npm - @tailrace/core - Versions diffs - 0.1.0 - Mend

@tailrace/core 0.1.0

This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.

Files changed (10) hide show

package/dist/index.js.map ADDED Viewed

@@ -0,0 +1 @@

+ {"version":3,"sources":["../src/errors-docs.ts","../src/errors.ts","../src/types.ts","../src/policy/boundary.ts","../src/policy/resolve.ts","../src/console.ts","../src/vault/alphabet.ts","../src/vault/crypto.ts","../src/vault/token.ts","../src/actions/pointer.ts","../src/actions/apply.ts","../src/actions/restore.ts","../src/actions/stream-cut.ts","../src/audit/emitter.ts","../src/detect/merge.ts","../src/detect/object-scan.ts","../src/detect/primitives.ts","../src/detect/recognizers/shared.ts","../src/detect/recognizers/pii.ts","../src/detect/recognizers/secrets.ts","../src/detect/recognizers/index.ts","../src/detect/engine.ts","../src/policy/normalize.ts","../src/policy/validate.ts","../src/policy/compile.ts","../src/policy/default.ts","../src/vault/keys.ts","../src/vault/shared.ts","../src/vault/memory.ts","../src/audit/sinks.ts","../src/vault/kv.ts","../src/index.ts"],"names":["textEncoder","decisions","DEFAULT_TTL_SECONDS","vault","options","output"],"mappings":";AAIA,IAAM,gBAAA,GAAmB,4CAAA;AAElB,SAAS,WAAA,CAAY,MAAc,OAAA,EAAyB;AACjE,EAAA,MAAM,MAAA,GAAS,CAAA,OAAA,EAAK,gBAAgB,CAAA,CAAA,EAAI,IAAI,CAAA,CAAA;AAC5C,EAAA,IAAI,OAAA,CAAQ,QAAA,CAAS,MAAM,CAAA,IAAK,OAAA,CAAQ,QAAA,CAAS,CAAA,EAAG,gBAAgB,CAAA,CAAA,EAAI,IAAI,CAAA,CAAE,CAAA,EAAG;AAC/E,IAAA,OAAO,OAAA;AAAA,EACT;AACA,EAAA,OAAO,CAAA,EAAG,OAAO,CAAA,CAAA,EAAI,MAAM,CAAA,CAAA;AAC7B;;;ACAO,IAAM,aAAA,GAAN,cAA4B,KAAA,CAAM;AAAA;AAAA,EAE9B,IAAA;AAAA,EAET,WAAA,CAAY,MAAc,OAAA,EAAiB;AACzC,IAAA,KAAA,CAAM,WAAA,CAAY,IAAA,EAAM,OAAO,CAAC,CAAA;AAChC,IAAA,IAAA,CAAK,OAAO,GAAA,CAAA,MAAA,CAAW,IAAA;AACvB,IAAA,IAAA,CAAK,IAAA,GAAO,IAAA;AAEZ,IAAA,MAAA,CAAO,cAAA,CAAe,IAAA,EAAM,GAAA,CAAA,MAAA,CAAW,SAAS,CAAA;AAAA,EAClD;AACF;AAMO,IAAM,oBAAA,GAAN,cAAmC,aAAA,CAAc;AAAA,EAC7C,SAAA;AAAA,EAET,WAAA,CAAY,SAAiB,SAAA,EAAuB;AAClD,IAAA,KAAA,CAAM,oBAAoB,OAAO,CAAA;AACjC,IAAA,IAAA,CAAK,SAAA,GAAY,SAAA;AAAA,EACnB;AACF;AAGO,IAAM,qBAAA,GAAN,cAAoC,aAAA,CAAc;AAAA,EAC9C,IAAA;AAAA,EAET,WAAA,CAAY,SAAiB,IAAA,EAAc;AACzC,IAAA,KAAA,CAAM,kBAAkB,OAAO,CAAA;AAC/B,IAAA,IAAA,CAAK,IAAA,GAAO,IAAA;AAAA,EACd;AACF;AAGO,IAAM,uBAAA,GAAN,cAAsC,aAAA,CAAc;AAAA,EACzD,YAAY,OAAA,EAAiB;AAC3B,IAAA,KAAA,CAAM,aAAa,OAAO,CAAA;AAAA,EAC5B;AACF;AAGO,IAAM,UAAA,GAAN,cAAyB,aAAA,CAAc;AAAA,EAC5C,YAAY,OAAA,EAAiB;AAC3B,IAAA,KAAA,CAAM,SAAS,OAAO,CAAA;AAAA,EACxB;AACF;AAGO,IAAM,eAAA,GAAN,cAA8B,aAAA,CAAc;AAAA,EACjD,YAAY,OAAA,EAAiB;AAC3B,IAAA,KAAA,CAAM,cAAc,OAAO,CAAA;AAAA,EAC7B;AACF;AAGO,IAAM,mBAAA,GAAN,cAAkC,aAAA,CAAc;AAAA,EACrD,YAAY,OAAA,EAAiB;AAC3B,IAAA,KAAA,CAAM,mBAAmB,OAAO,CAAA;AAAA,EAClC;AACF;;;ACtCO,IAAM,qBAAA,GAAsD;AAAA,EACjE,SAAA;AAAA,EACA,KAAA;AAAA,EACA,aAAA;AAAA,EACA,qBAAA;AAAA,EACA;AACF;AAGO,IAAM,kBAAA,GAAgD;AAAA,EAC3D,OAAA;AAAA,EACA,OAAA;AAAA,EACA,aAAA;AAAA,EACA,MAAA;AAAA,EACA,KAAA;AAAA,EACA,YAAA;AAAA,EACA;AACF;AAGO,IAAM,kBAAA,GAAgD,CAAC,QAAA,EAAU,UAAA,EAAY,cAAc;;;AC3C3F,SAAS,YAAY,QAAA,EAA4B;AACtD,EAAA,QAAQ,SAAS,IAAA;AAAM,IACrB,KAAK,OAAA;AACH,MAAA,OAAO,QAAA,CAAS,QAAA;AAAA,IAClB,KAAK,MAAA;AACH,MAAA,OAAO,CAAA,KAAA,EAAQ,QAAA,CAAS,IAAI,CAAA,CAAA,EAAI,SAAS,SAAS,CAAA,CAAA;AAAA,IACpD,KAAK,KAAA;AACH,MAAA,OAAO,CAAA,IAAA,EAAO,QAAA,CAAS,MAAM,CAAA,CAAA,EAAI,SAAS,IAAI,CAAA,CAAA;AAAA,IAChD,KAAK,WAAA;AACH,MAAA,OAAO,WAAA;AAAA,IACT,KAAK,QAAA;AACH,MAAA,OAAO,CAAA,OAAA,EAAU,SAAS,IAAI,CAAA,CAAA;AAAA;AAEpC;AAGO,SAAS,oBAAoB,GAAA,EAAsB;AACxD,EAAA,OAAO,GAAA,KAAQ,QAAA,IAAY,GAAA,CAAI,UAAA,CAAW,SAAS,CAAA;AACrD;AAMO,SAAS,eAAe,YAAA,EAAoC;AACjE,EAAA,IAAI,YAAA,KAAiB,aAAa,OAAO,WAAA;AACzC,EAAA,IAAI,mBAAA,CAAoB,YAAY,CAAA,EAAG,OAAO,QAAA;AAC9C,EAAA,IAAI,YAAA,CAAa,UAAA,CAAW,OAAO,CAAA,EAAG,OAAO,MAAA;AAC7C,EAAA,IAAI,YAAA,CAAa,UAAA,CAAW,MAAM,CAAA,EAAG,OAAO,KAAA;AAC5C,EAAA,OAAO,OAAA;AACT;AAMO,SAAS,SAAA,CAAU,SAAiB,GAAA,EAAsB;AAC/D,EAAA,IAAI,CAAC,OAAA,CAAQ,QAAA,CAAS,GAAG,CAAA,SAAU,OAAA,KAAY,GAAA;AAC/C,EAAA,MAAM,KAAA,GAAQ,OAAA,CAAQ,KAAA,CAAM,GAAG,CAAA;AAC/B,EAAA,IAAI,KAAA,CAAM,MAAA,KAAW,CAAA,EAAG,OAAO,OAAA,KAAY,GAAA;AAE3C,EAAA,IAAI,GAAA,GAAM,CAAA;AACV,EAAA,KAAA,IAAS,CAAA,GAAI,CAAA,EAAG,CAAA,GAAI,KAAA,CAAM,QAAQ,CAAA,EAAA,EAAK;AACrC,IAAA,MAAM,IAAA,GAAO,MAAM,CAAC,CAAA;AACpB,IAAA,IAAI,IAAA,CAAK,WAAW,CAAA,EAAG;AACrB,MAAA,IAAI,MAAM,CAAA,EAAG;AACb,MAAA,IAAI,CAAA,KAAM,KAAA,CAAM,MAAA,GAAS,CAAA,EAAG,OAAO,IAAA;AACnC,MAAA;AAAA,IACF;AACA,IAAA,IAAI,MAAM,CAAA,EAAG;AACX,MAAA,IAAI,CAAC,GAAA,CAAI,UAAA,CAAW,IAAI,GAAG,OAAO,KAAA;AAClC,MAAA,GAAA,GAAM,IAAA,CAAK,MAAA;AACX,MAAA;AAAA,IACF;AACA,IAAA,IAAI,CAAA,KAAM,KAAA,CAAM,MAAA,GAAS,CAAA,EAAG;AAC1B,MAAA,OAAO,IAAI,QAAA,CAAS,IAAI,KAAK,GAAA,CAAI,MAAA,GAAS,KAAK,MAAA,IAAU,GAAA;AAAA,IAC3D;AACA,IAAA,MAAM,GAAA,GAAM,GAAA,CAAI,OAAA,CAAQ,IAAA,EAAM,GAAG,CAAA;AACjC,IAAA,IAAI,GAAA,KAAQ,IAAI,OAAO,KAAA;AACvB,IAAA,GAAA,GAAM,MAAM,IAAA,CAAK,MAAA;AAAA,EACnB;AACA,EAAA,OAAO,IAAA;AACT;AAQO,SAAS,qBAAA,CAAsB,KAAa,QAAA,EAAuC;AACxF,EAAA,MAAM,IAAA,GAAO,eAAe,GAAG,CAAA;AAC/B,EAAA,MAAM,OAAA,GAAU,QAAA,CAAS,MAAA,CAAO,CAAC,CAAA,KAAM,cAAA,CAAe,CAAC,CAAA,KAAM,IAAA,IAAQ,SAAA,CAAU,CAAA,EAAG,GAAG,CAAC,CAAA;AACtF,EAAA,OAAA,CAAQ,IAAA,CAAK,CAAC,CAAA,EAAG,CAAA,KAAM;AACrB,IAAA,MAAM,KAAA,GAAQ,CAAA,CAAE,QAAA,CAAS,GAAG,IAAI,CAAA,GAAI,CAAA;AACpC,IAAA,MAAM,KAAA,GAAQ,CAAA,CAAE,QAAA,CAAS,GAAG,IAAI,CAAA,GAAI,CAAA;AACpC,IAAA,IAAI,KAAA,KAAU,KAAA,EAAO,OAAO,KAAA,GAAQ,KAAA;AACpC,IAAA,OAAO,CAAA,CAAE,SAAS,CAAA,CAAE,MAAA;AAAA,EACtB,CAAC,CAAA;AACD,EAAA,OAAO,OAAA;AACT;;;AC3EO,IAAM,WAAA,GAAgD;AAAA,EAC3D,KAAA,EAAO,CAAA;AAAA,EACP,MAAA,EAAQ,CAAA;AAAA,EACR,QAAA,EAAU,CAAA;AAAA,EACV,UAAA,EAAY,CAAA;AAAA,EACZ,IAAA,EAAM,CAAA;AAAA,EACN,KAAA,EAAO;AACT,CAAA;AAEA,IAAM,UAAA,GAAkC,IAAI,GAAA,CAAI,qBAAqB,CAAA;AACrE,IAAM,aAAA,uBAAyC,GAAA,CAAI,CAAC,GAAG,kBAAA,EAAoB,GAAG,kBAAkB,CAAC,CAAA;AAG1F,SAAS,eAAA,CAAgB,GAAW,CAAA,EAAmB;AAC5D,EAAA,OAAO,YAAY,CAAC,CAAA,IAAK,WAAA,CAAY,CAAC,IAAI,CAAA,GAAI,CAAA;AAChD;AAeA,SAAS,YAAA,CACP,QAAA,EACA,MAAA,EACA,UAAA,EACkB;AAElB,EAAA,MAAM,KAAA,GAAQ,QAAA,CAAS,GAAA,CAAI,MAAM,CAAA;AACjC,EAAA,IAAI,KAAA,KAAU,MAAA,EAAW,OAAO,EAAE,IAAA,EAAM,KAAA,EAAO,IAAA,EAAM,CAAA,EAAG,UAAU,CAAA,CAAA,EAAI,MAAM,CAAA,CAAA,EAAG;AAC/E,EAAA,IAAI,aAAA,CAAc,GAAA,CAAI,MAAM,CAAA,EAAG;AAC7B,IAAA,MAAM,QAAA,GAAW,QAAA,CAAS,GAAA,CAAI,WAAW,CAAA;AACzC,IAAA,IAAI,QAAA,KAAa,QAAW,OAAO,EAAE,MAAM,QAAA,EAAU,IAAA,EAAM,CAAA,EAAG,UAAU,CAAA,UAAA,CAAA,EAAa;AAAA,EACvF;AACA,EAAA,MAAM,IAAA,GAAO,QAAA,CAAS,GAAA,CAAI,GAAG,CAAA;AAC7B,EAAA,IAAI,IAAA,KAAS,QAAW,OAAO,EAAE,MAAM,IAAA,EAAM,IAAA,EAAM,CAAA,EAAG,UAAU,CAAA,EAAA,CAAA,EAAK;AACrE,EAAA,OAAO,IAAA;AACT;AAEA,SAAS,qBAAA,CACP,UAAA,EACA,QAAA,EACA,GAAA,EACA,QACA,UAAA,EACkB;AAClB,EAAA,MAAM,OAAA,GAAU,qBAAA,CAAsB,GAAA,EAAK,QAAQ,CAAA;AACnD,EAAA,KAAA,MAAW,WAAW,OAAA,EAAS;AAC7B,IAAA,MAAM,WAAW,UAAA,CAAW,IAAA,CAAK,CAAC,CAAA,KAAM,CAAA,CAAE,YAAY,OAAO,CAAA;AAC7D,IAAA,IAAI,aAAa,MAAA,EAAW;AAC5B,IAAA,MAAM,GAAA,GAAM,aAAa,QAAA,CAAS,QAAA,EAAU,QAAQ,CAAA,EAAG,UAAU,CAAA,CAAA,EAAI,OAAO,CAAA,SAAA,CAAW,CAAA;AACvF,IAAA,IAAI,GAAA,KAAQ,MAAM,OAAO,GAAA;AAAA,EAC3B;AACA,EAAA,OAAO,IAAA;AACT;AAEA,SAAS,iBAAA,CACP,MAAA,EACA,MAAA,EACA,QAAA,EACA,QAAA,EACa;AACb,EAAA,MAAM,GAAA,GAAM,YAAY,QAAQ,CAAA;AAChC,EAAA,MAAM,KAAA,GAAQ,SAAS,KAAA,IAAS,SAAA;AAChC,EAAA,MAAM,MAAmB,EAAC;AAE1B,EAAA,MAAM,IAAA,GAAO,CAAC,CAAA,KAA8B;AAC1C,IAAA,IAAI,CAAA,KAAM,IAAA,EAAM,GAAA,CAAI,IAAA,CAAK,CAAC,CAAA;AAAA,EAC5B,CAAA;AAEA,EAAA,MAAM,KAAA,GAAsC,MAAA,CAAO,UAAA,CAAW,GAAA,CAAI,KAAK,CAAA;AACvE,EAAA,IAAI,UAAU,MAAA,EAAW;AAEvB,IAAA,IAAA;AAAA,MACE,qBAAA;AAAA,QACE,KAAA,CAAM,UAAA;AAAA,QACN,KAAA,CAAM,gBAAA;AAAA,QACN,GAAA;AAAA,QACA,MAAA;AAAA,QACA,cAAc,KAAK,CAAA,WAAA;AAAA;AACrB,KACF;AAEA,IAAA,IAAA,CAAK,aAAa,KAAA,CAAM,QAAA,EAAU,QAAQ,CAAA,WAAA,EAAc,KAAK,WAAW,CAAC,CAAA;AAAA,EAC3E;AAGA,EAAA,IAAA;AAAA,IACE,sBAAsB,MAAA,CAAO,UAAA,EAAY,OAAO,gBAAA,EAAkB,GAAA,EAAK,QAAQ,YAAY;AAAA,GAC7F;AAGA,EAAA,IAAA,CAAK,YAAA,CAAa,MAAA,CAAO,QAAA,EAAU,MAAA,EAAQ,UAAU,CAAC,CAAA;AAGtD,EAAA,GAAA,CAAI,IAAA,CAAK;AAAA,IACP,IAAA,EAAM,EAAE,MAAA,EAAQ,MAAA,CAAO,cAAA,EAAe;AAAA,IACtC,IAAA,EAAM;AAAA,GACP,CAAA;AAED,EAAA,OAAO,GAAA;AACT;AAUO,SAAS,OAAA,CACd,MAAA,EACA,MAAA,EACA,QAAA,EACA,QAAA,EACc;AACd,EAAA,MAAM,UAAA,GAAa,iBAAA,CAAkB,MAAA,EAAQ,MAAA,EAAQ,UAAU,QAAQ,CAAA;AACvE,EAAA,MAAM,OAAA,GAAU,WAAW,CAAC,CAAA;AAC5B,EAAA,IAAI,MAAA,GAAS,QAAQ,IAAA,CAAK,MAAA;AAC1B,EAAA,IAAI,OAAO,OAAA,CAAQ,IAAA;AACnB,EAAA,IAAI,MAAA,GAAS,QAAQ,IAAA,CAAK,MAAA;AAC1B,EAAA,IAAI,uBAAA,GAA0B,OAAA,CAAQ,IAAA,CAAK,uBAAA,KAA4B,IAAA;AAIvE,EAAA,IACE,UAAA,CAAW,GAAA,CAAI,MAAM,CAAA,IACrB,MAAA,KAAW,WACX,CAAC,uBAAA,IACD,CAAC,MAAA,CAAO,uBAAA,EACR;AACA,IAAA,KAAA,MAAW,KAAK,UAAA,EAAY;AAC1B,MAAA,IAAI,CAAA,CAAE,IAAA,CAAK,MAAA,KAAW,OAAA,EAAS;AAC7B,QAAA,MAAA,GAAS,OAAA;AACT,QAAA,IAAA,GAAO,CAAA,CAAE,IAAA;AACT,QAAA,MAAA,GAAS,EAAE,IAAA,CAAK,MAAA;AAChB,QAAA,uBAAA,GAA0B,CAAA,CAAE,KAAK,uBAAA,KAA4B,IAAA;AAC7D,QAAA;AAAA,MACF;AAAA,IACF;AAAA,EACF;AAEA,EAAA,OAAO;AAAA,IACL,MAAA;AAAA,IACA,IAAA,EAAM,IAAA,CAAK,OAAA,CAAQ,KAAA,EAAO,EAAE,CAAA;AAAA,IAC5B,GAAI,MAAA,KAAW,MAAA,GAAY,EAAE,MAAA,KAAW,EAAC;AAAA,IACzC,GAAI,uBAAA,GAA0B,EAAE,uBAAA,EAAyB,IAAA,KAAS;AAAC,GACrE;AACF;;;ACtKO,SAAS,UAAA,GAAyC;AAEvD,EAAA,MAAM,IAAK,UAAA,CAA4C,OAAA;AACvD,EAAA,OAAO,CAAA;AACT;;;ACHO,IAAM,iBAAA,GAAoB,sCAAA;AAG1B,IAAM,eAAA,GAAkB,CAAA;AAMxB,IAAM,mBAAA,GAAsB,UAAA;AAEnC,SAAS,8BAAA,GAAuC;AAC9C,EAAA,IAAI,iBAAA,CAAkB,WAAW,EAAA,EAAI;AACnC,IAAA,MAAM,IAAI,MAAM,oDAAoD,CAAA;AAAA,EACtE;AACA,EAAA,MAAM,EAAA,GAAK,IAAI,MAAA,CAAO,CAAA,CAAA,EAAI,mBAAmB,CAAA,CAAA,CAAG,CAAA;AAChD,EAAA,KAAA,MAAW,MAAM,iBAAA,EAAmB;AAClC,IAAA,IAAI,CAAC,EAAA,CAAG,IAAA,CAAK,EAAE,CAAA,EAAG;AAChB,MAAA,MAAM,IAAI,KAAA;AAAA,QACR,CAAA,wBAAA,EAA2B,EAAE,CAAA,wCAAA,EAA2C,mBAAmB,CAAA;AAAA,OAC7F;AAAA,IACF;AAAA,EACF;AAEA,EAAA,KAAA,MAAW,MAAM,sCAAA,EAAwC;AACvD,IAAA,IAAI,CAAC,iBAAA,CAAkB,QAAA,CAAS,EAAE,CAAA,EAAG;AACnC,MAAA,MAAM,IAAI,KAAA,CAAM,CAAA,6CAAA,EAAgD,EAAE,CAAA,CAAA,CAAG,CAAA;AAAA,IACvE;AAAA,EACF;AACF;AAEA,8BAAA,EAA+B;AAMxB,SAAS,eAAe,KAAA,EAA2B;AAExD,EAAA,IAAI,CAAA,GAAI,EAAA;AACR,EAAA,MAAM,IAAA,GAAO,IAAA,CAAK,GAAA,CAAI,KAAA,CAAM,QAAQ,CAAC,CAAA;AACrC,EAAA,KAAA,IAAS,CAAA,GAAI,CAAA,EAAG,CAAA,GAAI,IAAA,EAAM,CAAA,EAAA,EAAK;AAC7B,IAAA,CAAA,GAAK,CAAA,IAAK,EAAA,GAAM,MAAA,CAAO,KAAA,CAAM,CAAC,CAAE,CAAA;AAAA,EAClC;AACA,EAAA,MAAM,IAAA,GAAO,MAAA,CAAO,iBAAA,CAAkB,MAAM,CAAA;AAC5C,EAAA,IAAI,GAAA,GAAM,EAAA;AACV,EAAA,KAAA,IAAS,CAAA,GAAI,CAAA,EAAG,CAAA,GAAI,eAAA,EAAiB,CAAA,EAAA,EAAK;AACxC,IAAA,GAAA,GAAM,iBAAA,CAAkB,MAAA,CAAO,CAAA,GAAI,IAAI,CAAC,CAAA,GAAK,GAAA;AAC7C,IAAA,CAAA,GAAI,CAAA,GAAI,IAAA;AAAA,EACV;AACA,EAAA,OAAO,GAAA;AACT;AAGO,IAAM,wBAAA,uBAAoD,GAAA,CAAI;AAAA,EACnE,OAAA;AAAA,EACA,OAAA;AAAA,EACA;AACF,CAAC,CAAA;;;AC7DD,IAAM,WAAA,GAAc,IAAI,WAAA,EAAY;AACpC,IAAM,WAAA,GAAc,IAAI,WAAA,EAAY;AAG7B,SAAS,WAAW,KAAA,EAA2B;AACpD,EAAA,IAAI,GAAA,GAAM,EAAA;AACV,EAAA,KAAA,IAAS,CAAA,GAAI,CAAA,EAAG,CAAA,GAAI,KAAA,CAAM,QAAQ,CAAA,EAAA,EAAK;AACrC,IAAA,GAAA,IAAO,KAAA,CAAM,CAAC,CAAA,CAAG,QAAA,CAAS,EAAE,CAAA,CAAE,QAAA,CAAS,GAAG,GAAG,CAAA;AAAA,EAC/C;AACA,EAAA,OAAO,GAAA;AACT;AAGO,SAAS,cAAc,KAAA,EAA2B;AACvD,EAAA,IAAI,MAAA,GAAS,EAAA;AACb,EAAA,KAAA,IAAS,CAAA,GAAI,CAAA,EAAG,CAAA,GAAI,KAAA,CAAM,QAAQ,CAAA,EAAA,EAAK;AACrC,IAAA,MAAA,IAAU,MAAA,CAAO,YAAA,CAAa,KAAA,CAAM,CAAC,CAAE,CAAA;AAAA,EACzC;AACA,EAAA,OAAO,KAAK,MAAM,CAAA;AACpB;AAGO,SAAS,cAAc,GAAA,EAAyB;AACrD,EAAA,MAAM,MAAA,GAAS,KAAK,GAAG,CAAA;AACvB,EAAA,MAAM,GAAA,GAAM,IAAI,UAAA,CAAW,MAAA,CAAO,MAAM,CAAA;AACxC,EAAA,KAAA,IAAS,CAAA,GAAI,CAAA,EAAG,CAAA,GAAI,MAAA,CAAO,QAAQ,CAAA,EAAA,EAAK;AACtC,IAAA,GAAA,CAAI,CAAC,CAAA,GAAI,MAAA,CAAO,UAAA,CAAW,CAAC,CAAA;AAAA,EAC9B;AACA,EAAA,OAAO,GAAA;AACT;AAEA,eAAe,cAAc,GAAA,EAAiB;AAC5C,EAAA,OAAO,MAAA,CAAO,MAAA,CAAO,SAAA,CAAU,KAAA,EAAO,GAAA,CAAI,KAAA,EAAM,EAAG,EAAE,IAAA,EAAM,MAAA,EAAQ,IAAA,EAAM,SAAA,IAAa,KAAA,EAAO;AAAA,IAC3F;AAAA,GACD,CAAA;AACH;AAGA,eAAsB,UAAA,CAAW,KAAiB,OAAA,EAA0C;AAC1F,EAAA,MAAM,SAAA,GAAY,MAAM,aAAA,CAAc,GAAG,CAAA;AACzC,EAAA,MAAM,GAAA,GAAM,MAAM,MAAA,CAAO,MAAA,CAAO,KAAK,MAAA,EAAQ,SAAA,EAAW,OAAA,CAAQ,KAAA,EAAO,CAAA;AACvE,EAAA,OAAO,IAAI,WAAW,GAAG,CAAA;AAC3B;AAGA,eAAsB,UAAU,KAAA,EAAgC;AAC9D,EAAA,MAAM,MAAA,GAAS,MAAM,MAAA,CAAO,MAAA,CAAO,OAAO,SAAA,EAAW,WAAA,CAAY,MAAA,CAAO,KAAK,CAAC,CAAA;AAC9E,EAAA,OAAO,UAAA,CAAW,IAAI,UAAA,CAAW,MAAM,CAAC,CAAA;AAC1C;AAGO,SAAS,YAAY,MAAA,EAA4B;AACtD,EAAA,MAAM,GAAA,GAAM,IAAI,UAAA,CAAW,MAAM,CAAA;AACjC,EAAA,MAAA,CAAO,gBAAgB,GAAG,CAAA;AAC1B,EAAA,OAAO,GAAA;AACT;AAEA,eAAe,mBAAmB,SAAA,EAAuB;AACvD,EAAA,MAAM,UAAU,MAAM,UAAA,CAAW,WAAW,WAAA,CAAY,MAAA,CAAO,SAAS,CAAC,CAAA;AACzE,EAAA,OAAO,MAAA,CAAO,MAAA,CAAO,SAAA,CAAU,KAAA,EAAO,OAAA,CAAQ,KAAA,EAAM,EAAG,EAAE,IAAA,EAAM,SAAA,EAAU,EAAG,KAAA,EAAO;AAAA,IACjF,SAAA;AAAA,IACA;AAAA,GACD,CAAA;AACH;AAMA,eAAsB,aAAA,CAAc,WAAuB,SAAA,EAAoC;AAC7F,EAAA,MAAM,GAAA,GAAM,MAAM,kBAAA,CAAmB,SAAS,CAAA;AAC9C,EAAA,MAAM,EAAA,GAAK,YAAY,EAAE,CAAA;AACzB,EAAA,MAAM,EAAA,GAAK,MAAM,MAAA,CAAO,MAAA,CAAO,OAAA;AAAA,IAC7B,EAAE,IAAA,EAAM,SAAA,EAAW,EAAA,EAAI,EAAA,CAAG,OAAM,EAAE;AAAA,IAClC,GAAA;AAAA,IACA,WAAA,CAAY,OAAO,SAAS;AAAA,GAC9B;AACA,EAAA,MAAM,SAAS,IAAI,UAAA,CAAW,EAAA,CAAG,MAAA,GAAS,GAAG,UAAU,CAAA;AACvD,EAAA,MAAA,CAAO,GAAA,CAAI,IAAI,CAAC,CAAA;AAChB,EAAA,MAAA,CAAO,IAAI,IAAI,UAAA,CAAW,EAAE,CAAA,EAAG,GAAG,MAAM,CAAA;AACxC,EAAA,OAAO,cAAc,MAAM,CAAA;AAC7B;AAGA,eAAsB,aAAA,CAAc,WAAuB,SAAA,EAAoC;AAC7F,EAAA,MAAM,MAAA,GAAS,cAAc,SAAS,CAAA;AACtC,EAAA,IAAI,MAAA,CAAO,SAAS,EAAA,EAAI;AACtB,IAAA,MAAM,IAAI,MAAM,sBAAsB,CAAA;AAAA,EACxC;AACA,EAAA,MAAM,EAAA,GAAK,MAAA,CAAO,QAAA,CAAS,CAAA,EAAG,EAAE,CAAA;AAChC,EAAA,MAAM,EAAA,GAAK,MAAA,CAAO,QAAA,CAAS,EAAE,CAAA;AAC7B,EAAA,MAAM,GAAA,GAAM,MAAM,kBAAA,CAAmB,SAAS,CAAA;AAC9C,EAAA,MAAM,KAAK,MAAM,MAAA,CAAO,MAAA,CAAO,OAAA,CAAQ,EAAE,IAAA,EAAM,SAAA,EAAW,EAAA,EAAI,EAAA,CAAG,OAAM,EAAE,EAAG,GAAA,EAAK,EAAA,CAAG,OAAO,CAAA;AAC3F,EAAA,OAAO,WAAA,CAAY,OAAO,EAAE,CAAA;AAC9B;AAEA,IAAI,kBAAA;AACJ,IAAI,eAAA,GAAkB,KAAA;AAEtB,SAAS,WAAA,GAAkC;AACzC,EAAA,MAAM,CAAA,GAAI,UAAA;AACV,EAAA,OAAO,CAAA,CAAE,OAAA,EAAS,GAAA,GAAM,oBAAoB,CAAA;AAC9C;AAKO,SAAS,iBAAiB,QAAA,EAA+B;AAC9D,EAAA,IAAI,QAAA,KAAa,MAAA,IAAa,QAAA,CAAS,MAAA,GAAS,CAAA,EAAG;AACjD,IAAA,OAAO,WAAA,CAAY,OAAO,QAAQ,CAAA;AAAA,EACpC;AACA,EAAA,MAAM,UAAU,WAAA,EAAY;AAC5B,EAAA,IAAI,OAAA,KAAY,MAAA,IAAa,OAAA,CAAQ,MAAA,GAAS,CAAA,EAAG;AAC/C,IAAA,OAAO,WAAA,CAAY,OAAO,OAAO,CAAA;AAAA,EACnC;AACA,EAAA,IAAI,uBAAuB,MAAA,EAAW;AACpC,IAAA,kBAAA,GAAqB,YAAY,EAAE,CAAA;AACnC,IAAA,IAAI,CAAC,eAAA,EAAiB;AACpB,MAAA,eAAA,GAAkB,IAAA;AAClB,MAAA,UAAA,EAAW,EAAG,IAAA;AAAA,QACZ;AAAA,OACF;AAAA,IACF;AAAA,EACF;AACA,EAAA,OAAO,kBAAA;AACT;;;ACtHA,IAAMA,YAAAA,GAAc,IAAI,WAAA,EAAY;AAM7B,IAAM,WAAW,IAAI,MAAA;AAAA,EAC1B,CAAA,oBAAA,EAAuB,mBAAmB,CAAA,CAAA,EAAI,eAAe,CAAA,GAAA,CAAA;AAAA,EAC7D;AACF,CAAA;AAGO,IAAM,eAAe,IAAI,MAAA;AAAA,EAC9B,CAAA,IAAA,EAAO,mBAAmB,CAAA,CAAA,EAAI,eAAe,CAAA,wBAAA,CAAA;AAAA,EAC7C;AACF,CAAA;AAGO,IAAM,YAAA,GAAe,kBAAA;AAMrB,IAAM,WAAA,GAAc,iCAAA;AAGpB,SAAS,cAAA,CAAe,QAAqB,KAAA,EAAuB;AACzE,EAAA,MAAM,OAAA,GAAU,MAAM,IAAA,EAAK;AAC3B,EAAA,IAAI,MAAA,KAAW,OAAA,EAAS,OAAO,OAAA,CAAQ,WAAA,EAAY;AACnD,EAAA,IAAI,MAAA,KAAW,WAAW,MAAA,KAAW,aAAA,SAAsB,OAAA,CAAQ,OAAA,CAAQ,OAAO,EAAE,CAAA;AACpF,EAAA,OAAO,OAAA;AACT;AAGO,SAAS,YAAY,MAAA,EAA6B;AACvD,EAAA,OAAO,OAAO,WAAA,EAAY;AAC5B;AAGO,SAAS,UAAA,CAAW,QAAqB,OAAA,EAAyB;AACvE,EAAA,OAAO,CAAA,CAAA,EAAI,WAAA,CAAY,MAAM,CAAC,IAAI,OAAO,CAAA,CAAA,CAAA;AAC3C;AAGA,eAAsB,iBAAA,CACpB,WACA,UAAA,EACqB;AACrB,EAAA,OAAO,UAAA,CAAW,SAAA,EAAWA,YAAAA,CAAY,MAAA,CAAO,UAAU,CAAC,CAAA;AAC7D;AAMA,eAAsB,aAAA,CACpB,WAAA,EACA,MAAA,EACA,eAAA,EACiB;AACjB,EAAA,MAAM,WAAA,GAAcA,YAAAA,CAAY,MAAA,CAAO,MAAM,CAAA;AAC7C,EAAA,MAAM,UAAA,GAAaA,YAAAA,CAAY,MAAA,CAAO,eAAe,CAAA;AACrD,EAAA,MAAM,MAAM,IAAI,UAAA,CAAW,YAAY,MAAA,GAAS,CAAA,GAAI,WAAW,MAAM,CAAA;AACrE,EAAA,GAAA,CAAI,GAAA,CAAI,aAAa,CAAC,CAAA;AACtB,EAAA,GAAA,CAAI,WAAA,CAAY,MAAM,CAAA,GAAI,CAAA;AAC1B,EAAA,GAAA,CAAI,GAAA,CAAI,UAAA,EAAY,WAAA,CAAY,MAAA,GAAS,CAAC,CAAA;AAC1C,EAAA,MAAM,GAAA,GAAM,MAAM,UAAA,CAAW,WAAA,EAAa,GAAG,CAAA;AAC7C,EAAA,OAAO,eAAe,GAAG,CAAA;AAC3B;AAEA,SAAS,eAAA,CAAgB,SAAiB,KAAA,EAAuB;AAC/D,EAAA,IAAI,GAAA,GAAM,EAAA;AACV,EAAA,IAAI,GAAA,GAAM,CAAA;AACV,EAAA,KAAA,IAAS,CAAA,GAAI,CAAA,EAAG,GAAA,CAAI,MAAA,GAAS,OAAO,CAAA,EAAA,EAAK;AACvC,IAAA,MAAM,CAAA,GAAI,OAAA,CAAQ,UAAA,CAAW,CAAA,GAAI,QAAQ,MAAM,CAAA;AAC/C,IAAA,GAAA,GAAO,GAAA,GAAM,EAAA,GAAK,CAAA,GAAI,CAAA,KAAO,CAAA;AAC7B,IAAA,GAAA,IAAO,MAAA,CAAO,MAAM,EAAE,CAAA;AAAA,EACxB;AACA,EAAA,OAAO,GAAA,CAAI,KAAA,CAAM,CAAA,EAAG,KAAK,CAAA;AAC3B;AAEA,SAAS,eAAe,mBAAA,EAAqC;AAC3D,EAAA,IAAI,GAAA,GAAM,CAAA;AACV,EAAA,IAAI,GAAA,GAAM,IAAA;AACV,EAAA,KAAA,IAAS,IAAI,mBAAA,CAAoB,MAAA,GAAS,CAAA,EAAG,CAAA,IAAK,GAAG,CAAA,EAAA,EAAK;AACxD,IAAA,IAAI,CAAA,GAAI,MAAA,CAAO,mBAAA,CAAoB,CAAC,CAAC,CAAA;AACrC,IAAA,IAAI,GAAA,EAAK;AACP,MAAA,CAAA,IAAK,CAAA;AACL,MAAA,IAAI,CAAA,GAAI,GAAG,CAAA,IAAK,CAAA;AAAA,IAClB;AACA,IAAA,GAAA,IAAO,CAAA;AACP,IAAA,GAAA,GAAM,CAAC,GAAA;AAAA,EACT;AACA,EAAA,OAAA,CAAQ,EAAA,GAAM,MAAM,EAAA,IAAO,EAAA;AAC7B;AAEA,SAAS,kBAAA,CAAmB,UAAkB,OAAA,EAAyB;AACrE,EAAA,MAAM,MAAA,GAAS,QAAA,CAAS,OAAA,CAAQ,KAAA,EAAO,EAAE,CAAA;AACzC,EAAA,MAAM,GAAA,GAAM,IAAA,CAAK,GAAA,CAAI,MAAA,CAAO,QAAQ,EAAE,CAAA;AACtC,EAAA,MAAM,UAAU,GAAA,GAAM,CAAA;AACtB,EAAA,IAAI,IAAA,GAAO,eAAA,CAAgB,OAAA,EAAS,OAAO,CAAA;AAC3C,EAAA,IAAA,GAAO,GAAA,GAAM,IAAA,CAAK,KAAA,CAAM,CAAC,CAAA;AACzB,EAAA,MAAM,KAAA,GAAQ,eAAe,IAAI,CAAA;AACjC,EAAA,MAAM,IAAA,GAAO,IAAA,GAAO,MAAA,CAAO,KAAK,CAAA;AAGhC,EAAA,IAAI,EAAA,GAAK,CAAA;AACT,EAAA,IAAI,GAAA,GAAM,EAAA;AACV,EAAA,KAAA,IAAS,CAAA,GAAI,CAAA,EAAG,CAAA,GAAI,QAAA,CAAS,QAAQ,CAAA,EAAA,EAAK;AACxC,IAAA,MAAM,EAAA,GAAK,SAAS,CAAC,CAAA;AACrB,IAAA,IAAI,IAAA,CAAK,IAAA,CAAK,EAAE,CAAA,EAAG;AACjB,MAAA,GAAA,IAAO,IAAA,CAAK,EAAE,CAAA,IAAK,GAAA;AACnB,MAAA,EAAA,EAAA;AAAA,IACF,CAAA,MAAO;AACL,MAAA,GAAA,IAAO,EAAA;AAAA,IACT;AAAA,EACF;AACA,EAAA,OAAO,EAAA,GAAK,KAAK,MAAA,EAAQ;AACvB,IAAA,GAAA,IAAO,KAAK,EAAE,CAAA;AACd,IAAA,EAAA,EAAA;AAAA,EACF;AACA,EAAA,OAAO,GAAA;AACT;AASO,SAAS,WAAA,CACd,MAAA,EACA,OAAA,EACA,MAAA,EACA,aAAA,EACQ;AACR,EAAA,IAAI,WAAW,UAAA,EAAY;AACzB,IAAA,IAAI,MAAA,KAAW,OAAA,EAAS,OAAO,CAAA,EAAG,OAAO,CAAA,iBAAA,CAAA;AACzC,IAAA,IAAI,WAAW,OAAA,EAAS,OAAO,QAAQ,eAAA,CAAgB,OAAA,EAAS,CAAC,CAAC,CAAA,CAAA;AAClE,IAAA,IAAI,MAAA,KAAW,aAAA,EAAe,OAAO,kBAAA,CAAmB,eAAe,OAAO,CAAA;AAC9E,IAAA,UAAA,EAAW,EAAG,IAAA;AAAA,MACZ,8DAA8D,MAAM,CAAA,8BAAA;AAAA,KACtE;AAAA,EACF;AACA,EAAA,OAAO,UAAA,CAAW,QAAQ,OAAO,CAAA;AACnC;AAGO,SAAS,UAAU,MAAA,EAA6B;AACrD,EAAA,OAAO,CAAA,CAAA,EAAI,WAAA,CAAY,MAAM,CAAC,CAAA,CAAA,CAAA;AAChC;;;AChKA,SAAS,gBAAgB,KAAA,EAAuB;AAC9C,EAAA,OAAO,MAAM,OAAA,CAAQ,KAAA,EAAO,GAAG,CAAA,CAAE,OAAA,CAAQ,OAAO,GAAG,CAAA;AACrD;AAGO,SAAS,UAA+B,KAAA,EAAa;AAC1D,EAAA,IAAI,OAAO,oBAAoB,UAAA,EAAY;AACzC,IAAA,OAAO,gBAAgB,KAAK,CAAA;AAAA,EAC9B;AACA,EAAA,OAAO,IAAA,CAAK,KAAA,CAAM,IAAA,CAAK,SAAA,CAAU,KAAK,CAAC,CAAA;AACzC;AAMO,SAAS,kBAAA,CAAmB,MAAkB,OAAA,EAAgC;AACnF,EAAA,IAAI,OAAA,KAAY,EAAA,IAAM,OAAA,KAAY,GAAA,EAAK;AACrC,IAAA,OAAO,IAAA;AAAA,EACT;AACA,EAAA,MAAM,KAAA,GAAQ,OAAA,CAAQ,UAAA,CAAW,GAAG,IAAI,OAAA,CAAQ,KAAA,CAAM,CAAC,CAAA,CAAE,KAAA,CAAM,GAAG,CAAA,GAAI,OAAA,CAAQ,MAAM,GAAG,CAAA;AACvF,EAAA,IAAI,GAAA,GAAiB,IAAA;AACrB,EAAA,KAAA,MAAW,OAAO,KAAA,EAAO;AACvB,IAAA,MAAM,GAAA,GAAM,gBAAgB,GAAG,CAAA;AAC/B,IAAA,IAAI,GAAA,KAAQ,IAAA,IAAQ,OAAO,GAAA,KAAQ,UAAU,OAAO,IAAA;AACpD,IAAA,IAAI,KAAA,CAAM,OAAA,CAAQ,GAAG,CAAA,EAAG;AACtB,MAAA,MAAM,GAAA,GAAM,OAAO,GAAG,CAAA;AACtB,MAAA,IAAI,CAAC,MAAA,CAAO,SAAA,CAAU,GAAG,CAAA,IAAK,MAAM,CAAA,IAAK,GAAA,IAAO,GAAA,CAAI,MAAA,EAAQ,OAAO,IAAA;AACnE,MAAA,GAAA,GAAM,IAAI,GAAG,CAAA;AAAA,IACf,CAAA,MAAO;AACL,MAAA,IAAI,EAAE,GAAA,IAAO,GAAA,CAAA,EAAM,OAAO,IAAA;AAC1B,MAAA,GAAA,GAAO,IAAmB,GAAG,CAAA;AAAA,IAC/B;AAAA,EACF;AACA,EAAA,OAAO,OAAO,GAAA,KAAQ,QAAA,GAAW,GAAA,GAAM,IAAA;AACzC;AAMO,SAAS,kBAAA,CAAmB,IAAA,EAAkB,OAAA,EAAiB,KAAA,EAAqB;AACzF,EAAA,IAAI,OAAA,KAAY,EAAA,IAAM,OAAA,KAAY,GAAA,EAAK;AACvC,EAAA,MAAM,KAAA,GAAQ,OAAA,CAAQ,UAAA,CAAW,GAAG,IAAI,OAAA,CAAQ,KAAA,CAAM,CAAC,CAAA,CAAE,KAAA,CAAM,GAAG,CAAA,GAAI,OAAA,CAAQ,MAAM,GAAG,CAAA;AACvF,EAAA,IAAI,GAAA,GAAiB,IAAA;AACrB,EAAA,KAAA,IAAS,IAAI,CAAA,EAAG,CAAA,GAAI,KAAA,CAAM,MAAA,GAAS,GAAG,CAAA,EAAA,EAAK;AACzC,IAAA,MAAM,GAAA,GAAM,eAAA,CAAgB,KAAA,CAAM,CAAC,CAAE,CAAA;AACrC,IAAA,IAAI,GAAA,KAAQ,IAAA,IAAQ,OAAO,GAAA,KAAQ,QAAA,EAAU;AAC7C,IAAA,IAAI,KAAA,CAAM,OAAA,CAAQ,GAAG,CAAA,EAAG;AACtB,MAAA,MAAM,GAAA,GAAM,OAAO,GAAG,CAAA;AACtB,MAAA,GAAA,GAAM,IAAI,GAAG,CAAA;AAAA,IACf,CAAA,MAAO;AACL,MAAA,GAAA,GAAO,IAAmB,GAAG,CAAA;AAAA,IAC/B;AAAA,EACF;AACA,EAAA,MAAM,OAAO,eAAA,CAAgB,KAAA,CAAM,KAAA,CAAM,MAAA,GAAS,CAAC,CAAE,CAAA;AACrD,EAAA,IAAI,GAAA,KAAQ,IAAA,IAAQ,OAAO,GAAA,KAAQ,QAAA,EAAU;AAC7C,EAAA,IAAI,KAAA,CAAM,OAAA,CAAQ,GAAG,CAAA,EAAG;AACtB,IAAA,MAAM,GAAA,GAAM,OAAO,IAAI,CAAA;AACvB,IAAA,IAAI,MAAA,CAAO,SAAA,CAAU,GAAG,CAAA,IAAK,GAAA,IAAO,CAAA,IAAK,GAAA,GAAM,GAAA,CAAI,MAAA,IAAU,OAAO,GAAA,CAAI,GAAG,MAAM,QAAA,EAAU;AACzF,MAAA,GAAA,CAAI,GAAG,CAAA,GAAI,KAAA;AAAA,IACb;AAAA,EACF,CAAA,MAAA,IAAW,OAAQ,GAAA,CAAmB,IAAI,MAAM,QAAA,EAAU;AACxD,IAAC,GAAA,CAAmB,IAAI,CAAA,GAAI,KAAA;AAAA,EAC9B;AACF;;;AC/BO,SAAS,iBAAiB,KAAA,EAAqC;AACpE,EAAA,IAAI,KAAA,CAAM,MAAA,KAAW,CAAA,EAAG,OAAO,EAAC;AAEhC,EAAA,MAAM,MAAA,uBAAa,GAAA,EAAyB;AAC5C,EAAA,KAAA,MAAW,QAAQ,KAAA,EAAO;AACxB,IAAA,MAAM,IAAA,GAAO,IAAA,CAAK,IAAA,CAAK,IAAA,IAAQ,EAAA;AAC/B,IAAA,MAAM,IAAA,GAAO,MAAA,CAAO,GAAA,CAAI,IAAI,KAAK,EAAC;AAClC,IAAA,IAAA,CAAK,KAAK,IAAI,CAAA;AACd,IAAA,MAAA,CAAO,GAAA,CAAI,MAAM,IAAI,CAAA;AAAA,EACvB;AAEA,EAAA,MAAM,MAAuB,EAAC;AAC9B,EAAA,KAAA,MAAW,KAAA,IAAS,MAAA,CAAO,MAAA,EAAO,EAAG;AACnC,IAAA,MAAM,MAAA,GAAS,CAAC,GAAG,KAAK,CAAA,CAAE,IAAA;AAAA,MACxB,CAAC,CAAA,EAAG,CAAA,KAAM,CAAA,CAAE,IAAA,CAAK,KAAA,GAAQ,CAAA,CAAE,IAAA,CAAK,KAAA,IAAS,CAAA,CAAE,IAAA,CAAK,GAAA,GAAM,EAAE,IAAA,CAAK;AAAA,KAC/D;AACA,IAAA,MAAM,OAAwB,EAAC;AAC/B,IAAA,KAAA,MAAW,QAAQ,MAAA,EAAQ;AACzB,MAAA,MAAM,MAAA,GAAS,KAAK,QAAA,CAAS,MAAA;AAC7B,MAAA,IAAI,WAAW,cAAA,EAAgB;AAC/B,MAAA,MAAM,QAAA,GAAW,MAAA;AACjB,MAAA,IAAI,QAAA,GAAW,KAAA;AACf,MAAA,KAAA,IAAS,CAAA,GAAI,CAAA,EAAG,CAAA,GAAI,IAAA,CAAK,QAAQ,CAAA,EAAA,EAAK;AACpC,QAAA,MAAM,KAAA,GAAQ,KAAK,CAAC,CAAA;AACpB,QAAA,IAAI,IAAA,CAAK,IAAA,CAAK,KAAA,GAAQ,KAAA,CAAM,IAAA,CAAK,GAAA,IAAO,IAAA,CAAK,IAAA,CAAK,GAAA,GAAM,KAAA,CAAM,IAAA,CAAK,KAAA,EAAO;AACxE,UAAA,QAAA,GAAW,IAAA;AACX,UAAA,MAAM,MAAA,GAAS,eAAA,CAAgB,QAAA,EAAU,KAAA,CAAM,MAAM,CAAA;AACrD,UAAA,IAAI,MAAA,KAAW,QAAA,IAAY,QAAA,KAAa,KAAA,CAAM,MAAA,EAAQ;AACpD,YAAA,IAAA,CAAK,CAAC,CAAA,GAAI,EAAE,GAAG,IAAA,EAAM,QAAQ,QAAA,EAAS;AAAA,UACxC,CAAA,MAAA,IAAW,MAAA,KAAW,KAAA,CAAM,MAAA,EAAQ;AAClC,YAAA,IAAA,CAAK,CAAC,CAAA,GAAI,EAAE,GAAG,KAAA,EAAO,QAAQ,MAAA,EAAO;AAAA,UACvC;AACA,UAAA;AAAA,QACF;AAAA,MACF;AACA,MAAA,IAAI,CAAC,UAAU,IAAA,CAAK,IAAA,CAAK,EAAE,GAAG,IAAA,EAAM,MAAA,EAAQ,QAAA,EAAU,CAAA;AAAA,IACxD;AACA,IAAA,GAAA,CAAI,IAAA,CAAK,GAAG,IAAI,CAAA;AAAA,EAClB;AACA,EAAA,OAAO,GAAA;AACT;AAEA,SAAS,YAAA,CAAa,OAA4B,IAAA,EAAoB;AACpE,EAAA,IAAI,OAAO,UAAU,QAAA,EAAU;AAC7B,IAAA,OAAO,KAAA,CAAM,KAAA,CAAM,IAAA,CAAK,KAAA,EAAO,KAAK,GAAG,CAAA;AAAA,EACzC;AACA,EAAA,MAAM,IAAA,GAAO,KAAK,IAAA,IAAQ,EAAA;AAC1B,EAAA,MAAM,IAAA,GAAO,kBAAA,CAAmB,KAAA,EAAO,IAAI,CAAA;AAC3C,EAAA,IAAI,IAAA,KAAS,MAAM,OAAO,EAAA;AAC1B,EAAA,OAAO,IAAA,CAAK,KAAA,CAAM,IAAA,CAAK,KAAA,EAAO,KAAK,GAAG,CAAA;AACxC;AAEA,SAAS,eAAA,CAAgB,IAAA,EAAc,KAAA,EAAe,GAAA,EAAa,WAAA,EAA6B;AAC9F,EAAA,OAAO,IAAA,CAAK,MAAM,CAAA,EAAG,KAAK,IAAI,WAAA,GAAc,IAAA,CAAK,MAAM,GAAG,CAAA;AAC5D;AAMA,eAAsB,YAAA,CACpB,KAAA,EACA,KAAA,EACA,GAAA,EAC+C;AAC/C,EAAA,MAAM,SAAA,GAAY,iBAAiB,KAAK,CAAA;AAExC,EAAA,MAAM,SAAS,SAAA,CAAU,MAAA,CAAO,CAAC,CAAA,KAAM,CAAA,CAAE,WAAW,OAAO,CAAA;AAC3D,EAAA,IAAI,MAAA,CAAO,MAAA,GAAS,CAAA,IAAK,GAAA,CAAI,iBAAiB,MAAA,EAAQ;AACpD,IAAA,MAAMC,UAAAA,GAAY,MAAA,CAAO,GAAA,CAAI,CAAC,CAAA,MAAO,EAAE,GAAG,CAAA,CAAE,QAAA,EAAU,MAAA,EAAQ,OAAA,EAAiB,CAAE,CAAA;AACjF,IAAA,MAAM,KAAA,GAAQA,WAAU,CAAC,CAAA;AACzB,IAAA,MAAM,IAAI,oBAAA;AAAA,MACR,CAAA,uBAAA,EAA0B,KAAA,CAAM,MAAM,CAAA,YAAA,EAAe,MAAM,IAAI,CAAA,CAAA,CAAA;AAAA,MAC/DA;AAAA,KACF;AAAA,EACF;AAGA,EAAA,MAAM,UAAU,SAAA,CAAU,MAAA,CAAO,CAAC,CAAA,KAAM,CAAA,CAAE,WAAW,QAAQ,CAAA;AAC7D,EAAA,IAAI,OAAA,CAAQ,SAAS,CAAA,EAAG;AACtB,IAAA,MAAM,IAAI,oBAAA;AAAA,MACR,CAAA,wCAAA,EAA2C,OAAA,CAAQ,CAAC,CAAA,CAAG,SAAS,IAAI,CAAA,EAAA,CAAA;AAAA,MACpE,OAAA,CAAQ,GAAA,CAAI,CAAC,CAAA,KAAM,EAAE,QAAQ;AAAA,KAC/B;AAAA,EACF;AAEA,EAAA,MAAM,cAAc,MAAM,iBAAA,CAAkB,GAAA,CAAI,SAAA,EAAW,IAAI,UAAU,CAAA;AACzE,EAAA,IAAI,SAA8B,OAAO,KAAA,KAAU,QAAA,GAAW,KAAA,GAAQ,UAAU,KAAK,CAAA;AAGrF,EAAA,MAAM,MAAA,uBAAa,GAAA,EAA6B;AAChD,EAAA,KAAA,MAAW,QAAQ,SAAA,EAAW;AAC5B,IAAA,MAAM,IAAA,GAAO,IAAA,CAAK,IAAA,CAAK,IAAA,IAAQ,EAAA;AAC/B,IAAA,MAAM,IAAA,GAAO,MAAA,CAAO,GAAA,CAAI,IAAI,KAAK,EAAC;AAClC,IAAA,IAAA,CAAK,KAAK,IAAI,CAAA;AACd,IAAA,MAAA,CAAO,GAAA,CAAI,MAAM,IAAI,CAAA;AAAA,EACvB;AAEA,EAAA,MAAM,YAAwB,EAAC;AAE/B,EAAA,KAAA,MAAW,CAAC,IAAA,EAAM,KAAK,CAAA,IAAK,MAAA,EAAQ;AAClC,IAAA,KAAA,CAAM,IAAA,CAAK,CAAC,CAAA,EAAG,CAAA,KAAM,EAAE,IAAA,CAAK,KAAA,GAAQ,CAAA,CAAE,IAAA,CAAK,KAAK,CAAA;AAEhD,IAAA,IAAI,IAAA;AACJ,IAAA,IAAI,OAAO,WAAW,QAAA,EAAU;AAC9B,MAAA,IAAA,GAAO,MAAA;AAAA,IACT,CAAA,MAAO;AACL,MAAA,IAAA,GAAO,kBAAA,CAAmB,MAAA,EAAQ,IAAI,CAAA,IAAK,EAAA;AAAA,IAC7C;AAEA,IAAA,KAAA,MAAW,QAAQ,KAAA,EAAO;AACxB,MAAA,MAAM,iBAAiB,IAAA,CAAK,MAAA;AAE5B,MAAA,MAAM,SACJ,cAAA,KAAmB,OAAA,IAAW,GAAA,CAAI,YAAA,KAAiB,SAAS,MAAA,GAAS,cAAA;AACvE,MAAA,MAAM,QAAQ,IAAA,CAAK,KAAA,IAAS,YAAA,CAAa,KAAA,EAAO,KAAK,IAAI,CAAA;AACzD,MAAA,IAAI,WAAA,GAAc,KAAA;AAElB,MAAA,IAAI,WAAW,MAAA,EAAQ;AACrB,QAAA,WAAA,GAAc,SAAA,CAAU,IAAA,CAAK,IAAA,CAAK,MAAM,CAAA;AAAA,MAC1C,CAAA,MAAA,IAAW,WAAW,UAAA,EAAY;AAChC,QAAA,MAAM,UAAA,GAAa,cAAA,CAAe,IAAA,CAAK,IAAA,CAAK,QAAQ,KAAK,CAAA;AACzD,QAAA,MAAM,UAAU,MAAM,aAAA,CAAc,aAAa,IAAA,CAAK,IAAA,CAAK,QAAQ,UAAU,CAAA;AAC7E,QAAA,MAAM,KAAA,GAAQ,YAAY,IAAA,CAAK,IAAA,CAAK,QAAQ,OAAA,EAAS,IAAA,CAAK,QAAQ,KAAK,CAAA;AACvE,QAAA,MAAM,GAAA,CAAI,MAAM,GAAA,CAAI;AAAA,UAClB,YAAY,GAAA,CAAI,UAAA;AAAA,UAChB,KAAA;AAAA,UACA,MAAA,EAAQ,KAAK,IAAA,CAAK,MAAA;AAAA,UAClB;AAAA,SACD,CAAA;AACD,QAAA,WAAA,GAAc,KAAA;AAAA,MAChB,CAAA,MAAA,IAAW,MAAA,KAAW,OAAA,IAAW,MAAA,KAAW,YAAA,EAAc;AACxD,QAAA,WAAA,GAAc,KAAA;AAAA,MAChB;AAEA,MAAA,IAAA,GAAO,eAAA,CAAgB,MAAM,IAAA,CAAK,IAAA,CAAK,OAAO,IAAA,CAAK,IAAA,CAAK,KAAK,WAAW,CAAA;AACxE,MAAA,MAAM,QAAA,GACJ,cAAA,KAAmB,OAAA,IAAW,GAAA,CAAI,iBAAiB,MAAA,GAC/C,EAAE,GAAG,IAAA,CAAK,UAAU,MAAA,EAAQ,OAAA,EAAS,SAAA,EAAW,MAAA,KAChD,IAAA,CAAK,QAAA;AACX,MAAA,SAAA,CAAU,KAAK,QAAQ,CAAA;AAAA,IACzB;AAEA,IAAA,IAAI,OAAO,WAAW,QAAA,EAAU;AAC9B,MAAA,MAAA,GAAS,IAAA;AAAA,IACX,CAAA,MAAO;AACL,MAAA,kBAAA,CAAmB,MAAA,EAAQ,MAAM,IAAI,CAAA;AAAA,IACvC;AAAA,EACF;AAGA,EAAA,SAAA,CAAU,KAAK,CAAC,CAAA,EAAG,CAAA,KAAM,CAAA,CAAE,KAAK,KAAA,GAAQ,CAAA,CAAE,IAAA,CAAK,KAAA,IAAS,EAAE,IAAA,CAAK,IAAA,CAAK,cAAc,CAAA,CAAE,IAAA,CAAK,IAAI,CAAC,CAAA;AAE9F,EAAA,OAAO,EAAE,QAAqB,SAAA,EAAU;AAC1C;;;ACxKA,SAAS,gBAAA,CAAiB,MAAc,IAAA,EAA0B;AAChE,EAAA,MAAM,OAAmB,EAAC;AAE1B,EAAA,QAAA,CAAS,SAAA,GAAY,CAAA;AACrB,EAAA,KAAA,MAAW,CAAA,IAAK,IAAA,CAAK,QAAA,CAAS,QAAQ,CAAA,EAAG;AACvC,IAAA,MAAM,IAAA,GAAO,EAAE,CAAC,CAAA;AAChB,IAAA,MAAM,KAAA,GAAQ,EAAE,CAAC,CAAA;AACjB,IAAA,MAAM,GAAA,GAAM,EAAE,KAAA,IAAS,CAAA;AACvB,IAAA,IAAA,CAAK,IAAA,CAAK;AAAA,MACR,KAAA,EAAO,GAAA;AAAA,MACP,GAAA,EAAK,MAAM,IAAA,CAAK,MAAA;AAAA,MAChB,KAAA,EAAO,IAAA;AAAA,MACP,MAAA,EAAQ,MAAM,WAAA,EAAY;AAAA,MAC1B;AAAA,KACD,CAAA;AAAA,EACH;AAEA,EAAA,YAAA,CAAa,SAAA,GAAY,CAAA;AACzB,EAAA,KAAA,MAAW,CAAA,IAAK,IAAA,CAAK,QAAA,CAAS,YAAY,CAAA,EAAG;AAC3C,IAAA,MAAM,IAAA,GAAO,EAAE,CAAC,CAAA;AAChB,IAAA,MAAM,GAAA,GAAM,EAAE,KAAA,IAAS,CAAA;AACvB,IAAA,IAAA,CAAK,IAAA,CAAK;AAAA,MACR,KAAA,EAAO,GAAA;AAAA,MACP,GAAA,EAAK,MAAM,IAAA,CAAK,MAAA;AAAA,MAChB,KAAA,EAAO,IAAA;AAAA,MACP,MAAA,EAAQ,OAAA;AAAA,MACR;AAAA,KACD,CAAA;AAAA,EACH;AAEA,EAAA,YAAA,CAAa,SAAA,GAAY,CAAA;AACzB,EAAA,KAAA,MAAW,CAAA,IAAK,IAAA,CAAK,QAAA,CAAS,YAAY,CAAA,EAAG;AAC3C,IAAA,MAAM,IAAA,GAAO,EAAE,CAAC,CAAA;AAChB,IAAA,MAAM,GAAA,GAAM,EAAE,KAAA,IAAS,CAAA;AACvB,IAAA,IAAA,CAAK,IAAA,CAAK;AAAA,MACR,KAAA,EAAO,GAAA;AAAA,MACP,GAAA,EAAK,MAAM,IAAA,CAAK,MAAA;AAAA,MAChB,KAAA,EAAO,IAAA;AAAA,MACP,MAAA,EAAQ,OAAA;AAAA,MACR;AAAA,KACD,CAAA;AAAA,EACH;AAEA,EAAA,WAAA,CAAY,SAAA,GAAY,CAAA;AACxB,EAAA,KAAA,MAAW,CAAA,IAAK,IAAA,CAAK,QAAA,CAAS,WAAW,CAAA,EAAG;AAC1C,IAAA,MAAM,IAAA,GAAO,EAAE,CAAC,CAAA;AAChB,IAAA,MAAM,GAAA,GAAM,EAAE,KAAA,IAAS,CAAA;AACvB,IAAA,IAAA,CAAK,IAAA,CAAK;AAAA,MACR,KAAA,EAAO,GAAA;AAAA,MACP,GAAA,EAAK,MAAM,IAAA,CAAK,MAAA;AAAA,MAChB,KAAA,EAAO,IAAA;AAAA,MACP,MAAA,EAAQ,aAAA;AAAA,MACR;AAAA,KACD,CAAA;AAAA,EACH;AAGA,EAAA,IAAA,CAAK,IAAA,CAAK,CAAC,CAAA,EAAG,CAAA,KAAM,CAAA,CAAE,KAAA,GAAQ,CAAA,CAAE,KAAA,IAAS,CAAA,CAAE,GAAA,GAAM,CAAA,CAAE,GAAG,CAAA;AACtD,EAAA,MAAM,UAAsB,EAAC;AAC7B,EAAA,KAAA,MAAW,OAAO,IAAA,EAAM;AACtB,IAAA,MAAM,OAAA,GAAU,OAAA,CAAQ,IAAA,CAAK,CAAC,CAAA,KAAM,GAAA,CAAI,KAAA,GAAQ,CAAA,CAAE,GAAA,IAAO,GAAA,CAAI,GAAA,GAAM,CAAA,CAAE,KAAK,CAAA;AAC1E,IAAA,IAAI,CAAC,OAAA,EAAS,OAAA,CAAQ,IAAA,CAAK,GAAG,CAAA;AAAA,EAChC;AACA,EAAA,OAAO,OAAA;AACT;AAEA,SAAS,cAAc,KAAA,EAAmE;AACxF,EAAA,IAAI,OAAO,UAAU,QAAA,EAAU;AAC7B,IAAA,OAAO,CAAC,EAAE,IAAA,EAAM,EAAA,EAAI,IAAA,EAAM,OAAO,CAAA;AAAA,EACnC;AACA,EAAA,MAAM,MAA6C,EAAC;AACpD,EAAA,MAAM,IAAA,GAAO,CAAC,KAAA,EAAgB,IAAA,KAAuB;AACnD,IAAA,IAAI,OAAO,UAAU,QAAA,EAAU;AAC7B,MAAA,GAAA,CAAI,IAAA,CAAK,EAAE,IAAA,EAAM,IAAA,EAAM,OAAO,CAAA;AAC9B,MAAA;AAAA,IACF;AACA,IAAA,IAAI,KAAA,KAAU,IAAA,IAAQ,OAAO,KAAA,KAAU,QAAA,EAAU;AACjD,IAAA,IAAI,KAAA,CAAM,OAAA,CAAQ,KAAK,CAAA,EAAG;AACxB,MAAA,KAAA,IAAS,CAAA,GAAI,CAAA,EAAG,CAAA,GAAI,KAAA,CAAM,QAAQ,CAAA,EAAA,EAAK,IAAA,CAAK,KAAA,CAAM,CAAC,CAAA,EAAG,CAAA,EAAG,IAAI,CAAA,CAAA,EAAI,CAAC,CAAA,CAAE,CAAA;AACpE,MAAA;AAAA,IACF;AACA,IAAA,KAAA,MAAW,CAAC,CAAA,EAAG,CAAC,KAAK,MAAA,CAAO,OAAA,CAAQ,KAAmB,CAAA,EAAG;AACxD,MAAA,MAAM,GAAA,GAAM,EAAE,OAAA,CAAQ,IAAA,EAAM,IAAI,CAAA,CAAE,OAAA,CAAQ,OAAO,IAAI,CAAA;AACrD,MAAA,IAAA,CAAK,CAAA,EAAG,CAAA,EAAG,IAAI,CAAA,CAAA,EAAI,GAAG,CAAA,CAAE,CAAA;AAAA,IAC1B;AAAA,EACF,CAAA;AACA,EAAA,IAAA,CAAK,OAAO,EAAE,CAAA;AACd,EAAA,OAAO,GAAA;AACT;AAMA,eAAsB,YAAA,CACpB,OACA,GAAA,EAC+C;AAC/C,EAAA,MAAM,GAAA,GAAM,WAAA,CAAY,GAAA,CAAI,QAAQ,CAAA;AACpC,EAAA,IAAI,CAAC,mBAAA,CAAoB,GAAG,KAAK,GAAA,CAAI,QAAA,CAAS,SAAS,QAAA,EAAU;AAC/D,IAAA,MAAM,IAAI,wBAAwB,8CAA8C,CAAA;AAAA,EAClF;AAEA,EAAA,IAAI,SAA8B,OAAO,KAAA,KAAU,QAAA,GAAW,KAAA,GAAQ,UAAU,KAAK,CAAA;AACrF,EAAA,MAAM,YAAwB,EAAC;AAC/B,EAAA,MAAM,MAAA,GAAS,cAAc,KAAK,CAAA;AAElC,EAAA,KAAA,MAAW,QAAQ,MAAA,EAAQ;AACzB,IAAA,MAAM,IAAA,GAAO,gBAAA,CAAiB,IAAA,CAAK,IAAA,EAAM,KAAK,IAAI,CAAA;AAElD,IAAA,IAAA,CAAK,KAAK,CAAC,CAAA,EAAG,MAAM,CAAA,CAAE,KAAA,GAAQ,EAAE,KAAK,CAAA;AAErC,IAAA,IAAI,IAAA,GACF,OAAO,MAAA,KAAW,QAAA,GAAW,MAAA,GAAU,mBAAmB,MAAA,EAAQ,IAAA,CAAK,IAAI,CAAA,IAAK,IAAA,CAAK,IAAA;AAEvF,IAAA,KAAA,MAAW,OAAO,IAAA,EAAM;AACtB,MAAA,MAAM,MAAA,GAAS,MAAM,GAAA,CAAI,KAAA,CAAM,IAAI,GAAA,CAAI,UAAA,EAAY,IAAI,KAAK,CAAA;AAC5D,MAAA,MAAM,WAAA,GAAc,MAAM,SAAA,CAAU,GAAA,CAAI,KAAK,CAAA;AAC7C,MAAA,IAAI,WAAW,IAAA,EAAM;AACnB,QAAA,SAAA,CAAU,IAAA,CAAK;AAAA,UACb,MAAA,EAAQ,cAAA;AAAA,UACR,QAAQ,GAAA,CAAI,MAAA;AAAA,UACZ,UAAU,GAAA,CAAI,QAAA;AAAA,UACd,UAAU,GAAA,CAAI,QAAA;AAAA,UACd,IAAA,EAAM,SAAA;AAAA,UACN,IAAA,EAAM,EAAE,IAAA,EAAM,GAAA,CAAI,IAAA,EAAM,OAAO,GAAA,CAAI,KAAA,EAAO,GAAA,EAAK,GAAA,CAAI,GAAA,EAAI;AAAA,UACvD;AAAA,SACD,CAAA;AACD,QAAA;AAAA,MACF;AACA,MAAA,IAAA,GAAO,IAAA,CAAK,KAAA,CAAM,CAAA,EAAG,GAAA,CAAI,KAAK,CAAA,GAAI,MAAA,CAAO,KAAA,GAAQ,IAAA,CAAK,KAAA,CAAM,GAAA,CAAI,GAAG,CAAA;AACnE,MAAA,SAAA,CAAU,IAAA,CAAK;AAAA,QACb,MAAA,EAAQ,YAAA;AAAA,QACR,QAAQ,MAAA,CAAO,MAAA;AAAA,QACf,UAAU,GAAA,CAAI,QAAA;AAAA,QACd,UAAU,GAAA,CAAI,QAAA;AAAA,QACd,IAAA,EAAM,SAAA;AAAA,QACN,IAAA,EAAM,EAAE,IAAA,EAAM,GAAA,CAAI,IAAA,EAAM,OAAO,GAAA,CAAI,KAAA,EAAO,GAAA,EAAK,GAAA,CAAI,GAAA,EAAI;AAAA,QACvD;AAAA,OACD,CAAA;AAAA,IACH;AAEA,IAAA,IAAI,OAAO,WAAW,QAAA,EAAU;AAC9B,MAAA,MAAA,GAAS,IAAA;AAAA,IACX,CAAA,MAAO;AACL,MAAA,kBAAA,CAAmB,MAAA,EAAQ,IAAA,CAAK,IAAA,EAAM,IAAI,CAAA;AAAA,IAC5C;AAAA,EACF;AAEA,EAAA,SAAA,CAAU,KAAK,CAAC,CAAA,EAAG,CAAA,KAAM,CAAA,CAAE,KAAK,KAAA,GAAQ,CAAA,CAAE,IAAA,CAAK,KAAA,IAAS,EAAE,IAAA,CAAK,IAAA,CAAK,cAAc,CAAA,CAAE,IAAA,CAAK,IAAI,CAAC,CAAA;AAC9F,EAAA,OAAO,EAAE,QAAqB,SAAA,EAAU;AAC1C;;;AC1KO,SAAS,oBAAA,CACd,MAAA,EACA,KAAA,EACA,QAAA,EACA,KAAA,EACQ;AACR,EAAA,IAAI,OAAO,OAAO,MAAA;AAClB,EAAA,IAAI,MAAA,IAAU,UAAU,OAAO,CAAA;AAE/B,EAAA,IAAI,MAAM,MAAA,GAAS,QAAA;AACnB,EAAA,KAAA,MAAW,QAAQ,KAAA,EAAO;AAExB,IAAA,IAAI,IAAA,CAAK,KAAA,GAAQ,GAAA,IAAO,IAAA,CAAK,MAAM,GAAA,EAAK;AACtC,MAAA,GAAA,GAAM,IAAA,CAAK,GAAA,CAAI,GAAA,EAAK,IAAA,CAAK,KAAK,CAAA;AAAA,IAChC;AAAA,EACF;AACA,EAAA,OAAO,IAAA,CAAK,GAAA,CAAI,CAAA,EAAG,GAAG,CAAA;AACxB;;;ACXA,SAAS,gBAAgB,GAAA,EAAoB;AAC3C,EAAA,MAAM,UAAU,GAAA,YAAe,KAAA,GAAQ,GAAA,CAAI,OAAA,GAAU,OAAO,GAAG,CAAA;AAC/D,EAAA,UAAA,EAAW,EAAG,IAAA,CAAK,CAAA,0CAAA,EAA6C,OAAO,CAAA,CAAE,CAAA;AAC3E;AAKO,SAAS,kBAAA,CACd,KAAA,GAAqB,EAAC,EACtB,UAAA,EACc;AACd,EAAA,OAAO;AAAA,IACL,IAAA,CAAK,IAAA,EAAM,UAAA,EAAY,SAAA,EAAiB;AACtC,MAAA,IAAI,eAAe,MAAA,EAAW;AAC5B,QAAA,IAAI;AACF,UAAA,UAAA,CAAW,SAAS,CAAA;AAAA,QACtB,SAAS,GAAA,EAAK;AACZ,UAAA,eAAA,CAAgB,GAAG,CAAA;AAAA,QACrB;AAAA,MACF;AACA,MAAA,IAAI,KAAA,CAAM,WAAW,CAAA,EAAG;AACxB,MAAA,MAAM,KAAA,GAAoB;AAAA,QACxB,IAAA;AAAA,QACA,UAAA;AAAA,QACA,SAAA,EAAW,KAAK,GAAA,EAAI;AAAA,QACpB;AAAA,OACF;AACA,MAAA,KAAA,MAAW,QAAQ,KAAA,EAAO;AACxB,QAAA,IAAI;AACF,UAAA,MAAM,MAAA,GAAS,IAAA,CAAK,IAAA,CAAK,KAAK,CAAA;AAC9B,UAAA,IAAI,MAAA,KAAW,KAAA,CAAA,IAAa,OAAQ,MAAA,CAAyB,SAAS,UAAA,EAAY;AAChF,YAAA,KAAM,MAAA,CAAyB,KAAA,CAAM,CAAC,GAAA,KAAiB;AACrD,cAAA,eAAA,CAAgB,GAAG,CAAA;AAAA,YACrB,CAAC,CAAA;AAAA,UACH;AAAA,QACF,SAAS,GAAA,EAAK;AACZ,UAAA,eAAA,CAAgB,GAAG,CAAA;AAAA,QACrB;AAAA,MACF;AAAA,IACF;AAAA,GACF;AACF;;;ACzCA,IAAM,iBAAA,GAAoB,GAAA;AAQnB,SAAS,UAAA,CAAW,KAAA,EAAwB,IAAA,GAAqB,EAAC,EAAW;AAClF,EAAA,MAAM,gBAAA,GAAmB,KAAK,gBAAA,IAAoB,iBAAA;AAClD,EAAA,MAAM,UAAA,GAAa,IAAA,CAAK,UAAA,IAAc,EAAC;AACvC,EAAA,MAAM,YAAA,GAAe,CAAC,MAAA,KAAgC,UAAA,CAAW,MAAM,CAAA,IAAK,gBAAA;AAE5E,EAAA,MAAM,QAAA,uBAAe,GAAA,EAAyB;AAC9C,EAAA,KAAA,MAAW,QAAQ,KAAA,EAAO;AACxB,IAAA,IAAI,IAAA,CAAK,UAAA,GAAa,YAAA,CAAa,IAAA,CAAK,MAAM,CAAA,EAAG;AACjD,IAAA,MAAM,KAAA,GAAQ,QAAA,CAAS,GAAA,CAAI,IAAA,CAAK,MAAM,CAAA;AACtC,IAAA,IAAI,KAAA,EAAO,KAAA,CAAM,IAAA,CAAK,IAAI,CAAA;AAAA,kBACZ,GAAA,CAAI,IAAA,CAAK,MAAA,EAAQ,CAAC,IAAI,CAAC,CAAA;AAAA,EACvC;AAEA,EAAA,MAAM,MAAc,EAAC;AACrB,EAAA,KAAA,MAAW,KAAA,IAAS,QAAA,CAAS,MAAA,EAAO,EAAG;AACrC,IAAA,KAAA,CAAM,IAAA,CAAK,CAAC,CAAA,EAAG,CAAA,KAAM,CAAA,CAAE,KAAA,GAAQ,CAAA,CAAE,KAAA,IAAS,CAAA,CAAE,GAAA,GAAM,CAAA,CAAE,GAAG,CAAA;AACvD,IAAA,IAAI,OAAA,GAAU,MAAM,CAAC,CAAA;AACrB,IAAA,KAAA,IAAS,CAAA,GAAI,CAAA,EAAG,CAAA,GAAI,KAAA,CAAM,QAAQ,CAAA,EAAA,EAAK;AACrC,MAAA,MAAM,IAAA,GAAO,MAAM,CAAC,CAAA;AACpB,MAAA,IAAI,IAAA,CAAK,KAAA,GAAQ,OAAA,CAAQ,GAAA,EAAK;AAE5B,QAAA,OAAA,GAAU;AAAA,UACR,GAAG,OAAA;AAAA,UACH,KAAK,IAAA,CAAK,GAAA,CAAI,OAAA,CAAQ,GAAA,EAAK,KAAK,GAAG,CAAA;AAAA,UACnC,YAAY,IAAA,CAAK,GAAA,CAAI,OAAA,CAAQ,UAAA,EAAY,KAAK,UAAU;AAAA,SAC1D;AAAA,MACF,CAAA,MAAO;AACL,QAAA,GAAA,CAAI,KAAK,OAAO,CAAA;AAChB,QAAA,OAAA,GAAU,IAAA;AAAA,MACZ;AAAA,IACF;AACA,IAAA,GAAA,CAAI,KAAK,OAAO,CAAA;AAAA,EAClB;AAEA,EAAA,GAAA,CAAI,IAAA,CAAK,CAAC,CAAA,EAAG,CAAA,KAAM,CAAA,CAAE,KAAA,GAAQ,CAAA,CAAE,KAAA,IAAS,CAAA,CAAE,GAAA,GAAM,CAAA,CAAE,GAAG,CAAA;AACrD,EAAA,OAAO,GAAA;AACT;;;ACjDA,IAAM,iBAAA,GAAoB,EAAA;AAG1B,SAAS,cAAc,GAAA,EAAqB;AAC1C,EAAA,OAAO,IAAI,OAAA,CAAQ,IAAA,EAAM,IAAI,CAAA,CAAE,OAAA,CAAQ,OAAO,IAAI,CAAA;AACpD;AAMO,SAAS,UAAA,CACd,KAAA,EACA,QAAA,EACA,QAAA,GAAmB,iBAAA,EACX;AACR,EAAA,MAAM,MAAc,EAAC;AACrB,EAAA,MAAM,IAAA,uBAAW,OAAA,EAAgB;AAEjC,EAAA,MAAM,IAAA,GAAO,CAAC,KAAA,EAAkB,IAAA,EAAc,KAAA,KAAwB;AACpE,IAAA,IAAI,OAAO,UAAU,QAAA,EAAU;AAC7B,MAAA,KAAA,MAAW,IAAA,IAAQ,QAAA,CAAS,KAAK,CAAA,EAAG,GAAA,CAAI,KAAK,EAAE,GAAG,IAAA,EAAM,IAAA,EAAM,CAAA;AAC9D,MAAA;AAAA,IACF;AACA,IAAA,IAAI,KAAA,KAAU,IAAA,IAAQ,OAAO,KAAA,KAAU,QAAA,EAAU;AACjD,IAAA,IAAI,IAAA,CAAK,GAAA,CAAI,KAAK,CAAA,EAAG;AACrB,IAAA,IAAI,SAAS,QAAA,EAAU;AACvB,IAAA,IAAA,CAAK,IAAI,KAAK,CAAA;AAEd,IAAA,IAAI,KAAA,CAAM,OAAA,CAAQ,KAAK,CAAA,EAAG;AACxB,MAAA,KAAA,IAAS,CAAA,GAAI,CAAA,EAAG,CAAA,GAAI,KAAA,CAAM,QAAQ,CAAA,EAAA,EAAK;AACrC,QAAA,IAAA,CAAK,KAAA,CAAM,CAAC,CAAA,EAAI,CAAA,EAAG,IAAI,CAAA,CAAA,EAAI,CAAC,CAAA,CAAA,EAAI,KAAA,GAAQ,CAAC,CAAA;AAAA,MAC3C;AAAA,IACF,CAAA,MAAO;AACL,MAAA,KAAA,MAAW,CAAC,GAAA,EAAK,KAAK,KAAK,MAAA,CAAO,OAAA,CAAQ,KAAK,CAAA,EAAG;AAChD,QAAA,MAAM,YAAY,CAAA,EAAG,IAAI,CAAA,CAAA,EAAI,aAAA,CAAc,GAAG,CAAC,CAAA,CAAA;AAC/C,QAAA,KAAA,MAAW,IAAA,IAAQ,QAAA,CAAS,GAAG,CAAA,EAAG,GAAA,CAAI,IAAA,CAAK,EAAE,GAAG,IAAA,EAAM,IAAA,EAAM,SAAA,EAAW,CAAA;AACvE,QAAA,IAAA,CAAK,KAAA,EAAO,SAAA,EAAW,KAAA,GAAQ,CAAC,CAAA;AAAA,MAClC;AAAA,IACF;AAAA,EACF,CAAA;AAEA,EAAA,IAAA,CAAK,KAAA,EAAO,IAAI,CAAC,CAAA;AACjB,EAAA,OAAO,GAAA;AACT;;;AC7CO,SAAS,eAAe,CAAA,EAAmB;AAChD,EAAA,IAAI,CAAA,CAAE,MAAA,KAAW,CAAA,EAAG,OAAO,CAAA;AAC3B,EAAA,MAAM,MAAA,uBAAa,GAAA,EAAoB;AACvC,EAAA,KAAA,IAAS,CAAA,GAAI,CAAA,EAAG,CAAA,GAAI,CAAA,CAAE,QAAQ,CAAA,EAAA,EAAK;AACjC,IAAA,MAAM,EAAA,GAAK,EAAE,CAAC,CAAA;AACd,IAAA,MAAA,CAAO,IAAI,EAAA,EAAA,CAAK,MAAA,CAAO,IAAI,EAAE,CAAA,IAAK,KAAK,CAAC,CAAA;AAAA,EAC1C;AACA,EAAA,IAAI,OAAA,GAAU,CAAA;AACd,EAAA,KAAA,MAAW,CAAA,IAAK,MAAA,CAAO,MAAA,EAAO,EAAG;AAC/B,IAAA,MAAM,CAAA,GAAI,IAAI,CAAA,CAAE,MAAA;AAChB,IAAA,OAAA,IAAW,CAAA,GAAI,IAAA,CAAK,IAAA,CAAK,CAAC,CAAA;AAAA,EAC5B;AACA,EAAA,OAAO,OAAA;AACT;AAOO,SAAS,iBAAiB,CAAA,EAAoB;AACnD,EAAA,IAAI,KAAA,GAAQ,KAAA;AACZ,EAAA,IAAI,KAAA,GAAQ,KAAA;AACZ,EAAA,IAAI,KAAA,GAAQ,KAAA;AACZ,EAAA,KAAA,IAAS,CAAA,GAAI,CAAA,EAAG,CAAA,GAAI,CAAA,CAAE,QAAQ,CAAA,EAAA,EAAK;AACjC,IAAA,MAAM,IAAA,GAAO,CAAA,CAAE,UAAA,CAAW,CAAC,CAAA;AAC3B,IAAA,IAAI,IAAA,IAAQ,EAAA,IAAM,IAAA,IAAQ,GAAA,EAAK,KAAA,GAAQ,IAAA;AAAA,SAAA,IAC9B,IAAA,IAAQ,EAAA,IAAM,IAAA,IAAQ,EAAA,EAAI,KAAA,GAAQ,IAAA;AAAA,SAAA,IAClC,IAAA,IAAQ,EAAA,IAAM,IAAA,IAAQ,EAAA,EAAI,KAAA,GAAQ,IAAA;AAAA,EAC7C;AACA,EAAA,OAAO,SAAS,KAAA,IAAS,KAAA;AAC3B;AAGO,SAAS,UAAU,MAAA,EAAyB;AACjD,EAAA,IAAI,MAAA,CAAO,MAAA,KAAW,CAAA,EAAG,OAAO,KAAA;AAChC,EAAA,IAAI,GAAA,GAAM,CAAA;AACV,EAAA,IAAI,MAAA,GAAS,KAAA;AACb,EAAA,KAAA,IAAS,IAAI,MAAA,CAAO,MAAA,GAAS,CAAA,EAAG,CAAA,IAAK,GAAG,CAAA,EAAA,EAAK;AAC3C,IAAA,IAAI,CAAA,GAAI,MAAA,CAAO,UAAA,CAAW,CAAC,CAAA,GAAI,EAAA;AAC/B,IAAA,IAAI,CAAA,GAAI,CAAA,IAAK,CAAA,GAAI,CAAA,EAAG,OAAO,KAAA;AAC3B,IAAA,IAAI,MAAA,EAAQ;AACV,MAAA,CAAA,IAAK,CAAA;AACL,MAAA,IAAI,CAAA,GAAI,GAAG,CAAA,IAAK,CAAA;AAAA,IAClB;AACA,IAAA,GAAA,IAAO,CAAA;AACP,IAAA,MAAA,GAAS,CAAC,MAAA;AAAA,EACZ;AACA,EAAA,OAAO,MAAM,EAAA,KAAO,CAAA;AACtB;AAGO,SAAS,UAAU,IAAA,EAAuB;AAC/C,EAAA,MAAM,UAAU,IAAA,CAAK,OAAA,CAAQ,MAAA,EAAQ,EAAE,EAAE,WAAA,EAAY;AACrD,EAAA,IAAI,CAAC,mCAAA,CAAoC,IAAA,CAAK,OAAO,GAAG,OAAO,KAAA;AAC/D,EAAA,MAAM,UAAA,GAAa,QAAQ,KAAA,CAAM,CAAC,IAAI,OAAA,CAAQ,KAAA,CAAM,GAAG,CAAC,CAAA;AACxD,EAAA,IAAI,SAAA,GAAY,CAAA;AAChB,EAAA,KAAA,IAAS,CAAA,GAAI,CAAA,EAAG,CAAA,GAAI,UAAA,CAAW,QAAQ,CAAA,EAAA,EAAK;AAC1C,IAAA,MAAM,IAAA,GAAO,UAAA,CAAW,UAAA,CAAW,CAAC,CAAA;AAEpC,IAAA,MAAM,KAAA,GAAQ,QAAQ,EAAA,GAAA,CAAM,IAAA,GAAO,IAAI,QAAA,EAAS,GAAI,MAAA,CAAO,YAAA,CAAa,IAAI,CAAA;AAC5E,IAAA,KAAA,IAAS,CAAA,GAAI,CAAA,EAAG,CAAA,GAAI,KAAA,CAAM,QAAQ,CAAA,EAAA,EAAK;AACrC,MAAA,SAAA,GAAA,CAAa,YAAY,EAAA,IAAM,KAAA,CAAM,UAAA,CAAW,CAAC,IAAI,EAAA,CAAA,IAAO,EAAA;AAAA,IAC9D;AAAA,EACF;AACA,EAAA,OAAO,SAAA,KAAc,CAAA;AACvB;AAGO,SAAS,oBAAoB,OAAA,EAAiD;AACnF,EAAA,IAAI;AACF,IAAA,MAAM,GAAA,GAAM,QAAQ,OAAA,CAAQ,IAAA,EAAM,GAAG,CAAA,CAAE,OAAA,CAAQ,MAAM,GAAG,CAAA;AACxD,IAAA,MAAM,GAAA,GAAM,GAAA,CAAI,MAAA,GAAS,CAAA,KAAM,CAAA,GAAI,EAAA,GAAK,GAAA,CAAI,MAAA,CAAO,CAAA,GAAK,GAAA,CAAI,MAAA,GAAS,CAAE,CAAA;AACvE,IAAA,MAAM,IAAA,GAAO,IAAA,CAAK,GAAA,GAAM,GAAG,CAAA;AAC3B,IAAA,MAAM,MAAA,GAAkB,IAAA,CAAK,KAAA,CAAM,IAAI,CAAA;AACvC,IAAA,IAAI,OAAO,WAAW,QAAA,IAAY,MAAA,KAAW,QAAQ,KAAA,CAAM,OAAA,CAAQ,MAAM,CAAA,EAAG,OAAO,IAAA;AACnF,IAAA,OAAO,MAAA;AAAA,EACT,CAAA,CAAA,MAAQ;AACN,IAAA,OAAO,IAAA;AAAA,EACT;AACF;AAGO,SAAS,YAAY,MAAA,EAA0C;AACpE,EAAA,MAAM,GAAA,GAAM,OAAO,KAAK,CAAA;AACxB,EAAA,IAAI,OAAO,GAAA,KAAQ,QAAA,IAAY,GAAA,CAAI,MAAA,KAAW,GAAG,OAAO,KAAA;AACxD,EAAA,MAAM,GAAA,GAAM,OAAO,KAAK,CAAA;AACxB,EAAA,IAAI,GAAA,KAAQ,UAAa,OAAO,GAAA,KAAQ,YAAY,GAAA,CAAI,WAAA,EAAY,KAAM,KAAA,EAAO,OAAO,KAAA;AACxF,EAAA,OAAO,IAAA;AACT;AAGO,SAAS,UAAU,CAAA,EAAoD;AAC5E,EAAA,MAAM,KAAA,GAAQ,CAAA,CAAE,KAAA,CAAM,GAAG,CAAA;AACzB,EAAA,IAAI,KAAA,CAAM,MAAA,KAAW,CAAA,EAAG,OAAO,IAAA;AAC/B,EAAA,MAAM,SAAmB,EAAC;AAC1B,EAAA,KAAA,MAAW,QAAQ,KAAA,EAAO;AACxB,IAAA,IAAI,CAAC,WAAA,CAAY,IAAA,CAAK,IAAI,GAAG,OAAO,IAAA;AACpC,IAAA,MAAM,CAAA,GAAI,OAAO,IAAI,CAAA;AACrB,IAAA,IAAI,CAAA,GAAI,KAAK,OAAO,IAAA;AAEpB,IAAA,IAAI,KAAK,MAAA,GAAS,CAAA,IAAK,KAAK,CAAC,CAAA,KAAM,KAAK,OAAO,IAAA;AAC/C,IAAA,MAAA,CAAO,KAAK,CAAC,CAAA;AAAA,EACf;AACA,EAAA,OAAO,CAAC,MAAA,CAAO,CAAC,CAAA,EAAI,MAAA,CAAO,CAAC,CAAA,EAAI,MAAA,CAAO,CAAC,CAAA,EAAI,MAAA,CAAO,CAAC,CAAE,CAAA;AACxD;AAGO,SAAS,wBAAwB,MAAA,EAAmD;AACzF,EAAA,MAAM,CAAC,CAAA,EAAG,CAAC,CAAA,GAAI,MAAA;AACf,EAAA,IAAI,CAAA,KAAM,IAAI,OAAO,IAAA;AACrB,EAAA,IAAI,MAAM,GAAA,IAAO,CAAA,IAAK,EAAA,IAAM,CAAA,IAAK,IAAI,OAAO,IAAA;AAC5C,EAAA,IAAI,CAAA,KAAM,GAAA,IAAO,CAAA,KAAM,GAAA,EAAK,OAAO,IAAA;AACnC,EAAA,IAAI,CAAA,KAAM,KAAK,OAAO,IAAA;AACtB,EAAA,IAAI,CAAA,KAAM,GAAA,IAAO,CAAA,KAAM,GAAA,EAAK,OAAO,IAAA;AACnC,EAAA,IAAI,MAAM,GAAA,IAAO,CAAA,IAAK,EAAA,IAAM,CAAA,IAAK,KAAK,OAAO,IAAA;AAC7C,EAAA,IAAI,CAAA,KAAM,GAAG,OAAO,IAAA;AACpB,EAAA,IAAI,CAAA,KAAM,OAAO,CAAA,KAAM,CAAA,IAAK,OAAO,CAAC,CAAA,KAAM,GAAG,OAAO,IAAA;AACpD,EAAA,IAAI,MAAM,GAAA,KAAQ,CAAA,KAAM,EAAA,IAAM,CAAA,KAAM,KAAK,OAAO,IAAA;AAChD,EAAA,IAAI,CAAA,KAAM,OAAO,CAAA,KAAM,EAAA,IAAM,OAAO,CAAC,CAAA,KAAM,KAAK,OAAO,IAAA;AACvD,EAAA,IAAI,CAAA,KAAM,OAAO,CAAA,KAAM,CAAA,IAAK,OAAO,CAAC,CAAA,KAAM,KAAK,OAAO,IAAA;AACtD,EAAA,IAAI,CAAA,IAAK,KAAK,OAAO,IAAA;AACrB,EAAA,OAAO,KAAA;AACT;AAGO,SAAS,wBAAwB,OAAA,EAA0B;AAChE,EAAA,MAAM,IAAA,GAAO,QAAQ,WAAA,EAAY;AACjC,EAAA,IAAI,IAAA,KAAS,KAAA,IAAS,IAAA,KAAS,IAAA,EAAM,OAAO,IAAA;AAC5C,EAAA,IACE,IAAA,CAAK,UAAA,CAAW,KAAK,CAAA,IACrB,KAAK,UAAA,CAAW,KAAK,CAAA,IACrB,IAAA,CAAK,UAAA,CAAW,KAAK,CAAA,IACrB,IAAA,CAAK,WAAW,KAAK,CAAA;AAErB,IAAA,OAAO,IAAA;AACT,EAAA,IAAI,IAAA,CAAK,WAAW,IAAI,CAAA,IAAK,KAAK,UAAA,CAAW,IAAI,GAAG,OAAO,IAAA;AAC3D,EAAA,IAAI,IAAA,CAAK,UAAA,CAAW,UAAU,CAAA,EAAG,OAAO,IAAA;AACxC,EAAA,IAAI,IAAA,CAAK,UAAA,CAAW,IAAI,CAAA,EAAG,OAAO,IAAA;AAClC,EAAA,OAAO,KAAA;AACT;;;ACvIO,SAAS,YAAA,CACd,IAAA,EACA,QAAA,EACA,MAAA,EACA,UAAA,EACQ;AACR,EAAA,MAAM,QAAgB,EAAC;AACvB,EAAA,KAAA,MAAW,EAAE,EAAA,EAAI,UAAA,EAAW,IAAK,QAAA,EAAU;AACzC,IAAA,EAAA,CAAG,SAAA,GAAY,CAAA;AACf,IAAA,IAAI,CAAA;AACJ,IAAA,OAAA,CAAQ,CAAA,GAAI,EAAA,CAAG,IAAA,CAAK,IAAI,OAAO,IAAA,EAAM;AACnC,MAAA,KAAA,CAAM,IAAA,CAAK,EAAE,MAAA,EAAQ,KAAA,EAAO,EAAE,KAAA,EAAO,GAAA,EAAK,CAAA,CAAE,KAAA,GAAQ,EAAE,CAAC,CAAA,CAAE,MAAA,EAAQ,UAAA,EAAY,YAAY,CAAA;AACzF,MAAA,IAAI,CAAA,CAAE,CAAC,CAAA,CAAE,MAAA,KAAW,GAAG,EAAA,CAAG,SAAA,EAAA;AAAA,IAC5B;AAAA,EACF;AACA,EAAA,OAAO,KAAA;AACT;;;ACbA,IAAM,cAAA,GAAqC;AAAA;AAAA,EAEzC,EAAE,EAAA,EAAI,iDAAA,EAAmD,UAAA,EAAY,CAAA;AACvE,CAAA;AAEO,IAAM,eAAA,GAA8B;AAAA,EACzC,EAAA,EAAI,OAAA;AAAA,EACJ,QAAA,EAAU,CAAC,OAAO,CAAA;AAAA,EAClB,IAAA,EAAM,CAAA;AAAA,EACN,MAAM,CAAC,IAAA,KAAS,aAAa,IAAA,EAAM,cAAA,EAAgB,SAAS,OAAO;AACrE,CAAA;AAEA,IAAM,cAAA,GAAqC;AAAA;AAAA,EAEzC;AAAA,IACE,EAAA,EAAI,yEAAA;AAAA,IACJ,UAAA,EAAY;AAAA,GACd;AAAA;AAAA;AAAA,EAGA;AAAA,IACE,EAAA,EAAI,8EAAA;AAAA,IACJ,UAAA,EAAY;AAAA;AAEhB,CAAA;AAGA,SAAS,WAAW,CAAA,EAAmB;AACrC,EAAA,IAAI,CAAA,GAAI,CAAA;AACR,EAAA,KAAA,IAAS,CAAA,GAAI,CAAA,EAAG,CAAA,GAAI,CAAA,CAAE,QAAQ,CAAA,EAAA,EAAK;AACjC,IAAA,MAAM,CAAA,GAAI,CAAA,CAAE,UAAA,CAAW,CAAC,CAAA;AACxB,IAAA,IAAI,CAAA,IAAK,EAAA,IAAM,CAAA,IAAK,EAAA,EAAI,CAAA,EAAA;AAAA,EAC1B;AACA,EAAA,OAAO,CAAA;AACT;AAEO,IAAM,eAAA,GAA8B;AAAA,EACzC,EAAA,EAAI,OAAA;AAAA,EACJ,QAAA,EAAU,CAAC,OAAO,CAAA;AAAA,EAClB,IAAA,EAAM,CAAA;AAAA,EACN,IAAA,EAAM,CAAC,IAAA,KAAS;AACd,IAAA,MAAM,KAAA,GAAQ,YAAA,CAAa,IAAA,EAAM,cAAA,EAAgB,SAAS,OAAO,CAAA;AAEjE,IAAA,OAAO,KAAA,CAAM,MAAA,CAAO,CAAC,CAAA,KAAM;AACzB,MAAA,MAAM,MAAA,GAAS,WAAW,IAAA,CAAK,KAAA,CAAM,EAAE,KAAA,EAAO,CAAA,CAAE,GAAG,CAAC,CAAA;AACpD,MAAA,OAAO,MAAA,IAAU,KAAK,MAAA,IAAU,EAAA;AAAA,IAClC,CAAC,CAAA;AAAA,EACH;AACF,CAAA;AAEA,IAAM,cAAA,GAAiB,0CAAA;AAEhB,IAAM,oBAAA,GAAmC;AAAA,EAC9C,EAAA,EAAI,aAAA;AAAA,EACJ,QAAA,EAAU,CAAC,aAAa,CAAA;AAAA,EACxB,IAAA,EAAM,CAAA;AAAA,EACN,IAAA,EAAM,CAAC,IAAA,KAAS;AACd,IAAA,MAAM,QAAgB,EAAC;AACvB,IAAA,cAAA,CAAe,SAAA,GAAY,CAAA;AAC3B,IAAA,IAAI,CAAA;AACJ,IAAA,OAAA,CAAQ,CAAA,GAAI,cAAA,CAAe,IAAA,CAAK,IAAI,OAAO,IAAA,EAAM;AAC/C,MAAA,MAAM,SAAS,CAAA,CAAE,CAAC,CAAA,CAAE,OAAA,CAAQ,UAAU,EAAE,CAAA;AACxC,MAAA,IAAI,MAAA,CAAO,MAAA,GAAS,EAAA,IAAM,MAAA,CAAO,SAAS,EAAA,EAAI;AAC9C,MAAA,IAAI,CAAC,SAAA,CAAU,MAAM,CAAA,EAAG;AACxB,MAAA,KAAA,CAAM,IAAA,CAAK;AAAA,QACT,MAAA,EAAQ,aAAA;AAAA,QACR,OAAO,CAAA,CAAE,KAAA;AAAA,QACT,GAAA,EAAK,CAAA,CAAE,KAAA,GAAQ,CAAA,CAAE,CAAC,CAAA,CAAE,MAAA;AAAA,QACpB,UAAA,EAAY,CAAA;AAAA,QACZ,UAAA,EAAY;AAAA,OACb,CAAA;AAAA,IACH;AACA,IAAA,OAAO,KAAA;AAAA,EACT;AACF,CAAA;AAEA,IAAM,OAAA,GAAU,qEAAA;AAET,IAAM,cAAA,GAA6B;AAAA,EACxC,EAAA,EAAI,MAAA;AAAA,EACJ,QAAA,EAAU,CAAC,MAAM,CAAA;AAAA,EACjB,IAAA,EAAM,CAAA;AAAA,EACN,IAAA,EAAM,CAAC,IAAA,KAAS;AACd,IAAA,MAAM,QAAgB,EAAC;AACvB,IAAA,OAAA,CAAQ,SAAA,GAAY,CAAA;AACpB,IAAA,IAAI,CAAA;AACJ,IAAA,OAAA,CAAQ,CAAA,GAAI,OAAA,CAAQ,IAAA,CAAK,IAAI,OAAO,IAAA,EAAM;AACxC,MAAA,MAAM,GAAA,GAAM,CAAA,CAAE,CAAC,CAAA,CAAE,OAAA,EAAQ;AACzB,MAAA,IAAI,CAAC,SAAA,CAAU,GAAG,CAAA,EAAG;AACrB,MAAA,KAAA,CAAM,IAAA,CAAK;AAAA,QACT,MAAA,EAAQ,MAAA;AAAA,QACR,OAAO,CAAA,CAAE,KAAA;AAAA,QACT,GAAA,EAAK,CAAA,CAAE,KAAA,GAAQ,GAAA,CAAI,MAAA;AAAA,QACnB,UAAA,EAAY,CAAA;AAAA,QACZ,UAAA,EAAY;AAAA,OACb,CAAA;AAAA,IACH;AACA,IAAA,OAAO,KAAA;AAAA,EACT;AACF,CAAA;AAEA,IAAM,gBAAA,GAAmB,uCAAA;AACzB,IAAM,kBAAA,GAAqB,qCAAA;AAC3B,IAAM,cAAA,GAAiB,cAAA;AACvB,IAAM,kBAAA,GAAqB,EAAA;AAG3B,SAAS,aAAA,CAAc,IAAA,EAAc,KAAA,EAAe,MAAA,EAAyB;AAC3E,EAAA,MAAM,CAAA,GAAI,OAAO,IAAI,CAAA;AACrB,EAAA,IAAI,MAAM,CAAA,IAAK,CAAA,KAAM,GAAA,IAAO,CAAA,IAAK,KAAK,OAAO,KAAA;AAC7C,EAAA,IAAI,MAAA,CAAO,KAAK,CAAA,KAAM,CAAA,EAAG,OAAO,KAAA;AAChC,EAAA,IAAI,MAAA,CAAO,MAAM,CAAA,KAAM,CAAA,EAAG,OAAO,KAAA;AACjC,EAAA,OAAO,IAAA;AACT;AAEO,IAAM,aAAA,GAA4B;AAAA,EACvC,EAAA,EAAI,KAAA;AAAA,EACJ,QAAA,EAAU,CAAC,KAAK,CAAA;AAAA,EAChB,IAAA,EAAM,CAAA;AAAA,EACN,IAAA,EAAM,CAAC,IAAA,KAAS;AACd,IAAA,MAAM,QAAgB,EAAC;AAEvB,IAAA,gBAAA,CAAiB,SAAA,GAAY,CAAA;AAC7B,IAAA,IAAI,CAAA;AACJ,IAAA,OAAA,CAAQ,CAAA,GAAI,gBAAA,CAAiB,IAAA,CAAK,IAAI,OAAO,IAAA,EAAM;AACjD,MAAA,IAAI,CAAC,aAAA,CAAc,CAAA,CAAE,CAAC,CAAA,EAAI,CAAA,CAAE,CAAC,CAAA,EAAI,CAAA,CAAE,CAAC,CAAE,CAAA,EAAG;AACzC,MAAA,KAAA,CAAM,IAAA,CAAK;AAAA,QACT,MAAA,EAAQ,KAAA;AAAA,QACR,OAAO,CAAA,CAAE,KAAA;AAAA,QACT,GAAA,EAAK,CAAA,CAAE,KAAA,GAAQ,CAAA,CAAE,CAAC,CAAA,CAAE,MAAA;AAAA,QACpB,UAAA,EAAY,CAAA;AAAA,QACZ,UAAA,EAAY;AAAA,OACb,CAAA;AAAA,IACH;AAGA,IAAA,MAAM,cAAwB,EAAC;AAC/B,IAAA,cAAA,CAAe,SAAA,GAAY,CAAA;AAC3B,IAAA,IAAI,CAAA;AACJ,IAAA,OAAA,CAAQ,CAAA,GAAI,cAAA,CAAe,IAAA,CAAK,IAAI,CAAA,MAAO,IAAA,EAAM,WAAA,CAAY,IAAA,CAAK,CAAA,CAAE,KAAA,GAAQ,CAAA,CAAE,CAAC,EAAE,MAAM,CAAA;AACvF,IAAA,IAAI,WAAA,CAAY,SAAS,CAAA,EAAG;AAC1B,MAAA,kBAAA,CAAmB,SAAA,GAAY,CAAA;AAC/B,MAAA,OAAA,CAAQ,CAAA,GAAI,kBAAA,CAAmB,IAAA,CAAK,IAAI,OAAO,IAAA,EAAM;AACnD,QAAA,IAAI,CAAC,aAAA,CAAc,CAAA,CAAE,CAAC,CAAA,EAAI,CAAA,CAAE,CAAC,CAAA,EAAI,CAAA,CAAE,CAAC,CAAE,CAAA,EAAG;AACzC,QAAA,MAAM,QAAQ,CAAA,CAAE,KAAA;AAChB,QAAA,MAAM,IAAA,GAAO,YAAY,IAAA,CAAK,CAAC,QAAQ,KAAA,IAAS,GAAA,IAAO,KAAA,GAAQ,GAAA,IAAO,kBAAkB,CAAA;AACxF,QAAA,IAAI,CAAC,IAAA,EAAM;AACX,QAAA,KAAA,CAAM,IAAA,CAAK;AAAA,UACT,MAAA,EAAQ,KAAA;AAAA,UACR,KAAA;AAAA,UACA,GAAA,EAAK,KAAA,GAAQ,CAAA,CAAE,CAAC,CAAA,CAAE,MAAA;AAAA,UAClB,UAAA,EAAY,GAAA;AAAA,UACZ,UAAA,EAAY;AAAA,SACb,CAAA;AAAA,MACH;AAAA,IACF;AACA,IAAA,OAAO,KAAA;AAAA,EACT;AACF,CAAA;AAEA,IAAM,OAAA,GAAU,6CAAA;AAEhB,IAAM,OAAA,GACJ,whBAAA;AAEK,SAAS,mBAAA,CAAoB,oBAAoB,KAAA,EAAmB;AACzE,EAAA,OAAO;AAAA,IACL,EAAA,EAAI,YAAA;AAAA,IACJ,QAAA,EAAU,CAAC,YAAY,CAAA;AAAA,IACvB,IAAA,EAAM,CAAA;AAAA,IACN,IAAA,EAAM,CAAC,IAAA,KAAS;AACd,MAAA,MAAM,QAAgB,EAAC;AAEvB,MAAA,OAAA,CAAQ,SAAA,GAAY,CAAA;AACpB,MAAA,IAAI,CAAA;AACJ,MAAA,OAAA,CAAQ,CAAA,GAAI,OAAA,CAAQ,IAAA,CAAK,IAAI,OAAO,IAAA,EAAM;AACxC,QAAA,MAAM,MAAA,GAAS,SAAA,CAAU,CAAA,CAAE,CAAC,CAAC,CAAA;AAC7B,QAAA,IAAI,WAAW,IAAA,EAAM;AACrB,QAAA,IAAI,CAAC,iBAAA,IAAqB,uBAAA,CAAwB,MAAM,CAAA,EAAG;AAC3D,QAAA,KAAA,CAAM,IAAA,CAAK;AAAA,UACT,MAAA,EAAQ,YAAA;AAAA,UACR,OAAO,CAAA,CAAE,KAAA;AAAA,UACT,GAAA,EAAK,CAAA,CAAE,KAAA,GAAQ,CAAA,CAAE,CAAC,CAAA,CAAE,MAAA;AAAA,UACpB,UAAA,EAAY,CAAA;AAAA,UACZ,UAAA,EAAY;AAAA,SACb,CAAA;AAAA,MACH;AAEA,MAAA,OAAA,CAAQ,SAAA,GAAY,CAAA;AACpB,MAAA,OAAA,CAAQ,CAAA,GAAI,OAAA,CAAQ,IAAA,CAAK,IAAI,OAAO,IAAA,EAAM;AACxC,QAAA,IAAI,CAAC,iBAAA,IAAqB,uBAAA,CAAwB,CAAA,CAAE,CAAC,CAAC,CAAA,EAAG;AACzD,QAAA,KAAA,CAAM,IAAA,CAAK;AAAA,UACT,MAAA,EAAQ,YAAA;AAAA,UACR,OAAO,CAAA,CAAE,KAAA;AAAA,UACT,GAAA,EAAK,CAAA,CAAE,KAAA,GAAQ,CAAA,CAAE,CAAC,CAAA,CAAE,MAAA;AAAA,UACpB,UAAA,EAAY,CAAA;AAAA,UACZ,UAAA,EAAY;AAAA,SACb,CAAA;AAAA,MACH;AACA,MAAA,OAAO,KAAA;AAAA,IACT;AAAA,GACF;AACF;AAEA,IAAM,wBAAA,GAA+C;AAAA,EACnD,EAAE,EAAA,EAAI,4DAAA,EAA8D,UAAA,EAAY,CAAA;AAClF,CAAA;AAEO,IAAM,wBAAA,GAAuC;AAAA,EAClD,EAAA,EAAI,iBAAA;AAAA,EACJ,QAAA,EAAU,CAAC,iBAAiB,CAAA;AAAA,EAC5B,IAAA,EAAM,CAAA;AAAA,EACN,MAAM,CAAC,IAAA,KACL,aAAa,IAAA,EAAM,wBAAA,EAA0B,mBAAmB,iBAAiB;AACrF,CAAA;AAGO,IAAM,sBAAA,GAAgD;AAAA,EAC3D,eAAA;AAAA,EACA,eAAA;AAAA,EACA,oBAAA;AAAA,EACA,cAAA;AAAA,EACA,aAAA;AAAA,EACA;AACF,CAAA;;;ACtOA,IAAM,gBAAA,GAAuC;AAAA,EAC3C,EAAE,EAAA,EAAI,4BAAA,EAA8B,UAAA,EAAY,CAAA,EAAE;AAAA;AAAA,EAClD,EAAE,EAAA,EAAI,sBAAA,EAAwB,UAAA,EAAY,CAAA,EAAE;AAAA;AAAA,EAC5C,EAAE,EAAA,EAAI,oCAAA,EAAsC,UAAA,EAAY,CAAA,EAAE;AAAA;AAAA,EAC1D,EAAE,EAAA,EAAI,oCAAA,EAAsC,UAAA,EAAY,GAAA,EAAI;AAAA;AAAA,EAC5D,EAAE,EAAA,EAAI,6BAAA,EAA+B,UAAA,EAAY,CAAA,EAAE;AAAA;AAAA,EACnD,EAAE,EAAA,EAAI,+BAAA,EAAiC,UAAA,EAAY,CAAA,EAAE;AAAA;AAAA,EACrD,EAAE,EAAA,EAAI,mBAAA,EAAqB,UAAA,EAAY,CAAA,EAAE;AAAA;AAAA,EACzC,EAAE,EAAA,EAAI,+BAAA,EAAiC,UAAA,EAAY,CAAA,EAAE;AAAA;AAAA,EACrD,EAAE,EAAA,EAAI,wBAAA,EAA0B,UAAA,EAAY,CAAA,EAAE;AAAA;AAAA,EAC9C,EAAE,EAAA,EAAI,2CAAA,EAA6C,UAAA,EAAY,CAAA,EAAE;AAAA;AAAA,EACjE,EAAE,EAAA,EAAI,sBAAA,EAAwB,UAAA,EAAY,GAAA,EAAI;AAAA;AAAA,EAC9C,EAAE,EAAA,EAAI,0BAAA,EAA4B,UAAA,EAAY,CAAA,EAAE;AAAA;AAAA,EAChD,EAAE,EAAA,EAAI,sBAAA,EAAwB,UAAA,EAAY,CAAA,EAAE;AAAA;AAAA,EAC5C,EAAE,EAAA,EAAI,sBAAA,EAAwB,UAAA,EAAY,CAAA;AAAE;AAC9C,CAAA;AAEO,IAAM,gBAAA,GAA+B;AAAA,EAC1C,EAAA,EAAI,SAAA;AAAA,EACJ,QAAA,EAAU,CAAC,SAAS,CAAA;AAAA,EACpB,IAAA,EAAM,CAAA;AAAA,EACN,MAAM,CAAC,IAAA,KAAS,aAAa,IAAA,EAAM,gBAAA,EAAkB,WAAW,SAAS;AAC3E,CAAA;AAEA,IAAM,MAAA,GAAS,oDAAA;AAER,IAAM,aAAA,GAA4B;AAAA,EACvC,EAAA,EAAI,KAAA;AAAA,EACJ,QAAA,EAAU,CAAC,KAAK,CAAA;AAAA,EAChB,IAAA,EAAM,CAAA;AAAA,EACN,IAAA,EAAM,CAAC,IAAA,KAAS;AACd,IAAA,MAAM,QAAgB,EAAC;AACvB,IAAA,MAAA,CAAO,SAAA,GAAY,CAAA;AACnB,IAAA,IAAI,CAAA;AACJ,IAAA,OAAA,CAAQ,CAAA,GAAI,MAAA,CAAO,IAAA,CAAK,IAAI,OAAO,IAAA,EAAM;AACvC,MAAA,MAAM,MAAA,GAAS,mBAAA,CAAoB,CAAA,CAAE,CAAC,CAAA,CAAE,KAAA,CAAM,CAAA,EAAG,CAAA,CAAE,CAAC,CAAA,CAAE,OAAA,CAAQ,GAAG,CAAC,CAAC,CAAA;AACnE,MAAA,IAAI,MAAA,KAAW,IAAA,IAAQ,WAAA,CAAY,MAAM,CAAA,EAAG;AAC1C,QAAA,KAAA,CAAM,IAAA,CAAK;AAAA,UACT,MAAA,EAAQ,KAAA;AAAA,UACR,OAAO,CAAA,CAAE,KAAA;AAAA,UACT,GAAA,EAAK,CAAA,CAAE,KAAA,GAAQ,CAAA,CAAE,CAAC,CAAA,CAAE,MAAA;AAAA,UACpB,UAAA,EAAY,CAAA;AAAA,UACZ,UAAA,EAAY;AAAA,SACb,CAAA;AAAA,MACH;AAAA,IACF;AACA,IAAA,OAAO,KAAA;AAAA,EACT;AACF,CAAA;AAEA,IAAM,YAAA,GAAmC;AAAA,EACvC;AAAA,IACE,EAAA,EAAI,oIAAA;AAAA,IACJ,UAAA,EAAY;AAAA;AAEhB,CAAA;AAEO,IAAM,oBAAA,GAAmC;AAAA,EAC9C,EAAA,EAAI,aAAA;AAAA,EACJ,QAAA,EAAU,CAAC,aAAa,CAAA;AAAA,EACxB,IAAA,EAAM,CAAA;AAAA,EACN,MAAM,CAAC,IAAA,KAAS,aAAa,IAAA,EAAM,YAAA,EAAc,eAAe,aAAa;AAC/E,CAAA;AAKA,IAAM,QAAA,GAAW,yBAAA;AACjB,IAAM,UAAA,GACJ,kFAAA;AACF,IAAM,gBAAA,GAAmB,6CAAA;AACzB,IAAM,iBAAA,GAAoB,CAAA;AAE1B,IAAM,cAAA,GAAiB,EAAA;AAEhB,IAAM,2BAAA,GAA0C;AAAA,EACrD,EAAA,EAAI,qBAAA;AAAA,EACJ,QAAA,EAAU,CAAC,qBAAqB,CAAA;AAAA,EAChC,IAAA,EAAM,CAAA;AAAA,EACN,IAAA,EAAM,CAAC,IAAA,KAAS;AACd,IAAA,MAAM,QAAgB,EAAC;AAGvB,IAAA,MAAM,cAAwB,EAAC;AAC/B,IAAA,UAAA,CAAW,SAAA,GAAY,CAAA;AACvB,IAAA,IAAI,CAAA;AACJ,IAAA,OAAA,CAAQ,CAAA,GAAI,UAAA,CAAW,IAAA,CAAK,IAAI,CAAA,MAAO,IAAA,EAAM,WAAA,CAAY,IAAA,CAAK,CAAA,CAAE,KAAA,GAAQ,CAAA,CAAE,CAAC,EAAE,MAAM,CAAA;AAGnF,IAAA,MAAM,YAAA,uBAAmB,GAAA,EAAY;AACrC,IAAA,gBAAA,CAAiB,SAAA,GAAY,CAAA;AAC7B,IAAA,IAAI,CAAA;AACJ,IAAA,OAAA,CAAQ,CAAA,GAAI,gBAAA,CAAiB,IAAA,CAAK,IAAI,OAAO,IAAA,EAAM;AACjD,MAAA,YAAA,CAAa,GAAA,CAAI,CAAA,CAAE,KAAA,GAAQ,CAAA,CAAE,CAAC,EAAE,OAAA,CAAQ,CAAA,CAAE,CAAC,CAAE,CAAC,CAAA;AAAA,IAChD;AAEA,IAAA,QAAA,CAAS,SAAA,GAAY,CAAA;AACrB,IAAA,IAAI,CAAA;AACJ,IAAA,OAAA,CAAQ,CAAA,GAAI,QAAA,CAAS,IAAA,CAAK,IAAI,OAAO,IAAA,EAAM;AACzC,MAAA,MAAM,GAAA,GAAM,EAAE,CAAC,CAAA;AACf,MAAA,IAAI,CAAC,gBAAA,CAAiB,GAAG,CAAA,EAAG;AAC5B,MAAA,IAAI,cAAA,CAAe,GAAG,CAAA,IAAK,iBAAA,EAAmB;AAC9C,MAAA,MAAM,QAAQ,CAAA,CAAE,KAAA;AAChB,MAAA,MAAM,WAAA,GAAc,YAAY,IAAA,CAAK,CAAC,QAAQ,KAAA,IAAS,GAAA,IAAO,KAAA,GAAQ,GAAA,IAAO,cAAc,CAAA;AAC3F,MAAA,IAAI,CAAC,WAAA,IAAe,CAAC,YAAA,CAAa,GAAA,CAAI,KAAK,CAAA,EAAG;AAC9C,MAAA,KAAA,CAAM,IAAA,CAAK;AAAA,QACT,MAAA,EAAQ,qBAAA;AAAA,QACR,KAAA;AAAA,QACA,GAAA,EAAK,QAAQ,GAAA,CAAI,MAAA;AAAA,QACjB,UAAA,EAAY,GAAA;AAAA,QACZ,UAAA,EAAY;AAAA,OACb,CAAA;AAAA,IACH;AACA,IAAA,OAAO,KAAA;AAAA,EACT;AACF,CAAA;AAEA,IAAM,0BAAA,GAAiD;AAAA,EACrD;AAAA;AAAA,IAEE,EAAA,EAAI,8FAAA;AAAA,IACJ,UAAA,EAAY;AAAA,GACd;AAAA,EACA;AAAA;AAAA,IAEE,EAAA,EAAI,kEAAA;AAAA,IACJ,UAAA,EAAY;AAAA;AAEhB,CAAA;AAEO,IAAM,0BAAA,GAAyC;AAAA,EACpD,EAAA,EAAI,mBAAA;AAAA,EACJ,QAAA,EAAU,CAAC,mBAAmB,CAAA;AAAA,EAC9B,IAAA,EAAM,CAAA;AAAA,EACN,MAAM,CAAC,IAAA,KACL,aAAa,IAAA,EAAM,0BAAA,EAA4B,qBAAqB,mBAAmB;AAC3F,CAAA;AAGO,IAAM,kBAAA,GAA4C;AAAA,EACvD,gBAAA;AAAA,EACA,aAAA;AAAA,EACA,oBAAA;AAAA,EACA,2BAAA;AAAA,EACA;AACF,CAAA;;;ACjJO,SAAS,kBAAA,CAAmB,IAAA,GAAiC,EAAC,EAAiB;AACpF,EAAA,OAAO;AAAA,IACL,GAAG,kBAAA;AAAA,IACH,GAAG,sBAAA;AAAA,IACH,mBAAA,CAAoB,IAAA,CAAK,iBAAA,IAAqB,KAAK;AAAA,GACrD;AACF;;;ACkBO,SAAS,qBAAA,CAAsB,IAAA,GAA+B,EAAC,EAAoB;AACxF,EAAA,MAAM,WAAA,GAA4B;AAAA,IAChC,GAAI,IAAA,CAAK,WAAA,KAAgB,KAAA,GACrB,EAAC,GACD,kBAAA,CAAmB,EAAE,iBAAA,EAAmB,IAAA,CAAK,iBAAA,IAAqB,KAAA,EAAO,CAAA;AAAA,IAC7E,GAAI,IAAA,CAAK,WAAA,IAAe;AAAC,GAC3B;AAEA,EAAA,MAAM,SAAA,GAAY;AAAA,IAChB,GAAI,KAAK,UAAA,KAAe,MAAA,GAAY,EAAE,UAAA,EAAY,IAAA,CAAK,UAAA,EAAW,GAAI,EAAC;AAAA,IACvE,GAAI,KAAK,gBAAA,KAAqB,MAAA,GAAY,EAAE,gBAAA,EAAkB,IAAA,CAAK,gBAAA,EAAiB,GAAI;AAAC,GAC3F;AAEA,EAAA,MAAM,cAAA,GAAiB,CAAC,IAAA,KAAyB;AAC/C,IAAA,MAAM,QAAgB,EAAC;AACvB,IAAA,KAAA,MAAW,cAAc,WAAA,EAAa;AACpC,MAAA,MAAM,MAAA,GAAS,UAAA,CAAW,IAAA,CAAK,IAAI,CAAA;AACnC,MAAA,IAAI,kBAAkB,OAAA,EAAS;AAC7B,QAAA,MAAM,IAAI,mBAAA;AAAA,UACR;AAAA,SACF;AAAA,MACF;AACA,MAAA,KAAA,MAAW,IAAA,IAAQ,MAAA,EAAQ,KAAA,CAAM,IAAA,CAAK,IAAI,CAAA;AAAA,IAC5C;AACA,IAAA,OAAO,KAAA;AAAA,EACT,CAAA;AAEA,EAAA,MAAM,WAAW,CAAC,IAAA,KAAyB,WAAW,cAAA,CAAe,IAAI,GAAG,SAAS,CAAA;AAErF,EAAA,MAAM,MAAA,GAAS,CAAC,KAAA,KACd,OAAO,KAAA,KAAU,QAAA,GAAW,QAAA,CAAS,KAAK,CAAA,GAAI,UAAA,CAAW,KAAA,EAAO,QAAQ,CAAA;AAE1E,EAAA,OAAO,EAAE,aAAa,MAAA,EAAO;AAC/B;;;AC5DO,SAAS,cAAc,KAAA,EAAoC;AAChE,EAAA,IAAI,OAAO,UAAU,QAAA,EAAU;AAC7B,IAAA,OAAO,EAAE,QAAQ,KAAA,EAAM;AAAA,EACzB;AACA,EAAA,OAAO;AAAA,IACL,QAAQ,KAAA,CAAM,MAAA;AAAA,IACd,GAAI,MAAM,MAAA,KAAW,MAAA,GAAY,EAAE,MAAA,EAAQ,KAAA,CAAM,MAAA,EAAO,GAAI,EAAC;AAAA,IAC7D,GAAI,MAAM,uBAAA,KAA4B,MAAA,GAClC,EAAE,uBAAA,EAAyB,KAAA,CAAM,uBAAA,EAAwB,GACzD;AAAC,GACP;AACF;;;ACRA,IAAM,aAAA,uBAAyC,GAAA,CAAI;AAAA,EACjD,OAAA;AAAA,EACA,MAAA;AAAA,EACA,UAAA;AAAA,EACA,OAAA;AAAA,EACA,QAAA;AAAA,EACA;AACF,CAAC,CAAA;AAED,SAAS,YAAA,CAAa,MAAA,EAAgB,IAAA,EAAc,WAAA,EAA4B;AAC9E,EAAA,IAAI,CAAC,aAAA,CAAc,GAAA,CAAI,MAAM,CAAA,EAAG;AAC9B,IAAA,MAAM,IAAI,qBAAA,CAAsB,CAAA,gBAAA,EAAmB,OAAO,MAAM,CAAC,KAAK,IAAI,CAAA;AAAA,EAC5E;AACA,EAAA,IAAI,WAAW,QAAA,EAAU;AACvB,IAAA,MAAM,IAAI,oBAAoB,6BAA6B,CAAA;AAAA,EAC7D;AAEA,EAAA,IAAI,MAAA,KAAW,YAAA,IAAgB,CAAC,WAAA,EAAa;AAC3C,IAAA,MAAM,IAAI,qBAAA,CAAsB,qDAAA,EAAuD,IAAI,CAAA;AAAA,EAC7F;AACF;AAEA,SAAS,iBAAA,CAAkB,KAAA,EAAwB,IAAA,EAAc,WAAA,EAA4B;AAC3F,EAAA,MAAM,IAAA,GAAO,cAAc,KAAK,CAAA;AAChC,EAAA,YAAA,CAAa,IAAA,CAAK,MAAA,EAAQ,CAAA,EAAG,IAAI,WAAW,WAAW,CAAA;AACvD,EAAA,IAAI,IAAA,CAAK,WAAW,MAAA,IAAa,IAAA,CAAK,WAAW,UAAA,IAAc,IAAA,CAAK,WAAW,OAAA,EAAS;AACtF,IAAA,MAAM,IAAI,qBAAA,CAAsB,CAAA,gBAAA,EAAmB,MAAA,CAAO,IAAA,CAAK,MAAM,CAAC,CAAA,CAAA,CAAA,EAAK,CAAA,EAAG,IAAI,CAAA,OAAA,CAAS,CAAA;AAAA,EAC7F;AACF;AAEA,SAAS,gBAAA,CACP,QAAA,EACA,IAAA,EACA,WAAA,EACM;AACN,EAAA,IAAI,aAAa,MAAA,EAAW;AAC5B,EAAA,KAAA,MAAW,CAAC,MAAA,EAAQ,KAAK,KAAK,MAAA,CAAO,OAAA,CAAQ,QAAQ,CAAA,EAAG;AACtD,IAAA,IAAI,UAAU,MAAA,EAAW;AACzB,IAAA,iBAAA,CAAkB,OAAO,CAAA,EAAG,IAAI,CAAA,CAAA,EAAI,MAAM,IAAI,WAAW,CAAA;AAAA,EAC3D;AACF;AAEA,SAAS,aAAA,CAAc,OAAoB,IAAA,EAAoB;AAC7D,EAAA,gBAAA,CAAiB,KAAA,CAAM,QAAA,EAAU,CAAA,EAAG,IAAI,aAAa,KAAK,CAAA;AAC1D,EAAA,IAAI,KAAA,CAAM,eAAe,MAAA,EAAW;AACpC,EAAA,KAAA,MAAW,CAAC,KAAK,IAAI,CAAA,IAAK,OAAO,OAAA,CAAQ,KAAA,CAAM,UAAU,CAAA,EAAG;AAC1D,IAAA,MAAM,WAAA,GAAc,oBAAoB,GAAG,CAAA;AAC3C,IAAA,gBAAA,CAAiB,MAAM,QAAA,EAAU,CAAA,EAAG,IAAI,CAAA,YAAA,EAAe,GAAG,aAAa,WAAW,CAAA;AAAA,EACpF;AACF;AAMO,SAAS,eAAe,GAAA,EAA2B;AACxD,EAAA,IAAI,GAAA,CAAI,QAAA,EAAU,MAAA,KAAW,MAAA,EAAW;AACtC,IAAA,YAAA,CAAa,GAAA,CAAI,QAAA,CAAS,MAAA,EAAQ,iBAAA,EAAmB,KAAK,CAAA;AAAA,EAC5D;AACA,EAAA,aAAA,CAAc,KAAK,EAAE,CAAA;AACrB,EAAA,IAAI,GAAA,CAAI,eAAe,MAAA,EAAW;AAClC,EAAA,KAAA,MAAW,CAAC,OAAO,KAAK,CAAA,IAAK,OAAO,OAAA,CAAQ,GAAA,CAAI,UAAU,CAAA,EAAG;AAC3D,IAAA,aAAA,CAAc,KAAA,EAAO,CAAA,WAAA,EAAc,KAAK,CAAA,CAAE,CAAA;AAAA,EAC5C;AACF;;;ACxCA,SAAS,gBACP,QAAA,EACyB;AACzB,EAAA,MAAM,GAAA,uBAAU,GAAA,EAAwB;AACxC,EAAA,IAAI,QAAA,KAAa,QAAW,OAAO,GAAA;AACnC,EAAA,KAAA,MAAW,CAAC,GAAA,EAAK,KAAK,KAAK,MAAA,CAAO,OAAA,CAAQ,QAAQ,CAAA,EAAG;AACnD,IAAA,IAAI,UAAU,MAAA,EAAW;AACzB,IAAA,GAAA,CAAI,GAAA,CAAI,GAAA,EAAK,aAAA,CAAc,KAAK,CAAC,CAAA;AAAA,EACnC;AACA,EAAA,OAAO,GAAA;AACT;AAEA,SAAS,kBAAkB,UAAA,EAGzB;AACA,EAAA,MAAM,WAA+B,EAAC;AACtC,EAAA,IAAI,eAAe,MAAA,EAAW;AAC5B,IAAA,OAAO,EAAE,UAAA,EAAY,QAAA,EAAU,gBAAA,EAAkB,EAAC,EAAE;AAAA,EACtD;AACA,EAAA,KAAA,MAAW,CAAC,OAAA,EAAS,IAAI,KAAK,MAAA,CAAO,OAAA,CAAQ,UAAU,CAAA,EAAG;AACxD,IAAA,QAAA,CAAS,IAAA,CAAK;AAAA,MACZ,OAAA;AAAA,MACA,QAAA,EAAU,eAAA,CAAgB,IAAA,EAAM,QAAQ;AAAA,KACzC,CAAA;AAAA,EACH;AAEA,EAAA,QAAA,CAAS,IAAA,CAAK,CAAC,CAAA,EAAG,CAAA,KAAM;AACtB,IAAA,MAAM,QAAQ,CAAA,CAAE,OAAA,CAAQ,QAAA,CAAS,GAAG,IAAI,CAAA,GAAI,CAAA;AAC5C,IAAA,MAAM,QAAQ,CAAA,CAAE,OAAA,CAAQ,QAAA,CAAS,GAAG,IAAI,CAAA,GAAI,CAAA;AAC5C,IAAA,IAAI,KAAA,KAAU,KAAA,EAAO,OAAO,KAAA,GAAQ,KAAA;AACpC,IAAA,OAAO,CAAA,CAAE,OAAA,CAAQ,MAAA,GAAS,CAAA,CAAE,OAAA,CAAQ,MAAA;AAAA,EACtC,CAAC,CAAA;AACD,EAAA,OAAO;AAAA,IACL,UAAA,EAAY,QAAA;AAAA,IACZ,kBAAkB,QAAA,CAAS,GAAA,CAAI,CAAC,CAAA,KAAM,EAAE,OAAO;AAAA,GACjD;AACF;AAEA,SAAS,aAAa,KAAA,EAAsC;AAC1D,EAAA,MAAM,QAAA,GAAW,eAAA,CAAgB,KAAA,CAAM,QAAQ,CAAA;AAC/C,EAAA,MAAM,EAAE,UAAA,EAAY,gBAAA,EAAiB,GAAI,iBAAA,CAAkB,MAAM,UAAU,CAAA;AAC3E,EAAA,OAAO,EAAE,QAAA,EAAU,UAAA,EAAY,gBAAA,EAAiB;AAClD;AAMA,SAAS,uBAAA,CAAwB,UAAmC,IAAA,EAAoB;AACtF,EAAA,KAAA,MAAW,CAAC,MAAA,EAAQ,IAAI,CAAA,IAAK,QAAA,EAAU;AACrC,IAAA,IAAI,IAAA,CAAK,WAAW,UAAA,EAAY;AAChC,IAAA,IAAI,wBAAA,CAAyB,GAAA,CAAI,MAAM,CAAA,EAAG;AAC1C,IAAA,UAAA,EAAW,EAAG,IAAA;AAAA,MACZ,CAAA,2DAAA,EAA8D,MAAM,CAAA,KAAA,EAAQ,IAAI,IAAI,MAAM,CAAA,6BAAA;AAAA,KAC5F;AAAA,EACF;AACF;AAEA,SAAS,sBAAsB,QAAA,EAAgC;AAC7D,EAAA,uBAAA,CAAwB,QAAA,CAAS,UAAU,UAAU,CAAA;AACrD,EAAA,KAAA,MAAW,QAAA,IAAY,SAAS,UAAA,EAAY;AAC1C,IAAA,uBAAA,CAAwB,QAAA,CAAS,QAAA,EAAU,CAAA,WAAA,EAAc,QAAA,CAAS,OAAO,CAAA,SAAA,CAAW,CAAA;AAAA,EACtF;AACA,EAAA,KAAA,MAAW,CAAC,KAAA,EAAO,KAAK,CAAA,IAAK,SAAS,UAAA,EAAY;AAChD,IAAA,uBAAA,CAAwB,KAAA,CAAM,QAAA,EAAU,CAAA,WAAA,EAAc,KAAK,CAAA,SAAA,CAAW,CAAA;AACtE,IAAA,KAAA,MAAW,QAAA,IAAY,MAAM,UAAA,EAAY;AACvC,MAAA,uBAAA;AAAA,QACE,QAAA,CAAS,QAAA;AAAA,QACT,CAAA,WAAA,EAAc,KAAK,CAAA,YAAA,EAAe,QAAA,CAAS,OAAO,CAAA,SAAA;AAAA,OACpD;AAAA,IACF;AAAA,EACF;AACF;AAUO,SAAS,cAAc,GAAA,EAAqC;AACjE,EAAA,cAAA,CAAe,GAAG,CAAA;AAClB,EAAA,MAAM,EAAE,UAAA,EAAY,gBAAA,EAAiB,GAAI,iBAAA,CAAkB,IAAI,UAAU,CAAA;AACzE,EAAA,MAAM,UAAA,uBAAiB,GAAA,EAA8B;AACrD,EAAA,IAAI,GAAA,CAAI,eAAe,MAAA,EAAW;AAChC,IAAA,KAAA,MAAW,CAAC,OAAO,KAAK,CAAA,IAAK,OAAO,OAAA,CAAQ,GAAA,CAAI,UAAU,CAAA,EAAG;AAC3D,MAAA,UAAA,CAAW,GAAA,CAAI,KAAA,EAAO,YAAA,CAAa,KAAK,CAAC,CAAA;AAAA,IAC3C;AAAA,EACF;AACA,EAAA,MAAM,QAAA,GAA2B;AAAA,IAC/B,cAAA,EAAgB,GAAA,CAAI,QAAA,EAAU,MAAA,IAAU,OAAA;AAAA,IACxC,uBAAA,EAAyB,IAAI,uBAAA,KAA4B,IAAA;AAAA,IACzD,QAAA,EAAU,eAAA,CAAgB,GAAA,CAAI,QAAQ,CAAA;AAAA,IACtC,UAAA;AAAA,IACA,gBAAA;AAAA,IACA;AAAA,GACF;AACA,EAAA,qBAAA,CAAsB,QAAQ,CAAA;AAC9B,EAAA,OAAO,QAAA;AACT;;;ACnHA,IAAM,oBAAA,GAAkD;AAAA,EACtD,OAAA;AAAA,EACA,OAAA;AAAA,EACA,aAAA;AAAA,EACA,MAAA;AAAA,EACA;AACF,CAAA;AAWO,SAAS,aAAA,GAAgC;AAC9C,EAAA,MAAM,WAA0D,EAAC;AACjE,EAAA,KAAA,MAAW,UAAU,qBAAA,EAAuB;AAC1C,IAAA,QAAA,CAAS,MAAM,CAAA,GAAI,OAAA;AAAA,EACrB;AACA,EAAA,KAAA,MAAW,UAAU,oBAAA,EAAsB;AACzC,IAAA,QAAA,CAAS,MAAM,CAAA,GAAI,UAAA;AAAA,EACrB;AACA,EAAA,QAAA,CAAS,eAAA,GAAkB,OAAA;AAC3B,EAAA,OAAO;AAAA,IACL,QAAA,EAAU,EAAE,MAAA,EAAQ,OAAA,EAAQ;AAAA,IAC5B,QAAA;AAAA,IACA,UAAA,EAAY;AAAA,MACV,YAAY,EAAE,QAAA,EAAU,EAAE,GAAA,EAAK,cAAa;AAAE;AAChD,GACF;AACF;;;AC/CA,IAAM,SAAA,uBAAgB,OAAA,EAA2B;AAG1C,SAAS,gBAAA,CAAiB,OAAc,SAAA,EAA6B;AAC1E,EAAA,SAAA,CAAU,GAAA,CAAI,OAAO,SAAS,CAAA;AAChC;AAGO,SAAS,YAAY,KAAA,EAAsC;AAChE,EAAA,OAAO,SAAA,CAAU,IAAI,KAAK,CAAA;AAC5B;;;ACFO,SAAS,UAAA,CAAW,YAAoB,KAAA,EAAuB;AACpE,EAAA,OAAO,CAAA,YAAA,EAAe,UAAU,CAAA,CAAA,EAAI,KAAK,CAAA,CAAA;AAC3C;AAGA,eAAsB,YAAA,CACpB,SAAA,EACA,MAAA,EACA,SAAA,EACiB;AACjB,EAAA,MAAM,UAAA,GAAa,MAAM,aAAA,CAAc,SAAA,EAAW,OAAO,KAAK,CAAA;AAC9D,EAAA,MAAM,OAAA,GAA8B;AAAA,IAClC,QAAQ,MAAA,CAAO,MAAA;AAAA,IACf,UAAA;AAAA,IACA,GAAI,SAAA,KAAc,MAAA,GAAY,EAAE,SAAA,KAAc;AAAC,GACjD;AACA,EAAA,OAAO,IAAA,CAAK,UAAU,OAAO,CAAA;AAC/B;AAGA,eAAsB,aACpB,SAAA,EACA,GAAA,EACA,GAAA,GAAc,IAAA,CAAK,KAAI,EACiC;AACxD,EAAA,IAAI,MAAA;AACJ,EAAA,IAAI;AACF,IAAA,MAAA,GAAS,IAAA,CAAK,MAAM,GAAG,CAAA;AAAA,EACzB,CAAA,CAAA,MAAQ;AACN,IAAA,MAAM,IAAI,WAAW,sBAAsB,CAAA;AAAA,EAC7C;AACA,EAAA,IAAI,MAAA,CAAO,SAAA,KAAc,MAAA,IAAa,MAAA,CAAO,aAAa,GAAA,EAAK;AAC7D,IAAA,OAAO,IAAA;AAAA,EACT;AACA,EAAA,MAAM,KAAA,GAAQ,MAAM,aAAA,CAAc,SAAA,EAAW,OAAO,UAAU,CAAA;AAC9D,EAAA,OAAO;AAAA,IACL,KAAA;AAAA,IACA,QAAQ,MAAA,CAAO,MAAA;AAAA,IACf,GAAI,OAAO,SAAA,KAAc,MAAA,GAAY,EAAE,SAAA,EAAW,MAAA,CAAO,SAAA,EAAU,GAAI;AAAC,GAC1E;AACF;AAMO,SAAS,iBAAA,CACd,QAAA,EACA,KAAA,EACA,KAAA,EACM;AACN,EAAA,IAAI,QAAA,KAAa,IAAA,IAAQ,QAAA,CAAS,KAAA,KAAU,KAAA,EAAO;AACjD,IAAA,MAAM,IAAI,UAAA,CAAW,CAAA,oBAAA,EAAuB,KAAK,CAAA,CAAE,CAAA;AAAA,EACrD;AACF;;;AC5DA,IAAM,mBAAA,GAAsB,KAAA;AAerB,SAAS,YAAY,IAAA,EAA4B;AACtD,EAAA,MAAM,SAAA,GAAY,gBAAA,CAAiB,IAAA,EAAM,GAAG,CAAA;AAC5C,EAAA,MAAM,UAAA,GAAa,MAAM,UAAA,IAAc,mBAAA;AACvC,EAAA,MAAM,KAAA,uBAAY,GAAA,EAAyB;AAE3C,EAAA,MAAM,KAAA,GAAQ,CAAC,GAAA,KAAsB;AACnC,IAAA,KAAA,MAAW,CAAC,GAAA,EAAK,KAAK,CAAA,IAAK,KAAA,EAAO;AAChC,MAAA,IAAI,KAAA,CAAM,SAAA,KAAc,MAAA,IAAa,KAAA,CAAM,aAAa,GAAA,EAAK;AAC3D,QAAA,KAAA,CAAM,OAAO,GAAG,CAAA;AAAA,MAClB;AAAA,IACF;AAAA,EACF,CAAA;AAEA,EAAA,MAAM,KAAA,GAAe;AAAA,IACnB,MAAM,IAAI,KAAA,EAAqC;AAC7C,MAAA,MAAM,GAAA,GAAM,KAAK,GAAA,EAAI;AACrB,MAAA,KAAA,CAAM,GAAG,CAAA;AACT,MAAA,MAAM,GAAA,GAAM,UAAA,CAAW,KAAA,CAAM,UAAA,EAAY,MAAM,KAAK,CAAA;AACpD,MAAA,MAAM,WAAA,GAAc,KAAA,CAAM,GAAA,CAAI,GAAG,CAAA;AACjC,MAAA,IAAI,gBAAgB,MAAA,EAAW;AAC7B,QAAA,MAAM,WAAW,MAAM,YAAA,CAAa,SAAA,EAAW,WAAA,CAAY,KAAK,GAAG,CAAA;AACnE,QAAA,iBAAA,CAAkB,QAAA,EAAU,KAAA,CAAM,KAAA,EAAO,KAAA,CAAM,KAAK,CAAA;AACpD,QAAA,IAAI,aAAa,IAAA,EAAM;AAAA,MACzB;AACA,MAAA,MAAM,YAAY,KAAA,CAAM,SAAA,KAAc,aAAa,CAAA,GAAI,GAAA,GAAM,aAAa,GAAA,GAAO,MAAA,CAAA;AACjF,MAAA,MAAM,MAAM,MAAM,YAAA;AAAA,QAChB,SAAA;AAAA,QACA,EAAE,KAAA,EAAO,KAAA,CAAM,KAAA,EAAO,MAAA,EAAQ,MAAM,MAAA,EAAO;AAAA,QAC3C;AAAA,OACF;AACA,MAAA,KAAA,CAAM,IAAI,GAAA,EAAK;AAAA,QACb,GAAA;AAAA,QACA,GAAI,SAAA,KAAc,MAAA,GAAY,EAAE,SAAA,KAAc;AAAC,OAChD,CAAA;AAAA,IACH,CAAA;AAAA,IAEA,MAAM,GAAA,CAAI,UAAA,EAAoB,KAAA,EAA4C;AACxE,MAAA,MAAM,GAAA,GAAM,KAAK,GAAA,EAAI;AACrB,MAAA,KAAA,CAAM,GAAG,CAAA;AACT,MAAA,MAAM,QAAQ,KAAA,CAAM,GAAA,CAAI,UAAA,CAAW,UAAA,EAAY,KAAK,CAAC,CAAA;AACrD,MAAA,IAAI,KAAA,KAAU,QAAW,OAAO,IAAA;AAChC,MAAA,MAAM,UAAU,MAAM,YAAA,CAAa,SAAA,EAAW,KAAA,CAAM,KAAK,GAAG,CAAA;AAC5D,MAAA,IAAI,YAAY,IAAA,EAAM;AACpB,QAAA,KAAA,CAAM,MAAA,CAAO,UAAA,CAAW,UAAA,EAAY,KAAK,CAAC,CAAA;AAC1C,QAAA,OAAO,IAAA;AAAA,MACT;AACA,MAAA,OAAO,EAAE,KAAA,EAAO,OAAA,CAAQ,KAAA,EAAO,MAAA,EAAQ,QAAQ,MAAA,EAAO;AAAA,IACxD,CAAA;AAAA,IAEA,MAAM,MAAM,UAAA,EAAmC;AAC7C,MAAA,MAAM,MAAA,GAAS,eAAe,UAAU,CAAA,CAAA,CAAA;AACxC,MAAA,KAAA,MAAW,GAAA,IAAO,KAAA,CAAM,IAAA,EAAK,EAAG;AAC9B,QAAA,IAAI,IAAI,UAAA,CAAW,MAAM,CAAA,EAAG,KAAA,CAAM,OAAO,GAAG,CAAA;AAAA,MAC9C;AAAA,IACF;AAAA,GACF;AAEA,EAAA,gBAAA,CAAiB,OAAO,SAAS,CAAA;AACjC,EAAA,OAAO,KAAA;AACT;;;ACpEO,SAAS,WAAA,GAAyB;AACvC,EAAA,OAAO;AAAA,IACL,KAAK,KAAA,EAAyB;AAC5B,MAAA,UAAA,EAAW,EAAG,GAAA,CAAI,IAAA,CAAK,SAAA,CAAU,KAAK,CAAC,CAAA;AAAA,IACzC;AAAA,GACF;AACF;AAYO,SAAS,UAAU,MAAA,EAAgC;AACxD,EAAA,OAAO;AAAA,IACL,MAAM,KAAK,KAAA,EAAkC;AAC3C,MAAA,MAAM,OAAO,KAAA,CAAM,IAAA,CAAK,SAAA,CAAU,KAAK,IAAI,IAAI,CAAA;AAAA,IACjD;AAAA,GACF;AACF;;;AC9BA,IAAMC,oBAAAA,GAAsB,KAAA;AAYrB,SAAS,OAAA,CAAQ,IAAa,IAAA,EAA4B;AAC/D,EAAA,MAAM,SAAA,GAAY,gBAAA,CAAiB,IAAA,EAAM,GAAG,CAAA;AAC5C,EAAA,MAAM,UAAA,GAAa,MAAM,UAAA,IAAcA,oBAAAA;AAEvC,EAAA,MAAM,KAAA,GAAe;AAAA,IACnB,MAAM,IAAI,KAAA,EAAqC;AAC7C,MAAA,MAAM,GAAA,GAAM,UAAA,CAAW,KAAA,CAAM,UAAA,EAAY,MAAM,KAAK,CAAA;AACpD,MAAA,MAAM,WAAA,GAAc,MAAM,EAAA,CAAG,GAAA,CAAI,GAAG,CAAA;AACpC,MAAA,IAAI,gBAAgB,IAAA,EAAM;AACxB,QAAA,MAAM,QAAA,GAAW,MAAM,YAAA,CAAa,SAAA,EAAW,WAAW,CAAA;AAC1D,QAAA,iBAAA,CAAkB,QAAA,EAAU,KAAA,CAAM,KAAA,EAAO,KAAA,CAAM,KAAK,CAAA;AACpD,QAAA,IAAI,aAAa,IAAA,EAAM;AAAA,MACzB;AACA,MAAA,MAAM,GAAA,GAAM,KAAK,GAAA,EAAI;AACrB,MAAA,MAAM,YAAY,KAAA,CAAM,SAAA,KAAc,aAAa,CAAA,GAAI,GAAA,GAAM,aAAa,GAAA,GAAO,MAAA,CAAA;AACjF,MAAA,MAAM,MAAM,MAAM,YAAA;AAAA,QAChB,SAAA;AAAA,QACA,EAAE,KAAA,EAAO,KAAA,CAAM,KAAA,EAAO,MAAA,EAAQ,MAAM,MAAA,EAAO;AAAA,QAC3C;AAAA,OACF;AACA,MAAA,MAAM,OAAA,GACJ,cAAc,MAAA,GACV,EAAE,eAAe,IAAA,CAAK,GAAA,CAAI,GAAG,IAAA,CAAK,IAAA,CAAA,CAAM,YAAY,GAAA,IAAO,GAAI,CAAC,CAAA,EAAE,GAClE,aAAa,CAAA,GACX,EAAE,aAAA,EAAe,UAAA,EAAW,GAC5B,MAAA;AACR,MAAA,IAAI,YAAY,MAAA,EAAW;AACzB,QAAA,MAAM,EAAA,CAAG,GAAA,CAAI,GAAA,EAAK,GAAA,EAAK,OAAO,CAAA;AAAA,MAChC,CAAA,MAAO;AACL,QAAA,MAAM,EAAA,CAAG,GAAA,CAAI,GAAA,EAAK,GAAG,CAAA;AAAA,MACvB;AAAA,IACF,CAAA;AAAA,IAEA,MAAM,GAAA,CAAI,UAAA,EAAoB,KAAA,EAA4C;AACxE,MAAA,MAAM,MAAM,MAAM,EAAA,CAAG,IAAI,UAAA,CAAW,UAAA,EAAY,KAAK,CAAC,CAAA;AACtD,MAAA,IAAI,GAAA,KAAQ,MAAM,OAAO,IAAA;AACzB,MAAA,MAAM,OAAA,GAAU,MAAM,YAAA,CAAa,SAAA,EAAW,GAAG,CAAA;AACjD,MAAA,IAAI,YAAY,IAAA,EAAM;AACpB,QAAA,MAAM,EAAA,CAAG,MAAA,CAAO,UAAA,CAAW,UAAA,EAAY,KAAK,CAAC,CAAA;AAC7C,QAAA,OAAO,IAAA;AAAA,MACT;AACA,MAAA,OAAO,EAAE,KAAA,EAAO,OAAA,CAAQ,KAAA,EAAO,MAAA,EAAQ,QAAQ,MAAA,EAAO;AAAA,IACxD,CAAA;AAAA,IAEA,MAAM,MAAM,UAAA,EAAmC;AAGxC,IACP;AAAA,GACF;AAEA,EAAA,gBAAA,CAAiB,OAAO,SAAS,CAAA;AACjC,EAAA,OAAO,KAAA;AACT;;;AC3BA,SAAS,QAAQ,KAAA,EAA6C;AAC5D,EAAA,OAAO,OAAQ,MAAgB,GAAA,KAAQ,UAAA;AACzC;AAEA,SAAS,eAAe,KAAA,EAA6D;AACnF,EAAA,OAAO,OAAQ,MAAuB,IAAA,KAAS,UAAA;AACjD;AAEA,SAAS,gBAAA,CAAiB,OAA4B,IAAA,EAAoB;AACxE,EAAA,IAAI,OAAO,UAAU,QAAA,EAAU;AAC7B,IAAA,OAAO,KAAA,CAAM,KAAA,CAAM,IAAA,CAAK,KAAA,EAAO,KAAK,GAAG,CAAA;AAAA,EACzC;AACA,EAAA,MAAM,IAAA,GAAO,KAAK,IAAA,IAAQ,EAAA;AAC1B,EAAA,MAAM,IAAA,GAAO,kBAAA,CAAmB,KAAA,EAAO,IAAI,CAAA;AAC3C,EAAA,IAAI,IAAA,KAAS,MAAM,OAAO,EAAA;AAC1B,EAAA,OAAO,IAAA,CAAK,KAAA,CAAM,IAAA,CAAK,KAAA,EAAO,KAAK,GAAG,CAAA;AACxC;AAEA,SAAS,aAAa,OAAA,EAAmE;AACvF,EAAA,IAAI,OAAA,CAAQ,UAAU,MAAA,EAAW;AAC/B,IAAA,MAAMC,SAAQ,WAAA,EAAY;AAC1B,IAAA,OAAO,EAAE,OAAAA,MAAAA,EAAO,SAAA,EAAW,YAAYA,MAAK,CAAA,IAAK,kBAAiB,EAAE;AAAA,EACtE;AACA,EAAA,IAAI,OAAA,CAAQ,OAAA,CAAQ,KAAK,CAAA,EAAG;AAC1B,IAAA,MAAMA,SAAQ,OAAA,CAAQ,KAAA;AACtB,IAAA,OAAO,EAAE,OAAAA,MAAAA,EAAO,SAAA,EAAW,YAAYA,MAAK,CAAA,IAAK,kBAAiB,EAAE;AAAA,EACtE;AACA,EAAA,MAAM,KAAA,GAAQ,WAAA,CAAY,OAAA,CAAQ,KAAK,CAAA;AACvC,EAAA,OAAO,EAAE,KAAA,EAAO,SAAA,EAAW,WAAA,CAAY,KAAK,KAAK,gBAAA,CAAiB,OAAA,CAAQ,KAAA,CAAM,GAAG,CAAA,EAAE;AACvF;AAcO,SAAS,cAAA,CAAe,OAAA,GAA2B,EAAC,EAAa;AACtE,EAAA,MAAM,SAAS,qBAAA,CAAsB;AAAA,IACnC,GAAI,QAAQ,WAAA,KAAgB,MAAA,GAAY,EAAE,WAAA,EAAa,OAAA,CAAQ,WAAA,EAAY,GAAI,EAAC;AAAA,IAChF,GAAI,QAAQ,iBAAA,KAAsB,MAAA,GAC9B,EAAE,iBAAA,EAAmB,OAAA,CAAQ,iBAAA,EAAkB,GAC/C;AAAC,GACN,CAAA;AAED,EAAA,MAAM,EAAE,KAAA,EAAO,SAAA,EAAU,GAAI,aAAa,OAAO,CAAA;AACjD,EAAA,MAAM,KAAA,GAAQ,mBAAmB,OAAA,CAAQ,KAAA,EAAO,SAAS,EAAC,EAAG,QAAQ,UAAU,CAAA;AAE/E,EAAA,IAAI,QAAA,GAAkC,IAAA;AACtC,EAAA,IAAI,WAAA;AAEJ,EAAA,MAAM,iBAAiB,YAAqC;AAC1D,IAAA,IAAI,QAAA,KAAa,MAAM,OAAO,QAAA;AAC9B,IAAA,IAAI,GAAA;AACJ,IAAA,IAAI,OAAA,CAAQ,WAAW,MAAA,EAAW;AAChC,MAAA,GAAA,GAAM,aAAA,EAAc;AAAA,IACtB,CAAA,MAAA,IAAW,cAAA,CAAe,OAAA,CAAQ,MAAM,CAAA,EAAG;AACzC,MAAA,GAAA,GAAM,MAAM,OAAA,CAAQ,MAAA,CAAO,IAAA,EAAK;AAChC,MAAA,IAAI,OAAA,CAAQ,MAAA,CAAO,SAAA,KAAc,MAAA,IAAa,gBAAgB,MAAA,EAAW;AACvE,QAAA,WAAA,GAAc,OAAA,CAAQ,MAAA,CAAO,SAAA,CAAU,CAAC,IAAA,KAAS;AAC/C,UAAA,QAAA,GAAW,cAAc,IAAI,CAAA;AAAA,QAC/B,CAAC,CAAA;AAAA,MACH;AAAA,IACF,CAAA,MAAO;AACL,MAAA,GAAA,GAAM,OAAA,CAAQ,MAAA;AAAA,IAChB;AACA,IAAA,QAAA,GAAW,cAAc,GAAG,CAAA;AAC5B,IAAA,OAAO,QAAA;AAAA,EACT,CAAA;AAEA,EAAA,MAAM,KAAA,GAAQ,OACZ,KAAA,EACA,GAAA,EACAC,QAAAA,KAC4B;AAC5B,IAAA,MAAM,UAAA,GAAa,IAAI,UAAA,IAAc,SAAA;AACrC,IAAA,MAAM,QAAA,GAAW;AAAA,MACf,KAAA,EAAO,GAAA,CAAI,QAAA,CAAS,KAAA,IAAS,SAAA;AAAA,MAC7B,GAAI,GAAA,CAAI,QAAA,CAAS,MAAA,KAAW,MAAA,GAAY,EAAE,MAAA,EAAQ,GAAA,CAAI,QAAA,CAAS,MAAA,EAAO,GAAI;AAAC,KAC7E;AACA,IAAA,MAAM,MAAA,GAAS,MAAM,cAAA,EAAe;AACpC,IAAA,MAAM,KAAA,GAAQ,MAAA,CAAO,MAAA,CAAO,KAAK,CAAA;AACjC,IAAA,MAAM,QAAqB,EAAC;AAE5B,IAAA,KAAA,MAAW,QAAQ,KAAA,EAAO;AACxB,MAAA,MAAM,KAAA,GAAQ,gBAAA,CAAiB,KAAA,EAAO,IAAI,CAAA;AAC1C,MAAA,MAAM,WAAW,OAAA,CAAQ,MAAA,EAAQ,KAAK,MAAA,EAAQ,GAAA,CAAI,UAAU,QAAQ,CAAA;AACpE,MAAA,MAAM,WAAA,GAAc,MAAM,SAAA,CAAU,KAAK,CAAA;AACzC,MAAA,MAAM,QAAA,GAAqB;AAAA,QACzB,QAAQ,QAAA,CAAS,MAAA;AAAA,QACjB,QAAQ,IAAA,CAAK,MAAA;AAAA,QACb,UAAU,GAAA,CAAI,QAAA;AAAA,QACd,QAAA;AAAA,QACA,MAAM,QAAA,CAAS,IAAA;AAAA,QACf,IAAA,EAAM;AAAA,UACJ,IAAA,EAAM,KAAK,IAAA,IAAQ,EAAA;AAAA,UACnB,OAAO,IAAA,CAAK,KAAA;AAAA,UACZ,KAAK,IAAA,CAAK;AAAA,SACZ;AAAA,QACA;AAAA,OACF;AACA,MAAA,KAAA,CAAM,IAAA,CAAK;AAAA,QACT,IAAA;AAAA,QACA,QAAA;AAAA,QACA,KAAA;AAAA,QACA,GAAI,SAAS,MAAA,KAAW,MAAA,GAAY,EAAE,MAAA,EAAQ,QAAA,CAAS,MAAA,EAAO,GAAI;AAAC,OACpE,CAAA;AAAA,IACH;AAEA,IAAA,MAAM,SAASA,QAAAA,EAAS,MAAA;AACxB,IAAA,MAAM,YAAA,GAAe,MAAA,KAAW,MAAA,IAAa,OAAO,KAAA,KAAU,QAAA;AAE9D,IAAA,IAAI;AACF,MAAA,IAAI,YAAA,EAAc;AAChB,QAAA,MAAM,IAAA,GAAO,KAAA;AACb,QAAA,MAAM,OAAA,GAAU,oBAAA;AAAA,UACd,IAAA,CAAK,MAAA;AAAA,UACL,KAAA,CAAM,GAAA,CAAI,CAAC,CAAA,KAAM,EAAE,IAAI,CAAA;AAAA,UACvB,MAAA,CAAO,QAAA;AAAA,UACP,OAAO,KAAA,KAAU;AAAA,SACnB;AAGA,QAAA,IAAIA,QAAAA,EAAS,iBAAiB,MAAA,EAAQ;AACpC,UAAA,MAAM,MAAA,GAAS,MAAM,MAAA,CAAO,CAAC,MAAM,CAAA,CAAE,QAAA,CAAS,WAAW,OAAO,CAAA;AAChE,UAAA,IAAI,MAAA,CAAO,SAAS,CAAA,EAAG;AACrB,YAAA,MAAMH,UAAAA,GAAY,MAAA,CAAO,GAAA,CAAI,CAAC,CAAA,MAAO,EAAE,GAAG,CAAA,CAAE,QAAA,EAAU,MAAA,EAAQ,OAAA,EAAiB,CAAE,CAAA;AACjF,YAAA,MAAM,KAAA,GAAQA,WAAU,CAAC,CAAA;AACzB,YAAA,MAAM,IAAI,oBAAA;AAAA,cACR,CAAA,uBAAA,EAA0B,KAAA,CAAM,MAAM,CAAA,YAAA,EAAe,MAAM,IAAI,CAAA,CAAA,CAAA;AAAA,cAC/DA;AAAA,aACF;AAAA,UACF;AAAA,QACF;AAEA,QAAA,MAAM,OAAA,GAAU,MAAM,MAAA,CAAO,CAAC,MAAM,CAAA,CAAE,IAAA,CAAK,OAAO,OAAO,CAAA;AACzD,QAAA,MAAM,MAAA,GAAS,IAAA,CAAK,KAAA,CAAM,CAAA,EAAG,OAAO,CAAA;AACpC,QAAA,MAAM,SAAA,GAAY,IAAA,CAAK,KAAA,CAAM,OAAO,CAAA;AAEpC,QAAA,IAAI,MAAA,CAAO,WAAW,CAAA,EAAG;AACvB,UAAA,OAAO,EAAE,QAAQ,EAAA,EAAS,SAAA,EAAW,EAAC,EAAG,OAAA,EAAS,OAAO,SAAA,EAAU;AAAA,QACrE;AAEA,QAAA,MAAM,EAAE,QAAAI,OAAAA,EAAQ,SAAA,EAAAJ,YAAU,GAAI,MAAM,YAAA,CAAa,MAAA,EAAQ,OAAA,EAAS;AAAA,UAChE,KAAA;AAAA,UACA,SAAA;AAAA,UACA,UAAA;AAAA,UACA,GAAIG,UAAS,YAAA,KAAiB,KAAA,CAAA,GAAY,EAAE,YAAA,EAAcA,QAAAA,CAAQ,YAAA,EAAa,GAAI;AAAC,SACrF,CAAA;AACD,QAAA,KAAA,CAAM,IAAA,CAAK,OAAA,EAAS,UAAA,EAAYH,UAAS,CAAA;AACzC,QAAA,OAAO,EAAE,MAAA,EAAQI,OAAAA,EAAa,WAAAJ,UAAAA,EAAW,OAAA,EAAS,OAAO,SAAA,EAAU;AAAA,MACrE;AAEA,MAAA,MAAM,EAAE,MAAA,EAAQ,SAAA,KAAc,MAAM,YAAA,CAAa,OAAO,KAAA,EAAO;AAAA,QAC7D,KAAA;AAAA,QACA,SAAA;AAAA,QACA,UAAA;AAAA,QACA,GAAIG,UAAS,YAAA,KAAiB,KAAA,CAAA,GAAY,EAAE,YAAA,EAAcA,QAAAA,CAAQ,YAAA,EAAa,GAAI;AAAC,OACrF,CAAA;AACD,MAAA,KAAA,CAAM,IAAA,CAAK,OAAA,EAAS,UAAA,EAAY,SAAS,CAAA;AACzC,MAAA,OAAO,EAAE,MAAA,EAAQ,SAAA,EAAW,OAAA,EAAS,KAAA,EAAM;AAAA,IAC7C,SAAS,GAAA,EAAK;AACZ,MAAA,IAAI,eAAe,oBAAA,EAAsB;AACvC,QAAA,KAAA,CAAM,IAAA,CAAK,OAAA,EAAS,UAAA,EAAY,GAAA,CAAI,SAAS,CAAA;AAAA,MAC/C;AACA,MAAA,MAAM,GAAA;AAAA,IACR;AAAA,EACF,CAAA;AAEA,EAAA,MAAM,OAAA,GAAU,OACd,KAAA,EACA,GAAA,KAC4B;AAC5B,IAAA,MAAM,UAAA,GAAa,IAAI,UAAA,IAAc,SAAA;AACrC,IAAA,MAAM,QAAA,GAAW;AAAA,MACf,KAAA,EAAO,GAAA,CAAI,QAAA,CAAS,KAAA,IAAS,SAAA;AAAA,MAC7B,GAAI,GAAA,CAAI,QAAA,CAAS,MAAA,KAAW,MAAA,GAAY,EAAE,MAAA,EAAQ,GAAA,CAAI,QAAA,CAAS,MAAA,EAAO,GAAI;AAAC,KAC7E;AACA,IAAA,MAAM,EAAE,MAAA,EAAQ,SAAA,EAAU,GAAI,MAAM,aAAa,KAAA,EAAO;AAAA,MACtD,KAAA;AAAA,MACA,UAAA;AAAA,MACA,UAAU,GAAA,CAAI,QAAA;AAAA,MACd;AAAA,KACD,CAAA;AACD,IAAA,KAAA,CAAM,IAAA,CAAK,SAAA,EAAW,UAAA,EAAY,SAAS,CAAA;AAC3C,IAAA,OAAO,EAAE,MAAA,EAAQ,SAAA,EAAW,OAAA,EAAS,KAAA,EAAM;AAAA,EAC7C,CAAA;AAEA,EAAA,OAAO,EAAE,OAAO,OAAA,EAAQ;AAC1B;AAUO,SAAS,aAAa,GAAA,EAAqC;AAChE,EAAA,cAAA,CAAe,GAAG,CAAA;AAClB,EAAA,OAAO,GAAA;AACT;AAeO,SAAS,iBAAiB,UAAA,EAAoC;AACnE,EAAA,OAAO,UAAA;AACT;AAWO,SAAS,aAAa,GAAA,EAAmC;AAC9D,EAAA,OAAO,EAAE,IAAA,EAAM,MAAM,OAAA,CAAQ,OAAA,CAAQ,GAAG,CAAA,EAAE;AAC5C","file":"index.js","sourcesContent":["/**\n * Append a stable docs URL for the error code (docs/site/machine-readable.md §4).\n */\n\nconst DOCS_ERRORS_BASE = \"https://tailrace.dev/docs/reference/errors\";\n\nexport function withDocsUrl(code: string, message: string): string {\n const suffix = `→ ${DOCS_ERRORS_BASE}/${code}`;\n if (message.includes(suffix) || message.includes(`${DOCS_ERRORS_BASE}/${code}`)) {\n return message;\n }\n return `${message} ${suffix}`;\n}\n\nexport function docsUrlForCode(code: string): string {\n return `${DOCS_ERRORS_BASE}/${code}`;\n}\n","/**\n * Typed error taxonomy (docs/conventions.md §Error taxonomy).\n *\n * Every Tailrace error carries a stable string `code`. Error messages MUST NEVER\n * contain a detected value - only entity classes, rule paths, and hashes. This is\n * enforced by a test that greps thrown messages against fixture values.\n */\n\nimport type { Decision } from \"./types\";\nimport { withDocsUrl } from \"./errors-docs\";\n\n/** Base class for every error thrown by Tailrace. */\nexport class TailraceError extends Error {\n /** Stable, machine-readable error code. */\n readonly code: string;\n\n constructor(code: string, message: string) {\n super(withDocsUrl(code, message));\n this.name = new.target.name;\n this.code = code;\n // Restore prototype chain when targeting ES5-ish down-level output.\n Object.setPrototypeOf(this, new.target.prototype);\n }\n}\n\n/**\n * A `block` policy matched. Integrations translate this into their host framework's\n * native failure mode. Carries the decisions that triggered the block; never a value.\n */\nexport class PolicyViolationError extends TailraceError {\n readonly decisions: Decision[];\n\n constructor(message: string, decisions: Decision[]) {\n super(\"POLICY_VIOLATION\", message);\n this.decisions = decisions;\n }\n}\n\n/** A policy document failed schema validation. `path` points at the offending key. */\nexport class PolicyValidationError extends TailraceError {\n readonly path: string;\n\n constructor(message: string, path: string) {\n super(\"POLICY_INVALID\", message);\n this.path = path;\n }\n}\n\n/** An internal contract was breached, e.g. a restore requested at a non-egress boundary. */\nexport class InvariantViolationError extends TailraceError {\n constructor(message: string) {\n super(\"INVARIANT\", message);\n }\n}\n\n/** A vault adapter failed (storage, encryption, or lookup). */\nexport class VaultError extends TailraceError {\n constructor(message: string) {\n super(\"VAULT\", message);\n }\n}\n\n/** A recognizer threw while scanning. */\nexport class RecognizerError extends TailraceError {\n constructor(message: string) {\n super(\"RECOGNIZER\", message);\n }\n}\n\n/** A surface that is specified but not yet implemented in this milestone. */\nexport class NotImplementedError extends TailraceError {\n constructor(message: string) {\n super(\"NOT_IMPLEMENTED\", message);\n }\n}\n","/**\n * Public type surface for @tailrace/core.\n *\n * These types are the contract every integration builds against. They are specified\n * by docs/policy-engine.md, docs/detection.md, and docs/vault.md - those docs are\n * normative when a detail here is ambiguous.\n */\n\n/** What the policy engine decides to do with a detected span. */\nexport type Action = \"allow\" | \"mask\" | \"tokenize\" | \"block\" | \"review\" | \"detokenize\";\n\n/** Deterministic, Tier 0 secret classes. `block` on these cannot be relaxed to `allow`\n * without `dangerouslyAllowSecrets` (docs/policy-engine.md §3.3). */\nexport type SecretEntityClass =\n \"api_key\" | \"jwt\" | \"private_key\" | \"high_entropy_secret\" | \"connection_string\";\n\n/** Structured PII, detected deterministically in Tier 0. */\nexport type PiiEntityClass =\n \"email\" | \"phone\" | \"credit_card\" | \"iban\" | \"ssn\" | \"ip_address\" | \"url_credentials\";\n\n/** Free-text PII, detected by the optional Tier 1 NER recognizer. */\nexport type NerEntityClass = \"person\" | \"location\" | \"organization\";\n\n/**\n * Any entity class. The `string & {}` member keeps literal autocomplete for the known\n * classes while still admitting user-defined classes from custom recognizers.\n */\nexport type EntityClass =\n | SecretEntityClass\n | PiiEntityClass\n | NerEntityClass\n // `string & {}` preserves literal autocomplete for the known classes while still admitting\n // user-defined classes from custom recognizers.\n | (string & {});\n\n/** The set of secret classes, as a runtime value, for the secrets-cannot-be-allowed rule. */\nexport const SECRET_ENTITY_CLASSES: readonly SecretEntityClass[] = [\n \"api_key\",\n \"jwt\",\n \"private_key\",\n \"high_entropy_secret\",\n \"connection_string\",\n];\n\n/** Structured PII classes (Tier 0). */\nexport const PII_ENTITY_CLASSES: readonly PiiEntityClass[] = [\n \"email\",\n \"phone\",\n \"credit_card\",\n \"iban\",\n \"ssn\",\n \"ip_address\",\n \"url_credentials\",\n];\n\n/** Free-text PII classes (Tier 1 NER). */\nexport const NER_ENTITY_CLASSES: readonly NerEntityClass[] = [\"person\", \"location\", \"organization\"];\n\n/** A trust boundary a value is about to cross. */\nexport type Boundary =\n | { kind: \"model\"; provider: string }\n | { kind: \"tool\"; name: string; direction: \"in\" | \"out\" }\n | { kind: \"mcp\"; server: string; tool: string; direction: \"in\" | \"out\" }\n | { kind: \"telemetry\" }\n | { kind: \"egress\"; sink: string };\n\n/** Who is acting. `agent` is required (\"default\" if unset). */\nexport interface Identity {\n agent: string;\n claims?: Record<string, string | string[]>;\n}\n\n/** A detected region of the input. Offsets are UTF-16 code units. */\nexport interface Span {\n entity: EntityClass;\n /** Inclusive start offset (UTF-16 code units). */\n start: number;\n /** Exclusive end offset (UTF-16 code units). */\n end: number;\n /** 1.0 = validator-confirmed, 0.8 = pattern-only (docs/detection.md §1). */\n confidence: number;\n /** Id of the emitting recognizer. */\n recognizer: string;\n /** RFC 6901 JSON Pointer when the span came from an object leaf; absent for plain strings. */\n path?: string;\n}\n\n/** A detection engine. Tier 0 recognizers MUST be synchronous. */\nexport interface Recognizer {\n id: string;\n entities: EntityClass[];\n tier: 0 | 1 | 2;\n scan(text: string): Span[] | Promise<Span[]>;\n}\n\n/** One resolved policy outcome for one span. Never carries the raw value. */\nexport interface Decision {\n action: Action | \"restore_miss\";\n entity: EntityClass;\n boundary: Boundary;\n identity: Identity;\n /** Dotted path of the winning rule, e.g. `identities.support-agent.tools.crm.*`. */\n rule: string;\n /** JSON path + offsets, never the value. */\n span: { path: string; start: number; end: number };\n /** SHA-256 of the raw value, hex - for audit correlation only. */\n contentHash: string;\n /**\n * When {@link CheckOptions.applyBlockAs} remaps a `block` to another applied action,\n * the resolved policy action stays `block` and this records what was applied.\n */\n appliedAs?: \"mask\";\n}\n\n/**\n * Per-call options for {@link Tailrace.check}. Integration-only knobs; does not change\n * policy resolution (docs/policy-engine.md §5).\n */\nexport interface CheckOptions {\n /**\n * When policy resolves to `block`, apply this action instead of throwing.\n * Default: throw. Used by `@tailrace/ai-sdk` for `streamBlockBehavior: \"redact\"`.\n */\n applyBlockAs?: \"mask\";\n /**\n * Streaming hold-back (docs/vault.md §5). String inputs only.\n * Detects+resolves on the full input once; applies only spans fully within the safe\n * emit prefix; returns raw {@link CheckResult.remainder} to carry.\n */\n stream?: {\n /** Trailing chars that may still grow into a match. */\n holdback: number;\n /** When true, flush the entire buffer (no hold-back). */\n final?: boolean;\n };\n}\n\n/** A per-entity rule; either a bare action or an action with modifiers. */\nexport interface EntityRule {\n action: Action;\n /** Tokenization output shape (docs/vault.md §3). */\n format?: \"preserve\" | \"label\";\n /** Required to relax a secret class away from `block` (docs/policy-engine.md §3.3). */\n dangerouslyAllowSecrets?: boolean;\n}\n\nexport type EntityRuleValue = Action | EntityRule;\n\n/** A scope that maps entities and per-boundary overrides; reused at top level and per identity. */\nexport interface PolicyScope {\n entities?: Partial<Record<EntityClass, EntityRuleValue>>;\n boundaries?: Record<string, { entities?: Partial<Record<string, EntityRuleValue>> }>;\n}\n\n/** A full policy document (docs/policy-engine.md §2). */\nexport interface PolicyDocument extends PolicyScope {\n defaults?: { action?: Action };\n identities?: Record<string, PolicyScope>;\n /** Global escape hatch for the secrets-cannot-be-allowed rule. */\n dangerouslyAllowSecrets?: boolean;\n}\n\n/**\n * Where a policy comes from. v0.1 ships `staticPolicy`; a hosted plane can slot in later\n * without a core API change (docs/architecture.md §5).\n */\nexport interface PolicySource {\n load(): Promise<PolicyDocument>;\n subscribe?(cb: (p: PolicyDocument) => void): () => void;\n}\n\n/** A single stored token record. */\nexport interface VaultRecord {\n value: string;\n entity: EntityClass;\n}\n\nexport interface VaultPutInput {\n workflowId: string;\n token: string;\n entity: EntityClass;\n value: string;\n expiresAt?: number;\n}\n\n/** Reversible token storage (docs/vault.md §2). Values are stored encrypted at rest. */\nexport interface Vault {\n put(input: VaultPutInput): Promise<void>;\n get(workflowId: string, token: string): Promise<VaultRecord | null>;\n purge(workflowId: string): Promise<void>;\n}\n\n/** Minimal KV surface backing `kvVault`; structurally compatible with Cloudflare KV. */\nexport interface KvStore {\n get(key: string): Promise<string | null>;\n put(key: string, value: string, opts?: { expirationTtl?: number }): Promise<void>;\n delete(key: string): Promise<void>;\n}\n\n/** One audit record emitted per check/restore. */\nexport interface AuditEvent {\n type: \"check\" | \"restore\";\n workflowId: string;\n timestamp: number;\n decisions: Decision[];\n}\n\n/** A destination for audit events (console, JSONL, otel, custom). */\nexport interface AuditSink {\n emit(event: AuditEvent): void | Promise<void>;\n}\n\n/**\n * Line writer for {@link jsonlSink}. Callers supply filesystem or remote adapters;\n * core never touches the filesystem.\n */\nexport interface AuditWriter {\n write(line: string): void | Promise<void>;\n}\n\n/** Master-key and TTL options for the built-in vaults. */\nexport interface VaultOptions {\n /** Master key; falls back to `TAILRACE_VAULT_KEY`, then a random per-process key. */\n key?: string;\n /** Default token TTL in seconds (docs/vault.md §2). */\n ttlSeconds?: number;\n}\n\n/** Options for {@link createTailrace}. Every field has a sensible default. */\nexport interface TailraceOptions {\n policy?: PolicyDocument | PolicySource;\n recognizers?: Recognizer[];\n vault?: Vault | VaultOptions;\n audit?: { sinks?: AuditSink[] };\n /** Emit spans for private/reserved IP ranges (docs/detection.md §2). */\n includePrivateIps?: boolean;\n /** Notified with every decision, regardless of configured audit sinks. */\n onDecision?: (decisions: Decision[]) => void;\n}\n\nexport type JsonValue = string | number | boolean | null | JsonValue[] | { [k: string]: JsonValue };\nexport type JsonObject = { [k: string]: JsonValue };\n\nexport interface CheckContext {\n boundary: Boundary;\n identity: Identity;\n workflowId?: string;\n}\n\nexport interface CheckResult<T> {\n output: T;\n decisions: Decision[];\n blocked: false;\n /**\n * Raw suffix held back when {@link CheckOptions.stream} is set on a string input.\n * Absent for non-streaming checks.\n */\n remainder?: string;\n}\n\n/**\n * The core primitive every integration calls. Integrations construct the right\n * `Boundary`/`Identity` and translate errors; they contain no policy logic.\n */\nexport interface Tailrace {\n /**\n * Detect + resolve + apply. Throws {@link PolicyViolationError} on a `block`\n * unless {@link CheckOptions.applyBlockAs} remaps the block.\n */\n check<T extends string | JsonObject>(\n input: T,\n ctx: CheckContext,\n options?: CheckOptions,\n ): Promise<CheckResult<T>>;\n /** Restore tokens at a trusted `egress` boundary. Throws at any other boundary. */\n restore<T extends string | JsonObject>(input: T, ctx: CheckContext): Promise<CheckResult<T>>;\n}\n","/**\n * Boundary key encoding and glob matching for policy resolution.\n *\n * Encodings: model → provider; tool → `tool:{name}:{direction}`; mcp →\n * `mcp:{server}/{tool}`; telemetry → `telemetry`; egress → `egress:{sink}`.\n * Glob matching is kind-scoped (docs/policy-engine.md §3).\n */\n\nimport type { Boundary } from \"../types\";\n\nexport type BoundaryKind = Boundary[\"kind\"];\n\n/** Encode a {@link Boundary} as the string key used in policy `boundaries` maps. */\nexport function boundaryKey(boundary: Boundary): string {\n switch (boundary.kind) {\n case \"model\":\n return boundary.provider;\n case \"tool\":\n return `tool:${boundary.name}:${boundary.direction}`;\n case \"mcp\":\n return `mcp:${boundary.server}/${boundary.tool}`;\n case \"telemetry\":\n return \"telemetry\";\n case \"egress\":\n return `egress:${boundary.sink}`;\n }\n}\n\n/** True when a boundary pattern / key refers to an egress sink. */\nexport function isEgressBoundaryKey(key: string): boolean {\n return key === \"egress\" || key.startsWith(\"egress:\");\n}\n\n/**\n * Resolve the boundary kind for an encoded key or policy pattern.\n * Model keys are bare provider strings; tool/mcp/egress/telemetry use prefixed encodings.\n */\nexport function boundaryKindOf(keyOrPattern: string): BoundaryKind {\n if (keyOrPattern === \"telemetry\") return \"telemetry\";\n if (isEgressBoundaryKey(keyOrPattern)) return \"egress\";\n if (keyOrPattern.startsWith(\"tool:\")) return \"tool\";\n if (keyOrPattern.startsWith(\"mcp:\")) return \"mcp\";\n return \"model\";\n}\n\n/**\n * Glob match where `*` matches any remainder (including empty and `/`-containing).\n * Exact strings (no `*`) match only themselves.\n */\nexport function globMatch(pattern: string, key: string): boolean {\n if (!pattern.includes(\"*\")) return pattern === key;\n const parts = pattern.split(\"*\");\n if (parts.length === 1) return pattern === key;\n\n let pos = 0;\n for (let i = 0; i < parts.length; i++) {\n const part = parts[i]!;\n if (part.length === 0) {\n if (i === 0) continue;\n if (i === parts.length - 1) return true;\n continue;\n }\n if (i === 0) {\n if (!key.startsWith(part)) return false;\n pos = part.length;\n continue;\n }\n if (i === parts.length - 1) {\n return key.endsWith(part) && key.length - part.length >= pos;\n }\n const idx = key.indexOf(part, pos);\n if (idx === -1) return false;\n pos = idx + part.length;\n }\n return true;\n}\n\n/**\n * Return patterns that match `key`, ordered most-specific first:\n * exact > longer glob > shorter glob. Matching is kind-scoped: only patterns whose\n * {@link boundaryKindOf} equals the key's kind are considered (so `openai/*` cannot\n * match `tool:openai/foo:out`).\n */\nexport function matchBoundaryPatterns(key: string, patterns: readonly string[]): string[] {\n const kind = boundaryKindOf(key);\n const matched = patterns.filter((p) => boundaryKindOf(p) === kind && globMatch(p, key));\n matched.sort((a, b) => {\n const aGlob = a.includes(\"*\") ? 1 : 0;\n const bGlob = b.includes(\"*\") ? 1 : 0;\n if (aGlob !== bGlob) return aGlob - bGlob;\n return b.length - a.length;\n });\n return matched;\n}\n","/**\n * Policy resolution (docs/policy-engine.md §3). Pure and synchronous.\n */\n\nimport {\n NER_ENTITY_CLASSES,\n PII_ENTITY_CLASSES,\n SECRET_ENTITY_CLASSES,\n type Action,\n type Boundary,\n type EntityClass,\n type EntityRule,\n type Identity,\n} from \"../types\";\nimport { boundaryKey, matchBoundaryPatterns } from \"./boundary\";\nimport type { CompiledBoundary, CompiledIdentity, CompiledPolicy } from \"./compile\";\n\n/** Restrictiveness ranking for overlap collapse (docs/policy-engine.md §3.4). */\nexport const ACTION_RANK: Readonly<Record<Action, number>> = {\n block: 5,\n review: 4,\n tokenize: 3,\n detokenize: 3,\n mask: 2,\n allow: 1,\n};\n\nconst SECRET_SET: ReadonlySet<string> = new Set(SECRET_ENTITY_CLASSES);\nconst BLOCK_PII_SET: ReadonlySet<string> = new Set([...PII_ENTITY_CLASSES, ...NER_ENTITY_CLASSES]);\n\n/** Return the more restrictive of two actions. */\nexport function moreRestrictive(a: Action, b: Action): Action {\n return ACTION_RANK[a] >= ACTION_RANK[b] ? a : b;\n}\n\nexport interface ResolvedRule {\n action: Action;\n rule: string;\n format?: \"preserve\" | \"label\";\n dangerouslyAllowSecrets?: boolean;\n}\n\ninterface Candidate {\n rule: EntityRule;\n path: string;\n}\n\n// Locked: all PiiEntityClass + NerEntityClass (OPEN_QUESTIONS.md).\nfunction lookupEntity(\n entities: Map<string, EntityRule>,\n entity: EntityClass,\n pathPrefix: string,\n): Candidate | null {\n // Exact > block-pii > *\n const exact = entities.get(entity);\n if (exact !== undefined) return { rule: exact, path: `${pathPrefix}.${entity}` };\n if (BLOCK_PII_SET.has(entity)) {\n const blockPii = entities.get(\"block-pii\");\n if (blockPii !== undefined) return { rule: blockPii, path: `${pathPrefix}.block-pii` };\n }\n const star = entities.get(\"*\");\n if (star !== undefined) return { rule: star, path: `${pathPrefix}.*` };\n return null;\n}\n\nfunction findBoundaryCandidate(\n boundaries: CompiledBoundary[],\n patterns: string[],\n key: string,\n entity: EntityClass,\n pathPrefix: string,\n): Candidate | null {\n const matched = matchBoundaryPatterns(key, patterns);\n for (const pattern of matched) {\n const compiled = boundaries.find((b) => b.pattern === pattern);\n if (compiled === undefined) continue;\n const hit = lookupEntity(compiled.entities, entity, `${pathPrefix}.${pattern}.entities`);\n if (hit !== null) return hit;\n }\n return null;\n}\n\nfunction collectCandidates(\n policy: CompiledPolicy,\n entity: EntityClass,\n boundary: Boundary,\n identity: Identity,\n): Candidate[] {\n const key = boundaryKey(boundary);\n const agent = identity.agent || \"default\";\n const out: Candidate[] = [];\n\n const push = (c: Candidate | null): void => {\n if (c !== null) out.push(c);\n };\n\n const ident: CompiledIdentity | undefined = policy.identities.get(agent);\n if (ident !== undefined) {\n // a. identities[I].boundaries[B].entities[E]\n push(\n findBoundaryCandidate(\n ident.boundaries,\n ident.boundaryPatterns,\n key,\n entity,\n `identities.${agent}.boundaries`,\n ),\n );\n // b. identities[I].entities[E]\n push(lookupEntity(ident.entities, entity, `identities.${agent}.entities`));\n }\n\n // c. boundaries[B].entities[E]\n push(\n findBoundaryCandidate(policy.boundaries, policy.boundaryPatterns, key, entity, \"boundaries\"),\n );\n\n // d. entities[E]\n push(lookupEntity(policy.entities, entity, \"entities\"));\n\n // e. defaults.action\n out.push({\n rule: { action: policy.defaultsAction },\n path: \"defaults.action\",\n });\n\n return out;\n}\n\n/**\n * Resolve the action for one (entity × boundary × identity) triple.\n *\n * @example\n * ```ts\n * const { action, rule } = resolve(compiled, \"email\", boundary, { agent: \"default\" });\n * ```\n */\nexport function resolve(\n policy: CompiledPolicy,\n entity: EntityClass,\n boundary: Boundary,\n identity: Identity,\n): ResolvedRule {\n const candidates = collectCandidates(policy, entity, boundary, identity);\n const winning = candidates[0]!;\n let action = winning.rule.action;\n let path = winning.path;\n let format = winning.rule.format;\n let dangerouslyAllowSecrets = winning.rule.dangerouslyAllowSecrets === true;\n\n // Secrets-cannot-be-allowed: block at any level cannot be overridden to allow by a more\n // specific rule unless dangerouslyAllowSecrets is set on the winning rule or document.\n if (\n SECRET_SET.has(entity) &&\n action === \"allow\" &&\n !dangerouslyAllowSecrets &&\n !policy.dangerouslyAllowSecrets\n ) {\n for (const c of candidates) {\n if (c.rule.action === \"block\") {\n action = \"block\";\n path = c.path;\n format = c.rule.format;\n dangerouslyAllowSecrets = c.rule.dangerouslyAllowSecrets === true;\n break;\n }\n }\n }\n\n return {\n action,\n rule: path.replace(/^\\./, \"\"),\n ...(format !== undefined ? { format } : {}),\n ...(dangerouslyAllowSecrets ? { dangerouslyAllowSecrets: true } : {}),\n };\n}\n","/**\n * Edge-safe console access without relying on DOM lib typings.\n */\n\ninterface MinimalConsole {\n log: (...args: unknown[]) => void;\n warn: (...args: unknown[]) => void;\n}\n\nexport function getConsole(): MinimalConsole | undefined {\n // why: core tsconfig lib is ES2022 only (no DOM); console exists on Node/Workers/browsers\n const c = (globalThis as { console?: MinimalConsole }).console;\n return c;\n}\n","/**\n * Token-id alphabet shared by generation and restore scanning.\n *\n * BUG RISK (vault.md §1 vs §4): §1 says \"base32\" (RFC 4648 → [A-Z2-7]) but §4 scans\n * `<LABEL_[a-z0-9]{8}>` and the worked example `<EMAIL_a3f2k9qx>` contains a `9`.\n * RFC 4648 tokens would NEVER match the restore regex. We pin a custom lowercase\n * alphanumeric alphabet and build both the encoder and the scan regexes from it.\n */\n\n/** Custom token-id alphabet: lowercase a-z + digits 0-9 (matches vault.md §4 / example). */\nexport const TOKEN_ID_ALPHABET = \"abcdefghijklmnopqrstuvwxyz0123456789\";\n\n/** Fixed token-id length (vault.md §1 `[0..8]` → 8 chars). */\nexport const TOKEN_ID_LENGTH = 8;\n\n/**\n * Character class used in restore regexes. MUST describe exactly {@link TOKEN_ID_ALPHABET}.\n * Kept as a string literal so RegExp sources stay readable; asserted at module load.\n */\nexport const TOKEN_ID_CHAR_CLASS = \"[a-z0-9]\";\n\nfunction assertAlphabetMatchesCharClass(): void {\n if (TOKEN_ID_ALPHABET.length !== 36) {\n throw new Error(\"TOKEN_ID_ALPHABET must have 36 characters (a-z0-9)\");\n }\n const re = new RegExp(`^${TOKEN_ID_CHAR_CLASS}$`);\n for (const ch of TOKEN_ID_ALPHABET) {\n if (!re.test(ch)) {\n throw new Error(\n `TOKEN_ID_ALPHABET char \"${ch}\" is not matched by TOKEN_ID_CHAR_CLASS ${TOKEN_ID_CHAR_CLASS}`,\n );\n }\n }\n // Every char-class match must be in the alphabet (spot-check digits + letters).\n for (const ch of \"abcdefghijklmnopqrstuvwxyz0123456789\") {\n if (!TOKEN_ID_ALPHABET.includes(ch)) {\n throw new Error(`TOKEN_ID_ALPHABET missing char-class member \"${ch}\"`);\n }\n }\n}\n\nassertAlphabetMatchesCharClass();\n\n/**\n * Encode HMAC bytes as an 8-char token id using {@link TOKEN_ID_ALPHABET} (base-36).\n * Not RFC 4648 base32 - see module doc.\n */\nexport function bytesToTokenId(bytes: Uint8Array): string {\n // Interpret the first 8 bytes as a big-endian unsigned integer, then emit base-36 digits.\n let n = 0n;\n const take = Math.min(bytes.length, 8);\n for (let i = 0; i < take; i++) {\n n = (n << 8n) | BigInt(bytes[i]!);\n }\n const base = BigInt(TOKEN_ID_ALPHABET.length);\n let out = \"\";\n for (let i = 0; i < TOKEN_ID_LENGTH; i++) {\n out = TOKEN_ID_ALPHABET[Number(n % base)]! + out;\n n = n / base;\n }\n return out;\n}\n\n/** Entities that support `format: \"preserve\"` (vault.md §3). */\nexport const FORMAT_PRESERVE_ENTITIES: ReadonlySet<string> = new Set([\n \"email\",\n \"phone\",\n \"credit_card\",\n]);\n","/**\n * WebCrypto helpers for vault keying, HMAC token ids, and AES-256-GCM at rest.\n * No `node:crypto`, no `Buffer` - Uint8Array + globalThis.crypto only.\n */\n\nimport { getConsole } from \"../console\";\n\nconst textEncoder = new TextEncoder();\nconst textDecoder = new TextDecoder();\n\n/** Encode bytes as lowercase hex. */\nexport function bytesToHex(bytes: Uint8Array): string {\n let out = \"\";\n for (let i = 0; i < bytes.length; i++) {\n out += bytes[i]!.toString(16).padStart(2, \"0\");\n }\n return out;\n}\n\n/** Encode bytes as standard base64. */\nexport function bytesToBase64(bytes: Uint8Array): string {\n let binary = \"\";\n for (let i = 0; i < bytes.length; i++) {\n binary += String.fromCharCode(bytes[i]!);\n }\n return btoa(binary);\n}\n\n/** Decode standard base64 to bytes. */\nexport function base64ToBytes(b64: string): Uint8Array {\n const binary = atob(b64);\n const out = new Uint8Array(binary.length);\n for (let i = 0; i < binary.length; i++) {\n out[i] = binary.charCodeAt(i);\n }\n return out;\n}\n\nasync function importHmacKey(raw: Uint8Array) {\n return crypto.subtle.importKey(\"raw\", raw.slice(), { name: \"HMAC\", hash: \"SHA-256\" }, false, [\n \"sign\",\n ]);\n}\n\n/** HMAC-SHA256(key, message) → 32 bytes. */\nexport async function hmacSha256(key: Uint8Array, message: Uint8Array): Promise<Uint8Array> {\n const cryptoKey = await importHmacKey(key);\n const sig = await crypto.subtle.sign(\"HMAC\", cryptoKey, message.slice());\n return new Uint8Array(sig);\n}\n\n/** SHA-256 hex digest of a UTF-8 string. */\nexport async function sha256Hex(value: string): Promise<string> {\n const digest = await crypto.subtle.digest(\"SHA-256\", textEncoder.encode(value));\n return bytesToHex(new Uint8Array(digest));\n}\n\n/** Cryptographically random bytes. */\nexport function randomBytes(length: number): Uint8Array {\n const out = new Uint8Array(length);\n crypto.getRandomValues(out);\n return out;\n}\n\nasync function storageKeyMaterial(masterKey: Uint8Array) {\n const derived = await hmacSha256(masterKey, textEncoder.encode(\"storage\"));\n return crypto.subtle.importKey(\"raw\", derived.slice(), { name: \"AES-GCM\" }, false, [\n \"encrypt\",\n \"decrypt\",\n ]);\n}\n\n/**\n * Encrypt plaintext at rest: AES-256-GCM with key = HMAC(master, \"storage\").\n * Returns base64(iv || ciphertext+tag).\n */\nexport async function encryptAtRest(masterKey: Uint8Array, plaintext: string): Promise<string> {\n const key = await storageKeyMaterial(masterKey);\n const iv = randomBytes(12);\n const ct = await crypto.subtle.encrypt(\n { name: \"AES-GCM\", iv: iv.slice() },\n key,\n textEncoder.encode(plaintext),\n );\n const packed = new Uint8Array(iv.length + ct.byteLength);\n packed.set(iv, 0);\n packed.set(new Uint8Array(ct), iv.length);\n return bytesToBase64(packed);\n}\n\n/** Decrypt a value produced by {@link encryptAtRest}. */\nexport async function decryptAtRest(masterKey: Uint8Array, packedB64: string): Promise<string> {\n const packed = base64ToBytes(packedB64);\n if (packed.length < 13) {\n throw new Error(\"ciphertext too short\");\n }\n const iv = packed.subarray(0, 12);\n const ct = packed.subarray(12);\n const key = await storageKeyMaterial(masterKey);\n const pt = await crypto.subtle.decrypt({ name: \"AES-GCM\", iv: iv.slice() }, key, ct.slice());\n return textDecoder.decode(pt);\n}\n\nlet ephemeralMasterKey: Uint8Array | undefined;\nlet warnedEphemeral = false;\n\nfunction envVaultKey(): string | undefined {\n const g = globalThis as { process?: { env?: Record<string, string | undefined> } };\n return g.process?.env?.[\"TAILRACE_VAULT_KEY\"];\n}\n\n/**\n * Resolve the vault master key: explicit → TAILRACE_VAULT_KEY → ephemeral (with warn).\n */\nexport function resolveMasterKey(explicit?: string): Uint8Array {\n if (explicit !== undefined && explicit.length > 0) {\n return textEncoder.encode(explicit);\n }\n const fromEnv = envVaultKey();\n if (fromEnv !== undefined && fromEnv.length > 0) {\n return textEncoder.encode(fromEnv);\n }\n if (ephemeralMasterKey === undefined) {\n ephemeralMasterKey = randomBytes(32);\n if (!warnedEphemeral) {\n warnedEphemeral = true;\n getConsole()?.warn(\n \"[tailrace] No vault key configured; using ephemeral per-process key. Tokens will not survive restarts.\",\n );\n }\n }\n return ephemeralMasterKey;\n}\n","/**\n * Token derivation and format-preserving shapes (docs/vault.md §1, §3).\n */\n\nimport { getConsole } from \"../console\";\nimport type { EntityClass } from \"../types\";\nimport {\n bytesToTokenId,\n FORMAT_PRESERVE_ENTITIES,\n TOKEN_ID_CHAR_CLASS,\n TOKEN_ID_LENGTH,\n} from \"./alphabet\";\nimport { hmacSha256 } from \"./crypto\";\n\nconst textEncoder = new TextEncoder();\n\n/**\n * Label token scan: `<EMAIL_a3f2k9qx>`.\n * Token-id group is built from {@link TOKEN_ID_CHAR_CLASS} so it cannot drift from encoding.\n */\nexport const LABEL_RE = new RegExp(\n `<([A-Z][A-Z0-9_]*)_(${TOKEN_ID_CHAR_CLASS}{${TOKEN_ID_LENGTH}})>`,\n \"g\",\n);\n\n/** Format-preserving email: `{tokenId}@redacted.example`. */\nexport const FPE_EMAIL_RE = new RegExp(\n `\\\\b(${TOKEN_ID_CHAR_CLASS}{${TOKEN_ID_LENGTH}})@redacted\\\\.example\\\\b`,\n \"g\",\n);\n\n/** Format-preserving phone: `+1555` + 7 digits. */\nexport const FPE_PHONE_RE = /\\+1555(\\d{7})\\b/g;\n\n/**\n * Format-preserving card: starts with 9, digits with optional separators.\n * Narrow enough to avoid matching arbitrary numbers in prose.\n */\nexport const FPE_CARD_RE = /\\b(9(?:[\\d][\\s-]?){12,18}\\d)\\b/g;\n\n/** Normalize a raw value for deterministic token derivation. */\nexport function normalizeValue(entity: EntityClass, value: string): string {\n const trimmed = value.trim();\n if (entity === \"email\") return trimmed.toLowerCase();\n if (entity === \"phone\" || entity === \"credit_card\") return trimmed.replace(/\\D/g, \"\");\n return trimmed;\n}\n\n/** Uppercase entity label used inside `<LABEL_id>` tokens. */\nexport function entityLabel(entity: EntityClass): string {\n return entity.toUpperCase();\n}\n\n/** Build a label token from entity + 8-char token id. */\nexport function labelToken(entity: EntityClass, tokenId: string): string {\n return `<${entityLabel(entity)}_${tokenId}>`;\n}\n\n/** workflowKey = HMAC-SHA256(masterKey, workflowId). */\nexport async function deriveWorkflowKey(\n masterKey: Uint8Array,\n workflowId: string,\n): Promise<Uint8Array> {\n return hmacSha256(masterKey, textEncoder.encode(workflowId));\n}\n\n/**\n * tokenId = customBase36(HMAC-SHA256(workflowKey, entity || 0x00 || normalized))[0..8]\n * Alphabet is {@link TOKEN_ID_ALPHABET} (not RFC 4648) - see alphabet.ts.\n */\nexport async function deriveTokenId(\n workflowKey: Uint8Array,\n entity: EntityClass,\n normalizedValue: string,\n): Promise<string> {\n const entityBytes = textEncoder.encode(entity);\n const valueBytes = textEncoder.encode(normalizedValue);\n const msg = new Uint8Array(entityBytes.length + 1 + valueBytes.length);\n msg.set(entityBytes, 0);\n msg[entityBytes.length] = 0;\n msg.set(valueBytes, entityBytes.length + 1);\n const mac = await hmacSha256(workflowKey, msg);\n return bytesToTokenId(mac);\n}\n\nfunction tokenIdToDigits(tokenId: string, count: number): string {\n let out = \"\";\n let acc = 0;\n for (let i = 0; out.length < count; i++) {\n const c = tokenId.charCodeAt(i % tokenId.length);\n acc = (acc * 33 + c + i) >>> 0;\n out += String(acc % 10);\n }\n return out.slice(0, count);\n}\n\nfunction luhnCheckDigit(payloadWithoutCheck: string): number {\n let sum = 0;\n let alt = true;\n for (let i = payloadWithoutCheck.length - 1; i >= 0; i--) {\n let n = Number(payloadWithoutCheck[i]);\n if (alt) {\n n *= 2;\n if (n > 9) n -= 9;\n }\n sum += n;\n alt = !alt;\n }\n return (10 - (sum % 10)) % 10;\n}\n\nfunction formatPreserveCard(original: string, tokenId: string): string {\n const digits = original.replace(/\\D/g, \"\");\n const len = Math.max(digits.length, 13);\n const bodyLen = len - 1;\n let body = tokenIdToDigits(tokenId, bodyLen);\n body = \"9\" + body.slice(1);\n const check = luhnCheckDigit(body);\n const fake = body + String(check);\n\n // Re-apply original grouping (non-digit separators stay in place).\n let di = 0;\n let out = \"\";\n for (let i = 0; i < original.length; i++) {\n const ch = original[i]!;\n if (/\\d/.test(ch)) {\n out += fake[di] ?? \"0\";\n di++;\n } else {\n out += ch;\n }\n }\n while (di < fake.length) {\n out += fake[di]!;\n di++;\n }\n return out;\n}\n\n/**\n * Format a token for substitution. `preserve` for email/phone/credit_card;\n * everything else falls back to label form.\n *\n * Unsupported `format: \"preserve\"` should already have been warned at compilePolicy time;\n * this runtime fallback is a last resort if apply is called without compiling.\n */\nexport function formatToken(\n entity: EntityClass,\n tokenId: string,\n format: \"preserve\" | \"label\" | undefined,\n originalValue: string,\n): string {\n if (format === \"preserve\") {\n if (entity === \"email\") return `${tokenId}@redacted.example`;\n if (entity === \"phone\") return `+1555${tokenIdToDigits(tokenId, 7)}`;\n if (entity === \"credit_card\") return formatPreserveCard(originalValue, tokenId);\n getConsole()?.warn(\n `[tailrace] format: \"preserve\" is not supported for entity \"${entity}\"; falling back to label token`,\n );\n }\n return labelToken(entity, tokenId);\n}\n\n/** Mask replacement: `[EMAIL]`, `[API_KEY]`, etc. */\nexport function maskLabel(entity: EntityClass): string {\n return `[${entityLabel(entity)}]`;\n}\n\nexport { FORMAT_PRESERVE_ENTITIES };\n","/**\n * RFC 6901 JSON Pointer get/set for string leaves, used when applying actions to objects.\n */\n\nimport type { JsonObject, JsonValue } from \"../types\";\n\nfunction unescapePointer(token: string): string {\n return token.replace(/~1/g, \"/\").replace(/~0/g, \"~\");\n}\n\n/** Deep-clone a JSON-compatible value (structuredClone when available). */\nexport function cloneJson<T extends JsonValue>(value: T): T {\n if (typeof structuredClone === \"function\") {\n return structuredClone(value);\n }\n return JSON.parse(JSON.stringify(value)) as T;\n}\n\n/**\n * Read a string at an RFC 6901 pointer. Returns null if the path is missing or\n * does not point at a string.\n */\nexport function getStringAtPointer(root: JsonObject, pointer: string): string | null {\n if (pointer === \"\" || pointer === \"/\") {\n return null;\n }\n const parts = pointer.startsWith(\"/\") ? pointer.slice(1).split(\"/\") : pointer.split(\"/\");\n let cur: JsonValue = root;\n for (const raw of parts) {\n const key = unescapePointer(raw);\n if (cur === null || typeof cur !== \"object\") return null;\n if (Array.isArray(cur)) {\n const idx = Number(key);\n if (!Number.isInteger(idx) || idx < 0 || idx >= cur.length) return null;\n cur = cur[idx]!;\n } else {\n if (!(key in cur)) return null;\n cur = (cur as JsonObject)[key]!;\n }\n }\n return typeof cur === \"string\" ? cur : null;\n}\n\n/**\n * Replace the string at an RFC 6901 pointer. Mutates `root` in place.\n * No-op if the path does not point at a string.\n */\nexport function setStringAtPointer(root: JsonObject, pointer: string, value: string): void {\n if (pointer === \"\" || pointer === \"/\") return;\n const parts = pointer.startsWith(\"/\") ? pointer.slice(1).split(\"/\") : pointer.split(\"/\");\n let cur: JsonValue = root;\n for (let i = 0; i < parts.length - 1; i++) {\n const key = unescapePointer(parts[i]!);\n if (cur === null || typeof cur !== \"object\") return;\n if (Array.isArray(cur)) {\n const idx = Number(key);\n cur = cur[idx]!;\n } else {\n cur = (cur as JsonObject)[key]!;\n }\n }\n const last = unescapePointer(parts[parts.length - 1]!);\n if (cur === null || typeof cur !== \"object\") return;\n if (Array.isArray(cur)) {\n const idx = Number(last);\n if (Number.isInteger(idx) && idx >= 0 && idx < cur.length && typeof cur[idx] === \"string\") {\n cur[idx] = value;\n }\n } else if (typeof (cur as JsonObject)[last] === \"string\") {\n (cur as JsonObject)[last] = value;\n }\n}\n","/**\n * Apply resolved policy actions to string / JSON inputs.\n */\n\nimport { PolicyViolationError } from \"../errors\";\nimport { moreRestrictive } from \"../policy/resolve\";\nimport type { Action, Decision, JsonObject, Span, Vault } from \"../types\";\nimport {\n deriveTokenId,\n deriveWorkflowKey,\n formatToken,\n maskLabel,\n normalizeValue,\n} from \"../vault/token\";\nimport { cloneJson, getStringAtPointer, setStringAtPointer } from \"./pointer\";\n\nexport interface ApplyItem {\n span: Span;\n decision: Decision;\n /** Raw detected substring. */\n value: string;\n format?: \"preserve\" | \"label\";\n}\n\nexport interface ApplyContext {\n vault: Vault;\n masterKey: Uint8Array;\n workflowId: string;\n /** When set, `block` actions are applied as this instead of throwing. */\n applyBlockAs?: \"mask\";\n}\n\ninterface CollapsedItem extends ApplyItem {\n action: Action;\n}\n\n/**\n * When spans overlap, keep the most restrictive action (docs/policy-engine.md §3.4).\n * Items are assumed to share the same path (or be plain-string spans).\n */\nexport function collapseOverlaps(items: ApplyItem[]): CollapsedItem[] {\n if (items.length === 0) return [];\n\n const byPath = new Map<string, ApplyItem[]>();\n for (const item of items) {\n const path = item.span.path ?? \"\";\n const list = byPath.get(path) ?? [];\n list.push(item);\n byPath.set(path, list);\n }\n\n const out: CollapsedItem[] = [];\n for (const group of byPath.values()) {\n const sorted = [...group].sort(\n (a, b) => a.span.start - b.span.start || b.span.end - a.span.end,\n );\n const kept: CollapsedItem[] = [];\n for (const item of sorted) {\n const action = item.decision.action;\n if (action === \"restore_miss\") continue;\n const asAction = action as Action;\n let overlaps = false;\n for (let i = 0; i < kept.length; i++) {\n const other = kept[i]!;\n if (item.span.start < other.span.end && item.span.end > other.span.start) {\n overlaps = true;\n const winner = moreRestrictive(asAction, other.action);\n if (winner === asAction && asAction !== other.action) {\n kept[i] = { ...item, action: asAction };\n } else if (winner !== other.action) {\n kept[i] = { ...other, action: winner };\n }\n break;\n }\n }\n if (!overlaps) kept.push({ ...item, action: asAction });\n }\n out.push(...kept);\n }\n return out;\n}\n\nfunction extractValue(input: string | JsonObject, span: Span): string {\n if (typeof input === \"string\") {\n return input.slice(span.start, span.end);\n }\n const path = span.path ?? \"\";\n const leaf = getStringAtPointer(input, path);\n if (leaf === null) return \"\";\n return leaf.slice(span.start, span.end);\n}\n\nfunction replaceInString(text: string, start: number, end: number, replacement: string): string {\n return text.slice(0, start) + replacement + text.slice(end);\n}\n\n/**\n * Apply actions right-to-left. Throws {@link PolicyViolationError} on `block`\n * unless {@link ApplyContext.applyBlockAs} remaps the block.\n */\nexport async function applyActions<T extends string | JsonObject>(\n input: T,\n items: ApplyItem[],\n ctx: ApplyContext,\n): Promise<{ output: T; decisions: Decision[] }> {\n const collapsed = collapseOverlaps(items);\n\n const blocks = collapsed.filter((i) => i.action === \"block\");\n if (blocks.length > 0 && ctx.applyBlockAs !== \"mask\") {\n const decisions = blocks.map((b) => ({ ...b.decision, action: \"block\" as const }));\n const first = decisions[0]!;\n throw new PolicyViolationError(\n `policy blocked entity \"${first.entity}\" via rule \"${first.rule}\"`,\n decisions,\n );\n }\n\n // review should have been rejected at validate time; treat as block-level failure if seen\n const reviews = collapsed.filter((i) => i.action === \"review\");\n if (reviews.length > 0) {\n throw new PolicyViolationError(\n `policy review is not implemented (rule \"${reviews[0]!.decision.rule}\")`,\n reviews.map((r) => r.decision),\n );\n }\n\n const workflowKey = await deriveWorkflowKey(ctx.masterKey, ctx.workflowId);\n let output: string | JsonObject = typeof input === \"string\" ? input : cloneJson(input);\n\n // Group by path for object leaves; apply right-to-left within each leaf.\n const byPath = new Map<string, CollapsedItem[]>();\n for (const item of collapsed) {\n const path = item.span.path ?? \"\";\n const list = byPath.get(path) ?? [];\n list.push(item);\n byPath.set(path, list);\n }\n\n const decisions: Decision[] = [];\n\n for (const [path, group] of byPath) {\n group.sort((a, b) => b.span.start - a.span.start);\n\n let leaf: string;\n if (typeof output === \"string\") {\n leaf = output;\n } else {\n leaf = getStringAtPointer(output, path) ?? \"\";\n }\n\n for (const item of group) {\n const resolvedAction = item.action;\n // Integration remapping: policy still resolved to block; apply as mask.\n const action: Action =\n resolvedAction === \"block\" && ctx.applyBlockAs === \"mask\" ? \"mask\" : resolvedAction;\n const value = item.value || extractValue(input, item.span);\n let replacement = value;\n\n if (action === \"mask\") {\n replacement = maskLabel(item.span.entity);\n } else if (action === \"tokenize\") {\n const normalized = normalizeValue(item.span.entity, value);\n const tokenId = await deriveTokenId(workflowKey, item.span.entity, normalized);\n const token = formatToken(item.span.entity, tokenId, item.format, value);\n await ctx.vault.put({\n workflowId: ctx.workflowId,\n token,\n entity: item.span.entity,\n value,\n });\n replacement = token;\n } else if (action === \"allow\" || action === \"detokenize\") {\n replacement = value;\n }\n\n leaf = replaceInString(leaf, item.span.start, item.span.end, replacement);\n const decision: Decision =\n resolvedAction === \"block\" && ctx.applyBlockAs === \"mask\"\n ? { ...item.decision, action: \"block\", appliedAs: \"mask\" }\n : item.decision;\n decisions.push(decision);\n }\n\n if (typeof output === \"string\") {\n output = leaf;\n } else {\n setStringAtPointer(output, path, leaf);\n }\n }\n\n // Preserve original decision order (by span start) for audit stability.\n decisions.sort((a, b) => a.span.start - b.span.start || a.span.path.localeCompare(b.span.path));\n\n return { output: output as T, decisions };\n}\n","/**\n * Detokenization at trusted egress boundaries (docs/vault.md §4).\n */\n\nimport { InvariantViolationError } from \"../errors\";\nimport { isEgressBoundaryKey, boundaryKey } from \"../policy/boundary\";\nimport type { Boundary, Decision, EntityClass, Identity, JsonObject, Vault } from \"../types\";\nimport { sha256Hex } from \"../vault/crypto\";\nimport { FPE_CARD_RE, FPE_EMAIL_RE, FPE_PHONE_RE, LABEL_RE } from \"../vault/token\";\nimport { cloneJson, getStringAtPointer, setStringAtPointer } from \"./pointer\";\n\nexport interface RestoreContext {\n vault: Vault;\n workflowId: string;\n boundary: Boundary;\n identity: Identity;\n}\n\ninterface TokenHit {\n start: number;\n end: number;\n token: string;\n entity: EntityClass;\n path: string;\n}\n\nfunction findTokensInLeaf(leaf: string, path: string): TokenHit[] {\n const hits: TokenHit[] = [];\n\n LABEL_RE.lastIndex = 0;\n for (const m of leaf.matchAll(LABEL_RE)) {\n const full = m[0]!;\n const label = m[1]!;\n const idx = m.index ?? 0;\n hits.push({\n start: idx,\n end: idx + full.length,\n token: full,\n entity: label.toLowerCase() as EntityClass,\n path,\n });\n }\n\n FPE_EMAIL_RE.lastIndex = 0;\n for (const m of leaf.matchAll(FPE_EMAIL_RE)) {\n const full = m[0]!;\n const idx = m.index ?? 0;\n hits.push({\n start: idx,\n end: idx + full.length,\n token: full,\n entity: \"email\",\n path,\n });\n }\n\n FPE_PHONE_RE.lastIndex = 0;\n for (const m of leaf.matchAll(FPE_PHONE_RE)) {\n const full = m[0]!;\n const idx = m.index ?? 0;\n hits.push({\n start: idx,\n end: idx + full.length,\n token: full,\n entity: \"phone\",\n path,\n });\n }\n\n FPE_CARD_RE.lastIndex = 0;\n for (const m of leaf.matchAll(FPE_CARD_RE)) {\n const full = m[0]!;\n const idx = m.index ?? 0;\n hits.push({\n start: idx,\n end: idx + full.length,\n token: full,\n entity: \"credit_card\",\n path,\n });\n }\n\n // Deduplicate overlapping hits preferring label tokens (more specific).\n hits.sort((a, b) => a.start - b.start || b.end - a.end);\n const deduped: TokenHit[] = [];\n for (const hit of hits) {\n const overlap = deduped.some((d) => hit.start < d.end && hit.end > d.start);\n if (!overlap) deduped.push(hit);\n }\n return deduped;\n}\n\nfunction collectLeaves(input: string | JsonObject): Array<{ path: string; text: string }> {\n if (typeof input === \"string\") {\n return [{ path: \"\", text: input }];\n }\n const out: Array<{ path: string; text: string }> = [];\n const walk = (value: unknown, path: string): void => {\n if (typeof value === \"string\") {\n out.push({ path, text: value });\n return;\n }\n if (value === null || typeof value !== \"object\") return;\n if (Array.isArray(value)) {\n for (let i = 0; i < value.length; i++) walk(value[i], `${path}/${i}`);\n return;\n }\n for (const [k, v] of Object.entries(value as JsonObject)) {\n const esc = k.replace(/~/g, \"~0\").replace(/\\//g, \"~1\");\n walk(v, `${path}/${esc}`);\n }\n };\n walk(input, \"\");\n return out;\n}\n\n/**\n * Restore vault tokens in `input`. Throws {@link InvariantViolationError} when the\n * boundary is not egress - detokenize never happens elsewhere.\n */\nexport async function restoreInput<T extends string | JsonObject>(\n input: T,\n ctx: RestoreContext,\n): Promise<{ output: T; decisions: Decision[] }> {\n const key = boundaryKey(ctx.boundary);\n if (!isEgressBoundaryKey(key) || ctx.boundary.kind !== \"egress\") {\n throw new InvariantViolationError(\"restore is only allowed at egress boundaries\");\n }\n\n let output: string | JsonObject = typeof input === \"string\" ? input : cloneJson(input);\n const decisions: Decision[] = [];\n const leaves = collectLeaves(input);\n\n for (const leaf of leaves) {\n const hits = findTokensInLeaf(leaf.text, leaf.path);\n // Right-to-left by offset.\n hits.sort((a, b) => b.start - a.start);\n\n let text =\n typeof output === \"string\" ? output : (getStringAtPointer(output, leaf.path) ?? leaf.text);\n\n for (const hit of hits) {\n const record = await ctx.vault.get(ctx.workflowId, hit.token);\n const contentHash = await sha256Hex(hit.token);\n if (record === null) {\n decisions.push({\n action: \"restore_miss\",\n entity: hit.entity,\n boundary: ctx.boundary,\n identity: ctx.identity,\n rule: \"restore\",\n span: { path: hit.path, start: hit.start, end: hit.end },\n contentHash,\n });\n continue;\n }\n text = text.slice(0, hit.start) + record.value + text.slice(hit.end);\n decisions.push({\n action: \"detokenize\",\n entity: record.entity,\n boundary: ctx.boundary,\n identity: ctx.identity,\n rule: \"restore\",\n span: { path: hit.path, start: hit.start, end: hit.end },\n contentHash,\n });\n }\n\n if (typeof output === \"string\") {\n output = text;\n } else {\n setStringAtPointer(output, leaf.path, text);\n }\n }\n\n decisions.sort((a, b) => a.span.start - b.span.start || a.span.path.localeCompare(b.span.path));\n return { output: output as T, decisions };\n}\n","/**\n * Streaming emit cut (docs/vault.md §5).\n *\n * Hold back a trailing window that might still grow into a match, and never bisect a\n * span that already reaches into that window - pull the cut back to the span start.\n */\n\nexport function computeStreamEmitEnd(\n length: number,\n spans: ReadonlyArray<{ start: number; end: number }>,\n holdback: number,\n final: boolean,\n): number {\n if (final) return length;\n if (length <= holdback) return 0;\n\n let cut = length - holdback;\n for (const span of spans) {\n // Detected span straddles the tentative cut: keep the whole span in carry.\n if (span.start < cut && span.end > cut) {\n cut = Math.min(cut, span.start);\n }\n }\n return Math.max(0, cut);\n}\n","/**\n * Fire-and-forget audit emitter. Never throws into the request path (prime directive 4:\n * fail open for availability). Each sink.emit is isolated - a throwing or rejecting sink\n * cannot crash check/restore.\n */\n\nimport { getConsole } from \"../console\";\nimport type { AuditEvent, AuditSink, Decision } from \"../types\";\n\nexport interface AuditEmitter {\n emit(type: \"check\" | \"restore\", workflowId: string, decisions: Decision[]): void;\n}\n\nfunction warnSinkFailure(err: unknown): void {\n const message = err instanceof Error ? err.message : String(err);\n getConsole()?.warn(`[tailrace] audit sink failed (swallowed): ${message}`);\n}\n\n/**\n * Create an audit emitter that fans out to sinks and an optional onDecision hook.\n */\nexport function createAuditEmitter(\n sinks: AuditSink[] = [],\n onDecision?: (decisions: Decision[]) => void,\n): AuditEmitter {\n return {\n emit(type, workflowId, decisions): void {\n if (onDecision !== undefined) {\n try {\n onDecision(decisions);\n } catch (err) {\n warnSinkFailure(err);\n }\n }\n if (sinks.length === 0) return;\n const event: AuditEvent = {\n type,\n workflowId,\n timestamp: Date.now(),\n decisions,\n };\n for (const sink of sinks) {\n try {\n const result = sink.emit(event);\n if (result !== undefined && typeof (result as Promise<void>).then === \"function\") {\n void (result as Promise<void>).catch((err: unknown) => {\n warnSinkFailure(err);\n });\n }\n } catch (err) {\n warnSinkFailure(err);\n }\n }\n },\n };\n}\n","/**\n * Span merging (docs/detection.md §4). Operates on spans from a single coordinate space\n * (one string / one object leaf): the engine merges each leaf's spans before attaching a path.\n */\n\nimport type { EntityClass, Span } from \"../types\";\n\nexport interface MergeOptions {\n /** Per-entity minimum confidence. Entities not listed use `defaultThreshold`. */\n thresholds?: Partial<Record<EntityClass, number>>;\n /** Default minimum confidence (docs/detection.md §4). */\n defaultThreshold?: number;\n}\n\nconst DEFAULT_THRESHOLD = 0.6;\n\n/**\n * 1. Drop spans below their per-entity confidence threshold.\n * 2. Union overlapping spans of the same entity.\n * 3. Keep overlapping spans of different entities (policy applies most-restrictive later).\n * 4. Return sorted by `start` ascending (rewriting applies right-to-left).\n */\nexport function mergeSpans(spans: readonly Span[], opts: MergeOptions = {}): Span[] {\n const defaultThreshold = opts.defaultThreshold ?? DEFAULT_THRESHOLD;\n const thresholds = opts.thresholds ?? {};\n const thresholdFor = (entity: EntityClass): number => thresholds[entity] ?? defaultThreshold;\n\n const byEntity = new Map<EntityClass, Span[]>();\n for (const span of spans) {\n if (span.confidence < thresholdFor(span.entity)) continue;\n const group = byEntity.get(span.entity);\n if (group) group.push(span);\n else byEntity.set(span.entity, [span]);\n }\n\n const out: Span[] = [];\n for (const group of byEntity.values()) {\n group.sort((a, b) => a.start - b.start || a.end - b.end);\n let current = group[0]!;\n for (let i = 1; i < group.length; i++) {\n const span = group[i]!;\n if (span.start < current.end) {\n // Overlap, same entity -> union (widen span, keep the higher confidence).\n current = {\n ...current,\n end: Math.max(current.end, span.end),\n confidence: Math.max(current.confidence, span.confidence),\n };\n } else {\n out.push(current);\n current = span;\n }\n }\n out.push(current);\n }\n\n out.sort((a, b) => a.start - b.start || a.end - b.end);\n return out;\n}\n","/**\n * Object scanning (docs/detection.md §5). Walks the string leaves of a JSON object, scans\n * each with `scanLeaf`, and tags the resulting spans with an RFC 6901 JSON Pointer. Keys are\n * scanned too (a secret can be a key). Non-string leaves are ignored. Depth-limited and\n * cycle-safe.\n */\n\nimport type { JsonObject, JsonValue, Span } from \"../types\";\n\nconst DEFAULT_MAX_DEPTH = 32;\n\n/** Escape a property name for use in an RFC 6901 JSON Pointer. */\nfunction escapePointer(key: string): string {\n return key.replace(/~/g, \"~0\").replace(/\\//g, \"~1\");\n}\n\n/**\n * @param scanLeaf scans a single string and returns spans with offsets relative to that\n * string (no `path`); this function attaches the path.\n */\nexport function scanObject(\n input: JsonObject,\n scanLeaf: (text: string) => Span[],\n maxDepth: number = DEFAULT_MAX_DEPTH,\n): Span[] {\n const out: Span[] = [];\n const seen = new WeakSet<object>();\n\n const walk = (value: JsonValue, path: string, depth: number): void => {\n if (typeof value === \"string\") {\n for (const span of scanLeaf(value)) out.push({ ...span, path });\n return;\n }\n if (value === null || typeof value !== \"object\") return; // numbers, booleans ignored\n if (seen.has(value)) return; // cycle guard\n if (depth >= maxDepth) return;\n seen.add(value);\n\n if (Array.isArray(value)) {\n for (let i = 0; i < value.length; i++) {\n walk(value[i]!, `${path}/${i}`, depth + 1);\n }\n } else {\n for (const [key, child] of Object.entries(value)) {\n const childPath = `${path}/${escapePointer(key)}`;\n for (const span of scanLeaf(key)) out.push({ ...span, path: childPath });\n walk(child, childPath, depth + 1);\n }\n }\n };\n\n walk(input, \"\", 0);\n return out;\n}\n","/**\n * Shared, dependency-free primitives for Tier 0 recognizers: entropy, charset checks,\n * and the validators that upgrade a pattern match to confidence 1.0 (docs/detection.md §2).\n *\n * Everything here is synchronous and edge-safe (no `node:` imports, no `Buffer`).\n */\n\n/** Shannon entropy of `s` in bits per character (0 for the empty string). */\nexport function shannonEntropy(s: string): number {\n if (s.length === 0) return 0;\n const counts = new Map<string, number>();\n for (let i = 0; i < s.length; i++) {\n const ch = s[i] as string;\n counts.set(ch, (counts.get(ch) ?? 0) + 1);\n }\n let entropy = 0;\n for (const c of counts.values()) {\n const p = c / s.length;\n entropy -= p * Math.log2(p);\n }\n return entropy;\n}\n\n/**\n * True when `s` spans a base62-or-richer alphabet: it contains a lowercase letter, an\n * uppercase letter, and a digit. Used to gate `high_entropy_secret` so lowercase-hex\n * hashes and all-caps identifiers don't qualify (docs/detection.md §2).\n */\nexport function hasBase62Charset(s: string): boolean {\n let lower = false;\n let upper = false;\n let digit = false;\n for (let i = 0; i < s.length; i++) {\n const code = s.charCodeAt(i);\n if (code >= 97 && code <= 122) lower = true;\n else if (code >= 65 && code <= 90) upper = true;\n else if (code >= 48 && code <= 57) digit = true;\n }\n return lower && upper && digit;\n}\n\n/** Luhn checksum validation over a digits-only string. */\nexport function luhnValid(digits: string): boolean {\n if (digits.length === 0) return false;\n let sum = 0;\n let double = false;\n for (let i = digits.length - 1; i >= 0; i--) {\n let d = digits.charCodeAt(i) - 48;\n if (d < 0 || d > 9) return false;\n if (double) {\n d *= 2;\n if (d > 9) d -= 9;\n }\n sum += d;\n double = !double;\n }\n return sum % 10 === 0;\n}\n\n/** IBAN mod-97 validation (ISO 13616). Input may contain spaces. */\nexport function ibanValid(iban: string): boolean {\n const compact = iban.replace(/\\s+/g, \"\").toUpperCase();\n if (!/^[A-Z]{2}[0-9]{2}[A-Z0-9]{10,30}$/.test(compact)) return false;\n const rearranged = compact.slice(4) + compact.slice(0, 4);\n let remainder = 0;\n for (let i = 0; i < rearranged.length; i++) {\n const code = rearranged.charCodeAt(i);\n // A-Z -> 10-35, 0-9 -> themselves.\n const chunk = code >= 65 ? (code - 55).toString() : String.fromCharCode(code);\n for (let j = 0; j < chunk.length; j++) {\n remainder = (remainder * 10 + (chunk.charCodeAt(j) - 48)) % 97;\n }\n }\n return remainder === 1;\n}\n\n/** Decode a base64url JWT segment to a parsed object, or null if it isn't valid JSON. */\nexport function decodeBase64UrlJson(segment: string): Record<string, unknown> | null {\n try {\n const b64 = segment.replace(/-/g, \"+\").replace(/_/g, \"/\");\n const pad = b64.length % 4 === 0 ? \"\" : \"=\".repeat(4 - (b64.length % 4));\n const json = atob(b64 + pad);\n const parsed: unknown = JSON.parse(json);\n if (typeof parsed !== \"object\" || parsed === null || Array.isArray(parsed)) return null;\n return parsed as Record<string, unknown>;\n } catch {\n return null;\n }\n}\n\n/** True when a decoded JWT header looks real: a non-empty string `alg`, and if `typ` is present it is \"JWT\". */\nexport function isJwtHeader(header: Record<string, unknown>): boolean {\n const alg = header[\"alg\"];\n if (typeof alg !== \"string\" || alg.length === 0) return false;\n const typ = header[\"typ\"];\n if (typ !== undefined && typeof typ === \"string\" && typ.toUpperCase() !== \"JWT\") return false;\n return true;\n}\n\n/** Parse a dotted IPv4 string to its four octets, or null if any octet is out of range. */\nexport function parseIpv4(s: string): [number, number, number, number] | null {\n const parts = s.split(\".\");\n if (parts.length !== 4) return null;\n const octets: number[] = [];\n for (const part of parts) {\n if (!/^\\d{1,3}$/.test(part)) return null;\n const n = Number(part);\n if (n > 255) return null;\n // Reject non-canonical leading zeros (\"01\") so we don't match version strings.\n if (part.length > 1 && part[0] === \"0\") return null;\n octets.push(n);\n }\n return [octets[0]!, octets[1]!, octets[2]!, octets[3]!];\n}\n\n/** True for private, loopback, link-local, CGNAT, documentation, multicast, and reserved IPv4. */\nexport function isPrivateOrReservedIpv4(octets: [number, number, number, number]): boolean {\n const [a, b] = octets;\n if (a === 10) return true; // 10.0.0.0/8 private\n if (a === 172 && b >= 16 && b <= 31) return true; // 172.16.0.0/12 private\n if (a === 192 && b === 168) return true; // 192.168.0.0/16 private\n if (a === 127) return true; // loopback\n if (a === 169 && b === 254) return true; // link-local\n if (a === 100 && b >= 64 && b <= 127) return true; // CGNAT 100.64.0.0/10\n if (a === 0) return true; // \"this network\"\n if (a === 192 && b === 0 && octets[2] === 2) return true; // TEST-NET-1 documentation\n if (a === 198 && (b === 18 || b === 19)) return true; // benchmarking\n if (a === 198 && b === 51 && octets[2] === 100) return true; // TEST-NET-2\n if (a === 203 && b === 0 && octets[2] === 113) return true; // TEST-NET-3\n if (a >= 224) return true; // multicast + reserved + broadcast\n return false;\n}\n\n/** True for IPv6 loopback, unspecified, link-local, unique-local, and documentation ranges. */\nexport function isPrivateOrReservedIpv6(address: string): boolean {\n const addr = address.toLowerCase();\n if (addr === \"::1\" || addr === \"::\") return true;\n if (\n addr.startsWith(\"fe8\") ||\n addr.startsWith(\"fe9\") ||\n addr.startsWith(\"fea\") ||\n addr.startsWith(\"feb\")\n )\n return true; // link-local fe80::/10\n if (addr.startsWith(\"fc\") || addr.startsWith(\"fd\")) return true; // unique-local fc00::/7\n if (addr.startsWith(\"2001:db8\")) return true; // documentation 2001:db8::/32\n if (addr.startsWith(\"ff\")) return true; // multicast\n return false;\n}\n","import type { EntityClass, Span } from \"../../types\";\n\n/** A regex pattern paired with the confidence to emit for its matches. */\nexport interface Pattern {\n re: RegExp;\n confidence: number;\n}\n\n/**\n * Emit a span for every match of every pattern. Each `re` MUST carry the `g` flag.\n * `lastIndex` is reset before use, so module-level regexes are safe to reuse (the engine\n * is single-threaded and synchronous).\n */\nexport function scanPatterns(\n text: string,\n patterns: readonly Pattern[],\n entity: EntityClass,\n recognizer: string,\n): Span[] {\n const spans: Span[] = [];\n for (const { re, confidence } of patterns) {\n re.lastIndex = 0;\n let m: RegExpExecArray | null;\n while ((m = re.exec(text)) !== null) {\n spans.push({ entity, start: m.index, end: m.index + m[0].length, confidence, recognizer });\n if (m[0].length === 0) re.lastIndex++;\n }\n }\n return spans;\n}\n","/**\n * Tier 0 structured-PII recognizers (docs/detection.md §2, \"Structured PII\"). All synchronous.\n * Recognizers that carry a validator (Luhn, mod-97, area rules, IP-range) drop non-conforming\n * matches entirely rather than emitting a low-confidence span.\n */\n\nimport type { Recognizer, Span } from \"../../types\";\nimport {\n ibanValid,\n isPrivateOrReservedIpv4,\n isPrivateOrReservedIpv6,\n luhnValid,\n parseIpv4,\n} from \"../primitives\";\nimport { scanPatterns, type Pattern } from \"./shared\";\n\nconst EMAIL_PATTERNS: readonly Pattern[] = [\n // TLD length >= 2 is enforced by the `{2,}` (docs/detection.md §2).\n { re: /[A-Za-z0-9._%+-]+@[A-Za-z0-9.-]+\\.[A-Za-z]{2,}/g, confidence: 1 },\n];\n\nexport const emailRecognizer: Recognizer = {\n id: \"email\",\n entities: [\"email\"],\n tier: 0,\n scan: (text) => scanPatterns(text, EMAIL_PATTERNS, \"email\", \"email\"),\n};\n\nconst PHONE_PATTERNS: readonly Pattern[] = [\n // E.164 / international with a `+` country prefix -> confidence 1.0.\n {\n re: /(?<![\\w+])\\+\\d{1,3}[\\s.-]?\$?\\d{1,4}\$?(?:[\\s.-]?\\d{2,4}){1,4}(?![\\w])/g,\n confidence: 1,\n },\n // Grouped national format with separators -> confidence 0.8. Requires separators so we\n // don't match bare digit runs like order numbers.\n {\n re: /(?<![\\w+])\$?\\d{2,4}\$?[\\s.-]\\d{2,4}[\\s.-]\\d{2,4}(?:[\\s.-]\\d{2,4})?(?![\\w])/g,\n confidence: 0.8,\n },\n];\n\n/** Count decimal digits in a matched phone string. */\nfunction digitCount(s: string): number {\n let n = 0;\n for (let i = 0; i < s.length; i++) {\n const c = s.charCodeAt(i);\n if (c >= 48 && c <= 57) n++;\n }\n return n;\n}\n\nexport const phoneRecognizer: Recognizer = {\n id: \"phone\",\n entities: [\"phone\"],\n tier: 0,\n scan: (text) => {\n const spans = scanPatterns(text, PHONE_PATTERNS, \"phone\", \"phone\");\n // Require 7..15 digits (docs/detection.md §2).\n return spans.filter((s) => {\n const digits = digitCount(text.slice(s.start, s.end));\n return digits >= 7 && digits <= 15;\n });\n },\n};\n\nconst CREDIT_CARD_RE = /(?<![\\d.])\\d(?:[ -]?\\d){12,18}(?![\\d.])/g;\n\nexport const creditCardRecognizer: Recognizer = {\n id: \"credit_card\",\n entities: [\"credit_card\"],\n tier: 0,\n scan: (text) => {\n const spans: Span[] = [];\n CREDIT_CARD_RE.lastIndex = 0;\n let m: RegExpExecArray | null;\n while ((m = CREDIT_CARD_RE.exec(text)) !== null) {\n const digits = m[0].replace(/[^\\d]/g, \"\");\n if (digits.length < 13 || digits.length > 19) continue;\n if (!luhnValid(digits)) continue; // non-Luhn -> drop the span entirely\n spans.push({\n entity: \"credit_card\",\n start: m.index,\n end: m.index + m[0].length,\n confidence: 1,\n recognizer: \"credit_card\",\n });\n }\n return spans;\n },\n};\n\nconst IBAN_RE = /(?<![A-Za-z0-9])[A-Z]{2}\\d{2}(?:\\s?[A-Z0-9]){10,30}(?![A-Za-z0-9])/g;\n\nexport const ibanRecognizer: Recognizer = {\n id: \"iban\",\n entities: [\"iban\"],\n tier: 0,\n scan: (text) => {\n const spans: Span[] = [];\n IBAN_RE.lastIndex = 0;\n let m: RegExpExecArray | null;\n while ((m = IBAN_RE.exec(text)) !== null) {\n const raw = m[0].trimEnd();\n if (!ibanValid(raw)) continue;\n spans.push({\n entity: \"iban\",\n start: m.index,\n end: m.index + raw.length,\n confidence: 1,\n recognizer: \"iban\",\n });\n }\n return spans;\n },\n};\n\nconst SSN_FORMATTED_RE = /(?<!\\d)(\\d{3})-(\\d{2})-(\\d{4})(?!\\d)/g;\nconst SSN_UNFORMATTED_RE = /(?<!\\d)(\\d{3})(\\d{2})(\\d{4})(?!\\d)/g;\nconst SSN_CONTEXT_RE = /ssn|social/gi;\nconst SSN_CONTEXT_WINDOW = 30;\n\n/** Area/group/serial rules for a valid SSN (docs/detection.md §2). */\nfunction ssnPartsValid(area: string, group: string, serial: string): boolean {\n const a = Number(area);\n if (a === 0 || a === 666 || a >= 900) return false;\n if (Number(group) === 0) return false;\n if (Number(serial) === 0) return false;\n return true;\n}\n\nexport const ssnRecognizer: Recognizer = {\n id: \"ssn\",\n entities: [\"ssn\"],\n tier: 0,\n scan: (text) => {\n const spans: Span[] = [];\n\n SSN_FORMATTED_RE.lastIndex = 0;\n let m: RegExpExecArray | null;\n while ((m = SSN_FORMATTED_RE.exec(text)) !== null) {\n if (!ssnPartsValid(m[1]!, m[2]!, m[3]!)) continue;\n spans.push({\n entity: \"ssn\",\n start: m.index,\n end: m.index + m[0].length,\n confidence: 1,\n recognizer: \"ssn\",\n });\n }\n\n // Unformatted 9-digit runs only count near an \"ssn\"/\"social\" keyword.\n const contextEnds: number[] = [];\n SSN_CONTEXT_RE.lastIndex = 0;\n let c: RegExpExecArray | null;\n while ((c = SSN_CONTEXT_RE.exec(text)) !== null) contextEnds.push(c.index + c[0].length);\n if (contextEnds.length > 0) {\n SSN_UNFORMATTED_RE.lastIndex = 0;\n while ((m = SSN_UNFORMATTED_RE.exec(text)) !== null) {\n if (!ssnPartsValid(m[1]!, m[2]!, m[3]!)) continue;\n const start = m.index;\n const near = contextEnds.some((end) => start >= end && start - end <= SSN_CONTEXT_WINDOW);\n if (!near) continue;\n spans.push({\n entity: \"ssn\",\n start,\n end: start + m[0].length,\n confidence: 0.8,\n recognizer: \"ssn\",\n });\n }\n }\n return spans;\n },\n};\n\nconst IPV4_RE = /(?<![\\d.])\\d{1,3}(?:\\.\\d{1,3}){3}(?![\\d.])/g;\n// Comprehensive IPv6 matcher (all compression forms + IPv4-mapped tail).\nconst IPV6_RE =\n /(?<![:.\\w])(?:(?:[A-Fa-f0-9]{1,4}:){7}[A-Fa-f0-9]{1,4}|(?:[A-Fa-f0-9]{1,4}:){1,7}:|(?:[A-Fa-f0-9]{1,4}:){1,6}:[A-Fa-f0-9]{1,4}|(?:[A-Fa-f0-9]{1,4}:){1,5}(?::[A-Fa-f0-9]{1,4}){1,2}|(?:[A-Fa-f0-9]{1,4}:){1,4}(?::[A-Fa-f0-9]{1,4}){1,3}|(?:[A-Fa-f0-9]{1,4}:){1,3}(?::[A-Fa-f0-9]{1,4}){1,4}|(?:[A-Fa-f0-9]{1,4}:){1,2}(?::[A-Fa-f0-9]{1,4}){1,5}|[A-Fa-f0-9]{1,4}:(?::[A-Fa-f0-9]{1,4}){1,6}|:(?:(?::[A-Fa-f0-9]{1,4}){1,7}|:)|::(?:ffff(?::0{1,4})?:)?(?:(?:25[0-5]|(?:2[0-4]|1?[0-9])?[0-9])\\.){3}(?:25[0-5]|(?:2[0-4]|1?[0-9])?[0-9]))(?![:.\\w])/g;\n\nexport function ipAddressRecognizer(includePrivateIps = false): Recognizer {\n return {\n id: \"ip_address\",\n entities: [\"ip_address\"],\n tier: 0,\n scan: (text) => {\n const spans: Span[] = [];\n\n IPV4_RE.lastIndex = 0;\n let m: RegExpExecArray | null;\n while ((m = IPV4_RE.exec(text)) !== null) {\n const octets = parseIpv4(m[0]);\n if (octets === null) continue;\n if (!includePrivateIps && isPrivateOrReservedIpv4(octets)) continue;\n spans.push({\n entity: \"ip_address\",\n start: m.index,\n end: m.index + m[0].length,\n confidence: 1,\n recognizer: \"ip_address\",\n });\n }\n\n IPV6_RE.lastIndex = 0;\n while ((m = IPV6_RE.exec(text)) !== null) {\n if (!includePrivateIps && isPrivateOrReservedIpv6(m[0])) continue;\n spans.push({\n entity: \"ip_address\",\n start: m.index,\n end: m.index + m[0].length,\n confidence: 1,\n recognizer: \"ip_address\",\n });\n }\n return spans;\n },\n };\n}\n\nconst URL_CREDENTIALS_PATTERNS: readonly Pattern[] = [\n { re: /[a-zA-Z][a-zA-Z0-9+.-]*:\\/\\/[^\\s/:@]+:[^\\s/@]+@[^\\s\"'<>]+/g, confidence: 1 },\n];\n\nexport const urlCredentialsRecognizer: Recognizer = {\n id: \"url_credentials\",\n entities: [\"url_credentials\"],\n tier: 0,\n scan: (text) =>\n scanPatterns(text, URL_CREDENTIALS_PATTERNS, \"url_credentials\", \"url_credentials\"),\n};\n\n/** Tier 0 PII recognizers that need no configuration. */\nexport const STATIC_PII_RECOGNIZERS: readonly Recognizer[] = [\n emailRecognizer,\n phoneRecognizer,\n creditCardRecognizer,\n ibanRecognizer,\n ssnRecognizer,\n urlCredentialsRecognizer,\n];\n","/**\n * Tier 0 secret recognizers (docs/detection.md §2, \"Secrets\"). All synchronous.\n * Confidence is 1.0 for a distinctive prefix or a passed validator, 0.8 for a weaker signal.\n */\n\nimport type { Recognizer, Span } from \"../../types\";\nimport { decodeBase64UrlJson, hasBase62Charset, isJwtHeader, shannonEntropy } from \"../primitives\";\nimport { scanPatterns, type Pattern } from \"./shared\";\n\n/** Known API-key shapes, keyed by provider prefix. */\nconst API_KEY_PATTERNS: readonly Pattern[] = [\n { re: /sk-ant-[A-Za-z0-9_-]{20,}/g, confidence: 1 }, // Anthropic\n { re: /sk-[A-Za-z0-9]{20,}/g, confidence: 1 }, // OpenAI (legacy)\n { re: /sk_(?:live|test)_[0-9A-Za-z]{16,}/g, confidence: 1 }, // Stripe secret\n { re: /pk_(?:live|test)_[0-9A-Za-z]{16,}/g, confidence: 0.8 }, // Stripe publishable (low-confidence)\n { re: /gh[opsur]_[A-Za-z0-9]{36,}/g, confidence: 1 }, // GitHub token\n { re: /github_pat_[A-Za-z0-9_]{22,}/g, confidence: 1 }, // GitHub fine-grained PAT\n { re: /AKIA[0-9A-Z]{16}/g, confidence: 1 }, // AWS access key id\n { re: /xox[bpars]-[A-Za-z0-9-]{10,}/g, confidence: 1 }, // Slack\n { re: /AIza[0-9A-Za-z_-]{35}/g, confidence: 1 }, // Google\n { re: /SG\\.[A-Za-z0-9_-]{22}\\.[A-Za-z0-9_-]{43}/g, confidence: 1 }, // SendGrid\n { re: /key-[0-9a-zA-Z]{32}/g, confidence: 0.8 }, // Mailgun\n { re: /glpat-[A-Za-z0-9_-]{20}/g, confidence: 1 }, // GitLab\n { re: /npm_[A-Za-z0-9]{36}/g, confidence: 1 }, // npm\n { re: /dop_v1_[0-9a-f]{64}/g, confidence: 1 }, // DigitalOcean\n];\n\nexport const apiKeyRecognizer: Recognizer = {\n id: \"api_key\",\n entities: [\"api_key\"],\n tier: 0,\n scan: (text) => scanPatterns(text, API_KEY_PATTERNS, \"api_key\", \"api_key\"),\n};\n\nconst JWT_RE = /eyJ[A-Za-z0-9_-]+\\.[A-Za-z0-9_-]+\\.[A-Za-z0-9_-]+/g;\n\nexport const jwtRecognizer: Recognizer = {\n id: \"jwt\",\n entities: [\"jwt\"],\n tier: 0,\n scan: (text) => {\n const spans: Span[] = [];\n JWT_RE.lastIndex = 0;\n let m: RegExpExecArray | null;\n while ((m = JWT_RE.exec(text)) !== null) {\n const header = decodeBase64UrlJson(m[0].slice(0, m[0].indexOf(\".\")));\n if (header !== null && isJwtHeader(header)) {\n spans.push({\n entity: \"jwt\",\n start: m.index,\n end: m.index + m[0].length,\n confidence: 1,\n recognizer: \"jwt\",\n });\n }\n }\n return spans;\n },\n};\n\nconst PEM_PATTERNS: readonly Pattern[] = [\n {\n re: /-----BEGIN (?:RSA |EC |DSA |OPENSSH |PGP )?PRIVATE KEY-----(?:[\\s\\S]*?-----END (?:RSA |EC |DSA |OPENSSH |PGP )?PRIVATE KEY-----)?/g,\n confidence: 1,\n },\n];\n\nexport const privateKeyRecognizer: Recognizer = {\n id: \"private_key\",\n entities: [\"private_key\"],\n tier: 0,\n scan: (text) => scanPatterns(text, PEM_PATTERNS, \"private_key\", \"private_key\"),\n};\n\n// Note: `=` is intentionally excluded so an assignment like `API_SECRET=<token>` splits into\n// the key and the value rather than matching as one run that starts before the keyword. Base64\n// `=` only ever appears as trailing padding, so excluding it just trims padding from the span.\nconst TOKEN_RE = /[A-Za-z0-9+/_-]{20,64}/g;\nconst KEYWORD_RE =\n /(?:secret|token|password|passwd|pwd|api[_-]?key|apikey|auth|credential|bearer)/gi;\nconst ASSIGN_QUOTED_RE = /[=:]\\s*[\"'`]([A-Za-z0-9+/=_-]{20,64})[\"'`]/g;\nconst ENTROPY_THRESHOLD = 4.0;\n/** A candidate must sit within this many chars after a keyword to pass the context gate. */\nconst KEYWORD_WINDOW = 40;\n\nexport const highEntropySecretRecognizer: Recognizer = {\n id: \"high_entropy_secret\",\n entities: [\"high_entropy_secret\"],\n tier: 0,\n scan: (text) => {\n const spans: Span[] = [];\n\n // Context gate part 1: end offsets of nearby keywords.\n const keywordEnds: number[] = [];\n KEYWORD_RE.lastIndex = 0;\n let k: RegExpExecArray | null;\n while ((k = KEYWORD_RE.exec(text)) !== null) keywordEnds.push(k.index + k[0].length);\n\n // Context gate part 2: start offsets of tokens inside a quoted assignment.\n const quotedStarts = new Set<number>();\n ASSIGN_QUOTED_RE.lastIndex = 0;\n let q: RegExpExecArray | null;\n while ((q = ASSIGN_QUOTED_RE.exec(text)) !== null) {\n quotedStarts.add(q.index + q[0].indexOf(q[1]!));\n }\n\n TOKEN_RE.lastIndex = 0;\n let m: RegExpExecArray | null;\n while ((m = TOKEN_RE.exec(text)) !== null) {\n const tok = m[0];\n if (!hasBase62Charset(tok)) continue;\n if (shannonEntropy(tok) <= ENTROPY_THRESHOLD) continue;\n const start = m.index;\n const nearKeyword = keywordEnds.some((end) => start >= end && start - end <= KEYWORD_WINDOW);\n if (!nearKeyword && !quotedStarts.has(start)) continue;\n spans.push({\n entity: \"high_entropy_secret\",\n start,\n end: start + tok.length,\n confidence: 0.8,\n recognizer: \"high_entropy_secret\",\n });\n }\n return spans;\n },\n};\n\nconst CONNECTION_STRING_PATTERNS: readonly Pattern[] = [\n {\n // URI schemes with user:pass@ userinfo.\n re: /(?:postgres(?:ql)?|mysql|mongodb(?:\\+srv)?|rediss?|amqp):\\/\\/[^\\s:@/]+:[^\\s@/]+@[^\\s\"'<>]+/gi,\n confidence: 1,\n },\n {\n // ADO-style \"Server=...;Password=...;\".\n re: /(?:Server|Data Source)=[^;]+;(?:[^;]*;)*?\\s*Password=[^;\\s\"']+/gi,\n confidence: 1,\n },\n];\n\nexport const connectionStringRecognizer: Recognizer = {\n id: \"connection_string\",\n entities: [\"connection_string\"],\n tier: 0,\n scan: (text) =>\n scanPatterns(text, CONNECTION_STRING_PATTERNS, \"connection_string\", \"connection_string\"),\n};\n\n/** All Tier 0 secret recognizers. */\nexport const SECRET_RECOGNIZERS: readonly Recognizer[] = [\n apiKeyRecognizer,\n jwtRecognizer,\n privateKeyRecognizer,\n highEntropySecretRecognizer,\n connectionStringRecognizer,\n];\n","import type { Recognizer } from \"../../types\";\nimport { ipAddressRecognizer, STATIC_PII_RECOGNIZERS } from \"./pii\";\nimport { SECRET_RECOGNIZERS } from \"./secrets\";\n\nexport interface BuiltinRecognizerOptions {\n /** Emit spans for private/reserved IP ranges (docs/detection.md §2). Default false. */\n includePrivateIps?: boolean;\n}\n\n/** The full set of Tier 0 recognizers that ship in core. */\nexport function builtinRecognizers(opts: BuiltinRecognizerOptions = {}): Recognizer[] {\n return [\n ...SECRET_RECOGNIZERS,\n ...STATIC_PII_RECOGNIZERS,\n ipAddressRecognizer(opts.includePrivateIps ?? false),\n ];\n}\n","/**\n * Detection engine: runs recognizers over a string or JSON object and returns merged spans.\n * Internal to core (not part of the public export surface) - consumed by `check` in M2 and by\n * the CLI `scan` command in M4.\n *\n * Tier 0 is synchronous end to end. A recognizer that returns a Promise (Tier 1) is rejected\n * here until async detection is wired in a later milestone.\n */\n\nimport { NotImplementedError } from \"../errors\";\nimport type { EntityClass, JsonObject, Recognizer, Span } from \"../types\";\nimport { mergeSpans } from \"./merge\";\nimport { scanObject } from \"./object-scan\";\nimport { builtinRecognizers } from \"./recognizers\";\n\nexport interface DetectionEngineOptions {\n /** Custom recognizers, appended after the builtins. */\n recognizers?: Recognizer[];\n /** Include the Tier 0 builtins. Default true. */\n useBuiltins?: boolean;\n /** Emit spans for private/reserved IP ranges. Default false. */\n includePrivateIps?: boolean;\n /** Per-entity confidence thresholds; entities not listed use `defaultThreshold`. */\n thresholds?: Partial<Record<EntityClass, number>>;\n /** Default minimum confidence (docs/detection.md §4). Default 0.6. */\n defaultThreshold?: number;\n}\n\nexport interface DetectionEngine {\n readonly recognizers: readonly Recognizer[];\n /** Detect over a plain string or a JSON object; returns merged spans. */\n detect(input: string | JsonObject): Span[];\n}\n\nexport function createDetectionEngine(opts: DetectionEngineOptions = {}): DetectionEngine {\n const recognizers: Recognizer[] = [\n ...(opts.useBuiltins === false\n ? []\n : builtinRecognizers({ includePrivateIps: opts.includePrivateIps ?? false })),\n ...(opts.recognizers ?? []),\n ];\n\n const mergeOpts = {\n ...(opts.thresholds !== undefined ? { thresholds: opts.thresholds } : {}),\n ...(opts.defaultThreshold !== undefined ? { defaultThreshold: opts.defaultThreshold } : {}),\n };\n\n const runRecognizers = (text: string): Span[] => {\n const spans: Span[] = [];\n for (const recognizer of recognizers) {\n const result = recognizer.scan(text);\n if (result instanceof Promise) {\n throw new NotImplementedError(\n \"async (Tier 1) recognizers are wired in a later milestone; Tier 0 detection is synchronous\",\n );\n }\n for (const span of result) spans.push(span);\n }\n return spans;\n };\n\n const scanLeaf = (text: string): Span[] => mergeSpans(runRecognizers(text), mergeOpts);\n\n const detect = (input: string | JsonObject): Span[] =>\n typeof input === \"string\" ? scanLeaf(input) : scanObject(input, scanLeaf);\n\n return { recognizers, detect };\n}\n","/**\n * Normalize a bare Action or EntityRule into a full EntityRule object.\n */\n\nimport type { EntityRule, EntityRuleValue } from \"../types\";\n\n/** Expand `EntityRuleValue` to a concrete {@link EntityRule}. */\nexport function normalizeRule(value: EntityRuleValue): EntityRule {\n if (typeof value === \"string\") {\n return { action: value };\n }\n return {\n action: value.action,\n ...(value.format !== undefined ? { format: value.format } : {}),\n ...(value.dangerouslyAllowSecrets !== undefined\n ? { dangerouslyAllowSecrets: value.dangerouslyAllowSecrets }\n : {}),\n };\n}\n","/**\n * Runtime validation of policy documents. Throws at definePolicy / compile time so\n * misconfiguration surfaces immediately, not on the first request.\n */\n\nimport { NotImplementedError, PolicyValidationError } from \"../errors\";\nimport type { Action, EntityRuleValue, PolicyDocument, PolicyScope } from \"../types\";\nimport { isEgressBoundaryKey } from \"./boundary\";\nimport { normalizeRule } from \"./normalize\";\n\nconst VALID_ACTIONS: ReadonlySet<Action> = new Set([\n \"allow\",\n \"mask\",\n \"tokenize\",\n \"block\",\n \"review\",\n \"detokenize\",\n]);\n\nfunction assertAction(action: Action, path: string, underEgress: boolean): void {\n if (!VALID_ACTIONS.has(action)) {\n throw new PolicyValidationError(`unknown action \"${String(action)}\"`, path);\n }\n if (action === \"review\") {\n throw new NotImplementedError(\"review action ships in v0.2\");\n }\n // Locked: Action includes detokenize; valid only under egress boundary keys (OPEN_QUESTIONS.md).\n if (action === \"detokenize\" && !underEgress) {\n throw new PolicyValidationError(\"detokenize is only valid under egress boundary keys\", path);\n }\n}\n\nfunction validateRuleValue(value: EntityRuleValue, path: string, underEgress: boolean): void {\n const rule = normalizeRule(value);\n assertAction(rule.action, `${path}.action`, underEgress);\n if (rule.format !== undefined && rule.format !== \"preserve\" && rule.format !== \"label\") {\n throw new PolicyValidationError(`unknown format \"${String(rule.format)}\"`, `${path}.format`);\n }\n}\n\nfunction validateEntities(\n entities: Partial<Record<string, EntityRuleValue>> | undefined,\n path: string,\n underEgress: boolean,\n): void {\n if (entities === undefined) return;\n for (const [entity, value] of Object.entries(entities)) {\n if (value === undefined) continue;\n validateRuleValue(value, `${path}.${entity}`, underEgress);\n }\n}\n\nfunction validateScope(scope: PolicyScope, path: string): void {\n validateEntities(scope.entities, `${path}.entities`, false);\n if (scope.boundaries === undefined) return;\n for (const [key, body] of Object.entries(scope.boundaries)) {\n const underEgress = isEgressBoundaryKey(key);\n validateEntities(body?.entities, `${path}.boundaries.${key}.entities`, underEgress);\n }\n}\n\n/**\n * Validate a policy document. Throws {@link PolicyValidationError} or\n * {@link NotImplementedError} on failure.\n */\nexport function validatePolicy(doc: PolicyDocument): void {\n if (doc.defaults?.action !== undefined) {\n assertAction(doc.defaults.action, \"defaults.action\", false);\n }\n validateScope(doc, \"\");\n if (doc.identities === undefined) return;\n for (const [agent, scope] of Object.entries(doc.identities)) {\n validateScope(scope, `identities.${agent}`);\n }\n}\n","/**\n * Precompile a policy document into lookup structures for fast per-span resolution.\n */\n\nimport { getConsole } from \"../console\";\nimport type { Action, EntityRule, EntityRuleValue, PolicyDocument, PolicyScope } from \"../types\";\nimport { FORMAT_PRESERVE_ENTITIES } from \"../vault/alphabet\";\nimport { normalizeRule } from \"./normalize\";\nimport { validatePolicy } from \"./validate\";\n\n/** One boundary pattern with its entity rules. */\nexport interface CompiledBoundary {\n pattern: string;\n entities: Map<string, EntityRule>;\n}\n\n/** One identity override tree. */\nexport interface CompiledIdentity {\n entities: Map<string, EntityRule>;\n boundaries: CompiledBoundary[];\n /** Pattern strings in the same order as `boundaries` (for matchBoundaryPatterns). */\n boundaryPatterns: string[];\n}\n\n/** Precompiled policy used by {@link resolve}. */\nexport interface CompiledPolicy {\n defaultsAction: Action;\n dangerouslyAllowSecrets: boolean;\n entities: Map<string, EntityRule>;\n boundaries: CompiledBoundary[];\n boundaryPatterns: string[];\n identities: Map<string, CompiledIdentity>;\n}\n\nfunction compileEntities(\n entities: Partial<Record<string, EntityRuleValue>> | undefined,\n): Map<string, EntityRule> {\n const map = new Map<string, EntityRule>();\n if (entities === undefined) return map;\n for (const [key, value] of Object.entries(entities)) {\n if (value === undefined) continue;\n map.set(key, normalizeRule(value));\n }\n return map;\n}\n\nfunction compileBoundaries(boundaries: PolicyScope[\"boundaries\"]): {\n boundaries: CompiledBoundary[];\n boundaryPatterns: string[];\n} {\n const compiled: CompiledBoundary[] = [];\n if (boundaries === undefined) {\n return { boundaries: compiled, boundaryPatterns: [] };\n }\n for (const [pattern, body] of Object.entries(boundaries)) {\n compiled.push({\n pattern,\n entities: compileEntities(body?.entities),\n });\n }\n // Exact before glob; longer before shorter - same order as matchBoundaryPatterns.\n compiled.sort((a, b) => {\n const aGlob = a.pattern.includes(\"*\") ? 1 : 0;\n const bGlob = b.pattern.includes(\"*\") ? 1 : 0;\n if (aGlob !== bGlob) return aGlob - bGlob;\n return b.pattern.length - a.pattern.length;\n });\n return {\n boundaries: compiled,\n boundaryPatterns: compiled.map((b) => b.pattern),\n };\n}\n\nfunction compileScope(scope: PolicyScope): CompiledIdentity {\n const entities = compileEntities(scope.entities);\n const { boundaries, boundaryPatterns } = compileBoundaries(scope.boundaries);\n return { entities, boundaries, boundaryPatterns };\n}\n\n/**\n * vault.md §3: format:\"preserve\" outside {email, phone, credit_card} falls back to\n * label tokens with a compile-time warning.\n */\nfunction warnUnsupportedPreserve(entities: Map<string, EntityRule>, path: string): void {\n for (const [entity, rule] of entities) {\n if (rule.format !== \"preserve\") continue;\n if (FORMAT_PRESERVE_ENTITIES.has(entity)) continue;\n getConsole()?.warn(\n `[tailrace] format: \"preserve\" is not supported for entity \"${entity}\" at ${path}.${entity}; falling back to label token`,\n );\n }\n}\n\nfunction warnPreserveFallbacks(compiled: CompiledPolicy): void {\n warnUnsupportedPreserve(compiled.entities, \"entities\");\n for (const boundary of compiled.boundaries) {\n warnUnsupportedPreserve(boundary.entities, `boundaries.${boundary.pattern}.entities`);\n }\n for (const [agent, ident] of compiled.identities) {\n warnUnsupportedPreserve(ident.entities, `identities.${agent}.entities`);\n for (const boundary of ident.boundaries) {\n warnUnsupportedPreserve(\n boundary.entities,\n `identities.${agent}.boundaries.${boundary.pattern}.entities`,\n );\n }\n }\n}\n\n/**\n * Validate and precompile a policy document.\n *\n * @example\n * ```ts\n * const compiled = compilePolicy(definePolicy({ entities: { email: \"tokenize\" } }));\n * ```\n */\nexport function compilePolicy(doc: PolicyDocument): CompiledPolicy {\n validatePolicy(doc);\n const { boundaries, boundaryPatterns } = compileBoundaries(doc.boundaries);\n const identities = new Map<string, CompiledIdentity>();\n if (doc.identities !== undefined) {\n for (const [agent, scope] of Object.entries(doc.identities)) {\n identities.set(agent, compileScope(scope));\n }\n }\n const compiled: CompiledPolicy = {\n defaultsAction: doc.defaults?.action ?? \"allow\",\n dangerouslyAllowSecrets: doc.dangerouslyAllowSecrets === true,\n entities: compileEntities(doc.entities),\n boundaries,\n boundaryPatterns,\n identities,\n };\n warnPreserveFallbacks(compiled);\n return compiled;\n}\n","/**\n * Zero-config default policy document.\n *\n * Explicit per-entity choices (not a blanket \"all PII tokenize\"):\n * - secrets → block\n * - common structured PII (email, phone, card, iban, ssn) → tokenize\n * - ip_address → allow (IPs appear in legitimate flows; blanket tokenization is aggressive)\n * - url_credentials → block (credential-in-URL shape is secret-class in practice)\n * - NER entities unset → fall through to defaults.action = allow\n * - egress:* → detokenize\n */\n\nimport {\n SECRET_ENTITY_CLASSES,\n type EntityClass,\n type EntityRuleValue,\n type PiiEntityClass,\n type PolicyDocument,\n} from \"../types\";\n\n/** Structured PII tokenized by the zero-config default. */\nconst DEFAULT_TOKENIZE_PII: readonly PiiEntityClass[] = [\n \"email\",\n \"phone\",\n \"credit_card\",\n \"iban\",\n \"ssn\",\n];\n\n/**\n * Build the default policy enforced by `createTailrace()` with no args.\n *\n * @example\n * ```ts\n * const policy = defaultPolicy();\n * // secrets block, emails tokenize, egress:* detokenize\n * ```\n */\nexport function defaultPolicy(): PolicyDocument {\n const entities: Partial<Record<EntityClass, EntityRuleValue>> = {};\n for (const entity of SECRET_ENTITY_CLASSES) {\n entities[entity] = \"block\";\n }\n for (const entity of DEFAULT_TOKENIZE_PII) {\n entities[entity] = \"tokenize\";\n }\n entities.url_credentials = \"block\";\n return {\n defaults: { action: \"allow\" },\n entities,\n boundaries: {\n \"egress:*\": { entities: { \"*\": \"detokenize\" } },\n },\n };\n}\n","/**\n * Associate a master key with a Vault instance so createTailrace can derive tokens\n * for pre-built memoryVault / kvVault instances.\n */\n\nimport type { Vault } from \"../types\";\n\nconst vaultKeys = new WeakMap<Vault, Uint8Array>();\n\n/** Register the master key used by a built-in vault adapter. */\nexport function registerVaultKey(vault: Vault, masterKey: Uint8Array): void {\n vaultKeys.set(vault, masterKey);\n}\n\n/** Retrieve a previously registered master key, if any. */\nexport function getVaultKey(vault: Vault): Uint8Array | undefined {\n return vaultKeys.get(vault);\n}\n","/**\n * Shared vault record encoding and storage key helpers.\n */\n\nimport { VaultError } from \"../errors\";\nimport type { EntityClass, VaultRecord } from \"../types\";\nimport { decryptAtRest, encryptAtRest } from \"./crypto\";\n\nexport interface EncodedVaultRecord {\n entity: EntityClass;\n ciphertext: string;\n expiresAt?: number;\n}\n\n/** Storage key: `tailrace:v1:{workflowId}:{token}`. */\nexport function storageKey(workflowId: string, token: string): string {\n return `tailrace:v1:${workflowId}:${token}`;\n}\n\n/** Encrypt and JSON-encode a vault record for storage. */\nexport async function encodeRecord(\n masterKey: Uint8Array,\n record: VaultRecord,\n expiresAt?: number,\n): Promise<string> {\n const ciphertext = await encryptAtRest(masterKey, record.value);\n const encoded: EncodedVaultRecord = {\n entity: record.entity,\n ciphertext,\n ...(expiresAt !== undefined ? { expiresAt } : {}),\n };\n return JSON.stringify(encoded);\n}\n\n/** Decode and decrypt a stored vault record. Returns null if expired. */\nexport async function decodeRecord(\n masterKey: Uint8Array,\n raw: string,\n now: number = Date.now(),\n): Promise<(VaultRecord & { expiresAt?: number }) | null> {\n let parsed: EncodedVaultRecord;\n try {\n parsed = JSON.parse(raw) as EncodedVaultRecord;\n } catch {\n throw new VaultError(\"corrupt vault record\");\n }\n if (parsed.expiresAt !== undefined && parsed.expiresAt <= now) {\n return null;\n }\n const value = await decryptAtRest(masterKey, parsed.ciphertext);\n return {\n value,\n entity: parsed.entity,\n ...(parsed.expiresAt !== undefined ? { expiresAt: parsed.expiresAt } : {}),\n };\n}\n\n/**\n * Ensure an existing vault entry for `token` stores the same plaintext.\n * Different value for the same token id is a collision (docs/vault.md §3).\n */\nexport function assertNoCollision(\n existing: VaultRecord | null,\n value: string,\n token: string,\n): void {\n if (existing !== null && existing.value !== value) {\n throw new VaultError(`token collision for ${token}`);\n }\n}\n","/**\n * In-memory vault with TTL sweep. Default vault for createTailrace().\n */\n\nimport type { Vault, VaultOptions, VaultPutInput, VaultRecord } from \"../types\";\nimport { resolveMasterKey } from \"./crypto\";\nimport { registerVaultKey } from \"./keys\";\nimport { assertNoCollision, decodeRecord, encodeRecord, storageKey } from \"./shared\";\n\nconst DEFAULT_TTL_SECONDS = 86_400;\n\ninterface MemoryEntry {\n raw: string;\n expiresAt?: number;\n}\n\n/**\n * Create an in-memory vault. Values are encrypted at rest with the resolved master key.\n *\n * @example\n * ```ts\n * const gate = createTailrace({ vault: memoryVault({ key: \"dev-only-key\" }) });\n * ```\n */\nexport function memoryVault(opts?: VaultOptions): Vault {\n const masterKey = resolveMasterKey(opts?.key);\n const ttlSeconds = opts?.ttlSeconds ?? DEFAULT_TTL_SECONDS;\n const store = new Map<string, MemoryEntry>();\n\n const sweep = (now: number): void => {\n for (const [key, entry] of store) {\n if (entry.expiresAt !== undefined && entry.expiresAt <= now) {\n store.delete(key);\n }\n }\n };\n\n const vault: Vault = {\n async put(input: VaultPutInput): Promise<void> {\n const now = Date.now();\n sweep(now);\n const key = storageKey(input.workflowId, input.token);\n const existingRaw = store.get(key);\n if (existingRaw !== undefined) {\n const existing = await decodeRecord(masterKey, existingRaw.raw, now);\n assertNoCollision(existing, input.value, input.token);\n if (existing !== null) return; // idempotent same-value put\n }\n const expiresAt = input.expiresAt ?? (ttlSeconds > 0 ? now + ttlSeconds * 1000 : undefined);\n const raw = await encodeRecord(\n masterKey,\n { value: input.value, entity: input.entity },\n expiresAt,\n );\n store.set(key, {\n raw,\n ...(expiresAt !== undefined ? { expiresAt } : {}),\n });\n },\n\n async get(workflowId: string, token: string): Promise<VaultRecord | null> {\n const now = Date.now();\n sweep(now);\n const entry = store.get(storageKey(workflowId, token));\n if (entry === undefined) return null;\n const decoded = await decodeRecord(masterKey, entry.raw, now);\n if (decoded === null) {\n store.delete(storageKey(workflowId, token));\n return null;\n }\n return { value: decoded.value, entity: decoded.entity };\n },\n\n async purge(workflowId: string): Promise<void> {\n const prefix = `tailrace:v1:${workflowId}:`;\n for (const key of store.keys()) {\n if (key.startsWith(prefix)) store.delete(key);\n }\n },\n };\n\n registerVaultKey(vault, masterKey);\n return vault;\n}\n","/**\n * Built-in audit sinks (console + JSONL writer).\n */\n\nimport type { AuditEvent, AuditSink, AuditWriter } from \"../types\";\nimport { getConsole } from \"../console\";\n\n/**\n * Log each audit event as a single JSON line on the console.\n *\n * @example\n * ```ts\n * const gate = createTailrace({ audit: { sinks: [consoleSink()] } });\n * ```\n */\nexport function consoleSink(): AuditSink {\n return {\n emit(event: AuditEvent): void {\n getConsole()?.log(JSON.stringify(event));\n },\n };\n}\n\n/**\n * Write each audit event as a JSON line via a caller-supplied {@link AuditWriter}.\n * Core never touches the filesystem - pass a file/stream adapter from Node or the CLI.\n *\n * @example\n * ```ts\n * const lines: string[] = [];\n * const sink = jsonlSink({ write: (line) => { lines.push(line); } });\n * ```\n */\nexport function jsonlSink(writer: AuditWriter): AuditSink {\n return {\n async emit(event: AuditEvent): Promise<void> {\n await writer.write(JSON.stringify(event) + \"\\n\");\n },\n };\n}\n","/**\n * KV-backed vault (Cloudflare KV and compatible). Values encrypted at rest.\n */\n\nimport type { KvStore, Vault, VaultOptions, VaultPutInput, VaultRecord } from \"../types\";\nimport { resolveMasterKey } from \"./crypto\";\nimport { registerVaultKey } from \"./keys\";\nimport { assertNoCollision, decodeRecord, encodeRecord, storageKey } from \"./shared\";\n\nconst DEFAULT_TTL_SECONDS = 86_400;\n\nexport { storageKey };\n\n/**\n * Create a vault backed by a minimal KV store.\n *\n * @example\n * ```ts\n * const gate = createTailrace({ vault: kvVault(env.MY_KV, { key: secret }) });\n * ```\n */\nexport function kvVault(kv: KvStore, opts?: VaultOptions): Vault {\n const masterKey = resolveMasterKey(opts?.key);\n const ttlSeconds = opts?.ttlSeconds ?? DEFAULT_TTL_SECONDS;\n\n const vault: Vault = {\n async put(input: VaultPutInput): Promise<void> {\n const key = storageKey(input.workflowId, input.token);\n const existingRaw = await kv.get(key);\n if (existingRaw !== null) {\n const existing = await decodeRecord(masterKey, existingRaw);\n assertNoCollision(existing, input.value, input.token);\n if (existing !== null) return;\n }\n const now = Date.now();\n const expiresAt = input.expiresAt ?? (ttlSeconds > 0 ? now + ttlSeconds * 1000 : undefined);\n const raw = await encodeRecord(\n masterKey,\n { value: input.value, entity: input.entity },\n expiresAt,\n );\n const putOpts =\n expiresAt !== undefined\n ? { expirationTtl: Math.max(1, Math.ceil((expiresAt - now) / 1000)) }\n : ttlSeconds > 0\n ? { expirationTtl: ttlSeconds }\n : undefined;\n if (putOpts !== undefined) {\n await kv.put(key, raw, putOpts);\n } else {\n await kv.put(key, raw);\n }\n },\n\n async get(workflowId: string, token: string): Promise<VaultRecord | null> {\n const raw = await kv.get(storageKey(workflowId, token));\n if (raw === null) return null;\n const decoded = await decodeRecord(masterKey, raw);\n if (decoded === null) {\n await kv.delete(storageKey(workflowId, token));\n return null;\n }\n return { value: decoded.value, entity: decoded.entity };\n },\n\n async purge(workflowId: string): Promise<void> {\n // Minimal KvStore has no list API; purge is a no-op for opaque namespaces.\n // Callers that need purge should use memoryVault or a richer adapter.\n void workflowId;\n },\n };\n\n registerVaultKey(vault, masterKey);\n return vault;\n}\n","/**\n * @tailrace/core - detection, policy engine, vault, and audit.\n *\n * Zero runtime dependencies; runs on Node 20+, Cloudflare Workers, and Vercel Edge.\n * Public exports are intentionally short - every export is API forever\n * (docs/architecture.md §6).\n */\n\nimport { applyActions } from \"./actions/apply\";\nimport type { ApplyItem } from \"./actions/apply\";\nimport { getStringAtPointer } from \"./actions/pointer\";\nimport { restoreInput } from \"./actions/restore\";\nimport { computeStreamEmitEnd } from \"./actions/stream-cut\";\nimport { createAuditEmitter } from \"./audit/emitter\";\nimport { createDetectionEngine } from \"./detect/engine\";\nimport { PolicyViolationError } from \"./errors\";\nimport { compilePolicy } from \"./policy/compile\";\nimport type { CompiledPolicy } from \"./policy/compile\";\nimport { defaultPolicy } from \"./policy/default\";\nimport { resolve } from \"./policy/resolve\";\nimport { validatePolicy } from \"./policy/validate\";\nimport type {\n CheckContext,\n CheckOptions,\n CheckResult,\n Decision,\n JsonObject,\n PolicyDocument,\n PolicySource,\n Recognizer,\n Span,\n Tailrace,\n TailraceOptions,\n Vault,\n VaultOptions,\n} from \"./types\";\nimport { resolveMasterKey, sha256Hex } from \"./vault/crypto\";\nimport { getVaultKey } from \"./vault/keys\";\nimport { memoryVault } from \"./vault/memory\";\n\nexport * from \"./errors\";\nexport type * from \"./types\";\nexport { NER_ENTITY_CLASSES, PII_ENTITY_CLASSES, SECRET_ENTITY_CLASSES } from \"./types\";\nexport { consoleSink, jsonlSink } from \"./audit/sinks\";\nexport { memoryVault } from \"./vault/memory\";\nexport { kvVault } from \"./vault/kv\";\n\nfunction isVault(value: Vault | VaultOptions): value is Vault {\n return typeof (value as Vault).put === \"function\";\n}\n\nfunction isPolicySource(value: PolicyDocument | PolicySource): value is PolicySource {\n return typeof (value as PolicySource).load === \"function\";\n}\n\nfunction extractSpanValue(input: string | JsonObject, span: Span): string {\n if (typeof input === \"string\") {\n return input.slice(span.start, span.end);\n }\n const path = span.path ?? \"\";\n const leaf = getStringAtPointer(input, path);\n if (leaf === null) return \"\";\n return leaf.slice(span.start, span.end);\n}\n\nfunction resolveVault(options: TailraceOptions): { vault: Vault; masterKey: Uint8Array } {\n if (options.vault === undefined) {\n const vault = memoryVault();\n return { vault, masterKey: getVaultKey(vault) ?? resolveMasterKey() };\n }\n if (isVault(options.vault)) {\n const vault = options.vault;\n return { vault, masterKey: getVaultKey(vault) ?? resolveMasterKey() };\n }\n const vault = memoryVault(options.vault);\n return { vault, masterKey: getVaultKey(vault) ?? resolveMasterKey(options.vault.key) };\n}\n\n/**\n * Create a gate. Zero-config by default: all secret classes `block`, common PII `tokenize`.\n *\n * @example\n * ```ts\n * const tailrace = createTailrace();\n * const { output } = await tailrace.check(userInput, {\n * boundary: { kind: \"model\", provider: \"openai/gpt-4o\" },\n * identity: { agent: \"default\" },\n * });\n * ```\n */\nexport function createTailrace(options: TailraceOptions = {}): Tailrace {\n const engine = createDetectionEngine({\n ...(options.recognizers !== undefined ? { recognizers: options.recognizers } : {}),\n ...(options.includePrivateIps !== undefined\n ? { includePrivateIps: options.includePrivateIps }\n : {}),\n });\n\n const { vault, masterKey } = resolveVault(options);\n const audit = createAuditEmitter(options.audit?.sinks ?? [], options.onDecision);\n\n let compiled: CompiledPolicy | null = null;\n let unsubscribe: (() => void) | undefined;\n\n const loadAndCompile = async (): Promise<CompiledPolicy> => {\n if (compiled !== null) return compiled;\n let doc: PolicyDocument;\n if (options.policy === undefined) {\n doc = defaultPolicy();\n } else if (isPolicySource(options.policy)) {\n doc = await options.policy.load();\n if (options.policy.subscribe !== undefined && unsubscribe === undefined) {\n unsubscribe = options.policy.subscribe((next) => {\n compiled = compilePolicy(next);\n });\n }\n } else {\n doc = options.policy;\n }\n compiled = compilePolicy(doc);\n return compiled;\n };\n\n const check = async <T extends string | JsonObject>(\n input: T,\n ctx: CheckContext,\n options?: CheckOptions,\n ): Promise<CheckResult<T>> => {\n const workflowId = ctx.workflowId ?? \"default\";\n const identity = {\n agent: ctx.identity.agent || \"default\",\n ...(ctx.identity.claims !== undefined ? { claims: ctx.identity.claims } : {}),\n };\n const policy = await loadAndCompile();\n const spans = engine.detect(input);\n const items: ApplyItem[] = [];\n\n for (const span of spans) {\n const value = extractSpanValue(input, span);\n const resolved = resolve(policy, span.entity, ctx.boundary, identity);\n const contentHash = await sha256Hex(value);\n const decision: Decision = {\n action: resolved.action,\n entity: span.entity,\n boundary: ctx.boundary,\n identity,\n rule: resolved.rule,\n span: {\n path: span.path ?? \"\",\n start: span.start,\n end: span.end,\n },\n contentHash,\n };\n items.push({\n span,\n decision,\n value,\n ...(resolved.format !== undefined ? { format: resolved.format } : {}),\n });\n }\n\n const stream = options?.stream;\n const streamString = stream !== undefined && typeof input === \"string\";\n\n try {\n if (streamString) {\n const text = input;\n const emitEnd = computeStreamEmitEnd(\n text.length,\n items.map((i) => i.span),\n stream.holdback,\n stream.final === true,\n );\n\n // Fail closed on any complete block in the full window (including carry).\n if (options?.applyBlockAs !== \"mask\") {\n const blocks = items.filter((i) => i.decision.action === \"block\");\n if (blocks.length > 0) {\n const decisions = blocks.map((b) => ({ ...b.decision, action: \"block\" as const }));\n const first = decisions[0]!;\n throw new PolicyViolationError(\n `policy blocked entity \"${first.entity}\" via rule \"${first.rule}\"`,\n decisions,\n );\n }\n }\n\n const toApply = items.filter((i) => i.span.end <= emitEnd);\n const prefix = text.slice(0, emitEnd);\n const remainder = text.slice(emitEnd);\n\n if (prefix.length === 0) {\n return { output: \"\" as T, decisions: [], blocked: false, remainder };\n }\n\n const { output, decisions } = await applyActions(prefix, toApply, {\n vault,\n masterKey,\n workflowId,\n ...(options?.applyBlockAs !== undefined ? { applyBlockAs: options.applyBlockAs } : {}),\n });\n audit.emit(\"check\", workflowId, decisions);\n return { output: output as T, decisions, blocked: false, remainder };\n }\n\n const { output, decisions } = await applyActions(input, items, {\n vault,\n masterKey,\n workflowId,\n ...(options?.applyBlockAs !== undefined ? { applyBlockAs: options.applyBlockAs } : {}),\n });\n audit.emit(\"check\", workflowId, decisions);\n return { output, decisions, blocked: false };\n } catch (err) {\n if (err instanceof PolicyViolationError) {\n audit.emit(\"check\", workflowId, err.decisions);\n }\n throw err;\n }\n };\n\n const restore = async <T extends string | JsonObject>(\n input: T,\n ctx: CheckContext,\n ): Promise<CheckResult<T>> => {\n const workflowId = ctx.workflowId ?? \"default\";\n const identity = {\n agent: ctx.identity.agent || \"default\",\n ...(ctx.identity.claims !== undefined ? { claims: ctx.identity.claims } : {}),\n };\n const { output, decisions } = await restoreInput(input, {\n vault,\n workflowId,\n boundary: ctx.boundary,\n identity,\n });\n audit.emit(\"restore\", workflowId, decisions);\n return { output, decisions, blocked: false };\n };\n\n return { check, restore };\n}\n\n/**\n * Author and validate a policy document.\n *\n * @example\n * ```ts\n * const policy = definePolicy({ entities: { email: \"tokenize\" } });\n * ```\n */\nexport function definePolicy(doc: PolicyDocument): PolicyDocument {\n validatePolicy(doc);\n return doc;\n}\n\n/**\n * Define a custom recognizer.\n *\n * @example\n * ```ts\n * const employeeId = defineRecognizer({\n * id: \"employee-id\",\n * entities: [\"employee_id\"],\n * tier: 0,\n * scan: (text) => [],\n * });\n * ```\n */\nexport function defineRecognizer(recognizer: Recognizer): Recognizer {\n return recognizer;\n}\n\n/**\n * Wrap a local policy document as a {@link PolicySource}. This is the default source and\n * the shape a hosted policy plane implements later (docs/architecture.md §5).\n *\n * @example\n * ```ts\n * const source = staticPolicy(definePolicy({ entities: { email: \"tokenize\" } }));\n * ```\n */\nexport function staticPolicy(doc: PolicyDocument): PolicySource {\n return { load: () => Promise.resolve(doc) };\n}\n"]}

package/package.json ADDED Viewed

@@ -0,0 +1,53 @@
+{
+  "name": "@tailrace/core",
+  "version": "0.1.0",
+  "description": "Agent data governance core: detection, policy engine, vault, audit. Zero runtime deps; runs on Node, Cloudflare Workers, and Vercel Edge.",
+  "license": "MIT",
+  "type": "module",
+  "sideEffects": false,
+  "main": "./dist/index.cjs",
+  "module": "./dist/index.js",
+  "types": "./dist/index.d.ts",
+  "exports": {
+    ".": {
+      "import": {
+        "types": "./dist/index.d.ts",
+        "default": "./dist/index.js"
+      },
+      "require": {
+        "types": "./dist/index.d.cts",
+        "default": "./dist/index.cjs"
+      }
+    }
+  },
+  "files": [
+    "dist",
+    "schemas",
+    "README.md"
+  ],
+  "size-limit": [
+    {
+      "name": "@tailrace/core (esm, gzip)",
+      "path": "dist/index.js",
+      "limit": "60 KB",
+      "gzip": true
+    }
+  ],
+  "devDependencies": {
+    "@cloudflare/vitest-pool-workers": "^0.5.40",
+    "@size-limit/preset-small-lib": "^11.1.6",
+    "ajv": "^8.20.0",
+    "fast-check": "^4.9.0",
+    "size-limit": "^11.1.6"
+  },
+  "publishConfig": {
+    "access": "public"
+  },
+  "scripts": {
+    "build": "tsup",
+    "test": "vitest run --passWithNoTests",
+    "test:workers": "vitest run --config vitest.workers.config.ts",
+    "typecheck": "tsc --noEmit",
+    "size": "size-limit"
+  }
+}

package/schemas/policy.v1.json ADDED Viewed

@@ -0,0 +1,78 @@
+{
+  "$schema": "https://json-schema.org/draft/2020-12/schema",
+  "$id": "https://tailrace.dev/schema/policy.v1.json",
+  "title": "TailracePolicyDocument",
+  "description": "Policy document for definePolicy / createTailrace({ policy }).",
+  "type": "object",
+  "additionalProperties": false,
+  "properties": {
+    "$schema": { "type": "string" },
+    "defaults": {
+      "type": "object",
+      "additionalProperties": false,
+      "properties": {
+        "action": { "$ref": "#/$defs/action" }
+      }
+    },
+    "entities": { "$ref": "#/$defs/entityMap" },
+    "boundaries": {
+      "type": "object",
+      "additionalProperties": {
+        "type": "object",
+        "additionalProperties": false,
+        "properties": {
+          "entities": { "$ref": "#/$defs/entityMap" }
+        }
+      }
+    },
+    "identities": {
+      "type": "object",
+      "additionalProperties": { "$ref": "#/$defs/policyScope" }
+    },
+    "dangerouslyAllowSecrets": { "type": "boolean" }
+  },
+  "$defs": {
+    "action": {
+      "type": "string",
+      "enum": ["allow", "mask", "tokenize", "block", "review", "detokenize"]
+    },
+    "format": {
+      "type": "string",
+      "enum": ["preserve", "label"]
+    },
+    "entityRule": {
+      "type": "object",
+      "additionalProperties": false,
+      "required": ["action"],
+      "properties": {
+        "action": { "$ref": "#/$defs/action" },
+        "format": { "$ref": "#/$defs/format" },
+        "dangerouslyAllowSecrets": { "type": "boolean" }
+      }
+    },
+    "entityRuleValue": {
+      "oneOf": [{ "$ref": "#/$defs/action" }, { "$ref": "#/$defs/entityRule" }]
+    },
+    "entityMap": {
+      "type": "object",
+      "additionalProperties": { "$ref": "#/$defs/entityRuleValue" }
+    },
+    "policyScope": {
+      "type": "object",
+      "additionalProperties": false,
+      "properties": {
+        "entities": { "$ref": "#/$defs/entityMap" },
+        "boundaries": {
+          "type": "object",
+          "additionalProperties": {
+            "type": "object",
+            "additionalProperties": false,
+            "properties": {
+              "entities": { "$ref": "#/$defs/entityMap" }
+            }
+          }
+        }
+      }
+    }
+  }
+}