field',\n };\n }\n\n if (!issuerConfig.jwks_uri.startsWith('https://')) {\n return {\n ok: false,\n code: 'E_VERIFY_JWKS_URI_INVALID',\n message: `jwks_uri must be HTTPS: ${issuerConfig.jwks_uri}`,\n blockedUrl: issuerConfig.jwks_uri,\n };\n }\n\n // Step 6: Fetch JWKS from jwks_uri\n const jwksResult = await fetchJWKSSafe(issuerConfig.jwks_uri);\n\n if (!jwksResult.ok) {\n const mapped = mapSSRFError(jwksResult.reason, 'jwks');\n return {\n ok: false,\n code: mapped.code,\n message: `Failed to fetch JWKS from ${issuerConfig.jwks_uri}: ${jwksResult.message}`,\n reason: mapped.reason,\n blockedUrl: jwksResult.blockedUrl,\n };\n }\n\n // Step 7: Parse and validate JWKS\n let parsed: unknown;\n try {\n parsed = JSON.parse(jwksResult.body);\n } catch {\n return {\n ok: false,\n code: 'E_VERIFY_JWKS_INVALID',\n message: 'JWKS response is not valid JSON',\n };\n }\n\n const rawKeys = isPlainObject(parsed) ? parsed.keys : undefined;\n if (!Array.isArray(rawKeys)) {\n return {\n ok: false,\n code: 'E_VERIFY_JWKS_INVALID',\n message: 'JWKS missing required keys array',\n };\n }\n\n if (rawKeys.length > VERIFIER_LIMITS.maxJwksKeys) {\n return {\n ok: false,\n code: 'E_VERIFY_JWKS_TOO_MANY_KEYS',\n message: `JWKS has too many keys: ${rawKeys.length} > ${VERIFIER_LIMITS.maxJwksKeys}`,\n };\n }\n\n const validKeys: JWK[] = [];\n const skipped: string[] = [];\n rawKeys.forEach((entry: unknown, index: number) => {\n const problem = jwkEntryProblem(entry);\n if (problem === null) {\n validKeys.push(entry as JWK);\n } else {\n skipped.push(`#${index}: ${problem}`);\n }\n });\n if (skipped.length > 0) {\n console.warn(\n `[peac:jwks] Skipped ${skipped.length} invalid JWKS entr${skipped.length === 1 ? 'y' : 'ies'} for ${normalizedIssuer} (${skipped.join('; ')})`\n );\n }\n const jwks: JWKS = { keys: validKeys };\n\n // Step 8: Kid reuse detection (stateful MUST reject)\n const kidReuseError = checkKidReuse(normalizedIssuer, jwks, now);\n if (kidReuseError) {\n return {\n ok: false,\n code: 'E_KID_REUSE_DETECTED',\n message: kidReuseError,\n };\n }\n\n // Extract revoked_keys from issuer config\n const revokedKeys = issuerConfig.revoked_keys?.map((entry) => ({\n kid: entry.kid,\n revoked_at: entry.revoked_at,\n reason: entry.reason,\n }));\n\n // Cache and return (with LRU eviction)\n if (!noCache) {\n cacheSet(normalizedIssuer, { jwks, expiresAt: now + cacheTtlMs, revokedKeys }, maxCacheEntries);\n }\n\n return {\n ok: true,\n jwks,\n fromCache: false,\n rawBytes: jwksResult.rawBytes,\n revokedKeys,\n };\n}\n","/**\n * Internal Ed25519 signature-width guard for the verification paths.\n *\n * NOT re-exported from the package barrel (`index.ts` does\n * `export * from './verify'` / `'./verify-local'`, so anything exported from\n * those modules becomes public API). Keep this helper in `_internal` so the\n * guard adds no public surface.\n */\n\nimport { base64urlDecode } from '@peac/crypto';\n\n/** Ed25519 signatures are fixed-width 64 bytes (RFC 8032 / RFC 8709). */\nexport const ED25519_SIGNATURE_BYTES = 64;\n\n/**\n * Return the decoded byte length of a compact JWS signature segment, or `null`\n * when the token is not a well-formed three-part compact JWS or the signature\n * segment is not decodable base64url. Those `null` cases are deliberately left\n * to the existing format/verification error paths (this guard does not change\n * their classification); only a well-formed token whose signature decodes to a\n * non-64-byte width is surfaced to the caller as a wrong-length signature.\n */\nexport function ed25519SignatureByteLength(jws: string): number | null {\n const parts = jws.split('.');\n if (parts.length !== 3) {\n return null;\n }\n try {\n return base64urlDecode(parts[2]).length;\n } catch {\n return null;\n }\n}\n","/**\n * Receipt verification with strict issuer-config-based JWKS discovery\n *\n * Key discovery uses peac-issuer.json -> jwks_uri exclusively.\n * No legacy fallbacks (peac.txt, direct JWKS).\n * JWKS caching is centralized in jwks-resolver.ts.\n */\n\nimport { verify as jwsVerify, decode } from '@peac/crypto';\nimport {\n PEACReceiptClaims,\n ReceiptClaims,\n SubjectProfileSnapshot,\n validateSubjectSnapshot,\n validateKernelConstraints,\n} from '@peac/schema';\nimport { resolveJWKS, type JWK } from './jwks-resolver.js';\nimport { hashReceipt, fireTelemetryHook, type TelemetryHook } from './telemetry.js';\nimport { readLegacyPathFlag, type LegacyPathOptions } from './_internal/legacy-path.js';\nimport { ED25519_SIGNATURE_BYTES, ed25519SignatureByteLength } from './_internal/signature.js';\n\n/**\n * Convert JWK x coordinate to Ed25519 public key\n */\nfunction jwkToPublicKey(jwk: JWK): Uint8Array {\n if (jwk.kty !== 'OKP' || jwk.crv !== 'Ed25519') {\n throw new Error('Only Ed25519 keys (OKP/Ed25519) are supported');\n }\n\n // Decode base64url x coordinate\n const xBytes = Buffer.from(jwk.x, 'base64url');\n if (xBytes.length !== 32) {\n throw new Error('Ed25519 public key must be 32 bytes');\n }\n\n return new Uint8Array(xBytes);\n}\n\n/**\n * Wire 0.1 verification result.\n * @deprecated Wire 0.1 is frozen legacy. Use {@link verifyLocal} (from `verify-local.ts`)\n * for the current stable format.\n */\nexport interface VerifyResult {\n /** Verification succeeded */\n ok: true;\n\n /** Receipt claims */\n claims: PEACReceiptClaims;\n\n /** Subject profile snapshot (v0.9.17+, if provided) */\n subject_snapshot?: SubjectProfileSnapshot;\n\n /** Performance metrics */\n perf?: {\n verify_ms: number;\n jwks_fetch_ms?: number;\n };\n}\n\n/**\n * Wire 0.1 verification failure.\n * @deprecated Wire 0.1 is frozen legacy. Use {@link verifyLocal} for the current stable format.\n */\nexport interface VerifyFailure {\n /** Verification failed */\n ok: false;\n\n /** Error reason */\n reason: string;\n\n /** Error details */\n details?: string;\n}\n\n/**\n * Wire 0.1 verification options.\n * @deprecated Wire 0.1 is frozen legacy. Use {@link verifyLocal} for the current stable format.\n */\nexport interface VerifyOptions {\n /** JWS compact serialization */\n receiptJws: string;\n\n /** Subject profile snapshot (v0.9.17+, optional envelope metadata) */\n subject_snapshot?: SubjectProfileSnapshot;\n\n /** Telemetry hook (optional, fire-and-forget) */\n telemetry?: TelemetryHook;\n}\n\n/**\n * Verify a Wire 0.1 PEAC receipt JWS via issuer-config discovery.\n *\n * Uses strict issuer-config discovery: peac-issuer.json -> jwks_uri -> JWKS.\n * No fallback to peac.txt or direct JWKS endpoints.\n *\n * @deprecated Wire 0.1 is frozen legacy. Use {@link verifyLocal} for the current stable\n * format (Interaction Record format, `interaction-record+jwt`).\n *\n * @param optionsOrJws - Verify options or JWS compact serialization (for backwards compatibility)\n * @returns Verification result or failure\n */\nexport async function verifyReceipt(\n optionsOrJws: string | VerifyOptions\n): Promise<VerifyResult | VerifyFailure> {\n // Internal rollback-path flag. See `_internal/legacy-path.ts` for\n // the full contract.\n const legacyPathOptions =\n typeof optionsOrJws === 'string' ? undefined : (optionsOrJws as unknown as LegacyPathOptions);\n void readLegacyPathFlag(legacyPathOptions);\n\n // Support both old (string) and new (options) signatures for backwards compatibility\n const receiptJws = typeof optionsOrJws === 'string' ? optionsOrJws : optionsOrJws.receiptJws;\n const inputSnapshot =\n typeof optionsOrJws === 'string' ? undefined : optionsOrJws.subject_snapshot;\n const telemetry = typeof optionsOrJws === 'string' ? undefined : optionsOrJws.telemetry;\n const startTime = performance.now();\n let jwksFetchTime: number | undefined;\n\n try {\n // Decode JWS to get issuer\n const { header, payload } = decode<PEACReceiptClaims>(receiptJws);\n\n // Validate structural kernel constraints (fail-closed)\n const constraintResult = validateKernelConstraints(payload);\n if (!constraintResult.valid) {\n const v = constraintResult.violations[0];\n return {\n ok: false,\n reason: 'constraint_violation',\n details: `Kernel constraint violated: ${v.constraint} (actual: ${v.actual}, limit: ${v.limit})`,\n };\n }\n\n // Validate claims structure\n ReceiptClaims.parse(payload);\n\n // Check expiry\n if (payload.exp && payload.exp < Math.floor(Date.now() / 1000)) {\n const durationMs = performance.now() - startTime;\n fireTelemetryHook(telemetry?.onReceiptVerified, {\n receiptHash: hashReceipt(receiptJws),\n valid: false,\n reasonCode: 'expired',\n issuer: payload.iss,\n kid: header.kid,\n durationMs,\n });\n return {\n ok: false,\n reason: 'expired',\n details: `Receipt expired at ${new Date(payload.exp * 1000).toISOString()}`,\n };\n }\n\n // Resolve JWKS via strict discovery (peac-issuer.json -> jwks_uri)\n const jwksFetchStart = performance.now();\n const jwksResult = await resolveJWKS(payload.iss);\n\n if (!jwksResult.ok) {\n return {\n ok: false,\n reason: jwksResult.code,\n details: jwksResult.message,\n };\n }\n\n if (!jwksResult.fromCache) {\n jwksFetchTime = performance.now() - jwksFetchStart;\n }\n\n // Check if key is revoked (v0.11.3+)\n if (jwksResult.revokedKeys) {\n const revokedEntry = jwksResult.revokedKeys.find((rk) => rk.kid === header.kid);\n if (revokedEntry) {\n const durationMs = performance.now() - startTime;\n fireTelemetryHook(telemetry?.onReceiptVerified, {\n receiptHash: hashReceipt(receiptJws),\n valid: false,\n reasonCode: 'key_revoked',\n issuer: payload.iss,\n kid: header.kid,\n durationMs,\n });\n return {\n ok: false,\n reason: 'key_revoked',\n details: `Key kid=${header.kid} was revoked at ${revokedEntry.revoked_at}${revokedEntry.reason ? ` (reason: ${revokedEntry.reason})` : ''}`,\n };\n }\n }\n\n // Find key by kid\n const jwk = jwksResult.jwks.keys.find((k) => k.kid === header.kid);\n if (!jwk) {\n const durationMs = performance.now() - startTime;\n fireTelemetryHook(telemetry?.onReceiptVerified, {\n receiptHash: hashReceipt(receiptJws),\n valid: false,\n reasonCode: 'unknown_key',\n issuer: payload.iss,\n kid: header.kid,\n durationMs,\n });\n return {\n ok: false,\n reason: 'unknown_key',\n details: `No key found with kid=${header.kid}`,\n };\n }\n\n // Convert JWK to public key\n const publicKey = jwkToPublicKey(jwk);\n\n // Reject fixed-width-violating Ed25519 signatures deterministically as an\n // invalid signature, immediately before cryptographic verification (after\n // key resolution/conversion). Placing it here -- rather than in the outer\n // catch -- ensures an unexpected failure in an earlier stage (JWKS, key\n // conversion, etc.) is never masked as invalid_signature.\n const signatureBytes = ed25519SignatureByteLength(receiptJws);\n if (signatureBytes !== null && signatureBytes !== ED25519_SIGNATURE_BYTES) {\n const durationMs = performance.now() - startTime;\n fireTelemetryHook(telemetry?.onReceiptVerified, {\n receiptHash: hashReceipt(receiptJws),\n valid: false,\n reasonCode: 'invalid_signature',\n issuer: payload.iss,\n kid: header.kid,\n durationMs,\n });\n return {\n ok: false,\n reason: 'invalid_signature',\n details: 'Ed25519 signature has invalid length',\n };\n }\n\n // Verify signature\n const result = await jwsVerify<PEACReceiptClaims>(receiptJws, publicKey);\n\n if (!result.valid) {\n const durationMs = performance.now() - startTime;\n fireTelemetryHook(telemetry?.onReceiptVerified, {\n receiptHash: hashReceipt(receiptJws),\n valid: false,\n reasonCode: 'invalid_signature',\n issuer: payload.iss,\n kid: header.kid,\n durationMs,\n });\n return {\n ok: false,\n reason: 'invalid_signature',\n details: 'Ed25519 signature verification failed',\n };\n }\n\n // Validate subject_snapshot if provided (v0.9.17+)\n // This validates schema and logs advisory PII warning if applicable\n const validatedSnapshot = validateSubjectSnapshot(inputSnapshot);\n\n const verifyTime = performance.now() - startTime;\n\n // Emit success telemetry (fire-and-forget, guarded)\n fireTelemetryHook(telemetry?.onReceiptVerified, {\n receiptHash: hashReceipt(receiptJws),\n valid: true,\n issuer: payload.iss,\n kid: header.kid,\n durationMs: verifyTime,\n });\n\n return {\n ok: true,\n claims: payload,\n ...(validatedSnapshot && { subject_snapshot: validatedSnapshot }),\n perf: {\n verify_ms: verifyTime,\n ...(jwksFetchTime && { jwks_fetch_ms: jwksFetchTime }),\n },\n };\n } catch {\n const durationMs = performance.now() - startTime;\n fireTelemetryHook(telemetry?.onReceiptVerified, {\n receiptHash: hashReceipt(receiptJws),\n valid: false,\n reasonCode: 'verification_error',\n durationMs,\n });\n // Do not surface raw exception text to callers (avoids leaking internal\n // paths/state); the stable reason carries the classification.\n return {\n ok: false,\n reason: 'verification_error',\n details: 'Unexpected verification error.',\n };\n }\n}\n","/**\n * Inert shadow-call boundary for the bounded validator foundation.\n *\n * INTERNAL ONLY. This module is the call-site placeholder that PR D\n * will wire to the bounded validator pipeline behind an internal\n * feature flag. In v0.13.1 the boundary is INERT by construction:\n *\n * - the only declared mode is `'disabled'`\n * - the function body is a single early return on `'disabled'`\n * - it imports no bounded validators (zero runtime weight at\n * verify-local.ts cold-start, even though the call site exists)\n * - it never throws into verifyLocal()\n * - it never mutates the input claims object\n * - it never logs\n * - it never reads environment variables\n * - it never affects the canonical verify-local result\n *\n * The function returns `undefined` for every call. The call site in\n * verify-local.ts ignores the return value and never awaits any work.\n *\n * NOT re-exported from packages/protocol/src/index.ts. Public surface\n * is byte-stable. PR D may extend the input shape when wiring the\n * actual flag plumbing; that is a future-internal change, not a\n * public API change.\n */\n\n/**\n * The only declared shadow validation mode. Adding new modes requires\n * a deliberate future change in PR D where the actual flag is wired.\n */\nexport type ShadowValidationMode = 'disabled';\n\n/**\n * Input shape for the shadow-call boundary. `claims` is intentionally\n * `unknown` so callers may pass parsed Wire 0.2 claims without a\n * coupling to the schema's exported type from this internal helper.\n */\nexport interface ShadowValidationInput {\n readonly mode: ShadowValidationMode;\n readonly claims: unknown;\n}\n\n/**\n * Inert shadow-call hook. Always returns `undefined`. The signature\n * is stable enough for PR D to extend (e.g., adding a `header` or\n * `now` field) without breaking the disabled-default contract.\n */\nexport function maybeRunShadowValidation(input: ShadowValidationInput): undefined {\n if (input.mode === 'disabled') return undefined;\n return undefined;\n}\n","/**\n * Local receipt verification with schema validation\n *\n * Use this for verifying receipts when you have the public key locally,\n * without JWKS discovery.\n */\n\nimport { type VerificationStrictness, type VerificationWarning, HASH } from '@peac/kernel';\nimport { defaultCodec } from './_internal/record-core/codec/jws-jwt.js';\nimport {\n parseReceiptClaims,\n validateKernelConstraints,\n type Wire02Claims,\n checkOccurredAtSkew,\n sortWarnings,\n WARNING_TYP_MISSING,\n WARNING_TYPE_UNREGISTERED,\n WARNING_UNKNOWN_EXTENSION,\n WARNING_EXTENSION_GROUP_MISSING,\n WARNING_EXTENSION_GROUP_MISMATCH,\n REGISTERED_RECEIPT_TYPES,\n REGISTERED_EXTENSION_GROUP_KEYS,\n isValidExtensionKey,\n verifyPolicyBinding,\n} from '@peac/schema';\nimport { TYPE_TO_EXTENSION_MAP } from '@peac/kernel';\nimport { checkTypeExtensionMapping } from './type-extension-check';\nimport { maybeRunShadowValidation } from './_internal/record-core/shadow-hook';\nimport { runBoundedValidatorShadow } from './_internal/record-core/bounded-validator.js';\nimport { runBoundedValidationGate } from './_internal/record-core/validation-gate.js';\nimport { isShadowEnabled, scheduleShadow, type ShadowEnableOptions } from './_internal/shadow.js';\nimport { readLegacyPathFlag, type LegacyPathOptions } from './_internal/legacy-path.js';\nimport { ED25519_SIGNATURE_BYTES, ed25519SignatureByteLength } from './_internal/signature.js';\nimport {\n realObservationForVerifyLocalSuccess,\n shadowObservationFromBounded,\n type ShadowObservation,\n} from './_internal/shadow-observe.js';\nimport type { PolicyBindingStatus } from './verifier-types';\n\n/**\n * Structural type for CryptoError\n * Used instead of instanceof for robustness across ESM/CJS boundaries\n */\ninterface CryptoErrorLike {\n name: 'CryptoError';\n code: string;\n message: string;\n}\n\n/**\n * Structural check for CryptoError\n * More robust than instanceof across module boundaries (ESM/CJS, duplicate packages)\n */\nfunction isCryptoError(err: unknown): err is CryptoErrorLike {\n return (\n err !== null &&\n typeof err === 'object' &&\n 'name' in err &&\n err.name === 'CryptoError' &&\n 'code' in err &&\n typeof err.code === 'string' &&\n err.code.startsWith('CRYPTO_') &&\n 'message' in err &&\n typeof err.message === 'string'\n );\n}\n\n/**\n * Canonical error codes for local verification\n *\n * These map to E_* codes in specs/kernel/errors.json.\n * JOSE hardening codes (E_JWS_*) are distinct from generic E_INVALID_FORMAT\n * so callers can distinguish key-injection, compression, and crit attacks from\n * ordinary format errors (v0.12.0-preview.1).\n */\nexport type VerifyLocalErrorCode =\n | 'E_INVALID_SIGNATURE'\n | 'E_INVALID_FORMAT'\n | 'E_CONSTRAINT_VIOLATION'\n | 'E_EXPIRED'\n | 'E_NOT_YET_VALID'\n | 'E_INVALID_ISSUER'\n | 'E_INVALID_AUDIENCE'\n | 'E_INVALID_SUBJECT'\n | 'E_INVALID_RECEIPT_ID'\n | 'E_MISSING_EXP'\n | 'E_WIRE_VERSION_MISMATCH'\n | 'E_UNSUPPORTED_WIRE_VERSION'\n | 'E_OCCURRED_AT_FUTURE'\n // JOSE hardening codes (Wire 0.2, v0.12.0-preview.1)\n | 'E_JWS_EMBEDDED_KEY'\n | 'E_JWS_CRIT_REJECTED'\n | 'E_JWS_MISSING_KID'\n | 'E_JWS_B64_REJECTED'\n | 'E_JWS_ZIP_REJECTED'\n // Policy binding (Wire 0.2, v0.12.0-preview.1)\n | 'E_POLICY_BINDING_FAILED'\n // Type-to-extension enforcement (Wire 0.2, v0.12.2)\n | 'E_EXTENSION_GROUP_REQUIRED'\n | 'E_EXTENSION_GROUP_MISMATCH'\n // Raw-input I-JSON gate (RFC 7493): runs on raw header/payload bytes before parse\n | 'E_IJSON_DUPLICATE_MEMBER_NAME'\n | 'E_IJSON_NUMBER_OUT_OF_RANGE'\n | 'E_IJSON_INVALID_STRING'\n | 'E_INTERNAL';\n\n/**\n * Options for local verification\n */\nexport interface VerifyLocalOptions {\n /**\n * Expected issuer URL\n *\n * If provided, verification fails if receipt.iss does not match.\n */\n issuer?: string;\n\n /**\n * @deprecated Wire 0.2 does not have an `aud` claim. This option is ignored.\n * Retained for source compatibility during migration; will be removed in v1.0.\n */\n audience?: string;\n\n /**\n * Expected subject URI\n *\n * If provided, verification fails if receipt.sub does not match.\n * Binds the receipt to a specific resource/interaction target.\n */\n subjectUri?: string;\n\n /**\n * @deprecated Wire 0.2 does not have a `rid` claim. Use `jti` for receipt identification.\n * This option is ignored. Retained for source compatibility; will be removed in v1.0.\n */\n rid?: string;\n\n /**\n * @deprecated Wire 0.2 receipts do not expire (permanent evidence by design).\n * This option is ignored. Retained for source compatibility; will be removed in v1.0.\n */\n requireExp?: boolean;\n\n /**\n * Current timestamp (Unix seconds)\n *\n * Defaults to Date.now() / 1000. Override for testing.\n */\n now?: number;\n\n /**\n * Maximum clock skew tolerance (seconds)\n *\n * Allows for clock drift between issuer and verifier.\n * Defaults to 300 (5 minutes).\n */\n maxClockSkew?: number;\n\n /**\n * Verification strictness profile (v0.12.0-preview.1).\n *\n * - 'strict' (default): missing typ is a hard error before schema validation.\n * - 'interop': missing typ emits a 'typ_missing' warning and routes by payload content.\n *\n * Strictness is EXCLUSIVELY controlled here (@peac/protocol). @peac/crypto has no strictness param.\n */\n strictness?: VerificationStrictness;\n\n /**\n * Pre-computed local policy digest for policy binding (Wire 0.2, v0.12.0-preview.1).\n *\n * Must be in 'sha256:<64 lowercase hex>' format, computed via computePolicyDigestJcs()\n * from @peac/protocol. When provided alongside a receipt that contains a policy block\n * (policy.digest), the binding check is performed:\n * - Match: policy_binding = 'verified'\n * - Mismatch: hard fail with E_POLICY_BINDING_FAILED\n * - Either absent: policy_binding = 'unavailable'\n *\n * Always 'unavailable' for Wire 0.1 receipts regardless of this option.\n */\n policyDigest?: string;\n\n /**\n * Pre-computed document-binding results for transaction-local terms\n * and any other referenced documents (v0.12.14).\n *\n * Per-representation envelope binding (status) and any optional\n * publisher-supplied canonical-JSON digest comparison are computed by\n * the caller using the helpers in `document-binding.ts`. `verifyLocal`\n * surfaces the results on the report's `bindings` field exactly as\n * supplied; it never synthesizes envelope or canonical-digest\n * comparisons internally.\n *\n * `bindings.policy` is populated by `verifyLocal` itself from the\n * receipt's `policy.digest` and the `policyDigest` option. `bindings.terms`\n * is populated from `terms` here. `bindings.documents` is populated from\n * `documents` here. None of these fields appear on the emitted record\n * or envelope; they are verifier-report-only.\n */\n bindings?: {\n terms?: import('./verifier-types.js').DocumentBindingResult;\n documents?: import('./verifier-types.js').DocumentBindingResult[];\n };\n}\n\n/**\n * Result of successful local verification (Wire 0.2 only)\n *\n * Wire 0.1 receipts are no longer accepted by verifyLocal() and return\n * E_UNSUPPORTED_WIRE_VERSION. Re-issue as Wire 0.2 using issue().\n */\nexport interface VerifyLocalSuccess {\n /** Verification succeeded */\n valid: true;\n /** Receipt variant (always 'wire-02') */\n variant: 'wire-02';\n /** Validated Wire 0.2 receipt claims */\n claims: Wire02Claims;\n /** Key ID from JWS header (for logging/indexing) */\n kid: string;\n /** Wire format version */\n wireVersion: '0.2';\n /** Verification warnings from schema parsing and strictness routing */\n warnings: VerificationWarning[];\n /**\n * Policy binding status.\n *\n * Three-state result:\n * - 'unavailable': either the receipt contains no policy block, or the\n * caller did not pass a policyDigest option to verifyLocal(). No check.\n * - 'verified': both digests present and match exactly.\n * - 'failed': not returned on success; verifyLocal() returns\n * E_POLICY_BINDING_FAILED (valid: false) before reaching this field.\n *\n * This field is the byte-stable legacy mirror of `bindings.policy`.\n */\n policy_binding: PolicyBindingStatus;\n\n /**\n * Top-level bindings object (v0.12.14).\n *\n * `bindings.policy` is always present and equal to `policy_binding`.\n * `bindings.terms` is present iff the caller supplied terms inputs.\n * `bindings.documents` is present iff the caller supplied a non-empty\n * `documentDigests` array. `bindings.terms` and `bindings.documents`\n * appear in verifier output only; they are NOT stamped into the\n * emitted record / envelope / artifact shape.\n */\n bindings: import('./verifier-types.js').VerifierBindings;\n}\n\n/**\n * Result of failed local verification\n */\nexport interface VerifyLocalFailure {\n /** Verification failed */\n valid: false;\n\n /** Canonical error code (maps to specs/kernel/errors.json) */\n code: VerifyLocalErrorCode;\n\n /** Human-readable error message */\n message: string;\n\n /** Structured details for debugging (stable error code preserved in `code`) */\n details?: {\n /** Precise parse error code from unified parser (e.g. E_PARSE_COMMERCE_INVALID) */\n parse_code?: string;\n /** Zod validation issues (bounded, stable shape; non-normative, may change) */\n issues?: ReadonlyArray<{ path: string; message: string }>;\n /**\n * Policy digest from the receipt (present when code is E_POLICY_BINDING_FAILED).\n * Both are SHA-256 hashes; safe to log without leaking policy content.\n */\n receipt_policy_digest?: string;\n /** Caller-supplied policy digest (present when code is E_POLICY_BINDING_FAILED). */\n local_policy_digest?: string;\n /** policy.uri hint from the receipt (present when code is E_POLICY_BINDING_FAILED and uri set). */\n policy_uri?: string;\n /** Receipt type value (present when code is E_EXTENSION_GROUP_REQUIRED or E_EXTENSION_GROUP_MISMATCH). */\n type?: string;\n /** Expected extension group key for the receipt type. */\n expected_extension_group?: string;\n /** Registered extension groups actually present in extensions. */\n present_registered_extension_groups?: string[];\n };\n}\n\n/**\n * Union type for local verification result\n */\nexport type VerifyLocalResult = VerifyLocalSuccess | VerifyLocalFailure;\n\n/**\n * Internal CRYPTO_* codes that map to generic E_INVALID_FORMAT.\n * These are format/encoding errors not security-specific.\n */\nconst FORMAT_ERROR_CODES = new Set([\n 'CRYPTO_INVALID_JWS_FORMAT',\n 'CRYPTO_INVALID_TYP',\n 'CRYPTO_INVALID_ALG',\n 'CRYPTO_INVALID_KEY_LENGTH',\n]);\n\n/**\n * JOSE hardening code mapping: CRYPTO_JWS_* → specific E_JWS_* (v0.12.0-preview.1).\n *\n * Each JOSE hazard code maps to its specific public E_JWS_* counterpart rather than\n * collapsing into the generic E_INVALID_FORMAT. This lets callers distinguish embedded-key\n * injection, crit-header abuse, and unencoded-payload attacks from ordinary format errors.\n */\nconst JOSE_CODE_MAP: Record<string, VerifyLocalErrorCode> = {\n CRYPTO_JWS_EMBEDDED_KEY: 'E_JWS_EMBEDDED_KEY',\n CRYPTO_JWS_CRIT_REJECTED: 'E_JWS_CRIT_REJECTED',\n CRYPTO_JWS_MISSING_KID: 'E_JWS_MISSING_KID',\n CRYPTO_JWS_B64_REJECTED: 'E_JWS_B64_REJECTED',\n CRYPTO_JWS_ZIP_REJECTED: 'E_JWS_ZIP_REJECTED',\n // Raw-input I-JSON gate (RFC 7493): specific E_IJSON_* codes so callers can\n // distinguish duplicate member names, out-of-range numbers, and invalid\n // strings from ordinary format errors. (Generic JSON syntax errors from the\n // gate use CRYPTO_INVALID_JWS_FORMAT -> E_INVALID_FORMAT via FORMAT_ERROR_CODES.)\n CRYPTO_IJSON_DUPLICATE_MEMBER_NAME: 'E_IJSON_DUPLICATE_MEMBER_NAME',\n CRYPTO_IJSON_NUMBER_OUT_OF_RANGE: 'E_IJSON_NUMBER_OUT_OF_RANGE',\n CRYPTO_IJSON_INVALID_STRING: 'E_IJSON_INVALID_STRING',\n};\n\n/** Max parse issues to include in details (prevents log bloat) */\nconst MAX_PARSE_ISSUES = 25;\n\n/**\n * Sanitize Zod issues into a bounded, stable structure.\n * Avoids exposing raw Zod internals or unbounded arrays in the public API.\n */\nfunction sanitizeParseIssues(\n issues: unknown\n): ReadonlyArray<{ path: string; message: string }> | undefined {\n if (!Array.isArray(issues)) return undefined;\n return issues.slice(0, MAX_PARSE_ISSUES).map((issue) => ({\n path: Array.isArray(issue?.path) ? issue.path.join('.') : '',\n message: typeof issue?.message === 'string' ? issue.message : String(issue),\n }));\n}\n\n/**\n * Verify a Wire 0.2 PEAC receipt locally with a known public key.\n *\n * Wire 0.2 only: Wire 0.1 receipts return E_UNSUPPORTED_WIRE_VERSION.\n * Re-issue Wire 0.1 receipts as Wire 0.2 using issueWire02().\n *\n * This function:\n * 1. Verifies the Ed25519 signature and header (typ, alg)\n * 2. Applies strictness routing for missing typ (strict: hard error; interop: warning)\n * 3. Validates the receipt schema with Zod (Wire 0.2 only)\n * 4. Checks issuer/subject binding (if options provided)\n * 5. Checks time validity (iat with clock skew tolerance)\n * 6. Checks occurred_at skew and collects parse warnings\n *\n * @param jws - JWS compact serialization\n * @param publicKey - Ed25519 public key (32 bytes)\n * @param options - Optional verification options (issuer, subject, clock skew, strictness, policyDigest)\n * @returns Typed verification result\n *\n * @example\n * ```typescript\n * const result = await verifyLocal(jws, publicKey, {\n * issuer: 'https://api.example.com',\n * strictness: 'strict',\n * });\n * if (result.valid) {\n * console.log('Kind:', result.claims.kind);\n * console.log('Warnings:', result.warnings);\n * }\n * ```\n */\nexport async function verifyLocal(\n jws: string,\n publicKey: Uint8Array,\n options: VerifyLocalOptions = {}\n): Promise<VerifyLocalResult> {\n // Internal rollback-path flag. Selects the bounded validation\n // admission gate (default) or the inline canonical sequence\n // (rollback). Both branches share the post-admission flow: caller-\n // option binding, temporal checks, type-extension enforcement,\n // policy-binding compute, bindings construction, sortWarnings.\n const legacyPath = readLegacyPathFlag(options as unknown as LegacyPathOptions);\n\n const {\n issuer,\n subjectUri,\n maxClockSkew = 300,\n strictness = 'strict',\n policyDigest,\n bindings: callerBindings,\n } = options;\n const now = options.now ?? Math.floor(Date.now() / 1000);\n\n try {\n // 1. Verify signature and header via the internal codec boundary\n // (typ, alg validated by @peac/crypto). Default codec is a pure\n // pass-through to @peac/crypto.verify; the returned VerifyResult is\n // byte-identical to the prior release for every fixture. Format errors\n // (bad typ/header/JSON) are thrown as typed CryptoErrors and handled in\n // the catch below (format-first), so the length discrimination here runs\n // only on a well-formed JWS whose signature simply failed to verify.\n const result = await defaultCodec.decode<unknown>(jws, publicKey);\n\n if (!result.valid) {\n // The Ed25519 verifier rejects a wrong-length signature by returning\n // false (it no longer throws); distinguish that specifically from a\n // genuine signature mismatch, matching verifyReceipt() in verify.ts.\n const signatureBytes = ed25519SignatureByteLength(jws);\n const invalidLength = signatureBytes !== null && signatureBytes !== ED25519_SIGNATURE_BYTES;\n return {\n valid: false,\n code: 'E_INVALID_SIGNATURE',\n message: invalidLength\n ? 'Ed25519 signature has invalid length'\n : 'Ed25519 signature verification failed',\n };\n }\n\n // Accumulated warnings for Wire 0.2 path\n const accumulatedWarnings: VerificationWarning[] = [];\n\n // 2. Strictness routing for missing typ (Correction 1)\n if (result.header.typ === undefined) {\n if (strictness === 'strict') {\n return {\n valid: false,\n code: 'E_INVALID_FORMAT',\n message: 'Missing JWS typ header: strict mode requires typ to be present',\n };\n }\n // interop mode: emit warning and continue\n accumulatedWarnings.push({\n code: WARNING_TYP_MISSING,\n message: 'JWS typ header is absent; accepted in interop mode',\n });\n }\n\n // 3-5. Admission: kernel constraints, schema parse, parser warnings.\n //\n // The default branch routes through the bounded validation gate,\n // which surfaces canonical-equivalent E_CONSTRAINT_VIOLATION /\n // E_INVALID_FORMAT / E_UNSUPPORTED_WIRE_VERSION verdicts on\n // rejection and the parsed Wire 0.2 claims plus parser warnings\n // on acceptance. The rollback branch retains the inline canonical\n // sequence (validateKernelConstraints + parseReceiptClaims). Both\n // branches feed the same post-admission flow.\n type AdmittedClaims = {\n readonly ok: true;\n readonly wireVersion: '0.1' | '0.2';\n readonly warnings: readonly VerificationWarning[];\n readonly claims: unknown;\n };\n let pr: AdmittedClaims;\n\n if (legacyPath) {\n const constraintResult = validateKernelConstraints(result.payload);\n if (!constraintResult.valid) {\n const v = constraintResult.violations[0];\n return {\n valid: false,\n code: 'E_CONSTRAINT_VIOLATION',\n message: `Kernel constraint violated: ${v.constraint} (actual: ${v.actual}, limit: ${v.limit})`,\n };\n }\n const parsed = parseReceiptClaims(result.payload);\n if (!parsed.ok) {\n return {\n valid: false,\n code: 'E_INVALID_FORMAT',\n message: `Receipt schema validation failed: ${parsed.error.message}`,\n details: {\n parse_code: parsed.error.code,\n issues: sanitizeParseIssues(parsed.error.issues),\n },\n };\n }\n pr = parsed;\n } else {\n const gateResult = runBoundedValidationGate({\n surface: 'verifyLocal',\n payload: result.payload,\n });\n if (!gateResult.ok) {\n return {\n valid: false,\n code: gateResult.code as VerifyLocalErrorCode,\n message: gateResult.message,\n ...(gateResult.details !== undefined && { details: gateResult.details }),\n };\n }\n const parsedFromGate = gateResult.parsed;\n if (parsedFromGate === undefined) {\n return {\n valid: false,\n code: 'E_INTERNAL',\n message: 'Bounded validation gate accepted without surfacing parsed claims',\n };\n }\n pr = {\n ok: true,\n wireVersion: parsedFromGate.wireVersion,\n warnings: parsedFromGate.parserWarnings,\n claims: parsedFromGate.claims,\n };\n }\n\n // Collect parser warnings (Wire 0.2 parser may emit type/extension warnings).\n if (pr.wireVersion === '0.2') {\n accumulatedWarnings.push(...pr.warnings);\n }\n\n // Wire 0.2 path\n if (pr.wireVersion === '0.2') {\n const claims = pr.claims as Wire02Claims;\n\n // Inert shadow-call boundary (default disabled in v0.13.1; PR D\n // wires the actual flag plumbing). The hook returns undefined\n // and never affects control flow or result; this call is a\n // structural placeholder so PR D can extend the boundary\n // without touching this file again.\n maybeRunShadowValidation({ mode: 'disabled', claims });\n\n // Issuer check\n if (issuer !== undefined && claims.iss !== issuer) {\n return {\n valid: false,\n code: 'E_INVALID_ISSUER',\n message: `Issuer mismatch: expected \"${issuer}\", got \"${claims.iss}\"`,\n };\n }\n\n // Subject check\n if (subjectUri !== undefined && claims.sub !== subjectUri) {\n return {\n valid: false,\n code: 'E_INVALID_SUBJECT',\n message: `Subject mismatch: expected \"${subjectUri}\", got \"${claims.sub ?? 'undefined'}\"`,\n };\n }\n\n // iat: not-yet-valid check (with clock skew)\n if (claims.iat > now + maxClockSkew) {\n return {\n valid: false,\n code: 'E_NOT_YET_VALID',\n message: `Receipt not yet valid: issued at ${new Date(claims.iat * 1000).toISOString()}, now is ${new Date(now * 1000).toISOString()}`,\n };\n }\n\n // occurred_at skew check (evidence kind only)\n if (claims.kind === 'evidence') {\n const skewResult = checkOccurredAtSkew(claims.occurred_at, claims.iat, now, maxClockSkew);\n if (skewResult === 'future_error') {\n return {\n valid: false,\n code: 'E_OCCURRED_AT_FUTURE',\n message: `occurred_at is in the future beyond tolerance (${maxClockSkew}s)`,\n };\n }\n if (skewResult !== null) {\n accumulatedWarnings.push(skewResult);\n }\n }\n\n // Emit type_unregistered warning for valid-but-unregistered type values\n if (!REGISTERED_RECEIPT_TYPES.has(claims.type)) {\n accumulatedWarnings.push({\n code: WARNING_TYPE_UNREGISTERED,\n message: 'Receipt type is not in the recommended type registry',\n pointer: '/type',\n });\n }\n\n // Emit unknown_extension_preserved warnings for unrecognized-but-well-formed keys\n // Malformed keys are already hard errors (E_INVALID_EXTENSION_KEY) at schema layer.\n if (claims.extensions !== undefined) {\n for (const key of Object.keys(claims.extensions)) {\n if (!REGISTERED_EXTENSION_GROUP_KEYS.has(key) && isValidExtensionKey(key)) {\n // RFC 6901: '~' -> '~0', '/' -> '~1'\n const escapedKey = key.replace(/~/g, '~0').replace(/\\//g, '~1');\n accumulatedWarnings.push({\n code: WARNING_UNKNOWN_EXTENSION,\n message: 'Unknown extension key preserved without schema validation',\n pointer: `/extensions/${escapedKey}`,\n });\n }\n }\n }\n\n // Type-to-extension enforcement: check that the expected extension group is present\n const typeExtCheck = checkTypeExtensionMapping(\n claims.kind,\n claims.type,\n claims.extensions,\n TYPE_TO_EXTENSION_MAP,\n REGISTERED_EXTENSION_GROUP_KEYS\n );\n\n if (typeExtCheck.status === 'missing' || typeExtCheck.status === 'mismatch') {\n const warningCode =\n typeExtCheck.status === 'missing'\n ? WARNING_EXTENSION_GROUP_MISSING\n : WARNING_EXTENSION_GROUP_MISMATCH;\n const errorCode =\n typeExtCheck.status === 'missing'\n ? 'E_EXTENSION_GROUP_REQUIRED'\n : 'E_EXTENSION_GROUP_MISMATCH';\n\n if (strictness === 'strict') {\n return {\n valid: false,\n code: errorCode,\n message: `Type \"${claims.type}\" expects extension group \"${typeExtCheck.expected_extension_group}\" but it is ${typeExtCheck.status === 'mismatch' ? 'replaced by a different registered group' : 'absent'}`,\n details: {\n type: claims.type,\n expected_extension_group: typeExtCheck.expected_extension_group,\n present_registered_extension_groups: typeExtCheck.present_registered_extension_groups,\n },\n };\n }\n\n // Interop mode: emit warning, continue verification\n accumulatedWarnings.push({\n code: warningCode,\n message: `Type \"${claims.type}\" expects extension group \"${typeExtCheck.expected_extension_group}\"`,\n pointer: '/type',\n });\n }\n\n // Validate policyDigest option format: must be sha256:<64 lowercase hex> if provided.\n if (policyDigest !== undefined && !HASH.pattern.test(policyDigest)) {\n return {\n valid: false,\n code: 'E_INVALID_FORMAT',\n message: 'policyDigest option must be in sha256:<64 lowercase hex> format',\n };\n }\n\n // Policy binding check: 3-state result.\n // 'unavailable' when either receipt has no policy block or caller omitted policyDigest.\n // 'verified' / 'failed' when both are present; 'failed' is a hard verification error.\n const receiptPolicyDigest = claims.policy?.digest;\n const bindingStatus: PolicyBindingStatus =\n receiptPolicyDigest === undefined || policyDigest === undefined\n ? 'unavailable'\n : verifyPolicyBinding(receiptPolicyDigest, policyDigest);\n if (bindingStatus === 'failed') {\n return {\n valid: false,\n code: 'E_POLICY_BINDING_FAILED',\n message: 'Policy binding check failed: receipt policy digest does not match local policy',\n details: {\n receipt_policy_digest: receiptPolicyDigest,\n local_policy_digest: policyDigest,\n ...(claims.policy?.uri !== undefined && { policy_uri: claims.policy.uri }),\n },\n };\n }\n\n // Build the top-level `bindings` object. `policy` always present and\n // mirrors the legacy `policy_binding` field byte-stable. `terms` and\n // `documents` are surfaced from caller-supplied results; verifyLocal\n // does not synthesize envelope or canonical-digest comparisons here.\n // Report-only; never stamped into emitted record / envelope shape.\n const bindings: import('./verifier-types.js').VerifierBindings = {\n policy: bindingStatus,\n ...(callerBindings?.terms !== undefined && { terms: callerBindings.terms }),\n ...(callerBindings?.documents !== undefined &&\n callerBindings.documents.length > 0 && { documents: callerBindings.documents }),\n };\n\n const sortedWarnings = sortWarnings(accumulatedWarnings);\n\n // Shadow scheduling fires only on the rollback branch where the\n // bounded validator is genuinely a comparison path. Under the\n // default branch the gate runs as the production admission\n // path, so a duplicate shadow run would compare the same code\n // path against itself.\n if (legacyPath && isShadowEnabled(options as unknown as ShadowEnableOptions)) {\n const headerSnapshot = { ...result.header } as Record<string, unknown>;\n scheduleShadow<ShadowObservation>({\n call: 'verifyLocal',\n realResult: realObservationForVerifyLocalSuccess(sortedWarnings),\n realError: undefined,\n shadowFn: async () =>\n shadowObservationFromBounded(\n runBoundedValidatorShadow({\n claims: {\n kind: claims.kind,\n type: claims.type,\n iss: claims.iss,\n iat: claims.iat,\n occurred_at: claims.occurred_at,\n extensions: claims.extensions,\n },\n header: headerSnapshot,\n now,\n })\n ),\n recordRef: jws,\n });\n }\n\n return {\n valid: true,\n variant: 'wire-02',\n claims,\n kid: result.header.kid,\n wireVersion: '0.2',\n warnings: sortedWarnings,\n policy_binding: bindingStatus,\n bindings,\n };\n }\n\n // Wire 0.1 receipts: reject with E_UNSUPPORTED_WIRE_VERSION.\n return {\n valid: false,\n code: 'E_UNSUPPORTED_WIRE_VERSION',\n message: 'Wire 0.1 receipts are not supported. Re-issue as Wire 0.2 using issue().',\n };\n } catch (err) {\n // Handle typed CryptoError from @peac/crypto\n // Use structural check instead of instanceof for robustness across ESM/CJS boundaries\n // Map internal CRYPTO_* codes to canonical E_* codes.\n // JOSE hardening codes get specific E_JWS_* (not generic E_INVALID_FORMAT) so callers\n // can distinguish key-injection attacks from ordinary encoding errors.\n if (isCryptoError(err)) {\n // 1. JOSE hardening: specific E_JWS_* codes (checked first)\n if (Object.prototype.hasOwnProperty.call(JOSE_CODE_MAP, err.code)) {\n return {\n valid: false,\n code: JOSE_CODE_MAP[err.code]!,\n message: err.message,\n };\n }\n // 2. Generic format errors\n if (FORMAT_ERROR_CODES.has(err.code)) {\n return {\n valid: false,\n code: 'E_INVALID_FORMAT',\n message: err.message,\n };\n }\n if (err.code === 'CRYPTO_INVALID_SIGNATURE') {\n return {\n valid: false,\n code: 'E_INVALID_SIGNATURE',\n message: err.message,\n };\n }\n if (err.code === 'CRYPTO_WIRE_VERSION_MISMATCH') {\n return {\n valid: false,\n code: 'E_WIRE_VERSION_MISMATCH',\n message: err.message,\n };\n }\n }\n\n // Handle JSON parse errors from malformed payloads\n // Use structural check for cross-boundary robustness (consistent with isCryptoError pattern)\n if (\n err !== null &&\n typeof err === 'object' &&\n 'name' in err &&\n (err as { name: unknown }).name === 'SyntaxError'\n ) {\n const syntaxMessage =\n 'message' in err && typeof (err as { message: unknown }).message === 'string'\n ? (err as { message: string }).message\n : 'Invalid JSON';\n return {\n valid: false,\n code: 'E_INVALID_FORMAT',\n message: `Invalid receipt payload: ${syntaxMessage}`,\n };\n }\n\n // Defense in depth: a wrong-length Ed25519 signature is rejected on the\n // happy path (the verifier returns false and the !result.valid branch above\n // classifies it). Should any verifier error nonetheless reach here, classify\n // a wrong-length signature deterministically as an invalid signature rather\n // than letting it fall through to E_INTERNAL. Typed format errors are\n // handled earlier, so a malformed header/payload still maps to\n // E_INVALID_FORMAT (format-first).\n const signatureBytes = ed25519SignatureByteLength(jws);\n if (signatureBytes !== null && signatureBytes !== ED25519_SIGNATURE_BYTES) {\n return {\n valid: false,\n code: 'E_INVALID_SIGNATURE',\n message: 'Ed25519 signature has invalid length',\n };\n }\n\n // All other errors -> E_INTERNAL\n // No message parsing - code-based mapping only; do not surface raw\n // exception text to callers (avoids leaking internal paths/state).\n return {\n valid: false,\n code: 'E_INTERNAL',\n message: 'Unexpected verification error.',\n };\n }\n}\n\n/**\n * @deprecated Removed: verifyLocal() is Wire 0.2 only and always returns variant 'wire-02'.\n * This guard always returns false. Remove usage and use isWire02Result() instead.\n */\nexport function isCommerceResult(\n r: VerifyLocalResult\n): r is VerifyLocalSuccess & { variant: 'wire-02' } {\n // Always false: verifyLocal() only returns variant 'wire-02'\n return false;\n}\n\n/**\n * @deprecated Removed: verifyLocal() is Wire 0.2 only and always returns variant 'wire-02'.\n * This guard always returns false. Remove usage and use isWire02Result() instead.\n */\nexport function isAttestationResult(\n r: VerifyLocalResult\n): r is VerifyLocalSuccess & { variant: 'wire-02' } {\n // Always false: verifyLocal() only returns variant 'wire-02'\n return false;\n}\n\n/**\n * Type guard: narrows a VerifyLocalResult to a Wire 0.2 success (v0.12.0-preview.1).\n *\n * Use instead of manual `result.valid && result.variant === 'wire-02'` checks\n * to get proper claims narrowing to Wire02Claims.\n */\nexport function isWire02Result(\n r: VerifyLocalResult\n): r is VerifyLocalSuccess & { variant: 'wire-02' } {\n return r.valid === true && r.variant === 'wire-02';\n}\n","/**\n * HTTP header utilities for PEAC receipts and purpose\n */\n\nimport {\n PEAC_RECEIPT_HEADER,\n PEAC_PURPOSE_HEADER,\n PEAC_PURPOSE_APPLIED_HEADER,\n PEAC_PURPOSE_REASON_HEADER,\n parsePurposeHeader,\n type PurposeToken,\n type CanonicalPurpose,\n type PurposeReason,\n} from '@peac/schema';\n\n/**\n * Set PEAC-Receipt header on a response\n *\n * @param headers - Headers object (e.g., Response.headers)\n * @param receiptJws - JWS compact serialization\n */\nexport function setReceiptHeader(headers: Headers, receiptJws: string): void {\n headers.set(PEAC_RECEIPT_HEADER, receiptJws);\n}\n\n/**\n * Get PEAC-Receipt header from a request/response\n *\n * @param headers - Headers object\n * @returns JWS compact serialization, or null if not present\n */\nexport function getReceiptHeader(headers: Headers): string | null {\n return headers.get(PEAC_RECEIPT_HEADER);\n}\n\n/**\n * Set Vary: PEAC-Receipt header for caching\n *\n * @param headers - Response headers\n */\nexport function setVaryHeader(headers: Headers): void {\n const existing = headers.get('Vary');\n if (existing) {\n // Append to existing Vary header\n const varies = existing.split(',').map((v) => v.trim());\n if (!varies.includes(PEAC_RECEIPT_HEADER)) {\n headers.set('Vary', `${existing}, ${PEAC_RECEIPT_HEADER}`);\n }\n } else {\n headers.set('Vary', PEAC_RECEIPT_HEADER);\n }\n}\n\n// -----------------------------------------------------------------------------\n// Purpose Header Utilities (v0.9.24+)\n// -----------------------------------------------------------------------------\n\n/**\n * Get PEAC-Purpose header from a request\n *\n * Parses the comma-separated purpose token list into an array.\n * Normalizes tokens (lowercase, trim whitespace), deduplicates.\n *\n * @param headers - Request headers\n * @returns Array of normalized PurposeToken values, empty if header missing\n */\nexport function getPurposeHeader(headers: Headers): PurposeToken[] {\n const value = headers.get(PEAC_PURPOSE_HEADER);\n if (!value) {\n return [];\n }\n return parsePurposeHeader(value);\n}\n\n/**\n * Set PEAC-Purpose-Applied header on a response\n *\n * Indicates which purpose(s) were enforced for this request.\n *\n * @param headers - Response headers\n * @param purpose - Single canonical purpose that was enforced\n */\nexport function setPurposeAppliedHeader(headers: Headers, purpose: CanonicalPurpose): void {\n headers.set(PEAC_PURPOSE_APPLIED_HEADER, purpose);\n}\n\n/**\n * Set PEAC-Purpose-Reason header on a response\n *\n * Explains WHY the purpose was enforced as it was (audit trail).\n *\n * @param headers - Response headers\n * @param reason - Purpose reason enum value\n */\nexport function setPurposeReasonHeader(headers: Headers, reason: PurposeReason): void {\n headers.set(PEAC_PURPOSE_REASON_HEADER, reason);\n}\n\n/**\n * Set Vary: PEAC-Purpose header for caching\n *\n * If response behavior varies by declared purpose, MUST set this header.\n *\n * @param headers - Response headers\n */\nexport function setVaryPurposeHeader(headers: Headers): void {\n const existing = headers.get('Vary');\n if (existing) {\n const varies = existing.split(',').map((v) => v.trim());\n if (!varies.includes(PEAC_PURPOSE_HEADER)) {\n headers.set('Vary', `${existing}, ${PEAC_PURPOSE_HEADER}`);\n }\n } else {\n headers.set('Vary', PEAC_PURPOSE_HEADER);\n }\n}\n","/**\n * Document binding utilities (Layer 3)\n *\n * Generalized binding helpers for `peac-policy/0.1` policy documents,\n * x402 PR #1986 `terms` representations, and any other referenced\n * document. Three-state semantics (`verified` / `failed` / `unavailable`)\n * are reused from `policy-binding`.\n *\n * Helper-naming rule (normative, see `docs/specs/DOCUMENT-BINDING.md`):\n * - `computeJsonDocumentDigestJcs` is JSON-only (RFC 8785 JCS + SHA-256).\n * - `computeTextDocumentDigestUtf8` is text-only (UTF-8 with `\\n` line\n * endings + NFC, preserving all other bytes including trailing\n * whitespace).\n * - `computeDocumentDigest` is the umbrella dispatcher.\n *\n * The `Jcs` suffix is reserved for JSON-only helpers; text-only helpers\n * name their scheme. This prevents the `aipref/resolver.ts` historical\n * bug where a sort-keys `JSON.stringify` digest was labelled `JCS-SHA256`.\n *\n * The `policy_binding` field on the verifier report is the byte-stable\n * legacy mirror of `bindings.policy`; both are populated identically.\n *\n * @see docs/specs/DOCUMENT-BINDING.md\n * @see packages/protocol/src/policy-binding.ts\n */\n\nimport { jcsHash } from '@peac/crypto';\nimport { HASH } from '@peac/kernel';\nimport type { JsonValue } from '@peac/kernel';\nimport type { PolicyBindingStatus } from './verifier-types.js';\nimport { verifyPolicyBinding } from '@peac/schema';\n\nexport type DocumentRepresentation = 'uri' | 'markdown' | 'plaintext' | 'json';\n\n/**\n * Compute the RFC 8785 JCS canonicalization + SHA-256 digest of a JSON\n * document. Returns the canonical PEAC self-describing hash format\n * `'sha256:<64 lowercase hex>'`. Suitable for `peac-policy/0.1` policy\n * docs and any other JSON-shaped document carried in or referenced from\n * a record.\n */\nexport async function computeJsonDocumentDigestJcs(value: JsonValue): Promise<string> {\n const hex = await jcsHash(value);\n return `${HASH.prefix}${hex}`;\n}\n\n/**\n * Compute the SHA-256 digest of a UTF-8 text document after the minimal\n * canonical normalization documented in `docs/specs/DOCUMENT-BINDING.md`:\n *\n * 1. Normalize line endings to `\\n` (strip `\\r` before `\\n`; replace a\n * lone `\\r` with `\\n`).\n * 2. Normalize Unicode to NFC.\n * 3. Preserve all other bytes exactly.\n *\n * Trailing whitespace is **not** stripped. Blank lines are **not**\n * collapsed. Case is **not** normalized. The intent is a deterministic\n * representation envelope identity, not a \"pretty-print before hashing\"\n * scheme. Text representations like `markdown` and `plaintext` are\n * frequently signed by publishers, and silent transformations would\n * break those signatures.\n *\n * Returns the canonical PEAC self-describing hash format\n * `'sha256:<64 lowercase hex>'`.\n *\n * @param bytes UTF-8 string to hash (single representation envelope).\n * @param representation Tag recorded by the caller; not currently\n * altering the hash but reserved so future representation-specific\n * normalization rules can be added without renaming the helper.\n */\nexport async function computeTextDocumentDigestUtf8(\n bytes: string,\n _representation: 'markdown' | 'plaintext'\n): Promise<string> {\n const normalized = bytes.replace(/\\r\\n/g, '\\n').replace(/\\r/g, '\\n').normalize('NFC');\n const buf = new TextEncoder().encode(normalized);\n const hashBuffer = await crypto.subtle.digest('SHA-256', buf);\n const hashArray = Array.from(new Uint8Array(hashBuffer));\n const hex = hashArray.map((b) => b.toString(16).padStart(2, '0')).join('');\n return `${HASH.prefix}${hex}`;\n}\n\n/**\n * Umbrella dispatcher. Selects the correct scheme-specific helper from\n * `input.representation`.\n *\n * For `representation: 'uri'`, the bytes the caller fetched from the URI\n * MUST be supplied via `bytes`. Without bytes the dispatcher returns\n * `'unavailable'`: the URI alone is not enough to bind, and PEAC does\n * not perform network I/O from this layer (callers fetch under their own\n * SSRF / redirect / timeout policy). When bytes are supplied for a URI,\n * they are hashed via the text helper.\n */\nexport async function computeDocumentDigest(\n input:\n | { representation: 'json'; value: JsonValue }\n | { representation: 'markdown' | 'plaintext'; bytes: string }\n | { representation: 'uri'; uri: string; bytes?: string }\n): Promise<string | 'unavailable'> {\n switch (input.representation) {\n case 'json':\n return computeJsonDocumentDigestJcs(input.value);\n case 'markdown':\n case 'plaintext':\n return computeTextDocumentDigestUtf8(input.bytes, input.representation);\n case 'uri':\n if (typeof input.bytes !== 'string') return 'unavailable';\n return computeTextDocumentDigestUtf8(input.bytes, 'plaintext');\n }\n}\n\n/**\n * Three-state binding check. Same semantics as `checkPolicyBinding`:\n *\n * - `'unavailable'` when either digest is missing.\n * - `'verified'` when both digests are present and match exactly.\n * - `'failed'` when both digests are present but do not match.\n *\n * The legacy `checkPolicyBinding` export delegates to this function.\n */\nexport function checkDocumentBinding(\n receiptDigest: string | undefined,\n localDigest: string | undefined\n): PolicyBindingStatus {\n if (receiptDigest === undefined || localDigest === undefined) {\n return 'unavailable';\n }\n return verifyPolicyBinding(receiptDigest, localDigest);\n}\n","/**\n * Policy binding utilities (Layer 3)\n *\n * Thin delegate over `document-binding.ts`. Preserves the pre-v0.12.14\n * API surface (`computePolicyDigestJcs`, `checkPolicyBinding`) with\n * byte-identical output. New callers should prefer the generalized\n * helpers in `document-binding.ts`.\n *\n * The pure string comparison (`verifyPolicyBinding`) lives in Layer 1\n * (`@peac/schema`) so consumers that only need to check pre-computed\n * digests do not pull in protocol-level dependencies.\n *\n * @see packages/protocol/src/document-binding.ts\n * @see docs/specs/DOCUMENT-BINDING.md\n */\n\nimport type { JsonValue } from '@peac/kernel';\nimport type { PolicyBindingStatus } from './verifier-types.js';\nimport { checkDocumentBinding, computeJsonDocumentDigestJcs } from './document-binding.js';\n\n/**\n * Compute the JCS+SHA-256 digest of a policy object.\n *\n * Canonicalizes the policy value via RFC 8785 (JSON Canonicalization\n * Scheme), computes SHA-256 over the resulting UTF-8 bytes, and returns\n * the result in the PEAC self-describing hash format\n * `'sha256:<64 lowercase hex>'`.\n *\n * This is the normative digest format for the policy.digest field in\n * Wire 0.2 records. The format is stable and identical across\n * implementations. Output is byte-identical to\n * `computeJsonDocumentDigestJcs(policy)` from `document-binding.ts`.\n *\n * Callers MUST pass the same JSON structure that was embedded in the\n * receipt's policy block when issuing. Key order is irrelevant; JCS\n * normalizes it.\n *\n * @param policy - Policy value (any JSON-serializable value)\n * @returns Digest string in 'sha256:<64 lowercase hex>' format\n * @throws Error if the value cannot be canonicalized (e.g., contains\n * functions or non-finite numbers)\n */\nexport async function computePolicyDigestJcs(policy: JsonValue): Promise<string> {\n return computeJsonDocumentDigestJcs(policy);\n}\n\n/**\n * Compute the 3-state policy binding result.\n *\n * Three-state semantics:\n * - `'unavailable'`: either digest is absent (receipt has no policy\n * block, or caller did not provide a local digest). No binding\n * check performed.\n * - `'verified'`: both digests present and match exactly.\n * - `'failed'`: both digests present but do not match.\n *\n * When the result is `'failed'`, `verifyLocal()` returns\n * `E_POLICY_BINDING_FAILED` as a hard verification error.\n *\n * Output is byte-identical to `checkDocumentBinding` from\n * `document-binding.ts`.\n *\n * @param receiptDigest - policy.digest from the receipt claims; undefined if\n * the receipt contains no policy block\n * @param localDigest - digest computed from the caller's local policy bytes via\n * `computePolicyDigestJcs()`; undefined if the caller has no policy to check\n * @returns Three-state PolicyBindingStatus\n */\nexport function checkPolicyBinding(\n receiptDigest: string | undefined,\n localDigest: string | undefined\n): PolicyBindingStatus {\n return checkDocumentBinding(receiptDigest, localDigest);\n}\n","/**\n * PEAC Verifier Types\n *\n * Types for verification policy, trust pinning, and verification reports\n * per VERIFIER-SECURITY-MODEL.md, TRUST-PINNING-POLICY.md, and\n * VERIFICATION-REPORT-FORMAT.md\n *\n * @packageDocumentation\n */\n\nimport {\n VERIFIER_LIMITS,\n VERIFIER_NETWORK,\n VERIFIER_POLICY_VERSION,\n VERIFICATION_REPORT_VERSION,\n} from '@peac/kernel';\n\n// ---------------------------------------------------------------------------\n// Policy Binding\n// ---------------------------------------------------------------------------\n\n/**\n * Three-state policy binding status\n *\n * - 'verified': Policy digest in receipt matches local policy bytes (Wire 0.2+)\n * - 'failed': Policy digest mismatch (Wire 0.2+)\n * - 'unavailable': No policy digest in receipt or no policy bytes available.\n * Always 'unavailable' for Wire 0.1 receipts.\n */\nexport type PolicyBindingStatus = 'verified' | 'failed' | 'unavailable';\n\n// ---------------------------------------------------------------------------\n// Document Binding (terms / policy / referenced documents)\n// ---------------------------------------------------------------------------\n\n/**\n * Representation envelope tag for a bound document. Matches the four\n * x402 PR #1986 `terms` representations and is shared by other binding\n * paths (policy docs, referenced documents).\n */\nexport type DocumentRepresentation = 'uri' | 'markdown' | 'plaintext' | 'json';\n\n/**\n * Result of a document-binding check.\n *\n * `status` carries the three-state outcome for the per-representation\n * envelope binding. `canonical_digest` and `canonical_digest_status` are\n * **publisher-supplied only**: a publisher MAY assert a canonical-JSON\n * digest that they consider equivalent across multiple representations.\n * Verifiers MAY compare it when both sides supply it; verifiers MUST\n * NOT synthesize it from non-JSON representations. Absence is\n * `'unavailable'`, NOT `'failed'`.\n *\n * @see docs/specs/DOCUMENT-BINDING.md\n */\nexport interface DocumentBindingResult {\n /** Caller-supplied identifier (free-form; useful when reporting multiple documents). */\n ref: string;\n /** Representation envelope this binding refers to. */\n representation?: DocumentRepresentation;\n /** Per-representation envelope binding status. */\n status: PolicyBindingStatus;\n /**\n * Publisher-supplied canonical-JSON digest (`sha256:<64 hex>`).\n * Verifiers compare only when both sides supply it; verifiers MUST\n * NOT synthesize from non-JSON representations.\n */\n canonical_digest?: string;\n /** Three-state outcome for the optional canonical-digest comparison. */\n canonical_digest_status?: PolicyBindingStatus;\n}\n\n/**\n * Top-level `bindings` object on the verifier report. `policy` is always\n * present (mirrors the legacy top-level `policy_binding` field\n * byte-stable). `terms` is present iff the caller supplied a terms\n * digest; `documents` is present iff the caller supplied a list of\n * document digests.\n *\n * `bindings.terms` and `bindings.documents` appear in the verifier\n * report output only; they are NOT stamped into the emitted record /\n * envelope / artifact shape.\n */\nexport interface VerifierBindings {\n policy: PolicyBindingStatus;\n terms?: DocumentBindingResult;\n documents?: DocumentBindingResult[];\n}\n\n// ---------------------------------------------------------------------------\n// Verification Mode\n// ---------------------------------------------------------------------------\n\n/**\n * Verification mode per VERIFIER-SECURITY-MODEL.md\n */\nexport type VerificationMode = 'offline_only' | 'offline_preferred' | 'network_allowed';\n\n// ---------------------------------------------------------------------------\n// Trust Pinning\n// ---------------------------------------------------------------------------\n\n/**\n * Pinned key entry per TRUST-PINNING-POLICY.md\n *\n * Uses RFC 7638 JWK Thumbprint with base64url encoding (NOT hex).\n * SHA-256 thumbprints are 43 characters in base64url.\n *\n * For offline verification, include either `public_key` (base64url 32 bytes)\n * or the full `jwk` object. If only thumbprint is provided, the key can only\n * be pin-checked after fetching JWKS (requires network mode).\n */\nexport interface PinnedKey {\n /** Issuer origin (https://host[:port]) */\n issuer: string;\n /** Key identifier (kid from JWKS) */\n kid: string;\n /** RFC 7638 JWK Thumbprint, SHA-256, base64url-encoded (43 chars) */\n jwk_thumbprint_sha256: string;\n /**\n * Ed25519 public key bytes, base64url-encoded (43 chars for 32 bytes).\n * If provided, enables offline verification without JWKS fetch.\n */\n public_key?: string;\n /**\n * Full JWK for offline verification.\n * If provided, enables offline verification without JWKS fetch.\n * Takes precedence over public_key.\n */\n jwk?: {\n kty: 'OKP';\n crv: 'Ed25519';\n x: string;\n kid?: string;\n };\n}\n\n/**\n * Issuer allowlist entry\n *\n * Full origin format: https://host[:port]\n * The port is only included if non-standard (not 443 for HTTPS).\n */\nexport type IssuerOrigin = string;\n\n// ---------------------------------------------------------------------------\n// Verifier Limits\n// ---------------------------------------------------------------------------\n\n/**\n * Verifier security limits\n */\nexport interface VerifierLimits {\n /** Maximum receipt size in bytes */\n max_receipt_bytes: number;\n /** Maximum JWKS document size in bytes */\n max_jwks_bytes: number;\n /** Maximum number of keys in a JWKS */\n max_jwks_keys: number;\n /** Maximum redirects to follow */\n max_redirects: number;\n /** Network fetch timeout in milliseconds */\n fetch_timeout_ms: number;\n /** Maximum extension size in bytes */\n max_extension_bytes: number;\n}\n\n/**\n * Default verifier limits from VERIFIER-SECURITY-MODEL.md\n */\nexport const DEFAULT_VERIFIER_LIMITS: VerifierLimits = {\n max_receipt_bytes: VERIFIER_LIMITS.maxReceiptBytes,\n max_jwks_bytes: VERIFIER_LIMITS.maxJwksBytes,\n max_jwks_keys: VERIFIER_LIMITS.maxJwksKeys,\n max_redirects: VERIFIER_LIMITS.maxRedirects,\n fetch_timeout_ms: VERIFIER_LIMITS.fetchTimeoutMs,\n max_extension_bytes: VERIFIER_LIMITS.maxExtensionBytes,\n};\n\n// ---------------------------------------------------------------------------\n// Network Security\n// ---------------------------------------------------------------------------\n\n/**\n * Network security settings\n */\nexport interface NetworkSecurity {\n /** Only allow HTTPS URLs */\n https_only: boolean;\n /** Block requests to private IP ranges */\n block_private_ips: boolean;\n /** Allow redirects */\n allow_redirects: boolean;\n /**\n * Allow cross-origin redirects (default: true for CDN compatibility).\n * When true, redirects to different origins are allowed if they pass SSRF checks.\n * When false, only same-origin redirects are allowed.\n */\n allow_cross_origin_redirects?: boolean;\n /**\n * Behavior on DNS resolution failure (default: 'block' for security).\n * - 'block': Treat DNS failure as blocked (fail-closed, more secure)\n * - 'fail': Return fetch error (allows retry, less restrictive)\n */\n dns_failure_behavior?: 'block' | 'fail';\n}\n\n/**\n * Default network security settings from VERIFIER-SECURITY-MODEL.md\n */\nexport const DEFAULT_NETWORK_SECURITY: NetworkSecurity = {\n https_only: VERIFIER_NETWORK.httpsOnly,\n block_private_ips: VERIFIER_NETWORK.blockPrivateIps,\n allow_redirects: VERIFIER_NETWORK.allowRedirects,\n allow_cross_origin_redirects: true, // Allow for CDN compatibility\n dns_failure_behavior: 'block', // Fail-closed by default\n};\n\n// ---------------------------------------------------------------------------\n// Verifier Policy\n// ---------------------------------------------------------------------------\n\n/**\n * Verifier policy configuration\n *\n * This structure echoes the policy used for verification, making trust\n * decisions auditable per VERIFICATION-REPORT-FORMAT.md.\n */\nexport interface VerifierPolicy {\n /** Policy schema version */\n policy_version: typeof VERIFIER_POLICY_VERSION;\n /** Verification mode */\n mode: VerificationMode;\n /** Allowed issuer origins (optional, if empty all issuers allowed) */\n issuer_allowlist?: IssuerOrigin[];\n /** Pinned keys for offline verification */\n pinned_keys?: PinnedKey[];\n /** Effective security limits */\n limits: VerifierLimits;\n /** Network security settings */\n network: NetworkSecurity;\n}\n\n/**\n * Create a default verifier policy\n */\nexport function createDefaultPolicy(mode: VerificationMode): VerifierPolicy {\n return {\n policy_version: VERIFIER_POLICY_VERSION,\n mode,\n limits: { ...DEFAULT_VERIFIER_LIMITS },\n network: { ...DEFAULT_NETWORK_SECURITY },\n };\n}\n\n// ---------------------------------------------------------------------------\n// Verification Checks\n// ---------------------------------------------------------------------------\n\n/**\n * Check status\n */\nexport type CheckStatus = 'pass' | 'fail' | 'skip';\n\n/**\n * Standard check IDs per VERIFIER-SECURITY-MODEL.md (in order).\n *\n * APPEND-ONLY CONTRACT:\n * - New checks MUST only be appended to the end of this array.\n * - Existing entries MUST NOT be removed, reordered, or renamed.\n * - Downstream consumers (conformance fixtures, report builders, dashboards)\n * depend on stable indices and the `as const` tuple type.\n * - Breaking this contract invalidates all existing verification reports\n * and conformance vectors.\n * - Enforced by prefix-pinning test in verification-report.test.ts.\n *\n * OUTPUT ORDER vs EVALUATION ORDER:\n * This array defines the report output (render) order only. Verifier\n * implementations MAY evaluate checks in any order internally (e.g.,\n * checking signature before discovery). The report builder normalizes\n * results into this canonical order regardless of evaluation sequence.\n *\n * To add a new check:\n * 1. Append the new ID to the end of this array.\n * 2. Update the conformance fixture: specs/conformance/fixtures/verifier/verification-report.json\n * 3. Update the spec: docs/specs/VERIFICATION-REPORT-FORMAT.md (Section 5.5)\n * 4. Update the spec: docs/specs/VERIFIER-SECURITY-MODEL.md (Section 6.1)\n */\nexport const CHECK_IDS = [\n 'jws.parse',\n 'limits.receipt_bytes',\n 'jws.protected_header',\n 'claims.schema_unverified',\n 'issuer.trust_policy',\n 'issuer.discovery',\n 'key.resolve',\n 'jws.signature',\n 'claims.time_window',\n 'extensions.limits',\n 'transport.profile_binding',\n 'policy.binding',\n] as const;\n\nexport type CheckId = (typeof CHECK_IDS)[number];\n\n/**\n * Single verification check result\n */\nexport interface CheckResult {\n /** Stable check identifier */\n id: CheckId;\n /** Check status */\n status: CheckStatus;\n /** Machine-readable details (optional) */\n detail?: Record<string, unknown>;\n /** Stable error code (if failed) */\n error_code?: string;\n}\n\n// ---------------------------------------------------------------------------\n// Verification Report Input\n// ---------------------------------------------------------------------------\n\n/**\n * Input type for verification\n */\nexport type InputType = 'receipt_jws' | 'bundle_entry';\n\n/**\n * Digest object (algorithm + value)\n */\nexport interface DigestObject {\n /** Hash algorithm */\n alg: 'sha-256';\n /** Hash value in lowercase hex */\n value: string;\n}\n\n/**\n * Bundle context for bundle_entry input type\n */\nexport interface BundleContext {\n /** Digest of bundle bytes */\n bundle_digest: DigestObject;\n /** 0-based entry index */\n entry_index: number;\n /** Stable entry ID (optional) */\n entry_id?: string;\n}\n\n/**\n * Verification input descriptor\n */\nexport interface VerificationInput {\n /** Input type */\n type: InputType;\n /** Digest of receipt bytes */\n receipt_digest: DigestObject;\n /** Bundle context (if type = bundle_entry) */\n bundle?: BundleContext;\n}\n\n// ---------------------------------------------------------------------------\n// Verification Report Result\n// ---------------------------------------------------------------------------\n\n/**\n * Result severity\n */\nexport type ResultSeverity = 'info' | 'warning' | 'error';\n\n/**\n * Reason codes per VERIFIER-SECURITY-MODEL.md\n */\nexport type ReasonCode =\n | 'ok'\n | 'receipt_too_large'\n | 'malformed_receipt'\n | 'signature_invalid'\n | 'issuer_not_allowed'\n | 'key_not_found'\n | 'key_fetch_blocked'\n | 'key_fetch_failed'\n | 'key_fetch_timeout'\n | 'pointer_fetch_blocked'\n | 'pointer_fetch_failed'\n | 'pointer_fetch_timeout'\n | 'pointer_fetch_too_large'\n | 'pointer_digest_mismatch'\n | 'jwks_too_large'\n | 'jwks_too_many_keys'\n | 'expired'\n | 'not_yet_valid'\n | 'audience_mismatch'\n | 'schema_invalid'\n | 'policy_violation'\n | 'extension_too_large'\n | 'invalid_transport';\n\n/**\n * High-level verification result\n */\nexport interface VerificationResult {\n /** Overall verification result */\n valid: boolean;\n /** Stable reason code */\n reason: ReasonCode;\n /** Result severity */\n severity: ResultSeverity;\n /** Receipt wire format (e.g., peac-receipt/0.1) */\n receipt_type: string;\n /** Normalized issuer origin (optional) */\n issuer?: string;\n /** Key ID used for verification (optional) */\n kid?: string;\n /**\n * Policy binding status.\n *\n * Always 'unavailable' for Wire 0.1 receipts.\n * Wire 0.2+ receipts with `peac.policy.digest` will report 'verified' or 'failed'.\n *\n * This field is ALWAYS present (never undefined). Consumers can rely on it\n * without null checks.\n */\n policy_binding: PolicyBindingStatus;\n}\n\n// ---------------------------------------------------------------------------\n// Verification Report Artifacts\n// ---------------------------------------------------------------------------\n\n/**\n * Pointer resolution details\n */\nexport interface PointerArtifact {\n /** Pointer URL */\n url: string;\n /** Expected digest from header */\n expected_digest: DigestObject;\n /** Actual digest of fetched content */\n actual_digest?: DigestObject;\n /** Whether digests matched */\n digest_matched?: boolean;\n}\n\n/**\n * Key source for enterprise debuggability\n */\nexport type KeySource = 'pinned' | 'jwks_fetch';\n\n/**\n * Additional verification artifacts\n *\n * Artifacts are divided into two categories:\n *\n * **Deterministic artifacts** (same inputs and policy -> same values):\n * - `issuer_key_source`: Always determined by policy and receipt\n * - `issuer_key_thumbprint`: Computed from the signing key\n * - `normalized_claims_digest`: Computed from the claims\n * - `receipt_pointer`: Derived from the input pointer header\n *\n * **Non-deterministic artifacts** (may vary based on runtime state):\n * - `issuer_jwks_digest`: Only present when JWKS is fetched fresh (not from cache)\n *\n * Use `buildDeterministic()` to exclude non-deterministic artifacts for\n * reproducible report generation.\n */\nexport interface VerificationArtifacts {\n /**\n * Digest of JWKS used for verification.\n *\n * NON-DETERMINISTIC: Only present when JWKS is fetched fresh (not from cache).\n * Excluded by `buildDeterministic()`.\n */\n issuer_jwks_digest?: DigestObject;\n /** Source of the signing key used for verification (DETERMINISTIC) */\n issuer_key_source?: KeySource;\n /** RFC 7638 JWK Thumbprint (SHA-256, base64url) of the key used (DETERMINISTIC) */\n issuer_key_thumbprint?: string;\n /** Digest of canonicalized claims (DETERMINISTIC) */\n normalized_claims_digest?: DigestObject;\n /** Pointer resolution details (DETERMINISTIC) */\n receipt_pointer?: PointerArtifact;\n}\n\n/**\n * Keys of artifacts that are non-deterministic (depend on runtime state)\n */\nexport const NON_DETERMINISTIC_ARTIFACT_KEYS: (keyof VerificationArtifacts)[] = [\n 'issuer_jwks_digest',\n];\n\n// ---------------------------------------------------------------------------\n// Verification Report Meta\n// ---------------------------------------------------------------------------\n\n/**\n * Verifier implementation info\n */\nexport interface VerifierInfo {\n /** Verifier name */\n name: string;\n /** Verifier version */\n version: string;\n}\n\n/**\n * Non-deterministic metadata (MUST be excluded from report hashes)\n */\nexport interface VerificationMeta {\n /** RFC 3339 timestamp when report was generated */\n generated_at?: string;\n /** Verifier implementation info */\n verifier?: VerifierInfo;\n}\n\n// ---------------------------------------------------------------------------\n// Verification Report\n// ---------------------------------------------------------------------------\n\n/**\n * PEAC Verification Report per VERIFICATION-REPORT-FORMAT.md\n *\n * This report is designed to be:\n * - Portable: shareable across organizations\n * - Deterministic: reproducible given same inputs\n * - Safe: bounded resource usage\n * - Policy-aware: trust decisions are explicit\n */\nexport interface VerificationReport {\n /** Format version identifier (REQUIRED) */\n report_version: typeof VERIFICATION_REPORT_VERSION;\n /** What was verified (REQUIRED) */\n input: VerificationInput;\n /** Policy used for verification (REQUIRED) */\n policy: VerifierPolicy;\n /** High-level outcome (REQUIRED) */\n result: VerificationResult;\n /** Ordered list of checks (REQUIRED) */\n checks: CheckResult[];\n /** Additional outputs (OPTIONAL) */\n artifacts?: VerificationArtifacts;\n /** Non-deterministic fields (OPTIONAL, excluded from hashes) */\n meta?: VerificationMeta;\n}\n\n// ---------------------------------------------------------------------------\n// Report Builder Utilities\n// ---------------------------------------------------------------------------\n\n/**\n * Create a digest object from a hex string\n */\nexport function createDigest(hexValue: string): DigestObject {\n return {\n alg: 'sha-256',\n value: hexValue.toLowerCase(),\n };\n}\n\n/**\n * Create an empty verification report structure\n */\nexport function createEmptyReport(\n policy: VerifierPolicy\n): Omit<VerificationReport, 'input' | 'result' | 'checks'> {\n return {\n report_version: VERIFICATION_REPORT_VERSION,\n policy,\n };\n}\n\n/**\n * Map SSRF fetch error reason to verification reason code\n */\nexport function ssrfErrorToReasonCode(\n ssrfReason: string,\n fetchType: 'key' | 'pointer'\n): ReasonCode {\n const prefix = fetchType === 'key' ? 'key_fetch' : 'pointer_fetch';\n\n switch (ssrfReason) {\n case 'not_https':\n case 'private_ip':\n case 'loopback':\n case 'link_local':\n case 'cross_origin_redirect':\n case 'dns_failure':\n return `${prefix}_blocked` as ReasonCode;\n case 'timeout':\n return `${prefix}_timeout` as ReasonCode;\n case 'response_too_large':\n return fetchType === 'pointer' ? 'pointer_fetch_too_large' : 'jwks_too_large';\n case 'jwks_too_many_keys':\n return 'jwks_too_many_keys';\n case 'too_many_redirects':\n case 'scheme_downgrade':\n case 'network_error':\n case 'invalid_url':\n default:\n return `${prefix}_failed` as ReasonCode;\n }\n}\n\n/**\n * Map reason code to severity\n */\nexport function reasonCodeToSeverity(reason: ReasonCode): ResultSeverity {\n if (reason === 'ok') return 'info';\n return 'error';\n}\n\n/**\n * Map reason code to error code\n */\nexport function reasonCodeToErrorCode(reason: ReasonCode): string {\n const mapping: Record<ReasonCode, string> = {\n ok: '',\n receipt_too_large: 'E_VERIFY_RECEIPT_TOO_LARGE',\n malformed_receipt: 'E_VERIFY_MALFORMED_RECEIPT',\n signature_invalid: 'E_VERIFY_SIGNATURE_INVALID',\n issuer_not_allowed: 'E_VERIFY_ISSUER_NOT_ALLOWED',\n key_not_found: 'E_VERIFY_KEY_NOT_FOUND',\n key_fetch_blocked: 'E_VERIFY_KEY_FETCH_BLOCKED',\n key_fetch_failed: 'E_VERIFY_KEY_FETCH_FAILED',\n key_fetch_timeout: 'E_VERIFY_KEY_FETCH_TIMEOUT',\n pointer_fetch_blocked: 'E_VERIFY_POINTER_FETCH_BLOCKED',\n pointer_fetch_failed: 'E_VERIFY_POINTER_FETCH_FAILED',\n pointer_fetch_timeout: 'E_VERIFY_POINTER_FETCH_TIMEOUT',\n pointer_fetch_too_large: 'E_VERIFY_POINTER_FETCH_TOO_LARGE',\n pointer_digest_mismatch: 'E_VERIFY_POINTER_DIGEST_MISMATCH',\n jwks_too_large: 'E_VERIFY_JWKS_TOO_LARGE',\n jwks_too_many_keys: 'E_VERIFY_JWKS_TOO_MANY_KEYS',\n expired: 'E_VERIFY_EXPIRED',\n not_yet_valid: 'E_VERIFY_NOT_YET_VALID',\n audience_mismatch: 'E_VERIFY_AUDIENCE_MISMATCH',\n schema_invalid: 'E_VERIFY_SCHEMA_INVALID',\n policy_violation: 'E_VERIFY_POLICY_VIOLATION',\n extension_too_large: 'E_VERIFY_EXTENSION_TOO_LARGE',\n invalid_transport: 'E_VERIFY_INVALID_TRANSPORT',\n };\n return mapping[reason] || 'E_VERIFY_POLICY_VIOLATION';\n}\n","/**\n * PEAC Verification Report Builder\n *\n * Constructs deterministic verification reports per VERIFICATION-REPORT-FORMAT.md.\n * Reports are designed to be portable, deterministic, safe, and policy-aware.\n *\n * @packageDocumentation\n */\n\nimport { sha256Hex } from '@peac/crypto';\nimport { VERIFICATION_REPORT_VERSION, WIRE_TYPE } from '@peac/kernel';\nimport type {\n CheckId,\n CheckResult,\n CheckStatus,\n DigestObject,\n ReasonCode,\n VerificationArtifacts,\n VerificationInput,\n VerificationMeta,\n VerificationReport,\n VerificationResult,\n VerifierPolicy,\n} from './verifier-types.js';\nimport {\n CHECK_IDS,\n createDigest,\n NON_DETERMINISTIC_ARTIFACT_KEYS,\n reasonCodeToErrorCode,\n reasonCodeToSeverity,\n} from './verifier-types.js';\n\n/**\n * Report builder state\n */\ninterface ReportBuilderState {\n input?: VerificationInput;\n receiptDigestHex?: string;\n policy: VerifierPolicy;\n checks: Map<CheckId, CheckResult>;\n result?: VerificationResult;\n artifacts?: Record<string, unknown>;\n meta?: VerificationMeta;\n shortCircuited: boolean;\n failedAtCheck?: CheckId;\n}\n\n/**\n * Verification Report Builder\n *\n * Builds verification reports with proper check ordering and short-circuit behavior.\n * Ensures reports conform to VERIFICATION-REPORT-FORMAT.md requirements.\n *\n * Shape-stable: Always emits all checks with pass/fail/skip status.\n */\nexport class VerificationReportBuilder {\n private state: ReportBuilderState;\n\n constructor(policy: VerifierPolicy) {\n this.state = {\n policy,\n checks: new Map(),\n shortCircuited: false,\n };\n }\n\n /**\n * Set the input descriptor with pre-computed digest\n *\n * Use this when you've already computed the SHA-256 hash.\n *\n * @param digestHex - SHA-256 digest as lowercase hex (64 chars)\n * @param type - Input type\n */\n setInputWithDigest(\n digestHex: string,\n type: 'receipt_jws' | 'bundle_entry' = 'receipt_jws'\n ): this {\n this.state.receiptDigestHex = digestHex;\n this.state.input = {\n type,\n receipt_digest: createDigest(digestHex),\n };\n return this;\n }\n\n /**\n * Set the input descriptor (async - computes SHA-256)\n *\n * @param receiptBytes - Raw receipt bytes\n * @param type - Input type\n */\n async setInputAsync(\n receiptBytes: Uint8Array,\n type: 'receipt_jws' | 'bundle_entry' = 'receipt_jws'\n ): Promise<this> {\n const digestHex = await sha256Hex(receiptBytes);\n return this.setInputWithDigest(digestHex, type);\n }\n\n /**\n * Add a check result\n *\n * Checks can be added in any order; they will be sorted in build().\n * If a previous check failed, subsequent checks should be marked as skip.\n */\n addCheck(\n id: CheckId,\n status: CheckStatus,\n detail?: Record<string, unknown>,\n errorCode?: string\n ): this {\n const check: CheckResult = { id, status };\n if (detail && Object.keys(detail).length > 0) {\n check.detail = detail;\n }\n if (errorCode) {\n check.error_code = errorCode;\n }\n\n this.state.checks.set(id, check);\n\n // Track short-circuit on failure\n if (status === 'fail' && !this.state.shortCircuited) {\n this.state.shortCircuited = true;\n this.state.failedAtCheck = id;\n }\n\n return this;\n }\n\n /**\n * Add a passing check\n */\n pass(id: CheckId, detail?: Record<string, unknown>): this {\n return this.addCheck(id, 'pass', detail);\n }\n\n /**\n * Add a failing check\n */\n fail(id: CheckId, errorCode: string, detail?: Record<string, unknown>): this {\n return this.addCheck(id, 'fail', detail, errorCode);\n }\n\n /**\n * Add a skipped check\n */\n skip(id: CheckId, detail?: Record<string, unknown>): this {\n return this.addCheck(id, 'skip', detail);\n }\n\n /**\n * Set the final result\n */\n setResult(\n valid: boolean,\n reason: ReasonCode,\n options?: {\n issuer?: string;\n kid?: string;\n receiptType?: string;\n }\n ): this {\n this.state.result = {\n valid,\n reason,\n severity: reasonCodeToSeverity(reason),\n receipt_type: options?.receiptType ?? WIRE_TYPE,\n // Wire 0.1: always 'unavailable'. Wire 0.2 will set this via options.\n policy_binding: 'unavailable',\n ...(options?.issuer && { issuer: options.issuer }),\n ...(options?.kid && { kid: options.kid }),\n };\n return this;\n }\n\n /**\n * Set success result\n */\n success(issuer: string, kid: string): this {\n return this.setResult(true, 'ok', { issuer, kid });\n }\n\n /**\n * Set failure result\n */\n failure(reason: ReasonCode, issuer?: string, kid?: string): this {\n return this.setResult(false, reason, { issuer, kid });\n }\n\n /**\n * Add artifacts\n */\n addArtifact(key: string, value: unknown): this {\n if (!this.state.artifacts) {\n this.state.artifacts = {};\n }\n this.state.artifacts[key] = value;\n return this;\n }\n\n /**\n * Set metadata (non-deterministic fields)\n */\n setMeta(meta: VerificationMeta): this {\n this.state.meta = meta;\n return this;\n }\n\n /**\n * Add current timestamp to meta\n */\n addTimestamp(): this {\n if (!this.state.meta) {\n this.state.meta = {};\n }\n this.state.meta.generated_at = new Date().toISOString();\n return this;\n }\n\n /**\n * Build the final report\n *\n * Ensures all checks are present (shape-stable).\n * Missing checks after a failure are marked as 'skip'.\n * Missing checks before a failure (or in success) are marked as 'pass'.\n */\n build(): VerificationReport {\n // Validate required fields\n if (!this.state.input) {\n throw new Error('Input is required. Call setInputWithDigest() or setInputAsync() first.');\n }\n if (!this.state.result) {\n throw new Error('Result is required. Call setResult() or success()/failure() first.');\n }\n\n // Build shape-stable checks array\n const checks: CheckResult[] = [];\n const failedIndex = this.state.failedAtCheck ? CHECK_IDS.indexOf(this.state.failedAtCheck) : -1;\n\n for (let i = 0; i < CHECK_IDS.length; i++) {\n const checkId = CHECK_IDS[i];\n const existing = this.state.checks.get(checkId);\n\n if (existing) {\n checks.push(existing);\n } else if (this.state.shortCircuited && i > failedIndex) {\n // After failure, missing checks are skipped\n checks.push({ id: checkId, status: 'skip', detail: { reason: 'short_circuit' } });\n } else {\n // Before failure or in success, missing checks get default status\n // For optional/deferred checks, mark as skip with appropriate reason\n if (checkId === 'transport.profile_binding') {\n checks.push({ id: checkId, status: 'skip', detail: { reason: 'not_applicable' } });\n } else if (checkId === 'policy.binding') {\n // Wire 0.1: always skip. Wire 0.2 will produce pass/fail.\n checks.push({\n id: checkId,\n status: 'skip',\n detail: { reason: 'wire_01_no_policy_digest' },\n });\n } else {\n // This shouldn't happen in well-formed builds - indicates a bug\n checks.push({ id: checkId, status: 'skip', detail: { reason: 'not_executed' } });\n }\n }\n }\n\n const report: VerificationReport = {\n report_version: VERIFICATION_REPORT_VERSION,\n input: this.state.input,\n policy: this.state.policy,\n result: this.state.result,\n checks,\n };\n\n if (this.state.artifacts && Object.keys(this.state.artifacts).length > 0) {\n report.artifacts = this.state.artifacts as VerificationReport['artifacts'];\n }\n\n if (this.state.meta) {\n report.meta = this.state.meta;\n }\n\n return report;\n }\n\n /**\n * Build in deterministic mode (excludes meta and non-deterministic artifacts)\n *\n * Deterministic mode ensures that the same inputs and policy always produce\n * the same report output, regardless of cache state or timing.\n *\n * Excludes:\n * - `meta`: Contains timestamps and verifier info\n * - Non-deterministic artifacts: `issuer_jwks_digest` (depends on cache state)\n *\n * @returns Report without meta and with only deterministic artifacts\n */\n buildDeterministic(): Omit<VerificationReport, 'meta'> {\n const report = this.build();\n const { meta: _meta, ...deterministic } = report;\n\n // Filter out non-deterministic artifacts\n if (deterministic.artifacts) {\n const filteredArtifacts: Partial<VerificationArtifacts> = { ...deterministic.artifacts };\n for (const key of NON_DETERMINISTIC_ARTIFACT_KEYS) {\n delete filteredArtifacts[key];\n }\n\n // Remove artifacts object if empty after filtering\n if (Object.keys(filteredArtifacts).length === 0) {\n delete deterministic.artifacts;\n } else {\n deterministic.artifacts = filteredArtifacts as VerificationArtifacts;\n }\n }\n\n return deterministic;\n }\n}\n\n/**\n * Create a new report builder\n */\nexport function createReportBuilder(policy: VerifierPolicy): VerificationReportBuilder {\n return new VerificationReportBuilder(policy);\n}\n\n/**\n * Compute receipt digest for report input\n *\n * @param receiptBytes - Raw receipt bytes (JWS string as UTF-8)\n * @returns SHA-256 digest as lowercase hex (64 chars)\n */\nexport async function computeReceiptDigest(receiptBytes: Uint8Array | string): Promise<string> {\n const bytes =\n typeof receiptBytes === 'string' ? new TextEncoder().encode(receiptBytes) : receiptBytes;\n return sha256Hex(bytes);\n}\n\n/**\n * Build a quick failure report without going through all checks\n *\n * Useful for early failures like receipt_too_large or malformed_receipt\n * where most checks are skipped.\n */\nexport async function buildFailureReport(\n policy: VerifierPolicy,\n receiptBytes: Uint8Array | string,\n reason: ReasonCode,\n failedCheckId: CheckId,\n errorCode?: string,\n detail?: Record<string, unknown>,\n options?: {\n issuer?: string;\n kid?: string;\n meta?: VerificationMeta;\n }\n): Promise<VerificationReport> {\n const bytes =\n typeof receiptBytes === 'string' ? new TextEncoder().encode(receiptBytes) : receiptBytes;\n const digestHex = await sha256Hex(bytes);\n\n const builder = createReportBuilder(policy)\n .setInputWithDigest(digestHex)\n .failure(reason, options?.issuer, options?.kid);\n\n // Add passing checks up to the failure point\n const failedIndex = CHECK_IDS.indexOf(failedCheckId);\n for (let i = 0; i < CHECK_IDS.length; i++) {\n const checkId = CHECK_IDS[i];\n if (i < failedIndex) {\n builder.pass(checkId);\n } else if (i === failedIndex) {\n builder.fail(checkId, errorCode ?? reasonCodeToErrorCode(reason), detail);\n }\n // Remaining checks will be auto-skipped by build()\n }\n\n if (options?.meta) {\n builder.setMeta(options.meta);\n }\n\n return builder.build();\n}\n\n/**\n * Build a success report\n */\nexport async function buildSuccessReport(\n policy: VerifierPolicy,\n receiptBytes: Uint8Array | string,\n issuer: string,\n kid: string,\n checkDetails?: Partial<Record<CheckId, Record<string, unknown>>>,\n options?: {\n artifacts?: VerificationReport['artifacts'];\n meta?: VerificationMeta;\n }\n): Promise<VerificationReport> {\n const bytes =\n typeof receiptBytes === 'string' ? new TextEncoder().encode(receiptBytes) : receiptBytes;\n const digestHex = await sha256Hex(bytes);\n\n const builder = createReportBuilder(policy).setInputWithDigest(digestHex).success(issuer, kid);\n\n // Add all checks as passing (except optional ones)\n for (const checkId of CHECK_IDS) {\n // Skip issuer.discovery for offline mode\n if (checkId === 'issuer.discovery' && policy.mode === 'offline_only') {\n builder.skip(checkId, { reason: 'offline_mode' });\n continue;\n }\n\n // transport.profile_binding is optional\n if (checkId === 'transport.profile_binding') {\n if (checkDetails?.[checkId]) {\n builder.pass(checkId, checkDetails[checkId]);\n }\n // Will be marked as skip by build() if not added\n continue;\n }\n\n // policy.binding: Wire 0.1 always skip\n if (checkId === 'policy.binding') {\n // Will be marked as skip with wire_01_no_policy_digest by build()\n continue;\n }\n\n builder.pass(checkId, checkDetails?.[checkId]);\n }\n\n if (options?.artifacts) {\n for (const [key, value] of Object.entries(options.artifacts)) {\n builder.addArtifact(key, value);\n }\n }\n\n if (options?.meta) {\n builder.setMeta(options.meta);\n }\n\n return builder.build();\n}\n","/**\n * PEAC Verifier Core\n *\n * Implements the verification flow per VERIFIER-SECURITY-MODEL.md with:\n * - Ordered checks with short-circuit behavior\n * - Trust pinning (issuer allowlist + RFC 7638 thumbprints)\n * - SSRF-safe network fetches\n * - Deterministic verification reports\n *\n * @packageDocumentation\n */\n\nimport {\n base64urlDecode,\n computeJwkThumbprint,\n decode,\n jwkToPublicKeyBytes,\n sha256Hex,\n verify as jwsVerify,\n} from '@peac/crypto';\nimport { WIRE_TYPE } from '@peac/kernel';\nimport { PEACReceiptClaims, ReceiptClaims } from '@peac/schema';\nimport type { SSRFFetchError } from './ssrf-safe-fetch.js';\nimport { resolveJWKS } from './jwks-resolver.js';\nimport type { RevokedKeyInfo } from './jwks-resolver.js';\nimport { createReportBuilder } from './verification-report.js';\nimport type { PinnedKey, VerificationReport, VerifierPolicy } from './verifier-types.js';\nimport {\n createDefaultPolicy,\n createDigest,\n reasonCodeToErrorCode,\n ssrfErrorToReasonCode,\n} from './verifier-types.js';\n\n// ---------------------------------------------------------------------------\n// Types\n// ---------------------------------------------------------------------------\n\n/**\n * JWK structure for Ed25519 keys\n */\ninterface JWK {\n kty: string;\n crv: string;\n x: string;\n kid: string;\n}\n\n/**\n * JWKS document\n */\ninterface JWKS {\n keys: JWK[];\n}\n\n/**\n * Issuer configuration document (/.well-known/peac-issuer.json)\n */\ninterface IssuerConfig {\n issuer: string;\n jwks_uri: string;\n}\n\n/**\n * Verification options for verifier-core\n */\nexport interface VerifyCoreOptions {\n /** Receipt JWS (compact serialization) or raw bytes */\n receipt: string | Uint8Array;\n /** Verification policy */\n policy?: VerifierPolicy;\n /** Reference time for deterministic verification (seconds since epoch) */\n referenceTime?: number;\n /** Include non-deterministic metadata in report */\n includeMeta?: boolean;\n}\n\n/**\n * Verification result\n */\nexport interface VerifyCoreResult {\n /** Whether verification succeeded */\n valid: boolean;\n /** Verification report */\n report: VerificationReport;\n /** Parsed claims (if valid) */\n claims?: PEACReceiptClaims;\n}\n\n// ---------------------------------------------------------------------------\n// Helper Functions\n// ---------------------------------------------------------------------------\n\n/**\n * Normalize issuer to origin format (https://host[:port])\n */\nfunction normalizeIssuer(issuer: string): string {\n try {\n const url = new URL(issuer);\n // Include port only if non-standard for HTTPS\n if (url.port && url.port !== '443') {\n return `${url.protocol}//${url.hostname}:${url.port}`;\n }\n return `${url.protocol}//${url.hostname}`;\n } catch {\n return issuer;\n }\n}\n\n/**\n * Check if issuer is in the allowlist\n */\nfunction isIssuerAllowed(issuer: string, allowlist?: string[]): boolean {\n if (!allowlist || allowlist.length === 0) {\n // No allowlist means all issuers are allowed\n return true;\n }\n\n const normalized = normalizeIssuer(issuer);\n return allowlist.some((allowed) => normalizeIssuer(allowed) === normalized);\n}\n\n/**\n * Find pinned key for issuer and kid\n */\nfunction findPinnedKey(\n issuer: string,\n kid: string,\n pinnedKeys?: PinnedKey[]\n): PinnedKey | undefined {\n if (!pinnedKeys || pinnedKeys.length === 0) {\n return undefined;\n }\n\n const normalizedIssuer = normalizeIssuer(issuer);\n return pinnedKeys.find((pk) => normalizeIssuer(pk.issuer) === normalizedIssuer && pk.kid === kid);\n}\n\n/**\n * JWKS fetch result (success case)\n */\ninterface JWKSFetchSuccess {\n jwks: JWKS;\n fromCache: boolean;\n /** Raw JWKS bytes for digest computation (only present when not from cache) */\n rawBytes?: Uint8Array;\n /** Revoked keys from issuer configuration */\n revokedKeys?: RevokedKeyInfo[];\n}\n\n/**\n * Fetch JWKS from issuer via strict discovery (peac-issuer.json -> jwks_uri).\n * Delegates to the shared jwks-resolver module.\n *\n * The resolver preserves the original SSRF reason on errors, so no lossy\n * reverse-mapping is needed.\n */\nasync function fetchIssuerJWKS(\n issuerOrigin: string\n): Promise<JWKSFetchSuccess | { error: SSRFFetchError }> {\n const result = await resolveJWKS(issuerOrigin);\n\n if (!result.ok) {\n return {\n error: {\n ok: false,\n reason: result.reason ?? 'network_error',\n message: result.message,\n blockedUrl: result.blockedUrl,\n } as SSRFFetchError,\n };\n }\n\n return {\n jwks: result.jwks,\n fromCache: result.fromCache,\n rawBytes: result.rawBytes,\n revokedKeys: result.revokedKeys,\n };\n}\n\n/**\n * Find the issuer revocation entry for a kid, if any\n */\nfunction findRevokedKey(kid: string, revokedKeys?: RevokedKeyInfo[]): RevokedKeyInfo | undefined {\n return revokedKeys?.find((rk) => rk.kid === kid);\n}\n\n// ---------------------------------------------------------------------------\n// Main Verification Function\n// ---------------------------------------------------------------------------\n\n/**\n * Verify a PEAC receipt with full security checks and report emission\n *\n * Implements the verification flow per VERIFIER-SECURITY-MODEL.md:\n * 1. jws.parse - Parse JWS structure\n * 2. limits.receipt_bytes - Check receipt size\n * 3. jws.protected_header - Validate protected header\n * 4. claims.schema_unverified - Pre-signature schema check\n * 5. issuer.trust_policy - Check issuer allowlist/pins\n * 6. issuer.discovery - Fetch JWKS (if network mode)\n * 7. key.resolve - Resolve signing key by kid\n * 8. jws.signature - Verify signature\n * 9. claims.time_window - Check iat/exp\n * 10. extensions.limits - Check extension sizes\n */\nexport async function verifyReceiptCore(options: VerifyCoreOptions): Promise<VerifyCoreResult> {\n const {\n receipt,\n policy = createDefaultPolicy('offline_preferred'),\n referenceTime,\n includeMeta = false,\n } = options;\n\n // Convert receipt to string if needed\n const receiptJws = typeof receipt === 'string' ? receipt : new TextDecoder().decode(receipt);\n const receiptBytes = typeof receipt === 'string' ? new TextEncoder().encode(receipt) : receipt;\n\n // Compute receipt digest for report\n const receiptDigestHex = await sha256Hex(receiptBytes);\n\n // Start building report\n const builder = createReportBuilder(policy);\n builder.setInputWithDigest(receiptDigestHex);\n\n // Current time (or reference time for deterministic verification)\n const nowSeconds = referenceTime ?? Math.floor(Date.now() / 1000);\n\n // Track issuer and kid for result\n let issuer: string | undefined;\n let kid: string | undefined;\n let parsedClaims: PEACReceiptClaims | undefined;\n\n // ---------------------------------------------------------------------------\n // Check 1: jws.parse - Parse JWS structure\n // ---------------------------------------------------------------------------\n let header: { alg: string; typ?: string; kid: string };\n let payload: PEACReceiptClaims;\n\n try {\n const decoded = decode<PEACReceiptClaims>(receiptJws);\n header = decoded.header;\n payload = decoded.payload;\n builder.pass('jws.parse');\n } catch (err) {\n builder.fail('jws.parse', 'E_VERIFY_MALFORMED_RECEIPT', {\n error: err instanceof Error ? err.message : String(err),\n });\n builder.failure('malformed_receipt');\n return { valid: false, report: includeMeta ? builder.addTimestamp().build() : builder.build() };\n }\n\n // ---------------------------------------------------------------------------\n // Check 2: limits.receipt_bytes - Check receipt size\n // ---------------------------------------------------------------------------\n if (receiptBytes.length > policy.limits.max_receipt_bytes) {\n builder.fail('limits.receipt_bytes', 'E_VERIFY_RECEIPT_TOO_LARGE', {\n size: receiptBytes.length,\n limit: policy.limits.max_receipt_bytes,\n });\n builder.failure('receipt_too_large');\n return { valid: false, report: includeMeta ? builder.addTimestamp().build() : builder.build() };\n }\n builder.pass('limits.receipt_bytes', { size: receiptBytes.length });\n\n // ---------------------------------------------------------------------------\n // Check 3: jws.protected_header - Validate protected header\n // ---------------------------------------------------------------------------\n if (header.alg !== 'EdDSA') {\n builder.fail('jws.protected_header', 'E_VERIFY_MALFORMED_RECEIPT', {\n expected_alg: 'EdDSA',\n actual_alg: header.alg,\n });\n builder.failure('malformed_receipt');\n return { valid: false, report: includeMeta ? builder.addTimestamp().build() : builder.build() };\n }\n if (header.typ !== WIRE_TYPE) {\n builder.fail('jws.protected_header', 'E_VERIFY_MALFORMED_RECEIPT', {\n expected_typ: WIRE_TYPE,\n actual_typ: header.typ,\n });\n builder.failure('malformed_receipt');\n return { valid: false, report: includeMeta ? builder.addTimestamp().build() : builder.build() };\n }\n if (!header.kid) {\n builder.fail('jws.protected_header', 'E_VERIFY_MALFORMED_RECEIPT', {\n error: 'Missing kid in protected header',\n });\n builder.failure('malformed_receipt');\n return { valid: false, report: includeMeta ? builder.addTimestamp().build() : builder.build() };\n }\n kid = header.kid;\n builder.pass('jws.protected_header', { alg: header.alg, typ: header.typ, kid: header.kid });\n\n // ---------------------------------------------------------------------------\n // Check 4: claims.schema_unverified - Pre-signature schema check\n // ---------------------------------------------------------------------------\n try {\n ReceiptClaims.parse(payload);\n issuer = payload.iss;\n builder.pass('claims.schema_unverified');\n } catch (err) {\n builder.fail('claims.schema_unverified', 'E_VERIFY_SCHEMA_INVALID', {\n error: err instanceof Error ? err.message : String(err),\n });\n builder.failure('schema_invalid');\n return { valid: false, report: includeMeta ? builder.addTimestamp().build() : builder.build() };\n }\n\n // ---------------------------------------------------------------------------\n // Check 5: issuer.trust_policy - Check issuer allowlist/pins\n // ---------------------------------------------------------------------------\n const normalizedIssuer = normalizeIssuer(issuer!);\n\n if (!isIssuerAllowed(issuer!, policy.issuer_allowlist)) {\n builder.fail('issuer.trust_policy', 'E_VERIFY_ISSUER_NOT_ALLOWED', {\n issuer: normalizedIssuer,\n allowlist: policy.issuer_allowlist,\n });\n builder.failure('issuer_not_allowed', normalizedIssuer, kid);\n return { valid: false, report: includeMeta ? builder.addTimestamp().build() : builder.build() };\n }\n builder.pass('issuer.trust_policy', { issuer: normalizedIssuer });\n\n // ---------------------------------------------------------------------------\n // Check 6: issuer.discovery - Fetch JWKS (if network mode)\n // Check 7: key.resolve - Resolve signing key by kid\n // ---------------------------------------------------------------------------\n let publicKey: Uint8Array;\n let keySource: 'pinned_keys' | 'jwks_discovery';\n let keyThumbprint: string | undefined;\n let jwksRawBytes: Uint8Array | undefined;\n\n // Check for pinned key first\n const pinnedKey = findPinnedKey(issuer!, kid!, policy.pinned_keys);\n\n if (pinnedKey) {\n // Use pinned key - skip discovery\n builder.skip('issuer.discovery', { reason: 'pinned_key_available' });\n\n // Check if pinned key has key material for offline verification\n if (pinnedKey.jwk) {\n // Full JWK provided - verify thumbprint and use directly\n const actualThumbprint = await computeJwkThumbprint(pinnedKey.jwk);\n if (actualThumbprint !== pinnedKey.jwk_thumbprint_sha256) {\n builder.fail('key.resolve', 'E_VERIFY_POLICY_VIOLATION', {\n error: 'Pinned JWK thumbprint does not match declared thumbprint',\n expected: pinnedKey.jwk_thumbprint_sha256,\n actual: actualThumbprint,\n });\n builder.failure('policy_violation', normalizedIssuer, kid);\n return {\n valid: false,\n report: includeMeta ? builder.addTimestamp().build() : builder.build(),\n };\n }\n publicKey = jwkToPublicKeyBytes(pinnedKey.jwk);\n keySource = 'pinned_keys';\n keyThumbprint = actualThumbprint;\n builder.pass('key.resolve', {\n source: keySource,\n kid,\n thumbprint_verified: true,\n offline: true,\n });\n } else if (pinnedKey.public_key) {\n // Raw public key bytes provided (base64url, 32 bytes for Ed25519)\n try {\n publicKey = base64urlDecode(pinnedKey.public_key);\n if (publicKey.length !== 32) {\n throw new Error(`Expected 32 bytes, got ${publicKey.length}`);\n }\n keySource = 'pinned_keys';\n // Note: We can't compute thumbprint from raw key bytes alone\n // The thumbprint is computed from canonical JWK JSON\n // Use the declared thumbprint from the pinned key entry\n keyThumbprint = pinnedKey.jwk_thumbprint_sha256;\n builder.pass('key.resolve', {\n source: keySource,\n kid,\n offline: true,\n thumbprint_verified: false,\n });\n } catch (err) {\n builder.fail('key.resolve', 'E_VERIFY_KEY_NOT_FOUND', {\n error: `Invalid pinned public_key: ${err instanceof Error ? err.message : String(err)}`,\n });\n builder.failure('key_not_found', normalizedIssuer, kid);\n return {\n valid: false,\n report: includeMeta ? builder.addTimestamp().build() : builder.build(),\n };\n }\n } else if (policy.mode === 'offline_only') {\n // Offline mode but pinned key has no key material - fail\n builder.fail('key.resolve', 'E_VERIFY_KEY_NOT_FOUND', {\n error: 'Offline mode requires key material (jwk or public_key) in pinned_keys',\n });\n builder.failure('key_not_found', normalizedIssuer, kid);\n return {\n valid: false,\n report: includeMeta ? builder.addTimestamp().build() : builder.build(),\n };\n } else {\n // Network mode - fetch JWKS and verify thumbprint\n const jwksResult = await fetchIssuerJWKS(normalizedIssuer);\n\n if ('error' in jwksResult) {\n const reason = ssrfErrorToReasonCode(jwksResult.error.reason, 'key');\n builder.fail('issuer.discovery', reasonCodeToErrorCode(reason), {\n error: jwksResult.error.message,\n url: jwksResult.error.blockedUrl,\n });\n builder.failure(reason, normalizedIssuer, kid);\n return {\n valid: false,\n report: includeMeta ? builder.addTimestamp().build() : builder.build(),\n };\n }\n\n // Store raw bytes for digest computation (only when not from cache)\n if (jwksResult.rawBytes) {\n jwksRawBytes = jwksResult.rawBytes;\n }\n\n builder.pass('issuer.discovery', {\n from_cache: jwksResult.fromCache,\n keys_count: jwksResult.jwks.keys.length,\n });\n\n const revokedPinned = findRevokedKey(kid!, jwksResult.revokedKeys);\n if (revokedPinned) {\n builder.fail('key.resolve', 'E_REVOKED_KEY_USED', {\n kid,\n revoked_at: revokedPinned.revoked_at,\n ...(revokedPinned.reason && { reason: revokedPinned.reason }),\n });\n builder.failure('key_not_found', normalizedIssuer, kid);\n return {\n valid: false,\n report: includeMeta ? builder.addTimestamp().build() : builder.build(),\n };\n }\n\n // Find the key\n const jwk = jwksResult.jwks.keys.find((k) => k.kid === kid);\n if (!jwk) {\n builder.fail('key.resolve', 'E_VERIFY_KEY_NOT_FOUND', {\n kid,\n available_kids: jwksResult.jwks.keys.map((k) => k.kid),\n });\n builder.failure('key_not_found', normalizedIssuer, kid);\n return {\n valid: false,\n report: includeMeta ? builder.addTimestamp().build() : builder.build(),\n };\n }\n\n // Verify thumbprint matches\n const actualThumbprint = await computeJwkThumbprint(jwk);\n if (actualThumbprint !== pinnedKey.jwk_thumbprint_sha256) {\n builder.fail('key.resolve', 'E_VERIFY_POLICY_VIOLATION', {\n error: 'JWK thumbprint does not match pinned key',\n expected: pinnedKey.jwk_thumbprint_sha256,\n actual: actualThumbprint,\n });\n builder.failure('policy_violation', normalizedIssuer, kid);\n return {\n valid: false,\n report: includeMeta ? builder.addTimestamp().build() : builder.build(),\n };\n }\n\n publicKey = jwkToPublicKeyBytes(jwk);\n keySource = 'pinned_keys';\n keyThumbprint = actualThumbprint;\n builder.pass('key.resolve', { source: keySource, kid, thumbprint_verified: true });\n }\n } else {\n // No pinned key - need to discover\n if (policy.mode === 'offline_only') {\n builder.fail('issuer.discovery', 'E_VERIFY_KEY_NOT_FOUND', {\n error: 'Offline mode requires pinned keys',\n });\n builder.failure('key_not_found', normalizedIssuer, kid);\n return {\n valid: false,\n report: includeMeta ? builder.addTimestamp().build() : builder.build(),\n };\n }\n\n const jwksResult = await fetchIssuerJWKS(normalizedIssuer);\n\n if ('error' in jwksResult) {\n const reason = ssrfErrorToReasonCode(jwksResult.error.reason, 'key');\n builder.fail('issuer.discovery', reasonCodeToErrorCode(reason), {\n error: jwksResult.error.message,\n url: jwksResult.error.blockedUrl,\n });\n builder.failure(reason, normalizedIssuer, kid);\n return {\n valid: false,\n report: includeMeta ? builder.addTimestamp().build() : builder.build(),\n };\n }\n\n // Store raw bytes for digest computation (only when not from cache)\n if (jwksResult.rawBytes) {\n jwksRawBytes = jwksResult.rawBytes;\n }\n\n builder.pass('issuer.discovery', {\n from_cache: jwksResult.fromCache,\n keys_count: jwksResult.jwks.keys.length,\n });\n\n const revoked = findRevokedKey(kid!, jwksResult.revokedKeys);\n if (revoked) {\n builder.fail('key.resolve', 'E_REVOKED_KEY_USED', {\n kid,\n revoked_at: revoked.revoked_at,\n ...(revoked.reason && { reason: revoked.reason }),\n });\n builder.failure('key_not_found', normalizedIssuer, kid);\n return {\n valid: false,\n report: includeMeta ? builder.addTimestamp().build() : builder.build(),\n };\n }\n\n // Find the key\n const jwk = jwksResult.jwks.keys.find((k) => k.kid === kid);\n if (!jwk) {\n builder.fail('key.resolve', 'E_VERIFY_KEY_NOT_FOUND', {\n kid,\n available_kids: jwksResult.jwks.keys.map((k) => k.kid),\n });\n builder.failure('key_not_found', normalizedIssuer, kid);\n return {\n valid: false,\n report: includeMeta ? builder.addTimestamp().build() : builder.build(),\n };\n }\n\n publicKey = jwkToPublicKeyBytes(jwk);\n keySource = 'jwks_discovery';\n keyThumbprint = await computeJwkThumbprint(jwk);\n builder.pass('key.resolve', { source: keySource, kid, thumbprint: keyThumbprint });\n }\n\n // ---------------------------------------------------------------------------\n // Check 8: jws.signature - Verify signature\n // ---------------------------------------------------------------------------\n try {\n const result = await jwsVerify<PEACReceiptClaims>(receiptJws, publicKey);\n\n if (!result.valid) {\n builder.fail('jws.signature', 'E_VERIFY_SIGNATURE_INVALID', {\n error: 'Ed25519 signature verification failed',\n });\n builder.failure('signature_invalid', normalizedIssuer, kid);\n return {\n valid: false,\n report: includeMeta ? builder.addTimestamp().build() : builder.build(),\n };\n }\n\n parsedClaims = result.payload;\n builder.pass('jws.signature');\n } catch (err) {\n builder.fail('jws.signature', 'E_VERIFY_SIGNATURE_INVALID', {\n error: err instanceof Error ? err.message : String(err),\n });\n builder.failure('signature_invalid', normalizedIssuer, kid);\n return { valid: false, report: includeMeta ? builder.addTimestamp().build() : builder.build() };\n }\n\n // ---------------------------------------------------------------------------\n // Check 9: claims.time_window - Check iat/exp\n // ---------------------------------------------------------------------------\n const iatTolerance = 60; // 60 seconds tolerance for future iat\n\n // Check iat (issued at) - required field per schema\n if (parsedClaims!.iat > nowSeconds + iatTolerance) {\n builder.fail('claims.time_window', 'E_VERIFY_NOT_YET_VALID', {\n error: 'Receipt issued in the future',\n iat: parsedClaims!.iat,\n now: nowSeconds,\n tolerance: iatTolerance,\n });\n builder.failure('not_yet_valid', normalizedIssuer, kid);\n return { valid: false, report: includeMeta ? builder.addTimestamp().build() : builder.build() };\n }\n\n // Check exp (expiration) - no tolerance\n if (parsedClaims!.exp) {\n if (parsedClaims!.exp < nowSeconds) {\n builder.fail('claims.time_window', 'E_VERIFY_EXPIRED', {\n error: 'Receipt expired',\n exp: parsedClaims!.exp,\n now: nowSeconds,\n });\n builder.failure('expired', normalizedIssuer, kid);\n return {\n valid: false,\n report: includeMeta ? builder.addTimestamp().build() : builder.build(),\n };\n }\n }\n\n builder.pass('claims.time_window', {\n iat: parsedClaims!.iat,\n exp: parsedClaims!.exp,\n now: nowSeconds,\n });\n\n // ---------------------------------------------------------------------------\n // Check 10: extensions.limits - Check extension sizes\n // ---------------------------------------------------------------------------\n // Check for oversized extensions in ext object\n if (parsedClaims!.ext) {\n for (const [extKey, extValue] of Object.entries(parsedClaims!.ext)) {\n if (extValue !== undefined) {\n const extJson = JSON.stringify(extValue);\n if (extJson.length > policy.limits.max_extension_bytes) {\n builder.fail('extensions.limits', 'E_VERIFY_EXTENSION_TOO_LARGE', {\n extension: extKey,\n size: extJson.length,\n limit: policy.limits.max_extension_bytes,\n });\n builder.failure('extension_too_large', normalizedIssuer, kid);\n return {\n valid: false,\n report: includeMeta ? builder.addTimestamp().build() : builder.build(),\n };\n }\n }\n }\n }\n\n builder.pass('extensions.limits');\n\n // ---------------------------------------------------------------------------\n // Success!\n // ---------------------------------------------------------------------------\n builder.success(normalizedIssuer, kid!);\n\n // Add JWKS artifacts for enterprise debuggability\n // Map internal key source to artifact format\n const artifactKeySource = keySource === 'pinned_keys' ? 'pinned' : 'jwks_fetch';\n builder.addArtifact('issuer_key_source', artifactKeySource);\n\n if (keyThumbprint) {\n builder.addArtifact('issuer_key_thumbprint', keyThumbprint);\n }\n\n // Add JWKS digest when fetched (not from cache)\n // Computed over raw bytes to avoid encoding round-trip issues\n if (jwksRawBytes) {\n const jwksDigestHex = await sha256Hex(jwksRawBytes);\n builder.addArtifact('issuer_jwks_digest', createDigest(jwksDigestHex));\n }\n\n const report = includeMeta ? builder.addTimestamp().build() : builder.build();\n\n return {\n valid: true,\n report,\n claims: parsedClaims,\n };\n}\n\n// JWKS cache management is now in jwks-resolver.ts\n// Use clearJWKSCache() and getJWKSCacheSize() from '@peac/protocol'\n","/**\n * PEAC Transport Profile Parsers\n *\n * Implements parsing for transport profiles per TRANSPORT-PROFILES.md:\n * - Header profile (PEAC-Receipt header)\n * - Pointer profile (PEAC-Receipt-Pointer header)\n * - Body profile (peac_receipt/peac_receipts in JSON body)\n *\n * @packageDocumentation\n */\n\n// ---------------------------------------------------------------------------\n// Types\n// ---------------------------------------------------------------------------\n\n/**\n * Transport profile type\n */\nexport type TransportProfile = 'header' | 'pointer' | 'body';\n\n/**\n * Result of parsing a header transport profile\n */\nexport interface HeaderProfileResult {\n profile: 'header';\n receipt: string;\n}\n\n/**\n * Result of parsing a pointer transport profile\n */\nexport interface PointerProfileResult {\n profile: 'pointer';\n digestAlg: 'sha256';\n digestValue: string;\n url: string;\n /**\n * Extension parameters (keys starting with ext_).\n * Stored separately from normative fields for forward-compatibility.\n * Consumers SHOULD NOT rely on extension keys for core verification logic.\n */\n extensions?: Record<string, string>;\n}\n\n/**\n * Result of parsing a body transport profile\n */\nexport interface BodyProfileResult {\n profile: 'body';\n receipts: string[];\n}\n\n/**\n * Parsed transport profile (discriminated union)\n */\nexport type ParsedTransportProfile = HeaderProfileResult | PointerProfileResult | BodyProfileResult;\n\n/**\n * Transport profile parse error\n */\nexport interface TransportProfileError {\n ok: false;\n reason: 'invalid_transport' | 'malformed_receipt' | 'pointer_fetch_blocked';\n errorCode: string;\n message: string;\n}\n\n/**\n * Transport profile parse success\n */\nexport interface TransportProfileSuccess<\n T extends ParsedTransportProfile = ParsedTransportProfile,\n> {\n ok: true;\n result: T;\n}\n\n/**\n * Transport profile parse result\n */\nexport type TransportProfileParseResult<T extends ParsedTransportProfile = ParsedTransportProfile> =\n | TransportProfileSuccess<T>\n | TransportProfileError;\n\n// ---------------------------------------------------------------------------\n// Header Profile Parser\n// ---------------------------------------------------------------------------\n\n/**\n * Parse PEAC-Receipt header\n *\n * Per TRANSPORT-PROFILES.md:\n * - Multiple headers MUST be rejected\n * - Comma-separated values MUST be rejected\n * - Value MUST be JWS compact serialization (three dot-separated segments)\n *\n * @param headerValue - PEAC-Receipt header value (string or array if multiple)\n * @returns Parse result\n */\nexport function parseHeaderProfile(\n headerValue: string | string[] | undefined\n): TransportProfileParseResult<HeaderProfileResult> {\n // Check for missing header\n if (headerValue === undefined || headerValue === '') {\n return {\n ok: false,\n reason: 'invalid_transport',\n errorCode: 'E_VERIFY_INVALID_TRANSPORT',\n message: 'PEAC-Receipt header is missing',\n };\n }\n\n // Check for multiple headers (array)\n if (Array.isArray(headerValue)) {\n return {\n ok: false,\n reason: 'invalid_transport',\n errorCode: 'E_VERIFY_INVALID_TRANSPORT',\n message: 'Multiple PEAC-Receipt headers are not allowed',\n };\n }\n\n // Check for comma-separated values (HTTP header list syntax)\n if (headerValue.includes(',')) {\n // Could be comma in base64url, but JWS compact has exactly 2 periods\n // If there are commas between periods, it's likely multiple values\n const parts = headerValue.split('.');\n if (parts.length !== 3 || parts.some((p) => p.includes(','))) {\n return {\n ok: false,\n reason: 'invalid_transport',\n errorCode: 'E_VERIFY_INVALID_TRANSPORT',\n message: 'Comma-separated PEAC-Receipt values are not allowed',\n };\n }\n }\n\n // Validate JWS compact serialization structure (three segments)\n const segments = headerValue.split('.');\n if (segments.length !== 3) {\n return {\n ok: false,\n reason: 'malformed_receipt',\n errorCode: 'E_VERIFY_MALFORMED_RECEIPT',\n message: `Invalid JWS compact serialization: expected 3 segments, got ${segments.length}`,\n };\n }\n\n // All segments must be non-empty base64url strings\n const base64urlRegex = /^[A-Za-z0-9_-]*$/;\n for (let i = 0; i < segments.length; i++) {\n const segment = segments[i];\n if (segment.length === 0) {\n return {\n ok: false,\n reason: 'malformed_receipt',\n errorCode: 'E_VERIFY_MALFORMED_RECEIPT',\n message: `Invalid JWS compact serialization: segment ${i + 1} is empty`,\n };\n }\n if (!base64urlRegex.test(segment)) {\n return {\n ok: false,\n reason: 'malformed_receipt',\n errorCode: 'E_VERIFY_MALFORMED_RECEIPT',\n message: `Invalid JWS compact serialization: segment ${i + 1} contains invalid characters`,\n };\n }\n }\n\n return {\n ok: true,\n result: {\n profile: 'header',\n receipt: headerValue,\n },\n };\n}\n\n// ---------------------------------------------------------------------------\n// Pointer Profile Parser\n// ---------------------------------------------------------------------------\n\n/**\n * Parse PEAC-Receipt-Pointer header\n *\n * Per TRANSPORT-PROFILES.md:\n * - Format: RFC 9651 dictionary with sha256 and url parameters\n * - Multiple headers MUST be rejected\n * - URL MUST be HTTPS\n *\n * Example: sha256=\"7d8f...\", url=\"https://receipts.example.com/abc123\"\n *\n * @param headerValue - PEAC-Receipt-Pointer header value (string or array if multiple)\n * @returns Parse result\n */\nexport function parsePointerProfile(\n headerValue: string | string[] | undefined\n): TransportProfileParseResult<PointerProfileResult> {\n // Check for missing header\n if (headerValue === undefined || headerValue === '') {\n return {\n ok: false,\n reason: 'invalid_transport',\n errorCode: 'E_VERIFY_INVALID_TRANSPORT',\n message: 'PEAC-Receipt-Pointer header is missing',\n };\n }\n\n // Check for multiple headers (array)\n if (Array.isArray(headerValue)) {\n return {\n ok: false,\n reason: 'invalid_transport',\n errorCode: 'E_VERIFY_INVALID_TRANSPORT',\n message: 'Multiple PEAC-Receipt-Pointer headers are not allowed',\n };\n }\n\n // Parse RFC 9651 dictionary format\n // Format: sha256=\"<hex>\", url=\"<url>\"\n // We use a simple parser here instead of a full RFC 9651 implementation\n\n const parseResult = parseSimpleDictionary(headerValue);\n\n // Strict: Reject duplicate parameters\n if (parseResult.duplicates.length > 0) {\n return {\n ok: false,\n reason: 'invalid_transport',\n errorCode: 'E_VERIFY_INVALID_TRANSPORT',\n message: `PEAC-Receipt-Pointer has duplicate parameter: ${parseResult.duplicates[0]}`,\n };\n }\n\n // Strict: Reject unknown parameters (only sha256, url, and ext_* are valid)\n // Extension keys (ext_*) are allowed for forward-compatibility\n const ALLOWED_KEYS = new Set(['sha256', 'url']);\n const unknownKeys = parseResult.keys.filter((k) => !ALLOWED_KEYS.has(k) && !k.startsWith('ext_'));\n if (unknownKeys.length > 0) {\n return {\n ok: false,\n reason: 'invalid_transport',\n errorCode: 'E_VERIFY_INVALID_TRANSPORT',\n message: `PEAC-Receipt-Pointer has unknown parameter: ${unknownKeys[0]}`,\n };\n }\n\n const params = parseResult.params;\n\n if (!params.sha256) {\n return {\n ok: false,\n reason: 'invalid_transport',\n errorCode: 'E_VERIFY_INVALID_TRANSPORT',\n message: 'PEAC-Receipt-Pointer missing sha256 parameter',\n };\n }\n\n if (!params.url) {\n return {\n ok: false,\n reason: 'invalid_transport',\n errorCode: 'E_VERIFY_INVALID_TRANSPORT',\n message: 'PEAC-Receipt-Pointer missing url parameter',\n };\n }\n\n // Validate digest is lowercase hex\n const hexRegex = /^[0-9a-f]{64}$/;\n if (!hexRegex.test(params.sha256)) {\n return {\n ok: false,\n reason: 'invalid_transport',\n errorCode: 'E_VERIFY_INVALID_TRANSPORT',\n message: 'PEAC-Receipt-Pointer sha256 must be 64 lowercase hex characters',\n };\n }\n\n // Validate URL is HTTPS\n try {\n const url = new URL(params.url);\n if (url.protocol !== 'https:') {\n return {\n ok: false,\n reason: 'pointer_fetch_blocked',\n errorCode: 'E_VERIFY_POINTER_FETCH_BLOCKED',\n message: 'Pointer URL must use HTTPS',\n };\n }\n } catch {\n return {\n ok: false,\n reason: 'invalid_transport',\n errorCode: 'E_VERIFY_INVALID_TRANSPORT',\n message: 'PEAC-Receipt-Pointer url is not a valid URL',\n };\n }\n\n // Extract extension keys (ext_*) for forward-compatibility\n const extensions: Record<string, string> = {};\n for (const key of parseResult.keys) {\n if (key.startsWith('ext_')) {\n extensions[key] = params[key];\n }\n }\n\n return {\n ok: true,\n result: {\n profile: 'pointer',\n digestAlg: 'sha256',\n digestValue: params.sha256,\n url: params.url,\n ...(Object.keys(extensions).length > 0 && { extensions }),\n },\n };\n}\n\n/**\n * Simple RFC 9651-like dictionary parser result\n */\ninterface DictionaryParseResult {\n /** Parsed key-value pairs */\n params: Record<string, string>;\n /** Duplicate keys found (strict mode violation) */\n duplicates: string[];\n /** All keys found (for unknown key detection) */\n keys: string[];\n}\n\n/**\n * Simple RFC 9651-like dictionary parser (ReDoS-safe)\n *\n * Parses: key1=\"value1\", key2=\"value2\"\n * Returns map of key -> value (unquoted) plus metadata for strict validation\n *\n * Uses explicit character-by-character parsing to avoid ReDoS vulnerabilities\n * from regex alternation patterns.\n */\nfunction parseSimpleDictionary(input: string): DictionaryParseResult {\n const params: Record<string, string> = {};\n const duplicates: string[] = [];\n const keys: string[] = [];\n\n let i = 0;\n const len = input.length;\n\n while (i < len) {\n // Skip whitespace and commas\n while (i < len && (input[i] === ' ' || input[i] === ',' || input[i] === '\\t')) {\n i++;\n }\n if (i >= len) break;\n\n // Parse key (word characters only)\n const keyStart = i;\n while (i < len && /\\w/.test(input[i])) {\n i++;\n }\n const key = input.slice(keyStart, i);\n if (!key) break;\n\n // Skip whitespace before '='\n while (i < len && input[i] === ' ') i++;\n\n // Expect '='\n if (i >= len || input[i] !== '=') break;\n i++; // skip '='\n\n // Skip whitespace after '='\n while (i < len && input[i] === ' ') i++;\n\n // Parse value (quoted or unquoted)\n let value: string;\n if (input[i] === '\"') {\n // Quoted value - find closing quote\n i++; // skip opening quote\n const valueStart = i;\n while (i < len && input[i] !== '\"') {\n i++;\n }\n value = input.slice(valueStart, i);\n if (i < len) i++; // skip closing quote\n } else {\n // Unquoted value - read until comma or whitespace\n const valueStart = i;\n while (i < len && input[i] !== ',' && input[i] !== ' ' && input[i] !== '\\t') {\n i++;\n }\n value = input.slice(valueStart, i);\n }\n\n keys.push(key);\n\n // Track duplicates\n if (key in params) {\n duplicates.push(key);\n }\n\n params[key] = value;\n }\n\n return { params, duplicates, keys };\n}\n\n// ---------------------------------------------------------------------------\n// Body Profile Parser\n// ---------------------------------------------------------------------------\n\n/**\n * Parse body profile (JSON body with peac_receipt or peac_receipts)\n *\n * Per TRANSPORT-PROFILES.md:\n * - peac_receipt: single receipt (string)\n * - peac_receipts: multiple receipts (array of strings)\n *\n * @param body - Parsed JSON body object\n * @returns Parse result\n */\nexport function parseBodyProfile(body: unknown): TransportProfileParseResult<BodyProfileResult> {\n if (body === null || typeof body !== 'object') {\n return {\n ok: false,\n reason: 'invalid_transport',\n errorCode: 'E_VERIFY_INVALID_TRANSPORT',\n message: 'Body must be a JSON object',\n };\n }\n\n const obj = body as Record<string, unknown>;\n\n // Check for peac_receipts (array, takes precedence)\n if ('peac_receipts' in obj) {\n if (!Array.isArray(obj.peac_receipts)) {\n return {\n ok: false,\n reason: 'invalid_transport',\n errorCode: 'E_VERIFY_INVALID_TRANSPORT',\n message: 'peac_receipts must be an array',\n };\n }\n\n const receipts: string[] = [];\n for (let i = 0; i < obj.peac_receipts.length; i++) {\n const receipt = obj.peac_receipts[i];\n if (typeof receipt !== 'string') {\n return {\n ok: false,\n reason: 'invalid_transport',\n errorCode: 'E_VERIFY_INVALID_TRANSPORT',\n message: `peac_receipts[${i}] must be a string`,\n };\n }\n receipts.push(receipt);\n }\n\n if (receipts.length === 0) {\n return {\n ok: false,\n reason: 'invalid_transport',\n errorCode: 'E_VERIFY_INVALID_TRANSPORT',\n message: 'peac_receipts array is empty',\n };\n }\n\n return {\n ok: true,\n result: {\n profile: 'body',\n receipts,\n },\n };\n }\n\n // Check for peac_receipt (single)\n if ('peac_receipt' in obj) {\n if (typeof obj.peac_receipt !== 'string') {\n return {\n ok: false,\n reason: 'invalid_transport',\n errorCode: 'E_VERIFY_INVALID_TRANSPORT',\n message: 'peac_receipt must be a string',\n };\n }\n\n if (obj.peac_receipt.length === 0) {\n return {\n ok: false,\n reason: 'invalid_transport',\n errorCode: 'E_VERIFY_INVALID_TRANSPORT',\n message: 'peac_receipt is empty',\n };\n }\n\n return {\n ok: true,\n result: {\n profile: 'body',\n receipts: [obj.peac_receipt],\n },\n };\n }\n\n return {\n ok: false,\n reason: 'invalid_transport',\n errorCode: 'E_VERIFY_INVALID_TRANSPORT',\n message: 'Body must contain peac_receipt or peac_receipts',\n };\n}\n\n// ---------------------------------------------------------------------------\n// Auto-detect Parser\n// ---------------------------------------------------------------------------\n\n/**\n * Auto-detect and parse transport profile from request context\n *\n * @param context - Request context with headers and optional body\n * @returns Parse result\n */\nexport function parseTransportProfile(context: {\n headers: Record<string, string | string[] | undefined>;\n body?: unknown;\n}): TransportProfileParseResult {\n const peacReceipt = context.headers['peac-receipt'] ?? context.headers['PEAC-Receipt'];\n const peacPointer =\n context.headers['peac-receipt-pointer'] ?? context.headers['PEAC-Receipt-Pointer'];\n\n // Header profile takes precedence\n if (peacReceipt !== undefined) {\n return parseHeaderProfile(peacReceipt);\n }\n\n // Pointer profile second\n if (peacPointer !== undefined) {\n return parsePointerProfile(peacPointer);\n }\n\n // Body profile last (if body provided)\n if (context.body !== undefined) {\n return parseBodyProfile(context.body);\n }\n\n return {\n ok: false,\n reason: 'invalid_transport',\n errorCode: 'E_VERIFY_INVALID_TRANSPORT',\n message:\n 'No transport profile detected (missing PEAC-Receipt, PEAC-Receipt-Pointer, or body receipt)',\n };\n}\n","/**\n * PEAC Pointer Fetch with Digest Verification\n *\n * Implements secure receipt fetching via pointers per TRANSPORT-PROFILES.md:\n * - SSRF-safe fetch\n * - SHA-256 digest verification\n * - Size limits\n *\n * @packageDocumentation\n */\n\nimport { sha256Hex } from '@peac/crypto';\nimport { VERIFIER_LIMITS } from '@peac/kernel';\nimport { ssrfSafeFetch, type SSRFFetchOptions, type SSRFFetchError } from './ssrf-safe-fetch.js';\n\n// ---------------------------------------------------------------------------\n// Types\n// ---------------------------------------------------------------------------\n\n/**\n * Pointer fetch options\n */\nexport interface PointerFetchOptions {\n /** URL to fetch the receipt from */\n url: string;\n /** Expected SHA-256 digest (lowercase hex, 64 chars) */\n expectedDigest: string;\n /** Optional SSRF fetch options */\n fetchOptions?: Omit<SSRFFetchOptions, 'maxBytes'>;\n}\n\n/**\n * Successful pointer fetch result\n */\nexport interface PointerFetchSuccess {\n ok: true;\n /** Fetched receipt (JWS compact serialization) */\n receipt: string;\n /** Actual SHA-256 digest of fetched content */\n actualDigest: string;\n /** Whether digest matched expected */\n digestMatched: true;\n /** Content-Type header (if present) */\n contentType?: string;\n /**\n * Warning about unexpected Content-Type.\n * Present when Content-Type is not application/jose, application/json, or text/plain.\n * Does not cause rejection (for interoperability) but callers may want to log.\n */\n contentTypeWarning?: string;\n}\n\n/**\n * Failed pointer fetch result\n */\nexport interface PointerFetchError {\n ok: false;\n /** Error reason */\n reason:\n | 'pointer_fetch_blocked'\n | 'pointer_fetch_failed'\n | 'pointer_fetch_timeout'\n | 'pointer_fetch_too_large'\n | 'pointer_digest_mismatch'\n | 'malformed_receipt';\n /** Error code for reports */\n errorCode: string;\n /** Human-readable error message */\n message: string;\n /** Actual digest if computed (for mismatch errors) */\n actualDigest?: string;\n /** Expected digest */\n expectedDigest?: string;\n}\n\n/**\n * Pointer fetch result\n */\nexport type PointerFetchResult = PointerFetchSuccess | PointerFetchError;\n\n// ---------------------------------------------------------------------------\n// Error Mapping\n// ---------------------------------------------------------------------------\n\n/**\n * Map SSRF error reason to pointer error reason\n */\nfunction mapSsrfError(ssrfError: SSRFFetchError): PointerFetchError {\n const reason = ssrfError.reason;\n\n switch (reason) {\n case 'not_https':\n case 'private_ip':\n case 'loopback':\n case 'link_local':\n case 'dns_failure':\n case 'cross_origin_redirect':\n return {\n ok: false,\n reason: 'pointer_fetch_blocked',\n errorCode: 'E_VERIFY_POINTER_FETCH_BLOCKED',\n message: ssrfError.message,\n };\n\n case 'timeout':\n return {\n ok: false,\n reason: 'pointer_fetch_timeout',\n errorCode: 'E_VERIFY_POINTER_FETCH_TIMEOUT',\n message: ssrfError.message,\n };\n\n case 'response_too_large':\n return {\n ok: false,\n reason: 'pointer_fetch_too_large',\n errorCode: 'E_VERIFY_POINTER_FETCH_TOO_LARGE',\n message: ssrfError.message,\n };\n\n default:\n return {\n ok: false,\n reason: 'pointer_fetch_failed',\n errorCode: 'E_VERIFY_POINTER_FETCH_FAILED',\n message: ssrfError.message,\n };\n }\n}\n\n// ---------------------------------------------------------------------------\n// Pointer Fetch\n// ---------------------------------------------------------------------------\n\n/**\n * Fetch a receipt via pointer with digest verification\n *\n * Per TRANSPORT-PROFILES.md:\n * - Fetch the URL using SSRF-safe fetch\n * - Compute SHA-256 digest of response\n * - Verify digest matches expected value from header\n * - Return receipt only if digest matches\n *\n * @param options - Pointer fetch options\n * @returns Fetch result\n */\nexport async function fetchPointerWithDigest(\n options: PointerFetchOptions\n): Promise<PointerFetchResult> {\n const { url, expectedDigest, fetchOptions = {} } = options;\n\n // Validate expected digest format\n const hexRegex = /^[0-9a-f]{64}$/;\n if (!hexRegex.test(expectedDigest)) {\n return {\n ok: false,\n reason: 'pointer_fetch_failed',\n errorCode: 'E_VERIFY_POINTER_FETCH_FAILED',\n message: 'Invalid expected digest: must be 64 lowercase hex characters',\n };\n }\n\n // Validate URL is HTTPS (pre-check before fetch)\n try {\n const parsedUrl = new URL(url);\n if (parsedUrl.protocol !== 'https:') {\n return {\n ok: false,\n reason: 'pointer_fetch_blocked',\n errorCode: 'E_VERIFY_POINTER_FETCH_BLOCKED',\n message: 'Pointer URL must use HTTPS',\n };\n }\n } catch {\n return {\n ok: false,\n reason: 'pointer_fetch_failed',\n errorCode: 'E_VERIFY_POINTER_FETCH_FAILED',\n message: 'Invalid pointer URL',\n };\n }\n\n // Fetch with SSRF protection and DoS bounds\n // - Size cap: maxReceiptBytes (prevents memory exhaustion)\n // - No redirects: prevents redirect-based SSRF (pointer URL must be direct)\n // - Timeout: prevents slow-loris style attacks\n const fetchResult = await ssrfSafeFetch(url, {\n ...fetchOptions,\n maxBytes: VERIFIER_LIMITS.maxReceiptBytes,\n allowRedirects: false, // Pointer URL must be direct - no redirects\n timeoutMs: fetchOptions?.timeoutMs ?? VERIFIER_LIMITS.fetchTimeoutMs,\n headers: {\n Accept: 'application/jose, application/json, text/plain',\n ...fetchOptions.headers,\n },\n });\n\n if (!fetchResult.ok) {\n return mapSsrfError(fetchResult);\n }\n\n const receipt = fetchResult.body;\n\n // Validate Content-Type if present (warn but don't reject for interoperability)\n // Expected: application/jose, application/json, or text/plain\n const contentType = fetchResult.contentType;\n const expectedContentTypes = ['application/jose', 'application/json', 'text/plain'];\n const contentTypeWarning =\n contentType && !expectedContentTypes.some((expected) => contentType.startsWith(expected))\n ? `Unexpected Content-Type: ${contentType}; expected application/jose, application/json, or text/plain`\n : undefined;\n\n // Validate: reject empty body\n if (!receipt || receipt.trim().length === 0) {\n return {\n ok: false,\n reason: 'malformed_receipt',\n errorCode: 'E_VERIFY_MALFORMED_RECEIPT',\n message: 'Pointer target returned empty content',\n };\n }\n\n // Validate: content must look like JWS compact serialization (3 dot-separated segments)\n const jwsValidation = validateJwsCompactStructure(receipt);\n if (!jwsValidation.valid) {\n return {\n ok: false,\n reason: 'malformed_receipt',\n errorCode: 'E_VERIFY_MALFORMED_RECEIPT',\n message: jwsValidation.message,\n };\n }\n\n // Compute digest of fetched content (hash the raw string bytes)\n const actualDigest = await sha256Hex(receipt);\n\n // Verify digest matches\n if (actualDigest !== expectedDigest) {\n return {\n ok: false,\n reason: 'pointer_digest_mismatch',\n errorCode: 'E_VERIFY_POINTER_DIGEST_MISMATCH',\n message: 'Fetched receipt digest does not match expected digest',\n actualDigest,\n expectedDigest,\n };\n }\n\n return {\n ok: true,\n receipt,\n actualDigest,\n digestMatched: true,\n contentType: fetchResult.contentType,\n ...(contentTypeWarning && { contentTypeWarning }),\n };\n}\n\n/**\n * Validate that a string looks like JWS compact serialization\n *\n * A valid JWS compact has exactly 3 dot-separated base64url segments.\n *\n * @param value - String to validate\n * @returns Validation result\n */\nfunction validateJwsCompactStructure(\n value: string\n): { valid: true } | { valid: false; message: string } {\n const segments = value.split('.');\n\n if (segments.length !== 3) {\n return {\n valid: false,\n message: `Invalid JWS compact serialization: expected 3 segments, got ${segments.length}`,\n };\n }\n\n // All segments must be non-empty and contain only base64url characters\n const base64urlRegex = /^[A-Za-z0-9_-]+$/;\n\n for (let i = 0; i < segments.length; i++) {\n const segment = segments[i];\n if (segment.length === 0) {\n return {\n valid: false,\n message: `Invalid JWS compact serialization: segment ${i + 1} is empty`,\n };\n }\n if (!base64urlRegex.test(segment)) {\n return {\n valid: false,\n message: `Invalid JWS compact serialization: segment ${i + 1} contains invalid characters`,\n };\n }\n }\n\n return { valid: true };\n}\n\n/**\n * Parse pointer header key=value pairs (ReDoS-safe)\n *\n * Handles both quoted and unquoted values without complex regex alternation.\n */\nfunction parsePointerHeader(input: string): Record<string, string> {\n const params: Record<string, string> = {};\n let i = 0;\n const len = input.length;\n\n while (i < len) {\n // Skip whitespace and commas\n while (i < len && (input[i] === ' ' || input[i] === ',' || input[i] === '\\t')) {\n i++;\n }\n if (i >= len) break;\n\n // Parse key (word characters only)\n const keyStart = i;\n while (i < len && /\\w/.test(input[i])) {\n i++;\n }\n const key = input.slice(keyStart, i);\n if (!key) break;\n\n // Skip whitespace before '='\n while (i < len && input[i] === ' ') i++;\n\n // Expect '='\n if (i >= len || input[i] !== '=') break;\n i++; // skip '='\n\n // Skip whitespace after '='\n while (i < len && input[i] === ' ') i++;\n\n // Parse value (quoted or unquoted)\n let value: string;\n if (input[i] === '\"') {\n // Quoted value - find closing quote\n i++; // skip opening quote\n const valueStart = i;\n while (i < len && input[i] !== '\"') {\n i++;\n }\n value = input.slice(valueStart, i);\n if (i < len) i++; // skip closing quote\n } else {\n // Unquoted value - read until comma or whitespace\n const valueStart = i;\n while (i < len && input[i] !== ',' && input[i] !== ' ' && input[i] !== '\\t') {\n i++;\n }\n value = input.slice(valueStart, i);\n }\n\n params[key] = value;\n }\n\n return params;\n}\n\n/**\n * Verify a pointer header and fetch the receipt\n *\n * Combines parsing and fetching in a single operation.\n *\n * @param pointerHeader - PEAC-Receipt-Pointer header value\n * @param fetchOptions - Optional SSRF fetch options\n * @returns Fetch result\n */\nexport async function verifyAndFetchPointer(\n pointerHeader: string,\n fetchOptions?: Omit<SSRFFetchOptions, 'maxBytes'>\n): Promise<PointerFetchResult> {\n // Parse pointer header (RFC 9651 dictionary format)\n // Format: sha256=\"<hex>\", url=\"<url>\"\n // Using explicit parsing to avoid ReDoS in regex alternation\n const params = parsePointerHeader(pointerHeader);\n\n if (!params.sha256) {\n return {\n ok: false,\n reason: 'pointer_fetch_failed',\n errorCode: 'E_VERIFY_POINTER_FETCH_FAILED',\n message: 'PEAC-Receipt-Pointer missing sha256 parameter',\n };\n }\n\n if (!params.url) {\n return {\n ok: false,\n reason: 'pointer_fetch_failed',\n errorCode: 'E_VERIFY_POINTER_FETCH_FAILED',\n message: 'PEAC-Receipt-Pointer missing url parameter',\n };\n }\n\n return fetchPointerWithDigest({\n url: params.url,\n expectedDigest: params.sha256,\n fetchOptions,\n });\n}\n","/**\n * Optional, composable replay defense for online consumers of PEAC records.\n *\n * createReplayGuard() returns a stateful guard that classifies an already-verified\n * record as 'fresh', 'replayed', or 'outside-window'. The store is bounded by both\n * count (maxEntries) and time (a TTL purge plus an iat acceptance window), so\n * it is finite and bounded against unbounded state growth. The dedup key is\n * (iss, jti); iat gates the window. All timestamp/window values are safe integers\n * (epoch seconds); unsafe-integer input fails closed.\n *\n * This is an online acceptance policy, not a record property: PEAC adds no exp to\n * records, changes no wire bytes, and enforces nothing. The same record stays valid\n * and offline-verifiable indefinitely outside any window. The guard returns a\n * verdict; the deployer chooses the response. It is intentionally not wired into the\n * stateless verifyLocal path.\n *\n * The clock (now) returns epoch seconds; backward movement (e.g. an NTP or manual\n * wall-clock regression) is clamped internally to the last observed second, so the\n * guard stays correct even if the clock goes backward. TTL entries expire at\n * insertion-time + windowSeconds + maxClockSkewSeconds; with the clamped (monotonic)\n * clock, expiry order equals insertion order and purge is O(number expired).\n */\n\n/** Default future-skew tolerance for iat, in seconds (mirrors verifyLocal maxClockSkew). */\nconst DEFAULT_MAX_CLOCK_SKEW_SECONDS = 300;\n/** Default upper bound on retained (iss,jti) entries. */\nconst DEFAULT_MAX_ENTRIES = 100_000;\n\nexport interface ReplayGuardOptions {\n /**\n * Accept only records whose iat is within [now - windowSeconds, now + maxClockSkewSeconds].\n * Positive integer (seconds).\n */\n windowSeconds: number;\n /** Allowed future skew for iat (seconds). Default 300. Non-negative integer. */\n maxClockSkewSeconds?: number;\n /** Upper bound on retained entries. Default 100_000. Positive integer. */\n maxEntries?: number;\n /**\n * Injectable clock returning epoch seconds (tests/determinism). Backward movement\n * is clamped internally to the last observed second. Default Math.floor(Date.now() / 1000).\n */\n now?: () => number;\n}\n\nexport type ReplayGuardVerdict = 'fresh' | 'replayed' | 'outside-window';\n\nexport interface ReplayGuard {\n /** Classify a record that has already been verified (e.g. by verifyLocal). No I/O. */\n check(record: { iss: string; jti: string; iat: number }): ReplayGuardVerdict;\n}\n\n/** Internal retained-entry shape (not exported). */\ninterface ReplayEntry {\n expiresAt: number;\n}\n\nfunction safeInteger(value: number, name: string): number {\n // Use Number.isSafeInteger (not Number.isInteger) for all timestamp/window\n // arithmetic: values beyond MAX_SAFE_INTEGER lose exactness, so the guard\n // fails closed rather than computing imprecise window/TTL boundaries.\n if (!Number.isSafeInteger(value)) {\n throw new Error(`createReplayGuard: ${name} must be a safe integer`);\n }\n return value;\n}\n\nfunction positiveInt(value: number, name: string): number {\n safeInteger(value, name);\n if (value <= 0) {\n throw new Error(`createReplayGuard: ${name} must be a positive integer`);\n }\n return value;\n}\n\nfunction nonNegativeInt(value: number, name: string): number {\n safeInteger(value, name);\n if (value < 0) {\n throw new Error(`createReplayGuard: ${name} must be a non-negative integer`);\n }\n return value;\n}\n\nfunction nonEmptyString(value: string, name: string): string {\n if (typeof value !== 'string' || value.length === 0) {\n throw new Error(`createReplayGuard: ${name} must be a non-empty string`);\n }\n return value;\n}\n\n/**\n * Create a bounded replay guard for already-verified records.\n *\n * @param options - window, optional max clock skew, optional entry cap, optional clock.\n * @returns a guard whose `check(record)` returns 'fresh' | 'replayed' | 'outside-window'.\n */\nexport function createReplayGuard(options: ReplayGuardOptions): ReplayGuard {\n const windowSeconds = positiveInt(options.windowSeconds, 'windowSeconds');\n const maxClockSkewSeconds =\n options.maxClockSkewSeconds === undefined\n ? DEFAULT_MAX_CLOCK_SKEW_SECONDS\n : nonNegativeInt(options.maxClockSkewSeconds, 'maxClockSkewSeconds');\n const maxEntries =\n options.maxEntries === undefined\n ? DEFAULT_MAX_ENTRIES\n : positiveInt(options.maxEntries, 'maxEntries');\n const now = options.now ?? (() => Math.floor(Date.now() / 1000));\n\n // Date.now() is a wall clock and can move backward (NTP / manual time changes);\n // clamp to the last observed second so the insertion-order TTL purge stays correct\n // even if the clock regresses. now() is validated (safe integer) here too.\n let lastNow = Number.NEGATIVE_INFINITY;\n const currentNow = (): number => {\n const raw = safeInteger(now(), 'now()');\n if (raw < lastNow) return lastNow;\n lastNow = raw;\n return raw;\n };\n\n // key -> entry. JS Map preserves insertion order. expiresAt is computed from the\n // (clamped, monotonic) insertion-time clock, so the front of the map always holds\n // the soonest-expiring entry: a front-scan that breaks on the first not-yet-expired\n // entry is correct and O(number actually expired). A replay does not refresh the\n // entry (no recency/TTL bump), so insertion order remains the eviction order.\n const seen = new Map<string, ReplayEntry>();\n\n // Length-prefixed key so (iss=\"a\", jti=\"bc\") cannot collide with (iss=\"ab\", jti=\"c\").\n const keyOf = (iss: string, jti: string): string => `${iss.length}:${iss}${jti.length}:${jti}`;\n\n const purgeExpired = (nowSeconds: number): void => {\n for (const [key, entry] of seen) {\n if (entry.expiresAt > nowSeconds) break;\n seen.delete(key);\n }\n };\n\n return {\n check(record: { iss: string; jti: string; iat: number }): ReplayGuardVerdict {\n // Fail closed on runtime misuse (plain-JS callers bypass the TS types). Validate\n // the record before any state mutation so invalid input never changes the store.\n const iat = safeInteger(record.iat, 'record.iat');\n const iss = nonEmptyString(record.iss, 'record.iss');\n const jti = nonEmptyString(record.jti, 'record.jti');\n const t = currentNow(); // validates now() + clamps backward movement\n\n // Time bound: drop entries that can no longer match within any window.\n purgeExpired(t);\n\n // Window first: out-of-window records never consume store capacity, and the\n // verdict is unambiguous (reported outside-window without being recorded).\n if (iat < t - windowSeconds || iat > t + maxClockSkewSeconds) {\n return 'outside-window';\n }\n\n const key = keyOf(iss, jti);\n if (seen.has(key)) {\n return 'replayed';\n }\n\n // Conservative TTL: an upper bound on the latest time any record accepted now\n // could still be replayed within the acceptance window. May retain older-iat\n // entries slightly longer than their exact iat + windowSeconds horizon, but it\n // preserves monotonic expiry order and keeps the store time-bounded (a stale\n // entry re-checked short-circuits as outside-window before dedup regardless).\n // Validate the expiry sum is a safe integer before any store mutation, so an\n // overflow fails closed without evicting or inserting.\n const expiresAt = safeInteger(t + windowSeconds + maxClockSkewSeconds, 'entry expiry');\n\n // Count bound: apply the hard maxEntries cap before inserting.\n if (seen.size >= maxEntries) {\n const oldest = seen.keys().next().value;\n if (oldest !== undefined) seen.delete(oldest);\n }\n seen.set(key, { expiresAt });\n return 'fresh';\n },\n };\n}\n"]}