@tinycloud/operations 0.4.0-beta.9 → 0.4.0

package/dist/cli-runtime.js.map

@@ -1 +1 @@
-{"version":3,"sources":["../src/errors.ts","../../../node_modules/ms/index.js","../../sdk-core/src/manifest.ts","../../sdk-core/src/capabilities.ts","../src/authority.ts","../src/state.ts","../src/artifacts.ts","../src/secrets.ts","../src/operations/auth.ts","../src/operations/exploration.ts","../src/operations/secrets-get.ts","../src/operations/sql.ts","../src/delegation-binding.ts","../src/operations/status.ts","../src/registry.ts","../src/profile.ts","../src/runtime.ts","../src/invoke.ts","../../sdk-core/src/policy/errors.ts","../../sdk-core/src/policy/jcs.ts","../src/safe-values.ts","../src/redaction.ts","../src/cli-runtime.ts"],"sourcesContent":["export const OPERATION_ERROR_CODES = [\n  \"INPUT_INVALID\",\n  \"OPERATION_NOT_FOUND\",\n  \"OPERATION_VERSION_UNSUPPORTED\",\n  \"PROFILE_NOT_FOUND\",\n  \"PROFILE_POSTURE_NOT_ALLOWED\",\n  \"PROFILE_OWNER_OPT_IN_REQUIRED\",\n  \"AUTH_REQUIRED\",\n  \"PERMISSION_DENIED\",\n  \"SESSION_NOT_FOUND\",\n  \"PERMISSION_HINT_INVALID\",\n  \"DELEGATION_ARTIFACT_INVALID\",\n  \"DELEGATION_EXPIRED\",\n  \"DELEGATION_AUDIENCE_MISMATCH\",\n  \"DELEGATION_HOST_MISMATCH\",\n  \"DELEGATION_REJECTED\",\n  \"ENCRYPTION_NETWORK_UNRESOLVED\",\n  \"NODE_UNREACHABLE\",\n  \"NODE_ERROR\",\n  \"KV_NOT_FOUND\",\n  \"KV_PRECONDITION_FAILED\",\n  \"KV_CONFLICT\",\n  \"KV_RESPONSE_TOO_LARGE\",\n  \"SQL_QUERY_INVALID\",\n  \"SQL_EXECUTION_FAILED\",\n  \"SQL_RESULT_LIMIT_EXCEEDED\",\n  \"SQL_VALUE_UNSAFE\",\n  \"SECRET_READ_FAILED\",\n  \"SECRET_DECRYPT_FAILED\",\n  \"OUTPUT_INVALID\",\n  \"INTERNAL_ERROR\",\n] as const;\n\nexport type OperationErrorCode = (typeof OPERATION_ERROR_CODES)[number];\n\nexport interface OperationError {\n  readonly code: OperationErrorCode;\n  readonly message: string;\n  readonly retryable: boolean;\n  readonly details?: Readonly<Record<string, unknown>>;\n}\n\nexport function operationError(\n  code: OperationErrorCode,\n  message: string,\n  options: Readonly<{\n    retryable?: boolean;\n    details?: Readonly<Record<string, unknown>>;\n  }> = {},\n): OperationError {\n  return {\n    code,\n    message,\n    retryable: options.retryable ?? false,\n    ...(options.details === undefined ? {} : { details: options.details }),\n  };\n}\n\n/**\n * Internal operations and profile resolution use this for expected failures.\n * Generic exceptions are never exposed at the projection boundary.\n */\nexport class OperationInvocationError extends Error {\n  public readonly operationError: OperationError;\n\n  constructor(operationError: OperationError) {\n    super(operationError.message);\n    this.name = \"OperationInvocationError\";\n    this.operationError = operationError;\n  }\n}\n\nexport function isOperationErrorCode(value: unknown): value is OperationErrorCode {\n  return typeof value === \"string\" && OPERATION_ERROR_CODES.includes(value as OperationErrorCode);\n}\n\nexport function internalOperationError(): OperationError {\n  return operationError(\n    \"INTERNAL_ERROR\",\n    \"The operation could not be completed.\",\n  );\n}\n\nexport function sanitizeThrownOperationError(error: unknown): OperationError {\n  if (error instanceof OperationInvocationError) {\n    return sanitizeOperationError(error.operationError);\n  }\n\n  return internalOperationError();\n}\n\nexport function sanitizeOperationError(error: unknown): OperationError {\n  if (\n    typeof error !== \"object\" ||\n    error === null ||\n    !isOperationErrorCode((error as { code?: unknown }).code) ||\n    typeof (error as { message?: unknown }).message !== \"string\" ||\n    typeof (error as { retryable?: unknown }).retryable !== \"boolean\"\n  ) {\n    return internalOperationError();\n  }\n\n  const candidate = error as OperationError;\n  return operationError(candidate.code, candidate.message, {\n    retryable: candidate.retryable,\n    ...(candidate.details === undefined ? {} : { details: candidate.details }),\n  });\n}\n","/**\n * Helpers.\n */\n\nvar s = 1000;\nvar m = s * 60;\nvar h = m * 60;\nvar d = h * 24;\nvar w = d * 7;\nvar y = d * 365.25;\n\n/**\n * Parse or format the given `val`.\n *\n * Options:\n *\n *  - `long` verbose formatting [false]\n *\n * @param {String|Number} val\n * @param {Object} [options]\n * @throws {Error} throw an error if val is not a non-empty string or a number\n * @return {String|Number}\n * @api public\n */\n\nmodule.exports = function (val, options) {\n  options = options || {};\n  var type = typeof val;\n  if (type === 'string' && val.length > 0) {\n    return parse(val);\n  } else if (type === 'number' && isFinite(val)) {\n    return options.long ? fmtLong(val) : fmtShort(val);\n  }\n  throw new Error(\n    'val is not a non-empty string or a valid number. val=' +\n      JSON.stringify(val)\n  );\n};\n\n/**\n * Parse the given `str` and return milliseconds.\n *\n * @param {String} str\n * @return {Number}\n * @api private\n */\n\nfunction parse(str) {\n  str = String(str);\n  if (str.length > 100) {\n    return;\n  }\n  var match = /^(-?(?:\\d+)?\\.?\\d+) *(milliseconds?|msecs?|ms|seconds?|secs?|s|minutes?|mins?|m|hours?|hrs?|h|days?|d|weeks?|w|years?|yrs?|y)?$/i.exec(\n    str\n  );\n  if (!match) {\n    return;\n  }\n  var n = parseFloat(match[1]);\n  var type = (match[2] || 'ms').toLowerCase();\n  switch (type) {\n    case 'years':\n    case 'year':\n    case 'yrs':\n    case 'yr':\n    case 'y':\n      return n * y;\n    case 'weeks':\n    case 'week':\n    case 'w':\n      return n * w;\n    case 'days':\n    case 'day':\n    case 'd':\n      return n * d;\n    case 'hours':\n    case 'hour':\n    case 'hrs':\n    case 'hr':\n    case 'h':\n      return n * h;\n    case 'minutes':\n    case 'minute':\n    case 'mins':\n    case 'min':\n    case 'm':\n      return n * m;\n    case 'seconds':\n    case 'second':\n    case 'secs':\n    case 'sec':\n    case 's':\n      return n * s;\n    case 'milliseconds':\n    case 'millisecond':\n    case 'msecs':\n    case 'msec':\n    case 'ms':\n      return n;\n    default:\n      return undefined;\n  }\n}\n\n/**\n * Short format for `ms`.\n *\n * @param {Number} ms\n * @return {String}\n * @api private\n */\n\nfunction fmtShort(ms) {\n  var msAbs = Math.abs(ms);\n  if (msAbs >= d) {\n    return Math.round(ms / d) + 'd';\n  }\n  if (msAbs >= h) {\n    return Math.round(ms / h) + 'h';\n  }\n  if (msAbs >= m) {\n    return Math.round(ms / m) + 'm';\n  }\n  if (msAbs >= s) {\n    return Math.round(ms / s) + 's';\n  }\n  return ms + 'ms';\n}\n\n/**\n * Long format for `ms`.\n *\n * @param {Number} ms\n * @return {String}\n * @api private\n */\n\nfunction fmtLong(ms) {\n  var msAbs = Math.abs(ms);\n  if (msAbs >= d) {\n    return plural(ms, msAbs, d, 'day');\n  }\n  if (msAbs >= h) {\n    return plural(ms, msAbs, h, 'hour');\n  }\n  if (msAbs >= m) {\n    return plural(ms, msAbs, m, 'minute');\n  }\n  if (msAbs >= s) {\n    return plural(ms, msAbs, s, 'second');\n  }\n  return ms + ' ms';\n}\n\n/**\n * Pluralization helper.\n */\n\nfunction plural(ms, msAbs, n, name) {\n  var isPlural = msAbs >= n * 1.5;\n  return Math.round(ms / n) + ' ' + name + (isPlural ? 's' : '');\n}\n","/**\n * TinyCloud App Manifest\n *\n * A declarative description of an app's identity and the capabilities it\n * needs. The manifest drives the SIWE recap at sign-in time, enabling a\n * single wallet prompt that covers the app's own permissions plus any\n * pre-declared delegations.\n *\n * The SDK does NOT fetch external manifests. Apps compose their own manifest\n * (optionally including backend or agent addenda) before handing it to the\n * SDK.\n *\n * Canonical spec: `.claude/specs/manifest.md`.\n *\n * @packageDocumentation\n */\n\nimport ms from \"ms\";\nimport { ACCOUNT_MANIFEST_PERMISSIONS } from \"@tinycloud/bootstrap\";\nimport { resolveSecretPath, SECRET_NAME_RE } from \"@tinycloud/sdk-services\";\n\n// ---------------------------------------------------------------------------\n// Public types\n// ---------------------------------------------------------------------------\n\n/**\n * A single permission entry inside a manifest. This is the shape apps write\n * in their `manifest.json` and the shape we compare against when performing\n * the capability-subset derivability check in the delegation flow.\n *\n * `service` uses the long form (e.g. `\"tinycloud.kv\"`, `\"tinycloud.sql\"`).\n * `\"tinycloud.vault\"` is an SDK-only shorthand that expands to the KV\n * resources the vault service uses; it is never encoded as a recap service.\n */\nexport interface PermissionEntry {\n  /** Service namespace, e.g. \"tinycloud.kv\", \"tinycloud.sql\", \"tinycloud.duckdb\", \"tinycloud.capabilities\". */\n  service: string;\n  /** Space name or full space URI. Defaults to \"applications\" inside manifests. */\n  space?: string;\n  /**\n   * Service-specific path.\n   * - tinycloud.kv: hierarchical prefix. \"/\" = all, \"foo/\" = prefix match, \"foo\" = exact key\n   * - tinycloud.sql: database name/file (e.g. \"data.sqlite\") or \"/\" for all\n   * - tinycloud.duckdb: database name/file\n   * - tinycloud.capabilities: capability key URI or \"/\" for all\n   */\n  path: string;\n  /**\n   * Short action names (e.g. \"get\", \"put\", \"read\", \"schema\"). The SDK expands\n   * these to full URNs (e.g. `tinycloud.kv/get`) during resolution.\n   * Already-expanded URNs are passed through unchanged.\n   */\n  actions: string[];\n  /** Exact ReCap caveat branches when this authority came from a signed ReCap. */\n  caveats?: Record<string, unknown>[];\n  /** When true, the manifest prefix is NOT prepended to `path`. Default false. */\n  skipPrefix?: boolean;\n  /** Per-entry expiry override, ms-format. */\n  expiry?: string;\n  /** User/agent-facing context for why this permission is requested. */\n  description?: string;\n}\n\nexport type ManifestSecretActions =\n  | true\n  | string\n  | string[]\n  | {\n      /** Actual vault secret name. Defaults to the manifest object key. */\n      name?: string;\n      /** Optional scoped secret namespace. Omit for global secrets. */\n      scope?: string;\n      actions?: string | string[];\n      expiry?: string;\n      description?: string;\n    };\n\n/**\n * The valid values for `Manifest.defaults`.\n *\n * - `false` → no auto-included permissions\n * - `true` → standard tier (KV + SQL read/write + capabilities:read)\n * - `\"admin\"` → standard + SQL schema\n * - `\"all\"` → everything the SDK supports (including DuckDB)\n *\n * Unknown string values silently fall back to `true`. Values are normalized\n * (lowercase + trim) before matching.\n */\nexport type ManifestDefaults = boolean | \"admin\" | \"all\";\n\n/**\n * Agent-readable app knowledge bundle pointer.\n *\n * - `true` means the default root: `knowledge/index.md`\n * - string values must point at a markdown root under `knowledge/`\n */\nexport type ManifestKnowledge = true | string;\n\n/** Default root used when `manifest.knowledge === true`. */\nexport const DEFAULT_KNOWLEDGE_ROOT = \"knowledge/index.md\";\n\n/**\n * The raw manifest shape an app declares. See `.claude/specs/manifest.md`.\n */\nexport interface Manifest {\n  /** Schema version. Optional, defaults to 1. */\n  manifest_version?: 1;\n  /** Application identifier / namespace prefix. Required. */\n  app_id: string;\n  /** Display name. Required. */\n  name: string;\n  /** Description of what the app or delegate does. Optional. */\n  description?: string;\n  /** DID of this manifest's delegate target. Optional. Required only for delegation materialization. */\n  did?: string;\n  /** URL to app icon. Optional. */\n  icon?: string;\n  /** App version string. Optional. */\n  appVersion?: string;\n  /** Default expiry for permissions. ms-format (\"30d\", \"2h\", \"1y\"). Default \"30d\". */\n  expiry?: string;\n  /** Space name or full space URI. Optional, defaults to \"applications\". */\n  space?: string;\n  /**\n   * Path prefix auto-prepended to permission paths. Optional, defaults to\n   * `app_id`. Set to `\"\"` to disable entirely. Individual permissions can opt\n   * out with `skipPrefix: true`.\n   */\n  prefix?: string;\n  /**\n   * Default permission set to auto-include. Optional, defaults to `true`.\n   * See {@link ManifestDefaults}.\n   */\n  defaults?: ManifestDefaults | string;\n  /** Whether to include the public-space companion delegation. Default `true`. */\n  includePublicSpace?: boolean;\n  /** Agent-readable knowledge bundle root. `true` means `knowledge/index.md`. */\n  knowledge?: ManifestKnowledge;\n  /**\n   * Additional permissions beyond the defaults. Use for cross-space access,\n   * DuckDB (opt-in), or `skipPrefix: true` entries.\n   */\n  permissions?: PermissionEntry[];\n  /**\n   * Secret name shorthand. Entries resolve to encrypted vault KV resources in\n   * the `secrets` space.\n   */\n  secrets?: Record<string, ManifestSecretActions>;\n}\n\n/**\n * A resolved permission entry with fully-expanded paths and action URNs.\n * This is the shape the delegation flow compares against parsed recap\n * capabilities, and the shape the session-key delegation path actually uses.\n */\nexport interface ResourceCapability {\n  /** Long-form service, e.g. \"tinycloud.kv\". */\n  service: string;\n  /** Space name or URI. Short names are resolved to full SpaceIds at sign-in time. */\n  space: string;\n  /** Path with the manifest prefix applied (or skipped per `skipPrefix`). */\n  path: string;\n  /** Full-URN actions, e.g. [\"tinycloud.kv/get\", \"tinycloud.kv/put\"]. */\n  actions: string[];\n  /** Per-entry expiry override in milliseconds. */\n  expiryMs?: number;\n  /** User/agent-facing context copied from the source permission entry. */\n  description?: string;\n}\n\n/**\n * A resolved delegation entry with fully-expanded permissions.\n */\nexport interface ResolvedDelegate {\n  /** DID of the delegate. */\n  did: string;\n  /** Informational display name. Optional. */\n  name?: string;\n  /** Expiry in milliseconds (per-delegation > manifest default > 30 days). */\n  expiryMs: number;\n  /** Fully resolved permissions. */\n  permissions: ResourceCapability[];\n}\n\n/**\n * The output of {@link resolveManifest}: a fully-expanded capability set\n * ready to drive the SIWE recap.\n */\nexport interface ResolvedCapabilities {\n  /** Application identifier copied from manifest.app_id. */\n  app_id: string;\n  /** Delegate DID copied from manifest.did, when present. */\n  did?: string;\n  /** Effective default space for this manifest. */\n  space: string;\n  /** All session-key resources with paths fully resolved (prefix applied). */\n  resources: ResourceCapability[];\n  /** Default expiry for the session, in milliseconds. */\n  expiryMs: number;\n  /** Whether to include the public-space companion. */\n  includePublicSpace: boolean;\n  /** Delegate targets derived from manifests that declare `did`. */\n  additionalDelegates: ResolvedDelegate[];\n}\n\nexport interface ManifestRegistryRecord {\n  /** KV key inside the account space. */\n  key: string;\n  /** App id this record describes. */\n  app_id: string;\n  /** Latest manifest payloads composed for this app id. */\n  manifests: Manifest[];\n}\n\nexport interface ComposeManifestOptions {\n  /** Include implicit account-space registry permissions. Default true. */\n  includeAccountRegistryPermissions?: boolean;\n}\n\nexport interface ComposedManifestRequest {\n  /** Validated manifests that were composed. */\n  manifests: Manifest[];\n  /** Full permission union requested from the user in one SIWE. */\n  resources: ResourceCapability[];\n  /** Delegations that can be materialized after sign-in. */\n  delegationTargets: ResolvedDelegate[];\n  /** Account-space registry records to write after successful sign-in. */\n  registryRecords: ManifestRegistryRecord[];\n  /** Effective session expiry, using the longest composed manifest expiry. */\n  expiryMs: number;\n  /** Whether to include the public-space companion behavior. */\n  includePublicSpace: boolean;\n}\n\n/**\n * Thrown when the manifest fails validation (missing id/name, bad expiry,\n * empty actions on a permission, etc).\n */\nexport class ManifestValidationError extends Error {\n  constructor(message: string) {\n    super(`Manifest validation failed: ${message}`);\n    this.name = \"ManifestValidationError\";\n  }\n}\n\n// ---------------------------------------------------------------------------\n// Constants\n// ---------------------------------------------------------------------------\n\n/**\n * Default expiry when neither the manifest, delegation, nor permission\n * specifies one. APP tier — see `expiry.ts`. Spec: 30 days.\n *\n * Kept as an ms-format string because the manifest schema stores expiry\n * as a string and the parser is shared between this default and\n * caller-provided values; converting `EXPIRY.APP_MS` back to a string\n * here would duplicate that same `30d` literal in another form.\n */\nexport const DEFAULT_EXPIRY = \"30d\";\n\n/**\n * Default `defaults` value when the manifest omits it. Spec: standard tier.\n */\nexport const DEFAULT_DEFAULTS: ManifestDefaults = true;\n\n/** Default manifest schema version. */\nexport const DEFAULT_MANIFEST_VERSION = 1;\n\n/** Default space for manifest-declared app data. */\nexport const DEFAULT_MANIFEST_SPACE = \"applications\";\n\n/** Account-space name used for installed-application registry records. */\nexport const ACCOUNT_REGISTRY_SPACE = \"account\";\n\n/** Account-space KV prefix used for installed-application registry records. */\nexport const ACCOUNT_REGISTRY_PATH = \"applications/\";\n\nexport const SECRETS_SPACE = \"secrets\";\n\n/** SDK-only permission service for encrypted vault resources. */\nexport const VAULT_PERMISSION_SERVICE = \"tinycloud.vault\";\n\ntype VaultKVBase = \"vault\";\n\ninterface VaultActionExpansion {\n  bases: readonly VaultKVBase[];\n  action: string;\n}\n\n/**\n * Known services and their short-form (recap URI) names. The TinyCloud\n * node encodes the recap resource URI with the short service name, while\n * action URNs and manifest entries use the long `tinycloud.<short>` form.\n * This table is the canonical bridge between the two.\n */\nexport const SERVICE_SHORT_TO_LONG: Readonly<Record<string, string>> =\n  Object.freeze({\n    kv: \"tinycloud.kv\",\n    sql: \"tinycloud.sql\",\n    duckdb: \"tinycloud.duckdb\",\n    capabilities: \"tinycloud.capabilities\",\n    hooks: \"tinycloud.hooks\",\n    encryption: \"tinycloud.encryption\",\n    delegation: \"tinycloud.delegation\",\n  });\n\n/**\n * Manifest service identifier for TinyCloud encryption network grants.\n *\n * Encryption permissions live on a network id URN\n * (`urn:tinycloud:encryption:<ownerDid>:<network>`), not on a space.\n * The `path` field is the literal networkId; `actions` are\n * `[\"decrypt\"]` (expanded to `[\"tinycloud.encryption/decrypt\"]`).\n *\n * Apps should omit `space` for encryption permissions. The SDK may emit\n * an internal `\"encryption\"` compatibility label after expansion so the\n * older `PermissionEntry`/`ResourceCapability` shape can still carry the\n * raw network URN through subset checks.\n */\nexport const ENCRYPTION_PERMISSION_SERVICE = \"tinycloud.encryption\";\n\n/** Synthetic space label used by encryption manifest entries. */\nexport const ENCRYPTION_MANIFEST_SPACE = \"encryption\";\n\n/**\n * Inverse of {@link SERVICE_SHORT_TO_LONG}.\n */\nexport const SERVICE_LONG_TO_SHORT: Readonly<Record<string, string>> =\n  Object.freeze(\n    Object.fromEntries(\n      Object.entries(SERVICE_SHORT_TO_LONG).map(([s, l]) => [l, s]),\n    ),\n  );\n\n/**\n * Default permission entries for the `true` / standard tier.\n *\n * `tinycloud.capabilities/read` is added separately for every requested\n * space, without the app path prefix. That keeps capability introspection\n * space-scoped instead of app-data scoped.\n */\nconst DEFAULT_STANDARD_ENTRIES: readonly PermissionEntry[] = [\n  {\n    service: \"tinycloud.kv\",\n    space: DEFAULT_MANIFEST_SPACE,\n    path: \"/\",\n    actions: [\"get\", \"put\", \"del\", \"list\", \"metadata\"],\n  },\n  {\n    service: \"tinycloud.sql\",\n    space: DEFAULT_MANIFEST_SPACE,\n    path: \"/\",\n    actions: [\"read\", \"write\"],\n  },\n];\n\n/**\n * Default permission entries for the `\"admin\"` tier: standard + sql/schema.\n */\nconst DEFAULT_ADMIN_ENTRIES: readonly PermissionEntry[] = [\n  {\n    service: \"tinycloud.kv\",\n    space: DEFAULT_MANIFEST_SPACE,\n    path: \"/\",\n    actions: [\"get\", \"put\", \"del\", \"list\", \"metadata\"],\n  },\n  {\n    service: \"tinycloud.sql\",\n    space: DEFAULT_MANIFEST_SPACE,\n    path: \"/\",\n    actions: [\"read\", \"write\", \"schema\"],\n  },\n];\n\n/**\n * Default permission entries for the `\"all\"` tier: admin + DuckDB.\n *\n * DuckDB is opt-in and only appears in this tier or in explicit manifest\n * `permissions` entries.\n */\nconst DEFAULT_ALL_ENTRIES: readonly PermissionEntry[] = [\n  {\n    service: \"tinycloud.kv\",\n    space: DEFAULT_MANIFEST_SPACE,\n    path: \"/\",\n    actions: [\"get\", \"put\", \"del\", \"list\", \"metadata\"],\n  },\n  {\n    service: \"tinycloud.sql\",\n    space: DEFAULT_MANIFEST_SPACE,\n    path: \"/\",\n    actions: [\"read\", \"write\", \"schema\"],\n  },\n  {\n    service: \"tinycloud.duckdb\",\n    space: DEFAULT_MANIFEST_SPACE,\n    path: \"/\",\n    actions: [\"read\", \"write\"],\n  },\n];\n\n// ---------------------------------------------------------------------------\n// Public API\n// ---------------------------------------------------------------------------\n\n/**\n * Parse an ms-format duration string (e.g. \"30d\", \"2h\", \"1y\") into\n * milliseconds.\n *\n * @throws {ManifestValidationError} on empty string, non-string input, or\n * any input `ms()` cannot parse.\n */\nexport function parseExpiry(duration: string): number {\n  if (typeof duration !== \"string\" || duration.length === 0) {\n    throw new ManifestValidationError(\n      `expiry must be a non-empty duration string (got ${JSON.stringify(duration)})`,\n    );\n  }\n  // `ms` returns `undefined` for unparseable input and can return a number\n  // or a string depending on the call signature; cast explicitly.\n  const parsed = (ms as unknown as (v: string) => number | undefined)(duration);\n  if (typeof parsed !== \"number\" || !Number.isFinite(parsed) || parsed <= 0) {\n    throw new ManifestValidationError(\n      `invalid expiry duration: ${JSON.stringify(duration)}`,\n    );\n  }\n  return parsed;\n}\n\n/**\n * Expand a list of action short names (or already-expanded URNs) into full\n * ability URNs of the form `<service>/<action>`.\n *\n * Examples:\n *   `expandActionShortNames(\"tinycloud.kv\", [\"get\", \"put\"])`\n *     → `[\"tinycloud.kv/get\", \"tinycloud.kv/put\"]`\n *   `expandActionShortNames(\"tinycloud.kv\", [\"tinycloud.kv/get\"])`\n *     → `[\"tinycloud.kv/get\"]` (passed through unchanged)\n */\nexport function expandActionShortNames(\n  service: string,\n  actions: readonly string[],\n): string[] {\n  return actions.map((a) => {\n    if (a.includes(\"/\")) {\n      // Already a full URN — pass through.\n      return a;\n    }\n    return `${service}/${a}`;\n  });\n}\n\n/**\n * Expand SDK virtual permission services into concrete recap-capable services.\n *\n * Today this handles `\"tinycloud.vault\"`, which is backed by inline\n * network-encrypted KV records:\n * - read/get: `vault/<path>` with `tinycloud.kv/get`\n * - write/put: `vault/<path>` with `tinycloud.kv/put`\n * - delete/del: `vault/<path>` with `tinycloud.kv/del`\n * - list: `vault/<path>` with `tinycloud.kv/list`\n * - head: `vault/<path>` with `tinycloud.kv/get`\n * - metadata: `vault/<path>` with `tinycloud.kv/metadata`\n */\nexport function expandPermissionEntry(entry: PermissionEntry): PermissionEntry[] {\n  if (entry.service === ENCRYPTION_PERMISSION_SERVICE) {\n    return expandEncryptionPermissionEntry(entry);\n  }\n  if (entry.service !== VAULT_PERMISSION_SERVICE) {\n    return [\n      {\n        ...entry,\n        actions: expandActionShortNames(entry.service, entry.actions),\n      },\n    ];\n  }\n\n  return expandVaultPermissionEntry(entry);\n}\n\n/**\n * Expand a `tinycloud.encryption` manifest entry.\n *\n * - `path` MUST be a networkId URN (`urn:tinycloud:encryption:...`).\n *   The manifest prefix is always skipped — network ids are top-level\n *   owner-scoped resources, not space-scoped paths.\n * - `actions` must be `decrypt`, `network.create`, or `network.revoke`\n *   (or their already-expanded `tinycloud.encryption/*` forms).\n *\n * The returned entry uses an internal `space = \"encryption\"` compatibility\n * label so old manifest grouping code does not collapse it into the app's\n * data space, and `skipPrefix` is forced to `true` so the prefix application\n * step is a no-op.\n */\nfunction expandEncryptionPermissionEntry(\n  entry: PermissionEntry,\n): PermissionEntry[] {\n  if (\n    typeof entry.path !== \"string\" ||\n    !entry.path.startsWith(\"urn:tinycloud:encryption:\")\n  ) {\n    throw new ManifestValidationError(\n      `tinycloud.encryption entries require path to be a networkId URN ` +\n        `(got ${JSON.stringify(entry.path)})`,\n    );\n  }\n  const normalizedActions: string[] = [];\n  for (const action of entry.actions) {\n    if (action === \"decrypt\" || action === \"tinycloud.encryption/decrypt\") {\n      normalizedActions.push(\"tinycloud.encryption/decrypt\");\n      continue;\n    }\n    if (\n      action === \"network.create\" ||\n      action === \"tinycloud.encryption/network.create\"\n    ) {\n      normalizedActions.push(\"tinycloud.encryption/network.create\");\n      continue;\n    }\n    if (\n      action === \"network.revoke\" ||\n      action === \"tinycloud.encryption/network.revoke\"\n    ) {\n      normalizedActions.push(\"tinycloud.encryption/network.revoke\");\n      continue;\n    }\n    if (action.includes(\"/\")) {\n      throw new ManifestValidationError(\n        `unknown encryption action ${JSON.stringify(action)}; expected decrypt, network.create, or network.revoke`,\n      );\n    }\n    throw new ManifestValidationError(\n      `unknown encryption action ${JSON.stringify(action)}; expected decrypt, network.create, or network.revoke`,\n    );\n  }\n  // Dedupe while preserving order\n  const dedupedActions: string[] = [];\n  const seen = new Set<string>();\n  for (const a of normalizedActions) {\n    if (!seen.has(a)) {\n      dedupedActions.push(a);\n      seen.add(a);\n    }\n  }\n  // Encryption resources are network-scoped, not space-scoped. We\n  // always emit the synthetic \"encryption\" space label so manifest\n  // grouping can deal with it uniformly without collapsing the\n  // networkId URN into an app data space.\n  return [\n    {\n      service: ENCRYPTION_PERMISSION_SERVICE,\n      space: ENCRYPTION_MANIFEST_SPACE,\n      path: entry.path,\n      actions: dedupedActions,\n      skipPrefix: true,\n      ...(entry.expiry !== undefined ? { expiry: entry.expiry } : {}),\n      ...(entry.description !== undefined\n        ? { description: entry.description }\n        : {}),\n    },\n  ];\n}\n\n/**\n * Expand a list of permission entries using {@link expandPermissionEntry}.\n */\nexport function expandPermissionEntries(\n  entries: readonly PermissionEntry[],\n): PermissionEntry[] {\n  return entries.flatMap(expandPermissionEntry);\n}\n\n/**\n * Apply the manifest prefix to a permission path per the spec rules.\n *\n * - `skipPrefix: true` → path is returned as-is\n * - `prefix === \"\"` → path is returned as-is\n * - path starts with \"/\" → `prefix + path`  (e.g. \"com.listen.app\" + \"/\" → \"com.listen.app/\")\n * - otherwise → `prefix + \"/\" + path`  (e.g. \"com.listen.app\" + \"data.sqlite\" → \"com.listen.app/data.sqlite\")\n */\nexport function applyPrefix(\n  prefix: string,\n  path: string,\n  skipPrefix: boolean,\n): string {\n  if (skipPrefix) {\n    return path;\n  }\n  if (prefix === \"\") {\n    return path;\n  }\n  if (path.startsWith(\"/\")) {\n    return `${prefix}${path}`;\n  }\n  return `${prefix}/${path}`;\n}\n\n/**\n * Fetch and parse a manifest from a URL (browser) or file path (node).\n * The runtime decides the fetch strategy via `globalThis.fetch`; this is\n * platform-agnostic. Callers that want custom loading should JSON.parse a\n * Manifest themselves and skip this helper.\n *\n * @throws if the fetch fails, the JSON is invalid, or the manifest fails\n * validation.\n */\nexport async function loadManifest(url: string): Promise<Manifest> {\n  const fetchFn: typeof fetch | undefined = (\n    globalThis as { fetch?: typeof fetch }\n  ).fetch;\n  if (typeof fetchFn !== \"function\") {\n    throw new ManifestValidationError(\n      \"loadManifest requires a global fetch; pass the manifest object directly on runtimes without fetch\",\n    );\n  }\n  const res = await fetchFn(url);\n  if (!res.ok) {\n    throw new ManifestValidationError(\n      `failed to fetch manifest from ${url}: HTTP ${res.status}`,\n    );\n  }\n  const json = (await res.json()) as unknown;\n  return validateManifest(json);\n}\n\n/**\n * Validate a manifest-shaped object and return it strongly-typed.\n * Throws {@link ManifestValidationError} on any hard failure.\n */\nexport function validateManifest(input: unknown): Manifest {\n  if (input === null || typeof input !== \"object\") {\n    throw new ManifestValidationError(\"manifest must be an object\");\n  }\n  const m = input as Manifest;\n  if (\n    m.manifest_version !== undefined &&\n    m.manifest_version !== DEFAULT_MANIFEST_VERSION\n  ) {\n    throw new ManifestValidationError(\n      `manifest.manifest_version must be ${DEFAULT_MANIFEST_VERSION}`,\n    );\n  }\n  if (typeof m.app_id !== \"string\" || m.app_id.length === 0) {\n    throw new ManifestValidationError(\n      \"manifest.app_id is required and must be a non-empty string\",\n    );\n  }\n  if (typeof m.name !== \"string\" || m.name.length === 0) {\n    throw new ManifestValidationError(\n      \"manifest.name is required and must be a non-empty string\",\n    );\n  }\n  if (\n    m.did !== undefined &&\n    (typeof m.did !== \"string\" || m.did.length === 0)\n  ) {\n    throw new ManifestValidationError(\n      \"manifest.did must be a non-empty DID string\",\n    );\n  }\n  if (\n    m.space !== undefined &&\n    (typeof m.space !== \"string\" || m.space.length === 0)\n  ) {\n    throw new ManifestValidationError(\n      \"manifest.space must be a non-empty string\",\n    );\n  }\n  if (m.expiry !== undefined) {\n    // Will throw with a clear error if invalid.\n    parseExpiry(m.expiry);\n  }\n  if (m.knowledge !== undefined) {\n    resolveManifestKnowledgeRoot(m.knowledge);\n  }\n  if (m.permissions !== undefined) {\n    if (!Array.isArray(m.permissions)) {\n      throw new ManifestValidationError(\n        \"manifest.permissions must be an array\",\n      );\n    }\n    m.permissions.forEach((p, i) =>\n      validatePermissionEntry(p, `permissions[${i}]`),\n    );\n  }\n  if (m.secrets !== undefined) {\n    validateManifestSecrets(m.secrets);\n  }\n  return m;\n}\n\n/**\n * Resolve a manifest knowledge pointer to its root markdown file.\n *\n * This is metadata only; app knowledge does not create capabilities.\n */\nexport function resolveManifestKnowledgeRoot(\n  knowledge: Manifest[\"knowledge\"] | undefined,\n): string | undefined {\n  if (knowledge === undefined) {\n    return undefined;\n  }\n  if (knowledge === true) {\n    return DEFAULT_KNOWLEDGE_ROOT;\n  }\n  if (typeof knowledge !== \"string\" || knowledge.length === 0) {\n    throw new ManifestValidationError(\n      \"manifest.knowledge must be true or a knowledge/*.md root path\",\n    );\n  }\n  if (!/^knowledge\\/.+\\.md$/.test(knowledge)) {\n    throw new ManifestValidationError(\n      \"manifest.knowledge must be true or a knowledge/*.md root path\",\n    );\n  }\n  return knowledge;\n}\n\nfunction validateManifestSecrets(secrets: unknown): void {\n  if (secrets === null || typeof secrets !== \"object\" || Array.isArray(secrets)) {\n    throw new ManifestValidationError(\"manifest.secrets must be an object\");\n  }\n\n  for (const [name, spec] of Object.entries(secrets)) {\n    if (!SECRET_NAME_RE.test(name)) {\n      throw new ManifestValidationError(\n        `manifest.secrets.${name} must match ${SECRET_NAME_RE.source}`,\n      );\n    }\n    try {\n      resolveSecretPath(\n        secretNameFromSpec(name, spec as ManifestSecretActions),\n        { scope: secretScopeFromSpec(spec as ManifestSecretActions) },\n      );\n    } catch (error) {\n      throw new ManifestValidationError(\n        `manifest.secrets.${name}: ${error instanceof Error ? error.message : String(error)}`,\n      );\n    }\n    const actions = secretActionsFromSpec(name, spec as ManifestSecretActions);\n    if (actions.length === 0) {\n      throw new ManifestValidationError(\n        `manifest.secrets.${name} actions must be non-empty`,\n      );\n    }\n    for (const action of actions) {\n      if (typeof action !== \"string\" || action.length === 0) {\n        throw new ManifestValidationError(\n          `manifest.secrets.${name} actions must be non-empty strings`,\n        );\n      }\n    }\n    if (\n      spec !== null &&\n      typeof spec === \"object\" &&\n      !Array.isArray(spec) &&\n      (spec as { expiry?: unknown }).expiry !== undefined\n    ) {\n      parseExpiry((spec as { expiry: string }).expiry);\n    }\n  }\n}\n\nfunction validatePermissionEntry(p: unknown, path: string): void {\n  if (p === null || typeof p !== \"object\") {\n    throw new ManifestValidationError(`${path} must be an object`);\n  }\n  const entry = p as PermissionEntry;\n  if (typeof entry.service !== \"string\" || entry.service.length === 0) {\n    throw new ManifestValidationError(`${path}.service is required`);\n  }\n  if (\n    entry.space !== undefined &&\n    (typeof entry.space !== \"string\" || entry.space.length === 0)\n  ) {\n    throw new ManifestValidationError(\n      `${path}.space must be a non-empty string`,\n    );\n  }\n  if (typeof entry.path !== \"string\") {\n    throw new ManifestValidationError(\n      `${path}.path is required (use \"\" or \"/\" for root)`,\n    );\n  }\n  if (!Array.isArray(entry.actions) || entry.actions.length === 0) {\n    throw new ManifestValidationError(\n      `${path}.actions must be a non-empty array`,\n    );\n  }\n  for (const action of entry.actions) {\n    if (typeof action !== \"string\" || action.length === 0) {\n      throw new ManifestValidationError(\n        `${path}.actions must contain non-empty strings`,\n      );\n    }\n    if (entry.service === VAULT_PERMISSION_SERVICE) {\n      vaultActionExpansion(action);\n    }\n  }\n  if (entry.caveats !== undefined &&\n    (!Array.isArray(entry.caveats) || entry.caveats.some((caveat) =>\n      caveat === null || typeof caveat !== \"object\" || Array.isArray(caveat)\n    ))\n  ) {\n    throw new ManifestValidationError(`${path}.caveats must be an array of objects`);\n  }\n  if (entry.expiry !== undefined) {\n    parseExpiry(entry.expiry);\n  }\n}\n\n/**\n * Normalize a `defaults` value: lowercase + trim, then match against known\n * tiers. Unknown string values silently fall back to `true` (standard).\n * Boolean values pass through.\n */\nexport function normalizeDefaults(\n  value: Manifest[\"defaults\"] | undefined,\n): ManifestDefaults {\n  if (value === undefined) {\n    return DEFAULT_DEFAULTS;\n  }\n  if (typeof value === \"boolean\") {\n    return value;\n  }\n  if (typeof value !== \"string\") {\n    // Spec says unknown values silently fall back to `true`.\n    return true;\n  }\n  const normalized = value.trim().toLowerCase();\n  if (normalized === \"admin\" || normalized === \"all\") {\n    return normalized;\n  }\n  // Anything else, including \"true\"/\"false\"/\"standard\"/garbage, falls back\n  // to the standard tier per spec.\n  return true;\n}\n\n/**\n * Return the default permission entries for the given tier. Entries are\n * deep-cloned so callers can mutate them without affecting the constants.\n */\nfunction defaultEntriesForTier(tier: ManifestDefaults): PermissionEntry[] {\n  if (tier === false) {\n    return [];\n  }\n  const source =\n    tier === \"admin\"\n      ? DEFAULT_ADMIN_ENTRIES\n      : tier === \"all\"\n        ? DEFAULT_ALL_ENTRIES\n        : DEFAULT_STANDARD_ENTRIES;\n  return source.map((e) => ({\n    service: e.service,\n    space: e.space,\n    path: e.path,\n    actions: [...e.actions],\n    ...(e.skipPrefix !== undefined ? { skipPrefix: e.skipPrefix } : {}),\n  }));\n}\n\n/**\n * Resolve a raw manifest into a {@link ResolvedCapabilities} object: expand\n * shortform actions, apply the prefix, merge defaults, and compute effective\n * expiries. Pure function — does no I/O.\n *\n * Resolution semantics (spec):\n * - `prefix` defaults to `app_id`; set to `\"\"` to disable prefix application entirely.\n * - `space` defaults to `applications`; per-permission `space` overrides it.\n * - `defaults` defaults to `true` (standard tier); unknown string values fall back to `true`.\n * - Per-entry expiry overrides per-delegation overrides manifest > `DEFAULT_EXPIRY`.\n * - Default entries use `skipPrefix: false` so they inherit the manifest prefix.\n */\nexport function resolveManifest(input: Manifest): ResolvedCapabilities {\n  const manifest = validateManifest(input);\n\n  const prefix =\n    manifest.prefix !== undefined ? manifest.prefix : manifest.app_id;\n  const space = manifest.space ?? DEFAULT_MANIFEST_SPACE;\n  const expiryMs = parseExpiry(manifest.expiry ?? DEFAULT_EXPIRY);\n  const includePublicSpace = manifest.includePublicSpace ?? true;\n  const tier = normalizeDefaults(manifest.defaults);\n\n  const defaultEntries = defaultEntriesForTier(tier);\n  const explicitEntries = manifest.permissions ?? [];\n  const secretEntries = secretEntriesForManifest(manifest.secrets);\n\n  // Merge order: defaults first, then explicit entries, so explicit entries\n  // for the same (service, space, path) tuple override defaults.\n  const allEntries: PermissionEntry[] = [\n    ...defaultEntries,\n    ...explicitEntries,\n    ...secretEntries,\n  ];\n\n  const resources: ResourceCapability[] = withCapabilitiesReadForSpaces(\n    allEntries.flatMap((entry) => resolveEntry(entry, prefix, expiryMs, space)),\n  );\n\n  const additionalDelegates: ResolvedDelegate[] =\n    manifest.did === undefined\n      ? []\n      : [\n          {\n            did: manifest.did,\n            name: manifest.name,\n            expiryMs,\n            permissions: resources.map(cloneResourceCapability),\n          },\n        ];\n\n  return {\n    app_id: manifest.app_id,\n    ...(manifest.did !== undefined ? { did: manifest.did } : {}),\n    space,\n    resources,\n    expiryMs,\n    includePublicSpace,\n    additionalDelegates,\n  };\n}\n\nfunction normalizeSecretActions(actions: readonly string[]): string[] {\n  const out: string[] = [];\n  const seen = new Set<string>();\n  const add = (action: string) => {\n    if (!seen.has(action)) {\n      out.push(action);\n      seen.add(action);\n    }\n  };\n\n  for (const action of actions) {\n    if (action === \"read\") {\n      add(\"get\");\n      continue;\n    }\n    if (action === \"write\") {\n      add(\"put\");\n      continue;\n    }\n    if (action === \"delete\") {\n      add(\"del\");\n      continue;\n    }\n    if (\n      action === \"get\" ||\n      action === \"put\" ||\n      action === \"del\" ||\n      action === \"list\" ||\n      action === \"metadata\"\n    ) {\n      add(action);\n      continue;\n    }\n    if (\n      action === \"tinycloud.kv/get\" ||\n      action === \"tinycloud.kv/put\" ||\n      action === \"tinycloud.kv/del\" ||\n      action === \"tinycloud.kv/list\" ||\n      action === \"tinycloud.kv/metadata\"\n    ) {\n      add(action);\n      continue;\n    }\n    throw new ManifestValidationError(\n      `unknown secret action ${JSON.stringify(action)}; expected read, write, delete, list, or metadata`,\n    );\n  }\n\n  return out;\n}\n\nfunction secretNameFromSpec(\n  fallbackName: string,\n  spec: ManifestSecretActions,\n): string {\n  if (spec !== null && typeof spec === \"object\" && !Array.isArray(spec)) {\n    return spec.name ?? fallbackName;\n  }\n  return fallbackName;\n}\n\nfunction secretScopeFromSpec(\n  spec: ManifestSecretActions,\n): string | undefined {\n  if (spec !== null && typeof spec === \"object\" && !Array.isArray(spec)) {\n    return spec.scope;\n  }\n  return undefined;\n}\n\nfunction secretActionsFromSpec(\n  name: string,\n  spec: ManifestSecretActions,\n): string[] {\n  if (spec === true) {\n    return [\"read\"];\n  }\n  if (typeof spec === \"string\") {\n    return [spec];\n  }\n  if (Array.isArray(spec)) {\n    return spec;\n  }\n  if (spec === null || typeof spec !== \"object\") {\n    throw new ManifestValidationError(\n      `manifest.secrets.${name} must be true, a string action, an actions array, or an object`,\n    );\n  }\n  if (spec.actions === undefined) {\n    return [\"read\"];\n  }\n  if (typeof spec.actions === \"string\") {\n    return [spec.actions];\n  }\n  if (Array.isArray(spec.actions)) {\n    return spec.actions;\n  }\n  throw new ManifestValidationError(\n    `manifest.secrets.${name}.actions must be a string or array`,\n  );\n}\n\nfunction secretEntriesForManifest(\n  secrets: Manifest[\"secrets\"] | undefined,\n): PermissionEntry[] {\n  if (secrets === undefined) {\n    return [];\n  }\n\n  const entries: PermissionEntry[] = [];\n  for (const [name, spec] of Object.entries(secrets)) {\n    const actions = secretActionsFromSpec(name, spec);\n    const secretPath = resolveSecretPath(\n      secretNameFromSpec(name, spec),\n      { scope: secretScopeFromSpec(spec) },\n    );\n    const extra: { expiry?: string; description?: string } =\n      spec !== true && typeof spec === \"object\" && !Array.isArray(spec)\n        ? spec\n        : {};\n    entries.push({\n      service: VAULT_PERMISSION_SERVICE,\n      space: SECRETS_SPACE,\n      path: secretPath.vaultKey,\n      actions: normalizeSecretActions(actions),\n      skipPrefix: true,\n      ...(extra.expiry !== undefined ? { expiry: extra.expiry } : {}),\n      ...(extra.description !== undefined\n        ? { description: extra.description }\n        : {}),\n    });\n  }\n  return entries;\n}\n\n/**\n * Expand a single permission entry into a {@link ResourceCapability}:\n * apply the prefix to the path and expand short actions into full URNs.\n */\nfunction resolveEntry(\n  entry: PermissionEntry,\n  prefix: string,\n  _inheritedExpiryMs: number,\n  inheritedSpace: string,\n): ResourceCapability[] {\n  // Encryption permissions reference a networkId URN as their resource\n  // — the manifest prefix is meaningless against a top-level\n  // owner-scoped resource and would corrupt the URN. Always skip.\n  const skipPrefixForEntry =\n    entry.skipPrefix === true ||\n    entry.service === ENCRYPTION_PERMISSION_SERVICE;\n  const resolvedPath = applyPrefix(prefix, entry.path, skipPrefixForEntry);\n  const entryExpiryMs =\n    entry.expiry !== undefined ? parseExpiry(entry.expiry) : undefined;\n  return expandPermissionEntry({\n    ...entry,\n    space: entry.space ?? inheritedSpace,\n    path: resolvedPath,\n    skipPrefix: true,\n  }).map((expanded) => ({\n    service: expanded.service,\n    space: expanded.space ?? inheritedSpace,\n    path: expanded.path,\n    actions: expanded.actions,\n    // Only populate `expiryMs` when the entry had its own expiry override.\n    // When absent, callers use the parent (delegation or manifest) expiry\n    // which is carried on ResolvedDelegate.expiryMs / ResolvedCapabilities.expiryMs.\n    ...(entryExpiryMs !== undefined ? { expiryMs: entryExpiryMs } : {}),\n    ...(entry.description !== undefined\n      ? { description: entry.description }\n      : {}),\n  }));\n}\n\nfunction expandVaultPermissionEntry(entry: PermissionEntry): PermissionEntry[] {\n  const byBase = new Map<VaultKVBase, string[]>();\n\n  for (const action of entry.actions) {\n    const expansion = vaultActionExpansion(action);\n    for (const base of expansion.bases) {\n      const actions = byBase.get(base) ?? [];\n      if (!actions.includes(expansion.action)) {\n        actions.push(expansion.action);\n      }\n      byBase.set(base, actions);\n    }\n  }\n\n  return [...byBase.entries()].map(([base, actions]) => ({\n    ...entry,\n    service: \"tinycloud.kv\",\n    path: vaultKVPath(base, entry.path),\n    actions,\n    skipPrefix: true,\n  }));\n}\n\nfunction vaultActionExpansion(action: string): VaultActionExpansion {\n  const normalized = normalizeVaultAction(action);\n  if (normalized === \"read\" || normalized === \"get\") {\n    return { bases: [\"vault\"], action: \"tinycloud.kv/get\" };\n  }\n  if (normalized === \"write\" || normalized === \"put\") {\n    return { bases: [\"vault\"], action: \"tinycloud.kv/put\" };\n  }\n  if (normalized === \"delete\" || normalized === \"del\") {\n    return { bases: [\"vault\"], action: \"tinycloud.kv/del\" };\n  }\n  if (normalized === \"list\") {\n    return { bases: [\"vault\"], action: \"tinycloud.kv/list\" };\n  }\n  if (normalized === \"head\") {\n    return { bases: [\"vault\"], action: \"tinycloud.kv/get\" };\n  }\n  if (normalized === \"metadata\") {\n    return { bases: [\"vault\"], action: \"tinycloud.kv/metadata\" };\n  }\n\n  throw new ManifestValidationError(\n    `unknown vault action ${JSON.stringify(action)}; expected read, write, delete, get, put, del, list, head, or metadata`,\n  );\n}\n\nfunction normalizeVaultAction(action: string): string {\n  if (action.startsWith(`${VAULT_PERMISSION_SERVICE}/`)) {\n    return action.slice(`${VAULT_PERMISSION_SERVICE}/`.length);\n  }\n  if (action.startsWith(\"tinycloud.kv/\")) {\n    return action.slice(\"tinycloud.kv/\".length);\n  }\n  if (action.includes(\"/\")) {\n    throw new ManifestValidationError(\n      `unknown vault action ${JSON.stringify(action)}; expected a tinycloud.vault or tinycloud.kv action`,\n    );\n  }\n  return action;\n}\n\nfunction vaultKVPath(base: VaultKVBase, path: string): string {\n  const normalized = path.startsWith(\"/\") ? path.slice(1) : path;\n  return `${base}/${normalized}`;\n}\n\nfunction cloneResourceCapability(\n  entry: ResourceCapability,\n): ResourceCapability {\n  return {\n    service: entry.service,\n    space: entry.space,\n    path: entry.path,\n    actions: [...entry.actions],\n    ...(entry.expiryMs !== undefined ? { expiryMs: entry.expiryMs } : {}),\n    ...(entry.description !== undefined\n      ? { description: entry.description }\n      : {}),\n  };\n}\n\nfunction clonePermissionEntry(entry: PermissionEntry): PermissionEntry {\n  return {\n    service: entry.service,\n    ...(entry.space !== undefined ? { space: entry.space } : {}),\n    path: entry.path,\n    actions: [...entry.actions],\n    ...(entry.caveats !== undefined\n      ? { caveats: JSON.parse(JSON.stringify(entry.caveats)) as Record<string, unknown>[] }\n      : {}),\n    ...(entry.skipPrefix !== undefined ? { skipPrefix: entry.skipPrefix } : {}),\n    ...(entry.expiry !== undefined ? { expiry: entry.expiry } : {}),\n    ...(entry.description !== undefined\n      ? { description: entry.description }\n      : {}),\n  };\n}\n\nfunction dedupeResources(\n  resources: readonly ResourceCapability[],\n): ResourceCapability[] {\n  const byKey = new Map<string, ResourceCapability>();\n\n  for (const resource of resources) {\n    const key = `${resource.service}\\u0000${resource.space}\\u0000${resource.path}\\u0000${resource.expiryMs ?? \"\"}`;\n    const existing = byKey.get(key);\n    if (existing === undefined) {\n      byKey.set(key, cloneResourceCapability(resource));\n      continue;\n    }\n\n    const seen = new Set(existing.actions);\n    for (const action of resource.actions) {\n      if (!seen.has(action)) {\n        existing.actions.push(action);\n        seen.add(action);\n      }\n    }\n    if (\n      existing.description === undefined &&\n      resource.description !== undefined\n    ) {\n      existing.description = resource.description;\n    }\n  }\n\n  return [...byKey.values()];\n}\n\nfunction capabilitiesReadPermission(space: string): ResourceCapability {\n  return {\n    service: \"tinycloud.capabilities\",\n    space,\n    path: \"\",\n    actions: [\"tinycloud.capabilities/read\"],\n  };\n}\n\nfunction withCapabilitiesReadForSpaces(\n  resources: readonly ResourceCapability[],\n): ResourceCapability[] {\n  if (resources.length === 0) {\n    return [];\n  }\n\n  const spaces = new Set(\n    resources\n      .filter((resource) => resource.service !== ENCRYPTION_PERMISSION_SERVICE)\n      .map((resource) => resource.space),\n  );\n  return dedupeResources([\n    ...resources,\n    ...[...spaces].map(capabilitiesReadPermission),\n  ]);\n}\n\n/**\n * Compose one or more manifests into the single capability request that should\n * be signed. Fetching manifests is intentionally out of band; callers pass the\n * already-loaded manifest objects.\n */\nexport function composeManifestRequest(\n  inputs: readonly Manifest[],\n  options: ComposeManifestOptions = {},\n): ComposedManifestRequest {\n  if (!Array.isArray(inputs) || inputs.length === 0) {\n    throw new ManifestValidationError(\n      \"composeManifestRequest requires at least one manifest\",\n    );\n  }\n\n  const includeAccountRegistryPermissions =\n    options.includeAccountRegistryPermissions ?? true;\n  const manifests = inputs.map(validateManifest);\n  const resolved = manifests.map(resolveManifest);\n  const resources = resolved.flatMap((entry) => entry.resources);\n  const delegationTargets = resolved.flatMap((entry) =>\n    entry.additionalDelegates.map((delegate) => ({\n      ...delegate,\n      permissions: dedupeResources(delegate.permissions),\n    })),\n  );\n\n  if (includeAccountRegistryPermissions) {\n    resources.push(\n      ...ACCOUNT_MANIFEST_PERMISSIONS.map((resource) => ({\n        ...resource,\n        actions: [...resource.actions],\n      })),\n    );\n  }\n  const resourcesWithImplicitCapabilities =\n    withCapabilitiesReadForSpaces(resources);\n\n  const manifestsByAppId = new Map<string, Manifest[]>();\n  for (const manifest of manifests) {\n    const current = manifestsByAppId.get(manifest.app_id);\n    if (current === undefined) {\n      manifestsByAppId.set(manifest.app_id, [manifest]);\n    } else {\n      current.push(manifest);\n    }\n  }\n\n  const registryRecords: ManifestRegistryRecord[] =\n    includeAccountRegistryPermissions\n      ? [...manifestsByAppId.entries()].map(([app_id, appManifests]) => ({\n          key: `${ACCOUNT_REGISTRY_PATH}${app_id}`,\n          app_id,\n          manifests: appManifests.map((manifest) => ({\n            ...manifest,\n            permissions: manifest.permissions?.map(clonePermissionEntry),\n          })),\n        }))\n      : [];\n\n  return {\n    manifests,\n    resources: resourcesWithImplicitCapabilities,\n    delegationTargets,\n    registryRecords,\n    expiryMs: Math.max(...resolved.map((entry) => entry.expiryMs)),\n    includePublicSpace: resolved.some((entry) => entry.includePublicSpace),\n  };\n}\n\n// ---------------------------------------------------------------------------\n// Abilities map construction (bridge to WASM prepareSession / createDelegation)\n// ---------------------------------------------------------------------------\n\n/**\n * The shape `prepareSession` and the multi-resource `createDelegation` WASM\n * export both accept:\n *\n * ```\n * { [shortService]: { [path]: [fullUrnAction, ...] } }\n * ```\n *\n * - `shortService` is the recap-level service segment (`\"kv\"`, `\"sql\"`,\n *   `\"duckdb\"`, `\"capabilities\"`, `\"hooks\"`) — not the manifest long form.\n * - `path` is the fully-resolved path (prefix already applied). An empty\n *   string means \"no path segment\" on the resource URI.\n * - Action strings are full URNs like `\"tinycloud.kv/get\"`.\n *\n * This is a single source of truth for both the session's own recap (at\n * sign-in) and the delegations it can derive (post sign-in). We re-use it\n * for both so one manifest drives both sides.\n */\nexport type AbilitiesMap = Record<string, Record<string, string[]>>;\n\n/**\n * Per-space abilities map accepted by the newer WASM session config:\n *\n * ```\n * { [spaceIdOrName]: { [shortService]: { [path]: [fullUrnAction, ...] } } }\n * ```\n */\nexport type SpaceAbilitiesMap = Record<string, AbilitiesMap>;\n\n/**\n * Convert a list of {@link ResourceCapability} entries (manifest\n * long-form service, full-URN actions) into the {@link AbilitiesMap}\n * shape the WASM layer expects.\n *\n * When multiple entries target the same `(service, path)` pair, their\n * action lists are merged and deduped. Entries whose service has no\n * short-form mapping in {@link SERVICE_LONG_TO_SHORT} are rejected with\n * a {@link ManifestValidationError} — the SDK does not silently drop\n * unknown services because the recap encoding would lose them.\n *\n * Paths are kept verbatim: this function does NOT collapse\n * `\"com.listen.app/\"` and `\"com.listen.app\"` or reinterpret empty /\n * slash strings. Callers that care about path canonicalization should\n * normalize before calling.\n */\nexport function resourceCapabilitiesToAbilitiesMap(\n  resources: readonly ResourceCapability[],\n): AbilitiesMap {\n  const out: AbilitiesMap = {};\n  for (const r of resources) {\n    const shortService = SERVICE_LONG_TO_SHORT[r.service];\n    if (shortService === undefined) {\n      throw new ManifestValidationError(\n        `unknown service '${r.service}' — no short-form mapping. Known services: ${Object.keys(SERVICE_LONG_TO_SHORT).join(\", \")}`,\n      );\n    }\n    if (out[shortService] === undefined) {\n      out[shortService] = {};\n    }\n    const pathsMap = out[shortService];\n    const existing = pathsMap[r.path];\n    if (existing === undefined) {\n      // Copy so downstream mutation can't leak back into the input.\n      pathsMap[r.path] = [...r.actions];\n    } else {\n      // Merge + dedupe while preserving first-seen order.\n      const seen = new Set(existing);\n      for (const action of r.actions) {\n        if (!seen.has(action)) {\n          existing.push(action);\n          seen.add(action);\n        }\n      }\n    }\n  }\n  return out;\n}\n\n/**\n * Group resolved capabilities by `space`, then convert each group into a WASM\n * abilities map. Short space names are left as-is here; platform layers that\n * know the wallet address and chain id turn them into full SpaceIds.\n */\nexport function resourceCapabilitiesToSpaceAbilitiesMap(\n  resources: readonly ResourceCapability[],\n): SpaceAbilitiesMap {\n  const grouped = new Map<string, ResourceCapability[]>();\n  for (const resource of resources) {\n    const entries = grouped.get(resource.space);\n    if (entries === undefined) {\n      grouped.set(resource.space, [resource]);\n    } else {\n      entries.push(resource);\n    }\n  }\n\n  const out: SpaceAbilitiesMap = {};\n  for (const [space, entries] of grouped.entries()) {\n    out[space] = resourceCapabilitiesToAbilitiesMap(entries);\n  }\n  return out;\n}\n\n/**\n * Build the {@link AbilitiesMap} that a session should be signed with,\n * given a {@link ResolvedCapabilities} (i.e. the output of\n * {@link resolveManifest}).\n *\n * The resulting map is the **union** of:\n * 1. the app's own resources (`resolved.resources`), and\n * 2. every permission declared in every `additionalDelegates[*]` entry.\n *\n * The union is what makes the manifest's delegations ergonomic: at\n * sign-in, the session key acquires recap coverage for both the app's\n * runtime needs and every downstream delegation target. Post sign-in,\n * `delegateTo(backendDID, backendPermissions)` can then issue the\n * sub-delegation via the session key (no wallet prompt) because the\n * caps are already part of the granted set.\n *\n * Duplicate `(service, path, action)` triples across resources and\n * delegations are merged and deduped — the session SIWE doesn't need\n * them repeated.\n */\nexport function manifestAbilitiesUnion(\n  resolved: ResolvedCapabilities,\n): AbilitiesMap {\n  const all: ResourceCapability[] = [...resolved.resources];\n  for (const delegate of resolved.additionalDelegates) {\n    for (const perm of delegate.permissions) {\n      all.push(perm);\n    }\n  }\n  return resourceCapabilitiesToAbilitiesMap(all);\n}\n","/**\n * Capability subset checking and recap parsing.\n *\n * This module powers the capability-chain delegation flow. The key decision\n * a `delegateTo` call has to make is: \"are the requested capabilities a\n * subset of what the current session already grants?\"\n *\n * - If yes → issue the delegation via the session-key UCAN path (no wallet prompt).\n * - If no → raise {@link PermissionNotInManifestError} so the caller can\n *   trigger an escalation flow via `requestPermissions`.\n *\n * Canonical spec: `.claude/specs/capability-chain.md`.\n *\n * @packageDocumentation\n */\n\nimport {\n  DEFAULT_MANIFEST_SPACE,\n  type PermissionEntry,\n  SERVICE_SHORT_TO_LONG,\n  expandActionShortNames,\n} from \"./manifest\";\n\n// ---------------------------------------------------------------------------\n// Errors\n// ---------------------------------------------------------------------------\n\n/**\n * Thrown when a `delegateTo` call requests capabilities that the current\n * session does not already grant. The caller can catch this and trigger\n * `requestPermissions(missing)` to show an escalation modal.\n */\nexport class PermissionNotInManifestError extends Error {\n  public readonly missing: PermissionEntry[];\n  public readonly granted: PermissionEntry[];\n\n  constructor(missing: PermissionEntry[], granted: PermissionEntry[]) {\n    super(\n      `Requested capabilities exceed current session. Missing ${missing.length} entries.`\n    );\n    this.name = \"PermissionNotInManifestError\";\n    this.missing = missing;\n    this.granted = granted;\n  }\n}\n\n/**\n * Thrown when the current session has expired (or will expire within the\n * safety margin). The caller should trigger a fresh sign-in.\n */\nexport class SessionExpiredError extends Error {\n  public readonly expiredAt: Date;\n\n  constructor(expiredAt: Date) {\n    super(`Session expired at ${expiredAt.toISOString()}`);\n    this.name = \"SessionExpiredError\";\n    this.expiredAt = expiredAt;\n  }\n}\n\n/**\n * Thrown when the installed WASM delegation boundary cannot encode every\n * constrained ReCap branch in a requested child delegation.\n */\nexport class CaveatedDelegationUnsupportedError extends Error {\n  /** Stable machine-readable error code for fail-closed caveated delegation. */\n  code = \"CAVEATED_DELEGATION_UNSUPPORTED\" as const;\n  /** Requested entries whose constrained ReCap branches cannot be preserved. */\n  entries: PermissionEntry[];\n\n  constructor(entries: PermissionEntry[]) {\n    super(\n      \"Cannot create a caveated delegation because this WASM delegation boundary cannot preserve every ReCap caveat branch exactly.\"\n    );\n    this.name = \"CaveatedDelegationUnsupportedError\";\n    this.entries = entries.map(cloneEntry);\n  }\n}\n\n// ---------------------------------------------------------------------------\n// Space normalization\n// ---------------------------------------------------------------------------\n\n/**\n * Normalize a space identifier to its short-name form.\n *\n * Recap resource URIs in a signed SIWE encode the space as a full URI of the\n * form `tinycloud:pkh:eip155:{chainId}:{address}:{name}` (e.g.\n * `tinycloud:pkh:eip155:1:0xd559...:default`). Manifest permissions and\n * backend-advertised permissions use the short `{name}` form (e.g.\n * `\"default\"`).\n *\n * Strict string comparison between these two forms would always fail, so we\n * normalize both sides to the short name before comparing. The trailing\n * segment after the last `:` in a `tinycloud:` URI is the space name.\n *\n * Short names (`\"default\"`, `\"work-space\"`) are returned unchanged.\n * Any non-`tinycloud:` string is returned unchanged. A malformed URI with a\n * trailing colon is returned unchanged (so the check degrades to a strict\n * mismatch rather than collapsing to an empty string).\n *\n * @internal\n */\nexport function normalizeSpace(space: string): string {\n  if (!space.startsWith(\"tinycloud:\")) {\n    return space;\n  }\n  const lastColon = space.lastIndexOf(\":\");\n  if (lastColon === -1 || lastColon === space.length - 1) {\n    return space;\n  }\n  return space.slice(lastColon + 1);\n}\n\n// ---------------------------------------------------------------------------\n// Subset check\n// ---------------------------------------------------------------------------\n\nexport interface SubsetCheckResult {\n  /** True when every requested entry is covered by a granted entry. */\n  subset: boolean;\n  /** Entries the granted set does not cover (empty when `subset` is true). */\n  missing: PermissionEntry[];\n}\n\n/**\n * Check whether `requested` is a strict subset of `granted`.\n *\n * Matching rules for each `requested[i]`:\n * - `service` matches exactly.\n * - `space` matches exactly.\n * - Path containment:\n *     - If `granted.path` ends with `/`, it covers any `requested.path` that\n *       starts with `granted.path`.\n *     - Otherwise, the paths must match exactly.\n * - Action containment: every requested URN must be matched exactly or by a\n *   service-scoped wildcard such as `tinycloud.kv/*`.\n *\n * Grant entries with the same service, space, path coverage, and caveats are\n * considered together. This matters because ReCap parsers may return one\n * entry per action even when the original manifest grouped those actions.\n * Any `requested` entry whose actions are not collectively covered is added\n * to `missing` and the overall result is non-subset.\n *\n * Both sides are expected to be in the canonical long-form shape (service\n * starts with `tinycloud.`, actions are full URNs). Use {@link parseRecapCapabilities}\n * or `expandActionShortNames` to normalize inputs first.\n */\nexport function isCapabilitySubset(\n  requested: readonly PermissionEntry[],\n  granted: readonly PermissionEntry[]\n): SubsetCheckResult {\n  const missing: PermissionEntry[] = [];\n\n  for (const req of requested) {\n    const matchingScope = granted.filter((entry) =>\n      canonicalizeEntryScopeMatches(req, entry)\n    );\n    const requestedActions = expandActionShortNames(\n      req.service,\n      req.actions\n    );\n    const grantedActions = matchingScope.flatMap((entry) =>\n      expandActionShortNames(entry.service, entry.actions)\n    );\n    const covered = requestedActions.every((requestedAction) =>\n      grantedActions.some((grantedAction) =>\n        actionContains(grantedAction, requestedAction)\n      )\n    );\n    if (!covered) {\n      missing.push(cloneEntry(req));\n    }\n  }\n\n  return { subset: missing.length === 0, missing };\n}\n\n/**\n * Returns true when `granted` fully covers `requested` — same service, same\n * space, path containment per spec, and action set containment.\n */\nfunction canonicalizeEntryScopeMatches(\n  requested: PermissionEntry,\n  granted: PermissionEntry\n): boolean {\n  if (requested.service !== granted.service) {\n    return false;\n  }\n  // Normalize both sides so callers passing short names (`\"default\"`) match\n  // recap-parsed full URIs (`\"tinycloud:pkh:eip155:1:0xd559...:default\"`) and\n  // vice versa. Idempotent for short names.\n  if (\n    normalizeSpace(requested.space ?? DEFAULT_MANIFEST_SPACE) !==\n    normalizeSpace(granted.space ?? DEFAULT_MANIFEST_SPACE)\n  ) {\n    return false;\n  }\n  if (!pathContains(granted.path, requested.path)) {\n    return false;\n  }\n  // There is no safe general partial ordering for arbitrary ReCap caveat\n  // objects. A caveated authority therefore only covers the same caveat set;\n  // treating it as uncaveated would authorize a broader child delegation.\n  if (!recapCaveatsEqual(requested.caveats, granted.caveats)) {\n    return false;\n  }\n  return true;\n}\n\n/**\n * Compare ReCap caveat branch sets without losing signed branch structure.\n *\n * ReCap represents an unconstrained ability as `[{}]`, while SDK callers can\n * represent that same authority as `undefined` or `[]`. Those three forms are\n * equivalent. Every other branch, including an unconstrained branch mixed\n * with a constrained one, remains part of the canonical comparison.\n */\nexport function recapCaveatsEqual(\n  left: readonly Record<string, unknown>[] | undefined,\n  right: readonly Record<string, unknown>[] | undefined,\n): boolean {\n  return canonicalizeRecapCaveats(left) === canonicalizeRecapCaveats(right);\n}\n\n/**\n * Canonicalize a ReCap caveat branch set for exact equality checks.\n *\n * Object keys and branch order do not affect equality. A lone unconstrained\n * branch is normalized to the SDK's empty-caveat representation, but an\n * unconstrained branch in a mixed set is deliberately retained.\n */\nexport function canonicalizeRecapCaveats(\n  caveats: readonly Record<string, unknown>[] | undefined,\n): string {\n  const canonicalize = (value: unknown): string => {\n    if (value === null || typeof value === \"boolean\" || typeof value === \"string\") {\n      return JSON.stringify(value);\n    }\n    if (typeof value === \"number\") {\n      if (Number.isFinite(value)) return JSON.stringify(value);\n      throw new Error(\"ReCap caveats must contain only JSON values.\");\n    }\n    if (Array.isArray(value)) return `[${value.map(canonicalize).join(\",\")}]`;\n    if (typeof value === \"object\") {\n      const object = value as Record<string, unknown>;\n      const prototype = Object.getPrototypeOf(object);\n      if (prototype !== Object.prototype && prototype !== null) {\n        throw new Error(\"ReCap caveats must contain only JSON values.\");\n      }\n      return `{${Object.keys(object).sort().map((key) =>\n        `${JSON.stringify(key)}:${canonicalize(object[key])}`,\n      ).join(\",\")}}`;\n    }\n    throw new Error(\"ReCap caveats must contain only JSON values.\");\n  };\n  const branches = (caveats ?? []).map(canonicalize).sort();\n  if (branches.length === 0 || (branches.length === 1 && branches[0] === \"{}\")) {\n    return \"[]\";\n  }\n  return `[${branches.join(\",\")}]`;\n}\n\n/** Return whether a granted action pattern covers one requested action. */\nexport function actionContains(grantedAction: string, requestedAction: string): boolean {\n  if (grantedAction === \"*\" || grantedAction === requestedAction) return true;\n  if (!grantedAction.endsWith(\"/*\")) return false;\n  const service = grantedAction.slice(0, -2);\n  return requestedAction === service || requestedAction.startsWith(`${service}/`);\n}\n\n/**\n * Path containment per spec:\n * - `granted.path` ends with `/` → prefix match (requested starts with granted)\n * - otherwise → exact string match\n *\n * The empty string is treated as \"no path constraint\" and matches anything.\n * The single-character `\"/\"` also matches anything (it is a trailing-slash\n * prefix of zero-length).\n */\nfunction pathContains(grantedPath: string, requestedPath: string): boolean {\n  if (grantedPath === \"\" || grantedPath === \"/\") {\n    return true;\n  }\n  if (grantedPath.endsWith(\"/\")) {\n    return requestedPath.startsWith(grantedPath);\n  }\n  return requestedPath === grantedPath;\n}\n\nfunction cloneEntry(entry: PermissionEntry): PermissionEntry {\n  return {\n    service: entry.service,\n    ...(entry.space !== undefined ? { space: entry.space } : {}),\n    path: entry.path,\n    actions: [...entry.actions],\n    ...(entry.caveats !== undefined\n      ? { caveats: JSON.parse(JSON.stringify(entry.caveats)) as Record<string, unknown>[] }\n      : {}),\n    ...(entry.skipPrefix !== undefined ? { skipPrefix: entry.skipPrefix } : {}),\n    ...(entry.expiry !== undefined ? { expiry: entry.expiry } : {}),\n  };\n}\n\n// ---------------------------------------------------------------------------\n// Recap parsing (WASM wrapper)\n// ---------------------------------------------------------------------------\n\n/**\n * The raw shape returned from the WASM `parseRecapFromSiwe` export. The\n * Rust layer encodes the service in the short form (e.g. `\"kv\"`) because\n * that is what the SIWE recap resource URI actually contains. We normalize\n * to the manifest long form (`\"tinycloud.kv\"`) in {@link parseRecapCapabilities}.\n *\n * @internal\n */\nexport interface WasmRecapEntry {\n  service: string;\n  space: string;\n  path: string;\n  actions: string[];\n  /** Exact ReCap caveats shared by every action in this entry. */\n  caveats?: Record<string, unknown>[];\n}\n\n/**\n * Signature of the WASM `parseRecapFromSiwe` export. Accepts the signed\n * SIWE message string and returns an array of raw recap entries. Throws if\n * the SIWE is malformed or the recap statement has been tampered.\n *\n * Exposed as an interface so the SDK can inject the web or node binding\n * without `capabilities.ts` needing to know which.\n */\nexport type ParseRecapFromSiwe = (siweString: string) => WasmRecapEntry[];\n\n/**\n * Parse a signed SIWE message into an array of {@link PermissionEntry}\n * objects in the canonical long-form manifest shape.\n *\n * This is a thin wrapper around the WASM `parseRecapFromSiwe` export that:\n * 1. Normalizes short-form services (`\"kv\"`) to long-form (`\"tinycloud.kv\"`).\n * 2. Returns entries in a deterministic order (sorted by space, then service,\n *    then path) so downstream equality checks are stable.\n *\n * Returns an empty array when the SIWE has no recap resource (plain auth\n * SIWE); this matches the WASM function's behavior and the spec.\n *\n * @param parseWasm The WASM `parseRecapFromSiwe` binding.\n * @param siwe The signed SIWE message string (exactly what `session.siwe` stores).\n */\nexport function parseRecapCapabilities(\n  parseWasm: ParseRecapFromSiwe,\n  siwe: string\n): PermissionEntry[] {\n  const raw = parseWasm(siwe);\n  if (!Array.isArray(raw)) {\n    throw new Error(\n      \"parseRecapFromSiwe returned a non-array value; wasm binding may be out of sync\"\n    );\n  }\n  const normalized: PermissionEntry[] = raw.map((entry) => {\n    const longService =\n      SERVICE_SHORT_TO_LONG[entry.service] ??\n      // Unknown short names pass through. If the recap already contained a\n      // long-form service (e.g. a future tinycloud-node version emits long\n      // form directly), don't double-prefix.\n      (entry.service.startsWith(\"tinycloud.\")\n        ? entry.service\n        : `tinycloud.${entry.service}`);\n    return {\n      service: longService,\n      // The Rust layer emits the space as a full `tinycloud:pkh:...:name`\n      // URI (the recap target URI). Normalize to the short name so the\n      // returned entries match the shape manifests use.\n      space: normalizeSpace(entry.space),\n      path: entry.path,\n      actions: [...entry.actions],\n      ...(entry.caveats === undefined\n        ? {}\n        : { caveats: JSON.parse(JSON.stringify(entry.caveats)) as Record<string, unknown>[] }),\n    };\n  });\n\n  // Sort for determinism (callers do equality checks on arrays of entries\n  // in tests; deterministic ordering keeps those stable).\n  normalized.sort((a, b) => {\n    const aSpace = a.space ?? DEFAULT_MANIFEST_SPACE;\n    const bSpace = b.space ?? DEFAULT_MANIFEST_SPACE;\n    if (aSpace !== bSpace) return aSpace < bSpace ? -1 : 1;\n    if (a.service !== b.service) return a.service < b.service ? -1 : 1;\n    if (a.path !== b.path) return a.path < b.path ? -1 : 1;\n    return 0;\n  });\n\n  return normalized;\n}\n","import {\n  canonicalizeRecapCaveats,\n  isCapabilitySubset,\n  type PermissionEntry,\n} from \"@tinycloud/sdk-core\";\n\n/**\n * A capability in the canonical form persisted in a v1 request artifact.\n *\n * The SDK remains the semantic authority for containment. This module only\n * establishes deterministic exact identity for persistence and display.\n */\nexport type CanonicalPermissionEntry = Readonly<PermissionEntry>;\n\nexport interface AuthorityEvaluation {\n  readonly satisfied: boolean;\n  readonly missing: readonly CanonicalPermissionEntry[];\n}\n\n/**\n * Operation-owned space resolution. The SDK's general capability evaluator\n * intentionally preserves its historical short/full-space compatibility; the\n * operation kernel supplies this narrower resolver when a space identifies a\n * remote owner's resource.\n */\nexport type OperationSpaceResolver = (space: string) => string;\n\nconst EXACT_PERMISSION_KEYS = new Set([\n  \"service\",\n  \"space\",\n  \"path\",\n  \"actions\",\n  \"skipPrefix\",\n  \"expiry\",\n  \"description\",\n]);\n\n/**\n * Validate requirements that can be represented without semantic broadening in\n * a v1 artifact. Caveated authority is intentionally rejected: the v1 request\n * schema and grant path cannot preserve those signed branches end-to-end.\n */\nexport function validateExactCapabilities(value: unknown): PermissionEntry[] | undefined {\n  if (!Array.isArray(value)) return undefined;\n\n  const permissions: PermissionEntry[] = [];\n  for (const candidate of value) {\n    if (!isExactPermission(candidate)) return undefined;\n    permissions.push(candidate);\n  }\n  return canonicalizeCapabilities(permissions);\n}\n\n/**\n * Evaluates required authority with the SDK's public subset primitive.\n *\n * In particular, this intentionally does not implement matching rules or\n * manufacture wildcards. A wildcard can cover a requirement only when it was\n * already present in the supplied granted authority and the SDK says so.\n */\nexport function evaluateAuthority(\n  granted: readonly PermissionEntry[],\n  required: readonly PermissionEntry[],\n): AuthorityEvaluation {\n  const canonicalGranted = canonicalizeCapabilities(granted);\n  const canonicalRequired = canonicalizeCapabilities(required);\n  const result = isCapabilitySubset(canonicalRequired, canonicalGranted);\n\n  return {\n    satisfied: result.subset,\n    missing: canonicalizeCapabilities(result.missing),\n  };\n}\n\n/**\n * Evaluate operation capabilities without allowing two owners' same-named\n * spaces to compare equal. Path and action containment still come from the\n * SDK primitive; only the operation space identity is made owner-exact.\n */\nexport function evaluateOperationAuthority(\n  granted: readonly PermissionEntry[],\n  required: readonly PermissionEntry[],\n  resolveSpace?: OperationSpaceResolver,\n): AuthorityEvaluation {\n  const canonicalGranted = canonicalizeOperationCapabilities(granted, resolveSpace);\n  const canonicalRequired = canonicalizeOperationCapabilities(required, resolveSpace);\n  const missing: CanonicalPermissionEntry[] = [];\n\n  for (const requested of canonicalRequired) {\n    const covered = canonicalGranted.some((candidate) =>\n      candidate.service === requested.service &&\n      operationSpacesEqual(candidate.space, requested.space) &&\n      isCapabilitySubset([requested], [candidate]).subset,\n    );\n    if (!covered) missing.push(requested);\n  }\n\n  return {\n    satisfied: missing.length === 0,\n    missing: canonicalizeCapabilities(missing),\n  };\n}\n\n/**\n * Whether a delegation's signed capabilities stay inside the stored request\n * it answers. `tinycloud.auth.import` and runtime replay share this check, so\n * a delegation import accepts is never one replay discards.\n */\nexport function delegationWithinRequest(\n  requested: readonly PermissionEntry[],\n  effective: readonly PermissionEntry[],\n  resolveSpace?: OperationSpaceResolver,\n): boolean {\n  return requested.length > 0 &&\n    evaluateOperationAuthority(requested, canonicalizeCapabilities(effective), resolveSpace).satisfied;\n}\n\n/**\n * Validate a runtime hint as an exact member of the registered plan. Runtime\n * nodes may report the one phase that failed, but they may not introduce a\n * broader, differently-owned, caveated, or otherwise new capability.\n */\nexport function isExactCapabilityMemberSubset(\n  hinted: readonly PermissionEntry[],\n  planned: readonly PermissionEntry[],\n  resolveSpace?: OperationSpaceResolver,\n): boolean {\n  const canonicalHinted = canonicalizeOperationCapabilities(hinted, resolveSpace);\n  const canonicalPlanned = canonicalizeOperationCapabilities(planned, resolveSpace);\n  return canonicalHinted.length > 0 && canonicalHinted.every((hint) => canonicalPlanned.some((plan) =>\n    JSON.stringify(hint) === JSON.stringify(plan),\n  ));\n}\n\n/** Canonical identity used by operation preflight, hints, and artifacts. */\nexport function canonicalizeOperationCapabilities(\n  permissions: readonly PermissionEntry[],\n  resolveSpace?: OperationSpaceResolver,\n): CanonicalPermissionEntry[] {\n  return canonicalizeCapabilities(permissions.map((permission) => {\n    const canonicalPath = canonicalizeOperationPath(permission);\n    if (permission.space === undefined || resolveSpace === undefined) {\n      return canonicalPath;\n    }\n    try {\n      return { ...canonicalPath, space: resolveSpace(permission.space) };\n    } catch {\n      // An unresolvable identity remains a non-matching literal. It must never\n      // be widened to a wildcard or to another authenticated owner.\n      return canonicalPath;\n    }\n  }));\n}\n\nfunction canonicalizeOperationPath(permission: PermissionEntry): PermissionEntry {\n  if (permission.service !== \"tinycloud.encryption\") return permission;\n  const match = permission.path.match(\n    /^(urn:tinycloud:encryption:did:pkh:eip155:\\d+:)(0x[0-9a-fA-F]{40})(:.*)$/,\n  );\n  if (!match) return permission;\n  return { ...permission, path: `${match[1]}${match[2]!.toLowerCase()}${match[3]}` };\n}\n\nfunction operationSpacesEqual(\n  granted: string | undefined,\n  requested: string | undefined,\n): boolean {\n  return granted === requested;\n}\n\n/** Returns a stable exact identity for one capability without containment. */\nexport function permissionIdentity(permission: PermissionEntry): string {\n  return JSON.stringify(canonicalizeCapability(permission));\n}\n\n/**\n * Sorts actions and entries and removes only exactly-identical capabilities.\n * It does not coalesce paths, services, spaces, or actions into a broader\n * capability.\n */\nexport function canonicalizeCapabilities(\n  permissions: readonly PermissionEntry[],\n): CanonicalPermissionEntry[] {\n  const byIdentity = new Map<string, CanonicalPermissionEntry>();\n  for (const permission of permissions) {\n    const canonical = canonicalizeCapability(permission);\n    byIdentity.set(permissionIdentityFromCanonical(canonical), canonical);\n  }\n\n  return [...byIdentity.entries()]\n    .sort(([left], [right]) => left.localeCompare(right))\n    .map(([, permission]) => permission);\n}\n\nfunction canonicalizeCapability(permission: PermissionEntry): CanonicalPermissionEntry {\n  const actions = [...new Set(permission.actions)].sort((left, right) => left.localeCompare(right));\n  return {\n    service: permission.service,\n    ...(permission.space !== undefined ? { space: permission.space } : {}),\n    path: permission.path,\n    actions,\n    ...(permission.skipPrefix !== undefined ? { skipPrefix: permission.skipPrefix } : {}),\n    ...(permission.expiry !== undefined ? { expiry: permission.expiry } : {}),\n    ...(permission.description !== undefined ? { description: permission.description } : {}),\n    ...(permission.caveats === undefined\n      ? {}\n      : { caveats: canonicalizeCaveats(permission.caveats) }),\n  };\n}\n\nfunction permissionIdentityFromCanonical(permission: CanonicalPermissionEntry): string {\n  return JSON.stringify({\n    service: permission.service,\n    ...(permission.space !== undefined ? { space: permission.space } : {}),\n    path: permission.path,\n    actions: permission.actions,\n    ...(permission.skipPrefix !== undefined ? { skipPrefix: permission.skipPrefix } : {}),\n    ...(permission.expiry !== undefined ? { expiry: permission.expiry } : {}),\n    ...(permission.description !== undefined ? { description: permission.description } : {}),\n    ...(permission.caveats === undefined ? {} : { caveats: permission.caveats }),\n  });\n}\n\nfunction isExactPermission(value: unknown): value is PermissionEntry {\n  if (\n    !isExactRecord(value) ||\n    Object.getOwnPropertyNames(value).some((key) => !EXACT_PERMISSION_KEYS.has(key)) ||\n    Object.getOwnPropertySymbols(value).length > 0\n  ) {\n    return false;\n  }\n  if (\n    !isExactText(value.service) ||\n    !isExactPath(value.path, value.actions) ||\n    (value.space !== undefined && !isExactText(value.space)) ||\n    !Array.isArray(value.actions) ||\n    value.actions.length === 0 ||\n    !value.actions.every(isExactText) ||\n    new Set(value.actions).size !== value.actions.length ||\n    value.skipPrefix === true ||\n    (value.skipPrefix !== undefined && value.skipPrefix !== false) ||\n    (value.expiry !== undefined && !isExactText(value.expiry)) ||\n    (value.description !== undefined && !isExactText(value.description))\n  ) {\n    return false;\n  }\n  return !(\"caveats\" in value);\n}\n\nfunction isExactRecord(value: unknown): value is Record<string, unknown> {\n  if (typeof value !== \"object\" || value === null || Array.isArray(value)) return false;\n  const prototype = Object.getPrototypeOf(value);\n  return prototype === Object.prototype || prototype === null;\n}\n\nfunction isExactText(value: unknown): value is string {\n  return typeof value === \"string\" && value.length > 0 && !value.includes(\"*\");\n}\n\nfunction isExactPath(value: unknown, actions: unknown): value is string {\n  if (typeof value !== \"string\" || value === \"/\" || value.includes(\"*\")) return false;\n  if (value === \"\" || value.endsWith(\"/\")) {\n    return Array.isArray(actions) && actions.includes(\"tinycloud.kv/list\");\n  }\n  return true;\n}\n\nfunction canonicalizeCaveats(\n  caveats: readonly Record<string, unknown>[],\n): Record<string, unknown>[] {\n  return [...caveats]\n    .map((caveat) => ({\n      identity: canonicalizeRecapCaveats([caveat]),\n      value: JSON.parse(JSON.stringify(caveat)) as Record<string, unknown>,\n    }))\n    .sort((left, right) => left.identity.localeCompare(right.identity))\n    .map(({ value }) => value);\n}\n","import { randomUUID } from \"node:crypto\";\nimport { AsyncLocalStorage } from \"node:async_hooks\";\nimport {\n  chmod,\n  link,\n  mkdir,\n  open,\n  readFile,\n  readdir,\n  rename,\n  rmdir,\n  rm,\n  stat,\n  unlink,\n  writeFile,\n} from \"node:fs/promises\";\nimport { homedir } from \"node:os\";\nimport { basename, dirname, isAbsolute, join, relative, resolve } from \"node:path\";\n\nconst DEFAULT_PROFILE = \"default\";\nconst DEFAULT_LOCK_TIMEOUT_MS = 2_000;\nconst DEFAULT_LOCK_RETRY_MS = 25;\nconst DEFAULT_STALE_LOCK_MS = 30_000;\nconst TEST_LOCK_CONTENTION_SIGNAL_PATH = \"TC_TEST_PROFILE_LOCK_CONTENTION_SIGNAL_PATH\";\n// Profile state holds keys, sessions and delegations: owner-only access.\nconst PRIVATE_FILE_MODE = 0o600;\nconst PRIVATE_DIR_MODE = 0o700;\nconst TEST_LOCK_RECOVERY_BARRIER_DIR = \"TC_TEST_PROFILE_LOCK_RECOVERY_BARRIER_DIR\";\nconst TEST_LOCK_OWNERLESS_BARRIER_DIR = \"TC_TEST_PROFILE_LOCK_OWNERLESS_BARRIER_DIR\";\nconst TEST_LOCK_PUBLISH_BARRIER_DIR = \"TC_TEST_PROFILE_LOCK_PUBLISH_BARRIER_DIR\";\nconst TEST_LOCK_RELEASE_BARRIER_DIR = \"TC_TEST_PROFILE_LOCK_RELEASE_BARRIER_DIR\";\nconst TEST_LOCK_CLAIM_BARRIER_DIR = \"TC_TEST_PROFILE_LOCK_CLAIM_BARRIER_DIR\";\nconst TEST_LOCK_CLAIMED_BARRIER_DIR = \"TC_TEST_PROFILE_LOCK_CLAIMED_BARRIER_DIR\";\nconst TEST_LOCK_VERIFIED_BARRIER_DIR = \"TC_TEST_PROFILE_LOCK_VERIFIED_BARRIER_DIR\";\nconst TEST_LOCK_MOVED_BARRIER_DIR = \"TC_TEST_PROFILE_LOCK_MOVED_BARRIER_DIR\";\nconst TEST_LOCK_TURN_PUBLISH_BARRIER_DIR = \"TC_TEST_PROFILE_LOCK_TURN_PUBLISH_BARRIER_DIR\";\nconst TEST_LOCK_TURN_SETTLE_BARRIER_DIR = \"TC_TEST_PROFILE_LOCK_TURN_SETTLE_BARRIER_DIR\";\nconst TEST_LOCK_TURN_COLLECT_BARRIER_DIR = \"TC_TEST_PROFILE_LOCK_TURN_COLLECT_BARRIER_DIR\";\n/** One acquisition of a profile lock; `active` is cleared before release. */\ninterface HeldProfileLock {\n  readonly lockPath: string;\n  /** The number of the turn this acquisition holds (see acquireTurn). */\n  readonly turnSlot: number;\n  /** A deletion of the profile ran while this acquisition waited for the lock. */\n  readonly deletedWhileWaiting: boolean;\n  active: boolean;\n}\n/**\n * Async context shared by every copy of this module in the process. Each\n * bundled operations entry point (`state`, `delegation-binding`, the root)\n * carries its own copy, so module-level context would make lock reentrancy and\n * the invocation state root stop at an entry-point boundary.\n * Each key is independently versioned for the shape and meaning of the\n * value it stores. Held-lock entries gained `turnSlot` and\n * `deletedWhileWaiting` in TC-633, so `.v2` must not read TC-602's `.v1`\n * entries. The invocation root remains a string path with unchanged\n * semantics and stays `.v1`. Relinquished turn tokens use a separate\n * versioned process-wide key: only an explicitly given-up turn of this PID\n * may be settled across separately bundled entry points.\n */\nfunction processWideContext<T>(key: string): AsyncLocalStorage<T> {\n  const registry = globalThis as unknown as Record<symbol, AsyncLocalStorage<T> | undefined>;\n  return registry[Symbol.for(key)] ??= new AsyncLocalStorage<T>();\n}\nconst invocationStateRoot = processWideContext<string>(\"tinycloud.operations.invocationStateRoot.v1\");\n/** Profile lock acquisitions held by the current async call chain (see withProfileLock). */\nconst heldProfileLocks = processWideContext<readonly HeldProfileLock[]>(\"tinycloud.operations.heldProfileLocks.v2\");\n\nexport type ProfileStoreName =\n  | \"session\"\n  | \"additional-delegations\"\n  | \"auth-requests\";\n\nexport interface StoreMetadata {\n  formatVersion: number;\n}\n\nexport interface ProfileStoreContents<T> {\n  formatVersion: number;\n  records: T[];\n}\n\nexport interface ProfileLockOptions {\n  timeoutMs?: number;\n  retryMs?: number;\n  staleAfterMs?: number;\n}\n\nexport class ProfileLockTimeoutError extends Error {\n  readonly code = \"PROFILE_LOCK_TIMEOUT\";\n\n  /** `detail` names the cause when it is not simply another process holding the lock. */\n  constructor(profile: string, timeoutMs: number, detail?: string) {\n    super(`Timed out waiting for the profile lock for \"${profile}\" after ${timeoutMs}ms.${detail ? ` ${detail}` : \"\"}`);\n    this.name = \"ProfileLockTimeoutError\";\n  }\n}\n\n/**\n * A store write that waited for the profile lock while a deletion of that\n * profile held it, and found no profile settings once it got the lock. The\n * write is refused rather than recreating a profile with only a session or\n * store in it.\n */\nexport class ProfileDeletedError extends Error {\n  readonly code = \"PROFILE_NOT_FOUND\";\n\n  constructor(profile: string) {\n    super(`Profile \"${profile}\" was deleted while this change waited for its lock, so the change was not written.`);\n    this.name = \"ProfileDeletedError\";\n  }\n}\n\n/**\n * The CLI's delegated-secret path treats TC_HOME as a home directory, rather\n * than a direct TinyCloud directory. Keep the shared store on that convention.\n */\nexport function tinycloudHomePath(): string {\n  const home = invocationStateRoot.getStore() ??\n    process.env.TC_HOME ??\n    process.env.HOME ??\n    process.env.USERPROFILE ??\n    homedir();\n  return join(home, \".tinycloud\");\n}\n\n/** Run one operation against an isolated TinyCloud home directory. */\nexport function withTinyCloudStateRoot<T>(\n  stateRoot: string | undefined,\n  action: () => Promise<T>,\n): Promise<T> {\n  if (stateRoot === undefined) return action();\n  if (!isAbsolute(stateRoot) || stateRoot.includes(\"\\0\")) {\n    throw new TypeError(\"The TinyCloud state root must be an absolute path.\");\n  }\n  return invocationStateRoot.run(resolve(stateRoot), action);\n}\n\nexport function tinycloudConfigPath(): string {\n  return join(tinycloudHomePath(), \"config.json\");\n}\n\nexport function profilesPath(): string {\n  return join(tinycloudHomePath(), \"profiles\");\n}\n\nexport function profilePath(profile: string): string {\n  return join(profilesPath(), validateProfileName(profile));\n}\n\nexport function profileConfigPath(profile: string): string {\n  return join(profilePath(profile), \"profile.json\");\n}\n\nexport function sessionPath(profile: string): string {\n  return profileStorePath(profile, \"session\");\n}\n\nexport function additionalDelegationsPath(profile: string): string {\n  return profileStorePath(profile, \"additional-delegations\");\n}\n\nexport function authRequestsPath(profile: string): string {\n  return profileStorePath(profile, \"auth-requests\");\n}\n\nexport function profileStorePath(profile: string, store: ProfileStoreName): string {\n  return join(profilePath(profile), `${store}.json`);\n}\n\n/** The format record is deliberately separate from each legacy JSON payload. */\nexport function profileStoreMetadataPath(profile: string, store: ProfileStoreName): string {\n  return `${profileStorePath(profile, store)}.metadata.json`;\n}\n\nexport function profileLockPath(profile: string): string {\n  return join(profilePath(profile), \".lock\");\n}\n\nexport function profileLockMetadataPath(profile: string): string {\n  return join(profileLockPath(profile), \"owner.json\");\n}\n\n/**\n * The turn lock of a profile (see acquireTurn). It lives outside the profile\n * directory, so neither a profile deletion nor an older release's cleanup\n * removes it.\n */\nexport function profileTurnLockPath(profile: string): string {\n  return join(tinycloudHomePath(), \"profile-locks\", validateProfileName(profile));\n}\n\n/**\n * Reads JSON without hiding malformed or inaccessible files. A missing file is\n * the only condition represented as null.\n */\nexport async function readJson<T>(filePath: string): Promise<T | null> {\n  try {\n    return JSON.parse(await readFile(filePath, \"utf8\")) as T;\n  } catch (error) {\n    if (isErrno(error, \"ENOENT\")) return null;\n    throw error;\n  }\n}\n\n/**\n * Writes the same pretty-printed, trailing-newline JSON shape used by the CLI,\n * but publishes it with an atomic rename from the same directory.\n */\nexport async function writeJsonAtomic(filePath: string, value: unknown): Promise<void> {\n  await replaceJson(filePath, value, false);\n}\n\n/**\n * writeJsonAtomic; `durable` also flushes the data to disk before the rename,\n * so a crash or power loss leaves the old record or the new one, never a\n * truncated one (for lock records, whose damage would stop every writer).\n */\nasync function replaceJson(filePath: string, value: unknown, durable: boolean): Promise<void> {\n  const directory = dirname(filePath);\n  const temporaryPath = join(\n    directory,\n    `.${basename(filePath)}.${process.pid}.${randomUUID()}.tmp`,\n  );\n  const contents = `${JSON.stringify(value, null, 2)}\\n`;\n\n  await mkdir(directory, { recursive: true, mode: PRIVATE_DIR_MODE });\n  try {\n    if (durable) await writeFileDurably(temporaryPath, contents);\n    else await writeFile(temporaryPath, contents, { encoding: \"utf8\", mode: PRIVATE_FILE_MODE });\n    await rename(temporaryPath, filePath);\n  } catch (error) {\n    await rm(temporaryPath, { force: true }).catch(() => undefined);\n    throw error;\n  }\n}\n\n/** Creates a file (exclusively) and, when it has contents, flushes them to disk. */\nasync function writeFileDurably(path: string, contents: string): Promise<void> {\n  const handle = await open(path, \"wx\", PRIVATE_FILE_MODE);\n  try {\n    if (contents) {\n      await handle.writeFile(contents, \"utf8\");\n      await handle.datasync();\n    }\n  } finally {\n    await handle.close();\n  }\n}\n\nexport async function readProfile<T extends object = Record<string, unknown>>(\n  profile: string,\n): Promise<T | null> {\n  return readJson<T>(profileConfigPath(profile));\n}\n\nexport async function readSession<T extends object = Record<string, unknown>>(\n  profile: string,\n): Promise<T | null> {\n  await readStoreMetadata(profile, \"session\");\n  return readJson<T>(sessionPath(profile));\n}\n\nexport async function readAdditionalDelegations<T = Record<string, unknown>>(\n  profile: string,\n): Promise<T[]> {\n  return (await readProfileStore<T>(profile, \"additional-delegations\")).records;\n}\n\nexport async function readAuthRequests<T = Record<string, unknown>>(\n  profile: string,\n): Promise<T[]> {\n  return (await readProfileStore<T>(profile, \"auth-requests\")).records;\n}\n\nexport async function readStoreMetadata(\n  profile: string,\n  store: ProfileStoreName,\n): Promise<StoreMetadata> {\n  const metadata = await readJson<StoreMetadata>(profileStoreMetadataPath(profile, store));\n  if (metadata === null) return { formatVersion: 1 };\n  if (\n    typeof metadata !== \"object\" ||\n    metadata.formatVersion !== 1\n  ) {\n    throw new TypeError(`Unsupported store format for \"${store}\".`);\n  }\n  return metadata;\n}\n\nexport async function readProfileStore<T>(\n  profile: string,\n  store: Exclude<ProfileStoreName, \"session\">,\n): Promise<ProfileStoreContents<T>> {\n  const [metadata, raw] = await Promise.all([\n    readStoreMetadata(profile, store),\n    readJson<unknown>(profileStorePath(profile, store)),\n  ]);\n  return {\n    formatVersion: metadata.formatVersion,\n    records: Array.isArray(raw) ? raw as T[] : [],\n  };\n}\n\n/**\n * Runs a small critical section under the one lock shared by all profile\n * stores (see acquireProfileLock). Lock release verifies its ownership token\n * before removing the exact metadata instance it acquired.\n *\n * Reentrant within one async call chain: a critical section that already\n * holds a profile's lock (for example a login's compare-and-commit) can call\n * store writers that take the same lock without deadlocking. Ownership is\n * keyed by the resolved lock path (so switching state roots inside a lock\n * still takes the other root's lock) and lasts exactly as long as the\n * acquisition: it is revoked before release, so work deferred past the\n * critical section waits for the lock like any other caller.\n */\nexport async function withProfileLock<T>(\n  profile: string,\n  action: () => Promise<T>,\n  options: ProfileLockOptions = {},\n): Promise<T> {\n  const normalizedProfile = validateProfileName(profile);\n  const lockPath = profileLockPath(normalizedProfile);\n  const held = (heldProfileLocks.getStore() ?? []).filter((ownership) => ownership.active);\n  if (held.some((ownership) => ownership.lockPath === lockPath)) return action();\n  const acquired = await acquireProfileLock(normalizedProfile, options);\n  const ownership: HeldProfileLock = {\n    lockPath,\n    turnSlot: acquired.turnSlot,\n    deletedWhileWaiting: acquired.deletedWhileWaiting,\n    active: true,\n  };\n  try {\n    return await heldProfileLocks.run([...held, ownership], action);\n  } finally {\n    ownership.active = false;\n    await acquired.release();\n    // Taking the lock recreated the deleted profile's directory; remove it\n    // again unless something was written into it (rmdir needs it empty).\n    if (acquired.deletedWhileWaiting) await rmdir(profilePath(normalizedProfile)).catch(() => undefined);\n  }\n}\n\n/**\n * Records, inside a profile deletion's critical section and after its files\n * are gone, that the profile was deleted, with the number of the deleting\n * turn. A store write whose wait overlapped that turn (it arrived before the\n * deletion released the lock, whether before or after this record) then\n * refuses (ProfileDeletedError) instead of recreating a profile with only a\n * session or store in it. The caller must hold the profile's lock.\n */\nexport async function recordProfileDeletion(profile: string): Promise<void> {\n  const lockPath = profileLockPath(profile);\n  const ownership = (heldProfileLocks.getStore() ?? []).find((candidate) => candidate.active && candidate.lockPath === lockPath);\n  if (!ownership) throw new Error(`Recording the deletion of profile \"${profile}\" requires holding its lock.`);\n  await replaceJson(join(profileTurnLockPath(profile), \"deleted.json\"), { slot: ownership.turnSlot }, true);\n}\n\n/**\n * Refuses a write that would recreate a profile deleted while this critical\n * section waited for the lock (ProfileDeletedError). Every writer of profile\n * state other than the profile settings themselves calls this inside its\n * critical section, before writing. The caller must hold the profile's lock.\n */\nexport async function refuseWriteToDeletedProfile(profile: string): Promise<void> {\n  const lockPath = profileLockPath(profile);\n  const ownership = (heldProfileLocks.getStore() ?? []).find((candidate) => candidate.active && candidate.lockPath === lockPath);\n  if (!ownership?.deletedWhileWaiting) return;\n  // Recreated meanwhile (or by this critical section): writing is fine.\n  if (await exists(profileConfigPath(profile))) return;\n  throw new ProfileDeletedError(profile);\n}\n\n/**\n * Appends a record or replaces the existing record with the supplied explicit\n * key. The extractor is supplied by the owning store so state.ts never needs\n * to know permission-request or delegation record shapes.\n */\nexport async function upsertProfileRecord<T>(\n  profile: string,\n  store: Exclude<ProfileStoreName, \"session\">,\n  key: string,\n  record: T,\n  getKey: (candidate: T) => string | undefined,\n  options: ProfileLockOptions = {},\n): Promise<T[]> {\n  if (!key) throw new TypeError(\"A non-empty record key is required.\");\n\n  return withProfileLock(profile, async () => {\n    await refuseWriteToDeletedProfile(profile);\n    const current = (await readProfileStore<T>(profile, store)).records;\n    const next = current.filter((candidate) => getKey(candidate) !== key);\n    next.push(record);\n    await writeJsonAtomic(profileStorePath(profile, store), next);\n    await writeFormatOneMetadata(profile, store);\n    return next;\n  }, options);\n}\n\n/**\n * Performs a typed read-modify-write of a legacy array store under the one\n * per-profile lock. The payload stays an array and the sibling metadata stays\n * format 1, so existing CLI readers keep their byte/layout contract.\n */\nexport async function updateProfileStore<T, Result>(\n  profile: string,\n  store: Exclude<ProfileStoreName, \"session\">,\n  update: (\n    records: readonly T[],\n  ) => Promise<{ readonly records: readonly T[]; readonly result: Result }> | {\n    readonly records: readonly T[];\n    readonly result: Result;\n  },\n  options: ProfileLockOptions = {},\n): Promise<Result> {\n  return withProfileLock(\n    profile,\n    () => updateProfileStoreWhileLocked(profile, store, update),\n    options,\n  );\n}\n\n/** The caller must already own this profile's lock. */\nasync function updateProfileStoreWhileLocked<T, Result>(\n  profile: string,\n  store: Exclude<ProfileStoreName, \"session\">,\n  update: (\n    records: readonly T[],\n  ) => Promise<{ readonly records: readonly T[]; readonly result: Result }> | {\n    readonly records: readonly T[];\n    readonly result: Result;\n  },\n): Promise<Result> {\n  await refuseWriteToDeletedProfile(profile);\n  const current = await readProfileStore<T>(profile, store);\n  const next = await update(current.records);\n  await writeJsonAtomic(profileStorePath(profile, store), next.records);\n  await writeFormatOneMetadata(profile, store);\n  return next.result;\n}\n\nexport async function writeSession<T extends object>(\n  profile: string,\n  session: T,\n  options: ProfileLockOptions = {},\n): Promise<void> {\n  await withProfileLock(profile, async () => {\n    await refuseWriteToDeletedProfile(profile);\n    await readStoreMetadata(profile, \"session\");\n    await writeJsonAtomic(sessionPath(profile), session);\n    await writeFormatOneMetadata(profile, \"session\");\n  }, options);\n}\n\nexport async function removeSession(\n  profile: string,\n  options: ProfileLockOptions = {},\n): Promise<void> {\n  await withProfileLock(profile, async () => {\n    await readStoreMetadata(profile, \"session\");\n    await rm(sessionPath(profile), { force: true });\n  }, options);\n}\n\nasync function writeFormatOneMetadata(profile: string, store: ProfileStoreName): Promise<void> {\n  await writeJsonAtomic(profileStoreMetadataPath(profile, store), { formatVersion: 1 });\n}\n\ninterface AcquiredProfileLock {\n  readonly deletedWhileWaiting: boolean;\n  readonly turnSlot: number;\n  release(): Promise<void>;\n}\n\ninterface LockDeadline {\n  readonly startedAt: number;\n  readonly timeoutMs: number;\n  readonly retryMs: number;\n}\n\n/**\n * Takes a profile's lock in two layers:\n *\n * 1. The turn lock (acquireTurn), used by this release and later ones. It\n *    decides nothing from elapsed time, so a process paused anywhere, for\n *    any length of time, cannot let a second holder in.\n * 2. Holding a turn, the `.lock` directory every older release uses\n *    (publishProfileLock), so they keep excluding this release and it them.\n *    Only one process of this release at a time acquires, recovers or\n *    releases `.lock`.\n *\n * Also reports whether a profile deletion (recordProfileDeletion) ran while\n * this acquisition waited.\n */\nasync function acquireProfileLock(\n  profile: string,\n  options: ProfileLockOptions,\n): Promise<AcquiredProfileLock> {\n  const deadline: LockDeadline = {\n    startedAt: Date.now(),\n    timeoutMs: options.timeoutMs ?? DEFAULT_LOCK_TIMEOUT_MS,\n    retryMs: options.retryMs ?? DEFAULT_LOCK_RETRY_MS,\n  };\n  const staleAfterMs = options.staleAfterMs ?? DEFAULT_STALE_LOCK_MS;\n  const lockPath = profileLockPath(profile);\n  const turnDirectory = profileTurnLockPath(profile);\n\n  const directory = profilePath(profile);\n  await mkdir(directory, { recursive: true, mode: PRIVATE_DIR_MODE });\n  await mkdir(dirname(turnDirectory), { recursive: true, mode: PRIVATE_DIR_MODE });\n  // Every store write takes this lock: tighten the tree older releases\n  // created 0775 before writing sessions or delegations into it.\n  for (const path of [tinycloudHomePath(), profilesPath(), directory]) {\n    await chmod(path, PRIVATE_DIR_MODE).catch((error: unknown) => {\n      // A profile deletion can remove the profile directory right after the\n      // mkdir above; the lock attempt below recreates it 0700.\n      if (path !== directory || !isErrno(error, \"ENOENT\")) throw error;\n    });\n  }\n\n  const { turn, firstWaitedTurn } = await acquireTurn(profile, turnDirectory, deadline);\n  try {\n    // An unreadable deletion record is ignored rather than failing every\n    // acquisition; it is written durably, so only damage makes it so.\n    const deletion = await readJson<{ slot?: unknown }>(join(turnDirectory, \"deleted.json\")).catch(() => null);\n    const deletedWhileWaiting = typeof deletion?.slot === \"number\" && deletion.slot >= firstWaitedTurn;\n    while (true) {\n      const token = randomUUID();\n      if (await publishProfileLock(profile, lockPath, token)) {\n        return {\n          deletedWhileWaiting,\n          turnSlot: turn.slot,\n          release: async () => {\n            try {\n              await releaseProfileLock(profile, lockPath, token);\n            } finally {\n              await releaseTurn(profile, turn);\n            }\n          },\n        };\n      }\n      await signalTestLockContention(profile);\n      if (await recoverStaleLock(profile, lockPath, staleAfterMs)) continue;\n      await waitOrTimeOut(profile, deadline);\n    }\n  } catch (error) {\n    await releaseTurn(profile, turn);\n    throw error;\n  }\n}\n\n/** Throws once the acquisition's time is up; `detail` explains a damaged turn lock. */\nfunction checkDeadline(profile: string, deadline: LockDeadline, detail?: string): void {\n  if (Date.now() - deadline.startedAt >= deadline.timeoutMs) {\n    throw new ProfileLockTimeoutError(profile, deadline.timeoutMs, detail);\n  }\n}\n\n/** Sleeps one retry interval, or throws once the acquisition's time is up. */\nasync function waitOrTimeOut(profile: string, deadline: LockDeadline, detail?: string): Promise<void> {\n  checkDeadline(profile, deadline, detail);\n  await sleep(Math.min(deadline.retryMs, deadline.timeoutMs - (Date.now() - deadline.startedAt)));\n}\n\n/** One granted turn of the turn lock. */\ninterface Turn {\n  readonly directory: string;\n  readonly slot: number;\n  readonly token: string;\n}\n\n/** A turn as recorded on disk. */\ninterface TurnState {\n  readonly slot: number;\n  readonly token: string;\n  readonly pid: number;\n  /** The token of the turn before it that its creator observed; null for turn 0. */\n  readonly after: string | null;\n  readonly held: boolean;\n  readonly done: boolean;\n}\n\n/** Turn directory names: decimal turn numbers. */\nconst TURN = /^(?:0|[1-9][0-9]*)$/;\n\n/**\n * Tokens of turns this process published and then gave up (a marker write or\n * a read failed after publication): the positive evidence that lets this\n * process settle a turn of its own PID. A live process's turn that is not in\n * here is never settled by it, so a module instance that cannot see another\n * instance's set (another bundled copy of this package) waits rather than\n * settling a turn that copy still holds.\n *\n * One set per process, not per module instance: the package's entry points\n * (state, index, artifacts, cli-runtime; ESM and CJS) each bundle their own\n * copy of this module, and one process may load several. The key is\n * versioned so that a release changing what the set holds uses a new one.\n */\nconst relinquishedTurns: Set<string> =\n  (globalThis as unknown as Record<symbol, Set<string> | undefined>)[Symbol.for(\"tinycloud.operations.relinquishedProfileTurns.v1\")] ??=\n    new Set<string>();\n\n/** Marker writes are retried this many times, after these delays (ms), before giving up. */\nconst MARKER_RETRY_DELAYS_MS = [10, 50, 250];\n/** A given-up turn is settled in the background every second for up to five minutes. */\nconst SETTLE_RETRY_MS = 1_000;\nconst SETTLE_RETRIES = 300;\n\n/**\n * The turn lock: mutual exclusion among processes of this release that does\n * not depend on how long any of them is paused. It uses only `mkdir`,\n * `rename`, exclusive file creation, and a check that a holder's PID is gone\n * (as `.lock` recovery always has), so it needs no hard links.\n *\n * Turns are numbered directories in profileTurnLockPath(profile). Turn n has\n * `owner.json` ({ pid, createdAt, token, after }), where `after` is the token\n * of the turn n-1 its creator observed, and gains `<token>.held` when granted\n * and `<token>.done` when over. Markers name the turn's own token, so one\n * written late into a recreated directory of the same number means nothing.\n *\n * - A turn is published by renaming a fully written staging directory to\n *   `n`, which fails while `n` exists (rename never replaces a non-empty\n *   directory, and turn directories are never empty). The turn directory\n *   itself is published the same way, with a granted, finished turn 0.\n * - A process takes turn n only after reading turn n-1 granted and done.\n *   Once `n` is published it checks that turn n-1 is still the one it read\n *   (same token, granted, done) and only then writes `held`; otherwise the\n *   turn is void: it writes `done` alone and starts over.\n * - Turns are removed by renaming them aside: a void turn at any time, a\n *   granted one only once no older turn is left and turn n+1 is granted and\n *   done. The latest turn is never removed.\n *\n * Why at most one granted turn is ever not done: a removed number can be\n * published again, but turn n-1 is always removed before turn n, so a\n * process whose stale read led it to republish n finds n-1 gone or holding\n * another token, and its turn is void. A process that finds n-1 as it read\n * it published `n` for the first time, so it is the only process granted n,\n * and n-1 was done before. A turn is marked done only by its holder, or by\n * another process once the holder's PID is gone (or by its own process,\n * once it has explicitly given that turn up); a paused holder is alive.\n * A turn is voided only on definite evidence (the turn it follows is gone or\n * holds another token), never because a read failed. Nothing above is\n * decided from elapsed time.\n *\n * Returns the turn and the number of the first turn this acquisition waited\n * on: the latest turn when it first looked if that was not done yet, else\n * the next one.\n */\nasync function acquireTurn(\n  profile: string,\n  directory: string,\n  deadline: LockDeadline,\n): Promise<{ turn: Turn; firstWaitedTurn: number }> {\n  let firstWaitedTurn: number | undefined;\n  // Why the turn lock looks damaged, as of the last look, for the timeout message.\n  let problem: string | undefined;\n  const damaged = (what: string) =>\n    `The turn lock ${directory} ${what}, so no process can take it. ` +\n    `If no tc or MCP process is using profile \"${profile}\", remove that directory.`;\n  for (let first = true; ; first = false) {\n    if (!first) checkDeadline(profile, deadline, problem);\n    problem = undefined;\n    const latest = await readLatestTurn(directory);\n    if (latest === \"missing\") {\n      await createTurnDirectory(directory);\n      continue;\n    }\n    if (latest === \"empty\") {\n      // Usually a listing that straddled a turn's publication and an older\n      // turn's removal (readdir is not a snapshot); damaged if it persists.\n      problem = damaged(\"has no turns\");\n      await waitOrTimeOut(profile, deadline, problem);\n      continue;\n    }\n    if (latest === null) continue;\n    if (typeof latest === \"number\") {\n      problem = damaged(`has an unreadable turn ${latest}`);\n      await waitOrTimeOut(profile, deadline, problem);\n      continue;\n    }\n    firstWaitedTurn ??= latest.done ? latest.slot + 1 : latest.slot;\n    if (latest.held && latest.done) {\n      const turn = await takeTurn(profile, directory, latest);\n      if (turn !== null) return { turn, firstWaitedTurn };\n      await waitOrTimeOut(profile, deadline);\n    } else if (latest.done) {\n      problem = damaged(`ends with turn ${latest.slot}, which was never granted`);\n      await waitOrTimeOut(profile, deadline, problem);\n    } else if (latest.pid === process.pid ? relinquishedTurns.has(latest.token) : !isProcessAlive(latest.pid)) {\n      await waitForTestBarrier(TEST_LOCK_TURN_SETTLE_BARRIER_DIR, profile);\n      await settleAbandonedTurn(directory, latest);\n      relinquishedTurns.delete(latest.token);\n    } else {\n      await signalTestLockContention(profile);\n      await waitOrTimeOut(profile, deadline);\n    }\n  }\n}\n\n/**\n * The highest-numbered turn: its state, its number if it is damaged, null if\n * it went away while being read.\n */\nasync function readLatestTurn(directory: string): Promise<TurnState | number | \"missing\" | \"empty\" | null> {\n  let names: string[];\n  try {\n    names = await readdir(directory);\n  } catch (error) {\n    if (isErrno(error, \"ENOENT\")) return \"missing\";\n    throw error;\n  }\n  const slots = names.filter((name) => TURN.test(name)).map(Number);\n  if (slots.length === 0) return \"empty\";\n  const slot = Math.max(...slots);\n  const turn = await readTurn(directory, slot);\n  return turn === \"damaged\" ? slot : turn;\n}\n\n/**\n * Turn `slot` as recorded now; null if it is gone; \"damaged\" if its owner\n * record is missing or unreadable (turns are renamed into place and aside\n * whole, with their owner record written durably). Any other read error is\n * thrown: it says nothing about the turn. `done` is read before `held`,\n * which every writer creates first, so a turn read as done is never misread\n * as void.\n */\nasync function readTurn(directory: string, slot: number): Promise<TurnState | \"damaged\" | null> {\n  const path = join(directory, String(slot));\n  let text: string;\n  try {\n    text = await readFile(join(path, \"owner.json\"), \"utf8\");\n  } catch (error) {\n    if (!isErrno(error, \"ENOENT\") && !isErrno(error, \"ENOTDIR\")) throw error;\n    return await exists(path) ? \"damaged\" : null;\n  }\n  let owner: { pid?: unknown; token?: unknown; after?: unknown } | null;\n  try {\n    owner = JSON.parse(text) as typeof owner;\n  } catch {\n    return \"damaged\";\n  }\n  if (owner === null || typeof owner !== \"object\" || typeof owner.token !== \"string\" || typeof owner.pid !== \"number\") {\n    return \"damaged\";\n  }\n  const done = await exists(join(path, `${owner.token}.done`));\n  const held = await exists(join(path, `${owner.token}.held`));\n  return {\n    slot,\n    token: owner.token,\n    pid: owner.pid,\n    after: typeof owner.after === \"string\" ? owner.after : null,\n    held,\n    done,\n  };\n}\n\n/**\n * Whether turn `slot` is still the granted, finished turn with `token`. False\n * only on definite evidence: it is gone, or holds another token. Throws if it\n * cannot be read, or is damaged, so the caller leaves its own turn undecided.\n */\nasync function isFinishedTurn(directory: string, slot: number, token: string): Promise<boolean> {\n  const turn = await readTurn(directory, slot);\n  if (turn === \"damaged\") throw new Error(`Turn ${slot} of the turn lock ${directory} is unreadable.`);\n  return turn !== null && turn.token === token && turn.held && turn.done;\n}\n\n/**\n * Publishes the turn after `latest` and claims it. Null if another process\n * published that number first, or the turn is void. If a step after\n * publication fails, the turn is handed to settleOwnTurn and the error thrown.\n */\nasync function takeTurn(profile: string, directory: string, latest: TurnState): Promise<Turn | null> {\n  const token = randomUUID();\n  const slot = latest.slot + 1;\n  const path = join(directory, String(slot));\n  const owner = { pid: process.pid, createdAt: new Date().toISOString(), token, after: latest.token };\n  let published = false;\n  try {\n    published = await publishDirectory(\n      join(directory, `.stage-${process.pid}-${token}`),\n      path,\n      { \"owner.json\": `${JSON.stringify(owner, null, 2)}\\n` },\n      () => waitForTestBarrier(TEST_LOCK_TURN_PUBLISH_BARRIER_DIR, profile),\n    );\n    if (published && await isFinishedTurn(directory, latest.slot, latest.token) && await markTurn(path, token, \"held\")) {\n      return { directory, slot, token };\n    }\n    if (published) await markTurn(path, token, \"done\");\n    return null;\n  } catch (error) {\n    if (published) settleOwnTurn(directory, slot, token);\n    throw error;\n  }\n}\n\n/**\n * Finishes the turn of a process that is gone (or one this process gave up).\n * A turn its creator never got to grant is granted first if the turn before\n * it is still the one its creator read (the check the creator would have\n * made; that turn cannot have been removed, since that needs this turn\n * done), and left void only if it definitely is not.\n */\nasync function settleAbandonedTurn(directory: string, abandoned: TurnState): Promise<void> {\n  const path = join(directory, String(abandoned.slot));\n  if (!abandoned.held && abandoned.after !== null &&\n    await isFinishedTurn(directory, abandoned.slot - 1, abandoned.after)) {\n    await markTurn(path, abandoned.token, \"held\");\n  }\n  await markTurn(path, abandoned.token, \"done\");\n}\n\n/**\n * Settles a turn this process published but could not grant or finish (a\n * marker write or a read failed). Other processes wait on this live PID, so\n * it is retried in the background until it succeeds or the turn is settled\n * otherwise (by this process's next acquisition, or by another process once\n * this one has exited). The timer does not keep the process alive.\n */\nfunction settleOwnTurn(directory: string, slot: number, token: string, retries = SETTLE_RETRIES): void {\n  relinquishedTurns.add(token);\n  void (async () => {\n    try {\n      const turn = await readTurn(directory, slot);\n      if (turn !== null && turn !== \"damaged\" && turn.token === token && !turn.done) await settleAbandonedTurn(directory, turn);\n      relinquishedTurns.delete(token);\n    } catch {\n      // Still relinquished: this process's next acquisition settles it too.\n      if (retries > 0) setTimeout(() => settleOwnTurn(directory, slot, token, retries - 1), SETTLE_RETRY_MS).unref();\n    }\n  })();\n}\n\n/**\n * Creates `<token>.<kind>` in a turn directory; false if the directory is\n * gone. Other failures (a full disk, a permission error) are retried a few\n * times, then thrown.\n */\nasync function markTurn(path: string, token: string, kind: \"held\" | \"done\"): Promise<boolean> {\n  for (let attempt = 0; ; attempt++) {\n    try {\n      await writeFile(join(path, `${token}.${kind}`), \"\", { mode: PRIVATE_FILE_MODE, flag: \"wx\" });\n      return true;\n    } catch (error) {\n      if (isErrno(error, \"EEXIST\")) return true;\n      if (isErrno(error, \"ENOENT\")) return false;\n      if (attempt >= MARKER_RETRY_DELAYS_MS.length) throw error;\n      await sleep(MARKER_RETRY_DELAYS_MS[attempt]!);\n    }\n  }\n}\n\n/** Creates the turn directory with a granted, finished turn 0, unless another process did. */\nasync function createTurnDirectory(directory: string): Promise<void> {\n  const token = randomUUID();\n  const owner = { pid: process.pid, createdAt: new Date().toISOString(), token, after: null };\n  await publishDirectory(join(dirname(directory), `.stage-${basename(directory)}-${process.pid}-${token}`), directory, {\n    \"0/owner.json\": `${JSON.stringify(owner, null, 2)}\\n`,\n    [`0/${token}.held`]: \"\",\n    [`0/${token}.done`]: \"\",\n  });\n}\n\n/**\n * Writes `files` (durably, when not empty) into a new staging directory and\n * renames it to `target`. False if `target` already exists (or the turn\n * directory is gone); the caller starts over. Nothing else removes a live\n * process's staging directory (see collectTurns), so `target` never appears\n * incomplete.\n */\nasync function publishDirectory(\n  stage: string,\n  target: string,\n  files: Readonly<Record<string, string>>,\n  beforeRename?: () => Promise<void>,\n): Promise<boolean> {\n  try {\n    for (const [name, contents] of Object.entries(files)) {\n      await mkdir(dirname(join(stage, name)), { recursive: true, mode: PRIVATE_DIR_MODE });\n      await writeFileDurably(join(stage, name), contents);\n    }\n    await beforeRename?.();\n    await rename(stage, target);\n    return true;\n  } catch (error) {\n    // ENOTEMPTY/EEXIST: `target` exists, though it may be gone again by now.\n    // Windows reports an existing target directory as EPERM.\n    if ([\"ENOTEMPTY\", \"EEXIST\", \"ENOENT\"].some((code) => isErrno(error, code)) || await exists(target)) return false;\n    throw error;\n  } finally {\n    await rm(stage, { recursive: true, force: true }).catch(() => undefined);\n  }\n}\n\n/**\n * Finishes this process's turn. If `done` cannot be written even after\n * retries, the critical section is still over and its writes stand: the turn\n * is handed to settleOwnTurn rather than failing the caller.\n */\nasync function releaseTurn(profile: string, turn: Turn): Promise<void> {\n  try {\n    await markTurn(join(turn.directory, String(turn.slot)), turn.token, \"done\");\n  } catch {\n    settleOwnTurn(turn.directory, turn.slot, turn.token);\n    return;\n  }\n  await collectTurns(profile, turn).catch(() => undefined);\n}\n\n/**\n * Leftovers in a turn directory whose writer is gone: trash (a removed turn\n * renamed aside, garbage from then on), and staging directories and\n * deletion-record temporaries named after their writer's PID.\n */\nfunction isAbandonedTurnEntry(name: string): boolean {\n  if (name.startsWith(\".trash-\")) return true;\n  const writer = /^\\.(?:stage|deleted\\.json)[-.]([0-9]+)[-.]/.exec(name)?.[1];\n  return writer !== undefined && !isProcessAlive(Number(writer));\n}\n\n/** A turn directory's staging directory left beside it by a process that is gone. */\nfunction isAbandonedTurnDirectoryStage(name: string): boolean {\n  const writer = /^\\.stage-.+-([0-9]+)-[0-9a-f]{8}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{12}$/.exec(name)?.[1];\n  return writer !== undefined && !isProcessAlive(Number(writer));\n}\n\n/**\n * Removes the turns before `turn`, which just finished: void turns, and\n * granted ones oldest first, each once no older turn is left and the next is\n * granted and done (see acquireTurn). A turn is renamed aside before it is\n * deleted, so its number is never an empty directory. A turn that is damaged\n * or cannot be read is left alone, and a read error stops the collection.\n * Leftovers of crashed processes go too, judged by PID, never by age:\n * removing a paused process's staging directory could publish an incomplete\n * turn.\n */\nasync function collectTurns(profile: string, turn: Turn): Promise<void> {\n  for (const [directory, abandoned] of [\n    [turn.directory, isAbandonedTurnEntry],\n    [dirname(turn.directory), isAbandonedTurnDirectoryStage],\n  ] as const) {\n    for (const name of (await readdir(directory)).filter(abandoned)) {\n      await rm(join(directory, name), { recursive: true, force: true }).catch(() => undefined);\n    }\n  }\n  const older = (await readdir(turn.directory)).filter((name) => TURN.test(name)).map(Number)\n    .filter((slot) => slot < turn.slot)\n    .sort((left, right) => left - right);\n  for (const slot of older) {\n    const candidate = await readTurn(turn.directory, slot);\n    if (candidate === null || candidate === \"damaged\" || !candidate.done) continue;\n    if (candidate.held) {\n      if (await exists(join(turn.directory, String(slot - 1)))) continue;\n      const next = await readTurn(turn.directory, slot + 1);\n      if (next === null || next === \"damaged\" || !next.held || !next.done) continue;\n    }\n    await waitForTestBarrier(TEST_LOCK_TURN_COLLECT_BARRIER_DIR, profile);\n    const trash = join(turn.directory, `.trash-${randomUUID()}`);\n    if (await rename(join(turn.directory, String(slot)), trash).then(() => true, () => false)) {\n      await rm(trash, { recursive: true, force: true }).catch(() => undefined);\n    }\n  }\n}\n\n/**\n * One attempt to take `.lock`, made while holding a turn. Nothing here\n * replaces an existing path:\n *\n * 1. `mkdir(.lock)` (never recursive) is exclusive, and is the primitive\n *    older releases use too, so they exclude each other.\n * 2. Ownership is published by `link`ing a fully written owner file (staged\n *    beside `.lock`, on the same filesystem) to `.lock/owner.json`. `link`\n *    fails with EEXIST if an owner exists, and with ENOENT if the directory\n *    was removed meanwhile (an aged ownerless-lock reclaim by an older\n *    release). Only a successful link holds the lock; on either failure\n *    nothing is released, since nothing was acquired, and the caller retries.\n *    On a filesystem without hard links (FAT/exFAT, some SMB mounts) the\n *    owner file is created in place with an exclusive create instead, with\n *    the same EEXIST/ENOENT outcomes. A reader may then briefly see it\n *    incomplete; every release treats an owner file it cannot parse as a\n *    held lock, and this release removes one only once it has aged (see\n *    isAbandonedOwner).\n *\n * A profile deletion removes the profile directory once it has released its\n * lock, so `mkdir(.lock)` can see ENOENT; the directory is recreated (0700)\n * and the caller retries within its deadline, as for a first write to a new\n * profile.\n *\n * Only one owner.json can exist at the lock path, and it is removed only by\n * its holder's release or by recovery of an abandoned holder, so at most one\n * process holds the lock. Returns false when the lock is not acquired.\n */\nasync function publishProfileLock(profile: string, lockPath: string, token: string): Promise<boolean> {\n  try {\n    await mkdir(lockPath, { mode: PRIVATE_DIR_MODE });\n  } catch (error) {\n    if (isErrno(error, \"EEXIST\")) return false;\n    if (!isErrno(error, \"ENOENT\")) throw error;\n    await mkdir(profilePath(profile), { recursive: true, mode: PRIVATE_DIR_MODE });\n    return false;\n  }\n  await waitForTestBarrier(TEST_LOCK_PUBLISH_BARRIER_DIR, profile);\n  const ownerPath = join(lockPath, \"owner.json\");\n  const staged = join(dirname(lockPath), `.lock-owner-${token}.tmp`);\n  const owner = `${JSON.stringify({ pid: process.pid, createdAt: new Date().toISOString(), token }, null, 2)}\\n`;\n  try {\n    await writeFile(staged, owner, { encoding: \"utf8\", mode: PRIVATE_FILE_MODE, flag: \"wx\" });\n    try {\n      await link(staged, ownerPath);\n    } catch (error) {\n      if (!lacksHardLinks(error)) throw error;\n      await writeFile(ownerPath, owner, { encoding: \"utf8\", mode: PRIVATE_FILE_MODE, flag: \"wx\" });\n    }\n    return true;\n  } catch (error) {\n    if (isErrno(error, \"EEXIST\") || isErrno(error, \"ENOENT\")) return false;\n    // Do not leave an ownerless lock behind for others to wait out. rmdir\n    // removes only an empty directory; anyone who created it after ours went\n    // away sees ENOENT on link and retries.\n    await rmdir(lockPath).catch(() => undefined);\n    throw error;\n  } finally {\n    await rm(staged, { force: true }).catch(() => undefined);\n  }\n}\n\n/**\n * Errors `link` reports on a filesystem without hard links: EPERM (Linux\n * FAT/exFAT), ENOTSUP/EOPNOTSUPP (macOS FAT/exFAT, SMB), ENOSYS, EISDIR\n * (libuv's code for Windows' ERROR_INVALID_FUNCTION on FAT32), and EMLINK\n * (too many links), for which the same fallback is just as correct.\n */\nconst NO_HARD_LINK_ERRORS = new Set([\"EPERM\", \"ENOTSUP\", \"EOPNOTSUPP\", \"ENOSYS\", \"EISDIR\", \"EMLINK\"]);\n\nfunction lacksHardLinks(error: unknown): boolean {\n  return typeof error === \"object\" && error !== null && \"code\" in error &&\n    NO_HARD_LINK_ERRORS.has(String((error as { code?: unknown }).code));\n}\n\n/**\n * Releases the lock if `.lock/owner.json` is still this acquisition's. No\n * one else can put an owner record there while it exists (owners are only\n * published into a directory their own `mkdir` created, and recovery\n * removes only an abandoned holder's record), so the record read is the one\n * unlinked.\n */\nasync function releaseProfileLock(profile: string, lockPath: string, token: string): Promise<void> {\n  const ownerPath = join(lockPath, \"owner.json\");\n  const owner = await readJson<{ token?: unknown }>(ownerPath).catch(() => null);\n  if (owner?.token !== token) return;\n  await rm(ownerPath, { force: true });\n  // `.lock` is empty from here until the rmdir; a contender that removes it\n  // and creates its own meanwhile is not harmed: rmdir fails on its owner\n  // file, or the contender's link sees ENOENT and retries. If a recoverer's\n  // claim file is still inside, rmdir fails and that recoverer removes the\n  // directory when it drops its claim.\n  await waitForTestBarrier(TEST_LOCK_RELEASE_BARRIER_DIR, profile);\n  await rmdir(lockPath).catch(() => undefined);\n}\n\n/**\n * Gives process-level contention tests an event-driven witness that a second\n * writer has reached an already-held lock. This deliberately has no effect\n * outside an explicit test environment, and only creates a new signal file\n * beneath TC_HOME; it never changes lock acquisition or release semantics.\n */\nasync function signalTestLockContention(profile: string): Promise<void> {\n  if (process.env.NODE_ENV !== \"test\") return;\n\n  const configuredPath = process.env[TEST_LOCK_CONTENTION_SIGNAL_PATH];\n  const configuredHome = process.env.TC_HOME;\n  if (!configuredPath || !configuredHome) return;\n\n  const home = resolve(configuredHome);\n  const signalPath = resolve(configuredPath);\n  const pathFromHome = relative(home, signalPath);\n  if (\n    pathFromHome === \"\" ||\n    pathFromHome === \"..\" ||\n    pathFromHome.startsWith(`..${process.platform === \"win32\" ? \"\\\\\" : \"/\"}`) ||\n    pathFromHome.startsWith(\"../\") ||\n    pathFromHome.startsWith(\"..\\\\\")\n  ) {\n    return;\n  }\n\n  await writeFile(signalPath, `${profile}\\n`, { encoding: \"utf8\", flag: \"wx\" })\n    .catch(() => undefined);\n}\n\n/**\n * Reclaims a `.lock` with no owner record, while holding a turn. A\n * `.recover-*` claim may contain a live legacy owner's record moved by a\n * no-hard-links recoverer just before it crashed. Restore that record first;\n * only orphaned claims holding dead or malformed records can be removed.\n * Otherwise the directory must be older than the stale threshold: one left\n * by a crash, or by an older release, whose `.stale-*` / `.release-*` claim\n * files are removed too. owner.json is never unlinked, and the directory\n * itself is only `rmdir`ed, which succeeds only while it is empty.\n *\n * Holding a turn, no other process of this release reclaims concurrently.\n * That closes the race in which two reclaimers' age checks let the later one\n * remove a directory a 1.0.0-beta.16-or-older release had just created,\n * which holds the lock from its `mkdir`. That race remains only if a\n * 1.0.0-beta.17 … 1.0.1-beta.4 release reclaims at the same moment, or the\n * older process stays paused between its `mkdir` and its owner write for\n * longer than the stale threshold; recoveryFenced bounds how stale this\n * process's age check can be.\n */\nasync function recoverOwnerlessLock(profile: string, lockPath: string, staleAfterMs: number): Promise<boolean> {\n  let aged: boolean;\n  try {\n    const { mtimeMs } = await stat(lockPath);\n    aged = Date.now() - mtimeMs >= staleAfterMs;\n  } catch {\n    return false;\n  }\n  const checkedAt = performance.now();\n  await waitForTestBarrier(TEST_LOCK_OWNERLESS_BARRIER_DIR, profile);\n  try {\n    const entries = await readdir(lockPath);\n    if (entries.includes(\"owner.json\")) return false;\n    const onlyOrphanedClaims = entries.length > 0 && entries.every((entry) => RECOVERY_CLAIM.test(entry));\n    if (!onlyOrphanedClaims && (!aged || recoveryFenced(checkedAt, staleAfterMs))) return false;\n    for (const name of entries.filter((entry) => RECOVERY_CLAIM.test(entry))) {\n      const claimPath = join(lockPath, name);\n      if (await hasLiveRecoveryOwner(claimPath)) {\n        // The claim keeps the directory in place. Only the original mkdir\n        // owner could publish owner.json here; never overwrite that record.\n        if (!await exists(join(lockPath, \"owner.json\"))) await rename(claimPath, join(lockPath, \"owner.json\"));\n        return false;\n      }\n      await rm(claimPath, { force: true });\n    }\n    for (const name of entries.filter((entry) => ABANDONED_CLAIM.test(entry))) {\n      await rm(join(lockPath, name), { force: true });\n    }\n    await rmdir(lockPath);\n  } catch {\n    return false;\n  }\n  await removeAgedOwnerFiles(lockPath, staleAfterMs);\n  return true;\n}\n\n/** A no-hard-links claim may contain a live owner's record moved before a crash. */\nasync function hasLiveRecoveryOwner(claimPath: string): Promise<boolean> {\n  let contents: string;\n  try {\n    contents = await readFile(claimPath, \"utf8\");\n  } catch (error) {\n    if (isErrno(error, \"ENOENT\")) return false;\n    throw error; // An I/O failure is not evidence that the holder is gone.\n  }\n  let owner: unknown;\n  try {\n    owner = JSON.parse(contents);\n  } catch {\n    return false;\n  }\n  const pid = typeof owner === \"object\" && owner !== null && \"pid\" in owner ? owner.pid : null;\n  return typeof pid === \"number\" && Number.isInteger(pid) && pid > 0 && isProcessAlive(pid);\n}\n\n/**\n * Whether an ownerless-reclaim decision made at `since` (a monotonic\n * timestamp) is too old to act on. The age check is only good for a while:\n * past half the stale threshold the reclaim starts over.\n */\nfunction recoveryFenced(since: number, staleAfterMs: number): boolean {\n  return performance.now() - since >= staleAfterMs / 2;\n}\n\n/** Claim files of older releases' stale recovery and (up to 1.0.0-beta.16) release. */\nconst ABANDONED_CLAIM = /^\\.(?:release|stale)-[0-9a-f-]+\\.json$/;\n/**\n * Claim files of this release's stale recovery. Releases up to 1.0.1-beta.4\n * never remove them, which is what makes this recovery safe against them; a\n * recoverer that crashes leaves one that only a release with the turn lock\n * clears (see REFERENCE.md, \"Profile lock\").\n */\nconst RECOVERY_CLAIM = /^\\.recover-[0-9a-f-]+\\.json$/;\n/** Owner files staged by publishProfileLock beside `.lock`. */\nconst STAGED_OWNER = /^\\.lock-owner-[0-9a-f-]+\\.tmp$/;\n/**\n * Removes owner files a crashed acquirer staged beside `.lock`. A live\n * acquirer's staged file exists only for its write and link, so only files\n * older than the stale threshold are removed. Runs after a recovery, never\n * on the uncontended path.\n */\nasync function removeAgedOwnerFiles(lockPath: string, staleAfterMs: number): Promise<void> {\n  const directory = dirname(lockPath);\n  const names = await readdir(directory).catch(() => []);\n  for (const name of names.filter((entry) => STAGED_OWNER.test(entry))) {\n    const path = join(directory, name);\n    const aged = await stat(path).then(({ mtimeMs }) => Date.now() - mtimeMs >= staleAfterMs, () => false);\n    if (aged) await rm(path, { force: true }).catch(() => undefined);\n  }\n}\n\n\n/**\n * Removes an abandoned owner record (see isAbandonedOwner) and its `.lock`,\n * while holding a turn, so no other process of this release recovers,\n * reclaims or acquires `.lock` meanwhile.\n *\n * The record is claimed first: hard-linked to `.recover-<uuid>.json`, and the\n * claim compared with the exact bytes read. A record that replaced the\n * observed one is left in place. While the claim is inside `.lock`, the\n * directory cannot be removed and recreated: older releases never remove a\n * `.recover-*` claim (they clean up only their own claim names), and other\n * processes of this release are kept out by the turn lock. So no other owner\n * record can appear in it, and the unlink of owner.json can only remove the\n * claimed, dead record. A live record is never unlinked or moved. `.lock`\n * itself is removed only after this process's claim is unlinked from it,\n * which proves it is still the dead holder's directory; if the claim cannot\n * be made, `.lock` is left alone (it may be a directory a 1.0.0-beta.16-or-\n * older writer just created, which it holds from that `mkdir`). No step\n * depends on how long this process takes.\n *\n * Without hard links (where 1.0.0-beta.17 … 1.0.1-beta.4 cannot run at all),\n * the record is renamed into the claim instead, and put back if it is not\n * the observed one: one a 1.0.0-beta.16-or-older process published after\n * recovering the same lock at the same moment. The claim keeps `.lock` held\n * meanwhile, so no second writer gets in, but if that holder releases\n * between the two renames, the put-back restores a released record, and\n * `.lock` stays held until that PID is gone and the record is 30 s old.\n */\nasync function recoverStaleLock(profile: string, lockPath: string, staleAfterMs: number): Promise<boolean> {\n  const ownerPath = join(lockPath, \"owner.json\");\n  const observed = await readFile(ownerPath, \"utf8\").catch(() => null);\n  if (observed === null) return recoverOwnerlessLock(profile, lockPath, staleAfterMs);\n  if (!await isAbandonedOwner(observed, ownerPath, staleAfterMs)) return false;\n\n  await waitForTestBarrier(TEST_LOCK_RECOVERY_BARRIER_DIR, profile);\n  const claimPath = join(lockPath, `.recover-${randomUUID()}.json`);\n  let moved = false;\n  try {\n    await link(ownerPath, claimPath);\n  } catch (error) {\n    // Gone or replaced already (another release recovered it): leave `.lock`.\n    if (!lacksHardLinks(error)) return false;\n    try {\n      await rename(ownerPath, claimPath);\n      moved = true;\n    } catch {\n      return false;\n    }\n  }\n  if (moved) await waitForTestBarrier(TEST_LOCK_MOVED_BARRIER_DIR, profile);\n  const sameInstance = await readFile(claimPath, \"utf8\").then((claimed) => claimed === observed, () => false);\n  await waitForTestBarrier(TEST_LOCK_VERIFIED_BARRIER_DIR, profile);\n  if (!sameInstance) {\n    if (moved) {\n      // No other owner.json can have appeared meanwhile: only a process\n      // whose mkdir created this `.lock` publishes one, and it already has.\n      await rename(claimPath, ownerPath).catch(() => undefined);\n    } else {\n      await unlink(claimPath).catch(() => undefined);\n    }\n    return false;\n  }\n  if (!moved) await rm(ownerPath, { force: true });\n  await waitForTestBarrier(TEST_LOCK_CLAIM_BARRIER_DIR, profile);\n  await waitForTestBarrier(TEST_LOCK_CLAIMED_BARRIER_DIR, profile);\n  // Drop any claim a crashed recoverer of this release left, then this one.\n  for (const name of (await readdir(lockPath).catch(() => [])).filter((entry) => RECOVERY_CLAIM.test(entry))) {\n    if (join(lockPath, name) !== claimPath) await rm(join(lockPath, name), { force: true });\n  }\n  // Empty now, and still the dead holder's directory if this claim was in\n  // it: remove it rather than leave an ownerless lock to age out.\n  if (await unlink(claimPath).then(() => true, () => false)) await rmdir(lockPath).catch(() => undefined);\n  await removeAgedOwnerFiles(lockPath, staleAfterMs);\n  return true;\n}\n\n/**\n * Whether an owner record (its exact bytes, read from `ownerPath`) is\n * abandoned: a holder's whose PID is gone, older than the stale threshold;\n * or, if it is not a complete record, a file older than that threshold.\n * Every release publishes complete records (by link or rename) except this\n * one's no-hard-link fallback, which writes in place while holding a turn;\n * so an incomplete record seen while holding a turn was left by a crash.\n */\nasync function isAbandonedOwner(observed: string, ownerPath: string, staleAfterMs: number): Promise<boolean> {\n  let owner: unknown;\n  try {\n    owner = JSON.parse(observed);\n  } catch {\n    owner = null;\n  }\n  if (typeof owner === \"object\" && owner !== null && \"pid\" in owner) {\n    return isStaleOwner(owner as { pid?: unknown; createdAt?: unknown }, staleAfterMs);\n  }\n  const modifiedAt = await stat(ownerPath).then(({ mtimeMs }) => mtimeMs, () => Number.NaN);\n  return Date.now() - modifiedAt >= staleAfterMs;\n}\n\n/** Test-only rendezvous (NODE_ENV=test and the named barrier directory set). */\nasync function waitForTestBarrier(environmentName: string, profile: string): Promise<void> {\n  if (process.env.NODE_ENV !== \"test\") return;\n  const barrierDirectory = process.env[environmentName];\n  if (!barrierDirectory) return;\n  await mkdir(barrierDirectory, { recursive: true });\n  const readyPath = join(barrierDirectory, `ready-${process.pid}-${profile}`);\n  await writeFile(readyPath, \"ready\\n\", { encoding: \"utf8\", flag: \"wx\" }).catch(() => undefined);\n  const releasePath = join(barrierDirectory, \"release\");\n  while (true) {\n    try {\n      await readFile(releasePath, \"utf8\");\n      return;\n    } catch {\n      await sleep(1);\n    }\n  }\n}\n\nfunction isStaleOwner(\n  owner: { pid?: unknown; createdAt?: unknown } | null,\n  staleAfterMs: number,\n): boolean {\n  const now = Date.now();\n  const createdAt = typeof owner?.createdAt === \"string\"\n    ? Date.parse(owner.createdAt)\n    : Number.NaN;\n\n  // Reclaim only a fully published lock whose owner PID is confirmed dead.\n  // A lock without an owner record is handled by recoverOwnerlessLock: a\n  // process holds the lock only once its owner.json is linked in.\n  if (!Number.isFinite(createdAt) || now - createdAt < staleAfterMs) return false;\n  if (typeof owner?.pid !== \"number\" || !Number.isInteger(owner.pid) || owner.pid <= 0) {\n    return false;\n  }\n  return !isProcessAlive(owner.pid);\n}\n\n/** Whether `path` exists. Only ENOENT/ENOTDIR mean it does not; other errors are thrown. */\nasync function exists(path: string): Promise<boolean> {\n  try {\n    await stat(path);\n    return true;\n  } catch (error) {\n    if (isErrno(error, \"ENOENT\") || isErrno(error, \"ENOTDIR\")) return false;\n    throw error;\n  }\n}\n\nfunction isProcessAlive(pid: number): boolean {\n  try {\n    process.kill(pid, 0);\n    return true;\n  } catch (error) {\n    return !isErrno(error, \"ESRCH\");\n  }\n}\n\nfunction validateProfileName(profile: string): string {\n  if (\n    !profile ||\n    profile === \".\" ||\n    profile === \"..\" ||\n    profile.includes(\"/\") ||\n    profile.includes(\"\\\\\") ||\n    profile.includes(\"\\0\")\n  ) {\n    throw new TypeError(\"Profile names must be non-empty path segments.\");\n  }\n  return profile;\n}\n\nfunction isErrno(error: unknown, code: string): boolean {\n  return typeof error === \"object\" && error !== null && \"code\" in error &&\n    (error as { code?: unknown }).code === code;\n}\n\nfunction sleep(milliseconds: number): Promise<void> {\n  return new Promise((resolve) => setTimeout(resolve, milliseconds));\n}\n\nexport { DEFAULT_PROFILE };\n","import { randomUUID } from \"node:crypto\";\n\nimport type { PermissionEntry } from \"@tinycloud/sdk-core\";\nimport { z } from \"zod\";\n\nimport {\n  canonicalizeCapabilities,\n  evaluateOperationAuthority,\n  evaluateAuthority,\n} from \"./authority.js\";\nimport type { OperationSpaceResolver } from \"./authority.js\";\nimport type {\n  OperationOperatorType,\n  TinyCloudPosture,\n} from \"./contract.js\";\nimport { readAuthRequests, updateProfileStore } from \"./state.js\";\n\nexport { evaluateAuthority } from \"./authority.js\";\n\nconst THIRTY_DAYS_MS = 30 * 24 * 60 * 60 * 1_000;\n\n/** The shared wire schema for SDK PermissionEntry values, including signed ReCap caveats. */\nexport const PermissionEntrySchema = z.object({\n  service: z.string().min(1),\n  space: z.string().min(1).optional(),\n  path: z.string(),\n  actions: z.array(z.string().min(1)).min(1),\n  caveats: z.array(z.record(z.unknown())).optional(),\n  skipPrefix: z.boolean().optional(),\n  expiry: z.string().min(1).optional(),\n  description: z.string().optional(),\n}).strict();\n\nconst CommandSchema = z.object({\n  argv: z.array(z.string()).min(1),\n  cwd: z.string().min(1),\n}).strict();\n\nconst LegacyPermissionRequestArtifactSchema = z.object({\n  kind: z.literal(\"tinycloud.auth.request\"),\n  version: z.literal(1),\n  requestId: z.string(),\n  sessionDid: z.string().min(1),\n  requested: z.array(PermissionEntrySchema),\n  requestedExpiry: z.union([z.string(), z.number().finite()]).optional(),\n}).strict();\n\nconst PortableDelegationSchema: z.ZodType<Record<string, unknown>> = z.lazy(() => z.object({\n  cid: z.string().min(1),\n  spaceId: z.string().min(1),\n  path: z.string(),\n  actions: z.array(z.string().min(1)).min(1),\n  delegateDID: z.string().min(1),\n  ownerAddress: z.string().min(1),\n  chainId: z.number().int().positive(),\n  expiry: z.union([z.string().datetime({ offset: true }), z.date()]),\n  delegationHeader: z.object({ Authorization: z.string().min(1) }).strict(),\n  host: z.string().min(1).optional(),\n  disableSubDelegation: z.boolean().optional(),\n  publicDelegation: PortableDelegationSchema.optional(),\n  resources: z.array(PermissionEntrySchema).optional(),\n}).passthrough());\n\n/** Canonical wire-format v1 request retained for CLI and OpenKey compatibility. */\nexport const PermissionRequestArtifactSchema = z.object({\n  kind: z.literal(\"tinycloud.auth.request\"),\n  version: z.literal(1),\n  requestId: z.string().min(1),\n  createdAt: z.string().datetime({ offset: true }),\n  profile: z.string().min(1),\n  posture: z.enum([\"owner-openkey\", \"delegate-session\", \"local-owner-key\", \"unauthenticated\"]),\n  operatorType: z.enum([\"human\", \"agent\"]),\n  host: z.string().min(1),\n  sessionDid: z.string().min(1),\n  ownerDid: z.string().min(1).optional(),\n  spaceId: z.string().min(1).optional(),\n  requestedExpiry: z.union([z.string().min(1), z.number().finite()]).optional(),\n  requested: z.array(PermissionEntrySchema),\n  command: CommandSchema.optional(),\n}).strict();\n\n/** Canonical structured v1 delegation import accepted by the auth operation. */\nexport const DelegationImportArtifactSchema = z.object({\n  kind: z.literal(\"tinycloud.auth.delegation\"),\n  version: z.literal(1),\n  requestId: z.string().min(1),\n  delegationCid: z.string().min(1).optional(),\n  delegation: PortableDelegationSchema,\n  // This field is presentation metadata only. A later import operation obtains\n  // effective permissions from validated, installed delegation authority.\n  permissions: z.array(PermissionEntrySchema).optional(),\n  expiry: z.string().datetime({ offset: true }).optional(),\n  prompted: z.boolean().optional(),\n}).strict();\n\n/**\n * The stored request an imported delegation was checked against, persisted\n * with the delegation. Its fields are exactly the request artifact's, so\n * replay accepts every binding import can write.\n */\nexport const DelegationRequestBindingSchema = PermissionRequestArtifactSchema\n  .pick({ requestId: true, requested: true })\n  .strict();\nexport type DelegationRequestBinding = z.infer<typeof DelegationRequestBindingSchema>;\n\nexport type PermissionRequestArtifact = z.infer<typeof PermissionRequestArtifactSchema>;\nexport type DelegationImportArtifact = z.infer<typeof DelegationImportArtifactSchema>;\n/** The minimal public node-sdk request shape accepted by the legacy reader. */\nexport type LegacyPermissionRequestArtifact = z.infer<typeof LegacyPermissionRequestArtifactSchema>;\nexport type ArtifactClock = () => Date;\nexport type RequestIdSource = () => string;\n\n/** Invocation-owned values used to safely complete a legacy request record. */\nexport interface LegacyRequestContext {\n  readonly profile: string;\n  readonly host: string;\n  readonly sessionDid: string;\n  readonly posture: TinyCloudPosture;\n  readonly operatorType: OperationOperatorType;\n  readonly ownerDid?: string;\n  readonly spaceId?: string;\n  readonly now?: Date;\n}\n\nexport interface PermissionRequestIdentityInput {\n  readonly profile: string;\n  readonly sessionDid: string;\n  readonly host: string;\n  readonly missing: readonly PermissionEntry[];\n}\n\nexport interface BuildPermissionRequestArtifactInput extends PermissionRequestIdentityInput {\n  readonly posture: TinyCloudPosture;\n  readonly operatorType: OperationOperatorType;\n  readonly ownerDid?: string;\n  readonly spaceId?: string;\n  readonly requestedExpiry?: string | number;\n  readonly command?: { readonly argv: readonly string[]; readonly cwd: string };\n  readonly now?: ArtifactClock;\n  readonly createRequestId?: RequestIdSource;\n}\n\nexport interface CreateOrReusePermissionRequestInput extends BuildPermissionRequestArtifactInput {\n  readonly granted: readonly PermissionEntry[];\n  /** Owner-aware identity resolver used by registered operation callers. */\n  readonly resolveSpace?: OperationSpaceResolver;\n  readonly replace?: boolean;\n}\n\nexport type PermissionRequestResolution =\n  | Readonly<{ status: \"satisfied\"; reused: false }>\n  | Readonly<{ status: \"created\"; reused: boolean; request: PermissionRequestArtifact }>;\n\n/** Parses a request artifact without accepting a newer wire format as v1. */\nexport function validatePermissionRequestArtifact(value: unknown): PermissionRequestArtifact {\n  return PermissionRequestArtifactSchema.parse(value);\n}\n\n/** Parses a structured active-session import artifact without accepting a newer wire format as v1. */\nexport function validateDelegationImportArtifact(value: unknown): DelegationImportArtifact {\n  return DelegationImportArtifactSchema.parse(value);\n}\n\nexport function isPermissionRequestArtifact(value: unknown): value is PermissionRequestArtifact {\n  return PermissionRequestArtifactSchema.safeParse(value).success;\n}\n\nexport function isDelegationImportArtifact(value: unknown): value is DelegationImportArtifact {\n  return DelegationImportArtifactSchema.safeParse(value).success;\n}\n\nfunction normalizeLegacyPermissionRequest(\n  value: LegacyPermissionRequestArtifact,\n  context: LegacyRequestContext,\n): PermissionRequestArtifact {\n  if (principal(value.sessionDid) !== principal(context.sessionDid)) {\n    throw new TypeError(\"Stored authority request belongs to a different session.\");\n  }\n  const createdAt = context.now ?? new Date();\n  if (Number.isNaN(createdAt.getTime())) {\n    throw new TypeError(\"The legacy authority request has no usable creation time.\");\n  }\n  return {\n    kind: \"tinycloud.auth.request\",\n    version: 1,\n    requestId: value.requestId,\n    createdAt: createdAt.toISOString(),\n    profile: context.profile,\n    posture: context.posture,\n    operatorType: context.operatorType,\n    host: context.host,\n    sessionDid: context.sessionDid,\n    ...(context.ownerDid === undefined ? {} : { ownerDid: context.ownerDid }),\n    ...(context.spaceId === undefined ? {} : { spaceId: context.spaceId }),\n    ...(value.requestedExpiry === undefined ? {} : { requestedExpiry: value.requestedExpiry }),\n    requested: canonicalizeCapabilities(value.requested),\n  } as PermissionRequestArtifact;\n}\n\nfunction principal(value: string): string {\n  return value.split(\"#\", 1)[0]!;\n}\n\n/**\n * Stable exact identity used only for request reuse. It binds a request to its\n * selected profile, active session DID, host, and canonical missing subset.\n */\nexport function createPermissionRequestIdentity(input: PermissionRequestIdentityInput): string {\n  return JSON.stringify({\n    profile: input.profile,\n    sessionDid: input.sessionDid,\n    host: input.host,\n    missing: canonicalizeCapabilities(input.missing),\n  });\n}\n\n/** Builds an on-disk-compatible v1 record. Omitted values stay omitted. */\nexport function buildPermissionRequestArtifact(\n  input: BuildPermissionRequestArtifactInput,\n): PermissionRequestArtifact {\n  const now = input.now ?? (() => new Date());\n  const createdAt = now();\n  if (Number.isNaN(createdAt.getTime())) throw new TypeError(\"The artifact clock returned an invalid date.\");\n  const requested = canonicalizeCapabilities(input.missing);\n  if (requested.length === 0) throw new TypeError(\"Permission requests require at least one missing capability.\");\n\n  return validatePermissionRequestArtifact({\n    kind: \"tinycloud.auth.request\",\n    version: 1,\n    requestId: input.createRequestId?.() ?? defaultRequestId(createdAt),\n    createdAt: createdAt.toISOString(),\n    profile: input.profile,\n    posture: input.posture,\n    operatorType: input.operatorType,\n    host: input.host,\n    sessionDid: input.sessionDid,\n    ...(input.ownerDid !== undefined ? { ownerDid: input.ownerDid } : {}),\n    ...(input.spaceId !== undefined ? { spaceId: input.spaceId } : {}),\n    ...(input.requestedExpiry !== undefined ? { requestedExpiry: input.requestedExpiry } : {}),\n    requested,\n    ...(input.command !== undefined\n      ? { command: { argv: [...input.command.argv], cwd: input.command.cwd } }\n      : {}),\n  });\n}\n\n/** Reads only valid canonical v1 records and refuses malformed stored artifacts. */\nexport async function listPermissionRequests(\n  profile: string,\n  context?: LegacyRequestContext,\n): Promise<PermissionRequestArtifact[]> {\n  const records: PermissionRequestArtifact[] = [];\n  for (const value of await readAuthRequests<unknown>(profile)) {\n    const canonical = PermissionRequestArtifactSchema.safeParse(value);\n    if (canonical.success) {\n      if (context !== undefined && principal(canonical.data.sessionDid) !== principal(context.sessionDid)) {\n        continue;\n      }\n      records.push(canonical.data);\n      continue;\n    }\n    const legacy = LegacyPermissionRequestArtifactSchema.safeParse(value);\n    if (!legacy.success) throw new TypeError(\"Stored authority request is malformed.\");\n    if (context === undefined) {\n      throw new TypeError(\"Legacy authority requests require the selected invocation context.\");\n    }\n    if (principal(legacy.data.sessionDid) !== principal(context.sessionDid)) continue;\n    records.push(normalizeLegacyPermissionRequest(legacy.data, context));\n  }\n  return records;\n}\n\nexport async function findPermissionRequest(\n  profile: string,\n  requestId: string,\n  identity: Pick<PermissionRequestIdentityInput, \"sessionDid\" | \"host\"> &\n    Partial<Omit<LegacyRequestContext, \"profile\" | \"host\" | \"sessionDid\">>,\n): Promise<PermissionRequestArtifact | null> {\n  const records = await listPermissionRequests(profile, {\n    profile,\n    host: identity.host,\n    sessionDid: identity.sessionDid,\n    posture: identity.posture ?? \"delegate-session\",\n    operatorType: identity.operatorType ?? \"human\",\n    ...(identity.ownerDid === undefined ? {} : { ownerDid: identity.ownerDid }),\n    ...(identity.spaceId === undefined ? {} : { spaceId: identity.spaceId }),\n  });\n  return records.find((record) =>\n    record.requestId === requestId &&\n    record.sessionDid === identity.sessionDid &&\n    record.host === identity.host,\n  ) ?? null;\n}\n\n/**\n * Atomically returns the newest identical unresolved request, or writes a new\n * v1 record. Retention, stale-session pruning, covered-record pruning, and\n * partial-grant supersession all happen in the same existing profile lock.\n */\nexport async function createOrReusePermissionRequest(\n  input: CreateOrReusePermissionRequestInput,\n): Promise<PermissionRequestResolution> {\n  // Registered operations already computed this exact missing set during\n  // canonical preflight. Do not recompute it with the legacy global matcher:\n  // that matcher intentionally treats same-named short/full spaces as equal.\n  const missing = input.resolveSpace === undefined\n    ? evaluateAuthority(input.granted, input.missing).missing\n    : canonicalizeCapabilities(input.missing);\n  const now = input.now ?? (() => new Date());\n  const observedNow = now();\n  if (Number.isNaN(observedNow.getTime())) throw new TypeError(\"The artifact clock returned an invalid date.\");\n\n  return updateProfileStore<unknown, PermissionRequestResolution>(\n    input.profile,\n    \"auth-requests\",\n    (rawRecords) => {\n      const records: PermissionRequestArtifact[] = [];\n      for (const value of rawRecords) {\n        const canonical = PermissionRequestArtifactSchema.safeParse(value);\n        if (canonical.success) {\n          if (principal(canonical.data.sessionDid) !== principal(input.sessionDid)) continue;\n          records.push(canonical.data);\n          continue;\n        }\n        const legacy = LegacyPermissionRequestArtifactSchema.safeParse(value);\n        if (!legacy.success) throw new TypeError(\"Stored authority request is malformed.\");\n        if (principal(legacy.data.sessionDid) !== principal(input.sessionDid)) continue;\n        records.push(normalizeLegacyPermissionRequest(legacy.data, {\n          profile: input.profile,\n          host: input.host,\n          sessionDid: input.sessionDid,\n          posture: input.posture,\n          operatorType: input.operatorType,\n          ...(input.ownerDid === undefined ? {} : { ownerDid: input.ownerDid }),\n          ...(input.spaceId === undefined ? {} : { spaceId: input.spaceId }),\n          now: observedNow,\n        }));\n      }\n      const retained = prunePermissionRequests(records, {\n        profile: input.profile,\n        sessionDid: input.sessionDid,\n        granted: input.granted,\n        resolveSpace: input.resolveSpace,\n        now: observedNow,\n      });\n\n      if (missing.length === 0) {\n        return { records: retained, result: { status: \"satisfied\", reused: false } };\n      }\n\n      const identity = createPermissionRequestIdentity({ ...input, missing });\n      const withoutSuperseded = retained.filter((record) => !isSupersededBy(record, input, missing));\n      const equivalent = newestEquivalentRequest(withoutSuperseded, identity);\n      if (equivalent !== undefined && input.replace !== true) {\n        return { records: withoutSuperseded, result: { status: \"created\", reused: true, request: equivalent } };\n      }\n\n      const next = withoutSuperseded.filter((record) =>\n        input.replace !== true || permissionRequestArtifactIdentity(record) !== identity,\n      );\n      const request = buildPermissionRequestArtifact({ ...input, missing, now: () => observedNow });\n      return {\n        records: [...next, request],\n        result: { status: \"created\", reused: false, request },\n      };\n    },\n  );\n}\n\nexport interface PrunePermissionRequestsInput {\n  readonly profile: string;\n  readonly sessionDid: string;\n  readonly granted: readonly PermissionEntry[];\n  readonly resolveSpace?: OperationSpaceResolver;\n  readonly now: Date;\n}\n\n/** Pure retention policy used by the locked persistence operation. */\nexport function prunePermissionRequests(\n  records: readonly PermissionRequestArtifact[],\n  input: PrunePermissionRequestsInput,\n): PermissionRequestArtifact[] {\n  const cutoff = input.now.getTime() - THIRTY_DAYS_MS;\n  return records.filter((record) => {\n    const createdAt = Date.parse(record.createdAt);\n    if (!Number.isFinite(createdAt) || createdAt < cutoff) return false;\n    if (record.profile === input.profile && principal(record.sessionDid) !== principal(input.sessionDid)) return false;\n    // Empty request arrays are historical CLI records. They carry no\n    // authority, but remain readable and are retained byte-for-byte by the\n    // shared format-1 writer for compatibility.\n    if (record.requested.length === 0) return true;\n    return !evaluateArtifactAuthority(\n      input.granted,\n      record.requested,\n      input.resolveSpace,\n    ).satisfied;\n  });\n}\n\nfunction newestEquivalentRequest(\n  records: readonly PermissionRequestArtifact[],\n  identity: string,\n): PermissionRequestArtifact | undefined {\n  let newest: PermissionRequestArtifact | undefined;\n  for (const record of records) {\n    if (permissionRequestArtifactIdentity(record) !== identity) continue;\n    if (newest === undefined || record.createdAt >= newest.createdAt) newest = record;\n  }\n  return newest;\n}\n\nfunction isSupersededBy(\n  record: PermissionRequestArtifact,\n  input: CreateOrReusePermissionRequestInput,\n  missing: readonly PermissionEntry[],\n): boolean {\n  if (\n    record.profile !== input.profile ||\n    record.sessionDid !== input.sessionDid ||\n    record.host !== input.host\n  ) {\n    return false;\n  }\n  const remaining = evaluateArtifactAuthority(\n    input.granted,\n    record.requested,\n    input.resolveSpace,\n  ).missing;\n  return remaining.length > 0 &&\n    permissionRequestArtifactIdentity(record) !==\n      createPermissionRequestIdentity({ ...input, missing }) &&\n    createPermissionRequestIdentity({ ...input, missing: remaining }) ===\n      createPermissionRequestIdentity({ ...input, missing });\n}\n\nfunction permissionRequestArtifactIdentity(record: PermissionRequestArtifact): string {\n  return createPermissionRequestIdentity({\n    profile: record.profile,\n    sessionDid: record.sessionDid,\n    host: record.host,\n    missing: record.requested,\n  });\n}\n\nfunction evaluateArtifactAuthority(\n  granted: readonly PermissionEntry[],\n  required: readonly PermissionEntry[],\n  resolveSpace?: OperationSpaceResolver,\n) {\n  return resolveSpace === undefined\n    ? evaluateAuthority(granted, required)\n    : evaluateOperationAuthority(granted, required, resolveSpace);\n}\n\nfunction defaultRequestId(now: Date): string {\n  return `req_${now.getTime().toString(36)}_${randomUUID().replace(/-/g, \"\")}`;\n}\n","// Namespace-shaped so modules that bundle this one stay compatible with\n// lightweight node-sdk test doubles.\nimport * as nodeSdk from \"@tinycloud/node-sdk\";\n\nimport { OperationInvocationError, operationError } from \"./errors.js\";\n\nconst DEFAULT_SECRETS_SPACE = \"secrets\";\nconst SECRET_MANAGER_BASE_URL = \"https://secrets.tinycloud.xyz\";\nconst SECRET_NAME_RE = /^[A-Z][A-Z0-9_]*$/;\nconst RESERVED_SECRET_SCOPES = new Set([\"default\", \"global\"]);\n\nexport interface SecretsGetInput {\n  readonly name: string;\n  readonly scope?: string;\n  readonly space?: string;\n}\n\nexport interface SecretReference {\n  readonly name: string;\n  readonly scope?: string;\n  readonly space: string;\n  readonly vaultKey: string;\n  readonly permissionPath: string;\n}\n\nexport function normalizeSecretsGetInput(\n  input: SecretsGetInput,\n): SecretsGetInput {\n  const reference = resolveSecretReference(input);\n  return {\n    name: reference.name,\n    ...(reference.scope === undefined ? {} : { scope: reference.scope }),\n    // Omission is meaningful: the CLI's default is the literal `secrets`\n    // space, while an explicitly supplied short name is resolved later against\n    // the authenticated identity.\n    ...(input.space === undefined ? {} : { space: reference.space }),\n  };\n}\n\n/** Resolves the one canonical backing key/path used by planning and setup. */\nexport function resolveSecretReference(\n  input: SecretsGetInput,\n): SecretReference {\n  const name = input.name.trim();\n  if (!SECRET_NAME_RE.test(name)) {\n    throw invalidSecretInput();\n  }\n\n  const scope = canonicalizeSecretScope(input.scope);\n  const space = normalizeSecretsSpace(input.space);\n  const vaultKey = scope === undefined\n    ? `secrets/${name}`\n    : `secrets/scoped/${scope}/${name}`;\n\n  return {\n    name,\n    ...(scope === undefined ? {} : { scope }),\n    space,\n    vaultKey,\n    permissionPath: `vault/${vaultKey}`,\n  };\n}\n\n/**\n * Resolve the operation's space against the authenticated identity. The\n * public short-name contract remains `secrets`, while an authenticated\n * operation uses its owner-exact URI for the actual read boundary.\n */\nexport function resolveSecretReferenceForOperation(\n  input: SecretsGetInput,\n  node: unknown,\n  ownerSpace?: string,\n): SecretReference {\n  const reference = resolveSecretReference(input);\n  if (input.space === undefined && ownerSpace === undefined) return reference;\n  return {\n    ...reference,\n    space: resolveOperationSpace(reference.space, node, ownerSpace),\n  };\n}\n\n/** Creates the one owner-aware resolver shared by operation matching paths. */\nexport function operationSpaceResolver(\n  node: unknown,\n  ownerSpace?: string,\n): (space: string) => string {\n  return (space) => resolveOperationSpace(space, node, ownerSpace);\n}\n\nfunction resolveOperationSpace(space: string, node: unknown, ownerSpace?: string): string {\n  if (space.startsWith(\"tinycloud:\")) return canonicalizeSpaceUri(space);\n\n  const ownerSpaceId = ownerSpace === undefined ? undefined : ownedSpaceForName(ownerSpace, space);\n  if (ownerSpaceId !== undefined) return canonicalizeSpaceUri(ownerSpaceId);\n\n  const candidate = node as {\n    resolveOwnedSpace?: (spaceName: string) => unknown;\n    spaceId?: unknown;\n    address?: unknown;\n    did?: unknown;\n  };\n  try {\n    const resolved = candidate.resolveOwnedSpace?.(space);\n    if (typeof resolved === \"string\" && resolved.length > 0) {\n      return canonicalizeSpaceUri(resolved);\n    }\n  } catch {\n    // Continue to the identity-derived resolver below.\n  }\n\n  // A restored delegate session carries the owner's primary space even though\n  // node.did is the delegate/session principal. This is the same owner\n  // identity used by the CLI space resolver.\n  if (typeof candidate.spaceId === \"string\") {\n    const resolved = ownedSpaceForName(candidate.spaceId, space);\n    if (resolved !== undefined) return canonicalizeSpaceUri(resolved);\n  }\n\n  const did = typeof candidate.did === \"string\" ? candidate.did : undefined;\n  const pkh = did === undefined ? null : nodeSdk.parsePkhDid(did);\n  if (pkh === null) {\n    throw invalidSecretInput();\n  }\n  return nodeSdk.makePkhSpaceId(pkh.address, pkh.chainId, space);\n}\n\nfunction ownedSpaceForName(ownerSpace: string, name: string): string | undefined {\n  const parsed = nodeSdk.parseSpaceUri(ownerSpace);\n  if (parsed === null) return undefined;\n  try {\n    const pkh = nodeSdk.parsePkhDid(parsed.owner);\n    return pkh === null ? undefined : nodeSdk.makePkhSpaceId(pkh.address, pkh.chainId, name);\n  } catch {\n    return undefined;\n  }\n}\n\nfunction canonicalizeSpaceUri(space: string): string {\n  const parts = space.split(\":\");\n  const name = parts.at(-1);\n  if (parts.length < 3 || name === undefined || name === \"\") {\n    throw invalidSecretInput();\n  }\n  // EIP-155 address casing is interchangeable only in the repository's\n  // anchored PKH space form. Other TinyCloud space/DID syntaxes are opaque\n  // method-specific identifiers and must remain byte-for-byte unchanged.\n  const pkh = space.match(\n    /^tinycloud:pkh:eip155:(\\d+):(0x[0-9a-fA-F]{40}):([^:]+)$/,\n  );\n  if (pkh !== null) {\n    return `tinycloud:pkh:eip155:${pkh[1]}:${nodeSdk.canonicalizeAddress(pkh[2]!).toLowerCase()}:${pkh[3]}`;\n  }\n  return space;\n}\n\n/**\n * Builds a setup action URL without ever accepting a secret value. It opens\n * Secret Manager's app with the secret's name (and scope) filled in.\n */\nexport function buildSecretSetupUrl(reference: SecretReference): string {\n  const parameters = [\n    [\"secret\", reference.name],\n    ...(reference.scope === undefined ? [] : [[\"scope\", reference.scope] as const]),\n    [\"space\", reference.space],\n  ] as const;\n  const query = parameters\n    .map(([key, value]) => `${encodeURIComponent(key)}=${encodeURIComponent(value)}`)\n    .join(\"&\");\n  return `${SECRET_MANAGER_BASE_URL}/app?${query}`;\n}\n\nfunction canonicalizeSecretScope(scope: string | undefined): string | undefined {\n  if (scope === undefined || scope === \"\") return undefined;\n\n  const trimmed = scope.trim();\n  if (trimmed === \"\") throw invalidSecretInput();\n\n  const canonical = trimmed\n    .toLowerCase()\n    .replace(/[^a-z0-9-]/g, \"-\")\n    .replace(/-+/g, \"-\")\n    .replace(/^-|-$/g, \"\");\n  if (canonical === \"\" || RESERVED_SECRET_SCOPES.has(canonical)) {\n    throw invalidSecretInput();\n  }\n  return canonical;\n}\n\nfunction normalizeSecretsSpace(space: string | undefined): string {\n  if (space === undefined || space === \"\") return DEFAULT_SECRETS_SPACE;\n\n  if (space.startsWith(\"tinycloud:\")) {\n    const parts = space.split(\":\");\n    if (parts.length < 3 || parts.at(-1) === undefined || parts.at(-1) === \"\") {\n      throw invalidSecretInput();\n    }\n    return `tinycloud:${parts.slice(1, -1).join(\":\")}:${parts.at(-1)}`;\n  }\n\n  if (!/^[A-Za-z0-9_-]+$/.test(space)) throw invalidSecretInput();\n  return space;\n}\n\nfunction invalidSecretInput(): OperationInvocationError {\n  return new OperationInvocationError(\n    operationError(\"INPUT_INVALID\", \"The secret reference is invalid.\"),\n  );\n}\n","import * as nodeSdk from \"@tinycloud/node-sdk\";\nimport type {\n  PermissionEntry,\n  PortableDelegation,\n  RuntimeDelegationActivator,\n} from \"@tinycloud/node-sdk\";\nimport { z } from \"zod\";\n\nimport {\n  canonicalizeCapabilities,\n  canonicalizeOperationCapabilities,\n  delegationWithinRequest,\n  evaluateAuthority,\n  validateExactCapabilities,\n} from \"../authority.js\";\nimport {\n  createOrReusePermissionRequest,\n  DelegationImportArtifactSchema,\n  findPermissionRequest,\n  listPermissionRequests,\n  PermissionEntrySchema,\n  type DelegationImportArtifact,\n  type DelegationRequestBinding,\n  type PermissionRequestArtifact,\n} from \"../artifacts.js\";\nimport type {\n  OperationContext,\n  OperationDefinition,\n  OperationExecutionOutcome,\n  OperationExposure,\n  OperationSensitivity,\n  RuntimeOperationContext,\n  TinyCloudPosture,\n} from \"../contract.js\";\nimport { operationError } from \"../errors.js\";\nimport { lookupOperation } from \"../registry.js\";\nimport {\n  readSession,\n  readProfile,\n  updateProfileStore,\n} from \"../state.js\";\nimport { operationSpaceResolver } from \"../secrets.js\";\n\ntype CapabilitiesInput = Record<never, never>;\ntype CapabilitiesOutput = { readonly capabilities: readonly PermissionEntry[] };\ntype AuthRequestInput =\n  | Readonly<{ requestId: string }>\n  | Readonly<{\n    operationId: string;\n    operationVersion: number;\n    input?: unknown;\n  }>;\ntype AuthRequestOutput = Readonly<{\n  missing: readonly PermissionEntry[];\n  request?: PermissionRequestArtifact;\n}>;\ntype AuthImportOutput = Readonly<{\n  cid: string;\n  effectivePermissions: readonly PermissionEntry[];\n  expiry: string;\n  audience: string;\n  host: string;\n  activated: true;\n  alreadyPresent: boolean;\n}>;\n\nconst EmptyInputSchema: z.ZodType<CapabilitiesInput> = z.object({}).strict();\nconst CapabilitiesOutputSchema: z.ZodType<CapabilitiesOutput> = z.object({\n  capabilities: z.array(PermissionEntrySchema),\n}).strict();\nconst AuthRequestInputSchema: z.ZodType<AuthRequestInput> = z.union([\n  z.object({ requestId: z.string().min(1) }).strict(),\n  z.object({\n    operationId: z.string().min(1),\n    operationVersion: z.number().int().positive(),\n    input: z.unknown(),\n  }).strict().superRefine((value, issue) => {\n    if (!Object.prototype.hasOwnProperty.call(value, \"input\")) {\n      issue.addIssue({ code: z.ZodIssueCode.custom, message: \"Operation input is required.\" });\n    }\n  }),\n]);\nconst PermissionRequestOutputSchema = z.object({\n  kind: z.literal(\"tinycloud.auth.request\"),\n  version: z.literal(1),\n  requestId: z.string().min(1),\n  createdAt: z.string().datetime({ offset: true }),\n  profile: z.string().min(1),\n  posture: z.enum([\"owner-openkey\", \"delegate-session\", \"local-owner-key\", \"unauthenticated\"]),\n  operatorType: z.enum([\"human\", \"agent\"]),\n  host: z.string().min(1),\n  sessionDid: z.string().min(1),\n  ownerDid: z.string().min(1).optional(),\n  spaceId: z.string().min(1).optional(),\n  requestedExpiry: z.union([z.string(), z.number()]).optional(),\n  requested: z.array(PermissionEntrySchema).min(1),\n  command: z.object({ argv: z.array(z.string()).min(1), cwd: z.string().min(1) }).strict().optional(),\n}).strict();\nconst AuthRequestOutputSchema: z.ZodType<AuthRequestOutput> = z.object({\n  missing: z.array(PermissionEntrySchema),\n  request: PermissionRequestOutputSchema.optional(),\n}).strict();\nconst AuthImportOutputSchema: z.ZodType<AuthImportOutput> = z.object({\n  cid: z.string().min(1),\n  effectivePermissions: z.array(PermissionEntrySchema),\n  expiry: z.string().datetime({ offset: true }),\n  audience: z.string().min(1),\n  host: z.string().min(1),\n  activated: z.literal(true),\n  alreadyPresent: z.boolean(),\n}).strict();\n\nconst AUTH_POSTURES: readonly TinyCloudPosture[] = [\n  \"owner-openkey\",\n  \"delegate-session\",\n  \"local-owner-key\",\n];\nconst AUTH_EXPOSURE: OperationExposure = {\n  cli: { status: \"required\" },\n  mcp: { status: \"required\" },\n  skill: { status: \"required\" },\n  docs: { status: \"required\" },\n};\nconst AUTH_CAPABILITIES_SENSITIVITY: OperationSensitivity = { input: [], output: [] };\nconst AUTH_REQUEST_SENSITIVITY: OperationSensitivity = { input: [\"/input\"], output: [] };\nconst AUTH_IMPORT_SENSITIVITY: OperationSensitivity = { input: [\"\"], output: [] };\n\n/**\n * Internal I2 auth definitions. Registry integration intentionally owns their\n * registration and root exports remain limited to invokeOperation.\n */\ntype AuthOperationDefinition =\n  | OperationDefinition<CapabilitiesInput, CapabilitiesOutput>\n  | OperationDefinition<AuthRequestInput, AuthRequestOutput>\n  | OperationDefinition<DelegationImportArtifact, AuthImportOutput>;\n\nexport const authOperationDefinitions: readonly AuthOperationDefinition[] = [\n  {\n    id: \"tinycloud.auth.capabilities\",\n    version: 1,\n    title: \"TinyCloud active capabilities\",\n    description: \"Inspect validated active runtime capabilities for the selected profile.\",\n    input: EmptyInputSchema,\n    output: CapabilitiesOutputSchema,\n    effects: [\"read\"],\n    runtime: \"authenticated\",\n    postures: AUTH_POSTURES,\n    exposure: AUTH_EXPOSURE,\n    sensitivity: AUTH_CAPABILITIES_SENSITIVITY,\n    authority: async () => [],\n    execute: async (context: OperationContext): Promise<OperationExecutionOutcome<CapabilitiesOutput>> => ({\n      status: \"ok\",\n      output: {\n        capabilities: canonicalizeCapabilities(\n          (context.runtime?.granted ?? []) as unknown as PermissionEntry[],\n        ),\n      },\n    }),\n  },\n  {\n    id: \"tinycloud.auth.request\",\n    version: 1,\n    title: \"Request TinyCloud capabilities\",\n    description: \"Create or recover an exact stored request from a canonical operation planner.\",\n    input: AuthRequestInputSchema,\n    output: AuthRequestOutputSchema,\n    effects: [\"local_write\"],\n    runtime: \"authenticated\",\n    postures: AUTH_POSTURES,\n    exposure: AUTH_EXPOSURE,\n    sensitivity: AUTH_REQUEST_SENSITIVITY,\n    authority: async () => [],\n    execute: (context: OperationContext, input: AuthRequestInput) => requestExactAuthority(\n      context as RuntimeOperationContext,\n      input,\n    ),\n  },\n  {\n    id: \"tinycloud.auth.import\",\n    version: 1,\n    title: \"Import TinyCloud delegation\",\n    description: \"Validate, activate, and persist one request-bound runtime delegation.\",\n    input: DelegationImportArtifactSchema,\n    output: AuthImportOutputSchema,\n    effects: [\"local_write\"],\n    runtime: \"authenticated\",\n    postures: AUTH_POSTURES,\n    exposure: AUTH_EXPOSURE,\n    sensitivity: AUTH_IMPORT_SENSITIVITY,\n    invalidInputErrorCode: \"DELEGATION_ARTIFACT_INVALID\",\n    authority: async () => [],\n    execute: (context: OperationContext, input: DelegationImportArtifact) => importRequestBoundDelegation(\n      context as RuntimeOperationContext,\n      input,\n    ),\n  },\n];\n\nasync function requestExactAuthority(\n  context: RuntimeOperationContext,\n  input: AuthRequestInput,\n): Promise<OperationExecutionOutcome<AuthRequestOutput>> {\n  const sessionDid = context.summary.sessionDid;\n  if (sessionDid === undefined) return missingSession();\n\n  if (\"requestId\" in input) {\n    try {\n      const request = await findPermissionRequest(context.summary.profile, input.requestId, {\n        sessionDid,\n        host: context.summary.host,\n        posture: context.summary.posture,\n        operatorType: context.summary.operatorType ?? \"human\",\n        ...(context.summary.ownerDid === undefined ? {} : { ownerDid: context.summary.ownerDid }),\n        ...(context.summary.space === undefined ? {} : { spaceId: context.summary.space }),\n      });\n      if (request === null) {\n        return invalidInput(\"The requested authority request is not available for this session.\");\n      }\n      if (request.profile !== context.summary.profile) {\n        return invalidInput(\"The requested authority request is not available for this profile.\");\n      }\n      const required = exactCapabilities(request.requested);\n      if (required === undefined) {\n        return operationFailure(\n          \"PERMISSION_HINT_INVALID\",\n          \"The stored authority request has invalid capabilities.\",\n        );\n      }\n      const evaluation = evaluateAuthority(\n        context.runtime.granted as unknown as PermissionEntry[],\n        required,\n      );\n      if (evaluation.satisfied) {\n        return { status: \"ok\", output: { missing: [] } };\n      }\n      const narrowed = await createOrReusePermissionRequest({\n        profile: context.summary.profile,\n        posture: context.summary.posture,\n        operatorType: context.summary.operatorType ?? \"human\",\n        host: context.summary.host,\n        sessionDid,\n        ...(context.summary.ownerDid === undefined ? {} : { ownerDid: context.summary.ownerDid }),\n        ...(context.summary.space === undefined ? {} : { spaceId: context.summary.space }),\n        missing: evaluation.missing,\n        granted: context.runtime.granted as unknown as PermissionEntry[],\n      });\n      if (narrowed.status === \"satisfied\") return { status: \"ok\", output: { missing: [] } };\n      return { status: \"ok\", output: { missing: evaluation.missing, request: narrowed.request } };\n    } catch {\n      return internalFailure();\n    }\n  }\n\n  const target = lookupOperation(input.operationId, input.operationVersion);\n  if (target.status === \"operation_not_found\") {\n    return operationFailure(\"OPERATION_NOT_FOUND\", \"The requested operation is not registered.\");\n  }\n  if (target.status === \"operation_version_unsupported\") {\n    return operationFailure(\n      \"OPERATION_VERSION_UNSUPPORTED\",\n      \"The requested operation version is not supported.\",\n    );\n  }\n  if (target.definition.id === \"tinycloud.auth.request\") {\n    return invalidInput(\"Authority requests cannot plan themselves.\");\n  }\n  if (!target.definition.postures.includes(context.summary.posture)) {\n    return operationFailure(\n      \"PROFILE_POSTURE_NOT_ALLOWED\",\n      \"The active profile posture cannot execute this operation.\",\n    );\n  }\n\n  const parsed = target.definition.input.safeParse(input.input);\n  if (!parsed.success) return invalidInput(\"The operation input is invalid.\");\n\n  try {\n    const planned = await target.definition.authority(context, parsed.data);\n    const required = exactCapabilities(planned);\n    if (required === undefined) {\n      return operationFailure(\n        \"PERMISSION_HINT_INVALID\",\n        \"The operation returned an invalid permission requirement.\",\n      );\n    }\n    const evaluation = evaluateAuthority(\n      context.runtime.granted as unknown as PermissionEntry[],\n      required,\n    );\n    if (evaluation.satisfied) {\n      // Do not call the artifact store: even a retention-only write is not an\n      // allowed side effect for an already-authorized request.\n      return { status: \"ok\", output: { missing: [] } };\n    }\n    const request = await createOrReusePermissionRequest({\n      profile: context.summary.profile,\n      posture: context.summary.posture,\n      operatorType: context.summary.operatorType ?? \"human\",\n      host: context.summary.host,\n      sessionDid,\n      ...(context.summary.ownerDid === undefined ? {} : { ownerDid: context.summary.ownerDid }),\n      ...(context.summary.space === undefined ? {} : { spaceId: context.summary.space }),\n      missing: evaluation.missing,\n      granted: context.runtime.granted as unknown as PermissionEntry[],\n    });\n    if (request.status === \"satisfied\") return { status: \"ok\", output: { missing: [] } };\n    return {\n      status: \"ok\",\n      output: { missing: evaluation.missing, request: request.request },\n    };\n  } catch {\n    return internalFailure();\n  }\n}\n\nasync function importRequestBoundDelegation(\n  context: RuntimeOperationContext,\n  input: DelegationImportArtifact,\n): Promise<OperationExecutionOutcome<AuthImportOutput>> {\n  try {\n    const rawDelegation = input.delegation as unknown as Record<string, unknown>;\n    if (typeof rawDelegation.delegateDID !== \"string\") return invalidDelegation();\n    if (context.summary.sessionDid !== undefined && !samePrincipal(\n      rawDelegation.delegateDID,\n      context.summary.sessionDid,\n    )) {\n      return audienceMismatch(context.summary.sessionDid, rawDelegation.delegateDID);\n    }\n    const initial = await importState(context, input.requestId);\n    if (!initial.ok) return initial.result;\n    const { request, sessionDid, host } = initial;\n    const explicitHost = rawDelegation.host;\n    if (explicitHost !== undefined && typeof explicitHost !== \"string\") {\n      return invalidDelegation();\n    }\n    if (typeof explicitHost === \"string\" && normalizeHost(explicitHost) !== normalizeHost(host)) {\n      return hostMismatch(host, explicitHost);\n    }\n    const expiry = normalizeExpiry(rawDelegation.expiry);\n    if (expiry === undefined) return invalidDelegation();\n    if (expiry.getTime() <= Date.now()) return expiredDelegation();\n    if (input.delegationCid !== undefined && input.delegationCid !== rawDelegation.cid) {\n      return invalidDelegation();\n    }\n    if (typeof rawDelegation.delegateDID !== \"string\" || !samePrincipal(rawDelegation.delegateDID, sessionDid)) {\n      return audienceMismatch(sessionDid, String(rawDelegation.delegateDID ?? \"unknown\"));\n    }\n\n    const delegation = {\n      ...rawDelegation,\n      expiry,\n      host: explicitHost ?? host,\n    } as PortableDelegation;\n    let activated: Awaited<ReturnType<typeof nodeSdk.activateValidatedRuntimeDelegation>>;\n    try {\n      activated = await nodeSdk.activateValidatedRuntimeDelegation(\n        context.runtime.node as RuntimeDelegationActivator,\n        delegation,\n        { host },\n      );\n    } catch {\n      return operationFailure(\n        \"DELEGATION_REJECTED\",\n        \"The delegation was rejected by the TinyCloud runtime.\",\n      );\n    }\n\n    const effectivePermissions = canonicalizeCapabilities(activated.effectivePermissions);\n    const resolveSpace = operationSpaceResolver(\n      context.runtime.node,\n      context.summary.space,\n    );\n    if (!delegationWithinRequest(request.requested, effectivePermissions, resolveSpace)) {\n      return operationFailure(\n        \"DELEGATION_REJECTED\",\n        \"The delegation exceeds the stored authority request.\",\n      );\n    }\n\n    try {\n      return await updateProfileStore<Record<string, unknown>, OperationExecutionOutcome<AuthImportOutput>>(\n        context.summary.profile,\n        \"additional-delegations\",\n        async (records) => {\n          const state = await importState(context, input.requestId);\n          if (!state.ok) return { records, result: state.result };\n          if (state.sessionDid !== sessionDid || normalizeHost(state.host) !== normalizeHost(host)) {\n            return {\n              records,\n              result: audienceMismatch(state.sessionDid, sessionDid),\n            };\n          }\n          if (state.request.profile !== context.summary.profile ||\n            !samePrincipal(state.request.sessionDid, sessionDid) ||\n            normalizeHost(state.request.host) !== normalizeHost(host) ||\n            JSON.stringify(canonicalizeOperationCapabilities(state.request.requested, resolveSpace)) !==\n              JSON.stringify(canonicalizeOperationCapabilities(request.requested, resolveSpace))) {\n            return {\n              records,\n              result: operationFailure(\n                \"DELEGATION_ARTIFACT_INVALID\",\n                \"The delegation does not reference a current stored request.\",\n              ),\n            };\n          }\n          // Replay re-checks the delegation against this binding; the stored\n          // request itself may later be pruned.\n          const record = {\n            delegation: activated.delegation,\n            permissions: activated.effectivePermissions,\n            authorityRequest: {\n              requestId: request.requestId,\n              requested: request.requested,\n            } satisfies DelegationRequestBinding,\n          };\n          // A validated import replaces every stored row for its CID with this\n          // record, whatever binding those rows carried (none, a synthesized\n          // one, or one replay cannot use), keeping the first row's position.\n          const position = records.findIndex((entry) => delegationCid(entry) === activated.cid);\n          const alreadyPresent = position !== -1;\n          const others = records.filter((entry) => delegationCid(entry) !== activated.cid);\n          return {\n            records: alreadyPresent\n              ? [...others.slice(0, position), record, ...others.slice(position)]\n              : [...records, record],\n            result: {\n              status: \"ok\",\n              output: {\n                cid: activated.cid,\n                effectivePermissions,\n                expiry: activated.expiry.toISOString(),\n                audience: activated.audience,\n                host: activated.host,\n                activated: true,\n                alreadyPresent,\n              },\n            },\n          };\n        },\n      );\n    } catch {\n      return internalImportFailure();\n    }\n  } catch {\n    return internalImportFailure();\n  }\n}\n\nasync function importState(\n  context: RuntimeOperationContext,\n  requestId: string,\n): Promise<\n  | { ok: true; request: PermissionRequestArtifact; sessionDid: string; host: string }\n  | { ok: false; result: OperationExecutionOutcome<never> }\n> {\n  const sessionDid = await currentSessionDid(context.summary.profile);\n  if (sessionDid === undefined) return { ok: false, result: missingSession() };\n  if (context.summary.sessionDid === undefined || !samePrincipal(context.summary.sessionDid, sessionDid)) {\n    return { ok: false, result: audienceMismatch(sessionDid, context.summary.sessionDid ?? \"unknown\") };\n  }\n  const current = await readProfile<Record<string, unknown>>(context.summary.profile);\n  const host = typeof current?.host === \"string\" ? current.host : context.summary.host;\n  if (normalizeHost(host) !== normalizeHost(context.summary.host)) {\n    return { ok: false, result: hostMismatch(context.summary.host, host) };\n  }\n  let requests: PermissionRequestArtifact[];\n  try {\n    requests = await listPermissionRequests(context.summary.profile, {\n      profile: context.summary.profile,\n      host: context.summary.host,\n      sessionDid,\n      posture: context.summary.posture,\n      operatorType: context.summary.operatorType ?? \"human\",\n      ...(context.summary.ownerDid === undefined ? {} : { ownerDid: context.summary.ownerDid }),\n      ...(context.summary.space === undefined ? {} : { spaceId: context.summary.space }),\n    });\n  } catch {\n    return {\n      ok: false,\n      result: operationFailure(\n        \"DELEGATION_ARTIFACT_INVALID\",\n        \"The stored authority request is malformed.\",\n      ),\n    };\n  }\n  const request = requests.find((candidate) => candidate.requestId === requestId);\n  if (request === undefined || request.profile !== context.summary.profile) {\n    return {\n      ok: false,\n      result: operationFailure(\n        \"DELEGATION_ARTIFACT_INVALID\",\n        \"The delegation does not reference a stored request for this profile.\",\n      ),\n    };\n  }\n  if (normalizeHost(request.host) !== normalizeHost(host)) {\n    return { ok: false, result: hostMismatch(host, request.host) };\n  }\n  if (!samePrincipal(request.sessionDid, sessionDid)) {\n    return { ok: false, result: audienceMismatch(sessionDid, request.sessionDid) };\n  }\n  return { ok: true, request, sessionDid, host };\n}\n\nfunction exactCapabilities(value: unknown): PermissionEntry[] | undefined {\n  return validateExactCapabilities(value);\n}\n\nfunction normalizeExpiry(value: unknown): Date | undefined {\n  const expiry = value instanceof Date ? value : typeof value === \"string\" ? new Date(value) : undefined;\n  return expiry !== undefined && !Number.isNaN(expiry.getTime()) ? expiry : undefined;\n}\n\nfunction normalizeHost(host: string): string {\n  return host.replace(/\\/+$/, \"\");\n}\n\nfunction samePrincipal(left: string, right: string): boolean {\n  return left.split(\"#\", 1)[0] === right.split(\"#\", 1)[0];\n}\n\nfunction delegationCid(value: Record<string, unknown>): string | undefined {\n  const delegation = value.delegation;\n  if (delegation === null || typeof delegation !== \"object\") return undefined;\n  const cid = (delegation as { cid?: unknown }).cid;\n  return typeof cid === \"string\" ? cid : undefined;\n}\n\nasync function currentSessionDid(profile: string): Promise<string | undefined> {\n  const session = await readSession<Record<string, unknown>>(profile);\n  if (session === null || typeof session.verificationMethod !== \"string\") return undefined;\n  return session.verificationMethod.split(\"#\", 1)[0] || undefined;\n}\n\nfunction missingSession(): OperationExecutionOutcome<never> {\n  return operationFailure(\"SESSION_NOT_FOUND\", \"The selected profile does not have an active session.\");\n}\n\nfunction invalidDelegation(): OperationExecutionOutcome<never> {\n  return operationFailure(\"DELEGATION_ARTIFACT_INVALID\", \"The delegation artifact is invalid.\");\n}\n\nfunction expiredDelegation(): OperationExecutionOutcome<never> {\n  return operationFailure(\"DELEGATION_EXPIRED\", \"The delegation has expired.\");\n}\n\nfunction audienceMismatch(expectedSessionDid: string, artifactAudience: string): OperationExecutionOutcome<never> {\n  return operationFailure(\"DELEGATION_AUDIENCE_MISMATCH\", \"The delegation is for a different session.\", {\n    expectedSessionDid,\n    artifactAudience,\n  });\n}\n\nfunction hostMismatch(expectedHost: string, artifactHost: string): OperationExecutionOutcome<never> {\n  return operationFailure(\"DELEGATION_HOST_MISMATCH\", \"The delegation is for a different host.\", {\n    expectedHost,\n    artifactHost,\n  });\n}\n\nfunction invalidInput(message: string): OperationExecutionOutcome<never> {\n  return operationFailure(\"INPUT_INVALID\", message);\n}\n\nfunction internalFailure(): OperationExecutionOutcome<never> {\n  return operationFailure(\"INTERNAL_ERROR\", \"The authority request could not be completed.\");\n}\n\nfunction internalImportFailure(): OperationExecutionOutcome<never> {\n  return operationFailure(\"INTERNAL_ERROR\", \"The delegation import could not be completed.\");\n}\n\nfunction operationFailure(\n  code: Parameters<typeof operationError>[0],\n  message: string,\n  details?: Readonly<Record<string, unknown>>,\n): OperationExecutionOutcome<never> {\n  return { status: \"error\", error: operationError(code, message, { ...(details === undefined ? {} : { details }) }) };\n}\n","import type { TinyCloudNode } from \"@tinycloud/node-sdk\";\nimport { authorizationVerdictOf, validatedCapabilityOf } from \"@tinycloud/sdk-services\";\nimport { z } from \"zod\";\n\nimport type {\n  CapabilityRequirement,\n  OperationContext,\n  OperationDefinition,\n  OperationExecutionOutcome,\n  OperationExposure,\n  OperationSensitivity,\n  RuntimeOperationContext,\n  TinyCloudPosture,\n} from \"../contract.js\";\nimport { OperationInvocationError, operationError } from \"../errors.js\";\nimport { operationSpaceResolver } from \"../secrets.js\";\n\ntype EmptyInput = Record<never, never>;\n\ninterface AccountSpacesOutput {\n  readonly spaces: readonly {\n    readonly spaceId: string;\n    readonly name: string;\n    readonly ownerDid: string;\n    readonly type: \"owned\" | \"delegated\" | \"discovered\";\n    readonly permissions: readonly string[];\n    readonly status: \"active\" | \"archived\";\n    readonly registeredAt?: string;\n    readonly updatedAt?: string;\n    readonly expiresAt?: string;\n  }[];\n  readonly count: number;\n}\n\ninterface AccountApplicationsOutput {\n  readonly applications: readonly {\n    readonly appId: string;\n    readonly manifests: readonly Record<string, unknown>[];\n    readonly updatedAt?: string;\n    readonly name?: string;\n    readonly description?: string;\n    readonly manifestHash?: string;\n  }[];\n  readonly count: number;\n}\n\ninterface KvListInput {\n  readonly space: string;\n  readonly prefix?: string;\n  readonly limit?: number;\n}\n\ninterface KvListOutput {\n  readonly space: string;\n  readonly prefix: string;\n  readonly keys: readonly string[];\n  readonly count: number;\n  readonly truncated: boolean;\n}\n\ninterface KvGetInput {\n  readonly space: string;\n  readonly key: string;\n  readonly representation?: \"base64\" | \"text\" | \"json\";\n}\n\ninterface KvGetOutput {\n  readonly space: string;\n  readonly key: string;\n  readonly value: unknown;\n  readonly encoding: \"json\" | \"text\" | \"base64\";\n  readonly metadata: {\n    readonly etag?: string;\n    readonly contentType?: string;\n    readonly lastModified?: string;\n    readonly contentLength?: number;\n  };\n  readonly byteLength: number;\n}\n\ntype JsonValue = null | boolean | number | string | JsonValue[] | { [key: string]: JsonValue };\ntype KvPutContent =\n  | Readonly<{ encoding: \"utf8\"; value: string }>\n  | Readonly<{ encoding: \"json\"; value: JsonValue }>\n  | Readonly<{ encoding: \"base64\"; value: string }>;\ntype KvPutInput = Readonly<{\n  space: string;\n  key: string;\n  content: KvPutContent;\n  contentType?: string;\n}> & (\n  | Readonly<{ mode: \"create\" | \"upsert\" }>\n  | Readonly<{ mode: \"replace\"; etag: string }>\n);\ninterface KvPutOutput {\n  readonly space: string;\n  readonly key: string;\n  readonly mode: \"create\" | \"replace\" | \"upsert\";\n  readonly byteLength: number;\n  readonly metadata: KvMetadata;\n}\ninterface KvHeadInput { readonly space: string; readonly key: string }\ninterface KvHeadOutput { readonly space: string; readonly key: string; readonly metadata: KvMetadata }\ninterface KvDeleteInput { readonly space: string; readonly key: string; readonly etag?: string }\ninterface KvDeleteOutput { readonly space: string; readonly key: string; readonly deleted: true; readonly etag?: string }\ninterface KvMetadata {\n  readonly etag?: string;\n  readonly contentType?: string;\n  readonly lastModified?: string;\n  readonly contentLength?: number;\n}\ntype KvOperationResult<T> =\n  | Readonly<{ ok: true; data: T }>\n  | Readonly<{ ok: false; error: Readonly<{ code?: string; meta?: Readonly<Record<string, unknown>> }> }>;\ninterface KvOperationHandle {\n  list(options: Readonly<{ prefix?: string; limit: number }>): Promise<KvOperationResult<{\n    readonly keys: readonly string[];\n    readonly truncated?: boolean;\n  }>>;\n  get(key: string, options: Readonly<{\n    binary: true;\n    maxResponseBytes: number;\n  }>): Promise<KvOperationResult<{ readonly data: Uint8Array; readonly headers: KvMetadata }>>;\n  head(key: string): Promise<KvOperationResult<{ readonly data: void; readonly headers: KvMetadata }>>;\n  put(key: string, value: Uint8Array, options: Readonly<{\n    contentType: string;\n    ifNoneMatch?: \"*\";\n    ifMatch?: string;\n  }>): Promise<KvOperationResult<{ readonly data: void; readonly headers: KvMetadata }>>;\n  delete(key: string, options: Readonly<{ ifMatch?: string }>): Promise<KvOperationResult<{\n    readonly data: void;\n    readonly headers: KvMetadata;\n  }>>;\n}\n\nconst MAX_KV_VALUE_BYTES = 1024 * 1024;\nconst DEFAULT_KV_LIST_LIMIT = 100;\nconst MAX_ACCOUNT_REGISTRY_RECORDS = 1000;\nconst MAX_ACCOUNT_REGISTRY_BYTES = 4 * 1024 * 1024;\n\nconst EmptyInputSchema: z.ZodType<EmptyInput> = z.object({}).strict();\nconst SpaceSchema = z.string().min(1).refine(\n  (space) =>\n    (/^[A-Za-z0-9_-]+$/.test(space) || space.startsWith(\"tinycloud:\")) &&\n    !space.includes(\"*\"),\n  \"Invalid TinyCloud space.\",\n);\nconst PrefixSchema = z.string().refine(\n  (prefix) => prefix !== \"/\" && !prefix.includes(\"*\"),\n  \"Invalid KV prefix.\",\n);\nconst KeySchema = z.string().min(1).refine(\n  (key) => key !== \"/\" && !key.endsWith(\"/\") && !key.includes(\"*\"),\n  \"Invalid KV key.\",\n);\nconst LimitSchema = z.number().int().min(1).max(1000);\nconst StrongEtagSchema = z.string().regex(\n  /^\"blake3-[0-9a-f]{64}\"$/,\n  \"A strong TinyCloud BLAKE3 ETag is required.\",\n);\nconst ContentTypeSchema = z.string().min(1).max(128).refine(\n  (value) => !/[\\x00-\\x1f\\x7f]/.test(value),\n  \"Invalid content type.\",\n);\nconst JsonNumberSchema = z.number().finite().refine(\n  (value) => !Number.isInteger(value) || Number.isSafeInteger(value),\n  \"JSON integer values must be JavaScript safe integers.\",\n);\nconst JsonValueSchema: z.ZodType<JsonValue> = z.lazy(() => z.union([\n  z.null(),\n  z.boolean(),\n  JsonNumberSchema,\n  z.string(),\n  z.array(JsonValueSchema),\n  z.record(JsonValueSchema),\n]));\nconst KvMetadataSchema: z.ZodType<KvMetadata> = z.object({\n  etag: z.string().optional(),\n  contentType: z.string().optional(),\n  lastModified: z.string().optional(),\n  contentLength: z.number().int().nonnegative().optional(),\n}).strict();\n\nconst AccountSpaceSchema = z.object({\n  spaceId: z.string().min(1),\n  name: z.string().min(1),\n  ownerDid: z.string(),\n  type: z.enum([\"owned\", \"delegated\", \"discovered\"]),\n  permissions: z.array(z.string()),\n  status: z.enum([\"active\", \"archived\"]),\n  registeredAt: z.string().optional(),\n  updatedAt: z.string().optional(),\n  expiresAt: z.string().datetime({ offset: true }).optional(),\n}).strict();\nconst AccountSpacesOutputSchema: z.ZodType<AccountSpacesOutput> = z.object({\n  spaces: z.array(AccountSpaceSchema),\n  count: z.number().int().nonnegative(),\n}).strict();\n\nconst AccountApplicationSchema = z.object({\n  appId: z.string().min(1),\n  manifests: z.array(z.record(z.unknown())),\n  updatedAt: z.string().optional(),\n  name: z.string().optional(),\n  description: z.string().optional(),\n  manifestHash: z.string().optional(),\n}).strict();\nconst AccountApplicationsOutputSchema: z.ZodType<AccountApplicationsOutput> = z.object({\n  applications: z.array(AccountApplicationSchema),\n  count: z.number().int().nonnegative(),\n}).strict();\n\nconst KvListInputSchema: z.ZodType<KvListInput> = z.object({\n  space: SpaceSchema,\n  prefix: PrefixSchema.optional(),\n  limit: LimitSchema.optional(),\n}).strict();\nconst KvListOutputSchema: z.ZodType<KvListOutput> = z.object({\n  space: z.string().min(1),\n  prefix: z.string(),\n  keys: z.array(z.string()),\n  count: z.number().int().nonnegative(),\n  truncated: z.boolean(),\n}).strict();\n\nconst KvGetInputSchema: z.ZodType<KvGetInput> = z.object({\n  space: SpaceSchema,\n  key: KeySchema,\n  representation: z.enum([\"base64\", \"text\", \"json\"]).optional(),\n}).strict();\nconst KvGetOutputSchema: z.ZodType<KvGetOutput> = z.object({\n  space: z.string().min(1),\n  key: z.string().min(1),\n  value: z.union([\n    z.string(),\n    z.number(),\n    z.boolean(),\n    z.null(),\n    z.array(z.unknown()),\n    z.record(z.unknown()),\n  ]),\n  encoding: z.enum([\"json\", \"text\", \"base64\"]),\n  metadata: KvMetadataSchema,\n  byteLength: z.number().int().nonnegative(),\n}).strict();\n\nconst KvPutContentSchema: z.ZodType<KvPutContent> = z.discriminatedUnion(\"encoding\", [\n  z.object({ encoding: z.literal(\"utf8\"), value: z.string() }).strict(),\n  z.object({ encoding: z.literal(\"json\"), value: JsonValueSchema }).strict(),\n  z.object({ encoding: z.literal(\"base64\"), value: z.string() }).strict(),\n]).superRefine((content, context) => {\n  const decoded = decodeKvPutContent(content);\n  if (decoded === undefined) {\n    context.addIssue({ code: z.ZodIssueCode.custom, message: \"Invalid canonical base64 content.\" });\n  } else if (decoded.byteLength > MAX_KV_VALUE_BYTES) {\n    context.addIssue({\n      code: z.ZodIssueCode.too_big,\n      type: \"array\",\n      maximum: MAX_KV_VALUE_BYTES,\n      inclusive: true,\n      message: `KV content must not exceed ${MAX_KV_VALUE_BYTES} bytes.`,\n    });\n  }\n});\nconst KvPutCommonSchema = {\n  space: SpaceSchema,\n  key: KeySchema,\n  content: KvPutContentSchema,\n  contentType: ContentTypeSchema.optional(),\n};\nconst KvPutInputSchema: z.ZodType<KvPutInput> = z.discriminatedUnion(\"mode\", [\n  z.object({ ...KvPutCommonSchema, mode: z.literal(\"create\") }).strict(),\n  z.object({ ...KvPutCommonSchema, mode: z.literal(\"upsert\") }).strict(),\n  z.object({ ...KvPutCommonSchema, mode: z.literal(\"replace\"), etag: StrongEtagSchema }).strict(),\n]);\nconst KvPutOutputSchema: z.ZodType<KvPutOutput> = z.object({\n  space: z.string().min(1),\n  key: z.string().min(1),\n  mode: z.enum([\"create\", \"replace\", \"upsert\"]),\n  byteLength: z.number().int().nonnegative(),\n  metadata: KvMetadataSchema,\n}).strict();\nconst KvHeadInputSchema: z.ZodType<KvHeadInput> = z.object({ space: SpaceSchema, key: KeySchema }).strict();\nconst KvHeadOutputSchema: z.ZodType<KvHeadOutput> = z.object({\n  space: z.string().min(1), key: z.string().min(1), metadata: KvMetadataSchema,\n}).strict();\nconst KvDeleteInputSchema: z.ZodType<KvDeleteInput> = z.object({\n  space: SpaceSchema, key: KeySchema, etag: StrongEtagSchema.optional(),\n}).strict();\nconst KvDeleteOutputSchema: z.ZodType<KvDeleteOutput> = z.object({\n  space: z.string().min(1), key: z.string().min(1), deleted: z.literal(true), etag: z.string().optional(),\n}).strict();\n\nconst AUTHENTICATED_POSTURES: readonly TinyCloudPosture[] = [\n  \"owner-openkey\",\n  \"delegate-session\",\n  \"local-owner-key\",\n];\nconst EXPLORATION_EXPOSURE: OperationExposure = {\n  cli: {\n    status: \"excluded\",\n    reason: \"Existing account and KV Commander commands remain the CLI surface.\",\n  },\n  mcp: { status: \"required\" },\n  skill: { status: \"required\" },\n  docs: { status: \"required\" },\n};\n\nconst ACCOUNT_SPACES_SENSITIVITY: OperationSensitivity = {\n  input: [],\n  output: [\"/spaces\"],\n};\nconst ACCOUNT_APPLICATIONS_SENSITIVITY: OperationSensitivity = {\n  input: [],\n  output: [\"/applications\"],\n};\nconst KV_LIST_SENSITIVITY: OperationSensitivity = {\n  input: [\"/prefix\"],\n  output: [\"/keys\"],\n};\nconst KV_GET_SENSITIVITY: OperationSensitivity = {\n  input: [\"/key\"],\n  output: [\"/value\"],\n};\nconst KV_PUT_SENSITIVITY: OperationSensitivity = { input: [\"/key\", \"/content\"], output: [] };\nconst KV_KEY_SENSITIVITY: OperationSensitivity = { input: [\"/key\"], output: [] };\n\ntype ExplorationDefinition =\n  | OperationDefinition<EmptyInput, AccountSpacesOutput>\n  | OperationDefinition<EmptyInput, AccountApplicationsOutput>\n  | OperationDefinition<KvListInput, KvListOutput>\n  | OperationDefinition<KvGetInput, KvGetOutput>\n  | OperationDefinition<KvPutInput, KvPutOutput>\n  | OperationDefinition<KvHeadInput, KvHeadOutput>\n  | OperationDefinition<KvDeleteInput, KvDeleteOutput>;\n\nexport const explorationOperationDefinitions: readonly ExplorationDefinition[] = [\n  {\n    id: \"tinycloud.account.spaces.list\",\n    version: 1,\n    title: \"List TinyCloud account spaces\",\n    description: \"List the spaces registered in the selected owner's TinyCloud account.\",\n    input: EmptyInputSchema,\n    output: AccountSpacesOutputSchema,\n    effects: [\"read\"],\n    runtime: \"authenticated\",\n    postures: AUTHENTICATED_POSTURES,\n    exposure: EXPLORATION_EXPOSURE,\n    sensitivity: ACCOUNT_SPACES_SENSITIVITY,\n    authority: (context: RuntimeOperationContext) => planAccountRegistryRead(context, \"spaces/\"),\n    execute: executeAccountSpacesList,\n  },\n  {\n    id: \"tinycloud.account.applications.list\",\n    version: 1,\n    title: \"List TinyCloud account applications\",\n    description: \"List the application manifests registered in the selected owner's TinyCloud account.\",\n    input: EmptyInputSchema,\n    output: AccountApplicationsOutputSchema,\n    effects: [\"read\"],\n    runtime: \"authenticated\",\n    postures: AUTHENTICATED_POSTURES,\n    exposure: EXPLORATION_EXPOSURE,\n    sensitivity: ACCOUNT_APPLICATIONS_SENSITIVITY,\n    authority: (context: RuntimeOperationContext) => planAccountRegistryRead(context, \"applications/\"),\n    execute: executeAccountApplicationsList,\n  },\n  {\n    id: \"tinycloud.kv.list\",\n    version: 1,\n    title: \"List TinyCloud KV keys\",\n    description: \"List keys at one exact prefix in a delegated TinyCloud space.\",\n    input: KvListInputSchema,\n    output: KvListOutputSchema,\n    effects: [\"read\"],\n    runtime: \"authenticated\",\n    postures: AUTHENTICATED_POSTURES,\n    exposure: EXPLORATION_EXPOSURE,\n    sensitivity: KV_LIST_SENSITIVITY,\n    authority: planKvList,\n    execute: executeKvList,\n  },\n  {\n    id: \"tinycloud.kv.get\",\n    version: 1,\n    title: \"Get a TinyCloud KV value\",\n    description: \"Read one exact key with a node-enforced one MiB response limit.\",\n    input: KvGetInputSchema,\n    output: KvGetOutputSchema,\n    effects: [\"read\"],\n    runtime: \"authenticated\",\n    postures: AUTHENTICATED_POSTURES,\n    exposure: EXPLORATION_EXPOSURE,\n    sensitivity: KV_GET_SENSITIVITY,\n    authority: planKvGet,\n    execute: executeKvGet,\n  },\n  {\n    id: \"tinycloud.kv.head\", version: 1, title: \"Inspect TinyCloud KV metadata\",\n    description: \"Read metadata for one exact key without downloading its value.\",\n    input: KvHeadInputSchema, output: KvHeadOutputSchema, effects: [\"read\"], runtime: \"authenticated\",\n    postures: AUTHENTICATED_POSTURES, exposure: EXPLORATION_EXPOSURE, sensitivity: KV_KEY_SENSITIVITY,\n    authority: (context: RuntimeOperationContext, input: KvHeadInput) =>\n      planExactKv(context, input.space, input.key, \"tinycloud.kv/metadata\"),\n    execute: executeKvHead,\n  },\n  {\n    id: \"tinycloud.kv.put\", version: 1, title: \"Write a TinyCloud KV value\",\n    description: \"Create, conditionally replace, or explicitly upsert one exact KV key.\",\n    input: KvPutInputSchema, output: KvPutOutputSchema, effects: [\"write\"], runtime: \"authenticated\",\n    postures: AUTHENTICATED_POSTURES, exposure: EXPLORATION_EXPOSURE, sensitivity: KV_PUT_SENSITIVITY,\n    authority: (context: RuntimeOperationContext, input: KvPutInput) =>\n      planExactKv(context, input.space, input.key, \"tinycloud.kv/put\"),\n    execute: executeKvPut,\n  },\n  {\n    id: \"tinycloud.kv.delete\", version: 1, title: \"Delete a TinyCloud KV value\",\n    description: \"Delete one exact KV key, optionally only when its ETag still matches.\",\n    input: KvDeleteInputSchema, output: KvDeleteOutputSchema, effects: [\"destructive\"], runtime: \"authenticated\",\n    postures: AUTHENTICATED_POSTURES, exposure: EXPLORATION_EXPOSURE, sensitivity: KV_KEY_SENSITIVITY,\n    authority: (context: RuntimeOperationContext, input: KvDeleteInput) =>\n      planExactKv(context, input.space, input.key, \"tinycloud.kv/del\"),\n    execute: executeKvDelete,\n  },\n];\n\nasync function planAccountRegistryRead(\n  context: RuntimeOperationContext,\n  path: \"spaces/\" | \"applications/\",\n): Promise<readonly CapabilityRequirement[]> {\n  return [{\n    service: \"tinycloud.kv\",\n    space: resolveSpace(context, \"account\"),\n    path,\n    actions: [\"tinycloud.kv/get\", \"tinycloud.kv/list\"],\n  }];\n}\n\nasync function planKvList(\n  context: RuntimeOperationContext,\n  input: KvListInput,\n): Promise<readonly CapabilityRequirement[]> {\n  const space = resolveGenericKvSpace(context, input.space);\n  return [{\n    service: \"tinycloud.kv\",\n    space,\n    path: input.prefix ?? \"\",\n    actions: [\"tinycloud.kv/list\"],\n  }];\n}\n\nasync function planKvGet(\n  context: RuntimeOperationContext,\n  input: KvGetInput,\n): Promise<readonly CapabilityRequirement[]> {\n  const space = resolveGenericKvSpace(context, input.space);\n  return [{\n    service: \"tinycloud.kv\",\n    space,\n    path: input.key,\n    actions: [\"tinycloud.kv/get\"],\n  }];\n}\n\nasync function planExactKv(\n  context: RuntimeOperationContext,\n  requestedSpace: string,\n  key: string,\n  action: \"tinycloud.kv/metadata\" | \"tinycloud.kv/put\" | \"tinycloud.kv/del\",\n): Promise<readonly CapabilityRequirement[]> {\n  return [{\n    service: \"tinycloud.kv\",\n    space: resolveGenericKvSpace(context, requestedSpace),\n    path: key,\n    actions: [action],\n  }];\n}\n\nasync function executeAccountSpacesList(\n  context: OperationContext,\n  _input: EmptyInput,\n): Promise<OperationExecutionOutcome<AccountSpacesOutput>> {\n  try {\n    const entries = await readAccountRegistry(context, \"spaces/\");\n    if (!entries.ok) return entries.outcome;\n    const spaces = entries.records\n      .map(({ key, value }) => projectAccountSpace(key, value))\n      .sort((left, right) => left.name.localeCompare(right.name) || left.spaceId.localeCompare(right.spaceId));\n    const output = { spaces, count: spaces.length };\n    return accountRegistryOutput(output);\n  } catch (error) {\n    return caughtKvFailure(error, \"list account spaces\");\n  }\n}\n\nasync function executeAccountApplicationsList(\n  context: OperationContext,\n  _input: EmptyInput,\n): Promise<OperationExecutionOutcome<AccountApplicationsOutput>> {\n  try {\n    const entries = await readAccountRegistry(context, \"applications/\");\n    if (!entries.ok) return entries.outcome;\n    const applications = entries.records\n      .map(({ key, value }) => projectAccountApplication(key, value))\n      .sort((left, right) => left.appId.localeCompare(right.appId));\n    const output = { applications, count: applications.length };\n    return accountRegistryOutput(output);\n  } catch (error) {\n    return caughtKvFailure(error, \"list account applications\");\n  }\n}\n\nasync function executeKvList(\n  context: OperationContext,\n  input: KvListInput,\n): Promise<OperationExecutionOutcome<KvListOutput>> {\n  try {\n    const runtime = runtimeContext(context);\n    const space = resolveGenericKvSpace(runtime, input.space);\n    const result = await genericKv(runtime, space).list({\n      ...(input.prefix === undefined ? {} : { prefix: input.prefix }),\n      limit: input.limit ?? DEFAULT_KV_LIST_LIMIT,\n    });\n    if (!result.ok) return kvFailure(result.error, \"list KV keys\");\n    const keys = [...result.data.keys];\n    return {\n      status: \"ok\",\n      output: {\n        space,\n        prefix: input.prefix ?? \"\",\n        keys,\n        count: keys.length,\n        truncated: result.data.truncated ?? false,\n      },\n    };\n  } catch (error) {\n    return caughtKvFailure(error, \"list KV keys\");\n  }\n}\n\nasync function executeKvGet(\n  context: OperationContext,\n  input: KvGetInput,\n): Promise<OperationExecutionOutcome<KvGetOutput>> {\n  try {\n    const runtime = runtimeContext(context);\n    const space = resolveGenericKvSpace(runtime, input.space);\n    const result = await genericKv(runtime, space).get(input.key, {\n      binary: true,\n      maxResponseBytes: MAX_KV_VALUE_BYTES,\n    });\n    if (!result.ok) return kvFailure(result.error, \"read the KV value\");\n    const bytes = result.data.data;\n    if (bytes.byteLength > MAX_KV_VALUE_BYTES) {\n      return kvFailure({ code: \"KV_RESPONSE_TOO_LARGE\" }, \"read the KV value\");\n    }\n    const encoded = encodeKvValue(bytes, input.representation ?? \"base64\");\n    if (!encoded.ok) return encoded.outcome;\n    return {\n      status: \"ok\",\n      output: {\n        space,\n        key: input.key,\n        value: encoded.value,\n        encoding: encoded.encoding,\n        metadata: projectKvMetadata(result.data.headers),\n        byteLength: bytes.byteLength,\n      },\n    };\n  } catch (error) {\n    return caughtKvFailure(error, \"read the KV value\");\n  }\n}\n\nasync function executeKvHead(\n  context: OperationContext,\n  input: KvHeadInput,\n): Promise<OperationExecutionOutcome<KvHeadOutput>> {\n  try {\n    const runtime = runtimeContext(context);\n    const space = resolveGenericKvSpace(runtime, input.space);\n    const result = await genericKv(runtime, space).head(input.key);\n    if (!result.ok) return kvFailure(result.error, \"read KV metadata\");\n    return { status: \"ok\", output: { space, key: input.key, metadata: projectKvMetadata(result.data.headers) } };\n  } catch (error) {\n    return caughtKvFailure(error, \"read KV metadata\");\n  }\n}\n\nasync function executeKvPut(\n  context: OperationContext,\n  input: KvPutInput,\n): Promise<OperationExecutionOutcome<KvPutOutput>> {\n  try {\n    const runtime = runtimeContext(context);\n    const space = resolveGenericKvSpace(runtime, input.space);\n    const decoded = decodeKvPutContent(input.content);\n    if (decoded === undefined || decoded.byteLength > MAX_KV_VALUE_BYTES) {\n      return { status: \"error\", error: operationError(\"INPUT_INVALID\", \"The KV content is invalid or too large.\") };\n    }\n    const result = await genericKv(runtime, space).put(input.key, decoded.bytes, {\n      contentType: input.contentType ?? decoded.contentType,\n      ...(input.mode === \"create\" ? { ifNoneMatch: \"*\" as const } : {}),\n      ...(input.mode === \"replace\" ? { ifMatch: input.etag } : {}),\n    });\n    if (!result.ok) return kvFailure(result.error, \"write the KV value\");\n    return {\n      status: \"ok\",\n      output: {\n        space,\n        key: input.key,\n        mode: input.mode,\n        byteLength: decoded.byteLength,\n        metadata: projectKvMetadata(result.data.headers),\n      },\n    };\n  } catch (error) {\n    return caughtKvFailure(error, \"write the KV value\");\n  }\n}\n\nasync function executeKvDelete(\n  context: OperationContext,\n  input: KvDeleteInput,\n): Promise<OperationExecutionOutcome<KvDeleteOutput>> {\n  try {\n    const runtime = runtimeContext(context);\n    const space = resolveGenericKvSpace(runtime, input.space);\n    const result = await genericKv(runtime, space).delete(input.key, {\n      ...(input.etag === undefined ? {} : { ifMatch: input.etag }),\n    });\n    if (!result.ok) return kvFailure(result.error, \"delete the KV value\");\n    return {\n      status: \"ok\",\n      output: {\n        space,\n        key: input.key,\n        deleted: true,\n        ...(result.data.headers.etag === undefined ? {} : { etag: result.data.headers.etag }),\n      },\n    };\n  } catch (error) {\n    return caughtKvFailure(error, \"delete the KV value\");\n  }\n}\n\nfunction runtimeContext(context: OperationContext): RuntimeOperationContext {\n  if (context.runtime === undefined) {\n    throw new TypeError(\"Authenticated operation runtime is unavailable.\");\n  }\n  return context as RuntimeOperationContext;\n}\n\nfunction runtimeNode(context: OperationContext): TinyCloudNode {\n  return runtimeContext(context).runtime.node as TinyCloudNode;\n}\n\nfunction genericKv(context: RuntimeOperationContext, space: string): KvOperationHandle {\n  return runtimeNode(context).kvForSpace(space) as unknown as KvOperationHandle;\n}\n\nfunction resolveSpace(context: RuntimeOperationContext, space: string): string {\n  return operationSpaceResolver(context.runtime.node, context.summary.space)(space);\n}\n\nfunction resolveGenericKvSpace(context: RuntimeOperationContext, space: string): string {\n  const resolved = resolveSpace(context, space);\n  const protectedName = resolved.split(\":\").at(-1)?.toLowerCase();\n  if (protectedName === \"secrets\" || protectedName === \"account\") {\n    throw new OperationInvocationError(operationError(\n      \"INPUT_INVALID\",\n      \"Generic KV operations cannot access TinyCloud account or secrets spaces.\",\n    ));\n  }\n  return resolved;\n}\n\nasync function readAccountRegistry(\n  context: OperationContext,\n  prefix: \"spaces/\" | \"applications/\",\n): Promise<\n  | Readonly<{ ok: true; records: readonly Readonly<{ key: string; value: Record<string, unknown> }>[] }>\n  | Readonly<{ ok: false; outcome: OperationExecutionOutcome<never> }>\n> {\n  const runtime = runtimeContext(context);\n  const accountSpace = resolveSpace(runtime, \"account\");\n  const kv = runtimeNode(runtime).kvForSpace(accountSpace) as unknown as KvOperationHandle;\n  const listed = await kv.list({ prefix, limit: MAX_ACCOUNT_REGISTRY_RECORDS });\n  if (!listed.ok) return { ok: false, outcome: kvFailure(listed.error, \"list the account registry\") };\n  if (listed.data.truncated === true) {\n    return {\n      ok: false,\n      outcome: {\n        status: \"error\",\n        error: operationError(\n          \"OUTPUT_INVALID\",\n          `The TinyCloud account registry exceeds the ${MAX_ACCOUNT_REGISTRY_RECORDS}-record exploration limit.`,\n        ),\n      },\n    };\n  }\n\n  const records: Array<Readonly<{ key: string; value: Record<string, unknown> }>> = [];\n  let totalBytes = 0;\n  for (const key of listed.data.keys) {\n    const loaded = await kv.get(key, {\n      binary: true,\n      maxResponseBytes: MAX_KV_VALUE_BYTES,\n    });\n    if (!loaded.ok) {\n      return { ok: false, outcome: kvFailure(loaded.error, \"read the account registry\") };\n    }\n    const bytes = loaded.data.data;\n    totalBytes += bytes.byteLength;\n    if (bytes.byteLength > MAX_KV_VALUE_BYTES || totalBytes > MAX_ACCOUNT_REGISTRY_BYTES) {\n      return {\n        ok: false,\n        outcome: {\n          status: \"error\",\n          error: operationError(\n            \"KV_RESPONSE_TOO_LARGE\",\n            `The TinyCloud account registry exceeds the ${MAX_ACCOUNT_REGISTRY_BYTES}-byte exploration limit.`,\n          ),\n        },\n      };\n    }\n    try {\n      const value: unknown = JSON.parse(new TextDecoder(\"utf-8\", { fatal: true }).decode(bytes));\n      if (!isRecord(value)) throw new TypeError(\"Account registry values must be JSON objects.\");\n      records.push({ key, value });\n    } catch {\n      return {\n        ok: false,\n        outcome: {\n          status: \"error\",\n          error: operationError(\"OUTPUT_INVALID\", \"The TinyCloud account registry contains an invalid record.\"),\n        },\n      };\n    }\n  }\n  return { ok: true, records };\n}\n\nfunction projectAccountSpace(\n  key: string,\n  record: Record<string, unknown>,\n): AccountSpacesOutput[\"spaces\"][number] {\n  const suffix = key.startsWith(\"spaces/\") ? key.slice(\"spaces/\".length) : key;\n  const rawSpaceId = stringField(record, \"space_id\", \"spaceId\") ?? suffix;\n  const rawName = stringField(record, \"name\") ?? rawSpaceId.split(\":\").at(-1) ?? rawSpaceId;\n  const rawType = stringField(record, \"type\");\n  const rawStatus = stringField(record, \"status\");\n  const rawExpiresAt = record.expires_at ?? record.expiresAt;\n  const expiresAt = rawExpiresAt instanceof Date\n    ? rawExpiresAt.toISOString()\n    : typeof rawExpiresAt === \"string\" && !Number.isNaN(new Date(rawExpiresAt).getTime())\n    ? new Date(rawExpiresAt).toISOString()\n    : undefined;\n  return {\n    spaceId: rawSpaceId,\n    name: rawName,\n    ownerDid: stringField(record, \"owner_did\", \"ownerDid\", \"owner\") ?? \"\",\n    type: rawType === \"owned\" || rawType === \"delegated\" ? rawType : \"discovered\",\n    permissions: Array.isArray(record.permissions)\n      ? record.permissions.filter((value): value is string => typeof value === \"string\")\n      : [],\n    status: rawStatus === \"archived\" ? \"archived\" : \"active\",\n    ...(stringField(record, \"registered_at\", \"registeredAt\") === undefined\n      ? {}\n      : { registeredAt: stringField(record, \"registered_at\", \"registeredAt\") }),\n    ...(stringField(record, \"updated_at\", \"updatedAt\") === undefined\n      ? {}\n      : { updatedAt: stringField(record, \"updated_at\", \"updatedAt\") }),\n    ...(expiresAt === undefined ? {} : { expiresAt }),\n  };\n}\n\nfunction projectAccountApplication(\n  key: string,\n  record: Record<string, unknown>,\n): AccountApplicationsOutput[\"applications\"][number] {\n  const manifests = Array.isArray(record.manifests)\n    ? record.manifests.filter(isRecord)\n    : [];\n  const first = manifests[0];\n  return {\n    appId: stringField(record, \"app_id\", \"appId\") ??\n      stringField(first, \"app_id\") ??\n      (key.startsWith(\"applications/\") ? key.slice(\"applications/\".length) : key),\n    manifests,\n    ...(stringField(record, \"updated_at\", \"updatedAt\") === undefined\n      ? {}\n      : { updatedAt: stringField(record, \"updated_at\", \"updatedAt\") }),\n    ...(stringField(first, \"name\") === undefined ? {} : { name: stringField(first, \"name\") }),\n    ...(stringField(first, \"description\") === undefined\n      ? {}\n      : { description: stringField(first, \"description\") }),\n    ...(stringField(record, \"manifest_hash\", \"manifestHash\") === undefined\n      ? {}\n      : { manifestHash: stringField(record, \"manifest_hash\", \"manifestHash\") }),\n  };\n}\n\nfunction stringField(\n  record: Record<string, unknown> | undefined,\n  ...keys: readonly string[]\n): string | undefined {\n  if (record === undefined) return undefined;\n  for (const key of keys) {\n    if (typeof record[key] === \"string\") return record[key];\n  }\n  return undefined;\n}\n\nfunction isRecord(value: unknown): value is Record<string, unknown> {\n  return typeof value === \"object\" && value !== null && !Array.isArray(value);\n}\n\nfunction encodeKvValue(\n  value: Uint8Array,\n  representation: NonNullable<KvGetInput[\"representation\"]>,\n):\n  | Readonly<{ ok: true; value: unknown; encoding: KvGetOutput[\"encoding\"] }>\n  | Readonly<{ ok: false; outcome: OperationExecutionOutcome<KvGetOutput> }> {\n  if (representation === \"base64\") {\n    return { ok: true, value: Buffer.from(value).toString(\"base64\"), encoding: \"base64\" };\n  }\n  let text: string;\n  try {\n    text = new TextDecoder(\"utf-8\", { fatal: true }).decode(value);\n  } catch {\n    return {\n      ok: false,\n      outcome: { status: \"error\", error: operationError(\"OUTPUT_INVALID\", \"The KV value is not valid UTF-8.\") },\n    };\n  }\n  if (representation === \"text\") return { ok: true, value: text, encoding: \"text\" };\n  try {\n    const parsed = JsonValueSchema.safeParse(JSON.parse(text));\n    if (!parsed.success) {\n      return {\n        ok: false,\n        outcome: {\n          status: \"error\",\n          error: operationError(\n            \"OUTPUT_INVALID\",\n            \"The KV JSON contains a number that cannot be represented safely.\",\n          ),\n        },\n      };\n    }\n    return { ok: true, value: parsed.data, encoding: \"json\" };\n  } catch {\n    return {\n      ok: false,\n      outcome: { status: \"error\", error: operationError(\"OUTPUT_INVALID\", \"The KV value is not valid JSON.\") },\n    };\n  }\n}\n\nfunction decodeKvPutContent(content: KvPutContent):\n  | Readonly<{ bytes: Uint8Array; byteLength: number; contentType: string }>\n  | undefined {\n  let bytes: Uint8Array;\n  let contentType: string;\n  if (content.encoding === \"utf8\") {\n    bytes = new TextEncoder().encode(content.value);\n    contentType = \"text/plain;charset=UTF-8\";\n  } else if (content.encoding === \"json\") {\n    bytes = new TextEncoder().encode(JSON.stringify(content.value));\n    contentType = \"application/json\";\n  } else {\n    if (!isCanonicalBase64(content.value)) return undefined;\n    bytes = new Uint8Array(Buffer.from(content.value, \"base64\"));\n    contentType = \"application/octet-stream\";\n  }\n  return { bytes, byteLength: bytes.byteLength, contentType };\n}\n\nfunction isCanonicalBase64(value: string): boolean {\n  if (value.length % 4 !== 0 || !/^(?:[A-Za-z0-9+/]{4})*(?:[A-Za-z0-9+/]{2}==|[A-Za-z0-9+/]{3}=)?$/.test(value)) {\n    return false;\n  }\n  return Buffer.from(value, \"base64\").toString(\"base64\") === value;\n}\n\nfunction projectKvMetadata(headers: {\n  readonly etag?: string;\n  readonly contentType?: string;\n  readonly lastModified?: string;\n  readonly contentLength?: number;\n}): KvMetadata {\n  return {\n    ...(headers.etag === undefined ? {} : { etag: headers.etag }),\n    ...(headers.contentType === undefined ? {} : { contentType: headers.contentType }),\n    ...(headers.lastModified === undefined ? {} : { lastModified: headers.lastModified }),\n    ...(headers.contentLength === undefined ? {} : { contentLength: headers.contentLength }),\n  };\n}\n\nfunction caughtKvFailure(error: unknown, action: string): OperationExecutionOutcome<never> {\n  if (error instanceof OperationInvocationError) return { status: \"error\", error: error.operationError };\n  return authorizationFailure(error, action) ?? nodeFailure(action);\n}\n\nexport function authorizationFailure(error: unknown, action: string): OperationExecutionOutcome<never> | undefined {\n  const verdict = authorizationVerdictOf(error);\n  if (verdict === \"unauthenticated\") {\n    if (validatedCapabilityOf(error) !== undefined) {\n      return { status: \"error\", error: operationError(\"PERMISSION_DENIED\", `Permission is denied to ${action}.`) };\n    }\n    return { status: \"error\", error: operationError(\"AUTH_REQUIRED\", `Authentication is required to ${action}.`) };\n  }\n  if (verdict === \"forbidden\") {\n    return { status: \"error\", error: operationError(\"PERMISSION_DENIED\", `Permission is denied to ${action}.`) };\n  }\n  return undefined;\n}\n\nfunction accountRegistryOutput<T>(output: T): OperationExecutionOutcome<T> {\n  if (Buffer.byteLength(JSON.stringify(output), \"utf8\") > MAX_ACCOUNT_REGISTRY_BYTES) {\n    return {\n      status: \"error\",\n      error: operationError(\n        \"KV_RESPONSE_TOO_LARGE\",\n        `The TinyCloud account registry exceeds the ${MAX_ACCOUNT_REGISTRY_BYTES}-byte exploration limit.`,\n      ),\n    };\n  }\n  return { status: \"ok\", output };\n}\n\nfunction kvFailure(\n  error: Readonly<{ code?: string; meta?: Readonly<Record<string, unknown>> }>,\n  action: string,\n): OperationExecutionOutcome<never> {\n  const auth = authorizationFailure(error, action);\n  if (auth !== undefined) return auth;\n  if (error.code === \"KV_NOT_FOUND\") {\n    return { status: \"error\", error: operationError(\"KV_NOT_FOUND\", \"The TinyCloud KV key was not found.\") };\n  }\n  if (error.code === \"KV_PRECONDITION_FAILED\") {\n    return { status: \"error\", error: operationError(\"KV_PRECONDITION_FAILED\", \"The TinyCloud KV object changed or already exists.\") };\n  }\n  if (error.code === \"KV_CONFLICT\") {\n    return {\n      status: \"error\",\n      error: operationError(\n        \"KV_CONFLICT\",\n        \"A database serialization conflict prevented the conditional KV mutation; re-read the key state, which may still be absent, before deciding whether to retry.\",\n        { retryable: true },\n      ),\n    };\n  }\n  if (error.code === \"KV_RESPONSE_TOO_LARGE\") {\n    return { status: \"error\", error: operationError(\"KV_RESPONSE_TOO_LARGE\", `The TinyCloud KV value exceeds ${MAX_KV_VALUE_BYTES} bytes.`) };\n  }\n  return nodeFailure(action);\n}\n\nfunction nodeFailure(action: string): OperationExecutionOutcome<never> {\n  return {\n    status: \"error\",\n    error: operationError(\n      \"NODE_ERROR\",\n      `The TinyCloud node could not ${action}.`,\n      { retryable: true },\n    ),\n  };\n}\n","import { z } from \"zod\";\nimport type { SecretReadResult } from \"@tinycloud/node-sdk\";\n\nimport {\n  type OperationContext,\n  type CapabilityRequirement,\n  type OperationDefinition,\n  type OperationExecutionOutcome,\n  type OperationExposure,\n  type OperationSensitivity,\n  type RuntimeOperationContext,\n  type TinyCloudPosture,\n} from \"../contract.js\";\nimport { OperationInvocationError, operationError } from \"../errors.js\";\nimport {\n  buildSecretSetupUrl,\n  normalizeSecretsGetInput,\n  operationSpaceResolver,\n  resolveSecretReference,\n  resolveSecretReferenceForOperation,\n  type SecretReference,\n  type SecretsGetInput,\n} from \"../secrets.js\";\n\ninterface SecretsGetOutput {\n  readonly value: string;\n}\n\nconst SecretsGetInputSchema: z.ZodType<SecretsGetInput> = z.object({\n  name: z.string(),\n  scope: z.string().optional(),\n  space: z.string().optional(),\n}).strict().superRefine((input, context) => {\n  try {\n    resolveSecretReference(input);\n  } catch {\n    context.addIssue({ code: z.ZodIssueCode.custom, message: \"Invalid secret reference.\" });\n  }\n}).transform(normalizeSecretsGetInput);\n\nconst SecretsGetOutputSchema: z.ZodType<SecretsGetOutput> = z.object({\n  value: z.string(),\n}).strict();\n\nconst SECRETS_GET_POSTURES: readonly TinyCloudPosture[] = [\n  \"owner-openkey\",\n  \"delegate-session\",\n  \"local-owner-key\",\n];\n\nconst SECRETS_GET_EXPOSURE: OperationExposure = {\n  cli: { status: \"required\" },\n  mcp: { status: \"required\" },\n  skill: { status: \"required\" },\n  docs: { status: \"required\" },\n};\n\nconst SECRETS_GET_SENSITIVITY: OperationSensitivity = {\n  input: [],\n  output: [\"/value\"],\n};\n\nexport const secretsGetOperationDefinition: OperationDefinition<SecretsGetInput, SecretsGetOutput> = {\n  id: \"tinycloud.secrets.get\",\n  version: 1,\n  title: \"Get a TinyCloud secret\",\n  description: \"Read and decrypt one secret from the selected TinyCloud secrets space.\",\n  input: SecretsGetInputSchema,\n  output: SecretsGetOutputSchema,\n  effects: [\"read\", \"local_write\"],\n  runtime: \"authenticated\",\n  postures: SECRETS_GET_POSTURES,\n  exposure: SECRETS_GET_EXPOSURE,\n  sensitivity: SECRETS_GET_SENSITIVITY,\n  authority: planSecretGet,\n  execute: executeSecretGet,\n};\n\nexport const secretsGetOperationDefinitions: readonly [typeof secretsGetOperationDefinition] = [\n  secretsGetOperationDefinition,\n];\n\nasync function planSecretGet(\n  context: RuntimeOperationContext,\n  input: SecretsGetInput,\n): Promise<readonly CapabilityRequirement[]> {\n  const reference = resolveSecretReferenceForOperation(\n    input,\n    context.runtime.node,\n    context.summary.space,\n  );\n  let networkSpace = reference.space;\n  if (input.space === undefined) {\n    try {\n      networkSpace = operationSpaceResolver(\n        context.runtime.node,\n        context.summary.space,\n      )(\"secrets\");\n    } catch {\n      // Definition-focused callers may omit authenticated identity metadata;\n      // the runtime path supplies the owner space before production planning.\n    }\n  }\n  const networkId = resolveEncryptionNetworkId(context.runtime.node, networkSpace);\n\n  return [\n    {\n      service: \"tinycloud.kv\",\n      space: reference.space,\n      path: reference.permissionPath,\n      actions: [\"tinycloud.kv/get\"],\n    },\n    {\n      service: \"tinycloud.encryption\",\n      path: networkId,\n      actions: [\"tinycloud.encryption/decrypt\"],\n    },\n  ];\n}\n\nasync function executeSecretGet(\n  context: OperationContext,\n  input: SecretsGetInput,\n): Promise<OperationExecutionOutcome<SecretsGetOutput>> {\n  const reference = resolveSecretReferenceForOperation(\n    input,\n    context.runtime?.node,\n    context.summary.space,\n  );\n  const node = context.runtime?.node as SecretReadingNode | undefined;\n  if (node === undefined || typeof node.readSecret !== \"function\") {\n    return {\n      status: \"error\",\n      error: operationError(\n        \"NODE_ERROR\",\n        \"The TinyCloud node could not read the secret.\",\n        { retryable: true },\n      ),\n    };\n  }\n\n  let result: SecretReadResult;\n  try {\n    result = await node.readSecret({\n      space: reference.space,\n      name: reference.name,\n      ...(reference.scope === undefined ? {} : { scope: reference.scope }),\n    });\n  } catch {\n    return {\n      status: \"error\",\n      error: operationError(\n        \"NODE_ERROR\",\n        \"The TinyCloud node could not read the secret.\",\n        { retryable: true },\n      ),\n    };\n  }\n\n  return classifySecretRead(reference, result);\n}\n\nfunction classifySecretRead(\n  reference: SecretReference,\n  result: SecretReadResult,\n): OperationExecutionOutcome<SecretsGetOutput> {\n  switch (result.status) {\n    case \"ok\":\n      return { status: \"ok\", output: { value: result.value } };\n    case \"not_found\":\n      return {\n        status: \"setup_required\",\n        setup: {\n          kind: \"secret_manager\",\n          secret: {\n            name: reference.name,\n            ...(reference.scope === undefined ? {} : { scope: reference.scope }),\n            space: reference.space,\n          },\n          url: buildSecretSetupUrl(reference),\n          message: \"Enter this secret in Secret Manager, then retry the operation.\",\n        },\n        requiresCallerInput: true,\n      };\n    case \"permission_required\":\n      return {\n        status: \"authority_required\",\n        missing: [result.hint as unknown as CapabilityRequirement],\n        request: { requestId: \"runtime-hint\" },\n        approval: {\n          kind: \"openkey\",\n          requestId: \"runtime-hint\",\n          fallback: \"tc auth grant <request-artifact>\",\n        },\n      };\n    case \"node_unreachable\":\n      return {\n        status: \"error\",\n        error: operationError(\n          \"NODE_UNREACHABLE\",\n          \"The TinyCloud node could not be reached.\",\n          { retryable: true },\n        ),\n      };\n    case \"read_failed\":\n    case \"corrupt_envelope\":\n      return {\n        status: \"error\",\n        error: operationError(\n          \"SECRET_READ_FAILED\",\n          \"The secret ciphertext could not be read.\",\n        ),\n      };\n    case \"decrypt_failed\":\n    case \"invalid_payload\":\n      return {\n        status: \"error\",\n        error: operationError(\n          \"SECRET_DECRYPT_FAILED\",\n          \"The secret could not be decrypted.\",\n        ),\n      };\n  }\n\n  return {\n    status: \"error\",\n    error: operationError(\"SECRET_READ_FAILED\", \"The secret read failed.\"),\n  };\n}\n\nfunction resolveEncryptionNetworkId(node: unknown, space: string): string {\n  const candidate = node as {\n    getEncryptionNetworkIdForSpace?: (spaceId: string) => unknown;\n    getDefaultEncryptionNetworkId?: () => unknown;\n  };\n\n  let scoped: unknown;\n  try {\n    scoped = candidate.getEncryptionNetworkIdForSpace?.(space);\n  } catch {\n    // A scoped resolver is optional and may fail for a non-primary space.\n  }\n  if (typeof scoped === \"string\" && scoped.length > 0) return scoped;\n\n  let fallback: unknown;\n  try {\n    fallback = candidate.getDefaultEncryptionNetworkId?.();\n  } catch {\n    // Both local sources must fail before the operation reports unresolved.\n  }\n  if (typeof fallback === \"string\" && fallback.length > 0) return fallback;\n\n  throw new OperationInvocationError(\n    operationError(\n      \"ENCRYPTION_NETWORK_UNRESOLVED\",\n      \"The encryption network for the target secrets space could not be resolved.\",\n    ),\n  );\n}\n\ninterface SecretReadingNode {\n  readSecret(input: {\n    space: string;\n    name: string;\n    scope?: string;\n  }): Promise<SecretReadResult>;\n  getEncryptionNetworkIdForSpace?: (spaceId: string) => unknown;\n  getDefaultEncryptionNetworkId?: () => unknown;\n}\n","import type { TinyCloudNode } from \"@tinycloud/node-sdk\";\nimport nodeSqlParser from \"node-sql-parser\";\nimport { z } from \"zod\";\n\nimport type {\n  CapabilityRequirement,\n  OperationContext,\n  OperationDefinition,\n  OperationExecutionOutcome,\n  OperationExposure,\n  OperationSensitivity,\n  RuntimeOperationContext,\n  TinyCloudPosture,\n} from \"../contract.js\";\nimport { OperationInvocationError, operationError } from \"../errors.js\";\nimport { operationSpaceResolver } from \"../secrets.js\";\nimport { authorizationFailure } from \"./exploration.js\";\n\nconst DEFAULT_MAX_ROWS = 100;\nconst MAX_MAX_ROWS = 1_000;\nconst DEFAULT_MAX_BYTES = 1024 * 1024;\nconst MAX_MAX_BYTES = 4 * 1024 * 1024;\nconst SCHEMA_MAX_ROWS = 500;\nconst SCHEMA_MAX_BYTES = 1024 * 1024;\nconst MAX_PARAMETERS = 100;\nconst MAX_SQL_LENGTH = 64 * 1024;\nconst SQL_WRITE_AUTHORITY_NOTICE =\n  \"Approving tinycloud.sql/write grants full read/write/schema mutation authority over this exact database; the MCP tool itself accepts only one parameterized INSERT, UPDATE, or DELETE.\";\n\nconst SCHEMA_QUERY = `SELECT type, name, tbl_name, sql\nFROM sqlite_schema\nWHERE type IN ('table', 'view', 'index', 'trigger')\n  AND name NOT LIKE 'sqlite_%'\nORDER BY type, name`;\n\ntype SqlPrimitive = null | number | string;\ninterface SqlBlob {\n  readonly type: \"blob\";\n  readonly base64: string;\n  readonly byteLength: number;\n}\ntype SqlOutputValue = SqlPrimitive | SqlBlob;\ntype SqlInputValue = SqlPrimitive | Readonly<{ type: \"blob\"; base64: string }>;\n\ninterface SqlTargetInput {\n  readonly space: string;\n  readonly database: string;\n}\n\ninterface SqlQueryInput extends SqlTargetInput {\n  readonly sql: string;\n  readonly params?: readonly SqlInputValue[];\n  readonly maxRows?: number;\n  readonly maxBytes?: number;\n}\n\ninterface SqlExecuteInput extends SqlTargetInput {\n  readonly sql: string;\n  readonly params: readonly SqlInputValue[];\n  readonly acknowledgeDatabaseWideAuthority: true;\n}\n\ninterface SqlLimitsOutput {\n  readonly maxRows: number;\n  readonly maxBytes: number;\n  readonly enforcement: \"node-requested-client-verified\";\n}\n\ninterface SqlSchemaInspectOutput {\n  readonly space: string;\n  readonly database: string;\n  readonly objects: readonly {\n    readonly type: \"table\" | \"view\" | \"index\" | \"trigger\";\n    readonly name: string;\n    readonly tableName: string;\n    readonly sql?: string;\n  }[];\n  readonly count: number;\n  readonly limits: SqlLimitsOutput;\n}\n\ninterface SqlQueryOutput {\n  readonly space: string;\n  readonly database: string;\n  readonly columns: readonly string[];\n  readonly rows: readonly (readonly SqlOutputValue[])[];\n  readonly rowCount: number;\n  readonly limits: SqlLimitsOutput;\n}\n\ninterface SqlExecuteOutput {\n  readonly space: string;\n  readonly database: string;\n  readonly statementType: \"insert\" | \"update\" | \"delete\";\n  readonly changes: number;\n  readonly lastInsertRowId: number | null;\n  readonly authorityNotice: typeof SQL_WRITE_AUTHORITY_NOTICE;\n}\n\nconst sqlParser = new nodeSqlParser.Parser();\n\nconst SpaceSchema = z.string().min(1).refine(\n  (space) =>\n    (/^[A-Za-z0-9_-]+$/.test(space) || space.startsWith(\"tinycloud:\")) &&\n    !space.includes(\"*\"),\n  \"Invalid TinyCloud space.\",\n);\nconst DatabaseSchema = z.string().min(1).max(256).refine(\n  (database) =>\n    database !== \"/\" &&\n    !database.endsWith(\"/\") &&\n    !database.includes(\"*\") &&\n    !/[\\u0000-\\u001f\\u007f]/.test(database),\n  \"Invalid SQLite database name.\",\n);\nconst SafeNumberSchema = z.number().finite().refine(\n  (value) => !Number.isInteger(value) || Number.isSafeInteger(value),\n  \"SQLite integer parameters must be JavaScript safe integers.\",\n);\nconst Base64Schema = z.string().max(Math.ceil(MAX_MAX_BYTES / 3) * 4).refine(\n  isCanonicalBase64,\n  \"Invalid base64 BLOB value.\",\n);\nconst SqlInputValueSchema: z.ZodType<SqlInputValue> = z.union([\n  z.null(),\n  SafeNumberSchema,\n  z.string().max(MAX_MAX_BYTES),\n  z.object({ type: z.literal(\"blob\"), base64: Base64Schema }).strict(),\n]);\nconst SqlParamsSchema = z.array(SqlInputValueSchema).max(MAX_PARAMETERS).superRefine(\n  (params, context) => {\n    const totalBytes = params.reduce<number>(\n      (total, value) => total + sqlInputValueBytes(value),\n      0,\n    );\n    if (totalBytes > MAX_MAX_BYTES) {\n      context.addIssue({\n        code: z.ZodIssueCode.custom,\n        message: \"SQLite query parameters exceed the 4 MiB input limit.\",\n      });\n    }\n  },\n);\nconst RequiredSqlParamsSchema = z.array(SqlInputValueSchema).min(1).max(MAX_PARAMETERS).superRefine(\n  (params, context) => {\n    const totalBytes = params.reduce<number>(\n      (total, value) => total + sqlInputValueBytes(value),\n      0,\n    );\n    if (totalBytes > MAX_MAX_BYTES) {\n      context.addIssue({\n        code: z.ZodIssueCode.custom,\n        message: \"SQLite query parameters exceed the 4 MiB input limit.\",\n      });\n    }\n  },\n);\nconst SqlOutputValueSchema: z.ZodType<SqlOutputValue> = z.union([\n  z.null(),\n  SafeNumberSchema,\n  z.string(),\n  z.object({\n    type: z.literal(\"blob\"),\n    base64: z.string(),\n    byteLength: z.number().int().nonnegative(),\n  }).strict(),\n]);\nconst SqlTargetInputSchema: z.ZodType<SqlTargetInput> = z.object({\n  space: SpaceSchema,\n  database: DatabaseSchema,\n}).strict();\nconst SqlQueryInputSchema: z.ZodType<SqlQueryInput> = z.object({\n  space: SpaceSchema,\n  database: DatabaseSchema,\n  sql: z.string().min(1).max(MAX_SQL_LENGTH).superRefine((sql, context) => {\n    if (!isSingleReadQuery(sql)) {\n      context.addIssue({\n        code: z.ZodIssueCode.custom,\n        message: \"SQL must parse as exactly one SQLite SELECT statement.\",\n      });\n    }\n  }),\n  params: SqlParamsSchema.optional(),\n  maxRows: z.number().int().positive().max(MAX_MAX_ROWS).optional(),\n  maxBytes: z.number().int().positive().max(MAX_MAX_BYTES).optional(),\n}).strict();\nconst SqlExecuteInputSchema: z.ZodType<SqlExecuteInput> = z.object({\n  space: SpaceSchema,\n  database: DatabaseSchema,\n  sql: z.string().min(1).max(MAX_SQL_LENGTH),\n  params: RequiredSqlParamsSchema,\n  acknowledgeDatabaseWideAuthority: z.literal(true).describe(SQL_WRITE_AUTHORITY_NOTICE),\n}).strict().superRefine((input, context) => {\n  if (parseSingleDmlStatement(input.sql, input.params.length) === undefined) {\n    context.addIssue({\n      code: z.ZodIssueCode.custom,\n      path: [\"sql\"],\n      message: \"SQL must parse as exactly one parameterized INSERT, UPDATE, or DELETE with one value per positional placeholder.\",\n    });\n  }\n});\n\nconst SqlLimitsOutputSchema: z.ZodType<SqlLimitsOutput> = z.object({\n  maxRows: z.number().int().positive(),\n  maxBytes: z.number().int().positive(),\n  enforcement: z.literal(\"node-requested-client-verified\"),\n}).strict();\nconst SqlSchemaInspectOutputSchema: z.ZodType<SqlSchemaInspectOutput> = z.object({\n  space: z.string().min(1),\n  database: z.string().min(1),\n  objects: z.array(z.object({\n    type: z.enum([\"table\", \"view\", \"index\", \"trigger\"]),\n    name: z.string().min(1),\n    tableName: z.string().min(1),\n    sql: z.string().optional(),\n  }).strict()),\n  count: z.number().int().nonnegative(),\n  limits: SqlLimitsOutputSchema,\n}).strict();\nconst SqlQueryOutputSchema: z.ZodType<SqlQueryOutput> = z.object({\n  space: z.string().min(1),\n  database: z.string().min(1),\n  columns: z.array(z.string()),\n  rows: z.array(z.array(SqlOutputValueSchema)),\n  rowCount: z.number().int().nonnegative(),\n  limits: SqlLimitsOutputSchema,\n}).strict();\nconst SqlExecuteOutputSchema: z.ZodType<SqlExecuteOutput> = z.object({\n  space: z.string().min(1),\n  database: z.string().min(1),\n  statementType: z.enum([\"insert\", \"update\", \"delete\"]),\n  changes: z.number().int().nonnegative(),\n  lastInsertRowId: z.number().int().nullable(),\n  authorityNotice: z.literal(SQL_WRITE_AUTHORITY_NOTICE),\n}).strict();\n\nconst AUTHENTICATED_POSTURES: readonly TinyCloudPosture[] = [\n  \"owner-openkey\",\n  \"delegate-session\",\n  \"local-owner-key\",\n];\nconst SQL_EXPOSURE: OperationExposure = {\n  cli: {\n    status: \"excluded\",\n    reason: \"Existing SQL Commander commands remain the CLI surface.\",\n  },\n  mcp: { status: \"required\" },\n  skill: { status: \"required\" },\n  docs: { status: \"required\" },\n};\nconst SQL_SCHEMA_SENSITIVITY: OperationSensitivity = {\n  input: [\"/database\"],\n  output: [\"/objects\"],\n};\nconst SQL_QUERY_SENSITIVITY: OperationSensitivity = {\n  input: [\"/database\", \"/sql\", \"/params\"],\n  output: [\"/columns\", \"/rows\"],\n};\nconst SQL_EXECUTE_SENSITIVITY: OperationSensitivity = {\n  input: [\"/database\", \"/sql\", \"/params\"],\n  output: [\"/lastInsertRowId\"],\n};\n\ntype SqlDefinition =\n  | OperationDefinition<SqlTargetInput, SqlSchemaInspectOutput>\n  | OperationDefinition<SqlQueryInput, SqlQueryOutput>\n  | OperationDefinition<SqlExecuteInput, SqlExecuteOutput>;\n\nexport const sqlOperationDefinitions: readonly SqlDefinition[] = [\n  {\n    id: \"tinycloud.sql.schema.inspect\",\n    version: 1,\n    title: \"Inspect a TinyCloud SQLite schema\",\n    description: \"List user tables, views, indexes, and triggers in one exact TinyCloud SQLite database using a fixed read-only query.\",\n    input: SqlTargetInputSchema,\n    output: SqlSchemaInspectOutputSchema,\n    effects: [\"read\"],\n    runtime: \"authenticated\",\n    postures: AUTHENTICATED_POSTURES,\n    exposure: SQL_EXPOSURE,\n    sensitivity: SQL_SCHEMA_SENSITIVITY,\n    authority: planSqlRead,\n    execute: executeSqlSchemaInspect,\n  },\n  {\n    id: \"tinycloud.sql.query\",\n    version: 1,\n    title: \"Query a TinyCloud SQLite database\",\n    description: \"Run exactly one parser-approved SELECT against one exact TinyCloud SQLite database. Result limits are requested from the node and verified locally without silent truncation.\",\n    input: SqlQueryInputSchema,\n    output: SqlQueryOutputSchema,\n    effects: [\"read\"],\n    runtime: \"authenticated\",\n    postures: AUTHENTICATED_POSTURES,\n    exposure: SQL_EXPOSURE,\n    sensitivity: SQL_QUERY_SENSITIVITY,\n    invalidInputErrorCode: \"SQL_QUERY_INVALID\",\n    authority: planSqlRead,\n    execute: executeSqlQuery,\n  },\n  {\n    id: \"tinycloud.sql.execute\",\n    version: 1,\n    title: \"Execute a TinyCloud SQLite DML statement\",\n    description: `Run exactly one parameterized INSERT, UPDATE, or DELETE against one exact TinyCloud SQLite database. ${SQL_WRITE_AUTHORITY_NOTICE}`,\n    input: SqlExecuteInputSchema,\n    output: SqlExecuteOutputSchema,\n    effects: [\"write\", \"destructive\"],\n    runtime: \"authenticated\",\n    postures: AUTHENTICATED_POSTURES,\n    exposure: SQL_EXPOSURE,\n    sensitivity: SQL_EXECUTE_SENSITIVITY,\n    invalidInputErrorCode: \"SQL_QUERY_INVALID\",\n    authority: planSqlWrite,\n    execute: executeSqlDml,\n  },\n];\n\nasync function planSqlRead(\n  context: RuntimeOperationContext,\n  input: SqlTargetInput,\n): Promise<readonly CapabilityRequirement[]> {\n  const space = resolveSqlSpace(context, input.space);\n  return [{\n    service: \"tinycloud.sql\",\n    space,\n    path: input.database,\n    actions: [\"tinycloud.sql/read\"],\n  }];\n}\n\nasync function planSqlWrite(\n  context: RuntimeOperationContext,\n  input: SqlExecuteInput,\n): Promise<readonly CapabilityRequirement[]> {\n  const space = resolveSqlSpace(context, input.space);\n  return [{\n    service: \"tinycloud.sql\",\n    space,\n    path: input.database,\n    actions: [\"tinycloud.sql/write\"],\n    description: SQL_WRITE_AUTHORITY_NOTICE,\n  }];\n}\n\nasync function executeSqlSchemaInspect(\n  context: OperationContext,\n  input: SqlTargetInput,\n): Promise<OperationExecutionOutcome<SqlSchemaInspectOutput>> {\n  try {\n    const runtime = runtimeContext(context);\n    const space = resolveSqlSpace(runtime, input.space);\n    const result = await runtimeNode(runtime)\n      .sqlForSpace(space)\n      .db(input.database)\n      .query(SCHEMA_QUERY, [], { maxRows: SCHEMA_MAX_ROWS, maxBytes: SCHEMA_MAX_BYTES });\n    if (!result.ok) return sqlServiceFailure(result.error, \"inspect the SQLite schema\");\n\n    const normalized = normalizeQueryResult(result.data, SCHEMA_MAX_ROWS, SCHEMA_MAX_BYTES);\n    const objects = normalized.rows.map((row) => schemaObject(row));\n    return {\n      status: \"ok\",\n      output: {\n        space,\n        database: input.database,\n        objects,\n        count: objects.length,\n        limits: limitsOutput(SCHEMA_MAX_ROWS, SCHEMA_MAX_BYTES),\n      },\n    };\n  } catch (error) {\n    return sqlFailure(error, \"inspect the SQLite schema\");\n  }\n}\n\nasync function executeSqlQuery(\n  context: OperationContext,\n  input: SqlQueryInput,\n): Promise<OperationExecutionOutcome<SqlQueryOutput>> {\n  try {\n    if (!isSingleReadQuery(input.sql)) {\n      return {\n        status: \"error\",\n        error: operationError(\n          \"SQL_QUERY_INVALID\",\n          \"SQL must parse as exactly one SQLite SELECT statement.\",\n        ),\n      };\n    }\n\n    const runtime = runtimeContext(context);\n    const space = resolveSqlSpace(runtime, input.space);\n    const maxRows = input.maxRows ?? DEFAULT_MAX_ROWS;\n    const maxBytes = input.maxBytes ?? DEFAULT_MAX_BYTES;\n    const params = (input.params ?? []).map(decodeSqlInputValue);\n    const result = await runtimeNode(runtime)\n      .sqlForSpace(space)\n      .db(input.database)\n      .query(input.sql, params, { maxRows, maxBytes });\n    if (!result.ok) return sqlServiceFailure(result.error, \"run the SQLite query\");\n\n    const normalized = normalizeQueryResult(result.data, maxRows, maxBytes);\n    return {\n      status: \"ok\",\n      output: {\n        space,\n        database: input.database,\n        columns: normalized.columns,\n        rows: normalized.rows,\n        rowCount: normalized.rows.length,\n        limits: limitsOutput(maxRows, maxBytes),\n      },\n    };\n  } catch (error) {\n    return sqlFailure(error, \"run the SQLite query\");\n  }\n}\n\nasync function executeSqlDml(\n  context: OperationContext,\n  input: SqlExecuteInput,\n): Promise<OperationExecutionOutcome<SqlExecuteOutput>> {\n  try {\n    const statementType = parseSingleDmlStatement(input.sql, input.params.length);\n    if (statementType === undefined) {\n      return {\n        status: \"error\",\n        error: operationError(\n          \"SQL_QUERY_INVALID\",\n          \"SQL must parse as exactly one parameterized INSERT, UPDATE, or DELETE with one value per positional placeholder.\",\n        ),\n      };\n    }\n\n    const runtime = runtimeContext(context);\n    const space = resolveSqlSpace(runtime, input.space);\n    const result = await runtimeNode(runtime)\n      .sqlForSpace(space)\n      .db(input.database)\n      .execute(input.sql, input.params.map(decodeSqlInputValue));\n    if (!result.ok) return authorizationFailure(result.error, \"execute the SQLite statement\") ?? sqlMutationFailure();\n    const normalized = normalizeExecuteResult(result.data);\n    return {\n      status: \"ok\",\n      output: {\n        space,\n        database: input.database,\n        statementType,\n        ...normalized,\n        authorityNotice: SQL_WRITE_AUTHORITY_NOTICE,\n      },\n    };\n  } catch (error) {\n    if (error instanceof OperationInvocationError) return { status: \"error\", error: error.operationError };\n    return authorizationFailure(error, \"execute the SQLite statement\") ?? sqlMutationFailure();\n  }\n}\n\nfunction isSingleReadQuery(sql: string): boolean {\n  const ast = parseSingleStatement(sql);\n  return ast !== undefined && ast.type === \"select\";\n}\n\nfunction parseSingleDmlStatement(\n  sql: string,\n  parameterCount: number,\n): \"insert\" | \"update\" | \"delete\" | undefined {\n  const ast = parseSingleStatement(sql);\n  if (\n    ast === undefined ||\n    (ast.type !== \"insert\" && ast.type !== \"update\" && ast.type !== \"delete\") ||\n    ast.with !== undefined && ast.with !== null\n  ) {\n    return undefined;\n  }\n  const placeholders = countPositionalParameters(ast);\n  return placeholders > 0 && placeholders === parameterCount ? ast.type : undefined;\n}\n\nfunction parseSingleStatement(sql: string): Record<string, unknown> | undefined {\n  try {\n    const ast = sqlParser.astify(sql, { database: \"sqlite\" }) as unknown;\n    return !Array.isArray(ast) && isRecord(ast) ? ast : undefined;\n  } catch {\n    return undefined;\n  }\n}\n\nfunction countPositionalParameters(value: unknown): number {\n  if (Array.isArray(value)) {\n    return value.reduce((count, entry) => count + countPositionalParameters(entry), 0);\n  }\n  if (!isRecord(value)) return 0;\n  const current = value.type === \"origin\" && value.value === \"?\" ? 1 : 0;\n  return Object.values(value).reduce<number>(\n    (count, entry) => count + countPositionalParameters(entry),\n    current,\n  );\n}\n\nfunction decodeSqlInputValue(value: SqlInputValue): null | number | string | Uint8Array {\n  if (isRecord(value) && value.type === \"blob\") {\n    return new Uint8Array(Buffer.from(value.base64 as string, \"base64\"));\n  }\n  return value as null | number | string;\n}\n\nfunction normalizeQueryResult(\n  value: unknown,\n  maxRows: number,\n  maxBytes: number,\n): Readonly<{ columns: readonly string[]; rows: readonly (readonly SqlOutputValue[])[] }> {\n  if (!isRecord(value) || !Array.isArray(value.columns) || !Array.isArray(value.rows)) {\n    throw unsafeSqlValue(\"The node returned an invalid SQLite query result.\");\n  }\n  const columns = value.columns.map((column) => {\n    if (typeof column !== \"string\") {\n      throw unsafeSqlValue(\"The node returned an invalid SQLite column name.\");\n    }\n    return column;\n  });\n  const rows = value.rows.map((row) => {\n    if (!Array.isArray(row) || row.length !== columns.length) {\n      throw unsafeSqlValue(\"The node returned an invalid SQLite row.\");\n    }\n    return row.map(normalizeSqlOutputValue);\n  });\n\n  const serializedBytes = Buffer.byteLength(JSON.stringify({ columns, rows }), \"utf8\");\n  if (rows.length > maxRows || serializedBytes > maxBytes) {\n    throw new OperationInvocationError(operationError(\n      \"SQL_RESULT_LIMIT_EXCEEDED\",\n      \"The SQLite query result exceeded the requested result limits.\",\n      {\n        details: {\n          maxRows,\n          maxBytes,\n          returnedRows: rows.length,\n          returnedBytes: serializedBytes,\n        },\n      },\n    ));\n  }\n  return { columns, rows };\n}\n\nfunction normalizeSqlOutputValue(value: unknown): SqlOutputValue {\n  if (value === null || typeof value === \"string\") return value;\n  if (typeof value === \"number\") {\n    if (!Number.isFinite(value) || (Number.isInteger(value) && !Number.isSafeInteger(value))) {\n      throw unsafeSqlValue(\"The node returned an integer that cannot be represented safely in JavaScript.\");\n    }\n    return value;\n  }\n  if (value instanceof Uint8Array) return encodeBlob(value);\n  if (Array.isArray(value) && value.every(isByte)) {\n    return encodeBlob(Uint8Array.from(value));\n  }\n  if (isRecord(value) && value.type === \"Buffer\" && Array.isArray(value.data) && value.data.every(isByte)) {\n    return encodeBlob(Uint8Array.from(value.data));\n  }\n  throw unsafeSqlValue(\"The node returned an unsupported SQLite value.\");\n}\n\nfunction normalizeExecuteResult(\n  value: unknown,\n): Readonly<{ changes: number; lastInsertRowId: number | null }> {\n  if (\n    !isRecord(value) ||\n    !Number.isSafeInteger(value.changes) ||\n    (value.changes as number) < 0 ||\n    (\n      value.lastInsertRowId !== null &&\n      !Number.isSafeInteger(value.lastInsertRowId)\n    )\n  ) {\n    throw unsafeSqlValue(\"The node returned SQLite mutation metadata that cannot be represented safely in JavaScript.\");\n  }\n  return {\n    changes: value.changes as number,\n    lastInsertRowId: value.lastInsertRowId as number | null,\n  };\n}\n\nfunction schemaObject(row: readonly SqlOutputValue[]): SqlSchemaInspectOutput[\"objects\"][number] {\n  const [type, name, tableName, sql] = row;\n  if (\n    (type !== \"table\" && type !== \"view\" && type !== \"index\" && type !== \"trigger\") ||\n    typeof name !== \"string\" ||\n    typeof tableName !== \"string\" ||\n    (sql !== null && typeof sql !== \"string\")\n  ) {\n    throw unsafeSqlValue(\"The node returned an invalid SQLite schema record.\");\n  }\n  return {\n    type,\n    name,\n    tableName,\n    ...(sql === null ? {} : { sql }),\n  };\n}\n\nfunction limitsOutput(maxRows: number, maxBytes: number): SqlLimitsOutput {\n  return { maxRows, maxBytes, enforcement: \"node-requested-client-verified\" };\n}\n\nfunction runtimeContext(context: OperationContext): RuntimeOperationContext {\n  if (context.runtime === undefined) {\n    throw new TypeError(\"Authenticated operation runtime is unavailable.\");\n  }\n  return context as RuntimeOperationContext;\n}\n\nfunction runtimeNode(context: RuntimeOperationContext): TinyCloudNode {\n  return context.runtime.node as TinyCloudNode;\n}\n\nfunction resolveSqlSpace(context: RuntimeOperationContext, space: string): string {\n  const resolved = operationSpaceResolver(\n    context.runtime.node,\n    context.summary.space,\n  )(space);\n  const name = resolved.split(\":\").at(-1)?.toLowerCase();\n  if (name === \"secrets\" || name === \"account\") {\n    throw new OperationInvocationError(operationError(\n      \"INPUT_INVALID\",\n      \"Generic SQL operations cannot access protected TinyCloud account or secrets spaces.\",\n    ));\n  }\n  return resolved;\n}\n\nfunction encodeBlob(value: Uint8Array): SqlBlob {\n  return {\n    type: \"blob\",\n    base64: Buffer.from(value).toString(\"base64\"),\n    byteLength: value.byteLength,\n  };\n}\n\nfunction unsafeSqlValue(message: string): OperationInvocationError {\n  return new OperationInvocationError(operationError(\"SQL_VALUE_UNSAFE\", message));\n}\n\nfunction sqlFailure(\n  error: unknown,\n  action: string,\n): OperationExecutionOutcome<never> {\n  if (error instanceof OperationInvocationError) {\n    return { status: \"error\", error: error.operationError };\n  }\n  return authorizationFailure(error, action) ?? nodeFailure(action);\n}\n\nfunction nodeFailure(action: string): OperationExecutionOutcome<never> {\n  return {\n    status: \"error\",\n    error: operationError(\n      \"NODE_ERROR\",\n      `The TinyCloud node could not ${action}.`,\n      { retryable: true },\n    ),\n  };\n}\n\nfunction sqlServiceFailure(\n  error: unknown,\n  action: string,\n): OperationExecutionOutcome<never> {\n  const auth = authorizationFailure(error, action);\n  if (auth !== undefined) return auth;\n  if (isRecord(error) && error.code === \"SQL_RESPONSE_TOO_LARGE\") {\n    return {\n      status: \"error\",\n      error: operationError(\n        \"SQL_RESULT_LIMIT_EXCEEDED\",\n        \"The SQLite query result exceeded the requested result limits.\",\n      ),\n    };\n  }\n  return nodeFailure(action);\n}\n\nfunction sqlMutationFailure(): OperationExecutionOutcome<never> {\n  return {\n    status: \"error\",\n    error: operationError(\n      \"SQL_EXECUTION_FAILED\",\n      \"The SQLite statement outcome is unknown; inspect database state before considering another write.\",\n      { retryable: false },\n    ),\n  };\n}\n\nfunction isCanonicalBase64(value: string): boolean {\n  if (value === \"\") return true;\n  if (value.length % 4 !== 0 || !/^[A-Za-z0-9+/]*={0,2}$/.test(value)) return false;\n  return Buffer.from(value, \"base64\").toString(\"base64\") === value;\n}\n\nfunction sqlInputValueBytes(value: SqlInputValue): number {\n  if (typeof value === \"string\") return Buffer.byteLength(value, \"utf8\");\n  if (isRecord(value) && value.type === \"blob\") {\n    return Buffer.from(value.base64 as string, \"base64\").byteLength;\n  }\n  return 8;\n}\n\nfunction isByte(value: unknown): value is number {\n  return Number.isInteger(value) && (value as number) >= 0 && (value as number) <= 255;\n}\n\nfunction isRecord(value: unknown): value is Record<string, unknown> {\n  return typeof value === \"object\" && value !== null && !Array.isArray(value);\n}\n","import { join } from \"node:path\";\n\n// Keep the value import namespace-shaped so modules that import this one stay\n// compatible with lightweight node-sdk test doubles.\nimport * as nodeSdk from \"@tinycloud/node-sdk\";\nimport type {\n  PermissionEntry,\n  PortableDelegation,\n  RuntimeDelegationActivator,\n  ValidatedRuntimeDelegation,\n} from \"@tinycloud/node-sdk\";\n\nimport { DelegationRequestBindingSchema } from \"./artifacts.js\";\nimport { delegationWithinRequest, type OperationSpaceResolver } from \"./authority.js\";\nimport {\n  profilePath,\n  readAdditionalDelegations,\n  readJson,\n  readSession,\n  updateProfileStore,\n  withProfileLock,\n  writeJsonAtomic,\n} from \"./state.js\";\n\nexport { operationSpaceResolver } from \"./secrets.js\";\n\n/**\n * Request bindings for delegations stored in `additional-delegations.json`.\n *\n * A compact-UCAN or signed-login (SIWE) record replays only when its\n * `authorityRequest` binding is valid and the capabilities its signed bytes\n * grant fit inside the binding's `requested`. Validated activation checks that\n * before anything is activated. Three writers produce bindings:\n *\n * - `tinycloud.auth.import`: the stored request the delegation was checked\n *   against (`requestId` is that request's).\n * - `tc auth import` of an artifact with no request: exactly the delegation's\n *   own signed capabilities (`unbound-import:<cid>`).\n * - The one-time migration of records stored before bindings existed: exactly\n *   each record's own signed capabilities (`migrated:<cid>`).\n *\n * Records the CLI stores from its own signed-login grants carry no\n * `siweProof`, cannot be verified here, and keep their legacy CLI replay.\n *\n * The binding is local profile data. It stops records written by any other\n * path from granting authority. It does not stop someone who can write the\n * profile directory, who already holds the session key and the signed bytes.\n */\n\nexport type BindingSource = \"migration\" | \"unbound-import\";\n\nconst REQUEST_ID_PREFIX: Record<BindingSource, string> = {\n  migration: \"migrated\",\n  \"unbound-import\": \"unbound-import\",\n};\n\n/** The audit note written beside a binding synthesized from a record's own signed capabilities. */\nexport const BINDING_NOTES: Record<BindingSource, string> = {\n  migration:\n    \"Stored without a request binding before bindings were required. Bound at migration to exactly \" +\n    \"its own signed capabilities, so replay refuses any delegation in this record that exceeds them.\",\n  \"unbound-import\":\n    \"Imported by `tc auth import` without a stored request. Bound to exactly its own signed \" +\n    \"capabilities, so replay refuses any delegation in this record that exceeds them.\",\n};\n\n/** Short so a busy profile only defers migration to a later runtime. */\nconst MIGRATION_LOCK_TIMEOUT_MS = 250;\n\n/** The per-profile marker: present once that profile's unbound records were migrated. */\nexport function bindingMigrationPath(profile: string): string {\n  return join(profilePath(profile), \"delegation-binding-migration.json\");\n}\n\n/**\n * How replay treats a stored record:\n *\n * - `compact` and `signed-login` records go through validated activation and\n *   the binding rule.\n * - `other` records keep the CLI's legacy replay: an unbound record whose\n *   bytes are not compact and that has no `siweProof`, which is how the CLI\n *   stores its own signed-login grants. The operations runtime never installs\n *   them.\n * - `refused` records install nothing anywhere.\n *\n * A record is `refused` unless its `delegationHeader` has exactly one own\n * key, `Authorization`, with a string value: header names are matched\n * case-insensitively on the wire, and other value types are stringified, so\n * any other shape could reach the node as authorization bytes this rule never\n * read. Bytes containing a `.` are never `other`: a CACAO has none, and\n * validated activation refuses anything compact-shaped that it cannot parse.\n * A record with an `authorityRequest` (valid or not) is never `other`: the\n * legacy path cannot hold it to a binding, so dropping a `siweProof` cannot\n * route a bound signed-login delegation around its binding.\n */\nexport function storedDelegationKind(\n  entry: unknown,\n): \"compact\" | \"signed-login\" | \"other\" | \"refused\" {\n  // A stored element that is not an object is not a record at all.\n  if (!isRecord(entry)) return \"refused\";\n  const delegation = entry.delegation;\n  if (!isRecord(delegation)) return \"refused\";\n  const header = delegation.delegationHeader;\n  if (\n    !isRecord(header) ||\n    Object.keys(header).length !== 1 ||\n    !Object.prototype.hasOwnProperty.call(header, \"Authorization\") ||\n    typeof header.Authorization !== \"string\"\n  ) {\n    return \"refused\";\n  }\n  if (\"siweProof\" in delegation) return \"signed-login\";\n  if (header.Authorization.includes(\".\")) return \"compact\";\n  return \"authorityRequest\" in entry ? \"refused\" : \"other\";\n}\n\n/**\n * What replay holds a stored record to: its binding's `requested`, `\"signed\"`\n * for an unbound compact record before the profile has migrated (it installs\n * with its own signed authority, as before bindings existed), or `undefined`\n * when the record installs nothing.\n */\nexport function replayLimit(\n  entry: unknown,\n  migrated: boolean,\n): readonly PermissionEntry[] | \"signed\" | undefined {\n  const kind = storedDelegationKind(entry);\n  if (!isRecord(entry) || (kind !== \"compact\" && kind !== \"signed-login\")) return undefined;\n  const binding = DelegationRequestBindingSchema.safeParse(entry.authorityRequest);\n  if (binding.success) return binding.data.requested;\n  return !migrated && kind === \"compact\" && !(\"authorityRequest\" in entry) ? \"signed\" : undefined;\n}\n\n/**\n * Binds a record to exactly the capabilities its signed bytes grant, with an\n * audit note naming where the binding came from.\n */\nfunction bindToSignedCapabilities<T extends { readonly delegation: { readonly cid: string } }>(\n  record: T,\n  signed: readonly PermissionEntry[],\n  source: BindingSource,\n  recordedAt = new Date().toISOString(),\n): T & Record<\"authorityRequest\" | \"authorityRequestAudit\", unknown> {\n  return {\n    ...record,\n    authorityRequest: DelegationRequestBindingSchema.parse({\n      requestId: `${REQUEST_ID_PREFIX[source]}:${record.delegation.cid}`,\n      requested: structuredClone(signed),\n    }),\n    authorityRequestAudit: { source, recordedAt, note: BINDING_NOTES[source] },\n  };\n}\n\n/**\n * Validates and activates a compact delegation that `tc auth import` received\n * without a stored request, through the same validated activation replay uses,\n * and returns its record bound to exactly the capabilities its signed bytes\n * grant. Throws when validation or activation fails.\n */\nexport async function activateUnboundCompactImport(\n  node: RuntimeDelegationActivator,\n  delegation: PortableDelegation,\n  host: string,\n): Promise<{ delegation: PortableDelegation; permissions: PermissionEntry[] } & Record<string, unknown>> {\n  const activated = await nodeSdk.activateValidatedRuntimeDelegation(node, delegation, { host });\n  return bindToSignedCapabilities(\n    // The record keeps the delegation as imported; replay validates it again.\n    { delegation, permissions: [...activated.effectivePermissions] },\n    activated.effectivePermissions,\n    \"unbound-import\",\n  );\n}\n\n/**\n * The stored records after adding records written without a stored request\n * (by `tc auth import` or a CLI grant). A stored record for the same CID that\n * carries an `authorityRequest` is kept as it is, so this route never drops,\n * replaces or weakens a binding; otherwise each record replaces every row for\n * its CID, at the first one's position, or is appended. Callers write the\n * result under the profile lock they already use for this store.\n */\nexport function mergeDelegationsWithoutRequest(\n  stored: readonly unknown[],\n  incoming: readonly ({ readonly delegation: { readonly cid: string } } & Record<string, unknown>)[],\n): unknown[] {\n  let records = [...stored];\n  for (const record of incoming) {\n    const cid = record.delegation.cid;\n    if (records.some((entry) => storedCid(entry) === cid && isRecord(entry) && \"authorityRequest\" in entry)) continue;\n    const position = records.findIndex((entry) => storedCid(entry) === cid);\n    const others = records.filter((entry) => storedCid(entry) !== cid);\n    records = position === -1\n      ? [...records, record]\n      : [...others.slice(0, position), record, ...others.slice(position)];\n  }\n  return records;\n}\n\n/**\n * Runs before replay reads the profile's records, so those records and the\n * migration marker agree. Returns whether the profile has migrated.\n *\n * Migration runs under the profile lock, and only while the profile's\n * persisted session is still the one `node` restored: a session rotated since\n * the restore leaves migration to a runtime of the new session. Each compact\n * record with no `authorityRequest` is handled on its own: if validated\n * activation can read its signed capabilities (CID, expiry, audience and\n * declared resources checked, nothing activated) and they form a valid\n * binding, the record is bound to exactly those capabilities; otherwise it\n * stays unbound, is listed in the marker's `unbound`, and installs nothing\n * after migration. A compact record whose capabilities cannot be read could\n * not activate for this session either. `migrate` must be false unless `node`\n * holds the profile's own restored session.\n *\n * Migration is best-effort and restartable. The bound records are written\n * first and the marker last; a busy lock or any failure before the marker\n * leaves the profile unmigrated, so this runtime replays under the\n * pre-migration rule and the next one migrates again. Records already bound\n * by an interrupted run keep their bindings.\n */\nexport async function prepareStoredDelegationReplay(\n  profile: string,\n  node: RuntimeDelegationActivator,\n  options: { readonly host: string; readonly migrate: boolean },\n): Promise<boolean> {\n  if (await bindingMigrationRecorded(profile)) return true;\n  // A persisted session without a `verificationMethod`, or one this node did\n  // not restore, never migrates here; skip the lock rather than take it for\n  // nothing on every command.\n  if (!options.migrate || !await holdsPersistedSession(profile, node)) return false;\n  try {\n    return await withProfileLock(profile, async () => {\n      if (await bindingMigrationRecorded(profile)) return true;\n      // Checked again under the lock: a session rotated since the restore\n      // leaves migration to a runtime of the new session.\n      if (!await holdsPersistedSession(profile, node)) return false;\n      const recordedAt = new Date().toISOString();\n      const bound = new Map<string, Record<string, unknown>>();\n      const unbound: string[] = [];\n      for (const entry of await readAdditionalDelegations<unknown>(profile)) {\n        // Elements that are not objects are skipped: they install nothing.\n        if (!isRecord(entry) || \"authorityRequest\" in entry || storedDelegationKind(entry) !== \"compact\") continue;\n        const migrated = await migratedRecord(node, entry, options.host, recordedAt);\n        if (migrated === undefined) unbound.push(String(storedCid(entry)));\n        else bound.set(recordKey(entry)!, migrated);\n      }\n      if (bound.size > 0) {\n        await updateProfileStore<unknown, void>(profile, \"additional-delegations\", (records) => ({\n          records: records.map((entry) => {\n            const key = !isRecord(entry) || \"authorityRequest\" in entry ? undefined : recordKey(entry);\n            return (key === undefined ? undefined : bound.get(key)) ?? entry;\n          }),\n          result: undefined,\n        }));\n      }\n      await writeJsonAtomic(bindingMigrationPath(profile), {\n        formatVersion: 1,\n        migratedAt: recordedAt,\n        bound: [...bound.values()].map(storedCid),\n        unbound,\n      });\n      return true;\n    }, { timeoutMs: MIGRATION_LOCK_TIMEOUT_MS });\n  } catch {\n    return false;\n  }\n}\n\n/** Whether the profile's persisted session is the one `node` restored. */\nasync function holdsPersistedSession(profile: string, node: RuntimeDelegationActivator): Promise<boolean> {\n  try {\n    const persisted = await readSession<Record<string, unknown>>(profile);\n    return typeof persisted?.verificationMethod === \"string\" &&\n      typeof node.sessionDid === \"string\" &&\n      persisted.verificationMethod.split(\"#\", 1)[0] === node.sessionDid.split(\"#\", 1)[0];\n  } catch {\n    return false;\n  }\n}\n\n/** One record's migration: bound to its own signed capabilities, or `undefined` if it cannot be. */\nasync function migratedRecord(\n  node: RuntimeDelegationActivator,\n  entry: Record<string, unknown>,\n  host: string,\n  recordedAt: string,\n): Promise<Record<string, unknown> | undefined> {\n  const delegation = normalizeStoredDelegation(entry);\n  if (delegation === undefined) return undefined;\n  const signed = await signedCapabilities(node, delegation, host);\n  if (signed === undefined) return undefined;\n  try {\n    // The stored delegation is kept exactly as it was; only the binding is added.\n    return bindToSignedCapabilities({ ...entry, delegation: { ...entry.delegation as object, cid: delegation.cid } }, signed, \"migration\", recordedAt);\n  } catch {\n    // Signed capabilities a request binding cannot hold (an empty action, say).\n    return undefined;\n  }\n}\n\n/**\n * Replays one stored record under the binding rule. A record with a valid\n * binding installs only if its signed capabilities fit inside it. Before the\n * profile has migrated, an unbound compact record installs with its signed\n * authority as it always did; after, it installs nothing. A signed-login\n * record installs only with a binding. Returns the installed delegation, or\n * `undefined` when the record installs nothing. Never throws: stored data is\n * untrusted transport material.\n */\nexport async function replayStoredDelegation(\n  node: RuntimeDelegationActivator,\n  entry: unknown,\n  options: {\n    readonly host: string;\n    readonly migrated: boolean;\n    readonly resolveSpace: OperationSpaceResolver;\n  },\n): Promise<ValidatedRuntimeDelegation | undefined> {\n  const delegation = normalizeStoredDelegation(entry);\n  if (delegation === undefined || delegation.expiry.getTime() <= Date.now()) return undefined;\n  const limit = replayLimit(entry, options.migrated);\n  if (limit === undefined) return undefined;\n  const authorize = limit === \"signed\"\n    ? () => true\n    : (effective: readonly PermissionEntry[]) => delegationWithinRequest(limit, effective, options.resolveSpace);\n  try {\n    return await nodeSdk.activateValidatedRuntimeDelegation(node, delegation, { host: options.host, authorize });\n  } catch {\n    // An invalid, stale, wrong-session, or rejected record grants nothing and\n    // must not reveal its contents through a safe operation channel.\n    return undefined;\n  }\n}\n\n/** An unreadable marker counts as migrated: a damaged marker never reopens migration. */\nexport async function bindingMigrationRecorded(profile: string): Promise<boolean> {\n  try {\n    return await readJson<unknown>(bindingMigrationPath(profile)) !== null;\n  } catch {\n    return true;\n  }\n}\n\n/**\n * The capabilities a stored delegation's signed bytes grant, read through\n * validated activation, which `authorize` stops before anything is activated.\n */\nasync function signedCapabilities(\n  node: RuntimeDelegationActivator,\n  delegation: PortableDelegation,\n  host: string,\n): Promise<readonly PermissionEntry[] | undefined> {\n  let signed: readonly PermissionEntry[] | undefined;\n  try {\n    await nodeSdk.activateValidatedRuntimeDelegation(node, delegation, {\n      // The transport host is not signed authority; check it at replay instead.\n      host: delegation.host ?? host,\n      authorize: (effective) => {\n        signed = effective;\n        return false;\n      },\n    });\n  } catch {\n    // Refused by `authorize` once the capabilities were read, or failed a check before it.\n  }\n  return signed;\n}\n\nfunction normalizeStoredDelegation(entry: unknown): PortableDelegation | undefined {\n  if (!isRecord(entry)) return undefined;\n  const raw = entry.delegation;\n  if (!isRecord(raw) || !isRecord(raw.delegationHeader)) return undefined;\n  const expiry = raw.expiry instanceof Date\n    ? raw.expiry\n    : typeof raw.expiry === \"string\" ? new Date(raw.expiry) : undefined;\n  if (\n    expiry === undefined || Number.isNaN(expiry.getTime()) ||\n    typeof raw.cid !== \"string\" ||\n    typeof raw.spaceId !== \"string\" ||\n    typeof raw.path !== \"string\" ||\n    !Array.isArray(raw.actions) || !raw.actions.every((action) => typeof action === \"string\") ||\n    typeof raw.delegateDID !== \"string\" ||\n    typeof raw.ownerAddress !== \"string\" ||\n    typeof raw.chainId !== \"number\" ||\n    typeof raw.delegationHeader.Authorization !== \"string\"\n  ) {\n    return undefined;\n  }\n  return { ...raw, expiry } as PortableDelegation;\n}\n\nfunction storedCid(entry: unknown): string | undefined {\n  const cid = isRecord(entry) && isRecord(entry.delegation) ? entry.delegation.cid : undefined;\n  return typeof cid === \"string\" ? cid : undefined;\n}\n\n/** A record's CID and exact authorization bytes. */\nfunction recordKey(entry: Record<string, unknown>): string | undefined {\n  const delegation = entry.delegation;\n  if (!isRecord(delegation) || !isRecord(delegation.delegationHeader)) return undefined;\n  return JSON.stringify([delegation.cid, delegation.delegationHeader.Authorization]);\n}\n\nfunction isRecord(value: unknown): value is Record<string, unknown> {\n  return typeof value === \"object\" && value !== null && !Array.isArray(value);\n}\n","import { z } from \"zod\";\n\nimport type {\n  OperationContext,\n  OperationDefinition,\n  OperationExecutionOutcome,\n  OperationExposure,\n  OperationSensitivity,\n  TinyCloudPosture,\n} from \"../contract.js\";\nimport { bindingMigrationRecorded, replayLimit, storedDelegationKind } from \"../delegation-binding.js\";\nimport { operationError } from \"../errors.js\";\nimport {\n  additionalDelegationsPath,\n  readJson,\n  readProfile,\n  readSession,\n  readStoreMetadata,\n} from \"../state.js\";\n\ntype StatusInput = Record<never, never>;\n\ninterface StatusOutput {\n  readonly profile: string;\n  readonly host: string;\n  readonly posture: TinyCloudPosture;\n  readonly operatorType?: \"human\" | \"agent\";\n  readonly principalDid?: string;\n  readonly sessionDid?: string;\n  readonly ownerDid?: string;\n  readonly space?: string;\n  readonly session: {\n    readonly present: boolean;\n    readonly expired: boolean | null;\n    readonly expiresAt: string | null;\n  };\n  readonly liveAdditionalDelegationCount: number;\n}\n\nconst StatusInputSchema: z.ZodType<StatusInput> = z.object({}).strict();\n\nconst StatusOutputSchema: z.ZodType<StatusOutput> = z.object({\n  profile: z.string().min(1),\n  host: z.string().min(1),\n  posture: z.enum([\n    \"owner-openkey\",\n    \"delegate-session\",\n    \"local-owner-key\",\n    \"unauthenticated\",\n  ]),\n  operatorType: z.enum([\"human\", \"agent\"]).optional(),\n  principalDid: z.string().min(1).optional(),\n  sessionDid: z.string().min(1).optional(),\n  ownerDid: z.string().min(1).optional(),\n  space: z.string().min(1).optional(),\n  session: z.object({\n    present: z.boolean(),\n    expired: z.boolean().nullable(),\n    expiresAt: z.string().datetime({ offset: true }).nullable(),\n  }).strict(),\n  liveAdditionalDelegationCount: z.number().int().nonnegative().describe(\n    \"Stored, unexpired delegations the replay rule accepts: compact-UCAN or signed-login records with a request \" +\n      \"binding, and unbound compact-UCAN records before the profile's one-time binding migration. Each is still \" +\n      \"validated, and checked against its binding, when a runtime installs it.\",\n  ),\n}).strict();\n\nconst STATUS_POSTURES: readonly TinyCloudPosture[] = [\n  \"owner-openkey\",\n  \"delegate-session\",\n  \"local-owner-key\",\n  \"unauthenticated\",\n];\n\nconst STATUS_EXPOSURE: OperationExposure = {\n  cli: { status: \"required\" },\n  mcp: { status: \"required\" },\n  skill: { status: \"required\" },\n  docs: { status: \"required\" },\n};\n\nconst STATUS_SENSITIVITY: OperationSensitivity = { input: [], output: [] };\n\n/**\n * Internal I2 definition material. The registry integration owner imports this\n * collection; package entrypoints intentionally do not expose these handlers.\n */\nexport const statusOperationDefinitions: readonly OperationDefinition<StatusInput, StatusOutput>[] = [\n  createStatusDefinition({\n    id: \"tinycloud.status.get\",\n    title: \"TinyCloud status\",\n    description: \"Inspect the selected TinyCloud profile's safe local status.\",\n  }),\n  createStatusDefinition({\n    id: \"tinycloud.auth.status\",\n    title: \"TinyCloud authentication status\",\n    description: \"Inspect the selected TinyCloud profile's safe authentication status.\",\n  }),\n];\n\nfunction createStatusDefinition(params: Readonly<{\n  id: \"tinycloud.status.get\" | \"tinycloud.auth.status\";\n  title: string;\n  description: string;\n}>): OperationDefinition<StatusInput, StatusOutput> {\n  return {\n    id: params.id,\n    version: 1,\n    title: params.title,\n    description: params.description,\n    input: StatusInputSchema,\n    output: StatusOutputSchema,\n    effects: [\"read\"],\n    runtime: \"inspection\",\n    postures: STATUS_POSTURES,\n    exposure: STATUS_EXPOSURE,\n    sensitivity: STATUS_SENSITIVITY,\n    authority: async () => [],\n    execute: inspectPinnedProfileStatus,\n  };\n}\n\nasync function inspectPinnedProfileStatus(\n  context: OperationContext,\n  _input: StatusInput,\n): Promise<OperationExecutionOutcome<StatusOutput>> {\n  const profile = context.summary.profile;\n  if (!(await pinnedProfileExists(profile))) return profileNotFound(profile);\n\n  try {\n    const [session, liveAdditionalDelegationCount] = await Promise.all([\n      readSession<Record<string, unknown>>(profile),\n      countLiveAdditionalDelegations(profile),\n    ]);\n    const sessionSummary = summarizeSession(session);\n\n    return {\n      status: \"ok\",\n      output: {\n        profile,\n        host: context.summary.host,\n        posture: context.summary.posture,\n        ...(context.summary.operatorType === undefined\n          ? {}\n          : { operatorType: context.summary.operatorType }),\n        ...(context.summary.principalDid === undefined\n          ? {}\n          : { principalDid: context.summary.principalDid }),\n        ...(context.summary.sessionDid === undefined\n          ? {}\n          : { sessionDid: context.summary.sessionDid }),\n        ...(context.summary.ownerDid === undefined\n          ? {}\n          : { ownerDid: context.summary.ownerDid }),\n        ...(context.summary.space === undefined ? {} : { space: context.summary.space }),\n        session: sessionSummary,\n        liveAdditionalDelegationCount,\n      },\n    };\n  } catch {\n    // Store contents may contain keys, session material, or delegation bytes.\n    // A state-inspection failure must not relay any part of that material.\n    return {\n      status: \"error\",\n      error: operationError(\n        \"INTERNAL_ERROR\",\n        \"The profile state could not be inspected.\",\n      ),\n    };\n  }\n}\n\nasync function pinnedProfileExists(profile: string): Promise<boolean> {\n  try {\n    const storedProfile = await readProfile<Record<string, unknown>>(profile);\n    return isRecord(storedProfile);\n  } catch {\n    return false;\n  }\n}\n\nasync function countLiveAdditionalDelegations(profile: string): Promise<number> {\n  await readStoreMetadata(profile, \"additional-delegations\");\n  const rawDelegations = await readJson<unknown>(additionalDelegationsPath(profile));\n  if (rawDelegations === null) return 0;\n  if (!Array.isArray(rawDelegations)) throw new TypeError(\"Invalid additional delegation store.\");\n\n  const now = Date.now();\n  const migrated = await bindingMigrationRecorded(profile);\n  let count = 0;\n  for (const entry of rawDelegations) {\n    // Elements replay refuses outright (not objects, no delegation, malformed\n    // headers) never install, so they are not inspected either.\n    if (storedDelegationKind(entry) === \"refused\") continue;\n    const expiry = storedDelegationExpiry(entry);\n    // Records replay refuses outright (unbound after migration, malformed,\n    // or the CLI's own signed-login grants) are not runtime authority.\n    if (expiry.getTime() > now && replayLimit(entry, migrated) !== undefined) count += 1;\n  }\n  return count;\n}\n\nfunction summarizeSession(session: Record<string, unknown> | null): StatusOutput[\"session\"] {\n  if (session === null) return { present: false, expired: null, expiresAt: null };\n  if (!isRecord(session)) throw new TypeError(\"Invalid session store.\");\n\n  const expiry = extractSessionExpiry(session);\n  if (expiry === null) return { present: true, expired: null, expiresAt: null };\n\n  return {\n    present: true,\n    expired: expiry.getTime() <= Date.now(),\n    expiresAt: expiry.toISOString(),\n  };\n}\n\nfunction storedDelegationExpiry(entry: unknown): Date {\n  if (!isRecord(entry) || !isRecord(entry.delegation) || !(\"expiry\" in entry.delegation)) {\n    throw new TypeError(\"Invalid stored delegation.\");\n  }\n  return parseExpiry(entry.delegation.expiry);\n}\n\nfunction extractSessionExpiry(session: Record<string, unknown>): Date | null {\n  for (const field of [\"expiresAt\", \"expiry\", \"expirationTime\"] as const) {\n    if (!(field in session) || session[field] === undefined || session[field] === null) continue;\n    return parseExpiry(session[field]);\n  }\n\n  if (!(\"siwe\" in session) || session.siwe === undefined || session.siwe === null) return null;\n  if (typeof session.siwe !== \"string\") throw new TypeError(\"Invalid session expiry.\");\n  const match = session.siwe.match(/^Expiration Time:\\s*(.+)$/im);\n  return match === null ? null : parseExpiry(match[1].trim());\n}\n\nfunction parseExpiry(value: unknown): Date {\n  const date = value instanceof Date\n    ? value\n    : typeof value === \"number\" && Number.isFinite(value)\n    ? new Date(value > 0 && value < 1_000_000_000_000 ? value * 1_000 : value)\n    : typeof value === \"string\" && value.trim() !== \"\"\n    ? new Date(value)\n    : null;\n  if (date === null || Number.isNaN(date.getTime())) throw new TypeError(\"Invalid expiry.\");\n  return date;\n}\n\nfunction profileNotFound(profile: string): OperationExecutionOutcome<never> {\n  return {\n    status: \"error\",\n    error: operationError(\n      \"PROFILE_NOT_FOUND\",\n      `Profile \"${profile}\" is not available.`,\n    ),\n  };\n}\n\nfunction isRecord(value: unknown): value is Record<string, unknown> {\n  return typeof value === \"object\" && value !== null && !Array.isArray(value);\n}\n","import type { OperationDefinition, OperationId } from \"./contract.js\";\nimport { authOperationDefinitions } from \"./operations/auth.js\";\nimport { explorationOperationDefinitions } from \"./operations/exploration.js\";\nimport { secretsGetOperationDefinitions } from \"./operations/secrets-get.js\";\nimport { sqlOperationDefinitions } from \"./operations/sql.js\";\nimport { statusOperationDefinitions } from \"./operations/status.js\";\n\nexport type OperationLookup =\n  | Readonly<{ status: \"found\"; definition: OperationDefinition<any, any> }>\n  | Readonly<{ status: \"operation_not_found\" }>\n  | Readonly<{\n      status: \"operation_version_unsupported\";\n      supportedVersions: readonly number[];\n    }>;\n\n/**\n * The closed v1 catalog is assembled from internal definitions. There is no\n * exported registration hook for projections or a handler bypass API.\n */\nlet operationDefinitions: readonly OperationDefinition<any, any>[] | undefined;\n\nfunction registeredOperationDefinitions(): readonly OperationDefinition<any, any>[] {\n  // Auth handlers consult lookupOperation while executing. Lazy assembly keeps\n  // that internal dependency out of the module-initialization cycle.\n  operationDefinitions ??= [\n    ...statusOperationDefinitions,\n    ...authOperationDefinitions,\n    ...explorationOperationDefinitions,\n    ...sqlOperationDefinitions,\n    ...secretsGetOperationDefinitions,\n  ];\n  return operationDefinitions;\n}\n\n/** Internal generator input; package exports prevent projection access. */\nexport function operationDefinitionsForCatalog(): readonly OperationDefinition<any, any>[] {\n  return registeredOperationDefinitions();\n}\n\nexport function lookupOperation(\n  operationId: OperationId,\n  operationVersion: number,\n): OperationLookup {\n  const matchingId = registeredOperationDefinitions().filter(\n    (definition) => definition.id === operationId,\n  );\n  if (matchingId.length === 0) {\n    return { status: \"operation_not_found\" };\n  }\n\n  const definition = matchingId.find(\n    (candidate) => candidate.version === operationVersion,\n  );\n  if (definition === undefined) {\n    return {\n      status: \"operation_version_unsupported\",\n      supportedVersions: matchingId.map((candidate) => candidate.version),\n    };\n  }\n\n  return { status: \"found\", definition };\n}\n","import {\n  DEFAULT_PROFILE,\n  readJson,\n  readProfile,\n  tinycloudConfigPath,\n} from \"./state.js\";\nimport type {\n  InvocationTarget,\n  OperationContextSummary,\n  OperationOperatorType,\n  TinyCloudPosture,\n} from \"./contract.js\";\n\nconst DEFAULT_HOST = \"https://tee.node.tinycloud.xyz\";\n\nexport type SafeInvocationContext = OperationContextSummary & {\n  operatorType: OperationOperatorType;\n};\n\nexport type InvocationContextResolution =\n  | { ok: true; context: SafeInvocationContext }\n  | {\n    ok: false;\n    error: {\n      code: \"PROFILE_NOT_FOUND\";\n      message: string;\n      retryable: false;\n    };\n  };\n\ninterface GlobalConfig {\n  defaultProfile?: unknown;\n}\n\n/** Validated profile material retained only inside runtime resolution. */\nexport type StoredProfile = {\n  name: string;\n  host: string;\n  chainId: number;\n  spaceName: string;\n  did: string;\n  createdAt: string;\n  sessionDid?: unknown;\n  ownerDid?: unknown;\n  spaceId?: unknown;\n  posture?: unknown;\n  operatorType?: unknown;\n  authMethod?: unknown;\n  defaultSpace?: unknown;\n  privateKey?: unknown;\n  address?: unknown;\n  openkeyHost?: unknown;\n};\n\n/** Profile snapshot plus its derived safe invocation context. */\nexport type InvocationProfileResolution =\n  | { ok: true; profile: StoredProfile; context: SafeInvocationContext }\n  | Extract<InvocationContextResolution, { ok: false }>;\n\n/**\n * Resolves one selected profile to safe identity data. Resolution is deliberately\n * one-way: after selecting a name, any missing, malformed, or unreadable\n * profile is PROFILE_NOT_FOUND rather than a reason to choose another profile.\n */\nexport async function resolveInvocationContext(\n  target: InvocationTarget = {},\n): Promise<InvocationContextResolution> {\n  const resolved = await resolveInvocationProfile(target);\n  return resolved.ok ? { ok: true, context: resolved.context } : resolved;\n}\n\n/** Resolves the selected profile and its safe context from one profile read. */\nexport async function resolveInvocationProfile(\n  target: InvocationTarget = {},\n): Promise<InvocationProfileResolution> {\n  const profile = await resolveProfileName(target);\n  let storedProfile: StoredProfile | null;\n  try {\n    storedProfile = await readProfile<StoredProfile>(profile);\n  } catch {\n    return profileNotFound(profile);\n  }\n\n  if (!isStoredProfile(storedProfile)) {\n    return profileNotFound(profile);\n  }\n  // An explicit CLI key is a complete identity override. Do not let stale\n  // persisted auth posture reject that live local-owner authentication path.\n  if (target.privateKey === undefined && !isCoherentProfile(storedProfile)) {\n    return profileNotFound(profile);\n  }\n\n  const host = firstString(target.host, process.env.TC_HOST, storedProfile.host, DEFAULT_HOST);\n  const posture = resolvePosture(storedProfile);\n\n  return {\n    ok: true,\n    profile: storedProfile,\n    context: {\n      profile,\n      host,\n      posture,\n      operatorType: isOperatorType(storedProfile.operatorType) ? storedProfile.operatorType : \"human\",\n      principalDid: maybeDid(storedProfile.did),\n      sessionDid: maybeDid(storedProfile.sessionDid),\n      ownerDid: maybeDid(storedProfile.ownerDid),\n      space: typeof storedProfile.spaceId === \"string\" ? storedProfile.spaceId : undefined,\n    },\n  };\n}\n\n/**\n * Selects the profile name once for a long-lived projection process. The\n * selected name is safe identity data; profile material is read only by the\n * invocation runtime after the projection pins this value.\n */\nexport async function resolveInvocationProfileName(\n  explicitProfile?: string,\n): Promise<string> {\n  return resolveProfileName(\n    explicitProfile === undefined ? {} : { profile: explicitProfile },\n  );\n}\n\nasync function resolveProfileName(target: InvocationTarget): Promise<string> {\n  if (typeof target.profile === \"string\") return target.profile;\n  if (typeof process.env.TC_PROFILE === \"string\") return process.env.TC_PROFILE;\n\n  try {\n    const config = await readJson<GlobalConfig>(tinycloudConfigPath());\n    if (typeof config?.defaultProfile === \"string\") return config.defaultProfile;\n  } catch {\n    // Config only chooses the initial name. A missing or malformed config falls\n    // back to the documented default, never to another existing profile.\n  }\n  return DEFAULT_PROFILE;\n}\n\n/** Derives the effective posture without consulting any later profile read. */\nexport function resolvePosture(profile: Pick<StoredProfile, \"posture\" | \"authMethod\">): TinyCloudPosture {\n  if (isPosture(profile.posture)) return profile.posture;\n  if (profile.authMethod === \"local\") return \"local-owner-key\";\n  return \"owner-openkey\";\n}\n\nfunction profileNotFound(profile: string): Extract<InvocationContextResolution, { ok: false }> {\n  return {\n    ok: false,\n    error: {\n      code: \"PROFILE_NOT_FOUND\",\n      message: `Profile \"${profile}\" is not available.`,\n      retryable: false,\n    },\n  };\n}\n\nfunction firstString(...values: unknown[]): string {\n  for (const value of values) {\n    if (typeof value === \"string\" && value.length > 0) return value;\n  }\n  return DEFAULT_HOST;\n}\n\nfunction maybeDid(value: unknown): string | undefined {\n  if (typeof value !== \"string\" || value.length === 0) return undefined;\n  const fragment = value.indexOf(\"#\");\n  return fragment === -1 ? value : value.slice(0, fragment);\n}\n\nfunction isPosture(value: unknown): value is TinyCloudPosture {\n  return value === \"owner-openkey\" ||\n    value === \"delegate-session\" ||\n    value === \"local-owner-key\" ||\n    value === \"unauthenticated\";\n}\n\nfunction isOperatorType(value: unknown): value is OperationOperatorType {\n  return value === \"human\" || value === \"agent\";\n}\n\n/**\n * The CLI's original persisted profile format required these six fields.\n * Posture and operator fields arrived later, so they remain optional while\n * any present typed field must still have its documented shape.\n */\nfunction isStoredProfile(value: unknown): value is StoredProfile {\n  return isRecord(value) &&\n    isNonEmptyString(value.name) &&\n    isNonEmptyString(value.host) &&\n    typeof value.chainId === \"number\" &&\n    Number.isFinite(value.chainId) &&\n    isNonEmptyString(value.spaceName) &&\n    isNonEmptyString(value.did) &&\n    isNonEmptyString(value.createdAt) &&\n    isOptionalNonEmptyString(value.sessionDid) &&\n    isOptionalNonEmptyString(value.ownerDid) &&\n    isOptionalNonEmptyString(value.spaceId) &&\n    isOptionalPosture(value.posture) &&\n    isOptionalOperatorType(value.operatorType) &&\n    isOptionalAuthMethod(value.authMethod) &&\n    isOptionalNonEmptyString(value.defaultSpace) &&\n    isOptionalNonEmptyString(value.privateKey) &&\n    isOptionalNonEmptyString(value.address) &&\n    isOptionalNonEmptyString(value.openkeyHost);\n}\n\nfunction isRecord(value: unknown): value is Record<string, unknown> {\n  return typeof value === \"object\" && value !== null && !Array.isArray(value);\n}\n\nfunction isNonEmptyString(value: unknown): value is string {\n  return typeof value === \"string\" && value.length > 0;\n}\n\nfunction isOptionalNonEmptyString(value: unknown): boolean {\n  return value === undefined || isNonEmptyString(value);\n}\n\nfunction isOptionalPosture(value: unknown): boolean {\n  return value === undefined || isPosture(value);\n}\n\nfunction isOptionalOperatorType(value: unknown): boolean {\n  return value === undefined || isOperatorType(value);\n}\n\nfunction isOptionalAuthMethod(value: unknown): boolean {\n  return value === undefined || value === \"openkey\" || value === \"local\";\n}\n\n/**\n * Local-key authentication is owner authentication. A persisted delegate or\n * OpenKey posture must never be allowed to select that path later in runtime\n * construction, so reject the inconsistent profile before policy inspection.\n */\nfunction isCoherentProfile(profile: StoredProfile): boolean {\n  if (profile.authMethod === \"local\") {\n    return profile.posture === undefined || profile.posture === \"local-owner-key\";\n  }\n  if (profile.posture === \"local-owner-key\") {\n    return profile.authMethod === \"local\";\n  }\n  return true;\n}\n","import type {\n  PermissionEntry,\n  RuntimeDelegationActivator,\n  TinyCloudNode,\n} from \"@tinycloud/node-sdk\";\nimport * as nodeSdk from \"@tinycloud/node-sdk\";\n\nimport type {\n  InvocationTarget,\n  OperationContext,\n  OperationRuntime,\n  OperationRuntimeRequirement,\n  RuntimeOperationContext,\n} from \"./contract.js\";\nimport { canonicalizeCapabilities } from \"./authority.js\";\nimport { operationError, type OperationError } from \"./errors.js\";\nimport { resolveInvocationProfile, resolvePosture } from \"./profile.js\";\nimport { operationSpaceResolver } from \"./secrets.js\";\nimport {\n  profilePath,\n  readAdditionalDelegations,\n  readJson,\n  readProfile,\n  readSession,\n} from \"./state.js\";\nimport { prepareStoredDelegationReplay, replayStoredDelegation } from \"./delegation-binding.js\";\n\nexport type InvocationRuntimeResolution =\n  | Readonly<{ ok: true; context: OperationContext }>\n  | Readonly<{\n    ok: false;\n    context: RuntimeOperationContext[\"summary\"];\n    error: OperationError;\n  }>;\n\ninterface StoredSession extends Record<string, unknown> {\n  readonly delegationHeader?: unknown;\n  readonly delegationCid?: unknown;\n  readonly spaceId?: unknown;\n  readonly jwk?: unknown;\n  readonly verificationMethod?: unknown;\n  readonly address?: unknown;\n  readonly chainId?: unknown;\n  readonly siwe?: unknown;\n  readonly signature?: unknown;\n  readonly tinycloudHosts?: unknown;\n}\n\n/**\n * Creates one authenticated runtime for an invocation. The selected profile\n * name is resolved once and every subsequent read is explicitly scoped to that\n * name; no failure path can choose a different profile.\n */\ntype AuthenticatedRuntimeResolution =\n  | Readonly<{ ok: true; context: RuntimeOperationContext }>\n  | Exclude<InvocationRuntimeResolution, Readonly<{ ok: true; context: OperationContext }>>;\n\nexport function createInvocationRuntime(\n  target: InvocationTarget,\n): Promise<AuthenticatedRuntimeResolution>;\nexport function createInvocationRuntime(\n  target: InvocationTarget,\n  requirement: \"authenticated\",\n): Promise<AuthenticatedRuntimeResolution>;\nexport function createInvocationRuntime(\n  target: InvocationTarget,\n  requirement: \"inspection\",\n): Promise<InvocationRuntimeResolution>;\nexport function createInvocationRuntime(\n  target: InvocationTarget,\n  requirement: OperationRuntimeRequirement,\n): Promise<InvocationRuntimeResolution>;\nexport async function createInvocationRuntime(\n  target: InvocationTarget,\n  requirement: OperationRuntimeRequirement = \"authenticated\",\n): Promise<InvocationRuntimeResolution> {\n  const resolved = await resolveInvocationProfile(target);\n  if (!resolved.ok) {\n    return {\n      ok: false,\n      context: unresolvedSummary(target),\n      error: resolved.error,\n    };\n  }\n\n  const summary = resolved.context;\n  if (requirement === \"inspection\") {\n    return { ok: true, context: { summary } };\n  }\n\n  const profileName = summary.profile;\n  try {\n    // Keep the value import namespace-shaped so projection modules remain\n    // compatible with lightweight node-sdk test doubles.\n    const {\n      TinyCloudNode: TinyCloudNodeConstructor,\n    } = nodeSdk;\n    const explicitPrivateKeyOverride = typeof target.privateKey === \"string\";\n    const [session, key] = explicitPrivateKeyOverride\n      ? [null, null]\n      : await Promise.all([\n        readSession<StoredSession>(profileName),\n        readJson<Record<string, unknown>>(`${profilePath(profileName)}/key.json`),\n      ]);\n    const profile = resolved.profile;\n\n    // The inspection summary and authenticated material are intentionally\n    // separate reads. Fail closed if the profile changed posture between\n    // them; otherwise local-owner-key could be authenticated under a stale\n    // delegate-session summary and bypass the caller's posture policy.\n    const actualPosture = resolvePosture(profile);\n    if (!explicitPrivateKeyOverride && actualPosture !== summary.posture) {\n      return failed(\n        { ...summary, posture: actualPosture },\n        operationError(\n          \"PROFILE_POSTURE_NOT_ALLOWED\",\n          \"The selected profile changed posture during runtime resolution.\",\n        ),\n      );\n    }\n\n    const privateKey = typeof target.privateKey === \"string\"\n      ? target.privateKey\n      : typeof profile.privateKey === \"string\"\n      ? profile.privateKey\n      : undefined;\n    const selectedPosture = explicitPrivateKeyOverride || profile.authMethod === \"local\"\n      ? \"local-owner-key\"\n      : summary.posture;\n    if (selectedPosture !== summary.posture && !explicitPrivateKeyOverride) {\n      return failed(\n        { ...summary, posture: selectedPosture },\n        operationError(\n          \"PROFILE_POSTURE_NOT_ALLOWED\",\n          \"The selected profile authentication material does not match its posture.\",\n        ),\n      );\n    }\n    const node = new TinyCloudNodeConstructor({\n      host: summary.host,\n      ...(privateKey === undefined ? {} : { privateKey }),\n    });\n\n    const activeSession = session === null ? undefined : normalizeSession(session, key);\n    if (explicitPrivateKeyOverride) {\n      // An explicit key is a complete, non-persisted identity. Do not inherit\n      // an OpenKey session (or require one) from the selected profile.\n      await node.signIn();\n    } else if (activeSession === undefined) {\n      if (profile.authMethod === \"local\" && privateKey !== undefined) {\n        await node.signIn();\n      } else {\n        return failed(summary, operationError(\n          \"SESSION_NOT_FOUND\",\n          \"The selected profile does not have an active session.\",\n        ));\n      }\n    } else {\n      await node.restoreSession(activeSession);\n    }\n\n    // The restored node is the authority for the active session identity. In\n    // particular, do not report the persisted verification method if SDK\n    // restoration failed to install its key as the live session key.\n    const activeSessionDid = normalizeDid(node.sessionDid);\n    const livePrincipalDid = normalizeDid(node.did);\n    const authenticatedSpace = explicitPrivateKeyOverride\n      ? spaceForAuthenticatedPrincipal(livePrincipalDid)\n      : undefined;\n    // This API derives from the restored, verified base session rather than\n    // from an SDK private field or a second parse of signed authority here.\n    const livePermissions: PermissionEntry[] = [...node.getVerifiedSessionCapabilities()];\n    const resolveSpace = operationSpaceResolver(node, authenticatedSpace ?? summary.space);\n    const seenCids = new Set<string>();\n    // An explicit key is another identity: it neither replays nor migrates\n    // this profile's records.\n    if (!explicitPrivateKeyOverride) {\n      const activator = node as unknown as RuntimeDelegationActivator;\n      // Migration runs before the records are read, so the records replayed\n      // here and the migration marker agree.\n      const migrated = await prepareStoredDelegationReplay(profileName, activator, {\n        host: summary.host,\n        // Only the profile's own restored session; a local sign-in without\n        // one uses a fresh session key the stored records do not address.\n        migrate: activeSession !== undefined,\n      });\n      // Elements are untrusted and may not even be objects; the shared rule\n      // classifies each before reading any field.\n      for (const entry of await readAdditionalDelegations<unknown>(profileName)) {\n        const activated = await replayStoredDelegation(activator, entry, {\n          host: summary.host,\n          migrated,\n          resolveSpace,\n        });\n        if (activated !== undefined && !seenCids.has(activated.cid)) {\n          seenCids.add(activated.cid);\n          livePermissions.push(...activated.effectivePermissions);\n        }\n      }\n    }\n\n    const runtime: OperationRuntime = {\n      node,\n      granted: canonicalizeCapabilities(livePermissions),\n    };\n    return {\n      ok: true,\n      context: {\n        summary: {\n          ...summary,\n          posture: selectedPosture,\n          ...(livePrincipalDid === undefined ? {} : { principalDid: livePrincipalDid }),\n          ...(explicitPrivateKeyOverride && livePrincipalDid !== undefined\n            ? { ownerDid: livePrincipalDid }\n            : {}),\n          ...(authenticatedSpace === undefined ? {} : { space: authenticatedSpace }),\n          ...(activeSessionDid === undefined ? {} : { sessionDid: activeSessionDid }),\n        },\n        runtime,\n      },\n    };\n  } catch {\n    return failed(summary, operationError(\n      \"NODE_ERROR\",\n      \"The selected profile runtime could not be initialized.\",\n      { retryable: true },\n    ));\n  }\n}\n\nfunction spaceForAuthenticatedPrincipal(principal: string | undefined): string | undefined {\n  if (principal === undefined) return undefined;\n  try {\n    const pkh = nodeSdk.parsePkhDid(principal);\n    return pkh === null ? undefined : nodeSdk.makePkhSpaceId(pkh.address, pkh.chainId, \"secrets\");\n  } catch {\n    return undefined;\n  }\n}\n\nfunction normalizeSession(\n  session: StoredSession,\n  key: Record<string, unknown> | null,\n): Parameters<TinyCloudNode[\"restoreSession\"]>[0] | undefined {\n  const header = session.delegationHeader;\n  const jwk = hasPrivateParameter(session.jwk) ? session.jwk : key;\n  if (\n    !isRecord(header) ||\n    typeof header.Authorization !== \"string\" ||\n    typeof session.delegationCid !== \"string\" ||\n    typeof session.spaceId !== \"string\" ||\n    !hasPrivateParameter(jwk) ||\n    typeof session.verificationMethod !== \"string\"\n  ) {\n    return undefined;\n  }\n\n  return {\n    delegationHeader: { Authorization: header.Authorization },\n    delegationCid: session.delegationCid,\n    spaceId: session.spaceId,\n    jwk,\n    verificationMethod: session.verificationMethod,\n    ...(typeof session.address === \"string\" ? { address: session.address } : {}),\n    ...(typeof session.chainId === \"number\" ? { chainId: session.chainId } : {}),\n    ...(typeof session.siwe === \"string\" ? { siwe: session.siwe } : {}),\n    ...(typeof session.signature === \"string\" ? { signature: session.signature } : {}),\n    ...(Array.isArray(session.tinycloudHosts) && session.tinycloudHosts.every((host) => typeof host === \"string\")\n      ? { tinycloudHosts: session.tinycloudHosts }\n      : {}),\n  };\n}\n\nfunction hasPrivateParameter(value: unknown): value is Record<string, unknown> {\n  return isRecord(value) && typeof value.d === \"string\" && value.d.length > 0;\n}\n\nfunction normalizeDid(value: string | undefined): string | undefined {\n  if (typeof value !== \"string\" || value.length === 0) return undefined;\n  return value.split(\"#\", 1)[0];\n}\n\nfunction isRecord(value: unknown): value is Record<string, unknown> {\n  return typeof value === \"object\" && value !== null && !Array.isArray(value);\n}\n\nfunction failed(\n  context: RuntimeOperationContext[\"summary\"],\n  error: OperationError,\n): InvocationRuntimeResolution {\n  return { ok: false, context, error };\n}\n\nfunction unresolvedSummary(target: InvocationTarget): RuntimeOperationContext[\"summary\"] {\n  return {\n    profile: target.profile ?? \"unresolved\",\n    host: target.host ?? \"unresolved\",\n    posture: \"unauthenticated\",\n  };\n}\n","import { createHash } from \"node:crypto\";\nimport { isAbsolute } from \"node:path\";\n\nimport {\n  makePkhSpaceId,\n  parsePkhDid,\n  parseSpaceUri,\n  type PermissionEntry,\n} from \"@tinycloud/node-sdk\";\nimport { jcsCanonicalize } from \"@tinycloud/sdk-core/policy\";\nimport type { ZodError } from \"zod\";\n\nimport {\n  type ApprovalAction,\n  type CapabilityRequirement,\n  type InvocationTarget,\n  type OperationContextSummary,\n  type OperationDefinition,\n  type OperationRef,\n  type OperationResult,\n  type OperationRuntimeRequirement,\n  type RuntimeOperationContext,\n} from \"./contract.js\";\nimport {\n  internalOperationError,\n  operationError,\n  sanitizeOperationError,\n  sanitizeThrownOperationError,\n} from \"./errors.js\";\nimport {\n  canonicalizeOperationCapabilities,\n  evaluateOperationAuthority,\n  isExactCapabilityMemberSubset,\n  validateExactCapabilities,\n} from \"./authority.js\";\nimport {\n  createOrReusePermissionRequest,\n  buildPermissionRequestArtifact,\n  type PermissionRequestArtifact,\n} from \"./artifacts.js\";\nimport { redactOperationError } from \"./redaction.js\";\nimport { safeOriginHost } from \"./safe-values.js\";\nimport { withTinyCloudStateRoot } from \"./state.js\";\nimport type { InvocationRuntimeResolution } from \"./runtime.js\";\nimport {\n  operationSpaceResolver,\n  resolveSecretReferenceForOperation,\n} from \"./secrets.js\";\n\n/** The sole projection-facing execution API. */\nexport async function invokeOperation(\n  operationId: string,\n  operationVersion: number,\n  invocationTarget: InvocationTarget,\n  unknownInput: unknown,\n): Promise<OperationResult<unknown>> {\n  const target = normalizeInvocationTarget(invocationTarget);\n  if (target === undefined) {\n    return errorResult(\n      { operationId, operationVersion },\n      unresolvedContextSummary(),\n      operationError(\"INPUT_INVALID\", \"The invocation target is invalid.\"),\n    );\n  }\n  return withTinyCloudStateRoot(target.stateRoot, async () => {\n    const prepared = await prepareInvocation(\n      operationId,\n      operationVersion,\n      target,\n      unknownInput,\n    );\n    if (isPreparedError(prepared)) return prepared.result;\n    return executePreparedInvocation(prepared);\n  });\n}\n\n/**\n * CLI-only local-owner acquisition path. The runtime is deliberately created\n * and retained inside operations so a grant is installed on the exact session\n * that performs the one retry. The explicit key remains a non-persisted target\n * value and no runtime object crosses the operations boundary.\n */\nexport async function invokeOperationWithLocalAuthorityRetry(\n  operationId: string,\n  operationVersion: number,\n  invocationTarget: InvocationTarget,\n  unknownInput: unknown,\n): Promise<OperationResult<unknown>> {\n  const target = normalizeInvocationTarget(invocationTarget);\n  if (target === undefined) {\n    return errorResult(\n      { operationId, operationVersion },\n      unresolvedContextSummary(),\n      operationError(\"INPUT_INVALID\", \"The invocation target is invalid.\"),\n    );\n  }\n  if (typeof target.privateKey !== \"string\" || target.privateKey.length === 0) {\n    return errorResult(\n      { operationId, operationVersion },\n      unresolvedContextSummary(target),\n      operationError(\n        \"PROFILE_POSTURE_NOT_ALLOWED\",\n        \"Local authority retry requires an explicit private key.\",\n      ),\n    );\n  }\n\n  return withTinyCloudStateRoot(target.stateRoot, () =>\n    invokeLocalAuthorityRetry(\n      operationId,\n      operationVersion,\n      target,\n      unknownInput,\n    )\n  );\n}\n\nasync function invokeLocalAuthorityRetry(\n  operationId: string,\n  operationVersion: number,\n  target: InvocationTarget,\n  unknownInput: unknown,\n): Promise<OperationResult<unknown>> {\n  const prepared = await prepareInvocation(\n    operationId,\n    operationVersion,\n    target,\n    unknownInput,\n  );\n  if (isPreparedError(prepared)) return prepared.result;\n\n  if (\n    prepared.operation.operationId !== \"tinycloud.secrets.get\" ||\n    prepared.operation.operationVersion !== 1\n  ) {\n    return errorResult(\n      prepared.operation,\n      prepared.runtimeResolution.context.summary,\n      operationError(\n        \"OPERATION_NOT_FOUND\",\n        \"The local CLI authority helper supports only tinycloud.secrets.get@1.\",\n      ),\n    );\n  }\n\n  const runtimeContext = prepared.runtimeResolution.context;\n  if (runtimeContext.runtime === undefined) return internalOperationErrorResult(prepared);\n  const operationContext = runtimeContext as RuntimeOperationContext;\n  let planned: CapabilityRequirement[] | undefined;\n  try {\n    planned = exactCapabilities(await prepared.definition.authority(\n      operationContext,\n      prepared.parsedInput.data,\n    ));\n  } catch {\n    return errorResult(\n      prepared.operation,\n      operationContext.summary,\n      operationError(\n        \"PERMISSION_HINT_INVALID\",\n        \"The local CLI authority plan is invalid.\",\n      ),\n    );\n  }\n  const planStatus = planned === undefined\n    ? \"invalid\"\n    : isExactLocalSecretsGetPlan(prepared, planned, operationContext);\n  if (planStatus === \"ineligible\") {\n    return errorResult(\n      prepared.operation,\n      operationContext.summary,\n      operationError(\n        \"PROFILE_POSTURE_NOT_ALLOWED\",\n        \"The explicit private key cannot authorize the requested owner space.\",\n      ),\n    );\n  }\n  if (planStatus !== \"valid\") {\n    return errorResult(\n      prepared.operation,\n      operationContext.summary,\n      operationError(\n        \"PERMISSION_HINT_INVALID\",\n        \"The local CLI authority plan is invalid.\",\n      ),\n    );\n  }\n\n  const first = await executePreparedInvocation(prepared, { deferAuthorityRequest: true });\n  if (first.status !== \"authority_required\") {\n    return first;\n  }\n  if (\n    operationContext.summary.posture !== \"local-owner-key\" ||\n    !requirementsBelongToAuthenticatedOwner(\n      first.missing as unknown as PermissionEntry[],\n      operationContext.summary.space,\n    )\n  ) {\n    return localAuthorityFailure(prepared);\n  }\n\n  try {\n    const grantRuntimePermissions = (operationContext.runtime.node as {\n      grantRuntimePermissions?: (\n        permissions: PermissionEntry[],\n      ) => Promise<unknown>;\n    }).grantRuntimePermissions;\n    if (typeof grantRuntimePermissions !== \"function\") {\n      return localAuthorityFailure(prepared);\n    }\n    await grantRuntimePermissions.call(\n      operationContext.runtime.node,\n      first.missing as unknown as PermissionEntry[],\n    );\n\n    const resolveSpace = operationSpaceResolver(\n      operationContext.runtime.node,\n      operationContext.summary.space,\n    );\n    const refreshedGranted = refreshLiveRuntimeAuthority(\n      operationContext.runtime.node,\n      first.missing as unknown as PermissionEntry[],\n      planned as unknown as PermissionEntry[],\n      resolveSpace,\n    );\n    if (refreshedGranted === undefined) {\n      return localAuthorityFailure(prepared);\n    }\n    const retryContext: RuntimeOperationContext = {\n      ...operationContext,\n      runtime: {\n        ...operationContext.runtime,\n        granted: refreshedGranted,\n      },\n    };\n    const retry = await executePreparedInvocation({\n      ...prepared,\n      runtimeResolution: { ok: true, context: retryContext },\n    }, { deferAuthorityRequest: true });\n    return retry.status === \"authority_required\"\n      ? localAuthorityFailure(prepared)\n      : retry;\n  } catch {\n    return localAuthorityFailure(prepared);\n  }\n}\n\ntype PreparedInvocation = Readonly<{\n  operation: OperationRef;\n  definition: OperationDefinition<any, any>;\n  parsedInput: { data: any };\n  runtimeResolution: Extract<InvocationRuntimeResolution, { ok: true }>;\n}> | Readonly<{\n  status: \"error\";\n  result: OperationResult<never>;\n}>;\n\nfunction isPreparedError(\n  prepared: PreparedInvocation,\n): prepared is Extract<PreparedInvocation, { status: \"error\" }> {\n  return \"status\" in prepared;\n}\n\nasync function prepareInvocation(\n  operationId: string,\n  operationVersion: number,\n  invocationTarget: InvocationTarget,\n  unknownInput: unknown,\n): Promise<PreparedInvocation> {\n  const operation: OperationRef = { operationId, operationVersion };\n  const target = normalizeInvocationTarget(invocationTarget);\n  if (target === undefined) {\n    return { status: \"error\", result: errorResult(\n      operation,\n      unresolvedContextSummary(),\n      operationError(\"INPUT_INVALID\", \"The invocation target is invalid.\"),\n    ) };\n  }\n  // Load internal registry material only when invoking. This keeps the packed\n  // root entrypoint free of auth/runtime SDK initialization until a call is\n  // made, while preserving registry resolution before input or profile access.\n  const { lookupOperation } = await import(\"./registry.js\");\n  const lookup = lookupOperation(operationId, operationVersion);\n\n  // Registry resolution is deliberately complete before any input parsing or\n  // profile access. An unrecognized operation must not cause an invocation to\n  // consult profile state.\n  if (lookup.status === \"operation_not_found\") {\n    return { status: \"error\", result: errorResult(\n      operation,\n      unresolvedContextSummary(target),\n      operationError(\n        \"OPERATION_NOT_FOUND\",\n        \"The requested operation is not registered.\",\n      ),\n    ) };\n  }\n  if (lookup.status === \"operation_version_unsupported\") {\n    return { status: \"error\", result: errorResult(\n      operation,\n      unresolvedContextSummary(target),\n      operationError(\n        \"OPERATION_VERSION_UNSUPPORTED\",\n        \"The requested operation version is not supported.\",\n        { details: { supportedVersions: lookup.supportedVersions } },\n      ),\n    ) };\n  }\n\n  const definition = lookup.definition;\n  const parsedInput = definition.input.safeParse(unknownInput);\n  if (!parsedInput.success) {\n    return { status: \"error\", result: errorResult(\n      operation,\n      unresolvedContextSummary(target),\n      operationError(\n        definition.invalidInputErrorCode ?? \"INPUT_INVALID\",\n        \"The operation input is invalid.\",\n        {\n          details: zodIssueDetails(parsedInput.error),\n        },\n      ),\n    ) };\n  }\n\n  // Only a registered operation with valid input may inspect the pinned\n  // profile. Inspection is deliberately node-free, so owner opt-in and status\n  // availability are decided before any authentication or external effect.\n  const inspectionResolution = await resolveRuntime(target, \"inspection\");\n  if (!inspectionResolution.ok) {\n    return { status: \"error\", result: errorResult(\n      operation,\n      inspectionResolution.context,\n      inspectionResolution.error,\n    ) };\n  }\n\n  if (\n    target.privateKey === undefined &&\n    !definition.postures.includes(inspectionResolution.context.summary.posture)\n  ) {\n    return { status: \"error\", result: errorResult(\n      operation,\n      inspectionResolution.context.summary,\n      operationError(\n        \"PROFILE_POSTURE_NOT_ALLOWED\",\n        \"The active profile posture cannot execute this operation.\",\n      ),\n    ) };\n  }\n  if (\n    target.privateKey === undefined &&\n    definition.runtime === \"authenticated\" &&\n    isOwnerPosture(inspectionResolution.context.summary.posture) &&\n    target.allowOwnerProfile !== true\n  ) {\n    return { status: \"error\", result: errorResult(\n      operation,\n      inspectionResolution.context.summary,\n      operationError(\n        \"PROFILE_OWNER_OPT_IN_REQUIRED\",\n        \"Owner-profile execution requires explicit opt-in.\",\n      ),\n    ) };\n  }\n\n  const runtimeResolution =\n    definition.runtime === \"inspection\"\n      ? inspectionResolution\n      : await resolveRuntime(target, \"authenticated\");\n  if (!runtimeResolution.ok) {\n    return { status: \"error\", result: errorResult(\n      operation,\n      runtimeResolution.context,\n      runtimeResolution.error,\n    ) };\n  }\n  if (definition.runtime === \"authenticated\") {\n    const actualPosture = runtimeResolution.context.summary.posture;\n    if (!definition.postures.includes(actualPosture)) {\n      return { status: \"error\", result: errorResult(\n        operation,\n        runtimeResolution.context.summary,\n        operationError(\n          \"PROFILE_POSTURE_NOT_ALLOWED\",\n          \"The authenticated profile posture cannot execute this operation.\",\n        ),\n      ) };\n    }\n    if (isOwnerPosture(actualPosture) && target.allowOwnerProfile !== true) {\n      return { status: \"error\", result: errorResult(\n        operation,\n        runtimeResolution.context.summary,\n        operationError(\n          \"PROFILE_OWNER_OPT_IN_REQUIRED\",\n          \"Owner-profile execution requires explicit opt-in.\",\n        ),\n      ) };\n    }\n  }\n  return {\n    operation,\n    definition,\n    parsedInput,\n    runtimeResolution,\n  };\n}\n\nasync function executePreparedInvocation(\n  prepared: Exclude<PreparedInvocation, { status: \"error\" }>,\n  options: Readonly<{ deferAuthorityRequest?: boolean }> = {},\n): Promise<OperationResult<unknown>> {\n  const { operation, definition, parsedInput, runtimeResolution } = prepared;\n  const runtimeContext =\n    runtimeResolution.context.runtime === undefined\n      ? undefined\n      : (runtimeResolution.context as RuntimeOperationContext);\n  const resolveSpace = runtimeContext === undefined\n    ? undefined\n    : operationSpaceResolver(\n      runtimeContext.runtime.node,\n      runtimeContext.summary.space,\n    );\n\n  try {\n    const planned = await definition.authority(\n      (runtimeContext ?? runtimeResolution.context) as RuntimeOperationContext,\n      parsedInput.data,\n    );\n    const required = exactCapabilities(planned);\n    if (required === undefined) {\n      return errorResult(\n        operation,\n        runtimeResolution.context.summary,\n        operationError(\n          \"PERMISSION_HINT_INVALID\",\n          \"The operation returned an invalid permission requirement.\",\n        ),\n      );\n    }\n\n    const evaluation = evaluateOperationAuthority(\n      (runtimeContext?.runtime.granted ?? []) as unknown as PermissionEntry[],\n      required as unknown as PermissionEntry[],\n      resolveSpace,\n    );\n    if (!evaluation.satisfied) {\n      if (runtimeContext === undefined) {\n        return errorResult(\n          operation,\n          runtimeResolution.context.summary,\n          internalOperationError(),\n        );\n      }\n      if (options.deferAuthorityRequest) {\n        try {\n          const request = buildPermissionRequestArtifact({\n            profile: runtimeContext.summary.profile,\n            host: runtimeContext.summary.host,\n            sessionDid: runtimeContext.summary.sessionDid!,\n            posture: runtimeContext.summary.posture,\n            operatorType: runtimeContext.summary.operatorType ?? \"human\",\n            ...(runtimeContext.summary.ownerDid === undefined\n              ? {}\n              : { ownerDid: runtimeContext.summary.ownerDid }),\n            ...(runtimeContext.summary.space === undefined\n              ? {}\n              : { spaceId: runtimeContext.summary.space }),\n            missing: evaluation.missing as unknown as PermissionEntry[],\n          });\n          return authorityRequiredResult(\n            operation,\n            runtimeResolution.context.summary,\n            parsedInput.data,\n            request,\n            evaluation.missing,\n            runtimeContext.runtime.node,\n          );\n        } catch {\n          return errorResult(\n            operation,\n            runtimeResolution.context.summary,\n            internalOperationError(),\n          );\n        }\n      }\n      const authority = await persistAuthorityRequest(\n        runtimeContext,\n        evaluation.missing,\n      );\n      if (authority.status === \"error\") {\n        return errorResult(\n          operation,\n          runtimeResolution.context.summary,\n          authority.error,\n        );\n      }\n      return authorityRequiredResult(\n        operation,\n        runtimeResolution.context.summary,\n        parsedInput.data,\n        authority.request,\n        authority.missing,\n        runtimeContext.runtime.node,\n      );\n    }\n\n    const outcome = await definition.execute(\n      runtimeResolution.context,\n      parsedInput.data,\n    );\n\n    switch (outcome.status) {\n      case \"ok\": {\n        const parsedOutput = definition.output.safeParse(outcome.output);\n        if (!parsedOutput.success) {\n          return errorResult(\n            operation,\n            runtimeResolution.context.summary,\n            operationError(\n              \"OUTPUT_INVALID\",\n              \"The operation returned an invalid result.\",\n            ),\n          );\n        }\n        return {\n          status: \"ok\",\n          operation,\n          context: runtimeResolution.context.summary,\n          output: parsedOutput.data,\n        };\n      }\n      case \"authority_required\": {\n        const hinted = exactCapabilities(outcome.missing);\n        if (\n          hinted === undefined ||\n          !isExactCapabilityMemberSubset(\n            hinted as unknown as PermissionEntry[],\n            required as unknown as PermissionEntry[],\n            resolveSpace,\n          )\n        ) {\n          return errorResult(\n            operation,\n            runtimeResolution.context.summary,\n            operationError(\n              \"PERMISSION_HINT_INVALID\",\n              \"The node returned an invalid permission hint.\",\n            ),\n          );\n        }\n        if (runtimeContext === undefined) {\n          return errorResult(\n            operation,\n            runtimeResolution.context.summary,\n            internalOperationError(),\n          );\n        }\n        if (options.deferAuthorityRequest) {\n          try {\n            const request = buildPermissionRequestArtifact({\n              profile: runtimeContext.summary.profile,\n              host: runtimeContext.summary.host,\n              sessionDid: runtimeContext.summary.sessionDid!,\n              posture: runtimeContext.summary.posture,\n              operatorType: runtimeContext.summary.operatorType ?? \"human\",\n              ...(runtimeContext.summary.ownerDid === undefined\n                ? {}\n                : { ownerDid: runtimeContext.summary.ownerDid }),\n              ...(runtimeContext.summary.space === undefined\n                ? {}\n                : { spaceId: runtimeContext.summary.space }),\n              missing: hinted as unknown as PermissionEntry[],\n            });\n            return authorityRequiredResult(\n              operation,\n              runtimeResolution.context.summary,\n              parsedInput.data,\n              request,\n              hinted,\n              runtimeContext.runtime.node,\n              outcome.requiresCallerInput ?? false,\n            );\n          } catch {\n            return errorResult(\n              operation,\n              runtimeResolution.context.summary,\n              internalOperationError(),\n            );\n          }\n        }\n        const authority = await persistAuthorityRequest(\n          runtimeContext,\n          hinted,\n          true,\n        );\n        if (authority.status === \"error\") {\n          return errorResult(\n            operation,\n            runtimeResolution.context.summary,\n            authority.error,\n          );\n        }\n        return authorityRequiredResult(\n          operation,\n          runtimeResolution.context.summary,\n          parsedInput.data,\n          authority.request,\n          authority.missing,\n          runtimeContext.runtime.node,\n          outcome.requiresCallerInput ?? false,\n        );\n      }\n      case \"setup_required\":\n        return {\n          status: \"setup_required\",\n          operation,\n          context: runtimeResolution.context.summary,\n          setup: outcome.setup,\n          retry: retryDescriptor(\n            operation,\n            parsedInput.data,\n            outcome.requiresCallerInput ?? false,\n          ),\n        };\n      case \"error\":\n        return errorResult(\n          operation,\n          runtimeResolution.context.summary,\n          redactOperationError(\n            definition,\n            sanitizeOperationError(outcome.error),\n          ),\n        );\n      default:\n        return errorResult(\n          operation,\n          runtimeResolution.context.summary,\n          internalOperationError(),\n        );\n    }\n  } catch (error) {\n    return errorResult(\n      operation,\n      runtimeResolution.context.summary,\n      redactOperationError(definition, sanitizeThrownOperationError(error)),\n    );\n  }\n}\n\nfunction normalizeInvocationTarget(\n  target: unknown,\n): InvocationTarget | undefined {\n  if (typeof target !== \"object\" || target === null) return undefined;\n\n  try {\n    const candidate = target as InvocationTarget;\n    const profile = candidate.profile;\n    const host = candidate.host;\n    const stateRoot = candidate.stateRoot;\n    const allowOwnerProfile = candidate.allowOwnerProfile;\n    const privateKey = candidate.privateKey;\n\n    if (\n      (profile !== undefined && typeof profile !== \"string\") ||\n      (host !== undefined && typeof host !== \"string\") ||\n      (stateRoot !== undefined &&\n        (typeof stateRoot !== \"string\" || !isAbsolute(stateRoot))) ||\n      (allowOwnerProfile !== undefined &&\n        typeof allowOwnerProfile !== \"boolean\") ||\n      (privateKey !== undefined && typeof privateKey !== \"string\")\n    ) {\n      return undefined;\n    }\n\n    return {\n      ...(profile === undefined ? {} : { profile }),\n      ...(host === undefined ? {} : { host }),\n      ...(stateRoot === undefined ? {} : { stateRoot }),\n      ...(allowOwnerProfile === true ? { allowOwnerProfile: true } : {}),\n      ...(privateKey === undefined ? {} : { privateKey }),\n    };\n  } catch {\n    return undefined;\n  }\n}\n\nasync function resolveRuntime(\n  target: InvocationTarget,\n  requirement: OperationRuntimeRequirement,\n): Promise<InvocationRuntimeResolution> {\n  try {\n    // Keep the root package loadable for projections that only inspect its\n    // public invocation export. The SDK runtime is needed only once a valid\n    // operation reaches runtime construction.\n    const { createInvocationRuntime } = await import(\"./runtime.js\");\n    return await createInvocationRuntime(target, requirement);\n  } catch (error) {\n    return {\n      ok: false,\n      context: unresolvedContextSummary(target),\n      error: sanitizeThrownOperationError(error),\n    };\n  }\n}\n\nfunction unresolvedContextSummary(\n  target: InvocationTarget = {},\n): OperationContextSummary {\n  return {\n    profile: typeof target.profile === \"string\" ? target.profile : \"unresolved\",\n    host: safeOriginHost(target.host) ?? \"unresolved\",\n    posture: \"unauthenticated\",\n  };\n}\n\nfunction errorResult(\n  operation: OperationRef,\n  context: OperationContextSummary,\n  error: ReturnType<typeof sanitizeOperationError>,\n): OperationResult<never> {\n  return { status: \"error\", operation, context, error };\n}\n\nfunction retryDescriptor(\n  operation: OperationRef,\n  input: unknown,\n  requiresCallerInput: boolean,\n): Readonly<{\n  operationId: string;\n  operationVersion: number;\n  inputDigest: string;\n  requiresCallerInput: boolean;\n}> {\n  return {\n    operationId: operation.operationId,\n    operationVersion: operation.operationVersion,\n    inputDigest: createHash(\"sha256\")\n      .update(jcsCanonicalize(input), \"utf8\")\n      .digest(\"hex\"),\n    requiresCallerInput,\n  };\n}\n\ntype PersistedAuthority =\n  | Readonly<{\n      status: \"ok\";\n      request: PermissionRequestArtifact;\n      missing: readonly CapabilityRequirement[];\n    }>\n  | Readonly<{\n      status: \"error\";\n      error: ReturnType<typeof sanitizeOperationError>;\n    }>;\n\nasync function persistAuthorityRequest(\n  context: RuntimeOperationContext,\n  missing: readonly CapabilityRequirement[],\n  force = false,\n): Promise<PersistedAuthority> {\n  const sessionDid = context.summary.sessionDid;\n  if (sessionDid === undefined) {\n    return {\n      status: \"error\",\n      error: operationError(\n        \"SESSION_NOT_FOUND\",\n        \"The selected profile does not have an active session.\",\n      ),\n    };\n  }\n  try {\n    const resolveSpace = operationSpaceResolver(\n      context.runtime.node,\n      context.summary.space,\n    );\n    const canonicalMissing = canonicalizeOperationCapabilities(missing as unknown as PermissionEntry[], resolveSpace);\n    const canonicalGranted = canonicalizeOperationCapabilities(context.runtime.granted as unknown as PermissionEntry[], resolveSpace);\n    const resolution = await createOrReusePermissionRequest({\n      profile: context.summary.profile,\n      posture: context.summary.posture,\n      operatorType: context.summary.operatorType ?? \"human\",\n      host: context.summary.host,\n      sessionDid,\n      ...(context.summary.ownerDid === undefined\n        ? {}\n        : { ownerDid: context.summary.ownerDid }),\n      ...(context.summary.space === undefined\n        ? {}\n        : { spaceId: context.summary.space }),\n      missing: canonicalMissing as unknown as PermissionEntry[],\n      granted: (force\n        ? []\n        : canonicalGranted) as unknown as PermissionEntry[],\n      resolveSpace,\n    });\n    if (resolution.status !== \"created\") {\n      return {\n        status: \"error\",\n        error: operationError(\n          \"INTERNAL_ERROR\",\n          \"The authority request could not be created.\",\n        ),\n      };\n    }\n    return {\n      status: \"ok\",\n      request: resolution.request,\n      missing: canonicalMissing as CapabilityRequirement[],\n    };\n  } catch {\n    return {\n      status: \"error\",\n      error: operationError(\n        \"INTERNAL_ERROR\",\n        \"The authority request could not be created.\",\n      ),\n    };\n  }\n}\n\nfunction authorityRequiredResult(\n  operation: OperationRef,\n  context: OperationContextSummary,\n  input: unknown,\n  request: PermissionRequestArtifact,\n  missing: readonly CapabilityRequirement[],\n  node: unknown,\n  requiresCallerInput = false,\n): OperationResult<never> {\n  return {\n    status: \"authority_required\",\n    operation,\n    context,\n    missing,\n    request,\n    approval: approvalAction(request, node),\n    retry: retryDescriptor(operation, input, requiresCallerInput),\n  };\n}\n\nfunction approvalAction(\n  request: PermissionRequestArtifact,\n  node: unknown,\n): ApprovalAction {\n  const maybeNode = node as {\n    getOpenKeyApprovalUrl?: (artifact: PermissionRequestArtifact) => unknown;\n  };\n  let url: string | undefined;\n  try {\n    const candidate = maybeNode.getOpenKeyApprovalUrl?.(request);\n    if (typeof candidate === \"string\" && candidate.length > 0) url = candidate;\n  } catch {\n    // The stored request remains the source of truth when a runtime does not\n    // expose a canonical OpenKey URL.\n  }\n  return {\n    kind: \"openkey\",\n    requestId: request.requestId,\n    ...(url === undefined ? {} : { url }),\n    fallback: \"tc auth grant <request-artifact>\",\n  };\n}\n\nfunction exactCapabilities(\n  value: unknown,\n): CapabilityRequirement[] | undefined {\n  return validateExactCapabilities(value) as\n    | CapabilityRequirement[]\n    | undefined;\n}\n\nfunction requirementsBelongToAuthenticatedOwner(\n  requirements: readonly PermissionEntry[],\n  authenticatedSpace: string | undefined,\n): boolean {\n  const authenticatedOwner = canonicalPkhOwner(authenticatedSpace);\n  if (authenticatedOwner === undefined) return false;\n  return requirements.every((requirement) => {\n    if (requirement.service === \"tinycloud.encryption\") {\n      return requirement.space === undefined;\n    }\n    const requirementOwner = canonicalPkhOwner(requirement.space);\n    return requirement.service === \"tinycloud.kv\" && requirementOwner === authenticatedOwner;\n  });\n}\n\nfunction canonicalPkhOwner(space: string | undefined): string | undefined {\n  if (typeof space !== \"string\") return undefined;\n  const parsedSpace = parseSpaceUri(space);\n  if (parsedSpace === null) return undefined;\n  try {\n    const pkh = parsePkhDid(parsedSpace.owner);\n    return pkh === null\n      ? undefined\n      : parseSpaceUri(makePkhSpaceId(pkh.address, pkh.chainId, parsedSpace.name))?.owner;\n  } catch {\n    return undefined;\n  }\n}\n\nfunction isExactLocalSecretsGetPlan(\n  prepared: Exclude<PreparedInvocation, { status: \"error\" }>,\n  planned: readonly CapabilityRequirement[],\n  context: RuntimeOperationContext,\n): \"valid\" | \"ineligible\" | \"invalid\" {\n  if (\n    prepared.definition.id !== \"tinycloud.secrets.get\" ||\n    prepared.definition.version !== 1 ||\n    JSON.stringify(prepared.definition.effects) !== JSON.stringify([\"read\", \"local_write\"])\n  ) return \"invalid\";\n\n  const resolveSpace = operationSpaceResolver(context.runtime.node, context.summary.space);\n  let reference;\n  try {\n    reference = resolveSecretReferenceForOperation(\n      prepared.parsedInput.data,\n      context.runtime.node,\n      context.summary.space,\n    );\n  } catch {\n    return \"invalid\";\n  }\n  const canonicalPlan = canonicalizeOperationCapabilities(\n    planned as unknown as PermissionEntry[],\n    resolveSpace,\n  );\n  if (canonicalPlan.length !== 2) return \"invalid\";\n  const kv = canonicalPlan.find((permission) => permission.service === \"tinycloud.kv\");\n  const decrypt = canonicalPlan.find((permission) => permission.service === \"tinycloud.encryption\");\n  if (kv === undefined || decrypt === undefined) return \"invalid\";\n  const requestedOwner = canonicalPkhOwner(kv.space);\n  const authenticatedOwner = canonicalPkhOwner(context.summary.space);\n  if (requestedOwner === undefined || authenticatedOwner === undefined || requestedOwner !== authenticatedOwner) {\n    return \"ineligible\";\n  }\n  if (JSON.stringify(kv) !== JSON.stringify({\n    service: \"tinycloud.kv\",\n    space: resolveSpace(reference.space),\n    path: reference.permissionPath,\n    actions: [\"tinycloud.kv/get\"],\n  })) return \"invalid\";\n  if (\n    JSON.stringify(decrypt) !== JSON.stringify({\n      service: \"tinycloud.encryption\",\n      path: decrypt.path,\n      actions: [\"tinycloud.encryption/decrypt\"],\n    }) ||\n    typeof decrypt.path !== \"string\" ||\n    !decrypt.path.startsWith(\"urn:tinycloud:encryption:\")\n  ) return \"invalid\";\n  return \"valid\";\n}\n\nfunction refreshLiveRuntimeAuthority(\n  node: unknown,\n  requested: readonly PermissionEntry[],\n  planned: readonly PermissionEntry[],\n  resolveSpace: (space: string) => string,\n): readonly CapabilityRequirement[] | undefined {\n  const candidate = node as {\n    hasRuntimePermissions?: (permissions: PermissionEntry[]) => unknown;\n    getVerifiedSessionCapabilities?: () => unknown;\n    getEffectiveRuntimePermissionEntries?: () => unknown;\n  };\n  if (typeof candidate.hasRuntimePermissions !== \"function\") return undefined;\n  if (candidate.hasRuntimePermissions([...requested]) !== true) return undefined;\n  if (typeof candidate.getVerifiedSessionCapabilities !== \"function\" ||\n      typeof candidate.getEffectiveRuntimePermissionEntries !== \"function\") return undefined;\n\n  const base = candidate.getVerifiedSessionCapabilities();\n  const activated = candidate.getEffectiveRuntimePermissionEntries();\n  if (!Array.isArray(base) || !Array.isArray(activated)) return undefined;\n  const exactActivated = validateExactCapabilities(activated);\n  if (exactActivated === undefined) return undefined;\n  const selectedActivated = exactActivated.filter((permission) =>\n    isExactCapabilityMemberSubset([permission], planned, resolveSpace),\n  );\n  if (!isExactCapabilityMemberSubset(requested, selectedActivated, resolveSpace)) return undefined;\n  const combined = canonicalizeOperationCapabilities(\n    [...base, ...selectedActivated],\n    resolveSpace,\n  );\n  return evaluateOperationAuthority(combined, planned as unknown as PermissionEntry[], resolveSpace).satisfied\n    ? combined\n    : undefined;\n}\n\nfunction localAuthorityFailure(\n  prepared: Exclude<PreparedInvocation, { status: \"error\" }>,\n): OperationResult<never> {\n  return errorResult(\n    prepared.operation,\n    prepared.runtimeResolution.context.summary,\n    operationError(\n      \"NODE_ERROR\",\n      \"The local owner could not acquire the requested secret permissions.\",\n      { retryable: true },\n    ),\n  );\n}\n\nfunction internalOperationErrorResult(\n  prepared: Exclude<PreparedInvocation, { status: \"error\" }>,\n): OperationResult<never> {\n  return errorResult(\n    prepared.operation,\n    prepared.runtimeResolution.context.summary,\n    internalOperationError(),\n  );\n}\n\nfunction isOwnerPosture(posture: OperationContextSummary[\"posture\"]): boolean {\n  return posture === \"owner-openkey\" || posture === \"local-owner-key\";\n}\n\nfunction zodIssueDetails(error: ZodError): Readonly<Record<string, unknown>> {\n  return {\n    // The canonical error channel carries only schema-owned issue codes.\n    // Messages and paths can contain arbitrary input keys and values.\n    issues: error.issues.map((issue) => ({ code: issue.code })),\n  };\n}\n","export type SignedObjectErrorCode =\n  | \"schema-invalid\"\n  | \"canonicalization-mismatch\"\n  | \"digest-mismatch\"\n  | \"id-mismatch\"\n  | \"signing-key-binding\"\n  | \"signature-material-invalid\"\n  | \"signature-suite-unsupported\"\n  | \"signature-invalid\";\n\nexport class SignedObjectProfileError extends Error {\n  public readonly code: SignedObjectErrorCode;\n\n  constructor(code: SignedObjectErrorCode, message: string) {\n    super(message);\n    this.name = \"SignedObjectProfileError\";\n    this.code = code;\n  }\n}\n\nexport class SignedObjectSchemaError extends SignedObjectProfileError {\n  constructor(message: string) {\n    super(\"schema-invalid\", message);\n    this.name = \"SignedObjectSchemaError\";\n  }\n}\n\nexport class SignedObjectCanonicalizationError extends SignedObjectProfileError {\n  constructor(message: string) {\n    super(\"canonicalization-mismatch\", message);\n    this.name = \"SignedObjectCanonicalizationError\";\n  }\n}\n\nexport class SignedObjectDigestError extends SignedObjectProfileError {\n  constructor(message: string) {\n    super(\"digest-mismatch\", message);\n    this.name = \"SignedObjectDigestError\";\n  }\n}\n\nexport class SignedObjectIdError extends SignedObjectProfileError {\n  constructor(message: string) {\n    super(\"id-mismatch\", message);\n    this.name = \"SignedObjectIdError\";\n  }\n}\n\nexport class SigningKeyBindingError extends SignedObjectProfileError {\n  constructor(message: string) {\n    super(\"signing-key-binding\", message);\n    this.name = \"SigningKeyBindingError\";\n  }\n}\n\nexport class SignatureMaterialError extends SignedObjectProfileError {\n  constructor(message: string) {\n    super(\"signature-material-invalid\", message);\n    this.name = \"SignatureMaterialError\";\n  }\n}\n\nexport class UnsupportedSignatureSuiteError extends SignedObjectProfileError {\n  constructor(message: string) {\n    super(\"signature-suite-unsupported\", message);\n    this.name = \"UnsupportedSignatureSuiteError\";\n  }\n}\n\nexport class SignatureVerificationError extends SignedObjectProfileError {\n  constructor(message: string) {\n    super(\"signature-invalid\", message);\n    this.name = \"SignatureVerificationError\";\n  }\n}\n\nexport function toSignedObjectError(error: unknown): SignedObjectProfileError {\n  if (error instanceof SignedObjectProfileError) {\n    return error;\n  }\n  return new SignedObjectProfileError(\n    \"schema-invalid\",\n    error instanceof Error ? error.message : String(error),\n  );\n}\n","import { SignedObjectCanonicalizationError } from \"./errors\";\n\nexport type JsonValue =\n  | null\n  | boolean\n  | number\n  | string\n  | JsonValue[]\n  | { readonly [key: string]: JsonValue };\n\ntype MutableJsonObject = { [key: string]: JsonValue };\nconst objectHasOwn: (object: object, propertyKey: PropertyKey) => boolean =\n  (Object as ObjectConstructor & {\n    hasOwn?: (object: object, propertyKey: PropertyKey) => boolean;\n  }).hasOwn ??\n  (Object.prototype.hasOwnProperty.call.bind(\n    Object.prototype.hasOwnProperty,\n  ) as (object: object, propertyKey: PropertyKey) => boolean);\n\n/**\n * RFC 8785 JSON Canonicalization Scheme encoder for the signed-object profile.\n *\n * This local encoder is intentionally stricter than JSON.stringify:\n * it rejects non-plain JSON inputs, sparse arrays, undefined/functions/symbols,\n * non-finite numbers, BigInt, dangerous prototype keys, and lone surrogates.\n * Object keys are sorted lexicographically by their raw UTF-16 code units,\n * as required by RFC 8785 section 3.2.3, before serialization.\n */\nexport function jcsCanonicalize(input: unknown): string {\n  return serialize(normalizeJson(input, \"$\"));\n}\n\nexport function normalizeJson(input: unknown, path = \"$\"): JsonValue {\n  if (input === null) {\n    return null;\n  }\n\n  switch (typeof input) {\n    case \"boolean\":\n      return input;\n    case \"number\":\n      if (!Number.isFinite(input)) {\n        throw new SignedObjectCanonicalizationError(\n          `${path} must be a finite JSON number`,\n        );\n      }\n      return input;\n    case \"string\":\n      assertUnicodeScalarString(input, path);\n      return input;\n    case \"object\":\n      return normalizeJsonObjectOrArray(input, path);\n    case \"bigint\":\n    case \"function\":\n    case \"symbol\":\n    case \"undefined\":\n    default:\n      throw new SignedObjectCanonicalizationError(\n        `${path} is not a JSON value`,\n      );\n  }\n}\n\nexport function serialize(value: JsonValue): string {\n  if (value === null) {\n    return \"null\";\n  }\n\n  switch (typeof value) {\n    case \"boolean\":\n      return value ? \"true\" : \"false\";\n    case \"number\": {\n      const encoded = JSON.stringify(value);\n      if (encoded === undefined) {\n        throw new SignedObjectCanonicalizationError(\n          \"number could not be serialized as JSON\",\n        );\n      }\n      return encoded;\n    }\n    case \"string\":\n      return JSON.stringify(value);\n    case \"object\":\n      if (Array.isArray(value)) {\n        return `[${value.map((item) => serialize(item)).join(\",\")}]`;\n      }\n      return serializeObject(value);\n    default:\n      throw new SignedObjectCanonicalizationError(\n        `unsupported JSON value type ${typeof value}`,\n      );\n  }\n}\n\nfunction normalizeJsonObjectOrArray(input: object, path: string): JsonValue {\n  assertNoSymbolKeys(input, path);\n\n  if (Array.isArray(input)) {\n    for (const key of Object.getOwnPropertyNames(input)) {\n      if (key === \"length\") {\n        continue;\n      }\n      if (!isArrayIndexKey(key, input.length)) {\n        throw new SignedObjectCanonicalizationError(\n          `${path}.${key} is not allowed on a JSON array`,\n        );\n      }\n      const descriptor = Object.getOwnPropertyDescriptor(input, key);\n      if (descriptor?.enumerable !== true) {\n        throw new SignedObjectCanonicalizationError(\n          `${path}[${key}] must be an enumerable JSON array item`,\n        );\n      }\n      if (!(\"value\" in descriptor)) {\n        throw new SignedObjectCanonicalizationError(\n          `${path}[${key}] must be a JSON data property`,\n        );\n      }\n    }\n    const output: JsonValue[] = [];\n    for (let index = 0; index < input.length; index++) {\n      if (!objectHasOwn(input, index)) {\n        throw new SignedObjectCanonicalizationError(\n          `${path}[${index}] must not be a sparse array hole`,\n        );\n      }\n      output.push(normalizeJson(input[index], `${path}[${index}]`));\n    }\n    return output;\n  }\n\n  const proto = Object.getPrototypeOf(input);\n  if (proto !== Object.prototype && proto !== null) {\n    throw new SignedObjectCanonicalizationError(\n      `${path} must be a plain JSON object`,\n    );\n  }\n\n  const output = Object.create(null) as MutableJsonObject;\n  for (const key of Object.getOwnPropertyNames(input)) {\n    assertUnicodeScalarString(key, `${path} key`);\n    if (key === \"__proto__\" || key === \"constructor\") {\n      throw new SignedObjectCanonicalizationError(\n        `${path}.${key} is not allowed`,\n      );\n    }\n    const descriptor = Object.getOwnPropertyDescriptor(input, key);\n    if (descriptor?.enumerable !== true) {\n      throw new SignedObjectCanonicalizationError(\n        `${path}.${key} must be an enumerable JSON object property`,\n      );\n    }\n    if (!(\"value\" in descriptor)) {\n      throw new SignedObjectCanonicalizationError(\n        `${path}.${key} must be a JSON data property`,\n      );\n    }\n    const value = descriptor.value;\n    output[key] = normalizeJson(value, `${path}.${key}`);\n  }\n  return output;\n}\n\nfunction assertNoSymbolKeys(input: object, path: string): void {\n  if (Object.getOwnPropertySymbols(input).length > 0) {\n    throw new SignedObjectCanonicalizationError(\n      `${path} must not have symbol properties`,\n    );\n  }\n}\n\nfunction isArrayIndexKey(key: string, length: number): boolean {\n  if (!/^(0|[1-9]\\d*)$/.test(key)) {\n    return false;\n  }\n  const index = Number(key);\n  return Number.isSafeInteger(index) && index >= 0 && index < length;\n}\n\nfunction serializeObject(value: { readonly [key: string]: JsonValue }): string {\n  const keys = Object.keys(value).sort(compareUtf16CodeUnits);\n  const parts = keys.map((key) => `${JSON.stringify(key)}:${serialize(value[key])}`);\n  return `{${parts.join(\",\")}}`;\n}\n\nfunction compareUtf16CodeUnits(a: string, b: string): number {\n  const max = Math.min(a.length, b.length);\n  for (let index = 0; index < max; index++) {\n    const leftCodeUnit = a.charCodeAt(index);\n    const rightCodeUnit = b.charCodeAt(index);\n    if (leftCodeUnit !== rightCodeUnit) {\n      return leftCodeUnit - rightCodeUnit;\n    }\n  }\n  return a.length - b.length;\n}\n\nfunction assertUnicodeScalarString(value: string, path: string): void {\n  for (let index = 0; index < value.length; index++) {\n    const code = value.charCodeAt(index);\n    if (code >= 0xd800 && code <= 0xdbff) {\n      const next = value.charCodeAt(index + 1);\n      if (Number.isNaN(next) || next < 0xdc00 || next > 0xdfff) {\n        throw new SignedObjectCanonicalizationError(\n          `${path} contains a lone high surrogate`,\n        );\n      }\n      index++;\n      continue;\n    }\n    if (code >= 0xdc00 && code <= 0xdfff) {\n      throw new SignedObjectCanonicalizationError(\n        `${path} contains a lone low surrogate`,\n      );\n    }\n  }\n}\n","/**\n * Values allowed to cross the operation error and context channels.\n *\n * These are intentionally strict. A mismatch detail is useful only when it\n * identifies the same kind of value the runtime actually compares; treating\n * every string as safe would turn the detail field into an exfiltration path.\n */\nexport function safeOriginHost(value: unknown): string | undefined {\n  if (typeof value !== \"string\" || value.length === 0) return undefined;\n\n  let parsed: URL;\n  try {\n    parsed = new URL(value);\n  } catch {\n    return undefined;\n  }\n\n  if (\n    (parsed.protocol !== \"http:\" && parsed.protocol !== \"https:\") ||\n    parsed.username !== \"\" ||\n    parsed.password !== \"\" ||\n    parsed.search !== \"\" ||\n    parsed.hash !== \"\" ||\n    (parsed.pathname !== \"\" && parsed.pathname !== \"/\") ||\n    parsed.origin === \"null\"\n  ) {\n    return undefined;\n  }\n\n  const originWithOptionalSlash = `${parsed.origin}/`;\n  if (value !== parsed.origin && value !== originWithOptionalSlash) {\n    return undefined;\n  }\n  return parsed.origin;\n}\n\nexport function safeSessionDid(value: unknown): string | undefined {\n  if (typeof value !== \"string\" || value.length === 0) return undefined;\n\n  const [principal, fragment, ...extra] = value.split(\"#\");\n  if (\n    extra.length > 0 ||\n    (fragment !== undefined && !/^[A-Za-z0-9._:-]+$/.test(fragment))\n  ) {\n    return undefined;\n  }\n\n  if (isEd25519DidKey(principal) || isEip155PkhDid(principal)) {\n    return principal;\n  }\n  return undefined;\n}\n\nfunction isEd25519DidKey(value: string): boolean {\n  if (!value.startsWith(\"did:key:z\")) return false;\n  const bytes = decodeBase58(value.slice(\"did:key:z\".length));\n  return (\n    bytes !== undefined &&\n    bytes.length === 34 &&\n    bytes[0] === 0xed &&\n    bytes[1] === 0x01\n  );\n}\n\nfunction isEip155PkhDid(value: string): boolean {\n  return /^did:pkh:eip155:[1-9][0-9]*:0x[0-9a-fA-F]{40}$/.test(value);\n}\n\nfunction decodeBase58(value: string): Uint8Array | undefined {\n  if (value.length === 0) return undefined;\n  const alphabet = \"123456789ABCDEFGHJKLMNPQRSTUVWXYZabcdefghijkmnopqrstuvwxyz\";\n  const digits = [0];\n  for (const character of value) {\n    const index = alphabet.indexOf(character);\n    if (index < 0) return undefined;\n    let carry = index;\n    for (let i = 0; i < digits.length; i += 1) {\n      carry += digits[i]! * 58;\n      digits[i] = carry & 0xff;\n      carry >>= 8;\n    }\n    while (carry > 0) {\n      digits.push(carry & 0xff);\n      carry >>= 8;\n    }\n  }\n  for (const character of value) {\n    if (character !== \"1\") break;\n    digits.push(0);\n  }\n  return Uint8Array.from(digits.reverse());\n}\n","import type {\n  OperationContextSummary,\n  OperationDefinition,\n  OperationRef,\n} from \"./contract.js\";\nimport type { OperationError, OperationErrorCode } from \"./errors.js\";\nimport { safeOriginHost, safeSessionDid } from \"./safe-values.js\";\n\nexport const REDACTED_VALUE = \"[REDACTED]\";\n\nexport interface SafeOperationDiagnostic {\n  readonly operation: OperationRef;\n  readonly context: OperationContextSummary;\n  readonly input?: unknown;\n  readonly output?: unknown;\n  readonly error?: OperationError;\n}\n\n/**\n * Return a detached redacted value. A missing pointer is intentionally a no-op\n * so an operation can evolve an optional shape without leaking another field.\n */\nexport function redactOperationValue(\n  definition: Pick<OperationDefinition<unknown, unknown>, \"sensitivity\">,\n  value: unknown,\n): unknown {\n  const clone = cloneValue(value);\n  const pointers = [\n    ...definition.sensitivity.input,\n    ...definition.sensitivity.output,\n  ];\n\n  let redacted: unknown = clone;\n  for (const pointer of pointers) {\n    redacted = redactPointer(redacted, pointer);\n  }\n  return redacted;\n}\n\n/**\n * Diagnostic payloads are a supported non-result channel. They accept raw\n * operation values only through this helper, never an invocation target.\n */\nexport function createSafeOperationDiagnostic(\n  definition: Pick<OperationDefinition<unknown, unknown>, \"sensitivity\">,\n  diagnostic: Readonly<{\n    operation: OperationRef;\n    context: OperationContextSummary;\n    input?: unknown;\n    output?: unknown;\n    error?: OperationError;\n  }>,\n): SafeOperationDiagnostic {\n  return {\n    operation: {\n      operationId: diagnostic.operation.operationId,\n      operationVersion: diagnostic.operation.operationVersion,\n    },\n    context: {\n      profile: diagnostic.context.profile,\n      host: diagnostic.context.host,\n      posture: diagnostic.context.posture,\n      ...(diagnostic.context.operatorType === undefined\n        ? {}\n        : { operatorType: diagnostic.context.operatorType }),\n      ...(diagnostic.context.principalDid === undefined\n        ? {}\n        : { principalDid: diagnostic.context.principalDid }),\n      ...(diagnostic.context.sessionDid === undefined\n        ? {}\n        : { sessionDid: diagnostic.context.sessionDid }),\n      ...(diagnostic.context.ownerDid === undefined\n        ? {}\n        : { ownerDid: diagnostic.context.ownerDid }),\n      ...(diagnostic.context.space === undefined\n        ? {}\n        : { space: diagnostic.context.space }),\n    },\n    ...(diagnostic.input === undefined\n      ? {}\n      : { input: redactOperationValue(definition, diagnostic.input) }),\n    ...(diagnostic.output === undefined\n      ? {}\n      : { output: redactOperationValue(definition, diagnostic.output) }),\n    ...(diagnostic.error === undefined\n      ? {}\n      : { error: redactOperationError(definition, diagnostic.error) }),\n  };\n}\n\nexport function redactOperationError(\n  _definition: Pick<OperationDefinition<unknown, unknown>, \"sensitivity\">,\n  error: OperationError,\n): OperationError {\n  const details =\n    error.details === undefined\n      ? undefined\n      : redactSafeErrorDetails(error.code, error.details);\n\n  return {\n    code: error.code,\n    message: error.message,\n    retryable: error.retryable,\n    ...(details === undefined\n      ? {}\n      : {\n          details: isRecord(details) ? details : { redacted: details },\n        }),\n  };\n}\n\n/**\n * Error details are a separate, code-owned channel. Only fields with an\n * explicit stable policy can cross the canonical result or diagnostic\n * boundary; arbitrary handler details are dropped rather than redacted by\n * input pointers, which could accidentally preserve a transport secret.\n */\nconst SAFE_ERROR_DETAIL_POLICIES: Readonly<\n  Partial<\n    Record<\n      OperationErrorCode,\n      Readonly<Record<string, (value: unknown) => unknown | undefined>>\n    >\n  >\n> = {\n  INPUT_INVALID: {\n    issues: (value) =>\n      Array.isArray(value) ? safeIssueCodes(value) : undefined,\n  },\n  OPERATION_VERSION_UNSUPPORTED: {\n    supportedVersions: (value) =>\n      Array.isArray(value) && value.every((item) => Number.isInteger(item))\n        ? value\n        : undefined,\n  },\n  DELEGATION_AUDIENCE_MISMATCH: {\n    expectedSessionDid: safeSessionDid,\n    artifactAudience: safeSessionDid,\n  },\n  DELEGATION_HOST_MISMATCH: {\n    expectedHost: safeOriginHost,\n    artifactHost: safeOriginHost,\n  },\n};\n\nfunction redactSafeErrorDetails(\n  code: OperationErrorCode,\n  details: Readonly<Record<string, unknown>>,\n): Readonly<Record<string, unknown>> | undefined {\n  const policy = SAFE_ERROR_DETAIL_POLICIES[code];\n  if (policy === undefined) return undefined;\n\n  const safeDetails: Record<string, unknown> = {};\n  for (const [key, sanitize] of Object.entries(policy)) {\n    if (!hasOwn(details, key)) continue;\n    const value = sanitize(details[key]);\n    if (value !== undefined) safeDetails[key] = value;\n  }\n  return Object.keys(safeDetails).length === 0 ? undefined : safeDetails;\n}\n\nfunction safeIssueCodes(\n  value: readonly unknown[],\n): readonly Readonly<{ code: string }>[] | undefined {\n  const codes = value.map((issue) => {\n    if (!isRecord(issue) || typeof issue.code !== \"string\") return undefined;\n    return SAFE_ISSUE_CODES.has(issue.code) ? { code: issue.code } : undefined;\n  });\n  return codes.every(\n    (issue): issue is Readonly<{ code: string }> => issue !== undefined,\n  )\n    ? codes\n    : undefined;\n}\n\nconst SAFE_ISSUE_CODES = new Set([\n  \"invalid_type\",\n  \"invalid_literal\",\n  \"custom\",\n  \"invalid_union\",\n  \"invalid_union_discriminator\",\n  \"invalid_enum_value\",\n  \"unrecognized_keys\",\n  \"invalid_arguments\",\n  \"invalid_return_type\",\n  \"invalid_date\",\n  \"invalid_string\",\n  \"too_small\",\n  \"too_big\",\n  \"invalid_intersection_types\",\n  \"not_multiple_of\",\n  \"not_finite\",\n]);\n\nfunction redactPointer(value: unknown, pointer: string): unknown {\n  if (pointer === \"\") {\n    return REDACTED_VALUE;\n  }\n  if (!pointer.startsWith(\"/\")) {\n    return value;\n  }\n\n  const tokens = pointer.slice(1).split(\"/\").map(unescapePointerToken);\n  const parent = getPointerParent(value, tokens);\n  if (parent === undefined) {\n    return value;\n  }\n\n  const key = tokens[tokens.length - 1];\n  if (key === undefined || !hasOwn(parent, key)) {\n    return value;\n  }\n\n  Reflect.set(parent, key, REDACTED_VALUE);\n  return value;\n}\n\nfunction getPointerParent(\n  value: unknown,\n  tokens: readonly string[],\n): Record<string, unknown> | unknown[] | undefined {\n  if (tokens.length === 0) {\n    return undefined;\n  }\n\n  let cursor = value;\n  for (const token of tokens.slice(0, -1)) {\n    if (!isRecordOrArray(cursor) || !hasOwn(cursor, token)) {\n      return undefined;\n    }\n    cursor = Reflect.get(cursor, token);\n  }\n  return isRecordOrArray(cursor) ? cursor : undefined;\n}\n\nfunction unescapePointerToken(token: string): string {\n  return token.replace(/~1/g, \"/\").replace(/~0/g, \"~\");\n}\n\nfunction cloneValue(value: unknown): unknown {\n  if (value === null || typeof value !== \"object\") {\n    return value;\n  }\n\n  if (Array.isArray(value)) {\n    return value.map((entry) => cloneValue(entry));\n  }\n\n  const clone: Record<string, unknown> = {};\n  for (const key of Object.keys(value)) {\n    Object.defineProperty(clone, key, {\n      configurable: true,\n      enumerable: true,\n      value: cloneValue((value as Record<string, unknown>)[key]),\n      writable: true,\n    });\n  }\n  return clone;\n}\n\nfunction isRecordOrArray(\n  value: unknown,\n): value is Record<string, unknown> | unknown[] {\n  return value !== null && typeof value === \"object\";\n}\n\nfunction hasOwn(value: object, key: string): boolean {\n  return Object.prototype.hasOwnProperty.call(value, key);\n}\n\nfunction isRecord(value: unknown): value is Readonly<Record<string, unknown>> {\n  return value !== null && typeof value === \"object\" && !Array.isArray(value);\n}\n","import type { InvocationTarget, OperationResult } from \"./contract.js\";\nimport { invokeOperationWithLocalAuthorityRetry } from \"./invoke.js\";\n\n/**\n * The only published CLI acquisition helper. Its fixed operation identity is\n * deliberate: adding a future registry operation cannot expand this seam.\n */\nexport function invokeSecretsGetWithLocalAuthorityRetry(\n  invocationTarget: InvocationTarget,\n  unknownInput: unknown,\n): Promise<OperationResult<unknown>> {\n  return invokeOperationWithLocalAuthorityRetry(\n    \"tinycloud.secrets.get\",\n    1,\n    invocationTarget,\n    unknownInput,\n  );\n}\n"],"mappings":";;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;AA0CO,SAAS,eACd,MACA,SACA,UAGK,CAAC,GACU;AAChB,SAAO;AAAA,IACL;AAAA,IACA;AAAA,IACA,WAAW,QAAQ,aAAa;AAAA,IAChC,GAAI,QAAQ,YAAY,SAAY,CAAC,IAAI,EAAE,SAAS,QAAQ,QAAQ;AAAA,EACtE;AACF;AAgBO,SAAS,qBAAqB,OAA6C;AAChF,SAAO,OAAO,UAAU,YAAY,sBAAsB,SAAS,KAA2B;AAChG;AAEO,SAAS,yBAAyC;AACvD,SAAO;AAAA,IACL;AAAA,IACA;AAAA,EACF;AACF;AAEO,SAAS,6BAA6B,OAAgC;AAC3E,MAAI,iBAAiB,0BAA0B;AAC7C,WAAO,uBAAuB,MAAM,cAAc;AAAA,EACpD;AAEA,SAAO,uBAAuB;AAChC;AAEO,SAAS,uBAAuB,OAAgC;AACrE,MACE,OAAO,UAAU,YACjB,UAAU,QACV,CAAC,qBAAsB,MAA6B,IAAI,KACxD,OAAQ,MAAgC,YAAY,YACpD,OAAQ,MAAkC,cAAc,WACxD;AACA,WAAO,uBAAuB;AAAA,EAChC;AAEA,QAAM,YAAY;AAClB,SAAO,eAAe,UAAU,MAAM,UAAU,SAAS;AAAA,IACvD,WAAW,UAAU;AAAA,IACrB,GAAI,UAAU,YAAY,SAAY,CAAC,IAAI,EAAE,SAAS,UAAU,QAAQ;AAAA,EAC1E,CAAC;AACH;AA3GA,IAAa,uBA8DA;AA9Db;AAAA;AAAA;AAAO,IAAM,wBAAwB;AAAA,MACnC;AAAA,MACA;AAAA,MACA;AAAA,MACA;AAAA,MACA;AAAA,MACA;AAAA,MACA;AAAA,MACA;AAAA,MACA;AAAA,MACA;AAAA,MACA;AAAA,MACA;AAAA,MACA;AAAA,MACA;AAAA,MACA;AAAA,MACA;AAAA,MACA;AAAA,MACA;AAAA,MACA;AAAA,MACA;AAAA,MACA;AAAA,MACA;AAAA,MACA;AAAA,MACA;AAAA,MACA;AAAA,MACA;AAAA,MACA;AAAA,MACA;AAAA,MACA;AAAA,MACA;AAAA,IACF;AA+BO,IAAM,2BAAN,cAAuC,MAAM;AAAA,MAGlD,YAAYA,iBAAgC;AAC1C,cAAMA,gBAAe,OAAO;AAC5B,aAAK,OAAO;AACZ,aAAK,iBAAiBA;AAAA,MACxB;AAAA,IACF;AAAA;AAAA;;;ACtEA;AAAA;AAAA;AAIA,QAAI,IAAI;AACR,QAAI,IAAI,IAAI;AACZ,QAAI,IAAI,IAAI;AACZ,QAAI,IAAI,IAAI;AACZ,QAAI,IAAI,IAAI;AACZ,QAAI,IAAI,IAAI;AAgBZ,WAAO,UAAU,SAAU,KAAK,SAAS;AACvC,gBAAU,WAAW,CAAC;AACtB,UAAI,OAAO,OAAO;AAClB,UAAI,SAAS,YAAY,IAAI,SAAS,GAAG;AACvC,eAAO,MAAM,GAAG;AAAA,MAClB,WAAW,SAAS,YAAY,SAAS,GAAG,GAAG;AAC7C,eAAO,QAAQ,OAAO,QAAQ,GAAG,IAAI,SAAS,GAAG;AAAA,MACnD;AACA,YAAM,IAAI;AAAA,QACR,0DACE,KAAK,UAAU,GAAG;AAAA,MACtB;AAAA,IACF;AAUA,aAAS,MAAM,KAAK;AAClB,YAAM,OAAO,GAAG;AAChB,UAAI,IAAI,SAAS,KAAK;AACpB;AAAA,MACF;AACA,UAAI,QAAQ,mIAAmI;AAAA,QAC7I;AAAA,MACF;AACA,UAAI,CAAC,OAAO;AACV;AAAA,MACF;AACA,UAAI,IAAI,WAAW,MAAM,CAAC,CAAC;AAC3B,UAAI,QAAQ,MAAM,CAAC,KAAK,MAAM,YAAY;AAC1C,cAAQ,MAAM;AAAA,QACZ,KAAK;AAAA,QACL,KAAK;AAAA,QACL,KAAK;AAAA,QACL,KAAK;AAAA,QACL,KAAK;AACH,iBAAO,IAAI;AAAA,QACb,KAAK;AAAA,QACL,KAAK;AAAA,QACL,KAAK;AACH,iBAAO,IAAI;AAAA,QACb,KAAK;AAAA,QACL,KAAK;AAAA,QACL,KAAK;AACH,iBAAO,IAAI;AAAA,QACb,KAAK;AAAA,QACL,KAAK;AAAA,QACL,KAAK;AAAA,QACL,KAAK;AAAA,QACL,KAAK;AACH,iBAAO,IAAI;AAAA,QACb,KAAK;AAAA,QACL,KAAK;AAAA,QACL,KAAK;AAAA,QACL,KAAK;AAAA,QACL,KAAK;AACH,iBAAO,IAAI;AAAA,QACb,KAAK;AAAA,QACL,KAAK;AAAA,QACL,KAAK;AAAA,QACL,KAAK;AAAA,QACL,KAAK;AACH,iBAAO,IAAI;AAAA,QACb,KAAK;AAAA,QACL,KAAK;AAAA,QACL,KAAK;AAAA,QACL,KAAK;AAAA,QACL,KAAK;AACH,iBAAO;AAAA,QACT;AACE,iBAAO;AAAA,MACX;AAAA,IACF;AAUA,aAAS,SAASC,KAAI;AACpB,UAAI,QAAQ,KAAK,IAAIA,GAAE;AACvB,UAAI,SAAS,GAAG;AACd,eAAO,KAAK,MAAMA,MAAK,CAAC,IAAI;AAAA,MAC9B;AACA,UAAI,SAAS,GAAG;AACd,eAAO,KAAK,MAAMA,MAAK,CAAC,IAAI;AAAA,MAC9B;AACA,UAAI,SAAS,GAAG;AACd,eAAO,KAAK,MAAMA,MAAK,CAAC,IAAI;AAAA,MAC9B;AACA,UAAI,SAAS,GAAG;AACd,eAAO,KAAK,MAAMA,MAAK,CAAC,IAAI;AAAA,MAC9B;AACA,aAAOA,MAAK;AAAA,IACd;AAUA,aAAS,QAAQA,KAAI;AACnB,UAAI,QAAQ,KAAK,IAAIA,GAAE;AACvB,UAAI,SAAS,GAAG;AACd,eAAO,OAAOA,KAAI,OAAO,GAAG,KAAK;AAAA,MACnC;AACA,UAAI,SAAS,GAAG;AACd,eAAO,OAAOA,KAAI,OAAO,GAAG,MAAM;AAAA,MACpC;AACA,UAAI,SAAS,GAAG;AACd,eAAO,OAAOA,KAAI,OAAO,GAAG,QAAQ;AAAA,MACtC;AACA,UAAI,SAAS,GAAG;AACd,eAAO,OAAOA,KAAI,OAAO,GAAG,QAAQ;AAAA,MACtC;AACA,aAAOA,MAAK;AAAA,IACd;AAMA,aAAS,OAAOA,KAAI,OAAO,GAAG,MAAM;AAClC,UAAI,WAAW,SAAS,IAAI;AAC5B,aAAO,KAAK,MAAMA,MAAK,CAAC,IAAI,MAAM,QAAQ,WAAW,MAAM;AAAA,IAC7D;AAAA;AAAA;;;AC9IA,SAAS,mBAAmB,sBAAsB;AAoa3C,SAAS,uBACd,SACA,SACU;AACV,SAAO,QAAQ,IAAI,CAAC,MAAM;AACxB,QAAI,EAAE,SAAS,GAAG,GAAG;AAEnB,aAAO;AAAA,IACT;AACA,WAAO,GAAG,OAAO,IAAI,CAAC;AAAA,EACxB,CAAC;AACH;AAlcA,IAiBA,WA4Pa,wBA0BA,uBAgCA;AAvUb;AAAA;AAAA;AAiBA,gBAAe;AA4PR,IAAM,yBAAyB;AA0B/B,IAAM,wBACX,OAAO,OAAO;AAAA,MACZ,IAAI;AAAA,MACJ,KAAK;AAAA,MACL,QAAQ;AAAA,MACR,cAAc;AAAA,MACd,OAAO;AAAA,MACP,YAAY;AAAA,MACZ,YAAY;AAAA,IACd,CAAC;AAuBI,IAAM,wBACX,OAAO;AAAA,MACL,OAAO;AAAA,QACL,OAAO,QAAQ,qBAAqB,EAAE,IAAI,CAAC,CAAC,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC;AAAA,MAC9D;AAAA,IACF;AAAA;AAAA;;;ACrOK,SAAS,eAAe,OAAuB;AACpD,MAAI,CAAC,MAAM,WAAW,YAAY,GAAG;AACnC,WAAO;AAAA,EACT;AACA,QAAM,YAAY,MAAM,YAAY,GAAG;AACvC,MAAI,cAAc,MAAM,cAAc,MAAM,SAAS,GAAG;AACtD,WAAO;AAAA,EACT;AACA,SAAO,MAAM,MAAM,YAAY,CAAC;AAClC;AAoCO,SAAS,mBACd,WACA,SACmB;AACnB,QAAM,UAA6B,CAAC;AAEpC,aAAW,OAAO,WAAW;AAC3B,UAAM,gBAAgB,QAAQ;AAAA,MAAO,CAAC,UACpC,8BAA8B,KAAK,KAAK;AAAA,IAC1C;AACA,UAAM,mBAAmB;AAAA,MACvB,IAAI;AAAA,MACJ,IAAI;AAAA,IACN;AACA,UAAM,iBAAiB,cAAc;AAAA,MAAQ,CAAC,UAC5C,uBAAuB,MAAM,SAAS,MAAM,OAAO;AAAA,IACrD;AACA,UAAM,UAAU,iBAAiB;AAAA,MAAM,CAAC,oBACtC,eAAe;AAAA,QAAK,CAAC,kBACnB,eAAe,eAAe,eAAe;AAAA,MAC/C;AAAA,IACF;AACA,QAAI,CAAC,SAAS;AACZ,cAAQ,KAAK,WAAW,GAAG,CAAC;AAAA,IAC9B;AAAA,EACF;AAEA,SAAO,EAAE,QAAQ,QAAQ,WAAW,GAAG,QAAQ;AACjD;AAMA,SAAS,8BACP,WACA,SACS;AACT,MAAI,UAAU,YAAY,QAAQ,SAAS;AACzC,WAAO;AAAA,EACT;AAIA,MACE,eAAe,UAAU,SAAS,sBAAsB,MACxD,eAAe,QAAQ,SAAS,sBAAsB,GACtD;AACA,WAAO;AAAA,EACT;AACA,MAAI,CAAC,aAAa,QAAQ,MAAM,UAAU,IAAI,GAAG;AAC/C,WAAO;AAAA,EACT;AAIA,MAAI,CAAC,kBAAkB,UAAU,SAAS,QAAQ,OAAO,GAAG;AAC1D,WAAO;AAAA,EACT;AACA,SAAO;AACT;AAUO,SAAS,kBACd,MACA,OACS;AACT,SAAO,yBAAyB,IAAI,MAAM,yBAAyB,KAAK;AAC1E;AASO,SAAS,yBACd,SACQ;AACR,QAAM,eAAe,CAAC,UAA2B;AAC/C,QAAI,UAAU,QAAQ,OAAO,UAAU,aAAa,OAAO,UAAU,UAAU;AAC7E,aAAO,KAAK,UAAU,KAAK;AAAA,IAC7B;AACA,QAAI,OAAO,UAAU,UAAU;AAC7B,UAAI,OAAO,SAAS,KAAK,EAAG,QAAO,KAAK,UAAU,KAAK;AACvD,YAAM,IAAI,MAAM,8CAA8C;AAAA,IAChE;AACA,QAAI,MAAM,QAAQ,KAAK,EAAG,QAAO,IAAI,MAAM,IAAI,YAAY,EAAE,KAAK,GAAG,CAAC;AACtE,QAAI,OAAO,UAAU,UAAU;AAC7B,YAAM,SAAS;AACf,YAAM,YAAY,OAAO,eAAe,MAAM;AAC9C,UAAI,cAAc,OAAO,aAAa,cAAc,MAAM;AACxD,cAAM,IAAI,MAAM,8CAA8C;AAAA,MAChE;AACA,aAAO,IAAI,OAAO,KAAK,MAAM,EAAE,KAAK,EAAE;AAAA,QAAI,CAAC,QACzC,GAAG,KAAK,UAAU,GAAG,CAAC,IAAI,aAAa,OAAO,GAAG,CAAC,CAAC;AAAA,MACrD,EAAE,KAAK,GAAG,CAAC;AAAA,IACb;AACA,UAAM,IAAI,MAAM,8CAA8C;AAAA,EAChE;AACA,QAAM,YAAY,WAAW,CAAC,GAAG,IAAI,YAAY,EAAE,KAAK;AACxD,MAAI,SAAS,WAAW,KAAM,SAAS,WAAW,KAAK,SAAS,CAAC,MAAM,MAAO;AAC5E,WAAO;AAAA,EACT;AACA,SAAO,IAAI,SAAS,KAAK,GAAG,CAAC;AAC/B;AAGO,SAAS,eAAe,eAAuB,iBAAkC;AACtF,MAAI,kBAAkB,OAAO,kBAAkB,gBAAiB,QAAO;AACvE,MAAI,CAAC,cAAc,SAAS,IAAI,EAAG,QAAO;AAC1C,QAAM,UAAU,cAAc,MAAM,GAAG,EAAE;AACzC,SAAO,oBAAoB,WAAW,gBAAgB,WAAW,GAAG,OAAO,GAAG;AAChF;AAWA,SAAS,aAAa,aAAqB,eAAgC;AACzE,MAAI,gBAAgB,MAAM,gBAAgB,KAAK;AAC7C,WAAO;AAAA,EACT;AACA,MAAI,YAAY,SAAS,GAAG,GAAG;AAC7B,WAAO,cAAc,WAAW,WAAW;AAAA,EAC7C;AACA,SAAO,kBAAkB;AAC3B;AAEA,SAAS,WAAW,OAAyC;AAC3D,SAAO;AAAA,IACL,SAAS,MAAM;AAAA,IACf,GAAI,MAAM,UAAU,SAAY,EAAE,OAAO,MAAM,MAAM,IAAI,CAAC;AAAA,IAC1D,MAAM,MAAM;AAAA,IACZ,SAAS,CAAC,GAAG,MAAM,OAAO;AAAA,IAC1B,GAAI,MAAM,YAAY,SAClB,EAAE,SAAS,KAAK,MAAM,KAAK,UAAU,MAAM,OAAO,CAAC,EAA+B,IAClF,CAAC;AAAA,IACL,GAAI,MAAM,eAAe,SAAY,EAAE,YAAY,MAAM,WAAW,IAAI,CAAC;AAAA,IACzE,GAAI,MAAM,WAAW,SAAY,EAAE,QAAQ,MAAM,OAAO,IAAI,CAAC;AAAA,EAC/D;AACF;AA9SA;AAAA;AAAA;AAgBA;AAAA;AAAA;;;AC0BO,SAAS,0BAA0B,OAA+C;AACvF,MAAI,CAAC,MAAM,QAAQ,KAAK,EAAG,QAAO;AAElC,QAAM,cAAiC,CAAC;AACxC,aAAW,aAAa,OAAO;AAC7B,QAAI,CAAC,kBAAkB,SAAS,EAAG,QAAO;AAC1C,gBAAY,KAAK,SAAS;AAAA,EAC5B;AACA,SAAO,yBAAyB,WAAW;AAC7C;AASO,SAAS,kBACd,SACA,UACqB;AACrB,QAAM,mBAAmB,yBAAyB,OAAO;AACzD,QAAM,oBAAoB,yBAAyB,QAAQ;AAC3D,QAAM,SAAS,mBAAmB,mBAAmB,gBAAgB;AAErE,SAAO;AAAA,IACL,WAAW,OAAO;AAAA,IAClB,SAAS,yBAAyB,OAAO,OAAO;AAAA,EAClD;AACF;AAOO,SAAS,2BACd,SACA,UACAC,eACqB;AACrB,QAAM,mBAAmB,kCAAkC,SAASA,aAAY;AAChF,QAAM,oBAAoB,kCAAkC,UAAUA,aAAY;AAClF,QAAM,UAAsC,CAAC;AAE7C,aAAW,aAAa,mBAAmB;AACzC,UAAM,UAAU,iBAAiB;AAAA,MAAK,CAAC,cACrC,UAAU,YAAY,UAAU,WAChC,qBAAqB,UAAU,OAAO,UAAU,KAAK,KACrD,mBAAmB,CAAC,SAAS,GAAG,CAAC,SAAS,CAAC,EAAE;AAAA,IAC/C;AACA,QAAI,CAAC,QAAS,SAAQ,KAAK,SAAS;AAAA,EACtC;AAEA,SAAO;AAAA,IACL,WAAW,QAAQ,WAAW;AAAA,IAC9B,SAAS,yBAAyB,OAAO;AAAA,EAC3C;AACF;AAOO,SAAS,wBACd,WACA,WACAA,eACS;AACT,SAAO,UAAU,SAAS,KACxB,2BAA2B,WAAW,yBAAyB,SAAS,GAAGA,aAAY,EAAE;AAC7F;AAOO,SAAS,8BACd,QACA,SACAA,eACS;AACT,QAAM,kBAAkB,kCAAkC,QAAQA,aAAY;AAC9E,QAAM,mBAAmB,kCAAkC,SAASA,aAAY;AAChF,SAAO,gBAAgB,SAAS,KAAK,gBAAgB,MAAM,CAAC,SAAS,iBAAiB;AAAA,IAAK,CAAC,SAC1F,KAAK,UAAU,IAAI,MAAM,KAAK,UAAU,IAAI;AAAA,EAC9C,CAAC;AACH;AAGO,SAAS,kCACd,aACAA,eAC4B;AAC5B,SAAO,yBAAyB,YAAY,IAAI,CAAC,eAAe;AAC9D,UAAM,gBAAgB,0BAA0B,UAAU;AAC1D,QAAI,WAAW,UAAU,UAAaA,kBAAiB,QAAW;AAChE,aAAO;AAAA,IACT;AACA,QAAI;AACF,aAAO,EAAE,GAAG,eAAe,OAAOA,cAAa,WAAW,KAAK,EAAE;AAAA,IACnE,QAAQ;AAGN,aAAO;AAAA,IACT;AAAA,EACF,CAAC,CAAC;AACJ;AAEA,SAAS,0BAA0B,YAA8C;AAC/E,MAAI,WAAW,YAAY,uBAAwB,QAAO;AAC1D,QAAM,QAAQ,WAAW,KAAK;AAAA,IAC5B;AAAA,EACF;AACA,MAAI,CAAC,MAAO,QAAO;AACnB,SAAO,EAAE,GAAG,YAAY,MAAM,GAAG,MAAM,CAAC,CAAC,GAAG,MAAM,CAAC,EAAG,YAAY,CAAC,GAAG,MAAM,CAAC,CAAC,GAAG;AACnF;AAEA,SAAS,qBACP,SACA,WACS;AACT,SAAO,YAAY;AACrB;AAYO,SAAS,yBACd,aAC4B;AAC5B,QAAM,aAAa,oBAAI,IAAsC;AAC7D,aAAW,cAAc,aAAa;AACpC,UAAM,YAAY,uBAAuB,UAAU;AACnD,eAAW,IAAI,gCAAgC,SAAS,GAAG,SAAS;AAAA,EACtE;AAEA,SAAO,CAAC,GAAG,WAAW,QAAQ,CAAC,EAC5B,KAAK,CAAC,CAAC,IAAI,GAAG,CAAC,KAAK,MAAM,KAAK,cAAc,KAAK,CAAC,EACnD,IAAI,CAAC,CAAC,EAAE,UAAU,MAAM,UAAU;AACvC;AAEA,SAAS,uBAAuB,YAAuD;AACrF,QAAM,UAAU,CAAC,GAAG,IAAI,IAAI,WAAW,OAAO,CAAC,EAAE,KAAK,CAAC,MAAM,UAAU,KAAK,cAAc,KAAK,CAAC;AAChG,SAAO;AAAA,IACL,SAAS,WAAW;AAAA,IACpB,GAAI,WAAW,UAAU,SAAY,EAAE,OAAO,WAAW,MAAM,IAAI,CAAC;AAAA,IACpE,MAAM,WAAW;AAAA,IACjB;AAAA,IACA,GAAI,WAAW,eAAe,SAAY,EAAE,YAAY,WAAW,WAAW,IAAI,CAAC;AAAA,IACnF,GAAI,WAAW,WAAW,SAAY,EAAE,QAAQ,WAAW,OAAO,IAAI,CAAC;AAAA,IACvE,GAAI,WAAW,gBAAgB,SAAY,EAAE,aAAa,WAAW,YAAY,IAAI,CAAC;AAAA,IACtF,GAAI,WAAW,YAAY,SACvB,CAAC,IACD,EAAE,SAAS,oBAAoB,WAAW,OAAO,EAAE;AAAA,EACzD;AACF;AAEA,SAAS,gCAAgC,YAA8C;AACrF,SAAO,KAAK,UAAU;AAAA,IACpB,SAAS,WAAW;AAAA,IACpB,GAAI,WAAW,UAAU,SAAY,EAAE,OAAO,WAAW,MAAM,IAAI,CAAC;AAAA,IACpE,MAAM,WAAW;AAAA,IACjB,SAAS,WAAW;AAAA,IACpB,GAAI,WAAW,eAAe,SAAY,EAAE,YAAY,WAAW,WAAW,IAAI,CAAC;AAAA,IACnF,GAAI,WAAW,WAAW,SAAY,EAAE,QAAQ,WAAW,OAAO,IAAI,CAAC;AAAA,IACvE,GAAI,WAAW,gBAAgB,SAAY,EAAE,aAAa,WAAW,YAAY,IAAI,CAAC;AAAA,IACtF,GAAI,WAAW,YAAY,SAAY,CAAC,IAAI,EAAE,SAAS,WAAW,QAAQ;AAAA,EAC5E,CAAC;AACH;AAEA,SAAS,kBAAkB,OAA0C;AACnE,MACE,CAAC,cAAc,KAAK,KACpB,OAAO,oBAAoB,KAAK,EAAE,KAAK,CAAC,QAAQ,CAAC,sBAAsB,IAAI,GAAG,CAAC,KAC/E,OAAO,sBAAsB,KAAK,EAAE,SAAS,GAC7C;AACA,WAAO;AAAA,EACT;AACA,MACE,CAAC,YAAY,MAAM,OAAO,KAC1B,CAAC,YAAY,MAAM,MAAM,MAAM,OAAO,KACrC,MAAM,UAAU,UAAa,CAAC,YAAY,MAAM,KAAK,KACtD,CAAC,MAAM,QAAQ,MAAM,OAAO,KAC5B,MAAM,QAAQ,WAAW,KACzB,CAAC,MAAM,QAAQ,MAAM,WAAW,KAChC,IAAI,IAAI,MAAM,OAAO,EAAE,SAAS,MAAM,QAAQ,UAC9C,MAAM,eAAe,QACpB,MAAM,eAAe,UAAa,MAAM,eAAe,SACvD,MAAM,WAAW,UAAa,CAAC,YAAY,MAAM,MAAM,KACvD,MAAM,gBAAgB,UAAa,CAAC,YAAY,MAAM,WAAW,GAClE;AACA,WAAO;AAAA,EACT;AACA,SAAO,EAAE,aAAa;AACxB;AAEA,SAAS,cAAc,OAAkD;AACvE,MAAI,OAAO,UAAU,YAAY,UAAU,QAAQ,MAAM,QAAQ,KAAK,EAAG,QAAO;AAChF,QAAM,YAAY,OAAO,eAAe,KAAK;AAC7C,SAAO,cAAc,OAAO,aAAa,cAAc;AACzD;AAEA,SAAS,YAAY,OAAiC;AACpD,SAAO,OAAO,UAAU,YAAY,MAAM,SAAS,KAAK,CAAC,MAAM,SAAS,GAAG;AAC7E;AAEA,SAAS,YAAY,OAAgB,SAAmC;AACtE,MAAI,OAAO,UAAU,YAAY,UAAU,OAAO,MAAM,SAAS,GAAG,EAAG,QAAO;AAC9E,MAAI,UAAU,MAAM,MAAM,SAAS,GAAG,GAAG;AACvC,WAAO,MAAM,QAAQ,OAAO,KAAK,QAAQ,SAAS,mBAAmB;AAAA,EACvE;AACA,SAAO;AACT;AAEA,SAAS,oBACP,SAC2B;AAC3B,SAAO,CAAC,GAAG,OAAO,EACf,IAAI,CAAC,YAAY;AAAA,IAChB,UAAU,yBAAyB,CAAC,MAAM,CAAC;AAAA,IAC3C,OAAO,KAAK,MAAM,KAAK,UAAU,MAAM,CAAC;AAAA,EAC1C,EAAE,EACD,KAAK,CAAC,MAAM,UAAU,KAAK,SAAS,cAAc,MAAM,QAAQ,CAAC,EACjE,IAAI,CAAC,EAAE,MAAM,MAAM,KAAK;AAC7B;AArRA,IA2BM;AA3BN;AAAA;AAAA;AAAA;AA2BA,IAAM,wBAAwB,oBAAI,IAAI;AAAA,MACpC;AAAA,MACA;AAAA,MACA;AAAA,MACA;AAAA,MACA;AAAA,MACA;AAAA,MACA;AAAA,IACF,CAAC;AAAA;AAAA;;;ACnCD,SAAS,kBAAkB;AAC3B,SAAS,yBAAyB;AAClC;AAAA,EACE;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,OACK;AACP,SAAS,eAAe;AACxB,SAAS,UAAU,SAAS,YAAY,MAAM,UAAU,eAAe;AA2CvE,SAAS,mBAAsB,KAAmC;AA5DlE,MAAAC;AA6DE,QAAM,WAAW;AACjB,SAAO,SAAAA,MAAS,OAAO,IAAI,GAAG,OAAvB,SAAAA,OAA8B,IAAI,kBAAqB;AAChE;AAsDO,SAAS,oBAA4B;AAC1C,QAAM,OAAO,oBAAoB,SAAS,KACxC,QAAQ,IAAI,WACZ,QAAQ,IAAI,QACZ,QAAQ,IAAI,eACZ,QAAQ;AACV,SAAO,KAAK,MAAM,YAAY;AAChC;AAGO,SAAS,uBACd,WACA,QACY;AACZ,MAAI,cAAc,OAAW,QAAO,OAAO;AAC3C,MAAI,CAAC,WAAW,SAAS,KAAK,UAAU,SAAS,IAAI,GAAG;AACtD,UAAM,IAAI,UAAU,oDAAoD;AAAA,EAC1E;AACA,SAAO,oBAAoB,IAAI,QAAQ,SAAS,GAAG,MAAM;AAC3D;AAEO,SAAS,sBAA8B;AAC5C,SAAO,KAAK,kBAAkB,GAAG,aAAa;AAChD;AAEO,SAAS,eAAuB;AACrC,SAAO,KAAK,kBAAkB,GAAG,UAAU;AAC7C;AAEO,SAAS,YAAY,SAAyB;AACnD,SAAO,KAAK,aAAa,GAAG,oBAAoB,OAAO,CAAC;AAC1D;AAEO,SAAS,kBAAkB,SAAyB;AACzD,SAAO,KAAK,YAAY,OAAO,GAAG,cAAc;AAClD;AAEO,SAAS,YAAY,SAAyB;AACnD,SAAO,iBAAiB,SAAS,SAAS;AAC5C;AAEO,SAAS,0BAA0B,SAAyB;AACjE,SAAO,iBAAiB,SAAS,wBAAwB;AAC3D;AAMO,SAAS,iBAAiB,SAAiB,OAAiC;AACjF,SAAO,KAAK,YAAY,OAAO,GAAG,GAAG,KAAK,OAAO;AACnD;AAGO,SAAS,yBAAyB,SAAiB,OAAiC;AACzF,SAAO,GAAG,iBAAiB,SAAS,KAAK,CAAC;AAC5C;AAEO,SAAS,gBAAgB,SAAyB;AACvD,SAAO,KAAK,YAAY,OAAO,GAAG,OAAO;AAC3C;AAWO,SAAS,oBAAoB,SAAyB;AAC3D,SAAO,KAAK,kBAAkB,GAAG,iBAAiB,oBAAoB,OAAO,CAAC;AAChF;AAMA,eAAsB,SAAY,UAAqC;AACrE,MAAI;AACF,WAAO,KAAK,MAAM,MAAM,SAAS,UAAU,MAAM,CAAC;AAAA,EACpD,SAAS,OAAO;AACd,QAAI,QAAQ,OAAO,QAAQ,EAAG,QAAO;AACrC,UAAM;AAAA,EACR;AACF;AAMA,eAAsB,gBAAgB,UAAkB,OAA+B;AACrF,QAAM,YAAY,UAAU,OAAO,KAAK;AAC1C;AAOA,eAAe,YAAY,UAAkB,OAAgB,SAAiC;AAC5F,QAAM,YAAY,QAAQ,QAAQ;AAClC,QAAM,gBAAgB;AAAA,IACpB;AAAA,IACA,IAAI,SAAS,QAAQ,CAAC,IAAI,QAAQ,GAAG,IAAI,WAAW,CAAC;AAAA,EACvD;AACA,QAAM,WAAW,GAAG,KAAK,UAAU,OAAO,MAAM,CAAC,CAAC;AAAA;AAElD,QAAM,MAAM,WAAW,EAAE,WAAW,MAAM,MAAM,iBAAiB,CAAC;AAClE,MAAI;AACF,QAAI,QAAS,OAAM,iBAAiB,eAAe,QAAQ;AAAA,QACtD,OAAM,UAAU,eAAe,UAAU,EAAE,UAAU,QAAQ,MAAM,kBAAkB,CAAC;AAC3F,UAAM,OAAO,eAAe,QAAQ;AAAA,EACtC,SAAS,OAAO;AACd,UAAM,GAAG,eAAe,EAAE,OAAO,KAAK,CAAC,EAAE,MAAM,MAAM,MAAS;AAC9D,UAAM;AAAA,EACR;AACF;AAGA,eAAe,iBAAiB,MAAc,UAAiC;AAC7E,QAAM,SAAS,MAAM,KAAK,MAAM,MAAM,iBAAiB;AACvD,MAAI;AACF,QAAI,UAAU;AACZ,YAAM,OAAO,UAAU,UAAU,MAAM;AACvC,YAAM,OAAO,SAAS;AAAA,IACxB;AAAA,EACF,UAAE;AACA,UAAM,OAAO,MAAM;AAAA,EACrB;AACF;AAEA,eAAsB,YACpB,SACmB;AACnB,SAAO,SAAY,kBAAkB,OAAO,CAAC;AAC/C;AAEA,eAAsB,YACpB,SACmB;AACnB,QAAM,kBAAkB,SAAS,SAAS;AAC1C,SAAO,SAAY,YAAY,OAAO,CAAC;AACzC;AAEA,eAAsB,0BACpB,SACc;AACd,UAAQ,MAAM,iBAAoB,SAAS,wBAAwB,GAAG;AACxE;AAEA,eAAsB,iBACpB,SACc;AACd,UAAQ,MAAM,iBAAoB,SAAS,eAAe,GAAG;AAC/D;AAEA,eAAsB,kBACpB,SACA,OACwB;AACxB,QAAM,WAAW,MAAM,SAAwB,yBAAyB,SAAS,KAAK,CAAC;AACvF,MAAI,aAAa,KAAM,QAAO,EAAE,eAAe,EAAE;AACjD,MACE,OAAO,aAAa,YACpB,SAAS,kBAAkB,GAC3B;AACA,UAAM,IAAI,UAAU,iCAAiC,KAAK,IAAI;AAAA,EAChE;AACA,SAAO;AACT;AAEA,eAAsB,iBACpB,SACA,OACkC;AAClC,QAAM,CAAC,UAAU,GAAG,IAAI,MAAM,QAAQ,IAAI;AAAA,IACxC,kBAAkB,SAAS,KAAK;AAAA,IAChC,SAAkB,iBAAiB,SAAS,KAAK,CAAC;AAAA,EACpD,CAAC;AACD,SAAO;AAAA,IACL,eAAe,SAAS;AAAA,IACxB,SAAS,MAAM,QAAQ,GAAG,IAAI,MAAa,CAAC;AAAA,EAC9C;AACF;AAeA,eAAsB,gBACpB,SACA,QACA,UAA8B,CAAC,GACnB;AACZ,QAAM,oBAAoB,oBAAoB,OAAO;AACrD,QAAM,WAAW,gBAAgB,iBAAiB;AAClD,QAAM,QAAQ,iBAAiB,SAAS,KAAK,CAAC,GAAG,OAAO,CAACC,eAAcA,WAAU,MAAM;AACvF,MAAI,KAAK,KAAK,CAACA,eAAcA,WAAU,aAAa,QAAQ,EAAG,QAAO,OAAO;AAC7E,QAAM,WAAW,MAAM,mBAAmB,mBAAmB,OAAO;AACpE,QAAM,YAA6B;AAAA,IACjC;AAAA,IACA,UAAU,SAAS;AAAA,IACnB,qBAAqB,SAAS;AAAA,IAC9B,QAAQ;AAAA,EACV;AACA,MAAI;AACF,WAAO,MAAM,iBAAiB,IAAI,CAAC,GAAG,MAAM,SAAS,GAAG,MAAM;AAAA,EAChE,UAAE;AACA,cAAU,SAAS;AACnB,UAAM,SAAS,QAAQ;AAGvB,QAAI,SAAS,oBAAqB,OAAM,MAAM,YAAY,iBAAiB,CAAC,EAAE,MAAM,MAAM,MAAS;AAAA,EACrG;AACF;AAuBA,eAAsB,4BAA4B,SAAgC;AAChF,QAAM,WAAW,gBAAgB,OAAO;AACxC,QAAM,aAAa,iBAAiB,SAAS,KAAK,CAAC,GAAG,KAAK,CAAC,cAAc,UAAU,UAAU,UAAU,aAAa,QAAQ;AAC7H,MAAI,CAAC,WAAW,oBAAqB;AAErC,MAAI,MAAM,OAAO,kBAAkB,OAAO,CAAC,EAAG;AAC9C,QAAM,IAAI,oBAAoB,OAAO;AACvC;AAiCA,eAAsB,mBACpB,SACA,OACA,QAMA,UAA8B,CAAC,GACd;AACjB,SAAO;AAAA,IACL;AAAA,IACA,MAAM,8BAA8B,SAAS,OAAO,MAAM;AAAA,IAC1D;AAAA,EACF;AACF;AAGA,eAAe,8BACb,SACA,OACA,QAMiB;AACjB,QAAM,4BAA4B,OAAO;AACzC,QAAM,UAAU,MAAM,iBAAoB,SAAS,KAAK;AACxD,QAAM,OAAO,MAAM,OAAO,QAAQ,OAAO;AACzC,QAAM,gBAAgB,iBAAiB,SAAS,KAAK,GAAG,KAAK,OAAO;AACpE,QAAM,uBAAuB,SAAS,KAAK;AAC3C,SAAO,KAAK;AACd;AAyBA,eAAe,uBAAuB,SAAiB,OAAwC;AAC7F,QAAM,gBAAgB,yBAAyB,SAAS,KAAK,GAAG,EAAE,eAAe,EAAE,CAAC;AACtF;AA4BA,eAAe,mBACb,SACA,SAC8B;AAC9B,QAAM,WAAyB;AAAA,IAC7B,WAAW,KAAK,IAAI;AAAA,IACpB,WAAW,QAAQ,aAAa;AAAA,IAChC,SAAS,QAAQ,WAAW;AAAA,EAC9B;AACA,QAAM,eAAe,QAAQ,gBAAgB;AAC7C,QAAM,WAAW,gBAAgB,OAAO;AACxC,QAAM,gBAAgB,oBAAoB,OAAO;AAEjD,QAAM,YAAY,YAAY,OAAO;AACrC,QAAM,MAAM,WAAW,EAAE,WAAW,MAAM,MAAM,iBAAiB,CAAC;AAClE,QAAM,MAAM,QAAQ,aAAa,GAAG,EAAE,WAAW,MAAM,MAAM,iBAAiB,CAAC;AAG/E,aAAW,QAAQ,CAAC,kBAAkB,GAAG,aAAa,GAAG,SAAS,GAAG;AACnE,UAAM,MAAM,MAAM,gBAAgB,EAAE,MAAM,CAAC,UAAmB;AAG5D,UAAI,SAAS,aAAa,CAAC,QAAQ,OAAO,QAAQ,EAAG,OAAM;AAAA,IAC7D,CAAC;AAAA,EACH;AAEA,QAAM,EAAE,MAAM,gBAAgB,IAAI,MAAM,YAAY,SAAS,eAAe,QAAQ;AACpF,MAAI;AAGF,UAAM,WAAW,MAAM,SAA6B,KAAK,eAAe,cAAc,CAAC,EAAE,MAAM,MAAM,IAAI;AACzG,UAAM,sBAAsB,OAAO,UAAU,SAAS,YAAY,SAAS,QAAQ;AACnF,WAAO,MAAM;AACX,YAAM,QAAQ,WAAW;AACzB,UAAI,MAAM,mBAAmB,SAAS,UAAU,KAAK,GAAG;AACtD,eAAO;AAAA,UACL;AAAA,UACA,UAAU,KAAK;AAAA,UACf,SAAS,YAAY;AACnB,gBAAI;AACF,oBAAM,mBAAmB,SAAS,UAAU,KAAK;AAAA,YACnD,UAAE;AACA,oBAAM,YAAY,SAAS,IAAI;AAAA,YACjC;AAAA,UACF;AAAA,QACF;AAAA,MACF;AACA,YAAM,yBAAyB,OAAO;AACtC,UAAI,MAAM,iBAAiB,SAAS,UAAU,YAAY,EAAG;AAC7D,YAAM,cAAc,SAAS,QAAQ;AAAA,IACvC;AAAA,EACF,SAAS,OAAO;AACd,UAAM,YAAY,SAAS,IAAI;AAC/B,UAAM;AAAA,EACR;AACF;AAGA,SAAS,cAAc,SAAiB,UAAwB,QAAuB;AACrF,MAAI,KAAK,IAAI,IAAI,SAAS,aAAa,SAAS,WAAW;AACzD,UAAM,IAAI,wBAAwB,SAAS,SAAS,WAAW,MAAM;AAAA,EACvE;AACF;AAGA,eAAe,cAAc,SAAiB,UAAwB,QAAgC;AACpG,gBAAc,SAAS,UAAU,MAAM;AACvC,QAAM,MAAM,KAAK,IAAI,SAAS,SAAS,SAAS,aAAa,KAAK,IAAI,IAAI,SAAS,UAAU,CAAC;AAChG;AAsFA,eAAe,YACb,SACA,WACA,UACkD;AAClD,MAAI;AAEJ,MAAI;AACJ,QAAM,UAAU,CAAC,SACf,iBAAiB,SAAS,IAAI,IAAI,0EACW,OAAO;AACtD,WAAS,QAAQ,QAAQ,QAAQ,OAAO;AACtC,QAAI,CAAC,MAAO,eAAc,SAAS,UAAU,OAAO;AACpD,cAAU;AACV,UAAM,SAAS,MAAM,eAAe,SAAS;AAC7C,QAAI,WAAW,WAAW;AACxB,YAAM,oBAAoB,SAAS;AACnC;AAAA,IACF;AACA,QAAI,WAAW,SAAS;AAGtB,gBAAU,QAAQ,cAAc;AAChC,YAAM,cAAc,SAAS,UAAU,OAAO;AAC9C;AAAA,IACF;AACA,QAAI,WAAW,KAAM;AACrB,QAAI,OAAO,WAAW,UAAU;AAC9B,gBAAU,QAAQ,0BAA0B,MAAM,EAAE;AACpD,YAAM,cAAc,SAAS,UAAU,OAAO;AAC9C;AAAA,IACF;AACA,0CAAoB,OAAO,OAAO,OAAO,OAAO,IAAI,OAAO;AAC3D,QAAI,OAAO,QAAQ,OAAO,MAAM;AAC9B,YAAM,OAAO,MAAM,SAAS,SAAS,WAAW,MAAM;AACtD,UAAI,SAAS,KAAM,QAAO,EAAE,MAAM,gBAAgB;AAClD,YAAM,cAAc,SAAS,QAAQ;AAAA,IACvC,WAAW,OAAO,MAAM;AACtB,gBAAU,QAAQ,kBAAkB,OAAO,IAAI,2BAA2B;AAC1E,YAAM,cAAc,SAAS,UAAU,OAAO;AAAA,IAChD,WAAW,OAAO,QAAQ,QAAQ,MAAM,kBAAkB,IAAI,OAAO,KAAK,IAAI,CAAC,eAAe,OAAO,GAAG,GAAG;AACzG,YAAM,mBAAmB,mCAAmC,OAAO;AACnE,YAAM,oBAAoB,WAAW,MAAM;AAC3C,wBAAkB,OAAO,OAAO,KAAK;AAAA,IACvC,OAAO;AACL,YAAM,yBAAyB,OAAO;AACtC,YAAM,cAAc,SAAS,QAAQ;AAAA,IACvC;AAAA,EACF;AACF;AAMA,eAAe,eAAe,WAA6E;AACzG,MAAI;AACJ,MAAI;AACF,YAAQ,MAAM,QAAQ,SAAS;AAAA,EACjC,SAAS,OAAO;AACd,QAAI,QAAQ,OAAO,QAAQ,EAAG,QAAO;AACrC,UAAM;AAAA,EACR;AACA,QAAM,QAAQ,MAAM,OAAO,CAAC,SAAS,KAAK,KAAK,IAAI,CAAC,EAAE,IAAI,MAAM;AAChE,MAAI,MAAM,WAAW,EAAG,QAAO;AAC/B,QAAM,OAAO,KAAK,IAAI,GAAG,KAAK;AAC9B,QAAM,OAAO,MAAM,SAAS,WAAW,IAAI;AAC3C,SAAO,SAAS,YAAY,OAAO;AACrC;AAUA,eAAe,SAAS,WAAmB,MAAqD;AAC9F,QAAM,OAAO,KAAK,WAAW,OAAO,IAAI,CAAC;AACzC,MAAI;AACJ,MAAI;AACF,WAAO,MAAM,SAAS,KAAK,MAAM,YAAY,GAAG,MAAM;AAAA,EACxD,SAAS,OAAO;AACd,QAAI,CAAC,QAAQ,OAAO,QAAQ,KAAK,CAAC,QAAQ,OAAO,SAAS,EAAG,OAAM;AACnE,WAAO,MAAM,OAAO,IAAI,IAAI,YAAY;AAAA,EAC1C;AACA,MAAI;AACJ,MAAI;AACF,YAAQ,KAAK,MAAM,IAAI;AAAA,EACzB,QAAQ;AACN,WAAO;AAAA,EACT;AACA,MAAI,UAAU,QAAQ,OAAO,UAAU,YAAY,OAAO,MAAM,UAAU,YAAY,OAAO,MAAM,QAAQ,UAAU;AACnH,WAAO;AAAA,EACT;AACA,QAAM,OAAO,MAAM,OAAO,KAAK,MAAM,GAAG,MAAM,KAAK,OAAO,CAAC;AAC3D,QAAM,OAAO,MAAM,OAAO,KAAK,MAAM,GAAG,MAAM,KAAK,OAAO,CAAC;AAC3D,SAAO;AAAA,IACL;AAAA,IACA,OAAO,MAAM;AAAA,IACb,KAAK,MAAM;AAAA,IACX,OAAO,OAAO,MAAM,UAAU,WAAW,MAAM,QAAQ;AAAA,IACvD;AAAA,IACA;AAAA,EACF;AACF;AAOA,eAAe,eAAe,WAAmB,MAAc,OAAiC;AAC9F,QAAM,OAAO,MAAM,SAAS,WAAW,IAAI;AAC3C,MAAI,SAAS,UAAW,OAAM,IAAI,MAAM,QAAQ,IAAI,qBAAqB,SAAS,iBAAiB;AACnG,SAAO,SAAS,QAAQ,KAAK,UAAU,SAAS,KAAK,QAAQ,KAAK;AACpE;AAOA,eAAe,SAAS,SAAiB,WAAmB,QAAyC;AACnG,QAAM,QAAQ,WAAW;AACzB,QAAM,OAAO,OAAO,OAAO;AAC3B,QAAM,OAAO,KAAK,WAAW,OAAO,IAAI,CAAC;AACzC,QAAM,QAAQ,EAAE,KAAK,QAAQ,KAAK,YAAW,oBAAI,KAAK,GAAE,YAAY,GAAG,OAAO,OAAO,OAAO,MAAM;AAClG,MAAI,YAAY;AAChB,MAAI;AACF,gBAAY,MAAM;AAAA,MAChB,KAAK,WAAW,UAAU,QAAQ,GAAG,IAAI,KAAK,EAAE;AAAA,MAChD;AAAA,MACA,EAAE,cAAc,GAAG,KAAK,UAAU,OAAO,MAAM,CAAC,CAAC;AAAA,EAAK;AAAA,MACtD,MAAM,mBAAmB,oCAAoC,OAAO;AAAA,IACtE;AACA,QAAI,aAAa,MAAM,eAAe,WAAW,OAAO,MAAM,OAAO,KAAK,KAAK,MAAM,SAAS,MAAM,OAAO,MAAM,GAAG;AAClH,aAAO,EAAE,WAAW,MAAM,MAAM;AAAA,IAClC;AACA,QAAI,UAAW,OAAM,SAAS,MAAM,OAAO,MAAM;AACjD,WAAO;AAAA,EACT,SAAS,OAAO;AACd,QAAI,UAAW,eAAc,WAAW,MAAM,KAAK;AACnD,UAAM;AAAA,EACR;AACF;AASA,eAAe,oBAAoB,WAAmB,WAAqC;AACzF,QAAM,OAAO,KAAK,WAAW,OAAO,UAAU,IAAI,CAAC;AACnD,MAAI,CAAC,UAAU,QAAQ,UAAU,UAAU,QACzC,MAAM,eAAe,WAAW,UAAU,OAAO,GAAG,UAAU,KAAK,GAAG;AACtE,UAAM,SAAS,MAAM,UAAU,OAAO,MAAM;AAAA,EAC9C;AACA,QAAM,SAAS,MAAM,UAAU,OAAO,MAAM;AAC9C;AASA,SAAS,cAAc,WAAmB,MAAc,OAAe,UAAU,gBAAsB;AACrG,oBAAkB,IAAI,KAAK;AAC3B,QAAM,YAAY;AAChB,QAAI;AACF,YAAM,OAAO,MAAM,SAAS,WAAW,IAAI;AAC3C,UAAI,SAAS,QAAQ,SAAS,aAAa,KAAK,UAAU,SAAS,CAAC,KAAK,KAAM,OAAM,oBAAoB,WAAW,IAAI;AACxH,wBAAkB,OAAO,KAAK;AAAA,IAChC,QAAQ;AAEN,UAAI,UAAU,EAAG,YAAW,MAAM,cAAc,WAAW,MAAM,OAAO,UAAU,CAAC,GAAG,eAAe,EAAE,MAAM;AAAA,IAC/G;AAAA,EACF,GAAG;AACL;AAOA,eAAe,SAAS,MAAc,OAAe,MAAyC;AAC5F,WAAS,UAAU,KAAK,WAAW;AACjC,QAAI;AACF,YAAM,UAAU,KAAK,MAAM,GAAG,KAAK,IAAI,IAAI,EAAE,GAAG,IAAI,EAAE,MAAM,mBAAmB,MAAM,KAAK,CAAC;AAC3F,aAAO;AAAA,IACT,SAAS,OAAO;AACd,UAAI,QAAQ,OAAO,QAAQ,EAAG,QAAO;AACrC,UAAI,QAAQ,OAAO,QAAQ,EAAG,QAAO;AACrC,UAAI,WAAW,uBAAuB,OAAQ,OAAM;AACpD,YAAM,MAAM,uBAAuB,OAAO,CAAE;AAAA,IAC9C;AAAA,EACF;AACF;AAGA,eAAe,oBAAoB,WAAkC;AACnE,QAAM,QAAQ,WAAW;AACzB,QAAM,QAAQ,EAAE,KAAK,QAAQ,KAAK,YAAW,oBAAI,KAAK,GAAE,YAAY,GAAG,OAAO,OAAO,KAAK;AAC1F,QAAM,iBAAiB,KAAK,QAAQ,SAAS,GAAG,UAAU,SAAS,SAAS,CAAC,IAAI,QAAQ,GAAG,IAAI,KAAK,EAAE,GAAG,WAAW;AAAA,IACnH,gBAAgB,GAAG,KAAK,UAAU,OAAO,MAAM,CAAC,CAAC;AAAA;AAAA,IACjD,CAAC,KAAK,KAAK,OAAO,GAAG;AAAA,IACrB,CAAC,KAAK,KAAK,OAAO,GAAG;AAAA,EACvB,CAAC;AACH;AASA,eAAe,iBACb,OACA,QACA,OACA,cACkB;AAClB,MAAI;AACF,eAAW,CAAC,MAAM,QAAQ,KAAK,OAAO,QAAQ,KAAK,GAAG;AACpD,YAAM,MAAM,QAAQ,KAAK,OAAO,IAAI,CAAC,GAAG,EAAE,WAAW,MAAM,MAAM,iBAAiB,CAAC;AACnF,YAAM,iBAAiB,KAAK,OAAO,IAAI,GAAG,QAAQ;AAAA,IACpD;AACA,UAAM,eAAe;AACrB,UAAM,OAAO,OAAO,MAAM;AAC1B,WAAO;AAAA,EACT,SAAS,OAAO;AAGd,QAAI,CAAC,aAAa,UAAU,QAAQ,EAAE,KAAK,CAAC,SAAS,QAAQ,OAAO,IAAI,CAAC,KAAK,MAAM,OAAO,MAAM,EAAG,QAAO;AAC3G,UAAM;AAAA,EACR,UAAE;AACA,UAAM,GAAG,OAAO,EAAE,WAAW,MAAM,OAAO,KAAK,CAAC,EAAE,MAAM,MAAM,MAAS;AAAA,EACzE;AACF;AAOA,eAAe,YAAY,SAAiB,MAA2B;AACrE,MAAI;AACF,UAAM,SAAS,KAAK,KAAK,WAAW,OAAO,KAAK,IAAI,CAAC,GAAG,KAAK,OAAO,MAAM;AAAA,EAC5E,QAAQ;AACN,kBAAc,KAAK,WAAW,KAAK,MAAM,KAAK,KAAK;AACnD;AAAA,EACF;AACA,QAAM,aAAa,SAAS,IAAI,EAAE,MAAM,MAAM,MAAS;AACzD;AAOA,SAAS,qBAAqB,MAAuB;AACnD,MAAI,KAAK,WAAW,SAAS,EAAG,QAAO;AACvC,QAAM,SAAS,6CAA6C,KAAK,IAAI,IAAI,CAAC;AAC1E,SAAO,WAAW,UAAa,CAAC,eAAe,OAAO,MAAM,CAAC;AAC/D;AAGA,SAAS,8BAA8B,MAAuB;AAC5D,QAAM,SAAS,qFAAqF,KAAK,IAAI,IAAI,CAAC;AAClH,SAAO,WAAW,UAAa,CAAC,eAAe,OAAO,MAAM,CAAC;AAC/D;AAYA,eAAe,aAAa,SAAiB,MAA2B;AACtE,aAAW,CAAC,WAAW,SAAS,KAAK;AAAA,IACnC,CAAC,KAAK,WAAW,oBAAoB;AAAA,IACrC,CAAC,QAAQ,KAAK,SAAS,GAAG,6BAA6B;AAAA,EACzD,GAAY;AACV,eAAW,SAAS,MAAM,QAAQ,SAAS,GAAG,OAAO,SAAS,GAAG;AAC/D,YAAM,GAAG,KAAK,WAAW,IAAI,GAAG,EAAE,WAAW,MAAM,OAAO,KAAK,CAAC,EAAE,MAAM,MAAM,MAAS;AAAA,IACzF;AAAA,EACF;AACA,QAAM,SAAS,MAAM,QAAQ,KAAK,SAAS,GAAG,OAAO,CAAC,SAAS,KAAK,KAAK,IAAI,CAAC,EAAE,IAAI,MAAM,EACvF,OAAO,CAAC,SAAS,OAAO,KAAK,IAAI,EACjC,KAAK,CAAC,MAAM,UAAU,OAAO,KAAK;AACrC,aAAW,QAAQ,OAAO;AACxB,UAAM,YAAY,MAAM,SAAS,KAAK,WAAW,IAAI;AACrD,QAAI,cAAc,QAAQ,cAAc,aAAa,CAAC,UAAU,KAAM;AACtE,QAAI,UAAU,MAAM;AAClB,UAAI,MAAM,OAAO,KAAK,KAAK,WAAW,OAAO,OAAO,CAAC,CAAC,CAAC,EAAG;AAC1D,YAAM,OAAO,MAAM,SAAS,KAAK,WAAW,OAAO,CAAC;AACpD,UAAI,SAAS,QAAQ,SAAS,aAAa,CAAC,KAAK,QAAQ,CAAC,KAAK,KAAM;AAAA,IACvE;AACA,UAAM,mBAAmB,oCAAoC,OAAO;AACpE,UAAM,QAAQ,KAAK,KAAK,WAAW,UAAU,WAAW,CAAC,EAAE;AAC3D,QAAI,MAAM,OAAO,KAAK,KAAK,WAAW,OAAO,IAAI,CAAC,GAAG,KAAK,EAAE,KAAK,MAAM,MAAM,MAAM,KAAK,GAAG;AACzF,YAAM,GAAG,OAAO,EAAE,WAAW,MAAM,OAAO,KAAK,CAAC,EAAE,MAAM,MAAM,MAAS;AAAA,IACzE;AAAA,EACF;AACF;AA8BA,eAAe,mBAAmB,SAAiB,UAAkB,OAAiC;AACpG,MAAI;AACF,UAAM,MAAM,UAAU,EAAE,MAAM,iBAAiB,CAAC;AAAA,EAClD,SAAS,OAAO;AACd,QAAI,QAAQ,OAAO,QAAQ,EAAG,QAAO;AACrC,QAAI,CAAC,QAAQ,OAAO,QAAQ,EAAG,OAAM;AACrC,UAAM,MAAM,YAAY,OAAO,GAAG,EAAE,WAAW,MAAM,MAAM,iBAAiB,CAAC;AAC7E,WAAO;AAAA,EACT;AACA,QAAM,mBAAmB,+BAA+B,OAAO;AAC/D,QAAM,YAAY,KAAK,UAAU,YAAY;AAC7C,QAAM,SAAS,KAAK,QAAQ,QAAQ,GAAG,eAAe,KAAK,MAAM;AACjE,QAAM,QAAQ,GAAG,KAAK,UAAU,EAAE,KAAK,QAAQ,KAAK,YAAW,oBAAI,KAAK,GAAE,YAAY,GAAG,MAAM,GAAG,MAAM,CAAC,CAAC;AAAA;AAC1G,MAAI;AACF,UAAM,UAAU,QAAQ,OAAO,EAAE,UAAU,QAAQ,MAAM,mBAAmB,MAAM,KAAK,CAAC;AACxF,QAAI;AACF,YAAM,KAAK,QAAQ,SAAS;AAAA,IAC9B,SAAS,OAAO;AACd,UAAI,CAAC,eAAe,KAAK,EAAG,OAAM;AAClC,YAAM,UAAU,WAAW,OAAO,EAAE,UAAU,QAAQ,MAAM,mBAAmB,MAAM,KAAK,CAAC;AAAA,IAC7F;AACA,WAAO;AAAA,EACT,SAAS,OAAO;AACd,QAAI,QAAQ,OAAO,QAAQ,KAAK,QAAQ,OAAO,QAAQ,EAAG,QAAO;AAIjE,UAAM,MAAM,QAAQ,EAAE,MAAM,MAAM,MAAS;AAC3C,UAAM;AAAA,EACR,UAAE;AACA,UAAM,GAAG,QAAQ,EAAE,OAAO,KAAK,CAAC,EAAE,MAAM,MAAM,MAAS;AAAA,EACzD;AACF;AAUA,SAAS,eAAe,OAAyB;AAC/C,SAAO,OAAO,UAAU,YAAY,UAAU,QAAQ,UAAU,SAC9D,oBAAoB,IAAI,OAAQ,MAA6B,IAAI,CAAC;AACtE;AASA,eAAe,mBAAmB,SAAiB,UAAkB,OAA8B;AACjG,QAAM,YAAY,KAAK,UAAU,YAAY;AAC7C,QAAM,QAAQ,MAAM,SAA8B,SAAS,EAAE,MAAM,MAAM,IAAI;AAC7E,MAAI,OAAO,UAAU,MAAO;AAC5B,QAAM,GAAG,WAAW,EAAE,OAAO,KAAK,CAAC;AAMnC,QAAM,mBAAmB,+BAA+B,OAAO;AAC/D,QAAM,MAAM,QAAQ,EAAE,MAAM,MAAM,MAAS;AAC7C;AAQA,eAAe,yBAAyB,SAAgC;AACtE,MAAI,QAAQ,IAAI,aAAa,OAAQ;AAErC,QAAM,iBAAiB,QAAQ,IAAI,gCAAgC;AACnE,QAAM,iBAAiB,QAAQ,IAAI;AACnC,MAAI,CAAC,kBAAkB,CAAC,eAAgB;AAExC,QAAM,OAAO,QAAQ,cAAc;AACnC,QAAM,aAAa,QAAQ,cAAc;AACzC,QAAM,eAAe,SAAS,MAAM,UAAU;AAC9C,MACE,iBAAiB,MACjB,iBAAiB,QACjB,aAAa,WAAW,KAAK,QAAQ,aAAa,UAAU,OAAO,GAAG,EAAE,KACxE,aAAa,WAAW,KAAK,KAC7B,aAAa,WAAW,MAAM,GAC9B;AACA;AAAA,EACF;AAEA,QAAM,UAAU,YAAY,GAAG,OAAO;AAAA,GAAM,EAAE,UAAU,QAAQ,MAAM,KAAK,CAAC,EACzE,MAAM,MAAM,MAAS;AAC1B;AAqBA,eAAe,qBAAqB,SAAiB,UAAkB,cAAwC;AAC7G,MAAI;AACJ,MAAI;AACF,UAAM,EAAE,QAAQ,IAAI,MAAM,KAAK,QAAQ;AACvC,WAAO,KAAK,IAAI,IAAI,WAAW;AAAA,EACjC,QAAQ;AACN,WAAO;AAAA,EACT;AACA,QAAM,YAAY,YAAY,IAAI;AAClC,QAAM,mBAAmB,iCAAiC,OAAO;AACjE,MAAI;AACF,UAAM,UAAU,MAAM,QAAQ,QAAQ;AACtC,QAAI,QAAQ,SAAS,YAAY,EAAG,QAAO;AAC3C,UAAM,qBAAqB,QAAQ,SAAS,KAAK,QAAQ,MAAM,CAAC,UAAU,eAAe,KAAK,KAAK,CAAC;AACpG,QAAI,CAAC,uBAAuB,CAAC,QAAQ,eAAe,WAAW,YAAY,GAAI,QAAO;AACtF,eAAW,QAAQ,QAAQ,OAAO,CAAC,UAAU,eAAe,KAAK,KAAK,CAAC,GAAG;AACxE,YAAM,YAAY,KAAK,UAAU,IAAI;AACrC,UAAI,MAAM,qBAAqB,SAAS,GAAG;AAGzC,YAAI,CAAC,MAAM,OAAO,KAAK,UAAU,YAAY,CAAC,EAAG,OAAM,OAAO,WAAW,KAAK,UAAU,YAAY,CAAC;AACrG,eAAO;AAAA,MACT;AACA,YAAM,GAAG,WAAW,EAAE,OAAO,KAAK,CAAC;AAAA,IACrC;AACA,eAAW,QAAQ,QAAQ,OAAO,CAAC,UAAU,gBAAgB,KAAK,KAAK,CAAC,GAAG;AACzE,YAAM,GAAG,KAAK,UAAU,IAAI,GAAG,EAAE,OAAO,KAAK,CAAC;AAAA,IAChD;AACA,UAAM,MAAM,QAAQ;AAAA,EACtB,QAAQ;AACN,WAAO;AAAA,EACT;AACA,QAAM,qBAAqB,UAAU,YAAY;AACjD,SAAO;AACT;AAGA,eAAe,qBAAqB,WAAqC;AACvE,MAAI;AACJ,MAAI;AACF,eAAW,MAAM,SAAS,WAAW,MAAM;AAAA,EAC7C,SAAS,OAAO;AACd,QAAI,QAAQ,OAAO,QAAQ,EAAG,QAAO;AACrC,UAAM;AAAA,EACR;AACA,MAAI;AACJ,MAAI;AACF,YAAQ,KAAK,MAAM,QAAQ;AAAA,EAC7B,QAAQ;AACN,WAAO;AAAA,EACT;AACA,QAAM,MAAM,OAAO,UAAU,YAAY,UAAU,QAAQ,SAAS,QAAQ,MAAM,MAAM;AACxF,SAAO,OAAO,QAAQ,YAAY,OAAO,UAAU,GAAG,KAAK,MAAM,KAAK,eAAe,GAAG;AAC1F;AAOA,SAAS,eAAe,OAAe,cAA+B;AACpE,SAAO,YAAY,IAAI,IAAI,SAAS,eAAe;AACrD;AAmBA,eAAe,qBAAqB,UAAkB,cAAqC;AACzF,QAAM,YAAY,QAAQ,QAAQ;AAClC,QAAM,QAAQ,MAAM,QAAQ,SAAS,EAAE,MAAM,MAAM,CAAC,CAAC;AACrD,aAAW,QAAQ,MAAM,OAAO,CAAC,UAAU,aAAa,KAAK,KAAK,CAAC,GAAG;AACpE,UAAM,OAAO,KAAK,WAAW,IAAI;AACjC,UAAM,OAAO,MAAM,KAAK,IAAI,EAAE,KAAK,CAAC,EAAE,QAAQ,MAAM,KAAK,IAAI,IAAI,WAAW,cAAc,MAAM,KAAK;AACrG,QAAI,KAAM,OAAM,GAAG,MAAM,EAAE,OAAO,KAAK,CAAC,EAAE,MAAM,MAAM,MAAS;AAAA,EACjE;AACF;AA8BA,eAAe,iBAAiB,SAAiB,UAAkB,cAAwC;AACzG,QAAM,YAAY,KAAK,UAAU,YAAY;AAC7C,QAAM,WAAW,MAAM,SAAS,WAAW,MAAM,EAAE,MAAM,MAAM,IAAI;AACnE,MAAI,aAAa,KAAM,QAAO,qBAAqB,SAAS,UAAU,YAAY;AAClF,MAAI,CAAC,MAAM,iBAAiB,UAAU,WAAW,YAAY,EAAG,QAAO;AAEvE,QAAM,mBAAmB,gCAAgC,OAAO;AAChE,QAAM,YAAY,KAAK,UAAU,YAAY,WAAW,CAAC,OAAO;AAChE,MAAI,QAAQ;AACZ,MAAI;AACF,UAAM,KAAK,WAAW,SAAS;AAAA,EACjC,SAAS,OAAO;AAEd,QAAI,CAAC,eAAe,KAAK,EAAG,QAAO;AACnC,QAAI;AACF,YAAM,OAAO,WAAW,SAAS;AACjC,cAAQ;AAAA,IACV,QAAQ;AACN,aAAO;AAAA,IACT;AAAA,EACF;AACA,MAAI,MAAO,OAAM,mBAAmB,6BAA6B,OAAO;AACxE,QAAM,eAAe,MAAM,SAAS,WAAW,MAAM,EAAE,KAAK,CAAC,YAAY,YAAY,UAAU,MAAM,KAAK;AAC1G,QAAM,mBAAmB,gCAAgC,OAAO;AAChE,MAAI,CAAC,cAAc;AACjB,QAAI,OAAO;AAGT,YAAM,OAAO,WAAW,SAAS,EAAE,MAAM,MAAM,MAAS;AAAA,IAC1D,OAAO;AACL,YAAM,OAAO,SAAS,EAAE,MAAM,MAAM,MAAS;AAAA,IAC/C;AACA,WAAO;AAAA,EACT;AACA,MAAI,CAAC,MAAO,OAAM,GAAG,WAAW,EAAE,OAAO,KAAK,CAAC;AAC/C,QAAM,mBAAmB,6BAA6B,OAAO;AAC7D,QAAM,mBAAmB,+BAA+B,OAAO;AAE/D,aAAW,SAAS,MAAM,QAAQ,QAAQ,EAAE,MAAM,MAAM,CAAC,CAAC,GAAG,OAAO,CAAC,UAAU,eAAe,KAAK,KAAK,CAAC,GAAG;AAC1G,QAAI,KAAK,UAAU,IAAI,MAAM,UAAW,OAAM,GAAG,KAAK,UAAU,IAAI,GAAG,EAAE,OAAO,KAAK,CAAC;AAAA,EACxF;AAGA,MAAI,MAAM,OAAO,SAAS,EAAE,KAAK,MAAM,MAAM,MAAM,KAAK,EAAG,OAAM,MAAM,QAAQ,EAAE,MAAM,MAAM,MAAS;AACtG,QAAM,qBAAqB,UAAU,YAAY;AACjD,SAAO;AACT;AAUA,eAAe,iBAAiB,UAAkB,WAAmB,cAAwC;AAC3G,MAAI;AACJ,MAAI;AACF,YAAQ,KAAK,MAAM,QAAQ;AAAA,EAC7B,QAAQ;AACN,YAAQ;AAAA,EACV;AACA,MAAI,OAAO,UAAU,YAAY,UAAU,QAAQ,SAAS,OAAO;AACjE,WAAO,aAAa,OAAiD,YAAY;AAAA,EACnF;AACA,QAAM,aAAa,MAAM,KAAK,SAAS,EAAE,KAAK,CAAC,EAAE,QAAQ,MAAM,SAAS,MAAM,OAAO,GAAG;AACxF,SAAO,KAAK,IAAI,IAAI,cAAc;AACpC;AAGA,eAAe,mBAAmB,iBAAyB,SAAgC;AACzF,MAAI,QAAQ,IAAI,aAAa,OAAQ;AACrC,QAAM,mBAAmB,QAAQ,IAAI,eAAe;AACpD,MAAI,CAAC,iBAAkB;AACvB,QAAM,MAAM,kBAAkB,EAAE,WAAW,KAAK,CAAC;AACjD,QAAM,YAAY,KAAK,kBAAkB,SAAS,QAAQ,GAAG,IAAI,OAAO,EAAE;AAC1E,QAAM,UAAU,WAAW,WAAW,EAAE,UAAU,QAAQ,MAAM,KAAK,CAAC,EAAE,MAAM,MAAM,MAAS;AAC7F,QAAM,cAAc,KAAK,kBAAkB,SAAS;AACpD,SAAO,MAAM;AACX,QAAI;AACF,YAAM,SAAS,aAAa,MAAM;AAClC;AAAA,IACF,QAAQ;AACN,YAAM,MAAM,CAAC;AAAA,IACf;AAAA,EACF;AACF;AAEA,SAAS,aACP,OACA,cACS;AACT,QAAM,MAAM,KAAK,IAAI;AACrB,QAAM,YAAY,OAAO,OAAO,cAAc,WAC1C,KAAK,MAAM,MAAM,SAAS,IAC1B,OAAO;AAKX,MAAI,CAAC,OAAO,SAAS,SAAS,KAAK,MAAM,YAAY,aAAc,QAAO;AAC1E,MAAI,OAAO,OAAO,QAAQ,YAAY,CAAC,OAAO,UAAU,MAAM,GAAG,KAAK,MAAM,OAAO,GAAG;AACpF,WAAO;AAAA,EACT;AACA,SAAO,CAAC,eAAe,MAAM,GAAG;AAClC;AAGA,eAAe,OAAO,MAAgC;AACpD,MAAI;AACF,UAAM,KAAK,IAAI;AACf,WAAO;AAAA,EACT,SAAS,OAAO;AACd,QAAI,QAAQ,OAAO,QAAQ,KAAK,QAAQ,OAAO,SAAS,EAAG,QAAO;AAClE,UAAM;AAAA,EACR;AACF;AAEA,SAAS,eAAe,KAAsB;AAC5C,MAAI;AACF,YAAQ,KAAK,KAAK,CAAC;AACnB,WAAO;AAAA,EACT,SAAS,OAAO;AACd,WAAO,CAAC,QAAQ,OAAO,OAAO;AAAA,EAChC;AACF;AAEA,SAAS,oBAAoB,SAAyB;AACpD,MACE,CAAC,WACD,YAAY,OACZ,YAAY,QACZ,QAAQ,SAAS,GAAG,KACpB,QAAQ,SAAS,IAAI,KACrB,QAAQ,SAAS,IAAI,GACrB;AACA,UAAM,IAAI,UAAU,gDAAgD;AAAA,EACtE;AACA,SAAO;AACT;AAEA,SAAS,QAAQ,OAAgB,MAAuB;AACtD,SAAO,OAAO,UAAU,YAAY,UAAU,QAAQ,UAAU,SAC7D,MAA6B,SAAS;AAC3C;AAEA,SAAS,MAAM,cAAqC;AAClD,SAAO,IAAI,QAAQ,CAACC,aAAY,WAAWA,UAAS,YAAY,CAAC;AACnE;AAl2CA,IAmBM,iBACA,yBACA,uBACA,uBACA,kCAEA,mBACA,kBACA,gCACA,iCACA,+BACA,+BACA,6BACA,+BACA,gCACA,6BACA,oCACA,mCACA,oCA2BA,qBAEA,kBAsBO,yBAgBA,qBAgeP,MAxkBN,IAulBM,mBAKA,wBAEA,iBACA,gBA0aA,qBA8IA,iBAOA,gBAEA;AAhqCN;AAAA;AAAA;AAmBA,IAAM,kBAAkB;AACxB,IAAM,0BAA0B;AAChC,IAAM,wBAAwB;AAC9B,IAAM,wBAAwB;AAC9B,IAAM,mCAAmC;AAEzC,IAAM,oBAAoB;AAC1B,IAAM,mBAAmB;AACzB,IAAM,iCAAiC;AACvC,IAAM,kCAAkC;AACxC,IAAM,gCAAgC;AACtC,IAAM,gCAAgC;AACtC,IAAM,8BAA8B;AACpC,IAAM,gCAAgC;AACtC,IAAM,iCAAiC;AACvC,IAAM,8BAA8B;AACpC,IAAM,qCAAqC;AAC3C,IAAM,oCAAoC;AAC1C,IAAM,qCAAqC;AA2B3C,IAAM,sBAAsB,mBAA2B,6CAA6C;AAEpG,IAAM,mBAAmB,mBAA+C,0CAA0C;AAsB3G,IAAM,0BAAN,cAAsC,MAAM;AAAA;AAAA,MAIjD,YAAY,SAAiB,WAAmB,QAAiB;AAC/D,cAAM,+CAA+C,OAAO,WAAW,SAAS,MAAM,SAAS,IAAI,MAAM,KAAK,EAAE,EAAE;AAJpH,aAAS,OAAO;AAKd,aAAK,OAAO;AAAA,MACd;AAAA,IACF;AAQO,IAAM,sBAAN,cAAkC,MAAM;AAAA,MAG7C,YAAY,SAAiB;AAC3B,cAAM,YAAY,OAAO,qFAAqF;AAHhH,aAAS,OAAO;AAId,aAAK,OAAO;AAAA,MACd;AAAA,IACF;AAydA,IAAM,OAAO;AAeb,IAAM,oBACH,gBAAkE,uBAAO,IAAI,kDAAkD,OAA/H,iBACC,oBAAI,IAAY;AAGpB,IAAM,yBAAyB,CAAC,IAAI,IAAI,GAAG;AAE3C,IAAM,kBAAkB;AACxB,IAAM,iBAAiB;AA0avB,IAAM,sBAAsB,oBAAI,IAAI,CAAC,SAAS,WAAW,cAAc,UAAU,UAAU,QAAQ,CAAC;AA8IpG,IAAM,kBAAkB;AAOxB,IAAM,iBAAiB;AAEvB,IAAM,eAAe;AAAA;AAAA;;;AChqCrB,SAAS,cAAAC,mBAAkB;AAG3B,SAAS,SAAS;AAuJX,SAAS,kCAAkC,OAA2C;AAC3F,SAAO,gCAAgC,MAAM,KAAK;AACpD;AAeA,SAAS,iCACP,OACA,SAC2B;AAC3B,MAAI,UAAU,MAAM,UAAU,MAAM,UAAU,QAAQ,UAAU,GAAG;AACjE,UAAM,IAAI,UAAU,0DAA0D;AAAA,EAChF;AACA,QAAM,YAAY,QAAQ,OAAO,oBAAI,KAAK;AAC1C,MAAI,OAAO,MAAM,UAAU,QAAQ,CAAC,GAAG;AACrC,UAAM,IAAI,UAAU,2DAA2D;AAAA,EACjF;AACA,SAAO;AAAA,IACL,MAAM;AAAA,IACN,SAAS;AAAA,IACT,WAAW,MAAM;AAAA,IACjB,WAAW,UAAU,YAAY;AAAA,IACjC,SAAS,QAAQ;AAAA,IACjB,SAAS,QAAQ;AAAA,IACjB,cAAc,QAAQ;AAAA,IACtB,MAAM,QAAQ;AAAA,IACd,YAAY,QAAQ;AAAA,IACpB,GAAI,QAAQ,aAAa,SAAY,CAAC,IAAI,EAAE,UAAU,QAAQ,SAAS;AAAA,IACvE,GAAI,QAAQ,YAAY,SAAY,CAAC,IAAI,EAAE,SAAS,QAAQ,QAAQ;AAAA,IACpE,GAAI,MAAM,oBAAoB,SAAY,CAAC,IAAI,EAAE,iBAAiB,MAAM,gBAAgB;AAAA,IACxF,WAAW,yBAAyB,MAAM,SAAS;AAAA,EACrD;AACF;AAEA,SAAS,UAAU,OAAuB;AACxC,SAAO,MAAM,MAAM,KAAK,CAAC,EAAE,CAAC;AAC9B;AAMO,SAAS,gCAAgC,OAA+C;AAC7F,SAAO,KAAK,UAAU;AAAA,IACpB,SAAS,MAAM;AAAA,IACf,YAAY,MAAM;AAAA,IAClB,MAAM,MAAM;AAAA,IACZ,SAAS,yBAAyB,MAAM,OAAO;AAAA,EACjD,CAAC;AACH;AAGO,SAAS,+BACd,OAC2B;AAC3B,QAAM,MAAM,MAAM,QAAQ,MAAM,oBAAI,KAAK;AACzC,QAAM,YAAY,IAAI;AACtB,MAAI,OAAO,MAAM,UAAU,QAAQ,CAAC,EAAG,OAAM,IAAI,UAAU,8CAA8C;AACzG,QAAM,YAAY,yBAAyB,MAAM,OAAO;AACxD,MAAI,UAAU,WAAW,EAAG,OAAM,IAAI,UAAU,8DAA8D;AAE9G,SAAO,kCAAkC;AAAA,IACvC,MAAM;AAAA,IACN,SAAS;AAAA,IACT,WAAW,MAAM,kBAAkB,KAAK,iBAAiB,SAAS;AAAA,IAClE,WAAW,UAAU,YAAY;AAAA,IACjC,SAAS,MAAM;AAAA,IACf,SAAS,MAAM;AAAA,IACf,cAAc,MAAM;AAAA,IACpB,MAAM,MAAM;AAAA,IACZ,YAAY,MAAM;AAAA,IAClB,GAAI,MAAM,aAAa,SAAY,EAAE,UAAU,MAAM,SAAS,IAAI,CAAC;AAAA,IACnE,GAAI,MAAM,YAAY,SAAY,EAAE,SAAS,MAAM,QAAQ,IAAI,CAAC;AAAA,IAChE,GAAI,MAAM,oBAAoB,SAAY,EAAE,iBAAiB,MAAM,gBAAgB,IAAI,CAAC;AAAA,IACxF;AAAA,IACA,GAAI,MAAM,YAAY,SAClB,EAAE,SAAS,EAAE,MAAM,CAAC,GAAG,MAAM,QAAQ,IAAI,GAAG,KAAK,MAAM,QAAQ,IAAI,EAAE,IACrE,CAAC;AAAA,EACP,CAAC;AACH;AAGA,eAAsB,uBACpB,SACA,SACsC;AACtC,QAAM,UAAuC,CAAC;AAC9C,aAAW,SAAS,MAAM,iBAA0B,OAAO,GAAG;AAC5D,UAAM,YAAY,gCAAgC,UAAU,KAAK;AACjE,QAAI,UAAU,SAAS;AACrB,UAAI,YAAY,UAAa,UAAU,UAAU,KAAK,UAAU,MAAM,UAAU,QAAQ,UAAU,GAAG;AACnG;AAAA,MACF;AACA,cAAQ,KAAK,UAAU,IAAI;AAC3B;AAAA,IACF;AACA,UAAM,SAAS,sCAAsC,UAAU,KAAK;AACpE,QAAI,CAAC,OAAO,QAAS,OAAM,IAAI,UAAU,wCAAwC;AACjF,QAAI,YAAY,QAAW;AACzB,YAAM,IAAI,UAAU,oEAAoE;AAAA,IAC1F;AACA,QAAI,UAAU,OAAO,KAAK,UAAU,MAAM,UAAU,QAAQ,UAAU,EAAG;AACzE,YAAQ,KAAK,iCAAiC,OAAO,MAAM,OAAO,CAAC;AAAA,EACrE;AACA,SAAO;AACT;AAEA,eAAsB,sBACpB,SACA,WACA,UAE2C;AAC3C,QAAM,UAAU,MAAM,uBAAuB,SAAS;AAAA,IACpD;AAAA,IACA,MAAM,SAAS;AAAA,IACf,YAAY,SAAS;AAAA,IACrB,SAAS,SAAS,WAAW;AAAA,IAC7B,cAAc,SAAS,gBAAgB;AAAA,IACvC,GAAI,SAAS,aAAa,SAAY,CAAC,IAAI,EAAE,UAAU,SAAS,SAAS;AAAA,IACzE,GAAI,SAAS,YAAY,SAAY,CAAC,IAAI,EAAE,SAAS,SAAS,QAAQ;AAAA,EACxE,CAAC;AACD,SAAO,QAAQ;AAAA,IAAK,CAAC,WACnB,OAAO,cAAc,aACrB,OAAO,eAAe,SAAS,cAC/B,OAAO,SAAS,SAAS;AAAA,EAC3B,KAAK;AACP;AAOA,eAAsB,+BACpB,OACsC;AAItC,QAAM,UAAU,MAAM,iBAAiB,SACnC,kBAAkB,MAAM,SAAS,MAAM,OAAO,EAAE,UAChD,yBAAyB,MAAM,OAAO;AAC1C,QAAM,MAAM,MAAM,QAAQ,MAAM,oBAAI,KAAK;AACzC,QAAM,cAAc,IAAI;AACxB,MAAI,OAAO,MAAM,YAAY,QAAQ,CAAC,EAAG,OAAM,IAAI,UAAU,8CAA8C;AAE3G,SAAO;AAAA,IACL,MAAM;AAAA,IACN;AAAA,IACA,CAAC,eAAe;AACd,YAAM,UAAuC,CAAC;AAC9C,iBAAW,SAAS,YAAY;AAC9B,cAAM,YAAY,gCAAgC,UAAU,KAAK;AACjE,YAAI,UAAU,SAAS;AACrB,cAAI,UAAU,UAAU,KAAK,UAAU,MAAM,UAAU,MAAM,UAAU,EAAG;AAC1E,kBAAQ,KAAK,UAAU,IAAI;AAC3B;AAAA,QACF;AACA,cAAM,SAAS,sCAAsC,UAAU,KAAK;AACpE,YAAI,CAAC,OAAO,QAAS,OAAM,IAAI,UAAU,wCAAwC;AACjF,YAAI,UAAU,OAAO,KAAK,UAAU,MAAM,UAAU,MAAM,UAAU,EAAG;AACvE,gBAAQ,KAAK,iCAAiC,OAAO,MAAM;AAAA,UACzD,SAAS,MAAM;AAAA,UACf,MAAM,MAAM;AAAA,UACZ,YAAY,MAAM;AAAA,UAClB,SAAS,MAAM;AAAA,UACf,cAAc,MAAM;AAAA,UACpB,GAAI,MAAM,aAAa,SAAY,CAAC,IAAI,EAAE,UAAU,MAAM,SAAS;AAAA,UACnE,GAAI,MAAM,YAAY,SAAY,CAAC,IAAI,EAAE,SAAS,MAAM,QAAQ;AAAA,UAChE,KAAK;AAAA,QACP,CAAC,CAAC;AAAA,MACJ;AACA,YAAM,WAAW,wBAAwB,SAAS;AAAA,QAChD,SAAS,MAAM;AAAA,QACf,YAAY,MAAM;AAAA,QAClB,SAAS,MAAM;AAAA,QACf,cAAc,MAAM;AAAA,QACpB,KAAK;AAAA,MACP,CAAC;AAED,UAAI,QAAQ,WAAW,GAAG;AACxB,eAAO,EAAE,SAAS,UAAU,QAAQ,EAAE,QAAQ,aAAa,QAAQ,MAAM,EAAE;AAAA,MAC7E;AAEA,YAAM,WAAW,gCAAgC,EAAE,GAAG,OAAO,QAAQ,CAAC;AACtE,YAAM,oBAAoB,SAAS,OAAO,CAAC,WAAW,CAAC,eAAe,QAAQ,OAAO,OAAO,CAAC;AAC7F,YAAM,aAAa,wBAAwB,mBAAmB,QAAQ;AACtE,UAAI,eAAe,UAAa,MAAM,YAAY,MAAM;AACtD,eAAO,EAAE,SAAS,mBAAmB,QAAQ,EAAE,QAAQ,WAAW,QAAQ,MAAM,SAAS,WAAW,EAAE;AAAA,MACxG;AAEA,YAAM,OAAO,kBAAkB;AAAA,QAAO,CAAC,WACrC,MAAM,YAAY,QAAQ,kCAAkC,MAAM,MAAM;AAAA,MAC1E;AACA,YAAM,UAAU,+BAA+B,EAAE,GAAG,OAAO,SAAS,KAAK,MAAM,YAAY,CAAC;AAC5F,aAAO;AAAA,QACL,SAAS,CAAC,GAAG,MAAM,OAAO;AAAA,QAC1B,QAAQ,EAAE,QAAQ,WAAW,QAAQ,OAAO,QAAQ;AAAA,MACtD;AAAA,IACF;AAAA,EACF;AACF;AAWO,SAAS,wBACd,SACA,OAC6B;AAC7B,QAAM,SAAS,MAAM,IAAI,QAAQ,IAAI;AACrC,SAAO,QAAQ,OAAO,CAAC,WAAW;AAChC,UAAM,YAAY,KAAK,MAAM,OAAO,SAAS;AAC7C,QAAI,CAAC,OAAO,SAAS,SAAS,KAAK,YAAY,OAAQ,QAAO;AAC9D,QAAI,OAAO,YAAY,MAAM,WAAW,UAAU,OAAO,UAAU,MAAM,UAAU,MAAM,UAAU,EAAG,QAAO;AAI7G,QAAI,OAAO,UAAU,WAAW,EAAG,QAAO;AAC1C,WAAO,CAAC;AAAA,MACN,MAAM;AAAA,MACN,OAAO;AAAA,MACP,MAAM;AAAA,IACR,EAAE;AAAA,EACJ,CAAC;AACH;AAEA,SAAS,wBACP,SACA,UACuC;AACvC,MAAI;AACJ,aAAW,UAAU,SAAS;AAC5B,QAAI,kCAAkC,MAAM,MAAM,SAAU;AAC5D,QAAI,WAAW,UAAa,OAAO,aAAa,OAAO,UAAW,UAAS;AAAA,EAC7E;AACA,SAAO;AACT;AAEA,SAAS,eACP,QACA,OACA,SACS;AACT,MACE,OAAO,YAAY,MAAM,WACzB,OAAO,eAAe,MAAM,cAC5B,OAAO,SAAS,MAAM,MACtB;AACA,WAAO;AAAA,EACT;AACA,QAAM,YAAY;AAAA,IAChB,MAAM;AAAA,IACN,OAAO;AAAA,IACP,MAAM;AAAA,EACR,EAAE;AACF,SAAO,UAAU,SAAS,KACxB,kCAAkC,MAAM,MACtC,gCAAgC,EAAE,GAAG,OAAO,QAAQ,CAAC,KACvD,gCAAgC,EAAE,GAAG,OAAO,SAAS,UAAU,CAAC,MAC9D,gCAAgC,EAAE,GAAG,OAAO,QAAQ,CAAC;AAC3D;AAEA,SAAS,kCAAkC,QAA2C;AACpF,SAAO,gCAAgC;AAAA,IACrC,SAAS,OAAO;AAAA,IAChB,YAAY,OAAO;AAAA,IACnB,MAAM,OAAO;AAAA,IACb,SAAS,OAAO;AAAA,EAClB,CAAC;AACH;AAEA,SAAS,0BACP,SACA,UACAC,eACA;AACA,SAAOA,kBAAiB,SACpB,kBAAkB,SAAS,QAAQ,IACnC,2BAA2B,SAAS,UAAUA,aAAY;AAChE;AAEA,SAAS,iBAAiB,KAAmB;AAC3C,SAAO,OAAO,IAAI,QAAQ,EAAE,SAAS,EAAE,CAAC,IAAID,YAAW,EAAE,QAAQ,MAAM,EAAE,CAAC;AAC5E;AAxcA,IAmBM,gBAGO,uBAWP,eAKA,uCASA,0BAiBO,iCAkBA,gCAkBA;AApGb;AAAA;AAAA;AAKA;AAUA;AAEA;AAEA,IAAM,iBAAiB,KAAK,KAAK,KAAK,KAAK;AAGpC,IAAM,wBAAwB,EAAE,OAAO;AAAA,MAC5C,SAAS,EAAE,OAAO,EAAE,IAAI,CAAC;AAAA,MACzB,OAAO,EAAE,OAAO,EAAE,IAAI,CAAC,EAAE,SAAS;AAAA,MAClC,MAAM,EAAE,OAAO;AAAA,MACf,SAAS,EAAE,MAAM,EAAE,OAAO,EAAE,IAAI,CAAC,CAAC,EAAE,IAAI,CAAC;AAAA,MACzC,SAAS,EAAE,MAAM,EAAE,OAAO,EAAE,QAAQ,CAAC,CAAC,EAAE,SAAS;AAAA,MACjD,YAAY,EAAE,QAAQ,EAAE,SAAS;AAAA,MACjC,QAAQ,EAAE,OAAO,EAAE,IAAI,CAAC,EAAE,SAAS;AAAA,MACnC,aAAa,EAAE,OAAO,EAAE,SAAS;AAAA,IACnC,CAAC,EAAE,OAAO;AAEV,IAAM,gBAAgB,EAAE,OAAO;AAAA,MAC7B,MAAM,EAAE,MAAM,EAAE,OAAO,CAAC,EAAE,IAAI,CAAC;AAAA,MAC/B,KAAK,EAAE,OAAO,EAAE,IAAI,CAAC;AAAA,IACvB,CAAC,EAAE,OAAO;AAEV,IAAM,wCAAwC,EAAE,OAAO;AAAA,MACrD,MAAM,EAAE,QAAQ,wBAAwB;AAAA,MACxC,SAAS,EAAE,QAAQ,CAAC;AAAA,MACpB,WAAW,EAAE,OAAO;AAAA,MACpB,YAAY,EAAE,OAAO,EAAE,IAAI,CAAC;AAAA,MAC5B,WAAW,EAAE,MAAM,qBAAqB;AAAA,MACxC,iBAAiB,EAAE,MAAM,CAAC,EAAE,OAAO,GAAG,EAAE,OAAO,EAAE,OAAO,CAAC,CAAC,EAAE,SAAS;AAAA,IACvE,CAAC,EAAE,OAAO;AAEV,IAAM,2BAA+D,EAAE,KAAK,MAAM,EAAE,OAAO;AAAA,MACzF,KAAK,EAAE,OAAO,EAAE,IAAI,CAAC;AAAA,MACrB,SAAS,EAAE,OAAO,EAAE,IAAI,CAAC;AAAA,MACzB,MAAM,EAAE,OAAO;AAAA,MACf,SAAS,EAAE,MAAM,EAAE,OAAO,EAAE,IAAI,CAAC,CAAC,EAAE,IAAI,CAAC;AAAA,MACzC,aAAa,EAAE,OAAO,EAAE,IAAI,CAAC;AAAA,MAC7B,cAAc,EAAE,OAAO,EAAE,IAAI,CAAC;AAAA,MAC9B,SAAS,EAAE,OAAO,EAAE,IAAI,EAAE,SAAS;AAAA,MACnC,QAAQ,EAAE,MAAM,CAAC,EAAE,OAAO,EAAE,SAAS,EAAE,QAAQ,KAAK,CAAC,GAAG,EAAE,KAAK,CAAC,CAAC;AAAA,MACjE,kBAAkB,EAAE,OAAO,EAAE,eAAe,EAAE,OAAO,EAAE,IAAI,CAAC,EAAE,CAAC,EAAE,OAAO;AAAA,MACxE,MAAM,EAAE,OAAO,EAAE,IAAI,CAAC,EAAE,SAAS;AAAA,MACjC,sBAAsB,EAAE,QAAQ,EAAE,SAAS;AAAA,MAC3C,kBAAkB,yBAAyB,SAAS;AAAA,MACpD,WAAW,EAAE,MAAM,qBAAqB,EAAE,SAAS;AAAA,IACrD,CAAC,EAAE,YAAY,CAAC;AAGT,IAAM,kCAAkC,EAAE,OAAO;AAAA,MACtD,MAAM,EAAE,QAAQ,wBAAwB;AAAA,MACxC,SAAS,EAAE,QAAQ,CAAC;AAAA,MACpB,WAAW,EAAE,OAAO,EAAE,IAAI,CAAC;AAAA,MAC3B,WAAW,EAAE,OAAO,EAAE,SAAS,EAAE,QAAQ,KAAK,CAAC;AAAA,MAC/C,SAAS,EAAE,OAAO,EAAE,IAAI,CAAC;AAAA,MACzB,SAAS,EAAE,KAAK,CAAC,iBAAiB,oBAAoB,mBAAmB,iBAAiB,CAAC;AAAA,MAC3F,cAAc,EAAE,KAAK,CAAC,SAAS,OAAO,CAAC;AAAA,MACvC,MAAM,EAAE,OAAO,EAAE,IAAI,CAAC;AAAA,MACtB,YAAY,EAAE,OAAO,EAAE,IAAI,CAAC;AAAA,MAC5B,UAAU,EAAE,OAAO,EAAE,IAAI,CAAC,EAAE,SAAS;AAAA,MACrC,SAAS,EAAE,OAAO,EAAE,IAAI,CAAC,EAAE,SAAS;AAAA,MACpC,iBAAiB,EAAE,MAAM,CAAC,EAAE,OAAO,EAAE,IAAI,CAAC,GAAG,EAAE,OAAO,EAAE,OAAO,CAAC,CAAC,EAAE,SAAS;AAAA,MAC5E,WAAW,EAAE,MAAM,qBAAqB;AAAA,MACxC,SAAS,cAAc,SAAS;AAAA,IAClC,CAAC,EAAE,OAAO;AAGH,IAAM,iCAAiC,EAAE,OAAO;AAAA,MACrD,MAAM,EAAE,QAAQ,2BAA2B;AAAA,MAC3C,SAAS,EAAE,QAAQ,CAAC;AAAA,MACpB,WAAW,EAAE,OAAO,EAAE,IAAI,CAAC;AAAA,MAC3B,eAAe,EAAE,OAAO,EAAE,IAAI,CAAC,EAAE,SAAS;AAAA,MAC1C,YAAY;AAAA;AAAA;AAAA,MAGZ,aAAa,EAAE,MAAM,qBAAqB,EAAE,SAAS;AAAA,MACrD,QAAQ,EAAE,OAAO,EAAE,SAAS,EAAE,QAAQ,KAAK,CAAC,EAAE,SAAS;AAAA,MACvD,UAAU,EAAE,QAAQ,EAAE,SAAS;AAAA,IACjC,CAAC,EAAE,OAAO;AAOH,IAAM,iCAAiC,gCAC3C,KAAK,EAAE,WAAW,MAAM,WAAW,KAAK,CAAC,EACzC,OAAO;AAAA;AAAA;;;ACpGV,YAAY,aAAa;AAuBlB,SAAS,yBACd,OACiB;AACjB,QAAM,YAAY,uBAAuB,KAAK;AAC9C,SAAO;AAAA,IACL,MAAM,UAAU;AAAA,IAChB,GAAI,UAAU,UAAU,SAAY,CAAC,IAAI,EAAE,OAAO,UAAU,MAAM;AAAA;AAAA;AAAA;AAAA,IAIlE,GAAI,MAAM,UAAU,SAAY,CAAC,IAAI,EAAE,OAAO,UAAU,MAAM;AAAA,EAChE;AACF;AAGO,SAAS,uBACd,OACiB;AACjB,QAAM,OAAO,MAAM,KAAK,KAAK;AAC7B,MAAI,CAACE,gBAAe,KAAK,IAAI,GAAG;AAC9B,UAAM,mBAAmB;AAAA,EAC3B;AAEA,QAAM,QAAQ,wBAAwB,MAAM,KAAK;AACjD,QAAM,QAAQ,sBAAsB,MAAM,KAAK;AAC/C,QAAM,WAAW,UAAU,SACvB,WAAW,IAAI,KACf,kBAAkB,KAAK,IAAI,IAAI;AAEnC,SAAO;AAAA,IACL;AAAA,IACA,GAAI,UAAU,SAAY,CAAC,IAAI,EAAE,MAAM;AAAA,IACvC;AAAA,IACA;AAAA,IACA,gBAAgB,SAAS,QAAQ;AAAA,EACnC;AACF;AAOO,SAAS,mCACd,OACA,MACA,YACiB;AACjB,QAAM,YAAY,uBAAuB,KAAK;AAC9C,MAAI,MAAM,UAAU,UAAa,eAAe,OAAW,QAAO;AAClE,SAAO;AAAA,IACL,GAAG;AAAA,IACH,OAAO,sBAAsB,UAAU,OAAO,MAAM,UAAU;AAAA,EAChE;AACF;AAGO,SAAS,uBACd,MACA,YAC2B;AAC3B,SAAO,CAAC,UAAU,sBAAsB,OAAO,MAAM,UAAU;AACjE;AAEA,SAAS,sBAAsB,OAAe,MAAe,YAA6B;AACxF,MAAI,MAAM,WAAW,YAAY,EAAG,QAAO,qBAAqB,KAAK;AAErE,QAAM,eAAe,eAAe,SAAY,SAAY,kBAAkB,YAAY,KAAK;AAC/F,MAAI,iBAAiB,OAAW,QAAO,qBAAqB,YAAY;AAExE,QAAM,YAAY;AAMlB,MAAI;AACF,UAAM,WAAW,UAAU,oBAAoB,KAAK;AACpD,QAAI,OAAO,aAAa,YAAY,SAAS,SAAS,GAAG;AACvD,aAAO,qBAAqB,QAAQ;AAAA,IACtC;AAAA,EACF,QAAQ;AAAA,EAER;AAKA,MAAI,OAAO,UAAU,YAAY,UAAU;AACzC,UAAM,WAAW,kBAAkB,UAAU,SAAS,KAAK;AAC3D,QAAI,aAAa,OAAW,QAAO,qBAAqB,QAAQ;AAAA,EAClE;AAEA,QAAM,MAAM,OAAO,UAAU,QAAQ,WAAW,UAAU,MAAM;AAChE,QAAM,MAAM,QAAQ,SAAY,OAAe,oBAAY,GAAG;AAC9D,MAAI,QAAQ,MAAM;AAChB,UAAM,mBAAmB;AAAA,EAC3B;AACA,SAAe,uBAAe,IAAI,SAAS,IAAI,SAAS,KAAK;AAC/D;AAEA,SAAS,kBAAkB,YAAoB,MAAkC;AAC/E,QAAM,SAAiB,sBAAc,UAAU;AAC/C,MAAI,WAAW,KAAM,QAAO;AAC5B,MAAI;AACF,UAAM,MAAc,oBAAY,OAAO,KAAK;AAC5C,WAAO,QAAQ,OAAO,SAAoB,uBAAe,IAAI,SAAS,IAAI,SAAS,IAAI;AAAA,EACzF,QAAQ;AACN,WAAO;AAAA,EACT;AACF;AAEA,SAAS,qBAAqB,OAAuB;AACnD,QAAM,QAAQ,MAAM,MAAM,GAAG;AAC7B,QAAM,OAAO,MAAM,GAAG,EAAE;AACxB,MAAI,MAAM,SAAS,KAAK,SAAS,UAAa,SAAS,IAAI;AACzD,UAAM,mBAAmB;AAAA,EAC3B;AAIA,QAAM,MAAM,MAAM;AAAA,IAChB;AAAA,EACF;AACA,MAAI,QAAQ,MAAM;AAChB,WAAO,wBAAwB,IAAI,CAAC,CAAC,IAAY,4BAAoB,IAAI,CAAC,CAAE,EAAE,YAAY,CAAC,IAAI,IAAI,CAAC,CAAC;AAAA,EACvG;AACA,SAAO;AACT;AAMO,SAAS,oBAAoB,WAAoC;AACtE,QAAM,aAAa;AAAA,IACjB,CAAC,UAAU,UAAU,IAAI;AAAA,IACzB,GAAI,UAAU,UAAU,SAAY,CAAC,IAAI,CAAC,CAAC,SAAS,UAAU,KAAK,CAAU;AAAA,IAC7E,CAAC,SAAS,UAAU,KAAK;AAAA,EAC3B;AACA,QAAM,QAAQ,WACX,IAAI,CAAC,CAAC,KAAK,KAAK,MAAM,GAAG,mBAAmB,GAAG,CAAC,IAAI,mBAAmB,KAAK,CAAC,EAAE,EAC/E,KAAK,GAAG;AACX,SAAO,GAAG,uBAAuB,QAAQ,KAAK;AAChD;AAEA,SAAS,wBAAwB,OAA+C;AAC9E,MAAI,UAAU,UAAa,UAAU,GAAI,QAAO;AAEhD,QAAM,UAAU,MAAM,KAAK;AAC3B,MAAI,YAAY,GAAI,OAAM,mBAAmB;AAE7C,QAAM,YAAY,QACf,YAAY,EACZ,QAAQ,eAAe,GAAG,EAC1B,QAAQ,OAAO,GAAG,EAClB,QAAQ,UAAU,EAAE;AACvB,MAAI,cAAc,MAAM,uBAAuB,IAAI,SAAS,GAAG;AAC7D,UAAM,mBAAmB;AAAA,EAC3B;AACA,SAAO;AACT;AAEA,SAAS,sBAAsB,OAAmC;AAChE,MAAI,UAAU,UAAa,UAAU,GAAI,QAAO;AAEhD,MAAI,MAAM,WAAW,YAAY,GAAG;AAClC,UAAM,QAAQ,MAAM,MAAM,GAAG;AAC7B,QAAI,MAAM,SAAS,KAAK,MAAM,GAAG,EAAE,MAAM,UAAa,MAAM,GAAG,EAAE,MAAM,IAAI;AACzE,YAAM,mBAAmB;AAAA,IAC3B;AACA,WAAO,aAAa,MAAM,MAAM,GAAG,EAAE,EAAE,KAAK,GAAG,CAAC,IAAI,MAAM,GAAG,EAAE,CAAC;AAAA,EAClE;AAEA,MAAI,CAAC,mBAAmB,KAAK,KAAK,EAAG,OAAM,mBAAmB;AAC9D,SAAO;AACT;AAEA,SAAS,qBAA+C;AACtD,SAAO,IAAI;AAAA,IACT,eAAe,iBAAiB,kCAAkC;AAAA,EACpE;AACF;AA/MA,IAMM,uBACA,yBACAA,iBACA;AATN;AAAA;AAAA;AAIA;AAEA,IAAM,wBAAwB;AAC9B,IAAM,0BAA0B;AAChC,IAAMA,kBAAiB;AACvB,IAAM,yBAAyB,oBAAI,IAAI,CAAC,WAAW,QAAQ,CAAC;AAAA;AAAA;;;ACT5D,YAAYC,cAAa;AAMzB,SAAS,KAAAC,UAAS;AAgMlB,eAAe,sBACb,SACA,OACuD;AACvD,QAAM,aAAa,QAAQ,QAAQ;AACnC,MAAI,eAAe,OAAW,QAAO,eAAe;AAEpD,MAAI,eAAe,OAAO;AACxB,QAAI;AACF,YAAM,UAAU,MAAM,sBAAsB,QAAQ,QAAQ,SAAS,MAAM,WAAW;AAAA,QACpF;AAAA,QACA,MAAM,QAAQ,QAAQ;AAAA,QACtB,SAAS,QAAQ,QAAQ;AAAA,QACzB,cAAc,QAAQ,QAAQ,gBAAgB;AAAA,QAC9C,GAAI,QAAQ,QAAQ,aAAa,SAAY,CAAC,IAAI,EAAE,UAAU,QAAQ,QAAQ,SAAS;AAAA,QACvF,GAAI,QAAQ,QAAQ,UAAU,SAAY,CAAC,IAAI,EAAE,SAAS,QAAQ,QAAQ,MAAM;AAAA,MAClF,CAAC;AACD,UAAI,YAAY,MAAM;AACpB,eAAO,aAAa,oEAAoE;AAAA,MAC1F;AACA,UAAI,QAAQ,YAAY,QAAQ,QAAQ,SAAS;AAC/C,eAAO,aAAa,oEAAoE;AAAA,MAC1F;AACA,YAAM,WAAW,kBAAkB,QAAQ,SAAS;AACpD,UAAI,aAAa,QAAW;AAC1B,eAAO;AAAA,UACL;AAAA,UACA;AAAA,QACF;AAAA,MACF;AACA,YAAM,aAAa;AAAA,QACjB,QAAQ,QAAQ;AAAA,QAChB;AAAA,MACF;AACA,UAAI,WAAW,WAAW;AACxB,eAAO,EAAE,QAAQ,MAAM,QAAQ,EAAE,SAAS,CAAC,EAAE,EAAE;AAAA,MACjD;AACA,YAAM,WAAW,MAAM,+BAA+B;AAAA,QACpD,SAAS,QAAQ,QAAQ;AAAA,QACzB,SAAS,QAAQ,QAAQ;AAAA,QACzB,cAAc,QAAQ,QAAQ,gBAAgB;AAAA,QAC9C,MAAM,QAAQ,QAAQ;AAAA,QACtB;AAAA,QACA,GAAI,QAAQ,QAAQ,aAAa,SAAY,CAAC,IAAI,EAAE,UAAU,QAAQ,QAAQ,SAAS;AAAA,QACvF,GAAI,QAAQ,QAAQ,UAAU,SAAY,CAAC,IAAI,EAAE,SAAS,QAAQ,QAAQ,MAAM;AAAA,QAChF,SAAS,WAAW;AAAA,QACpB,SAAS,QAAQ,QAAQ;AAAA,MAC3B,CAAC;AACD,UAAI,SAAS,WAAW,YAAa,QAAO,EAAE,QAAQ,MAAM,QAAQ,EAAE,SAAS,CAAC,EAAE,EAAE;AACpF,aAAO,EAAE,QAAQ,MAAM,QAAQ,EAAE,SAAS,WAAW,SAAS,SAAS,SAAS,QAAQ,EAAE;AAAA,IAC5F,QAAQ;AACN,aAAO,gBAAgB;AAAA,IACzB;AAAA,EACF;AAEA,QAAM,SAAS,gBAAgB,MAAM,aAAa,MAAM,gBAAgB;AACxE,MAAI,OAAO,WAAW,uBAAuB;AAC3C,WAAO,iBAAiB,uBAAuB,4CAA4C;AAAA,EAC7F;AACA,MAAI,OAAO,WAAW,iCAAiC;AACrD,WAAO;AAAA,MACL;AAAA,MACA;AAAA,IACF;AAAA,EACF;AACA,MAAI,OAAO,WAAW,OAAO,0BAA0B;AACrD,WAAO,aAAa,4CAA4C;AAAA,EAClE;AACA,MAAI,CAAC,OAAO,WAAW,SAAS,SAAS,QAAQ,QAAQ,OAAO,GAAG;AACjE,WAAO;AAAA,MACL;AAAA,MACA;AAAA,IACF;AAAA,EACF;AAEA,QAAM,SAAS,OAAO,WAAW,MAAM,UAAU,MAAM,KAAK;AAC5D,MAAI,CAAC,OAAO,QAAS,QAAO,aAAa,iCAAiC;AAE1E,MAAI;AACF,UAAM,UAAU,MAAM,OAAO,WAAW,UAAU,SAAS,OAAO,IAAI;AACtE,UAAM,WAAW,kBAAkB,OAAO;AAC1C,QAAI,aAAa,QAAW;AAC1B,aAAO;AAAA,QACL;AAAA,QACA;AAAA,MACF;AAAA,IACF;AACA,UAAM,aAAa;AAAA,MACjB,QAAQ,QAAQ;AAAA,MAChB;AAAA,IACF;AACA,QAAI,WAAW,WAAW;AAGxB,aAAO,EAAE,QAAQ,MAAM,QAAQ,EAAE,SAAS,CAAC,EAAE,EAAE;AAAA,IACjD;AACA,UAAM,UAAU,MAAM,+BAA+B;AAAA,MACnD,SAAS,QAAQ,QAAQ;AAAA,MACzB,SAAS,QAAQ,QAAQ;AAAA,MACzB,cAAc,QAAQ,QAAQ,gBAAgB;AAAA,MAC9C,MAAM,QAAQ,QAAQ;AAAA,MACtB;AAAA,MACA,GAAI,QAAQ,QAAQ,aAAa,SAAY,CAAC,IAAI,EAAE,UAAU,QAAQ,QAAQ,SAAS;AAAA,MACvF,GAAI,QAAQ,QAAQ,UAAU,SAAY,CAAC,IAAI,EAAE,SAAS,QAAQ,QAAQ,MAAM;AAAA,MAChF,SAAS,WAAW;AAAA,MACpB,SAAS,QAAQ,QAAQ;AAAA,IAC3B,CAAC;AACD,QAAI,QAAQ,WAAW,YAAa,QAAO,EAAE,QAAQ,MAAM,QAAQ,EAAE,SAAS,CAAC,EAAE,EAAE;AACnF,WAAO;AAAA,MACL,QAAQ;AAAA,MACR,QAAQ,EAAE,SAAS,WAAW,SAAS,SAAS,QAAQ,QAAQ;AAAA,IAClE;AAAA,EACF,QAAQ;AACN,WAAO,gBAAgB;AAAA,EACzB;AACF;AAEA,eAAe,6BACb,SACA,OACsD;AACtD,MAAI;AACF,UAAM,gBAAgB,MAAM;AAC5B,QAAI,OAAO,cAAc,gBAAgB,SAAU,QAAO,kBAAkB;AAC5E,QAAI,QAAQ,QAAQ,eAAe,UAAa,CAAC;AAAA,MAC/C,cAAc;AAAA,MACd,QAAQ,QAAQ;AAAA,IAClB,GAAG;AACD,aAAO,iBAAiB,QAAQ,QAAQ,YAAY,cAAc,WAAW;AAAA,IAC/E;AACA,UAAM,UAAU,MAAM,YAAY,SAAS,MAAM,SAAS;AAC1D,QAAI,CAAC,QAAQ,GAAI,QAAO,QAAQ;AAChC,UAAM,EAAE,SAAS,YAAY,KAAK,IAAI;AACtC,UAAM,eAAe,cAAc;AACnC,QAAI,iBAAiB,UAAa,OAAO,iBAAiB,UAAU;AAClE,aAAO,kBAAkB;AAAA,IAC3B;AACA,QAAI,OAAO,iBAAiB,YAAY,cAAc,YAAY,MAAM,cAAc,IAAI,GAAG;AAC3F,aAAO,aAAa,MAAM,YAAY;AAAA,IACxC;AACA,UAAM,SAAS,gBAAgB,cAAc,MAAM;AACnD,QAAI,WAAW,OAAW,QAAO,kBAAkB;AACnD,QAAI,OAAO,QAAQ,KAAK,KAAK,IAAI,EAAG,QAAO,kBAAkB;AAC7D,QAAI,MAAM,kBAAkB,UAAa,MAAM,kBAAkB,cAAc,KAAK;AAClF,aAAO,kBAAkB;AAAA,IAC3B;AACA,QAAI,OAAO,cAAc,gBAAgB,YAAY,CAAC,cAAc,cAAc,aAAa,UAAU,GAAG;AAC1G,aAAO,iBAAiB,YAAY,OAAO,cAAc,eAAe,SAAS,CAAC;AAAA,IACpF;AAEA,UAAM,aAAa;AAAA,MACjB,GAAG;AAAA,MACH;AAAA,MACA,MAAM,gBAAgB;AAAA,IACxB;AACA,QAAI;AACJ,QAAI;AACF,kBAAY,MAAc;AAAA,QACxB,QAAQ,QAAQ;AAAA,QAChB;AAAA,QACA,EAAE,KAAK;AAAA,MACT;AAAA,IACF,QAAQ;AACN,aAAO;AAAA,QACL;AAAA,QACA;AAAA,MACF;AAAA,IACF;AAEA,UAAM,uBAAuB,yBAAyB,UAAU,oBAAoB;AACpF,UAAMC,gBAAe;AAAA,MACnB,QAAQ,QAAQ;AAAA,MAChB,QAAQ,QAAQ;AAAA,IAClB;AACA,QAAI,CAAC,wBAAwB,QAAQ,WAAW,sBAAsBA,aAAY,GAAG;AACnF,aAAO;AAAA,QACL;AAAA,QACA;AAAA,MACF;AAAA,IACF;AAEA,QAAI;AACF,aAAO,MAAM;AAAA,QACX,QAAQ,QAAQ;AAAA,QAChB;AAAA,QACA,OAAO,YAAY;AACjB,gBAAM,QAAQ,MAAM,YAAY,SAAS,MAAM,SAAS;AACxD,cAAI,CAAC,MAAM,GAAI,QAAO,EAAE,SAAS,QAAQ,MAAM,OAAO;AACtD,cAAI,MAAM,eAAe,cAAc,cAAc,MAAM,IAAI,MAAM,cAAc,IAAI,GAAG;AACxF,mBAAO;AAAA,cACL;AAAA,cACA,QAAQ,iBAAiB,MAAM,YAAY,UAAU;AAAA,YACvD;AAAA,UACF;AACA,cAAI,MAAM,QAAQ,YAAY,QAAQ,QAAQ,WAC5C,CAAC,cAAc,MAAM,QAAQ,YAAY,UAAU,KACnD,cAAc,MAAM,QAAQ,IAAI,MAAM,cAAc,IAAI,KACxD,KAAK,UAAU,kCAAkC,MAAM,QAAQ,WAAWA,aAAY,CAAC,MACrF,KAAK,UAAU,kCAAkC,QAAQ,WAAWA,aAAY,CAAC,GAAG;AACtF,mBAAO;AAAA,cACL;AAAA,cACA,QAAQ;AAAA,gBACN;AAAA,gBACA;AAAA,cACF;AAAA,YACF;AAAA,UACF;AAGA,gBAAM,SAAS;AAAA,YACb,YAAY,UAAU;AAAA,YACtB,aAAa,UAAU;AAAA,YACvB,kBAAkB;AAAA,cAChB,WAAW,QAAQ;AAAA,cACnB,WAAW,QAAQ;AAAA,YACrB;AAAA,UACF;AAIA,gBAAM,WAAW,QAAQ,UAAU,CAAC,UAAU,cAAc,KAAK,MAAM,UAAU,GAAG;AACpF,gBAAM,iBAAiB,aAAa;AACpC,gBAAM,SAAS,QAAQ,OAAO,CAAC,UAAU,cAAc,KAAK,MAAM,UAAU,GAAG;AAC/E,iBAAO;AAAA,YACL,SAAS,iBACL,CAAC,GAAG,OAAO,MAAM,GAAG,QAAQ,GAAG,QAAQ,GAAG,OAAO,MAAM,QAAQ,CAAC,IAChE,CAAC,GAAG,SAAS,MAAM;AAAA,YACvB,QAAQ;AAAA,cACN,QAAQ;AAAA,cACR,QAAQ;AAAA,gBACN,KAAK,UAAU;AAAA,gBACf;AAAA,gBACA,QAAQ,UAAU,OAAO,YAAY;AAAA,gBACrC,UAAU,UAAU;AAAA,gBACpB,MAAM,UAAU;AAAA,gBAChB,WAAW;AAAA,gBACX;AAAA,cACF;AAAA,YACF;AAAA,UACF;AAAA,QACF;AAAA,MACF;AAAA,IACF,QAAQ;AACN,aAAO,sBAAsB;AAAA,IAC/B;AAAA,EACF,QAAQ;AACN,WAAO,sBAAsB;AAAA,EAC/B;AACF;AAEA,eAAe,YACb,SACA,WAIA;AACA,QAAM,aAAa,MAAM,kBAAkB,QAAQ,QAAQ,OAAO;AAClE,MAAI,eAAe,OAAW,QAAO,EAAE,IAAI,OAAO,QAAQ,eAAe,EAAE;AAC3E,MAAI,QAAQ,QAAQ,eAAe,UAAa,CAAC,cAAc,QAAQ,QAAQ,YAAY,UAAU,GAAG;AACtG,WAAO,EAAE,IAAI,OAAO,QAAQ,iBAAiB,YAAY,QAAQ,QAAQ,cAAc,SAAS,EAAE;AAAA,EACpG;AACA,QAAM,UAAU,MAAM,YAAqC,QAAQ,QAAQ,OAAO;AAClF,QAAM,OAAO,OAAO,SAAS,SAAS,WAAW,QAAQ,OAAO,QAAQ,QAAQ;AAChF,MAAI,cAAc,IAAI,MAAM,cAAc,QAAQ,QAAQ,IAAI,GAAG;AAC/D,WAAO,EAAE,IAAI,OAAO,QAAQ,aAAa,QAAQ,QAAQ,MAAM,IAAI,EAAE;AAAA,EACvE;AACA,MAAI;AACJ,MAAI;AACF,eAAW,MAAM,uBAAuB,QAAQ,QAAQ,SAAS;AAAA,MAC/D,SAAS,QAAQ,QAAQ;AAAA,MACzB,MAAM,QAAQ,QAAQ;AAAA,MACtB;AAAA,MACA,SAAS,QAAQ,QAAQ;AAAA,MACzB,cAAc,QAAQ,QAAQ,gBAAgB;AAAA,MAC9C,GAAI,QAAQ,QAAQ,aAAa,SAAY,CAAC,IAAI,EAAE,UAAU,QAAQ,QAAQ,SAAS;AAAA,MACvF,GAAI,QAAQ,QAAQ,UAAU,SAAY,CAAC,IAAI,EAAE,SAAS,QAAQ,QAAQ,MAAM;AAAA,IAClF,CAAC;AAAA,EACH,QAAQ;AACN,WAAO;AAAA,MACL,IAAI;AAAA,MACJ,QAAQ;AAAA,QACN;AAAA,QACA;AAAA,MACF;AAAA,IACF;AAAA,EACF;AACA,QAAM,UAAU,SAAS,KAAK,CAAC,cAAc,UAAU,cAAc,SAAS;AAC9E,MAAI,YAAY,UAAa,QAAQ,YAAY,QAAQ,QAAQ,SAAS;AACxE,WAAO;AAAA,MACL,IAAI;AAAA,MACJ,QAAQ;AAAA,QACN;AAAA,QACA;AAAA,MACF;AAAA,IACF;AAAA,EACF;AACA,MAAI,cAAc,QAAQ,IAAI,MAAM,cAAc,IAAI,GAAG;AACvD,WAAO,EAAE,IAAI,OAAO,QAAQ,aAAa,MAAM,QAAQ,IAAI,EAAE;AAAA,EAC/D;AACA,MAAI,CAAC,cAAc,QAAQ,YAAY,UAAU,GAAG;AAClD,WAAO,EAAE,IAAI,OAAO,QAAQ,iBAAiB,YAAY,QAAQ,UAAU,EAAE;AAAA,EAC/E;AACA,SAAO,EAAE,IAAI,MAAM,SAAS,YAAY,KAAK;AAC/C;AAEA,SAAS,kBAAkB,OAA+C;AACxE,SAAO,0BAA0B,KAAK;AACxC;AAEA,SAAS,gBAAgB,OAAkC;AACzD,QAAM,SAAS,iBAAiB,OAAO,QAAQ,OAAO,UAAU,WAAW,IAAI,KAAK,KAAK,IAAI;AAC7F,SAAO,WAAW,UAAa,CAAC,OAAO,MAAM,OAAO,QAAQ,CAAC,IAAI,SAAS;AAC5E;AAEA,SAAS,cAAc,MAAsB;AAC3C,SAAO,KAAK,QAAQ,QAAQ,EAAE;AAChC;AAEA,SAAS,cAAc,MAAc,OAAwB;AAC3D,SAAO,KAAK,MAAM,KAAK,CAAC,EAAE,CAAC,MAAM,MAAM,MAAM,KAAK,CAAC,EAAE,CAAC;AACxD;AAEA,SAAS,cAAc,OAAoD;AACzE,QAAM,aAAa,MAAM;AACzB,MAAI,eAAe,QAAQ,OAAO,eAAe,SAAU,QAAO;AAClE,QAAM,MAAO,WAAiC;AAC9C,SAAO,OAAO,QAAQ,WAAW,MAAM;AACzC;AAEA,eAAe,kBAAkB,SAA8C;AAC7E,QAAM,UAAU,MAAM,YAAqC,OAAO;AAClE,MAAI,YAAY,QAAQ,OAAO,QAAQ,uBAAuB,SAAU,QAAO;AAC/E,SAAO,QAAQ,mBAAmB,MAAM,KAAK,CAAC,EAAE,CAAC,KAAK;AACxD;AAEA,SAAS,iBAAmD;AAC1D,SAAO,iBAAiB,qBAAqB,uDAAuD;AACtG;AAEA,SAAS,oBAAsD;AAC7D,SAAO,iBAAiB,+BAA+B,qCAAqC;AAC9F;AAEA,SAAS,oBAAsD;AAC7D,SAAO,iBAAiB,sBAAsB,6BAA6B;AAC7E;AAEA,SAAS,iBAAiB,oBAA4B,kBAA4D;AAChH,SAAO,iBAAiB,gCAAgC,8CAA8C;AAAA,IACpG;AAAA,IACA;AAAA,EACF,CAAC;AACH;AAEA,SAAS,aAAa,cAAsB,cAAwD;AAClG,SAAO,iBAAiB,4BAA4B,2CAA2C;AAAA,IAC7F;AAAA,IACA;AAAA,EACF,CAAC;AACH;AAEA,SAAS,aAAa,SAAmD;AACvE,SAAO,iBAAiB,iBAAiB,OAAO;AAClD;AAEA,SAAS,kBAAoD;AAC3D,SAAO,iBAAiB,kBAAkB,+CAA+C;AAC3F;AAEA,SAAS,wBAA0D;AACjE,SAAO,iBAAiB,kBAAkB,+CAA+C;AAC3F;AAEA,SAAS,iBACP,MACA,SACA,SACkC;AAClC,SAAO,EAAE,QAAQ,SAAS,OAAO,eAAe,MAAM,SAAS,EAAE,GAAI,YAAY,SAAY,CAAC,IAAI,EAAE,QAAQ,EAAG,CAAC,EAAE;AACpH;AAlkBA,IAkEM,kBACA,0BAGA,wBAYA,+BAgBA,yBAIA,wBAUA,eAKA,eAMA,+BACA,0BACA,yBAWO;AAxIb;AAAA;AAAA;AAQA;AAOA;AAmBA;AACA;AACA;AAKA;AAyBA,IAAM,mBAAiDD,GAAE,OAAO,CAAC,CAAC,EAAE,OAAO;AAC3E,IAAM,2BAA0DA,GAAE,OAAO;AAAA,MACvE,cAAcA,GAAE,MAAM,qBAAqB;AAAA,IAC7C,CAAC,EAAE,OAAO;AACV,IAAM,yBAAsDA,GAAE,MAAM;AAAA,MAClEA,GAAE,OAAO,EAAE,WAAWA,GAAE,OAAO,EAAE,IAAI,CAAC,EAAE,CAAC,EAAE,OAAO;AAAA,MAClDA,GAAE,OAAO;AAAA,QACP,aAAaA,GAAE,OAAO,EAAE,IAAI,CAAC;AAAA,QAC7B,kBAAkBA,GAAE,OAAO,EAAE,IAAI,EAAE,SAAS;AAAA,QAC5C,OAAOA,GAAE,QAAQ;AAAA,MACnB,CAAC,EAAE,OAAO,EAAE,YAAY,CAAC,OAAO,UAAU;AACxC,YAAI,CAAC,OAAO,UAAU,eAAe,KAAK,OAAO,OAAO,GAAG;AACzD,gBAAM,SAAS,EAAE,MAAMA,GAAE,aAAa,QAAQ,SAAS,+BAA+B,CAAC;AAAA,QACzF;AAAA,MACF,CAAC;AAAA,IACH,CAAC;AACD,IAAM,gCAAgCA,GAAE,OAAO;AAAA,MAC7C,MAAMA,GAAE,QAAQ,wBAAwB;AAAA,MACxC,SAASA,GAAE,QAAQ,CAAC;AAAA,MACpB,WAAWA,GAAE,OAAO,EAAE,IAAI,CAAC;AAAA,MAC3B,WAAWA,GAAE,OAAO,EAAE,SAAS,EAAE,QAAQ,KAAK,CAAC;AAAA,MAC/C,SAASA,GAAE,OAAO,EAAE,IAAI,CAAC;AAAA,MACzB,SAASA,GAAE,KAAK,CAAC,iBAAiB,oBAAoB,mBAAmB,iBAAiB,CAAC;AAAA,MAC3F,cAAcA,GAAE,KAAK,CAAC,SAAS,OAAO,CAAC;AAAA,MACvC,MAAMA,GAAE,OAAO,EAAE,IAAI,CAAC;AAAA,MACtB,YAAYA,GAAE,OAAO,EAAE,IAAI,CAAC;AAAA,MAC5B,UAAUA,GAAE,OAAO,EAAE,IAAI,CAAC,EAAE,SAAS;AAAA,MACrC,SAASA,GAAE,OAAO,EAAE,IAAI,CAAC,EAAE,SAAS;AAAA,MACpC,iBAAiBA,GAAE,MAAM,CAACA,GAAE,OAAO,GAAGA,GAAE,OAAO,CAAC,CAAC,EAAE,SAAS;AAAA,MAC5D,WAAWA,GAAE,MAAM,qBAAqB,EAAE,IAAI,CAAC;AAAA,MAC/C,SAASA,GAAE,OAAO,EAAE,MAAMA,GAAE,MAAMA,GAAE,OAAO,CAAC,EAAE,IAAI,CAAC,GAAG,KAAKA,GAAE,OAAO,EAAE,IAAI,CAAC,EAAE,CAAC,EAAE,OAAO,EAAE,SAAS;AAAA,IACpG,CAAC,EAAE,OAAO;AACV,IAAM,0BAAwDA,GAAE,OAAO;AAAA,MACrE,SAASA,GAAE,MAAM,qBAAqB;AAAA,MACtC,SAAS,8BAA8B,SAAS;AAAA,IAClD,CAAC,EAAE,OAAO;AACV,IAAM,yBAAsDA,GAAE,OAAO;AAAA,MACnE,KAAKA,GAAE,OAAO,EAAE,IAAI,CAAC;AAAA,MACrB,sBAAsBA,GAAE,MAAM,qBAAqB;AAAA,MACnD,QAAQA,GAAE,OAAO,EAAE,SAAS,EAAE,QAAQ,KAAK,CAAC;AAAA,MAC5C,UAAUA,GAAE,OAAO,EAAE,IAAI,CAAC;AAAA,MAC1B,MAAMA,GAAE,OAAO,EAAE,IAAI,CAAC;AAAA,MACtB,WAAWA,GAAE,QAAQ,IAAI;AAAA,MACzB,gBAAgBA,GAAE,QAAQ;AAAA,IAC5B,CAAC,EAAE,OAAO;AAEV,IAAM,gBAA6C;AAAA,MACjD;AAAA,MACA;AAAA,MACA;AAAA,IACF;AACA,IAAM,gBAAmC;AAAA,MACvC,KAAK,EAAE,QAAQ,WAAW;AAAA,MAC1B,KAAK,EAAE,QAAQ,WAAW;AAAA,MAC1B,OAAO,EAAE,QAAQ,WAAW;AAAA,MAC5B,MAAM,EAAE,QAAQ,WAAW;AAAA,IAC7B;AACA,IAAM,gCAAsD,EAAE,OAAO,CAAC,GAAG,QAAQ,CAAC,EAAE;AACpF,IAAM,2BAAiD,EAAE,OAAO,CAAC,QAAQ,GAAG,QAAQ,CAAC,EAAE;AACvF,IAAM,0BAAgD,EAAE,OAAO,CAAC,EAAE,GAAG,QAAQ,CAAC,EAAE;AAWzE,IAAM,2BAA+D;AAAA,MAC1E;AAAA,QACE,IAAI;AAAA,QACJ,SAAS;AAAA,QACT,OAAO;AAAA,QACP,aAAa;AAAA,QACb,OAAO;AAAA,QACP,QAAQ;AAAA,QACR,SAAS,CAAC,MAAM;AAAA,QAChB,SAAS;AAAA,QACT,UAAU;AAAA,QACV,UAAU;AAAA,QACV,aAAa;AAAA,QACb,WAAW,YAAY,CAAC;AAAA,QACxB,SAAS,OAAO,aAAuF;AAAA,UACrG,QAAQ;AAAA,UACR,QAAQ;AAAA,YACN,cAAc;AAAA,cACX,QAAQ,SAAS,WAAW,CAAC;AAAA,YAChC;AAAA,UACF;AAAA,QACF;AAAA,MACF;AAAA,MACA;AAAA,QACE,IAAI;AAAA,QACJ,SAAS;AAAA,QACT,OAAO;AAAA,QACP,aAAa;AAAA,QACb,OAAO;AAAA,QACP,QAAQ;AAAA,QACR,SAAS,CAAC,aAAa;AAAA,QACvB,SAAS;AAAA,QACT,UAAU;AAAA,QACV,UAAU;AAAA,QACV,aAAa;AAAA,QACb,WAAW,YAAY,CAAC;AAAA,QACxB,SAAS,CAAC,SAA2B,UAA4B;AAAA,UAC/D;AAAA,UACA;AAAA,QACF;AAAA,MACF;AAAA,MACA;AAAA,QACE,IAAI;AAAA,QACJ,SAAS;AAAA,QACT,OAAO;AAAA,QACP,aAAa;AAAA,QACb,OAAO;AAAA,QACP,QAAQ;AAAA,QACR,SAAS,CAAC,aAAa;AAAA,QACvB,SAAS;AAAA,QACT,UAAU;AAAA,QACV,UAAU;AAAA,QACV,aAAa;AAAA,QACb,uBAAuB;AAAA,QACvB,WAAW,YAAY,CAAC;AAAA,QACxB,SAAS,CAAC,SAA2B,UAAoC;AAAA,UACvE;AAAA,UACA;AAAA,QACF;AAAA,MACF;AAAA,IACF;AAAA;AAAA;;;ACnMA,SAAS,wBAAwB,6BAA6B;AAC9D,SAAS,KAAAE,UAAS;AAwalB,eAAe,wBACb,SACA,MAC2C;AAC3C,SAAO,CAAC;AAAA,IACN,SAAS;AAAA,IACT,OAAO,aAAa,SAAS,SAAS;AAAA,IACtC;AAAA,IACA,SAAS,CAAC,oBAAoB,mBAAmB;AAAA,EACnD,CAAC;AACH;AAEA,eAAe,WACb,SACA,OAC2C;AAC3C,QAAM,QAAQ,sBAAsB,SAAS,MAAM,KAAK;AACxD,SAAO,CAAC;AAAA,IACN,SAAS;AAAA,IACT;AAAA,IACA,MAAM,MAAM,UAAU;AAAA,IACtB,SAAS,CAAC,mBAAmB;AAAA,EAC/B,CAAC;AACH;AAEA,eAAe,UACb,SACA,OAC2C;AAC3C,QAAM,QAAQ,sBAAsB,SAAS,MAAM,KAAK;AACxD,SAAO,CAAC;AAAA,IACN,SAAS;AAAA,IACT;AAAA,IACA,MAAM,MAAM;AAAA,IACZ,SAAS,CAAC,kBAAkB;AAAA,EAC9B,CAAC;AACH;AAEA,eAAe,YACb,SACA,gBACA,KACA,QAC2C;AAC3C,SAAO,CAAC;AAAA,IACN,SAAS;AAAA,IACT,OAAO,sBAAsB,SAAS,cAAc;AAAA,IACpD,MAAM;AAAA,IACN,SAAS,CAAC,MAAM;AAAA,EAClB,CAAC;AACH;AAEA,eAAe,yBACb,SACA,QACyD;AACzD,MAAI;AACF,UAAM,UAAU,MAAM,oBAAoB,SAAS,SAAS;AAC5D,QAAI,CAAC,QAAQ,GAAI,QAAO,QAAQ;AAChC,UAAM,SAAS,QAAQ,QACpB,IAAI,CAAC,EAAE,KAAK,MAAM,MAAM,oBAAoB,KAAK,KAAK,CAAC,EACvD,KAAK,CAAC,MAAM,UAAU,KAAK,KAAK,cAAc,MAAM,IAAI,KAAK,KAAK,QAAQ,cAAc,MAAM,OAAO,CAAC;AACzG,UAAM,SAAS,EAAE,QAAQ,OAAO,OAAO,OAAO;AAC9C,WAAO,sBAAsB,MAAM;AAAA,EACrC,SAAS,OAAO;AACd,WAAO,gBAAgB,OAAO,qBAAqB;AAAA,EACrD;AACF;AAEA,eAAe,+BACb,SACA,QAC+D;AAC/D,MAAI;AACF,UAAM,UAAU,MAAM,oBAAoB,SAAS,eAAe;AAClE,QAAI,CAAC,QAAQ,GAAI,QAAO,QAAQ;AAChC,UAAM,eAAe,QAAQ,QAC1B,IAAI,CAAC,EAAE,KAAK,MAAM,MAAM,0BAA0B,KAAK,KAAK,CAAC,EAC7D,KAAK,CAAC,MAAM,UAAU,KAAK,MAAM,cAAc,MAAM,KAAK,CAAC;AAC9D,UAAM,SAAS,EAAE,cAAc,OAAO,aAAa,OAAO;AAC1D,WAAO,sBAAsB,MAAM;AAAA,EACrC,SAAS,OAAO;AACd,WAAO,gBAAgB,OAAO,2BAA2B;AAAA,EAC3D;AACF;AAEA,eAAe,cACb,SACA,OACkD;AAClD,MAAI;AACF,UAAM,UAAU,eAAe,OAAO;AACtC,UAAM,QAAQ,sBAAsB,SAAS,MAAM,KAAK;AACxD,UAAM,SAAS,MAAM,UAAU,SAAS,KAAK,EAAE,KAAK;AAAA,MAClD,GAAI,MAAM,WAAW,SAAY,CAAC,IAAI,EAAE,QAAQ,MAAM,OAAO;AAAA,MAC7D,OAAO,MAAM,SAAS;AAAA,IACxB,CAAC;AACD,QAAI,CAAC,OAAO,GAAI,QAAO,UAAU,OAAO,OAAO,cAAc;AAC7D,UAAM,OAAO,CAAC,GAAG,OAAO,KAAK,IAAI;AACjC,WAAO;AAAA,MACL,QAAQ;AAAA,MACR,QAAQ;AAAA,QACN;AAAA,QACA,QAAQ,MAAM,UAAU;AAAA,QACxB;AAAA,QACA,OAAO,KAAK;AAAA,QACZ,WAAW,OAAO,KAAK,aAAa;AAAA,MACtC;AAAA,IACF;AAAA,EACF,SAAS,OAAO;AACd,WAAO,gBAAgB,OAAO,cAAc;AAAA,EAC9C;AACF;AAEA,eAAe,aACb,SACA,OACiD;AACjD,MAAI;AACF,UAAM,UAAU,eAAe,OAAO;AACtC,UAAM,QAAQ,sBAAsB,SAAS,MAAM,KAAK;AACxD,UAAM,SAAS,MAAM,UAAU,SAAS,KAAK,EAAE,IAAI,MAAM,KAAK;AAAA,MAC5D,QAAQ;AAAA,MACR,kBAAkB;AAAA,IACpB,CAAC;AACD,QAAI,CAAC,OAAO,GAAI,QAAO,UAAU,OAAO,OAAO,mBAAmB;AAClE,UAAM,QAAQ,OAAO,KAAK;AAC1B,QAAI,MAAM,aAAa,oBAAoB;AACzC,aAAO,UAAU,EAAE,MAAM,wBAAwB,GAAG,mBAAmB;AAAA,IACzE;AACA,UAAM,UAAU,cAAc,OAAO,MAAM,kBAAkB,QAAQ;AACrE,QAAI,CAAC,QAAQ,GAAI,QAAO,QAAQ;AAChC,WAAO;AAAA,MACL,QAAQ;AAAA,MACR,QAAQ;AAAA,QACN;AAAA,QACA,KAAK,MAAM;AAAA,QACX,OAAO,QAAQ;AAAA,QACf,UAAU,QAAQ;AAAA,QAClB,UAAU,kBAAkB,OAAO,KAAK,OAAO;AAAA,QAC/C,YAAY,MAAM;AAAA,MACpB;AAAA,IACF;AAAA,EACF,SAAS,OAAO;AACd,WAAO,gBAAgB,OAAO,mBAAmB;AAAA,EACnD;AACF;AAEA,eAAe,cACb,SACA,OACkD;AAClD,MAAI;AACF,UAAM,UAAU,eAAe,OAAO;AACtC,UAAM,QAAQ,sBAAsB,SAAS,MAAM,KAAK;AACxD,UAAM,SAAS,MAAM,UAAU,SAAS,KAAK,EAAE,KAAK,MAAM,GAAG;AAC7D,QAAI,CAAC,OAAO,GAAI,QAAO,UAAU,OAAO,OAAO,kBAAkB;AACjE,WAAO,EAAE,QAAQ,MAAM,QAAQ,EAAE,OAAO,KAAK,MAAM,KAAK,UAAU,kBAAkB,OAAO,KAAK,OAAO,EAAE,EAAE;AAAA,EAC7G,SAAS,OAAO;AACd,WAAO,gBAAgB,OAAO,kBAAkB;AAAA,EAClD;AACF;AAEA,eAAe,aACb,SACA,OACiD;AACjD,MAAI;AACF,UAAM,UAAU,eAAe,OAAO;AACtC,UAAM,QAAQ,sBAAsB,SAAS,MAAM,KAAK;AACxD,UAAM,UAAU,mBAAmB,MAAM,OAAO;AAChD,QAAI,YAAY,UAAa,QAAQ,aAAa,oBAAoB;AACpE,aAAO,EAAE,QAAQ,SAAS,OAAO,eAAe,iBAAiB,yCAAyC,EAAE;AAAA,IAC9G;AACA,UAAM,SAAS,MAAM,UAAU,SAAS,KAAK,EAAE,IAAI,MAAM,KAAK,QAAQ,OAAO;AAAA,MAC3E,aAAa,MAAM,eAAe,QAAQ;AAAA,MAC1C,GAAI,MAAM,SAAS,WAAW,EAAE,aAAa,IAAa,IAAI,CAAC;AAAA,MAC/D,GAAI,MAAM,SAAS,YAAY,EAAE,SAAS,MAAM,KAAK,IAAI,CAAC;AAAA,IAC5D,CAAC;AACD,QAAI,CAAC,OAAO,GAAI,QAAO,UAAU,OAAO,OAAO,oBAAoB;AACnE,WAAO;AAAA,MACL,QAAQ;AAAA,MACR,QAAQ;AAAA,QACN;AAAA,QACA,KAAK,MAAM;AAAA,QACX,MAAM,MAAM;AAAA,QACZ,YAAY,QAAQ;AAAA,QACpB,UAAU,kBAAkB,OAAO,KAAK,OAAO;AAAA,MACjD;AAAA,IACF;AAAA,EACF,SAAS,OAAO;AACd,WAAO,gBAAgB,OAAO,oBAAoB;AAAA,EACpD;AACF;AAEA,eAAe,gBACb,SACA,OACoD;AACpD,MAAI;AACF,UAAM,UAAU,eAAe,OAAO;AACtC,UAAM,QAAQ,sBAAsB,SAAS,MAAM,KAAK;AACxD,UAAM,SAAS,MAAM,UAAU,SAAS,KAAK,EAAE,OAAO,MAAM,KAAK;AAAA,MAC/D,GAAI,MAAM,SAAS,SAAY,CAAC,IAAI,EAAE,SAAS,MAAM,KAAK;AAAA,IAC5D,CAAC;AACD,QAAI,CAAC,OAAO,GAAI,QAAO,UAAU,OAAO,OAAO,qBAAqB;AACpE,WAAO;AAAA,MACL,QAAQ;AAAA,MACR,QAAQ;AAAA,QACN;AAAA,QACA,KAAK,MAAM;AAAA,QACX,SAAS;AAAA,QACT,GAAI,OAAO,KAAK,QAAQ,SAAS,SAAY,CAAC,IAAI,EAAE,MAAM,OAAO,KAAK,QAAQ,KAAK;AAAA,MACrF;AAAA,IACF;AAAA,EACF,SAAS,OAAO;AACd,WAAO,gBAAgB,OAAO,qBAAqB;AAAA,EACrD;AACF;AAEA,SAAS,eAAe,SAAoD;AAC1E,MAAI,QAAQ,YAAY,QAAW;AACjC,UAAM,IAAI,UAAU,iDAAiD;AAAA,EACvE;AACA,SAAO;AACT;AAEA,SAAS,YAAY,SAA0C;AAC7D,SAAO,eAAe,OAAO,EAAE,QAAQ;AACzC;AAEA,SAAS,UAAU,SAAkC,OAAkC;AACrF,SAAO,YAAY,OAAO,EAAE,WAAW,KAAK;AAC9C;AAEA,SAAS,aAAa,SAAkC,OAAuB;AAC7E,SAAO,uBAAuB,QAAQ,QAAQ,MAAM,QAAQ,QAAQ,KAAK,EAAE,KAAK;AAClF;AAEA,SAAS,sBAAsB,SAAkC,OAAuB;AACtF,QAAM,WAAW,aAAa,SAAS,KAAK;AAC5C,QAAM,gBAAgB,SAAS,MAAM,GAAG,EAAE,GAAG,EAAE,GAAG,YAAY;AAC9D,MAAI,kBAAkB,aAAa,kBAAkB,WAAW;AAC9D,UAAM,IAAI,yBAAyB;AAAA,MACjC;AAAA,MACA;AAAA,IACF,CAAC;AAAA,EACH;AACA,SAAO;AACT;AAEA,eAAe,oBACb,SACA,QAIA;AACA,QAAM,UAAU,eAAe,OAAO;AACtC,QAAM,eAAe,aAAa,SAAS,SAAS;AACpD,QAAM,KAAK,YAAY,OAAO,EAAE,WAAW,YAAY;AACvD,QAAM,SAAS,MAAM,GAAG,KAAK,EAAE,QAAQ,OAAO,6BAA6B,CAAC;AAC5E,MAAI,CAAC,OAAO,GAAI,QAAO,EAAE,IAAI,OAAO,SAAS,UAAU,OAAO,OAAO,2BAA2B,EAAE;AAClG,MAAI,OAAO,KAAK,cAAc,MAAM;AAClC,WAAO;AAAA,MACL,IAAI;AAAA,MACJ,SAAS;AAAA,QACP,QAAQ;AAAA,QACR,OAAO;AAAA,UACL;AAAA,UACA,8CAA8C,4BAA4B;AAAA,QAC5E;AAAA,MACF;AAAA,IACF;AAAA,EACF;AAEA,QAAM,UAA4E,CAAC;AACnF,MAAI,aAAa;AACjB,aAAW,OAAO,OAAO,KAAK,MAAM;AAClC,UAAM,SAAS,MAAM,GAAG,IAAI,KAAK;AAAA,MAC/B,QAAQ;AAAA,MACR,kBAAkB;AAAA,IACpB,CAAC;AACD,QAAI,CAAC,OAAO,IAAI;AACd,aAAO,EAAE,IAAI,OAAO,SAAS,UAAU,OAAO,OAAO,2BAA2B,EAAE;AAAA,IACpF;AACA,UAAM,QAAQ,OAAO,KAAK;AAC1B,kBAAc,MAAM;AACpB,QAAI,MAAM,aAAa,sBAAsB,aAAa,4BAA4B;AACpF,aAAO;AAAA,QACL,IAAI;AAAA,QACJ,SAAS;AAAA,UACP,QAAQ;AAAA,UACR,OAAO;AAAA,YACL;AAAA,YACA,8CAA8C,0BAA0B;AAAA,UAC1E;AAAA,QACF;AAAA,MACF;AAAA,IACF;AACA,QAAI;AACF,YAAM,QAAiB,KAAK,MAAM,IAAI,YAAY,SAAS,EAAE,OAAO,KAAK,CAAC,EAAE,OAAO,KAAK,CAAC;AACzF,UAAI,CAACC,UAAS,KAAK,EAAG,OAAM,IAAI,UAAU,+CAA+C;AACzF,cAAQ,KAAK,EAAE,KAAK,MAAM,CAAC;AAAA,IAC7B,QAAQ;AACN,aAAO;AAAA,QACL,IAAI;AAAA,QACJ,SAAS;AAAA,UACP,QAAQ;AAAA,UACR,OAAO,eAAe,kBAAkB,4DAA4D;AAAA,QACtG;AAAA,MACF;AAAA,IACF;AAAA,EACF;AACA,SAAO,EAAE,IAAI,MAAM,QAAQ;AAC7B;AAEA,SAAS,oBACP,KACA,QACuC;AACvC,QAAM,SAAS,IAAI,WAAW,SAAS,IAAI,IAAI,MAAM,UAAU,MAAM,IAAI;AACzE,QAAM,aAAa,YAAY,QAAQ,YAAY,SAAS,KAAK;AACjE,QAAM,UAAU,YAAY,QAAQ,MAAM,KAAK,WAAW,MAAM,GAAG,EAAE,GAAG,EAAE,KAAK;AAC/E,QAAM,UAAU,YAAY,QAAQ,MAAM;AAC1C,QAAM,YAAY,YAAY,QAAQ,QAAQ;AAC9C,QAAM,eAAe,OAAO,cAAc,OAAO;AACjD,QAAM,YAAY,wBAAwB,OACtC,aAAa,YAAY,IACzB,OAAO,iBAAiB,YAAY,CAAC,OAAO,MAAM,IAAI,KAAK,YAAY,EAAE,QAAQ,CAAC,IAClF,IAAI,KAAK,YAAY,EAAE,YAAY,IACnC;AACJ,SAAO;AAAA,IACL,SAAS;AAAA,IACT,MAAM;AAAA,IACN,UAAU,YAAY,QAAQ,aAAa,YAAY,OAAO,KAAK;AAAA,IACnE,MAAM,YAAY,WAAW,YAAY,cAAc,UAAU;AAAA,IACjE,aAAa,MAAM,QAAQ,OAAO,WAAW,IACzC,OAAO,YAAY,OAAO,CAAC,UAA2B,OAAO,UAAU,QAAQ,IAC/E,CAAC;AAAA,IACL,QAAQ,cAAc,aAAa,aAAa;AAAA,IAChD,GAAI,YAAY,QAAQ,iBAAiB,cAAc,MAAM,SACzD,CAAC,IACD,EAAE,cAAc,YAAY,QAAQ,iBAAiB,cAAc,EAAE;AAAA,IACzE,GAAI,YAAY,QAAQ,cAAc,WAAW,MAAM,SACnD,CAAC,IACD,EAAE,WAAW,YAAY,QAAQ,cAAc,WAAW,EAAE;AAAA,IAChE,GAAI,cAAc,SAAY,CAAC,IAAI,EAAE,UAAU;AAAA,EACjD;AACF;AAEA,SAAS,0BACP,KACA,QACmD;AACnD,QAAM,YAAY,MAAM,QAAQ,OAAO,SAAS,IAC5C,OAAO,UAAU,OAAOA,SAAQ,IAChC,CAAC;AACL,QAAM,QAAQ,UAAU,CAAC;AACzB,SAAO;AAAA,IACL,OAAO,YAAY,QAAQ,UAAU,OAAO,KAC1C,YAAY,OAAO,QAAQ,MAC1B,IAAI,WAAW,eAAe,IAAI,IAAI,MAAM,gBAAgB,MAAM,IAAI;AAAA,IACzE;AAAA,IACA,GAAI,YAAY,QAAQ,cAAc,WAAW,MAAM,SACnD,CAAC,IACD,EAAE,WAAW,YAAY,QAAQ,cAAc,WAAW,EAAE;AAAA,IAChE,GAAI,YAAY,OAAO,MAAM,MAAM,SAAY,CAAC,IAAI,EAAE,MAAM,YAAY,OAAO,MAAM,EAAE;AAAA,IACvF,GAAI,YAAY,OAAO,aAAa,MAAM,SACtC,CAAC,IACD,EAAE,aAAa,YAAY,OAAO,aAAa,EAAE;AAAA,IACrD,GAAI,YAAY,QAAQ,iBAAiB,cAAc,MAAM,SACzD,CAAC,IACD,EAAE,cAAc,YAAY,QAAQ,iBAAiB,cAAc,EAAE;AAAA,EAC3E;AACF;AAEA,SAAS,YACP,WACG,MACiB;AACpB,MAAI,WAAW,OAAW,QAAO;AACjC,aAAW,OAAO,MAAM;AACtB,QAAI,OAAO,OAAO,GAAG,MAAM,SAAU,QAAO,OAAO,GAAG;AAAA,EACxD;AACA,SAAO;AACT;AAEA,SAASA,UAAS,OAAkD;AAClE,SAAO,OAAO,UAAU,YAAY,UAAU,QAAQ,CAAC,MAAM,QAAQ,KAAK;AAC5E;AAEA,SAAS,cACP,OACA,gBAG2E;AAC3E,MAAI,mBAAmB,UAAU;AAC/B,WAAO,EAAE,IAAI,MAAM,OAAO,OAAO,KAAK,KAAK,EAAE,SAAS,QAAQ,GAAG,UAAU,SAAS;AAAA,EACtF;AACA,MAAI;AACJ,MAAI;AACF,WAAO,IAAI,YAAY,SAAS,EAAE,OAAO,KAAK,CAAC,EAAE,OAAO,KAAK;AAAA,EAC/D,QAAQ;AACN,WAAO;AAAA,MACL,IAAI;AAAA,MACJ,SAAS,EAAE,QAAQ,SAAS,OAAO,eAAe,kBAAkB,kCAAkC,EAAE;AAAA,IAC1G;AAAA,EACF;AACA,MAAI,mBAAmB,OAAQ,QAAO,EAAE,IAAI,MAAM,OAAO,MAAM,UAAU,OAAO;AAChF,MAAI;AACF,UAAM,SAAS,gBAAgB,UAAU,KAAK,MAAM,IAAI,CAAC;AACzD,QAAI,CAAC,OAAO,SAAS;AACnB,aAAO;AAAA,QACL,IAAI;AAAA,QACJ,SAAS;AAAA,UACP,QAAQ;AAAA,UACR,OAAO;AAAA,YACL;AAAA,YACA;AAAA,UACF;AAAA,QACF;AAAA,MACF;AAAA,IACF;AACA,WAAO,EAAE,IAAI,MAAM,OAAO,OAAO,MAAM,UAAU,OAAO;AAAA,EAC1D,QAAQ;AACN,WAAO;AAAA,MACL,IAAI;AAAA,MACJ,SAAS,EAAE,QAAQ,SAAS,OAAO,eAAe,kBAAkB,iCAAiC,EAAE;AAAA,IACzG;AAAA,EACF;AACF;AAEA,SAAS,mBAAmB,SAEd;AACZ,MAAI;AACJ,MAAI;AACJ,MAAI,QAAQ,aAAa,QAAQ;AAC/B,YAAQ,IAAI,YAAY,EAAE,OAAO,QAAQ,KAAK;AAC9C,kBAAc;AAAA,EAChB,WAAW,QAAQ,aAAa,QAAQ;AACtC,YAAQ,IAAI,YAAY,EAAE,OAAO,KAAK,UAAU,QAAQ,KAAK,CAAC;AAC9D,kBAAc;AAAA,EAChB,OAAO;AACL,QAAI,CAAC,kBAAkB,QAAQ,KAAK,EAAG,QAAO;AAC9C,YAAQ,IAAI,WAAW,OAAO,KAAK,QAAQ,OAAO,QAAQ,CAAC;AAC3D,kBAAc;AAAA,EAChB;AACA,SAAO,EAAE,OAAO,YAAY,MAAM,YAAY,YAAY;AAC5D;AAEA,SAAS,kBAAkB,OAAwB;AACjD,MAAI,MAAM,SAAS,MAAM,KAAK,CAAC,mEAAmE,KAAK,KAAK,GAAG;AAC7G,WAAO;AAAA,EACT;AACA,SAAO,OAAO,KAAK,OAAO,QAAQ,EAAE,SAAS,QAAQ,MAAM;AAC7D;AAEA,SAAS,kBAAkB,SAKZ;AACb,SAAO;AAAA,IACL,GAAI,QAAQ,SAAS,SAAY,CAAC,IAAI,EAAE,MAAM,QAAQ,KAAK;AAAA,IAC3D,GAAI,QAAQ,gBAAgB,SAAY,CAAC,IAAI,EAAE,aAAa,QAAQ,YAAY;AAAA,IAChF,GAAI,QAAQ,iBAAiB,SAAY,CAAC,IAAI,EAAE,cAAc,QAAQ,aAAa;AAAA,IACnF,GAAI,QAAQ,kBAAkB,SAAY,CAAC,IAAI,EAAE,eAAe,QAAQ,cAAc;AAAA,EACxF;AACF;AAEA,SAAS,gBAAgB,OAAgB,QAAkD;AACzF,MAAI,iBAAiB,yBAA0B,QAAO,EAAE,QAAQ,SAAS,OAAO,MAAM,eAAe;AACrG,SAAO,qBAAqB,OAAO,MAAM,KAAK,YAAY,MAAM;AAClE;AAEO,SAAS,qBAAqB,OAAgB,QAA8D;AACjH,QAAM,UAAU,uBAAuB,KAAK;AAC5C,MAAI,YAAY,mBAAmB;AACjC,QAAI,sBAAsB,KAAK,MAAM,QAAW;AAC9C,aAAO,EAAE,QAAQ,SAAS,OAAO,eAAe,qBAAqB,2BAA2B,MAAM,GAAG,EAAE;AAAA,IAC7G;AACA,WAAO,EAAE,QAAQ,SAAS,OAAO,eAAe,iBAAiB,iCAAiC,MAAM,GAAG,EAAE;AAAA,EAC/G;AACA,MAAI,YAAY,aAAa;AAC3B,WAAO,EAAE,QAAQ,SAAS,OAAO,eAAe,qBAAqB,2BAA2B,MAAM,GAAG,EAAE;AAAA,EAC7G;AACA,SAAO;AACT;AAEA,SAAS,sBAAyB,QAAyC;AACzE,MAAI,OAAO,WAAW,KAAK,UAAU,MAAM,GAAG,MAAM,IAAI,4BAA4B;AAClF,WAAO;AAAA,MACL,QAAQ;AAAA,MACR,OAAO;AAAA,QACL;AAAA,QACA,8CAA8C,0BAA0B;AAAA,MAC1E;AAAA,IACF;AAAA,EACF;AACA,SAAO,EAAE,QAAQ,MAAM,OAAO;AAChC;AAEA,SAAS,UACP,OACA,QACkC;AAClC,QAAM,OAAO,qBAAqB,OAAO,MAAM;AAC/C,MAAI,SAAS,OAAW,QAAO;AAC/B,MAAI,MAAM,SAAS,gBAAgB;AACjC,WAAO,EAAE,QAAQ,SAAS,OAAO,eAAe,gBAAgB,qCAAqC,EAAE;AAAA,EACzG;AACA,MAAI,MAAM,SAAS,0BAA0B;AAC3C,WAAO,EAAE,QAAQ,SAAS,OAAO,eAAe,0BAA0B,oDAAoD,EAAE;AAAA,EAClI;AACA,MAAI,MAAM,SAAS,eAAe;AAChC,WAAO;AAAA,MACL,QAAQ;AAAA,MACR,OAAO;AAAA,QACL;AAAA,QACA;AAAA,QACA,EAAE,WAAW,KAAK;AAAA,MACpB;AAAA,IACF;AAAA,EACF;AACA,MAAI,MAAM,SAAS,yBAAyB;AAC1C,WAAO,EAAE,QAAQ,SAAS,OAAO,eAAe,yBAAyB,kCAAkC,kBAAkB,SAAS,EAAE;AAAA,EAC1I;AACA,SAAO,YAAY,MAAM;AAC3B;AAEA,SAAS,YAAY,QAAkD;AACrE,SAAO;AAAA,IACL,QAAQ;AAAA,IACR,OAAO;AAAA,MACL;AAAA,MACA,gCAAgC,MAAM;AAAA,MACtC,EAAE,WAAW,KAAK;AAAA,IACpB;AAAA,EACF;AACF;AAz8BA,IAuIM,oBACA,uBACA,8BACA,4BAEAC,mBACA,aAMA,cAIA,WAIA,aACA,kBAIA,mBAIA,kBAIA,iBAQA,kBAOA,oBAWA,2BAKA,0BAQA,iCAKA,mBAKA,oBAQA,kBAKA,mBAgBA,oBAkBA,mBAMA,kBAKA,mBAOA,mBACA,oBAGA,qBAGA,sBAIA,wBAKA,sBAUA,4BAIA,kCAIA,qBAIA,oBAIA,oBACA,oBAWO;AAhVb;AAAA;AAAA;AAcA;AACA;AAwHA,IAAM,qBAAqB,OAAO;AAClC,IAAM,wBAAwB;AAC9B,IAAM,+BAA+B;AACrC,IAAM,6BAA6B,IAAI,OAAO;AAE9C,IAAMA,oBAA0CF,GAAE,OAAO,CAAC,CAAC,EAAE,OAAO;AACpE,IAAM,cAAcA,GAAE,OAAO,EAAE,IAAI,CAAC,EAAE;AAAA,MACpC,CAAC,WACE,mBAAmB,KAAK,KAAK,KAAK,MAAM,WAAW,YAAY,MAChE,CAAC,MAAM,SAAS,GAAG;AAAA,MACrB;AAAA,IACF;AACA,IAAM,eAAeA,GAAE,OAAO,EAAE;AAAA,MAC9B,CAAC,WAAW,WAAW,OAAO,CAAC,OAAO,SAAS,GAAG;AAAA,MAClD;AAAA,IACF;AACA,IAAM,YAAYA,GAAE,OAAO,EAAE,IAAI,CAAC,EAAE;AAAA,MAClC,CAAC,QAAQ,QAAQ,OAAO,CAAC,IAAI,SAAS,GAAG,KAAK,CAAC,IAAI,SAAS,GAAG;AAAA,MAC/D;AAAA,IACF;AACA,IAAM,cAAcA,GAAE,OAAO,EAAE,IAAI,EAAE,IAAI,CAAC,EAAE,IAAI,GAAI;AACpD,IAAM,mBAAmBA,GAAE,OAAO,EAAE;AAAA,MAClC;AAAA,MACA;AAAA,IACF;AACA,IAAM,oBAAoBA,GAAE,OAAO,EAAE,IAAI,CAAC,EAAE,IAAI,GAAG,EAAE;AAAA,MACnD,CAAC,UAAU,CAAC,kBAAkB,KAAK,KAAK;AAAA,MACxC;AAAA,IACF;AACA,IAAM,mBAAmBA,GAAE,OAAO,EAAE,OAAO,EAAE;AAAA,MAC3C,CAAC,UAAU,CAAC,OAAO,UAAU,KAAK,KAAK,OAAO,cAAc,KAAK;AAAA,MACjE;AAAA,IACF;AACA,IAAM,kBAAwCA,GAAE,KAAK,MAAMA,GAAE,MAAM;AAAA,MACjEA,GAAE,KAAK;AAAA,MACPA,GAAE,QAAQ;AAAA,MACV;AAAA,MACAA,GAAE,OAAO;AAAA,MACTA,GAAE,MAAM,eAAe;AAAA,MACvBA,GAAE,OAAO,eAAe;AAAA,IAC1B,CAAC,CAAC;AACF,IAAM,mBAA0CA,GAAE,OAAO;AAAA,MACvD,MAAMA,GAAE,OAAO,EAAE,SAAS;AAAA,MAC1B,aAAaA,GAAE,OAAO,EAAE,SAAS;AAAA,MACjC,cAAcA,GAAE,OAAO,EAAE,SAAS;AAAA,MAClC,eAAeA,GAAE,OAAO,EAAE,IAAI,EAAE,YAAY,EAAE,SAAS;AAAA,IACzD,CAAC,EAAE,OAAO;AAEV,IAAM,qBAAqBA,GAAE,OAAO;AAAA,MAClC,SAASA,GAAE,OAAO,EAAE,IAAI,CAAC;AAAA,MACzB,MAAMA,GAAE,OAAO,EAAE,IAAI,CAAC;AAAA,MACtB,UAAUA,GAAE,OAAO;AAAA,MACnB,MAAMA,GAAE,KAAK,CAAC,SAAS,aAAa,YAAY,CAAC;AAAA,MACjD,aAAaA,GAAE,MAAMA,GAAE,OAAO,CAAC;AAAA,MAC/B,QAAQA,GAAE,KAAK,CAAC,UAAU,UAAU,CAAC;AAAA,MACrC,cAAcA,GAAE,OAAO,EAAE,SAAS;AAAA,MAClC,WAAWA,GAAE,OAAO,EAAE,SAAS;AAAA,MAC/B,WAAWA,GAAE,OAAO,EAAE,SAAS,EAAE,QAAQ,KAAK,CAAC,EAAE,SAAS;AAAA,IAC5D,CAAC,EAAE,OAAO;AACV,IAAM,4BAA4DA,GAAE,OAAO;AAAA,MACzE,QAAQA,GAAE,MAAM,kBAAkB;AAAA,MAClC,OAAOA,GAAE,OAAO,EAAE,IAAI,EAAE,YAAY;AAAA,IACtC,CAAC,EAAE,OAAO;AAEV,IAAM,2BAA2BA,GAAE,OAAO;AAAA,MACxC,OAAOA,GAAE,OAAO,EAAE,IAAI,CAAC;AAAA,MACvB,WAAWA,GAAE,MAAMA,GAAE,OAAOA,GAAE,QAAQ,CAAC,CAAC;AAAA,MACxC,WAAWA,GAAE,OAAO,EAAE,SAAS;AAAA,MAC/B,MAAMA,GAAE,OAAO,EAAE,SAAS;AAAA,MAC1B,aAAaA,GAAE,OAAO,EAAE,SAAS;AAAA,MACjC,cAAcA,GAAE,OAAO,EAAE,SAAS;AAAA,IACpC,CAAC,EAAE,OAAO;AACV,IAAM,kCAAwEA,GAAE,OAAO;AAAA,MACrF,cAAcA,GAAE,MAAM,wBAAwB;AAAA,MAC9C,OAAOA,GAAE,OAAO,EAAE,IAAI,EAAE,YAAY;AAAA,IACtC,CAAC,EAAE,OAAO;AAEV,IAAM,oBAA4CA,GAAE,OAAO;AAAA,MACzD,OAAO;AAAA,MACP,QAAQ,aAAa,SAAS;AAAA,MAC9B,OAAO,YAAY,SAAS;AAAA,IAC9B,CAAC,EAAE,OAAO;AACV,IAAM,qBAA8CA,GAAE,OAAO;AAAA,MAC3D,OAAOA,GAAE,OAAO,EAAE,IAAI,CAAC;AAAA,MACvB,QAAQA,GAAE,OAAO;AAAA,MACjB,MAAMA,GAAE,MAAMA,GAAE,OAAO,CAAC;AAAA,MACxB,OAAOA,GAAE,OAAO,EAAE,IAAI,EAAE,YAAY;AAAA,MACpC,WAAWA,GAAE,QAAQ;AAAA,IACvB,CAAC,EAAE,OAAO;AAEV,IAAM,mBAA0CA,GAAE,OAAO;AAAA,MACvD,OAAO;AAAA,MACP,KAAK;AAAA,MACL,gBAAgBA,GAAE,KAAK,CAAC,UAAU,QAAQ,MAAM,CAAC,EAAE,SAAS;AAAA,IAC9D,CAAC,EAAE,OAAO;AACV,IAAM,oBAA4CA,GAAE,OAAO;AAAA,MACzD,OAAOA,GAAE,OAAO,EAAE,IAAI,CAAC;AAAA,MACvB,KAAKA,GAAE,OAAO,EAAE,IAAI,CAAC;AAAA,MACrB,OAAOA,GAAE,MAAM;AAAA,QACbA,GAAE,OAAO;AAAA,QACTA,GAAE,OAAO;AAAA,QACTA,GAAE,QAAQ;AAAA,QACVA,GAAE,KAAK;AAAA,QACPA,GAAE,MAAMA,GAAE,QAAQ,CAAC;AAAA,QACnBA,GAAE,OAAOA,GAAE,QAAQ,CAAC;AAAA,MACtB,CAAC;AAAA,MACD,UAAUA,GAAE,KAAK,CAAC,QAAQ,QAAQ,QAAQ,CAAC;AAAA,MAC3C,UAAU;AAAA,MACV,YAAYA,GAAE,OAAO,EAAE,IAAI,EAAE,YAAY;AAAA,IAC3C,CAAC,EAAE,OAAO;AAEV,IAAM,qBAA8CA,GAAE,mBAAmB,YAAY;AAAA,MACnFA,GAAE,OAAO,EAAE,UAAUA,GAAE,QAAQ,MAAM,GAAG,OAAOA,GAAE,OAAO,EAAE,CAAC,EAAE,OAAO;AAAA,MACpEA,GAAE,OAAO,EAAE,UAAUA,GAAE,QAAQ,MAAM,GAAG,OAAO,gBAAgB,CAAC,EAAE,OAAO;AAAA,MACzEA,GAAE,OAAO,EAAE,UAAUA,GAAE,QAAQ,QAAQ,GAAG,OAAOA,GAAE,OAAO,EAAE,CAAC,EAAE,OAAO;AAAA,IACxE,CAAC,EAAE,YAAY,CAAC,SAAS,YAAY;AACnC,YAAM,UAAU,mBAAmB,OAAO;AAC1C,UAAI,YAAY,QAAW;AACzB,gBAAQ,SAAS,EAAE,MAAMA,GAAE,aAAa,QAAQ,SAAS,oCAAoC,CAAC;AAAA,MAChG,WAAW,QAAQ,aAAa,oBAAoB;AAClD,gBAAQ,SAAS;AAAA,UACf,MAAMA,GAAE,aAAa;AAAA,UACrB,MAAM;AAAA,UACN,SAAS;AAAA,UACT,WAAW;AAAA,UACX,SAAS,8BAA8B,kBAAkB;AAAA,QAC3D,CAAC;AAAA,MACH;AAAA,IACF,CAAC;AACD,IAAM,oBAAoB;AAAA,MACxB,OAAO;AAAA,MACP,KAAK;AAAA,MACL,SAAS;AAAA,MACT,aAAa,kBAAkB,SAAS;AAAA,IAC1C;AACA,IAAM,mBAA0CA,GAAE,mBAAmB,QAAQ;AAAA,MAC3EA,GAAE,OAAO,EAAE,GAAG,mBAAmB,MAAMA,GAAE,QAAQ,QAAQ,EAAE,CAAC,EAAE,OAAO;AAAA,MACrEA,GAAE,OAAO,EAAE,GAAG,mBAAmB,MAAMA,GAAE,QAAQ,QAAQ,EAAE,CAAC,EAAE,OAAO;AAAA,MACrEA,GAAE,OAAO,EAAE,GAAG,mBAAmB,MAAMA,GAAE,QAAQ,SAAS,GAAG,MAAM,iBAAiB,CAAC,EAAE,OAAO;AAAA,IAChG,CAAC;AACD,IAAM,oBAA4CA,GAAE,OAAO;AAAA,MACzD,OAAOA,GAAE,OAAO,EAAE,IAAI,CAAC;AAAA,MACvB,KAAKA,GAAE,OAAO,EAAE,IAAI,CAAC;AAAA,MACrB,MAAMA,GAAE,KAAK,CAAC,UAAU,WAAW,QAAQ,CAAC;AAAA,MAC5C,YAAYA,GAAE,OAAO,EAAE,IAAI,EAAE,YAAY;AAAA,MACzC,UAAU;AAAA,IACZ,CAAC,EAAE,OAAO;AACV,IAAM,oBAA4CA,GAAE,OAAO,EAAE,OAAO,aAAa,KAAK,UAAU,CAAC,EAAE,OAAO;AAC1G,IAAM,qBAA8CA,GAAE,OAAO;AAAA,MAC3D,OAAOA,GAAE,OAAO,EAAE,IAAI,CAAC;AAAA,MAAG,KAAKA,GAAE,OAAO,EAAE,IAAI,CAAC;AAAA,MAAG,UAAU;AAAA,IAC9D,CAAC,EAAE,OAAO;AACV,IAAM,sBAAgDA,GAAE,OAAO;AAAA,MAC7D,OAAO;AAAA,MAAa,KAAK;AAAA,MAAW,MAAM,iBAAiB,SAAS;AAAA,IACtE,CAAC,EAAE,OAAO;AACV,IAAM,uBAAkDA,GAAE,OAAO;AAAA,MAC/D,OAAOA,GAAE,OAAO,EAAE,IAAI,CAAC;AAAA,MAAG,KAAKA,GAAE,OAAO,EAAE,IAAI,CAAC;AAAA,MAAG,SAASA,GAAE,QAAQ,IAAI;AAAA,MAAG,MAAMA,GAAE,OAAO,EAAE,SAAS;AAAA,IACxG,CAAC,EAAE,OAAO;AAEV,IAAM,yBAAsD;AAAA,MAC1D;AAAA,MACA;AAAA,MACA;AAAA,IACF;AACA,IAAM,uBAA0C;AAAA,MAC9C,KAAK;AAAA,QACH,QAAQ;AAAA,QACR,QAAQ;AAAA,MACV;AAAA,MACA,KAAK,EAAE,QAAQ,WAAW;AAAA,MAC1B,OAAO,EAAE,QAAQ,WAAW;AAAA,MAC5B,MAAM,EAAE,QAAQ,WAAW;AAAA,IAC7B;AAEA,IAAM,6BAAmD;AAAA,MACvD,OAAO,CAAC;AAAA,MACR,QAAQ,CAAC,SAAS;AAAA,IACpB;AACA,IAAM,mCAAyD;AAAA,MAC7D,OAAO,CAAC;AAAA,MACR,QAAQ,CAAC,eAAe;AAAA,IAC1B;AACA,IAAM,sBAA4C;AAAA,MAChD,OAAO,CAAC,SAAS;AAAA,MACjB,QAAQ,CAAC,OAAO;AAAA,IAClB;AACA,IAAM,qBAA2C;AAAA,MAC/C,OAAO,CAAC,MAAM;AAAA,MACd,QAAQ,CAAC,QAAQ;AAAA,IACnB;AACA,IAAM,qBAA2C,EAAE,OAAO,CAAC,QAAQ,UAAU,GAAG,QAAQ,CAAC,EAAE;AAC3F,IAAM,qBAA2C,EAAE,OAAO,CAAC,MAAM,GAAG,QAAQ,CAAC,EAAE;AAWxE,IAAM,kCAAoE;AAAA,MAC/E;AAAA,QACE,IAAI;AAAA,QACJ,SAAS;AAAA,QACT,OAAO;AAAA,QACP,aAAa;AAAA,QACb,OAAOE;AAAA,QACP,QAAQ;AAAA,QACR,SAAS,CAAC,MAAM;AAAA,QAChB,SAAS;AAAA,QACT,UAAU;AAAA,QACV,UAAU;AAAA,QACV,aAAa;AAAA,QACb,WAAW,CAAC,YAAqC,wBAAwB,SAAS,SAAS;AAAA,QAC3F,SAAS;AAAA,MACX;AAAA,MACA;AAAA,QACE,IAAI;AAAA,QACJ,SAAS;AAAA,QACT,OAAO;AAAA,QACP,aAAa;AAAA,QACb,OAAOA;AAAA,QACP,QAAQ;AAAA,QACR,SAAS,CAAC,MAAM;AAAA,QAChB,SAAS;AAAA,QACT,UAAU;AAAA,QACV,UAAU;AAAA,QACV,aAAa;AAAA,QACb,WAAW,CAAC,YAAqC,wBAAwB,SAAS,eAAe;AAAA,QACjG,SAAS;AAAA,MACX;AAAA,MACA;AAAA,QACE,IAAI;AAAA,QACJ,SAAS;AAAA,QACT,OAAO;AAAA,QACP,aAAa;AAAA,QACb,OAAO;AAAA,QACP,QAAQ;AAAA,QACR,SAAS,CAAC,MAAM;AAAA,QAChB,SAAS;AAAA,QACT,UAAU;AAAA,QACV,UAAU;AAAA,QACV,aAAa;AAAA,QACb,WAAW;AAAA,QACX,SAAS;AAAA,MACX;AAAA,MACA;AAAA,QACE,IAAI;AAAA,QACJ,SAAS;AAAA,QACT,OAAO;AAAA,QACP,aAAa;AAAA,QACb,OAAO;AAAA,QACP,QAAQ;AAAA,QACR,SAAS,CAAC,MAAM;AAAA,QAChB,SAAS;AAAA,QACT,UAAU;AAAA,QACV,UAAU;AAAA,QACV,aAAa;AAAA,QACb,WAAW;AAAA,QACX,SAAS;AAAA,MACX;AAAA,MACA;AAAA,QACE,IAAI;AAAA,QAAqB,SAAS;AAAA,QAAG,OAAO;AAAA,QAC5C,aAAa;AAAA,QACb,OAAO;AAAA,QAAmB,QAAQ;AAAA,QAAoB,SAAS,CAAC,MAAM;AAAA,QAAG,SAAS;AAAA,QAClF,UAAU;AAAA,QAAwB,UAAU;AAAA,QAAsB,aAAa;AAAA,QAC/E,WAAW,CAAC,SAAkC,UAC5C,YAAY,SAAS,MAAM,OAAO,MAAM,KAAK,uBAAuB;AAAA,QACtE,SAAS;AAAA,MACX;AAAA,MACA;AAAA,QACE,IAAI;AAAA,QAAoB,SAAS;AAAA,QAAG,OAAO;AAAA,QAC3C,aAAa;AAAA,QACb,OAAO;AAAA,QAAkB,QAAQ;AAAA,QAAmB,SAAS,CAAC,OAAO;AAAA,QAAG,SAAS;AAAA,QACjF,UAAU;AAAA,QAAwB,UAAU;AAAA,QAAsB,aAAa;AAAA,QAC/E,WAAW,CAAC,SAAkC,UAC5C,YAAY,SAAS,MAAM,OAAO,MAAM,KAAK,kBAAkB;AAAA,QACjE,SAAS;AAAA,MACX;AAAA,MACA;AAAA,QACE,IAAI;AAAA,QAAuB,SAAS;AAAA,QAAG,OAAO;AAAA,QAC9C,aAAa;AAAA,QACb,OAAO;AAAA,QAAqB,QAAQ;AAAA,QAAsB,SAAS,CAAC,aAAa;AAAA,QAAG,SAAS;AAAA,QAC7F,UAAU;AAAA,QAAwB,UAAU;AAAA,QAAsB,aAAa;AAAA,QAC/E,WAAW,CAAC,SAAkC,UAC5C,YAAY,SAAS,MAAM,OAAO,MAAM,KAAK,kBAAkB;AAAA,QACjE,SAAS;AAAA,MACX;AAAA,IACF;AAAA;AAAA;;;ACxaA,SAAS,KAAAC,UAAS;AAkFlB,eAAe,cACb,SACA,OAC2C;AAC3C,QAAM,YAAY;AAAA,IAChB;AAAA,IACA,QAAQ,QAAQ;AAAA,IAChB,QAAQ,QAAQ;AAAA,EAClB;AACA,MAAI,eAAe,UAAU;AAC7B,MAAI,MAAM,UAAU,QAAW;AAC7B,QAAI;AACF,qBAAe;AAAA,QACb,QAAQ,QAAQ;AAAA,QAChB,QAAQ,QAAQ;AAAA,MAClB,EAAE,SAAS;AAAA,IACb,QAAQ;AAAA,IAGR;AAAA,EACF;AACA,QAAM,YAAY,2BAA2B,QAAQ,QAAQ,MAAM,YAAY;AAE/E,SAAO;AAAA,IACL;AAAA,MACE,SAAS;AAAA,MACT,OAAO,UAAU;AAAA,MACjB,MAAM,UAAU;AAAA,MAChB,SAAS,CAAC,kBAAkB;AAAA,IAC9B;AAAA,IACA;AAAA,MACE,SAAS;AAAA,MACT,MAAM;AAAA,MACN,SAAS,CAAC,8BAA8B;AAAA,IAC1C;AAAA,EACF;AACF;AAEA,eAAe,iBACb,SACA,OACsD;AACtD,QAAM,YAAY;AAAA,IAChB;AAAA,IACA,QAAQ,SAAS;AAAA,IACjB,QAAQ,QAAQ;AAAA,EAClB;AACA,QAAM,OAAO,QAAQ,SAAS;AAC9B,MAAI,SAAS,UAAa,OAAO,KAAK,eAAe,YAAY;AAC/D,WAAO;AAAA,MACL,QAAQ;AAAA,MACR,OAAO;AAAA,QACL;AAAA,QACA;AAAA,QACA,EAAE,WAAW,KAAK;AAAA,MACpB;AAAA,IACF;AAAA,EACF;AAEA,MAAI;AACJ,MAAI;AACF,aAAS,MAAM,KAAK,WAAW;AAAA,MAC7B,OAAO,UAAU;AAAA,MACjB,MAAM,UAAU;AAAA,MAChB,GAAI,UAAU,UAAU,SAAY,CAAC,IAAI,EAAE,OAAO,UAAU,MAAM;AAAA,IACpE,CAAC;AAAA,EACH,QAAQ;AACN,WAAO;AAAA,MACL,QAAQ;AAAA,MACR,OAAO;AAAA,QACL;AAAA,QACA;AAAA,QACA,EAAE,WAAW,KAAK;AAAA,MACpB;AAAA,IACF;AAAA,EACF;AAEA,SAAO,mBAAmB,WAAW,MAAM;AAC7C;AAEA,SAAS,mBACP,WACA,QAC6C;AAC7C,UAAQ,OAAO,QAAQ;AAAA,IACrB,KAAK;AACH,aAAO,EAAE,QAAQ,MAAM,QAAQ,EAAE,OAAO,OAAO,MAAM,EAAE;AAAA,IACzD,KAAK;AACH,aAAO;AAAA,QACL,QAAQ;AAAA,QACR,OAAO;AAAA,UACL,MAAM;AAAA,UACN,QAAQ;AAAA,YACN,MAAM,UAAU;AAAA,YAChB,GAAI,UAAU,UAAU,SAAY,CAAC,IAAI,EAAE,OAAO,UAAU,MAAM;AAAA,YAClE,OAAO,UAAU;AAAA,UACnB;AAAA,UACA,KAAK,oBAAoB,SAAS;AAAA,UAClC,SAAS;AAAA,QACX;AAAA,QACA,qBAAqB;AAAA,MACvB;AAAA,IACF,KAAK;AACH,aAAO;AAAA,QACL,QAAQ;AAAA,QACR,SAAS,CAAC,OAAO,IAAwC;AAAA,QACzD,SAAS,EAAE,WAAW,eAAe;AAAA,QACrC,UAAU;AAAA,UACR,MAAM;AAAA,UACN,WAAW;AAAA,UACX,UAAU;AAAA,QACZ;AAAA,MACF;AAAA,IACF,KAAK;AACH,aAAO;AAAA,QACL,QAAQ;AAAA,QACR,OAAO;AAAA,UACL;AAAA,UACA;AAAA,UACA,EAAE,WAAW,KAAK;AAAA,QACpB;AAAA,MACF;AAAA,IACF,KAAK;AAAA,IACL,KAAK;AACH,aAAO;AAAA,QACL,QAAQ;AAAA,QACR,OAAO;AAAA,UACL;AAAA,UACA;AAAA,QACF;AAAA,MACF;AAAA,IACF,KAAK;AAAA,IACL,KAAK;AACH,aAAO;AAAA,QACL,QAAQ;AAAA,QACR,OAAO;AAAA,UACL;AAAA,UACA;AAAA,QACF;AAAA,MACF;AAAA,EACJ;AAEA,SAAO;AAAA,IACL,QAAQ;AAAA,IACR,OAAO,eAAe,sBAAsB,yBAAyB;AAAA,EACvE;AACF;AAEA,SAAS,2BAA2B,MAAe,OAAuB;AACxE,QAAM,YAAY;AAKlB,MAAI;AACJ,MAAI;AACF,aAAS,UAAU,iCAAiC,KAAK;AAAA,EAC3D,QAAQ;AAAA,EAER;AACA,MAAI,OAAO,WAAW,YAAY,OAAO,SAAS,EAAG,QAAO;AAE5D,MAAI;AACJ,MAAI;AACF,eAAW,UAAU,gCAAgC;AAAA,EACvD,QAAQ;AAAA,EAER;AACA,MAAI,OAAO,aAAa,YAAY,SAAS,SAAS,EAAG,QAAO;AAEhE,QAAM,IAAI;AAAA,IACR;AAAA,MACE;AAAA,MACA;AAAA,IACF;AAAA,EACF;AACF;AAlQA,IA4BM,uBAYA,wBAIA,sBAMA,sBAOA,yBAKO,+BAgBA;AA9Eb;AAAA;AAAA;AAaA;AACA;AAcA,IAAM,wBAAoDA,GAAE,OAAO;AAAA,MACjE,MAAMA,GAAE,OAAO;AAAA,MACf,OAAOA,GAAE,OAAO,EAAE,SAAS;AAAA,MAC3B,OAAOA,GAAE,OAAO,EAAE,SAAS;AAAA,IAC7B,CAAC,EAAE,OAAO,EAAE,YAAY,CAAC,OAAO,YAAY;AAC1C,UAAI;AACF,+BAAuB,KAAK;AAAA,MAC9B,QAAQ;AACN,gBAAQ,SAAS,EAAE,MAAMA,GAAE,aAAa,QAAQ,SAAS,4BAA4B,CAAC;AAAA,MACxF;AAAA,IACF,CAAC,EAAE,UAAU,wBAAwB;AAErC,IAAM,yBAAsDA,GAAE,OAAO;AAAA,MACnE,OAAOA,GAAE,OAAO;AAAA,IAClB,CAAC,EAAE,OAAO;AAEV,IAAM,uBAAoD;AAAA,MACxD;AAAA,MACA;AAAA,MACA;AAAA,IACF;AAEA,IAAM,uBAA0C;AAAA,MAC9C,KAAK,EAAE,QAAQ,WAAW;AAAA,MAC1B,KAAK,EAAE,QAAQ,WAAW;AAAA,MAC1B,OAAO,EAAE,QAAQ,WAAW;AAAA,MAC5B,MAAM,EAAE,QAAQ,WAAW;AAAA,IAC7B;AAEA,IAAM,0BAAgD;AAAA,MACpD,OAAO,CAAC;AAAA,MACR,QAAQ,CAAC,QAAQ;AAAA,IACnB;AAEO,IAAM,gCAAwF;AAAA,MACnG,IAAI;AAAA,MACJ,SAAS;AAAA,MACT,OAAO;AAAA,MACP,aAAa;AAAA,MACb,OAAO;AAAA,MACP,QAAQ;AAAA,MACR,SAAS,CAAC,QAAQ,aAAa;AAAA,MAC/B,SAAS;AAAA,MACT,UAAU;AAAA,MACV,UAAU;AAAA,MACV,aAAa;AAAA,MACb,WAAW;AAAA,MACX,SAAS;AAAA,IACX;AAEO,IAAM,iCAAkF;AAAA,MAC7F;AAAA,IACF;AAAA;AAAA;;;AC/EA,OAAO,mBAAmB;AAC1B,SAAS,KAAAC,UAAS;AA4TlB,eAAe,YACb,SACA,OAC2C;AAC3C,QAAM,QAAQ,gBAAgB,SAAS,MAAM,KAAK;AAClD,SAAO,CAAC;AAAA,IACN,SAAS;AAAA,IACT;AAAA,IACA,MAAM,MAAM;AAAA,IACZ,SAAS,CAAC,oBAAoB;AAAA,EAChC,CAAC;AACH;AAEA,eAAe,aACb,SACA,OAC2C;AAC3C,QAAM,QAAQ,gBAAgB,SAAS,MAAM,KAAK;AAClD,SAAO,CAAC;AAAA,IACN,SAAS;AAAA,IACT;AAAA,IACA,MAAM,MAAM;AAAA,IACZ,SAAS,CAAC,qBAAqB;AAAA,IAC/B,aAAa;AAAA,EACf,CAAC;AACH;AAEA,eAAe,wBACb,SACA,OAC4D;AAC5D,MAAI;AACF,UAAM,UAAUC,gBAAe,OAAO;AACtC,UAAM,QAAQ,gBAAgB,SAAS,MAAM,KAAK;AAClD,UAAM,SAAS,MAAMC,aAAY,OAAO,EACrC,YAAY,KAAK,EACjB,GAAG,MAAM,QAAQ,EACjB,MAAM,cAAc,CAAC,GAAG,EAAE,SAAS,iBAAiB,UAAU,iBAAiB,CAAC;AACnF,QAAI,CAAC,OAAO,GAAI,QAAO,kBAAkB,OAAO,OAAO,2BAA2B;AAElF,UAAM,aAAa,qBAAqB,OAAO,MAAM,iBAAiB,gBAAgB;AACtF,UAAM,UAAU,WAAW,KAAK,IAAI,CAAC,QAAQ,aAAa,GAAG,CAAC;AAC9D,WAAO;AAAA,MACL,QAAQ;AAAA,MACR,QAAQ;AAAA,QACN;AAAA,QACA,UAAU,MAAM;AAAA,QAChB;AAAA,QACA,OAAO,QAAQ;AAAA,QACf,QAAQ,aAAa,iBAAiB,gBAAgB;AAAA,MACxD;AAAA,IACF;AAAA,EACF,SAAS,OAAO;AACd,WAAO,WAAW,OAAO,2BAA2B;AAAA,EACtD;AACF;AAEA,eAAe,gBACb,SACA,OACoD;AACpD,MAAI;AACF,QAAI,CAAC,kBAAkB,MAAM,GAAG,GAAG;AACjC,aAAO;AAAA,QACL,QAAQ;AAAA,QACR,OAAO;AAAA,UACL;AAAA,UACA;AAAA,QACF;AAAA,MACF;AAAA,IACF;AAEA,UAAM,UAAUD,gBAAe,OAAO;AACtC,UAAM,QAAQ,gBAAgB,SAAS,MAAM,KAAK;AAClD,UAAM,UAAU,MAAM,WAAW;AACjC,UAAM,WAAW,MAAM,YAAY;AACnC,UAAM,UAAU,MAAM,UAAU,CAAC,GAAG,IAAI,mBAAmB;AAC3D,UAAM,SAAS,MAAMC,aAAY,OAAO,EACrC,YAAY,KAAK,EACjB,GAAG,MAAM,QAAQ,EACjB,MAAM,MAAM,KAAK,QAAQ,EAAE,SAAS,SAAS,CAAC;AACjD,QAAI,CAAC,OAAO,GAAI,QAAO,kBAAkB,OAAO,OAAO,sBAAsB;AAE7E,UAAM,aAAa,qBAAqB,OAAO,MAAM,SAAS,QAAQ;AACtE,WAAO;AAAA,MACL,QAAQ;AAAA,MACR,QAAQ;AAAA,QACN;AAAA,QACA,UAAU,MAAM;AAAA,QAChB,SAAS,WAAW;AAAA,QACpB,MAAM,WAAW;AAAA,QACjB,UAAU,WAAW,KAAK;AAAA,QAC1B,QAAQ,aAAa,SAAS,QAAQ;AAAA,MACxC;AAAA,IACF;AAAA,EACF,SAAS,OAAO;AACd,WAAO,WAAW,OAAO,sBAAsB;AAAA,EACjD;AACF;AAEA,eAAe,cACb,SACA,OACsD;AACtD,MAAI;AACF,UAAM,gBAAgB,wBAAwB,MAAM,KAAK,MAAM,OAAO,MAAM;AAC5E,QAAI,kBAAkB,QAAW;AAC/B,aAAO;AAAA,QACL,QAAQ;AAAA,QACR,OAAO;AAAA,UACL;AAAA,UACA;AAAA,QACF;AAAA,MACF;AAAA,IACF;AAEA,UAAM,UAAUD,gBAAe,OAAO;AACtC,UAAM,QAAQ,gBAAgB,SAAS,MAAM,KAAK;AAClD,UAAM,SAAS,MAAMC,aAAY,OAAO,EACrC,YAAY,KAAK,EACjB,GAAG,MAAM,QAAQ,EACjB,QAAQ,MAAM,KAAK,MAAM,OAAO,IAAI,mBAAmB,CAAC;AAC3D,QAAI,CAAC,OAAO,GAAI,QAAO,qBAAqB,OAAO,OAAO,8BAA8B,KAAK,mBAAmB;AAChH,UAAM,aAAa,uBAAuB,OAAO,IAAI;AACrD,WAAO;AAAA,MACL,QAAQ;AAAA,MACR,QAAQ;AAAA,QACN;AAAA,QACA,UAAU,MAAM;AAAA,QAChB;AAAA,QACA,GAAG;AAAA,QACH,iBAAiB;AAAA,MACnB;AAAA,IACF;AAAA,EACF,SAAS,OAAO;AACd,QAAI,iBAAiB,yBAA0B,QAAO,EAAE,QAAQ,SAAS,OAAO,MAAM,eAAe;AACrG,WAAO,qBAAqB,OAAO,8BAA8B,KAAK,mBAAmB;AAAA,EAC3F;AACF;AAEA,SAAS,kBAAkB,KAAsB;AAC/C,QAAM,MAAM,qBAAqB,GAAG;AACpC,SAAO,QAAQ,UAAa,IAAI,SAAS;AAC3C;AAEA,SAAS,wBACP,KACA,gBAC4C;AAC5C,QAAM,MAAM,qBAAqB,GAAG;AACpC,MACE,QAAQ,UACP,IAAI,SAAS,YAAY,IAAI,SAAS,YAAY,IAAI,SAAS,YAChE,IAAI,SAAS,UAAa,IAAI,SAAS,MACvC;AACA,WAAO;AAAA,EACT;AACA,QAAM,eAAe,0BAA0B,GAAG;AAClD,SAAO,eAAe,KAAK,iBAAiB,iBAAiB,IAAI,OAAO;AAC1E;AAEA,SAAS,qBAAqB,KAAkD;AAC9E,MAAI;AACF,UAAM,MAAM,UAAU,OAAO,KAAK,EAAE,UAAU,SAAS,CAAC;AACxD,WAAO,CAAC,MAAM,QAAQ,GAAG,KAAKC,UAAS,GAAG,IAAI,MAAM;AAAA,EACtD,QAAQ;AACN,WAAO;AAAA,EACT;AACF;AAEA,SAAS,0BAA0B,OAAwB;AACzD,MAAI,MAAM,QAAQ,KAAK,GAAG;AACxB,WAAO,MAAM,OAAO,CAAC,OAAO,UAAU,QAAQ,0BAA0B,KAAK,GAAG,CAAC;AAAA,EACnF;AACA,MAAI,CAACA,UAAS,KAAK,EAAG,QAAO;AAC7B,QAAM,UAAU,MAAM,SAAS,YAAY,MAAM,UAAU,MAAM,IAAI;AACrE,SAAO,OAAO,OAAO,KAAK,EAAE;AAAA,IAC1B,CAAC,OAAO,UAAU,QAAQ,0BAA0B,KAAK;AAAA,IACzD;AAAA,EACF;AACF;AAEA,SAAS,oBAAoB,OAA2D;AACtF,MAAIA,UAAS,KAAK,KAAK,MAAM,SAAS,QAAQ;AAC5C,WAAO,IAAI,WAAW,OAAO,KAAK,MAAM,QAAkB,QAAQ,CAAC;AAAA,EACrE;AACA,SAAO;AACT;AAEA,SAAS,qBACP,OACA,SACA,UACwF;AACxF,MAAI,CAACA,UAAS,KAAK,KAAK,CAAC,MAAM,QAAQ,MAAM,OAAO,KAAK,CAAC,MAAM,QAAQ,MAAM,IAAI,GAAG;AACnF,UAAM,eAAe,mDAAmD;AAAA,EAC1E;AACA,QAAM,UAAU,MAAM,QAAQ,IAAI,CAAC,WAAW;AAC5C,QAAI,OAAO,WAAW,UAAU;AAC9B,YAAM,eAAe,kDAAkD;AAAA,IACzE;AACA,WAAO;AAAA,EACT,CAAC;AACD,QAAM,OAAO,MAAM,KAAK,IAAI,CAAC,QAAQ;AACnC,QAAI,CAAC,MAAM,QAAQ,GAAG,KAAK,IAAI,WAAW,QAAQ,QAAQ;AACxD,YAAM,eAAe,0CAA0C;AAAA,IACjE;AACA,WAAO,IAAI,IAAI,uBAAuB;AAAA,EACxC,CAAC;AAED,QAAM,kBAAkB,OAAO,WAAW,KAAK,UAAU,EAAE,SAAS,KAAK,CAAC,GAAG,MAAM;AACnF,MAAI,KAAK,SAAS,WAAW,kBAAkB,UAAU;AACvD,UAAM,IAAI,yBAAyB;AAAA,MACjC;AAAA,MACA;AAAA,MACA;AAAA,QACE,SAAS;AAAA,UACP;AAAA,UACA;AAAA,UACA,cAAc,KAAK;AAAA,UACnB,eAAe;AAAA,QACjB;AAAA,MACF;AAAA,IACF,CAAC;AAAA,EACH;AACA,SAAO,EAAE,SAAS,KAAK;AACzB;AAEA,SAAS,wBAAwB,OAAgC;AAC/D,MAAI,UAAU,QAAQ,OAAO,UAAU,SAAU,QAAO;AACxD,MAAI,OAAO,UAAU,UAAU;AAC7B,QAAI,CAAC,OAAO,SAAS,KAAK,KAAM,OAAO,UAAU,KAAK,KAAK,CAAC,OAAO,cAAc,KAAK,GAAI;AACxF,YAAM,eAAe,+EAA+E;AAAA,IACtG;AACA,WAAO;AAAA,EACT;AACA,MAAI,iBAAiB,WAAY,QAAO,WAAW,KAAK;AACxD,MAAI,MAAM,QAAQ,KAAK,KAAK,MAAM,MAAM,MAAM,GAAG;AAC/C,WAAO,WAAW,WAAW,KAAK,KAAK,CAAC;AAAA,EAC1C;AACA,MAAIA,UAAS,KAAK,KAAK,MAAM,SAAS,YAAY,MAAM,QAAQ,MAAM,IAAI,KAAK,MAAM,KAAK,MAAM,MAAM,GAAG;AACvG,WAAO,WAAW,WAAW,KAAK,MAAM,IAAI,CAAC;AAAA,EAC/C;AACA,QAAM,eAAe,gDAAgD;AACvE;AAEA,SAAS,uBACP,OAC+D;AAC/D,MACE,CAACA,UAAS,KAAK,KACf,CAAC,OAAO,cAAc,MAAM,OAAO,KAClC,MAAM,UAAqB,KAE1B,MAAM,oBAAoB,QAC1B,CAAC,OAAO,cAAc,MAAM,eAAe,GAE7C;AACA,UAAM,eAAe,6FAA6F;AAAA,EACpH;AACA,SAAO;AAAA,IACL,SAAS,MAAM;AAAA,IACf,iBAAiB,MAAM;AAAA,EACzB;AACF;AAEA,SAAS,aAAa,KAA2E;AAC/F,QAAM,CAAC,MAAM,MAAM,WAAW,GAAG,IAAI;AACrC,MACG,SAAS,WAAW,SAAS,UAAU,SAAS,WAAW,SAAS,aACrE,OAAO,SAAS,YAChB,OAAO,cAAc,YACpB,QAAQ,QAAQ,OAAO,QAAQ,UAChC;AACA,UAAM,eAAe,oDAAoD;AAAA,EAC3E;AACA,SAAO;AAAA,IACL;AAAA,IACA;AAAA,IACA;AAAA,IACA,GAAI,QAAQ,OAAO,CAAC,IAAI,EAAE,IAAI;AAAA,EAChC;AACF;AAEA,SAAS,aAAa,SAAiB,UAAmC;AACxE,SAAO,EAAE,SAAS,UAAU,aAAa,iCAAiC;AAC5E;AAEA,SAASF,gBAAe,SAAoD;AAC1E,MAAI,QAAQ,YAAY,QAAW;AACjC,UAAM,IAAI,UAAU,iDAAiD;AAAA,EACvE;AACA,SAAO;AACT;AAEA,SAASC,aAAY,SAAiD;AACpE,SAAO,QAAQ,QAAQ;AACzB;AAEA,SAAS,gBAAgB,SAAkC,OAAuB;AAChF,QAAM,WAAW;AAAA,IACf,QAAQ,QAAQ;AAAA,IAChB,QAAQ,QAAQ;AAAA,EAClB,EAAE,KAAK;AACP,QAAM,OAAO,SAAS,MAAM,GAAG,EAAE,GAAG,EAAE,GAAG,YAAY;AACrD,MAAI,SAAS,aAAa,SAAS,WAAW;AAC5C,UAAM,IAAI,yBAAyB;AAAA,MACjC;AAAA,MACA;AAAA,IACF,CAAC;AAAA,EACH;AACA,SAAO;AACT;AAEA,SAAS,WAAW,OAA4B;AAC9C,SAAO;AAAA,IACL,MAAM;AAAA,IACN,QAAQ,OAAO,KAAK,KAAK,EAAE,SAAS,QAAQ;AAAA,IAC5C,YAAY,MAAM;AAAA,EACpB;AACF;AAEA,SAAS,eAAe,SAA2C;AACjE,SAAO,IAAI,yBAAyB,eAAe,oBAAoB,OAAO,CAAC;AACjF;AAEA,SAAS,WACP,OACA,QACkC;AAClC,MAAI,iBAAiB,0BAA0B;AAC7C,WAAO,EAAE,QAAQ,SAAS,OAAO,MAAM,eAAe;AAAA,EACxD;AACA,SAAO,qBAAqB,OAAO,MAAM,KAAKE,aAAY,MAAM;AAClE;AAEA,SAASA,aAAY,QAAkD;AACrE,SAAO;AAAA,IACL,QAAQ;AAAA,IACR,OAAO;AAAA,MACL;AAAA,MACA,gCAAgC,MAAM;AAAA,MACtC,EAAE,WAAW,KAAK;AAAA,IACpB;AAAA,EACF;AACF;AAEA,SAAS,kBACP,OACA,QACkC;AAClC,QAAM,OAAO,qBAAqB,OAAO,MAAM;AAC/C,MAAI,SAAS,OAAW,QAAO;AAC/B,MAAID,UAAS,KAAK,KAAK,MAAM,SAAS,0BAA0B;AAC9D,WAAO;AAAA,MACL,QAAQ;AAAA,MACR,OAAO;AAAA,QACL;AAAA,QACA;AAAA,MACF;AAAA,IACF;AAAA,EACF;AACA,SAAOC,aAAY,MAAM;AAC3B;AAEA,SAAS,qBAAuD;AAC9D,SAAO;AAAA,IACL,QAAQ;AAAA,IACR,OAAO;AAAA,MACL;AAAA,MACA;AAAA,MACA,EAAE,WAAW,MAAM;AAAA,IACrB;AAAA,EACF;AACF;AAEA,SAASC,mBAAkB,OAAwB;AACjD,MAAI,UAAU,GAAI,QAAO;AACzB,MAAI,MAAM,SAAS,MAAM,KAAK,CAAC,yBAAyB,KAAK,KAAK,EAAG,QAAO;AAC5E,SAAO,OAAO,KAAK,OAAO,QAAQ,EAAE,SAAS,QAAQ,MAAM;AAC7D;AAEA,SAAS,mBAAmB,OAA8B;AACxD,MAAI,OAAO,UAAU,SAAU,QAAO,OAAO,WAAW,OAAO,MAAM;AACrE,MAAIF,UAAS,KAAK,KAAK,MAAM,SAAS,QAAQ;AAC5C,WAAO,OAAO,KAAK,MAAM,QAAkB,QAAQ,EAAE;AAAA,EACvD;AACA,SAAO;AACT;AAEA,SAAS,OAAO,OAAiC;AAC/C,SAAO,OAAO,UAAU,KAAK,KAAM,SAAoB,KAAM,SAAoB;AACnF;AAEA,SAASA,UAAS,OAAkD;AAClE,SAAO,OAAO,UAAU,YAAY,UAAU,QAAQ,CAAC,MAAM,QAAQ,KAAK;AAC5E;AA1sBA,IAkBM,kBACA,cACA,mBACA,eACA,iBACA,kBACA,gBACA,gBACA,4BAGA,cAsEA,WAEAG,cAMA,gBAQA,kBAIA,cAIA,qBAMA,iBAcA,yBAcA,sBAUA,sBAIA,qBAeA,uBAgBA,uBAKA,8BAYA,sBAQA,wBASAC,yBAKA,cASA,wBAIA,uBAIA,yBAUO;AA5Qb;AAAA;AAAA;AAcA;AACA;AACA;AAEA,IAAM,mBAAmB;AACzB,IAAM,eAAe;AACrB,IAAM,oBAAoB,OAAO;AACjC,IAAM,gBAAgB,IAAI,OAAO;AACjC,IAAM,kBAAkB;AACxB,IAAM,mBAAmB,OAAO;AAChC,IAAM,iBAAiB;AACvB,IAAM,iBAAiB,KAAK;AAC5B,IAAM,6BACJ;AAEF,IAAM,eAAe;AAAA;AAAA;AAAA;AAAA;AAsErB,IAAM,YAAY,IAAI,cAAc,OAAO;AAE3C,IAAMD,eAAcN,GAAE,OAAO,EAAE,IAAI,CAAC,EAAE;AAAA,MACpC,CAAC,WACE,mBAAmB,KAAK,KAAK,KAAK,MAAM,WAAW,YAAY,MAChE,CAAC,MAAM,SAAS,GAAG;AAAA,MACrB;AAAA,IACF;AACA,IAAM,iBAAiBA,GAAE,OAAO,EAAE,IAAI,CAAC,EAAE,IAAI,GAAG,EAAE;AAAA,MAChD,CAAC,aACC,aAAa,OACb,CAAC,SAAS,SAAS,GAAG,KACtB,CAAC,SAAS,SAAS,GAAG,KACtB,CAAC,wBAAwB,KAAK,QAAQ;AAAA,MACxC;AAAA,IACF;AACA,IAAM,mBAAmBA,GAAE,OAAO,EAAE,OAAO,EAAE;AAAA,MAC3C,CAAC,UAAU,CAAC,OAAO,UAAU,KAAK,KAAK,OAAO,cAAc,KAAK;AAAA,MACjE;AAAA,IACF;AACA,IAAM,eAAeA,GAAE,OAAO,EAAE,IAAI,KAAK,KAAK,gBAAgB,CAAC,IAAI,CAAC,EAAE;AAAA,MACpEK;AAAA,MACA;AAAA,IACF;AACA,IAAM,sBAAgDL,GAAE,MAAM;AAAA,MAC5DA,GAAE,KAAK;AAAA,MACP;AAAA,MACAA,GAAE,OAAO,EAAE,IAAI,aAAa;AAAA,MAC5BA,GAAE,OAAO,EAAE,MAAMA,GAAE,QAAQ,MAAM,GAAG,QAAQ,aAAa,CAAC,EAAE,OAAO;AAAA,IACrE,CAAC;AACD,IAAM,kBAAkBA,GAAE,MAAM,mBAAmB,EAAE,IAAI,cAAc,EAAE;AAAA,MACvE,CAAC,QAAQ,YAAY;AACnB,cAAM,aAAa,OAAO;AAAA,UACxB,CAAC,OAAO,UAAU,QAAQ,mBAAmB,KAAK;AAAA,UAClD;AAAA,QACF;AACA,YAAI,aAAa,eAAe;AAC9B,kBAAQ,SAAS;AAAA,YACf,MAAMA,GAAE,aAAa;AAAA,YACrB,SAAS;AAAA,UACX,CAAC;AAAA,QACH;AAAA,MACF;AAAA,IACF;AACA,IAAM,0BAA0BA,GAAE,MAAM,mBAAmB,EAAE,IAAI,CAAC,EAAE,IAAI,cAAc,EAAE;AAAA,MACtF,CAAC,QAAQ,YAAY;AACnB,cAAM,aAAa,OAAO;AAAA,UACxB,CAAC,OAAO,UAAU,QAAQ,mBAAmB,KAAK;AAAA,UAClD;AAAA,QACF;AACA,YAAI,aAAa,eAAe;AAC9B,kBAAQ,SAAS;AAAA,YACf,MAAMA,GAAE,aAAa;AAAA,YACrB,SAAS;AAAA,UACX,CAAC;AAAA,QACH;AAAA,MACF;AAAA,IACF;AACA,IAAM,uBAAkDA,GAAE,MAAM;AAAA,MAC9DA,GAAE,KAAK;AAAA,MACP;AAAA,MACAA,GAAE,OAAO;AAAA,MACTA,GAAE,OAAO;AAAA,QACP,MAAMA,GAAE,QAAQ,MAAM;AAAA,QACtB,QAAQA,GAAE,OAAO;AAAA,QACjB,YAAYA,GAAE,OAAO,EAAE,IAAI,EAAE,YAAY;AAAA,MAC3C,CAAC,EAAE,OAAO;AAAA,IACZ,CAAC;AACD,IAAM,uBAAkDA,GAAE,OAAO;AAAA,MAC/D,OAAOM;AAAA,MACP,UAAU;AAAA,IACZ,CAAC,EAAE,OAAO;AACV,IAAM,sBAAgDN,GAAE,OAAO;AAAA,MAC7D,OAAOM;AAAA,MACP,UAAU;AAAA,MACV,KAAKN,GAAE,OAAO,EAAE,IAAI,CAAC,EAAE,IAAI,cAAc,EAAE,YAAY,CAAC,KAAK,YAAY;AACvE,YAAI,CAAC,kBAAkB,GAAG,GAAG;AAC3B,kBAAQ,SAAS;AAAA,YACf,MAAMA,GAAE,aAAa;AAAA,YACrB,SAAS;AAAA,UACX,CAAC;AAAA,QACH;AAAA,MACF,CAAC;AAAA,MACD,QAAQ,gBAAgB,SAAS;AAAA,MACjC,SAASA,GAAE,OAAO,EAAE,IAAI,EAAE,SAAS,EAAE,IAAI,YAAY,EAAE,SAAS;AAAA,MAChE,UAAUA,GAAE,OAAO,EAAE,IAAI,EAAE,SAAS,EAAE,IAAI,aAAa,EAAE,SAAS;AAAA,IACpE,CAAC,EAAE,OAAO;AACV,IAAM,wBAAoDA,GAAE,OAAO;AAAA,MACjE,OAAOM;AAAA,MACP,UAAU;AAAA,MACV,KAAKN,GAAE,OAAO,EAAE,IAAI,CAAC,EAAE,IAAI,cAAc;AAAA,MACzC,QAAQ;AAAA,MACR,kCAAkCA,GAAE,QAAQ,IAAI,EAAE,SAAS,0BAA0B;AAAA,IACvF,CAAC,EAAE,OAAO,EAAE,YAAY,CAAC,OAAO,YAAY;AAC1C,UAAI,wBAAwB,MAAM,KAAK,MAAM,OAAO,MAAM,MAAM,QAAW;AACzE,gBAAQ,SAAS;AAAA,UACf,MAAMA,GAAE,aAAa;AAAA,UACrB,MAAM,CAAC,KAAK;AAAA,UACZ,SAAS;AAAA,QACX,CAAC;AAAA,MACH;AAAA,IACF,CAAC;AAED,IAAM,wBAAoDA,GAAE,OAAO;AAAA,MACjE,SAASA,GAAE,OAAO,EAAE,IAAI,EAAE,SAAS;AAAA,MACnC,UAAUA,GAAE,OAAO,EAAE,IAAI,EAAE,SAAS;AAAA,MACpC,aAAaA,GAAE,QAAQ,gCAAgC;AAAA,IACzD,CAAC,EAAE,OAAO;AACV,IAAM,+BAAkEA,GAAE,OAAO;AAAA,MAC/E,OAAOA,GAAE,OAAO,EAAE,IAAI,CAAC;AAAA,MACvB,UAAUA,GAAE,OAAO,EAAE,IAAI,CAAC;AAAA,MAC1B,SAASA,GAAE,MAAMA,GAAE,OAAO;AAAA,QACxB,MAAMA,GAAE,KAAK,CAAC,SAAS,QAAQ,SAAS,SAAS,CAAC;AAAA,QAClD,MAAMA,GAAE,OAAO,EAAE,IAAI,CAAC;AAAA,QACtB,WAAWA,GAAE,OAAO,EAAE,IAAI,CAAC;AAAA,QAC3B,KAAKA,GAAE,OAAO,EAAE,SAAS;AAAA,MAC3B,CAAC,EAAE,OAAO,CAAC;AAAA,MACX,OAAOA,GAAE,OAAO,EAAE,IAAI,EAAE,YAAY;AAAA,MACpC,QAAQ;AAAA,IACV,CAAC,EAAE,OAAO;AACV,IAAM,uBAAkDA,GAAE,OAAO;AAAA,MAC/D,OAAOA,GAAE,OAAO,EAAE,IAAI,CAAC;AAAA,MACvB,UAAUA,GAAE,OAAO,EAAE,IAAI,CAAC;AAAA,MAC1B,SAASA,GAAE,MAAMA,GAAE,OAAO,CAAC;AAAA,MAC3B,MAAMA,GAAE,MAAMA,GAAE,MAAM,oBAAoB,CAAC;AAAA,MAC3C,UAAUA,GAAE,OAAO,EAAE,IAAI,EAAE,YAAY;AAAA,MACvC,QAAQ;AAAA,IACV,CAAC,EAAE,OAAO;AACV,IAAM,yBAAsDA,GAAE,OAAO;AAAA,MACnE,OAAOA,GAAE,OAAO,EAAE,IAAI,CAAC;AAAA,MACvB,UAAUA,GAAE,OAAO,EAAE,IAAI,CAAC;AAAA,MAC1B,eAAeA,GAAE,KAAK,CAAC,UAAU,UAAU,QAAQ,CAAC;AAAA,MACpD,SAASA,GAAE,OAAO,EAAE,IAAI,EAAE,YAAY;AAAA,MACtC,iBAAiBA,GAAE,OAAO,EAAE,IAAI,EAAE,SAAS;AAAA,MAC3C,iBAAiBA,GAAE,QAAQ,0BAA0B;AAAA,IACvD,CAAC,EAAE,OAAO;AAEV,IAAMO,0BAAsD;AAAA,MAC1D;AAAA,MACA;AAAA,MACA;AAAA,IACF;AACA,IAAM,eAAkC;AAAA,MACtC,KAAK;AAAA,QACH,QAAQ;AAAA,QACR,QAAQ;AAAA,MACV;AAAA,MACA,KAAK,EAAE,QAAQ,WAAW;AAAA,MAC1B,OAAO,EAAE,QAAQ,WAAW;AAAA,MAC5B,MAAM,EAAE,QAAQ,WAAW;AAAA,IAC7B;AACA,IAAM,yBAA+C;AAAA,MACnD,OAAO,CAAC,WAAW;AAAA,MACnB,QAAQ,CAAC,UAAU;AAAA,IACrB;AACA,IAAM,wBAA8C;AAAA,MAClD,OAAO,CAAC,aAAa,QAAQ,SAAS;AAAA,MACtC,QAAQ,CAAC,YAAY,OAAO;AAAA,IAC9B;AACA,IAAM,0BAAgD;AAAA,MACpD,OAAO,CAAC,aAAa,QAAQ,SAAS;AAAA,MACtC,QAAQ,CAAC,kBAAkB;AAAA,IAC7B;AAOO,IAAM,0BAAoD;AAAA,MAC/D;AAAA,QACE,IAAI;AAAA,QACJ,SAAS;AAAA,QACT,OAAO;AAAA,QACP,aAAa;AAAA,QACb,OAAO;AAAA,QACP,QAAQ;AAAA,QACR,SAAS,CAAC,MAAM;AAAA,QAChB,SAAS;AAAA,QACT,UAAUA;AAAA,QACV,UAAU;AAAA,QACV,aAAa;AAAA,QACb,WAAW;AAAA,QACX,SAAS;AAAA,MACX;AAAA,MACA;AAAA,QACE,IAAI;AAAA,QACJ,SAAS;AAAA,QACT,OAAO;AAAA,QACP,aAAa;AAAA,QACb,OAAO;AAAA,QACP,QAAQ;AAAA,QACR,SAAS,CAAC,MAAM;AAAA,QAChB,SAAS;AAAA,QACT,UAAUA;AAAA,QACV,UAAU;AAAA,QACV,aAAa;AAAA,QACb,uBAAuB;AAAA,QACvB,WAAW;AAAA,QACX,SAAS;AAAA,MACX;AAAA,MACA;AAAA,QACE,IAAI;AAAA,QACJ,SAAS;AAAA,QACT,OAAO;AAAA,QACP,aAAa,wGAAwG,0BAA0B;AAAA,QAC/I,OAAO;AAAA,QACP,QAAQ;AAAA,QACR,SAAS,CAAC,SAAS,aAAa;AAAA,QAChC,SAAS;AAAA,QACT,UAAUA;AAAA,QACV,UAAU;AAAA,QACV,aAAa;AAAA,QACb,uBAAuB;AAAA,QACvB,WAAW;AAAA,QACX,SAAS;AAAA,MACX;AAAA,IACF;AAAA;AAAA;;;AC5TA,SAAS,QAAAC,aAAY;AAIrB,YAAYC,cAAa;AAkElB,SAAS,qBAAqB,SAAyB;AAC5D,SAAOD,MAAK,YAAY,OAAO,GAAG,mCAAmC;AACvE;AAuBO,SAAS,qBACd,OACkD;AAElD,MAAI,CAACE,UAAS,KAAK,EAAG,QAAO;AAC7B,QAAM,aAAa,MAAM;AACzB,MAAI,CAACA,UAAS,UAAU,EAAG,QAAO;AAClC,QAAM,SAAS,WAAW;AAC1B,MACE,CAACA,UAAS,MAAM,KAChB,OAAO,KAAK,MAAM,EAAE,WAAW,KAC/B,CAAC,OAAO,UAAU,eAAe,KAAK,QAAQ,eAAe,KAC7D,OAAO,OAAO,kBAAkB,UAChC;AACA,WAAO;AAAA,EACT;AACA,MAAI,eAAe,WAAY,QAAO;AACtC,MAAI,OAAO,cAAc,SAAS,GAAG,EAAG,QAAO;AAC/C,SAAO,sBAAsB,QAAQ,YAAY;AACnD;AAQO,SAAS,YACd,OACA,UACmD;AACnD,QAAM,OAAO,qBAAqB,KAAK;AACvC,MAAI,CAACA,UAAS,KAAK,KAAM,SAAS,aAAa,SAAS,eAAiB,QAAO;AAChF,QAAM,UAAU,+BAA+B,UAAU,MAAM,gBAAgB;AAC/E,MAAI,QAAQ,QAAS,QAAO,QAAQ,KAAK;AACzC,SAAO,CAAC,YAAY,SAAS,aAAa,EAAE,sBAAsB,SAAS,WAAW;AACxF;AAMA,SAAS,yBACP,QACA,QACA,QACA,cAAa,oBAAI,KAAK,GAAE,YAAY,GAC+B;AACnE,SAAO;AAAA,IACL,GAAG;AAAA,IACH,kBAAkB,+BAA+B,MAAM;AAAA,MACrD,WAAW,GAAG,kBAAkB,MAAM,CAAC,IAAI,OAAO,WAAW,GAAG;AAAA,MAChE,WAAW,gBAAgB,MAAM;AAAA,IACnC,CAAC;AAAA,IACD,uBAAuB,EAAE,QAAQ,YAAY,MAAM,cAAc,MAAM,EAAE;AAAA,EAC3E;AACF;AAqEA,eAAsB,8BACpB,SACA,MACA,SACkB;AAClB,MAAI,MAAM,yBAAyB,OAAO,EAAG,QAAO;AAIpD,MAAI,CAAC,QAAQ,WAAW,CAAC,MAAM,sBAAsB,SAAS,IAAI,EAAG,QAAO;AAC5E,MAAI;AACF,WAAO,MAAM,gBAAgB,SAAS,YAAY;AAChD,UAAI,MAAM,yBAAyB,OAAO,EAAG,QAAO;AAGpD,UAAI,CAAC,MAAM,sBAAsB,SAAS,IAAI,EAAG,QAAO;AACxD,YAAM,cAAa,oBAAI,KAAK,GAAE,YAAY;AAC1C,YAAM,QAAQ,oBAAI,IAAqC;AACvD,YAAM,UAAoB,CAAC;AAC3B,iBAAW,SAAS,MAAM,0BAAmC,OAAO,GAAG;AAErE,YAAI,CAACA,UAAS,KAAK,KAAK,sBAAsB,SAAS,qBAAqB,KAAK,MAAM,UAAW;AAClG,cAAM,WAAW,MAAM,eAAe,MAAM,OAAO,QAAQ,MAAM,UAAU;AAC3E,YAAI,aAAa,OAAW,SAAQ,KAAK,OAAO,UAAU,KAAK,CAAC,CAAC;AAAA,YAC5D,OAAM,IAAI,UAAU,KAAK,GAAI,QAAQ;AAAA,MAC5C;AACA,UAAI,MAAM,OAAO,GAAG;AAClB,cAAM,mBAAkC,SAAS,0BAA0B,CAAC,aAAa;AAAA,UACvF,SAAS,QAAQ,IAAI,CAAC,UAAU;AAC9B,kBAAM,MAAM,CAACA,UAAS,KAAK,KAAK,sBAAsB,QAAQ,SAAY,UAAU,KAAK;AACzF,oBAAQ,QAAQ,SAAY,SAAY,MAAM,IAAI,GAAG,MAAM;AAAA,UAC7D,CAAC;AAAA,UACD,QAAQ;AAAA,QACV,EAAE;AAAA,MACJ;AACA,YAAM,gBAAgB,qBAAqB,OAAO,GAAG;AAAA,QACnD,eAAe;AAAA,QACf,YAAY;AAAA,QACZ,OAAO,CAAC,GAAG,MAAM,OAAO,CAAC,EAAE,IAAI,SAAS;AAAA,QACxC;AAAA,MACF,CAAC;AACD,aAAO;AAAA,IACT,GAAG,EAAE,WAAW,0BAA0B,CAAC;AAAA,EAC7C,QAAQ;AACN,WAAO;AAAA,EACT;AACF;AAGA,eAAe,sBAAsB,SAAiB,MAAoD;AACxG,MAAI;AACF,UAAM,YAAY,MAAM,YAAqC,OAAO;AACpE,WAAO,OAAO,WAAW,uBAAuB,YAC9C,OAAO,KAAK,eAAe,YAC3B,UAAU,mBAAmB,MAAM,KAAK,CAAC,EAAE,CAAC,MAAM,KAAK,WAAW,MAAM,KAAK,CAAC,EAAE,CAAC;AAAA,EACrF,QAAQ;AACN,WAAO;AAAA,EACT;AACF;AAGA,eAAe,eACb,MACA,OACA,MACA,YAC8C;AAC9C,QAAM,aAAa,0BAA0B,KAAK;AAClD,MAAI,eAAe,OAAW,QAAO;AACrC,QAAM,SAAS,MAAM,mBAAmB,MAAM,YAAY,IAAI;AAC9D,MAAI,WAAW,OAAW,QAAO;AACjC,MAAI;AAEF,WAAO,yBAAyB,EAAE,GAAG,OAAO,YAAY,EAAE,GAAG,MAAM,YAAsB,KAAK,WAAW,IAAI,EAAE,GAAG,QAAQ,aAAa,UAAU;AAAA,EACnJ,QAAQ;AAEN,WAAO;AAAA,EACT;AACF;AAWA,eAAsB,uBACpB,MACA,OACA,SAKiD;AACjD,QAAM,aAAa,0BAA0B,KAAK;AAClD,MAAI,eAAe,UAAa,WAAW,OAAO,QAAQ,KAAK,KAAK,IAAI,EAAG,QAAO;AAClF,QAAM,QAAQ,YAAY,OAAO,QAAQ,QAAQ;AACjD,MAAI,UAAU,OAAW,QAAO;AAChC,QAAM,YAAY,UAAU,WACxB,MAAM,OACN,CAAC,cAA0C,wBAAwB,OAAO,WAAW,QAAQ,YAAY;AAC7G,MAAI;AACF,WAAO,MAAc,4CAAmC,MAAM,YAAY,EAAE,MAAM,QAAQ,MAAM,UAAU,CAAC;AAAA,EAC7G,QAAQ;AAGN,WAAO;AAAA,EACT;AACF;AAGA,eAAsB,yBAAyB,SAAmC;AAChF,MAAI;AACF,WAAO,MAAM,SAAkB,qBAAqB,OAAO,CAAC,MAAM;AAAA,EACpE,QAAQ;AACN,WAAO;AAAA,EACT;AACF;AAMA,eAAe,mBACb,MACA,YACA,MACiD;AACjD,MAAI;AACJ,MAAI;AACF,UAAc,4CAAmC,MAAM,YAAY;AAAA;AAAA,MAEjE,MAAM,WAAW,QAAQ;AAAA,MACzB,WAAW,CAAC,cAAc;AACxB,iBAAS;AACT,eAAO;AAAA,MACT;AAAA,IACF,CAAC;AAAA,EACH,QAAQ;AAAA,EAER;AACA,SAAO;AACT;AAEA,SAAS,0BAA0B,OAAgD;AACjF,MAAI,CAACA,UAAS,KAAK,EAAG,QAAO;AAC7B,QAAM,MAAM,MAAM;AAClB,MAAI,CAACA,UAAS,GAAG,KAAK,CAACA,UAAS,IAAI,gBAAgB,EAAG,QAAO;AAC9D,QAAM,SAAS,IAAI,kBAAkB,OACjC,IAAI,SACJ,OAAO,IAAI,WAAW,WAAW,IAAI,KAAK,IAAI,MAAM,IAAI;AAC5D,MACE,WAAW,UAAa,OAAO,MAAM,OAAO,QAAQ,CAAC,KACrD,OAAO,IAAI,QAAQ,YACnB,OAAO,IAAI,YAAY,YACvB,OAAO,IAAI,SAAS,YACpB,CAAC,MAAM,QAAQ,IAAI,OAAO,KAAK,CAAC,IAAI,QAAQ,MAAM,CAAC,WAAW,OAAO,WAAW,QAAQ,KACxF,OAAO,IAAI,gBAAgB,YAC3B,OAAO,IAAI,iBAAiB,YAC5B,OAAO,IAAI,YAAY,YACvB,OAAO,IAAI,iBAAiB,kBAAkB,UAC9C;AACA,WAAO;AAAA,EACT;AACA,SAAO,EAAE,GAAG,KAAK,OAAO;AAC1B;AAEA,SAAS,UAAU,OAAoC;AACrD,QAAM,MAAMA,UAAS,KAAK,KAAKA,UAAS,MAAM,UAAU,IAAI,MAAM,WAAW,MAAM;AACnF,SAAO,OAAO,QAAQ,WAAW,MAAM;AACzC;AAGA,SAAS,UAAU,OAAoD;AACrE,QAAM,aAAa,MAAM;AACzB,MAAI,CAACA,UAAS,UAAU,KAAK,CAACA,UAAS,WAAW,gBAAgB,EAAG,QAAO;AAC5E,SAAO,KAAK,UAAU,CAAC,WAAW,KAAK,WAAW,iBAAiB,aAAa,CAAC;AACnF;AAEA,SAASA,UAAS,OAAkD;AAClE,SAAO,OAAO,UAAU,YAAY,UAAU,QAAQ,CAAC,MAAM,QAAQ,KAAK;AAC5E;AArZA,IAmDM,mBAMO,eAUP;AAnEN;AAAA;AAAA;AAYA;AACA;AACA;AAUA;AA2BA,IAAM,oBAAmD;AAAA,MACvD,WAAW;AAAA,MACX,kBAAkB;AAAA,IACpB;AAGO,IAAM,gBAA+C;AAAA,MAC1D,WACE;AAAA,MAEF,kBACE;AAAA,IAEJ;AAGA,IAAM,4BAA4B;AAAA;AAAA;;;ACnElC,SAAS,KAAAC,UAAS;AAoGlB,SAAS,uBAAuB,QAIoB;AAClD,SAAO;AAAA,IACL,IAAI,OAAO;AAAA,IACX,SAAS;AAAA,IACT,OAAO,OAAO;AAAA,IACd,aAAa,OAAO;AAAA,IACpB,OAAO;AAAA,IACP,QAAQ;AAAA,IACR,SAAS,CAAC,MAAM;AAAA,IAChB,SAAS;AAAA,IACT,UAAU;AAAA,IACV,UAAU;AAAA,IACV,aAAa;AAAA,IACb,WAAW,YAAY,CAAC;AAAA,IACxB,SAAS;AAAA,EACX;AACF;AAEA,eAAe,2BACb,SACA,QACkD;AAClD,QAAM,UAAU,QAAQ,QAAQ;AAChC,MAAI,CAAE,MAAM,oBAAoB,OAAO,EAAI,QAAO,gBAAgB,OAAO;AAEzE,MAAI;AACF,UAAM,CAAC,SAAS,6BAA6B,IAAI,MAAM,QAAQ,IAAI;AAAA,MACjE,YAAqC,OAAO;AAAA,MAC5C,+BAA+B,OAAO;AAAA,IACxC,CAAC;AACD,UAAM,iBAAiB,iBAAiB,OAAO;AAE/C,WAAO;AAAA,MACL,QAAQ;AAAA,MACR,QAAQ;AAAA,QACN;AAAA,QACA,MAAM,QAAQ,QAAQ;AAAA,QACtB,SAAS,QAAQ,QAAQ;AAAA,QACzB,GAAI,QAAQ,QAAQ,iBAAiB,SACjC,CAAC,IACD,EAAE,cAAc,QAAQ,QAAQ,aAAa;AAAA,QACjD,GAAI,QAAQ,QAAQ,iBAAiB,SACjC,CAAC,IACD,EAAE,cAAc,QAAQ,QAAQ,aAAa;AAAA,QACjD,GAAI,QAAQ,QAAQ,eAAe,SAC/B,CAAC,IACD,EAAE,YAAY,QAAQ,QAAQ,WAAW;AAAA,QAC7C,GAAI,QAAQ,QAAQ,aAAa,SAC7B,CAAC,IACD,EAAE,UAAU,QAAQ,QAAQ,SAAS;AAAA,QACzC,GAAI,QAAQ,QAAQ,UAAU,SAAY,CAAC,IAAI,EAAE,OAAO,QAAQ,QAAQ,MAAM;AAAA,QAC9E,SAAS;AAAA,QACT;AAAA,MACF;AAAA,IACF;AAAA,EACF,QAAQ;AAGN,WAAO;AAAA,MACL,QAAQ;AAAA,MACR,OAAO;AAAA,QACL;AAAA,QACA;AAAA,MACF;AAAA,IACF;AAAA,EACF;AACF;AAEA,eAAe,oBAAoB,SAAmC;AACpE,MAAI;AACF,UAAM,gBAAgB,MAAM,YAAqC,OAAO;AACxE,WAAOC,UAAS,aAAa;AAAA,EAC/B,QAAQ;AACN,WAAO;AAAA,EACT;AACF;AAEA,eAAe,+BAA+B,SAAkC;AAC9E,QAAM,kBAAkB,SAAS,wBAAwB;AACzD,QAAM,iBAAiB,MAAM,SAAkB,0BAA0B,OAAO,CAAC;AACjF,MAAI,mBAAmB,KAAM,QAAO;AACpC,MAAI,CAAC,MAAM,QAAQ,cAAc,EAAG,OAAM,IAAI,UAAU,sCAAsC;AAE9F,QAAM,MAAM,KAAK,IAAI;AACrB,QAAM,WAAW,MAAM,yBAAyB,OAAO;AACvD,MAAI,QAAQ;AACZ,aAAW,SAAS,gBAAgB;AAGlC,QAAI,qBAAqB,KAAK,MAAM,UAAW;AAC/C,UAAM,SAAS,uBAAuB,KAAK;AAG3C,QAAI,OAAO,QAAQ,IAAI,OAAO,YAAY,OAAO,QAAQ,MAAM,OAAW,UAAS;AAAA,EACrF;AACA,SAAO;AACT;AAEA,SAAS,iBAAiB,SAAkE;AAC1F,MAAI,YAAY,KAAM,QAAO,EAAE,SAAS,OAAO,SAAS,MAAM,WAAW,KAAK;AAC9E,MAAI,CAACA,UAAS,OAAO,EAAG,OAAM,IAAI,UAAU,wBAAwB;AAEpE,QAAM,SAAS,qBAAqB,OAAO;AAC3C,MAAI,WAAW,KAAM,QAAO,EAAE,SAAS,MAAM,SAAS,MAAM,WAAW,KAAK;AAE5E,SAAO;AAAA,IACL,SAAS;AAAA,IACT,SAAS,OAAO,QAAQ,KAAK,KAAK,IAAI;AAAA,IACtC,WAAW,OAAO,YAAY;AAAA,EAChC;AACF;AAEA,SAAS,uBAAuB,OAAsB;AACpD,MAAI,CAACA,UAAS,KAAK,KAAK,CAACA,UAAS,MAAM,UAAU,KAAK,EAAE,YAAY,MAAM,aAAa;AACtF,UAAM,IAAI,UAAU,4BAA4B;AAAA,EAClD;AACA,SAAO,YAAY,MAAM,WAAW,MAAM;AAC5C;AAEA,SAAS,qBAAqB,SAA+C;AAC3E,aAAW,SAAS,CAAC,aAAa,UAAU,gBAAgB,GAAY;AACtE,QAAI,EAAE,SAAS,YAAY,QAAQ,KAAK,MAAM,UAAa,QAAQ,KAAK,MAAM,KAAM;AACpF,WAAO,YAAY,QAAQ,KAAK,CAAC;AAAA,EACnC;AAEA,MAAI,EAAE,UAAU,YAAY,QAAQ,SAAS,UAAa,QAAQ,SAAS,KAAM,QAAO;AACxF,MAAI,OAAO,QAAQ,SAAS,SAAU,OAAM,IAAI,UAAU,yBAAyB;AACnF,QAAM,QAAQ,QAAQ,KAAK,MAAM,6BAA6B;AAC9D,SAAO,UAAU,OAAO,OAAO,YAAY,MAAM,CAAC,EAAE,KAAK,CAAC;AAC5D;AAEA,SAAS,YAAY,OAAsB;AACzC,QAAM,OAAO,iBAAiB,OAC1B,QACA,OAAO,UAAU,YAAY,OAAO,SAAS,KAAK,IAClD,IAAI,KAAK,QAAQ,KAAK,QAAQ,OAAoB,QAAQ,MAAQ,KAAK,IACvE,OAAO,UAAU,YAAY,MAAM,KAAK,MAAM,KAC9C,IAAI,KAAK,KAAK,IACd;AACJ,MAAI,SAAS,QAAQ,OAAO,MAAM,KAAK,QAAQ,CAAC,EAAG,OAAM,IAAI,UAAU,iBAAiB;AACxF,SAAO;AACT;AAEA,SAAS,gBAAgB,SAAmD;AAC1E,SAAO;AAAA,IACL,QAAQ;AAAA,IACR,OAAO;AAAA,MACL;AAAA,MACA,YAAY,OAAO;AAAA,IACrB;AAAA,EACF;AACF;AAEA,SAASA,UAAS,OAAkD;AAClE,SAAO,OAAO,UAAU,YAAY,UAAU,QAAQ,CAAC,MAAM,QAAQ,KAAK;AAC5E;AAnQA,IAuCM,mBAEA,oBA0BA,iBAOA,iBAOA,oBAMO;AAvFb;AAAA;AAAA;AAUA;AACA;AACA;AA2BA,IAAM,oBAA4CD,GAAE,OAAO,CAAC,CAAC,EAAE,OAAO;AAEtE,IAAM,qBAA8CA,GAAE,OAAO;AAAA,MAC3D,SAASA,GAAE,OAAO,EAAE,IAAI,CAAC;AAAA,MACzB,MAAMA,GAAE,OAAO,EAAE,IAAI,CAAC;AAAA,MACtB,SAASA,GAAE,KAAK;AAAA,QACd;AAAA,QACA;AAAA,QACA;AAAA,QACA;AAAA,MACF,CAAC;AAAA,MACD,cAAcA,GAAE,KAAK,CAAC,SAAS,OAAO,CAAC,EAAE,SAAS;AAAA,MAClD,cAAcA,GAAE,OAAO,EAAE,IAAI,CAAC,EAAE,SAAS;AAAA,MACzC,YAAYA,GAAE,OAAO,EAAE,IAAI,CAAC,EAAE,SAAS;AAAA,MACvC,UAAUA,GAAE,OAAO,EAAE,IAAI,CAAC,EAAE,SAAS;AAAA,MACrC,OAAOA,GAAE,OAAO,EAAE,IAAI,CAAC,EAAE,SAAS;AAAA,MAClC,SAASA,GAAE,OAAO;AAAA,QAChB,SAASA,GAAE,QAAQ;AAAA,QACnB,SAASA,GAAE,QAAQ,EAAE,SAAS;AAAA,QAC9B,WAAWA,GAAE,OAAO,EAAE,SAAS,EAAE,QAAQ,KAAK,CAAC,EAAE,SAAS;AAAA,MAC5D,CAAC,EAAE,OAAO;AAAA,MACV,+BAA+BA,GAAE,OAAO,EAAE,IAAI,EAAE,YAAY,EAAE;AAAA,QAC5D;AAAA,MAGF;AAAA,IACF,CAAC,EAAE,OAAO;AAEV,IAAM,kBAA+C;AAAA,MACnD;AAAA,MACA;AAAA,MACA;AAAA,MACA;AAAA,IACF;AAEA,IAAM,kBAAqC;AAAA,MACzC,KAAK,EAAE,QAAQ,WAAW;AAAA,MAC1B,KAAK,EAAE,QAAQ,WAAW;AAAA,MAC1B,OAAO,EAAE,QAAQ,WAAW;AAAA,MAC5B,MAAM,EAAE,QAAQ,WAAW;AAAA,IAC7B;AAEA,IAAM,qBAA2C,EAAE,OAAO,CAAC,GAAG,QAAQ,CAAC,EAAE;AAMlE,IAAM,6BAAwF;AAAA,MACnG,uBAAuB;AAAA,QACrB,IAAI;AAAA,QACJ,OAAO;AAAA,QACP,aAAa;AAAA,MACf,CAAC;AAAA,MACD,uBAAuB;AAAA,QACrB,IAAI;AAAA,QACJ,OAAO;AAAA,QACP,aAAa;AAAA,MACf,CAAC;AAAA,IACH;AAAA;AAAA;;;AClGA;AAAA;AAAA;AAAA;AAAA;AAqBA,SAAS,iCAA2E;AAGlF,kDAAyB;AAAA,IACvB,GAAG;AAAA,IACH,GAAG;AAAA,IACH,GAAG;AAAA,IACH,GAAG;AAAA,IACH,GAAG;AAAA,EACL;AACA,SAAO;AACT;AAGO,SAAS,iCAA2E;AACzF,SAAO,+BAA+B;AACxC;AAEO,SAAS,gBACd,aACA,kBACiB;AACjB,QAAM,aAAa,+BAA+B,EAAE;AAAA,IAClD,CAACE,gBAAeA,YAAW,OAAO;AAAA,EACpC;AACA,MAAI,WAAW,WAAW,GAAG;AAC3B,WAAO,EAAE,QAAQ,sBAAsB;AAAA,EACzC;AAEA,QAAM,aAAa,WAAW;AAAA,IAC5B,CAAC,cAAc,UAAU,YAAY;AAAA,EACvC;AACA,MAAI,eAAe,QAAW;AAC5B,WAAO;AAAA,MACL,QAAQ;AAAA,MACR,mBAAmB,WAAW,IAAI,CAAC,cAAc,UAAU,OAAO;AAAA,IACpE;AAAA,EACF;AAEA,SAAO,EAAE,QAAQ,SAAS,WAAW;AACvC;AA7DA,IAmBI;AAnBJ;AAAA;AAAA;AACA;AACA;AACA;AACA;AACA;AAAA;AAAA;;;ACmEA,eAAsB,yBACpB,SAA2B,CAAC,GACU;AACtC,QAAM,UAAU,MAAM,mBAAmB,MAAM;AAC/C,MAAI;AACJ,MAAI;AACF,oBAAgB,MAAM,YAA2B,OAAO;AAAA,EAC1D,QAAQ;AACN,WAAOC,iBAAgB,OAAO;AAAA,EAChC;AAEA,MAAI,CAAC,gBAAgB,aAAa,GAAG;AACnC,WAAOA,iBAAgB,OAAO;AAAA,EAChC;AAGA,MAAI,OAAO,eAAe,UAAa,CAAC,kBAAkB,aAAa,GAAG;AACxE,WAAOA,iBAAgB,OAAO;AAAA,EAChC;AAEA,QAAM,OAAO,YAAY,OAAO,MAAM,QAAQ,IAAI,SAAS,cAAc,MAAM,YAAY;AAC3F,QAAM,UAAU,eAAe,aAAa;AAE5C,SAAO;AAAA,IACL,IAAI;AAAA,IACJ,SAAS;AAAA,IACT,SAAS;AAAA,MACP;AAAA,MACA;AAAA,MACA;AAAA,MACA,cAAc,eAAe,cAAc,YAAY,IAAI,cAAc,eAAe;AAAA,MACxF,cAAc,SAAS,cAAc,GAAG;AAAA,MACxC,YAAY,SAAS,cAAc,UAAU;AAAA,MAC7C,UAAU,SAAS,cAAc,QAAQ;AAAA,MACzC,OAAO,OAAO,cAAc,YAAY,WAAW,cAAc,UAAU;AAAA,IAC7E;AAAA,EACF;AACF;AAeA,eAAe,mBAAmB,QAA2C;AAC3E,MAAI,OAAO,OAAO,YAAY,SAAU,QAAO,OAAO;AACtD,MAAI,OAAO,QAAQ,IAAI,eAAe,SAAU,QAAO,QAAQ,IAAI;AAEnE,MAAI;AACF,UAAM,SAAS,MAAM,SAAuB,oBAAoB,CAAC;AACjE,QAAI,OAAO,QAAQ,mBAAmB,SAAU,QAAO,OAAO;AAAA,EAChE,QAAQ;AAAA,EAGR;AACA,SAAO;AACT;AAGO,SAAS,eAAe,SAA0E;AACvG,MAAI,UAAU,QAAQ,OAAO,EAAG,QAAO,QAAQ;AAC/C,MAAI,QAAQ,eAAe,QAAS,QAAO;AAC3C,SAAO;AACT;AAEA,SAASA,iBAAgB,SAAsE;AAC7F,SAAO;AAAA,IACL,IAAI;AAAA,IACJ,OAAO;AAAA,MACL,MAAM;AAAA,MACN,SAAS,YAAY,OAAO;AAAA,MAC5B,WAAW;AAAA,IACb;AAAA,EACF;AACF;AAEA,SAAS,eAAe,QAA2B;AACjD,aAAW,SAAS,QAAQ;AAC1B,QAAI,OAAO,UAAU,YAAY,MAAM,SAAS,EAAG,QAAO;AAAA,EAC5D;AACA,SAAO;AACT;AAEA,SAAS,SAAS,OAAoC;AACpD,MAAI,OAAO,UAAU,YAAY,MAAM,WAAW,EAAG,QAAO;AAC5D,QAAM,WAAW,MAAM,QAAQ,GAAG;AAClC,SAAO,aAAa,KAAK,QAAQ,MAAM,MAAM,GAAG,QAAQ;AAC1D;AAEA,SAAS,UAAU,OAA2C;AAC5D,SAAO,UAAU,mBACf,UAAU,sBACV,UAAU,qBACV,UAAU;AACd;AAEA,SAAS,eAAe,OAAgD;AACtE,SAAO,UAAU,WAAW,UAAU;AACxC;AAOA,SAAS,gBAAgB,OAAwC;AAC/D,SAAOC,UAAS,KAAK,KACnB,iBAAiB,MAAM,IAAI,KAC3B,iBAAiB,MAAM,IAAI,KAC3B,OAAO,MAAM,YAAY,YACzB,OAAO,SAAS,MAAM,OAAO,KAC7B,iBAAiB,MAAM,SAAS,KAChC,iBAAiB,MAAM,GAAG,KAC1B,iBAAiB,MAAM,SAAS,KAChC,yBAAyB,MAAM,UAAU,KACzC,yBAAyB,MAAM,QAAQ,KACvC,yBAAyB,MAAM,OAAO,KACtC,kBAAkB,MAAM,OAAO,KAC/B,uBAAuB,MAAM,YAAY,KACzC,qBAAqB,MAAM,UAAU,KACrC,yBAAyB,MAAM,YAAY,KAC3C,yBAAyB,MAAM,UAAU,KACzC,yBAAyB,MAAM,OAAO,KACtC,yBAAyB,MAAM,WAAW;AAC9C;AAEA,SAASA,UAAS,OAAkD;AAClE,SAAO,OAAO,UAAU,YAAY,UAAU,QAAQ,CAAC,MAAM,QAAQ,KAAK;AAC5E;AAEA,SAAS,iBAAiB,OAAiC;AACzD,SAAO,OAAO,UAAU,YAAY,MAAM,SAAS;AACrD;AAEA,SAAS,yBAAyB,OAAyB;AACzD,SAAO,UAAU,UAAa,iBAAiB,KAAK;AACtD;AAEA,SAAS,kBAAkB,OAAyB;AAClD,SAAO,UAAU,UAAa,UAAU,KAAK;AAC/C;AAEA,SAAS,uBAAuB,OAAyB;AACvD,SAAO,UAAU,UAAa,eAAe,KAAK;AACpD;AAEA,SAAS,qBAAqB,OAAyB;AACrD,SAAO,UAAU,UAAa,UAAU,aAAa,UAAU;AACjE;AAOA,SAAS,kBAAkB,SAAiC;AAC1D,MAAI,QAAQ,eAAe,SAAS;AAClC,WAAO,QAAQ,YAAY,UAAa,QAAQ,YAAY;AAAA,EAC9D;AACA,MAAI,QAAQ,YAAY,mBAAmB;AACzC,WAAO,QAAQ,eAAe;AAAA,EAChC;AACA,SAAO;AACT;AAnPA,IAaM;AAbN;AAAA;AAAA;AAAA;AAaA,IAAM,eAAe;AAAA;AAAA;;;ACbrB;AAAA;AAAA;AAAA;AAKA,YAAYC,cAAa;AAmEzB,eAAsB,wBACpB,QACA,cAA2C,iBACL;AACtC,QAAM,WAAW,MAAM,yBAAyB,MAAM;AACtD,MAAI,CAAC,SAAS,IAAI;AAChB,WAAO;AAAA,MACL,IAAI;AAAA,MACJ,SAAS,kBAAkB,MAAM;AAAA,MACjC,OAAO,SAAS;AAAA,IAClB;AAAA,EACF;AAEA,QAAM,UAAU,SAAS;AACzB,MAAI,gBAAgB,cAAc;AAChC,WAAO,EAAE,IAAI,MAAM,SAAS,EAAE,QAAQ,EAAE;AAAA,EAC1C;AAEA,QAAM,cAAc,QAAQ;AAC5B,MAAI;AAGF,UAAM;AAAA,MACJ,eAAe;AAAA,IACjB,IAAIA;AACJ,UAAM,6BAA6B,OAAO,OAAO,eAAe;AAChE,UAAM,CAAC,SAAS,GAAG,IAAI,6BACnB,CAAC,MAAM,IAAI,IACX,MAAM,QAAQ,IAAI;AAAA,MAClB,YAA2B,WAAW;AAAA,MACtC,SAAkC,GAAG,YAAY,WAAW,CAAC,WAAW;AAAA,IAC1E,CAAC;AACH,UAAM,UAAU,SAAS;AAMzB,UAAM,gBAAgB,eAAe,OAAO;AAC5C,QAAI,CAAC,8BAA8B,kBAAkB,QAAQ,SAAS;AACpE,aAAO;AAAA,QACL,EAAE,GAAG,SAAS,SAAS,cAAc;AAAA,QACrC;AAAA,UACE;AAAA,UACA;AAAA,QACF;AAAA,MACF;AAAA,IACF;AAEA,UAAM,aAAa,OAAO,OAAO,eAAe,WAC5C,OAAO,aACP,OAAO,QAAQ,eAAe,WAC9B,QAAQ,aACR;AACJ,UAAM,kBAAkB,8BAA8B,QAAQ,eAAe,UACzE,oBACA,QAAQ;AACZ,QAAI,oBAAoB,QAAQ,WAAW,CAAC,4BAA4B;AACtE,aAAO;AAAA,QACL,EAAE,GAAG,SAAS,SAAS,gBAAgB;AAAA,QACvC;AAAA,UACE;AAAA,UACA;AAAA,QACF;AAAA,MACF;AAAA,IACF;AACA,UAAM,OAAO,IAAI,yBAAyB;AAAA,MACxC,MAAM,QAAQ;AAAA,MACd,GAAI,eAAe,SAAY,CAAC,IAAI,EAAE,WAAW;AAAA,IACnD,CAAC;AAED,UAAM,gBAAgB,YAAY,OAAO,SAAY,iBAAiB,SAAS,GAAG;AAClF,QAAI,4BAA4B;AAG9B,YAAM,KAAK,OAAO;AAAA,IACpB,WAAW,kBAAkB,QAAW;AACtC,UAAI,QAAQ,eAAe,WAAW,eAAe,QAAW;AAC9D,cAAM,KAAK,OAAO;AAAA,MACpB,OAAO;AACL,eAAO,OAAO,SAAS;AAAA,UACrB;AAAA,UACA;AAAA,QACF,CAAC;AAAA,MACH;AAAA,IACF,OAAO;AACL,YAAM,KAAK,eAAe,aAAa;AAAA,IACzC;AAKA,UAAM,mBAAmB,aAAa,KAAK,UAAU;AACrD,UAAM,mBAAmB,aAAa,KAAK,GAAG;AAC9C,UAAM,qBAAqB,6BACvB,+BAA+B,gBAAgB,IAC/C;AAGJ,UAAM,kBAAqC,CAAC,GAAG,KAAK,+BAA+B,CAAC;AACpF,UAAMC,gBAAe,uBAAuB,MAAM,sBAAsB,QAAQ,KAAK;AACrF,UAAM,WAAW,oBAAI,IAAY;AAGjC,QAAI,CAAC,4BAA4B;AAC/B,YAAM,YAAY;AAGlB,YAAM,WAAW,MAAM,8BAA8B,aAAa,WAAW;AAAA,QAC3E,MAAM,QAAQ;AAAA;AAAA;AAAA,QAGd,SAAS,kBAAkB;AAAA,MAC7B,CAAC;AAGD,iBAAW,SAAS,MAAM,0BAAmC,WAAW,GAAG;AACzE,cAAM,YAAY,MAAM,uBAAuB,WAAW,OAAO;AAAA,UAC/D,MAAM,QAAQ;AAAA,UACd;AAAA,UACA,cAAAA;AAAA,QACF,CAAC;AACD,YAAI,cAAc,UAAa,CAAC,SAAS,IAAI,UAAU,GAAG,GAAG;AAC3D,mBAAS,IAAI,UAAU,GAAG;AAC1B,0BAAgB,KAAK,GAAG,UAAU,oBAAoB;AAAA,QACxD;AAAA,MACF;AAAA,IACF;AAEA,UAAM,UAA4B;AAAA,MAChC;AAAA,MACA,SAAS,yBAAyB,eAAe;AAAA,IACnD;AACA,WAAO;AAAA,MACL,IAAI;AAAA,MACJ,SAAS;AAAA,QACP,SAAS;AAAA,UACP,GAAG;AAAA,UACH,SAAS;AAAA,UACT,GAAI,qBAAqB,SAAY,CAAC,IAAI,EAAE,cAAc,iBAAiB;AAAA,UAC3E,GAAI,8BAA8B,qBAAqB,SACnD,EAAE,UAAU,iBAAiB,IAC7B,CAAC;AAAA,UACL,GAAI,uBAAuB,SAAY,CAAC,IAAI,EAAE,OAAO,mBAAmB;AAAA,UACxE,GAAI,qBAAqB,SAAY,CAAC,IAAI,EAAE,YAAY,iBAAiB;AAAA,QAC3E;AAAA,QACA;AAAA,MACF;AAAA,IACF;AAAA,EACF,QAAQ;AACN,WAAO,OAAO,SAAS;AAAA,MACrB;AAAA,MACA;AAAA,MACA,EAAE,WAAW,KAAK;AAAA,IACpB,CAAC;AAAA,EACH;AACF;AAEA,SAAS,+BAA+BC,YAAmD;AACzF,MAAIA,eAAc,OAAW,QAAO;AACpC,MAAI;AACF,UAAM,MAAc,qBAAYA,UAAS;AACzC,WAAO,QAAQ,OAAO,SAAoB,wBAAe,IAAI,SAAS,IAAI,SAAS,SAAS;AAAA,EAC9F,QAAQ;AACN,WAAO;AAAA,EACT;AACF;AAEA,SAAS,iBACP,SACA,KAC4D;AAC5D,QAAM,SAAS,QAAQ;AACvB,QAAM,MAAM,oBAAoB,QAAQ,GAAG,IAAI,QAAQ,MAAM;AAC7D,MACE,CAACC,UAAS,MAAM,KAChB,OAAO,OAAO,kBAAkB,YAChC,OAAO,QAAQ,kBAAkB,YACjC,OAAO,QAAQ,YAAY,YAC3B,CAAC,oBAAoB,GAAG,KACxB,OAAO,QAAQ,uBAAuB,UACtC;AACA,WAAO;AAAA,EACT;AAEA,SAAO;AAAA,IACL,kBAAkB,EAAE,eAAe,OAAO,cAAc;AAAA,IACxD,eAAe,QAAQ;AAAA,IACvB,SAAS,QAAQ;AAAA,IACjB;AAAA,IACA,oBAAoB,QAAQ;AAAA,IAC5B,GAAI,OAAO,QAAQ,YAAY,WAAW,EAAE,SAAS,QAAQ,QAAQ,IAAI,CAAC;AAAA,IAC1E,GAAI,OAAO,QAAQ,YAAY,WAAW,EAAE,SAAS,QAAQ,QAAQ,IAAI,CAAC;AAAA,IAC1E,GAAI,OAAO,QAAQ,SAAS,WAAW,EAAE,MAAM,QAAQ,KAAK,IAAI,CAAC;AAAA,IACjE,GAAI,OAAO,QAAQ,cAAc,WAAW,EAAE,WAAW,QAAQ,UAAU,IAAI,CAAC;AAAA,IAChF,GAAI,MAAM,QAAQ,QAAQ,cAAc,KAAK,QAAQ,eAAe,MAAM,CAAC,SAAS,OAAO,SAAS,QAAQ,IACxG,EAAE,gBAAgB,QAAQ,eAAe,IACzC,CAAC;AAAA,EACP;AACF;AAEA,SAAS,oBAAoB,OAAkD;AAC7E,SAAOA,UAAS,KAAK,KAAK,OAAO,MAAM,MAAM,YAAY,MAAM,EAAE,SAAS;AAC5E;AAEA,SAAS,aAAa,OAA+C;AACnE,MAAI,OAAO,UAAU,YAAY,MAAM,WAAW,EAAG,QAAO;AAC5D,SAAO,MAAM,MAAM,KAAK,CAAC,EAAE,CAAC;AAC9B;AAEA,SAASA,UAAS,OAAkD;AAClE,SAAO,OAAO,UAAU,YAAY,UAAU,QAAQ,CAAC,MAAM,QAAQ,KAAK;AAC5E;AAEA,SAAS,OACP,SACA,OAC6B;AAC7B,SAAO,EAAE,IAAI,OAAO,SAAS,MAAM;AACrC;AAEA,SAAS,kBAAkB,QAA8D;AACvF,SAAO;AAAA,IACL,SAAS,OAAO,WAAW;AAAA,IAC3B,MAAM,OAAO,QAAQ;AAAA,IACrB,SAAS;AAAA,EACX;AACF;AA3SA;AAAA;AAAA;AAcA;AACA;AACA;AACA;AACA;AAOA;AAAA;AAAA;;;ACzBA,SAAS,kBAAkB;AAC3B,SAAS,cAAAC,mBAAkB;AAE3B;AAAA,EACE,kBAAAC;AAAA,EACA,eAAAC;AAAA,EACA,iBAAAC;AAAA,OAEK;;;ACEA,IAAM,2BAAN,cAAuC,MAAM;AAAA,EAGlD,YAAY,MAA6B,SAAiB;AACxD,UAAM,OAAO;AACb,SAAK,OAAO;AACZ,SAAK,OAAO;AAAA,EACd;AACF;AASO,IAAM,oCAAN,cAAgD,yBAAyB;AAAA,EAC9E,YAAY,SAAiB;AAC3B,UAAM,6BAA6B,OAAO;AAC1C,SAAK,OAAO;AAAA,EACd;AACF;;;ACrBA,IAAM,eACH,OAEE,UACF,OAAO,UAAU,eAAe,KAAK;AAAA,EACpC,OAAO,UAAU;AACnB;AAWK,SAAS,gBAAgB,OAAwB;AACtD,SAAO,UAAU,cAAc,OAAO,GAAG,CAAC;AAC5C;AAEO,SAAS,cAAc,OAAgB,OAAO,KAAgB;AACnE,MAAI,UAAU,MAAM;AAClB,WAAO;AAAA,EACT;AAEA,UAAQ,OAAO,OAAO;AAAA,IACpB,KAAK;AACH,aAAO;AAAA,IACT,KAAK;AACH,UAAI,CAAC,OAAO,SAAS,KAAK,GAAG;AAC3B,cAAM,IAAI;AAAA,UACR,GAAG,IAAI;AAAA,QACT;AAAA,MACF;AACA,aAAO;AAAA,IACT,KAAK;AACH,gCAA0B,OAAO,IAAI;AACrC,aAAO;AAAA,IACT,KAAK;AACH,aAAO,2BAA2B,OAAO,IAAI;AAAA,IAC/C,KAAK;AAAA,IACL,KAAK;AAAA,IACL,KAAK;AAAA,IACL,KAAK;AAAA,IACL;AACE,YAAM,IAAI;AAAA,QACR,GAAG,IAAI;AAAA,MACT;AAAA,EACJ;AACF;AAEO,SAAS,UAAU,OAA0B;AAClD,MAAI,UAAU,MAAM;AAClB,WAAO;AAAA,EACT;AAEA,UAAQ,OAAO,OAAO;AAAA,IACpB,KAAK;AACH,aAAO,QAAQ,SAAS;AAAA,IAC1B,KAAK,UAAU;AACb,YAAM,UAAU,KAAK,UAAU,KAAK;AACpC,UAAI,YAAY,QAAW;AACzB,cAAM,IAAI;AAAA,UACR;AAAA,QACF;AAAA,MACF;AACA,aAAO;AAAA,IACT;AAAA,IACA,KAAK;AACH,aAAO,KAAK,UAAU,KAAK;AAAA,IAC7B,KAAK;AACH,UAAI,MAAM,QAAQ,KAAK,GAAG;AACxB,eAAO,IAAI,MAAM,IAAI,CAAC,SAAS,UAAU,IAAI,CAAC,EAAE,KAAK,GAAG,CAAC;AAAA,MAC3D;AACA,aAAO,gBAAgB,KAAK;AAAA,IAC9B;AACE,YAAM,IAAI;AAAA,QACR,+BAA+B,OAAO,KAAK;AAAA,MAC7C;AAAA,EACJ;AACF;AAEA,SAAS,2BAA2B,OAAe,MAAyB;AAC1E,qBAAmB,OAAO,IAAI;AAE9B,MAAI,MAAM,QAAQ,KAAK,GAAG;AACxB,eAAW,OAAO,OAAO,oBAAoB,KAAK,GAAG;AACnD,UAAI,QAAQ,UAAU;AACpB;AAAA,MACF;AACA,UAAI,CAAC,gBAAgB,KAAK,MAAM,MAAM,GAAG;AACvC,cAAM,IAAI;AAAA,UACR,GAAG,IAAI,IAAI,GAAG;AAAA,QAChB;AAAA,MACF;AACA,YAAM,aAAa,OAAO,yBAAyB,OAAO,GAAG;AAC7D,UAAI,YAAY,eAAe,MAAM;AACnC,cAAM,IAAI;AAAA,UACR,GAAG,IAAI,IAAI,GAAG;AAAA,QAChB;AAAA,MACF;AACA,UAAI,EAAE,WAAW,aAAa;AAC5B,cAAM,IAAI;AAAA,UACR,GAAG,IAAI,IAAI,GAAG;AAAA,QAChB;AAAA,MACF;AAAA,IACF;AACA,UAAMC,UAAsB,CAAC;AAC7B,aAAS,QAAQ,GAAG,QAAQ,MAAM,QAAQ,SAAS;AACjD,UAAI,CAAC,aAAa,OAAO,KAAK,GAAG;AAC/B,cAAM,IAAI;AAAA,UACR,GAAG,IAAI,IAAI,KAAK;AAAA,QAClB;AAAA,MACF;AACA,MAAAA,QAAO,KAAK,cAAc,MAAM,KAAK,GAAG,GAAG,IAAI,IAAI,KAAK,GAAG,CAAC;AAAA,IAC9D;AACA,WAAOA;AAAA,EACT;AAEA,QAAM,QAAQ,OAAO,eAAe,KAAK;AACzC,MAAI,UAAU,OAAO,aAAa,UAAU,MAAM;AAChD,UAAM,IAAI;AAAA,MACR,GAAG,IAAI;AAAA,IACT;AAAA,EACF;AAEA,QAAM,SAAS,uBAAO,OAAO,IAAI;AACjC,aAAW,OAAO,OAAO,oBAAoB,KAAK,GAAG;AACnD,8BAA0B,KAAK,GAAG,IAAI,MAAM;AAC5C,QAAI,QAAQ,eAAe,QAAQ,eAAe;AAChD,YAAM,IAAI;AAAA,QACR,GAAG,IAAI,IAAI,GAAG;AAAA,MAChB;AAAA,IACF;AACA,UAAM,aAAa,OAAO,yBAAyB,OAAO,GAAG;AAC7D,QAAI,YAAY,eAAe,MAAM;AACnC,YAAM,IAAI;AAAA,QACR,GAAG,IAAI,IAAI,GAAG;AAAA,MAChB;AAAA,IACF;AACA,QAAI,EAAE,WAAW,aAAa;AAC5B,YAAM,IAAI;AAAA,QACR,GAAG,IAAI,IAAI,GAAG;AAAA,MAChB;AAAA,IACF;AACA,UAAM,QAAQ,WAAW;AACzB,WAAO,GAAG,IAAI,cAAc,OAAO,GAAG,IAAI,IAAI,GAAG,EAAE;AAAA,EACrD;AACA,SAAO;AACT;AAEA,SAAS,mBAAmB,OAAe,MAAoB;AAC7D,MAAI,OAAO,sBAAsB,KAAK,EAAE,SAAS,GAAG;AAClD,UAAM,IAAI;AAAA,MACR,GAAG,IAAI;AAAA,IACT;AAAA,EACF;AACF;AAEA,SAAS,gBAAgB,KAAa,QAAyB;AAC7D,MAAI,CAAC,iBAAiB,KAAK,GAAG,GAAG;AAC/B,WAAO;AAAA,EACT;AACA,QAAM,QAAQ,OAAO,GAAG;AACxB,SAAO,OAAO,cAAc,KAAK,KAAK,SAAS,KAAK,QAAQ;AAC9D;AAEA,SAAS,gBAAgB,OAAsD;AAC7E,QAAM,OAAO,OAAO,KAAK,KAAK,EAAE,KAAK,qBAAqB;AAC1D,QAAM,QAAQ,KAAK,IAAI,CAAC,QAAQ,GAAG,KAAK,UAAU,GAAG,CAAC,IAAI,UAAU,MAAM,GAAG,CAAC,CAAC,EAAE;AACjF,SAAO,IAAI,MAAM,KAAK,GAAG,CAAC;AAC5B;AAEA,SAAS,sBAAsB,GAAW,GAAmB;AAC3D,QAAM,MAAM,KAAK,IAAI,EAAE,QAAQ,EAAE,MAAM;AACvC,WAAS,QAAQ,GAAG,QAAQ,KAAK,SAAS;AACxC,UAAM,eAAe,EAAE,WAAW,KAAK;AACvC,UAAM,gBAAgB,EAAE,WAAW,KAAK;AACxC,QAAI,iBAAiB,eAAe;AAClC,aAAO,eAAe;AAAA,IACxB;AAAA,EACF;AACA,SAAO,EAAE,SAAS,EAAE;AACtB;AAEA,SAAS,0BAA0B,OAAe,MAAoB;AACpE,WAAS,QAAQ,GAAG,QAAQ,MAAM,QAAQ,SAAS;AACjD,UAAM,OAAO,MAAM,WAAW,KAAK;AACnC,QAAI,QAAQ,SAAU,QAAQ,OAAQ;AACpC,YAAM,OAAO,MAAM,WAAW,QAAQ,CAAC;AACvC,UAAI,OAAO,MAAM,IAAI,KAAK,OAAO,SAAU,OAAO,OAAQ;AACxD,cAAM,IAAI;AAAA,UACR,GAAG,IAAI;AAAA,QACT;AAAA,MACF;AACA;AACA;AAAA,IACF;AACA,QAAI,QAAQ,SAAU,QAAQ,OAAQ;AACpC,YAAM,IAAI;AAAA,QACR,GAAG,IAAI;AAAA,MACT;AAAA,IACF;AAAA,EACF;AACF;;;AFjMA;AAMA;AAMA;;;AG5BO,SAAS,eAAe,OAAoC;AACjE,MAAI,OAAO,UAAU,YAAY,MAAM,WAAW,EAAG,QAAO;AAE5D,MAAI;AACJ,MAAI;AACF,aAAS,IAAI,IAAI,KAAK;AAAA,EACxB,QAAQ;AACN,WAAO;AAAA,EACT;AAEA,MACG,OAAO,aAAa,WAAW,OAAO,aAAa,YACpD,OAAO,aAAa,MACpB,OAAO,aAAa,MACpB,OAAO,WAAW,MAClB,OAAO,SAAS,MACf,OAAO,aAAa,MAAM,OAAO,aAAa,OAC/C,OAAO,WAAW,QAClB;AACA,WAAO;AAAA,EACT;AAEA,QAAM,0BAA0B,GAAG,OAAO,MAAM;AAChD,MAAI,UAAU,OAAO,UAAU,UAAU,yBAAyB;AAChE,WAAO;AAAA,EACT;AACA,SAAO,OAAO;AAChB;AAEO,SAAS,eAAe,OAAoC;AACjE,MAAI,OAAO,UAAU,YAAY,MAAM,WAAW,EAAG,QAAO;AAE5D,QAAM,CAACC,YAAW,UAAU,GAAG,KAAK,IAAI,MAAM,MAAM,GAAG;AACvD,MACE,MAAM,SAAS,KACd,aAAa,UAAa,CAAC,qBAAqB,KAAK,QAAQ,GAC9D;AACA,WAAO;AAAA,EACT;AAEA,MAAI,gBAAgBA,UAAS,KAAK,eAAeA,UAAS,GAAG;AAC3D,WAAOA;AAAA,EACT;AACA,SAAO;AACT;AAEA,SAAS,gBAAgB,OAAwB;AAC/C,MAAI,CAAC,MAAM,WAAW,WAAW,EAAG,QAAO;AAC3C,QAAM,QAAQ,aAAa,MAAM,MAAM,YAAY,MAAM,CAAC;AAC1D,SACE,UAAU,UACV,MAAM,WAAW,MACjB,MAAM,CAAC,MAAM,OACb,MAAM,CAAC,MAAM;AAEjB;AAEA,SAAS,eAAe,OAAwB;AAC9C,SAAO,iDAAiD,KAAK,KAAK;AACpE;AAEA,SAAS,aAAa,OAAuC;AAC3D,MAAI,MAAM,WAAW,EAAG,QAAO;AAC/B,QAAM,WAAW;AACjB,QAAM,SAAS,CAAC,CAAC;AACjB,aAAW,aAAa,OAAO;AAC7B,UAAM,QAAQ,SAAS,QAAQ,SAAS;AACxC,QAAI,QAAQ,EAAG,QAAO;AACtB,QAAI,QAAQ;AACZ,aAAS,IAAI,GAAG,IAAI,OAAO,QAAQ,KAAK,GAAG;AACzC,eAAS,OAAO,CAAC,IAAK;AACtB,aAAO,CAAC,IAAI,QAAQ;AACpB,gBAAU;AAAA,IACZ;AACA,WAAO,QAAQ,GAAG;AAChB,aAAO,KAAK,QAAQ,GAAI;AACxB,gBAAU;AAAA,IACZ;AAAA,EACF;AACA,aAAW,aAAa,OAAO;AAC7B,QAAI,cAAc,IAAK;AACvB,WAAO,KAAK,CAAC;AAAA,EACf;AACA,SAAO,WAAW,KAAK,OAAO,QAAQ,CAAC;AACzC;;;ACDO,SAAS,qBACd,aACA,OACgB;AAChB,QAAM,UACJ,MAAM,YAAY,SACd,SACA,uBAAuB,MAAM,MAAM,MAAM,OAAO;AAEtD,SAAO;AAAA,IACL,MAAM,MAAM;AAAA,IACZ,SAAS,MAAM;AAAA,IACf,WAAW,MAAM;AAAA,IACjB,GAAI,YAAY,SACZ,CAAC,IACD;AAAA,MACE,SAAS,SAAS,OAAO,IAAI,UAAU,EAAE,UAAU,QAAQ;AAAA,IAC7D;AAAA,EACN;AACF;AAQA,IAAM,6BAOF;AAAA,EACF,eAAe;AAAA,IACb,QAAQ,CAAC,UACP,MAAM,QAAQ,KAAK,IAAI,eAAe,KAAK,IAAI;AAAA,EACnD;AAAA,EACA,+BAA+B;AAAA,IAC7B,mBAAmB,CAAC,UAClB,MAAM,QAAQ,KAAK,KAAK,MAAM,MAAM,CAAC,SAAS,OAAO,UAAU,IAAI,CAAC,IAChE,QACA;AAAA,EACR;AAAA,EACA,8BAA8B;AAAA,IAC5B,oBAAoB;AAAA,IACpB,kBAAkB;AAAA,EACpB;AAAA,EACA,0BAA0B;AAAA,IACxB,cAAc;AAAA,IACd,cAAc;AAAA,EAChB;AACF;AAEA,SAAS,uBACP,MACA,SAC+C;AAC/C,QAAM,SAAS,2BAA2B,IAAI;AAC9C,MAAI,WAAW,OAAW,QAAO;AAEjC,QAAM,cAAuC,CAAC;AAC9C,aAAW,CAAC,KAAK,QAAQ,KAAK,OAAO,QAAQ,MAAM,GAAG;AACpD,QAAI,CAAC,OAAO,SAAS,GAAG,EAAG;AAC3B,UAAM,QAAQ,SAAS,QAAQ,GAAG,CAAC;AACnC,QAAI,UAAU,OAAW,aAAY,GAAG,IAAI;AAAA,EAC9C;AACA,SAAO,OAAO,KAAK,WAAW,EAAE,WAAW,IAAI,SAAY;AAC7D;AAEA,SAAS,eACP,OACmD;AACnD,QAAM,QAAQ,MAAM,IAAI,CAAC,UAAU;AACjC,QAAI,CAAC,SAAS,KAAK,KAAK,OAAO,MAAM,SAAS,SAAU,QAAO;AAC/D,WAAO,iBAAiB,IAAI,MAAM,IAAI,IAAI,EAAE,MAAM,MAAM,KAAK,IAAI;AAAA,EACnE,CAAC;AACD,SAAO,MAAM;AAAA,IACX,CAAC,UAA+C,UAAU;AAAA,EAC5D,IACI,QACA;AACN;AAEA,IAAM,mBAAmB,oBAAI,IAAI;AAAA,EAC/B;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AACF,CAAC;AA0ED,SAAS,OAAO,OAAe,KAAsB;AACnD,SAAO,OAAO,UAAU,eAAe,KAAK,OAAO,GAAG;AACxD;AAEA,SAAS,SAAS,OAA4D;AAC5E,SAAO,UAAU,QAAQ,OAAO,UAAU,YAAY,CAAC,MAAM,QAAQ,KAAK;AAC5E;;;AJtOA;AAEA;AAsCA,eAAsB,uCACpB,aACA,kBACA,kBACA,cACmC;AACnC,QAAM,SAAS,0BAA0B,gBAAgB;AACzD,MAAI,WAAW,QAAW;AACxB,WAAO;AAAA,MACL,EAAE,aAAa,iBAAiB;AAAA,MAChC,yBAAyB;AAAA,MACzB,eAAe,iBAAiB,mCAAmC;AAAA,IACrE;AAAA,EACF;AACA,MAAI,OAAO,OAAO,eAAe,YAAY,OAAO,WAAW,WAAW,GAAG;AAC3E,WAAO;AAAA,MACL,EAAE,aAAa,iBAAiB;AAAA,MAChC,yBAAyB,MAAM;AAAA,MAC/B;AAAA,QACE;AAAA,QACA;AAAA,MACF;AAAA,IACF;AAAA,EACF;AAEA,SAAO;AAAA,IAAuB,OAAO;AAAA,IAAW,MAC9C;AAAA,MACE;AAAA,MACA;AAAA,MACA;AAAA,MACA;AAAA,IACF;AAAA,EACF;AACF;AAEA,eAAe,0BACb,aACA,kBACA,QACA,cACmC;AACnC,QAAM,WAAW,MAAM;AAAA,IACrB;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,EACF;AACA,MAAI,gBAAgB,QAAQ,EAAG,QAAO,SAAS;AAE/C,MACE,SAAS,UAAU,gBAAgB,2BACnC,SAAS,UAAU,qBAAqB,GACxC;AACA,WAAO;AAAA,MACL,SAAS;AAAA,MACT,SAAS,kBAAkB,QAAQ;AAAA,MACnC;AAAA,QACE;AAAA,QACA;AAAA,MACF;AAAA,IACF;AAAA,EACF;AAEA,QAAMC,kBAAiB,SAAS,kBAAkB;AAClD,MAAIA,gBAAe,YAAY,OAAW,QAAO,6BAA6B,QAAQ;AACtF,QAAM,mBAAmBA;AACzB,MAAI;AACJ,MAAI;AACF,cAAUC,mBAAkB,MAAM,SAAS,WAAW;AAAA,MACpD;AAAA,MACA,SAAS,YAAY;AAAA,IACvB,CAAC;AAAA,EACH,QAAQ;AACN,WAAO;AAAA,MACL,SAAS;AAAA,MACT,iBAAiB;AAAA,MACjB;AAAA,QACE;AAAA,QACA;AAAA,MACF;AAAA,IACF;AAAA,EACF;AACA,QAAM,aAAa,YAAY,SAC3B,YACA,2BAA2B,UAAU,SAAS,gBAAgB;AAClE,MAAI,eAAe,cAAc;AAC/B,WAAO;AAAA,MACL,SAAS;AAAA,MACT,iBAAiB;AAAA,MACjB;AAAA,QACE;AAAA,QACA;AAAA,MACF;AAAA,IACF;AAAA,EACF;AACA,MAAI,eAAe,SAAS;AAC1B,WAAO;AAAA,MACL,SAAS;AAAA,MACT,iBAAiB;AAAA,MACjB;AAAA,QACE;AAAA,QACA;AAAA,MACF;AAAA,IACF;AAAA,EACF;AAEA,QAAM,QAAQ,MAAM,0BAA0B,UAAU,EAAE,uBAAuB,KAAK,CAAC;AACvF,MAAI,MAAM,WAAW,sBAAsB;AACzC,WAAO;AAAA,EACT;AACA,MACE,iBAAiB,QAAQ,YAAY,qBACrC,CAAC;AAAA,IACC,MAAM;AAAA,IACN,iBAAiB,QAAQ;AAAA,EAC3B,GACA;AACA,WAAO,sBAAsB,QAAQ;AAAA,EACvC;AAEA,MAAI;AACF,UAAM,0BAA2B,iBAAiB,QAAQ,KAIvD;AACH,QAAI,OAAO,4BAA4B,YAAY;AACjD,aAAO,sBAAsB,QAAQ;AAAA,IACvC;AACA,UAAM,wBAAwB;AAAA,MAC5B,iBAAiB,QAAQ;AAAA,MACzB,MAAM;AAAA,IACR;AAEA,UAAMC,gBAAe;AAAA,MACnB,iBAAiB,QAAQ;AAAA,MACzB,iBAAiB,QAAQ;AAAA,IAC3B;AACA,UAAM,mBAAmB;AAAA,MACvB,iBAAiB,QAAQ;AAAA,MACzB,MAAM;AAAA,MACN;AAAA,MACAA;AAAA,IACF;AACA,QAAI,qBAAqB,QAAW;AAClC,aAAO,sBAAsB,QAAQ;AAAA,IACvC;AACA,UAAM,eAAwC;AAAA,MAC5C,GAAG;AAAA,MACH,SAAS;AAAA,QACP,GAAG,iBAAiB;AAAA,QACpB,SAAS;AAAA,MACX;AAAA,IACF;AACA,UAAM,QAAQ,MAAM,0BAA0B;AAAA,MAC5C,GAAG;AAAA,MACH,mBAAmB,EAAE,IAAI,MAAM,SAAS,aAAa;AAAA,IACvD,GAAG,EAAE,uBAAuB,KAAK,CAAC;AAClC,WAAO,MAAM,WAAW,uBACpB,sBAAsB,QAAQ,IAC9B;AAAA,EACN,QAAQ;AACN,WAAO,sBAAsB,QAAQ;AAAA,EACvC;AACF;AAYA,SAAS,gBACP,UAC8D;AAC9D,SAAO,YAAY;AACrB;AAEA,eAAe,kBACb,aACA,kBACA,kBACA,cAC6B;AAC7B,QAAM,YAA0B,EAAE,aAAa,iBAAiB;AAChE,QAAM,SAAS,0BAA0B,gBAAgB;AACzD,MAAI,WAAW,QAAW;AACxB,WAAO,EAAE,QAAQ,SAAS,QAAQ;AAAA,MAChC;AAAA,MACA,yBAAyB;AAAA,MACzB,eAAe,iBAAiB,mCAAmC;AAAA,IACrE,EAAE;AAAA,EACJ;AAIA,QAAM,EAAE,iBAAAC,iBAAgB,IAAI,MAAM;AAClC,QAAM,SAASA,iBAAgB,aAAa,gBAAgB;AAK5D,MAAI,OAAO,WAAW,uBAAuB;AAC3C,WAAO,EAAE,QAAQ,SAAS,QAAQ;AAAA,MAChC;AAAA,MACA,yBAAyB,MAAM;AAAA,MAC/B;AAAA,QACE;AAAA,QACA;AAAA,MACF;AAAA,IACF,EAAE;AAAA,EACJ;AACA,MAAI,OAAO,WAAW,iCAAiC;AACrD,WAAO,EAAE,QAAQ,SAAS,QAAQ;AAAA,MAChC;AAAA,MACA,yBAAyB,MAAM;AAAA,MAC/B;AAAA,QACE;AAAA,QACA;AAAA,QACA,EAAE,SAAS,EAAE,mBAAmB,OAAO,kBAAkB,EAAE;AAAA,MAC7D;AAAA,IACF,EAAE;AAAA,EACJ;AAEA,QAAM,aAAa,OAAO;AAC1B,QAAM,cAAc,WAAW,MAAM,UAAU,YAAY;AAC3D,MAAI,CAAC,YAAY,SAAS;AACxB,WAAO,EAAE,QAAQ,SAAS,QAAQ;AAAA,MAChC;AAAA,MACA,yBAAyB,MAAM;AAAA,MAC/B;AAAA,QACE,WAAW,yBAAyB;AAAA,QACpC;AAAA,QACA;AAAA,UACE,SAAS,gBAAgB,YAAY,KAAK;AAAA,QAC5C;AAAA,MACF;AAAA,IACF,EAAE;AAAA,EACJ;AAKA,QAAM,uBAAuB,MAAM,eAAe,QAAQ,YAAY;AACtE,MAAI,CAAC,qBAAqB,IAAI;AAC5B,WAAO,EAAE,QAAQ,SAAS,QAAQ;AAAA,MAChC;AAAA,MACA,qBAAqB;AAAA,MACrB,qBAAqB;AAAA,IACvB,EAAE;AAAA,EACJ;AAEA,MACE,OAAO,eAAe,UACtB,CAAC,WAAW,SAAS,SAAS,qBAAqB,QAAQ,QAAQ,OAAO,GAC1E;AACA,WAAO,EAAE,QAAQ,SAAS,QAAQ;AAAA,MAChC;AAAA,MACA,qBAAqB,QAAQ;AAAA,MAC7B;AAAA,QACE;AAAA,QACA;AAAA,MACF;AAAA,IACF,EAAE;AAAA,EACJ;AACA,MACE,OAAO,eAAe,UACtB,WAAW,YAAY,mBACvB,eAAe,qBAAqB,QAAQ,QAAQ,OAAO,KAC3D,OAAO,sBAAsB,MAC7B;AACA,WAAO,EAAE,QAAQ,SAAS,QAAQ;AAAA,MAChC;AAAA,MACA,qBAAqB,QAAQ;AAAA,MAC7B;AAAA,QACE;AAAA,QACA;AAAA,MACF;AAAA,IACF,EAAE;AAAA,EACJ;AAEA,QAAM,oBACJ,WAAW,YAAY,eACnB,uBACA,MAAM,eAAe,QAAQ,eAAe;AAClD,MAAI,CAAC,kBAAkB,IAAI;AACzB,WAAO,EAAE,QAAQ,SAAS,QAAQ;AAAA,MAChC;AAAA,MACA,kBAAkB;AAAA,MAClB,kBAAkB;AAAA,IACpB,EAAE;AAAA,EACJ;AACA,MAAI,WAAW,YAAY,iBAAiB;AAC1C,UAAM,gBAAgB,kBAAkB,QAAQ,QAAQ;AACxD,QAAI,CAAC,WAAW,SAAS,SAAS,aAAa,GAAG;AAChD,aAAO,EAAE,QAAQ,SAAS,QAAQ;AAAA,QAChC;AAAA,QACA,kBAAkB,QAAQ;AAAA,QAC1B;AAAA,UACE;AAAA,UACA;AAAA,QACF;AAAA,MACF,EAAE;AAAA,IACJ;AACA,QAAI,eAAe,aAAa,KAAK,OAAO,sBAAsB,MAAM;AACtE,aAAO,EAAE,QAAQ,SAAS,QAAQ;AAAA,QAChC;AAAA,QACA,kBAAkB,QAAQ;AAAA,QAC1B;AAAA,UACE;AAAA,UACA;AAAA,QACF;AAAA,MACF,EAAE;AAAA,IACJ;AAAA,EACF;AACA,SAAO;AAAA,IACL;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,EACF;AACF;AAEA,eAAe,0BACb,UACA,UAAyD,CAAC,GACvB;AACnC,QAAM,EAAE,WAAW,YAAY,aAAa,kBAAkB,IAAI;AAClE,QAAMH,kBACJ,kBAAkB,QAAQ,YAAY,SAClC,SACC,kBAAkB;AACzB,QAAME,gBAAeF,oBAAmB,SACpC,SACA;AAAA,IACAA,gBAAe,QAAQ;AAAA,IACvBA,gBAAe,QAAQ;AAAA,EACzB;AAEF,MAAI;AACF,UAAM,UAAU,MAAM,WAAW;AAAA,MAC9BA,mBAAkB,kBAAkB;AAAA,MACrC,YAAY;AAAA,IACd;AACA,UAAM,WAAWC,mBAAkB,OAAO;AAC1C,QAAI,aAAa,QAAW;AAC1B,aAAO;AAAA,QACL;AAAA,QACA,kBAAkB,QAAQ;AAAA,QAC1B;AAAA,UACE;AAAA,UACA;AAAA,QACF;AAAA,MACF;AAAA,IACF;AAEA,UAAM,aAAa;AAAA,MAChBD,iBAAgB,QAAQ,WAAW,CAAC;AAAA,MACrC;AAAA,MACAE;AAAA,IACF;AACA,QAAI,CAAC,WAAW,WAAW;AACzB,UAAIF,oBAAmB,QAAW;AAChC,eAAO;AAAA,UACL;AAAA,UACA,kBAAkB,QAAQ;AAAA,UAC1B,uBAAuB;AAAA,QACzB;AAAA,MACF;AACA,UAAI,QAAQ,uBAAuB;AACjC,YAAI;AACF,gBAAM,UAAU,+BAA+B;AAAA,YAC7C,SAASA,gBAAe,QAAQ;AAAA,YAChC,MAAMA,gBAAe,QAAQ;AAAA,YAC7B,YAAYA,gBAAe,QAAQ;AAAA,YACnC,SAASA,gBAAe,QAAQ;AAAA,YAChC,cAAcA,gBAAe,QAAQ,gBAAgB;AAAA,YACrD,GAAIA,gBAAe,QAAQ,aAAa,SACpC,CAAC,IACD,EAAE,UAAUA,gBAAe,QAAQ,SAAS;AAAA,YAChD,GAAIA,gBAAe,QAAQ,UAAU,SACjC,CAAC,IACD,EAAE,SAASA,gBAAe,QAAQ,MAAM;AAAA,YAC5C,SAAS,WAAW;AAAA,UACtB,CAAC;AACD,iBAAO;AAAA,YACL;AAAA,YACA,kBAAkB,QAAQ;AAAA,YAC1B,YAAY;AAAA,YACZ;AAAA,YACA,WAAW;AAAA,YACXA,gBAAe,QAAQ;AAAA,UACzB;AAAA,QACF,QAAQ;AACN,iBAAO;AAAA,YACL;AAAA,YACA,kBAAkB,QAAQ;AAAA,YAC1B,uBAAuB;AAAA,UACzB;AAAA,QACF;AAAA,MACF;AACA,YAAM,YAAY,MAAM;AAAA,QACtBA;AAAA,QACA,WAAW;AAAA,MACb;AACA,UAAI,UAAU,WAAW,SAAS;AAChC,eAAO;AAAA,UACL;AAAA,UACA,kBAAkB,QAAQ;AAAA,UAC1B,UAAU;AAAA,QACZ;AAAA,MACF;AACA,aAAO;AAAA,QACL;AAAA,QACA,kBAAkB,QAAQ;AAAA,QAC1B,YAAY;AAAA,QACZ,UAAU;AAAA,QACV,UAAU;AAAA,QACVA,gBAAe,QAAQ;AAAA,MACzB;AAAA,IACF;AAEA,UAAM,UAAU,MAAM,WAAW;AAAA,MAC/B,kBAAkB;AAAA,MAClB,YAAY;AAAA,IACd;AAEA,YAAQ,QAAQ,QAAQ;AAAA,MACtB,KAAK,MAAM;AACT,cAAM,eAAe,WAAW,OAAO,UAAU,QAAQ,MAAM;AAC/D,YAAI,CAAC,aAAa,SAAS;AACzB,iBAAO;AAAA,YACL;AAAA,YACA,kBAAkB,QAAQ;AAAA,YAC1B;AAAA,cACE;AAAA,cACA;AAAA,YACF;AAAA,UACF;AAAA,QACF;AACA,eAAO;AAAA,UACL,QAAQ;AAAA,UACR;AAAA,UACA,SAAS,kBAAkB,QAAQ;AAAA,UACnC,QAAQ,aAAa;AAAA,QACvB;AAAA,MACF;AAAA,MACA,KAAK,sBAAsB;AACzB,cAAM,SAASC,mBAAkB,QAAQ,OAAO;AAChD,YACE,WAAW,UACX,CAAC;AAAA,UACC;AAAA,UACA;AAAA,UACAC;AAAA,QACF,GACA;AACA,iBAAO;AAAA,YACL;AAAA,YACA,kBAAkB,QAAQ;AAAA,YAC1B;AAAA,cACE;AAAA,cACA;AAAA,YACF;AAAA,UACF;AAAA,QACF;AACA,YAAIF,oBAAmB,QAAW;AAChC,iBAAO;AAAA,YACL;AAAA,YACA,kBAAkB,QAAQ;AAAA,YAC1B,uBAAuB;AAAA,UACzB;AAAA,QACF;AACA,YAAI,QAAQ,uBAAuB;AACjC,cAAI;AACF,kBAAM,UAAU,+BAA+B;AAAA,cAC7C,SAASA,gBAAe,QAAQ;AAAA,cAChC,MAAMA,gBAAe,QAAQ;AAAA,cAC7B,YAAYA,gBAAe,QAAQ;AAAA,cACnC,SAASA,gBAAe,QAAQ;AAAA,cAChC,cAAcA,gBAAe,QAAQ,gBAAgB;AAAA,cACrD,GAAIA,gBAAe,QAAQ,aAAa,SACpC,CAAC,IACD,EAAE,UAAUA,gBAAe,QAAQ,SAAS;AAAA,cAChD,GAAIA,gBAAe,QAAQ,UAAU,SACjC,CAAC,IACD,EAAE,SAASA,gBAAe,QAAQ,MAAM;AAAA,cAC5C,SAAS;AAAA,YACX,CAAC;AACD,mBAAO;AAAA,cACL;AAAA,cACA,kBAAkB,QAAQ;AAAA,cAC1B,YAAY;AAAA,cACZ;AAAA,cACA;AAAA,cACAA,gBAAe,QAAQ;AAAA,cACvB,QAAQ,uBAAuB;AAAA,YACjC;AAAA,UACF,QAAQ;AACN,mBAAO;AAAA,cACL;AAAA,cACA,kBAAkB,QAAQ;AAAA,cAC1B,uBAAuB;AAAA,YACzB;AAAA,UACF;AAAA,QACF;AACA,cAAM,YAAY,MAAM;AAAA,UACtBA;AAAA,UACA;AAAA,UACA;AAAA,QACF;AACA,YAAI,UAAU,WAAW,SAAS;AAChC,iBAAO;AAAA,YACL;AAAA,YACA,kBAAkB,QAAQ;AAAA,YAC1B,UAAU;AAAA,UACZ;AAAA,QACF;AACA,eAAO;AAAA,UACL;AAAA,UACA,kBAAkB,QAAQ;AAAA,UAC1B,YAAY;AAAA,UACZ,UAAU;AAAA,UACV,UAAU;AAAA,UACVA,gBAAe,QAAQ;AAAA,UACvB,QAAQ,uBAAuB;AAAA,QACjC;AAAA,MACF;AAAA,MACA,KAAK;AACH,eAAO;AAAA,UACL,QAAQ;AAAA,UACR;AAAA,UACA,SAAS,kBAAkB,QAAQ;AAAA,UACnC,OAAO,QAAQ;AAAA,UACf,OAAO;AAAA,YACL;AAAA,YACA,YAAY;AAAA,YACZ,QAAQ,uBAAuB;AAAA,UACjC;AAAA,QACF;AAAA,MACF,KAAK;AACH,eAAO;AAAA,UACL;AAAA,UACA,kBAAkB,QAAQ;AAAA,UAC1B;AAAA,YACE;AAAA,YACA,uBAAuB,QAAQ,KAAK;AAAA,UACtC;AAAA,QACF;AAAA,MACF;AACE,eAAO;AAAA,UACL;AAAA,UACA,kBAAkB,QAAQ;AAAA,UAC1B,uBAAuB;AAAA,QACzB;AAAA,IACJ;AAAA,EACF,SAAS,OAAO;AACd,WAAO;AAAA,MACL;AAAA,MACA,kBAAkB,QAAQ;AAAA,MAC1B,qBAAqB,YAAY,6BAA6B,KAAK,CAAC;AAAA,IACtE;AAAA,EACF;AACF;AAEA,SAAS,0BACP,QAC8B;AAC9B,MAAI,OAAO,WAAW,YAAY,WAAW,KAAM,QAAO;AAE1D,MAAI;AACF,UAAM,YAAY;AAClB,UAAM,UAAU,UAAU;AAC1B,UAAM,OAAO,UAAU;AACvB,UAAM,YAAY,UAAU;AAC5B,UAAM,oBAAoB,UAAU;AACpC,UAAM,aAAa,UAAU;AAE7B,QACG,YAAY,UAAa,OAAO,YAAY,YAC5C,SAAS,UAAa,OAAO,SAAS,YACtC,cAAc,WACZ,OAAO,cAAc,YAAY,CAACI,YAAW,SAAS,MACxD,sBAAsB,UACrB,OAAO,sBAAsB,aAC9B,eAAe,UAAa,OAAO,eAAe,UACnD;AACA,aAAO;AAAA,IACT;AAEA,WAAO;AAAA,MACL,GAAI,YAAY,SAAY,CAAC,IAAI,EAAE,QAAQ;AAAA,MAC3C,GAAI,SAAS,SAAY,CAAC,IAAI,EAAE,KAAK;AAAA,MACrC,GAAI,cAAc,SAAY,CAAC,IAAI,EAAE,UAAU;AAAA,MAC/C,GAAI,sBAAsB,OAAO,EAAE,mBAAmB,KAAK,IAAI,CAAC;AAAA,MAChE,GAAI,eAAe,SAAY,CAAC,IAAI,EAAE,WAAW;AAAA,IACnD;AAAA,EACF,QAAQ;AACN,WAAO;AAAA,EACT;AACF;AAEA,eAAe,eACb,QACA,aACsC;AACtC,MAAI;AAIF,UAAM,EAAE,yBAAAC,yBAAwB,IAAI,MAAM;AAC1C,WAAO,MAAMA,yBAAwB,QAAQ,WAAW;AAAA,EAC1D,SAAS,OAAO;AACd,WAAO;AAAA,MACL,IAAI;AAAA,MACJ,SAAS,yBAAyB,MAAM;AAAA,MACxC,OAAO,6BAA6B,KAAK;AAAA,IAC3C;AAAA,EACF;AACF;AAEA,SAAS,yBACP,SAA2B,CAAC,GACH;AACzB,SAAO;AAAA,IACL,SAAS,OAAO,OAAO,YAAY,WAAW,OAAO,UAAU;AAAA,IAC/D,MAAM,eAAe,OAAO,IAAI,KAAK;AAAA,IACrC,SAAS;AAAA,EACX;AACF;AAEA,SAAS,YACP,WACA,SACA,OACwB;AACxB,SAAO,EAAE,QAAQ,SAAS,WAAW,SAAS,MAAM;AACtD;AAEA,SAAS,gBACP,WACA,OACA,qBAMC;AACD,SAAO;AAAA,IACL,aAAa,UAAU;AAAA,IACvB,kBAAkB,UAAU;AAAA,IAC5B,aAAa,WAAW,QAAQ,EAC7B,OAAO,gBAAgB,KAAK,GAAG,MAAM,EACrC,OAAO,KAAK;AAAA,IACf;AAAA,EACF;AACF;AAaA,eAAe,wBACb,SACA,SACA,QAAQ,OACqB;AAC7B,QAAM,aAAa,QAAQ,QAAQ;AACnC,MAAI,eAAe,QAAW;AAC5B,WAAO;AAAA,MACL,QAAQ;AAAA,MACR,OAAO;AAAA,QACL;AAAA,QACA;AAAA,MACF;AAAA,IACF;AAAA,EACF;AACA,MAAI;AACF,UAAMH,gBAAe;AAAA,MACnB,QAAQ,QAAQ;AAAA,MAChB,QAAQ,QAAQ;AAAA,IAClB;AACA,UAAM,mBAAmB,kCAAkC,SAAyCA,aAAY;AAChH,UAAM,mBAAmB,kCAAkC,QAAQ,QAAQ,SAAyCA,aAAY;AAChI,UAAM,aAAa,MAAM,+BAA+B;AAAA,MACtD,SAAS,QAAQ,QAAQ;AAAA,MACzB,SAAS,QAAQ,QAAQ;AAAA,MACzB,cAAc,QAAQ,QAAQ,gBAAgB;AAAA,MAC9C,MAAM,QAAQ,QAAQ;AAAA,MACtB;AAAA,MACA,GAAI,QAAQ,QAAQ,aAAa,SAC7B,CAAC,IACD,EAAE,UAAU,QAAQ,QAAQ,SAAS;AAAA,MACzC,GAAI,QAAQ,QAAQ,UAAU,SAC1B,CAAC,IACD,EAAE,SAAS,QAAQ,QAAQ,MAAM;AAAA,MACrC,SAAS;AAAA,MACT,SAAU,QACN,CAAC,IACD;AAAA,MACJ,cAAAA;AAAA,IACF,CAAC;AACD,QAAI,WAAW,WAAW,WAAW;AACnC,aAAO;AAAA,QACL,QAAQ;AAAA,QACR,OAAO;AAAA,UACL;AAAA,UACA;AAAA,QACF;AAAA,MACF;AAAA,IACF;AACA,WAAO;AAAA,MACL,QAAQ;AAAA,MACR,SAAS,WAAW;AAAA,MACpB,SAAS;AAAA,IACX;AAAA,EACF,QAAQ;AACN,WAAO;AAAA,MACL,QAAQ;AAAA,MACR,OAAO;AAAA,QACL;AAAA,QACA;AAAA,MACF;AAAA,IACF;AAAA,EACF;AACF;AAEA,SAAS,wBACP,WACA,SACA,OACA,SACA,SACA,MACA,sBAAsB,OACE;AACxB,SAAO;AAAA,IACL,QAAQ;AAAA,IACR;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA,UAAU,eAAe,SAAS,IAAI;AAAA,IACtC,OAAO,gBAAgB,WAAW,OAAO,mBAAmB;AAAA,EAC9D;AACF;AAEA,SAAS,eACP,SACA,MACgB;AAChB,QAAM,YAAY;AAGlB,MAAI;AACJ,MAAI;AACF,UAAM,YAAY,UAAU,wBAAwB,OAAO;AAC3D,QAAI,OAAO,cAAc,YAAY,UAAU,SAAS,EAAG,OAAM;AAAA,EACnE,QAAQ;AAAA,EAGR;AACA,SAAO;AAAA,IACL,MAAM;AAAA,IACN,WAAW,QAAQ;AAAA,IACnB,GAAI,QAAQ,SAAY,CAAC,IAAI,EAAE,IAAI;AAAA,IACnC,UAAU;AAAA,EACZ;AACF;AAEA,SAASD,mBACP,OACqC;AACrC,SAAO,0BAA0B,KAAK;AAGxC;AAEA,SAAS,uCACP,cACA,oBACS;AACT,QAAM,qBAAqB,kBAAkB,kBAAkB;AAC/D,MAAI,uBAAuB,OAAW,QAAO;AAC7C,SAAO,aAAa,MAAM,CAAC,gBAAgB;AACzC,QAAI,YAAY,YAAY,wBAAwB;AAClD,aAAO,YAAY,UAAU;AAAA,IAC/B;AACA,UAAM,mBAAmB,kBAAkB,YAAY,KAAK;AAC5D,WAAO,YAAY,YAAY,kBAAkB,qBAAqB;AAAA,EACxE,CAAC;AACH;AAEA,SAAS,kBAAkB,OAA+C;AACxE,MAAI,OAAO,UAAU,SAAU,QAAO;AACtC,QAAM,cAAcK,eAAc,KAAK;AACvC,MAAI,gBAAgB,KAAM,QAAO;AACjC,MAAI;AACF,UAAM,MAAMC,aAAY,YAAY,KAAK;AACzC,WAAO,QAAQ,OACX,SACAD,eAAcE,gBAAe,IAAI,SAAS,IAAI,SAAS,YAAY,IAAI,CAAC,GAAG;AAAA,EACjF,QAAQ;AACN,WAAO;AAAA,EACT;AACF;AAEA,SAAS,2BACP,UACA,SACA,SACoC;AACpC,MACE,SAAS,WAAW,OAAO,2BAC3B,SAAS,WAAW,YAAY,KAChC,KAAK,UAAU,SAAS,WAAW,OAAO,MAAM,KAAK,UAAU,CAAC,QAAQ,aAAa,CAAC,EACtF,QAAO;AAET,QAAMN,gBAAe,uBAAuB,QAAQ,QAAQ,MAAM,QAAQ,QAAQ,KAAK;AACvF,MAAI;AACJ,MAAI;AACF,gBAAY;AAAA,MACV,SAAS,YAAY;AAAA,MACrB,QAAQ,QAAQ;AAAA,MAChB,QAAQ,QAAQ;AAAA,IAClB;AAAA,EACF,QAAQ;AACN,WAAO;AAAA,EACT;AACA,QAAM,gBAAgB;AAAA,IACpB;AAAA,IACAA;AAAA,EACF;AACA,MAAI,cAAc,WAAW,EAAG,QAAO;AACvC,QAAM,KAAK,cAAc,KAAK,CAAC,eAAe,WAAW,YAAY,cAAc;AACnF,QAAM,UAAU,cAAc,KAAK,CAAC,eAAe,WAAW,YAAY,sBAAsB;AAChG,MAAI,OAAO,UAAa,YAAY,OAAW,QAAO;AACtD,QAAM,iBAAiB,kBAAkB,GAAG,KAAK;AACjD,QAAM,qBAAqB,kBAAkB,QAAQ,QAAQ,KAAK;AAClE,MAAI,mBAAmB,UAAa,uBAAuB,UAAa,mBAAmB,oBAAoB;AAC7G,WAAO;AAAA,EACT;AACA,MAAI,KAAK,UAAU,EAAE,MAAM,KAAK,UAAU;AAAA,IACxC,SAAS;AAAA,IACT,OAAOA,cAAa,UAAU,KAAK;AAAA,IACnC,MAAM,UAAU;AAAA,IAChB,SAAS,CAAC,kBAAkB;AAAA,EAC9B,CAAC,EAAG,QAAO;AACX,MACE,KAAK,UAAU,OAAO,MAAM,KAAK,UAAU;AAAA,IACzC,SAAS;AAAA,IACT,MAAM,QAAQ;AAAA,IACd,SAAS,CAAC,8BAA8B;AAAA,EAC1C,CAAC,KACD,OAAO,QAAQ,SAAS,YACxB,CAAC,QAAQ,KAAK,WAAW,2BAA2B,EACpD,QAAO;AACT,SAAO;AACT;AAEA,SAAS,4BACP,MACA,WACA,SACAA,eAC8C;AAC9C,QAAM,YAAY;AAKlB,MAAI,OAAO,UAAU,0BAA0B,WAAY,QAAO;AAClE,MAAI,UAAU,sBAAsB,CAAC,GAAG,SAAS,CAAC,MAAM,KAAM,QAAO;AACrE,MAAI,OAAO,UAAU,mCAAmC,cACpD,OAAO,UAAU,yCAAyC,WAAY,QAAO;AAEjF,QAAM,OAAO,UAAU,+BAA+B;AACtD,QAAM,YAAY,UAAU,qCAAqC;AACjE,MAAI,CAAC,MAAM,QAAQ,IAAI,KAAK,CAAC,MAAM,QAAQ,SAAS,EAAG,QAAO;AAC9D,QAAM,iBAAiB,0BAA0B,SAAS;AAC1D,MAAI,mBAAmB,OAAW,QAAO;AACzC,QAAM,oBAAoB,eAAe;AAAA,IAAO,CAAC,eAC/C,8BAA8B,CAAC,UAAU,GAAG,SAASA,aAAY;AAAA,EACnE;AACA,MAAI,CAAC,8BAA8B,WAAW,mBAAmBA,aAAY,EAAG,QAAO;AACvF,QAAM,WAAW;AAAA,IACf,CAAC,GAAG,MAAM,GAAG,iBAAiB;AAAA,IAC9BA;AAAA,EACF;AACA,SAAO,2BAA2B,UAAU,SAAyCA,aAAY,EAAE,YAC/F,WACA;AACN;AAEA,SAAS,sBACP,UACwB;AACxB,SAAO;AAAA,IACL,SAAS;AAAA,IACT,SAAS,kBAAkB,QAAQ;AAAA,IACnC;AAAA,MACE;AAAA,MACA;AAAA,MACA,EAAE,WAAW,KAAK;AAAA,IACpB;AAAA,EACF;AACF;AAEA,SAAS,6BACP,UACwB;AACxB,SAAO;AAAA,IACL,SAAS;AAAA,IACT,SAAS,kBAAkB,QAAQ;AAAA,IACnC,uBAAuB;AAAA,EACzB;AACF;AAEA,SAAS,eAAe,SAAsD;AAC5E,SAAO,YAAY,mBAAmB,YAAY;AACpD;AAEA,SAAS,gBAAgB,OAAoD;AAC3E,SAAO;AAAA;AAAA;AAAA,IAGL,QAAQ,MAAM,OAAO,IAAI,CAAC,WAAW,EAAE,MAAM,MAAM,KAAK,EAAE;AAAA,EAC5D;AACF;;;AKv/BO,SAAS,wCACd,kBACA,cACmC;AACnC,SAAO;AAAA,IACL;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,EACF;AACF;","names":["operationError","ms","resolveSpace","_a","ownership","resolve","randomUUID","resolveSpace","SECRET_NAME_RE","nodeSdk","z","resolveSpace","z","isRecord","EmptyInputSchema","z","z","runtimeContext","runtimeNode","isRecord","nodeFailure","isCanonicalBase64","SpaceSchema","AUTHENTICATED_POSTURES","join","nodeSdk","isRecord","z","isRecord","definition","profileNotFound","isRecord","nodeSdk","resolveSpace","principal","isRecord","isAbsolute","makePkhSpaceId","parsePkhDid","parseSpaceUri","output","principal","runtimeContext","exactCapabilities","resolveSpace","lookupOperation","isAbsolute","createInvocationRuntime","parseSpaceUri","parsePkhDid","makePkhSpaceId"]}
+{"version":3,"sources":["../src/errors.ts","../../../node_modules/ms/index.js","../../sdk-core/src/manifest.ts","../../sdk-core/src/capabilities.ts","../src/authority.ts","../src/state.ts","../src/artifacts.ts","../src/secrets.ts","../src/operations/auth.ts","../src/operations/exploration.ts","../src/operations/secrets-get.ts","../src/operations/sql.ts","../src/contract.ts","../src/delegation-binding.ts","../src/operations/status.ts","../src/registry.ts","../src/profile.ts","../src/runtime.ts","../src/invoke.ts","../../sdk-core/src/policy/errors.ts","../../sdk-core/src/policy/jcs.ts","../src/safe-values.ts","../src/redaction.ts","../src/cli-runtime.ts"],"sourcesContent":["export const OPERATION_ERROR_CODES = [\n  \"INPUT_INVALID\",\n  \"OPERATION_NOT_FOUND\",\n  \"OPERATION_VERSION_UNSUPPORTED\",\n  \"PROFILE_NOT_FOUND\",\n  \"PROFILE_POSTURE_NOT_ALLOWED\",\n  \"PROFILE_OWNER_OPT_IN_REQUIRED\",\n  \"AUTH_REQUIRED\",\n  \"PERMISSION_DENIED\",\n  \"SESSION_NOT_FOUND\",\n  \"PERMISSION_HINT_INVALID\",\n  \"DELEGATION_ARTIFACT_INVALID\",\n  \"DELEGATION_EXPIRED\",\n  \"DELEGATION_AUDIENCE_MISMATCH\",\n  \"DELEGATION_HOST_MISMATCH\",\n  \"DELEGATION_REJECTED\",\n  \"ENCRYPTION_NETWORK_UNRESOLVED\",\n  \"NODE_UNREACHABLE\",\n  \"NODE_ERROR\",\n  \"STORAGE_QUOTA_EXCEEDED\",\n  \"KV_NOT_FOUND\",\n  \"KV_PRECONDITION_FAILED\",\n  \"KV_CONFLICT\",\n  \"KV_RESPONSE_TOO_LARGE\",\n  \"SQL_QUERY_INVALID\",\n  \"SQL_EXECUTION_FAILED\",\n  \"SQL_RESULT_LIMIT_EXCEEDED\",\n  \"SQL_VALUE_UNSAFE\",\n  \"SECRET_READ_FAILED\",\n  \"SECRET_DECRYPT_FAILED\",\n  \"OUTPUT_INVALID\",\n  \"INTERNAL_ERROR\",\n] as const;\n\nexport type OperationErrorCode = (typeof OPERATION_ERROR_CODES)[number];\n\nexport interface OperationError {\n  readonly code: OperationErrorCode;\n  readonly message: string;\n  readonly retryable: boolean;\n  readonly details?: Readonly<Record<string, unknown>>;\n}\n\nexport function operationError(\n  code: OperationErrorCode,\n  message: string,\n  options: Readonly<{\n    retryable?: boolean;\n    details?: Readonly<Record<string, unknown>>;\n  }> = {},\n): OperationError {\n  return {\n    code,\n    message,\n    retryable: options.retryable ?? false,\n    ...(options.details === undefined ? {} : { details: options.details }),\n  };\n}\n\nconst MANAGE_STORAGE = \"Do not retry: the owner must free up space or upgrade at https://account.tinycloud.xyz/billing.\";\n\n/**\n * A write the node refused because the owner's TinyCloud storage is full\n * (SDK `STORAGE_QUOTA_EXCEEDED`, HTTP 402) or too small for this write\n * (`STORAGE_LIMIT_REACHED`, HTTP 413). Nothing was written, so the outcome is\n * known, and it stays refused until the owner acts, so it is never retryable.\n * The SDK's account totals travel as details; per-space numbers never do.\n */\nexport function storageFullOperationError(error: unknown): OperationError | undefined {\n  if (typeof error !== \"object\" || error === null) return undefined;\n  const { code, meta } = error as { code?: unknown; meta?: unknown };\n  if (code !== \"STORAGE_QUOTA_EXCEEDED\" && code !== \"STORAGE_LIMIT_REACHED\") return undefined;\n  const account = typeof meta === \"object\" && meta !== null ? (meta as { account?: unknown }).account : undefined;\n  return operationError(\n    \"STORAGE_QUOTA_EXCEEDED\",\n    code === \"STORAGE_LIMIT_REACHED\"\n      ? `This write is larger than the TinyCloud storage left, so nothing was written. Reading still works. ${MANAGE_STORAGE}`\n      : `TinyCloud storage is full, so nothing was written. Reading still works. ${MANAGE_STORAGE}`,\n    { retryable: false, ...(account === undefined ? {} : { details: { account } }) },\n  );\n}\n\n/**\n * Internal operations and profile resolution use this for expected failures.\n * Generic exceptions are never exposed at the projection boundary.\n */\nexport class OperationInvocationError extends Error {\n  public readonly operationError: OperationError;\n\n  constructor(operationError: OperationError) {\n    super(operationError.message);\n    this.name = \"OperationInvocationError\";\n    this.operationError = operationError;\n  }\n}\n\nexport function isOperationErrorCode(value: unknown): value is OperationErrorCode {\n  return typeof value === \"string\" && OPERATION_ERROR_CODES.includes(value as OperationErrorCode);\n}\n\nexport function internalOperationError(): OperationError {\n  return operationError(\n    \"INTERNAL_ERROR\",\n    \"The operation could not be completed.\",\n  );\n}\n\nexport function sanitizeThrownOperationError(error: unknown): OperationError {\n  if (error instanceof OperationInvocationError) {\n    return sanitizeOperationError(error.operationError);\n  }\n\n  return internalOperationError();\n}\n\nexport function sanitizeOperationError(error: unknown): OperationError {\n  if (\n    typeof error !== \"object\" ||\n    error === null ||\n    !isOperationErrorCode((error as { code?: unknown }).code) ||\n    typeof (error as { message?: unknown }).message !== \"string\" ||\n    typeof (error as { retryable?: unknown }).retryable !== \"boolean\"\n  ) {\n    return internalOperationError();\n  }\n\n  const candidate = error as OperationError;\n  return operationError(candidate.code, candidate.message, {\n    retryable: candidate.retryable,\n    ...(candidate.details === undefined ? {} : { details: candidate.details }),\n  });\n}\n","/**\n * Helpers.\n */\n\nvar s = 1000;\nvar m = s * 60;\nvar h = m * 60;\nvar d = h * 24;\nvar w = d * 7;\nvar y = d * 365.25;\n\n/**\n * Parse or format the given `val`.\n *\n * Options:\n *\n *  - `long` verbose formatting [false]\n *\n * @param {String|Number} val\n * @param {Object} [options]\n * @throws {Error} throw an error if val is not a non-empty string or a number\n * @return {String|Number}\n * @api public\n */\n\nmodule.exports = function (val, options) {\n  options = options || {};\n  var type = typeof val;\n  if (type === 'string' && val.length > 0) {\n    return parse(val);\n  } else if (type === 'number' && isFinite(val)) {\n    return options.long ? fmtLong(val) : fmtShort(val);\n  }\n  throw new Error(\n    'val is not a non-empty string or a valid number. val=' +\n      JSON.stringify(val)\n  );\n};\n\n/**\n * Parse the given `str` and return milliseconds.\n *\n * @param {String} str\n * @return {Number}\n * @api private\n */\n\nfunction parse(str) {\n  str = String(str);\n  if (str.length > 100) {\n    return;\n  }\n  var match = /^(-?(?:\\d+)?\\.?\\d+) *(milliseconds?|msecs?|ms|seconds?|secs?|s|minutes?|mins?|m|hours?|hrs?|h|days?|d|weeks?|w|years?|yrs?|y)?$/i.exec(\n    str\n  );\n  if (!match) {\n    return;\n  }\n  var n = parseFloat(match[1]);\n  var type = (match[2] || 'ms').toLowerCase();\n  switch (type) {\n    case 'years':\n    case 'year':\n    case 'yrs':\n    case 'yr':\n    case 'y':\n      return n * y;\n    case 'weeks':\n    case 'week':\n    case 'w':\n      return n * w;\n    case 'days':\n    case 'day':\n    case 'd':\n      return n * d;\n    case 'hours':\n    case 'hour':\n    case 'hrs':\n    case 'hr':\n    case 'h':\n      return n * h;\n    case 'minutes':\n    case 'minute':\n    case 'mins':\n    case 'min':\n    case 'm':\n      return n * m;\n    case 'seconds':\n    case 'second':\n    case 'secs':\n    case 'sec':\n    case 's':\n      return n * s;\n    case 'milliseconds':\n    case 'millisecond':\n    case 'msecs':\n    case 'msec':\n    case 'ms':\n      return n;\n    default:\n      return undefined;\n  }\n}\n\n/**\n * Short format for `ms`.\n *\n * @param {Number} ms\n * @return {String}\n * @api private\n */\n\nfunction fmtShort(ms) {\n  var msAbs = Math.abs(ms);\n  if (msAbs >= d) {\n    return Math.round(ms / d) + 'd';\n  }\n  if (msAbs >= h) {\n    return Math.round(ms / h) + 'h';\n  }\n  if (msAbs >= m) {\n    return Math.round(ms / m) + 'm';\n  }\n  if (msAbs >= s) {\n    return Math.round(ms / s) + 's';\n  }\n  return ms + 'ms';\n}\n\n/**\n * Long format for `ms`.\n *\n * @param {Number} ms\n * @return {String}\n * @api private\n */\n\nfunction fmtLong(ms) {\n  var msAbs = Math.abs(ms);\n  if (msAbs >= d) {\n    return plural(ms, msAbs, d, 'day');\n  }\n  if (msAbs >= h) {\n    return plural(ms, msAbs, h, 'hour');\n  }\n  if (msAbs >= m) {\n    return plural(ms, msAbs, m, 'minute');\n  }\n  if (msAbs >= s) {\n    return plural(ms, msAbs, s, 'second');\n  }\n  return ms + ' ms';\n}\n\n/**\n * Pluralization helper.\n */\n\nfunction plural(ms, msAbs, n, name) {\n  var isPlural = msAbs >= n * 1.5;\n  return Math.round(ms / n) + ' ' + name + (isPlural ? 's' : '');\n}\n","/**\n * TinyCloud App Manifest\n *\n * A declarative description of an app's identity and the capabilities it\n * needs. The manifest drives the SIWE recap at sign-in time, enabling a\n * single wallet prompt that covers the app's own permissions plus any\n * pre-declared delegations.\n *\n * The SDK does NOT fetch external manifests. Apps compose their own manifest\n * (optionally including backend or agent addenda) before handing it to the\n * SDK.\n *\n * Canonical spec: `.claude/specs/manifest.md`.\n *\n * @packageDocumentation\n */\n\nimport ms from \"ms\";\nimport { ACCOUNT_MANIFEST_PERMISSIONS } from \"@tinycloud/bootstrap\";\nimport { resolveSecretPath, SECRET_NAME_RE } from \"@tinycloud/sdk-services\";\n\n// ---------------------------------------------------------------------------\n// Public types\n// ---------------------------------------------------------------------------\n\n/**\n * A single permission entry inside a manifest. This is the shape apps write\n * in their `manifest.json` and the shape we compare against when performing\n * the capability-subset derivability check in the delegation flow.\n *\n * `service` uses the long form (e.g. `\"tinycloud.kv\"`, `\"tinycloud.sql\"`).\n * `\"tinycloud.vault\"` is an SDK-only shorthand that expands to the KV\n * resources the vault service uses; it is never encoded as a recap service.\n */\nexport interface PermissionEntry {\n  /** Service namespace, e.g. \"tinycloud.kv\", \"tinycloud.sql\", \"tinycloud.duckdb\", \"tinycloud.capabilities\". */\n  service: string;\n  /** Space name or full space URI. Defaults to \"applications\" inside manifests. */\n  space?: string;\n  /**\n   * Service-specific path.\n   * - tinycloud.kv: hierarchical prefix. \"/\" = all, \"foo/\" = prefix match, \"foo\" = exact key\n   * - tinycloud.sql: database name/file (e.g. \"data.sqlite\") or \"/\" for all\n   * - tinycloud.duckdb: database name/file\n   * - tinycloud.capabilities: capability key URI or \"/\" for all\n   */\n  path: string;\n  /**\n   * Short action names (e.g. \"get\", \"put\", \"read\", \"schema\"). The SDK expands\n   * these to full URNs (e.g. `tinycloud.kv/get`) during resolution.\n   * Already-expanded URNs are passed through unchanged.\n   */\n  actions: string[];\n  /** Exact ReCap caveat branches when this authority came from a signed ReCap. */\n  caveats?: Record<string, unknown>[];\n  /** When true, the manifest prefix is NOT prepended to `path`. Default false. */\n  skipPrefix?: boolean;\n  /** Per-entry expiry override, ms-format. */\n  expiry?: string;\n  /** User/agent-facing context for why this permission is requested. */\n  description?: string;\n}\n\nexport type ManifestSecretActions =\n  | true\n  | string\n  | string[]\n  | {\n      /** Actual vault secret name. Defaults to the manifest object key. */\n      name?: string;\n      /** Optional scoped secret namespace. Omit for global secrets. */\n      scope?: string;\n      actions?: string | string[];\n      expiry?: string;\n      description?: string;\n    };\n\n/**\n * The valid values for `Manifest.defaults`.\n *\n * - `false` → no auto-included permissions\n * - `true` → standard tier (KV + SQL read/write + capabilities:read)\n * - `\"admin\"` → standard + SQL schema\n * - `\"all\"` → everything the SDK supports (including DuckDB)\n *\n * Unknown string values silently fall back to `true`. Values are normalized\n * (lowercase + trim) before matching.\n */\nexport type ManifestDefaults = boolean | \"admin\" | \"all\";\n\n/**\n * Agent-readable app knowledge bundle pointer.\n *\n * - `true` means the default root: `knowledge/index.md`\n * - string values must point at a markdown root under `knowledge/`\n */\nexport type ManifestKnowledge = true | string;\n\n/** Default root used when `manifest.knowledge === true`. */\nexport const DEFAULT_KNOWLEDGE_ROOT = \"knowledge/index.md\";\n\n/**\n * The raw manifest shape an app declares. See `.claude/specs/manifest.md`.\n */\nexport interface Manifest {\n  /** Schema version. Optional, defaults to 1. */\n  manifest_version?: 1;\n  /** Application identifier / namespace prefix. Required. */\n  app_id: string;\n  /** Display name. Required. */\n  name: string;\n  /** Description of what the app or delegate does. Optional. */\n  description?: string;\n  /** DID of this manifest's delegate target. Optional. Required only for delegation materialization. */\n  did?: string;\n  /** URL to app icon. Optional. */\n  icon?: string;\n  /** App version string. Optional. */\n  appVersion?: string;\n  /** Default expiry for permissions. ms-format (\"30d\", \"2h\", \"1y\"). Default \"30d\". */\n  expiry?: string;\n  /** Space name or full space URI. Optional, defaults to \"applications\". */\n  space?: string;\n  /**\n   * Path prefix auto-prepended to permission paths. Optional, defaults to\n   * `app_id`. Set to `\"\"` to disable entirely. Individual permissions can opt\n   * out with `skipPrefix: true`.\n   */\n  prefix?: string;\n  /**\n   * Default permission set to auto-include. Optional, defaults to `true`.\n   * See {@link ManifestDefaults}.\n   */\n  defaults?: ManifestDefaults | string;\n  /** Whether to include the public-space companion delegation. Default `true`. */\n  includePublicSpace?: boolean;\n  /** Agent-readable knowledge bundle root. `true` means `knowledge/index.md`. */\n  knowledge?: ManifestKnowledge;\n  /**\n   * Additional permissions beyond the defaults. Use for cross-space access,\n   * DuckDB (opt-in), or `skipPrefix: true` entries.\n   */\n  permissions?: PermissionEntry[];\n  /**\n   * Secret name shorthand. Entries resolve to encrypted vault KV resources in\n   * the `secrets` space.\n   */\n  secrets?: Record<string, ManifestSecretActions>;\n}\n\n/**\n * A resolved permission entry with fully-expanded paths and action URNs.\n * This is the shape the delegation flow compares against parsed recap\n * capabilities, and the shape the session-key delegation path actually uses.\n */\nexport interface ResourceCapability {\n  /** Long-form service, e.g. \"tinycloud.kv\". */\n  service: string;\n  /** Space name or URI. Short names are resolved to full SpaceIds at sign-in time. */\n  space: string;\n  /** Path with the manifest prefix applied (or skipped per `skipPrefix`). */\n  path: string;\n  /** Full-URN actions, e.g. [\"tinycloud.kv/get\", \"tinycloud.kv/put\"]. */\n  actions: string[];\n  /** Per-entry expiry override in milliseconds. */\n  expiryMs?: number;\n  /** User/agent-facing context copied from the source permission entry. */\n  description?: string;\n}\n\n/**\n * A resolved delegation entry with fully-expanded permissions.\n */\nexport interface ResolvedDelegate {\n  /** DID of the delegate. */\n  did: string;\n  /** Informational display name. Optional. */\n  name?: string;\n  /** Expiry in milliseconds (per-delegation > manifest default > 30 days). */\n  expiryMs: number;\n  /** Fully resolved permissions. */\n  permissions: ResourceCapability[];\n}\n\n/**\n * The output of {@link resolveManifest}: a fully-expanded capability set\n * ready to drive the SIWE recap.\n */\nexport interface ResolvedCapabilities {\n  /** Application identifier copied from manifest.app_id. */\n  app_id: string;\n  /** Delegate DID copied from manifest.did, when present. */\n  did?: string;\n  /** Effective default space for this manifest. */\n  space: string;\n  /** All session-key resources with paths fully resolved (prefix applied). */\n  resources: ResourceCapability[];\n  /** Default expiry for the session, in milliseconds. */\n  expiryMs: number;\n  /** Whether to include the public-space companion. */\n  includePublicSpace: boolean;\n  /** Delegate targets derived from manifests that declare `did`. */\n  additionalDelegates: ResolvedDelegate[];\n}\n\nexport interface ManifestRegistryRecord {\n  /** KV key inside the account space. */\n  key: string;\n  /** App id this record describes. */\n  app_id: string;\n  /** Latest manifest payloads composed for this app id. */\n  manifests: Manifest[];\n}\n\nexport interface ComposeManifestOptions {\n  /** Include implicit account-space registry permissions. Default true. */\n  includeAccountRegistryPermissions?: boolean;\n}\n\nexport interface ComposedManifestRequest {\n  /** Validated manifests that were composed. */\n  manifests: Manifest[];\n  /** Full permission union requested from the user in one SIWE. */\n  resources: ResourceCapability[];\n  /** Delegations that can be materialized after sign-in. */\n  delegationTargets: ResolvedDelegate[];\n  /** Account-space registry records to write after successful sign-in. */\n  registryRecords: ManifestRegistryRecord[];\n  /** Effective session expiry, using the longest composed manifest expiry. */\n  expiryMs: number;\n  /** Whether to include the public-space companion behavior. */\n  includePublicSpace: boolean;\n}\n\n/**\n * Thrown when the manifest fails validation (missing id/name, bad expiry,\n * empty actions on a permission, etc).\n */\nexport class ManifestValidationError extends Error {\n  constructor(message: string) {\n    super(`Manifest validation failed: ${message}`);\n    this.name = \"ManifestValidationError\";\n  }\n}\n\n// ---------------------------------------------------------------------------\n// Constants\n// ---------------------------------------------------------------------------\n\n/**\n * Default expiry when neither the manifest, delegation, nor permission\n * specifies one. APP tier — see `expiry.ts`. Spec: 30 days.\n *\n * Kept as an ms-format string because the manifest schema stores expiry\n * as a string and the parser is shared between this default and\n * caller-provided values; converting `EXPIRY.APP_MS` back to a string\n * here would duplicate that same `30d` literal in another form.\n */\nexport const DEFAULT_EXPIRY = \"30d\";\n\n/**\n * Default `defaults` value when the manifest omits it. Spec: standard tier.\n */\nexport const DEFAULT_DEFAULTS: ManifestDefaults = true;\n\n/** Default manifest schema version. */\nexport const DEFAULT_MANIFEST_VERSION = 1;\n\n/** Default space for manifest-declared app data. */\nexport const DEFAULT_MANIFEST_SPACE = \"applications\";\n\n/** Account-space name used for installed-application registry records. */\nexport const ACCOUNT_REGISTRY_SPACE = \"account\";\n\n/** Account-space KV prefix used for installed-application registry records. */\nexport const ACCOUNT_REGISTRY_PATH = \"applications/\";\n\nexport const SECRETS_SPACE = \"secrets\";\n\n/** SDK-only permission service for encrypted vault resources. */\nexport const VAULT_PERMISSION_SERVICE = \"tinycloud.vault\";\n\ntype VaultKVBase = \"vault\";\n\ninterface VaultActionExpansion {\n  bases: readonly VaultKVBase[];\n  action: string;\n}\n\n/**\n * Known services and their short-form (recap URI) names. The TinyCloud\n * node encodes the recap resource URI with the short service name, while\n * action URNs and manifest entries use the long `tinycloud.<short>` form.\n * This table is the canonical bridge between the two.\n */\nexport const SERVICE_SHORT_TO_LONG: Readonly<Record<string, string>> =\n  Object.freeze({\n    kv: \"tinycloud.kv\",\n    sql: \"tinycloud.sql\",\n    duckdb: \"tinycloud.duckdb\",\n    capabilities: \"tinycloud.capabilities\",\n    hooks: \"tinycloud.hooks\",\n    encryption: \"tinycloud.encryption\",\n    delegation: \"tinycloud.delegation\",\n  });\n\n/**\n * Manifest service identifier for TinyCloud encryption network grants.\n *\n * Encryption permissions live on a network id URN\n * (`urn:tinycloud:encryption:<ownerDid>:<network>`), not on a space.\n * The `path` field is the literal networkId; `actions` are\n * `[\"decrypt\"]` (expanded to `[\"tinycloud.encryption/decrypt\"]`).\n *\n * Apps should omit `space` for encryption permissions. The SDK may emit\n * an internal `\"encryption\"` compatibility label after expansion so the\n * older `PermissionEntry`/`ResourceCapability` shape can still carry the\n * raw network URN through subset checks.\n */\nexport const ENCRYPTION_PERMISSION_SERVICE = \"tinycloud.encryption\";\n\n/** Synthetic space label used by encryption manifest entries. */\nexport const ENCRYPTION_MANIFEST_SPACE = \"encryption\";\n\n/**\n * Inverse of {@link SERVICE_SHORT_TO_LONG}.\n */\nexport const SERVICE_LONG_TO_SHORT: Readonly<Record<string, string>> =\n  Object.freeze(\n    Object.fromEntries(\n      Object.entries(SERVICE_SHORT_TO_LONG).map(([s, l]) => [l, s]),\n    ),\n  );\n\n/**\n * Default permission entries for the `true` / standard tier.\n *\n * `tinycloud.capabilities/read` is added separately for every requested\n * space, without the app path prefix. That keeps capability introspection\n * space-scoped instead of app-data scoped.\n */\nconst DEFAULT_STANDARD_ENTRIES: readonly PermissionEntry[] = [\n  {\n    service: \"tinycloud.kv\",\n    space: DEFAULT_MANIFEST_SPACE,\n    path: \"/\",\n    actions: [\"get\", \"put\", \"del\", \"list\", \"metadata\"],\n  },\n  {\n    service: \"tinycloud.sql\",\n    space: DEFAULT_MANIFEST_SPACE,\n    path: \"/\",\n    actions: [\"read\", \"write\"],\n  },\n];\n\n/**\n * Default permission entries for the `\"admin\"` tier: standard + sql/schema.\n */\nconst DEFAULT_ADMIN_ENTRIES: readonly PermissionEntry[] = [\n  {\n    service: \"tinycloud.kv\",\n    space: DEFAULT_MANIFEST_SPACE,\n    path: \"/\",\n    actions: [\"get\", \"put\", \"del\", \"list\", \"metadata\"],\n  },\n  {\n    service: \"tinycloud.sql\",\n    space: DEFAULT_MANIFEST_SPACE,\n    path: \"/\",\n    actions: [\"read\", \"write\", \"schema\"],\n  },\n];\n\n/**\n * Default permission entries for the `\"all\"` tier: admin + DuckDB.\n *\n * DuckDB is opt-in and only appears in this tier or in explicit manifest\n * `permissions` entries.\n */\nconst DEFAULT_ALL_ENTRIES: readonly PermissionEntry[] = [\n  {\n    service: \"tinycloud.kv\",\n    space: DEFAULT_MANIFEST_SPACE,\n    path: \"/\",\n    actions: [\"get\", \"put\", \"del\", \"list\", \"metadata\"],\n  },\n  {\n    service: \"tinycloud.sql\",\n    space: DEFAULT_MANIFEST_SPACE,\n    path: \"/\",\n    actions: [\"read\", \"write\", \"schema\"],\n  },\n  {\n    service: \"tinycloud.duckdb\",\n    space: DEFAULT_MANIFEST_SPACE,\n    path: \"/\",\n    actions: [\"read\", \"write\"],\n  },\n];\n\n// ---------------------------------------------------------------------------\n// Public API\n// ---------------------------------------------------------------------------\n\n/**\n * Parse an ms-format duration string (e.g. \"30d\", \"2h\", \"1y\") into\n * milliseconds.\n *\n * @throws {ManifestValidationError} on empty string, non-string input, or\n * any input `ms()` cannot parse.\n */\nexport function parseExpiry(duration: string): number {\n  if (typeof duration !== \"string\" || duration.length === 0) {\n    throw new ManifestValidationError(\n      `expiry must be a non-empty duration string (got ${JSON.stringify(duration)})`,\n    );\n  }\n  // `ms` returns `undefined` for unparseable input and can return a number\n  // or a string depending on the call signature; cast explicitly.\n  const parsed = (ms as unknown as (v: string) => number | undefined)(duration);\n  if (typeof parsed !== \"number\" || !Number.isFinite(parsed) || parsed <= 0) {\n    throw new ManifestValidationError(\n      `invalid expiry duration: ${JSON.stringify(duration)}`,\n    );\n  }\n  return parsed;\n}\n\n/**\n * Expand a list of action short names (or already-expanded URNs) into full\n * ability URNs of the form `<service>/<action>`.\n *\n * Examples:\n *   `expandActionShortNames(\"tinycloud.kv\", [\"get\", \"put\"])`\n *     → `[\"tinycloud.kv/get\", \"tinycloud.kv/put\"]`\n *   `expandActionShortNames(\"tinycloud.kv\", [\"tinycloud.kv/get\"])`\n *     → `[\"tinycloud.kv/get\"]` (passed through unchanged)\n */\nexport function expandActionShortNames(\n  service: string,\n  actions: readonly string[],\n): string[] {\n  return actions.map((a) => {\n    if (a.includes(\"/\")) {\n      // Already a full URN — pass through.\n      return a;\n    }\n    return `${service}/${a}`;\n  });\n}\n\n/**\n * Expand SDK virtual permission services into concrete recap-capable services.\n *\n * Today this handles `\"tinycloud.vault\"`, which is backed by inline\n * network-encrypted KV records:\n * - read/get: `vault/<path>` with `tinycloud.kv/get`\n * - write/put: `vault/<path>` with `tinycloud.kv/put`\n * - delete/del: `vault/<path>` with `tinycloud.kv/del`\n * - list: `vault/<path>` with `tinycloud.kv/list`\n * - head: `vault/<path>` with `tinycloud.kv/get`\n * - metadata: `vault/<path>` with `tinycloud.kv/metadata`\n */\nexport function expandPermissionEntry(entry: PermissionEntry): PermissionEntry[] {\n  if (entry.service === ENCRYPTION_PERMISSION_SERVICE) {\n    return expandEncryptionPermissionEntry(entry);\n  }\n  if (entry.service !== VAULT_PERMISSION_SERVICE) {\n    return [\n      {\n        ...entry,\n        actions: expandActionShortNames(entry.service, entry.actions),\n      },\n    ];\n  }\n\n  return expandVaultPermissionEntry(entry);\n}\n\n/**\n * Expand a `tinycloud.encryption` manifest entry.\n *\n * - `path` MUST be a networkId URN (`urn:tinycloud:encryption:...`).\n *   The manifest prefix is always skipped — network ids are top-level\n *   owner-scoped resources, not space-scoped paths.\n * - `actions` must be `decrypt`, `network.create`, or `network.revoke`\n *   (or their already-expanded `tinycloud.encryption/*` forms).\n *\n * The returned entry uses an internal `space = \"encryption\"` compatibility\n * label so old manifest grouping code does not collapse it into the app's\n * data space, and `skipPrefix` is forced to `true` so the prefix application\n * step is a no-op.\n */\nfunction expandEncryptionPermissionEntry(\n  entry: PermissionEntry,\n): PermissionEntry[] {\n  if (\n    typeof entry.path !== \"string\" ||\n    !entry.path.startsWith(\"urn:tinycloud:encryption:\")\n  ) {\n    throw new ManifestValidationError(\n      `tinycloud.encryption entries require path to be a networkId URN ` +\n        `(got ${JSON.stringify(entry.path)})`,\n    );\n  }\n  const normalizedActions: string[] = [];\n  for (const action of entry.actions) {\n    if (action === \"decrypt\" || action === \"tinycloud.encryption/decrypt\") {\n      normalizedActions.push(\"tinycloud.encryption/decrypt\");\n      continue;\n    }\n    if (\n      action === \"network.create\" ||\n      action === \"tinycloud.encryption/network.create\"\n    ) {\n      normalizedActions.push(\"tinycloud.encryption/network.create\");\n      continue;\n    }\n    if (\n      action === \"network.revoke\" ||\n      action === \"tinycloud.encryption/network.revoke\"\n    ) {\n      normalizedActions.push(\"tinycloud.encryption/network.revoke\");\n      continue;\n    }\n    if (action.includes(\"/\")) {\n      throw new ManifestValidationError(\n        `unknown encryption action ${JSON.stringify(action)}; expected decrypt, network.create, or network.revoke`,\n      );\n    }\n    throw new ManifestValidationError(\n      `unknown encryption action ${JSON.stringify(action)}; expected decrypt, network.create, or network.revoke`,\n    );\n  }\n  // Dedupe while preserving order\n  const dedupedActions: string[] = [];\n  const seen = new Set<string>();\n  for (const a of normalizedActions) {\n    if (!seen.has(a)) {\n      dedupedActions.push(a);\n      seen.add(a);\n    }\n  }\n  // Encryption resources are network-scoped, not space-scoped. We\n  // always emit the synthetic \"encryption\" space label so manifest\n  // grouping can deal with it uniformly without collapsing the\n  // networkId URN into an app data space.\n  return [\n    {\n      service: ENCRYPTION_PERMISSION_SERVICE,\n      space: ENCRYPTION_MANIFEST_SPACE,\n      path: entry.path,\n      actions: dedupedActions,\n      skipPrefix: true,\n      ...(entry.expiry !== undefined ? { expiry: entry.expiry } : {}),\n      ...(entry.description !== undefined\n        ? { description: entry.description }\n        : {}),\n    },\n  ];\n}\n\n/**\n * Expand a list of permission entries using {@link expandPermissionEntry}.\n */\nexport function expandPermissionEntries(\n  entries: readonly PermissionEntry[],\n): PermissionEntry[] {\n  return entries.flatMap(expandPermissionEntry);\n}\n\n/**\n * Apply the manifest prefix to a permission path per the spec rules.\n *\n * - `skipPrefix: true` → path is returned as-is\n * - `prefix === \"\"` → path is returned as-is\n * - path starts with \"/\" → `prefix + path`  (e.g. \"com.listen.app\" + \"/\" → \"com.listen.app/\")\n * - otherwise → `prefix + \"/\" + path`  (e.g. \"com.listen.app\" + \"data.sqlite\" → \"com.listen.app/data.sqlite\")\n */\nexport function applyPrefix(\n  prefix: string,\n  path: string,\n  skipPrefix: boolean,\n): string {\n  if (skipPrefix) {\n    return path;\n  }\n  if (prefix === \"\") {\n    return path;\n  }\n  if (path.startsWith(\"/\")) {\n    return `${prefix}${path}`;\n  }\n  return `${prefix}/${path}`;\n}\n\n/**\n * Fetch and parse a manifest from a URL (browser) or file path (node).\n * The runtime decides the fetch strategy via `globalThis.fetch`; this is\n * platform-agnostic. Callers that want custom loading should JSON.parse a\n * Manifest themselves and skip this helper.\n *\n * @throws if the fetch fails, the JSON is invalid, or the manifest fails\n * validation.\n */\nexport async function loadManifest(url: string): Promise<Manifest> {\n  const fetchFn: typeof fetch | undefined = (\n    globalThis as { fetch?: typeof fetch }\n  ).fetch;\n  if (typeof fetchFn !== \"function\") {\n    throw new ManifestValidationError(\n      \"loadManifest requires a global fetch; pass the manifest object directly on runtimes without fetch\",\n    );\n  }\n  const res = await fetchFn(url);\n  if (!res.ok) {\n    throw new ManifestValidationError(\n      `failed to fetch manifest from ${url}: HTTP ${res.status}`,\n    );\n  }\n  const json = (await res.json()) as unknown;\n  return validateManifest(json);\n}\n\n/**\n * Validate a manifest-shaped object and return it strongly-typed.\n * Throws {@link ManifestValidationError} on any hard failure.\n */\nexport function validateManifest(input: unknown): Manifest {\n  if (input === null || typeof input !== \"object\") {\n    throw new ManifestValidationError(\"manifest must be an object\");\n  }\n  const m = input as Manifest;\n  if (\n    m.manifest_version !== undefined &&\n    m.manifest_version !== DEFAULT_MANIFEST_VERSION\n  ) {\n    throw new ManifestValidationError(\n      `manifest.manifest_version must be ${DEFAULT_MANIFEST_VERSION}`,\n    );\n  }\n  if (typeof m.app_id !== \"string\" || m.app_id.length === 0) {\n    throw new ManifestValidationError(\n      \"manifest.app_id is required and must be a non-empty string\",\n    );\n  }\n  if (typeof m.name !== \"string\" || m.name.length === 0) {\n    throw new ManifestValidationError(\n      \"manifest.name is required and must be a non-empty string\",\n    );\n  }\n  if (\n    m.did !== undefined &&\n    (typeof m.did !== \"string\" || m.did.length === 0)\n  ) {\n    throw new ManifestValidationError(\n      \"manifest.did must be a non-empty DID string\",\n    );\n  }\n  if (\n    m.space !== undefined &&\n    (typeof m.space !== \"string\" || m.space.length === 0)\n  ) {\n    throw new ManifestValidationError(\n      \"manifest.space must be a non-empty string\",\n    );\n  }\n  if (m.expiry !== undefined) {\n    // Will throw with a clear error if invalid.\n    parseExpiry(m.expiry);\n  }\n  if (m.knowledge !== undefined) {\n    resolveManifestKnowledgeRoot(m.knowledge);\n  }\n  if (m.permissions !== undefined) {\n    if (!Array.isArray(m.permissions)) {\n      throw new ManifestValidationError(\n        \"manifest.permissions must be an array\",\n      );\n    }\n    m.permissions.forEach((p, i) =>\n      validatePermissionEntry(p, `permissions[${i}]`),\n    );\n  }\n  if (m.secrets !== undefined) {\n    validateManifestSecrets(m.secrets);\n  }\n  return m;\n}\n\n/**\n * Resolve a manifest knowledge pointer to its root markdown file.\n *\n * This is metadata only; app knowledge does not create capabilities.\n */\nexport function resolveManifestKnowledgeRoot(\n  knowledge: Manifest[\"knowledge\"] | undefined,\n): string | undefined {\n  if (knowledge === undefined) {\n    return undefined;\n  }\n  if (knowledge === true) {\n    return DEFAULT_KNOWLEDGE_ROOT;\n  }\n  if (typeof knowledge !== \"string\" || knowledge.length === 0) {\n    throw new ManifestValidationError(\n      \"manifest.knowledge must be true or a knowledge/*.md root path\",\n    );\n  }\n  if (!/^knowledge\\/.+\\.md$/.test(knowledge)) {\n    throw new ManifestValidationError(\n      \"manifest.knowledge must be true or a knowledge/*.md root path\",\n    );\n  }\n  return knowledge;\n}\n\nfunction validateManifestSecrets(secrets: unknown): void {\n  if (secrets === null || typeof secrets !== \"object\" || Array.isArray(secrets)) {\n    throw new ManifestValidationError(\"manifest.secrets must be an object\");\n  }\n\n  for (const [name, spec] of Object.entries(secrets)) {\n    if (!SECRET_NAME_RE.test(name)) {\n      throw new ManifestValidationError(\n        `manifest.secrets.${name} must match ${SECRET_NAME_RE.source}`,\n      );\n    }\n    try {\n      resolveSecretPath(\n        secretNameFromSpec(name, spec as ManifestSecretActions),\n        { scope: secretScopeFromSpec(spec as ManifestSecretActions) },\n      );\n    } catch (error) {\n      throw new ManifestValidationError(\n        `manifest.secrets.${name}: ${error instanceof Error ? error.message : String(error)}`,\n      );\n    }\n    const actions = secretActionsFromSpec(name, spec as ManifestSecretActions);\n    if (actions.length === 0) {\n      throw new ManifestValidationError(\n        `manifest.secrets.${name} actions must be non-empty`,\n      );\n    }\n    for (const action of actions) {\n      if (typeof action !== \"string\" || action.length === 0) {\n        throw new ManifestValidationError(\n          `manifest.secrets.${name} actions must be non-empty strings`,\n        );\n      }\n    }\n    if (\n      spec !== null &&\n      typeof spec === \"object\" &&\n      !Array.isArray(spec) &&\n      (spec as { expiry?: unknown }).expiry !== undefined\n    ) {\n      parseExpiry((spec as { expiry: string }).expiry);\n    }\n  }\n}\n\nfunction validatePermissionEntry(p: unknown, path: string): void {\n  if (p === null || typeof p !== \"object\") {\n    throw new ManifestValidationError(`${path} must be an object`);\n  }\n  const entry = p as PermissionEntry;\n  if (typeof entry.service !== \"string\" || entry.service.length === 0) {\n    throw new ManifestValidationError(`${path}.service is required`);\n  }\n  if (\n    entry.space !== undefined &&\n    (typeof entry.space !== \"string\" || entry.space.length === 0)\n  ) {\n    throw new ManifestValidationError(\n      `${path}.space must be a non-empty string`,\n    );\n  }\n  if (typeof entry.path !== \"string\") {\n    throw new ManifestValidationError(\n      `${path}.path is required (use \"\" or \"/\" for root)`,\n    );\n  }\n  if (!Array.isArray(entry.actions) || entry.actions.length === 0) {\n    throw new ManifestValidationError(\n      `${path}.actions must be a non-empty array`,\n    );\n  }\n  for (const action of entry.actions) {\n    if (typeof action !== \"string\" || action.length === 0) {\n      throw new ManifestValidationError(\n        `${path}.actions must contain non-empty strings`,\n      );\n    }\n    if (entry.service === VAULT_PERMISSION_SERVICE) {\n      vaultActionExpansion(action);\n    }\n  }\n  if (entry.caveats !== undefined &&\n    (!Array.isArray(entry.caveats) || entry.caveats.some((caveat) =>\n      caveat === null || typeof caveat !== \"object\" || Array.isArray(caveat)\n    ))\n  ) {\n    throw new ManifestValidationError(`${path}.caveats must be an array of objects`);\n  }\n  if (entry.expiry !== undefined) {\n    parseExpiry(entry.expiry);\n  }\n}\n\n/**\n * Normalize a `defaults` value: lowercase + trim, then match against known\n * tiers. Unknown string values silently fall back to `true` (standard).\n * Boolean values pass through.\n */\nexport function normalizeDefaults(\n  value: Manifest[\"defaults\"] | undefined,\n): ManifestDefaults {\n  if (value === undefined) {\n    return DEFAULT_DEFAULTS;\n  }\n  if (typeof value === \"boolean\") {\n    return value;\n  }\n  if (typeof value !== \"string\") {\n    // Spec says unknown values silently fall back to `true`.\n    return true;\n  }\n  const normalized = value.trim().toLowerCase();\n  if (normalized === \"admin\" || normalized === \"all\") {\n    return normalized;\n  }\n  // Anything else, including \"true\"/\"false\"/\"standard\"/garbage, falls back\n  // to the standard tier per spec.\n  return true;\n}\n\n/**\n * Return the default permission entries for the given tier. Entries are\n * deep-cloned so callers can mutate them without affecting the constants.\n */\nfunction defaultEntriesForTier(tier: ManifestDefaults): PermissionEntry[] {\n  if (tier === false) {\n    return [];\n  }\n  const source =\n    tier === \"admin\"\n      ? DEFAULT_ADMIN_ENTRIES\n      : tier === \"all\"\n        ? DEFAULT_ALL_ENTRIES\n        : DEFAULT_STANDARD_ENTRIES;\n  return source.map((e) => ({\n    service: e.service,\n    space: e.space,\n    path: e.path,\n    actions: [...e.actions],\n    ...(e.skipPrefix !== undefined ? { skipPrefix: e.skipPrefix } : {}),\n  }));\n}\n\n/**\n * Resolve a raw manifest into a {@link ResolvedCapabilities} object: expand\n * shortform actions, apply the prefix, merge defaults, and compute effective\n * expiries. Pure function — does no I/O.\n *\n * Resolution semantics (spec):\n * - `prefix` defaults to `app_id`; set to `\"\"` to disable prefix application entirely.\n * - `space` defaults to `applications`; per-permission `space` overrides it.\n * - `defaults` defaults to `true` (standard tier); unknown string values fall back to `true`.\n * - Per-entry expiry overrides per-delegation overrides manifest > `DEFAULT_EXPIRY`.\n * - Default entries use `skipPrefix: false` so they inherit the manifest prefix.\n */\nexport function resolveManifest(input: Manifest): ResolvedCapabilities {\n  const manifest = validateManifest(input);\n\n  const prefix =\n    manifest.prefix !== undefined ? manifest.prefix : manifest.app_id;\n  const space = manifest.space ?? DEFAULT_MANIFEST_SPACE;\n  const expiryMs = parseExpiry(manifest.expiry ?? DEFAULT_EXPIRY);\n  const includePublicSpace = manifest.includePublicSpace ?? true;\n  const tier = normalizeDefaults(manifest.defaults);\n\n  const defaultEntries = defaultEntriesForTier(tier);\n  const explicitEntries = manifest.permissions ?? [];\n  const secretEntries = secretEntriesForManifest(manifest.secrets);\n\n  // Merge order: defaults first, then explicit entries, so explicit entries\n  // for the same (service, space, path) tuple override defaults.\n  const allEntries: PermissionEntry[] = [\n    ...defaultEntries,\n    ...explicitEntries,\n    ...secretEntries,\n  ];\n\n  const resources: ResourceCapability[] = withCapabilitiesReadForSpaces(\n    allEntries.flatMap((entry) => resolveEntry(entry, prefix, expiryMs, space)),\n  );\n\n  const additionalDelegates: ResolvedDelegate[] =\n    manifest.did === undefined\n      ? []\n      : [\n          {\n            did: manifest.did,\n            name: manifest.name,\n            expiryMs,\n            permissions: resources.map(cloneResourceCapability),\n          },\n        ];\n\n  return {\n    app_id: manifest.app_id,\n    ...(manifest.did !== undefined ? { did: manifest.did } : {}),\n    space,\n    resources,\n    expiryMs,\n    includePublicSpace,\n    additionalDelegates,\n  };\n}\n\nfunction normalizeSecretActions(actions: readonly string[]): string[] {\n  const out: string[] = [];\n  const seen = new Set<string>();\n  const add = (action: string) => {\n    if (!seen.has(action)) {\n      out.push(action);\n      seen.add(action);\n    }\n  };\n\n  for (const action of actions) {\n    if (action === \"read\") {\n      add(\"get\");\n      continue;\n    }\n    if (action === \"write\") {\n      add(\"put\");\n      continue;\n    }\n    if (action === \"delete\") {\n      add(\"del\");\n      continue;\n    }\n    if (\n      action === \"get\" ||\n      action === \"put\" ||\n      action === \"del\" ||\n      action === \"list\" ||\n      action === \"metadata\"\n    ) {\n      add(action);\n      continue;\n    }\n    if (\n      action === \"tinycloud.kv/get\" ||\n      action === \"tinycloud.kv/put\" ||\n      action === \"tinycloud.kv/del\" ||\n      action === \"tinycloud.kv/list\" ||\n      action === \"tinycloud.kv/metadata\"\n    ) {\n      add(action);\n      continue;\n    }\n    throw new ManifestValidationError(\n      `unknown secret action ${JSON.stringify(action)}; expected read, write, delete, list, or metadata`,\n    );\n  }\n\n  return out;\n}\n\nfunction secretNameFromSpec(\n  fallbackName: string,\n  spec: ManifestSecretActions,\n): string {\n  if (spec !== null && typeof spec === \"object\" && !Array.isArray(spec)) {\n    return spec.name ?? fallbackName;\n  }\n  return fallbackName;\n}\n\nfunction secretScopeFromSpec(\n  spec: ManifestSecretActions,\n): string | undefined {\n  if (spec !== null && typeof spec === \"object\" && !Array.isArray(spec)) {\n    return spec.scope;\n  }\n  return undefined;\n}\n\nfunction secretActionsFromSpec(\n  name: string,\n  spec: ManifestSecretActions,\n): string[] {\n  if (spec === true) {\n    return [\"read\"];\n  }\n  if (typeof spec === \"string\") {\n    return [spec];\n  }\n  if (Array.isArray(spec)) {\n    return spec;\n  }\n  if (spec === null || typeof spec !== \"object\") {\n    throw new ManifestValidationError(\n      `manifest.secrets.${name} must be true, a string action, an actions array, or an object`,\n    );\n  }\n  if (spec.actions === undefined) {\n    return [\"read\"];\n  }\n  if (typeof spec.actions === \"string\") {\n    return [spec.actions];\n  }\n  if (Array.isArray(spec.actions)) {\n    return spec.actions;\n  }\n  throw new ManifestValidationError(\n    `manifest.secrets.${name}.actions must be a string or array`,\n  );\n}\n\nfunction secretEntriesForManifest(\n  secrets: Manifest[\"secrets\"] | undefined,\n): PermissionEntry[] {\n  if (secrets === undefined) {\n    return [];\n  }\n\n  const entries: PermissionEntry[] = [];\n  for (const [name, spec] of Object.entries(secrets)) {\n    const actions = secretActionsFromSpec(name, spec);\n    const secretPath = resolveSecretPath(\n      secretNameFromSpec(name, spec),\n      { scope: secretScopeFromSpec(spec) },\n    );\n    const extra: { expiry?: string; description?: string } =\n      spec !== true && typeof spec === \"object\" && !Array.isArray(spec)\n        ? spec\n        : {};\n    entries.push({\n      service: VAULT_PERMISSION_SERVICE,\n      space: SECRETS_SPACE,\n      path: secretPath.vaultKey,\n      actions: normalizeSecretActions(actions),\n      skipPrefix: true,\n      ...(extra.expiry !== undefined ? { expiry: extra.expiry } : {}),\n      ...(extra.description !== undefined\n        ? { description: extra.description }\n        : {}),\n    });\n  }\n  return entries;\n}\n\n/**\n * Expand a single permission entry into a {@link ResourceCapability}:\n * apply the prefix to the path and expand short actions into full URNs.\n */\nfunction resolveEntry(\n  entry: PermissionEntry,\n  prefix: string,\n  _inheritedExpiryMs: number,\n  inheritedSpace: string,\n): ResourceCapability[] {\n  // Encryption permissions reference a networkId URN as their resource\n  // — the manifest prefix is meaningless against a top-level\n  // owner-scoped resource and would corrupt the URN. Always skip.\n  const skipPrefixForEntry =\n    entry.skipPrefix === true ||\n    entry.service === ENCRYPTION_PERMISSION_SERVICE;\n  const resolvedPath = applyPrefix(prefix, entry.path, skipPrefixForEntry);\n  const entryExpiryMs =\n    entry.expiry !== undefined ? parseExpiry(entry.expiry) : undefined;\n  return expandPermissionEntry({\n    ...entry,\n    space: entry.space ?? inheritedSpace,\n    path: resolvedPath,\n    skipPrefix: true,\n  }).map((expanded) => ({\n    service: expanded.service,\n    space: expanded.space ?? inheritedSpace,\n    path: expanded.path,\n    actions: expanded.actions,\n    // Only populate `expiryMs` when the entry had its own expiry override.\n    // When absent, callers use the parent (delegation or manifest) expiry\n    // which is carried on ResolvedDelegate.expiryMs / ResolvedCapabilities.expiryMs.\n    ...(entryExpiryMs !== undefined ? { expiryMs: entryExpiryMs } : {}),\n    ...(entry.description !== undefined\n      ? { description: entry.description }\n      : {}),\n  }));\n}\n\nfunction expandVaultPermissionEntry(entry: PermissionEntry): PermissionEntry[] {\n  const byBase = new Map<VaultKVBase, string[]>();\n\n  for (const action of entry.actions) {\n    const expansion = vaultActionExpansion(action);\n    for (const base of expansion.bases) {\n      const actions = byBase.get(base) ?? [];\n      if (!actions.includes(expansion.action)) {\n        actions.push(expansion.action);\n      }\n      byBase.set(base, actions);\n    }\n  }\n\n  return [...byBase.entries()].map(([base, actions]) => ({\n    ...entry,\n    service: \"tinycloud.kv\",\n    path: vaultKVPath(base, entry.path),\n    actions,\n    skipPrefix: true,\n  }));\n}\n\nfunction vaultActionExpansion(action: string): VaultActionExpansion {\n  const normalized = normalizeVaultAction(action);\n  if (normalized === \"read\" || normalized === \"get\") {\n    return { bases: [\"vault\"], action: \"tinycloud.kv/get\" };\n  }\n  if (normalized === \"write\" || normalized === \"put\") {\n    return { bases: [\"vault\"], action: \"tinycloud.kv/put\" };\n  }\n  if (normalized === \"delete\" || normalized === \"del\") {\n    return { bases: [\"vault\"], action: \"tinycloud.kv/del\" };\n  }\n  if (normalized === \"list\") {\n    return { bases: [\"vault\"], action: \"tinycloud.kv/list\" };\n  }\n  if (normalized === \"head\") {\n    return { bases: [\"vault\"], action: \"tinycloud.kv/get\" };\n  }\n  if (normalized === \"metadata\") {\n    return { bases: [\"vault\"], action: \"tinycloud.kv/metadata\" };\n  }\n\n  throw new ManifestValidationError(\n    `unknown vault action ${JSON.stringify(action)}; expected read, write, delete, get, put, del, list, head, or metadata`,\n  );\n}\n\nfunction normalizeVaultAction(action: string): string {\n  if (action.startsWith(`${VAULT_PERMISSION_SERVICE}/`)) {\n    return action.slice(`${VAULT_PERMISSION_SERVICE}/`.length);\n  }\n  if (action.startsWith(\"tinycloud.kv/\")) {\n    return action.slice(\"tinycloud.kv/\".length);\n  }\n  if (action.includes(\"/\")) {\n    throw new ManifestValidationError(\n      `unknown vault action ${JSON.stringify(action)}; expected a tinycloud.vault or tinycloud.kv action`,\n    );\n  }\n  return action;\n}\n\nfunction vaultKVPath(base: VaultKVBase, path: string): string {\n  const normalized = path.startsWith(\"/\") ? path.slice(1) : path;\n  return `${base}/${normalized}`;\n}\n\nfunction cloneResourceCapability(\n  entry: ResourceCapability,\n): ResourceCapability {\n  return {\n    service: entry.service,\n    space: entry.space,\n    path: entry.path,\n    actions: [...entry.actions],\n    ...(entry.expiryMs !== undefined ? { expiryMs: entry.expiryMs } : {}),\n    ...(entry.description !== undefined\n      ? { description: entry.description }\n      : {}),\n  };\n}\n\nfunction clonePermissionEntry(entry: PermissionEntry): PermissionEntry {\n  return {\n    service: entry.service,\n    ...(entry.space !== undefined ? { space: entry.space } : {}),\n    path: entry.path,\n    actions: [...entry.actions],\n    ...(entry.caveats !== undefined\n      ? { caveats: JSON.parse(JSON.stringify(entry.caveats)) as Record<string, unknown>[] }\n      : {}),\n    ...(entry.skipPrefix !== undefined ? { skipPrefix: entry.skipPrefix } : {}),\n    ...(entry.expiry !== undefined ? { expiry: entry.expiry } : {}),\n    ...(entry.description !== undefined\n      ? { description: entry.description }\n      : {}),\n  };\n}\n\nfunction dedupeResources(\n  resources: readonly ResourceCapability[],\n): ResourceCapability[] {\n  const byKey = new Map<string, ResourceCapability>();\n\n  for (const resource of resources) {\n    const key = `${resource.service}\\u0000${resource.space}\\u0000${resource.path}\\u0000${resource.expiryMs ?? \"\"}`;\n    const existing = byKey.get(key);\n    if (existing === undefined) {\n      byKey.set(key, cloneResourceCapability(resource));\n      continue;\n    }\n\n    const seen = new Set(existing.actions);\n    for (const action of resource.actions) {\n      if (!seen.has(action)) {\n        existing.actions.push(action);\n        seen.add(action);\n      }\n    }\n    if (\n      existing.description === undefined &&\n      resource.description !== undefined\n    ) {\n      existing.description = resource.description;\n    }\n  }\n\n  return [...byKey.values()];\n}\n\nfunction capabilitiesReadPermission(space: string): ResourceCapability {\n  return {\n    service: \"tinycloud.capabilities\",\n    space,\n    path: \"\",\n    actions: [\"tinycloud.capabilities/read\"],\n  };\n}\n\nfunction withCapabilitiesReadForSpaces(\n  resources: readonly ResourceCapability[],\n): ResourceCapability[] {\n  if (resources.length === 0) {\n    return [];\n  }\n\n  const spaces = new Set(\n    resources\n      .filter((resource) => resource.service !== ENCRYPTION_PERMISSION_SERVICE)\n      .map((resource) => resource.space),\n  );\n  return dedupeResources([\n    ...resources,\n    ...[...spaces].map(capabilitiesReadPermission),\n  ]);\n}\n\n/**\n * Compose one or more manifests into the single capability request that should\n * be signed. Fetching manifests is intentionally out of band; callers pass the\n * already-loaded manifest objects.\n */\nexport function composeManifestRequest(\n  inputs: readonly Manifest[],\n  options: ComposeManifestOptions = {},\n): ComposedManifestRequest {\n  if (!Array.isArray(inputs) || inputs.length === 0) {\n    throw new ManifestValidationError(\n      \"composeManifestRequest requires at least one manifest\",\n    );\n  }\n\n  const includeAccountRegistryPermissions =\n    options.includeAccountRegistryPermissions ?? true;\n  const manifests = inputs.map(validateManifest);\n  const resolved = manifests.map(resolveManifest);\n  const resources = resolved.flatMap((entry) => entry.resources);\n  const delegationTargets = resolved.flatMap((entry) =>\n    entry.additionalDelegates.map((delegate) => ({\n      ...delegate,\n      permissions: dedupeResources(delegate.permissions),\n    })),\n  );\n\n  if (includeAccountRegistryPermissions) {\n    resources.push(\n      ...ACCOUNT_MANIFEST_PERMISSIONS.map((resource) => ({\n        ...resource,\n        actions: [...resource.actions],\n      })),\n    );\n  }\n  const resourcesWithImplicitCapabilities =\n    withCapabilitiesReadForSpaces(resources);\n\n  const manifestsByAppId = new Map<string, Manifest[]>();\n  for (const manifest of manifests) {\n    const current = manifestsByAppId.get(manifest.app_id);\n    if (current === undefined) {\n      manifestsByAppId.set(manifest.app_id, [manifest]);\n    } else {\n      current.push(manifest);\n    }\n  }\n\n  const registryRecords: ManifestRegistryRecord[] =\n    includeAccountRegistryPermissions\n      ? [...manifestsByAppId.entries()].map(([app_id, appManifests]) => ({\n          key: `${ACCOUNT_REGISTRY_PATH}${app_id}`,\n          app_id,\n          manifests: appManifests.map((manifest) => ({\n            ...manifest,\n            permissions: manifest.permissions?.map(clonePermissionEntry),\n          })),\n        }))\n      : [];\n\n  return {\n    manifests,\n    resources: resourcesWithImplicitCapabilities,\n    delegationTargets,\n    registryRecords,\n    expiryMs: Math.max(...resolved.map((entry) => entry.expiryMs)),\n    includePublicSpace: resolved.some((entry) => entry.includePublicSpace),\n  };\n}\n\n// ---------------------------------------------------------------------------\n// Abilities map construction (bridge to WASM prepareSession / createDelegation)\n// ---------------------------------------------------------------------------\n\n/**\n * The shape `prepareSession` and the multi-resource `createDelegation` WASM\n * export both accept:\n *\n * ```\n * { [shortService]: { [path]: [fullUrnAction, ...] } }\n * ```\n *\n * - `shortService` is the recap-level service segment (`\"kv\"`, `\"sql\"`,\n *   `\"duckdb\"`, `\"capabilities\"`, `\"hooks\"`) — not the manifest long form.\n * - `path` is the fully-resolved path (prefix already applied). An empty\n *   string means \"no path segment\" on the resource URI.\n * - Action strings are full URNs like `\"tinycloud.kv/get\"`.\n *\n * This is a single source of truth for both the session's own recap (at\n * sign-in) and the delegations it can derive (post sign-in). We re-use it\n * for both so one manifest drives both sides.\n */\nexport type AbilitiesMap = Record<string, Record<string, string[]>>;\n\n/**\n * Per-space abilities map accepted by the newer WASM session config:\n *\n * ```\n * { [spaceIdOrName]: { [shortService]: { [path]: [fullUrnAction, ...] } } }\n * ```\n */\nexport type SpaceAbilitiesMap = Record<string, AbilitiesMap>;\n\n/**\n * Convert a list of {@link ResourceCapability} entries (manifest\n * long-form service, full-URN actions) into the {@link AbilitiesMap}\n * shape the WASM layer expects.\n *\n * When multiple entries target the same `(service, path)` pair, their\n * action lists are merged and deduped. Entries whose service has no\n * short-form mapping in {@link SERVICE_LONG_TO_SHORT} are rejected with\n * a {@link ManifestValidationError} — the SDK does not silently drop\n * unknown services because the recap encoding would lose them.\n *\n * Paths are kept verbatim: this function does NOT collapse\n * `\"com.listen.app/\"` and `\"com.listen.app\"` or reinterpret empty /\n * slash strings. Callers that care about path canonicalization should\n * normalize before calling.\n */\nexport function resourceCapabilitiesToAbilitiesMap(\n  resources: readonly ResourceCapability[],\n): AbilitiesMap {\n  const out: AbilitiesMap = {};\n  for (const r of resources) {\n    const shortService = SERVICE_LONG_TO_SHORT[r.service];\n    if (shortService === undefined) {\n      throw new ManifestValidationError(\n        `unknown service '${r.service}' — no short-form mapping. Known services: ${Object.keys(SERVICE_LONG_TO_SHORT).join(\", \")}`,\n      );\n    }\n    if (out[shortService] === undefined) {\n      out[shortService] = {};\n    }\n    const pathsMap = out[shortService];\n    const existing = pathsMap[r.path];\n    if (existing === undefined) {\n      // Copy so downstream mutation can't leak back into the input.\n      pathsMap[r.path] = [...r.actions];\n    } else {\n      // Merge + dedupe while preserving first-seen order.\n      const seen = new Set(existing);\n      for (const action of r.actions) {\n        if (!seen.has(action)) {\n          existing.push(action);\n          seen.add(action);\n        }\n      }\n    }\n  }\n  return out;\n}\n\n/**\n * Group resolved capabilities by `space`, then convert each group into a WASM\n * abilities map. Short space names are left as-is here; platform layers that\n * know the wallet address and chain id turn them into full SpaceIds.\n */\nexport function resourceCapabilitiesToSpaceAbilitiesMap(\n  resources: readonly ResourceCapability[],\n): SpaceAbilitiesMap {\n  const grouped = new Map<string, ResourceCapability[]>();\n  for (const resource of resources) {\n    const entries = grouped.get(resource.space);\n    if (entries === undefined) {\n      grouped.set(resource.space, [resource]);\n    } else {\n      entries.push(resource);\n    }\n  }\n\n  const out: SpaceAbilitiesMap = {};\n  for (const [space, entries] of grouped.entries()) {\n    out[space] = resourceCapabilitiesToAbilitiesMap(entries);\n  }\n  return out;\n}\n\n/**\n * Build the {@link AbilitiesMap} that a session should be signed with,\n * given a {@link ResolvedCapabilities} (i.e. the output of\n * {@link resolveManifest}).\n *\n * The resulting map is the **union** of:\n * 1. the app's own resources (`resolved.resources`), and\n * 2. every permission declared in every `additionalDelegates[*]` entry.\n *\n * The union is what makes the manifest's delegations ergonomic: at\n * sign-in, the session key acquires recap coverage for both the app's\n * runtime needs and every downstream delegation target. Post sign-in,\n * `delegateTo(backendDID, backendPermissions)` can then issue the\n * sub-delegation via the session key (no wallet prompt) because the\n * caps are already part of the granted set.\n *\n * Duplicate `(service, path, action)` triples across resources and\n * delegations are merged and deduped — the session SIWE doesn't need\n * them repeated.\n */\nexport function manifestAbilitiesUnion(\n  resolved: ResolvedCapabilities,\n): AbilitiesMap {\n  const all: ResourceCapability[] = [...resolved.resources];\n  for (const delegate of resolved.additionalDelegates) {\n    for (const perm of delegate.permissions) {\n      all.push(perm);\n    }\n  }\n  return resourceCapabilitiesToAbilitiesMap(all);\n}\n","/**\n * Capability subset checking and recap parsing.\n *\n * This module powers the capability-chain delegation flow. The key decision\n * a `delegateTo` call has to make is: \"are the requested capabilities a\n * subset of what the current session already grants?\"\n *\n * - If yes → issue the delegation via the session-key UCAN path (no wallet prompt).\n * - If no → raise {@link PermissionNotInManifestError} so the caller can\n *   trigger an escalation flow via `requestPermissions`.\n *\n * Canonical spec: `.claude/specs/capability-chain.md`.\n *\n * @packageDocumentation\n */\n\nimport {\n  DEFAULT_MANIFEST_SPACE,\n  type PermissionEntry,\n  SERVICE_SHORT_TO_LONG,\n  expandActionShortNames,\n} from \"./manifest\";\n\n// ---------------------------------------------------------------------------\n// Errors\n// ---------------------------------------------------------------------------\n\n/**\n * Thrown when a `delegateTo` call requests capabilities that the current\n * session does not already grant. The caller can catch this and trigger\n * `requestPermissions(missing)` to show an escalation modal.\n */\nexport class PermissionNotInManifestError extends Error {\n  public readonly missing: PermissionEntry[];\n  public readonly granted: PermissionEntry[];\n\n  constructor(missing: PermissionEntry[], granted: PermissionEntry[]) {\n    super(\n      `Requested capabilities exceed current session. Missing ${missing.length} entries.`\n    );\n    this.name = \"PermissionNotInManifestError\";\n    this.missing = missing;\n    this.granted = granted;\n  }\n}\n\n/**\n * Thrown when the current session has expired (or will expire within the\n * safety margin). The caller should trigger a fresh sign-in.\n */\nexport class SessionExpiredError extends Error {\n  public readonly expiredAt: Date;\n\n  constructor(expiredAt: Date) {\n    super(`Session expired at ${expiredAt.toISOString()}`);\n    this.name = \"SessionExpiredError\";\n    this.expiredAt = expiredAt;\n  }\n}\n\n/**\n * Thrown when the installed WASM delegation boundary cannot encode every\n * constrained ReCap branch in a requested child delegation.\n */\nexport class CaveatedDelegationUnsupportedError extends Error {\n  /** Stable machine-readable error code for fail-closed caveated delegation. */\n  code = \"CAVEATED_DELEGATION_UNSUPPORTED\" as const;\n  /** Requested entries whose constrained ReCap branches cannot be preserved. */\n  entries: PermissionEntry[];\n\n  constructor(entries: PermissionEntry[]) {\n    super(\n      \"Cannot create a caveated delegation because this WASM delegation boundary cannot preserve every ReCap caveat branch exactly.\"\n    );\n    this.name = \"CaveatedDelegationUnsupportedError\";\n    this.entries = entries.map(cloneEntry);\n  }\n}\n\n// ---------------------------------------------------------------------------\n// Space normalization\n// ---------------------------------------------------------------------------\n\n/**\n * Normalize a space identifier to its short-name form.\n *\n * Recap resource URIs in a signed SIWE encode the space as a full URI of the\n * form `tinycloud:pkh:eip155:{chainId}:{address}:{name}` (e.g.\n * `tinycloud:pkh:eip155:1:0xd559...:default`). Manifest permissions and\n * backend-advertised permissions use the short `{name}` form (e.g.\n * `\"default\"`).\n *\n * Strict string comparison between these two forms would always fail, so we\n * normalize both sides to the short name before comparing. The trailing\n * segment after the last `:` in a `tinycloud:` URI is the space name.\n *\n * Short names (`\"default\"`, `\"work-space\"`) are returned unchanged.\n * Any non-`tinycloud:` string is returned unchanged. A malformed URI with a\n * trailing colon is returned unchanged (so the check degrades to a strict\n * mismatch rather than collapsing to an empty string).\n *\n * @internal\n */\nexport function normalizeSpace(space: string): string {\n  if (!space.startsWith(\"tinycloud:\")) {\n    return space;\n  }\n  const lastColon = space.lastIndexOf(\":\");\n  if (lastColon === -1 || lastColon === space.length - 1) {\n    return space;\n  }\n  return space.slice(lastColon + 1);\n}\n\n// ---------------------------------------------------------------------------\n// Subset check\n// ---------------------------------------------------------------------------\n\nexport interface SubsetCheckResult {\n  /** True when every requested entry is covered by a granted entry. */\n  subset: boolean;\n  /** Entries the granted set does not cover (empty when `subset` is true). */\n  missing: PermissionEntry[];\n}\n\n/**\n * Check whether `requested` is a strict subset of `granted`.\n *\n * Matching rules for each `requested[i]`:\n * - `service` matches exactly.\n * - `space` matches exactly.\n * - Path containment:\n *     - If `granted.path` ends with `/`, it covers any `requested.path` that\n *       starts with `granted.path`.\n *     - Otherwise, the paths must match exactly.\n * - Action containment: every requested URN must be matched exactly or by a\n *   service-scoped wildcard such as `tinycloud.kv/*`.\n *\n * Grant entries with the same service, space, path coverage, and caveats are\n * considered together. This matters because ReCap parsers may return one\n * entry per action even when the original manifest grouped those actions.\n * Any `requested` entry whose actions are not collectively covered is added\n * to `missing` and the overall result is non-subset.\n *\n * Both sides are expected to be in the canonical long-form shape (service\n * starts with `tinycloud.`, actions are full URNs). Use {@link parseRecapCapabilities}\n * or `expandActionShortNames` to normalize inputs first.\n */\nexport function isCapabilitySubset(\n  requested: readonly PermissionEntry[],\n  granted: readonly PermissionEntry[]\n): SubsetCheckResult {\n  const missing: PermissionEntry[] = [];\n\n  for (const req of requested) {\n    const matchingScope = granted.filter((entry) =>\n      canonicalizeEntryScopeMatches(req, entry)\n    );\n    const requestedActions = expandActionShortNames(\n      req.service,\n      req.actions\n    );\n    const grantedActions = matchingScope.flatMap((entry) =>\n      expandActionShortNames(entry.service, entry.actions)\n    );\n    const covered = requestedActions.every((requestedAction) =>\n      grantedActions.some((grantedAction) =>\n        actionContains(grantedAction, requestedAction)\n      )\n    );\n    if (!covered) {\n      missing.push(cloneEntry(req));\n    }\n  }\n\n  return { subset: missing.length === 0, missing };\n}\n\n/**\n * Returns true when `granted` fully covers `requested` — same service, same\n * space, path containment per spec, and action set containment.\n */\nfunction canonicalizeEntryScopeMatches(\n  requested: PermissionEntry,\n  granted: PermissionEntry\n): boolean {\n  if (requested.service !== granted.service) {\n    return false;\n  }\n  // Normalize both sides so callers passing short names (`\"default\"`) match\n  // recap-parsed full URIs (`\"tinycloud:pkh:eip155:1:0xd559...:default\"`) and\n  // vice versa. Idempotent for short names.\n  if (\n    normalizeSpace(requested.space ?? DEFAULT_MANIFEST_SPACE) !==\n    normalizeSpace(granted.space ?? DEFAULT_MANIFEST_SPACE)\n  ) {\n    return false;\n  }\n  if (!pathContains(granted.path, requested.path)) {\n    return false;\n  }\n  // There is no safe general partial ordering for arbitrary ReCap caveat\n  // objects. A caveated authority therefore only covers the same caveat set;\n  // treating it as uncaveated would authorize a broader child delegation.\n  if (!recapCaveatsEqual(requested.caveats, granted.caveats)) {\n    return false;\n  }\n  return true;\n}\n\n/**\n * Compare ReCap caveat branch sets without losing signed branch structure.\n *\n * ReCap represents an unconstrained ability as `[{}]`, while SDK callers can\n * represent that same authority as `undefined` or `[]`. Those three forms are\n * equivalent. Every other branch, including an unconstrained branch mixed\n * with a constrained one, remains part of the canonical comparison.\n */\nexport function recapCaveatsEqual(\n  left: readonly Record<string, unknown>[] | undefined,\n  right: readonly Record<string, unknown>[] | undefined,\n): boolean {\n  return canonicalizeRecapCaveats(left) === canonicalizeRecapCaveats(right);\n}\n\n/**\n * Canonicalize a ReCap caveat branch set for exact equality checks.\n *\n * Object keys and branch order do not affect equality. A lone unconstrained\n * branch is normalized to the SDK's empty-caveat representation, but an\n * unconstrained branch in a mixed set is deliberately retained.\n */\nexport function canonicalizeRecapCaveats(\n  caveats: readonly Record<string, unknown>[] | undefined,\n): string {\n  const canonicalize = (value: unknown): string => {\n    if (value === null || typeof value === \"boolean\" || typeof value === \"string\") {\n      return JSON.stringify(value);\n    }\n    if (typeof value === \"number\") {\n      if (Number.isFinite(value)) return JSON.stringify(value);\n      throw new Error(\"ReCap caveats must contain only JSON values.\");\n    }\n    if (Array.isArray(value)) return `[${value.map(canonicalize).join(\",\")}]`;\n    if (typeof value === \"object\") {\n      const object = value as Record<string, unknown>;\n      const prototype = Object.getPrototypeOf(object);\n      if (prototype !== Object.prototype && prototype !== null) {\n        throw new Error(\"ReCap caveats must contain only JSON values.\");\n      }\n      return `{${Object.keys(object).sort().map((key) =>\n        `${JSON.stringify(key)}:${canonicalize(object[key])}`,\n      ).join(\",\")}}`;\n    }\n    throw new Error(\"ReCap caveats must contain only JSON values.\");\n  };\n  const branches = (caveats ?? []).map(canonicalize).sort();\n  if (branches.length === 0 || (branches.length === 1 && branches[0] === \"{}\")) {\n    return \"[]\";\n  }\n  return `[${branches.join(\",\")}]`;\n}\n\n// Literal strings, not `KV.SYNC`/`KV.RETAIN`: those are derived from the\n// vendored registry at runtime, so an older bootstrap would turn them into\n// `undefined` and silently disable this guard.\nconst EXPLICIT_ONLY_ACTIONS: Readonly<Record<string, true>> = {\n  \"tinycloud.kv/sync\": true,\n  \"tinycloud.kv/retain\": true,\n};\n\n/**\n * Whether `action` is one no wildcard covers: `*` and `tinycloud.kv/*` do not\n * grant it, so a grant must name it (TC-732). `tinycloud.kv/sync` discloses a\n * prefix's change feed and `tinycloud.kv/retain` is an owner-approved\n * retention attestation; the node refuses both unless granted by name.\n */\nexport function isExplicitOnlyAction(action: string): boolean {\n  return Object.prototype.hasOwnProperty.call(EXPLICIT_ONLY_ACTIONS, action);\n}\n\n/** Return whether a granted action pattern covers one requested action. */\nexport function actionContains(grantedAction: string, requestedAction: string): boolean {\n  if (grantedAction === requestedAction) return true;\n  if (isExplicitOnlyAction(requestedAction)) return false;\n  if (grantedAction === \"*\") return true;\n  if (!grantedAction.endsWith(\"/*\")) return false;\n  const service = grantedAction.slice(0, -2);\n  return requestedAction === service || requestedAction.startsWith(`${service}/`);\n}\n\n/**\n * Path containment per spec:\n * - `granted.path` ends with `/` → prefix match (requested starts with granted)\n * - otherwise → exact string match\n *\n * The empty string is treated as \"no path constraint\" and matches anything.\n * The single-character `\"/\"` also matches anything (it is a trailing-slash\n * prefix of zero-length).\n */\nfunction pathContains(grantedPath: string, requestedPath: string): boolean {\n  if (grantedPath === \"\" || grantedPath === \"/\") {\n    return true;\n  }\n  if (grantedPath.endsWith(\"/\")) {\n    return requestedPath.startsWith(grantedPath);\n  }\n  return requestedPath === grantedPath;\n}\n\nfunction cloneEntry(entry: PermissionEntry): PermissionEntry {\n  return {\n    service: entry.service,\n    ...(entry.space !== undefined ? { space: entry.space } : {}),\n    path: entry.path,\n    actions: [...entry.actions],\n    ...(entry.caveats !== undefined\n      ? { caveats: JSON.parse(JSON.stringify(entry.caveats)) as Record<string, unknown>[] }\n      : {}),\n    ...(entry.skipPrefix !== undefined ? { skipPrefix: entry.skipPrefix } : {}),\n    ...(entry.expiry !== undefined ? { expiry: entry.expiry } : {}),\n  };\n}\n\n// ---------------------------------------------------------------------------\n// Recap parsing (WASM wrapper)\n// ---------------------------------------------------------------------------\n\n/**\n * The raw shape returned from the WASM `parseRecapFromSiwe` export. The\n * Rust layer encodes the service in the short form (e.g. `\"kv\"`) because\n * that is what the SIWE recap resource URI actually contains. We normalize\n * to the manifest long form (`\"tinycloud.kv\"`) in {@link parseRecapCapabilities}.\n *\n * @internal\n */\nexport interface WasmRecapEntry {\n  service: string;\n  space: string;\n  path: string;\n  actions: string[];\n  /** Exact ReCap caveats shared by every action in this entry. */\n  caveats?: Record<string, unknown>[];\n}\n\n/**\n * Signature of the WASM `parseRecapFromSiwe` export. Accepts the signed\n * SIWE message string and returns an array of raw recap entries. Throws if\n * the SIWE is malformed or the recap statement has been tampered.\n *\n * Exposed as an interface so the SDK can inject the web or node binding\n * without `capabilities.ts` needing to know which.\n */\nexport type ParseRecapFromSiwe = (siweString: string) => WasmRecapEntry[];\n\n/**\n * Parse a signed SIWE message into an array of {@link PermissionEntry}\n * objects in the canonical long-form manifest shape.\n *\n * This is a thin wrapper around the WASM `parseRecapFromSiwe` export that:\n * 1. Normalizes short-form services (`\"kv\"`) to long-form (`\"tinycloud.kv\"`).\n * 2. Returns entries in a deterministic order (sorted by space, then service,\n *    then path) so downstream equality checks are stable.\n *\n * Returns an empty array when the SIWE has no recap resource (plain auth\n * SIWE); this matches the WASM function's behavior and the spec.\n *\n * @param parseWasm The WASM `parseRecapFromSiwe` binding.\n * @param siwe The signed SIWE message string (exactly what `session.siwe` stores).\n */\nexport function parseRecapCapabilities(\n  parseWasm: ParseRecapFromSiwe,\n  siwe: string\n): PermissionEntry[] {\n  const raw = parseWasm(siwe);\n  if (!Array.isArray(raw)) {\n    throw new Error(\n      \"parseRecapFromSiwe returned a non-array value; wasm binding may be out of sync\"\n    );\n  }\n  const normalized: PermissionEntry[] = raw.map((entry) => {\n    const longService =\n      SERVICE_SHORT_TO_LONG[entry.service] ??\n      // Unknown short names pass through. If the recap already contained a\n      // long-form service (e.g. a future tinycloud-node version emits long\n      // form directly), don't double-prefix.\n      (entry.service.startsWith(\"tinycloud.\")\n        ? entry.service\n        : `tinycloud.${entry.service}`);\n    return {\n      service: longService,\n      // The Rust layer emits the space as a full `tinycloud:pkh:...:name`\n      // URI (the recap target URI). Normalize to the short name so the\n      // returned entries match the shape manifests use.\n      space: normalizeSpace(entry.space),\n      path: entry.path,\n      actions: [...entry.actions],\n      ...(entry.caveats === undefined\n        ? {}\n        : { caveats: JSON.parse(JSON.stringify(entry.caveats)) as Record<string, unknown>[] }),\n    };\n  });\n\n  // Sort for determinism (callers do equality checks on arrays of entries\n  // in tests; deterministic ordering keeps those stable).\n  normalized.sort((a, b) => {\n    const aSpace = a.space ?? DEFAULT_MANIFEST_SPACE;\n    const bSpace = b.space ?? DEFAULT_MANIFEST_SPACE;\n    if (aSpace !== bSpace) return aSpace < bSpace ? -1 : 1;\n    if (a.service !== b.service) return a.service < b.service ? -1 : 1;\n    if (a.path !== b.path) return a.path < b.path ? -1 : 1;\n    return 0;\n  });\n\n  return normalized;\n}\n","import {\n  canonicalizeRecapCaveats,\n  isCapabilitySubset,\n  type PermissionEntry,\n} from \"@tinycloud/sdk-core\";\n\n/**\n * A capability in the canonical form persisted in a v1 request artifact.\n *\n * The SDK remains the semantic authority for containment. This module only\n * establishes deterministic exact identity for persistence and display.\n */\nexport type CanonicalPermissionEntry = Readonly<PermissionEntry>;\n\nexport interface AuthorityEvaluation {\n  readonly satisfied: boolean;\n  readonly missing: readonly CanonicalPermissionEntry[];\n}\n\n/**\n * Operation-owned space resolution. The SDK's general capability evaluator\n * intentionally preserves its historical short/full-space compatibility; the\n * operation kernel supplies this narrower resolver when a space identifies a\n * remote owner's resource.\n */\nexport type OperationSpaceResolver = (space: string) => string;\n\nconst EXACT_PERMISSION_KEYS = new Set([\n  \"service\",\n  \"space\",\n  \"path\",\n  \"actions\",\n  \"skipPrefix\",\n  \"expiry\",\n  \"description\",\n]);\n\n/**\n * Validate requirements that can be represented without semantic broadening in\n * a v1 artifact. Caveated authority is intentionally rejected: the v1 request\n * schema and grant path cannot preserve those signed branches end-to-end.\n */\nexport function validateExactCapabilities(value: unknown): PermissionEntry[] | undefined {\n  if (!Array.isArray(value)) return undefined;\n\n  const permissions: PermissionEntry[] = [];\n  for (const candidate of value) {\n    if (!isExactPermission(candidate)) return undefined;\n    permissions.push(candidate);\n  }\n  return canonicalizeCapabilities(permissions);\n}\n\n/**\n * Evaluates required authority with the SDK's public subset primitive.\n *\n * In particular, this intentionally does not implement matching rules or\n * manufacture wildcards. A wildcard can cover a requirement only when it was\n * already present in the supplied granted authority and the SDK says so.\n */\nexport function evaluateAuthority(\n  granted: readonly PermissionEntry[],\n  required: readonly PermissionEntry[],\n): AuthorityEvaluation {\n  const canonicalGranted = canonicalizeCapabilities(granted);\n  const canonicalRequired = canonicalizeCapabilities(required);\n  const result = isCapabilitySubset(canonicalRequired, canonicalGranted);\n\n  return {\n    satisfied: result.subset,\n    missing: canonicalizeCapabilities(result.missing),\n  };\n}\n\n/**\n * Evaluate operation capabilities without allowing two owners' same-named\n * spaces to compare equal. Path and action containment still come from the\n * SDK primitive; only the operation space identity is made owner-exact.\n */\nexport function evaluateOperationAuthority(\n  granted: readonly PermissionEntry[],\n  required: readonly PermissionEntry[],\n  resolveSpace?: OperationSpaceResolver,\n): AuthorityEvaluation {\n  const canonicalGranted = canonicalizeOperationCapabilities(granted, resolveSpace);\n  const canonicalRequired = canonicalizeOperationCapabilities(required, resolveSpace);\n  const missing: CanonicalPermissionEntry[] = [];\n\n  for (const requested of canonicalRequired) {\n    const covered = canonicalGranted.some((candidate) =>\n      candidate.service === requested.service &&\n      operationSpacesEqual(candidate.space, requested.space) &&\n      isCapabilitySubset([requested], [candidate]).subset,\n    );\n    if (!covered) missing.push(requested);\n  }\n\n  return {\n    satisfied: missing.length === 0,\n    missing: canonicalizeCapabilities(missing),\n  };\n}\n\n/**\n * Whether a delegation's signed capabilities stay inside the stored request\n * it answers. `tinycloud.auth.import` and runtime replay share this check, so\n * a delegation import accepts is never one replay discards.\n */\nexport function delegationWithinRequest(\n  requested: readonly PermissionEntry[],\n  effective: readonly PermissionEntry[],\n  resolveSpace?: OperationSpaceResolver,\n): boolean {\n  return requested.length > 0 &&\n    evaluateOperationAuthority(requested, canonicalizeCapabilities(effective), resolveSpace).satisfied;\n}\n\n/**\n * Validate a runtime hint as an exact member of the registered plan. Runtime\n * nodes may report the one phase that failed, but they may not introduce a\n * broader, differently-owned, caveated, or otherwise new capability.\n */\nexport function isExactCapabilityMemberSubset(\n  hinted: readonly PermissionEntry[],\n  planned: readonly PermissionEntry[],\n  resolveSpace?: OperationSpaceResolver,\n): boolean {\n  const canonicalHinted = canonicalizeOperationCapabilities(hinted, resolveSpace);\n  const canonicalPlanned = canonicalizeOperationCapabilities(planned, resolveSpace);\n  return canonicalHinted.length > 0 && canonicalHinted.every((hint) => canonicalPlanned.some((plan) =>\n    JSON.stringify(hint) === JSON.stringify(plan),\n  ));\n}\n\n/** Canonical identity used by operation preflight, hints, and artifacts. */\nexport function canonicalizeOperationCapabilities(\n  permissions: readonly PermissionEntry[],\n  resolveSpace?: OperationSpaceResolver,\n): CanonicalPermissionEntry[] {\n  return canonicalizeCapabilities(permissions.map((permission) => {\n    const canonicalPath = canonicalizeOperationPath(permission);\n    if (permission.space === undefined || resolveSpace === undefined) {\n      return canonicalPath;\n    }\n    try {\n      return { ...canonicalPath, space: resolveSpace(permission.space) };\n    } catch {\n      // An unresolvable identity remains a non-matching literal. It must never\n      // be widened to a wildcard or to another authenticated owner.\n      return canonicalPath;\n    }\n  }));\n}\n\nfunction canonicalizeOperationPath(permission: PermissionEntry): PermissionEntry {\n  if (permission.service !== \"tinycloud.encryption\") return permission;\n  const match = permission.path.match(\n    /^(urn:tinycloud:encryption:did:pkh:eip155:\\d+:)(0x[0-9a-fA-F]{40})(:.*)$/,\n  );\n  if (!match) return permission;\n  return { ...permission, path: `${match[1]}${match[2]!.toLowerCase()}${match[3]}` };\n}\n\nfunction operationSpacesEqual(\n  granted: string | undefined,\n  requested: string | undefined,\n): boolean {\n  return granted === requested;\n}\n\n/** Returns a stable exact identity for one capability without containment. */\nexport function permissionIdentity(permission: PermissionEntry): string {\n  return JSON.stringify(canonicalizeCapability(permission));\n}\n\n/**\n * Sorts actions and entries and removes only exactly-identical capabilities.\n * It does not coalesce paths, services, spaces, or actions into a broader\n * capability.\n */\nexport function canonicalizeCapabilities(\n  permissions: readonly PermissionEntry[],\n): CanonicalPermissionEntry[] {\n  const byIdentity = new Map<string, CanonicalPermissionEntry>();\n  for (const permission of permissions) {\n    const canonical = canonicalizeCapability(permission);\n    byIdentity.set(permissionIdentityFromCanonical(canonical), canonical);\n  }\n\n  return [...byIdentity.entries()]\n    .sort(([left], [right]) => left.localeCompare(right))\n    .map(([, permission]) => permission);\n}\n\nfunction canonicalizeCapability(permission: PermissionEntry): CanonicalPermissionEntry {\n  const actions = [...new Set(permission.actions)].sort((left, right) => left.localeCompare(right));\n  return {\n    service: permission.service,\n    ...(permission.space !== undefined ? { space: permission.space } : {}),\n    path: permission.path,\n    actions,\n    ...(permission.skipPrefix !== undefined ? { skipPrefix: permission.skipPrefix } : {}),\n    ...(permission.expiry !== undefined ? { expiry: permission.expiry } : {}),\n    ...(permission.description !== undefined ? { description: permission.description } : {}),\n    ...(permission.caveats === undefined\n      ? {}\n      : { caveats: canonicalizeCaveats(permission.caveats) }),\n  };\n}\n\nfunction permissionIdentityFromCanonical(permission: CanonicalPermissionEntry): string {\n  return JSON.stringify({\n    service: permission.service,\n    ...(permission.space !== undefined ? { space: permission.space } : {}),\n    path: permission.path,\n    actions: permission.actions,\n    ...(permission.skipPrefix !== undefined ? { skipPrefix: permission.skipPrefix } : {}),\n    ...(permission.expiry !== undefined ? { expiry: permission.expiry } : {}),\n    ...(permission.description !== undefined ? { description: permission.description } : {}),\n    ...(permission.caveats === undefined ? {} : { caveats: permission.caveats }),\n  });\n}\n\nfunction isExactPermission(value: unknown): value is PermissionEntry {\n  if (\n    !isExactRecord(value) ||\n    Object.getOwnPropertyNames(value).some((key) => !EXACT_PERMISSION_KEYS.has(key)) ||\n    Object.getOwnPropertySymbols(value).length > 0\n  ) {\n    return false;\n  }\n  if (\n    !isExactText(value.service) ||\n    !isExactPath(value.path, value.actions) ||\n    (value.space !== undefined && !isExactText(value.space)) ||\n    !Array.isArray(value.actions) ||\n    value.actions.length === 0 ||\n    !value.actions.every(isExactText) ||\n    new Set(value.actions).size !== value.actions.length ||\n    value.skipPrefix === true ||\n    (value.skipPrefix !== undefined && value.skipPrefix !== false) ||\n    (value.expiry !== undefined && !isExactText(value.expiry)) ||\n    (value.description !== undefined && !isExactText(value.description))\n  ) {\n    return false;\n  }\n  return !(\"caveats\" in value);\n}\n\nfunction isExactRecord(value: unknown): value is Record<string, unknown> {\n  if (typeof value !== \"object\" || value === null || Array.isArray(value)) return false;\n  const prototype = Object.getPrototypeOf(value);\n  return prototype === Object.prototype || prototype === null;\n}\n\nfunction isExactText(value: unknown): value is string {\n  return typeof value === \"string\" && value.length > 0 && !value.includes(\"*\");\n}\n\nfunction isExactPath(value: unknown, actions: unknown): value is string {\n  if (typeof value !== \"string\" || value === \"/\" || value.includes(\"*\")) return false;\n  if (value === \"\" || value.endsWith(\"/\")) {\n    return Array.isArray(actions) && actions.includes(\"tinycloud.kv/list\");\n  }\n  return true;\n}\n\nfunction canonicalizeCaveats(\n  caveats: readonly Record<string, unknown>[],\n): Record<string, unknown>[] {\n  return [...caveats]\n    .map((caveat) => ({\n      identity: canonicalizeRecapCaveats([caveat]),\n      value: JSON.parse(JSON.stringify(caveat)) as Record<string, unknown>,\n    }))\n    .sort((left, right) => left.identity.localeCompare(right.identity))\n    .map(({ value }) => value);\n}\n","import { randomUUID } from \"node:crypto\";\nimport { AsyncLocalStorage } from \"node:async_hooks\";\nimport {\n  chmod,\n  link,\n  mkdir,\n  open,\n  readFile,\n  readdir,\n  rename,\n  rmdir,\n  rm,\n  stat,\n  unlink,\n  writeFile,\n} from \"node:fs/promises\";\nimport { homedir } from \"node:os\";\nimport { basename, dirname, isAbsolute, join, relative, resolve } from \"node:path\";\n\nconst DEFAULT_PROFILE = \"default\";\nconst DEFAULT_LOCK_TIMEOUT_MS = 2_000;\nconst DEFAULT_LOCK_RETRY_MS = 25;\nconst DEFAULT_STALE_LOCK_MS = 30_000;\nconst TEST_LOCK_CONTENTION_SIGNAL_PATH = \"TC_TEST_PROFILE_LOCK_CONTENTION_SIGNAL_PATH\";\n// Profile state holds keys, sessions and delegations: owner-only access.\nconst PRIVATE_FILE_MODE = 0o600;\nconst PRIVATE_DIR_MODE = 0o700;\nconst TEST_LOCK_RECOVERY_BARRIER_DIR = \"TC_TEST_PROFILE_LOCK_RECOVERY_BARRIER_DIR\";\nconst TEST_LOCK_OWNERLESS_BARRIER_DIR = \"TC_TEST_PROFILE_LOCK_OWNERLESS_BARRIER_DIR\";\nconst TEST_LOCK_PUBLISH_BARRIER_DIR = \"TC_TEST_PROFILE_LOCK_PUBLISH_BARRIER_DIR\";\nconst TEST_LOCK_RELEASE_BARRIER_DIR = \"TC_TEST_PROFILE_LOCK_RELEASE_BARRIER_DIR\";\nconst TEST_LOCK_CLAIM_BARRIER_DIR = \"TC_TEST_PROFILE_LOCK_CLAIM_BARRIER_DIR\";\nconst TEST_LOCK_CLAIMED_BARRIER_DIR = \"TC_TEST_PROFILE_LOCK_CLAIMED_BARRIER_DIR\";\nconst TEST_LOCK_VERIFIED_BARRIER_DIR = \"TC_TEST_PROFILE_LOCK_VERIFIED_BARRIER_DIR\";\nconst TEST_LOCK_MOVED_BARRIER_DIR = \"TC_TEST_PROFILE_LOCK_MOVED_BARRIER_DIR\";\nconst TEST_LOCK_TURN_PUBLISH_BARRIER_DIR = \"TC_TEST_PROFILE_LOCK_TURN_PUBLISH_BARRIER_DIR\";\nconst TEST_LOCK_TURN_SETTLE_BARRIER_DIR = \"TC_TEST_PROFILE_LOCK_TURN_SETTLE_BARRIER_DIR\";\nconst TEST_LOCK_TURN_COLLECT_BARRIER_DIR = \"TC_TEST_PROFILE_LOCK_TURN_COLLECT_BARRIER_DIR\";\n/** One acquisition of a profile lock; `active` is cleared before release. */\ninterface HeldProfileLock {\n  readonly lockPath: string;\n  /** The number of the turn this acquisition holds (see acquireTurn). */\n  readonly turnSlot: number;\n  /** A deletion of the profile ran while this acquisition waited for the lock. */\n  readonly deletedWhileWaiting: boolean;\n  active: boolean;\n}\n/**\n * Async context shared by every copy of this module in the process. Each\n * bundled operations entry point (`state`, `delegation-binding`, the root)\n * carries its own copy, so module-level context would make lock reentrancy and\n * the invocation state root stop at an entry-point boundary.\n * Each key is independently versioned for the shape and meaning of the\n * value it stores. Held-lock entries gained `turnSlot` and\n * `deletedWhileWaiting` in TC-633, so `.v2` must not read TC-602's `.v1`\n * entries. The invocation root remains a string path with unchanged\n * semantics and stays `.v1`. Relinquished turn tokens use a separate\n * versioned process-wide key: only an explicitly given-up turn of this PID\n * may be settled across separately bundled entry points.\n */\nfunction processWideContext<T>(key: string): AsyncLocalStorage<T> {\n  const registry = globalThis as unknown as Record<symbol, AsyncLocalStorage<T> | undefined>;\n  return registry[Symbol.for(key)] ??= new AsyncLocalStorage<T>();\n}\nconst invocationStateRoot = processWideContext<string>(\"tinycloud.operations.invocationStateRoot.v1\");\n/** Profile lock acquisitions held by the current async call chain (see withProfileLock). */\nconst heldProfileLocks = processWideContext<readonly HeldProfileLock[]>(\"tinycloud.operations.heldProfileLocks.v2\");\n\nexport type ProfileStoreName =\n  | \"session\"\n  | \"additional-delegations\"\n  | \"auth-requests\";\n\nexport interface StoreMetadata {\n  formatVersion: number;\n}\n\nexport interface ProfileStoreContents<T> {\n  formatVersion: number;\n  records: T[];\n}\n\nexport interface ProfileLockOptions {\n  timeoutMs?: number;\n  retryMs?: number;\n  staleAfterMs?: number;\n  /**\n   * Lock only a profile that exists (its `profile.json` is present), and\n   * never create its directory: a missing or deleted profile is refused with\n   * ProfileDeletedError, before and after waiting for the lock. For writers\n   * of state that lives inside an existing profile (replicas).\n   */\n  requireProfile?: boolean;\n}\n\nexport class ProfileLockTimeoutError extends Error {\n  readonly code = \"PROFILE_LOCK_TIMEOUT\";\n\n  /** `detail` names the cause when it is not simply another process holding the lock. */\n  constructor(profile: string, timeoutMs: number, detail?: string) {\n    super(`Timed out waiting for the profile lock for \"${profile}\" after ${timeoutMs}ms.${detail ? ` ${detail}` : \"\"}`);\n    this.name = \"ProfileLockTimeoutError\";\n  }\n}\n\n/**\n * A store write that waited for the profile lock while a deletion of that\n * profile held it, and found no profile settings once it got the lock. The\n * write is refused rather than recreating a profile with only a session or\n * store in it.\n */\nexport class ProfileDeletedError extends Error {\n  readonly code = \"PROFILE_NOT_FOUND\";\n\n  constructor(profile: string) {\n    super(`Profile \"${profile}\" was deleted while this change waited for its lock, so the change was not written.`);\n    this.name = \"ProfileDeletedError\";\n  }\n}\n\n/**\n * The CLI's delegated-secret path treats TC_HOME as a home directory, rather\n * than a direct TinyCloud directory. Keep the shared store on that convention.\n */\nexport function tinycloudHomePath(): string {\n  const home = invocationStateRoot.getStore() ??\n    process.env.TC_HOME ??\n    process.env.HOME ??\n    process.env.USERPROFILE ??\n    homedir();\n  return join(home, \".tinycloud\");\n}\n\n/** Run one operation against an isolated TinyCloud home directory. */\nexport function withTinyCloudStateRoot<T>(\n  stateRoot: string | undefined,\n  action: () => Promise<T>,\n): Promise<T> {\n  if (stateRoot === undefined) return action();\n  if (!isAbsolute(stateRoot) || stateRoot.includes(\"\\0\")) {\n    throw new TypeError(\"The TinyCloud state root must be an absolute path.\");\n  }\n  return invocationStateRoot.run(resolve(stateRoot), action);\n}\n\nexport function tinycloudConfigPath(): string {\n  return join(tinycloudHomePath(), \"config.json\");\n}\n\nexport function profilesPath(): string {\n  return join(tinycloudHomePath(), \"profiles\");\n}\n\nexport function profilePath(profile: string): string {\n  return join(profilesPath(), validateProfileName(profile));\n}\n\nexport function profileConfigPath(profile: string): string {\n  return join(profilePath(profile), \"profile.json\");\n}\n\nexport function sessionPath(profile: string): string {\n  return profileStorePath(profile, \"session\");\n}\n\nexport function additionalDelegationsPath(profile: string): string {\n  return profileStorePath(profile, \"additional-delegations\");\n}\n\nexport function authRequestsPath(profile: string): string {\n  return profileStorePath(profile, \"auth-requests\");\n}\n\nexport function profileStorePath(profile: string, store: ProfileStoreName): string {\n  return join(profilePath(profile), `${store}.json`);\n}\n\n/** The format record is deliberately separate from each legacy JSON payload. */\nexport function profileStoreMetadataPath(profile: string, store: ProfileStoreName): string {\n  return `${profileStorePath(profile, store)}.metadata.json`;\n}\n\nexport function profileLockPath(profile: string): string {\n  return join(profilePath(profile), \".lock\");\n}\n\nexport function profileLockMetadataPath(profile: string): string {\n  return join(profileLockPath(profile), \"owner.json\");\n}\n\n/**\n * The turn lock of a profile (see acquireTurn). It lives outside the profile\n * directory, so neither a profile deletion nor an older release's cleanup\n * removes it.\n */\nexport function profileTurnLockPath(profile: string): string {\n  return join(tinycloudHomePath(), \"profile-locks\", validateProfileName(profile));\n}\n\n/**\n * Reads JSON without hiding malformed or inaccessible files. A missing file is\n * the only condition represented as null.\n */\nexport async function readJson<T>(filePath: string): Promise<T | null> {\n  try {\n    return JSON.parse(await readFile(filePath, \"utf8\")) as T;\n  } catch (error) {\n    if (isErrno(error, \"ENOENT\")) return null;\n    throw error;\n  }\n}\n\n/**\n * Writes the same pretty-printed, trailing-newline JSON shape used by the CLI,\n * but publishes it with an atomic rename from the same directory.\n */\nexport async function writeJsonAtomic(filePath: string, value: unknown): Promise<void> {\n  await replaceJson(filePath, value, false);\n}\n\n/**\n * writeJsonAtomic; `durable` also flushes the data to disk before the rename,\n * so a crash or power loss leaves the old record or the new one, never a\n * truncated one (for lock records, whose damage would stop every writer).\n */\nasync function replaceJson(filePath: string, value: unknown, durable: boolean): Promise<void> {\n  const directory = dirname(filePath);\n  const temporaryPath = join(\n    directory,\n    `.${basename(filePath)}.${process.pid}.${randomUUID()}.tmp`,\n  );\n  const contents = `${JSON.stringify(value, null, 2)}\\n`;\n\n  await mkdir(directory, { recursive: true, mode: PRIVATE_DIR_MODE });\n  try {\n    if (durable) await writeFileDurably(temporaryPath, contents);\n    else await writeFile(temporaryPath, contents, { encoding: \"utf8\", mode: PRIVATE_FILE_MODE });\n    await rename(temporaryPath, filePath);\n  } catch (error) {\n    await rm(temporaryPath, { force: true }).catch(() => undefined);\n    throw error;\n  }\n}\n\n/** Creates a file (exclusively) and, when it has contents, flushes them to disk. */\nasync function writeFileDurably(path: string, contents: string): Promise<void> {\n  const handle = await open(path, \"wx\", PRIVATE_FILE_MODE);\n  try {\n    if (contents) {\n      await handle.writeFile(contents, \"utf8\");\n      await handle.datasync();\n    }\n  } finally {\n    await handle.close();\n  }\n}\n\nexport async function readProfile<T extends object = Record<string, unknown>>(\n  profile: string,\n): Promise<T | null> {\n  return readJson<T>(profileConfigPath(profile));\n}\n\nexport async function readSession<T extends object = Record<string, unknown>>(\n  profile: string,\n): Promise<T | null> {\n  await readStoreMetadata(profile, \"session\");\n  return readJson<T>(sessionPath(profile));\n}\n\nexport async function readAdditionalDelegations<T = Record<string, unknown>>(\n  profile: string,\n): Promise<T[]> {\n  return (await readProfileStore<T>(profile, \"additional-delegations\")).records;\n}\n\nexport async function readAuthRequests<T = Record<string, unknown>>(\n  profile: string,\n): Promise<T[]> {\n  return (await readProfileStore<T>(profile, \"auth-requests\")).records;\n}\n\nexport async function readStoreMetadata(\n  profile: string,\n  store: ProfileStoreName,\n): Promise<StoreMetadata> {\n  const metadata = await readJson<StoreMetadata>(profileStoreMetadataPath(profile, store));\n  if (metadata === null) return { formatVersion: 1 };\n  if (\n    typeof metadata !== \"object\" ||\n    metadata.formatVersion !== 1\n  ) {\n    throw new TypeError(`Unsupported store format for \"${store}\".`);\n  }\n  return metadata;\n}\n\nexport async function readProfileStore<T>(\n  profile: string,\n  store: Exclude<ProfileStoreName, \"session\">,\n): Promise<ProfileStoreContents<T>> {\n  const [metadata, raw] = await Promise.all([\n    readStoreMetadata(profile, store),\n    readJson<unknown>(profileStorePath(profile, store)),\n  ]);\n  return {\n    formatVersion: metadata.formatVersion,\n    records: Array.isArray(raw) ? raw as T[] : [],\n  };\n}\n\n/**\n * Runs a small critical section under the one lock shared by all profile\n * stores (see acquireProfileLock). Lock release verifies its ownership token\n * before removing the exact metadata instance it acquired.\n *\n * Reentrant within one async call chain: a critical section that already\n * holds a profile's lock (for example a login's compare-and-commit) can call\n * store writers that take the same lock without deadlocking. Ownership is\n * keyed by the resolved lock path (so switching state roots inside a lock\n * still takes the other root's lock) and lasts exactly as long as the\n * acquisition: it is revoked before release, so work deferred past the\n * critical section waits for the lock like any other caller.\n */\nexport async function withProfileLock<T>(\n  profile: string,\n  action: () => Promise<T>,\n  options: ProfileLockOptions = {},\n): Promise<T> {\n  const normalizedProfile = validateProfileName(profile);\n  const lockPath = profileLockPath(normalizedProfile);\n  const held = (heldProfileLocks.getStore() ?? []).filter((ownership) => ownership.active);\n  if (held.some((ownership) => ownership.lockPath === lockPath)) return action();\n  const acquired = await acquireProfileLock(normalizedProfile, options);\n  const ownership: HeldProfileLock = {\n    lockPath,\n    turnSlot: acquired.turnSlot,\n    deletedWhileWaiting: acquired.deletedWhileWaiting,\n    active: true,\n  };\n  try {\n    return await heldProfileLocks.run([...held, ownership], action);\n  } finally {\n    ownership.active = false;\n    await acquired.release();\n    // Taking the lock recreated the deleted profile's directory; remove it\n    // again unless something was written into it (rmdir needs it empty).\n    if (acquired.deletedWhileWaiting) await rmdir(profilePath(normalizedProfile)).catch(() => undefined);\n  }\n}\n\n/**\n * Records, inside a profile deletion's critical section and after its files\n * are gone, that the profile was deleted, with the number of the deleting\n * turn. A store write whose wait overlapped that turn (it arrived before the\n * deletion released the lock, whether before or after this record) then\n * refuses (ProfileDeletedError) instead of recreating a profile with only a\n * session or store in it. The caller must hold the profile's lock.\n */\nexport async function recordProfileDeletion(profile: string): Promise<void> {\n  const lockPath = profileLockPath(profile);\n  const ownership = (heldProfileLocks.getStore() ?? []).find((candidate) => candidate.active && candidate.lockPath === lockPath);\n  if (!ownership) throw new Error(`Recording the deletion of profile \"${profile}\" requires holding its lock.`);\n  await replaceJson(join(profileTurnLockPath(profile), \"deleted.json\"), { slot: ownership.turnSlot }, true);\n}\n\n/**\n * Refuses a write that would recreate a profile deleted while this critical\n * section waited for the lock (ProfileDeletedError). Every writer of profile\n * state other than the profile settings themselves calls this inside its\n * critical section, before writing. The caller must hold the profile's lock.\n */\nexport async function refuseWriteToDeletedProfile(profile: string): Promise<void> {\n  const lockPath = profileLockPath(profile);\n  const ownership = (heldProfileLocks.getStore() ?? []).find((candidate) => candidate.active && candidate.lockPath === lockPath);\n  if (!ownership?.deletedWhileWaiting) return;\n  // Recreated meanwhile (or by this critical section): writing is fine.\n  if (await exists(profileConfigPath(profile))) return;\n  throw new ProfileDeletedError(profile);\n}\n\n/**\n * Appends a record or replaces the existing record with the supplied explicit\n * key. The extractor is supplied by the owning store so state.ts never needs\n * to know permission-request or delegation record shapes.\n */\nexport async function upsertProfileRecord<T>(\n  profile: string,\n  store: Exclude<ProfileStoreName, \"session\">,\n  key: string,\n  record: T,\n  getKey: (candidate: T) => string | undefined,\n  options: ProfileLockOptions = {},\n): Promise<T[]> {\n  if (!key) throw new TypeError(\"A non-empty record key is required.\");\n\n  return withProfileLock(profile, async () => {\n    await refuseWriteToDeletedProfile(profile);\n    const current = (await readProfileStore<T>(profile, store)).records;\n    const next = current.filter((candidate) => getKey(candidate) !== key);\n    next.push(record);\n    await writeJsonAtomic(profileStorePath(profile, store), next);\n    await writeFormatOneMetadata(profile, store);\n    return next;\n  }, options);\n}\n\n/**\n * Performs a typed read-modify-write of a legacy array store under the one\n * per-profile lock. The payload stays an array and the sibling metadata stays\n * format 1, so existing CLI readers keep their byte/layout contract.\n */\nexport async function updateProfileStore<T, Result>(\n  profile: string,\n  store: Exclude<ProfileStoreName, \"session\">,\n  update: (\n    records: readonly T[],\n  ) => Promise<{ readonly records: readonly T[]; readonly result: Result }> | {\n    readonly records: readonly T[];\n    readonly result: Result;\n  },\n  options: ProfileLockOptions = {},\n): Promise<Result> {\n  return withProfileLock(\n    profile,\n    () => updateProfileStoreWhileLocked(profile, store, update),\n    options,\n  );\n}\n\n/** The caller must already own this profile's lock. */\nasync function updateProfileStoreWhileLocked<T, Result>(\n  profile: string,\n  store: Exclude<ProfileStoreName, \"session\">,\n  update: (\n    records: readonly T[],\n  ) => Promise<{ readonly records: readonly T[]; readonly result: Result }> | {\n    readonly records: readonly T[];\n    readonly result: Result;\n  },\n): Promise<Result> {\n  await refuseWriteToDeletedProfile(profile);\n  const current = await readProfileStore<T>(profile, store);\n  const next = await update(current.records);\n  await writeJsonAtomic(profileStorePath(profile, store), next.records);\n  await writeFormatOneMetadata(profile, store);\n  return next.result;\n}\n\nexport async function writeSession<T extends object>(\n  profile: string,\n  session: T,\n  options: ProfileLockOptions = {},\n): Promise<void> {\n  await withProfileLock(profile, async () => {\n    await refuseWriteToDeletedProfile(profile);\n    await readStoreMetadata(profile, \"session\");\n    await writeJsonAtomic(sessionPath(profile), session);\n    await writeFormatOneMetadata(profile, \"session\");\n  }, options);\n}\n\nexport async function removeSession(\n  profile: string,\n  options: ProfileLockOptions = {},\n): Promise<void> {\n  await withProfileLock(profile, async () => {\n    await readStoreMetadata(profile, \"session\");\n    await rm(sessionPath(profile), { force: true });\n  }, options);\n}\n\nasync function writeFormatOneMetadata(profile: string, store: ProfileStoreName): Promise<void> {\n  await writeJsonAtomic(profileStoreMetadataPath(profile, store), { formatVersion: 1 });\n}\n\ninterface AcquiredProfileLock {\n  readonly deletedWhileWaiting: boolean;\n  readonly turnSlot: number;\n  release(): Promise<void>;\n}\n\ninterface LockDeadline {\n  readonly startedAt: number;\n  readonly timeoutMs: number;\n  readonly retryMs: number;\n}\n\n/**\n * Takes a profile's lock in two layers:\n *\n * 1. The turn lock (acquireTurn), used by this release and later ones. It\n *    decides nothing from elapsed time, so a process paused anywhere, for\n *    any length of time, cannot let a second holder in.\n * 2. Holding a turn, the `.lock` directory every older release uses\n *    (publishProfileLock), so they keep excluding this release and it them.\n *    Only one process of this release at a time acquires, recovers or\n *    releases `.lock`.\n *\n * Also reports whether a profile deletion (recordProfileDeletion) ran while\n * this acquisition waited.\n */\nasync function acquireProfileLock(\n  profile: string,\n  options: ProfileLockOptions,\n): Promise<AcquiredProfileLock> {\n  const deadline: LockDeadline = {\n    startedAt: Date.now(),\n    timeoutMs: options.timeoutMs ?? DEFAULT_LOCK_TIMEOUT_MS,\n    retryMs: options.retryMs ?? DEFAULT_LOCK_RETRY_MS,\n  };\n  const staleAfterMs = options.staleAfterMs ?? DEFAULT_STALE_LOCK_MS;\n  const lockPath = profileLockPath(profile);\n  const turnDirectory = profileTurnLockPath(profile);\n\n  const directory = profilePath(profile);\n  if (options.requireProfile && !(await exists(profileConfigPath(profile)))) throw new ProfileDeletedError(profile);\n  if (!options.requireProfile) await mkdir(directory, { recursive: true, mode: PRIVATE_DIR_MODE });\n  await mkdir(dirname(turnDirectory), { recursive: true, mode: PRIVATE_DIR_MODE });\n  // Every store write takes this lock: tighten the tree older releases\n  // created 0775 before writing sessions or delegations into it.\n  for (const path of [tinycloudHomePath(), profilesPath(), directory]) {\n    await chmod(path, PRIVATE_DIR_MODE).catch((error: unknown) => {\n      // A profile deletion can remove the profile directory right after the\n      // mkdir above; the lock attempt below recreates it 0700.\n      if (path !== directory || !isErrno(error, \"ENOENT\")) throw error;\n    });\n  }\n\n  const { turn, firstWaitedTurn } = await acquireTurn(profile, turnDirectory, deadline);\n  try {\n    // Holding the turn, no deletion runs: a profile present now stays until release.\n    if (options.requireProfile && !(await exists(profileConfigPath(profile)))) {\n      // A deletion that finished while this waited could not remove the\n      // directory if a lock was held then; remove it if empty.\n      await rmdir(directory).catch(() => undefined);\n      throw new ProfileDeletedError(profile);\n    }\n    // An unreadable deletion record is ignored rather than failing every\n    // acquisition; it is written durably, so only damage makes it so.\n    const deletion = await readJson<{ slot?: unknown }>(join(turnDirectory, \"deleted.json\")).catch(() => null);\n    const deletedWhileWaiting = typeof deletion?.slot === \"number\" && deletion.slot >= firstWaitedTurn;\n    while (true) {\n      const token = randomUUID();\n      if (await publishProfileLock(profile, lockPath, token, options.requireProfile === true)) {\n        return {\n          deletedWhileWaiting,\n          turnSlot: turn.slot,\n          release: async () => {\n            try {\n              await releaseProfileLock(profile, lockPath, token);\n            } finally {\n              await releaseTurn(profile, turn);\n            }\n          },\n        };\n      }\n      await signalTestLockContention(profile);\n      if (await recoverStaleLock(profile, lockPath, staleAfterMs)) continue;\n      await waitOrTimeOut(profile, deadline);\n    }\n  } catch (error) {\n    await releaseTurn(profile, turn);\n    throw error;\n  }\n}\n\n/** Throws once the acquisition's time is up; `detail` explains a damaged turn lock. */\nfunction checkDeadline(profile: string, deadline: LockDeadline, detail?: string): void {\n  if (Date.now() - deadline.startedAt >= deadline.timeoutMs) {\n    throw new ProfileLockTimeoutError(profile, deadline.timeoutMs, detail);\n  }\n}\n\n/** Sleeps one retry interval, or throws once the acquisition's time is up. */\nasync function waitOrTimeOut(profile: string, deadline: LockDeadline, detail?: string): Promise<void> {\n  checkDeadline(profile, deadline, detail);\n  await sleep(Math.min(deadline.retryMs, deadline.timeoutMs - (Date.now() - deadline.startedAt)));\n}\n\n/** One granted turn of the turn lock. */\ninterface Turn {\n  readonly directory: string;\n  readonly slot: number;\n  readonly token: string;\n}\n\n/** A turn as recorded on disk. */\ninterface TurnState {\n  readonly slot: number;\n  readonly token: string;\n  readonly pid: number;\n  /** The token of the turn before it that its creator observed; null for turn 0. */\n  readonly after: string | null;\n  readonly held: boolean;\n  readonly done: boolean;\n}\n\n/** Turn directory names: decimal turn numbers. */\nconst TURN = /^(?:0|[1-9][0-9]*)$/;\n\n/**\n * Tokens of turns this process published and then gave up (a marker write or\n * a read failed after publication): the positive evidence that lets this\n * process settle a turn of its own PID. A live process's turn that is not in\n * here is never settled by it, so a module instance that cannot see another\n * instance's set (another bundled copy of this package) waits rather than\n * settling a turn that copy still holds.\n *\n * One set per process, not per module instance: the package's entry points\n * (state, index, artifacts, cli-runtime; ESM and CJS) each bundle their own\n * copy of this module, and one process may load several. The key is\n * versioned so that a release changing what the set holds uses a new one.\n */\nconst relinquishedTurns: Set<string> =\n  (globalThis as unknown as Record<symbol, Set<string> | undefined>)[Symbol.for(\"tinycloud.operations.relinquishedProfileTurns.v1\")] ??=\n    new Set<string>();\n\n/** Marker writes are retried this many times, after these delays (ms), before giving up. */\nconst MARKER_RETRY_DELAYS_MS = [10, 50, 250];\n/** A given-up turn is settled in the background every second for up to five minutes. */\nconst SETTLE_RETRY_MS = 1_000;\nconst SETTLE_RETRIES = 300;\n\n/**\n * The turn lock: mutual exclusion among processes of this release that does\n * not depend on how long any of them is paused. It uses only `mkdir`,\n * `rename`, exclusive file creation, and a check that a holder's PID is gone\n * (as `.lock` recovery always has), so it needs no hard links.\n *\n * Turns are numbered directories in profileTurnLockPath(profile). Turn n has\n * `owner.json` ({ pid, createdAt, token, after }), where `after` is the token\n * of the turn n-1 its creator observed, and gains `<token>.held` when granted\n * and `<token>.done` when over. Markers name the turn's own token, so one\n * written late into a recreated directory of the same number means nothing.\n *\n * - A turn is published by renaming a fully written staging directory to\n *   `n`, which fails while `n` exists (rename never replaces a non-empty\n *   directory, and turn directories are never empty). The turn directory\n *   itself is published the same way, with a granted, finished turn 0.\n * - A process takes turn n only after reading turn n-1 granted and done.\n *   Once `n` is published it checks that turn n-1 is still the one it read\n *   (same token, granted, done) and only then writes `held`; otherwise the\n *   turn is void: it writes `done` alone and starts over.\n * - Turns are removed by renaming them aside: a void turn at any time, a\n *   granted one only once no older turn is left and turn n+1 is granted and\n *   done. The latest turn is never removed.\n *\n * Why at most one granted turn is ever not done: a removed number can be\n * published again, but turn n-1 is always removed before turn n, so a\n * process whose stale read led it to republish n finds n-1 gone or holding\n * another token, and its turn is void. A process that finds n-1 as it read\n * it published `n` for the first time, so it is the only process granted n,\n * and n-1 was done before. A turn is marked done only by its holder, or by\n * another process once the holder's PID is gone (or by its own process,\n * once it has explicitly given that turn up); a paused holder is alive.\n * A turn is voided only on definite evidence (the turn it follows is gone or\n * holds another token), never because a read failed. Nothing above is\n * decided from elapsed time.\n *\n * Returns the turn and the number of the first turn this acquisition waited\n * on: the latest turn when it first looked if that was not done yet, else\n * the next one.\n */\nasync function acquireTurn(\n  profile: string,\n  directory: string,\n  deadline: LockDeadline,\n): Promise<{ turn: Turn; firstWaitedTurn: number }> {\n  let firstWaitedTurn: number | undefined;\n  // Why the turn lock looks damaged, as of the last look, for the timeout message.\n  let problem: string | undefined;\n  const damaged = (what: string) =>\n    `The turn lock ${directory} ${what}, so no process can take it. ` +\n    `If no tc or MCP process is using profile \"${profile}\", remove that directory.`;\n  for (let first = true; ; first = false) {\n    if (!first) checkDeadline(profile, deadline, problem);\n    problem = undefined;\n    const latest = await readLatestTurn(directory);\n    if (latest === \"missing\") {\n      await createTurnDirectory(directory);\n      continue;\n    }\n    if (latest === \"empty\") {\n      // Usually a listing that straddled a turn's publication and an older\n      // turn's removal (readdir is not a snapshot); damaged if it persists.\n      problem = damaged(\"has no turns\");\n      await waitOrTimeOut(profile, deadline, problem);\n      continue;\n    }\n    if (latest === null) continue;\n    if (typeof latest === \"number\") {\n      problem = damaged(`has an unreadable turn ${latest}`);\n      await waitOrTimeOut(profile, deadline, problem);\n      continue;\n    }\n    firstWaitedTurn ??= latest.done ? latest.slot + 1 : latest.slot;\n    if (latest.held && latest.done) {\n      const turn = await takeTurn(profile, directory, latest);\n      if (turn !== null) return { turn, firstWaitedTurn };\n      await waitOrTimeOut(profile, deadline);\n    } else if (latest.done) {\n      problem = damaged(`ends with turn ${latest.slot}, which was never granted`);\n      await waitOrTimeOut(profile, deadline, problem);\n    } else if (latest.pid === process.pid ? relinquishedTurns.has(latest.token) : !isProcessAlive(latest.pid)) {\n      await waitForTestBarrier(TEST_LOCK_TURN_SETTLE_BARRIER_DIR, profile);\n      await settleAbandonedTurn(directory, latest);\n      relinquishedTurns.delete(latest.token);\n    } else {\n      await signalTestLockContention(profile);\n      await waitOrTimeOut(profile, deadline);\n    }\n  }\n}\n\n/**\n * The highest-numbered turn: its state, its number if it is damaged, null if\n * it went away while being read.\n */\nasync function readLatestTurn(directory: string): Promise<TurnState | number | \"missing\" | \"empty\" | null> {\n  let names: string[];\n  try {\n    names = await readdir(directory);\n  } catch (error) {\n    if (isErrno(error, \"ENOENT\")) return \"missing\";\n    throw error;\n  }\n  const slots = names.filter((name) => TURN.test(name)).map(Number);\n  if (slots.length === 0) return \"empty\";\n  const slot = Math.max(...slots);\n  const turn = await readTurn(directory, slot);\n  return turn === \"damaged\" ? slot : turn;\n}\n\n/**\n * Turn `slot` as recorded now; null if it is gone; \"damaged\" if its owner\n * record is missing or unreadable (turns are renamed into place and aside\n * whole, with their owner record written durably). Any other read error is\n * thrown: it says nothing about the turn. `done` is read before `held`,\n * which every writer creates first, so a turn read as done is never misread\n * as void.\n */\nasync function readTurn(directory: string, slot: number): Promise<TurnState | \"damaged\" | null> {\n  const path = join(directory, String(slot));\n  let text: string;\n  try {\n    text = await readFile(join(path, \"owner.json\"), \"utf8\");\n  } catch (error) {\n    if (!isErrno(error, \"ENOENT\") && !isErrno(error, \"ENOTDIR\")) throw error;\n    return await exists(path) ? \"damaged\" : null;\n  }\n  let owner: { pid?: unknown; token?: unknown; after?: unknown } | null;\n  try {\n    owner = JSON.parse(text) as typeof owner;\n  } catch {\n    return \"damaged\";\n  }\n  if (owner === null || typeof owner !== \"object\" || typeof owner.token !== \"string\" || typeof owner.pid !== \"number\") {\n    return \"damaged\";\n  }\n  const done = await exists(join(path, `${owner.token}.done`));\n  const held = await exists(join(path, `${owner.token}.held`));\n  return {\n    slot,\n    token: owner.token,\n    pid: owner.pid,\n    after: typeof owner.after === \"string\" ? owner.after : null,\n    held,\n    done,\n  };\n}\n\n/**\n * Whether turn `slot` is still the granted, finished turn with `token`. False\n * only on definite evidence: it is gone, or holds another token. Throws if it\n * cannot be read, or is damaged, so the caller leaves its own turn undecided.\n */\nasync function isFinishedTurn(directory: string, slot: number, token: string): Promise<boolean> {\n  const turn = await readTurn(directory, slot);\n  if (turn === \"damaged\") throw new Error(`Turn ${slot} of the turn lock ${directory} is unreadable.`);\n  return turn !== null && turn.token === token && turn.held && turn.done;\n}\n\n/**\n * Publishes the turn after `latest` and claims it. Null if another process\n * published that number first, or the turn is void. If a step after\n * publication fails, the turn is handed to settleOwnTurn and the error thrown.\n */\nasync function takeTurn(profile: string, directory: string, latest: TurnState): Promise<Turn | null> {\n  const token = randomUUID();\n  const slot = latest.slot + 1;\n  const path = join(directory, String(slot));\n  const owner = { pid: process.pid, createdAt: new Date().toISOString(), token, after: latest.token };\n  let published = false;\n  try {\n    published = await publishDirectory(\n      join(directory, `.stage-${process.pid}-${token}`),\n      path,\n      { \"owner.json\": `${JSON.stringify(owner, null, 2)}\\n` },\n      () => waitForTestBarrier(TEST_LOCK_TURN_PUBLISH_BARRIER_DIR, profile),\n    );\n    if (published && await isFinishedTurn(directory, latest.slot, latest.token) && await markTurn(path, token, \"held\")) {\n      return { directory, slot, token };\n    }\n    if (published) await markTurn(path, token, \"done\");\n    return null;\n  } catch (error) {\n    if (published) settleOwnTurn(directory, slot, token);\n    throw error;\n  }\n}\n\n/**\n * Finishes the turn of a process that is gone (or one this process gave up).\n * A turn its creator never got to grant is granted first if the turn before\n * it is still the one its creator read (the check the creator would have\n * made; that turn cannot have been removed, since that needs this turn\n * done), and left void only if it definitely is not.\n */\nasync function settleAbandonedTurn(directory: string, abandoned: TurnState): Promise<void> {\n  const path = join(directory, String(abandoned.slot));\n  if (!abandoned.held && abandoned.after !== null &&\n    await isFinishedTurn(directory, abandoned.slot - 1, abandoned.after)) {\n    await markTurn(path, abandoned.token, \"held\");\n  }\n  await markTurn(path, abandoned.token, \"done\");\n}\n\n/**\n * Settles a turn this process published but could not grant or finish (a\n * marker write or a read failed). Other processes wait on this live PID, so\n * it is retried in the background until it succeeds or the turn is settled\n * otherwise (by this process's next acquisition, or by another process once\n * this one has exited). The timer does not keep the process alive.\n */\nfunction settleOwnTurn(directory: string, slot: number, token: string, retries = SETTLE_RETRIES): void {\n  relinquishedTurns.add(token);\n  void (async () => {\n    try {\n      const turn = await readTurn(directory, slot);\n      if (turn !== null && turn !== \"damaged\" && turn.token === token && !turn.done) await settleAbandonedTurn(directory, turn);\n      relinquishedTurns.delete(token);\n    } catch {\n      // Still relinquished: this process's next acquisition settles it too.\n      if (retries > 0) setTimeout(() => settleOwnTurn(directory, slot, token, retries - 1), SETTLE_RETRY_MS).unref();\n    }\n  })();\n}\n\n/**\n * Creates `<token>.<kind>` in a turn directory; false if the directory is\n * gone. Other failures (a full disk, a permission error) are retried a few\n * times, then thrown.\n */\nasync function markTurn(path: string, token: string, kind: \"held\" | \"done\"): Promise<boolean> {\n  for (let attempt = 0; ; attempt++) {\n    try {\n      await writeFile(join(path, `${token}.${kind}`), \"\", { mode: PRIVATE_FILE_MODE, flag: \"wx\" });\n      return true;\n    } catch (error) {\n      if (isErrno(error, \"EEXIST\")) return true;\n      if (isErrno(error, \"ENOENT\")) return false;\n      if (attempt >= MARKER_RETRY_DELAYS_MS.length) throw error;\n      await sleep(MARKER_RETRY_DELAYS_MS[attempt]!);\n    }\n  }\n}\n\n/** Creates the turn directory with a granted, finished turn 0, unless another process did. */\nasync function createTurnDirectory(directory: string): Promise<void> {\n  const token = randomUUID();\n  const owner = { pid: process.pid, createdAt: new Date().toISOString(), token, after: null };\n  await publishDirectory(join(dirname(directory), `.stage-${basename(directory)}-${process.pid}-${token}`), directory, {\n    \"0/owner.json\": `${JSON.stringify(owner, null, 2)}\\n`,\n    [`0/${token}.held`]: \"\",\n    [`0/${token}.done`]: \"\",\n  });\n}\n\n/**\n * Writes `files` (durably, when not empty) into a new staging directory and\n * renames it to `target`. False if `target` already exists (or the turn\n * directory is gone); the caller starts over. Nothing else removes a live\n * process's staging directory (see collectTurns), so `target` never appears\n * incomplete.\n */\nasync function publishDirectory(\n  stage: string,\n  target: string,\n  files: Readonly<Record<string, string>>,\n  beforeRename?: () => Promise<void>,\n): Promise<boolean> {\n  try {\n    for (const [name, contents] of Object.entries(files)) {\n      await mkdir(dirname(join(stage, name)), { recursive: true, mode: PRIVATE_DIR_MODE });\n      await writeFileDurably(join(stage, name), contents);\n    }\n    await beforeRename?.();\n    await rename(stage, target);\n    return true;\n  } catch (error) {\n    // ENOTEMPTY/EEXIST: `target` exists, though it may be gone again by now.\n    // Windows reports an existing target directory as EPERM.\n    if ([\"ENOTEMPTY\", \"EEXIST\", \"ENOENT\"].some((code) => isErrno(error, code)) || await exists(target)) return false;\n    throw error;\n  } finally {\n    await rm(stage, { recursive: true, force: true }).catch(() => undefined);\n  }\n}\n\n/**\n * Finishes this process's turn. If `done` cannot be written even after\n * retries, the critical section is still over and its writes stand: the turn\n * is handed to settleOwnTurn rather than failing the caller.\n */\nasync function releaseTurn(profile: string, turn: Turn): Promise<void> {\n  try {\n    await markTurn(join(turn.directory, String(turn.slot)), turn.token, \"done\");\n  } catch {\n    settleOwnTurn(turn.directory, turn.slot, turn.token);\n    return;\n  }\n  await collectTurns(profile, turn).catch(() => undefined);\n}\n\n/**\n * Leftovers in a turn directory whose writer is gone: trash (a removed turn\n * renamed aside, garbage from then on), and staging directories and\n * deletion-record temporaries named after their writer's PID.\n */\nfunction isAbandonedTurnEntry(name: string): boolean {\n  if (name.startsWith(\".trash-\")) return true;\n  const writer = /^\\.(?:stage|deleted\\.json)[-.]([0-9]+)[-.]/.exec(name)?.[1];\n  return writer !== undefined && !isProcessAlive(Number(writer));\n}\n\n/** A turn directory's staging directory left beside it by a process that is gone. */\nfunction isAbandonedTurnDirectoryStage(name: string): boolean {\n  const writer = /^\\.stage-.+-([0-9]+)-[0-9a-f]{8}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{12}$/.exec(name)?.[1];\n  return writer !== undefined && !isProcessAlive(Number(writer));\n}\n\n/**\n * Removes the turns before `turn`, which just finished: void turns, and\n * granted ones oldest first, each once no older turn is left and the next is\n * granted and done (see acquireTurn). A turn is renamed aside before it is\n * deleted, so its number is never an empty directory. A turn that is damaged\n * or cannot be read is left alone, and a read error stops the collection.\n * Leftovers of crashed processes go too, judged by PID, never by age:\n * removing a paused process's staging directory could publish an incomplete\n * turn.\n */\nasync function collectTurns(profile: string, turn: Turn): Promise<void> {\n  for (const [directory, abandoned] of [\n    [turn.directory, isAbandonedTurnEntry],\n    [dirname(turn.directory), isAbandonedTurnDirectoryStage],\n  ] as const) {\n    for (const name of (await readdir(directory)).filter(abandoned)) {\n      await rm(join(directory, name), { recursive: true, force: true }).catch(() => undefined);\n    }\n  }\n  const older = (await readdir(turn.directory)).filter((name) => TURN.test(name)).map(Number)\n    .filter((slot) => slot < turn.slot)\n    .sort((left, right) => left - right);\n  for (const slot of older) {\n    const candidate = await readTurn(turn.directory, slot);\n    if (candidate === null || candidate === \"damaged\" || !candidate.done) continue;\n    if (candidate.held) {\n      if (await exists(join(turn.directory, String(slot - 1)))) continue;\n      const next = await readTurn(turn.directory, slot + 1);\n      if (next === null || next === \"damaged\" || !next.held || !next.done) continue;\n    }\n    await waitForTestBarrier(TEST_LOCK_TURN_COLLECT_BARRIER_DIR, profile);\n    const trash = join(turn.directory, `.trash-${randomUUID()}`);\n    if (await rename(join(turn.directory, String(slot)), trash).then(() => true, () => false)) {\n      await rm(trash, { recursive: true, force: true }).catch(() => undefined);\n    }\n  }\n}\n\n/**\n * One attempt to take `.lock`, made while holding a turn. Nothing here\n * replaces an existing path:\n *\n * 1. `mkdir(.lock)` (never recursive) is exclusive, and is the primitive\n *    older releases use too, so they exclude each other.\n * 2. Ownership is published by `link`ing a fully written owner file (staged\n *    beside `.lock`, on the same filesystem) to `.lock/owner.json`. `link`\n *    fails with EEXIST if an owner exists, and with ENOENT if the directory\n *    was removed meanwhile (an aged ownerless-lock reclaim by an older\n *    release). Only a successful link holds the lock; on either failure\n *    nothing is released, since nothing was acquired, and the caller retries.\n *    On a filesystem without hard links (FAT/exFAT, some SMB mounts) the\n *    owner file is created in place with an exclusive create instead, with\n *    the same EEXIST/ENOENT outcomes. A reader may then briefly see it\n *    incomplete; every release treats an owner file it cannot parse as a\n *    held lock, and this release removes one only once it has aged (see\n *    isAbandonedOwner).\n *\n * A profile deletion removes the profile directory once it has released its\n * lock, so `mkdir(.lock)` can see ENOENT; the directory is recreated (0700)\n * and the caller retries within its deadline, as for a first write to a new\n * profile.\n *\n * Only one owner.json can exist at the lock path, and it is removed only by\n * its holder's release or by recovery of an abandoned holder, so at most one\n * process holds the lock. Returns false when the lock is not acquired.\n */\nasync function publishProfileLock(profile: string, lockPath: string, token: string, requireProfile: boolean): Promise<boolean> {\n  try {\n    await mkdir(lockPath, { mode: PRIVATE_DIR_MODE });\n  } catch (error) {\n    if (isErrno(error, \"EEXIST\")) return false;\n    if (!isErrno(error, \"ENOENT\")) throw error;\n    // With requireProfile only an older release's deletion (which takes no turn) gets here.\n    if (requireProfile) throw new ProfileDeletedError(profile);\n    await mkdir(profilePath(profile), { recursive: true, mode: PRIVATE_DIR_MODE });\n    return false;\n  }\n  await waitForTestBarrier(TEST_LOCK_PUBLISH_BARRIER_DIR, profile);\n  const ownerPath = join(lockPath, \"owner.json\");\n  const staged = join(dirname(lockPath), `.lock-owner-${token}.tmp`);\n  const owner = `${JSON.stringify({ pid: process.pid, createdAt: new Date().toISOString(), token }, null, 2)}\\n`;\n  try {\n    await writeFile(staged, owner, { encoding: \"utf8\", mode: PRIVATE_FILE_MODE, flag: \"wx\" });\n    try {\n      await link(staged, ownerPath);\n    } catch (error) {\n      if (!lacksHardLinks(error)) throw error;\n      await writeFile(ownerPath, owner, { encoding: \"utf8\", mode: PRIVATE_FILE_MODE, flag: \"wx\" });\n    }\n    return true;\n  } catch (error) {\n    if (isErrno(error, \"EEXIST\") || isErrno(error, \"ENOENT\")) return false;\n    // Do not leave an ownerless lock behind for others to wait out. rmdir\n    // removes only an empty directory; anyone who created it after ours went\n    // away sees ENOENT on link and retries.\n    await rmdir(lockPath).catch(() => undefined);\n    throw error;\n  } finally {\n    await rm(staged, { force: true }).catch(() => undefined);\n  }\n}\n\n/**\n * Errors `link` reports on a filesystem without hard links: EPERM (Linux\n * FAT/exFAT), ENOTSUP/EOPNOTSUPP (macOS FAT/exFAT, SMB), ENOSYS, EISDIR\n * (libuv's code for Windows' ERROR_INVALID_FUNCTION on FAT32), and EMLINK\n * (too many links), for which the same fallback is just as correct.\n */\nconst NO_HARD_LINK_ERRORS = new Set([\"EPERM\", \"ENOTSUP\", \"EOPNOTSUPP\", \"ENOSYS\", \"EISDIR\", \"EMLINK\"]);\n\nfunction lacksHardLinks(error: unknown): boolean {\n  return typeof error === \"object\" && error !== null && \"code\" in error &&\n    NO_HARD_LINK_ERRORS.has(String((error as { code?: unknown }).code));\n}\n\n/**\n * Releases the lock if `.lock/owner.json` is still this acquisition's. No\n * one else can put an owner record there while it exists (owners are only\n * published into a directory their own `mkdir` created, and recovery\n * removes only an abandoned holder's record), so the record read is the one\n * unlinked.\n */\nasync function releaseProfileLock(profile: string, lockPath: string, token: string): Promise<void> {\n  const ownerPath = join(lockPath, \"owner.json\");\n  const owner = await readJson<{ token?: unknown }>(ownerPath).catch(() => null);\n  if (owner?.token !== token) return;\n  await rm(ownerPath, { force: true });\n  // `.lock` is empty from here until the rmdir; a contender that removes it\n  // and creates its own meanwhile is not harmed: rmdir fails on its owner\n  // file, or the contender's link sees ENOENT and retries. If a recoverer's\n  // claim file is still inside, rmdir fails and that recoverer removes the\n  // directory when it drops its claim.\n  await waitForTestBarrier(TEST_LOCK_RELEASE_BARRIER_DIR, profile);\n  await rmdir(lockPath).catch(() => undefined);\n}\n\n/**\n * Gives process-level contention tests an event-driven witness that a second\n * writer has reached an already-held lock. This deliberately has no effect\n * outside an explicit test environment, and only creates a new signal file\n * beneath TC_HOME; it never changes lock acquisition or release semantics.\n */\nasync function signalTestLockContention(profile: string): Promise<void> {\n  if (process.env.NODE_ENV !== \"test\") return;\n\n  const configuredPath = process.env[TEST_LOCK_CONTENTION_SIGNAL_PATH];\n  const configuredHome = process.env.TC_HOME;\n  if (!configuredPath || !configuredHome) return;\n\n  const home = resolve(configuredHome);\n  const signalPath = resolve(configuredPath);\n  const pathFromHome = relative(home, signalPath);\n  if (\n    pathFromHome === \"\" ||\n    pathFromHome === \"..\" ||\n    pathFromHome.startsWith(`..${process.platform === \"win32\" ? \"\\\\\" : \"/\"}`) ||\n    pathFromHome.startsWith(\"../\") ||\n    pathFromHome.startsWith(\"..\\\\\")\n  ) {\n    return;\n  }\n\n  await writeFile(signalPath, `${profile}\\n`, { encoding: \"utf8\", flag: \"wx\" })\n    .catch(() => undefined);\n}\n\n/**\n * Reclaims a `.lock` with no owner record, while holding a turn. A\n * `.recover-*` claim may contain a live legacy owner's record moved by a\n * no-hard-links recoverer just before it crashed. Restore that record first;\n * only orphaned claims holding dead or malformed records can be removed.\n * Otherwise the directory must be older than the stale threshold: one left\n * by a crash, or by an older release, whose `.stale-*` / `.release-*` claim\n * files are removed too. owner.json is never unlinked, and the directory\n * itself is only `rmdir`ed, which succeeds only while it is empty.\n *\n * Holding a turn, no other process of this release reclaims concurrently.\n * That closes the race in which two reclaimers' age checks let the later one\n * remove a directory a 1.0.0-beta.16-or-older release had just created,\n * which holds the lock from its `mkdir`. That race remains only if a\n * 1.0.0-beta.17 … 1.0.1-beta.4 release reclaims at the same moment, or the\n * older process stays paused between its `mkdir` and its owner write for\n * longer than the stale threshold; recoveryFenced bounds how stale this\n * process's age check can be.\n */\nasync function recoverOwnerlessLock(profile: string, lockPath: string, staleAfterMs: number): Promise<boolean> {\n  let aged: boolean;\n  try {\n    const { mtimeMs } = await stat(lockPath);\n    aged = Date.now() - mtimeMs >= staleAfterMs;\n  } catch {\n    return false;\n  }\n  const checkedAt = performance.now();\n  await waitForTestBarrier(TEST_LOCK_OWNERLESS_BARRIER_DIR, profile);\n  try {\n    const entries = await readdir(lockPath);\n    if (entries.includes(\"owner.json\")) return false;\n    const onlyOrphanedClaims = entries.length > 0 && entries.every((entry) => RECOVERY_CLAIM.test(entry));\n    if (!onlyOrphanedClaims && (!aged || recoveryFenced(checkedAt, staleAfterMs))) return false;\n    for (const name of entries.filter((entry) => RECOVERY_CLAIM.test(entry))) {\n      const claimPath = join(lockPath, name);\n      if (await hasLiveRecoveryOwner(claimPath)) {\n        // The claim keeps the directory in place. Only the original mkdir\n        // owner could publish owner.json here; never overwrite that record.\n        if (!await exists(join(lockPath, \"owner.json\"))) await rename(claimPath, join(lockPath, \"owner.json\"));\n        return false;\n      }\n      await rm(claimPath, { force: true });\n    }\n    for (const name of entries.filter((entry) => ABANDONED_CLAIM.test(entry))) {\n      await rm(join(lockPath, name), { force: true });\n    }\n    await rmdir(lockPath);\n  } catch {\n    return false;\n  }\n  await removeAgedOwnerFiles(lockPath, staleAfterMs);\n  return true;\n}\n\n/** A no-hard-links claim may contain a live owner's record moved before a crash. */\nasync function hasLiveRecoveryOwner(claimPath: string): Promise<boolean> {\n  let contents: string;\n  try {\n    contents = await readFile(claimPath, \"utf8\");\n  } catch (error) {\n    if (isErrno(error, \"ENOENT\")) return false;\n    throw error; // An I/O failure is not evidence that the holder is gone.\n  }\n  let owner: unknown;\n  try {\n    owner = JSON.parse(contents);\n  } catch {\n    return false;\n  }\n  const pid = typeof owner === \"object\" && owner !== null && \"pid\" in owner ? owner.pid : null;\n  return typeof pid === \"number\" && Number.isInteger(pid) && pid > 0 && isProcessAlive(pid);\n}\n\n/**\n * Whether an ownerless-reclaim decision made at `since` (a monotonic\n * timestamp) is too old to act on. The age check is only good for a while:\n * past half the stale threshold the reclaim starts over.\n */\nfunction recoveryFenced(since: number, staleAfterMs: number): boolean {\n  return performance.now() - since >= staleAfterMs / 2;\n}\n\n/** Claim files of older releases' stale recovery and (up to 1.0.0-beta.16) release. */\nconst ABANDONED_CLAIM = /^\\.(?:release|stale)-[0-9a-f-]+\\.json$/;\n/**\n * Claim files of this release's stale recovery. Releases up to 1.0.1-beta.4\n * never remove them, which is what makes this recovery safe against them; a\n * recoverer that crashes leaves one that only a release with the turn lock\n * clears (see REFERENCE.md, \"Profile lock\").\n */\nconst RECOVERY_CLAIM = /^\\.recover-[0-9a-f-]+\\.json$/;\n/** Owner files staged by publishProfileLock beside `.lock`. */\nconst STAGED_OWNER = /^\\.lock-owner-[0-9a-f-]+\\.tmp$/;\n/**\n * Removes owner files a crashed acquirer staged beside `.lock`. A live\n * acquirer's staged file exists only for its write and link, so only files\n * older than the stale threshold are removed. Runs after a recovery, never\n * on the uncontended path.\n */\nasync function removeAgedOwnerFiles(lockPath: string, staleAfterMs: number): Promise<void> {\n  const directory = dirname(lockPath);\n  const names = await readdir(directory).catch(() => []);\n  for (const name of names.filter((entry) => STAGED_OWNER.test(entry))) {\n    const path = join(directory, name);\n    const aged = await stat(path).then(({ mtimeMs }) => Date.now() - mtimeMs >= staleAfterMs, () => false);\n    if (aged) await rm(path, { force: true }).catch(() => undefined);\n  }\n}\n\n\n/**\n * Removes an abandoned owner record (see isAbandonedOwner) and its `.lock`,\n * while holding a turn, so no other process of this release recovers,\n * reclaims or acquires `.lock` meanwhile.\n *\n * The record is claimed first: hard-linked to `.recover-<uuid>.json`, and the\n * claim compared with the exact bytes read. A record that replaced the\n * observed one is left in place. While the claim is inside `.lock`, the\n * directory cannot be removed and recreated: older releases never remove a\n * `.recover-*` claim (they clean up only their own claim names), and other\n * processes of this release are kept out by the turn lock. So no other owner\n * record can appear in it, and the unlink of owner.json can only remove the\n * claimed, dead record. A live record is never unlinked or moved. `.lock`\n * itself is removed only after this process's claim is unlinked from it,\n * which proves it is still the dead holder's directory; if the claim cannot\n * be made, `.lock` is left alone (it may be a directory a 1.0.0-beta.16-or-\n * older writer just created, which it holds from that `mkdir`). No step\n * depends on how long this process takes.\n *\n * Without hard links (where 1.0.0-beta.17 … 1.0.1-beta.4 cannot run at all),\n * the record is renamed into the claim instead, and put back if it is not\n * the observed one: one a 1.0.0-beta.16-or-older process published after\n * recovering the same lock at the same moment. The claim keeps `.lock` held\n * meanwhile, so no second writer gets in, but if that holder releases\n * between the two renames, the put-back restores a released record, and\n * `.lock` stays held until that PID is gone and the record is 30 s old.\n */\nasync function recoverStaleLock(profile: string, lockPath: string, staleAfterMs: number): Promise<boolean> {\n  const ownerPath = join(lockPath, \"owner.json\");\n  const observed = await readFile(ownerPath, \"utf8\").catch(() => null);\n  if (observed === null) return recoverOwnerlessLock(profile, lockPath, staleAfterMs);\n  if (!await isAbandonedOwner(observed, ownerPath, staleAfterMs)) return false;\n\n  await waitForTestBarrier(TEST_LOCK_RECOVERY_BARRIER_DIR, profile);\n  const claimPath = join(lockPath, `.recover-${randomUUID()}.json`);\n  let moved = false;\n  try {\n    await link(ownerPath, claimPath);\n  } catch (error) {\n    // Gone or replaced already (another release recovered it): leave `.lock`.\n    if (!lacksHardLinks(error)) return false;\n    try {\n      await rename(ownerPath, claimPath);\n      moved = true;\n    } catch {\n      return false;\n    }\n  }\n  if (moved) await waitForTestBarrier(TEST_LOCK_MOVED_BARRIER_DIR, profile);\n  const sameInstance = await readFile(claimPath, \"utf8\").then((claimed) => claimed === observed, () => false);\n  await waitForTestBarrier(TEST_LOCK_VERIFIED_BARRIER_DIR, profile);\n  if (!sameInstance) {\n    if (moved) {\n      // No other owner.json can have appeared meanwhile: only a process\n      // whose mkdir created this `.lock` publishes one, and it already has.\n      await rename(claimPath, ownerPath).catch(() => undefined);\n    } else {\n      await unlink(claimPath).catch(() => undefined);\n    }\n    return false;\n  }\n  if (!moved) await rm(ownerPath, { force: true });\n  await waitForTestBarrier(TEST_LOCK_CLAIM_BARRIER_DIR, profile);\n  await waitForTestBarrier(TEST_LOCK_CLAIMED_BARRIER_DIR, profile);\n  // Drop any claim a crashed recoverer of this release left, then this one.\n  for (const name of (await readdir(lockPath).catch(() => [])).filter((entry) => RECOVERY_CLAIM.test(entry))) {\n    if (join(lockPath, name) !== claimPath) await rm(join(lockPath, name), { force: true });\n  }\n  // Empty now, and still the dead holder's directory if this claim was in\n  // it: remove it rather than leave an ownerless lock to age out.\n  if (await unlink(claimPath).then(() => true, () => false)) await rmdir(lockPath).catch(() => undefined);\n  await removeAgedOwnerFiles(lockPath, staleAfterMs);\n  return true;\n}\n\n/**\n * Whether an owner record (its exact bytes, read from `ownerPath`) is\n * abandoned: a holder's whose PID is gone, older than the stale threshold;\n * or, if it is not a complete record, a file older than that threshold.\n * Every release publishes complete records (by link or rename) except this\n * one's no-hard-link fallback, which writes in place while holding a turn;\n * so an incomplete record seen while holding a turn was left by a crash.\n */\nasync function isAbandonedOwner(observed: string, ownerPath: string, staleAfterMs: number): Promise<boolean> {\n  let owner: unknown;\n  try {\n    owner = JSON.parse(observed);\n  } catch {\n    owner = null;\n  }\n  if (typeof owner === \"object\" && owner !== null && \"pid\" in owner) {\n    return isStaleOwner(owner as { pid?: unknown; createdAt?: unknown }, staleAfterMs);\n  }\n  const modifiedAt = await stat(ownerPath).then(({ mtimeMs }) => mtimeMs, () => Number.NaN);\n  return Date.now() - modifiedAt >= staleAfterMs;\n}\n\n/** Test-only rendezvous (NODE_ENV=test and the named barrier directory set). */\nasync function waitForTestBarrier(environmentName: string, profile: string): Promise<void> {\n  if (process.env.NODE_ENV !== \"test\") return;\n  const barrierDirectory = process.env[environmentName];\n  if (!barrierDirectory) return;\n  await mkdir(barrierDirectory, { recursive: true });\n  const readyPath = join(barrierDirectory, `ready-${process.pid}-${profile}`);\n  await writeFile(readyPath, \"ready\\n\", { encoding: \"utf8\", flag: \"wx\" }).catch(() => undefined);\n  const releasePath = join(barrierDirectory, \"release\");\n  while (true) {\n    try {\n      await readFile(releasePath, \"utf8\");\n      return;\n    } catch {\n      await sleep(1);\n    }\n  }\n}\n\nfunction isStaleOwner(\n  owner: { pid?: unknown; createdAt?: unknown } | null,\n  staleAfterMs: number,\n): boolean {\n  const now = Date.now();\n  const createdAt = typeof owner?.createdAt === \"string\"\n    ? Date.parse(owner.createdAt)\n    : Number.NaN;\n\n  // Reclaim only a fully published lock whose owner PID is confirmed dead.\n  // A lock without an owner record is handled by recoverOwnerlessLock: a\n  // process holds the lock only once its owner.json is linked in.\n  if (!Number.isFinite(createdAt) || now - createdAt < staleAfterMs) return false;\n  if (typeof owner?.pid !== \"number\" || !Number.isInteger(owner.pid) || owner.pid <= 0) {\n    return false;\n  }\n  return !isProcessAlive(owner.pid);\n}\n\n/** Whether `path` exists. Only ENOENT/ENOTDIR mean it does not; other errors are thrown. */\nasync function exists(path: string): Promise<boolean> {\n  try {\n    await stat(path);\n    return true;\n  } catch (error) {\n    if (isErrno(error, \"ENOENT\") || isErrno(error, \"ENOTDIR\")) return false;\n    throw error;\n  }\n}\n\nfunction isProcessAlive(pid: number): boolean {\n  try {\n    process.kill(pid, 0);\n    return true;\n  } catch (error) {\n    return !isErrno(error, \"ESRCH\");\n  }\n}\n\nfunction validateProfileName(profile: string): string {\n  if (\n    !profile ||\n    profile === \".\" ||\n    profile === \"..\" ||\n    profile.includes(\"/\") ||\n    profile.includes(\"\\\\\") ||\n    profile.includes(\"\\0\")\n  ) {\n    throw new TypeError(\"Profile names must be non-empty path segments.\");\n  }\n  return profile;\n}\n\nfunction isErrno(error: unknown, code: string): boolean {\n  return typeof error === \"object\" && error !== null && \"code\" in error &&\n    (error as { code?: unknown }).code === code;\n}\n\nfunction sleep(milliseconds: number): Promise<void> {\n  return new Promise((resolve) => setTimeout(resolve, milliseconds));\n}\n\nexport { DEFAULT_PROFILE };\n","import { randomUUID } from \"node:crypto\";\n\nimport type { PermissionEntry } from \"@tinycloud/sdk-core\";\nimport { z } from \"zod\";\n\nimport {\n  canonicalizeCapabilities,\n  evaluateOperationAuthority,\n  evaluateAuthority,\n} from \"./authority.js\";\nimport type { OperationSpaceResolver } from \"./authority.js\";\nimport type {\n  OperationOperatorType,\n  TinyCloudPosture,\n} from \"./contract.js\";\nimport { readAuthRequests, updateProfileStore } from \"./state.js\";\n\nexport { evaluateAuthority } from \"./authority.js\";\n\nconst THIRTY_DAYS_MS = 30 * 24 * 60 * 60 * 1_000;\n\n/** The shared wire schema for SDK PermissionEntry values, including signed ReCap caveats. */\nexport const PermissionEntrySchema = z.object({\n  service: z.string().min(1),\n  space: z.string().min(1).optional(),\n  path: z.string(),\n  actions: z.array(z.string().min(1)).min(1),\n  caveats: z.array(z.record(z.unknown())).optional(),\n  skipPrefix: z.boolean().optional(),\n  expiry: z.string().min(1).optional(),\n  description: z.string().optional(),\n}).strict();\n\nconst CommandSchema = z.object({\n  argv: z.array(z.string()).min(1),\n  cwd: z.string().min(1),\n}).strict();\n\nconst LegacyPermissionRequestArtifactSchema = z.object({\n  kind: z.literal(\"tinycloud.auth.request\"),\n  version: z.literal(1),\n  requestId: z.string(),\n  sessionDid: z.string().min(1),\n  requested: z.array(PermissionEntrySchema),\n  requestedExpiry: z.union([z.string(), z.number().finite()]).optional(),\n}).strict();\n\nconst PortableDelegationSchema: z.ZodType<Record<string, unknown>> = z.lazy(() => z.object({\n  cid: z.string().min(1),\n  spaceId: z.string().min(1),\n  path: z.string(),\n  actions: z.array(z.string().min(1)).min(1),\n  delegateDID: z.string().min(1),\n  ownerAddress: z.string().min(1),\n  chainId: z.number().int().positive(),\n  expiry: z.union([z.string().datetime({ offset: true }), z.date()]),\n  delegationHeader: z.object({ Authorization: z.string().min(1) }).strict(),\n  host: z.string().min(1).optional(),\n  disableSubDelegation: z.boolean().optional(),\n  publicDelegation: PortableDelegationSchema.optional(),\n  resources: z.array(PermissionEntrySchema).optional(),\n}).passthrough());\n\n/** Canonical wire-format v1 request retained for CLI and OpenKey compatibility. */\nexport const PermissionRequestArtifactSchema = z.object({\n  kind: z.literal(\"tinycloud.auth.request\"),\n  version: z.literal(1),\n  requestId: z.string().min(1),\n  createdAt: z.string().datetime({ offset: true }),\n  profile: z.string().min(1),\n  posture: z.enum([\"owner-openkey\", \"delegate-session\", \"local-owner-key\", \"unauthenticated\"]),\n  operatorType: z.enum([\"human\", \"agent\"]),\n  host: z.string().min(1),\n  sessionDid: z.string().min(1),\n  ownerDid: z.string().min(1).optional(),\n  spaceId: z.string().min(1).optional(),\n  requestedExpiry: z.union([z.string().min(1), z.number().finite()]).optional(),\n  requested: z.array(PermissionEntrySchema),\n  command: CommandSchema.optional(),\n}).strict();\n\n/** Canonical structured v1 delegation import accepted by the auth operation. */\nexport const DelegationImportArtifactSchema = z.object({\n  kind: z.literal(\"tinycloud.auth.delegation\"),\n  version: z.literal(1),\n  requestId: z.string().min(1),\n  delegationCid: z.string().min(1).optional(),\n  delegation: PortableDelegationSchema,\n  // This field is presentation metadata only. A later import operation obtains\n  // effective permissions from validated, installed delegation authority.\n  permissions: z.array(PermissionEntrySchema).optional(),\n  expiry: z.string().datetime({ offset: true }).optional(),\n  prompted: z.boolean().optional(),\n}).strict();\n\n/**\n * The stored request an imported delegation was checked against, persisted\n * with the delegation. Its fields are exactly the request artifact's, so\n * replay accepts every binding import can write.\n */\nexport const DelegationRequestBindingSchema = PermissionRequestArtifactSchema\n  .pick({ requestId: true, requested: true })\n  .strict();\nexport type DelegationRequestBinding = z.infer<typeof DelegationRequestBindingSchema>;\n\nexport type PermissionRequestArtifact = z.infer<typeof PermissionRequestArtifactSchema>;\nexport type DelegationImportArtifact = z.infer<typeof DelegationImportArtifactSchema>;\n/** The minimal public node-sdk request shape accepted by the legacy reader. */\nexport type LegacyPermissionRequestArtifact = z.infer<typeof LegacyPermissionRequestArtifactSchema>;\nexport type ArtifactClock = () => Date;\nexport type RequestIdSource = () => string;\n\n/** Invocation-owned values used to safely complete a legacy request record. */\nexport interface LegacyRequestContext {\n  readonly profile: string;\n  readonly host: string;\n  readonly sessionDid: string;\n  readonly posture: TinyCloudPosture;\n  readonly operatorType: OperationOperatorType;\n  readonly ownerDid?: string;\n  readonly spaceId?: string;\n  readonly now?: Date;\n}\n\nexport interface PermissionRequestIdentityInput {\n  readonly profile: string;\n  readonly sessionDid: string;\n  readonly host: string;\n  readonly missing: readonly PermissionEntry[];\n}\n\nexport interface BuildPermissionRequestArtifactInput extends PermissionRequestIdentityInput {\n  readonly posture: TinyCloudPosture;\n  readonly operatorType: OperationOperatorType;\n  readonly ownerDid?: string;\n  readonly spaceId?: string;\n  readonly requestedExpiry?: string | number;\n  readonly command?: { readonly argv: readonly string[]; readonly cwd: string };\n  readonly now?: ArtifactClock;\n  readonly createRequestId?: RequestIdSource;\n}\n\nexport interface CreateOrReusePermissionRequestInput extends BuildPermissionRequestArtifactInput {\n  readonly granted: readonly PermissionEntry[];\n  /** Owner-aware identity resolver used by registered operation callers. */\n  readonly resolveSpace?: OperationSpaceResolver;\n  readonly replace?: boolean;\n}\n\nexport type PermissionRequestResolution =\n  | Readonly<{ status: \"satisfied\"; reused: false }>\n  | Readonly<{ status: \"created\"; reused: boolean; request: PermissionRequestArtifact }>;\n\n/** Parses a request artifact without accepting a newer wire format as v1. */\nexport function validatePermissionRequestArtifact(value: unknown): PermissionRequestArtifact {\n  return PermissionRequestArtifactSchema.parse(value);\n}\n\n/** Parses a structured active-session import artifact without accepting a newer wire format as v1. */\nexport function validateDelegationImportArtifact(value: unknown): DelegationImportArtifact {\n  return DelegationImportArtifactSchema.parse(value);\n}\n\nexport function isPermissionRequestArtifact(value: unknown): value is PermissionRequestArtifact {\n  return PermissionRequestArtifactSchema.safeParse(value).success;\n}\n\nexport function isDelegationImportArtifact(value: unknown): value is DelegationImportArtifact {\n  return DelegationImportArtifactSchema.safeParse(value).success;\n}\n\nfunction normalizeLegacyPermissionRequest(\n  value: LegacyPermissionRequestArtifact,\n  context: LegacyRequestContext,\n): PermissionRequestArtifact {\n  if (principal(value.sessionDid) !== principal(context.sessionDid)) {\n    throw new TypeError(\"Stored authority request belongs to a different session.\");\n  }\n  const createdAt = context.now ?? new Date();\n  if (Number.isNaN(createdAt.getTime())) {\n    throw new TypeError(\"The legacy authority request has no usable creation time.\");\n  }\n  return {\n    kind: \"tinycloud.auth.request\",\n    version: 1,\n    requestId: value.requestId,\n    createdAt: createdAt.toISOString(),\n    profile: context.profile,\n    posture: context.posture,\n    operatorType: context.operatorType,\n    host: context.host,\n    sessionDid: context.sessionDid,\n    ...(context.ownerDid === undefined ? {} : { ownerDid: context.ownerDid }),\n    ...(context.spaceId === undefined ? {} : { spaceId: context.spaceId }),\n    ...(value.requestedExpiry === undefined ? {} : { requestedExpiry: value.requestedExpiry }),\n    requested: canonicalizeCapabilities(value.requested),\n  } as PermissionRequestArtifact;\n}\n\nfunction principal(value: string): string {\n  return value.split(\"#\", 1)[0]!;\n}\n\n/**\n * Stable exact identity used only for request reuse. It binds a request to its\n * selected profile, active session DID, host, and canonical missing subset.\n */\nexport function createPermissionRequestIdentity(input: PermissionRequestIdentityInput): string {\n  return JSON.stringify({\n    profile: input.profile,\n    sessionDid: input.sessionDid,\n    host: input.host,\n    missing: canonicalizeCapabilities(input.missing),\n  });\n}\n\n/** Builds an on-disk-compatible v1 record. Omitted values stay omitted. */\nexport function buildPermissionRequestArtifact(\n  input: BuildPermissionRequestArtifactInput,\n): PermissionRequestArtifact {\n  const now = input.now ?? (() => new Date());\n  const createdAt = now();\n  if (Number.isNaN(createdAt.getTime())) throw new TypeError(\"The artifact clock returned an invalid date.\");\n  const requested = canonicalizeCapabilities(input.missing);\n  if (requested.length === 0) throw new TypeError(\"Permission requests require at least one missing capability.\");\n\n  return validatePermissionRequestArtifact({\n    kind: \"tinycloud.auth.request\",\n    version: 1,\n    requestId: input.createRequestId?.() ?? defaultRequestId(createdAt),\n    createdAt: createdAt.toISOString(),\n    profile: input.profile,\n    posture: input.posture,\n    operatorType: input.operatorType,\n    host: input.host,\n    sessionDid: input.sessionDid,\n    ...(input.ownerDid !== undefined ? { ownerDid: input.ownerDid } : {}),\n    ...(input.spaceId !== undefined ? { spaceId: input.spaceId } : {}),\n    ...(input.requestedExpiry !== undefined ? { requestedExpiry: input.requestedExpiry } : {}),\n    requested,\n    ...(input.command !== undefined\n      ? { command: { argv: [...input.command.argv], cwd: input.command.cwd } }\n      : {}),\n  });\n}\n\n/** Reads only valid canonical v1 records and refuses malformed stored artifacts. */\nexport async function listPermissionRequests(\n  profile: string,\n  context?: LegacyRequestContext,\n): Promise<PermissionRequestArtifact[]> {\n  const records: PermissionRequestArtifact[] = [];\n  for (const value of await readAuthRequests<unknown>(profile)) {\n    const canonical = PermissionRequestArtifactSchema.safeParse(value);\n    if (canonical.success) {\n      if (context !== undefined && principal(canonical.data.sessionDid) !== principal(context.sessionDid)) {\n        continue;\n      }\n      records.push(canonical.data);\n      continue;\n    }\n    const legacy = LegacyPermissionRequestArtifactSchema.safeParse(value);\n    if (!legacy.success) throw new TypeError(\"Stored authority request is malformed.\");\n    if (context === undefined) {\n      throw new TypeError(\"Legacy authority requests require the selected invocation context.\");\n    }\n    if (principal(legacy.data.sessionDid) !== principal(context.sessionDid)) continue;\n    records.push(normalizeLegacyPermissionRequest(legacy.data, context));\n  }\n  return records;\n}\n\nexport async function findPermissionRequest(\n  profile: string,\n  requestId: string,\n  identity: Pick<PermissionRequestIdentityInput, \"sessionDid\" | \"host\"> &\n    Partial<Omit<LegacyRequestContext, \"profile\" | \"host\" | \"sessionDid\">>,\n): Promise<PermissionRequestArtifact | null> {\n  const records = await listPermissionRequests(profile, {\n    profile,\n    host: identity.host,\n    sessionDid: identity.sessionDid,\n    posture: identity.posture ?? \"delegate-session\",\n    operatorType: identity.operatorType ?? \"human\",\n    ...(identity.ownerDid === undefined ? {} : { ownerDid: identity.ownerDid }),\n    ...(identity.spaceId === undefined ? {} : { spaceId: identity.spaceId }),\n  });\n  return records.find((record) =>\n    record.requestId === requestId &&\n    record.sessionDid === identity.sessionDid &&\n    record.host === identity.host,\n  ) ?? null;\n}\n\n/**\n * Atomically returns the newest identical unresolved request, or writes a new\n * v1 record. Retention, stale-session pruning, covered-record pruning, and\n * partial-grant supersession all happen in the same existing profile lock.\n */\nexport async function createOrReusePermissionRequest(\n  input: CreateOrReusePermissionRequestInput,\n): Promise<PermissionRequestResolution> {\n  // Registered operations already computed this exact missing set during\n  // canonical preflight. Do not recompute it with the legacy global matcher:\n  // that matcher intentionally treats same-named short/full spaces as equal.\n  const missing = input.resolveSpace === undefined\n    ? evaluateAuthority(input.granted, input.missing).missing\n    : canonicalizeCapabilities(input.missing);\n  const now = input.now ?? (() => new Date());\n  const observedNow = now();\n  if (Number.isNaN(observedNow.getTime())) throw new TypeError(\"The artifact clock returned an invalid date.\");\n\n  return updateProfileStore<unknown, PermissionRequestResolution>(\n    input.profile,\n    \"auth-requests\",\n    (rawRecords) => {\n      const records: PermissionRequestArtifact[] = [];\n      for (const value of rawRecords) {\n        const canonical = PermissionRequestArtifactSchema.safeParse(value);\n        if (canonical.success) {\n          if (principal(canonical.data.sessionDid) !== principal(input.sessionDid)) continue;\n          records.push(canonical.data);\n          continue;\n        }\n        const legacy = LegacyPermissionRequestArtifactSchema.safeParse(value);\n        if (!legacy.success) throw new TypeError(\"Stored authority request is malformed.\");\n        if (principal(legacy.data.sessionDid) !== principal(input.sessionDid)) continue;\n        records.push(normalizeLegacyPermissionRequest(legacy.data, {\n          profile: input.profile,\n          host: input.host,\n          sessionDid: input.sessionDid,\n          posture: input.posture,\n          operatorType: input.operatorType,\n          ...(input.ownerDid === undefined ? {} : { ownerDid: input.ownerDid }),\n          ...(input.spaceId === undefined ? {} : { spaceId: input.spaceId }),\n          now: observedNow,\n        }));\n      }\n      const retained = prunePermissionRequests(records, {\n        profile: input.profile,\n        sessionDid: input.sessionDid,\n        granted: input.granted,\n        resolveSpace: input.resolveSpace,\n        now: observedNow,\n      });\n\n      if (missing.length === 0) {\n        return { records: retained, result: { status: \"satisfied\", reused: false } };\n      }\n\n      const identity = createPermissionRequestIdentity({ ...input, missing });\n      const withoutSuperseded = retained.filter((record) => !isSupersededBy(record, input, missing));\n      const equivalent = newestEquivalentRequest(withoutSuperseded, identity);\n      if (equivalent !== undefined && input.replace !== true) {\n        return { records: withoutSuperseded, result: { status: \"created\", reused: true, request: equivalent } };\n      }\n\n      const next = withoutSuperseded.filter((record) =>\n        input.replace !== true || permissionRequestArtifactIdentity(record) !== identity,\n      );\n      const request = buildPermissionRequestArtifact({ ...input, missing, now: () => observedNow });\n      return {\n        records: [...next, request],\n        result: { status: \"created\", reused: false, request },\n      };\n    },\n  );\n}\n\nexport interface PrunePermissionRequestsInput {\n  readonly profile: string;\n  readonly sessionDid: string;\n  readonly granted: readonly PermissionEntry[];\n  readonly resolveSpace?: OperationSpaceResolver;\n  readonly now: Date;\n}\n\n/** Pure retention policy used by the locked persistence operation. */\nexport function prunePermissionRequests(\n  records: readonly PermissionRequestArtifact[],\n  input: PrunePermissionRequestsInput,\n): PermissionRequestArtifact[] {\n  const cutoff = input.now.getTime() - THIRTY_DAYS_MS;\n  return records.filter((record) => {\n    const createdAt = Date.parse(record.createdAt);\n    if (!Number.isFinite(createdAt) || createdAt < cutoff) return false;\n    if (record.profile === input.profile && principal(record.sessionDid) !== principal(input.sessionDid)) return false;\n    // Empty request arrays are historical CLI records. They carry no\n    // authority, but remain readable and are retained byte-for-byte by the\n    // shared format-1 writer for compatibility.\n    if (record.requested.length === 0) return true;\n    return !evaluateArtifactAuthority(\n      input.granted,\n      record.requested,\n      input.resolveSpace,\n    ).satisfied;\n  });\n}\n\nfunction newestEquivalentRequest(\n  records: readonly PermissionRequestArtifact[],\n  identity: string,\n): PermissionRequestArtifact | undefined {\n  let newest: PermissionRequestArtifact | undefined;\n  for (const record of records) {\n    if (permissionRequestArtifactIdentity(record) !== identity) continue;\n    if (newest === undefined || record.createdAt >= newest.createdAt) newest = record;\n  }\n  return newest;\n}\n\nfunction isSupersededBy(\n  record: PermissionRequestArtifact,\n  input: CreateOrReusePermissionRequestInput,\n  missing: readonly PermissionEntry[],\n): boolean {\n  if (\n    record.profile !== input.profile ||\n    record.sessionDid !== input.sessionDid ||\n    record.host !== input.host\n  ) {\n    return false;\n  }\n  const remaining = evaluateArtifactAuthority(\n    input.granted,\n    record.requested,\n    input.resolveSpace,\n  ).missing;\n  return remaining.length > 0 &&\n    permissionRequestArtifactIdentity(record) !==\n      createPermissionRequestIdentity({ ...input, missing }) &&\n    createPermissionRequestIdentity({ ...input, missing: remaining }) ===\n      createPermissionRequestIdentity({ ...input, missing });\n}\n\nfunction permissionRequestArtifactIdentity(record: PermissionRequestArtifact): string {\n  return createPermissionRequestIdentity({\n    profile: record.profile,\n    sessionDid: record.sessionDid,\n    host: record.host,\n    missing: record.requested,\n  });\n}\n\nfunction evaluateArtifactAuthority(\n  granted: readonly PermissionEntry[],\n  required: readonly PermissionEntry[],\n  resolveSpace?: OperationSpaceResolver,\n) {\n  return resolveSpace === undefined\n    ? evaluateAuthority(granted, required)\n    : evaluateOperationAuthority(granted, required, resolveSpace);\n}\n\nfunction defaultRequestId(now: Date): string {\n  return `req_${now.getTime().toString(36)}_${randomUUID().replace(/-/g, \"\")}`;\n}\n","// Namespace-shaped so modules that bundle this one stay compatible with\n// lightweight node-sdk test doubles.\nimport * as nodeSdk from \"@tinycloud/node-sdk\";\n\nimport { OperationInvocationError, operationError } from \"./errors.js\";\n\nconst DEFAULT_SECRETS_SPACE = \"secrets\";\nconst SECRET_MANAGER_BASE_URL = \"https://secrets.tinycloud.xyz\";\nconst SECRET_NAME_RE = /^[A-Z][A-Z0-9_]*$/;\nconst RESERVED_SECRET_SCOPES = new Set([\"default\", \"global\"]);\n\nexport interface SecretsGetInput {\n  readonly name: string;\n  readonly scope?: string;\n  readonly space?: string;\n}\n\nexport interface SecretReference {\n  readonly name: string;\n  readonly scope?: string;\n  readonly space: string;\n  readonly vaultKey: string;\n  readonly permissionPath: string;\n}\n\nexport function normalizeSecretsGetInput(\n  input: SecretsGetInput,\n): SecretsGetInput {\n  const reference = resolveSecretReference(input);\n  return {\n    name: reference.name,\n    ...(reference.scope === undefined ? {} : { scope: reference.scope }),\n    // Omission is meaningful: the CLI's default is the literal `secrets`\n    // space, while an explicitly supplied short name is resolved later against\n    // the authenticated identity.\n    ...(input.space === undefined ? {} : { space: reference.space }),\n  };\n}\n\n/** Resolves the one canonical backing key/path used by planning and setup. */\nexport function resolveSecretReference(\n  input: SecretsGetInput,\n): SecretReference {\n  const name = input.name.trim();\n  if (!SECRET_NAME_RE.test(name)) {\n    throw invalidSecretInput();\n  }\n\n  const scope = canonicalizeSecretScope(input.scope);\n  const space = normalizeSecretsSpace(input.space);\n  const vaultKey = scope === undefined\n    ? `secrets/${name}`\n    : `secrets/scoped/${scope}/${name}`;\n\n  return {\n    name,\n    ...(scope === undefined ? {} : { scope }),\n    space,\n    vaultKey,\n    permissionPath: `vault/${vaultKey}`,\n  };\n}\n\n/**\n * Resolve the operation's space against the authenticated identity. The\n * public short-name contract remains `secrets`, while an authenticated\n * operation uses its owner-exact URI for the actual read boundary.\n */\nexport function resolveSecretReferenceForOperation(\n  input: SecretsGetInput,\n  node: unknown,\n  ownerSpace?: string,\n): SecretReference {\n  const reference = resolveSecretReference(input);\n  if (input.space === undefined && ownerSpace === undefined) return reference;\n  return {\n    ...reference,\n    space: resolveOperationSpace(reference.space, node, ownerSpace),\n  };\n}\n\n/** Creates the one owner-aware resolver shared by operation matching paths. */\nexport function operationSpaceResolver(\n  node: unknown,\n  ownerSpace?: string,\n): (space: string) => string {\n  return (space) => resolveOperationSpace(space, node, ownerSpace);\n}\n\nfunction resolveOperationSpace(space: string, node: unknown, ownerSpace?: string): string {\n  if (space.startsWith(\"tinycloud:\")) return canonicalizeSpaceUri(space);\n\n  const ownerSpaceId = ownerSpace === undefined ? undefined : ownedSpaceForName(ownerSpace, space);\n  if (ownerSpaceId !== undefined) return canonicalizeSpaceUri(ownerSpaceId);\n\n  const candidate = node as {\n    resolveOwnedSpace?: (spaceName: string) => unknown;\n    spaceId?: unknown;\n    address?: unknown;\n    did?: unknown;\n  };\n  try {\n    const resolved = candidate.resolveOwnedSpace?.(space);\n    if (typeof resolved === \"string\" && resolved.length > 0) {\n      return canonicalizeSpaceUri(resolved);\n    }\n  } catch {\n    // Continue to the identity-derived resolver below.\n  }\n\n  // A restored delegate session carries the owner's primary space even though\n  // node.did is the delegate/session principal. This is the same owner\n  // identity used by the CLI space resolver.\n  if (typeof candidate.spaceId === \"string\") {\n    const resolved = ownedSpaceForName(candidate.spaceId, space);\n    if (resolved !== undefined) return canonicalizeSpaceUri(resolved);\n  }\n\n  const did = typeof candidate.did === \"string\" ? candidate.did : undefined;\n  const pkh = did === undefined ? null : nodeSdk.parsePkhDid(did);\n  if (pkh === null) {\n    throw invalidSecretInput();\n  }\n  return nodeSdk.makePkhSpaceId(pkh.address, pkh.chainId, space);\n}\n\nfunction ownedSpaceForName(ownerSpace: string, name: string): string | undefined {\n  const parsed = nodeSdk.parseSpaceUri(ownerSpace);\n  if (parsed === null) return undefined;\n  try {\n    const pkh = nodeSdk.parsePkhDid(parsed.owner);\n    return pkh === null ? undefined : nodeSdk.makePkhSpaceId(pkh.address, pkh.chainId, name);\n  } catch {\n    return undefined;\n  }\n}\n\nfunction canonicalizeSpaceUri(space: string): string {\n  const parts = space.split(\":\");\n  const name = parts.at(-1);\n  if (parts.length < 3 || name === undefined || name === \"\") {\n    throw invalidSecretInput();\n  }\n  // EIP-155 address casing is interchangeable only in the repository's\n  // anchored PKH space form. Other TinyCloud space/DID syntaxes are opaque\n  // method-specific identifiers and must remain byte-for-byte unchanged.\n  const pkh = space.match(\n    /^tinycloud:pkh:eip155:(\\d+):(0x[0-9a-fA-F]{40}):([^:]+)$/,\n  );\n  if (pkh !== null) {\n    return `tinycloud:pkh:eip155:${pkh[1]}:${nodeSdk.canonicalizeAddress(pkh[2]!).toLowerCase()}:${pkh[3]}`;\n  }\n  return space;\n}\n\n/**\n * Builds a setup action URL without ever accepting a secret value. It opens\n * Secret Manager's app with the secret's name (and scope) filled in.\n */\nexport function buildSecretSetupUrl(reference: SecretReference): string {\n  const parameters = [\n    [\"secret\", reference.name],\n    ...(reference.scope === undefined ? [] : [[\"scope\", reference.scope] as const]),\n    [\"space\", reference.space],\n  ] as const;\n  const query = parameters\n    .map(([key, value]) => `${encodeURIComponent(key)}=${encodeURIComponent(value)}`)\n    .join(\"&\");\n  return `${SECRET_MANAGER_BASE_URL}/app?${query}`;\n}\n\nfunction canonicalizeSecretScope(scope: string | undefined): string | undefined {\n  if (scope === undefined || scope === \"\") return undefined;\n\n  const trimmed = scope.trim();\n  if (trimmed === \"\") throw invalidSecretInput();\n\n  const canonical = trimmed\n    .toLowerCase()\n    .replace(/[^a-z0-9-]/g, \"-\")\n    .replace(/-+/g, \"-\")\n    .replace(/^-|-$/g, \"\");\n  if (canonical === \"\" || RESERVED_SECRET_SCOPES.has(canonical)) {\n    throw invalidSecretInput();\n  }\n  return canonical;\n}\n\nfunction normalizeSecretsSpace(space: string | undefined): string {\n  if (space === undefined || space === \"\") return DEFAULT_SECRETS_SPACE;\n\n  if (space.startsWith(\"tinycloud:\")) {\n    const parts = space.split(\":\");\n    if (parts.length < 3 || parts.at(-1) === undefined || parts.at(-1) === \"\") {\n      throw invalidSecretInput();\n    }\n    return `tinycloud:${parts.slice(1, -1).join(\":\")}:${parts.at(-1)}`;\n  }\n\n  if (!/^[A-Za-z0-9_-]+$/.test(space)) throw invalidSecretInput();\n  return space;\n}\n\nfunction invalidSecretInput(): OperationInvocationError {\n  return new OperationInvocationError(\n    operationError(\"INPUT_INVALID\", \"The secret reference is invalid.\"),\n  );\n}\n","import * as nodeSdk from \"@tinycloud/node-sdk\";\nimport type {\n  PermissionEntry,\n  PortableDelegation,\n  RuntimeDelegationActivator,\n} from \"@tinycloud/node-sdk\";\nimport { z } from \"zod\";\n\nimport {\n  canonicalizeCapabilities,\n  canonicalizeOperationCapabilities,\n  delegationWithinRequest,\n  evaluateAuthority,\n  validateExactCapabilities,\n} from \"../authority.js\";\nimport {\n  createOrReusePermissionRequest,\n  DelegationImportArtifactSchema,\n  findPermissionRequest,\n  listPermissionRequests,\n  PermissionEntrySchema,\n  type DelegationImportArtifact,\n  type DelegationRequestBinding,\n  type PermissionRequestArtifact,\n} from \"../artifacts.js\";\nimport type {\n  OperationContext,\n  OperationDefinition,\n  OperationExecutionOutcome,\n  OperationExposure,\n  OperationSensitivity,\n  RuntimeOperationContext,\n  TinyCloudPosture,\n} from \"../contract.js\";\nimport { operationError } from \"../errors.js\";\nimport { lookupOperation } from \"../registry.js\";\nimport {\n  readSession,\n  readProfile,\n  updateProfileStore,\n} from \"../state.js\";\nimport { operationSpaceResolver } from \"../secrets.js\";\n\ntype CapabilitiesInput = Record<never, never>;\ntype CapabilitiesOutput = { readonly capabilities: readonly PermissionEntry[] };\ntype AuthRequestInput =\n  | Readonly<{ requestId: string }>\n  | Readonly<{\n    operationId: string;\n    operationVersion: number;\n    input?: unknown;\n  }>;\ntype AuthRequestOutput = Readonly<{\n  missing: readonly PermissionEntry[];\n  request?: PermissionRequestArtifact;\n}>;\ntype AuthImportOutput = Readonly<{\n  cid: string;\n  effectivePermissions: readonly PermissionEntry[];\n  expiry: string;\n  audience: string;\n  host: string;\n  activated: true;\n  alreadyPresent: boolean;\n}>;\n\nconst EmptyInputSchema: z.ZodType<CapabilitiesInput> = z.object({}).strict();\nconst CapabilitiesOutputSchema: z.ZodType<CapabilitiesOutput> = z.object({\n  capabilities: z.array(PermissionEntrySchema),\n}).strict();\nconst AuthRequestInputSchema: z.ZodType<AuthRequestInput> = z.union([\n  z.object({ requestId: z.string().min(1) }).strict(),\n  z.object({\n    operationId: z.string().min(1),\n    operationVersion: z.number().int().positive(),\n    input: z.unknown(),\n  }).strict().superRefine((value, issue) => {\n    if (!Object.prototype.hasOwnProperty.call(value, \"input\")) {\n      issue.addIssue({ code: z.ZodIssueCode.custom, message: \"Operation input is required.\" });\n    }\n  }),\n]);\nconst PermissionRequestOutputSchema = z.object({\n  kind: z.literal(\"tinycloud.auth.request\"),\n  version: z.literal(1),\n  requestId: z.string().min(1),\n  createdAt: z.string().datetime({ offset: true }),\n  profile: z.string().min(1),\n  posture: z.enum([\"owner-openkey\", \"delegate-session\", \"local-owner-key\", \"unauthenticated\"]),\n  operatorType: z.enum([\"human\", \"agent\"]),\n  host: z.string().min(1),\n  sessionDid: z.string().min(1),\n  ownerDid: z.string().min(1).optional(),\n  spaceId: z.string().min(1).optional(),\n  requestedExpiry: z.union([z.string(), z.number()]).optional(),\n  requested: z.array(PermissionEntrySchema).min(1),\n  command: z.object({ argv: z.array(z.string()).min(1), cwd: z.string().min(1) }).strict().optional(),\n}).strict();\nconst AuthRequestOutputSchema: z.ZodType<AuthRequestOutput> = z.object({\n  missing: z.array(PermissionEntrySchema),\n  request: PermissionRequestOutputSchema.optional(),\n}).strict();\nconst AuthImportOutputSchema: z.ZodType<AuthImportOutput> = z.object({\n  cid: z.string().min(1),\n  effectivePermissions: z.array(PermissionEntrySchema),\n  expiry: z.string().datetime({ offset: true }),\n  audience: z.string().min(1),\n  host: z.string().min(1),\n  activated: z.literal(true),\n  alreadyPresent: z.boolean(),\n}).strict();\n\nconst AUTH_POSTURES: readonly TinyCloudPosture[] = [\n  \"owner-openkey\",\n  \"delegate-session\",\n  \"local-owner-key\",\n];\nconst AUTH_EXPOSURE: OperationExposure = {\n  cli: { status: \"required\" },\n  mcp: { status: \"required\" },\n  skill: { status: \"required\" },\n  docs: { status: \"required\" },\n};\nconst AUTH_CAPABILITIES_SENSITIVITY: OperationSensitivity = { input: [], output: [] };\nconst AUTH_REQUEST_SENSITIVITY: OperationSensitivity = { input: [\"/input\"], output: [] };\nconst AUTH_IMPORT_SENSITIVITY: OperationSensitivity = { input: [\"\"], output: [] };\n\n/**\n * Internal I2 auth definitions. Registry integration intentionally owns their\n * registration and root exports remain limited to invokeOperation.\n */\ntype AuthOperationDefinition =\n  | OperationDefinition<CapabilitiesInput, CapabilitiesOutput>\n  | OperationDefinition<AuthRequestInput, AuthRequestOutput>\n  | OperationDefinition<DelegationImportArtifact, AuthImportOutput>;\n\nexport const authOperationDefinitions: readonly AuthOperationDefinition[] = [\n  {\n    id: \"tinycloud.auth.capabilities\",\n    version: 1,\n    title: \"TinyCloud active capabilities\",\n    description: \"Inspect validated active runtime capabilities for the selected profile.\",\n    input: EmptyInputSchema,\n    output: CapabilitiesOutputSchema,\n    effects: [\"read\"],\n    runtime: \"authenticated\",\n    postures: AUTH_POSTURES,\n    exposure: AUTH_EXPOSURE,\n    sensitivity: AUTH_CAPABILITIES_SENSITIVITY,\n    authority: async () => [],\n    execute: async (context: OperationContext): Promise<OperationExecutionOutcome<CapabilitiesOutput>> => ({\n      status: \"ok\",\n      output: {\n        capabilities: canonicalizeCapabilities(\n          (context.runtime?.granted ?? []) as unknown as PermissionEntry[],\n        ),\n      },\n    }),\n  },\n  {\n    id: \"tinycloud.auth.request\",\n    version: 1,\n    title: \"Request TinyCloud capabilities\",\n    description: \"Create or recover an exact stored request from a canonical operation planner.\",\n    input: AuthRequestInputSchema,\n    output: AuthRequestOutputSchema,\n    effects: [\"local_write\"],\n    runtime: \"authenticated\",\n    postures: AUTH_POSTURES,\n    exposure: AUTH_EXPOSURE,\n    sensitivity: AUTH_REQUEST_SENSITIVITY,\n    authority: async () => [],\n    execute: (context: OperationContext, input: AuthRequestInput) => requestExactAuthority(\n      context as RuntimeOperationContext,\n      input,\n    ),\n  },\n  {\n    id: \"tinycloud.auth.import\",\n    version: 1,\n    title: \"Import TinyCloud delegation\",\n    description: \"Validate, activate, and persist one request-bound runtime delegation.\",\n    input: DelegationImportArtifactSchema,\n    output: AuthImportOutputSchema,\n    effects: [\"local_write\"],\n    runtime: \"authenticated\",\n    postures: AUTH_POSTURES,\n    exposure: AUTH_EXPOSURE,\n    sensitivity: AUTH_IMPORT_SENSITIVITY,\n    invalidInputErrorCode: \"DELEGATION_ARTIFACT_INVALID\",\n    authority: async () => [],\n    execute: (context: OperationContext, input: DelegationImportArtifact) => importRequestBoundDelegation(\n      context as RuntimeOperationContext,\n      input,\n    ),\n  },\n];\n\nasync function requestExactAuthority(\n  context: RuntimeOperationContext,\n  input: AuthRequestInput,\n): Promise<OperationExecutionOutcome<AuthRequestOutput>> {\n  const sessionDid = context.summary.sessionDid;\n  if (sessionDid === undefined) return missingSession();\n\n  if (\"requestId\" in input) {\n    try {\n      const request = await findPermissionRequest(context.summary.profile, input.requestId, {\n        sessionDid,\n        host: context.summary.host,\n        posture: context.summary.posture,\n        operatorType: context.summary.operatorType ?? \"human\",\n        ...(context.summary.ownerDid === undefined ? {} : { ownerDid: context.summary.ownerDid }),\n        ...(context.summary.space === undefined ? {} : { spaceId: context.summary.space }),\n      });\n      if (request === null) {\n        return invalidInput(\"The requested authority request is not available for this session.\");\n      }\n      if (request.profile !== context.summary.profile) {\n        return invalidInput(\"The requested authority request is not available for this profile.\");\n      }\n      const required = exactCapabilities(request.requested);\n      if (required === undefined) {\n        return operationFailure(\n          \"PERMISSION_HINT_INVALID\",\n          \"The stored authority request has invalid capabilities.\",\n        );\n      }\n      const evaluation = evaluateAuthority(\n        context.runtime.granted as unknown as PermissionEntry[],\n        required,\n      );\n      if (evaluation.satisfied) {\n        return { status: \"ok\", output: { missing: [] } };\n      }\n      const narrowed = await createOrReusePermissionRequest({\n        profile: context.summary.profile,\n        posture: context.summary.posture,\n        operatorType: context.summary.operatorType ?? \"human\",\n        host: context.summary.host,\n        sessionDid,\n        ...(context.summary.ownerDid === undefined ? {} : { ownerDid: context.summary.ownerDid }),\n        ...(context.summary.space === undefined ? {} : { spaceId: context.summary.space }),\n        missing: evaluation.missing,\n        granted: context.runtime.granted as unknown as PermissionEntry[],\n      });\n      if (narrowed.status === \"satisfied\") return { status: \"ok\", output: { missing: [] } };\n      return { status: \"ok\", output: { missing: evaluation.missing, request: narrowed.request } };\n    } catch {\n      return internalFailure();\n    }\n  }\n\n  const target = lookupOperation(input.operationId, input.operationVersion);\n  if (target.status === \"operation_not_found\") {\n    return operationFailure(\"OPERATION_NOT_FOUND\", \"The requested operation is not registered.\");\n  }\n  if (target.status === \"operation_version_unsupported\") {\n    return operationFailure(\n      \"OPERATION_VERSION_UNSUPPORTED\",\n      \"The requested operation version is not supported.\",\n    );\n  }\n  if (target.definition.id === \"tinycloud.auth.request\") {\n    return invalidInput(\"Authority requests cannot plan themselves.\");\n  }\n  if (!target.definition.postures.includes(context.summary.posture)) {\n    return operationFailure(\n      \"PROFILE_POSTURE_NOT_ALLOWED\",\n      \"The active profile posture cannot execute this operation.\",\n    );\n  }\n\n  const parsed = target.definition.input.safeParse(input.input);\n  if (!parsed.success) return invalidInput(\"The operation input is invalid.\");\n\n  try {\n    const planned = await target.definition.authority(context, parsed.data);\n    const required = exactCapabilities(planned);\n    if (required === undefined) {\n      return operationFailure(\n        \"PERMISSION_HINT_INVALID\",\n        \"The operation returned an invalid permission requirement.\",\n      );\n    }\n    const evaluation = evaluateAuthority(\n      context.runtime.granted as unknown as PermissionEntry[],\n      required,\n    );\n    if (evaluation.satisfied) {\n      // Do not call the artifact store: even a retention-only write is not an\n      // allowed side effect for an already-authorized request.\n      return { status: \"ok\", output: { missing: [] } };\n    }\n    const request = await createOrReusePermissionRequest({\n      profile: context.summary.profile,\n      posture: context.summary.posture,\n      operatorType: context.summary.operatorType ?? \"human\",\n      host: context.summary.host,\n      sessionDid,\n      ...(context.summary.ownerDid === undefined ? {} : { ownerDid: context.summary.ownerDid }),\n      ...(context.summary.space === undefined ? {} : { spaceId: context.summary.space }),\n      missing: evaluation.missing,\n      granted: context.runtime.granted as unknown as PermissionEntry[],\n    });\n    if (request.status === \"satisfied\") return { status: \"ok\", output: { missing: [] } };\n    return {\n      status: \"ok\",\n      output: { missing: evaluation.missing, request: request.request },\n    };\n  } catch {\n    return internalFailure();\n  }\n}\n\nasync function importRequestBoundDelegation(\n  context: RuntimeOperationContext,\n  input: DelegationImportArtifact,\n): Promise<OperationExecutionOutcome<AuthImportOutput>> {\n  try {\n    const rawDelegation = input.delegation as unknown as Record<string, unknown>;\n    if (typeof rawDelegation.delegateDID !== \"string\") return invalidDelegation();\n    if (context.summary.sessionDid !== undefined && !samePrincipal(\n      rawDelegation.delegateDID,\n      context.summary.sessionDid,\n    )) {\n      return audienceMismatch(context.summary.sessionDid, rawDelegation.delegateDID);\n    }\n    const initial = await importState(context, input.requestId);\n    if (!initial.ok) return initial.result;\n    const { request, sessionDid, host } = initial;\n    const explicitHost = rawDelegation.host;\n    if (explicitHost !== undefined && typeof explicitHost !== \"string\") {\n      return invalidDelegation();\n    }\n    if (typeof explicitHost === \"string\" && normalizeHost(explicitHost) !== normalizeHost(host)) {\n      return hostMismatch(host, explicitHost);\n    }\n    const expiry = normalizeExpiry(rawDelegation.expiry);\n    if (expiry === undefined) return invalidDelegation();\n    if (expiry.getTime() <= Date.now()) return expiredDelegation();\n    if (input.delegationCid !== undefined && input.delegationCid !== rawDelegation.cid) {\n      return invalidDelegation();\n    }\n    if (typeof rawDelegation.delegateDID !== \"string\" || !samePrincipal(rawDelegation.delegateDID, sessionDid)) {\n      return audienceMismatch(sessionDid, String(rawDelegation.delegateDID ?? \"unknown\"));\n    }\n\n    const delegation = {\n      ...rawDelegation,\n      expiry,\n      host: explicitHost ?? host,\n    } as PortableDelegation;\n    let activated: Awaited<ReturnType<typeof nodeSdk.activateValidatedRuntimeDelegation>>;\n    try {\n      activated = await nodeSdk.activateValidatedRuntimeDelegation(\n        context.runtime.node as RuntimeDelegationActivator,\n        delegation,\n        { host },\n      );\n    } catch {\n      return operationFailure(\n        \"DELEGATION_REJECTED\",\n        \"The delegation was rejected by the TinyCloud runtime.\",\n      );\n    }\n\n    const effectivePermissions = canonicalizeCapabilities(activated.effectivePermissions);\n    const resolveSpace = operationSpaceResolver(\n      context.runtime.node,\n      context.summary.space,\n    );\n    if (!delegationWithinRequest(request.requested, effectivePermissions, resolveSpace)) {\n      return operationFailure(\n        \"DELEGATION_REJECTED\",\n        \"The delegation exceeds the stored authority request.\",\n      );\n    }\n\n    try {\n      return await updateProfileStore<Record<string, unknown>, OperationExecutionOutcome<AuthImportOutput>>(\n        context.summary.profile,\n        \"additional-delegations\",\n        async (records) => {\n          const state = await importState(context, input.requestId);\n          if (!state.ok) return { records, result: state.result };\n          if (state.sessionDid !== sessionDid || normalizeHost(state.host) !== normalizeHost(host)) {\n            return {\n              records,\n              result: audienceMismatch(state.sessionDid, sessionDid),\n            };\n          }\n          if (state.request.profile !== context.summary.profile ||\n            !samePrincipal(state.request.sessionDid, sessionDid) ||\n            normalizeHost(state.request.host) !== normalizeHost(host) ||\n            JSON.stringify(canonicalizeOperationCapabilities(state.request.requested, resolveSpace)) !==\n              JSON.stringify(canonicalizeOperationCapabilities(request.requested, resolveSpace))) {\n            return {\n              records,\n              result: operationFailure(\n                \"DELEGATION_ARTIFACT_INVALID\",\n                \"The delegation does not reference a current stored request.\",\n              ),\n            };\n          }\n          // Replay re-checks the delegation against this binding; the stored\n          // request itself may later be pruned.\n          const record = {\n            delegation: activated.delegation,\n            permissions: activated.effectivePermissions,\n            authorityRequest: {\n              requestId: request.requestId,\n              requested: request.requested,\n            } satisfies DelegationRequestBinding,\n          };\n          // A validated import replaces every stored row for its CID with this\n          // record, whatever binding those rows carried (none, a synthesized\n          // one, or one replay cannot use), keeping the first row's position.\n          const position = records.findIndex((entry) => delegationCid(entry) === activated.cid);\n          const alreadyPresent = position !== -1;\n          const others = records.filter((entry) => delegationCid(entry) !== activated.cid);\n          return {\n            records: alreadyPresent\n              ? [...others.slice(0, position), record, ...others.slice(position)]\n              : [...records, record],\n            result: {\n              status: \"ok\",\n              output: {\n                cid: activated.cid,\n                effectivePermissions,\n                expiry: activated.expiry.toISOString(),\n                audience: activated.audience,\n                host: activated.host,\n                activated: true,\n                alreadyPresent,\n              },\n            },\n          };\n        },\n      );\n    } catch {\n      return internalImportFailure();\n    }\n  } catch {\n    return internalImportFailure();\n  }\n}\n\nasync function importState(\n  context: RuntimeOperationContext,\n  requestId: string,\n): Promise<\n  | { ok: true; request: PermissionRequestArtifact; sessionDid: string; host: string }\n  | { ok: false; result: OperationExecutionOutcome<never> }\n> {\n  const sessionDid = await currentSessionDid(context.summary.profile);\n  if (sessionDid === undefined) return { ok: false, result: missingSession() };\n  if (context.summary.sessionDid === undefined || !samePrincipal(context.summary.sessionDid, sessionDid)) {\n    return { ok: false, result: audienceMismatch(sessionDid, context.summary.sessionDid ?? \"unknown\") };\n  }\n  const current = await readProfile<Record<string, unknown>>(context.summary.profile);\n  const host = typeof current?.host === \"string\" ? current.host : context.summary.host;\n  if (normalizeHost(host) !== normalizeHost(context.summary.host)) {\n    return { ok: false, result: hostMismatch(context.summary.host, host) };\n  }\n  let requests: PermissionRequestArtifact[];\n  try {\n    requests = await listPermissionRequests(context.summary.profile, {\n      profile: context.summary.profile,\n      host: context.summary.host,\n      sessionDid,\n      posture: context.summary.posture,\n      operatorType: context.summary.operatorType ?? \"human\",\n      ...(context.summary.ownerDid === undefined ? {} : { ownerDid: context.summary.ownerDid }),\n      ...(context.summary.space === undefined ? {} : { spaceId: context.summary.space }),\n    });\n  } catch {\n    return {\n      ok: false,\n      result: operationFailure(\n        \"DELEGATION_ARTIFACT_INVALID\",\n        \"The stored authority request is malformed.\",\n      ),\n    };\n  }\n  const request = requests.find((candidate) => candidate.requestId === requestId);\n  if (request === undefined || request.profile !== context.summary.profile) {\n    return {\n      ok: false,\n      result: operationFailure(\n        \"DELEGATION_ARTIFACT_INVALID\",\n        \"The delegation does not reference a stored request for this profile.\",\n      ),\n    };\n  }\n  if (normalizeHost(request.host) !== normalizeHost(host)) {\n    return { ok: false, result: hostMismatch(host, request.host) };\n  }\n  if (!samePrincipal(request.sessionDid, sessionDid)) {\n    return { ok: false, result: audienceMismatch(sessionDid, request.sessionDid) };\n  }\n  return { ok: true, request, sessionDid, host };\n}\n\nfunction exactCapabilities(value: unknown): PermissionEntry[] | undefined {\n  return validateExactCapabilities(value);\n}\n\nfunction normalizeExpiry(value: unknown): Date | undefined {\n  const expiry = value instanceof Date ? value : typeof value === \"string\" ? new Date(value) : undefined;\n  return expiry !== undefined && !Number.isNaN(expiry.getTime()) ? expiry : undefined;\n}\n\nfunction normalizeHost(host: string): string {\n  return host.replace(/\\/+$/, \"\");\n}\n\nfunction samePrincipal(left: string, right: string): boolean {\n  return left.split(\"#\", 1)[0] === right.split(\"#\", 1)[0];\n}\n\nfunction delegationCid(value: Record<string, unknown>): string | undefined {\n  const delegation = value.delegation;\n  if (delegation === null || typeof delegation !== \"object\") return undefined;\n  const cid = (delegation as { cid?: unknown }).cid;\n  return typeof cid === \"string\" ? cid : undefined;\n}\n\nasync function currentSessionDid(profile: string): Promise<string | undefined> {\n  const session = await readSession<Record<string, unknown>>(profile);\n  if (session === null || typeof session.verificationMethod !== \"string\") return undefined;\n  return session.verificationMethod.split(\"#\", 1)[0] || undefined;\n}\n\nfunction missingSession(): OperationExecutionOutcome<never> {\n  return operationFailure(\"SESSION_NOT_FOUND\", \"The selected profile does not have an active session.\");\n}\n\nfunction invalidDelegation(): OperationExecutionOutcome<never> {\n  return operationFailure(\"DELEGATION_ARTIFACT_INVALID\", \"The delegation artifact is invalid.\");\n}\n\nfunction expiredDelegation(): OperationExecutionOutcome<never> {\n  return operationFailure(\"DELEGATION_EXPIRED\", \"The delegation has expired.\");\n}\n\nfunction audienceMismatch(expectedSessionDid: string, artifactAudience: string): OperationExecutionOutcome<never> {\n  return operationFailure(\"DELEGATION_AUDIENCE_MISMATCH\", \"The delegation is for a different session.\", {\n    expectedSessionDid,\n    artifactAudience,\n  });\n}\n\nfunction hostMismatch(expectedHost: string, artifactHost: string): OperationExecutionOutcome<never> {\n  return operationFailure(\"DELEGATION_HOST_MISMATCH\", \"The delegation is for a different host.\", {\n    expectedHost,\n    artifactHost,\n  });\n}\n\nfunction invalidInput(message: string): OperationExecutionOutcome<never> {\n  return operationFailure(\"INPUT_INVALID\", message);\n}\n\nfunction internalFailure(): OperationExecutionOutcome<never> {\n  return operationFailure(\"INTERNAL_ERROR\", \"The authority request could not be completed.\");\n}\n\nfunction internalImportFailure(): OperationExecutionOutcome<never> {\n  return operationFailure(\"INTERNAL_ERROR\", \"The delegation import could not be completed.\");\n}\n\nfunction operationFailure(\n  code: Parameters<typeof operationError>[0],\n  message: string,\n  details?: Readonly<Record<string, unknown>>,\n): OperationExecutionOutcome<never> {\n  return { status: \"error\", error: operationError(code, message, { ...(details === undefined ? {} : { details }) }) };\n}\n","import type { TinyCloudNode } from \"@tinycloud/node-sdk\";\nimport { authorizationVerdictOf, validatedCapabilityOf } from \"@tinycloud/sdk-services\";\nimport { z } from \"zod\";\n\nimport type {\n  CapabilityRequirement,\n  OperationContext,\n  OperationDefinition,\n  OperationExecutionOutcome,\n  OperationExposure,\n  OperationSensitivity,\n  RuntimeOperationContext,\n  TinyCloudPosture,\n} from \"../contract.js\";\nimport { OperationInvocationError, operationError, storageFullOperationError } from \"../errors.js\";\nimport { operationSpaceResolver } from \"../secrets.js\";\n\ntype EmptyInput = Record<never, never>;\n\ninterface AccountSpacesOutput {\n  readonly spaces: readonly {\n    readonly spaceId: string;\n    readonly name: string;\n    readonly ownerDid: string;\n    readonly type: \"owned\" | \"delegated\" | \"discovered\";\n    readonly permissions: readonly string[];\n    readonly status: \"active\" | \"archived\";\n    readonly registeredAt?: string;\n    readonly updatedAt?: string;\n    readonly expiresAt?: string;\n  }[];\n  readonly count: number;\n}\n\ninterface AccountApplicationsOutput {\n  readonly applications: readonly {\n    readonly appId: string;\n    readonly manifests: readonly Record<string, unknown>[];\n    readonly updatedAt?: string;\n    readonly name?: string;\n    readonly description?: string;\n    readonly manifestHash?: string;\n  }[];\n  readonly count: number;\n}\n\ninterface KvListInput {\n  readonly space: string;\n  readonly prefix?: string;\n  readonly limit?: number;\n}\n\ninterface KvListOutput {\n  readonly space: string;\n  readonly prefix: string;\n  readonly keys: readonly string[];\n  readonly count: number;\n  readonly truncated: boolean;\n}\n\ninterface KvGetInput {\n  readonly space: string;\n  readonly key: string;\n  readonly representation?: \"base64\" | \"text\" | \"json\";\n}\n\ninterface KvGetOutput {\n  readonly space: string;\n  readonly key: string;\n  readonly value: unknown;\n  readonly encoding: \"json\" | \"text\" | \"base64\";\n  readonly metadata: {\n    readonly etag?: string;\n    readonly contentType?: string;\n    readonly lastModified?: string;\n    readonly contentLength?: number;\n  };\n  readonly byteLength: number;\n}\n\ntype JsonValue = null | boolean | number | string | JsonValue[] | { [key: string]: JsonValue };\ntype KvPutContent =\n  | Readonly<{ encoding: \"utf8\"; value: string }>\n  | Readonly<{ encoding: \"json\"; value: JsonValue }>\n  | Readonly<{ encoding: \"base64\"; value: string }>;\ntype KvPutInput = Readonly<{\n  space: string;\n  key: string;\n  content: KvPutContent;\n  contentType?: string;\n}> & (\n  | Readonly<{ mode: \"create\" | \"upsert\" }>\n  | Readonly<{ mode: \"replace\"; etag: string }>\n);\ninterface KvPutOutput {\n  readonly space: string;\n  readonly key: string;\n  readonly mode: \"create\" | \"replace\" | \"upsert\";\n  readonly byteLength: number;\n  readonly metadata: KvMetadata;\n}\ninterface KvHeadInput { readonly space: string; readonly key: string }\ninterface KvHeadOutput { readonly space: string; readonly key: string; readonly metadata: KvMetadata }\ninterface KvDeleteInput { readonly space: string; readonly key: string; readonly etag?: string }\ninterface KvDeleteOutput { readonly space: string; readonly key: string; readonly deleted: true; readonly etag?: string }\ninterface KvMetadata {\n  readonly etag?: string;\n  readonly contentType?: string;\n  readonly lastModified?: string;\n  readonly contentLength?: number;\n}\ntype KvOperationResult<T> =\n  | Readonly<{ ok: true; data: T }>\n  | Readonly<{ ok: false; error: Readonly<{ code?: string; meta?: Readonly<Record<string, unknown>> }> }>;\ninterface KvOperationHandle {\n  list(options: Readonly<{ prefix?: string; limit: number }>): Promise<KvOperationResult<{\n    readonly keys: readonly string[];\n    readonly truncated?: boolean;\n  }>>;\n  get(key: string, options: Readonly<{\n    binary: true;\n    maxResponseBytes: number;\n  }>): Promise<KvOperationResult<{ readonly data: Uint8Array; readonly headers: KvMetadata }>>;\n  head(key: string): Promise<KvOperationResult<{ readonly data: void; readonly headers: KvMetadata }>>;\n  put(key: string, value: Uint8Array, options: Readonly<{\n    contentType: string;\n    ifNoneMatch?: \"*\";\n    ifMatch?: string;\n  }>): Promise<KvOperationResult<{ readonly data: void; readonly headers: KvMetadata }>>;\n  delete(key: string, options: Readonly<{ ifMatch?: string }>): Promise<KvOperationResult<{\n    readonly data: void;\n    readonly headers: KvMetadata;\n  }>>;\n}\n\nconst MAX_KV_VALUE_BYTES = 1024 * 1024;\nconst DEFAULT_KV_LIST_LIMIT = 100;\nconst MAX_ACCOUNT_REGISTRY_RECORDS = 1000;\nconst MAX_ACCOUNT_REGISTRY_BYTES = 4 * 1024 * 1024;\n\nconst EmptyInputSchema: z.ZodType<EmptyInput> = z.object({}).strict();\nconst SpaceSchema = z.string().min(1).refine(\n  (space) =>\n    (/^[A-Za-z0-9_-]+$/.test(space) || space.startsWith(\"tinycloud:\")) &&\n    !space.includes(\"*\"),\n  \"Invalid TinyCloud space.\",\n);\nconst PrefixSchema = z.string().refine(\n  (prefix) => prefix !== \"/\" && !prefix.includes(\"*\"),\n  \"Invalid KV prefix.\",\n);\nconst KeySchema = z.string().min(1).refine(\n  (key) => key !== \"/\" && !key.endsWith(\"/\") && !key.includes(\"*\"),\n  \"Invalid KV key.\",\n);\nconst LimitSchema = z.number().int().min(1).max(1000);\nconst StrongEtagSchema = z.string().regex(\n  /^\"blake3-[0-9a-f]{64}\"$/,\n  \"A strong TinyCloud BLAKE3 ETag is required.\",\n);\nconst ContentTypeSchema = z.string().min(1).max(128).refine(\n  (value) => !/[\\x00-\\x1f\\x7f]/.test(value),\n  \"Invalid content type.\",\n);\nconst JsonNumberSchema = z.number().finite().refine(\n  (value) => !Number.isInteger(value) || Number.isSafeInteger(value),\n  \"JSON integer values must be JavaScript safe integers.\",\n);\nconst JsonValueSchema: z.ZodType<JsonValue> = z.lazy(() => z.union([\n  z.null(),\n  z.boolean(),\n  JsonNumberSchema,\n  z.string(),\n  z.array(JsonValueSchema),\n  z.record(JsonValueSchema),\n]));\nconst KvMetadataSchema: z.ZodType<KvMetadata> = z.object({\n  etag: z.string().optional(),\n  contentType: z.string().optional(),\n  lastModified: z.string().optional(),\n  contentLength: z.number().int().nonnegative().optional(),\n}).strict();\n\nconst AccountSpaceSchema = z.object({\n  spaceId: z.string().min(1),\n  name: z.string().min(1),\n  ownerDid: z.string(),\n  type: z.enum([\"owned\", \"delegated\", \"discovered\"]),\n  permissions: z.array(z.string()),\n  status: z.enum([\"active\", \"archived\"]),\n  registeredAt: z.string().optional(),\n  updatedAt: z.string().optional(),\n  expiresAt: z.string().datetime({ offset: true }).optional(),\n}).strict();\nconst AccountSpacesOutputSchema: z.ZodType<AccountSpacesOutput> = z.object({\n  spaces: z.array(AccountSpaceSchema),\n  count: z.number().int().nonnegative(),\n}).strict();\n\nconst AccountApplicationSchema = z.object({\n  appId: z.string().min(1),\n  manifests: z.array(z.record(z.unknown())),\n  updatedAt: z.string().optional(),\n  name: z.string().optional(),\n  description: z.string().optional(),\n  manifestHash: z.string().optional(),\n}).strict();\nconst AccountApplicationsOutputSchema: z.ZodType<AccountApplicationsOutput> = z.object({\n  applications: z.array(AccountApplicationSchema),\n  count: z.number().int().nonnegative(),\n}).strict();\n\nconst KvListInputSchema: z.ZodType<KvListInput> = z.object({\n  space: SpaceSchema,\n  prefix: PrefixSchema.optional(),\n  limit: LimitSchema.optional(),\n}).strict();\nconst KvListOutputSchema: z.ZodType<KvListOutput> = z.object({\n  space: z.string().min(1),\n  prefix: z.string(),\n  keys: z.array(z.string()),\n  count: z.number().int().nonnegative(),\n  truncated: z.boolean(),\n}).strict();\n\nconst KvGetInputSchema: z.ZodType<KvGetInput> = z.object({\n  space: SpaceSchema,\n  key: KeySchema,\n  representation: z.enum([\"base64\", \"text\", \"json\"]).optional(),\n}).strict();\nconst KvGetOutputSchema: z.ZodType<KvGetOutput> = z.object({\n  space: z.string().min(1),\n  key: z.string().min(1),\n  value: z.union([\n    z.string(),\n    z.number(),\n    z.boolean(),\n    z.null(),\n    z.array(z.unknown()),\n    z.record(z.unknown()),\n  ]),\n  encoding: z.enum([\"json\", \"text\", \"base64\"]),\n  metadata: KvMetadataSchema,\n  byteLength: z.number().int().nonnegative(),\n}).strict();\n\nconst KvPutContentSchema: z.ZodType<KvPutContent> = z.discriminatedUnion(\"encoding\", [\n  z.object({ encoding: z.literal(\"utf8\"), value: z.string() }).strict(),\n  z.object({ encoding: z.literal(\"json\"), value: JsonValueSchema }).strict(),\n  z.object({ encoding: z.literal(\"base64\"), value: z.string() }).strict(),\n]).superRefine((content, context) => {\n  const decoded = decodeKvPutContent(content);\n  if (decoded === undefined) {\n    context.addIssue({ code: z.ZodIssueCode.custom, message: \"Invalid canonical base64 content.\" });\n  } else if (decoded.byteLength > MAX_KV_VALUE_BYTES) {\n    context.addIssue({\n      code: z.ZodIssueCode.too_big,\n      type: \"array\",\n      maximum: MAX_KV_VALUE_BYTES,\n      inclusive: true,\n      message: `KV content must not exceed ${MAX_KV_VALUE_BYTES} bytes.`,\n    });\n  }\n});\nconst KvPutCommonSchema = {\n  space: SpaceSchema,\n  key: KeySchema,\n  content: KvPutContentSchema,\n  contentType: ContentTypeSchema.optional(),\n};\nconst KvPutInputSchema: z.ZodType<KvPutInput> = z.discriminatedUnion(\"mode\", [\n  z.object({ ...KvPutCommonSchema, mode: z.literal(\"create\") }).strict(),\n  z.object({ ...KvPutCommonSchema, mode: z.literal(\"upsert\") }).strict(),\n  z.object({ ...KvPutCommonSchema, mode: z.literal(\"replace\"), etag: StrongEtagSchema }).strict(),\n]);\nconst KvPutOutputSchema: z.ZodType<KvPutOutput> = z.object({\n  space: z.string().min(1),\n  key: z.string().min(1),\n  mode: z.enum([\"create\", \"replace\", \"upsert\"]),\n  byteLength: z.number().int().nonnegative(),\n  metadata: KvMetadataSchema,\n}).strict();\nconst KvHeadInputSchema: z.ZodType<KvHeadInput> = z.object({ space: SpaceSchema, key: KeySchema }).strict();\nconst KvHeadOutputSchema: z.ZodType<KvHeadOutput> = z.object({\n  space: z.string().min(1), key: z.string().min(1), metadata: KvMetadataSchema,\n}).strict();\nconst KvDeleteInputSchema: z.ZodType<KvDeleteInput> = z.object({\n  space: SpaceSchema, key: KeySchema, etag: StrongEtagSchema.optional(),\n}).strict();\nconst KvDeleteOutputSchema: z.ZodType<KvDeleteOutput> = z.object({\n  space: z.string().min(1), key: z.string().min(1), deleted: z.literal(true), etag: z.string().optional(),\n}).strict();\n\nconst AUTHENTICATED_POSTURES: readonly TinyCloudPosture[] = [\n  \"owner-openkey\",\n  \"delegate-session\",\n  \"local-owner-key\",\n];\nconst EXPLORATION_EXPOSURE: OperationExposure = {\n  cli: {\n    status: \"excluded\",\n    reason: \"Existing account and KV Commander commands remain the CLI surface.\",\n  },\n  mcp: { status: \"required\" },\n  skill: { status: \"required\" },\n  docs: { status: \"required\" },\n};\n\nconst ACCOUNT_SPACES_SENSITIVITY: OperationSensitivity = {\n  input: [],\n  output: [\"/spaces\"],\n};\nconst ACCOUNT_APPLICATIONS_SENSITIVITY: OperationSensitivity = {\n  input: [],\n  output: [\"/applications\"],\n};\nconst KV_LIST_SENSITIVITY: OperationSensitivity = {\n  input: [\"/prefix\"],\n  output: [\"/keys\"],\n};\nconst KV_GET_SENSITIVITY: OperationSensitivity = {\n  input: [\"/key\"],\n  output: [\"/value\"],\n};\nconst KV_PUT_SENSITIVITY: OperationSensitivity = { input: [\"/key\", \"/content\"], output: [] };\nconst KV_KEY_SENSITIVITY: OperationSensitivity = { input: [\"/key\"], output: [] };\n\ntype ExplorationDefinition =\n  | OperationDefinition<EmptyInput, AccountSpacesOutput>\n  | OperationDefinition<EmptyInput, AccountApplicationsOutput>\n  | OperationDefinition<KvListInput, KvListOutput>\n  | OperationDefinition<KvGetInput, KvGetOutput>\n  | OperationDefinition<KvPutInput, KvPutOutput>\n  | OperationDefinition<KvHeadInput, KvHeadOutput>\n  | OperationDefinition<KvDeleteInput, KvDeleteOutput>;\n\nexport const explorationOperationDefinitions: readonly ExplorationDefinition[] = [\n  {\n    id: \"tinycloud.account.spaces.list\",\n    version: 1,\n    title: \"List TinyCloud account spaces\",\n    description: \"List the spaces registered in the selected owner's TinyCloud account.\",\n    input: EmptyInputSchema,\n    output: AccountSpacesOutputSchema,\n    effects: [\"read\"],\n    runtime: \"authenticated\",\n    postures: AUTHENTICATED_POSTURES,\n    exposure: EXPLORATION_EXPOSURE,\n    sensitivity: ACCOUNT_SPACES_SENSITIVITY,\n    authority: (context: RuntimeOperationContext) => planAccountRegistryRead(context, \"spaces/\"),\n    execute: executeAccountSpacesList,\n  },\n  {\n    id: \"tinycloud.account.applications.list\",\n    version: 1,\n    title: \"List TinyCloud account applications\",\n    description: \"List the application manifests registered in the selected owner's TinyCloud account.\",\n    input: EmptyInputSchema,\n    output: AccountApplicationsOutputSchema,\n    effects: [\"read\"],\n    runtime: \"authenticated\",\n    postures: AUTHENTICATED_POSTURES,\n    exposure: EXPLORATION_EXPOSURE,\n    sensitivity: ACCOUNT_APPLICATIONS_SENSITIVITY,\n    authority: (context: RuntimeOperationContext) => planAccountRegistryRead(context, \"applications/\"),\n    execute: executeAccountApplicationsList,\n  },\n  {\n    id: \"tinycloud.kv.list\",\n    version: 1,\n    title: \"List TinyCloud KV keys\",\n    description: \"List keys at one exact prefix in a delegated TinyCloud space.\",\n    input: KvListInputSchema,\n    output: KvListOutputSchema,\n    effects: [\"read\"],\n    runtime: \"authenticated\",\n    postures: AUTHENTICATED_POSTURES,\n    exposure: EXPLORATION_EXPOSURE,\n    sensitivity: KV_LIST_SENSITIVITY,\n    authority: planKvList,\n    execute: executeKvList,\n  },\n  {\n    id: \"tinycloud.kv.get\",\n    version: 1,\n    title: \"Get a TinyCloud KV value\",\n    description: \"Read one exact key with a node-enforced one MiB response limit.\",\n    input: KvGetInputSchema,\n    output: KvGetOutputSchema,\n    effects: [\"read\"],\n    runtime: \"authenticated\",\n    postures: AUTHENTICATED_POSTURES,\n    exposure: EXPLORATION_EXPOSURE,\n    sensitivity: KV_GET_SENSITIVITY,\n    authority: planKvGet,\n    execute: executeKvGet,\n  },\n  {\n    id: \"tinycloud.kv.head\", version: 1, title: \"Inspect TinyCloud KV metadata\",\n    description: \"Read metadata for one exact key without downloading its value.\",\n    input: KvHeadInputSchema, output: KvHeadOutputSchema, effects: [\"read\"], runtime: \"authenticated\",\n    postures: AUTHENTICATED_POSTURES, exposure: EXPLORATION_EXPOSURE, sensitivity: KV_KEY_SENSITIVITY,\n    authority: (context: RuntimeOperationContext, input: KvHeadInput) =>\n      planExactKv(context, input.space, input.key, \"tinycloud.kv/metadata\"),\n    execute: executeKvHead,\n  },\n  {\n    id: \"tinycloud.kv.put\", version: 1, title: \"Write a TinyCloud KV value\",\n    description: \"Create, conditionally replace, or explicitly upsert one exact KV key.\",\n    input: KvPutInputSchema, output: KvPutOutputSchema, effects: [\"write\"], runtime: \"authenticated\",\n    postures: AUTHENTICATED_POSTURES, exposure: EXPLORATION_EXPOSURE, sensitivity: KV_PUT_SENSITIVITY,\n    authority: (context: RuntimeOperationContext, input: KvPutInput) =>\n      planExactKv(context, input.space, input.key, \"tinycloud.kv/put\"),\n    execute: executeKvPut,\n  },\n  {\n    id: \"tinycloud.kv.delete\", version: 1, title: \"Delete a TinyCloud KV value\",\n    description: \"Delete one exact KV key, optionally only when its ETag still matches.\",\n    input: KvDeleteInputSchema, output: KvDeleteOutputSchema, effects: [\"destructive\"], runtime: \"authenticated\",\n    postures: AUTHENTICATED_POSTURES, exposure: EXPLORATION_EXPOSURE, sensitivity: KV_KEY_SENSITIVITY,\n    authority: (context: RuntimeOperationContext, input: KvDeleteInput) =>\n      planExactKv(context, input.space, input.key, \"tinycloud.kv/del\"),\n    execute: executeKvDelete,\n  },\n];\n\nasync function planAccountRegistryRead(\n  context: RuntimeOperationContext,\n  path: \"spaces/\" | \"applications/\",\n): Promise<readonly CapabilityRequirement[]> {\n  return [{\n    service: \"tinycloud.kv\",\n    space: resolveSpace(context, \"account\"),\n    path,\n    actions: [\"tinycloud.kv/get\", \"tinycloud.kv/list\"],\n  }];\n}\n\nasync function planKvList(\n  context: RuntimeOperationContext,\n  input: KvListInput,\n): Promise<readonly CapabilityRequirement[]> {\n  const space = resolveGenericKvSpace(context, input.space);\n  return [{\n    service: \"tinycloud.kv\",\n    space,\n    path: input.prefix ?? \"\",\n    actions: [\"tinycloud.kv/list\"],\n  }];\n}\n\nasync function planKvGet(\n  context: RuntimeOperationContext,\n  input: KvGetInput,\n): Promise<readonly CapabilityRequirement[]> {\n  const space = resolveGenericKvSpace(context, input.space);\n  return [{\n    service: \"tinycloud.kv\",\n    space,\n    path: input.key,\n    actions: [\"tinycloud.kv/get\"],\n  }];\n}\n\nasync function planExactKv(\n  context: RuntimeOperationContext,\n  requestedSpace: string,\n  key: string,\n  action: \"tinycloud.kv/metadata\" | \"tinycloud.kv/put\" | \"tinycloud.kv/del\",\n): Promise<readonly CapabilityRequirement[]> {\n  return [{\n    service: \"tinycloud.kv\",\n    space: resolveGenericKvSpace(context, requestedSpace),\n    path: key,\n    actions: [action],\n  }];\n}\n\nasync function executeAccountSpacesList(\n  context: OperationContext,\n  _input: EmptyInput,\n): Promise<OperationExecutionOutcome<AccountSpacesOutput>> {\n  try {\n    const entries = await readAccountRegistry(context, \"spaces/\");\n    if (!entries.ok) return entries.outcome;\n    const spaces = entries.records\n      .map(({ key, value }) => projectAccountSpace(key, value))\n      .sort((left, right) => left.name.localeCompare(right.name) || left.spaceId.localeCompare(right.spaceId));\n    const output = { spaces, count: spaces.length };\n    return accountRegistryOutput(output);\n  } catch (error) {\n    return caughtKvFailure(error, \"list account spaces\");\n  }\n}\n\nasync function executeAccountApplicationsList(\n  context: OperationContext,\n  _input: EmptyInput,\n): Promise<OperationExecutionOutcome<AccountApplicationsOutput>> {\n  try {\n    const entries = await readAccountRegistry(context, \"applications/\");\n    if (!entries.ok) return entries.outcome;\n    const applications = entries.records\n      .map(({ key, value }) => projectAccountApplication(key, value))\n      .sort((left, right) => left.appId.localeCompare(right.appId));\n    const output = { applications, count: applications.length };\n    return accountRegistryOutput(output);\n  } catch (error) {\n    return caughtKvFailure(error, \"list account applications\");\n  }\n}\n\nasync function executeKvList(\n  context: OperationContext,\n  input: KvListInput,\n): Promise<OperationExecutionOutcome<KvListOutput>> {\n  try {\n    const runtime = runtimeContext(context);\n    const space = resolveGenericKvSpace(runtime, input.space);\n    const result = await genericKv(runtime, space).list({\n      ...(input.prefix === undefined ? {} : { prefix: input.prefix }),\n      limit: input.limit ?? DEFAULT_KV_LIST_LIMIT,\n    });\n    if (!result.ok) return kvFailure(result.error, \"list KV keys\");\n    const keys = [...result.data.keys];\n    return {\n      status: \"ok\",\n      output: {\n        space,\n        prefix: input.prefix ?? \"\",\n        keys,\n        count: keys.length,\n        truncated: result.data.truncated ?? false,\n      },\n    };\n  } catch (error) {\n    return caughtKvFailure(error, \"list KV keys\");\n  }\n}\n\nasync function executeKvGet(\n  context: OperationContext,\n  input: KvGetInput,\n): Promise<OperationExecutionOutcome<KvGetOutput>> {\n  try {\n    const runtime = runtimeContext(context);\n    const space = resolveGenericKvSpace(runtime, input.space);\n    const result = await genericKv(runtime, space).get(input.key, {\n      binary: true,\n      maxResponseBytes: MAX_KV_VALUE_BYTES,\n    });\n    if (!result.ok) return kvFailure(result.error, \"read the KV value\");\n    const bytes = result.data.data;\n    if (bytes.byteLength > MAX_KV_VALUE_BYTES) {\n      return kvFailure({ code: \"KV_RESPONSE_TOO_LARGE\" }, \"read the KV value\");\n    }\n    const encoded = encodeKvValue(bytes, input.representation ?? \"base64\");\n    if (!encoded.ok) return encoded.outcome;\n    return {\n      status: \"ok\",\n      output: {\n        space,\n        key: input.key,\n        value: encoded.value,\n        encoding: encoded.encoding,\n        metadata: projectKvMetadata(result.data.headers),\n        byteLength: bytes.byteLength,\n      },\n    };\n  } catch (error) {\n    return caughtKvFailure(error, \"read the KV value\");\n  }\n}\n\nasync function executeKvHead(\n  context: OperationContext,\n  input: KvHeadInput,\n): Promise<OperationExecutionOutcome<KvHeadOutput>> {\n  try {\n    const runtime = runtimeContext(context);\n    const space = resolveGenericKvSpace(runtime, input.space);\n    const result = await genericKv(runtime, space).head(input.key);\n    if (!result.ok) return kvFailure(result.error, \"read KV metadata\");\n    return { status: \"ok\", output: { space, key: input.key, metadata: projectKvMetadata(result.data.headers) } };\n  } catch (error) {\n    return caughtKvFailure(error, \"read KV metadata\");\n  }\n}\n\nasync function executeKvPut(\n  context: OperationContext,\n  input: KvPutInput,\n): Promise<OperationExecutionOutcome<KvPutOutput>> {\n  try {\n    const runtime = runtimeContext(context);\n    const space = resolveGenericKvSpace(runtime, input.space);\n    const decoded = decodeKvPutContent(input.content);\n    if (decoded === undefined || decoded.byteLength > MAX_KV_VALUE_BYTES) {\n      return { status: \"error\", error: operationError(\"INPUT_INVALID\", \"The KV content is invalid or too large.\") };\n    }\n    const result = await genericKv(runtime, space).put(input.key, decoded.bytes, {\n      contentType: input.contentType ?? decoded.contentType,\n      ...(input.mode === \"create\" ? { ifNoneMatch: \"*\" as const } : {}),\n      ...(input.mode === \"replace\" ? { ifMatch: input.etag } : {}),\n    });\n    if (!result.ok) return kvFailure(result.error, \"write the KV value\");\n    return {\n      status: \"ok\",\n      output: {\n        space,\n        key: input.key,\n        mode: input.mode,\n        byteLength: decoded.byteLength,\n        metadata: projectKvMetadata(result.data.headers),\n      },\n    };\n  } catch (error) {\n    return caughtKvFailure(error, \"write the KV value\");\n  }\n}\n\nasync function executeKvDelete(\n  context: OperationContext,\n  input: KvDeleteInput,\n): Promise<OperationExecutionOutcome<KvDeleteOutput>> {\n  try {\n    const runtime = runtimeContext(context);\n    const space = resolveGenericKvSpace(runtime, input.space);\n    const result = await genericKv(runtime, space).delete(input.key, {\n      ...(input.etag === undefined ? {} : { ifMatch: input.etag }),\n    });\n    if (!result.ok) return kvFailure(result.error, \"delete the KV value\");\n    return {\n      status: \"ok\",\n      output: {\n        space,\n        key: input.key,\n        deleted: true,\n        ...(result.data.headers.etag === undefined ? {} : { etag: result.data.headers.etag }),\n      },\n    };\n  } catch (error) {\n    return caughtKvFailure(error, \"delete the KV value\");\n  }\n}\n\nfunction runtimeContext(context: OperationContext): RuntimeOperationContext {\n  if (context.runtime === undefined) {\n    throw new TypeError(\"Authenticated operation runtime is unavailable.\");\n  }\n  return context as RuntimeOperationContext;\n}\n\nfunction runtimeNode(context: OperationContext): TinyCloudNode {\n  return runtimeContext(context).runtime.node as TinyCloudNode;\n}\n\nfunction genericKv(context: RuntimeOperationContext, space: string): KvOperationHandle {\n  return runtimeNode(context).kvForSpace(space) as unknown as KvOperationHandle;\n}\n\nfunction resolveSpace(context: RuntimeOperationContext, space: string): string {\n  return operationSpaceResolver(context.runtime.node, context.summary.space)(space);\n}\n\nfunction resolveGenericKvSpace(context: RuntimeOperationContext, space: string): string {\n  const resolved = resolveSpace(context, space);\n  const protectedName = resolved.split(\":\").at(-1)?.toLowerCase();\n  if (protectedName === \"secrets\" || protectedName === \"account\") {\n    throw new OperationInvocationError(operationError(\n      \"INPUT_INVALID\",\n      \"Generic KV operations cannot access TinyCloud account or secrets spaces.\",\n    ));\n  }\n  return resolved;\n}\n\nasync function readAccountRegistry(\n  context: OperationContext,\n  prefix: \"spaces/\" | \"applications/\",\n): Promise<\n  | Readonly<{ ok: true; records: readonly Readonly<{ key: string; value: Record<string, unknown> }>[] }>\n  | Readonly<{ ok: false; outcome: OperationExecutionOutcome<never> }>\n> {\n  const runtime = runtimeContext(context);\n  const accountSpace = resolveSpace(runtime, \"account\");\n  const kv = runtimeNode(runtime).kvForSpace(accountSpace) as unknown as KvOperationHandle;\n  const listed = await kv.list({ prefix, limit: MAX_ACCOUNT_REGISTRY_RECORDS });\n  if (!listed.ok) return { ok: false, outcome: kvFailure(listed.error, \"list the account registry\") };\n  if (listed.data.truncated === true) {\n    return {\n      ok: false,\n      outcome: {\n        status: \"error\",\n        error: operationError(\n          \"OUTPUT_INVALID\",\n          `The TinyCloud account registry exceeds the ${MAX_ACCOUNT_REGISTRY_RECORDS}-record exploration limit.`,\n        ),\n      },\n    };\n  }\n\n  const records: Array<Readonly<{ key: string; value: Record<string, unknown> }>> = [];\n  let totalBytes = 0;\n  for (const key of listed.data.keys) {\n    const loaded = await kv.get(key, {\n      binary: true,\n      maxResponseBytes: MAX_KV_VALUE_BYTES,\n    });\n    if (!loaded.ok) {\n      return { ok: false, outcome: kvFailure(loaded.error, \"read the account registry\") };\n    }\n    const bytes = loaded.data.data;\n    totalBytes += bytes.byteLength;\n    if (bytes.byteLength > MAX_KV_VALUE_BYTES || totalBytes > MAX_ACCOUNT_REGISTRY_BYTES) {\n      return {\n        ok: false,\n        outcome: {\n          status: \"error\",\n          error: operationError(\n            \"KV_RESPONSE_TOO_LARGE\",\n            `The TinyCloud account registry exceeds the ${MAX_ACCOUNT_REGISTRY_BYTES}-byte exploration limit.`,\n          ),\n        },\n      };\n    }\n    try {\n      const value: unknown = JSON.parse(new TextDecoder(\"utf-8\", { fatal: true }).decode(bytes));\n      if (!isRecord(value)) throw new TypeError(\"Account registry values must be JSON objects.\");\n      records.push({ key, value });\n    } catch {\n      return {\n        ok: false,\n        outcome: {\n          status: \"error\",\n          error: operationError(\"OUTPUT_INVALID\", \"The TinyCloud account registry contains an invalid record.\"),\n        },\n      };\n    }\n  }\n  return { ok: true, records };\n}\n\nfunction projectAccountSpace(\n  key: string,\n  record: Record<string, unknown>,\n): AccountSpacesOutput[\"spaces\"][number] {\n  const suffix = key.startsWith(\"spaces/\") ? key.slice(\"spaces/\".length) : key;\n  const rawSpaceId = stringField(record, \"space_id\", \"spaceId\") ?? suffix;\n  const rawName = stringField(record, \"name\") ?? rawSpaceId.split(\":\").at(-1) ?? rawSpaceId;\n  const rawType = stringField(record, \"type\");\n  const rawStatus = stringField(record, \"status\");\n  const rawExpiresAt = record.expires_at ?? record.expiresAt;\n  const expiresAt = rawExpiresAt instanceof Date\n    ? rawExpiresAt.toISOString()\n    : typeof rawExpiresAt === \"string\" && !Number.isNaN(new Date(rawExpiresAt).getTime())\n    ? new Date(rawExpiresAt).toISOString()\n    : undefined;\n  return {\n    spaceId: rawSpaceId,\n    name: rawName,\n    ownerDid: stringField(record, \"owner_did\", \"ownerDid\", \"owner\") ?? \"\",\n    type: rawType === \"owned\" || rawType === \"delegated\" ? rawType : \"discovered\",\n    permissions: Array.isArray(record.permissions)\n      ? record.permissions.filter((value): value is string => typeof value === \"string\")\n      : [],\n    status: rawStatus === \"archived\" ? \"archived\" : \"active\",\n    ...(stringField(record, \"registered_at\", \"registeredAt\") === undefined\n      ? {}\n      : { registeredAt: stringField(record, \"registered_at\", \"registeredAt\") }),\n    ...(stringField(record, \"updated_at\", \"updatedAt\") === undefined\n      ? {}\n      : { updatedAt: stringField(record, \"updated_at\", \"updatedAt\") }),\n    ...(expiresAt === undefined ? {} : { expiresAt }),\n  };\n}\n\nfunction projectAccountApplication(\n  key: string,\n  record: Record<string, unknown>,\n): AccountApplicationsOutput[\"applications\"][number] {\n  const manifests = Array.isArray(record.manifests)\n    ? record.manifests.filter(isRecord)\n    : [];\n  const first = manifests[0];\n  return {\n    appId: stringField(record, \"app_id\", \"appId\") ??\n      stringField(first, \"app_id\") ??\n      (key.startsWith(\"applications/\") ? key.slice(\"applications/\".length) : key),\n    manifests,\n    ...(stringField(record, \"updated_at\", \"updatedAt\") === undefined\n      ? {}\n      : { updatedAt: stringField(record, \"updated_at\", \"updatedAt\") }),\n    ...(stringField(first, \"name\") === undefined ? {} : { name: stringField(first, \"name\") }),\n    ...(stringField(first, \"description\") === undefined\n      ? {}\n      : { description: stringField(first, \"description\") }),\n    ...(stringField(record, \"manifest_hash\", \"manifestHash\") === undefined\n      ? {}\n      : { manifestHash: stringField(record, \"manifest_hash\", \"manifestHash\") }),\n  };\n}\n\nfunction stringField(\n  record: Record<string, unknown> | undefined,\n  ...keys: readonly string[]\n): string | undefined {\n  if (record === undefined) return undefined;\n  for (const key of keys) {\n    if (typeof record[key] === \"string\") return record[key];\n  }\n  return undefined;\n}\n\nfunction isRecord(value: unknown): value is Record<string, unknown> {\n  return typeof value === \"object\" && value !== null && !Array.isArray(value);\n}\n\nfunction encodeKvValue(\n  value: Uint8Array,\n  representation: NonNullable<KvGetInput[\"representation\"]>,\n):\n  | Readonly<{ ok: true; value: unknown; encoding: KvGetOutput[\"encoding\"] }>\n  | Readonly<{ ok: false; outcome: OperationExecutionOutcome<KvGetOutput> }> {\n  if (representation === \"base64\") {\n    return { ok: true, value: Buffer.from(value).toString(\"base64\"), encoding: \"base64\" };\n  }\n  let text: string;\n  try {\n    text = new TextDecoder(\"utf-8\", { fatal: true }).decode(value);\n  } catch {\n    return {\n      ok: false,\n      outcome: { status: \"error\", error: operationError(\"OUTPUT_INVALID\", \"The KV value is not valid UTF-8.\") },\n    };\n  }\n  if (representation === \"text\") return { ok: true, value: text, encoding: \"text\" };\n  try {\n    const parsed = JsonValueSchema.safeParse(JSON.parse(text));\n    if (!parsed.success) {\n      return {\n        ok: false,\n        outcome: {\n          status: \"error\",\n          error: operationError(\n            \"OUTPUT_INVALID\",\n            \"The KV JSON contains a number that cannot be represented safely.\",\n          ),\n        },\n      };\n    }\n    return { ok: true, value: parsed.data, encoding: \"json\" };\n  } catch {\n    return {\n      ok: false,\n      outcome: { status: \"error\", error: operationError(\"OUTPUT_INVALID\", \"The KV value is not valid JSON.\") },\n    };\n  }\n}\n\nfunction decodeKvPutContent(content: KvPutContent):\n  | Readonly<{ bytes: Uint8Array; byteLength: number; contentType: string }>\n  | undefined {\n  let bytes: Uint8Array;\n  let contentType: string;\n  if (content.encoding === \"utf8\") {\n    bytes = new TextEncoder().encode(content.value);\n    contentType = \"text/plain;charset=UTF-8\";\n  } else if (content.encoding === \"json\") {\n    bytes = new TextEncoder().encode(JSON.stringify(content.value));\n    contentType = \"application/json\";\n  } else {\n    if (!isCanonicalBase64(content.value)) return undefined;\n    bytes = new Uint8Array(Buffer.from(content.value, \"base64\"));\n    contentType = \"application/octet-stream\";\n  }\n  return { bytes, byteLength: bytes.byteLength, contentType };\n}\n\nfunction isCanonicalBase64(value: string): boolean {\n  if (value.length % 4 !== 0 || !/^(?:[A-Za-z0-9+/]{4})*(?:[A-Za-z0-9+/]{2}==|[A-Za-z0-9+/]{3}=)?$/.test(value)) {\n    return false;\n  }\n  return Buffer.from(value, \"base64\").toString(\"base64\") === value;\n}\n\nfunction projectKvMetadata(headers: {\n  readonly etag?: string;\n  readonly contentType?: string;\n  readonly lastModified?: string;\n  readonly contentLength?: number;\n}): KvMetadata {\n  return {\n    ...(headers.etag === undefined ? {} : { etag: headers.etag }),\n    ...(headers.contentType === undefined ? {} : { contentType: headers.contentType }),\n    ...(headers.lastModified === undefined ? {} : { lastModified: headers.lastModified }),\n    ...(headers.contentLength === undefined ? {} : { contentLength: headers.contentLength }),\n  };\n}\n\nfunction caughtKvFailure(error: unknown, action: string): OperationExecutionOutcome<never> {\n  if (error instanceof OperationInvocationError) return { status: \"error\", error: error.operationError };\n  return authorizationFailure(error, action) ?? nodeFailure(action);\n}\n\nexport function authorizationFailure(error: unknown, action: string): OperationExecutionOutcome<never> | undefined {\n  const verdict = authorizationVerdictOf(error);\n  if (verdict === \"unauthenticated\") {\n    if (validatedCapabilityOf(error) !== undefined) {\n      return { status: \"error\", error: operationError(\"PERMISSION_DENIED\", `Permission is denied to ${action}.`) };\n    }\n    return { status: \"error\", error: operationError(\"AUTH_REQUIRED\", `Authentication is required to ${action}.`) };\n  }\n  if (verdict === \"forbidden\") {\n    return { status: \"error\", error: operationError(\"PERMISSION_DENIED\", `Permission is denied to ${action}.`) };\n  }\n  return undefined;\n}\n\nfunction accountRegistryOutput<T>(output: T): OperationExecutionOutcome<T> {\n  if (Buffer.byteLength(JSON.stringify(output), \"utf8\") > MAX_ACCOUNT_REGISTRY_BYTES) {\n    return {\n      status: \"error\",\n      error: operationError(\n        \"KV_RESPONSE_TOO_LARGE\",\n        `The TinyCloud account registry exceeds the ${MAX_ACCOUNT_REGISTRY_BYTES}-byte exploration limit.`,\n      ),\n    };\n  }\n  return { status: \"ok\", output };\n}\n\nfunction kvFailure(\n  error: Readonly<{ code?: string; meta?: Readonly<Record<string, unknown>> }>,\n  action: string,\n): OperationExecutionOutcome<never> {\n  const auth = authorizationFailure(error, action);\n  if (auth !== undefined) return auth;\n  if (error.code === \"KV_NOT_FOUND\") {\n    return { status: \"error\", error: operationError(\"KV_NOT_FOUND\", \"The TinyCloud KV key was not found.\") };\n  }\n  if (error.code === \"KV_PRECONDITION_FAILED\") {\n    return { status: \"error\", error: operationError(\"KV_PRECONDITION_FAILED\", \"The TinyCloud KV object changed or already exists.\") };\n  }\n  if (error.code === \"KV_CONFLICT\") {\n    return {\n      status: \"error\",\n      error: operationError(\n        \"KV_CONFLICT\",\n        \"A database serialization conflict prevented the conditional KV mutation; re-read the key state, which may still be absent, before deciding whether to retry.\",\n        { retryable: true },\n      ),\n    };\n  }\n  if (error.code === \"KV_RESPONSE_TOO_LARGE\") {\n    return { status: \"error\", error: operationError(\"KV_RESPONSE_TOO_LARGE\", `The TinyCloud KV value exceeds ${MAX_KV_VALUE_BYTES} bytes.`) };\n  }\n  const storageFull = storageFullOperationError(error);\n  if (storageFull) return { status: \"error\", error: storageFull };\n  return nodeFailure(action);\n}\n\nfunction nodeFailure(action: string): OperationExecutionOutcome<never> {\n  return {\n    status: \"error\",\n    error: operationError(\n      \"NODE_ERROR\",\n      `The TinyCloud node could not ${action}.`,\n      { retryable: true },\n    ),\n  };\n}\n","import { z } from \"zod\";\nimport type { SecretReadResult } from \"@tinycloud/node-sdk\";\n\nimport {\n  type OperationContext,\n  type CapabilityRequirement,\n  type OperationDefinition,\n  type OperationExecutionOutcome,\n  type OperationExposure,\n  type OperationSensitivity,\n  type RuntimeOperationContext,\n  type TinyCloudPosture,\n} from \"../contract.js\";\nimport { OperationInvocationError, operationError } from \"../errors.js\";\nimport {\n  buildSecretSetupUrl,\n  normalizeSecretsGetInput,\n  operationSpaceResolver,\n  resolveSecretReference,\n  resolveSecretReferenceForOperation,\n  type SecretReference,\n  type SecretsGetInput,\n} from \"../secrets.js\";\n\ninterface SecretsGetOutput {\n  readonly value: string;\n}\n\nconst SecretsGetInputSchema: z.ZodType<SecretsGetInput> = z.object({\n  name: z.string(),\n  scope: z.string().optional(),\n  space: z.string().optional(),\n}).strict().superRefine((input, context) => {\n  try {\n    resolveSecretReference(input);\n  } catch {\n    context.addIssue({ code: z.ZodIssueCode.custom, message: \"Invalid secret reference.\" });\n  }\n}).transform(normalizeSecretsGetInput);\n\nconst SecretsGetOutputSchema: z.ZodType<SecretsGetOutput> = z.object({\n  value: z.string(),\n}).strict();\n\nconst SECRETS_GET_POSTURES: readonly TinyCloudPosture[] = [\n  \"owner-openkey\",\n  \"delegate-session\",\n  \"local-owner-key\",\n];\n\nconst SECRETS_GET_EXPOSURE: OperationExposure = {\n  cli: { status: \"required\" },\n  mcp: { status: \"required\" },\n  skill: { status: \"required\" },\n  docs: { status: \"required\" },\n};\n\nconst SECRETS_GET_SENSITIVITY: OperationSensitivity = {\n  input: [],\n  output: [\"/value\"],\n};\n\nexport const secretsGetOperationDefinition: OperationDefinition<SecretsGetInput, SecretsGetOutput> = {\n  id: \"tinycloud.secrets.get\",\n  version: 1,\n  title: \"Get a TinyCloud secret\",\n  description: \"Read and decrypt one secret from the selected TinyCloud secrets space.\",\n  input: SecretsGetInputSchema,\n  output: SecretsGetOutputSchema,\n  effects: [\"read\", \"local_write\"],\n  runtime: \"authenticated\",\n  postures: SECRETS_GET_POSTURES,\n  exposure: SECRETS_GET_EXPOSURE,\n  sensitivity: SECRETS_GET_SENSITIVITY,\n  authority: planSecretGet,\n  execute: executeSecretGet,\n};\n\nexport const secretsGetOperationDefinitions: readonly [typeof secretsGetOperationDefinition] = [\n  secretsGetOperationDefinition,\n];\n\nasync function planSecretGet(\n  context: RuntimeOperationContext,\n  input: SecretsGetInput,\n): Promise<readonly CapabilityRequirement[]> {\n  const reference = resolveSecretReferenceForOperation(\n    input,\n    context.runtime.node,\n    context.summary.space,\n  );\n  let networkSpace = reference.space;\n  if (input.space === undefined) {\n    try {\n      networkSpace = operationSpaceResolver(\n        context.runtime.node,\n        context.summary.space,\n      )(\"secrets\");\n    } catch {\n      // Definition-focused callers may omit authenticated identity metadata;\n      // the runtime path supplies the owner space before production planning.\n    }\n  }\n  const networkId = resolveEncryptionNetworkId(context.runtime.node, networkSpace);\n\n  return [\n    {\n      service: \"tinycloud.kv\",\n      space: reference.space,\n      path: reference.permissionPath,\n      actions: [\"tinycloud.kv/get\"],\n    },\n    {\n      service: \"tinycloud.encryption\",\n      path: networkId,\n      actions: [\"tinycloud.encryption/decrypt\"],\n    },\n  ];\n}\n\nasync function executeSecretGet(\n  context: OperationContext,\n  input: SecretsGetInput,\n): Promise<OperationExecutionOutcome<SecretsGetOutput>> {\n  const reference = resolveSecretReferenceForOperation(\n    input,\n    context.runtime?.node,\n    context.summary.space,\n  );\n  const node = context.runtime?.node as SecretReadingNode | undefined;\n  if (node === undefined || typeof node.readSecret !== \"function\") {\n    return {\n      status: \"error\",\n      error: operationError(\n        \"NODE_ERROR\",\n        \"The TinyCloud node could not read the secret.\",\n        { retryable: true },\n      ),\n    };\n  }\n\n  let result: SecretReadResult;\n  try {\n    result = await node.readSecret({\n      space: reference.space,\n      name: reference.name,\n      ...(reference.scope === undefined ? {} : { scope: reference.scope }),\n    });\n  } catch {\n    return {\n      status: \"error\",\n      error: operationError(\n        \"NODE_ERROR\",\n        \"The TinyCloud node could not read the secret.\",\n        { retryable: true },\n      ),\n    };\n  }\n\n  return classifySecretRead(reference, result);\n}\n\nfunction classifySecretRead(\n  reference: SecretReference,\n  result: SecretReadResult,\n): OperationExecutionOutcome<SecretsGetOutput> {\n  switch (result.status) {\n    case \"ok\":\n      return { status: \"ok\", output: { value: result.value } };\n    case \"not_found\":\n      return {\n        status: \"setup_required\",\n        setup: {\n          kind: \"secret_manager\",\n          secret: {\n            name: reference.name,\n            ...(reference.scope === undefined ? {} : { scope: reference.scope }),\n            space: reference.space,\n          },\n          url: buildSecretSetupUrl(reference),\n          message: \"Enter this secret in Secret Manager, then retry the operation.\",\n        },\n        requiresCallerInput: true,\n      };\n    case \"permission_required\":\n      return {\n        status: \"authority_required\",\n        missing: [result.hint as unknown as CapabilityRequirement],\n        request: { requestId: \"runtime-hint\" },\n        approval: {\n          kind: \"openkey\",\n          requestId: \"runtime-hint\",\n          fallback: \"tc auth grant <request-artifact>\",\n        },\n      };\n    case \"node_unreachable\":\n      return {\n        status: \"error\",\n        error: operationError(\n          \"NODE_UNREACHABLE\",\n          \"The TinyCloud node could not be reached.\",\n          { retryable: true },\n        ),\n      };\n    case \"read_failed\":\n    case \"corrupt_envelope\":\n      return {\n        status: \"error\",\n        error: operationError(\n          \"SECRET_READ_FAILED\",\n          \"The secret ciphertext could not be read.\",\n        ),\n      };\n    case \"decrypt_failed\":\n    case \"invalid_payload\":\n      return {\n        status: \"error\",\n        error: operationError(\n          \"SECRET_DECRYPT_FAILED\",\n          \"The secret could not be decrypted.\",\n        ),\n      };\n  }\n\n  return {\n    status: \"error\",\n    error: operationError(\"SECRET_READ_FAILED\", \"The secret read failed.\"),\n  };\n}\n\nfunction resolveEncryptionNetworkId(node: unknown, space: string): string {\n  const candidate = node as {\n    getEncryptionNetworkIdForSpace?: (spaceId: string) => unknown;\n    getDefaultEncryptionNetworkId?: () => unknown;\n  };\n\n  let scoped: unknown;\n  try {\n    scoped = candidate.getEncryptionNetworkIdForSpace?.(space);\n  } catch {\n    // A scoped resolver is optional and may fail for a non-primary space.\n  }\n  if (typeof scoped === \"string\" && scoped.length > 0) return scoped;\n\n  let fallback: unknown;\n  try {\n    fallback = candidate.getDefaultEncryptionNetworkId?.();\n  } catch {\n    // Both local sources must fail before the operation reports unresolved.\n  }\n  if (typeof fallback === \"string\" && fallback.length > 0) return fallback;\n\n  throw new OperationInvocationError(\n    operationError(\n      \"ENCRYPTION_NETWORK_UNRESOLVED\",\n      \"The encryption network for the target secrets space could not be resolved.\",\n    ),\n  );\n}\n\ninterface SecretReadingNode {\n  readSecret(input: {\n    space: string;\n    name: string;\n    scope?: string;\n  }): Promise<SecretReadResult>;\n  getEncryptionNetworkIdForSpace?: (spaceId: string) => unknown;\n  getDefaultEncryptionNetworkId?: () => unknown;\n}\n","import type { TinyCloudNode } from \"@tinycloud/node-sdk\";\nimport nodeSqlParser from \"node-sql-parser\";\nimport { z } from \"zod\";\n\nimport type {\n  CapabilityRequirement,\n  OperationContext,\n  OperationDefinition,\n  OperationExecutionOutcome,\n  OperationExposure,\n  OperationSensitivity,\n  RuntimeOperationContext,\n  TinyCloudPosture,\n} from \"../contract.js\";\nimport { OperationInvocationError, operationError, storageFullOperationError } from \"../errors.js\";\nimport { operationSpaceResolver } from \"../secrets.js\";\nimport { authorizationFailure } from \"./exploration.js\";\n\nconst DEFAULT_MAX_ROWS = 100;\nconst MAX_MAX_ROWS = 1_000;\nconst DEFAULT_MAX_BYTES = 1024 * 1024;\nconst MAX_MAX_BYTES = 4 * 1024 * 1024;\nconst SCHEMA_MAX_ROWS = 500;\nconst SCHEMA_MAX_BYTES = 1024 * 1024;\nconst MAX_PARAMETERS = 100;\nconst MAX_SQL_LENGTH = 64 * 1024;\nconst SQL_WRITE_AUTHORITY_NOTICE =\n  \"Approving tinycloud.sql/write grants full read/write/schema mutation authority over this exact database; the MCP tool itself accepts only one parameterized INSERT, UPDATE, or DELETE.\";\n\nconst SCHEMA_QUERY = `SELECT type, name, tbl_name, sql\nFROM sqlite_schema\nWHERE type IN ('table', 'view', 'index', 'trigger')\n  AND name NOT LIKE 'sqlite_%'\nORDER BY type, name`;\n\ntype SqlPrimitive = null | number | string;\ninterface SqlBlob {\n  readonly type: \"blob\";\n  readonly base64: string;\n  readonly byteLength: number;\n}\ntype SqlOutputValue = SqlPrimitive | SqlBlob;\ntype SqlInputValue = SqlPrimitive | Readonly<{ type: \"blob\"; base64: string }>;\n\ninterface SqlTargetInput {\n  readonly space: string;\n  readonly database: string;\n}\n\ninterface SqlQueryInput extends SqlTargetInput {\n  readonly sql: string;\n  readonly params?: readonly SqlInputValue[];\n  readonly maxRows?: number;\n  readonly maxBytes?: number;\n}\n\ninterface SqlExecuteInput extends SqlTargetInput {\n  readonly sql: string;\n  readonly params: readonly SqlInputValue[];\n  readonly acknowledgeDatabaseWideAuthority: true;\n}\n\ninterface SqlLimitsOutput {\n  readonly maxRows: number;\n  readonly maxBytes: number;\n  readonly enforcement: \"node-requested-client-verified\";\n}\n\ninterface SqlSchemaInspectOutput {\n  readonly space: string;\n  readonly database: string;\n  readonly objects: readonly {\n    readonly type: \"table\" | \"view\" | \"index\" | \"trigger\";\n    readonly name: string;\n    readonly tableName: string;\n    readonly sql?: string;\n  }[];\n  readonly count: number;\n  readonly limits: SqlLimitsOutput;\n}\n\ninterface SqlQueryOutput {\n  readonly space: string;\n  readonly database: string;\n  readonly columns: readonly string[];\n  readonly rows: readonly (readonly SqlOutputValue[])[];\n  readonly rowCount: number;\n  readonly limits: SqlLimitsOutput;\n}\n\ninterface SqlExecuteOutput {\n  readonly space: string;\n  readonly database: string;\n  readonly statementType: \"insert\" | \"update\" | \"delete\";\n  readonly changes: number;\n  readonly lastInsertRowId: number | null;\n  readonly authorityNotice: typeof SQL_WRITE_AUTHORITY_NOTICE;\n}\n\nconst sqlParser = new nodeSqlParser.Parser();\n\nconst SpaceSchema = z.string().min(1).refine(\n  (space) =>\n    (/^[A-Za-z0-9_-]+$/.test(space) || space.startsWith(\"tinycloud:\")) &&\n    !space.includes(\"*\"),\n  \"Invalid TinyCloud space.\",\n);\nconst DatabaseSchema = z.string().min(1).max(256).refine(\n  (database) =>\n    database !== \"/\" &&\n    !database.endsWith(\"/\") &&\n    !database.includes(\"*\") &&\n    !/[\\u0000-\\u001f\\u007f]/.test(database),\n  \"Invalid SQLite database name.\",\n);\nconst SafeNumberSchema = z.number().finite().refine(\n  (value) => !Number.isInteger(value) || Number.isSafeInteger(value),\n  \"SQLite integer parameters must be JavaScript safe integers.\",\n);\nconst Base64Schema = z.string().max(Math.ceil(MAX_MAX_BYTES / 3) * 4).refine(\n  isCanonicalBase64,\n  \"Invalid base64 BLOB value.\",\n);\nconst SqlInputValueSchema: z.ZodType<SqlInputValue> = z.union([\n  z.null(),\n  SafeNumberSchema,\n  z.string().max(MAX_MAX_BYTES),\n  z.object({ type: z.literal(\"blob\"), base64: Base64Schema }).strict(),\n]);\nconst SqlParamsSchema = z.array(SqlInputValueSchema).max(MAX_PARAMETERS).superRefine(\n  (params, context) => {\n    const totalBytes = params.reduce<number>(\n      (total, value) => total + sqlInputValueBytes(value),\n      0,\n    );\n    if (totalBytes > MAX_MAX_BYTES) {\n      context.addIssue({\n        code: z.ZodIssueCode.custom,\n        message: \"SQLite query parameters exceed the 4 MiB input limit.\",\n      });\n    }\n  },\n);\nconst RequiredSqlParamsSchema = z.array(SqlInputValueSchema).min(1).max(MAX_PARAMETERS).superRefine(\n  (params, context) => {\n    const totalBytes = params.reduce<number>(\n      (total, value) => total + sqlInputValueBytes(value),\n      0,\n    );\n    if (totalBytes > MAX_MAX_BYTES) {\n      context.addIssue({\n        code: z.ZodIssueCode.custom,\n        message: \"SQLite query parameters exceed the 4 MiB input limit.\",\n      });\n    }\n  },\n);\nconst SqlOutputValueSchema: z.ZodType<SqlOutputValue> = z.union([\n  z.null(),\n  SafeNumberSchema,\n  z.string(),\n  z.object({\n    type: z.literal(\"blob\"),\n    base64: z.string(),\n    byteLength: z.number().int().nonnegative(),\n  }).strict(),\n]);\nconst SqlTargetInputSchema: z.ZodType<SqlTargetInput> = z.object({\n  space: SpaceSchema,\n  database: DatabaseSchema,\n}).strict();\nconst SqlQueryInputSchema: z.ZodType<SqlQueryInput> = z.object({\n  space: SpaceSchema,\n  database: DatabaseSchema,\n  sql: z.string().min(1).max(MAX_SQL_LENGTH).superRefine((sql, context) => {\n    if (!isSingleReadQuery(sql)) {\n      context.addIssue({\n        code: z.ZodIssueCode.custom,\n        message: \"SQL must parse as exactly one SQLite SELECT statement.\",\n      });\n    }\n  }),\n  params: SqlParamsSchema.optional(),\n  maxRows: z.number().int().positive().max(MAX_MAX_ROWS).optional(),\n  maxBytes: z.number().int().positive().max(MAX_MAX_BYTES).optional(),\n}).strict();\nconst SqlExecuteInputSchema: z.ZodType<SqlExecuteInput> = z.object({\n  space: SpaceSchema,\n  database: DatabaseSchema,\n  sql: z.string().min(1).max(MAX_SQL_LENGTH),\n  params: RequiredSqlParamsSchema,\n  acknowledgeDatabaseWideAuthority: z.literal(true).describe(SQL_WRITE_AUTHORITY_NOTICE),\n}).strict().superRefine((input, context) => {\n  if (parseSingleDmlStatement(input.sql, input.params.length) === undefined) {\n    context.addIssue({\n      code: z.ZodIssueCode.custom,\n      path: [\"sql\"],\n      message: \"SQL must parse as exactly one parameterized INSERT, UPDATE, or DELETE with one value per positional placeholder.\",\n    });\n  }\n});\n\nconst SqlLimitsOutputSchema: z.ZodType<SqlLimitsOutput> = z.object({\n  maxRows: z.number().int().positive(),\n  maxBytes: z.number().int().positive(),\n  enforcement: z.literal(\"node-requested-client-verified\"),\n}).strict();\nconst SqlSchemaInspectOutputSchema: z.ZodType<SqlSchemaInspectOutput> = z.object({\n  space: z.string().min(1),\n  database: z.string().min(1),\n  objects: z.array(z.object({\n    type: z.enum([\"table\", \"view\", \"index\", \"trigger\"]),\n    name: z.string().min(1),\n    tableName: z.string().min(1),\n    sql: z.string().optional(),\n  }).strict()),\n  count: z.number().int().nonnegative(),\n  limits: SqlLimitsOutputSchema,\n}).strict();\nconst SqlQueryOutputSchema: z.ZodType<SqlQueryOutput> = z.object({\n  space: z.string().min(1),\n  database: z.string().min(1),\n  columns: z.array(z.string()),\n  rows: z.array(z.array(SqlOutputValueSchema)),\n  rowCount: z.number().int().nonnegative(),\n  limits: SqlLimitsOutputSchema,\n}).strict();\nconst SqlExecuteOutputSchema: z.ZodType<SqlExecuteOutput> = z.object({\n  space: z.string().min(1),\n  database: z.string().min(1),\n  statementType: z.enum([\"insert\", \"update\", \"delete\"]),\n  changes: z.number().int().nonnegative(),\n  lastInsertRowId: z.number().int().nullable(),\n  authorityNotice: z.literal(SQL_WRITE_AUTHORITY_NOTICE),\n}).strict();\n\nconst AUTHENTICATED_POSTURES: readonly TinyCloudPosture[] = [\n  \"owner-openkey\",\n  \"delegate-session\",\n  \"local-owner-key\",\n];\nconst SQL_EXPOSURE: OperationExposure = {\n  cli: {\n    status: \"excluded\",\n    reason: \"Existing SQL Commander commands remain the CLI surface.\",\n  },\n  mcp: { status: \"required\" },\n  skill: { status: \"required\" },\n  docs: { status: \"required\" },\n};\nconst SQL_SCHEMA_SENSITIVITY: OperationSensitivity = {\n  input: [\"/database\"],\n  output: [\"/objects\"],\n};\nconst SQL_QUERY_SENSITIVITY: OperationSensitivity = {\n  input: [\"/database\", \"/sql\", \"/params\"],\n  output: [\"/columns\", \"/rows\"],\n};\nconst SQL_EXECUTE_SENSITIVITY: OperationSensitivity = {\n  input: [\"/database\", \"/sql\", \"/params\"],\n  output: [\"/lastInsertRowId\"],\n};\n\ntype SqlDefinition =\n  | OperationDefinition<SqlTargetInput, SqlSchemaInspectOutput>\n  | OperationDefinition<SqlQueryInput, SqlQueryOutput>\n  | OperationDefinition<SqlExecuteInput, SqlExecuteOutput>;\n\nexport const sqlOperationDefinitions: readonly SqlDefinition[] = [\n  {\n    id: \"tinycloud.sql.schema.inspect\",\n    version: 1,\n    title: \"Inspect a TinyCloud SQLite schema\",\n    description: \"List user tables, views, indexes, and triggers in one exact TinyCloud SQLite database using a fixed read-only query.\",\n    input: SqlTargetInputSchema,\n    output: SqlSchemaInspectOutputSchema,\n    effects: [\"read\"],\n    runtime: \"authenticated\",\n    postures: AUTHENTICATED_POSTURES,\n    exposure: SQL_EXPOSURE,\n    sensitivity: SQL_SCHEMA_SENSITIVITY,\n    authority: planSqlRead,\n    execute: executeSqlSchemaInspect,\n  },\n  {\n    id: \"tinycloud.sql.query\",\n    version: 1,\n    title: \"Query a TinyCloud SQLite database\",\n    description: \"Run exactly one parser-approved SELECT against one exact TinyCloud SQLite database. Result limits are requested from the node and verified locally without silent truncation.\",\n    input: SqlQueryInputSchema,\n    output: SqlQueryOutputSchema,\n    effects: [\"read\"],\n    runtime: \"authenticated\",\n    postures: AUTHENTICATED_POSTURES,\n    exposure: SQL_EXPOSURE,\n    sensitivity: SQL_QUERY_SENSITIVITY,\n    invalidInputErrorCode: \"SQL_QUERY_INVALID\",\n    authority: planSqlRead,\n    execute: executeSqlQuery,\n  },\n  {\n    id: \"tinycloud.sql.execute\",\n    version: 1,\n    title: \"Execute a TinyCloud SQLite DML statement\",\n    description: `Run exactly one parameterized INSERT, UPDATE, or DELETE against one exact TinyCloud SQLite database. ${SQL_WRITE_AUTHORITY_NOTICE}`,\n    input: SqlExecuteInputSchema,\n    output: SqlExecuteOutputSchema,\n    effects: [\"write\", \"destructive\"],\n    runtime: \"authenticated\",\n    postures: AUTHENTICATED_POSTURES,\n    exposure: SQL_EXPOSURE,\n    sensitivity: SQL_EXECUTE_SENSITIVITY,\n    invalidInputErrorCode: \"SQL_QUERY_INVALID\",\n    authority: planSqlWrite,\n    execute: executeSqlDml,\n  },\n];\n\nasync function planSqlRead(\n  context: RuntimeOperationContext,\n  input: SqlTargetInput,\n): Promise<readonly CapabilityRequirement[]> {\n  const space = resolveSqlSpace(context, input.space);\n  return [{\n    service: \"tinycloud.sql\",\n    space,\n    path: input.database,\n    actions: [\"tinycloud.sql/read\"],\n  }];\n}\n\nasync function planSqlWrite(\n  context: RuntimeOperationContext,\n  input: SqlExecuteInput,\n): Promise<readonly CapabilityRequirement[]> {\n  const space = resolveSqlSpace(context, input.space);\n  return [{\n    service: \"tinycloud.sql\",\n    space,\n    path: input.database,\n    actions: [\"tinycloud.sql/write\"],\n    description: SQL_WRITE_AUTHORITY_NOTICE,\n  }];\n}\n\nasync function executeSqlSchemaInspect(\n  context: OperationContext,\n  input: SqlTargetInput,\n): Promise<OperationExecutionOutcome<SqlSchemaInspectOutput>> {\n  try {\n    const runtime = runtimeContext(context);\n    const space = resolveSqlSpace(runtime, input.space);\n    const result = await runtimeNode(runtime)\n      .sqlForSpace(space)\n      .db(input.database)\n      .query(SCHEMA_QUERY, [], { maxRows: SCHEMA_MAX_ROWS, maxBytes: SCHEMA_MAX_BYTES });\n    if (!result.ok) return sqlServiceFailure(result.error, \"inspect the SQLite schema\");\n\n    const normalized = normalizeQueryResult(result.data, SCHEMA_MAX_ROWS, SCHEMA_MAX_BYTES);\n    const objects = normalized.rows.map((row) => schemaObject(row));\n    return {\n      status: \"ok\",\n      output: {\n        space,\n        database: input.database,\n        objects,\n        count: objects.length,\n        limits: limitsOutput(SCHEMA_MAX_ROWS, SCHEMA_MAX_BYTES),\n      },\n    };\n  } catch (error) {\n    return sqlFailure(error, \"inspect the SQLite schema\");\n  }\n}\n\nasync function executeSqlQuery(\n  context: OperationContext,\n  input: SqlQueryInput,\n): Promise<OperationExecutionOutcome<SqlQueryOutput>> {\n  try {\n    if (!isSingleReadQuery(input.sql)) {\n      return {\n        status: \"error\",\n        error: operationError(\n          \"SQL_QUERY_INVALID\",\n          \"SQL must parse as exactly one SQLite SELECT statement.\",\n        ),\n      };\n    }\n\n    const runtime = runtimeContext(context);\n    const space = resolveSqlSpace(runtime, input.space);\n    const maxRows = input.maxRows ?? DEFAULT_MAX_ROWS;\n    const maxBytes = input.maxBytes ?? DEFAULT_MAX_BYTES;\n    const params = (input.params ?? []).map(decodeSqlInputValue);\n    const result = await runtimeNode(runtime)\n      .sqlForSpace(space)\n      .db(input.database)\n      .query(input.sql, params, { maxRows, maxBytes });\n    if (!result.ok) return sqlServiceFailure(result.error, \"run the SQLite query\");\n\n    const normalized = normalizeQueryResult(result.data, maxRows, maxBytes);\n    return {\n      status: \"ok\",\n      output: {\n        space,\n        database: input.database,\n        columns: normalized.columns,\n        rows: normalized.rows,\n        rowCount: normalized.rows.length,\n        limits: limitsOutput(maxRows, maxBytes),\n      },\n    };\n  } catch (error) {\n    return sqlFailure(error, \"run the SQLite query\");\n  }\n}\n\nasync function executeSqlDml(\n  context: OperationContext,\n  input: SqlExecuteInput,\n): Promise<OperationExecutionOutcome<SqlExecuteOutput>> {\n  try {\n    const statementType = parseSingleDmlStatement(input.sql, input.params.length);\n    if (statementType === undefined) {\n      return {\n        status: \"error\",\n        error: operationError(\n          \"SQL_QUERY_INVALID\",\n          \"SQL must parse as exactly one parameterized INSERT, UPDATE, or DELETE with one value per positional placeholder.\",\n        ),\n      };\n    }\n\n    const runtime = runtimeContext(context);\n    const space = resolveSqlSpace(runtime, input.space);\n    const result = await runtimeNode(runtime)\n      .sqlForSpace(space)\n      .db(input.database)\n      .execute(input.sql, input.params.map(decodeSqlInputValue));\n    if (!result.ok) return authorizationFailure(result.error, \"execute the SQLite statement\") ?? sqlMutationFailure(result.error);\n    const normalized = normalizeExecuteResult(result.data);\n    return {\n      status: \"ok\",\n      output: {\n        space,\n        database: input.database,\n        statementType,\n        ...normalized,\n        authorityNotice: SQL_WRITE_AUTHORITY_NOTICE,\n      },\n    };\n  } catch (error) {\n    if (error instanceof OperationInvocationError) return { status: \"error\", error: error.operationError };\n    return authorizationFailure(error, \"execute the SQLite statement\") ?? sqlMutationFailure(error);\n  }\n}\n\nfunction isSingleReadQuery(sql: string): boolean {\n  const ast = parseSingleStatement(sql);\n  return ast !== undefined && ast.type === \"select\";\n}\n\nfunction parseSingleDmlStatement(\n  sql: string,\n  parameterCount: number,\n): \"insert\" | \"update\" | \"delete\" | undefined {\n  const ast = parseSingleStatement(sql);\n  if (\n    ast === undefined ||\n    (ast.type !== \"insert\" && ast.type !== \"update\" && ast.type !== \"delete\") ||\n    ast.with !== undefined && ast.with !== null\n  ) {\n    return undefined;\n  }\n  const placeholders = countPositionalParameters(ast);\n  return placeholders > 0 && placeholders === parameterCount ? ast.type : undefined;\n}\n\nfunction parseSingleStatement(sql: string): Record<string, unknown> | undefined {\n  try {\n    const ast = sqlParser.astify(sql, { database: \"sqlite\" }) as unknown;\n    return !Array.isArray(ast) && isRecord(ast) ? ast : undefined;\n  } catch {\n    return undefined;\n  }\n}\n\nfunction countPositionalParameters(value: unknown): number {\n  if (Array.isArray(value)) {\n    return value.reduce((count, entry) => count + countPositionalParameters(entry), 0);\n  }\n  if (!isRecord(value)) return 0;\n  const current = value.type === \"origin\" && value.value === \"?\" ? 1 : 0;\n  return Object.values(value).reduce<number>(\n    (count, entry) => count + countPositionalParameters(entry),\n    current,\n  );\n}\n\nfunction decodeSqlInputValue(value: SqlInputValue): null | number | string | Uint8Array {\n  if (isRecord(value) && value.type === \"blob\") {\n    return new Uint8Array(Buffer.from(value.base64 as string, \"base64\"));\n  }\n  return value as null | number | string;\n}\n\nfunction normalizeQueryResult(\n  value: unknown,\n  maxRows: number,\n  maxBytes: number,\n): Readonly<{ columns: readonly string[]; rows: readonly (readonly SqlOutputValue[])[] }> {\n  if (!isRecord(value) || !Array.isArray(value.columns) || !Array.isArray(value.rows)) {\n    throw unsafeSqlValue(\"The node returned an invalid SQLite query result.\");\n  }\n  const columns = value.columns.map((column) => {\n    if (typeof column !== \"string\") {\n      throw unsafeSqlValue(\"The node returned an invalid SQLite column name.\");\n    }\n    return column;\n  });\n  const rows = value.rows.map((row) => {\n    if (!Array.isArray(row) || row.length !== columns.length) {\n      throw unsafeSqlValue(\"The node returned an invalid SQLite row.\");\n    }\n    return row.map(normalizeSqlOutputValue);\n  });\n\n  const serializedBytes = Buffer.byteLength(JSON.stringify({ columns, rows }), \"utf8\");\n  if (rows.length > maxRows || serializedBytes > maxBytes) {\n    throw new OperationInvocationError(operationError(\n      \"SQL_RESULT_LIMIT_EXCEEDED\",\n      \"The SQLite query result exceeded the requested result limits.\",\n      {\n        details: {\n          maxRows,\n          maxBytes,\n          returnedRows: rows.length,\n          returnedBytes: serializedBytes,\n        },\n      },\n    ));\n  }\n  return { columns, rows };\n}\n\nfunction normalizeSqlOutputValue(value: unknown): SqlOutputValue {\n  if (value === null || typeof value === \"string\") return value;\n  if (typeof value === \"number\") {\n    if (!Number.isFinite(value) || (Number.isInteger(value) && !Number.isSafeInteger(value))) {\n      throw unsafeSqlValue(\"The node returned an integer that cannot be represented safely in JavaScript.\");\n    }\n    return value;\n  }\n  if (value instanceof Uint8Array) return encodeBlob(value);\n  if (Array.isArray(value) && value.every(isByte)) {\n    return encodeBlob(Uint8Array.from(value));\n  }\n  if (isRecord(value) && value.type === \"Buffer\" && Array.isArray(value.data) && value.data.every(isByte)) {\n    return encodeBlob(Uint8Array.from(value.data));\n  }\n  throw unsafeSqlValue(\"The node returned an unsupported SQLite value.\");\n}\n\nfunction normalizeExecuteResult(\n  value: unknown,\n): Readonly<{ changes: number; lastInsertRowId: number | null }> {\n  if (\n    !isRecord(value) ||\n    !Number.isSafeInteger(value.changes) ||\n    (value.changes as number) < 0 ||\n    (\n      value.lastInsertRowId !== null &&\n      !Number.isSafeInteger(value.lastInsertRowId)\n    )\n  ) {\n    throw unsafeSqlValue(\"The node returned SQLite mutation metadata that cannot be represented safely in JavaScript.\");\n  }\n  return {\n    changes: value.changes as number,\n    lastInsertRowId: value.lastInsertRowId as number | null,\n  };\n}\n\nfunction schemaObject(row: readonly SqlOutputValue[]): SqlSchemaInspectOutput[\"objects\"][number] {\n  const [type, name, tableName, sql] = row;\n  if (\n    (type !== \"table\" && type !== \"view\" && type !== \"index\" && type !== \"trigger\") ||\n    typeof name !== \"string\" ||\n    typeof tableName !== \"string\" ||\n    (sql !== null && typeof sql !== \"string\")\n  ) {\n    throw unsafeSqlValue(\"The node returned an invalid SQLite schema record.\");\n  }\n  return {\n    type,\n    name,\n    tableName,\n    ...(sql === null ? {} : { sql }),\n  };\n}\n\nfunction limitsOutput(maxRows: number, maxBytes: number): SqlLimitsOutput {\n  return { maxRows, maxBytes, enforcement: \"node-requested-client-verified\" };\n}\n\nfunction runtimeContext(context: OperationContext): RuntimeOperationContext {\n  if (context.runtime === undefined) {\n    throw new TypeError(\"Authenticated operation runtime is unavailable.\");\n  }\n  return context as RuntimeOperationContext;\n}\n\nfunction runtimeNode(context: RuntimeOperationContext): TinyCloudNode {\n  return context.runtime.node as TinyCloudNode;\n}\n\nfunction resolveSqlSpace(context: RuntimeOperationContext, space: string): string {\n  const resolved = operationSpaceResolver(\n    context.runtime.node,\n    context.summary.space,\n  )(space);\n  const name = resolved.split(\":\").at(-1)?.toLowerCase();\n  if (name === \"secrets\" || name === \"account\") {\n    throw new OperationInvocationError(operationError(\n      \"INPUT_INVALID\",\n      \"Generic SQL operations cannot access protected TinyCloud account or secrets spaces.\",\n    ));\n  }\n  return resolved;\n}\n\nfunction encodeBlob(value: Uint8Array): SqlBlob {\n  return {\n    type: \"blob\",\n    base64: Buffer.from(value).toString(\"base64\"),\n    byteLength: value.byteLength,\n  };\n}\n\nfunction unsafeSqlValue(message: string): OperationInvocationError {\n  return new OperationInvocationError(operationError(\"SQL_VALUE_UNSAFE\", message));\n}\n\nfunction sqlFailure(\n  error: unknown,\n  action: string,\n): OperationExecutionOutcome<never> {\n  if (error instanceof OperationInvocationError) {\n    return { status: \"error\", error: error.operationError };\n  }\n  return authorizationFailure(error, action) ?? nodeFailure(action);\n}\n\nfunction nodeFailure(action: string): OperationExecutionOutcome<never> {\n  return {\n    status: \"error\",\n    error: operationError(\n      \"NODE_ERROR\",\n      `The TinyCloud node could not ${action}.`,\n      { retryable: true },\n    ),\n  };\n}\n\nfunction sqlServiceFailure(\n  error: unknown,\n  action: string,\n): OperationExecutionOutcome<never> {\n  const auth = authorizationFailure(error, action);\n  if (auth !== undefined) return auth;\n  if (isRecord(error) && error.code === \"SQL_RESPONSE_TOO_LARGE\") {\n    return {\n      status: \"error\",\n      error: operationError(\n        \"SQL_RESULT_LIMIT_EXCEEDED\",\n        \"The SQLite query result exceeded the requested result limits.\",\n      ),\n    };\n  }\n  return nodeFailure(action);\n}\n\nfunction sqlMutationFailure(error: unknown): OperationExecutionOutcome<never> {\n  // A storage rejection leaves nothing written, so that outcome is known.\n  const storageFull = storageFullOperationError(error);\n  if (storageFull) return { status: \"error\", error: storageFull };\n  return {\n    status: \"error\",\n    error: operationError(\n      \"SQL_EXECUTION_FAILED\",\n      \"The SQLite statement outcome is unknown; inspect database state before considering another write.\",\n      { retryable: false },\n    ),\n  };\n}\n\nfunction isCanonicalBase64(value: string): boolean {\n  if (value === \"\") return true;\n  if (value.length % 4 !== 0 || !/^[A-Za-z0-9+/]*={0,2}$/.test(value)) return false;\n  return Buffer.from(value, \"base64\").toString(\"base64\") === value;\n}\n\nfunction sqlInputValueBytes(value: SqlInputValue): number {\n  if (typeof value === \"string\") return Buffer.byteLength(value, \"utf8\");\n  if (isRecord(value) && value.type === \"blob\") {\n    return Buffer.from(value.base64 as string, \"base64\").byteLength;\n  }\n  return 8;\n}\n\nfunction isByte(value: unknown): value is number {\n  return Number.isInteger(value) && (value as number) >= 0 && (value as number) <= 255;\n}\n\nfunction isRecord(value: unknown): value is Record<string, unknown> {\n  return typeof value === \"object\" && value !== null && !Array.isArray(value);\n}\n","import type { z } from \"zod\";\n\nimport type { OperationError, OperationErrorCode } from \"./errors.js\";\n\n/** A stable, cross-surface operation identifier. */\nexport type OperationId = string;\n\n/** JSON Pointer syntax from RFC 6901, including the empty pointer for a root value. */\nexport type JsonPointer = \"\" | `/${string}`;\n\nexport type OperationEffect =\n  | \"read\"\n  | \"local_write\"\n  | \"write\"\n  | \"destructive\"\n  | \"external\";\n\nexport type TinyCloudPosture =\n  | \"owner-openkey\"\n  | \"delegate-session\"\n  | \"local-owner-key\"\n  | \"unauthenticated\";\n\nexport type OperationOperatorType = \"human\" | \"agent\";\n\nexport type SurfaceDisposition =\n  | Readonly<{ status: \"required\" }>\n  | Readonly<{ status: \"excluded\"; reason: string }>;\n\n/**\n * Safe identity reported with every result. This deliberately excludes keys,\n * tokens, delegations, grants, and operation inputs or outputs.\n */\nexport interface OperationContextSummary {\n  readonly profile: string;\n  readonly host: string;\n  readonly posture: TinyCloudPosture;\n  readonly operatorType?: OperationOperatorType;\n  readonly principalDid?: string;\n  readonly sessionDid?: string;\n  readonly ownerDid?: string;\n  readonly space?: string;\n}\n\n/**\n * The profile foundation constructs this context for every invocation. The\n * invocation target never supplies an execution context or runtime object.\n */\nexport interface OperationContext {\n  readonly summary: OperationContextSummary;\n  /** Present for every normal invocation; optional for focused definition tests. */\n  readonly runtime?: OperationRuntime;\n}\n\n/**\n * Per-invocation authority that is constructed inside operations. It is never\n * caller supplied and it is deliberately absent from result envelopes.\n */\nexport interface OperationRuntime {\n  readonly node: unknown;\n  readonly granted: readonly CapabilityRequirement[];\n  /** Diagnostics gathered while building the runtime, attached to the result. */\n  readonly warnings?: readonly OperationWarning[];\n}\n\n/**\n * Why a stored grant was not used. A fixed vocabulary: diagnostics never\n * carry exception text, node responses, URLs or other stored transport data.\n * `unbound`: the record has no valid request binding where one is required;\n * `outside_request`: its signed authority exceeds its binding.\n */\nexport const STORED_GRANT_SKIP_REASONS = [\n  \"malformed\",\n  \"unbound\",\n  \"outside_request\",\n  \"host_mismatch\",\n  \"expired\",\n  \"cid_mismatch\",\n  \"authority_invalid\",\n  \"proof_missing\",\n  \"proof_invalid\",\n  \"owner_mismatch\",\n  \"audience_mismatch\",\n  \"resources_mismatch\",\n  \"unsupported\",\n  \"activation_rejected\",\n  \"invalid\",\n] as const;\n\nexport type StoredGrantSkipReason = typeof STORED_GRANT_SKIP_REASONS[number];\n\n/**\n * The string form of every delegation CID TinyCloud computes: CIDv1, raw\n * codec, BLAKE3-256 multihash, base32. A published `grantCid` also has to be\n * the CID recomputed from the stored authorization bytes.\n */\nexport const DELEGATION_CID_PATTERN = \"^bafkr4i[a-z2-7]{52}$\";\n\n/**\n * A non-fatal diagnostic attached to a result. `STORED_GRANT_SKIPPED`: a\n * stored grant failed validation and gave no authority; `grantCid` is present\n * only when the stored CID is the CID of the stored authorization bytes.\n */\nexport interface OperationWarning {\n  readonly code: \"STORED_GRANT_SKIPPED\";\n  readonly reason: StoredGrantSkipReason;\n  readonly grantCid?: string;\n}\n\n/** Context given to planners and handlers after runtime authentication. */\nexport interface RuntimeOperationContext extends OperationContext {\n  readonly runtime: OperationRuntime;\n}\n\nexport type AuthorityPlanningContext = RuntimeOperationContext;\n\n/**\n * Capability details are finalized by the authority/artifacts increment. The\n * kernel intentionally preserves them as canonical operation-owned data.\n */\nexport type CapabilityRequirement = Readonly<Record<string, unknown>>;\n\nexport interface PermissionRequestArtifact {\n  readonly requestId: string;\n  readonly [key: string]: unknown;\n}\n\nexport interface ApprovalAction {\n  readonly kind: \"openkey\";\n  readonly requestId: string;\n  readonly url?: string;\n  readonly fallback: string;\n}\n\nexport interface SetupAction {\n  readonly kind: string;\n  readonly [key: string]: unknown;\n}\n\nexport interface OperationRef {\n  readonly operationId: OperationId;\n  readonly operationVersion: number;\n}\n\nexport interface RetryDescriptor extends OperationRef {\n  readonly inputDigest: string;\n  readonly safeInput?: Readonly<Record<string, unknown>>;\n  readonly requiresCallerInput: boolean;\n}\n\nexport interface OperationSensitivity {\n  readonly input: readonly JsonPointer[];\n  readonly output: readonly JsonPointer[];\n}\n\n/**\n * An inspection operation may read safe local profile state without creating a\n * node or authenticating. Every other operation requires an authenticated\n * runtime before planning or execution.\n */\nexport type OperationRuntimeRequirement = \"authenticated\" | \"inspection\";\n\nexport interface OperationExposure {\n  readonly cli: SurfaceDisposition;\n  readonly mcp: SurfaceDisposition;\n  readonly skill: SurfaceDisposition;\n  readonly docs: SurfaceDisposition;\n}\n\nexport interface OperationOkResult<O> {\n  readonly status: \"ok\";\n  readonly operation: OperationRef;\n  readonly context: OperationContextSummary;\n  readonly output: O;\n  readonly warnings?: readonly OperationWarning[];\n}\n\nexport interface OperationAuthorityRequiredResult {\n  readonly status: \"authority_required\";\n  readonly operation: OperationRef;\n  readonly context: OperationContextSummary;\n  readonly missing: readonly CapabilityRequirement[];\n  readonly request: PermissionRequestArtifact;\n  readonly approval: ApprovalAction;\n  readonly retry: RetryDescriptor;\n  readonly warnings?: readonly OperationWarning[];\n}\n\nexport interface OperationSetupRequiredResult {\n  readonly status: \"setup_required\";\n  readonly operation: OperationRef;\n  readonly context: OperationContextSummary;\n  readonly setup: SetupAction;\n  readonly retry: RetryDescriptor;\n  readonly warnings?: readonly OperationWarning[];\n}\n\nexport interface OperationErrorResult {\n  readonly status: \"error\";\n  readonly operation: OperationRef;\n  readonly context: OperationContextSummary;\n  readonly error: OperationError;\n  readonly warnings?: readonly OperationWarning[];\n}\n\nexport type OperationResult<O> =\n  | OperationOkResult<O>\n  | OperationAuthorityRequiredResult\n  | OperationSetupRequiredResult\n  | OperationErrorResult;\n\n/**\n * Handler outcomes intentionally omit invocation-owned operation, context, and\n * retry metadata. The kernel attaches those values after validation.\n */\nexport type OperationExecutionOutcome<O> =\n  | Readonly<{ status: \"ok\"; output: O }>\n  | Readonly<{\n      status: \"authority_required\";\n      missing: readonly CapabilityRequirement[];\n      request: PermissionRequestArtifact;\n      approval: ApprovalAction;\n      requiresCallerInput?: boolean;\n    }>\n  | Readonly<{\n      status: \"setup_required\";\n      setup: SetupAction;\n      requiresCallerInput?: boolean;\n    }>\n  | Readonly<{ status: \"error\"; error: OperationError }>;\n\n/**\n * Internal registry material. It is intentionally never re-exported by the\n * package root: projections can execute only by operation id and version.\n */\nexport interface OperationDefinition<I, O> {\n  readonly id: OperationId;\n  readonly version: 1;\n  readonly title: string;\n  readonly description: string;\n  readonly input: z.ZodType<I>;\n  readonly output: z.ZodType<O>;\n  readonly effects: readonly OperationEffect[];\n  readonly runtime: OperationRuntimeRequirement;\n  readonly postures: readonly TinyCloudPosture[];\n  readonly exposure: OperationExposure;\n  readonly sensitivity: OperationSensitivity;\n  /** A definition may give malformed transport artifacts a stable error code. */\n  readonly invalidInputErrorCode?: OperationErrorCode;\n  readonly authority: (\n    context: AuthorityPlanningContext,\n    input: I,\n  ) => Promise<readonly CapabilityRequirement[]>;\n  readonly execute: (\n    context: OperationContext,\n    input: I,\n  ) => Promise<OperationExecutionOutcome<O>>;\n}\n\n/**\n * The only caller-controlled invocation settings. `privateKey` is a CLI-only,\n * nonpersistable override; it is deliberately excluded from result metadata,\n * retry descriptors, diagnostics, and all state written by this package.\n */\nexport interface InvocationTarget {\n  readonly profile?: string;\n  readonly host?: string;\n  /**\n   * Absolute home directory used for this invocation's TinyCloud profile\n   * state. Hosted projections set this per authenticated principal so\n   * concurrent tenants never share process-global TC_HOME state.\n   */\n  readonly stateRoot?: string;\n  readonly allowOwnerProfile?: boolean;\n  readonly privateKey?: string;\n}\n\n/**\n * Copy only the identity fields allowed in a public result. Keeping this\n * projection centralized prevents a profile/runtime implementation from\n * accidentally smuggling execution material into an envelope.\n */\nexport function safeOperationContextSummary(\n  summary: OperationContextSummary,\n): OperationContextSummary {\n  return {\n    profile: summary.profile,\n    host: summary.host,\n    posture: summary.posture,\n    ...(summary.operatorType === undefined\n      ? {}\n      : { operatorType: summary.operatorType }),\n    ...(summary.principalDid === undefined\n      ? {}\n      : { principalDid: summary.principalDid }),\n    ...(summary.sessionDid === undefined ? {} : { sessionDid: summary.sessionDid }),\n    ...(summary.ownerDid === undefined ? {} : { ownerDid: summary.ownerDid }),\n    ...(summary.space === undefined ? {} : { space: summary.space }),\n  };\n}\n","import { join } from \"node:path\";\n\n// Keep the value import namespace-shaped so modules that import this one stay\n// compatible with lightweight node-sdk test doubles.\nimport * as nodeSdk from \"@tinycloud/node-sdk\";\nimport type {\n  PermissionEntry,\n  PortableDelegation,\n  RuntimeDelegationActivator,\n  ValidatedRuntimeDelegation,\n} from \"@tinycloud/node-sdk\";\n\nimport { DelegationRequestBindingSchema } from \"./artifacts.js\";\nimport { delegationWithinRequest, type OperationSpaceResolver } from \"./authority.js\";\nimport { STORED_GRANT_SKIP_REASONS, type StoredGrantSkipReason } from \"./contract.js\";\nimport {\n  profilePath,\n  readAdditionalDelegations,\n  readJson,\n  readSession,\n  updateProfileStore,\n  withProfileLock,\n  writeJsonAtomic,\n} from \"./state.js\";\n\nexport { operationSpaceResolver } from \"./secrets.js\";\n\n/**\n * Request bindings for delegations stored in `additional-delegations.json`.\n *\n * A compact-UCAN or signed-login (SIWE) record replays only when its\n * `authorityRequest` binding is valid and the capabilities its signed bytes\n * grant fit inside the binding's `requested`. Validated activation checks that\n * before anything is activated. Three writers produce bindings:\n *\n * - `tinycloud.auth.import`: the stored request the delegation was checked\n *   against (`requestId` is that request's).\n * - `tc auth import` of an artifact with no request: exactly the delegation's\n *   own signed capabilities (`unbound-import:<cid>`).\n * - The one-time migration of records stored before bindings existed: exactly\n *   each record's own signed capabilities (`migrated:<cid>`).\n * - The CLI's own grants (`tc auth request --grant`, permission escalation),\n *   once checked against the request they answer: exactly each grant's own\n *   signed capabilities (`cli-grant:<cid>`). Their signed-login records carry\n *   the `siweProof` replay verifies them from.\n *\n * Signed-login records the CLI stored before it kept a `siweProof` cannot be\n * verified here and keep their legacy CLI replay.\n *\n * The binding is local profile data. It stops records written by any other\n * path from granting authority. It does not stop someone who can write the\n * profile directory, who already holds the session key and the signed bytes.\n */\n\nexport type BindingSource = \"migration\" | \"unbound-import\" | \"cli-grant\";\n\nconst REQUEST_ID_PREFIX: Record<BindingSource, string> = {\n  migration: \"migrated\",\n  \"unbound-import\": \"unbound-import\",\n  \"cli-grant\": \"cli-grant\",\n};\n\n/** The audit note written beside a binding the record's writer synthesized. */\nexport const BINDING_NOTES: Record<BindingSource, string> = {\n  migration:\n    \"Stored without a request binding before bindings were required. Bound at migration to exactly \" +\n    \"its own signed capabilities, so replay refuses any delegation in this record that exceeds them.\",\n  \"unbound-import\":\n    \"Imported by `tc auth import` without a stored request. Bound to exactly its own signed \" +\n    \"capabilities, so replay refuses any delegation in this record that exceeds them.\",\n  \"cli-grant\":\n    \"Granted to this CLI by `tc auth request --grant` or a permission escalation, and checked \" +\n    \"against the request it answered. Bound to exactly its own signed capabilities, so replay \" +\n    \"refuses any delegation in this record that exceeds them.\",\n};\n\n/** Short so a busy profile only defers migration to a later runtime. */\nconst MIGRATION_LOCK_TIMEOUT_MS = 250;\n\n/** The per-profile marker: present once that profile's unbound records were migrated. */\nexport function bindingMigrationPath(profile: string): string {\n  return join(profilePath(profile), \"delegation-binding-migration.json\");\n}\n\n/**\n * How replay treats a stored record:\n *\n * - `compact` and `signed-login` records go through validated activation and\n *   the binding rule.\n * - `other` records keep the CLI's legacy replay: an unbound record whose\n *   bytes are not compact and that has no `siweProof`, which is how earlier\n *   CLI releases stored their own signed-login grants. The operations runtime\n *   never installs them.\n * - `refused` records install nothing anywhere.\n *\n * A record is `refused` unless its `delegationHeader` has exactly one own\n * key, `Authorization`, with a string value: header names are matched\n * case-insensitively on the wire, and other value types are stringified, so\n * any other shape could reach the node as authorization bytes this rule never\n * read. Bytes containing a `.` are never `other`: a CACAO has none, and\n * validated activation refuses anything compact-shaped that it cannot parse.\n * A record with an `authorityRequest` (valid or not) is never `other`: the\n * legacy path cannot hold it to a binding, so dropping a `siweProof` cannot\n * route a bound signed-login delegation around its binding.\n */\nexport function storedDelegationKind(\n  entry: unknown,\n): \"compact\" | \"signed-login\" | \"other\" | \"refused\" {\n  // A stored element that is not an object is not a record at all.\n  if (!isRecord(entry)) return \"refused\";\n  const delegation = entry.delegation;\n  if (!isRecord(delegation)) return \"refused\";\n  const header = delegation.delegationHeader;\n  if (\n    !isRecord(header) ||\n    Object.keys(header).length !== 1 ||\n    !Object.prototype.hasOwnProperty.call(header, \"Authorization\") ||\n    typeof header.Authorization !== \"string\"\n  ) {\n    return \"refused\";\n  }\n  if (\"siweProof\" in delegation) return \"signed-login\";\n  if (header.Authorization.includes(\".\")) return \"compact\";\n  return \"authorityRequest\" in entry ? \"refused\" : \"other\";\n}\n\n/**\n * What replay holds a stored record to: its binding's `requested`, `\"signed\"`\n * for an unbound compact record before the profile has migrated (it installs\n * with its own signed authority, as before bindings existed), or `undefined`\n * when the record installs nothing.\n */\nexport function replayLimit(\n  entry: unknown,\n  migrated: boolean,\n): readonly PermissionEntry[] | \"signed\" | undefined {\n  const kind = storedDelegationKind(entry);\n  if (!isRecord(entry) || (kind !== \"compact\" && kind !== \"signed-login\")) return undefined;\n  const binding = DelegationRequestBindingSchema.safeParse(entry.authorityRequest);\n  if (binding.success) return binding.data.requested;\n  return !migrated && kind === \"compact\" && !(\"authorityRequest\" in entry) ? \"signed\" : undefined;\n}\n\n/**\n * Binds a record to `requested`, with an audit note naming where the binding\n * came from. Throws when `requested` cannot form a valid binding.\n */\nfunction bindToRequest<T extends { readonly delegation: { readonly cid: string } }>(\n  record: T,\n  requested: readonly PermissionEntry[],\n  source: BindingSource,\n  recordedAt = new Date().toISOString(),\n): T & Record<\"authorityRequest\" | \"authorityRequestAudit\", unknown> {\n  return {\n    ...record,\n    authorityRequest: DelegationRequestBindingSchema.parse({\n      requestId: `${REQUEST_ID_PREFIX[source]}:${record.delegation.cid}`,\n      requested: structuredClone(requested),\n    }),\n    authorityRequestAudit: { source, recordedAt, note: BINDING_NOTES[source] },\n  };\n}\n\n/**\n * Binds the record of one of the CLI's own grants, already checked against\n * the request it answers, to exactly the capabilities its signed bytes grant.\n * They are read through the validated activation replay uses (nothing is\n * activated), so the binding is the authority replay will derive. Throws when\n * validated activation cannot read them for `node`'s session.\n */\nexport async function bindCliGrant<T extends { readonly delegation: PortableDelegation }>(\n  node: RuntimeDelegationActivator,\n  record: T,\n  host: string,\n): Promise<T & Record<\"authorityRequest\" | \"authorityRequestAudit\", unknown>> {\n  const signed = await signedCapabilities(node, record.delegation, host);\n  if (signed === undefined) {\n    throw new Error(\"The grant's signed authority could not be validated for this session.\");\n  }\n  return bindToRequest(record, signed, \"cli-grant\");\n}\n\n/**\n * Validates and activates a compact delegation that `tc auth import` received\n * without a stored request, through the same validated activation replay uses,\n * and returns its record bound to exactly the capabilities its signed bytes\n * grant. Throws when validation or activation fails.\n */\nexport async function activateUnboundCompactImport(\n  node: RuntimeDelegationActivator,\n  delegation: PortableDelegation,\n  host: string,\n): Promise<{ delegation: PortableDelegation; permissions: PermissionEntry[] } & Record<string, unknown>> {\n  const activated = await nodeSdk.activateValidatedRuntimeDelegation(node, delegation, { host });\n  return bindToRequest(\n    // The record keeps the delegation as imported; replay validates it again.\n    { delegation, permissions: [...activated.effectivePermissions] },\n    activated.effectivePermissions,\n    \"unbound-import\",\n  );\n}\n\n/**\n * The stored records after adding records written without a stored request\n * (by `tc auth import` or a CLI grant). A stored record for the same CID that\n * carries an `authorityRequest` is kept as it is, so this route never drops,\n * replaces or weakens a binding; otherwise each record replaces every row for\n * its CID, at the first one's position, or is appended. Callers write the\n * result under the profile lock they already use for this store.\n */\nexport function mergeDelegationsWithoutRequest(\n  stored: readonly unknown[],\n  incoming: readonly ({ readonly delegation: { readonly cid: string } } & Record<string, unknown>)[],\n): unknown[] {\n  let records = [...stored];\n  for (const record of incoming) {\n    const cid = record.delegation.cid;\n    if (records.some((entry) => storedCid(entry) === cid && isRecord(entry) && \"authorityRequest\" in entry)) continue;\n    const position = records.findIndex((entry) => storedCid(entry) === cid);\n    const others = records.filter((entry) => storedCid(entry) !== cid);\n    records = position === -1\n      ? [...records, record]\n      : [...others.slice(0, position), record, ...others.slice(position)];\n  }\n  return records;\n}\n\n/**\n * Runs before replay reads the profile's records, so those records and the\n * migration marker agree. Returns whether the profile has migrated.\n *\n * Migration runs under the profile lock, and only while the profile's\n * persisted session is still the one `node` restored: a session rotated since\n * the restore leaves migration to a runtime of the new session. Each compact\n * record with no `authorityRequest` is handled on its own: if validated\n * activation can read its signed capabilities (CID, expiry, audience and\n * declared resources checked, nothing activated) and they form a valid\n * binding, the record is bound to exactly those capabilities; otherwise it\n * stays unbound, is listed in the marker's `unbound`, and installs nothing\n * after migration. A compact record whose capabilities cannot be read could\n * not activate for this session either. `migrate` must be false unless `node`\n * holds the profile's own restored session.\n *\n * Migration is best-effort and restartable. The bound records are written\n * first and the marker last; a busy lock or any failure before the marker\n * leaves the profile unmigrated, so this runtime replays under the\n * pre-migration rule and the next one migrates again. Records already bound\n * by an interrupted run keep their bindings.\n */\nexport async function prepareStoredDelegationReplay(\n  profile: string,\n  node: RuntimeDelegationActivator,\n  options: { readonly host: string; readonly migrate: boolean },\n): Promise<boolean> {\n  if (await bindingMigrationRecorded(profile)) return true;\n  // A persisted session without a `verificationMethod`, or one this node did\n  // not restore, never migrates here; skip the lock rather than take it for\n  // nothing on every command.\n  if (!options.migrate || !await holdsPersistedSession(profile, node)) return false;\n  try {\n    return await withProfileLock(profile, async () => {\n      if (await bindingMigrationRecorded(profile)) return true;\n      // Checked again under the lock: a session rotated since the restore\n      // leaves migration to a runtime of the new session.\n      if (!await holdsPersistedSession(profile, node)) return false;\n      const recordedAt = new Date().toISOString();\n      const bound = new Map<string, Record<string, unknown>>();\n      const unbound: string[] = [];\n      for (const entry of await readAdditionalDelegations<unknown>(profile)) {\n        // Elements that are not objects are skipped: they install nothing.\n        if (!isRecord(entry) || \"authorityRequest\" in entry || storedDelegationKind(entry) !== \"compact\") continue;\n        const migrated = await migratedRecord(node, entry, options.host, recordedAt);\n        if (migrated === undefined) unbound.push(String(storedCid(entry)));\n        else bound.set(recordKey(entry)!, migrated);\n      }\n      if (bound.size > 0) {\n        await updateProfileStore<unknown, void>(profile, \"additional-delegations\", (records) => ({\n          records: records.map((entry) => {\n            const key = !isRecord(entry) || \"authorityRequest\" in entry ? undefined : recordKey(entry);\n            return (key === undefined ? undefined : bound.get(key)) ?? entry;\n          }),\n          result: undefined,\n        }));\n      }\n      await writeJsonAtomic(bindingMigrationPath(profile), {\n        formatVersion: 1,\n        migratedAt: recordedAt,\n        bound: [...bound.values()].map(storedCid),\n        unbound,\n      });\n      return true;\n    }, { timeoutMs: MIGRATION_LOCK_TIMEOUT_MS });\n  } catch {\n    return false;\n  }\n}\n\n/** Whether the profile's persisted session is the one `node` restored. */\nasync function holdsPersistedSession(profile: string, node: RuntimeDelegationActivator): Promise<boolean> {\n  try {\n    const persisted = await readSession<Record<string, unknown>>(profile);\n    return typeof persisted?.verificationMethod === \"string\" &&\n      typeof node.sessionDid === \"string\" &&\n      persisted.verificationMethod.split(\"#\", 1)[0] === node.sessionDid.split(\"#\", 1)[0];\n  } catch {\n    return false;\n  }\n}\n\n/** One record's migration: bound to its own signed capabilities, or `undefined` if it cannot be. */\nasync function migratedRecord(\n  node: RuntimeDelegationActivator,\n  entry: Record<string, unknown>,\n  host: string,\n  recordedAt: string,\n): Promise<Record<string, unknown> | undefined> {\n  const delegation = normalizeStoredDelegation(entry);\n  if (delegation === undefined) return undefined;\n  const signed = await signedCapabilities(node, delegation, host);\n  if (signed === undefined) return undefined;\n  try {\n    // The stored delegation is kept exactly as it was; only the binding is added.\n    return bindToRequest({ ...entry, delegation: { ...entry.delegation as object, cid: delegation.cid } }, signed, \"migration\", recordedAt);\n  } catch {\n    // Signed capabilities a request binding cannot hold (an empty action, say).\n    return undefined;\n  }\n}\n\n/**\n * What replay did with one stored record. `skipped` records grant nothing and\n * carry a fixed reason code that is safe to publish; `not-replayed` records\n * are routine (expired) and give nothing to act on.\n */\nexport type StoredDelegationReplay =\n  | { readonly status: \"installed\"; readonly delegation: ValidatedRuntimeDelegation }\n  | { readonly status: \"skipped\"; readonly reason: StoredGrantSkipReason }\n  | { readonly status: \"not-replayed\" };\n\nconst NOT_REPLAYED: StoredDelegationReplay = { status: \"not-replayed\" };\n\nfunction skipped(reason: StoredGrantSkipReason): StoredDelegationReplay {\n  return { status: \"skipped\", reason };\n}\n\n/**\n * Replays one stored record under the binding rule. A record with a valid\n * binding installs only if its signed capabilities fit inside it. Before the\n * profile has migrated, an unbound compact record installs with its signed\n * authority as it always did; after, it installs nothing. A signed-login\n * record installs only with a binding. A record with neither compact bytes\n * nor a `siweProof` cannot be verified here and installs nothing. Never\n * throws, and never reports exception text: stored data is untrusted\n * transport material, and messages can quote it or a node's response.\n */\nexport async function replayStoredDelegation(\n  node: RuntimeDelegationActivator,\n  entry: unknown,\n  options: {\n    readonly host: string;\n    readonly migrated: boolean;\n    readonly resolveSpace: OperationSpaceResolver;\n  },\n): Promise<StoredDelegationReplay> {\n  const kind = storedDelegationKind(entry);\n  const delegation = normalizeStoredDelegation(entry);\n  if (kind === \"refused\" || delegation === undefined) return skipped(\"malformed\");\n  if (delegation.expiry.getTime() <= Date.now()) return NOT_REPLAYED;\n  if (kind === \"other\") return skipped(\"proof_missing\");\n  const limit = replayLimit(entry, options.migrated);\n  if (limit === undefined) return skipped(\"unbound\");\n  let outsideRequest = false;\n  const authorize = limit === \"signed\"\n    ? () => true\n    : (effective: readonly PermissionEntry[]) => {\n      outsideRequest = !delegationWithinRequest(limit, effective, options.resolveSpace);\n      return !outsideRequest;\n    };\n  try {\n    return {\n      status: \"installed\",\n      delegation: await nodeSdk.activateValidatedRuntimeDelegation(node, delegation, { host: options.host, authorize }),\n    };\n  } catch (error) {\n    return skipped(outsideRequest ? \"outside_request\" : rejectionReason(error));\n  }\n}\n\n/** The published reason node-sdk attached to a refused delegation, else `invalid`. */\nfunction rejectionReason(error: unknown): StoredGrantSkipReason {\n  const reason = isRecord(error) ? error.reason : undefined;\n  return typeof reason === \"string\" && (STORED_GRANT_SKIP_REASONS as readonly string[]).includes(reason)\n    ? reason as StoredGrantSkipReason\n    : \"invalid\";\n}\n\n/** An unreadable marker counts as migrated: a damaged marker never reopens migration. */\nexport async function bindingMigrationRecorded(profile: string): Promise<boolean> {\n  try {\n    return await readJson<unknown>(bindingMigrationPath(profile)) !== null;\n  } catch {\n    return true;\n  }\n}\n\n/**\n * The capabilities a stored delegation's signed bytes grant, read through\n * validated activation, which `authorize` stops before anything is activated.\n */\nasync function signedCapabilities(\n  node: RuntimeDelegationActivator,\n  delegation: PortableDelegation,\n  host: string,\n): Promise<readonly PermissionEntry[] | undefined> {\n  let signed: readonly PermissionEntry[] | undefined;\n  try {\n    await nodeSdk.activateValidatedRuntimeDelegation(node, delegation, {\n      // The transport host is not signed authority; check it at replay instead.\n      host: delegation.host ?? host,\n      authorize: (effective) => {\n        signed = effective;\n        return false;\n      },\n    });\n  } catch {\n    // Refused by `authorize` once the capabilities were read, or failed a check before it.\n  }\n  return signed;\n}\n\nfunction normalizeStoredDelegation(entry: unknown): PortableDelegation | undefined {\n  if (!isRecord(entry)) return undefined;\n  const raw = entry.delegation;\n  if (!isRecord(raw) || !isRecord(raw.delegationHeader)) return undefined;\n  const expiry = raw.expiry instanceof Date\n    ? raw.expiry\n    : typeof raw.expiry === \"string\" ? new Date(raw.expiry) : undefined;\n  if (\n    expiry === undefined || Number.isNaN(expiry.getTime()) ||\n    typeof raw.cid !== \"string\" ||\n    typeof raw.spaceId !== \"string\" ||\n    typeof raw.path !== \"string\" ||\n    !Array.isArray(raw.actions) || !raw.actions.every((action) => typeof action === \"string\") ||\n    typeof raw.delegateDID !== \"string\" ||\n    typeof raw.ownerAddress !== \"string\" ||\n    typeof raw.chainId !== \"number\" ||\n    typeof raw.delegationHeader.Authorization !== \"string\"\n  ) {\n    return undefined;\n  }\n  return { ...raw, expiry } as PortableDelegation;\n}\n\nfunction storedCid(entry: unknown): string | undefined {\n  const cid = isRecord(entry) && isRecord(entry.delegation) ? entry.delegation.cid : undefined;\n  return typeof cid === \"string\" ? cid : undefined;\n}\n\n/** A record's CID and exact authorization bytes. */\nfunction recordKey(entry: Record<string, unknown>): string | undefined {\n  const delegation = entry.delegation;\n  if (!isRecord(delegation) || !isRecord(delegation.delegationHeader)) return undefined;\n  return JSON.stringify([delegation.cid, delegation.delegationHeader.Authorization]);\n}\n\nfunction isRecord(value: unknown): value is Record<string, unknown> {\n  return typeof value === \"object\" && value !== null && !Array.isArray(value);\n}\n","import { z } from \"zod\";\n\nimport type {\n  OperationContext,\n  OperationDefinition,\n  OperationExecutionOutcome,\n  OperationExposure,\n  OperationSensitivity,\n  TinyCloudPosture,\n} from \"../contract.js\";\nimport { bindingMigrationRecorded, replayLimit, storedDelegationKind } from \"../delegation-binding.js\";\nimport { operationError } from \"../errors.js\";\nimport {\n  additionalDelegationsPath,\n  readJson,\n  readProfile,\n  readSession,\n  readStoreMetadata,\n} from \"../state.js\";\n\ntype StatusInput = Record<never, never>;\n\ninterface StatusOutput {\n  readonly profile: string;\n  readonly host: string;\n  readonly posture: TinyCloudPosture;\n  readonly operatorType?: \"human\" | \"agent\";\n  readonly principalDid?: string;\n  readonly sessionDid?: string;\n  readonly ownerDid?: string;\n  readonly space?: string;\n  readonly session: {\n    readonly present: boolean;\n    readonly expired: boolean | null;\n    readonly expiresAt: string | null;\n  };\n  readonly liveAdditionalDelegationCount: number;\n}\n\nconst StatusInputSchema: z.ZodType<StatusInput> = z.object({}).strict();\n\nconst StatusOutputSchema: z.ZodType<StatusOutput> = z.object({\n  profile: z.string().min(1),\n  host: z.string().min(1),\n  posture: z.enum([\n    \"owner-openkey\",\n    \"delegate-session\",\n    \"local-owner-key\",\n    \"unauthenticated\",\n  ]),\n  operatorType: z.enum([\"human\", \"agent\"]).optional(),\n  principalDid: z.string().min(1).optional(),\n  sessionDid: z.string().min(1).optional(),\n  ownerDid: z.string().min(1).optional(),\n  space: z.string().min(1).optional(),\n  session: z.object({\n    present: z.boolean(),\n    expired: z.boolean().nullable(),\n    expiresAt: z.string().datetime({ offset: true }).nullable(),\n  }).strict(),\n  liveAdditionalDelegationCount: z.number().int().nonnegative().describe(\n    \"Stored, unexpired delegations the replay rule accepts: compact-UCAN or signed-login records with a request \" +\n      \"binding, and unbound compact-UCAN records before the profile's one-time binding migration. Each is still \" +\n      \"validated, and checked against its binding, when a runtime installs it.\",\n  ),\n}).strict();\n\nconst STATUS_POSTURES: readonly TinyCloudPosture[] = [\n  \"owner-openkey\",\n  \"delegate-session\",\n  \"local-owner-key\",\n  \"unauthenticated\",\n];\n\nconst STATUS_EXPOSURE: OperationExposure = {\n  cli: { status: \"required\" },\n  mcp: { status: \"required\" },\n  skill: { status: \"required\" },\n  docs: { status: \"required\" },\n};\n\nconst STATUS_SENSITIVITY: OperationSensitivity = { input: [], output: [] };\n\n/**\n * Internal I2 definition material. The registry integration owner imports this\n * collection; package entrypoints intentionally do not expose these handlers.\n */\nexport const statusOperationDefinitions: readonly OperationDefinition<StatusInput, StatusOutput>[] = [\n  createStatusDefinition({\n    id: \"tinycloud.status.get\",\n    title: \"TinyCloud status\",\n    description: \"Inspect the selected TinyCloud profile's safe local status.\",\n  }),\n  createStatusDefinition({\n    id: \"tinycloud.auth.status\",\n    title: \"TinyCloud authentication status\",\n    description: \"Inspect the selected TinyCloud profile's safe authentication status.\",\n  }),\n];\n\nfunction createStatusDefinition(params: Readonly<{\n  id: \"tinycloud.status.get\" | \"tinycloud.auth.status\";\n  title: string;\n  description: string;\n}>): OperationDefinition<StatusInput, StatusOutput> {\n  return {\n    id: params.id,\n    version: 1,\n    title: params.title,\n    description: params.description,\n    input: StatusInputSchema,\n    output: StatusOutputSchema,\n    effects: [\"read\"],\n    runtime: \"inspection\",\n    postures: STATUS_POSTURES,\n    exposure: STATUS_EXPOSURE,\n    sensitivity: STATUS_SENSITIVITY,\n    authority: async () => [],\n    execute: inspectPinnedProfileStatus,\n  };\n}\n\nasync function inspectPinnedProfileStatus(\n  context: OperationContext,\n  _input: StatusInput,\n): Promise<OperationExecutionOutcome<StatusOutput>> {\n  const profile = context.summary.profile;\n  if (!(await pinnedProfileExists(profile))) return profileNotFound(profile);\n\n  try {\n    const [session, liveAdditionalDelegationCount] = await Promise.all([\n      readSession<Record<string, unknown>>(profile),\n      countLiveAdditionalDelegations(profile),\n    ]);\n    const sessionSummary = summarizeSession(session);\n\n    return {\n      status: \"ok\",\n      output: {\n        profile,\n        host: context.summary.host,\n        posture: context.summary.posture,\n        ...(context.summary.operatorType === undefined\n          ? {}\n          : { operatorType: context.summary.operatorType }),\n        ...(context.summary.principalDid === undefined\n          ? {}\n          : { principalDid: context.summary.principalDid }),\n        ...(context.summary.sessionDid === undefined\n          ? {}\n          : { sessionDid: context.summary.sessionDid }),\n        ...(context.summary.ownerDid === undefined\n          ? {}\n          : { ownerDid: context.summary.ownerDid }),\n        ...(context.summary.space === undefined ? {} : { space: context.summary.space }),\n        session: sessionSummary,\n        liveAdditionalDelegationCount,\n      },\n    };\n  } catch {\n    // Store contents may contain keys, session material, or delegation bytes.\n    // A state-inspection failure must not relay any part of that material.\n    return {\n      status: \"error\",\n      error: operationError(\n        \"INTERNAL_ERROR\",\n        \"The profile state could not be inspected.\",\n      ),\n    };\n  }\n}\n\nasync function pinnedProfileExists(profile: string): Promise<boolean> {\n  try {\n    const storedProfile = await readProfile<Record<string, unknown>>(profile);\n    return isRecord(storedProfile);\n  } catch {\n    return false;\n  }\n}\n\nasync function countLiveAdditionalDelegations(profile: string): Promise<number> {\n  await readStoreMetadata(profile, \"additional-delegations\");\n  const rawDelegations = await readJson<unknown>(additionalDelegationsPath(profile));\n  if (rawDelegations === null) return 0;\n  if (!Array.isArray(rawDelegations)) throw new TypeError(\"Invalid additional delegation store.\");\n\n  const now = Date.now();\n  const migrated = await bindingMigrationRecorded(profile);\n  let count = 0;\n  for (const entry of rawDelegations) {\n    // Elements replay refuses outright (not objects, no delegation, malformed\n    // headers) never install, so they are not inspected either.\n    if (storedDelegationKind(entry) === \"refused\") continue;\n    const expiry = storedDelegationExpiry(entry);\n    // Records replay refuses outright (unbound after migration, malformed,\n    // or the CLI's own signed-login grants) are not runtime authority.\n    if (expiry.getTime() > now && replayLimit(entry, migrated) !== undefined) count += 1;\n  }\n  return count;\n}\n\nfunction summarizeSession(session: Record<string, unknown> | null): StatusOutput[\"session\"] {\n  if (session === null) return { present: false, expired: null, expiresAt: null };\n  if (!isRecord(session)) throw new TypeError(\"Invalid session store.\");\n\n  const expiry = extractSessionExpiry(session);\n  if (expiry === null) return { present: true, expired: null, expiresAt: null };\n\n  return {\n    present: true,\n    expired: expiry.getTime() <= Date.now(),\n    expiresAt: expiry.toISOString(),\n  };\n}\n\nfunction storedDelegationExpiry(entry: unknown): Date {\n  if (!isRecord(entry) || !isRecord(entry.delegation) || !(\"expiry\" in entry.delegation)) {\n    throw new TypeError(\"Invalid stored delegation.\");\n  }\n  return parseExpiry(entry.delegation.expiry);\n}\n\nfunction extractSessionExpiry(session: Record<string, unknown>): Date | null {\n  for (const field of [\"expiresAt\", \"expiry\", \"expirationTime\"] as const) {\n    if (!(field in session) || session[field] === undefined || session[field] === null) continue;\n    return parseExpiry(session[field]);\n  }\n\n  if (!(\"siwe\" in session) || session.siwe === undefined || session.siwe === null) return null;\n  if (typeof session.siwe !== \"string\") throw new TypeError(\"Invalid session expiry.\");\n  const match = session.siwe.match(/^Expiration Time:\\s*(.+)$/im);\n  return match === null ? null : parseExpiry(match[1].trim());\n}\n\nfunction parseExpiry(value: unknown): Date {\n  const date = value instanceof Date\n    ? value\n    : typeof value === \"number\" && Number.isFinite(value)\n    ? new Date(value > 0 && value < 1_000_000_000_000 ? value * 1_000 : value)\n    : typeof value === \"string\" && value.trim() !== \"\"\n    ? new Date(value)\n    : null;\n  if (date === null || Number.isNaN(date.getTime())) throw new TypeError(\"Invalid expiry.\");\n  return date;\n}\n\nfunction profileNotFound(profile: string): OperationExecutionOutcome<never> {\n  return {\n    status: \"error\",\n    error: operationError(\n      \"PROFILE_NOT_FOUND\",\n      `Profile \"${profile}\" is not available.`,\n    ),\n  };\n}\n\nfunction isRecord(value: unknown): value is Record<string, unknown> {\n  return typeof value === \"object\" && value !== null && !Array.isArray(value);\n}\n","import type { OperationDefinition, OperationId } from \"./contract.js\";\nimport { authOperationDefinitions } from \"./operations/auth.js\";\nimport { explorationOperationDefinitions } from \"./operations/exploration.js\";\nimport { secretsGetOperationDefinitions } from \"./operations/secrets-get.js\";\nimport { sqlOperationDefinitions } from \"./operations/sql.js\";\nimport { statusOperationDefinitions } from \"./operations/status.js\";\n\nexport type OperationLookup =\n  | Readonly<{ status: \"found\"; definition: OperationDefinition<any, any> }>\n  | Readonly<{ status: \"operation_not_found\" }>\n  | Readonly<{\n      status: \"operation_version_unsupported\";\n      supportedVersions: readonly number[];\n    }>;\n\n/**\n * The closed v1 catalog is assembled from internal definitions. There is no\n * exported registration hook for projections or a handler bypass API.\n */\nlet operationDefinitions: readonly OperationDefinition<any, any>[] | undefined;\n\nfunction registeredOperationDefinitions(): readonly OperationDefinition<any, any>[] {\n  // Auth handlers consult lookupOperation while executing. Lazy assembly keeps\n  // that internal dependency out of the module-initialization cycle.\n  operationDefinitions ??= [\n    ...statusOperationDefinitions,\n    ...authOperationDefinitions,\n    ...explorationOperationDefinitions,\n    ...sqlOperationDefinitions,\n    ...secretsGetOperationDefinitions,\n  ];\n  return operationDefinitions;\n}\n\n/** Internal generator input; package exports prevent projection access. */\nexport function operationDefinitionsForCatalog(): readonly OperationDefinition<any, any>[] {\n  return registeredOperationDefinitions();\n}\n\nexport function lookupOperation(\n  operationId: OperationId,\n  operationVersion: number,\n): OperationLookup {\n  const matchingId = registeredOperationDefinitions().filter(\n    (definition) => definition.id === operationId,\n  );\n  if (matchingId.length === 0) {\n    return { status: \"operation_not_found\" };\n  }\n\n  const definition = matchingId.find(\n    (candidate) => candidate.version === operationVersion,\n  );\n  if (definition === undefined) {\n    return {\n      status: \"operation_version_unsupported\",\n      supportedVersions: matchingId.map((candidate) => candidate.version),\n    };\n  }\n\n  return { status: \"found\", definition };\n}\n","import {\n  DEFAULT_PROFILE,\n  readJson,\n  readProfile,\n  tinycloudConfigPath,\n} from \"./state.js\";\nimport type {\n  InvocationTarget,\n  OperationContextSummary,\n  OperationOperatorType,\n  TinyCloudPosture,\n} from \"./contract.js\";\n\nconst DEFAULT_HOST = \"https://tee.node.tinycloud.xyz\";\n\nexport type SafeInvocationContext = OperationContextSummary & {\n  operatorType: OperationOperatorType;\n};\n\nexport type InvocationContextResolution =\n  | { ok: true; context: SafeInvocationContext }\n  | {\n    ok: false;\n    error: {\n      code: \"PROFILE_NOT_FOUND\";\n      message: string;\n      retryable: false;\n    };\n  };\n\ninterface GlobalConfig {\n  defaultProfile?: unknown;\n}\n\n/** Validated profile material retained only inside runtime resolution. */\nexport type StoredProfile = {\n  name: string;\n  host: string;\n  chainId: number;\n  spaceName: string;\n  did: string;\n  createdAt: string;\n  sessionDid?: unknown;\n  ownerDid?: unknown;\n  spaceId?: unknown;\n  posture?: unknown;\n  operatorType?: unknown;\n  authMethod?: unknown;\n  defaultSpace?: unknown;\n  privateKey?: unknown;\n  address?: unknown;\n  openkeyHost?: unknown;\n};\n\n/** Profile snapshot plus its derived safe invocation context. */\nexport type InvocationProfileResolution =\n  | { ok: true; profile: StoredProfile; context: SafeInvocationContext }\n  | Extract<InvocationContextResolution, { ok: false }>;\n\n/**\n * Resolves one selected profile to safe identity data. Resolution is deliberately\n * one-way: after selecting a name, any missing, malformed, or unreadable\n * profile is PROFILE_NOT_FOUND rather than a reason to choose another profile.\n */\nexport async function resolveInvocationContext(\n  target: InvocationTarget = {},\n): Promise<InvocationContextResolution> {\n  const resolved = await resolveInvocationProfile(target);\n  return resolved.ok ? { ok: true, context: resolved.context } : resolved;\n}\n\n/** Resolves the selected profile and its safe context from one profile read. */\nexport async function resolveInvocationProfile(\n  target: InvocationTarget = {},\n): Promise<InvocationProfileResolution> {\n  const profile = await resolveProfileName(target);\n  let storedProfile: StoredProfile | null;\n  try {\n    storedProfile = await readProfile<StoredProfile>(profile);\n  } catch {\n    return profileNotFound(profile);\n  }\n\n  if (!isStoredProfile(storedProfile)) {\n    return profileNotFound(profile);\n  }\n  // An explicit CLI key is a complete identity override. Do not let stale\n  // persisted auth posture reject that live local-owner authentication path.\n  if (target.privateKey === undefined && !isCoherentProfile(storedProfile)) {\n    return profileNotFound(profile);\n  }\n\n  const host = firstString(target.host, process.env.TC_HOST, storedProfile.host, DEFAULT_HOST);\n  const posture = resolvePosture(storedProfile);\n\n  return {\n    ok: true,\n    profile: storedProfile,\n    context: {\n      profile,\n      host,\n      posture,\n      operatorType: isOperatorType(storedProfile.operatorType) ? storedProfile.operatorType : \"human\",\n      principalDid: maybeDid(storedProfile.did),\n      sessionDid: maybeDid(storedProfile.sessionDid),\n      ownerDid: maybeDid(storedProfile.ownerDid),\n      space: typeof storedProfile.spaceId === \"string\" ? storedProfile.spaceId : undefined,\n    },\n  };\n}\n\n/**\n * Selects the profile name once for a long-lived projection process. The\n * selected name is safe identity data; profile material is read only by the\n * invocation runtime after the projection pins this value.\n */\nexport async function resolveInvocationProfileName(\n  explicitProfile?: string,\n): Promise<string> {\n  return resolveProfileName(\n    explicitProfile === undefined ? {} : { profile: explicitProfile },\n  );\n}\n\nasync function resolveProfileName(target: InvocationTarget): Promise<string> {\n  if (typeof target.profile === \"string\") return target.profile;\n  if (typeof process.env.TC_PROFILE === \"string\") return process.env.TC_PROFILE;\n\n  try {\n    const config = await readJson<GlobalConfig>(tinycloudConfigPath());\n    if (typeof config?.defaultProfile === \"string\") return config.defaultProfile;\n  } catch {\n    // Config only chooses the initial name. A missing or malformed config falls\n    // back to the documented default, never to another existing profile.\n  }\n  return DEFAULT_PROFILE;\n}\n\n/** Derives the effective posture without consulting any later profile read. */\nexport function resolvePosture(profile: Pick<StoredProfile, \"posture\" | \"authMethod\">): TinyCloudPosture {\n  if (isPosture(profile.posture)) return profile.posture;\n  if (profile.authMethod === \"local\") return \"local-owner-key\";\n  return \"owner-openkey\";\n}\n\nfunction profileNotFound(profile: string): Extract<InvocationContextResolution, { ok: false }> {\n  return {\n    ok: false,\n    error: {\n      code: \"PROFILE_NOT_FOUND\",\n      message: `Profile \"${profile}\" is not available.`,\n      retryable: false,\n    },\n  };\n}\n\nfunction firstString(...values: unknown[]): string {\n  for (const value of values) {\n    if (typeof value === \"string\" && value.length > 0) return value;\n  }\n  return DEFAULT_HOST;\n}\n\nfunction maybeDid(value: unknown): string | undefined {\n  if (typeof value !== \"string\" || value.length === 0) return undefined;\n  const fragment = value.indexOf(\"#\");\n  return fragment === -1 ? value : value.slice(0, fragment);\n}\n\nfunction isPosture(value: unknown): value is TinyCloudPosture {\n  return value === \"owner-openkey\" ||\n    value === \"delegate-session\" ||\n    value === \"local-owner-key\" ||\n    value === \"unauthenticated\";\n}\n\nfunction isOperatorType(value: unknown): value is OperationOperatorType {\n  return value === \"human\" || value === \"agent\";\n}\n\n/**\n * The CLI's original persisted profile format required these six fields.\n * Posture and operator fields arrived later, so they remain optional while\n * any present typed field must still have its documented shape.\n */\nfunction isStoredProfile(value: unknown): value is StoredProfile {\n  return isRecord(value) &&\n    isNonEmptyString(value.name) &&\n    isNonEmptyString(value.host) &&\n    typeof value.chainId === \"number\" &&\n    Number.isFinite(value.chainId) &&\n    isNonEmptyString(value.spaceName) &&\n    isNonEmptyString(value.did) &&\n    isNonEmptyString(value.createdAt) &&\n    isOptionalNonEmptyString(value.sessionDid) &&\n    isOptionalNonEmptyString(value.ownerDid) &&\n    isOptionalNonEmptyString(value.spaceId) &&\n    isOptionalPosture(value.posture) &&\n    isOptionalOperatorType(value.operatorType) &&\n    isOptionalAuthMethod(value.authMethod) &&\n    isOptionalNonEmptyString(value.defaultSpace) &&\n    isOptionalNonEmptyString(value.privateKey) &&\n    isOptionalNonEmptyString(value.address) &&\n    isOptionalNonEmptyString(value.openkeyHost);\n}\n\nfunction isRecord(value: unknown): value is Record<string, unknown> {\n  return typeof value === \"object\" && value !== null && !Array.isArray(value);\n}\n\nfunction isNonEmptyString(value: unknown): value is string {\n  return typeof value === \"string\" && value.length > 0;\n}\n\nfunction isOptionalNonEmptyString(value: unknown): boolean {\n  return value === undefined || isNonEmptyString(value);\n}\n\nfunction isOptionalPosture(value: unknown): boolean {\n  return value === undefined || isPosture(value);\n}\n\nfunction isOptionalOperatorType(value: unknown): boolean {\n  return value === undefined || isOperatorType(value);\n}\n\nfunction isOptionalAuthMethod(value: unknown): boolean {\n  return value === undefined || value === \"openkey\" || value === \"local\";\n}\n\n/**\n * Local-key authentication is owner authentication. A persisted delegate or\n * OpenKey posture must never be allowed to select that path later in runtime\n * construction, so reject the inconsistent profile before policy inspection.\n */\nfunction isCoherentProfile(profile: StoredProfile): boolean {\n  if (profile.authMethod === \"local\") {\n    return profile.posture === undefined || profile.posture === \"local-owner-key\";\n  }\n  if (profile.posture === \"local-owner-key\") {\n    return profile.authMethod === \"local\";\n  }\n  return true;\n}\n","import type {\n  PermissionEntry,\n  RuntimeDelegationActivator,\n  TinyCloudNode,\n} from \"@tinycloud/node-sdk\";\nimport * as nodeSdk from \"@tinycloud/node-sdk\";\n\nimport {\n  DELEGATION_CID_PATTERN,\n  type InvocationTarget,\n  type OperationContext,\n  type OperationRuntime,\n  type OperationRuntimeRequirement,\n  type OperationWarning,\n  type RuntimeOperationContext,\n  type StoredGrantSkipReason,\n} from \"./contract.js\";\nimport { canonicalizeCapabilities } from \"./authority.js\";\nimport { operationError, type OperationError } from \"./errors.js\";\nimport { resolveInvocationProfile, resolvePosture } from \"./profile.js\";\nimport { operationSpaceResolver } from \"./secrets.js\";\nimport {\n  profilePath,\n  readAdditionalDelegations,\n  readJson,\n  readProfile,\n  readSession,\n} from \"./state.js\";\nimport { prepareStoredDelegationReplay, replayStoredDelegation } from \"./delegation-binding.js\";\n\nexport type InvocationRuntimeResolution =\n  | Readonly<{ ok: true; context: OperationContext }>\n  | Readonly<{\n    ok: false;\n    context: RuntimeOperationContext[\"summary\"];\n    error: OperationError;\n  }>;\n\ninterface StoredSession extends Record<string, unknown> {\n  readonly delegationHeader?: unknown;\n  readonly delegationCid?: unknown;\n  readonly spaceId?: unknown;\n  readonly jwk?: unknown;\n  readonly verificationMethod?: unknown;\n  readonly address?: unknown;\n  readonly chainId?: unknown;\n  readonly siwe?: unknown;\n  readonly signature?: unknown;\n  readonly tinycloudHosts?: unknown;\n}\n\n/**\n * Creates one authenticated runtime for an invocation. The selected profile\n * name is resolved once and every subsequent read is explicitly scoped to that\n * name; no failure path can choose a different profile.\n */\ntype AuthenticatedRuntimeResolution =\n  | Readonly<{ ok: true; context: RuntimeOperationContext }>\n  | Exclude<InvocationRuntimeResolution, Readonly<{ ok: true; context: OperationContext }>>;\n\nexport function createInvocationRuntime(\n  target: InvocationTarget,\n): Promise<AuthenticatedRuntimeResolution>;\nexport function createInvocationRuntime(\n  target: InvocationTarget,\n  requirement: \"authenticated\",\n): Promise<AuthenticatedRuntimeResolution>;\nexport function createInvocationRuntime(\n  target: InvocationTarget,\n  requirement: \"inspection\",\n): Promise<InvocationRuntimeResolution>;\nexport function createInvocationRuntime(\n  target: InvocationTarget,\n  requirement: OperationRuntimeRequirement,\n): Promise<InvocationRuntimeResolution>;\nexport async function createInvocationRuntime(\n  target: InvocationTarget,\n  requirement: OperationRuntimeRequirement = \"authenticated\",\n): Promise<InvocationRuntimeResolution> {\n  const resolved = await resolveInvocationProfile(target);\n  if (!resolved.ok) {\n    return {\n      ok: false,\n      context: unresolvedSummary(target),\n      error: resolved.error,\n    };\n  }\n\n  const summary = resolved.context;\n  if (requirement === \"inspection\") {\n    return { ok: true, context: { summary } };\n  }\n\n  const profileName = summary.profile;\n  try {\n    // Keep the value import namespace-shaped so projection modules remain\n    // compatible with lightweight node-sdk test doubles.\n    const {\n      TinyCloudNode: TinyCloudNodeConstructor,\n    } = nodeSdk;\n    const explicitPrivateKeyOverride = typeof target.privateKey === \"string\";\n    const [session, key] = explicitPrivateKeyOverride\n      ? [null, null]\n      : await Promise.all([\n        readSession<StoredSession>(profileName),\n        readJson<Record<string, unknown>>(`${profilePath(profileName)}/key.json`),\n      ]);\n    const profile = resolved.profile;\n\n    // The inspection summary and authenticated material are intentionally\n    // separate reads. Fail closed if the profile changed posture between\n    // them; otherwise local-owner-key could be authenticated under a stale\n    // delegate-session summary and bypass the caller's posture policy.\n    const actualPosture = resolvePosture(profile);\n    if (!explicitPrivateKeyOverride && actualPosture !== summary.posture) {\n      return failed(\n        { ...summary, posture: actualPosture },\n        operationError(\n          \"PROFILE_POSTURE_NOT_ALLOWED\",\n          \"The selected profile changed posture during runtime resolution.\",\n        ),\n      );\n    }\n\n    const privateKey = typeof target.privateKey === \"string\"\n      ? target.privateKey\n      : typeof profile.privateKey === \"string\"\n      ? profile.privateKey\n      : undefined;\n    const selectedPosture = explicitPrivateKeyOverride || profile.authMethod === \"local\"\n      ? \"local-owner-key\"\n      : summary.posture;\n    if (selectedPosture !== summary.posture && !explicitPrivateKeyOverride) {\n      return failed(\n        { ...summary, posture: selectedPosture },\n        operationError(\n          \"PROFILE_POSTURE_NOT_ALLOWED\",\n          \"The selected profile authentication material does not match its posture.\",\n        ),\n      );\n    }\n    const node = new TinyCloudNodeConstructor({\n      host: summary.host,\n      ...(privateKey === undefined ? {} : { privateKey }),\n    });\n\n    const activeSession = session === null ? undefined : normalizeSession(session, key);\n    if (explicitPrivateKeyOverride) {\n      // An explicit key is a complete, non-persisted identity. Do not inherit\n      // an OpenKey session (or require one) from the selected profile.\n      await node.signIn();\n    } else if (activeSession === undefined) {\n      if (profile.authMethod === \"local\" && privateKey !== undefined) {\n        await node.signIn();\n      } else {\n        return failed(summary, operationError(\n          \"SESSION_NOT_FOUND\",\n          \"The selected profile does not have an active session.\",\n        ));\n      }\n    } else {\n      try {\n        await node.restoreSession(activeSession);\n      } catch (error) {\n        // node-sdk refuses expired or otherwise unusable persisted authority\n        // (`AUTH_EXPIRED`) while verifying it locally, before any node request.\n        // Only a new sign-in fixes that: the same non-retryable `AUTH_REQUIRED`\n        // a node's 401 for a stale session produces.\n        if (isRecord(error) && error.code === \"AUTH_EXPIRED\") {\n          return failed(summary, operationError(\n            \"AUTH_REQUIRED\",\n            \"The stored session has expired or is no longer valid. Sign in again.\",\n            { retryable: false },\n          ));\n        }\n        throw error;\n      }\n    }\n\n    // The restored node is the authority for the active session identity. In\n    // particular, do not report the persisted verification method if SDK\n    // restoration failed to install its key as the live session key.\n    const activeSessionDid = normalizeDid(node.sessionDid);\n    const livePrincipalDid = normalizeDid(node.did);\n    const authenticatedSpace = explicitPrivateKeyOverride\n      ? spaceForAuthenticatedPrincipal(livePrincipalDid)\n      : undefined;\n    // This API derives from the restored, verified base session rather than\n    // from an SDK private field or a second parse of signed authority here.\n    const livePermissions: PermissionEntry[] = [...node.getVerifiedSessionCapabilities()];\n    const resolveSpace = operationSpaceResolver(node, authenticatedSpace ?? summary.space);\n    const seenCids = new Set<string>();\n    const warnings: OperationWarning[] = [];\n    // An explicit key is another identity: it neither replays nor migrates\n    // this profile's records.\n    if (!explicitPrivateKeyOverride) {\n      const activator = node as unknown as RuntimeDelegationActivator;\n      // Migration runs before the records are read, so the records replayed\n      // here and the migration marker agree.\n      const migrated = await prepareStoredDelegationReplay(profileName, activator, {\n        host: summary.host,\n        // Only the profile's own restored session; a local sign-in without\n        // one uses a fresh session key the stored records do not address.\n        migrate: activeSession !== undefined,\n      });\n      // Elements are untrusted and may not even be objects; the shared rule\n      // classifies each before reading any field.\n      for (const entry of await readAdditionalDelegations<unknown>(profileName)) {\n        const replay = await replayStoredDelegation(activator, entry, {\n          host: summary.host,\n          migrated,\n          resolveSpace,\n        });\n        if (replay.status === \"installed\") {\n          if (!seenCids.has(replay.delegation.cid)) {\n            seenCids.add(replay.delegation.cid);\n            livePermissions.push(...replay.delegation.effectivePermissions);\n          }\n        } else if (replay.status === \"skipped\") {\n          // A skipped record never grants authority. Skipping (not failing)\n          // keeps one stale record from blocking what the session or other\n          // grants cover; the result says which grant and why, in fixed\n          // codes only. An expired grant is routine and is not reported.\n          warnings.push(skippedGrantWarning(node, entry, replay.reason));\n        }\n      }\n    }\n\n    const runtime: OperationRuntime = {\n      node,\n      granted: canonicalizeCapabilities(livePermissions),\n      ...(warnings.length === 0 ? {} : { warnings }),\n    };\n    return {\n      ok: true,\n      context: {\n        summary: {\n          ...summary,\n          posture: selectedPosture,\n          ...(livePrincipalDid === undefined ? {} : { principalDid: livePrincipalDid }),\n          ...(explicitPrivateKeyOverride && livePrincipalDid !== undefined\n            ? { ownerDid: livePrincipalDid }\n            : {}),\n          ...(authenticatedSpace === undefined ? {} : { space: authenticatedSpace }),\n          ...(activeSessionDid === undefined ? {} : { sessionDid: activeSessionDid }),\n        },\n        runtime,\n      },\n    };\n  } catch {\n    return failed(summary, operationError(\n      \"NODE_ERROR\",\n      \"The selected profile runtime could not be initialized.\",\n      { retryable: true },\n    ));\n  }\n}\n\n/**\n * A stored CID is published only when it is the CID of the stored\n * authorization bytes, recomputed here. Any other value (free text, or a\n * well-formed CID of different bytes) is caller-controlled data and is omitted.\n */\nfunction skippedGrantWarning(node: unknown, entry: unknown, reason: StoredGrantSkipReason): OperationWarning {\n  const grantCid = verifiedStoredCid(node, entry);\n  return { code: \"STORED_GRANT_SKIPPED\", reason, ...(grantCid === undefined ? {} : { grantCid }) };\n}\n\nfunction verifiedStoredCid(node: unknown, entry: unknown): string | undefined {\n  const delegation = isRecord(entry) && isRecord(entry.delegation) ? entry.delegation : undefined;\n  const header = isRecord(delegation?.delegationHeader) ? delegation.delegationHeader : undefined;\n  const cid = delegation?.cid;\n  const computeDelegationCid = isRecord(node) ? node.computeDelegationCid : undefined;\n  if (typeof cid !== \"string\" || typeof header?.Authorization !== \"string\" || typeof computeDelegationCid !== \"function\") {\n    return undefined;\n  }\n  try {\n    return computeDelegationCid.call(node, header.Authorization) === cid && DELEGATION_CID.test(cid) ? cid : undefined;\n  } catch {\n    return undefined;\n  }\n}\n\nconst DELEGATION_CID = new RegExp(DELEGATION_CID_PATTERN);\n\nfunction spaceForAuthenticatedPrincipal(principal: string | undefined): string | undefined {\n  if (principal === undefined) return undefined;\n  try {\n    const pkh = nodeSdk.parsePkhDid(principal);\n    return pkh === null ? undefined : nodeSdk.makePkhSpaceId(pkh.address, pkh.chainId, \"secrets\");\n  } catch {\n    return undefined;\n  }\n}\n\nfunction normalizeSession(\n  session: StoredSession,\n  key: Record<string, unknown> | null,\n): Parameters<TinyCloudNode[\"restoreSession\"]>[0] | undefined {\n  const header = session.delegationHeader;\n  const jwk = hasPrivateParameter(session.jwk) ? session.jwk : key;\n  if (\n    !isRecord(header) ||\n    typeof header.Authorization !== \"string\" ||\n    typeof session.delegationCid !== \"string\" ||\n    typeof session.spaceId !== \"string\" ||\n    !hasPrivateParameter(jwk) ||\n    typeof session.verificationMethod !== \"string\"\n  ) {\n    return undefined;\n  }\n\n  return {\n    delegationHeader: { Authorization: header.Authorization },\n    delegationCid: session.delegationCid,\n    spaceId: session.spaceId,\n    jwk,\n    verificationMethod: session.verificationMethod,\n    ...(typeof session.address === \"string\" ? { address: session.address } : {}),\n    ...(typeof session.chainId === \"number\" ? { chainId: session.chainId } : {}),\n    ...(typeof session.siwe === \"string\" ? { siwe: session.siwe } : {}),\n    ...(typeof session.signature === \"string\" ? { signature: session.signature } : {}),\n    ...(Array.isArray(session.tinycloudHosts) && session.tinycloudHosts.every((host) => typeof host === \"string\")\n      ? { tinycloudHosts: session.tinycloudHosts }\n      : {}),\n  };\n}\n\nfunction hasPrivateParameter(value: unknown): value is Record<string, unknown> {\n  return isRecord(value) && typeof value.d === \"string\" && value.d.length > 0;\n}\n\nfunction normalizeDid(value: string | undefined): string | undefined {\n  if (typeof value !== \"string\" || value.length === 0) return undefined;\n  return value.split(\"#\", 1)[0];\n}\n\nfunction isRecord(value: unknown): value is Record<string, unknown> {\n  return typeof value === \"object\" && value !== null && !Array.isArray(value);\n}\n\nfunction failed(\n  context: RuntimeOperationContext[\"summary\"],\n  error: OperationError,\n): InvocationRuntimeResolution {\n  return { ok: false, context, error };\n}\n\nfunction unresolvedSummary(target: InvocationTarget): RuntimeOperationContext[\"summary\"] {\n  return {\n    profile: target.profile ?? \"unresolved\",\n    host: target.host ?? \"unresolved\",\n    posture: \"unauthenticated\",\n  };\n}\n","import { createHash } from \"node:crypto\";\nimport { isAbsolute } from \"node:path\";\n\nimport {\n  makePkhSpaceId,\n  parsePkhDid,\n  parseSpaceUri,\n  type PermissionEntry,\n} from \"@tinycloud/node-sdk\";\nimport { jcsCanonicalize } from \"@tinycloud/sdk-core/policy\";\nimport type { ZodError } from \"zod\";\n\nimport {\n  type ApprovalAction,\n  type CapabilityRequirement,\n  type InvocationTarget,\n  type OperationContextSummary,\n  type OperationDefinition,\n  type OperationRef,\n  type OperationResult,\n  type OperationRuntimeRequirement,\n  type RuntimeOperationContext,\n} from \"./contract.js\";\nimport {\n  internalOperationError,\n  operationError,\n  sanitizeOperationError,\n  sanitizeThrownOperationError,\n} from \"./errors.js\";\nimport {\n  canonicalizeOperationCapabilities,\n  evaluateOperationAuthority,\n  isExactCapabilityMemberSubset,\n  validateExactCapabilities,\n} from \"./authority.js\";\nimport {\n  createOrReusePermissionRequest,\n  buildPermissionRequestArtifact,\n  type PermissionRequestArtifact,\n} from \"./artifacts.js\";\nimport { redactOperationError } from \"./redaction.js\";\nimport { safeOriginHost } from \"./safe-values.js\";\nimport { withTinyCloudStateRoot } from \"./state.js\";\nimport type { InvocationRuntimeResolution } from \"./runtime.js\";\nimport {\n  operationSpaceResolver,\n  resolveSecretReferenceForOperation,\n} from \"./secrets.js\";\n\n/** The sole projection-facing execution API. */\nexport async function invokeOperation(\n  operationId: string,\n  operationVersion: number,\n  invocationTarget: InvocationTarget,\n  unknownInput: unknown,\n): Promise<OperationResult<unknown>> {\n  const target = normalizeInvocationTarget(invocationTarget);\n  if (target === undefined) {\n    return errorResult(\n      { operationId, operationVersion },\n      unresolvedContextSummary(),\n      operationError(\"INPUT_INVALID\", \"The invocation target is invalid.\"),\n    );\n  }\n  return withTinyCloudStateRoot(target.stateRoot, async () => {\n    const prepared = await prepareInvocation(\n      operationId,\n      operationVersion,\n      target,\n      unknownInput,\n    );\n    if (isPreparedError(prepared)) return prepared.result;\n    return withRuntimeWarnings(await executePreparedInvocation(prepared), prepared);\n  });\n}\n\n/**\n * CLI-only local-owner acquisition path. The runtime is deliberately created\n * and retained inside operations so a grant is installed on the exact session\n * that performs the one retry. The explicit key remains a non-persisted target\n * value and no runtime object crosses the operations boundary.\n */\nexport async function invokeOperationWithLocalAuthorityRetry(\n  operationId: string,\n  operationVersion: number,\n  invocationTarget: InvocationTarget,\n  unknownInput: unknown,\n): Promise<OperationResult<unknown>> {\n  const target = normalizeInvocationTarget(invocationTarget);\n  if (target === undefined) {\n    return errorResult(\n      { operationId, operationVersion },\n      unresolvedContextSummary(),\n      operationError(\"INPUT_INVALID\", \"The invocation target is invalid.\"),\n    );\n  }\n  if (typeof target.privateKey !== \"string\" || target.privateKey.length === 0) {\n    return errorResult(\n      { operationId, operationVersion },\n      unresolvedContextSummary(target),\n      operationError(\n        \"PROFILE_POSTURE_NOT_ALLOWED\",\n        \"Local authority retry requires an explicit private key.\",\n      ),\n    );\n  }\n\n  return withTinyCloudStateRoot(target.stateRoot, () =>\n    invokeLocalAuthorityRetry(\n      operationId,\n      operationVersion,\n      target,\n      unknownInput,\n    )\n  );\n}\n\nasync function invokeLocalAuthorityRetry(\n  operationId: string,\n  operationVersion: number,\n  target: InvocationTarget,\n  unknownInput: unknown,\n): Promise<OperationResult<unknown>> {\n  const prepared = await prepareInvocation(\n    operationId,\n    operationVersion,\n    target,\n    unknownInput,\n  );\n  if (isPreparedError(prepared)) return prepared.result;\n  return withRuntimeWarnings(await retryWithLocalAuthority(prepared), prepared);\n}\n\nasync function retryWithLocalAuthority(\n  prepared: Exclude<PreparedInvocation, { status: \"error\" }>,\n): Promise<OperationResult<unknown>> {\n  if (\n    prepared.operation.operationId !== \"tinycloud.secrets.get\" ||\n    prepared.operation.operationVersion !== 1\n  ) {\n    return errorResult(\n      prepared.operation,\n      prepared.runtimeResolution.context.summary,\n      operationError(\n        \"OPERATION_NOT_FOUND\",\n        \"The local CLI authority helper supports only tinycloud.secrets.get@1.\",\n      ),\n    );\n  }\n\n  const runtimeContext = prepared.runtimeResolution.context;\n  if (runtimeContext.runtime === undefined) return internalOperationErrorResult(prepared);\n  const operationContext = runtimeContext as RuntimeOperationContext;\n  let planned: CapabilityRequirement[] | undefined;\n  try {\n    planned = exactCapabilities(await prepared.definition.authority(\n      operationContext,\n      prepared.parsedInput.data,\n    ));\n  } catch {\n    return errorResult(\n      prepared.operation,\n      operationContext.summary,\n      operationError(\n        \"PERMISSION_HINT_INVALID\",\n        \"The local CLI authority plan is invalid.\",\n      ),\n    );\n  }\n  const planStatus = planned === undefined\n    ? \"invalid\"\n    : isExactLocalSecretsGetPlan(prepared, planned, operationContext);\n  if (planStatus === \"ineligible\") {\n    return errorResult(\n      prepared.operation,\n      operationContext.summary,\n      operationError(\n        \"PROFILE_POSTURE_NOT_ALLOWED\",\n        \"The explicit private key cannot authorize the requested owner space.\",\n      ),\n    );\n  }\n  if (planStatus !== \"valid\") {\n    return errorResult(\n      prepared.operation,\n      operationContext.summary,\n      operationError(\n        \"PERMISSION_HINT_INVALID\",\n        \"The local CLI authority plan is invalid.\",\n      ),\n    );\n  }\n\n  const first = await executePreparedInvocation(prepared, { deferAuthorityRequest: true });\n  if (first.status !== \"authority_required\") {\n    return first;\n  }\n  if (\n    operationContext.summary.posture !== \"local-owner-key\" ||\n    !requirementsBelongToAuthenticatedOwner(\n      first.missing as unknown as PermissionEntry[],\n      operationContext.summary.space,\n    )\n  ) {\n    return localAuthorityFailure(prepared);\n  }\n\n  try {\n    const grantRuntimePermissions = (operationContext.runtime.node as {\n      grantRuntimePermissions?: (\n        permissions: PermissionEntry[],\n      ) => Promise<unknown>;\n    }).grantRuntimePermissions;\n    if (typeof grantRuntimePermissions !== \"function\") {\n      return localAuthorityFailure(prepared);\n    }\n    await grantRuntimePermissions.call(\n      operationContext.runtime.node,\n      first.missing as unknown as PermissionEntry[],\n    );\n\n    const resolveSpace = operationSpaceResolver(\n      operationContext.runtime.node,\n      operationContext.summary.space,\n    );\n    const refreshedGranted = refreshLiveRuntimeAuthority(\n      operationContext.runtime.node,\n      first.missing as unknown as PermissionEntry[],\n      planned as unknown as PermissionEntry[],\n      resolveSpace,\n    );\n    if (refreshedGranted === undefined) {\n      return localAuthorityFailure(prepared);\n    }\n    const retryContext: RuntimeOperationContext = {\n      ...operationContext,\n      runtime: {\n        ...operationContext.runtime,\n        granted: refreshedGranted,\n      },\n    };\n    const retry = await executePreparedInvocation({\n      ...prepared,\n      runtimeResolution: { ok: true, context: retryContext },\n    }, { deferAuthorityRequest: true });\n    return retry.status === \"authority_required\"\n      ? localAuthorityFailure(prepared)\n      : retry;\n  } catch {\n    return localAuthorityFailure(prepared);\n  }\n}\n\n/** Diagnostics from building the runtime belong to the invocation's result. */\nfunction withRuntimeWarnings(\n  result: OperationResult<unknown>,\n  prepared: Exclude<PreparedInvocation, { status: \"error\" }>,\n): OperationResult<unknown> {\n  const warnings = prepared.runtimeResolution.context.runtime?.warnings;\n  return warnings === undefined || warnings.length === 0 ? result : { ...result, warnings: [...warnings] };\n}\n\ntype PreparedInvocation = Readonly<{\n  operation: OperationRef;\n  definition: OperationDefinition<any, any>;\n  parsedInput: { data: any };\n  runtimeResolution: Extract<InvocationRuntimeResolution, { ok: true }>;\n}> | Readonly<{\n  status: \"error\";\n  result: OperationResult<never>;\n}>;\n\nfunction isPreparedError(\n  prepared: PreparedInvocation,\n): prepared is Extract<PreparedInvocation, { status: \"error\" }> {\n  return \"status\" in prepared;\n}\n\nasync function prepareInvocation(\n  operationId: string,\n  operationVersion: number,\n  invocationTarget: InvocationTarget,\n  unknownInput: unknown,\n): Promise<PreparedInvocation> {\n  const operation: OperationRef = { operationId, operationVersion };\n  const target = normalizeInvocationTarget(invocationTarget);\n  if (target === undefined) {\n    return { status: \"error\", result: errorResult(\n      operation,\n      unresolvedContextSummary(),\n      operationError(\"INPUT_INVALID\", \"The invocation target is invalid.\"),\n    ) };\n  }\n  // Load internal registry material only when invoking. This keeps the packed\n  // root entrypoint free of auth/runtime SDK initialization until a call is\n  // made, while preserving registry resolution before input or profile access.\n  const { lookupOperation } = await import(\"./registry.js\");\n  const lookup = lookupOperation(operationId, operationVersion);\n\n  // Registry resolution is deliberately complete before any input parsing or\n  // profile access. An unrecognized operation must not cause an invocation to\n  // consult profile state.\n  if (lookup.status === \"operation_not_found\") {\n    return { status: \"error\", result: errorResult(\n      operation,\n      unresolvedContextSummary(target),\n      operationError(\n        \"OPERATION_NOT_FOUND\",\n        \"The requested operation is not registered.\",\n      ),\n    ) };\n  }\n  if (lookup.status === \"operation_version_unsupported\") {\n    return { status: \"error\", result: errorResult(\n      operation,\n      unresolvedContextSummary(target),\n      operationError(\n        \"OPERATION_VERSION_UNSUPPORTED\",\n        \"The requested operation version is not supported.\",\n        { details: { supportedVersions: lookup.supportedVersions } },\n      ),\n    ) };\n  }\n\n  const definition = lookup.definition;\n  const parsedInput = definition.input.safeParse(unknownInput);\n  if (!parsedInput.success) {\n    return { status: \"error\", result: errorResult(\n      operation,\n      unresolvedContextSummary(target),\n      operationError(\n        definition.invalidInputErrorCode ?? \"INPUT_INVALID\",\n        \"The operation input is invalid.\",\n        {\n          details: zodIssueDetails(parsedInput.error),\n        },\n      ),\n    ) };\n  }\n\n  // Only a registered operation with valid input may inspect the pinned\n  // profile. Inspection is deliberately node-free, so owner opt-in and status\n  // availability are decided before any authentication or external effect.\n  const inspectionResolution = await resolveRuntime(target, \"inspection\");\n  if (!inspectionResolution.ok) {\n    return { status: \"error\", result: errorResult(\n      operation,\n      inspectionResolution.context,\n      inspectionResolution.error,\n    ) };\n  }\n\n  if (\n    target.privateKey === undefined &&\n    !definition.postures.includes(inspectionResolution.context.summary.posture)\n  ) {\n    return { status: \"error\", result: errorResult(\n      operation,\n      inspectionResolution.context.summary,\n      operationError(\n        \"PROFILE_POSTURE_NOT_ALLOWED\",\n        \"The active profile posture cannot execute this operation.\",\n      ),\n    ) };\n  }\n  if (\n    target.privateKey === undefined &&\n    definition.runtime === \"authenticated\" &&\n    isOwnerPosture(inspectionResolution.context.summary.posture) &&\n    target.allowOwnerProfile !== true\n  ) {\n    return { status: \"error\", result: errorResult(\n      operation,\n      inspectionResolution.context.summary,\n      operationError(\n        \"PROFILE_OWNER_OPT_IN_REQUIRED\",\n        \"Owner-profile execution requires explicit opt-in.\",\n      ),\n    ) };\n  }\n\n  const runtimeResolution =\n    definition.runtime === \"inspection\"\n      ? inspectionResolution\n      : await resolveRuntime(target, \"authenticated\");\n  if (!runtimeResolution.ok) {\n    return { status: \"error\", result: errorResult(\n      operation,\n      runtimeResolution.context,\n      runtimeResolution.error,\n    ) };\n  }\n  if (definition.runtime === \"authenticated\") {\n    const actualPosture = runtimeResolution.context.summary.posture;\n    if (!definition.postures.includes(actualPosture)) {\n      return { status: \"error\", result: errorResult(\n        operation,\n        runtimeResolution.context.summary,\n        operationError(\n          \"PROFILE_POSTURE_NOT_ALLOWED\",\n          \"The authenticated profile posture cannot execute this operation.\",\n        ),\n      ) };\n    }\n    if (isOwnerPosture(actualPosture) && target.allowOwnerProfile !== true) {\n      return { status: \"error\", result: errorResult(\n        operation,\n        runtimeResolution.context.summary,\n        operationError(\n          \"PROFILE_OWNER_OPT_IN_REQUIRED\",\n          \"Owner-profile execution requires explicit opt-in.\",\n        ),\n      ) };\n    }\n  }\n  return {\n    operation,\n    definition,\n    parsedInput,\n    runtimeResolution,\n  };\n}\n\nasync function executePreparedInvocation(\n  prepared: Exclude<PreparedInvocation, { status: \"error\" }>,\n  options: Readonly<{ deferAuthorityRequest?: boolean }> = {},\n): Promise<OperationResult<unknown>> {\n  const { operation, definition, parsedInput, runtimeResolution } = prepared;\n  const runtimeContext =\n    runtimeResolution.context.runtime === undefined\n      ? undefined\n      : (runtimeResolution.context as RuntimeOperationContext);\n  const resolveSpace = runtimeContext === undefined\n    ? undefined\n    : operationSpaceResolver(\n      runtimeContext.runtime.node,\n      runtimeContext.summary.space,\n    );\n\n  try {\n    const planned = await definition.authority(\n      (runtimeContext ?? runtimeResolution.context) as RuntimeOperationContext,\n      parsedInput.data,\n    );\n    const required = exactCapabilities(planned);\n    if (required === undefined) {\n      return errorResult(\n        operation,\n        runtimeResolution.context.summary,\n        operationError(\n          \"PERMISSION_HINT_INVALID\",\n          \"The operation returned an invalid permission requirement.\",\n        ),\n      );\n    }\n\n    const evaluation = evaluateOperationAuthority(\n      (runtimeContext?.runtime.granted ?? []) as unknown as PermissionEntry[],\n      required as unknown as PermissionEntry[],\n      resolveSpace,\n    );\n    if (!evaluation.satisfied) {\n      if (runtimeContext === undefined) {\n        return errorResult(\n          operation,\n          runtimeResolution.context.summary,\n          internalOperationError(),\n        );\n      }\n      if (options.deferAuthorityRequest) {\n        try {\n          const request = buildPermissionRequestArtifact({\n            profile: runtimeContext.summary.profile,\n            host: runtimeContext.summary.host,\n            sessionDid: runtimeContext.summary.sessionDid!,\n            posture: runtimeContext.summary.posture,\n            operatorType: runtimeContext.summary.operatorType ?? \"human\",\n            ...(runtimeContext.summary.ownerDid === undefined\n              ? {}\n              : { ownerDid: runtimeContext.summary.ownerDid }),\n            ...(runtimeContext.summary.space === undefined\n              ? {}\n              : { spaceId: runtimeContext.summary.space }),\n            missing: evaluation.missing as unknown as PermissionEntry[],\n          });\n          return authorityRequiredResult(\n            operation,\n            runtimeResolution.context.summary,\n            parsedInput.data,\n            request,\n            evaluation.missing,\n            runtimeContext.runtime.node,\n          );\n        } catch {\n          return errorResult(\n            operation,\n            runtimeResolution.context.summary,\n            internalOperationError(),\n          );\n        }\n      }\n      const authority = await persistAuthorityRequest(\n        runtimeContext,\n        evaluation.missing,\n      );\n      if (authority.status === \"error\") {\n        return errorResult(\n          operation,\n          runtimeResolution.context.summary,\n          authority.error,\n        );\n      }\n      return authorityRequiredResult(\n        operation,\n        runtimeResolution.context.summary,\n        parsedInput.data,\n        authority.request,\n        authority.missing,\n        runtimeContext.runtime.node,\n      );\n    }\n\n    const outcome = await definition.execute(\n      runtimeResolution.context,\n      parsedInput.data,\n    );\n\n    switch (outcome.status) {\n      case \"ok\": {\n        const parsedOutput = definition.output.safeParse(outcome.output);\n        if (!parsedOutput.success) {\n          return errorResult(\n            operation,\n            runtimeResolution.context.summary,\n            operationError(\n              \"OUTPUT_INVALID\",\n              \"The operation returned an invalid result.\",\n            ),\n          );\n        }\n        return {\n          status: \"ok\",\n          operation,\n          context: runtimeResolution.context.summary,\n          output: parsedOutput.data,\n        };\n      }\n      case \"authority_required\": {\n        const hinted = exactCapabilities(outcome.missing);\n        if (\n          hinted === undefined ||\n          !isExactCapabilityMemberSubset(\n            hinted as unknown as PermissionEntry[],\n            required as unknown as PermissionEntry[],\n            resolveSpace,\n          )\n        ) {\n          return errorResult(\n            operation,\n            runtimeResolution.context.summary,\n            operationError(\n              \"PERMISSION_HINT_INVALID\",\n              \"The node returned an invalid permission hint.\",\n            ),\n          );\n        }\n        if (runtimeContext === undefined) {\n          return errorResult(\n            operation,\n            runtimeResolution.context.summary,\n            internalOperationError(),\n          );\n        }\n        if (options.deferAuthorityRequest) {\n          try {\n            const request = buildPermissionRequestArtifact({\n              profile: runtimeContext.summary.profile,\n              host: runtimeContext.summary.host,\n              sessionDid: runtimeContext.summary.sessionDid!,\n              posture: runtimeContext.summary.posture,\n              operatorType: runtimeContext.summary.operatorType ?? \"human\",\n              ...(runtimeContext.summary.ownerDid === undefined\n                ? {}\n                : { ownerDid: runtimeContext.summary.ownerDid }),\n              ...(runtimeContext.summary.space === undefined\n                ? {}\n                : { spaceId: runtimeContext.summary.space }),\n              missing: hinted as unknown as PermissionEntry[],\n            });\n            return authorityRequiredResult(\n              operation,\n              runtimeResolution.context.summary,\n              parsedInput.data,\n              request,\n              hinted,\n              runtimeContext.runtime.node,\n              outcome.requiresCallerInput ?? false,\n            );\n          } catch {\n            return errorResult(\n              operation,\n              runtimeResolution.context.summary,\n              internalOperationError(),\n            );\n          }\n        }\n        const authority = await persistAuthorityRequest(\n          runtimeContext,\n          hinted,\n          true,\n        );\n        if (authority.status === \"error\") {\n          return errorResult(\n            operation,\n            runtimeResolution.context.summary,\n            authority.error,\n          );\n        }\n        return authorityRequiredResult(\n          operation,\n          runtimeResolution.context.summary,\n          parsedInput.data,\n          authority.request,\n          authority.missing,\n          runtimeContext.runtime.node,\n          outcome.requiresCallerInput ?? false,\n        );\n      }\n      case \"setup_required\":\n        return {\n          status: \"setup_required\",\n          operation,\n          context: runtimeResolution.context.summary,\n          setup: outcome.setup,\n          retry: retryDescriptor(\n            operation,\n            parsedInput.data,\n            outcome.requiresCallerInput ?? false,\n          ),\n        };\n      case \"error\":\n        return errorResult(\n          operation,\n          runtimeResolution.context.summary,\n          redactOperationError(\n            definition,\n            sanitizeOperationError(outcome.error),\n          ),\n        );\n      default:\n        return errorResult(\n          operation,\n          runtimeResolution.context.summary,\n          internalOperationError(),\n        );\n    }\n  } catch (error) {\n    return errorResult(\n      operation,\n      runtimeResolution.context.summary,\n      redactOperationError(definition, sanitizeThrownOperationError(error)),\n    );\n  }\n}\n\nfunction normalizeInvocationTarget(\n  target: unknown,\n): InvocationTarget | undefined {\n  if (typeof target !== \"object\" || target === null) return undefined;\n\n  try {\n    const candidate = target as InvocationTarget;\n    const profile = candidate.profile;\n    const host = candidate.host;\n    const stateRoot = candidate.stateRoot;\n    const allowOwnerProfile = candidate.allowOwnerProfile;\n    const privateKey = candidate.privateKey;\n\n    if (\n      (profile !== undefined && typeof profile !== \"string\") ||\n      (host !== undefined && typeof host !== \"string\") ||\n      (stateRoot !== undefined &&\n        (typeof stateRoot !== \"string\" || !isAbsolute(stateRoot))) ||\n      (allowOwnerProfile !== undefined &&\n        typeof allowOwnerProfile !== \"boolean\") ||\n      (privateKey !== undefined && typeof privateKey !== \"string\")\n    ) {\n      return undefined;\n    }\n\n    return {\n      ...(profile === undefined ? {} : { profile }),\n      ...(host === undefined ? {} : { host }),\n      ...(stateRoot === undefined ? {} : { stateRoot }),\n      ...(allowOwnerProfile === true ? { allowOwnerProfile: true } : {}),\n      ...(privateKey === undefined ? {} : { privateKey }),\n    };\n  } catch {\n    return undefined;\n  }\n}\n\nasync function resolveRuntime(\n  target: InvocationTarget,\n  requirement: OperationRuntimeRequirement,\n): Promise<InvocationRuntimeResolution> {\n  try {\n    // Keep the root package loadable for projections that only inspect its\n    // public invocation export. The SDK runtime is needed only once a valid\n    // operation reaches runtime construction.\n    const { createInvocationRuntime } = await import(\"./runtime.js\");\n    return await createInvocationRuntime(target, requirement);\n  } catch (error) {\n    return {\n      ok: false,\n      context: unresolvedContextSummary(target),\n      error: sanitizeThrownOperationError(error),\n    };\n  }\n}\n\nfunction unresolvedContextSummary(\n  target: InvocationTarget = {},\n): OperationContextSummary {\n  return {\n    profile: typeof target.profile === \"string\" ? target.profile : \"unresolved\",\n    host: safeOriginHost(target.host) ?? \"unresolved\",\n    posture: \"unauthenticated\",\n  };\n}\n\nfunction errorResult(\n  operation: OperationRef,\n  context: OperationContextSummary,\n  error: ReturnType<typeof sanitizeOperationError>,\n): OperationResult<never> {\n  return { status: \"error\", operation, context, error };\n}\n\nfunction retryDescriptor(\n  operation: OperationRef,\n  input: unknown,\n  requiresCallerInput: boolean,\n): Readonly<{\n  operationId: string;\n  operationVersion: number;\n  inputDigest: string;\n  requiresCallerInput: boolean;\n}> {\n  return {\n    operationId: operation.operationId,\n    operationVersion: operation.operationVersion,\n    inputDigest: createHash(\"sha256\")\n      .update(jcsCanonicalize(input), \"utf8\")\n      .digest(\"hex\"),\n    requiresCallerInput,\n  };\n}\n\ntype PersistedAuthority =\n  | Readonly<{\n      status: \"ok\";\n      request: PermissionRequestArtifact;\n      missing: readonly CapabilityRequirement[];\n    }>\n  | Readonly<{\n      status: \"error\";\n      error: ReturnType<typeof sanitizeOperationError>;\n    }>;\n\nasync function persistAuthorityRequest(\n  context: RuntimeOperationContext,\n  missing: readonly CapabilityRequirement[],\n  force = false,\n): Promise<PersistedAuthority> {\n  const sessionDid = context.summary.sessionDid;\n  if (sessionDid === undefined) {\n    return {\n      status: \"error\",\n      error: operationError(\n        \"SESSION_NOT_FOUND\",\n        \"The selected profile does not have an active session.\",\n      ),\n    };\n  }\n  try {\n    const resolveSpace = operationSpaceResolver(\n      context.runtime.node,\n      context.summary.space,\n    );\n    const canonicalMissing = canonicalizeOperationCapabilities(missing as unknown as PermissionEntry[], resolveSpace);\n    const canonicalGranted = canonicalizeOperationCapabilities(context.runtime.granted as unknown as PermissionEntry[], resolveSpace);\n    const resolution = await createOrReusePermissionRequest({\n      profile: context.summary.profile,\n      posture: context.summary.posture,\n      operatorType: context.summary.operatorType ?? \"human\",\n      host: context.summary.host,\n      sessionDid,\n      ...(context.summary.ownerDid === undefined\n        ? {}\n        : { ownerDid: context.summary.ownerDid }),\n      ...(context.summary.space === undefined\n        ? {}\n        : { spaceId: context.summary.space }),\n      missing: canonicalMissing as unknown as PermissionEntry[],\n      granted: (force\n        ? []\n        : canonicalGranted) as unknown as PermissionEntry[],\n      resolveSpace,\n    });\n    if (resolution.status !== \"created\") {\n      return {\n        status: \"error\",\n        error: operationError(\n          \"INTERNAL_ERROR\",\n          \"The authority request could not be created.\",\n        ),\n      };\n    }\n    return {\n      status: \"ok\",\n      request: resolution.request,\n      missing: canonicalMissing as CapabilityRequirement[],\n    };\n  } catch {\n    return {\n      status: \"error\",\n      error: operationError(\n        \"INTERNAL_ERROR\",\n        \"The authority request could not be created.\",\n      ),\n    };\n  }\n}\n\nfunction authorityRequiredResult(\n  operation: OperationRef,\n  context: OperationContextSummary,\n  input: unknown,\n  request: PermissionRequestArtifact,\n  missing: readonly CapabilityRequirement[],\n  node: unknown,\n  requiresCallerInput = false,\n): OperationResult<never> {\n  return {\n    status: \"authority_required\",\n    operation,\n    context,\n    missing,\n    request,\n    approval: approvalAction(request, node),\n    retry: retryDescriptor(operation, input, requiresCallerInput),\n  };\n}\n\nfunction approvalAction(\n  request: PermissionRequestArtifact,\n  node: unknown,\n): ApprovalAction {\n  const maybeNode = node as {\n    getOpenKeyApprovalUrl?: (artifact: PermissionRequestArtifact) => unknown;\n  };\n  let url: string | undefined;\n  try {\n    const candidate = maybeNode.getOpenKeyApprovalUrl?.(request);\n    if (typeof candidate === \"string\" && candidate.length > 0) url = candidate;\n  } catch {\n    // The stored request remains the source of truth when a runtime does not\n    // expose a canonical OpenKey URL.\n  }\n  return {\n    kind: \"openkey\",\n    requestId: request.requestId,\n    ...(url === undefined ? {} : { url }),\n    fallback: \"tc auth grant <request-artifact>\",\n  };\n}\n\nfunction exactCapabilities(\n  value: unknown,\n): CapabilityRequirement[] | undefined {\n  return validateExactCapabilities(value) as\n    | CapabilityRequirement[]\n    | undefined;\n}\n\nfunction requirementsBelongToAuthenticatedOwner(\n  requirements: readonly PermissionEntry[],\n  authenticatedSpace: string | undefined,\n): boolean {\n  const authenticatedOwner = canonicalPkhOwner(authenticatedSpace);\n  if (authenticatedOwner === undefined) return false;\n  return requirements.every((requirement) => {\n    if (requirement.service === \"tinycloud.encryption\") {\n      return requirement.space === undefined;\n    }\n    const requirementOwner = canonicalPkhOwner(requirement.space);\n    return requirement.service === \"tinycloud.kv\" && requirementOwner === authenticatedOwner;\n  });\n}\n\nfunction canonicalPkhOwner(space: string | undefined): string | undefined {\n  if (typeof space !== \"string\") return undefined;\n  const parsedSpace = parseSpaceUri(space);\n  if (parsedSpace === null) return undefined;\n  try {\n    const pkh = parsePkhDid(parsedSpace.owner);\n    return pkh === null\n      ? undefined\n      : parseSpaceUri(makePkhSpaceId(pkh.address, pkh.chainId, parsedSpace.name))?.owner;\n  } catch {\n    return undefined;\n  }\n}\n\nfunction isExactLocalSecretsGetPlan(\n  prepared: Exclude<PreparedInvocation, { status: \"error\" }>,\n  planned: readonly CapabilityRequirement[],\n  context: RuntimeOperationContext,\n): \"valid\" | \"ineligible\" | \"invalid\" {\n  if (\n    prepared.definition.id !== \"tinycloud.secrets.get\" ||\n    prepared.definition.version !== 1 ||\n    JSON.stringify(prepared.definition.effects) !== JSON.stringify([\"read\", \"local_write\"])\n  ) return \"invalid\";\n\n  const resolveSpace = operationSpaceResolver(context.runtime.node, context.summary.space);\n  let reference;\n  try {\n    reference = resolveSecretReferenceForOperation(\n      prepared.parsedInput.data,\n      context.runtime.node,\n      context.summary.space,\n    );\n  } catch {\n    return \"invalid\";\n  }\n  const canonicalPlan = canonicalizeOperationCapabilities(\n    planned as unknown as PermissionEntry[],\n    resolveSpace,\n  );\n  if (canonicalPlan.length !== 2) return \"invalid\";\n  const kv = canonicalPlan.find((permission) => permission.service === \"tinycloud.kv\");\n  const decrypt = canonicalPlan.find((permission) => permission.service === \"tinycloud.encryption\");\n  if (kv === undefined || decrypt === undefined) return \"invalid\";\n  const requestedOwner = canonicalPkhOwner(kv.space);\n  const authenticatedOwner = canonicalPkhOwner(context.summary.space);\n  if (requestedOwner === undefined || authenticatedOwner === undefined || requestedOwner !== authenticatedOwner) {\n    return \"ineligible\";\n  }\n  if (JSON.stringify(kv) !== JSON.stringify({\n    service: \"tinycloud.kv\",\n    space: resolveSpace(reference.space),\n    path: reference.permissionPath,\n    actions: [\"tinycloud.kv/get\"],\n  })) return \"invalid\";\n  if (\n    JSON.stringify(decrypt) !== JSON.stringify({\n      service: \"tinycloud.encryption\",\n      path: decrypt.path,\n      actions: [\"tinycloud.encryption/decrypt\"],\n    }) ||\n    typeof decrypt.path !== \"string\" ||\n    !decrypt.path.startsWith(\"urn:tinycloud:encryption:\")\n  ) return \"invalid\";\n  return \"valid\";\n}\n\nfunction refreshLiveRuntimeAuthority(\n  node: unknown,\n  requested: readonly PermissionEntry[],\n  planned: readonly PermissionEntry[],\n  resolveSpace: (space: string) => string,\n): readonly CapabilityRequirement[] | undefined {\n  const candidate = node as {\n    hasRuntimePermissions?: (permissions: PermissionEntry[]) => unknown;\n    getVerifiedSessionCapabilities?: () => unknown;\n    getEffectiveRuntimePermissionEntries?: () => unknown;\n  };\n  if (typeof candidate.hasRuntimePermissions !== \"function\") return undefined;\n  if (candidate.hasRuntimePermissions([...requested]) !== true) return undefined;\n  if (typeof candidate.getVerifiedSessionCapabilities !== \"function\" ||\n      typeof candidate.getEffectiveRuntimePermissionEntries !== \"function\") return undefined;\n\n  const base = candidate.getVerifiedSessionCapabilities();\n  const activated = candidate.getEffectiveRuntimePermissionEntries();\n  if (!Array.isArray(base) || !Array.isArray(activated)) return undefined;\n  const exactActivated = validateExactCapabilities(activated);\n  if (exactActivated === undefined) return undefined;\n  const selectedActivated = exactActivated.filter((permission) =>\n    isExactCapabilityMemberSubset([permission], planned, resolveSpace),\n  );\n  if (!isExactCapabilityMemberSubset(requested, selectedActivated, resolveSpace)) return undefined;\n  const combined = canonicalizeOperationCapabilities(\n    [...base, ...selectedActivated],\n    resolveSpace,\n  );\n  return evaluateOperationAuthority(combined, planned as unknown as PermissionEntry[], resolveSpace).satisfied\n    ? combined\n    : undefined;\n}\n\nfunction localAuthorityFailure(\n  prepared: Exclude<PreparedInvocation, { status: \"error\" }>,\n): OperationResult<never> {\n  return errorResult(\n    prepared.operation,\n    prepared.runtimeResolution.context.summary,\n    operationError(\n      \"NODE_ERROR\",\n      \"The local owner could not acquire the requested secret permissions.\",\n      { retryable: true },\n    ),\n  );\n}\n\nfunction internalOperationErrorResult(\n  prepared: Exclude<PreparedInvocation, { status: \"error\" }>,\n): OperationResult<never> {\n  return errorResult(\n    prepared.operation,\n    prepared.runtimeResolution.context.summary,\n    internalOperationError(),\n  );\n}\n\nfunction isOwnerPosture(posture: OperationContextSummary[\"posture\"]): boolean {\n  return posture === \"owner-openkey\" || posture === \"local-owner-key\";\n}\n\nfunction zodIssueDetails(error: ZodError): Readonly<Record<string, unknown>> {\n  return {\n    // The canonical error channel carries only schema-owned issue codes.\n    // Messages and paths can contain arbitrary input keys and values.\n    issues: error.issues.map((issue) => ({ code: issue.code })),\n  };\n}\n","export type SignedObjectErrorCode =\n  | \"schema-invalid\"\n  | \"canonicalization-mismatch\"\n  | \"digest-mismatch\"\n  | \"id-mismatch\"\n  | \"signing-key-binding\"\n  | \"signature-material-invalid\"\n  | \"signature-suite-unsupported\"\n  | \"signature-invalid\";\n\nexport class SignedObjectProfileError extends Error {\n  public readonly code: SignedObjectErrorCode;\n\n  constructor(code: SignedObjectErrorCode, message: string) {\n    super(message);\n    this.name = \"SignedObjectProfileError\";\n    this.code = code;\n  }\n}\n\nexport class SignedObjectSchemaError extends SignedObjectProfileError {\n  constructor(message: string) {\n    super(\"schema-invalid\", message);\n    this.name = \"SignedObjectSchemaError\";\n  }\n}\n\nexport class SignedObjectCanonicalizationError extends SignedObjectProfileError {\n  constructor(message: string) {\n    super(\"canonicalization-mismatch\", message);\n    this.name = \"SignedObjectCanonicalizationError\";\n  }\n}\n\nexport class SignedObjectDigestError extends SignedObjectProfileError {\n  constructor(message: string) {\n    super(\"digest-mismatch\", message);\n    this.name = \"SignedObjectDigestError\";\n  }\n}\n\nexport class SignedObjectIdError extends SignedObjectProfileError {\n  constructor(message: string) {\n    super(\"id-mismatch\", message);\n    this.name = \"SignedObjectIdError\";\n  }\n}\n\nexport class SigningKeyBindingError extends SignedObjectProfileError {\n  constructor(message: string) {\n    super(\"signing-key-binding\", message);\n    this.name = \"SigningKeyBindingError\";\n  }\n}\n\nexport class SignatureMaterialError extends SignedObjectProfileError {\n  constructor(message: string) {\n    super(\"signature-material-invalid\", message);\n    this.name = \"SignatureMaterialError\";\n  }\n}\n\nexport class UnsupportedSignatureSuiteError extends SignedObjectProfileError {\n  constructor(message: string) {\n    super(\"signature-suite-unsupported\", message);\n    this.name = \"UnsupportedSignatureSuiteError\";\n  }\n}\n\nexport class SignatureVerificationError extends SignedObjectProfileError {\n  constructor(message: string) {\n    super(\"signature-invalid\", message);\n    this.name = \"SignatureVerificationError\";\n  }\n}\n\nexport function toSignedObjectError(error: unknown): SignedObjectProfileError {\n  if (error instanceof SignedObjectProfileError) {\n    return error;\n  }\n  return new SignedObjectProfileError(\n    \"schema-invalid\",\n    error instanceof Error ? error.message : String(error),\n  );\n}\n","import { SignedObjectCanonicalizationError } from \"./errors\";\n\nexport type JsonValue =\n  | null\n  | boolean\n  | number\n  | string\n  | JsonValue[]\n  | { readonly [key: string]: JsonValue };\n\ntype MutableJsonObject = { [key: string]: JsonValue };\nconst objectHasOwn: (object: object, propertyKey: PropertyKey) => boolean =\n  (Object as ObjectConstructor & {\n    hasOwn?: (object: object, propertyKey: PropertyKey) => boolean;\n  }).hasOwn ??\n  (Object.prototype.hasOwnProperty.call.bind(\n    Object.prototype.hasOwnProperty,\n  ) as (object: object, propertyKey: PropertyKey) => boolean);\n\n/**\n * RFC 8785 JSON Canonicalization Scheme encoder for the signed-object profile.\n *\n * This local encoder is intentionally stricter than JSON.stringify:\n * it rejects non-plain JSON inputs, sparse arrays, undefined/functions/symbols,\n * non-finite numbers, BigInt, dangerous prototype keys, and lone surrogates.\n * Object keys are sorted lexicographically by their raw UTF-16 code units,\n * as required by RFC 8785 section 3.2.3, before serialization.\n */\nexport function jcsCanonicalize(input: unknown): string {\n  return serialize(normalizeJson(input, \"$\"));\n}\n\nexport function normalizeJson(input: unknown, path = \"$\"): JsonValue {\n  if (input === null) {\n    return null;\n  }\n\n  switch (typeof input) {\n    case \"boolean\":\n      return input;\n    case \"number\":\n      if (!Number.isFinite(input)) {\n        throw new SignedObjectCanonicalizationError(\n          `${path} must be a finite JSON number`,\n        );\n      }\n      return input;\n    case \"string\":\n      assertUnicodeScalarString(input, path);\n      return input;\n    case \"object\":\n      return normalizeJsonObjectOrArray(input, path);\n    case \"bigint\":\n    case \"function\":\n    case \"symbol\":\n    case \"undefined\":\n    default:\n      throw new SignedObjectCanonicalizationError(\n        `${path} is not a JSON value`,\n      );\n  }\n}\n\nexport function serialize(value: JsonValue): string {\n  if (value === null) {\n    return \"null\";\n  }\n\n  switch (typeof value) {\n    case \"boolean\":\n      return value ? \"true\" : \"false\";\n    case \"number\": {\n      const encoded = JSON.stringify(value);\n      if (encoded === undefined) {\n        throw new SignedObjectCanonicalizationError(\n          \"number could not be serialized as JSON\",\n        );\n      }\n      return encoded;\n    }\n    case \"string\":\n      return JSON.stringify(value);\n    case \"object\":\n      if (Array.isArray(value)) {\n        return `[${value.map((item) => serialize(item)).join(\",\")}]`;\n      }\n      return serializeObject(value);\n    default:\n      throw new SignedObjectCanonicalizationError(\n        `unsupported JSON value type ${typeof value}`,\n      );\n  }\n}\n\nfunction normalizeJsonObjectOrArray(input: object, path: string): JsonValue {\n  assertNoSymbolKeys(input, path);\n\n  if (Array.isArray(input)) {\n    for (const key of Object.getOwnPropertyNames(input)) {\n      if (key === \"length\") {\n        continue;\n      }\n      if (!isArrayIndexKey(key, input.length)) {\n        throw new SignedObjectCanonicalizationError(\n          `${path}.${key} is not allowed on a JSON array`,\n        );\n      }\n      const descriptor = Object.getOwnPropertyDescriptor(input, key);\n      if (descriptor?.enumerable !== true) {\n        throw new SignedObjectCanonicalizationError(\n          `${path}[${key}] must be an enumerable JSON array item`,\n        );\n      }\n      if (!(\"value\" in descriptor)) {\n        throw new SignedObjectCanonicalizationError(\n          `${path}[${key}] must be a JSON data property`,\n        );\n      }\n    }\n    const output: JsonValue[] = [];\n    for (let index = 0; index < input.length; index++) {\n      if (!objectHasOwn(input, index)) {\n        throw new SignedObjectCanonicalizationError(\n          `${path}[${index}] must not be a sparse array hole`,\n        );\n      }\n      output.push(normalizeJson(input[index], `${path}[${index}]`));\n    }\n    return output;\n  }\n\n  const proto = Object.getPrototypeOf(input);\n  if (proto !== Object.prototype && proto !== null) {\n    throw new SignedObjectCanonicalizationError(\n      `${path} must be a plain JSON object`,\n    );\n  }\n\n  const output = Object.create(null) as MutableJsonObject;\n  for (const key of Object.getOwnPropertyNames(input)) {\n    assertUnicodeScalarString(key, `${path} key`);\n    if (key === \"__proto__\" || key === \"constructor\") {\n      throw new SignedObjectCanonicalizationError(\n        `${path}.${key} is not allowed`,\n      );\n    }\n    const descriptor = Object.getOwnPropertyDescriptor(input, key);\n    if (descriptor?.enumerable !== true) {\n      throw new SignedObjectCanonicalizationError(\n        `${path}.${key} must be an enumerable JSON object property`,\n      );\n    }\n    if (!(\"value\" in descriptor)) {\n      throw new SignedObjectCanonicalizationError(\n        `${path}.${key} must be a JSON data property`,\n      );\n    }\n    const value = descriptor.value;\n    output[key] = normalizeJson(value, `${path}.${key}`);\n  }\n  return output;\n}\n\nfunction assertNoSymbolKeys(input: object, path: string): void {\n  if (Object.getOwnPropertySymbols(input).length > 0) {\n    throw new SignedObjectCanonicalizationError(\n      `${path} must not have symbol properties`,\n    );\n  }\n}\n\nfunction isArrayIndexKey(key: string, length: number): boolean {\n  if (!/^(0|[1-9]\\d*)$/.test(key)) {\n    return false;\n  }\n  const index = Number(key);\n  return Number.isSafeInteger(index) && index >= 0 && index < length;\n}\n\nfunction serializeObject(value: { readonly [key: string]: JsonValue }): string {\n  const keys = Object.keys(value).sort(compareUtf16CodeUnits);\n  const parts = keys.map((key) => `${JSON.stringify(key)}:${serialize(value[key])}`);\n  return `{${parts.join(\",\")}}`;\n}\n\nfunction compareUtf16CodeUnits(a: string, b: string): number {\n  const max = Math.min(a.length, b.length);\n  for (let index = 0; index < max; index++) {\n    const leftCodeUnit = a.charCodeAt(index);\n    const rightCodeUnit = b.charCodeAt(index);\n    if (leftCodeUnit !== rightCodeUnit) {\n      return leftCodeUnit - rightCodeUnit;\n    }\n  }\n  return a.length - b.length;\n}\n\nfunction assertUnicodeScalarString(value: string, path: string): void {\n  for (let index = 0; index < value.length; index++) {\n    const code = value.charCodeAt(index);\n    if (code >= 0xd800 && code <= 0xdbff) {\n      const next = value.charCodeAt(index + 1);\n      if (Number.isNaN(next) || next < 0xdc00 || next > 0xdfff) {\n        throw new SignedObjectCanonicalizationError(\n          `${path} contains a lone high surrogate`,\n        );\n      }\n      index++;\n      continue;\n    }\n    if (code >= 0xdc00 && code <= 0xdfff) {\n      throw new SignedObjectCanonicalizationError(\n        `${path} contains a lone low surrogate`,\n      );\n    }\n  }\n}\n","/**\n * Values allowed to cross the operation error and context channels.\n *\n * These are intentionally strict. A mismatch detail is useful only when it\n * identifies the same kind of value the runtime actually compares; treating\n * every string as safe would turn the detail field into an exfiltration path.\n */\nexport function safeOriginHost(value: unknown): string | undefined {\n  if (typeof value !== \"string\" || value.length === 0) return undefined;\n\n  let parsed: URL;\n  try {\n    parsed = new URL(value);\n  } catch {\n    return undefined;\n  }\n\n  if (\n    (parsed.protocol !== \"http:\" && parsed.protocol !== \"https:\") ||\n    parsed.username !== \"\" ||\n    parsed.password !== \"\" ||\n    parsed.search !== \"\" ||\n    parsed.hash !== \"\" ||\n    (parsed.pathname !== \"\" && parsed.pathname !== \"/\") ||\n    parsed.origin === \"null\"\n  ) {\n    return undefined;\n  }\n\n  const originWithOptionalSlash = `${parsed.origin}/`;\n  if (value !== parsed.origin && value !== originWithOptionalSlash) {\n    return undefined;\n  }\n  return parsed.origin;\n}\n\nexport function safeSessionDid(value: unknown): string | undefined {\n  if (typeof value !== \"string\" || value.length === 0) return undefined;\n\n  const [principal, fragment, ...extra] = value.split(\"#\");\n  if (\n    extra.length > 0 ||\n    (fragment !== undefined && !/^[A-Za-z0-9._:-]+$/.test(fragment))\n  ) {\n    return undefined;\n  }\n\n  if (isEd25519DidKey(principal) || isEip155PkhDid(principal)) {\n    return principal;\n  }\n  return undefined;\n}\n\nfunction isEd25519DidKey(value: string): boolean {\n  if (!value.startsWith(\"did:key:z\")) return false;\n  const bytes = decodeBase58(value.slice(\"did:key:z\".length));\n  return (\n    bytes !== undefined &&\n    bytes.length === 34 &&\n    bytes[0] === 0xed &&\n    bytes[1] === 0x01\n  );\n}\n\nfunction isEip155PkhDid(value: string): boolean {\n  return /^did:pkh:eip155:[1-9][0-9]*:0x[0-9a-fA-F]{40}$/.test(value);\n}\n\nfunction decodeBase58(value: string): Uint8Array | undefined {\n  if (value.length === 0) return undefined;\n  const alphabet = \"123456789ABCDEFGHJKLMNPQRSTUVWXYZabcdefghijkmnopqrstuvwxyz\";\n  const digits = [0];\n  for (const character of value) {\n    const index = alphabet.indexOf(character);\n    if (index < 0) return undefined;\n    let carry = index;\n    for (let i = 0; i < digits.length; i += 1) {\n      carry += digits[i]! * 58;\n      digits[i] = carry & 0xff;\n      carry >>= 8;\n    }\n    while (carry > 0) {\n      digits.push(carry & 0xff);\n      carry >>= 8;\n    }\n  }\n  for (const character of value) {\n    if (character !== \"1\") break;\n    digits.push(0);\n  }\n  return Uint8Array.from(digits.reverse());\n}\n","import type {\n  OperationContextSummary,\n  OperationDefinition,\n  OperationRef,\n} from \"./contract.js\";\nimport type { OperationError, OperationErrorCode } from \"./errors.js\";\nimport { safeOriginHost, safeSessionDid } from \"./safe-values.js\";\n\nexport const REDACTED_VALUE = \"[REDACTED]\";\n\nexport interface SafeOperationDiagnostic {\n  readonly operation: OperationRef;\n  readonly context: OperationContextSummary;\n  readonly input?: unknown;\n  readonly output?: unknown;\n  readonly error?: OperationError;\n}\n\n/**\n * Return a detached redacted value. A missing pointer is intentionally a no-op\n * so an operation can evolve an optional shape without leaking another field.\n */\nexport function redactOperationValue(\n  definition: Pick<OperationDefinition<unknown, unknown>, \"sensitivity\">,\n  value: unknown,\n): unknown {\n  const clone = cloneValue(value);\n  const pointers = [\n    ...definition.sensitivity.input,\n    ...definition.sensitivity.output,\n  ];\n\n  let redacted: unknown = clone;\n  for (const pointer of pointers) {\n    redacted = redactPointer(redacted, pointer);\n  }\n  return redacted;\n}\n\n/**\n * Diagnostic payloads are a supported non-result channel. They accept raw\n * operation values only through this helper, never an invocation target.\n */\nexport function createSafeOperationDiagnostic(\n  definition: Pick<OperationDefinition<unknown, unknown>, \"sensitivity\">,\n  diagnostic: Readonly<{\n    operation: OperationRef;\n    context: OperationContextSummary;\n    input?: unknown;\n    output?: unknown;\n    error?: OperationError;\n  }>,\n): SafeOperationDiagnostic {\n  return {\n    operation: {\n      operationId: diagnostic.operation.operationId,\n      operationVersion: diagnostic.operation.operationVersion,\n    },\n    context: {\n      profile: diagnostic.context.profile,\n      host: diagnostic.context.host,\n      posture: diagnostic.context.posture,\n      ...(diagnostic.context.operatorType === undefined\n        ? {}\n        : { operatorType: diagnostic.context.operatorType }),\n      ...(diagnostic.context.principalDid === undefined\n        ? {}\n        : { principalDid: diagnostic.context.principalDid }),\n      ...(diagnostic.context.sessionDid === undefined\n        ? {}\n        : { sessionDid: diagnostic.context.sessionDid }),\n      ...(diagnostic.context.ownerDid === undefined\n        ? {}\n        : { ownerDid: diagnostic.context.ownerDid }),\n      ...(diagnostic.context.space === undefined\n        ? {}\n        : { space: diagnostic.context.space }),\n    },\n    ...(diagnostic.input === undefined\n      ? {}\n      : { input: redactOperationValue(definition, diagnostic.input) }),\n    ...(diagnostic.output === undefined\n      ? {}\n      : { output: redactOperationValue(definition, diagnostic.output) }),\n    ...(diagnostic.error === undefined\n      ? {}\n      : { error: redactOperationError(definition, diagnostic.error) }),\n  };\n}\n\nexport function redactOperationError(\n  _definition: Pick<OperationDefinition<unknown, unknown>, \"sensitivity\">,\n  error: OperationError,\n): OperationError {\n  const details =\n    error.details === undefined\n      ? undefined\n      : redactSafeErrorDetails(error.code, error.details);\n\n  return {\n    code: error.code,\n    message: error.message,\n    retryable: error.retryable,\n    ...(details === undefined\n      ? {}\n      : {\n          details: isRecord(details) ? details : { redacted: details },\n        }),\n  };\n}\n\n/**\n * Error details are a separate, code-owned channel. Only fields with an\n * explicit stable policy can cross the canonical result or diagnostic\n * boundary; arbitrary handler details are dropped rather than redacted by\n * input pointers, which could accidentally preserve a transport secret.\n */\nconst SAFE_ERROR_DETAIL_POLICIES: Readonly<\n  Partial<\n    Record<\n      OperationErrorCode,\n      Readonly<Record<string, (value: unknown) => unknown | undefined>>\n    >\n  >\n> = {\n  INPUT_INVALID: {\n    issues: (value) =>\n      Array.isArray(value) ? safeIssueCodes(value) : undefined,\n  },\n  OPERATION_VERSION_UNSUPPORTED: {\n    supportedVersions: (value) =>\n      Array.isArray(value) && value.every((item) => Number.isInteger(item))\n        ? value\n        : undefined,\n  },\n  DELEGATION_AUDIENCE_MISMATCH: {\n    expectedSessionDid: safeSessionDid,\n    artifactAudience: safeSessionDid,\n  },\n  DELEGATION_HOST_MISMATCH: {\n    expectedHost: safeOriginHost,\n    artifactHost: safeOriginHost,\n  },\n  STORAGE_QUOTA_EXCEEDED: {\n    account: safeStorageAccount,\n  },\n};\n\n/** Account-wide totals only; a zero budget explains nothing and is dropped. */\nfunction safeStorageAccount(value: unknown): unknown | undefined {\n  if (!isRecord(value)) return undefined;\n  const { usedBytes, limitBytes, plan } = value;\n  if (\n    !Number.isSafeInteger(usedBytes) || (usedBytes as number) < 0 ||\n    !Number.isSafeInteger(limitBytes) || (limitBytes as number) <= 0\n  ) {\n    return undefined;\n  }\n  return typeof plan === \"string\" && /^[A-Za-z0-9][A-Za-z0-9 _.-]{0,31}$/.test(plan)\n    ? { usedBytes, limitBytes, plan }\n    : { usedBytes, limitBytes };\n}\n\nfunction redactSafeErrorDetails(\n  code: OperationErrorCode,\n  details: Readonly<Record<string, unknown>>,\n): Readonly<Record<string, unknown>> | undefined {\n  const policy = SAFE_ERROR_DETAIL_POLICIES[code];\n  if (policy === undefined) return undefined;\n\n  const safeDetails: Record<string, unknown> = {};\n  for (const [key, sanitize] of Object.entries(policy)) {\n    if (!hasOwn(details, key)) continue;\n    const value = sanitize(details[key]);\n    if (value !== undefined) safeDetails[key] = value;\n  }\n  return Object.keys(safeDetails).length === 0 ? undefined : safeDetails;\n}\n\nfunction safeIssueCodes(\n  value: readonly unknown[],\n): readonly Readonly<{ code: string }>[] | undefined {\n  const codes = value.map((issue) => {\n    if (!isRecord(issue) || typeof issue.code !== \"string\") return undefined;\n    return SAFE_ISSUE_CODES.has(issue.code) ? { code: issue.code } : undefined;\n  });\n  return codes.every(\n    (issue): issue is Readonly<{ code: string }> => issue !== undefined,\n  )\n    ? codes\n    : undefined;\n}\n\nconst SAFE_ISSUE_CODES = new Set([\n  \"invalid_type\",\n  \"invalid_literal\",\n  \"custom\",\n  \"invalid_union\",\n  \"invalid_union_discriminator\",\n  \"invalid_enum_value\",\n  \"unrecognized_keys\",\n  \"invalid_arguments\",\n  \"invalid_return_type\",\n  \"invalid_date\",\n  \"invalid_string\",\n  \"too_small\",\n  \"too_big\",\n  \"invalid_intersection_types\",\n  \"not_multiple_of\",\n  \"not_finite\",\n]);\n\nfunction redactPointer(value: unknown, pointer: string): unknown {\n  if (pointer === \"\") {\n    return REDACTED_VALUE;\n  }\n  if (!pointer.startsWith(\"/\")) {\n    return value;\n  }\n\n  const tokens = pointer.slice(1).split(\"/\").map(unescapePointerToken);\n  const parent = getPointerParent(value, tokens);\n  if (parent === undefined) {\n    return value;\n  }\n\n  const key = tokens[tokens.length - 1];\n  if (key === undefined || !hasOwn(parent, key)) {\n    return value;\n  }\n\n  Reflect.set(parent, key, REDACTED_VALUE);\n  return value;\n}\n\nfunction getPointerParent(\n  value: unknown,\n  tokens: readonly string[],\n): Record<string, unknown> | unknown[] | undefined {\n  if (tokens.length === 0) {\n    return undefined;\n  }\n\n  let cursor = value;\n  for (const token of tokens.slice(0, -1)) {\n    if (!isRecordOrArray(cursor) || !hasOwn(cursor, token)) {\n      return undefined;\n    }\n    cursor = Reflect.get(cursor, token);\n  }\n  return isRecordOrArray(cursor) ? cursor : undefined;\n}\n\nfunction unescapePointerToken(token: string): string {\n  return token.replace(/~1/g, \"/\").replace(/~0/g, \"~\");\n}\n\nfunction cloneValue(value: unknown): unknown {\n  if (value === null || typeof value !== \"object\") {\n    return value;\n  }\n\n  if (Array.isArray(value)) {\n    return value.map((entry) => cloneValue(entry));\n  }\n\n  const clone: Record<string, unknown> = {};\n  for (const key of Object.keys(value)) {\n    Object.defineProperty(clone, key, {\n      configurable: true,\n      enumerable: true,\n      value: cloneValue((value as Record<string, unknown>)[key]),\n      writable: true,\n    });\n  }\n  return clone;\n}\n\nfunction isRecordOrArray(\n  value: unknown,\n): value is Record<string, unknown> | unknown[] {\n  return value !== null && typeof value === \"object\";\n}\n\nfunction hasOwn(value: object, key: string): boolean {\n  return Object.prototype.hasOwnProperty.call(value, key);\n}\n\nfunction isRecord(value: unknown): value is Readonly<Record<string, unknown>> {\n  return value !== null && typeof value === \"object\" && !Array.isArray(value);\n}\n","import type { InvocationTarget, OperationResult } from \"./contract.js\";\nimport { invokeOperationWithLocalAuthorityRetry } from \"./invoke.js\";\n\n/**\n * The only published CLI acquisition helper. Its fixed operation identity is\n * deliberate: adding a future registry operation cannot expand this seam.\n */\nexport function invokeSecretsGetWithLocalAuthorityRetry(\n  invocationTarget: InvocationTarget,\n  unknownInput: unknown,\n): Promise<OperationResult<unknown>> {\n  return invokeOperationWithLocalAuthorityRetry(\n    \"tinycloud.secrets.get\",\n    1,\n    invocationTarget,\n    unknownInput,\n  );\n}\n"],"mappings":";;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;AA2CO,SAAS,eACd,MACA,SACA,UAGK,CAAC,GACU;AAChB,SAAO;AAAA,IACL;AAAA,IACA;AAAA,IACA,WAAW,QAAQ,aAAa;AAAA,IAChC,GAAI,QAAQ,YAAY,SAAY,CAAC,IAAI,EAAE,SAAS,QAAQ,QAAQ;AAAA,EACtE;AACF;AAWO,SAAS,0BAA0B,OAA4C;AACpF,MAAI,OAAO,UAAU,YAAY,UAAU,KAAM,QAAO;AACxD,QAAM,EAAE,MAAM,KAAK,IAAI;AACvB,MAAI,SAAS,4BAA4B,SAAS,wBAAyB,QAAO;AAClF,QAAM,UAAU,OAAO,SAAS,YAAY,SAAS,OAAQ,KAA+B,UAAU;AACtG,SAAO;AAAA,IACL;AAAA,IACA,SAAS,0BACL,sGAAsG,cAAc,KACpH,2EAA2E,cAAc;AAAA,IAC7F,EAAE,WAAW,OAAO,GAAI,YAAY,SAAY,CAAC,IAAI,EAAE,SAAS,EAAE,QAAQ,EAAE,EAAG;AAAA,EACjF;AACF;AAgBO,SAAS,qBAAqB,OAA6C;AAChF,SAAO,OAAO,UAAU,YAAY,sBAAsB,SAAS,KAA2B;AAChG;AAEO,SAAS,yBAAyC;AACvD,SAAO;AAAA,IACL;AAAA,IACA;AAAA,EACF;AACF;AAEO,SAAS,6BAA6B,OAAgC;AAC3E,MAAI,iBAAiB,0BAA0B;AAC7C,WAAO,uBAAuB,MAAM,cAAc;AAAA,EACpD;AAEA,SAAO,uBAAuB;AAChC;AAEO,SAAS,uBAAuB,OAAgC;AACrE,MACE,OAAO,UAAU,YACjB,UAAU,QACV,CAAC,qBAAsB,MAA6B,IAAI,KACxD,OAAQ,MAAgC,YAAY,YACpD,OAAQ,MAAkC,cAAc,WACxD;AACA,WAAO,uBAAuB;AAAA,EAChC;AAEA,QAAM,YAAY;AAClB,SAAO,eAAe,UAAU,MAAM,UAAU,SAAS;AAAA,IACvD,WAAW,UAAU;AAAA,IACrB,GAAI,UAAU,YAAY,SAAY,CAAC,IAAI,EAAE,SAAS,UAAU,QAAQ;AAAA,EAC1E,CAAC;AACH;AAnIA,IAAa,uBA2DP,gBA2BO;AAtFb;AAAA;AAAA;AAAO,IAAM,wBAAwB;AAAA,MACnC;AAAA,MACA;AAAA,MACA;AAAA,MACA;AAAA,MACA;AAAA,MACA;AAAA,MACA;AAAA,MACA;AAAA,MACA;AAAA,MACA;AAAA,MACA;AAAA,MACA;AAAA,MACA;AAAA,MACA;AAAA,MACA;AAAA,MACA;AAAA,MACA;AAAA,MACA;AAAA,MACA;AAAA,MACA;AAAA,MACA;AAAA,MACA;AAAA,MACA;AAAA,MACA;AAAA,MACA;AAAA,MACA;AAAA,MACA;AAAA,MACA;AAAA,MACA;AAAA,MACA;AAAA,MACA;AAAA,IACF;AA2BA,IAAM,iBAAiB;AA2BhB,IAAM,2BAAN,cAAuC,MAAM;AAAA,MAGlD,YAAYA,iBAAgC;AAC1C,cAAMA,gBAAe,OAAO;AAC5B,aAAK,OAAO;AACZ,aAAK,iBAAiBA;AAAA,MACxB;AAAA,IACF;AAAA;AAAA;;;AC9FA;AAAA;AAAA;AAIA,QAAI,IAAI;AACR,QAAI,IAAI,IAAI;AACZ,QAAI,IAAI,IAAI;AACZ,QAAI,IAAI,IAAI;AACZ,QAAI,IAAI,IAAI;AACZ,QAAI,IAAI,IAAI;AAgBZ,WAAO,UAAU,SAAU,KAAK,SAAS;AACvC,gBAAU,WAAW,CAAC;AACtB,UAAI,OAAO,OAAO;AAClB,UAAI,SAAS,YAAY,IAAI,SAAS,GAAG;AACvC,eAAO,MAAM,GAAG;AAAA,MAClB,WAAW,SAAS,YAAY,SAAS,GAAG,GAAG;AAC7C,eAAO,QAAQ,OAAO,QAAQ,GAAG,IAAI,SAAS,GAAG;AAAA,MACnD;AACA,YAAM,IAAI;AAAA,QACR,0DACE,KAAK,UAAU,GAAG;AAAA,MACtB;AAAA,IACF;AAUA,aAAS,MAAM,KAAK;AAClB,YAAM,OAAO,GAAG;AAChB,UAAI,IAAI,SAAS,KAAK;AACpB;AAAA,MACF;AACA,UAAI,QAAQ,mIAAmI;AAAA,QAC7I;AAAA,MACF;AACA,UAAI,CAAC,OAAO;AACV;AAAA,MACF;AACA,UAAI,IAAI,WAAW,MAAM,CAAC,CAAC;AAC3B,UAAI,QAAQ,MAAM,CAAC,KAAK,MAAM,YAAY;AAC1C,cAAQ,MAAM;AAAA,QACZ,KAAK;AAAA,QACL,KAAK;AAAA,QACL,KAAK;AAAA,QACL,KAAK;AAAA,QACL,KAAK;AACH,iBAAO,IAAI;AAAA,QACb,KAAK;AAAA,QACL,KAAK;AAAA,QACL,KAAK;AACH,iBAAO,IAAI;AAAA,QACb,KAAK;AAAA,QACL,KAAK;AAAA,QACL,KAAK;AACH,iBAAO,IAAI;AAAA,QACb,KAAK;AAAA,QACL,KAAK;AAAA,QACL,KAAK;AAAA,QACL,KAAK;AAAA,QACL,KAAK;AACH,iBAAO,IAAI;AAAA,QACb,KAAK;AAAA,QACL,KAAK;AAAA,QACL,KAAK;AAAA,QACL,KAAK;AAAA,QACL,KAAK;AACH,iBAAO,IAAI;AAAA,QACb,KAAK;AAAA,QACL,KAAK;AAAA,QACL,KAAK;AAAA,QACL,KAAK;AAAA,QACL,KAAK;AACH,iBAAO,IAAI;AAAA,QACb,KAAK;AAAA,QACL,KAAK;AAAA,QACL,KAAK;AAAA,QACL,KAAK;AAAA,QACL,KAAK;AACH,iBAAO;AAAA,QACT;AACE,iBAAO;AAAA,MACX;AAAA,IACF;AAUA,aAAS,SAASC,KAAI;AACpB,UAAI,QAAQ,KAAK,IAAIA,GAAE;AACvB,UAAI,SAAS,GAAG;AACd,eAAO,KAAK,MAAMA,MAAK,CAAC,IAAI;AAAA,MAC9B;AACA,UAAI,SAAS,GAAG;AACd,eAAO,KAAK,MAAMA,MAAK,CAAC,IAAI;AAAA,MAC9B;AACA,UAAI,SAAS,GAAG;AACd,eAAO,KAAK,MAAMA,MAAK,CAAC,IAAI;AAAA,MAC9B;AACA,UAAI,SAAS,GAAG;AACd,eAAO,KAAK,MAAMA,MAAK,CAAC,IAAI;AAAA,MAC9B;AACA,aAAOA,MAAK;AAAA,IACd;AAUA,aAAS,QAAQA,KAAI;AACnB,UAAI,QAAQ,KAAK,IAAIA,GAAE;AACvB,UAAI,SAAS,GAAG;AACd,eAAO,OAAOA,KAAI,OAAO,GAAG,KAAK;AAAA,MACnC;AACA,UAAI,SAAS,GAAG;AACd,eAAO,OAAOA,KAAI,OAAO,GAAG,MAAM;AAAA,MACpC;AACA,UAAI,SAAS,GAAG;AACd,eAAO,OAAOA,KAAI,OAAO,GAAG,QAAQ;AAAA,MACtC;AACA,UAAI,SAAS,GAAG;AACd,eAAO,OAAOA,KAAI,OAAO,GAAG,QAAQ;AAAA,MACtC;AACA,aAAOA,MAAK;AAAA,IACd;AAMA,aAAS,OAAOA,KAAI,OAAO,GAAG,MAAM;AAClC,UAAI,WAAW,SAAS,IAAI;AAC5B,aAAO,KAAK,MAAMA,MAAK,CAAC,IAAI,MAAM,QAAQ,WAAW,MAAM;AAAA,IAC7D;AAAA;AAAA;;;AC9IA,SAAS,mBAAmB,sBAAsB;AAoa3C,SAAS,uBACd,SACA,SACU;AACV,SAAO,QAAQ,IAAI,CAAC,MAAM;AACxB,QAAI,EAAE,SAAS,GAAG,GAAG;AAEnB,aAAO;AAAA,IACT;AACA,WAAO,GAAG,OAAO,IAAI,CAAC;AAAA,EACxB,CAAC;AACH;AAlcA,IAiBA,WA4Pa,wBA0BA,uBAgCA;AAvUb;AAAA;AAAA;AAiBA,gBAAe;AA4PR,IAAM,yBAAyB;AA0B/B,IAAM,wBACX,OAAO,OAAO;AAAA,MACZ,IAAI;AAAA,MACJ,KAAK;AAAA,MACL,QAAQ;AAAA,MACR,cAAc;AAAA,MACd,OAAO;AAAA,MACP,YAAY;AAAA,MACZ,YAAY;AAAA,IACd,CAAC;AAuBI,IAAM,wBACX,OAAO;AAAA,MACL,OAAO;AAAA,QACL,OAAO,QAAQ,qBAAqB,EAAE,IAAI,CAAC,CAAC,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC;AAAA,MAC9D;AAAA,IACF;AAAA;AAAA;;;ACrOK,SAAS,eAAe,OAAuB;AACpD,MAAI,CAAC,MAAM,WAAW,YAAY,GAAG;AACnC,WAAO;AAAA,EACT;AACA,QAAM,YAAY,MAAM,YAAY,GAAG;AACvC,MAAI,cAAc,MAAM,cAAc,MAAM,SAAS,GAAG;AACtD,WAAO;AAAA,EACT;AACA,SAAO,MAAM,MAAM,YAAY,CAAC;AAClC;AAoCO,SAAS,mBACd,WACA,SACmB;AACnB,QAAM,UAA6B,CAAC;AAEpC,aAAW,OAAO,WAAW;AAC3B,UAAM,gBAAgB,QAAQ;AAAA,MAAO,CAAC,UACpC,8BAA8B,KAAK,KAAK;AAAA,IAC1C;AACA,UAAM,mBAAmB;AAAA,MACvB,IAAI;AAAA,MACJ,IAAI;AAAA,IACN;AACA,UAAM,iBAAiB,cAAc;AAAA,MAAQ,CAAC,UAC5C,uBAAuB,MAAM,SAAS,MAAM,OAAO;AAAA,IACrD;AACA,UAAM,UAAU,iBAAiB;AAAA,MAAM,CAAC,oBACtC,eAAe;AAAA,QAAK,CAAC,kBACnB,eAAe,eAAe,eAAe;AAAA,MAC/C;AAAA,IACF;AACA,QAAI,CAAC,SAAS;AACZ,cAAQ,KAAK,WAAW,GAAG,CAAC;AAAA,IAC9B;AAAA,EACF;AAEA,SAAO,EAAE,QAAQ,QAAQ,WAAW,GAAG,QAAQ;AACjD;AAMA,SAAS,8BACP,WACA,SACS;AACT,MAAI,UAAU,YAAY,QAAQ,SAAS;AACzC,WAAO;AAAA,EACT;AAIA,MACE,eAAe,UAAU,SAAS,sBAAsB,MACxD,eAAe,QAAQ,SAAS,sBAAsB,GACtD;AACA,WAAO;AAAA,EACT;AACA,MAAI,CAAC,aAAa,QAAQ,MAAM,UAAU,IAAI,GAAG;AAC/C,WAAO;AAAA,EACT;AAIA,MAAI,CAAC,kBAAkB,UAAU,SAAS,QAAQ,OAAO,GAAG;AAC1D,WAAO;AAAA,EACT;AACA,SAAO;AACT;AAUO,SAAS,kBACd,MACA,OACS;AACT,SAAO,yBAAyB,IAAI,MAAM,yBAAyB,KAAK;AAC1E;AASO,SAAS,yBACd,SACQ;AACR,QAAM,eAAe,CAAC,UAA2B;AAC/C,QAAI,UAAU,QAAQ,OAAO,UAAU,aAAa,OAAO,UAAU,UAAU;AAC7E,aAAO,KAAK,UAAU,KAAK;AAAA,IAC7B;AACA,QAAI,OAAO,UAAU,UAAU;AAC7B,UAAI,OAAO,SAAS,KAAK,EAAG,QAAO,KAAK,UAAU,KAAK;AACvD,YAAM,IAAI,MAAM,8CAA8C;AAAA,IAChE;AACA,QAAI,MAAM,QAAQ,KAAK,EAAG,QAAO,IAAI,MAAM,IAAI,YAAY,EAAE,KAAK,GAAG,CAAC;AACtE,QAAI,OAAO,UAAU,UAAU;AAC7B,YAAM,SAAS;AACf,YAAM,YAAY,OAAO,eAAe,MAAM;AAC9C,UAAI,cAAc,OAAO,aAAa,cAAc,MAAM;AACxD,cAAM,IAAI,MAAM,8CAA8C;AAAA,MAChE;AACA,aAAO,IAAI,OAAO,KAAK,MAAM,EAAE,KAAK,EAAE;AAAA,QAAI,CAAC,QACzC,GAAG,KAAK,UAAU,GAAG,CAAC,IAAI,aAAa,OAAO,GAAG,CAAC,CAAC;AAAA,MACrD,EAAE,KAAK,GAAG,CAAC;AAAA,IACb;AACA,UAAM,IAAI,MAAM,8CAA8C;AAAA,EAChE;AACA,QAAM,YAAY,WAAW,CAAC,GAAG,IAAI,YAAY,EAAE,KAAK;AACxD,MAAI,SAAS,WAAW,KAAM,SAAS,WAAW,KAAK,SAAS,CAAC,MAAM,MAAO;AAC5E,WAAO;AAAA,EACT;AACA,SAAO,IAAI,SAAS,KAAK,GAAG,CAAC;AAC/B;AAgBO,SAAS,qBAAqB,QAAyB;AAC5D,SAAO,OAAO,UAAU,eAAe,KAAK,uBAAuB,MAAM;AAC3E;AAGO,SAAS,eAAe,eAAuB,iBAAkC;AACtF,MAAI,kBAAkB,gBAAiB,QAAO;AAC9C,MAAI,qBAAqB,eAAe,EAAG,QAAO;AAClD,MAAI,kBAAkB,IAAK,QAAO;AAClC,MAAI,CAAC,cAAc,SAAS,IAAI,EAAG,QAAO;AAC1C,QAAM,UAAU,cAAc,MAAM,GAAG,EAAE;AACzC,SAAO,oBAAoB,WAAW,gBAAgB,WAAW,GAAG,OAAO,GAAG;AAChF;AAWA,SAAS,aAAa,aAAqB,eAAgC;AACzE,MAAI,gBAAgB,MAAM,gBAAgB,KAAK;AAC7C,WAAO;AAAA,EACT;AACA,MAAI,YAAY,SAAS,GAAG,GAAG;AAC7B,WAAO,cAAc,WAAW,WAAW;AAAA,EAC7C;AACA,SAAO,kBAAkB;AAC3B;AAEA,SAAS,WAAW,OAAyC;AAC3D,SAAO;AAAA,IACL,SAAS,MAAM;AAAA,IACf,GAAI,MAAM,UAAU,SAAY,EAAE,OAAO,MAAM,MAAM,IAAI,CAAC;AAAA,IAC1D,MAAM,MAAM;AAAA,IACZ,SAAS,CAAC,GAAG,MAAM,OAAO;AAAA,IAC1B,GAAI,MAAM,YAAY,SAClB,EAAE,SAAS,KAAK,MAAM,KAAK,UAAU,MAAM,OAAO,CAAC,EAA+B,IAClF,CAAC;AAAA,IACL,GAAI,MAAM,eAAe,SAAY,EAAE,YAAY,MAAM,WAAW,IAAI,CAAC;AAAA,IACzE,GAAI,MAAM,WAAW,SAAY,EAAE,QAAQ,MAAM,OAAO,IAAI,CAAC;AAAA,EAC/D;AACF;AAlUA,IA0QM;AA1QN;AAAA;AAAA;AAgBA;AA0PA,IAAM,wBAAwD;AAAA,MAC5D,qBAAqB;AAAA,MACrB,uBAAuB;AAAA,IACzB;AAAA;AAAA;;;ACnOO,SAAS,0BAA0B,OAA+C;AACvF,MAAI,CAAC,MAAM,QAAQ,KAAK,EAAG,QAAO;AAElC,QAAM,cAAiC,CAAC;AACxC,aAAW,aAAa,OAAO;AAC7B,QAAI,CAAC,kBAAkB,SAAS,EAAG,QAAO;AAC1C,gBAAY,KAAK,SAAS;AAAA,EAC5B;AACA,SAAO,yBAAyB,WAAW;AAC7C;AASO,SAAS,kBACd,SACA,UACqB;AACrB,QAAM,mBAAmB,yBAAyB,OAAO;AACzD,QAAM,oBAAoB,yBAAyB,QAAQ;AAC3D,QAAM,SAAS,mBAAmB,mBAAmB,gBAAgB;AAErE,SAAO;AAAA,IACL,WAAW,OAAO;AAAA,IAClB,SAAS,yBAAyB,OAAO,OAAO;AAAA,EAClD;AACF;AAOO,SAAS,2BACd,SACA,UACAC,eACqB;AACrB,QAAM,mBAAmB,kCAAkC,SAASA,aAAY;AAChF,QAAM,oBAAoB,kCAAkC,UAAUA,aAAY;AAClF,QAAM,UAAsC,CAAC;AAE7C,aAAW,aAAa,mBAAmB;AACzC,UAAM,UAAU,iBAAiB;AAAA,MAAK,CAAC,cACrC,UAAU,YAAY,UAAU,WAChC,qBAAqB,UAAU,OAAO,UAAU,KAAK,KACrD,mBAAmB,CAAC,SAAS,GAAG,CAAC,SAAS,CAAC,EAAE;AAAA,IAC/C;AACA,QAAI,CAAC,QAAS,SAAQ,KAAK,SAAS;AAAA,EACtC;AAEA,SAAO;AAAA,IACL,WAAW,QAAQ,WAAW;AAAA,IAC9B,SAAS,yBAAyB,OAAO;AAAA,EAC3C;AACF;AAOO,SAAS,wBACd,WACA,WACAA,eACS;AACT,SAAO,UAAU,SAAS,KACxB,2BAA2B,WAAW,yBAAyB,SAAS,GAAGA,aAAY,EAAE;AAC7F;AAOO,SAAS,8BACd,QACA,SACAA,eACS;AACT,QAAM,kBAAkB,kCAAkC,QAAQA,aAAY;AAC9E,QAAM,mBAAmB,kCAAkC,SAASA,aAAY;AAChF,SAAO,gBAAgB,SAAS,KAAK,gBAAgB,MAAM,CAAC,SAAS,iBAAiB;AAAA,IAAK,CAAC,SAC1F,KAAK,UAAU,IAAI,MAAM,KAAK,UAAU,IAAI;AAAA,EAC9C,CAAC;AACH;AAGO,SAAS,kCACd,aACAA,eAC4B;AAC5B,SAAO,yBAAyB,YAAY,IAAI,CAAC,eAAe;AAC9D,UAAM,gBAAgB,0BAA0B,UAAU;AAC1D,QAAI,WAAW,UAAU,UAAaA,kBAAiB,QAAW;AAChE,aAAO;AAAA,IACT;AACA,QAAI;AACF,aAAO,EAAE,GAAG,eAAe,OAAOA,cAAa,WAAW,KAAK,EAAE;AAAA,IACnE,QAAQ;AAGN,aAAO;AAAA,IACT;AAAA,EACF,CAAC,CAAC;AACJ;AAEA,SAAS,0BAA0B,YAA8C;AAC/E,MAAI,WAAW,YAAY,uBAAwB,QAAO;AAC1D,QAAM,QAAQ,WAAW,KAAK;AAAA,IAC5B;AAAA,EACF;AACA,MAAI,CAAC,MAAO,QAAO;AACnB,SAAO,EAAE,GAAG,YAAY,MAAM,GAAG,MAAM,CAAC,CAAC,GAAG,MAAM,CAAC,EAAG,YAAY,CAAC,GAAG,MAAM,CAAC,CAAC,GAAG;AACnF;AAEA,SAAS,qBACP,SACA,WACS;AACT,SAAO,YAAY;AACrB;AAYO,SAAS,yBACd,aAC4B;AAC5B,QAAM,aAAa,oBAAI,IAAsC;AAC7D,aAAW,cAAc,aAAa;AACpC,UAAM,YAAY,uBAAuB,UAAU;AACnD,eAAW,IAAI,gCAAgC,SAAS,GAAG,SAAS;AAAA,EACtE;AAEA,SAAO,CAAC,GAAG,WAAW,QAAQ,CAAC,EAC5B,KAAK,CAAC,CAAC,IAAI,GAAG,CAAC,KAAK,MAAM,KAAK,cAAc,KAAK,CAAC,EACnD,IAAI,CAAC,CAAC,EAAE,UAAU,MAAM,UAAU;AACvC;AAEA,SAAS,uBAAuB,YAAuD;AACrF,QAAM,UAAU,CAAC,GAAG,IAAI,IAAI,WAAW,OAAO,CAAC,EAAE,KAAK,CAAC,MAAM,UAAU,KAAK,cAAc,KAAK,CAAC;AAChG,SAAO;AAAA,IACL,SAAS,WAAW;AAAA,IACpB,GAAI,WAAW,UAAU,SAAY,EAAE,OAAO,WAAW,MAAM,IAAI,CAAC;AAAA,IACpE,MAAM,WAAW;AAAA,IACjB;AAAA,IACA,GAAI,WAAW,eAAe,SAAY,EAAE,YAAY,WAAW,WAAW,IAAI,CAAC;AAAA,IACnF,GAAI,WAAW,WAAW,SAAY,EAAE,QAAQ,WAAW,OAAO,IAAI,CAAC;AAAA,IACvE,GAAI,WAAW,gBAAgB,SAAY,EAAE,aAAa,WAAW,YAAY,IAAI,CAAC;AAAA,IACtF,GAAI,WAAW,YAAY,SACvB,CAAC,IACD,EAAE,SAAS,oBAAoB,WAAW,OAAO,EAAE;AAAA,EACzD;AACF;AAEA,SAAS,gCAAgC,YAA8C;AACrF,SAAO,KAAK,UAAU;AAAA,IACpB,SAAS,WAAW;AAAA,IACpB,GAAI,WAAW,UAAU,SAAY,EAAE,OAAO,WAAW,MAAM,IAAI,CAAC;AAAA,IACpE,MAAM,WAAW;AAAA,IACjB,SAAS,WAAW;AAAA,IACpB,GAAI,WAAW,eAAe,SAAY,EAAE,YAAY,WAAW,WAAW,IAAI,CAAC;AAAA,IACnF,GAAI,WAAW,WAAW,SAAY,EAAE,QAAQ,WAAW,OAAO,IAAI,CAAC;AAAA,IACvE,GAAI,WAAW,gBAAgB,SAAY,EAAE,aAAa,WAAW,YAAY,IAAI,CAAC;AAAA,IACtF,GAAI,WAAW,YAAY,SAAY,CAAC,IAAI,EAAE,SAAS,WAAW,QAAQ;AAAA,EAC5E,CAAC;AACH;AAEA,SAAS,kBAAkB,OAA0C;AACnE,MACE,CAAC,cAAc,KAAK,KACpB,OAAO,oBAAoB,KAAK,EAAE,KAAK,CAAC,QAAQ,CAAC,sBAAsB,IAAI,GAAG,CAAC,KAC/E,OAAO,sBAAsB,KAAK,EAAE,SAAS,GAC7C;AACA,WAAO;AAAA,EACT;AACA,MACE,CAAC,YAAY,MAAM,OAAO,KAC1B,CAAC,YAAY,MAAM,MAAM,MAAM,OAAO,KACrC,MAAM,UAAU,UAAa,CAAC,YAAY,MAAM,KAAK,KACtD,CAAC,MAAM,QAAQ,MAAM,OAAO,KAC5B,MAAM,QAAQ,WAAW,KACzB,CAAC,MAAM,QAAQ,MAAM,WAAW,KAChC,IAAI,IAAI,MAAM,OAAO,EAAE,SAAS,MAAM,QAAQ,UAC9C,MAAM,eAAe,QACpB,MAAM,eAAe,UAAa,MAAM,eAAe,SACvD,MAAM,WAAW,UAAa,CAAC,YAAY,MAAM,MAAM,KACvD,MAAM,gBAAgB,UAAa,CAAC,YAAY,MAAM,WAAW,GAClE;AACA,WAAO;AAAA,EACT;AACA,SAAO,EAAE,aAAa;AACxB;AAEA,SAAS,cAAc,OAAkD;AACvE,MAAI,OAAO,UAAU,YAAY,UAAU,QAAQ,MAAM,QAAQ,KAAK,EAAG,QAAO;AAChF,QAAM,YAAY,OAAO,eAAe,KAAK;AAC7C,SAAO,cAAc,OAAO,aAAa,cAAc;AACzD;AAEA,SAAS,YAAY,OAAiC;AACpD,SAAO,OAAO,UAAU,YAAY,MAAM,SAAS,KAAK,CAAC,MAAM,SAAS,GAAG;AAC7E;AAEA,SAAS,YAAY,OAAgB,SAAmC;AACtE,MAAI,OAAO,UAAU,YAAY,UAAU,OAAO,MAAM,SAAS,GAAG,EAAG,QAAO;AAC9E,MAAI,UAAU,MAAM,MAAM,SAAS,GAAG,GAAG;AACvC,WAAO,MAAM,QAAQ,OAAO,KAAK,QAAQ,SAAS,mBAAmB;AAAA,EACvE;AACA,SAAO;AACT;AAEA,SAAS,oBACP,SAC2B;AAC3B,SAAO,CAAC,GAAG,OAAO,EACf,IAAI,CAAC,YAAY;AAAA,IAChB,UAAU,yBAAyB,CAAC,MAAM,CAAC;AAAA,IAC3C,OAAO,KAAK,MAAM,KAAK,UAAU,MAAM,CAAC;AAAA,EAC1C,EAAE,EACD,KAAK,CAAC,MAAM,UAAU,KAAK,SAAS,cAAc,MAAM,QAAQ,CAAC,EACjE,IAAI,CAAC,EAAE,MAAM,MAAM,KAAK;AAC7B;AArRA,IA2BM;AA3BN;AAAA;AAAA;AAAA;AA2BA,IAAM,wBAAwB,oBAAI,IAAI;AAAA,MACpC;AAAA,MACA;AAAA,MACA;AAAA,MACA;AAAA,MACA;AAAA,MACA;AAAA,MACA;AAAA,IACF,CAAC;AAAA;AAAA;;;ACnCD,SAAS,kBAAkB;AAC3B,SAAS,yBAAyB;AAClC;AAAA,EACE;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,OACK;AACP,SAAS,eAAe;AACxB,SAAS,UAAU,SAAS,YAAY,MAAM,UAAU,eAAe;AA2CvE,SAAS,mBAAsB,KAAmC;AA5DlE,MAAAC;AA6DE,QAAM,WAAW;AACjB,SAAO,SAAAA,MAAS,OAAO,IAAI,GAAG,OAAvB,SAAAA,OAA8B,IAAI,kBAAqB;AAChE;AA6DO,SAAS,oBAA4B;AAC1C,QAAM,OAAO,oBAAoB,SAAS,KACxC,QAAQ,IAAI,WACZ,QAAQ,IAAI,QACZ,QAAQ,IAAI,eACZ,QAAQ;AACV,SAAO,KAAK,MAAM,YAAY;AAChC;AAGO,SAAS,uBACd,WACA,QACY;AACZ,MAAI,cAAc,OAAW,QAAO,OAAO;AAC3C,MAAI,CAAC,WAAW,SAAS,KAAK,UAAU,SAAS,IAAI,GAAG;AACtD,UAAM,IAAI,UAAU,oDAAoD;AAAA,EAC1E;AACA,SAAO,oBAAoB,IAAI,QAAQ,SAAS,GAAG,MAAM;AAC3D;AAEO,SAAS,sBAA8B;AAC5C,SAAO,KAAK,kBAAkB,GAAG,aAAa;AAChD;AAEO,SAAS,eAAuB;AACrC,SAAO,KAAK,kBAAkB,GAAG,UAAU;AAC7C;AAEO,SAAS,YAAY,SAAyB;AACnD,SAAO,KAAK,aAAa,GAAG,oBAAoB,OAAO,CAAC;AAC1D;AAEO,SAAS,kBAAkB,SAAyB;AACzD,SAAO,KAAK,YAAY,OAAO,GAAG,cAAc;AAClD;AAEO,SAAS,YAAY,SAAyB;AACnD,SAAO,iBAAiB,SAAS,SAAS;AAC5C;AAEO,SAAS,0BAA0B,SAAyB;AACjE,SAAO,iBAAiB,SAAS,wBAAwB;AAC3D;AAMO,SAAS,iBAAiB,SAAiB,OAAiC;AACjF,SAAO,KAAK,YAAY,OAAO,GAAG,GAAG,KAAK,OAAO;AACnD;AAGO,SAAS,yBAAyB,SAAiB,OAAiC;AACzF,SAAO,GAAG,iBAAiB,SAAS,KAAK,CAAC;AAC5C;AAEO,SAAS,gBAAgB,SAAyB;AACvD,SAAO,KAAK,YAAY,OAAO,GAAG,OAAO;AAC3C;AAWO,SAAS,oBAAoB,SAAyB;AAC3D,SAAO,KAAK,kBAAkB,GAAG,iBAAiB,oBAAoB,OAAO,CAAC;AAChF;AAMA,eAAsB,SAAY,UAAqC;AACrE,MAAI;AACF,WAAO,KAAK,MAAM,MAAM,SAAS,UAAU,MAAM,CAAC;AAAA,EACpD,SAAS,OAAO;AACd,QAAI,QAAQ,OAAO,QAAQ,EAAG,QAAO;AACrC,UAAM;AAAA,EACR;AACF;AAMA,eAAsB,gBAAgB,UAAkB,OAA+B;AACrF,QAAM,YAAY,UAAU,OAAO,KAAK;AAC1C;AAOA,eAAe,YAAY,UAAkB,OAAgB,SAAiC;AAC5F,QAAM,YAAY,QAAQ,QAAQ;AAClC,QAAM,gBAAgB;AAAA,IACpB;AAAA,IACA,IAAI,SAAS,QAAQ,CAAC,IAAI,QAAQ,GAAG,IAAI,WAAW,CAAC;AAAA,EACvD;AACA,QAAM,WAAW,GAAG,KAAK,UAAU,OAAO,MAAM,CAAC,CAAC;AAAA;AAElD,QAAM,MAAM,WAAW,EAAE,WAAW,MAAM,MAAM,iBAAiB,CAAC;AAClE,MAAI;AACF,QAAI,QAAS,OAAM,iBAAiB,eAAe,QAAQ;AAAA,QACtD,OAAM,UAAU,eAAe,UAAU,EAAE,UAAU,QAAQ,MAAM,kBAAkB,CAAC;AAC3F,UAAM,OAAO,eAAe,QAAQ;AAAA,EACtC,SAAS,OAAO;AACd,UAAM,GAAG,eAAe,EAAE,OAAO,KAAK,CAAC,EAAE,MAAM,MAAM,MAAS;AAC9D,UAAM;AAAA,EACR;AACF;AAGA,eAAe,iBAAiB,MAAc,UAAiC;AAC7E,QAAM,SAAS,MAAM,KAAK,MAAM,MAAM,iBAAiB;AACvD,MAAI;AACF,QAAI,UAAU;AACZ,YAAM,OAAO,UAAU,UAAU,MAAM;AACvC,YAAM,OAAO,SAAS;AAAA,IACxB;AAAA,EACF,UAAE;AACA,UAAM,OAAO,MAAM;AAAA,EACrB;AACF;AAEA,eAAsB,YACpB,SACmB;AACnB,SAAO,SAAY,kBAAkB,OAAO,CAAC;AAC/C;AAEA,eAAsB,YACpB,SACmB;AACnB,QAAM,kBAAkB,SAAS,SAAS;AAC1C,SAAO,SAAY,YAAY,OAAO,CAAC;AACzC;AAEA,eAAsB,0BACpB,SACc;AACd,UAAQ,MAAM,iBAAoB,SAAS,wBAAwB,GAAG;AACxE;AAEA,eAAsB,iBACpB,SACc;AACd,UAAQ,MAAM,iBAAoB,SAAS,eAAe,GAAG;AAC/D;AAEA,eAAsB,kBACpB,SACA,OACwB;AACxB,QAAM,WAAW,MAAM,SAAwB,yBAAyB,SAAS,KAAK,CAAC;AACvF,MAAI,aAAa,KAAM,QAAO,EAAE,eAAe,EAAE;AACjD,MACE,OAAO,aAAa,YACpB,SAAS,kBAAkB,GAC3B;AACA,UAAM,IAAI,UAAU,iCAAiC,KAAK,IAAI;AAAA,EAChE;AACA,SAAO;AACT;AAEA,eAAsB,iBACpB,SACA,OACkC;AAClC,QAAM,CAAC,UAAU,GAAG,IAAI,MAAM,QAAQ,IAAI;AAAA,IACxC,kBAAkB,SAAS,KAAK;AAAA,IAChC,SAAkB,iBAAiB,SAAS,KAAK,CAAC;AAAA,EACpD,CAAC;AACD,SAAO;AAAA,IACL,eAAe,SAAS;AAAA,IACxB,SAAS,MAAM,QAAQ,GAAG,IAAI,MAAa,CAAC;AAAA,EAC9C;AACF;AAeA,eAAsB,gBACpB,SACA,QACA,UAA8B,CAAC,GACnB;AACZ,QAAM,oBAAoB,oBAAoB,OAAO;AACrD,QAAM,WAAW,gBAAgB,iBAAiB;AAClD,QAAM,QAAQ,iBAAiB,SAAS,KAAK,CAAC,GAAG,OAAO,CAACC,eAAcA,WAAU,MAAM;AACvF,MAAI,KAAK,KAAK,CAACA,eAAcA,WAAU,aAAa,QAAQ,EAAG,QAAO,OAAO;AAC7E,QAAM,WAAW,MAAM,mBAAmB,mBAAmB,OAAO;AACpE,QAAM,YAA6B;AAAA,IACjC;AAAA,IACA,UAAU,SAAS;AAAA,IACnB,qBAAqB,SAAS;AAAA,IAC9B,QAAQ;AAAA,EACV;AACA,MAAI;AACF,WAAO,MAAM,iBAAiB,IAAI,CAAC,GAAG,MAAM,SAAS,GAAG,MAAM;AAAA,EAChE,UAAE;AACA,cAAU,SAAS;AACnB,UAAM,SAAS,QAAQ;AAGvB,QAAI,SAAS,oBAAqB,OAAM,MAAM,YAAY,iBAAiB,CAAC,EAAE,MAAM,MAAM,MAAS;AAAA,EACrG;AACF;AAuBA,eAAsB,4BAA4B,SAAgC;AAChF,QAAM,WAAW,gBAAgB,OAAO;AACxC,QAAM,aAAa,iBAAiB,SAAS,KAAK,CAAC,GAAG,KAAK,CAAC,cAAc,UAAU,UAAU,UAAU,aAAa,QAAQ;AAC7H,MAAI,CAAC,WAAW,oBAAqB;AAErC,MAAI,MAAM,OAAO,kBAAkB,OAAO,CAAC,EAAG;AAC9C,QAAM,IAAI,oBAAoB,OAAO;AACvC;AAiCA,eAAsB,mBACpB,SACA,OACA,QAMA,UAA8B,CAAC,GACd;AACjB,SAAO;AAAA,IACL;AAAA,IACA,MAAM,8BAA8B,SAAS,OAAO,MAAM;AAAA,IAC1D;AAAA,EACF;AACF;AAGA,eAAe,8BACb,SACA,OACA,QAMiB;AACjB,QAAM,4BAA4B,OAAO;AACzC,QAAM,UAAU,MAAM,iBAAoB,SAAS,KAAK;AACxD,QAAM,OAAO,MAAM,OAAO,QAAQ,OAAO;AACzC,QAAM,gBAAgB,iBAAiB,SAAS,KAAK,GAAG,KAAK,OAAO;AACpE,QAAM,uBAAuB,SAAS,KAAK;AAC3C,SAAO,KAAK;AACd;AAyBA,eAAe,uBAAuB,SAAiB,OAAwC;AAC7F,QAAM,gBAAgB,yBAAyB,SAAS,KAAK,GAAG,EAAE,eAAe,EAAE,CAAC;AACtF;AA4BA,eAAe,mBACb,SACA,SAC8B;AAC9B,QAAM,WAAyB;AAAA,IAC7B,WAAW,KAAK,IAAI;AAAA,IACpB,WAAW,QAAQ,aAAa;AAAA,IAChC,SAAS,QAAQ,WAAW;AAAA,EAC9B;AACA,QAAM,eAAe,QAAQ,gBAAgB;AAC7C,QAAM,WAAW,gBAAgB,OAAO;AACxC,QAAM,gBAAgB,oBAAoB,OAAO;AAEjD,QAAM,YAAY,YAAY,OAAO;AACrC,MAAI,QAAQ,kBAAkB,CAAE,MAAM,OAAO,kBAAkB,OAAO,CAAC,EAAI,OAAM,IAAI,oBAAoB,OAAO;AAChH,MAAI,CAAC,QAAQ,eAAgB,OAAM,MAAM,WAAW,EAAE,WAAW,MAAM,MAAM,iBAAiB,CAAC;AAC/F,QAAM,MAAM,QAAQ,aAAa,GAAG,EAAE,WAAW,MAAM,MAAM,iBAAiB,CAAC;AAG/E,aAAW,QAAQ,CAAC,kBAAkB,GAAG,aAAa,GAAG,SAAS,GAAG;AACnE,UAAM,MAAM,MAAM,gBAAgB,EAAE,MAAM,CAAC,UAAmB;AAG5D,UAAI,SAAS,aAAa,CAAC,QAAQ,OAAO,QAAQ,EAAG,OAAM;AAAA,IAC7D,CAAC;AAAA,EACH;AAEA,QAAM,EAAE,MAAM,gBAAgB,IAAI,MAAM,YAAY,SAAS,eAAe,QAAQ;AACpF,MAAI;AAEF,QAAI,QAAQ,kBAAkB,CAAE,MAAM,OAAO,kBAAkB,OAAO,CAAC,GAAI;AAGzE,YAAM,MAAM,SAAS,EAAE,MAAM,MAAM,MAAS;AAC5C,YAAM,IAAI,oBAAoB,OAAO;AAAA,IACvC;AAGA,UAAM,WAAW,MAAM,SAA6B,KAAK,eAAe,cAAc,CAAC,EAAE,MAAM,MAAM,IAAI;AACzG,UAAM,sBAAsB,OAAO,UAAU,SAAS,YAAY,SAAS,QAAQ;AACnF,WAAO,MAAM;AACX,YAAM,QAAQ,WAAW;AACzB,UAAI,MAAM,mBAAmB,SAAS,UAAU,OAAO,QAAQ,mBAAmB,IAAI,GAAG;AACvF,eAAO;AAAA,UACL;AAAA,UACA,UAAU,KAAK;AAAA,UACf,SAAS,YAAY;AACnB,gBAAI;AACF,oBAAM,mBAAmB,SAAS,UAAU,KAAK;AAAA,YACnD,UAAE;AACA,oBAAM,YAAY,SAAS,IAAI;AAAA,YACjC;AAAA,UACF;AAAA,QACF;AAAA,MACF;AACA,YAAM,yBAAyB,OAAO;AACtC,UAAI,MAAM,iBAAiB,SAAS,UAAU,YAAY,EAAG;AAC7D,YAAM,cAAc,SAAS,QAAQ;AAAA,IACvC;AAAA,EACF,SAAS,OAAO;AACd,UAAM,YAAY,SAAS,IAAI;AAC/B,UAAM;AAAA,EACR;AACF;AAGA,SAAS,cAAc,SAAiB,UAAwB,QAAuB;AACrF,MAAI,KAAK,IAAI,IAAI,SAAS,aAAa,SAAS,WAAW;AACzD,UAAM,IAAI,wBAAwB,SAAS,SAAS,WAAW,MAAM;AAAA,EACvE;AACF;AAGA,eAAe,cAAc,SAAiB,UAAwB,QAAgC;AACpG,gBAAc,SAAS,UAAU,MAAM;AACvC,QAAM,MAAM,KAAK,IAAI,SAAS,SAAS,SAAS,aAAa,KAAK,IAAI,IAAI,SAAS,UAAU,CAAC;AAChG;AAsFA,eAAe,YACb,SACA,WACA,UACkD;AAClD,MAAI;AAEJ,MAAI;AACJ,QAAM,UAAU,CAAC,SACf,iBAAiB,SAAS,IAAI,IAAI,0EACW,OAAO;AACtD,WAAS,QAAQ,QAAQ,QAAQ,OAAO;AACtC,QAAI,CAAC,MAAO,eAAc,SAAS,UAAU,OAAO;AACpD,cAAU;AACV,UAAM,SAAS,MAAM,eAAe,SAAS;AAC7C,QAAI,WAAW,WAAW;AACxB,YAAM,oBAAoB,SAAS;AACnC;AAAA,IACF;AACA,QAAI,WAAW,SAAS;AAGtB,gBAAU,QAAQ,cAAc;AAChC,YAAM,cAAc,SAAS,UAAU,OAAO;AAC9C;AAAA,IACF;AACA,QAAI,WAAW,KAAM;AACrB,QAAI,OAAO,WAAW,UAAU;AAC9B,gBAAU,QAAQ,0BAA0B,MAAM,EAAE;AACpD,YAAM,cAAc,SAAS,UAAU,OAAO;AAC9C;AAAA,IACF;AACA,0CAAoB,OAAO,OAAO,OAAO,OAAO,IAAI,OAAO;AAC3D,QAAI,OAAO,QAAQ,OAAO,MAAM;AAC9B,YAAM,OAAO,MAAM,SAAS,SAAS,WAAW,MAAM;AACtD,UAAI,SAAS,KAAM,QAAO,EAAE,MAAM,gBAAgB;AAClD,YAAM,cAAc,SAAS,QAAQ;AAAA,IACvC,WAAW,OAAO,MAAM;AACtB,gBAAU,QAAQ,kBAAkB,OAAO,IAAI,2BAA2B;AAC1E,YAAM,cAAc,SAAS,UAAU,OAAO;AAAA,IAChD,WAAW,OAAO,QAAQ,QAAQ,MAAM,kBAAkB,IAAI,OAAO,KAAK,IAAI,CAAC,eAAe,OAAO,GAAG,GAAG;AACzG,YAAM,mBAAmB,mCAAmC,OAAO;AACnE,YAAM,oBAAoB,WAAW,MAAM;AAC3C,wBAAkB,OAAO,OAAO,KAAK;AAAA,IACvC,OAAO;AACL,YAAM,yBAAyB,OAAO;AACtC,YAAM,cAAc,SAAS,QAAQ;AAAA,IACvC;AAAA,EACF;AACF;AAMA,eAAe,eAAe,WAA6E;AACzG,MAAI;AACJ,MAAI;AACF,YAAQ,MAAM,QAAQ,SAAS;AAAA,EACjC,SAAS,OAAO;AACd,QAAI,QAAQ,OAAO,QAAQ,EAAG,QAAO;AACrC,UAAM;AAAA,EACR;AACA,QAAM,QAAQ,MAAM,OAAO,CAAC,SAAS,KAAK,KAAK,IAAI,CAAC,EAAE,IAAI,MAAM;AAChE,MAAI,MAAM,WAAW,EAAG,QAAO;AAC/B,QAAM,OAAO,KAAK,IAAI,GAAG,KAAK;AAC9B,QAAM,OAAO,MAAM,SAAS,WAAW,IAAI;AAC3C,SAAO,SAAS,YAAY,OAAO;AACrC;AAUA,eAAe,SAAS,WAAmB,MAAqD;AAC9F,QAAM,OAAO,KAAK,WAAW,OAAO,IAAI,CAAC;AACzC,MAAI;AACJ,MAAI;AACF,WAAO,MAAM,SAAS,KAAK,MAAM,YAAY,GAAG,MAAM;AAAA,EACxD,SAAS,OAAO;AACd,QAAI,CAAC,QAAQ,OAAO,QAAQ,KAAK,CAAC,QAAQ,OAAO,SAAS,EAAG,OAAM;AACnE,WAAO,MAAM,OAAO,IAAI,IAAI,YAAY;AAAA,EAC1C;AACA,MAAI;AACJ,MAAI;AACF,YAAQ,KAAK,MAAM,IAAI;AAAA,EACzB,QAAQ;AACN,WAAO;AAAA,EACT;AACA,MAAI,UAAU,QAAQ,OAAO,UAAU,YAAY,OAAO,MAAM,UAAU,YAAY,OAAO,MAAM,QAAQ,UAAU;AACnH,WAAO;AAAA,EACT;AACA,QAAM,OAAO,MAAM,OAAO,KAAK,MAAM,GAAG,MAAM,KAAK,OAAO,CAAC;AAC3D,QAAM,OAAO,MAAM,OAAO,KAAK,MAAM,GAAG,MAAM,KAAK,OAAO,CAAC;AAC3D,SAAO;AAAA,IACL;AAAA,IACA,OAAO,MAAM;AAAA,IACb,KAAK,MAAM;AAAA,IACX,OAAO,OAAO,MAAM,UAAU,WAAW,MAAM,QAAQ;AAAA,IACvD;AAAA,IACA;AAAA,EACF;AACF;AAOA,eAAe,eAAe,WAAmB,MAAc,OAAiC;AAC9F,QAAM,OAAO,MAAM,SAAS,WAAW,IAAI;AAC3C,MAAI,SAAS,UAAW,OAAM,IAAI,MAAM,QAAQ,IAAI,qBAAqB,SAAS,iBAAiB;AACnG,SAAO,SAAS,QAAQ,KAAK,UAAU,SAAS,KAAK,QAAQ,KAAK;AACpE;AAOA,eAAe,SAAS,SAAiB,WAAmB,QAAyC;AACnG,QAAM,QAAQ,WAAW;AACzB,QAAM,OAAO,OAAO,OAAO;AAC3B,QAAM,OAAO,KAAK,WAAW,OAAO,IAAI,CAAC;AACzC,QAAM,QAAQ,EAAE,KAAK,QAAQ,KAAK,YAAW,oBAAI,KAAK,GAAE,YAAY,GAAG,OAAO,OAAO,OAAO,MAAM;AAClG,MAAI,YAAY;AAChB,MAAI;AACF,gBAAY,MAAM;AAAA,MAChB,KAAK,WAAW,UAAU,QAAQ,GAAG,IAAI,KAAK,EAAE;AAAA,MAChD;AAAA,MACA,EAAE,cAAc,GAAG,KAAK,UAAU,OAAO,MAAM,CAAC,CAAC;AAAA,EAAK;AAAA,MACtD,MAAM,mBAAmB,oCAAoC,OAAO;AAAA,IACtE;AACA,QAAI,aAAa,MAAM,eAAe,WAAW,OAAO,MAAM,OAAO,KAAK,KAAK,MAAM,SAAS,MAAM,OAAO,MAAM,GAAG;AAClH,aAAO,EAAE,WAAW,MAAM,MAAM;AAAA,IAClC;AACA,QAAI,UAAW,OAAM,SAAS,MAAM,OAAO,MAAM;AACjD,WAAO;AAAA,EACT,SAAS,OAAO;AACd,QAAI,UAAW,eAAc,WAAW,MAAM,KAAK;AACnD,UAAM;AAAA,EACR;AACF;AASA,eAAe,oBAAoB,WAAmB,WAAqC;AACzF,QAAM,OAAO,KAAK,WAAW,OAAO,UAAU,IAAI,CAAC;AACnD,MAAI,CAAC,UAAU,QAAQ,UAAU,UAAU,QACzC,MAAM,eAAe,WAAW,UAAU,OAAO,GAAG,UAAU,KAAK,GAAG;AACtE,UAAM,SAAS,MAAM,UAAU,OAAO,MAAM;AAAA,EAC9C;AACA,QAAM,SAAS,MAAM,UAAU,OAAO,MAAM;AAC9C;AASA,SAAS,cAAc,WAAmB,MAAc,OAAe,UAAU,gBAAsB;AACrG,oBAAkB,IAAI,KAAK;AAC3B,QAAM,YAAY;AAChB,QAAI;AACF,YAAM,OAAO,MAAM,SAAS,WAAW,IAAI;AAC3C,UAAI,SAAS,QAAQ,SAAS,aAAa,KAAK,UAAU,SAAS,CAAC,KAAK,KAAM,OAAM,oBAAoB,WAAW,IAAI;AACxH,wBAAkB,OAAO,KAAK;AAAA,IAChC,QAAQ;AAEN,UAAI,UAAU,EAAG,YAAW,MAAM,cAAc,WAAW,MAAM,OAAO,UAAU,CAAC,GAAG,eAAe,EAAE,MAAM;AAAA,IAC/G;AAAA,EACF,GAAG;AACL;AAOA,eAAe,SAAS,MAAc,OAAe,MAAyC;AAC5F,WAAS,UAAU,KAAK,WAAW;AACjC,QAAI;AACF,YAAM,UAAU,KAAK,MAAM,GAAG,KAAK,IAAI,IAAI,EAAE,GAAG,IAAI,EAAE,MAAM,mBAAmB,MAAM,KAAK,CAAC;AAC3F,aAAO;AAAA,IACT,SAAS,OAAO;AACd,UAAI,QAAQ,OAAO,QAAQ,EAAG,QAAO;AACrC,UAAI,QAAQ,OAAO,QAAQ,EAAG,QAAO;AACrC,UAAI,WAAW,uBAAuB,OAAQ,OAAM;AACpD,YAAM,MAAM,uBAAuB,OAAO,CAAE;AAAA,IAC9C;AAAA,EACF;AACF;AAGA,eAAe,oBAAoB,WAAkC;AACnE,QAAM,QAAQ,WAAW;AACzB,QAAM,QAAQ,EAAE,KAAK,QAAQ,KAAK,YAAW,oBAAI,KAAK,GAAE,YAAY,GAAG,OAAO,OAAO,KAAK;AAC1F,QAAM,iBAAiB,KAAK,QAAQ,SAAS,GAAG,UAAU,SAAS,SAAS,CAAC,IAAI,QAAQ,GAAG,IAAI,KAAK,EAAE,GAAG,WAAW;AAAA,IACnH,gBAAgB,GAAG,KAAK,UAAU,OAAO,MAAM,CAAC,CAAC;AAAA;AAAA,IACjD,CAAC,KAAK,KAAK,OAAO,GAAG;AAAA,IACrB,CAAC,KAAK,KAAK,OAAO,GAAG;AAAA,EACvB,CAAC;AACH;AASA,eAAe,iBACb,OACA,QACA,OACA,cACkB;AAClB,MAAI;AACF,eAAW,CAAC,MAAM,QAAQ,KAAK,OAAO,QAAQ,KAAK,GAAG;AACpD,YAAM,MAAM,QAAQ,KAAK,OAAO,IAAI,CAAC,GAAG,EAAE,WAAW,MAAM,MAAM,iBAAiB,CAAC;AACnF,YAAM,iBAAiB,KAAK,OAAO,IAAI,GAAG,QAAQ;AAAA,IACpD;AACA,UAAM,eAAe;AACrB,UAAM,OAAO,OAAO,MAAM;AAC1B,WAAO;AAAA,EACT,SAAS,OAAO;AAGd,QAAI,CAAC,aAAa,UAAU,QAAQ,EAAE,KAAK,CAAC,SAAS,QAAQ,OAAO,IAAI,CAAC,KAAK,MAAM,OAAO,MAAM,EAAG,QAAO;AAC3G,UAAM;AAAA,EACR,UAAE;AACA,UAAM,GAAG,OAAO,EAAE,WAAW,MAAM,OAAO,KAAK,CAAC,EAAE,MAAM,MAAM,MAAS;AAAA,EACzE;AACF;AAOA,eAAe,YAAY,SAAiB,MAA2B;AACrE,MAAI;AACF,UAAM,SAAS,KAAK,KAAK,WAAW,OAAO,KAAK,IAAI,CAAC,GAAG,KAAK,OAAO,MAAM;AAAA,EAC5E,QAAQ;AACN,kBAAc,KAAK,WAAW,KAAK,MAAM,KAAK,KAAK;AACnD;AAAA,EACF;AACA,QAAM,aAAa,SAAS,IAAI,EAAE,MAAM,MAAM,MAAS;AACzD;AAOA,SAAS,qBAAqB,MAAuB;AACnD,MAAI,KAAK,WAAW,SAAS,EAAG,QAAO;AACvC,QAAM,SAAS,6CAA6C,KAAK,IAAI,IAAI,CAAC;AAC1E,SAAO,WAAW,UAAa,CAAC,eAAe,OAAO,MAAM,CAAC;AAC/D;AAGA,SAAS,8BAA8B,MAAuB;AAC5D,QAAM,SAAS,qFAAqF,KAAK,IAAI,IAAI,CAAC;AAClH,SAAO,WAAW,UAAa,CAAC,eAAe,OAAO,MAAM,CAAC;AAC/D;AAYA,eAAe,aAAa,SAAiB,MAA2B;AACtE,aAAW,CAAC,WAAW,SAAS,KAAK;AAAA,IACnC,CAAC,KAAK,WAAW,oBAAoB;AAAA,IACrC,CAAC,QAAQ,KAAK,SAAS,GAAG,6BAA6B;AAAA,EACzD,GAAY;AACV,eAAW,SAAS,MAAM,QAAQ,SAAS,GAAG,OAAO,SAAS,GAAG;AAC/D,YAAM,GAAG,KAAK,WAAW,IAAI,GAAG,EAAE,WAAW,MAAM,OAAO,KAAK,CAAC,EAAE,MAAM,MAAM,MAAS;AAAA,IACzF;AAAA,EACF;AACA,QAAM,SAAS,MAAM,QAAQ,KAAK,SAAS,GAAG,OAAO,CAAC,SAAS,KAAK,KAAK,IAAI,CAAC,EAAE,IAAI,MAAM,EACvF,OAAO,CAAC,SAAS,OAAO,KAAK,IAAI,EACjC,KAAK,CAAC,MAAM,UAAU,OAAO,KAAK;AACrC,aAAW,QAAQ,OAAO;AACxB,UAAM,YAAY,MAAM,SAAS,KAAK,WAAW,IAAI;AACrD,QAAI,cAAc,QAAQ,cAAc,aAAa,CAAC,UAAU,KAAM;AACtE,QAAI,UAAU,MAAM;AAClB,UAAI,MAAM,OAAO,KAAK,KAAK,WAAW,OAAO,OAAO,CAAC,CAAC,CAAC,EAAG;AAC1D,YAAM,OAAO,MAAM,SAAS,KAAK,WAAW,OAAO,CAAC;AACpD,UAAI,SAAS,QAAQ,SAAS,aAAa,CAAC,KAAK,QAAQ,CAAC,KAAK,KAAM;AAAA,IACvE;AACA,UAAM,mBAAmB,oCAAoC,OAAO;AACpE,UAAM,QAAQ,KAAK,KAAK,WAAW,UAAU,WAAW,CAAC,EAAE;AAC3D,QAAI,MAAM,OAAO,KAAK,KAAK,WAAW,OAAO,IAAI,CAAC,GAAG,KAAK,EAAE,KAAK,MAAM,MAAM,MAAM,KAAK,GAAG;AACzF,YAAM,GAAG,OAAO,EAAE,WAAW,MAAM,OAAO,KAAK,CAAC,EAAE,MAAM,MAAM,MAAS;AAAA,IACzE;AAAA,EACF;AACF;AA8BA,eAAe,mBAAmB,SAAiB,UAAkB,OAAe,gBAA2C;AAC7H,MAAI;AACF,UAAM,MAAM,UAAU,EAAE,MAAM,iBAAiB,CAAC;AAAA,EAClD,SAAS,OAAO;AACd,QAAI,QAAQ,OAAO,QAAQ,EAAG,QAAO;AACrC,QAAI,CAAC,QAAQ,OAAO,QAAQ,EAAG,OAAM;AAErC,QAAI,eAAgB,OAAM,IAAI,oBAAoB,OAAO;AACzD,UAAM,MAAM,YAAY,OAAO,GAAG,EAAE,WAAW,MAAM,MAAM,iBAAiB,CAAC;AAC7E,WAAO;AAAA,EACT;AACA,QAAM,mBAAmB,+BAA+B,OAAO;AAC/D,QAAM,YAAY,KAAK,UAAU,YAAY;AAC7C,QAAM,SAAS,KAAK,QAAQ,QAAQ,GAAG,eAAe,KAAK,MAAM;AACjE,QAAM,QAAQ,GAAG,KAAK,UAAU,EAAE,KAAK,QAAQ,KAAK,YAAW,oBAAI,KAAK,GAAE,YAAY,GAAG,MAAM,GAAG,MAAM,CAAC,CAAC;AAAA;AAC1G,MAAI;AACF,UAAM,UAAU,QAAQ,OAAO,EAAE,UAAU,QAAQ,MAAM,mBAAmB,MAAM,KAAK,CAAC;AACxF,QAAI;AACF,YAAM,KAAK,QAAQ,SAAS;AAAA,IAC9B,SAAS,OAAO;AACd,UAAI,CAAC,eAAe,KAAK,EAAG,OAAM;AAClC,YAAM,UAAU,WAAW,OAAO,EAAE,UAAU,QAAQ,MAAM,mBAAmB,MAAM,KAAK,CAAC;AAAA,IAC7F;AACA,WAAO;AAAA,EACT,SAAS,OAAO;AACd,QAAI,QAAQ,OAAO,QAAQ,KAAK,QAAQ,OAAO,QAAQ,EAAG,QAAO;AAIjE,UAAM,MAAM,QAAQ,EAAE,MAAM,MAAM,MAAS;AAC3C,UAAM;AAAA,EACR,UAAE;AACA,UAAM,GAAG,QAAQ,EAAE,OAAO,KAAK,CAAC,EAAE,MAAM,MAAM,MAAS;AAAA,EACzD;AACF;AAUA,SAAS,eAAe,OAAyB;AAC/C,SAAO,OAAO,UAAU,YAAY,UAAU,QAAQ,UAAU,SAC9D,oBAAoB,IAAI,OAAQ,MAA6B,IAAI,CAAC;AACtE;AASA,eAAe,mBAAmB,SAAiB,UAAkB,OAA8B;AACjG,QAAM,YAAY,KAAK,UAAU,YAAY;AAC7C,QAAM,QAAQ,MAAM,SAA8B,SAAS,EAAE,MAAM,MAAM,IAAI;AAC7E,MAAI,OAAO,UAAU,MAAO;AAC5B,QAAM,GAAG,WAAW,EAAE,OAAO,KAAK,CAAC;AAMnC,QAAM,mBAAmB,+BAA+B,OAAO;AAC/D,QAAM,MAAM,QAAQ,EAAE,MAAM,MAAM,MAAS;AAC7C;AAQA,eAAe,yBAAyB,SAAgC;AACtE,MAAI,QAAQ,IAAI,aAAa,OAAQ;AAErC,QAAM,iBAAiB,QAAQ,IAAI,gCAAgC;AACnE,QAAM,iBAAiB,QAAQ,IAAI;AACnC,MAAI,CAAC,kBAAkB,CAAC,eAAgB;AAExC,QAAM,OAAO,QAAQ,cAAc;AACnC,QAAM,aAAa,QAAQ,cAAc;AACzC,QAAM,eAAe,SAAS,MAAM,UAAU;AAC9C,MACE,iBAAiB,MACjB,iBAAiB,QACjB,aAAa,WAAW,KAAK,QAAQ,aAAa,UAAU,OAAO,GAAG,EAAE,KACxE,aAAa,WAAW,KAAK,KAC7B,aAAa,WAAW,MAAM,GAC9B;AACA;AAAA,EACF;AAEA,QAAM,UAAU,YAAY,GAAG,OAAO;AAAA,GAAM,EAAE,UAAU,QAAQ,MAAM,KAAK,CAAC,EACzE,MAAM,MAAM,MAAS;AAC1B;AAqBA,eAAe,qBAAqB,SAAiB,UAAkB,cAAwC;AAC7G,MAAI;AACJ,MAAI;AACF,UAAM,EAAE,QAAQ,IAAI,MAAM,KAAK,QAAQ;AACvC,WAAO,KAAK,IAAI,IAAI,WAAW;AAAA,EACjC,QAAQ;AACN,WAAO;AAAA,EACT;AACA,QAAM,YAAY,YAAY,IAAI;AAClC,QAAM,mBAAmB,iCAAiC,OAAO;AACjE,MAAI;AACF,UAAM,UAAU,MAAM,QAAQ,QAAQ;AACtC,QAAI,QAAQ,SAAS,YAAY,EAAG,QAAO;AAC3C,UAAM,qBAAqB,QAAQ,SAAS,KAAK,QAAQ,MAAM,CAAC,UAAU,eAAe,KAAK,KAAK,CAAC;AACpG,QAAI,CAAC,uBAAuB,CAAC,QAAQ,eAAe,WAAW,YAAY,GAAI,QAAO;AACtF,eAAW,QAAQ,QAAQ,OAAO,CAAC,UAAU,eAAe,KAAK,KAAK,CAAC,GAAG;AACxE,YAAM,YAAY,KAAK,UAAU,IAAI;AACrC,UAAI,MAAM,qBAAqB,SAAS,GAAG;AAGzC,YAAI,CAAC,MAAM,OAAO,KAAK,UAAU,YAAY,CAAC,EAAG,OAAM,OAAO,WAAW,KAAK,UAAU,YAAY,CAAC;AACrG,eAAO;AAAA,MACT;AACA,YAAM,GAAG,WAAW,EAAE,OAAO,KAAK,CAAC;AAAA,IACrC;AACA,eAAW,QAAQ,QAAQ,OAAO,CAAC,UAAU,gBAAgB,KAAK,KAAK,CAAC,GAAG;AACzE,YAAM,GAAG,KAAK,UAAU,IAAI,GAAG,EAAE,OAAO,KAAK,CAAC;AAAA,IAChD;AACA,UAAM,MAAM,QAAQ;AAAA,EACtB,QAAQ;AACN,WAAO;AAAA,EACT;AACA,QAAM,qBAAqB,UAAU,YAAY;AACjD,SAAO;AACT;AAGA,eAAe,qBAAqB,WAAqC;AACvE,MAAI;AACJ,MAAI;AACF,eAAW,MAAM,SAAS,WAAW,MAAM;AAAA,EAC7C,SAAS,OAAO;AACd,QAAI,QAAQ,OAAO,QAAQ,EAAG,QAAO;AACrC,UAAM;AAAA,EACR;AACA,MAAI;AACJ,MAAI;AACF,YAAQ,KAAK,MAAM,QAAQ;AAAA,EAC7B,QAAQ;AACN,WAAO;AAAA,EACT;AACA,QAAM,MAAM,OAAO,UAAU,YAAY,UAAU,QAAQ,SAAS,QAAQ,MAAM,MAAM;AACxF,SAAO,OAAO,QAAQ,YAAY,OAAO,UAAU,GAAG,KAAK,MAAM,KAAK,eAAe,GAAG;AAC1F;AAOA,SAAS,eAAe,OAAe,cAA+B;AACpE,SAAO,YAAY,IAAI,IAAI,SAAS,eAAe;AACrD;AAmBA,eAAe,qBAAqB,UAAkB,cAAqC;AACzF,QAAM,YAAY,QAAQ,QAAQ;AAClC,QAAM,QAAQ,MAAM,QAAQ,SAAS,EAAE,MAAM,MAAM,CAAC,CAAC;AACrD,aAAW,QAAQ,MAAM,OAAO,CAAC,UAAU,aAAa,KAAK,KAAK,CAAC,GAAG;AACpE,UAAM,OAAO,KAAK,WAAW,IAAI;AACjC,UAAM,OAAO,MAAM,KAAK,IAAI,EAAE,KAAK,CAAC,EAAE,QAAQ,MAAM,KAAK,IAAI,IAAI,WAAW,cAAc,MAAM,KAAK;AACrG,QAAI,KAAM,OAAM,GAAG,MAAM,EAAE,OAAO,KAAK,CAAC,EAAE,MAAM,MAAM,MAAS;AAAA,EACjE;AACF;AA8BA,eAAe,iBAAiB,SAAiB,UAAkB,cAAwC;AACzG,QAAM,YAAY,KAAK,UAAU,YAAY;AAC7C,QAAM,WAAW,MAAM,SAAS,WAAW,MAAM,EAAE,MAAM,MAAM,IAAI;AACnE,MAAI,aAAa,KAAM,QAAO,qBAAqB,SAAS,UAAU,YAAY;AAClF,MAAI,CAAC,MAAM,iBAAiB,UAAU,WAAW,YAAY,EAAG,QAAO;AAEvE,QAAM,mBAAmB,gCAAgC,OAAO;AAChE,QAAM,YAAY,KAAK,UAAU,YAAY,WAAW,CAAC,OAAO;AAChE,MAAI,QAAQ;AACZ,MAAI;AACF,UAAM,KAAK,WAAW,SAAS;AAAA,EACjC,SAAS,OAAO;AAEd,QAAI,CAAC,eAAe,KAAK,EAAG,QAAO;AACnC,QAAI;AACF,YAAM,OAAO,WAAW,SAAS;AACjC,cAAQ;AAAA,IACV,QAAQ;AACN,aAAO;AAAA,IACT;AAAA,EACF;AACA,MAAI,MAAO,OAAM,mBAAmB,6BAA6B,OAAO;AACxE,QAAM,eAAe,MAAM,SAAS,WAAW,MAAM,EAAE,KAAK,CAAC,YAAY,YAAY,UAAU,MAAM,KAAK;AAC1G,QAAM,mBAAmB,gCAAgC,OAAO;AAChE,MAAI,CAAC,cAAc;AACjB,QAAI,OAAO;AAGT,YAAM,OAAO,WAAW,SAAS,EAAE,MAAM,MAAM,MAAS;AAAA,IAC1D,OAAO;AACL,YAAM,OAAO,SAAS,EAAE,MAAM,MAAM,MAAS;AAAA,IAC/C;AACA,WAAO;AAAA,EACT;AACA,MAAI,CAAC,MAAO,OAAM,GAAG,WAAW,EAAE,OAAO,KAAK,CAAC;AAC/C,QAAM,mBAAmB,6BAA6B,OAAO;AAC7D,QAAM,mBAAmB,+BAA+B,OAAO;AAE/D,aAAW,SAAS,MAAM,QAAQ,QAAQ,EAAE,MAAM,MAAM,CAAC,CAAC,GAAG,OAAO,CAAC,UAAU,eAAe,KAAK,KAAK,CAAC,GAAG;AAC1G,QAAI,KAAK,UAAU,IAAI,MAAM,UAAW,OAAM,GAAG,KAAK,UAAU,IAAI,GAAG,EAAE,OAAO,KAAK,CAAC;AAAA,EACxF;AAGA,MAAI,MAAM,OAAO,SAAS,EAAE,KAAK,MAAM,MAAM,MAAM,KAAK,EAAG,OAAM,MAAM,QAAQ,EAAE,MAAM,MAAM,MAAS;AACtG,QAAM,qBAAqB,UAAU,YAAY;AACjD,SAAO;AACT;AAUA,eAAe,iBAAiB,UAAkB,WAAmB,cAAwC;AAC3G,MAAI;AACJ,MAAI;AACF,YAAQ,KAAK,MAAM,QAAQ;AAAA,EAC7B,QAAQ;AACN,YAAQ;AAAA,EACV;AACA,MAAI,OAAO,UAAU,YAAY,UAAU,QAAQ,SAAS,OAAO;AACjE,WAAO,aAAa,OAAiD,YAAY;AAAA,EACnF;AACA,QAAM,aAAa,MAAM,KAAK,SAAS,EAAE,KAAK,CAAC,EAAE,QAAQ,MAAM,SAAS,MAAM,OAAO,GAAG;AACxF,SAAO,KAAK,IAAI,IAAI,cAAc;AACpC;AAGA,eAAe,mBAAmB,iBAAyB,SAAgC;AACzF,MAAI,QAAQ,IAAI,aAAa,OAAQ;AACrC,QAAM,mBAAmB,QAAQ,IAAI,eAAe;AACpD,MAAI,CAAC,iBAAkB;AACvB,QAAM,MAAM,kBAAkB,EAAE,WAAW,KAAK,CAAC;AACjD,QAAM,YAAY,KAAK,kBAAkB,SAAS,QAAQ,GAAG,IAAI,OAAO,EAAE;AAC1E,QAAM,UAAU,WAAW,WAAW,EAAE,UAAU,QAAQ,MAAM,KAAK,CAAC,EAAE,MAAM,MAAM,MAAS;AAC7F,QAAM,cAAc,KAAK,kBAAkB,SAAS;AACpD,SAAO,MAAM;AACX,QAAI;AACF,YAAM,SAAS,aAAa,MAAM;AAClC;AAAA,IACF,QAAQ;AACN,YAAM,MAAM,CAAC;AAAA,IACf;AAAA,EACF;AACF;AAEA,SAAS,aACP,OACA,cACS;AACT,QAAM,MAAM,KAAK,IAAI;AACrB,QAAM,YAAY,OAAO,OAAO,cAAc,WAC1C,KAAK,MAAM,MAAM,SAAS,IAC1B,OAAO;AAKX,MAAI,CAAC,OAAO,SAAS,SAAS,KAAK,MAAM,YAAY,aAAc,QAAO;AAC1E,MAAI,OAAO,OAAO,QAAQ,YAAY,CAAC,OAAO,UAAU,MAAM,GAAG,KAAK,MAAM,OAAO,GAAG;AACpF,WAAO;AAAA,EACT;AACA,SAAO,CAAC,eAAe,MAAM,GAAG;AAClC;AAGA,eAAe,OAAO,MAAgC;AACpD,MAAI;AACF,UAAM,KAAK,IAAI;AACf,WAAO;AAAA,EACT,SAAS,OAAO;AACd,QAAI,QAAQ,OAAO,QAAQ,KAAK,QAAQ,OAAO,SAAS,EAAG,QAAO;AAClE,UAAM;AAAA,EACR;AACF;AAEA,SAAS,eAAe,KAAsB;AAC5C,MAAI;AACF,YAAQ,KAAK,KAAK,CAAC;AACnB,WAAO;AAAA,EACT,SAAS,OAAO;AACd,WAAO,CAAC,QAAQ,OAAO,OAAO;AAAA,EAChC;AACF;AAEA,SAAS,oBAAoB,SAAyB;AACpD,MACE,CAAC,WACD,YAAY,OACZ,YAAY,QACZ,QAAQ,SAAS,GAAG,KACpB,QAAQ,SAAS,IAAI,KACrB,QAAQ,SAAS,IAAI,GACrB;AACA,UAAM,IAAI,UAAU,gDAAgD;AAAA,EACtE;AACA,SAAO;AACT;AAEA,SAAS,QAAQ,OAAgB,MAAuB;AACtD,SAAO,OAAO,UAAU,YAAY,UAAU,QAAQ,UAAU,SAC7D,MAA6B,SAAS;AAC3C;AAEA,SAAS,MAAM,cAAqC;AAClD,SAAO,IAAI,QAAQ,CAACC,aAAY,WAAWA,UAAS,YAAY,CAAC;AACnE;AAn3CA,IAmBM,iBACA,yBACA,uBACA,uBACA,kCAEA,mBACA,kBACA,gCACA,iCACA,+BACA,+BACA,6BACA,+BACA,gCACA,6BACA,oCACA,mCACA,oCA2BA,qBAEA,kBA6BO,yBAgBA,qBAweP,MAvlBN,IAsmBM,mBAKA,wBAEA,iBACA,gBA4aA,qBA8IA,iBAOA,gBAEA;AAjrCN;AAAA;AAAA;AAmBA,IAAM,kBAAkB;AACxB,IAAM,0BAA0B;AAChC,IAAM,wBAAwB;AAC9B,IAAM,wBAAwB;AAC9B,IAAM,mCAAmC;AAEzC,IAAM,oBAAoB;AAC1B,IAAM,mBAAmB;AACzB,IAAM,iCAAiC;AACvC,IAAM,kCAAkC;AACxC,IAAM,gCAAgC;AACtC,IAAM,gCAAgC;AACtC,IAAM,8BAA8B;AACpC,IAAM,gCAAgC;AACtC,IAAM,iCAAiC;AACvC,IAAM,8BAA8B;AACpC,IAAM,qCAAqC;AAC3C,IAAM,oCAAoC;AAC1C,IAAM,qCAAqC;AA2B3C,IAAM,sBAAsB,mBAA2B,6CAA6C;AAEpG,IAAM,mBAAmB,mBAA+C,0CAA0C;AA6B3G,IAAM,0BAAN,cAAsC,MAAM;AAAA;AAAA,MAIjD,YAAY,SAAiB,WAAmB,QAAiB;AAC/D,cAAM,+CAA+C,OAAO,WAAW,SAAS,MAAM,SAAS,IAAI,MAAM,KAAK,EAAE,EAAE;AAJpH,aAAS,OAAO;AAKd,aAAK,OAAO;AAAA,MACd;AAAA,IACF;AAQO,IAAM,sBAAN,cAAkC,MAAM;AAAA,MAG7C,YAAY,SAAiB;AAC3B,cAAM,YAAY,OAAO,qFAAqF;AAHhH,aAAS,OAAO;AAId,aAAK,OAAO;AAAA,MACd;AAAA,IACF;AAieA,IAAM,OAAO;AAeb,IAAM,oBACH,gBAAkE,uBAAO,IAAI,kDAAkD,OAA/H,iBACC,oBAAI,IAAY;AAGpB,IAAM,yBAAyB,CAAC,IAAI,IAAI,GAAG;AAE3C,IAAM,kBAAkB;AACxB,IAAM,iBAAiB;AA4avB,IAAM,sBAAsB,oBAAI,IAAI,CAAC,SAAS,WAAW,cAAc,UAAU,UAAU,QAAQ,CAAC;AA8IpG,IAAM,kBAAkB;AAOxB,IAAM,iBAAiB;AAEvB,IAAM,eAAe;AAAA;AAAA;;;ACjrCrB,SAAS,cAAAC,mBAAkB;AAG3B,SAAS,SAAS;AAuJX,SAAS,kCAAkC,OAA2C;AAC3F,SAAO,gCAAgC,MAAM,KAAK;AACpD;AAeA,SAAS,iCACP,OACA,SAC2B;AAC3B,MAAI,UAAU,MAAM,UAAU,MAAM,UAAU,QAAQ,UAAU,GAAG;AACjE,UAAM,IAAI,UAAU,0DAA0D;AAAA,EAChF;AACA,QAAM,YAAY,QAAQ,OAAO,oBAAI,KAAK;AAC1C,MAAI,OAAO,MAAM,UAAU,QAAQ,CAAC,GAAG;AACrC,UAAM,IAAI,UAAU,2DAA2D;AAAA,EACjF;AACA,SAAO;AAAA,IACL,MAAM;AAAA,IACN,SAAS;AAAA,IACT,WAAW,MAAM;AAAA,IACjB,WAAW,UAAU,YAAY;AAAA,IACjC,SAAS,QAAQ;AAAA,IACjB,SAAS,QAAQ;AAAA,IACjB,cAAc,QAAQ;AAAA,IACtB,MAAM,QAAQ;AAAA,IACd,YAAY,QAAQ;AAAA,IACpB,GAAI,QAAQ,aAAa,SAAY,CAAC,IAAI,EAAE,UAAU,QAAQ,SAAS;AAAA,IACvE,GAAI,QAAQ,YAAY,SAAY,CAAC,IAAI,EAAE,SAAS,QAAQ,QAAQ;AAAA,IACpE,GAAI,MAAM,oBAAoB,SAAY,CAAC,IAAI,EAAE,iBAAiB,MAAM,gBAAgB;AAAA,IACxF,WAAW,yBAAyB,MAAM,SAAS;AAAA,EACrD;AACF;AAEA,SAAS,UAAU,OAAuB;AACxC,SAAO,MAAM,MAAM,KAAK,CAAC,EAAE,CAAC;AAC9B;AAMO,SAAS,gCAAgC,OAA+C;AAC7F,SAAO,KAAK,UAAU;AAAA,IACpB,SAAS,MAAM;AAAA,IACf,YAAY,MAAM;AAAA,IAClB,MAAM,MAAM;AAAA,IACZ,SAAS,yBAAyB,MAAM,OAAO;AAAA,EACjD,CAAC;AACH;AAGO,SAAS,+BACd,OAC2B;AAC3B,QAAM,MAAM,MAAM,QAAQ,MAAM,oBAAI,KAAK;AACzC,QAAM,YAAY,IAAI;AACtB,MAAI,OAAO,MAAM,UAAU,QAAQ,CAAC,EAAG,OAAM,IAAI,UAAU,8CAA8C;AACzG,QAAM,YAAY,yBAAyB,MAAM,OAAO;AACxD,MAAI,UAAU,WAAW,EAAG,OAAM,IAAI,UAAU,8DAA8D;AAE9G,SAAO,kCAAkC;AAAA,IACvC,MAAM;AAAA,IACN,SAAS;AAAA,IACT,WAAW,MAAM,kBAAkB,KAAK,iBAAiB,SAAS;AAAA,IAClE,WAAW,UAAU,YAAY;AAAA,IACjC,SAAS,MAAM;AAAA,IACf,SAAS,MAAM;AAAA,IACf,cAAc,MAAM;AAAA,IACpB,MAAM,MAAM;AAAA,IACZ,YAAY,MAAM;AAAA,IAClB,GAAI,MAAM,aAAa,SAAY,EAAE,UAAU,MAAM,SAAS,IAAI,CAAC;AAAA,IACnE,GAAI,MAAM,YAAY,SAAY,EAAE,SAAS,MAAM,QAAQ,IAAI,CAAC;AAAA,IAChE,GAAI,MAAM,oBAAoB,SAAY,EAAE,iBAAiB,MAAM,gBAAgB,IAAI,CAAC;AAAA,IACxF;AAAA,IACA,GAAI,MAAM,YAAY,SAClB,EAAE,SAAS,EAAE,MAAM,CAAC,GAAG,MAAM,QAAQ,IAAI,GAAG,KAAK,MAAM,QAAQ,IAAI,EAAE,IACrE,CAAC;AAAA,EACP,CAAC;AACH;AAGA,eAAsB,uBACpB,SACA,SACsC;AACtC,QAAM,UAAuC,CAAC;AAC9C,aAAW,SAAS,MAAM,iBAA0B,OAAO,GAAG;AAC5D,UAAM,YAAY,gCAAgC,UAAU,KAAK;AACjE,QAAI,UAAU,SAAS;AACrB,UAAI,YAAY,UAAa,UAAU,UAAU,KAAK,UAAU,MAAM,UAAU,QAAQ,UAAU,GAAG;AACnG;AAAA,MACF;AACA,cAAQ,KAAK,UAAU,IAAI;AAC3B;AAAA,IACF;AACA,UAAM,SAAS,sCAAsC,UAAU,KAAK;AACpE,QAAI,CAAC,OAAO,QAAS,OAAM,IAAI,UAAU,wCAAwC;AACjF,QAAI,YAAY,QAAW;AACzB,YAAM,IAAI,UAAU,oEAAoE;AAAA,IAC1F;AACA,QAAI,UAAU,OAAO,KAAK,UAAU,MAAM,UAAU,QAAQ,UAAU,EAAG;AACzE,YAAQ,KAAK,iCAAiC,OAAO,MAAM,OAAO,CAAC;AAAA,EACrE;AACA,SAAO;AACT;AAEA,eAAsB,sBACpB,SACA,WACA,UAE2C;AAC3C,QAAM,UAAU,MAAM,uBAAuB,SAAS;AAAA,IACpD;AAAA,IACA,MAAM,SAAS;AAAA,IACf,YAAY,SAAS;AAAA,IACrB,SAAS,SAAS,WAAW;AAAA,IAC7B,cAAc,SAAS,gBAAgB;AAAA,IACvC,GAAI,SAAS,aAAa,SAAY,CAAC,IAAI,EAAE,UAAU,SAAS,SAAS;AAAA,IACzE,GAAI,SAAS,YAAY,SAAY,CAAC,IAAI,EAAE,SAAS,SAAS,QAAQ;AAAA,EACxE,CAAC;AACD,SAAO,QAAQ;AAAA,IAAK,CAAC,WACnB,OAAO,cAAc,aACrB,OAAO,eAAe,SAAS,cAC/B,OAAO,SAAS,SAAS;AAAA,EAC3B,KAAK;AACP;AAOA,eAAsB,+BACpB,OACsC;AAItC,QAAM,UAAU,MAAM,iBAAiB,SACnC,kBAAkB,MAAM,SAAS,MAAM,OAAO,EAAE,UAChD,yBAAyB,MAAM,OAAO;AAC1C,QAAM,MAAM,MAAM,QAAQ,MAAM,oBAAI,KAAK;AACzC,QAAM,cAAc,IAAI;AACxB,MAAI,OAAO,MAAM,YAAY,QAAQ,CAAC,EAAG,OAAM,IAAI,UAAU,8CAA8C;AAE3G,SAAO;AAAA,IACL,MAAM;AAAA,IACN;AAAA,IACA,CAAC,eAAe;AACd,YAAM,UAAuC,CAAC;AAC9C,iBAAW,SAAS,YAAY;AAC9B,cAAM,YAAY,gCAAgC,UAAU,KAAK;AACjE,YAAI,UAAU,SAAS;AACrB,cAAI,UAAU,UAAU,KAAK,UAAU,MAAM,UAAU,MAAM,UAAU,EAAG;AAC1E,kBAAQ,KAAK,UAAU,IAAI;AAC3B;AAAA,QACF;AACA,cAAM,SAAS,sCAAsC,UAAU,KAAK;AACpE,YAAI,CAAC,OAAO,QAAS,OAAM,IAAI,UAAU,wCAAwC;AACjF,YAAI,UAAU,OAAO,KAAK,UAAU,MAAM,UAAU,MAAM,UAAU,EAAG;AACvE,gBAAQ,KAAK,iCAAiC,OAAO,MAAM;AAAA,UACzD,SAAS,MAAM;AAAA,UACf,MAAM,MAAM;AAAA,UACZ,YAAY,MAAM;AAAA,UAClB,SAAS,MAAM;AAAA,UACf,cAAc,MAAM;AAAA,UACpB,GAAI,MAAM,aAAa,SAAY,CAAC,IAAI,EAAE,UAAU,MAAM,SAAS;AAAA,UACnE,GAAI,MAAM,YAAY,SAAY,CAAC,IAAI,EAAE,SAAS,MAAM,QAAQ;AAAA,UAChE,KAAK;AAAA,QACP,CAAC,CAAC;AAAA,MACJ;AACA,YAAM,WAAW,wBAAwB,SAAS;AAAA,QAChD,SAAS,MAAM;AAAA,QACf,YAAY,MAAM;AAAA,QAClB,SAAS,MAAM;AAAA,QACf,cAAc,MAAM;AAAA,QACpB,KAAK;AAAA,MACP,CAAC;AAED,UAAI,QAAQ,WAAW,GAAG;AACxB,eAAO,EAAE,SAAS,UAAU,QAAQ,EAAE,QAAQ,aAAa,QAAQ,MAAM,EAAE;AAAA,MAC7E;AAEA,YAAM,WAAW,gCAAgC,EAAE,GAAG,OAAO,QAAQ,CAAC;AACtE,YAAM,oBAAoB,SAAS,OAAO,CAAC,WAAW,CAAC,eAAe,QAAQ,OAAO,OAAO,CAAC;AAC7F,YAAM,aAAa,wBAAwB,mBAAmB,QAAQ;AACtE,UAAI,eAAe,UAAa,MAAM,YAAY,MAAM;AACtD,eAAO,EAAE,SAAS,mBAAmB,QAAQ,EAAE,QAAQ,WAAW,QAAQ,MAAM,SAAS,WAAW,EAAE;AAAA,MACxG;AAEA,YAAM,OAAO,kBAAkB;AAAA,QAAO,CAAC,WACrC,MAAM,YAAY,QAAQ,kCAAkC,MAAM,MAAM;AAAA,MAC1E;AACA,YAAM,UAAU,+BAA+B,EAAE,GAAG,OAAO,SAAS,KAAK,MAAM,YAAY,CAAC;AAC5F,aAAO;AAAA,QACL,SAAS,CAAC,GAAG,MAAM,OAAO;AAAA,QAC1B,QAAQ,EAAE,QAAQ,WAAW,QAAQ,OAAO,QAAQ;AAAA,MACtD;AAAA,IACF;AAAA,EACF;AACF;AAWO,SAAS,wBACd,SACA,OAC6B;AAC7B,QAAM,SAAS,MAAM,IAAI,QAAQ,IAAI;AACrC,SAAO,QAAQ,OAAO,CAAC,WAAW;AAChC,UAAM,YAAY,KAAK,MAAM,OAAO,SAAS;AAC7C,QAAI,CAAC,OAAO,SAAS,SAAS,KAAK,YAAY,OAAQ,QAAO;AAC9D,QAAI,OAAO,YAAY,MAAM,WAAW,UAAU,OAAO,UAAU,MAAM,UAAU,MAAM,UAAU,EAAG,QAAO;AAI7G,QAAI,OAAO,UAAU,WAAW,EAAG,QAAO;AAC1C,WAAO,CAAC;AAAA,MACN,MAAM;AAAA,MACN,OAAO;AAAA,MACP,MAAM;AAAA,IACR,EAAE;AAAA,EACJ,CAAC;AACH;AAEA,SAAS,wBACP,SACA,UACuC;AACvC,MAAI;AACJ,aAAW,UAAU,SAAS;AAC5B,QAAI,kCAAkC,MAAM,MAAM,SAAU;AAC5D,QAAI,WAAW,UAAa,OAAO,aAAa,OAAO,UAAW,UAAS;AAAA,EAC7E;AACA,SAAO;AACT;AAEA,SAAS,eACP,QACA,OACA,SACS;AACT,MACE,OAAO,YAAY,MAAM,WACzB,OAAO,eAAe,MAAM,cAC5B,OAAO,SAAS,MAAM,MACtB;AACA,WAAO;AAAA,EACT;AACA,QAAM,YAAY;AAAA,IAChB,MAAM;AAAA,IACN,OAAO;AAAA,IACP,MAAM;AAAA,EACR,EAAE;AACF,SAAO,UAAU,SAAS,KACxB,kCAAkC,MAAM,MACtC,gCAAgC,EAAE,GAAG,OAAO,QAAQ,CAAC,KACvD,gCAAgC,EAAE,GAAG,OAAO,SAAS,UAAU,CAAC,MAC9D,gCAAgC,EAAE,GAAG,OAAO,QAAQ,CAAC;AAC3D;AAEA,SAAS,kCAAkC,QAA2C;AACpF,SAAO,gCAAgC;AAAA,IACrC,SAAS,OAAO;AAAA,IAChB,YAAY,OAAO;AAAA,IACnB,MAAM,OAAO;AAAA,IACb,SAAS,OAAO;AAAA,EAClB,CAAC;AACH;AAEA,SAAS,0BACP,SACA,UACAC,eACA;AACA,SAAOA,kBAAiB,SACpB,kBAAkB,SAAS,QAAQ,IACnC,2BAA2B,SAAS,UAAUA,aAAY;AAChE;AAEA,SAAS,iBAAiB,KAAmB;AAC3C,SAAO,OAAO,IAAI,QAAQ,EAAE,SAAS,EAAE,CAAC,IAAID,YAAW,EAAE,QAAQ,MAAM,EAAE,CAAC;AAC5E;AAxcA,IAmBM,gBAGO,uBAWP,eAKA,uCASA,0BAiBO,iCAkBA,gCAkBA;AApGb;AAAA;AAAA;AAKA;AAUA;AAEA;AAEA,IAAM,iBAAiB,KAAK,KAAK,KAAK,KAAK;AAGpC,IAAM,wBAAwB,EAAE,OAAO;AAAA,MAC5C,SAAS,EAAE,OAAO,EAAE,IAAI,CAAC;AAAA,MACzB,OAAO,EAAE,OAAO,EAAE,IAAI,CAAC,EAAE,SAAS;AAAA,MAClC,MAAM,EAAE,OAAO;AAAA,MACf,SAAS,EAAE,MAAM,EAAE,OAAO,EAAE,IAAI,CAAC,CAAC,EAAE,IAAI,CAAC;AAAA,MACzC,SAAS,EAAE,MAAM,EAAE,OAAO,EAAE,QAAQ,CAAC,CAAC,EAAE,SAAS;AAAA,MACjD,YAAY,EAAE,QAAQ,EAAE,SAAS;AAAA,MACjC,QAAQ,EAAE,OAAO,EAAE,IAAI,CAAC,EAAE,SAAS;AAAA,MACnC,aAAa,EAAE,OAAO,EAAE,SAAS;AAAA,IACnC,CAAC,EAAE,OAAO;AAEV,IAAM,gBAAgB,EAAE,OAAO;AAAA,MAC7B,MAAM,EAAE,MAAM,EAAE,OAAO,CAAC,EAAE,IAAI,CAAC;AAAA,MAC/B,KAAK,EAAE,OAAO,EAAE,IAAI,CAAC;AAAA,IACvB,CAAC,EAAE,OAAO;AAEV,IAAM,wCAAwC,EAAE,OAAO;AAAA,MACrD,MAAM,EAAE,QAAQ,wBAAwB;AAAA,MACxC,SAAS,EAAE,QAAQ,CAAC;AAAA,MACpB,WAAW,EAAE,OAAO;AAAA,MACpB,YAAY,EAAE,OAAO,EAAE,IAAI,CAAC;AAAA,MAC5B,WAAW,EAAE,MAAM,qBAAqB;AAAA,MACxC,iBAAiB,EAAE,MAAM,CAAC,EAAE,OAAO,GAAG,EAAE,OAAO,EAAE,OAAO,CAAC,CAAC,EAAE,SAAS;AAAA,IACvE,CAAC,EAAE,OAAO;AAEV,IAAM,2BAA+D,EAAE,KAAK,MAAM,EAAE,OAAO;AAAA,MACzF,KAAK,EAAE,OAAO,EAAE,IAAI,CAAC;AAAA,MACrB,SAAS,EAAE,OAAO,EAAE,IAAI,CAAC;AAAA,MACzB,MAAM,EAAE,OAAO;AAAA,MACf,SAAS,EAAE,MAAM,EAAE,OAAO,EAAE,IAAI,CAAC,CAAC,EAAE,IAAI,CAAC;AAAA,MACzC,aAAa,EAAE,OAAO,EAAE,IAAI,CAAC;AAAA,MAC7B,cAAc,EAAE,OAAO,EAAE,IAAI,CAAC;AAAA,MAC9B,SAAS,EAAE,OAAO,EAAE,IAAI,EAAE,SAAS;AAAA,MACnC,QAAQ,EAAE,MAAM,CAAC,EAAE,OAAO,EAAE,SAAS,EAAE,QAAQ,KAAK,CAAC,GAAG,EAAE,KAAK,CAAC,CAAC;AAAA,MACjE,kBAAkB,EAAE,OAAO,EAAE,eAAe,EAAE,OAAO,EAAE,IAAI,CAAC,EAAE,CAAC,EAAE,OAAO;AAAA,MACxE,MAAM,EAAE,OAAO,EAAE,IAAI,CAAC,EAAE,SAAS;AAAA,MACjC,sBAAsB,EAAE,QAAQ,EAAE,SAAS;AAAA,MAC3C,kBAAkB,yBAAyB,SAAS;AAAA,MACpD,WAAW,EAAE,MAAM,qBAAqB,EAAE,SAAS;AAAA,IACrD,CAAC,EAAE,YAAY,CAAC;AAGT,IAAM,kCAAkC,EAAE,OAAO;AAAA,MACtD,MAAM,EAAE,QAAQ,wBAAwB;AAAA,MACxC,SAAS,EAAE,QAAQ,CAAC;AAAA,MACpB,WAAW,EAAE,OAAO,EAAE,IAAI,CAAC;AAAA,MAC3B,WAAW,EAAE,OAAO,EAAE,SAAS,EAAE,QAAQ,KAAK,CAAC;AAAA,MAC/C,SAAS,EAAE,OAAO,EAAE,IAAI,CAAC;AAAA,MACzB,SAAS,EAAE,KAAK,CAAC,iBAAiB,oBAAoB,mBAAmB,iBAAiB,CAAC;AAAA,MAC3F,cAAc,EAAE,KAAK,CAAC,SAAS,OAAO,CAAC;AAAA,MACvC,MAAM,EAAE,OAAO,EAAE,IAAI,CAAC;AAAA,MACtB,YAAY,EAAE,OAAO,EAAE,IAAI,CAAC;AAAA,MAC5B,UAAU,EAAE,OAAO,EAAE,IAAI,CAAC,EAAE,SAAS;AAAA,MACrC,SAAS,EAAE,OAAO,EAAE,IAAI,CAAC,EAAE,SAAS;AAAA,MACpC,iBAAiB,EAAE,MAAM,CAAC,EAAE,OAAO,EAAE,IAAI,CAAC,GAAG,EAAE,OAAO,EAAE,OAAO,CAAC,CAAC,EAAE,SAAS;AAAA,MAC5E,WAAW,EAAE,MAAM,qBAAqB;AAAA,MACxC,SAAS,cAAc,SAAS;AAAA,IAClC,CAAC,EAAE,OAAO;AAGH,IAAM,iCAAiC,EAAE,OAAO;AAAA,MACrD,MAAM,EAAE,QAAQ,2BAA2B;AAAA,MAC3C,SAAS,EAAE,QAAQ,CAAC;AAAA,MACpB,WAAW,EAAE,OAAO,EAAE,IAAI,CAAC;AAAA,MAC3B,eAAe,EAAE,OAAO,EAAE,IAAI,CAAC,EAAE,SAAS;AAAA,MAC1C,YAAY;AAAA;AAAA;AAAA,MAGZ,aAAa,EAAE,MAAM,qBAAqB,EAAE,SAAS;AAAA,MACrD,QAAQ,EAAE,OAAO,EAAE,SAAS,EAAE,QAAQ,KAAK,CAAC,EAAE,SAAS;AAAA,MACvD,UAAU,EAAE,QAAQ,EAAE,SAAS;AAAA,IACjC,CAAC,EAAE,OAAO;AAOH,IAAM,iCAAiC,gCAC3C,KAAK,EAAE,WAAW,MAAM,WAAW,KAAK,CAAC,EACzC,OAAO;AAAA;AAAA;;;ACpGV,YAAY,aAAa;AAuBlB,SAAS,yBACd,OACiB;AACjB,QAAM,YAAY,uBAAuB,KAAK;AAC9C,SAAO;AAAA,IACL,MAAM,UAAU;AAAA,IAChB,GAAI,UAAU,UAAU,SAAY,CAAC,IAAI,EAAE,OAAO,UAAU,MAAM;AAAA;AAAA;AAAA;AAAA,IAIlE,GAAI,MAAM,UAAU,SAAY,CAAC,IAAI,EAAE,OAAO,UAAU,MAAM;AAAA,EAChE;AACF;AAGO,SAAS,uBACd,OACiB;AACjB,QAAM,OAAO,MAAM,KAAK,KAAK;AAC7B,MAAI,CAACE,gBAAe,KAAK,IAAI,GAAG;AAC9B,UAAM,mBAAmB;AAAA,EAC3B;AAEA,QAAM,QAAQ,wBAAwB,MAAM,KAAK;AACjD,QAAM,QAAQ,sBAAsB,MAAM,KAAK;AAC/C,QAAM,WAAW,UAAU,SACvB,WAAW,IAAI,KACf,kBAAkB,KAAK,IAAI,IAAI;AAEnC,SAAO;AAAA,IACL;AAAA,IACA,GAAI,UAAU,SAAY,CAAC,IAAI,EAAE,MAAM;AAAA,IACvC;AAAA,IACA;AAAA,IACA,gBAAgB,SAAS,QAAQ;AAAA,EACnC;AACF;AAOO,SAAS,mCACd,OACA,MACA,YACiB;AACjB,QAAM,YAAY,uBAAuB,KAAK;AAC9C,MAAI,MAAM,UAAU,UAAa,eAAe,OAAW,QAAO;AAClE,SAAO;AAAA,IACL,GAAG;AAAA,IACH,OAAO,sBAAsB,UAAU,OAAO,MAAM,UAAU;AAAA,EAChE;AACF;AAGO,SAAS,uBACd,MACA,YAC2B;AAC3B,SAAO,CAAC,UAAU,sBAAsB,OAAO,MAAM,UAAU;AACjE;AAEA,SAAS,sBAAsB,OAAe,MAAe,YAA6B;AACxF,MAAI,MAAM,WAAW,YAAY,EAAG,QAAO,qBAAqB,KAAK;AAErE,QAAM,eAAe,eAAe,SAAY,SAAY,kBAAkB,YAAY,KAAK;AAC/F,MAAI,iBAAiB,OAAW,QAAO,qBAAqB,YAAY;AAExE,QAAM,YAAY;AAMlB,MAAI;AACF,UAAM,WAAW,UAAU,oBAAoB,KAAK;AACpD,QAAI,OAAO,aAAa,YAAY,SAAS,SAAS,GAAG;AACvD,aAAO,qBAAqB,QAAQ;AAAA,IACtC;AAAA,EACF,QAAQ;AAAA,EAER;AAKA,MAAI,OAAO,UAAU,YAAY,UAAU;AACzC,UAAM,WAAW,kBAAkB,UAAU,SAAS,KAAK;AAC3D,QAAI,aAAa,OAAW,QAAO,qBAAqB,QAAQ;AAAA,EAClE;AAEA,QAAM,MAAM,OAAO,UAAU,QAAQ,WAAW,UAAU,MAAM;AAChE,QAAM,MAAM,QAAQ,SAAY,OAAe,oBAAY,GAAG;AAC9D,MAAI,QAAQ,MAAM;AAChB,UAAM,mBAAmB;AAAA,EAC3B;AACA,SAAe,uBAAe,IAAI,SAAS,IAAI,SAAS,KAAK;AAC/D;AAEA,SAAS,kBAAkB,YAAoB,MAAkC;AAC/E,QAAM,SAAiB,sBAAc,UAAU;AAC/C,MAAI,WAAW,KAAM,QAAO;AAC5B,MAAI;AACF,UAAM,MAAc,oBAAY,OAAO,KAAK;AAC5C,WAAO,QAAQ,OAAO,SAAoB,uBAAe,IAAI,SAAS,IAAI,SAAS,IAAI;AAAA,EACzF,QAAQ;AACN,WAAO;AAAA,EACT;AACF;AAEA,SAAS,qBAAqB,OAAuB;AACnD,QAAM,QAAQ,MAAM,MAAM,GAAG;AAC7B,QAAM,OAAO,MAAM,GAAG,EAAE;AACxB,MAAI,MAAM,SAAS,KAAK,SAAS,UAAa,SAAS,IAAI;AACzD,UAAM,mBAAmB;AAAA,EAC3B;AAIA,QAAM,MAAM,MAAM;AAAA,IAChB;AAAA,EACF;AACA,MAAI,QAAQ,MAAM;AAChB,WAAO,wBAAwB,IAAI,CAAC,CAAC,IAAY,4BAAoB,IAAI,CAAC,CAAE,EAAE,YAAY,CAAC,IAAI,IAAI,CAAC,CAAC;AAAA,EACvG;AACA,SAAO;AACT;AAMO,SAAS,oBAAoB,WAAoC;AACtE,QAAM,aAAa;AAAA,IACjB,CAAC,UAAU,UAAU,IAAI;AAAA,IACzB,GAAI,UAAU,UAAU,SAAY,CAAC,IAAI,CAAC,CAAC,SAAS,UAAU,KAAK,CAAU;AAAA,IAC7E,CAAC,SAAS,UAAU,KAAK;AAAA,EAC3B;AACA,QAAM,QAAQ,WACX,IAAI,CAAC,CAAC,KAAK,KAAK,MAAM,GAAG,mBAAmB,GAAG,CAAC,IAAI,mBAAmB,KAAK,CAAC,EAAE,EAC/E,KAAK,GAAG;AACX,SAAO,GAAG,uBAAuB,QAAQ,KAAK;AAChD;AAEA,SAAS,wBAAwB,OAA+C;AAC9E,MAAI,UAAU,UAAa,UAAU,GAAI,QAAO;AAEhD,QAAM,UAAU,MAAM,KAAK;AAC3B,MAAI,YAAY,GAAI,OAAM,mBAAmB;AAE7C,QAAM,YAAY,QACf,YAAY,EACZ,QAAQ,eAAe,GAAG,EAC1B,QAAQ,OAAO,GAAG,EAClB,QAAQ,UAAU,EAAE;AACvB,MAAI,cAAc,MAAM,uBAAuB,IAAI,SAAS,GAAG;AAC7D,UAAM,mBAAmB;AAAA,EAC3B;AACA,SAAO;AACT;AAEA,SAAS,sBAAsB,OAAmC;AAChE,MAAI,UAAU,UAAa,UAAU,GAAI,QAAO;AAEhD,MAAI,MAAM,WAAW,YAAY,GAAG;AAClC,UAAM,QAAQ,MAAM,MAAM,GAAG;AAC7B,QAAI,MAAM,SAAS,KAAK,MAAM,GAAG,EAAE,MAAM,UAAa,MAAM,GAAG,EAAE,MAAM,IAAI;AACzE,YAAM,mBAAmB;AAAA,IAC3B;AACA,WAAO,aAAa,MAAM,MAAM,GAAG,EAAE,EAAE,KAAK,GAAG,CAAC,IAAI,MAAM,GAAG,EAAE,CAAC;AAAA,EAClE;AAEA,MAAI,CAAC,mBAAmB,KAAK,KAAK,EAAG,OAAM,mBAAmB;AAC9D,SAAO;AACT;AAEA,SAAS,qBAA+C;AACtD,SAAO,IAAI;AAAA,IACT,eAAe,iBAAiB,kCAAkC;AAAA,EACpE;AACF;AA/MA,IAMM,uBACA,yBACAA,iBACA;AATN;AAAA;AAAA;AAIA;AAEA,IAAM,wBAAwB;AAC9B,IAAM,0BAA0B;AAChC,IAAMA,kBAAiB;AACvB,IAAM,yBAAyB,oBAAI,IAAI,CAAC,WAAW,QAAQ,CAAC;AAAA;AAAA;;;ACT5D,YAAYC,cAAa;AAMzB,SAAS,KAAAC,UAAS;AAgMlB,eAAe,sBACb,SACA,OACuD;AACvD,QAAM,aAAa,QAAQ,QAAQ;AACnC,MAAI,eAAe,OAAW,QAAO,eAAe;AAEpD,MAAI,eAAe,OAAO;AACxB,QAAI;AACF,YAAM,UAAU,MAAM,sBAAsB,QAAQ,QAAQ,SAAS,MAAM,WAAW;AAAA,QACpF;AAAA,QACA,MAAM,QAAQ,QAAQ;AAAA,QACtB,SAAS,QAAQ,QAAQ;AAAA,QACzB,cAAc,QAAQ,QAAQ,gBAAgB;AAAA,QAC9C,GAAI,QAAQ,QAAQ,aAAa,SAAY,CAAC,IAAI,EAAE,UAAU,QAAQ,QAAQ,SAAS;AAAA,QACvF,GAAI,QAAQ,QAAQ,UAAU,SAAY,CAAC,IAAI,EAAE,SAAS,QAAQ,QAAQ,MAAM;AAAA,MAClF,CAAC;AACD,UAAI,YAAY,MAAM;AACpB,eAAO,aAAa,oEAAoE;AAAA,MAC1F;AACA,UAAI,QAAQ,YAAY,QAAQ,QAAQ,SAAS;AAC/C,eAAO,aAAa,oEAAoE;AAAA,MAC1F;AACA,YAAM,WAAW,kBAAkB,QAAQ,SAAS;AACpD,UAAI,aAAa,QAAW;AAC1B,eAAO;AAAA,UACL;AAAA,UACA;AAAA,QACF;AAAA,MACF;AACA,YAAM,aAAa;AAAA,QACjB,QAAQ,QAAQ;AAAA,QAChB;AAAA,MACF;AACA,UAAI,WAAW,WAAW;AACxB,eAAO,EAAE,QAAQ,MAAM,QAAQ,EAAE,SAAS,CAAC,EAAE,EAAE;AAAA,MACjD;AACA,YAAM,WAAW,MAAM,+BAA+B;AAAA,QACpD,SAAS,QAAQ,QAAQ;AAAA,QACzB,SAAS,QAAQ,QAAQ;AAAA,QACzB,cAAc,QAAQ,QAAQ,gBAAgB;AAAA,QAC9C,MAAM,QAAQ,QAAQ;AAAA,QACtB;AAAA,QACA,GAAI,QAAQ,QAAQ,aAAa,SAAY,CAAC,IAAI,EAAE,UAAU,QAAQ,QAAQ,SAAS;AAAA,QACvF,GAAI,QAAQ,QAAQ,UAAU,SAAY,CAAC,IAAI,EAAE,SAAS,QAAQ,QAAQ,MAAM;AAAA,QAChF,SAAS,WAAW;AAAA,QACpB,SAAS,QAAQ,QAAQ;AAAA,MAC3B,CAAC;AACD,UAAI,SAAS,WAAW,YAAa,QAAO,EAAE,QAAQ,MAAM,QAAQ,EAAE,SAAS,CAAC,EAAE,EAAE;AACpF,aAAO,EAAE,QAAQ,MAAM,QAAQ,EAAE,SAAS,WAAW,SAAS,SAAS,SAAS,QAAQ,EAAE;AAAA,IAC5F,QAAQ;AACN,aAAO,gBAAgB;AAAA,IACzB;AAAA,EACF;AAEA,QAAM,SAAS,gBAAgB,MAAM,aAAa,MAAM,gBAAgB;AACxE,MAAI,OAAO,WAAW,uBAAuB;AAC3C,WAAO,iBAAiB,uBAAuB,4CAA4C;AAAA,EAC7F;AACA,MAAI,OAAO,WAAW,iCAAiC;AACrD,WAAO;AAAA,MACL;AAAA,MACA;AAAA,IACF;AAAA,EACF;AACA,MAAI,OAAO,WAAW,OAAO,0BAA0B;AACrD,WAAO,aAAa,4CAA4C;AAAA,EAClE;AACA,MAAI,CAAC,OAAO,WAAW,SAAS,SAAS,QAAQ,QAAQ,OAAO,GAAG;AACjE,WAAO;AAAA,MACL;AAAA,MACA;AAAA,IACF;AAAA,EACF;AAEA,QAAM,SAAS,OAAO,WAAW,MAAM,UAAU,MAAM,KAAK;AAC5D,MAAI,CAAC,OAAO,QAAS,QAAO,aAAa,iCAAiC;AAE1E,MAAI;AACF,UAAM,UAAU,MAAM,OAAO,WAAW,UAAU,SAAS,OAAO,IAAI;AACtE,UAAM,WAAW,kBAAkB,OAAO;AAC1C,QAAI,aAAa,QAAW;AAC1B,aAAO;AAAA,QACL;AAAA,QACA;AAAA,MACF;AAAA,IACF;AACA,UAAM,aAAa;AAAA,MACjB,QAAQ,QAAQ;AAAA,MAChB;AAAA,IACF;AACA,QAAI,WAAW,WAAW;AAGxB,aAAO,EAAE,QAAQ,MAAM,QAAQ,EAAE,SAAS,CAAC,EAAE,EAAE;AAAA,IACjD;AACA,UAAM,UAAU,MAAM,+BAA+B;AAAA,MACnD,SAAS,QAAQ,QAAQ;AAAA,MACzB,SAAS,QAAQ,QAAQ;AAAA,MACzB,cAAc,QAAQ,QAAQ,gBAAgB;AAAA,MAC9C,MAAM,QAAQ,QAAQ;AAAA,MACtB;AAAA,MACA,GAAI,QAAQ,QAAQ,aAAa,SAAY,CAAC,IAAI,EAAE,UAAU,QAAQ,QAAQ,SAAS;AAAA,MACvF,GAAI,QAAQ,QAAQ,UAAU,SAAY,CAAC,IAAI,EAAE,SAAS,QAAQ,QAAQ,MAAM;AAAA,MAChF,SAAS,WAAW;AAAA,MACpB,SAAS,QAAQ,QAAQ;AAAA,IAC3B,CAAC;AACD,QAAI,QAAQ,WAAW,YAAa,QAAO,EAAE,QAAQ,MAAM,QAAQ,EAAE,SAAS,CAAC,EAAE,EAAE;AACnF,WAAO;AAAA,MACL,QAAQ;AAAA,MACR,QAAQ,EAAE,SAAS,WAAW,SAAS,SAAS,QAAQ,QAAQ;AAAA,IAClE;AAAA,EACF,QAAQ;AACN,WAAO,gBAAgB;AAAA,EACzB;AACF;AAEA,eAAe,6BACb,SACA,OACsD;AACtD,MAAI;AACF,UAAM,gBAAgB,MAAM;AAC5B,QAAI,OAAO,cAAc,gBAAgB,SAAU,QAAO,kBAAkB;AAC5E,QAAI,QAAQ,QAAQ,eAAe,UAAa,CAAC;AAAA,MAC/C,cAAc;AAAA,MACd,QAAQ,QAAQ;AAAA,IAClB,GAAG;AACD,aAAO,iBAAiB,QAAQ,QAAQ,YAAY,cAAc,WAAW;AAAA,IAC/E;AACA,UAAM,UAAU,MAAM,YAAY,SAAS,MAAM,SAAS;AAC1D,QAAI,CAAC,QAAQ,GAAI,QAAO,QAAQ;AAChC,UAAM,EAAE,SAAS,YAAY,KAAK,IAAI;AACtC,UAAM,eAAe,cAAc;AACnC,QAAI,iBAAiB,UAAa,OAAO,iBAAiB,UAAU;AAClE,aAAO,kBAAkB;AAAA,IAC3B;AACA,QAAI,OAAO,iBAAiB,YAAY,cAAc,YAAY,MAAM,cAAc,IAAI,GAAG;AAC3F,aAAO,aAAa,MAAM,YAAY;AAAA,IACxC;AACA,UAAM,SAAS,gBAAgB,cAAc,MAAM;AACnD,QAAI,WAAW,OAAW,QAAO,kBAAkB;AACnD,QAAI,OAAO,QAAQ,KAAK,KAAK,IAAI,EAAG,QAAO,kBAAkB;AAC7D,QAAI,MAAM,kBAAkB,UAAa,MAAM,kBAAkB,cAAc,KAAK;AAClF,aAAO,kBAAkB;AAAA,IAC3B;AACA,QAAI,OAAO,cAAc,gBAAgB,YAAY,CAAC,cAAc,cAAc,aAAa,UAAU,GAAG;AAC1G,aAAO,iBAAiB,YAAY,OAAO,cAAc,eAAe,SAAS,CAAC;AAAA,IACpF;AAEA,UAAM,aAAa;AAAA,MACjB,GAAG;AAAA,MACH;AAAA,MACA,MAAM,gBAAgB;AAAA,IACxB;AACA,QAAI;AACJ,QAAI;AACF,kBAAY,MAAc;AAAA,QACxB,QAAQ,QAAQ;AAAA,QAChB;AAAA,QACA,EAAE,KAAK;AAAA,MACT;AAAA,IACF,QAAQ;AACN,aAAO;AAAA,QACL;AAAA,QACA;AAAA,MACF;AAAA,IACF;AAEA,UAAM,uBAAuB,yBAAyB,UAAU,oBAAoB;AACpF,UAAMC,gBAAe;AAAA,MACnB,QAAQ,QAAQ;AAAA,MAChB,QAAQ,QAAQ;AAAA,IAClB;AACA,QAAI,CAAC,wBAAwB,QAAQ,WAAW,sBAAsBA,aAAY,GAAG;AACnF,aAAO;AAAA,QACL;AAAA,QACA;AAAA,MACF;AAAA,IACF;AAEA,QAAI;AACF,aAAO,MAAM;AAAA,QACX,QAAQ,QAAQ;AAAA,QAChB;AAAA,QACA,OAAO,YAAY;AACjB,gBAAM,QAAQ,MAAM,YAAY,SAAS,MAAM,SAAS;AACxD,cAAI,CAAC,MAAM,GAAI,QAAO,EAAE,SAAS,QAAQ,MAAM,OAAO;AACtD,cAAI,MAAM,eAAe,cAAc,cAAc,MAAM,IAAI,MAAM,cAAc,IAAI,GAAG;AACxF,mBAAO;AAAA,cACL;AAAA,cACA,QAAQ,iBAAiB,MAAM,YAAY,UAAU;AAAA,YACvD;AAAA,UACF;AACA,cAAI,MAAM,QAAQ,YAAY,QAAQ,QAAQ,WAC5C,CAAC,cAAc,MAAM,QAAQ,YAAY,UAAU,KACnD,cAAc,MAAM,QAAQ,IAAI,MAAM,cAAc,IAAI,KACxD,KAAK,UAAU,kCAAkC,MAAM,QAAQ,WAAWA,aAAY,CAAC,MACrF,KAAK,UAAU,kCAAkC,QAAQ,WAAWA,aAAY,CAAC,GAAG;AACtF,mBAAO;AAAA,cACL;AAAA,cACA,QAAQ;AAAA,gBACN;AAAA,gBACA;AAAA,cACF;AAAA,YACF;AAAA,UACF;AAGA,gBAAM,SAAS;AAAA,YACb,YAAY,UAAU;AAAA,YACtB,aAAa,UAAU;AAAA,YACvB,kBAAkB;AAAA,cAChB,WAAW,QAAQ;AAAA,cACnB,WAAW,QAAQ;AAAA,YACrB;AAAA,UACF;AAIA,gBAAM,WAAW,QAAQ,UAAU,CAAC,UAAU,cAAc,KAAK,MAAM,UAAU,GAAG;AACpF,gBAAM,iBAAiB,aAAa;AACpC,gBAAM,SAAS,QAAQ,OAAO,CAAC,UAAU,cAAc,KAAK,MAAM,UAAU,GAAG;AAC/E,iBAAO;AAAA,YACL,SAAS,iBACL,CAAC,GAAG,OAAO,MAAM,GAAG,QAAQ,GAAG,QAAQ,GAAG,OAAO,MAAM,QAAQ,CAAC,IAChE,CAAC,GAAG,SAAS,MAAM;AAAA,YACvB,QAAQ;AAAA,cACN,QAAQ;AAAA,cACR,QAAQ;AAAA,gBACN,KAAK,UAAU;AAAA,gBACf;AAAA,gBACA,QAAQ,UAAU,OAAO,YAAY;AAAA,gBACrC,UAAU,UAAU;AAAA,gBACpB,MAAM,UAAU;AAAA,gBAChB,WAAW;AAAA,gBACX;AAAA,cACF;AAAA,YACF;AAAA,UACF;AAAA,QACF;AAAA,MACF;AAAA,IACF,QAAQ;AACN,aAAO,sBAAsB;AAAA,IAC/B;AAAA,EACF,QAAQ;AACN,WAAO,sBAAsB;AAAA,EAC/B;AACF;AAEA,eAAe,YACb,SACA,WAIA;AACA,QAAM,aAAa,MAAM,kBAAkB,QAAQ,QAAQ,OAAO;AAClE,MAAI,eAAe,OAAW,QAAO,EAAE,IAAI,OAAO,QAAQ,eAAe,EAAE;AAC3E,MAAI,QAAQ,QAAQ,eAAe,UAAa,CAAC,cAAc,QAAQ,QAAQ,YAAY,UAAU,GAAG;AACtG,WAAO,EAAE,IAAI,OAAO,QAAQ,iBAAiB,YAAY,QAAQ,QAAQ,cAAc,SAAS,EAAE;AAAA,EACpG;AACA,QAAM,UAAU,MAAM,YAAqC,QAAQ,QAAQ,OAAO;AAClF,QAAM,OAAO,OAAO,SAAS,SAAS,WAAW,QAAQ,OAAO,QAAQ,QAAQ;AAChF,MAAI,cAAc,IAAI,MAAM,cAAc,QAAQ,QAAQ,IAAI,GAAG;AAC/D,WAAO,EAAE,IAAI,OAAO,QAAQ,aAAa,QAAQ,QAAQ,MAAM,IAAI,EAAE;AAAA,EACvE;AACA,MAAI;AACJ,MAAI;AACF,eAAW,MAAM,uBAAuB,QAAQ,QAAQ,SAAS;AAAA,MAC/D,SAAS,QAAQ,QAAQ;AAAA,MACzB,MAAM,QAAQ,QAAQ;AAAA,MACtB;AAAA,MACA,SAAS,QAAQ,QAAQ;AAAA,MACzB,cAAc,QAAQ,QAAQ,gBAAgB;AAAA,MAC9C,GAAI,QAAQ,QAAQ,aAAa,SAAY,CAAC,IAAI,EAAE,UAAU,QAAQ,QAAQ,SAAS;AAAA,MACvF,GAAI,QAAQ,QAAQ,UAAU,SAAY,CAAC,IAAI,EAAE,SAAS,QAAQ,QAAQ,MAAM;AAAA,IAClF,CAAC;AAAA,EACH,QAAQ;AACN,WAAO;AAAA,MACL,IAAI;AAAA,MACJ,QAAQ;AAAA,QACN;AAAA,QACA;AAAA,MACF;AAAA,IACF;AAAA,EACF;AACA,QAAM,UAAU,SAAS,KAAK,CAAC,cAAc,UAAU,cAAc,SAAS;AAC9E,MAAI,YAAY,UAAa,QAAQ,YAAY,QAAQ,QAAQ,SAAS;AACxE,WAAO;AAAA,MACL,IAAI;AAAA,MACJ,QAAQ;AAAA,QACN;AAAA,QACA;AAAA,MACF;AAAA,IACF;AAAA,EACF;AACA,MAAI,cAAc,QAAQ,IAAI,MAAM,cAAc,IAAI,GAAG;AACvD,WAAO,EAAE,IAAI,OAAO,QAAQ,aAAa,MAAM,QAAQ,IAAI,EAAE;AAAA,EAC/D;AACA,MAAI,CAAC,cAAc,QAAQ,YAAY,UAAU,GAAG;AAClD,WAAO,EAAE,IAAI,OAAO,QAAQ,iBAAiB,YAAY,QAAQ,UAAU,EAAE;AAAA,EAC/E;AACA,SAAO,EAAE,IAAI,MAAM,SAAS,YAAY,KAAK;AAC/C;AAEA,SAAS,kBAAkB,OAA+C;AACxE,SAAO,0BAA0B,KAAK;AACxC;AAEA,SAAS,gBAAgB,OAAkC;AACzD,QAAM,SAAS,iBAAiB,OAAO,QAAQ,OAAO,UAAU,WAAW,IAAI,KAAK,KAAK,IAAI;AAC7F,SAAO,WAAW,UAAa,CAAC,OAAO,MAAM,OAAO,QAAQ,CAAC,IAAI,SAAS;AAC5E;AAEA,SAAS,cAAc,MAAsB;AAC3C,SAAO,KAAK,QAAQ,QAAQ,EAAE;AAChC;AAEA,SAAS,cAAc,MAAc,OAAwB;AAC3D,SAAO,KAAK,MAAM,KAAK,CAAC,EAAE,CAAC,MAAM,MAAM,MAAM,KAAK,CAAC,EAAE,CAAC;AACxD;AAEA,SAAS,cAAc,OAAoD;AACzE,QAAM,aAAa,MAAM;AACzB,MAAI,eAAe,QAAQ,OAAO,eAAe,SAAU,QAAO;AAClE,QAAM,MAAO,WAAiC;AAC9C,SAAO,OAAO,QAAQ,WAAW,MAAM;AACzC;AAEA,eAAe,kBAAkB,SAA8C;AAC7E,QAAM,UAAU,MAAM,YAAqC,OAAO;AAClE,MAAI,YAAY,QAAQ,OAAO,QAAQ,uBAAuB,SAAU,QAAO;AAC/E,SAAO,QAAQ,mBAAmB,MAAM,KAAK,CAAC,EAAE,CAAC,KAAK;AACxD;AAEA,SAAS,iBAAmD;AAC1D,SAAO,iBAAiB,qBAAqB,uDAAuD;AACtG;AAEA,SAAS,oBAAsD;AAC7D,SAAO,iBAAiB,+BAA+B,qCAAqC;AAC9F;AAEA,SAAS,oBAAsD;AAC7D,SAAO,iBAAiB,sBAAsB,6BAA6B;AAC7E;AAEA,SAAS,iBAAiB,oBAA4B,kBAA4D;AAChH,SAAO,iBAAiB,gCAAgC,8CAA8C;AAAA,IACpG;AAAA,IACA;AAAA,EACF,CAAC;AACH;AAEA,SAAS,aAAa,cAAsB,cAAwD;AAClG,SAAO,iBAAiB,4BAA4B,2CAA2C;AAAA,IAC7F;AAAA,IACA;AAAA,EACF,CAAC;AACH;AAEA,SAAS,aAAa,SAAmD;AACvE,SAAO,iBAAiB,iBAAiB,OAAO;AAClD;AAEA,SAAS,kBAAoD;AAC3D,SAAO,iBAAiB,kBAAkB,+CAA+C;AAC3F;AAEA,SAAS,wBAA0D;AACjE,SAAO,iBAAiB,kBAAkB,+CAA+C;AAC3F;AAEA,SAAS,iBACP,MACA,SACA,SACkC;AAClC,SAAO,EAAE,QAAQ,SAAS,OAAO,eAAe,MAAM,SAAS,EAAE,GAAI,YAAY,SAAY,CAAC,IAAI,EAAE,QAAQ,EAAG,CAAC,EAAE;AACpH;AAlkBA,IAkEM,kBACA,0BAGA,wBAYA,+BAgBA,yBAIA,wBAUA,eAKA,eAMA,+BACA,0BACA,yBAWO;AAxIb;AAAA;AAAA;AAQA;AAOA;AAmBA;AACA;AACA;AAKA;AAyBA,IAAM,mBAAiDD,GAAE,OAAO,CAAC,CAAC,EAAE,OAAO;AAC3E,IAAM,2BAA0DA,GAAE,OAAO;AAAA,MACvE,cAAcA,GAAE,MAAM,qBAAqB;AAAA,IAC7C,CAAC,EAAE,OAAO;AACV,IAAM,yBAAsDA,GAAE,MAAM;AAAA,MAClEA,GAAE,OAAO,EAAE,WAAWA,GAAE,OAAO,EAAE,IAAI,CAAC,EAAE,CAAC,EAAE,OAAO;AAAA,MAClDA,GAAE,OAAO;AAAA,QACP,aAAaA,GAAE,OAAO,EAAE,IAAI,CAAC;AAAA,QAC7B,kBAAkBA,GAAE,OAAO,EAAE,IAAI,EAAE,SAAS;AAAA,QAC5C,OAAOA,GAAE,QAAQ;AAAA,MACnB,CAAC,EAAE,OAAO,EAAE,YAAY,CAAC,OAAO,UAAU;AACxC,YAAI,CAAC,OAAO,UAAU,eAAe,KAAK,OAAO,OAAO,GAAG;AACzD,gBAAM,SAAS,EAAE,MAAMA,GAAE,aAAa,QAAQ,SAAS,+BAA+B,CAAC;AAAA,QACzF;AAAA,MACF,CAAC;AAAA,IACH,CAAC;AACD,IAAM,gCAAgCA,GAAE,OAAO;AAAA,MAC7C,MAAMA,GAAE,QAAQ,wBAAwB;AAAA,MACxC,SAASA,GAAE,QAAQ,CAAC;AAAA,MACpB,WAAWA,GAAE,OAAO,EAAE,IAAI,CAAC;AAAA,MAC3B,WAAWA,GAAE,OAAO,EAAE,SAAS,EAAE,QAAQ,KAAK,CAAC;AAAA,MAC/C,SAASA,GAAE,OAAO,EAAE,IAAI,CAAC;AAAA,MACzB,SAASA,GAAE,KAAK,CAAC,iBAAiB,oBAAoB,mBAAmB,iBAAiB,CAAC;AAAA,MAC3F,cAAcA,GAAE,KAAK,CAAC,SAAS,OAAO,CAAC;AAAA,MACvC,MAAMA,GAAE,OAAO,EAAE,IAAI,CAAC;AAAA,MACtB,YAAYA,GAAE,OAAO,EAAE,IAAI,CAAC;AAAA,MAC5B,UAAUA,GAAE,OAAO,EAAE,IAAI,CAAC,EAAE,SAAS;AAAA,MACrC,SAASA,GAAE,OAAO,EAAE,IAAI,CAAC,EAAE,SAAS;AAAA,MACpC,iBAAiBA,GAAE,MAAM,CAACA,GAAE,OAAO,GAAGA,GAAE,OAAO,CAAC,CAAC,EAAE,SAAS;AAAA,MAC5D,WAAWA,GAAE,MAAM,qBAAqB,EAAE,IAAI,CAAC;AAAA,MAC/C,SAASA,GAAE,OAAO,EAAE,MAAMA,GAAE,MAAMA,GAAE,OAAO,CAAC,EAAE,IAAI,CAAC,GAAG,KAAKA,GAAE,OAAO,EAAE,IAAI,CAAC,EAAE,CAAC,EAAE,OAAO,EAAE,SAAS;AAAA,IACpG,CAAC,EAAE,OAAO;AACV,IAAM,0BAAwDA,GAAE,OAAO;AAAA,MACrE,SAASA,GAAE,MAAM,qBAAqB;AAAA,MACtC,SAAS,8BAA8B,SAAS;AAAA,IAClD,CAAC,EAAE,OAAO;AACV,IAAM,yBAAsDA,GAAE,OAAO;AAAA,MACnE,KAAKA,GAAE,OAAO,EAAE,IAAI,CAAC;AAAA,MACrB,sBAAsBA,GAAE,MAAM,qBAAqB;AAAA,MACnD,QAAQA,GAAE,OAAO,EAAE,SAAS,EAAE,QAAQ,KAAK,CAAC;AAAA,MAC5C,UAAUA,GAAE,OAAO,EAAE,IAAI,CAAC;AAAA,MAC1B,MAAMA,GAAE,OAAO,EAAE,IAAI,CAAC;AAAA,MACtB,WAAWA,GAAE,QAAQ,IAAI;AAAA,MACzB,gBAAgBA,GAAE,QAAQ;AAAA,IAC5B,CAAC,EAAE,OAAO;AAEV,IAAM,gBAA6C;AAAA,MACjD;AAAA,MACA;AAAA,MACA;AAAA,IACF;AACA,IAAM,gBAAmC;AAAA,MACvC,KAAK,EAAE,QAAQ,WAAW;AAAA,MAC1B,KAAK,EAAE,QAAQ,WAAW;AAAA,MAC1B,OAAO,EAAE,QAAQ,WAAW;AAAA,MAC5B,MAAM,EAAE,QAAQ,WAAW;AAAA,IAC7B;AACA,IAAM,gCAAsD,EAAE,OAAO,CAAC,GAAG,QAAQ,CAAC,EAAE;AACpF,IAAM,2BAAiD,EAAE,OAAO,CAAC,QAAQ,GAAG,QAAQ,CAAC,EAAE;AACvF,IAAM,0BAAgD,EAAE,OAAO,CAAC,EAAE,GAAG,QAAQ,CAAC,EAAE;AAWzE,IAAM,2BAA+D;AAAA,MAC1E;AAAA,QACE,IAAI;AAAA,QACJ,SAAS;AAAA,QACT,OAAO;AAAA,QACP,aAAa;AAAA,QACb,OAAO;AAAA,QACP,QAAQ;AAAA,QACR,SAAS,CAAC,MAAM;AAAA,QAChB,SAAS;AAAA,QACT,UAAU;AAAA,QACV,UAAU;AAAA,QACV,aAAa;AAAA,QACb,WAAW,YAAY,CAAC;AAAA,QACxB,SAAS,OAAO,aAAuF;AAAA,UACrG,QAAQ;AAAA,UACR,QAAQ;AAAA,YACN,cAAc;AAAA,cACX,QAAQ,SAAS,WAAW,CAAC;AAAA,YAChC;AAAA,UACF;AAAA,QACF;AAAA,MACF;AAAA,MACA;AAAA,QACE,IAAI;AAAA,QACJ,SAAS;AAAA,QACT,OAAO;AAAA,QACP,aAAa;AAAA,QACb,OAAO;AAAA,QACP,QAAQ;AAAA,QACR,SAAS,CAAC,aAAa;AAAA,QACvB,SAAS;AAAA,QACT,UAAU;AAAA,QACV,UAAU;AAAA,QACV,aAAa;AAAA,QACb,WAAW,YAAY,CAAC;AAAA,QACxB,SAAS,CAAC,SAA2B,UAA4B;AAAA,UAC/D;AAAA,UACA;AAAA,QACF;AAAA,MACF;AAAA,MACA;AAAA,QACE,IAAI;AAAA,QACJ,SAAS;AAAA,QACT,OAAO;AAAA,QACP,aAAa;AAAA,QACb,OAAO;AAAA,QACP,QAAQ;AAAA,QACR,SAAS,CAAC,aAAa;AAAA,QACvB,SAAS;AAAA,QACT,UAAU;AAAA,QACV,UAAU;AAAA,QACV,aAAa;AAAA,QACb,uBAAuB;AAAA,QACvB,WAAW,YAAY,CAAC;AAAA,QACxB,SAAS,CAAC,SAA2B,UAAoC;AAAA,UACvE;AAAA,UACA;AAAA,QACF;AAAA,MACF;AAAA,IACF;AAAA;AAAA;;;ACnMA,SAAS,wBAAwB,6BAA6B;AAC9D,SAAS,KAAAE,UAAS;AAwalB,eAAe,wBACb,SACA,MAC2C;AAC3C,SAAO,CAAC;AAAA,IACN,SAAS;AAAA,IACT,OAAO,aAAa,SAAS,SAAS;AAAA,IACtC;AAAA,IACA,SAAS,CAAC,oBAAoB,mBAAmB;AAAA,EACnD,CAAC;AACH;AAEA,eAAe,WACb,SACA,OAC2C;AAC3C,QAAM,QAAQ,sBAAsB,SAAS,MAAM,KAAK;AACxD,SAAO,CAAC;AAAA,IACN,SAAS;AAAA,IACT;AAAA,IACA,MAAM,MAAM,UAAU;AAAA,IACtB,SAAS,CAAC,mBAAmB;AAAA,EAC/B,CAAC;AACH;AAEA,eAAe,UACb,SACA,OAC2C;AAC3C,QAAM,QAAQ,sBAAsB,SAAS,MAAM,KAAK;AACxD,SAAO,CAAC;AAAA,IACN,SAAS;AAAA,IACT;AAAA,IACA,MAAM,MAAM;AAAA,IACZ,SAAS,CAAC,kBAAkB;AAAA,EAC9B,CAAC;AACH;AAEA,eAAe,YACb,SACA,gBACA,KACA,QAC2C;AAC3C,SAAO,CAAC;AAAA,IACN,SAAS;AAAA,IACT,OAAO,sBAAsB,SAAS,cAAc;AAAA,IACpD,MAAM;AAAA,IACN,SAAS,CAAC,MAAM;AAAA,EAClB,CAAC;AACH;AAEA,eAAe,yBACb,SACA,QACyD;AACzD,MAAI;AACF,UAAM,UAAU,MAAM,oBAAoB,SAAS,SAAS;AAC5D,QAAI,CAAC,QAAQ,GAAI,QAAO,QAAQ;AAChC,UAAM,SAAS,QAAQ,QACpB,IAAI,CAAC,EAAE,KAAK,MAAM,MAAM,oBAAoB,KAAK,KAAK,CAAC,EACvD,KAAK,CAAC,MAAM,UAAU,KAAK,KAAK,cAAc,MAAM,IAAI,KAAK,KAAK,QAAQ,cAAc,MAAM,OAAO,CAAC;AACzG,UAAM,SAAS,EAAE,QAAQ,OAAO,OAAO,OAAO;AAC9C,WAAO,sBAAsB,MAAM;AAAA,EACrC,SAAS,OAAO;AACd,WAAO,gBAAgB,OAAO,qBAAqB;AAAA,EACrD;AACF;AAEA,eAAe,+BACb,SACA,QAC+D;AAC/D,MAAI;AACF,UAAM,UAAU,MAAM,oBAAoB,SAAS,eAAe;AAClE,QAAI,CAAC,QAAQ,GAAI,QAAO,QAAQ;AAChC,UAAM,eAAe,QAAQ,QAC1B,IAAI,CAAC,EAAE,KAAK,MAAM,MAAM,0BAA0B,KAAK,KAAK,CAAC,EAC7D,KAAK,CAAC,MAAM,UAAU,KAAK,MAAM,cAAc,MAAM,KAAK,CAAC;AAC9D,UAAM,SAAS,EAAE,cAAc,OAAO,aAAa,OAAO;AAC1D,WAAO,sBAAsB,MAAM;AAAA,EACrC,SAAS,OAAO;AACd,WAAO,gBAAgB,OAAO,2BAA2B;AAAA,EAC3D;AACF;AAEA,eAAe,cACb,SACA,OACkD;AAClD,MAAI;AACF,UAAM,UAAU,eAAe,OAAO;AACtC,UAAM,QAAQ,sBAAsB,SAAS,MAAM,KAAK;AACxD,UAAM,SAAS,MAAM,UAAU,SAAS,KAAK,EAAE,KAAK;AAAA,MAClD,GAAI,MAAM,WAAW,SAAY,CAAC,IAAI,EAAE,QAAQ,MAAM,OAAO;AAAA,MAC7D,OAAO,MAAM,SAAS;AAAA,IACxB,CAAC;AACD,QAAI,CAAC,OAAO,GAAI,QAAO,UAAU,OAAO,OAAO,cAAc;AAC7D,UAAM,OAAO,CAAC,GAAG,OAAO,KAAK,IAAI;AACjC,WAAO;AAAA,MACL,QAAQ;AAAA,MACR,QAAQ;AAAA,QACN;AAAA,QACA,QAAQ,MAAM,UAAU;AAAA,QACxB;AAAA,QACA,OAAO,KAAK;AAAA,QACZ,WAAW,OAAO,KAAK,aAAa;AAAA,MACtC;AAAA,IACF;AAAA,EACF,SAAS,OAAO;AACd,WAAO,gBAAgB,OAAO,cAAc;AAAA,EAC9C;AACF;AAEA,eAAe,aACb,SACA,OACiD;AACjD,MAAI;AACF,UAAM,UAAU,eAAe,OAAO;AACtC,UAAM,QAAQ,sBAAsB,SAAS,MAAM,KAAK;AACxD,UAAM,SAAS,MAAM,UAAU,SAAS,KAAK,EAAE,IAAI,MAAM,KAAK;AAAA,MAC5D,QAAQ;AAAA,MACR,kBAAkB;AAAA,IACpB,CAAC;AACD,QAAI,CAAC,OAAO,GAAI,QAAO,UAAU,OAAO,OAAO,mBAAmB;AAClE,UAAM,QAAQ,OAAO,KAAK;AAC1B,QAAI,MAAM,aAAa,oBAAoB;AACzC,aAAO,UAAU,EAAE,MAAM,wBAAwB,GAAG,mBAAmB;AAAA,IACzE;AACA,UAAM,UAAU,cAAc,OAAO,MAAM,kBAAkB,QAAQ;AACrE,QAAI,CAAC,QAAQ,GAAI,QAAO,QAAQ;AAChC,WAAO;AAAA,MACL,QAAQ;AAAA,MACR,QAAQ;AAAA,QACN;AAAA,QACA,KAAK,MAAM;AAAA,QACX,OAAO,QAAQ;AAAA,QACf,UAAU,QAAQ;AAAA,QAClB,UAAU,kBAAkB,OAAO,KAAK,OAAO;AAAA,QAC/C,YAAY,MAAM;AAAA,MACpB;AAAA,IACF;AAAA,EACF,SAAS,OAAO;AACd,WAAO,gBAAgB,OAAO,mBAAmB;AAAA,EACnD;AACF;AAEA,eAAe,cACb,SACA,OACkD;AAClD,MAAI;AACF,UAAM,UAAU,eAAe,OAAO;AACtC,UAAM,QAAQ,sBAAsB,SAAS,MAAM,KAAK;AACxD,UAAM,SAAS,MAAM,UAAU,SAAS,KAAK,EAAE,KAAK,MAAM,GAAG;AAC7D,QAAI,CAAC,OAAO,GAAI,QAAO,UAAU,OAAO,OAAO,kBAAkB;AACjE,WAAO,EAAE,QAAQ,MAAM,QAAQ,EAAE,OAAO,KAAK,MAAM,KAAK,UAAU,kBAAkB,OAAO,KAAK,OAAO,EAAE,EAAE;AAAA,EAC7G,SAAS,OAAO;AACd,WAAO,gBAAgB,OAAO,kBAAkB;AAAA,EAClD;AACF;AAEA,eAAe,aACb,SACA,OACiD;AACjD,MAAI;AACF,UAAM,UAAU,eAAe,OAAO;AACtC,UAAM,QAAQ,sBAAsB,SAAS,MAAM,KAAK;AACxD,UAAM,UAAU,mBAAmB,MAAM,OAAO;AAChD,QAAI,YAAY,UAAa,QAAQ,aAAa,oBAAoB;AACpE,aAAO,EAAE,QAAQ,SAAS,OAAO,eAAe,iBAAiB,yCAAyC,EAAE;AAAA,IAC9G;AACA,UAAM,SAAS,MAAM,UAAU,SAAS,KAAK,EAAE,IAAI,MAAM,KAAK,QAAQ,OAAO;AAAA,MAC3E,aAAa,MAAM,eAAe,QAAQ;AAAA,MAC1C,GAAI,MAAM,SAAS,WAAW,EAAE,aAAa,IAAa,IAAI,CAAC;AAAA,MAC/D,GAAI,MAAM,SAAS,YAAY,EAAE,SAAS,MAAM,KAAK,IAAI,CAAC;AAAA,IAC5D,CAAC;AACD,QAAI,CAAC,OAAO,GAAI,QAAO,UAAU,OAAO,OAAO,oBAAoB;AACnE,WAAO;AAAA,MACL,QAAQ;AAAA,MACR,QAAQ;AAAA,QACN;AAAA,QACA,KAAK,MAAM;AAAA,QACX,MAAM,MAAM;AAAA,QACZ,YAAY,QAAQ;AAAA,QACpB,UAAU,kBAAkB,OAAO,KAAK,OAAO;AAAA,MACjD;AAAA,IACF;AAAA,EACF,SAAS,OAAO;AACd,WAAO,gBAAgB,OAAO,oBAAoB;AAAA,EACpD;AACF;AAEA,eAAe,gBACb,SACA,OACoD;AACpD,MAAI;AACF,UAAM,UAAU,eAAe,OAAO;AACtC,UAAM,QAAQ,sBAAsB,SAAS,MAAM,KAAK;AACxD,UAAM,SAAS,MAAM,UAAU,SAAS,KAAK,EAAE,OAAO,MAAM,KAAK;AAAA,MAC/D,GAAI,MAAM,SAAS,SAAY,CAAC,IAAI,EAAE,SAAS,MAAM,KAAK;AAAA,IAC5D,CAAC;AACD,QAAI,CAAC,OAAO,GAAI,QAAO,UAAU,OAAO,OAAO,qBAAqB;AACpE,WAAO;AAAA,MACL,QAAQ;AAAA,MACR,QAAQ;AAAA,QACN;AAAA,QACA,KAAK,MAAM;AAAA,QACX,SAAS;AAAA,QACT,GAAI,OAAO,KAAK,QAAQ,SAAS,SAAY,CAAC,IAAI,EAAE,MAAM,OAAO,KAAK,QAAQ,KAAK;AAAA,MACrF;AAAA,IACF;AAAA,EACF,SAAS,OAAO;AACd,WAAO,gBAAgB,OAAO,qBAAqB;AAAA,EACrD;AACF;AAEA,SAAS,eAAe,SAAoD;AAC1E,MAAI,QAAQ,YAAY,QAAW;AACjC,UAAM,IAAI,UAAU,iDAAiD;AAAA,EACvE;AACA,SAAO;AACT;AAEA,SAAS,YAAY,SAA0C;AAC7D,SAAO,eAAe,OAAO,EAAE,QAAQ;AACzC;AAEA,SAAS,UAAU,SAAkC,OAAkC;AACrF,SAAO,YAAY,OAAO,EAAE,WAAW,KAAK;AAC9C;AAEA,SAAS,aAAa,SAAkC,OAAuB;AAC7E,SAAO,uBAAuB,QAAQ,QAAQ,MAAM,QAAQ,QAAQ,KAAK,EAAE,KAAK;AAClF;AAEA,SAAS,sBAAsB,SAAkC,OAAuB;AACtF,QAAM,WAAW,aAAa,SAAS,KAAK;AAC5C,QAAM,gBAAgB,SAAS,MAAM,GAAG,EAAE,GAAG,EAAE,GAAG,YAAY;AAC9D,MAAI,kBAAkB,aAAa,kBAAkB,WAAW;AAC9D,UAAM,IAAI,yBAAyB;AAAA,MACjC;AAAA,MACA;AAAA,IACF,CAAC;AAAA,EACH;AACA,SAAO;AACT;AAEA,eAAe,oBACb,SACA,QAIA;AACA,QAAM,UAAU,eAAe,OAAO;AACtC,QAAM,eAAe,aAAa,SAAS,SAAS;AACpD,QAAM,KAAK,YAAY,OAAO,EAAE,WAAW,YAAY;AACvD,QAAM,SAAS,MAAM,GAAG,KAAK,EAAE,QAAQ,OAAO,6BAA6B,CAAC;AAC5E,MAAI,CAAC,OAAO,GAAI,QAAO,EAAE,IAAI,OAAO,SAAS,UAAU,OAAO,OAAO,2BAA2B,EAAE;AAClG,MAAI,OAAO,KAAK,cAAc,MAAM;AAClC,WAAO;AAAA,MACL,IAAI;AAAA,MACJ,SAAS;AAAA,QACP,QAAQ;AAAA,QACR,OAAO;AAAA,UACL;AAAA,UACA,8CAA8C,4BAA4B;AAAA,QAC5E;AAAA,MACF;AAAA,IACF;AAAA,EACF;AAEA,QAAM,UAA4E,CAAC;AACnF,MAAI,aAAa;AACjB,aAAW,OAAO,OAAO,KAAK,MAAM;AAClC,UAAM,SAAS,MAAM,GAAG,IAAI,KAAK;AAAA,MAC/B,QAAQ;AAAA,MACR,kBAAkB;AAAA,IACpB,CAAC;AACD,QAAI,CAAC,OAAO,IAAI;AACd,aAAO,EAAE,IAAI,OAAO,SAAS,UAAU,OAAO,OAAO,2BAA2B,EAAE;AAAA,IACpF;AACA,UAAM,QAAQ,OAAO,KAAK;AAC1B,kBAAc,MAAM;AACpB,QAAI,MAAM,aAAa,sBAAsB,aAAa,4BAA4B;AACpF,aAAO;AAAA,QACL,IAAI;AAAA,QACJ,SAAS;AAAA,UACP,QAAQ;AAAA,UACR,OAAO;AAAA,YACL;AAAA,YACA,8CAA8C,0BAA0B;AAAA,UAC1E;AAAA,QACF;AAAA,MACF;AAAA,IACF;AACA,QAAI;AACF,YAAM,QAAiB,KAAK,MAAM,IAAI,YAAY,SAAS,EAAE,OAAO,KAAK,CAAC,EAAE,OAAO,KAAK,CAAC;AACzF,UAAI,CAACC,UAAS,KAAK,EAAG,OAAM,IAAI,UAAU,+CAA+C;AACzF,cAAQ,KAAK,EAAE,KAAK,MAAM,CAAC;AAAA,IAC7B,QAAQ;AACN,aAAO;AAAA,QACL,IAAI;AAAA,QACJ,SAAS;AAAA,UACP,QAAQ;AAAA,UACR,OAAO,eAAe,kBAAkB,4DAA4D;AAAA,QACtG;AAAA,MACF;AAAA,IACF;AAAA,EACF;AACA,SAAO,EAAE,IAAI,MAAM,QAAQ;AAC7B;AAEA,SAAS,oBACP,KACA,QACuC;AACvC,QAAM,SAAS,IAAI,WAAW,SAAS,IAAI,IAAI,MAAM,UAAU,MAAM,IAAI;AACzE,QAAM,aAAa,YAAY,QAAQ,YAAY,SAAS,KAAK;AACjE,QAAM,UAAU,YAAY,QAAQ,MAAM,KAAK,WAAW,MAAM,GAAG,EAAE,GAAG,EAAE,KAAK;AAC/E,QAAM,UAAU,YAAY,QAAQ,MAAM;AAC1C,QAAM,YAAY,YAAY,QAAQ,QAAQ;AAC9C,QAAM,eAAe,OAAO,cAAc,OAAO;AACjD,QAAM,YAAY,wBAAwB,OACtC,aAAa,YAAY,IACzB,OAAO,iBAAiB,YAAY,CAAC,OAAO,MAAM,IAAI,KAAK,YAAY,EAAE,QAAQ,CAAC,IAClF,IAAI,KAAK,YAAY,EAAE,YAAY,IACnC;AACJ,SAAO;AAAA,IACL,SAAS;AAAA,IACT,MAAM;AAAA,IACN,UAAU,YAAY,QAAQ,aAAa,YAAY,OAAO,KAAK;AAAA,IACnE,MAAM,YAAY,WAAW,YAAY,cAAc,UAAU;AAAA,IACjE,aAAa,MAAM,QAAQ,OAAO,WAAW,IACzC,OAAO,YAAY,OAAO,CAAC,UAA2B,OAAO,UAAU,QAAQ,IAC/E,CAAC;AAAA,IACL,QAAQ,cAAc,aAAa,aAAa;AAAA,IAChD,GAAI,YAAY,QAAQ,iBAAiB,cAAc,MAAM,SACzD,CAAC,IACD,EAAE,cAAc,YAAY,QAAQ,iBAAiB,cAAc,EAAE;AAAA,IACzE,GAAI,YAAY,QAAQ,cAAc,WAAW,MAAM,SACnD,CAAC,IACD,EAAE,WAAW,YAAY,QAAQ,cAAc,WAAW,EAAE;AAAA,IAChE,GAAI,cAAc,SAAY,CAAC,IAAI,EAAE,UAAU;AAAA,EACjD;AACF;AAEA,SAAS,0BACP,KACA,QACmD;AACnD,QAAM,YAAY,MAAM,QAAQ,OAAO,SAAS,IAC5C,OAAO,UAAU,OAAOA,SAAQ,IAChC,CAAC;AACL,QAAM,QAAQ,UAAU,CAAC;AACzB,SAAO;AAAA,IACL,OAAO,YAAY,QAAQ,UAAU,OAAO,KAC1C,YAAY,OAAO,QAAQ,MAC1B,IAAI,WAAW,eAAe,IAAI,IAAI,MAAM,gBAAgB,MAAM,IAAI;AAAA,IACzE;AAAA,IACA,GAAI,YAAY,QAAQ,cAAc,WAAW,MAAM,SACnD,CAAC,IACD,EAAE,WAAW,YAAY,QAAQ,cAAc,WAAW,EAAE;AAAA,IAChE,GAAI,YAAY,OAAO,MAAM,MAAM,SAAY,CAAC,IAAI,EAAE,MAAM,YAAY,OAAO,MAAM,EAAE;AAAA,IACvF,GAAI,YAAY,OAAO,aAAa,MAAM,SACtC,CAAC,IACD,EAAE,aAAa,YAAY,OAAO,aAAa,EAAE;AAAA,IACrD,GAAI,YAAY,QAAQ,iBAAiB,cAAc,MAAM,SACzD,CAAC,IACD,EAAE,cAAc,YAAY,QAAQ,iBAAiB,cAAc,EAAE;AAAA,EAC3E;AACF;AAEA,SAAS,YACP,WACG,MACiB;AACpB,MAAI,WAAW,OAAW,QAAO;AACjC,aAAW,OAAO,MAAM;AACtB,QAAI,OAAO,OAAO,GAAG,MAAM,SAAU,QAAO,OAAO,GAAG;AAAA,EACxD;AACA,SAAO;AACT;AAEA,SAASA,UAAS,OAAkD;AAClE,SAAO,OAAO,UAAU,YAAY,UAAU,QAAQ,CAAC,MAAM,QAAQ,KAAK;AAC5E;AAEA,SAAS,cACP,OACA,gBAG2E;AAC3E,MAAI,mBAAmB,UAAU;AAC/B,WAAO,EAAE,IAAI,MAAM,OAAO,OAAO,KAAK,KAAK,EAAE,SAAS,QAAQ,GAAG,UAAU,SAAS;AAAA,EACtF;AACA,MAAI;AACJ,MAAI;AACF,WAAO,IAAI,YAAY,SAAS,EAAE,OAAO,KAAK,CAAC,EAAE,OAAO,KAAK;AAAA,EAC/D,QAAQ;AACN,WAAO;AAAA,MACL,IAAI;AAAA,MACJ,SAAS,EAAE,QAAQ,SAAS,OAAO,eAAe,kBAAkB,kCAAkC,EAAE;AAAA,IAC1G;AAAA,EACF;AACA,MAAI,mBAAmB,OAAQ,QAAO,EAAE,IAAI,MAAM,OAAO,MAAM,UAAU,OAAO;AAChF,MAAI;AACF,UAAM,SAAS,gBAAgB,UAAU,KAAK,MAAM,IAAI,CAAC;AACzD,QAAI,CAAC,OAAO,SAAS;AACnB,aAAO;AAAA,QACL,IAAI;AAAA,QACJ,SAAS;AAAA,UACP,QAAQ;AAAA,UACR,OAAO;AAAA,YACL;AAAA,YACA;AAAA,UACF;AAAA,QACF;AAAA,MACF;AAAA,IACF;AACA,WAAO,EAAE,IAAI,MAAM,OAAO,OAAO,MAAM,UAAU,OAAO;AAAA,EAC1D,QAAQ;AACN,WAAO;AAAA,MACL,IAAI;AAAA,MACJ,SAAS,EAAE,QAAQ,SAAS,OAAO,eAAe,kBAAkB,iCAAiC,EAAE;AAAA,IACzG;AAAA,EACF;AACF;AAEA,SAAS,mBAAmB,SAEd;AACZ,MAAI;AACJ,MAAI;AACJ,MAAI,QAAQ,aAAa,QAAQ;AAC/B,YAAQ,IAAI,YAAY,EAAE,OAAO,QAAQ,KAAK;AAC9C,kBAAc;AAAA,EAChB,WAAW,QAAQ,aAAa,QAAQ;AACtC,YAAQ,IAAI,YAAY,EAAE,OAAO,KAAK,UAAU,QAAQ,KAAK,CAAC;AAC9D,kBAAc;AAAA,EAChB,OAAO;AACL,QAAI,CAAC,kBAAkB,QAAQ,KAAK,EAAG,QAAO;AAC9C,YAAQ,IAAI,WAAW,OAAO,KAAK,QAAQ,OAAO,QAAQ,CAAC;AAC3D,kBAAc;AAAA,EAChB;AACA,SAAO,EAAE,OAAO,YAAY,MAAM,YAAY,YAAY;AAC5D;AAEA,SAAS,kBAAkB,OAAwB;AACjD,MAAI,MAAM,SAAS,MAAM,KAAK,CAAC,mEAAmE,KAAK,KAAK,GAAG;AAC7G,WAAO;AAAA,EACT;AACA,SAAO,OAAO,KAAK,OAAO,QAAQ,EAAE,SAAS,QAAQ,MAAM;AAC7D;AAEA,SAAS,kBAAkB,SAKZ;AACb,SAAO;AAAA,IACL,GAAI,QAAQ,SAAS,SAAY,CAAC,IAAI,EAAE,MAAM,QAAQ,KAAK;AAAA,IAC3D,GAAI,QAAQ,gBAAgB,SAAY,CAAC,IAAI,EAAE,aAAa,QAAQ,YAAY;AAAA,IAChF,GAAI,QAAQ,iBAAiB,SAAY,CAAC,IAAI,EAAE,cAAc,QAAQ,aAAa;AAAA,IACnF,GAAI,QAAQ,kBAAkB,SAAY,CAAC,IAAI,EAAE,eAAe,QAAQ,cAAc;AAAA,EACxF;AACF;AAEA,SAAS,gBAAgB,OAAgB,QAAkD;AACzF,MAAI,iBAAiB,yBAA0B,QAAO,EAAE,QAAQ,SAAS,OAAO,MAAM,eAAe;AACrG,SAAO,qBAAqB,OAAO,MAAM,KAAK,YAAY,MAAM;AAClE;AAEO,SAAS,qBAAqB,OAAgB,QAA8D;AACjH,QAAM,UAAU,uBAAuB,KAAK;AAC5C,MAAI,YAAY,mBAAmB;AACjC,QAAI,sBAAsB,KAAK,MAAM,QAAW;AAC9C,aAAO,EAAE,QAAQ,SAAS,OAAO,eAAe,qBAAqB,2BAA2B,MAAM,GAAG,EAAE;AAAA,IAC7G;AACA,WAAO,EAAE,QAAQ,SAAS,OAAO,eAAe,iBAAiB,iCAAiC,MAAM,GAAG,EAAE;AAAA,EAC/G;AACA,MAAI,YAAY,aAAa;AAC3B,WAAO,EAAE,QAAQ,SAAS,OAAO,eAAe,qBAAqB,2BAA2B,MAAM,GAAG,EAAE;AAAA,EAC7G;AACA,SAAO;AACT;AAEA,SAAS,sBAAyB,QAAyC;AACzE,MAAI,OAAO,WAAW,KAAK,UAAU,MAAM,GAAG,MAAM,IAAI,4BAA4B;AAClF,WAAO;AAAA,MACL,QAAQ;AAAA,MACR,OAAO;AAAA,QACL;AAAA,QACA,8CAA8C,0BAA0B;AAAA,MAC1E;AAAA,IACF;AAAA,EACF;AACA,SAAO,EAAE,QAAQ,MAAM,OAAO;AAChC;AAEA,SAAS,UACP,OACA,QACkC;AAClC,QAAM,OAAO,qBAAqB,OAAO,MAAM;AAC/C,MAAI,SAAS,OAAW,QAAO;AAC/B,MAAI,MAAM,SAAS,gBAAgB;AACjC,WAAO,EAAE,QAAQ,SAAS,OAAO,eAAe,gBAAgB,qCAAqC,EAAE;AAAA,EACzG;AACA,MAAI,MAAM,SAAS,0BAA0B;AAC3C,WAAO,EAAE,QAAQ,SAAS,OAAO,eAAe,0BAA0B,oDAAoD,EAAE;AAAA,EAClI;AACA,MAAI,MAAM,SAAS,eAAe;AAChC,WAAO;AAAA,MACL,QAAQ;AAAA,MACR,OAAO;AAAA,QACL;AAAA,QACA;AAAA,QACA,EAAE,WAAW,KAAK;AAAA,MACpB;AAAA,IACF;AAAA,EACF;AACA,MAAI,MAAM,SAAS,yBAAyB;AAC1C,WAAO,EAAE,QAAQ,SAAS,OAAO,eAAe,yBAAyB,kCAAkC,kBAAkB,SAAS,EAAE;AAAA,EAC1I;AACA,QAAM,cAAc,0BAA0B,KAAK;AACnD,MAAI,YAAa,QAAO,EAAE,QAAQ,SAAS,OAAO,YAAY;AAC9D,SAAO,YAAY,MAAM;AAC3B;AAEA,SAAS,YAAY,QAAkD;AACrE,SAAO;AAAA,IACL,QAAQ;AAAA,IACR,OAAO;AAAA,MACL;AAAA,MACA,gCAAgC,MAAM;AAAA,MACtC,EAAE,WAAW,KAAK;AAAA,IACpB;AAAA,EACF;AACF;AA38BA,IAuIM,oBACA,uBACA,8BACA,4BAEAC,mBACA,aAMA,cAIA,WAIA,aACA,kBAIA,mBAIA,kBAIA,iBAQA,kBAOA,oBAWA,2BAKA,0BAQA,iCAKA,mBAKA,oBAQA,kBAKA,mBAgBA,oBAkBA,mBAMA,kBAKA,mBAOA,mBACA,oBAGA,qBAGA,sBAIA,wBAKA,sBAUA,4BAIA,kCAIA,qBAIA,oBAIA,oBACA,oBAWO;AAhVb;AAAA;AAAA;AAcA;AACA;AAwHA,IAAM,qBAAqB,OAAO;AAClC,IAAM,wBAAwB;AAC9B,IAAM,+BAA+B;AACrC,IAAM,6BAA6B,IAAI,OAAO;AAE9C,IAAMA,oBAA0CF,GAAE,OAAO,CAAC,CAAC,EAAE,OAAO;AACpE,IAAM,cAAcA,GAAE,OAAO,EAAE,IAAI,CAAC,EAAE;AAAA,MACpC,CAAC,WACE,mBAAmB,KAAK,KAAK,KAAK,MAAM,WAAW,YAAY,MAChE,CAAC,MAAM,SAAS,GAAG;AAAA,MACrB;AAAA,IACF;AACA,IAAM,eAAeA,GAAE,OAAO,EAAE;AAAA,MAC9B,CAAC,WAAW,WAAW,OAAO,CAAC,OAAO,SAAS,GAAG;AAAA,MAClD;AAAA,IACF;AACA,IAAM,YAAYA,GAAE,OAAO,EAAE,IAAI,CAAC,EAAE;AAAA,MAClC,CAAC,QAAQ,QAAQ,OAAO,CAAC,IAAI,SAAS,GAAG,KAAK,CAAC,IAAI,SAAS,GAAG;AAAA,MAC/D;AAAA,IACF;AACA,IAAM,cAAcA,GAAE,OAAO,EAAE,IAAI,EAAE,IAAI,CAAC,EAAE,IAAI,GAAI;AACpD,IAAM,mBAAmBA,GAAE,OAAO,EAAE;AAAA,MAClC;AAAA,MACA;AAAA,IACF;AACA,IAAM,oBAAoBA,GAAE,OAAO,EAAE,IAAI,CAAC,EAAE,IAAI,GAAG,EAAE;AAAA,MACnD,CAAC,UAAU,CAAC,kBAAkB,KAAK,KAAK;AAAA,MACxC;AAAA,IACF;AACA,IAAM,mBAAmBA,GAAE,OAAO,EAAE,OAAO,EAAE;AAAA,MAC3C,CAAC,UAAU,CAAC,OAAO,UAAU,KAAK,KAAK,OAAO,cAAc,KAAK;AAAA,MACjE;AAAA,IACF;AACA,IAAM,kBAAwCA,GAAE,KAAK,MAAMA,GAAE,MAAM;AAAA,MACjEA,GAAE,KAAK;AAAA,MACPA,GAAE,QAAQ;AAAA,MACV;AAAA,MACAA,GAAE,OAAO;AAAA,MACTA,GAAE,MAAM,eAAe;AAAA,MACvBA,GAAE,OAAO,eAAe;AAAA,IAC1B,CAAC,CAAC;AACF,IAAM,mBAA0CA,GAAE,OAAO;AAAA,MACvD,MAAMA,GAAE,OAAO,EAAE,SAAS;AAAA,MAC1B,aAAaA,GAAE,OAAO,EAAE,SAAS;AAAA,MACjC,cAAcA,GAAE,OAAO,EAAE,SAAS;AAAA,MAClC,eAAeA,GAAE,OAAO,EAAE,IAAI,EAAE,YAAY,EAAE,SAAS;AAAA,IACzD,CAAC,EAAE,OAAO;AAEV,IAAM,qBAAqBA,GAAE,OAAO;AAAA,MAClC,SAASA,GAAE,OAAO,EAAE,IAAI,CAAC;AAAA,MACzB,MAAMA,GAAE,OAAO,EAAE,IAAI,CAAC;AAAA,MACtB,UAAUA,GAAE,OAAO;AAAA,MACnB,MAAMA,GAAE,KAAK,CAAC,SAAS,aAAa,YAAY,CAAC;AAAA,MACjD,aAAaA,GAAE,MAAMA,GAAE,OAAO,CAAC;AAAA,MAC/B,QAAQA,GAAE,KAAK,CAAC,UAAU,UAAU,CAAC;AAAA,MACrC,cAAcA,GAAE,OAAO,EAAE,SAAS;AAAA,MAClC,WAAWA,GAAE,OAAO,EAAE,SAAS;AAAA,MAC/B,WAAWA,GAAE,OAAO,EAAE,SAAS,EAAE,QAAQ,KAAK,CAAC,EAAE,SAAS;AAAA,IAC5D,CAAC,EAAE,OAAO;AACV,IAAM,4BAA4DA,GAAE,OAAO;AAAA,MACzE,QAAQA,GAAE,MAAM,kBAAkB;AAAA,MAClC,OAAOA,GAAE,OAAO,EAAE,IAAI,EAAE,YAAY;AAAA,IACtC,CAAC,EAAE,OAAO;AAEV,IAAM,2BAA2BA,GAAE,OAAO;AAAA,MACxC,OAAOA,GAAE,OAAO,EAAE,IAAI,CAAC;AAAA,MACvB,WAAWA,GAAE,MAAMA,GAAE,OAAOA,GAAE,QAAQ,CAAC,CAAC;AAAA,MACxC,WAAWA,GAAE,OAAO,EAAE,SAAS;AAAA,MAC/B,MAAMA,GAAE,OAAO,EAAE,SAAS;AAAA,MAC1B,aAAaA,GAAE,OAAO,EAAE,SAAS;AAAA,MACjC,cAAcA,GAAE,OAAO,EAAE,SAAS;AAAA,IACpC,CAAC,EAAE,OAAO;AACV,IAAM,kCAAwEA,GAAE,OAAO;AAAA,MACrF,cAAcA,GAAE,MAAM,wBAAwB;AAAA,MAC9C,OAAOA,GAAE,OAAO,EAAE,IAAI,EAAE,YAAY;AAAA,IACtC,CAAC,EAAE,OAAO;AAEV,IAAM,oBAA4CA,GAAE,OAAO;AAAA,MACzD,OAAO;AAAA,MACP,QAAQ,aAAa,SAAS;AAAA,MAC9B,OAAO,YAAY,SAAS;AAAA,IAC9B,CAAC,EAAE,OAAO;AACV,IAAM,qBAA8CA,GAAE,OAAO;AAAA,MAC3D,OAAOA,GAAE,OAAO,EAAE,IAAI,CAAC;AAAA,MACvB,QAAQA,GAAE,OAAO;AAAA,MACjB,MAAMA,GAAE,MAAMA,GAAE,OAAO,CAAC;AAAA,MACxB,OAAOA,GAAE,OAAO,EAAE,IAAI,EAAE,YAAY;AAAA,MACpC,WAAWA,GAAE,QAAQ;AAAA,IACvB,CAAC,EAAE,OAAO;AAEV,IAAM,mBAA0CA,GAAE,OAAO;AAAA,MACvD,OAAO;AAAA,MACP,KAAK;AAAA,MACL,gBAAgBA,GAAE,KAAK,CAAC,UAAU,QAAQ,MAAM,CAAC,EAAE,SAAS;AAAA,IAC9D,CAAC,EAAE,OAAO;AACV,IAAM,oBAA4CA,GAAE,OAAO;AAAA,MACzD,OAAOA,GAAE,OAAO,EAAE,IAAI,CAAC;AAAA,MACvB,KAAKA,GAAE,OAAO,EAAE,IAAI,CAAC;AAAA,MACrB,OAAOA,GAAE,MAAM;AAAA,QACbA,GAAE,OAAO;AAAA,QACTA,GAAE,OAAO;AAAA,QACTA,GAAE,QAAQ;AAAA,QACVA,GAAE,KAAK;AAAA,QACPA,GAAE,MAAMA,GAAE,QAAQ,CAAC;AAAA,QACnBA,GAAE,OAAOA,GAAE,QAAQ,CAAC;AAAA,MACtB,CAAC;AAAA,MACD,UAAUA,GAAE,KAAK,CAAC,QAAQ,QAAQ,QAAQ,CAAC;AAAA,MAC3C,UAAU;AAAA,MACV,YAAYA,GAAE,OAAO,EAAE,IAAI,EAAE,YAAY;AAAA,IAC3C,CAAC,EAAE,OAAO;AAEV,IAAM,qBAA8CA,GAAE,mBAAmB,YAAY;AAAA,MACnFA,GAAE,OAAO,EAAE,UAAUA,GAAE,QAAQ,MAAM,GAAG,OAAOA,GAAE,OAAO,EAAE,CAAC,EAAE,OAAO;AAAA,MACpEA,GAAE,OAAO,EAAE,UAAUA,GAAE,QAAQ,MAAM,GAAG,OAAO,gBAAgB,CAAC,EAAE,OAAO;AAAA,MACzEA,GAAE,OAAO,EAAE,UAAUA,GAAE,QAAQ,QAAQ,GAAG,OAAOA,GAAE,OAAO,EAAE,CAAC,EAAE,OAAO;AAAA,IACxE,CAAC,EAAE,YAAY,CAAC,SAAS,YAAY;AACnC,YAAM,UAAU,mBAAmB,OAAO;AAC1C,UAAI,YAAY,QAAW;AACzB,gBAAQ,SAAS,EAAE,MAAMA,GAAE,aAAa,QAAQ,SAAS,oCAAoC,CAAC;AAAA,MAChG,WAAW,QAAQ,aAAa,oBAAoB;AAClD,gBAAQ,SAAS;AAAA,UACf,MAAMA,GAAE,aAAa;AAAA,UACrB,MAAM;AAAA,UACN,SAAS;AAAA,UACT,WAAW;AAAA,UACX,SAAS,8BAA8B,kBAAkB;AAAA,QAC3D,CAAC;AAAA,MACH;AAAA,IACF,CAAC;AACD,IAAM,oBAAoB;AAAA,MACxB,OAAO;AAAA,MACP,KAAK;AAAA,MACL,SAAS;AAAA,MACT,aAAa,kBAAkB,SAAS;AAAA,IAC1C;AACA,IAAM,mBAA0CA,GAAE,mBAAmB,QAAQ;AAAA,MAC3EA,GAAE,OAAO,EAAE,GAAG,mBAAmB,MAAMA,GAAE,QAAQ,QAAQ,EAAE,CAAC,EAAE,OAAO;AAAA,MACrEA,GAAE,OAAO,EAAE,GAAG,mBAAmB,MAAMA,GAAE,QAAQ,QAAQ,EAAE,CAAC,EAAE,OAAO;AAAA,MACrEA,GAAE,OAAO,EAAE,GAAG,mBAAmB,MAAMA,GAAE,QAAQ,SAAS,GAAG,MAAM,iBAAiB,CAAC,EAAE,OAAO;AAAA,IAChG,CAAC;AACD,IAAM,oBAA4CA,GAAE,OAAO;AAAA,MACzD,OAAOA,GAAE,OAAO,EAAE,IAAI,CAAC;AAAA,MACvB,KAAKA,GAAE,OAAO,EAAE,IAAI,CAAC;AAAA,MACrB,MAAMA,GAAE,KAAK,CAAC,UAAU,WAAW,QAAQ,CAAC;AAAA,MAC5C,YAAYA,GAAE,OAAO,EAAE,IAAI,EAAE,YAAY;AAAA,MACzC,UAAU;AAAA,IACZ,CAAC,EAAE,OAAO;AACV,IAAM,oBAA4CA,GAAE,OAAO,EAAE,OAAO,aAAa,KAAK,UAAU,CAAC,EAAE,OAAO;AAC1G,IAAM,qBAA8CA,GAAE,OAAO;AAAA,MAC3D,OAAOA,GAAE,OAAO,EAAE,IAAI,CAAC;AAAA,MAAG,KAAKA,GAAE,OAAO,EAAE,IAAI,CAAC;AAAA,MAAG,UAAU;AAAA,IAC9D,CAAC,EAAE,OAAO;AACV,IAAM,sBAAgDA,GAAE,OAAO;AAAA,MAC7D,OAAO;AAAA,MAAa,KAAK;AAAA,MAAW,MAAM,iBAAiB,SAAS;AAAA,IACtE,CAAC,EAAE,OAAO;AACV,IAAM,uBAAkDA,GAAE,OAAO;AAAA,MAC/D,OAAOA,GAAE,OAAO,EAAE,IAAI,CAAC;AAAA,MAAG,KAAKA,GAAE,OAAO,EAAE,IAAI,CAAC;AAAA,MAAG,SAASA,GAAE,QAAQ,IAAI;AAAA,MAAG,MAAMA,GAAE,OAAO,EAAE,SAAS;AAAA,IACxG,CAAC,EAAE,OAAO;AAEV,IAAM,yBAAsD;AAAA,MAC1D;AAAA,MACA;AAAA,MACA;AAAA,IACF;AACA,IAAM,uBAA0C;AAAA,MAC9C,KAAK;AAAA,QACH,QAAQ;AAAA,QACR,QAAQ;AAAA,MACV;AAAA,MACA,KAAK,EAAE,QAAQ,WAAW;AAAA,MAC1B,OAAO,EAAE,QAAQ,WAAW;AAAA,MAC5B,MAAM,EAAE,QAAQ,WAAW;AAAA,IAC7B;AAEA,IAAM,6BAAmD;AAAA,MACvD,OAAO,CAAC;AAAA,MACR,QAAQ,CAAC,SAAS;AAAA,IACpB;AACA,IAAM,mCAAyD;AAAA,MAC7D,OAAO,CAAC;AAAA,MACR,QAAQ,CAAC,eAAe;AAAA,IAC1B;AACA,IAAM,sBAA4C;AAAA,MAChD,OAAO,CAAC,SAAS;AAAA,MACjB,QAAQ,CAAC,OAAO;AAAA,IAClB;AACA,IAAM,qBAA2C;AAAA,MAC/C,OAAO,CAAC,MAAM;AAAA,MACd,QAAQ,CAAC,QAAQ;AAAA,IACnB;AACA,IAAM,qBAA2C,EAAE,OAAO,CAAC,QAAQ,UAAU,GAAG,QAAQ,CAAC,EAAE;AAC3F,IAAM,qBAA2C,EAAE,OAAO,CAAC,MAAM,GAAG,QAAQ,CAAC,EAAE;AAWxE,IAAM,kCAAoE;AAAA,MAC/E;AAAA,QACE,IAAI;AAAA,QACJ,SAAS;AAAA,QACT,OAAO;AAAA,QACP,aAAa;AAAA,QACb,OAAOE;AAAA,QACP,QAAQ;AAAA,QACR,SAAS,CAAC,MAAM;AAAA,QAChB,SAAS;AAAA,QACT,UAAU;AAAA,QACV,UAAU;AAAA,QACV,aAAa;AAAA,QACb,WAAW,CAAC,YAAqC,wBAAwB,SAAS,SAAS;AAAA,QAC3F,SAAS;AAAA,MACX;AAAA,MACA;AAAA,QACE,IAAI;AAAA,QACJ,SAAS;AAAA,QACT,OAAO;AAAA,QACP,aAAa;AAAA,QACb,OAAOA;AAAA,QACP,QAAQ;AAAA,QACR,SAAS,CAAC,MAAM;AAAA,QAChB,SAAS;AAAA,QACT,UAAU;AAAA,QACV,UAAU;AAAA,QACV,aAAa;AAAA,QACb,WAAW,CAAC,YAAqC,wBAAwB,SAAS,eAAe;AAAA,QACjG,SAAS;AAAA,MACX;AAAA,MACA;AAAA,QACE,IAAI;AAAA,QACJ,SAAS;AAAA,QACT,OAAO;AAAA,QACP,aAAa;AAAA,QACb,OAAO;AAAA,QACP,QAAQ;AAAA,QACR,SAAS,CAAC,MAAM;AAAA,QAChB,SAAS;AAAA,QACT,UAAU;AAAA,QACV,UAAU;AAAA,QACV,aAAa;AAAA,QACb,WAAW;AAAA,QACX,SAAS;AAAA,MACX;AAAA,MACA;AAAA,QACE,IAAI;AAAA,QACJ,SAAS;AAAA,QACT,OAAO;AAAA,QACP,aAAa;AAAA,QACb,OAAO;AAAA,QACP,QAAQ;AAAA,QACR,SAAS,CAAC,MAAM;AAAA,QAChB,SAAS;AAAA,QACT,UAAU;AAAA,QACV,UAAU;AAAA,QACV,aAAa;AAAA,QACb,WAAW;AAAA,QACX,SAAS;AAAA,MACX;AAAA,MACA;AAAA,QACE,IAAI;AAAA,QAAqB,SAAS;AAAA,QAAG,OAAO;AAAA,QAC5C,aAAa;AAAA,QACb,OAAO;AAAA,QAAmB,QAAQ;AAAA,QAAoB,SAAS,CAAC,MAAM;AAAA,QAAG,SAAS;AAAA,QAClF,UAAU;AAAA,QAAwB,UAAU;AAAA,QAAsB,aAAa;AAAA,QAC/E,WAAW,CAAC,SAAkC,UAC5C,YAAY,SAAS,MAAM,OAAO,MAAM,KAAK,uBAAuB;AAAA,QACtE,SAAS;AAAA,MACX;AAAA,MACA;AAAA,QACE,IAAI;AAAA,QAAoB,SAAS;AAAA,QAAG,OAAO;AAAA,QAC3C,aAAa;AAAA,QACb,OAAO;AAAA,QAAkB,QAAQ;AAAA,QAAmB,SAAS,CAAC,OAAO;AAAA,QAAG,SAAS;AAAA,QACjF,UAAU;AAAA,QAAwB,UAAU;AAAA,QAAsB,aAAa;AAAA,QAC/E,WAAW,CAAC,SAAkC,UAC5C,YAAY,SAAS,MAAM,OAAO,MAAM,KAAK,kBAAkB;AAAA,QACjE,SAAS;AAAA,MACX;AAAA,MACA;AAAA,QACE,IAAI;AAAA,QAAuB,SAAS;AAAA,QAAG,OAAO;AAAA,QAC9C,aAAa;AAAA,QACb,OAAO;AAAA,QAAqB,QAAQ;AAAA,QAAsB,SAAS,CAAC,aAAa;AAAA,QAAG,SAAS;AAAA,QAC7F,UAAU;AAAA,QAAwB,UAAU;AAAA,QAAsB,aAAa;AAAA,QAC/E,WAAW,CAAC,SAAkC,UAC5C,YAAY,SAAS,MAAM,OAAO,MAAM,KAAK,kBAAkB;AAAA,QACjE,SAAS;AAAA,MACX;AAAA,IACF;AAAA;AAAA;;;ACxaA,SAAS,KAAAC,UAAS;AAkFlB,eAAe,cACb,SACA,OAC2C;AAC3C,QAAM,YAAY;AAAA,IAChB;AAAA,IACA,QAAQ,QAAQ;AAAA,IAChB,QAAQ,QAAQ;AAAA,EAClB;AACA,MAAI,eAAe,UAAU;AAC7B,MAAI,MAAM,UAAU,QAAW;AAC7B,QAAI;AACF,qBAAe;AAAA,QACb,QAAQ,QAAQ;AAAA,QAChB,QAAQ,QAAQ;AAAA,MAClB,EAAE,SAAS;AAAA,IACb,QAAQ;AAAA,IAGR;AAAA,EACF;AACA,QAAM,YAAY,2BAA2B,QAAQ,QAAQ,MAAM,YAAY;AAE/E,SAAO;AAAA,IACL;AAAA,MACE,SAAS;AAAA,MACT,OAAO,UAAU;AAAA,MACjB,MAAM,UAAU;AAAA,MAChB,SAAS,CAAC,kBAAkB;AAAA,IAC9B;AAAA,IACA;AAAA,MACE,SAAS;AAAA,MACT,MAAM;AAAA,MACN,SAAS,CAAC,8BAA8B;AAAA,IAC1C;AAAA,EACF;AACF;AAEA,eAAe,iBACb,SACA,OACsD;AACtD,QAAM,YAAY;AAAA,IAChB;AAAA,IACA,QAAQ,SAAS;AAAA,IACjB,QAAQ,QAAQ;AAAA,EAClB;AACA,QAAM,OAAO,QAAQ,SAAS;AAC9B,MAAI,SAAS,UAAa,OAAO,KAAK,eAAe,YAAY;AAC/D,WAAO;AAAA,MACL,QAAQ;AAAA,MACR,OAAO;AAAA,QACL;AAAA,QACA;AAAA,QACA,EAAE,WAAW,KAAK;AAAA,MACpB;AAAA,IACF;AAAA,EACF;AAEA,MAAI;AACJ,MAAI;AACF,aAAS,MAAM,KAAK,WAAW;AAAA,MAC7B,OAAO,UAAU;AAAA,MACjB,MAAM,UAAU;AAAA,MAChB,GAAI,UAAU,UAAU,SAAY,CAAC,IAAI,EAAE,OAAO,UAAU,MAAM;AAAA,IACpE,CAAC;AAAA,EACH,QAAQ;AACN,WAAO;AAAA,MACL,QAAQ;AAAA,MACR,OAAO;AAAA,QACL;AAAA,QACA;AAAA,QACA,EAAE,WAAW,KAAK;AAAA,MACpB;AAAA,IACF;AAAA,EACF;AAEA,SAAO,mBAAmB,WAAW,MAAM;AAC7C;AAEA,SAAS,mBACP,WACA,QAC6C;AAC7C,UAAQ,OAAO,QAAQ;AAAA,IACrB,KAAK;AACH,aAAO,EAAE,QAAQ,MAAM,QAAQ,EAAE,OAAO,OAAO,MAAM,EAAE;AAAA,IACzD,KAAK;AACH,aAAO;AAAA,QACL,QAAQ;AAAA,QACR,OAAO;AAAA,UACL,MAAM;AAAA,UACN,QAAQ;AAAA,YACN,MAAM,UAAU;AAAA,YAChB,GAAI,UAAU,UAAU,SAAY,CAAC,IAAI,EAAE,OAAO,UAAU,MAAM;AAAA,YAClE,OAAO,UAAU;AAAA,UACnB;AAAA,UACA,KAAK,oBAAoB,SAAS;AAAA,UAClC,SAAS;AAAA,QACX;AAAA,QACA,qBAAqB;AAAA,MACvB;AAAA,IACF,KAAK;AACH,aAAO;AAAA,QACL,QAAQ;AAAA,QACR,SAAS,CAAC,OAAO,IAAwC;AAAA,QACzD,SAAS,EAAE,WAAW,eAAe;AAAA,QACrC,UAAU;AAAA,UACR,MAAM;AAAA,UACN,WAAW;AAAA,UACX,UAAU;AAAA,QACZ;AAAA,MACF;AAAA,IACF,KAAK;AACH,aAAO;AAAA,QACL,QAAQ;AAAA,QACR,OAAO;AAAA,UACL;AAAA,UACA;AAAA,UACA,EAAE,WAAW,KAAK;AAAA,QACpB;AAAA,MACF;AAAA,IACF,KAAK;AAAA,IACL,KAAK;AACH,aAAO;AAAA,QACL,QAAQ;AAAA,QACR,OAAO;AAAA,UACL;AAAA,UACA;AAAA,QACF;AAAA,MACF;AAAA,IACF,KAAK;AAAA,IACL,KAAK;AACH,aAAO;AAAA,QACL,QAAQ;AAAA,QACR,OAAO;AAAA,UACL;AAAA,UACA;AAAA,QACF;AAAA,MACF;AAAA,EACJ;AAEA,SAAO;AAAA,IACL,QAAQ;AAAA,IACR,OAAO,eAAe,sBAAsB,yBAAyB;AAAA,EACvE;AACF;AAEA,SAAS,2BAA2B,MAAe,OAAuB;AACxE,QAAM,YAAY;AAKlB,MAAI;AACJ,MAAI;AACF,aAAS,UAAU,iCAAiC,KAAK;AAAA,EAC3D,QAAQ;AAAA,EAER;AACA,MAAI,OAAO,WAAW,YAAY,OAAO,SAAS,EAAG,QAAO;AAE5D,MAAI;AACJ,MAAI;AACF,eAAW,UAAU,gCAAgC;AAAA,EACvD,QAAQ;AAAA,EAER;AACA,MAAI,OAAO,aAAa,YAAY,SAAS,SAAS,EAAG,QAAO;AAEhE,QAAM,IAAI;AAAA,IACR;AAAA,MACE;AAAA,MACA;AAAA,IACF;AAAA,EACF;AACF;AAlQA,IA4BM,uBAYA,wBAIA,sBAMA,sBAOA,yBAKO,+BAgBA;AA9Eb;AAAA;AAAA;AAaA;AACA;AAcA,IAAM,wBAAoDA,GAAE,OAAO;AAAA,MACjE,MAAMA,GAAE,OAAO;AAAA,MACf,OAAOA,GAAE,OAAO,EAAE,SAAS;AAAA,MAC3B,OAAOA,GAAE,OAAO,EAAE,SAAS;AAAA,IAC7B,CAAC,EAAE,OAAO,EAAE,YAAY,CAAC,OAAO,YAAY;AAC1C,UAAI;AACF,+BAAuB,KAAK;AAAA,MAC9B,QAAQ;AACN,gBAAQ,SAAS,EAAE,MAAMA,GAAE,aAAa,QAAQ,SAAS,4BAA4B,CAAC;AAAA,MACxF;AAAA,IACF,CAAC,EAAE,UAAU,wBAAwB;AAErC,IAAM,yBAAsDA,GAAE,OAAO;AAAA,MACnE,OAAOA,GAAE,OAAO;AAAA,IAClB,CAAC,EAAE,OAAO;AAEV,IAAM,uBAAoD;AAAA,MACxD;AAAA,MACA;AAAA,MACA;AAAA,IACF;AAEA,IAAM,uBAA0C;AAAA,MAC9C,KAAK,EAAE,QAAQ,WAAW;AAAA,MAC1B,KAAK,EAAE,QAAQ,WAAW;AAAA,MAC1B,OAAO,EAAE,QAAQ,WAAW;AAAA,MAC5B,MAAM,EAAE,QAAQ,WAAW;AAAA,IAC7B;AAEA,IAAM,0BAAgD;AAAA,MACpD,OAAO,CAAC;AAAA,MACR,QAAQ,CAAC,QAAQ;AAAA,IACnB;AAEO,IAAM,gCAAwF;AAAA,MACnG,IAAI;AAAA,MACJ,SAAS;AAAA,MACT,OAAO;AAAA,MACP,aAAa;AAAA,MACb,OAAO;AAAA,MACP,QAAQ;AAAA,MACR,SAAS,CAAC,QAAQ,aAAa;AAAA,MAC/B,SAAS;AAAA,MACT,UAAU;AAAA,MACV,UAAU;AAAA,MACV,aAAa;AAAA,MACb,WAAW;AAAA,MACX,SAAS;AAAA,IACX;AAEO,IAAM,iCAAkF;AAAA,MAC7F;AAAA,IACF;AAAA;AAAA;;;AC/EA,OAAO,mBAAmB;AAC1B,SAAS,KAAAC,UAAS;AA4TlB,eAAe,YACb,SACA,OAC2C;AAC3C,QAAM,QAAQ,gBAAgB,SAAS,MAAM,KAAK;AAClD,SAAO,CAAC;AAAA,IACN,SAAS;AAAA,IACT;AAAA,IACA,MAAM,MAAM;AAAA,IACZ,SAAS,CAAC,oBAAoB;AAAA,EAChC,CAAC;AACH;AAEA,eAAe,aACb,SACA,OAC2C;AAC3C,QAAM,QAAQ,gBAAgB,SAAS,MAAM,KAAK;AAClD,SAAO,CAAC;AAAA,IACN,SAAS;AAAA,IACT;AAAA,IACA,MAAM,MAAM;AAAA,IACZ,SAAS,CAAC,qBAAqB;AAAA,IAC/B,aAAa;AAAA,EACf,CAAC;AACH;AAEA,eAAe,wBACb,SACA,OAC4D;AAC5D,MAAI;AACF,UAAM,UAAUC,gBAAe,OAAO;AACtC,UAAM,QAAQ,gBAAgB,SAAS,MAAM,KAAK;AAClD,UAAM,SAAS,MAAMC,aAAY,OAAO,EACrC,YAAY,KAAK,EACjB,GAAG,MAAM,QAAQ,EACjB,MAAM,cAAc,CAAC,GAAG,EAAE,SAAS,iBAAiB,UAAU,iBAAiB,CAAC;AACnF,QAAI,CAAC,OAAO,GAAI,QAAO,kBAAkB,OAAO,OAAO,2BAA2B;AAElF,UAAM,aAAa,qBAAqB,OAAO,MAAM,iBAAiB,gBAAgB;AACtF,UAAM,UAAU,WAAW,KAAK,IAAI,CAAC,QAAQ,aAAa,GAAG,CAAC;AAC9D,WAAO;AAAA,MACL,QAAQ;AAAA,MACR,QAAQ;AAAA,QACN;AAAA,QACA,UAAU,MAAM;AAAA,QAChB;AAAA,QACA,OAAO,QAAQ;AAAA,QACf,QAAQ,aAAa,iBAAiB,gBAAgB;AAAA,MACxD;AAAA,IACF;AAAA,EACF,SAAS,OAAO;AACd,WAAO,WAAW,OAAO,2BAA2B;AAAA,EACtD;AACF;AAEA,eAAe,gBACb,SACA,OACoD;AACpD,MAAI;AACF,QAAI,CAAC,kBAAkB,MAAM,GAAG,GAAG;AACjC,aAAO;AAAA,QACL,QAAQ;AAAA,QACR,OAAO;AAAA,UACL;AAAA,UACA;AAAA,QACF;AAAA,MACF;AAAA,IACF;AAEA,UAAM,UAAUD,gBAAe,OAAO;AACtC,UAAM,QAAQ,gBAAgB,SAAS,MAAM,KAAK;AAClD,UAAM,UAAU,MAAM,WAAW;AACjC,UAAM,WAAW,MAAM,YAAY;AACnC,UAAM,UAAU,MAAM,UAAU,CAAC,GAAG,IAAI,mBAAmB;AAC3D,UAAM,SAAS,MAAMC,aAAY,OAAO,EACrC,YAAY,KAAK,EACjB,GAAG,MAAM,QAAQ,EACjB,MAAM,MAAM,KAAK,QAAQ,EAAE,SAAS,SAAS,CAAC;AACjD,QAAI,CAAC,OAAO,GAAI,QAAO,kBAAkB,OAAO,OAAO,sBAAsB;AAE7E,UAAM,aAAa,qBAAqB,OAAO,MAAM,SAAS,QAAQ;AACtE,WAAO;AAAA,MACL,QAAQ;AAAA,MACR,QAAQ;AAAA,QACN;AAAA,QACA,UAAU,MAAM;AAAA,QAChB,SAAS,WAAW;AAAA,QACpB,MAAM,WAAW;AAAA,QACjB,UAAU,WAAW,KAAK;AAAA,QAC1B,QAAQ,aAAa,SAAS,QAAQ;AAAA,MACxC;AAAA,IACF;AAAA,EACF,SAAS,OAAO;AACd,WAAO,WAAW,OAAO,sBAAsB;AAAA,EACjD;AACF;AAEA,eAAe,cACb,SACA,OACsD;AACtD,MAAI;AACF,UAAM,gBAAgB,wBAAwB,MAAM,KAAK,MAAM,OAAO,MAAM;AAC5E,QAAI,kBAAkB,QAAW;AAC/B,aAAO;AAAA,QACL,QAAQ;AAAA,QACR,OAAO;AAAA,UACL;AAAA,UACA;AAAA,QACF;AAAA,MACF;AAAA,IACF;AAEA,UAAM,UAAUD,gBAAe,OAAO;AACtC,UAAM,QAAQ,gBAAgB,SAAS,MAAM,KAAK;AAClD,UAAM,SAAS,MAAMC,aAAY,OAAO,EACrC,YAAY,KAAK,EACjB,GAAG,MAAM,QAAQ,EACjB,QAAQ,MAAM,KAAK,MAAM,OAAO,IAAI,mBAAmB,CAAC;AAC3D,QAAI,CAAC,OAAO,GAAI,QAAO,qBAAqB,OAAO,OAAO,8BAA8B,KAAK,mBAAmB,OAAO,KAAK;AAC5H,UAAM,aAAa,uBAAuB,OAAO,IAAI;AACrD,WAAO;AAAA,MACL,QAAQ;AAAA,MACR,QAAQ;AAAA,QACN;AAAA,QACA,UAAU,MAAM;AAAA,QAChB;AAAA,QACA,GAAG;AAAA,QACH,iBAAiB;AAAA,MACnB;AAAA,IACF;AAAA,EACF,SAAS,OAAO;AACd,QAAI,iBAAiB,yBAA0B,QAAO,EAAE,QAAQ,SAAS,OAAO,MAAM,eAAe;AACrG,WAAO,qBAAqB,OAAO,8BAA8B,KAAK,mBAAmB,KAAK;AAAA,EAChG;AACF;AAEA,SAAS,kBAAkB,KAAsB;AAC/C,QAAM,MAAM,qBAAqB,GAAG;AACpC,SAAO,QAAQ,UAAa,IAAI,SAAS;AAC3C;AAEA,SAAS,wBACP,KACA,gBAC4C;AAC5C,QAAM,MAAM,qBAAqB,GAAG;AACpC,MACE,QAAQ,UACP,IAAI,SAAS,YAAY,IAAI,SAAS,YAAY,IAAI,SAAS,YAChE,IAAI,SAAS,UAAa,IAAI,SAAS,MACvC;AACA,WAAO;AAAA,EACT;AACA,QAAM,eAAe,0BAA0B,GAAG;AAClD,SAAO,eAAe,KAAK,iBAAiB,iBAAiB,IAAI,OAAO;AAC1E;AAEA,SAAS,qBAAqB,KAAkD;AAC9E,MAAI;AACF,UAAM,MAAM,UAAU,OAAO,KAAK,EAAE,UAAU,SAAS,CAAC;AACxD,WAAO,CAAC,MAAM,QAAQ,GAAG,KAAKC,UAAS,GAAG,IAAI,MAAM;AAAA,EACtD,QAAQ;AACN,WAAO;AAAA,EACT;AACF;AAEA,SAAS,0BAA0B,OAAwB;AACzD,MAAI,MAAM,QAAQ,KAAK,GAAG;AACxB,WAAO,MAAM,OAAO,CAAC,OAAO,UAAU,QAAQ,0BAA0B,KAAK,GAAG,CAAC;AAAA,EACnF;AACA,MAAI,CAACA,UAAS,KAAK,EAAG,QAAO;AAC7B,QAAM,UAAU,MAAM,SAAS,YAAY,MAAM,UAAU,MAAM,IAAI;AACrE,SAAO,OAAO,OAAO,KAAK,EAAE;AAAA,IAC1B,CAAC,OAAO,UAAU,QAAQ,0BAA0B,KAAK;AAAA,IACzD;AAAA,EACF;AACF;AAEA,SAAS,oBAAoB,OAA2D;AACtF,MAAIA,UAAS,KAAK,KAAK,MAAM,SAAS,QAAQ;AAC5C,WAAO,IAAI,WAAW,OAAO,KAAK,MAAM,QAAkB,QAAQ,CAAC;AAAA,EACrE;AACA,SAAO;AACT;AAEA,SAAS,qBACP,OACA,SACA,UACwF;AACxF,MAAI,CAACA,UAAS,KAAK,KAAK,CAAC,MAAM,QAAQ,MAAM,OAAO,KAAK,CAAC,MAAM,QAAQ,MAAM,IAAI,GAAG;AACnF,UAAM,eAAe,mDAAmD;AAAA,EAC1E;AACA,QAAM,UAAU,MAAM,QAAQ,IAAI,CAAC,WAAW;AAC5C,QAAI,OAAO,WAAW,UAAU;AAC9B,YAAM,eAAe,kDAAkD;AAAA,IACzE;AACA,WAAO;AAAA,EACT,CAAC;AACD,QAAM,OAAO,MAAM,KAAK,IAAI,CAAC,QAAQ;AACnC,QAAI,CAAC,MAAM,QAAQ,GAAG,KAAK,IAAI,WAAW,QAAQ,QAAQ;AACxD,YAAM,eAAe,0CAA0C;AAAA,IACjE;AACA,WAAO,IAAI,IAAI,uBAAuB;AAAA,EACxC,CAAC;AAED,QAAM,kBAAkB,OAAO,WAAW,KAAK,UAAU,EAAE,SAAS,KAAK,CAAC,GAAG,MAAM;AACnF,MAAI,KAAK,SAAS,WAAW,kBAAkB,UAAU;AACvD,UAAM,IAAI,yBAAyB;AAAA,MACjC;AAAA,MACA;AAAA,MACA;AAAA,QACE,SAAS;AAAA,UACP;AAAA,UACA;AAAA,UACA,cAAc,KAAK;AAAA,UACnB,eAAe;AAAA,QACjB;AAAA,MACF;AAAA,IACF,CAAC;AAAA,EACH;AACA,SAAO,EAAE,SAAS,KAAK;AACzB;AAEA,SAAS,wBAAwB,OAAgC;AAC/D,MAAI,UAAU,QAAQ,OAAO,UAAU,SAAU,QAAO;AACxD,MAAI,OAAO,UAAU,UAAU;AAC7B,QAAI,CAAC,OAAO,SAAS,KAAK,KAAM,OAAO,UAAU,KAAK,KAAK,CAAC,OAAO,cAAc,KAAK,GAAI;AACxF,YAAM,eAAe,+EAA+E;AAAA,IACtG;AACA,WAAO;AAAA,EACT;AACA,MAAI,iBAAiB,WAAY,QAAO,WAAW,KAAK;AACxD,MAAI,MAAM,QAAQ,KAAK,KAAK,MAAM,MAAM,MAAM,GAAG;AAC/C,WAAO,WAAW,WAAW,KAAK,KAAK,CAAC;AAAA,EAC1C;AACA,MAAIA,UAAS,KAAK,KAAK,MAAM,SAAS,YAAY,MAAM,QAAQ,MAAM,IAAI,KAAK,MAAM,KAAK,MAAM,MAAM,GAAG;AACvG,WAAO,WAAW,WAAW,KAAK,MAAM,IAAI,CAAC;AAAA,EAC/C;AACA,QAAM,eAAe,gDAAgD;AACvE;AAEA,SAAS,uBACP,OAC+D;AAC/D,MACE,CAACA,UAAS,KAAK,KACf,CAAC,OAAO,cAAc,MAAM,OAAO,KAClC,MAAM,UAAqB,KAE1B,MAAM,oBAAoB,QAC1B,CAAC,OAAO,cAAc,MAAM,eAAe,GAE7C;AACA,UAAM,eAAe,6FAA6F;AAAA,EACpH;AACA,SAAO;AAAA,IACL,SAAS,MAAM;AAAA,IACf,iBAAiB,MAAM;AAAA,EACzB;AACF;AAEA,SAAS,aAAa,KAA2E;AAC/F,QAAM,CAAC,MAAM,MAAM,WAAW,GAAG,IAAI;AACrC,MACG,SAAS,WAAW,SAAS,UAAU,SAAS,WAAW,SAAS,aACrE,OAAO,SAAS,YAChB,OAAO,cAAc,YACpB,QAAQ,QAAQ,OAAO,QAAQ,UAChC;AACA,UAAM,eAAe,oDAAoD;AAAA,EAC3E;AACA,SAAO;AAAA,IACL;AAAA,IACA;AAAA,IACA;AAAA,IACA,GAAI,QAAQ,OAAO,CAAC,IAAI,EAAE,IAAI;AAAA,EAChC;AACF;AAEA,SAAS,aAAa,SAAiB,UAAmC;AACxE,SAAO,EAAE,SAAS,UAAU,aAAa,iCAAiC;AAC5E;AAEA,SAASF,gBAAe,SAAoD;AAC1E,MAAI,QAAQ,YAAY,QAAW;AACjC,UAAM,IAAI,UAAU,iDAAiD;AAAA,EACvE;AACA,SAAO;AACT;AAEA,SAASC,aAAY,SAAiD;AACpE,SAAO,QAAQ,QAAQ;AACzB;AAEA,SAAS,gBAAgB,SAAkC,OAAuB;AAChF,QAAM,WAAW;AAAA,IACf,QAAQ,QAAQ;AAAA,IAChB,QAAQ,QAAQ;AAAA,EAClB,EAAE,KAAK;AACP,QAAM,OAAO,SAAS,MAAM,GAAG,EAAE,GAAG,EAAE,GAAG,YAAY;AACrD,MAAI,SAAS,aAAa,SAAS,WAAW;AAC5C,UAAM,IAAI,yBAAyB;AAAA,MACjC;AAAA,MACA;AAAA,IACF,CAAC;AAAA,EACH;AACA,SAAO;AACT;AAEA,SAAS,WAAW,OAA4B;AAC9C,SAAO;AAAA,IACL,MAAM;AAAA,IACN,QAAQ,OAAO,KAAK,KAAK,EAAE,SAAS,QAAQ;AAAA,IAC5C,YAAY,MAAM;AAAA,EACpB;AACF;AAEA,SAAS,eAAe,SAA2C;AACjE,SAAO,IAAI,yBAAyB,eAAe,oBAAoB,OAAO,CAAC;AACjF;AAEA,SAAS,WACP,OACA,QACkC;AAClC,MAAI,iBAAiB,0BAA0B;AAC7C,WAAO,EAAE,QAAQ,SAAS,OAAO,MAAM,eAAe;AAAA,EACxD;AACA,SAAO,qBAAqB,OAAO,MAAM,KAAKE,aAAY,MAAM;AAClE;AAEA,SAASA,aAAY,QAAkD;AACrE,SAAO;AAAA,IACL,QAAQ;AAAA,IACR,OAAO;AAAA,MACL;AAAA,MACA,gCAAgC,MAAM;AAAA,MACtC,EAAE,WAAW,KAAK;AAAA,IACpB;AAAA,EACF;AACF;AAEA,SAAS,kBACP,OACA,QACkC;AAClC,QAAM,OAAO,qBAAqB,OAAO,MAAM;AAC/C,MAAI,SAAS,OAAW,QAAO;AAC/B,MAAID,UAAS,KAAK,KAAK,MAAM,SAAS,0BAA0B;AAC9D,WAAO;AAAA,MACL,QAAQ;AAAA,MACR,OAAO;AAAA,QACL;AAAA,QACA;AAAA,MACF;AAAA,IACF;AAAA,EACF;AACA,SAAOC,aAAY,MAAM;AAC3B;AAEA,SAAS,mBAAmB,OAAkD;AAE5E,QAAM,cAAc,0BAA0B,KAAK;AACnD,MAAI,YAAa,QAAO,EAAE,QAAQ,SAAS,OAAO,YAAY;AAC9D,SAAO;AAAA,IACL,QAAQ;AAAA,IACR,OAAO;AAAA,MACL;AAAA,MACA;AAAA,MACA,EAAE,WAAW,MAAM;AAAA,IACrB;AAAA,EACF;AACF;AAEA,SAASC,mBAAkB,OAAwB;AACjD,MAAI,UAAU,GAAI,QAAO;AACzB,MAAI,MAAM,SAAS,MAAM,KAAK,CAAC,yBAAyB,KAAK,KAAK,EAAG,QAAO;AAC5E,SAAO,OAAO,KAAK,OAAO,QAAQ,EAAE,SAAS,QAAQ,MAAM;AAC7D;AAEA,SAAS,mBAAmB,OAA8B;AACxD,MAAI,OAAO,UAAU,SAAU,QAAO,OAAO,WAAW,OAAO,MAAM;AACrE,MAAIF,UAAS,KAAK,KAAK,MAAM,SAAS,QAAQ;AAC5C,WAAO,OAAO,KAAK,MAAM,QAAkB,QAAQ,EAAE;AAAA,EACvD;AACA,SAAO;AACT;AAEA,SAAS,OAAO,OAAiC;AAC/C,SAAO,OAAO,UAAU,KAAK,KAAM,SAAoB,KAAM,SAAoB;AACnF;AAEA,SAASA,UAAS,OAAkD;AAClE,SAAO,OAAO,UAAU,YAAY,UAAU,QAAQ,CAAC,MAAM,QAAQ,KAAK;AAC5E;AA7sBA,IAkBM,kBACA,cACA,mBACA,eACA,iBACA,kBACA,gBACA,gBACA,4BAGA,cAsEA,WAEAG,cAMA,gBAQA,kBAIA,cAIA,qBAMA,iBAcA,yBAcA,sBAUA,sBAIA,qBAeA,uBAgBA,uBAKA,8BAYA,sBAQA,wBASAC,yBAKA,cASA,wBAIA,uBAIA,yBAUO;AA5Qb;AAAA;AAAA;AAcA;AACA;AACA;AAEA,IAAM,mBAAmB;AACzB,IAAM,eAAe;AACrB,IAAM,oBAAoB,OAAO;AACjC,IAAM,gBAAgB,IAAI,OAAO;AACjC,IAAM,kBAAkB;AACxB,IAAM,mBAAmB,OAAO;AAChC,IAAM,iBAAiB;AACvB,IAAM,iBAAiB,KAAK;AAC5B,IAAM,6BACJ;AAEF,IAAM,eAAe;AAAA;AAAA;AAAA;AAAA;AAsErB,IAAM,YAAY,IAAI,cAAc,OAAO;AAE3C,IAAMD,eAAcN,GAAE,OAAO,EAAE,IAAI,CAAC,EAAE;AAAA,MACpC,CAAC,WACE,mBAAmB,KAAK,KAAK,KAAK,MAAM,WAAW,YAAY,MAChE,CAAC,MAAM,SAAS,GAAG;AAAA,MACrB;AAAA,IACF;AACA,IAAM,iBAAiBA,GAAE,OAAO,EAAE,IAAI,CAAC,EAAE,IAAI,GAAG,EAAE;AAAA,MAChD,CAAC,aACC,aAAa,OACb,CAAC,SAAS,SAAS,GAAG,KACtB,CAAC,SAAS,SAAS,GAAG,KACtB,CAAC,wBAAwB,KAAK,QAAQ;AAAA,MACxC;AAAA,IACF;AACA,IAAM,mBAAmBA,GAAE,OAAO,EAAE,OAAO,EAAE;AAAA,MAC3C,CAAC,UAAU,CAAC,OAAO,UAAU,KAAK,KAAK,OAAO,cAAc,KAAK;AAAA,MACjE;AAAA,IACF;AACA,IAAM,eAAeA,GAAE,OAAO,EAAE,IAAI,KAAK,KAAK,gBAAgB,CAAC,IAAI,CAAC,EAAE;AAAA,MACpEK;AAAA,MACA;AAAA,IACF;AACA,IAAM,sBAAgDL,GAAE,MAAM;AAAA,MAC5DA,GAAE,KAAK;AAAA,MACP;AAAA,MACAA,GAAE,OAAO,EAAE,IAAI,aAAa;AAAA,MAC5BA,GAAE,OAAO,EAAE,MAAMA,GAAE,QAAQ,MAAM,GAAG,QAAQ,aAAa,CAAC,EAAE,OAAO;AAAA,IACrE,CAAC;AACD,IAAM,kBAAkBA,GAAE,MAAM,mBAAmB,EAAE,IAAI,cAAc,EAAE;AAAA,MACvE,CAAC,QAAQ,YAAY;AACnB,cAAM,aAAa,OAAO;AAAA,UACxB,CAAC,OAAO,UAAU,QAAQ,mBAAmB,KAAK;AAAA,UAClD;AAAA,QACF;AACA,YAAI,aAAa,eAAe;AAC9B,kBAAQ,SAAS;AAAA,YACf,MAAMA,GAAE,aAAa;AAAA,YACrB,SAAS;AAAA,UACX,CAAC;AAAA,QACH;AAAA,MACF;AAAA,IACF;AACA,IAAM,0BAA0BA,GAAE,MAAM,mBAAmB,EAAE,IAAI,CAAC,EAAE,IAAI,cAAc,EAAE;AAAA,MACtF,CAAC,QAAQ,YAAY;AACnB,cAAM,aAAa,OAAO;AAAA,UACxB,CAAC,OAAO,UAAU,QAAQ,mBAAmB,KAAK;AAAA,UAClD;AAAA,QACF;AACA,YAAI,aAAa,eAAe;AAC9B,kBAAQ,SAAS;AAAA,YACf,MAAMA,GAAE,aAAa;AAAA,YACrB,SAAS;AAAA,UACX,CAAC;AAAA,QACH;AAAA,MACF;AAAA,IACF;AACA,IAAM,uBAAkDA,GAAE,MAAM;AAAA,MAC9DA,GAAE,KAAK;AAAA,MACP;AAAA,MACAA,GAAE,OAAO;AAAA,MACTA,GAAE,OAAO;AAAA,QACP,MAAMA,GAAE,QAAQ,MAAM;AAAA,QACtB,QAAQA,GAAE,OAAO;AAAA,QACjB,YAAYA,GAAE,OAAO,EAAE,IAAI,EAAE,YAAY;AAAA,MAC3C,CAAC,EAAE,OAAO;AAAA,IACZ,CAAC;AACD,IAAM,uBAAkDA,GAAE,OAAO;AAAA,MAC/D,OAAOM;AAAA,MACP,UAAU;AAAA,IACZ,CAAC,EAAE,OAAO;AACV,IAAM,sBAAgDN,GAAE,OAAO;AAAA,MAC7D,OAAOM;AAAA,MACP,UAAU;AAAA,MACV,KAAKN,GAAE,OAAO,EAAE,IAAI,CAAC,EAAE,IAAI,cAAc,EAAE,YAAY,CAAC,KAAK,YAAY;AACvE,YAAI,CAAC,kBAAkB,GAAG,GAAG;AAC3B,kBAAQ,SAAS;AAAA,YACf,MAAMA,GAAE,aAAa;AAAA,YACrB,SAAS;AAAA,UACX,CAAC;AAAA,QACH;AAAA,MACF,CAAC;AAAA,MACD,QAAQ,gBAAgB,SAAS;AAAA,MACjC,SAASA,GAAE,OAAO,EAAE,IAAI,EAAE,SAAS,EAAE,IAAI,YAAY,EAAE,SAAS;AAAA,MAChE,UAAUA,GAAE,OAAO,EAAE,IAAI,EAAE,SAAS,EAAE,IAAI,aAAa,EAAE,SAAS;AAAA,IACpE,CAAC,EAAE,OAAO;AACV,IAAM,wBAAoDA,GAAE,OAAO;AAAA,MACjE,OAAOM;AAAA,MACP,UAAU;AAAA,MACV,KAAKN,GAAE,OAAO,EAAE,IAAI,CAAC,EAAE,IAAI,cAAc;AAAA,MACzC,QAAQ;AAAA,MACR,kCAAkCA,GAAE,QAAQ,IAAI,EAAE,SAAS,0BAA0B;AAAA,IACvF,CAAC,EAAE,OAAO,EAAE,YAAY,CAAC,OAAO,YAAY;AAC1C,UAAI,wBAAwB,MAAM,KAAK,MAAM,OAAO,MAAM,MAAM,QAAW;AACzE,gBAAQ,SAAS;AAAA,UACf,MAAMA,GAAE,aAAa;AAAA,UACrB,MAAM,CAAC,KAAK;AAAA,UACZ,SAAS;AAAA,QACX,CAAC;AAAA,MACH;AAAA,IACF,CAAC;AAED,IAAM,wBAAoDA,GAAE,OAAO;AAAA,MACjE,SAASA,GAAE,OAAO,EAAE,IAAI,EAAE,SAAS;AAAA,MACnC,UAAUA,GAAE,OAAO,EAAE,IAAI,EAAE,SAAS;AAAA,MACpC,aAAaA,GAAE,QAAQ,gCAAgC;AAAA,IACzD,CAAC,EAAE,OAAO;AACV,IAAM,+BAAkEA,GAAE,OAAO;AAAA,MAC/E,OAAOA,GAAE,OAAO,EAAE,IAAI,CAAC;AAAA,MACvB,UAAUA,GAAE,OAAO,EAAE,IAAI,CAAC;AAAA,MAC1B,SAASA,GAAE,MAAMA,GAAE,OAAO;AAAA,QACxB,MAAMA,GAAE,KAAK,CAAC,SAAS,QAAQ,SAAS,SAAS,CAAC;AAAA,QAClD,MAAMA,GAAE,OAAO,EAAE,IAAI,CAAC;AAAA,QACtB,WAAWA,GAAE,OAAO,EAAE,IAAI,CAAC;AAAA,QAC3B,KAAKA,GAAE,OAAO,EAAE,SAAS;AAAA,MAC3B,CAAC,EAAE,OAAO,CAAC;AAAA,MACX,OAAOA,GAAE,OAAO,EAAE,IAAI,EAAE,YAAY;AAAA,MACpC,QAAQ;AAAA,IACV,CAAC,EAAE,OAAO;AACV,IAAM,uBAAkDA,GAAE,OAAO;AAAA,MAC/D,OAAOA,GAAE,OAAO,EAAE,IAAI,CAAC;AAAA,MACvB,UAAUA,GAAE,OAAO,EAAE,IAAI,CAAC;AAAA,MAC1B,SAASA,GAAE,MAAMA,GAAE,OAAO,CAAC;AAAA,MAC3B,MAAMA,GAAE,MAAMA,GAAE,MAAM,oBAAoB,CAAC;AAAA,MAC3C,UAAUA,GAAE,OAAO,EAAE,IAAI,EAAE,YAAY;AAAA,MACvC,QAAQ;AAAA,IACV,CAAC,EAAE,OAAO;AACV,IAAM,yBAAsDA,GAAE,OAAO;AAAA,MACnE,OAAOA,GAAE,OAAO,EAAE,IAAI,CAAC;AAAA,MACvB,UAAUA,GAAE,OAAO,EAAE,IAAI,CAAC;AAAA,MAC1B,eAAeA,GAAE,KAAK,CAAC,UAAU,UAAU,QAAQ,CAAC;AAAA,MACpD,SAASA,GAAE,OAAO,EAAE,IAAI,EAAE,YAAY;AAAA,MACtC,iBAAiBA,GAAE,OAAO,EAAE,IAAI,EAAE,SAAS;AAAA,MAC3C,iBAAiBA,GAAE,QAAQ,0BAA0B;AAAA,IACvD,CAAC,EAAE,OAAO;AAEV,IAAMO,0BAAsD;AAAA,MAC1D;AAAA,MACA;AAAA,MACA;AAAA,IACF;AACA,IAAM,eAAkC;AAAA,MACtC,KAAK;AAAA,QACH,QAAQ;AAAA,QACR,QAAQ;AAAA,MACV;AAAA,MACA,KAAK,EAAE,QAAQ,WAAW;AAAA,MAC1B,OAAO,EAAE,QAAQ,WAAW;AAAA,MAC5B,MAAM,EAAE,QAAQ,WAAW;AAAA,IAC7B;AACA,IAAM,yBAA+C;AAAA,MACnD,OAAO,CAAC,WAAW;AAAA,MACnB,QAAQ,CAAC,UAAU;AAAA,IACrB;AACA,IAAM,wBAA8C;AAAA,MAClD,OAAO,CAAC,aAAa,QAAQ,SAAS;AAAA,MACtC,QAAQ,CAAC,YAAY,OAAO;AAAA,IAC9B;AACA,IAAM,0BAAgD;AAAA,MACpD,OAAO,CAAC,aAAa,QAAQ,SAAS;AAAA,MACtC,QAAQ,CAAC,kBAAkB;AAAA,IAC7B;AAOO,IAAM,0BAAoD;AAAA,MAC/D;AAAA,QACE,IAAI;AAAA,QACJ,SAAS;AAAA,QACT,OAAO;AAAA,QACP,aAAa;AAAA,QACb,OAAO;AAAA,QACP,QAAQ;AAAA,QACR,SAAS,CAAC,MAAM;AAAA,QAChB,SAAS;AAAA,QACT,UAAUA;AAAA,QACV,UAAU;AAAA,QACV,aAAa;AAAA,QACb,WAAW;AAAA,QACX,SAAS;AAAA,MACX;AAAA,MACA;AAAA,QACE,IAAI;AAAA,QACJ,SAAS;AAAA,QACT,OAAO;AAAA,QACP,aAAa;AAAA,QACb,OAAO;AAAA,QACP,QAAQ;AAAA,QACR,SAAS,CAAC,MAAM;AAAA,QAChB,SAAS;AAAA,QACT,UAAUA;AAAA,QACV,UAAU;AAAA,QACV,aAAa;AAAA,QACb,uBAAuB;AAAA,QACvB,WAAW;AAAA,QACX,SAAS;AAAA,MACX;AAAA,MACA;AAAA,QACE,IAAI;AAAA,QACJ,SAAS;AAAA,QACT,OAAO;AAAA,QACP,aAAa,wGAAwG,0BAA0B;AAAA,QAC/I,OAAO;AAAA,QACP,QAAQ;AAAA,QACR,SAAS,CAAC,SAAS,aAAa;AAAA,QAChC,SAAS;AAAA,QACT,UAAUA;AAAA,QACV,UAAU;AAAA,QACV,aAAa;AAAA,QACb,uBAAuB;AAAA,QACvB,WAAW;AAAA,QACX,SAAS;AAAA,MACX;AAAA,IACF;AAAA;AAAA;;;AC5TA,IAuEa,2BAyBA;AAhGb;AAAA;AAAA;AAuEO,IAAM,4BAA4B;AAAA,MACvC;AAAA,MACA;AAAA,MACA;AAAA,MACA;AAAA,MACA;AAAA,MACA;AAAA,MACA;AAAA,MACA;AAAA,MACA;AAAA,MACA;AAAA,MACA;AAAA,MACA;AAAA,MACA;AAAA,MACA;AAAA,MACA;AAAA,IACF;AASO,IAAM,yBAAyB;AAAA;AAAA;;;AChGtC,SAAS,QAAAC,aAAY;AAIrB,YAAYC,cAAa;AA4ElB,SAAS,qBAAqB,SAAyB;AAC5D,SAAOD,MAAK,YAAY,OAAO,GAAG,mCAAmC;AACvE;AAuBO,SAAS,qBACd,OACkD;AAElD,MAAI,CAACE,UAAS,KAAK,EAAG,QAAO;AAC7B,QAAM,aAAa,MAAM;AACzB,MAAI,CAACA,UAAS,UAAU,EAAG,QAAO;AAClC,QAAM,SAAS,WAAW;AAC1B,MACE,CAACA,UAAS,MAAM,KAChB,OAAO,KAAK,MAAM,EAAE,WAAW,KAC/B,CAAC,OAAO,UAAU,eAAe,KAAK,QAAQ,eAAe,KAC7D,OAAO,OAAO,kBAAkB,UAChC;AACA,WAAO;AAAA,EACT;AACA,MAAI,eAAe,WAAY,QAAO;AACtC,MAAI,OAAO,cAAc,SAAS,GAAG,EAAG,QAAO;AAC/C,SAAO,sBAAsB,QAAQ,YAAY;AACnD;AAQO,SAAS,YACd,OACA,UACmD;AACnD,QAAM,OAAO,qBAAqB,KAAK;AACvC,MAAI,CAACA,UAAS,KAAK,KAAM,SAAS,aAAa,SAAS,eAAiB,QAAO;AAChF,QAAM,UAAU,+BAA+B,UAAU,MAAM,gBAAgB;AAC/E,MAAI,QAAQ,QAAS,QAAO,QAAQ,KAAK;AACzC,SAAO,CAAC,YAAY,SAAS,aAAa,EAAE,sBAAsB,SAAS,WAAW;AACxF;AAMA,SAAS,cACP,QACA,WACA,QACA,cAAa,oBAAI,KAAK,GAAE,YAAY,GAC+B;AACnE,SAAO;AAAA,IACL,GAAG;AAAA,IACH,kBAAkB,+BAA+B,MAAM;AAAA,MACrD,WAAW,GAAG,kBAAkB,MAAM,CAAC,IAAI,OAAO,WAAW,GAAG;AAAA,MAChE,WAAW,gBAAgB,SAAS;AAAA,IACtC,CAAC;AAAA,IACD,uBAAuB,EAAE,QAAQ,YAAY,MAAM,cAAc,MAAM,EAAE;AAAA,EAC3E;AACF;AAwFA,eAAsB,8BACpB,SACA,MACA,SACkB;AAClB,MAAI,MAAM,yBAAyB,OAAO,EAAG,QAAO;AAIpD,MAAI,CAAC,QAAQ,WAAW,CAAC,MAAM,sBAAsB,SAAS,IAAI,EAAG,QAAO;AAC5E,MAAI;AACF,WAAO,MAAM,gBAAgB,SAAS,YAAY;AAChD,UAAI,MAAM,yBAAyB,OAAO,EAAG,QAAO;AAGpD,UAAI,CAAC,MAAM,sBAAsB,SAAS,IAAI,EAAG,QAAO;AACxD,YAAM,cAAa,oBAAI,KAAK,GAAE,YAAY;AAC1C,YAAM,QAAQ,oBAAI,IAAqC;AACvD,YAAM,UAAoB,CAAC;AAC3B,iBAAW,SAAS,MAAM,0BAAmC,OAAO,GAAG;AAErE,YAAI,CAACA,UAAS,KAAK,KAAK,sBAAsB,SAAS,qBAAqB,KAAK,MAAM,UAAW;AAClG,cAAM,WAAW,MAAM,eAAe,MAAM,OAAO,QAAQ,MAAM,UAAU;AAC3E,YAAI,aAAa,OAAW,SAAQ,KAAK,OAAO,UAAU,KAAK,CAAC,CAAC;AAAA,YAC5D,OAAM,IAAI,UAAU,KAAK,GAAI,QAAQ;AAAA,MAC5C;AACA,UAAI,MAAM,OAAO,GAAG;AAClB,cAAM,mBAAkC,SAAS,0BAA0B,CAAC,aAAa;AAAA,UACvF,SAAS,QAAQ,IAAI,CAAC,UAAU;AAC9B,kBAAM,MAAM,CAACA,UAAS,KAAK,KAAK,sBAAsB,QAAQ,SAAY,UAAU,KAAK;AACzF,oBAAQ,QAAQ,SAAY,SAAY,MAAM,IAAI,GAAG,MAAM;AAAA,UAC7D,CAAC;AAAA,UACD,QAAQ;AAAA,QACV,EAAE;AAAA,MACJ;AACA,YAAM,gBAAgB,qBAAqB,OAAO,GAAG;AAAA,QACnD,eAAe;AAAA,QACf,YAAY;AAAA,QACZ,OAAO,CAAC,GAAG,MAAM,OAAO,CAAC,EAAE,IAAI,SAAS;AAAA,QACxC;AAAA,MACF,CAAC;AACD,aAAO;AAAA,IACT,GAAG,EAAE,WAAW,0BAA0B,CAAC;AAAA,EAC7C,QAAQ;AACN,WAAO;AAAA,EACT;AACF;AAGA,eAAe,sBAAsB,SAAiB,MAAoD;AACxG,MAAI;AACF,UAAM,YAAY,MAAM,YAAqC,OAAO;AACpE,WAAO,OAAO,WAAW,uBAAuB,YAC9C,OAAO,KAAK,eAAe,YAC3B,UAAU,mBAAmB,MAAM,KAAK,CAAC,EAAE,CAAC,MAAM,KAAK,WAAW,MAAM,KAAK,CAAC,EAAE,CAAC;AAAA,EACrF,QAAQ;AACN,WAAO;AAAA,EACT;AACF;AAGA,eAAe,eACb,MACA,OACA,MACA,YAC8C;AAC9C,QAAM,aAAa,0BAA0B,KAAK;AAClD,MAAI,eAAe,OAAW,QAAO;AACrC,QAAM,SAAS,MAAM,mBAAmB,MAAM,YAAY,IAAI;AAC9D,MAAI,WAAW,OAAW,QAAO;AACjC,MAAI;AAEF,WAAO,cAAc,EAAE,GAAG,OAAO,YAAY,EAAE,GAAG,MAAM,YAAsB,KAAK,WAAW,IAAI,EAAE,GAAG,QAAQ,aAAa,UAAU;AAAA,EACxI,QAAQ;AAEN,WAAO;AAAA,EACT;AACF;AAcA,SAAS,QAAQ,QAAuD;AACtE,SAAO,EAAE,QAAQ,WAAW,OAAO;AACrC;AAYA,eAAsB,uBACpB,MACA,OACA,SAKiC;AACjC,QAAM,OAAO,qBAAqB,KAAK;AACvC,QAAM,aAAa,0BAA0B,KAAK;AAClD,MAAI,SAAS,aAAa,eAAe,OAAW,QAAO,QAAQ,WAAW;AAC9E,MAAI,WAAW,OAAO,QAAQ,KAAK,KAAK,IAAI,EAAG,QAAO;AACtD,MAAI,SAAS,QAAS,QAAO,QAAQ,eAAe;AACpD,QAAM,QAAQ,YAAY,OAAO,QAAQ,QAAQ;AACjD,MAAI,UAAU,OAAW,QAAO,QAAQ,SAAS;AACjD,MAAI,iBAAiB;AACrB,QAAM,YAAY,UAAU,WACxB,MAAM,OACN,CAAC,cAA0C;AAC3C,qBAAiB,CAAC,wBAAwB,OAAO,WAAW,QAAQ,YAAY;AAChF,WAAO,CAAC;AAAA,EACV;AACF,MAAI;AACF,WAAO;AAAA,MACL,QAAQ;AAAA,MACR,YAAY,MAAc,4CAAmC,MAAM,YAAY,EAAE,MAAM,QAAQ,MAAM,UAAU,CAAC;AAAA,IAClH;AAAA,EACF,SAAS,OAAO;AACd,WAAO,QAAQ,iBAAiB,oBAAoB,gBAAgB,KAAK,CAAC;AAAA,EAC5E;AACF;AAGA,SAAS,gBAAgB,OAAuC;AAC9D,QAAM,SAASA,UAAS,KAAK,IAAI,MAAM,SAAS;AAChD,SAAO,OAAO,WAAW,YAAa,0BAAgD,SAAS,MAAM,IACjG,SACA;AACN;AAGA,eAAsB,yBAAyB,SAAmC;AAChF,MAAI;AACF,WAAO,MAAM,SAAkB,qBAAqB,OAAO,CAAC,MAAM;AAAA,EACpE,QAAQ;AACN,WAAO;AAAA,EACT;AACF;AAMA,eAAe,mBACb,MACA,YACA,MACiD;AACjD,MAAI;AACJ,MAAI;AACF,UAAc,4CAAmC,MAAM,YAAY;AAAA;AAAA,MAEjE,MAAM,WAAW,QAAQ;AAAA,MACzB,WAAW,CAAC,cAAc;AACxB,iBAAS;AACT,eAAO;AAAA,MACT;AAAA,IACF,CAAC;AAAA,EACH,QAAQ;AAAA,EAER;AACA,SAAO;AACT;AAEA,SAAS,0BAA0B,OAAgD;AACjF,MAAI,CAACA,UAAS,KAAK,EAAG,QAAO;AAC7B,QAAM,MAAM,MAAM;AAClB,MAAI,CAACA,UAAS,GAAG,KAAK,CAACA,UAAS,IAAI,gBAAgB,EAAG,QAAO;AAC9D,QAAM,SAAS,IAAI,kBAAkB,OACjC,IAAI,SACJ,OAAO,IAAI,WAAW,WAAW,IAAI,KAAK,IAAI,MAAM,IAAI;AAC5D,MACE,WAAW,UAAa,OAAO,MAAM,OAAO,QAAQ,CAAC,KACrD,OAAO,IAAI,QAAQ,YACnB,OAAO,IAAI,YAAY,YACvB,OAAO,IAAI,SAAS,YACpB,CAAC,MAAM,QAAQ,IAAI,OAAO,KAAK,CAAC,IAAI,QAAQ,MAAM,CAAC,WAAW,OAAO,WAAW,QAAQ,KACxF,OAAO,IAAI,gBAAgB,YAC3B,OAAO,IAAI,iBAAiB,YAC5B,OAAO,IAAI,YAAY,YACvB,OAAO,IAAI,iBAAiB,kBAAkB,UAC9C;AACA,WAAO;AAAA,EACT;AACA,SAAO,EAAE,GAAG,KAAK,OAAO;AAC1B;AAEA,SAAS,UAAU,OAAoC;AACrD,QAAM,MAAMA,UAAS,KAAK,KAAKA,UAAS,MAAM,UAAU,IAAI,MAAM,WAAW,MAAM;AACnF,SAAO,OAAO,QAAQ,WAAW,MAAM;AACzC;AAGA,SAAS,UAAU,OAAoD;AACrE,QAAM,aAAa,MAAM;AACzB,MAAI,CAACA,UAAS,UAAU,KAAK,CAACA,UAAS,WAAW,gBAAgB,EAAG,QAAO;AAC5E,SAAO,KAAK,UAAU,CAAC,WAAW,KAAK,WAAW,iBAAiB,aAAa,CAAC;AACnF;AAEA,SAASA,UAAS,OAAkD;AAClE,SAAO,OAAO,UAAU,YAAY,UAAU,QAAQ,CAAC,MAAM,QAAQ,KAAK;AAC5E;AAndA,IAwDM,mBAOO,eAcP,2BAsQA;AAnVN;AAAA;AAAA;AAYA;AACA;AACA;AACA;AAUA;AA+BA,IAAM,oBAAmD;AAAA,MACvD,WAAW;AAAA,MACX,kBAAkB;AAAA,MAClB,aAAa;AAAA,IACf;AAGO,IAAM,gBAA+C;AAAA,MAC1D,WACE;AAAA,MAEF,kBACE;AAAA,MAEF,aACE;AAAA,IAGJ;AAGA,IAAM,4BAA4B;AAsQlC,IAAM,eAAuC,EAAE,QAAQ,eAAe;AAAA;AAAA;;;ACnVtE,SAAS,KAAAC,UAAS;AAoGlB,SAAS,uBAAuB,QAIoB;AAClD,SAAO;AAAA,IACL,IAAI,OAAO;AAAA,IACX,SAAS;AAAA,IACT,OAAO,OAAO;AAAA,IACd,aAAa,OAAO;AAAA,IACpB,OAAO;AAAA,IACP,QAAQ;AAAA,IACR,SAAS,CAAC,MAAM;AAAA,IAChB,SAAS;AAAA,IACT,UAAU;AAAA,IACV,UAAU;AAAA,IACV,aAAa;AAAA,IACb,WAAW,YAAY,CAAC;AAAA,IACxB,SAAS;AAAA,EACX;AACF;AAEA,eAAe,2BACb,SACA,QACkD;AAClD,QAAM,UAAU,QAAQ,QAAQ;AAChC,MAAI,CAAE,MAAM,oBAAoB,OAAO,EAAI,QAAO,gBAAgB,OAAO;AAEzE,MAAI;AACF,UAAM,CAAC,SAAS,6BAA6B,IAAI,MAAM,QAAQ,IAAI;AAAA,MACjE,YAAqC,OAAO;AAAA,MAC5C,+BAA+B,OAAO;AAAA,IACxC,CAAC;AACD,UAAM,iBAAiB,iBAAiB,OAAO;AAE/C,WAAO;AAAA,MACL,QAAQ;AAAA,MACR,QAAQ;AAAA,QACN;AAAA,QACA,MAAM,QAAQ,QAAQ;AAAA,QACtB,SAAS,QAAQ,QAAQ;AAAA,QACzB,GAAI,QAAQ,QAAQ,iBAAiB,SACjC,CAAC,IACD,EAAE,cAAc,QAAQ,QAAQ,aAAa;AAAA,QACjD,GAAI,QAAQ,QAAQ,iBAAiB,SACjC,CAAC,IACD,EAAE,cAAc,QAAQ,QAAQ,aAAa;AAAA,QACjD,GAAI,QAAQ,QAAQ,eAAe,SAC/B,CAAC,IACD,EAAE,YAAY,QAAQ,QAAQ,WAAW;AAAA,QAC7C,GAAI,QAAQ,QAAQ,aAAa,SAC7B,CAAC,IACD,EAAE,UAAU,QAAQ,QAAQ,SAAS;AAAA,QACzC,GAAI,QAAQ,QAAQ,UAAU,SAAY,CAAC,IAAI,EAAE,OAAO,QAAQ,QAAQ,MAAM;AAAA,QAC9E,SAAS;AAAA,QACT;AAAA,MACF;AAAA,IACF;AAAA,EACF,QAAQ;AAGN,WAAO;AAAA,MACL,QAAQ;AAAA,MACR,OAAO;AAAA,QACL;AAAA,QACA;AAAA,MACF;AAAA,IACF;AAAA,EACF;AACF;AAEA,eAAe,oBAAoB,SAAmC;AACpE,MAAI;AACF,UAAM,gBAAgB,MAAM,YAAqC,OAAO;AACxE,WAAOC,UAAS,aAAa;AAAA,EAC/B,QAAQ;AACN,WAAO;AAAA,EACT;AACF;AAEA,eAAe,+BAA+B,SAAkC;AAC9E,QAAM,kBAAkB,SAAS,wBAAwB;AACzD,QAAM,iBAAiB,MAAM,SAAkB,0BAA0B,OAAO,CAAC;AACjF,MAAI,mBAAmB,KAAM,QAAO;AACpC,MAAI,CAAC,MAAM,QAAQ,cAAc,EAAG,OAAM,IAAI,UAAU,sCAAsC;AAE9F,QAAM,MAAM,KAAK,IAAI;AACrB,QAAM,WAAW,MAAM,yBAAyB,OAAO;AACvD,MAAI,QAAQ;AACZ,aAAW,SAAS,gBAAgB;AAGlC,QAAI,qBAAqB,KAAK,MAAM,UAAW;AAC/C,UAAM,SAAS,uBAAuB,KAAK;AAG3C,QAAI,OAAO,QAAQ,IAAI,OAAO,YAAY,OAAO,QAAQ,MAAM,OAAW,UAAS;AAAA,EACrF;AACA,SAAO;AACT;AAEA,SAAS,iBAAiB,SAAkE;AAC1F,MAAI,YAAY,KAAM,QAAO,EAAE,SAAS,OAAO,SAAS,MAAM,WAAW,KAAK;AAC9E,MAAI,CAACA,UAAS,OAAO,EAAG,OAAM,IAAI,UAAU,wBAAwB;AAEpE,QAAM,SAAS,qBAAqB,OAAO;AAC3C,MAAI,WAAW,KAAM,QAAO,EAAE,SAAS,MAAM,SAAS,MAAM,WAAW,KAAK;AAE5E,SAAO;AAAA,IACL,SAAS;AAAA,IACT,SAAS,OAAO,QAAQ,KAAK,KAAK,IAAI;AAAA,IACtC,WAAW,OAAO,YAAY;AAAA,EAChC;AACF;AAEA,SAAS,uBAAuB,OAAsB;AACpD,MAAI,CAACA,UAAS,KAAK,KAAK,CAACA,UAAS,MAAM,UAAU,KAAK,EAAE,YAAY,MAAM,aAAa;AACtF,UAAM,IAAI,UAAU,4BAA4B;AAAA,EAClD;AACA,SAAO,YAAY,MAAM,WAAW,MAAM;AAC5C;AAEA,SAAS,qBAAqB,SAA+C;AAC3E,aAAW,SAAS,CAAC,aAAa,UAAU,gBAAgB,GAAY;AACtE,QAAI,EAAE,SAAS,YAAY,QAAQ,KAAK,MAAM,UAAa,QAAQ,KAAK,MAAM,KAAM;AACpF,WAAO,YAAY,QAAQ,KAAK,CAAC;AAAA,EACnC;AAEA,MAAI,EAAE,UAAU,YAAY,QAAQ,SAAS,UAAa,QAAQ,SAAS,KAAM,QAAO;AACxF,MAAI,OAAO,QAAQ,SAAS,SAAU,OAAM,IAAI,UAAU,yBAAyB;AACnF,QAAM,QAAQ,QAAQ,KAAK,MAAM,6BAA6B;AAC9D,SAAO,UAAU,OAAO,OAAO,YAAY,MAAM,CAAC,EAAE,KAAK,CAAC;AAC5D;AAEA,SAAS,YAAY,OAAsB;AACzC,QAAM,OAAO,iBAAiB,OAC1B,QACA,OAAO,UAAU,YAAY,OAAO,SAAS,KAAK,IAClD,IAAI,KAAK,QAAQ,KAAK,QAAQ,OAAoB,QAAQ,MAAQ,KAAK,IACvE,OAAO,UAAU,YAAY,MAAM,KAAK,MAAM,KAC9C,IAAI,KAAK,KAAK,IACd;AACJ,MAAI,SAAS,QAAQ,OAAO,MAAM,KAAK,QAAQ,CAAC,EAAG,OAAM,IAAI,UAAU,iBAAiB;AACxF,SAAO;AACT;AAEA,SAAS,gBAAgB,SAAmD;AAC1E,SAAO;AAAA,IACL,QAAQ;AAAA,IACR,OAAO;AAAA,MACL;AAAA,MACA,YAAY,OAAO;AAAA,IACrB;AAAA,EACF;AACF;AAEA,SAASA,UAAS,OAAkD;AAClE,SAAO,OAAO,UAAU,YAAY,UAAU,QAAQ,CAAC,MAAM,QAAQ,KAAK;AAC5E;AAnQA,IAuCM,mBAEA,oBA0BA,iBAOA,iBAOA,oBAMO;AAvFb;AAAA;AAAA;AAUA;AACA;AACA;AA2BA,IAAM,oBAA4CD,GAAE,OAAO,CAAC,CAAC,EAAE,OAAO;AAEtE,IAAM,qBAA8CA,GAAE,OAAO;AAAA,MAC3D,SAASA,GAAE,OAAO,EAAE,IAAI,CAAC;AAAA,MACzB,MAAMA,GAAE,OAAO,EAAE,IAAI,CAAC;AAAA,MACtB,SAASA,GAAE,KAAK;AAAA,QACd;AAAA,QACA;AAAA,QACA;AAAA,QACA;AAAA,MACF,CAAC;AAAA,MACD,cAAcA,GAAE,KAAK,CAAC,SAAS,OAAO,CAAC,EAAE,SAAS;AAAA,MAClD,cAAcA,GAAE,OAAO,EAAE,IAAI,CAAC,EAAE,SAAS;AAAA,MACzC,YAAYA,GAAE,OAAO,EAAE,IAAI,CAAC,EAAE,SAAS;AAAA,MACvC,UAAUA,GAAE,OAAO,EAAE,IAAI,CAAC,EAAE,SAAS;AAAA,MACrC,OAAOA,GAAE,OAAO,EAAE,IAAI,CAAC,EAAE,SAAS;AAAA,MAClC,SAASA,GAAE,OAAO;AAAA,QAChB,SAASA,GAAE,QAAQ;AAAA,QACnB,SAASA,GAAE,QAAQ,EAAE,SAAS;AAAA,QAC9B,WAAWA,GAAE,OAAO,EAAE,SAAS,EAAE,QAAQ,KAAK,CAAC,EAAE,SAAS;AAAA,MAC5D,CAAC,EAAE,OAAO;AAAA,MACV,+BAA+BA,GAAE,OAAO,EAAE,IAAI,EAAE,YAAY,EAAE;AAAA,QAC5D;AAAA,MAGF;AAAA,IACF,CAAC,EAAE,OAAO;AAEV,IAAM,kBAA+C;AAAA,MACnD;AAAA,MACA;AAAA,MACA;AAAA,MACA;AAAA,IACF;AAEA,IAAM,kBAAqC;AAAA,MACzC,KAAK,EAAE,QAAQ,WAAW;AAAA,MAC1B,KAAK,EAAE,QAAQ,WAAW;AAAA,MAC1B,OAAO,EAAE,QAAQ,WAAW;AAAA,MAC5B,MAAM,EAAE,QAAQ,WAAW;AAAA,IAC7B;AAEA,IAAM,qBAA2C,EAAE,OAAO,CAAC,GAAG,QAAQ,CAAC,EAAE;AAMlE,IAAM,6BAAwF;AAAA,MACnG,uBAAuB;AAAA,QACrB,IAAI;AAAA,QACJ,OAAO;AAAA,QACP,aAAa;AAAA,MACf,CAAC;AAAA,MACD,uBAAuB;AAAA,QACrB,IAAI;AAAA,QACJ,OAAO;AAAA,QACP,aAAa;AAAA,MACf,CAAC;AAAA,IACH;AAAA;AAAA;;;AClGA;AAAA;AAAA;AAAA;AAAA;AAqBA,SAAS,iCAA2E;AAGlF,kDAAyB;AAAA,IACvB,GAAG;AAAA,IACH,GAAG;AAAA,IACH,GAAG;AAAA,IACH,GAAG;AAAA,IACH,GAAG;AAAA,EACL;AACA,SAAO;AACT;AAGO,SAAS,iCAA2E;AACzF,SAAO,+BAA+B;AACxC;AAEO,SAAS,gBACd,aACA,kBACiB;AACjB,QAAM,aAAa,+BAA+B,EAAE;AAAA,IAClD,CAACE,gBAAeA,YAAW,OAAO;AAAA,EACpC;AACA,MAAI,WAAW,WAAW,GAAG;AAC3B,WAAO,EAAE,QAAQ,sBAAsB;AAAA,EACzC;AAEA,QAAM,aAAa,WAAW;AAAA,IAC5B,CAAC,cAAc,UAAU,YAAY;AAAA,EACvC;AACA,MAAI,eAAe,QAAW;AAC5B,WAAO;AAAA,MACL,QAAQ;AAAA,MACR,mBAAmB,WAAW,IAAI,CAAC,cAAc,UAAU,OAAO;AAAA,IACpE;AAAA,EACF;AAEA,SAAO,EAAE,QAAQ,SAAS,WAAW;AACvC;AA7DA,IAmBI;AAnBJ;AAAA;AAAA;AACA;AACA;AACA;AACA;AACA;AAAA;AAAA;;;ACmEA,eAAsB,yBACpB,SAA2B,CAAC,GACU;AACtC,QAAM,UAAU,MAAM,mBAAmB,MAAM;AAC/C,MAAI;AACJ,MAAI;AACF,oBAAgB,MAAM,YAA2B,OAAO;AAAA,EAC1D,QAAQ;AACN,WAAOC,iBAAgB,OAAO;AAAA,EAChC;AAEA,MAAI,CAAC,gBAAgB,aAAa,GAAG;AACnC,WAAOA,iBAAgB,OAAO;AAAA,EAChC;AAGA,MAAI,OAAO,eAAe,UAAa,CAAC,kBAAkB,aAAa,GAAG;AACxE,WAAOA,iBAAgB,OAAO;AAAA,EAChC;AAEA,QAAM,OAAO,YAAY,OAAO,MAAM,QAAQ,IAAI,SAAS,cAAc,MAAM,YAAY;AAC3F,QAAM,UAAU,eAAe,aAAa;AAE5C,SAAO;AAAA,IACL,IAAI;AAAA,IACJ,SAAS;AAAA,IACT,SAAS;AAAA,MACP;AAAA,MACA;AAAA,MACA;AAAA,MACA,cAAc,eAAe,cAAc,YAAY,IAAI,cAAc,eAAe;AAAA,MACxF,cAAc,SAAS,cAAc,GAAG;AAAA,MACxC,YAAY,SAAS,cAAc,UAAU;AAAA,MAC7C,UAAU,SAAS,cAAc,QAAQ;AAAA,MACzC,OAAO,OAAO,cAAc,YAAY,WAAW,cAAc,UAAU;AAAA,IAC7E;AAAA,EACF;AACF;AAeA,eAAe,mBAAmB,QAA2C;AAC3E,MAAI,OAAO,OAAO,YAAY,SAAU,QAAO,OAAO;AACtD,MAAI,OAAO,QAAQ,IAAI,eAAe,SAAU,QAAO,QAAQ,IAAI;AAEnE,MAAI;AACF,UAAM,SAAS,MAAM,SAAuB,oBAAoB,CAAC;AACjE,QAAI,OAAO,QAAQ,mBAAmB,SAAU,QAAO,OAAO;AAAA,EAChE,QAAQ;AAAA,EAGR;AACA,SAAO;AACT;AAGO,SAAS,eAAe,SAA0E;AACvG,MAAI,UAAU,QAAQ,OAAO,EAAG,QAAO,QAAQ;AAC/C,MAAI,QAAQ,eAAe,QAAS,QAAO;AAC3C,SAAO;AACT;AAEA,SAASA,iBAAgB,SAAsE;AAC7F,SAAO;AAAA,IACL,IAAI;AAAA,IACJ,OAAO;AAAA,MACL,MAAM;AAAA,MACN,SAAS,YAAY,OAAO;AAAA,MAC5B,WAAW;AAAA,IACb;AAAA,EACF;AACF;AAEA,SAAS,eAAe,QAA2B;AACjD,aAAW,SAAS,QAAQ;AAC1B,QAAI,OAAO,UAAU,YAAY,MAAM,SAAS,EAAG,QAAO;AAAA,EAC5D;AACA,SAAO;AACT;AAEA,SAAS,SAAS,OAAoC;AACpD,MAAI,OAAO,UAAU,YAAY,MAAM,WAAW,EAAG,QAAO;AAC5D,QAAM,WAAW,MAAM,QAAQ,GAAG;AAClC,SAAO,aAAa,KAAK,QAAQ,MAAM,MAAM,GAAG,QAAQ;AAC1D;AAEA,SAAS,UAAU,OAA2C;AAC5D,SAAO,UAAU,mBACf,UAAU,sBACV,UAAU,qBACV,UAAU;AACd;AAEA,SAAS,eAAe,OAAgD;AACtE,SAAO,UAAU,WAAW,UAAU;AACxC;AAOA,SAAS,gBAAgB,OAAwC;AAC/D,SAAOC,UAAS,KAAK,KACnB,iBAAiB,MAAM,IAAI,KAC3B,iBAAiB,MAAM,IAAI,KAC3B,OAAO,MAAM,YAAY,YACzB,OAAO,SAAS,MAAM,OAAO,KAC7B,iBAAiB,MAAM,SAAS,KAChC,iBAAiB,MAAM,GAAG,KAC1B,iBAAiB,MAAM,SAAS,KAChC,yBAAyB,MAAM,UAAU,KACzC,yBAAyB,MAAM,QAAQ,KACvC,yBAAyB,MAAM,OAAO,KACtC,kBAAkB,MAAM,OAAO,KAC/B,uBAAuB,MAAM,YAAY,KACzC,qBAAqB,MAAM,UAAU,KACrC,yBAAyB,MAAM,YAAY,KAC3C,yBAAyB,MAAM,UAAU,KACzC,yBAAyB,MAAM,OAAO,KACtC,yBAAyB,MAAM,WAAW;AAC9C;AAEA,SAASA,UAAS,OAAkD;AAClE,SAAO,OAAO,UAAU,YAAY,UAAU,QAAQ,CAAC,MAAM,QAAQ,KAAK;AAC5E;AAEA,SAAS,iBAAiB,OAAiC;AACzD,SAAO,OAAO,UAAU,YAAY,MAAM,SAAS;AACrD;AAEA,SAAS,yBAAyB,OAAyB;AACzD,SAAO,UAAU,UAAa,iBAAiB,KAAK;AACtD;AAEA,SAAS,kBAAkB,OAAyB;AAClD,SAAO,UAAU,UAAa,UAAU,KAAK;AAC/C;AAEA,SAAS,uBAAuB,OAAyB;AACvD,SAAO,UAAU,UAAa,eAAe,KAAK;AACpD;AAEA,SAAS,qBAAqB,OAAyB;AACrD,SAAO,UAAU,UAAa,UAAU,aAAa,UAAU;AACjE;AAOA,SAAS,kBAAkB,SAAiC;AAC1D,MAAI,QAAQ,eAAe,SAAS;AAClC,WAAO,QAAQ,YAAY,UAAa,QAAQ,YAAY;AAAA,EAC9D;AACA,MAAI,QAAQ,YAAY,mBAAmB;AACzC,WAAO,QAAQ,eAAe;AAAA,EAChC;AACA,SAAO;AACT;AAnPA,IAaM;AAbN;AAAA;AAAA;AAAA;AAaA,IAAM,eAAe;AAAA;AAAA;;;ACbrB;AAAA;AAAA;AAAA;AAKA,YAAYC,cAAa;AAsEzB,eAAsB,wBACpB,QACA,cAA2C,iBACL;AACtC,QAAM,WAAW,MAAM,yBAAyB,MAAM;AACtD,MAAI,CAAC,SAAS,IAAI;AAChB,WAAO;AAAA,MACL,IAAI;AAAA,MACJ,SAAS,kBAAkB,MAAM;AAAA,MACjC,OAAO,SAAS;AAAA,IAClB;AAAA,EACF;AAEA,QAAM,UAAU,SAAS;AACzB,MAAI,gBAAgB,cAAc;AAChC,WAAO,EAAE,IAAI,MAAM,SAAS,EAAE,QAAQ,EAAE;AAAA,EAC1C;AAEA,QAAM,cAAc,QAAQ;AAC5B,MAAI;AAGF,UAAM;AAAA,MACJ,eAAe;AAAA,IACjB,IAAIA;AACJ,UAAM,6BAA6B,OAAO,OAAO,eAAe;AAChE,UAAM,CAAC,SAAS,GAAG,IAAI,6BACnB,CAAC,MAAM,IAAI,IACX,MAAM,QAAQ,IAAI;AAAA,MAClB,YAA2B,WAAW;AAAA,MACtC,SAAkC,GAAG,YAAY,WAAW,CAAC,WAAW;AAAA,IAC1E,CAAC;AACH,UAAM,UAAU,SAAS;AAMzB,UAAM,gBAAgB,eAAe,OAAO;AAC5C,QAAI,CAAC,8BAA8B,kBAAkB,QAAQ,SAAS;AACpE,aAAO;AAAA,QACL,EAAE,GAAG,SAAS,SAAS,cAAc;AAAA,QACrC;AAAA,UACE;AAAA,UACA;AAAA,QACF;AAAA,MACF;AAAA,IACF;AAEA,UAAM,aAAa,OAAO,OAAO,eAAe,WAC5C,OAAO,aACP,OAAO,QAAQ,eAAe,WAC9B,QAAQ,aACR;AACJ,UAAM,kBAAkB,8BAA8B,QAAQ,eAAe,UACzE,oBACA,QAAQ;AACZ,QAAI,oBAAoB,QAAQ,WAAW,CAAC,4BAA4B;AACtE,aAAO;AAAA,QACL,EAAE,GAAG,SAAS,SAAS,gBAAgB;AAAA,QACvC;AAAA,UACE;AAAA,UACA;AAAA,QACF;AAAA,MACF;AAAA,IACF;AACA,UAAM,OAAO,IAAI,yBAAyB;AAAA,MACxC,MAAM,QAAQ;AAAA,MACd,GAAI,eAAe,SAAY,CAAC,IAAI,EAAE,WAAW;AAAA,IACnD,CAAC;AAED,UAAM,gBAAgB,YAAY,OAAO,SAAY,iBAAiB,SAAS,GAAG;AAClF,QAAI,4BAA4B;AAG9B,YAAM,KAAK,OAAO;AAAA,IACpB,WAAW,kBAAkB,QAAW;AACtC,UAAI,QAAQ,eAAe,WAAW,eAAe,QAAW;AAC9D,cAAM,KAAK,OAAO;AAAA,MACpB,OAAO;AACL,eAAO,OAAO,SAAS;AAAA,UACrB;AAAA,UACA;AAAA,QACF,CAAC;AAAA,MACH;AAAA,IACF,OAAO;AACL,UAAI;AACF,cAAM,KAAK,eAAe,aAAa;AAAA,MACzC,SAAS,OAAO;AAKd,YAAIC,UAAS,KAAK,KAAK,MAAM,SAAS,gBAAgB;AACpD,iBAAO,OAAO,SAAS;AAAA,YACrB;AAAA,YACA;AAAA,YACA,EAAE,WAAW,MAAM;AAAA,UACrB,CAAC;AAAA,QACH;AACA,cAAM;AAAA,MACR;AAAA,IACF;AAKA,UAAM,mBAAmB,aAAa,KAAK,UAAU;AACrD,UAAM,mBAAmB,aAAa,KAAK,GAAG;AAC9C,UAAM,qBAAqB,6BACvB,+BAA+B,gBAAgB,IAC/C;AAGJ,UAAM,kBAAqC,CAAC,GAAG,KAAK,+BAA+B,CAAC;AACpF,UAAMC,gBAAe,uBAAuB,MAAM,sBAAsB,QAAQ,KAAK;AACrF,UAAM,WAAW,oBAAI,IAAY;AACjC,UAAM,WAA+B,CAAC;AAGtC,QAAI,CAAC,4BAA4B;AAC/B,YAAM,YAAY;AAGlB,YAAM,WAAW,MAAM,8BAA8B,aAAa,WAAW;AAAA,QAC3E,MAAM,QAAQ;AAAA;AAAA;AAAA,QAGd,SAAS,kBAAkB;AAAA,MAC7B,CAAC;AAGD,iBAAW,SAAS,MAAM,0BAAmC,WAAW,GAAG;AACzE,cAAM,SAAS,MAAM,uBAAuB,WAAW,OAAO;AAAA,UAC5D,MAAM,QAAQ;AAAA,UACd;AAAA,UACA,cAAAA;AAAA,QACF,CAAC;AACD,YAAI,OAAO,WAAW,aAAa;AACjC,cAAI,CAAC,SAAS,IAAI,OAAO,WAAW,GAAG,GAAG;AACxC,qBAAS,IAAI,OAAO,WAAW,GAAG;AAClC,4BAAgB,KAAK,GAAG,OAAO,WAAW,oBAAoB;AAAA,UAChE;AAAA,QACF,WAAW,OAAO,WAAW,WAAW;AAKtC,mBAAS,KAAK,oBAAoB,MAAM,OAAO,OAAO,MAAM,CAAC;AAAA,QAC/D;AAAA,MACF;AAAA,IACF;AAEA,UAAM,UAA4B;AAAA,MAChC;AAAA,MACA,SAAS,yBAAyB,eAAe;AAAA,MACjD,GAAI,SAAS,WAAW,IAAI,CAAC,IAAI,EAAE,SAAS;AAAA,IAC9C;AACA,WAAO;AAAA,MACL,IAAI;AAAA,MACJ,SAAS;AAAA,QACP,SAAS;AAAA,UACP,GAAG;AAAA,UACH,SAAS;AAAA,UACT,GAAI,qBAAqB,SAAY,CAAC,IAAI,EAAE,cAAc,iBAAiB;AAAA,UAC3E,GAAI,8BAA8B,qBAAqB,SACnD,EAAE,UAAU,iBAAiB,IAC7B,CAAC;AAAA,UACL,GAAI,uBAAuB,SAAY,CAAC,IAAI,EAAE,OAAO,mBAAmB;AAAA,UACxE,GAAI,qBAAqB,SAAY,CAAC,IAAI,EAAE,YAAY,iBAAiB;AAAA,QAC3E;AAAA,QACA;AAAA,MACF;AAAA,IACF;AAAA,EACF,QAAQ;AACN,WAAO,OAAO,SAAS;AAAA,MACrB;AAAA,MACA;AAAA,MACA,EAAE,WAAW,KAAK;AAAA,IACpB,CAAC;AAAA,EACH;AACF;AAOA,SAAS,oBAAoB,MAAe,OAAgB,QAAiD;AAC3G,QAAM,WAAW,kBAAkB,MAAM,KAAK;AAC9C,SAAO,EAAE,MAAM,wBAAwB,QAAQ,GAAI,aAAa,SAAY,CAAC,IAAI,EAAE,SAAS,EAAG;AACjG;AAEA,SAAS,kBAAkB,MAAe,OAAoC;AAC5E,QAAM,aAAaD,UAAS,KAAK,KAAKA,UAAS,MAAM,UAAU,IAAI,MAAM,aAAa;AACtF,QAAM,SAASA,UAAS,YAAY,gBAAgB,IAAI,WAAW,mBAAmB;AACtF,QAAM,MAAM,YAAY;AACxB,QAAM,uBAAuBA,UAAS,IAAI,IAAI,KAAK,uBAAuB;AAC1E,MAAI,OAAO,QAAQ,YAAY,OAAO,QAAQ,kBAAkB,YAAY,OAAO,yBAAyB,YAAY;AACtH,WAAO;AAAA,EACT;AACA,MAAI;AACF,WAAO,qBAAqB,KAAK,MAAM,OAAO,aAAa,MAAM,OAAO,eAAe,KAAK,GAAG,IAAI,MAAM;AAAA,EAC3G,QAAQ;AACN,WAAO;AAAA,EACT;AACF;AAIA,SAAS,+BAA+BE,YAAmD;AACzF,MAAIA,eAAc,OAAW,QAAO;AACpC,MAAI;AACF,UAAM,MAAc,qBAAYA,UAAS;AACzC,WAAO,QAAQ,OAAO,SAAoB,wBAAe,IAAI,SAAS,IAAI,SAAS,SAAS;AAAA,EAC9F,QAAQ;AACN,WAAO;AAAA,EACT;AACF;AAEA,SAAS,iBACP,SACA,KAC4D;AAC5D,QAAM,SAAS,QAAQ;AACvB,QAAM,MAAM,oBAAoB,QAAQ,GAAG,IAAI,QAAQ,MAAM;AAC7D,MACE,CAACF,UAAS,MAAM,KAChB,OAAO,OAAO,kBAAkB,YAChC,OAAO,QAAQ,kBAAkB,YACjC,OAAO,QAAQ,YAAY,YAC3B,CAAC,oBAAoB,GAAG,KACxB,OAAO,QAAQ,uBAAuB,UACtC;AACA,WAAO;AAAA,EACT;AAEA,SAAO;AAAA,IACL,kBAAkB,EAAE,eAAe,OAAO,cAAc;AAAA,IACxD,eAAe,QAAQ;AAAA,IACvB,SAAS,QAAQ;AAAA,IACjB;AAAA,IACA,oBAAoB,QAAQ;AAAA,IAC5B,GAAI,OAAO,QAAQ,YAAY,WAAW,EAAE,SAAS,QAAQ,QAAQ,IAAI,CAAC;AAAA,IAC1E,GAAI,OAAO,QAAQ,YAAY,WAAW,EAAE,SAAS,QAAQ,QAAQ,IAAI,CAAC;AAAA,IAC1E,GAAI,OAAO,QAAQ,SAAS,WAAW,EAAE,MAAM,QAAQ,KAAK,IAAI,CAAC;AAAA,IACjE,GAAI,OAAO,QAAQ,cAAc,WAAW,EAAE,WAAW,QAAQ,UAAU,IAAI,CAAC;AAAA,IAChF,GAAI,MAAM,QAAQ,QAAQ,cAAc,KAAK,QAAQ,eAAe,MAAM,CAAC,SAAS,OAAO,SAAS,QAAQ,IACxG,EAAE,gBAAgB,QAAQ,eAAe,IACzC,CAAC;AAAA,EACP;AACF;AAEA,SAAS,oBAAoB,OAAkD;AAC7E,SAAOA,UAAS,KAAK,KAAK,OAAO,MAAM,MAAM,YAAY,MAAM,EAAE,SAAS;AAC5E;AAEA,SAAS,aAAa,OAA+C;AACnE,MAAI,OAAO,UAAU,YAAY,MAAM,WAAW,EAAG,QAAO;AAC5D,SAAO,MAAM,MAAM,KAAK,CAAC,EAAE,CAAC;AAC9B;AAEA,SAASA,UAAS,OAAkD;AAClE,SAAO,OAAO,UAAU,YAAY,UAAU,QAAQ,CAAC,MAAM,QAAQ,KAAK;AAC5E;AAEA,SAAS,OACP,SACA,OAC6B;AAC7B,SAAO,EAAE,IAAI,OAAO,SAAS,MAAM;AACrC;AAEA,SAAS,kBAAkB,QAA8D;AACvF,SAAO;AAAA,IACL,SAAS,OAAO,WAAW;AAAA,IAC3B,MAAM,OAAO,QAAQ;AAAA,IACrB,SAAS;AAAA,EACX;AACF;AAlWA,IA2RM;AA3RN;AAAA;AAAA;AAOA;AAUA;AACA;AACA;AACA;AACA;AAOA;AA+PA,IAAM,iBAAiB,IAAI,OAAO,sBAAsB;AAAA;AAAA;;;AC3RxD,SAAS,kBAAkB;AAC3B,SAAS,cAAAG,mBAAkB;AAE3B;AAAA,EACE,kBAAAC;AAAA,EACA,eAAAC;AAAA,EACA,iBAAAC;AAAA,OAEK;;;ACEA,IAAM,2BAAN,cAAuC,MAAM;AAAA,EAGlD,YAAY,MAA6B,SAAiB;AACxD,UAAM,OAAO;AACb,SAAK,OAAO;AACZ,SAAK,OAAO;AAAA,EACd;AACF;AASO,IAAM,oCAAN,cAAgD,yBAAyB;AAAA,EAC9E,YAAY,SAAiB;AAC3B,UAAM,6BAA6B,OAAO;AAC1C,SAAK,OAAO;AAAA,EACd;AACF;;;ACrBA,IAAM,eACH,OAEE,UACF,OAAO,UAAU,eAAe,KAAK;AAAA,EACpC,OAAO,UAAU;AACnB;AAWK,SAAS,gBAAgB,OAAwB;AACtD,SAAO,UAAU,cAAc,OAAO,GAAG,CAAC;AAC5C;AAEO,SAAS,cAAc,OAAgB,OAAO,KAAgB;AACnE,MAAI,UAAU,MAAM;AAClB,WAAO;AAAA,EACT;AAEA,UAAQ,OAAO,OAAO;AAAA,IACpB,KAAK;AACH,aAAO;AAAA,IACT,KAAK;AACH,UAAI,CAAC,OAAO,SAAS,KAAK,GAAG;AAC3B,cAAM,IAAI;AAAA,UACR,GAAG,IAAI;AAAA,QACT;AAAA,MACF;AACA,aAAO;AAAA,IACT,KAAK;AACH,gCAA0B,OAAO,IAAI;AACrC,aAAO;AAAA,IACT,KAAK;AACH,aAAO,2BAA2B,OAAO,IAAI;AAAA,IAC/C,KAAK;AAAA,IACL,KAAK;AAAA,IACL,KAAK;AAAA,IACL,KAAK;AAAA,IACL;AACE,YAAM,IAAI;AAAA,QACR,GAAG,IAAI;AAAA,MACT;AAAA,EACJ;AACF;AAEO,SAAS,UAAU,OAA0B;AAClD,MAAI,UAAU,MAAM;AAClB,WAAO;AAAA,EACT;AAEA,UAAQ,OAAO,OAAO;AAAA,IACpB,KAAK;AACH,aAAO,QAAQ,SAAS;AAAA,IAC1B,KAAK,UAAU;AACb,YAAM,UAAU,KAAK,UAAU,KAAK;AACpC,UAAI,YAAY,QAAW;AACzB,cAAM,IAAI;AAAA,UACR;AAAA,QACF;AAAA,MACF;AACA,aAAO;AAAA,IACT;AAAA,IACA,KAAK;AACH,aAAO,KAAK,UAAU,KAAK;AAAA,IAC7B,KAAK;AACH,UAAI,MAAM,QAAQ,KAAK,GAAG;AACxB,eAAO,IAAI,MAAM,IAAI,CAAC,SAAS,UAAU,IAAI,CAAC,EAAE,KAAK,GAAG,CAAC;AAAA,MAC3D;AACA,aAAO,gBAAgB,KAAK;AAAA,IAC9B;AACE,YAAM,IAAI;AAAA,QACR,+BAA+B,OAAO,KAAK;AAAA,MAC7C;AAAA,EACJ;AACF;AAEA,SAAS,2BAA2B,OAAe,MAAyB;AAC1E,qBAAmB,OAAO,IAAI;AAE9B,MAAI,MAAM,QAAQ,KAAK,GAAG;AACxB,eAAW,OAAO,OAAO,oBAAoB,KAAK,GAAG;AACnD,UAAI,QAAQ,UAAU;AACpB;AAAA,MACF;AACA,UAAI,CAAC,gBAAgB,KAAK,MAAM,MAAM,GAAG;AACvC,cAAM,IAAI;AAAA,UACR,GAAG,IAAI,IAAI,GAAG;AAAA,QAChB;AAAA,MACF;AACA,YAAM,aAAa,OAAO,yBAAyB,OAAO,GAAG;AAC7D,UAAI,YAAY,eAAe,MAAM;AACnC,cAAM,IAAI;AAAA,UACR,GAAG,IAAI,IAAI,GAAG;AAAA,QAChB;AAAA,MACF;AACA,UAAI,EAAE,WAAW,aAAa;AAC5B,cAAM,IAAI;AAAA,UACR,GAAG,IAAI,IAAI,GAAG;AAAA,QAChB;AAAA,MACF;AAAA,IACF;AACA,UAAMC,UAAsB,CAAC;AAC7B,aAAS,QAAQ,GAAG,QAAQ,MAAM,QAAQ,SAAS;AACjD,UAAI,CAAC,aAAa,OAAO,KAAK,GAAG;AAC/B,cAAM,IAAI;AAAA,UACR,GAAG,IAAI,IAAI,KAAK;AAAA,QAClB;AAAA,MACF;AACA,MAAAA,QAAO,KAAK,cAAc,MAAM,KAAK,GAAG,GAAG,IAAI,IAAI,KAAK,GAAG,CAAC;AAAA,IAC9D;AACA,WAAOA;AAAA,EACT;AAEA,QAAM,QAAQ,OAAO,eAAe,KAAK;AACzC,MAAI,UAAU,OAAO,aAAa,UAAU,MAAM;AAChD,UAAM,IAAI;AAAA,MACR,GAAG,IAAI;AAAA,IACT;AAAA,EACF;AAEA,QAAM,SAAS,uBAAO,OAAO,IAAI;AACjC,aAAW,OAAO,OAAO,oBAAoB,KAAK,GAAG;AACnD,8BAA0B,KAAK,GAAG,IAAI,MAAM;AAC5C,QAAI,QAAQ,eAAe,QAAQ,eAAe;AAChD,YAAM,IAAI;AAAA,QACR,GAAG,IAAI,IAAI,GAAG;AAAA,MAChB;AAAA,IACF;AACA,UAAM,aAAa,OAAO,yBAAyB,OAAO,GAAG;AAC7D,QAAI,YAAY,eAAe,MAAM;AACnC,YAAM,IAAI;AAAA,QACR,GAAG,IAAI,IAAI,GAAG;AAAA,MAChB;AAAA,IACF;AACA,QAAI,EAAE,WAAW,aAAa;AAC5B,YAAM,IAAI;AAAA,QACR,GAAG,IAAI,IAAI,GAAG;AAAA,MAChB;AAAA,IACF;AACA,UAAM,QAAQ,WAAW;AACzB,WAAO,GAAG,IAAI,cAAc,OAAO,GAAG,IAAI,IAAI,GAAG,EAAE;AAAA,EACrD;AACA,SAAO;AACT;AAEA,SAAS,mBAAmB,OAAe,MAAoB;AAC7D,MAAI,OAAO,sBAAsB,KAAK,EAAE,SAAS,GAAG;AAClD,UAAM,IAAI;AAAA,MACR,GAAG,IAAI;AAAA,IACT;AAAA,EACF;AACF;AAEA,SAAS,gBAAgB,KAAa,QAAyB;AAC7D,MAAI,CAAC,iBAAiB,KAAK,GAAG,GAAG;AAC/B,WAAO;AAAA,EACT;AACA,QAAM,QAAQ,OAAO,GAAG;AACxB,SAAO,OAAO,cAAc,KAAK,KAAK,SAAS,KAAK,QAAQ;AAC9D;AAEA,SAAS,gBAAgB,OAAsD;AAC7E,QAAM,OAAO,OAAO,KAAK,KAAK,EAAE,KAAK,qBAAqB;AAC1D,QAAM,QAAQ,KAAK,IAAI,CAAC,QAAQ,GAAG,KAAK,UAAU,GAAG,CAAC,IAAI,UAAU,MAAM,GAAG,CAAC,CAAC,EAAE;AACjF,SAAO,IAAI,MAAM,KAAK,GAAG,CAAC;AAC5B;AAEA,SAAS,sBAAsB,GAAW,GAAmB;AAC3D,QAAM,MAAM,KAAK,IAAI,EAAE,QAAQ,EAAE,MAAM;AACvC,WAAS,QAAQ,GAAG,QAAQ,KAAK,SAAS;AACxC,UAAM,eAAe,EAAE,WAAW,KAAK;AACvC,UAAM,gBAAgB,EAAE,WAAW,KAAK;AACxC,QAAI,iBAAiB,eAAe;AAClC,aAAO,eAAe;AAAA,IACxB;AAAA,EACF;AACA,SAAO,EAAE,SAAS,EAAE;AACtB;AAEA,SAAS,0BAA0B,OAAe,MAAoB;AACpE,WAAS,QAAQ,GAAG,QAAQ,MAAM,QAAQ,SAAS;AACjD,UAAM,OAAO,MAAM,WAAW,KAAK;AACnC,QAAI,QAAQ,SAAU,QAAQ,OAAQ;AACpC,YAAM,OAAO,MAAM,WAAW,QAAQ,CAAC;AACvC,UAAI,OAAO,MAAM,IAAI,KAAK,OAAO,SAAU,OAAO,OAAQ;AACxD,cAAM,IAAI;AAAA,UACR,GAAG,IAAI;AAAA,QACT;AAAA,MACF;AACA;AACA;AAAA,IACF;AACA,QAAI,QAAQ,SAAU,QAAQ,OAAQ;AACpC,YAAM,IAAI;AAAA,QACR,GAAG,IAAI;AAAA,MACT;AAAA,IACF;AAAA,EACF;AACF;;;AFjMA;AAMA;AAMA;;;AG5BO,SAAS,eAAe,OAAoC;AACjE,MAAI,OAAO,UAAU,YAAY,MAAM,WAAW,EAAG,QAAO;AAE5D,MAAI;AACJ,MAAI;AACF,aAAS,IAAI,IAAI,KAAK;AAAA,EACxB,QAAQ;AACN,WAAO;AAAA,EACT;AAEA,MACG,OAAO,aAAa,WAAW,OAAO,aAAa,YACpD,OAAO,aAAa,MACpB,OAAO,aAAa,MACpB,OAAO,WAAW,MAClB,OAAO,SAAS,MACf,OAAO,aAAa,MAAM,OAAO,aAAa,OAC/C,OAAO,WAAW,QAClB;AACA,WAAO;AAAA,EACT;AAEA,QAAM,0BAA0B,GAAG,OAAO,MAAM;AAChD,MAAI,UAAU,OAAO,UAAU,UAAU,yBAAyB;AAChE,WAAO;AAAA,EACT;AACA,SAAO,OAAO;AAChB;AAEO,SAAS,eAAe,OAAoC;AACjE,MAAI,OAAO,UAAU,YAAY,MAAM,WAAW,EAAG,QAAO;AAE5D,QAAM,CAACC,YAAW,UAAU,GAAG,KAAK,IAAI,MAAM,MAAM,GAAG;AACvD,MACE,MAAM,SAAS,KACd,aAAa,UAAa,CAAC,qBAAqB,KAAK,QAAQ,GAC9D;AACA,WAAO;AAAA,EACT;AAEA,MAAI,gBAAgBA,UAAS,KAAK,eAAeA,UAAS,GAAG;AAC3D,WAAOA;AAAA,EACT;AACA,SAAO;AACT;AAEA,SAAS,gBAAgB,OAAwB;AAC/C,MAAI,CAAC,MAAM,WAAW,WAAW,EAAG,QAAO;AAC3C,QAAM,QAAQ,aAAa,MAAM,MAAM,YAAY,MAAM,CAAC;AAC1D,SACE,UAAU,UACV,MAAM,WAAW,MACjB,MAAM,CAAC,MAAM,OACb,MAAM,CAAC,MAAM;AAEjB;AAEA,SAAS,eAAe,OAAwB;AAC9C,SAAO,iDAAiD,KAAK,KAAK;AACpE;AAEA,SAAS,aAAa,OAAuC;AAC3D,MAAI,MAAM,WAAW,EAAG,QAAO;AAC/B,QAAM,WAAW;AACjB,QAAM,SAAS,CAAC,CAAC;AACjB,aAAW,aAAa,OAAO;AAC7B,UAAM,QAAQ,SAAS,QAAQ,SAAS;AACxC,QAAI,QAAQ,EAAG,QAAO;AACtB,QAAI,QAAQ;AACZ,aAAS,IAAI,GAAG,IAAI,OAAO,QAAQ,KAAK,GAAG;AACzC,eAAS,OAAO,CAAC,IAAK;AACtB,aAAO,CAAC,IAAI,QAAQ;AACpB,gBAAU;AAAA,IACZ;AACA,WAAO,QAAQ,GAAG;AAChB,aAAO,KAAK,QAAQ,GAAI;AACxB,gBAAU;AAAA,IACZ;AAAA,EACF;AACA,aAAW,aAAa,OAAO;AAC7B,QAAI,cAAc,IAAK;AACvB,WAAO,KAAK,CAAC;AAAA,EACf;AACA,SAAO,WAAW,KAAK,OAAO,QAAQ,CAAC;AACzC;;;ACDO,SAAS,qBACd,aACA,OACgB;AAChB,QAAM,UACJ,MAAM,YAAY,SACd,SACA,uBAAuB,MAAM,MAAM,MAAM,OAAO;AAEtD,SAAO;AAAA,IACL,MAAM,MAAM;AAAA,IACZ,SAAS,MAAM;AAAA,IACf,WAAW,MAAM;AAAA,IACjB,GAAI,YAAY,SACZ,CAAC,IACD;AAAA,MACE,SAAS,SAAS,OAAO,IAAI,UAAU,EAAE,UAAU,QAAQ;AAAA,IAC7D;AAAA,EACN;AACF;AAQA,IAAM,6BAOF;AAAA,EACF,eAAe;AAAA,IACb,QAAQ,CAAC,UACP,MAAM,QAAQ,KAAK,IAAI,eAAe,KAAK,IAAI;AAAA,EACnD;AAAA,EACA,+BAA+B;AAAA,IAC7B,mBAAmB,CAAC,UAClB,MAAM,QAAQ,KAAK,KAAK,MAAM,MAAM,CAAC,SAAS,OAAO,UAAU,IAAI,CAAC,IAChE,QACA;AAAA,EACR;AAAA,EACA,8BAA8B;AAAA,IAC5B,oBAAoB;AAAA,IACpB,kBAAkB;AAAA,EACpB;AAAA,EACA,0BAA0B;AAAA,IACxB,cAAc;AAAA,IACd,cAAc;AAAA,EAChB;AAAA,EACA,wBAAwB;AAAA,IACtB,SAAS;AAAA,EACX;AACF;AAGA,SAAS,mBAAmB,OAAqC;AAC/D,MAAI,CAAC,SAAS,KAAK,EAAG,QAAO;AAC7B,QAAM,EAAE,WAAW,YAAY,KAAK,IAAI;AACxC,MACE,CAAC,OAAO,cAAc,SAAS,KAAM,YAAuB,KAC5D,CAAC,OAAO,cAAc,UAAU,KAAM,cAAyB,GAC/D;AACA,WAAO;AAAA,EACT;AACA,SAAO,OAAO,SAAS,YAAY,qCAAqC,KAAK,IAAI,IAC7E,EAAE,WAAW,YAAY,KAAK,IAC9B,EAAE,WAAW,WAAW;AAC9B;AAEA,SAAS,uBACP,MACA,SAC+C;AAC/C,QAAM,SAAS,2BAA2B,IAAI;AAC9C,MAAI,WAAW,OAAW,QAAO;AAEjC,QAAM,cAAuC,CAAC;AAC9C,aAAW,CAAC,KAAK,QAAQ,KAAK,OAAO,QAAQ,MAAM,GAAG;AACpD,QAAI,CAAC,OAAO,SAAS,GAAG,EAAG;AAC3B,UAAM,QAAQ,SAAS,QAAQ,GAAG,CAAC;AACnC,QAAI,UAAU,OAAW,aAAY,GAAG,IAAI;AAAA,EAC9C;AACA,SAAO,OAAO,KAAK,WAAW,EAAE,WAAW,IAAI,SAAY;AAC7D;AAEA,SAAS,eACP,OACmD;AACnD,QAAM,QAAQ,MAAM,IAAI,CAAC,UAAU;AACjC,QAAI,CAAC,SAAS,KAAK,KAAK,OAAO,MAAM,SAAS,SAAU,QAAO;AAC/D,WAAO,iBAAiB,IAAI,MAAM,IAAI,IAAI,EAAE,MAAM,MAAM,KAAK,IAAI;AAAA,EACnE,CAAC;AACD,SAAO,MAAM;AAAA,IACX,CAAC,UAA+C,UAAU;AAAA,EAC5D,IACI,QACA;AACN;AAEA,IAAM,mBAAmB,oBAAI,IAAI;AAAA,EAC/B;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AACF,CAAC;AA0ED,SAAS,OAAO,OAAe,KAAsB;AACnD,SAAO,OAAO,UAAU,eAAe,KAAK,OAAO,GAAG;AACxD;AAEA,SAAS,SAAS,OAA4D;AAC5E,SAAO,UAAU,QAAQ,OAAO,UAAU,YAAY,CAAC,MAAM,QAAQ,KAAK;AAC5E;;;AJxPA;AAEA;AAsCA,eAAsB,uCACpB,aACA,kBACA,kBACA,cACmC;AACnC,QAAM,SAAS,0BAA0B,gBAAgB;AACzD,MAAI,WAAW,QAAW;AACxB,WAAO;AAAA,MACL,EAAE,aAAa,iBAAiB;AAAA,MAChC,yBAAyB;AAAA,MACzB,eAAe,iBAAiB,mCAAmC;AAAA,IACrE;AAAA,EACF;AACA,MAAI,OAAO,OAAO,eAAe,YAAY,OAAO,WAAW,WAAW,GAAG;AAC3E,WAAO;AAAA,MACL,EAAE,aAAa,iBAAiB;AAAA,MAChC,yBAAyB,MAAM;AAAA,MAC/B;AAAA,QACE;AAAA,QACA;AAAA,MACF;AAAA,IACF;AAAA,EACF;AAEA,SAAO;AAAA,IAAuB,OAAO;AAAA,IAAW,MAC9C;AAAA,MACE;AAAA,MACA;AAAA,MACA;AAAA,MACA;AAAA,IACF;AAAA,EACF;AACF;AAEA,eAAe,0BACb,aACA,kBACA,QACA,cACmC;AACnC,QAAM,WAAW,MAAM;AAAA,IACrB;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,EACF;AACA,MAAI,gBAAgB,QAAQ,EAAG,QAAO,SAAS;AAC/C,SAAO,oBAAoB,MAAM,wBAAwB,QAAQ,GAAG,QAAQ;AAC9E;AAEA,eAAe,wBACb,UACmC;AACnC,MACE,SAAS,UAAU,gBAAgB,2BACnC,SAAS,UAAU,qBAAqB,GACxC;AACA,WAAO;AAAA,MACL,SAAS;AAAA,MACT,SAAS,kBAAkB,QAAQ;AAAA,MACnC;AAAA,QACE;AAAA,QACA;AAAA,MACF;AAAA,IACF;AAAA,EACF;AAEA,QAAMC,kBAAiB,SAAS,kBAAkB;AAClD,MAAIA,gBAAe,YAAY,OAAW,QAAO,6BAA6B,QAAQ;AACtF,QAAM,mBAAmBA;AACzB,MAAI;AACJ,MAAI;AACF,cAAUC,mBAAkB,MAAM,SAAS,WAAW;AAAA,MACpD;AAAA,MACA,SAAS,YAAY;AAAA,IACvB,CAAC;AAAA,EACH,QAAQ;AACN,WAAO;AAAA,MACL,SAAS;AAAA,MACT,iBAAiB;AAAA,MACjB;AAAA,QACE;AAAA,QACA;AAAA,MACF;AAAA,IACF;AAAA,EACF;AACA,QAAM,aAAa,YAAY,SAC3B,YACA,2BAA2B,UAAU,SAAS,gBAAgB;AAClE,MAAI,eAAe,cAAc;AAC/B,WAAO;AAAA,MACL,SAAS;AAAA,MACT,iBAAiB;AAAA,MACjB;AAAA,QACE;AAAA,QACA;AAAA,MACF;AAAA,IACF;AAAA,EACF;AACA,MAAI,eAAe,SAAS;AAC1B,WAAO;AAAA,MACL,SAAS;AAAA,MACT,iBAAiB;AAAA,MACjB;AAAA,QACE;AAAA,QACA;AAAA,MACF;AAAA,IACF;AAAA,EACF;AAEA,QAAM,QAAQ,MAAM,0BAA0B,UAAU,EAAE,uBAAuB,KAAK,CAAC;AACvF,MAAI,MAAM,WAAW,sBAAsB;AACzC,WAAO;AAAA,EACT;AACA,MACE,iBAAiB,QAAQ,YAAY,qBACrC,CAAC;AAAA,IACC,MAAM;AAAA,IACN,iBAAiB,QAAQ;AAAA,EAC3B,GACA;AACA,WAAO,sBAAsB,QAAQ;AAAA,EACvC;AAEA,MAAI;AACF,UAAM,0BAA2B,iBAAiB,QAAQ,KAIvD;AACH,QAAI,OAAO,4BAA4B,YAAY;AACjD,aAAO,sBAAsB,QAAQ;AAAA,IACvC;AACA,UAAM,wBAAwB;AAAA,MAC5B,iBAAiB,QAAQ;AAAA,MACzB,MAAM;AAAA,IACR;AAEA,UAAMC,gBAAe;AAAA,MACnB,iBAAiB,QAAQ;AAAA,MACzB,iBAAiB,QAAQ;AAAA,IAC3B;AACA,UAAM,mBAAmB;AAAA,MACvB,iBAAiB,QAAQ;AAAA,MACzB,MAAM;AAAA,MACN;AAAA,MACAA;AAAA,IACF;AACA,QAAI,qBAAqB,QAAW;AAClC,aAAO,sBAAsB,QAAQ;AAAA,IACvC;AACA,UAAM,eAAwC;AAAA,MAC5C,GAAG;AAAA,MACH,SAAS;AAAA,QACP,GAAG,iBAAiB;AAAA,QACpB,SAAS;AAAA,MACX;AAAA,IACF;AACA,UAAM,QAAQ,MAAM,0BAA0B;AAAA,MAC5C,GAAG;AAAA,MACH,mBAAmB,EAAE,IAAI,MAAM,SAAS,aAAa;AAAA,IACvD,GAAG,EAAE,uBAAuB,KAAK,CAAC;AAClC,WAAO,MAAM,WAAW,uBACpB,sBAAsB,QAAQ,IAC9B;AAAA,EACN,QAAQ;AACN,WAAO,sBAAsB,QAAQ;AAAA,EACvC;AACF;AAGA,SAAS,oBACP,QACA,UAC0B;AAC1B,QAAM,WAAW,SAAS,kBAAkB,QAAQ,SAAS;AAC7D,SAAO,aAAa,UAAa,SAAS,WAAW,IAAI,SAAS,EAAE,GAAG,QAAQ,UAAU,CAAC,GAAG,QAAQ,EAAE;AACzG;AAYA,SAAS,gBACP,UAC8D;AAC9D,SAAO,YAAY;AACrB;AAEA,eAAe,kBACb,aACA,kBACA,kBACA,cAC6B;AAC7B,QAAM,YAA0B,EAAE,aAAa,iBAAiB;AAChE,QAAM,SAAS,0BAA0B,gBAAgB;AACzD,MAAI,WAAW,QAAW;AACxB,WAAO,EAAE,QAAQ,SAAS,QAAQ;AAAA,MAChC;AAAA,MACA,yBAAyB;AAAA,MACzB,eAAe,iBAAiB,mCAAmC;AAAA,IACrE,EAAE;AAAA,EACJ;AAIA,QAAM,EAAE,iBAAAC,iBAAgB,IAAI,MAAM;AAClC,QAAM,SAASA,iBAAgB,aAAa,gBAAgB;AAK5D,MAAI,OAAO,WAAW,uBAAuB;AAC3C,WAAO,EAAE,QAAQ,SAAS,QAAQ;AAAA,MAChC;AAAA,MACA,yBAAyB,MAAM;AAAA,MAC/B;AAAA,QACE;AAAA,QACA;AAAA,MACF;AAAA,IACF,EAAE;AAAA,EACJ;AACA,MAAI,OAAO,WAAW,iCAAiC;AACrD,WAAO,EAAE,QAAQ,SAAS,QAAQ;AAAA,MAChC;AAAA,MACA,yBAAyB,MAAM;AAAA,MAC/B;AAAA,QACE;AAAA,QACA;AAAA,QACA,EAAE,SAAS,EAAE,mBAAmB,OAAO,kBAAkB,EAAE;AAAA,MAC7D;AAAA,IACF,EAAE;AAAA,EACJ;AAEA,QAAM,aAAa,OAAO;AAC1B,QAAM,cAAc,WAAW,MAAM,UAAU,YAAY;AAC3D,MAAI,CAAC,YAAY,SAAS;AACxB,WAAO,EAAE,QAAQ,SAAS,QAAQ;AAAA,MAChC;AAAA,MACA,yBAAyB,MAAM;AAAA,MAC/B;AAAA,QACE,WAAW,yBAAyB;AAAA,QACpC;AAAA,QACA;AAAA,UACE,SAAS,gBAAgB,YAAY,KAAK;AAAA,QAC5C;AAAA,MACF;AAAA,IACF,EAAE;AAAA,EACJ;AAKA,QAAM,uBAAuB,MAAM,eAAe,QAAQ,YAAY;AACtE,MAAI,CAAC,qBAAqB,IAAI;AAC5B,WAAO,EAAE,QAAQ,SAAS,QAAQ;AAAA,MAChC;AAAA,MACA,qBAAqB;AAAA,MACrB,qBAAqB;AAAA,IACvB,EAAE;AAAA,EACJ;AAEA,MACE,OAAO,eAAe,UACtB,CAAC,WAAW,SAAS,SAAS,qBAAqB,QAAQ,QAAQ,OAAO,GAC1E;AACA,WAAO,EAAE,QAAQ,SAAS,QAAQ;AAAA,MAChC;AAAA,MACA,qBAAqB,QAAQ;AAAA,MAC7B;AAAA,QACE;AAAA,QACA;AAAA,MACF;AAAA,IACF,EAAE;AAAA,EACJ;AACA,MACE,OAAO,eAAe,UACtB,WAAW,YAAY,mBACvB,eAAe,qBAAqB,QAAQ,QAAQ,OAAO,KAC3D,OAAO,sBAAsB,MAC7B;AACA,WAAO,EAAE,QAAQ,SAAS,QAAQ;AAAA,MAChC;AAAA,MACA,qBAAqB,QAAQ;AAAA,MAC7B;AAAA,QACE;AAAA,QACA;AAAA,MACF;AAAA,IACF,EAAE;AAAA,EACJ;AAEA,QAAM,oBACJ,WAAW,YAAY,eACnB,uBACA,MAAM,eAAe,QAAQ,eAAe;AAClD,MAAI,CAAC,kBAAkB,IAAI;AACzB,WAAO,EAAE,QAAQ,SAAS,QAAQ;AAAA,MAChC;AAAA,MACA,kBAAkB;AAAA,MAClB,kBAAkB;AAAA,IACpB,EAAE;AAAA,EACJ;AACA,MAAI,WAAW,YAAY,iBAAiB;AAC1C,UAAM,gBAAgB,kBAAkB,QAAQ,QAAQ;AACxD,QAAI,CAAC,WAAW,SAAS,SAAS,aAAa,GAAG;AAChD,aAAO,EAAE,QAAQ,SAAS,QAAQ;AAAA,QAChC;AAAA,QACA,kBAAkB,QAAQ;AAAA,QAC1B;AAAA,UACE;AAAA,UACA;AAAA,QACF;AAAA,MACF,EAAE;AAAA,IACJ;AACA,QAAI,eAAe,aAAa,KAAK,OAAO,sBAAsB,MAAM;AACtE,aAAO,EAAE,QAAQ,SAAS,QAAQ;AAAA,QAChC;AAAA,QACA,kBAAkB,QAAQ;AAAA,QAC1B;AAAA,UACE;AAAA,UACA;AAAA,QACF;AAAA,MACF,EAAE;AAAA,IACJ;AAAA,EACF;AACA,SAAO;AAAA,IACL;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,EACF;AACF;AAEA,eAAe,0BACb,UACA,UAAyD,CAAC,GACvB;AACnC,QAAM,EAAE,WAAW,YAAY,aAAa,kBAAkB,IAAI;AAClE,QAAMH,kBACJ,kBAAkB,QAAQ,YAAY,SAClC,SACC,kBAAkB;AACzB,QAAME,gBAAeF,oBAAmB,SACpC,SACA;AAAA,IACAA,gBAAe,QAAQ;AAAA,IACvBA,gBAAe,QAAQ;AAAA,EACzB;AAEF,MAAI;AACF,UAAM,UAAU,MAAM,WAAW;AAAA,MAC9BA,mBAAkB,kBAAkB;AAAA,MACrC,YAAY;AAAA,IACd;AACA,UAAM,WAAWC,mBAAkB,OAAO;AAC1C,QAAI,aAAa,QAAW;AAC1B,aAAO;AAAA,QACL;AAAA,QACA,kBAAkB,QAAQ;AAAA,QAC1B;AAAA,UACE;AAAA,UACA;AAAA,QACF;AAAA,MACF;AAAA,IACF;AAEA,UAAM,aAAa;AAAA,MAChBD,iBAAgB,QAAQ,WAAW,CAAC;AAAA,MACrC;AAAA,MACAE;AAAA,IACF;AACA,QAAI,CAAC,WAAW,WAAW;AACzB,UAAIF,oBAAmB,QAAW;AAChC,eAAO;AAAA,UACL;AAAA,UACA,kBAAkB,QAAQ;AAAA,UAC1B,uBAAuB;AAAA,QACzB;AAAA,MACF;AACA,UAAI,QAAQ,uBAAuB;AACjC,YAAI;AACF,gBAAM,UAAU,+BAA+B;AAAA,YAC7C,SAASA,gBAAe,QAAQ;AAAA,YAChC,MAAMA,gBAAe,QAAQ;AAAA,YAC7B,YAAYA,gBAAe,QAAQ;AAAA,YACnC,SAASA,gBAAe,QAAQ;AAAA,YAChC,cAAcA,gBAAe,QAAQ,gBAAgB;AAAA,YACrD,GAAIA,gBAAe,QAAQ,aAAa,SACpC,CAAC,IACD,EAAE,UAAUA,gBAAe,QAAQ,SAAS;AAAA,YAChD,GAAIA,gBAAe,QAAQ,UAAU,SACjC,CAAC,IACD,EAAE,SAASA,gBAAe,QAAQ,MAAM;AAAA,YAC5C,SAAS,WAAW;AAAA,UACtB,CAAC;AACD,iBAAO;AAAA,YACL;AAAA,YACA,kBAAkB,QAAQ;AAAA,YAC1B,YAAY;AAAA,YACZ;AAAA,YACA,WAAW;AAAA,YACXA,gBAAe,QAAQ;AAAA,UACzB;AAAA,QACF,QAAQ;AACN,iBAAO;AAAA,YACL;AAAA,YACA,kBAAkB,QAAQ;AAAA,YAC1B,uBAAuB;AAAA,UACzB;AAAA,QACF;AAAA,MACF;AACA,YAAM,YAAY,MAAM;AAAA,QACtBA;AAAA,QACA,WAAW;AAAA,MACb;AACA,UAAI,UAAU,WAAW,SAAS;AAChC,eAAO;AAAA,UACL;AAAA,UACA,kBAAkB,QAAQ;AAAA,UAC1B,UAAU;AAAA,QACZ;AAAA,MACF;AACA,aAAO;AAAA,QACL;AAAA,QACA,kBAAkB,QAAQ;AAAA,QAC1B,YAAY;AAAA,QACZ,UAAU;AAAA,QACV,UAAU;AAAA,QACVA,gBAAe,QAAQ;AAAA,MACzB;AAAA,IACF;AAEA,UAAM,UAAU,MAAM,WAAW;AAAA,MAC/B,kBAAkB;AAAA,MAClB,YAAY;AAAA,IACd;AAEA,YAAQ,QAAQ,QAAQ;AAAA,MACtB,KAAK,MAAM;AACT,cAAM,eAAe,WAAW,OAAO,UAAU,QAAQ,MAAM;AAC/D,YAAI,CAAC,aAAa,SAAS;AACzB,iBAAO;AAAA,YACL;AAAA,YACA,kBAAkB,QAAQ;AAAA,YAC1B;AAAA,cACE;AAAA,cACA;AAAA,YACF;AAAA,UACF;AAAA,QACF;AACA,eAAO;AAAA,UACL,QAAQ;AAAA,UACR;AAAA,UACA,SAAS,kBAAkB,QAAQ;AAAA,UACnC,QAAQ,aAAa;AAAA,QACvB;AAAA,MACF;AAAA,MACA,KAAK,sBAAsB;AACzB,cAAM,SAASC,mBAAkB,QAAQ,OAAO;AAChD,YACE,WAAW,UACX,CAAC;AAAA,UACC;AAAA,UACA;AAAA,UACAC;AAAA,QACF,GACA;AACA,iBAAO;AAAA,YACL;AAAA,YACA,kBAAkB,QAAQ;AAAA,YAC1B;AAAA,cACE;AAAA,cACA;AAAA,YACF;AAAA,UACF;AAAA,QACF;AACA,YAAIF,oBAAmB,QAAW;AAChC,iBAAO;AAAA,YACL;AAAA,YACA,kBAAkB,QAAQ;AAAA,YAC1B,uBAAuB;AAAA,UACzB;AAAA,QACF;AACA,YAAI,QAAQ,uBAAuB;AACjC,cAAI;AACF,kBAAM,UAAU,+BAA+B;AAAA,cAC7C,SAASA,gBAAe,QAAQ;AAAA,cAChC,MAAMA,gBAAe,QAAQ;AAAA,cAC7B,YAAYA,gBAAe,QAAQ;AAAA,cACnC,SAASA,gBAAe,QAAQ;AAAA,cAChC,cAAcA,gBAAe,QAAQ,gBAAgB;AAAA,cACrD,GAAIA,gBAAe,QAAQ,aAAa,SACpC,CAAC,IACD,EAAE,UAAUA,gBAAe,QAAQ,SAAS;AAAA,cAChD,GAAIA,gBAAe,QAAQ,UAAU,SACjC,CAAC,IACD,EAAE,SAASA,gBAAe,QAAQ,MAAM;AAAA,cAC5C,SAAS;AAAA,YACX,CAAC;AACD,mBAAO;AAAA,cACL;AAAA,cACA,kBAAkB,QAAQ;AAAA,cAC1B,YAAY;AAAA,cACZ;AAAA,cACA;AAAA,cACAA,gBAAe,QAAQ;AAAA,cACvB,QAAQ,uBAAuB;AAAA,YACjC;AAAA,UACF,QAAQ;AACN,mBAAO;AAAA,cACL;AAAA,cACA,kBAAkB,QAAQ;AAAA,cAC1B,uBAAuB;AAAA,YACzB;AAAA,UACF;AAAA,QACF;AACA,cAAM,YAAY,MAAM;AAAA,UACtBA;AAAA,UACA;AAAA,UACA;AAAA,QACF;AACA,YAAI,UAAU,WAAW,SAAS;AAChC,iBAAO;AAAA,YACL;AAAA,YACA,kBAAkB,QAAQ;AAAA,YAC1B,UAAU;AAAA,UACZ;AAAA,QACF;AACA,eAAO;AAAA,UACL;AAAA,UACA,kBAAkB,QAAQ;AAAA,UAC1B,YAAY;AAAA,UACZ,UAAU;AAAA,UACV,UAAU;AAAA,UACVA,gBAAe,QAAQ;AAAA,UACvB,QAAQ,uBAAuB;AAAA,QACjC;AAAA,MACF;AAAA,MACA,KAAK;AACH,eAAO;AAAA,UACL,QAAQ;AAAA,UACR;AAAA,UACA,SAAS,kBAAkB,QAAQ;AAAA,UACnC,OAAO,QAAQ;AAAA,UACf,OAAO;AAAA,YACL;AAAA,YACA,YAAY;AAAA,YACZ,QAAQ,uBAAuB;AAAA,UACjC;AAAA,QACF;AAAA,MACF,KAAK;AACH,eAAO;AAAA,UACL;AAAA,UACA,kBAAkB,QAAQ;AAAA,UAC1B;AAAA,YACE;AAAA,YACA,uBAAuB,QAAQ,KAAK;AAAA,UACtC;AAAA,QACF;AAAA,MACF;AACE,eAAO;AAAA,UACL;AAAA,UACA,kBAAkB,QAAQ;AAAA,UAC1B,uBAAuB;AAAA,QACzB;AAAA,IACJ;AAAA,EACF,SAAS,OAAO;AACd,WAAO;AAAA,MACL;AAAA,MACA,kBAAkB,QAAQ;AAAA,MAC1B,qBAAqB,YAAY,6BAA6B,KAAK,CAAC;AAAA,IACtE;AAAA,EACF;AACF;AAEA,SAAS,0BACP,QAC8B;AAC9B,MAAI,OAAO,WAAW,YAAY,WAAW,KAAM,QAAO;AAE1D,MAAI;AACF,UAAM,YAAY;AAClB,UAAM,UAAU,UAAU;AAC1B,UAAM,OAAO,UAAU;AACvB,UAAM,YAAY,UAAU;AAC5B,UAAM,oBAAoB,UAAU;AACpC,UAAM,aAAa,UAAU;AAE7B,QACG,YAAY,UAAa,OAAO,YAAY,YAC5C,SAAS,UAAa,OAAO,SAAS,YACtC,cAAc,WACZ,OAAO,cAAc,YAAY,CAACI,YAAW,SAAS,MACxD,sBAAsB,UACrB,OAAO,sBAAsB,aAC9B,eAAe,UAAa,OAAO,eAAe,UACnD;AACA,aAAO;AAAA,IACT;AAEA,WAAO;AAAA,MACL,GAAI,YAAY,SAAY,CAAC,IAAI,EAAE,QAAQ;AAAA,MAC3C,GAAI,SAAS,SAAY,CAAC,IAAI,EAAE,KAAK;AAAA,MACrC,GAAI,cAAc,SAAY,CAAC,IAAI,EAAE,UAAU;AAAA,MAC/C,GAAI,sBAAsB,OAAO,EAAE,mBAAmB,KAAK,IAAI,CAAC;AAAA,MAChE,GAAI,eAAe,SAAY,CAAC,IAAI,EAAE,WAAW;AAAA,IACnD;AAAA,EACF,QAAQ;AACN,WAAO;AAAA,EACT;AACF;AAEA,eAAe,eACb,QACA,aACsC;AACtC,MAAI;AAIF,UAAM,EAAE,yBAAAC,yBAAwB,IAAI,MAAM;AAC1C,WAAO,MAAMA,yBAAwB,QAAQ,WAAW;AAAA,EAC1D,SAAS,OAAO;AACd,WAAO;AAAA,MACL,IAAI;AAAA,MACJ,SAAS,yBAAyB,MAAM;AAAA,MACxC,OAAO,6BAA6B,KAAK;AAAA,IAC3C;AAAA,EACF;AACF;AAEA,SAAS,yBACP,SAA2B,CAAC,GACH;AACzB,SAAO;AAAA,IACL,SAAS,OAAO,OAAO,YAAY,WAAW,OAAO,UAAU;AAAA,IAC/D,MAAM,eAAe,OAAO,IAAI,KAAK;AAAA,IACrC,SAAS;AAAA,EACX;AACF;AAEA,SAAS,YACP,WACA,SACA,OACwB;AACxB,SAAO,EAAE,QAAQ,SAAS,WAAW,SAAS,MAAM;AACtD;AAEA,SAAS,gBACP,WACA,OACA,qBAMC;AACD,SAAO;AAAA,IACL,aAAa,UAAU;AAAA,IACvB,kBAAkB,UAAU;AAAA,IAC5B,aAAa,WAAW,QAAQ,EAC7B,OAAO,gBAAgB,KAAK,GAAG,MAAM,EACrC,OAAO,KAAK;AAAA,IACf;AAAA,EACF;AACF;AAaA,eAAe,wBACb,SACA,SACA,QAAQ,OACqB;AAC7B,QAAM,aAAa,QAAQ,QAAQ;AACnC,MAAI,eAAe,QAAW;AAC5B,WAAO;AAAA,MACL,QAAQ;AAAA,MACR,OAAO;AAAA,QACL;AAAA,QACA;AAAA,MACF;AAAA,IACF;AAAA,EACF;AACA,MAAI;AACF,UAAMH,gBAAe;AAAA,MACnB,QAAQ,QAAQ;AAAA,MAChB,QAAQ,QAAQ;AAAA,IAClB;AACA,UAAM,mBAAmB,kCAAkC,SAAyCA,aAAY;AAChH,UAAM,mBAAmB,kCAAkC,QAAQ,QAAQ,SAAyCA,aAAY;AAChI,UAAM,aAAa,MAAM,+BAA+B;AAAA,MACtD,SAAS,QAAQ,QAAQ;AAAA,MACzB,SAAS,QAAQ,QAAQ;AAAA,MACzB,cAAc,QAAQ,QAAQ,gBAAgB;AAAA,MAC9C,MAAM,QAAQ,QAAQ;AAAA,MACtB;AAAA,MACA,GAAI,QAAQ,QAAQ,aAAa,SAC7B,CAAC,IACD,EAAE,UAAU,QAAQ,QAAQ,SAAS;AAAA,MACzC,GAAI,QAAQ,QAAQ,UAAU,SAC1B,CAAC,IACD,EAAE,SAAS,QAAQ,QAAQ,MAAM;AAAA,MACrC,SAAS;AAAA,MACT,SAAU,QACN,CAAC,IACD;AAAA,MACJ,cAAAA;AAAA,IACF,CAAC;AACD,QAAI,WAAW,WAAW,WAAW;AACnC,aAAO;AAAA,QACL,QAAQ;AAAA,QACR,OAAO;AAAA,UACL;AAAA,UACA;AAAA,QACF;AAAA,MACF;AAAA,IACF;AACA,WAAO;AAAA,MACL,QAAQ;AAAA,MACR,SAAS,WAAW;AAAA,MACpB,SAAS;AAAA,IACX;AAAA,EACF,QAAQ;AACN,WAAO;AAAA,MACL,QAAQ;AAAA,MACR,OAAO;AAAA,QACL;AAAA,QACA;AAAA,MACF;AAAA,IACF;AAAA,EACF;AACF;AAEA,SAAS,wBACP,WACA,SACA,OACA,SACA,SACA,MACA,sBAAsB,OACE;AACxB,SAAO;AAAA,IACL,QAAQ;AAAA,IACR;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA,UAAU,eAAe,SAAS,IAAI;AAAA,IACtC,OAAO,gBAAgB,WAAW,OAAO,mBAAmB;AAAA,EAC9D;AACF;AAEA,SAAS,eACP,SACA,MACgB;AAChB,QAAM,YAAY;AAGlB,MAAI;AACJ,MAAI;AACF,UAAM,YAAY,UAAU,wBAAwB,OAAO;AAC3D,QAAI,OAAO,cAAc,YAAY,UAAU,SAAS,EAAG,OAAM;AAAA,EACnE,QAAQ;AAAA,EAGR;AACA,SAAO;AAAA,IACL,MAAM;AAAA,IACN,WAAW,QAAQ;AAAA,IACnB,GAAI,QAAQ,SAAY,CAAC,IAAI,EAAE,IAAI;AAAA,IACnC,UAAU;AAAA,EACZ;AACF;AAEA,SAASD,mBACP,OACqC;AACrC,SAAO,0BAA0B,KAAK;AAGxC;AAEA,SAAS,uCACP,cACA,oBACS;AACT,QAAM,qBAAqB,kBAAkB,kBAAkB;AAC/D,MAAI,uBAAuB,OAAW,QAAO;AAC7C,SAAO,aAAa,MAAM,CAAC,gBAAgB;AACzC,QAAI,YAAY,YAAY,wBAAwB;AAClD,aAAO,YAAY,UAAU;AAAA,IAC/B;AACA,UAAM,mBAAmB,kBAAkB,YAAY,KAAK;AAC5D,WAAO,YAAY,YAAY,kBAAkB,qBAAqB;AAAA,EACxE,CAAC;AACH;AAEA,SAAS,kBAAkB,OAA+C;AACxE,MAAI,OAAO,UAAU,SAAU,QAAO;AACtC,QAAM,cAAcK,eAAc,KAAK;AACvC,MAAI,gBAAgB,KAAM,QAAO;AACjC,MAAI;AACF,UAAM,MAAMC,aAAY,YAAY,KAAK;AACzC,WAAO,QAAQ,OACX,SACAD,eAAcE,gBAAe,IAAI,SAAS,IAAI,SAAS,YAAY,IAAI,CAAC,GAAG;AAAA,EACjF,QAAQ;AACN,WAAO;AAAA,EACT;AACF;AAEA,SAAS,2BACP,UACA,SACA,SACoC;AACpC,MACE,SAAS,WAAW,OAAO,2BAC3B,SAAS,WAAW,YAAY,KAChC,KAAK,UAAU,SAAS,WAAW,OAAO,MAAM,KAAK,UAAU,CAAC,QAAQ,aAAa,CAAC,EACtF,QAAO;AAET,QAAMN,gBAAe,uBAAuB,QAAQ,QAAQ,MAAM,QAAQ,QAAQ,KAAK;AACvF,MAAI;AACJ,MAAI;AACF,gBAAY;AAAA,MACV,SAAS,YAAY;AAAA,MACrB,QAAQ,QAAQ;AAAA,MAChB,QAAQ,QAAQ;AAAA,IAClB;AAAA,EACF,QAAQ;AACN,WAAO;AAAA,EACT;AACA,QAAM,gBAAgB;AAAA,IACpB;AAAA,IACAA;AAAA,EACF;AACA,MAAI,cAAc,WAAW,EAAG,QAAO;AACvC,QAAM,KAAK,cAAc,KAAK,CAAC,eAAe,WAAW,YAAY,cAAc;AACnF,QAAM,UAAU,cAAc,KAAK,CAAC,eAAe,WAAW,YAAY,sBAAsB;AAChG,MAAI,OAAO,UAAa,YAAY,OAAW,QAAO;AACtD,QAAM,iBAAiB,kBAAkB,GAAG,KAAK;AACjD,QAAM,qBAAqB,kBAAkB,QAAQ,QAAQ,KAAK;AAClE,MAAI,mBAAmB,UAAa,uBAAuB,UAAa,mBAAmB,oBAAoB;AAC7G,WAAO;AAAA,EACT;AACA,MAAI,KAAK,UAAU,EAAE,MAAM,KAAK,UAAU;AAAA,IACxC,SAAS;AAAA,IACT,OAAOA,cAAa,UAAU,KAAK;AAAA,IACnC,MAAM,UAAU;AAAA,IAChB,SAAS,CAAC,kBAAkB;AAAA,EAC9B,CAAC,EAAG,QAAO;AACX,MACE,KAAK,UAAU,OAAO,MAAM,KAAK,UAAU;AAAA,IACzC,SAAS;AAAA,IACT,MAAM,QAAQ;AAAA,IACd,SAAS,CAAC,8BAA8B;AAAA,EAC1C,CAAC,KACD,OAAO,QAAQ,SAAS,YACxB,CAAC,QAAQ,KAAK,WAAW,2BAA2B,EACpD,QAAO;AACT,SAAO;AACT;AAEA,SAAS,4BACP,MACA,WACA,SACAA,eAC8C;AAC9C,QAAM,YAAY;AAKlB,MAAI,OAAO,UAAU,0BAA0B,WAAY,QAAO;AAClE,MAAI,UAAU,sBAAsB,CAAC,GAAG,SAAS,CAAC,MAAM,KAAM,QAAO;AACrE,MAAI,OAAO,UAAU,mCAAmC,cACpD,OAAO,UAAU,yCAAyC,WAAY,QAAO;AAEjF,QAAM,OAAO,UAAU,+BAA+B;AACtD,QAAM,YAAY,UAAU,qCAAqC;AACjE,MAAI,CAAC,MAAM,QAAQ,IAAI,KAAK,CAAC,MAAM,QAAQ,SAAS,EAAG,QAAO;AAC9D,QAAM,iBAAiB,0BAA0B,SAAS;AAC1D,MAAI,mBAAmB,OAAW,QAAO;AACzC,QAAM,oBAAoB,eAAe;AAAA,IAAO,CAAC,eAC/C,8BAA8B,CAAC,UAAU,GAAG,SAASA,aAAY;AAAA,EACnE;AACA,MAAI,CAAC,8BAA8B,WAAW,mBAAmBA,aAAY,EAAG,QAAO;AACvF,QAAM,WAAW;AAAA,IACf,CAAC,GAAG,MAAM,GAAG,iBAAiB;AAAA,IAC9BA;AAAA,EACF;AACA,SAAO,2BAA2B,UAAU,SAAyCA,aAAY,EAAE,YAC/F,WACA;AACN;AAEA,SAAS,sBACP,UACwB;AACxB,SAAO;AAAA,IACL,SAAS;AAAA,IACT,SAAS,kBAAkB,QAAQ;AAAA,IACnC;AAAA,MACE;AAAA,MACA;AAAA,MACA,EAAE,WAAW,KAAK;AAAA,IACpB;AAAA,EACF;AACF;AAEA,SAAS,6BACP,UACwB;AACxB,SAAO;AAAA,IACL,SAAS;AAAA,IACT,SAAS,kBAAkB,QAAQ;AAAA,IACnC,uBAAuB;AAAA,EACzB;AACF;AAEA,SAAS,eAAe,SAAsD;AAC5E,SAAO,YAAY,mBAAmB,YAAY;AACpD;AAEA,SAAS,gBAAgB,OAAoD;AAC3E,SAAO;AAAA;AAAA;AAAA,IAGL,QAAQ,MAAM,OAAO,IAAI,CAAC,WAAW,EAAE,MAAM,MAAM,KAAK,EAAE;AAAA,EAC5D;AACF;;;AKrgCO,SAAS,wCACd,kBACA,cACmC;AACnC,SAAO;AAAA,IACL;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,EACF;AACF;","names":["operationError","ms","resolveSpace","_a","ownership","resolve","randomUUID","resolveSpace","SECRET_NAME_RE","nodeSdk","z","resolveSpace","z","isRecord","EmptyInputSchema","z","z","runtimeContext","runtimeNode","isRecord","nodeFailure","isCanonicalBase64","SpaceSchema","AUTHENTICATED_POSTURES","join","nodeSdk","isRecord","z","isRecord","definition","profileNotFound","isRecord","nodeSdk","isRecord","resolveSpace","principal","isAbsolute","makePkhSpaceId","parsePkhDid","parseSpaceUri","output","principal","runtimeContext","exactCapabilities","resolveSpace","lookupOperation","isAbsolute","createInvocationRuntime","parseSpaceUri","parsePkhDid","makePkhSpaceId"]}