@tenuo/core 0.3.0-beta.0 → 0.3.2-beta.0

This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
Files changed (22) hide show
  1. package/LICENSE +76 -61
  2. package/dist/api.d.ts +12 -3
  3. package/dist/api.js.map +1 -1
  4. package/dist/build-info.json +8 -0
  5. package/dist/client.js +10 -4
  6. package/dist/client.js.map +1 -1
  7. package/dist/constraints.d.ts +25 -0
  8. package/dist/constraints.js +45 -0
  9. package/dist/constraints.js.map +1 -1
  10. package/dist/generated/tenuo_wasm.d.ts +27 -1
  11. package/dist/generated/tenuo_wasm.js +93 -1
  12. package/dist/generated/tenuo_wasm_bg.wasm +0 -0
  13. package/dist/generated/tenuo_wasm_bg.wasm.d.ts +4 -0
  14. package/dist/index.d.ts +2 -2
  15. package/dist/index.js +2 -2
  16. package/dist/index.js.map +1 -1
  17. package/dist/mcp.js +33 -65
  18. package/dist/mcp.js.map +1 -1
  19. package/dist/wasm.d.ts +20 -0
  20. package/dist/wasm.js +12 -0
  21. package/dist/wasm.js.map +1 -1
  22. package/package.json +13 -6
package/dist/client.js.map CHANGED
@@ -1 +1 @@
1
- {"version":3,"file":"client.js","sourceRoot":"","sources":["../src/client.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,iBAAiB,EAAE,MAAM,kBAAkB,CAAC;AACrD,OAAO,EAAE,WAAW,EAAE,MAAM,aAAa,CAAC;AAkC1C,OAAO,EAAE,iBAAiB,EAAE,MAAM,cAAc,CAAC;AACjD,OAAO,EAAE,gBAAgB,EAAE,eAAe,EAAE,MAAM,eAAe,CAAC;AAClE,OAAO,EAAE,SAAS,EAAE,WAAW,EAAE,eAAe,EAAe,MAAM,UAAU,CAAC;AAChF,OAAO,EAAE,cAAc,EAAE,mBAAmB,EAAE,uBAAuB,EAAE,MAAM,eAAe,CAAC;AAC7F,OAAO,EAAE,aAAa,EAAE,MAAM,cAAc,CAAC;AAC7C,OAAO,EAAE,wBAAwB,EAAE,qBAAqB,EAAE,uBAAuB,EAAE,UAAU,EAAE,MAAM,aAAa,CAAC;AACnH,OAAO,EAAE,OAAO,EAAE,SAAS,EAAE,aAAa,EAAE,MAAM,cAAc,CAAC;AACjE,OAAO,EACL,gBAAgB,EAChB,mBAAmB,EACnB,qBAAqB,EACrB,sBAAsB,EACtB,qBAAqB,EACrB,QAAQ,EACR,cAAc,EACd,yBAAyB,GAS1B,MAAM,WAAW,CAAC;AAEnB,MAAM,cAAc,GAAG,IAAI,iBAAiB,EAAW,CAAC;AACxD,MAAM,YAAY,GAAG,IAAI,OAAO,EAAsD,CAAC;AACvF,MAAM,aAAa,GAAG,IAAI,OAAO,EAAU,CAAC;AAE5C,MAAM,eAAe,GAAG,IAAI,GAAG,CAAC,CAAC,WAAW,EAAE,UAAU,EAAE,SAAS,EAAE,UAAU,EAAE,YAAY,EAAE,QAAQ,CAAC,CAAC,CAAC;AAE1G,SAAS,OAAO;IACd,IAAI,OAAO,OAAO,KAAK,WAAW,EAAE,CAAC;QACnC,OAAO,SAAS,CAAC;IACnB,CAAC;IACD,OAAO,OAAO,CAAC,GAAG,CAAC,QAAQ,CAAC;AAC9B,CAAC;AAED,SAAS,QAAQ;IACf,IAAI,OAAO,OAAO,KAAK,WAAW,EAAE,CAAC;QACnC,OAAO,KAAK,CAAC;IACf,CAAC;IACD,OAAO,OAAO,CAAC,GAAG,CAAC,eAAe,KAAK,GAAG,CAAC;AAC7C,CAAC;AAED,MAAM,UAAU,OAAO,CAAC,OAAkD;IACxE,MAAM,IAAI,GAAY;QACpB,IAAI,EAAE,UAAU;QAChB,GAAG,CAAC,OAAO,EAAE,iBAAiB,KAAK,IAAI,CAAC,CAAC,CAAC,EAAE,iBAAiB,EAAE,IAAI,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;KAC5E,CAAC;IACF,IAAI,CAAC,cAAc,CAAC,IAAI,CAAC,EAAE,CAAC;QAC1B,MAAM,IAAI,uBAAuB,CAAC,qBAAqB,EAAE,CAAC,CAAC;IAC7D,CAAC;IACD,OAAO,IAAI,CAAC;AACd,CAAC;AAED,SAAS,cAAc,CAAC,IAAa;IACnC,IAAI,IAAI,CAAC,iBAAiB,KAAK,IAAI,IAAI,QAAQ,EAAE,EAAE,CAAC;QAClD,OAAO,IAAI,CAAC;IACd,CAAC;IACD,MAAM,GAAG,GAAG,OAAO,EAAE,CAAC;IACtB,OAAO,GAAG,KAAK,aAAa,IAAI,GAAG,KAAK,MAAM,CAAC;AACjD,CAAC;AAED,SAAS,qBAAqB;IAC5B,OAAO,4LAA4L,CAAC;AACtM,CAAC;AAED,SAAS,YAAY,CAAC,KAAa;IACjC,MAAM,GAAG,GAAG,KAAK,CAAC,IAAI,EAAE,CAAC,WAAW,EAAE,CAAC,OAAO,CAAC,KAAK,EAAE,EAAE,CAAC,CAAC;IAC1D,IAAI,CAAC,gBAAgB,CAAC,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC;QAChC,MAAM,IAAI,uBAAuB,CAC/B,mEAAmE,CACpE,CAAC;IACJ,CAAC;IACD,OAAO,GAAG,CAAC;AACb,CAAC;AAED,SAAS,QAAQ,CAAC,IAAY,EAAE,IAAY;IAC1C,IAAI,IAAI,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QACtB,MAAM,IAAI,uBAAuB,CAAC,GAAG,IAAI,wCAAwC,CAAC,CAAC;IACrF,CAAC;IACD,IAAI,OAAO,OAAO,KAAK,WAAW,EAAE,CAAC;QACnC,MAAM,IAAI,uBAAuB,CAC/B,wBAAwB,IAAI,mDAAmD,IAAI,GAAG,CACvF,CAAC;IACJ,CAAC;IACD,MAAM,KAAK,GAAG,OAAO,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC;IAChC,IAAI,KAAK,KAAK,SAAS,IAAI,KAAK,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QAC9C,MAAM,IAAI,uBAAuB,CAC/B,wBAAwB,IAAI,sDAAsD,IAAI,GAAG,CAC1F,CAAC;IACJ,CAAC;IACD,OAAO,KAAK,CAAC;AACf,CAAC;AAED,MAAM,UAAU,gBAAgB,CAAC,IAAY;IAC3C,OAAO,EAAE,IAAI,EAAE,YAAY,EAAE,MAAM,EAAE,KAAK,EAAE,GAAG,EAAE,YAAY,CAAC,QAAQ,CAAC,IAAI,EAAE,cAAc,CAAC,CAAC,EAAE,CAAC;AAClG,CAAC;AAED,MAAM,UAAU,gBAAgB,CAAC,GAAW;IAC1C,OAAO,EAAE,IAAI,EAAE,YAAY,EAAE,MAAM,EAAE,KAAK,EAAE,GAAG,EAAE,YAAY,CAAC,GAAG,CAAC,EAAE,CAAC;AACvE,CAAC;AAED,MAAM,UAAU,kBAAkB,CAAC,KAAiB;IAClD,IAAI,KAAK,CAAC,MAAM,KAAK,EAAE,EAAE,CAAC;QACxB,MAAM,IAAI,uBAAuB,CAAC,oDAAoD,CAAC,CAAC;IAC1F,CAAC;IACD,OAAO,EAAE,IAAI,EAAE,YAAY,EAAE,MAAM,EAAE,OAAO,EAAE,GAAG,EAAE,UAAU,CAAC,KAAK,CAAC,EAAE,CAAC;AACzE,CAAC;AAED,SAAS,kBAAkB,CAAC,KAAa,EAAE,IAAY;IACrD,MAAM,GAAG,GAAG,KAAK,CAAC,IAAI,EAAE,CAAC,WAAW,EAAE,CAAC,OAAO,CAAC,KAAK,EAAE,EAAE,CAAC,CAAC;IAC1D,IAAI,CAAC,gBAAgB,CAAC,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC;QAChC,MAAM,IAAI,uBAAuB,CAAC,GAAG,IAAI,mDAAmD,CAAC,CAAC;IAChG,CAAC;IACD,OAAO,GAAG,CAAC;AACb,CAAC;AAED,SAAS,UAAU,CAAC,GAAW;IAC7B,MAAM,KAAK,GAAG,IAAI,UAAU,CAAC,GAAG,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC;IAC7C,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,KAAK,CAAC,MAAM,EAAE,CAAC,IAAI,CAAC,EAAE,CAAC;QACzC,KAAK,CAAC,CAAC,CAAC,GAAG,MAAM,CAAC,QAAQ,CAAC,GAAG,CAAC,KAAK,CAAC,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC;IAC9D,CAAC;IACD,OAAO,KAAK,CAAC;AACf,CAAC;AAED,SAAS,UAAU,CAAC,KAAiB;IACnC,OAAO,KAAK,CAAC,IAAI,CAAC,KAAK,EAAE,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,QAAQ,CAAC,EAAE,CAAC,CAAC,QAAQ,CAAC,CAAC,EAAE,GAAG,CAAC,CAAC,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;AAC5E,CAAC;AAED,MAAM,UAAU,gBAAgB,CAAC,IAAY;IAC3C,OAAO,UAAU,CAAC,kBAAkB,CAAC,QAAQ,CAAC,IAAI,EAAE,YAAY,CAAC,EAAE,YAAY,CAAC,CAAC,CAAC;AACpF,CAAC;AAED,MAAM,UAAU,gBAAgB,CAAC,GAAW;IAC1C,OAAO,UAAU,CAAC,kBAAkB,CAAC,GAAG,EAAE,YAAY,CAAC,CAAC,CAAC;AAC3D,CAAC;AAED;;;GAGG;AACH,MAAM,UAAU,iBAAiB;IAC/B,OAAO,IAAI,UAAU,CAAC,WAAW,CAAC,EAAE,CAAC,CAAC,CAAC;AACzC,CAAC;AAED,0FAA0F;AAC1F,MAAM,UAAU,iBAAiB;IAC/B,OAAO,iBAAiB,EAAE,CAAC;AAC7B,CAAC;AAED,oDAAoD;AACpD,MAAM,UAAU,sBAAsB,CAAC,SAAqB;IAC1D,IAAI,CAAC,CAAC,SAAS,YAAY,UAAU,CAAC,IAAI,SAAS,CAAC,MAAM,KAAK,EAAE,EAAE,CAAC;QAClE,MAAM,IAAI,uBAAuB,CAAC,wDAAwD,CAAC,CAAC;IAC9F,CAAC;IACD,QAAQ,EAAE,CAAC;IACX,OAAO,EAAE,IAAI,EAAE,YAAY,EAAE,MAAM,EAAE,OAAO,EAAE,GAAG,EAAE,yBAAyB,CAAC,SAAS,CAAC,EAAE,CAAC;AAC5F,CAAC;AAED,MAAM,YAAY,GAAG,WAAW,CAAC;AAEjC,SAAS,aAAa,CAAC,KAAa,EAAE,IAAY,EAAE,OAAO,GAAG,CAAC;IAC7D,IAAI,CAAC,MAAM,CAAC,SAAS,CAAC,KAAK,CAAC,IAAI,KAAK,GAAG,OAAO,IAAI,KAAK,GAAG,YAAY,EAAE,CAAC;QACxE,MAAM,IAAI,uBAAuB,CAC/B,GAAG,IAAI,+BAA+B,OAAO,QAAQ,YAAY,EAAE,CACpE,CAAC;IACJ,CAAC;IACD,OAAO,KAAK,CAAC;AACf,CAAC;AAED,qFAAqF;AACrF,MAAM,UAAU,gBAAgB,CAAC,IAAY;IAC3C,OAAO,EAAE,IAAI,EAAE,YAAY,EAAE,MAAM,EAAE,UAAU,CAAC,kBAAkB,CAAC,QAAQ,CAAC,IAAI,EAAE,YAAY,CAAC,EAAE,YAAY,CAAC,CAAC,EAAE,CAAC;AACpH,CAAC;AAED,MAAM,UAAU,gBAAgB,CAAC,GAAW;IAC1C,OAAO,EAAE,IAAI,EAAE,YAAY,EAAE,MAAM,EAAE,UAAU,CAAC,kBAAkB,CAAC,GAAG,EAAE,YAAY,CAAC,CAAC,EAAE,CAAC;AAC3F,CAAC;AAED,MAAM,UAAU,kBAAkB,CAAC,MAAkB;IACnD,IAAI,CAAC,CAAC,MAAM,YAAY,UAAU,CAAC,IAAI,MAAM,CAAC,MAAM,KAAK,EAAE,EAAE,CAAC;QAC5D,MAAM,IAAI,uBAAuB,CAAC,gDAAgD,CAAC,CAAC;IACtF,CAAC;IACD,OAAO,EAAE,IAAI,EAAE,YAAY,EAAE,MAAM,EAAE,IAAI,UAAU,CAAC,MAAM,CAAC,EAAE,CAAC;AAChE,CAAC;AAED,SAAS,YAAY,CAAC,KAAa,EAAE,IAAY;IAC/C,aAAa,CAAC,KAAK,EAAE,IAAI,CAAC,CAAC;IAC3B,MAAM,OAAO,GAAG,cAAc,EAAE,CAAC,oBAAoB,CAAC;IACtD,IAAI,KAAK,GAAG,OAAO,EAAE,CAAC;QACpB,MAAM,IAAI,uBAAuB,CAC/B,GAAG,IAAI,IAAI,KAAK,oCAAoC,OAAO,EAAE,CAC9D,CAAC;IACJ,CAAC;IACD,OAAO,KAAK,CAAC;AACf,CAAC;AAED,SAAS,UAAU,CAAC,KAAa,EAAE,IAAY,EAAE,OAAO,GAAG,CAAC;IAC1D,aAAa,CAAC,KAAK,EAAE,IAAI,EAAE,OAAO,CAAC,CAAC;IACpC,MAAM,OAAO,GAAG,cAAc,EAAE,CAAC,uBAAuB,CAAC;IACzD,IAAI,KAAK,GAAG,OAAO,EAAE,CAAC;QACpB,MAAM,IAAI,uBAAuB,CAC/B,GAAG,IAAI,IAAI,KAAK,oCAAoC,OAAO,EAAE,CAC9D,CAAC;IACJ,CAAC;IACD,OAAO,KAAK,CAAC;AACf,CAAC;AAED,SAAS,gBAAgB,CAAC,KAAc,EAAE,IAAY;IACpD,IACE,KAAK,KAAK,IAAI;QACd,OAAO,KAAK,KAAK,QAAQ;QACxB,KAA4B,CAAC,IAAI,KAAK,YAAY;QACnD,OAAQ,KAA2B,CAAC,GAAG,KAAK,QAAQ,EACpD,CAAC;QACD,MAAM,IAAI,uBAAuB,CAC/B,GAAG,IAAI,yGAAyG,CACjH,CAAC;IACJ,CAAC;IACD,OAAO,KAAwB,CAAC;AAClC,CAAC;AAED,SAAS,aAAa,CAAC,KAAgB,EAAE,IAAY;IACnD,IAAI,OAAO,KAAK,KAAK,QAAQ,EAAE,CAAC;QAC9B,IAAI,CAAC,MAAM,CAAC,SAAS,CAAC,KAAK,CAAC,IAAI,KAAK,GAAG,CAAC,IAAI,KAAK,GAAG,GAAG,EAAE,CAAC;YACzD,MAAM,IAAI,uBAAuB,CAAC,GAAG,IAAI,2CAA2C,CAAC,CAAC;QACxF,CAAC;QACD,OAAO,KAAK,CAAC;IACf,CAAC;IACD,IAAI,OAAO,KAAK,KAAK,QAAQ,IAAI,eAAe,CAAC,GAAG,CAAC,KAAK,CAAC,EAAE,CAAC;QAC5D,OAAO,KAAK,CAAC;IACf,CAAC;IACD,MAAM,IAAI,uBAAuB,CAC/B,GAAG,IAAI,mBAAmB,CAAC,GAAG,eAAe,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,sBAAsB,CAChF,CAAC;AACJ,CAAC;AAED,SAAS,SAAS,CAAC,OAA2B;IAC5C,MAAM,OAAO,GAAsB,EAAE,CAAC;IACtC,IAAI,OAAO,CAAC,IAAI,KAAK,SAAS,IAAI,OAAO,CAAC,IAAI,CAAC,IAAI,KAAK,YAAY,EAAE,CAAC;QACrE,OAAO,CAAC,IAAI,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC;IAC7B,CAAC;IACD,KAAK,MAAM,IAAI,IAAI,OAAO,CAAC,YAAY,IAAI,EAAE,EAAE,CAAC;QAC9C,OAAO,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;IACrB,CAAC;IACD,OAAO,OAAO,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC;AACnC,CAAC;AAED,SAAS,cAAc,CAAC,OAA2B;IACjD,IAAI,OAAO,CAAC,IAAI,KAAK,SAAS,EAAE,CAAC;QAC/B,OAAO,IAAI,CAAC;IACd,CAAC;IACD,OAAO,CAAC,OAAO,CAAC,YAAY,EAAE,MAAM,IAAI,CAAC,CAAC,GAAG,CAAC,CAAC;AACjD,CAAC;AAED,SAAS,cAAc,CAAC,KAAa,EAAE,MAAsC;IAC3E,IAAI,MAAM,CAAC,UAAU,KAAK,SAAS,IAAI,MAAM,CAAC,UAAU,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;QACpE,OAAO,MAAM,CAAC,UAAU,CAAC;IAC3B,CAAC;IACD,MAAM,KAAK,GAAG,KAAyC,CAAC;IACxD,IAAI,OAAO,KAAK,CAAC,IAAI,KAAK,QAAQ,IAAI,KAAK,CAAC,IAAI,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;QAC5D,OAAO,KAAK,CAAC,IAAI,CAAC;IACpB,CAAC;IACD,IAAI,OAAO,KAAK,CAAC,EAAE,KAAK,QAAQ,IAAI,KAAK,CAAC,EAAE,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;QACxD,OAAO,KAAK,CAAC,EAAE,CAAC;IAClB,CAAC;IACD,MAAM,IAAI,uBAAuB,CAC/B,kFAAkF,CACnF,CAAC;AACJ,CAAC;AAED,MAAM,WAAW;IACE,OAAO,CAAc;IACrB,OAAO,CAAU;IACzB,GAAG,CAAW;IACN,MAAM,CAAS;IAEhC,YAAY,OAA2B;QACrC,IAAI,OAAO,CAAC,IAAI,EAAE,IAAI,KAAK,UAAU,EAAE,CAAC;YACtC,IAAI,CAAC,OAAO,GAAG,gBAAgB,CAAC,OAAO,CAAC,aAAa,CAAC,CAAC;YACvD,IAAI,CAAC,OAAO,GAAG,IAAI,CAAC;QACtB,CAAC;aAAM,IAAI,OAAO,CAAC,IAAI,EAAE,IAAI,KAAK,YAAY,EAAE,CAAC;YAC/C,IAAI,CAAC,CAAC,OAAO,CAAC,IAAI,CAAC,MAAM,YAAY,UAAU,CAAC,IAAI,OAAO,CAAC,IAAI,CAAC,MAAM,CAAC,MAAM,KAAK,EAAE,EAAE,CAAC;gBACtF,MAAM,IAAI,uBAAuB,CAAC,2CAA2C,CAAC,CAAC;YACjF,CAAC;YACD,IAAI,CAAC,OAAO,GAAG,mBAAmB,CAChC,OAAO,CAAC,IAAI,CAAC,MAAM,EACnB,SAAS,CAAC,OAAO,CAAC,EAClB,OAAO,CAAC,aAAa,CACtB,CAAC;YACF,IAAI,CAAC,OAAO,GAAG,IAAI,CAAC;QACtB,CAAC;aAAM,CAAC;YACN,IAAI,CAAC,OAAO,GAAG,qBAAqB,CAClC,SAAS,CAAC,OAAO,CAAC,EAClB,SAAS,EACT,OAAO,CAAC,aAAa,CACtB,CAAC;YACF,IAAI,CAAC,OAAO,GAAG,KAAK,CAAC;QACvB,CAAC;QACD,IAAI,OAAO,CAAC,cAAc,KAAK,SAAS,EAAE,CAAC;YACzC,IAAI,CAAC,OAAO,CAAC,kBAAkB,CAAC,kBAAkB,CAAC,OAAO,CAAC,cAAc,CAAC,CAAC,CAAC;QAC9E,CAAC;QACD,IAAI,CAAC,MAAM,GAAG,CAAC,QAAQ,EAAE,IAAI,EAAE,MAAM,EAAE,IAAI,EAAE,EAAE;YAC7C,IAAI,CAAC,aAAa,CAAC,QAAQ,EAAE,IAAI,EAAE,MAAM,EAAE,IAAI,CAAC,CAAC;QACnD,CAAC,CAAC;QACF,IAAI,CAAC,GAAG,GAAG,SAAS,CAAC,IAAI,CAAC,OAAO,EAAE,IAAI,CAAC,MAAM,EAAE,IAAI,CAAC,CAAC;IACxD,CAAC;IAEO,aAAa,CACnB,QAAmI,EACnI,IAAY,EACZ,MAAe,EACf,IAA8B;QAE9B,IAAI,QAAQ,CAAC,OAAO,KAAK,OAAO,EAAE,CAAC;YACjC,OAAO;QACT,CAAC;QACD,IAAI,QAAQ,CAAC,OAAO,KAAK,mBAAmB,EAAE,CAAC;YAC7C,IAAI,OAAoC,CAAC;YACzC,IAAI,MAAM,KAAK,SAAS,IAAI,IAAI,KAAK,SAAS,EAAE,CAAC;gBAC/C,IAAI,CAAC;oBACH,OAAO,GAAG,uBAAuB,CAAC,IAAI,CAAC,OAAO,CAAC,eAAe,CAAC,MAAM,EAAE,IAAI,EAAE,IAAI,CAAC,CAAC,CAAC;gBACtF,CAAC;gBAAC,MAAM,CAAC;oBACP,OAAO,GAAG,SAAS,CAAC;gBACtB,CAAC;YACH,CAAC;YACD,MAAM,IAAI,qBAAqB,CAC7B,QAAQ,CAAC,IAAI,IAAI,IAAI,EACrB,QAAQ,CAAC,QAAQ,IAAI,CAAC,EACtB,QAAQ,CAAC,QAAQ,IAAI,CAAC,EACtB,QAAQ,CAAC,OAAO,EAChB,OAAO,CACR,CAAC;QACJ,CAAC;QACD,MAAM,IAAI,wBAAwB,CAC/B,QAAQ,CAAC,IAAmC,IAAI,2BAA2B,EAC5E,WAAW,CAAC,QAAQ,CAAC,OAAO,IAAI,sBAAsB,EAAE,QAAQ,CAAC,KAAK,CAAC,EACvE,QAAQ,CAAC,KAAK,CACf,CAAC;IACJ,CAAC;IAED,IAAI,CACF,KAAQ,EACR,MAA+C;QAE/C,IAAI,YAAY,CAAC,GAAG,CAAC,KAAK,CAAC,IAAI,aAAa,CAAC,GAAG,CAAC,KAAK,CAAC,EAAE,CAAC;YACxD,MAAM,IAAI,uBAAuB,CAAC,wCAAwC,CAAC,CAAC;QAC9E,CAAC;QACD,MAAM,UAAU,GAAG,cAAc,CAAC,KAAK,EAAE,MAAM,CAAC,CAAC;QACjD,MAAM,QAAQ,GAAG,KAAK,CAAC,OAGX,CAAC;QACb,MAAM,OAAO,GAAG,KAAK,EAAE,IAAW,EAAE,WAAqB,EAAE,EAAE;YAC3D,MAAM,OAAO,GAAG,cAAc,CAAC,WAAW,CAAC,CAAC;YAC5C,MAAM,MAAM,GAAG,aAAa,CAAC,OAAO,CAAC,CAAC;YACtC,MAAM,QAAQ,GAAG,IAAI,CAAC,OAAO,CAAC,SAAS,CACrC,MAAM,EACN,UAAU,EACV,IAAI,EACJ,aAAa,CAAC,WAAW,CAAC,EAC1B,MAAM,CAAC,KAAK,EACZ,aAAa,CAAC,WAAW,CAAC,CAC3B,CAAC;YACF,WAAW,CAAC,WAAW,EAAE,QAAQ,CAAC,OAAO,EAAE,OAAO,EAAE,IAAI,CAAC,CAAC;YAC1D,IAAI,QAAQ,CAAC,OAAO,KAAK,OAAO,EAAE,CAAC;gBACjC,OAAO,QAAQ,CAAC,SAAS,CAAC,QAAQ,CAAC,IAAI,CAAC,EAAE,qBAAqB,CAAC,WAAW,CAAC,CAAC,CAAC;YAChF,CAAC;YACD,IAAI,CAAC,aAAa,CAAC,QAAQ,EAAE,UAAU,EAAE,MAAM,EAAE,SAAS,CAAC,IAAI,CAAC,CAAC,CAAC;YAClE,MAAM,IAAI,uBAAuB,CAAC,kDAAkD,CAAC,CAAC;QACxF,CAAC,CAAC;QAEF,MAAM,OAAO,GAAG,MAAM,CAAC,MAAM,CAAC,MAAM,CAAC,MAAM,CAAC,MAAM,CAAC,cAAc,CAAC,KAAK,CAAC,CAAC,EAAE,KAAK,EAAE;YAChF,OAAO;SACR,CAAqB,CAAC;QACvB,aAAa,CAAC,GAAG,CAAC,KAAK,CAAC,CAAC;QACzB,YAAY,CAAC,GAAG,CAAC,OAAO,EAAE,EAAE,UAAU,EAAE,KAAK,EAAE,EAAE,GAAG,MAAM,CAAC,KAAK,EAAiB,EAAE,CAAC,CAAC;QACrF,OAAO,OAAO,CAAC;IACjB,CAAC;IAED,OAAO,CAAC,KAAmB;QACzB,MAAM,KAAK,GAAG,mBAAmB,CAAC,KAAK,CAAC,CAAC;QACzC,MAAM,IAAI,GAAG,KAAK,CAAC,IAAI,IAAI,WAAW,CAAC;QACvC,IAAI,IAAI,KAAK,WAAW,IAAI,IAAI,KAAK,QAAQ,EAAE,CAAC;YAC9C,MAAM,IAAI,uBAAuB,CAAC,gDAAgD,CAAC,CAAC;QACtF,CAAC;QACD,IAAI,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,MAAM,KAAK,CAAC,IAAI,IAAI,KAAK,WAAW,EAAE,CAAC;YAC5D,MAAM,IAAI,uBAAuB,CAC/B,sFAAsF,CACvF,CAAC;QACJ,CAAC;QACD,IAAI,CAAC,IAAI,CAAC,OAAO,EAAE,CAAC;YAClB,MAAM,IAAI,uBAAuB,CAC/B,wHAAwH,CACzH,CAAC;QACJ,CAAC;QACD,MAAM,OAAO,GAAoB,EAAE,IAAI,EAAE,KAAK,EAAE,CAAC;QACjD,IAAI,KAAK,CAAC,UAAU,KAAK,SAAS,EAAE,CAAC;YACnC,OAAO,CAAC,UAAU,GAAG,UAAU,CAAC,KAAK,CAAC,UAAU,EAAE,sBAAsB,CAAC,CAAC;QAC5E,CAAC;QACD,IAAI,KAAK,CAAC,MAAM,KAAK,SAAS,EAAE,CAAC;YAC/B,OAAO,CAAC,MAAM,GAAG,gBAAgB,CAAC,KAAK,CAAC,MAAM,EAAE,kBAAkB,CAAC,CAAC,GAAG,CAAC;QAC1E,CAAC;QACD,IAAI,KAAK,CAAC,QAAQ,KAAK,SAAS,EAAE,CAAC;YACjC,OAAO,CAAC,QAAQ,GAAG,YAAY,CAAC,KAAK,CAAC,QAAQ,EAAE,oBAAoB,CAAC,CAAC;QACxE,CAAC;QACD,IAAI,KAAK,CAAC,SAAS,KAAK,SAAS,EAAE,CAAC;YAClC,OAAO,CAAC,SAAS,GAAG,aAAa,CAAC,KAAK,CAAC,SAAS,EAAE,qBAAqB,CAAC,CAAC;QAC5E,CAAC;QACD,IAAI,KAAK,CAAC,SAAS,KAAK,SAAS,EAAE,CAAC;YAClC,OAAO,CAAC,SAAS,GAAG,YAAY,CAAC,KAAK,CAAC,SAAS,EAAE,qBAAqB,CAAC,CAAC;QAC3E,CAAC;QACD,IAAI,KAAK,CAAC,OAAO,KAAK,SAAS,EAAE,CAAC;YAChC,OAAO,CAAC,OAAO,GAAG,YAAY,CAAC,KAAK,CAAC,OAAO,EAAE,mBAAmB,CAAC,CAAC;QACrE,CAAC;QACD,IAAI,KAAK,CAAC,eAAe,KAAK,SAAS,EAAE,CAAC;YACxC,OAAO,CAAC,eAAe,GAAG,mBAAmB,CAAC,KAAK,CAAC,eAAe,CAAC,CAAC;QACvE,CAAC;QACD,IAAI,KAAK,CAAC,aAAa,KAAK,SAAS,EAAE,CAAC;YACtC,OAAO,CAAC,aAAa,GAAG,CAAC,GAAG,KAAK,CAAC,aAAa,CAAC,CAAC;QACnD,CAAC;QACD,IAAI,KAAK,CAAC,gBAAgB,KAAK,SAAS,EAAE,CAAC;YACzC,OAAO,CAAC,gBAAgB,GAAG,KAAK,CAAC,gBAAgB,CAAC;QACpD,CAAC;QACD,IAAI,KAAK,CAAC,aAAa,KAAK,SAAS,EAAE,CAAC;YACtC,OAAO,CAAC,aAAa,GAAG,YAAY,CAAC,KAAK,CAAC,aAAa,EAAE,yBAAyB,CAAC,CAAC;QACvF,CAAC;QACD,IAAI,CAAC;YACH,OAAO,IAAI,OAAO,CAAC,IAAI,CAAC,OAAO,CAAC,YAAY,CAAC,OAAO,CAAC,CAAC,CAAC;QACzD,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,MAAM,IAAI,uBAAuB,CAAC,YAAY,CAAC,KAAK,CAAC,CAAC,CAAC;QACzD,CAAC;IACH,CAAC;IAED,KAAK,CAAC,MAAe,EAAE,KAAiB;QACtC,IAAI,CAAC,SAAS,CAAC,MAAM,CAAC,EAAE,CAAC;YACvB,MAAM,IAAI,uBAAuB,CAAC,sDAAsD,CAAC,CAAC;QAC5F,CAAC;QACD,IAAI,KAAK,KAAK,IAAI,IAAI,OAAO,KAAK,KAAK,QAAQ,IAAI,KAAK,CAAC,KAAK,KAAK,SAAS,IAAI,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;YACtH,MAAM,IAAI,uBAAuB,CAAC,mDAAmD,CAAC,CAAC;QACzF,CAAC;QACD,MAAM,OAAO,GAAqB;YAChC,KAAK,EAAE,KAAK,CAAC,KAAK;YAClB,MAAM,EAAE,gBAAgB,CAAC,KAAK,CAAC,MAAM,EAAE,gBAAgB,CAAC,CAAC,GAAG;SAC7D,CAAC;QACF,IAAI,KAAK,CAAC,UAAU,KAAK,SAAS,EAAE,CAAC;YACnC,OAAO,CAAC,UAAU,GAAG,UAAU,CAAC,KAAK,CAAC,UAAU,EAAE,oBAAoB,EAAE,CAAC,CAAC,CAAC;QAC7E,CAAC;QACD,IAAI,KAAK,CAAC,QAAQ,KAAK,SAAS,EAAE,CAAC;YACjC,OAAO,CAAC,QAAQ,GAAG,YAAY,CAAC,KAAK,CAAC,QAAQ,EAAE,kBAAkB,CAAC,CAAC;QACtE,CAAC;QACD,IAAI,KAAK,CAAC,SAAS,KAAK,SAAS,EAAE,CAAC;YAClC,OAAO,CAAC,SAAS,GAAG,aAAa,CAAC,KAAK,CAAC,SAAS,EAAE,mBAAmB,CAAC,CAAC;QAC1E,CAAC;QACD,IAAI,KAAK,CAAC,SAAS,KAAK,SAAS,EAAE,CAAC;YAClC,OAAO,CAAC,SAAS,GAAG,YAAY,CAAC,KAAK,CAAC,SAAS,EAAE,mBAAmB,CAAC,CAAC;QACzE,CAAC;QACD,IAAI,KAAK,CAAC,OAAO,KAAK,SAAS,EAAE,CAAC;YAChC,OAAO,CAAC,OAAO,GAAG,YAAY,CAAC,KAAK,CAAC,OAAO,EAAE,iBAAiB,CAAC,CAAC;QACnE,CAAC;QACD,IAAI,KAAK,CAAC,eAAe,KAAK,SAAS,EAAE,CAAC;YACxC,OAAO,CAAC,eAAe,GAAG,mBAAmB,CAAC,KAAK,CAAC,eAAe,CAAC,CAAC;QACvE,CAAC;QACD,IAAI,CAAC;YACH,OAAO,IAAI,OAAO,CAAC,IAAI,CAAC,OAAO,CAAC,KAAK,CAAC,aAAa,CAAC,MAAM,CAAC,EAAE,OAAO,CAAC,CAAC,CAAC;QACzE,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,MAAM,UAAU,CAAC,KAAK,CAAC,CAAC;QAC1B,CAAC;IACH,CAAC;IAED,eAAe;QACb,IAAI,CAAC,IAAI,CAAC,OAAO,EAAE,CAAC;YAClB,MAAM,IAAI,uBAAuB,CAC/B,uGAAuG,CACxG,CAAC;QACJ,CAAC;QACD,OAAO,EAAE,IAAI,EAAE,YAAY,EAAE,MAAM,EAAE,OAAO,EAAE,GAAG,EAAE,IAAI,CAAC,OAAO,CAAC,eAAe,EAAE,EAAE,CAAC;IACtF,CAAC;IAED,eAAe,CAAC,KAA2B;QACzC,IAAI,CAAC,CAAC,KAAK,CAAC,SAAS,YAAY,UAAU,CAAC,IAAI,KAAK,CAAC,SAAS,CAAC,MAAM,KAAK,EAAE,EAAE,CAAC;YAC9E,MAAM,IAAI,uBAAuB,CAAC,gDAAgD,CAAC,CAAC;QACtF,CAAC;QACD,IAAI,OAAO,KAAK,CAAC,OAAO,KAAK,QAAQ,IAAI,KAAK,CAAC,OAAO,CAAC,IAAI,EAAE,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;YAC3E,MAAM,IAAI,uBAAuB,CAAC,sCAAsC,CAAC,CAAC;QAC5E,CAAC;QACD,IAAI,CAAC;YACH,IAAI,OAAO,KAAK,CAAC,OAAO,KAAK,QAAQ,EAAE,CAAC;gBACtC,OAAO,IAAI,OAAO,CAAC,qBAAqB,CAAC,KAAK,CAAC,OAAO,EAAE,KAAK,CAAC,SAAS,CAAC,CAAC,CAAC;YAC5E,CAAC;YACD,IAAI,KAAK,CAAC,OAAO,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;gBAC/B,MAAM,IAAI,uBAAuB,CAAC,sCAAsC,CAAC,CAAC;YAC5E,CAAC;YACD,OAAO,IAAI,OAAO,CAAC,sBAAsB,CAAC,CAAC,GAAG,KAAK,CAAC,OAAO,CAAC,EAAE,KAAK,CAAC,SAAS,CAAC,CAAC,CAAC;QAClF,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,MAAM,eAAe,CAAC,KAAK,CAAC,CAAC;QAC/B,CAAC;IACH,CAAC;IAED,WAAW,CAAI,OAAgB,EAAE,EAAW;QAC1C,IAAI,CAAC,SAAS,CAAC,OAAO,CAAC,EAAE,CAAC;YACxB,MAAM,IAAI,uBAAuB,CAAC,4DAA4D,CAAC,CAAC;QAClG,CAAC;QACD,OAAO,cAAc,CAAC,GAAG,CAAC,OAAO,EAAE,EAAE,CAAC,CAAC;IACzC,CAAC;IAED,MAAM,CAAC,OAAgB,EAAE,KAAkB,EAAE,OAAuB;QAClE,IAAI,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;YACpC,MAAM,IAAI,uBAAuB,CAAC,kDAAkD,CAAC,CAAC;QACxF,CAAC;QACD,IAAI,CAAC,SAAS,CAAC,OAAO,CAAC,EAAE,CAAC;YACxB,MAAM,IAAI,uBAAuB,CAAC,uDAAuD,CAAC,CAAC;QAC7F,CAAC;QACD,MAAM,MAAM,GAAG,OAAO,KAAK,SAAS,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,iBAAiB,CAAC,OAAO,CAAC,CAAC;QAC9E,IAAI,CAAC;YACH,MAAM,KAAK,GAAG,IAAI,OAAO,CAAC,IAAI,CAAC,OAAO,CAAC,MAAM,CAAC,aAAa,CAAC,OAAO,CAAC,EAAE,KAAK,EAAE,MAAM,CAAC,CAAC,CAAC;YACtF,uBAAuB,CAAC,OAAO,EAAE,KAAK,CAAC,CAAC;YACxC,OAAO,KAAK,CAAC;QACf,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,MAAM,UAAU,CAAC,KAAK,CAAC,CAAC;QAC1B,CAAC;IACH,CAAC;IAED,OAAO,CAAC,OAAgB,EAAE,IAAY,EAAE,IAAuC;QAC7E,IAAI,CAAC,SAAS,CAAC,OAAO,CAAC,EAAE,CAAC;YACxB,MAAM,IAAI,uBAAuB,CAAC,wDAAwD,CAAC,CAAC;QAC9F,CAAC;QACD,IAAI,GAAgB,CAAC;QACrB,IAAI,CAAC;YACH,GAAG,GAAG,IAAI,CAAC,OAAO,CAAC,OAAO,CAAC,aAAa,CAAC,OAAO,CAAC,EAAE,IAAI,EAAE,IAAI,CAAC,CAAC;QACjE,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,MAAM,IAAI,uBAAuB,CAAC,YAAY,CAAC,KAAK,CAAC,CAAC,CAAC;QACzD,CAAC;QACD,MAAM,GAAG,GAA2D;YAClE,IAAI,EAAE,GAAG,CAAC,IAAI;YACd,IAAI,EAAE,GAAG,CAAC,IAAI;YACd,OAAO,EAAE,GAAG,CAAC,OAAO;YACpB,WAAW,EAAE,GAAG,CAAC,YAAY;YAC7B,MAAM,EAAE,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE;gBAC3B,MAAM,KAAK,GAA+F;oBACxG,KAAK,EAAE,CAAC,CAAC,KAAK;oBACd,IAAI,EAAE,CAAC,CAAC,IAAI;oBACZ,UAAU,EAAE,CAAC,CAAC,UAAU;oBACxB,SAAS,EAAE,CAAC,CAAC,SAAS;iBACvB,CAAC;gBACF,IAAI,CAAC,CAAC,KAAK,KAAK,SAAS,EAAE,CAAC;oBAC1B,KAAK,CAAC,KAAK,GAAG,CAAC,CAAC,KAAK,CAAC;gBACxB,CAAC;gBACD,IAAI,CAAC,CAAC,MAAM,KAAK,SAAS,EAAE,CAAC;oBAC3B,KAAK,CAAC,MAAM,GAAG,CAAC,CAAC,MAAM,CAAC;gBAC1B,CAAC;gBACD,OAAO,KAAK,CAAC;YACf,CAAC,CAAC;YACF,aAAa,EAAE,CAAC,GAAG,GAAG,CAAC,cAAc,CAAC;YACtC,aAAa,EAAE,CAAC,GAAG,GAAG,CAAC,cAAc,CAAC;YACtC,OAAO,EAAE,GAAG,CAAC,OAAO;YACpB,SAAS,EAAE,GAAG,CAAC,UAAU;YACzB,UAAU,EAAE,GAAG,CAAC,WAAW;SAC5B,CAAC;QACF,IAAI,GAAG,CAAC,IAAI,KAAK,SAAS,EAAE,CAAC;YAC3B,GAAG,CAAC,IAAI,GAAG,GAAG,CAAC,IAAI,CAAC;QACtB,CAAC;QACD,IAAI,GAAG,CAAC,KAAK,KAAK,SAAS,EAAE,CAAC;YAC5B,GAAG,CAAC,KAAK,GAAG,GAAG,CAAC,KAAK,CAAC;QACxB,CAAC;QACD,IAAI,GAAG,CAAC,OAAO,KAAK,SAAS,EAAE,CAAC;YAC9B,GAAG,CAAC,OAAO,GAAG,GAAG,CAAC,OAAO,CAAC;QAC5B,CAAC;QACD,IAAI,GAAG,CAAC,WAAW,KAAK,SAAS,EAAE,CAAC;YAClC,GAAG,CAAC,UAAU,GAAG,GAAG,CAAC,WAAW,CAAC;QACnC,CAAC;QACD,OAAO,GAAG,CAAC;IACb,CAAC;IAED,eAAe,CAAC,OAAgB,EAAE,IAAY,EAAE,IAAuC;QACrF,IAAI,CAAC,SAAS,CAAC,OAAO,CAAC,EAAE,CAAC;YACxB,MAAM,IAAI,uBAAuB,CAAC,gEAAgE,CAAC,CAAC;QACtG,CAAC;QACD,IAAI,CAAC;YACH,OAAO,uBAAuB,CAAC,IAAI,CAAC,OAAO,CAAC,eAAe,CAAC,aAAa,CAAC,OAAO,CAAC,EAAE,IAAI,EAAE,IAAI,CAAC,CAAC,CAAC;QACnG,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,MAAM,IAAI,uBAAuB,CAAC,YAAY,CAAC,KAAK,CAAC,CAAC,CAAC;QACzD,CAAC;IACH,CAAC;IAED,qBAAqB,CACnB,OAAgB,EAChB,IAAY,EACZ,IAAuC;QAEvC,IAAI,CAAC,SAAS,CAAC,OAAO,CAAC,EAAE,CAAC;YACxB,MAAM,IAAI,uBAAuB,CAAC,sEAAsE,CAAC,CAAC;QAC5G,CAAC;QACD,IAAI,GAAoB,CAAC;QACzB,IAAI,CAAC;YACH,GAAG,GAAG,IAAI,CAAC,OAAO,CAAC,0BAA0B,CAAC,aAAa,CAAC,OAAO,CAAC,EAAE,IAAI,EAAE,IAAI,CAAC,CAAC;QACpF,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,MAAM,IAAI,uBAAuB,CAAC,YAAY,CAAC,KAAK,CAAC,CAAC,CAAC;QACzD,CAAC;QACD,OAAO;YACL,OAAO,EAAE,GAAG,CAAC,OAAO;YACpB,gBAAgB,EAAE,GAAG,CAAC,gBAAgB;YACtC,SAAS,EAAE,GAAG,CAAC,UAAU;YACzB,IAAI,EAAE,GAAG,CAAC,IAAI;YACd,WAAW,EAAE,GAAG,CAAC,YAAY;YAC7B,YAAY,EAAE,GAAG,CAAC,cAAc;YAChC,oBAAoB,EAAE,GAAG,CAAC,uBAAuB;YACjD,YAAY,EAAE,GAAG,CAAC,cAAc;YAChC,YAAY,EAAE,GAAG,CAAC,aAAa;SAChC,CAAC;IACJ,CAAC;IAED,OAAO,CACL,OAAgB,EAChB,IAAY,EACZ,IAAuC,EACvC,OAA0B;QAE1B,IAAI,CAAC,SAAS,CAAC,OAAO,CAAC,EAAE,CAAC;YACxB,MAAM,IAAI,uBAAuB,CAAC,wDAAwD,CAAC,CAAC;QAC9F,CAAC;QACD,OAAO,WAAW,CAAC,IAAI,CAAC,OAAO,EAAE,IAAI,CAAC,MAAM,EAAE,OAAO,EAAE,IAAI,EAAE,IAAI,EAAE,OAAO,EAAE,WAAW,EAAE,IAAI,CAAC;aAC3F,SAAS,CAAC;IACf,CAAC;IAED,MAAM,CACJ,SAAwB,EACxB,IAAY,EACZ,IAAuC,EACvC,OAA0B;QAE1B,OAAO,eAAe,CACpB,IAAI,CAAC,OAAO,EACZ,IAAI,CAAC,MAAM,EACX,SAAS,EACT,IAAI,EACJ,IAAI,EACJ,OAAO,EACP,UAAU,EACV,IAAI,CACL,CAAC;IACJ,CAAC;IAED,cAAc,CAAC,KAA0B;QACvC,IAAI,CAAC,IAAI,CAAC,OAAO,EAAE,CAAC;YAClB,MAAM,IAAI,uBAAuB,CAC/B,iIAAiI,CAClI,CAAC;QACJ,CAAC;QACD,MAAM,EAAE,GAAG,EAAE,OAAO,EAAE,GAAG,eAAe,CAAC,KAAK,CAAC,CAAC;QAChD,IAAI,CAAC;YACH,OAAO,IAAI,CAAC,OAAO,CAAC,2BAA2B,CAAC,GAAG,EAAE,OAAO,CAAC,CAAC;QAChE,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,MAAM,IAAI,uBAAuB,CAAC,YAAY,CAAC,KAAK,CAAC,CAAC,CAAC;QACzD,CAAC;IACH,CAAC;IAED,MAAM,CAAC,IAAyB;QAC9B,IAAI,CAAC,OAAO,CAAC,kBAAkB,CAAC,kBAAkB,CAAC,IAAI,CAAC,CAAC,CAAC;IAC5D,CAAC;IAED,KAAK;QACH,QAAQ,EAAE,CAAC;IACb,CAAC;CACF;AAED,SAAS,YAAY,CAAC,KAAa,EAAE,IAAY;IAC/C,IAAI,OAAO,KAAK,KAAK,QAAQ,IAAI,KAAK,CAAC,IAAI,EAAE,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QAC3D,MAAM,IAAI,uBAAuB,CAAC,GAAG,IAAI,6BAA6B,CAAC,CAAC;IAC1E,CAAC;IACD,OAAO,KAAK,CAAC;AACf,CAAC;AAED,SAAS,YAAY,CAAC,KAAc;IAClC,OAAO,KAAK,YAAY,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;AAChE,CAAC;AAED,qFAAqF;AACrF,SAAS,UAAU,CAAC,KAAc;IAChC,IAAI,KAAK,YAAY,UAAU,EAAE,CAAC;QAChC,OAAO,KAAK,CAAC;IACf,CAAC;IACD,MAAM,OAAO,GAAG,mBAAmB,CAAC,YAAY,CAAC,KAAK,CAAC,CAAC,CAAC;IACzD,KAAK,MAAM,IAAI,IAAI,CAAC,qBAAqB,EAAE,sBAAsB,EAAE,uBAAuB,CAAU,EAAE,CAAC;QACrG,IAAI,OAAO,CAAC,UAAU,CAAC,IAAI,CAAC,EAAE,CAAC;YAC7B,OAAO,IAAI,wBAAwB,CAAC,IAAI,EAAE,OAAO,CAAC,CAAC;QACrD,CAAC;IACH,CAAC;IACD,OAAO,IAAI,uBAAuB,CAAC,OAAO,CAAC,CAAC;AAC9C,CAAC;AAED,SAAS,mBAAmB,CAAC,OAAe;IAC1C,MAAM,IAAI,GAAG,sCAAsC,CAAC,IAAI,CAAC,OAAO,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC;IACvE,IAAI,IAAI,KAAK,SAAS,EAAE,CAAC;QACvB,OAAO,GAAG,OAAO,0BAA0B,IAAI,wDAAwD,CAAC;IAC1G,CAAC;IACD,IACE,OAAO,CAAC,QAAQ,CAAC,sBAAsB,CAAC;QACxC,OAAO,CAAC,QAAQ,CAAC,gBAAgB,CAAC;QAClC,OAAO,CAAC,QAAQ,CAAC,0BAA0B,CAAC;QAC5C,OAAO,CAAC,QAAQ,CAAC,2BAA2B,CAAC,EAC7C,CAAC;QACD,OAAO,GAAG,OAAO,sFAAsF,CAAC;IAC1G,CAAC;IACD,OAAO,OAAO,CAAC;AACjB,CAAC;AAED,SAAS,eAAe,CAAC,KAA0B;IACjD,IAAI,KAAK,KAAK,IAAI,IAAI,OAAO,KAAK,KAAK,QAAQ,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC,MAAM,CAAC,EAAE,CAAC;QAChF,MAAM,IAAI,uBAAuB,CAAC,8DAA8D,CAAC,CAAC;IACpG,CAAC;IACD,MAAM,GAAG,GAAG,KAAK,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC,EAAE,EAAgB,EAAE,CAAC,OAAO,EAAE,KAAK,QAAQ,IAAI,EAAE,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC;IAC/F,IAAI,GAAG,CAAC,MAAM,KAAK,CAAC,IAAI,GAAG,CAAC,MAAM,KAAK,KAAK,CAAC,MAAM,CAAC,MAAM,EAAE,CAAC;QAC3D,MAAM,IAAI,uBAAuB,CAAC,iDAAiD,CAAC,CAAC;IACvF,CAAC;IACD,IAAI,KAAK,CAAC,OAAO,KAAK,SAAS,IAAI,CAAC,CAAC,MAAM,CAAC,SAAS,CAAC,KAAK,CAAC,OAAO,CAAC,IAAI,KAAK,CAAC,OAAO,GAAG,CAAC,CAAC,EAAE,CAAC;QAC3F,MAAM,IAAI,uBAAuB,CAAC,oDAAoD,CAAC,CAAC;IAC1F,CAAC;IACD,OAAO,EAAE,GAAG,EAAE,OAAO,EAAE,KAAK,CAAC,OAAO,EAAE,CAAC;AACzC,CAAC;AAED,SAAS,SAAS,CAAC,KAAc;IAC/B,IAAI,KAAK,YAAY,GAAG,EAAE,CAAC;QACzB,OAAO,MAAM,CAAC,WAAW,CAAC,KAAK,CAAC,CAAC;IACnC,CAAC;IACD,IAAI,KAAK,KAAK,IAAI,IAAI,OAAO,KAAK,KAAK,QAAQ,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC,EAAE,CAAC;QACzE,OAAO,EAAE,GAAI,KAAiC,EAAE,CAAC;IACnD,CAAC;IACD,OAAO,EAAE,CAAC;AACZ,CAAC;AAED,SAAS,mBAAmB,CAAC,OAAwB;IACnD,IAAI,OAAO,KAAK,IAAI,IAAI,OAAO,OAAO,KAAK,QAAQ,EAAE,CAAC;QACpD,MAAM,IAAI,uBAAuB,CAAC,mCAAmC,CAAC,CAAC;IACzE,CAAC;IACD,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,OAAO,CAAC,SAAS,CAAC,IAAI,OAAO,CAAC,SAAS,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QACxE,MAAM,IAAI,uBAAuB,CAAC,6CAA6C,CAAC,CAAC;IACnF,CAAC;IACD,IAAI,CAAC,MAAM,CAAC,SAAS,CAAC,OAAO,CAAC,GAAG,CAAC,IAAI,OAAO,CAAC,GAAG,GAAG,CAAC,EAAE,CAAC;QACtD,MAAM,IAAI,uBAAuB,CAAC,wCAAwC,CAAC,CAAC;IAC9E,CAAC;IACD,MAAM,OAAO,GAAwB;QACnC,SAAS,EAAE,OAAO,CAAC,SAAS,CAAC,GAAG,CAAC,CAAC,QAAQ,EAAE,CAAC,EAAE,EAAE,CAAC,gBAAgB,CAAC,QAAQ,EAAE,6BAA6B,CAAC,GAAG,CAAC,CAAC,GAAG,CAAC;QACpH,GAAG,EAAE,OAAO,CAAC,GAAG;KACjB,CAAC;IACF,IAAI,OAAO,CAAC,KAAK,KAAK,SAAS,EAAE,CAAC;QAChC,OAAO,CAAC,KAAK,GAAG,CAAC,GAAG,OAAO,CAAC,KAAK,CAAC,CAAC;IACrC,CAAC;IACD,IAAI,OAAO,CAAC,KAAK,KAAK,SAAS,EAAE,CAAC;QAChC,MAAM,KAAK,GAA8C,EAAE,CAAC;QAC5D,KAAK,MAAM,CAAC,IAAI,EAAE,IAAI,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,OAAO,CAAC,KAAK,CAAC,EAAE,CAAC;YACzD,MAAM,GAAG,GAAyD,EAAE,CAAC;YACrE,IAAI,IAAI,CAAC,OAAO,KAAK,SAAS,EAAE,CAAC;gBAC/B,GAAG,CAAC,OAAO,GAAG,IAAI,CAAC,OAAO,CAAC;YAC7B,CAAC;YACD,IAAI,IAAI,CAAC,IAAI,KAAK,SAAS,EAAE,CAAC;gBAC5B,GAAG,CAAC,IAAI,GAAG,EAAE,GAAG,IAAI,CAAC,IAAI,EAAE,CAAC;YAC9B,CAAC;YACD,KAAK,CAAC,IAAI,CAAC,GAAG,GAAG,CAAC;QACpB,CAAC;QACD,OAAO,CAAC,KAAK,GAAG,KAAK,CAAC;IACxB,CAAC;IACD,OAAO,OAAO,CAAC;AACjB,CAAC;AAED,SAAS,iBAAiB,CAAC,OAAsB;IAC/C,IAAI,OAAO,KAAK,IAAI,IAAI,OAAO,OAAO,KAAK,QAAQ,EAAE,CAAC;QACpD,MAAM,IAAI,uBAAuB,CAAC,oCAAoC,CAAC,CAAC;IAC1E,CAAC;IACD,MAAM,KAAK,GAAG,CAAC,QAAQ,EAAE,YAAY,EAAE,UAAU,EAAE,UAAU,EAAE,WAAW,EAAE,SAAS,EAAE,cAAc,EAAE,cAAc,CAAC,CAAC;IACvH,KAAK,MAAM,GAAG,IAAI,MAAM,CAAC,IAAI,CAAC,OAAO,CAAC,EAAE,CAAC;QACvC,IAAI,CAAC,KAAK,CAAC,QAAQ,CAAC,GAAG,CAAC,EAAE,CAAC;YACzB,MAAM,IAAI,uBAAuB,CAC/B,kCAAkC,GAAG,eAAe,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,GAAG,CACxE,CAAC;QACJ,CAAC;IACH,CAAC;IACD,MAAM,GAAG,GAAsB,EAAE,CAAC;IAClC,IAAI,OAAO,CAAC,MAAM,KAAK,SAAS,EAAE,CAAC;QACjC,GAAG,CAAC,MAAM,GAAG,gBAAgB,CAAC,OAAO,CAAC,MAAM,EAAE,iBAAiB,CAAC,CAAC,GAAG,CAAC;IACvE,CAAC;IACD,IAAI,OAAO,CAAC,UAAU,KAAK,SAAS,EAAE,CAAC;QACrC,GAAG,CAAC,UAAU,GAAG,UAAU,CAAC,OAAO,CAAC,UAAU,EAAE,qBAAqB,EAAE,CAAC,CAAC,CAAC;IAC5E,CAAC;IACD,IAAI,OAAO,CAAC,QAAQ,KAAK,SAAS,EAAE,CAAC;QACnC,IAAI,OAAO,OAAO,CAAC,QAAQ,KAAK,SAAS,EAAE,CAAC;YAC1C,MAAM,IAAI,uBAAuB,CAAC,qCAAqC,CAAC,CAAC;QAC3E,CAAC;QACD,GAAG,CAAC,QAAQ,GAAG,OAAO,CAAC,QAAQ,CAAC;IAClC,CAAC;IACD,IAAI,OAAO,CAAC,QAAQ,KAAK,SAAS,EAAE,CAAC;QACnC,GAAG,CAAC,QAAQ,GAAG,YAAY,CAAC,OAAO,CAAC,QAAQ,EAAE,mBAAmB,CAAC,CAAC;IACrE,CAAC;IACD,IAAI,GAAG,CAAC,QAAQ,KAAK,IAAI,IAAI,GAAG,CAAC,QAAQ,KAAK,SAAS,EAAE,CAAC;QACxD,MAAM,IAAI,uBAAuB,CAAC,uDAAuD,CAAC,CAAC;IAC7F,CAAC;IACD,IAAI,OAAO,CAAC,SAAS,KAAK,SAAS,EAAE,CAAC;QACpC,GAAG,CAAC,SAAS,GAAG,aAAa,CAAC,OAAO,CAAC,SAAS,EAAE,oBAAoB,CAAC,CAAC;IACzE,CAAC;IACD,IAAI,OAAO,CAAC,OAAO,KAAK,SAAS,EAAE,CAAC;QAClC,GAAG,CAAC,OAAO,GAAG,YAAY,CAAC,OAAO,CAAC,OAAO,EAAE,kBAAkB,CAAC,CAAC;IAClE,CAAC;IACD,IAAI,OAAO,CAAC,YAAY,KAAK,SAAS,EAAE,CAAC;QACvC,GAAG,CAAC,YAAY,GAAG,OAAO,CAAC,YAAY,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,EAAE,CAAC,gBAAgB,CAAC,CAAC,EAAE,yBAAyB,CAAC,GAAG,CAAC,CAAC,GAAG,CAAC,CAAC;IAChH,CAAC;IACD,IAAI,OAAO,CAAC,YAAY,KAAK,SAAS,EAAE,CAAC;QACvC,IAAI,CAAC,MAAM,CAAC,SAAS,CAAC,OAAO,CAAC,YAAY,CAAC,IAAI,OAAO,CAAC,YAAY,GAAG,CAAC,EAAE,CAAC;YACxE,MAAM,IAAI,uBAAuB,CAAC,0CAA0C,CAAC,CAAC;QAChF,CAAC;QACD,GAAG,CAAC,YAAY,GAAG,OAAO,CAAC,YAAY,CAAC;IAC1C,CAAC;IACD,OAAO,GAAG,CAAC;AACb,CAAC;AAED,SAAS,uBAAuB,CAAC,GAAwB;IACvD,OAAO;QACL,SAAS,EAAE,GAAG,CAAC,UAAU;QACzB,SAAS,EAAE,GAAG,CAAC,UAAU;QACzB,IAAI,EAAE,GAAG,CAAC,IAAI;QACd,IAAI,EAAE,EAAE,GAAG,GAAG,CAAC,IAAI,EAAE;QACrB,WAAW,EAAE,GAAG,CAAC,YAAY;QAC7B,eAAe,EAAE,GAAG,CAAC,iBAAiB;QACtC,iBAAiB,EAAE,CAAC,GAAG,GAAG,CAAC,kBAAkB,CAAC;QAC9C,YAAY,EAAE,GAAG,CAAC,aAAa;QAC/B,gBAAgB,EAAE,GAAG,CAAC,kBAAkB;QACxC,SAAS,EAAE,GAAG,CAAC,UAAU;QACzB,OAAO,EAAE,GAAG,CAAC,OAAO;KACrB,CAAC;AACJ,CAAC;AAED,SAAS,WAAW,CAAC,OAAe,EAAE,KAAc;IAClD,IAAI,CAAC,OAAO,CAAC,QAAQ,CAAC,2BAA2B,CAAC,EAAE,CAAC;QACnD,OAAO,OAAO,CAAC;IACjB,CAAC;IACD,MAAM,KAAK,GAAG,KAAK,KAAK,SAAS,IAAI,KAAK,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC,IAAI,KAAK,GAAG,CAAC,CAAC,CAAC,eAAe,CAAC;IACvF,OAAO,GAAG,OAAO,sBAAsB,KAAK,0BAA0B,KAAK,0FAA0F,CAAC;AACxK,CAAC;AAED,SAAS,qBAAqB,CAAC,WAAoB;IACjD,IAAI,WAAW,KAAK,IAAI,IAAI,OAAO,WAAW,KAAK,QAAQ,EAAE,CAAC;QAC5D,OAAO,WAAW,CAAC;IACrB,CAAC;IACD,MAAM,IAAI,GAA4B,EAAE,CAAC;IACzC,KAAK,MAAM,CAAC,GAAG,EAAE,KAAK,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,WAAsC,CAAC,EAAE,CAAC;QAClF,IACE,GAAG,KAAK,SAAS;YACjB,GAAG,KAAK,WAAW;YACnB,GAAG,KAAK,WAAW;YACnB,GAAG,KAAK,WAAW,EACnB,CAAC;YACD,SAAS;QACX,CAAC;QACD,IAAI,CAAC,GAAG,CAAC,GAAG,KAAK,CAAC;IACpB,CAAC;IACD,OAAO,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,MAAM,KAAK,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,IAAI,CAAC;AAC3D,CAAC;AAED,SAAS,eAAe,CAAC,KAAc;IACrC,MAAM,OAAO,GAAG,YAAY,CAAC,KAAK,CAAC,CAAC;IACpC,IAAI,OAAO,CAAC,UAAU,CAAC,qBAAqB,CAAC,IAAI,OAAO,CAAC,QAAQ,CAAC,iBAAiB,CAAC,EAAE,CAAC;QACrF,OAAO,IAAI,UAAU,CAAC,qBAAqB,EAAE,OAAO,CAAC,CAAC;IACxD,CAAC;IACD,IAAI,OAAO,CAAC,UAAU,CAAC,yBAAyB,CAAC,EAAE,CAAC;QAClD,OAAO,IAAI,UAAU,CAAC,yBAAyB,EAAE,OAAO,CAAC,CAAC;IAC5D,CAAC;IACD,IAAI,OAAO,CAAC,UAAU,CAAC,sBAAsB,CAAC,EAAE,CAAC;QAC/C,OAAO,IAAI,UAAU,CAAC,sBAAsB,EAAE,OAAO,CAAC,CAAC;IACzD,CAAC;IACD,IAAI,OAAO,CAAC,UAAU,CAAC,mBAAmB,CAAC,EAAE,CAAC;QAC5C,gEAAgE;QAChE,MAAM,SAAS,GAAG,QAAQ,CAAC,IAAI,CAAC,OAAO,CAAC,IAAI,EAAE,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,GAAG,CAAC;QAC3D,OAAO,IAAI,wBAAwB,CACjC,mBAAmB,EACnB,GAAG,OAAO,GAAG,SAAS,qGAAqG,CAC5H,CAAC;IACJ,CAAC;IACD,OAAO,IAAI,uBAAuB,CAAC,OAAO,CAAC,CAAC;AAC9C,CAAC;AAED,SAAS,kBAAkB,CAAC,KAA0B;IACpD,IAAI,OAAO,KAAK,KAAK,QAAQ,EAAE,CAAC;QAC9B,OAAO,KAAK,CAAC;IACf,CAAC;IACD,OAAO,UAAU,CAAC,KAAK,CAAC,CAAC;AAC3B,CAAC;AAED,SAAS,WAAW,CAClB,WAAoB,EACpB,OAA2B,EAC3B,OAAgB,EAChB,IAAY;IAEZ,cAAc,CAAC,OAAO,EAAE,OAAO,EAAE,IAAI,CAAC,CAAC;IACvC,IAAI,OAAO,KAAK,SAAS,IAAI,WAAW,KAAK,IAAI,IAAI,OAAO,WAAW,KAAK,QAAQ,EAAE,CAAC;QACrF,OAAO;IACT,CAAC;IACD,IAAI,CAAC,CAAC,WAAW,IAAI,WAAW,CAAC,EAAE,CAAC;QAClC,OAAO;IACT,CAAC;IACD,MAAM,SAAS,GAAI,WAAuC,CAAC,SAAS,CAAC;IACrE,IAAI,OAAO,SAAS,KAAK,UAAU,EAAE,CAAC;QACpC,OAAO;IACT,CAAC;IACD,mBAAmB,CAAC,SAAsD,EAAE,OAAO,CAAC,CAAC;AACvF,CAAC;AAED,SAAS,aAAa,CAAC,WAAoB;IACzC,IAAI,WAAW,KAAK,IAAI,IAAI,OAAO,WAAW,KAAK,QAAQ,IAAI,WAAW,IAAI,WAAW,EAAE,CAAC;QAC1F,MAAM,KAAK,GAAI,WAAuC,CAAC,SAAS,CAAC;QACjE,IAAI,OAAO,KAAK,KAAK,QAAQ,IAAI,KAAK,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;YAClD,OAAO,KAAK,CAAC;QACf,CAAC;IACH,CAAC;IACD,OAAO,SAAS,CAAC;AACnB,CAAC;AAED,SAAS,aAAa,CAAC,WAAoB;IACzC,IAAI,WAAW,KAAK,IAAI,IAAI,OAAO,WAAW,KAAK,QAAQ,IAAI,WAAW,IAAI,WAAW,EAAE,CAAC;QAC1F,OAAQ,WAAuC,CAAC,SAAS,CAAC;IAC5D,CAAC;IACD,OAAO,SAAS,CAAC;AACnB,CAAC;AAED,SAAS,cAAc,CAAC,WAAoB;IAC1C,IAAI,WAAW,KAAK,IAAI,IAAI,OAAO,WAAW,KAAK,QAAQ,IAAI,SAAS,IAAI,WAAW,EAAE,CAAC;QACxF,MAAM,QAAQ,GAAI,WAAoC,CAAC,OAAO,CAAC;QAC/D,IAAI,CAAC,SAAS,CAAC,QAAQ,CAAC,EAAE,CAAC;YACzB,MAAM,IAAI,uBAAuB,CAAC,yCAAyC,CAAC,CAAC;QAC/E,CAAC;QACD,OAAO,QAAQ,CAAC;IAClB,CAAC;IACD,MAAM,OAAO,GAAG,cAAc,CAAC,QAAQ,EAAE,CAAC;IAC1C,IAAI,OAAO,KAAK,SAAS,EAAE,CAAC;QAC1B,MAAM,IAAI,uBAAuB,CAC/B,mFAAmF,CACpF,CAAC;IACJ,CAAC;IACD,OAAO,OAAO,CAAC;AACjB,CAAC;AAED,SAAS,mBAAmB,CAAC,KAAmB;IAC9C,MAAM,KAAK,GAA0C,EAAE,GAAG,CAAC,KAAK,CAAC,KAAK,IAAI,EAAE,CAAC,EAAE,CAAC;IAChF,KAAK,MAAM,IAAI,IAAI,KAAK,CAAC,KAAK,IAAI,EAAE,EAAE,CAAC;QACrC,IAAI,IAAI,KAAK,IAAI,IAAI,OAAO,IAAI,KAAK,QAAQ,EAAE,CAAC;YAC9C,MAAM,IAAI,uBAAuB,CAAC,qDAAqD,CAAC,CAAC;QAC3F,CAAC;QACD,MAAM,MAAM,GAAG,YAAY,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC;QACtC,IAAI,MAAM,KAAK,SAAS,EAAE,CAAC;YACzB,MAAM,IAAI,uBAAuB,CAAC,qDAAqD,CAAC,CAAC;QAC3F,CAAC;QACD,MAAM,QAAQ,GAAG,KAAK,CAAC,MAAM,CAAC,UAAU,CAAC,CAAC;QAC1C,IAAI,QAAQ,KAAK,SAAS,IAAI,CAAC,SAAS,CAAC,QAAQ,EAAE,MAAM,CAAC,KAAK,CAAC,EAAE,CAAC;YACjE,MAAM,IAAI,uBAAuB,CAC/B,yCAAyC,MAAM,CAAC,UAAU,EAAE,CAC7D,CAAC;QACJ,CAAC;QACD,KAAK,CAAC,MAAM,CAAC,UAAU,CAAC,GAAG,MAAM,CAAC,KAAK,CAAC;IAC1C,CAAC;IACD,OAAO,KAAK,CAAC;AACf,CAAC;AAED,SAAS,SAAS,CAAC,IAAiB,EAAE,KAAkB;IACtD,OAAO,IAAI,CAAC,SAAS,CAAC,WAAW,CAAC,IAAI,CAAC,CAAC,KAAK,IAAI,CAAC,SAAS,CAAC,WAAW,CAAC,KAAK,CAAC,CAAC,CAAC;AAClF,CAAC;AAED,SAAS,WAAW,CAAC,KAAkB;IACrC,MAAM,IAAI,GAAG,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,IAAI,EAAE,CAAC;IACvC,MAAM,GAAG,GAA6C,EAAE,CAAC;IACzD,KAAK,MAAM,GAAG,IAAI,IAAI,EAAE,CAAC;QACvB,MAAM,KAAK,GAAG,KAAK,CAAC,GAAG,CAAC,CAAC;QACzB,IAAI,KAAK,KAAK,SAAS,EAAE,CAAC;YACxB,GAAG,CAAC,GAAG,CAAC,GAAG,KAAK,CAAC;QACnB,CAAC;IACH,CAAC;IACD,OAAO,GAAG,CAAC;AACb,CAAC;AAED,8EAA8E;AAC9E,6EAA6E;AAC7E,8EAA8E;AAE9E,SAAS,aAAa,CAAC,OAAiC;IACtD,MAAM,IAAI,GAAG,OAAO,OAAO,KAAK,QAAQ,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,OAAO,CAAC,WAAW,CAAC;IACzE,MAAM,GAAG,GAAG,IAAI,CAAC,IAAI,EAAE,CAAC,WAAW,EAAE,CAAC;IACtC,IAAI,CAAC,gBAAgB,CAAC,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC;QAChC,MAAM,IAAI,uBAAuB,CAAC,kEAAkE,CAAC,CAAC;IACxG,CAAC;IACD,OAAO,GAAG,CAAC;AACb,CAAC;AAED,+FAA+F;AAC/F,MAAM,UAAU,YAAY,CAC1B,OAAiC,EACjC,cAA0B,EAC1B,OAA4B;IAE5B,IAAI,CAAC,CAAC,cAAc,YAAY,UAAU,CAAC,IAAI,cAAc,CAAC,MAAM,KAAK,EAAE,EAAE,CAAC;QAC5E,MAAM,IAAI,uBAAuB,CAAC,mDAAmD,CAAC,CAAC;IACzF,CAAC;IACD,IAAI,OAAO,KAAK,IAAI,IAAI,OAAO,OAAO,KAAK,QAAQ,IAAI,OAAO,OAAO,CAAC,UAAU,KAAK,QAAQ,IAAI,OAAO,CAAC,UAAU,CAAC,IAAI,EAAE,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QACxI,MAAM,IAAI,uBAAuB,CAAC,0DAA0D,CAAC,CAAC;IAChG,CAAC;IACD,IAAI,OAAO,CAAC,UAAU,KAAK,SAAS,IAAI,CAAC,CAAC,MAAM,CAAC,SAAS,CAAC,OAAO,CAAC,UAAU,CAAC,IAAI,OAAO,CAAC,UAAU,GAAG,CAAC,CAAC,EAAE,CAAC;QAC1G,MAAM,IAAI,uBAAuB,CAAC,sDAAsD,CAAC,CAAC;IAC5F,CAAC;IACD,MAAM,gBAAgB,GACpB,OAAO,CAAC,gBAAgB,IAAI,CAAC,OAAO,OAAO,KAAK,QAAQ,CAAC,CAAC,CAAC,OAAO,CAAC,gBAAgB,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC;IACnG,IAAI,CAAC;QACH,OAAO,QAAQ,EAAE,CAAC,yBAAyB,CACzC,aAAa,CAAC,OAAO,CAAC,EACtB,cAAc,EACd,OAAO,CAAC,UAAU,EAClB,OAAO,CAAC,UAAU,EAClB,gBAAgB,CACjB,CAAC;IACJ,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,MAAM,IAAI,uBAAuB,CAAC,YAAY,CAAC,KAAK,CAAC,CAAC,CAAC;IACzD,CAAC;AACH,CAAC;AAED,mFAAmF;AACnF,MAAM,UAAU,eAAe,CAAC,QAA6B;IAC3D,MAAM,IAAI,GAAG,OAAO,QAAQ,KAAK,QAAQ,CAAC,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC,MAAM,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC,QAAQ,CAAC,QAAQ,CAAC,CAAC;IAChG,IAAI,GAAG,CAAC;IACR,IAAI,CAAC;QACH,GAAG,GAAG,QAAQ,EAAE,CAAC,kBAAkB,CAAC,IAAI,CAAC,CAAC;IAC5C,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,MAAM,IAAI,uBAAuB,CAAC,YAAY,CAAC,KAAK,CAAC,CAAC,CAAC;IACzD,CAAC;IACD,MAAM,GAAG,GAA6D;QACpE,iBAAiB,EAAE,GAAG,CAAC,mBAAmB;QAC1C,WAAW,EAAE,GAAG,CAAC,YAAY;QAC7B,UAAU,EAAE,GAAG,CAAC,WAAW;QAC3B,UAAU,EAAE,GAAG,CAAC,WAAW;QAC3B,SAAS,EAAE,GAAG,CAAC,UAAU;QACzB,OAAO,EAAE,GAAG,CAAC,OAAO;QACpB,cAAc,EAAE,GAAG,CAAC,eAAe;KACpC,CAAC;IACF,IAAI,GAAG,CAAC,KAAK,KAAK,SAAS,EAAE,CAAC;QAC5B,GAAG,CAAC,KAAK,GAAG,GAAG,CAAC,KAAK,CAAC;IACxB,CAAC;IACD,OAAO,GAAG,CAAC;AACb,CAAC;AAED,6DAA6D;AAC7D,MAAM,UAAU,kBAAkB,CAAC,KAA0B,EAAE,YAAwB;IACrF,IAAI,CAAC,CAAC,YAAY,YAAY,UAAU,CAAC,IAAI,YAAY,CAAC,MAAM,KAAK,EAAE,EAAE,CAAC;QACxE,MAAM,IAAI,uBAAuB,CAAC,uDAAuD,CAAC,CAAC;IAC7F,CAAC;IACD,MAAM,EAAE,GAAG,EAAE,OAAO,EAAE,GAAG,eAAe,CAAC,KAAK,CAAC,CAAC;IAChD,IAAI,CAAC;QACH,OAAO,QAAQ,EAAE,CAAC,8BAA8B,CAAC,GAAG,EAAE,OAAO,EAAE,YAAY,CAAC,CAAC;IAC/E,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,MAAM,IAAI,uBAAuB,CAAC,YAAY,CAAC,KAAK,CAAC,CAAC,CAAC;IACzD,CAAC;AACH,CAAC;AAED,MAAM,UAAU,qBAAqB,CAAC,IAAyB;IAC7D,IAAI,GAAG,CAAC;IACR,IAAI,CAAC;QACH,GAAG,GAAG,QAAQ,EAAE,CAAC,wBAAwB,CAAC,kBAAkB,CAAC,IAAI,CAAC,CAAC,CAAC;IACtE,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,MAAM,IAAI,uBAAuB,CAAC,YAAY,CAAC,KAAK,CAAC,CAAC,CAAC;IACzD,CAAC;IACD,OAAO;QACL,OAAO,EAAE,GAAG,CAAC,OAAO;QACpB,QAAQ,EAAE,GAAG,CAAC,SAAS;QACvB,eAAe,EAAE,GAAG,CAAC,iBAAiB;QACtC,UAAU,EAAE,CAAC,GAAG,GAAG,CAAC,WAAW,CAAC;QAChC,cAAc,EAAE,GAAG,CAAC,eAAe;KACpC,CAAC;AACJ,CAAC;AAED,8DAA8D;AAC9D,MAAM,UAAU,aAAa,CAAC,IAAyB;IACrD,IAAI,GAAG,CAAC;IACR,IAAI,CAAC;QACH,GAAG,GAAG,QAAQ,EAAE,CAAC,gBAAgB,CAAC,kBAAkB,CAAC,IAAI,CAAC,CAAC,CAAC;IAC9D,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,MAAM,IAAI,uBAAuB,CAAC,YAAY,CAAC,KAAK,CAAC,CAAC,CAAC;IACzD,CAAC;IACD,MAAM,GAAG,GAA2D;QAClE,SAAS,EAAE,IAAI;QACf,SAAS,EAAE,GAAG,CAAC,UAAU;QACzB,OAAO,EAAE,GAAG,CAAC,OAAO;QACpB,MAAM,EAAE,GAAG,CAAC,MAAM;QAClB,SAAS,EAAE,GAAG,CAAC,UAAU;KAC1B,CAAC;IACF,IAAI,GAAG,CAAC,aAAa,KAAK,SAAS;QAAE,GAAG,CAAC,YAAY,GAAG,GAAG,CAAC,aAAa,CAAC;IAC1E,IAAI,GAAG,CAAC,WAAW,KAAK,SAAS;QAAE,GAAG,CAAC,UAAU,GAAG,GAAG,CAAC,WAAW,CAAC;IACpE,IAAI,GAAG,CAAC,QAAQ,KAAK,SAAS;QAAE,GAAG,CAAC,OAAO,GAAG,GAAG,CAAC,QAAQ,CAAC;IAC3D,IAAI,GAAG,CAAC,YAAY,KAAK,SAAS;QAAE,GAAG,CAAC,WAAW,GAAG,GAAG,CAAC,YAAY,CAAC;IACvE,IAAI,GAAG,CAAC,sBAAsB,KAAK,SAAS;QAAE,GAAG,CAAC,oBAAoB,GAAG,GAAG,CAAC,sBAAsB,CAAC;IACpG,IAAI,GAAG,CAAC,iBAAiB,KAAK,SAAS;QAAE,GAAG,CAAC,eAAe,GAAG,GAAG,CAAC,iBAAiB,CAAC;IACrF,IAAI,GAAG,CAAC,kBAAkB,KAAK,SAAS;QAAE,GAAG,CAAC,gBAAgB,GAAG,GAAG,CAAC,kBAAkB,CAAC;IACxF,OAAO,GAAG,CAAC;AACb,CAAC;AAED;;;GAGG;AACH,MAAM,UAAU,kBAAkB,CAAC,IAAyB,EAAE,KAAiC;IAC7F,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC,IAAI,KAAK,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QAChD,MAAM,IAAI,uBAAuB,CAAC,yDAAyD,CAAC,CAAC;IAC/F,CAAC;IACD,IAAI,GAAG,CAAC;IACR,IAAI,CAAC;QACH,GAAG,GAAG,QAAQ,EAAE,CAAC,qBAAqB,CACpC,kBAAkB,CAAC,IAAI,CAAC,EACxB,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,EAAE,CAAC,gBAAgB,CAAC,CAAC,EAAE,SAAS,CAAC,GAAG,CAAC,CAAC,GAAG,CAAC,CAC5D,CAAC;IACJ,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,MAAM,IAAI,uBAAuB,CAAC,YAAY,CAAC,KAAK,CAAC,CAAC,CAAC;IACzD,CAAC;IACD,MAAM,GAAG,GAAqE;QAC5E,SAAS,EAAE,GAAG,CAAC,UAAU;QACzB,OAAO,EAAE,GAAG,CAAC,OAAO;QACpB,SAAS,EAAE,GAAG,CAAC,SAAS;QACxB,UAAU,EAAE,GAAG,CAAC,WAAW;KAC5B,CAAC;IACF,IAAI,GAAG,CAAC,aAAa,KAAK,SAAS;QAAE,GAAG,CAAC,YAAY,GAAG,GAAG,CAAC,aAAa,CAAC;IAC1E,IAAI,GAAG,CAAC,WAAW,KAAK,SAAS;QAAE,GAAG,CAAC,UAAU,GAAG,GAAG,CAAC,WAAW,CAAC;IACpE,IAAI,GAAG,CAAC,mBAAmB,KAAK,SAAS;QAAE,GAAG,CAAC,kBAAkB,GAAG,GAAG,CAAC,mBAAmB,CAAC;IAC5F,IAAI,GAAG,CAAC,WAAW,KAAK,SAAS;QAAE,GAAG,CAAC,UAAU,GAAG,GAAG,CAAC,WAAW,CAAC;IACpE,IAAI,GAAG,CAAC,WAAW,KAAK,SAAS;QAAE,GAAG,CAAC,UAAU,GAAG,GAAG,CAAC,WAAW,CAAC;IACpE,OAAO,GAAG,CAAC;AACb,CAAC;AAED;;;GAGG;AACH,MAAM,UAAU,6BAA6B,CAC3C,OAAwB,EACxB,OAGC;IAED,IAAI,OAAO,KAAK,IAAI,IAAI,OAAO,OAAO,KAAK,QAAQ,IAAI,OAAO,OAAO,CAAC,WAAW,KAAK,QAAQ,EAAE,CAAC;QAC/F,MAAM,IAAI,uBAAuB,CAAC,uFAAuF,CAAC,CAAC;IAC7H,CAAC;IACD,MAAM,IAAI,GAA+F;QACvG,cAAc,EAAE,CAAC;QACjB,cAAc,EAAE,OAAO,CAAC,SAAS;QACjC,UAAU,EAAE,OAAO,CAAC,SAAS;QAC7B,IAAI,EAAE,OAAO,CAAC,IAAI;QAClB,SAAS,EAAE,EAAE,GAAG,OAAO,CAAC,IAAI,EAAE;QAC9B,gBAAgB,EAAE,OAAO,CAAC,WAAW;QACrC,qBAAqB,EAAE,OAAO,CAAC,eAAe;QAC9C,0BAA0B,EAAE,CAAC,GAAG,OAAO,CAAC,iBAAiB,CAAC;QAC1D,aAAa,EAAE,IAAI,CAAC,GAAG,CAAC,CAAC,EAAE,OAAO,CAAC,YAAY,CAAC;QAChD,uBAAuB,EAAE,OAAO,CAAC,gBAAgB;QACjD,eAAe,EAAE,OAAO,CAAC,SAAS;KACnC,CAAC;IACF,IAAI,OAAO,EAAE,WAAW,KAAK,SAAS,EAAE,CAAC;QACvC,MAAM,CAAC,GAAG,OAAO,CAAC,WAAW,CAAC;QAC9B,IAAI,CAAC,WAAW,GAAG;YACjB,OAAO,EAAE,CAAC,CAAC,OAAO;YAClB,gBAAgB,EAAE,CAAC,CAAC,gBAAgB;YACpC,UAAU,EAAE,CAAC,CAAC,SAAS;YACvB,IAAI,EAAE,CAAC,CAAC,IAAI;YACZ,YAAY,EAAE,CAAC,CAAC,WAAW;YAC3B,cAAc,EAAE,CAAC,CAAC,YAAY;YAC9B,uBAAuB,EAAE,CAAC,CAAC,oBAAoB;YAC/C,cAAc,EAAE,CAAC,CAAC,YAAY;YAC9B,aAAa,EAAE,CAAC,CAAC,YAAY;YAC7B,2CAA2C;YAC3C,UAAU,EAAE,CAAC,CAAC,YAAY;YAC1B,SAAS,EAAE,CAAC,CAAC,YAAY;SAC1B,CAAC;IACJ,CAAC;IACD,IAAI,OAAO,EAAE,QAAQ,KAAK,SAAS,IAAI,MAAM,CAAC,IAAI,CAAC,OAAO,CAAC,QAAQ,CAAC,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;QAChF,IAAI,CAAC,QAAQ,GAAG,EAAE,GAAG,OAAO,CAAC,QAAQ,EAAE,CAAC;IAC1C,CAAC;IACD,IAAI,OAAO,CAAC,OAAO,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;QAC/B,IAAI,CAAC,OAAO,GAAG,OAAO,CAAC,OAAO,CAAC;IACjC,CAAC;IACD,OAAO,IAAI,CAAC;AACd,CAAC;AAED,sHAAsH;AACtH,MAAM,UAAU,6BAA6B,CAAC,QAAwC;IACpF,IAAI,QAAQ,KAAK,IAAI,IAAI,OAAO,QAAQ,KAAK,QAAQ,IAAI,OAAO,QAAQ,CAAC,MAAM,KAAK,QAAQ,EAAE,CAAC;QAC7F,MAAM,IAAI,uBAAuB,CAAC,mDAAmD,CAAC,CAAC;IACzF,CAAC;IACD,IAAI,QAAQ,CAAC,MAAM,KAAK,UAAU,EAAE,CAAC;QACnC,OAAO,EAAE,CAAC;IACZ,CAAC;IACD,MAAM,IAAI,GAAG,QAAQ,CAAC,oBAAoB,CAAC;IAC3C,IAAI,IAAI,KAAK,SAAS,IAAI,IAAI,KAAK,IAAI,EAAE,CAAC;QACxC,OAAO,EAAE,CAAC;IACZ,CAAC;IACD,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,IAAI,CAAC,IAAI,IAAI,CAAC,IAAI,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,OAAO,IAAI,KAAK,QAAQ,IAAI,IAAI,CAAC,MAAM,KAAK,CAAC,CAAC,EAAE,CAAC;QAC/F,MAAM,IAAI,uBAAuB,CAAC,yDAAyD,CAAC,CAAC;IAC/F,CAAC;IACD,OAAO,CAAC,GAAG,IAAI,CAAC,CAAC;AACnB,CAAC;AAED,SAAS,eAAe,CAAC,UAA8B,EAAE;IACvD,IAAI,CAAC,cAAc,CAAC,OAAO,CAAC,EAAE,CAAC;QAC7B,MAAM,IAAI,uBAAuB,CAC/B,gHAAgH,CACjH,CAAC;IACJ,CAAC;IACD,IAAI,OAAO,CAAC,IAAI,EAAE,IAAI,KAAK,UAAU,IAAI,CAAC,cAAc,CAAC,OAAO,CAAC,IAAI,CAAC,EAAE,CAAC;QACvE,MAAM,IAAI,uBAAuB,CAAC,qBAAqB,EAAE,CAAC,CAAC;IAC7D,CAAC;IACD,QAAQ,EAAE,CAAC;IACX,OAAO,IAAI,WAAW,CAAC,OAAO,CAAC,CAAC;AAClC,CAAC;AAED,MAAM,CAAC,MAAM,WAAW,GAyBpB,MAAM,CAAC,MAAM,CAAC,eAAe,EAAE;IACjC,OAAO;IACP,gBAAgB;IAChB,gBAAgB;IAChB,kBAAkB;IAClB,gBAAgB;IAChB,gBAAgB;IAChB,iBAAiB;IACjB,iBAAiB;IACjB,sBAAsB;IACtB,gBAAgB;IAChB,gBAAgB;IAChB,kBAAkB;IAClB,YAAY;IACZ,eAAe;IACf,kBAAkB;IAClB,qBAAqB;IACrB,aAAa;IACb,kBAAkB;IAClB,6BAA6B;IAC7B,6BAA6B;IAC7B,iBAAiB;IACjB,QAAQ,EAAE,eAAe;IACzB,gBAAgB;IAChB,OAAO,EAAE,CAAC,OAA4C,EAAE,EAAE,CAAC,aAAa,CAAC,eAAe,EAAE,OAAO,CAAC;CACnG,CAAC,CAAC","sourcesContent":["import { AsyncLocalStorage } from \"node:async_hooks\";\nimport { randomBytes } from \"node:crypto\";\nimport type {\n AllowPolicy,\n ApprovalContextAttestation,\n ApprovalInfo,\n ApprovalRequest,\n Clearance,\n ControlPlaneApprovalRequestV1,\n ControlPlaneApprovalResponseV1,\n CreateTenuoOptions,\n DevRoot,\n Explanation,\n IssueInput,\n IssuerKey,\n McpAttachOptions,\n McpVerifyOptions,\n NarrowInput,\n NarrowOptions,\n PresentedCall,\n ProtectedTool,\n PublicKeyHandle,\n ReceiptChainInfo,\n ReceiptInfo,\n RequireApproval,\n RevocationListInfo,\n RevocationListInput,\n SessionFromWireInput,\n SessionInput,\n SignApprovalOptions,\n Tenuo,\n TenuoErrorCode,\n TenuoMcp,\n ToolPolicy,\n} from \"./api.ts\";\nimport { parseConnectToken } from \"./connect.ts\";\nimport { generateIdentity, identityFromKey } from \"./identity.ts\";\nimport { createMcp, presentCall, verifyPresented, type Decide } from \"./mcp.ts\";\nimport { collectReceipt, emitIsolatedReceipt, inheritSessionCollector } from \"./receipts.ts\";\nimport { createRuntime } from \"./runtime.ts\";\nimport { AuthorizationDeniedError, ApprovalRequiredError, TenuoConfigurationError, TenuoError } from \"./errors.ts\";\nimport { Session, isSession, nativeSession } from \"./session.ts\";\nimport {\n createDevContext,\n createIssuerContext,\n createVerifierContext,\n importSessionFromChain,\n importSessionFromWire,\n loadWasm,\n protocolLimits,\n publicKeyHexFromHolderKey,\n type WasmApprovalRequest,\n type WasmAttestation,\n type WasmContext,\n type WasmExplain,\n type WasmIssueOptions,\n type WasmMintOptions,\n type WasmNarrowOptions,\n type WasmRequireApproval,\n} from \"./wasm.ts\";\n\nconst currentSession = new AsyncLocalStorage<Session>();\nconst toolPolicies = new WeakMap<object, { capability: string; allow: AllowPolicy }>();\nconst wrappedInners = new WeakSet<object>();\n\nconst CLEARANCE_NAMES = new Set([\"untrusted\", \"external\", \"partner\", \"internal\", \"privileged\", \"system\"]);\n\nfunction nodeEnv(): string | undefined {\n if (typeof process === \"undefined\") {\n return undefined;\n }\n return process.env.NODE_ENV;\n}\n\nfunction allowDev(): boolean {\n if (typeof process === \"undefined\") {\n return false;\n }\n return process.env.TENUO_ALLOW_DEV === \"1\";\n}\n\nexport function devRoot(options?: { readonly allowInProduction?: boolean }): DevRoot {\n const root: DevRoot = {\n kind: \"dev-root\",\n ...(options?.allowInProduction === true ? { allowInProduction: true } : {}),\n };\n if (!devRootAllowed(root)) {\n throw new TenuoConfigurationError(devRootBlockedMessage());\n }\n return root;\n}\n\nfunction devRootAllowed(root: DevRoot): boolean {\n if (root.allowInProduction === true || allowDev()) {\n return true;\n }\n const env = nodeEnv();\n return env === \"development\" || env === \"test\";\n}\n\nfunction devRootBlockedMessage(): string {\n return \"createTenuo.devRoot() is for development. Set NODE_ENV=development or test, pass devRoot({ allowInProduction: true }), or TENUO_ALLOW_DEV=1. Unset NODE_ENV is not treated as development.\";\n}\n\nfunction normalizeHex(value: string): string {\n const hex = value.trim().toLowerCase().replace(/^0x/, \"\");\n if (!/^[0-9a-f]{64}$/.test(hex)) {\n throw new TenuoConfigurationError(\n \"Trusted root must be a 32-byte hex public key (64 hex characters)\",\n );\n }\n return hex;\n}\n\nfunction envValue(name: string, what: string): string {\n if (name.length === 0) {\n throw new TenuoConfigurationError(`${what} requires an environment variable name`);\n }\n if (typeof process === \"undefined\") {\n throw new TenuoConfigurationError(\n `Environment variable ${name} is not available. Tenuo fails closed without a ${what}.`,\n );\n }\n const value = process.env[name];\n if (value === undefined || value.length === 0) {\n throw new TenuoConfigurationError(\n `Environment variable ${name} is not set or empty. Tenuo fails closed without a ${what}.`,\n );\n }\n return value;\n}\n\nexport function publicKeyFromEnv(name: string): PublicKeyHandle {\n return { kind: \"public-key\", source: \"env\", hex: normalizeHex(envValue(name, \"trusted root\")) };\n}\n\nexport function publicKeyFromHex(hex: string): PublicKeyHandle {\n return { kind: \"public-key\", source: \"hex\", hex: normalizeHex(hex) };\n}\n\nexport function publicKeyFromBytes(bytes: Uint8Array): PublicKeyHandle {\n if (bytes.length !== 32) {\n throw new TenuoConfigurationError(\"publicKeyFromBytes() requires a 32-byte public key\");\n }\n return { kind: \"public-key\", source: \"bytes\", hex: bytesToHex(bytes) };\n}\n\nfunction normalizeSecretHex(value: string, what: string): string {\n const hex = value.trim().toLowerCase().replace(/^0x/, \"\");\n if (!/^[0-9a-f]{64}$/.test(hex)) {\n throw new TenuoConfigurationError(`${what} must be a 32-byte hex secret (64 hex characters)`);\n }\n return hex;\n}\n\nfunction hexToBytes(hex: string): Uint8Array {\n const bytes = new Uint8Array(hex.length / 2);\n for (let i = 0; i < bytes.length; i += 1) {\n bytes[i] = Number.parseInt(hex.slice(i * 2, i * 2 + 2), 16);\n }\n return bytes;\n}\n\nfunction bytesToHex(bytes: Uint8Array): string {\n return Array.from(bytes, (b) => b.toString(16).padStart(2, \"0\")).join(\"\");\n}\n\nexport function holderKeyFromEnv(name: string): Uint8Array {\n return hexToBytes(normalizeSecretHex(envValue(name, \"holder key\"), \"Holder key\"));\n}\n\nexport function holderKeyFromHex(hex: string): Uint8Array {\n return hexToBytes(normalizeSecretHex(hex, \"Holder key\"));\n}\n\n/**\n * A fresh 32-byte Ed25519 secret. One per agent, kept in that agent's\n * process; only its public key (see `publicKeyFromHolderKey`) travels.\n */\nexport function generateHolderKey(): Uint8Array {\n return new Uint8Array(randomBytes(32));\n}\n\n/** Same shape as a holder key. Named separately so a control plane's key reads as one. */\nexport function generateIssuerKey(): Uint8Array {\n return generateHolderKey();\n}\n\n/** The public half of a holder or issuer secret. */\nexport function publicKeyFromHolderKey(holderKey: Uint8Array): PublicKeyHandle {\n if (!(holderKey instanceof Uint8Array) || holderKey.length !== 32) {\n throw new TenuoConfigurationError(\"publicKeyFromHolderKey() requires a 32-byte holder key\");\n }\n loadWasm();\n return { kind: \"public-key\", source: \"bytes\", hex: publicKeyHexFromHolderKey(holderKey) };\n}\n\nconst MAX_WASM_U32 = 0xffff_ffff;\n\nfunction requireUint32(value: number, name: string, minimum = 0): number {\n if (!Number.isInteger(value) || value < minimum || value > MAX_WASM_U32) {\n throw new TenuoConfigurationError(\n `${name} must be an integer between ${minimum} and ${MAX_WASM_U32}`,\n );\n }\n return value;\n}\n\n/** Stable control-plane key from the environment. This process becomes an issuer. */\nexport function issuerKeyFromEnv(name: string): IssuerKey {\n return { kind: \"issuer-key\", secret: hexToBytes(normalizeSecretHex(envValue(name, \"issuer key\"), \"Issuer key\")) };\n}\n\nexport function issuerKeyFromHex(hex: string): IssuerKey {\n return { kind: \"issuer-key\", secret: hexToBytes(normalizeSecretHex(hex, \"Issuer key\")) };\n}\n\nexport function issuerKeyFromBytes(secret: Uint8Array): IssuerKey {\n if (!(secret instanceof Uint8Array) || secret.length !== 32) {\n throw new TenuoConfigurationError(\"issuerKeyFromBytes() requires a 32-byte secret\");\n }\n return { kind: \"issuer-key\", secret: new Uint8Array(secret) };\n}\n\nfunction requireDepth(value: number, name: string): number {\n requireUint32(value, name);\n const maximum = protocolLimits().max_delegation_depth;\n if (value > maximum) {\n throw new TenuoConfigurationError(\n `${name} ${value} exceeds the protocol maximum of ${maximum}`,\n );\n }\n return value;\n}\n\nfunction requireTtl(value: number, name: string, minimum = 0): number {\n requireUint32(value, name, minimum);\n const maximum = protocolLimits().max_warrant_ttl_seconds;\n if (value > maximum) {\n throw new TenuoConfigurationError(\n `${name} ${value} exceeds the protocol maximum of ${maximum}`,\n );\n }\n return value;\n}\n\nfunction requirePublicKey(value: unknown, name: string): PublicKeyHandle {\n if (\n value === null ||\n typeof value !== \"object\" ||\n (value as { kind?: unknown }).kind !== \"public-key\" ||\n typeof (value as { hex?: unknown }).hex !== \"string\"\n ) {\n throw new TenuoConfigurationError(\n `${name} must be a public key handle (createTenuo.publicKeyFromHolderKey / publicKeyFromHex / publicKeyFromEnv)`,\n );\n }\n return value as PublicKeyHandle;\n}\n\nfunction clearanceJson(value: Clearance, name: string): number | string {\n if (typeof value === \"number\") {\n if (!Number.isInteger(value) || value < 0 || value > 255) {\n throw new TenuoConfigurationError(`${name} must be an integer 0-255 or a level name`);\n }\n return value;\n }\n if (typeof value === \"string\" && CLEARANCE_NAMES.has(value)) {\n return value;\n }\n throw new TenuoConfigurationError(\n `${name} must be one of ${[...CLEARANCE_NAMES].join(\", \")} or an integer 0-255`,\n );\n}\n\nfunction rootHexes(options: CreateTenuoOptions): string[] {\n const handles: PublicKeyHandle[] = [];\n if (options.root !== undefined && options.root.kind === \"public-key\") {\n handles.push(options.root);\n }\n for (const root of options.trustedRoots ?? []) {\n handles.push(root);\n }\n return handles.map((h) => h.hex);\n}\n\nfunction hasTrustAnchor(options: CreateTenuoOptions): boolean {\n if (options.root !== undefined) {\n return true;\n }\n return (options.trustedRoots?.length ?? 0) > 0;\n}\n\nfunction capabilityName(inner: object, policy: Pick<ToolPolicy, \"capability\">): string {\n if (policy.capability !== undefined && policy.capability.length > 0) {\n return policy.capability;\n }\n const named = inner as { name?: unknown; id?: unknown };\n if (typeof named.name === \"string\" && named.name.length > 0) {\n return named.name;\n }\n if (typeof named.id === \"string\" && named.id.length > 0) {\n return named.id;\n }\n throw new TenuoConfigurationError(\n \"tenuo.tool() needs a capability name (policy.capability, or tool.name / tool.id)\",\n );\n}\n\nclass TenuoClient implements Tenuo {\n private readonly context: WasmContext;\n private readonly canMint: boolean;\n readonly mcp: TenuoMcp;\n private readonly decide: Decide;\n\n constructor(options: CreateTenuoOptions) {\n if (options.root?.kind === \"dev-root\") {\n this.context = createDevContext(options.receiptSigner);\n this.canMint = true;\n } else if (options.root?.kind === \"issuer-key\") {\n if (!(options.root.secret instanceof Uint8Array) || options.root.secret.length !== 32) {\n throw new TenuoConfigurationError(\"root: issuer key must be a 32-byte secret\");\n }\n this.context = createIssuerContext(\n options.root.secret,\n rootHexes(options),\n options.receiptSigner,\n );\n this.canMint = true;\n } else {\n this.context = createVerifierContext(\n rootHexes(options),\n undefined,\n options.receiptSigner,\n );\n this.canMint = false;\n }\n if (options.revocationList !== undefined) {\n this.context.loadRevocationList(normalizeWireBytes(options.revocationList));\n }\n this.decide = (decision, tool, native, args) => {\n this.applyDecision(decision, tool, native, args);\n };\n this.mcp = createMcp(this.context, this.decide, this);\n }\n\n private applyDecision(\n decision: { outcome: string; code?: string; field?: string; message?: string; tool?: string; required?: number; received?: number },\n tool: string,\n native?: object,\n args?: Record<string, unknown>,\n ): void {\n if (decision.outcome === \"allow\") {\n return;\n }\n if (decision.outcome === \"approval_required\") {\n let request: ApprovalRequest | undefined;\n if (native !== undefined && args !== undefined) {\n try {\n request = approvalRequestFromWasm(this.context.approvalRequest(native, tool, args));\n } catch {\n request = undefined;\n }\n }\n throw new ApprovalRequiredError(\n decision.tool ?? tool,\n decision.required ?? 1,\n decision.received ?? 0,\n decision.message,\n request,\n );\n }\n throw new AuthorizationDeniedError(\n (decision.code as TenuoErrorCode | undefined) ?? \"TENUO_TOOL_NOT_AUTHORIZED\",\n explainDeny(decision.message ?? \"Authorization denied\", decision.field),\n decision.field,\n );\n }\n\n tool<T extends { execute: (args: never) => unknown }>(\n inner: T,\n policy: ToolPolicy<Parameters<T[\"execute\"]>[0]>,\n ): ProtectedTool<T> {\n if (toolPolicies.has(inner) || wrappedInners.has(inner)) {\n throw new TenuoConfigurationError(\"tenuo.tool() already wrapped this tool\");\n }\n const capability = capabilityName(inner, policy);\n const original = inner.execute as (\n args: Record<string, unknown>,\n options?: unknown,\n ) => unknown;\n const execute = async (args: never, callOptions?: unknown) => {\n const session = resolveSession(callOptions);\n const native = nativeSession(session);\n const decision = this.context.authorize(\n native,\n capability,\n args,\n approvalsFrom(callOptions),\n policy.allow,\n requestIdFrom(callOptions),\n );\n emitReceipt(callOptions, decision.receipt, session, this);\n if (decision.outcome === \"allow\") {\n return original(plainArgs(decision.args), forwardExecuteOptions(callOptions));\n }\n this.applyDecision(decision, capability, native, plainArgs(args));\n throw new TenuoConfigurationError(\"unreachable: decision was neither allow nor deny\");\n };\n\n const wrapped = Object.assign(Object.create(Object.getPrototypeOf(inner)), inner, {\n execute,\n }) as ProtectedTool<T>;\n wrappedInners.add(inner);\n toolPolicies.set(wrapped, { capability, allow: { ...policy.allow } as AllowPolicy });\n return wrapped;\n }\n\n session(input: SessionInput): Session {\n const allow = collectSessionAllow(input);\n const kind = input.kind ?? \"execution\";\n if (kind !== \"execution\" && kind !== \"issuer\") {\n throw new TenuoConfigurationError('session().kind must be \"execution\" or \"issuer\"');\n }\n if (Object.keys(allow).length === 0 && kind === \"execution\") {\n throw new TenuoConfigurationError(\n \"tenuo.session() requires tools from tenuo.tool() or at least one capability in allow\",\n );\n }\n if (!this.canMint) {\n throw new TenuoConfigurationError(\n \"session() mints a warrant and needs a local issuer. Use createTenuo({ root: createTenuo.devRoot() }) or an issuer key.\",\n );\n }\n const options: WasmMintOptions = { kind, allow };\n if (input.ttlSeconds !== undefined) {\n options.ttlSeconds = requireTtl(input.ttlSeconds, \"session().ttlSeconds\");\n }\n if (input.holder !== undefined) {\n options.holder = requirePublicKey(input.holder, \"session().holder\").hex;\n }\n if (input.maxDepth !== undefined) {\n options.maxDepth = requireDepth(input.maxDepth, \"session().maxDepth\");\n }\n if (input.clearance !== undefined) {\n options.clearance = clearanceJson(input.clearance, \"session().clearance\");\n }\n if (input.sessionId !== undefined) {\n options.sessionId = requireLabel(input.sessionId, \"session().sessionId\");\n }\n if (input.agentId !== undefined) {\n options.agentId = requireLabel(input.agentId, \"session().agentId\");\n }\n if (input.requireApproval !== undefined) {\n options.requireApproval = requireApprovalJson(input.requireApproval);\n }\n if (input.issuableTools !== undefined) {\n options.issuableTools = [...input.issuableTools];\n }\n if (input.constraintBounds !== undefined) {\n options.constraintBounds = input.constraintBounds;\n }\n if (input.maxIssueDepth !== undefined) {\n options.maxIssueDepth = requireDepth(input.maxIssueDepth, \"session().maxIssueDepth\");\n }\n try {\n return new Session(this.context.mintExtended(options));\n } catch (error) {\n throw new TenuoConfigurationError(errorMessage(error));\n }\n }\n\n issue(issuer: Session, input: IssueInput): Session {\n if (!isSession(issuer)) {\n throw new TenuoConfigurationError(\"issue() requires a Tenuo Session, not a plain object\");\n }\n if (input === null || typeof input !== \"object\" || input.allow === undefined || Object.keys(input.allow).length === 0) {\n throw new TenuoConfigurationError(\"issue() requires at least one capability in allow\");\n }\n const options: WasmIssueOptions = {\n allow: input.allow,\n holder: requirePublicKey(input.holder, \"issue().holder\").hex,\n };\n if (input.ttlSeconds !== undefined) {\n options.ttlSeconds = requireTtl(input.ttlSeconds, \"issue().ttlSeconds\", 1);\n }\n if (input.maxDepth !== undefined) {\n options.maxDepth = requireDepth(input.maxDepth, \"issue().maxDepth\");\n }\n if (input.clearance !== undefined) {\n options.clearance = clearanceJson(input.clearance, \"issue().clearance\");\n }\n if (input.sessionId !== undefined) {\n options.sessionId = requireLabel(input.sessionId, \"issue().sessionId\");\n }\n if (input.agentId !== undefined) {\n options.agentId = requireLabel(input.agentId, \"issue().agentId\");\n }\n if (input.requireApproval !== undefined) {\n options.requireApproval = requireApprovalJson(input.requireApproval);\n }\n try {\n return new Session(this.context.issue(nativeSession(issuer), options));\n } catch (error) {\n throw chainError(error);\n }\n }\n\n issuerPublicKey(): PublicKeyHandle {\n if (!this.canMint) {\n throw new TenuoConfigurationError(\n \"issuerPublicKey() needs a local issuer. This context verifies against trustedRoots and does not mint.\",\n );\n }\n return { kind: \"public-key\", source: \"bytes\", hex: this.context.issuerPublicKey() };\n }\n\n sessionFromWire(input: SessionFromWireInput): Session {\n if (!(input.holderKey instanceof Uint8Array) || input.holderKey.length !== 32) {\n throw new TenuoConfigurationError(\"sessionFromWire() requires a 32-byte holderKey\");\n }\n if (typeof input.warrant === \"string\" && input.warrant.trim().length === 0) {\n throw new TenuoConfigurationError(\"sessionFromWire() requires a warrant\");\n }\n try {\n if (typeof input.warrant === \"string\") {\n return new Session(importSessionFromWire(input.warrant, input.holderKey));\n }\n if (input.warrant.length === 0) {\n throw new TenuoConfigurationError(\"sessionFromWire() requires a warrant\");\n }\n return new Session(importSessionFromChain([...input.warrant], input.holderKey));\n } catch (error) {\n throw importWireError(error);\n }\n }\n\n withSession<R>(session: Session, fn: () => R): R {\n if (!isSession(session)) {\n throw new TenuoConfigurationError(\"withSession() requires a Tenuo Session, not a plain object\");\n }\n return currentSession.run(session, fn);\n }\n\n narrow(session: Session, allow: NarrowInput, options?: NarrowOptions): Session {\n if (Object.keys(allow).length === 0) {\n throw new TenuoConfigurationError(\"tenuo.narrow() requires a non-empty allow policy\");\n }\n if (!isSession(session)) {\n throw new TenuoConfigurationError(\"narrow() requires a Tenuo Session, not a plain object\");\n }\n const native = options === undefined ? undefined : narrowOptionsJson(options);\n try {\n const child = new Session(this.context.narrow(nativeSession(session), allow, native));\n inheritSessionCollector(session, child);\n return child;\n } catch (error) {\n throw chainError(error);\n }\n }\n\n explain(session: Session, tool: string, args: Readonly<Record<string, unknown>>): Explanation {\n if (!isSession(session)) {\n throw new TenuoConfigurationError(\"explain() requires a Tenuo Session, not a plain object\");\n }\n let raw: WasmExplain;\n try {\n raw = this.context.explain(nativeSession(session), tool, args);\n } catch (error) {\n throw new TenuoConfigurationError(errorMessage(error));\n }\n const out: { -readonly [K in keyof Explanation]: Explanation[K] } = {\n tool: raw.tool,\n kind: raw.kind,\n outcome: raw.outcome,\n toolGranted: raw.tool_granted,\n fields: raw.fields.map((f) => {\n const field: { -readonly [K in keyof Explanation[\"fields\"][number]]: Explanation[\"fields\"][number][K] } = {\n field: f.field,\n kind: f.kind,\n constraint: f.constraint,\n satisfied: f.satisfied,\n };\n if (f.value !== undefined) {\n field.value = f.value;\n }\n if (f.reason !== undefined) {\n field.reason = f.reason;\n }\n return field;\n }),\n unknownFields: [...raw.unknown_fields],\n missingFields: [...raw.missing_fields],\n expired: raw.expired,\n expiresAt: raw.expires_at,\n chainValid: raw.chain_valid,\n };\n if (raw.code !== undefined) {\n out.code = raw.code;\n }\n if (raw.field !== undefined) {\n out.field = raw.field;\n }\n if (raw.message !== undefined) {\n out.message = raw.message;\n }\n if (raw.chain_error !== undefined) {\n out.chainError = raw.chain_error;\n }\n return out;\n }\n\n approvalRequest(session: Session, tool: string, args: Readonly<Record<string, unknown>>): ApprovalRequest {\n if (!isSession(session)) {\n throw new TenuoConfigurationError(\"approvalRequest() requires a Tenuo Session, not a plain object\");\n }\n try {\n return approvalRequestFromWasm(this.context.approvalRequest(nativeSession(session), tool, args));\n } catch (error) {\n throw new TenuoConfigurationError(errorMessage(error));\n }\n }\n\n attestApprovalRequest(\n session: Session,\n tool: string,\n args: Readonly<Record<string, unknown>>,\n ): ApprovalContextAttestation {\n if (!isSession(session)) {\n throw new TenuoConfigurationError(\"attestApprovalRequest() requires a Tenuo Session, not a plain object\");\n }\n let raw: WasmAttestation;\n try {\n raw = this.context.approvalContextAttestation(nativeSession(session), tool, args);\n } catch (error) {\n throw new TenuoConfigurationError(errorMessage(error));\n }\n return {\n version: raw.version,\n canonicalization: raw.canonicalization,\n warrantId: raw.warrant_id,\n tool: raw.tool,\n requestHash: raw.request_hash,\n holderKeyHex: raw.holder_key_hex,\n argsCanonicalCborB64: raw.args_canonical_cbor_b64,\n signerKeyHex: raw.signer_key_hex,\n signatureB64: raw.signature_b64,\n };\n }\n\n present(\n session: Session,\n tool: string,\n args: Readonly<Record<string, unknown>>,\n options?: McpAttachOptions,\n ): PresentedCall {\n if (!isSession(session)) {\n throw new TenuoConfigurationError(\"present() requires a Tenuo Session, not a plain object\");\n }\n return presentCall(this.context, this.decide, session, tool, args, options, \"present()\", this)\n .presented;\n }\n\n verify(\n presented: PresentedCall,\n tool: string,\n args: Readonly<Record<string, unknown>>,\n options?: McpVerifyOptions,\n ): Promise<Readonly<Record<string, unknown>>> {\n return verifyPresented(\n this.context,\n this.decide,\n presented,\n tool,\n args,\n options,\n \"verify()\",\n this,\n );\n }\n\n revocationList(input: RevocationListInput): string {\n if (!this.canMint) {\n throw new TenuoConfigurationError(\n \"revocationList() needs a local issuer key. Use createTenuo.signRevocationList() with an explicit secret, or an issuer-key root.\",\n );\n }\n const { ids, version } = revocationInput(input);\n try {\n return this.context.signRevocationListVersioned(ids, version);\n } catch (error) {\n throw new TenuoConfigurationError(errorMessage(error));\n }\n }\n\n revoke(list: string | Uint8Array): void {\n this.context.loadRevocationList(normalizeWireBytes(list));\n }\n\n ready(): void {\n loadWasm();\n }\n}\n\nfunction requireLabel(value: string, name: string): string {\n if (typeof value !== \"string\" || value.trim().length === 0) {\n throw new TenuoConfigurationError(`${name} must be a non-empty string`);\n }\n return value;\n}\n\nfunction errorMessage(error: unknown): string {\n return error instanceof Error ? error.message : String(error);\n}\n\n/** Map a prefixed core message from narrow()/issue() to the matching error class. */\nfunction chainError(error: unknown): TenuoError {\n if (error instanceof TenuoError) {\n return error;\n }\n const message = explainChainFailure(errorMessage(error));\n for (const code of [\"TENUO_CHAIN_INVALID\", \"TENUO_DEPTH_EXCEEDED\", \"TENUO_WARRANT_EXPIRED\"] as const) {\n if (message.startsWith(code)) {\n return new AuthorizationDeniedError(code, message);\n }\n }\n return new TenuoConfigurationError(message);\n}\n\nfunction explainChainFailure(message: string): string {\n const tool = /tool '([^']+)' not in parent's tools/.exec(message)?.[1];\n if (tool !== undefined) {\n return `${message}. narrow() cannot add '${tool}': remove it or delegate from a parent that grants it.`;\n }\n if (\n message.includes(\"parent's allowed set\") ||\n message.includes(\"range expanded\") ||\n message.includes(\"would expand permissions\") ||\n message.includes(\"clearance cannot increase\")\n ) {\n return `${message}. narrow() only accepts a child policy that is equal to or stricter than its parent.`;\n }\n return message;\n}\n\nfunction revocationInput(input: RevocationListInput): { ids: string[]; version: number | undefined } {\n if (input === null || typeof input !== \"object\" || !Array.isArray(input.revoke)) {\n throw new TenuoConfigurationError(\"revocation list input must be { revoke: string[], version? }\");\n }\n const ids = input.revoke.filter((id): id is string => typeof id === \"string\" && id.length > 0);\n if (ids.length === 0 || ids.length !== input.revoke.length) {\n throw new TenuoConfigurationError(\"revoke must be a non-empty array of warrant ids\");\n }\n if (input.version !== undefined && (!Number.isInteger(input.version) || input.version < 1)) {\n throw new TenuoConfigurationError(\"revocation list version must be a positive integer\");\n }\n return { ids, version: input.version };\n}\n\nfunction plainArgs(value: unknown): Record<string, unknown> {\n if (value instanceof Map) {\n return Object.fromEntries(value);\n }\n if (value !== null && typeof value === \"object\" && !Array.isArray(value)) {\n return { ...(value as Record<string, unknown>) };\n }\n return {};\n}\n\nfunction requireApprovalJson(require: RequireApproval): WasmRequireApproval {\n if (require === null || typeof require !== \"object\") {\n throw new TenuoConfigurationError(\"requireApproval must be an object\");\n }\n if (!Array.isArray(require.approvers) || require.approvers.length === 0) {\n throw new TenuoConfigurationError(\"requireApproval.approvers must not be empty\");\n }\n if (!Number.isInteger(require.min) || require.min < 1) {\n throw new TenuoConfigurationError(\"requireApproval.min must be at least 1\");\n }\n const payload: WasmRequireApproval = {\n approvers: require.approvers.map((approver, i) => requirePublicKey(approver, `requireApproval.approvers[${i}]`).hex),\n min: require.min,\n };\n if (require.tools !== undefined) {\n payload.tools = [...require.tools];\n }\n if (require.gates !== undefined) {\n const gates: NonNullable<WasmRequireApproval[\"gates\"]> = {};\n for (const [tool, gate] of Object.entries(require.gates)) {\n const out: { message?: string; args?: Record<string, unknown> } = {};\n if (gate.message !== undefined) {\n out.message = gate.message;\n }\n if (gate.args !== undefined) {\n out.args = { ...gate.args };\n }\n gates[tool] = out;\n }\n payload.gates = gates;\n }\n return payload;\n}\n\nfunction narrowOptionsJson(options: NarrowOptions): WasmNarrowOptions {\n if (options === null || typeof options !== \"object\") {\n throw new TenuoConfigurationError(\"narrow() options must be an object\");\n }\n const known = [\"holder\", \"ttlSeconds\", \"terminal\", \"maxDepth\", \"clearance\", \"agentId\", \"addApprovers\", \"minApprovals\"];\n for (const key of Object.keys(options)) {\n if (!known.includes(key)) {\n throw new TenuoConfigurationError(\n `narrow() options: unknown key '${key}' (expected ${known.join(\", \")})`,\n );\n }\n }\n const out: WasmNarrowOptions = {};\n if (options.holder !== undefined) {\n out.holder = requirePublicKey(options.holder, \"narrow().holder\").hex;\n }\n if (options.ttlSeconds !== undefined) {\n out.ttlSeconds = requireTtl(options.ttlSeconds, \"narrow().ttlSeconds\", 1);\n }\n if (options.terminal !== undefined) {\n if (typeof options.terminal !== \"boolean\") {\n throw new TenuoConfigurationError(\"narrow().terminal must be a boolean\");\n }\n out.terminal = options.terminal;\n }\n if (options.maxDepth !== undefined) {\n out.maxDepth = requireDepth(options.maxDepth, \"narrow().maxDepth\");\n }\n if (out.terminal === true && out.maxDepth !== undefined) {\n throw new TenuoConfigurationError(\"narrow() options: pass terminal or maxDepth, not both\");\n }\n if (options.clearance !== undefined) {\n out.clearance = clearanceJson(options.clearance, \"narrow().clearance\");\n }\n if (options.agentId !== undefined) {\n out.agentId = requireLabel(options.agentId, \"narrow().agentId\");\n }\n if (options.addApprovers !== undefined) {\n out.addApprovers = options.addApprovers.map((a, i) => requirePublicKey(a, `narrow().addApprovers[${i}]`).hex);\n }\n if (options.minApprovals !== undefined) {\n if (!Number.isInteger(options.minApprovals) || options.minApprovals < 1) {\n throw new TenuoConfigurationError(\"narrow().minApprovals must be at least 1\");\n }\n out.minApprovals = options.minApprovals;\n }\n return out;\n}\n\nfunction approvalRequestFromWasm(raw: WasmApprovalRequest): ApprovalRequest {\n return {\n requestId: raw.request_id,\n warrantId: raw.warrant_id,\n tool: raw.tool,\n args: { ...raw.args },\n requestHash: raw.request_hash,\n holderPublicKey: raw.holder_public_key,\n requiredApprovers: [...raw.required_approvers],\n minApprovals: raw.min_approvals,\n warrantExpiresAt: raw.warrant_expires_at,\n createdAt: raw.created_at,\n message: raw.message,\n };\n}\n\nfunction explainDeny(message: string, field?: string): string {\n if (!message.includes(\"unknown field not allowed\")) {\n return message;\n }\n const named = field !== undefined && field.length > 0 ? `'${field}'` : \"this argument\";\n return `${message}. Zero-trust: name ${named} in allow (for example ${named}: pattern(\"*\")), or remove it from the call; constrained policies reject omitted fields.`;\n}\n\nfunction forwardExecuteOptions(callOptions: unknown): unknown {\n if (callOptions === null || typeof callOptions !== \"object\") {\n return callOptions;\n }\n const rest: Record<string, unknown> = {};\n for (const [key, value] of Object.entries(callOptions as Record<string, unknown>)) {\n if (\n key === \"session\" ||\n key === \"approvals\" ||\n key === \"onReceipt\" ||\n key === \"requestId\"\n ) {\n continue;\n }\n rest[key] = value;\n }\n return Object.keys(rest).length === 0 ? undefined : rest;\n}\n\nfunction importWireError(error: unknown): TenuoError {\n const message = errorMessage(error);\n if (message.startsWith(\"TENUO_CHAIN_INVALID\") || message.includes(\"invalid warrant\")) {\n return new TenuoError(\"TENUO_CHAIN_INVALID\", message);\n }\n if (message.startsWith(\"TENUO_SIGNATURE_INVALID\")) {\n return new TenuoError(\"TENUO_SIGNATURE_INVALID\", message);\n }\n if (message.startsWith(\"TENUO_UNTRUSTED_ROOT\")) {\n return new TenuoError(\"TENUO_UNTRUSTED_ROOT\", message);\n }\n if (message.startsWith(\"TENUO_INVALID_POP\")) {\n // The warrant is fine; the key is not the one it was issued to.\n const separator = /[.!?]$/.test(message.trim()) ? \"\" : \".\";\n return new AuthorizationDeniedError(\n \"TENUO_INVALID_POP\",\n `${message}${separator} If this followed narrow(), set { holder: receiverPublicKey } for the agent that imports the child.`,\n );\n }\n return new TenuoConfigurationError(message);\n}\n\nfunction normalizeWireBytes(value: string | Uint8Array): string {\n if (typeof value === \"string\") {\n return value;\n }\n return bytesToHex(value);\n}\n\nfunction emitReceipt(\n callOptions: unknown,\n receipt: string | undefined,\n session: Session,\n host: object,\n): void {\n collectReceipt(receipt, session, host);\n if (receipt === undefined || callOptions === null || typeof callOptions !== \"object\") {\n return;\n }\n if (!(\"onReceipt\" in callOptions)) {\n return;\n }\n const onReceipt = (callOptions as { onReceipt?: unknown }).onReceipt;\n if (typeof onReceipt !== \"function\") {\n return;\n }\n emitIsolatedReceipt(onReceipt as (receipt: string) => void | Promise<void>, receipt);\n}\n\nfunction requestIdFrom(callOptions: unknown): string | undefined {\n if (callOptions !== null && typeof callOptions === \"object\" && \"requestId\" in callOptions) {\n const value = (callOptions as { requestId?: unknown }).requestId;\n if (typeof value === \"string\" && value.length > 0) {\n return value;\n }\n }\n return undefined;\n}\n\nfunction approvalsFrom(callOptions: unknown): unknown {\n if (callOptions !== null && typeof callOptions === \"object\" && \"approvals\" in callOptions) {\n return (callOptions as { approvals?: unknown }).approvals;\n }\n return undefined;\n}\n\nfunction resolveSession(callOptions: unknown): Session {\n if (callOptions !== null && typeof callOptions === \"object\" && \"session\" in callOptions) {\n const explicit = (callOptions as { session: unknown }).session;\n if (!isSession(explicit)) {\n throw new TenuoConfigurationError(\"options.session must be a Tenuo Session\");\n }\n return explicit;\n }\n const ambient = currentSession.getStore();\n if (ambient === undefined) {\n throw new TenuoConfigurationError(\n \"No session. Wrap the call in tenuo.withSession(session, ...) or pass { session }.\",\n );\n }\n return ambient;\n}\n\nfunction collectSessionAllow(input: SessionInput): { [capability: string]: AllowPolicy } {\n const allow: { [capability: string]: AllowPolicy } = { ...(input.allow ?? {}) };\n for (const tool of input.tools ?? []) {\n if (tool === null || typeof tool !== \"object\") {\n throw new TenuoConfigurationError(\"session({ tools }) requires tools from tenuo.tool()\");\n }\n const policy = toolPolicies.get(tool);\n if (policy === undefined) {\n throw new TenuoConfigurationError(\"session({ tools }) requires tools from tenuo.tool()\");\n }\n const existing = allow[policy.capability];\n if (existing !== undefined && !sameAllow(existing, policy.allow)) {\n throw new TenuoConfigurationError(\n `session() allow and tools disagree on ${policy.capability}`,\n );\n }\n allow[policy.capability] = policy.allow;\n }\n return allow;\n}\n\nfunction sameAllow(left: AllowPolicy, right: AllowPolicy): boolean {\n return JSON.stringify(sortedAllow(left)) === JSON.stringify(sortedAllow(right));\n}\n\nfunction sortedAllow(allow: AllowPolicy): AllowPolicy {\n const keys = Object.keys(allow).sort();\n const out: { [field: string]: AllowPolicy[string] } = {};\n for (const key of keys) {\n const value = allow[key];\n if (value !== undefined) {\n out[key] = value;\n }\n }\n return out;\n}\n\n// ---------------------------------------------------------------------------\n// Static helpers: approvals, revocation, receipts, control-plane wire shapes\n// ---------------------------------------------------------------------------\n\nfunction requestHashOf(request: ApprovalRequest | string): string {\n const hash = typeof request === \"string\" ? request : request.requestHash;\n const hex = hash.trim().toLowerCase();\n if (!/^[0-9a-f]{64}$/.test(hex)) {\n throw new TenuoConfigurationError(\"signApproval() needs an ApprovalRequest or a 64-hex request hash\");\n }\n return hex;\n}\n\n/** Sign an approval as an approver. The approver never needs the warrant or the holder key. */\nexport function signApproval(\n request: ApprovalRequest | string,\n approverSecret: Uint8Array,\n options: SignApprovalOptions,\n): string {\n if (!(approverSecret instanceof Uint8Array) || approverSecret.length !== 32) {\n throw new TenuoConfigurationError(\"signApproval() requires a 32-byte approver secret\");\n }\n if (options === null || typeof options !== \"object\" || typeof options.externalId !== \"string\" || options.externalId.trim().length === 0) {\n throw new TenuoConfigurationError(\"signApproval() requires options.externalId: who approved\");\n }\n if (options.ttlSeconds !== undefined && (!Number.isInteger(options.ttlSeconds) || options.ttlSeconds < 1)) {\n throw new TenuoConfigurationError(\"signApproval().ttlSeconds must be a positive integer\");\n }\n const warrantExpiresAt =\n options.warrantExpiresAt ?? (typeof request === \"object\" ? request.warrantExpiresAt : undefined);\n try {\n return loadWasm().sdkSignApprovalForRequest(\n requestHashOf(request),\n approverSecret,\n options.externalId,\n options.ttlSeconds,\n warrantExpiresAt,\n );\n } catch (error) {\n throw new TenuoConfigurationError(errorMessage(error));\n }\n}\n\n/** Decode an approval envelope. Not authorization: the call path still decides. */\nexport function inspectApproval(envelope: string | Uint8Array): ApprovalInfo {\n const text = typeof envelope === \"string\" ? envelope : Buffer.from(envelope).toString(\"base64\");\n let raw;\n try {\n raw = loadWasm().sdkInspectApproval(text);\n } catch (error) {\n throw new TenuoConfigurationError(errorMessage(error));\n }\n const out: { -readonly [K in keyof ApprovalInfo]: ApprovalInfo[K] } = {\n approverPublicKey: raw.approver_public_key,\n requestHash: raw.request_hash,\n externalId: raw.external_id,\n approvedAt: raw.approved_at,\n expiresAt: raw.expires_at,\n expired: raw.expired,\n signatureValid: raw.signature_valid,\n };\n if (raw.error !== undefined) {\n out.error = raw.error;\n }\n return out;\n}\n\n/** Sign a revocation list with an explicit issuer secret. */\nexport function signRevocationList(input: RevocationListInput, issuerSecret: Uint8Array): string {\n if (!(issuerSecret instanceof Uint8Array) || issuerSecret.length !== 32) {\n throw new TenuoConfigurationError(\"signRevocationList() requires a 32-byte issuer secret\");\n }\n const { ids, version } = revocationInput(input);\n try {\n return loadWasm().sdkSignRevocationListVersioned(ids, version, issuerSecret);\n } catch (error) {\n throw new TenuoConfigurationError(errorMessage(error));\n }\n}\n\nexport function inspectRevocationList(wire: string | Uint8Array): RevocationListInfo {\n let raw;\n try {\n raw = loadWasm().sdkInspectRevocationList(normalizeWireBytes(wire));\n } catch (error) {\n throw new TenuoConfigurationError(errorMessage(error));\n }\n return {\n version: raw.version,\n issuedAt: raw.issued_at,\n issuerPublicKey: raw.issuer_public_key,\n revokedIds: [...raw.revoked_ids],\n signatureValid: raw.signature_valid,\n };\n}\n\n/** Signature authenticity of a receipt. Not authorization. */\nexport function verifyReceipt(wire: string | Uint8Array): ReceiptInfo {\n let raw;\n try {\n raw = loadWasm().sdkVerifyReceipt(normalizeWireBytes(wire));\n } catch (error) {\n throw new TenuoConfigurationError(errorMessage(error));\n }\n const out: { -readonly [K in keyof ReceiptInfo]: ReceiptInfo[K] } = {\n authentic: true,\n signerKey: raw.signer_key,\n outcome: raw.outcome,\n action: raw.action,\n requestId: raw.request_id,\n };\n if (raw.decision_code !== undefined) out.decisionCode = raw.decision_code;\n if (raw.srl_version !== undefined) out.srlVersion = raw.srl_version;\n if (raw.srl_hash !== undefined) out.srlHash = raw.srl_hash;\n if (raw.request_hash !== undefined) out.requestHash = raw.request_hash;\n if (raw.policy_definition_hash !== undefined) out.policyDefinitionHash = raw.policy_definition_hash;\n if (raw.prev_receipt_hash !== undefined) out.prevReceiptHash = raw.prev_receipt_hash;\n if (raw.trusted_roots_hash !== undefined) out.trustedRootsHash = raw.trusted_roots_hash;\n return out;\n}\n\n/**\n * Root-anchored receipt check: the embedded warrant chain against `roots`\n * at the receipt's own decision instant. Needs no trust in the signer.\n */\nexport function verifyReceiptChain(wire: string | Uint8Array, roots: readonly PublicKeyHandle[]): ReceiptChainInfo {\n if (!Array.isArray(roots) || roots.length === 0) {\n throw new TenuoConfigurationError(\"verifyReceiptChain() requires at least one trusted root\");\n }\n let raw;\n try {\n raw = loadWasm().sdkVerifyReceiptChain(\n normalizeWireBytes(wire),\n roots.map((r, i) => requirePublicKey(r, `roots[${i}]`).hex),\n );\n } catch (error) {\n throw new TenuoConfigurationError(errorMessage(error));\n }\n const out: { -readonly [K in keyof ReceiptChainInfo]: ReceiptChainInfo[K] } = {\n signerKey: raw.signer_key,\n outcome: raw.outcome,\n timestamp: raw.timestamp,\n chainValid: raw.chain_valid,\n };\n if (raw.decision_code !== undefined) out.decisionCode = raw.decision_code;\n if (raw.chain_error !== undefined) out.chainError = raw.chain_error;\n if (raw.corroborates_denial !== undefined) out.corroboratesDenial = raw.corroborates_denial;\n if (raw.root_issuer !== undefined) out.rootIssuer = raw.root_issuer;\n if (raw.leaf_holder !== undefined) out.leafHolder = raw.leaf_holder;\n return out;\n}\n\n/**\n * The v1 JSON body a control plane's approval API accepts. Same shape the\n * Python SDK produces, so one approval service serves both.\n */\nexport function controlPlaneApprovalRequestV1(\n request: ApprovalRequest,\n options?: {\n readonly attestation?: ApprovalContextAttestation;\n readonly temporal?: Readonly<Record<string, string>>;\n },\n): ControlPlaneApprovalRequestV1 {\n if (request === null || typeof request !== \"object\" || typeof request.requestHash !== \"string\") {\n throw new TenuoConfigurationError(\"controlPlaneApprovalRequestV1() needs an ApprovalRequest from tenuo.approvalRequest()\");\n }\n const body: { -readonly [K in keyof ControlPlaneApprovalRequestV1]: ControlPlaneApprovalRequestV1[K] } = {\n schema_version: 1,\n request_id_hex: request.requestId,\n warrant_id: request.warrantId,\n tool: request.tool,\n arguments: { ...request.args },\n request_hash_hex: request.requestHash,\n holder_public_key_hex: request.holderPublicKey,\n required_approver_keys_hex: [...request.requiredApprovers],\n min_approvals: Math.max(1, request.minApprovals),\n warrant_expires_at_unix: request.warrantExpiresAt,\n created_at_unix: request.createdAt,\n };\n if (options?.attestation !== undefined) {\n const a = options.attestation;\n body.attestation = {\n version: a.version,\n canonicalization: a.canonicalization,\n warrant_id: a.warrantId,\n tool: a.tool,\n request_hash: a.requestHash,\n holder_key_hex: a.holderKeyHex,\n args_canonical_cbor_b64: a.argsCanonicalCborB64,\n signer_key_hex: a.signerKeyHex,\n signature_b64: a.signatureB64,\n // Python readers look for these two names.\n signer_key: a.signerKeyHex,\n signature: a.signatureB64,\n };\n }\n if (options?.temporal !== undefined && Object.keys(options.temporal).length > 0) {\n body.temporal = { ...options.temporal };\n }\n if (request.message.length > 0) {\n body.message = request.message;\n }\n return body;\n}\n\n/** Approval envelopes from a v1 response, ready for `{ approvals }` on the call. Empty unless status is a success. */\nexport function signedApprovalsFromResponseV1(response: ControlPlaneApprovalResponseV1): string[] {\n if (response === null || typeof response !== \"object\" || typeof response.status !== \"string\") {\n throw new TenuoConfigurationError(\"approval response must be an object with a status\");\n }\n if (response.status !== \"approved\") {\n return [];\n }\n const list = response.signed_approvals_b64;\n if (list === undefined || list === null) {\n return [];\n }\n if (!Array.isArray(list) || list.some((item) => typeof item !== \"string\" || item.length === 0)) {\n throw new TenuoConfigurationError(\"signed_approvals_b64 must be an array of base64 strings\");\n }\n return [...list];\n}\n\nfunction createTenuoImpl(options: CreateTenuoOptions = {}): Tenuo {\n if (!hasTrustAnchor(options)) {\n throw new TenuoConfigurationError(\n \"createTenuo() requires trustedRoots or root: createTenuo.devRoot(). An empty trust set is not a configuration.\",\n );\n }\n if (options.root?.kind === \"dev-root\" && !devRootAllowed(options.root)) {\n throw new TenuoConfigurationError(devRootBlockedMessage());\n }\n loadWasm();\n return new TenuoClient(options);\n}\n\nexport const createTenuo: ((options?: CreateTenuoOptions) => Tenuo) & {\n devRoot: typeof devRoot;\n publicKeyFromEnv: typeof publicKeyFromEnv;\n publicKeyFromHex: typeof publicKeyFromHex;\n publicKeyFromBytes: typeof publicKeyFromBytes;\n holderKeyFromEnv: typeof holderKeyFromEnv;\n holderKeyFromHex: typeof holderKeyFromHex;\n generateHolderKey: typeof generateHolderKey;\n generateIssuerKey: typeof generateIssuerKey;\n publicKeyFromHolderKey: typeof publicKeyFromHolderKey;\n issuerKeyFromEnv: typeof issuerKeyFromEnv;\n issuerKeyFromHex: typeof issuerKeyFromHex;\n issuerKeyFromBytes: typeof issuerKeyFromBytes;\n signApproval: typeof signApproval;\n inspectApproval: typeof inspectApproval;\n signRevocationList: typeof signRevocationList;\n inspectRevocationList: typeof inspectRevocationList;\n verifyReceipt: typeof verifyReceipt;\n verifyReceiptChain: typeof verifyReceiptChain;\n controlPlaneApprovalRequestV1: typeof controlPlaneApprovalRequestV1;\n signedApprovalsFromResponseV1: typeof signedApprovalsFromResponseV1;\n parseConnectToken: typeof parseConnectToken;\n identity: typeof identityFromKey;\n generateIdentity: typeof generateIdentity;\n runtime: (options: Parameters<typeof createRuntime>[1]) => ReturnType<typeof createRuntime>;\n} = Object.assign(createTenuoImpl, {\n devRoot,\n publicKeyFromEnv,\n publicKeyFromHex,\n publicKeyFromBytes,\n holderKeyFromEnv,\n holderKeyFromHex,\n generateHolderKey,\n generateIssuerKey,\n publicKeyFromHolderKey,\n issuerKeyFromEnv,\n issuerKeyFromHex,\n issuerKeyFromBytes,\n signApproval,\n inspectApproval,\n signRevocationList,\n inspectRevocationList,\n verifyReceipt,\n verifyReceiptChain,\n controlPlaneApprovalRequestV1,\n signedApprovalsFromResponseV1,\n parseConnectToken,\n identity: identityFromKey,\n generateIdentity,\n runtime: (options: Parameters<typeof createRuntime>[1]) => createRuntime(createTenuoImpl, options),\n});\n"]}
1
+ {"version":3,"file":"client.js","sourceRoot":"","sources":["../src/client.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,iBAAiB,EAAE,MAAM,kBAAkB,CAAC;AACrD,OAAO,EAAE,WAAW,EAAE,MAAM,aAAa,CAAC;AAkC1C,OAAO,EAAE,iBAAiB,EAAE,MAAM,cAAc,CAAC;AACjD,OAAO,EAAE,gBAAgB,EAAE,eAAe,EAAE,MAAM,eAAe,CAAC;AAClE,OAAO,EAAE,SAAS,EAAE,WAAW,EAAE,eAAe,EAAe,MAAM,UAAU,CAAC;AAChF,OAAO,EAAE,cAAc,EAAE,mBAAmB,EAAE,uBAAuB,EAAE,MAAM,eAAe,CAAC;AAC7F,OAAO,EAAE,aAAa,EAAE,MAAM,cAAc,CAAC;AAC7C,OAAO,EAAE,wBAAwB,EAAE,qBAAqB,EAAE,uBAAuB,EAAE,UAAU,EAAE,MAAM,aAAa,CAAC;AACnH,OAAO,EAAE,OAAO,EAAE,SAAS,EAAE,aAAa,EAAE,MAAM,cAAc,CAAC;AACjE,OAAO,EACL,gBAAgB,EAChB,mBAAmB,EACnB,qBAAqB,EACrB,sBAAsB,EACtB,qBAAqB,EACrB,QAAQ,EACR,cAAc,EACd,yBAAyB,GAS1B,MAAM,WAAW,CAAC;AAEnB,MAAM,cAAc,GAAG,IAAI,iBAAiB,EAAW,CAAC;AACxD,MAAM,YAAY,GAAG,IAAI,OAAO,EAAsD,CAAC;AACvF,MAAM,aAAa,GAAG,IAAI,OAAO,EAAU,CAAC;AAE5C,MAAM,eAAe,GAAG,IAAI,GAAG,CAAC,CAAC,WAAW,EAAE,UAAU,EAAE,SAAS,EAAE,UAAU,EAAE,YAAY,EAAE,QAAQ,CAAC,CAAC,CAAC;AAE1G,SAAS,OAAO;IACd,IAAI,OAAO,OAAO,KAAK,WAAW,EAAE,CAAC;QACnC,OAAO,SAAS,CAAC;IACnB,CAAC;IACD,OAAO,OAAO,CAAC,GAAG,CAAC,QAAQ,CAAC;AAC9B,CAAC;AAED,SAAS,QAAQ;IACf,IAAI,OAAO,OAAO,KAAK,WAAW,EAAE,CAAC;QACnC,OAAO,KAAK,CAAC;IACf,CAAC;IACD,OAAO,OAAO,CAAC,GAAG,CAAC,eAAe,KAAK,GAAG,CAAC;AAC7C,CAAC;AAED,MAAM,UAAU,OAAO,CAAC,OAAkD;IACxE,MAAM,IAAI,GAAY;QACpB,IAAI,EAAE,UAAU;QAChB,GAAG,CAAC,OAAO,EAAE,iBAAiB,KAAK,IAAI,CAAC,CAAC,CAAC,EAAE,iBAAiB,EAAE,IAAI,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;KAC5E,CAAC;IACF,IAAI,CAAC,cAAc,CAAC,IAAI,CAAC,EAAE,CAAC;QAC1B,MAAM,IAAI,uBAAuB,CAAC,qBAAqB,EAAE,CAAC,CAAC;IAC7D,CAAC;IACD,OAAO,IAAI,CAAC;AACd,CAAC;AAED,SAAS,cAAc,CAAC,IAAa;IACnC,IAAI,IAAI,CAAC,iBAAiB,KAAK,IAAI,IAAI,QAAQ,EAAE,EAAE,CAAC;QAClD,OAAO,IAAI,CAAC;IACd,CAAC;IACD,MAAM,GAAG,GAAG,OAAO,EAAE,CAAC;IACtB,OAAO,GAAG,KAAK,aAAa,IAAI,GAAG,KAAK,MAAM,CAAC;AACjD,CAAC;AAED,SAAS,qBAAqB;IAC5B,OAAO,4LAA4L,CAAC;AACtM,CAAC;AAED,SAAS,YAAY,CAAC,KAAa;IACjC,MAAM,GAAG,GAAG,KAAK,CAAC,IAAI,EAAE,CAAC,WAAW,EAAE,CAAC,OAAO,CAAC,KAAK,EAAE,EAAE,CAAC,CAAC;IAC1D,IAAI,CAAC,gBAAgB,CAAC,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC;QAChC,MAAM,IAAI,uBAAuB,CAC/B,mEAAmE,CACpE,CAAC;IACJ,CAAC;IACD,OAAO,GAAG,CAAC;AACb,CAAC;AAED,SAAS,QAAQ,CAAC,IAAY,EAAE,IAAY;IAC1C,IAAI,IAAI,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QACtB,MAAM,IAAI,uBAAuB,CAAC,GAAG,IAAI,wCAAwC,CAAC,CAAC;IACrF,CAAC;IACD,IAAI,OAAO,OAAO,KAAK,WAAW,EAAE,CAAC;QACnC,MAAM,IAAI,uBAAuB,CAC/B,wBAAwB,IAAI,mDAAmD,IAAI,GAAG,CACvF,CAAC;IACJ,CAAC;IACD,MAAM,KAAK,GAAG,OAAO,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC;IAChC,IAAI,KAAK,KAAK,SAAS,IAAI,KAAK,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QAC9C,MAAM,IAAI,uBAAuB,CAC/B,wBAAwB,IAAI,sDAAsD,IAAI,GAAG,CAC1F,CAAC;IACJ,CAAC;IACD,OAAO,KAAK,CAAC;AACf,CAAC;AAED,MAAM,UAAU,gBAAgB,CAAC,IAAY;IAC3C,OAAO,EAAE,IAAI,EAAE,YAAY,EAAE,MAAM,EAAE,KAAK,EAAE,GAAG,EAAE,YAAY,CAAC,QAAQ,CAAC,IAAI,EAAE,cAAc,CAAC,CAAC,EAAE,CAAC;AAClG,CAAC;AAED,MAAM,UAAU,gBAAgB,CAAC,GAAW;IAC1C,OAAO,EAAE,IAAI,EAAE,YAAY,EAAE,MAAM,EAAE,KAAK,EAAE,GAAG,EAAE,YAAY,CAAC,GAAG,CAAC,EAAE,CAAC;AACvE,CAAC;AAED,MAAM,UAAU,kBAAkB,CAAC,KAAiB;IAClD,IAAI,KAAK,CAAC,MAAM,KAAK,EAAE,EAAE,CAAC;QACxB,MAAM,IAAI,uBAAuB,CAAC,oDAAoD,CAAC,CAAC;IAC1F,CAAC;IACD,OAAO,EAAE,IAAI,EAAE,YAAY,EAAE,MAAM,EAAE,OAAO,EAAE,GAAG,EAAE,UAAU,CAAC,KAAK,CAAC,EAAE,CAAC;AACzE,CAAC;AAED,SAAS,kBAAkB,CAAC,KAAa,EAAE,IAAY;IACrD,MAAM,GAAG,GAAG,KAAK,CAAC,IAAI,EAAE,CAAC,WAAW,EAAE,CAAC,OAAO,CAAC,KAAK,EAAE,EAAE,CAAC,CAAC;IAC1D,IAAI,CAAC,gBAAgB,CAAC,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC;QAChC,MAAM,IAAI,uBAAuB,CAAC,GAAG,IAAI,mDAAmD,CAAC,CAAC;IAChG,CAAC;IACD,OAAO,GAAG,CAAC;AACb,CAAC;AAED,SAAS,UAAU,CAAC,GAAW;IAC7B,MAAM,KAAK,GAAG,IAAI,UAAU,CAAC,GAAG,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC;IAC7C,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,KAAK,CAAC,MAAM,EAAE,CAAC,IAAI,CAAC,EAAE,CAAC;QACzC,KAAK,CAAC,CAAC,CAAC,GAAG,MAAM,CAAC,QAAQ,CAAC,GAAG,CAAC,KAAK,CAAC,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC;IAC9D,CAAC;IACD,OAAO,KAAK,CAAC;AACf,CAAC;AAED,SAAS,UAAU,CAAC,KAAiB;IACnC,OAAO,KAAK,CAAC,IAAI,CAAC,KAAK,EAAE,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,QAAQ,CAAC,EAAE,CAAC,CAAC,QAAQ,CAAC,CAAC,EAAE,GAAG,CAAC,CAAC,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;AAC5E,CAAC;AAED,MAAM,UAAU,gBAAgB,CAAC,IAAY;IAC3C,OAAO,UAAU,CAAC,kBAAkB,CAAC,QAAQ,CAAC,IAAI,EAAE,YAAY,CAAC,EAAE,YAAY,CAAC,CAAC,CAAC;AACpF,CAAC;AAED,MAAM,UAAU,gBAAgB,CAAC,GAAW;IAC1C,OAAO,UAAU,CAAC,kBAAkB,CAAC,GAAG,EAAE,YAAY,CAAC,CAAC,CAAC;AAC3D,CAAC;AAED;;;GAGG;AACH,MAAM,UAAU,iBAAiB;IAC/B,OAAO,IAAI,UAAU,CAAC,WAAW,CAAC,EAAE,CAAC,CAAC,CAAC;AACzC,CAAC;AAED,0FAA0F;AAC1F,MAAM,UAAU,iBAAiB;IAC/B,OAAO,iBAAiB,EAAE,CAAC;AAC7B,CAAC;AAED,oDAAoD;AACpD,MAAM,UAAU,sBAAsB,CAAC,SAAqB;IAC1D,IAAI,CAAC,CAAC,SAAS,YAAY,UAAU,CAAC,IAAI,SAAS,CAAC,MAAM,KAAK,EAAE,EAAE,CAAC;QAClE,MAAM,IAAI,uBAAuB,CAAC,wDAAwD,CAAC,CAAC;IAC9F,CAAC;IACD,QAAQ,EAAE,CAAC;IACX,OAAO,EAAE,IAAI,EAAE,YAAY,EAAE,MAAM,EAAE,OAAO,EAAE,GAAG,EAAE,yBAAyB,CAAC,SAAS,CAAC,EAAE,CAAC;AAC5F,CAAC;AAED,MAAM,YAAY,GAAG,WAAW,CAAC;AAEjC,SAAS,aAAa,CAAC,KAAa,EAAE,IAAY,EAAE,OAAO,GAAG,CAAC;IAC7D,IAAI,CAAC,MAAM,CAAC,SAAS,CAAC,KAAK,CAAC,IAAI,KAAK,GAAG,OAAO,IAAI,KAAK,GAAG,YAAY,EAAE,CAAC;QACxE,MAAM,IAAI,uBAAuB,CAC/B,GAAG,IAAI,+BAA+B,OAAO,QAAQ,YAAY,EAAE,CACpE,CAAC;IACJ,CAAC;IACD,OAAO,KAAK,CAAC;AACf,CAAC;AAED,qFAAqF;AACrF,MAAM,UAAU,gBAAgB,CAAC,IAAY;IAC3C,OAAO,EAAE,IAAI,EAAE,YAAY,EAAE,MAAM,EAAE,UAAU,CAAC,kBAAkB,CAAC,QAAQ,CAAC,IAAI,EAAE,YAAY,CAAC,EAAE,YAAY,CAAC,CAAC,EAAE,CAAC;AACpH,CAAC;AAED,MAAM,UAAU,gBAAgB,CAAC,GAAW;IAC1C,OAAO,EAAE,IAAI,EAAE,YAAY,EAAE,MAAM,EAAE,UAAU,CAAC,kBAAkB,CAAC,GAAG,EAAE,YAAY,CAAC,CAAC,EAAE,CAAC;AAC3F,CAAC;AAED,MAAM,UAAU,kBAAkB,CAAC,MAAkB;IACnD,IAAI,CAAC,CAAC,MAAM,YAAY,UAAU,CAAC,IAAI,MAAM,CAAC,MAAM,KAAK,EAAE,EAAE,CAAC;QAC5D,MAAM,IAAI,uBAAuB,CAAC,gDAAgD,CAAC,CAAC;IACtF,CAAC;IACD,OAAO,EAAE,IAAI,EAAE,YAAY,EAAE,MAAM,EAAE,IAAI,UAAU,CAAC,MAAM,CAAC,EAAE,CAAC;AAChE,CAAC;AAED,SAAS,YAAY,CAAC,KAAa,EAAE,IAAY;IAC/C,aAAa,CAAC,KAAK,EAAE,IAAI,CAAC,CAAC;IAC3B,MAAM,OAAO,GAAG,cAAc,EAAE,CAAC,oBAAoB,CAAC;IACtD,IAAI,KAAK,GAAG,OAAO,EAAE,CAAC;QACpB,MAAM,IAAI,uBAAuB,CAC/B,GAAG,IAAI,IAAI,KAAK,oCAAoC,OAAO,EAAE,CAC9D,CAAC;IACJ,CAAC;IACD,OAAO,KAAK,CAAC;AACf,CAAC;AAED,SAAS,UAAU,CAAC,KAAa,EAAE,IAAY,EAAE,OAAO,GAAG,CAAC;IAC1D,aAAa,CAAC,KAAK,EAAE,IAAI,EAAE,OAAO,CAAC,CAAC;IACpC,MAAM,OAAO,GAAG,cAAc,EAAE,CAAC,uBAAuB,CAAC;IACzD,IAAI,KAAK,GAAG,OAAO,EAAE,CAAC;QACpB,MAAM,IAAI,uBAAuB,CAC/B,GAAG,IAAI,IAAI,KAAK,oCAAoC,OAAO,EAAE,CAC9D,CAAC;IACJ,CAAC;IACD,OAAO,KAAK,CAAC;AACf,CAAC;AAED,SAAS,gBAAgB,CAAC,KAAc,EAAE,IAAY;IACpD,IACE,KAAK,KAAK,IAAI;QACd,OAAO,KAAK,KAAK,QAAQ;QACxB,KAA4B,CAAC,IAAI,KAAK,YAAY;QACnD,OAAQ,KAA2B,CAAC,GAAG,KAAK,QAAQ,EACpD,CAAC;QACD,MAAM,IAAI,uBAAuB,CAC/B,GAAG,IAAI,yGAAyG,CACjH,CAAC;IACJ,CAAC;IACD,OAAO,KAAwB,CAAC;AAClC,CAAC;AAED,SAAS,aAAa,CAAC,KAAgB,EAAE,IAAY;IACnD,IAAI,OAAO,KAAK,KAAK,QAAQ,EAAE,CAAC;QAC9B,IAAI,CAAC,MAAM,CAAC,SAAS,CAAC,KAAK,CAAC,IAAI,KAAK,GAAG,CAAC,IAAI,KAAK,GAAG,GAAG,EAAE,CAAC;YACzD,MAAM,IAAI,uBAAuB,CAAC,GAAG,IAAI,2CAA2C,CAAC,CAAC;QACxF,CAAC;QACD,OAAO,KAAK,CAAC;IACf,CAAC;IACD,IAAI,OAAO,KAAK,KAAK,QAAQ,IAAI,eAAe,CAAC,GAAG,CAAC,KAAK,CAAC,EAAE,CAAC;QAC5D,OAAO,KAAK,CAAC;IACf,CAAC;IACD,MAAM,IAAI,uBAAuB,CAC/B,GAAG,IAAI,mBAAmB,CAAC,GAAG,eAAe,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,sBAAsB,CAChF,CAAC;AACJ,CAAC;AAED,SAAS,SAAS,CAAC,OAA2B;IAC5C,MAAM,OAAO,GAAsB,EAAE,CAAC;IACtC,IAAI,OAAO,CAAC,IAAI,KAAK,SAAS,IAAI,OAAO,CAAC,IAAI,CAAC,IAAI,KAAK,YAAY,EAAE,CAAC;QACrE,OAAO,CAAC,IAAI,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC;IAC7B,CAAC;IACD,KAAK,MAAM,IAAI,IAAI,OAAO,CAAC,YAAY,IAAI,EAAE,EAAE,CAAC;QAC9C,OAAO,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;IACrB,CAAC;IACD,OAAO,OAAO,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC;AACnC,CAAC;AAED,SAAS,cAAc,CAAC,OAA2B;IACjD,IAAI,OAAO,CAAC,IAAI,KAAK,SAAS,EAAE,CAAC;QAC/B,OAAO,IAAI,CAAC;IACd,CAAC;IACD,OAAO,CAAC,OAAO,CAAC,YAAY,EAAE,MAAM,IAAI,CAAC,CAAC,GAAG,CAAC,CAAC;AACjD,CAAC;AAED,SAAS,cAAc,CAAC,KAAa,EAAE,MAAsC;IAC3E,IAAI,MAAM,CAAC,UAAU,KAAK,SAAS,IAAI,MAAM,CAAC,UAAU,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;QACpE,OAAO,MAAM,CAAC,UAAU,CAAC;IAC3B,CAAC;IACD,MAAM,KAAK,GAAG,KAAyC,CAAC;IACxD,IAAI,OAAO,KAAK,CAAC,IAAI,KAAK,QAAQ,IAAI,KAAK,CAAC,IAAI,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;QAC5D,OAAO,KAAK,CAAC,IAAI,CAAC;IACpB,CAAC;IACD,IAAI,OAAO,KAAK,CAAC,EAAE,KAAK,QAAQ,IAAI,KAAK,CAAC,EAAE,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;QACxD,OAAO,KAAK,CAAC,EAAE,CAAC;IAClB,CAAC;IACD,MAAM,IAAI,uBAAuB,CAC/B,kFAAkF,CACnF,CAAC;AACJ,CAAC;AAED,MAAM,WAAW;IACE,OAAO,CAAc;IACrB,OAAO,CAAU;IACzB,GAAG,CAAW;IACN,MAAM,CAAS;IAEhC,YAAY,OAA2B;QACrC,IAAI,OAAO,CAAC,IAAI,EAAE,IAAI,KAAK,UAAU,EAAE,CAAC;YACtC,IAAI,CAAC,OAAO,GAAG,gBAAgB,CAAC,OAAO,CAAC,aAAa,CAAC,CAAC;YACvD,IAAI,CAAC,OAAO,GAAG,IAAI,CAAC;QACtB,CAAC;aAAM,IAAI,OAAO,CAAC,IAAI,EAAE,IAAI,KAAK,YAAY,EAAE,CAAC;YAC/C,IAAI,CAAC,CAAC,OAAO,CAAC,IAAI,CAAC,MAAM,YAAY,UAAU,CAAC,IAAI,OAAO,CAAC,IAAI,CAAC,MAAM,CAAC,MAAM,KAAK,EAAE,EAAE,CAAC;gBACtF,MAAM,IAAI,uBAAuB,CAAC,2CAA2C,CAAC,CAAC;YACjF,CAAC;YACD,IAAI,CAAC,OAAO,GAAG,mBAAmB,CAChC,OAAO,CAAC,IAAI,CAAC,MAAM,EACnB,SAAS,CAAC,OAAO,CAAC,EAClB,OAAO,CAAC,aAAa,CACtB,CAAC;YACF,IAAI,CAAC,OAAO,GAAG,IAAI,CAAC;QACtB,CAAC;aAAM,CAAC;YACN,IAAI,CAAC,OAAO,GAAG,qBAAqB,CAClC,SAAS,CAAC,OAAO,CAAC,EAClB,SAAS,EACT,OAAO,CAAC,aAAa,CACtB,CAAC;YACF,IAAI,CAAC,OAAO,GAAG,KAAK,CAAC;QACvB,CAAC;QACD,IAAI,OAAO,CAAC,cAAc,KAAK,SAAS,EAAE,CAAC;YACzC,IAAI,CAAC,OAAO,CAAC,kBAAkB,CAAC,kBAAkB,CAAC,OAAO,CAAC,cAAc,CAAC,CAAC,CAAC;QAC9E,CAAC;QACD,IAAI,CAAC,MAAM,GAAG,CAAC,QAAQ,EAAE,IAAI,EAAE,MAAM,EAAE,IAAI,EAAE,EAAE;YAC7C,IAAI,CAAC,aAAa,CAAC,QAAQ,EAAE,IAAI,EAAE,MAAM,EAAE,IAAI,CAAC,CAAC;QACnD,CAAC,CAAC;QACF,IAAI,CAAC,GAAG,GAAG,SAAS,CAAC,IAAI,CAAC,OAAO,EAAE,IAAI,CAAC,MAAM,EAAE,IAAI,CAAC,CAAC;IACxD,CAAC;IAEO,aAAa,CACnB,QAAmI,EACnI,IAAY,EACZ,MAAe,EACf,IAA8B;QAE9B,IAAI,QAAQ,CAAC,OAAO,KAAK,OAAO,EAAE,CAAC;YACjC,OAAO;QACT,CAAC;QACD,IAAI,QAAQ,CAAC,OAAO,KAAK,mBAAmB,EAAE,CAAC;YAC7C,IAAI,OAAoC,CAAC;YACzC,IAAI,MAAM,KAAK,SAAS,IAAI,IAAI,KAAK,SAAS,EAAE,CAAC;gBAC/C,IAAI,CAAC;oBACH,OAAO,GAAG,uBAAuB,CAAC,IAAI,CAAC,OAAO,CAAC,eAAe,CAAC,MAAM,EAAE,IAAI,EAAE,IAAI,CAAC,CAAC,CAAC;gBACtF,CAAC;gBAAC,MAAM,CAAC;oBACP,OAAO,GAAG,SAAS,CAAC;gBACtB,CAAC;YACH,CAAC;YACD,MAAM,IAAI,qBAAqB,CAC7B,QAAQ,CAAC,IAAI,IAAI,IAAI,EACrB,QAAQ,CAAC,QAAQ,IAAI,CAAC,EACtB,QAAQ,CAAC,QAAQ,IAAI,CAAC,EACtB,QAAQ,CAAC,OAAO,EAChB,OAAO,CACR,CAAC;QACJ,CAAC;QACD,MAAM,IAAI,wBAAwB,CAC/B,QAAQ,CAAC,IAAmC,IAAI,2BAA2B,EAC5E,WAAW,CAAC,QAAQ,CAAC,OAAO,IAAI,sBAAsB,EAAE,QAAQ,CAAC,KAAK,CAAC,EACvE,QAAQ,CAAC,KAAK,CACf,CAAC;IACJ,CAAC;IAED,IAAI,CACF,KAAQ,EACR,MAA+C;QAE/C,IAAI,YAAY,CAAC,GAAG,CAAC,KAAK,CAAC,IAAI,aAAa,CAAC,GAAG,CAAC,KAAK,CAAC,EAAE,CAAC;YACxD,MAAM,IAAI,uBAAuB,CAAC,wCAAwC,CAAC,CAAC;QAC9E,CAAC;QACD,MAAM,UAAU,GAAG,cAAc,CAAC,KAAK,EAAE,MAAM,CAAC,CAAC;QACjD,MAAM,QAAQ,GAAG,KAAK,CAAC,OAGX,CAAC;QACb,MAAM,OAAO,GAAG,KAAK,EAAE,IAAW,EAAE,WAAqB,EAAE,EAAE;YAC3D,MAAM,OAAO,GAAG,cAAc,CAAC,WAAW,CAAC,CAAC;YAC5C,MAAM,MAAM,GAAG,aAAa,CAAC,OAAO,CAAC,CAAC;YACtC,MAAM,QAAQ,GAAG,IAAI,CAAC,OAAO,CAAC,SAAS,CACrC,MAAM,EACN,UAAU,EACV,IAAI,EACJ,aAAa,CAAC,WAAW,CAAC,EAC1B,MAAM,CAAC,KAAK,EACZ,aAAa,CAAC,WAAW,CAAC,CAC3B,CAAC;YACF,WAAW,CAAC,WAAW,EAAE,QAAQ,CAAC,OAAO,EAAE,OAAO,EAAE,IAAI,CAAC,CAAC;YAC1D,IAAI,QAAQ,CAAC,OAAO,KAAK,OAAO,EAAE,CAAC;gBACjC,OAAO,QAAQ,CAAC,SAAS,CAAC,QAAQ,CAAC,IAAI,CAAC,EAAE,qBAAqB,CAAC,WAAW,CAAC,CAAC,CAAC;YAChF,CAAC;YACD,IAAI,CAAC,aAAa,CAAC,QAAQ,EAAE,UAAU,EAAE,MAAM,EAAE,SAAS,CAAC,IAAI,CAAC,CAAC,CAAC;YAClE,MAAM,IAAI,uBAAuB,CAAC,kDAAkD,CAAC,CAAC;QACxF,CAAC,CAAC;QAEF,MAAM,OAAO,GAAG,MAAM,CAAC,MAAM,CAAC,MAAM,CAAC,MAAM,CAAC,MAAM,CAAC,cAAc,CAAC,KAAK,CAAC,CAAC,EAAE,KAAK,EAAE;YAChF,OAAO;SACR,CAAqB,CAAC;QACvB,aAAa,CAAC,GAAG,CAAC,KAAK,CAAC,CAAC;QACzB,YAAY,CAAC,GAAG,CAAC,OAAO,EAAE,EAAE,UAAU,EAAE,KAAK,EAAE,EAAE,GAAG,MAAM,CAAC,KAAK,EAAiB,EAAE,CAAC,CAAC;QACrF,OAAO,OAAO,CAAC;IACjB,CAAC;IAED,OAAO,CAAC,KAAmB;QACzB,MAAM,KAAK,GAAG,mBAAmB,CAAC,KAAK,CAAC,CAAC;QACzC,MAAM,IAAI,GAAG,KAAK,CAAC,IAAI,IAAI,WAAW,CAAC;QACvC,IAAI,IAAI,KAAK,WAAW,IAAI,IAAI,KAAK,QAAQ,EAAE,CAAC;YAC9C,MAAM,IAAI,uBAAuB,CAAC,gDAAgD,CAAC,CAAC;QACtF,CAAC;QACD,IAAI,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,MAAM,KAAK,CAAC,IAAI,IAAI,KAAK,WAAW,EAAE,CAAC;YAC5D,MAAM,IAAI,uBAAuB,CAC/B,sFAAsF,CACvF,CAAC;QACJ,CAAC;QACD,IAAI,CAAC,IAAI,CAAC,OAAO,EAAE,CAAC;YAClB,MAAM,IAAI,uBAAuB,CAC/B,wHAAwH,CACzH,CAAC;QACJ,CAAC;QACD,MAAM,OAAO,GAAoB,EAAE,IAAI,EAAE,KAAK,EAAE,CAAC;QACjD,IAAI,KAAK,CAAC,UAAU,KAAK,SAAS,EAAE,CAAC;YACnC,OAAO,CAAC,UAAU,GAAG,UAAU,CAAC,KAAK,CAAC,UAAU,EAAE,sBAAsB,CAAC,CAAC;QAC5E,CAAC;QACD,IAAI,KAAK,CAAC,MAAM,KAAK,SAAS,EAAE,CAAC;YAC/B,OAAO,CAAC,MAAM,GAAG,gBAAgB,CAAC,KAAK,CAAC,MAAM,EAAE,kBAAkB,CAAC,CAAC,GAAG,CAAC;QAC1E,CAAC;QACD,IAAI,KAAK,CAAC,QAAQ,KAAK,SAAS,EAAE,CAAC;YACjC,OAAO,CAAC,QAAQ,GAAG,YAAY,CAAC,KAAK,CAAC,QAAQ,EAAE,oBAAoB,CAAC,CAAC;QACxE,CAAC;QACD,IAAI,KAAK,CAAC,SAAS,KAAK,SAAS,EAAE,CAAC;YAClC,OAAO,CAAC,SAAS,GAAG,aAAa,CAAC,KAAK,CAAC,SAAS,EAAE,qBAAqB,CAAC,CAAC;QAC5E,CAAC;QACD,IAAI,KAAK,CAAC,SAAS,KAAK,SAAS,EAAE,CAAC;YAClC,OAAO,CAAC,SAAS,GAAG,YAAY,CAAC,KAAK,CAAC,SAAS,EAAE,qBAAqB,CAAC,CAAC;QAC3E,CAAC;QACD,IAAI,KAAK,CAAC,OAAO,KAAK,SAAS,EAAE,CAAC;YAChC,OAAO,CAAC,OAAO,GAAG,YAAY,CAAC,KAAK,CAAC,OAAO,EAAE,mBAAmB,CAAC,CAAC;QACrE,CAAC;QACD,IAAI,KAAK,CAAC,eAAe,KAAK,SAAS,EAAE,CAAC;YACxC,OAAO,CAAC,eAAe,GAAG,mBAAmB,CAAC,KAAK,CAAC,eAAe,CAAC,CAAC;QACvE,CAAC;QACD,IAAI,KAAK,CAAC,aAAa,KAAK,SAAS,EAAE,CAAC;YACtC,OAAO,CAAC,aAAa,GAAG,CAAC,GAAG,KAAK,CAAC,aAAa,CAAC,CAAC;QACnD,CAAC;QACD,IAAI,KAAK,CAAC,gBAAgB,KAAK,SAAS,EAAE,CAAC;YACzC,OAAO,CAAC,gBAAgB,GAAG,KAAK,CAAC,gBAAgB,CAAC;QACpD,CAAC;QACD,IAAI,KAAK,CAAC,aAAa,KAAK,SAAS,EAAE,CAAC;YACtC,OAAO,CAAC,aAAa,GAAG,YAAY,CAAC,KAAK,CAAC,aAAa,EAAE,yBAAyB,CAAC,CAAC;QACvF,CAAC;QACD,IAAI,CAAC;YACH,OAAO,IAAI,OAAO,CAAC,IAAI,CAAC,OAAO,CAAC,YAAY,CAAC,OAAO,CAAC,CAAC,CAAC;QACzD,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,MAAM,IAAI,uBAAuB,CAAC,YAAY,CAAC,KAAK,CAAC,CAAC,CAAC;QACzD,CAAC;IACH,CAAC;IAED,KAAK,CAAC,MAAe,EAAE,KAAiB;QACtC,IAAI,CAAC,SAAS,CAAC,MAAM,CAAC,EAAE,CAAC;YACvB,MAAM,IAAI,uBAAuB,CAAC,sDAAsD,CAAC,CAAC;QAC5F,CAAC;QACD,IAAI,KAAK,KAAK,IAAI,IAAI,OAAO,KAAK,KAAK,QAAQ,IAAI,KAAK,CAAC,KAAK,KAAK,SAAS,IAAI,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;YACtH,MAAM,IAAI,uBAAuB,CAAC,mDAAmD,CAAC,CAAC;QACzF,CAAC;QACD,MAAM,OAAO,GAAqB;YAChC,KAAK,EAAE,KAAK,CAAC,KAAK;YAClB,MAAM,EAAE,gBAAgB,CAAC,KAAK,CAAC,MAAM,EAAE,gBAAgB,CAAC,CAAC,GAAG;SAC7D,CAAC;QACF,IAAI,KAAK,CAAC,UAAU,KAAK,SAAS,EAAE,CAAC;YACnC,OAAO,CAAC,UAAU,GAAG,UAAU,CAAC,KAAK,CAAC,UAAU,EAAE,oBAAoB,EAAE,CAAC,CAAC,CAAC;QAC7E,CAAC;QACD,IAAI,KAAK,CAAC,QAAQ,KAAK,SAAS,EAAE,CAAC;YACjC,OAAO,CAAC,QAAQ,GAAG,YAAY,CAAC,KAAK,CAAC,QAAQ,EAAE,kBAAkB,CAAC,CAAC;QACtE,CAAC;QACD,IAAI,KAAK,CAAC,SAAS,KAAK,SAAS,EAAE,CAAC;YAClC,OAAO,CAAC,SAAS,GAAG,aAAa,CAAC,KAAK,CAAC,SAAS,EAAE,mBAAmB,CAAC,CAAC;QAC1E,CAAC;QACD,IAAI,KAAK,CAAC,SAAS,KAAK,SAAS,EAAE,CAAC;YAClC,OAAO,CAAC,SAAS,GAAG,YAAY,CAAC,KAAK,CAAC,SAAS,EAAE,mBAAmB,CAAC,CAAC;QACzE,CAAC;QACD,IAAI,KAAK,CAAC,OAAO,KAAK,SAAS,EAAE,CAAC;YAChC,OAAO,CAAC,OAAO,GAAG,YAAY,CAAC,KAAK,CAAC,OAAO,EAAE,iBAAiB,CAAC,CAAC;QACnE,CAAC;QACD,IAAI,KAAK,CAAC,eAAe,KAAK,SAAS,EAAE,CAAC;YACxC,OAAO,CAAC,eAAe,GAAG,mBAAmB,CAAC,KAAK,CAAC,eAAe,CAAC,CAAC;QACvE,CAAC;QACD,IAAI,CAAC;YACH,OAAO,IAAI,OAAO,CAAC,IAAI,CAAC,OAAO,CAAC,KAAK,CAAC,aAAa,CAAC,MAAM,CAAC,EAAE,OAAO,CAAC,CAAC,CAAC;QACzE,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,MAAM,UAAU,CAAC,KAAK,CAAC,CAAC;QAC1B,CAAC;IACH,CAAC;IAED,eAAe;QACb,IAAI,CAAC,IAAI,CAAC,OAAO,EAAE,CAAC;YAClB,MAAM,IAAI,uBAAuB,CAC/B,uGAAuG,CACxG,CAAC;QACJ,CAAC;QACD,OAAO,EAAE,IAAI,EAAE,YAAY,EAAE,MAAM,EAAE,OAAO,EAAE,GAAG,EAAE,IAAI,CAAC,OAAO,CAAC,eAAe,EAAE,EAAE,CAAC;IACtF,CAAC;IAED,eAAe,CAAC,KAA2B;QACzC,IAAI,CAAC,CAAC,KAAK,CAAC,SAAS,YAAY,UAAU,CAAC,IAAI,KAAK,CAAC,SAAS,CAAC,MAAM,KAAK,EAAE,EAAE,CAAC;YAC9E,MAAM,IAAI,uBAAuB,CAAC,gDAAgD,CAAC,CAAC;QACtF,CAAC;QACD,IAAI,OAAO,KAAK,CAAC,OAAO,KAAK,QAAQ,IAAI,KAAK,CAAC,OAAO,CAAC,IAAI,EAAE,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;YAC3E,MAAM,IAAI,uBAAuB,CAAC,sCAAsC,CAAC,CAAC;QAC5E,CAAC;QACD,IAAI,CAAC;YACH,IAAI,OAAO,KAAK,CAAC,OAAO,KAAK,QAAQ,EAAE,CAAC;gBACtC,OAAO,IAAI,OAAO,CAAC,qBAAqB,CAAC,KAAK,CAAC,OAAO,EAAE,KAAK,CAAC,SAAS,CAAC,CAAC,CAAC;YAC5E,CAAC;YACD,IAAI,KAAK,CAAC,OAAO,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;gBAC/B,MAAM,IAAI,uBAAuB,CAAC,sCAAsC,CAAC,CAAC;YAC5E,CAAC;YACD,OAAO,IAAI,OAAO,CAAC,sBAAsB,CAAC,CAAC,GAAG,KAAK,CAAC,OAAO,CAAC,EAAE,KAAK,CAAC,SAAS,CAAC,CAAC,CAAC;QAClF,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,MAAM,eAAe,CAAC,KAAK,CAAC,CAAC;QAC/B,CAAC;IACH,CAAC;IAED,WAAW,CAAI,OAAgB,EAAE,EAAW;QAC1C,IAAI,CAAC,SAAS,CAAC,OAAO,CAAC,EAAE,CAAC;YACxB,MAAM,IAAI,uBAAuB,CAAC,4DAA4D,CAAC,CAAC;QAClG,CAAC;QACD,OAAO,cAAc,CAAC,GAAG,CAAC,OAAO,EAAE,EAAE,CAAC,CAAC;IACzC,CAAC;IAED,MAAM,CAAC,OAAgB,EAAE,KAAkB,EAAE,OAAuB;QAClE,IAAI,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;YACpC,MAAM,IAAI,uBAAuB,CAAC,kDAAkD,CAAC,CAAC;QACxF,CAAC;QACD,IAAI,CAAC,SAAS,CAAC,OAAO,CAAC,EAAE,CAAC;YACxB,MAAM,IAAI,uBAAuB,CAAC,uDAAuD,CAAC,CAAC;QAC7F,CAAC;QACD,MAAM,MAAM,GAAG,OAAO,KAAK,SAAS,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,iBAAiB,CAAC,OAAO,CAAC,CAAC;QAC9E,IAAI,CAAC;YACH,MAAM,KAAK,GAAG,IAAI,OAAO,CAAC,IAAI,CAAC,OAAO,CAAC,MAAM,CAAC,aAAa,CAAC,OAAO,CAAC,EAAE,KAAK,EAAE,MAAM,CAAC,CAAC,CAAC;YACtF,uBAAuB,CAAC,OAAO,EAAE,KAAK,CAAC,CAAC;YACxC,OAAO,KAAK,CAAC;QACf,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,MAAM,UAAU,CAAC,KAAK,CAAC,CAAC;QAC1B,CAAC;IACH,CAAC;IAED,OAAO,CAAC,OAAgB,EAAE,IAAY,EAAE,IAAuC;QAC7E,IAAI,CAAC,SAAS,CAAC,OAAO,CAAC,EAAE,CAAC;YACxB,MAAM,IAAI,uBAAuB,CAAC,wDAAwD,CAAC,CAAC;QAC9F,CAAC;QACD,IAAI,GAAgB,CAAC;QACrB,IAAI,CAAC;YACH,GAAG,GAAG,IAAI,CAAC,OAAO,CAAC,OAAO,CAAC,aAAa,CAAC,OAAO,CAAC,EAAE,IAAI,EAAE,IAAI,CAAC,CAAC;QACjE,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,MAAM,IAAI,uBAAuB,CAAC,YAAY,CAAC,KAAK,CAAC,CAAC,CAAC;QACzD,CAAC;QACD,MAAM,GAAG,GAA2D;YAClE,IAAI,EAAE,GAAG,CAAC,IAAI;YACd,IAAI,EAAE,GAAG,CAAC,IAAI;YACd,OAAO,EAAE,GAAG,CAAC,OAAO;YACpB,WAAW,EAAE,GAAG,CAAC,YAAY;YAC7B,MAAM,EAAE,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE;gBAC3B,MAAM,KAAK,GAA+F;oBACxG,KAAK,EAAE,CAAC,CAAC,KAAK;oBACd,IAAI,EAAE,CAAC,CAAC,IAAI;oBACZ,UAAU,EAAE,CAAC,CAAC,UAAU;oBACxB,SAAS,EAAE,CAAC,CAAC,SAAS;iBACvB,CAAC;gBACF,IAAI,CAAC,CAAC,KAAK,KAAK,SAAS,EAAE,CAAC;oBAC1B,KAAK,CAAC,KAAK,GAAG,CAAC,CAAC,KAAK,CAAC;gBACxB,CAAC;gBACD,IAAI,CAAC,CAAC,MAAM,KAAK,SAAS,EAAE,CAAC;oBAC3B,KAAK,CAAC,MAAM,GAAG,CAAC,CAAC,MAAM,CAAC;gBAC1B,CAAC;gBACD,IAAI,CAAC,CAAC,WAAW,KAAK,SAAS,EAAE,CAAC;oBAChC,KAAK,CAAC,UAAU,GAAG,CAAC,CAAC,WAAW,CAAC;gBACnC,CAAC;gBACD,OAAO,KAAK,CAAC;YACf,CAAC,CAAC;YACF,aAAa,EAAE,CAAC,GAAG,GAAG,CAAC,cAAc,CAAC;YACtC,aAAa,EAAE,CAAC,GAAG,GAAG,CAAC,cAAc,CAAC;YACtC,OAAO,EAAE,GAAG,CAAC,OAAO;YACpB,SAAS,EAAE,GAAG,CAAC,UAAU;YACzB,UAAU,EAAE,GAAG,CAAC,WAAW;SAC5B,CAAC;QACF,IAAI,GAAG,CAAC,IAAI,KAAK,SAAS,EAAE,CAAC;YAC3B,GAAG,CAAC,IAAI,GAAG,GAAG,CAAC,IAAI,CAAC;QACtB,CAAC;QACD,IAAI,GAAG,CAAC,KAAK,KAAK,SAAS,EAAE,CAAC;YAC5B,GAAG,CAAC,KAAK,GAAG,GAAG,CAAC,KAAK,CAAC;QACxB,CAAC;QACD,IAAI,GAAG,CAAC,OAAO,KAAK,SAAS,EAAE,CAAC;YAC9B,GAAG,CAAC,OAAO,GAAG,GAAG,CAAC,OAAO,CAAC;QAC5B,CAAC;QACD,IAAI,GAAG,CAAC,WAAW,KAAK,SAAS,EAAE,CAAC;YAClC,GAAG,CAAC,UAAU,GAAG,GAAG,CAAC,WAAW,CAAC;QACnC,CAAC;QACD,OAAO,GAAG,CAAC;IACb,CAAC;IAED,eAAe,CAAC,OAAgB,EAAE,IAAY,EAAE,IAAuC;QACrF,IAAI,CAAC,SAAS,CAAC,OAAO,CAAC,EAAE,CAAC;YACxB,MAAM,IAAI,uBAAuB,CAAC,gEAAgE,CAAC,CAAC;QACtG,CAAC;QACD,IAAI,CAAC;YACH,OAAO,uBAAuB,CAAC,IAAI,CAAC,OAAO,CAAC,eAAe,CAAC,aAAa,CAAC,OAAO,CAAC,EAAE,IAAI,EAAE,IAAI,CAAC,CAAC,CAAC;QACnG,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,MAAM,IAAI,uBAAuB,CAAC,YAAY,CAAC,KAAK,CAAC,CAAC,CAAC;QACzD,CAAC;IACH,CAAC;IAED,qBAAqB,CACnB,OAAgB,EAChB,IAAY,EACZ,IAAuC;QAEvC,IAAI,CAAC,SAAS,CAAC,OAAO,CAAC,EAAE,CAAC;YACxB,MAAM,IAAI,uBAAuB,CAAC,sEAAsE,CAAC,CAAC;QAC5G,CAAC;QACD,IAAI,GAAoB,CAAC;QACzB,IAAI,CAAC;YACH,GAAG,GAAG,IAAI,CAAC,OAAO,CAAC,0BAA0B,CAAC,aAAa,CAAC,OAAO,CAAC,EAAE,IAAI,EAAE,IAAI,CAAC,CAAC;QACpF,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,MAAM,IAAI,uBAAuB,CAAC,YAAY,CAAC,KAAK,CAAC,CAAC,CAAC;QACzD,CAAC;QACD,OAAO;YACL,OAAO,EAAE,GAAG,CAAC,OAAO;YACpB,gBAAgB,EAAE,GAAG,CAAC,gBAAgB;YACtC,SAAS,EAAE,GAAG,CAAC,UAAU;YACzB,IAAI,EAAE,GAAG,CAAC,IAAI;YACd,WAAW,EAAE,GAAG,CAAC,YAAY;YAC7B,YAAY,EAAE,GAAG,CAAC,cAAc;YAChC,oBAAoB,EAAE,GAAG,CAAC,uBAAuB;YACjD,YAAY,EAAE,GAAG,CAAC,cAAc;YAChC,YAAY,EAAE,GAAG,CAAC,aAAa;SAChC,CAAC;IACJ,CAAC;IAED,OAAO,CACL,OAAgB,EAChB,IAAY,EACZ,IAAuC,EACvC,OAA0B;QAE1B,IAAI,CAAC,SAAS,CAAC,OAAO,CAAC,EAAE,CAAC;YACxB,MAAM,IAAI,uBAAuB,CAAC,wDAAwD,CAAC,CAAC;QAC9F,CAAC;QACD,OAAO,WAAW,CAAC,IAAI,CAAC,OAAO,EAAE,IAAI,CAAC,MAAM,EAAE,OAAO,EAAE,IAAI,EAAE,IAAI,EAAE,OAAO,EAAE,WAAW,EAAE,IAAI,CAAC;aAC3F,SAAS,CAAC;IACf,CAAC;IAED,MAAM,CACJ,SAAwB,EACxB,IAAY,EACZ,IAAuC,EACvC,OAA0B;QAE1B,OAAO,eAAe,CACpB,IAAI,CAAC,OAAO,EACZ,IAAI,CAAC,MAAM,EACX,SAAS,EACT,IAAI,EACJ,IAAI,EACJ,OAAO,EACP,UAAU,EACV,IAAI,CACL,CAAC;IACJ,CAAC;IAED,cAAc,CAAC,KAA0B;QACvC,IAAI,CAAC,IAAI,CAAC,OAAO,EAAE,CAAC;YAClB,MAAM,IAAI,uBAAuB,CAC/B,iIAAiI,CAClI,CAAC;QACJ,CAAC;QACD,MAAM,EAAE,GAAG,EAAE,OAAO,EAAE,GAAG,eAAe,CAAC,KAAK,CAAC,CAAC;QAChD,IAAI,CAAC;YACH,OAAO,IAAI,CAAC,OAAO,CAAC,2BAA2B,CAAC,GAAG,EAAE,OAAO,CAAC,CAAC;QAChE,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,MAAM,IAAI,uBAAuB,CAAC,YAAY,CAAC,KAAK,CAAC,CAAC,CAAC;QACzD,CAAC;IACH,CAAC;IAED,MAAM,CAAC,IAAyB;QAC9B,IAAI,CAAC,OAAO,CAAC,kBAAkB,CAAC,kBAAkB,CAAC,IAAI,CAAC,CAAC,CAAC;IAC5D,CAAC;IAED,KAAK;QACH,QAAQ,EAAE,CAAC;IACb,CAAC;CACF;AAED,SAAS,YAAY,CAAC,KAAa,EAAE,IAAY;IAC/C,IAAI,OAAO,KAAK,KAAK,QAAQ,IAAI,KAAK,CAAC,IAAI,EAAE,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QAC3D,MAAM,IAAI,uBAAuB,CAAC,GAAG,IAAI,6BAA6B,CAAC,CAAC;IAC1E,CAAC;IACD,OAAO,KAAK,CAAC;AACf,CAAC;AAED,SAAS,YAAY,CAAC,KAAc;IAClC,OAAO,KAAK,YAAY,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;AAChE,CAAC;AAED,qFAAqF;AACrF,SAAS,UAAU,CAAC,KAAc;IAChC,IAAI,KAAK,YAAY,UAAU,EAAE,CAAC;QAChC,OAAO,KAAK,CAAC;IACf,CAAC;IACD,MAAM,OAAO,GAAG,mBAAmB,CAAC,YAAY,CAAC,KAAK,CAAC,CAAC,CAAC;IACzD,KAAK,MAAM,IAAI,IAAI,CAAC,qBAAqB,EAAE,sBAAsB,EAAE,uBAAuB,CAAU,EAAE,CAAC;QACrG,IAAI,OAAO,CAAC,UAAU,CAAC,IAAI,CAAC,EAAE,CAAC;YAC7B,OAAO,IAAI,wBAAwB,CAAC,IAAI,EAAE,OAAO,CAAC,CAAC;QACrD,CAAC;IACH,CAAC;IACD,OAAO,IAAI,uBAAuB,CAAC,OAAO,CAAC,CAAC;AAC9C,CAAC;AAED,SAAS,mBAAmB,CAAC,OAAe;IAC1C,MAAM,IAAI,GAAG,sCAAsC,CAAC,IAAI,CAAC,OAAO,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC;IACvE,IAAI,IAAI,KAAK,SAAS,EAAE,CAAC;QACvB,OAAO,GAAG,OAAO,0BAA0B,IAAI,wDAAwD,CAAC;IAC1G,CAAC;IACD,IACE,OAAO,CAAC,QAAQ,CAAC,sBAAsB,CAAC;QACxC,OAAO,CAAC,QAAQ,CAAC,gBAAgB,CAAC;QAClC,OAAO,CAAC,QAAQ,CAAC,0BAA0B,CAAC;QAC5C,OAAO,CAAC,QAAQ,CAAC,2BAA2B,CAAC,EAC7C,CAAC;QACD,OAAO,GAAG,OAAO,sFAAsF,CAAC;IAC1G,CAAC;IACD,OAAO,OAAO,CAAC;AACjB,CAAC;AAED,SAAS,eAAe,CAAC,KAA0B;IACjD,IAAI,KAAK,KAAK,IAAI,IAAI,OAAO,KAAK,KAAK,QAAQ,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC,MAAM,CAAC,EAAE,CAAC;QAChF,MAAM,IAAI,uBAAuB,CAAC,8DAA8D,CAAC,CAAC;IACpG,CAAC;IACD,MAAM,GAAG,GAAG,KAAK,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC,EAAE,EAAgB,EAAE,CAAC,OAAO,EAAE,KAAK,QAAQ,IAAI,EAAE,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC;IAC/F,IAAI,GAAG,CAAC,MAAM,KAAK,CAAC,IAAI,GAAG,CAAC,MAAM,KAAK,KAAK,CAAC,MAAM,CAAC,MAAM,EAAE,CAAC;QAC3D,MAAM,IAAI,uBAAuB,CAAC,iDAAiD,CAAC,CAAC;IACvF,CAAC;IACD,IAAI,KAAK,CAAC,OAAO,KAAK,SAAS,IAAI,CAAC,CAAC,MAAM,CAAC,SAAS,CAAC,KAAK,CAAC,OAAO,CAAC,IAAI,KAAK,CAAC,OAAO,GAAG,CAAC,CAAC,EAAE,CAAC;QAC3F,MAAM,IAAI,uBAAuB,CAAC,oDAAoD,CAAC,CAAC;IAC1F,CAAC;IACD,OAAO,EAAE,GAAG,EAAE,OAAO,EAAE,KAAK,CAAC,OAAO,EAAE,CAAC;AACzC,CAAC;AAED,SAAS,SAAS,CAAC,KAAc;IAC/B,IAAI,KAAK,YAAY,GAAG,EAAE,CAAC;QACzB,OAAO,MAAM,CAAC,WAAW,CAAC,KAAK,CAAC,CAAC;IACnC,CAAC;IACD,IAAI,KAAK,KAAK,IAAI,IAAI,OAAO,KAAK,KAAK,QAAQ,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC,EAAE,CAAC;QACzE,OAAO,EAAE,GAAI,KAAiC,EAAE,CAAC;IACnD,CAAC;IACD,OAAO,EAAE,CAAC;AACZ,CAAC;AAED,SAAS,mBAAmB,CAAC,OAAwB;IACnD,IAAI,OAAO,KAAK,IAAI,IAAI,OAAO,OAAO,KAAK,QAAQ,EAAE,CAAC;QACpD,MAAM,IAAI,uBAAuB,CAAC,mCAAmC,CAAC,CAAC;IACzE,CAAC;IACD,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,OAAO,CAAC,SAAS,CAAC,IAAI,OAAO,CAAC,SAAS,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QACxE,MAAM,IAAI,uBAAuB,CAAC,6CAA6C,CAAC,CAAC;IACnF,CAAC;IACD,IAAI,CAAC,MAAM,CAAC,SAAS,CAAC,OAAO,CAAC,GAAG,CAAC,IAAI,OAAO,CAAC,GAAG,GAAG,CAAC,EAAE,CAAC;QACtD,MAAM,IAAI,uBAAuB,CAAC,wCAAwC,CAAC,CAAC;IAC9E,CAAC;IACD,MAAM,OAAO,GAAwB;QACnC,SAAS,EAAE,OAAO,CAAC,SAAS,CAAC,GAAG,CAAC,CAAC,QAAQ,EAAE,CAAC,EAAE,EAAE,CAAC,gBAAgB,CAAC,QAAQ,EAAE,6BAA6B,CAAC,GAAG,CAAC,CAAC,GAAG,CAAC;QACpH,GAAG,EAAE,OAAO,CAAC,GAAG;KACjB,CAAC;IACF,IAAI,OAAO,CAAC,KAAK,KAAK,SAAS,EAAE,CAAC;QAChC,OAAO,CAAC,KAAK,GAAG,CAAC,GAAG,OAAO,CAAC,KAAK,CAAC,CAAC;IACrC,CAAC;IACD,IAAI,OAAO,CAAC,KAAK,KAAK,SAAS,EAAE,CAAC;QAChC,MAAM,KAAK,GAA8C,EAAE,CAAC;QAC5D,KAAK,MAAM,CAAC,IAAI,EAAE,IAAI,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,OAAO,CAAC,KAAK,CAAC,EAAE,CAAC;YACzD,MAAM,GAAG,GAAyD,EAAE,CAAC;YACrE,IAAI,IAAI,CAAC,OAAO,KAAK,SAAS,EAAE,CAAC;gBAC/B,GAAG,CAAC,OAAO,GAAG,IAAI,CAAC,OAAO,CAAC;YAC7B,CAAC;YACD,IAAI,IAAI,CAAC,IAAI,KAAK,SAAS,EAAE,CAAC;gBAC5B,GAAG,CAAC,IAAI,GAAG,EAAE,GAAG,IAAI,CAAC,IAAI,EAAE,CAAC;YAC9B,CAAC;YACD,KAAK,CAAC,IAAI,CAAC,GAAG,GAAG,CAAC;QACpB,CAAC;QACD,OAAO,CAAC,KAAK,GAAG,KAAK,CAAC;IACxB,CAAC;IACD,OAAO,OAAO,CAAC;AACjB,CAAC;AAED,SAAS,iBAAiB,CAAC,OAAsB;IAC/C,IAAI,OAAO,KAAK,IAAI,IAAI,OAAO,OAAO,KAAK,QAAQ,EAAE,CAAC;QACpD,MAAM,IAAI,uBAAuB,CAAC,oCAAoC,CAAC,CAAC;IAC1E,CAAC;IACD,MAAM,KAAK,GAAG,CAAC,QAAQ,EAAE,YAAY,EAAE,UAAU,EAAE,UAAU,EAAE,WAAW,EAAE,SAAS,EAAE,cAAc,EAAE,cAAc,CAAC,CAAC;IACvH,KAAK,MAAM,GAAG,IAAI,MAAM,CAAC,IAAI,CAAC,OAAO,CAAC,EAAE,CAAC;QACvC,IAAI,CAAC,KAAK,CAAC,QAAQ,CAAC,GAAG,CAAC,EAAE,CAAC;YACzB,MAAM,IAAI,uBAAuB,CAC/B,kCAAkC,GAAG,eAAe,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,GAAG,CACxE,CAAC;QACJ,CAAC;IACH,CAAC;IACD,MAAM,GAAG,GAAsB,EAAE,CAAC;IAClC,IAAI,OAAO,CAAC,MAAM,KAAK,SAAS,EAAE,CAAC;QACjC,GAAG,CAAC,MAAM,GAAG,gBAAgB,CAAC,OAAO,CAAC,MAAM,EAAE,iBAAiB,CAAC,CAAC,GAAG,CAAC;IACvE,CAAC;IACD,IAAI,OAAO,CAAC,UAAU,KAAK,SAAS,EAAE,CAAC;QACrC,GAAG,CAAC,UAAU,GAAG,UAAU,CAAC,OAAO,CAAC,UAAU,EAAE,qBAAqB,EAAE,CAAC,CAAC,CAAC;IAC5E,CAAC;IACD,IAAI,OAAO,CAAC,QAAQ,KAAK,SAAS,EAAE,CAAC;QACnC,IAAI,OAAO,OAAO,CAAC,QAAQ,KAAK,SAAS,EAAE,CAAC;YAC1C,MAAM,IAAI,uBAAuB,CAAC,qCAAqC,CAAC,CAAC;QAC3E,CAAC;QACD,GAAG,CAAC,QAAQ,GAAG,OAAO,CAAC,QAAQ,CAAC;IAClC,CAAC;IACD,IAAI,OAAO,CAAC,QAAQ,KAAK,SAAS,EAAE,CAAC;QACnC,GAAG,CAAC,QAAQ,GAAG,YAAY,CAAC,OAAO,CAAC,QAAQ,EAAE,mBAAmB,CAAC,CAAC;IACrE,CAAC;IACD,IAAI,GAAG,CAAC,QAAQ,KAAK,IAAI,IAAI,GAAG,CAAC,QAAQ,KAAK,SAAS,EAAE,CAAC;QACxD,MAAM,IAAI,uBAAuB,CAAC,uDAAuD,CAAC,CAAC;IAC7F,CAAC;IACD,IAAI,OAAO,CAAC,SAAS,KAAK,SAAS,EAAE,CAAC;QACpC,GAAG,CAAC,SAAS,GAAG,aAAa,CAAC,OAAO,CAAC,SAAS,EAAE,oBAAoB,CAAC,CAAC;IACzE,CAAC;IACD,IAAI,OAAO,CAAC,OAAO,KAAK,SAAS,EAAE,CAAC;QAClC,GAAG,CAAC,OAAO,GAAG,YAAY,CAAC,OAAO,CAAC,OAAO,EAAE,kBAAkB,CAAC,CAAC;IAClE,CAAC;IACD,IAAI,OAAO,CAAC,YAAY,KAAK,SAAS,EAAE,CAAC;QACvC,GAAG,CAAC,YAAY,GAAG,OAAO,CAAC,YAAY,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,EAAE,CAAC,gBAAgB,CAAC,CAAC,EAAE,yBAAyB,CAAC,GAAG,CAAC,CAAC,GAAG,CAAC,CAAC;IAChH,CAAC;IACD,IAAI,OAAO,CAAC,YAAY,KAAK,SAAS,EAAE,CAAC;QACvC,IAAI,CAAC,MAAM,CAAC,SAAS,CAAC,OAAO,CAAC,YAAY,CAAC,IAAI,OAAO,CAAC,YAAY,GAAG,CAAC,EAAE,CAAC;YACxE,MAAM,IAAI,uBAAuB,CAAC,0CAA0C,CAAC,CAAC;QAChF,CAAC;QACD,GAAG,CAAC,YAAY,GAAG,OAAO,CAAC,YAAY,CAAC;IAC1C,CAAC;IACD,OAAO,GAAG,CAAC;AACb,CAAC;AAED,SAAS,uBAAuB,CAAC,GAAwB;IACvD,OAAO;QACL,SAAS,EAAE,GAAG,CAAC,UAAU;QACzB,SAAS,EAAE,GAAG,CAAC,UAAU;QACzB,IAAI,EAAE,GAAG,CAAC,IAAI;QACd,IAAI,EAAE,EAAE,GAAG,GAAG,CAAC,IAAI,EAAE;QACrB,WAAW,EAAE,GAAG,CAAC,YAAY;QAC7B,eAAe,EAAE,GAAG,CAAC,iBAAiB;QACtC,iBAAiB,EAAE,CAAC,GAAG,GAAG,CAAC,kBAAkB,CAAC;QAC9C,YAAY,EAAE,GAAG,CAAC,aAAa;QAC/B,gBAAgB,EAAE,GAAG,CAAC,kBAAkB;QACxC,SAAS,EAAE,GAAG,CAAC,UAAU;QACzB,OAAO,EAAE,GAAG,CAAC,OAAO;KACrB,CAAC;AACJ,CAAC;AAED,SAAS,WAAW,CAAC,OAAe,EAAE,KAAc;IAClD,IAAI,OAAO,CAAC,QAAQ,CAAC,2BAA2B,CAAC,EAAE,CAAC;QAClD,MAAM,KAAK,GAAG,KAAK,KAAK,SAAS,IAAI,KAAK,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC,IAAI,KAAK,GAAG,CAAC,CAAC,CAAC,eAAe,CAAC;QACvF,OAAO,GAAG,OAAO,sBAAsB,KAAK,qJAAqJ,KAAK,4FAA4F,CAAC;IACrS,CAAC;IACD,IAAI,OAAO,CAAC,QAAQ,CAAC,iCAAiC,CAAC,EAAE,CAAC;QACxD,OAAO,GAAG,OAAO,+EAA+E,CAAC;IACnG,CAAC;IACD,OAAO,OAAO,CAAC;AACjB,CAAC;AAED,SAAS,qBAAqB,CAAC,WAAoB;IACjD,IAAI,WAAW,KAAK,IAAI,IAAI,OAAO,WAAW,KAAK,QAAQ,EAAE,CAAC;QAC5D,OAAO,WAAW,CAAC;IACrB,CAAC;IACD,MAAM,IAAI,GAA4B,EAAE,CAAC;IACzC,KAAK,MAAM,CAAC,GAAG,EAAE,KAAK,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,WAAsC,CAAC,EAAE,CAAC;QAClF,IACE,GAAG,KAAK,SAAS;YACjB,GAAG,KAAK,WAAW;YACnB,GAAG,KAAK,WAAW;YACnB,GAAG,KAAK,WAAW,EACnB,CAAC;YACD,SAAS;QACX,CAAC;QACD,IAAI,CAAC,GAAG,CAAC,GAAG,KAAK,CAAC;IACpB,CAAC;IACD,OAAO,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,MAAM,KAAK,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,IAAI,CAAC;AAC3D,CAAC;AAED,SAAS,eAAe,CAAC,KAAc;IACrC,MAAM,OAAO,GAAG,YAAY,CAAC,KAAK,CAAC,CAAC;IACpC,IAAI,OAAO,CAAC,UAAU,CAAC,qBAAqB,CAAC,IAAI,OAAO,CAAC,QAAQ,CAAC,iBAAiB,CAAC,EAAE,CAAC;QACrF,OAAO,IAAI,UAAU,CAAC,qBAAqB,EAAE,OAAO,CAAC,CAAC;IACxD,CAAC;IACD,IAAI,OAAO,CAAC,UAAU,CAAC,yBAAyB,CAAC,EAAE,CAAC;QAClD,OAAO,IAAI,UAAU,CAAC,yBAAyB,EAAE,OAAO,CAAC,CAAC;IAC5D,CAAC;IACD,IAAI,OAAO,CAAC,UAAU,CAAC,sBAAsB,CAAC,EAAE,CAAC;QAC/C,OAAO,IAAI,UAAU,CAAC,sBAAsB,EAAE,OAAO,CAAC,CAAC;IACzD,CAAC;IACD,IAAI,OAAO,CAAC,UAAU,CAAC,mBAAmB,CAAC,EAAE,CAAC;QAC5C,gEAAgE;QAChE,MAAM,SAAS,GAAG,QAAQ,CAAC,IAAI,CAAC,OAAO,CAAC,IAAI,EAAE,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,GAAG,CAAC;QAC3D,OAAO,IAAI,wBAAwB,CACjC,mBAAmB,EACnB,GAAG,OAAO,GAAG,SAAS,qGAAqG,CAC5H,CAAC;IACJ,CAAC;IACD,OAAO,IAAI,uBAAuB,CAAC,OAAO,CAAC,CAAC;AAC9C,CAAC;AAED,SAAS,kBAAkB,CAAC,KAA0B;IACpD,IAAI,OAAO,KAAK,KAAK,QAAQ,EAAE,CAAC;QAC9B,OAAO,KAAK,CAAC;IACf,CAAC;IACD,OAAO,UAAU,CAAC,KAAK,CAAC,CAAC;AAC3B,CAAC;AAED,SAAS,WAAW,CAClB,WAAoB,EACpB,OAA2B,EAC3B,OAAgB,EAChB,IAAY;IAEZ,cAAc,CAAC,OAAO,EAAE,OAAO,EAAE,IAAI,CAAC,CAAC;IACvC,IAAI,OAAO,KAAK,SAAS,IAAI,WAAW,KAAK,IAAI,IAAI,OAAO,WAAW,KAAK,QAAQ,EAAE,CAAC;QACrF,OAAO;IACT,CAAC;IACD,IAAI,CAAC,CAAC,WAAW,IAAI,WAAW,CAAC,EAAE,CAAC;QAClC,OAAO;IACT,CAAC;IACD,MAAM,SAAS,GAAI,WAAuC,CAAC,SAAS,CAAC;IACrE,IAAI,OAAO,SAAS,KAAK,UAAU,EAAE,CAAC;QACpC,OAAO;IACT,CAAC;IACD,mBAAmB,CAAC,SAAsD,EAAE,OAAO,CAAC,CAAC;AACvF,CAAC;AAED,SAAS,aAAa,CAAC,WAAoB;IACzC,IAAI,WAAW,KAAK,IAAI,IAAI,OAAO,WAAW,KAAK,QAAQ,IAAI,WAAW,IAAI,WAAW,EAAE,CAAC;QAC1F,MAAM,KAAK,GAAI,WAAuC,CAAC,SAAS,CAAC;QACjE,IAAI,OAAO,KAAK,KAAK,QAAQ,IAAI,KAAK,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;YAClD,OAAO,KAAK,CAAC;QACf,CAAC;IACH,CAAC;IACD,OAAO,SAAS,CAAC;AACnB,CAAC;AAED,SAAS,aAAa,CAAC,WAAoB;IACzC,IAAI,WAAW,KAAK,IAAI,IAAI,OAAO,WAAW,KAAK,QAAQ,IAAI,WAAW,IAAI,WAAW,EAAE,CAAC;QAC1F,OAAQ,WAAuC,CAAC,SAAS,CAAC;IAC5D,CAAC;IACD,OAAO,SAAS,CAAC;AACnB,CAAC;AAED,SAAS,cAAc,CAAC,WAAoB;IAC1C,IAAI,WAAW,KAAK,IAAI,IAAI,OAAO,WAAW,KAAK,QAAQ,IAAI,SAAS,IAAI,WAAW,EAAE,CAAC;QACxF,MAAM,QAAQ,GAAI,WAAoC,CAAC,OAAO,CAAC;QAC/D,IAAI,CAAC,SAAS,CAAC,QAAQ,CAAC,EAAE,CAAC;YACzB,MAAM,IAAI,uBAAuB,CAAC,yCAAyC,CAAC,CAAC;QAC/E,CAAC;QACD,OAAO,QAAQ,CAAC;IAClB,CAAC;IACD,MAAM,OAAO,GAAG,cAAc,CAAC,QAAQ,EAAE,CAAC;IAC1C,IAAI,OAAO,KAAK,SAAS,EAAE,CAAC;QAC1B,MAAM,IAAI,uBAAuB,CAC/B,mFAAmF,CACpF,CAAC;IACJ,CAAC;IACD,OAAO,OAAO,CAAC;AACjB,CAAC;AAED,SAAS,mBAAmB,CAAC,KAAmB;IAC9C,MAAM,KAAK,GAA0C,EAAE,GAAG,CAAC,KAAK,CAAC,KAAK,IAAI,EAAE,CAAC,EAAE,CAAC;IAChF,KAAK,MAAM,IAAI,IAAI,KAAK,CAAC,KAAK,IAAI,EAAE,EAAE,CAAC;QACrC,IAAI,IAAI,KAAK,IAAI,IAAI,OAAO,IAAI,KAAK,QAAQ,EAAE,CAAC;YAC9C,MAAM,IAAI,uBAAuB,CAAC,qDAAqD,CAAC,CAAC;QAC3F,CAAC;QACD,MAAM,MAAM,GAAG,YAAY,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC;QACtC,IAAI,MAAM,KAAK,SAAS,EAAE,CAAC;YACzB,MAAM,IAAI,uBAAuB,CAAC,qDAAqD,CAAC,CAAC;QAC3F,CAAC;QACD,MAAM,QAAQ,GAAG,KAAK,CAAC,MAAM,CAAC,UAAU,CAAC,CAAC;QAC1C,IAAI,QAAQ,KAAK,SAAS,IAAI,CAAC,SAAS,CAAC,QAAQ,EAAE,MAAM,CAAC,KAAK,CAAC,EAAE,CAAC;YACjE,MAAM,IAAI,uBAAuB,CAC/B,yCAAyC,MAAM,CAAC,UAAU,EAAE,CAC7D,CAAC;QACJ,CAAC;QACD,KAAK,CAAC,MAAM,CAAC,UAAU,CAAC,GAAG,MAAM,CAAC,KAAK,CAAC;IAC1C,CAAC;IACD,OAAO,KAAK,CAAC;AACf,CAAC;AAED,SAAS,SAAS,CAAC,IAAiB,EAAE,KAAkB;IACtD,OAAO,IAAI,CAAC,SAAS,CAAC,WAAW,CAAC,IAAI,CAAC,CAAC,KAAK,IAAI,CAAC,SAAS,CAAC,WAAW,CAAC,KAAK,CAAC,CAAC,CAAC;AAClF,CAAC;AAED,SAAS,WAAW,CAAC,KAAkB;IACrC,MAAM,IAAI,GAAG,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,IAAI,EAAE,CAAC;IACvC,MAAM,GAAG,GAA6C,EAAE,CAAC;IACzD,KAAK,MAAM,GAAG,IAAI,IAAI,EAAE,CAAC;QACvB,MAAM,KAAK,GAAG,KAAK,CAAC,GAAG,CAAC,CAAC;QACzB,IAAI,KAAK,KAAK,SAAS,EAAE,CAAC;YACxB,GAAG,CAAC,GAAG,CAAC,GAAG,KAAK,CAAC;QACnB,CAAC;IACH,CAAC;IACD,OAAO,GAAG,CAAC;AACb,CAAC;AAED,8EAA8E;AAC9E,6EAA6E;AAC7E,8EAA8E;AAE9E,SAAS,aAAa,CAAC,OAAiC;IACtD,MAAM,IAAI,GAAG,OAAO,OAAO,KAAK,QAAQ,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,OAAO,CAAC,WAAW,CAAC;IACzE,MAAM,GAAG,GAAG,IAAI,CAAC,IAAI,EAAE,CAAC,WAAW,EAAE,CAAC;IACtC,IAAI,CAAC,gBAAgB,CAAC,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC;QAChC,MAAM,IAAI,uBAAuB,CAAC,kEAAkE,CAAC,CAAC;IACxG,CAAC;IACD,OAAO,GAAG,CAAC;AACb,CAAC;AAED,+FAA+F;AAC/F,MAAM,UAAU,YAAY,CAC1B,OAAiC,EACjC,cAA0B,EAC1B,OAA4B;IAE5B,IAAI,CAAC,CAAC,cAAc,YAAY,UAAU,CAAC,IAAI,cAAc,CAAC,MAAM,KAAK,EAAE,EAAE,CAAC;QAC5E,MAAM,IAAI,uBAAuB,CAAC,mDAAmD,CAAC,CAAC;IACzF,CAAC;IACD,IAAI,OAAO,KAAK,IAAI,IAAI,OAAO,OAAO,KAAK,QAAQ,IAAI,OAAO,OAAO,CAAC,UAAU,KAAK,QAAQ,IAAI,OAAO,CAAC,UAAU,CAAC,IAAI,EAAE,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QACxI,MAAM,IAAI,uBAAuB,CAAC,0DAA0D,CAAC,CAAC;IAChG,CAAC;IACD,IAAI,OAAO,CAAC,UAAU,KAAK,SAAS,IAAI,CAAC,CAAC,MAAM,CAAC,SAAS,CAAC,OAAO,CAAC,UAAU,CAAC,IAAI,OAAO,CAAC,UAAU,GAAG,CAAC,CAAC,EAAE,CAAC;QAC1G,MAAM,IAAI,uBAAuB,CAAC,sDAAsD,CAAC,CAAC;IAC5F,CAAC;IACD,MAAM,gBAAgB,GACpB,OAAO,CAAC,gBAAgB,IAAI,CAAC,OAAO,OAAO,KAAK,QAAQ,CAAC,CAAC,CAAC,OAAO,CAAC,gBAAgB,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC;IACnG,IAAI,CAAC;QACH,OAAO,QAAQ,EAAE,CAAC,yBAAyB,CACzC,aAAa,CAAC,OAAO,CAAC,EACtB,cAAc,EACd,OAAO,CAAC,UAAU,EAClB,OAAO,CAAC,UAAU,EAClB,gBAAgB,CACjB,CAAC;IACJ,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,MAAM,IAAI,uBAAuB,CAAC,YAAY,CAAC,KAAK,CAAC,CAAC,CAAC;IACzD,CAAC;AACH,CAAC;AAED,mFAAmF;AACnF,MAAM,UAAU,eAAe,CAAC,QAA6B;IAC3D,MAAM,IAAI,GAAG,OAAO,QAAQ,KAAK,QAAQ,CAAC,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC,MAAM,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC,QAAQ,CAAC,QAAQ,CAAC,CAAC;IAChG,IAAI,GAAG,CAAC;IACR,IAAI,CAAC;QACH,GAAG,GAAG,QAAQ,EAAE,CAAC,kBAAkB,CAAC,IAAI,CAAC,CAAC;IAC5C,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,MAAM,IAAI,uBAAuB,CAAC,YAAY,CAAC,KAAK,CAAC,CAAC,CAAC;IACzD,CAAC;IACD,MAAM,GAAG,GAA6D;QACpE,iBAAiB,EAAE,GAAG,CAAC,mBAAmB;QAC1C,WAAW,EAAE,GAAG,CAAC,YAAY;QAC7B,UAAU,EAAE,GAAG,CAAC,WAAW;QAC3B,UAAU,EAAE,GAAG,CAAC,WAAW;QAC3B,SAAS,EAAE,GAAG,CAAC,UAAU;QACzB,OAAO,EAAE,GAAG,CAAC,OAAO;QACpB,cAAc,EAAE,GAAG,CAAC,eAAe;KACpC,CAAC;IACF,IAAI,GAAG,CAAC,KAAK,KAAK,SAAS,EAAE,CAAC;QAC5B,GAAG,CAAC,KAAK,GAAG,GAAG,CAAC,KAAK,CAAC;IACxB,CAAC;IACD,OAAO,GAAG,CAAC;AACb,CAAC;AAED,6DAA6D;AAC7D,MAAM,UAAU,kBAAkB,CAAC,KAA0B,EAAE,YAAwB;IACrF,IAAI,CAAC,CAAC,YAAY,YAAY,UAAU,CAAC,IAAI,YAAY,CAAC,MAAM,KAAK,EAAE,EAAE,CAAC;QACxE,MAAM,IAAI,uBAAuB,CAAC,uDAAuD,CAAC,CAAC;IAC7F,CAAC;IACD,MAAM,EAAE,GAAG,EAAE,OAAO,EAAE,GAAG,eAAe,CAAC,KAAK,CAAC,CAAC;IAChD,IAAI,CAAC;QACH,OAAO,QAAQ,EAAE,CAAC,8BAA8B,CAAC,GAAG,EAAE,OAAO,EAAE,YAAY,CAAC,CAAC;IAC/E,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,MAAM,IAAI,uBAAuB,CAAC,YAAY,CAAC,KAAK,CAAC,CAAC,CAAC;IACzD,CAAC;AACH,CAAC;AAED,MAAM,UAAU,qBAAqB,CAAC,IAAyB;IAC7D,IAAI,GAAG,CAAC;IACR,IAAI,CAAC;QACH,GAAG,GAAG,QAAQ,EAAE,CAAC,wBAAwB,CAAC,kBAAkB,CAAC,IAAI,CAAC,CAAC,CAAC;IACtE,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,MAAM,IAAI,uBAAuB,CAAC,YAAY,CAAC,KAAK,CAAC,CAAC,CAAC;IACzD,CAAC;IACD,OAAO;QACL,OAAO,EAAE,GAAG,CAAC,OAAO;QACpB,QAAQ,EAAE,GAAG,CAAC,SAAS;QACvB,eAAe,EAAE,GAAG,CAAC,iBAAiB;QACtC,UAAU,EAAE,CAAC,GAAG,GAAG,CAAC,WAAW,CAAC;QAChC,cAAc,EAAE,GAAG,CAAC,eAAe;KACpC,CAAC;AACJ,CAAC;AAED,8DAA8D;AAC9D,MAAM,UAAU,aAAa,CAAC,IAAyB;IACrD,IAAI,GAAG,CAAC;IACR,IAAI,CAAC;QACH,GAAG,GAAG,QAAQ,EAAE,CAAC,gBAAgB,CAAC,kBAAkB,CAAC,IAAI,CAAC,CAAC,CAAC;IAC9D,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,MAAM,IAAI,uBAAuB,CAAC,YAAY,CAAC,KAAK,CAAC,CAAC,CAAC;IACzD,CAAC;IACD,MAAM,GAAG,GAA2D;QAClE,SAAS,EAAE,IAAI;QACf,SAAS,EAAE,GAAG,CAAC,UAAU;QACzB,OAAO,EAAE,GAAG,CAAC,OAAO;QACpB,MAAM,EAAE,GAAG,CAAC,MAAM;QAClB,SAAS,EAAE,GAAG,CAAC,UAAU;KAC1B,CAAC;IACF,IAAI,GAAG,CAAC,aAAa,KAAK,SAAS;QAAE,GAAG,CAAC,YAAY,GAAG,GAAG,CAAC,aAAa,CAAC;IAC1E,IAAI,GAAG,CAAC,WAAW,KAAK,SAAS;QAAE,GAAG,CAAC,UAAU,GAAG,GAAG,CAAC,WAAW,CAAC;IACpE,IAAI,GAAG,CAAC,QAAQ,KAAK,SAAS;QAAE,GAAG,CAAC,OAAO,GAAG,GAAG,CAAC,QAAQ,CAAC;IAC3D,IAAI,GAAG,CAAC,YAAY,KAAK,SAAS;QAAE,GAAG,CAAC,WAAW,GAAG,GAAG,CAAC,YAAY,CAAC;IACvE,IAAI,GAAG,CAAC,sBAAsB,KAAK,SAAS;QAAE,GAAG,CAAC,oBAAoB,GAAG,GAAG,CAAC,sBAAsB,CAAC;IACpG,IAAI,GAAG,CAAC,iBAAiB,KAAK,SAAS;QAAE,GAAG,CAAC,eAAe,GAAG,GAAG,CAAC,iBAAiB,CAAC;IACrF,IAAI,GAAG,CAAC,kBAAkB,KAAK,SAAS;QAAE,GAAG,CAAC,gBAAgB,GAAG,GAAG,CAAC,kBAAkB,CAAC;IACxF,OAAO,GAAG,CAAC;AACb,CAAC;AAED;;;GAGG;AACH,MAAM,UAAU,kBAAkB,CAAC,IAAyB,EAAE,KAAiC;IAC7F,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC,IAAI,KAAK,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QAChD,MAAM,IAAI,uBAAuB,CAAC,yDAAyD,CAAC,CAAC;IAC/F,CAAC;IACD,IAAI,GAAG,CAAC;IACR,IAAI,CAAC;QACH,GAAG,GAAG,QAAQ,EAAE,CAAC,qBAAqB,CACpC,kBAAkB,CAAC,IAAI,CAAC,EACxB,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,EAAE,CAAC,gBAAgB,CAAC,CAAC,EAAE,SAAS,CAAC,GAAG,CAAC,CAAC,GAAG,CAAC,CAC5D,CAAC;IACJ,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,MAAM,IAAI,uBAAuB,CAAC,YAAY,CAAC,KAAK,CAAC,CAAC,CAAC;IACzD,CAAC;IACD,MAAM,GAAG,GAAqE;QAC5E,SAAS,EAAE,GAAG,CAAC,UAAU;QACzB,OAAO,EAAE,GAAG,CAAC,OAAO;QACpB,SAAS,EAAE,GAAG,CAAC,SAAS;QACxB,UAAU,EAAE,GAAG,CAAC,WAAW;KAC5B,CAAC;IACF,IAAI,GAAG,CAAC,aAAa,KAAK,SAAS;QAAE,GAAG,CAAC,YAAY,GAAG,GAAG,CAAC,aAAa,CAAC;IAC1E,IAAI,GAAG,CAAC,WAAW,KAAK,SAAS;QAAE,GAAG,CAAC,UAAU,GAAG,GAAG,CAAC,WAAW,CAAC;IACpE,IAAI,GAAG,CAAC,mBAAmB,KAAK,SAAS;QAAE,GAAG,CAAC,kBAAkB,GAAG,GAAG,CAAC,mBAAmB,CAAC;IAC5F,IAAI,GAAG,CAAC,WAAW,KAAK,SAAS;QAAE,GAAG,CAAC,UAAU,GAAG,GAAG,CAAC,WAAW,CAAC;IACpE,IAAI,GAAG,CAAC,WAAW,KAAK,SAAS;QAAE,GAAG,CAAC,UAAU,GAAG,GAAG,CAAC,WAAW,CAAC;IACpE,OAAO,GAAG,CAAC;AACb,CAAC;AAED;;;GAGG;AACH,MAAM,UAAU,6BAA6B,CAC3C,OAAwB,EACxB,OAGC;IAED,IAAI,OAAO,KAAK,IAAI,IAAI,OAAO,OAAO,KAAK,QAAQ,IAAI,OAAO,OAAO,CAAC,WAAW,KAAK,QAAQ,EAAE,CAAC;QAC/F,MAAM,IAAI,uBAAuB,CAAC,uFAAuF,CAAC,CAAC;IAC7H,CAAC;IACD,MAAM,IAAI,GAA+F;QACvG,cAAc,EAAE,CAAC;QACjB,cAAc,EAAE,OAAO,CAAC,SAAS;QACjC,UAAU,EAAE,OAAO,CAAC,SAAS;QAC7B,IAAI,EAAE,OAAO,CAAC,IAAI;QAClB,SAAS,EAAE,EAAE,GAAG,OAAO,CAAC,IAAI,EAAE;QAC9B,gBAAgB,EAAE,OAAO,CAAC,WAAW;QACrC,qBAAqB,EAAE,OAAO,CAAC,eAAe;QAC9C,0BAA0B,EAAE,CAAC,GAAG,OAAO,CAAC,iBAAiB,CAAC;QAC1D,aAAa,EAAE,IAAI,CAAC,GAAG,CAAC,CAAC,EAAE,OAAO,CAAC,YAAY,CAAC;QAChD,uBAAuB,EAAE,OAAO,CAAC,gBAAgB;QACjD,eAAe,EAAE,OAAO,CAAC,SAAS;KACnC,CAAC;IACF,IAAI,OAAO,EAAE,WAAW,KAAK,SAAS,EAAE,CAAC;QACvC,MAAM,CAAC,GAAG,OAAO,CAAC,WAAW,CAAC;QAC9B,IAAI,CAAC,WAAW,GAAG;YACjB,OAAO,EAAE,CAAC,CAAC,OAAO;YAClB,gBAAgB,EAAE,CAAC,CAAC,gBAAgB;YACpC,UAAU,EAAE,CAAC,CAAC,SAAS;YACvB,IAAI,EAAE,CAAC,CAAC,IAAI;YACZ,YAAY,EAAE,CAAC,CAAC,WAAW;YAC3B,cAAc,EAAE,CAAC,CAAC,YAAY;YAC9B,uBAAuB,EAAE,CAAC,CAAC,oBAAoB;YAC/C,cAAc,EAAE,CAAC,CAAC,YAAY;YAC9B,aAAa,EAAE,CAAC,CAAC,YAAY;YAC7B,2CAA2C;YAC3C,UAAU,EAAE,CAAC,CAAC,YAAY;YAC1B,SAAS,EAAE,CAAC,CAAC,YAAY;SAC1B,CAAC;IACJ,CAAC;IACD,IAAI,OAAO,EAAE,QAAQ,KAAK,SAAS,IAAI,MAAM,CAAC,IAAI,CAAC,OAAO,CAAC,QAAQ,CAAC,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;QAChF,IAAI,CAAC,QAAQ,GAAG,EAAE,GAAG,OAAO,CAAC,QAAQ,EAAE,CAAC;IAC1C,CAAC;IACD,IAAI,OAAO,CAAC,OAAO,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;QAC/B,IAAI,CAAC,OAAO,GAAG,OAAO,CAAC,OAAO,CAAC;IACjC,CAAC;IACD,OAAO,IAAI,CAAC;AACd,CAAC;AAED,sHAAsH;AACtH,MAAM,UAAU,6BAA6B,CAAC,QAAwC;IACpF,IAAI,QAAQ,KAAK,IAAI,IAAI,OAAO,QAAQ,KAAK,QAAQ,IAAI,OAAO,QAAQ,CAAC,MAAM,KAAK,QAAQ,EAAE,CAAC;QAC7F,MAAM,IAAI,uBAAuB,CAAC,mDAAmD,CAAC,CAAC;IACzF,CAAC;IACD,IAAI,QAAQ,CAAC,MAAM,KAAK,UAAU,EAAE,CAAC;QACnC,OAAO,EAAE,CAAC;IACZ,CAAC;IACD,MAAM,IAAI,GAAG,QAAQ,CAAC,oBAAoB,CAAC;IAC3C,IAAI,IAAI,KAAK,SAAS,IAAI,IAAI,KAAK,IAAI,EAAE,CAAC;QACxC,OAAO,EAAE,CAAC;IACZ,CAAC;IACD,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,IAAI,CAAC,IAAI,IAAI,CAAC,IAAI,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,OAAO,IAAI,KAAK,QAAQ,IAAI,IAAI,CAAC,MAAM,KAAK,CAAC,CAAC,EAAE,CAAC;QAC/F,MAAM,IAAI,uBAAuB,CAAC,yDAAyD,CAAC,CAAC;IAC/F,CAAC;IACD,OAAO,CAAC,GAAG,IAAI,CAAC,CAAC;AACnB,CAAC;AAED,SAAS,eAAe,CAAC,UAA8B,EAAE;IACvD,IAAI,CAAC,cAAc,CAAC,OAAO,CAAC,EAAE,CAAC;QAC7B,MAAM,IAAI,uBAAuB,CAC/B,gHAAgH,CACjH,CAAC;IACJ,CAAC;IACD,IAAI,OAAO,CAAC,IAAI,EAAE,IAAI,KAAK,UAAU,IAAI,CAAC,cAAc,CAAC,OAAO,CAAC,IAAI,CAAC,EAAE,CAAC;QACvE,MAAM,IAAI,uBAAuB,CAAC,qBAAqB,EAAE,CAAC,CAAC;IAC7D,CAAC;IACD,QAAQ,EAAE,CAAC;IACX,OAAO,IAAI,WAAW,CAAC,OAAO,CAAC,CAAC;AAClC,CAAC;AAED,MAAM,CAAC,MAAM,WAAW,GAyBpB,MAAM,CAAC,MAAM,CAAC,eAAe,EAAE;IACjC,OAAO;IACP,gBAAgB;IAChB,gBAAgB;IAChB,kBAAkB;IAClB,gBAAgB;IAChB,gBAAgB;IAChB,iBAAiB;IACjB,iBAAiB;IACjB,sBAAsB;IACtB,gBAAgB;IAChB,gBAAgB;IAChB,kBAAkB;IAClB,YAAY;IACZ,eAAe;IACf,kBAAkB;IAClB,qBAAqB;IACrB,aAAa;IACb,kBAAkB;IAClB,6BAA6B;IAC7B,6BAA6B;IAC7B,iBAAiB;IACjB,QAAQ,EAAE,eAAe;IACzB,gBAAgB;IAChB,OAAO,EAAE,CAAC,OAA4C,EAAE,EAAE,CAAC,aAAa,CAAC,eAAe,EAAE,OAAO,CAAC;CACnG,CAAC,CAAC","sourcesContent":["import { AsyncLocalStorage } from \"node:async_hooks\";\nimport { randomBytes } from \"node:crypto\";\nimport type {\n AllowPolicy,\n ApprovalContextAttestation,\n ApprovalInfo,\n ApprovalRequest,\n Clearance,\n ControlPlaneApprovalRequestV1,\n ControlPlaneApprovalResponseV1,\n CreateTenuoOptions,\n DevRoot,\n Explanation,\n IssueInput,\n IssuerKey,\n McpAttachOptions,\n McpVerifyOptions,\n NarrowInput,\n NarrowOptions,\n PresentedCall,\n ProtectedTool,\n PublicKeyHandle,\n ReceiptChainInfo,\n ReceiptInfo,\n RequireApproval,\n RevocationListInfo,\n RevocationListInput,\n SessionFromWireInput,\n SessionInput,\n SignApprovalOptions,\n Tenuo,\n TenuoErrorCode,\n TenuoMcp,\n ToolPolicy,\n} from \"./api.ts\";\nimport { parseConnectToken } from \"./connect.ts\";\nimport { generateIdentity, identityFromKey } from \"./identity.ts\";\nimport { createMcp, presentCall, verifyPresented, type Decide } from \"./mcp.ts\";\nimport { collectReceipt, emitIsolatedReceipt, inheritSessionCollector } from \"./receipts.ts\";\nimport { createRuntime } from \"./runtime.ts\";\nimport { AuthorizationDeniedError, ApprovalRequiredError, TenuoConfigurationError, TenuoError } from \"./errors.ts\";\nimport { Session, isSession, nativeSession } from \"./session.ts\";\nimport {\n createDevContext,\n createIssuerContext,\n createVerifierContext,\n importSessionFromChain,\n importSessionFromWire,\n loadWasm,\n protocolLimits,\n publicKeyHexFromHolderKey,\n type WasmApprovalRequest,\n type WasmAttestation,\n type WasmContext,\n type WasmExplain,\n type WasmIssueOptions,\n type WasmMintOptions,\n type WasmNarrowOptions,\n type WasmRequireApproval,\n} from \"./wasm.ts\";\n\nconst currentSession = new AsyncLocalStorage<Session>();\nconst toolPolicies = new WeakMap<object, { capability: string; allow: AllowPolicy }>();\nconst wrappedInners = new WeakSet<object>();\n\nconst CLEARANCE_NAMES = new Set([\"untrusted\", \"external\", \"partner\", \"internal\", \"privileged\", \"system\"]);\n\nfunction nodeEnv(): string | undefined {\n if (typeof process === \"undefined\") {\n return undefined;\n }\n return process.env.NODE_ENV;\n}\n\nfunction allowDev(): boolean {\n if (typeof process === \"undefined\") {\n return false;\n }\n return process.env.TENUO_ALLOW_DEV === \"1\";\n}\n\nexport function devRoot(options?: { readonly allowInProduction?: boolean }): DevRoot {\n const root: DevRoot = {\n kind: \"dev-root\",\n ...(options?.allowInProduction === true ? { allowInProduction: true } : {}),\n };\n if (!devRootAllowed(root)) {\n throw new TenuoConfigurationError(devRootBlockedMessage());\n }\n return root;\n}\n\nfunction devRootAllowed(root: DevRoot): boolean {\n if (root.allowInProduction === true || allowDev()) {\n return true;\n }\n const env = nodeEnv();\n return env === \"development\" || env === \"test\";\n}\n\nfunction devRootBlockedMessage(): string {\n return \"createTenuo.devRoot() is for development. Set NODE_ENV=development or test, pass devRoot({ allowInProduction: true }), or TENUO_ALLOW_DEV=1. Unset NODE_ENV is not treated as development.\";\n}\n\nfunction normalizeHex(value: string): string {\n const hex = value.trim().toLowerCase().replace(/^0x/, \"\");\n if (!/^[0-9a-f]{64}$/.test(hex)) {\n throw new TenuoConfigurationError(\n \"Trusted root must be a 32-byte hex public key (64 hex characters)\",\n );\n }\n return hex;\n}\n\nfunction envValue(name: string, what: string): string {\n if (name.length === 0) {\n throw new TenuoConfigurationError(`${what} requires an environment variable name`);\n }\n if (typeof process === \"undefined\") {\n throw new TenuoConfigurationError(\n `Environment variable ${name} is not available. Tenuo fails closed without a ${what}.`,\n );\n }\n const value = process.env[name];\n if (value === undefined || value.length === 0) {\n throw new TenuoConfigurationError(\n `Environment variable ${name} is not set or empty. Tenuo fails closed without a ${what}.`,\n );\n }\n return value;\n}\n\nexport function publicKeyFromEnv(name: string): PublicKeyHandle {\n return { kind: \"public-key\", source: \"env\", hex: normalizeHex(envValue(name, \"trusted root\")) };\n}\n\nexport function publicKeyFromHex(hex: string): PublicKeyHandle {\n return { kind: \"public-key\", source: \"hex\", hex: normalizeHex(hex) };\n}\n\nexport function publicKeyFromBytes(bytes: Uint8Array): PublicKeyHandle {\n if (bytes.length !== 32) {\n throw new TenuoConfigurationError(\"publicKeyFromBytes() requires a 32-byte public key\");\n }\n return { kind: \"public-key\", source: \"bytes\", hex: bytesToHex(bytes) };\n}\n\nfunction normalizeSecretHex(value: string, what: string): string {\n const hex = value.trim().toLowerCase().replace(/^0x/, \"\");\n if (!/^[0-9a-f]{64}$/.test(hex)) {\n throw new TenuoConfigurationError(`${what} must be a 32-byte hex secret (64 hex characters)`);\n }\n return hex;\n}\n\nfunction hexToBytes(hex: string): Uint8Array {\n const bytes = new Uint8Array(hex.length / 2);\n for (let i = 0; i < bytes.length; i += 1) {\n bytes[i] = Number.parseInt(hex.slice(i * 2, i * 2 + 2), 16);\n }\n return bytes;\n}\n\nfunction bytesToHex(bytes: Uint8Array): string {\n return Array.from(bytes, (b) => b.toString(16).padStart(2, \"0\")).join(\"\");\n}\n\nexport function holderKeyFromEnv(name: string): Uint8Array {\n return hexToBytes(normalizeSecretHex(envValue(name, \"holder key\"), \"Holder key\"));\n}\n\nexport function holderKeyFromHex(hex: string): Uint8Array {\n return hexToBytes(normalizeSecretHex(hex, \"Holder key\"));\n}\n\n/**\n * A fresh 32-byte Ed25519 secret. One per agent, kept in that agent's\n * process; only its public key (see `publicKeyFromHolderKey`) travels.\n */\nexport function generateHolderKey(): Uint8Array {\n return new Uint8Array(randomBytes(32));\n}\n\n/** Same shape as a holder key. Named separately so a control plane's key reads as one. */\nexport function generateIssuerKey(): Uint8Array {\n return generateHolderKey();\n}\n\n/** The public half of a holder or issuer secret. */\nexport function publicKeyFromHolderKey(holderKey: Uint8Array): PublicKeyHandle {\n if (!(holderKey instanceof Uint8Array) || holderKey.length !== 32) {\n throw new TenuoConfigurationError(\"publicKeyFromHolderKey() requires a 32-byte holder key\");\n }\n loadWasm();\n return { kind: \"public-key\", source: \"bytes\", hex: publicKeyHexFromHolderKey(holderKey) };\n}\n\nconst MAX_WASM_U32 = 0xffff_ffff;\n\nfunction requireUint32(value: number, name: string, minimum = 0): number {\n if (!Number.isInteger(value) || value < minimum || value > MAX_WASM_U32) {\n throw new TenuoConfigurationError(\n `${name} must be an integer between ${minimum} and ${MAX_WASM_U32}`,\n );\n }\n return value;\n}\n\n/** Stable control-plane key from the environment. This process becomes an issuer. */\nexport function issuerKeyFromEnv(name: string): IssuerKey {\n return { kind: \"issuer-key\", secret: hexToBytes(normalizeSecretHex(envValue(name, \"issuer key\"), \"Issuer key\")) };\n}\n\nexport function issuerKeyFromHex(hex: string): IssuerKey {\n return { kind: \"issuer-key\", secret: hexToBytes(normalizeSecretHex(hex, \"Issuer key\")) };\n}\n\nexport function issuerKeyFromBytes(secret: Uint8Array): IssuerKey {\n if (!(secret instanceof Uint8Array) || secret.length !== 32) {\n throw new TenuoConfigurationError(\"issuerKeyFromBytes() requires a 32-byte secret\");\n }\n return { kind: \"issuer-key\", secret: new Uint8Array(secret) };\n}\n\nfunction requireDepth(value: number, name: string): number {\n requireUint32(value, name);\n const maximum = protocolLimits().max_delegation_depth;\n if (value > maximum) {\n throw new TenuoConfigurationError(\n `${name} ${value} exceeds the protocol maximum of ${maximum}`,\n );\n }\n return value;\n}\n\nfunction requireTtl(value: number, name: string, minimum = 0): number {\n requireUint32(value, name, minimum);\n const maximum = protocolLimits().max_warrant_ttl_seconds;\n if (value > maximum) {\n throw new TenuoConfigurationError(\n `${name} ${value} exceeds the protocol maximum of ${maximum}`,\n );\n }\n return value;\n}\n\nfunction requirePublicKey(value: unknown, name: string): PublicKeyHandle {\n if (\n value === null ||\n typeof value !== \"object\" ||\n (value as { kind?: unknown }).kind !== \"public-key\" ||\n typeof (value as { hex?: unknown }).hex !== \"string\"\n ) {\n throw new TenuoConfigurationError(\n `${name} must be a public key handle (createTenuo.publicKeyFromHolderKey / publicKeyFromHex / publicKeyFromEnv)`,\n );\n }\n return value as PublicKeyHandle;\n}\n\nfunction clearanceJson(value: Clearance, name: string): number | string {\n if (typeof value === \"number\") {\n if (!Number.isInteger(value) || value < 0 || value > 255) {\n throw new TenuoConfigurationError(`${name} must be an integer 0-255 or a level name`);\n }\n return value;\n }\n if (typeof value === \"string\" && CLEARANCE_NAMES.has(value)) {\n return value;\n }\n throw new TenuoConfigurationError(\n `${name} must be one of ${[...CLEARANCE_NAMES].join(\", \")} or an integer 0-255`,\n );\n}\n\nfunction rootHexes(options: CreateTenuoOptions): string[] {\n const handles: PublicKeyHandle[] = [];\n if (options.root !== undefined && options.root.kind === \"public-key\") {\n handles.push(options.root);\n }\n for (const root of options.trustedRoots ?? []) {\n handles.push(root);\n }\n return handles.map((h) => h.hex);\n}\n\nfunction hasTrustAnchor(options: CreateTenuoOptions): boolean {\n if (options.root !== undefined) {\n return true;\n }\n return (options.trustedRoots?.length ?? 0) > 0;\n}\n\nfunction capabilityName(inner: object, policy: Pick<ToolPolicy, \"capability\">): string {\n if (policy.capability !== undefined && policy.capability.length > 0) {\n return policy.capability;\n }\n const named = inner as { name?: unknown; id?: unknown };\n if (typeof named.name === \"string\" && named.name.length > 0) {\n return named.name;\n }\n if (typeof named.id === \"string\" && named.id.length > 0) {\n return named.id;\n }\n throw new TenuoConfigurationError(\n \"tenuo.tool() needs a capability name (policy.capability, or tool.name / tool.id)\",\n );\n}\n\nclass TenuoClient implements Tenuo {\n private readonly context: WasmContext;\n private readonly canMint: boolean;\n readonly mcp: TenuoMcp;\n private readonly decide: Decide;\n\n constructor(options: CreateTenuoOptions) {\n if (options.root?.kind === \"dev-root\") {\n this.context = createDevContext(options.receiptSigner);\n this.canMint = true;\n } else if (options.root?.kind === \"issuer-key\") {\n if (!(options.root.secret instanceof Uint8Array) || options.root.secret.length !== 32) {\n throw new TenuoConfigurationError(\"root: issuer key must be a 32-byte secret\");\n }\n this.context = createIssuerContext(\n options.root.secret,\n rootHexes(options),\n options.receiptSigner,\n );\n this.canMint = true;\n } else {\n this.context = createVerifierContext(\n rootHexes(options),\n undefined,\n options.receiptSigner,\n );\n this.canMint = false;\n }\n if (options.revocationList !== undefined) {\n this.context.loadRevocationList(normalizeWireBytes(options.revocationList));\n }\n this.decide = (decision, tool, native, args) => {\n this.applyDecision(decision, tool, native, args);\n };\n this.mcp = createMcp(this.context, this.decide, this);\n }\n\n private applyDecision(\n decision: { outcome: string; code?: string; field?: string; message?: string; tool?: string; required?: number; received?: number },\n tool: string,\n native?: object,\n args?: Record<string, unknown>,\n ): void {\n if (decision.outcome === \"allow\") {\n return;\n }\n if (decision.outcome === \"approval_required\") {\n let request: ApprovalRequest | undefined;\n if (native !== undefined && args !== undefined) {\n try {\n request = approvalRequestFromWasm(this.context.approvalRequest(native, tool, args));\n } catch {\n request = undefined;\n }\n }\n throw new ApprovalRequiredError(\n decision.tool ?? tool,\n decision.required ?? 1,\n decision.received ?? 0,\n decision.message,\n request,\n );\n }\n throw new AuthorizationDeniedError(\n (decision.code as TenuoErrorCode | undefined) ?? \"TENUO_TOOL_NOT_AUTHORIZED\",\n explainDeny(decision.message ?? \"Authorization denied\", decision.field),\n decision.field,\n );\n }\n\n tool<T extends { execute: (args: never) => unknown }>(\n inner: T,\n policy: ToolPolicy<Parameters<T[\"execute\"]>[0]>,\n ): ProtectedTool<T> {\n if (toolPolicies.has(inner) || wrappedInners.has(inner)) {\n throw new TenuoConfigurationError(\"tenuo.tool() already wrapped this tool\");\n }\n const capability = capabilityName(inner, policy);\n const original = inner.execute as (\n args: Record<string, unknown>,\n options?: unknown,\n ) => unknown;\n const execute = async (args: never, callOptions?: unknown) => {\n const session = resolveSession(callOptions);\n const native = nativeSession(session);\n const decision = this.context.authorize(\n native,\n capability,\n args,\n approvalsFrom(callOptions),\n policy.allow,\n requestIdFrom(callOptions),\n );\n emitReceipt(callOptions, decision.receipt, session, this);\n if (decision.outcome === \"allow\") {\n return original(plainArgs(decision.args), forwardExecuteOptions(callOptions));\n }\n this.applyDecision(decision, capability, native, plainArgs(args));\n throw new TenuoConfigurationError(\"unreachable: decision was neither allow nor deny\");\n };\n\n const wrapped = Object.assign(Object.create(Object.getPrototypeOf(inner)), inner, {\n execute,\n }) as ProtectedTool<T>;\n wrappedInners.add(inner);\n toolPolicies.set(wrapped, { capability, allow: { ...policy.allow } as AllowPolicy });\n return wrapped;\n }\n\n session(input: SessionInput): Session {\n const allow = collectSessionAllow(input);\n const kind = input.kind ?? \"execution\";\n if (kind !== \"execution\" && kind !== \"issuer\") {\n throw new TenuoConfigurationError('session().kind must be \"execution\" or \"issuer\"');\n }\n if (Object.keys(allow).length === 0 && kind === \"execution\") {\n throw new TenuoConfigurationError(\n \"tenuo.session() requires tools from tenuo.tool() or at least one capability in allow\",\n );\n }\n if (!this.canMint) {\n throw new TenuoConfigurationError(\n \"session() mints a warrant and needs a local issuer. Use createTenuo({ root: createTenuo.devRoot() }) or an issuer key.\",\n );\n }\n const options: WasmMintOptions = { kind, allow };\n if (input.ttlSeconds !== undefined) {\n options.ttlSeconds = requireTtl(input.ttlSeconds, \"session().ttlSeconds\");\n }\n if (input.holder !== undefined) {\n options.holder = requirePublicKey(input.holder, \"session().holder\").hex;\n }\n if (input.maxDepth !== undefined) {\n options.maxDepth = requireDepth(input.maxDepth, \"session().maxDepth\");\n }\n if (input.clearance !== undefined) {\n options.clearance = clearanceJson(input.clearance, \"session().clearance\");\n }\n if (input.sessionId !== undefined) {\n options.sessionId = requireLabel(input.sessionId, \"session().sessionId\");\n }\n if (input.agentId !== undefined) {\n options.agentId = requireLabel(input.agentId, \"session().agentId\");\n }\n if (input.requireApproval !== undefined) {\n options.requireApproval = requireApprovalJson(input.requireApproval);\n }\n if (input.issuableTools !== undefined) {\n options.issuableTools = [...input.issuableTools];\n }\n if (input.constraintBounds !== undefined) {\n options.constraintBounds = input.constraintBounds;\n }\n if (input.maxIssueDepth !== undefined) {\n options.maxIssueDepth = requireDepth(input.maxIssueDepth, \"session().maxIssueDepth\");\n }\n try {\n return new Session(this.context.mintExtended(options));\n } catch (error) {\n throw new TenuoConfigurationError(errorMessage(error));\n }\n }\n\n issue(issuer: Session, input: IssueInput): Session {\n if (!isSession(issuer)) {\n throw new TenuoConfigurationError(\"issue() requires a Tenuo Session, not a plain object\");\n }\n if (input === null || typeof input !== \"object\" || input.allow === undefined || Object.keys(input.allow).length === 0) {\n throw new TenuoConfigurationError(\"issue() requires at least one capability in allow\");\n }\n const options: WasmIssueOptions = {\n allow: input.allow,\n holder: requirePublicKey(input.holder, \"issue().holder\").hex,\n };\n if (input.ttlSeconds !== undefined) {\n options.ttlSeconds = requireTtl(input.ttlSeconds, \"issue().ttlSeconds\", 1);\n }\n if (input.maxDepth !== undefined) {\n options.maxDepth = requireDepth(input.maxDepth, \"issue().maxDepth\");\n }\n if (input.clearance !== undefined) {\n options.clearance = clearanceJson(input.clearance, \"issue().clearance\");\n }\n if (input.sessionId !== undefined) {\n options.sessionId = requireLabel(input.sessionId, \"issue().sessionId\");\n }\n if (input.agentId !== undefined) {\n options.agentId = requireLabel(input.agentId, \"issue().agentId\");\n }\n if (input.requireApproval !== undefined) {\n options.requireApproval = requireApprovalJson(input.requireApproval);\n }\n try {\n return new Session(this.context.issue(nativeSession(issuer), options));\n } catch (error) {\n throw chainError(error);\n }\n }\n\n issuerPublicKey(): PublicKeyHandle {\n if (!this.canMint) {\n throw new TenuoConfigurationError(\n \"issuerPublicKey() needs a local issuer. This context verifies against trustedRoots and does not mint.\",\n );\n }\n return { kind: \"public-key\", source: \"bytes\", hex: this.context.issuerPublicKey() };\n }\n\n sessionFromWire(input: SessionFromWireInput): Session {\n if (!(input.holderKey instanceof Uint8Array) || input.holderKey.length !== 32) {\n throw new TenuoConfigurationError(\"sessionFromWire() requires a 32-byte holderKey\");\n }\n if (typeof input.warrant === \"string\" && input.warrant.trim().length === 0) {\n throw new TenuoConfigurationError(\"sessionFromWire() requires a warrant\");\n }\n try {\n if (typeof input.warrant === \"string\") {\n return new Session(importSessionFromWire(input.warrant, input.holderKey));\n }\n if (input.warrant.length === 0) {\n throw new TenuoConfigurationError(\"sessionFromWire() requires a warrant\");\n }\n return new Session(importSessionFromChain([...input.warrant], input.holderKey));\n } catch (error) {\n throw importWireError(error);\n }\n }\n\n withSession<R>(session: Session, fn: () => R): R {\n if (!isSession(session)) {\n throw new TenuoConfigurationError(\"withSession() requires a Tenuo Session, not a plain object\");\n }\n return currentSession.run(session, fn);\n }\n\n narrow(session: Session, allow: NarrowInput, options?: NarrowOptions): Session {\n if (Object.keys(allow).length === 0) {\n throw new TenuoConfigurationError(\"tenuo.narrow() requires a non-empty allow policy\");\n }\n if (!isSession(session)) {\n throw new TenuoConfigurationError(\"narrow() requires a Tenuo Session, not a plain object\");\n }\n const native = options === undefined ? undefined : narrowOptionsJson(options);\n try {\n const child = new Session(this.context.narrow(nativeSession(session), allow, native));\n inheritSessionCollector(session, child);\n return child;\n } catch (error) {\n throw chainError(error);\n }\n }\n\n explain(session: Session, tool: string, args: Readonly<Record<string, unknown>>): Explanation {\n if (!isSession(session)) {\n throw new TenuoConfigurationError(\"explain() requires a Tenuo Session, not a plain object\");\n }\n let raw: WasmExplain;\n try {\n raw = this.context.explain(nativeSession(session), tool, args);\n } catch (error) {\n throw new TenuoConfigurationError(errorMessage(error));\n }\n const out: { -readonly [K in keyof Explanation]: Explanation[K] } = {\n tool: raw.tool,\n kind: raw.kind,\n outcome: raw.outcome,\n toolGranted: raw.tool_granted,\n fields: raw.fields.map((f) => {\n const field: { -readonly [K in keyof Explanation[\"fields\"][number]]: Explanation[\"fields\"][number][K] } = {\n field: f.field,\n kind: f.kind,\n constraint: f.constraint,\n satisfied: f.satisfied,\n };\n if (f.value !== undefined) {\n field.value = f.value;\n }\n if (f.reason !== undefined) {\n field.reason = f.reason;\n }\n if (f.reason_code !== undefined) {\n field.reasonCode = f.reason_code;\n }\n return field;\n }),\n unknownFields: [...raw.unknown_fields],\n missingFields: [...raw.missing_fields],\n expired: raw.expired,\n expiresAt: raw.expires_at,\n chainValid: raw.chain_valid,\n };\n if (raw.code !== undefined) {\n out.code = raw.code;\n }\n if (raw.field !== undefined) {\n out.field = raw.field;\n }\n if (raw.message !== undefined) {\n out.message = raw.message;\n }\n if (raw.chain_error !== undefined) {\n out.chainError = raw.chain_error;\n }\n return out;\n }\n\n approvalRequest(session: Session, tool: string, args: Readonly<Record<string, unknown>>): ApprovalRequest {\n if (!isSession(session)) {\n throw new TenuoConfigurationError(\"approvalRequest() requires a Tenuo Session, not a plain object\");\n }\n try {\n return approvalRequestFromWasm(this.context.approvalRequest(nativeSession(session), tool, args));\n } catch (error) {\n throw new TenuoConfigurationError(errorMessage(error));\n }\n }\n\n attestApprovalRequest(\n session: Session,\n tool: string,\n args: Readonly<Record<string, unknown>>,\n ): ApprovalContextAttestation {\n if (!isSession(session)) {\n throw new TenuoConfigurationError(\"attestApprovalRequest() requires a Tenuo Session, not a plain object\");\n }\n let raw: WasmAttestation;\n try {\n raw = this.context.approvalContextAttestation(nativeSession(session), tool, args);\n } catch (error) {\n throw new TenuoConfigurationError(errorMessage(error));\n }\n return {\n version: raw.version,\n canonicalization: raw.canonicalization,\n warrantId: raw.warrant_id,\n tool: raw.tool,\n requestHash: raw.request_hash,\n holderKeyHex: raw.holder_key_hex,\n argsCanonicalCborB64: raw.args_canonical_cbor_b64,\n signerKeyHex: raw.signer_key_hex,\n signatureB64: raw.signature_b64,\n };\n }\n\n present(\n session: Session,\n tool: string,\n args: Readonly<Record<string, unknown>>,\n options?: McpAttachOptions,\n ): PresentedCall {\n if (!isSession(session)) {\n throw new TenuoConfigurationError(\"present() requires a Tenuo Session, not a plain object\");\n }\n return presentCall(this.context, this.decide, session, tool, args, options, \"present()\", this)\n .presented;\n }\n\n verify(\n presented: PresentedCall,\n tool: string,\n args: Readonly<Record<string, unknown>>,\n options?: McpVerifyOptions,\n ): Promise<Readonly<Record<string, unknown>>> {\n return verifyPresented(\n this.context,\n this.decide,\n presented,\n tool,\n args,\n options,\n \"verify()\",\n this,\n );\n }\n\n revocationList(input: RevocationListInput): string {\n if (!this.canMint) {\n throw new TenuoConfigurationError(\n \"revocationList() needs a local issuer key. Use createTenuo.signRevocationList() with an explicit secret, or an issuer-key root.\",\n );\n }\n const { ids, version } = revocationInput(input);\n try {\n return this.context.signRevocationListVersioned(ids, version);\n } catch (error) {\n throw new TenuoConfigurationError(errorMessage(error));\n }\n }\n\n revoke(list: string | Uint8Array): void {\n this.context.loadRevocationList(normalizeWireBytes(list));\n }\n\n ready(): void {\n loadWasm();\n }\n}\n\nfunction requireLabel(value: string, name: string): string {\n if (typeof value !== \"string\" || value.trim().length === 0) {\n throw new TenuoConfigurationError(`${name} must be a non-empty string`);\n }\n return value;\n}\n\nfunction errorMessage(error: unknown): string {\n return error instanceof Error ? error.message : String(error);\n}\n\n/** Map a prefixed core message from narrow()/issue() to the matching error class. */\nfunction chainError(error: unknown): TenuoError {\n if (error instanceof TenuoError) {\n return error;\n }\n const message = explainChainFailure(errorMessage(error));\n for (const code of [\"TENUO_CHAIN_INVALID\", \"TENUO_DEPTH_EXCEEDED\", \"TENUO_WARRANT_EXPIRED\"] as const) {\n if (message.startsWith(code)) {\n return new AuthorizationDeniedError(code, message);\n }\n }\n return new TenuoConfigurationError(message);\n}\n\nfunction explainChainFailure(message: string): string {\n const tool = /tool '([^']+)' not in parent's tools/.exec(message)?.[1];\n if (tool !== undefined) {\n return `${message}. narrow() cannot add '${tool}': remove it or delegate from a parent that grants it.`;\n }\n if (\n message.includes(\"parent's allowed set\") ||\n message.includes(\"range expanded\") ||\n message.includes(\"would expand permissions\") ||\n message.includes(\"clearance cannot increase\")\n ) {\n return `${message}. narrow() only accepts a child policy that is equal to or stricter than its parent.`;\n }\n return message;\n}\n\nfunction revocationInput(input: RevocationListInput): { ids: string[]; version: number | undefined } {\n if (input === null || typeof input !== \"object\" || !Array.isArray(input.revoke)) {\n throw new TenuoConfigurationError(\"revocation list input must be { revoke: string[], version? }\");\n }\n const ids = input.revoke.filter((id): id is string => typeof id === \"string\" && id.length > 0);\n if (ids.length === 0 || ids.length !== input.revoke.length) {\n throw new TenuoConfigurationError(\"revoke must be a non-empty array of warrant ids\");\n }\n if (input.version !== undefined && (!Number.isInteger(input.version) || input.version < 1)) {\n throw new TenuoConfigurationError(\"revocation list version must be a positive integer\");\n }\n return { ids, version: input.version };\n}\n\nfunction plainArgs(value: unknown): Record<string, unknown> {\n if (value instanceof Map) {\n return Object.fromEntries(value);\n }\n if (value !== null && typeof value === \"object\" && !Array.isArray(value)) {\n return { ...(value as Record<string, unknown>) };\n }\n return {};\n}\n\nfunction requireApprovalJson(require: RequireApproval): WasmRequireApproval {\n if (require === null || typeof require !== \"object\") {\n throw new TenuoConfigurationError(\"requireApproval must be an object\");\n }\n if (!Array.isArray(require.approvers) || require.approvers.length === 0) {\n throw new TenuoConfigurationError(\"requireApproval.approvers must not be empty\");\n }\n if (!Number.isInteger(require.min) || require.min < 1) {\n throw new TenuoConfigurationError(\"requireApproval.min must be at least 1\");\n }\n const payload: WasmRequireApproval = {\n approvers: require.approvers.map((approver, i) => requirePublicKey(approver, `requireApproval.approvers[${i}]`).hex),\n min: require.min,\n };\n if (require.tools !== undefined) {\n payload.tools = [...require.tools];\n }\n if (require.gates !== undefined) {\n const gates: NonNullable<WasmRequireApproval[\"gates\"]> = {};\n for (const [tool, gate] of Object.entries(require.gates)) {\n const out: { message?: string; args?: Record<string, unknown> } = {};\n if (gate.message !== undefined) {\n out.message = gate.message;\n }\n if (gate.args !== undefined) {\n out.args = { ...gate.args };\n }\n gates[tool] = out;\n }\n payload.gates = gates;\n }\n return payload;\n}\n\nfunction narrowOptionsJson(options: NarrowOptions): WasmNarrowOptions {\n if (options === null || typeof options !== \"object\") {\n throw new TenuoConfigurationError(\"narrow() options must be an object\");\n }\n const known = [\"holder\", \"ttlSeconds\", \"terminal\", \"maxDepth\", \"clearance\", \"agentId\", \"addApprovers\", \"minApprovals\"];\n for (const key of Object.keys(options)) {\n if (!known.includes(key)) {\n throw new TenuoConfigurationError(\n `narrow() options: unknown key '${key}' (expected ${known.join(\", \")})`,\n );\n }\n }\n const out: WasmNarrowOptions = {};\n if (options.holder !== undefined) {\n out.holder = requirePublicKey(options.holder, \"narrow().holder\").hex;\n }\n if (options.ttlSeconds !== undefined) {\n out.ttlSeconds = requireTtl(options.ttlSeconds, \"narrow().ttlSeconds\", 1);\n }\n if (options.terminal !== undefined) {\n if (typeof options.terminal !== \"boolean\") {\n throw new TenuoConfigurationError(\"narrow().terminal must be a boolean\");\n }\n out.terminal = options.terminal;\n }\n if (options.maxDepth !== undefined) {\n out.maxDepth = requireDepth(options.maxDepth, \"narrow().maxDepth\");\n }\n if (out.terminal === true && out.maxDepth !== undefined) {\n throw new TenuoConfigurationError(\"narrow() options: pass terminal or maxDepth, not both\");\n }\n if (options.clearance !== undefined) {\n out.clearance = clearanceJson(options.clearance, \"narrow().clearance\");\n }\n if (options.agentId !== undefined) {\n out.agentId = requireLabel(options.agentId, \"narrow().agentId\");\n }\n if (options.addApprovers !== undefined) {\n out.addApprovers = options.addApprovers.map((a, i) => requirePublicKey(a, `narrow().addApprovers[${i}]`).hex);\n }\n if (options.minApprovals !== undefined) {\n if (!Number.isInteger(options.minApprovals) || options.minApprovals < 1) {\n throw new TenuoConfigurationError(\"narrow().minApprovals must be at least 1\");\n }\n out.minApprovals = options.minApprovals;\n }\n return out;\n}\n\nfunction approvalRequestFromWasm(raw: WasmApprovalRequest): ApprovalRequest {\n return {\n requestId: raw.request_id,\n warrantId: raw.warrant_id,\n tool: raw.tool,\n args: { ...raw.args },\n requestHash: raw.request_hash,\n holderPublicKey: raw.holder_public_key,\n requiredApprovers: [...raw.required_approvers],\n minApprovals: raw.min_approvals,\n warrantExpiresAt: raw.warrant_expires_at,\n createdAt: raw.created_at,\n message: raw.message,\n };\n}\n\nfunction explainDeny(message: string, field?: string): string {\n if (message.includes(\"unknown field not allowed\")) {\n const named = field !== undefined && field.length > 0 ? `'${field}'` : \"this argument\";\n return `${message}. Zero-trust: name ${named} in allow with the tightest constraint that admits the real values (wildcard() only when the value does not change what the tool does), or remove ${named} from the call if the tool does not act on it; constrained policies reject omitted fields.`;\n }\n if (message.includes(\"value does not match constraint\")) {\n return `${message}. Use tenuo.explain(session, tool, args) locally for field-level diagnostics.`;\n }\n return message;\n}\n\nfunction forwardExecuteOptions(callOptions: unknown): unknown {\n if (callOptions === null || typeof callOptions !== \"object\") {\n return callOptions;\n }\n const rest: Record<string, unknown> = {};\n for (const [key, value] of Object.entries(callOptions as Record<string, unknown>)) {\n if (\n key === \"session\" ||\n key === \"approvals\" ||\n key === \"onReceipt\" ||\n key === \"requestId\"\n ) {\n continue;\n }\n rest[key] = value;\n }\n return Object.keys(rest).length === 0 ? undefined : rest;\n}\n\nfunction importWireError(error: unknown): TenuoError {\n const message = errorMessage(error);\n if (message.startsWith(\"TENUO_CHAIN_INVALID\") || message.includes(\"invalid warrant\")) {\n return new TenuoError(\"TENUO_CHAIN_INVALID\", message);\n }\n if (message.startsWith(\"TENUO_SIGNATURE_INVALID\")) {\n return new TenuoError(\"TENUO_SIGNATURE_INVALID\", message);\n }\n if (message.startsWith(\"TENUO_UNTRUSTED_ROOT\")) {\n return new TenuoError(\"TENUO_UNTRUSTED_ROOT\", message);\n }\n if (message.startsWith(\"TENUO_INVALID_POP\")) {\n // The warrant is fine; the key is not the one it was issued to.\n const separator = /[.!?]$/.test(message.trim()) ? \"\" : \".\";\n return new AuthorizationDeniedError(\n \"TENUO_INVALID_POP\",\n `${message}${separator} If this followed narrow(), set { holder: receiverPublicKey } for the agent that imports the child.`,\n );\n }\n return new TenuoConfigurationError(message);\n}\n\nfunction normalizeWireBytes(value: string | Uint8Array): string {\n if (typeof value === \"string\") {\n return value;\n }\n return bytesToHex(value);\n}\n\nfunction emitReceipt(\n callOptions: unknown,\n receipt: string | undefined,\n session: Session,\n host: object,\n): void {\n collectReceipt(receipt, session, host);\n if (receipt === undefined || callOptions === null || typeof callOptions !== \"object\") {\n return;\n }\n if (!(\"onReceipt\" in callOptions)) {\n return;\n }\n const onReceipt = (callOptions as { onReceipt?: unknown }).onReceipt;\n if (typeof onReceipt !== \"function\") {\n return;\n }\n emitIsolatedReceipt(onReceipt as (receipt: string) => void | Promise<void>, receipt);\n}\n\nfunction requestIdFrom(callOptions: unknown): string | undefined {\n if (callOptions !== null && typeof callOptions === \"object\" && \"requestId\" in callOptions) {\n const value = (callOptions as { requestId?: unknown }).requestId;\n if (typeof value === \"string\" && value.length > 0) {\n return value;\n }\n }\n return undefined;\n}\n\nfunction approvalsFrom(callOptions: unknown): unknown {\n if (callOptions !== null && typeof callOptions === \"object\" && \"approvals\" in callOptions) {\n return (callOptions as { approvals?: unknown }).approvals;\n }\n return undefined;\n}\n\nfunction resolveSession(callOptions: unknown): Session {\n if (callOptions !== null && typeof callOptions === \"object\" && \"session\" in callOptions) {\n const explicit = (callOptions as { session: unknown }).session;\n if (!isSession(explicit)) {\n throw new TenuoConfigurationError(\"options.session must be a Tenuo Session\");\n }\n return explicit;\n }\n const ambient = currentSession.getStore();\n if (ambient === undefined) {\n throw new TenuoConfigurationError(\n \"No session. Wrap the call in tenuo.withSession(session, ...) or pass { session }.\",\n );\n }\n return ambient;\n}\n\nfunction collectSessionAllow(input: SessionInput): { [capability: string]: AllowPolicy } {\n const allow: { [capability: string]: AllowPolicy } = { ...(input.allow ?? {}) };\n for (const tool of input.tools ?? []) {\n if (tool === null || typeof tool !== \"object\") {\n throw new TenuoConfigurationError(\"session({ tools }) requires tools from tenuo.tool()\");\n }\n const policy = toolPolicies.get(tool);\n if (policy === undefined) {\n throw new TenuoConfigurationError(\"session({ tools }) requires tools from tenuo.tool()\");\n }\n const existing = allow[policy.capability];\n if (existing !== undefined && !sameAllow(existing, policy.allow)) {\n throw new TenuoConfigurationError(\n `session() allow and tools disagree on ${policy.capability}`,\n );\n }\n allow[policy.capability] = policy.allow;\n }\n return allow;\n}\n\nfunction sameAllow(left: AllowPolicy, right: AllowPolicy): boolean {\n return JSON.stringify(sortedAllow(left)) === JSON.stringify(sortedAllow(right));\n}\n\nfunction sortedAllow(allow: AllowPolicy): AllowPolicy {\n const keys = Object.keys(allow).sort();\n const out: { [field: string]: AllowPolicy[string] } = {};\n for (const key of keys) {\n const value = allow[key];\n if (value !== undefined) {\n out[key] = value;\n }\n }\n return out;\n}\n\n// ---------------------------------------------------------------------------\n// Static helpers: approvals, revocation, receipts, control-plane wire shapes\n// ---------------------------------------------------------------------------\n\nfunction requestHashOf(request: ApprovalRequest | string): string {\n const hash = typeof request === \"string\" ? request : request.requestHash;\n const hex = hash.trim().toLowerCase();\n if (!/^[0-9a-f]{64}$/.test(hex)) {\n throw new TenuoConfigurationError(\"signApproval() needs an ApprovalRequest or a 64-hex request hash\");\n }\n return hex;\n}\n\n/** Sign an approval as an approver. The approver never needs the warrant or the holder key. */\nexport function signApproval(\n request: ApprovalRequest | string,\n approverSecret: Uint8Array,\n options: SignApprovalOptions,\n): string {\n if (!(approverSecret instanceof Uint8Array) || approverSecret.length !== 32) {\n throw new TenuoConfigurationError(\"signApproval() requires a 32-byte approver secret\");\n }\n if (options === null || typeof options !== \"object\" || typeof options.externalId !== \"string\" || options.externalId.trim().length === 0) {\n throw new TenuoConfigurationError(\"signApproval() requires options.externalId: who approved\");\n }\n if (options.ttlSeconds !== undefined && (!Number.isInteger(options.ttlSeconds) || options.ttlSeconds < 1)) {\n throw new TenuoConfigurationError(\"signApproval().ttlSeconds must be a positive integer\");\n }\n const warrantExpiresAt =\n options.warrantExpiresAt ?? (typeof request === \"object\" ? request.warrantExpiresAt : undefined);\n try {\n return loadWasm().sdkSignApprovalForRequest(\n requestHashOf(request),\n approverSecret,\n options.externalId,\n options.ttlSeconds,\n warrantExpiresAt,\n );\n } catch (error) {\n throw new TenuoConfigurationError(errorMessage(error));\n }\n}\n\n/** Decode an approval envelope. Not authorization: the call path still decides. */\nexport function inspectApproval(envelope: string | Uint8Array): ApprovalInfo {\n const text = typeof envelope === \"string\" ? envelope : Buffer.from(envelope).toString(\"base64\");\n let raw;\n try {\n raw = loadWasm().sdkInspectApproval(text);\n } catch (error) {\n throw new TenuoConfigurationError(errorMessage(error));\n }\n const out: { -readonly [K in keyof ApprovalInfo]: ApprovalInfo[K] } = {\n approverPublicKey: raw.approver_public_key,\n requestHash: raw.request_hash,\n externalId: raw.external_id,\n approvedAt: raw.approved_at,\n expiresAt: raw.expires_at,\n expired: raw.expired,\n signatureValid: raw.signature_valid,\n };\n if (raw.error !== undefined) {\n out.error = raw.error;\n }\n return out;\n}\n\n/** Sign a revocation list with an explicit issuer secret. */\nexport function signRevocationList(input: RevocationListInput, issuerSecret: Uint8Array): string {\n if (!(issuerSecret instanceof Uint8Array) || issuerSecret.length !== 32) {\n throw new TenuoConfigurationError(\"signRevocationList() requires a 32-byte issuer secret\");\n }\n const { ids, version } = revocationInput(input);\n try {\n return loadWasm().sdkSignRevocationListVersioned(ids, version, issuerSecret);\n } catch (error) {\n throw new TenuoConfigurationError(errorMessage(error));\n }\n}\n\nexport function inspectRevocationList(wire: string | Uint8Array): RevocationListInfo {\n let raw;\n try {\n raw = loadWasm().sdkInspectRevocationList(normalizeWireBytes(wire));\n } catch (error) {\n throw new TenuoConfigurationError(errorMessage(error));\n }\n return {\n version: raw.version,\n issuedAt: raw.issued_at,\n issuerPublicKey: raw.issuer_public_key,\n revokedIds: [...raw.revoked_ids],\n signatureValid: raw.signature_valid,\n };\n}\n\n/** Signature authenticity of a receipt. Not authorization. */\nexport function verifyReceipt(wire: string | Uint8Array): ReceiptInfo {\n let raw;\n try {\n raw = loadWasm().sdkVerifyReceipt(normalizeWireBytes(wire));\n } catch (error) {\n throw new TenuoConfigurationError(errorMessage(error));\n }\n const out: { -readonly [K in keyof ReceiptInfo]: ReceiptInfo[K] } = {\n authentic: true,\n signerKey: raw.signer_key,\n outcome: raw.outcome,\n action: raw.action,\n requestId: raw.request_id,\n };\n if (raw.decision_code !== undefined) out.decisionCode = raw.decision_code;\n if (raw.srl_version !== undefined) out.srlVersion = raw.srl_version;\n if (raw.srl_hash !== undefined) out.srlHash = raw.srl_hash;\n if (raw.request_hash !== undefined) out.requestHash = raw.request_hash;\n if (raw.policy_definition_hash !== undefined) out.policyDefinitionHash = raw.policy_definition_hash;\n if (raw.prev_receipt_hash !== undefined) out.prevReceiptHash = raw.prev_receipt_hash;\n if (raw.trusted_roots_hash !== undefined) out.trustedRootsHash = raw.trusted_roots_hash;\n return out;\n}\n\n/**\n * Root-anchored receipt check: the embedded warrant chain against `roots`\n * at the receipt's own decision instant. Needs no trust in the signer.\n */\nexport function verifyReceiptChain(wire: string | Uint8Array, roots: readonly PublicKeyHandle[]): ReceiptChainInfo {\n if (!Array.isArray(roots) || roots.length === 0) {\n throw new TenuoConfigurationError(\"verifyReceiptChain() requires at least one trusted root\");\n }\n let raw;\n try {\n raw = loadWasm().sdkVerifyReceiptChain(\n normalizeWireBytes(wire),\n roots.map((r, i) => requirePublicKey(r, `roots[${i}]`).hex),\n );\n } catch (error) {\n throw new TenuoConfigurationError(errorMessage(error));\n }\n const out: { -readonly [K in keyof ReceiptChainInfo]: ReceiptChainInfo[K] } = {\n signerKey: raw.signer_key,\n outcome: raw.outcome,\n timestamp: raw.timestamp,\n chainValid: raw.chain_valid,\n };\n if (raw.decision_code !== undefined) out.decisionCode = raw.decision_code;\n if (raw.chain_error !== undefined) out.chainError = raw.chain_error;\n if (raw.corroborates_denial !== undefined) out.corroboratesDenial = raw.corroborates_denial;\n if (raw.root_issuer !== undefined) out.rootIssuer = raw.root_issuer;\n if (raw.leaf_holder !== undefined) out.leafHolder = raw.leaf_holder;\n return out;\n}\n\n/**\n * The v1 JSON body a control plane's approval API accepts. Same shape the\n * Python SDK produces, so one approval service serves both.\n */\nexport function controlPlaneApprovalRequestV1(\n request: ApprovalRequest,\n options?: {\n readonly attestation?: ApprovalContextAttestation;\n readonly temporal?: Readonly<Record<string, string>>;\n },\n): ControlPlaneApprovalRequestV1 {\n if (request === null || typeof request !== \"object\" || typeof request.requestHash !== \"string\") {\n throw new TenuoConfigurationError(\"controlPlaneApprovalRequestV1() needs an ApprovalRequest from tenuo.approvalRequest()\");\n }\n const body: { -readonly [K in keyof ControlPlaneApprovalRequestV1]: ControlPlaneApprovalRequestV1[K] } = {\n schema_version: 1,\n request_id_hex: request.requestId,\n warrant_id: request.warrantId,\n tool: request.tool,\n arguments: { ...request.args },\n request_hash_hex: request.requestHash,\n holder_public_key_hex: request.holderPublicKey,\n required_approver_keys_hex: [...request.requiredApprovers],\n min_approvals: Math.max(1, request.minApprovals),\n warrant_expires_at_unix: request.warrantExpiresAt,\n created_at_unix: request.createdAt,\n };\n if (options?.attestation !== undefined) {\n const a = options.attestation;\n body.attestation = {\n version: a.version,\n canonicalization: a.canonicalization,\n warrant_id: a.warrantId,\n tool: a.tool,\n request_hash: a.requestHash,\n holder_key_hex: a.holderKeyHex,\n args_canonical_cbor_b64: a.argsCanonicalCborB64,\n signer_key_hex: a.signerKeyHex,\n signature_b64: a.signatureB64,\n // Python readers look for these two names.\n signer_key: a.signerKeyHex,\n signature: a.signatureB64,\n };\n }\n if (options?.temporal !== undefined && Object.keys(options.temporal).length > 0) {\n body.temporal = { ...options.temporal };\n }\n if (request.message.length > 0) {\n body.message = request.message;\n }\n return body;\n}\n\n/** Approval envelopes from a v1 response, ready for `{ approvals }` on the call. Empty unless status is a success. */\nexport function signedApprovalsFromResponseV1(response: ControlPlaneApprovalResponseV1): string[] {\n if (response === null || typeof response !== \"object\" || typeof response.status !== \"string\") {\n throw new TenuoConfigurationError(\"approval response must be an object with a status\");\n }\n if (response.status !== \"approved\") {\n return [];\n }\n const list = response.signed_approvals_b64;\n if (list === undefined || list === null) {\n return [];\n }\n if (!Array.isArray(list) || list.some((item) => typeof item !== \"string\" || item.length === 0)) {\n throw new TenuoConfigurationError(\"signed_approvals_b64 must be an array of base64 strings\");\n }\n return [...list];\n}\n\nfunction createTenuoImpl(options: CreateTenuoOptions = {}): Tenuo {\n if (!hasTrustAnchor(options)) {\n throw new TenuoConfigurationError(\n \"createTenuo() requires trustedRoots or root: createTenuo.devRoot(). An empty trust set is not a configuration.\",\n );\n }\n if (options.root?.kind === \"dev-root\" && !devRootAllowed(options.root)) {\n throw new TenuoConfigurationError(devRootBlockedMessage());\n }\n loadWasm();\n return new TenuoClient(options);\n}\n\nexport const createTenuo: ((options?: CreateTenuoOptions) => Tenuo) & {\n devRoot: typeof devRoot;\n publicKeyFromEnv: typeof publicKeyFromEnv;\n publicKeyFromHex: typeof publicKeyFromHex;\n publicKeyFromBytes: typeof publicKeyFromBytes;\n holderKeyFromEnv: typeof holderKeyFromEnv;\n holderKeyFromHex: typeof holderKeyFromHex;\n generateHolderKey: typeof generateHolderKey;\n generateIssuerKey: typeof generateIssuerKey;\n publicKeyFromHolderKey: typeof publicKeyFromHolderKey;\n issuerKeyFromEnv: typeof issuerKeyFromEnv;\n issuerKeyFromHex: typeof issuerKeyFromHex;\n issuerKeyFromBytes: typeof issuerKeyFromBytes;\n signApproval: typeof signApproval;\n inspectApproval: typeof inspectApproval;\n signRevocationList: typeof signRevocationList;\n inspectRevocationList: typeof inspectRevocationList;\n verifyReceipt: typeof verifyReceipt;\n verifyReceiptChain: typeof verifyReceiptChain;\n controlPlaneApprovalRequestV1: typeof controlPlaneApprovalRequestV1;\n signedApprovalsFromResponseV1: typeof signedApprovalsFromResponseV1;\n parseConnectToken: typeof parseConnectToken;\n identity: typeof identityFromKey;\n generateIdentity: typeof generateIdentity;\n runtime: (options: Parameters<typeof createRuntime>[1]) => ReturnType<typeof createRuntime>;\n} = Object.assign(createTenuoImpl, {\n devRoot,\n publicKeyFromEnv,\n publicKeyFromHex,\n publicKeyFromBytes,\n holderKeyFromEnv,\n holderKeyFromHex,\n generateHolderKey,\n generateIssuerKey,\n publicKeyFromHolderKey,\n issuerKeyFromEnv,\n issuerKeyFromHex,\n issuerKeyFromBytes,\n signApproval,\n inspectApproval,\n signRevocationList,\n inspectRevocationList,\n verifyReceipt,\n verifyReceiptChain,\n controlPlaneApprovalRequestV1,\n signedApprovalsFromResponseV1,\n parseConnectToken,\n identity: identityFromKey,\n generateIdentity,\n runtime: (options: Parameters<typeof createRuntime>[1]) => createRuntime(createTenuoImpl, options),\n});\n"]}
package/dist/constraints.d.ts CHANGED
@@ -27,7 +27,32 @@ export declare function range(options: {
27
27
  export declare function oneOf(values: readonly string[]): OneOfConstraint;
28
28
  /** Any value except these. */
29
29
  export declare function notOneOf(values: readonly string[]): NotOneOfConstraint;
30
+ /**
31
+ * Generic string glob. `*` matches `/`; this is not path containment.
32
+ * For filesystem arguments, use `pathGlob(root, glob)`.
33
+ */
30
34
  export declare function pattern(pattern: string): PatternConstraint;
35
+ /**
36
+ * A traversal-safe filesystem glob: the value must stay under `root` and
37
+ * match `glob`.
38
+ *
39
+ * The glob is tested against the whole path, not against the part below
40
+ * `root`, so it matches at any depth:
41
+ *
42
+ * ```ts
43
+ * pathGlob("/workspace", "*.json");
44
+ * // /workspace/reports/q3.json allowed
45
+ * // /workspace/secrets.env denied (glob)
46
+ * // /etc/passwd.json denied (root)
47
+ * ```
48
+ *
49
+ * A delegatee can narrow this to a tighter `pathGlob`, or to an `exact()`
50
+ * path the parent already admits.
51
+ */
52
+ export declare function pathGlob(root: string, glob: string, options?: {
53
+ readonly caseSensitive?: boolean;
54
+ readonly allowEqual?: boolean;
55
+ }): AllConstraint;
31
56
  /** Regular expression, compiled and evaluated in core. */
32
57
  export declare function regex(source: string): RegexConstraint;
33
58
  export declare function exact(value: string | number | boolean): ExactConstraint;
package/dist/constraints.js CHANGED
@@ -1,4 +1,21 @@
1
1
  import { TenuoConfigurationError } from "./errors.js";
2
+ /**
3
+ * Builders throw on a misspelled option instead of dropping it: an option
4
+ * that vanishes silently (`urlSafe({ domains })`) widens authority. The core
5
+ * applies the same rule to raw constraint objects when the policy compiles.
6
+ */
7
+ function rejectUnknownOptions(builder, options, allowed) {
8
+ if (options === undefined || options === null) {
9
+ return;
10
+ }
11
+ if (typeof options !== "object" || Array.isArray(options)) {
12
+ throw new TenuoConfigurationError(`tenuo.${builder}() expects an options object`);
13
+ }
14
+ const unknown = Object.keys(options).find((key) => !allowed.includes(key));
15
+ if (unknown !== undefined) {
16
+ throw new TenuoConfigurationError(`tenuo.${builder}() received unknown option "${unknown}"; allowed options: ${allowed.join(", ")}`);
17
+ }
18
+ }
2
19
  /**
3
20
  * Constraint builders. These produce plain marker objects; every one is
4
21
  * evaluated by the Rust core, never in TypeScript. The set matches the
@@ -9,6 +26,7 @@ import { TenuoConfigurationError } from "./errors.js";
9
26
  */
10
27
  /** Directory prefix. Evaluated in core as Subpath — not a string prefix check in TS. */
11
28
  export function under(root, options) {
29
+ rejectUnknownOptions("under", options, ["caseSensitive", "allowEqual"]);
12
30
  if (!root.startsWith("/")) {
13
31
  throw new TenuoConfigurationError("tenuo.under() expects an absolute path (start with /)");
14
32
  }
@@ -25,6 +43,7 @@ export function under(root, options) {
25
43
  return out;
26
44
  }
27
45
  export function email(options) {
46
+ rejectUnknownOptions("email", options, ["domain"]);
28
47
  return { kind: "email", domain: options.domain };
29
48
  }
30
49
  export function max(value) {
@@ -41,6 +60,7 @@ export function min(value) {
41
60
  }
42
61
  /** Numeric interval. Bounds are inclusive unless `minExclusive` / `maxExclusive`. */
43
62
  export function range(options) {
63
+ rejectUnknownOptions("range", options, ["min", "max", "minExclusive", "maxExclusive"]);
44
64
  if (options.min === undefined && options.max === undefined) {
45
65
  throw new TenuoConfigurationError("tenuo.range() requires min, max, or both");
46
66
  }
@@ -80,12 +100,36 @@ export function notOneOf(values) {
80
100
  }
81
101
  return { kind: "notOneOf", values };
82
102
  }
103
+ /**
104
+ * Generic string glob. `*` matches `/`; this is not path containment.
105
+ * For filesystem arguments, use `pathGlob(root, glob)`.
106
+ */
83
107
  export function pattern(pattern) {
84
108
  if (pattern.length === 0) {
85
109
  throw new TenuoConfigurationError("tenuo.pattern() requires a non-empty pattern");
86
110
  }
87
111
  return { kind: "pattern", pattern };
88
112
  }
113
+ /**
114
+ * A traversal-safe filesystem glob: the value must stay under `root` and
115
+ * match `glob`.
116
+ *
117
+ * The glob is tested against the whole path, not against the part below
118
+ * `root`, so it matches at any depth:
119
+ *
120
+ * ```ts
121
+ * pathGlob("/workspace", "*.json");
122
+ * // /workspace/reports/q3.json allowed
123
+ * // /workspace/secrets.env denied (glob)
124
+ * // /etc/passwd.json denied (root)
125
+ * ```
126
+ *
127
+ * A delegatee can narrow this to a tighter `pathGlob`, or to an `exact()`
128
+ * path the parent already admits.
129
+ */
130
+ export function pathGlob(root, glob, options) {
131
+ return all([under(root, options), pattern(glob)]);
132
+ }
89
133
  /** Regular expression, compiled and evaluated in core. */
90
134
  export function regex(source) {
91
135
  if (source.length === 0) {
@@ -119,6 +163,7 @@ export function urlPattern(pattern) {
119
163
  * hosts rejected, optional allow and deny domain lists (`*.example.com`).
120
164
  */
121
165
  export function urlSafe(options) {
166
+ rejectUnknownOptions("urlSafe", options, ["schemes", "allowDomains", "denyDomains"]);
122
167
  const out = { kind: "urlSafe" };
123
168
  if (options?.schemes !== undefined) {
124
169
  out.schemes = options.schemes;