@tenuo/core 0.2.4-beta.0

package/dist/client.js

@@ -0,0 +1,417 @@
+import { AsyncLocalStorage } from "node:async_hooks";
+import { createMcp } from "./mcp.js";
+import { AuthorizationDeniedError, ApprovalRequiredError, TenuoConfigurationError, TenuoError } from "./errors.js";
+import { Session, isSession, nativeSession } from "./session.js";
+import { createDevContext, createVerifierContext, importSessionFromChain, importSessionFromWire, loadWasm, } from "./wasm.js";
+const currentSession = new AsyncLocalStorage();
+const toolPolicies = new WeakMap();
+const wrappedInners = new WeakSet();
+function nodeEnv() {
+    if (typeof process === "undefined") {
+        return undefined;
+    }
+    return process.env.NODE_ENV;
+}
+function allowDev() {
+    if (typeof process === "undefined") {
+        return false;
+    }
+    return process.env.TENUO_ALLOW_DEV === "1";
+}
+export function devRoot(options) {
+    const root = {
+        kind: "dev-root",
+        ...(options?.allowInProduction === true ? { allowInProduction: true } : {}),
+    };
+    if (!devRootAllowed(root)) {
+        throw new TenuoConfigurationError(devRootBlockedMessage());
+    }
+    return root;
+}
+function devRootAllowed(root) {
+    if (root.allowInProduction === true || allowDev()) {
+        return true;
+    }
+    const env = nodeEnv();
+    return env === "development" || env === "test";
+}
+function devRootBlockedMessage() {
+    return "createTenuo.devRoot() is for development. Set NODE_ENV=development or test, pass devRoot({ allowInProduction: true }), or TENUO_ALLOW_DEV=1. Unset NODE_ENV is not treated as development.";
+}
+function normalizeHex(value) {
+    const hex = value.trim().toLowerCase().replace(/^0x/, "");
+    if (!/^[0-9a-f]{64}$/.test(hex)) {
+        throw new TenuoConfigurationError("Trusted root must be a 32-byte hex public key (64 hex characters)");
+    }
+    return hex;
+}
+export function publicKeyFromEnv(name) {
+    if (name.length === 0) {
+        throw new TenuoConfigurationError("publicKeyFromEnv() requires an environment variable name");
+    }
+    if (typeof process === "undefined") {
+        throw new TenuoConfigurationError(`Environment variable ${name} is not available. Tenuo fails closed without a trusted root.`);
+    }
+    const value = process.env[name];
+    if (value === undefined || value.length === 0) {
+        throw new TenuoConfigurationError(`Environment variable ${name} is not set or empty. Tenuo fails closed without a trusted root.`);
+    }
+    return { kind: "public-key", source: "env", hex: normalizeHex(value) };
+}
+export function publicKeyFromHex(hex) {
+    return { kind: "public-key", source: "hex", hex: normalizeHex(hex) };
+}
+export function publicKeyFromBytes(bytes) {
+    if (bytes.length !== 32) {
+        throw new TenuoConfigurationError("publicKeyFromBytes() requires a 32-byte public key");
+    }
+    const hex = Array.from(bytes, (b) => b.toString(16).padStart(2, "0")).join("");
+    return { kind: "public-key", source: "bytes", hex };
+}
+function normalizeSecretHex(value) {
+    const hex = value.trim().toLowerCase().replace(/^0x/, "");
+    if (!/^[0-9a-f]{64}$/.test(hex)) {
+        throw new TenuoConfigurationError("Holder key must be a 32-byte hex secret (64 hex characters)");
+    }
+    return hex;
+}
+function hexToBytes(hex) {
+    const bytes = new Uint8Array(hex.length / 2);
+    for (let i = 0; i < bytes.length; i += 1) {
+        bytes[i] = Number.parseInt(hex.slice(i * 2, i * 2 + 2), 16);
+    }
+    return bytes;
+}
+export function holderKeyFromEnv(name) {
+    if (name.length === 0) {
+        throw new TenuoConfigurationError("holderKeyFromEnv() requires an environment variable name");
+    }
+    if (typeof process === "undefined") {
+        throw new TenuoConfigurationError(`Environment variable ${name} is not available. Tenuo fails closed without a holder key.`);
+    }
+    const value = process.env[name];
+    if (value === undefined || value.length === 0) {
+        throw new TenuoConfigurationError(`Environment variable ${name} is not set or empty. Tenuo fails closed without a holder key.`);
+    }
+    return hexToBytes(normalizeSecretHex(value));
+}
+export function holderKeyFromHex(hex) {
+    return hexToBytes(normalizeSecretHex(hex));
+}
+function rootHexes(options) {
+    const handles = [];
+    if (options.root !== undefined && options.root.kind === "public-key") {
+        handles.push(options.root);
+    }
+    for (const root of options.trustedRoots ?? []) {
+        handles.push(root);
+    }
+    return handles.map((h) => h.hex);
+}
+function hasTrustAnchor(options) {
+    if (options.root !== undefined) {
+        return true;
+    }
+    return (options.trustedRoots?.length ?? 0) > 0;
+}
+function capabilityName(inner, policy) {
+    if (policy.capability !== undefined && policy.capability.length > 0) {
+        return policy.capability;
+    }
+    const named = inner;
+    if (typeof named.name === "string" && named.name.length > 0) {
+        return named.name;
+    }
+    if (typeof named.id === "string" && named.id.length > 0) {
+        return named.id;
+    }
+    throw new TenuoConfigurationError("tenuo.tool() needs a capability name (policy.capability, or tool.name / tool.id)");
+}
+class TenuoClient {
+    context;
+    canMint;
+    mcp;
+    constructor(options) {
+        if (options.root?.kind === "dev-root") {
+            this.context = createDevContext();
+            this.canMint = true;
+        }
+        else {
+            this.context = createVerifierContext(rootHexes(options));
+            this.canMint = false;
+        }
+        if (options.revocationList !== undefined) {
+            this.context.loadRevocationList(normalizeWireBytes(options.revocationList));
+        }
+        this.mcp = createMcp(this.context, (decision, tool) => applyDecision(decision, tool));
+    }
+    tool(inner, policy) {
+        if (toolPolicies.has(inner) || wrappedInners.has(inner)) {
+            throw new TenuoConfigurationError("tenuo.tool() already wrapped this tool");
+        }
+        const capability = capabilityName(inner, policy);
+        const original = inner.execute;
+        const execute = async (args, callOptions) => {
+            const session = resolveSession(callOptions);
+            const decision = this.context.authorize(nativeSession(session), capability, args, approvalsFrom(callOptions), policy.allow, requestIdFrom(callOptions));
+            emitReceipt(callOptions, decision.receipt);
+            if (decision.outcome === "allow") {
+                return original(plainArgs(decision.args), forwardExecuteOptions(callOptions));
+            }
+            if (decision.outcome === "approval_required") {
+                throw new ApprovalRequiredError(decision.tool ?? capability, decision.required ?? 1, decision.received ?? 0, decision.message);
+            }
+            throw new AuthorizationDeniedError(decision.code ?? "TENUO_TOOL_NOT_AUTHORIZED", explainDeny(decision.message ?? "Authorization denied", decision.field), decision.field);
+        };
+        const wrapped = Object.assign(Object.create(Object.getPrototypeOf(inner)), inner, {
+            execute,
+        });
+        wrappedInners.add(inner);
+        toolPolicies.set(wrapped, { capability, allow: { ...policy.allow } });
+        return wrapped;
+    }
+    session(input) {
+        const allow = collectSessionAllow(input);
+        if (Object.keys(allow).length === 0) {
+            throw new TenuoConfigurationError("tenuo.session() requires tools from tenuo.tool() or at least one capability in allow");
+        }
+        if (!this.canMint) {
+            throw new TenuoConfigurationError("session() mints a warrant and needs a local issuer. Use createTenuo({ root: createTenuo.devRoot() }).");
+        }
+        const ttl = input.ttlSeconds ?? 0;
+        if (input.requireApproval !== undefined) {
+            if (input.requireApproval.approvers.length === 0) {
+                throw new TenuoConfigurationError("requireApproval.approvers must not be empty");
+            }
+            if (input.requireApproval.min < 1) {
+                throw new TenuoConfigurationError("requireApproval.min must be at least 1");
+            }
+        }
+        const native = this.context.mint(allow, ttl, requireApprovalJson(input.requireApproval));
+        return new Session(native);
+    }
+    sessionFromWire(input) {
+        if (!(input.holderKey instanceof Uint8Array) || input.holderKey.length !== 32) {
+            throw new TenuoConfigurationError("sessionFromWire() requires a 32-byte holderKey");
+        }
+        if (typeof input.warrant === "string" && input.warrant.trim().length === 0) {
+            throw new TenuoConfigurationError("sessionFromWire() requires a warrant");
+        }
+        try {
+            if (typeof input.warrant === "string") {
+                return new Session(importSessionFromWire(input.warrant, input.holderKey));
+            }
+            if (input.warrant.length === 0) {
+                throw new TenuoConfigurationError("sessionFromWire() requires a warrant");
+            }
+            return new Session(importSessionFromChain([...input.warrant], input.holderKey));
+        }
+        catch (error) {
+            throw importWireError(error);
+        }
+    }
+    withSession(session, fn) {
+        if (!isSession(session)) {
+            throw new TenuoConfigurationError("withSession() requires a Tenuo Session, not a plain object");
+        }
+        return currentSession.run(session, fn);
+    }
+    narrow(session, allow) {
+        if (Object.keys(allow).length === 0) {
+            throw new TenuoConfigurationError("tenuo.narrow() requires a non-empty allow policy");
+        }
+        if (!isSession(session)) {
+            throw new TenuoConfigurationError("narrow() requires a Tenuo Session, not a plain object");
+        }
+        try {
+            return new Session(this.context.narrow(nativeSession(session), allow));
+        }
+        catch (error) {
+            const message = error instanceof Error ? error.message : String(error);
+            if (message.startsWith("TENUO_CHAIN_INVALID")) {
+                throw new AuthorizationDeniedError("TENUO_CHAIN_INVALID", message);
+            }
+            throw new TenuoConfigurationError(message);
+        }
+    }
+    revoke(list) {
+        this.context.loadRevocationList(normalizeWireBytes(list));
+    }
+    ready() {
+        loadWasm();
+    }
+}
+function plainArgs(value) {
+    if (value instanceof Map) {
+        return Object.fromEntries(value);
+    }
+    if (value !== null && typeof value === "object" && !Array.isArray(value)) {
+        return { ...value };
+    }
+    return {};
+}
+function requireApprovalJson(require) {
+    if (require === undefined) {
+        return undefined;
+    }
+    const payload = {
+        approvers: require.approvers.map((approver) => approver.hex),
+        min: require.min,
+    };
+    if (require.tools !== undefined) {
+        payload.tools = [...require.tools];
+    }
+    return payload;
+}
+function applyDecision(decision, tool) {
+    if (decision.outcome === "allow") {
+        return;
+    }
+    if (decision.outcome === "approval_required") {
+        throw new ApprovalRequiredError(decision.tool ?? tool, decision.required ?? 1, decision.received ?? 0, decision.message);
+    }
+    throw new AuthorizationDeniedError(decision.code ?? "TENUO_TOOL_NOT_AUTHORIZED", explainDeny(decision.message ?? "Authorization denied", decision.field), decision.field);
+}
+function explainDeny(message, field) {
+    if (!message.includes("unknown field not allowed")) {
+        return message;
+    }
+    const named = field !== undefined && field.length > 0 ? `'${field}'` : "this argument";
+    return `${message}. Zero-trust: name ${named} in allow (e.g. ${named}: pattern("*")), or drop it from the call. Empty allow: {} adds no extra ceiling.`;
+}
+function forwardExecuteOptions(callOptions) {
+    if (callOptions === null || typeof callOptions !== "object") {
+        return callOptions;
+    }
+    const rest = {};
+    for (const [key, value] of Object.entries(callOptions)) {
+        if (key === "session" ||
+            key === "approvals" ||
+            key === "onReceipt" ||
+            key === "requestId") {
+            continue;
+        }
+        rest[key] = value;
+    }
+    return Object.keys(rest).length === 0 ? undefined : rest;
+}
+function importWireError(error) {
+    const message = error instanceof Error ? error.message : String(error);
+    if (message.startsWith("TENUO_CHAIN_INVALID") || message.includes("invalid warrant")) {
+        return new TenuoError("TENUO_CHAIN_INVALID", message);
+    }
+    if (message.startsWith("TENUO_SIGNATURE_INVALID")) {
+        return new TenuoError("TENUO_SIGNATURE_INVALID", message);
+    }
+    if (message.startsWith("TENUO_UNTRUSTED_ROOT")) {
+        return new TenuoError("TENUO_UNTRUSTED_ROOT", message);
+    }
+    return new TenuoConfigurationError(message);
+}
+function normalizeWireBytes(value) {
+    if (typeof value === "string") {
+        return value;
+    }
+    return Array.from(value, (byte) => byte.toString(16).padStart(2, "0")).join("");
+}
+function emitReceipt(callOptions, receipt) {
+    if (receipt === undefined || callOptions === null || typeof callOptions !== "object") {
+        return;
+    }
+    if (!("onReceipt" in callOptions)) {
+        return;
+    }
+    const onReceipt = callOptions.onReceipt;
+    if (typeof onReceipt !== "function") {
+        return;
+    }
+    try {
+        const result = onReceipt(receipt);
+        if (result !== null && typeof result === "object" && "then" in result && typeof result.then === "function") {
+            void Promise.resolve(result).catch(() => undefined);
+        }
+    }
+    catch {
+        // Receipt hooks must not deny or fail the tool.
+    }
+}
+function requestIdFrom(callOptions) {
+    if (callOptions !== null && typeof callOptions === "object" && "requestId" in callOptions) {
+        const value = callOptions.requestId;
+        if (typeof value === "string" && value.length > 0) {
+            return value;
+        }
+    }
+    return undefined;
+}
+function approvalsFrom(callOptions) {
+    if (callOptions !== null && typeof callOptions === "object" && "approvals" in callOptions) {
+        return callOptions.approvals;
+    }
+    return undefined;
+}
+function resolveSession(callOptions) {
+    if (callOptions !== null && typeof callOptions === "object" && "session" in callOptions) {
+        const explicit = callOptions.session;
+        if (!isSession(explicit)) {
+            throw new TenuoConfigurationError("options.session must be a Tenuo Session");
+        }
+        return explicit;
+    }
+    const ambient = currentSession.getStore();
+    if (ambient === undefined) {
+        throw new TenuoConfigurationError("No session. Wrap the call in tenuo.withSession(session, ...) or pass { session }.");
+    }
+    return ambient;
+}
+function collectSessionAllow(input) {
+    const allow = { ...(input.allow ?? {}) };
+    for (const tool of input.tools ?? []) {
+        if (tool === null || typeof tool !== "object") {
+            throw new TenuoConfigurationError("session({ tools }) requires tools from tenuo.tool()");
+        }
+        const policy = toolPolicies.get(tool);
+        if (policy === undefined) {
+            throw new TenuoConfigurationError("session({ tools }) requires tools from tenuo.tool()");
+        }
+        const existing = allow[policy.capability];
+        if (existing !== undefined && !sameAllow(existing, policy.allow)) {
+            throw new TenuoConfigurationError(`session() allow and tools disagree on ${policy.capability}`);
+        }
+        allow[policy.capability] = policy.allow;
+    }
+    return allow;
+}
+function sameAllow(left, right) {
+    return JSON.stringify(sortedAllow(left)) === JSON.stringify(sortedAllow(right));
+}
+function sortedAllow(allow) {
+    const keys = Object.keys(allow).sort();
+    const out = {};
+    for (const key of keys) {
+        const value = allow[key];
+        if (value !== undefined) {
+            out[key] = value;
+        }
+    }
+    return out;
+}
+function createTenuoImpl(options = {}) {
+    if (!hasTrustAnchor(options)) {
+        throw new TenuoConfigurationError("createTenuo() requires trustedRoots or root: createTenuo.devRoot(). An empty trust set is not a configuration.");
+    }
+    if (options.root?.kind === "dev-root" && !devRootAllowed(options.root)) {
+        throw new TenuoConfigurationError(devRootBlockedMessage());
+    }
+    loadWasm();
+    return new TenuoClient(options);
+}
+export const createTenuo = Object.assign(createTenuoImpl, {
+    devRoot,
+    publicKeyFromEnv,
+    publicKeyFromHex,
+    publicKeyFromBytes,
+    holderKeyFromEnv,
+    holderKeyFromHex,
+});
+//# sourceMappingURL=client.js.map

package/dist/client.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"client.js","sourceRoot":"","sources":["../src/client.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,iBAAiB,EAAE,MAAM,kBAAkB,CAAC;AAerD,OAAO,EAAE,SAAS,EAAE,MAAM,UAAU,CAAC;AACrC,OAAO,EAAE,wBAAwB,EAAE,qBAAqB,EAAE,uBAAuB,EAAE,UAAU,EAAE,MAAM,aAAa,CAAC;AACnH,OAAO,EAAE,OAAO,EAAE,SAAS,EAAE,aAAa,EAAE,MAAM,cAAc,CAAC;AACjE,OAAO,EACL,gBAAgB,EAChB,qBAAqB,EACrB,sBAAsB,EACtB,qBAAqB,EACrB,QAAQ,GAET,MAAM,WAAW,CAAC;AAEnB,MAAM,cAAc,GAAG,IAAI,iBAAiB,EAAW,CAAC;AACxD,MAAM,YAAY,GAAG,IAAI,OAAO,EAAsD,CAAC;AACvF,MAAM,aAAa,GAAG,IAAI,OAAO,EAAU,CAAC;AAE5C,SAAS,OAAO;IACd,IAAI,OAAO,OAAO,KAAK,WAAW,EAAE,CAAC;QACnC,OAAO,SAAS,CAAC;IACnB,CAAC;IACD,OAAO,OAAO,CAAC,GAAG,CAAC,QAAQ,CAAC;AAC9B,CAAC;AAED,SAAS,QAAQ;IACf,IAAI,OAAO,OAAO,KAAK,WAAW,EAAE,CAAC;QACnC,OAAO,KAAK,CAAC;IACf,CAAC;IACD,OAAO,OAAO,CAAC,GAAG,CAAC,eAAe,KAAK,GAAG,CAAC;AAC7C,CAAC;AAED,MAAM,UAAU,OAAO,CAAC,OAAkD;IACxE,MAAM,IAAI,GAAY;QACpB,IAAI,EAAE,UAAU;QAChB,GAAG,CAAC,OAAO,EAAE,iBAAiB,KAAK,IAAI,CAAC,CAAC,CAAC,EAAE,iBAAiB,EAAE,IAAI,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;KAC5E,CAAC;IACF,IAAI,CAAC,cAAc,CAAC,IAAI,CAAC,EAAE,CAAC;QAC1B,MAAM,IAAI,uBAAuB,CAAC,qBAAqB,EAAE,CAAC,CAAC;IAC7D,CAAC;IACD,OAAO,IAAI,CAAC;AACd,CAAC;AAED,SAAS,cAAc,CAAC,IAAa;IACnC,IAAI,IAAI,CAAC,iBAAiB,KAAK,IAAI,IAAI,QAAQ,EAAE,EAAE,CAAC;QAClD,OAAO,IAAI,CAAC;IACd,CAAC;IACD,MAAM,GAAG,GAAG,OAAO,EAAE,CAAC;IACtB,OAAO,GAAG,KAAK,aAAa,IAAI,GAAG,KAAK,MAAM,CAAC;AACjD,CAAC;AAED,SAAS,qBAAqB;IAC5B,OAAO,4LAA4L,CAAC;AACtM,CAAC;AAED,SAAS,YAAY,CAAC,KAAa;IACjC,MAAM,GAAG,GAAG,KAAK,CAAC,IAAI,EAAE,CAAC,WAAW,EAAE,CAAC,OAAO,CAAC,KAAK,EAAE,EAAE,CAAC,CAAC;IAC1D,IAAI,CAAC,gBAAgB,CAAC,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC;QAChC,MAAM,IAAI,uBAAuB,CAC/B,mEAAmE,CACpE,CAAC;IACJ,CAAC;IACD,OAAO,GAAG,CAAC;AACb,CAAC;AAED,MAAM,UAAU,gBAAgB,CAAC,IAAY;IAC3C,IAAI,IAAI,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QACtB,MAAM,IAAI,uBAAuB,CAAC,0DAA0D,CAAC,CAAC;IAChG,CAAC;IACD,IAAI,OAAO,OAAO,KAAK,WAAW,EAAE,CAAC;QACnC,MAAM,IAAI,uBAAuB,CAC/B,wBAAwB,IAAI,+DAA+D,CAC5F,CAAC;IACJ,CAAC;IACD,MAAM,KAAK,GAAG,OAAO,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC;IAChC,IAAI,KAAK,KAAK,SAAS,IAAI,KAAK,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QAC9C,MAAM,IAAI,uBAAuB,CAC/B,wBAAwB,IAAI,kEAAkE,CAC/F,CAAC;IACJ,CAAC;IACD,OAAO,EAAE,IAAI,EAAE,YAAY,EAAE,MAAM,EAAE,KAAK,EAAE,GAAG,EAAE,YAAY,CAAC,KAAK,CAAC,EAAE,CAAC;AACzE,CAAC;AAED,MAAM,UAAU,gBAAgB,CAAC,GAAW;IAC1C,OAAO,EAAE,IAAI,EAAE,YAAY,EAAE,MAAM,EAAE,KAAK,EAAE,GAAG,EAAE,YAAY,CAAC,GAAG,CAAC,EAAE,CAAC;AACvE,CAAC;AAED,MAAM,UAAU,kBAAkB,CAAC,KAAiB;IAClD,IAAI,KAAK,CAAC,MAAM,KAAK,EAAE,EAAE,CAAC;QACxB,MAAM,IAAI,uBAAuB,CAAC,oDAAoD,CAAC,CAAC;IAC1F,CAAC;IACD,MAAM,GAAG,GAAG,KAAK,CAAC,IAAI,CAAC,KAAK,EAAE,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,QAAQ,CAAC,EAAE,CAAC,CAAC,QAAQ,CAAC,CAAC,EAAE,GAAG,CAAC,CAAC,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;IAC/E,OAAO,EAAE,IAAI,EAAE,YAAY,EAAE,MAAM,EAAE,OAAO,EAAE,GAAG,EAAE,CAAC;AACtD,CAAC;AAED,SAAS,kBAAkB,CAAC,KAAa;IACvC,MAAM,GAAG,GAAG,KAAK,CAAC,IAAI,EAAE,CAAC,WAAW,EAAE,CAAC,OAAO,CAAC,KAAK,EAAE,EAAE,CAAC,CAAC;IAC1D,IAAI,CAAC,gBAAgB,CAAC,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC;QAChC,MAAM,IAAI,uBAAuB,CAC/B,6DAA6D,CAC9D,CAAC;IACJ,CAAC;IACD,OAAO,GAAG,CAAC;AACb,CAAC;AAED,SAAS,UAAU,CAAC,GAAW;IAC7B,MAAM,KAAK,GAAG,IAAI,UAAU,CAAC,GAAG,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC;IAC7C,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,KAAK,CAAC,MAAM,EAAE,CAAC,IAAI,CAAC,EAAE,CAAC;QACzC,KAAK,CAAC,CAAC,CAAC,GAAG,MAAM,CAAC,QAAQ,CAAC,GAAG,CAAC,KAAK,CAAC,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC;IAC9D,CAAC;IACD,OAAO,KAAK,CAAC;AACf,CAAC;AAED,MAAM,UAAU,gBAAgB,CAAC,IAAY;IAC3C,IAAI,IAAI,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QACtB,MAAM,IAAI,uBAAuB,CAAC,0DAA0D,CAAC,CAAC;IAChG,CAAC;IACD,IAAI,OAAO,OAAO,KAAK,WAAW,EAAE,CAAC;QACnC,MAAM,IAAI,uBAAuB,CAC/B,wBAAwB,IAAI,6DAA6D,CAC1F,CAAC;IACJ,CAAC;IACD,MAAM,KAAK,GAAG,OAAO,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC;IAChC,IAAI,KAAK,KAAK,SAAS,IAAI,KAAK,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QAC9C,MAAM,IAAI,uBAAuB,CAC/B,wBAAwB,IAAI,gEAAgE,CAC7F,CAAC;IACJ,CAAC;IACD,OAAO,UAAU,CAAC,kBAAkB,CAAC,KAAK,CAAC,CAAC,CAAC;AAC/C,CAAC;AAED,MAAM,UAAU,gBAAgB,CAAC,GAAW;IAC1C,OAAO,UAAU,CAAC,kBAAkB,CAAC,GAAG,CAAC,CAAC,CAAC;AAC7C,CAAC;AAED,SAAS,SAAS,CAAC,OAA2B;IAC5C,MAAM,OAAO,GAAsB,EAAE,CAAC;IACtC,IAAI,OAAO,CAAC,IAAI,KAAK,SAAS,IAAI,OAAO,CAAC,IAAI,CAAC,IAAI,KAAK,YAAY,EAAE,CAAC;QACrE,OAAO,CAAC,IAAI,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC;IAC7B,CAAC;IACD,KAAK,MAAM,IAAI,IAAI,OAAO,CAAC,YAAY,IAAI,EAAE,EAAE,CAAC;QAC9C,OAAO,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;IACrB,CAAC;IACD,OAAO,OAAO,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC;AACnC,CAAC;AAED,SAAS,cAAc,CAAC,OAA2B;IACjD,IAAI,OAAO,CAAC,IAAI,KAAK,SAAS,EAAE,CAAC;QAC/B,OAAO,IAAI,CAAC;IACd,CAAC;IACD,OAAO,CAAC,OAAO,CAAC,YAAY,EAAE,MAAM,IAAI,CAAC,CAAC,GAAG,CAAC,CAAC;AACjD,CAAC;AAED,SAAS,cAAc,CAAC,KAAa,EAAE,MAAkB;IACvD,IAAI,MAAM,CAAC,UAAU,KAAK,SAAS,IAAI,MAAM,CAAC,UAAU,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;QACpE,OAAO,MAAM,CAAC,UAAU,CAAC;IAC3B,CAAC;IACD,MAAM,KAAK,GAAG,KAAyC,CAAC;IACxD,IAAI,OAAO,KAAK,CAAC,IAAI,KAAK,QAAQ,IAAI,KAAK,CAAC,IAAI,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;QAC5D,OAAO,KAAK,CAAC,IAAI,CAAC;IACpB,CAAC;IACD,IAAI,OAAO,KAAK,CAAC,EAAE,KAAK,QAAQ,IAAI,KAAK,CAAC,EAAE,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;QACxD,OAAO,KAAK,CAAC,EAAE,CAAC;IAClB,CAAC;IACD,MAAM,IAAI,uBAAuB,CAC/B,kFAAkF,CACnF,CAAC;AACJ,CAAC;AAED,MAAM,WAAW;IACE,OAAO,CAAc;IACrB,OAAO,CAAU;IACzB,GAAG,CAAW;IAEvB,YAAY,OAA2B;QACrC,IAAI,OAAO,CAAC,IAAI,EAAE,IAAI,KAAK,UAAU,EAAE,CAAC;YACtC,IAAI,CAAC,OAAO,GAAG,gBAAgB,EAAE,CAAC;YAClC,IAAI,CAAC,OAAO,GAAG,IAAI,CAAC;QACtB,CAAC;aAAM,CAAC;YACN,IAAI,CAAC,OAAO,GAAG,qBAAqB,CAAC,SAAS,CAAC,OAAO,CAAC,CAAC,CAAC;YACzD,IAAI,CAAC,OAAO,GAAG,KAAK,CAAC;QACvB,CAAC;QACD,IAAI,OAAO,CAAC,cAAc,KAAK,SAAS,EAAE,CAAC;YACzC,IAAI,CAAC,OAAO,CAAC,kBAAkB,CAAC,kBAAkB,CAAC,OAAO,CAAC,cAAc,CAAC,CAAC,CAAC;QAC9E,CAAC;QACD,IAAI,CAAC,GAAG,GAAG,SAAS,CAAC,IAAI,CAAC,OAAO,EAAE,CAAC,QAAQ,EAAE,IAAI,EAAE,EAAE,CAAC,aAAa,CAAC,QAAQ,EAAE,IAAI,CAAC,CAAC,CAAC;IACxF,CAAC;IAED,IAAI,CACF,KAAQ,EACR,MAAkB;QAElB,IAAI,YAAY,CAAC,GAAG,CAAC,KAAK,CAAC,IAAI,aAAa,CAAC,GAAG,CAAC,KAAK,CAAC,EAAE,CAAC;YACxD,MAAM,IAAI,uBAAuB,CAAC,wCAAwC,CAAC,CAAC;QAC9E,CAAC;QACD,MAAM,UAAU,GAAG,cAAc,CAAC,KAAK,EAAE,MAAM,CAAC,CAAC;QACjD,MAAM,QAAQ,GAAG,KAAK,CAAC,OAGX,CAAC;QACb,MAAM,OAAO,GAAG,KAAK,EAAE,IAAW,EAAE,WAAqB,EAAE,EAAE;YAC3D,MAAM,OAAO,GAAG,cAAc,CAAC,WAAW,CAAC,CAAC;YAC5C,MAAM,QAAQ,GAAG,IAAI,CAAC,OAAO,CAAC,SAAS,CACrC,aAAa,CAAC,OAAO,CAAC,EACtB,UAAU,EACV,IAAI,EACJ,aAAa,CAAC,WAAW,CAAC,EAC1B,MAAM,CAAC,KAAK,EACZ,aAAa,CAAC,WAAW,CAAC,CAC3B,CAAC;YACF,WAAW,CAAC,WAAW,EAAE,QAAQ,CAAC,OAAO,CAAC,CAAC;YAC3C,IAAI,QAAQ,CAAC,OAAO,KAAK,OAAO,EAAE,CAAC;gBACjC,OAAO,QAAQ,CAAC,SAAS,CAAC,QAAQ,CAAC,IAAI,CAAC,EAAE,qBAAqB,CAAC,WAAW,CAAC,CAAC,CAAC;YAChF,CAAC;YACD,IAAI,QAAQ,CAAC,OAAO,KAAK,mBAAmB,EAAE,CAAC;gBAC7C,MAAM,IAAI,qBAAqB,CAC7B,QAAQ,CAAC,IAAI,IAAI,UAAU,EAC3B,QAAQ,CAAC,QAAQ,IAAI,CAAC,EACtB,QAAQ,CAAC,QAAQ,IAAI,CAAC,EACtB,QAAQ,CAAC,OAAO,CACjB,CAAC;YACJ,CAAC;YACD,MAAM,IAAI,wBAAwB,CAChC,QAAQ,CAAC,IAAI,IAAI,2BAA2B,EAC5C,WAAW,CAAC,QAAQ,CAAC,OAAO,IAAI,sBAAsB,EAAE,QAAQ,CAAC,KAAK,CAAC,EACvE,QAAQ,CAAC,KAAK,CACf,CAAC;QACJ,CAAC,CAAC;QAEF,MAAM,OAAO,GAAG,MAAM,CAAC,MAAM,CAAC,MAAM,CAAC,MAAM,CAAC,MAAM,CAAC,cAAc,CAAC,KAAK,CAAC,CAAC,EAAE,KAAK,EAAE;YAChF,OAAO;SACR,CAAqB,CAAC;QACvB,aAAa,CAAC,GAAG,CAAC,KAAK,CAAC,CAAC;QACzB,YAAY,CAAC,GAAG,CAAC,OAAO,EAAE,EAAE,UAAU,EAAE,KAAK,EAAE,EAAE,GAAG,MAAM,CAAC,KAAK,EAAE,EAAE,CAAC,CAAC;QACtE,OAAO,OAAO,CAAC;IACjB,CAAC;IAED,OAAO,CAAC,KAAmB;QACzB,MAAM,KAAK,GAAG,mBAAmB,CAAC,KAAK,CAAC,CAAC;QACzC,IAAI,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;YACpC,MAAM,IAAI,uBAAuB,CAC/B,sFAAsF,CACvF,CAAC;QACJ,CAAC;QACD,IAAI,CAAC,IAAI,CAAC,OAAO,EAAE,CAAC;YAClB,MAAM,IAAI,uBAAuB,CAC/B,uGAAuG,CACxG,CAAC;QACJ,CAAC;QACD,MAAM,GAAG,GAAG,KAAK,CAAC,UAAU,IAAI,CAAC,CAAC;QAClC,IAAI,KAAK,CAAC,eAAe,KAAK,SAAS,EAAE,CAAC;YACxC,IAAI,KAAK,CAAC,eAAe,CAAC,SAAS,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;gBACjD,MAAM,IAAI,uBAAuB,CAAC,6CAA6C,CAAC,CAAC;YACnF,CAAC;YACD,IAAI,KAAK,CAAC,eAAe,CAAC,GAAG,GAAG,CAAC,EAAE,CAAC;gBAClC,MAAM,IAAI,uBAAuB,CAAC,wCAAwC,CAAC,CAAC;YAC9E,CAAC;QACH,CAAC;QACD,MAAM,MAAM,GAAG,IAAI,CAAC,OAAO,CAAC,IAAI,CAAC,KAAK,EAAE,GAAG,EAAE,mBAAmB,CAAC,KAAK,CAAC,eAAe,CAAC,CAAC,CAAC;QACzF,OAAO,IAAI,OAAO,CAAC,MAAM,CAAC,CAAC;IAC7B,CAAC;IAED,eAAe,CAAC,KAA2B;QACzC,IAAI,CAAC,CAAC,KAAK,CAAC,SAAS,YAAY,UAAU,CAAC,IAAI,KAAK,CAAC,SAAS,CAAC,MAAM,KAAK,EAAE,EAAE,CAAC;YAC9E,MAAM,IAAI,uBAAuB,CAAC,gDAAgD,CAAC,CAAC;QACtF,CAAC;QACD,IAAI,OAAO,KAAK,CAAC,OAAO,KAAK,QAAQ,IAAI,KAAK,CAAC,OAAO,CAAC,IAAI,EAAE,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;YAC3E,MAAM,IAAI,uBAAuB,CAAC,sCAAsC,CAAC,CAAC;QAC5E,CAAC;QACD,IAAI,CAAC;YACH,IAAI,OAAO,KAAK,CAAC,OAAO,KAAK,QAAQ,EAAE,CAAC;gBACtC,OAAO,IAAI,OAAO,CAAC,qBAAqB,CAAC,KAAK,CAAC,OAAO,EAAE,KAAK,CAAC,SAAS,CAAC,CAAC,CAAC;YAC5E,CAAC;YACD,IAAI,KAAK,CAAC,OAAO,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;gBAC/B,MAAM,IAAI,uBAAuB,CAAC,sCAAsC,CAAC,CAAC;YAC5E,CAAC;YACD,OAAO,IAAI,OAAO,CAAC,sBAAsB,CAAC,CAAC,GAAG,KAAK,CAAC,OAAO,CAAC,EAAE,KAAK,CAAC,SAAS,CAAC,CAAC,CAAC;QAClF,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,MAAM,eAAe,CAAC,KAAK,CAAC,CAAC;QAC/B,CAAC;IACH,CAAC;IAED,WAAW,CAAI,OAAgB,EAAE,EAAW;QAC1C,IAAI,CAAC,SAAS,CAAC,OAAO,CAAC,EAAE,CAAC;YACxB,MAAM,IAAI,uBAAuB,CAAC,4DAA4D,CAAC,CAAC;QAClG,CAAC;QACD,OAAO,cAAc,CAAC,GAAG,CAAC,OAAO,EAAE,EAAE,CAAC,CAAC;IACzC,CAAC;IAED,MAAM,CAAC,OAAgB,EAAE,KAAkB;QACzC,IAAI,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;YACpC,MAAM,IAAI,uBAAuB,CAAC,kDAAkD,CAAC,CAAC;QACxF,CAAC;QACD,IAAI,CAAC,SAAS,CAAC,OAAO,CAAC,EAAE,CAAC;YACxB,MAAM,IAAI,uBAAuB,CAAC,uDAAuD,CAAC,CAAC;QAC7F,CAAC;QACD,IAAI,CAAC;YACH,OAAO,IAAI,OAAO,CAAC,IAAI,CAAC,OAAO,CAAC,MAAM,CAAC,aAAa,CAAC,OAAO,CAAC,EAAE,KAAK,CAAC,CAAC,CAAC;QACzE,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,MAAM,OAAO,GAAG,KAAK,YAAY,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;YACvE,IAAI,OAAO,CAAC,UAAU,CAAC,qBAAqB,CAAC,EAAE,CAAC;gBAC9C,MAAM,IAAI,wBAAwB,CAAC,qBAAqB,EAAE,OAAO,CAAC,CAAC;YACrE,CAAC;YACD,MAAM,IAAI,uBAAuB,CAAC,OAAO,CAAC,CAAC;QAC7C,CAAC;IACH,CAAC;IAED,MAAM,CAAC,IAAyB;QAC9B,IAAI,CAAC,OAAO,CAAC,kBAAkB,CAAC,kBAAkB,CAAC,IAAI,CAAC,CAAC,CAAC;IAC5D,CAAC;IAED,KAAK;QACH,QAAQ,EAAE,CAAC;IACb,CAAC;CACF;AAED,SAAS,SAAS,CAAC,KAAc;IAC/B,IAAI,KAAK,YAAY,GAAG,EAAE,CAAC;QACzB,OAAO,MAAM,CAAC,WAAW,CAAC,KAAK,CAAC,CAAC;IACnC,CAAC;IACD,IAAI,KAAK,KAAK,IAAI,IAAI,OAAO,KAAK,KAAK,QAAQ,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC,EAAE,CAAC;QACzE,OAAO,EAAE,GAAI,KAAiC,EAAE,CAAC;IACnD,CAAC;IACD,OAAO,EAAE,CAAC;AACZ,CAAC;AAED,SAAS,mBAAmB,CAC1B,OAAwC;IAExC,IAAI,OAAO,KAAK,SAAS,EAAE,CAAC;QAC1B,OAAO,SAAS,CAAC;IACnB,CAAC;IACD,MAAM,OAAO,GAA2D;QACtE,SAAS,EAAE,OAAO,CAAC,SAAS,CAAC,GAAG,CAAC,CAAC,QAAQ,EAAE,EAAE,CAAC,QAAQ,CAAC,GAAG,CAAC;QAC5D,GAAG,EAAE,OAAO,CAAC,GAAG;KACjB,CAAC;IACF,IAAI,OAAO,CAAC,KAAK,KAAK,SAAS,EAAE,CAAC;QAChC,OAAO,CAAC,KAAK,GAAG,CAAC,GAAG,OAAO,CAAC,KAAK,CAAC,CAAC;IACrC,CAAC;IACD,OAAO,OAAO,CAAC;AACjB,CAAC;AAED,SAAS,aAAa,CAAC,QAAmI,EAAE,IAAY;IACtK,IAAI,QAAQ,CAAC,OAAO,KAAK,OAAO,EAAE,CAAC;QACjC,OAAO;IACT,CAAC;IACD,IAAI,QAAQ,CAAC,OAAO,KAAK,mBAAmB,EAAE,CAAC;QAC7C,MAAM,IAAI,qBAAqB,CAC7B,QAAQ,CAAC,IAAI,IAAI,IAAI,EACrB,QAAQ,CAAC,QAAQ,IAAI,CAAC,EACtB,QAAQ,CAAC,QAAQ,IAAI,CAAC,EACtB,QAAQ,CAAC,OAAO,CACjB,CAAC;IACJ,CAAC;IACD,MAAM,IAAI,wBAAwB,CAC/B,QAAQ,CAAC,IAAmC,IAAI,2BAA2B,EAC5E,WAAW,CAAC,QAAQ,CAAC,OAAO,IAAI,sBAAsB,EAAE,QAAQ,CAAC,KAAK,CAAC,EACvE,QAAQ,CAAC,KAAK,CACf,CAAC;AACJ,CAAC;AAED,SAAS,WAAW,CAAC,OAAe,EAAE,KAAc;IAClD,IAAI,CAAC,OAAO,CAAC,QAAQ,CAAC,2BAA2B,CAAC,EAAE,CAAC;QACnD,OAAO,OAAO,CAAC;IACjB,CAAC;IACD,MAAM,KAAK,GAAG,KAAK,KAAK,SAAS,IAAI,KAAK,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC,IAAI,KAAK,GAAG,CAAC,CAAC,CAAC,eAAe,CAAC;IACvF,OAAO,GAAG,OAAO,sBAAsB,KAAK,mBAAmB,KAAK,mFAAmF,CAAC;AAC1J,CAAC;AAED,SAAS,qBAAqB,CAAC,WAAoB;IACjD,IAAI,WAAW,KAAK,IAAI,IAAI,OAAO,WAAW,KAAK,QAAQ,EAAE,CAAC;QAC5D,OAAO,WAAW,CAAC;IACrB,CAAC;IACD,MAAM,IAAI,GAA4B,EAAE,CAAC;IACzC,KAAK,MAAM,CAAC,GAAG,EAAE,KAAK,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,WAAsC,CAAC,EAAE,CAAC;QAClF,IACE,GAAG,KAAK,SAAS;YACjB,GAAG,KAAK,WAAW;YACnB,GAAG,KAAK,WAAW;YACnB,GAAG,KAAK,WAAW,EACnB,CAAC;YACD,SAAS;QACX,CAAC;QACD,IAAI,CAAC,GAAG,CAAC,GAAG,KAAK,CAAC;IACpB,CAAC;IACD,OAAO,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,MAAM,KAAK,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,IAAI,CAAC;AAC3D,CAAC;AAED,SAAS,eAAe,CAAC,KAAc;IACrC,MAAM,OAAO,GAAG,KAAK,YAAY,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;IACvE,IAAI,OAAO,CAAC,UAAU,CAAC,qBAAqB,CAAC,IAAI,OAAO,CAAC,QAAQ,CAAC,iBAAiB,CAAC,EAAE,CAAC;QACrF,OAAO,IAAI,UAAU,CAAC,qBAAqB,EAAE,OAAO,CAAC,CAAC;IACxD,CAAC;IACD,IAAI,OAAO,CAAC,UAAU,CAAC,yBAAyB,CAAC,EAAE,CAAC;QAClD,OAAO,IAAI,UAAU,CAAC,yBAAyB,EAAE,OAAO,CAAC,CAAC;IAC5D,CAAC;IACD,IAAI,OAAO,CAAC,UAAU,CAAC,sBAAsB,CAAC,EAAE,CAAC;QAC/C,OAAO,IAAI,UAAU,CAAC,sBAAsB,EAAE,OAAO,CAAC,CAAC;IACzD,CAAC;IACD,OAAO,IAAI,uBAAuB,CAAC,OAAO,CAAC,CAAC;AAC9C,CAAC;AAED,SAAS,kBAAkB,CAAC,KAA0B;IACpD,IAAI,OAAO,KAAK,KAAK,QAAQ,EAAE,CAAC;QAC9B,OAAO,KAAK,CAAC;IACf,CAAC;IACD,OAAO,KAAK,CAAC,IAAI,CAAC,KAAK,EAAE,CAAC,IAAI,EAAE,EAAE,CAAC,IAAI,CAAC,QAAQ,CAAC,EAAE,CAAC,CAAC,QAAQ,CAAC,CAAC,EAAE,GAAG,CAAC,CAAC,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;AAClF,CAAC;AAED,SAAS,WAAW,CAAC,WAAoB,EAAE,OAA2B;IACpE,IAAI,OAAO,KAAK,SAAS,IAAI,WAAW,KAAK,IAAI,IAAI,OAAO,WAAW,KAAK,QAAQ,EAAE,CAAC;QACrF,OAAO;IACT,CAAC;IACD,IAAI,CAAC,CAAC,WAAW,IAAI,WAAW,CAAC,EAAE,CAAC;QAClC,OAAO;IACT,CAAC;IACD,MAAM,SAAS,GAAI,WAAuC,CAAC,SAAS,CAAC;IACrE,IAAI,OAAO,SAAS,KAAK,UAAU,EAAE,CAAC;QACpC,OAAO;IACT,CAAC;IACD,IAAI,CAAC;QACH,MAAM,MAAM,GAAG,SAAS,CAAC,OAAO,CAAC,CAAC;QAClC,IAAI,MAAM,KAAK,IAAI,IAAI,OAAO,MAAM,KAAK,QAAQ,IAAI,MAAM,IAAI,MAAM,IAAI,OAAO,MAAM,CAAC,IAAI,KAAK,UAAU,EAAE,CAAC;YAC3G,KAAK,OAAO,CAAC,OAAO,CAAC,MAAM,CAAC,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,SAAS,CAAC,CAAC;QACtD,CAAC;IACH,CAAC;IAAC,MAAM,CAAC;QACP,gDAAgD;IAClD,CAAC;AACH,CAAC;AAED,SAAS,aAAa,CAAC,WAAoB;IACzC,IAAI,WAAW,KAAK,IAAI,IAAI,OAAO,WAAW,KAAK,QAAQ,IAAI,WAAW,IAAI,WAAW,EAAE,CAAC;QAC1F,MAAM,KAAK,GAAI,WAAuC,CAAC,SAAS,CAAC;QACjE,IAAI,OAAO,KAAK,KAAK,QAAQ,IAAI,KAAK,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;YAClD,OAAO,KAAK,CAAC;QACf,CAAC;IACH,CAAC;IACD,OAAO,SAAS,CAAC;AACnB,CAAC;AAED,SAAS,aAAa,CAAC,WAAoB;IACzC,IAAI,WAAW,KAAK,IAAI,IAAI,OAAO,WAAW,KAAK,QAAQ,IAAI,WAAW,IAAI,WAAW,EAAE,CAAC;QAC1F,OAAQ,WAAuC,CAAC,SAAS,CAAC;IAC5D,CAAC;IACD,OAAO,SAAS,CAAC;AACnB,CAAC;AAED,SAAS,cAAc,CAAC,WAAoB;IAC1C,IAAI,WAAW,KAAK,IAAI,IAAI,OAAO,WAAW,KAAK,QAAQ,IAAI,SAAS,IAAI,WAAW,EAAE,CAAC;QACxF,MAAM,QAAQ,GAAI,WAAoC,CAAC,OAAO,CAAC;QAC/D,IAAI,CAAC,SAAS,CAAC,QAAQ,CAAC,EAAE,CAAC;YACzB,MAAM,IAAI,uBAAuB,CAAC,yCAAyC,CAAC,CAAC;QAC/E,CAAC;QACD,OAAO,QAAQ,CAAC;IAClB,CAAC;IACD,MAAM,OAAO,GAAG,cAAc,CAAC,QAAQ,EAAE,CAAC;IAC1C,IAAI,OAAO,KAAK,SAAS,EAAE,CAAC;QAC1B,MAAM,IAAI,uBAAuB,CAC/B,mFAAmF,CACpF,CAAC;IACJ,CAAC;IACD,OAAO,OAAO,CAAC;AACjB,CAAC;AAED,SAAS,mBAAmB,CAAC,KAAmB;IAC9C,MAAM,KAAK,GAA0C,EAAE,GAAG,CAAC,KAAK,CAAC,KAAK,IAAI,EAAE,CAAC,EAAE,CAAC;IAChF,KAAK,MAAM,IAAI,IAAI,KAAK,CAAC,KAAK,IAAI,EAAE,EAAE,CAAC;QACrC,IAAI,IAAI,KAAK,IAAI,IAAI,OAAO,IAAI,KAAK,QAAQ,EAAE,CAAC;YAC9C,MAAM,IAAI,uBAAuB,CAAC,qDAAqD,CAAC,CAAC;QAC3F,CAAC;QACD,MAAM,MAAM,GAAG,YAAY,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC;QACtC,IAAI,MAAM,KAAK,SAAS,EAAE,CAAC;YACzB,MAAM,IAAI,uBAAuB,CAAC,qDAAqD,CAAC,CAAC;QAC3F,CAAC;QACD,MAAM,QAAQ,GAAG,KAAK,CAAC,MAAM,CAAC,UAAU,CAAC,CAAC;QAC1C,IAAI,QAAQ,KAAK,SAAS,IAAI,CAAC,SAAS,CAAC,QAAQ,EAAE,MAAM,CAAC,KAAK,CAAC,EAAE,CAAC;YACjE,MAAM,IAAI,uBAAuB,CAC/B,yCAAyC,MAAM,CAAC,UAAU,EAAE,CAC7D,CAAC;QACJ,CAAC;QACD,KAAK,CAAC,MAAM,CAAC,UAAU,CAAC,GAAG,MAAM,CAAC,KAAK,CAAC;IAC1C,CAAC;IACD,OAAO,KAAK,CAAC;AACf,CAAC;AAED,SAAS,SAAS,CAAC,IAAiB,EAAE,KAAkB;IACtD,OAAO,IAAI,CAAC,SAAS,CAAC,WAAW,CAAC,IAAI,CAAC,CAAC,KAAK,IAAI,CAAC,SAAS,CAAC,WAAW,CAAC,KAAK,CAAC,CAAC,CAAC;AAClF,CAAC;AAED,SAAS,WAAW,CAAC,KAAkB;IACrC,MAAM,IAAI,GAAG,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,IAAI,EAAE,CAAC;IACvC,MAAM,GAAG,GAA6C,EAAE,CAAC;IACzD,KAAK,MAAM,GAAG,IAAI,IAAI,EAAE,CAAC;QACvB,MAAM,KAAK,GAAG,KAAK,CAAC,GAAG,CAAC,CAAC;QACzB,IAAI,KAAK,KAAK,SAAS,EAAE,CAAC;YACxB,GAAG,CAAC,GAAG,CAAC,GAAG,KAAK,CAAC;QACnB,CAAC;IACH,CAAC;IACD,OAAO,GAAG,CAAC;AACb,CAAC;AAED,SAAS,eAAe,CAAC,UAA8B,EAAE;IACvD,IAAI,CAAC,cAAc,CAAC,OAAO,CAAC,EAAE,CAAC;QAC7B,MAAM,IAAI,uBAAuB,CAC/B,gHAAgH,CACjH,CAAC;IACJ,CAAC;IACD,IAAI,OAAO,CAAC,IAAI,EAAE,IAAI,KAAK,UAAU,IAAI,CAAC,cAAc,CAAC,OAAO,CAAC,IAAI,CAAC,EAAE,CAAC;QACvE,MAAM,IAAI,uBAAuB,CAAC,qBAAqB,EAAE,CAAC,CAAC;IAC7D,CAAC;IACD,QAAQ,EAAE,CAAC;IACX,OAAO,IAAI,WAAW,CAAC,OAAO,CAAC,CAAC;AAClC,CAAC;AAED,MAAM,CAAC,MAAM,WAAW,GAOpB,MAAM,CAAC,MAAM,CAAC,eAAe,EAAE;IACjC,OAAO;IACP,gBAAgB;IAChB,gBAAgB;IAChB,kBAAkB;IAClB,gBAAgB;IAChB,gBAAgB;CACjB,CAAC,CAAC"}

package/dist/constraints.d.ts

@@ -0,0 +1,11 @@
+import type { EmailConstraint, ExactConstraint, MaxConstraint, OneOfConstraint, PatternConstraint, UnderConstraint } from "./api.ts";
+/** Directory prefix. Evaluated in core as Subpath — not a string prefix check in TS. */
+export declare function under(root: string): UnderConstraint;
+export declare function email(options: {
+    domain: string;
+}): EmailConstraint;
+export declare function max(value: number): MaxConstraint;
+export declare function oneOf(values: readonly string[]): OneOfConstraint;
+export declare function pattern(pattern: string): PatternConstraint;
+export declare function exact(value: string | number | boolean): ExactConstraint;
+//# sourceMappingURL=constraints.d.ts.map

package/dist/constraints.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"constraints.d.ts","sourceRoot":"","sources":["../src/constraints.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EACV,eAAe,EACf,eAAe,EACf,aAAa,EACb,eAAe,EACf,iBAAiB,EACjB,eAAe,EAChB,MAAM,UAAU,CAAC;AAElB,wFAAwF;AACxF,wBAAgB,KAAK,CAAC,IAAI,EAAE,MAAM,GAAG,eAAe,CAKnD;AAED,wBAAgB,KAAK,CAAC,OAAO,EAAE;IAAE,MAAM,EAAE,MAAM,CAAA;CAAE,GAAG,eAAe,CAElE;AAED,wBAAgB,GAAG,CAAC,KAAK,EAAE,MAAM,GAAG,aAAa,CAKhD;AAED,wBAAgB,KAAK,CAAC,MAAM,EAAE,SAAS,MAAM,EAAE,GAAG,eAAe,CAKhE;AAED,wBAAgB,OAAO,CAAC,OAAO,EAAE,MAAM,GAAG,iBAAiB,CAK1D;AAED,wBAAgB,KAAK,CAAC,KAAK,EAAE,MAAM,GAAG,MAAM,GAAG,OAAO,GAAG,eAAe,CAEvE"}

package/dist/constraints.js

@@ -0,0 +1,32 @@
+/** Directory prefix. Evaluated in core as Subpath — not a string prefix check in TS. */
+export function under(root) {
+    if (!root.startsWith("/")) {
+        throw new Error("tenuo.under() expects an absolute path (start with /)");
+    }
+    return { kind: "under", root };
+}
+export function email(options) {
+    return { kind: "email", domain: options.domain };
+}
+export function max(value) {
+    if (!Number.isFinite(value)) {
+        throw new Error("tenuo.max() requires a finite number");
+    }
+    return { kind: "max", value };
+}
+export function oneOf(values) {
+    if (values.length === 0) {
+        throw new Error("tenuo.oneOf() requires at least one value");
+    }
+    return { kind: "oneOf", values };
+}
+export function pattern(pattern) {
+    if (pattern.length === 0) {
+        throw new Error("tenuo.pattern() requires a non-empty pattern");
+    }
+    return { kind: "pattern", pattern };
+}
+export function exact(value) {
+    return { kind: "exact", value };
+}
+//# sourceMappingURL=constraints.js.map

package/dist/constraints.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"constraints.js","sourceRoot":"","sources":["../src/constraints.ts"],"names":[],"mappings":"AASA,wFAAwF;AACxF,MAAM,UAAU,KAAK,CAAC,IAAY;IAChC,IAAI,CAAC,IAAI,CAAC,UAAU,CAAC,GAAG,CAAC,EAAE,CAAC;QAC1B,MAAM,IAAI,KAAK,CAAC,uDAAuD,CAAC,CAAC;IAC3E,CAAC;IACD,OAAO,EAAE,IAAI,EAAE,OAAO,EAAE,IAAI,EAAE,CAAC;AACjC,CAAC;AAED,MAAM,UAAU,KAAK,CAAC,OAA2B;IAC/C,OAAO,EAAE,IAAI,EAAE,OAAO,EAAE,MAAM,EAAE,OAAO,CAAC,MAAM,EAAE,CAAC;AACnD,CAAC;AAED,MAAM,UAAU,GAAG,CAAC,KAAa;IAC/B,IAAI,CAAC,MAAM,CAAC,QAAQ,CAAC,KAAK,CAAC,EAAE,CAAC;QAC5B,MAAM,IAAI,KAAK,CAAC,sCAAsC,CAAC,CAAC;IAC1D,CAAC;IACD,OAAO,EAAE,IAAI,EAAE,KAAK,EAAE,KAAK,EAAE,CAAC;AAChC,CAAC;AAED,MAAM,UAAU,KAAK,CAAC,MAAyB;IAC7C,IAAI,MAAM,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QACxB,MAAM,IAAI,KAAK,CAAC,2CAA2C,CAAC,CAAC;IAC/D,CAAC;IACD,OAAO,EAAE,IAAI,EAAE,OAAO,EAAE,MAAM,EAAE,CAAC;AACnC,CAAC;AAED,MAAM,UAAU,OAAO,CAAC,OAAe;IACrC,IAAI,OAAO,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QACzB,MAAM,IAAI,KAAK,CAAC,8CAA8C,CAAC,CAAC;IAClE,CAAC;IACD,OAAO,EAAE,IAAI,EAAE,SAAS,EAAE,OAAO,EAAE,CAAC;AACtC,CAAC;AAED,MAAM,UAAU,KAAK,CAAC,KAAgC;IACpD,OAAO,EAAE,IAAI,EAAE,OAAO,EAAE,KAAK,EAAE,CAAC;AAClC,CAAC"}

package/dist/errors.d.ts

@@ -0,0 +1,19 @@
+import type { TenuoErrorCode } from "./api.ts";
+export declare class TenuoError extends Error {
+    readonly code: TenuoErrorCode;
+    constructor(code: TenuoErrorCode, message: string);
+}
+export declare class TenuoConfigurationError extends TenuoError {
+    constructor(message: string, code?: TenuoErrorCode);
+}
+export declare class AuthorizationDeniedError extends TenuoError {
+    readonly field?: string;
+    constructor(code: TenuoErrorCode, message: string, field?: string);
+}
+export declare class ApprovalRequiredError extends TenuoError {
+    readonly tool: string;
+    readonly required: number;
+    readonly received: number;
+    constructor(tool: string, required: number, received: number, message?: string);
+}
+//# sourceMappingURL=errors.d.ts.map

package/dist/errors.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"errors.d.ts","sourceRoot":"","sources":["../src/errors.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,UAAU,CAAC;AAE/C,qBAAa,UAAW,SAAQ,KAAK;IACnC,QAAQ,CAAC,IAAI,EAAE,cAAc,CAAC;gBAElB,IAAI,EAAE,cAAc,EAAE,OAAO,EAAE,MAAM;CAKlD;AAED,qBAAa,uBAAwB,SAAQ,UAAU;gBACzC,OAAO,EAAE,MAAM,EAAE,IAAI,GAAE,cAAsC;CAI1E;AAED,qBAAa,wBAAyB,SAAQ,UAAU;IACtD,QAAQ,CAAC,KAAK,CAAC,EAAE,MAAM,CAAC;gBAEZ,IAAI,EAAE,cAAc,EAAE,OAAO,EAAE,MAAM,EAAE,KAAK,CAAC,EAAE,MAAM;CAOlE;AAED,qBAAa,qBAAsB,SAAQ,UAAU;IACnD,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;IACtB,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAC;IAC1B,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAC;gBAEd,IAAI,EAAE,MAAM,EAAE,QAAQ,EAAE,MAAM,EAAE,QAAQ,EAAE,MAAM,EAAE,OAAO,CAAC,EAAE,MAAM;CAO/E"}

package/dist/errors.js

@@ -0,0 +1,37 @@
+export class TenuoError extends Error {
+    code;
+    constructor(code, message) {
+        super(message);
+        this.name = "TenuoError";
+        this.code = code;
+    }
+}
+export class TenuoConfigurationError extends TenuoError {
+    constructor(message, code = "TENUO_CONFIGURATION") {
+        super(code, message);
+        this.name = "TenuoConfigurationError";
+    }
+}
+export class AuthorizationDeniedError extends TenuoError {
+    field;
+    constructor(code, message, field) {
+        super(code, message);
+        this.name = "AuthorizationDeniedError";
+        if (field !== undefined) {
+            this.field = field;
+        }
+    }
+}
+export class ApprovalRequiredError extends TenuoError {
+    tool;
+    required;
+    received;
+    constructor(tool, required, received, message) {
+        super("TENUO_APPROVAL_REQUIRED", message ?? `Approval required for ${tool}`);
+        this.name = "ApprovalRequiredError";
+        this.tool = tool;
+        this.required = required;
+        this.received = received;
+    }
+}
+//# sourceMappingURL=errors.js.map

package/dist/errors.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"errors.js","sourceRoot":"","sources":["../src/errors.ts"],"names":[],"mappings":"AAEA,MAAM,OAAO,UAAW,SAAQ,KAAK;IAC1B,IAAI,CAAiB;IAE9B,YAAY,IAAoB,EAAE,OAAe;QAC/C,KAAK,CAAC,OAAO,CAAC,CAAC;QACf,IAAI,CAAC,IAAI,GAAG,YAAY,CAAC;QACzB,IAAI,CAAC,IAAI,GAAG,IAAI,CAAC;IACnB,CAAC;CACF;AAED,MAAM,OAAO,uBAAwB,SAAQ,UAAU;IACrD,YAAY,OAAe,EAAE,OAAuB,qBAAqB;QACvE,KAAK,CAAC,IAAI,EAAE,OAAO,CAAC,CAAC;QACrB,IAAI,CAAC,IAAI,GAAG,yBAAyB,CAAC;IACxC,CAAC;CACF;AAED,MAAM,OAAO,wBAAyB,SAAQ,UAAU;IAC7C,KAAK,CAAU;IAExB,YAAY,IAAoB,EAAE,OAAe,EAAE,KAAc;QAC/D,KAAK,CAAC,IAAI,EAAE,OAAO,CAAC,CAAC;QACrB,IAAI,CAAC,IAAI,GAAG,0BAA0B,CAAC;QACvC,IAAI,KAAK,KAAK,SAAS,EAAE,CAAC;YACxB,IAAI,CAAC,KAAK,GAAG,KAAK,CAAC;QACrB,CAAC;IACH,CAAC;CACF;AAED,MAAM,OAAO,qBAAsB,SAAQ,UAAU;IAC1C,IAAI,CAAS;IACb,QAAQ,CAAS;IACjB,QAAQ,CAAS;IAE1B,YAAY,IAAY,EAAE,QAAgB,EAAE,QAAgB,EAAE,OAAgB;QAC5E,KAAK,CAAC,yBAAyB,EAAE,OAAO,IAAI,yBAAyB,IAAI,EAAE,CAAC,CAAC;QAC7E,IAAI,CAAC,IAAI,GAAG,uBAAuB,CAAC;QACpC,IAAI,CAAC,IAAI,GAAG,IAAI,CAAC;QACjB,IAAI,CAAC,QAAQ,GAAG,QAAQ,CAAC;QACzB,IAAI,CAAC,QAAQ,GAAG,QAAQ,CAAC;IAC3B,CAAC;CACF"}

package/dist/generated/package.json

@@ -0,0 +1 @@
+{"type":"commonjs"}