@sixb/core 0.1.6 → 0.1.8

package/dist/chunk-nx7k8tpr.js

@@ -0,0 +1,436 @@
+// @bun
+import {
+  captureSelectedObjectReadScope,
+  compileSelectedObjectReadScope
+} from "./chunk-r8jrnexe.js";
+import {
+  stableJsonStringify
+} from "./chunk-n6jxh8sw.js";
+
+// src/storage/share-grants/errors.ts
+class ShareGrantStorageError extends Error {
+  code;
+  name = "ShareGrantStorageError";
+  constructor(code, message, options) {
+    super(message, options);
+    this.code = code;
+  }
+}
+
+// src/shares/access-plan.ts
+var MAX_SCOPED_GRANTS = 1024;
+var MAX_SCOPED_VIEW_ROOTS_BEFORE_COMPILATION = 1024;
+var MAX_SCOPED_ACTION_SUBJECTS = 4096;
+var MAX_SCOPED_ACTION_IDENTIFIER_CHARACTERS = 1e6;
+function snapshotShareAccessPlan(input) {
+  const captured = captureAccessPlanGrants(input);
+  const selection = validateMergedViewSelection(captured.viewRoots);
+  return assembleAccessPlanSnapshot(captured.grants, selection);
+}
+function captureAccessPlanGrants(input) {
+  if (!isRecord(input)) {
+    throw new Error("[Sixb] Share access plan must contain scoped grants.");
+  }
+  const authoredGrants = input.grants;
+  if (!Array.isArray(authoredGrants)) {
+    throw new Error("[Sixb] Share access plan must contain scoped grants.");
+  }
+  const grantCount = authoredGrants.length;
+  if (grantCount > MAX_SCOPED_GRANTS) {
+    throw new Error(`[Sixb] Share access plan exceeds the maximum of ${MAX_SCOPED_GRANTS} scoped grants.`);
+  }
+  const budget = { subjectCount: 0, identifierCharacters: 0 };
+  const viewRoots = [];
+  const grants = [];
+  for (let index = 0;index < grantCount; index += 1) {
+    const grant = authoredGrants[index];
+    if (!isRecord(grant)) {
+      throw new Error(`[Sixb] Scoped grant ${index} must be an object.`);
+    }
+    const kind = grant.kind;
+    switch (kind) {
+      case "object.view":
+        grants.push(captureViewGrant(grant, index, viewRoots));
+        break;
+      case "action.apply":
+        grants.push(captureActionGrant(grant, index, budget));
+        break;
+      default:
+        throw new Error(`[Sixb] Unknown scoped grant kind '${String(kind)}'.`);
+    }
+  }
+  return { grants, viewRoots };
+}
+function captureViewGrant(grant, index, viewRoots) {
+  const selection = grant.selection;
+  if (!isRecord(selection)) {
+    throw new Error(`[Sixb] Scoped grant ${index} requires a selected object read scope.`);
+  }
+  const selectionKind = selection.kind;
+  const roots = selection.roots;
+  if (selectionKind !== "selected" || !Array.isArray(roots)) {
+    throw new Error(`[Sixb] Scoped grant ${index} requires a selected object read scope.`);
+  }
+  const rootCount = roots.length;
+  if (rootCount > MAX_SCOPED_VIEW_ROOTS_BEFORE_COMPILATION - viewRoots.length) {
+    throw new Error(`[Sixb] Share access plan exceeds the maximum of ${MAX_SCOPED_VIEW_ROOTS_BEFORE_COMPILATION} raw scoped view roots.`);
+  }
+  const rootStart = viewRoots.length;
+  for (let rootIndex = 0;rootIndex < rootCount; rootIndex += 1) {
+    viewRoots.push(roots[rootIndex]);
+  }
+  return { kind: "object.view", rootStart, rootCount };
+}
+function captureActionGrant(grant, index, budget) {
+  const authoredActionId = grant.actionId;
+  const authoredSubjects = grant.subjects;
+  const actionId = nonEmpty(authoredActionId, `Scoped grant ${index} action id`);
+  addActionIdentifierCharacters(budget, actionId.length);
+  if (!Array.isArray(authoredSubjects)) {
+    throw new Error(`[Sixb] Scoped grant ${index} action subjects must be an array.`);
+  }
+  const subjectCount = authoredSubjects.length;
+  budget.subjectCount += subjectCount;
+  if (budget.subjectCount > MAX_SCOPED_ACTION_SUBJECTS) {
+    throw new Error(`[Sixb] Share access plan exceeds the maximum of ${MAX_SCOPED_ACTION_SUBJECTS} scoped action subjects.`);
+  }
+  const subjects = [];
+  for (let subjectIndex = 0;subjectIndex < subjectCount; subjectIndex += 1) {
+    const subject = captureActionSubject(authoredSubjects[subjectIndex], index, subjectIndex);
+    addActionIdentifierCharacters(budget, subject.objectTypeId.length + subject.primaryId.length);
+    subjects.push(subject);
+  }
+  return Object.freeze({ kind: "action.apply", actionId, subjects: Object.freeze(subjects) });
+}
+function captureActionSubject(subject, grantIndex, subjectIndex) {
+  if (!isRecord(subject)) {
+    throw new Error(`[Sixb] Scoped grant ${grantIndex} subject ${subjectIndex} must be an object.`);
+  }
+  const authoredObjectTypeId = subject.objectTypeId;
+  const authoredPrimaryId = subject.primaryId;
+  const objectTypeId = nonEmpty(authoredObjectTypeId, `Scoped grant ${grantIndex} subject ${subjectIndex} object type id`);
+  const primaryId = nonEmpty(authoredPrimaryId, `Scoped grant ${grantIndex} subject ${subjectIndex} primary id`);
+  return Object.freeze({ objectTypeId, primaryId });
+}
+function addActionIdentifierCharacters(budget, count) {
+  budget.identifierCharacters += count;
+  if (budget.identifierCharacters > MAX_SCOPED_ACTION_IDENTIFIER_CHARACTERS) {
+    throw new Error(`[Sixb] Share access plan exceeds the maximum of ${MAX_SCOPED_ACTION_IDENTIFIER_CHARACTERS} scoped action identifier characters.`);
+  }
+}
+function validateMergedViewSelection(roots) {
+  const selection = captureSelectedObjectReadScope({ kind: "selected", roots });
+  compileSelectedObjectReadScope(selection);
+  return selection;
+}
+function assembleAccessPlanSnapshot(capturedGrants, selection) {
+  const grants = capturedGrants.map((grant) => {
+    if (grant.kind === "action.apply")
+      return grant;
+    const roots = Object.freeze(selection.roots.slice(grant.rootStart, grant.rootStart + grant.rootCount));
+    return Object.freeze({
+      kind: "object.view",
+      selection: Object.freeze({ kind: "selected", roots })
+    });
+  });
+  return Object.freeze({ grants: Object.freeze(grants) });
+}
+function objectReadScopeForAccessPlan(plan) {
+  return Object.freeze({
+    kind: "selected",
+    roots: Object.freeze(plan.grants.flatMap((grant) => grant.kind === "object.view" ? [...grant.selection.roots] : []))
+  });
+}
+function nonEmpty(value, label) {
+  if (typeof value !== "string" || !value.trim()) {
+    throw new Error(`[Sixb] ${label} must not be empty.`);
+  }
+  return value;
+}
+function isRecord(value) {
+  return typeof value === "object" && value !== null;
+}
+
+// src/storage/share-grants/record.ts
+import { createHash } from "crypto";
+var DEFAULT_LIST_LIMIT = 50;
+var MAX_LIST_LIMIT = 200;
+var MAX_DESTINATION_PATH_LENGTH = 4096;
+var SHA256_HEX = /^[0-9a-f]{64}$/;
+var SHARED_APP_PATH_PREFIX = "/shared";
+function normalizeShareGrantCreate(input) {
+  if (!isRecord2(input))
+    throw invalidInput("Share grant create input must be an object.");
+  const projectId = identifier(input.projectId, "Project id");
+  const id = identifier(input.id, "Share grant id");
+  const definitionId = identifier(input.definitionId, "Share definition id");
+  const target = normalizeObjectRef(input.target, "Share target");
+  const issuedBy = normalizeAuthorizablePrincipal(input.issuedBy, "Share issuer");
+  const authoritySnapshot = normalizeAuthoritySnapshot(input.authoritySnapshot, target);
+  const tokenHash = sha256(input.tokenHash, "Share token hash");
+  const destinationPath = normalizeDestinationPath(input.destinationPath);
+  const createdAt = inputDate(input.createdAt, "Share creation time");
+  const expiresAt = inputDate(input.expiresAt, "Share expiry time");
+  if (expiresAt.getTime() <= createdAt.getTime()) {
+    throw invalidInput("Share expiry time must be later than creation time.");
+  }
+  return {
+    id,
+    projectId,
+    definitionId,
+    target,
+    issuedBy,
+    authoritySnapshot,
+    authorityDigest: shareAuthorityDigest(authoritySnapshot),
+    tokenHash,
+    destinationPath,
+    createdAt,
+    expiresAt
+  };
+}
+function parseShareGrantRecord(input) {
+  if (!isRecord2(input))
+    throw invalidRecord("Share grant row must be an object.");
+  try {
+    const projectId = identifier(input.projectId, "Project id");
+    const id = identifier(input.id, "Share grant id");
+    const definitionId = identifier(input.definitionId, "Share definition id");
+    const target = normalizeObjectRef(input.target, "Share target");
+    const issuedBy = normalizeAuthorizablePrincipal(input.issuedBy, "Share issuer");
+    const authoritySnapshot = normalizeAuthoritySnapshot(input.authoritySnapshot, target);
+    const authorityDigest = sha256(input.authorityDigest, "Share authority digest");
+    const expectedDigest = shareAuthorityDigest(authoritySnapshot);
+    if (authorityDigest !== expectedDigest) {
+      throw invalidRecord("Share authority digest does not match its snapshot.");
+    }
+    const tokenHash = sha256(input.tokenHash, "Share token hash");
+    const destinationPath = normalizeDestinationPath(input.destinationPath);
+    const createdAt = storedDate(input.createdAt, "Share creation time");
+    const expiresAt = storedDate(input.expiresAt, "Share expiry time");
+    if (expiresAt.getTime() <= createdAt.getTime()) {
+      throw invalidRecord("Share expiry time must be later than creation time.");
+    }
+    const revokedAtValue = input.revokedAt;
+    const revokedByValue = input.revokedBy;
+    if (revokedAtValue === undefined !== (revokedByValue === undefined)) {
+      throw invalidRecord("Share revocation time and actor must be stored together.");
+    }
+    if (revokedAtValue === null || revokedByValue === null) {
+      throw invalidRecord("Share revocation fields must be omitted rather than null.");
+    }
+    const revokedAt = revokedAtValue === undefined ? undefined : storedDate(revokedAtValue, "Share revocation time");
+    const revokedBy = revokedByValue === undefined ? undefined : normalizePrincipal(revokedByValue, "Share revocation actor");
+    if (revokedAt && revokedAt.getTime() < createdAt.getTime()) {
+      throw invalidRecord("Share revocation time must not precede creation time.");
+    }
+    return {
+      id,
+      projectId,
+      definitionId,
+      target,
+      issuedBy,
+      authoritySnapshot,
+      authorityDigest,
+      tokenHash,
+      destinationPath,
+      createdAt,
+      expiresAt,
+      ...revokedAt === undefined ? {} : { revokedAt },
+      ...revokedBy === undefined ? {} : { revokedBy }
+    };
+  } catch (error) {
+    if (error instanceof ShareGrantStorageError) {
+      if (error.code === "invalid_record")
+        throw error;
+      throw invalidRecord(error.message.replace(/^\[Sixb\] /, ""), error);
+    }
+    throw error;
+  }
+}
+function normalizeGetShareGrantByIdInput(input) {
+  if (!isRecord2(input))
+    throw invalidInput("Share grant lookup input must be an object.");
+  return {
+    projectId: identifier(input.projectId, "Project id"),
+    id: identifier(input.id, "Share grant id")
+  };
+}
+function normalizeListShareGrantsInput(input) {
+  if (!isRecord2(input))
+    throw invalidInput("Share grant list input must be an object.");
+  const projectId = identifier(input.projectId, "Project id");
+  const definitionId = input.definitionId === undefined ? undefined : identifier(input.definitionId, "Share definition id");
+  const target = input.target === undefined ? undefined : normalizeObjectRef(input.target, "Share target");
+  const includeRevoked = optionalBoolean(input.includeRevoked, "includeRevoked");
+  const includeExpired = optionalBoolean(input.includeExpired, "includeExpired");
+  const now = inputDate(input.now, "Share grant list time");
+  const limit = safeInteger(input.limit ?? DEFAULT_LIST_LIMIT, "Share grant list limit", 1);
+  const offset = safeInteger(input.offset ?? 0, "Share grant list offset", 0);
+  if (limit > MAX_LIST_LIMIT) {
+    throw invalidInput(`Share grant list limit must not exceed ${MAX_LIST_LIMIT}.`);
+  }
+  return {
+    projectId,
+    ...definitionId === undefined ? {} : { definitionId },
+    ...target === undefined ? {} : { target },
+    includeRevoked,
+    includeExpired,
+    now,
+    limit,
+    offset
+  };
+}
+function normalizeRevokeShareGrantInput(input, createdAt) {
+  if (!isRecord2(input))
+    throw invalidInput("Share grant revocation input must be an object.");
+  const normalized = {
+    projectId: identifier(input.projectId, "Project id"),
+    id: identifier(input.id, "Share grant id"),
+    revokedAt: inputDate(input.revokedAt, "Share revocation time"),
+    revokedBy: normalizePrincipal(input.revokedBy, "Share revocation actor")
+  };
+  if (createdAt && normalized.revokedAt.getTime() < createdAt.getTime()) {
+    throw invalidInput("Share revocation time must not precede creation time.");
+  }
+  return normalized;
+}
+function cloneShareGrantRecord(input) {
+  return structuredClone(input);
+}
+function shareAuthorityDigest(snapshot) {
+  return createHash("sha256").update(stableJsonStringify(snapshot)).digest("hex");
+}
+function normalizeAuthoritySnapshot(value, target) {
+  if (!isRecord2(value) || value.version !== 1 || !isRecord2(value.access)) {
+    throw invalidInput("Share authority snapshot version is unsupported.");
+  }
+  let access;
+  try {
+    access = snapshotShareAccessPlan(value.access);
+  } catch (error) {
+    if (error instanceof ShareGrantStorageError)
+      throw error;
+    const reason = error instanceof Error ? error.message.replace(/^\[Sixb\] /, "") : String(error);
+    throw invalidInput(`Share authority snapshot is invalid: ${reason}`, error);
+  }
+  assertAccessTargets(access, target);
+  return Object.freeze({ version: 1, access });
+}
+function assertAccessTargets(access, target) {
+  for (const grant of access.grants) {
+    if (grant.kind === "object.view") {
+      for (const root of grant.selection.roots) {
+        if (!sameObjectRef(root.anchor, target)) {
+          throw invalidInput("Every Share view root must match the exact Share target.");
+        }
+      }
+      continue;
+    }
+    for (const subject of grant.subjects) {
+      if (!sameObjectRef(subject, target)) {
+        throw invalidInput("Every shared Action subject must match the exact Share target.");
+      }
+    }
+  }
+}
+function sameObjectRef(left, right) {
+  return left.objectTypeId === right.objectTypeId && left.primaryId === right.primaryId;
+}
+function normalizeObjectRef(value, label) {
+  if (!isRecord2(value))
+    throw invalidInput(`${label} must be an exact object reference.`);
+  return Object.freeze({
+    objectTypeId: identifier(value.objectTypeId, `${label} object type id`),
+    primaryId: identifier(value.primaryId, `${label} primary id`)
+  });
+}
+function normalizeAuthorizablePrincipal(value, label) {
+  const principal = normalizePrincipal(value, label);
+  if (principal.type === "system") {
+    throw invalidInput(`${label} must be a user or service account.`);
+  }
+  return principal;
+}
+function normalizePrincipal(value, label) {
+  if (!isRecord2(value))
+    throw invalidInput(`${label} must be a principal.`);
+  if (value.type !== "user" && value.type !== "serviceAccount" && value.type !== "system") {
+    throw invalidInput(`${label} has an unsupported type.`);
+  }
+  return Object.freeze({ type: value.type, id: identifier(value.id, `${label} id`) });
+}
+function normalizeDestinationPath(value) {
+  if (typeof value !== "string" || value.length === 0) {
+    throw invalidInput("Share destination path must not be empty.");
+  }
+  if (value.length > MAX_DESTINATION_PATH_LENGTH) {
+    throw invalidInput(`Share destination path must not exceed ${MAX_DESTINATION_PATH_LENGTH} characters.`);
+  }
+  if (!value.startsWith("/") || value.includes("//") || value.includes("?") || value.includes("#") || value.includes("\\") || value.includes("\x00")) {
+    throw invalidInput("Share destination path must be an absolute same-origin pathname without query or fragment.");
+  }
+  const normalized = new URL(value, "https://sixb.invalid").pathname;
+  if (normalized !== value) {
+    throw invalidInput("Share destination path must already be canonical.");
+  }
+  let decoded;
+  try {
+    decoded = decodeURIComponent(value).replaceAll("\\", "/");
+  } catch {
+    throw invalidInput("Share destination path must contain valid percent-encoding.");
+  }
+  if (decoded === SHARED_APP_PATH_PREFIX || decoded.startsWith(`${SHARED_APP_PATH_PREFIX}/`)) {
+    throw invalidInput("Share destination path must not use the framework-owned '/shared' namespace.");
+  }
+  return value;
+}
+function identifier(value, label) {
+  if (typeof value !== "string" || value.trim().length === 0 || value.includes("\x00")) {
+    throw invalidInput(`${label} must be a non-empty string without NUL bytes.`);
+  }
+  return value;
+}
+function sha256(value, label) {
+  if (typeof value !== "string" || !SHA256_HEX.test(value)) {
+    throw invalidInput(`${label} must be a lowercase SHA-256 hex digest.`);
+  }
+  return value;
+}
+function inputDate(value, label) {
+  if (!(value instanceof Date) || !Number.isFinite(value.getTime())) {
+    throw invalidInput(`${label} must be a valid Date.`);
+  }
+  return new Date(value);
+}
+function storedDate(value, label) {
+  const parsed = value instanceof Date ? new Date(value) : typeof value === "string" ? new Date(value) : new Date(Number.NaN);
+  if (!Number.isFinite(parsed.getTime()))
+    throw invalidRecord(`${label} is invalid.`);
+  return parsed;
+}
+function optionalBoolean(value, label) {
+  if (value === undefined)
+    return false;
+  if (typeof value !== "boolean")
+    throw invalidInput(`${label} must be a boolean.`);
+  return value;
+}
+function safeInteger(value, label, minimum) {
+  if (!Number.isSafeInteger(value) || value < minimum) {
+    throw invalidInput(`${label} must be a safe integer greater than or equal to ${minimum}.`);
+  }
+  return value;
+}
+function isRecord2(value) {
+  return typeof value === "object" && value !== null && !Array.isArray(value);
+}
+function invalidInput(message, cause) {
+  return new ShareGrantStorageError("invalid_input", `[Sixb] ${message}`, { cause });
+}
+function invalidRecord(message, cause) {
+  return new ShareGrantStorageError("invalid_record", `[Sixb] ${message}`, { cause });
+}
+
+export { ShareGrantStorageError, snapshotShareAccessPlan, objectReadScopeForAccessPlan, normalizeShareGrantCreate, parseShareGrantRecord, normalizeGetShareGrantByIdInput, normalizeListShareGrantsInput, normalizeRevokeShareGrantInput, cloneShareGrantRecord, shareAuthorityDigest };
+
+//# debugId=0F41D81FEC343F9E64756E2164756E21

package/dist/chunk-nx7k8tpr.js.map

@@ -0,0 +1,12 @@
+{
+  "version": 3,
+  "sources": ["../src/storage/share-grants/errors.ts", "../src/shares/access-plan.ts", "../src/storage/share-grants/record.ts"],
+  "sourcesContent": [
+    "export type ShareGrantStorageErrorCode = \"duplicate\" | \"invalid_input\" | \"invalid_record\"\n\n/** Provider-level control signal; Core maps it to the public Share lifecycle error vocabulary. */\nexport class ShareGrantStorageError extends Error {\n  readonly name = \"ShareGrantStorageError\"\n\n  constructor(\n    readonly code: ShareGrantStorageErrorCode,\n    message: string,\n    options?: ErrorOptions\n  ) {\n    super(message, options)\n  }\n}\n",
+    "import type { ObjectRef } from \"../ontology\"\nimport {\n  captureSelectedObjectReadScope,\n  compileSelectedObjectReadScope,\n} from \"../storage/objects/read-scope\"\nimport type { ObjectReadRoot, SelectedObjectReadScope } from \"../storage/objects/types\"\n\nconst MAX_SCOPED_GRANTS = 1_024\nconst MAX_SCOPED_VIEW_ROOTS_BEFORE_COMPILATION = 1_024\nconst MAX_SCOPED_ACTION_SUBJECTS = 4_096\nconst MAX_SCOPED_ACTION_IDENTIFIER_CHARACTERS = 1_000_000\n\n/** One capability paired with the exact resources it authorizes. */\nexport type ShareScopedGrant = ShareScopedViewGrant | ShareScopedActionGrant\n\nexport interface ShareScopedViewGrant {\n  readonly kind: \"object.view\"\n  readonly selection: SelectedObjectReadScope\n}\n\nexport interface ShareScopedActionGrant {\n  readonly kind: \"action.apply\"\n  readonly actionId: string\n  readonly subjects: readonly ObjectRef[]\n}\n\n/** Internal authority compiled from a delegation such as a shared-access grant. */\nexport interface ShareAccessPlan {\n  readonly grants: readonly ShareScopedGrant[]\n}\n\ninterface CapturedViewGrant {\n  readonly kind: \"object.view\"\n  readonly rootStart: number\n  readonly rootCount: number\n}\n\ntype CapturedGrant = CapturedViewGrant | ShareScopedActionGrant\n\ninterface ActionCaptureBudget {\n  subjectCount: number\n  identifierCharacters: number\n}\n\n/** Validate and detach an access plan before registering process-local authority. */\nexport function snapshotShareAccessPlan(input: ShareAccessPlan): ShareAccessPlan {\n  const captured = captureAccessPlanGrants(input)\n  const selection = validateMergedViewSelection(captured.viewRoots)\n  return assembleAccessPlanSnapshot(captured.grants, selection)\n}\n\nfunction captureAccessPlanGrants(input: ShareAccessPlan): {\n  readonly grants: readonly CapturedGrant[]\n  readonly viewRoots: readonly ObjectReadRoot[]\n} {\n  if (!isRecord(input)) {\n    throw new Error(\"[Sixb] Share access plan must contain scoped grants.\")\n  }\n  const authoredGrants = input.grants\n  if (!Array.isArray(authoredGrants)) {\n    throw new Error(\"[Sixb] Share access plan must contain scoped grants.\")\n  }\n  const grantCount = authoredGrants.length\n  if (grantCount > MAX_SCOPED_GRANTS) {\n    throw new Error(\n      `[Sixb] Share access plan exceeds the maximum of ${MAX_SCOPED_GRANTS} scoped grants.`\n    )\n  }\n\n  // Share budgets across grants and capture caller-controlled fields exactly once.\n  const budget: ActionCaptureBudget = { subjectCount: 0, identifierCharacters: 0 }\n  const viewRoots: ObjectReadRoot[] = []\n  const grants: CapturedGrant[] = []\n  for (let index = 0; index < grantCount; index += 1) {\n    const grant = authoredGrants[index]\n    if (!isRecord(grant)) {\n      throw new Error(`[Sixb] Scoped grant ${index} must be an object.`)\n    }\n    const kind = grant.kind\n    switch (kind) {\n      case \"object.view\":\n        grants.push(captureViewGrant(grant, index, viewRoots))\n        break\n      case \"action.apply\":\n        grants.push(captureActionGrant(grant, index, budget))\n        break\n      default:\n        throw new Error(`[Sixb] Unknown scoped grant kind '${String(kind)}'.`)\n    }\n  }\n  return { grants, viewRoots }\n}\n\nfunction captureViewGrant(\n  grant: Record<string, unknown>,\n  index: number,\n  viewRoots: ObjectReadRoot[]\n): CapturedViewGrant {\n  const selection = grant.selection\n  if (!isRecord(selection)) {\n    throw new Error(`[Sixb] Scoped grant ${index} requires a selected object read scope.`)\n  }\n  const selectionKind = selection.kind\n  const roots = selection.roots\n  if (selectionKind !== \"selected\" || !Array.isArray(roots)) {\n    throw new Error(`[Sixb] Scoped grant ${index} requires a selected object read scope.`)\n  }\n  const rootCount = roots.length\n  if (rootCount > MAX_SCOPED_VIEW_ROOTS_BEFORE_COMPILATION - viewRoots.length) {\n    throw new Error(\n      `[Sixb] Share access plan exceeds the maximum of ${MAX_SCOPED_VIEW_ROOTS_BEFORE_COMPILATION} raw scoped view roots.`\n    )\n  }\n  const rootStart = viewRoots.length\n  for (let rootIndex = 0; rootIndex < rootCount; rootIndex += 1) {\n    viewRoots.push(roots[rootIndex] as ObjectReadRoot)\n  }\n  return { kind: \"object.view\", rootStart, rootCount }\n}\n\nfunction captureActionGrant(\n  grant: Record<string, unknown>,\n  index: number,\n  budget: ActionCaptureBudget\n): ShareScopedActionGrant {\n  const authoredActionId = grant.actionId\n  const authoredSubjects = grant.subjects\n  const actionId = nonEmpty(authoredActionId, `Scoped grant ${index} action id`)\n  addActionIdentifierCharacters(budget, actionId.length)\n  if (!Array.isArray(authoredSubjects)) {\n    throw new Error(`[Sixb] Scoped grant ${index} action subjects must be an array.`)\n  }\n  const subjectCount = authoredSubjects.length\n  budget.subjectCount += subjectCount\n  if (budget.subjectCount > MAX_SCOPED_ACTION_SUBJECTS) {\n    throw new Error(\n      `[Sixb] Share access plan exceeds the maximum of ${MAX_SCOPED_ACTION_SUBJECTS} scoped action subjects.`\n    )\n  }\n  const subjects: ObjectRef[] = []\n  for (let subjectIndex = 0; subjectIndex < subjectCount; subjectIndex += 1) {\n    const subject = captureActionSubject(authoredSubjects[subjectIndex], index, subjectIndex)\n    addActionIdentifierCharacters(budget, subject.objectTypeId.length + subject.primaryId.length)\n    subjects.push(subject)\n  }\n  return Object.freeze({ kind: \"action.apply\", actionId, subjects: Object.freeze(subjects) })\n}\n\nfunction captureActionSubject(\n  subject: unknown,\n  grantIndex: number,\n  subjectIndex: number\n): ObjectRef {\n  if (!isRecord(subject)) {\n    throw new Error(`[Sixb] Scoped grant ${grantIndex} subject ${subjectIndex} must be an object.`)\n  }\n  const authoredObjectTypeId = subject.objectTypeId\n  const authoredPrimaryId = subject.primaryId\n  const objectTypeId = nonEmpty(\n    authoredObjectTypeId,\n    `Scoped grant ${grantIndex} subject ${subjectIndex} object type id`\n  )\n  const primaryId = nonEmpty(\n    authoredPrimaryId,\n    `Scoped grant ${grantIndex} subject ${subjectIndex} primary id`\n  )\n  return Object.freeze({ objectTypeId, primaryId })\n}\n\nfunction addActionIdentifierCharacters(budget: ActionCaptureBudget, count: number): void {\n  budget.identifierCharacters += count\n  if (budget.identifierCharacters > MAX_SCOPED_ACTION_IDENTIFIER_CHARACTERS) {\n    throw new Error(\n      `[Sixb] Share access plan exceeds the maximum of ${MAX_SCOPED_ACTION_IDENTIFIER_CHARACTERS} scoped action identifier characters.`\n    )\n  }\n}\n\nfunction validateMergedViewSelection(roots: readonly ObjectReadRoot[]): SelectedObjectReadScope {\n  // Snapshot all roots together so the provider's limits apply globally across view grants.\n  const selection = captureSelectedObjectReadScope({ kind: \"selected\", roots })\n  // Compile the exact immutable snapshot, without rereading caller-controlled data.\n  compileSelectedObjectReadScope(selection)\n  return selection\n}\n\nfunction assembleAccessPlanSnapshot(\n  capturedGrants: readonly CapturedGrant[],\n  selection: SelectedObjectReadScope\n): ShareAccessPlan {\n  const grants = capturedGrants.map((grant): ShareScopedGrant => {\n    if (grant.kind === \"action.apply\") return grant\n    const roots = Object.freeze(\n      selection.roots.slice(grant.rootStart, grant.rootStart + grant.rootCount)\n    )\n    return Object.freeze({\n      kind: \"object.view\",\n      selection: Object.freeze({ kind: \"selected\", roots }),\n    })\n  })\n  return Object.freeze({ grants: Object.freeze(grants) })\n}\n\n/** Merge view grants only; capability/resource pairing remains intact for every other grant. */\nexport function objectReadScopeForAccessPlan(plan: ShareAccessPlan): SelectedObjectReadScope {\n  return Object.freeze({\n    kind: \"selected\",\n    roots: Object.freeze(\n      plan.grants.flatMap((grant) =>\n        grant.kind === \"object.view\" ? [...grant.selection.roots] : []\n      )\n    ),\n  })\n}\n\nfunction nonEmpty(value: unknown, label: string): string {\n  if (typeof value !== \"string\" || !value.trim()) {\n    throw new Error(`[Sixb] ${label} must not be empty.`)\n  }\n  return value\n}\n\nfunction isRecord(value: unknown): value is Record<string, unknown> {\n  return typeof value === \"object\" && value !== null\n}\n",
+    "import { createHash } from \"node:crypto\"\nimport type { Principal } from \"../../auth\"\nimport type { AuthorizablePrincipal } from \"../../execution/types\"\nimport { stableJsonStringify } from \"../../json\"\nimport type { ObjectRef } from \"../../ontology\"\nimport { snapshotShareAccessPlan } from \"../../shares/access-plan\"\nimport { ShareGrantStorageError } from \"./errors\"\nimport type {\n  CreateShareGrantInput,\n  GetShareGrantByIdInput,\n  ListShareGrantsInput,\n  NormalizedListShareGrantsInput,\n  RevokeShareGrantInput,\n  ShareAuthoritySnapshot,\n  ShareGrantRecord,\n} from \"./types\"\n\nconst DEFAULT_LIST_LIMIT = 50\nconst MAX_LIST_LIMIT = 200\nconst MAX_DESTINATION_PATH_LENGTH = 4_096\nconst SHA256_HEX = /^[0-9a-f]{64}$/\nconst SHARED_APP_PATH_PREFIX = \"/shared\"\n\n/** Normalize, detach, and derive every persisted field owned by Share grant storage. */\nexport function normalizeShareGrantCreate(input: CreateShareGrantInput): ShareGrantRecord {\n  if (!isRecord(input)) throw invalidInput(\"Share grant create input must be an object.\")\n  const projectId = identifier(input.projectId, \"Project id\")\n  const id = identifier(input.id, \"Share grant id\")\n  const definitionId = identifier(input.definitionId, \"Share definition id\")\n  const target = normalizeObjectRef(input.target, \"Share target\")\n  const issuedBy = normalizeAuthorizablePrincipal(input.issuedBy, \"Share issuer\")\n  const authoritySnapshot = normalizeAuthoritySnapshot(input.authoritySnapshot, target)\n  const tokenHash = sha256(input.tokenHash, \"Share token hash\")\n  const destinationPath = normalizeDestinationPath(input.destinationPath)\n  const createdAt = inputDate(input.createdAt, \"Share creation time\")\n  const expiresAt = inputDate(input.expiresAt, \"Share expiry time\")\n\n  if (expiresAt.getTime() <= createdAt.getTime()) {\n    throw invalidInput(\"Share expiry time must be later than creation time.\")\n  }\n\n  return {\n    id,\n    projectId,\n    definitionId,\n    target,\n    issuedBy,\n    authoritySnapshot,\n    authorityDigest: shareAuthorityDigest(authoritySnapshot),\n    tokenHash,\n    destinationPath,\n    createdAt,\n    expiresAt,\n  }\n}\n\n/** Parse a provider row and reject unknown/corrupt durable authority instead of widening it. */\nexport function parseShareGrantRecord(input: unknown): ShareGrantRecord {\n  if (!isRecord(input)) throw invalidRecord(\"Share grant row must be an object.\")\n\n  try {\n    const projectId = identifier(input.projectId, \"Project id\")\n    const id = identifier(input.id, \"Share grant id\")\n    const definitionId = identifier(input.definitionId, \"Share definition id\")\n    const target = normalizeObjectRef(input.target, \"Share target\")\n    const issuedBy = normalizeAuthorizablePrincipal(input.issuedBy, \"Share issuer\")\n    const authoritySnapshot = normalizeAuthoritySnapshot(input.authoritySnapshot, target)\n    const authorityDigest = sha256(input.authorityDigest, \"Share authority digest\")\n    const expectedDigest = shareAuthorityDigest(authoritySnapshot)\n    if (authorityDigest !== expectedDigest) {\n      throw invalidRecord(\"Share authority digest does not match its snapshot.\")\n    }\n    const tokenHash = sha256(input.tokenHash, \"Share token hash\")\n    const destinationPath = normalizeDestinationPath(input.destinationPath)\n    const createdAt = storedDate(input.createdAt, \"Share creation time\")\n    const expiresAt = storedDate(input.expiresAt, \"Share expiry time\")\n    if (expiresAt.getTime() <= createdAt.getTime()) {\n      throw invalidRecord(\"Share expiry time must be later than creation time.\")\n    }\n\n    const revokedAtValue = input.revokedAt\n    const revokedByValue = input.revokedBy\n    if ((revokedAtValue === undefined) !== (revokedByValue === undefined)) {\n      throw invalidRecord(\"Share revocation time and actor must be stored together.\")\n    }\n    if (revokedAtValue === null || revokedByValue === null) {\n      throw invalidRecord(\"Share revocation fields must be omitted rather than null.\")\n    }\n\n    const revokedAt =\n      revokedAtValue === undefined ? undefined : storedDate(revokedAtValue, \"Share revocation time\")\n    const revokedBy =\n      revokedByValue === undefined\n        ? undefined\n        : normalizePrincipal(revokedByValue, \"Share revocation actor\")\n    if (revokedAt && revokedAt.getTime() < createdAt.getTime()) {\n      throw invalidRecord(\"Share revocation time must not precede creation time.\")\n    }\n\n    return {\n      id,\n      projectId,\n      definitionId,\n      target,\n      issuedBy,\n      authoritySnapshot,\n      authorityDigest,\n      tokenHash,\n      destinationPath,\n      createdAt,\n      expiresAt,\n      ...(revokedAt === undefined ? {} : { revokedAt }),\n      ...(revokedBy === undefined ? {} : { revokedBy }),\n    }\n  } catch (error) {\n    if (error instanceof ShareGrantStorageError) {\n      if (error.code === \"invalid_record\") throw error\n      throw invalidRecord(error.message.replace(/^\\[Sixb\\] /, \"\"), error)\n    }\n    throw error\n  }\n}\n\nexport function normalizeGetShareGrantByIdInput(\n  input: GetShareGrantByIdInput\n): GetShareGrantByIdInput {\n  if (!isRecord(input)) throw invalidInput(\"Share grant lookup input must be an object.\")\n  return {\n    projectId: identifier(input.projectId, \"Project id\"),\n    id: identifier(input.id, \"Share grant id\"),\n  }\n}\n\nexport function normalizeListShareGrantsInput(\n  input: ListShareGrantsInput\n): NormalizedListShareGrantsInput {\n  if (!isRecord(input)) throw invalidInput(\"Share grant list input must be an object.\")\n  const projectId = identifier(input.projectId, \"Project id\")\n  const definitionId =\n    input.definitionId === undefined\n      ? undefined\n      : identifier(input.definitionId, \"Share definition id\")\n  const target =\n    input.target === undefined ? undefined : normalizeObjectRef(input.target, \"Share target\")\n  const includeRevoked = optionalBoolean(input.includeRevoked, \"includeRevoked\")\n  const includeExpired = optionalBoolean(input.includeExpired, \"includeExpired\")\n  const now = inputDate(input.now, \"Share grant list time\")\n  const limit = safeInteger(input.limit ?? DEFAULT_LIST_LIMIT, \"Share grant list limit\", 1)\n  const offset = safeInteger(input.offset ?? 0, \"Share grant list offset\", 0)\n  if (limit > MAX_LIST_LIMIT) {\n    throw invalidInput(`Share grant list limit must not exceed ${MAX_LIST_LIMIT}.`)\n  }\n\n  return {\n    projectId,\n    ...(definitionId === undefined ? {} : { definitionId }),\n    ...(target === undefined ? {} : { target }),\n    includeRevoked,\n    includeExpired,\n    now,\n    limit,\n    offset,\n  }\n}\n\nexport function normalizeRevokeShareGrantInput(\n  input: RevokeShareGrantInput,\n  createdAt?: Date\n): RevokeShareGrantInput {\n  if (!isRecord(input)) throw invalidInput(\"Share grant revocation input must be an object.\")\n  const normalized = {\n    projectId: identifier(input.projectId, \"Project id\"),\n    id: identifier(input.id, \"Share grant id\"),\n    revokedAt: inputDate(input.revokedAt, \"Share revocation time\"),\n    revokedBy: normalizePrincipal(input.revokedBy, \"Share revocation actor\"),\n  }\n  if (createdAt && normalized.revokedAt.getTime() < createdAt.getTime()) {\n    throw invalidInput(\"Share revocation time must not precede creation time.\")\n  }\n  return normalized\n}\n\nexport function cloneShareGrantRecord(input: ShareGrantRecord): ShareGrantRecord {\n  return structuredClone(input)\n}\n\nexport function shareAuthorityDigest(snapshot: ShareAuthoritySnapshot): string {\n  return createHash(\"sha256\").update(stableJsonStringify(snapshot)).digest(\"hex\")\n}\n\nfunction normalizeAuthoritySnapshot(value: unknown, target: ObjectRef): ShareAuthoritySnapshot {\n  if (!isRecord(value) || value.version !== 1 || !isRecord(value.access)) {\n    throw invalidInput(\"Share authority snapshot version is unsupported.\")\n  }\n  let access: ShareAuthoritySnapshot[\"access\"]\n  try {\n    access = snapshotShareAccessPlan(value.access as never)\n  } catch (error) {\n    if (error instanceof ShareGrantStorageError) throw error\n    const reason = error instanceof Error ? error.message.replace(/^\\[Sixb\\] /, \"\") : String(error)\n    throw invalidInput(`Share authority snapshot is invalid: ${reason}`, error)\n  }\n  assertAccessTargets(access, target)\n  return Object.freeze({ version: 1, access })\n}\n\nfunction assertAccessTargets(access: ShareAuthoritySnapshot[\"access\"], target: ObjectRef): void {\n  for (const grant of access.grants) {\n    if (grant.kind === \"object.view\") {\n      for (const root of grant.selection.roots) {\n        if (!sameObjectRef(root.anchor, target)) {\n          throw invalidInput(\"Every Share view root must match the exact Share target.\")\n        }\n      }\n      continue\n    }\n    for (const subject of grant.subjects) {\n      if (!sameObjectRef(subject, target)) {\n        throw invalidInput(\"Every shared Action subject must match the exact Share target.\")\n      }\n    }\n  }\n}\n\nfunction sameObjectRef(left: ObjectRef, right: ObjectRef): boolean {\n  return left.objectTypeId === right.objectTypeId && left.primaryId === right.primaryId\n}\n\nfunction normalizeObjectRef(value: unknown, label: string): ObjectRef {\n  if (!isRecord(value)) throw invalidInput(`${label} must be an exact object reference.`)\n  return Object.freeze({\n    objectTypeId: identifier(value.objectTypeId, `${label} object type id`),\n    primaryId: identifier(value.primaryId, `${label} primary id`),\n  })\n}\n\nfunction normalizeAuthorizablePrincipal(value: unknown, label: string): AuthorizablePrincipal {\n  const principal = normalizePrincipal(value, label)\n  if (principal.type === \"system\") {\n    throw invalidInput(`${label} must be a user or service account.`)\n  }\n  return principal\n}\n\nfunction normalizePrincipal(value: unknown, label: string): Principal {\n  if (!isRecord(value)) throw invalidInput(`${label} must be a principal.`)\n  if (value.type !== \"user\" && value.type !== \"serviceAccount\" && value.type !== \"system\") {\n    throw invalidInput(`${label} has an unsupported type.`)\n  }\n  return Object.freeze({ type: value.type, id: identifier(value.id, `${label} id`) })\n}\n\nfunction normalizeDestinationPath(value: unknown): string {\n  if (typeof value !== \"string\" || value.length === 0) {\n    throw invalidInput(\"Share destination path must not be empty.\")\n  }\n  if (value.length > MAX_DESTINATION_PATH_LENGTH) {\n    throw invalidInput(\n      `Share destination path must not exceed ${MAX_DESTINATION_PATH_LENGTH} characters.`\n    )\n  }\n  if (\n    !value.startsWith(\"/\") ||\n    value.includes(\"//\") ||\n    value.includes(\"?\") ||\n    value.includes(\"#\") ||\n    value.includes(\"\\\\\") ||\n    value.includes(\"\\0\")\n  ) {\n    throw invalidInput(\n      \"Share destination path must be an absolute same-origin pathname without query or fragment.\"\n    )\n  }\n  const normalized = new URL(value, \"https://sixb.invalid\").pathname\n  if (normalized !== value) {\n    throw invalidInput(\"Share destination path must already be canonical.\")\n  }\n  let decoded: string\n  try {\n    decoded = decodeURIComponent(value).replaceAll(\"\\\\\", \"/\")\n  } catch {\n    throw invalidInput(\"Share destination path must contain valid percent-encoding.\")\n  }\n  if (decoded === SHARED_APP_PATH_PREFIX || decoded.startsWith(`${SHARED_APP_PATH_PREFIX}/`)) {\n    throw invalidInput(\n      \"Share destination path must not use the framework-owned '/shared' namespace.\"\n    )\n  }\n  return value\n}\n\nfunction identifier(value: unknown, label: string): string {\n  if (typeof value !== \"string\" || value.trim().length === 0 || value.includes(\"\\0\")) {\n    throw invalidInput(`${label} must be a non-empty string without NUL bytes.`)\n  }\n  return value\n}\n\nfunction sha256(value: unknown, label: string): string {\n  if (typeof value !== \"string\" || !SHA256_HEX.test(value)) {\n    throw invalidInput(`${label} must be a lowercase SHA-256 hex digest.`)\n  }\n  return value\n}\n\nfunction inputDate(value: unknown, label: string): Date {\n  if (!(value instanceof Date) || !Number.isFinite(value.getTime())) {\n    throw invalidInput(`${label} must be a valid Date.`)\n  }\n  return new Date(value)\n}\n\nfunction storedDate(value: unknown, label: string): Date {\n  const parsed =\n    value instanceof Date\n      ? new Date(value)\n      : typeof value === \"string\"\n        ? new Date(value)\n        : new Date(Number.NaN)\n  if (!Number.isFinite(parsed.getTime())) throw invalidRecord(`${label} is invalid.`)\n  return parsed\n}\n\nfunction optionalBoolean(value: unknown, label: string): boolean {\n  if (value === undefined) return false\n  if (typeof value !== \"boolean\") throw invalidInput(`${label} must be a boolean.`)\n  return value\n}\n\nfunction safeInteger(value: unknown, label: string, minimum: number): number {\n  if (!Number.isSafeInteger(value) || (value as number) < minimum) {\n    throw invalidInput(`${label} must be a safe integer greater than or equal to ${minimum}.`)\n  }\n  return value as number\n}\n\nfunction isRecord(value: unknown): value is Record<string, unknown> {\n  return typeof value === \"object\" && value !== null && !Array.isArray(value)\n}\n\nfunction invalidInput(message: string, cause?: unknown): ShareGrantStorageError {\n  return new ShareGrantStorageError(\"invalid_input\", `[Sixb] ${message}`, { cause })\n}\n\nfunction invalidRecord(message: string, cause?: unknown): ShareGrantStorageError {\n  return new ShareGrantStorageError(\"invalid_record\", `[Sixb] ${message}`, { cause })\n}\n"
+  ],
+  "mappings": ";;;;;;;;;;AAGO,MAAM,+BAA+B,MAAM;AAAA,EAIrC;AAAA,EAHF,OAAO;AAAA,EAEhB,WAAW,CACA,MACT,SACA,SACA;AAAA,IACA,MAAM,SAAS,OAAO;AAAA,IAJb;AAAA;AAMb;;;ACNA,IAAM,oBAAoB;AAC1B,IAAM,2CAA2C;AACjD,IAAM,6BAA6B;AACnC,IAAM,0CAA0C;AAmCzC,SAAS,uBAAuB,CAAC,OAAyC;AAAA,EAC/E,MAAM,WAAW,wBAAwB,KAAK;AAAA,EAC9C,MAAM,YAAY,4BAA4B,SAAS,SAAS;AAAA,EAChE,OAAO,2BAA2B,SAAS,QAAQ,SAAS;AAAA;AAG9D,SAAS,uBAAuB,CAAC,OAG/B;AAAA,EACA,IAAI,CAAC,SAAS,KAAK,GAAG;AAAA,IACpB,MAAM,IAAI,MAAM,sDAAsD;AAAA,EACxE;AAAA,EACA,MAAM,iBAAiB,MAAM;AAAA,EAC7B,IAAI,CAAC,MAAM,QAAQ,cAAc,GAAG;AAAA,IAClC,MAAM,IAAI,MAAM,sDAAsD;AAAA,EACxE;AAAA,EACA,MAAM,aAAa,eAAe;AAAA,EAClC,IAAI,aAAa,mBAAmB;AAAA,IAClC,MAAM,IAAI,MACR,mDAAmD,kCACrD;AAAA,EACF;AAAA,EAGA,MAAM,SAA8B,EAAE,cAAc,GAAG,sBAAsB,EAAE;AAAA,EAC/E,MAAM,YAA8B,CAAC;AAAA,EACrC,MAAM,SAA0B,CAAC;AAAA,EACjC,SAAS,QAAQ,EAAG,QAAQ,YAAY,SAAS,GAAG;AAAA,IAClD,MAAM,QAAQ,eAAe;AAAA,IAC7B,IAAI,CAAC,SAAS,KAAK,GAAG;AAAA,MACpB,MAAM,IAAI,MAAM,uBAAuB,0BAA0B;AAAA,IACnE;AAAA,IACA,MAAM,OAAO,MAAM;AAAA,IACnB,QAAQ;AAAA,WACD;AAAA,QACH,OAAO,KAAK,iBAAiB,OAAO,OAAO,SAAS,CAAC;AAAA,QACrD;AAAA,WACG;AAAA,QACH,OAAO,KAAK,mBAAmB,OAAO,OAAO,MAAM,CAAC;AAAA,QACpD;AAAA;AAAA,QAEA,MAAM,IAAI,MAAM,qCAAqC,OAAO,IAAI,KAAK;AAAA;AAAA,EAE3E;AAAA,EACA,OAAO,EAAE,QAAQ,UAAU;AAAA;AAG7B,SAAS,gBAAgB,CACvB,OACA,OACA,WACmB;AAAA,EACnB,MAAM,YAAY,MAAM;AAAA,EACxB,IAAI,CAAC,SAAS,SAAS,GAAG;AAAA,IACxB,MAAM,IAAI,MAAM,uBAAuB,8CAA8C;AAAA,EACvF;AAAA,EACA,MAAM,gBAAgB,UAAU;AAAA,EAChC,MAAM,QAAQ,UAAU;AAAA,EACxB,IAAI,kBAAkB,cAAc,CAAC,MAAM,QAAQ,KAAK,GAAG;AAAA,IACzD,MAAM,IAAI,MAAM,uBAAuB,8CAA8C;AAAA,EACvF;AAAA,EACA,MAAM,YAAY,MAAM;AAAA,EACxB,IAAI,YAAY,2CAA2C,UAAU,QAAQ;AAAA,IAC3E,MAAM,IAAI,MACR,mDAAmD,iEACrD;AAAA,EACF;AAAA,EACA,MAAM,YAAY,UAAU;AAAA,EAC5B,SAAS,YAAY,EAAG,YAAY,WAAW,aAAa,GAAG;AAAA,IAC7D,UAAU,KAAK,MAAM,UAA4B;AAAA,EACnD;AAAA,EACA,OAAO,EAAE,MAAM,eAAe,WAAW,UAAU;AAAA;AAGrD,SAAS,kBAAkB,CACzB,OACA,OACA,QACwB;AAAA,EACxB,MAAM,mBAAmB,MAAM;AAAA,EAC/B,MAAM,mBAAmB,MAAM;AAAA,EAC/B,MAAM,WAAW,SAAS,kBAAkB,gBAAgB,iBAAiB;AAAA,EAC7E,8BAA8B,QAAQ,SAAS,MAAM;AAAA,EACrD,IAAI,CAAC,MAAM,QAAQ,gBAAgB,GAAG;AAAA,IACpC,MAAM,IAAI,MAAM,uBAAuB,yCAAyC;AAAA,EAClF;AAAA,EACA,MAAM,eAAe,iBAAiB;AAAA,EACtC,OAAO,gBAAgB;AAAA,EACvB,IAAI,OAAO,eAAe,4BAA4B;AAAA,IACpD,MAAM,IAAI,MACR,mDAAmD,oDACrD;AAAA,EACF;AAAA,EACA,MAAM,WAAwB,CAAC;AAAA,EAC/B,SAAS,eAAe,EAAG,eAAe,cAAc,gBAAgB,GAAG;AAAA,IACzE,MAAM,UAAU,qBAAqB,iBAAiB,eAAe,OAAO,YAAY;AAAA,IACxF,8BAA8B,QAAQ,QAAQ,aAAa,SAAS,QAAQ,UAAU,MAAM;AAAA,IAC5F,SAAS,KAAK,OAAO;AAAA,EACvB;AAAA,EACA,OAAO,OAAO,OAAO,EAAE,MAAM,gBAAgB,UAAU,UAAU,OAAO,OAAO,QAAQ,EAAE,CAAC;AAAA;AAG5F,SAAS,oBAAoB,CAC3B,SACA,YACA,cACW;AAAA,EACX,IAAI,CAAC,SAAS,OAAO,GAAG;AAAA,IACtB,MAAM,IAAI,MAAM,uBAAuB,sBAAsB,iCAAiC;AAAA,EAChG;AAAA,EACA,MAAM,uBAAuB,QAAQ;AAAA,EACrC,MAAM,oBAAoB,QAAQ;AAAA,EAClC,MAAM,eAAe,SACnB,sBACA,gBAAgB,sBAAsB,6BACxC;AAAA,EACA,MAAM,YAAY,SAChB,mBACA,gBAAgB,sBAAsB,yBACxC;AAAA,EACA,OAAO,OAAO,OAAO,EAAE,cAAc,UAAU,CAAC;AAAA;AAGlD,SAAS,6BAA6B,CAAC,QAA6B,OAAqB;AAAA,EACvF,OAAO,wBAAwB;AAAA,EAC/B,IAAI,OAAO,uBAAuB,yCAAyC;AAAA,IACzE,MAAM,IAAI,MACR,mDAAmD,8EACrD;AAAA,EACF;AAAA;AAGF,SAAS,2BAA2B,CAAC,OAA2D;AAAA,EAE9F,MAAM,YAAY,+BAA+B,EAAE,MAAM,YAAY,MAAM,CAAC;AAAA,EAE5E,+BAA+B,SAAS;AAAA,EACxC,OAAO;AAAA;AAGT,SAAS,0BAA0B,CACjC,gBACA,WACiB;AAAA,EACjB,MAAM,SAAS,eAAe,IAAI,CAAC,UAA4B;AAAA,IAC7D,IAAI,MAAM,SAAS;AAAA,MAAgB,OAAO;AAAA,IAC1C,MAAM,QAAQ,OAAO,OACnB,UAAU,MAAM,MAAM,MAAM,WAAW,MAAM,YAAY,MAAM,SAAS,CAC1E;AAAA,IACA,OAAO,OAAO,OAAO;AAAA,MACnB,MAAM;AAAA,MACN,WAAW,OAAO,OAAO,EAAE,MAAM,YAAY,MAAM,CAAC;AAAA,IACtD,CAAC;AAAA,GACF;AAAA,EACD,OAAO,OAAO,OAAO,EAAE,QAAQ,OAAO,OAAO,MAAM,EAAE,CAAC;AAAA;AAIjD,SAAS,4BAA4B,CAAC,MAAgD;AAAA,EAC3F,OAAO,OAAO,OAAO;AAAA,IACnB,MAAM;AAAA,IACN,OAAO,OAAO,OACZ,KAAK,OAAO,QAAQ,CAAC,UACnB,MAAM,SAAS,gBAAgB,CAAC,GAAG,MAAM,UAAU,KAAK,IAAI,CAAC,CAC/D,CACF;AAAA,EACF,CAAC;AAAA;AAGH,SAAS,QAAQ,CAAC,OAAgB,OAAuB;AAAA,EACvD,IAAI,OAAO,UAAU,YAAY,CAAC,MAAM,KAAK,GAAG;AAAA,IAC9C,MAAM,IAAI,MAAM,UAAU,0BAA0B;AAAA,EACtD;AAAA,EACA,OAAO;AAAA;AAGT,SAAS,QAAQ,CAAC,OAAkD;AAAA,EAClE,OAAO,OAAO,UAAU,YAAY,UAAU;AAAA;;;AC/NhD;AAiBA,IAAM,qBAAqB;AAC3B,IAAM,iBAAiB;AACvB,IAAM,8BAA8B;AACpC,IAAM,aAAa;AACnB,IAAM,yBAAyB;AAGxB,SAAS,yBAAyB,CAAC,OAAgD;AAAA,EACxF,IAAI,CAAC,UAAS,KAAK;AAAA,IAAG,MAAM,aAAa,6CAA6C;AAAA,EACtF,MAAM,YAAY,WAAW,MAAM,WAAW,YAAY;AAAA,EAC1D,MAAM,KAAK,WAAW,MAAM,IAAI,gBAAgB;AAAA,EAChD,MAAM,eAAe,WAAW,MAAM,cAAc,qBAAqB;AAAA,EACzE,MAAM,SAAS,mBAAmB,MAAM,QAAQ,cAAc;AAAA,EAC9D,MAAM,WAAW,+BAA+B,MAAM,UAAU,cAAc;AAAA,EAC9E,MAAM,oBAAoB,2BAA2B,MAAM,mBAAmB,MAAM;AAAA,EACpF,MAAM,YAAY,OAAO,MAAM,WAAW,kBAAkB;AAAA,EAC5D,MAAM,kBAAkB,yBAAyB,MAAM,eAAe;AAAA,EACtE,MAAM,YAAY,UAAU,MAAM,WAAW,qBAAqB;AAAA,EAClE,MAAM,YAAY,UAAU,MAAM,WAAW,mBAAmB;AAAA,EAEhE,IAAI,UAAU,QAAQ,KAAK,UAAU,QAAQ,GAAG;AAAA,IAC9C,MAAM,aAAa,qDAAqD;AAAA,EAC1E;AAAA,EAEA,OAAO;AAAA,IACL;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA,iBAAiB,qBAAqB,iBAAiB;AAAA,IACvD;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,EACF;AAAA;AAIK,SAAS,qBAAqB,CAAC,OAAkC;AAAA,EACtE,IAAI,CAAC,UAAS,KAAK;AAAA,IAAG,MAAM,cAAc,oCAAoC;AAAA,EAE9E,IAAI;AAAA,IACF,MAAM,YAAY,WAAW,MAAM,WAAW,YAAY;AAAA,IAC1D,MAAM,KAAK,WAAW,MAAM,IAAI,gBAAgB;AAAA,IAChD,MAAM,eAAe,WAAW,MAAM,cAAc,qBAAqB;AAAA,IACzE,MAAM,SAAS,mBAAmB,MAAM,QAAQ,cAAc;AAAA,IAC9D,MAAM,WAAW,+BAA+B,MAAM,UAAU,cAAc;AAAA,IAC9E,MAAM,oBAAoB,2BAA2B,MAAM,mBAAmB,MAAM;AAAA,IACpF,MAAM,kBAAkB,OAAO,MAAM,iBAAiB,wBAAwB;AAAA,IAC9E,MAAM,iBAAiB,qBAAqB,iBAAiB;AAAA,IAC7D,IAAI,oBAAoB,gBAAgB;AAAA,MACtC,MAAM,cAAc,qDAAqD;AAAA,IAC3E;AAAA,IACA,MAAM,YAAY,OAAO,MAAM,WAAW,kBAAkB;AAAA,IAC5D,MAAM,kBAAkB,yBAAyB,MAAM,eAAe;AAAA,IACtE,MAAM,YAAY,WAAW,MAAM,WAAW,qBAAqB;AAAA,IACnE,MAAM,YAAY,WAAW,MAAM,WAAW,mBAAmB;AAAA,IACjE,IAAI,UAAU,QAAQ,KAAK,UAAU,QAAQ,GAAG;AAAA,MAC9C,MAAM,cAAc,qDAAqD;AAAA,IAC3E;AAAA,IAEA,MAAM,iBAAiB,MAAM;AAAA,IAC7B,MAAM,iBAAiB,MAAM;AAAA,IAC7B,IAAK,mBAAmB,eAAgB,mBAAmB,YAAY;AAAA,MACrE,MAAM,cAAc,0DAA0D;AAAA,IAChF;AAAA,IACA,IAAI,mBAAmB,QAAQ,mBAAmB,MAAM;AAAA,MACtD,MAAM,cAAc,2DAA2D;AAAA,IACjF;AAAA,IAEA,MAAM,YACJ,mBAAmB,YAAY,YAAY,WAAW,gBAAgB,uBAAuB;AAAA,IAC/F,MAAM,YACJ,mBAAmB,YACf,YACA,mBAAmB,gBAAgB,wBAAwB;AAAA,IACjE,IAAI,aAAa,UAAU,QAAQ,IAAI,UAAU,QAAQ,GAAG;AAAA,MAC1D,MAAM,cAAc,uDAAuD;AAAA,IAC7E;AAAA,IAEA,OAAO;AAAA,MACL;AAAA,MACA;AAAA,MACA;AAAA,MACA;AAAA,MACA;AAAA,MACA;AAAA,MACA;AAAA,MACA;AAAA,MACA;AAAA,MACA;AAAA,MACA;AAAA,SACI,cAAc,YAAY,CAAC,IAAI,EAAE,UAAU;AAAA,SAC3C,cAAc,YAAY,CAAC,IAAI,EAAE,UAAU;AAAA,IACjD;AAAA,IACA,OAAO,OAAO;AAAA,IACd,IAAI,iBAAiB,wBAAwB;AAAA,MAC3C,IAAI,MAAM,SAAS;AAAA,QAAkB,MAAM;AAAA,MAC3C,MAAM,cAAc,MAAM,QAAQ,QAAQ,cAAc,EAAE,GAAG,KAAK;AAAA,IACpE;AAAA,IACA,MAAM;AAAA;AAAA;AAIH,SAAS,+BAA+B,CAC7C,OACwB;AAAA,EACxB,IAAI,CAAC,UAAS,KAAK;AAAA,IAAG,MAAM,aAAa,6CAA6C;AAAA,EACtF,OAAO;AAAA,IACL,WAAW,WAAW,MAAM,WAAW,YAAY;AAAA,IACnD,IAAI,WAAW,MAAM,IAAI,gBAAgB;AAAA,EAC3C;AAAA;AAGK,SAAS,6BAA6B,CAC3C,OACgC;AAAA,EAChC,IAAI,CAAC,UAAS,KAAK;AAAA,IAAG,MAAM,aAAa,2CAA2C;AAAA,EACpF,MAAM,YAAY,WAAW,MAAM,WAAW,YAAY;AAAA,EAC1D,MAAM,eACJ,MAAM,iBAAiB,YACnB,YACA,WAAW,MAAM,cAAc,qBAAqB;AAAA,EAC1D,MAAM,SACJ,MAAM,WAAW,YAAY,YAAY,mBAAmB,MAAM,QAAQ,cAAc;AAAA,EAC1F,MAAM,iBAAiB,gBAAgB,MAAM,gBAAgB,gBAAgB;AAAA,EAC7E,MAAM,iBAAiB,gBAAgB,MAAM,gBAAgB,gBAAgB;AAAA,EAC7E,MAAM,MAAM,UAAU,MAAM,KAAK,uBAAuB;AAAA,EACxD,MAAM,QAAQ,YAAY,MAAM,SAAS,oBAAoB,0BAA0B,CAAC;AAAA,EACxF,MAAM,SAAS,YAAY,MAAM,UAAU,GAAG,2BAA2B,CAAC;AAAA,EAC1E,IAAI,QAAQ,gBAAgB;AAAA,IAC1B,MAAM,aAAa,0CAA0C,iBAAiB;AAAA,EAChF;AAAA,EAEA,OAAO;AAAA,IACL;AAAA,OACI,iBAAiB,YAAY,CAAC,IAAI,EAAE,aAAa;AAAA,OACjD,WAAW,YAAY,CAAC,IAAI,EAAE,OAAO;AAAA,IACzC;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,EACF;AAAA;AAGK,SAAS,8BAA8B,CAC5C,OACA,WACuB;AAAA,EACvB,IAAI,CAAC,UAAS,KAAK;AAAA,IAAG,MAAM,aAAa,iDAAiD;AAAA,EAC1F,MAAM,aAAa;AAAA,IACjB,WAAW,WAAW,MAAM,WAAW,YAAY;AAAA,IACnD,IAAI,WAAW,MAAM,IAAI,gBAAgB;AAAA,IACzC,WAAW,UAAU,MAAM,WAAW,uBAAuB;AAAA,IAC7D,WAAW,mBAAmB,MAAM,WAAW,wBAAwB;AAAA,EACzE;AAAA,EACA,IAAI,aAAa,WAAW,UAAU,QAAQ,IAAI,UAAU,QAAQ,GAAG;AAAA,IACrE,MAAM,aAAa,uDAAuD;AAAA,EAC5E;AAAA,EACA,OAAO;AAAA;AAGF,SAAS,qBAAqB,CAAC,OAA2C;AAAA,EAC/E,OAAO,gBAAgB,KAAK;AAAA;AAGvB,SAAS,oBAAoB,CAAC,UAA0C;AAAA,EAC7E,OAAO,WAAW,QAAQ,EAAE,OAAO,oBAAoB,QAAQ,CAAC,EAAE,OAAO,KAAK;AAAA;AAGhF,SAAS,0BAA0B,CAAC,OAAgB,QAA2C;AAAA,EAC7F,IAAI,CAAC,UAAS,KAAK,KAAK,MAAM,YAAY,KAAK,CAAC,UAAS,MAAM,MAAM,GAAG;AAAA,IACtE,MAAM,aAAa,kDAAkD;AAAA,EACvE;AAAA,EACA,IAAI;AAAA,EACJ,IAAI;AAAA,IACF,SAAS,wBAAwB,MAAM,MAAe;AAAA,IACtD,OAAO,OAAO;AAAA,IACd,IAAI,iBAAiB;AAAA,MAAwB,MAAM;AAAA,IACnD,MAAM,SAAS,iBAAiB,QAAQ,MAAM,QAAQ,QAAQ,cAAc,EAAE,IAAI,OAAO,KAAK;AAAA,IAC9F,MAAM,aAAa,wCAAwC,UAAU,KAAK;AAAA;AAAA,EAE5E,oBAAoB,QAAQ,MAAM;AAAA,EAClC,OAAO,OAAO,OAAO,EAAE,SAAS,GAAG,OAAO,CAAC;AAAA;AAG7C,SAAS,mBAAmB,CAAC,QAA0C,QAAyB;AAAA,EAC9F,WAAW,SAAS,OAAO,QAAQ;AAAA,IACjC,IAAI,MAAM,SAAS,eAAe;AAAA,MAChC,WAAW,QAAQ,MAAM,UAAU,OAAO;AAAA,QACxC,IAAI,CAAC,cAAc,KAAK,QAAQ,MAAM,GAAG;AAAA,UACvC,MAAM,aAAa,0DAA0D;AAAA,QAC/E;AAAA,MACF;AAAA,MACA;AAAA,IACF;AAAA,IACA,WAAW,WAAW,MAAM,UAAU;AAAA,MACpC,IAAI,CAAC,cAAc,SAAS,MAAM,GAAG;AAAA,QACnC,MAAM,aAAa,gEAAgE;AAAA,MACrF;AAAA,IACF;AAAA,EACF;AAAA;AAGF,SAAS,aAAa,CAAC,MAAiB,OAA2B;AAAA,EACjE,OAAO,KAAK,iBAAiB,MAAM,gBAAgB,KAAK,cAAc,MAAM;AAAA;AAG9E,SAAS,kBAAkB,CAAC,OAAgB,OAA0B;AAAA,EACpE,IAAI,CAAC,UAAS,KAAK;AAAA,IAAG,MAAM,aAAa,GAAG,0CAA0C;AAAA,EACtF,OAAO,OAAO,OAAO;AAAA,IACnB,cAAc,WAAW,MAAM,cAAc,GAAG,sBAAsB;AAAA,IACtE,WAAW,WAAW,MAAM,WAAW,GAAG,kBAAkB;AAAA,EAC9D,CAAC;AAAA;AAGH,SAAS,8BAA8B,CAAC,OAAgB,OAAsC;AAAA,EAC5F,MAAM,YAAY,mBAAmB,OAAO,KAAK;AAAA,EACjD,IAAI,UAAU,SAAS,UAAU;AAAA,IAC/B,MAAM,aAAa,GAAG,0CAA0C;AAAA,EAClE;AAAA,EACA,OAAO;AAAA;AAGT,SAAS,kBAAkB,CAAC,OAAgB,OAA0B;AAAA,EACpE,IAAI,CAAC,UAAS,KAAK;AAAA,IAAG,MAAM,aAAa,GAAG,4BAA4B;AAAA,EACxE,IAAI,MAAM,SAAS,UAAU,MAAM,SAAS,oBAAoB,MAAM,SAAS,UAAU;AAAA,IACvF,MAAM,aAAa,GAAG,gCAAgC;AAAA,EACxD;AAAA,EACA,OAAO,OAAO,OAAO,EAAE,MAAM,MAAM,MAAM,IAAI,WAAW,MAAM,IAAI,GAAG,UAAU,EAAE,CAAC;AAAA;AAGpF,SAAS,wBAAwB,CAAC,OAAwB;AAAA,EACxD,IAAI,OAAO,UAAU,YAAY,MAAM,WAAW,GAAG;AAAA,IACnD,MAAM,aAAa,2CAA2C;AAAA,EAChE;AAAA,EACA,IAAI,MAAM,SAAS,6BAA6B;AAAA,IAC9C,MAAM,aACJ,0CAA0C,yCAC5C;AAAA,EACF;AAAA,EACA,IACE,CAAC,MAAM,WAAW,GAAG,KACrB,MAAM,SAAS,IAAI,KACnB,MAAM,SAAS,GAAG,KAClB,MAAM,SAAS,GAAG,KAClB,MAAM,SAAS,IAAI,KACnB,MAAM,SAAS,MAAI,GACnB;AAAA,IACA,MAAM,aACJ,4FACF;AAAA,EACF;AAAA,EACA,MAAM,aAAa,IAAI,IAAI,OAAO,sBAAsB,EAAE;AAAA,EAC1D,IAAI,eAAe,OAAO;AAAA,IACxB,MAAM,aAAa,mDAAmD;AAAA,EACxE;AAAA,EACA,IAAI;AAAA,EACJ,IAAI;AAAA,IACF,UAAU,mBAAmB,KAAK,EAAE,WAAW,MAAM,GAAG;AAAA,IACxD,MAAM;AAAA,IACN,MAAM,aAAa,6DAA6D;AAAA;AAAA,EAElF,IAAI,YAAY,0BAA0B,QAAQ,WAAW,GAAG,yBAAyB,GAAG;AAAA,IAC1F,MAAM,aACJ,8EACF;AAAA,EACF;AAAA,EACA,OAAO;AAAA;AAGT,SAAS,UAAU,CAAC,OAAgB,OAAuB;AAAA,EACzD,IAAI,OAAO,UAAU,YAAY,MAAM,KAAK,EAAE,WAAW,KAAK,MAAM,SAAS,MAAI,GAAG;AAAA,IAClF,MAAM,aAAa,GAAG,qDAAqD;AAAA,EAC7E;AAAA,EACA,OAAO;AAAA;AAGT,SAAS,MAAM,CAAC,OAAgB,OAAuB;AAAA,EACrD,IAAI,OAAO,UAAU,YAAY,CAAC,WAAW,KAAK,KAAK,GAAG;AAAA,IACxD,MAAM,aAAa,GAAG,+CAA+C;AAAA,EACvE;AAAA,EACA,OAAO;AAAA;AAGT,SAAS,SAAS,CAAC,OAAgB,OAAqB;AAAA,EACtD,IAAI,EAAE,iBAAiB,SAAS,CAAC,OAAO,SAAS,MAAM,QAAQ,CAAC,GAAG;AAAA,IACjE,MAAM,aAAa,GAAG,6BAA6B;AAAA,EACrD;AAAA,EACA,OAAO,IAAI,KAAK,KAAK;AAAA;AAGvB,SAAS,UAAU,CAAC,OAAgB,OAAqB;AAAA,EACvD,MAAM,SACJ,iBAAiB,OACb,IAAI,KAAK,KAAK,IACd,OAAO,UAAU,WACf,IAAI,KAAK,KAAK,IACd,IAAI,KAAK,OAAO,GAAG;AAAA,EAC3B,IAAI,CAAC,OAAO,SAAS,OAAO,QAAQ,CAAC;AAAA,IAAG,MAAM,cAAc,GAAG,mBAAmB;AAAA,EAClF,OAAO;AAAA;AAGT,SAAS,eAAe,CAAC,OAAgB,OAAwB;AAAA,EAC/D,IAAI,UAAU;AAAA,IAAW,OAAO;AAAA,EAChC,IAAI,OAAO,UAAU;AAAA,IAAW,MAAM,aAAa,GAAG,0BAA0B;AAAA,EAChF,OAAO;AAAA;AAGT,SAAS,WAAW,CAAC,OAAgB,OAAe,SAAyB;AAAA,EAC3E,IAAI,CAAC,OAAO,cAAc,KAAK,KAAM,QAAmB,SAAS;AAAA,IAC/D,MAAM,aAAa,GAAG,yDAAyD,UAAU;AAAA,EAC3F;AAAA,EACA,OAAO;AAAA;AAGT,SAAS,SAAQ,CAAC,OAAkD;AAAA,EAClE,OAAO,OAAO,UAAU,YAAY,UAAU,QAAQ,CAAC,MAAM,QAAQ,KAAK;AAAA;AAG5E,SAAS,YAAY,CAAC,SAAiB,OAAyC;AAAA,EAC9E,OAAO,IAAI,uBAAuB,iBAAiB,UAAU,WAAW,EAAE,MAAM,CAAC;AAAA;AAGnF,SAAS,aAAa,CAAC,SAAiB,OAAyC;AAAA,EAC/E,OAAO,IAAI,uBAAuB,kBAAkB,UAAU,WAAW,EAAE,MAAM,CAAC;AAAA;",
+  "debugId": "0F41D81FEC343F9E64756E2164756E21",
+  "names": []
+}