@tinycloud/sdk-core 2.11.0-beta.10 → 2.11.0-beta.11

package/dist/delegations/index.cjs.map

@@ -1 +1 @@
-{"version":3,"sources":["../../src/delegations/index.ts","../../src/delegations/types.schema.ts","../../src/expiry.ts","../../src/delegations/DelegationManager.ts","../../src/delegations/SharingService.schema.ts","../../src/manifest.ts","../../src/identity.ts","../../src/capabilities.ts","../../../../node_modules/multiformats/src/bases/base10.ts","../../../../node_modules/multiformats/src/bytes.ts","../../../../node_modules/multiformats/src/vendor/base-x.js","../../../../node_modules/multiformats/src/bases/base.ts","../../../../node_modules/multiformats/src/bases/base16.ts","../../../../node_modules/multiformats/src/bases/base2.ts","../../../../node_modules/multiformats/src/bases/base256emoji.ts","../../../../node_modules/multiformats/src/bases/base32.ts","../../../../node_modules/multiformats/src/bases/base36.ts","../../../../node_modules/multiformats/src/bases/base58.ts","../../../../node_modules/multiformats/src/bases/base64.ts","../../../../node_modules/multiformats/src/bases/base8.ts","../../../../node_modules/multiformats/src/bases/identity.ts","../../../../node_modules/multiformats/src/codecs/json.ts","../../../../node_modules/multiformats/src/codecs/raw.ts","../../../../node_modules/multiformats/src/hashes/identity.ts","../../../../node_modules/multiformats/src/vendor/varint.js","../../../../node_modules/multiformats/src/varint.ts","../../../../node_modules/multiformats/src/hashes/digest.ts","../../../../node_modules/multiformats/src/hashes/sha2-browser.ts","../../../../node_modules/multiformats/src/hashes/hasher.ts","../../../../node_modules/multiformats/src/cid.ts","../../../../node_modules/multiformats/src/basics.ts","../../src/delegations/SharingService.ts","../../src/delegations/ShareRecipientClient.ts","../../src/delegations/share-envelope.ts","../../src/delegations/ShareCache.ts","../../src/delegations/recipient-types.ts","../../src/delegations/recipient-types.schema.ts","../../src/delegations/owner-policy.ts","../../src/policy/signed-object.ts","../../src/policy/errors.ts","../../src/policy/jcs.ts","../../src/delegations/share-delivery.ts","../../src/delegations/sender-share-store.ts"],"sourcesContent":["/**\n * TinyCloud SDK Delegations Module\n *\n * This module provides delegation and sharing link functionality\n * for the TinyCloud SDK. It extracts and improves upon the delegation\n * functionality previously in ITinyCloudStorage.\n *\n * @packageDocumentation\n *\n * @example\n * ```typescript\n * import {\n *   DelegationManager,\n *   SharingService,\n *   Delegation,\n *   CreateDelegationParams,\n * } from \"@tinycloud/sdk-core/delegations\";\n *\n * // Create delegation manager\n * const delegations = new DelegationManager({\n *   hosts: [\"https://node.tinycloud.xyz\"],\n *   session,\n *   invoke,\n * });\n *\n * // Create a delegation\n * const result = await delegations.create({\n *   delegateDID: \"did:pkh:eip155:1:0x...\",\n *   path: \"shared/\",\n *   actions: [\"tinycloud.kv/get\", \"tinycloud.kv/list\"],\n * });\n * ```\n */\n\n// Types\nexport {\n  // Result pattern\n  Result,\n  DelegationError,\n  DelegationErrorCodes,\n  DelegationErrorCode,\n\n  // Delegation types\n  Delegation,\n  DelegationStatus,\n  DelegationRevocationReceipt,\n  AccountDelegationResource,\n  AccountDelegationRecord,\n  AccountDelegationPage,\n  AccountDelegationQueryOptions,\n  CreateDelegationParams,\n  DelegationChain,\n  DelegationApiResponse,\n\n  // Configuration types\n  DelegationManagerConfig,\n  KeyProvider,\n\n  // v2 types for CapabilityKeyRegistry\n  JWK,\n  KeyType,\n  KeyInfo,\n  CapabilityEntry,\n  DelegationRecord,\n  DelegationChainV2,\n  DelegationDirection,\n  DelegationFilters,\n  SpaceOwnership,\n  SpaceInfo,\n  ShareSchema,\n  ShareLink,\n  ShareLinkData,\n  IngestOptions,\n  GenerateShareParams,\n\n  // WASM delegation types\n  CreateDelegationWasmParams,\n  CreateDelegationWasmResult,\n  DelegatedResource,\n} from \"./types\";\n\n// Classes\nexport { DelegationManager } from \"./DelegationManager\";\n\n// v2 SharingService\nexport {\n  SharingService,\n  createSharingService,\n  ISharingService,\n  SharingServiceConfig,\n  EncodedShareData,\n  ReceiveOptions,\n  ShareAccess,\n  DelegateReceivedShareParams,\n  DelegatedShareAccess,\n} from \"./SharingService\";\n\nexport { ShareRecipientClient } from \"./ShareRecipientClient\";\nexport { MemoryShareCache } from \"./ShareCache\";\nexport type { ShareCache, ShareCacheEntry, ShareCacheKey, ShareCacheMetadata } from \"./ShareCache\";\nexport {\n  createShareArtifact,\n  createShareArtifactAsync,\n  createSharePolicy,\n  computeShareCid,\n  decryptShareBytesAsync,\n  encodeInlineShareUrl,\n  encodeShareArtifact,\n  encodeShareUrl,\n  encryptShareBytes,\n  encryptShareBytesAsync,\n  intersectShareCapabilities,\n  isV2ShareLink,\n  normalizeShareActions,\n  normalizeShareRecipientTarget,\n  normalizeShareResource,\n  parseShareArtifact,\n  parseShareUrl,\n  shareCapabilityAllows,\n  signShareEnvelope,\n  verifyShareCid,\n  verifyShareEnvelope,\n  ShareEnvelopeError,\n  MAX_SHARE_CONTENT_BYTES,\n  MAX_SEALED_SHARE_CONTENT_BYTES,\n  MAX_SHARE_ARTIFACT_BYTES,\n} from \"./share-envelope\";\nexport type {\n  ShareAction,\n  ShareArtifactInput,\n  ShareArtifactResult,\n  ShareArtifactV2,\n  ShareCapabilityLike,\n  ShareContentMetadata,\n  ShareEnvelopeV2,\n  ShareLinkLocation,\n  SharePolicy,\n  ShareRecipientTarget,\n  ShareResource,\n  VerifyShareEnvelopeOptions,\n} from \"./share-envelope\";\n\nexport {\n  createDelegatedShareKey,\n  restoreDelegatedShareKey,\n  createPolicyEnforcementDelegation,\n  canonicalOwnerSharePolicy,\n  computeOwnerShareRegistrationCid,\n  validateOwnerSharePolicyRegistration,\n  validateOwnerSharePolicyRegistrationBytes,\n  MAX_CONTENT_BYTES,\n} from \"./owner-policy\";\nexport type {\n  OwnerDelegationReceipt,\n  OwnerDelegationPermission,\n  CreateOwnerDelegationParams,\n  OwnerShareAction,\n  OwnerShareDecryption,\n  OwnerShareMatcher,\n  OwnerSharePolicyV2,\n  DelegatedShareKey,\n  SignedDelegation,\n  RegisterOwnerSharePolicyParams,\n  OwnerSharePolicyRegistration,\n  OwnerSharePolicyRegistrationReceipt,\n} from \"./owner-policy\";\n\nexport {\n  SHARE_DELIVERY_AUTHORIZATION_DOMAIN,\n  validateShareDeliveryAuthorizationBytes,\n  shareDeliveryTrustedKid,\n} from \"./share-delivery\";\nexport type {\n  ShareDeliveryAuthorizationRequest,\n  ShareDeliveryAuthorization,\n  ShareDeliveryAuthorizationReceipt,\n  ValidateShareDeliveryAuthorizationExpected,\n} from \"./share-delivery\";\n\nexport {\n  MemorySenderShareRecordStorage,\n  MemorySenderShareKeyStorage,\n  SenderShareStore,\n} from \"./sender-share-store\";\n\n/** Lifecycle and authorization operations are delegated to the canonical\n * headless package so sdk-core cannot grow a second Share verifier. */\nexport {\n  authorizeShare,\n  authorizationMethodForTarget,\n  notifyShare,\n  revokeShare,\n  listShares,\n  showShare,\n  publishTargetShare,\n  publishPolicyShare,\n  claimShare,\n  resumeShareAuthorization,\n  isLegacyShareLink,\n  receiveLegacyShare,\n  migrateShare,\n  MemoryEncryptedShareHistoryStorage,\n  EncryptedSenderShareHistory,\n} from \"@tinycloud/share-sdk\";\nexport type {\n  ShareAuthorizationMethod,\n  ShareAuthorizationRequired,\n  ShareAuthorizationDenied,\n  ShareAuthorizationReady,\n  ShareAuthorizationResult,\n  ShareAuthorizationAdapter,\n  ShareNotifyState,\n  ShareNotifyResult,\n  ShareDeliveryAdapter,\n  ShareRevocationResult,\n  ShareRevocationAdapter,\n  ShareHistoryView,\n  ShareTarget,\n  TargetPublishInput,\n  TargetPublishOutcome,\n  TargetPublishAdapter,\n  SharePolicyPublishAdapter,\n  LegacyShareReader,\n  LegacyMigrationResult,\n  EncryptedShareHistoryStorage,\n} from \"@tinycloud/share-sdk\";\nexport type {\n  SenderShareRecord,\n  SenderShareRecordStorage,\n  SenderShareKeyStorage,\n  SenderShareRevocationScope,\n} from \"./sender-share-store\";\nexport type {\n  ShareAccessV2,\n  ShareListResult,\n  ShareReadResult,\n  ShareRecipientClientOptions,\n  ShareNativeInvokeInput,\n  ShareNativeInvokeResult,\n  ShareNativeInvokeSuccessResult,\n  ShareNativeInvokeErrorResult,\n  ShareNativeAction,\n  ShareWireAction,\n  ShareAddressedRecipientMatcher,\n  ShareContentSource,\n  ShareKvContentSource,\n  ShareSqlContentSource,\n  ShareExpiryBounds,\n  ShareAddressedDelegationRequestV2,\n  ShareAddressedDelegationEnvelopeV2,\n  ShareAddressedDelegationResponseV2,\n  SharePolicySessionWireV1,\n  SharePolicySessionV1,\n  ShareReadInvocationV1,\n  ShareNativeInvokeEnvelopeV1,\n  ShareDetachedProof,\n  ShareListEntry,\n  SharePolicyBinding,\n  SharePolicySession,\n  ShareRecipientPolicy,\n  ShareRecipientResult,\n  ShareSaveOptions,\n} from \"./recipient-types\";\nexport type { ShareNativeResponse } from \"./recipient-types.schema\";\nexport { ShareAccessError, ShareConflict } from \"./recipient-types\";\n\n/**\n * Canonical headless Share foundation. The older SharingService and v2\n * artifact exports above remain compatibility adapters; new consumers should\n * use these package-owned codecs and redacted receive operations so browser\n * and Node callers share one verifier and one result taxonomy.\n */\nexport {\n  inspectShare,\n  receiveShare,\n  ShareReceiveError,\n  toShareErrorInfo,\n  verifyBearerEnvelope,\n} from \"@tinycloud/share-sdk\";\nexport type {\n  ShareErrorCode,\n  ShareErrorInfo,\n  ShareFetchOptions,\n  ShareInspection,\n  ShareMetadata,\n  ShareReceiveResult,\n  VerifyBearerEnvelopeOptions,\n} from \"@tinycloud/share-sdk\";\nexport {\n  ShareActionSchema,\n  ShareRecipientClientOptionsSchema,\n  ShareRecipientPolicySchema,\n  ShareRecipientTargetSchema,\n  ShareResourceSchema,\n  ShareNativeResponseSchema,\n  ShareAddressedDelegationRequestV2Schema,\n  ShareAddressedDelegationEnvelopeV2Schema,\n  ShareAddressedDelegationResponseV2Schema,\n} from \"./recipient-types.schema\";\n\n// SharingService Schemas and Validation\nexport {\n  EncodedShareDataSchema,\n  ReceiveOptionsSchema,\n  SharingServiceConfigSchema,\n  validateEncodedShareData,\n  validateReceiveOptions,\n  validateSharingServiceConfig,\n} from \"./SharingService.schema.js\";\n","/**\n * Zod schemas for delegation management types.\n *\n * These schemas provide runtime validation for delegation, capability key management,\n * and sharing link functionality. Types are derived from schemas using z.infer<>.\n *\n * @packageDocumentation\n */\n\nimport { z } from \"zod\";\nimport type {\n  FetchFunction,\n  InvokeAnyFunction,\n  InvokeFunction,\n  ServiceSession,\n} from \"@tinycloud/sdk-services\";\n\n// =============================================================================\n// Result Type (Generic)\n// =============================================================================\n\n/**\n * Creates a Result schema for a given data type and error type.\n * Result types provide explicit error handling instead of throwing.\n */\nexport function createResultSchema<T extends z.ZodTypeAny, E extends z.ZodTypeAny>(\n  dataSchema: T,\n  errorSchema: E\n) {\n  return z.discriminatedUnion(\"ok\", [\n    z.object({ ok: z.literal(true), data: dataSchema }),\n    z.object({ ok: z.literal(false), error: errorSchema }),\n  ]);\n}\n\n/**\n * Result type pattern for delegation operations.\n */\nexport type Result<T, E = DelegationError> =\n  | { ok: true; data: T }\n  | { ok: false; error: E };\n\n// =============================================================================\n// JWK Type (JSON Web Key)\n// =============================================================================\n\n/**\n * JSON Web Key representation for cryptographic keys.\n * Follows the JWK specification (RFC 7517).\n */\nexport const JWKSchema = z.object({\n  /** Key type (e.g., \"EC\", \"RSA\", \"OKP\") */\n  kty: z.string(),\n  /** Curve for EC/OKP keys (e.g., \"P-256\", \"Ed25519\") */\n  crv: z.string().optional(),\n  /** X coordinate for EC keys, public key for OKP */\n  x: z.string().optional(),\n  /** Y coordinate for EC keys */\n  y: z.string().optional(),\n  /** Private key value (d parameter) */\n  d: z.string().optional(),\n  /** Public exponent for RSA keys */\n  e: z.string().optional(),\n  /** Modulus for RSA keys */\n  n: z.string().optional(),\n  /** Key ID */\n  kid: z.string().optional(),\n  /** Algorithm */\n  alg: z.string().optional(),\n  /** Key use (e.g., \"sig\", \"enc\") */\n  use: z.string().optional(),\n  /** Key operations (e.g., [\"sign\", \"verify\"]) */\n  key_ops: z.array(z.string()).optional(),\n});\n\nexport type JWK = z.infer<typeof JWKSchema>;\n\n// =============================================================================\n// Key Management Types\n// =============================================================================\n\n/**\n * Type of key in the capability registry.\n */\nexport const KeyTypeSchema = z.enum([\"main\", \"session\", \"ingested\"]);\nexport type KeyType = z.infer<typeof KeyTypeSchema>;\n\n/**\n * Information about a cryptographic key used for delegations.\n */\nexport const KeyInfoSchema = z.object({\n  /** Unique identifier for this key */\n  id: z.string(),\n  /** DID associated with this key */\n  did: z.string(),\n  /** Type of key determining its authority level */\n  type: KeyTypeSchema,\n  /** Private key in JWK format */\n  jwk: JWKSchema.optional(),\n  /** Priority for key selection (lower = higher priority) */\n  priority: z.number(),\n});\n\nexport type KeyInfo = z.infer<typeof KeyInfoSchema>;\n\n// =============================================================================\n// Error Types\n// =============================================================================\n\n/**\n * Error type for delegation operations.\n */\nexport const DelegationErrorSchema = z.object({\n  /** Error code for programmatic handling */\n  code: z.string(),\n  /** Human-readable error message */\n  message: z.string(),\n  /** The service that produced the error */\n  service: z.literal(\"delegation\"),\n  /** Original error if wrapping another error */\n  cause: z.instanceof(Error).optional(),\n  /** Additional metadata about the error */\n  meta: z.record(z.string(), z.unknown()).optional(),\n});\n\nexport type DelegationError = z.infer<typeof DelegationErrorSchema>;\n\n/**\n * Error codes for delegation operations.\n */\nexport const DelegationErrorCodes = {\n  AUTH_REQUIRED: \"AUTH_REQUIRED\",\n  AUTH_EXPIRED: \"AUTH_EXPIRED\",\n  NOT_INITIALIZED: \"NOT_INITIALIZED\",\n  NOT_FOUND: \"NOT_FOUND\",\n  REVOKED: \"REVOKED\",\n  NETWORK_ERROR: \"NETWORK_ERROR\",\n  TIMEOUT: \"TIMEOUT\",\n  ABORTED: \"ABORTED\",\n  INVALID_INPUT: \"INVALID_INPUT\",\n  PERMISSION_DENIED: \"PERMISSION_DENIED\",\n  CREATION_FAILED: \"CREATION_FAILED\",\n  REVOCATION_FAILED: \"REVOCATION_FAILED\",\n  INVALID_TOKEN: \"INVALID_TOKEN\",\n  KV_SERVICE_UNAVAILABLE: \"KV_SERVICE_UNAVAILABLE\",\n  DATA_FETCH_FAILED: \"DATA_FETCH_FAILED\",\n  VALIDATION_ERROR: \"VALIDATION_ERROR\",\n} as const;\n\nexport type DelegationErrorCode =\n  (typeof DelegationErrorCodes)[keyof typeof DelegationErrorCodes];\n\n// =============================================================================\n// Delegation Types\n// =============================================================================\n\n/**\n * Represents a delegation from one DID to another.\n */\nexport const DelegationSchema = z.object({\n  /** Content identifier (CID) of the delegation */\n  cid: z.string(),\n  /** DID of the delegate (the party receiving the delegation) */\n  delegateDID: z.string(),\n  /** Space ID this delegation applies to */\n  spaceId: z.string(),\n  /** Resource path this delegation grants access to */\n  path: z.string(),\n  /** Actions this delegation authorizes */\n  actions: z.array(z.string()),\n  /** Exact ReCap caveats that constrain every action in this scope. */\n  caveats: z.array(z.record(z.string(), z.unknown())).optional(),\n  /** When this delegation expires (accepts Date or ISO string from JSON) */\n  expiry: z.coerce.date(),\n  /** Whether this delegation has been revoked */\n  isRevoked: z.boolean(),\n  /** DID of the delegator (the party granting the delegation) */\n  delegatorDID: z.string().optional(),\n  /** When this delegation was created (accepts Date or ISO string from JSON) */\n  createdAt: z.coerce.date().optional(),\n  /** Parent delegation CID if this is a sub-delegation */\n  parentCid: z.string().optional(),\n  /** Whether sub-delegation is allowed */\n  allowSubDelegation: z.boolean().optional(),\n  /** Authorization header (UCAN bearer token) */\n  authHeader: z.string().optional(),\n});\n\nexport type Delegation = z.infer<typeof DelegationSchema>;\n\n/** Node-confirmed lifecycle state for one delegation. */\nexport const DelegationStatusSchema = z.object({\n  cid: z.string().min(1),\n  status: z.enum([\"active\", \"revoked\", \"expired\", \"unavailable\", \"not_found\"]),\n  exists: z.boolean(),\n  active: z.boolean(),\n  revoked: z.boolean(),\n  expired: z.boolean(),\n}).strict().superRefine((value, context) => {\n  const valid = value.status === \"active\"\n    ? value.exists && value.active && !value.revoked && !value.expired\n    : value.status === \"revoked\"\n      ? value.exists && !value.active && value.revoked && !value.expired\n      : value.status === \"expired\"\n        ? value.exists && !value.active && !value.revoked && value.expired\n        : value.status === \"unavailable\"\n          ? value.exists && !value.active && !value.revoked && !value.expired\n          : !value.exists && !value.active && !value.revoked && !value.expired;\n  if (!valid) {\n    context.addIssue({\n      code: z.ZodIssueCode.custom,\n      message: \"delegation status flags do not match status\",\n    });\n  }\n});\n\nexport type DelegationStatus = z.infer<typeof DelegationStatusSchema>;\n\nexport const DelegationRevocationReceiptSchema = z.object({\n  revoked: z.literal(true),\n  cid: z.string().min(1),\n}).strict();\n\nexport type DelegationRevocationReceipt = z.infer<typeof DelegationRevocationReceiptSchema>;\n\nexport const AccountDelegationResourceSchema = z.object({\n  resource: z.string().min(1),\n  actions: z.array(z.string()),\n  caveats: z.array(z.record(z.string(), z.unknown())),\n}).strict();\n\nconst AccountDelegationDateSchema = z\n  .string()\n  .datetime({ offset: true })\n  .transform((value) => new Date(value));\n\nexport const AccountDelegationRecordSchema = z.object({\n  cid: z.string().min(1),\n  direction: z.enum([\"granted\", \"received\"]),\n  delegatorDid: z.string().min(1),\n  delegateDid: z.string().min(1),\n  resources: z.array(AccountDelegationResourceSchema),\n  parents: z.array(z.string()),\n  issuedAt: AccountDelegationDateSchema.nullable(),\n  notBefore: AccountDelegationDateSchema.nullable(),\n  expiresAt: AccountDelegationDateSchema.nullable(),\n  status: z.enum([\"active\", \"pending\", \"expired\", \"revoked\", \"ancestor_revoked\"]),\n  revokedAt: AccountDelegationDateSchema.nullable().optional(),\n  revokedBy: z.string().optional(),\n  revokedAncestorCid: z.string().optional(),\n}).strict();\n\nexport const AccountDelegationPageSchema = z.object({\n  schemaVersion: z.literal(2),\n  items: z.array(AccountDelegationRecordSchema),\n  nextCursor: z.string().optional(),\n}).strict();\n\nexport type AccountDelegationResource = z.infer<typeof AccountDelegationResourceSchema>;\nexport type AccountDelegationRecord = z.infer<typeof AccountDelegationRecordSchema>;\nexport type AccountDelegationPage = z.infer<typeof AccountDelegationPageSchema>;\n\nexport const AccountDelegationQueryOptionsSchema = z.object({\n  direction: z.enum([\"granted\", \"received\", \"all\"]).optional(),\n  status: z.enum([\"active\", \"pending\", \"expired\", \"revoked\", \"ancestor_revoked\"]).optional(),\n  space: z.string().trim().min(1).optional(),\n  limit: z.number().int().min(1).max(100).optional(),\n  cursor: z.string().min(1).optional(),\n}).strict();\n\nexport type AccountDelegationQueryOptions = z.infer<typeof AccountDelegationQueryOptionsSchema>;\n\n/**\n * Entry in the capability registry mapping a capability to available keys.\n */\nexport const CapabilityEntrySchema = z.object({\n  /** Resource URI this capability applies to */\n  resource: z.string(),\n  /** Action this capability authorizes */\n  action: z.string(),\n  /** Keys that can exercise this capability, ordered by priority */\n  keys: z.array(KeyInfoSchema),\n  /** The delegation that grants this capability */\n  delegation: DelegationSchema,\n  /** When this capability expires (accepts Date or ISO string from JSON) */\n  expiresAt: z.coerce.date().optional(),\n});\n\nexport type CapabilityEntry = z.infer<typeof CapabilityEntrySchema>;\n\n/**\n * Persistent record of a delegation stored in the system.\n */\nexport const DelegationRecordSchema = z.object({\n  /** Content identifier (CID) of the delegation */\n  cid: z.string(),\n  /** Space ID this delegation applies to */\n  spaceId: z.string(),\n  /** DID of the delegator (grantor) */\n  delegator: z.string(),\n  /** DID of the delegatee (recipient) */\n  delegatee: z.string(),\n  /** Key ID used to sign/exercise this delegation */\n  keyId: z.string().optional(),\n  /** Resource path pattern this delegation grants access to */\n  path: z.string(),\n  /** Actions this delegation authorizes */\n  actions: z.array(z.string()),\n  /** When this delegation expires (accepts Date or ISO string from JSON) */\n  expiry: z.coerce.date().optional(),\n  /** When this delegation becomes valid (not before) (accepts Date or ISO string) */\n  notBefore: z.coerce.date().optional(),\n  /** Whether this delegation has been revoked */\n  isRevoked: z.boolean(),\n  /** When this delegation was created (accepts Date or ISO string from JSON) */\n  createdAt: z.coerce.date(),\n  /** Parent delegation CID if this is a sub-delegation */\n  parentCid: z.string().optional(),\n});\n\nexport type DelegationRecord = z.infer<typeof DelegationRecordSchema>;\n\n/**\n * Parameters for creating a new delegation.\n */\nexport const CreateDelegationParamsSchema = z.object({\n  /** DID of the delegate (the party receiving the delegation) */\n  delegateDID: z.string(),\n  /** Resource path this delegation grants access to */\n  path: z.string(),\n  /** Actions to authorize */\n  actions: z.array(z.string()),\n  /** When this delegation expires (accepts Date or ISO string) */\n  expiry: z.coerce.date().optional(),\n  /** Whether to disable sub-delegation */\n  disableSubDelegation: z.boolean().optional(),\n  /** Optional statement for the SIWE message */\n  statement: z.string().optional(),\n});\n\nexport type CreateDelegationParams = z.infer<typeof CreateDelegationParamsSchema>;\n\n/**\n * A chain of delegations from root to leaf (array format).\n */\nexport const DelegationChainSchema = z.array(DelegationSchema);\nexport type DelegationChain = z.infer<typeof DelegationChainSchema>;\n\n/**\n * Structured delegation chain (v2 spec).\n */\nexport const DelegationChainV2Schema = z.object({\n  /** The root delegation from the original authority */\n  root: DelegationSchema,\n  /** Intermediate delegations in the chain (may be empty) */\n  chain: z.array(DelegationSchema),\n  /** The final delegation to the current user */\n  leaf: DelegationSchema,\n});\n\nexport type DelegationChainV2 = z.infer<typeof DelegationChainV2Schema>;\n\n// =============================================================================\n// Filtering and Query Types\n// =============================================================================\n\n/**\n * Direction of delegation to filter by.\n */\nexport const DelegationDirectionSchema = z.enum([\"granted\", \"received\", \"all\"]);\nexport type DelegationDirection = z.infer<typeof DelegationDirectionSchema>;\n\n/**\n * Filters for listing delegations.\n */\nexport const DelegationFiltersSchema = z.object({\n  /** Filter by delegation direction */\n  direction: DelegationDirectionSchema.optional(),\n  /** Filter by resource path pattern */\n  path: z.string().optional(),\n  /** Filter by required actions */\n  actions: z.array(z.string()).optional(),\n  /** Include revoked delegations */\n  includeRevoked: z.boolean().optional(),\n  /** Filter by delegator DID */\n  delegator: z.string().optional(),\n  /** Filter by delegatee DID */\n  delegatee: z.string().optional(),\n  /** Only include delegations valid at this time */\n  validAt: z.coerce.date().optional(),\n  /** Maximum number of results to return */\n  limit: z.number().optional(),\n  /** Cursor for pagination */\n  cursor: z.string().optional(),\n});\n\nexport type DelegationFilters = z.infer<typeof DelegationFiltersSchema>;\n\n// =============================================================================\n// Space Types\n// =============================================================================\n\n/**\n * Type of space ownership.\n */\nexport const SpaceOwnershipSchema = z.enum([\"owned\", \"delegated\"]);\nexport type SpaceOwnership = z.infer<typeof SpaceOwnershipSchema>;\n\n/**\n * Information about a space the user has access to.\n */\nexport const SpaceInfoSchema = z.object({\n  /** Space identifier */\n  id: z.string(),\n  /** Human-readable name for the space */\n  name: z.string().optional(),\n  /** DID of the space owner */\n  owner: z.string(),\n  /** Whether user owns or has delegated access */\n  type: SpaceOwnershipSchema,\n  /** Permissions the user has in this space */\n  permissions: z.array(z.string()).optional(),\n  /** When the access expires (for delegated spaces) */\n  expiresAt: z.coerce.date().optional(),\n});\n\nexport type SpaceInfo = z.infer<typeof SpaceInfoSchema>;\n\n// =============================================================================\n// Share Link Types\n// =============================================================================\n\n/**\n * Schema for encoding share link data.\n */\nexport const ShareSchemaSchema = z.enum([\"base64\", \"compact\", \"ipfs\"]);\nexport type ShareSchema = z.infer<typeof ShareSchemaSchema>;\n\n/**\n * A shareable link containing delegation credentials.\n */\nexport const ShareLinkSchema = z.object({\n  /** Unique token identifying this share link */\n  token: z.string(),\n  /** Full URL for sharing */\n  url: z.string(),\n  /** The delegation this link grants access to */\n  delegation: DelegationSchema,\n  /** Encoding schema used for the link */\n  schema: ShareSchemaSchema,\n  /** When this share link expires */\n  expiresAt: z.coerce.date().optional(),\n  /** Human-readable description of what is being shared */\n  description: z.string().optional(),\n});\n\nexport type ShareLink = z.infer<typeof ShareLinkSchema>;\n\n/**\n * Data retrieved from a share link.\n */\nexport function createShareLinkDataSchema<T extends z.ZodTypeAny>(dataSchema: T) {\n  return z.object({\n    /** The retrieved data */\n    data: dataSchema,\n    /** The delegation that authorized this access */\n    delegation: DelegationSchema,\n    /** The space the data belongs to */\n    spaceId: z.string(),\n    /** The resource path that was accessed */\n    path: z.string(),\n  });\n}\n\nexport const ShareLinkDataSchema = createShareLinkDataSchema(z.unknown());\nexport type ShareLinkData<T = unknown> = {\n  data: T;\n  delegation: Delegation;\n  spaceId: string;\n  path: string;\n};\n\n// =============================================================================\n// Ingestion Types\n// =============================================================================\n\n/**\n * Options for ingesting an external delegation.\n */\nexport const IngestOptionsSchema = z.object({\n  /** Whether to persist the delegation to storage */\n  persist: z.boolean().optional(),\n  /** Whether to validate the full delegation chain */\n  validateChain: z.boolean().optional(),\n  /** Name for the ingested key */\n  keyName: z.string().optional(),\n  /** Whether to create a session key for this delegation */\n  createSessionKey: z.boolean().optional(),\n  /** Override the priority for the ingested key */\n  priority: z.number().optional(),\n});\n\nexport type IngestOptions = z.infer<typeof IngestOptionsSchema>;\n\n// =============================================================================\n// Parameter Types\n// =============================================================================\n\n/**\n * Parameters for generating a share link.\n */\nexport const GenerateShareParamsSchema = z.object({\n  /** Resource path to share */\n  path: z.string(),\n  /** Actions to authorize */\n  actions: z.array(z.string()).optional(),\n  /** When the share link expires */\n  expiry: z.coerce.date().optional(),\n  /** Encoding schema for the link */\n  schema: ShareSchemaSchema.optional(),\n  /** Human-readable description */\n  description: z.string().optional(),\n  /** Base URL for the share link */\n  baseUrl: z.string().optional(),\n});\n\nexport type GenerateShareParams = z.infer<typeof GenerateShareParamsSchema>;\n\n// =============================================================================\n// Configuration Types\n// =============================================================================\n\n// Note: These types include functions and external types which cannot be fully validated at runtime.\n// We use z.unknown().refine() for runtime type checking while preserving TypeScript types.\n\n/**\n * Configuration for DelegationManager.\n * Note: ServiceSession, InvokeFunction, and FetchFunction are external types.\n */\nexport const DelegationManagerConfigSchema = z.object({\n  /** TinyCloud host URLs */\n  hosts: z.array(z.string()),\n  /** Account space used by account-wide delegation history queries */\n  accountSpaceId: z.string().min(1).optional(),\n  /** Active session for authentication */\n  session: z.unknown().refine(\n    (val): val is ServiceSession => val !== null && typeof val === \"object\",\n    { message: \"Expected a ServiceSession object\" }\n  ),\n  /** Platform-specific invoke function */\n  invoke: z.unknown().refine(\n    (val): val is InvokeFunction => typeof val === \"function\",\n    { message: \"Expected an invoke function\" }\n  ),\n  /** Platform-specific invoke function for raw resource URIs */\n  invokeAny: z.unknown().refine(\n    (val): val is InvokeAnyFunction => val === undefined || typeof val === \"function\",\n    { message: \"Expected an invokeAny function or undefined\" }\n  ).optional(),\n  /** Optional custom fetch implementation */\n  fetch: z.unknown().refine(\n    (val): val is FetchFunction => val === undefined || typeof val === \"function\",\n    { message: \"Expected a fetch function or undefined\" }\n  ).optional(),\n});\n\nexport type DelegationManagerConfig = z.infer<typeof DelegationManagerConfigSchema>;\n\n/**\n * Provider interface for cryptographic key operations.\n */\nexport const KeyProviderSchema = z.object({\n  /** Generate a new session key, returns key ID */\n  createSessionKey: z.unknown().refine(\n    (val): val is (name: string) => Promise<string> => typeof val === \"function\",\n    { message: \"Expected a function\" }\n  ),\n  /** Get JWK for a key */\n  getJWK: z.unknown().refine(\n    (val): val is (keyId: string) => object => typeof val === \"function\",\n    { message: \"Expected a function\" }\n  ),\n  /** Get DID for a key */\n  getDID: z.unknown().refine(\n    (val): val is (keyId: string) => Promise<string> => typeof val === \"function\",\n    { message: \"Expected a function\" }\n  ),\n});\n\nexport type KeyProvider = z.infer<typeof KeyProviderSchema>;\n\n// =============================================================================\n// API Response Types\n// =============================================================================\n\n/**\n * Response from the delegation API.\n */\nexport const DelegationApiResponseSchema = z.object({\n  /** SIWE message content */\n  siwe: z.string(),\n  /** Signature of the SIWE message */\n  signature: z.string(),\n  /** Delegation version */\n  version: z.number(),\n  /** CID of the created delegation */\n  cid: z.string().optional(),\n});\n\nexport type DelegationApiResponse = z.infer<typeof DelegationApiResponseSchema>;\n\n// =============================================================================\n// WASM Delegation Types\n// =============================================================================\n\n/**\n * A single (service, space, path, actions) entry inside a\n * createDelegation WASM result.\n *\n * Mirrors the Rust `DelegatedResource` struct in\n * `tinycloud-sdk-wasm/src/session.rs`. Field names match the manifest\n * {@link PermissionEntry} shape so callers can reconstruct what they sent\n * without having to re-parse the UCAN.\n *\n * `service` is the short form (e.g. `\"kv\"`, `\"sql\"`) as returned by the\n * Rust layer. The SDK layer translates to the long form\n * (`\"tinycloud.kv\"`) when comparing against manifests.\n */\nexport const DelegatedResourceSchema = z.object({\n  /** Short-form service name, e.g. \"kv\", \"sql\", \"duckdb\", \"capabilities\", \"hooks\". */\n  service: z.string(),\n  /** Full space id string, e.g. \"tinycloud:pkh:eip155:1:0x....:default\". */\n  space: z.string(),\n  /** Resource path; empty string when the resource URI had no path segment. */\n  path: z.string(),\n  /** Full-URN ability strings, e.g. [\"tinycloud.kv/get\", \"tinycloud.kv/put\"]. */\n  actions: z.array(z.string()),\n  /** Exact ReCap caveats that constrain every action in this scope. */\n  caveats: z.array(z.record(z.string(), z.unknown())).optional(),\n});\n\nexport type DelegatedResource = z.infer<typeof DelegatedResourceSchema>;\n\n/**\n * Input parameters for the createDelegation WASM function.\n *\n * A single call may encode multiple `(service, path, actions)` entries\n * via the `abilities` map — the underlying UCAN will contain one\n * attenuation entry per `(service, path)` pair, all signed by the same\n * session key in one blob.\n *\n * The `abilities` shape is identical to what `prepareSession` accepts\n * (`Record<shortService, Record<path, actionURNs[]>>`), so manifest\n * resolution can feed both sides from one data structure.\n */\nexport const CreateDelegationWasmParamsSchema = z.object({\n  /** The session containing delegation credentials */\n  session: z.unknown().refine(\n    (val): val is ServiceSession => val !== null && typeof val === \"object\",\n    { message: \"Expected a ServiceSession object\" }\n  ),\n  /** DID of the delegate */\n  delegateDID: z.string(),\n  /** Space ID this delegation applies to */\n  spaceId: z.string(),\n  /**\n   * Multi-resource abilities map: short-service → path → full-URN actions.\n   * Matches the shape accepted by `prepareSession`.\n   *\n   * Example:\n   * ```\n   * {\n   *   kv: {\n   *     \"com.listen.app/\": [\"tinycloud.kv/get\", \"tinycloud.kv/put\"]\n   *   },\n   *   sql: {\n   *     \"com.listen.app/data.sqlite\": [\"tinycloud.sql/read\"]\n   *   }\n   * }\n   * ```\n   */\n  abilities: z.record(z.string(), z.record(z.string(), z.array(z.string()))),\n  /** Expiration time in seconds since Unix epoch */\n  expirationSecs: z.number(),\n  /** Optional not-before time in seconds since Unix epoch */\n  notBeforeSecs: z.number().optional(),\n});\n\nexport type CreateDelegationWasmParams = z.infer<typeof CreateDelegationWasmParamsSchema>;\n\n/**\n * Result from the createDelegation WASM function.\n *\n * A single UCAN may cover multiple resources. The `resources` array\n * describes every `(service, space, path, actions)` entry granted, in\n * deterministic (service, path) lexicographic order (the Rust side sorts\n * the HashMap entries before signing).\n */\nexport const CreateDelegationWasmResultSchema = z.object({\n  /** Base64url-encoded UCAN delegation */\n  delegation: z.string(),\n  /** CID of the delegation */\n  cid: z.string(),\n  /** DID of the delegate */\n  delegateDID: z.string(),\n  /** Expiration time */\n  expiry: z.coerce.date(),\n  /**\n   * All (service, space, path, actions) entries granted by this delegation.\n   * Always non-empty on success.\n   */\n  resources: z.array(DelegatedResourceSchema),\n});\n\nexport type CreateDelegationWasmResult = z.infer<typeof CreateDelegationWasmResultSchema>;\n\n// =============================================================================\n// Validation Helpers\n// =============================================================================\n\n/**\n * Validates a Delegation object and returns a Result.\n */\nexport function validateDelegation(data: unknown): Result<Delegation, DelegationError> {\n  const result = DelegationSchema.safeParse(data);\n  if (!result.success) {\n    return {\n      ok: false,\n      error: {\n        code: DelegationErrorCodes.VALIDATION_ERROR,\n        message: result.error.message,\n        service: \"delegation\",\n        meta: { issues: result.error.issues },\n      },\n    };\n  }\n  return { ok: true, data: result.data };\n}\n\n/**\n * Validates a CreateDelegationParams object and returns a Result.\n */\nexport function validateCreateDelegationParams(\n  data: unknown\n): Result<CreateDelegationParams, DelegationError> {\n  const result = CreateDelegationParamsSchema.safeParse(data);\n  if (!result.success) {\n    return {\n      ok: false,\n      error: {\n        code: DelegationErrorCodes.VALIDATION_ERROR,\n        message: result.error.message,\n        service: \"delegation\",\n        meta: { issues: result.error.issues },\n      },\n    };\n  }\n  return { ok: true, data: result.data };\n}\n\n/**\n * Validates a DelegationFilters object and returns a Result.\n */\nexport function validateDelegationFilters(\n  data: unknown\n): Result<DelegationFilters, DelegationError> {\n  const result = DelegationFiltersSchema.safeParse(data);\n  if (!result.success) {\n    return {\n      ok: false,\n      error: {\n        code: DelegationErrorCodes.VALIDATION_ERROR,\n        message: result.error.message,\n        service: \"delegation\",\n        meta: { issues: result.error.issues },\n      },\n    };\n  }\n  return { ok: true, data: result.data };\n}\n\n/**\n * Validates a ShareLink object and returns a Result.\n */\nexport function validateShareLink(data: unknown): Result<ShareLink, DelegationError> {\n  const result = ShareLinkSchema.safeParse(data);\n  if (!result.success) {\n    return {\n      ok: false,\n      error: {\n        code: DelegationErrorCodes.VALIDATION_ERROR,\n        message: result.error.message,\n        service: \"delegation\",\n        meta: { issues: result.error.issues },\n      },\n    };\n  }\n  return { ok: true, data: result.data };\n}\n\n/**\n * Generic validation function factory.\n */\nexport function createValidator<T>(\n  schema: z.ZodType<T>\n): (data: unknown) => Result<T, DelegationError> {\n  return (data: unknown): Result<T, DelegationError> => {\n    const result = schema.safeParse(data);\n    if (!result.success) {\n      return {\n        ok: false,\n        error: {\n          code: DelegationErrorCodes.VALIDATION_ERROR,\n          message: result.error.message,\n          service: \"delegation\",\n          meta: { issues: result.error.issues },\n        },\n      };\n    }\n    return { ok: true, data: result.data };\n  };\n}\n","/**\n * Default lifetimes for the various delegation shapes the SDK mints.\n *\n * The SDK has many delegation flows (session sign-in, runtime grants,\n * share links, manifest installs, public-space sub-delegations, …) and\n * each one used to pick its own number freehand. That made it hard to\n * tell whether a chosen value was deliberate or copy-pasted, and made\n * silent inconsistencies easy to ship.\n *\n * Every default below answers two questions:\n *  - Who recovers if the delegation leaks? (re-auth, revocation, no one)\n *  - Who is the principal at use time? (issuer, third party)\n *\n * The five tiers fall out of those answers. Pick a tier, not a number,\n * when introducing a new delegation surface.\n *\n * @packageDocumentation\n */\n\n/**\n * Auto-refreshable, never user-visible. The SDK can re-derive these\n * transparently from the active session. Lifetime exists only to bound\n * replay if the wire format leaks.\n *\n * Use for: public-space sub-delegations, internal capability re-derivations.\n */\nconst EPHEMERAL_MS = 60 * 60 * 1000; // 1 hour\n\n/**\n * Short-lived bearer URLs for direct KV reads. Anyone holding the URL can\n * read the object until expiry, so the default is deliberately shorter than\n * delegation-style tiers. Callers can request a different TTL per URL.\n *\n * Use for: KV signed read URLs.\n */\nconst SIGNED_READ_URL_MS = 5 * 60 * 1000; // 5 minutes\n\n/**\n * The user's currently-active sign-in session. Recovery is trivial\n * (re-sign-in). Length tracks how long the user/agent is expected to\n * be working without re-prompt.\n *\n * Use for: TinyCloudNode session expiry, runtime permission grants\n * (which are capped by the session anyway).\n */\nconst SESSION_MS = 7 * 24 * 60 * 60 * 1000; // 7 days\n\n/**\n * Ad-hoc third-party delegations the caller often forgets to revoke.\n * Default sized so a forgotten share link prunes itself within a week\n * rather than living forever; callers pass longer for known recipients.\n *\n * Use for: SharingService share links, DelegationManager defaults,\n * SpaceService server-response fallback.\n */\nconst SHARE_MS = 7 * 24 * 60 * 60 * 1000; // 7 days\n\n/**\n * Manifest-declared delegations for installed apps. Long enough that\n * monthly re-prompts feel like maintenance, short enough that\n * abandoning an app prunes its access.\n *\n * Use for: manifest `expiry` defaults.\n */\nconst APP_MS = 30 * 24 * 60 * 60 * 1000; // 30 days\n\n/**\n * Hard ceiling for caller-supplied expiry. Effectively \"forever\" — the\n * constant exists primarily to guard against integer overflow / typo'd\n * input, not as a security policy lever. Long-lived API-token-style\n * delegations are a first-class use case; revocation is the right\n * control for them.\n */\nconst MAX_MS = 10 * 365 * 24 * 60 * 60 * 1000; // 10 years\n\nexport const EXPIRY = {\n  EPHEMERAL_MS,\n  SIGNED_READ_URL_MS,\n  SESSION_MS,\n  SHARE_MS,\n  APP_MS,\n  MAX_MS,\n} as const;\n\nexport const DEFAULT_SIGNED_READ_URL_EXPIRY_MS = EXPIRY.SIGNED_READ_URL_MS;\n\nexport type ExpiryTier = keyof typeof EXPIRY;\n","/**\n * DelegationManager - Handles delegation CRUD operations.\n *\n * This class manages the creation, revocation, listing, and querying\n * of delegations within TinyCloud. It extracts and improves upon the\n * delegation functionality previously in ITinyCloudStorage.\n *\n * @packageDocumentation\n */\n\nimport type {\n  FetchFunction,\n  FetchResponse,\n  InvokeAnyFunction,\n  InvokeFunction,\n  ServiceSession,\n} from \"@tinycloud/sdk-services\";\nimport {\n  Result,\n  DelegationError,\n  DelegationErrorCodes,\n  Delegation,\n  DelegationStatus,\n  DelegationStatusSchema,\n  DelegationRevocationReceipt,\n  DelegationRevocationReceiptSchema,\n  AccountDelegationPage,\n  AccountDelegationPageSchema,\n  AccountDelegationQueryOptionsSchema,\n  AccountDelegationQueryOptions,\n  CreateDelegationParams,\n  DelegationChain,\n  DelegationManagerConfig,\n  DelegationApiResponse,\n} from \"./types\";\nimport { EXPIRY } from \"../expiry\";\n\n/**\n * Delegation action constants.\n */\nconst DelegationAction = {\n  CREATE: \"tinycloud.delegation/create\",\n  REVOKE: \"tinycloud.delegation/revoke\",\n  STATUS: \"tinycloud.delegation/status\",\n  LIST: \"tinycloud.delegation/list\",\n  GET: \"tinycloud.delegation/get\",\n  CHECK: \"tinycloud.delegation/check\",\n} as const;\n\n/**\n * Creates a DelegationError with the given parameters.\n */\nfunction createError(\n  code: string,\n  message: string,\n  cause?: Error,\n  meta?: Record<string, unknown>\n): DelegationError {\n  return {\n    code,\n    message,\n    service: \"delegation\",\n    cause,\n    meta,\n  };\n}\n\n/**\n * DelegationManager handles all delegation-related operations.\n *\n * @example\n * ```typescript\n * import { DelegationManager } from \"@tinycloud/sdk-core/delegations\";\n *\n * const delegations = new DelegationManager({\n *   hosts: [\"https://node.tinycloud.xyz\"],\n *   session,\n *   invoke,\n * });\n *\n * // Create a delegation\n * const result = await delegations.create({\n *   delegateDID: \"did:pkh:eip155:1:0x...\",\n *   path: \"shared/\",\n *   actions: [\"tinycloud.kv/get\", \"tinycloud.kv/list\"],\n *   expiry: new Date(Date.now() + 24 * 60 * 60 * 1000), // 24 hours\n * });\n *\n * if (result.ok) {\n *   console.log(\"Created delegation:\", result.data.cid);\n * }\n * ```\n */\nexport class DelegationManager {\n  private hosts: string[];\n  private session: ServiceSession;\n  private invoke: InvokeFunction;\n  private invokeAny?: InvokeAnyFunction;\n  private fetchFn: FetchFunction;\n  private accountSpaceId?: string;\n\n  /**\n   * Creates a new DelegationManager instance.\n   *\n   * @param config - Configuration including hosts, session, and invoke function\n   */\n  constructor(config: DelegationManagerConfig) {\n    this.hosts = config.hosts;\n    this.session = config.session;\n    this.invoke = config.invoke;\n    this.invokeAny = config.invokeAny;\n    this.fetchFn = config.fetch ?? globalThis.fetch.bind(globalThis);\n    this.accountSpaceId = config.accountSpaceId;\n  }\n\n  /**\n   * Updates the session (e.g., after re-authentication).\n   *\n   * @param session - New session to use for operations\n   */\n  public updateSession(session: ServiceSession): void {\n    this.session = session;\n  }\n\n  /**\n   * Gets the primary host URL.\n   */\n  private get host(): string {\n    return this.hosts[0];\n  }\n\n  /**\n   * Executes an invoke operation against the delegation API.\n   */\n  private async invokeOperation(\n    path: string,\n    action: string,\n    body?: string\n  ): Promise<FetchResponse> {\n    const headers = this.invoke(this.session, \"delegation\", path, action);\n\n    return this.fetchFn(`${this.host}/invoke`, {\n      method: \"POST\",\n      headers,\n      body,\n    });\n  }\n\n  /**\n   * Creates a new delegation.\n   *\n   * Delegates specific permissions to another DID for a given path.\n   * The delegatee can then use these permissions to access resources\n   * within the specified scope.\n   *\n   * @param params - Parameters for the delegation\n   * @returns Result containing the created Delegation or an error\n   *\n   * @example\n   * ```typescript\n   * const result = await manager.create({\n   *   delegateDID: bob.did,\n   *   path: \"documents/shared/\",\n   *   actions: [\"tinycloud.kv/get\", \"tinycloud.kv/put\"],\n   *   expiry: new Date(Date.now() + 7 * 24 * 60 * 60 * 1000), // 7 days\n   * });\n   * ```\n   */\n  async create(params: CreateDelegationParams): Promise<Result<Delegation>> {\n    // Validate inputs\n    if (!params.delegateDID) {\n      return {\n        ok: false,\n        error: createError(\n          DelegationErrorCodes.INVALID_INPUT,\n          \"delegateDID is required\"\n        ),\n      };\n    }\n\n    if (!params.path) {\n      return {\n        ok: false,\n        error: createError(\n          DelegationErrorCodes.INVALID_INPUT,\n          \"path is required\"\n        ),\n      };\n    }\n\n    if (!params.actions || params.actions.length === 0) {\n      return {\n        ok: false,\n        error: createError(\n          DelegationErrorCodes.INVALID_INPUT,\n          \"at least one action is required\"\n        ),\n      };\n    }\n\n    try {\n      const body = JSON.stringify({\n        delegateDID: params.delegateDID,\n        path: params.path,\n        actions: params.actions,\n        expiry: params.expiry?.toISOString(),\n        disableSubDelegation: params.disableSubDelegation ?? false,\n        statement: params.statement,\n      });\n\n      const response = await this.invokeOperation(\n        params.path,\n        DelegationAction.CREATE,\n        body\n      );\n\n      if (!response.ok) {\n        const errorText = await response.text();\n        return {\n          ok: false,\n          error: createError(\n            DelegationErrorCodes.CREATION_FAILED,\n            `Failed to create delegation: ${response.status} - ${errorText}`,\n            undefined,\n            { status: response.status, path: params.path }\n          ),\n        };\n      }\n\n      const apiResponse = (await response.json()) as DelegationApiResponse;\n\n      const delegation: Delegation = {\n        cid: apiResponse.cid ?? \"\",\n        delegateDID: params.delegateDID,\n        spaceId: this.session.spaceId,\n        path: params.path,\n        actions: params.actions,\n        expiry: params.expiry ?? new Date(Date.now() + EXPIRY.SHARE_MS),\n        isRevoked: false,\n        allowSubDelegation: !(params.disableSubDelegation ?? false),\n        createdAt: new Date(),\n      };\n\n      return { ok: true, data: delegation };\n    } catch (error) {\n      if (error instanceof Error && error.name === \"AbortError\") {\n        return {\n          ok: false,\n          error: createError(\n            DelegationErrorCodes.ABORTED,\n            \"Request aborted\",\n            error\n          ),\n        };\n      }\n      return {\n        ok: false,\n        error: createError(\n          DelegationErrorCodes.NETWORK_ERROR,\n          `Network error during delegation creation: ${String(error)}`,\n          error instanceof Error ? error : undefined\n        ),\n      };\n    }\n  }\n\n  /**\n   * Revokes an existing delegation.\n   *\n   * Once revoked, the delegation can no longer be used to access resources.\n   * This also invalidates any sub-delegations derived from this delegation.\n   *\n   * @param cid - The CID of the delegation to revoke\n   * @returns Result indicating success or an error\n   *\n   * @example\n   * ```typescript\n   * const result = await manager.revoke(\"bafy...\");\n   * if (result.ok) {\n   *   console.log(\"Delegation revoked successfully\");\n   * }\n   * ```\n   */\n  async revoke(cid: string): Promise<Result<DelegationRevocationReceipt>> {\n    if (!cid) {\n      return {\n        ok: false,\n        error: createError(\n          DelegationErrorCodes.INVALID_INPUT,\n          \"cid is required\"\n        ),\n      };\n    }\n\n    try {\n      if (!this.invokeAny) {\n        return {\n          ok: false,\n          error: createError(\n            DelegationErrorCodes.NOT_INITIALIZED,\n            \"Revocation requires an invokeAny function that can sign the target CID\"\n          ),\n        };\n      }\n\n      const headers = this.invokeAny(\n        this.session,\n        [{\n          resource: `urn:cid:${cid}`,\n          service: \"delegation\",\n          path: \"\",\n          action: DelegationAction.REVOKE,\n        }],\n      );\n      const response = await this.fetchFn(`${this.host}/revoke`, {\n        method: \"POST\",\n        headers,\n      });\n\n      if (!response.ok) {\n        const errorText = await response.text();\n\n        if (response.status === 404) {\n          return {\n            ok: false,\n            error: createError(\n              DelegationErrorCodes.NOT_FOUND,\n              `Delegation not found: ${cid}`\n            ),\n          };\n        }\n\n        return {\n          ok: false,\n          error: createError(\n            DelegationErrorCodes.REVOCATION_FAILED,\n            `Failed to revoke delegation: ${response.status} - ${errorText}`,\n            undefined,\n            { status: response.status, cid }\n          ),\n        };\n      }\n\n      const parsed = DelegationRevocationReceiptSchema.safeParse(await response.json());\n      if (!parsed.success || parsed.data.cid !== cid) {\n        return {\n          ok: false,\n          error: createError(\n            DelegationErrorCodes.REVOCATION_FAILED,\n            \"Node returned an invalid delegation revocation receipt\",\n            undefined,\n            { cid },\n          ),\n        };\n      }\n      return { ok: true, data: parsed.data };\n    } catch (error) {\n      if (error instanceof Error && error.name === \"AbortError\") {\n        return {\n          ok: false,\n          error: createError(\n            DelegationErrorCodes.ABORTED,\n            \"Request aborted\",\n            error\n          ),\n        };\n      }\n      return {\n        ok: false,\n        error: createError(\n          DelegationErrorCodes.NETWORK_ERROR,\n          `Network error during delegation revocation: ${String(error)}`,\n          error instanceof Error ? error : undefined\n        ),\n      };\n    }\n  }\n\n  /**\n   * Reads the node-confirmed lifecycle state of one delegation without\n   * exposing delegation metadata.\n   */\n  async status(cid: string): Promise<Result<DelegationStatus>> {\n    if (!cid) {\n      return {\n        ok: false,\n        error: createError(DelegationErrorCodes.INVALID_INPUT, \"cid is required\"),\n      };\n    }\n    if (!this.invokeAny) {\n      return {\n        ok: false,\n        error: createError(\n          DelegationErrorCodes.NOT_INITIALIZED,\n          \"Delegation status requires an invokeAny function that can sign the target CID\"\n        ),\n      };\n    }\n\n    try {\n      const headers = this.invokeAny(this.session, [{\n        resource: `urn:cid:${cid}`,\n        service: \"delegation\",\n        path: \"\",\n        action: DelegationAction.STATUS,\n      }]);\n      const response = await this.fetchFn(`${this.host}/delegation/status`, {\n        method: \"POST\",\n        headers: { ...headers, \"Content-Type\": \"application/json\" },\n        body: JSON.stringify({ cid }),\n      });\n      if (!response.ok && response.status !== 404) {\n        const errorText = await response.text();\n        return {\n          ok: false,\n          error: createError(\n            DelegationErrorCodes.NETWORK_ERROR,\n            `Failed to get delegation status: ${response.status} - ${errorText}`,\n            undefined,\n            { status: response.status, cid }\n          ),\n        };\n      }\n      const parsed = DelegationStatusSchema.safeParse(await response.json());\n      const responseStatusMatches = parsed.success && (\n        response.status === 404\n          ? parsed.data.status === \"not_found\" && !parsed.data.exists\n          : parsed.data.status !== \"not_found\"\n      );\n      if (!parsed.success || parsed.data.cid !== cid || !responseStatusMatches) {\n        return {\n          ok: false,\n          error: createError(\n            DelegationErrorCodes.INVALID_TOKEN,\n            \"Node returned an invalid delegation status response\",\n            undefined,\n            { cid }\n          ),\n        };\n      }\n      return { ok: true, data: parsed.data };\n    } catch (error) {\n      if (error instanceof Error && error.name === \"AbortError\") {\n        return {\n          ok: false,\n          error: createError(DelegationErrorCodes.ABORTED, \"Request aborted\", error),\n        };\n      }\n      return {\n        ok: false,\n        error: createError(\n          DelegationErrorCodes.NETWORK_ERROR,\n          `Network error during delegation status: ${String(error)}`,\n          error instanceof Error ? error : undefined\n        ),\n      };\n    }\n  }\n\n  /** Query lifecycle-complete delegation history for the authenticated account. */\n  async query(\n    options: AccountDelegationQueryOptions = {},\n  ): Promise<Result<AccountDelegationPage>> {\n    const validated = AccountDelegationQueryOptionsSchema.safeParse(options);\n    if (!validated.success) {\n      return {\n        ok: false,\n        error: createError(\n          DelegationErrorCodes.INVALID_INPUT,\n          \"Invalid delegation query options\",\n          undefined,\n          { issues: validated.error.issues },\n        ),\n      };\n    }\n    if (!this.invokeAny) {\n      return {\n        ok: false,\n        error: createError(\n          DelegationErrorCodes.NOT_INITIALIZED,\n          \"Delegation query requires an invokeAny function\",\n        ),\n      };\n    }\n    if (!this.accountSpaceId) {\n      return {\n        ok: false,\n        error: createError(\n          DelegationErrorCodes.NOT_INITIALIZED,\n          \"Delegation query requires an account space\",\n        ),\n      };\n    }\n    try {\n      const invocationHeaders = this.invokeAny(this.session, [{\n        spaceId: this.accountSpaceId,\n        service: \"delegation\",\n        path: \"\",\n        action: DelegationAction.LIST,\n      }]);\n      const headers = Object.fromEntries(new Headers(invocationHeaders).entries());\n      headers[\"content-type\"] = \"application/json\";\n      const response = await this.fetchFn(`${this.host}/delegation/query`, {\n        method: \"POST\",\n        headers,\n        body: JSON.stringify(validated.data),\n      });\n      if (!response.ok) {\n        const errorText = await response.text();\n        return {\n          ok: false,\n          error: createError(\n            DelegationErrorCodes.NETWORK_ERROR,\n            `Failed to query delegations: ${response.status} - ${errorText}`,\n            undefined,\n            { status: response.status },\n          ),\n        };\n      }\n      const parsed = AccountDelegationPageSchema.safeParse(await response.json());\n      if (!parsed.success) {\n        return {\n          ok: false,\n          error: createError(\n            DelegationErrorCodes.INVALID_TOKEN,\n            \"Node returned an invalid delegation query response\",\n          ),\n        };\n      }\n      return { ok: true, data: parsed.data };\n    } catch (error) {\n      return {\n        ok: false,\n        error: createError(\n          DelegationErrorCodes.NETWORK_ERROR,\n          `Network error during delegation query: ${String(error)}`,\n          error instanceof Error ? error : undefined,\n        ),\n      };\n    }\n  }\n\n  /**\n   * Lists all delegations for the current session's space.\n   *\n   * Returns both delegations created by the current user (as delegator)\n   * and delegations granted to the current user (as delegatee).\n   *\n   * @returns Result containing an array of Delegations or an error\n   *\n   * @example\n   * ```typescript\n   * const result = await manager.list();\n   * if (result.ok) {\n   *   for (const delegation of result.data) {\n   *     console.log(`${delegation.cid}: ${delegation.path} -> ${delegation.delegateDID}`);\n   *   }\n   * }\n   * ```\n   */\n  async list(): Promise<Result<Delegation[]>> {\n    try {\n      const response = await this.invokeOperation(\"\", DelegationAction.LIST);\n\n      if (!response.ok) {\n        const errorText = await response.text();\n        return {\n          ok: false,\n          error: createError(\n            DelegationErrorCodes.NETWORK_ERROR,\n            `Failed to list delegations: ${response.status} - ${errorText}`,\n            undefined,\n            { status: response.status }\n          ),\n        };\n      }\n\n      const data = (await response.json()) as Array<{\n        cid: string;\n        delegateDID: string;\n        delegatorDID?: string;\n        spaceId: string;\n        path: string;\n        actions: string[];\n        expiry: string;\n        isRevoked: boolean;\n        createdAt?: string;\n        parentCid?: string;\n        allowSubDelegation?: boolean;\n      }>;\n\n      const delegations: Delegation[] = data.map((item) => ({\n        cid: item.cid,\n        delegateDID: item.delegateDID,\n        delegatorDID: item.delegatorDID,\n        spaceId: item.spaceId,\n        path: item.path,\n        actions: item.actions,\n        expiry: new Date(item.expiry),\n        isRevoked: item.isRevoked,\n        createdAt: item.createdAt ? new Date(item.createdAt) : undefined,\n        parentCid: item.parentCid,\n        allowSubDelegation: item.allowSubDelegation,\n      }));\n\n      return { ok: true, data: delegations };\n    } catch (error) {\n      if (error instanceof Error && error.name === \"AbortError\") {\n        return {\n          ok: false,\n          error: createError(\n            DelegationErrorCodes.ABORTED,\n            \"Request aborted\",\n            error\n          ),\n        };\n      }\n      return {\n        ok: false,\n        error: createError(\n          DelegationErrorCodes.NETWORK_ERROR,\n          `Network error during delegation list: ${String(error)}`,\n          error instanceof Error ? error : undefined\n        ),\n      };\n    }\n  }\n\n  /**\n   * Gets the full delegation chain for a given delegation.\n   *\n   * Returns the chain of delegations from the root (original delegator)\n   * to the specified delegation, including all intermediate sub-delegations.\n   *\n   * @param cid - The CID of the delegation to get the chain for\n   * @returns Result containing the DelegationChain or an error\n   *\n   * @example\n   * ```typescript\n   * const result = await manager.getChain(\"bafy...\");\n   * if (result.ok) {\n   *   console.log(\"Chain length:\", result.data.length);\n   *   for (const delegation of result.data) {\n   *     console.log(`- ${delegation.delegatorDID} -> ${delegation.delegateDID}`);\n   *   }\n   * }\n   * ```\n   */\n  async getChain(cid: string): Promise<Result<DelegationChain>> {\n    if (!cid) {\n      return {\n        ok: false,\n        error: createError(\n          DelegationErrorCodes.INVALID_INPUT,\n          \"cid is required\"\n        ),\n      };\n    }\n\n    try {\n      const body = JSON.stringify({ cid, includeChain: true });\n\n      const response = await this.invokeOperation(\n        cid,\n        DelegationAction.GET,\n        body\n      );\n\n      if (!response.ok) {\n        const errorText = await response.text();\n\n        if (response.status === 404) {\n          return {\n            ok: false,\n            error: createError(\n              DelegationErrorCodes.NOT_FOUND,\n              `Delegation not found: ${cid}`\n            ),\n          };\n        }\n\n        return {\n          ok: false,\n          error: createError(\n            DelegationErrorCodes.NETWORK_ERROR,\n            `Failed to get delegation chain: ${response.status} - ${errorText}`,\n            undefined,\n            { status: response.status, cid }\n          ),\n        };\n      }\n\n      const data = (await response.json()) as {\n        chain: Array<{\n          cid: string;\n          delegateDID: string;\n          delegatorDID?: string;\n          spaceId: string;\n          path: string;\n          actions: string[];\n          expiry: string;\n          isRevoked: boolean;\n          createdAt?: string;\n          parentCid?: string;\n          allowSubDelegation?: boolean;\n        }>;\n      };\n\n      const chain: DelegationChain = data.chain.map((item) => ({\n        cid: item.cid,\n        delegateDID: item.delegateDID,\n        delegatorDID: item.delegatorDID,\n        spaceId: item.spaceId,\n        path: item.path,\n        actions: item.actions,\n        expiry: new Date(item.expiry),\n        isRevoked: item.isRevoked,\n        createdAt: item.createdAt ? new Date(item.createdAt) : undefined,\n        parentCid: item.parentCid,\n        allowSubDelegation: item.allowSubDelegation,\n      }));\n\n      return { ok: true, data: chain };\n    } catch (error) {\n      if (error instanceof Error && error.name === \"AbortError\") {\n        return {\n          ok: false,\n          error: createError(\n            DelegationErrorCodes.ABORTED,\n            \"Request aborted\",\n            error\n          ),\n        };\n      }\n      return {\n        ok: false,\n        error: createError(\n          DelegationErrorCodes.NETWORK_ERROR,\n          `Network error during chain retrieval: ${String(error)}`,\n          error instanceof Error ? error : undefined\n        ),\n      };\n    }\n  }\n\n  /**\n   * Checks if the current session has permission for a given path and action.\n   *\n   * This can be used to verify permissions before attempting an operation,\n   * or to implement custom access control logic.\n   *\n   * @param path - The resource path to check\n   * @param action - The action to check (e.g., \"tinycloud.kv/get\")\n   * @returns Result containing a boolean indicating permission or an error\n   *\n   * @example\n   * ```typescript\n   * const result = await manager.checkPermission(\"documents/private/\", \"tinycloud.kv/put\");\n   * if (result.ok && result.data) {\n   *   console.log(\"Permission granted\");\n   * } else {\n   *   console.log(\"Permission denied\");\n   * }\n   * ```\n   */\n  async checkPermission(path: string, action: string): Promise<Result<boolean>> {\n    if (!path) {\n      return {\n        ok: false,\n        error: createError(\n          DelegationErrorCodes.INVALID_INPUT,\n          \"path is required\"\n        ),\n      };\n    }\n\n    if (!action) {\n      return {\n        ok: false,\n        error: createError(\n          DelegationErrorCodes.INVALID_INPUT,\n          \"action is required\"\n        ),\n      };\n    }\n\n    try {\n      const body = JSON.stringify({ path, action });\n\n      const response = await this.invokeOperation(\n        path,\n        DelegationAction.CHECK,\n        body\n      );\n\n      if (!response.ok) {\n        // 403 means permission denied, which is a valid result\n        if (response.status === 403) {\n          return { ok: true, data: false };\n        }\n\n        const errorText = await response.text();\n        return {\n          ok: false,\n          error: createError(\n            DelegationErrorCodes.NETWORK_ERROR,\n            `Failed to check permission: ${response.status} - ${errorText}`,\n            undefined,\n            { status: response.status, path, action }\n          ),\n        };\n      }\n\n      const data = (await response.json()) as { allowed: boolean };\n      return { ok: true, data: data.allowed };\n    } catch (error) {\n      if (error instanceof Error && error.name === \"AbortError\") {\n        return {\n          ok: false,\n          error: createError(\n            DelegationErrorCodes.ABORTED,\n            \"Request aborted\",\n            error\n          ),\n        };\n      }\n      return {\n        ok: false,\n        error: createError(\n          DelegationErrorCodes.NETWORK_ERROR,\n          `Network error during permission check: ${String(error)}`,\n          error instanceof Error ? error : undefined\n        ),\n      };\n    }\n  }\n}\n","/**\n * Zod schemas for SharingService types.\n *\n * These schemas provide runtime validation for sharing link data,\n * receive options, and service configuration.\n *\n * @packageDocumentation\n */\n\nimport { z } from \"zod\";\nimport type {\n  FetchFunction,\n  IKVService,\n  InvokeFunction,\n  ServiceSession,\n} from \"@tinycloud/sdk-services\";\nimport {\n  JWKSchema,\n  DelegationSchema,\n  KeyProviderSchema,\n  IngestOptionsSchema,\n  type Result,\n  type DelegationError,\n  DelegationErrorCodes,\n} from \"./types.schema.js\";\nimport type { ICapabilityKeyRegistry } from \"../authorization/CapabilityKeyRegistry.js\";\nimport type { DelegationManager } from \"./DelegationManager.js\";\n\n// =============================================================================\n// EncodedShareData Schema\n// =============================================================================\n\n/**\n * Schema for data encoded in a sharing link.\n *\n * This is the primary validation point for external share link data.\n * The link is base64-decoded and JSON-parsed, then validated against this schema.\n */\nexport const EncodedShareDataSchema = z.object({\n  /** Private key in JWK format (must include d parameter) */\n  key: JWKSchema.refine(\n    (jwk) => typeof jwk.d === \"string\" && jwk.d.length > 0,\n    { message: \"JWK must include private key (d parameter)\" }\n  ),\n  /** DID of the key */\n  keyDid: z.string().min(1, \"keyDid is required\"),\n  /** The delegation granting access */\n  delegation: DelegationSchema,\n  /** Resource path this link grants access to */\n  path: z.string().min(1, \"path is required\"),\n  /** TinyCloud host URL */\n  host: z.string().url(\"host must be a valid URL\"),\n  /** Space ID */\n  spaceId: z.string().min(1, \"spaceId is required\"),\n  /** Schema version (must be 1) */\n  version: z.literal(1),\n});\n\nexport type EncodedShareData = z.infer<typeof EncodedShareDataSchema>;\n\n// =============================================================================\n// ReceiveOptions Schema\n// =============================================================================\n\n/**\n * Schema for options when receiving a sharing link.\n */\nexport const ReceiveOptionsSchema = z.object({\n  /**\n   * Whether to automatically create a sub-delegation to the current session key.\n   * Default: true\n   */\n  autoSubdelegate: z.boolean().optional(),\n  /**\n   * Whether to use the current session key for operations (requires autoSubdelegate).\n   * Default: true\n   */\n  useSessionKey: z.boolean().optional(),\n  /**\n   * Ingestion options passed to CapabilityKeyRegistry.\n   */\n  ingestOptions: IngestOptionsSchema.optional(),\n});\n\nexport type ReceiveOptions = z.infer<typeof ReceiveOptionsSchema>;\n\n// =============================================================================\n// SharingServiceConfig Schema\n// =============================================================================\n\n/**\n * Schema for SharingService configuration.\n *\n * Note: Function fields use z.function() for shape validation only.\n * External types (ServiceSession, DelegationManager, ICapabilityKeyRegistry)\n * use z.unknown() with runtime type refinement.\n */\nexport const SharingServiceConfigSchema = z.object({\n  /** TinyCloud host URLs */\n  hosts: z.array(z.string().url()).min(1, \"At least one host URL is required\"),\n  /**\n   * Active session for authentication.\n   * Required for generate(), optional for receive().\n   */\n  session: z\n    .unknown()\n    .refine(\n      (val): val is ServiceSession =>\n        val === undefined || (val !== null && typeof val === \"object\"),\n      { message: \"Expected a ServiceSession object or undefined\" }\n    )\n    .optional(),\n  /** Platform-specific invoke function */\n  invoke: z\n    .unknown()\n    .refine((val): val is InvokeFunction => typeof val === \"function\", {\n      message: \"Expected an invoke function\",\n    }),\n  /** Optional custom fetch implementation */\n  fetch: z\n    .unknown()\n    .refine(\n      (val): val is FetchFunction =>\n        val === undefined || typeof val === \"function\",\n      { message: \"Expected a fetch function or undefined\" }\n    )\n    .optional(),\n  /** Key provider for cryptographic operations */\n  keyProvider: KeyProviderSchema,\n  /** Capability key registry for key/delegation management */\n  registry: z\n    .unknown()\n    .refine(\n      (val): val is ICapabilityKeyRegistry =>\n        val !== null && typeof val === \"object\",\n      { message: \"Expected an ICapabilityKeyRegistry object\" }\n    ),\n  /**\n   * Delegation manager for creating delegations.\n   * Required for generate(), optional for receive().\n   */\n  delegationManager: z\n    .unknown()\n    .refine(\n      (val): val is DelegationManager =>\n        val === undefined || (val !== null && typeof val === \"object\"),\n      { message: \"Expected a DelegationManager object or undefined\" }\n    )\n    .optional(),\n  /** Factory for creating KV service instances */\n  createKVService: z.unknown().refine(\n    (val): val is (config: {\n      hosts: string[];\n      session: ServiceSession;\n      invoke: InvokeFunction;\n      fetch?: FetchFunction;\n      pathPrefix?: string;\n    }) => IKVService => typeof val === \"function\",\n    { message: \"Expected a createKVService factory function\" }\n  ),\n  /** Base URL for sharing links (e.g., \"https://share.myapp.com\") */\n  baseUrl: z.string().optional(),\n  /**\n   * Custom delegation creation function.\n   */\n  createDelegation: z\n    .unknown()\n    .refine((val) => val === undefined || typeof val === \"function\", {\n      message: \"Expected a createDelegation function or undefined\",\n    })\n    .optional(),\n  /**\n   * WASM function for client-side delegation creation.\n   */\n  createDelegationWasm: z\n    .unknown()\n    .refine((val) => val === undefined || typeof val === \"function\", {\n      message: \"Expected a createDelegationWasm function or undefined\",\n    })\n    .optional(),\n  /** CID computation used to verify transportable child delegations. */\n  computeCid: z\n    .unknown()\n    .refine((val): val is (data: Uint8Array, codec: bigint) => string => val === undefined || typeof val === \"function\", {\n      message: \"Expected a computeCid function or undefined\",\n    })\n    .optional(),\n  /**\n   * Path prefix for KV operations.\n   */\n  pathPrefix: z.string().optional(),\n  /**\n   * Session expiry time.\n   */\n  sessionExpiry: z.date().optional(),\n  /**\n   * Callback to create a DIRECT delegation from wallet to share key.\n   * This is the preferred method for long-lived share links because it\n   * bypasses the session delegation chain entirely.\n   */\n  onRootDelegationNeeded: z\n    .unknown()\n    .refine((val) => val === undefined || typeof val === \"function\", {\n      message: \"Expected an onRootDelegationNeeded function or undefined\",\n    })\n    .optional(),\n});\n\nexport type SharingServiceConfig = z.infer<typeof SharingServiceConfigSchema>;\n\n// =============================================================================\n// Validation Helpers\n// =============================================================================\n\n/**\n * Validates encoded share data from a decoded link.\n *\n * @param data - Unknown data to validate (from JSON.parse)\n * @returns Result with validated data or validation error\n *\n * @example\n * ```typescript\n * const parsed = JSON.parse(base64UrlDecode(linkData));\n * const result = validateEncodedShareData(parsed);\n * if (!result.ok) {\n *   return result; // Forward the error\n * }\n * const shareData = result.data;\n * ```\n */\nexport function validateEncodedShareData(\n  data: unknown\n): Result<EncodedShareData, DelegationError> {\n  const result = EncodedShareDataSchema.safeParse(data);\n  if (!result.success) {\n    return {\n      ok: false,\n      error: {\n        code: DelegationErrorCodes.VALIDATION_ERROR,\n        message: `Invalid share data: ${result.error.message}`,\n        service: \"delegation\",\n        meta: { issues: result.error.issues },\n      },\n    };\n  }\n  return { ok: true, data: result.data };\n}\n\n/**\n * Validates receive options.\n *\n * @param data - Unknown data to validate\n * @returns Result with validated data or validation error\n */\nexport function validateReceiveOptions(\n  data: unknown\n): Result<ReceiveOptions, DelegationError> {\n  const result = ReceiveOptionsSchema.safeParse(data);\n  if (!result.success) {\n    return {\n      ok: false,\n      error: {\n        code: DelegationErrorCodes.VALIDATION_ERROR,\n        message: `Invalid receive options: ${result.error.message}`,\n        service: \"delegation\",\n        meta: { issues: result.error.issues },\n      },\n    };\n  }\n  return { ok: true, data: result.data };\n}\n\n/**\n * Validates SharingService configuration.\n *\n * @param data - Unknown data to validate\n * @returns Result with validated data or validation error\n */\nexport function validateSharingServiceConfig(\n  data: unknown\n): Result<SharingServiceConfig, DelegationError> {\n  const result = SharingServiceConfigSchema.safeParse(data);\n  if (!result.success) {\n    return {\n      ok: false,\n      error: {\n        code: DelegationErrorCodes.VALIDATION_ERROR,\n        message: `Invalid SharingService config: ${result.error.message}`,\n        service: \"delegation\",\n        meta: { issues: result.error.issues },\n      },\n    };\n  }\n  return { ok: true, data: result.data };\n}\n","/**\n * TinyCloud App Manifest\n *\n * A declarative description of an app's identity and the capabilities it\n * needs. The manifest drives the SIWE recap at sign-in time, enabling a\n * single wallet prompt that covers the app's own permissions plus any\n * pre-declared delegations.\n *\n * The SDK does NOT fetch external manifests. Apps compose their own manifest\n * (optionally including backend or agent addenda) before handing it to the\n * SDK.\n *\n * Canonical spec: `.claude/specs/manifest.md`.\n *\n * @packageDocumentation\n */\n\nimport ms from \"ms\";\nimport { resolveSecretPath, SECRET_NAME_RE } from \"@tinycloud/sdk-services\";\n\n// ---------------------------------------------------------------------------\n// Public types\n// ---------------------------------------------------------------------------\n\n/**\n * A single permission entry inside a manifest. This is the shape apps write\n * in their `manifest.json` and the shape we compare against when performing\n * the capability-subset derivability check in the delegation flow.\n *\n * `service` uses the long form (e.g. `\"tinycloud.kv\"`, `\"tinycloud.sql\"`).\n * `\"tinycloud.vault\"` is an SDK-only shorthand that expands to the KV\n * resources the vault service uses; it is never encoded as a recap service.\n */\nexport interface PermissionEntry {\n  /** Service namespace, e.g. \"tinycloud.kv\", \"tinycloud.sql\", \"tinycloud.duckdb\", \"tinycloud.capabilities\". */\n  service: string;\n  /** Space name or full space URI. Defaults to \"applications\" inside manifests. */\n  space?: string;\n  /**\n   * Service-specific path.\n   * - tinycloud.kv: hierarchical prefix. \"/\" = all, \"foo/\" = prefix match, \"foo\" = exact key\n   * - tinycloud.sql: database name/file (e.g. \"data.sqlite\") or \"/\" for all\n   * - tinycloud.duckdb: database name/file\n   * - tinycloud.capabilities: capability key URI or \"/\" for all\n   */\n  path: string;\n  /**\n   * Short action names (e.g. \"get\", \"put\", \"read\", \"schema\"). The SDK expands\n   * these to full URNs (e.g. `tinycloud.kv/get`) during resolution.\n   * Already-expanded URNs are passed through unchanged.\n   */\n  actions: string[];\n  /** Exact ReCap caveat branches when this authority came from a signed ReCap. */\n  caveats?: Record<string, unknown>[];\n  /** When true, the manifest prefix is NOT prepended to `path`. Default false. */\n  skipPrefix?: boolean;\n  /** Per-entry expiry override, ms-format. */\n  expiry?: string;\n  /** User/agent-facing context for why this permission is requested. */\n  description?: string;\n}\n\nexport type ManifestSecretActions =\n  | true\n  | string\n  | string[]\n  | {\n      /** Actual vault secret name. Defaults to the manifest object key. */\n      name?: string;\n      /** Optional scoped secret namespace. Omit for global secrets. */\n      scope?: string;\n      actions?: string | string[];\n      expiry?: string;\n      description?: string;\n    };\n\n/**\n * The valid values for `Manifest.defaults`.\n *\n * - `false` → no auto-included permissions\n * - `true` → standard tier (KV + SQL read/write + capabilities:read)\n * - `\"admin\"` → standard + SQL schema\n * - `\"all\"` → everything the SDK supports (including DuckDB)\n *\n * Unknown string values silently fall back to `true`. Values are normalized\n * (lowercase + trim) before matching.\n */\nexport type ManifestDefaults = boolean | \"admin\" | \"all\";\n\n/**\n * Agent-readable app knowledge bundle pointer.\n *\n * - `true` means the default root: `knowledge/index.md`\n * - string values must point at a markdown root under `knowledge/`\n */\nexport type ManifestKnowledge = true | string;\n\n/** Default root used when `manifest.knowledge === true`. */\nexport const DEFAULT_KNOWLEDGE_ROOT = \"knowledge/index.md\";\n\n/**\n * The raw manifest shape an app declares. See `.claude/specs/manifest.md`.\n */\nexport interface Manifest {\n  /** Schema version. Optional, defaults to 1. */\n  manifest_version?: 1;\n  /** Application identifier / namespace prefix. Required. */\n  app_id: string;\n  /** Display name. Required. */\n  name: string;\n  /** Description of what the app or delegate does. Optional. */\n  description?: string;\n  /** DID of this manifest's delegate target. Optional. Required only for delegation materialization. */\n  did?: string;\n  /** URL to app icon. Optional. */\n  icon?: string;\n  /** App version string. Optional. */\n  appVersion?: string;\n  /** Default expiry for permissions. ms-format (\"30d\", \"2h\", \"1y\"). Default \"30d\". */\n  expiry?: string;\n  /** Space name or full space URI. Optional, defaults to \"applications\". */\n  space?: string;\n  /**\n   * Path prefix auto-prepended to permission paths. Optional, defaults to\n   * `app_id`. Set to `\"\"` to disable entirely. Individual permissions can opt\n   * out with `skipPrefix: true`.\n   */\n  prefix?: string;\n  /**\n   * Default permission set to auto-include. Optional, defaults to `true`.\n   * See {@link ManifestDefaults}.\n   */\n  defaults?: ManifestDefaults | string;\n  /** Whether to include the public-space companion delegation. Default `true`. */\n  includePublicSpace?: boolean;\n  /** Agent-readable knowledge bundle root. `true` means `knowledge/index.md`. */\n  knowledge?: ManifestKnowledge;\n  /**\n   * Additional permissions beyond the defaults. Use for cross-space access,\n   * DuckDB (opt-in), or `skipPrefix: true` entries.\n   */\n  permissions?: PermissionEntry[];\n  /**\n   * Secret name shorthand. Entries resolve to encrypted vault KV resources in\n   * the `secrets` space.\n   */\n  secrets?: Record<string, ManifestSecretActions>;\n}\n\n/**\n * A resolved permission entry with fully-expanded paths and action URNs.\n * This is the shape the delegation flow compares against parsed recap\n * capabilities, and the shape the session-key delegation path actually uses.\n */\nexport interface ResourceCapability {\n  /** Long-form service, e.g. \"tinycloud.kv\". */\n  service: string;\n  /** Space name or URI. Short names are resolved to full SpaceIds at sign-in time. */\n  space: string;\n  /** Path with the manifest prefix applied (or skipped per `skipPrefix`). */\n  path: string;\n  /** Full-URN actions, e.g. [\"tinycloud.kv/get\", \"tinycloud.kv/put\"]. */\n  actions: string[];\n  /** Per-entry expiry override in milliseconds. */\n  expiryMs?: number;\n  /** User/agent-facing context copied from the source permission entry. */\n  description?: string;\n}\n\n/**\n * A resolved delegation entry with fully-expanded permissions.\n */\nexport interface ResolvedDelegate {\n  /** DID of the delegate. */\n  did: string;\n  /** Informational display name. Optional. */\n  name?: string;\n  /** Expiry in milliseconds (per-delegation > manifest default > 30 days). */\n  expiryMs: number;\n  /** Fully resolved permissions. */\n  permissions: ResourceCapability[];\n}\n\n/**\n * The output of {@link resolveManifest}: a fully-expanded capability set\n * ready to drive the SIWE recap.\n */\nexport interface ResolvedCapabilities {\n  /** Application identifier copied from manifest.app_id. */\n  app_id: string;\n  /** Delegate DID copied from manifest.did, when present. */\n  did?: string;\n  /** Effective default space for this manifest. */\n  space: string;\n  /** All session-key resources with paths fully resolved (prefix applied). */\n  resources: ResourceCapability[];\n  /** Default expiry for the session, in milliseconds. */\n  expiryMs: number;\n  /** Whether to include the public-space companion. */\n  includePublicSpace: boolean;\n  /** Delegate targets derived from manifests that declare `did`. */\n  additionalDelegates: ResolvedDelegate[];\n}\n\nexport interface ManifestRegistryRecord {\n  /** KV key inside the account space. */\n  key: string;\n  /** App id this record describes. */\n  app_id: string;\n  /** Latest manifest payloads composed for this app id. */\n  manifests: Manifest[];\n}\n\nexport interface ComposeManifestOptions {\n  /** Include implicit account-space registry permissions. Default true. */\n  includeAccountRegistryPermissions?: boolean;\n}\n\nexport interface ComposedManifestRequest {\n  /** Validated manifests that were composed. */\n  manifests: Manifest[];\n  /** Full permission union requested from the user in one SIWE. */\n  resources: ResourceCapability[];\n  /** Delegations that can be materialized after sign-in. */\n  delegationTargets: ResolvedDelegate[];\n  /** Account-space registry records to write after successful sign-in. */\n  registryRecords: ManifestRegistryRecord[];\n  /** Effective session expiry, using the longest composed manifest expiry. */\n  expiryMs: number;\n  /** Whether to include the public-space companion behavior. */\n  includePublicSpace: boolean;\n}\n\n/**\n * Thrown when the manifest fails validation (missing id/name, bad expiry,\n * empty actions on a permission, etc).\n */\nexport class ManifestValidationError extends Error {\n  constructor(message: string) {\n    super(`Manifest validation failed: ${message}`);\n    this.name = \"ManifestValidationError\";\n  }\n}\n\n// ---------------------------------------------------------------------------\n// Constants\n// ---------------------------------------------------------------------------\n\n/**\n * Default expiry when neither the manifest, delegation, nor permission\n * specifies one. APP tier — see `expiry.ts`. Spec: 30 days.\n *\n * Kept as an ms-format string because the manifest schema stores expiry\n * as a string and the parser is shared between this default and\n * caller-provided values; converting `EXPIRY.APP_MS` back to a string\n * here would duplicate that same `30d` literal in another form.\n */\nexport const DEFAULT_EXPIRY = \"30d\";\n\n/**\n * Default `defaults` value when the manifest omits it. Spec: standard tier.\n */\nexport const DEFAULT_DEFAULTS: ManifestDefaults = true;\n\n/** Default manifest schema version. */\nexport const DEFAULT_MANIFEST_VERSION = 1;\n\n/** Default space for manifest-declared app data. */\nexport const DEFAULT_MANIFEST_SPACE = \"applications\";\n\n/** Account-space name used for installed-application registry records. */\nexport const ACCOUNT_REGISTRY_SPACE = \"account\";\n\n/** Account-space KV prefix used for installed-application registry records. */\nexport const ACCOUNT_REGISTRY_PATH = \"applications/\";\n\nexport const SECRETS_SPACE = \"secrets\";\n\n/** SDK-only permission service for encrypted vault resources. */\nexport const VAULT_PERMISSION_SERVICE = \"tinycloud.vault\";\n\ntype VaultKVBase = \"vault\";\n\ninterface VaultActionExpansion {\n  bases: readonly VaultKVBase[];\n  action: string;\n}\n\n/**\n * Known services and their short-form (recap URI) names. The TinyCloud\n * node encodes the recap resource URI with the short service name, while\n * action URNs and manifest entries use the long `tinycloud.<short>` form.\n * This table is the canonical bridge between the two.\n */\nexport const SERVICE_SHORT_TO_LONG: Readonly<Record<string, string>> =\n  Object.freeze({\n    kv: \"tinycloud.kv\",\n    sql: \"tinycloud.sql\",\n    duckdb: \"tinycloud.duckdb\",\n    capabilities: \"tinycloud.capabilities\",\n    hooks: \"tinycloud.hooks\",\n    encryption: \"tinycloud.encryption\",\n    delegation: \"tinycloud.delegation\",\n  });\n\n/**\n * Manifest service identifier for TinyCloud encryption network grants.\n *\n * Encryption permissions live on a network id URN\n * (`urn:tinycloud:encryption:<ownerDid>:<network>`), not on a space.\n * The `path` field is the literal networkId; `actions` are\n * `[\"decrypt\"]` (expanded to `[\"tinycloud.encryption/decrypt\"]`).\n *\n * Apps should omit `space` for encryption permissions. The SDK may emit\n * an internal `\"encryption\"` compatibility label after expansion so the\n * older `PermissionEntry`/`ResourceCapability` shape can still carry the\n * raw network URN through subset checks.\n */\nexport const ENCRYPTION_PERMISSION_SERVICE = \"tinycloud.encryption\";\n\n/** Synthetic space label used by encryption manifest entries. */\nexport const ENCRYPTION_MANIFEST_SPACE = \"encryption\";\n\n/**\n * Inverse of {@link SERVICE_SHORT_TO_LONG}.\n */\nexport const SERVICE_LONG_TO_SHORT: Readonly<Record<string, string>> =\n  Object.freeze(\n    Object.fromEntries(\n      Object.entries(SERVICE_SHORT_TO_LONG).map(([s, l]) => [l, s]),\n    ),\n  );\n\n/**\n * Default permission entries for the `true` / standard tier.\n *\n * `tinycloud.capabilities/read` is added separately for every requested\n * space, without the app path prefix. That keeps capability introspection\n * space-scoped instead of app-data scoped.\n */\nconst DEFAULT_STANDARD_ENTRIES: readonly PermissionEntry[] = [\n  {\n    service: \"tinycloud.kv\",\n    space: DEFAULT_MANIFEST_SPACE,\n    path: \"/\",\n    actions: [\"get\", \"put\", \"del\", \"list\", \"metadata\"],\n  },\n  {\n    service: \"tinycloud.sql\",\n    space: DEFAULT_MANIFEST_SPACE,\n    path: \"/\",\n    actions: [\"read\", \"write\"],\n  },\n];\n\n/**\n * Default permission entries for the `\"admin\"` tier: standard + sql/schema.\n */\nconst DEFAULT_ADMIN_ENTRIES: readonly PermissionEntry[] = [\n  {\n    service: \"tinycloud.kv\",\n    space: DEFAULT_MANIFEST_SPACE,\n    path: \"/\",\n    actions: [\"get\", \"put\", \"del\", \"list\", \"metadata\"],\n  },\n  {\n    service: \"tinycloud.sql\",\n    space: DEFAULT_MANIFEST_SPACE,\n    path: \"/\",\n    actions: [\"read\", \"write\", \"schema\"],\n  },\n];\n\n/**\n * Default permission entries for the `\"all\"` tier: admin + DuckDB.\n *\n * DuckDB is opt-in and only appears in this tier or in explicit manifest\n * `permissions` entries.\n */\nconst DEFAULT_ALL_ENTRIES: readonly PermissionEntry[] = [\n  {\n    service: \"tinycloud.kv\",\n    space: DEFAULT_MANIFEST_SPACE,\n    path: \"/\",\n    actions: [\"get\", \"put\", \"del\", \"list\", \"metadata\"],\n  },\n  {\n    service: \"tinycloud.sql\",\n    space: DEFAULT_MANIFEST_SPACE,\n    path: \"/\",\n    actions: [\"read\", \"write\", \"schema\"],\n  },\n  {\n    service: \"tinycloud.duckdb\",\n    space: DEFAULT_MANIFEST_SPACE,\n    path: \"/\",\n    actions: [\"read\", \"write\"],\n  },\n];\n\n// ---------------------------------------------------------------------------\n// Public API\n// ---------------------------------------------------------------------------\n\n/**\n * Parse an ms-format duration string (e.g. \"30d\", \"2h\", \"1y\") into\n * milliseconds.\n *\n * @throws {ManifestValidationError} on empty string, non-string input, or\n * any input `ms()` cannot parse.\n */\nexport function parseExpiry(duration: string): number {\n  if (typeof duration !== \"string\" || duration.length === 0) {\n    throw new ManifestValidationError(\n      `expiry must be a non-empty duration string (got ${JSON.stringify(duration)})`,\n    );\n  }\n  // `ms` returns `undefined` for unparseable input and can return a number\n  // or a string depending on the call signature; cast explicitly.\n  const parsed = (ms as unknown as (v: string) => number | undefined)(duration);\n  if (typeof parsed !== \"number\" || !Number.isFinite(parsed) || parsed <= 0) {\n    throw new ManifestValidationError(\n      `invalid expiry duration: ${JSON.stringify(duration)}`,\n    );\n  }\n  return parsed;\n}\n\n/**\n * Expand a list of action short names (or already-expanded URNs) into full\n * ability URNs of the form `<service>/<action>`.\n *\n * Examples:\n *   `expandActionShortNames(\"tinycloud.kv\", [\"get\", \"put\"])`\n *     → `[\"tinycloud.kv/get\", \"tinycloud.kv/put\"]`\n *   `expandActionShortNames(\"tinycloud.kv\", [\"tinycloud.kv/get\"])`\n *     → `[\"tinycloud.kv/get\"]` (passed through unchanged)\n */\nexport function expandActionShortNames(\n  service: string,\n  actions: readonly string[],\n): string[] {\n  return actions.map((a) => {\n    if (a.includes(\"/\")) {\n      // Already a full URN — pass through.\n      return a;\n    }\n    return `${service}/${a}`;\n  });\n}\n\n/**\n * Expand SDK virtual permission services into concrete recap-capable services.\n *\n * Today this handles `\"tinycloud.vault\"`, which is backed by inline\n * network-encrypted KV records:\n * - read/get: `vault/<path>` with `tinycloud.kv/get`\n * - write/put: `vault/<path>` with `tinycloud.kv/put`\n * - delete/del: `vault/<path>` with `tinycloud.kv/del`\n * - list: `vault/<path>` with `tinycloud.kv/list`\n * - head: `vault/<path>` with `tinycloud.kv/get`\n * - metadata: `vault/<path>` with `tinycloud.kv/metadata`\n */\nexport function expandPermissionEntry(entry: PermissionEntry): PermissionEntry[] {\n  if (entry.service === ENCRYPTION_PERMISSION_SERVICE) {\n    return expandEncryptionPermissionEntry(entry);\n  }\n  if (entry.service !== VAULT_PERMISSION_SERVICE) {\n    return [\n      {\n        ...entry,\n        actions: expandActionShortNames(entry.service, entry.actions),\n      },\n    ];\n  }\n\n  return expandVaultPermissionEntry(entry);\n}\n\n/**\n * Expand a `tinycloud.encryption` manifest entry.\n *\n * - `path` MUST be a networkId URN (`urn:tinycloud:encryption:...`).\n *   The manifest prefix is always skipped — network ids are top-level\n *   owner-scoped resources, not space-scoped paths.\n * - `actions` must be `decrypt`, `network.create`, or `network.revoke`\n *   (or their already-expanded `tinycloud.encryption/*` forms).\n *\n * The returned entry uses an internal `space = \"encryption\"` compatibility\n * label so old manifest grouping code does not collapse it into the app's\n * data space, and `skipPrefix` is forced to `true` so the prefix application\n * step is a no-op.\n */\nfunction expandEncryptionPermissionEntry(\n  entry: PermissionEntry,\n): PermissionEntry[] {\n  if (\n    typeof entry.path !== \"string\" ||\n    !entry.path.startsWith(\"urn:tinycloud:encryption:\")\n  ) {\n    throw new ManifestValidationError(\n      `tinycloud.encryption entries require path to be a networkId URN ` +\n        `(got ${JSON.stringify(entry.path)})`,\n    );\n  }\n  const normalizedActions: string[] = [];\n  for (const action of entry.actions) {\n    if (action === \"decrypt\" || action === \"tinycloud.encryption/decrypt\") {\n      normalizedActions.push(\"tinycloud.encryption/decrypt\");\n      continue;\n    }\n    if (\n      action === \"network.create\" ||\n      action === \"tinycloud.encryption/network.create\"\n    ) {\n      normalizedActions.push(\"tinycloud.encryption/network.create\");\n      continue;\n    }\n    if (\n      action === \"network.revoke\" ||\n      action === \"tinycloud.encryption/network.revoke\"\n    ) {\n      normalizedActions.push(\"tinycloud.encryption/network.revoke\");\n      continue;\n    }\n    if (action.includes(\"/\")) {\n      throw new ManifestValidationError(\n        `unknown encryption action ${JSON.stringify(action)}; expected decrypt, network.create, or network.revoke`,\n      );\n    }\n    throw new ManifestValidationError(\n      `unknown encryption action ${JSON.stringify(action)}; expected decrypt, network.create, or network.revoke`,\n    );\n  }\n  // Dedupe while preserving order\n  const dedupedActions: string[] = [];\n  const seen = new Set<string>();\n  for (const a of normalizedActions) {\n    if (!seen.has(a)) {\n      dedupedActions.push(a);\n      seen.add(a);\n    }\n  }\n  // Encryption resources are network-scoped, not space-scoped. We\n  // always emit the synthetic \"encryption\" space label so manifest\n  // grouping can deal with it uniformly without collapsing the\n  // networkId URN into an app data space.\n  return [\n    {\n      service: ENCRYPTION_PERMISSION_SERVICE,\n      space: ENCRYPTION_MANIFEST_SPACE,\n      path: entry.path,\n      actions: dedupedActions,\n      skipPrefix: true,\n      ...(entry.expiry !== undefined ? { expiry: entry.expiry } : {}),\n      ...(entry.description !== undefined\n        ? { description: entry.description }\n        : {}),\n    },\n  ];\n}\n\n/**\n * Expand a list of permission entries using {@link expandPermissionEntry}.\n */\nexport function expandPermissionEntries(\n  entries: readonly PermissionEntry[],\n): PermissionEntry[] {\n  return entries.flatMap(expandPermissionEntry);\n}\n\n/**\n * Apply the manifest prefix to a permission path per the spec rules.\n *\n * - `skipPrefix: true` → path is returned as-is\n * - `prefix === \"\"` → path is returned as-is\n * - path starts with \"/\" → `prefix + path`  (e.g. \"com.listen.app\" + \"/\" → \"com.listen.app/\")\n * - otherwise → `prefix + \"/\" + path`  (e.g. \"com.listen.app\" + \"data.sqlite\" → \"com.listen.app/data.sqlite\")\n */\nexport function applyPrefix(\n  prefix: string,\n  path: string,\n  skipPrefix: boolean,\n): string {\n  if (skipPrefix) {\n    return path;\n  }\n  if (prefix === \"\") {\n    return path;\n  }\n  if (path.startsWith(\"/\")) {\n    return `${prefix}${path}`;\n  }\n  return `${prefix}/${path}`;\n}\n\n/**\n * Fetch and parse a manifest from a URL (browser) or file path (node).\n * The runtime decides the fetch strategy via `globalThis.fetch`; this is\n * platform-agnostic. Callers that want custom loading should JSON.parse a\n * Manifest themselves and skip this helper.\n *\n * @throws if the fetch fails, the JSON is invalid, or the manifest fails\n * validation.\n */\nexport async function loadManifest(url: string): Promise<Manifest> {\n  const fetchFn: typeof fetch | undefined = (\n    globalThis as { fetch?: typeof fetch }\n  ).fetch;\n  if (typeof fetchFn !== \"function\") {\n    throw new ManifestValidationError(\n      \"loadManifest requires a global fetch; pass the manifest object directly on runtimes without fetch\",\n    );\n  }\n  const res = await fetchFn(url);\n  if (!res.ok) {\n    throw new ManifestValidationError(\n      `failed to fetch manifest from ${url}: HTTP ${res.status}`,\n    );\n  }\n  const json = (await res.json()) as unknown;\n  return validateManifest(json);\n}\n\n/**\n * Validate a manifest-shaped object and return it strongly-typed.\n * Throws {@link ManifestValidationError} on any hard failure.\n */\nexport function validateManifest(input: unknown): Manifest {\n  if (input === null || typeof input !== \"object\") {\n    throw new ManifestValidationError(\"manifest must be an object\");\n  }\n  const m = input as Manifest;\n  if (\n    m.manifest_version !== undefined &&\n    m.manifest_version !== DEFAULT_MANIFEST_VERSION\n  ) {\n    throw new ManifestValidationError(\n      `manifest.manifest_version must be ${DEFAULT_MANIFEST_VERSION}`,\n    );\n  }\n  if (typeof m.app_id !== \"string\" || m.app_id.length === 0) {\n    throw new ManifestValidationError(\n      \"manifest.app_id is required and must be a non-empty string\",\n    );\n  }\n  if (typeof m.name !== \"string\" || m.name.length === 0) {\n    throw new ManifestValidationError(\n      \"manifest.name is required and must be a non-empty string\",\n    );\n  }\n  if (\n    m.did !== undefined &&\n    (typeof m.did !== \"string\" || m.did.length === 0)\n  ) {\n    throw new ManifestValidationError(\n      \"manifest.did must be a non-empty DID string\",\n    );\n  }\n  if (\n    m.space !== undefined &&\n    (typeof m.space !== \"string\" || m.space.length === 0)\n  ) {\n    throw new ManifestValidationError(\n      \"manifest.space must be a non-empty string\",\n    );\n  }\n  if (m.expiry !== undefined) {\n    // Will throw with a clear error if invalid.\n    parseExpiry(m.expiry);\n  }\n  if (m.knowledge !== undefined) {\n    resolveManifestKnowledgeRoot(m.knowledge);\n  }\n  if (m.permissions !== undefined) {\n    if (!Array.isArray(m.permissions)) {\n      throw new ManifestValidationError(\n        \"manifest.permissions must be an array\",\n      );\n    }\n    m.permissions.forEach((p, i) =>\n      validatePermissionEntry(p, `permissions[${i}]`),\n    );\n  }\n  if (m.secrets !== undefined) {\n    validateManifestSecrets(m.secrets);\n  }\n  return m;\n}\n\n/**\n * Resolve a manifest knowledge pointer to its root markdown file.\n *\n * This is metadata only; app knowledge does not create capabilities.\n */\nexport function resolveManifestKnowledgeRoot(\n  knowledge: Manifest[\"knowledge\"] | undefined,\n): string | undefined {\n  if (knowledge === undefined) {\n    return undefined;\n  }\n  if (knowledge === true) {\n    return DEFAULT_KNOWLEDGE_ROOT;\n  }\n  if (typeof knowledge !== \"string\" || knowledge.length === 0) {\n    throw new ManifestValidationError(\n      \"manifest.knowledge must be true or a knowledge/*.md root path\",\n    );\n  }\n  if (!/^knowledge\\/.+\\.md$/.test(knowledge)) {\n    throw new ManifestValidationError(\n      \"manifest.knowledge must be true or a knowledge/*.md root path\",\n    );\n  }\n  return knowledge;\n}\n\nfunction validateManifestSecrets(secrets: unknown): void {\n  if (secrets === null || typeof secrets !== \"object\" || Array.isArray(secrets)) {\n    throw new ManifestValidationError(\"manifest.secrets must be an object\");\n  }\n\n  for (const [name, spec] of Object.entries(secrets)) {\n    if (!SECRET_NAME_RE.test(name)) {\n      throw new ManifestValidationError(\n        `manifest.secrets.${name} must match ${SECRET_NAME_RE.source}`,\n      );\n    }\n    try {\n      resolveSecretPath(\n        secretNameFromSpec(name, spec as ManifestSecretActions),\n        { scope: secretScopeFromSpec(spec as ManifestSecretActions) },\n      );\n    } catch (error) {\n      throw new ManifestValidationError(\n        `manifest.secrets.${name}: ${error instanceof Error ? error.message : String(error)}`,\n      );\n    }\n    const actions = secretActionsFromSpec(name, spec as ManifestSecretActions);\n    if (actions.length === 0) {\n      throw new ManifestValidationError(\n        `manifest.secrets.${name} actions must be non-empty`,\n      );\n    }\n    for (const action of actions) {\n      if (typeof action !== \"string\" || action.length === 0) {\n        throw new ManifestValidationError(\n          `manifest.secrets.${name} actions must be non-empty strings`,\n        );\n      }\n    }\n    if (\n      spec !== null &&\n      typeof spec === \"object\" &&\n      !Array.isArray(spec) &&\n      (spec as { expiry?: unknown }).expiry !== undefined\n    ) {\n      parseExpiry((spec as { expiry: string }).expiry);\n    }\n  }\n}\n\nfunction validatePermissionEntry(p: unknown, path: string): void {\n  if (p === null || typeof p !== \"object\") {\n    throw new ManifestValidationError(`${path} must be an object`);\n  }\n  const entry = p as PermissionEntry;\n  if (typeof entry.service !== \"string\" || entry.service.length === 0) {\n    throw new ManifestValidationError(`${path}.service is required`);\n  }\n  if (\n    entry.space !== undefined &&\n    (typeof entry.space !== \"string\" || entry.space.length === 0)\n  ) {\n    throw new ManifestValidationError(\n      `${path}.space must be a non-empty string`,\n    );\n  }\n  if (typeof entry.path !== \"string\") {\n    throw new ManifestValidationError(\n      `${path}.path is required (use \"\" or \"/\" for root)`,\n    );\n  }\n  if (!Array.isArray(entry.actions) || entry.actions.length === 0) {\n    throw new ManifestValidationError(\n      `${path}.actions must be a non-empty array`,\n    );\n  }\n  for (const action of entry.actions) {\n    if (typeof action !== \"string\" || action.length === 0) {\n      throw new ManifestValidationError(\n        `${path}.actions must contain non-empty strings`,\n      );\n    }\n    if (entry.service === VAULT_PERMISSION_SERVICE) {\n      vaultActionExpansion(action);\n    }\n  }\n  if (entry.caveats !== undefined &&\n    (!Array.isArray(entry.caveats) || entry.caveats.some((caveat) =>\n      caveat === null || typeof caveat !== \"object\" || Array.isArray(caveat)\n    ))\n  ) {\n    throw new ManifestValidationError(`${path}.caveats must be an array of objects`);\n  }\n  if (entry.expiry !== undefined) {\n    parseExpiry(entry.expiry);\n  }\n}\n\n/**\n * Normalize a `defaults` value: lowercase + trim, then match against known\n * tiers. Unknown string values silently fall back to `true` (standard).\n * Boolean values pass through.\n */\nexport function normalizeDefaults(\n  value: Manifest[\"defaults\"] | undefined,\n): ManifestDefaults {\n  if (value === undefined) {\n    return DEFAULT_DEFAULTS;\n  }\n  if (typeof value === \"boolean\") {\n    return value;\n  }\n  if (typeof value !== \"string\") {\n    // Spec says unknown values silently fall back to `true`.\n    return true;\n  }\n  const normalized = value.trim().toLowerCase();\n  if (normalized === \"admin\" || normalized === \"all\") {\n    return normalized;\n  }\n  // Anything else, including \"true\"/\"false\"/\"standard\"/garbage, falls back\n  // to the standard tier per spec.\n  return true;\n}\n\n/**\n * Return the default permission entries for the given tier. Entries are\n * deep-cloned so callers can mutate them without affecting the constants.\n */\nfunction defaultEntriesForTier(tier: ManifestDefaults): PermissionEntry[] {\n  if (tier === false) {\n    return [];\n  }\n  const source =\n    tier === \"admin\"\n      ? DEFAULT_ADMIN_ENTRIES\n      : tier === \"all\"\n        ? DEFAULT_ALL_ENTRIES\n        : DEFAULT_STANDARD_ENTRIES;\n  return source.map((e) => ({\n    service: e.service,\n    space: e.space,\n    path: e.path,\n    actions: [...e.actions],\n    ...(e.skipPrefix !== undefined ? { skipPrefix: e.skipPrefix } : {}),\n  }));\n}\n\n/**\n * Resolve a raw manifest into a {@link ResolvedCapabilities} object: expand\n * shortform actions, apply the prefix, merge defaults, and compute effective\n * expiries. Pure function — does no I/O.\n *\n * Resolution semantics (spec):\n * - `prefix` defaults to `app_id`; set to `\"\"` to disable prefix application entirely.\n * - `space` defaults to `applications`; per-permission `space` overrides it.\n * - `defaults` defaults to `true` (standard tier); unknown string values fall back to `true`.\n * - Per-entry expiry overrides per-delegation overrides manifest > `DEFAULT_EXPIRY`.\n * - Default entries use `skipPrefix: false` so they inherit the manifest prefix.\n */\nexport function resolveManifest(input: Manifest): ResolvedCapabilities {\n  const manifest = validateManifest(input);\n\n  const prefix =\n    manifest.prefix !== undefined ? manifest.prefix : manifest.app_id;\n  const space = manifest.space ?? DEFAULT_MANIFEST_SPACE;\n  const expiryMs = parseExpiry(manifest.expiry ?? DEFAULT_EXPIRY);\n  const includePublicSpace = manifest.includePublicSpace ?? true;\n  const tier = normalizeDefaults(manifest.defaults);\n\n  const defaultEntries = defaultEntriesForTier(tier);\n  const explicitEntries = manifest.permissions ?? [];\n  const secretEntries = secretEntriesForManifest(manifest.secrets);\n\n  // Merge order: defaults first, then explicit entries, so explicit entries\n  // for the same (service, space, path) tuple override defaults.\n  const allEntries: PermissionEntry[] = [\n    ...defaultEntries,\n    ...explicitEntries,\n    ...secretEntries,\n  ];\n\n  const resources: ResourceCapability[] = withCapabilitiesReadForSpaces(\n    allEntries.flatMap((entry) => resolveEntry(entry, prefix, expiryMs, space)),\n  );\n\n  const additionalDelegates: ResolvedDelegate[] =\n    manifest.did === undefined\n      ? []\n      : [\n          {\n            did: manifest.did,\n            name: manifest.name,\n            expiryMs,\n            permissions: resources.map(cloneResourceCapability),\n          },\n        ];\n\n  return {\n    app_id: manifest.app_id,\n    ...(manifest.did !== undefined ? { did: manifest.did } : {}),\n    space,\n    resources,\n    expiryMs,\n    includePublicSpace,\n    additionalDelegates,\n  };\n}\n\nfunction normalizeSecretActions(actions: readonly string[]): string[] {\n  const out: string[] = [];\n  const seen = new Set<string>();\n  const add = (action: string) => {\n    if (!seen.has(action)) {\n      out.push(action);\n      seen.add(action);\n    }\n  };\n\n  for (const action of actions) {\n    if (action === \"read\") {\n      add(\"get\");\n      continue;\n    }\n    if (action === \"write\") {\n      add(\"put\");\n      continue;\n    }\n    if (action === \"delete\") {\n      add(\"del\");\n      continue;\n    }\n    if (\n      action === \"get\" ||\n      action === \"put\" ||\n      action === \"del\" ||\n      action === \"list\" ||\n      action === \"metadata\"\n    ) {\n      add(action);\n      continue;\n    }\n    if (\n      action === \"tinycloud.kv/get\" ||\n      action === \"tinycloud.kv/put\" ||\n      action === \"tinycloud.kv/del\" ||\n      action === \"tinycloud.kv/list\" ||\n      action === \"tinycloud.kv/metadata\"\n    ) {\n      add(action);\n      continue;\n    }\n    throw new ManifestValidationError(\n      `unknown secret action ${JSON.stringify(action)}; expected read, write, delete, list, or metadata`,\n    );\n  }\n\n  return out;\n}\n\nfunction secretNameFromSpec(\n  fallbackName: string,\n  spec: ManifestSecretActions,\n): string {\n  if (spec !== null && typeof spec === \"object\" && !Array.isArray(spec)) {\n    return spec.name ?? fallbackName;\n  }\n  return fallbackName;\n}\n\nfunction secretScopeFromSpec(\n  spec: ManifestSecretActions,\n): string | undefined {\n  if (spec !== null && typeof spec === \"object\" && !Array.isArray(spec)) {\n    return spec.scope;\n  }\n  return undefined;\n}\n\nfunction secretActionsFromSpec(\n  name: string,\n  spec: ManifestSecretActions,\n): string[] {\n  if (spec === true) {\n    return [\"read\"];\n  }\n  if (typeof spec === \"string\") {\n    return [spec];\n  }\n  if (Array.isArray(spec)) {\n    return spec;\n  }\n  if (spec === null || typeof spec !== \"object\") {\n    throw new ManifestValidationError(\n      `manifest.secrets.${name} must be true, a string action, an actions array, or an object`,\n    );\n  }\n  if (spec.actions === undefined) {\n    return [\"read\"];\n  }\n  if (typeof spec.actions === \"string\") {\n    return [spec.actions];\n  }\n  if (Array.isArray(spec.actions)) {\n    return spec.actions;\n  }\n  throw new ManifestValidationError(\n    `manifest.secrets.${name}.actions must be a string or array`,\n  );\n}\n\nfunction secretEntriesForManifest(\n  secrets: Manifest[\"secrets\"] | undefined,\n): PermissionEntry[] {\n  if (secrets === undefined) {\n    return [];\n  }\n\n  const entries: PermissionEntry[] = [];\n  for (const [name, spec] of Object.entries(secrets)) {\n    const actions = secretActionsFromSpec(name, spec);\n    const secretPath = resolveSecretPath(\n      secretNameFromSpec(name, spec),\n      { scope: secretScopeFromSpec(spec) },\n    );\n    const extra: { expiry?: string; description?: string } =\n      spec !== true && typeof spec === \"object\" && !Array.isArray(spec)\n        ? spec\n        : {};\n    entries.push({\n      service: VAULT_PERMISSION_SERVICE,\n      space: SECRETS_SPACE,\n      path: secretPath.vaultKey,\n      actions: normalizeSecretActions(actions),\n      skipPrefix: true,\n      ...(extra.expiry !== undefined ? { expiry: extra.expiry } : {}),\n      ...(extra.description !== undefined\n        ? { description: extra.description }\n        : {}),\n    });\n  }\n  return entries;\n}\n\n/**\n * Expand a single permission entry into a {@link ResourceCapability}:\n * apply the prefix to the path and expand short actions into full URNs.\n */\nfunction resolveEntry(\n  entry: PermissionEntry,\n  prefix: string,\n  _inheritedExpiryMs: number,\n  inheritedSpace: string,\n): ResourceCapability[] {\n  // Encryption permissions reference a networkId URN as their resource\n  // — the manifest prefix is meaningless against a top-level\n  // owner-scoped resource and would corrupt the URN. Always skip.\n  const skipPrefixForEntry =\n    entry.skipPrefix === true ||\n    entry.service === ENCRYPTION_PERMISSION_SERVICE;\n  const resolvedPath = applyPrefix(prefix, entry.path, skipPrefixForEntry);\n  const entryExpiryMs =\n    entry.expiry !== undefined ? parseExpiry(entry.expiry) : undefined;\n  return expandPermissionEntry({\n    ...entry,\n    space: entry.space ?? inheritedSpace,\n    path: resolvedPath,\n    skipPrefix: true,\n  }).map((expanded) => ({\n    service: expanded.service,\n    space: expanded.space ?? inheritedSpace,\n    path: expanded.path,\n    actions: expanded.actions,\n    // Only populate `expiryMs` when the entry had its own expiry override.\n    // When absent, callers use the parent (delegation or manifest) expiry\n    // which is carried on ResolvedDelegate.expiryMs / ResolvedCapabilities.expiryMs.\n    ...(entryExpiryMs !== undefined ? { expiryMs: entryExpiryMs } : {}),\n    ...(entry.description !== undefined\n      ? { description: entry.description }\n      : {}),\n  }));\n}\n\nfunction expandVaultPermissionEntry(entry: PermissionEntry): PermissionEntry[] {\n  const byBase = new Map<VaultKVBase, string[]>();\n\n  for (const action of entry.actions) {\n    const expansion = vaultActionExpansion(action);\n    for (const base of expansion.bases) {\n      const actions = byBase.get(base) ?? [];\n      if (!actions.includes(expansion.action)) {\n        actions.push(expansion.action);\n      }\n      byBase.set(base, actions);\n    }\n  }\n\n  return [...byBase.entries()].map(([base, actions]) => ({\n    ...entry,\n    service: \"tinycloud.kv\",\n    path: vaultKVPath(base, entry.path),\n    actions,\n    skipPrefix: true,\n  }));\n}\n\nfunction vaultActionExpansion(action: string): VaultActionExpansion {\n  const normalized = normalizeVaultAction(action);\n  if (normalized === \"read\" || normalized === \"get\") {\n    return { bases: [\"vault\"], action: \"tinycloud.kv/get\" };\n  }\n  if (normalized === \"write\" || normalized === \"put\") {\n    return { bases: [\"vault\"], action: \"tinycloud.kv/put\" };\n  }\n  if (normalized === \"delete\" || normalized === \"del\") {\n    return { bases: [\"vault\"], action: \"tinycloud.kv/del\" };\n  }\n  if (normalized === \"list\") {\n    return { bases: [\"vault\"], action: \"tinycloud.kv/list\" };\n  }\n  if (normalized === \"head\") {\n    return { bases: [\"vault\"], action: \"tinycloud.kv/get\" };\n  }\n  if (normalized === \"metadata\") {\n    return { bases: [\"vault\"], action: \"tinycloud.kv/metadata\" };\n  }\n\n  throw new ManifestValidationError(\n    `unknown vault action ${JSON.stringify(action)}; expected read, write, delete, get, put, del, list, head, or metadata`,\n  );\n}\n\nfunction normalizeVaultAction(action: string): string {\n  if (action.startsWith(`${VAULT_PERMISSION_SERVICE}/`)) {\n    return action.slice(`${VAULT_PERMISSION_SERVICE}/`.length);\n  }\n  if (action.startsWith(\"tinycloud.kv/\")) {\n    return action.slice(\"tinycloud.kv/\".length);\n  }\n  if (action.includes(\"/\")) {\n    throw new ManifestValidationError(\n      `unknown vault action ${JSON.stringify(action)}; expected a tinycloud.vault or tinycloud.kv action`,\n    );\n  }\n  return action;\n}\n\nfunction vaultKVPath(base: VaultKVBase, path: string): string {\n  const normalized = path.startsWith(\"/\") ? path.slice(1) : path;\n  return `${base}/${normalized}`;\n}\n\nfunction cloneResourceCapability(\n  entry: ResourceCapability,\n): ResourceCapability {\n  return {\n    service: entry.service,\n    space: entry.space,\n    path: entry.path,\n    actions: [...entry.actions],\n    ...(entry.expiryMs !== undefined ? { expiryMs: entry.expiryMs } : {}),\n    ...(entry.description !== undefined\n      ? { description: entry.description }\n      : {}),\n  };\n}\n\nfunction clonePermissionEntry(entry: PermissionEntry): PermissionEntry {\n  return {\n    service: entry.service,\n    ...(entry.space !== undefined ? { space: entry.space } : {}),\n    path: entry.path,\n    actions: [...entry.actions],\n    ...(entry.caveats !== undefined\n      ? { caveats: JSON.parse(JSON.stringify(entry.caveats)) as Record<string, unknown>[] }\n      : {}),\n    ...(entry.skipPrefix !== undefined ? { skipPrefix: entry.skipPrefix } : {}),\n    ...(entry.expiry !== undefined ? { expiry: entry.expiry } : {}),\n    ...(entry.description !== undefined\n      ? { description: entry.description }\n      : {}),\n  };\n}\n\nfunction dedupeResources(\n  resources: readonly ResourceCapability[],\n): ResourceCapability[] {\n  const byKey = new Map<string, ResourceCapability>();\n\n  for (const resource of resources) {\n    const key = `${resource.service}\\u0000${resource.space}\\u0000${resource.path}\\u0000${resource.expiryMs ?? \"\"}`;\n    const existing = byKey.get(key);\n    if (existing === undefined) {\n      byKey.set(key, cloneResourceCapability(resource));\n      continue;\n    }\n\n    const seen = new Set(existing.actions);\n    for (const action of resource.actions) {\n      if (!seen.has(action)) {\n        existing.actions.push(action);\n        seen.add(action);\n      }\n    }\n    if (\n      existing.description === undefined &&\n      resource.description !== undefined\n    ) {\n      existing.description = resource.description;\n    }\n  }\n\n  return [...byKey.values()];\n}\n\nfunction capabilitiesReadPermission(space: string): ResourceCapability {\n  return {\n    service: \"tinycloud.capabilities\",\n    space,\n    path: \"\",\n    actions: [\"tinycloud.capabilities/read\"],\n  };\n}\n\nfunction withCapabilitiesReadForSpaces(\n  resources: readonly ResourceCapability[],\n): ResourceCapability[] {\n  if (resources.length === 0) {\n    return [];\n  }\n\n  const spaces = new Set(\n    resources\n      .filter((resource) => resource.service !== ENCRYPTION_PERMISSION_SERVICE)\n      .map((resource) => resource.space),\n  );\n  return dedupeResources([\n    ...resources,\n    ...[...spaces].map(capabilitiesReadPermission),\n  ]);\n}\n\nfunction accountRegistryPermissions(): ResourceCapability[] {\n  return [\n    ...[ACCOUNT_REGISTRY_PATH, \"spaces/\"].map((path) => ({\n      service: \"tinycloud.kv\",\n      space: ACCOUNT_REGISTRY_SPACE,\n      path,\n      actions: [\"tinycloud.kv/get\", \"tinycloud.kv/put\", \"tinycloud.kv/list\"],\n    })),\n    {\n      service: \"tinycloud.delegation\",\n      space: ACCOUNT_REGISTRY_SPACE,\n      path: \"\",\n      actions: [\"tinycloud.delegation/list\"],\n    },\n  ];\n}\n\nfunction accountRegistryIndexPermission(): ResourceCapability {\n  return {\n    service: \"tinycloud.sql\",\n    space: ACCOUNT_REGISTRY_SPACE,\n    path: \"account\",\n    actions: [\"tinycloud.sql/read\", \"tinycloud.sql/write\", \"tinycloud.sql/schema\"],\n  };\n}\n\n/**\n * Compose one or more manifests into the single capability request that should\n * be signed. Fetching manifests is intentionally out of band; callers pass the\n * already-loaded manifest objects.\n */\nexport function composeManifestRequest(\n  inputs: readonly Manifest[],\n  options: ComposeManifestOptions = {},\n): ComposedManifestRequest {\n  if (!Array.isArray(inputs) || inputs.length === 0) {\n    throw new ManifestValidationError(\n      \"composeManifestRequest requires at least one manifest\",\n    );\n  }\n\n  const includeAccountRegistryPermissions =\n    options.includeAccountRegistryPermissions ?? true;\n  const manifests = inputs.map(validateManifest);\n  const resolved = manifests.map(resolveManifest);\n  const resources = resolved.flatMap((entry) => entry.resources);\n  const delegationTargets = resolved.flatMap((entry) =>\n    entry.additionalDelegates.map((delegate) => ({\n      ...delegate,\n      permissions: dedupeResources(delegate.permissions),\n    })),\n  );\n\n  if (includeAccountRegistryPermissions) {\n    resources.push(...accountRegistryPermissions());\n    resources.push(accountRegistryIndexPermission());\n  }\n  const resourcesWithImplicitCapabilities =\n    withCapabilitiesReadForSpaces(resources);\n\n  const manifestsByAppId = new Map<string, Manifest[]>();\n  for (const manifest of manifests) {\n    const current = manifestsByAppId.get(manifest.app_id);\n    if (current === undefined) {\n      manifestsByAppId.set(manifest.app_id, [manifest]);\n    } else {\n      current.push(manifest);\n    }\n  }\n\n  const registryRecords: ManifestRegistryRecord[] =\n    includeAccountRegistryPermissions\n      ? [...manifestsByAppId.entries()].map(([app_id, appManifests]) => ({\n          key: `${ACCOUNT_REGISTRY_PATH}${app_id}`,\n          app_id,\n          manifests: appManifests.map((manifest) => ({\n            ...manifest,\n            permissions: manifest.permissions?.map(clonePermissionEntry),\n          })),\n        }))\n      : [];\n\n  return {\n    manifests,\n    resources: resourcesWithImplicitCapabilities,\n    delegationTargets,\n    registryRecords,\n    expiryMs: Math.max(...resolved.map((entry) => entry.expiryMs)),\n    includePublicSpace: resolved.some((entry) => entry.includePublicSpace),\n  };\n}\n\n// ---------------------------------------------------------------------------\n// Abilities map construction (bridge to WASM prepareSession / createDelegation)\n// ---------------------------------------------------------------------------\n\n/**\n * The shape `prepareSession` and the multi-resource `createDelegation` WASM\n * export both accept:\n *\n * ```\n * { [shortService]: { [path]: [fullUrnAction, ...] } }\n * ```\n *\n * - `shortService` is the recap-level service segment (`\"kv\"`, `\"sql\"`,\n *   `\"duckdb\"`, `\"capabilities\"`, `\"hooks\"`) — not the manifest long form.\n * - `path` is the fully-resolved path (prefix already applied). An empty\n *   string means \"no path segment\" on the resource URI.\n * - Action strings are full URNs like `\"tinycloud.kv/get\"`.\n *\n * This is a single source of truth for both the session's own recap (at\n * sign-in) and the delegations it can derive (post sign-in). We re-use it\n * for both so one manifest drives both sides.\n */\nexport type AbilitiesMap = Record<string, Record<string, string[]>>;\n\n/**\n * Per-space abilities map accepted by the newer WASM session config:\n *\n * ```\n * { [spaceIdOrName]: { [shortService]: { [path]: [fullUrnAction, ...] } } }\n * ```\n */\nexport type SpaceAbilitiesMap = Record<string, AbilitiesMap>;\n\n/**\n * Convert a list of {@link ResourceCapability} entries (manifest\n * long-form service, full-URN actions) into the {@link AbilitiesMap}\n * shape the WASM layer expects.\n *\n * When multiple entries target the same `(service, path)` pair, their\n * action lists are merged and deduped. Entries whose service has no\n * short-form mapping in {@link SERVICE_LONG_TO_SHORT} are rejected with\n * a {@link ManifestValidationError} — the SDK does not silently drop\n * unknown services because the recap encoding would lose them.\n *\n * Paths are kept verbatim: this function does NOT collapse\n * `\"com.listen.app/\"` and `\"com.listen.app\"` or reinterpret empty /\n * slash strings. Callers that care about path canonicalization should\n * normalize before calling.\n */\nexport function resourceCapabilitiesToAbilitiesMap(\n  resources: readonly ResourceCapability[],\n): AbilitiesMap {\n  const out: AbilitiesMap = {};\n  for (const r of resources) {\n    const shortService = SERVICE_LONG_TO_SHORT[r.service];\n    if (shortService === undefined) {\n      throw new ManifestValidationError(\n        `unknown service '${r.service}' — no short-form mapping. Known services: ${Object.keys(SERVICE_LONG_TO_SHORT).join(\", \")}`,\n      );\n    }\n    if (out[shortService] === undefined) {\n      out[shortService] = {};\n    }\n    const pathsMap = out[shortService];\n    const existing = pathsMap[r.path];\n    if (existing === undefined) {\n      // Copy so downstream mutation can't leak back into the input.\n      pathsMap[r.path] = [...r.actions];\n    } else {\n      // Merge + dedupe while preserving first-seen order.\n      const seen = new Set(existing);\n      for (const action of r.actions) {\n        if (!seen.has(action)) {\n          existing.push(action);\n          seen.add(action);\n        }\n      }\n    }\n  }\n  return out;\n}\n\n/**\n * Group resolved capabilities by `space`, then convert each group into a WASM\n * abilities map. Short space names are left as-is here; platform layers that\n * know the wallet address and chain id turn them into full SpaceIds.\n */\nexport function resourceCapabilitiesToSpaceAbilitiesMap(\n  resources: readonly ResourceCapability[],\n): SpaceAbilitiesMap {\n  const grouped = new Map<string, ResourceCapability[]>();\n  for (const resource of resources) {\n    const entries = grouped.get(resource.space);\n    if (entries === undefined) {\n      grouped.set(resource.space, [resource]);\n    } else {\n      entries.push(resource);\n    }\n  }\n\n  const out: SpaceAbilitiesMap = {};\n  for (const [space, entries] of grouped.entries()) {\n    out[space] = resourceCapabilitiesToAbilitiesMap(entries);\n  }\n  return out;\n}\n\n/**\n * Build the {@link AbilitiesMap} that a session should be signed with,\n * given a {@link ResolvedCapabilities} (i.e. the output of\n * {@link resolveManifest}).\n *\n * The resulting map is the **union** of:\n * 1. the app's own resources (`resolved.resources`), and\n * 2. every permission declared in every `additionalDelegates[*]` entry.\n *\n * The union is what makes the manifest's delegations ergonomic: at\n * sign-in, the session key acquires recap coverage for both the app's\n * runtime needs and every downstream delegation target. Post sign-in,\n * `delegateTo(backendDID, backendPermissions)` can then issue the\n * sub-delegation via the session key (no wallet prompt) because the\n * caps are already part of the granted set.\n *\n * Duplicate `(service, path, action)` triples across resources and\n * delegations are merged and deduped — the session SIWE doesn't need\n * them repeated.\n */\nexport function manifestAbilitiesUnion(\n  resolved: ResolvedCapabilities,\n): AbilitiesMap {\n  const all: ResourceCapability[] = [...resolved.resources];\n  for (const delegate of resolved.additionalDelegates) {\n    for (const perm of delegate.permissions) {\n      all.push(perm);\n    }\n  }\n  return resourceCapabilitiesToAbilitiesMap(all);\n}\n","import { getAddress, isAddress } from \"viem\";\n\nexport type CanonicalAddress = `0x${string}`;\n\nexport interface PkhDidParts {\n  method: \"pkh\";\n  namespace: \"eip155\";\n  chainId: number;\n  address: CanonicalAddress;\n}\n\nexport interface DidEqualsOptions {\n  ignoreFragment?: boolean;\n}\n\nexport interface DidCacheKeyOptions {\n  preserveFragment?: boolean;\n}\n\nexport class IdentityParseError extends Error {\n  constructor(message: string) {\n    super(message);\n    this.name = \"IdentityParseError\";\n  }\n}\n\nconst PKH_DID_RE = /^did:pkh:eip155:(\\d+):(0x[a-fA-F0-9]{40})$/;\nconst DID_RE = /^did:[a-z0-9]+:.+$/;\n\nfunction splitDidUrl(input: string): { did: string; fragment: string } {\n  const fragmentIndex = input.indexOf(\"#\");\n  if (fragmentIndex < 0) {\n    return { did: input, fragment: \"\" };\n  }\n  return {\n    did: input.slice(0, fragmentIndex),\n    fragment: input.slice(fragmentIndex),\n  };\n}\n\nfunction assertValidChainId(chainId: number): void {\n  if (!Number.isSafeInteger(chainId) || chainId <= 0) {\n    throw new IdentityParseError(`Invalid EIP-155 chain ID: ${chainId}`);\n  }\n}\n\nexport function isEvmAddress(input: string): boolean {\n  return isAddress(input, { strict: false });\n}\n\nexport function canonicalizeAddress(address: string): CanonicalAddress {\n  if (!isEvmAddress(address)) {\n    throw new IdentityParseError(`Invalid EVM address: ${address}`);\n  }\n  return getAddress(address) as CanonicalAddress;\n}\n\nexport function addressStorageKey(address: string): CanonicalAddress {\n  return canonicalizeAddress(address).toLowerCase() as CanonicalAddress;\n}\n\nexport function pkhDid(address: string, chainId: number = 1): string {\n  assertValidChainId(chainId);\n  return `did:pkh:eip155:${chainId}:${canonicalizeAddress(address)}`;\n}\n\nexport function parsePkhDid(did: string): PkhDidParts | null {\n  const match = did.match(PKH_DID_RE);\n  if (!match) return null;\n\n  const chainId = Number(match[1]);\n  assertValidChainId(chainId);\n\n  return {\n    method: \"pkh\",\n    namespace: \"eip155\",\n    chainId,\n    address: canonicalizeAddress(match[2]),\n  };\n}\n\nexport function canonicalizeDid(did: string): string {\n  const pkh = parsePkhDid(did);\n  if (pkh) {\n    return pkhDid(pkh.address, pkh.chainId);\n  }\n  if (DID_RE.test(did)) {\n    return did;\n  }\n  throw new IdentityParseError(`Invalid DID: ${did}`);\n}\n\nexport function canonicalizeDidUrl(didUrl: string): string {\n  const { did, fragment } = splitDidUrl(didUrl);\n  return `${canonicalizeDid(did)}${fragment}`;\n}\n\nexport function principalDid(didUrl: string): string {\n  return canonicalizeDid(splitDidUrl(didUrl).did);\n}\n\nexport function didEquals(a: string, b: string, options: DidEqualsOptions = {}): boolean {\n  const canonicalize = options.ignoreFragment ? principalDid : canonicalizeDidUrl;\n  return canonicalize(a) === canonicalize(b);\n}\n\nexport function principalDidEquals(a: string, b: string): boolean {\n  return didEquals(a, b, { ignoreFragment: true });\n}\n\nexport function didCacheKey(input: string, options: DidCacheKeyOptions = {}): string {\n  const { did, fragment } = splitDidUrl(input);\n  const pkh = parsePkhDid(did);\n  const base = pkh\n    ? `did:pkh:eip155:${pkh.chainId}:${addressStorageKey(pkh.address)}`\n    : canonicalizeDid(did);\n\n  return options.preserveFragment ? `${base}${fragment}` : base;\n}\n\nexport function makePkhSpaceId(\n  address: string,\n  chainId: number,\n  name: string,\n): string {\n  assertValidChainId(chainId);\n  if (!name) {\n    throw new IdentityParseError(\"Space name cannot be empty\");\n  }\n  return `tinycloud:pkh:eip155:${chainId}:${canonicalizeAddress(address)}:${name}`;\n}\n","/**\n * Capability subset checking and recap parsing.\n *\n * This module powers the capability-chain delegation flow. The key decision\n * a `delegateTo` call has to make is: \"are the requested capabilities a\n * subset of what the current session already grants?\"\n *\n * - If yes → issue the delegation via the session-key UCAN path (no wallet prompt).\n * - If no → raise {@link PermissionNotInManifestError} so the caller can\n *   trigger an escalation flow via `requestPermissions`.\n *\n * Canonical spec: `.claude/specs/capability-chain.md`.\n *\n * @packageDocumentation\n */\n\nimport {\n  DEFAULT_MANIFEST_SPACE,\n  type PermissionEntry,\n  SERVICE_SHORT_TO_LONG,\n  expandActionShortNames,\n} from \"./manifest\";\n\n// ---------------------------------------------------------------------------\n// Errors\n// ---------------------------------------------------------------------------\n\n/**\n * Thrown when a `delegateTo` call requests capabilities that the current\n * session does not already grant. The caller can catch this and trigger\n * `requestPermissions(missing)` to show an escalation modal.\n */\nexport class PermissionNotInManifestError extends Error {\n  public readonly missing: PermissionEntry[];\n  public readonly granted: PermissionEntry[];\n\n  constructor(missing: PermissionEntry[], granted: PermissionEntry[]) {\n    super(\n      `Requested capabilities exceed current session. Missing ${missing.length} entries.`\n    );\n    this.name = \"PermissionNotInManifestError\";\n    this.missing = missing;\n    this.granted = granted;\n  }\n}\n\n/**\n * Thrown when the current session has expired (or will expire within the\n * safety margin). The caller should trigger a fresh sign-in.\n */\nexport class SessionExpiredError extends Error {\n  public readonly expiredAt: Date;\n\n  constructor(expiredAt: Date) {\n    super(`Session expired at ${expiredAt.toISOString()}`);\n    this.name = \"SessionExpiredError\";\n    this.expiredAt = expiredAt;\n  }\n}\n\n/**\n * Thrown when the installed WASM delegation boundary cannot encode every\n * constrained ReCap branch in a requested child delegation.\n */\nexport class CaveatedDelegationUnsupportedError extends Error {\n  /** Stable machine-readable error code for fail-closed caveated delegation. */\n  code = \"CAVEATED_DELEGATION_UNSUPPORTED\" as const;\n  /** Requested entries whose constrained ReCap branches cannot be preserved. */\n  entries: PermissionEntry[];\n\n  constructor(entries: PermissionEntry[]) {\n    super(\n      \"Cannot create a caveated delegation because this WASM delegation boundary cannot preserve every ReCap caveat branch exactly.\"\n    );\n    this.name = \"CaveatedDelegationUnsupportedError\";\n    this.entries = entries.map(cloneEntry);\n  }\n}\n\n// ---------------------------------------------------------------------------\n// Space normalization\n// ---------------------------------------------------------------------------\n\n/**\n * Normalize a space identifier to its short-name form.\n *\n * Recap resource URIs in a signed SIWE encode the space as a full URI of the\n * form `tinycloud:pkh:eip155:{chainId}:{address}:{name}` (e.g.\n * `tinycloud:pkh:eip155:1:0xd559...:default`). Manifest permissions and\n * backend-advertised permissions use the short `{name}` form (e.g.\n * `\"default\"`).\n *\n * Strict string comparison between these two forms would always fail, so we\n * normalize both sides to the short name before comparing. The trailing\n * segment after the last `:` in a `tinycloud:` URI is the space name.\n *\n * Short names (`\"default\"`, `\"work-space\"`) are returned unchanged.\n * Any non-`tinycloud:` string is returned unchanged. A malformed URI with a\n * trailing colon is returned unchanged (so the check degrades to a strict\n * mismatch rather than collapsing to an empty string).\n *\n * @internal\n */\nexport function normalizeSpace(space: string): string {\n  if (!space.startsWith(\"tinycloud:\")) {\n    return space;\n  }\n  const lastColon = space.lastIndexOf(\":\");\n  if (lastColon === -1 || lastColon === space.length - 1) {\n    return space;\n  }\n  return space.slice(lastColon + 1);\n}\n\n// ---------------------------------------------------------------------------\n// Subset check\n// ---------------------------------------------------------------------------\n\nexport interface SubsetCheckResult {\n  /** True when every requested entry is covered by a granted entry. */\n  subset: boolean;\n  /** Entries the granted set does not cover (empty when `subset` is true). */\n  missing: PermissionEntry[];\n}\n\n/**\n * Check whether `requested` is a strict subset of `granted`.\n *\n * Matching rules for each `requested[i]`:\n * - `service` matches exactly.\n * - `space` matches exactly.\n * - Path containment:\n *     - If `granted.path` ends with `/`, it covers any `requested.path` that\n *       starts with `granted.path`.\n *     - Otherwise, the paths must match exactly.\n * - Action containment: every requested URN must be matched exactly or by a\n *   service-scoped wildcard such as `tinycloud.kv/*`.\n *\n * Grant entries with the same service, space, path coverage, and caveats are\n * considered together. This matters because ReCap parsers may return one\n * entry per action even when the original manifest grouped those actions.\n * Any `requested` entry whose actions are not collectively covered is added\n * to `missing` and the overall result is non-subset.\n *\n * Both sides are expected to be in the canonical long-form shape (service\n * starts with `tinycloud.`, actions are full URNs). Use {@link parseRecapCapabilities}\n * or `expandActionShortNames` to normalize inputs first.\n */\nexport function isCapabilitySubset(\n  requested: readonly PermissionEntry[],\n  granted: readonly PermissionEntry[]\n): SubsetCheckResult {\n  const missing: PermissionEntry[] = [];\n\n  for (const req of requested) {\n    const matchingScope = granted.filter((entry) =>\n      canonicalizeEntryScopeMatches(req, entry)\n    );\n    const requestedActions = expandActionShortNames(\n      req.service,\n      req.actions\n    );\n    const grantedActions = matchingScope.flatMap((entry) =>\n      expandActionShortNames(entry.service, entry.actions)\n    );\n    const covered = requestedActions.every((requestedAction) =>\n      grantedActions.some((grantedAction) =>\n        actionContains(grantedAction, requestedAction)\n      )\n    );\n    if (!covered) {\n      missing.push(cloneEntry(req));\n    }\n  }\n\n  return { subset: missing.length === 0, missing };\n}\n\n/**\n * Returns true when `granted` fully covers `requested` — same service, same\n * space, path containment per spec, and action set containment.\n */\nfunction canonicalizeEntryScopeMatches(\n  requested: PermissionEntry,\n  granted: PermissionEntry\n): boolean {\n  if (requested.service !== granted.service) {\n    return false;\n  }\n  // Normalize both sides so callers passing short names (`\"default\"`) match\n  // recap-parsed full URIs (`\"tinycloud:pkh:eip155:1:0xd559...:default\"`) and\n  // vice versa. Idempotent for short names.\n  if (\n    normalizeSpace(requested.space ?? DEFAULT_MANIFEST_SPACE) !==\n    normalizeSpace(granted.space ?? DEFAULT_MANIFEST_SPACE)\n  ) {\n    return false;\n  }\n  if (!pathContains(granted.path, requested.path)) {\n    return false;\n  }\n  // There is no safe general partial ordering for arbitrary ReCap caveat\n  // objects. A caveated authority therefore only covers the same caveat set;\n  // treating it as uncaveated would authorize a broader child delegation.\n  if (!recapCaveatsEqual(requested.caveats, granted.caveats)) {\n    return false;\n  }\n  return true;\n}\n\n/**\n * Compare ReCap caveat branch sets without losing signed branch structure.\n *\n * ReCap represents an unconstrained ability as `[{}]`, while SDK callers can\n * represent that same authority as `undefined` or `[]`. Those three forms are\n * equivalent. Every other branch, including an unconstrained branch mixed\n * with a constrained one, remains part of the canonical comparison.\n */\nexport function recapCaveatsEqual(\n  left: readonly Record<string, unknown>[] | undefined,\n  right: readonly Record<string, unknown>[] | undefined,\n): boolean {\n  return canonicalizeRecapCaveats(left) === canonicalizeRecapCaveats(right);\n}\n\n/**\n * Canonicalize a ReCap caveat branch set for exact equality checks.\n *\n * Object keys and branch order do not affect equality. A lone unconstrained\n * branch is normalized to the SDK's empty-caveat representation, but an\n * unconstrained branch in a mixed set is deliberately retained.\n */\nexport function canonicalizeRecapCaveats(\n  caveats: readonly Record<string, unknown>[] | undefined,\n): string {\n  const canonicalize = (value: unknown): string => {\n    if (value === null || typeof value === \"boolean\" || typeof value === \"string\") {\n      return JSON.stringify(value);\n    }\n    if (typeof value === \"number\") {\n      if (Number.isFinite(value)) return JSON.stringify(value);\n      throw new Error(\"ReCap caveats must contain only JSON values.\");\n    }\n    if (Array.isArray(value)) return `[${value.map(canonicalize).join(\",\")}]`;\n    if (typeof value === \"object\") {\n      const object = value as Record<string, unknown>;\n      const prototype = Object.getPrototypeOf(object);\n      if (prototype !== Object.prototype && prototype !== null) {\n        throw new Error(\"ReCap caveats must contain only JSON values.\");\n      }\n      return `{${Object.keys(object).sort().map((key) =>\n        `${JSON.stringify(key)}:${canonicalize(object[key])}`,\n      ).join(\",\")}}`;\n    }\n    throw new Error(\"ReCap caveats must contain only JSON values.\");\n  };\n  const branches = (caveats ?? []).map(canonicalize).sort();\n  if (branches.length === 0 || (branches.length === 1 && branches[0] === \"{}\")) {\n    return \"[]\";\n  }\n  return `[${branches.join(\",\")}]`;\n}\n\n/** Return whether a granted action pattern covers one requested action. */\nexport function actionContains(grantedAction: string, requestedAction: string): boolean {\n  if (grantedAction === \"*\" || grantedAction === requestedAction) return true;\n  if (!grantedAction.endsWith(\"/*\")) return false;\n  const service = grantedAction.slice(0, -2);\n  return requestedAction === service || requestedAction.startsWith(`${service}/`);\n}\n\n/**\n * Path containment per spec:\n * - `granted.path` ends with `/` → prefix match (requested starts with granted)\n * - otherwise → exact string match\n *\n * The empty string is treated as \"no path constraint\" and matches anything.\n * The single-character `\"/\"` also matches anything (it is a trailing-slash\n * prefix of zero-length).\n */\nfunction pathContains(grantedPath: string, requestedPath: string): boolean {\n  if (grantedPath === \"\" || grantedPath === \"/\") {\n    return true;\n  }\n  if (grantedPath.endsWith(\"/\")) {\n    return requestedPath.startsWith(grantedPath);\n  }\n  return requestedPath === grantedPath;\n}\n\nfunction cloneEntry(entry: PermissionEntry): PermissionEntry {\n  return {\n    service: entry.service,\n    ...(entry.space !== undefined ? { space: entry.space } : {}),\n    path: entry.path,\n    actions: [...entry.actions],\n    ...(entry.caveats !== undefined\n      ? { caveats: JSON.parse(JSON.stringify(entry.caveats)) as Record<string, unknown>[] }\n      : {}),\n    ...(entry.skipPrefix !== undefined ? { skipPrefix: entry.skipPrefix } : {}),\n    ...(entry.expiry !== undefined ? { expiry: entry.expiry } : {}),\n  };\n}\n\n// ---------------------------------------------------------------------------\n// Recap parsing (WASM wrapper)\n// ---------------------------------------------------------------------------\n\n/**\n * The raw shape returned from the WASM `parseRecapFromSiwe` export. The\n * Rust layer encodes the service in the short form (e.g. `\"kv\"`) because\n * that is what the SIWE recap resource URI actually contains. We normalize\n * to the manifest long form (`\"tinycloud.kv\"`) in {@link parseRecapCapabilities}.\n *\n * @internal\n */\nexport interface WasmRecapEntry {\n  service: string;\n  space: string;\n  path: string;\n  actions: string[];\n  /** Exact ReCap caveats shared by every action in this entry. */\n  caveats?: Record<string, unknown>[];\n}\n\n/**\n * Signature of the WASM `parseRecapFromSiwe` export. Accepts the signed\n * SIWE message string and returns an array of raw recap entries. Throws if\n * the SIWE is malformed or the recap statement has been tampered.\n *\n * Exposed as an interface so the SDK can inject the web or node binding\n * without `capabilities.ts` needing to know which.\n */\nexport type ParseRecapFromSiwe = (siweString: string) => WasmRecapEntry[];\n\n/**\n * Parse a signed SIWE message into an array of {@link PermissionEntry}\n * objects in the canonical long-form manifest shape.\n *\n * This is a thin wrapper around the WASM `parseRecapFromSiwe` export that:\n * 1. Normalizes short-form services (`\"kv\"`) to long-form (`\"tinycloud.kv\"`).\n * 2. Returns entries in a deterministic order (sorted by space, then service,\n *    then path) so downstream equality checks are stable.\n *\n * Returns an empty array when the SIWE has no recap resource (plain auth\n * SIWE); this matches the WASM function's behavior and the spec.\n *\n * @param parseWasm The WASM `parseRecapFromSiwe` binding.\n * @param siwe The signed SIWE message string (exactly what `session.siwe` stores).\n */\nexport function parseRecapCapabilities(\n  parseWasm: ParseRecapFromSiwe,\n  siwe: string\n): PermissionEntry[] {\n  const raw = parseWasm(siwe);\n  if (!Array.isArray(raw)) {\n    throw new Error(\n      \"parseRecapFromSiwe returned a non-array value; wasm binding may be out of sync\"\n    );\n  }\n  const normalized: PermissionEntry[] = raw.map((entry) => {\n    const longService =\n      SERVICE_SHORT_TO_LONG[entry.service] ??\n      // Unknown short names pass through. If the recap already contained a\n      // long-form service (e.g. a future tinycloud-node version emits long\n      // form directly), don't double-prefix.\n      (entry.service.startsWith(\"tinycloud.\")\n        ? entry.service\n        : `tinycloud.${entry.service}`);\n    return {\n      service: longService,\n      // The Rust layer emits the space as a full `tinycloud:pkh:...:name`\n      // URI (the recap target URI). Normalize to the short name so the\n      // returned entries match the shape manifests use.\n      space: normalizeSpace(entry.space),\n      path: entry.path,\n      actions: [...entry.actions],\n      ...(entry.caveats === undefined\n        ? {}\n        : { caveats: JSON.parse(JSON.stringify(entry.caveats)) as Record<string, unknown>[] }),\n    };\n  });\n\n  // Sort for determinism (callers do equality checks on arrays of entries\n  // in tests; deterministic ordering keeps those stable).\n  normalized.sort((a, b) => {\n    const aSpace = a.space ?? DEFAULT_MANIFEST_SPACE;\n    const bSpace = b.space ?? DEFAULT_MANIFEST_SPACE;\n    if (aSpace !== bSpace) return aSpace < bSpace ? -1 : 1;\n    if (a.service !== b.service) return a.service < b.service ? -1 : 1;\n    if (a.path !== b.path) return a.path < b.path ? -1 : 1;\n    return 0;\n  });\n\n  return normalized;\n}\n","import { baseX } from './base.js'\n\nexport const base10 = baseX({\n  prefix: '9',\n  name: 'base10',\n  alphabet: '0123456789'\n})\n","export const empty = new Uint8Array(0)\n\nexport function toHex (d: Uint8Array): string {\n  return d.reduce((hex, byte) => hex + byte.toString(16).padStart(2, '0'), '')\n}\n\nexport function fromHex (hex: string): Uint8Array {\n  const hexes = hex.match(/../g)\n  return hexes != null ? new Uint8Array(hexes.map(b => parseInt(b, 16))) : empty\n}\n\nexport function equals (aa: Uint8Array, bb: Uint8Array): boolean {\n  if (aa === bb) { return true }\n  if (aa.byteLength !== bb.byteLength) {\n    return false\n  }\n\n  for (let ii = 0; ii < aa.byteLength; ii++) {\n    if (aa[ii] !== bb[ii]) {\n      return false\n    }\n  }\n\n  return true\n}\n\nexport function coerce (o: ArrayBufferView | ArrayBuffer | Uint8Array): Uint8Array {\n  if (o instanceof Uint8Array && o.constructor.name === 'Uint8Array') { return o }\n  if (o instanceof ArrayBuffer) { return new Uint8Array(o) }\n  if (ArrayBuffer.isView(o)) {\n    return new Uint8Array(o.buffer, o.byteOffset, o.byteLength)\n  }\n  throw new Error('Unknown type, must be binary type')\n}\n\nexport function isBinary (o: unknown): o is ArrayBuffer | ArrayBufferView {\n  return o instanceof ArrayBuffer || ArrayBuffer.isView(o)\n}\n\nexport function fromString (str: string): Uint8Array {\n  return new TextEncoder().encode(str)\n}\n\nexport function toString (b: Uint8Array): string {\n  return new TextDecoder().decode(b)\n}\n","/* eslint-disable */\n// base-x encoding / decoding\n// Copyright (c) 2018 base-x contributors\n// Copyright (c) 2014-2018 The Bitcoin Core developers (base58.cpp)\n// Distributed under the MIT software license, see the accompanying\n// file LICENSE or http://www.opensource.org/licenses/mit-license.php.\n/**\n * @param {string} ALPHABET\n * @param {any} name\n */\nfunction base (ALPHABET, name) {\n  if (ALPHABET.length >= 255) { throw new TypeError('Alphabet too long') }\n  var BASE_MAP = new Uint8Array(256);\n  for (var j = 0; j < BASE_MAP.length; j++) {\n    BASE_MAP[j] = 255;\n  }\n  for (var i = 0; i < ALPHABET.length; i++) {\n    var x = ALPHABET.charAt(i);\n    var xc = x.charCodeAt(0);\n    if (BASE_MAP[xc] !== 255) { throw new TypeError(x + ' is ambiguous') }\n    BASE_MAP[xc] = i;\n  }\n  var BASE = ALPHABET.length;\n  var LEADER = ALPHABET.charAt(0);\n  var FACTOR = Math.log(BASE) / Math.log(256); // log(BASE) / log(256), rounded up\n  var iFACTOR = Math.log(256) / Math.log(BASE); // log(256) / log(BASE), rounded up\n  /**\n   * @param {any[] | Iterable<number>} source\n   */\n  function encode (source) {\n    // @ts-ignore\n    if (source instanceof Uint8Array) ; else if (ArrayBuffer.isView(source)) {\n      source = new Uint8Array(source.buffer, source.byteOffset, source.byteLength);\n    } else if (Array.isArray(source)) {\n      source = Uint8Array.from(source);\n    }\n    if (!(source instanceof Uint8Array)) { throw new TypeError('Expected Uint8Array') }\n    if (source.length === 0) { return '' }\n        // Skip & count leading zeroes.\n    var zeroes = 0;\n    var length = 0;\n    var pbegin = 0;\n    var pend = source.length;\n    while (pbegin !== pend && source[pbegin] === 0) {\n      pbegin++;\n      zeroes++;\n    }\n        // Allocate enough space in big-endian base58 representation.\n    var size = ((pend - pbegin) * iFACTOR + 1) >>> 0;\n    var b58 = new Uint8Array(size);\n        // Process the bytes.\n    while (pbegin !== pend) {\n      var carry = source[pbegin];\n            // Apply \"b58 = b58 * 256 + ch\".\n      var i = 0;\n      for (var it1 = size - 1; (carry !== 0 || i < length) && (it1 !== -1); it1--, i++) {\n        carry += (256 * b58[it1]) >>> 0;\n        b58[it1] = (carry % BASE) >>> 0;\n        carry = (carry / BASE) >>> 0;\n      }\n      if (carry !== 0) { throw new Error('Non-zero carry') }\n      length = i;\n      pbegin++;\n    }\n        // Skip leading zeroes in base58 result.\n    var it2 = size - length;\n    while (it2 !== size && b58[it2] === 0) {\n      it2++;\n    }\n        // Translate the result into a string.\n    var str = LEADER.repeat(zeroes);\n    for (; it2 < size; ++it2) { str += ALPHABET.charAt(b58[it2]); }\n    return str\n  }\n  /**\n   * @param {string | string[]} source\n   */\n  function decodeUnsafe (source) {\n    if (typeof source !== 'string') { throw new TypeError('Expected String') }\n    if (source.length === 0) { return new Uint8Array() }\n    var psz = 0;\n        // Skip leading spaces.\n    if (source[psz] === ' ') { return }\n        // Skip and count leading '1's.\n    var zeroes = 0;\n    var length = 0;\n    while (source[psz] === LEADER) {\n      zeroes++;\n      psz++;\n    }\n        // Allocate enough space in big-endian base256 representation.\n    var size = (((source.length - psz) * FACTOR) + 1) >>> 0; // log(58) / log(256), rounded up.\n    var b256 = new Uint8Array(size);\n        // Process the characters.\n    while (source[psz]) {\n            // Decode character\n      var carry = BASE_MAP[source.charCodeAt(psz)];\n            // Invalid character\n      if (carry === 255) { return }\n      var i = 0;\n      for (var it3 = size - 1; (carry !== 0 || i < length) && (it3 !== -1); it3--, i++) {\n        carry += (BASE * b256[it3]) >>> 0;\n        b256[it3] = (carry % 256) >>> 0;\n        carry = (carry / 256) >>> 0;\n      }\n      if (carry !== 0) { throw new Error('Non-zero carry') }\n      length = i;\n      psz++;\n    }\n        // Skip trailing spaces.\n    if (source[psz] === ' ') { return }\n        // Skip leading zeroes in b256.\n    var it4 = size - length;\n    while (it4 !== size && b256[it4] === 0) {\n      it4++;\n    }\n    var vch = new Uint8Array(zeroes + (size - it4));\n    var j = zeroes;\n    while (it4 !== size) {\n      vch[j++] = b256[it4++];\n    }\n    return vch\n  }\n  /**\n   * @param {string | string[]} string\n   */\n  function decode (string) {\n    var buffer = decodeUnsafe(string);\n    if (buffer) { return buffer }\n    throw new Error(`Non-${name} character`)\n  }\n  return {\n    encode: encode,\n    decodeUnsafe: decodeUnsafe,\n    decode: decode\n  }\n}\nvar src = base;\n\nvar _brrp__multiformats_scope_baseX = src;\n\nexport default _brrp__multiformats_scope_baseX;\n","import { coerce } from '../bytes.js'\nimport basex from '../vendor/base-x.js'\nimport type { BaseCodec, BaseDecoder, BaseEncoder, CombobaseDecoder, Multibase, MultibaseCodec, MultibaseDecoder, MultibaseEncoder, UnibaseDecoder } from './interface.js'\n\ninterface EncodeFn { (bytes: Uint8Array): string }\ninterface DecodeFn { (text: string): Uint8Array }\n\n/**\n * Class represents both BaseEncoder and MultibaseEncoder meaning it\n * can be used to encode to multibase or base encode without multibase\n * prefix.\n */\nclass Encoder<Base extends string, Prefix extends string> implements MultibaseEncoder<Prefix>, BaseEncoder {\n  readonly name: Base\n  readonly prefix: Prefix\n  readonly baseEncode: EncodeFn\n\n  constructor (name: Base, prefix: Prefix, baseEncode: EncodeFn) {\n    this.name = name\n    this.prefix = prefix\n    this.baseEncode = baseEncode\n  }\n\n  encode (bytes: Uint8Array): Multibase<Prefix> {\n    if (bytes instanceof Uint8Array) {\n      return `${this.prefix}${this.baseEncode(bytes)}`\n    } else {\n      throw Error('Unknown type, must be binary type')\n    }\n  }\n}\n\n/**\n * Class represents both BaseDecoder and MultibaseDecoder so it could be used\n * to decode multibases (with matching prefix) or just base decode strings\n * with corresponding base encoding.\n */\nclass Decoder<Base extends string, Prefix extends string> implements MultibaseDecoder<Prefix>, UnibaseDecoder<Prefix>, BaseDecoder {\n  readonly name: Base\n  readonly prefix: Prefix\n  readonly baseDecode: DecodeFn\n  private readonly prefixCodePoint: number\n\n  constructor (name: Base, prefix: Prefix, baseDecode: DecodeFn) {\n    this.name = name\n    this.prefix = prefix\n    const prefixCodePoint = prefix.codePointAt(0)\n    /* c8 ignore next 3 */\n    if (prefixCodePoint === undefined) {\n      throw new Error('Invalid prefix character')\n    }\n    this.prefixCodePoint = prefixCodePoint\n    this.baseDecode = baseDecode\n  }\n\n  decode (text: string): Uint8Array {\n    if (typeof text === 'string') {\n      if (text.codePointAt(0) !== this.prefixCodePoint) {\n        throw Error(`Unable to decode multibase string ${JSON.stringify(text)}, ${this.name} decoder only supports inputs prefixed with ${this.prefix}`)\n      }\n      return this.baseDecode(text.slice(this.prefix.length))\n    } else {\n      throw Error('Can only multibase decode strings')\n    }\n  }\n\n  or<OtherPrefix extends string> (decoder: UnibaseDecoder<OtherPrefix> | ComposedDecoder<OtherPrefix>): ComposedDecoder<Prefix | OtherPrefix> {\n    return or(this, decoder)\n  }\n}\n\ntype Decoders<Prefix extends string> = Record<Prefix, UnibaseDecoder<Prefix>>\n\nclass ComposedDecoder<Prefix extends string> implements MultibaseDecoder<Prefix>, CombobaseDecoder<Prefix> {\n  readonly decoders: Decoders<Prefix>\n\n  constructor (decoders: Decoders<Prefix>) {\n    this.decoders = decoders\n  }\n\n  or <OtherPrefix extends string> (decoder: UnibaseDecoder<OtherPrefix> | ComposedDecoder<OtherPrefix>): ComposedDecoder<Prefix | OtherPrefix> {\n    return or(this, decoder)\n  }\n\n  decode (input: string): Uint8Array {\n    const prefix = input[0] as Prefix\n    const decoder = this.decoders[prefix]\n    if (decoder != null) {\n      return decoder.decode(input)\n    } else {\n      throw RangeError(`Unable to decode multibase string ${JSON.stringify(input)}, only inputs prefixed with ${Object.keys(this.decoders)} are supported`)\n    }\n  }\n}\n\nexport function or <L extends string, R extends string> (left: UnibaseDecoder<L> | CombobaseDecoder<L>, right: UnibaseDecoder<R> | CombobaseDecoder<R>): ComposedDecoder<L | R> {\n  return new ComposedDecoder({\n    ...(left.decoders ?? { [(left as UnibaseDecoder<L>).prefix]: left }),\n    ...(right.decoders ?? { [(right as UnibaseDecoder<R>).prefix]: right })\n  } as Decoders<L | R>)\n}\n\nexport class Codec<Base extends string, Prefix extends string> implements MultibaseCodec<Prefix>, MultibaseEncoder<Prefix>, MultibaseDecoder<Prefix>, BaseCodec, BaseEncoder, BaseDecoder {\n  readonly name: Base\n  readonly prefix: Prefix\n  readonly baseEncode: EncodeFn\n  readonly baseDecode: DecodeFn\n  readonly encoder: Encoder<Base, Prefix>\n  readonly decoder: Decoder<Base, Prefix>\n\n  constructor (name: Base, prefix: Prefix, baseEncode: EncodeFn, baseDecode: DecodeFn) {\n    this.name = name\n    this.prefix = prefix\n    this.baseEncode = baseEncode\n    this.baseDecode = baseDecode\n    this.encoder = new Encoder(name, prefix, baseEncode)\n    this.decoder = new Decoder(name, prefix, baseDecode)\n  }\n\n  encode (input: Uint8Array): string {\n    return this.encoder.encode(input)\n  }\n\n  decode (input: string): Uint8Array {\n    return this.decoder.decode(input)\n  }\n}\n\nexport function from <Base extends string, Prefix extends string> ({ name, prefix, encode, decode }: { name: Base, prefix: Prefix, encode: EncodeFn, decode: DecodeFn }): Codec<Base, Prefix> {\n  return new Codec(name, prefix, encode, decode)\n}\n\nexport function baseX <Base extends string, Prefix extends string> ({ name, prefix, alphabet }: { name: Base, prefix: Prefix, alphabet: string }): Codec<Base, Prefix> {\n  const { encode, decode } = basex(alphabet, name)\n  return from({\n    prefix,\n    name,\n    encode,\n    decode: (text: string): Uint8Array => coerce(decode(text))\n  })\n}\n\nfunction decode (string: string, alphabetIdx: Record<string, number>, bitsPerChar: number, name: string): Uint8Array {\n  // Count the padding bytes:\n  let end = string.length\n  while (string[end - 1] === '=') {\n    --end\n  }\n\n  // Allocate the output:\n  const out = new Uint8Array((end * bitsPerChar / 8) | 0)\n\n  // Parse the data:\n  let bits = 0 // Number of bits currently in the buffer\n  let buffer = 0 // Bits waiting to be written out, MSB first\n  let written = 0 // Next byte to write\n  for (let i = 0; i < end; ++i) {\n    // Read one character from the string:\n    const value = alphabetIdx[string[i]]\n    if (value === undefined) {\n      throw new SyntaxError(`Non-${name} character`)\n    }\n\n    // Append the bits to the buffer:\n    buffer = (buffer << bitsPerChar) | value\n    bits += bitsPerChar\n\n    // Write out some bits if the buffer has a byte's worth:\n    if (bits >= 8) {\n      bits -= 8\n      out[written++] = 0xff & (buffer >> bits)\n    }\n  }\n\n  // Verify that we have received just enough bits:\n  if (bits >= bitsPerChar || (0xff & (buffer << (8 - bits))) !== 0) {\n    throw new SyntaxError('Unexpected end of data')\n  }\n\n  return out\n}\n\nfunction encode (data: Uint8Array, alphabet: string, bitsPerChar: number): string {\n  const pad = alphabet[alphabet.length - 1] === '='\n  const mask = (1 << bitsPerChar) - 1\n  let out = ''\n\n  let bits = 0 // Number of bits currently in the buffer\n  let buffer = 0 // Bits waiting to be written out, MSB first\n  for (let i = 0; i < data.length; ++i) {\n    // Slurp data into the buffer:\n    buffer = (buffer << 8) | data[i]\n    bits += 8\n\n    // Write out as much as we can:\n    while (bits > bitsPerChar) {\n      bits -= bitsPerChar\n      out += alphabet[mask & (buffer >> bits)]\n    }\n  }\n\n  // Partial character:\n  if (bits !== 0) {\n    out += alphabet[mask & (buffer << (bitsPerChar - bits))]\n  }\n\n  // Add padding characters until we hit a byte boundary:\n  if (pad) {\n    while (((out.length * bitsPerChar) & 7) !== 0) {\n      out += '='\n    }\n  }\n\n  return out\n}\n\nfunction createAlphabetIdx (alphabet: string): Record<string, number> {\n  // Build the character lookup table:\n  const alphabetIdx: Record<string, number> = {}\n  for (let i = 0; i < alphabet.length; ++i) {\n    alphabetIdx[alphabet[i]] = i\n  }\n  return alphabetIdx\n}\n\n/**\n * RFC4648 Factory\n */\nexport function rfc4648 <Base extends string, Prefix extends string> ({ name, prefix, bitsPerChar, alphabet }: { name: Base, prefix: Prefix, bitsPerChar: number, alphabet: string }): Codec<Base, Prefix> {\n  const alphabetIdx = createAlphabetIdx(alphabet)\n  return from({\n    prefix,\n    name,\n    encode (input: Uint8Array): string {\n      return encode(input, alphabet, bitsPerChar)\n    },\n    decode (input: string): Uint8Array {\n      return decode(input, alphabetIdx, bitsPerChar, name)\n    }\n  })\n}\n","import { rfc4648 } from './base.js'\n\nexport const base16 = rfc4648({\n  prefix: 'f',\n  name: 'base16',\n  alphabet: '0123456789abcdef',\n  bitsPerChar: 4\n})\n\nexport const base16upper = rfc4648({\n  prefix: 'F',\n  name: 'base16upper',\n  alphabet: '0123456789ABCDEF',\n  bitsPerChar: 4\n})\n","import { rfc4648 } from './base.js'\n\nexport const base2 = rfc4648({\n  prefix: '0',\n  name: 'base2',\n  alphabet: '01',\n  bitsPerChar: 1\n})\n","import { from } from './base.js'\n\nconst alphabet = Array.from('🚀🪐☄🛰🌌🌑🌒🌓🌔🌕🌖🌗🌘🌍🌏🌎🐉☀💻🖥💾💿😂❤😍🤣😊🙏💕😭😘👍😅👏😁🔥🥰💔💖💙😢🤔😆🙄💪😉☺👌🤗💜😔😎😇🌹🤦🎉💞✌✨🤷😱😌🌸🙌😋💗💚😏💛🙂💓🤩😄😀🖤😃💯🙈👇🎶😒🤭❣😜💋👀😪😑💥🙋😞😩😡🤪👊🥳😥🤤👉💃😳✋😚😝😴🌟😬🙃🍀🌷😻😓⭐✅🥺🌈😈🤘💦✔😣🏃💐☹🎊💘😠☝😕🌺🎂🌻😐🖕💝🙊😹🗣💫💀👑🎵🤞😛🔴😤🌼😫⚽🤙☕🏆🤫👈😮🙆🍻🍃🐶💁😲🌿🧡🎁⚡🌞🎈❌✊👋😰🤨😶🤝🚶💰🍓💢🤟🙁🚨💨🤬✈🎀🍺🤓😙💟🌱😖👶🥴▶➡❓💎💸⬇😨🌚🦋😷🕺⚠🙅😟😵👎🤲🤠🤧📌🔵💅🧐🐾🍒😗🤑🌊🤯🐷☎💧😯💆👆🎤🙇🍑❄🌴💣🐸💌📍🥀🤢👅💡💩👐📸👻🤐🤮🎼🥵🚩🍎🍊👼💍📣🥂')\nconst alphabetBytesToChars: string[] = (alphabet.reduce<string[]>((p, c, i) => { p[i] = c; return p }, ([])))\nconst alphabetCharsToBytes: number[] = (alphabet.reduce<number[]>((p, c, i) => {\n  const codePoint = c.codePointAt(0)\n  if (codePoint == null) {\n    throw new Error(`Invalid character: ${c}`)\n  }\n  p[codePoint] = i\n  return p\n}, ([])))\n\nfunction encode (data: Uint8Array): string {\n  return data.reduce((p, c) => {\n    p += alphabetBytesToChars[c]\n    return p\n  }, '')\n}\n\nfunction decode (str: string): Uint8Array {\n  const byts = []\n  for (const char of str) {\n    const codePoint = char.codePointAt(0)\n    if (codePoint == null) {\n      throw new Error(`Invalid character: ${char}`)\n    }\n    const byt = alphabetCharsToBytes[codePoint]\n    if (byt == null) {\n      throw new Error(`Non-base256emoji character: ${char}`)\n    }\n    byts.push(byt)\n  }\n  return new Uint8Array(byts)\n}\n\nexport const base256emoji = from({\n  prefix: '🚀',\n  name: 'base256emoji',\n  encode,\n  decode\n})\n","import { rfc4648 } from './base.js'\n\nexport const base32 = rfc4648({\n  prefix: 'b',\n  name: 'base32',\n  alphabet: 'abcdefghijklmnopqrstuvwxyz234567',\n  bitsPerChar: 5\n})\n\nexport const base32upper = rfc4648({\n  prefix: 'B',\n  name: 'base32upper',\n  alphabet: 'ABCDEFGHIJKLMNOPQRSTUVWXYZ234567',\n  bitsPerChar: 5\n})\n\nexport const base32pad = rfc4648({\n  prefix: 'c',\n  name: 'base32pad',\n  alphabet: 'abcdefghijklmnopqrstuvwxyz234567=',\n  bitsPerChar: 5\n})\n\nexport const base32padupper = rfc4648({\n  prefix: 'C',\n  name: 'base32padupper',\n  alphabet: 'ABCDEFGHIJKLMNOPQRSTUVWXYZ234567=',\n  bitsPerChar: 5\n})\n\nexport const base32hex = rfc4648({\n  prefix: 'v',\n  name: 'base32hex',\n  alphabet: '0123456789abcdefghijklmnopqrstuv',\n  bitsPerChar: 5\n})\n\nexport const base32hexupper = rfc4648({\n  prefix: 'V',\n  name: 'base32hexupper',\n  alphabet: '0123456789ABCDEFGHIJKLMNOPQRSTUV',\n  bitsPerChar: 5\n})\n\nexport const base32hexpad = rfc4648({\n  prefix: 't',\n  name: 'base32hexpad',\n  alphabet: '0123456789abcdefghijklmnopqrstuv=',\n  bitsPerChar: 5\n})\n\nexport const base32hexpadupper = rfc4648({\n  prefix: 'T',\n  name: 'base32hexpadupper',\n  alphabet: '0123456789ABCDEFGHIJKLMNOPQRSTUV=',\n  bitsPerChar: 5\n})\n\nexport const base32z = rfc4648({\n  prefix: 'h',\n  name: 'base32z',\n  alphabet: 'ybndrfg8ejkmcpqxot1uwisza345h769',\n  bitsPerChar: 5\n})\n","import { baseX } from './base.js'\n\nexport const base36 = baseX({\n  prefix: 'k',\n  name: 'base36',\n  alphabet: '0123456789abcdefghijklmnopqrstuvwxyz'\n})\n\nexport const base36upper = baseX({\n  prefix: 'K',\n  name: 'base36upper',\n  alphabet: '0123456789ABCDEFGHIJKLMNOPQRSTUVWXYZ'\n})\n","import { baseX } from './base.js'\n\nexport const base58btc = baseX({\n  name: 'base58btc',\n  prefix: 'z',\n  alphabet: '123456789ABCDEFGHJKLMNPQRSTUVWXYZabcdefghijkmnopqrstuvwxyz'\n})\n\nexport const base58flickr = baseX({\n  name: 'base58flickr',\n  prefix: 'Z',\n  alphabet: '123456789abcdefghijkmnopqrstuvwxyzABCDEFGHJKLMNPQRSTUVWXYZ'\n})\n","import { rfc4648 } from './base.js'\n\nexport const base64 = rfc4648({\n  prefix: 'm',\n  name: 'base64',\n  alphabet: 'ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+/',\n  bitsPerChar: 6\n})\n\nexport const base64pad = rfc4648({\n  prefix: 'M',\n  name: 'base64pad',\n  alphabet: 'ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+/=',\n  bitsPerChar: 6\n})\n\nexport const base64url = rfc4648({\n  prefix: 'u',\n  name: 'base64url',\n  alphabet: 'ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789-_',\n  bitsPerChar: 6\n})\n\nexport const base64urlpad = rfc4648({\n  prefix: 'U',\n  name: 'base64urlpad',\n  alphabet: 'ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789-_=',\n  bitsPerChar: 6\n})\n","import { rfc4648 } from './base.js'\n\nexport const base8 = rfc4648({\n  prefix: '7',\n  name: 'base8',\n  alphabet: '01234567',\n  bitsPerChar: 3\n})\n","import { fromString, toString } from '../bytes.js'\nimport { from } from './base.js'\n\nexport const identity = from({\n  prefix: '\\x00',\n  name: 'identity',\n  encode: (buf) => toString(buf),\n  decode: (str) => fromString(str)\n})\n","import type { ArrayBufferView, ByteView } from './interface.js'\n\nconst textEncoder = new TextEncoder()\nconst textDecoder = new TextDecoder()\n\nexport const name = 'json'\nexport const code = 0x0200\n\nexport function encode <T> (node: T): ByteView<T> {\n  return textEncoder.encode(JSON.stringify(node))\n}\n\nexport function decode <T> (data: ByteView<T> | ArrayBufferView<T>): T {\n  return JSON.parse(textDecoder.decode(data))\n}\n","import { coerce } from '../bytes.js'\nimport type { ArrayBufferView, ByteView } from './interface.js'\n\nexport const name = 'raw'\nexport const code = 0x55\n\nexport function encode (node: Uint8Array): ByteView<Uint8Array> {\n  return coerce(node)\n}\n\nexport function decode (data: ByteView<Uint8Array> | ArrayBufferView<Uint8Array>): Uint8Array {\n  return coerce(data)\n}\n","import { coerce } from '../bytes.js'\nimport * as Digest from './digest.js'\nimport type { DigestOptions } from './hasher.js'\n\nconst code: 0x0 = 0x0\nconst name = 'identity'\n\nconst encode: (input: Uint8Array) => Uint8Array = coerce\n\nfunction digest (input: Uint8Array, options?: DigestOptions): Digest.Digest<typeof code, number> {\n  if (options?.truncate != null && options.truncate !== input.byteLength) {\n    if (options.truncate < 0 || options.truncate > input.byteLength) {\n      throw new Error(`Invalid truncate option, must be less than or equal to ${input.byteLength}`)\n    }\n\n    input = input.subarray(0, options.truncate)\n  }\n\n  return Digest.create(code, encode(input))\n}\n\nexport const identity = { code, name, encode, digest }\n","/* eslint-disable */\nvar encode_1 = encode;\n\nvar MSB = 0x80\n  , REST = 0x7F\n  , MSBALL = ~REST\n  , INT = Math.pow(2, 31);\n\n/**\n * @param {number} num\n * @param {number[]} out\n * @param {number} offset\n */\nfunction encode(num, out, offset) {\n  out = out || [];\n  offset = offset || 0;\n  var oldOffset = offset;\n\n  while(num >= INT) {\n    out[offset++] = (num & 0xFF) | MSB;\n    num /= 128;\n  }\n  while(num & MSBALL) {\n    out[offset++] = (num & 0xFF) | MSB;\n    num >>>= 7;\n  }\n  out[offset] = num | 0;\n  \n  // @ts-ignore\n  encode.bytes = offset - oldOffset + 1;\n  \n  return out\n}\n\nvar decode = read;\n\nvar MSB$1 = 0x80\n  , REST$1 = 0x7F;\n\n/**\n * @param {string | any[]} buf\n * @param {number} offset\n */\nfunction read(buf, offset) {\n  var res    = 0\n    , offset = offset || 0\n    , shift  = 0\n    , counter = offset\n    , b\n    , l = buf.length;\n\n  do {\n    if (counter >= l) {\n      // @ts-ignore\n      read.bytes = 0;\n      throw new RangeError('Could not decode varint')\n    }\n    b = buf[counter++];\n    res += shift < 28\n      ? (b & REST$1) << shift\n      : (b & REST$1) * Math.pow(2, shift);\n    shift += 7;\n  } while (b >= MSB$1)\n\n  // @ts-ignore\n  read.bytes = counter - offset;\n\n  return res\n}\n\nvar N1 = Math.pow(2,  7);\nvar N2 = Math.pow(2, 14);\nvar N3 = Math.pow(2, 21);\nvar N4 = Math.pow(2, 28);\nvar N5 = Math.pow(2, 35);\nvar N6 = Math.pow(2, 42);\nvar N7 = Math.pow(2, 49);\nvar N8 = Math.pow(2, 56);\nvar N9 = Math.pow(2, 63);\n\nvar length = function (/** @type {number} */ value) {\n  return (\n    value < N1 ? 1\n  : value < N2 ? 2\n  : value < N3 ? 3\n  : value < N4 ? 4\n  : value < N5 ? 5\n  : value < N6 ? 6\n  : value < N7 ? 7\n  : value < N8 ? 8\n  : value < N9 ? 9\n  :              10\n  )\n};\n\nvar varint = {\n    encode: encode_1\n  , decode: decode\n  , encodingLength: length\n};\n\nvar _brrp_varint = varint;\n\nexport default _brrp_varint;\n","import varint from './vendor/varint.js'\n\nexport function decode (data: Uint8Array, offset = 0): [number, number] {\n  const code = varint.decode(data, offset)\n  return [code, varint.decode.bytes]\n}\n\nexport function encodeTo (int: number, target: Uint8Array, offset = 0): Uint8Array {\n  varint.encode(int, target, offset)\n  return target\n}\n\nexport function encodingLength (int: number): number {\n  return varint.encodingLength(int)\n}\n","import { coerce, equals as equalBytes } from '../bytes.js'\nimport * as varint from '../varint.js'\nimport type { MultihashDigest } from './interface.js'\n\n/**\n * Creates a multihash digest.\n */\nexport function create <Code extends number> (code: Code, digest: Uint8Array): Digest<Code, number> {\n  const size = digest.byteLength\n  const sizeOffset = varint.encodingLength(code)\n  const digestOffset = sizeOffset + varint.encodingLength(size)\n\n  const bytes = new Uint8Array(digestOffset + size)\n  varint.encodeTo(code, bytes, 0)\n  varint.encodeTo(size, bytes, sizeOffset)\n  bytes.set(digest, digestOffset)\n\n  return new Digest(code, size, digest, bytes)\n}\n\n/**\n * Turns bytes representation of multihash digest into an instance.\n */\nexport function decode (multihash: Uint8Array): MultihashDigest {\n  const bytes = coerce(multihash)\n  const [code, sizeOffset] = varint.decode(bytes)\n  const [size, digestOffset] = varint.decode(bytes.subarray(sizeOffset))\n  const digest = bytes.subarray(sizeOffset + digestOffset)\n\n  if (digest.byteLength !== size) {\n    throw new Error('Incorrect length')\n  }\n\n  return new Digest(code, size, digest, bytes)\n}\n\nexport function equals (a: MultihashDigest, b: unknown): b is MultihashDigest {\n  if (a === b) {\n    return true\n  } else {\n    const data = b as { code?: unknown, size?: unknown, bytes?: unknown }\n\n    return (\n      a.code === data.code &&\n      a.size === data.size &&\n      data.bytes instanceof Uint8Array &&\n      equalBytes(a.bytes, data.bytes)\n    )\n  }\n}\n\n/**\n * Represents a multihash digest which carries information about the\n * hashing algorithm and an actual hash digest.\n */\nexport class Digest<Code extends number, Size extends number> implements MultihashDigest {\n  readonly code: Code\n  readonly size: Size\n  readonly digest: Uint8Array\n  readonly bytes: Uint8Array\n\n  /**\n   * Creates a multihash digest.\n   */\n  constructor (code: Code, size: Size, digest: Uint8Array, bytes: Uint8Array) {\n    this.code = code\n    this.size = size\n    this.digest = digest\n    this.bytes = bytes\n  }\n}\n\n/**\n * Used to check that the passed multihash has the passed code\n */\nexport function hasCode <T extends number> (digest: MultihashDigest, code: T): digest is MultihashDigest<T> {\n  return digest.code === code\n}\n","/* global crypto */\n\nimport { from } from './hasher.js'\n\nfunction sha (name: AlgorithmIdentifier): (data: Uint8Array) => Promise<Uint8Array> {\n  return async data => new Uint8Array(await crypto.subtle.digest(name, data))\n}\n\nexport const sha256 = from({\n  name: 'sha2-256',\n  code: 0x12,\n  encode: sha('SHA-256')\n})\n\nexport const sha512 = from({\n  name: 'sha2-512',\n  code: 0x13,\n  encode: sha('SHA-512')\n})\n","import * as Digest from './digest.js'\nimport type { MultihashHasher } from './interface.js'\n\ntype Await<T> = Promise<T> | T\n\nconst DEFAULT_MIN_DIGEST_LENGTH = 20\n\nexport interface HasherInit <Name extends string, Code extends number> {\n  name: Name\n  code: Code\n  encode(input: Uint8Array): Await<Uint8Array>\n\n  /**\n   * The minimum length a hash is allowed to be truncated to in bytes\n   *\n   * @default 20\n   */\n  minDigestLength?: number\n\n  /**\n   * The maximum length a hash is allowed to be truncated to in bytes. If not\n   * specified it will be inferred from the length of the digest.\n   */\n  maxDigestLength?: number\n}\n\nexport function from <Name extends string, Code extends number> ({ name, code, encode, minDigestLength, maxDigestLength }: HasherInit<Name, Code>): Hasher<Name, Code> {\n  return new Hasher(name, code, encode, minDigestLength, maxDigestLength)\n}\n\nexport interface DigestOptions {\n  /**\n   * Truncate the returned digest to this number of bytes.\n   *\n   * This may cause the digest method to throw/reject if the passed value is\n   * greater than the digest length or below a threshold under which the risk of\n   * hash collisions is significant.\n   *\n   * The actual value of this threshold can depend on the hashing algorithm in\n   * use.\n   */\n  truncate?: number\n}\n\n/**\n * Hasher represents a hashing algorithm implementation that produces as\n * `MultihashDigest`.\n */\nexport class Hasher<Name extends string, Code extends number> implements MultihashHasher<Code> {\n  readonly name: Name\n  readonly code: Code\n  readonly encode: (input: Uint8Array) => Await<Uint8Array>\n  readonly minDigestLength: number\n  readonly maxDigestLength?: number\n\n  constructor (name: Name, code: Code, encode: (input: Uint8Array) => Await<Uint8Array>, minDigestLength?: number, maxDigestLength?: number) {\n    this.name = name\n    this.code = code\n    this.encode = encode\n    this.minDigestLength = minDigestLength ?? DEFAULT_MIN_DIGEST_LENGTH\n    this.maxDigestLength = maxDigestLength\n  }\n\n  digest (input: Uint8Array, options?: DigestOptions): Await<Digest.Digest<Code, number>> {\n    if (options?.truncate != null) {\n      if (options.truncate < this.minDigestLength) {\n        throw new Error(`Invalid truncate option, must be greater than or equal to ${this.minDigestLength}`)\n      }\n\n      if (this.maxDigestLength != null && options.truncate > this.maxDigestLength) {\n        throw new Error(`Invalid truncate option, must be less than or equal to ${this.maxDigestLength}`)\n      }\n    }\n\n    if (input instanceof Uint8Array) {\n      const result = this.encode(input)\n\n      if (result instanceof Uint8Array) {\n        return createDigest(result, this.code, options?.truncate)\n      }\n\n      return result.then(digest => createDigest(digest, this.code, options?.truncate))\n    } else {\n      throw Error('Unknown type, must be binary type')\n      /* c8 ignore next 1 */\n    }\n  }\n}\n\n/**\n * Create a Digest from the passed uint8array and code, optionally truncating it\n * first.\n */\nfunction createDigest <Code extends number> (digest: Uint8Array, code: Code, truncate?: number): Digest.Digest<Code, number> {\n  if (truncate != null && truncate !== digest.byteLength) {\n    if (truncate > digest.byteLength) {\n      throw new Error(`Invalid truncate option, must be less than or equal to ${digest.byteLength}`)\n    }\n\n    digest = digest.subarray(0, truncate)\n  }\n\n  return Digest.create(code, digest)\n}\n","import { base32 } from './bases/base32.js'\nimport { base36 } from './bases/base36.js'\nimport { base58btc } from './bases/base58.js'\nimport { coerce } from './bytes.js'\nimport * as Digest from './hashes/digest.js'\nimport * as varint from './varint.js'\nimport type * as API from './link/interface.js'\n\n// This way TS will also expose all the types from module\nexport * from './link/interface.js'\n\nexport function format <T extends API.Link<unknown, number, number, API.Version>, Prefix extends string> (link: T, base?: API.MultibaseEncoder<Prefix>): API.ToString<T, Prefix> {\n  const { bytes, version } = link\n  switch (version) {\n    case 0:\n      return toStringV0(\n        bytes,\n        baseCache(link),\n        base as API.MultibaseEncoder<'z'> ?? base58btc.encoder\n      )\n    default:\n      return toStringV1(\n        bytes,\n        baseCache(link),\n        (base ?? base32.encoder) as API.MultibaseEncoder<Prefix>\n      )\n  }\n}\n\nexport function toJSON <Link extends API.UnknownLink> (link: Link): API.LinkJSON<Link> {\n  return {\n    '/': format(link)\n  }\n}\n\nexport function fromJSON <Link extends API.UnknownLink> (json: API.LinkJSON<Link>): CID<unknown, number, number, API.Version> {\n  return CID.parse(json['/'])\n}\n\nconst cache = new WeakMap<API.UnknownLink, Map<string, string>>()\n\nfunction baseCache (cid: API.UnknownLink): Map<string, string> {\n  const baseCache = cache.get(cid)\n  if (baseCache == null) {\n    const baseCache = new Map()\n    cache.set(cid, baseCache)\n    return baseCache\n  }\n  return baseCache\n}\n\nexport class CID<Data = unknown, Format extends number = number, Alg extends number = number, Version extends API.Version = API.Version> implements API.Link<Data, Format, Alg, Version> {\n  readonly code: Format\n  readonly version: Version\n  readonly multihash: API.MultihashDigest<Alg>\n  readonly bytes: Uint8Array\n  readonly '/': Uint8Array\n\n  /**\n   * @param version - Version of the CID\n   * @param code - Code of the codec content is encoded in, see https://github.com/multiformats/multicodec/blob/master/table.csv\n   * @param multihash - (Multi)hash of the of the content.\n   */\n  constructor (version: Version, code: Format, multihash: API.MultihashDigest<Alg>, bytes: Uint8Array) {\n    this.code = code\n    this.version = version\n    this.multihash = multihash\n    this.bytes = bytes\n\n    // flag to serializers that this is a CID and\n    // should be treated specially\n    this['/'] = bytes\n  }\n\n  /**\n   * Signalling `cid.asCID === cid` has been replaced with `cid['/'] === cid.bytes`\n   * please either use `CID.asCID(cid)` or switch to new signalling mechanism\n   *\n   * @deprecated\n   */\n  get asCID (): this {\n    return this\n  }\n\n  // ArrayBufferView\n  get byteOffset (): number {\n    return this.bytes.byteOffset\n  }\n\n  // ArrayBufferView\n  get byteLength (): number {\n    return this.bytes.byteLength\n  }\n\n  toV0 (): CID<Data, API.DAG_PB, API.SHA_256, 0> {\n    switch (this.version) {\n      case 0: {\n        return this as CID<Data, API.DAG_PB, API.SHA_256, 0>\n      }\n      case 1: {\n        const { code, multihash } = this\n\n        if (code !== DAG_PB_CODE) {\n          throw new Error('Cannot convert a non dag-pb CID to CIDv0')\n        }\n\n        // sha2-256\n        if (multihash.code !== SHA_256_CODE) {\n          throw new Error('Cannot convert non sha2-256 multihash CID to CIDv0')\n        }\n\n        return (\n          CID.createV0(\n            multihash as API.MultihashDigest<API.SHA_256>\n          )\n        )\n      }\n      default: {\n        throw Error(\n          `Can not convert CID version ${this.version} to version 0. This is a bug please report`\n        )\n      }\n    }\n  }\n\n  toV1 (): CID<Data, Format, Alg, 1> {\n    switch (this.version) {\n      case 0: {\n        const { code, digest } = this.multihash\n        const multihash = Digest.create(code, digest)\n        return (\n          CID.createV1(this.code, multihash)\n        )\n      }\n      case 1: {\n        return this as CID<Data, Format, Alg, 1>\n      }\n      default: {\n        throw Error(\n          `Can not convert CID version ${this.version} to version 1. This is a bug please report`\n        )\n      }\n    }\n  }\n\n  equals (other: unknown): other is CID<Data, Format, Alg, Version> {\n    return CID.equals(this, other)\n  }\n\n  static equals <Data, Format extends number, Alg extends number, Version extends API.Version>(self: API.Link<Data, Format, Alg, Version>, other: unknown): other is CID {\n    const unknown = other as { code?: unknown, version?: unknown, multihash?: unknown }\n    return (\n      unknown != null &&\n      self.code === unknown.code &&\n      self.version === unknown.version &&\n      Digest.equals(self.multihash, unknown.multihash)\n    )\n  }\n\n  toString (base?: API.MultibaseEncoder<string>): string {\n    return format(this, base)\n  }\n\n  toJSON (): API.LinkJSON<this> {\n    return { '/': format(this) }\n  }\n\n  link (): this {\n    return this\n  }\n\n  readonly [Symbol.toStringTag] = 'CID';\n\n  // Legacy\n\n  [Symbol.for('nodejs.util.inspect.custom')] (): string {\n    return `CID(${this.toString()})`\n  }\n\n  /**\n   * Takes any input `value` and returns a `CID` instance if it was\n   * a `CID` otherwise returns `null`. If `value` is instanceof `CID`\n   * it will return value back. If `value` is not instance of this CID\n   * class, but is compatible CID it will return new instance of this\n   * `CID` class. Otherwise returns null.\n   *\n   * This allows two different incompatible versions of CID library to\n   * co-exist and interop as long as binary interface is compatible.\n   */\n  static asCID <Data, Format extends number, Alg extends number, Version extends API.Version, U>(input: API.Link<Data, Format, Alg, Version> | U): CID<Data, Format, Alg, Version> | null {\n    if (input == null) {\n      return null\n    }\n\n    const value = input as any\n    if (value instanceof CID) {\n      // If value is instance of CID then we're all set.\n      return value\n    } else if ((value['/'] != null && value['/'] === value.bytes) || value.asCID === value) {\n      // If value isn't instance of this CID class but `this.asCID === this` or\n      // `value['/'] === value.bytes` is true it is CID instance coming from a\n      // different implementation (diff version or duplicate). In that case we\n      // rebase it to this `CID` implementation so caller is guaranteed to get\n      // instance with expected API.\n      const { version, code, multihash, bytes } = value\n      return new CID(\n        version,\n        code,\n        multihash as API.MultihashDigest<Alg>,\n        bytes ?? encodeCID(version, code, multihash.bytes)\n      )\n    } else if (value[cidSymbol] === true) {\n      // If value is a CID from older implementation that used to be tagged via\n      // symbol we still rebase it to the this `CID` implementation by\n      // delegating that to a constructor.\n      const { version, multihash, code } = value\n      const digest = Digest.decode(multihash) as API.MultihashDigest<Alg>\n      return CID.create(version, code, digest)\n    } else {\n      // Otherwise value is not a CID (or an incompatible version of it) in\n      // which case we return `null`.\n      return null\n    }\n  }\n\n  /**\n   * @param version - Version of the CID\n   * @param code - Code of the codec content is encoded in, see https://github.com/multiformats/multicodec/blob/master/table.csv\n   * @param digest - (Multi)hash of the of the content.\n   */\n  static create <Data, Format extends number, Alg extends number, Version extends API.Version>(version: Version, code: Format, digest: API.MultihashDigest<Alg>): CID<Data, Format, Alg, Version> {\n    if (typeof code !== 'number') {\n      throw new Error('String codecs are no longer supported')\n    }\n\n    if (!(digest.bytes instanceof Uint8Array)) {\n      throw new Error('Invalid digest')\n    }\n\n    switch (version) {\n      case 0: {\n        if (code !== DAG_PB_CODE) {\n          throw new Error(\n            `Version 0 CID must use dag-pb (code: ${DAG_PB_CODE}) block encoding`\n          )\n        } else {\n          return new CID(version, code, digest, digest.bytes)\n        }\n      }\n      case 1: {\n        const bytes = encodeCID(version, code, digest.bytes)\n        return new CID(version, code, digest, bytes)\n      }\n      default: {\n        throw new Error('Invalid version')\n      }\n    }\n  }\n\n  /**\n   * Simplified version of `create` for CIDv0.\n   */\n  static createV0 <T = unknown>(digest: API.MultihashDigest<typeof SHA_256_CODE>): CID<T, typeof DAG_PB_CODE, typeof SHA_256_CODE, 0> {\n    return CID.create(0, DAG_PB_CODE, digest)\n  }\n\n  /**\n   * Simplified version of `create` for CIDv1.\n   *\n   * @param code - Content encoding format code.\n   * @param digest - Multihash of the content.\n   */\n  static createV1 <Data, Code extends number, Alg extends number>(code: Code, digest: API.MultihashDigest<Alg>): CID<Data, Code, Alg, 1> {\n    return CID.create(1, code, digest)\n  }\n\n  /**\n   * Decoded a CID from its binary representation. The byte array must contain\n   * only the CID with no additional bytes.\n   *\n   * An error will be thrown if the bytes provided do not contain a valid\n   * binary representation of a CID.\n   */\n  static decode <Data, Code extends number, Alg extends number, Version extends API.Version>(bytes: API.ByteView<API.Link<Data, Code, Alg, Version>>): CID<Data, Code, Alg, Version> {\n    const [cid, remainder] = CID.decodeFirst(bytes)\n    if (remainder.length !== 0) {\n      throw new Error('Incorrect length')\n    }\n    return cid\n  }\n\n  /**\n   * Decoded a CID from its binary representation at the beginning of a byte\n   * array.\n   *\n   * Returns an array with the first element containing the CID and the second\n   * element containing the remainder of the original byte array. The remainder\n   * will be a zero-length byte array if the provided bytes only contained a\n   * binary CID representation.\n   */\n  static decodeFirst <T, C extends number, A extends number, V extends API.Version>(bytes: API.ByteView<API.Link<T, C, A, V>>): [CID<T, C, A, V>, Uint8Array] {\n    const specs = CID.inspectBytes(bytes)\n    const prefixSize = specs.size - specs.multihashSize\n    const multihashBytes = coerce(\n      bytes.subarray(prefixSize, prefixSize + specs.multihashSize)\n    )\n    if (multihashBytes.byteLength !== specs.multihashSize) {\n      throw new Error('Incorrect length')\n    }\n    const digestBytes = multihashBytes.subarray(\n      specs.multihashSize - specs.digestSize\n    )\n    const digest = new Digest.Digest(\n      specs.multihashCode,\n      specs.digestSize,\n      digestBytes,\n      multihashBytes\n    )\n    const cid =\n      specs.version === 0\n        ? CID.createV0(digest as API.MultihashDigest<API.SHA_256>)\n        : CID.createV1(specs.codec, digest)\n    return [cid as CID<T, C, A, V>, bytes.subarray(specs.size)]\n  }\n\n  /**\n   * Inspect the initial bytes of a CID to determine its properties.\n   *\n   * Involves decoding up to 4 varints. Typically this will require only 4 to 6\n   * bytes but for larger multicodec code values and larger multihash digest\n   * lengths these varints can be quite large. It is recommended that at least\n   * 10 bytes be made available in the `initialBytes` argument for a complete\n   * inspection.\n   */\n  static inspectBytes <T, C extends number, A extends number, V extends API.Version>(initialBytes: API.ByteView<API.Link<T, C, A, V>>): { version: V, codec: C, multihashCode: A, digestSize: number, multihashSize: number, size: number } {\n    let offset = 0\n    const next = (): number => {\n      const [i, length] = varint.decode(initialBytes.subarray(offset))\n      offset += length\n      return i\n    }\n\n    let version = next() as V\n    let codec = DAG_PB_CODE as C\n    if (version as number === 18) {\n      // CIDv0\n      version = 0 as V\n      offset = 0\n    } else {\n      codec = next() as C\n    }\n\n    if (version !== 0 && version !== 1) {\n      throw new RangeError(`Invalid CID version ${version}`)\n    }\n\n    const prefixSize = offset\n    const multihashCode = next() as A // multihash code\n    const digestSize = next() // multihash length\n    const size = offset + digestSize\n    const multihashSize = size - prefixSize\n\n    return { version, codec, multihashCode, digestSize, multihashSize, size }\n  }\n\n  /**\n   * Takes cid in a string representation and creates an instance. If `base`\n   * decoder is not provided will use a default from the configuration. It will\n   * throw an error if encoding of the CID is not compatible with supplied (or\n   * a default decoder).\n   */\n  static parse <Prefix extends string, Data, Code extends number, Alg extends number, Version extends API.Version>(source: API.ToString<API.Link<Data, Code, Alg, Version>, Prefix>, base?: API.MultibaseDecoder<Prefix>): CID<Data, Code, Alg, Version> {\n    const [prefix, bytes] = parseCIDtoBytes(source, base)\n\n    const cid = CID.decode(bytes)\n\n    if (cid.version === 0 && source[0] !== 'Q') {\n      throw Error('Version 0 CID string must not include multibase prefix')\n    }\n\n    // Cache string representation to avoid computing it on `this.toString()`\n    baseCache(cid).set(prefix, source)\n\n    return cid\n  }\n}\n\nfunction parseCIDtoBytes <Prefix extends string, Data, Code extends number, Alg extends number, Version extends API.Version> (source: API.ToString<API.Link<Data, Code, Alg, Version>, Prefix>, base?: API.MultibaseDecoder<Prefix>): [Prefix, API.ByteView<API.Link<Data, Code, Alg, Version>>] {\n  switch (source[0]) {\n    // CIDv0 is parsed differently\n    case 'Q': {\n      const decoder = base ?? base58btc\n      return [\n        base58btc.prefix as Prefix,\n        decoder.decode(`${base58btc.prefix}${source}`)\n      ]\n    }\n    case base58btc.prefix: {\n      const decoder = base ?? base58btc\n      return [base58btc.prefix as Prefix, decoder.decode(source)]\n    }\n    case base32.prefix: {\n      const decoder = base ?? base32\n      return [base32.prefix as Prefix, decoder.decode(source)]\n    }\n    case base36.prefix: {\n      const decoder = base ?? base36\n      return [base36.prefix as Prefix, decoder.decode(source)]\n    }\n    default: {\n      if (base == null) {\n        throw Error(\n          'To parse non base32, base36 or base58btc encoded CID multibase decoder must be provided'\n        )\n      }\n      return [source[0] as Prefix, base.decode(source)]\n    }\n  }\n}\n\nfunction toStringV0 (bytes: Uint8Array, cache: Map<string, string>, base: API.MultibaseEncoder<'z'>): string {\n  const { prefix } = base\n  if (prefix !== base58btc.prefix) {\n    throw Error(`Cannot string encode V0 in ${base.name} encoding`)\n  }\n\n  const cid = cache.get(prefix)\n  if (cid == null) {\n    const cid = base.encode(bytes).slice(1)\n    cache.set(prefix, cid)\n    return cid\n  } else {\n    return cid\n  }\n}\n\nfunction toStringV1 <Prefix extends string> (bytes: Uint8Array, cache: Map<string, string>, base: API.MultibaseEncoder<Prefix>): string {\n  const { prefix } = base\n  const cid = cache.get(prefix)\n  if (cid == null) {\n    const cid = base.encode(bytes)\n    cache.set(prefix, cid)\n    return cid\n  } else {\n    return cid\n  }\n}\n\nconst DAG_PB_CODE = 0x70\nconst SHA_256_CODE = 0x12\n\nfunction encodeCID (version: API.Version, code: number, multihash: Uint8Array): Uint8Array {\n  const codeOffset = varint.encodingLength(version)\n  const hashOffset = codeOffset + varint.encodingLength(code)\n  const bytes = new Uint8Array(hashOffset + multihash.byteLength)\n  varint.encodeTo(version, bytes, 0)\n  varint.encodeTo(code, bytes, codeOffset)\n  bytes.set(multihash, hashOffset)\n  return bytes\n}\n\nconst cidSymbol = Symbol.for('@ipld/js-cid/CID')\n","import * as base10 from './bases/base10.js'\nimport * as base16 from './bases/base16.js'\nimport * as base2 from './bases/base2.js'\nimport * as base256emoji from './bases/base256emoji.js'\nimport * as base32 from './bases/base32.js'\nimport * as base36 from './bases/base36.js'\nimport * as base58 from './bases/base58.js'\nimport * as base64 from './bases/base64.js'\nimport * as base8 from './bases/base8.js'\nimport * as identityBase from './bases/identity.js'\nimport * as json from './codecs/json.js'\nimport * as raw from './codecs/raw.js'\nimport * as identity from './hashes/identity.js'\nimport * as sha2 from './hashes/sha2.js'\nimport { CID, hasher, digest, varint, bytes } from './index.js'\n\nexport const bases = { ...identityBase, ...base2, ...base8, ...base10, ...base16, ...base32, ...base36, ...base58, ...base64, ...base256emoji }\nexport const hashes = { ...sha2, ...identity }\nexport const codecs = { raw, json }\n\nexport { CID, hasher, digest, varint, bytes }\n","/**\n * SharingService - v2 sharing link service with embedded private keys.\n *\n * This service implements the v2 sharing specification, which embeds private keys\n * directly in sharing links. This allows recipients to exercise delegations\n * without requiring prior session setup.\n *\n * Key differences from v1 SharingLinks:\n * - Private keys are embedded in the link (not just tokens)\n * - Recipients can optionally sub-delegate to their own session key\n * - Pre-configured KV service returned for immediate use\n *\n * @packageDocumentation\n */\n\nimport type {\n  IKVService,\n  ServiceSession,\n  InvokeFunction,\n  FetchFunction,\n} from \"@tinycloud/sdk-services\";\nimport type {\n  Result,\n  DelegationError,\n  Delegation,\n  KeyInfo,\n  KeyProvider,\n  GenerateShareParams,\n  ShareLink,\n  ShareLinkData,\n  ShareSchema,\n  JWK,\n  IngestOptions,\n  CreateDelegationParams,\n  CreateDelegationWasmParams,\n  CreateDelegationWasmResult,\n} from \"./types\";\nimport { DelegationErrorCodes } from \"./types\";\nimport type { DelegationManager } from \"./DelegationManager\";\nimport type { ICapabilityKeyRegistry } from \"../authorization/CapabilityKeyRegistry\";\nimport { validateEncodedShareData } from \"./SharingService.schema.js\";\nimport { SERVICE_LONG_TO_SHORT, type PermissionEntry } from \"../manifest\";\nimport { principalDid } from \"../identity\";\nimport {\n  actionContains,\n  CaveatedDelegationUnsupportedError,\n  recapCaveatsEqual,\n} from \"../capabilities\";\nimport { bases } from \"multiformats/basics\";\nimport { ed25519 } from \"@noble/curves/ed25519\";\nimport { ShareRecipientClient } from \"./ShareRecipientClient\";\nimport type { ShareAccessV2, ShareRecipientClientOptions } from \"./recipient-types\";\n\n// ---------------------------------------------------------------------------\n// Local helpers\n// ---------------------------------------------------------------------------\n\n/**\n * Infer the short-form service name (`\"kv\"`, `\"sql\"`, etc) that all of the\n * given full-URN action strings belong to.\n *\n * SharingService issues single-service delegations (KV-only, SQL-only, …) —\n * the multi-resource WASM `createDelegation` call requires the service\n * segment explicitly because it's keyed separately from the action list.\n * This helper extracts the namespace half (`\"tinycloud.kv\"`) from each URN,\n * maps it to the short form via {@link SERVICE_LONG_TO_SHORT}, and returns\n * `undefined` if the actions are not all from the same known service.\n *\n * Returning `undefined` is intentional: the caller must surface a clear\n * error rather than guessing.\n */\nfunction inferShortServiceFromActionUrns(\n  actions: readonly string[]\n): string | undefined {\n  let short: string | undefined;\n  for (const action of actions) {\n    const slash = action.indexOf(\"/\");\n    if (slash === -1) return undefined;\n    const longService = action.slice(0, slash);\n    const candidate = SERVICE_LONG_TO_SHORT[longService];\n    if (candidate === undefined) return undefined;\n    if (short === undefined) {\n      short = candidate;\n    } else if (short !== candidate) {\n      return undefined;\n    }\n  }\n  return short;\n}\n\n// =============================================================================\n// Constants\n// =============================================================================\n\n/**\n * Default actions for read-only sharing links.\n */\nconst DEFAULT_READ_ACTIONS = [\"tinycloud.kv/get\", \"tinycloud.kv/metadata\"];\n\n/**\n * Default expiry for share links — SHARE tier (see ../expiry.ts).\n */\nimport { EXPIRY } from \"../expiry\";\nconst DEFAULT_EXPIRY_MS = EXPIRY.SHARE_MS;\n\n/**\n * Prefix for the base64 schema.\n */\nconst BASE64_PREFIX = \"tc1:\";\n\n// =============================================================================\n// Helper Functions\n// =============================================================================\n\n/**\n * Creates a DelegationError with the given parameters.\n */\nfunction createError(\n  code: string,\n  message: string,\n  cause?: Error,\n  meta?: Record<string, unknown>\n): DelegationError {\n  return {\n    code,\n    message,\n    service: \"delegation\",\n    cause,\n    meta,\n  };\n}\n\n/**\n * Classify a failure thrown by the root-delegation signing callback.\n *\n * The callback drives a wallet / OpenKey signing surface. \"The signer never\n * answered\" and \"the server said you may not do this\" both used to collapse\n * into a single `PERMISSION_DENIED` with an authorization-flavoured message,\n * which is wrong for the user (retrying the signature would have worked) and\n * useless for whoever is debugging it.\n */\nfunction rootDelegationSigningError(err: unknown): DelegationError {\n  const cause = err instanceof Error ? err : undefined;\n  const code =\n    err && typeof err === \"object\" && \"code\" in err\n      ? String((err as { code?: unknown }).code ?? \"\")\n      : \"\";\n  const name = err instanceof Error ? err.name : \"\";\n  const message = err instanceof Error ? err.message : String(err ?? \"\");\n\n  const aborted =\n    code === DelegationErrorCodes.ABORTED ||\n    name === \"AbortError\" ||\n    /\\bcancell?ed\\b|\\brejected\\b|user denied/i.test(message);\n  if (aborted) {\n    return createError(\n      DelegationErrorCodes.ABORTED,\n      \"The signature that authorizes this sharing link was cancelled. \" +\n        \"Approve the signing prompt to finish creating the link.\",\n      cause,\n    );\n  }\n\n  const timedOut =\n    code === DelegationErrorCodes.TIMEOUT ||\n    name === \"TimeoutError\" ||\n    /timed out|timeout/i.test(message);\n  if (timedOut) {\n    return createError(\n      DelegationErrorCodes.TIMEOUT,\n      \"Timed out waiting for the signature that authorizes this sharing link. \" +\n        \"Creating a long-lived link re-opens the signing prompt after sign-in; \" +\n        \"if you did not see one, check for a blocked popup or a hidden signing \" +\n        \"frame, then try again.\",\n      cause,\n    );\n  }\n\n  return createError(\n    DelegationErrorCodes.PERMISSION_DENIED,\n    \"The active session ReCap does not authorize this sharing delegation.\",\n    cause,\n  );\n}\n\n/**\n * Base64 encode for URLs (URL-safe base64).\n */\nfunction base64UrlEncode(data: string): string {\n  // Use btoa for browser, Buffer for Node.js\n  let base64: string;\n  if (typeof btoa !== \"undefined\") {\n    base64 = btoa(unescape(encodeURIComponent(data)));\n  } else if (typeof Buffer !== \"undefined\") {\n    base64 = Buffer.from(data, \"utf-8\").toString(\"base64\");\n  } else {\n    throw new Error(\"No base64 encoding available\");\n  }\n  // Make URL-safe\n  return base64.replace(/\\+/g, \"-\").replace(/\\//g, \"_\").replace(/=+$/, \"\");\n}\n\n/**\n * Base64 decode for URLs (URL-safe base64).\n */\nfunction base64UrlDecode(encoded: string): string {\n  // Restore standard base64\n  let base64 = encoded.replace(/-/g, \"+\").replace(/_/g, \"/\");\n  // Add padding if needed\n  while (base64.length % 4) {\n    base64 += \"=\";\n  }\n  // Decode\n  if (typeof atob !== \"undefined\") {\n    return decodeURIComponent(escape(atob(base64)));\n  } else if (typeof Buffer !== \"undefined\") {\n    return Buffer.from(base64, \"base64\").toString(\"utf-8\");\n  } else {\n    throw new Error(\"No base64 decoding available\");\n  }\n}\n\n// =============================================================================\n// Types\n// =============================================================================\n\n/**\n * Data encoded in a sharing link.\n */\nexport interface EncodedShareData {\n  /** Private key in JWK format (includes d parameter) */\n  key: JWK;\n  /** DID of the key */\n  keyDid: string;\n  /** The delegation granting access */\n  delegation: Delegation;\n  /** Resource path this link grants access to */\n  path: string;\n  /** TinyCloud host URL */\n  host: string;\n  /** Space ID */\n  spaceId: string;\n  /** Schema version */\n  version: 1;\n}\n\n/**\n * Options for receiving a sharing link.\n */\nexport interface ReceiveOptions {\n  /**\n   * Whether to automatically create a sub-delegation to the current session key.\n   * Default: true\n   */\n  autoSubdelegate?: boolean;\n  /**\n   * Whether to use the current session key for operations (requires autoSubdelegate).\n   * Default: true\n   */\n  useSessionKey?: boolean;\n  /**\n   * Ingestion options passed to CapabilityKeyRegistry.\n   */\n  ingestOptions?: IngestOptions;\n}\n\n/**\n * Result of receiving a sharing link.\n */\nexport interface ShareAccess {\n  /** The delegation that was received/created */\n  delegation: Delegation;\n  /** Key info for the received key */\n  key: KeyInfo;\n  /** Pre-configured KV service for the shared path */\n  kv: IKVService;\n  /** The space ID */\n  spaceId: string;\n  /** The path prefix for this share */\n  path: string;\n}\n\n/**\n * Parameters for attenuating a received share to another principal.\n *\n * Omitted path/actions/expiry inherit the received share's exact values. Any\n * supplied value must be equal to or an attenuated subset of the parent.\n */\nexport interface DelegateReceivedShareParams {\n  /** DID that may exercise the child delegation. */\n  delegateDID: string;\n  /** Equal to or below the shared path. Defaults to the shared path. */\n  path?: string;\n  /** Subset of the shared actions. Defaults to all shared actions. */\n  actions?: string[];\n  /** No later than the sharing-link expiry. Defaults to the parent expiry. */\n  expiry?: Date;\n  /** Optional node origin that further narrows the configured-host allowlist. */\n  expectedHost?: string;\n}\n\n/**\n * A transport-ready child delegation with non-secret source lineage.\n *\n * `delegation.delegationHeader` is a live bearer credential. Treat it like a\n * secret: do not log it or persist it outside secure credential storage.\n * Only `source` is safe to retain as non-secret lineage metadata.\n */\nexport interface DelegatedShareAccess {\n  delegation: Delegation & {\n    delegationHeader: { Authorization: string };\n    ownerAddress: string;\n    chainId: number;\n    host: string;\n    resources: Array<{ service: string; space: string; path: string; actions: string[] }>;\n    disableSubDelegation: boolean;\n  };\n  source: {\n    parentCid: string;\n    spaceId: string;\n    path: string;\n    host: string;\n    expiresAt: Date;\n  };\n}\n\n/**\n * Configuration for SharingService.\n */\nexport interface SharingServiceConfig {\n  /** TinyCloud host URLs */\n  hosts: string[];\n  /**\n   * Active session for authentication.\n   * Required for generate(), optional for receive().\n   */\n  session?: ServiceSession;\n  /** Platform-specific invoke function */\n  invoke: InvokeFunction;\n  /** Optional custom fetch implementation */\n  fetch?: FetchFunction;\n  /** Key provider for cryptographic operations */\n  keyProvider: KeyProvider;\n  /** Capability key registry for key/delegation management */\n  registry: ICapabilityKeyRegistry;\n  /**\n   * Delegation manager for creating delegations (used if createDelegation not provided).\n   * Required for generate(), optional for receive().\n   */\n  delegationManager?: DelegationManager;\n  /** Factory for creating KV service instances */\n  createKVService: (config: {\n    hosts: string[];\n    session: ServiceSession;\n    invoke: InvokeFunction;\n    fetch?: FetchFunction;\n    pathPrefix?: string;\n  }) => IKVService;\n  /** Base URL for sharing links (e.g., \"https://share.myapp.com\") */\n  baseUrl?: string;\n  /**\n   * Custom delegation creation function. When provided, this is used instead\n   * of delegationManager.create(). This allows platforms to use their own\n   * delegation creation logic (e.g., SIWE-based /delegate endpoint).\n   */\n  createDelegation?: (params: CreateDelegationParams) => Promise<Result<Delegation, DelegationError>>;\n  /**\n   * WASM function for client-side delegation creation.\n   * When provided, this is preferred over server-side creation (createDelegation/delegationManager).\n   * Creates UCAN delegations directly without requiring server roundtrip.\n   */\n  createDelegationWasm?: (params: CreateDelegationWasmParams) => CreateDelegationWasmResult;\n  /** Compute a CID for serialized delegation bytes. Required for share attenuation. */\n  computeCid?: (data: Uint8Array, codec: bigint) => string;\n  /**\n   * Path prefix for KV operations.\n   * When set, paths passed to generate() are prefixed with this value.\n   * This ensures the share path matches the session's authorized paths.\n   */\n  pathPrefix?: string;\n  /**\n   * Session expiry time.\n   * When set, sharing link expiry is clamped to not exceed this value\n   * unless onRootDelegationNeeded is provided and returns a new delegation.\n   */\n  sessionExpiry?: Date;\n  /**\n   * Callback to create a DIRECT delegation from the root (wallet) to a share key.\n   * This bypasses the session delegation chain, allowing share links with\n   * expiry longer than the current session.\n   *\n   * When provided and share expiry > session expiry:\n   * 1. SharingService creates the ephemeral share key\n   * 2. This callback is invoked with the share key DID\n   * 3. The callback signs a direct PKH -> share key delegation with the wallet\n   * 4. The returned delegation is used for the share link\n   *\n   * This is the CORRECT solution for long-lived share links because:\n   * - It creates a fresh delegation chain: PKH -> share key\n   * - Not constrained by session expiry (no sub-delegation from session key)\n   *\n   * @param params - Parameters for creating the root delegation\n   * @returns The delegation from wallet to share key, or undefined to fall back to session extension\n   */\n  onRootDelegationNeeded?: (params: {\n    /** DID of the share key to delegate to */\n    shareKeyDID: string;\n    /** Space ID */\n    spaceId: string;\n    /** Path to grant access to */\n    path: string;\n    /** Actions to grant */\n    actions: string[];\n    /** Requested expiry time */\n    requestedExpiry: Date;\n  }) => Promise<Delegation | undefined>;\n  /** Reject operations after the host session/service graph has been retired. */\n  assertActive?: () => void;\n}\n\n/**\n * Interface for the SharingService.\n */\nexport interface ISharingService {\n  /**\n   * Generate a sharing link with an embedded private key.\n   *\n   * This creates a new session key, delegates to it, and encodes\n   * the key and delegation into a shareable link.\n   */\n  generate(params: GenerateShareParams): Promise<Result<ShareLink, DelegationError>>;\n\n  /**\n   * Receive and activate a sharing link.\n   *\n   * Decodes the link, ingests the key into the registry, and optionally\n   * creates a sub-delegation to the current session key.\n   */\n  receive(link: string, options?: ReceiveOptions): Promise<Result<ShareAccess, DelegationError>>;\n\n  /** Receive a signed v2 envelope/link without changing the legacy tc1 API. */\n  receiveV2(\n    link: string,\n    options?: Omit<ShareRecipientClientOptions, \"trustedOrigins\" | \"fetch\" | \"invoke\" | \"createKVService\">,\n  ): Promise<ShareAccessV2>;\n\n  /**\n   * Consume a sharing link locally and create an attenuated child delegation.\n   * The raw link and embedded private JWK are never returned. The returned\n   * child delegation is itself a sensitive bearer credential.\n   */\n  delegateReceivedShare(\n    link: string,\n    params: DelegateReceivedShareParams\n  ): Promise<Result<DelegatedShareAccess, DelegationError>>;\n\n  /**\n   * Encode sharing data into a link string.\n   */\n  encodeLink(data: EncodedShareData, schema?: ShareSchema): string;\n\n  /**\n   * Decode a link string into sharing data.\n   */\n  decodeLink(link: string): EncodedShareData;\n}\n\n// =============================================================================\n// Implementation\n// =============================================================================\n\n/**\n * SharingService - v2 sharing link service with embedded private keys.\n *\n * @example\n * ```typescript\n * import { SharingService } from \"@tinycloud/sdk-core/delegations\";\n *\n * const sharing = new SharingService({\n *   hosts: [\"https://node.tinycloud.xyz\"],\n *   session,\n *   invoke,\n *   keyProvider,\n *   registry,\n *   delegationManager,\n *   createKVService,\n *   baseUrl: \"https://share.myapp.com\"\n * });\n *\n * // Generate a sharing link\n * const result = await sharing.generate({\n *   path: \"/kv/documents/report.pdf\",\n *   actions: [\"tinycloud.kv/get\"],\n *   expiry: new Date(\"2024-12-31\")\n * });\n *\n * if (result.ok) {\n *   console.log(\"Share this URL:\", result.data.url);\n * }\n *\n * // Receive a sharing link\n * const receiveResult = await sharing.receive(shareUrl);\n * if (receiveResult.ok) {\n *   // Use the pre-configured KV service\n *   const data = await receiveResult.data.kv.get(\"report.pdf\");\n * }\n * ```\n */\nexport class SharingService implements ISharingService {\n  private hosts: string[];\n  private session?: ServiceSession;\n  private invoke: InvokeFunction;\n  private fetchFn: FetchFunction;\n  private keyProvider: KeyProvider;\n  private registry: ICapabilityKeyRegistry;\n  private delegationManager?: DelegationManager;\n  private createKVService: SharingServiceConfig[\"createKVService\"];\n  private baseUrl: string;\n  private createDelegationFn?: SharingServiceConfig[\"createDelegation\"];\n  private createDelegationWasmFn?: SharingServiceConfig[\"createDelegationWasm\"];\n  private computeCidFn?: SharingServiceConfig[\"computeCid\"];\n  private pathPrefix: string;\n  private sessionExpiry?: Date;\n  private onRootDelegationNeeded?: SharingServiceConfig[\"onRootDelegationNeeded\"];\n  private assertActiveFn?: SharingServiceConfig[\"assertActive\"];\n\n  /**\n   * Creates a new SharingService instance.\n   */\n  constructor(config: SharingServiceConfig) {\n    this.hosts = config.hosts;\n    this.session = config.session;\n    this.invoke = config.invoke;\n    this.fetchFn = config.fetch ?? globalThis.fetch.bind(globalThis);\n    this.keyProvider = config.keyProvider;\n    this.registry = config.registry;\n    this.delegationManager = config.delegationManager;\n    this.createKVService = config.createKVService;\n    this.baseUrl = (config.baseUrl ?? \"\").replace(/\\/$/, \"\"); // Remove trailing slash\n    this.createDelegationFn = config.createDelegation;\n    this.createDelegationWasmFn = config.createDelegationWasm;\n    this.computeCidFn = config.computeCid;\n    this.pathPrefix = config.pathPrefix ?? \"\";\n    this.sessionExpiry = config.sessionExpiry;\n    this.onRootDelegationNeeded = config.onRootDelegationNeeded;\n    this.assertActiveFn = config.assertActive;\n  }\n\n  /**\n   * Gets the primary host URL.\n   */\n  private get host(): string {\n    return this.hosts[0];\n  }\n\n  /**\n   * Updates the session (e.g., after re-authentication).\n   */\n  public updateSession(session: ServiceSession): void {\n    this.assertActiveFn?.();\n    this.session = session;\n  }\n\n  /**\n   * Updates the service configuration.\n   * Used to add full capabilities (session, delegationManager, createDelegation, createDelegationWasm) after signIn.\n   */\n  public updateConfig(config: Partial<Pick<SharingServiceConfig, \"session\" | \"delegationManager\" | \"createDelegation\" | \"createDelegationWasm\" | \"sessionExpiry\" | \"onRootDelegationNeeded\" | \"assertActive\">>): void {\n    this.assertActiveFn?.();\n    if (config.session !== undefined) {\n      this.session = config.session;\n    }\n    if (config.delegationManager !== undefined) {\n      this.delegationManager = config.delegationManager;\n    }\n    if (config.createDelegation !== undefined) {\n      this.createDelegationFn = config.createDelegation;\n    }\n    if (config.createDelegationWasm !== undefined) {\n      this.createDelegationWasmFn = config.createDelegationWasm;\n    }\n    if (config.sessionExpiry !== undefined) {\n      this.sessionExpiry = config.sessionExpiry;\n    }\n    if (config.onRootDelegationNeeded !== undefined) {\n      this.onRootDelegationNeeded = config.onRootDelegationNeeded;\n    }\n    if (config.assertActive !== undefined) {\n      this.assertActiveFn = config.assertActive;\n    }\n  }\n\n  /**\n   * Generate a sharing link with an embedded private key.\n   *\n   * Flow:\n   * 1. Spawn new session key (unique per share)\n   * 2. Create delegation from current session to spawned key\n   * 3. Package: { key (with private!), delegation, path, host }\n   * 4. Encode based on schema (base64 for now)\n   * 5. Return link string\n   */\n  async generate(params: GenerateShareParams): Promise<Result<ShareLink, DelegationError>> {\n    const activeError = this.retiredGraphError();\n    if (activeError) return { ok: false, error: activeError };\n\n    // Require session for generating (not for receiving)\n    if (!this.session) {\n      return {\n        ok: false,\n        error: createError(\n          DelegationErrorCodes.NOT_INITIALIZED,\n          \"Session required for generating sharing links. Call signIn() first.\"\n        ),\n      };\n    }\n\n    // Require delegation capability\n    if (!this.createDelegationWasmFn && !this.createDelegationFn && !this.delegationManager) {\n      return {\n        ok: false,\n        error: createError(\n          DelegationErrorCodes.NOT_INITIALIZED,\n          \"DelegationManager, createDelegation, or createDelegationWasm function required for generating sharing links.\"\n        ),\n      };\n    }\n\n    // Validate path\n    if (!params.path) {\n      return {\n        ok: false,\n        error: createError(\n          DelegationErrorCodes.INVALID_INPUT,\n          \"path is required\"\n        ),\n      };\n    }\n\n    const actions = params.actions ?? DEFAULT_READ_ACTIONS;\n    const requestedExpiry = params.expiry ?? new Date(Date.now() + DEFAULT_EXPIRY_MS);\n    let expiry = requestedExpiry;\n\n    const schema: ShareSchema = params.schema ?? \"base64\";\n\n    // Build full path with prefix (matches how KVService stores data)\n    // If pathPrefix is \"demo-app\" and path is \"hello\", fullPath is \"demo-app/hello\"\n    const fullPath = this.pathPrefix\n      ? `${this.pathPrefix}/${params.path}`.replace(/\\/+/g, \"/\") // Normalize slashes\n      : params.path;\n\n    // Only base64 schema is implemented in v1\n    if (schema !== \"base64\") {\n      return {\n        ok: false,\n        error: createError(\n          DelegationErrorCodes.INVALID_INPUT,\n          `Schema '${schema}' not implemented. Only 'base64' is supported.`\n        ),\n      };\n    }\n\n    // Step 1: Spawn a new session key unique to this share\n    // We create this FIRST so we can pass its DID to onRootDelegationNeeded if needed\n    let keyId: string;\n    let keyDid: string;\n    let keyJwk: JWK;\n\n    try {\n      const shareKeyName = `share:${Date.now()}:${Math.random().toString(36).substring(2, 10)}`;\n      keyId = await this.keyProvider.createSessionKey(shareKeyName);\n      const keyCreationActiveError = this.retiredGraphError();\n      if (keyCreationActiveError) return { ok: false, error: keyCreationActiveError };\n      keyDid = await this.keyProvider.getDID(keyId);\n      const keyDidActiveError = this.retiredGraphError();\n      if (keyDidActiveError) return { ok: false, error: keyDidActiveError };\n      keyJwk = this.keyProvider.getJWK(keyId) as JWK;\n\n      // Ensure the private key is included\n      if (!keyJwk.d) {\n        return {\n          ok: false,\n          error: createError(\n            DelegationErrorCodes.CREATION_FAILED,\n            \"KeyProvider did not return private key (d parameter) in JWK\"\n          ),\n        };\n      }\n    } catch (err) {\n      return {\n        ok: false,\n        error: createError(\n          DelegationErrorCodes.CREATION_FAILED,\n          `Failed to generate session key for share: ${err instanceof Error ? err.message : String(err)}`,\n          err instanceof Error ? err : undefined\n        ),\n      };\n    }\n\n    // Step 2: Check if any existing key can satisfy this delegation\n    // Only prompt for root delegation if NO existing key in the registry can handle it\n    let delegation: Delegation;\n    // Strip fragment from DID URL to get plain DID for UCAN audience\n    // getDID() returns \"did:key:z6Mk...#z6Mk...\" but audience needs \"did:key:z6Mk...\"\n    const plainDID = keyDid.split('#')[0];\n\n    // Helper to handle delegation result (returns early on error)\n    const handleDelegationResult = (\n      result: Awaited<ReturnType<typeof this.createSessionDelegation>>\n    ): Delegation | { ok: false; error: DelegationError } => {\n      if (result && typeof result === 'object' && 'ok' in result) {\n        return result as { ok: false; error: DelegationError };\n      }\n      return result as Delegation;\n    };\n\n    // Check if any key in the registry can satisfy this delegation request\n    // A key can satisfy the request if it has a delegation that:\n    // 1. Covers the required path and actions\n    // 2. Has sufficient expiry (delegation.expiry >= requestedExpiry)\n    // 3. Allows sub-delegation\n    const canSatisfyFromRegistry = this.findSuitableKeyForDelegation(\n      fullPath,\n      actions,\n      requestedExpiry\n    );\n\n    if (canSatisfyFromRegistry) {\n      // An existing key can satisfy this request - use session delegation (no prompt)\n      const delegationResult = await this.createSessionDelegation(plainDID, fullPath, actions, expiry);\n      const childDelegationActiveError = this.retiredGraphError();\n      if (childDelegationActiveError) return { ok: false, error: childDelegationActiveError };\n      const parsed = handleDelegationResult(delegationResult);\n      if ('ok' in parsed && parsed.ok === false) {\n        return parsed;\n      }\n      delegation = parsed as Delegation;\n    } else if (this.onRootDelegationNeeded) {\n      // No existing key can satisfy the request - try root delegation\n      try {\n        const rootDelegation = await this.onRootDelegationNeeded({\n          shareKeyDID: plainDID,\n          spaceId: this.session.spaceId,\n          path: fullPath,\n          actions,\n          requestedExpiry,\n        });\n        const rootDelegationActiveError = this.retiredGraphError();\n        if (rootDelegationActiveError) return { ok: false, error: rootDelegationActiveError };\n\n        if (rootDelegation) {\n          delegation = rootDelegation;\n          expiry = requestedExpiry;\n        } else {\n          return {\n            ok: false,\n            error: createError(\n              DelegationErrorCodes.PERMISSION_DENIED,\n              \"The active session ReCap does not authorize this sharing delegation.\",\n            ),\n          };\n        }\n      } catch (err) {\n        // `onRootDelegationNeeded` re-opens the wallet/OpenKey signing surface\n        // mid-compose, long after sign-in. An unanswered or cancelled signature\n        // is a completely different problem from \"you are not authorized\", and\n        // must not be reported as the same thing.\n        return { ok: false, error: rootDelegationSigningError(err) };\n      }\n    } else {\n      return {\n        ok: false,\n        error: createError(\n          DelegationErrorCodes.PERMISSION_DENIED,\n          \"The active session ReCap does not authorize this sharing delegation.\",\n        ),\n      };\n    }\n\n    const finalActiveError = this.retiredGraphError();\n    if (finalActiveError) return { ok: false, error: finalActiveError };\n\n    // Step 3: Package the share data\n    const shareData: EncodedShareData = {\n      key: keyJwk,\n      keyDid,\n      delegation,\n      path: fullPath,\n      host: this.host,\n      spaceId: this.session.spaceId,\n      version: 1,\n    };\n\n    // Step 4: Encode the link\n    const encodedData = this.encodeLink(shareData, schema);\n\n    // Step 5: Build the full URL\n    const baseUrl = params.baseUrl ?? this.baseUrl;\n    const url = baseUrl ? `${baseUrl}/share/${encodedData}` : encodedData;\n\n    const shareLink: ShareLink = {\n      token: encodedData,\n      url,\n      delegation,\n      schema,\n      expiresAt: expiry,\n      description: params.description,\n    };\n\n    return { ok: true, data: shareLink };\n  }\n\n  /**\n   * Check if any key in the registry can satisfy the delegation request.\n   * A key can satisfy if it has a delegation that:\n   * 1. Covers the required path (exact match or parent path)\n   * 2. Has all required actions\n   * 3. Has sufficient expiry (delegation.expiry >= requestedExpiry)\n   * 4. Allows sub-delegation\n   * @internal\n   */\n  private findSuitableKeyForDelegation(\n    path: string,\n    actions: string[],\n    requestedExpiry: Date\n  ): boolean {\n    // Check registry for keys with sufficient capabilities\n    const allKeys = this.registry.getAllKeys();\n    for (const key of allKeys) {\n      const delegations = this.registry.getDelegationsForKey(key.id);\n      for (const delegation of delegations) {\n        // A registry can contain capabilities for several spaces. A share\n        // created by this service may only spend authority for its own\n        // session space.\n        if (delegation.spaceId !== this.session?.spaceId) {\n          continue;\n        }\n\n        // SharingService cannot reproduce arbitrary signed ReCap caveats when\n        // issuing a child delegation.  Treat caveated authority as unusable\n        // here rather than minting a broader child capability.\n        if ((delegation.caveats?.length ?? 0) > 0) {\n          continue;\n        }\n\n        // Check if delegation is valid and not expired\n        if (!this.registry.isDelegationValid(delegation)) {\n          continue;\n        }\n\n        // Check if delegation has sufficient expiry\n        if (delegation.expiry < requestedExpiry) {\n          continue;\n        }\n\n        // Check if delegation allows sub-delegation\n        if (delegation.allowSubDelegation === false) {\n          continue;\n        }\n\n        // Check if delegation covers the path (exact match or parent path)\n        const delegationPath = delegation.path || '';\n        if (!this.pathMatches(delegationPath, path)) {\n          continue;\n        }\n\n        // Check if delegation has all required actions\n        const delegationActions = delegation.actions || [];\n        const hasAllActions = actions.every(action =>\n          delegationActions.includes(action) || delegationActions.includes('*')\n        );\n        if (!hasAllActions) {\n          continue;\n        }\n\n        // Found a suitable key\n        return true;\n      }\n    }\n\n    return false;\n  }\n\n  private retiredGraphError(): DelegationError | undefined {\n    try {\n      this.assertActiveFn?.();\n      return undefined;\n    } catch (err) {\n      return createError(\n        DelegationErrorCodes.NOT_INITIALIZED,\n        \"The session service graph has been retired.\",\n        err instanceof Error ? err : undefined,\n      );\n    }\n  }\n\n  /**\n   * Check if a delegation path matches/covers the requested path.\n   * A delegation path covers the request if:\n   * - It's an exact match\n   * - It's a parent path (e.g., delegation for \"\" covers \"foo/bar\")\n   * - It uses wildcards that match\n   * @internal\n   */\n  private pathMatches(delegationPath: string, requestedPath: string): boolean {\n    // Empty delegation path covers everything\n    if (delegationPath === '' || delegationPath === '*') {\n      return true;\n    }\n\n    // Exact match\n    if (delegationPath === requestedPath) {\n      return true;\n    }\n\n    // Check if delegation path is a parent of requested path\n    const normalizedDelegation = delegationPath.replace(/\\/$/, '');\n    const normalizedRequest = requestedPath.replace(/\\/$/, '');\n\n    if (normalizedRequest.startsWith(normalizedDelegation + '/')) {\n      return true;\n    }\n\n    return false;\n  }\n\n  /**\n   * Create a delegation from the current session to a share key.\n   * This is the fallback path when root delegation is not available.\n   * @internal\n   */\n  private async createSessionDelegation(\n    delegateDID: string,\n    path: string,\n    actions: string[],\n    expiry: Date\n  ): Promise<Delegation | Result<never, DelegationError>> {\n    const activeError = this.retiredGraphError();\n    if (activeError) return { ok: false, error: activeError };\n\n    if (!this.session) {\n      return {\n        ok: false,\n        error: createError(\n          DelegationErrorCodes.NOT_INITIALIZED,\n          \"Session required for creating delegation\"\n        ),\n      };\n    }\n\n    if (this.createDelegationWasmFn) {\n      // Client-side delegation creation via WASM.\n      //\n      // SharingService always issues single-resource delegations (one\n      // path, one action list). The multi-resource WASM API takes an\n      // `abilities` map shaped `Record<shortService, Record<path,\n      // actions[]>>`, so we infer the short service from the first\n      // action URN (every action in a share call shares the same\n      // service namespace by construction — KV-only, SQL-only, etc).\n      //\n      // The result comes back with a `resources` array; for a\n      // single-entry call it always has exactly one entry, and we\n      // mirror that entry's `path` + `actions` back into the flat\n      // Delegation shape that the rest of SharingService works with.\n      try {\n        if (actions.length === 0) {\n          return {\n            ok: false,\n            error: createError(\n              DelegationErrorCodes.VALIDATION_ERROR,\n              \"createDelegation requires at least one action\"\n            ),\n          };\n        }\n        const shortService = inferShortServiceFromActionUrns(actions);\n        if (shortService === undefined) {\n          return {\n            ok: false,\n            error: createError(\n              DelegationErrorCodes.VALIDATION_ERROR,\n              `createDelegation: cannot infer service from actions ${JSON.stringify(actions)} — expected full URNs like \"tinycloud.kv/get\"`\n            ),\n          };\n        }\n\n        const wasmResult = this.createDelegationWasmFn({\n          session: this.session,\n          delegateDID,\n          spaceId: this.session.spaceId,\n          abilities: {\n            [shortService]: {\n              [path]: [...actions],\n            },\n          },\n          expirationSecs: Math.floor(expiry.getTime() / 1000),\n        });\n        const childSigningActiveError = this.retiredGraphError();\n        if (childSigningActiveError) return { ok: false, error: childSigningActiveError };\n\n        // Register the delegation with the server\n        const registerRes = await this.fetchFn(`${this.host}/delegate`, {\n          method: \"POST\",\n          headers: {\n            Authorization: wasmResult.delegation,\n          },\n        });\n        const registrationActiveError = this.retiredGraphError();\n        if (registrationActiveError) return { ok: false, error: registrationActiveError };\n\n        if (!registerRes.ok) {\n          const errorText = await registerRes.text();\n          const registrationTextActiveError = this.retiredGraphError();\n          if (registrationTextActiveError) return { ok: false, error: registrationTextActiveError };\n          return {\n            ok: false,\n            error: createError(\n              DelegationErrorCodes.CREATION_FAILED,\n              `Failed to register delegation with server: ${registerRes.status} ${errorText}`\n            ),\n          };\n        }\n\n        // Single-entry call → resources[0] is authoritative for the\n        // flat Delegation shape. We assert length here because a\n        // zero-length result would mean the Rust side dropped our\n        // single input — that's a protocol bug, not a runtime\n        // condition to silently coerce.\n        if (wasmResult.resources.length === 0) {\n          return {\n            ok: false,\n            error: createError(\n              DelegationErrorCodes.CREATION_FAILED,\n              \"createDelegation WASM returned empty resources array for a single-entry request\"\n            ),\n          };\n        }\n        const primary = wasmResult.resources[0];\n        return {\n          cid: wasmResult.cid,\n          delegateDID: wasmResult.delegateDID,\n          spaceId: this.session.spaceId,\n          path: primary.path,\n          actions: primary.actions,\n          expiry: wasmResult.expiry,\n          isRevoked: false,\n          authHeader: wasmResult.delegation,\n          allowSubDelegation: true,\n          createdAt: new Date(),\n        };\n      } catch (err) {\n        return {\n          ok: false,\n          error: createError(\n            DelegationErrorCodes.CREATION_FAILED,\n            `Failed to create delegation via WASM: ${err instanceof Error ? err.message : String(err)}`,\n            err instanceof Error ? err : undefined\n          ),\n        };\n      }\n    } else {\n      // Server-side delegation creation (fallback)\n      const delegationParams: CreateDelegationParams = {\n        delegateDID,\n        path,\n        actions,\n        expiry,\n        disableSubDelegation: false,\n      };\n\n      const delegationResult = this.createDelegationFn\n        ? await this.createDelegationFn(delegationParams)\n        : await this.delegationManager!.create(delegationParams);\n      const delegationCreationActiveError = this.retiredGraphError();\n      if (delegationCreationActiveError) return { ok: false, error: delegationCreationActiveError };\n\n      if (!delegationResult.ok) {\n        return {\n          ok: false,\n          error: createError(\n            DelegationErrorCodes.CREATION_FAILED,\n            `Failed to create delegation for share: ${delegationResult.error.message}`,\n            delegationResult.error.cause,\n            delegationResult.error.meta\n          ),\n        };\n      }\n\n      return delegationResult.data;\n    }\n  }\n\n  /**\n   * Receive and activate a sharing link.\n   *\n   * Flow:\n   * 1. Decode link -> extract { key, delegation, path, host }\n   * 2. Ingest key into CapabilityKeyRegistry\n   * 3. If autoSubdelegate (default true) + useSessionKey:\n   *    - Create sub-delegation from ingested key -> current session\n   *    - Register sub-delegation capabilities\n   * 4. Return ShareAccess with pre-configured KV service\n   */\n  async receive(\n    link: string,\n    options: ReceiveOptions = {}\n  ): Promise<Result<ShareAccess, DelegationError>> {\n    const activeError = this.retiredGraphError();\n    if (activeError) return { ok: false, error: activeError };\n\n    const {\n      autoSubdelegate = true,\n      useSessionKey = true,\n      ingestOptions,\n    } = options;\n\n    // Step 1: Decode and validate the link\n    const decodeResult = this.decodeLinkWithValidation(link);\n    if (!decodeResult.ok) {\n      return decodeResult;\n    }\n    const shareData = decodeResult.data;\n\n    // Schema validation ensures key.d and delegation exist, but we need\n    // to check business rules (expiry, revocation) separately\n\n    // Check delegation expiry\n    const delegationExpiry = new Date(shareData.delegation.expiry);\n    if (delegationExpiry < new Date()) {\n      return {\n        ok: false,\n        error: createError(\n          DelegationErrorCodes.AUTH_EXPIRED,\n          \"Sharing link has expired\"\n        ),\n      };\n    }\n\n    // Check delegation revocation\n    if (shareData.delegation.isRevoked) {\n      return {\n        ok: false,\n        error: createError(\n          DelegationErrorCodes.REVOKED,\n          \"Sharing link has been revoked\"\n        ),\n      };\n    }\n\n    // Step 2: Create KeyInfo and ingest into registry\n    const keyInfo: KeyInfo = {\n      id: `ingested:${shareData.keyDid}`,\n      did: shareData.keyDid,\n      type: \"ingested\",\n      jwk: shareData.key,\n      priority: 2, // Ingested keys have lowest priority\n    };\n\n    this.registry.ingestKey(keyInfo, shareData.delegation, ingestOptions);\n\n    // The delegation and key to use for operations\n    let activeDelegation = shareData.delegation;\n    let activeKey = keyInfo;\n\n    // Step 3: Auto-subdelegate if requested\n    if (autoSubdelegate && useSessionKey && this.session) {\n      const child = await this.delegateReceivedShare(link, {\n        delegateDID: this.session.verificationMethod,\n        expectedHost: shareData.host,\n      });\n      if (!child.ok) return child;\n      activeDelegation = child.data.delegation;\n      activeKey = {\n        id: `session:${principalDid(this.session.verificationMethod)}`,\n        did: this.session.verificationMethod,\n        type: \"session\",\n        priority: 0,\n      };\n    }\n\n    // Step 4: Create pre-configured KV service for the shared path\n    // Construct session from share data - no need for existing session\n    // Use the authHeader if available, otherwise fall back to constructing from CID\n    const portableAuthorization = (activeDelegation as Delegation & {\n      delegationHeader?: { Authorization?: string };\n    }).delegationHeader?.Authorization;\n    const authHeader = portableAuthorization ?? activeDelegation.authHeader ?? `Bearer ${activeDelegation.cid}`;\n    const activeSession = activeKey.type === \"session\" && this.session\n      ? this.session\n      : undefined;\n    const shareSession: ServiceSession = {\n      delegationHeader: { Authorization: authHeader },\n      delegationCid: activeDelegation.cid,\n      spaceId: shareData.spaceId,\n      verificationMethod: activeSession?.verificationMethod ?? shareData.keyDid,\n      jwk: activeSession?.jwk ?? shareData.key,\n    };\n\n    const kvService = this.createKVService({\n      hosts: [shareData.host],\n      session: shareSession,\n      invoke: this.invoke,\n      fetch: this.fetchFn,\n      pathPrefix: shareData.path,\n    });\n\n    const shareAccess: ShareAccess = {\n      delegation: activeDelegation,\n      key: activeKey,\n      kv: kvService,\n      spaceId: shareData.spaceId,\n      path: shareData.path,\n    };\n\n    return { ok: true, data: shareAccess };\n  }\n\n  async receiveV2(\n    link: string,\n    options: Omit<ShareRecipientClientOptions, \"trustedOrigins\" | \"fetch\" | \"invoke\" | \"createKVService\"> = {},\n  ): Promise<ShareAccessV2> {\n    const client = new ShareRecipientClient({\n      ...options,\n      trustedOrigins: this.hosts,\n      fetch: this.fetchFn,\n      invoke: this.invoke,\n      createKVService: this.createKVService,\n    });\n    return client.open(link);\n  }\n\n  /**\n   * Create a constrained child delegation from a received sharing link.\n   *\n   * This is the safe handoff for a browser delegating shared input to an\n   * agent or service: the bearer link is decoded and used only in this SDK\n   * instance, while the recipient receives a child UCAN without the embedded\n   * private key. The child UCAN is a sensitive bearer credential and must not\n   * be logged or stored insecurely.\n   */\n  async delegateReceivedShare(\n    link: string,\n    params: DelegateReceivedShareParams\n  ): Promise<Result<DelegatedShareAccess, DelegationError>> {\n    const activeError = this.retiredGraphError();\n    if (activeError) return { ok: false, error: activeError };\n\n    const decoded = this.decodeLinkWithValidation(link);\n    if (!decoded.ok) return decoded;\n    const shareData = decoded.data;\n    this.assertDelegationCaveatsPreservable(shareData.delegation);\n\n    const parentExpiry = new Date(shareData.delegation.expiry);\n    const now = new Date();\n    if (parentExpiry <= now) {\n      return {\n        ok: false,\n        error: createError(DelegationErrorCodes.AUTH_EXPIRED, \"Sharing link has expired\"),\n      };\n    }\n    if (shareData.delegation.isRevoked) {\n      return {\n        ok: false,\n        error: createError(DelegationErrorCodes.REVOKED, \"Sharing link has been revoked\"),\n      };\n    }\n    if (shareData.delegation.allowSubDelegation === false) {\n      return {\n        ok: false,\n        error: createError(\n          DelegationErrorCodes.PERMISSION_DENIED,\n          \"Sharing link does not allow delegation\"\n        ),\n      };\n    }\n    const delegateDID = principalDid(params.delegateDID?.trim() ?? \"\");\n    if (!/^did:(?:key|pkh):[^\\s]+$/.test(delegateDID)) {\n      return {\n        ok: false,\n        error: createError(DelegationErrorCodes.INVALID_INPUT, \"A valid delegateDID is required\"),\n      };\n    }\n    const trustedHost = trustedNodeOrigin(shareData.host, this.hosts, params.expectedHost);\n    if (!trustedHost) {\n      return {\n        ok: false,\n        error: createError(\n          DelegationErrorCodes.PERMISSION_DENIED,\n          \"Sharing-link host is not a configured TinyCloud host\"\n        ),\n      };\n    }\n    if (\n      shareData.delegation.spaceId !== shareData.spaceId ||\n      principalDid(shareData.delegation.delegateDID) !== principalDid(shareData.keyDid) ||\n      !shareKeyMatchesDid(shareData.key, shareData.keyDid) ||\n      !capabilityPathContains(shareData.delegation.path, shareData.path)\n    ) {\n      return {\n        ok: false,\n        error: createError(\n          DelegationErrorCodes.INVALID_TOKEN,\n          \"Sharing-link metadata does not match its parent delegation\"\n        ),\n      };\n    }\n    if (!shareData.delegation.authHeader) {\n      return {\n        ok: false,\n        error: createError(\n          DelegationErrorCodes.INVALID_TOKEN,\n          \"Sharing link is missing its signed parent delegation\"\n        ),\n      };\n    }\n    if (!this.createDelegationWasmFn || !this.computeCidFn) {\n      return {\n        ok: false,\n        error: createError(\n          DelegationErrorCodes.NOT_INITIALIZED,\n          \"Client-side delegation and CID support are required\"\n        ),\n      };\n    }\n\n    const path = params.path ?? shareData.path;\n    if (!capabilityPathContains(shareData.path, path)) {\n      return {\n        ok: false,\n        error: createError(\n          DelegationErrorCodes.PERMISSION_DENIED,\n          \"Requested path exceeds the sharing-link capability\"\n        ),\n      };\n    }\n\n    const parentActions = shareData.delegation.actions;\n    const actions = params.actions ?? [...parentActions];\n    if (\n      actions.length === 0 ||\n      new Set(actions).size !== actions.length ||\n      actions.includes(\"*\") ||\n      actions.some((action) => !parentActions.some((parentAction) => actionContains(parentAction, action)))\n    ) {\n      return {\n        ok: false,\n        error: createError(\n          DelegationErrorCodes.PERMISSION_DENIED,\n          \"Requested actions exceed the sharing-link capability\"\n        ),\n      };\n    }\n\n    const expiry = params.expiry ?? parentExpiry;\n    if (expiry <= now || expiry > parentExpiry) {\n      return {\n        ok: false,\n        error: createError(\n          DelegationErrorCodes.PERMISSION_DENIED,\n          \"Child delegation expiry must be active and no later than the sharing link\"\n        ),\n      };\n    }\n\n    const service = inferShortServiceFromActionUrns(actions);\n    if (!service) {\n      return {\n        ok: false,\n        error: createError(\n          DelegationErrorCodes.INVALID_INPUT,\n          \"Sharing-link actions must belong to one known TinyCloud service\"\n        ),\n      };\n    }\n\n    const owner = ownerFromSpaceId(shareData.spaceId);\n    if (!owner) {\n      return {\n        ok: false,\n        error: createError(\n          DelegationErrorCodes.INVALID_TOKEN,\n          \"Sharing link has an unsupported owner space\"\n        ),\n      };\n    }\n\n    try {\n      const parentSession: ServiceSession = {\n        delegationHeader: { Authorization: shareData.delegation.authHeader },\n        delegationCid: shareData.delegation.cid,\n        spaceId: shareData.spaceId,\n        verificationMethod: shareData.keyDid,\n        jwk: shareData.key,\n      };\n      const result = this.createDelegationWasmFn({\n        session: parentSession,\n        delegateDID,\n        spaceId: shareData.spaceId,\n        abilities: { [service]: { [path]: actions } },\n        expirationSecs: Math.floor(expiry.getTime() / 1000),\n      });\n      const childSigningActiveError = this.retiredGraphError();\n      if (childSigningActiveError) return { ok: false, error: childSigningActiveError };\n      const verifiedChild = verifySignedChild(result, {\n        delegateDID,\n        issuerDID: principalDid(shareData.keyDid),\n        parentCid: shareData.delegation.cid,\n        service,\n        spaceId: shareData.spaceId,\n        path,\n        actions,\n        expiresAt: expiry,\n        parentExpiresAt: parentExpiry,\n      }, this.computeCidFn);\n      if (!verifiedChild) {\n        return {\n          ok: false,\n          error: createError(\n            DelegationErrorCodes.CREATION_FAILED,\n            \"Delegation signer returned a child outside the requested capability\"\n          ),\n        };\n      }\n\n      const registrationInit = {\n        method: \"POST\",\n        headers: { Authorization: result.delegation },\n        redirect: \"error\" as const,\n      };\n      const registration = await this.fetchFn(new URL(\"/delegate\", trustedHost).toString(), registrationInit);\n      const registrationActiveError = this.retiredGraphError();\n      if (registrationActiveError) return { ok: false, error: registrationActiveError };\n      if (!registration.ok) {\n        throw new Error(`node rejected child delegation (${registration.status})`);\n      }\n\n      const primary = verifiedChild.resource;\n      return {\n        ok: true,\n        data: {\n          delegation: {\n            cid: result.cid,\n            delegateDID: verifiedChild.delegateDID,\n            delegatorDID: shareData.keyDid.split(\"#\")[0],\n            spaceId: shareData.spaceId,\n            path: primary.path,\n            actions: primary.actions,\n            expiry: verifiedChild.expiresAt,\n            isRevoked: false,\n            allowSubDelegation: false,\n            parentCid: shareData.delegation.cid,\n            createdAt: now,\n            delegationHeader: { Authorization: result.delegation },\n            ownerAddress: owner.address,\n            chainId: owner.chainId,\n            host: trustedHost,\n            resources: result.resources,\n            disableSubDelegation: true,\n          },\n          source: {\n            parentCid: shareData.delegation.cid,\n            spaceId: shareData.spaceId,\n            path: primary.path,\n            host: trustedHost,\n            expiresAt: verifiedChild.expiresAt,\n          },\n        },\n      };\n    } catch (err) {\n      return {\n        ok: false,\n        error: createError(\n          DelegationErrorCodes.CREATION_FAILED,\n          \"Failed to create or register the child delegation\"\n        ),\n      };\n    }\n  }\n\n  /**\n   * The child-delegation WASM boundary accepts action-only abilities. Reject\n   * every constrained parent branch before that boundary can broaden it.\n   */\n  private assertDelegationCaveatsPreservable(delegation: Delegation): void {\n    if (recapCaveatsEqual(delegation.caveats, undefined)) return;\n    const service = delegation.actions[0]?.split(\"/\", 1)[0] ?? \"tinycloud.unknown\";\n    const entry: PermissionEntry = {\n      service,\n      space: delegation.spaceId,\n      path: delegation.path,\n      actions: [...delegation.actions],\n      caveats: delegation.caveats ?? [],\n    };\n    throw new CaveatedDelegationUnsupportedError([entry]);\n  }\n\n  /**\n   * Encode sharing data into a link string.\n   *\n   * @param data - The share data to encode\n   * @param schema - The encoding schema (default: \"base64\")\n   * @returns Encoded link string\n   */\n  encodeLink(data: EncodedShareData, schema: ShareSchema = \"base64\"): string {\n    if (schema !== \"base64\") {\n      throw new Error(`Schema '${schema}' not implemented. Only 'base64' is supported.`);\n    }\n\n    const jsonString = JSON.stringify(data);\n    const encoded = base64UrlEncode(jsonString);\n    return `${BASE64_PREFIX}${encoded}`;\n  }\n\n  /**\n   * Decode a link string into sharing data.\n   *\n   * @param link - The encoded link string (may include URL prefix)\n   * @returns Decoded share data\n   * @throws Error if link format is invalid or data fails validation\n   */\n  decodeLink(link: string): EncodedShareData {\n    const result = this.decodeLinkWithValidation(link);\n    if (!result.ok) {\n      throw new Error(result.error.message);\n    }\n    return result.data;\n  }\n\n  /**\n   * Decode and validate a link string into sharing data.\n   *\n   * Internal method that returns a Result instead of throwing.\n   * Used by receive() for proper error handling.\n   *\n   * @param link - The encoded link string (may include URL prefix)\n   * @returns Result with decoded share data or validation error\n   */\n  private decodeLinkWithValidation(link: string): Result<EncodedShareData, DelegationError> {\n    // Extract the encoded data from the link\n    let encoded = link;\n\n    // Handle full URL format: https://share.example.com/share/tc1:...\n    if (link.includes(\"/share/\")) {\n      const parts = link.split(\"/share/\");\n      encoded = parts[parts.length - 1];\n    }\n\n    // Handle query parameter format: ?share=tc1:...\n    if (link.includes(\"?share=\")) {\n      try {\n        const url = new URL(link);\n        encoded = url.searchParams.get(\"share\") ?? encoded;\n      } catch {\n        return {\n          ok: false,\n          error: createError(\n            DelegationErrorCodes.INVALID_TOKEN,\n            \"Invalid URL format in sharing link\"\n          ),\n        };\n      }\n    }\n\n    // Remove the schema prefix\n    if (!encoded.startsWith(BASE64_PREFIX)) {\n      return {\n        ok: false,\n        error: createError(\n          DelegationErrorCodes.INVALID_TOKEN,\n          `Invalid sharing link format. Expected prefix '${BASE64_PREFIX}'`\n        ),\n      };\n    }\n\n    const base64Data = encoded.slice(BASE64_PREFIX.length);\n\n    let jsonString: string;\n    try {\n      jsonString = base64UrlDecode(base64Data);\n    } catch (err) {\n      return {\n        ok: false,\n        error: createError(\n          DelegationErrorCodes.INVALID_TOKEN,\n          `Failed to decode base64 data: ${err instanceof Error ? err.message : String(err)}`,\n          err instanceof Error ? err : undefined\n        ),\n      };\n    }\n\n    let parsed: unknown;\n    try {\n      parsed = JSON.parse(jsonString);\n    } catch (err) {\n      return {\n        ok: false,\n        error: createError(\n          DelegationErrorCodes.INVALID_TOKEN,\n          `Failed to parse share data JSON: ${err instanceof Error ? err.message : String(err)}`,\n          err instanceof Error ? err : undefined\n        ),\n      };\n    }\n\n    // Convert delegation expiry to Date before validation if it's a string\n    // This is needed because JSON.parse doesn't restore Date objects\n    if (\n      parsed &&\n      typeof parsed === \"object\" &&\n      \"delegation\" in parsed &&\n      parsed.delegation &&\n      typeof parsed.delegation === \"object\" &&\n      \"expiry\" in parsed.delegation &&\n      typeof parsed.delegation.expiry === \"string\"\n    ) {\n      (parsed.delegation as { expiry: Date }).expiry = new Date(parsed.delegation.expiry);\n    }\n\n    // Validate against schema\n    const validationResult = validateEncodedShareData(parsed);\n    if (!validationResult.ok) {\n      return {\n        ok: false,\n        error: createError(\n          DelegationErrorCodes.INVALID_TOKEN,\n          validationResult.error.message,\n          undefined,\n          validationResult.error.meta\n        ),\n      };\n    }\n\n    return { ok: true, data: validationResult.data };\n  }\n}\n\n/**\n * Create a new SharingService instance.\n */\nexport function createSharingService(config: SharingServiceConfig): ISharingService {\n  return new SharingService(config);\n}\n\nfunction ownerFromSpaceId(spaceId: string): { chainId: number; address: string } | null {\n  const match = spaceId.match(/^tinycloud:pkh:eip155:(\\d+):(0x[a-fA-F0-9]{40}):/);\n  if (!match) return null;\n  const chainId = Number(match[1]);\n  if (!Number.isSafeInteger(chainId)) return null;\n  return { chainId, address: match[2] };\n}\n\nfunction parseTrustedNodeOrigin(value: string): string | null {\n  try {\n    const url = new URL(value);\n    if (\n      ![\"http:\", \"https:\"].includes(url.protocol) ||\n      url.username ||\n      url.password ||\n      (url.pathname !== \"\" && url.pathname !== \"/\") ||\n      url.search ||\n      url.hash\n    ) return null;\n    return url.origin.toLowerCase();\n  } catch {\n    return null;\n  }\n}\n\nfunction trustedNodeOrigin(candidate: string, configured: string[], expected?: string): string | null {\n  const origin = parseTrustedNodeOrigin(candidate);\n  if (!origin) return null;\n  const allowed = new Set(configured.map(parseTrustedNodeOrigin).filter((value): value is string => Boolean(value)));\n  if (!allowed.has(origin)) return null;\n  if (expected && parseTrustedNodeOrigin(expected) !== origin) return null;\n  return origin;\n}\n\nfunction canonicalCapabilityPath(path: string): string | null {\n  if (\n    /[\\u0000-\\u001f\\\\]/.test(path) ||\n    /%(?:2e|2f|5c)/i.test(path) ||\n    path.includes(\"//\")\n  ) return null;\n  const wildcardIndex = path.indexOf(\"*\");\n  if (wildcardIndex !== -1 && !path.endsWith(\"/*\") && !path.endsWith(\"/**\")) return null;\n  if (path.slice(0, -3).includes(\"*\") || (path.endsWith(\"/*\") && path.slice(0, -2).includes(\"*\"))) return null;\n  const segments = path.split(\"/\");\n  if (segments.some((segment) => segment === \".\" || segment === \"..\")) return null;\n  return path;\n}\n\nfunction capabilityPathContains(parent: string, child: string): boolean {\n  const canonicalParent = canonicalCapabilityPath(parent);\n  const canonicalChild = canonicalCapabilityPath(child);\n  if (canonicalParent === null || canonicalChild === null) return false;\n  if (canonicalParent === \"\" || canonicalParent === \"/\") return true;\n  if (canonicalParent === canonicalChild) return true;\n  if (canonicalParent.endsWith(\"/**\")) {\n    return canonicalChild.startsWith(canonicalParent.slice(0, -2));\n  }\n  if (canonicalParent.endsWith(\"/*\")) {\n    const prefix = canonicalParent.slice(0, -1);\n    if (!canonicalChild.startsWith(prefix)) return false;\n    const remainder = canonicalChild.slice(prefix.length);\n    return remainder.length > 0 && !remainder.includes(\"/\");\n  }\n  return canonicalParent.endsWith(\"/\") && canonicalChild.startsWith(canonicalParent);\n}\n\nfunction shareKeyMatchesDid(key: JWK, didUrl: string): boolean {\n  if (\n    key.kty !== \"OKP\" ||\n    key.crv !== \"Ed25519\" ||\n    typeof key.x !== \"string\" ||\n    typeof key.d !== \"string\"\n  ) return false;\n  try {\n    const didBytes = bases.base58btc.decode(principalDid(didUrl).slice(\"did:key:\".length));\n    const publicKey = didBytes.length === 34 && didBytes[0] === 0xed && didBytes[1] === 0x01\n      ? didBytes.slice(2)\n      : null;\n    if (!publicKey) return false;\n    const jwkBytes = decodeBase64UrlBytes(key.x);\n    const privateKey = decodeBase64UrlBytes(key.d);\n    const derivedPublicKey = ed25519.getPublicKey(privateKey);\n    return (\n      privateKey.length === 32 &&\n      publicKey.length === jwkBytes.length &&\n      publicKey.every((byte, index) => byte === jwkBytes[index]) &&\n      derivedPublicKey.length === jwkBytes.length &&\n      derivedPublicKey.every((byte, index) => byte === jwkBytes[index])\n    );\n  } catch {\n    return false;\n  }\n}\n\nfunction decodeBase64UrlBytes(value: string): Uint8Array {\n  let encoded = value.replace(/-/g, \"+\").replace(/_/g, \"/\");\n  while (encoded.length % 4) encoded += \"=\";\n  if (typeof atob !== \"undefined\") {\n    return Uint8Array.from(atob(encoded), (character) => character.charCodeAt(0));\n  }\n  return Uint8Array.from(Buffer.from(encoded, \"base64\"));\n}\n\nfunction verifySignedChild(\n  result: CreateDelegationWasmResult,\n  expected: {\n    delegateDID: string;\n    issuerDID: string;\n    parentCid: string;\n    service: string;\n    spaceId: string;\n    path: string;\n    actions: string[];\n    expiresAt: Date;\n    parentExpiresAt: Date;\n  },\n  computeCid: NonNullable<SharingServiceConfig[\"computeCid\"]>,\n): { delegateDID: string; expiresAt: Date; resource: CreateDelegationWasmResult[\"resources\"][number] } | null {\n  const parts = result.delegation.split(\".\");\n  if (parts.length !== 3) return null;\n  let payload: Record<string, unknown>;\n  try {\n    payload = JSON.parse(new TextDecoder().decode(decodeBase64UrlBytes(parts[1]))) as Record<string, unknown>;\n  } catch {\n    return null;\n  }\n  const delegateDID = typeof payload.aud === \"string\" ? principalDid(payload.aud) : \"\";\n  const issuerDID = typeof payload.iss === \"string\" ? principalDid(payload.iss) : \"\";\n  const proofs = Array.isArray(payload.prf) ? payload.prf : [];\n  const expirationSecs = typeof payload.exp === \"number\" && Number.isInteger(payload.exp) ? payload.exp : 0;\n  const expiresAt = new Date(expirationSecs * 1000);\n  if (\n    delegateDID !== expected.delegateDID ||\n    issuerDID !== expected.issuerDID ||\n    proofs.length !== 1 ||\n    proofs[0] !== expected.parentCid ||\n    expiresAt <= new Date() ||\n    expiresAt > expected.expiresAt ||\n    expiresAt > expected.parentExpiresAt ||\n    computeCid(new TextEncoder().encode(result.delegation), 0x55n) !== result.cid\n  ) return null;\n\n  const att = payload.att;\n  if (!att || typeof att !== \"object\" || Array.isArray(att)) return null;\n  const entries = Object.entries(att as Record<string, unknown>);\n  if (entries.length !== 1) return null;\n  const [resourceUri, abilityValue] = entries[0];\n  const prefix = `${expected.spaceId}/${expected.service}/`;\n  if (!resourceUri.startsWith(prefix) || resourceUri.slice(prefix.length) !== expected.path) return null;\n  if (!abilityValue || typeof abilityValue !== \"object\" || Array.isArray(abilityValue)) return null;\n  const signedActions = Object.keys(abilityValue as Record<string, unknown>).sort();\n  const expectedActions = [...expected.actions].sort();\n  if (\n    signedActions.length !== expectedActions.length ||\n    !signedActions.every((action, index) => action === expectedActions[index])\n  ) return null;\n\n  if (principalDid(result.delegateDID) !== delegateDID || result.resources.length !== 1) return null;\n  if (result.expiry.getTime() !== expiresAt.getTime()) return null;\n  const resource = result.resources[0];\n  if (\n    resource.service !== expected.service ||\n    resource.space !== expected.spaceId ||\n    resource.path !== expected.path\n  ) return null;\n  const actualActions = [...resource.actions].sort();\n  if (\n    actualActions.length !== expectedActions.length ||\n    !actualActions.every((action, index) => action === expectedActions[index])\n  ) return null;\n  return { delegateDID, expiresAt, resource };\n}\n","import {\n  ErrorCodes,\n  KVService,\n  ServiceContext,\n  type FetchFunction,\n  type IKVService,\n  type InvokeFunction,\n  type ServiceHeaders,\n  type ServiceSession,\n} from \"@tinycloud/sdk-services\";\nimport { ed25519 } from \"@noble/curves/ed25519\";\nimport { sha256 } from \"@noble/hashes/sha256\";\nimport { base58btc } from \"multiformats/bases/base58\";\nimport {\n  decryptShareBytesAsync,\n  openPublishedShareBlob,\n  parseShareArtifact,\n  parsePublishedShareEnvelope,\n  parseLegacyPublishedShareEnvelope,\n  parsePublishedShareLink,\n  parseShareUrl,\n  shareCapabilityAllows,\n  intersectShareCapabilities,\n  verifyShareCid,\n  verifyPublishedShareCid,\n  verifyShareEnvelope,\n  MAX_SEALED_SHARE_CONTENT_BYTES,\n  MAX_SHARE_ARTIFACT_BYTES,\n  MAX_SHARE_CONTENT_BYTES,\n  type ShareAction,\n  type ShareEnvelopeV2,\n  type ShareLinkLocation,\n  type ShareResource,\n  type ShareCapabilityLike,\n} from \"./share-envelope\";\nimport { MemoryShareCache, type ShareCache, type ShareCacheEntry } from \"./ShareCache\";\nimport { ShareAccessError, ShareConflict, type ShareAccessV2, type ShareDetachedProof, type ShareNativeAction, type ShareNativeInvokeResult, type ShareNativeInvokeSuccessResult, type SharePolicyBinding, type SharePolicySession, type ShareRecipientClientOptions, type ShareReadResult, type ShareMetadataResult, type ShareListEntry, type ShareListResult } from \"./recipient-types\";\nimport { ShareNativeResponseSchema } from \"./recipient-types.schema\";\n\nconst DEFAULT_MAX_ARTIFACT_BYTES = MAX_SHARE_ARTIFACT_BYTES;\nconst DEFAULT_MAX_CONTENT_BYTES = MAX_SHARE_CONTENT_BYTES;\nconst DEFAULT_MAX_SEALED_CONTENT_BYTES = MAX_SEALED_SHARE_CONTENT_BYTES;\nconst NATIVE_MEDIA_TYPE = \"application/vnd.tinycloud.share+json\" as const;\nconst READ_INVOCATION_DOMAIN_V1 = \"xyz.tinycloud.share/read-invocation/v1\\0\";\nconst READ_INVOCATION_DOMAIN_V2 = \"xyz.tinycloud.share/invocation/v2\\0\";\nconst POLICY_PRESENTATION_DOMAIN_V1 = \"xyz.tinycloud.share/policy-presentation/v1\\0\";\nconst POLICY_PRESENTATION_DOMAIN_V2 = \"xyz.tinycloud.share/policy-session/v2\\0\";\nconst READ_TTL_MS = 60_000;\nconst MAX_NATIVE_CURSOR_BYTES = 8 * 1024;\nconst MAX_NATIVE_LIMIT = 1_000;\nconst MAX_NATIVE_ENTRIES = 10_000;\n\ninterface ResolvedArtifact {\n  readonly location: ShareLinkLocation;\n  readonly artifact: ReturnType<typeof parseShareArtifact>;\n  readonly bytes: Uint8Array;\n  readonly plaintext: Uint8Array;\n}\n\ninterface NativeResponseRecord {\n  readonly type: \"TinyCloudShareInvokeResponse\";\n  readonly version: 2;\n  readonly action: ShareNativeAction;\n  readonly resource: string;\n  readonly mediaType?: string;\n  readonly content?: string;\n  readonly bodyDigest?: string;\n  readonly etag?: string | null;\n  readonly entries?: readonly ShareListEntry[];\n  readonly nextCursor?: string | null;\n  readonly contentType?: string;\n  readonly metadata?: Readonly<Record<string, string>>;\n}\n\nfunction redactedCode(error: unknown): string {\n  if (error instanceof ShareAccessError) return error.code;\n  if (error instanceof ShareConflict) return error.code;\n  const code = error && typeof error === \"object\" && \"code\" in error ? (error as { readonly code?: unknown }).code : undefined;\n  if (typeof code !== \"string\") return \"SHARE_INVALID\";\n  if (code === ErrorCodes.KV_PRECONDITION_FAILED || code === ErrorCodes.KV_CONFLICT || code === \"412\") return \"SHARE_CONFLICT\";\n  if (code === \"KV_NOT_FOUND\" || code === \"NOT_FOUND\" || code === \"404\") return \"SHARE_NOT_FOUND\";\n  if (code.includes(\"EXPIRED\") || code === \"expired\") return \"SHARE_EXPIRED\";\n  if (code.includes(\"REVOK\")) return \"SHARE_REVOKED\";\n  if (code.includes(\"AUTH\") || code.includes(\"DENIED\") || code === \"403\" || code === \"401\") return \"SHARE_DENIED\";\n  if (code.includes(\"NETWORK\") || code.includes(\"TIMEOUT\") || code === \"OFFLINE\") return \"SHARE_OFFLINE\";\n  if ([\"invalid-link\", \"invalid-envelope\", \"expired\", \"signature-invalid\", \"cid-mismatch\", \"origin-mismatch\", \"content-too-large\", \"encryption-required\", \"unsafe-plaintext\"].includes(code)) return code;\n  return code.startsWith(\"SHARE_\") ? code : \"SHARE_INVALID\";\n}\n\nfunction asError(error: unknown): ShareAccessError {\n  if (error instanceof ShareAccessError) return error;\n  return new ShareAccessError(redactedCode(error));\n}\n\nfunction operationAction(action: \"get\" | \"metadata\" | \"list\" | \"save\"): ShareAction {\n  return action === \"get\" || action === \"metadata\" ? \"read\" : action === \"list\" ? \"list\" : \"edit\";\n}\n\nfunction normalizePath(value: string): string {\n  const parts = value.split(\"/\");\n  const invalidPart = parts.some((part, index) => part === \"..\" || part === \".\" || (part === \"\" && !(index === parts.length - 1 && value.endsWith(\"/\"))));\n  if (value === \"\" || value.startsWith(\"/\") || /[\\u0000-\\u001f\\u007f\\\\]/.test(value) || /%2f|%5c|%2e/i.test(value) || invalidPart) {\n    throw new ShareAccessError(\"SHARE_INVALID_PATH\");\n  }\n  return value;\n}\n\nfunction canonicalJsonForProof(value: unknown): string {\n  if (value === null || typeof value === \"string\" || typeof value === \"boolean\") return JSON.stringify(value);\n  if (typeof value === \"number\") {\n    if (!Number.isFinite(value)) throw new ShareAccessError(\"SHARE_SESSION_INVALID\");\n    return JSON.stringify(value);\n  }\n  if (Array.isArray(value)) return `[${value.map(canonicalJsonForProof).join(\",\")}]`;\n  if (typeof value === \"object\") {\n    const object = value as Record<string, unknown>;\n    return `{${Object.keys(object).sort().map((key) => `${JSON.stringify(key)}:${canonicalJsonForProof(object[key])}`).join(\",\")}}`;\n  }\n  throw new ShareAccessError(\"SHARE_SESSION_INVALID\");\n}\n\nfunction base64UrlToBytes(value: string): Uint8Array {\n  if (!/^[A-Za-z0-9_-]*$/.test(value) || value.length % 4 === 1) throw new Error(\"base64url\");\n  const padded = value.replace(/-/g, \"+\").replace(/_/g, \"/\") + \"=\".repeat((4 - value.length % 4) % 4);\n  const decoded = typeof atob === \"function\" ? atob(padded) : Buffer.from(padded, \"base64\").toString(\"binary\");\n  const bytes = Uint8Array.from(decoded, (char) => char.charCodeAt(0));\n  if (bytesToBase64Url(bytes) !== value) throw new Error(\"non-canonical base64url\");\n  return bytes;\n}\n\nfunction bytesToBase64Url(bytes: Uint8Array): string {\n  let binary = \"\";\n  for (const byte of bytes) binary += String.fromCharCode(byte);\n  const encoded = typeof btoa === \"function\" ? btoa(binary) : Buffer.from(bytes).toString(\"base64\");\n  return encoded.replace(/\\+/g, \"-\").replace(/\\//g, \"_\").replace(/=+$/g, \"\");\n}\n\nfunction randomJti(): string {\n  const bytes = new Uint8Array(16);\n  crypto.getRandomValues(bytes);\n  return bytesToBase64Url(bytes);\n}\n\nfunction digestCanonical(value: unknown): string {\n  return bytesToBase64Url(sha256(new TextEncoder().encode(canonicalJsonForProof(value))));\n}\n\nfunction actionWire(action: \"get\" | \"metadata\" | \"list\" | \"put\"): ShareNativeAction {\n  return action === \"get\" ? \"tinycloud.kv/get\" : action === \"metadata\" ? \"tinycloud.kv/metadata\" : action === \"list\" ? \"tinycloud.kv/list\" : \"tinycloud.kv/put\";\n}\n\nfunction nativeActionFor(value: unknown): ShareNativeAction | undefined {\n  if (value === \"tinycloud.kv/get\" || value === \"get\" || value === \"read\") return \"tinycloud.kv/get\";\n  if (value === \"tinycloud.kv/metadata\" || value === \"metadata\") return \"tinycloud.kv/metadata\";\n  if (value === \"tinycloud.kv/list\" || value === \"list\") return \"tinycloud.kv/list\";\n  if (value === \"tinycloud.kv/put\" || value === \"tinycloud.kv/edit\" || value === \"put\" || value === \"edit\") return \"tinycloud.kv/put\";\n  return undefined;\n}\n\nfunction policyActionFor(value: unknown): ShareAction | undefined {\n  const native = nativeActionFor(value);\n  return native === \"tinycloud.kv/get\" || native === \"tinycloud.kv/metadata\" ? \"read\" : native === \"tinycloud.kv/list\" ? \"list\" : native === \"tinycloud.kv/put\" ? \"edit\" : undefined;\n}\n\nfunction canonicalNativeActions(values: readonly unknown[]): ShareNativeAction[] {\n  const actions = values.map(nativeActionFor);\n  if (actions.some((action) => action === undefined)) throw new ShareAccessError(\"SHARE_SESSION_ACTION_MISMATCH\");\n  return [...new Set(actions as ShareNativeAction[])].sort();\n}\n\nfunction resourceValue(value: unknown, stringKind: ShareResource[\"kind\"] = \"exact\"): ShareResource | undefined {\n  if (typeof value === \"string\") {\n    const kind = value.endsWith(\"/\") ? \"prefix\" : stringKind;\n    return { kind, path: kind === \"prefix\" && !value.endsWith(\"/\") ? `${value}/` : value };\n  }\n  if (!isRecord(value) || (value.kind !== \"exact\" && value.kind !== \"prefix\")) return undefined;\n  const path = typeof value.path === \"string\" ? value.path : typeof value.value === \"string\" ? value.value : undefined;\n  return path === undefined ? undefined : { kind: value.kind, path: value.kind === \"prefix\" && !path.endsWith(\"/\") ? `${path}/` : path };\n}\n\nfunction headersRecord(headers: ServiceHeaders | undefined): Record<string, string> {\n  if (headers === undefined) return {};\n  if (Array.isArray(headers)) return Object.fromEntries(headers.map(([key, value]) => [key.toLowerCase(), value]));\n  return Object.fromEntries(Object.entries(headers).map(([key, value]) => [key.toLowerCase(), value]));\n}\n\nfunction isRecord(value: unknown): value is Record<string, unknown> {\n  return value !== null && typeof value === \"object\" && !Array.isArray(value);\n}\n\nfunction isNativeSuccess(result: ShareNativeInvokeResult): result is ShareNativeInvokeSuccessResult {\n  return \"type\" in result;\n}\n\nfunction unwrapProofResponse(value: Record<string, unknown>, key: \"challenge\" | \"session\"): { readonly message: Record<string, unknown>; readonly proof: unknown } {\n  const candidates: Record<string, unknown>[] = [value];\n  for (const wrapper of [\"data\", \"result\", \"body\", \"response\"] as const) {\n    if (isRecord(value[wrapper])) candidates.push(value[wrapper]);\n  }\n  for (const candidate of candidates) {\n    const message = candidate[key];\n    if (isRecord(message)) {\n      const proof = candidate.proof ?? value.proof ?? message.proof;\n      if (proof !== undefined) return { message, proof };\n    }\n  }\n  throw new ShareAccessError(\"SHARE_SESSION_INVALID\", `Node ${key} response is missing its proof`);\n}\n\nfunction canonicalValue(value: unknown): string {\n  if (value === null || typeof value === \"string\" || typeof value === \"boolean\") return JSON.stringify(value);\n  if (typeof value === \"number\" && Number.isFinite(value)) return JSON.stringify(value);\n  if (Array.isArray(value)) return `[${value.map(canonicalValue).join(\",\")}]`;\n  if (isRecord(value)) return `{${Object.keys(value).sort().map((key) => `${JSON.stringify(key)}:${canonicalValue(value[key])}`).join(\",\")}}`;\n  throw new ShareAccessError(\"SHARE_SESSION_INVALID\");\n}\n\nfunction compareBoundValue(left: unknown, right: unknown, message: string): void {\n  if (left !== undefined && right !== undefined && canonicalValue(left) !== canonicalValue(right)) {\n    throw new ShareAccessError(\"SHARE_SESSION_INVALID\", message);\n  }\n}\n\nfunction dateValue(value: unknown): number | undefined {\n  if (typeof value !== \"string\") return undefined;\n  const parsed = Date.parse(value);\n  return Number.isFinite(parsed) ? parsed : undefined;\n}\n\nfunction assertObjectKeys(value: Record<string, unknown>, allowed: readonly string[], label: string): void {\n  const keys = new Set(allowed);\n  if (Object.keys(value).some((key) => !keys.has(key))) throw new ShareAccessError(\"SHARE_SESSION_INVALID\", `${label} contains an unknown field`);\n}\n\nfunction isBearerEnvelope(envelope: ShareEnvelopeV2): boolean {\n  // Missing recipientKind is retained for old bearer artifacts. New policy\n  // artifacts always carry the non-PII discriminator.\n  return envelope.recipientKind === \"bearer\" || (envelope.recipientKind === undefined && envelope.encrypted && (envelope.authorizationTargetKind === undefined || envelope.authorizationTargetKind === \"bearerKey\"));\n}\n\nfunction nativeInvoke(session: ServiceSession, _service: string, _path: string, _action: string): ServiceHeaders {\n  const authorization = session.delegationHeader?.Authorization;\n  if (typeof authorization !== \"string\" || authorization.length === 0) throw new ShareAccessError(\"SHARE_SESSION_REQUIRED\");\n  return { Authorization: authorization };\n}\n\nexport class ShareRecipientClient {\n  private readonly fetchFn: FetchFunction;\n  private readonly cache: ShareCache;\n  private readonly now: () => Date;\n\n  constructor(private readonly options: ShareRecipientClientOptions) {\n    this.fetchFn = options.fetch ?? (globalThis.fetch.bind(globalThis) as FetchFunction);\n    this.cache = options.cache ?? new MemoryShareCache();\n    this.now = options.now ?? (() => new Date());\n  }\n\n  async open(link: string): Promise<ShareAccessV2> {\n    try {\n      const resolved = await this.resolve(link);\n      const { envelope } = resolved.artifact;\n      const { location } = resolved;\n      const bearer = isBearerEnvelope(envelope);\n      const policy = envelope.recipientKind === \"exactEmail\" || envelope.recipientKind === \"emailDomain\" || envelope.authorizationTargetKind === \"recipientDid\";\n      const legacyBearer = !policy && envelope.recipientKind === undefined;\n      let recipientDidSession: SharePolicySession | undefined;\n      if (envelope.authorizationTargetKind === \"recipientDid\") {\n        if (this.options.establishRecipientDidSession === undefined) throw new ShareAccessError(\"SHARE_DEVICE_AUTH_REQUIRED\", \"an OpenKey device authorization is required\");\n        const authorization = await this.options.establishRecipientDidSession({ envelope, recipientDid: envelope.recipient?.kind === \"recipientDid\" ? envelope.recipient.value : \"\" });\n        if (\"state\" in authorization) {\n          if (authorization.state === \"authorization-required\") throw new ShareAccessError(\"SHARE_DEVICE_AUTH_REQUIRED\", \"an OpenKey device authorization is required\", authorization);\n          throw new ShareAccessError(\"SHARE_DENIED\", \"recipient DID authorization was denied\", authorization);\n        }\n        recipientDidSession = authorization;\n      }\n      if (policy && this.options.bearerSession !== undefined) throw new ShareAccessError(\"SHARE_POLICY_BEARER_MISMATCH\");\n      if (bearer && this.options.presentation !== undefined) throw new ShareAccessError(\"SHARE_BEARER_PRESENTATION_MISMATCH\");\n\n      const session = bearer || legacyBearer\n        ? this.options.bearerSession\n        : recipientDidSession\n          ? recipientDidSession\n        : policy && this.options.establishPolicySession !== undefined\n          ? await this.options.establishPolicySession({ envelope, presentation: this.options.presentation })\n          : policy ? await this.establishPolicySession(envelope) : undefined;\n      const kv = bearer || legacyBearer\n        ? session === undefined ? undefined : this.createKV(envelope.origin, session as ServiceSession)\n        : undefined;\n      const policySession = policy ? session as SharePolicySession | undefined : undefined;\n      if (policySession !== undefined) this.assertProvidedPolicySession(policySession, envelope);\n      const advertisedCapability: ShareCapabilityLike = { spaceId: envelope.spaceId, resource: envelope.resource, actions: envelope.actions };\n      const capability = policySession?.capability === undefined\n        ? advertisedCapability\n        : intersectShareCapabilities(advertisedCapability, policySession.capability);\n      if (capability === undefined) throw new ShareAccessError(\"SHARE_CAPABILITY_EMPTY\");\n\n      const get = async (path = envelope.resource.kind === \"exact\" ? envelope.resource.path : \"\"): Promise<ShareReadResult> => {\n        try {\n          const resolvedPath = normalizePath(path);\n          this.assertAllowed(capability, \"get\", resolvedPath);\n          if (kv !== undefined) {\n            const result = await kv.get<Uint8Array>(resolvedPath, { binary: true, maxResponseBytes: this.options.maxContentBytes ?? DEFAULT_MAX_CONTENT_BYTES });\n            if (!result.ok) throw result.error;\n            return { bytes: result.data.data, etag: result.data.headers.etag, contentType: result.data.headers.contentType, size: result.data.data.byteLength };\n          }\n          if (policySession !== undefined) return this.nativeGet(envelope, policySession, resolvedPath);\n          if (policy || envelope.resource.kind !== \"exact\" || resolvedPath !== envelope.resource.path) throw new ShareAccessError(\"SHARE_SESSION_REQUIRED\");\n          return { bytes: resolved.plaintext.slice(), contentType: envelope.content.mimeType, size: resolved.plaintext.byteLength };\n        } catch (error) {\n          throw asError(error);\n        }\n      };\n\n      const listChildren = async (input: { readonly path?: string; readonly limit?: number; readonly cursor?: string } = {}): Promise<ShareListResult> => {\n        try {\n          const scope = normalizePath(input.path ?? envelope.resource.path);\n          this.assertAllowed(capability, \"list\", scope);\n          if (kv === undefined && policySession === undefined) throw new ShareAccessError(\"SHARE_SESSION_REQUIRED\");\n          if (policySession !== undefined) return this.nativeList(envelope, policySession, scope, input.limit, input.cursor);\n          const result = await kv!.list({ path: scope, limit: input.limit, cursor: input.cursor });\n          if (!result.ok) throw result.error;\n          // Node is authoritative for direct-child filtering and pagination.\n          return { keys: result.data.keys, truncated: result.data.truncated, nextCursor: result.data.nextCursor };\n        } catch (error) {\n          throw asError(error);\n        }\n      };\n\n      const save = async (path: string, bytes: Uint8Array, input: { readonly etag: string; readonly contentType?: string }): Promise<{ readonly etag?: string }> => {\n        try {\n          const resolvedPath = normalizePath(path);\n          this.assertAllowed(capability, \"save\", resolvedPath);\n          if (kv === undefined && policySession === undefined) throw new ShareAccessError(\"SHARE_SESSION_REQUIRED\");\n          if (policySession !== undefined) return this.nativeSave(envelope, policySession, resolvedPath, bytes, input);\n          const result = await kv!.put(resolvedPath, bytes, { contentType: input.contentType ?? envelope.content.mimeType, ifMatch: input.etag });\n          if (!result.ok) {\n            if (result.error.code === ErrorCodes.KV_PRECONDITION_FAILED || result.error.code === ErrorCodes.KV_CONFLICT) throw new ShareConflict(resolvedPath, result.error.meta?.etag as string | undefined);\n            throw result.error;\n          }\n          return { etag: result.data.headers.etag };\n        } catch (error) {\n          if (error instanceof ShareConflict) throw error;\n          throw asError(error);\n        }\n      };\n\n      const metadata = async (path = envelope.resource.kind === \"exact\" ? envelope.resource.path : \"\"): Promise<ShareMetadataResult> => {\n        const resolvedPath = normalizePath(path);\n        this.assertAllowed(capability, \"metadata\", resolvedPath);\n        if (policySession !== undefined) return this.nativeMetadata(envelope, policySession, resolvedPath);\n        if (kv === undefined) throw new ShareAccessError(\"SHARE_SESSION_REQUIRED\");\n        const result = await kv.head(resolvedPath);\n        if (!result.ok) throw result.error;\n        return { metadata: { \"content-type\": result.data.headers.contentType ?? \"application/octet-stream\", \"content-length\": String(result.data.headers.contentLength ?? \"\"), ...(result.data.headers.lastModified === undefined ? {} : { \"last-modified\": result.data.headers.lastModified }) }, etag: result.data.headers.etag, contentType: result.data.headers.contentType, size: result.data.headers.contentLength };\n      };\n\n      return { kind: \"share-v2\", envelope, location: { ...location, key: undefined }, resource: envelope.resource, actions: envelope.actions, expiresAt: new Date(envelope.expiresAt), kv, get, listChildren, save, metadata };\n    } catch (error) {\n      throw asError(error);\n    }\n  }\n\n  private createKV(origin: string, session: ServiceSession): IKVService {\n    if (this.options.createKVService !== undefined) {\n      return this.options.createKVService({ hosts: [origin], session, invoke: this.options.invoke ?? nativeInvoke, fetch: this.fetchFn });\n    }\n    const context = new ServiceContext({ hosts: [origin], session, invoke: this.options.invoke ?? nativeInvoke, fetch: this.fetchFn });\n    const service = new KVService({ prefix: \"\" });\n    context.registerService(\"kv\", service);\n    service.initialize(context);\n    return service;\n  }\n\n  private async nativeGet(envelope: ShareEnvelopeV2, session: SharePolicySession, path: string): Promise<ShareReadResult> {\n    this.assertNativeRequestBounds(envelope, session, \"get\", path);\n    const result = await this.invokeNative({ envelope, session, action: \"get\", resource: path, mediaType: \"application/vnd.tinycloud.share+json\" });\n    if (result.status === 404) throw new ShareAccessError(\"SHARE_NOT_FOUND\");\n    if (result.status === 401 || result.status === 403) throw new ShareAccessError(\"SHARE_DENIED\");\n    if (!isNativeSuccess(result)) throw new ShareAccessError(\"SHARE_READ_FAILED\");\n    if (result.status < 200 || result.status >= 300 || result.bytes === undefined) throw new ShareAccessError(\"SHARE_READ_FAILED\");\n    this.verifyNativeResponse(result.bytes, result.headers, result.bodyDigest);\n    if (result.bytes.byteLength > (this.options.maxContentBytes ?? DEFAULT_MAX_CONTENT_BYTES)) throw new ShareAccessError(\"SHARE_TOO_LARGE\");\n    return { bytes: result.bytes, etag: result.headers?.etag ?? result.etag, contentType: result.headers?.[\"content-type\"] ?? result.contentType ?? envelope.content.mimeType, size: result.bytes.byteLength };\n  }\n\n  private async nativeMetadata(envelope: ShareEnvelopeV2, session: SharePolicySession, path: string): Promise<ShareMetadataResult> {\n    this.assertNativeRequestBounds(envelope, session, \"metadata\", path);\n    const result = await this.invokeNative({ envelope, session, action: \"metadata\", resource: path, mediaType: \"application/vnd.tinycloud.share+json\" });\n    if (result.status === 404) throw new ShareAccessError(\"SHARE_NOT_FOUND\");\n    if (result.status === 401 || result.status === 403) throw new ShareAccessError(\"SHARE_DENIED\");\n    if (!isNativeSuccess(result) || result.metadata === undefined) throw new ShareAccessError(\"SHARE_READ_FAILED\");\n    return { metadata: result.metadata, etag: result.headers?.etag ?? result.etag, contentType: result.headers?.[\"content-type\"] ?? result.contentType };\n  }\n\n  private async nativeList(envelope: ShareEnvelopeV2, session: SharePolicySession, path: string, limit?: number, cursor?: string): Promise<ShareListResult> {\n    this.assertNativeRequestBounds(envelope, session, \"list\", path, limit, cursor);\n    const result = await this.invokeNative({ envelope, session, action: \"list\", resource: path, limit, cursor, mediaType: \"application/vnd.tinycloud.share+json\" });\n    if (result.status === 401 || result.status === 403) throw new ShareAccessError(\"SHARE_DENIED\");\n    if (result.status < 200 || result.status >= 300) throw new ShareAccessError(\"SHARE_LIST_FAILED\");\n    if (!isNativeSuccess(result)) throw new ShareAccessError(\"SHARE_LIST_FAILED\");\n    const keys = result.keys ?? result.entries?.map((entry) => entry.path);\n    if (keys === undefined) throw new ShareAccessError(\"SHARE_LIST_FAILED\");\n    const headerCursor = result.headers?.[\"x-tinycloud-next-cursor\"];\n    if (headerCursor !== undefined && result.nextCursor !== undefined && headerCursor !== result.nextCursor) throw new ShareAccessError(\"SHARE_RESPONSE_INTEGRITY\");\n    this.assertNativeListResult(path, { ...result, keys });\n    return { keys, entries: result.entries, truncated: result.truncated, nextCursor: result.nextCursor };\n  }\n\n  private async nativeSave(envelope: ShareEnvelopeV2, session: SharePolicySession, path: string, bytes: Uint8Array, input: { readonly etag: string; readonly contentType?: string }): Promise<{ readonly etag?: string }> {\n    this.assertNativeRequestBounds(envelope, session, \"put\", path);\n    if (bytes.byteLength > (this.options.maxContentBytes ?? DEFAULT_MAX_CONTENT_BYTES)) throw new ShareAccessError(\"SHARE_TOO_LARGE\");\n    const contentType = input.contentType ?? envelope.content.mimeType;\n    if (contentType !== envelope.content.mimeType && !/^text\\/(?:plain|markdown)(?:;|$)/i.test(contentType)) throw new ShareAccessError(\"SHARE_CONTENT_TYPE_INVALID\");\n    const result = await this.invokeNative({ envelope, session, action: \"put\", resource: path, body: bytes, bodyDigest: bytesToBase64Url(sha256(bytes)), contentType, ifMatch: input.etag, mediaType: \"application/vnd.tinycloud.share+json\" });\n    if (result.status === 412 || result.status === 409) throw new ShareConflict(path, result.headers?.etag);\n    if (result.status === 401 || result.status === 403) throw new ShareAccessError(\"SHARE_DENIED\");\n    if (result.status < 200 || result.status >= 300) throw new ShareAccessError(\"SHARE_WRITE_FAILED\");\n    if (!isNativeSuccess(result)) throw new ShareAccessError(\"SHARE_WRITE_FAILED\");\n    return { etag: result.headers?.etag ?? result.etag };\n  }\n\n  private async invokeNative(input: Parameters<NonNullable<ShareRecipientClientOptions[\"nativeInvoke\"]>>[0]): Promise<ShareNativeInvokeResult> {\n    if (this.options.nativeInvoke !== undefined) {\n      const result = await this.options.nativeInvoke(input);\n      if (!Number.isSafeInteger(result.status) || result.status < 100 || result.status > 599) throw new ShareAccessError(\"SHARE_RESPONSE_INVALID\");\n      if (result.status >= 200 && result.status < 300) this.validateNativeResult(input, result);\n      return result;\n    }\n    const base = input.envelope.origin.replace(/\\/$/, \"\");\n    if (input.mediaType !== NATIVE_MEDIA_TYPE) throw new ShareAccessError(\"SHARE_NATIVE_MEDIA_TYPE_INVALID\");\n    const session = input.session;\n    const binding = this.options.policyBinding;\n    const v2 = session.version === 2 || binding?.registrationCid !== undefined;\n    const required = (value: unknown, name: string): string => {\n      if (typeof value !== \"string\" || value.length === 0) throw new ShareAccessError(\"SHARE_SESSION_INVALID\", `Node session ${name} is missing`);\n      return value;\n    };\n    const contentSource = session.contentSource ?? binding?.contentSource;\n    if (!isRecord(contentSource)) throw new ShareAccessError(\"SHARE_SESSION_INVALID\", \"Node content source is missing\");\n    const now = this.now().getTime();\n    const expiry = Math.min(\n      now + READ_TTL_MS,\n      dateValue(session.expiresAt) ?? now,\n      dateValue(input.envelope.expiresAt) ?? now,\n    );\n    if (!Number.isFinite(expiry) || expiry <= now) throw new ShareAccessError(\"SHARE_SESSION_INVALID\", \"Node read expiry is invalid\");\n    const selectedAction = actionWire(input.action);\n    const actionClaims = session.actions !== undefined\n      ? session.actions\n      : binding?.actions !== undefined\n        ? binding.actions\n        : session.action !== undefined\n          ? [session.action]\n          : binding?.action !== undefined\n            ? [binding.action]\n            : [];\n    const authorizedActions = canonicalNativeActions(actionClaims);\n    if (!authorizedActions.includes(selectedAction)) throw new ShareAccessError(\"SHARE_SESSION_ACTION_MISMATCH\");\n    const signedResource = resourceValue(session.resource ?? binding?.resource ?? input.envelope.resource, input.envelope.resource.kind);\n    if (signedResource === undefined || !shareCapabilityAllows({ spaceId: input.envelope.spaceId, resource: signedResource, actions: [policyActionFor(selectedAction)!] }, policyActionFor(selectedAction)!, input.resource)) {\n      throw new ShareAccessError(\"SHARE_OUT_OF_SCOPE\");\n    }\n    const invocationBase: Record<string, unknown> = {\n      type: \"TinyCloudShareReadInvocation\",\n      version: 2,\n      sessionId: required(session.sessionId, \"sessionId\"),\n      shareCid: required(session.shareCid ?? binding?.shareCid, \"shareCid\"),\n      shareId: required(session.shareId ?? binding?.shareId, \"shareId\"),\n      delegationCid: required(session.delegationCid ?? binding?.delegationCid, \"delegationCid\"),\n      policyCid: required(session.policyCid ?? binding?.policyCid, \"policyCid\"),\n      ...(v2 ? {\n        envelopeCid: required(session.envelopeCid ?? binding?.envelopeCid, \"envelopeCid\"),\n        registrationCid: required(session.registrationCid ?? binding?.registrationCid, \"registrationCid\"),\n        enforcementDelegationCid: required(session.enforcementDelegationCid ?? binding?.enforcementDelegationCid, \"enforcementDelegationCid\"),\n      } : {\n        authorityMaterialHandle: required(session.authorityMaterialHandle ?? binding?.authorityMaterialHandle, \"authorityMaterialHandle\"),\n        authorityMaterialDigest: required(session.authorityMaterialDigest ?? binding?.authorityMaterialDigest, \"authorityMaterialDigest\"),\n      }),\n      contentSource,\n      contentSourceDigest: required(session.contentSourceDigest ?? binding?.contentSourceDigest, \"contentSourceDigest\"),\n      holderDid: required(session.holderDid, \"holderDid\"),\n      ...(v2 ? {} : { targetOrigin: required(session.targetOrigin ?? binding?.targetOrigin ?? input.envelope.origin, \"targetOrigin\") }),\n      nodeAudience: required(session.nodeAudience ?? binding?.nodeAudience, \"nodeAudience\"),\n      action: selectedAction,\n      actions: authorizedActions,\n      resource: input.resource,\n      issuedAt: new Date(now).toISOString(),\n      expiresAt: new Date(expiry).toISOString(),\n      jti: randomJti(),\n      ...(input.bodyDigest === undefined ? {} : { bodyDigest: input.bodyDigest }),\n      ...(input.ifMatch === undefined ? {} : { ifMatch: input.ifMatch }),\n      ...(input.contentType === undefined ? {} : { contentType: input.contentType }),\n      ...(v2 ? {} : { ...(input.limit === undefined ? {} : { limit: input.limit }), ...(input.cursor === undefined ? {} : { cursor: input.cursor }), ...(session.expiryMin ?? binding?.expiryMin) === undefined ? {} : { expiryMin: session.expiryMin ?? binding?.expiryMin }, ...(session.expiryMax ?? binding?.expiryMax) === undefined ? {} : { expiryMax: session.expiryMax ?? binding?.expiryMax } }),\n    };\n    const requestBodyDigest = digestCanonical(invocationBase);\n    const invocation: Record<string, unknown> = { ...invocationBase, requestBodyDigest };\n    const signer = this.options.holderSigner ?? session.holderSigner;\n    if (signer === undefined) throw new ShareAccessError(\"SHARE_NATIVE_SIGNER_REQUIRED\");\n    const proof = await signer({ domain: v2 ? READ_INVOCATION_DOMAIN_V2 : READ_INVOCATION_DOMAIN_V1, message: invocation });\n    this.assertDetachedProof(proof);\n    const request: Record<string, unknown> = v2\n      ? {\n        sessionId: invocation.sessionId,\n        envelopeCid: invocation.envelopeCid,\n        shareCid: invocation.shareCid,\n        shareId: invocation.shareId,\n        registrationCid: invocation.registrationCid,\n        delegationCid: invocation.delegationCid,\n        policyCid: invocation.policyCid,\n        enforcementDelegationCid: invocation.enforcementDelegationCid,\n        contentSource,\n        contentSourceDigest: invocation.contentSourceDigest,\n        holderDid: invocation.holderDid,\n        nodeAudience: invocation.nodeAudience,\n        action: invocation.action,\n        actions: invocation.actions,\n        resource: invocation.resource,\n        requestBodyDigest,\n        invocation,\n        proof,\n      }\n      : {\n        sessionId: invocation.sessionId,\n        delegationCid: invocation.delegationCid,\n        authorityMaterialHandle: invocation.authorityMaterialHandle,\n        authorityMaterialDigest: invocation.authorityMaterialDigest,\n        contentSource,\n        contentSourceDigest: invocation.contentSourceDigest,\n        action: invocation.action,\n        actions: invocation.actions,\n        resource: invocation.resource,\n        requestBodyDigest,\n        invocation,\n        proof,\n      };\n    const body = {\n      request,\n      ...(input.limit === undefined ? {} : { limit: input.limit }),\n      ...(input.cursor === undefined ? {} : { cursor: input.cursor }),\n      ...(input.body === undefined ? {} : { body: bytesToBase64Url(input.body) }),\n      ...(input.bodyDigest === undefined ? {} : { bodyDigest: input.bodyDigest }),\n      ...(input.ifMatch === undefined ? {} : { ifMatch: input.ifMatch }),\n      ...(input.contentType === undefined ? {} : { contentType: input.contentType }),\n    };\n    const signed = this.options.signNativeInvoke === undefined\n      ? undefined\n      : await this.options.signNativeInvoke({ envelope: input.envelope, session: input.session, request: body });\n    const transport = this.options.invoke !== undefined || session.authorization !== undefined || session.delegationHeader !== undefined\n      ? this.defaultNativeHeaders(session, input.action, input.resource, body)\n      : undefined;\n    const response = await this.fetchFn(v2 ? `${base}/share/v2/invoke` : `${base}/invoke`, {\n      method: \"POST\",\n      headers: { ...headersRecord(transport), ...headersRecord(signed), \"content-type\": input.mediaType, accept: input.mediaType },\n      body: JSON.stringify(body),\n      redirect: \"error\",\n    });\n    if ((response as unknown as { readonly redirected?: boolean }).redirected === true || response.status >= 300 && response.status < 400) throw new ShareAccessError(\"SHARE_REDIRECT_REJECTED\");\n    const headers: Record<string, string> = {};\n    for (const name of [\"etag\", \"content-type\", \"content-digest\", \"x-tinycloud-content-digest\", \"x-tinycloud-cid\", \"x-tinycloud-content-cid\", \"x-tinycloud-next-cursor\"]) {\n      const value = response.headers.get(name);\n      if (value !== null) headers[name] = value;\n    }\n    if (response.status < 200 || response.status >= 300) return { status: response.status, headers };\n    const contentType = response.headers.get(\"content-type\") ?? \"\";\n    if (!contentType.toLowerCase().includes(\"json\")) throw new ShareAccessError(\"SHARE_RESPONSE_INVALID\");\n    let value: unknown;\n    let responseBytes: Uint8Array;\n    try { responseBytes = new Uint8Array(await response.arrayBuffer()); } catch { throw new ShareAccessError(\"SHARE_RESPONSE_INVALID\"); }\n    if (responseBytes.byteLength > (this.options.maxArtifactBytes ?? DEFAULT_MAX_ARTIFACT_BYTES)) throw new ShareAccessError(\"SHARE_TOO_LARGE\");\n    try { value = JSON.parse(new TextDecoder(\"utf-8\", { fatal: true }).decode(responseBytes)); } catch { throw new ShareAccessError(\"SHARE_RESPONSE_INVALID\"); }\n    const parsed = ShareNativeResponseSchema.safeParse(value);\n    if (!parsed.success) throw new ShareAccessError(\"SHARE_RESPONSE_INVALID\");\n    const record = parsed.data as NativeResponseRecord;\n    const expectedAction = actionWire(input.action) as ShareNativeAction;\n    if (record.action !== expectedAction || record.version !== 2 || record.resource !== input.resource) {\n      throw new ShareAccessError(\"SHARE_RESPONSE_MISMATCH\");\n    }\n    if (record.etag !== undefined && record.etag !== null && headers.etag !== undefined && record.etag !== headers.etag) throw new ShareAccessError(\"SHARE_RESPONSE_INTEGRITY\");\n    if (record.etag !== undefined && record.etag !== null) headers.etag = record.etag;\n    if (input.action === \"list\") {\n      if (record.entries === undefined) throw new ShareAccessError(\"SHARE_RESPONSE_INVALID\");\n      const rawEntries = record.entries;\n      if (rawEntries.length > MAX_NATIVE_ENTRIES) throw new ShareAccessError(\"SHARE_TOO_LARGE\");\n      const entries: ShareListEntry[] = [...rawEntries];\n      const headerCursor = response.headers.get(\"x-tinycloud-next-cursor\");\n      if (record.nextCursor !== undefined && record.nextCursor !== null && headerCursor !== null && record.nextCursor !== headerCursor) throw new ShareAccessError(\"SHARE_RESPONSE_INTEGRITY\");\n      const nextCursor = (record.nextCursor ?? headerCursor) ?? undefined;\n      if (nextCursor !== undefined && new TextEncoder().encode(nextCursor).byteLength > MAX_NATIVE_CURSOR_BYTES) throw new ShareAccessError(\"SHARE_TOO_LARGE\");\n      return { status: response.status, headers, type: record.type, version: record.version, action: record.action, resource: record.resource, keys: entries.map((entry) => entry.path), entries, truncated: nextCursor !== undefined, nextCursor };\n    }\n    if (input.action === \"get\") {\n      if (record.content === undefined || record.bodyDigest === undefined) throw new ShareAccessError(\"SHARE_RESPONSE_INVALID\");\n      let bytes: Uint8Array;\n      try { bytes = base64UrlToBytes(record.content); } catch { throw new ShareAccessError(\"SHARE_RESPONSE_INVALID\"); }\n      if (bytes.byteLength > (this.options.maxContentBytes ?? DEFAULT_MAX_CONTENT_BYTES) || !this.digestMatches(record.bodyDigest, bytes)) throw new ShareAccessError(\"SHARE_RESPONSE_INTEGRITY\");\n      return { status: response.status, headers, bytes, bodyDigest: record.bodyDigest, type: record.type, version: record.version, action: record.action, resource: record.resource };\n    }\n    if (input.action === \"metadata\") {\n      if (record.metadata === undefined) throw new ShareAccessError(\"SHARE_RESPONSE_INVALID\");\n      return { status: response.status, headers, metadata: record.metadata, etag: record.etag ?? undefined, type: record.type, version: record.version, action: record.action, resource: record.resource };\n    }\n    const responseEtag = record.etag;\n    const responseBodyDigest = record.bodyDigest;\n    if (responseEtag === undefined || responseEtag === null || responseEtag.length === 0 || headers.etag !== undefined && responseEtag !== headers.etag) throw new ShareAccessError(\"SHARE_RESPONSE_INVALID\");\n    if (input.bodyDigest === undefined || responseBodyDigest === undefined || responseBodyDigest !== input.bodyDigest || !this.digestMatches(responseBodyDigest, input.body ?? new Uint8Array())) throw new ShareAccessError(\"SHARE_RESPONSE_INTEGRITY\");\n    return { status: response.status, headers, bodyDigest: responseBodyDigest, type: record.type, version: record.version, action: record.action, resource: record.resource };\n  }\n\n  private validateNativeResult(input: Parameters<NonNullable<ShareRecipientClientOptions[\"nativeInvoke\"]>>[0], result: ShareNativeInvokeResult): void {\n    if (!isNativeSuccess(result)) throw new ShareAccessError(\"SHARE_RESPONSE_MISMATCH\");\n    if (result.type !== \"TinyCloudShareInvokeResponse\" || result.version !== 2 || result.action !== actionWire(input.action) || result.resource !== input.resource) throw new ShareAccessError(\"SHARE_RESPONSE_MISMATCH\");\n    if (input.action === \"get\") {\n      if (result.bytes === undefined || result.bodyDigest === undefined || !this.digestMatches(result.bodyDigest, result.bytes)) throw new ShareAccessError(\"SHARE_RESPONSE_INTEGRITY\");\n      if (result.bytes.byteLength > (this.options.maxContentBytes ?? DEFAULT_MAX_CONTENT_BYTES)) throw new ShareAccessError(\"SHARE_TOO_LARGE\");\n    }\n    if (input.action === \"metadata\" && result.metadata === undefined) throw new ShareAccessError(\"SHARE_RESPONSE_INVALID\");\n    if (input.action === \"list\") this.assertNativeListResult(input.resource, result);\n    if (input.action === \"put\") {\n      const etag = result.headers?.etag ?? result.etag;\n      const bodyDigest = result.bodyDigest;\n      if (etag === undefined || etag.length === 0 || bodyDigest === undefined || bodyDigest !== input.bodyDigest || input.body === undefined || !this.digestMatches(bodyDigest, input.body)) throw new ShareAccessError(\"SHARE_RESPONSE_INTEGRITY\");\n    }\n  }\n\n  private assertNativeListResult(scope: string, result: ShareNativeInvokeResult): void {\n    if (!isNativeSuccess(result)) throw new ShareAccessError(\"SHARE_LIST_FAILED\");\n    if (result.keys === undefined || result.entries === undefined || result.keys.length > MAX_NATIVE_ENTRIES || result.entries.length !== result.keys.length || result.nextCursor !== undefined && new TextEncoder().encode(result.nextCursor).byteLength > MAX_NATIVE_CURSOR_BYTES) throw new ShareAccessError(\"SHARE_LIST_FAILED\");\n    if (result.entries.some((entry, index) => !isRecord(entry) || typeof entry.path !== \"string\" || (entry.kind !== \"file\" && entry.kind !== \"folder\") || entry.path !== result.keys![index])) throw new ShareAccessError(\"SHARE_RESPONSE_INVALID\");\n    const seen = new Set<string>();\n    for (const entry of result.entries) {\n      normalizePath(entry.path);\n      if (seen.has(entry.path)) throw new ShareAccessError(\"SHARE_RESPONSE_INVALID\");\n      seen.add(entry.path);\n      const prefix = scope.replace(/\\/$/, \"\");\n      const relative = entry.path === prefix ? \"\" : entry.path.startsWith(`${prefix}/`) ? entry.path.slice(prefix.length + 1) : undefined;\n      if (relative === undefined || relative.length === 0 || relative.includes(\"/\")) throw new ShareAccessError(\"SHARE_RESPONSE_MISMATCH\");\n    }\n  }\n\n  private assertDetachedProof(value: unknown): asserts value is ShareDetachedProof {\n    const proof = this.requireObject(value, \"holder proof\");\n    assertObjectKeys(proof, [\"alg\", \"kid\", \"signature\"], \"holder proof\");\n    if (proof.alg !== \"EdDSA\" || typeof proof.kid !== \"string\" || typeof proof.signature !== \"string\" || !/^[A-Za-z0-9_-]{86}$/.test(proof.signature)) {\n      throw new ShareAccessError(\"SHARE_NATIVE_PROOF_INVALID\");\n    }\n  }\n\n  private defaultNativeHeaders(session: SharePolicySession, action: \"get\" | \"metadata\" | \"list\" | \"put\", resource: string, request: Record<string, unknown>): ServiceHeaders {\n    const authorization = typeof session.authorization === \"string\"\n      ? session.authorization\n      : isRecord(session.delegationHeader) && typeof session.delegationHeader.Authorization === \"string\"\n        ? session.delegationHeader.Authorization\n        : undefined;\n    const invokeSession = {\n      delegationHeader: { Authorization: authorization ?? \"\" },\n      delegationCid: typeof session.delegationCid === \"string\" ? session.delegationCid : session.sessionId,\n      spaceId: typeof session.spaceId === \"string\" ? session.spaceId : \"share\",\n      verificationMethod: typeof session.verificationMethod === \"string\" ? session.verificationMethod : session.holderDid,\n      jwk: isRecord(session.jwk) ? session.jwk : {},\n    } as ServiceSession;\n    if (this.options.invoke === undefined) {\n      if (authorization === undefined) throw new ShareAccessError(\"SHARE_NATIVE_INVOKE_REQUIRED\");\n      return { Authorization: authorization };\n    }\n    return this.options.invoke(invokeSession, \"share\", resource, `tinycloud.share/${action}`, [{\n      shareSessionId: session.sessionId,\n      shareRequest: request,\n    }]);\n  }\n\n  private digestMatches(value: string, bytes: Uint8Array): boolean {\n    const digest = bytesToBase64Url(sha256(bytes));\n    return value === digest || value === `sha-256=:${digest}:`;\n  }\n\n  private assertNativeRequestBounds(envelope: ShareEnvelopeV2, session: SharePolicySession, operation: \"get\" | \"metadata\" | \"list\" | \"put\", path: string, limit?: number, cursor?: string): void {\n    const binding = this.options.policyBinding;\n    const signedResource = resourceValue(session.resource ?? binding?.resource ?? envelope.resource, envelope.resource.kind);\n    const nativeAction = actionWire(operation);\n    const policyAction = policyActionFor(nativeAction);\n    if (signedResource === undefined || policyAction === undefined || !shareCapabilityAllows({ spaceId: envelope.spaceId, resource: signedResource, actions: [policyAction] }, policyAction, path)) throw new ShareAccessError(\"SHARE_OUT_OF_SCOPE\");\n    const claims = session.actions ?? binding?.actions ?? (session.action !== undefined ? [session.action] : binding?.action !== undefined ? [binding.action] : []);\n    if (claims.length === 0 || !canonicalNativeActions(claims).includes(nativeAction)) throw new ShareAccessError(\"SHARE_SESSION_ACTION_MISMATCH\");\n    if (limit !== undefined && (!Number.isSafeInteger(limit) || limit < 1 || limit > MAX_NATIVE_LIMIT)) throw new ShareAccessError(\"SHARE_INVALID_LIMIT\");\n    if (cursor !== undefined && (cursor.length === 0 || new TextEncoder().encode(cursor).byteLength > MAX_NATIVE_CURSOR_BYTES)) throw new ShareAccessError(\"SHARE_INVALID_CURSOR\");\n  }\n\n  private verifyNativeResponse(bytes: Uint8Array, headers: Readonly<Record<string, string | undefined>> | undefined, bodyDigest?: string): void {\n    if (bodyDigest !== undefined && !this.digestMatches(bodyDigest, bytes)) throw new ShareAccessError(\"SHARE_RESPONSE_INTEGRITY\");\n    const digest = headers?.[\"x-tinycloud-content-digest\"] ?? headers?.[\"content-digest\"];\n    if (digest !== undefined && !this.digestMatches(digest, bytes)) {\n      throw new ShareAccessError(\"SHARE_RESPONSE_INTEGRITY\");\n    }\n    const cid = headers?.[\"x-tinycloud-content-cid\"] ?? headers?.[\"x-tinycloud-cid\"];\n    if (cid !== undefined && !verifyPublishedShareCid(cid, bytes) && !verifyShareCid(cid, bytes)) throw new ShareAccessError(\"SHARE_RESPONSE_INTEGRITY\");\n  }\n\n  private async establishPolicySession(envelope: ShareEnvelopeV2): Promise<SharePolicySession> {\n    if (this.options.presentation === undefined) throw new ShareAccessError(\"SHARE_PRESENTATION_REQUIRED\");\n    const base = envelope.origin.replace(/\\/$/, \"\");\n    const presentation = this.options.presentation;\n    if (presentation === undefined || typeof presentation !== \"object\" || presentation === null) {\n      throw new ShareAccessError(\"SHARE_PRESENTATION_REQUIRED\");\n    }\n    const input = presentation as Record<string, unknown>;\n    const v2 = this.options.policyBinding?.registrationCid !== undefined || isRecord(input.challengeRequest) && input.challengeRequest.envelopeCid !== undefined;\n    const challengeUrl = this.options.policyRoutes?.challenge ?? `${base}/${v2 ? \"share/v2\" : \"share/v1\"}/policy/challenges`;\n    const sessionUrl = this.options.policyRoutes?.session ?? `${base}/${v2 ? \"share/v2\" : \"share/v1\"}/policy/session`;\n    const request = input.challengeRequest ?? this.buildChallengeRequest(envelope, input);\n    if (request === undefined || typeof request !== \"object\" || request === null || Array.isArray(request)) throw new ShareAccessError(\"SHARE_SESSION_INVALID\", \"a Node policy challenge request is required\");\n    if (this.options.policyBinding !== undefined) this.assertStrictChallengeRequest(request as Record<string, unknown>);\n    const challengeResponse = await this.postJson(challengeUrl, request);\n    const challengeEnvelope = unwrapProofResponse(challengeResponse, \"challenge\");\n    const challenge = challengeEnvelope.message;\n    this.verifyNodeProof(challenge, challengeEnvelope.proof, `xyz.tinycloud.share/policy-challenge/${v2 ? \"v2\" : \"v1\"}\\0`);\n    this.assertChallengeRequestBinding(request as Readonly<Record<string, unknown>>, challenge);\n    this.assertChallengeFresh(challenge);\n\n    const builder = this.options.buildPolicySessionRequest;\n    const sessionRequest = builder === undefined\n      ? await this.buildDefaultPolicySessionRequest(presentation, challenge)\n      : await builder({ envelope, challenge, challengeRequest: request as Readonly<Record<string, unknown>> });\n    if (sessionRequest === undefined || typeof sessionRequest !== \"object\" || sessionRequest === null || Array.isArray(sessionRequest)) throw new ShareAccessError(\"SHARE_SESSION_INVALID\", \"the policy session builder returned an invalid request\");\n    if (this.options.policyBinding !== undefined) this.assertStrictSessionRequest(sessionRequest as Record<string, unknown>, v2, challenge);\n    const sessionResponse = await this.postJson(sessionUrl, sessionRequest);\n    const sessionEnvelope = unwrapProofResponse(sessionResponse, \"session\");\n    const session = sessionEnvelope.message;\n    this.verifyNodeProof(session, sessionEnvelope.proof, `xyz.tinycloud.share/policy-session/${v2 ? \"v2\" : \"v1\"}\\0`);\n    this.assertSessionBinding(session, envelope, request, challenge, sessionRequest);\n    return {\n      ...(this.options.policyBinding ?? {}),\n      ...session,\n      sessionId: this.requiredString(session, \"sessionId\"),\n      ...(typeof session.shareCid === \"string\" ? { shareCid: session.shareCid } : {}),\n      ...(typeof session.shareId === \"string\" ? { shareId: session.shareId } : {}),\n      ...(typeof session.policyCid === \"string\" ? { policyCid: session.policyCid } : {}),\n      holderDid: this.requiredString(session, \"holderDid\"),\n      expiresAt: this.requiredString(session, \"expiresAt\"),\n      ...(session.capability !== undefined ? { capability: this.parseSessionCapability(session.capability) } : {}),\n      ...(this.options.policyBinding ?? {}),\n      ...(isRecord(sessionRequest) && typeof sessionRequest.credential === \"string\" ? { credential: sessionRequest.credential } : {}),\n      ...(isRecord(sessionRequest) && sessionRequest.holderBinding !== undefined ? { holderBinding: sessionRequest.holderBinding } : {}),\n      ...(isRecord(sessionRequest) && typeof sessionRequest.readSignerDid === \"string\" ? { readSignerDid: sessionRequest.readSignerDid } : {}),\n      ...(this.options.holderSigner === undefined ? {} : { holderSigner: this.options.holderSigner }),\n    };\n  }\n\n  private buildChallengeRequest(envelope: ShareEnvelopeV2, presentation: Record<string, unknown>): Record<string, unknown> {\n    const binding = this.options.policyBinding;\n    if (binding === undefined) throw new ShareAccessError(\"SHARE_SESSION_INVALID\", \"a Node policy challenge request is required\");\n    const required = (value: unknown, name: string): string => {\n      if (typeof value !== \"string\" || value.length === 0) throw new ShareAccessError(\"SHARE_SESSION_INVALID\", `Node challenge ${name} is missing`);\n      return value;\n    };\n    if (!isRecord(binding.enforcementDelegation) || !isRecord(binding.outerEnvelope)) throw new ShareAccessError(\"SHARE_SESSION_INVALID\", \"Node challenge authority material is missing\");\n    const holderDid = typeof presentation.holderDid === \"string\" ? presentation.holderDid : binding.holderDid;\n    if (holderDid === undefined) throw new ShareAccessError(\"SHARE_SESSION_INVALID\", \"the holder DID is required\");\n    const action = binding.action ?? binding.actions?.[0] ?? \"tinycloud.kv/get\";\n    const body: Record<string, unknown> = {\n      envelopeCid: required(binding.envelopeCid, \"envelopeCid\"),\n      shareCid: binding.shareCid,\n      shareId: binding.shareId,\n      registrationCid: required(binding.registrationCid, \"registrationCid\"),\n      delegationCid: binding.delegationCid,\n      policyCid: binding.policyCid,\n      enforcementDelegationCid: required(binding.enforcementDelegationCid, \"enforcementDelegationCid\"),\n      enforcementDelegation: binding.enforcementDelegation,\n      outerEnvelope: binding.outerEnvelope,\n      contentSource: binding.contentSource,\n      contentSourceDigest: binding.contentSourceDigest,\n      holderDid,\n      targetOrigin: binding.targetOrigin || envelope.origin,\n      nodeAudience: binding.nodeAudience,\n      action,\n      ...(binding.actions === undefined ? {} : { actions: [...binding.actions] }),\n      resource: binding.resource,\n    };\n    return { ...body, requestBodyDigest: digestCanonical(body) };\n  }\n\n  private assertStrictChallengeRequest(request: Record<string, unknown>): void {\n    const v2 = request.envelopeCid !== undefined || this.options.policyBinding?.registrationCid !== undefined;\n    const keys = v2\n      ? [\"envelopeCid\", \"shareCid\", \"shareId\", \"registrationCid\", \"delegationCid\", \"policyCid\", \"enforcementDelegationCid\", \"enforcementDelegation\", \"outerEnvelope\", \"contentSource\", \"contentSourceDigest\", \"holderDid\", \"targetOrigin\", \"nodeAudience\", \"action\", \"actions\", \"resource\", \"requestBodyDigest\"]\n      : [\"shareCid\", \"shareId\", \"delegationCid\", \"authorityMaterialHandle\", \"authorityMaterialDigest\", \"policyCid\", \"contentSource\", \"contentSourceDigest\", \"holderDid\", \"targetOrigin\", \"nodeAudience\", \"action\", \"actions\", \"resource\", \"expiryMin\", \"expiryMax\", \"requestBodyDigest\"];\n    assertObjectKeys(request, keys, \"Node challenge request\");\n    for (const key of v2 ? [\"envelopeCid\", \"shareCid\", \"shareId\", \"registrationCid\", \"delegationCid\", \"policyCid\", \"enforcementDelegationCid\", \"contentSourceDigest\", \"holderDid\", \"targetOrigin\", \"nodeAudience\", \"resource\", \"requestBodyDigest\"] : [\"shareCid\", \"shareId\", \"delegationCid\", \"authorityMaterialHandle\", \"authorityMaterialDigest\", \"policyCid\", \"contentSourceDigest\", \"holderDid\", \"targetOrigin\", \"nodeAudience\", \"resource\", \"requestBodyDigest\"]) {\n      if (typeof request[key] !== \"string\" || request[key].length === 0) throw new ShareAccessError(\"SHARE_SESSION_INVALID\", `Node challenge ${key} is invalid`);\n    }\n    if (!isRecord(request.contentSource) || typeof request.action !== \"string\") throw new ShareAccessError(\"SHARE_SESSION_INVALID\", \"Node challenge source is invalid\");\n    if (request.actions !== undefined && (!Array.isArray(request.actions) || request.actions.some((action) => typeof action !== \"string\"))) throw new ShareAccessError(\"SHARE_SESSION_INVALID\", \"Node challenge actions are invalid\");\n    if (request.expiryMin !== undefined && dateValue(request.expiryMin) === undefined || request.expiryMax !== undefined && dateValue(request.expiryMax) === undefined || dateValue(request.expiryMin) !== undefined && dateValue(request.expiryMax) !== undefined && dateValue(request.expiryMin)! > dateValue(request.expiryMax)!) throw new ShareAccessError(\"SHARE_SESSION_INVALID\", \"Node challenge expiry bounds are invalid\");\n    const { requestBodyDigest: _digest, ...body } = request;\n    if (request.requestBodyDigest !== digestCanonical(body)) throw new ShareAccessError(\"SHARE_SESSION_INVALID\", \"Node challenge digest is invalid\");\n  }\n\n  private assertStrictSessionRequest(request: Record<string, unknown>, v2: boolean, challenge: Record<string, unknown>): void {\n    const keys = v2\n      ? [\"challengeId\", \"nonce\", \"presentation\", \"credential\", \"proof\", \"holderBinding\", \"readSignerDid\"]\n      : [\"presentation\", \"credential\", \"proof\", \"holderBinding\", \"readSignerDid\"];\n    assertObjectKeys(request, keys, \"Node session request\");\n    if (v2 && (request.challengeId !== challenge.challengeId || request.nonce !== challenge.nonce)) throw new ShareAccessError(\"SHARE_SESSION_INVALID\", \"Node session challenge is not bound\");\n    if (!isRecord(request.presentation) || typeof request.credential !== \"string\" || request.credential.length === 0 || !isRecord(request.proof) || request.holderBinding === undefined || typeof request.readSignerDid !== \"string\") throw new ShareAccessError(\"SHARE_SESSION_INVALID\", \"Node session request is incomplete\");\n    this.assertDetachedProof(request.proof);\n  }\n\n  private parseSessionCapability(value: unknown): ShareCapabilityLike {\n    const object = this.requireObject(value, \"session capability\");\n    if (typeof object.spaceId !== \"string\") throw new ShareAccessError(\"SHARE_SESSION_INVALID\", \"session capability space is invalid\");\n    if (!Array.isArray(object.actions) || object.actions.some((action) => ![\"read\", \"list\", \"edit\"].includes(action as string))) throw new ShareAccessError(\"SHARE_SESSION_INVALID\", \"session capability actions are invalid\");\n    const resource = this.requireObject(object.resource, \"session capability resource\");\n    if ((resource.kind !== \"exact\" && resource.kind !== \"prefix\") || typeof resource.path !== \"string\") throw new ShareAccessError(\"SHARE_SESSION_INVALID\", \"session capability resource is invalid\");\n    return { spaceId: object.spaceId, actions: [...new Set(object.actions)] as ShareAction[], resource: { kind: resource.kind, path: resource.path } as ShareResource };\n  }\n\n  private assertProvidedPolicySession(session: SharePolicySession, envelope: ShareEnvelopeV2): void {\n    const sessionExpiry = dateValue(session.expiresAt);\n    if (typeof session.sessionId !== \"string\" || typeof session.holderDid !== \"string\" || session.resource === undefined || session.actions === undefined && session.action === undefined || sessionExpiry === undefined || sessionExpiry <= this.now().getTime() || sessionExpiry > (dateValue(envelope.expiresAt) ?? 0)) {\n      throw new ShareAccessError(\"SHARE_SESSION_INVALID\");\n    }\n    this.assertExpiryBounds(session, envelope, sessionExpiry);\n    if (isRecord(this.options.presentation)) {\n      const presentation = isRecord(this.options.presentation.presentation) ? this.options.presentation.presentation : this.options.presentation;\n      const presentedHolder = typeof presentation.holderDid === \"string\" ? presentation.holderDid : isRecord(presentation.holder) && typeof presentation.holder.did === \"string\" ? presentation.holder.did : undefined;\n      if (presentedHolder !== undefined && presentedHolder !== session.holderDid) throw new ShareAccessError(\"SHARE_SESSION_INVALID\", \"Node session holder is not bound to the presentation\");\n    }\n    const sessionOrigin = session.targetOrigin ?? session.origin;\n    if (sessionOrigin !== undefined && sessionOrigin !== envelope.origin) throw new ShareAccessError(\"SHARE_SESSION_INVALID\", \"Node session origin is not bound to the share\");\n    if (session.resource !== undefined) {\n      const sessionResource = resourceValue(session.resource, envelope.resource.kind);\n      if (sessionResource === undefined || canonicalValue(sessionResource) !== canonicalValue(envelope.resource)) throw new ShareAccessError(\"SHARE_SESSION_INVALID\", \"Node session resource is not bound to the share\");\n    }\n    const binding = this.options.policyBinding;\n    if (binding === undefined) {\n      this.assertServerActions(session.actions ?? (session.action === undefined ? [] : [session.action]), envelope.actions);\n      return;\n    }\n    compareBoundValue(session.expiryMin, binding.expiryMin, \"Node session expiryMin is not bound to the policy\");\n    compareBoundValue(session.expiryMax, binding.expiryMax, \"Node session expiryMax is not bound to the policy\");\n    const boundResource = resourceValue(binding.resource, envelope.resource.kind);\n    if (binding.targetOrigin !== envelope.origin || boundResource === undefined || canonicalValue(boundResource) !== canonicalValue(envelope.resource) || binding.expiresAt !== undefined && binding.expiresAt !== envelope.expiresAt) {\n      throw new ShareAccessError(\"SHARE_SESSION_INVALID\");\n    }\n    for (const [key, expected] of Object.entries({\n      shareCid: binding.shareCid,\n      shareId: binding.shareId,\n      delegationCid: binding.delegationCid,\n      authorityMaterialHandle: binding.authorityMaterialHandle,\n      authorityMaterialDigest: binding.authorityMaterialDigest,\n      policyCid: binding.policyCid,\n      contentSourceDigest: binding.contentSourceDigest,\n      targetOrigin: binding.targetOrigin,\n      nodeAudience: binding.nodeAudience,\n      resource: boundResource,\n    })) {\n      const actual = key === \"resource\"\n        ? resourceValue((session as unknown as Record<string, unknown>)[key], envelope.resource.kind)\n        : (session as unknown as Record<string, unknown>)[key];\n      compareBoundValue(actual, expected, `Node session ${key} is not bound to the policy`);\n    }\n    if (session.contentSource !== undefined) compareBoundValue(session.contentSource, binding.contentSource, \"Node session content source is not bound to the policy\");\n    this.assertServerActions(session.actions ?? binding.actions ?? (session.action === undefined ? binding.action === undefined ? [] : [binding.action] : [session.action]), envelope.actions);\n  }\n\n  private assertExpiryBounds(session: SharePolicySession, envelope: ShareEnvelopeV2, expiry: number): void {\n    const min = dateValue(session.expiryMin ?? this.options.policyBinding?.expiryMin);\n    const max = dateValue(session.expiryMax ?? this.options.policyBinding?.expiryMax);\n    if ((session.expiryMin !== undefined || this.options.policyBinding?.expiryMin !== undefined) && min === undefined || (session.expiryMax !== undefined || this.options.policyBinding?.expiryMax !== undefined) && max === undefined || min !== undefined && max !== undefined && min > max || min !== undefined && expiry < min || max !== undefined && expiry > max) {\n      throw new ShareAccessError(\"SHARE_SESSION_INVALID\", \"Node session expiry is outside the inclusive policy bounds\");\n    }\n  }\n\n  private assertServerActions(values: readonly unknown[], envelopeActions: readonly ShareAction[]): void {\n    if (values.length === 0) return;\n    const nativeActions = canonicalNativeActions(values);\n    const allowed = new Set(envelopeActions);\n    if (nativeActions.length === 0 || nativeActions.some((action) => !allowed.has(policyActionFor(action)!))) throw new ShareAccessError(\"SHARE_SESSION_ACTION_MISMATCH\");\n  }\n\n  private async buildDefaultPolicySessionRequest(presentation: unknown, challenge: Record<string, unknown>): Promise<unknown> {\n    if (!isRecord(presentation)) throw new ShareAccessError(\"SHARE_SESSION_INVALID\", \"a nonce-bound policy session builder is required\");\n    if (!isRecord(presentation.sessionRequest)) {\n      const binding = this.options.policyBinding;\n      const credential = typeof presentation.credential === \"string\" ? presentation.credential : undefined;\n      const holderDid = typeof presentation.holderDid === \"string\" ? presentation.holderDid : binding?.holderDid;\n      const holderBinding = presentation.holderBinding;\n      const readSignerDid = typeof presentation.readSignerDid === \"string\" ? presentation.readSignerDid : holderDid;\n      const signer = this.options.holderSigner;\n      if (binding === undefined || credential === undefined || holderDid === undefined || holderBinding === undefined || readSignerDid === undefined || signer === undefined) {\n        throw new ShareAccessError(\"SHARE_SESSION_INVALID\", \"a nonce-bound policy session builder is required\");\n      }\n      const action = binding.action ?? binding.actions?.[0] ?? \"tinycloud.kv/get\";\n      const isV2 = challenge.version === 2;\n      const policyPresentation: Record<string, unknown> = {\n        type: \"TinyCloudSharePolicyPresentation\",\n        version: isV2 ? 2 : 1,\n        challengeId: challenge.challengeId,\n        nonce: challenge.nonce,\n        shareCid: binding.shareCid,\n        shareId: binding.shareId,\n        delegationCid: binding.delegationCid,\n        policyCid: binding.policyCid,\n        contentSource: binding.contentSource,\n        contentSourceDigest: binding.contentSourceDigest,\n        holderDid,\n        targetOrigin: binding.targetOrigin,\n        nodeAudience: binding.nodeAudience,\n        ...(isV2 ? {\n          enforcerDid: challenge.enforcerDid,\n          credentialDigest: typeof presentation.credentialDigest === \"string\" ? presentation.credentialDigest : bytesToBase64Url(sha256(new TextEncoder().encode(credential))),\n        } : {}),\n        action,\n        ...(binding.actions === undefined ? {} : { actions: [...binding.actions] }),\n        resource: binding.resource,\n        requestBodyDigest: challenge.requestBodyDigest,\n        issuedAt: new Date(this.now()).toISOString(),\n        expiresAt: challenge.expiresAt,\n        jti: randomJti(),\n      };\n      const proof = await signer({ domain: isV2 ? POLICY_PRESENTATION_DOMAIN_V2 : POLICY_PRESENTATION_DOMAIN_V1, message: policyPresentation });\n      this.assertDetachedProof(proof);\n      return challenge.version === 2\n        ? { challengeId: challenge.challengeId, nonce: challenge.nonce, presentation: policyPresentation, credential, proof, holderBinding, readSignerDid }\n        : { presentation: policyPresentation, credential, proof, holderBinding, readSignerDid };\n    }\n    const request = structuredClone(presentation.sessionRequest) as Record<string, unknown>;\n    const candidate = isRecord(request.presentation) ? request.presentation : request;\n    if (typeof candidate.holderDid !== \"string\") throw new ShareAccessError(\"SHARE_SESSION_INVALID\", \"the policy presentation holder is invalid\");\n    candidate.nonce = challenge.nonce;\n    if (typeof challenge.challengeId === \"string\") candidate.challengeId = challenge.challengeId;\n    if (candidate.audience === undefined && typeof challenge.audience === \"string\") candidate.audience = challenge.audience;\n    if (challenge.version === 2) {\n      request.challengeId = challenge.challengeId;\n      request.nonce = challenge.nonce;\n    }\n    return request;\n  }\n\n  private async postJson(url: string, body: unknown): Promise<Record<string, unknown>> {\n    const response = await this.fetchFn(url, { method: \"POST\", headers: { \"content-type\": \"application/json\" }, body: JSON.stringify(body), redirect: \"error\" });\n    if ((response as unknown as { readonly redirected?: boolean }).redirected === true || response.status >= 300 && response.status < 400) throw new ShareAccessError(\"SHARE_REDIRECT_REJECTED\");\n    if (!response.ok) throw new ShareAccessError(response.status === 401 || response.status === 403 ? \"SHARE_DENIED\" : \"SHARE_SESSION_FAILED\");\n    const value = await response.json();\n    if (!value || typeof value !== \"object\" || Array.isArray(value)) throw new ShareAccessError(\"SHARE_SESSION_INVALID\");\n    return value as Record<string, unknown>;\n  }\n\n  private requireObject(value: unknown, label: string): Record<string, unknown> {\n    if (!value || typeof value !== \"object\" || Array.isArray(value)) throw new ShareAccessError(\"SHARE_SESSION_INVALID\", `${label} is invalid`);\n    return value as Record<string, unknown>;\n  }\n\n  private requiredString(value: Record<string, unknown>, key: string, fallback?: string): string {\n    const result = value[key] ?? fallback;\n    if (typeof result !== \"string\" || result.length === 0) throw new ShareAccessError(\"SHARE_SESSION_INVALID\", `session ${key} is invalid`);\n    return result;\n  }\n\n  private verifyNodeProof(message: Record<string, unknown>, proof: unknown, domain: string): void {\n    const detached = this.requireObject(proof, \"proof\");\n    const isJwsProof = detached.alg === \"EdDSA\" && typeof detached.kid === \"string\" && typeof detached.signature === \"string\";\n    const isEd25519Proof = detached.algorithm === \"Ed25519\" && typeof detached.signerDid === \"string\" && typeof detached.value === \"string\";\n    if (!isJwsProof && !isEd25519Proof) throw new ShareAccessError(\"SHARE_SESSION_INVALID\", \"Node proof is invalid\");\n    if (isJwsProof) assertObjectKeys(detached, [\"alg\", \"kid\", \"signature\"], \"Node proof\");\n    if (isEd25519Proof) assertObjectKeys(detached, [\"algorithm\", \"signerDid\", \"value\"], \"Node proof\");\n    const signerDid = isJwsProof\n      ? this.options.trustedSignerDids?.find((did) => detached.kid === `${did}#${did.slice(\"did:key:\".length)}`)\n      : this.options.trustedSignerDids?.find((did) => did === detached.signerDid);\n    if (signerDid === undefined) throw new ShareAccessError(\"SHARE_SIGNER_UNTRUSTED\");\n    const encoded = signerDid.slice(\"did:key:\".length);\n    if (!signerDid.startsWith(\"did:key:\") || !encoded.startsWith(\"z\")) throw new ShareAccessError(\"SHARE_SESSION_INVALID\", \"Node signer is invalid\");\n    let key: Uint8Array;\n    let signature: Uint8Array;\n    try {\n      const decoded = base58btc.decode(encoded);\n      if (decoded.length !== 34 || decoded[0] !== 0xed || decoded[1] !== 0x01) throw new Error(\"key\");\n      key = decoded.slice(2);\n      signature = base64UrlToBytes((isJwsProof ? detached.signature : detached.value) as string);\n    } catch {\n      throw new ShareAccessError(\"SHARE_SESSION_INVALID\", \"Node proof encoding is invalid\");\n    }\n    if ((isJwsProof && detached.kid !== `${signerDid}#${encoded}`) || (isEd25519Proof && detached.signerDid !== signerDid) || signature.length !== 64) throw new ShareAccessError(\"SHARE_SESSION_INVALID\", \"Node proof binding is invalid\");\n    const bytes = new TextEncoder().encode(`${domain}${canonicalJsonForProof(message)}`);\n    if (!ed25519.verify(signature, bytes, key)) throw new ShareAccessError(\"SHARE_SESSION_INVALID\", \"Node proof signature is invalid\");\n  }\n\n  private assertChallengeRequestBinding(request: Readonly<Record<string, unknown>>, challenge: Record<string, unknown>): void {\n    const source = isRecord(request.body) ? request.body : request;\n    for (const key of [\"policyId\", \"shareId\", \"shareCid\", \"delegationCid\", \"authorityMaterialHandle\", \"authorityMaterialDigest\", \"policyCid\", \"contentSource\", \"contentSourceDigest\", \"holderDid\", \"targetOrigin\", \"nodeAudience\", \"audience\", \"resource\", \"action\", \"actions\", \"expiryMin\", \"expiryMax\"] as const) {\n      compareBoundValue(source[key], challenge[key], `Node challenge ${key} is not bound to the request`);\n    }\n    if (typeof challenge.challengeId !== \"string\" || challenge.challengeId.length === 0 || typeof challenge.nonce !== \"string\" || challenge.nonce.length < 16) throw new ShareAccessError(\"SHARE_SESSION_INVALID\", \"Node challenge identity is invalid\");\n    const claimed = source.requestBodyDigest;\n    if (typeof claimed === \"string\") {\n      const { requestBodyDigest: _ignored, ...body } = source;\n      compareBoundValue(claimed, digestCanonical(body), \"Node challenge request digest is invalid\");\n      compareBoundValue(challenge.requestBodyDigest, claimed, \"Node challenge request digest is not bound\");\n    }\n    if (challenge.requestDigest !== undefined) compareBoundValue(challenge.requestDigest, claimed, \"Node challenge request digest is invalid\");\n  }\n\n  private assertChallengeFresh(challenge: Record<string, unknown>): void {\n    const expiresAt = dateValue(challenge.challengeExpiresAt ?? challenge.expiresAt);\n    if (expiresAt === undefined || expiresAt <= this.now().getTime()) throw new ShareAccessError(\"SHARE_SESSION_INVALID\", \"Node challenge expiry is invalid\");\n  }\n\n  private assertSessionBinding(session: Record<string, unknown>, envelope: ShareEnvelopeV2, request: unknown, challenge: Record<string, unknown>, sessionRequest: unknown): void {\n    const requestObject = this.requireObject(request, \"challenge request\");\n    const sessionRequestObject = this.requireObject(sessionRequest, \"session request\");\n    const requestBinding = isRecord(requestObject.body) ? requestObject.body : requestObject;\n    const presentation = isRecord(sessionRequestObject.presentation) ? sessionRequestObject.presentation : sessionRequestObject;\n    const holderDid = typeof presentation.holderDid === \"string\"\n      ? presentation.holderDid\n      : isRecord(presentation.holder) && typeof presentation.holder.did === \"string\" ? presentation.holder.did : undefined;\n    if (holderDid === undefined) throw new ShareAccessError(\"SHARE_SESSION_INVALID\", \"Node presentation holder is missing\");\n    if (challenge.version === 2) {\n      if (session.version !== 2) throw new ShareAccessError(\"SHARE_SESSION_INVALID\", \"Node session version is invalid\");\n      for (const key of [\"envelopeCid\", \"shareCid\", \"shareId\", \"registrationCid\", \"delegationCid\", \"policyCid\", \"enforcementDelegationCid\", \"holderDid\", \"nodeAudience\", \"action\", \"actions\", \"resource\"] as const) {\n        compareBoundValue(session[key], requestBinding[key] ?? challenge[key], `Node v2 session ${key} is not bound`);\n      }\n    }\n    compareBoundValue(holderDid, session.holderDid, \"Node session holder is not bound to the presentation\");\n    if (isRecord(presentation.holderBinding) && typeof presentation.holderBinding.holderDid === \"string\") compareBoundValue(presentation.holderBinding.holderDid, session.holderDid, \"Node holder binding is not bound to the session\");\n    compareBoundValue(presentation.nonce, challenge.nonce, \"Node presentation nonce is not bound to the challenge\");\n    compareBoundValue(presentation.challengeId, challenge.challengeId, \"Node presentation challenge is not bound\");\n    compareBoundValue(presentation.audience, challenge.audience, \"Node presentation audience is not bound to the challenge\");\n    const allowedAudiences = new Set([envelope.origin, this.options.policyBinding?.nodeAudience].filter((value): value is string => value !== undefined));\n    if (typeof challenge.audience === \"string\" && !allowedAudiences.has(challenge.audience) || typeof presentation.audience === \"string\" && !allowedAudiences.has(presentation.audience)) throw new ShareAccessError(\"SHARE_SESSION_INVALID\", \"Node audience is not bound to the share origin\");\n    const sessionOrigin = session.targetOrigin ?? session.origin;\n    if (sessionOrigin !== undefined && sessionOrigin !== envelope.origin) throw new ShareAccessError(\"SHARE_SESSION_INVALID\", \"Node session origin is not bound to the share\");\n    if (session.spaceId !== undefined && session.spaceId !== envelope.spaceId) throw new ShareAccessError(\"SHARE_SESSION_INVALID\", \"Node session space is not bound to the share\");\n    for (const key of [\"shareCid\", \"shareId\", \"policyCid\", \"delegationCid\", \"authorityMaterialDigest\", \"sourceDigest\", \"targetOrigin\", \"nodeAudience\", \"resource\", \"action\", \"expiryMin\", \"expiryMax\"] as const) {\n      const requestValue = key === \"resource\" ? resourceValue(requestBinding[key], envelope.resource.kind) : requestBinding[key];\n      const sessionValue = key === \"resource\" ? resourceValue((session as Record<string, unknown>)[key], envelope.resource.kind) : (session as Record<string, unknown>)[key];\n      compareBoundValue(requestValue, sessionValue, `Node session ${key} is not bound to the request`);\n    }\n    if (session.resource !== undefined) {\n      const sessionResource = resourceValue(session.resource, envelope.resource.kind);\n      if (sessionResource === undefined || canonicalValue(sessionResource) !== canonicalValue(envelope.resource)) throw new ShareAccessError(\"SHARE_SESSION_INVALID\", \"Node session resource is not bound to the share\");\n    }\n    if (session.actions !== undefined) {\n      if (!Array.isArray(session.actions)) throw new ShareAccessError(\"SHARE_SESSION_INVALID\", \"Node session actions are invalid\");\n      this.assertServerActions(session.actions, envelope.actions);\n    }\n    const sessionExpiry = dateValue(session.expiresAt);\n    const envelopeExpiry = dateValue(envelope.expiresAt);\n    const presentationExpiry = dateValue(presentation.expiresAt);\n    if (sessionExpiry === undefined || sessionExpiry <= this.now().getTime() || envelopeExpiry === undefined || sessionExpiry > envelopeExpiry || (presentationExpiry !== undefined && sessionExpiry > presentationExpiry)) throw new ShareAccessError(\"SHARE_SESSION_INVALID\", \"Node session expiry is invalid\");\n    this.assertExpiryBounds({ ...session, sessionId: typeof session.sessionId === \"string\" ? session.sessionId : \"\", holderDid: typeof session.holderDid === \"string\" ? session.holderDid : \"\", expiresAt: session.expiresAt as string }, envelope, sessionExpiry);\n    compareBoundValue(session.expiryMin, requestBinding.expiryMin, \"Node session expiryMin is not bound to the request\");\n    compareBoundValue(session.expiryMax, requestBinding.expiryMax, \"Node session expiryMax is not bound to the request\");\n  }\n\n  private assertAllowed(capability: { readonly spaceId: string; readonly resource: ShareResource; readonly actions: readonly ShareAction[] }, operation: \"get\" | \"metadata\" | \"list\" | \"save\", path: string): void {\n    if (!shareCapabilityAllows(capability, operationAction(operation), path)) throw new ShareAccessError(\"SHARE_OUT_OF_SCOPE\");\n  }\n\n  private async resolve(link: string): Promise<ResolvedArtifact> {\n    const location = parseShareUrl(link, { trustedOrigins: this.options.trustedOrigins, maxInlineBytes: this.options.maxInlineBytes });\n    if (location.protocol === \"share-envelope-v2\") return this.resolvePublished(link);\n    let bytes: Uint8Array;\n    let cachedEntry: ShareCacheEntry | undefined;\n    if (location.kind === \"inline\") {\n      bytes = new TextEncoder().encode(JSON.stringify(location.artifact));\n    } else {\n      if (location.cid === undefined) throw new ShareAccessError(\"SHARE_INVALID\");\n      cachedEntry = this.cache.getByCid === undefined ? undefined : await this.cache.getByCid(location.cid, this.now());\n      if (cachedEntry !== undefined) {\n        if (!verifyShareCid(location.cid, cachedEntry.bytes) || !this.digestMatches(bytesToBase64Url(cachedEntry.digest), cachedEntry.bytes)) {\n          await this.cache.delete(cachedEntry.key);\n          // A cache is an optimization, never an authority. Re-fetch the\n          // canonical object once after evicting a corrupt entry.\n          bytes = await this.fetchArtifact(location.origin, location.cid);\n        } else {\n          bytes = cachedEntry.bytes;\n        }\n      } else {\n        bytes = await this.fetchArtifact(location.origin, location.cid);\n      }\n    }\n    let artifact = location.artifact ?? parseShareArtifact(bytes, { expectedOrigin: location.origin, maxArtifactBytes: this.options.maxArtifactBytes ?? DEFAULT_MAX_ARTIFACT_BYTES, maxContentBytes: this.options.maxContentBytes ?? DEFAULT_MAX_CONTENT_BYTES, maxSealedContentBytes: this.options.maxSealedContentBytes ?? DEFAULT_MAX_SEALED_CONTENT_BYTES });\n    if (cachedEntry !== undefined && cachedEntry.key.expiresAt !== artifact.envelope.expiresAt) {\n      await this.cache.delete(cachedEntry.key);\n      bytes = await this.fetchArtifact(location.origin, location.cid!);\n      artifact = parseShareArtifact(bytes, { expectedOrigin: location.origin, maxArtifactBytes: this.options.maxArtifactBytes ?? DEFAULT_MAX_ARTIFACT_BYTES, maxContentBytes: this.options.maxContentBytes ?? DEFAULT_MAX_CONTENT_BYTES, maxSealedContentBytes: this.options.maxSealedContentBytes ?? DEFAULT_MAX_SEALED_CONTENT_BYTES });\n    }\n    verifyShareEnvelope(artifact.envelope, { expectedOrigin: location.origin, maxContentBytes: this.options.maxContentBytes, maxSealedContentBytes: this.options.maxSealedContentBytes ?? DEFAULT_MAX_SEALED_CONTENT_BYTES, now: this.now(), trustedSignerDids: this.options.trustedSignerDids });\n    if (!artifact.envelope.encrypted && location.key !== undefined) throw new ShareAccessError(\"unsafe-plaintext\");\n    if (location.cid !== undefined && !verifyShareCid(location.cid, bytes)) {\n      await this.cache.delete({ cid: location.cid, expiresAt: artifact.envelope.expiresAt });\n      throw new ShareAccessError(\"SHARE_CID_MISMATCH\");\n    }\n    if (location.cid !== undefined) await this.cache.set({ cid: location.cid, expiresAt: artifact.envelope.expiresAt }, bytes, { contentType: artifact.envelope.content.mimeType, size: artifact.envelope.content.size, encrypted: artifact.envelope.encrypted });\n    const encodedContent = this.base64ToBytes(artifact.content);\n    const plaintext = artifact.envelope.encrypted\n      ? await decryptShareBytesAsync(encodedContent, location.key ?? (() => { throw new ShareAccessError(\"SHARE_KEY_REQUIRED\"); })())\n      : encodedContent;\n    if (plaintext.byteLength > (this.options.maxContentBytes ?? DEFAULT_MAX_CONTENT_BYTES)) throw new ShareAccessError(\"SHARE_TOO_LARGE\");\n    return { location, artifact, bytes, plaintext };\n  }\n\n  private async fetchArtifact(origin: string, cid: string): Promise<Uint8Array> {\n    const url = this.options.artifactUrl?.({ origin, cid }) ?? `${origin}/s/${cid}/raw`;\n    const response = await this.fetchFn(url, { method: \"GET\", headers: { accept: \"application/vnd.tinycloud.share-artifact+json, application/json\" }, redirect: \"error\" });\n    if ((response as unknown as { readonly redirected?: boolean }).redirected === true || response.status >= 300 && response.status < 400) throw new ShareAccessError(\"SHARE_REDIRECT_REJECTED\");\n    if (!response.ok) throw new ShareAccessError(\"SHARE_FETCH_FAILED\");\n    const bytes = new Uint8Array(await response.arrayBuffer());\n    if (bytes.byteLength > (this.options.maxArtifactBytes ?? DEFAULT_MAX_ARTIFACT_BYTES)) throw new ShareAccessError(\"SHARE_TOO_LARGE\");\n    if (!verifyShareCid(cid, bytes)) throw new ShareAccessError(\"SHARE_CID_MISMATCH\");\n    return bytes;\n  }\n\n  private async resolvePublished(link: string): Promise<ResolvedArtifact> {\n    const published = parsePublishedShareLink(link, { trustedOrigins: this.options.trustedOrigins, maxInlineBytes: this.options.maxInlineBytes });\n    let sealed = published.sealed;\n    let cached: ShareCacheEntry | undefined;\n    if (sealed === undefined && this.cache.getByCid !== undefined) {\n      cached = await this.cache.getByCid(published.cid, this.now());\n      if (cached !== undefined && verifyPublishedShareCid(published.cid, cached.bytes) && this.digestMatches(bytesToBase64Url(cached.digest), cached.bytes)) sealed = cached.bytes;\n      else if (cached !== undefined) await this.cache.delete(cached.key);\n    }\n    if (sealed === undefined) {\n      const url = this.options.artifactUrl?.({ origin: published.origin, cid: published.cid }) ?? `${published.origin}/s/${published.cid}/raw`;\n      const response = await this.fetchFn(url, { method: \"GET\", headers: { accept: \"application/vnd.tinycloud.share-envelope+json, application/json\" }, redirect: \"error\" });\n      if ((response as unknown as { readonly redirected?: boolean }).redirected === true || response.status >= 300 && response.status < 400) throw new ShareAccessError(\"SHARE_REDIRECT_REJECTED\");\n      if (!response.ok) throw new ShareAccessError(\"SHARE_FETCH_FAILED\");\n      sealed = new Uint8Array(await response.arrayBuffer());\n    }\n    if (sealed.byteLength > (this.options.maxSealedContentBytes ?? DEFAULT_MAX_SEALED_CONTENT_BYTES)) throw new ShareAccessError(\"SHARE_TOO_LARGE\");\n    if (!verifyPublishedShareCid(published.cid, sealed)) throw new ShareAccessError(\"SHARE_CID_MISMATCH\");\n    const envelopeBytes = published.key === undefined ? sealed : await openPublishedShareBlob(sealed, published.key);\n    let plaintext = new Uint8Array();\n    // Verify the signed envelope before following any content pointer. A\n    // pointer is data, not authority, and must never create a pre-signature\n    // fetch side channel.\n    let preliminary: ReturnType<typeof parsePublishedShareEnvelope>;\n    try {\n      preliminary = parsePublishedShareEnvelope(envelopeBytes, { expectedOrigin: published.origin, now: this.now(), plaintext, trustedSignerDids: this.options.trustedSignerDids });\n    } catch (error) {\n      if (!(error instanceof Error) || !(\"code\" in error) || (error as { readonly code?: unknown }).code !== \"invalid-envelope\") throw error;\n      const legacy = parseLegacyPublishedShareEnvelope(envelopeBytes, { expectedOrigin: published.origin, now: this.now(), plaintext, trustedSignerDids: this.options.trustedSignerDids });\n      if (this.cache.getByCid !== undefined) await this.cache.set({ cid: published.cid, expiresAt: legacy.artifact.envelope.expiresAt }, sealed, { contentType: legacy.artifact.envelope.content.mimeType, size: sealed.byteLength, encrypted: true });\n      const location: ShareLinkLocation = { kind: published.sealed === undefined ? \"compact\" : \"inline\", origin: published.origin, cid: published.cid, url: `${published.origin}/s/${published.cid}/raw`, protocol: \"share-envelope-v2\" };\n      return { location, artifact: legacy.artifact, bytes: sealed, plaintext };\n    }\n    const pointer = preliminary.envelope.content;\n    if (pointer !== undefined) {\n      const contentUrl = this.options.artifactUrl?.({ origin: published.origin, cid: pointer.cid }) ?? `${published.origin}/s/${pointer.cid}/raw`;\n      const contentResponse = await this.fetchFn(contentUrl, { method: \"GET\", headers: { accept: \"application/octet-stream\" }, redirect: \"error\" });\n      if ((contentResponse as unknown as { readonly redirected?: boolean }).redirected === true || contentResponse.status >= 300 && contentResponse.status < 400) throw new ShareAccessError(\"SHARE_REDIRECT_REJECTED\");\n      if (!contentResponse.ok) throw new ShareAccessError(\"SHARE_FETCH_FAILED\");\n      const contentSealed = new Uint8Array(await contentResponse.arrayBuffer());\n      if (contentSealed.byteLength > (this.options.maxSealedContentBytes ?? DEFAULT_MAX_SEALED_CONTENT_BYTES)) throw new ShareAccessError(\"SHARE_TOO_LARGE\");\n      if (!verifyPublishedShareCid(pointer.cid, contentSealed)) throw new ShareAccessError(\"SHARE_CID_MISMATCH\");\n      plaintext = new Uint8Array(await openPublishedShareBlob(contentSealed, this.base64ToBytes(pointer.key)));\n    }\n    const artifact = parsePublishedShareEnvelope(envelopeBytes, { expectedOrigin: published.origin, now: this.now(), plaintext, trustedSignerDids: this.options.trustedSignerDids }).artifact;\n    if (this.cache.getByCid !== undefined) await this.cache.set({ cid: published.cid, expiresAt: artifact.envelope.expiresAt }, sealed, { contentType: artifact.envelope.content.mimeType, size: sealed.byteLength, encrypted: true });\n    const location: ShareLinkLocation = { kind: published.sealed === undefined ? \"compact\" : \"inline\", origin: published.origin, cid: published.cid, url: `${published.origin}/s/${published.cid}/raw`, protocol: \"share-envelope-v2\" };\n    return { location, artifact, bytes: sealed, plaintext };\n  }\n\n  private base64ToBytes(value: string): Uint8Array {\n    const normalized = value.replace(/-/g, \"+\").replace(/_/g, \"/\") + \"=\".repeat((4 - value.length % 4) % 4);\n    if (typeof atob === \"function\") return Uint8Array.from(atob(normalized), (char) => char.charCodeAt(0));\n    return new Uint8Array(Buffer.from(normalized, \"base64\"));\n  }\n}\n","import { ed25519 } from \"@noble/curves/ed25519\";\nimport { blake3 } from \"@noble/hashes/blake3\";\nimport { sha256 } from \"@noble/hashes/sha256\";\nimport { CID } from \"multiformats/cid\";\nimport { create as createDigest } from \"multiformats/hashes/digest\";\nimport * as raw from \"multiformats/codecs/raw\";\nimport { sha256 as sha256Cid } from \"multiformats/hashes/sha2\";\nimport { base58btc } from \"multiformats/bases/base58\";\n\nconst ENVELOPE_SCHEMA = \"xyz.tinycloud.share/envelope\" as const;\nconst INLINE_PREFIX = \"tc2:\";\nconst RAW_CID_CODEC = 0x55;\nconst BLAKE3_256_CODE = 0x1e;\nconst DEFAULT_MAX_INLINE_BYTES = 256 * 1024;\nexport const MAX_SHARE_CONTENT_BYTES = 100 * 1024 * 1024;\n/** AES-GCM plus the published version byte, IV, and authentication tag. */\nexport const MAX_SEALED_SHARE_CONTENT_BYTES = MAX_SHARE_CONTENT_BYTES + 29;\n/** Canonical JSON is independently bounded from plaintext and sealed bytes. */\nexport const MAX_SHARE_ARTIFACT_BYTES =\n  Math.ceil((MAX_SEALED_SHARE_CONTENT_BYTES * 4) / 3) + 2 * 1024 * 1024;\nconst DEFAULT_MAX_ARTIFACT_BYTES = MAX_SHARE_ARTIFACT_BYTES;\n\nexport type ShareRecipientTarget =\n  | { readonly kind: \"exactEmail\"; readonly value: string }\n  | { readonly kind: \"emailDomain\"; readonly value: string }\n  | { readonly kind: \"recipientDid\"; readonly value: string }\n  | { readonly kind: \"bearer\" };\n\nexport type ShareResource =\n  | { readonly kind: \"exact\"; readonly path: string }\n  | { readonly kind: \"prefix\"; readonly path: string };\n\nexport type ShareAction = \"read\" | \"list\" | \"edit\";\n\nexport interface SharePolicy {\n  readonly matcher: ShareRecipientTarget;\n  readonly spaceId: string;\n  readonly resource: ShareResource;\n  readonly actions: readonly ShareAction[];\n  readonly expiresAt: string;\n}\n\nexport interface ShareContentMetadata {\n  readonly mimeType: string;\n  readonly size: number;\n  readonly digest: string;\n  readonly charset?: \"utf-8\";\n}\n\nexport interface ShareEnvelopeV2 {\n  readonly schema: typeof ENVELOPE_SCHEMA;\n  readonly version: 2;\n  readonly origin: string;\n  readonly spaceId: string;\n  readonly recipient?: ShareRecipientTarget;\n  /** Public routing discriminator. Matcher values are never serialized here. */\n  readonly recipientKind?: ShareRecipientTarget[\"kind\"];\n  readonly resource: ShareResource;\n  readonly actions: readonly ShareAction[];\n  readonly content: ShareContentMetadata;\n  readonly encrypted: boolean;\n  readonly expiresAt: string;\n  readonly signer: { readonly did: string; readonly publicKey: string };\n  readonly signature: string;\n  /** Internal marker for the published Share-v2 adapter; never serialized by legacy artifacts. */\n  readonly authorizationTargetKind?: string;\n}\n\nexport interface ShareArtifactV2 {\n  readonly envelope: ShareEnvelopeV2;\n  /** Canonical base64url bytes. For an encrypted artifact these are ciphertext. */\n  readonly content: string;\n}\n\nexport interface ShareLinkLocation {\n  readonly kind: \"compact\" | \"inline\";\n  readonly origin: string;\n  readonly cid?: string;\n  readonly key?: Uint8Array;\n  readonly artifact?: ShareArtifactV2;\n  readonly url: string;\n  /** Canonical Share envelope links use the published SHA-256/sealed-blob wire format. */\n  readonly protocol?: \"legacy\" | \"share-envelope-v2\";\n}\n\nexport interface VerifyShareEnvelopeOptions {\n  readonly now?: Date;\n  readonly expectedOrigin?: string;\n  readonly expectedCid?: string;\n  readonly maxArtifactBytes?: number;\n  readonly maxContentBytes?: number;\n  readonly maxSealedContentBytes?: number;\n  /** Trusted signer DIDs for addressed policy artifacts. */\n  readonly trustedSignerDids?: readonly string[];\n}\n\nexport interface ShareArtifactInput {\n  readonly origin: string;\n  readonly spaceId: string;\n  readonly recipient?: ShareRecipientTarget;\n  readonly resource: ShareResource;\n  readonly actions: readonly ShareAction[];\n  readonly mimeType: string;\n  readonly bytes: Uint8Array;\n  readonly expiresAt: Date;\n  readonly signerDid: string;\n  readonly signerPrivateKey: Uint8Array;\n  readonly encryptionKey?: Uint8Array;\n  readonly maxContentBytes?: number;\n  /** Required acknowledgement for the intentionally content-free policy-only plaintext form. */\n  readonly plaintextPolicyOnly?: boolean;\n  readonly plaintextWarningAcknowledged?: boolean;\n}\n\nexport interface ShareArtifactResult {\n  readonly artifact: ShareArtifactV2;\n  readonly bytes: Uint8Array;\n  readonly cid: string;\n  readonly key?: Uint8Array;\n}\n\nexport class ShareEnvelopeError extends Error {\n  readonly code:\n    | \"invalid-link\"\n    | \"invalid-envelope\"\n    | \"expired\"\n    | \"signature-invalid\"\n    | \"cid-mismatch\"\n    | \"origin-mismatch\"\n    | \"content-too-large\"\n    | \"encryption-required\"\n    | \"unsafe-plaintext\";\n\n  constructor(code: ShareEnvelopeError[\"code\"], message: string) {\n    super(message);\n    this.name = \"ShareEnvelopeError\";\n    this.code = code;\n  }\n}\n\nfunction bytesToBase64Url(bytes: Uint8Array): string {\n  let binary = \"\";\n  for (const byte of bytes) binary += String.fromCharCode(byte);\n  const encoded = typeof btoa === \"function\"\n    ? btoa(binary)\n    : Buffer.from(bytes).toString(\"base64\");\n  return encoded.replace(/\\+/g, \"-\").replace(/\\//g, \"_\").replace(/=+$/g, \"\");\n}\n\nfunction base64UrlToBytes(value: string): Uint8Array {\n  if (!/^[A-Za-z0-9_-]*$/.test(value) || value.length % 4 === 1) {\n    throw new ShareEnvelopeError(\"invalid-link\", \"non-canonical base64url\");\n  }\n  const padded = value.replace(/-/g, \"+\").replace(/_/g, \"/\") + \"=\".repeat((4 - value.length % 4) % 4);\n  const decoded = typeof atob === \"function\"\n    ? (() => {\n        const binary = atob(padded);\n        return Uint8Array.from(binary, (char) => char.charCodeAt(0));\n      })()\n    : new Uint8Array(Buffer.from(padded, \"base64\"));\n  if (bytesToBase64Url(decoded) !== value) throw new ShareEnvelopeError(\"invalid-link\", \"non-canonical base64url\");\n  return decoded;\n}\n\nfunction assertKeys(value: object, allowed: readonly string[], label: string): void {\n  const permitted = new Set(allowed);\n  for (const key of Object.keys(value)) if (!permitted.has(key)) throw new ShareEnvelopeError(\"invalid-envelope\", `${label} contains an unknown field`);\n}\n\nfunction canonicalJson(value: unknown): string {\n  if (value === null || typeof value === \"string\" || typeof value === \"boolean\") {\n    return JSON.stringify(value);\n  }\n  if (typeof value === \"number\") {\n    if (!Number.isFinite(value)) throw new ShareEnvelopeError(\"invalid-envelope\", \"non-finite number\");\n    return JSON.stringify(value);\n  }\n  if (Array.isArray(value)) return `[${value.map(canonicalJson).join(\",\")}]`;\n  if (typeof value === \"object\") {\n    const object = value as Record<string, unknown>;\n    return `{${Object.keys(object).sort().map((key) => `${JSON.stringify(key)}:${canonicalJson(object[key])}`).join(\",\")}}`;\n  }\n  throw new ShareEnvelopeError(\"invalid-envelope\", \"unsupported JSON value\");\n}\n\nfunction skipWhitespace(text: string, start: number): number {\n  let index = start;\n  while (/\\s/.test(text[index] ?? \"\")) index += 1;\n  return index;\n}\n\nfunction scanJsonValue(text: string, start: number): number {\n  let index = skipWhitespace(text, start);\n  const first = text[index];\n  if (first === '\"') {\n    index += 1;\n    while (index < text.length) {\n      if (text[index] === \"\\\\\") index += 2;\n      else if (text[index++] === '\"') return index;\n    }\n    throw new ShareEnvelopeError(\"invalid-envelope\", \"unterminated JSON string\");\n  }\n  if (first === \"{\") {\n    const keys = new Set<string>();\n    index = skipWhitespace(text, index + 1);\n    if (text[index] === \"}\") return index + 1;\n    while (index < text.length) {\n      index = skipWhitespace(text, index);\n      if (text[index] !== '\"') throw new ShareEnvelopeError(\"invalid-envelope\", \"object key must be a string\");\n      const keyStart = index;\n      index = scanJsonValue(text, index);\n      const key = JSON.parse(text.slice(keyStart, index)) as string;\n      if (keys.has(key)) throw new ShareEnvelopeError(\"invalid-envelope\", `duplicate JSON key ${key}`);\n      keys.add(key);\n      index = skipWhitespace(text, index);\n      if (text[index++] !== \":\") throw new ShareEnvelopeError(\"invalid-envelope\", \"missing object colon\");\n      index = scanJsonValue(text, index);\n      index = skipWhitespace(text, index);\n      if (text[index] === \"}\") return index + 1;\n      if (text[index++] !== \",\") throw new ShareEnvelopeError(\"invalid-envelope\", \"invalid object separator\");\n    }\n    throw new ShareEnvelopeError(\"invalid-envelope\", \"unterminated JSON object\");\n  }\n  if (first === \"[\") {\n    index = skipWhitespace(text, index + 1);\n    if (text[index] === \"]\") return index + 1;\n    while (index < text.length) {\n      index = scanJsonValue(text, index);\n      index = skipWhitespace(text, index);\n      if (text[index] === \"]\") return index + 1;\n      if (text[index++] !== \",\") throw new ShareEnvelopeError(\"invalid-envelope\", \"invalid array separator\");\n    }\n    throw new ShareEnvelopeError(\"invalid-envelope\", \"unterminated JSON array\");\n  }\n  const match = text.slice(index).match(/^(?:true|false|null|-?(?:0|[1-9]\\d*)(?:\\.\\d+)?(?:[eE][+-]?\\d+)?)/);\n  if (!match) throw new ShareEnvelopeError(\"invalid-envelope\", \"invalid JSON value\");\n  return index + match[0].length;\n}\n\nfunction parseCanonicalJson(text: string): unknown {\n  try {\n    const end = scanJsonValue(text, 0);\n    if (skipWhitespace(text, end) !== text.length) throw new Error(\"trailing JSON\");\n    const parsed = JSON.parse(text) as unknown;\n    if (canonicalJson(parsed) !== text) throw new Error(\"non-canonical JSON\");\n    return parsed;\n  } catch (error) {\n    if (error instanceof ShareEnvelopeError) throw error;\n    throw new ShareEnvelopeError(\"invalid-envelope\", error instanceof Error ? error.message : \"invalid JSON\");\n  }\n}\n\nfunction normalizeOrigin(value: string): string {\n  try {\n    const url = new URL(value);\n    if (![\"http:\", \"https:\"].includes(url.protocol) || url.username || url.password || url.search || url.hash) {\n      throw new Error(\"origin must be a credential-free URL\");\n    }\n    return url.origin;\n  } catch {\n    throw new ShareEnvelopeError(\"invalid-envelope\", \"invalid trusted origin\");\n  }\n}\n\nfunction normalizeResource(resource: ShareResource): ShareResource {\n  if (resource.kind !== \"exact\" && resource.kind !== \"prefix\") throw new ShareEnvelopeError(\"invalid-envelope\", \"invalid resource kind\");\n  if (!resource.path || resource.path.startsWith(\"/\") || /[\\u0000-\\u001f\\u007f\\\\]/.test(resource.path) || /%2f|%5c|%2e/i.test(resource.path) || resource.path.split(\"/\").some((part, index, parts) => part === \".\" || part === \"..\" || (part.length === 0 && !(resource.kind === \"prefix\" && index === parts.length - 1)))) {\n    throw new ShareEnvelopeError(\"invalid-envelope\", \"resource path is not canonical\");\n  }\n  return { kind: resource.kind, path: resource.kind === \"prefix\" && !resource.path.endsWith(\"/\") ? `${resource.path}/` : resource.path };\n}\n\nfunction normalizeActions(actions: readonly ShareAction[]): ShareAction[] {\n  const allowed = new Set<ShareAction>([\"read\", \"list\", \"edit\"]);\n  if (actions.length === 0 || new Set(actions).size !== actions.length || actions.some((action) => !allowed.has(action))) {\n    throw new ShareEnvelopeError(\"invalid-envelope\", \"actions must be a non-empty canonical set\");\n  }\n  return [...actions].sort((a, b) => a.localeCompare(b));\n}\n\nfunction normalizeRecipient(recipient: ShareRecipientTarget | undefined): ShareRecipientTarget | undefined {\n  if (recipient === undefined) return undefined;\n  if (recipient.kind === \"bearer\") return { kind: \"bearer\" };\n  if (typeof recipient.value !== \"string\" || recipient.value.length === 0 || /[\\r\\n]/.test(recipient.value)) {\n    throw new ShareEnvelopeError(\"invalid-envelope\", \"recipient value is invalid\");\n  }\n  if (recipient.kind === \"emailDomain\") {\n    const domain = recipient.value.toLowerCase();\n    if (!/^(?:[a-z0-9](?:[a-z0-9-]{0,61}[a-z0-9])?)(?:\\.(?:[a-z0-9](?:[a-z0-9-]{0,61}[a-z0-9])?))+$/i.test(domain)) {\n      throw new ShareEnvelopeError(\"invalid-envelope\", \"recipient domain is invalid\");\n    }\n    return { kind: recipient.kind, value: domain };\n  }\n  if (recipient.kind === \"recipientDid\") {\n    if (!isCanonicalRecipientDid(recipient.value)) throw new ShareEnvelopeError(\"invalid-envelope\", \"recipient DID is invalid\");\n    return { kind: recipient.kind, value: recipient.value };\n  }\n  // Mailbox matching is case-sensitive in the local part.  Only the DNS\n  // portion is normalized, which is the same contract used by the auth and\n  // node layers.  Trimming is limited to transport framing; it must never\n  // alter characters inside the mailbox.\n  const exact = recipient.value.trim();\n  const at = exact.lastIndexOf(\"@\");\n  const normalizedExact = at > 0 ? `${exact.slice(0, at)}@${exact.slice(at + 1).toLowerCase()}` : exact;\n  if (recipient.kind !== \"exactEmail\" || !/^[^@\\s]+@[^@\\s]+$/.test(normalizedExact)) {\n    throw new ShareEnvelopeError(\"invalid-envelope\", \"recipient matcher is invalid\");\n  }\n  return { kind: recipient.kind, value: normalizedExact };\n}\n\nfunction isCanonicalRecipientDid(value: string): boolean {\n  if (value.length === 0 || value.length > 2048 || /[\\u0000-\\u0020\\u007f]/.test(value)) return false;\n  const parts = value.split(\":\");\n  if (parts.length < 3 || parts[0] !== \"did\" || !/^[a-z0-9]+$/.test(parts[1] ?? \"\")) return false;\n  const identifier = parts.slice(2);\n  if (identifier.some((part) => part.length === 0)) return false;\n  if (parts[1] === \"web\") {\n    const host = identifier[0] ?? \"\";\n    if (host.length > 253 || host.split(\".\").some((label) => !label || label.length > 63 || !/^[A-Za-z0-9-]+$/.test(label) || label.startsWith(\"-\") || label.endsWith(\"-\"))) return false;\n    return identifier.slice(1).every((part) => /^[A-Za-z0-9._%-]+$/.test(part));\n  }\n  if (parts[1] === \"pkh\") return identifier.length >= 3 && identifier.every((part) => /^[A-Za-z0-9._%-]+$/.test(part));\n  if (parts[1] === \"key\") {\n    try {\n      const bytes = base58btc.decode(identifier.join(\":\"));\n      return bytes.length === 34 && bytes[0] === 0xed && bytes[1] === 0x01;\n    } catch {\n      return false;\n    }\n  }\n  return false;\n}\n\nexport function normalizeShareRecipientTarget(recipient: ShareRecipientTarget): ShareRecipientTarget {\n  const normalized = normalizeRecipient(recipient);\n  if (normalized === undefined) throw new ShareEnvelopeError(\"invalid-envelope\", \"recipient matcher is required\");\n  return normalized;\n}\n\nexport function normalizeShareResource(resource: ShareResource): ShareResource {\n  return normalizeResource(resource);\n}\n\nexport function normalizeShareActions(actions: readonly ShareAction[]): ShareAction[] {\n  return normalizeActions(actions);\n}\n\nfunction resourceContains(outer: ShareResource, inner: ShareResource): boolean {\n  if (outer.kind === \"exact\") return inner.kind === \"exact\" && outer.path === inner.path;\n  const prefix = outer.path.endsWith(\"/\") ? outer.path : `${outer.path}/`;\n  const outerPath = prefix.slice(0, -1);\n  if (inner.kind === \"exact\") return inner.path.startsWith(prefix) || inner.path === outerPath;\n  const innerPrefix = inner.path.endsWith(\"/\") ? inner.path : `${inner.path}/`;\n  return inner.path === outerPath || innerPrefix.startsWith(prefix);\n}\n\nexport function createSharePolicy(input: Omit<SharePolicy, \"expiresAt\"> & { readonly expiresAt: Date }): SharePolicy {\n  return {\n    matcher: normalizeShareRecipientTarget(input.matcher),\n    spaceId: input.spaceId,\n    resource: normalizeShareResource(input.resource),\n    actions: normalizeShareActions(input.actions),\n    expiresAt: input.expiresAt.toISOString(),\n  };\n}\n\nfunction contentDigest(bytes: Uint8Array): string {\n  return bytesToBase64Url(sha256(bytes));\n}\n\nexport function computeShareCid(bytes: Uint8Array): string {\n  const digest = createDigest(BLAKE3_256_CODE, blake3(bytes));\n  return CID.createV1(RAW_CID_CODEC, digest).toString();\n}\n\nexport function verifyShareCid(cid: string, bytes: Uint8Array): boolean {\n  try {\n    const parsed = CID.parse(cid);\n    if (parsed.toString() !== cid || parsed.multihash.code !== BLAKE3_256_CODE) return false;\n    return parsed.equals(CID.createV1(parsed.code, createDigest(parsed.multihash.code, blake3(bytes))));\n  } catch {\n    return false;\n  }\n}\n\nfunction envelopeSigningBytes(envelope: Omit<ShareEnvelopeV2, \"signature\">): Uint8Array {\n  return new TextEncoder().encode(canonicalJson(envelope));\n}\n\nexport function signShareEnvelope(input: Omit<ShareEnvelopeV2, \"signature\" | \"signer\"> & { signerDid: string; signerPrivateKey: Uint8Array }): ShareEnvelopeV2 {\n  if (input.signerPrivateKey.length !== 32) throw new ShareEnvelopeError(\"invalid-envelope\", \"Ed25519 private key must be 32 bytes\");\n  const publicKey = ed25519.getPublicKey(input.signerPrivateKey);\n  const unsigned = {\n    schema: ENVELOPE_SCHEMA,\n    version: 2 as const,\n    origin: normalizeOrigin(input.origin),\n    spaceId: input.spaceId,\n    ...(normalizeRecipient(input.recipient)?.kind === \"bearer\" ? { recipient: { kind: \"bearer\" as const } } : {}),\n    ...(input.recipientKind === undefined && input.recipient === undefined ? {} : { recipientKind: input.recipientKind ?? normalizeRecipient(input.recipient)?.kind }),\n    resource: normalizeResource(input.resource),\n    actions: normalizeActions(input.actions),\n    content: input.content,\n    encrypted: input.encrypted,\n    expiresAt: new Date(input.expiresAt).toISOString(),\n    signer: { did: input.signerDid, publicKey: bytesToBase64Url(publicKey) },\n  } satisfies Omit<ShareEnvelopeV2, \"signature\">;\n  return { ...unsigned, signature: bytesToBase64Url(ed25519.sign(envelopeSigningBytes(unsigned), input.signerPrivateKey)) };\n}\n\nexport function verifyShareEnvelope(envelope: ShareEnvelopeV2, options: VerifyShareEnvelopeOptions = {}): ShareEnvelopeV2 {\n  try {\n    assertKeys(envelope as object, [\"schema\", \"version\", \"origin\", \"spaceId\", \"recipient\", \"recipientKind\", \"resource\", \"actions\", \"content\", \"encrypted\", \"expiresAt\", \"signer\", \"signature\"], \"share envelope\");\n    assertKeys(envelope.resource as object, [\"kind\", \"path\"], \"share resource\");\n    assertKeys(envelope.content as object, [\"mimeType\", \"size\", \"digest\", \"charset\"], \"share content\");\n    assertKeys(envelope.signer as object, [\"did\", \"publicKey\"], \"share signer\");\n    if (envelope.recipient !== undefined) assertKeys(envelope.recipient as object, envelope.recipient.kind === \"bearer\" ? [\"kind\"] : [\"kind\", \"value\"], \"share recipient\");\n    if (envelope.schema !== ENVELOPE_SCHEMA || envelope.version !== 2 || typeof envelope.signature !== \"string\") throw new Error(\"unsupported envelope\");\n    if (normalizeOrigin(envelope.origin) !== envelope.origin) throw new Error(\"origin is not canonical\");\n    if (options.expectedOrigin !== undefined && normalizeOrigin(options.expectedOrigin) !== envelope.origin) throw new ShareEnvelopeError(\"origin-mismatch\", \"envelope origin is not trusted\");\n    const expiry = Date.parse(envelope.expiresAt);\n    if (!Number.isFinite(expiry) || expiry <= (options.now ?? new Date()).getTime()) throw new ShareEnvelopeError(\"expired\", \"share envelope has expired\");\n    if (new Date(expiry).toISOString() !== envelope.expiresAt) throw new ShareEnvelopeError(\"invalid-envelope\", \"expiry is not canonical\");\n    const resource = normalizeResource(envelope.resource);\n    if (resource.kind !== envelope.resource.kind || resource.path !== envelope.resource.path) throw new ShareEnvelopeError(\"invalid-envelope\", \"resource is not canonical\");\n    const actions = normalizeActions(envelope.actions);\n    if (actions.join(\"\\0\") !== envelope.actions.join(\"\\0\")) throw new ShareEnvelopeError(\"invalid-envelope\", \"actions are not canonical\");\n    const recipient = normalizeRecipient(envelope.recipient);\n    if (recipient !== undefined && JSON.stringify(recipient) !== JSON.stringify(envelope.recipient)) throw new ShareEnvelopeError(\"invalid-envelope\", \"recipient is not canonical\");\n    if (recipient?.kind === \"exactEmail\" || recipient?.kind === \"emailDomain\") throw new ShareEnvelopeError(\"unsafe-plaintext\", \"recipient matchers are not public envelope fields\");\n    if (envelope.recipientKind !== undefined && ![\"exactEmail\", \"emailDomain\", \"recipientDid\", \"bearer\"].includes(envelope.recipientKind)) throw new ShareEnvelopeError(\"invalid-envelope\", \"recipient mode is invalid\");\n    if (envelope.recipientKind === \"bearer\" && recipient?.kind !== undefined && recipient.kind !== \"bearer\") throw new ShareEnvelopeError(\"invalid-envelope\", \"recipient mode does not match recipient\");\n    if ((envelope.recipientKind === \"exactEmail\" || envelope.recipientKind === \"emailDomain\" || envelope.recipientKind === \"recipientDid\") && !envelope.encrypted) throw new ShareEnvelopeError(\"unsafe-plaintext\", \"addressed shares require encryption\");\n    if (typeof envelope.spaceId !== \"string\" || envelope.spaceId.length === 0 || typeof envelope.content.mimeType !== \"string\" || envelope.content.mimeType.length === 0 || typeof envelope.content.digest !== \"string\" || !/^[A-Za-z0-9_-]+$/.test(envelope.content.digest)) throw new ShareEnvelopeError(\"invalid-envelope\", \"content metadata is invalid\");\n    const maxContentBytes = envelope.encrypted\n      ? options.maxSealedContentBytes ?? MAX_SEALED_SHARE_CONTENT_BYTES\n      : options.maxContentBytes ?? MAX_SHARE_CONTENT_BYTES;\n    if (!Number.isInteger(envelope.content.size) || envelope.content.size < 0 || envelope.content.size > maxContentBytes) throw new ShareEnvelopeError(\"content-too-large\", \"share content exceeds the configured limit\");\n    const publicKey = base64UrlToBytes(envelope.signer.publicKey);\n    const signature = base64UrlToBytes(envelope.signature);\n    const unsigned = { ...envelope } as Omit<ShareEnvelopeV2, \"signature\">;\n    delete (unsigned as { signature?: string }).signature;\n    if (publicKey.length !== 32 || signature.length !== 64 || !ed25519.verify(signature, envelopeSigningBytes(unsigned), publicKey)) throw new ShareEnvelopeError(\"signature-invalid\", \"share envelope signature is invalid\");\n    if (options.trustedSignerDids !== undefined && envelope.recipientKind !== undefined && !options.trustedSignerDids.includes(envelope.signer.did)) throw new ShareEnvelopeError(\"signature-invalid\", \"share signer is not trusted\");\n    return envelope;\n  } catch (error) {\n    if (error instanceof ShareEnvelopeError) throw error;\n    throw new ShareEnvelopeError(\"invalid-envelope\", error instanceof Error ? error.message : \"invalid envelope\");\n  }\n}\n\nexport function encodeShareArtifact(artifact: ShareArtifactV2): Uint8Array {\n  const normalized = parseShareArtifact(new TextEncoder().encode(canonicalJson(artifact)), { verify: false });\n  return new TextEncoder().encode(canonicalJson(normalized));\n}\n\nexport function parseShareArtifact(bytes: Uint8Array, options: VerifyShareEnvelopeOptions & { readonly verify?: boolean } = {}): ShareArtifactV2 {\n  if (bytes.byteLength > (options.maxArtifactBytes ?? DEFAULT_MAX_ARTIFACT_BYTES)) throw new ShareEnvelopeError(\"content-too-large\", \"share artifact exceeds the configured limit\");\n  const parsed = parseCanonicalJson(new TextDecoder().decode(bytes));\n  if (parsed === null || typeof parsed !== \"object\" || Array.isArray(parsed)) throw new ShareEnvelopeError(\"invalid-envelope\", \"share artifact must be an object\");\n  const artifact = parsed as ShareArtifactV2;\n  if (!artifact.envelope || typeof artifact.content !== \"string\" || !/^[A-Za-z0-9_-]*$/.test(artifact.content)) throw new ShareEnvelopeError(\"invalid-envelope\", \"share artifact shape is invalid\");\n  assertKeys(artifact as object, [\"envelope\", \"content\"], \"share artifact\");\n  if (options.verify !== false) verifyShareEnvelope(artifact.envelope, options);\n  const bytesValue = base64UrlToBytes(artifact.content);\n  if (bytesValue.byteLength !== artifact.envelope.content.size || contentDigest(bytesValue) !== artifact.envelope.content.digest) throw new ShareEnvelopeError(\"invalid-envelope\", \"share content digest does not match envelope\");\n  if (artifact.envelope.encrypted && bytesValue.byteLength < 16) throw new ShareEnvelopeError(\"invalid-envelope\", \"encrypted share content is too short\");\n  if (!artifact.envelope.encrypted && artifact.envelope.recipient !== undefined) {\n    throw new ShareEnvelopeError(\"unsafe-plaintext\", \"recipient PII cannot be placed in an unencrypted envelope\");\n  }\n  return artifact;\n}\n\nexport function encodeShareUrl(input: { readonly origin: string; readonly cid: string; readonly key?: Uint8Array }): string {\n  const origin = normalizeOrigin(input.origin);\n  try {\n    if (CID.parse(input.cid).toString() !== input.cid) throw new Error(\"non-canonical CID\");\n  } catch {\n    throw new ShareEnvelopeError(\"invalid-link\", \"CID is not canonical\");\n  }\n  if (input.key !== undefined && input.key.length !== 32) throw new ShareEnvelopeError(\"invalid-link\", \"fragment key must be 32 bytes\");\n  return `${origin}/s/${input.cid}${input.key === undefined ? \"\" : `#k=${bytesToBase64Url(input.key)}`}`;\n}\n\nexport function encodeInlineShareUrl(input: { readonly origin: string; readonly artifact: ShareArtifactV2; readonly key?: Uint8Array; readonly maxInlineBytes?: number }): string {\n  const bytes = encodeShareArtifact(input.artifact);\n  const encoded = bytesToBase64Url(bytes);\n  if (bytes.byteLength > (input.maxInlineBytes ?? DEFAULT_MAX_INLINE_BYTES)) throw new ShareEnvelopeError(\"content-too-large\", \"inline share exceeds the configured limit\");\n  if (input.artifact.envelope.encrypted && (input.key === undefined || input.key.length !== 32)) throw new ShareEnvelopeError(\"encryption-required\", \"encrypted inline shares require a 32-byte fragment key\");\n  if (!input.artifact.envelope.encrypted && input.key !== undefined) throw new ShareEnvelopeError(\"unsafe-plaintext\", \"plaintext shares cannot carry a fragment key\");\n  return `${normalizeOrigin(input.origin)}/s/i/${encoded}${input.key === undefined ? \"\" : `#k=${bytesToBase64Url(input.key)}`}`;\n}\n\n/** The published Share package's v2 envelope, kept local so the SDK has no runtime dependency on the Share app. */\nexport interface PublishedShareEnvelopeV2 {\n  /** The published envelope wire format is v1; the SDK's normalized artifact is v2. */\n  readonly version: 1;\n  readonly shareId: string;\n  readonly delegation: string;\n  readonly authorizationTarget:\n    | { readonly kind: \"policy\"; readonly policyCid: string; readonly policyBytes: string }\n    | { readonly kind: \"bearerKey\"; readonly sessionJwk: Record<string, unknown> }\n    | { readonly kind: \"recipientDid\"; readonly did: string };\n  readonly target: { readonly origin: string; readonly nodeAudience: string; readonly spaceId: string; readonly resource: ShareResource };\n  readonly display: { readonly senderName?: string; readonly filename?: string; readonly recipientHint?: string; readonly mode?: \"document\" | \"source\" | \"folder\" };\n  readonly expiry: string;\n  readonly content?: { readonly cid: string; readonly key: string };\n  readonly signature: { readonly signerDid: string; readonly algorithm: \"Ed25519\"; readonly value: string };\n}\n\nconst PUBLISHED_AAD = new TextEncoder().encode(\"tinycloud-share-envelope-v1\");\n\nfunction publishedCid(bytes: Uint8Array): string {\n  return CID.create(1, raw.code, createDigest(sha256Cid.code, sha256(bytes))).toString();\n}\n\nfunction isPublishedCid(value: string): boolean {\n  try {\n    const parsed = CID.parse(value);\n    return parsed.version === 1 && parsed.code === raw.code && parsed.multihash.code === sha256Cid.code && parsed.toString() === value;\n  } catch {\n    return false;\n  }\n}\n\nfunction publishedPublicKey(did: string): Uint8Array {\n  const value = did.slice(\"did:key:\".length);\n  const encoded = base58btc.decode(value);\n  if (encoded.length !== 34 || encoded[0] !== 0xed || encoded[1] !== 0x01) throw new ShareEnvelopeError(\"invalid-envelope\", \"published signer is not Ed25519\");\n  return encoded.slice(2);\n}\n\nfunction publishedEnvelopeSigningBytes(envelope: PublishedShareEnvelopeV2): Uint8Array {\n  const { signature: _signature, ...unsigned } = envelope;\n  const domain = new TextEncoder().encode(\"xyz.tinycloud.share/envelope/v2\\0\");\n  const body = new TextEncoder().encode(canonicalJson(unsigned));\n  const result = new Uint8Array(domain.length + body.length);\n  result.set(domain);\n  result.set(body, domain.length);\n  return result;\n}\n\ninterface PublishedPolicyMetadata {\n  readonly recipientKind: \"exactEmail\" | \"emailDomain\" | \"recipientDid\";\n  readonly actions: readonly ShareAction[];\n  readonly resource: ShareResource;\n}\n\nfunction publishedArtifact(envelope: PublishedShareEnvelopeV2, plaintext: Uint8Array, policy?: PublishedPolicyMetadata): ShareArtifactV2 {\n  const content = bytesToBase64Url(plaintext);\n  const signerKey = publishedPublicKey(envelope.signature.signerDid);\n  return {\n    envelope: {\n      schema: ENVELOPE_SCHEMA,\n      version: 2,\n      origin: envelope.target.origin,\n      spaceId: envelope.target.spaceId,\n      ...(policy === undefined ? { recipientKind: envelope.authorizationTarget.kind === \"bearerKey\" ? \"bearer\" as const : envelope.authorizationTarget.kind === \"recipientDid\" ? \"bearer\" as const : undefined } : { recipientKind: policy.recipientKind }),\n      resource: policy?.resource ?? envelope.target.resource,\n      actions: [...(policy?.actions ?? [\"read\"])],\n      content: {\n        mimeType: \"application/octet-stream\",\n        size: plaintext.byteLength,\n        digest: bytesToBase64Url(sha256(plaintext)),\n      },\n      // Addressed policy metadata is confidential even though this function\n      // is called after the outer envelope has been opened. Keep the\n      // normalized artifact marked encrypted so generic envelope validation\n      // cannot mistake it for a public plaintext grant.\n      encrypted: envelope.authorizationTarget.kind !== \"bearerKey\",\n      expiresAt: envelope.expiry,\n      signer: { did: envelope.signature.signerDid, publicKey: bytesToBase64Url(signerKey) },\n      signature: envelope.signature.value,\n      authorizationTargetKind: envelope.authorizationTarget.kind,\n    },\n    content,\n  };\n}\n\nexport function verifyPublishedShareCid(cid: string, bytes: Uint8Array): boolean {\n  try {\n    const parsed = CID.parse(cid);\n    return parsed.version === 1 && parsed.code === raw.code && parsed.multihash.code === sha256Cid.code && parsed.toString() === cid && publishedCid(bytes) === cid;\n  } catch {\n    return false;\n  }\n}\n\nexport async function openPublishedShareBlob(blob: Uint8Array, key: Uint8Array): Promise<Uint8Array> {\n  if (key.length !== 32 || blob.length < 29 || blob[0] !== 1) throw new ShareEnvelopeError(\"invalid-link\", \"published sealed blob is invalid\");\n  try {\n    const cryptoKey = await crypto.subtle.importKey(\"raw\", key as unknown as ArrayBuffer, \"AES-GCM\", false, [\"decrypt\"]);\n    return new Uint8Array(await crypto.subtle.decrypt({ name: \"AES-GCM\", iv: blob.slice(1, 13) as unknown as ArrayBuffer, additionalData: PUBLISHED_AAD as unknown as ArrayBuffer }, cryptoKey, blob.slice(13) as unknown as ArrayBuffer));\n  } catch (error) {\n    throw new ShareEnvelopeError(\"signature-invalid\", error instanceof Error ? error.message : \"published envelope decryption failed\");\n  }\n}\n\nfunction parsePolicyMetadata(policyBytes: string, target: PublishedShareEnvelopeV2[\"target\"], expectedExpiry: string): PublishedPolicyMetadata {\n  const raw = base64UrlToBytes(policyBytes);\n  const value = parseCanonicalJson(new TextDecoder(\"utf-8\", { fatal: true }).decode(raw));\n  if (!value || typeof value !== \"object\" || Array.isArray(value)) throw new ShareEnvelopeError(\"invalid-envelope\", \"policy material is not an object\");\n  const policy = value as Record<string, unknown>;\n  const version = policy.version;\n  if (policy.type !== \"TinyCloudSharePolicy\" || (version !== 1 && version !== 2)) throw new ShareEnvelopeError(\"invalid-envelope\", \"policy material has an unsupported schema\");\n  if (version === 2 && policy.target !== undefined) {\n    assertKeys(policy, [\"type\", \"version\", \"issuerDid\", \"recipientMatcher\", \"target\", \"delegation\", \"authority\", \"actions\", \"resource\", \"content-source\", \"expiresAt\"], \"published canonical policy material\");\n    if (typeof policy.issuerDid !== \"string\" || typeof policy.expiresAt !== \"string\" || policy.expiresAt !== expectedExpiry) throw new ShareEnvelopeError(\"invalid-envelope\", \"policy expiry is not bound to the envelope\");\n    const matcherValue = policy.recipientMatcher;\n    if (!isPlainObject(matcherValue) || (matcherValue.kind !== \"exactEmail\" && matcherValue.kind !== \"emailDomain\" && matcherValue.kind !== \"recipientDid\") || typeof matcherValue.value !== \"string\") throw new ShareEnvelopeError(\"invalid-envelope\", \"policy matcher is invalid\");\n    const matcher = normalizeRecipient(matcherValue as ShareRecipientTarget);\n    if (matcher === undefined || matcher.kind === \"bearer\") throw new ShareEnvelopeError(\"invalid-envelope\", \"policy matcher is invalid\");\n    if (!isPlainObject(policy.target)) throw new ShareEnvelopeError(\"invalid-envelope\", \"policy target is invalid\");\n    assertKeys(policy.target, [\"origin\", \"nodeAudience\", \"spaceId\"], \"published policy target\");\n    if (policy.target.origin !== target.origin || policy.target.spaceId !== target.spaceId || policy.target.nodeAudience !== target.nodeAudience) throw new ShareEnvelopeError(\"invalid-envelope\", \"policy target is not bound to the envelope\");\n    if (!(typeof policy.delegation === \"string\" || isPlainObject(policy.delegation)) || !(typeof policy.authority === \"string\" || isPlainObject(policy.authority))) throw new ShareEnvelopeError(\"invalid-envelope\", \"policy authority material is invalid\");\n    if (!Array.isArray(policy.actions)) throw new ShareEnvelopeError(\"invalid-envelope\", \"policy actions are invalid\");\n    const actions = normalizeActions(policy.actions as ShareAction[]);\n    if (!isPlainObject(policy.resource) || (policy.resource.kind !== \"exact\" && policy.resource.kind !== \"prefix\") || typeof policy.resource.value !== \"string\") throw new ShareEnvelopeError(\"invalid-envelope\", \"policy resource is invalid\");\n    const resource = normalizeResource({ kind: policy.resource.kind, path: policy.resource.value });\n    if (!resourceContains(resource, target.resource)) throw new ShareEnvelopeError(\"invalid-envelope\", \"policy resource is not bound to the envelope\");\n    if (!isPlainObject(policy[\"content-source\"])) throw new ShareEnvelopeError(\"invalid-envelope\", \"policy content source is missing\");\n    const source = policy[\"content-source\"] as Record<string, unknown>;\n    assertKeys(source, [\"kind\", \"space\", \"path\", \"action\", \"database\", \"statement\", \"arguments\", \"argumentsDigest\", \"digest\"], \"published canonical content source\");\n    if (source.kind !== \"kv\" && source.kind !== \"sql\") throw new ShareEnvelopeError(\"invalid-envelope\", \"policy content source kind is invalid\");\n    if (typeof source.space !== \"string\" || typeof source.path !== \"string\" || typeof source.action !== \"string\") throw new ShareEnvelopeError(\"invalid-envelope\", \"policy content source is invalid\");\n    if (source.kind === \"sql\" && (typeof source.database !== \"string\" || typeof source.statement !== \"string\" || !isPlainObject(source.arguments) || typeof source.argumentsDigest !== \"string\")) throw new ShareEnvelopeError(\"invalid-envelope\", \"policy SQL content source is invalid\");\n    return { recipientKind: matcher.kind, actions, resource };\n  }\n  const allowed = version === 1\n    ? [\"type\", \"version\", \"issuerDid\", \"recipientEmail\", \"expiresAt\", \"action\", \"resource\", \"contentSource\", \"contentSourceDigest\"]\n    : [\"type\", \"version\", \"issuerDid\", \"recipientMatcher\", \"expiresAt\", \"actions\", \"resource\", \"content-source\", \"contentSourceDigest\"];\n  assertKeys(policy, allowed, \"published policy material\");\n  if (typeof policy.issuerDid !== \"string\" || typeof policy.expiresAt !== \"string\" || policy.expiresAt !== expectedExpiry) throw new ShareEnvelopeError(\"invalid-envelope\", \"policy expiry is not bound to the envelope\");\n  const matcher = policy.recipientMatcher;\n  let recipientKind: \"exactEmail\" | \"emailDomain\";\n  if (version === 1) {\n    if (typeof policy.recipientEmail !== \"string\") throw new ShareEnvelopeError(\"invalid-envelope\", \"policy recipient is missing\");\n    normalizeRecipient({ kind: \"exactEmail\", value: policy.recipientEmail });\n    recipientKind = \"exactEmail\";\n  } else {\n    if (!matcher || typeof matcher !== \"object\" || Array.isArray(matcher)) throw new ShareEnvelopeError(\"invalid-envelope\", \"policy matcher is missing\");\n    const parsedMatcher = matcher as Record<string, unknown>;\n    if (parsedMatcher.kind !== \"exactEmail\" && parsedMatcher.kind !== \"emailDomain\" || typeof parsedMatcher.value !== \"string\") throw new ShareEnvelopeError(\"invalid-envelope\", \"policy matcher is invalid\");\n    normalizeRecipient(parsedMatcher as ShareRecipientTarget);\n    if (policy.deliveryEmail !== undefined) normalizeRecipient({ kind: \"exactEmail\", value: policy.deliveryEmail as string });\n    recipientKind = parsedMatcher.kind;\n  }\n  const actionValue = policy.actions ?? policy.action;\n  const actionNames = Array.isArray(actionValue) ? actionValue : [actionValue];\n  const actions = normalizeActions(actionNames.map((action) => action === \"tinycloud.kv/get\" || action === \"get\" || action === \"read\" ? \"read\" : action === \"tinycloud.kv/list\" || action === \"list\" ? \"list\" : action === \"tinycloud.kv/put\" || action === \"tinycloud.kv/edit\" || action === \"put\" || action === \"edit\" ? \"edit\" : action) as ShareAction[]);\n  const resourceValue = policy.resource;\n  let resource: ShareResource;\n  if (resourceValue && typeof resourceValue === \"object\" && !Array.isArray(resourceValue)) {\n    const candidate = resourceValue as Record<string, unknown>;\n    // v2 policy resources use {kind,value}; v1 uses {kind,path}.  Accepting\n    // both here is intentional: the v1 adapter remains read-only while v2\n    // links and vectors use the canonical value spelling.\n    const path = typeof candidate.path === \"string\" ? candidate.path : candidate.value;\n    if (typeof path !== \"string\" || (candidate.kind !== \"exact\" && candidate.kind !== \"prefix\")) throw new ShareEnvelopeError(\"invalid-envelope\", \"policy resource is invalid\");\n    resource = normalizeResource({ kind: candidate.kind, path });\n  } else {\n    resource = normalizeResource({ kind: \"exact\", path: typeof resourceValue === \"string\" ? resourceValue : target.resource.path });\n  }\n  // The policy/delegation is the authority ceiling.  The envelope may only\n  // attenuate it; the inverse check would accept a policy for one exact file\n  // wrapped in a broader prefix envelope.\n  if (!resourceContains(resource, target.resource)) throw new ShareEnvelopeError(\"invalid-envelope\", \"policy resource is not bound to the envelope\");\n  const contentSourceValue = version === 2 ? policy[\"content-source\"] : policy.contentSource;\n  if (!contentSourceValue || typeof contentSourceValue !== \"object\" || Array.isArray(contentSourceValue)) throw new ShareEnvelopeError(\"invalid-envelope\", \"policy content source is missing\");\n  const source = contentSourceValue as Record<string, unknown>;\n  if (source.kind === \"kv\") {\n    assertKeys(source, [\"kind\", \"space\", \"path\", \"action\"], \"published KV content source\");\n    if (typeof source.space !== \"string\" || typeof source.path !== \"string\" || ![\"tinycloud.kv/get\", \"tinycloud.kv/list\", \"tinycloud.kv/put\"].includes(source.action as string)) throw new ShareEnvelopeError(\"invalid-envelope\", \"published KV content source is invalid\");\n  } else if (source.kind === \"sql\") {\n    assertKeys(source, [\"kind\", \"space\", \"database\", \"path\", \"statement\", \"arguments\", \"argumentsDigest\", \"action\"], \"published SQL content source\");\n    if (typeof source.space !== \"string\" || typeof source.database !== \"string\" || typeof source.path !== \"string\" || typeof source.statement !== \"string\" || !source.arguments || typeof source.arguments !== \"object\" || Array.isArray(source.arguments) || typeof source.argumentsDigest !== \"string\" || source.action !== \"tinycloud.sql/read\") throw new ShareEnvelopeError(\"invalid-envelope\", \"published SQL content source is invalid\");\n    for (const argument of Object.values(source.arguments as Record<string, unknown>)) if (!Number.isSafeInteger(argument)) throw new ShareEnvelopeError(\"invalid-envelope\", \"published SQL arguments are invalid\");\n    if (bytesToBase64Url(sha256(new TextEncoder().encode(canonicalJson(source.arguments)))) !== source.argumentsDigest) throw new ShareEnvelopeError(\"invalid-envelope\", \"published SQL argument digest is invalid\");\n  }\n  else throw new ShareEnvelopeError(\"invalid-envelope\", \"policy content source kind is invalid\");\n  if (typeof policy.contentSourceDigest !== \"string\" || bytesToBase64Url(sha256(new TextEncoder().encode(canonicalJson(source)))) !== policy.contentSourceDigest) throw new ShareEnvelopeError(\"invalid-envelope\", \"policy content source digest is invalid\");\n  return { recipientKind, actions, resource };\n}\n\n/**\n * Parse the canonical Share v2 publication.  The hyphenated content-source\n * member is intentional: it is part of the signed wire contract and is not\n * interchangeable with the v1 contentSource spelling.\n */\nfunction parseCanonicalPublishedV2(value: Record<string, unknown>, options: { readonly expectedOrigin?: string; readonly now?: Date; readonly plaintext?: Uint8Array; readonly trustedSignerDids?: readonly string[] }): { readonly artifact: ShareArtifactV2; readonly envelope: PublishedShareEnvelopeV2 } {\n  assertKeys(value, [\"version\", \"shareId\", \"target\", \"delegation\", \"authority\", \"recipientMatcher\", \"actions\", \"resource\", \"content-source\", \"expiry\", \"signature\"], \"published v2 envelope\");\n  if (value.version !== 2 || typeof value.shareId !== \"string\" || value.shareId.length === 0 || typeof value.expiry !== \"string\") throw new ShareEnvelopeError(\"invalid-envelope\", \"published v2 envelope shape is invalid\");\n  const target = value.target;\n  const delegation = value.delegation;\n  const authority = value.authority;\n  const resourceValue = value.resource;\n  if (!isPlainObject(target) || !isPlainObject(delegation) || !isPlainObject(authority) || !isPlainObject(resourceValue)) throw new ShareEnvelopeError(\"invalid-envelope\", \"published v2 binding is invalid\");\n  assertKeys(target, [\"origin\", \"nodeAudience\", \"spaceId\"], \"published v2 target\");\n  assertKeys(delegation, [\"cid\", \"issuerDid\", \"audience\", \"expiresAt\", \"encoded\"], \"published v2 delegation\");\n  assertKeys(authority, [\"kind\", \"did\", \"publicKey\", \"cid\", \"signature\"], \"published v2 authority\");\n  assertKeys(resourceValue, [\"kind\", \"value\"], \"published v2 resource\");\n  const origin = target.origin;\n  const spaceId = target.spaceId;\n  const nodeAudience = target.nodeAudience;\n  if (typeof origin !== \"string\" || normalizeOrigin(origin) !== origin || typeof spaceId !== \"string\" || spaceId.length === 0 || typeof nodeAudience !== \"string\" || nodeAudience.length === 0) throw new ShareEnvelopeError(\"invalid-envelope\", \"published v2 target is invalid\");\n  if (options.expectedOrigin !== undefined && normalizeOrigin(options.expectedOrigin) !== origin) throw new ShareEnvelopeError(\"origin-mismatch\", \"published envelope origin is not trusted\");\n  const expiry = Date.parse(value.expiry);\n  if (!Number.isFinite(expiry) || expiry <= (options.now ?? new Date()).getTime() || new Date(expiry).toISOString() !== value.expiry) throw new ShareEnvelopeError(\"expired\", \"published share envelope has expired\");\n  if (typeof delegation.cid !== \"string\" || typeof delegation.issuerDid !== \"string\" || typeof delegation.audience !== \"string\" || typeof delegation.expiresAt !== \"string\" || Date.parse(delegation.expiresAt) > expiry) throw new ShareEnvelopeError(\"invalid-envelope\", \"published v2 delegation is invalid\");\n  const matcher = value.recipientMatcher;\n  if (!isPlainObject(matcher) || (matcher.kind !== \"exactEmail\" && matcher.kind !== \"emailDomain\" && matcher.kind !== \"recipientDid\") || typeof matcher.value !== \"string\") throw new ShareEnvelopeError(\"invalid-envelope\", \"published v2 recipient matcher is invalid\");\n  const normalizedMatcher = normalizeRecipient(matcher as ShareRecipientTarget);\n  if (normalizedMatcher === undefined || normalizedMatcher.kind === \"bearer\") throw new ShareEnvelopeError(\"invalid-envelope\", \"published v2 recipient matcher is invalid\");\n  if (!Array.isArray(value.actions)) throw new ShareEnvelopeError(\"invalid-envelope\", \"published v2 actions are invalid\");\n  const actions = normalizeActions(value.actions as ShareAction[]);\n  if (!isPlainObject(value[\"content-source\"])) throw new ShareEnvelopeError(\"invalid-envelope\", \"published v2 content source is invalid\");\n  const contentSource = value[\"content-source\"] as Record<string, unknown>;\n  assertKeys(contentSource, [\"kind\", \"cid\", \"key\", \"digest\", \"mimeType\", \"size\"], \"published v2 content source\");\n  if (typeof contentSource.kind !== \"string\" || typeof contentSource.cid !== \"string\" || !isPublishedCid(contentSource.cid)) throw new ShareEnvelopeError(\"invalid-envelope\", \"published v2 content source is invalid\");\n  const resource = normalizeResource({ kind: resourceValue.kind as ShareResource[\"kind\"], path: resourceValue.value as string });\n  if (resourceValue.kind !== resource.kind || resourceValue.value !== resource.path) throw new ShareEnvelopeError(\"invalid-envelope\", \"published v2 resource is not canonical\");\n  const signature = value.signature;\n  if (!isPlainObject(signature)) throw new ShareEnvelopeError(\"invalid-envelope\", \"published v2 signature is invalid\");\n  assertKeys(signature, [\"signerDid\", \"algorithm\", \"value\"], \"published v2 signature\");\n  if (typeof signature.signerDid !== \"string\" || signature.algorithm !== \"Ed25519\" || typeof signature.value !== \"string\") throw new ShareEnvelopeError(\"invalid-envelope\", \"published v2 signature is invalid\");\n  const signerKey = publishedPublicKey(signature.signerDid);\n  if (options.trustedSignerDids !== undefined && !options.trustedSignerDids.includes(signature.signerDid)) throw new ShareEnvelopeError(\"signature-invalid\", \"a trusted authority is required for addressed shares\");\n  const signatureBytes = base64UrlToBytes(signature.value);\n  const { signature: _signature, ...unsigned } = value;\n  const domain = new TextEncoder().encode(\"xyz.tinycloud.share/envelope/v2\\0\");\n  const body = new TextEncoder().encode(canonicalJson(unsigned));\n  const signingBytes = new Uint8Array(domain.length + body.length);\n  signingBytes.set(domain); signingBytes.set(body, domain.length);\n  if (signatureBytes.length !== 64 || !ed25519.verify(signatureBytes, signingBytes, signerKey)) throw new ShareEnvelopeError(\"signature-invalid\", \"published v2 envelope signature is invalid\");\n  const content = options.plaintext ?? new Uint8Array();\n  const normalized: ShareEnvelopeV2 = {\n    schema: ENVELOPE_SCHEMA,\n    version: 2,\n    origin,\n    spaceId,\n    recipientKind: normalizedMatcher.kind,\n    resource,\n    actions,\n    content: { mimeType: typeof contentSource.mimeType === \"string\" ? contentSource.mimeType : \"application/octet-stream\", size: content.byteLength, digest: bytesToBase64Url(sha256(content)) },\n    encrypted: true,\n    expiresAt: value.expiry,\n    signer: { did: signature.signerDid, publicKey: bytesToBase64Url(signerKey) },\n    signature: signature.value,\n    authorizationTargetKind: \"policy\",\n  };\n  return { envelope: value as unknown as PublishedShareEnvelopeV2, artifact: { envelope: normalized, content: bytesToBase64Url(content) } };\n}\n\nfunction isPlainObject(value: unknown): value is Record<string, unknown> {\n  return value !== null && typeof value === \"object\" && !Array.isArray(value);\n}\n\nfunction parsePublishedEnvelopeObject(value: unknown): PublishedShareEnvelopeV2 {\n  if (!value || typeof value !== \"object\" || Array.isArray(value)) throw new ShareEnvelopeError(\"invalid-envelope\", \"published envelope is not an object\");\n  const envelope = value as Record<string, unknown>;\n  assertKeys(envelope, [\"version\", \"shareId\", \"delegation\", \"authorizationTarget\", \"target\", \"display\", \"expiry\", \"content\", \"signature\"], \"published envelope\");\n  if (envelope.version !== 1 || typeof envelope.shareId !== \"string\" || envelope.shareId.length === 0 || typeof envelope.delegation !== \"string\" || envelope.delegation.length === 0 || typeof envelope.expiry !== \"string\") throw new ShareEnvelopeError(\"invalid-envelope\", \"published envelope shape is invalid\");\n  const target = envelope.target;\n  if (!target || typeof target !== \"object\" || Array.isArray(target)) throw new ShareEnvelopeError(\"invalid-envelope\", \"published target is invalid\");\n  assertKeys(target, [\"origin\", \"nodeAudience\", \"spaceId\", \"resource\"], \"published target\");\n  const targetValue = target as Record<string, unknown>;\n  if (typeof targetValue.origin !== \"string\" || !/^https:\\/\\//.test(targetValue.origin) || normalizeOrigin(targetValue.origin) !== targetValue.origin || typeof targetValue.nodeAudience !== \"string\" || targetValue.nodeAudience.length === 0 || typeof targetValue.spaceId !== \"string\" || targetValue.spaceId.length === 0 || /[\\u0000-\\u001f\\u007f\\\\/]/.test(targetValue.spaceId)) throw new ShareEnvelopeError(\"invalid-envelope\", \"published target binding is invalid\");\n  const resource = normalizeResource(targetValue.resource as ShareResource);\n  if (JSON.stringify(resource) !== JSON.stringify(targetValue.resource)) throw new ShareEnvelopeError(\"invalid-envelope\", \"published resource is not canonical\");\n  const display = envelope.display;\n  if (!display || typeof display !== \"object\" || Array.isArray(display)) throw new ShareEnvelopeError(\"invalid-envelope\", \"published display is invalid\");\n  const displayValue = display as Record<string, unknown>;\n  assertKeys(displayValue, [\"senderName\", \"filename\", \"recipientHint\", \"mode\"], \"published display\");\n  for (const key of [\"senderName\", \"filename\", \"recipientHint\"] as const) if (displayValue[key] !== undefined && typeof displayValue[key] !== \"string\") throw new ShareEnvelopeError(\"invalid-envelope\", \"published display field is invalid\");\n  if (displayValue.mode !== undefined && ![\"document\", \"source\", \"folder\"].includes(displayValue.mode as string)) throw new ShareEnvelopeError(\"invalid-envelope\", \"published display mode is invalid\");\n  const targetAuthorization = envelope.authorizationTarget;\n  if (!targetAuthorization || typeof targetAuthorization !== \"object\" || Array.isArray(targetAuthorization)) throw new ShareEnvelopeError(\"invalid-envelope\", \"published authorization target is invalid\");\n  const authorizationTarget = targetAuthorization as Record<string, unknown>;\n  if (authorizationTarget.kind === \"policy\") {\n    assertKeys(authorizationTarget, [\"kind\", \"policyCid\", \"policyBytes\"], \"published policy target\");\n    if (typeof authorizationTarget.policyCid !== \"string\" || typeof authorizationTarget.policyBytes !== \"string\" || !verifyPublishedShareCid(authorizationTarget.policyCid, base64UrlToBytes(authorizationTarget.policyBytes))) throw new ShareEnvelopeError(\"invalid-envelope\", \"published policy material is not bound\");\n  } else if (authorizationTarget.kind === \"bearerKey\") {\n    assertKeys(authorizationTarget, [\"kind\", \"sessionJwk\"], \"published bearer target\");\n    const jwk = authorizationTarget.sessionJwk;\n    if (!jwk || typeof jwk !== \"object\" || Array.isArray(jwk)) throw new ShareEnvelopeError(\"invalid-envelope\", \"published bearer key is invalid\");\n    const jwkValue = jwk as Record<string, unknown>;\n    assertKeys(jwkValue, [\"kty\", \"crv\", \"x\", \"y\", \"d\", \"alg\", \"use\", \"key_ops\", \"kid\", \"ext\"], \"published session JWK\");\n    if (jwkValue.kty !== \"OKP\" && jwkValue.kty !== \"EC\" || typeof jwkValue.crv !== \"string\" || typeof jwkValue.x !== \"string\" || typeof jwkValue.d !== \"string\") throw new ShareEnvelopeError(\"invalid-envelope\", \"published session JWK is invalid\");\n    if (jwkValue.kty === \"EC\" && typeof jwkValue.y !== \"string\") throw new ShareEnvelopeError(\"invalid-envelope\", \"published EC session JWK is invalid\");\n    if (jwkValue.alg !== undefined && typeof jwkValue.alg !== \"string\" || jwkValue.use !== undefined && typeof jwkValue.use !== \"string\" || jwkValue.kid !== undefined && typeof jwkValue.kid !== \"string\" || jwkValue.ext !== undefined && typeof jwkValue.ext !== \"boolean\" || jwkValue.key_ops !== undefined && (!Array.isArray(jwkValue.key_ops) || jwkValue.key_ops.some((operation) => typeof operation !== \"string\"))) throw new ShareEnvelopeError(\"invalid-envelope\", \"published session JWK members are invalid\");\n    for (const member of [jwkValue.x, jwkValue.y, jwkValue.d]) if (member !== undefined) base64UrlToBytes(member as string);\n  } else if (authorizationTarget.kind === \"recipientDid\") {\n    assertKeys(authorizationTarget, [\"kind\", \"did\"], \"published DID target\");\n    if (typeof authorizationTarget.did !== \"string\" || !/^did:[a-z0-9]+:.+$/.test(authorizationTarget.did)) throw new ShareEnvelopeError(\"invalid-envelope\", \"published recipient DID is invalid\");\n  } else throw new ShareEnvelopeError(\"invalid-envelope\", \"published authorization target kind is invalid\");\n  if (envelope.content !== undefined) {\n    if (!envelope.content || typeof envelope.content !== \"object\" || Array.isArray(envelope.content)) throw new ShareEnvelopeError(\"invalid-envelope\", \"published content pointer is invalid\");\n    assertKeys(envelope.content, [\"cid\", \"key\"], \"published content pointer\");\n    const content = envelope.content as Record<string, unknown>;\n    if (typeof content.cid !== \"string\" || typeof content.key !== \"string\" || !isPublishedCid(content.cid)) throw new ShareEnvelopeError(\"invalid-envelope\", \"published content pointer is invalid\");\n    if (base64UrlToBytes(content.key).length !== 32) throw new ShareEnvelopeError(\"invalid-envelope\", \"published content key is invalid\");\n    if (authorizationTarget.kind !== \"bearerKey\") throw new ShareEnvelopeError(\"unsafe-plaintext\", \"policy envelopes cannot contain content pointers\");\n  }\n  const signature = envelope.signature;\n  if (!signature || typeof signature !== \"object\" || Array.isArray(signature)) throw new ShareEnvelopeError(\"invalid-envelope\", \"published signature is invalid\");\n  assertKeys(signature, [\"signerDid\", \"algorithm\", \"value\"], \"published signature\");\n  const signatureValue = signature as Record<string, unknown>;\n  if (typeof signatureValue.signerDid !== \"string\" || signatureValue.algorithm !== \"Ed25519\" || typeof signatureValue.value !== \"string\") throw new ShareEnvelopeError(\"invalid-envelope\", \"published signature is invalid\");\n  const signerKey = publishedPublicKey(signatureValue.signerDid);\n  if (base64UrlToBytes(signatureValue.value).length !== 64) throw new ShareEnvelopeError(\"invalid-envelope\", \"published signature length is invalid\");\n  return envelope as unknown as PublishedShareEnvelopeV2;\n}\n\nexport function parsePublishedShareEnvelope(bytes: Uint8Array, options: { readonly expectedOrigin?: string; readonly now?: Date; readonly plaintext?: Uint8Array; readonly trustedSignerDids?: readonly string[] } = {}): { readonly envelope: PublishedShareEnvelopeV2; readonly artifact: ShareArtifactV2 } {\n  let parsed: unknown;\n  try { parsed = JSON.parse(new TextDecoder(\"utf-8\", { fatal: true }).decode(bytes)); } catch { throw new ShareEnvelopeError(\"invalid-envelope\", \"published envelope is not JSON\"); }\n  if (isPlainObject(parsed) && parsed.version === 2 && parsed[\"content-source\"] !== undefined) {\n    return parseCanonicalPublishedV2(parsed, options);\n  }\n  // Current Share publishes the v2 envelope fields directly (recipient,\n  // actions, encrypted, metadata/content) rather than the older v1\n  // authorizationTarget wrapper.  Keep this adapter strict and normalize it\n  // into the SDK artifact shape before any policy/session work.\n  if (parsed && typeof parsed === \"object\" && !Array.isArray(parsed) && ((parsed as Record<string, unknown>).schema === ENVELOPE_SCHEMA || ((parsed as Record<string, unknown>).version === 2 && ((parsed as Record<string, unknown>).metadata !== undefined || (parsed as Record<string, unknown>).recipient !== undefined))) ) {\n    const direct = parsed as Record<string, unknown>;\n    const envelopeValue = direct.envelope && typeof direct.envelope === \"object\" && !Array.isArray(direct.envelope) ? direct.envelope as Record<string, unknown> : direct;\n    const value = { ...envelopeValue } as Record<string, unknown>;\n    if (value.content === undefined && value.metadata !== undefined) value.content = value.metadata;\n    delete value.metadata;\n    const contentValue = value.content;\n    if (!contentValue || typeof contentValue !== \"object\" || Array.isArray(contentValue)) throw new ShareEnvelopeError(\"invalid-envelope\", \"published v2 metadata is invalid\");\n    const artifactContent = typeof direct.content === \"string\" ? direct.content : options.plaintext === undefined ? \"\" : bytesToBase64Url(options.plaintext);\n    const artifactValue = { envelope: value, content: artifactContent };\n    const artifact = parseShareArtifact(new TextEncoder().encode(canonicalJson(artifactValue)), { expectedOrigin: options.expectedOrigin, now: options.now, maxContentBytes: DEFAULT_MAX_ARTIFACT_BYTES });\n    if (options.trustedSignerDids !== undefined && artifact.envelope.recipientKind !== undefined && !options.trustedSignerDids.includes(artifact.envelope.signer.did)) throw new ShareEnvelopeError(\"signature-invalid\", \"a trusted authority is required for addressed shares\");\n    return { envelope: direct as unknown as PublishedShareEnvelopeV2, artifact };\n  }\n  const envelope = parsePublishedEnvelopeObject(parsed);\n  if (options.expectedOrigin !== undefined && envelope.target.origin !== options.expectedOrigin) throw new ShareEnvelopeError(\"origin-mismatch\", \"published envelope origin is not trusted\");\n  if (!Number.isFinite(Date.parse(envelope.expiry)) || Date.parse(envelope.expiry) <= (options.now ?? new Date()).getTime()) throw new ShareEnvelopeError(\"expired\", \"published share envelope has expired\");\n  if (new Date(envelope.expiry).toISOString() !== envelope.expiry) throw new ShareEnvelopeError(\"invalid-envelope\", \"published expiry is not canonical\");\n  const policy = envelope.authorizationTarget.kind === \"policy\" ? parsePolicyMetadata(envelope.authorizationTarget.policyBytes, envelope.target, envelope.expiry) : undefined;\n  if (envelope.authorizationTarget.kind !== \"bearerKey\" && (options.trustedSignerDids === undefined || !options.trustedSignerDids.includes(envelope.signature.signerDid))) throw new ShareEnvelopeError(\"signature-invalid\", \"a trusted authority is required for addressed shares\");\n  const signature = base64UrlToBytes(envelope.signature.value);\n  const publicKey = publishedPublicKey(envelope.signature.signerDid);\n  if (signature.length !== 64 || !ed25519.verify(signature, publishedEnvelopeSigningBytes(envelope), publicKey)) throw new ShareEnvelopeError(\"signature-invalid\", \"published envelope signature is invalid\");\n  return { envelope, artifact: publishedArtifact(envelope, options.plaintext ?? new Uint8Array(), policy) };\n}\n\n/**\n * Read the v1 sealed envelope emitted by the existing authenticated Share\n * policy composer. It is deliberately exposed as a read-only compatibility\n * adapter: the resulting artifact carries an authorization marker, so the\n * SDK never treats this policy envelope as a local bearer grant.\n */\nexport function parseLegacyPublishedShareEnvelope(bytes: Uint8Array, options: { readonly expectedOrigin?: string; readonly now?: Date; readonly plaintext?: Uint8Array; readonly trustedSignerDids?: readonly string[] } = {}): { readonly artifact: ShareArtifactV2 } {\n  let parsed: unknown;\n  try { parsed = JSON.parse(new TextDecoder(\"utf-8\", { fatal: true }).decode(bytes)); } catch { throw new ShareEnvelopeError(\"invalid-envelope\", \"published v1 envelope is not JSON\"); }\n  if (typeof parsed !== \"object\" || parsed === null || Array.isArray(parsed)) throw new ShareEnvelopeError(\"invalid-envelope\", \"published v1 envelope is not an object\");\n  const envelope = parsed as Record<string, unknown>;\n  const target = envelope.target as Record<string, unknown> | undefined;\n  const resource = target?.resource as Record<string, unknown> | undefined;\n  const authorizationTarget = envelope.authorizationTarget as Record<string, unknown> | undefined;\n  const signature = envelope.signature as Record<string, unknown> | undefined;\n  assertKeys(envelope, [\"version\", \"shareId\", \"delegation\", \"authorizationTarget\", \"target\", \"display\", \"expiry\", \"content\", \"signature\"], \"published v1 envelope\");\n  if (target !== undefined) assertKeys(target, [\"origin\", \"nodeAudience\", \"spaceId\", \"resource\"], \"published v1 target\");\n  if (resource !== undefined) assertKeys(resource, [\"kind\", \"path\"], \"published v1 resource\");\n  if (authorizationTarget !== undefined) {\n    if (authorizationTarget.kind === \"policy\") assertKeys(authorizationTarget, [\"kind\", \"policyCid\", \"policyBytes\"], \"published v1 policy target\");\n    else if (authorizationTarget.kind === \"bearerKey\") assertKeys(authorizationTarget, [\"kind\", \"sessionJwk\"], \"published v1 bearer target\");\n    else if (authorizationTarget.kind === \"recipientDid\") assertKeys(authorizationTarget, [\"kind\", \"did\"], \"published v1 DID target\");\n    else assertKeys(authorizationTarget, [\"kind\"], \"published v1 authorization target\");\n  }\n  if (signature !== undefined) assertKeys(signature, [\"signerDid\", \"algorithm\", \"value\"], \"published v1 signature\");\n  if (envelope.version !== 1 || typeof envelope.shareId !== \"string\" || typeof envelope.expiry !== \"string\" || typeof target?.origin !== \"string\" || typeof target.spaceId !== \"string\" || typeof target.nodeAudience !== \"string\" || (resource?.kind !== \"exact\" && resource?.kind !== \"prefix\") || typeof resource.path !== \"string\" || typeof authorizationTarget?.kind !== \"string\" || typeof signature?.signerDid !== \"string\" || signature.algorithm !== \"Ed25519\" || typeof signature.value !== \"string\") throw new ShareEnvelopeError(\"invalid-envelope\", \"published v1 envelope shape is invalid\");\n  if (options.expectedOrigin !== undefined && target.origin !== options.expectedOrigin) throw new ShareEnvelopeError(\"origin-mismatch\", \"published envelope origin is not trusted\");\n  const expiry = Date.parse(envelope.expiry);\n  if (!Number.isFinite(expiry) || expiry <= (options.now ?? new Date()).getTime()) throw new ShareEnvelopeError(\"expired\", \"published share envelope has expired\");\n  const signerKey = publishedPublicKey(signature.signerDid);\n  if (authorizationTarget.kind !== \"bearer\" && (options.trustedSignerDids === undefined || !options.trustedSignerDids.includes(signature.signerDid))) throw new ShareEnvelopeError(\"signature-invalid\", \"a trusted authority is required for addressed shares\");\n  const signatureBytes = base64UrlToBytes(signature.value);\n  const { signature: _signature, ...unsigned } = envelope;\n  const domain = new TextEncoder().encode(\"xyz.tinycloud.share/envelope/v1\\0\");\n  const body = new TextEncoder().encode(canonicalJson(unsigned));\n  const signingBytes = new Uint8Array(domain.length + body.length);\n  signingBytes.set(domain); signingBytes.set(body, domain.length);\n  if (signatureBytes.length !== 64 || !ed25519.verify(signatureBytes, signingBytes, signerKey)) throw new ShareEnvelopeError(\"signature-invalid\", \"published v1 envelope signature is invalid\");\n  const content = options.plaintext ?? new Uint8Array();\n  const artifact: ShareArtifactV2 = {\n    envelope: {\n      schema: ENVELOPE_SCHEMA,\n      version: 2,\n      origin: target.origin,\n      spaceId: target.spaceId,\n      resource: { kind: resource.kind, path: resource.path },\n      recipientKind: authorizationTarget.kind === \"bearer\" ? \"bearer\" : authorizationTarget.kind === \"exact-email\" ? \"exactEmail\" : authorizationTarget.kind === \"email-domain\" ? \"emailDomain\" : undefined,\n      actions: [\"read\"],\n      content: { mimeType: \"application/octet-stream\", size: content.byteLength, digest: bytesToBase64Url(sha256(content)) },\n      encrypted: true,\n      expiresAt: envelope.expiry,\n      signer: { did: signature.signerDid, publicKey: bytesToBase64Url(signerKey) },\n      signature: signature.value,\n      authorizationTargetKind: authorizationTarget.kind,\n    },\n    content: bytesToBase64Url(content),\n  };\n  return { artifact };\n}\n\nexport function parsePublishedShareLink(link: string, options: { readonly trustedOrigins?: readonly string[]; readonly maxInlineBytes?: number } = {}): { readonly origin: string; readonly cid: string; readonly key?: Uint8Array; readonly sealed?: Uint8Array } {\n  let url: URL;\n  try { url = new URL(link); } catch { throw new ShareEnvelopeError(\"invalid-link\", \"share link must be an absolute URL\"); }\n  const origin = normalizeOrigin(url.origin);\n  if (options.trustedOrigins !== undefined && !options.trustedOrigins.map(normalizeOrigin).includes(origin)) throw new ShareEnvelopeError(\"origin-mismatch\", \"share link origin is not trusted\");\n  if (url.search !== \"\" || url.username !== \"\" || url.password !== \"\") throw new ShareEnvelopeError(\"invalid-link\", \"share link is not canonical\");\n  if (url.pathname === \"/s/inline\" && url.hash.startsWith(\"#v=2&p=\")) {\n    let payload: Record<string, unknown>;\n    try {\n      const bytes = base64UrlToBytes(url.hash.slice(\"#v=2&p=\".length));\n      if (bytes.length > (options.maxInlineBytes ?? DEFAULT_MAX_INLINE_BYTES) * 2) throw new Error(\"inline payload too large\");\n      const value = JSON.parse(new TextDecoder(\"utf-8\", { fatal: true }).decode(bytes)) as unknown;\n      if (typeof value !== \"object\" || value === null || Array.isArray(value)) throw new Error(\"inline payload shape\");\n      payload = value as Record<string, unknown>;\n    } catch (error) { throw new ShareEnvelopeError(\"invalid-link\", error instanceof Error ? error.message : \"invalid inline payload\"); }\n    if (payload.v !== 2 || typeof payload.c !== \"string\" || typeof payload.cid !== \"string\" || (payload.k !== undefined && typeof payload.k !== \"string\") || Object.keys(payload).some((key) => ![\"v\", \"c\", \"cid\", \"k\"].includes(key))) throw new ShareEnvelopeError(\"invalid-link\", \"inline payload fields are invalid\");\n    const sealed = base64UrlToBytes(payload.c);\n    if (!verifyPublishedShareCid(payload.cid, sealed)) throw new ShareEnvelopeError(\"cid-mismatch\", \"inline payload CID does not match\");\n    const key = payload.k === undefined ? undefined : base64UrlToBytes(payload.k);\n    if (key !== undefined && key.length !== 32) throw new ShareEnvelopeError(\"invalid-link\", \"inline payload key is invalid\");\n    return { origin, cid: payload.cid, ...(key === undefined ? {} : { key }), sealed };\n  }\n  const match = /^\\/s\\/([a-z2-7]+)$/.exec(url.pathname);\n  if (match === null || !url.hash.startsWith(\"#k=\")) throw new ShareEnvelopeError(\"invalid-link\", \"published share link is invalid\");\n  const key = base64UrlToBytes(url.hash.slice(3));\n  if (key.length !== 32) throw new ShareEnvelopeError(\"invalid-link\", \"published link key is invalid\");\n  try {\n    const cid = CID.parse(match[1]);\n    if (cid.version !== 1 || cid.code !== raw.code || cid.multihash.code !== sha256Cid.code || cid.toString() !== match[1]) throw new Error(\"CID\");\n  } catch { throw new ShareEnvelopeError(\"invalid-link\", \"published link CID is invalid\"); }\n  return { origin, cid: match[1], key };\n}\n\nexport function parseShareUrl(link: string, options: { readonly trustedOrigins?: readonly string[]; readonly maxInlineBytes?: number } = {}): ShareLinkLocation {\n  let url: URL;\n  try { url = new URL(link); } catch { throw new ShareEnvelopeError(\"invalid-link\", \"share link must be an absolute URL\"); }\n  if (url.search !== \"\") throw new ShareEnvelopeError(\"invalid-link\", \"share links must not contain query parameters\");\n  const origin = normalizeOrigin(url.origin);\n  if (options.trustedOrigins !== undefined && !options.trustedOrigins.map(normalizeOrigin).includes(origin)) throw new ShareEnvelopeError(\"origin-mismatch\", \"share link origin is not trusted\");\n  if (url.pathname === \"/s/inline\" && url.hash.startsWith(\"#v=2&p=\")) {\n    const published = parsePublishedShareLink(link, options);\n    return { kind: \"inline\", origin, cid: published.cid, key: published.key, url: `${url.origin}${url.pathname}`, protocol: \"share-envelope-v2\" };\n  }\n  const match = url.pathname.match(/^\\/s\\/(i\\/)?([^/]+)$/);\n  if (!match) throw new ShareEnvelopeError(\"invalid-link\", \"share link path is invalid\");\n  const fragmentParams = url.hash === \"\" ? undefined : new URLSearchParams(url.hash.slice(1));\n  if (fragmentParams !== undefined && (fragmentParams.get(\"k\") === null || [...fragmentParams.keys()].some((key) => key !== \"k\"))) throw new ShareEnvelopeError(\"invalid-link\", \"share link fragment is not canonical\");\n  const fragment = fragmentParams?.get(\"k\");\n  const key = fragment === null || fragment === undefined ? undefined : base64UrlToBytes(fragment);\n  if (key !== undefined && key.length !== 32) throw new ShareEnvelopeError(\"invalid-link\", \"fragment key must be 32 bytes\");\n  if (match[1] === undefined) {\n    try { if (CID.parse(match[2]).toString() !== match[2]) throw new Error(\"non-canonical CID\"); }\n    catch { throw new ShareEnvelopeError(\"invalid-link\", \"CID is not canonical\"); }\n    const protocol = CID.parse(match[2]).multihash.code === sha256Cid.code ? \"share-envelope-v2\" : \"legacy\";\n    return { kind: \"compact\", origin, cid: match[2], key, url: `${url.origin}${url.pathname}`, protocol };\n  }\n  const inlineBytes = base64UrlToBytes(match[2]);\n  if (inlineBytes.byteLength > (options.maxInlineBytes ?? DEFAULT_MAX_INLINE_BYTES)) throw new ShareEnvelopeError(\"content-too-large\", \"inline share exceeds the configured limit\");\n  return { kind: \"inline\", origin, artifact: parseShareArtifact(inlineBytes), key, url: `${url.origin}${url.pathname}` };\n}\n\nexport function isV2ShareLink(link: string): boolean {\n  try { return new URL(link).pathname.startsWith(\"/s/\"); } catch { return link.startsWith(INLINE_PREFIX); }\n}\n\nexport async function encryptShareBytes(bytes: Uint8Array, key: Uint8Array): Promise<Uint8Array> {\n  return encryptShareBytesAsync(bytes, key);\n}\n\nexport async function encryptShareBytesAsync(bytes: Uint8Array, key: Uint8Array): Promise<Uint8Array> {\n  if (key.length !== 32) throw new ShareEnvelopeError(\"encryption-required\", \"AES-GCM key must be 32 bytes\");\n  const iv = crypto.getRandomValues(new Uint8Array(12));\n  const cryptoKey = await crypto.subtle.importKey(\"raw\", key as unknown as ArrayBuffer, \"AES-GCM\", false, [\"encrypt\"]);\n  const ciphertext = await crypto.subtle.encrypt({ name: \"AES-GCM\", iv: iv as unknown as ArrayBuffer }, cryptoKey, bytes as unknown as ArrayBuffer);\n  return new Uint8Array([...iv, ...new Uint8Array(ciphertext)]);\n}\n\nexport async function decryptShareBytesAsync(bytes: Uint8Array, key: Uint8Array): Promise<Uint8Array> {\n  if (key.length !== 32 || bytes.length < 28) throw new ShareEnvelopeError(\"invalid-envelope\", \"encrypted share bytes are invalid\");\n  try {\n    const cryptoKey = await crypto.subtle.importKey(\"raw\", key as unknown as ArrayBuffer, \"AES-GCM\", false, [\"decrypt\"]);\n    return new Uint8Array(await crypto.subtle.decrypt({ name: \"AES-GCM\", iv: bytes.slice(0, 12) as unknown as ArrayBuffer }, cryptoKey, bytes.slice(12) as unknown as ArrayBuffer));\n  } catch {\n    throw new ShareEnvelopeError(\"signature-invalid\", \"share decryption failed\");\n  }\n}\n\nexport function createShareArtifact(input: ShareArtifactInput): ShareArtifactResult {\n  const key = input.encryptionKey;\n  if (input.recipient !== undefined && key === undefined) throw new ShareEnvelopeError(\"encryption-required\", \"recipient shares require encryption\");\n  if (input.plaintextPolicyOnly && (!input.plaintextWarningAcknowledged || input.bytes.byteLength !== 0 || input.recipient !== undefined || key !== undefined)) throw new ShareEnvelopeError(\"unsafe-plaintext\", \"plaintext policy artifacts require explicit acknowledgement and contain no content\");\n  if (input.bytes.byteLength > (input.maxContentBytes ?? DEFAULT_MAX_ARTIFACT_BYTES)) throw new ShareEnvelopeError(\"content-too-large\", \"share content exceeds the configured limit\");\n  if (key !== undefined) throw new ShareEnvelopeError(\"invalid-envelope\", \"use createShareArtifactAsync for encryption\");\n  const envelope = signShareEnvelope({\n    schema: ENVELOPE_SCHEMA,\n    version: 2,\n    origin: input.origin,\n    spaceId: input.spaceId,\n    recipient: input.recipient,\n    recipientKind: input.recipient?.kind,\n    resource: input.resource,\n    actions: input.actions,\n    content: { mimeType: input.mimeType, size: input.bytes.byteLength, digest: contentDigest(input.bytes), ...(input.mimeType.startsWith(\"text/\") ? { charset: \"utf-8\" as const } : {}) },\n    encrypted: false,\n    expiresAt: input.expiresAt.toISOString(),\n    signerDid: input.signerDid,\n    signerPrivateKey: input.signerPrivateKey,\n  });\n  const artifact = { envelope, content: bytesToBase64Url(input.bytes) } satisfies ShareArtifactV2;\n  return { artifact, bytes: encodeShareArtifact(artifact), cid: computeShareCid(encodeShareArtifact(artifact)) };\n}\n\nexport async function createShareArtifactAsync(input: ShareArtifactInput): Promise<ShareArtifactResult> {\n  const recipient = input.recipient === undefined ? undefined : normalizeShareRecipientTarget(input.recipient);\n  if (recipient !== undefined && input.encryptionKey === undefined) throw new ShareEnvelopeError(\"encryption-required\", \"recipient shares require encryption\");\n  if (input.plaintextPolicyOnly && (!input.plaintextWarningAcknowledged || input.bytes.byteLength !== 0 || recipient !== undefined || input.encryptionKey !== undefined)) throw new ShareEnvelopeError(\"unsafe-plaintext\", \"plaintext policy artifacts require explicit acknowledgement and contain no content\");\n  if (input.bytes.byteLength > (input.maxContentBytes ?? MAX_SHARE_CONTENT_BYTES)) throw new ShareEnvelopeError(\"content-too-large\", \"share plaintext exceeds the configured limit\");\n  const encryptedBytes = input.encryptionKey === undefined ? input.bytes : await encryptShareBytesAsync(input.bytes, input.encryptionKey);\n  if (encryptedBytes.byteLength > MAX_SEALED_SHARE_CONTENT_BYTES) throw new ShareEnvelopeError(\"content-too-large\", \"sealed share content exceeds the configured limit\");\n  const envelope = signShareEnvelope({\n    schema: ENVELOPE_SCHEMA,\n    version: 2,\n    origin: input.origin,\n    spaceId: input.spaceId,\n    resource: input.resource,\n    actions: input.actions,\n    content: { mimeType: input.mimeType, size: encryptedBytes.byteLength, digest: contentDigest(encryptedBytes), ...(input.mimeType.startsWith(\"text/\") ? { charset: \"utf-8\" as const } : {}) },\n    encrypted: input.encryptionKey !== undefined,\n    expiresAt: input.expiresAt.toISOString(),\n    signerDid: input.signerDid,\n    signerPrivateKey: input.signerPrivateKey,\n    ...(recipient?.kind === \"bearer\" ? { recipient } : {}),\n    ...(recipient === undefined ? {} : { recipientKind: recipient.kind }),\n  });\n  const artifact = { envelope, content: bytesToBase64Url(encryptedBytes) } satisfies ShareArtifactV2;\n  const bytes = encodeShareArtifact(artifact);\n  return { artifact, bytes, cid: computeShareCid(bytes), key: input.encryptionKey };\n}\n\nexport function intersectShareCapabilities(granted: ShareCapabilityLike, requested: ShareCapabilityLike): ShareCapabilityLike | undefined {\n  if (granted.spaceId !== requested.spaceId) return undefined;\n  const path = intersectSharePaths(granted.resource, requested.resource);\n  if (path === undefined) return undefined;\n  const actions = requested.actions.filter((action) => granted.actions.includes(action));\n  if (actions.length === 0) return undefined;\n  return { spaceId: granted.spaceId, resource: path, actions: [...new Set(actions)].sort() as ShareAction[] };\n}\n\nexport interface ShareCapabilityLike { readonly spaceId: string; readonly resource: ShareResource; readonly actions: readonly ShareAction[]; }\n\nfunction intersectSharePaths(left: ShareResource, right: ShareResource): ShareResource | undefined {\n  if (left.kind === \"exact\" && right.kind === \"exact\") return left.path === right.path ? left : undefined;\n  if (left.kind === \"exact\") return resourceContains(right, left) ? left : undefined;\n  if (right.kind === \"exact\") return resourceContains(left, right) ? right : undefined;\n  if (resourceContains(left, right)) return right;\n  if (resourceContains(right, left)) return left;\n  return undefined;\n}\n\nexport function shareCapabilityAllows(capability: ShareCapabilityLike, action: ShareAction, path: string): boolean {\n  if (!capability.actions.includes(action)) return false;\n  if (capability.resource.kind === \"exact\") return action !== \"list\" && capability.resource.path === path;\n  const prefix = capability.resource.path.replace(/\\/$/, \"\");\n  if (action === \"list\") return path.replace(/\\/$/, \"\") === prefix;\n  const remainder = path.startsWith(`${prefix}/`) ? path.slice(prefix.length + 1) : \"\";\n  return remainder.length > 0 && !remainder.includes(\"/\");\n}\n\nexport { ENVELOPE_SCHEMA, INLINE_PREFIX, DEFAULT_MAX_INLINE_BYTES };\n","import { sha256 } from \"@noble/hashes/sha256\";\n\nexport interface ShareCacheKey {\n  readonly cid: string;\n  readonly expiresAt: string;\n}\n\nexport interface ShareCacheMetadata {\n  readonly contentType: string;\n  readonly size: number;\n  readonly encrypted: boolean;\n}\n\nexport interface ShareCacheEntry {\n  readonly key: ShareCacheKey;\n  readonly bytes: Uint8Array;\n  readonly digest: Uint8Array;\n  readonly metadata: ShareCacheMetadata;\n}\n\nexport interface ShareCache {\n  get(key: ShareCacheKey, now?: Date): Promise<Uint8Array | undefined>;\n  /** Retrieve a valid entry without a process-local expiry index. */\n  getByCid?(cid: string, now?: Date): Promise<ShareCacheEntry | undefined>;\n  set(key: ShareCacheKey, bytes: Uint8Array, metadata: ShareCacheMetadata): Promise<void>;\n  delete(key: ShareCacheKey): Promise<void>;\n  clear(): Promise<void>;\n}\n\nfunction cacheKey(key: ShareCacheKey): string {\n  if (!key.cid || !key.expiresAt) throw new Error(\"share cache keys require CID and expiry\");\n  return `${key.cid}\\0${key.expiresAt}`;\n}\n\nfunction digest(bytes: Uint8Array): Uint8Array {\n  return sha256(bytes);\n}\n\nfunction equalBytes(left: Uint8Array, right: Uint8Array): boolean {\n  if (left.byteLength !== right.byteLength) return false;\n  return left.every((byte, index) => byte === right[index]);\n}\n\n/**\n * A deliberately memory-only cache. It stores verified artifact bytes and\n * non-secret metadata only; fragment keys, presentations, sessions, and\n * decrypted content never cross this boundary.\n */\nexport class MemoryShareCache implements ShareCache {\n  private readonly entries = new Map<string, ShareCacheEntry>();\n\n  constructor(private readonly now: () => Date = () => new Date()) {}\n\n  async get(key: ShareCacheKey, now = new Date()): Promise<Uint8Array | undefined> {\n    const mapKey = cacheKey(key);\n    const entry = this.entries.get(mapKey);\n    if (entry === undefined) return undefined;\n    if (Date.parse(entry.key.expiresAt) <= now.getTime() || !equalBytes(entry.digest, digest(entry.bytes))) {\n      this.entries.delete(mapKey);\n      return undefined;\n    }\n    return entry.bytes.slice();\n  }\n\n  async getByCid(cid: string, now = new Date()): Promise<ShareCacheEntry | undefined> {\n    const entries = [...this.entries.values()].filter((entry) => entry.key.cid === cid);\n    for (const entry of entries) {\n      if (Date.parse(entry.key.expiresAt) <= now.getTime() || !equalBytes(entry.digest, digest(entry.bytes))) {\n        this.entries.delete(cacheKey(entry.key));\n        continue;\n      }\n      return {\n        key: { ...entry.key },\n        bytes: entry.bytes.slice(),\n        digest: entry.digest.slice(),\n        metadata: { ...entry.metadata },\n      };\n    }\n    return undefined;\n  }\n\n  async set(key: ShareCacheKey, bytes: Uint8Array, metadata: ShareCacheMetadata): Promise<void> {\n    if (Date.parse(key.expiresAt) <= this.now().getTime()) return;\n    this.entries.set(cacheKey(key), {\n      key: { cid: key.cid, expiresAt: key.expiresAt },\n      bytes: bytes.slice(),\n      digest: digest(bytes),\n      metadata: { ...metadata },\n    });\n  }\n\n  async delete(key: ShareCacheKey): Promise<void> {\n    this.entries.delete(cacheKey(key));\n  }\n\n  async clear(): Promise<void> {\n    this.entries.clear();\n  }\n}\n","import type { FetchFunction, IKVService, InvokeFunction, Result, ServiceError, ServiceHeaders, ServiceSession } from \"@tinycloud/sdk-services\";\nimport type { ShareAction, ShareCapabilityLike, ShareEnvelopeV2, ShareLinkLocation, ShareResource, ShareRecipientTarget } from \"./share-envelope\";\n\nexport type { ShareAction, ShareEnvelopeV2, ShareLinkLocation, ShareResource, ShareRecipientTarget };\n\n/** Native action names used by the addressed Node data plane. */\nexport type ShareNativeAction = \"tinycloud.kv/get\" | \"tinycloud.kv/metadata\" | \"tinycloud.kv/list\" | \"tinycloud.kv/put\";\nexport type ShareWireAction = ShareNativeAction | \"tinycloud.sql/read\";\nexport type ShareAddressedRecipientMatcher = Exclude<ShareRecipientTarget, { readonly kind: \"bearer\" }>;\n\n/** The closed v2 content-source union emitted by Node. */\nexport interface ShareKvContentSource {\n  readonly kind: \"kv\";\n  readonly action: ShareNativeAction;\n  readonly space: string;\n  readonly path: string;\n}\n\nexport interface ShareSqlContentSource {\n  readonly kind: \"sql\";\n  readonly action: \"tinycloud.sql/read\";\n  readonly space: string;\n  readonly database: string;\n  readonly path: string;\n  readonly statement: string;\n  readonly arguments: Readonly<Record<string, number>>;\n  readonly argumentsDigest: string;\n}\n\nexport type ShareContentSource = ShareKvContentSource | ShareSqlContentSource;\n\n/** Inclusive expiry interval resolved by Node for an addressed policy. */\nexport interface ShareExpiryBounds {\n  readonly expiryMin?: string;\n  readonly expiryMax?: string;\n}\n\n/** Node's closed addressed-authoring v2 request. */\nexport interface ShareAddressedDelegationRequestV2 {\n  readonly version: 2;\n  readonly nonce: string;\n  readonly jti: string;\n  readonly senderDid: string;\n  readonly recipientMatcher: ShareAddressedRecipientMatcher;\n  readonly targetOrigin: string;\n  readonly nodeAudience: string;\n  readonly shareCid: string;\n  readonly shareId: string;\n  readonly delegationCid: string;\n  readonly authorityMaterialHandle: string;\n  readonly authorityMaterialDigest: string;\n  readonly contentSource: ShareContentSource;\n  readonly contentSourceDigest: string;\n  readonly actions: readonly ShareWireAction[];\n  readonly resource: { readonly kind: \"exact\" | \"prefix\"; readonly value: string };\n  readonly expiresAt: string;\n  readonly requestBodyDigest: string;\n}\n\nexport interface ShareAddressedDelegationEnvelopeV2 {\n  readonly request: ShareAddressedDelegationRequestV2;\n  readonly proof: ShareDetachedProof;\n}\n\nexport interface ShareAddressedDelegationResponseV2 {\n  readonly type: \"TinyCloudShareAddressedDelegation\";\n  readonly version: 2;\n  readonly nonce: string;\n  readonly jti: string;\n  readonly policyCid: string;\n  readonly policyBytes: string;\n  readonly policyDigest: string;\n  readonly delegationCid: string;\n  readonly delegationBytes: string;\n  readonly delegationDigest: string;\n  readonly authorityMaterialHandle: string;\n  readonly authorityMaterialDigest: string;\n  readonly actions: readonly ShareWireAction[];\n  readonly resource: { readonly kind: \"exact\" | \"prefix\"; readonly value: string };\n  readonly expiresAt: string;\n  readonly proof: ShareDetachedProof;\n}\n\n/** Closed v1 policy-session response emitted by Node's compatibility route. */\nexport interface SharePolicySessionWireV1 {\n  readonly type: \"TinyCloudSharePolicySession\";\n  readonly version: 1;\n  readonly sessionId: string;\n  readonly shareCid: string;\n  readonly shareId: string;\n  readonly delegationCid: string;\n  readonly authorityMaterialHandle: string;\n  readonly authorityMaterialDigest: string;\n  readonly policyCid: string;\n  readonly contentSource: ShareContentSource;\n  readonly contentSourceDigest: string;\n  readonly holderDid: string;\n  readonly targetOrigin: string;\n  readonly nodeAudience: string;\n  readonly action: ShareWireAction;\n  readonly actions?: readonly ShareWireAction[];\n  readonly resource: string;\n  readonly credentialDigest: string;\n  readonly issuedAt: string;\n  readonly expiresAt: string;\n}\n\n/** Explicit v1 wire names retained for callers using the legacy read path. */\nexport type SharePolicySessionV1 = SharePolicySession;\nexport type ShareReadInvocationV1 = ShareNativeInvokeInput;\n\nexport interface ShareRecipientPolicy {\n  readonly recipientMatcher: ShareRecipientTarget;\n  readonly spaceId: string;\n  readonly resource: ShareResource;\n  readonly actions: readonly ShareAction[];\n  readonly expiresAt: Date;\n}\n\nexport interface ShareRecipientClientOptions {\n  readonly trustedOrigins: readonly string[];\n  readonly fetch?: FetchFunction;\n  readonly invoke?: InvokeFunction;\n  readonly createKVService?: (config: {\n    hosts: string[];\n    session: ServiceSession;\n    invoke: InvokeFunction;\n    fetch?: FetchFunction;\n    pathPrefix?: string;\n  }) => IKVService;\n  /** Raw publication endpoint. The default is the Share raw artifact route. */\n  readonly artifactUrl?: (input: { readonly origin: string; readonly cid: string }) => string;\n  /** Trusted signer DIDs for addressed policy artifacts. */\n  readonly trustedSignerDids?: readonly string[];\n  /** A verified Node policy session. It is intentionally not a bearer token. */\n  readonly establishPolicySession?: (input: {\n    readonly envelope: ShareEnvelopeV2;\n    readonly presentation?: unknown;\n  }) => Promise<SharePolicySession>;\n  /** Direct DID authorization is explicit and may return a resumable device step. */\n  readonly establishRecipientDidSession?: (input: {\n    readonly envelope: ShareEnvelopeV2;\n    readonly recipientDid: string;\n  }) => Promise<SharePolicySession | { readonly state: \"authorization-required\"; readonly method: \"openkey-device\"; readonly continueUrl?: string; readonly resumeToken: string } | { readonly state: \"denied\"; readonly reason: string }>;\n  /**\n   * Builds the holder presentation/session request after Node returns a\n   * fresh challenge.  The callback is deliberately invoked only after the\n   * challenge proof has been verified; callers cannot precompute a reusable\n   * nonce-bound session request.\n   */\n  readonly buildPolicySessionRequest?: (input: {\n    readonly envelope: ShareEnvelopeV2;\n    readonly challenge: Readonly<Record<string, unknown>>;\n    readonly challengeRequest: Readonly<Record<string, unknown>>;\n  }) => Promise<unknown> | unknown;\n  /**\n   * Authoritative Node policy tuple. This is supplied by the Share host after\n   * Node has created/persisted the policy; the recipient never invents it.\n   */\n  readonly policyBinding?: SharePolicyBinding;\n  /** Holder proof signer used for the strict Node session and /invoke wires. */\n  readonly holderSigner?: (input: {\n    readonly domain: string;\n    readonly message: Readonly<Record<string, unknown>>;\n  }) => Promise<ShareDetachedProof> | ShareDetachedProof;\n  /**\n   * Node's addressed-sharing data plane. Implementations must sign the\n   * application/vnd.tinycloud.share+json request with the holder proof and\n   * send it to Node /invoke; the SDK never turns a policy session into a\n   * generic KV bearer session.\n   */\n  readonly nativeInvoke?: (input: ShareNativeInvokeInput) => Promise<ShareNativeInvokeResult>;\n  /** Optional holder signer for the built-in addressed /invoke transport. */\n  readonly signNativeInvoke?: (input: {\n    readonly envelope: ShareEnvelopeV2;\n    readonly session: SharePolicySession;\n    readonly request: Readonly<Record<string, unknown>>;\n  }) => Promise<ServiceHeaders> | ServiceHeaders;\n  /** Optional route overrides for deployments that mount Share under a prefix. */\n  readonly policyRoutes?: {\n    readonly challenge?: string;\n    readonly session?: string;\n  };\n  readonly presentation?: unknown;\n  readonly bearerSession?: ServiceSession;\n  readonly cache?: import(\"./ShareCache\").ShareCache;\n  readonly now?: () => Date;\n  readonly maxInlineBytes?: number;\n  readonly maxArtifactBytes?: number;\n  readonly maxContentBytes?: number;\n  readonly maxSealedContentBytes?: number;\n}\n\nexport interface SharePolicySession {\n  readonly type?: \"TinyCloudSharePolicySession\";\n  readonly version?: 1 | 2;\n  readonly sessionId: string;\n  readonly envelopeCid?: string;\n  readonly registrationCid?: string;\n  readonly shareCid?: string;\n  readonly shareId?: string;\n  readonly policyCid?: string;\n  readonly enforcementDelegationCid?: string;\n  readonly runtimeDelegation?: unknown;\n  readonly holderDid: string;\n  readonly expiresAt: string;\n  readonly expiryMin?: string;\n  readonly expiryMax?: string;\n  readonly capability?: ShareCapabilityLike;\n  readonly delegationCid?: string;\n  readonly authorityMaterialHandle?: string;\n  readonly authorityMaterialDigest?: string;\n  readonly contentSource?: ShareContentSource;\n  readonly contentSourceDigest?: string;\n  readonly targetOrigin?: string;\n  readonly nodeAudience?: string;\n  readonly action?: ShareWireAction | ShareAction;\n  readonly actions?: readonly (ShareWireAction | ShareAction)[];\n  readonly resource?: ShareResource | string;\n  readonly credentialDigest?: string;\n  readonly credential?: string;\n  readonly holderBinding?: unknown;\n  readonly readSignerDid?: string;\n  readonly holderSigner?: ShareRecipientClientOptions[\"holderSigner\"];\n  /** Legacy v1 transport fields retained for compatibility with Node sessions. */\n  readonly authorization?: string;\n  readonly delegationHeader?: { readonly Authorization?: string };\n  readonly spaceId?: string;\n  readonly origin?: string;\n  readonly audience?: string;\n  readonly sourceDigest?: string;\n  readonly verificationMethod?: string;\n  readonly jwk?: Readonly<Record<string, unknown>>;\n}\n\nexport interface ShareDetachedProof {\n  readonly alg: \"EdDSA\";\n  readonly kid: string;\n  readonly signature: string;\n}\n\n/** Exact fields Node resolves from its persisted policy authority tuple. */\nexport interface SharePolicyBinding {\n  readonly envelopeCid?: string;\n  readonly shareCid: string;\n  readonly shareId: string;\n  readonly registrationCid?: string;\n  readonly delegationCid: string;\n  readonly authorityMaterialHandle: string;\n  readonly authorityMaterialDigest: string;\n  readonly policyCid: string;\n  readonly enforcementDelegationCid?: string;\n  readonly enforcementDelegation?: unknown;\n  readonly outerEnvelope?: unknown;\n  readonly contentSource: ShareContentSource;\n  readonly contentSourceDigest: string;\n  readonly holderDid?: string;\n  readonly targetOrigin: string;\n  readonly nodeAudience: string;\n  readonly action?: ShareWireAction | ShareAction;\n  readonly actions?: readonly (ShareWireAction | ShareAction)[];\n  readonly resource: ShareResource | string;\n  readonly expiryMin?: string;\n  readonly expiryMax?: string;\n  readonly expiresAt?: string;\n}\n\nexport interface ShareNativeInvokeInput {\n  readonly envelope: ShareEnvelopeV2;\n  readonly session: SharePolicySession;\n  /** Native Node data-plane verb, kept distinct from public envelope actions. */\n  readonly action: \"get\" | \"metadata\" | \"list\" | \"put\";\n  readonly resource: string;\n  readonly body?: Uint8Array;\n  /** Digest of the exact decoded body; holder signing must cover this value. */\n  readonly bodyDigest?: string;\n  readonly contentType?: string;\n  readonly ifMatch?: string;\n  readonly cursor?: string;\n  readonly limit?: number;\n  readonly mediaType: \"application/vnd.tinycloud.share+json\";\n}\n\n/** The legacy v1 /invoke wrapper remains named and closed for adapters. */\nexport interface ShareNativeInvokeEnvelopeV1 {\n  readonly request: Readonly<Record<string, unknown>>;\n  readonly limit?: number;\n  readonly cursor?: string;\n  readonly body?: string;\n  readonly bodyDigest?: string;\n  readonly ifMatch?: string;\n  readonly contentType?: string;\n}\n\nexport interface ShareNativeInvokeErrorResult {\n  readonly status: number;\n  readonly headers?: Readonly<Record<string, string | undefined>>;\n}\n\nexport interface ShareNativeInvokeSuccessResult {\n  readonly status: number;\n  readonly type: \"TinyCloudShareInvokeResponse\";\n  readonly version: 2;\n  readonly action: ShareNativeAction;\n  readonly resource: string;\n  readonly bytes?: Uint8Array;\n  readonly headers?: Readonly<Record<string, string | undefined>>;\n  readonly keys?: readonly string[];\n  readonly truncated?: boolean;\n  readonly nextCursor?: string;\n  readonly entries?: readonly ShareListEntry[];\n  /** Normalized header aliases accepted by native adapters. */\n  readonly etag?: string;\n  readonly contentType?: string;\n  readonly metadata?: Readonly<Record<string, string>>;\n  readonly content?: string;\n  readonly bodyDigest?: string;\n}\n\nexport type ShareNativeInvokeResult = ShareNativeInvokeErrorResult | ShareNativeInvokeSuccessResult;\n\nexport interface ShareListEntry {\n  readonly path: string;\n  readonly kind: \"file\" | \"folder\";\n}\n\nexport interface ShareReadResult {\n  readonly bytes: Uint8Array;\n  readonly etag?: string;\n  readonly contentType?: string;\n  readonly size: number;\n}\n\nexport interface ShareMetadataResult {\n  readonly metadata: Readonly<Record<string, string>>;\n  readonly etag?: string;\n  readonly contentType?: string;\n  readonly size?: number;\n}\n\nexport interface ShareListResult {\n  readonly keys: readonly string[];\n  readonly entries?: readonly ShareListEntry[];\n  readonly nextCursor?: string;\n  readonly truncated?: boolean;\n}\n\nexport interface ShareSaveOptions {\n  readonly etag: string;\n  readonly contentType?: string;\n}\n\nexport class ShareConflict extends Error {\n  readonly code = \"SHARE_CONFLICT\" as const;\n  readonly path: string;\n  readonly etag?: string;\n\n  constructor(path: string, etag?: string) {\n    super(`The shared object at ${path} changed before it could be saved`);\n    this.name = \"ShareConflict\";\n    this.path = path;\n    this.etag = etag;\n  }\n}\n\nexport class ShareAccessError extends Error {\n  readonly code: string;\n  readonly details?: unknown;\n\n  constructor(code: string, message?: string, details?: unknown) {\n    super(message ?? \"shared access could not be completed\");\n    this.name = \"ShareAccessError\";\n    this.code = code;\n    this.details = details;\n  }\n}\n\nexport interface ShareAccessV2 {\n  readonly kind: \"share-v2\";\n  readonly envelope: ShareEnvelopeV2;\n  readonly location: ShareLinkLocation;\n  readonly resource: ShareResource;\n  readonly actions: readonly ShareAction[];\n  readonly expiresAt: Date;\n  readonly kv?: IKVService;\n  readonly get: (path?: string) => Promise<ShareReadResult>;\n  readonly listChildren: (options?: { readonly path?: string; readonly limit?: number; readonly cursor?: string }) => Promise<ShareListResult>;\n  readonly save: (path: string, bytes: Uint8Array, options: ShareSaveOptions) => Promise<{ readonly etag?: string }>;\n  readonly metadata: (path?: string) => Promise<ShareMetadataResult>;\n}\n\nexport type ShareRecipientResult<T> = Result<T, ServiceError | ShareAccessError | ShareConflict>;\n","import { z } from \"zod\";\n\nexport const ShareRecipientTargetSchema = z.discriminatedUnion(\"kind\", [\n  z.object({ kind: z.literal(\"exactEmail\"), value: z.string().min(1) }).strict(),\n  z.object({ kind: z.literal(\"emailDomain\"), value: z.string().min(1) }).strict(),\n  z.object({ kind: z.literal(\"recipientDid\"), value: z.string().regex(/^did:[a-z0-9]+:.+$/) }).strict(),\n  z.object({ kind: z.literal(\"bearer\") }).strict(),\n]);\n\nexport const ShareResourceSchema = z.discriminatedUnion(\"kind\", [\n  z.object({ kind: z.literal(\"exact\"), path: z.string().min(1) }).strict(),\n  z.object({ kind: z.literal(\"prefix\"), path: z.string().min(1) }).strict(),\n]);\n\nexport const ShareActionSchema = z.enum([\"read\", \"list\", \"edit\"]);\n\nexport const ShareRecipientPolicySchema = z.object({\n  recipientMatcher: ShareRecipientTargetSchema,\n  spaceId: z.string().min(1),\n  resource: ShareResourceSchema,\n  actions: z.array(ShareActionSchema).min(1),\n  expiresAt: z.date(),\n}).strict();\n\nexport const ShareRecipientClientOptionsSchema = z.object({\n  trustedOrigins: z.array(z.string().url()).min(1),\n  maxInlineBytes: z.number().int().positive().optional(),\n  maxArtifactBytes: z.number().int().positive().optional(),\n  maxContentBytes: z.number().int().positive().optional(),\n  maxSealedContentBytes: z.number().int().positive().optional(),\n}).strict();\n\nconst ShareNativeActionSchema = z.enum([\"tinycloud.kv/get\", \"tinycloud.kv/metadata\", \"tinycloud.kv/list\", \"tinycloud.kv/put\"]);\nconst ShareWireActionSchema = z.enum([\"tinycloud.kv/get\", \"tinycloud.kv/metadata\", \"tinycloud.kv/list\", \"tinycloud.kv/put\", \"tinycloud.sql/read\"]);\nconst ShareContentSourceSchema = z.discriminatedUnion(\"kind\", [\n  z.object({\n    kind: z.literal(\"kv\"),\n    action: ShareNativeActionSchema,\n    space: z.string().min(1),\n    path: z.string().min(1),\n  }).strict(),\n  z.object({\n    kind: z.literal(\"sql\"),\n    action: z.literal(\"tinycloud.sql/read\"),\n    space: z.string().min(1),\n    database: z.string().min(1),\n    path: z.string().min(1),\n    statement: z.string().min(1),\n    arguments: z.record(z.number().int().safe()),\n    argumentsDigest: z.string().min(1),\n  }).strict(),\n]);\nconst ShareAddressedRecipientSchema = z.discriminatedUnion(\"kind\", [\n  z.object({ kind: z.literal(\"exactEmail\"), value: z.string().min(1) }).strict(),\n  z.object({ kind: z.literal(\"emailDomain\"), value: z.string().min(1) }).strict(),\n  z.object({ kind: z.literal(\"recipientDid\"), value: z.string().regex(/^did:[a-z0-9]+:.+$/) }).strict(),\n]);\n\nexport const ShareAddressedDelegationRequestV2Schema = z.object({\n  version: z.literal(2),\n  nonce: z.string().min(1),\n  jti: z.string().min(1),\n  senderDid: z.string().min(1),\n  recipientMatcher: ShareAddressedRecipientSchema,\n  targetOrigin: z.string().url(),\n  nodeAudience: z.string().min(1),\n  shareCid: z.string().min(1),\n  shareId: z.string().min(1),\n  delegationCid: z.string().min(1),\n  authorityMaterialHandle: z.string().min(1),\n  authorityMaterialDigest: z.string().min(1),\n  contentSource: ShareContentSourceSchema,\n  contentSourceDigest: z.string().min(1),\n  actions: z.array(ShareWireActionSchema).min(1).refine((actions) => new Set(actions).size === actions.length),\n  resource: z.object({ kind: z.enum([\"exact\", \"prefix\"]), value: z.string().min(1) }).strict(),\n  expiresAt: z.string().datetime({ offset: true }),\n  requestBodyDigest: z.string().min(1),\n}).strict();\n\nexport const ShareAddressedDelegationEnvelopeV2Schema = z.object({\n  request: ShareAddressedDelegationRequestV2Schema,\n  proof: z.object({ alg: z.literal(\"EdDSA\"), kid: z.string().min(1), signature: z.string().min(1) }).strict(),\n}).strict();\n\nexport const ShareAddressedDelegationResponseV2Schema = z.object({\n  type: z.literal(\"TinyCloudShareAddressedDelegation\"),\n  version: z.literal(2),\n  nonce: z.string().min(1),\n  jti: z.string().min(1),\n  policyCid: z.string().min(1),\n  policyBytes: z.string().min(1),\n  policyDigest: z.string().min(1),\n  delegationCid: z.string().min(1),\n  delegationBytes: z.string().min(1),\n  delegationDigest: z.string().min(1),\n  authorityMaterialHandle: z.string().min(1),\n  authorityMaterialDigest: z.string().min(1),\n  actions: z.array(ShareWireActionSchema).min(1).refine((actions) => new Set(actions).size === actions.length),\n  resource: z.object({ kind: z.enum([\"exact\", \"prefix\"]), value: z.string().min(1) }).strict(),\n  expiresAt: z.string().datetime({ offset: true }),\n  proof: z.object({ alg: z.literal(\"EdDSA\"), kid: z.string().min(1), signature: z.string().min(1) }).strict(),\n}).strict();\n\nconst ShareNativeResponseEntrySchema = z.object({\n  path: z.string().min(1),\n  kind: z.enum([\"file\", \"folder\"]),\n}).strict();\n\n/**\n * Closed response envelope for the addressed Node data plane.\n * Addressed native responses are closed v2 envelopes.  Every operation binds\n * its exact action and resource before action-specific fields are consumed.\n */\nconst ShareNativeResponseBase = {\n  type: z.literal(\"TinyCloudShareInvokeResponse\"),\n  version: z.literal(2),\n  resource: z.string().min(1),\n};\n\nexport const ShareNativeResponseSchema = z.discriminatedUnion(\"action\", [\n  z.object({\n    ...ShareNativeResponseBase,\n    action: z.literal(\"tinycloud.kv/metadata\"),\n    metadata: z.record(z.string()),\n    etag: z.string().min(1).nullable(),\n  }).strict(),\n  z.object({\n    ...ShareNativeResponseBase,\n    action: z.literal(\"tinycloud.kv/get\"),\n    mediaType: z.string().min(1),\n    content: z.string(),\n    bodyDigest: z.string().min(1),\n    etag: z.string().min(1).nullable(),\n  }).strict(),\n  z.object({\n    ...ShareNativeResponseBase,\n    action: z.literal(\"tinycloud.kv/list\"),\n    entries: z.array(ShareNativeResponseEntrySchema),\n    nextCursor: z.string().min(1).nullable(),\n  }).strict(),\n  z.object({\n    ...ShareNativeResponseBase,\n    action: z.literal(\"tinycloud.kv/put\"),\n    etag: z.string().min(1),\n    bodyDigest: z.string().min(1),\n    contentType: z.string().min(1),\n  }).strict(),\n]);\n\nexport type ShareNativeResponse = z.infer<typeof ShareNativeResponseSchema>;\n","import { ed25519 } from \"@noble/curves/ed25519\";\nimport { sha256 } from \"@noble/hashes/sha256\";\nimport { base32 } from \"multiformats/bases/base32\";\nimport { CID } from \"multiformats/cid\";\nimport { create as createDigest } from \"multiformats/hashes/digest\";\nimport { sha256 as sha256Cid } from \"multiformats/hashes/sha2\";\nimport * as raw from \"multiformats/codecs/raw\";\nimport { base58btc } from \"multiformats/bases/base58\";\nimport { canonicalizeSignedObjectUnsigned as canonicalize } from \"../policy/signed-object.js\";\n\nexport interface OwnerDelegationReceipt {\n  readonly delegationCid: string;\n  readonly signedDagCbor: Uint8Array;\n  readonly delegation: { readonly delegateDID: string; readonly spaceId: string; readonly path: string; readonly actions: readonly string[]; readonly expiry: Date };\n  /** Exact service-scoped capabilities encoded in the signed owner delegation. */\n  readonly permissions: readonly OwnerDelegationPermission[];\n}\n\nexport interface OwnerDelegationPermission {\n  /** Canonical long-form service name, for example `tinycloud.kv`. */\n  readonly service: string;\n  /** Exact service resource path. Encryption permissions use a network URN. */\n  readonly path: string;\n  /** Canonical full action URNs belonging to `service`. */\n  readonly actions: readonly string[];\n}\n\ninterface CreateOwnerDelegationBase {\n  readonly delegateDid: string;\n  readonly spaceId: string;\n  readonly expiresAt: Date;\n}\n\n/**\n * A wallet-rooted owner delegation accepts either the historical single-path\n * shape or an exact list of service-scoped permissions. The two forms are\n * mutually exclusive so callers cannot sign authority from one field while\n * displaying or persisting a contradictory second field.\n */\nexport type CreateOwnerDelegationParams = CreateOwnerDelegationBase & (\n  | {\n      readonly path: string;\n      readonly actions: readonly string[];\n      readonly permissions?: never;\n    }\n  | {\n      readonly permissions: readonly OwnerDelegationPermission[];\n      readonly path?: never;\n      readonly actions?: never;\n    }\n);\n\nconst MAX_CONTENT_BYTES = 100 * 1024 * 1024;\nconst ENFORCEMENT_DOMAIN = \"xyz.tinycloud.share/policy-enforcement/v2\\0\";\nconst POLICY_DOMAIN = \"xyz.tinycloud.share/policy/v2\\0\";\nexport const OWNER_SHARE_REGISTRATION_DOMAIN = \"xyz.tinycloud.share/policy-registration/v2\\0\";\n\nexport type OwnerShareAction = \"tinycloud.kv/get\" | \"tinycloud.kv/list\" | \"tinycloud.kv/metadata\" | \"tinycloud.kv/put\";\nexport interface OwnerShareDecryption {\n  readonly networkId: string;\n  readonly action: \"tinycloud.encryption/decrypt\";\n}\nexport type OwnerShareMatcher =\n  | { readonly kind: \"exactEmail\"; readonly value: string }\n  | { readonly kind: \"emailDomain\"; readonly value: string }\n  | { readonly kind: \"recipientDid\"; readonly value: string };\n\nexport interface OwnerSharePolicyV2 {\n  readonly type: \"TinyCloudSharePolicy\";\n  readonly version: 2;\n  readonly shareId: string;\n  readonly ownerDid: string;\n  readonly shareKeyDid: string;\n  readonly recipientMatcher: OwnerShareMatcher;\n  readonly target: { readonly origin: string; readonly nodeAudience: string; readonly enforcerDid: string; readonly spaceId: string };\n  readonly resource: { readonly kind: \"exact\" | \"prefix\"; readonly path: string };\n  readonly actions: readonly OwnerShareAction[];\n  readonly decryption?: OwnerShareDecryption;\n  readonly contentSource: { readonly kind: \"kv\"; readonly space: string; readonly path: string; readonly action: \"tinycloud.kv/get\" };\n  readonly contentSourceDigest: string;\n  readonly ownerDelegationCid: string;\n  readonly expiresAt: string;\n}\n\nexport interface DelegatedShareKey {\n  readonly did: string;\n  readonly publicKey: Uint8Array;\n  readonly extractable: boolean;\n  readonly privateJwk?: Record<string, string>;\n  /**\n   * The underlying WebCrypto private key. Non-extractable keys are still\n   * structured-clonable, so this handle (not `privateJwk`) is what callers\n   * must persist (e.g. in IndexedDB) to recover signing across a reload.\n   */\n  readonly cryptoKey: CryptoKey;\n  sign(bytes: Uint8Array): Promise<Uint8Array>;\n  clear(): void;\n}\n\nexport interface SignedDelegation {\n  readonly cid: string;\n  readonly dagCbor: string;\n  readonly issuerDid: string;\n  readonly audienceDid: string;\n  readonly facts: Record<string, string | readonly string[]>;\n  readonly signature: string;\n}\n\nexport interface RegisterOwnerSharePolicyParams {\n  readonly policy: { readonly bytes: Uint8Array; readonly cid: string; readonly proof: string };\n  readonly ownerDelegation: OwnerDelegationReceipt;\n  readonly enforcementDelegation: SignedDelegation;\n  readonly contentSourceDigest: string;\n  /** The enrolled receipt key from the node trust bundle. */\n  readonly nodeProof?: { readonly kid: string; readonly publicKey: Uint8Array };\n}\n\nexport interface OwnerSharePolicyRegistration {\n  readonly registrationCid: string;\n  readonly policyCid: string;\n  readonly ownerDelegationCid: string;\n  readonly enforcementDelegationCid: string;\n  readonly ownerDid: string;\n  readonly shareKeyDid: string;\n  readonly enforcerDid: string;\n  readonly shareId: string;\n  readonly recipientMatcher: OwnerShareMatcher;\n  readonly target: { readonly origin: string; readonly nodeAudience: string; readonly spaceId: string };\n  readonly resource: { readonly kind: \"exact\" | \"prefix\"; readonly path: string };\n  readonly actions: readonly OwnerShareAction[];\n  readonly decryption?: OwnerShareDecryption;\n  readonly contentSource: { readonly kind: \"kv\"; readonly space: string; readonly path: string; readonly action: \"tinycloud.kv/get\" };\n  readonly contentSourceDigest: string;\n  readonly registeredAt: string;\n  readonly expiresAt: string;\n}\n\nexport interface OwnerSharePolicyRegistrationReceipt {\n  readonly registration: OwnerSharePolicyRegistration;\n  readonly proof: { readonly alg: \"EdDSA\"; readonly kid: string; readonly signature: string };\n}\n\nfunction bytes(value: Uint8Array): Uint8Array { return new Uint8Array(value); }\n\nfunction b64(value: Uint8Array): string {\n  if (typeof btoa === \"function\") {\n    let binary = \"\";\n    for (const byte of value) binary += String.fromCharCode(byte);\n    return btoa(binary).replace(/\\+/g, \"-\").replace(/\\//g, \"_\").replace(/=+$/g, \"\");\n  }\n  if (typeof Buffer !== \"undefined\") return Buffer.from(value).toString(\"base64url\");\n  throw new Error(\"base64url encoding is unavailable\");\n}\n\nfunction fromB64(value: string): Uint8Array {\n  if (!/^[A-Za-z0-9_-]+$/.test(value)) throw new Error(\"owner-share value is not canonical base64url\");\n  if (typeof atob === \"function\") {\n    const padded = value.replace(/-/g, \"+\").replace(/_/g, \"/\") + \"=\".repeat((4 - value.length % 4) % 4);\n    return Uint8Array.from(atob(padded), (character) => character.charCodeAt(0));\n  }\n  if (typeof Buffer !== \"undefined\") return new Uint8Array(Buffer.from(value, \"base64url\"));\n  throw new Error(\"base64url decoding is unavailable\");\n}\n\nfunction cid(bytesValue: Uint8Array): string {\n  return CID.createV1(raw.code, createDigest(sha256Cid.code, sha256(bytesValue))).toString(base32.encoder);\n}\n\nfunction digest(bytesValue: Uint8Array): string { return b64(sha256(bytesValue)); }\n\nfunction didKeyFromEd25519PublicKey(publicKey: Uint8Array): string {\n  if (publicKey.length !== 32) throw new Error(\"share key public key must be 32 bytes\");\n  const prefixed = new Uint8Array(34);\n  prefixed.set([0xed, 0x01]);\n  prefixed.set(publicKey, 2);\n  return `did:key:${base58btc.encode(prefixed)}`;\n}\n\nfunction assertCanonical(value: string, label: string): void {\n  if (value !== canonicalize(JSON.parse(value))) throw new Error(`${label} is not canonical JSON`);\n}\n\nfunction dagCborEncode(value: unknown): Uint8Array {\n  const output: number[] = [];\n  const writeHeader = (major: number, length: number): void => {\n    if (!Number.isSafeInteger(length) || length < 0) throw new Error(\"DAG-CBOR value is too large\");\n    if (length < 24) output.push((major << 5) | length);\n    else if (length < 0x100) output.push((major << 5) | 24, length);\n    else if (length < 0x10000) output.push((major << 5) | 25, length >> 8, length & 0xff);\n    else throw new Error(\"DAG-CBOR value is too large\");\n  };\n  const write = (item: unknown): void => {\n    if (item === null) { output.push(0xf6); return; }\n    if (item === false) { output.push(0xf4); return; }\n    if (item === true) { output.push(0xf5); return; }\n    if (typeof item === \"string\") {\n      const encoded = new TextEncoder().encode(item);\n      writeHeader(3, encoded.length); output.push(...encoded); return;\n    }\n    if (typeof item === \"number\" && Number.isSafeInteger(item)) {\n      if (item >= 0) writeHeader(0, item);\n      else writeHeader(1, -1 - item);\n      return;\n    }\n    if (Array.isArray(item)) {\n      writeHeader(4, item.length); item.forEach(write); return;\n    }\n    if (typeof item === \"object\" && item !== null) {\n      const entries = Object.entries(item as Record<string, unknown>).map(([key, value]) => {\n        const keyBytes = dagCborEncode(key);\n        return { key, value, keyBytes };\n      }).sort((left, right) => {\n        if (left.keyBytes.length !== right.keyBytes.length) return left.keyBytes.length - right.keyBytes.length;\n        for (let index = 0; index < left.keyBytes.length; index += 1) {\n          if (left.keyBytes[index] !== right.keyBytes[index]) return left.keyBytes[index] - right.keyBytes[index];\n        }\n        return 0;\n      });\n      writeHeader(5, entries.length);\n      entries.forEach(({ key, value }) => { write(key); write(value); });\n      return;\n    }\n    throw new Error(\"Unsupported DAG-CBOR value\");\n  };\n  write(value);\n  return Uint8Array.from(output);\n}\n\nfunction assertObject(value: unknown, keys: readonly string[], label: string): Record<string, unknown> {\n  if (typeof value !== \"object\" || value === null || Array.isArray(value)) throw new Error(`${label} is invalid`);\n  const record = value as Record<string, unknown>;\n  if (Object.keys(record).length !== keys.length || keys.some((key) => !Object.prototype.hasOwnProperty.call(record, key))) throw new Error(`${label} has unknown or missing fields`);\n  return record;\n}\n\nexport async function createDelegatedShareKey(options: { readonly extractable: boolean }): Promise<DelegatedShareKey> {\n  if (!globalThis.crypto?.subtle) throw new Error(\"WebCrypto Ed25519 is required for delegated share keys\");\n  const generated = await crypto.subtle.generateKey({ name: \"Ed25519\" }, options.extractable, [\"sign\", \"verify\"]) as CryptoKeyPair;\n  const privateKey = generated.privateKey;\n  const publicKey = new Uint8Array(await crypto.subtle.exportKey(\"raw\", generated.publicKey));\n  let cleared = false;\n  const key: DelegatedShareKey = {\n    did: didKeyFromEd25519PublicKey(publicKey),\n    publicKey: bytes(publicKey),\n    extractable: options.extractable,\n    cryptoKey: privateKey,\n    ...(options.extractable ? { privateJwk: await crypto.subtle.exportKey(\"jwk\", privateKey) as Record<string, string> } : {}),\n    async sign(input) {\n      if (cleared) throw new Error(\"share key has been cleared\");\n      return new Uint8Array(await crypto.subtle.sign({ name: \"Ed25519\" }, privateKey, input));\n    },\n    clear() { cleared = true; },\n  };\n  return key;\n}\n\n/**\n * Rehydrate a signer wrapper around a `DelegatedShareKey`'s private\n * `CryptoKey` handle that was persisted (e.g. via IndexedDB structured\n * clone) and recovered after a reload. `privateKey` must be the same\n * non-extractable Ed25519 `CryptoKey` originally produced by\n * {@link createDelegatedShareKey}.\n */\nexport function restoreDelegatedShareKey(input: { readonly privateKey: CryptoKey; readonly publicKey: Uint8Array; readonly extractable: boolean }): DelegatedShareKey {\n  let cleared = false;\n  return {\n    did: didKeyFromEd25519PublicKey(input.publicKey),\n    publicKey: bytes(input.publicKey),\n    extractable: input.extractable,\n    cryptoKey: input.privateKey,\n    async sign(signBytes) {\n      if (cleared) throw new Error(\"share key has been cleared\");\n      if (!globalThis.crypto?.subtle) throw new Error(\"WebCrypto Ed25519 is required for delegated share keys\");\n      return new Uint8Array(await crypto.subtle.sign({ name: \"Ed25519\" }, input.privateKey, signBytes));\n    },\n    clear() { cleared = true; },\n  };\n}\n\nexport async function createPolicyEnforcementDelegation(input: {\n  readonly ownerDelegation: OwnerDelegationReceipt;\n  readonly shareKey: DelegatedShareKey;\n  readonly enforcerDid: string;\n  readonly policyCid: string;\n  readonly shareId: string;\n  readonly spaceId: string;\n  readonly nodeAudience: string;\n  readonly path: string;\n  readonly actions: readonly OwnerShareAction[];\n  readonly decryption?: OwnerShareDecryption;\n  readonly contentSourceDigest: string;\n  readonly expiresAt: string;\n}): Promise<SignedDelegation> {\n  if (input.shareKey.did.length === 0 || input.ownerDelegation.delegationCid.length === 0) throw new Error(\"owner delegation and share key are required\");\n  const facts = {\n    ownerDelegationCid: input.ownerDelegation.delegationCid,\n    policyCid: input.policyCid,\n    shareId: input.shareId,\n    shareKeyDid: input.shareKey.did,\n    enforcerDid: input.enforcerDid,\n    nodeAudience: input.nodeAudience,\n    spaceId: input.spaceId,\n    path: input.path,\n    actions: [...input.actions],\n    ...(input.decryption === undefined ? {} : {\n      decryptionNetworkId: input.decryption.networkId,\n      decryptionAction: input.decryption.action,\n    }),\n    contentSourceDigest: input.contentSourceDigest,\n    expiresAt: input.expiresAt,\n  } satisfies Record<string, string | readonly string[]>;\n  const unsigned = { type: \"TinyCloudSharePolicyEnforcement\", version: 2, issuerDid: input.shareKey.did, audienceDid: input.enforcerDid, facts };\n  const dagCborBytes = dagCborEncode({ domain: ENFORCEMENT_DOMAIN, unsigned });\n  const signature = b64(await input.shareKey.sign(dagCborBytes));\n  return { cid: cid(dagCborBytes), dagCbor: b64(dagCborBytes), issuerDid: input.shareKey.did, audienceDid: input.enforcerDid, facts, signature };\n}\n\nexport async function canonicalOwnerSharePolicy(policy: OwnerSharePolicyV2): Promise<{ readonly bytes: Uint8Array; readonly cid: string; readonly digest: string }> {\n  const text = canonicalize({ domain: POLICY_DOMAIN, policy });\n  const policyBytes = new TextEncoder().encode(text);\n  return { bytes: policyBytes, cid: cid(policyBytes), digest: digest(policyBytes) };\n}\n\nexport function computeOwnerShareRegistrationCid(registration: Omit<OwnerSharePolicyRegistration, \"registrationCid\">): string {\n  return cid(new TextEncoder().encode(canonicalize(registration)));\n}\n\nexport function validateOwnerSharePolicyRegistration(value: unknown, expected: RegisterOwnerSharePolicyParams): OwnerSharePolicyRegistrationReceipt {\n  if (cid(expected.policy.bytes) !== expected.policy.cid) throw new Error(\"submitted owner-share policy bytes do not match its CID\");\n  const root = assertObject(value, [\"registration\", \"proof\"], \"owner-share registration response\");\n  const rawRegistration = root.registration as Record<string, unknown> | undefined;\n  const hasDecryption = typeof rawRegistration === \"object\" && rawRegistration !== null && Object.prototype.hasOwnProperty.call(rawRegistration, \"decryption\");\n  const registration = assertObject(root.registration, [\"registrationCid\", \"policyCid\", \"ownerDelegationCid\", \"enforcementDelegationCid\", \"ownerDid\", \"shareKeyDid\", \"enforcerDid\", \"shareId\", \"recipientMatcher\", \"target\", \"resource\", \"actions\", ...(hasDecryption ? [\"decryption\"] : []), \"contentSource\", \"contentSourceDigest\", \"registeredAt\", \"expiresAt\"], \"owner-share registration\");\n  const proof = assertObject(root.proof, [\"alg\", \"kid\", \"signature\"], \"owner-share registration proof\");\n  if (registration.policyCid !== expected.policy.cid || registration.ownerDelegationCid !== expected.ownerDelegation.delegationCid || registration.enforcementDelegationCid !== expected.enforcementDelegation.cid || registration.contentSourceDigest !== expected.contentSourceDigest) throw new Error(\"owner-share registration is not bound to the submitted chain\");\n  let policyValue: Record<string, unknown>;\n  try { policyValue = JSON.parse(new TextDecoder(\"utf-8\", { fatal: true }).decode(expected.policy.bytes)) as Record<string, unknown>; } catch { throw new Error(\"owner-share policy is not valid JSON\"); }\n  const policy = policyValue.policy as Record<string, unknown> | undefined;\n  if (policyValue.domain !== \"xyz.tinycloud.share/policy/v2\\0\" || policy === undefined || Array.isArray(policy)) throw new Error(\"owner-share policy envelope is invalid\");\n  const target = policy.target as Record<string, unknown> | undefined;\n  const resource = policy.resource as Record<string, unknown> | undefined;\n  const registrationTarget = registration.target as Record<string, unknown>;\n  const registrationResource = registration.resource as Record<string, unknown>;\n  const enforcementFacts = expected.enforcementDelegation.facts;\n  const decryption = policy.decryption as Record<string, unknown> | undefined;\n  const decryptionMatches = decryption === undefined\n    ? registration.decryption === undefined\n    : registration.decryption !== undefined && canonicalize(decryption) === canonicalize(registration.decryption);\n  if (typeof target?.origin !== \"string\" || typeof target.nodeAudience !== \"string\" || typeof target.enforcerDid !== \"string\" || typeof target.spaceId !== \"string\" || typeof resource?.kind !== \"string\" || ![\"exact\", \"prefix\"].includes(resource.kind) || typeof resource?.path !== \"string\" || !Array.isArray(policy.actions) || policy.ownerDid !== registration.ownerDid || policy.shareKeyDid !== registration.shareKeyDid || policy.shareId !== registration.shareId || canonicalize(policy.recipientMatcher) !== canonicalize(registration.recipientMatcher) || target.origin !== registrationTarget.origin || target.nodeAudience !== registrationTarget.nodeAudience || target.enforcerDid !== registration.enforcerDid || target.spaceId !== registrationTarget.spaceId || resource.kind !== registrationResource.kind || resource.path !== registrationResource.path || canonicalize(policy.actions) !== canonicalize(registration.actions) || !decryptionMatches || canonicalize(policy.contentSource) !== canonicalize(registration.contentSource) || policy.expiresAt !== registration.expiresAt || policy.contentSourceDigest !== registration.contentSourceDigest || enforcementFacts.ownerDelegationCid !== registration.ownerDelegationCid || enforcementFacts.policyCid !== registration.policyCid || enforcementFacts.shareKeyDid !== registration.shareKeyDid || enforcementFacts.enforcerDid !== registration.enforcerDid || enforcementFacts.nodeAudience !== registrationTarget.nodeAudience || enforcementFacts.spaceId !== registrationTarget.spaceId || enforcementFacts.path !== registrationResource.path || canonicalize(enforcementFacts.actions) !== canonicalize(registration.actions) || enforcementFacts.decryptionNetworkId !== decryption?.networkId || enforcementFacts.decryptionAction !== decryption?.action || enforcementFacts.expiresAt !== registration.expiresAt) throw new Error(\"owner-share registration is not bound to the canonical policy\");\n  if (typeof registration.registrationCid !== \"string\" || typeof registration.expiresAt !== \"string\" || typeof registration.registeredAt !== \"string\") throw new Error(\"owner-share registration timestamps are invalid\");\n  if (new Date(registration.expiresAt).toISOString() !== registration.expiresAt || Date.parse(registration.expiresAt) <= Date.now()) throw new Error(\"owner-share registration is expired or non-canonical\");\n  const { registrationCid: _registrationCid, ...registrationCore } = registration;\n  if (computeOwnerShareRegistrationCid(registrationCore as unknown as Omit<OwnerSharePolicyRegistration, \"registrationCid\">) !== registration.registrationCid) throw new Error(\"owner-share registration CID does not match its canonical core\");\n  if (proof.alg !== \"EdDSA\" || typeof proof.kid !== \"string\" || typeof proof.signature !== \"string\") throw new Error(\"owner-share registration proof is invalid\");\n  const proofKey = expected.nodeProof;\n  if (proofKey === undefined) throw new Error(\"owner-share registration proof trust material is required\");\n  if (proof.kid !== proofKey.kid) throw new Error(\"owner-share registration proof key is not trusted\");\n  const encodedKid = proofKey.publicKey;\n  if (encodedKid.length === 34 && encodedKid[0] === 0xed && encodedKid[1] === 0x01) {\n    // did:key multicodec prefix is removed below.\n  } else if (encodedKid.length !== 32) throw new Error(\"owner-share registration proof key is invalid\");\n  const publicKey = encodedKid.length === 34 ? encodedKid.slice(2) : encodedKid;\n  const signatureBytes = fromB64(proof.signature);\n  const signedBytes = new TextEncoder().encode(`${OWNER_SHARE_REGISTRATION_DOMAIN}${canonicalize(registrationCore)}`);\n  if (signatureBytes.length !== 64 || !ed25519.verify(signatureBytes, signedBytes, publicKey)) throw new Error(\"owner-share registration proof signature is invalid\");\n  return { registration: registration as unknown as OwnerSharePolicyRegistration, proof: proof as unknown as OwnerSharePolicyRegistrationReceipt[\"proof\"] };\n}\n\n/** Validate the exact UTF-8 response bytes emitted by the registration route. */\nexport function validateOwnerSharePolicyRegistrationBytes(bytesValue: Uint8Array, expected: RegisterOwnerSharePolicyParams): OwnerSharePolicyRegistrationReceipt {\n  let value: unknown;\n  try {\n    value = JSON.parse(new TextDecoder(\"utf-8\", { fatal: true }).decode(bytesValue));\n  } catch {\n    throw new Error(\"owner-share registration response is not valid UTF-8 JSON\");\n  }\n  return validateOwnerSharePolicyRegistration(value, expected);\n}\n\nexport { MAX_CONTENT_BYTES };\n","import { ed25519 } from \"@noble/curves/ed25519\";\nimport { bases } from \"multiformats/basics\";\nimport { bytesToHex, sha256, verifyMessage } from \"viem\";\nimport { parsePkhDid } from \"../identity\";\nimport { canonicalizePolicyCapability, normalizePolicyCapability } from \"./capability\";\nimport {\n  SignatureMaterialError,\n  SignatureVerificationError,\n  SignedObjectDigestError,\n  SignedObjectIdError,\n  SignedObjectProfileError,\n  SignedObjectSchemaError,\n  SigningKeyBindingError,\n  UnsupportedSignatureSuiteError,\n  toSignedObjectError,\n} from \"./errors\";\nimport { type JsonValue, jcsCanonicalize, normalizeJson } from \"./jcs\";\n\nexport const POLICY_SCHEMA = \"xyz.tinycloud.policy/policy/v0\";\nexport const POLICY_STATUS_SCHEMA = \"xyz.tinycloud.policy/status/v0\";\nexport const POLICY_ENGINE_RECORD_SCHEMA =\n  \"xyz.tinycloud.policy/engine-record/v0\";\n\nexport const ED25519_JCS_SIGNATURE_SUITE = \"eddsa-ed25519-sha256-jcs-v1\";\nexport const EIP191_JCS_SIGNATURE_SUITE =\n  \"eip191-secp256k1-sha256-jcs-v1\";\n\nexport type SignedObjectKind = \"Policy\" | \"PolicyStatus\" | \"PolicyEngineRecord\";\n\nexport type SignatureSuite =\n  | typeof ED25519_JCS_SIGNATURE_SUITE\n  | typeof EIP191_JCS_SIGNATURE_SUITE;\n\nexport interface SignedObjectSignature {\n  suite: SignatureSuite;\n  signerDid: string;\n  value: string;\n}\n\nexport type JsonObject = { readonly [key: string]: JsonValue };\n\nexport interface Policy {\n  readonly schema: typeof POLICY_SCHEMA;\n  readonly policyId: string;\n  readonly ownerDid: string;\n  readonly signingKeyDid: string;\n  readonly createdAt: string;\n  readonly expiresAt?: string;\n  readonly resource: JsonObject;\n  readonly when: JsonObject;\n  readonly grant: JsonObject;\n  readonly disclosure?: JsonObject;\n  readonly audit?: JsonObject;\n  readonly signature: SignedObjectSignature;\n}\n\nexport type UnsignedPolicy = Omit<Policy, \"policyId\" | \"signature\">;\n\nexport interface PolicyStatus {\n  readonly schema: typeof POLICY_STATUS_SCHEMA;\n  readonly statusId: string;\n  readonly policyId: string;\n  readonly ownerDid: string;\n  readonly sequence: number;\n  readonly disposition: \"active\" | \"suspended\" | \"revoked\";\n  readonly effectiveAt: string;\n  readonly reasonCode?: string;\n  readonly signingKeyDid: string;\n  readonly signature: SignedObjectSignature;\n}\n\nexport type UnsignedPolicyStatus = Omit<PolicyStatus, \"statusId\" | \"signature\">;\n\nexport interface PolicyEngineRecord {\n  readonly schema: typeof POLICY_ENGINE_RECORD_SCHEMA;\n  readonly engineRecordId: string;\n  readonly ownerDid: string;\n  readonly endpoint: string;\n  readonly audience: string;\n  readonly supportedPolicyVersions: string[];\n  readonly supportedEvidenceVerifiers: string[];\n  readonly grantIssuerDid: string;\n  readonly expiresAt: string;\n  readonly signature: SignedObjectSignature;\n}\n\nexport type UnsignedPolicyEngineRecord = Omit<\n  PolicyEngineRecord,\n  \"engineRecordId\" | \"signature\"\n>;\n\nexport type SignedPolicyObject =\n  | Policy\n  | PolicyStatus\n  | PolicyEngineRecord;\n\nexport type UnsignedPolicyObject =\n  | UnsignedPolicy\n  | UnsignedPolicyStatus\n  | UnsignedPolicyEngineRecord;\n\nexport interface SignedObjectSigner {\n  readonly suite: SignatureSuite;\n  readonly signerDid: string;\n  signDigest(digest: Uint8Array): Promise<Uint8Array | string> | Uint8Array | string;\n}\n\nexport interface SignedObjectMaterial {\n  readonly kind: SignedObjectKind;\n  readonly idField: string;\n  readonly id: string;\n  readonly domain: string;\n  readonly unsigned: JsonObject;\n  readonly jcs: string;\n  readonly jcsBytes: Uint8Array;\n  readonly digest: Uint8Array;\n  readonly digestHex: string;\n}\n\nexport type SignedObjectVerificationResult<T extends SignedPolicyObject> =\n  | { readonly ok: true; readonly object: T; readonly material: SignedObjectMaterial }\n  | { readonly ok: false; readonly error: SignedObjectProfileError };\n\ninterface ObjectDescriptor {\n  readonly kind: SignedObjectKind;\n  readonly schema: string;\n  readonly idField: \"policyId\" | \"statusId\" | \"engineRecordId\";\n  readonly idPrefix: string;\n  readonly domain: string;\n}\n\nconst DESCRIPTORS: Record<SignedObjectKind, ObjectDescriptor> = {\n  Policy: {\n    kind: \"Policy\",\n    schema: POLICY_SCHEMA,\n    idField: \"policyId\",\n    idPrefix: \"pol_\",\n    domain: POLICY_SCHEMA,\n  },\n  PolicyStatus: {\n    kind: \"PolicyStatus\",\n    schema: POLICY_STATUS_SCHEMA,\n    idField: \"statusId\",\n    idPrefix: \"polst_\",\n    domain: POLICY_STATUS_SCHEMA,\n  },\n  PolicyEngineRecord: {\n    kind: \"PolicyEngineRecord\",\n    schema: POLICY_ENGINE_RECORD_SCHEMA,\n    idField: \"engineRecordId\",\n    idPrefix: \"peng_\",\n    domain: POLICY_ENGINE_RECORD_SCHEMA,\n  },\n};\n\nconst textEncoder = new TextEncoder();\nconst BASE32_ALPHABET = \"abcdefghijklmnopqrstuvwxyz234567\";\nconst BASE64URL_RE = /^[A-Za-z0-9_-]+$/;\nconst objectHasOwn: (object: object, propertyKey: PropertyKey) => boolean =\n  (Object as ObjectConstructor & {\n    hasOwn?: (object: object, propertyKey: PropertyKey) => boolean;\n  }).hasOwn ??\n  (Object.prototype.hasOwnProperty.call.bind(\n    Object.prototype.hasOwnProperty,\n  ) as (object: object, propertyKey: PropertyKey) => boolean);\n\nexport function canonicalizeSignedObjectUnsigned(input: unknown): string {\n  return jcsCanonicalize(input);\n}\n\nexport function deriveSignedObjectMaterial(input: unknown): SignedObjectMaterial {\n  const descriptor = descriptorForUnsigned(input);\n  const unsigned = validateUnsignedForDescriptor(input, descriptor);\n  return materialForUnsigned(unsigned, descriptor);\n}\n\nexport function signedObjectIdFor(input: unknown): string {\n  return deriveSignedObjectMaterial(input).id;\n}\n\nexport async function createAndSignSignedObject(\n  input: unknown,\n  signer: SignedObjectSigner,\n): Promise<SignedPolicyObject> {\n  const normalized = expectJsonObject(normalizeJson(input), \"$\");\n  const descriptor = descriptorForUnsigned(normalized);\n  const stripped = stripOwnIdAndSignature(normalized, descriptor);\n  const unsigned = validateUnsignedForDescriptor(stripped, descriptor);\n  if (descriptor.kind === \"Policy\") {\n    validatePolicyPermissionsCeilingForSigning(unsigned);\n  }\n  assertSupportedSignatureSuite(signer.suite);\n  requireStringType(signer.signerDid, \"$.signer.signerDid\");\n  assertSignerDidMatchesSuite(signer.signerDid, signer.suite);\n  assertSigningKeyBindingForCreate(unsigned, signer.signerDid);\n  const material = materialForUnsigned(unsigned, descriptor);\n  const signatureValue = encodeSignatureValue(\n    await signer.signDigest(material.digest),\n    signer.suite,\n  );\n  const signature = validateSignature({\n    suite: signer.suite,\n    signerDid: signer.signerDid,\n    value: signatureValue,\n  });\n  return {\n    ...unsigned,\n    [descriptor.idField]: material.id,\n    signature,\n  } as unknown as SignedPolicyObject;\n}\n\nexport function createAndSignPolicy(\n  input: unknown,\n  signer: SignedObjectSigner,\n): Promise<Policy> {\n  return createAndSignSignedObject(input, signer).then((object) =>\n    validatePolicySignedShape(object),\n  );\n}\n\nexport function createAndSignPolicyStatus(\n  input: unknown,\n  signer: SignedObjectSigner,\n): Promise<PolicyStatus> {\n  return createAndSignSignedObject(input, signer).then((object) =>\n    validatePolicyStatusSignedShape(object),\n  );\n}\n\nexport function createAndSignPolicyEngineRecord(\n  input: unknown,\n  signer: SignedObjectSigner,\n): Promise<PolicyEngineRecord> {\n  return createAndSignSignedObject(input, signer).then((object) =>\n    validatePolicyEngineRecordSignedShape(object),\n  );\n}\n\nexport async function verifySignedObject(\n  input: unknown,\n): Promise<{ object: SignedPolicyObject; material: SignedObjectMaterial }> {\n  const signed = validateSignedObjectShape(input);\n  const signedJson = signed as unknown as JsonObject;\n  const descriptor = descriptorForSchema(signed.schema);\n  const signature = validateSignature(signed.signature);\n  assertSigningKeyBindingForVerify(signedJson, signature);\n  const unsigned = stripOwnIdAndSignature(signedJson, descriptor);\n  const material = materialForUnsigned(unsigned, descriptor);\n  assertIdMatches(signedJson, material, descriptor);\n  if (!(await verifySignature(signature, material.digest))) {\n    throw new SignatureVerificationError(\"signature verification failed\");\n  }\n  return { object: signed, material };\n}\n\nexport async function verifyPolicy(\n  input: unknown,\n): Promise<{ object: Policy; material: SignedObjectMaterial }> {\n  const result = await verifySignedObject(input);\n  return {\n    object: validatePolicySignedShape(result.object),\n    material: result.material,\n  };\n}\n\nexport async function verifyPolicyStatus(\n  input: unknown,\n): Promise<{ object: PolicyStatus; material: SignedObjectMaterial }> {\n  const result = await verifySignedObject(input);\n  return {\n    object: validatePolicyStatusSignedShape(result.object),\n    material: result.material,\n  };\n}\n\nexport async function verifyPolicyEngineRecord(\n  input: unknown,\n): Promise<{ object: PolicyEngineRecord; material: SignedObjectMaterial }> {\n  const result = await verifySignedObject(input);\n  return {\n    object: validatePolicyEngineRecordSignedShape(result.object),\n    material: result.material,\n  };\n}\n\nexport async function validatePolicySigned(\n  input: unknown,\n): Promise<SignedObjectVerificationResult<Policy>> {\n  try {\n    const result = await verifyPolicy(input);\n    return { ok: true, object: result.object, material: result.material };\n  } catch (error) {\n    return { ok: false, error: toSignedObjectError(error) };\n  }\n}\n\nexport async function validatePolicyStatusSigned(\n  input: unknown,\n): Promise<SignedObjectVerificationResult<PolicyStatus>> {\n  try {\n    const result = await verifyPolicyStatus(input);\n    return { ok: true, object: result.object, material: result.material };\n  } catch (error) {\n    return { ok: false, error: toSignedObjectError(error) };\n  }\n}\n\nexport async function validatePolicyEngineRecordSigned(\n  input: unknown,\n): Promise<SignedObjectVerificationResult<PolicyEngineRecord>> {\n  try {\n    const result = await verifyPolicyEngineRecord(input);\n    return { ok: true, object: result.object, material: result.material };\n  } catch (error) {\n    return { ok: false, error: toSignedObjectError(error) };\n  }\n}\n\nexport function validatePolicyUnsigned(input: unknown): UnsignedPolicy {\n  return validatePolicyShape(input, false) as unknown as UnsignedPolicy;\n}\n\nexport function validatePolicyStatusUnsigned(input: unknown): UnsignedPolicyStatus {\n  return validatePolicyStatusShape(input, false) as unknown as UnsignedPolicyStatus;\n}\n\nexport function validatePolicyEngineRecordUnsigned(\n  input: unknown,\n): UnsignedPolicyEngineRecord {\n  return validatePolicyEngineRecordShape(input, false) as unknown as UnsignedPolicyEngineRecord;\n}\n\nexport function validatePolicySignedShape(input: unknown): Policy {\n  return validatePolicyShape(input, true) as unknown as Policy;\n}\n\nexport function validatePolicyStatusSignedShape(input: unknown): PolicyStatus {\n  return validatePolicyStatusShape(input, true) as unknown as PolicyStatus;\n}\n\nexport function validatePolicyEngineRecordSignedShape(\n  input: unknown,\n): PolicyEngineRecord {\n  return validatePolicyEngineRecordShape(input, true) as unknown as PolicyEngineRecord;\n}\n\nfunction validateSignedObjectShape(input: unknown): SignedPolicyObject {\n  const normalized = expectJsonObject(normalizeJson(input), \"$\");\n  const schema = requiredString(normalized, \"schema\", \"$\");\n  const descriptor = descriptorForSchema(schema);\n  switch (descriptor.kind) {\n    case \"Policy\":\n      return validatePolicySignedShape(normalized);\n    case \"PolicyStatus\":\n      return validatePolicyStatusSignedShape(normalized);\n    case \"PolicyEngineRecord\":\n      return validatePolicyEngineRecordSignedShape(normalized);\n  }\n}\n\nfunction validateUnsignedForDescriptor(\n  input: unknown,\n  descriptor: ObjectDescriptor,\n): JsonObject {\n  switch (descriptor.kind) {\n    case \"Policy\":\n      return validatePolicyUnsigned(input) as unknown as JsonObject;\n    case \"PolicyStatus\":\n      return validatePolicyStatusUnsigned(input) as unknown as JsonObject;\n    case \"PolicyEngineRecord\":\n      return validatePolicyEngineRecordUnsigned(input) as unknown as JsonObject;\n  }\n}\n\nfunction validatePolicyShape(input: unknown, signed: boolean): JsonObject {\n  const object = expectJsonObject(normalizeJson(input), \"$\");\n  assertExactKeys(\n    object,\n    signed\n      ? [\n          \"schema\",\n          \"policyId\",\n          \"ownerDid\",\n          \"signingKeyDid\",\n          \"createdAt\",\n          \"expiresAt\",\n          \"resource\",\n          \"when\",\n          \"grant\",\n          \"disclosure\",\n          \"audit\",\n          \"signature\",\n        ]\n      : [\n          \"schema\",\n          \"ownerDid\",\n          \"signingKeyDid\",\n          \"createdAt\",\n          \"expiresAt\",\n          \"resource\",\n          \"when\",\n          \"grant\",\n          \"disclosure\",\n          \"audit\",\n        ],\n    \"$\",\n  );\n  expectConst(requiredString(object, \"schema\", \"$\"), POLICY_SCHEMA, \"$.schema\");\n  if (signed) {\n    requiredString(object, \"policyId\", \"$\");\n    validateSignature(requiredValue(object, \"signature\", \"$\"));\n  }\n  requiredString(object, \"ownerDid\", \"$\");\n  requiredString(object, \"signingKeyDid\", \"$\");\n  requiredDateString(object, \"createdAt\", \"$\");\n  optionalDateString(object, \"expiresAt\", \"$\");\n  validatePolicyResource(requiredValue(object, \"resource\", \"$\"), \"$.resource\");\n  validateExpression(requiredValue(object, \"when\", \"$\"), \"$.when\");\n  validateGrant(requiredValue(object, \"grant\", \"$\"), \"$.grant\");\n  if (hasOwn(object, \"disclosure\")) {\n    validateDisclosure(requiredValue(object, \"disclosure\", \"$\"), \"$.disclosure\");\n  }\n  if (hasOwn(object, \"audit\")) {\n    validateAudit(requiredValue(object, \"audit\", \"$\"), \"$.audit\");\n  }\n  return object;\n}\n\nfunction validatePolicyStatusShape(input: unknown, signed: boolean): JsonObject {\n  const object = expectJsonObject(normalizeJson(input), \"$\");\n  assertExactKeys(\n    object,\n    signed\n      ? [\n          \"schema\",\n          \"statusId\",\n          \"policyId\",\n          \"ownerDid\",\n          \"sequence\",\n          \"disposition\",\n          \"effectiveAt\",\n          \"reasonCode\",\n          \"signingKeyDid\",\n          \"signature\",\n        ]\n      : [\n          \"schema\",\n          \"policyId\",\n          \"ownerDid\",\n          \"sequence\",\n          \"disposition\",\n          \"effectiveAt\",\n          \"reasonCode\",\n          \"signingKeyDid\",\n        ],\n    \"$\",\n  );\n  expectConst(requiredString(object, \"schema\", \"$\"), POLICY_STATUS_SCHEMA, \"$.schema\");\n  if (signed) {\n    requiredString(object, \"statusId\", \"$\");\n    validateSignature(requiredValue(object, \"signature\", \"$\"));\n  }\n  requiredString(object, \"policyId\", \"$\");\n  requiredString(object, \"ownerDid\", \"$\");\n  requiredInteger(object, \"sequence\", \"$\", 0);\n  expectOneOf(requiredString(object, \"disposition\", \"$\"), [\n    \"active\",\n    \"suspended\",\n    \"revoked\",\n  ], \"$.disposition\");\n  requiredDateString(object, \"effectiveAt\", \"$\");\n  optionalString(object, \"reasonCode\", \"$\");\n  requiredString(object, \"signingKeyDid\", \"$\");\n  return object;\n}\n\nfunction validatePolicyEngineRecordShape(\n  input: unknown,\n  signed: boolean,\n): JsonObject {\n  const object = expectJsonObject(normalizeJson(input), \"$\");\n  assertExactKeys(\n    object,\n    signed\n      ? [\n          \"schema\",\n          \"engineRecordId\",\n          \"ownerDid\",\n          \"endpoint\",\n          \"audience\",\n          \"supportedPolicyVersions\",\n          \"supportedEvidenceVerifiers\",\n          \"grantIssuerDid\",\n          \"expiresAt\",\n          \"signature\",\n        ]\n      : [\n          \"schema\",\n          \"ownerDid\",\n          \"endpoint\",\n          \"audience\",\n          \"supportedPolicyVersions\",\n          \"supportedEvidenceVerifiers\",\n          \"grantIssuerDid\",\n          \"expiresAt\",\n        ],\n    \"$\",\n  );\n  expectConst(\n    requiredString(object, \"schema\", \"$\"),\n    POLICY_ENGINE_RECORD_SCHEMA,\n    \"$.schema\",\n  );\n  if (signed) {\n    requiredString(object, \"engineRecordId\", \"$\");\n    validateSignature(requiredValue(object, \"signature\", \"$\"));\n  }\n  requiredString(object, \"ownerDid\", \"$\");\n  requiredString(object, \"endpoint\", \"$\");\n  requiredString(object, \"audience\", \"$\");\n  requiredStringArray(object, \"supportedPolicyVersions\", \"$\", (value, path) =>\n    expectConst(value, \"v0\", path),\n  );\n  requiredStringArray(object, \"supportedEvidenceVerifiers\", \"$\");\n  requiredString(object, \"grantIssuerDid\", \"$\");\n  requiredDateString(object, \"expiresAt\", \"$\");\n  return object;\n}\n\nfunction validateSignature(input: unknown): SignedObjectSignature {\n  const object = expectJsonObject(input, \"$.signature\");\n  assertExactKeys(object, [\"suite\", \"signerDid\", \"value\"], \"$.signature\");\n  const suite = requiredString(object, \"suite\", \"$.signature\");\n  assertSupportedSignatureSuite(suite);\n  const signerDid = requiredString(object, \"signerDid\", \"$.signature\");\n  const value = requiredString(object, \"value\", \"$.signature\");\n  decodeSignatureValue(value, suite);\n  return { suite, signerDid, value };\n}\n\nfunction validatePolicyResource(input: unknown, path: string): void {\n  const object = expectJsonObject(input, path);\n  assertExactKeys(object, [\"resourceType\", \"resourceId\", \"permissionsCeiling\"], path);\n  requiredString(object, \"resourceType\", path);\n  requiredString(object, \"resourceId\", path);\n  const ceiling = requiredArray(object, \"permissionsCeiling\", path, 1);\n  for (let index = 0; index < ceiling.length; index++) {\n    validatePolicyCapability(ceiling[index], `${path}.permissionsCeiling[${index}]`);\n  }\n}\n\nfunction validatePolicyPermissionsCeilingForSigning(input: JsonObject): void {\n  const resource = expectJsonObject(requiredValue(input, \"resource\", \"$\"), \"$.resource\");\n  const ceiling = requiredArray(resource, \"permissionsCeiling\", \"$.resource\", 1);\n  for (let index = 0; index < ceiling.length; index++) {\n    validatePolicyCapabilityForSigning(\n      ceiling[index],\n      `$.resource.permissionsCeiling[${index}]`,\n    );\n  }\n}\n\nfunction validatePolicyCapability(input: unknown, path: string): void {\n  const object = expectJsonObject(input, path);\n  try {\n    const canonical = canonicalizePolicyCapability(object);\n    if (jcsCanonicalize(object) !== jcsCanonicalize(canonical)) {\n      throw new SignedObjectSchemaError(`${path} must be canonical PolicyCapability JSON`);\n    }\n  } catch (error) {\n    if (error instanceof SignedObjectSchemaError) {\n      throw error;\n    }\n    throw new SignedObjectSchemaError(\n      error instanceof Error ? error.message : String(error),\n    );\n  }\n}\n\nfunction validatePolicyCapabilityForSigning(input: unknown, path: string): void {\n  const object = expectJsonObject(input, path);\n  try {\n    const canonical = normalizePolicyCapability(object);\n    if (jcsCanonicalize(object) !== jcsCanonicalize(canonical)) {\n      throw new SignedObjectSchemaError(`${path} must be strict canonical PolicyCapability JSON`);\n    }\n  } catch (error) {\n    if (error instanceof SignedObjectSchemaError) {\n      throw error;\n    }\n    throw new SignedObjectSchemaError(\n      error instanceof Error ? error.message : String(error),\n    );\n  }\n}\n\nfunction validateExpression(input: unknown, path: string): void {\n  const object = expectJsonObject(input, path);\n  const keys = Object.keys(object);\n  if (keys.length !== 1) {\n    throw new SignedObjectSchemaError(`${path} must have exactly one expression key`);\n  }\n  const key = keys[0];\n  if (key === \"allOf\" || key === \"anyOf\") {\n    const values = requiredArray(object, key, path, 1);\n    for (let index = 0; index < values.length; index++) {\n      validateExpression(values[index], `${path}.${key}[${index}]`);\n    }\n    return;\n  }\n  if (key === \"subject\") {\n    const subject = expectJsonObject(requiredValue(object, \"subject\", path), `${path}.subject`);\n    assertExactKeys(subject, [\"did\"], `${path}.subject`);\n    requiredString(subject, \"did\", `${path}.subject`);\n    return;\n  }\n  if (key === \"evidence\") {\n    validateEvidenceRequirement(requiredValue(object, \"evidence\", path), `${path}.evidence`);\n    return;\n  }\n  throw new SignedObjectSchemaError(`${path} has unknown expression key ${key}`);\n}\n\nfunction validateEvidenceRequirement(input: unknown, path: string): void {\n  const object = expectJsonObject(input, path);\n  assertExactKeys(\n    object,\n    [\"requirementId\", \"verifier\", \"requirements\", \"authority\", \"freshness\"],\n    path,\n  );\n  requiredString(object, \"requirementId\", path);\n  requiredString(object, \"verifier\", path);\n  requiredValue(object, \"requirements\", path);\n  if (hasOwn(object, \"authority\")) {\n    const authority = expectJsonObject(requiredValue(object, \"authority\", path), `${path}.authority`);\n    assertExactKeys(\n      authority,\n      [\"profile\", \"acceptedIssuers\", \"allowOwnerAuthorizedIssuer\"],\n      `${path}.authority`,\n    );\n    optionalString(authority, \"profile\", `${path}.authority`);\n    if (hasOwn(authority, \"acceptedIssuers\")) {\n      requiredStringArray(authority, \"acceptedIssuers\", `${path}.authority`);\n    }\n    optionalBoolean(authority, \"allowOwnerAuthorizedIssuer\", `${path}.authority`);\n  }\n  if (hasOwn(object, \"freshness\")) {\n    const freshness = expectJsonObject(requiredValue(object, \"freshness\", path), `${path}.freshness`);\n    assertExactKeys(freshness, [\"maxStatusAgeSeconds\"], `${path}.freshness`);\n    requiredInteger(freshness, \"maxStatusAgeSeconds\", `${path}.freshness`, 0);\n  }\n}\n\nfunction validateGrant(input: unknown, path: string): void {\n  const object = expectJsonObject(input, path);\n  assertExactKeys(object, [\"output\", \"maxTtlSeconds\", \"delegationMode\", \"revocation\"], path);\n  expectConst(requiredString(object, \"output\", path), \"portable-delegation\", `${path}.output`);\n  requiredInteger(object, \"maxTtlSeconds\", path, 1);\n  expectOneOf(requiredString(object, \"delegationMode\", path), [\n    \"terminal\",\n    \"attenuable\",\n  ], `${path}.delegationMode`);\n  expectOneOf(requiredString(object, \"revocation\", path), [\n    \"refresh_only\",\n    \"active_cutoff\",\n  ], `${path}.revocation`);\n}\n\nfunction validateDisclosure(input: unknown, path: string): void {\n  const object = expectJsonObject(input, path);\n  assertExactKeys(object, [\"denial\"], path);\n  expectOneOf(requiredString(object, \"denial\", path), [\"none\", \"code\", \"debug\"], `${path}.denial`);\n}\n\nfunction validateAudit(input: unknown, path: string): void {\n  const object = expectJsonObject(input, path);\n  assertExactKeys(object, [\"issuance\"], path);\n  expectOneOf(requiredString(object, \"issuance\", path), [\"off\", \"security\", \"full\"], `${path}.issuance`);\n}\n\nfunction materialForUnsigned(\n  unsigned: JsonObject,\n  descriptor: ObjectDescriptor,\n): SignedObjectMaterial {\n  const jcs = jcsCanonicalize(unsigned);\n  const jcsBytes = textEncoder.encode(jcs);\n  const digest = sha256Bytes(concatBytes(textEncoder.encode(`${descriptor.domain}\\0`), jcsBytes));\n  const id = `${descriptor.idPrefix}${base32LowerNoPad(digest)}`;\n  return {\n    kind: descriptor.kind,\n    idField: descriptor.idField,\n    id,\n    domain: descriptor.domain,\n    unsigned,\n    jcs,\n    jcsBytes,\n    digest,\n    digestHex: bytesToHex(digest).slice(2),\n  };\n}\n\nfunction assertIdMatches(\n  signed: JsonObject,\n  material: SignedObjectMaterial,\n  descriptor: ObjectDescriptor,\n): void {\n  const actual = requiredString(signed, descriptor.idField, \"$\");\n  if (actual === material.id) {\n    return;\n  }\n  if (new RegExp(`^${descriptor.idPrefix}[a-z2-7]{52}$`).test(actual)) {\n    throw new SignedObjectDigestError(\n      `${descriptor.idField} was not derived from the signed object digest`,\n    );\n  }\n  throw new SignedObjectIdError(`${descriptor.idField} does not match ${descriptor.idPrefix}`);\n}\n\nfunction assertSigningKeyBindingForCreate(\n  unsigned: JsonObject,\n  signerDid: string,\n): void {\n  if (!hasOwn(unsigned, \"signingKeyDid\")) {\n    return;\n  }\n  const signingKeyDid = requiredString(unsigned, \"signingKeyDid\", \"$\");\n  if (signingKeyDid !== signerDid) {\n    throw new SigningKeyBindingError(\n      `signer DID ${signerDid} does not match signingKeyDid ${signingKeyDid}`,\n    );\n  }\n}\n\nfunction assertSigningKeyBindingForVerify(\n  signed: JsonObject,\n  signature: SignedObjectSignature,\n): void {\n  if (!hasOwn(signed, \"signingKeyDid\")) {\n    return;\n  }\n  const signingKeyDid = requiredString(signed, \"signingKeyDid\", \"$\");\n  if (signature.signerDid !== signingKeyDid) {\n    throw new SigningKeyBindingError(\n      `signature signerDid ${signature.signerDid} does not match signingKeyDid ${signingKeyDid}`,\n    );\n  }\n}\n\nfunction assertSignerDidMatchesSuite(\n  signerDid: string,\n  suite: SignatureSuite,\n): void {\n  if (suite === ED25519_JCS_SIGNATURE_SUITE) {\n    ed25519PublicKeyFromDidKey(signerDid);\n    return;\n  }\n  if (suite === EIP191_JCS_SIGNATURE_SUITE) {\n    parseDidPkh(signerDid);\n    return;\n  }\n  throw new UnsupportedSignatureSuiteError(`unsupported signature suite: ${suite}`);\n}\n\nasync function verifySignature(\n  signature: SignedObjectSignature,\n  digest: Uint8Array,\n): Promise<boolean> {\n  if (signature.suite === ED25519_JCS_SIGNATURE_SUITE) {\n    const publicKey = ed25519PublicKeyFromDidKey(signature.signerDid);\n    const signatureBytes = decodeSignatureValue(signature.value, signature.suite);\n    try {\n      return ed25519.verify(signatureBytes, digest, publicKey);\n    } catch {\n      throw new SignatureVerificationError(\"Ed25519 signature verification failed\");\n    }\n  }\n\n  if (signature.suite === EIP191_JCS_SIGNATURE_SUITE) {\n    const pkh = parseDidPkh(signature.signerDid);\n    const signatureBytes = decodeSignatureValue(signature.value, signature.suite);\n    try {\n      return verifyMessage({\n        address: pkh.address,\n        message: { raw: digest },\n        signature: bytesToHex(signatureBytes),\n      });\n    } catch {\n      throw new SignatureVerificationError(\"EIP-191 signature verification failed\");\n    }\n  }\n\n  throw new UnsupportedSignatureSuiteError(`unsupported signature suite: ${signature.suite}`);\n}\n\nfunction ed25519PublicKeyFromDidKey(did: string): Uint8Array {\n  if (!did.startsWith(\"did:key:\")) {\n    throw new SignatureMaterialError(\"Ed25519 signerDid must be did:key\");\n  }\n  const identifier = did.slice(\"did:key:\".length);\n  if (!identifier.startsWith(\"z\")) {\n    throw new SignatureMaterialError(\"did:key must use base58btc multibase\");\n  }\n  let bytes: Uint8Array;\n  try {\n    bytes = bases.base58btc.decode(identifier);\n  } catch {\n    throw new SignatureMaterialError(\"did:key signerDid is undecodable\");\n  }\n  if (bytes.length === 34 && bytes[0] === 0xed && bytes[1] === 0x01) {\n    return bytes.slice(2);\n  }\n  throw new SignatureMaterialError(\"did:key signerDid is not an Ed25519 key\");\n}\n\nfunction parseDidPkh(did: string): { address: `0x${string}` } {\n  let parsed: ReturnType<typeof parsePkhDid>;\n  try {\n    parsed = parsePkhDid(did);\n  } catch {\n    throw new SignatureMaterialError(\"did:pkh signerDid is undecodable\");\n  }\n  if (!parsed) {\n    throw new SignatureMaterialError(\"EIP-191 signerDid must be did:pkh\");\n  }\n  return { address: parsed.address };\n}\n\nfunction decodeSignatureValue(value: string, suite: SignatureSuite): Uint8Array {\n  if (value.length === 0 || !BASE64URL_RE.test(value) || value.includes(\"=\")) {\n    throw new SignatureMaterialError(\"signature value must be base64url without padding\");\n  }\n  const bytes = base64UrlDecode(value);\n  if (suite === ED25519_JCS_SIGNATURE_SUITE && bytes.length !== 64) {\n    throw new SignatureMaterialError(\"Ed25519 signature must be 64 bytes\");\n  }\n  if (suite === EIP191_JCS_SIGNATURE_SUITE) {\n    if (bytes.length !== 65) {\n      throw new SignatureMaterialError(\"EIP-191 signature must be 65 bytes\");\n    }\n    const v = bytes[64];\n    if (v !== 27 && v !== 28) {\n      throw new SignatureMaterialError(\"EIP-191 signature recovery id must be 27 or 28\");\n    }\n  }\n  return bytes;\n}\n\nfunction encodeSignatureValue(\n  value: Uint8Array | string,\n  suite: SignatureSuite,\n): string {\n  if (typeof value === \"string\") {\n    const encoded = value.startsWith(\"0x\")\n      ? base64UrlEncode(hexToBytes(value))\n      : value;\n    decodeSignatureValue(encoded, suite);\n    return encoded;\n  }\n  const encoded = base64UrlEncode(value);\n  decodeSignatureValue(encoded, suite);\n  return encoded;\n}\n\nfunction stripOwnIdAndSignature(\n  object: JsonObject,\n  descriptor: ObjectDescriptor,\n): JsonObject {\n  const output = Object.create(null) as { [key: string]: JsonValue };\n  for (const [key, value] of Object.entries(object)) {\n    if (key === descriptor.idField || key === \"signature\") {\n      continue;\n    }\n    output[key] = value;\n  }\n  return output;\n}\n\nfunction descriptorForUnsigned(input: unknown): ObjectDescriptor {\n  const object = expectJsonObject(normalizeJson(input), \"$\");\n  return descriptorForSchema(requiredString(object, \"schema\", \"$\"));\n}\n\nfunction descriptorForSchema(schema: string): ObjectDescriptor {\n  if (schema === POLICY_SCHEMA) return DESCRIPTORS.Policy;\n  if (schema === POLICY_STATUS_SCHEMA) return DESCRIPTORS.PolicyStatus;\n  if (schema === POLICY_ENGINE_RECORD_SCHEMA) return DESCRIPTORS.PolicyEngineRecord;\n  throw new SignedObjectSchemaError(`unsupported signed-object schema: ${schema}`);\n}\n\nfunction expectJsonObject(input: unknown, path: string): JsonObject {\n  if (input === null || typeof input !== \"object\" || Array.isArray(input)) {\n    throw new SignedObjectSchemaError(`${path} must be an object`);\n  }\n  return input as JsonObject;\n}\n\nfunction assertExactKeys(object: JsonObject, allowed: readonly string[], path: string): void {\n  const allowedSet = new Set(allowed);\n  for (const key of Object.keys(object)) {\n    if (!allowedSet.has(key)) {\n      throw new SignedObjectSchemaError(`${path} has unknown field ${key}`);\n    }\n  }\n}\n\nfunction requiredValue(object: JsonObject, key: string, path: string): JsonValue {\n  if (!hasOwn(object, key)) {\n    throw new SignedObjectSchemaError(`${path}.${key} is required`);\n  }\n  return object[key];\n}\n\nfunction requiredString(object: JsonObject, key: string, path: string): string {\n  return requireStringType(requiredValue(object, key, path), `${path}.${key}`);\n}\n\nfunction optionalString(object: JsonObject, key: string, path: string): void {\n  if (!hasOwn(object, key)) {\n    return;\n  }\n  requireStringType(requiredValue(object, key, path), `${path}.${key}`);\n}\n\nfunction requireStringType(value: JsonValue, path: string): string {\n  if (typeof value !== \"string\" || value.length === 0) {\n    throw new SignedObjectSchemaError(`${path} must be a non-empty string`);\n  }\n  return value;\n}\n\nfunction optionalBoolean(object: JsonObject, key: string, path: string): void {\n  if (!hasOwn(object, key)) {\n    return;\n  }\n  if (typeof requiredValue(object, key, path) !== \"boolean\") {\n    throw new SignedObjectSchemaError(`${path}.${key} must be a boolean`);\n  }\n}\n\nfunction requiredInteger(\n  object: JsonObject,\n  key: string,\n  path: string,\n  minimum: number,\n): number {\n  const value = requiredValue(object, key, path);\n  if (typeof value !== \"number\" || !Number.isSafeInteger(value) || value < minimum) {\n    throw new SignedObjectSchemaError(\n      `${path}.${key} must be an integer >= ${minimum}`,\n    );\n  }\n  return value;\n}\n\nfunction requiredArray(\n  object: JsonObject,\n  key: string,\n  path: string,\n  minimum: number,\n): readonly JsonValue[] {\n  const value = requiredValue(object, key, path);\n  if (!Array.isArray(value) || value.length < minimum) {\n    throw new SignedObjectSchemaError(\n      `${path}.${key} must be an array with at least ${minimum} item(s)`,\n    );\n  }\n  return value;\n}\n\nfunction requiredStringArray(\n  object: JsonObject,\n  key: string,\n  path: string,\n  check?: (value: string, path: string) => void,\n): void {\n  const values = requiredArray(object, key, path, 0);\n  for (let index = 0; index < values.length; index++) {\n    const itemPath = `${path}.${key}[${index}]`;\n    const value = requireStringType(values[index], itemPath);\n    check?.(value, itemPath);\n  }\n}\n\nfunction requiredDateString(object: JsonObject, key: string, path: string): void {\n  assertRfc3339(requiredString(object, key, path), `${path}.${key}`);\n}\n\nfunction optionalDateString(object: JsonObject, key: string, path: string): void {\n  if (!hasOwn(object, key)) {\n    return;\n  }\n  assertRfc3339(requiredString(object, key, path), `${path}.${key}`);\n}\n\nfunction assertRfc3339(value: string, path: string): void {\n  const match = value.match(\n    /^(\\d{4})-(\\d{2})-(\\d{2})T(\\d{2}):(\\d{2}):(\\d{2})(\\.\\d+)?(Z|[+-]\\d{2}:\\d{2})$/,\n  );\n  if (!match) {\n    throw new SignedObjectSchemaError(`${path} must be strict RFC 3339`);\n  }\n  const parsed = Date.parse(value);\n  if (Number.isNaN(parsed)) {\n    throw new SignedObjectSchemaError(`${path} must be a parseable RFC 3339 timestamp`);\n  }\n  const canonical = new Date(parsed).toISOString().replace(\".000Z\", \"Z\");\n  if (canonical !== value) {\n    throw new SignedObjectSchemaError(`${path} must be a normalizable RFC 3339 timestamp`);\n  }\n}\n\nfunction expectConst<T extends string>(actual: string, expected: T, path: string): T {\n  if (actual !== expected) {\n    throw new SignedObjectSchemaError(`${path} must be ${expected}`);\n  }\n  return expected;\n}\n\nfunction expectOneOf<T extends string>(\n  actual: string,\n  allowed: readonly T[],\n  path: string,\n): T {\n  for (const value of allowed) {\n    if (actual === value) {\n      return value;\n    }\n  }\n  throw new SignedObjectSchemaError(`${path} has unsupported value ${actual}`);\n}\n\nfunction hasOwn(object: JsonObject, key: string): boolean {\n  return objectHasOwn(object, key);\n}\n\nfunction assertSupportedSignatureSuite(suite: string): asserts suite is SignatureSuite {\n  if (suite !== ED25519_JCS_SIGNATURE_SUITE && suite !== EIP191_JCS_SIGNATURE_SUITE) {\n    throw new UnsupportedSignatureSuiteError(`unsupported signature suite: ${suite}`);\n  }\n}\n\nfunction sha256Bytes(bytes: Uint8Array): Uint8Array {\n  return sha256(bytes, \"bytes\");\n}\n\nfunction concatBytes(left: Uint8Array, right: Uint8Array): Uint8Array {\n  const output = new Uint8Array(left.length + right.length);\n  output.set(left, 0);\n  output.set(right, left.length);\n  return output;\n}\n\nfunction base32LowerNoPad(bytes: Uint8Array): string {\n  let output = \"\";\n  let buffer = 0;\n  let bits = 0;\n  for (const byte of bytes) {\n    buffer = (buffer << 8) | byte;\n    bits += 8;\n    while (bits >= 5) {\n      bits -= 5;\n      output += BASE32_ALPHABET[(buffer >> bits) & 31];\n    }\n  }\n  if (bits > 0) {\n    output += BASE32_ALPHABET[(buffer << (5 - bits)) & 31];\n  }\n  return output;\n}\n\nfunction base64UrlEncode(bytes: Uint8Array): string {\n  const alphabet =\n    \"ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789-_\";\n  let output = \"\";\n  for (let index = 0; index < bytes.length; index += 3) {\n    const a = bytes[index];\n    const b = bytes[index + 1];\n    const c = bytes[index + 2];\n    const triplet = (a << 16) | ((b ?? 0) << 8) | (c ?? 0);\n    output += alphabet[(triplet >> 18) & 63];\n    output += alphabet[(triplet >> 12) & 63];\n    if (index + 1 < bytes.length) {\n      output += alphabet[(triplet >> 6) & 63];\n    }\n    if (index + 2 < bytes.length) {\n      output += alphabet[triplet & 63];\n    }\n  }\n  return output;\n}\n\nfunction base64UrlDecode(value: string): Uint8Array {\n  if (value.length % 4 === 1) {\n    throw new SignatureMaterialError(\"signature value is not canonical base64url\");\n  }\n  const alphabet =\n    \"ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789-_\";\n  const bytes: number[] = [];\n  let buffer = 0;\n  let bits = 0;\n  for (const char of value) {\n    const index = alphabet.indexOf(char);\n    if (index < 0) {\n      throw new SignatureMaterialError(\"signature value is not base64url\");\n    }\n    buffer = (buffer << 6) | index;\n    bits += 6;\n    if (bits >= 8) {\n      bits -= 8;\n      bytes.push((buffer >> bits) & 0xff);\n    }\n  }\n  const decoded = Uint8Array.from(bytes);\n  if (base64UrlEncode(decoded) !== value) {\n    throw new SignatureMaterialError(\"signature value is not canonical base64url\");\n  }\n  return decoded;\n}\n\nfunction hexToBytes(value: string): Uint8Array {\n  const hex = value.slice(2);\n  if (hex.length % 2 !== 0 || !/^[0-9a-fA-F]*$/.test(hex)) {\n    throw new SignatureMaterialError(\"hex signature must have even length\");\n  }\n  const output = new Uint8Array(hex.length / 2);\n  for (let index = 0; index < output.length; index++) {\n    output[index] = Number.parseInt(hex.slice(index * 2, index * 2 + 2), 16);\n  }\n  return output;\n}\n","export type SignedObjectErrorCode =\n  | \"schema-invalid\"\n  | \"canonicalization-mismatch\"\n  | \"digest-mismatch\"\n  | \"id-mismatch\"\n  | \"signing-key-binding\"\n  | \"signature-material-invalid\"\n  | \"signature-suite-unsupported\"\n  | \"signature-invalid\";\n\nexport class SignedObjectProfileError extends Error {\n  public readonly code: SignedObjectErrorCode;\n\n  constructor(code: SignedObjectErrorCode, message: string) {\n    super(message);\n    this.name = \"SignedObjectProfileError\";\n    this.code = code;\n  }\n}\n\nexport class SignedObjectSchemaError extends SignedObjectProfileError {\n  constructor(message: string) {\n    super(\"schema-invalid\", message);\n    this.name = \"SignedObjectSchemaError\";\n  }\n}\n\nexport class SignedObjectCanonicalizationError extends SignedObjectProfileError {\n  constructor(message: string) {\n    super(\"canonicalization-mismatch\", message);\n    this.name = \"SignedObjectCanonicalizationError\";\n  }\n}\n\nexport class SignedObjectDigestError extends SignedObjectProfileError {\n  constructor(message: string) {\n    super(\"digest-mismatch\", message);\n    this.name = \"SignedObjectDigestError\";\n  }\n}\n\nexport class SignedObjectIdError extends SignedObjectProfileError {\n  constructor(message: string) {\n    super(\"id-mismatch\", message);\n    this.name = \"SignedObjectIdError\";\n  }\n}\n\nexport class SigningKeyBindingError extends SignedObjectProfileError {\n  constructor(message: string) {\n    super(\"signing-key-binding\", message);\n    this.name = \"SigningKeyBindingError\";\n  }\n}\n\nexport class SignatureMaterialError extends SignedObjectProfileError {\n  constructor(message: string) {\n    super(\"signature-material-invalid\", message);\n    this.name = \"SignatureMaterialError\";\n  }\n}\n\nexport class UnsupportedSignatureSuiteError extends SignedObjectProfileError {\n  constructor(message: string) {\n    super(\"signature-suite-unsupported\", message);\n    this.name = \"UnsupportedSignatureSuiteError\";\n  }\n}\n\nexport class SignatureVerificationError extends SignedObjectProfileError {\n  constructor(message: string) {\n    super(\"signature-invalid\", message);\n    this.name = \"SignatureVerificationError\";\n  }\n}\n\nexport function toSignedObjectError(error: unknown): SignedObjectProfileError {\n  if (error instanceof SignedObjectProfileError) {\n    return error;\n  }\n  return new SignedObjectProfileError(\n    \"schema-invalid\",\n    error instanceof Error ? error.message : String(error),\n  );\n}\n","import { SignedObjectCanonicalizationError } from \"./errors\";\n\nexport type JsonValue =\n  | null\n  | boolean\n  | number\n  | string\n  | JsonValue[]\n  | { readonly [key: string]: JsonValue };\n\ntype MutableJsonObject = { [key: string]: JsonValue };\nconst objectHasOwn: (object: object, propertyKey: PropertyKey) => boolean =\n  (Object as ObjectConstructor & {\n    hasOwn?: (object: object, propertyKey: PropertyKey) => boolean;\n  }).hasOwn ??\n  (Object.prototype.hasOwnProperty.call.bind(\n    Object.prototype.hasOwnProperty,\n  ) as (object: object, propertyKey: PropertyKey) => boolean);\n\n/**\n * RFC 8785 JSON Canonicalization Scheme encoder for the signed-object profile.\n *\n * This local encoder is intentionally stricter than JSON.stringify:\n * it rejects non-plain JSON inputs, sparse arrays, undefined/functions/symbols,\n * non-finite numbers, BigInt, dangerous prototype keys, and lone surrogates.\n * Object keys are sorted lexicographically by their raw UTF-16 code units,\n * as required by RFC 8785 section 3.2.3, before serialization.\n */\nexport function jcsCanonicalize(input: unknown): string {\n  return serialize(normalizeJson(input, \"$\"));\n}\n\nexport function normalizeJson(input: unknown, path = \"$\"): JsonValue {\n  if (input === null) {\n    return null;\n  }\n\n  switch (typeof input) {\n    case \"boolean\":\n      return input;\n    case \"number\":\n      if (!Number.isFinite(input)) {\n        throw new SignedObjectCanonicalizationError(\n          `${path} must be a finite JSON number`,\n        );\n      }\n      return input;\n    case \"string\":\n      assertUnicodeScalarString(input, path);\n      return input;\n    case \"object\":\n      return normalizeJsonObjectOrArray(input, path);\n    case \"bigint\":\n    case \"function\":\n    case \"symbol\":\n    case \"undefined\":\n    default:\n      throw new SignedObjectCanonicalizationError(\n        `${path} is not a JSON value`,\n      );\n  }\n}\n\nexport function serialize(value: JsonValue): string {\n  if (value === null) {\n    return \"null\";\n  }\n\n  switch (typeof value) {\n    case \"boolean\":\n      return value ? \"true\" : \"false\";\n    case \"number\": {\n      const encoded = JSON.stringify(value);\n      if (encoded === undefined) {\n        throw new SignedObjectCanonicalizationError(\n          \"number could not be serialized as JSON\",\n        );\n      }\n      return encoded;\n    }\n    case \"string\":\n      return JSON.stringify(value);\n    case \"object\":\n      if (Array.isArray(value)) {\n        return `[${value.map((item) => serialize(item)).join(\",\")}]`;\n      }\n      return serializeObject(value);\n    default:\n      throw new SignedObjectCanonicalizationError(\n        `unsupported JSON value type ${typeof value}`,\n      );\n  }\n}\n\nfunction normalizeJsonObjectOrArray(input: object, path: string): JsonValue {\n  assertNoSymbolKeys(input, path);\n\n  if (Array.isArray(input)) {\n    for (const key of Object.getOwnPropertyNames(input)) {\n      if (key === \"length\") {\n        continue;\n      }\n      if (!isArrayIndexKey(key, input.length)) {\n        throw new SignedObjectCanonicalizationError(\n          `${path}.${key} is not allowed on a JSON array`,\n        );\n      }\n      const descriptor = Object.getOwnPropertyDescriptor(input, key);\n      if (descriptor?.enumerable !== true) {\n        throw new SignedObjectCanonicalizationError(\n          `${path}[${key}] must be an enumerable JSON array item`,\n        );\n      }\n      if (!(\"value\" in descriptor)) {\n        throw new SignedObjectCanonicalizationError(\n          `${path}[${key}] must be a JSON data property`,\n        );\n      }\n    }\n    const output: JsonValue[] = [];\n    for (let index = 0; index < input.length; index++) {\n      if (!objectHasOwn(input, index)) {\n        throw new SignedObjectCanonicalizationError(\n          `${path}[${index}] must not be a sparse array hole`,\n        );\n      }\n      output.push(normalizeJson(input[index], `${path}[${index}]`));\n    }\n    return output;\n  }\n\n  const proto = Object.getPrototypeOf(input);\n  if (proto !== Object.prototype && proto !== null) {\n    throw new SignedObjectCanonicalizationError(\n      `${path} must be a plain JSON object`,\n    );\n  }\n\n  const output = Object.create(null) as MutableJsonObject;\n  for (const key of Object.getOwnPropertyNames(input)) {\n    assertUnicodeScalarString(key, `${path} key`);\n    if (key === \"__proto__\" || key === \"constructor\") {\n      throw new SignedObjectCanonicalizationError(\n        `${path}.${key} is not allowed`,\n      );\n    }\n    const descriptor = Object.getOwnPropertyDescriptor(input, key);\n    if (descriptor?.enumerable !== true) {\n      throw new SignedObjectCanonicalizationError(\n        `${path}.${key} must be an enumerable JSON object property`,\n      );\n    }\n    if (!(\"value\" in descriptor)) {\n      throw new SignedObjectCanonicalizationError(\n        `${path}.${key} must be a JSON data property`,\n      );\n    }\n    const value = descriptor.value;\n    output[key] = normalizeJson(value, `${path}.${key}`);\n  }\n  return output;\n}\n\nfunction assertNoSymbolKeys(input: object, path: string): void {\n  if (Object.getOwnPropertySymbols(input).length > 0) {\n    throw new SignedObjectCanonicalizationError(\n      `${path} must not have symbol properties`,\n    );\n  }\n}\n\nfunction isArrayIndexKey(key: string, length: number): boolean {\n  if (!/^(0|[1-9]\\d*)$/.test(key)) {\n    return false;\n  }\n  const index = Number(key);\n  return Number.isSafeInteger(index) && index >= 0 && index < length;\n}\n\nfunction serializeObject(value: { readonly [key: string]: JsonValue }): string {\n  const keys = Object.keys(value).sort(compareUtf16CodeUnits);\n  const parts = keys.map((key) => `${JSON.stringify(key)}:${serialize(value[key])}`);\n  return `{${parts.join(\",\")}}`;\n}\n\nfunction compareUtf16CodeUnits(a: string, b: string): number {\n  const max = Math.min(a.length, b.length);\n  for (let index = 0; index < max; index++) {\n    const leftCodeUnit = a.charCodeAt(index);\n    const rightCodeUnit = b.charCodeAt(index);\n    if (leftCodeUnit !== rightCodeUnit) {\n      return leftCodeUnit - rightCodeUnit;\n    }\n  }\n  return a.length - b.length;\n}\n\nfunction assertUnicodeScalarString(value: string, path: string): void {\n  for (let index = 0; index < value.length; index++) {\n    const code = value.charCodeAt(index);\n    if (code >= 0xd800 && code <= 0xdbff) {\n      const next = value.charCodeAt(index + 1);\n      if (Number.isNaN(next) || next < 0xdc00 || next > 0xdfff) {\n        throw new SignedObjectCanonicalizationError(\n          `${path} contains a lone high surrogate`,\n        );\n      }\n      index++;\n      continue;\n    }\n    if (code >= 0xdc00 && code <= 0xdfff) {\n      throw new SignedObjectCanonicalizationError(\n        `${path} contains a lone low surrogate`,\n      );\n    }\n  }\n}\n","import { ed25519 } from \"@noble/curves/ed25519\";\nimport { base58btc } from \"multiformats/bases/base58\";\nimport { canonicalizeSignedObjectUnsigned as canonicalize } from \"../policy/signed-object.js\";\n\n/** Matches V2_DELIVERY_DOMAIN in tinycloud-node-server/src/share_v2.rs. */\nexport const SHARE_DELIVERY_AUTHORIZATION_DOMAIN = \"xyz.tinycloud.share/delivery-authorization/v2\\0\";\n\n/** Exact camelCase mirror of the Rust `V2DeliveryRequest` wire struct. */\nexport interface ShareDeliveryAuthorizationRequest {\n  readonly envelopeCid: string;\n  readonly shareCid: string;\n  readonly shareId: string;\n  readonly registrationCid: string;\n  readonly policyCid: string;\n  readonly delegationCid: string;\n  readonly enforcementDelegationCid: string;\n  readonly recipientEmail: string;\n  readonly shareUrl: string;\n  readonly documentName: string;\n  readonly jti: string;\n  readonly idempotencyKey: string;\n  readonly expiresAt: string;\n  readonly requestBodyDigest: string;\n}\n\n/** Exact mirror of the `authorization` object the Node route signs and returns. */\nexport interface ShareDeliveryAuthorization {\n  readonly type: \"TinyCloudShareDeliveryAuthorization\";\n  readonly version: 2;\n  readonly jti: string;\n  readonly shareCid: string;\n  readonly shareId: string;\n  readonly registrationCid: string;\n  readonly delegationCid: string;\n  readonly enforcementDelegationCid: string;\n  readonly envelopeCid: string;\n  readonly policyCid: string;\n  readonly nodeAudience: string;\n  readonly targetOrigin: string;\n  /**\n   * The OpenCredentials witness this delivery is scoped to, sourced from\n   * Node's own trusted credentials origin. Deliberately distinct from\n   * `nodeAudience` (the node's own DID) and `returnOrigin` (Share's page\n   * origin) — conflating any of these three would let a party impersonate\n   * another's audience.\n   */\n  readonly openCredentialsAudience: string;\n  readonly holder: string;\n  readonly recipientMatcher: unknown;\n  readonly deliveryEmail: string;\n  readonly shareUrl: string;\n  readonly returnOrigin: string;\n  readonly documentName: string;\n  readonly senderDid: string;\n  readonly senderTrust: string;\n  readonly contentSource: unknown;\n  readonly contentSourceDigest: string;\n  readonly shareExpiresAt: string;\n  readonly issuedAt: string;\n  readonly reportAbuseToken: string;\n  readonly actions: readonly string[];\n  readonly resource: string;\n  readonly authorityMaterialHandle: string;\n  readonly authorityMaterialDigest: string;\n  readonly requestBodyDigest: string;\n  readonly idempotencyKey: string;\n  readonly expiresAt: string;\n  readonly dataAuthority: false;\n}\n\nexport interface ShareDeliveryAuthorizationReceipt {\n  readonly authorization: ShareDeliveryAuthorization;\n  readonly proof: { readonly alg: \"EdDSA\"; readonly kid: string; readonly signature: string };\n}\n\nexport interface ValidateShareDeliveryAuthorizationExpected {\n  readonly request: ShareDeliveryAuthorizationRequest;\n  /** The enrolled receipt key from the node trust bundle. */\n  readonly nodeProof: { readonly kid: string; readonly publicKey: Uint8Array };\n  /**\n   * The OpenCredentials witness origin the caller trusts, from the same\n   * trust bundle as `nodeProof`. Validated independently of the\n   * authorization's own `nodeAudience`/`returnOrigin` fields so a Node that\n   * mislabels or omits its credentials origin fails closed here rather than\n   * silently inheriting one of those unrelated identities.\n   */\n  readonly credentialsAudience: string;\n}\n\n/** Matches `canonical_https_origin` in tinycloud-node-server/src/config.rs. */\nfunction isCanonicalHttpsOrigin(value: string): boolean {\n  let url: URL;\n  try {\n    url = new URL(value);\n  } catch {\n    return false;\n  }\n  return url.protocol === \"https:\"\n    && url.origin === value\n    && url.pathname === \"/\"\n    && url.search === \"\"\n    && url.hash === \"\"\n    && url.username === \"\"\n    && url.password === \"\";\n}\n\nconst AUTHORIZATION_KEYS = [\n  \"type\", \"version\", \"jti\", \"shareCid\", \"shareId\", \"registrationCid\", \"delegationCid\",\n  \"enforcementDelegationCid\", \"envelopeCid\", \"policyCid\", \"nodeAudience\", \"targetOrigin\",\n  \"openCredentialsAudience\",\n  \"holder\", \"recipientMatcher\", \"deliveryEmail\", \"shareUrl\", \"returnOrigin\", \"documentName\",\n  \"senderDid\", \"senderTrust\", \"contentSource\", \"contentSourceDigest\", \"shareExpiresAt\",\n  \"issuedAt\", \"reportAbuseToken\", \"actions\", \"resource\", \"authorityMaterialHandle\",\n  \"authorityMaterialDigest\", \"requestBodyDigest\", \"idempotencyKey\", \"expiresAt\", \"dataAuthority\",\n] as const;\n\nfunction assertObject(value: unknown, keys: readonly string[], label: string): Record<string, unknown> {\n  if (typeof value !== \"object\" || value === null || Array.isArray(value)) throw new Error(`${label} is invalid`);\n  const record = value as Record<string, unknown>;\n  if (Object.keys(record).length !== keys.length || keys.some((key) => !Object.prototype.hasOwnProperty.call(record, key))) throw new Error(`${label} has unknown or missing fields`);\n  return record;\n}\n\nfunction fromB64(value: string): Uint8Array {\n  if (!/^[A-Za-z0-9_-]+$/.test(value)) throw new Error(\"share delivery value is not canonical base64url\");\n  if (typeof atob === \"function\") {\n    const padded = value.replace(/-/g, \"+\").replace(/_/g, \"/\") + \"=\".repeat((4 - value.length % 4) % 4);\n    return Uint8Array.from(atob(padded), (character) => character.charCodeAt(0));\n  }\n  if (typeof Buffer !== \"undefined\") return new Uint8Array(Buffer.from(value, \"base64url\"));\n  throw new Error(\"base64url decoding is unavailable\");\n}\n\n/**\n * Validate the exact UTF-8 response bytes emitted by\n * `POST /share/v2/deliveries/authorize`, bind them to the submitted\n * request, and verify the Node's detached EdDSA proof.\n */\nexport function validateShareDeliveryAuthorizationBytes(bytesValue: Uint8Array, expected: ValidateShareDeliveryAuthorizationExpected): ShareDeliveryAuthorizationReceipt {\n  let value: unknown;\n  try {\n    value = JSON.parse(new TextDecoder(\"utf-8\", { fatal: true }).decode(bytesValue));\n  } catch {\n    throw new Error(\"share delivery authorization response is not valid UTF-8 JSON\");\n  }\n  const root = assertObject(value, [\"authorization\", \"proof\"], \"share delivery authorization response\");\n  const authorization = assertObject(root.authorization, AUTHORIZATION_KEYS, \"share delivery authorization\");\n  const proof = assertObject(root.proof, [\"alg\", \"kid\", \"signature\"], \"share delivery authorization proof\");\n\n  const request = expected.request;\n  if (\n    authorization.type !== \"TinyCloudShareDeliveryAuthorization\"\n    || authorization.version !== 2\n    || authorization.dataAuthority !== false\n    || authorization.jti !== request.jti\n    || authorization.shareCid !== request.shareCid\n    || authorization.shareId !== request.shareId\n    || authorization.registrationCid !== request.registrationCid\n    || authorization.delegationCid !== request.delegationCid\n    || authorization.enforcementDelegationCid !== request.enforcementDelegationCid\n    || authorization.envelopeCid !== request.envelopeCid\n    || authorization.policyCid !== request.policyCid\n    || authorization.deliveryEmail !== request.recipientEmail\n    || authorization.shareUrl !== request.shareUrl\n    || authorization.documentName !== request.documentName\n    || authorization.requestBodyDigest !== request.requestBodyDigest\n    || authorization.expiresAt !== request.expiresAt\n    || authorization.idempotencyKey !== request.idempotencyKey\n    || authorization.reportAbuseToken !== request.jti\n    || authorization.authorityMaterialHandle !== request.registrationCid\n  ) {\n    throw new Error(\"share delivery authorization is not bound to the submitted request\");\n  }\n  if (typeof authorization.issuedAt !== \"string\" || Date.parse(authorization.issuedAt) > Date.now() + 60_000) throw new Error(\"share delivery authorization issuedAt is invalid\");\n  if (new Date(authorization.expiresAt as string).toISOString() !== authorization.expiresAt) throw new Error(\"share delivery authorization expiresAt is non-canonical\");\n\n  // Independent audience check: the OpenCredentials witness field must be a\n  // canonical https origin, must equal the caller's own trusted value (never\n  // derived from the response), and must not collapse into the node's own\n  // audience or Share's return origin.\n  if (\n    typeof authorization.openCredentialsAudience !== \"string\"\n    || !isCanonicalHttpsOrigin(authorization.openCredentialsAudience)\n    || authorization.openCredentialsAudience !== expected.credentialsAudience\n    || authorization.openCredentialsAudience === authorization.nodeAudience\n    || authorization.openCredentialsAudience === authorization.returnOrigin\n  ) {\n    throw new Error(\"share delivery authorization openCredentialsAudience is missing or untrusted\");\n  }\n\n  if (proof.alg !== \"EdDSA\" || typeof proof.kid !== \"string\" || typeof proof.signature !== \"string\") throw new Error(\"share delivery authorization proof is invalid\");\n  if (proof.kid !== expected.nodeProof.kid) throw new Error(\"share delivery authorization proof key is not trusted\");\n  const encodedKid = expected.nodeProof.publicKey;\n  const publicKey = encodedKid.length === 34 && encodedKid[0] === 0xed && encodedKid[1] === 0x01 ? encodedKid.slice(2) : encodedKid;\n  if (publicKey.length !== 32) throw new Error(\"share delivery authorization proof key is invalid\");\n  const signatureBytes = fromB64(proof.signature);\n  const signedBytes = new TextEncoder().encode(`${SHARE_DELIVERY_AUTHORIZATION_DOMAIN}${canonicalize(authorization)}`);\n  if (signatureBytes.length !== 64 || !ed25519.verify(signatureBytes, signedBytes, publicKey)) throw new Error(\"share delivery authorization proof signature is invalid\");\n\n  return { authorization: authorization as unknown as ShareDeliveryAuthorization, proof: proof as unknown as ShareDeliveryAuthorizationReceipt[\"proof\"] };\n}\n\n/** Build the trusted-signer descriptor `did:key:...#z...` expects from a raw node signing key. */\nexport function shareDeliveryTrustedKid(publicKey: Uint8Array): string {\n  if (publicKey.length !== 32) throw new Error(\"share delivery node key must be a raw 32-byte Ed25519 public key\");\n  const prefixed = new Uint8Array(34);\n  prefixed.set([0xed, 0x01]);\n  prefixed.set(publicKey, 2);\n  const did = `did:key:${base58btc.encode(prefixed)}`;\n  return `${did}#${did.slice(\"did:key:\".length)}`;\n}\n","import type { DelegatedShareKey, OwnerShareAction, OwnerShareMatcher, OwnerSharePolicyRegistrationReceipt } from \"./owner-policy\";\nimport { restoreDelegatedShareKey } from \"./owner-policy\";\n\n/**\n * The durable record a sender needs, after a reload, to display and manage\n * a share it created. Every identity/CID here comes verbatim from the\n * Node-verified {@link OwnerSharePolicyRegistrationReceipt}; nothing is\n * re-derived or guessed.\n */\nexport interface SenderShareRecord {\n  readonly shareId: string;\n  readonly registrationCid: string;\n  readonly policyCid: string;\n  readonly ownerDelegationCid: string;\n  readonly enforcementDelegationCid: string;\n  readonly shareKeyDid: string;\n  readonly ownerDid: string;\n  readonly enforcerDid: string;\n  readonly target: { readonly origin: string; readonly nodeAudience: string; readonly spaceId: string };\n  readonly resource: { readonly kind: \"exact\" | \"prefix\"; readonly path: string };\n  readonly actions: readonly OwnerShareAction[];\n  readonly recipientMatcher: OwnerShareMatcher;\n  readonly registeredAt: string;\n  readonly expiresAt: string;\n  readonly revokedAt?: string;\n}\n\n/**\n * \"direct\" revokes only this share's enforcement delegation. \"ancestor\"\n * revokes the owner delegation the share descends from, which transitively\n * denies every share built on it (see `revocation_in_ancestry` in\n * `tinycloud-node-server/src/share_v2.rs`). Both are existing CIDs that a\n * caller passes to the node's generic `tinycloud.delegation/revoke`\n * invocation (`DelegationManager.revoke` / `TinyCloudNode.revokeDelegation`)\n * -- there is no share-v2-specific revoke route.\n */\nexport type SenderShareRevocationScope = \"direct\" | \"ancestor\";\n\nexport interface SenderShareRecordStorage {\n  put(record: SenderShareRecord): Promise<void>;\n  list(): Promise<readonly SenderShareRecord[]>;\n  get(shareId: string): Promise<SenderShareRecord | undefined>;\n  delete(shareId: string): Promise<void>;\n}\n\nexport interface StoredSenderShareKey {\n  readonly cryptoKey: CryptoKey;\n  readonly publicKey: Uint8Array;\n  readonly extractable: boolean;\n}\n\nexport interface SenderShareKeyStorage {\n  put(shareId: string, key: StoredSenderShareKey): Promise<void>;\n  get(shareId: string): Promise<StoredSenderShareKey | undefined>;\n  delete(shareId: string): Promise<void>;\n}\n\n/** In-memory reference implementation. Real deployments back these with IndexedDB so the non-extractable `CryptoKey` survives a reload via structured clone. */\nexport class MemorySenderShareRecordStorage implements SenderShareRecordStorage {\n  private readonly records = new Map<string, SenderShareRecord>();\n\n  async put(record: SenderShareRecord): Promise<void> {\n    this.records.set(record.shareId, record);\n  }\n\n  async list(): Promise<readonly SenderShareRecord[]> {\n    return [...this.records.values()];\n  }\n\n  async get(shareId: string): Promise<SenderShareRecord | undefined> {\n    return this.records.get(shareId);\n  }\n\n  async delete(shareId: string): Promise<void> {\n    this.records.delete(shareId);\n  }\n}\n\nexport class MemorySenderShareKeyStorage implements SenderShareKeyStorage {\n  private readonly keys = new Map<string, StoredSenderShareKey>();\n\n  async put(shareId: string, key: StoredSenderShareKey): Promise<void> {\n    this.keys.set(shareId, key);\n  }\n\n  async get(shareId: string): Promise<StoredSenderShareKey | undefined> {\n    return this.keys.get(shareId);\n  }\n\n  async delete(shareId: string): Promise<void> {\n    this.keys.delete(shareId);\n  }\n}\n\nexport interface SenderShareStoreOptions {\n  readonly records: SenderShareRecordStorage;\n  readonly keys: SenderShareKeyStorage;\n  readonly now?: () => Date;\n}\n\n/**\n * Reload-safe sender-side management for shares created through\n * {@link canonicalOwnerSharePolicy} / `registerOwnerSharePolicy`. Persists\n * the registration receipt's canonical identity tuple plus the ephemeral\n * share key's non-extractable `CryptoKey` handle, so a sender can list,\n * inspect, and revoke shares it created in an earlier session -- without\n * ever re-exporting private key material.\n */\nexport class SenderShareStore {\n  private readonly records: SenderShareRecordStorage;\n  private readonly keys: SenderShareKeyStorage;\n  private readonly now: () => Date;\n\n  constructor(options: SenderShareStoreOptions) {\n    this.records = options.records;\n    this.keys = options.keys;\n    this.now = options.now ?? (() => new Date());\n  }\n\n  /** Persist a Node-verified registration receipt and its share key handle. */\n  async save(receipt: OwnerSharePolicyRegistrationReceipt, key: DelegatedShareKey): Promise<SenderShareRecord> {\n    const registration = receipt.registration;\n    if (registration.shareKeyDid !== key.did) throw new Error(\"share key does not match the registered receipt\");\n    const record: SenderShareRecord = {\n      shareId: registration.shareId,\n      registrationCid: registration.registrationCid,\n      policyCid: registration.policyCid,\n      ownerDelegationCid: registration.ownerDelegationCid,\n      enforcementDelegationCid: registration.enforcementDelegationCid,\n      shareKeyDid: registration.shareKeyDid,\n      ownerDid: registration.ownerDid,\n      enforcerDid: registration.enforcerDid,\n      target: registration.target,\n      resource: registration.resource,\n      actions: registration.actions,\n      recipientMatcher: registration.recipientMatcher,\n      registeredAt: registration.registeredAt,\n      expiresAt: registration.expiresAt,\n    };\n    await this.records.put(record);\n    await this.keys.put(record.shareId, { cryptoKey: key.cryptoKey, publicKey: key.publicKey, extractable: key.extractable });\n    return record;\n  }\n\n  /** List shares created in any session, most recent first. */\n  async list(options?: { readonly includeRevoked?: boolean; readonly includeExpired?: boolean }): Promise<readonly SenderShareRecord[]> {\n    const now = this.now().getTime();\n    const records = await this.records.list();\n    return records\n      .filter((record) => (options?.includeRevoked ?? false) || record.revokedAt === undefined)\n      .filter((record) => (options?.includeExpired ?? false) || Date.parse(record.expiresAt) > now)\n      .sort((left, right) => Date.parse(right.registeredAt) - Date.parse(left.registeredAt));\n  }\n\n  async get(shareId: string): Promise<SenderShareRecord | undefined> {\n    return this.records.get(shareId);\n  }\n\n  /** Recover a signer for the persisted share key after a reload. */\n  async loadKey(shareId: string): Promise<DelegatedShareKey | undefined> {\n    const stored = await this.keys.get(shareId);\n    if (stored === undefined) return undefined;\n    return restoreDelegatedShareKey({\n      privateKey: stored.cryptoKey,\n      publicKey: stored.publicKey,\n      extractable: stored.extractable,\n    });\n  }\n\n  /**\n   * The delegation CID to pass to the node's existing generic\n   * `tinycloud.delegation/revoke` invocation to revoke this share at the\n   * requested scope. Does not itself call the node -- callers invoke\n   * their own `revokeDelegation`/`DelegationManager.revoke` with the\n   * returned CID, then call {@link markRevoked} once that succeeds.\n   */\n  async revocationTarget(shareId: string, scope: SenderShareRevocationScope): Promise<string> {\n    const record = await this.records.get(shareId);\n    if (record === undefined) throw new Error(`Unknown share: ${shareId}`);\n    return scope === \"direct\" ? record.enforcementDelegationCid : record.ownerDelegationCid;\n  }\n\n  /** Mark a share revoked locally after the caller's node-side revoke call succeeds. */\n  async markRevoked(shareId: string, revokedAt: string = this.now().toISOString()): Promise<SenderShareRecord> {\n    const record = await this.records.get(shareId);\n    if (record === undefined) throw new Error(`Unknown share: ${shareId}`);\n    const revoked: SenderShareRecord = { ...record, revokedAt };\n    await this.records.put(revoked);\n    return revoked;\n  }\n\n  /** Forget a share and clear its persisted key handle. */\n  async remove(shareId: string): Promise<void> {\n    await this.records.delete(shareId);\n    await this.keys.delete(shareId);\n  }\n}\n"],"mappings":";;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;;;ACSA,iBAAkB;AAyCX,IAAM,YAAY,aAAE,OAAO;AAAA;AAAA,EAEhC,KAAK,aAAE,OAAO;AAAA;AAAA,EAEd,KAAK,aAAE,OAAO,EAAE,SAAS;AAAA;AAAA,EAEzB,GAAG,aAAE,OAAO,EAAE,SAAS;AAAA;AAAA,EAEvB,GAAG,aAAE,OAAO,EAAE,SAAS;AAAA;AAAA,EAEvB,GAAG,aAAE,OAAO,EAAE,SAAS;AAAA;AAAA,EAEvB,GAAG,aAAE,OAAO,EAAE,SAAS;AAAA;AAAA,EAEvB,GAAG,aAAE,OAAO,EAAE,SAAS;AAAA;AAAA,EAEvB,KAAK,aAAE,OAAO,EAAE,SAAS;AAAA;AAAA,EAEzB,KAAK,aAAE,OAAO,EAAE,SAAS;AAAA;AAAA,EAEzB,KAAK,aAAE,OAAO,EAAE,SAAS;AAAA;AAAA,EAEzB,SAAS,aAAE,MAAM,aAAE,OAAO,CAAC,EAAE,SAAS;AACxC,CAAC;AAWM,IAAM,gBAAgB,aAAE,KAAK,CAAC,QAAQ,WAAW,UAAU,CAAC;AAM5D,IAAM,gBAAgB,aAAE,OAAO;AAAA;AAAA,EAEpC,IAAI,aAAE,OAAO;AAAA;AAAA,EAEb,KAAK,aAAE,OAAO;AAAA;AAAA,EAEd,MAAM;AAAA;AAAA,EAEN,KAAK,UAAU,SAAS;AAAA;AAAA,EAExB,UAAU,aAAE,OAAO;AACrB,CAAC;AAWM,IAAM,wBAAwB,aAAE,OAAO;AAAA;AAAA,EAE5C,MAAM,aAAE,OAAO;AAAA;AAAA,EAEf,SAAS,aAAE,OAAO;AAAA;AAAA,EAElB,SAAS,aAAE,QAAQ,YAAY;AAAA;AAAA,EAE/B,OAAO,aAAE,WAAW,KAAK,EAAE,SAAS;AAAA;AAAA,EAEpC,MAAM,aAAE,OAAO,aAAE,OAAO,GAAG,aAAE,QAAQ,CAAC,EAAE,SAAS;AACnD,CAAC;AAOM,IAAM,uBAAuB;AAAA,EAClC,eAAe;AAAA,EACf,cAAc;AAAA,EACd,iBAAiB;AAAA,EACjB,WAAW;AAAA,EACX,SAAS;AAAA,EACT,eAAe;AAAA,EACf,SAAS;AAAA,EACT,SAAS;AAAA,EACT,eAAe;AAAA,EACf,mBAAmB;AAAA,EACnB,iBAAiB;AAAA,EACjB,mBAAmB;AAAA,EACnB,eAAe;AAAA,EACf,wBAAwB;AAAA,EACxB,mBAAmB;AAAA,EACnB,kBAAkB;AACpB;AAYO,IAAM,mBAAmB,aAAE,OAAO;AAAA;AAAA,EAEvC,KAAK,aAAE,OAAO;AAAA;AAAA,EAEd,aAAa,aAAE,OAAO;AAAA;AAAA,EAEtB,SAAS,aAAE,OAAO;AAAA;AAAA,EAElB,MAAM,aAAE,OAAO;AAAA;AAAA,EAEf,SAAS,aAAE,MAAM,aAAE,OAAO,CAAC;AAAA;AAAA,EAE3B,SAAS,aAAE,MAAM,aAAE,OAAO,aAAE,OAAO,GAAG,aAAE,QAAQ,CAAC,CAAC,EAAE,SAAS;AAAA;AAAA,EAE7D,QAAQ,aAAE,OAAO,KAAK;AAAA;AAAA,EAEtB,WAAW,aAAE,QAAQ;AAAA;AAAA,EAErB,cAAc,aAAE,OAAO,EAAE,SAAS;AAAA;AAAA,EAElC,WAAW,aAAE,OAAO,KAAK,EAAE,SAAS;AAAA;AAAA,EAEpC,WAAW,aAAE,OAAO,EAAE,SAAS;AAAA;AAAA,EAE/B,oBAAoB,aAAE,QAAQ,EAAE,SAAS;AAAA;AAAA,EAEzC,YAAY,aAAE,OAAO,EAAE,SAAS;AAClC,CAAC;AAKM,IAAM,yBAAyB,aAAE,OAAO;AAAA,EAC7C,KAAK,aAAE,OAAO,EAAE,IAAI,CAAC;AAAA,EACrB,QAAQ,aAAE,KAAK,CAAC,UAAU,WAAW,WAAW,eAAe,WAAW,CAAC;AAAA,EAC3E,QAAQ,aAAE,QAAQ;AAAA,EAClB,QAAQ,aAAE,QAAQ;AAAA,EAClB,SAAS,aAAE,QAAQ;AAAA,EACnB,SAAS,aAAE,QAAQ;AACrB,CAAC,EAAE,OAAO,EAAE,YAAY,CAAC,OAAO,YAAY;AAC1C,QAAM,QAAQ,MAAM,WAAW,WAC3B,MAAM,UAAU,MAAM,UAAU,CAAC,MAAM,WAAW,CAAC,MAAM,UACzD,MAAM,WAAW,YACf,MAAM,UAAU,CAAC,MAAM,UAAU,MAAM,WAAW,CAAC,MAAM,UACzD,MAAM,WAAW,YACf,MAAM,UAAU,CAAC,MAAM,UAAU,CAAC,MAAM,WAAW,MAAM,UACzD,MAAM,WAAW,gBACf,MAAM,UAAU,CAAC,MAAM,UAAU,CAAC,MAAM,WAAW,CAAC,MAAM,UAC1D,CAAC,MAAM,UAAU,CAAC,MAAM,UAAU,CAAC,MAAM,WAAW,CAAC,MAAM;AACrE,MAAI,CAAC,OAAO;AACV,YAAQ,SAAS;AAAA,MACf,MAAM,aAAE,aAAa;AAAA,MACrB,SAAS;AAAA,IACX,CAAC;AAAA,EACH;AACF,CAAC;AAIM,IAAM,oCAAoC,aAAE,OAAO;AAAA,EACxD,SAAS,aAAE,QAAQ,IAAI;AAAA,EACvB,KAAK,aAAE,OAAO,EAAE,IAAI,CAAC;AACvB,CAAC,EAAE,OAAO;AAIH,IAAM,kCAAkC,aAAE,OAAO;AAAA,EACtD,UAAU,aAAE,OAAO,EAAE,IAAI,CAAC;AAAA,EAC1B,SAAS,aAAE,MAAM,aAAE,OAAO,CAAC;AAAA,EAC3B,SAAS,aAAE,MAAM,aAAE,OAAO,aAAE,OAAO,GAAG,aAAE,QAAQ,CAAC,CAAC;AACpD,CAAC,EAAE,OAAO;AAEV,IAAM,8BAA8B,aACjC,OAAO,EACP,SAAS,EAAE,QAAQ,KAAK,CAAC,EACzB,UAAU,CAAC,UAAU,IAAI,KAAK,KAAK,CAAC;AAEhC,IAAM,gCAAgC,aAAE,OAAO;AAAA,EACpD,KAAK,aAAE,OAAO,EAAE,IAAI,CAAC;AAAA,EACrB,WAAW,aAAE,KAAK,CAAC,WAAW,UAAU,CAAC;AAAA,EACzC,cAAc,aAAE,OAAO,EAAE,IAAI,CAAC;AAAA,EAC9B,aAAa,aAAE,OAAO,EAAE,IAAI,CAAC;AAAA,EAC7B,WAAW,aAAE,MAAM,+BAA+B;AAAA,EAClD,SAAS,aAAE,MAAM,aAAE,OAAO,CAAC;AAAA,EAC3B,UAAU,4BAA4B,SAAS;AAAA,EAC/C,WAAW,4BAA4B,SAAS;AAAA,EAChD,WAAW,4BAA4B,SAAS;AAAA,EAChD,QAAQ,aAAE,KAAK,CAAC,UAAU,WAAW,WAAW,WAAW,kBAAkB,CAAC;AAAA,EAC9E,WAAW,4BAA4B,SAAS,EAAE,SAAS;AAAA,EAC3D,WAAW,aAAE,OAAO,EAAE,SAAS;AAAA,EAC/B,oBAAoB,aAAE,OAAO,EAAE,SAAS;AAC1C,CAAC,EAAE,OAAO;AAEH,IAAM,8BAA8B,aAAE,OAAO;AAAA,EAClD,eAAe,aAAE,QAAQ,CAAC;AAAA,EAC1B,OAAO,aAAE,MAAM,6BAA6B;AAAA,EAC5C,YAAY,aAAE,OAAO,EAAE,SAAS;AAClC,CAAC,EAAE,OAAO;AAMH,IAAM,sCAAsC,aAAE,OAAO;AAAA,EAC1D,WAAW,aAAE,KAAK,CAAC,WAAW,YAAY,KAAK,CAAC,EAAE,SAAS;AAAA,EAC3D,QAAQ,aAAE,KAAK,CAAC,UAAU,WAAW,WAAW,WAAW,kBAAkB,CAAC,EAAE,SAAS;AAAA,EACzF,OAAO,aAAE,OAAO,EAAE,KAAK,EAAE,IAAI,CAAC,EAAE,SAAS;AAAA,EACzC,OAAO,aAAE,OAAO,EAAE,IAAI,EAAE,IAAI,CAAC,EAAE,IAAI,GAAG,EAAE,SAAS;AAAA,EACjD,QAAQ,aAAE,OAAO,EAAE,IAAI,CAAC,EAAE,SAAS;AACrC,CAAC,EAAE,OAAO;AAOH,IAAM,wBAAwB,aAAE,OAAO;AAAA;AAAA,EAE5C,UAAU,aAAE,OAAO;AAAA;AAAA,EAEnB,QAAQ,aAAE,OAAO;AAAA;AAAA,EAEjB,MAAM,aAAE,MAAM,aAAa;AAAA;AAAA,EAE3B,YAAY;AAAA;AAAA,EAEZ,WAAW,aAAE,OAAO,KAAK,EAAE,SAAS;AACtC,CAAC;AAOM,IAAM,yBAAyB,aAAE,OAAO;AAAA;AAAA,EAE7C,KAAK,aAAE,OAAO;AAAA;AAAA,EAEd,SAAS,aAAE,OAAO;AAAA;AAAA,EAElB,WAAW,aAAE,OAAO;AAAA;AAAA,EAEpB,WAAW,aAAE,OAAO;AAAA;AAAA,EAEpB,OAAO,aAAE,OAAO,EAAE,SAAS;AAAA;AAAA,EAE3B,MAAM,aAAE,OAAO;AAAA;AAAA,EAEf,SAAS,aAAE,MAAM,aAAE,OAAO,CAAC;AAAA;AAAA,EAE3B,QAAQ,aAAE,OAAO,KAAK,EAAE,SAAS;AAAA;AAAA,EAEjC,WAAW,aAAE,OAAO,KAAK,EAAE,SAAS;AAAA;AAAA,EAEpC,WAAW,aAAE,QAAQ;AAAA;AAAA,EAErB,WAAW,aAAE,OAAO,KAAK;AAAA;AAAA,EAEzB,WAAW,aAAE,OAAO,EAAE,SAAS;AACjC,CAAC;AAOM,IAAM,+BAA+B,aAAE,OAAO;AAAA;AAAA,EAEnD,aAAa,aAAE,OAAO;AAAA;AAAA,EAEtB,MAAM,aAAE,OAAO;AAAA;AAAA,EAEf,SAAS,aAAE,MAAM,aAAE,OAAO,CAAC;AAAA;AAAA,EAE3B,QAAQ,aAAE,OAAO,KAAK,EAAE,SAAS;AAAA;AAAA,EAEjC,sBAAsB,aAAE,QAAQ,EAAE,SAAS;AAAA;AAAA,EAE3C,WAAW,aAAE,OAAO,EAAE,SAAS;AACjC,CAAC;AAOM,IAAM,wBAAwB,aAAE,MAAM,gBAAgB;AAMtD,IAAM,0BAA0B,aAAE,OAAO;AAAA;AAAA,EAE9C,MAAM;AAAA;AAAA,EAEN,OAAO,aAAE,MAAM,gBAAgB;AAAA;AAAA,EAE/B,MAAM;AACR,CAAC;AAWM,IAAM,4BAA4B,aAAE,KAAK,CAAC,WAAW,YAAY,KAAK,CAAC;AAMvE,IAAM,0BAA0B,aAAE,OAAO;AAAA;AAAA,EAE9C,WAAW,0BAA0B,SAAS;AAAA;AAAA,EAE9C,MAAM,aAAE,OAAO,EAAE,SAAS;AAAA;AAAA,EAE1B,SAAS,aAAE,MAAM,aAAE,OAAO,CAAC,EAAE,SAAS;AAAA;AAAA,EAEtC,gBAAgB,aAAE,QAAQ,EAAE,SAAS;AAAA;AAAA,EAErC,WAAW,aAAE,OAAO,EAAE,SAAS;AAAA;AAAA,EAE/B,WAAW,aAAE,OAAO,EAAE,SAAS;AAAA;AAAA,EAE/B,SAAS,aAAE,OAAO,KAAK,EAAE,SAAS;AAAA;AAAA,EAElC,OAAO,aAAE,OAAO,EAAE,SAAS;AAAA;AAAA,EAE3B,QAAQ,aAAE,OAAO,EAAE,SAAS;AAC9B,CAAC;AAWM,IAAM,uBAAuB,aAAE,KAAK,CAAC,SAAS,WAAW,CAAC;AAM1D,IAAM,kBAAkB,aAAE,OAAO;AAAA;AAAA,EAEtC,IAAI,aAAE,OAAO;AAAA;AAAA,EAEb,MAAM,aAAE,OAAO,EAAE,SAAS;AAAA;AAAA,EAE1B,OAAO,aAAE,OAAO;AAAA;AAAA,EAEhB,MAAM;AAAA;AAAA,EAEN,aAAa,aAAE,MAAM,aAAE,OAAO,CAAC,EAAE,SAAS;AAAA;AAAA,EAE1C,WAAW,aAAE,OAAO,KAAK,EAAE,SAAS;AACtC,CAAC;AAWM,IAAM,oBAAoB,aAAE,KAAK,CAAC,UAAU,WAAW,MAAM,CAAC;AAM9D,IAAM,kBAAkB,aAAE,OAAO;AAAA;AAAA,EAEtC,OAAO,aAAE,OAAO;AAAA;AAAA,EAEhB,KAAK,aAAE,OAAO;AAAA;AAAA,EAEd,YAAY;AAAA;AAAA,EAEZ,QAAQ;AAAA;AAAA,EAER,WAAW,aAAE,OAAO,KAAK,EAAE,SAAS;AAAA;AAAA,EAEpC,aAAa,aAAE,OAAO,EAAE,SAAS;AACnC,CAAC;AAOM,SAAS,0BAAkD,YAAe;AAC/E,SAAO,aAAE,OAAO;AAAA;AAAA,IAEd,MAAM;AAAA;AAAA,IAEN,YAAY;AAAA;AAAA,IAEZ,SAAS,aAAE,OAAO;AAAA;AAAA,IAElB,MAAM,aAAE,OAAO;AAAA,EACjB,CAAC;AACH;AAEO,IAAM,sBAAsB,0BAA0B,aAAE,QAAQ,CAAC;AAejE,IAAM,sBAAsB,aAAE,OAAO;AAAA;AAAA,EAE1C,SAAS,aAAE,QAAQ,EAAE,SAAS;AAAA;AAAA,EAE9B,eAAe,aAAE,QAAQ,EAAE,SAAS;AAAA;AAAA,EAEpC,SAAS,aAAE,OAAO,EAAE,SAAS;AAAA;AAAA,EAE7B,kBAAkB,aAAE,QAAQ,EAAE,SAAS;AAAA;AAAA,EAEvC,UAAU,aAAE,OAAO,EAAE,SAAS;AAChC,CAAC;AAWM,IAAM,4BAA4B,aAAE,OAAO;AAAA;AAAA,EAEhD,MAAM,aAAE,OAAO;AAAA;AAAA,EAEf,SAAS,aAAE,MAAM,aAAE,OAAO,CAAC,EAAE,SAAS;AAAA;AAAA,EAEtC,QAAQ,aAAE,OAAO,KAAK,EAAE,SAAS;AAAA;AAAA,EAEjC,QAAQ,kBAAkB,SAAS;AAAA;AAAA,EAEnC,aAAa,aAAE,OAAO,EAAE,SAAS;AAAA;AAAA,EAEjC,SAAS,aAAE,OAAO,EAAE,SAAS;AAC/B,CAAC;AAeM,IAAM,gCAAgC,aAAE,OAAO;AAAA;AAAA,EAEpD,OAAO,aAAE,MAAM,aAAE,OAAO,CAAC;AAAA;AAAA,EAEzB,gBAAgB,aAAE,OAAO,EAAE,IAAI,CAAC,EAAE,SAAS;AAAA;AAAA,EAE3C,SAAS,aAAE,QAAQ,EAAE;AAAA,IACnB,CAAC,QAA+B,QAAQ,QAAQ,OAAO,QAAQ;AAAA,IAC/D,EAAE,SAAS,mCAAmC;AAAA,EAChD;AAAA;AAAA,EAEA,QAAQ,aAAE,QAAQ,EAAE;AAAA,IAClB,CAAC,QAA+B,OAAO,QAAQ;AAAA,IAC/C,EAAE,SAAS,8BAA8B;AAAA,EAC3C;AAAA;AAAA,EAEA,WAAW,aAAE,QAAQ,EAAE;AAAA,IACrB,CAAC,QAAkC,QAAQ,UAAa,OAAO,QAAQ;AAAA,IACvE,EAAE,SAAS,8CAA8C;AAAA,EAC3D,EAAE,SAAS;AAAA;AAAA,EAEX,OAAO,aAAE,QAAQ,EAAE;AAAA,IACjB,CAAC,QAA8B,QAAQ,UAAa,OAAO,QAAQ;AAAA,IACnE,EAAE,SAAS,yCAAyC;AAAA,EACtD,EAAE,SAAS;AACb,CAAC;AAOM,IAAM,oBAAoB,aAAE,OAAO;AAAA;AAAA,EAExC,kBAAkB,aAAE,QAAQ,EAAE;AAAA,IAC5B,CAAC,QAAkD,OAAO,QAAQ;AAAA,IAClE,EAAE,SAAS,sBAAsB;AAAA,EACnC;AAAA;AAAA,EAEA,QAAQ,aAAE,QAAQ,EAAE;AAAA,IAClB,CAAC,QAA0C,OAAO,QAAQ;AAAA,IAC1D,EAAE,SAAS,sBAAsB;AAAA,EACnC;AAAA;AAAA,EAEA,QAAQ,aAAE,QAAQ,EAAE;AAAA,IAClB,CAAC,QAAmD,OAAO,QAAQ;AAAA,IACnE,EAAE,SAAS,sBAAsB;AAAA,EACnC;AACF,CAAC;AAWM,IAAM,8BAA8B,aAAE,OAAO;AAAA;AAAA,EAElD,MAAM,aAAE,OAAO;AAAA;AAAA,EAEf,WAAW,aAAE,OAAO;AAAA;AAAA,EAEpB,SAAS,aAAE,OAAO;AAAA;AAAA,EAElB,KAAK,aAAE,OAAO,EAAE,SAAS;AAC3B,CAAC;AAqBM,IAAM,0BAA0B,aAAE,OAAO;AAAA;AAAA,EAE9C,SAAS,aAAE,OAAO;AAAA;AAAA,EAElB,OAAO,aAAE,OAAO;AAAA;AAAA,EAEhB,MAAM,aAAE,OAAO;AAAA;AAAA,EAEf,SAAS,aAAE,MAAM,aAAE,OAAO,CAAC;AAAA;AAAA,EAE3B,SAAS,aAAE,MAAM,aAAE,OAAO,aAAE,OAAO,GAAG,aAAE,QAAQ,CAAC,CAAC,EAAE,SAAS;AAC/D,CAAC;AAgBM,IAAM,mCAAmC,aAAE,OAAO;AAAA;AAAA,EAEvD,SAAS,aAAE,QAAQ,EAAE;AAAA,IACnB,CAAC,QAA+B,QAAQ,QAAQ,OAAO,QAAQ;AAAA,IAC/D,EAAE,SAAS,mCAAmC;AAAA,EAChD;AAAA;AAAA,EAEA,aAAa,aAAE,OAAO;AAAA;AAAA,EAEtB,SAAS,aAAE,OAAO;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAiBlB,WAAW,aAAE,OAAO,aAAE,OAAO,GAAG,aAAE,OAAO,aAAE,OAAO,GAAG,aAAE,MAAM,aAAE,OAAO,CAAC,CAAC,CAAC;AAAA;AAAA,EAEzE,gBAAgB,aAAE,OAAO;AAAA;AAAA,EAEzB,eAAe,aAAE,OAAO,EAAE,SAAS;AACrC,CAAC;AAYM,IAAM,mCAAmC,aAAE,OAAO;AAAA;AAAA,EAEvD,YAAY,aAAE,OAAO;AAAA;AAAA,EAErB,KAAK,aAAE,OAAO;AAAA;AAAA,EAEd,aAAa,aAAE,OAAO;AAAA;AAAA,EAEtB,QAAQ,aAAE,OAAO,KAAK;AAAA;AAAA;AAAA;AAAA;AAAA,EAKtB,WAAW,aAAE,MAAM,uBAAuB;AAC5C,CAAC;;;AC9qBD,IAAM,eAAe,KAAK,KAAK;AAS/B,IAAM,qBAAqB,IAAI,KAAK;AAUpC,IAAM,aAAa,IAAI,KAAK,KAAK,KAAK;AAUtC,IAAM,WAAW,IAAI,KAAK,KAAK,KAAK;AASpC,IAAM,SAAS,KAAK,KAAK,KAAK,KAAK;AASnC,IAAM,SAAS,KAAK,MAAM,KAAK,KAAK,KAAK;AAElC,IAAM,SAAS;AAAA,EACpB;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AACF;AAEO,IAAM,oCAAoC,OAAO;;;AC5CxD,IAAM,mBAAmB;AAAA,EACvB,QAAQ;AAAA,EACR,QAAQ;AAAA,EACR,QAAQ;AAAA,EACR,MAAM;AAAA,EACN,KAAK;AAAA,EACL,OAAO;AACT;AAKA,SAAS,YACPA,OACA,SACA,OACA,MACiB;AACjB,SAAO;AAAA,IACL,MAAAA;AAAA,IACA;AAAA,IACA,SAAS;AAAA,IACT;AAAA,IACA;AAAA,EACF;AACF;AA4BO,IAAM,oBAAN,MAAwB;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAa7B,YAAY,QAAiC;AAC3C,SAAK,QAAQ,OAAO;AACpB,SAAK,UAAU,OAAO;AACtB,SAAK,SAAS,OAAO;AACrB,SAAK,YAAY,OAAO;AACxB,SAAK,UAAU,OAAO,SAAS,WAAW,MAAM,KAAK,UAAU;AAC/D,SAAK,iBAAiB,OAAO;AAAA,EAC/B;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAOO,cAAc,SAA+B;AAClD,SAAK,UAAU;AAAA,EACjB;AAAA;AAAA;AAAA;AAAA,EAKA,IAAY,OAAe;AACzB,WAAO,KAAK,MAAM,CAAC;AAAA,EACrB;AAAA;AAAA;AAAA;AAAA,EAKA,MAAc,gBACZ,MACA,QACA,MACwB;AACxB,UAAM,UAAU,KAAK,OAAO,KAAK,SAAS,cAAc,MAAM,MAAM;AAEpE,WAAO,KAAK,QAAQ,GAAG,KAAK,IAAI,WAAW;AAAA,MACzC,QAAQ;AAAA,MACR;AAAA,MACA;AAAA,IACF,CAAC;AAAA,EACH;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAsBA,MAAM,OAAO,QAA6D;AAExE,QAAI,CAAC,OAAO,aAAa;AACvB,aAAO;AAAA,QACL,IAAI;AAAA,QACJ,OAAO;AAAA,UACL,qBAAqB;AAAA,UACrB;AAAA,QACF;AAAA,MACF;AAAA,IACF;AAEA,QAAI,CAAC,OAAO,MAAM;AAChB,aAAO;AAAA,QACL,IAAI;AAAA,QACJ,OAAO;AAAA,UACL,qBAAqB;AAAA,UACrB;AAAA,QACF;AAAA,MACF;AAAA,IACF;AAEA,QAAI,CAAC,OAAO,WAAW,OAAO,QAAQ,WAAW,GAAG;AAClD,aAAO;AAAA,QACL,IAAI;AAAA,QACJ,OAAO;AAAA,UACL,qBAAqB;AAAA,UACrB;AAAA,QACF;AAAA,MACF;AAAA,IACF;AAEA,QAAI;AACF,YAAM,OAAO,KAAK,UAAU;AAAA,QAC1B,aAAa,OAAO;AAAA,QACpB,MAAM,OAAO;AAAA,QACb,SAAS,OAAO;AAAA,QAChB,QAAQ,OAAO,QAAQ,YAAY;AAAA,QACnC,sBAAsB,OAAO,wBAAwB;AAAA,QACrD,WAAW,OAAO;AAAA,MACpB,CAAC;AAED,YAAM,WAAW,MAAM,KAAK;AAAA,QAC1B,OAAO;AAAA,QACP,iBAAiB;AAAA,QACjB;AAAA,MACF;AAEA,UAAI,CAAC,SAAS,IAAI;AAChB,cAAM,YAAY,MAAM,SAAS,KAAK;AACtC,eAAO;AAAA,UACL,IAAI;AAAA,UACJ,OAAO;AAAA,YACL,qBAAqB;AAAA,YACrB,gCAAgC,SAAS,MAAM,MAAM,SAAS;AAAA,YAC9D;AAAA,YACA,EAAE,QAAQ,SAAS,QAAQ,MAAM,OAAO,KAAK;AAAA,UAC/C;AAAA,QACF;AAAA,MACF;AAEA,YAAM,cAAe,MAAM,SAAS,KAAK;AAEzC,YAAM,aAAyB;AAAA,QAC7B,KAAK,YAAY,OAAO;AAAA,QACxB,aAAa,OAAO;AAAA,QACpB,SAAS,KAAK,QAAQ;AAAA,QACtB,MAAM,OAAO;AAAA,QACb,SAAS,OAAO;AAAA,QAChB,QAAQ,OAAO,UAAU,IAAI,KAAK,KAAK,IAAI,IAAI,OAAO,QAAQ;AAAA,QAC9D,WAAW;AAAA,QACX,oBAAoB,EAAE,OAAO,wBAAwB;AAAA,QACrD,WAAW,oBAAI,KAAK;AAAA,MACtB;AAEA,aAAO,EAAE,IAAI,MAAM,MAAM,WAAW;AAAA,IACtC,SAAS,OAAO;AACd,UAAI,iBAAiB,SAAS,MAAM,SAAS,cAAc;AACzD,eAAO;AAAA,UACL,IAAI;AAAA,UACJ,OAAO;AAAA,YACL,qBAAqB;AAAA,YACrB;AAAA,YACA;AAAA,UACF;AAAA,QACF;AAAA,MACF;AACA,aAAO;AAAA,QACL,IAAI;AAAA,QACJ,OAAO;AAAA,UACL,qBAAqB;AAAA,UACrB,6CAA6C,OAAO,KAAK,CAAC;AAAA,UAC1D,iBAAiB,QAAQ,QAAQ;AAAA,QACnC;AAAA,MACF;AAAA,IACF;AAAA,EACF;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAmBA,MAAM,OAAOC,MAA2D;AACtE,QAAI,CAACA,MAAK;AACR,aAAO;AAAA,QACL,IAAI;AAAA,QACJ,OAAO;AAAA,UACL,qBAAqB;AAAA,UACrB;AAAA,QACF;AAAA,MACF;AAAA,IACF;AAEA,QAAI;AACF,UAAI,CAAC,KAAK,WAAW;AACnB,eAAO;AAAA,UACL,IAAI;AAAA,UACJ,OAAO;AAAA,YACL,qBAAqB;AAAA,YACrB;AAAA,UACF;AAAA,QACF;AAAA,MACF;AAEA,YAAM,UAAU,KAAK;AAAA,QACnB,KAAK;AAAA,QACL,CAAC;AAAA,UACC,UAAU,WAAWA,IAAG;AAAA,UACxB,SAAS;AAAA,UACT,MAAM;AAAA,UACN,QAAQ,iBAAiB;AAAA,QAC3B,CAAC;AAAA,MACH;AACA,YAAM,WAAW,MAAM,KAAK,QAAQ,GAAG,KAAK,IAAI,WAAW;AAAA,QACzD,QAAQ;AAAA,QACR;AAAA,MACF,CAAC;AAED,UAAI,CAAC,SAAS,IAAI;AAChB,cAAM,YAAY,MAAM,SAAS,KAAK;AAEtC,YAAI,SAAS,WAAW,KAAK;AAC3B,iBAAO;AAAA,YACL,IAAI;AAAA,YACJ,OAAO;AAAA,cACL,qBAAqB;AAAA,cACrB,yBAAyBA,IAAG;AAAA,YAC9B;AAAA,UACF;AAAA,QACF;AAEA,eAAO;AAAA,UACL,IAAI;AAAA,UACJ,OAAO;AAAA,YACL,qBAAqB;AAAA,YACrB,gCAAgC,SAAS,MAAM,MAAM,SAAS;AAAA,YAC9D;AAAA,YACA,EAAE,QAAQ,SAAS,QAAQ,KAAAA,KAAI;AAAA,UACjC;AAAA,QACF;AAAA,MACF;AAEA,YAAM,SAAS,kCAAkC,UAAU,MAAM,SAAS,KAAK,CAAC;AAChF,UAAI,CAAC,OAAO,WAAW,OAAO,KAAK,QAAQA,MAAK;AAC9C,eAAO;AAAA,UACL,IAAI;AAAA,UACJ,OAAO;AAAA,YACL,qBAAqB;AAAA,YACrB;AAAA,YACA;AAAA,YACA,EAAE,KAAAA,KAAI;AAAA,UACR;AAAA,QACF;AAAA,MACF;AACA,aAAO,EAAE,IAAI,MAAM,MAAM,OAAO,KAAK;AAAA,IACvC,SAAS,OAAO;AACd,UAAI,iBAAiB,SAAS,MAAM,SAAS,cAAc;AACzD,eAAO;AAAA,UACL,IAAI;AAAA,UACJ,OAAO;AAAA,YACL,qBAAqB;AAAA,YACrB;AAAA,YACA;AAAA,UACF;AAAA,QACF;AAAA,MACF;AACA,aAAO;AAAA,QACL,IAAI;AAAA,QACJ,OAAO;AAAA,UACL,qBAAqB;AAAA,UACrB,+CAA+C,OAAO,KAAK,CAAC;AAAA,UAC5D,iBAAiB,QAAQ,QAAQ;AAAA,QACnC;AAAA,MACF;AAAA,IACF;AAAA,EACF;AAAA;AAAA;AAAA;AAAA;AAAA,EAMA,MAAM,OAAOA,MAAgD;AAC3D,QAAI,CAACA,MAAK;AACR,aAAO;AAAA,QACL,IAAI;AAAA,QACJ,OAAO,YAAY,qBAAqB,eAAe,iBAAiB;AAAA,MAC1E;AAAA,IACF;AACA,QAAI,CAAC,KAAK,WAAW;AACnB,aAAO;AAAA,QACL,IAAI;AAAA,QACJ,OAAO;AAAA,UACL,qBAAqB;AAAA,UACrB;AAAA,QACF;AAAA,MACF;AAAA,IACF;AAEA,QAAI;AACF,YAAM,UAAU,KAAK,UAAU,KAAK,SAAS,CAAC;AAAA,QAC5C,UAAU,WAAWA,IAAG;AAAA,QACxB,SAAS;AAAA,QACT,MAAM;AAAA,QACN,QAAQ,iBAAiB;AAAA,MAC3B,CAAC,CAAC;AACF,YAAM,WAAW,MAAM,KAAK,QAAQ,GAAG,KAAK,IAAI,sBAAsB;AAAA,QACpE,QAAQ;AAAA,QACR,SAAS,EAAE,GAAG,SAAS,gBAAgB,mBAAmB;AAAA,QAC1D,MAAM,KAAK,UAAU,EAAE,KAAAA,KAAI,CAAC;AAAA,MAC9B,CAAC;AACD,UAAI,CAAC,SAAS,MAAM,SAAS,WAAW,KAAK;AAC3C,cAAM,YAAY,MAAM,SAAS,KAAK;AACtC,eAAO;AAAA,UACL,IAAI;AAAA,UACJ,OAAO;AAAA,YACL,qBAAqB;AAAA,YACrB,oCAAoC,SAAS,MAAM,MAAM,SAAS;AAAA,YAClE;AAAA,YACA,EAAE,QAAQ,SAAS,QAAQ,KAAAA,KAAI;AAAA,UACjC;AAAA,QACF;AAAA,MACF;AACA,YAAM,SAAS,uBAAuB,UAAU,MAAM,SAAS,KAAK,CAAC;AACrE,YAAM,wBAAwB,OAAO,YACnC,SAAS,WAAW,MAChB,OAAO,KAAK,WAAW,eAAe,CAAC,OAAO,KAAK,SACnD,OAAO,KAAK,WAAW;AAE7B,UAAI,CAAC,OAAO,WAAW,OAAO,KAAK,QAAQA,QAAO,CAAC,uBAAuB;AACxE,eAAO;AAAA,UACL,IAAI;AAAA,UACJ,OAAO;AAAA,YACL,qBAAqB;AAAA,YACrB;AAAA,YACA;AAAA,YACA,EAAE,KAAAA,KAAI;AAAA,UACR;AAAA,QACF;AAAA,MACF;AACA,aAAO,EAAE,IAAI,MAAM,MAAM,OAAO,KAAK;AAAA,IACvC,SAAS,OAAO;AACd,UAAI,iBAAiB,SAAS,MAAM,SAAS,cAAc;AACzD,eAAO;AAAA,UACL,IAAI;AAAA,UACJ,OAAO,YAAY,qBAAqB,SAAS,mBAAmB,KAAK;AAAA,QAC3E;AAAA,MACF;AACA,aAAO;AAAA,QACL,IAAI;AAAA,QACJ,OAAO;AAAA,UACL,qBAAqB;AAAA,UACrB,2CAA2C,OAAO,KAAK,CAAC;AAAA,UACxD,iBAAiB,QAAQ,QAAQ;AAAA,QACnC;AAAA,MACF;AAAA,IACF;AAAA,EACF;AAAA;AAAA,EAGA,MAAM,MACJ,UAAyC,CAAC,GACF;AACxC,UAAM,YAAY,oCAAoC,UAAU,OAAO;AACvE,QAAI,CAAC,UAAU,SAAS;AACtB,aAAO;AAAA,QACL,IAAI;AAAA,QACJ,OAAO;AAAA,UACL,qBAAqB;AAAA,UACrB;AAAA,UACA;AAAA,UACA,EAAE,QAAQ,UAAU,MAAM,OAAO;AAAA,QACnC;AAAA,MACF;AAAA,IACF;AACA,QAAI,CAAC,KAAK,WAAW;AACnB,aAAO;AAAA,QACL,IAAI;AAAA,QACJ,OAAO;AAAA,UACL,qBAAqB;AAAA,UACrB;AAAA,QACF;AAAA,MACF;AAAA,IACF;AACA,QAAI,CAAC,KAAK,gBAAgB;AACxB,aAAO;AAAA,QACL,IAAI;AAAA,QACJ,OAAO;AAAA,UACL,qBAAqB;AAAA,UACrB;AAAA,QACF;AAAA,MACF;AAAA,IACF;AACA,QAAI;AACF,YAAM,oBAAoB,KAAK,UAAU,KAAK,SAAS,CAAC;AAAA,QACtD,SAAS,KAAK;AAAA,QACd,SAAS;AAAA,QACT,MAAM;AAAA,QACN,QAAQ,iBAAiB;AAAA,MAC3B,CAAC,CAAC;AACF,YAAM,UAAU,OAAO,YAAY,IAAI,QAAQ,iBAAiB,EAAE,QAAQ,CAAC;AAC3E,cAAQ,cAAc,IAAI;AAC1B,YAAM,WAAW,MAAM,KAAK,QAAQ,GAAG,KAAK,IAAI,qBAAqB;AAAA,QACnE,QAAQ;AAAA,QACR;AAAA,QACA,MAAM,KAAK,UAAU,UAAU,IAAI;AAAA,MACrC,CAAC;AACD,UAAI,CAAC,SAAS,IAAI;AAChB,cAAM,YAAY,MAAM,SAAS,KAAK;AACtC,eAAO;AAAA,UACL,IAAI;AAAA,UACJ,OAAO;AAAA,YACL,qBAAqB;AAAA,YACrB,gCAAgC,SAAS,MAAM,MAAM,SAAS;AAAA,YAC9D;AAAA,YACA,EAAE,QAAQ,SAAS,OAAO;AAAA,UAC5B;AAAA,QACF;AAAA,MACF;AACA,YAAM,SAAS,4BAA4B,UAAU,MAAM,SAAS,KAAK,CAAC;AAC1E,UAAI,CAAC,OAAO,SAAS;AACnB,eAAO;AAAA,UACL,IAAI;AAAA,UACJ,OAAO;AAAA,YACL,qBAAqB;AAAA,YACrB;AAAA,UACF;AAAA,QACF;AAAA,MACF;AACA,aAAO,EAAE,IAAI,MAAM,MAAM,OAAO,KAAK;AAAA,IACvC,SAAS,OAAO;AACd,aAAO;AAAA,QACL,IAAI;AAAA,QACJ,OAAO;AAAA,UACL,qBAAqB;AAAA,UACrB,0CAA0C,OAAO,KAAK,CAAC;AAAA,UACvD,iBAAiB,QAAQ,QAAQ;AAAA,QACnC;AAAA,MACF;AAAA,IACF;AAAA,EACF;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAoBA,MAAM,OAAsC;AAC1C,QAAI;AACF,YAAM,WAAW,MAAM,KAAK,gBAAgB,IAAI,iBAAiB,IAAI;AAErE,UAAI,CAAC,SAAS,IAAI;AAChB,cAAM,YAAY,MAAM,SAAS,KAAK;AACtC,eAAO;AAAA,UACL,IAAI;AAAA,UACJ,OAAO;AAAA,YACL,qBAAqB;AAAA,YACrB,+BAA+B,SAAS,MAAM,MAAM,SAAS;AAAA,YAC7D;AAAA,YACA,EAAE,QAAQ,SAAS,OAAO;AAAA,UAC5B;AAAA,QACF;AAAA,MACF;AAEA,YAAM,OAAQ,MAAM,SAAS,KAAK;AAclC,YAAM,cAA4B,KAAK,IAAI,CAAC,UAAU;AAAA,QACpD,KAAK,KAAK;AAAA,QACV,aAAa,KAAK;AAAA,QAClB,cAAc,KAAK;AAAA,QACnB,SAAS,KAAK;AAAA,QACd,MAAM,KAAK;AAAA,QACX,SAAS,KAAK;AAAA,QACd,QAAQ,IAAI,KAAK,KAAK,MAAM;AAAA,QAC5B,WAAW,KAAK;AAAA,QAChB,WAAW,KAAK,YAAY,IAAI,KAAK,KAAK,SAAS,IAAI;AAAA,QACvD,WAAW,KAAK;AAAA,QAChB,oBAAoB,KAAK;AAAA,MAC3B,EAAE;AAEF,aAAO,EAAE,IAAI,MAAM,MAAM,YAAY;AAAA,IACvC,SAAS,OAAO;AACd,UAAI,iBAAiB,SAAS,MAAM,SAAS,cAAc;AACzD,eAAO;AAAA,UACL,IAAI;AAAA,UACJ,OAAO;AAAA,YACL,qBAAqB;AAAA,YACrB;AAAA,YACA;AAAA,UACF;AAAA,QACF;AAAA,MACF;AACA,aAAO;AAAA,QACL,IAAI;AAAA,QACJ,OAAO;AAAA,UACL,qBAAqB;AAAA,UACrB,yCAAyC,OAAO,KAAK,CAAC;AAAA,UACtD,iBAAiB,QAAQ,QAAQ;AAAA,QACnC;AAAA,MACF;AAAA,IACF;AAAA,EACF;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAsBA,MAAM,SAASA,MAA+C;AAC5D,QAAI,CAACA,MAAK;AACR,aAAO;AAAA,QACL,IAAI;AAAA,QACJ,OAAO;AAAA,UACL,qBAAqB;AAAA,UACrB;AAAA,QACF;AAAA,MACF;AAAA,IACF;AAEA,QAAI;AACF,YAAM,OAAO,KAAK,UAAU,EAAE,KAAAA,MAAK,cAAc,KAAK,CAAC;AAEvD,YAAM,WAAW,MAAM,KAAK;AAAA,QAC1BA;AAAA,QACA,iBAAiB;AAAA,QACjB;AAAA,MACF;AAEA,UAAI,CAAC,SAAS,IAAI;AAChB,cAAM,YAAY,MAAM,SAAS,KAAK;AAEtC,YAAI,SAAS,WAAW,KAAK;AAC3B,iBAAO;AAAA,YACL,IAAI;AAAA,YACJ,OAAO;AAAA,cACL,qBAAqB;AAAA,cACrB,yBAAyBA,IAAG;AAAA,YAC9B;AAAA,UACF;AAAA,QACF;AAEA,eAAO;AAAA,UACL,IAAI;AAAA,UACJ,OAAO;AAAA,YACL,qBAAqB;AAAA,YACrB,mCAAmC,SAAS,MAAM,MAAM,SAAS;AAAA,YACjE;AAAA,YACA,EAAE,QAAQ,SAAS,QAAQ,KAAAA,KAAI;AAAA,UACjC;AAAA,QACF;AAAA,MACF;AAEA,YAAM,OAAQ,MAAM,SAAS,KAAK;AAgBlC,YAAM,QAAyB,KAAK,MAAM,IAAI,CAAC,UAAU;AAAA,QACvD,KAAK,KAAK;AAAA,QACV,aAAa,KAAK;AAAA,QAClB,cAAc,KAAK;AAAA,QACnB,SAAS,KAAK;AAAA,QACd,MAAM,KAAK;AAAA,QACX,SAAS,KAAK;AAAA,QACd,QAAQ,IAAI,KAAK,KAAK,MAAM;AAAA,QAC5B,WAAW,KAAK;AAAA,QAChB,WAAW,KAAK,YAAY,IAAI,KAAK,KAAK,SAAS,IAAI;AAAA,QACvD,WAAW,KAAK;AAAA,QAChB,oBAAoB,KAAK;AAAA,MAC3B,EAAE;AAEF,aAAO,EAAE,IAAI,MAAM,MAAM,MAAM;AAAA,IACjC,SAAS,OAAO;AACd,UAAI,iBAAiB,SAAS,MAAM,SAAS,cAAc;AACzD,eAAO;AAAA,UACL,IAAI;AAAA,UACJ,OAAO;AAAA,YACL,qBAAqB;AAAA,YACrB;AAAA,YACA;AAAA,UACF;AAAA,QACF;AAAA,MACF;AACA,aAAO;AAAA,QACL,IAAI;AAAA,QACJ,OAAO;AAAA,UACL,qBAAqB;AAAA,UACrB,yCAAyC,OAAO,KAAK,CAAC;AAAA,UACtD,iBAAiB,QAAQ,QAAQ;AAAA,QACnC;AAAA,MACF;AAAA,IACF;AAAA,EACF;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAsBA,MAAM,gBAAgB,MAAc,QAA0C;AAC5E,QAAI,CAAC,MAAM;AACT,aAAO;AAAA,QACL,IAAI;AAAA,QACJ,OAAO;AAAA,UACL,qBAAqB;AAAA,UACrB;AAAA,QACF;AAAA,MACF;AAAA,IACF;AAEA,QAAI,CAAC,QAAQ;AACX,aAAO;AAAA,QACL,IAAI;AAAA,QACJ,OAAO;AAAA,UACL,qBAAqB;AAAA,UACrB;AAAA,QACF;AAAA,MACF;AAAA,IACF;AAEA,QAAI;AACF,YAAM,OAAO,KAAK,UAAU,EAAE,MAAM,OAAO,CAAC;AAE5C,YAAM,WAAW,MAAM,KAAK;AAAA,QAC1B;AAAA,QACA,iBAAiB;AAAA,QACjB;AAAA,MACF;AAEA,UAAI,CAAC,SAAS,IAAI;AAEhB,YAAI,SAAS,WAAW,KAAK;AAC3B,iBAAO,EAAE,IAAI,MAAM,MAAM,MAAM;AAAA,QACjC;AAEA,cAAM,YAAY,MAAM,SAAS,KAAK;AACtC,eAAO;AAAA,UACL,IAAI;AAAA,UACJ,OAAO;AAAA,YACL,qBAAqB;AAAA,YACrB,+BAA+B,SAAS,MAAM,MAAM,SAAS;AAAA,YAC7D;AAAA,YACA,EAAE,QAAQ,SAAS,QAAQ,MAAM,OAAO;AAAA,UAC1C;AAAA,QACF;AAAA,MACF;AAEA,YAAM,OAAQ,MAAM,SAAS,KAAK;AAClC,aAAO,EAAE,IAAI,MAAM,MAAM,KAAK,QAAQ;AAAA,IACxC,SAAS,OAAO;AACd,UAAI,iBAAiB,SAAS,MAAM,SAAS,cAAc;AACzD,eAAO;AAAA,UACL,IAAI;AAAA,UACJ,OAAO;AAAA,YACL,qBAAqB;AAAA,YACrB;AAAA,YACA;AAAA,UACF;AAAA,QACF;AAAA,MACF;AACA,aAAO;AAAA,QACL,IAAI;AAAA,QACJ,OAAO;AAAA,UACL,qBAAqB;AAAA,UACrB,0CAA0C,OAAO,KAAK,CAAC;AAAA,UACvD,iBAAiB,QAAQ,QAAQ;AAAA,QACnC;AAAA,MACF;AAAA,IACF;AAAA,EACF;AACF;;;AC3zBA,IAAAC,cAAkB;AA6BX,IAAM,yBAAyB,cAAE,OAAO;AAAA;AAAA,EAE7C,KAAK,UAAU;AAAA,IACb,CAAC,QAAQ,OAAO,IAAI,MAAM,YAAY,IAAI,EAAE,SAAS;AAAA,IACrD,EAAE,SAAS,6CAA6C;AAAA,EAC1D;AAAA;AAAA,EAEA,QAAQ,cAAE,OAAO,EAAE,IAAI,GAAG,oBAAoB;AAAA;AAAA,EAE9C,YAAY;AAAA;AAAA,EAEZ,MAAM,cAAE,OAAO,EAAE,IAAI,GAAG,kBAAkB;AAAA;AAAA,EAE1C,MAAM,cAAE,OAAO,EAAE,IAAI,0BAA0B;AAAA;AAAA,EAE/C,SAAS,cAAE,OAAO,EAAE,IAAI,GAAG,qBAAqB;AAAA;AAAA,EAEhD,SAAS,cAAE,QAAQ,CAAC;AACtB,CAAC;AAWM,IAAM,uBAAuB,cAAE,OAAO;AAAA;AAAA;AAAA;AAAA;AAAA,EAK3C,iBAAiB,cAAE,QAAQ,EAAE,SAAS;AAAA;AAAA;AAAA;AAAA;AAAA,EAKtC,eAAe,cAAE,QAAQ,EAAE,SAAS;AAAA;AAAA;AAAA;AAAA,EAIpC,eAAe,oBAAoB,SAAS;AAC9C,CAAC;AAeM,IAAM,6BAA6B,cAAE,OAAO;AAAA;AAAA,EAEjD,OAAO,cAAE,MAAM,cAAE,OAAO,EAAE,IAAI,CAAC,EAAE,IAAI,GAAG,mCAAmC;AAAA;AAAA;AAAA;AAAA;AAAA,EAK3E,SAAS,cACN,QAAQ,EACR;AAAA,IACC,CAAC,QACC,QAAQ,UAAc,QAAQ,QAAQ,OAAO,QAAQ;AAAA,IACvD,EAAE,SAAS,gDAAgD;AAAA,EAC7D,EACC,SAAS;AAAA;AAAA,EAEZ,QAAQ,cACL,QAAQ,EACR,OAAO,CAAC,QAA+B,OAAO,QAAQ,YAAY;AAAA,IACjE,SAAS;AAAA,EACX,CAAC;AAAA;AAAA,EAEH,OAAO,cACJ,QAAQ,EACR;AAAA,IACC,CAAC,QACC,QAAQ,UAAa,OAAO,QAAQ;AAAA,IACtC,EAAE,SAAS,yCAAyC;AAAA,EACtD,EACC,SAAS;AAAA;AAAA,EAEZ,aAAa;AAAA;AAAA,EAEb,UAAU,cACP,QAAQ,EACR;AAAA,IACC,CAAC,QACC,QAAQ,QAAQ,OAAO,QAAQ;AAAA,IACjC,EAAE,SAAS,4CAA4C;AAAA,EACzD;AAAA;AAAA;AAAA;AAAA;AAAA,EAKF,mBAAmB,cAChB,QAAQ,EACR;AAAA,IACC,CAAC,QACC,QAAQ,UAAc,QAAQ,QAAQ,OAAO,QAAQ;AAAA,IACvD,EAAE,SAAS,mDAAmD;AAAA,EAChE,EACC,SAAS;AAAA;AAAA,EAEZ,iBAAiB,cAAE,QAAQ,EAAE;AAAA,IAC3B,CAAC,QAMmB,OAAO,QAAQ;AAAA,IACnC,EAAE,SAAS,8CAA8C;AAAA,EAC3D;AAAA;AAAA,EAEA,SAAS,cAAE,OAAO,EAAE,SAAS;AAAA;AAAA;AAAA;AAAA,EAI7B,kBAAkB,cACf,QAAQ,EACR,OAAO,CAAC,QAAQ,QAAQ,UAAa,OAAO,QAAQ,YAAY;AAAA,IAC/D,SAAS;AAAA,EACX,CAAC,EACA,SAAS;AAAA;AAAA;AAAA;AAAA,EAIZ,sBAAsB,cACnB,QAAQ,EACR,OAAO,CAAC,QAAQ,QAAQ,UAAa,OAAO,QAAQ,YAAY;AAAA,IAC/D,SAAS;AAAA,EACX,CAAC,EACA,SAAS;AAAA;AAAA,EAEZ,YAAY,cACT,QAAQ,EACR,OAAO,CAAC,QAA4D,QAAQ,UAAa,OAAO,QAAQ,YAAY;AAAA,IACnH,SAAS;AAAA,EACX,CAAC,EACA,SAAS;AAAA;AAAA;AAAA;AAAA,EAIZ,YAAY,cAAE,OAAO,EAAE,SAAS;AAAA;AAAA;AAAA;AAAA,EAIhC,eAAe,cAAE,KAAK,EAAE,SAAS;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAMjC,wBAAwB,cACrB,QAAQ,EACR,OAAO,CAAC,QAAQ,QAAQ,UAAa,OAAO,QAAQ,YAAY;AAAA,IAC/D,SAAS;AAAA,EACX,CAAC,EACA,SAAS;AACd,CAAC;AAwBM,SAAS,yBACd,MAC2C;AAC3C,QAAM,SAAS,uBAAuB,UAAU,IAAI;AACpD,MAAI,CAAC,OAAO,SAAS;AACnB,WAAO;AAAA,MACL,IAAI;AAAA,MACJ,OAAO;AAAA,QACL,MAAM,qBAAqB;AAAA,QAC3B,SAAS,uBAAuB,OAAO,MAAM,OAAO;AAAA,QACpD,SAAS;AAAA,QACT,MAAM,EAAE,QAAQ,OAAO,MAAM,OAAO;AAAA,MACtC;AAAA,IACF;AAAA,EACF;AACA,SAAO,EAAE,IAAI,MAAM,MAAM,OAAO,KAAK;AACvC;AAQO,SAAS,uBACd,MACyC;AACzC,QAAM,SAAS,qBAAqB,UAAU,IAAI;AAClD,MAAI,CAAC,OAAO,SAAS;AACnB,WAAO;AAAA,MACL,IAAI;AAAA,MACJ,OAAO;AAAA,QACL,MAAM,qBAAqB;AAAA,QAC3B,SAAS,4BAA4B,OAAO,MAAM,OAAO;AAAA,QACzD,SAAS;AAAA,QACT,MAAM,EAAE,QAAQ,OAAO,MAAM,OAAO;AAAA,MACtC;AAAA,IACF;AAAA,EACF;AACA,SAAO,EAAE,IAAI,MAAM,MAAM,OAAO,KAAK;AACvC;AAQO,SAAS,6BACd,MAC+C;AAC/C,QAAM,SAAS,2BAA2B,UAAU,IAAI;AACxD,MAAI,CAAC,OAAO,SAAS;AACnB,WAAO;AAAA,MACL,IAAI;AAAA,MACJ,OAAO;AAAA,QACL,MAAM,qBAAqB;AAAA,QAC3B,SAAS,kCAAkC,OAAO,MAAM,OAAO;AAAA,QAC/D,SAAS;AAAA,QACT,MAAM,EAAE,QAAQ,OAAO,MAAM,OAAO;AAAA,MACtC;AAAA,IACF;AAAA,EACF;AACA,SAAO,EAAE,IAAI,MAAM,MAAM,OAAO,KAAK;AACvC;;;ACrRA,gBAAe;AACf,0BAAkD;AAoR3C,IAAM,wBACX,OAAO,OAAO;AAAA,EACZ,IAAI;AAAA,EACJ,KAAK;AAAA,EACL,QAAQ;AAAA,EACR,cAAc;AAAA,EACd,OAAO;AAAA,EACP,YAAY;AAAA,EACZ,YAAY;AACd,CAAC;AAuBI,IAAM,wBACX,OAAO;AAAA,EACL,OAAO;AAAA,IACL,OAAO,QAAQ,qBAAqB,EAAE,IAAI,CAAC,CAAC,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC;AAAA,EAC9D;AACF;;;AC3UF,kBAAsC;AAmB/B,IAAM,qBAAN,cAAiC,MAAM;AAAA,EAC5C,YAAY,SAAiB;AAC3B,UAAM,OAAO;AACb,SAAK,OAAO;AAAA,EACd;AACF;AAEA,IAAM,aAAa;AACnB,IAAM,SAAS;AAEf,SAAS,YAAY,OAAkD;AACrE,QAAM,gBAAgB,MAAM,QAAQ,GAAG;AACvC,MAAI,gBAAgB,GAAG;AACrB,WAAO,EAAE,KAAK,OAAO,UAAU,GAAG;AAAA,EACpC;AACA,SAAO;AAAA,IACL,KAAK,MAAM,MAAM,GAAG,aAAa;AAAA,IACjC,UAAU,MAAM,MAAM,aAAa;AAAA,EACrC;AACF;AAEA,SAAS,mBAAmB,SAAuB;AACjD,MAAI,CAAC,OAAO,cAAc,OAAO,KAAK,WAAW,GAAG;AAClD,UAAM,IAAI,mBAAmB,6BAA6B,OAAO,EAAE;AAAA,EACrE;AACF;AAEO,SAAS,aAAa,OAAwB;AACnD,aAAO,uBAAU,OAAO,EAAE,QAAQ,MAAM,CAAC;AAC3C;AAEO,SAAS,oBAAoB,SAAmC;AACrE,MAAI,CAAC,aAAa,OAAO,GAAG;AAC1B,UAAM,IAAI,mBAAmB,wBAAwB,OAAO,EAAE;AAAA,EAChE;AACA,aAAO,wBAAW,OAAO;AAC3B;AAMO,SAAS,OAAO,SAAiB,UAAkB,GAAW;AACnE,qBAAmB,OAAO;AAC1B,SAAO,kBAAkB,OAAO,IAAI,oBAAoB,OAAO,CAAC;AAClE;AAEO,SAAS,YAAY,KAAiC;AAC3D,QAAM,QAAQ,IAAI,MAAM,UAAU;AAClC,MAAI,CAAC,MAAO,QAAO;AAEnB,QAAM,UAAU,OAAO,MAAM,CAAC,CAAC;AAC/B,qBAAmB,OAAO;AAE1B,SAAO;AAAA,IACL,QAAQ;AAAA,IACR,WAAW;AAAA,IACX;AAAA,IACA,SAAS,oBAAoB,MAAM,CAAC,CAAC;AAAA,EACvC;AACF;AAEO,SAAS,gBAAgB,KAAqB;AACnD,QAAM,MAAM,YAAY,GAAG;AAC3B,MAAI,KAAK;AACP,WAAO,OAAO,IAAI,SAAS,IAAI,OAAO;AAAA,EACxC;AACA,MAAI,OAAO,KAAK,GAAG,GAAG;AACpB,WAAO;AAAA,EACT;AACA,QAAM,IAAI,mBAAmB,gBAAgB,GAAG,EAAE;AACpD;AAOO,SAAS,aAAa,QAAwB;AACnD,SAAO,gBAAgB,YAAY,MAAM,EAAE,GAAG;AAChD;;;ACnCO,IAAM,qCAAN,cAAiD,MAAM;AAAA,EAM5D,YAAY,SAA4B;AACtC;AAAA,MACE;AAAA,IACF;AAPF;AAAA,gBAAO;AAQL,SAAK,OAAO;AACZ,SAAK,UAAU,QAAQ,IAAI,UAAU;AAAA,EACvC;AACF;AA6IO,SAAS,kBACd,MACA,OACS;AACT,SAAO,yBAAyB,IAAI,MAAM,yBAAyB,KAAK;AAC1E;AASO,SAAS,yBACd,SACQ;AACR,QAAM,eAAe,CAAC,UAA2B;AAC/C,QAAI,UAAU,QAAQ,OAAO,UAAU,aAAa,OAAO,UAAU,UAAU;AAC7E,aAAO,KAAK,UAAU,KAAK;AAAA,IAC7B;AACA,QAAI,OAAO,UAAU,UAAU;AAC7B,UAAI,OAAO,SAAS,KAAK,EAAG,QAAO,KAAK,UAAU,KAAK;AACvD,YAAM,IAAI,MAAM,8CAA8C;AAAA,IAChE;AACA,QAAI,MAAM,QAAQ,KAAK,EAAG,QAAO,IAAI,MAAM,IAAI,YAAY,EAAE,KAAK,GAAG,CAAC;AACtE,QAAI,OAAO,UAAU,UAAU;AAC7B,YAAM,SAAS;AACf,YAAM,YAAY,OAAO,eAAe,MAAM;AAC9C,UAAI,cAAc,OAAO,aAAa,cAAc,MAAM;AACxD,cAAM,IAAI,MAAM,8CAA8C;AAAA,MAChE;AACA,aAAO,IAAI,OAAO,KAAK,MAAM,EAAE,KAAK,EAAE;AAAA,QAAI,CAAC,QACzC,GAAG,KAAK,UAAU,GAAG,CAAC,IAAI,aAAa,OAAO,GAAG,CAAC,CAAC;AAAA,MACrD,EAAE,KAAK,GAAG,CAAC;AAAA,IACb;AACA,UAAM,IAAI,MAAM,8CAA8C;AAAA,EAChE;AACA,QAAM,YAAY,WAAW,CAAC,GAAG,IAAI,YAAY,EAAE,KAAK;AACxD,MAAI,SAAS,WAAW,KAAM,SAAS,WAAW,KAAK,SAAS,CAAC,MAAM,MAAO;AAC5E,WAAO;AAAA,EACT;AACA,SAAO,IAAI,SAAS,KAAK,GAAG,CAAC;AAC/B;AAGO,SAAS,eAAe,eAAuB,iBAAkC;AACtF,MAAI,kBAAkB,OAAO,kBAAkB,gBAAiB,QAAO;AACvE,MAAI,CAAC,cAAc,SAAS,IAAI,EAAG,QAAO;AAC1C,QAAM,UAAU,cAAc,MAAM,GAAG,EAAE;AACzC,SAAO,oBAAoB,WAAW,gBAAgB,WAAW,GAAG,OAAO,GAAG;AAChF;AAqBA,SAAS,WAAW,OAAyC;AAC3D,SAAO;AAAA,IACL,SAAS,MAAM;AAAA,IACf,GAAI,MAAM,UAAU,SAAY,EAAE,OAAO,MAAM,MAAM,IAAI,CAAC;AAAA,IAC1D,MAAM,MAAM;AAAA,IACZ,SAAS,CAAC,GAAG,MAAM,OAAO;AAAA,IAC1B,GAAI,MAAM,YAAY,SAClB,EAAE,SAAS,KAAK,MAAM,KAAK,UAAU,MAAM,OAAO,CAAC,EAA+B,IAClF,CAAC;AAAA,IACL,GAAI,MAAM,eAAe,SAAY,EAAE,YAAY,MAAM,WAAW,IAAI,CAAC;AAAA,IACzE,GAAI,MAAM,WAAW,SAAY,EAAE,QAAQ,MAAM,OAAO,IAAI,CAAC;AAAA,EAC/D;AACF;;;AC9SA;;;;;;ACAO,IAAM,QAAQ,IAAI,WAAW,CAAC;AAW/B,SAAU,OAAQ,IAAgB,IAAc;AACpD,MAAI,OAAO,IAAI;AAAE,WAAO;EAAK;AAC7B,MAAI,GAAG,eAAe,GAAG,YAAY;AACnC,WAAO;EACT;AAEA,WAAS,KAAK,GAAG,KAAK,GAAG,YAAY,MAAM;AACzC,QAAI,GAAG,EAAE,MAAM,GAAG,EAAE,GAAG;AACrB,aAAO;IACT;EACF;AAEA,SAAO;AACT;AAEM,SAAU,OAAQ,GAA6C;AACnE,MAAI,aAAa,cAAc,EAAE,YAAY,SAAS,cAAc;AAAE,WAAO;EAAE;AAC/E,MAAI,aAAa,aAAa;AAAE,WAAO,IAAI,WAAW,CAAC;EAAE;AACzD,MAAI,YAAY,OAAO,CAAC,GAAG;AACzB,WAAO,IAAI,WAAW,EAAE,QAAQ,EAAE,YAAY,EAAE,UAAU;EAC5D;AACA,QAAM,IAAI,MAAM,mCAAmC;AACrD;AAMM,SAAU,WAAY,KAAW;AACrC,SAAO,IAAI,YAAW,EAAG,OAAO,GAAG;AACrC;AAEM,SAAU,SAAU,GAAa;AACrC,SAAO,IAAI,YAAW,EAAG,OAAO,CAAC;AACnC;;;ACnCA,SAAS,KAAM,UAAUC,OAAI;AAC3B,MAAI,SAAS,UAAU,KAAK;AAAE,UAAM,IAAI,UAAU,mBAAmB;EAAE;AACvE,MAAI,WAAW,IAAI,WAAW,GAAG;AACjC,WAAS,IAAI,GAAG,IAAI,SAAS,QAAQ,KAAK;AACxC,aAAS,CAAC,IAAI;EAChB;AACA,WAAS,IAAI,GAAG,IAAI,SAAS,QAAQ,KAAK;AACxC,QAAI,IAAI,SAAS,OAAO,CAAC;AACzB,QAAI,KAAK,EAAE,WAAW,CAAC;AACvB,QAAI,SAAS,EAAE,MAAM,KAAK;AAAE,YAAM,IAAI,UAAU,IAAI,eAAe;IAAE;AACrE,aAAS,EAAE,IAAI;EACjB;AACA,MAAI,OAAO,SAAS;AACpB,MAAI,SAAS,SAAS,OAAO,CAAC;AAC9B,MAAI,SAAS,KAAK,IAAI,IAAI,IAAI,KAAK,IAAI,GAAG;AAC1C,MAAI,UAAU,KAAK,IAAI,GAAG,IAAI,KAAK,IAAI,IAAI;AAI3C,WAASC,QAAQ,QAAM;AAErB,QAAI,kBAAkB;AAAY;aAAW,YAAY,OAAO,MAAM,GAAG;AACvE,eAAS,IAAI,WAAW,OAAO,QAAQ,OAAO,YAAY,OAAO,UAAU;IAC7E,WAAW,MAAM,QAAQ,MAAM,GAAG;AAChC,eAAS,WAAW,KAAK,MAAM;IACjC;AACA,QAAI,EAAE,kBAAkB,aAAa;AAAE,YAAM,IAAI,UAAU,qBAAqB;IAAE;AAClF,QAAI,OAAO,WAAW,GAAG;AAAE,aAAO;IAAG;AAErC,QAAI,SAAS;AACb,QAAIC,UAAS;AACb,QAAI,SAAS;AACb,QAAI,OAAO,OAAO;AAClB,WAAO,WAAW,QAAQ,OAAO,MAAM,MAAM,GAAG;AAC9C;AACA;IACF;AAEA,QAAI,QAAS,OAAO,UAAU,UAAU,MAAO;AAC/C,QAAI,MAAM,IAAI,WAAW,IAAI;AAE7B,WAAO,WAAW,MAAM;AACtB,UAAI,QAAQ,OAAO,MAAM;AAEzB,UAAIC,KAAI;AACR,eAAS,MAAM,OAAO,IAAI,UAAU,KAAKA,KAAID,YAAY,QAAQ,IAAK,OAAOC,MAAK;AAChF,iBAAU,MAAM,IAAI,GAAG,MAAO;AAC9B,YAAI,GAAG,IAAK,QAAQ,SAAU;AAC9B,gBAAS,QAAQ,SAAU;MAC7B;AACA,UAAI,UAAU,GAAG;AAAE,cAAM,IAAI,MAAM,gBAAgB;MAAE;AACrD,MAAAD,UAASC;AACT;IACF;AAEA,QAAI,MAAM,OAAOD;AACjB,WAAO,QAAQ,QAAQ,IAAI,GAAG,MAAM,GAAG;AACrC;IACF;AAEA,QAAI,MAAM,OAAO,OAAO,MAAM;AAC9B,WAAO,MAAM,MAAM,EAAE,KAAK;AAAE,aAAO,SAAS,OAAO,IAAI,GAAG,CAAC;IAAG;AAC9D,WAAO;EACT;AAIA,WAAS,aAAc,QAAM;AAC3B,QAAI,OAAO,WAAW,UAAU;AAAE,YAAM,IAAI,UAAU,iBAAiB;IAAE;AACzE,QAAI,OAAO,WAAW,GAAG;AAAE,aAAO,IAAI,WAAU;IAAG;AACnD,QAAI,MAAM;AAEV,QAAI,OAAO,GAAG,MAAM,KAAK;AAAE;IAAO;AAElC,QAAI,SAAS;AACb,QAAIA,UAAS;AACb,WAAO,OAAO,GAAG,MAAM,QAAQ;AAC7B;AACA;IACF;AAEA,QAAI,QAAU,OAAO,SAAS,OAAO,SAAU,MAAO;AACtD,QAAI,OAAO,IAAI,WAAW,IAAI;AAE9B,WAAO,OAAO,GAAG,GAAG;AAElB,UAAI,QAAQ,SAAS,OAAO,WAAW,GAAG,CAAC;AAE3C,UAAI,UAAU,KAAK;AAAE;MAAO;AAC5B,UAAIC,KAAI;AACR,eAAS,MAAM,OAAO,IAAI,UAAU,KAAKA,KAAID,YAAY,QAAQ,IAAK,OAAOC,MAAK;AAChF,iBAAU,OAAO,KAAK,GAAG,MAAO;AAChC,aAAK,GAAG,IAAK,QAAQ,QAAS;AAC9B,gBAAS,QAAQ,QAAS;MAC5B;AACA,UAAI,UAAU,GAAG;AAAE,cAAM,IAAI,MAAM,gBAAgB;MAAE;AACrD,MAAAD,UAASC;AACT;IACF;AAEA,QAAI,OAAO,GAAG,MAAM,KAAK;AAAE;IAAO;AAElC,QAAI,MAAM,OAAOD;AACjB,WAAO,QAAQ,QAAQ,KAAK,GAAG,MAAM,GAAG;AACtC;IACF;AACA,QAAI,MAAM,IAAI,WAAW,UAAU,OAAO,IAAI;AAC9C,QAAIE,KAAI;AACR,WAAO,QAAQ,MAAM;AACnB,UAAIA,IAAG,IAAI,KAAK,KAAK;IACvB;AACA,WAAO;EACT;AAIA,WAASC,QAAQ,QAAM;AACrB,QAAI,SAAS,aAAa,MAAM;AAChC,QAAI,QAAQ;AAAE,aAAO;IAAO;AAC5B,UAAM,IAAI,MAAM,OAAOL,KAAI,YAAY;EACzC;AACA,SAAO;IACL,QAAQC;IACR;IACA,QAAQI;;AAEZ;AACA,IAAI,MAAM;AAEV,IAAI,kCAAkC;AAEtC,IAAA,iBAAe;;;ACjIf,IAAM,UAAN,MAAa;EAKX,YAAaC,OAAY,QAAgB,YAAoB;AAJpD;AACA;AACA;AAGP,SAAK,OAAOA;AACZ,SAAK,SAAS;AACd,SAAK,aAAa;EACpB;EAEA,OAAQC,QAAiB;AACvB,QAAIA,kBAAiB,YAAY;AAC/B,aAAO,GAAG,KAAK,MAAM,GAAG,KAAK,WAAWA,MAAK,CAAC;IAChD,OAAO;AACL,YAAM,MAAM,mCAAmC;IACjD;EACF;;AAQF,IAAM,UAAN,MAAa;EAMX,YAAaD,OAAY,QAAgB,YAAoB;AALpD;AACA;AACA;AACQ;AAGf,SAAK,OAAOA;AACZ,SAAK,SAAS;AACd,UAAM,kBAAkB,OAAO,YAAY,CAAC;AAE5C,QAAI,oBAAoB,QAAW;AACjC,YAAM,IAAI,MAAM,0BAA0B;IAC5C;AACA,SAAK,kBAAkB;AACvB,SAAK,aAAa;EACpB;EAEA,OAAQ,MAAY;AAClB,QAAI,OAAO,SAAS,UAAU;AAC5B,UAAI,KAAK,YAAY,CAAC,MAAM,KAAK,iBAAiB;AAChD,cAAM,MAAM,qCAAqC,KAAK,UAAU,IAAI,CAAC,KAAK,KAAK,IAAI,+CAA+C,KAAK,MAAM,EAAE;MACjJ;AACA,aAAO,KAAK,WAAW,KAAK,MAAM,KAAK,OAAO,MAAM,CAAC;IACvD,OAAO;AACL,YAAM,MAAM,mCAAmC;IACjD;EACF;EAEA,GAAgC,SAAmE;AACjG,WAAO,GAAG,MAAM,OAAO;EACzB;;AAKF,IAAM,kBAAN,MAAqB;EAGnB,YAAa,UAA0B;AAF9B;AAGP,SAAK,WAAW;EAClB;EAEA,GAAiC,SAAmE;AAClG,WAAO,GAAG,MAAM,OAAO;EACzB;EAEA,OAAQ,OAAa;AACnB,UAAM,SAAS,MAAM,CAAC;AACtB,UAAM,UAAU,KAAK,SAAS,MAAM;AACpC,QAAI,WAAW,MAAM;AACnB,aAAO,QAAQ,OAAO,KAAK;IAC7B,OAAO;AACL,YAAM,WAAW,qCAAqC,KAAK,UAAU,KAAK,CAAC,+BAA+B,OAAO,KAAK,KAAK,QAAQ,CAAC,gBAAgB;IACtJ;EACF;;AAGI,SAAU,GAAyC,MAA+C,OAA8C;AACpJ,SAAO,IAAI,gBAAgB;IACzB,GAAI,KAAK,YAAY,EAAE,CAAE,KAA2B,MAAM,GAAG,KAAI;IACjE,GAAI,MAAM,YAAY,EAAE,CAAE,MAA4B,MAAM,GAAG,MAAK;GAClD;AACtB;AAEM,IAAO,QAAP,MAAY;EAQhB,YAAaA,OAAY,QAAgB,YAAsB,YAAoB;AAP1E;AACA;AACA;AACA;AACA;AACA;AAGP,SAAK,OAAOA;AACZ,SAAK,SAAS;AACd,SAAK,aAAa;AAClB,SAAK,aAAa;AAClB,SAAK,UAAU,IAAI,QAAQA,OAAM,QAAQ,UAAU;AACnD,SAAK,UAAU,IAAI,QAAQA,OAAM,QAAQ,UAAU;EACrD;EAEA,OAAQ,OAAiB;AACvB,WAAO,KAAK,QAAQ,OAAO,KAAK;EAClC;EAEA,OAAQ,OAAa;AACnB,WAAO,KAAK,QAAQ,OAAO,KAAK;EAClC;;AAGI,SAAU,KAAmD,EAAE,MAAAA,OAAM,QAAQ,QAAAE,SAAQ,QAAAC,QAAM,GAAsE;AACrK,SAAO,IAAI,MAAMH,OAAM,QAAQE,SAAQC,OAAM;AAC/C;AAEM,SAAU,MAAoD,EAAE,MAAAH,OAAM,QAAQ,UAAAI,UAAQ,GAAoD;AAC9I,QAAM,EAAE,QAAAF,SAAQ,QAAAC,QAAM,IAAK,eAAMC,WAAUJ,KAAI;AAC/C,SAAO,KAAK;IACV;IACA,MAAAA;IACA,QAAAE;IACA,QAAQ,CAAC,SAA6B,OAAOC,QAAO,IAAI,CAAC;GAC1D;AACH;AAEA,SAAS,OAAQ,QAAgB,aAAqC,aAAqBH,OAAY;AAErG,MAAI,MAAM,OAAO;AACjB,SAAO,OAAO,MAAM,CAAC,MAAM,KAAK;AAC9B,MAAE;EACJ;AAGA,QAAM,MAAM,IAAI,WAAY,MAAM,cAAc,IAAK,CAAC;AAGtD,MAAI,OAAO;AACX,MAAI,SAAS;AACb,MAAI,UAAU;AACd,WAAS,IAAI,GAAG,IAAI,KAAK,EAAE,GAAG;AAE5B,UAAM,QAAQ,YAAY,OAAO,CAAC,CAAC;AACnC,QAAI,UAAU,QAAW;AACvB,YAAM,IAAI,YAAY,OAAOA,KAAI,YAAY;IAC/C;AAGA,aAAU,UAAU,cAAe;AACnC,YAAQ;AAGR,QAAI,QAAQ,GAAG;AACb,cAAQ;AACR,UAAI,SAAS,IAAI,MAAQ,UAAU;IACrC;EACF;AAGA,MAAI,QAAQ,gBAAgB,MAAQ,UAAW,IAAI,UAAY,GAAG;AAChE,UAAM,IAAI,YAAY,wBAAwB;EAChD;AAEA,SAAO;AACT;AAEA,SAAS,OAAQ,MAAkBI,WAAkB,aAAmB;AACtE,QAAM,MAAMA,UAASA,UAAS,SAAS,CAAC,MAAM;AAC9C,QAAM,QAAQ,KAAK,eAAe;AAClC,MAAI,MAAM;AAEV,MAAI,OAAO;AACX,MAAI,SAAS;AACb,WAAS,IAAI,GAAG,IAAI,KAAK,QAAQ,EAAE,GAAG;AAEpC,aAAU,UAAU,IAAK,KAAK,CAAC;AAC/B,YAAQ;AAGR,WAAO,OAAO,aAAa;AACzB,cAAQ;AACR,aAAOA,UAAS,OAAQ,UAAU,IAAK;IACzC;EACF;AAGA,MAAI,SAAS,GAAG;AACd,WAAOA,UAAS,OAAQ,UAAW,cAAc,IAAM;EACzD;AAGA,MAAI,KAAK;AACP,YAAS,IAAI,SAAS,cAAe,OAAO,GAAG;AAC7C,aAAO;IACT;EACF;AAEA,SAAO;AACT;AAEA,SAAS,kBAAmBA,WAAgB;AAE1C,QAAM,cAAsC,CAAA;AAC5C,WAAS,IAAI,GAAG,IAAIA,UAAS,QAAQ,EAAE,GAAG;AACxC,gBAAYA,UAAS,CAAC,CAAC,IAAI;EAC7B;AACA,SAAO;AACT;AAKM,SAAU,QAAsD,EAAE,MAAAJ,OAAM,QAAQ,aAAa,UAAAI,UAAQ,GAAyE;AAClL,QAAM,cAAc,kBAAkBA,SAAQ;AAC9C,SAAO,KAAK;IACV;IACA,MAAAJ;IACA,OAAQ,OAAiB;AACvB,aAAO,OAAO,OAAOI,WAAU,WAAW;IAC5C;IACA,OAAQ,OAAa;AACnB,aAAO,OAAO,OAAO,aAAa,aAAaJ,KAAI;IACrD;GACD;AACH;;;AH9OO,IAAM,SAAS,MAAM;EAC1B,QAAQ;EACR,MAAM;EACN,UAAU;CACX;;;AIND;;;;;AAEO,IAAM,SAAS,QAAQ;EAC5B,QAAQ;EACR,MAAM;EACN,UAAU;EACV,aAAa;CACd;AAEM,IAAM,cAAc,QAAQ;EACjC,QAAQ;EACR,MAAM;EACN,UAAU;EACV,aAAa;CACd;;;ACdD;;;;AAEO,IAAM,QAAQ,QAAQ;EAC3B,QAAQ;EACR,MAAM;EACN,UAAU;EACV,aAAa;CACd;;;ACPD;;;;AAEA,IAAM,WAAW,MAAM,KAAK,orEAAwe;AACpgB,IAAM,uBAAkC,SAAS,OAAiB,CAAC,GAAG,GAAG,MAAK;AAAG,IAAE,CAAC,IAAI;AAAG,SAAO;AAAE,GAAI,CAAA,CAAG;AAC3G,IAAM,uBAAkC,SAAS,OAAiB,CAAC,GAAG,GAAG,MAAK;AAC5E,QAAM,YAAY,EAAE,YAAY,CAAC;AACjC,MAAI,aAAa,MAAM;AACrB,UAAM,IAAI,MAAM,sBAAsB,CAAC,EAAE;EAC3C;AACA,IAAE,SAAS,IAAI;AACf,SAAO;AACT,GAAI,CAAA,CAAG;AAEP,SAASK,QAAQ,MAAgB;AAC/B,SAAO,KAAK,OAAO,CAAC,GAAG,MAAK;AAC1B,SAAK,qBAAqB,CAAC;AAC3B,WAAO;EACT,GAAG,EAAE;AACP;AAEA,SAASC,QAAQ,KAAW;AAC1B,QAAM,OAAO,CAAA;AACb,aAAW,QAAQ,KAAK;AACtB,UAAM,YAAY,KAAK,YAAY,CAAC;AACpC,QAAI,aAAa,MAAM;AACrB,YAAM,IAAI,MAAM,sBAAsB,IAAI,EAAE;IAC9C;AACA,UAAM,MAAM,qBAAqB,SAAS;AAC1C,QAAI,OAAO,MAAM;AACf,YAAM,IAAI,MAAM,+BAA+B,IAAI,EAAE;IACvD;AACA,SAAK,KAAK,GAAG;EACf;AACA,SAAO,IAAI,WAAW,IAAI;AAC5B;AAEO,IAAM,eAAe,KAAK;EAC/B,QAAQ;EACR,MAAM;EACN,QAAAD;EACA,QAAAC;CACD;;;ACzCD;;;;;;;;;;;;AAEO,IAAM,SAAS,QAAQ;EAC5B,QAAQ;EACR,MAAM;EACN,UAAU;EACV,aAAa;CACd;AAEM,IAAM,cAAc,QAAQ;EACjC,QAAQ;EACR,MAAM;EACN,UAAU;EACV,aAAa;CACd;AAEM,IAAM,YAAY,QAAQ;EAC/B,QAAQ;EACR,MAAM;EACN,UAAU;EACV,aAAa;CACd;AAEM,IAAM,iBAAiB,QAAQ;EACpC,QAAQ;EACR,MAAM;EACN,UAAU;EACV,aAAa;CACd;AAEM,IAAM,YAAY,QAAQ;EAC/B,QAAQ;EACR,MAAM;EACN,UAAU;EACV,aAAa;CACd;AAEM,IAAM,iBAAiB,QAAQ;EACpC,QAAQ;EACR,MAAM;EACN,UAAU;EACV,aAAa;CACd;AAEM,IAAM,eAAe,QAAQ;EAClC,QAAQ;EACR,MAAM;EACN,UAAU;EACV,aAAa;CACd;AAEM,IAAM,oBAAoB,QAAQ;EACvC,QAAQ;EACR,MAAM;EACN,UAAU;EACV,aAAa;CACd;AAEM,IAAM,UAAU,QAAQ;EAC7B,QAAQ;EACR,MAAM;EACN,UAAU;EACV,aAAa;CACd;;;AC/DD;;;;;AAEO,IAAM,SAAS,MAAM;EAC1B,QAAQ;EACR,MAAM;EACN,UAAU;CACX;AAEM,IAAM,cAAc,MAAM;EAC/B,QAAQ;EACR,MAAM;EACN,UAAU;CACX;;;ACZD;;;;;AAEO,IAAM,YAAY,MAAM;EAC7B,MAAM;EACN,QAAQ;EACR,UAAU;CACX;AAEM,IAAM,eAAe,MAAM;EAChC,MAAM;EACN,QAAQ;EACR,UAAU;CACX;;;ACZD;;;;;;;AAEO,IAAM,SAAS,QAAQ;EAC5B,QAAQ;EACR,MAAM;EACN,UAAU;EACV,aAAa;CACd;AAEM,IAAM,YAAY,QAAQ;EAC/B,QAAQ;EACR,MAAM;EACN,UAAU;EACV,aAAa;CACd;AAEM,IAAM,YAAY,QAAQ;EAC/B,QAAQ;EACR,MAAM;EACN,UAAU;EACV,aAAa;CACd;AAEM,IAAM,eAAe,QAAQ;EAClC,QAAQ;EACR,MAAM;EACN,UAAU;EACV,aAAa;CACd;;;AC5BD;;;;AAEO,IAAM,QAAQ,QAAQ;EAC3B,QAAQ;EACR,MAAM;EACN,UAAU;EACV,aAAa;CACd;;;ACPD;;;;AAGO,IAAM,WAAW,KAAK;EAC3B,QAAQ;EACR,MAAM;EACN,QAAQ,CAAC,QAAQ,SAAS,GAAG;EAC7B,QAAQ,CAAC,QAAQ,WAAW,GAAG;CAChC;;;ACND,IAAM,cAAc,IAAI,YAAW;AACnC,IAAM,cAAc,IAAI,YAAW;;;ACC5B,IAAM,OAAO;;;ACJpB,IAAAC,oBAAA;SAAAA,mBAAA;kBAAAC;;;;ACCA,IAAI,WAAWC;AAEf,IAAI,MAAM;AAAV,IACI,OAAO;AADX,IAEI,SAAS,CAAC;AAFd,IAGI,MAAM,KAAK,IAAI,GAAG,EAAE;AAOxB,SAASA,QAAO,KAAK,KAAK,QAAM;AAC9B,QAAM,OAAO,CAAA;AACb,WAAS,UAAU;AACnB,MAAI,YAAY;AAEhB,SAAM,OAAO,KAAK;AAChB,QAAI,QAAQ,IAAK,MAAM,MAAQ;AAC/B,WAAO;EACT;AACA,SAAM,MAAM,QAAQ;AAClB,QAAI,QAAQ,IAAK,MAAM,MAAQ;AAC/B,aAAS;EACX;AACA,MAAI,MAAM,IAAI,MAAM;AAGpB,EAAAA,QAAO,QAAQ,SAAS,YAAY;AAEpC,SAAO;AACT;AAEA,IAAIC,UAAS;AAEb,IAAI,QAAQ;AAAZ,IACI,SAAS;AAMb,SAAS,KAAK,KAAK,QAAM;AACvB,MAAI,MAAS,GACT,SAAS,UAAU,GACnB,QAAS,GACT,UAAU,QACV,GACA,IAAI,IAAI;AAEZ,KAAG;AACD,QAAI,WAAW,GAAG;AAEhB,WAAK,QAAQ;AACb,YAAM,IAAI,WAAW,yBAAyB;IAChD;AACA,QAAI,IAAI,SAAS;AACjB,WAAO,QAAQ,MACV,IAAI,WAAW,SACf,IAAI,UAAU,KAAK,IAAI,GAAG,KAAK;AACpC,aAAS;EACX,SAAS,KAAK;AAGd,OAAK,QAAQ,UAAU;AAEvB,SAAO;AACT;AAEA,IAAI,KAAK,KAAK,IAAI,GAAI,CAAC;AACvB,IAAI,KAAK,KAAK,IAAI,GAAG,EAAE;AACvB,IAAI,KAAK,KAAK,IAAI,GAAG,EAAE;AACvB,IAAI,KAAK,KAAK,IAAI,GAAG,EAAE;AACvB,IAAI,KAAK,KAAK,IAAI,GAAG,EAAE;AACvB,IAAI,KAAK,KAAK,IAAI,GAAG,EAAE;AACvB,IAAI,KAAK,KAAK,IAAI,GAAG,EAAE;AACvB,IAAI,KAAK,KAAK,IAAI,GAAG,EAAE;AACvB,IAAI,KAAK,KAAK,IAAI,GAAG,EAAE;AAEvB,IAAI,SAAS,SAAgC,OAAK;AAChD,SACE,QAAQ,KAAK,IACb,QAAQ,KAAK,IACb,QAAQ,KAAK,IACb,QAAQ,KAAK,IACb,QAAQ,KAAK,IACb,QAAQ,KAAK,IACb,QAAQ,KAAK,IACb,QAAQ,KAAK,IACb,QAAQ,KAAK,IACA;AAEjB;AAEA,IAAI,SAAS;EACT,QAAQ;EACR,QAAQA;EACR,gBAAgB;;AAGpB,IAAI,eAAe;AAEnB,IAAA,iBAAe;;;ACrGT,SAAUC,QAAQ,MAAkB,SAAS,GAAC;AAClD,QAAMC,QAAO,eAAO,OAAO,MAAM,MAAM;AACvC,SAAO,CAACA,OAAM,eAAO,OAAO,KAAK;AACnC;AAEM,SAAU,SAAU,KAAa,QAAoB,SAAS,GAAC;AACnE,iBAAO,OAAO,KAAK,QAAQ,MAAM;AACjC,SAAO;AACT;AAEM,SAAU,eAAgB,KAAW;AACzC,SAAO,eAAO,eAAe,GAAG;AAClC;;;ACPM,SAAU,OAA8BC,OAAYC,SAAkB;AAC1E,QAAM,OAAOA,QAAO;AACpB,QAAM,aAAoB,eAAeD,KAAI;AAC7C,QAAM,eAAe,aAAoB,eAAe,IAAI;AAE5D,QAAME,SAAQ,IAAI,WAAW,eAAe,IAAI;AAChD,EAAO,SAASF,OAAME,QAAO,CAAC;AAC9B,EAAO,SAAS,MAAMA,QAAO,UAAU;AACvC,EAAAA,OAAM,IAAID,SAAQ,YAAY;AAE9B,SAAO,IAAI,OAAOD,OAAM,MAAMC,SAAQC,MAAK;AAC7C;AAKM,SAAUC,QAAQ,WAAqB;AAC3C,QAAMD,SAAQ,OAAO,SAAS;AAC9B,QAAM,CAACF,OAAM,UAAU,IAAWG,QAAOD,MAAK;AAC9C,QAAM,CAAC,MAAM,YAAY,IAAWC,QAAOD,OAAM,SAAS,UAAU,CAAC;AACrE,QAAMD,UAASC,OAAM,SAAS,aAAa,YAAY;AAEvD,MAAID,QAAO,eAAe,MAAM;AAC9B,UAAM,IAAI,MAAM,kBAAkB;EACpC;AAEA,SAAO,IAAI,OAAOD,OAAM,MAAMC,SAAQC,MAAK;AAC7C;AAEM,SAAUE,QAAQ,GAAoB,GAAU;AACpD,MAAI,MAAM,GAAG;AACX,WAAO;EACT,OAAO;AACL,UAAM,OAAO;AAEb,WACE,EAAE,SAAS,KAAK,QAChB,EAAE,SAAS,KAAK,QAChB,KAAK,iBAAiB,cACtB,OAAW,EAAE,OAAO,KAAK,KAAK;EAElC;AACF;AAMM,IAAO,SAAP,MAAa;;;;EASjB,YAAaJ,OAAY,MAAYC,SAAoBC,QAAiB;AARjE;AACA;AACA;AACA;AAMP,SAAK,OAAOF;AACZ,SAAK,OAAO;AACZ,SAAK,SAASC;AACd,SAAK,QAAQC;EACf;;;;AHjEF,IAAMG,QAAY;AAClB,IAAM,OAAO;AAEb,IAAMC,UAA4C;AAElD,SAAS,OAAQ,OAAmB,SAAuB;AACzD,MAAI,SAAS,YAAY,QAAQ,QAAQ,aAAa,MAAM,YAAY;AACtE,QAAI,QAAQ,WAAW,KAAK,QAAQ,WAAW,MAAM,YAAY;AAC/D,YAAM,IAAI,MAAM,0DAA0D,MAAM,UAAU,EAAE;IAC9F;AAEA,YAAQ,MAAM,SAAS,GAAG,QAAQ,QAAQ;EAC5C;AAEA,SAAc,OAAOD,OAAMC,QAAO,KAAK,CAAC;AAC1C;AAEO,IAAMC,YAAW,EAAE,MAAAF,OAAM,MAAM,QAAAC,SAAQ,OAAM;;;AIrBpD;;;;;;;ACKA,IAAM,4BAA4B;AAqB5B,SAAUE,MAAiD,EAAE,MAAAC,OAAM,MAAAC,OAAM,QAAAC,SAAQ,iBAAiB,gBAAe,GAA0B;AAC/I,SAAO,IAAI,OAAOF,OAAMC,OAAMC,SAAQ,iBAAiB,eAAe;AACxE;AAoBM,IAAO,SAAP,MAAa;EAOjB,YAAaF,OAAYC,OAAYC,SAAkD,iBAA0B,iBAAwB;AANhI;AACA;AACA;AACA;AACA;AAGP,SAAK,OAAOF;AACZ,SAAK,OAAOC;AACZ,SAAK,SAASC;AACd,SAAK,kBAAkB,mBAAmB;AAC1C,SAAK,kBAAkB;EACzB;EAEA,OAAQ,OAAmB,SAAuB;AAChD,QAAI,SAAS,YAAY,MAAM;AAC7B,UAAI,QAAQ,WAAW,KAAK,iBAAiB;AAC3C,cAAM,IAAI,MAAM,6DAA6D,KAAK,eAAe,EAAE;MACrG;AAEA,UAAI,KAAK,mBAAmB,QAAQ,QAAQ,WAAW,KAAK,iBAAiB;AAC3E,cAAM,IAAI,MAAM,0DAA0D,KAAK,eAAe,EAAE;MAClG;IACF;AAEA,QAAI,iBAAiB,YAAY;AAC/B,YAAM,SAAS,KAAK,OAAO,KAAK;AAEhC,UAAI,kBAAkB,YAAY;AAChC,eAAO,aAAa,QAAQ,KAAK,MAAM,SAAS,QAAQ;MAC1D;AAEA,aAAO,OAAO,KAAK,CAAAC,YAAU,aAAaA,SAAQ,KAAK,MAAM,SAAS,QAAQ,CAAC;IACjF,OAAO;AACL,YAAM,MAAM,mCAAmC;IAEjD;EACF;;AAOF,SAAS,aAAoCA,SAAoBF,OAAY,UAAiB;AAC5F,MAAI,YAAY,QAAQ,aAAaE,QAAO,YAAY;AACtD,QAAI,WAAWA,QAAO,YAAY;AAChC,YAAM,IAAI,MAAM,0DAA0DA,QAAO,UAAU,EAAE;IAC/F;AAEA,IAAAA,UAASA,QAAO,SAAS,GAAG,QAAQ;EACtC;AAEA,SAAc,OAAOF,OAAME,OAAM;AACnC;;;ADnGA,SAAS,IAAKC,OAAyB;AACrC,SAAO,OAAM,SAAQ,IAAI,WAAW,MAAM,OAAO,OAAO,OAAOA,OAAM,IAAI,CAAC;AAC5E;AAEO,IAAM,SAASC,MAAK;EACzB,MAAM;EACN,MAAM;EACN,QAAQ,IAAI,SAAS;CACtB;AAEM,IAAM,SAASA,MAAK;EACzB,MAAM;EACN,MAAM;EACN,QAAQ,IAAI,SAAS;CACtB;;;AEPK,SAAU,OAA0F,MAASC,OAAmC;AACpJ,QAAM,EAAE,OAAAC,QAAO,QAAO,IAAK;AAC3B,UAAQ,SAAS;IACf,KAAK;AACH,aAAO,WACLA,QACA,UAAU,IAAI,GACdD,SAAqC,UAAU,OAAO;IAE1D;AACE,aAAO,WACLC,QACA,UAAU,IAAI,GACbD,SAAQ,OAAO,OAAwC;EAE9D;AACF;AAYA,IAAM,QAAQ,oBAAI,QAAO;AAEzB,SAAS,UAAWE,MAAoB;AACtC,QAAMC,aAAY,MAAM,IAAID,IAAG;AAC/B,MAAIC,cAAa,MAAM;AACrB,UAAMA,aAAY,oBAAI,IAAG;AACzB,UAAM,IAAID,MAAKC,UAAS;AACxB,WAAOA;EACT;AACA,SAAOA;AACT;AAjDA;AAmDM,IAAO,MAAP,MAAO,KAAG;;;;;;EAYd,YAAa,SAAkBC,OAAc,WAAqCC,QAAiB;AAX1F;AACA;AACA;AACA;AACA;AAmHA,wBAAC,IAAsB;AA3G9B,SAAK,OAAOD;AACZ,SAAK,UAAU;AACf,SAAK,YAAY;AACjB,SAAK,QAAQC;AAIb,SAAK,GAAG,IAAIA;EACd;;;;;;;EAQA,IAAI,QAAK;AACP,WAAO;EACT;;EAGA,IAAI,aAAU;AACZ,WAAO,KAAK,MAAM;EACpB;;EAGA,IAAI,aAAU;AACZ,WAAO,KAAK,MAAM;EACpB;EAEA,OAAI;AACF,YAAQ,KAAK,SAAS;MACpB,KAAK,GAAG;AACN,eAAO;MACT;MACA,KAAK,GAAG;AACN,cAAM,EAAE,MAAAD,OAAM,UAAS,IAAK;AAE5B,YAAIA,UAAS,aAAa;AACxB,gBAAM,IAAI,MAAM,0CAA0C;QAC5D;AAGA,YAAI,UAAU,SAAS,cAAc;AACnC,gBAAM,IAAI,MAAM,oDAAoD;QACtE;AAEA,eACE,KAAI,SACF,SAA6C;MAGnD;MACA,SAAS;AACP,cAAM,MACJ,+BAA+B,KAAK,OAAO,4CAA4C;MAE3F;IACF;EACF;EAEA,OAAI;AACF,YAAQ,KAAK,SAAS;MACpB,KAAK,GAAG;AACN,cAAM,EAAE,MAAAA,OAAM,QAAAE,QAAM,IAAK,KAAK;AAC9B,cAAM,YAAmB,OAAOF,OAAME,OAAM;AAC5C,eACE,KAAI,SAAS,KAAK,MAAM,SAAS;MAErC;MACA,KAAK,GAAG;AACN,eAAO;MACT;MACA,SAAS;AACP,cAAM,MACJ,+BAA+B,KAAK,OAAO,4CAA4C;MAE3F;IACF;EACF;EAEA,OAAQ,OAAc;AACpB,WAAO,KAAI,OAAO,MAAM,KAAK;EAC/B;EAEA,OAAO,OAAsF,MAA4C,OAAc;AACrJ,UAAM,UAAU;AAChB,WACE,WAAW,QACX,KAAK,SAAS,QAAQ,QACtB,KAAK,YAAY,QAAQ,WAClBC,QAAO,KAAK,WAAW,QAAQ,SAAS;EAEnD;EAEA,SAAUC,OAAmC;AAC3C,WAAO,OAAO,MAAMA,KAAI;EAC1B;EAEA,SAAM;AACJ,WAAO,EAAE,KAAK,OAAO,IAAI,EAAC;EAC5B;EAEA,OAAI;AACF,WAAO;EACT;;EAMA,EAJU,YAAO,aAIhB,uBAAO,IAAI,4BAA4B,EAAC,IAAC;AACxC,WAAO,OAAO,KAAK,SAAQ,CAAE;EAC/B;;;;;;;;;;;EAYA,OAAO,MAAwF,OAA+C;AAC5I,QAAI,SAAS,MAAM;AACjB,aAAO;IACT;AAEA,UAAM,QAAQ;AACd,QAAI,iBAAiB,MAAK;AAExB,aAAO;IACT,WAAY,MAAM,GAAG,KAAK,QAAQ,MAAM,GAAG,MAAM,MAAM,SAAU,MAAM,UAAU,OAAO;AAMtF,YAAM,EAAE,SAAS,MAAAJ,OAAM,WAAW,OAAAC,OAAK,IAAK;AAC5C,aAAO,IAAI,KACT,SACAD,OACA,WACAC,UAAS,UAAU,SAASD,OAAM,UAAU,KAAK,CAAC;IAEtD,WAAW,MAAM,SAAS,MAAM,MAAM;AAIpC,YAAM,EAAE,SAAS,WAAW,MAAAA,MAAI,IAAK;AACrC,YAAME,UAAgBG,QAAO,SAAS;AACtC,aAAO,KAAI,OAAO,SAASL,OAAME,OAAM;IACzC,OAAO;AAGL,aAAO;IACT;EACF;;;;;;EAOA,OAAO,OAAsF,SAAkBF,OAAcE,SAAgC;AAC3J,QAAI,OAAOF,UAAS,UAAU;AAC5B,YAAM,IAAI,MAAM,uCAAuC;IACzD;AAEA,QAAI,EAAEE,QAAO,iBAAiB,aAAa;AACzC,YAAM,IAAI,MAAM,gBAAgB;IAClC;AAEA,YAAQ,SAAS;MACf,KAAK,GAAG;AACN,YAAIF,UAAS,aAAa;AACxB,gBAAM,IAAI,MACR,wCAAwC,WAAW,kBAAkB;QAEzE,OAAO;AACL,iBAAO,IAAI,KAAI,SAASA,OAAME,SAAQA,QAAO,KAAK;QACpD;MACF;MACA,KAAK,GAAG;AACN,cAAMD,SAAQ,UAAU,SAASD,OAAME,QAAO,KAAK;AACnD,eAAO,IAAI,KAAI,SAASF,OAAME,SAAQD,MAAK;MAC7C;MACA,SAAS;AACP,cAAM,IAAI,MAAM,iBAAiB;MACnC;IACF;EACF;;;;EAKA,OAAO,SAAuBC,SAAgD;AAC5E,WAAO,KAAI,OAAO,GAAG,aAAaA,OAAM;EAC1C;;;;;;;EAQA,OAAO,SAAyDF,OAAYE,SAAgC;AAC1G,WAAO,KAAI,OAAO,GAAGF,OAAME,OAAM;EACnC;;;;;;;;EASA,OAAO,OAAoFD,QAAuD;AAChJ,UAAM,CAACH,MAAK,SAAS,IAAI,KAAI,YAAYG,MAAK;AAC9C,QAAI,UAAU,WAAW,GAAG;AAC1B,YAAM,IAAI,MAAM,kBAAkB;IACpC;AACA,WAAOH;EACT;;;;;;;;;;EAWA,OAAO,YAA2EG,QAAyC;AACzH,UAAM,QAAQ,KAAI,aAAaA,MAAK;AACpC,UAAM,aAAa,MAAM,OAAO,MAAM;AACtC,UAAM,iBAAiB,OACrBA,OAAM,SAAS,YAAY,aAAa,MAAM,aAAa,CAAC;AAE9D,QAAI,eAAe,eAAe,MAAM,eAAe;AACrD,YAAM,IAAI,MAAM,kBAAkB;IACpC;AACA,UAAM,cAAc,eAAe,SACjC,MAAM,gBAAgB,MAAM,UAAU;AAExC,UAAMC,UAAS,IAAW,OACxB,MAAM,eACN,MAAM,YACN,aACA,cAAc;AAEhB,UAAMJ,OACJ,MAAM,YAAY,IACd,KAAI,SAASI,OAA0C,IACvD,KAAI,SAAS,MAAM,OAAOA,OAAM;AACtC,WAAO,CAACJ,MAAwBG,OAAM,SAAS,MAAM,IAAI,CAAC;EAC5D;;;;;;;;;;EAWA,OAAO,aAA4E,cAAgD;AACjI,QAAI,SAAS;AACb,UAAM,OAAO,MAAa;AACxB,YAAM,CAAC,GAAGK,OAAM,IAAWD,QAAO,aAAa,SAAS,MAAM,CAAC;AAC/D,gBAAUC;AACV,aAAO;IACT;AAEA,QAAI,UAAU,KAAI;AAClB,QAAI,QAAQ;AACZ,QAAI,YAAsB,IAAI;AAE5B,gBAAU;AACV,eAAS;IACX,OAAO;AACL,cAAQ,KAAI;IACd;AAEA,QAAI,YAAY,KAAK,YAAY,GAAG;AAClC,YAAM,IAAI,WAAW,uBAAuB,OAAO,EAAE;IACvD;AAEA,UAAM,aAAa;AACnB,UAAM,gBAAgB,KAAI;AAC1B,UAAM,aAAa,KAAI;AACvB,UAAM,OAAO,SAAS;AACtB,UAAM,gBAAgB,OAAO;AAE7B,WAAO,EAAE,SAAS,OAAO,eAAe,YAAY,eAAe,KAAI;EACzE;;;;;;;EAQA,OAAO,MAA0G,QAAkEF,OAAmC;AACpN,UAAM,CAAC,QAAQH,MAAK,IAAI,gBAAgB,QAAQG,KAAI;AAEpD,UAAMN,OAAM,KAAI,OAAOG,MAAK;AAE5B,QAAIH,KAAI,YAAY,KAAK,OAAO,CAAC,MAAM,KAAK;AAC1C,YAAM,MAAM,wDAAwD;IACtE;AAGA,cAAUA,IAAG,EAAE,IAAI,QAAQ,MAAM;AAEjC,WAAOA;EACT;;AAGF,SAAS,gBAAqH,QAAkEM,OAAmC;AACjO,UAAQ,OAAO,CAAC,GAAG;;IAEjB,KAAK,KAAK;AACR,YAAM,UAAUA,SAAQ;AACxB,aAAO;QACL,UAAU;QACV,QAAQ,OAAO,GAAG,UAAU,MAAM,GAAG,MAAM,EAAE;;IAEjD;IACA,KAAK,UAAU,QAAQ;AACrB,YAAM,UAAUA,SAAQ;AACxB,aAAO,CAAC,UAAU,QAAkB,QAAQ,OAAO,MAAM,CAAC;IAC5D;IACA,KAAK,OAAO,QAAQ;AAClB,YAAM,UAAUA,SAAQ;AACxB,aAAO,CAAC,OAAO,QAAkB,QAAQ,OAAO,MAAM,CAAC;IACzD;IACA,KAAK,OAAO,QAAQ;AAClB,YAAM,UAAUA,SAAQ;AACxB,aAAO,CAAC,OAAO,QAAkB,QAAQ,OAAO,MAAM,CAAC;IACzD;IACA,SAAS;AACP,UAAIA,SAAQ,MAAM;AAChB,cAAM,MACJ,yFAAyF;MAE7F;AACA,aAAO,CAAC,OAAO,CAAC,GAAaA,MAAK,OAAO,MAAM,CAAC;IAClD;EACF;AACF;AAEA,SAAS,WAAYH,QAAmBM,QAA4BH,OAA+B;AACjG,QAAM,EAAE,OAAM,IAAKA;AACnB,MAAI,WAAW,UAAU,QAAQ;AAC/B,UAAM,MAAM,8BAA8BA,MAAK,IAAI,WAAW;EAChE;AAEA,QAAMN,OAAMS,OAAM,IAAI,MAAM;AAC5B,MAAIT,QAAO,MAAM;AACf,UAAMA,OAAMM,MAAK,OAAOH,MAAK,EAAE,MAAM,CAAC;AACtC,IAAAM,OAAM,IAAI,QAAQT,IAAG;AACrB,WAAOA;EACT,OAAO;AACL,WAAOA;EACT;AACF;AAEA,SAAS,WAAoCG,QAAmBM,QAA4BH,OAAkC;AAC5H,QAAM,EAAE,OAAM,IAAKA;AACnB,QAAMN,OAAMS,OAAM,IAAI,MAAM;AAC5B,MAAIT,QAAO,MAAM;AACf,UAAMA,OAAMM,MAAK,OAAOH,MAAK;AAC7B,IAAAM,OAAM,IAAI,QAAQT,IAAG;AACrB,WAAOA;EACT,OAAO;AACL,WAAOA;EACT;AACF;AAEA,IAAM,cAAc;AACpB,IAAM,eAAe;AAErB,SAAS,UAAW,SAAsBE,OAAc,WAAqB;AAC3E,QAAM,aAAoB,eAAe,OAAO;AAChD,QAAM,aAAa,aAAoB,eAAeA,KAAI;AAC1D,QAAMC,SAAQ,IAAI,WAAW,aAAa,UAAU,UAAU;AAC9D,EAAO,SAAS,SAASA,QAAO,CAAC;AACjC,EAAO,SAASD,OAAMC,QAAO,UAAU;AACvC,EAAAA,OAAM,IAAI,WAAW,UAAU;AAC/B,SAAOA;AACT;AAEA,IAAM,YAAY,uBAAO,IAAI,kBAAkB;;;AC7bxC,IAAM,QAAQ,EAAE,GAAG,kBAAc,GAAG,eAAO,GAAG,eAAO,GAAG,gBAAQ,GAAG,gBAAQ,GAAG,gBAAQ,GAAG,gBAAQ,GAAG,gBAAQ,GAAG,gBAAQ,GAAG,qBAAY;AACtI,IAAM,SAAS,EAAE,GAAG,sBAAM,GAAGO,kBAAQ;;;ACgC5C,IAAAC,kBAAwB;;;ACjDxB,IAAAC,uBASO;AACP,IAAAC,kBAAwB;AACxB,IAAAC,iBAAuB;;;ACXvB,qBAAwB;AACxB,oBAAuB;AACvB,oBAAuB;AAOvB,IAAM,kBAAkB;AACxB,IAAM,gBAAgB;AACtB,IAAM,gBAAgB;AACtB,IAAM,kBAAkB;AACxB,IAAM,2BAA2B,MAAM;AAChC,IAAM,0BAA0B,MAAM,OAAO;AAE7C,IAAM,iCAAiC,0BAA0B;AAEjE,IAAM,2BACX,KAAK,KAAM,iCAAiC,IAAK,CAAC,IAAI,IAAI,OAAO;AACnE,IAAM,6BAA6B;AAqG5B,IAAM,qBAAN,cAAiC,MAAM;AAAA,EAY5C,YAAYC,OAAkC,SAAiB;AAC7D,UAAM,OAAO;AACb,SAAK,OAAO;AACZ,SAAK,OAAOA;AAAA,EACd;AACF;AAEA,SAAS,iBAAiBC,QAA2B;AACnD,MAAI,SAAS;AACb,aAAW,QAAQA,OAAO,WAAU,OAAO,aAAa,IAAI;AAC5D,QAAM,UAAU,OAAO,SAAS,aAC5B,KAAK,MAAM,IACX,OAAO,KAAKA,MAAK,EAAE,SAAS,QAAQ;AACxC,SAAO,QAAQ,QAAQ,OAAO,GAAG,EAAE,QAAQ,OAAO,GAAG,EAAE,QAAQ,QAAQ,EAAE;AAC3E;AAEA,SAAS,iBAAiB,OAA2B;AACnD,MAAI,CAAC,mBAAmB,KAAK,KAAK,KAAK,MAAM,SAAS,MAAM,GAAG;AAC7D,UAAM,IAAI,mBAAmB,gBAAgB,yBAAyB;AAAA,EACxE;AACA,QAAM,SAAS,MAAM,QAAQ,MAAM,GAAG,EAAE,QAAQ,MAAM,GAAG,IAAI,IAAI,QAAQ,IAAI,MAAM,SAAS,KAAK,CAAC;AAClG,QAAM,UAAU,OAAO,SAAS,cAC3B,MAAM;AACL,UAAM,SAAS,KAAK,MAAM;AAC1B,WAAO,WAAW,KAAK,QAAQ,CAAC,SAAS,KAAK,WAAW,CAAC,CAAC;AAAA,EAC7D,GAAG,IACH,IAAI,WAAW,OAAO,KAAK,QAAQ,QAAQ,CAAC;AAChD,MAAI,iBAAiB,OAAO,MAAM,MAAO,OAAM,IAAI,mBAAmB,gBAAgB,yBAAyB;AAC/G,SAAO;AACT;AAEA,SAAS,WAAW,OAAe,SAA4B,OAAqB;AAClF,QAAM,YAAY,IAAI,IAAI,OAAO;AACjC,aAAW,OAAO,OAAO,KAAK,KAAK,EAAG,KAAI,CAAC,UAAU,IAAI,GAAG,EAAG,OAAM,IAAI,mBAAmB,oBAAoB,GAAG,KAAK,4BAA4B;AACtJ;AAEA,SAAS,cAAc,OAAwB;AAC7C,MAAI,UAAU,QAAQ,OAAO,UAAU,YAAY,OAAO,UAAU,WAAW;AAC7E,WAAO,KAAK,UAAU,KAAK;AAAA,EAC7B;AACA,MAAI,OAAO,UAAU,UAAU;AAC7B,QAAI,CAAC,OAAO,SAAS,KAAK,EAAG,OAAM,IAAI,mBAAmB,oBAAoB,mBAAmB;AACjG,WAAO,KAAK,UAAU,KAAK;AAAA,EAC7B;AACA,MAAI,MAAM,QAAQ,KAAK,EAAG,QAAO,IAAI,MAAM,IAAI,aAAa,EAAE,KAAK,GAAG,CAAC;AACvE,MAAI,OAAO,UAAU,UAAU;AAC7B,UAAM,SAAS;AACf,WAAO,IAAI,OAAO,KAAK,MAAM,EAAE,KAAK,EAAE,IAAI,CAAC,QAAQ,GAAG,KAAK,UAAU,GAAG,CAAC,IAAI,cAAc,OAAO,GAAG,CAAC,CAAC,EAAE,EAAE,KAAK,GAAG,CAAC;AAAA,EACtH;AACA,QAAM,IAAI,mBAAmB,oBAAoB,wBAAwB;AAC3E;AAEA,SAAS,eAAe,MAAc,OAAuB;AAC3D,MAAI,QAAQ;AACZ,SAAO,KAAK,KAAK,KAAK,KAAK,KAAK,EAAE,EAAG,UAAS;AAC9C,SAAO;AACT;AAEA,SAAS,cAAc,MAAc,OAAuB;AAC1D,MAAI,QAAQ,eAAe,MAAM,KAAK;AACtC,QAAM,QAAQ,KAAK,KAAK;AACxB,MAAI,UAAU,KAAK;AACjB,aAAS;AACT,WAAO,QAAQ,KAAK,QAAQ;AAC1B,UAAI,KAAK,KAAK,MAAM,KAAM,UAAS;AAAA,eAC1B,KAAK,OAAO,MAAM,IAAK,QAAO;AAAA,IACzC;AACA,UAAM,IAAI,mBAAmB,oBAAoB,0BAA0B;AAAA,EAC7E;AACA,MAAI,UAAU,KAAK;AACjB,UAAM,OAAO,oBAAI,IAAY;AAC7B,YAAQ,eAAe,MAAM,QAAQ,CAAC;AACtC,QAAI,KAAK,KAAK,MAAM,IAAK,QAAO,QAAQ;AACxC,WAAO,QAAQ,KAAK,QAAQ;AAC1B,cAAQ,eAAe,MAAM,KAAK;AAClC,UAAI,KAAK,KAAK,MAAM,IAAK,OAAM,IAAI,mBAAmB,oBAAoB,6BAA6B;AACvG,YAAM,WAAW;AACjB,cAAQ,cAAc,MAAM,KAAK;AACjC,YAAM,MAAM,KAAK,MAAM,KAAK,MAAM,UAAU,KAAK,CAAC;AAClD,UAAI,KAAK,IAAI,GAAG,EAAG,OAAM,IAAI,mBAAmB,oBAAoB,sBAAsB,GAAG,EAAE;AAC/F,WAAK,IAAI,GAAG;AACZ,cAAQ,eAAe,MAAM,KAAK;AAClC,UAAI,KAAK,OAAO,MAAM,IAAK,OAAM,IAAI,mBAAmB,oBAAoB,sBAAsB;AAClG,cAAQ,cAAc,MAAM,KAAK;AACjC,cAAQ,eAAe,MAAM,KAAK;AAClC,UAAI,KAAK,KAAK,MAAM,IAAK,QAAO,QAAQ;AACxC,UAAI,KAAK,OAAO,MAAM,IAAK,OAAM,IAAI,mBAAmB,oBAAoB,0BAA0B;AAAA,IACxG;AACA,UAAM,IAAI,mBAAmB,oBAAoB,0BAA0B;AAAA,EAC7E;AACA,MAAI,UAAU,KAAK;AACjB,YAAQ,eAAe,MAAM,QAAQ,CAAC;AACtC,QAAI,KAAK,KAAK,MAAM,IAAK,QAAO,QAAQ;AACxC,WAAO,QAAQ,KAAK,QAAQ;AAC1B,cAAQ,cAAc,MAAM,KAAK;AACjC,cAAQ,eAAe,MAAM,KAAK;AAClC,UAAI,KAAK,KAAK,MAAM,IAAK,QAAO,QAAQ;AACxC,UAAI,KAAK,OAAO,MAAM,IAAK,OAAM,IAAI,mBAAmB,oBAAoB,yBAAyB;AAAA,IACvG;AACA,UAAM,IAAI,mBAAmB,oBAAoB,yBAAyB;AAAA,EAC5E;AACA,QAAM,QAAQ,KAAK,MAAM,KAAK,EAAE,MAAM,kEAAkE;AACxG,MAAI,CAAC,MAAO,OAAM,IAAI,mBAAmB,oBAAoB,oBAAoB;AACjF,SAAO,QAAQ,MAAM,CAAC,EAAE;AAC1B;AAEA,SAAS,mBAAmB,MAAuB;AACjD,MAAI;AACF,UAAM,MAAM,cAAc,MAAM,CAAC;AACjC,QAAI,eAAe,MAAM,GAAG,MAAM,KAAK,OAAQ,OAAM,IAAI,MAAM,eAAe;AAC9E,UAAM,SAAS,KAAK,MAAM,IAAI;AAC9B,QAAI,cAAc,MAAM,MAAM,KAAM,OAAM,IAAI,MAAM,oBAAoB;AACxE,WAAO;AAAA,EACT,SAAS,OAAO;AACd,QAAI,iBAAiB,mBAAoB,OAAM;AAC/C,UAAM,IAAI,mBAAmB,oBAAoB,iBAAiB,QAAQ,MAAM,UAAU,cAAc;AAAA,EAC1G;AACF;AAEA,SAAS,gBAAgB,OAAuB;AAC9C,MAAI;AACF,UAAM,MAAM,IAAI,IAAI,KAAK;AACzB,QAAI,CAAC,CAAC,SAAS,QAAQ,EAAE,SAAS,IAAI,QAAQ,KAAK,IAAI,YAAY,IAAI,YAAY,IAAI,UAAU,IAAI,MAAM;AACzG,YAAM,IAAI,MAAM,sCAAsC;AAAA,IACxD;AACA,WAAO,IAAI;AAAA,EACb,QAAQ;AACN,UAAM,IAAI,mBAAmB,oBAAoB,wBAAwB;AAAA,EAC3E;AACF;AAEA,SAAS,kBAAkB,UAAwC;AACjE,MAAI,SAAS,SAAS,WAAW,SAAS,SAAS,SAAU,OAAM,IAAI,mBAAmB,oBAAoB,uBAAuB;AACrI,MAAI,CAAC,SAAS,QAAQ,SAAS,KAAK,WAAW,GAAG,KAAK,0BAA0B,KAAK,SAAS,IAAI,KAAK,eAAe,KAAK,SAAS,IAAI,KAAK,SAAS,KAAK,MAAM,GAAG,EAAE,KAAK,CAAC,MAAM,OAAO,UAAU,SAAS,OAAO,SAAS,QAAS,KAAK,WAAW,KAAK,EAAE,SAAS,SAAS,YAAY,UAAU,MAAM,SAAS,EAAG,GAAG;AACxT,UAAM,IAAI,mBAAmB,oBAAoB,gCAAgC;AAAA,EACnF;AACA,SAAO,EAAE,MAAM,SAAS,MAAM,MAAM,SAAS,SAAS,YAAY,CAAC,SAAS,KAAK,SAAS,GAAG,IAAI,GAAG,SAAS,IAAI,MAAM,SAAS,KAAK;AACvI;AAEA,SAAS,iBAAiB,SAAgD;AACxE,QAAM,UAAU,oBAAI,IAAiB,CAAC,QAAQ,QAAQ,MAAM,CAAC;AAC7D,MAAI,QAAQ,WAAW,KAAK,IAAI,IAAI,OAAO,EAAE,SAAS,QAAQ,UAAU,QAAQ,KAAK,CAAC,WAAW,CAAC,QAAQ,IAAI,MAAM,CAAC,GAAG;AACtH,UAAM,IAAI,mBAAmB,oBAAoB,2CAA2C;AAAA,EAC9F;AACA,SAAO,CAAC,GAAG,OAAO,EAAE,KAAK,CAAC,GAAG,MAAM,EAAE,cAAc,CAAC,CAAC;AACvD;AAEA,SAAS,mBAAmB,WAA+E;AACzG,MAAI,cAAc,OAAW,QAAO;AACpC,MAAI,UAAU,SAAS,SAAU,QAAO,EAAE,MAAM,SAAS;AACzD,MAAI,OAAO,UAAU,UAAU,YAAY,UAAU,MAAM,WAAW,KAAK,SAAS,KAAK,UAAU,KAAK,GAAG;AACzG,UAAM,IAAI,mBAAmB,oBAAoB,4BAA4B;AAAA,EAC/E;AACA,MAAI,UAAU,SAAS,eAAe;AACpC,UAAM,SAAS,UAAU,MAAM,YAAY;AAC3C,QAAI,CAAC,6FAA6F,KAAK,MAAM,GAAG;AAC9G,YAAM,IAAI,mBAAmB,oBAAoB,6BAA6B;AAAA,IAChF;AACA,WAAO,EAAE,MAAM,UAAU,MAAM,OAAO,OAAO;AAAA,EAC/C;AACA,MAAI,UAAU,SAAS,gBAAgB;AACrC,QAAI,CAAC,wBAAwB,UAAU,KAAK,EAAG,OAAM,IAAI,mBAAmB,oBAAoB,0BAA0B;AAC1H,WAAO,EAAE,MAAM,UAAU,MAAM,OAAO,UAAU,MAAM;AAAA,EACxD;AAKA,QAAM,QAAQ,UAAU,MAAM,KAAK;AACnC,QAAM,KAAK,MAAM,YAAY,GAAG;AAChC,QAAM,kBAAkB,KAAK,IAAI,GAAG,MAAM,MAAM,GAAG,EAAE,CAAC,IAAI,MAAM,MAAM,KAAK,CAAC,EAAE,YAAY,CAAC,KAAK;AAChG,MAAI,UAAU,SAAS,gBAAgB,CAAC,oBAAoB,KAAK,eAAe,GAAG;AACjF,UAAM,IAAI,mBAAmB,oBAAoB,8BAA8B;AAAA,EACjF;AACA,SAAO,EAAE,MAAM,UAAU,MAAM,OAAO,gBAAgB;AACxD;AAEA,SAAS,wBAAwB,OAAwB;AACvD,MAAI,MAAM,WAAW,KAAK,MAAM,SAAS,QAAQ,wBAAwB,KAAK,KAAK,EAAG,QAAO;AAC7F,QAAM,QAAQ,MAAM,MAAM,GAAG;AAC7B,MAAI,MAAM,SAAS,KAAK,MAAM,CAAC,MAAM,SAAS,CAAC,cAAc,KAAK,MAAM,CAAC,KAAK,EAAE,EAAG,QAAO;AAC1F,QAAM,aAAa,MAAM,MAAM,CAAC;AAChC,MAAI,WAAW,KAAK,CAAC,SAAS,KAAK,WAAW,CAAC,EAAG,QAAO;AACzD,MAAI,MAAM,CAAC,MAAM,OAAO;AACtB,UAAM,OAAO,WAAW,CAAC,KAAK;AAC9B,QAAI,KAAK,SAAS,OAAO,KAAK,MAAM,GAAG,EAAE,KAAK,CAAC,UAAU,CAAC,SAAS,MAAM,SAAS,MAAM,CAAC,kBAAkB,KAAK,KAAK,KAAK,MAAM,WAAW,GAAG,KAAK,MAAM,SAAS,GAAG,CAAC,EAAG,QAAO;AAChL,WAAO,WAAW,MAAM,CAAC,EAAE,MAAM,CAAC,SAAS,qBAAqB,KAAK,IAAI,CAAC;AAAA,EAC5E;AACA,MAAI,MAAM,CAAC,MAAM,MAAO,QAAO,WAAW,UAAU,KAAK,WAAW,MAAM,CAAC,SAAS,qBAAqB,KAAK,IAAI,CAAC;AACnH,MAAI,MAAM,CAAC,MAAM,OAAO;AACtB,QAAI;AACF,YAAMA,SAAQ,UAAU,OAAO,WAAW,KAAK,GAAG,CAAC;AACnD,aAAOA,OAAM,WAAW,MAAMA,OAAM,CAAC,MAAM,OAAQA,OAAM,CAAC,MAAM;AAAA,IAClE,QAAQ;AACN,aAAO;AAAA,IACT;AAAA,EACF;AACA,SAAO;AACT;AAEO,SAAS,8BAA8B,WAAuD;AACnG,QAAM,aAAa,mBAAmB,SAAS;AAC/C,MAAI,eAAe,OAAW,OAAM,IAAI,mBAAmB,oBAAoB,+BAA+B;AAC9G,SAAO;AACT;AAEO,SAAS,uBAAuB,UAAwC;AAC7E,SAAO,kBAAkB,QAAQ;AACnC;AAEO,SAAS,sBAAsB,SAAgD;AACpF,SAAO,iBAAiB,OAAO;AACjC;AAEA,SAAS,iBAAiB,OAAsB,OAA+B;AAC7E,MAAI,MAAM,SAAS,QAAS,QAAO,MAAM,SAAS,WAAW,MAAM,SAAS,MAAM;AAClF,QAAM,SAAS,MAAM,KAAK,SAAS,GAAG,IAAI,MAAM,OAAO,GAAG,MAAM,IAAI;AACpE,QAAM,YAAY,OAAO,MAAM,GAAG,EAAE;AACpC,MAAI,MAAM,SAAS,QAAS,QAAO,MAAM,KAAK,WAAW,MAAM,KAAK,MAAM,SAAS;AACnF,QAAM,cAAc,MAAM,KAAK,SAAS,GAAG,IAAI,MAAM,OAAO,GAAG,MAAM,IAAI;AACzE,SAAO,MAAM,SAAS,aAAa,YAAY,WAAW,MAAM;AAClE;AAEO,SAAS,kBAAkB,OAAmF;AACnH,SAAO;AAAA,IACL,SAAS,8BAA8B,MAAM,OAAO;AAAA,IACpD,SAAS,MAAM;AAAA,IACf,UAAU,uBAAuB,MAAM,QAAQ;AAAA,IAC/C,SAAS,sBAAsB,MAAM,OAAO;AAAA,IAC5C,WAAW,MAAM,UAAU,YAAY;AAAA,EACzC;AACF;AAEA,SAAS,cAAcA,QAA2B;AAChD,SAAO,qBAAiB,sBAAOA,MAAK,CAAC;AACvC;AAEO,SAAS,gBAAgBA,QAA2B;AACzD,QAAMC,UAAS,OAAa,qBAAiB,sBAAOD,MAAK,CAAC;AAC1D,SAAO,IAAI,SAAS,eAAeC,OAAM,EAAE,SAAS;AACtD;AAEO,SAAS,eAAeC,MAAaF,QAA4B;AACtE,MAAI;AACF,UAAM,SAAS,IAAI,MAAME,IAAG;AAC5B,QAAI,OAAO,SAAS,MAAMA,QAAO,OAAO,UAAU,SAAS,gBAAiB,QAAO;AACnF,WAAO,OAAO,OAAO,IAAI,SAAS,OAAO,MAAM,OAAa,OAAO,UAAU,UAAM,sBAAOF,MAAK,CAAC,CAAC,CAAC;AAAA,EACpG,QAAQ;AACN,WAAO;AAAA,EACT;AACF;AAEA,SAAS,qBAAqB,UAA0D;AACtF,SAAO,IAAI,YAAY,EAAE,OAAO,cAAc,QAAQ,CAAC;AACzD;AAEO,SAAS,kBAAkB,OAA6H;AAC7J,MAAI,MAAM,iBAAiB,WAAW,GAAI,OAAM,IAAI,mBAAmB,oBAAoB,sCAAsC;AACjI,QAAM,YAAY,uBAAQ,aAAa,MAAM,gBAAgB;AAC7D,QAAM,WAAW;AAAA,IACf,QAAQ;AAAA,IACR,SAAS;AAAA,IACT,QAAQ,gBAAgB,MAAM,MAAM;AAAA,IACpC,SAAS,MAAM;AAAA,IACf,GAAI,mBAAmB,MAAM,SAAS,GAAG,SAAS,WAAW,EAAE,WAAW,EAAE,MAAM,SAAkB,EAAE,IAAI,CAAC;AAAA,IAC3G,GAAI,MAAM,kBAAkB,UAAa,MAAM,cAAc,SAAY,CAAC,IAAI,EAAE,eAAe,MAAM,iBAAiB,mBAAmB,MAAM,SAAS,GAAG,KAAK;AAAA,IAChK,UAAU,kBAAkB,MAAM,QAAQ;AAAA,IAC1C,SAAS,iBAAiB,MAAM,OAAO;AAAA,IACvC,SAAS,MAAM;AAAA,IACf,WAAW,MAAM;AAAA,IACjB,WAAW,IAAI,KAAK,MAAM,SAAS,EAAE,YAAY;AAAA,IACjD,QAAQ,EAAE,KAAK,MAAM,WAAW,WAAW,iBAAiB,SAAS,EAAE;AAAA,EACzE;AACA,SAAO,EAAE,GAAG,UAAU,WAAW,iBAAiB,uBAAQ,KAAK,qBAAqB,QAAQ,GAAG,MAAM,gBAAgB,CAAC,EAAE;AAC1H;AAEO,SAAS,oBAAoB,UAA2B,UAAsC,CAAC,GAAoB;AACxH,MAAI;AACF,eAAW,UAAoB,CAAC,UAAU,WAAW,UAAU,WAAW,aAAa,iBAAiB,YAAY,WAAW,WAAW,aAAa,aAAa,UAAU,WAAW,GAAG,gBAAgB;AAC5M,eAAW,SAAS,UAAoB,CAAC,QAAQ,MAAM,GAAG,gBAAgB;AAC1E,eAAW,SAAS,SAAmB,CAAC,YAAY,QAAQ,UAAU,SAAS,GAAG,eAAe;AACjG,eAAW,SAAS,QAAkB,CAAC,OAAO,WAAW,GAAG,cAAc;AAC1E,QAAI,SAAS,cAAc,OAAW,YAAW,SAAS,WAAqB,SAAS,UAAU,SAAS,WAAW,CAAC,MAAM,IAAI,CAAC,QAAQ,OAAO,GAAG,iBAAiB;AACrK,QAAI,SAAS,WAAW,mBAAmB,SAAS,YAAY,KAAK,OAAO,SAAS,cAAc,SAAU,OAAM,IAAI,MAAM,sBAAsB;AACnJ,QAAI,gBAAgB,SAAS,MAAM,MAAM,SAAS,OAAQ,OAAM,IAAI,MAAM,yBAAyB;AACnG,QAAI,QAAQ,mBAAmB,UAAa,gBAAgB,QAAQ,cAAc,MAAM,SAAS,OAAQ,OAAM,IAAI,mBAAmB,mBAAmB,gCAAgC;AACzL,UAAM,SAAS,KAAK,MAAM,SAAS,SAAS;AAC5C,QAAI,CAAC,OAAO,SAAS,MAAM,KAAK,WAAW,QAAQ,OAAO,oBAAI,KAAK,GAAG,QAAQ,EAAG,OAAM,IAAI,mBAAmB,WAAW,4BAA4B;AACrJ,QAAI,IAAI,KAAK,MAAM,EAAE,YAAY,MAAM,SAAS,UAAW,OAAM,IAAI,mBAAmB,oBAAoB,yBAAyB;AACrI,UAAM,WAAW,kBAAkB,SAAS,QAAQ;AACpD,QAAI,SAAS,SAAS,SAAS,SAAS,QAAQ,SAAS,SAAS,SAAS,SAAS,KAAM,OAAM,IAAI,mBAAmB,oBAAoB,2BAA2B;AACtK,UAAM,UAAU,iBAAiB,SAAS,OAAO;AACjD,QAAI,QAAQ,KAAK,IAAI,MAAM,SAAS,QAAQ,KAAK,IAAI,EAAG,OAAM,IAAI,mBAAmB,oBAAoB,2BAA2B;AACpI,UAAM,YAAY,mBAAmB,SAAS,SAAS;AACvD,QAAI,cAAc,UAAa,KAAK,UAAU,SAAS,MAAM,KAAK,UAAU,SAAS,SAAS,EAAG,OAAM,IAAI,mBAAmB,oBAAoB,4BAA4B;AAC9K,QAAI,WAAW,SAAS,gBAAgB,WAAW,SAAS,cAAe,OAAM,IAAI,mBAAmB,oBAAoB,mDAAmD;AAC/K,QAAI,SAAS,kBAAkB,UAAa,CAAC,CAAC,cAAc,eAAe,gBAAgB,QAAQ,EAAE,SAAS,SAAS,aAAa,EAAG,OAAM,IAAI,mBAAmB,oBAAoB,2BAA2B;AACnN,QAAI,SAAS,kBAAkB,YAAY,WAAW,SAAS,UAAa,UAAU,SAAS,SAAU,OAAM,IAAI,mBAAmB,oBAAoB,yCAAyC;AACnM,SAAK,SAAS,kBAAkB,gBAAgB,SAAS,kBAAkB,iBAAiB,SAAS,kBAAkB,mBAAmB,CAAC,SAAS,UAAW,OAAM,IAAI,mBAAmB,oBAAoB,qCAAqC;AACrP,QAAI,OAAO,SAAS,YAAY,YAAY,SAAS,QAAQ,WAAW,KAAK,OAAO,SAAS,QAAQ,aAAa,YAAY,SAAS,QAAQ,SAAS,WAAW,KAAK,OAAO,SAAS,QAAQ,WAAW,YAAY,CAAC,mBAAmB,KAAK,SAAS,QAAQ,MAAM,EAAG,OAAM,IAAI,mBAAmB,oBAAoB,6BAA6B;AACxV,UAAM,kBAAkB,SAAS,YAC7B,QAAQ,yBAAyB,iCACjC,QAAQ,mBAAmB;AAC/B,QAAI,CAAC,OAAO,UAAU,SAAS,QAAQ,IAAI,KAAK,SAAS,QAAQ,OAAO,KAAK,SAAS,QAAQ,OAAO,gBAAiB,OAAM,IAAI,mBAAmB,qBAAqB,4CAA4C;AACpN,UAAM,YAAY,iBAAiB,SAAS,OAAO,SAAS;AAC5D,UAAM,YAAY,iBAAiB,SAAS,SAAS;AACrD,UAAM,WAAW,EAAE,GAAG,SAAS;AAC/B,WAAQ,SAAoC;AAC5C,QAAI,UAAU,WAAW,MAAM,UAAU,WAAW,MAAM,CAAC,uBAAQ,OAAO,WAAW,qBAAqB,QAAQ,GAAG,SAAS,EAAG,OAAM,IAAI,mBAAmB,qBAAqB,qCAAqC;AACxN,QAAI,QAAQ,sBAAsB,UAAa,SAAS,kBAAkB,UAAa,CAAC,QAAQ,kBAAkB,SAAS,SAAS,OAAO,GAAG,EAAG,OAAM,IAAI,mBAAmB,qBAAqB,6BAA6B;AAChO,WAAO;AAAA,EACT,SAAS,OAAO;AACd,QAAI,iBAAiB,mBAAoB,OAAM;AAC/C,UAAM,IAAI,mBAAmB,oBAAoB,iBAAiB,QAAQ,MAAM,UAAU,kBAAkB;AAAA,EAC9G;AACF;AAEO,SAAS,oBAAoB,UAAuC;AACzE,QAAM,aAAa,mBAAmB,IAAI,YAAY,EAAE,OAAO,cAAc,QAAQ,CAAC,GAAG,EAAE,QAAQ,MAAM,CAAC;AAC1G,SAAO,IAAI,YAAY,EAAE,OAAO,cAAc,UAAU,CAAC;AAC3D;AAEO,SAAS,mBAAmBA,QAAmB,UAAsE,CAAC,GAAoB;AAC/I,MAAIA,OAAM,cAAc,QAAQ,oBAAoB,4BAA6B,OAAM,IAAI,mBAAmB,qBAAqB,6CAA6C;AAChL,QAAM,SAAS,mBAAmB,IAAI,YAAY,EAAE,OAAOA,MAAK,CAAC;AACjE,MAAI,WAAW,QAAQ,OAAO,WAAW,YAAY,MAAM,QAAQ,MAAM,EAAG,OAAM,IAAI,mBAAmB,oBAAoB,kCAAkC;AAC/J,QAAM,WAAW;AACjB,MAAI,CAAC,SAAS,YAAY,OAAO,SAAS,YAAY,YAAY,CAAC,mBAAmB,KAAK,SAAS,OAAO,EAAG,OAAM,IAAI,mBAAmB,oBAAoB,iCAAiC;AAChM,aAAW,UAAoB,CAAC,YAAY,SAAS,GAAG,gBAAgB;AACxE,MAAI,QAAQ,WAAW,MAAO,qBAAoB,SAAS,UAAU,OAAO;AAC5E,QAAM,aAAa,iBAAiB,SAAS,OAAO;AACpD,MAAI,WAAW,eAAe,SAAS,SAAS,QAAQ,QAAQ,cAAc,UAAU,MAAM,SAAS,SAAS,QAAQ,OAAQ,OAAM,IAAI,mBAAmB,oBAAoB,8CAA8C;AAC/N,MAAI,SAAS,SAAS,aAAa,WAAW,aAAa,GAAI,OAAM,IAAI,mBAAmB,oBAAoB,sCAAsC;AACtJ,MAAI,CAAC,SAAS,SAAS,aAAa,SAAS,SAAS,cAAc,QAAW;AAC7E,UAAM,IAAI,mBAAmB,oBAAoB,2DAA2D;AAAA,EAC9G;AACA,SAAO;AACT;AAEO,SAAS,eAAe,OAA6F;AAC1H,QAAM,SAAS,gBAAgB,MAAM,MAAM;AAC3C,MAAI;AACF,QAAI,IAAI,MAAM,MAAM,GAAG,EAAE,SAAS,MAAM,MAAM,IAAK,OAAM,IAAI,MAAM,mBAAmB;AAAA,EACxF,QAAQ;AACN,UAAM,IAAI,mBAAmB,gBAAgB,sBAAsB;AAAA,EACrE;AACA,MAAI,MAAM,QAAQ,UAAa,MAAM,IAAI,WAAW,GAAI,OAAM,IAAI,mBAAmB,gBAAgB,+BAA+B;AACpI,SAAO,GAAG,MAAM,MAAM,MAAM,GAAG,GAAG,MAAM,QAAQ,SAAY,KAAK,MAAM,iBAAiB,MAAM,GAAG,CAAC,EAAE;AACtG;AAEO,SAAS,qBAAqB,OAA6I;AAChL,QAAMA,SAAQ,oBAAoB,MAAM,QAAQ;AAChD,QAAM,UAAU,iBAAiBA,MAAK;AACtC,MAAIA,OAAM,cAAc,MAAM,kBAAkB,0BAA2B,OAAM,IAAI,mBAAmB,qBAAqB,2CAA2C;AACxK,MAAI,MAAM,SAAS,SAAS,cAAc,MAAM,QAAQ,UAAa,MAAM,IAAI,WAAW,IAAK,OAAM,IAAI,mBAAmB,uBAAuB,wDAAwD;AAC3M,MAAI,CAAC,MAAM,SAAS,SAAS,aAAa,MAAM,QAAQ,OAAW,OAAM,IAAI,mBAAmB,oBAAoB,8CAA8C;AAClK,SAAO,GAAG,gBAAgB,MAAM,MAAM,CAAC,QAAQ,OAAO,GAAG,MAAM,QAAQ,SAAY,KAAK,MAAM,iBAAiB,MAAM,GAAG,CAAC,EAAE;AAC7H;AAmBA,IAAM,gBAAgB,IAAI,YAAY,EAAE,OAAO,6BAA6B;AAE5E,SAAS,aAAaA,QAA2B;AAC/C,SAAO,IAAI,OAAO,GAAO,MAAM,OAAa,OAAU,UAAM,sBAAOA,MAAK,CAAC,CAAC,EAAE,SAAS;AACvF;AAEA,SAAS,eAAe,OAAwB;AAC9C,MAAI;AACF,UAAM,SAAS,IAAI,MAAM,KAAK;AAC9B,WAAO,OAAO,YAAY,KAAK,OAAO,SAAa,QAAQ,OAAO,UAAU,SAAS,OAAU,QAAQ,OAAO,SAAS,MAAM;AAAA,EAC/H,QAAQ;AACN,WAAO;AAAA,EACT;AACF;AAEA,SAAS,mBAAmB,KAAyB;AACnD,QAAM,QAAQ,IAAI,MAAM,WAAW,MAAM;AACzC,QAAM,UAAU,UAAU,OAAO,KAAK;AACtC,MAAI,QAAQ,WAAW,MAAM,QAAQ,CAAC,MAAM,OAAQ,QAAQ,CAAC,MAAM,EAAM,OAAM,IAAI,mBAAmB,oBAAoB,iCAAiC;AAC3J,SAAO,QAAQ,MAAM,CAAC;AACxB;AAEA,SAAS,8BAA8B,UAAgD;AACrF,QAAM,EAAE,WAAW,YAAY,GAAG,SAAS,IAAI;AAC/C,QAAM,SAAS,IAAI,YAAY,EAAE,OAAO,mCAAmC;AAC3E,QAAM,OAAO,IAAI,YAAY,EAAE,OAAO,cAAc,QAAQ,CAAC;AAC7D,QAAM,SAAS,IAAI,WAAW,OAAO,SAAS,KAAK,MAAM;AACzD,SAAO,IAAI,MAAM;AACjB,SAAO,IAAI,MAAM,OAAO,MAAM;AAC9B,SAAO;AACT;AAQA,SAAS,kBAAkB,UAAoC,WAAuB,QAAmD;AACvI,QAAM,UAAU,iBAAiB,SAAS;AAC1C,QAAM,YAAY,mBAAmB,SAAS,UAAU,SAAS;AACjE,SAAO;AAAA,IACL,UAAU;AAAA,MACR,QAAQ;AAAA,MACR,SAAS;AAAA,MACT,QAAQ,SAAS,OAAO;AAAA,MACxB,SAAS,SAAS,OAAO;AAAA,MACzB,GAAI,WAAW,SAAY,EAAE,eAAe,SAAS,oBAAoB,SAAS,cAAc,WAAoB,SAAS,oBAAoB,SAAS,iBAAiB,WAAoB,OAAU,IAAI,EAAE,eAAe,OAAO,cAAc;AAAA,MACnP,UAAU,QAAQ,YAAY,SAAS,OAAO;AAAA,MAC9C,SAAS,CAAC,GAAI,QAAQ,WAAW,CAAC,MAAM,CAAE;AAAA,MAC1C,SAAS;AAAA,QACP,UAAU;AAAA,QACV,MAAM,UAAU;AAAA,QAChB,QAAQ,qBAAiB,sBAAO,SAAS,CAAC;AAAA,MAC5C;AAAA;AAAA;AAAA;AAAA;AAAA,MAKA,WAAW,SAAS,oBAAoB,SAAS;AAAA,MACjD,WAAW,SAAS;AAAA,MACpB,QAAQ,EAAE,KAAK,SAAS,UAAU,WAAW,WAAW,iBAAiB,SAAS,EAAE;AAAA,MACpF,WAAW,SAAS,UAAU;AAAA,MAC9B,yBAAyB,SAAS,oBAAoB;AAAA,IACxD;AAAA,IACA;AAAA,EACF;AACF;AAEO,SAAS,wBAAwBE,MAAaF,QAA4B;AAC/E,MAAI;AACF,UAAM,SAAS,IAAI,MAAME,IAAG;AAC5B,WAAO,OAAO,YAAY,KAAK,OAAO,SAAa,QAAQ,OAAO,UAAU,SAAS,OAAU,QAAQ,OAAO,SAAS,MAAMA,QAAO,aAAaF,MAAK,MAAME;AAAA,EAC9J,QAAQ;AACN,WAAO;AAAA,EACT;AACF;AAEA,eAAsB,uBAAuB,MAAkB,KAAsC;AACnG,MAAI,IAAI,WAAW,MAAM,KAAK,SAAS,MAAM,KAAK,CAAC,MAAM,EAAG,OAAM,IAAI,mBAAmB,gBAAgB,kCAAkC;AAC3I,MAAI;AACF,UAAM,YAAY,MAAM,OAAO,OAAO,UAAU,OAAO,KAA+B,WAAW,OAAO,CAAC,SAAS,CAAC;AACnH,WAAO,IAAI,WAAW,MAAM,OAAO,OAAO,QAAQ,EAAE,MAAM,WAAW,IAAI,KAAK,MAAM,GAAG,EAAE,GAA6B,gBAAgB,cAAwC,GAAG,WAAW,KAAK,MAAM,EAAE,CAA2B,CAAC;AAAA,EACvO,SAAS,OAAO;AACd,UAAM,IAAI,mBAAmB,qBAAqB,iBAAiB,QAAQ,MAAM,UAAU,sCAAsC;AAAA,EACnI;AACF;AAEA,SAAS,oBAAoB,aAAqB,QAA4C,gBAAiD;AAC7I,QAAM,MAAM,iBAAiB,WAAW;AACxC,QAAM,QAAQ,mBAAmB,IAAI,YAAY,SAAS,EAAE,OAAO,KAAK,CAAC,EAAE,OAAO,GAAG,CAAC;AACtF,MAAI,CAAC,SAAS,OAAO,UAAU,YAAY,MAAM,QAAQ,KAAK,EAAG,OAAM,IAAI,mBAAmB,oBAAoB,kCAAkC;AACpJ,QAAM,SAAS;AACf,QAAM,UAAU,OAAO;AACvB,MAAI,OAAO,SAAS,0BAA2B,YAAY,KAAK,YAAY,EAAI,OAAM,IAAI,mBAAmB,oBAAoB,2CAA2C;AAC5K,MAAI,YAAY,KAAK,OAAO,WAAW,QAAW;AAChD,eAAW,QAAQ,CAAC,QAAQ,WAAW,aAAa,oBAAoB,UAAU,cAAc,aAAa,WAAW,YAAY,kBAAkB,WAAW,GAAG,qCAAqC;AACzM,QAAI,OAAO,OAAO,cAAc,YAAY,OAAO,OAAO,cAAc,YAAY,OAAO,cAAc,eAAgB,OAAM,IAAI,mBAAmB,oBAAoB,4CAA4C;AACtN,UAAM,eAAe,OAAO;AAC5B,QAAI,CAAC,cAAc,YAAY,KAAM,aAAa,SAAS,gBAAgB,aAAa,SAAS,iBAAiB,aAAa,SAAS,kBAAmB,OAAO,aAAa,UAAU,SAAU,OAAM,IAAI,mBAAmB,oBAAoB,2BAA2B;AAC/Q,UAAMC,WAAU,mBAAmB,YAAoC;AACvE,QAAIA,aAAY,UAAaA,SAAQ,SAAS,SAAU,OAAM,IAAI,mBAAmB,oBAAoB,2BAA2B;AACpI,QAAI,CAAC,cAAc,OAAO,MAAM,EAAG,OAAM,IAAI,mBAAmB,oBAAoB,0BAA0B;AAC9G,eAAW,OAAO,QAAQ,CAAC,UAAU,gBAAgB,SAAS,GAAG,yBAAyB;AAC1F,QAAI,OAAO,OAAO,WAAW,OAAO,UAAU,OAAO,OAAO,YAAY,OAAO,WAAW,OAAO,OAAO,iBAAiB,OAAO,aAAc,OAAM,IAAI,mBAAmB,oBAAoB,4CAA4C;AAC3O,QAAI,EAAE,OAAO,OAAO,eAAe,YAAY,cAAc,OAAO,UAAU,MAAM,EAAE,OAAO,OAAO,cAAc,YAAY,cAAc,OAAO,SAAS,GAAI,OAAM,IAAI,mBAAmB,oBAAoB,sCAAsC;AACvP,QAAI,CAAC,MAAM,QAAQ,OAAO,OAAO,EAAG,OAAM,IAAI,mBAAmB,oBAAoB,4BAA4B;AACjH,UAAMC,WAAU,iBAAiB,OAAO,OAAwB;AAChE,QAAI,CAAC,cAAc,OAAO,QAAQ,KAAM,OAAO,SAAS,SAAS,WAAW,OAAO,SAAS,SAAS,YAAa,OAAO,OAAO,SAAS,UAAU,SAAU,OAAM,IAAI,mBAAmB,oBAAoB,4BAA4B;AAC1O,UAAMC,YAAW,kBAAkB,EAAE,MAAM,OAAO,SAAS,MAAM,MAAM,OAAO,SAAS,MAAM,CAAC;AAC9F,QAAI,CAAC,iBAAiBA,WAAU,OAAO,QAAQ,EAAG,OAAM,IAAI,mBAAmB,oBAAoB,8CAA8C;AACjJ,QAAI,CAAC,cAAc,OAAO,gBAAgB,CAAC,EAAG,OAAM,IAAI,mBAAmB,oBAAoB,kCAAkC;AACjI,UAAMC,UAAS,OAAO,gBAAgB;AACtC,eAAWA,SAAQ,CAAC,QAAQ,SAAS,QAAQ,UAAU,YAAY,aAAa,aAAa,mBAAmB,QAAQ,GAAG,oCAAoC;AAC/J,QAAIA,QAAO,SAAS,QAAQA,QAAO,SAAS,MAAO,OAAM,IAAI,mBAAmB,oBAAoB,uCAAuC;AAC3I,QAAI,OAAOA,QAAO,UAAU,YAAY,OAAOA,QAAO,SAAS,YAAY,OAAOA,QAAO,WAAW,SAAU,OAAM,IAAI,mBAAmB,oBAAoB,kCAAkC;AACjM,QAAIA,QAAO,SAAS,UAAU,OAAOA,QAAO,aAAa,YAAY,OAAOA,QAAO,cAAc,YAAY,CAAC,cAAcA,QAAO,SAAS,KAAK,OAAOA,QAAO,oBAAoB,UAAW,OAAM,IAAI,mBAAmB,oBAAoB,sCAAsC;AACrR,WAAO,EAAE,eAAeH,SAAQ,MAAM,SAAAC,UAAS,UAAAC,UAAS;AAAA,EAC1D;AACA,QAAM,UAAU,YAAY,IACxB,CAAC,QAAQ,WAAW,aAAa,kBAAkB,aAAa,UAAU,YAAY,iBAAiB,qBAAqB,IAC5H,CAAC,QAAQ,WAAW,aAAa,oBAAoB,aAAa,WAAW,YAAY,kBAAkB,qBAAqB;AACpI,aAAW,QAAQ,SAAS,2BAA2B;AACvD,MAAI,OAAO,OAAO,cAAc,YAAY,OAAO,OAAO,cAAc,YAAY,OAAO,cAAc,eAAgB,OAAM,IAAI,mBAAmB,oBAAoB,4CAA4C;AACtN,QAAM,UAAU,OAAO;AACvB,MAAI;AACJ,MAAI,YAAY,GAAG;AACjB,QAAI,OAAO,OAAO,mBAAmB,SAAU,OAAM,IAAI,mBAAmB,oBAAoB,6BAA6B;AAC7H,uBAAmB,EAAE,MAAM,cAAc,OAAO,OAAO,eAAe,CAAC;AACvE,oBAAgB;AAAA,EAClB,OAAO;AACL,QAAI,CAAC,WAAW,OAAO,YAAY,YAAY,MAAM,QAAQ,OAAO,EAAG,OAAM,IAAI,mBAAmB,oBAAoB,2BAA2B;AACnJ,UAAM,gBAAgB;AACtB,QAAI,cAAc,SAAS,gBAAgB,cAAc,SAAS,iBAAiB,OAAO,cAAc,UAAU,SAAU,OAAM,IAAI,mBAAmB,oBAAoB,2BAA2B;AACxM,uBAAmB,aAAqC;AACxD,QAAI,OAAO,kBAAkB,OAAW,oBAAmB,EAAE,MAAM,cAAc,OAAO,OAAO,cAAwB,CAAC;AACxH,oBAAgB,cAAc;AAAA,EAChC;AACA,QAAM,cAAc,OAAO,WAAW,OAAO;AAC7C,QAAM,cAAc,MAAM,QAAQ,WAAW,IAAI,cAAc,CAAC,WAAW;AAC3E,QAAM,UAAU,iBAAiB,YAAY,IAAI,CAAC,WAAW,WAAW,sBAAsB,WAAW,SAAS,WAAW,SAAS,SAAS,WAAW,uBAAuB,WAAW,SAAS,SAAS,WAAW,sBAAsB,WAAW,uBAAuB,WAAW,SAAS,WAAW,SAAS,SAAS,MAAM,CAAkB;AAC1V,QAAME,iBAAgB,OAAO;AAC7B,MAAI;AACJ,MAAIA,kBAAiB,OAAOA,mBAAkB,YAAY,CAAC,MAAM,QAAQA,cAAa,GAAG;AACvF,UAAM,YAAYA;AAIlB,UAAM,OAAO,OAAO,UAAU,SAAS,WAAW,UAAU,OAAO,UAAU;AAC7E,QAAI,OAAO,SAAS,YAAa,UAAU,SAAS,WAAW,UAAU,SAAS,SAAW,OAAM,IAAI,mBAAmB,oBAAoB,4BAA4B;AAC1K,eAAW,kBAAkB,EAAE,MAAM,UAAU,MAAM,KAAK,CAAC;AAAA,EAC7D,OAAO;AACL,eAAW,kBAAkB,EAAE,MAAM,SAAS,MAAM,OAAOA,mBAAkB,WAAWA,iBAAgB,OAAO,SAAS,KAAK,CAAC;AAAA,EAChI;AAIA,MAAI,CAAC,iBAAiB,UAAU,OAAO,QAAQ,EAAG,OAAM,IAAI,mBAAmB,oBAAoB,8CAA8C;AACjJ,QAAM,qBAAqB,YAAY,IAAI,OAAO,gBAAgB,IAAI,OAAO;AAC7E,MAAI,CAAC,sBAAsB,OAAO,uBAAuB,YAAY,MAAM,QAAQ,kBAAkB,EAAG,OAAM,IAAI,mBAAmB,oBAAoB,kCAAkC;AAC3L,QAAM,SAAS;AACf,MAAI,OAAO,SAAS,MAAM;AACxB,eAAW,QAAQ,CAAC,QAAQ,SAAS,QAAQ,QAAQ,GAAG,6BAA6B;AACrF,QAAI,OAAO,OAAO,UAAU,YAAY,OAAO,OAAO,SAAS,YAAY,CAAC,CAAC,oBAAoB,qBAAqB,kBAAkB,EAAE,SAAS,OAAO,MAAgB,EAAG,OAAM,IAAI,mBAAmB,oBAAoB,wCAAwC;AAAA,EACxQ,WAAW,OAAO,SAAS,OAAO;AAChC,eAAW,QAAQ,CAAC,QAAQ,SAAS,YAAY,QAAQ,aAAa,aAAa,mBAAmB,QAAQ,GAAG,8BAA8B;AAC/I,QAAI,OAAO,OAAO,UAAU,YAAY,OAAO,OAAO,aAAa,YAAY,OAAO,OAAO,SAAS,YAAY,OAAO,OAAO,cAAc,YAAY,CAAC,OAAO,aAAa,OAAO,OAAO,cAAc,YAAY,MAAM,QAAQ,OAAO,SAAS,KAAK,OAAO,OAAO,oBAAoB,YAAY,OAAO,WAAW,qBAAsB,OAAM,IAAI,mBAAmB,oBAAoB,yCAAyC;AAC1a,eAAW,YAAY,OAAO,OAAO,OAAO,SAAoC,EAAG,KAAI,CAAC,OAAO,cAAc,QAAQ,EAAG,OAAM,IAAI,mBAAmB,oBAAoB,qCAAqC;AAC9M,QAAI,qBAAiB,sBAAO,IAAI,YAAY,EAAE,OAAO,cAAc,OAAO,SAAS,CAAC,CAAC,CAAC,MAAM,OAAO,gBAAiB,OAAM,IAAI,mBAAmB,oBAAoB,0CAA0C;AAAA,EACjN,MACK,OAAM,IAAI,mBAAmB,oBAAoB,uCAAuC;AAC7F,MAAI,OAAO,OAAO,wBAAwB,YAAY,qBAAiB,sBAAO,IAAI,YAAY,EAAE,OAAO,cAAc,MAAM,CAAC,CAAC,CAAC,MAAM,OAAO,oBAAqB,OAAM,IAAI,mBAAmB,oBAAoB,yCAAyC;AAC1P,SAAO,EAAE,eAAe,SAAS,SAAS;AAC5C;AAOA,SAAS,0BAA0B,OAAgC,SAA0O;AAC3S,aAAW,OAAO,CAAC,WAAW,WAAW,UAAU,cAAc,aAAa,oBAAoB,WAAW,YAAY,kBAAkB,UAAU,WAAW,GAAG,uBAAuB;AAC1L,MAAI,MAAM,YAAY,KAAK,OAAO,MAAM,YAAY,YAAY,MAAM,QAAQ,WAAW,KAAK,OAAO,MAAM,WAAW,SAAU,OAAM,IAAI,mBAAmB,oBAAoB,wCAAwC;AACzN,QAAM,SAAS,MAAM;AACrB,QAAM,aAAa,MAAM;AACzB,QAAM,YAAY,MAAM;AACxB,QAAMA,iBAAgB,MAAM;AAC5B,MAAI,CAAC,cAAc,MAAM,KAAK,CAAC,cAAc,UAAU,KAAK,CAAC,cAAc,SAAS,KAAK,CAAC,cAAcA,cAAa,EAAG,OAAM,IAAI,mBAAmB,oBAAoB,iCAAiC;AAC1M,aAAW,QAAQ,CAAC,UAAU,gBAAgB,SAAS,GAAG,qBAAqB;AAC/E,aAAW,YAAY,CAAC,OAAO,aAAa,YAAY,aAAa,SAAS,GAAG,yBAAyB;AAC1G,aAAW,WAAW,CAAC,QAAQ,OAAO,aAAa,OAAO,WAAW,GAAG,wBAAwB;AAChG,aAAWA,gBAAe,CAAC,QAAQ,OAAO,GAAG,uBAAuB;AACpE,QAAM,SAAS,OAAO;AACtB,QAAM,UAAU,OAAO;AACvB,QAAM,eAAe,OAAO;AAC5B,MAAI,OAAO,WAAW,YAAY,gBAAgB,MAAM,MAAM,UAAU,OAAO,YAAY,YAAY,QAAQ,WAAW,KAAK,OAAO,iBAAiB,YAAY,aAAa,WAAW,EAAG,OAAM,IAAI,mBAAmB,oBAAoB,gCAAgC;AAC/Q,MAAI,QAAQ,mBAAmB,UAAa,gBAAgB,QAAQ,cAAc,MAAM,OAAQ,OAAM,IAAI,mBAAmB,mBAAmB,0CAA0C;AAC1L,QAAM,SAAS,KAAK,MAAM,MAAM,MAAM;AACtC,MAAI,CAAC,OAAO,SAAS,MAAM,KAAK,WAAW,QAAQ,OAAO,oBAAI,KAAK,GAAG,QAAQ,KAAK,IAAI,KAAK,MAAM,EAAE,YAAY,MAAM,MAAM,OAAQ,OAAM,IAAI,mBAAmB,WAAW,sCAAsC;AAClN,MAAI,OAAO,WAAW,QAAQ,YAAY,OAAO,WAAW,cAAc,YAAY,OAAO,WAAW,aAAa,YAAY,OAAO,WAAW,cAAc,YAAY,KAAK,MAAM,WAAW,SAAS,IAAI,OAAQ,OAAM,IAAI,mBAAmB,oBAAoB,oCAAoC;AAC7S,QAAM,UAAU,MAAM;AACtB,MAAI,CAAC,cAAc,OAAO,KAAM,QAAQ,SAAS,gBAAgB,QAAQ,SAAS,iBAAiB,QAAQ,SAAS,kBAAmB,OAAO,QAAQ,UAAU,SAAU,OAAM,IAAI,mBAAmB,oBAAoB,2CAA2C;AACtQ,QAAM,oBAAoB,mBAAmB,OAA+B;AAC5E,MAAI,sBAAsB,UAAa,kBAAkB,SAAS,SAAU,OAAM,IAAI,mBAAmB,oBAAoB,2CAA2C;AACxK,MAAI,CAAC,MAAM,QAAQ,MAAM,OAAO,EAAG,OAAM,IAAI,mBAAmB,oBAAoB,kCAAkC;AACtH,QAAM,UAAU,iBAAiB,MAAM,OAAwB;AAC/D,MAAI,CAAC,cAAc,MAAM,gBAAgB,CAAC,EAAG,OAAM,IAAI,mBAAmB,oBAAoB,wCAAwC;AACtI,QAAM,gBAAgB,MAAM,gBAAgB;AAC5C,aAAW,eAAe,CAAC,QAAQ,OAAO,OAAO,UAAU,YAAY,MAAM,GAAG,6BAA6B;AAC7G,MAAI,OAAO,cAAc,SAAS,YAAY,OAAO,cAAc,QAAQ,YAAY,CAAC,eAAe,cAAc,GAAG,EAAG,OAAM,IAAI,mBAAmB,oBAAoB,wCAAwC;AACpN,QAAM,WAAW,kBAAkB,EAAE,MAAMA,eAAc,MAA+B,MAAMA,eAAc,MAAgB,CAAC;AAC7H,MAAIA,eAAc,SAAS,SAAS,QAAQA,eAAc,UAAU,SAAS,KAAM,OAAM,IAAI,mBAAmB,oBAAoB,wCAAwC;AAC5K,QAAM,YAAY,MAAM;AACxB,MAAI,CAAC,cAAc,SAAS,EAAG,OAAM,IAAI,mBAAmB,oBAAoB,mCAAmC;AACnH,aAAW,WAAW,CAAC,aAAa,aAAa,OAAO,GAAG,wBAAwB;AACnF,MAAI,OAAO,UAAU,cAAc,YAAY,UAAU,cAAc,aAAa,OAAO,UAAU,UAAU,SAAU,OAAM,IAAI,mBAAmB,oBAAoB,mCAAmC;AAC7M,QAAM,YAAY,mBAAmB,UAAU,SAAS;AACxD,MAAI,QAAQ,sBAAsB,UAAa,CAAC,QAAQ,kBAAkB,SAAS,UAAU,SAAS,EAAG,OAAM,IAAI,mBAAmB,qBAAqB,sDAAsD;AACjN,QAAM,iBAAiB,iBAAiB,UAAU,KAAK;AACvD,QAAM,EAAE,WAAW,YAAY,GAAG,SAAS,IAAI;AAC/C,QAAM,SAAS,IAAI,YAAY,EAAE,OAAO,mCAAmC;AAC3E,QAAM,OAAO,IAAI,YAAY,EAAE,OAAO,cAAc,QAAQ,CAAC;AAC7D,QAAM,eAAe,IAAI,WAAW,OAAO,SAAS,KAAK,MAAM;AAC/D,eAAa,IAAI,MAAM;AAAG,eAAa,IAAI,MAAM,OAAO,MAAM;AAC9D,MAAI,eAAe,WAAW,MAAM,CAAC,uBAAQ,OAAO,gBAAgB,cAAc,SAAS,EAAG,OAAM,IAAI,mBAAmB,qBAAqB,4CAA4C;AAC5L,QAAM,UAAU,QAAQ,aAAa,IAAI,WAAW;AACpD,QAAM,aAA8B;AAAA,IAClC,QAAQ;AAAA,IACR,SAAS;AAAA,IACT;AAAA,IACA;AAAA,IACA,eAAe,kBAAkB;AAAA,IACjC;AAAA,IACA;AAAA,IACA,SAAS,EAAE,UAAU,OAAO,cAAc,aAAa,WAAW,cAAc,WAAW,4BAA4B,MAAM,QAAQ,YAAY,QAAQ,qBAAiB,sBAAO,OAAO,CAAC,EAAE;AAAA,IAC3L,WAAW;AAAA,IACX,WAAW,MAAM;AAAA,IACjB,QAAQ,EAAE,KAAK,UAAU,WAAW,WAAW,iBAAiB,SAAS,EAAE;AAAA,IAC3E,WAAW,UAAU;AAAA,IACrB,yBAAyB;AAAA,EAC3B;AACA,SAAO,EAAE,UAAU,OAA8C,UAAU,EAAE,UAAU,YAAY,SAAS,iBAAiB,OAAO,EAAE,EAAE;AAC1I;AAEA,SAAS,cAAc,OAAkD;AACvE,SAAO,UAAU,QAAQ,OAAO,UAAU,YAAY,CAAC,MAAM,QAAQ,KAAK;AAC5E;AAEA,SAAS,6BAA6B,OAA0C;AAC9E,MAAI,CAAC,SAAS,OAAO,UAAU,YAAY,MAAM,QAAQ,KAAK,EAAG,OAAM,IAAI,mBAAmB,oBAAoB,qCAAqC;AACvJ,QAAM,WAAW;AACjB,aAAW,UAAU,CAAC,WAAW,WAAW,cAAc,uBAAuB,UAAU,WAAW,UAAU,WAAW,WAAW,GAAG,oBAAoB;AAC7J,MAAI,SAAS,YAAY,KAAK,OAAO,SAAS,YAAY,YAAY,SAAS,QAAQ,WAAW,KAAK,OAAO,SAAS,eAAe,YAAY,SAAS,WAAW,WAAW,KAAK,OAAO,SAAS,WAAW,SAAU,OAAM,IAAI,mBAAmB,oBAAoB,qCAAqC;AACjT,QAAM,SAAS,SAAS;AACxB,MAAI,CAAC,UAAU,OAAO,WAAW,YAAY,MAAM,QAAQ,MAAM,EAAG,OAAM,IAAI,mBAAmB,oBAAoB,6BAA6B;AAClJ,aAAW,QAAQ,CAAC,UAAU,gBAAgB,WAAW,UAAU,GAAG,kBAAkB;AACxF,QAAM,cAAc;AACpB,MAAI,OAAO,YAAY,WAAW,YAAY,CAAC,cAAc,KAAK,YAAY,MAAM,KAAK,gBAAgB,YAAY,MAAM,MAAM,YAAY,UAAU,OAAO,YAAY,iBAAiB,YAAY,YAAY,aAAa,WAAW,KAAK,OAAO,YAAY,YAAY,YAAY,YAAY,QAAQ,WAAW,KAAK,2BAA2B,KAAK,YAAY,OAAO,EAAG,OAAM,IAAI,mBAAmB,oBAAoB,qCAAqC;AAC3c,QAAM,WAAW,kBAAkB,YAAY,QAAyB;AACxE,MAAI,KAAK,UAAU,QAAQ,MAAM,KAAK,UAAU,YAAY,QAAQ,EAAG,OAAM,IAAI,mBAAmB,oBAAoB,qCAAqC;AAC7J,QAAM,UAAU,SAAS;AACzB,MAAI,CAAC,WAAW,OAAO,YAAY,YAAY,MAAM,QAAQ,OAAO,EAAG,OAAM,IAAI,mBAAmB,oBAAoB,8BAA8B;AACtJ,QAAM,eAAe;AACrB,aAAW,cAAc,CAAC,cAAc,YAAY,iBAAiB,MAAM,GAAG,mBAAmB;AACjG,aAAW,OAAO,CAAC,cAAc,YAAY,eAAe,EAAY,KAAI,aAAa,GAAG,MAAM,UAAa,OAAO,aAAa,GAAG,MAAM,SAAU,OAAM,IAAI,mBAAmB,oBAAoB,oCAAoC;AAC3O,MAAI,aAAa,SAAS,UAAa,CAAC,CAAC,YAAY,UAAU,QAAQ,EAAE,SAAS,aAAa,IAAc,EAAG,OAAM,IAAI,mBAAmB,oBAAoB,mCAAmC;AACpM,QAAM,sBAAsB,SAAS;AACrC,MAAI,CAAC,uBAAuB,OAAO,wBAAwB,YAAY,MAAM,QAAQ,mBAAmB,EAAG,OAAM,IAAI,mBAAmB,oBAAoB,2CAA2C;AACvM,QAAM,sBAAsB;AAC5B,MAAI,oBAAoB,SAAS,UAAU;AACzC,eAAW,qBAAqB,CAAC,QAAQ,aAAa,aAAa,GAAG,yBAAyB;AAC/F,QAAI,OAAO,oBAAoB,cAAc,YAAY,OAAO,oBAAoB,gBAAgB,YAAY,CAAC,wBAAwB,oBAAoB,WAAW,iBAAiB,oBAAoB,WAAW,CAAC,EAAG,OAAM,IAAI,mBAAmB,oBAAoB,wCAAwC;AAAA,EACvT,WAAW,oBAAoB,SAAS,aAAa;AACnD,eAAW,qBAAqB,CAAC,QAAQ,YAAY,GAAG,yBAAyB;AACjF,UAAM,MAAM,oBAAoB;AAChC,QAAI,CAAC,OAAO,OAAO,QAAQ,YAAY,MAAM,QAAQ,GAAG,EAAG,OAAM,IAAI,mBAAmB,oBAAoB,iCAAiC;AAC7I,UAAM,WAAW;AACjB,eAAW,UAAU,CAAC,OAAO,OAAO,KAAK,KAAK,KAAK,OAAO,OAAO,WAAW,OAAO,KAAK,GAAG,uBAAuB;AAClH,QAAI,SAAS,QAAQ,SAAS,SAAS,QAAQ,QAAQ,OAAO,SAAS,QAAQ,YAAY,OAAO,SAAS,MAAM,YAAY,OAAO,SAAS,MAAM,SAAU,OAAM,IAAI,mBAAmB,oBAAoB,kCAAkC;AAChP,QAAI,SAAS,QAAQ,QAAQ,OAAO,SAAS,MAAM,SAAU,OAAM,IAAI,mBAAmB,oBAAoB,qCAAqC;AACnJ,QAAI,SAAS,QAAQ,UAAa,OAAO,SAAS,QAAQ,YAAY,SAAS,QAAQ,UAAa,OAAO,SAAS,QAAQ,YAAY,SAAS,QAAQ,UAAa,OAAO,SAAS,QAAQ,YAAY,SAAS,QAAQ,UAAa,OAAO,SAAS,QAAQ,aAAa,SAAS,YAAY,WAAc,CAAC,MAAM,QAAQ,SAAS,OAAO,KAAK,SAAS,QAAQ,KAAK,CAAC,cAAc,OAAO,cAAc,QAAQ,GAAI,OAAM,IAAI,mBAAmB,oBAAoB,2CAA2C;AACtf,eAAW,UAAU,CAAC,SAAS,GAAG,SAAS,GAAG,SAAS,CAAC,EAAG,KAAI,WAAW,OAAW,kBAAiB,MAAgB;AAAA,EACxH,WAAW,oBAAoB,SAAS,gBAAgB;AACtD,eAAW,qBAAqB,CAAC,QAAQ,KAAK,GAAG,sBAAsB;AACvE,QAAI,OAAO,oBAAoB,QAAQ,YAAY,CAAC,qBAAqB,KAAK,oBAAoB,GAAG,EAAG,OAAM,IAAI,mBAAmB,oBAAoB,oCAAoC;AAAA,EAC/L,MAAO,OAAM,IAAI,mBAAmB,oBAAoB,gDAAgD;AACxG,MAAI,SAAS,YAAY,QAAW;AAClC,QAAI,CAAC,SAAS,WAAW,OAAO,SAAS,YAAY,YAAY,MAAM,QAAQ,SAAS,OAAO,EAAG,OAAM,IAAI,mBAAmB,oBAAoB,sCAAsC;AACzL,eAAW,SAAS,SAAS,CAAC,OAAO,KAAK,GAAG,2BAA2B;AACxE,UAAM,UAAU,SAAS;AACzB,QAAI,OAAO,QAAQ,QAAQ,YAAY,OAAO,QAAQ,QAAQ,YAAY,CAAC,eAAe,QAAQ,GAAG,EAAG,OAAM,IAAI,mBAAmB,oBAAoB,sCAAsC;AAC/L,QAAI,iBAAiB,QAAQ,GAAG,EAAE,WAAW,GAAI,OAAM,IAAI,mBAAmB,oBAAoB,kCAAkC;AACpI,QAAI,oBAAoB,SAAS,YAAa,OAAM,IAAI,mBAAmB,oBAAoB,kDAAkD;AAAA,EACnJ;AACA,QAAM,YAAY,SAAS;AAC3B,MAAI,CAAC,aAAa,OAAO,cAAc,YAAY,MAAM,QAAQ,SAAS,EAAG,OAAM,IAAI,mBAAmB,oBAAoB,gCAAgC;AAC9J,aAAW,WAAW,CAAC,aAAa,aAAa,OAAO,GAAG,qBAAqB;AAChF,QAAM,iBAAiB;AACvB,MAAI,OAAO,eAAe,cAAc,YAAY,eAAe,cAAc,aAAa,OAAO,eAAe,UAAU,SAAU,OAAM,IAAI,mBAAmB,oBAAoB,gCAAgC;AACzN,QAAM,YAAY,mBAAmB,eAAe,SAAS;AAC7D,MAAI,iBAAiB,eAAe,KAAK,EAAE,WAAW,GAAI,OAAM,IAAI,mBAAmB,oBAAoB,uCAAuC;AAClJ,SAAO;AACT;AAEO,SAAS,4BAA4BP,QAAmB,UAAsJ,CAAC,GAAwF;AAC5S,MAAI;AACJ,MAAI;AAAE,aAAS,KAAK,MAAM,IAAI,YAAY,SAAS,EAAE,OAAO,KAAK,CAAC,EAAE,OAAOA,MAAK,CAAC;AAAA,EAAG,QAAQ;AAAE,UAAM,IAAI,mBAAmB,oBAAoB,gCAAgC;AAAA,EAAG;AAClL,MAAI,cAAc,MAAM,KAAK,OAAO,YAAY,KAAK,OAAO,gBAAgB,MAAM,QAAW;AAC3F,WAAO,0BAA0B,QAAQ,OAAO;AAAA,EAClD;AAKA,MAAI,UAAU,OAAO,WAAW,YAAY,CAAC,MAAM,QAAQ,MAAM,MAAO,OAAmC,WAAW,mBAAqB,OAAmC,YAAY,MAAO,OAAmC,aAAa,UAAc,OAAmC,cAAc,UAAe;AAC7T,UAAM,SAAS;AACf,UAAM,gBAAgB,OAAO,YAAY,OAAO,OAAO,aAAa,YAAY,CAAC,MAAM,QAAQ,OAAO,QAAQ,IAAI,OAAO,WAAsC;AAC/J,UAAM,QAAQ,EAAE,GAAG,cAAc;AACjC,QAAI,MAAM,YAAY,UAAa,MAAM,aAAa,OAAW,OAAM,UAAU,MAAM;AACvF,WAAO,MAAM;AACb,UAAM,eAAe,MAAM;AAC3B,QAAI,CAAC,gBAAgB,OAAO,iBAAiB,YAAY,MAAM,QAAQ,YAAY,EAAG,OAAM,IAAI,mBAAmB,oBAAoB,kCAAkC;AACzK,UAAM,kBAAkB,OAAO,OAAO,YAAY,WAAW,OAAO,UAAU,QAAQ,cAAc,SAAY,KAAK,iBAAiB,QAAQ,SAAS;AACvJ,UAAM,gBAAgB,EAAE,UAAU,OAAO,SAAS,gBAAgB;AAClE,UAAM,WAAW,mBAAmB,IAAI,YAAY,EAAE,OAAO,cAAc,aAAa,CAAC,GAAG,EAAE,gBAAgB,QAAQ,gBAAgB,KAAK,QAAQ,KAAK,iBAAiB,2BAA2B,CAAC;AACrM,QAAI,QAAQ,sBAAsB,UAAa,SAAS,SAAS,kBAAkB,UAAa,CAAC,QAAQ,kBAAkB,SAAS,SAAS,SAAS,OAAO,GAAG,EAAG,OAAM,IAAI,mBAAmB,qBAAqB,sDAAsD;AAC3Q,WAAO,EAAE,UAAU,QAA+C,SAAS;AAAA,EAC7E;AACA,QAAM,WAAW,6BAA6B,MAAM;AACpD,MAAI,QAAQ,mBAAmB,UAAa,SAAS,OAAO,WAAW,QAAQ,eAAgB,OAAM,IAAI,mBAAmB,mBAAmB,0CAA0C;AACzL,MAAI,CAAC,OAAO,SAAS,KAAK,MAAM,SAAS,MAAM,CAAC,KAAK,KAAK,MAAM,SAAS,MAAM,MAAM,QAAQ,OAAO,oBAAI,KAAK,GAAG,QAAQ,EAAG,OAAM,IAAI,mBAAmB,WAAW,sCAAsC;AACzM,MAAI,IAAI,KAAK,SAAS,MAAM,EAAE,YAAY,MAAM,SAAS,OAAQ,OAAM,IAAI,mBAAmB,oBAAoB,mCAAmC;AACrJ,QAAM,SAAS,SAAS,oBAAoB,SAAS,WAAW,oBAAoB,SAAS,oBAAoB,aAAa,SAAS,QAAQ,SAAS,MAAM,IAAI;AAClK,MAAI,SAAS,oBAAoB,SAAS,gBAAgB,QAAQ,sBAAsB,UAAa,CAAC,QAAQ,kBAAkB,SAAS,SAAS,UAAU,SAAS,GAAI,OAAM,IAAI,mBAAmB,qBAAqB,sDAAsD;AACjR,QAAM,YAAY,iBAAiB,SAAS,UAAU,KAAK;AAC3D,QAAM,YAAY,mBAAmB,SAAS,UAAU,SAAS;AACjE,MAAI,UAAU,WAAW,MAAM,CAAC,uBAAQ,OAAO,WAAW,8BAA8B,QAAQ,GAAG,SAAS,EAAG,OAAM,IAAI,mBAAmB,qBAAqB,yCAAyC;AAC1M,SAAO,EAAE,UAAU,UAAU,kBAAkB,UAAU,QAAQ,aAAa,IAAI,WAAW,GAAG,MAAM,EAAE;AAC1G;AAQO,SAAS,kCAAkCA,QAAmB,UAAsJ,CAAC,GAA2C;AACrQ,MAAI;AACJ,MAAI;AAAE,aAAS,KAAK,MAAM,IAAI,YAAY,SAAS,EAAE,OAAO,KAAK,CAAC,EAAE,OAAOA,MAAK,CAAC;AAAA,EAAG,QAAQ;AAAE,UAAM,IAAI,mBAAmB,oBAAoB,mCAAmC;AAAA,EAAG;AACrL,MAAI,OAAO,WAAW,YAAY,WAAW,QAAQ,MAAM,QAAQ,MAAM,EAAG,OAAM,IAAI,mBAAmB,oBAAoB,wCAAwC;AACrK,QAAM,WAAW;AACjB,QAAM,SAAS,SAAS;AACxB,QAAM,WAAW,QAAQ;AACzB,QAAM,sBAAsB,SAAS;AACrC,QAAM,YAAY,SAAS;AAC3B,aAAW,UAAU,CAAC,WAAW,WAAW,cAAc,uBAAuB,UAAU,WAAW,UAAU,WAAW,WAAW,GAAG,uBAAuB;AAChK,MAAI,WAAW,OAAW,YAAW,QAAQ,CAAC,UAAU,gBAAgB,WAAW,UAAU,GAAG,qBAAqB;AACrH,MAAI,aAAa,OAAW,YAAW,UAAU,CAAC,QAAQ,MAAM,GAAG,uBAAuB;AAC1F,MAAI,wBAAwB,QAAW;AACrC,QAAI,oBAAoB,SAAS,SAAU,YAAW,qBAAqB,CAAC,QAAQ,aAAa,aAAa,GAAG,4BAA4B;AAAA,aACpI,oBAAoB,SAAS,YAAa,YAAW,qBAAqB,CAAC,QAAQ,YAAY,GAAG,4BAA4B;AAAA,aAC9H,oBAAoB,SAAS,eAAgB,YAAW,qBAAqB,CAAC,QAAQ,KAAK,GAAG,yBAAyB;AAAA,QAC3H,YAAW,qBAAqB,CAAC,MAAM,GAAG,mCAAmC;AAAA,EACpF;AACA,MAAI,cAAc,OAAW,YAAW,WAAW,CAAC,aAAa,aAAa,OAAO,GAAG,wBAAwB;AAChH,MAAI,SAAS,YAAY,KAAK,OAAO,SAAS,YAAY,YAAY,OAAO,SAAS,WAAW,YAAY,OAAO,QAAQ,WAAW,YAAY,OAAO,OAAO,YAAY,YAAY,OAAO,OAAO,iBAAiB,YAAa,UAAU,SAAS,WAAW,UAAU,SAAS,YAAa,OAAO,SAAS,SAAS,YAAY,OAAO,qBAAqB,SAAS,YAAY,OAAO,WAAW,cAAc,YAAY,UAAU,cAAc,aAAa,OAAO,UAAU,UAAU,SAAU,OAAM,IAAI,mBAAmB,oBAAoB,wCAAwC;AACxkB,MAAI,QAAQ,mBAAmB,UAAa,OAAO,WAAW,QAAQ,eAAgB,OAAM,IAAI,mBAAmB,mBAAmB,0CAA0C;AAChL,QAAM,SAAS,KAAK,MAAM,SAAS,MAAM;AACzC,MAAI,CAAC,OAAO,SAAS,MAAM,KAAK,WAAW,QAAQ,OAAO,oBAAI,KAAK,GAAG,QAAQ,EAAG,OAAM,IAAI,mBAAmB,WAAW,sCAAsC;AAC/J,QAAM,YAAY,mBAAmB,UAAU,SAAS;AACxD,MAAI,oBAAoB,SAAS,aAAa,QAAQ,sBAAsB,UAAa,CAAC,QAAQ,kBAAkB,SAAS,UAAU,SAAS,GAAI,OAAM,IAAI,mBAAmB,qBAAqB,sDAAsD;AAC5P,QAAM,iBAAiB,iBAAiB,UAAU,KAAK;AACvD,QAAM,EAAE,WAAW,YAAY,GAAG,SAAS,IAAI;AAC/C,QAAM,SAAS,IAAI,YAAY,EAAE,OAAO,mCAAmC;AAC3E,QAAM,OAAO,IAAI,YAAY,EAAE,OAAO,cAAc,QAAQ,CAAC;AAC7D,QAAM,eAAe,IAAI,WAAW,OAAO,SAAS,KAAK,MAAM;AAC/D,eAAa,IAAI,MAAM;AAAG,eAAa,IAAI,MAAM,OAAO,MAAM;AAC9D,MAAI,eAAe,WAAW,MAAM,CAAC,uBAAQ,OAAO,gBAAgB,cAAc,SAAS,EAAG,OAAM,IAAI,mBAAmB,qBAAqB,4CAA4C;AAC5L,QAAM,UAAU,QAAQ,aAAa,IAAI,WAAW;AACpD,QAAM,WAA4B;AAAA,IAChC,UAAU;AAAA,MACR,QAAQ;AAAA,MACR,SAAS;AAAA,MACT,QAAQ,OAAO;AAAA,MACf,SAAS,OAAO;AAAA,MAChB,UAAU,EAAE,MAAM,SAAS,MAAM,MAAM,SAAS,KAAK;AAAA,MACrD,eAAe,oBAAoB,SAAS,WAAW,WAAW,oBAAoB,SAAS,gBAAgB,eAAe,oBAAoB,SAAS,iBAAiB,gBAAgB;AAAA,MAC5L,SAAS,CAAC,MAAM;AAAA,MAChB,SAAS,EAAE,UAAU,4BAA4B,MAAM,QAAQ,YAAY,QAAQ,qBAAiB,sBAAO,OAAO,CAAC,EAAE;AAAA,MACrH,WAAW;AAAA,MACX,WAAW,SAAS;AAAA,MACpB,QAAQ,EAAE,KAAK,UAAU,WAAW,WAAW,iBAAiB,SAAS,EAAE;AAAA,MAC3E,WAAW,UAAU;AAAA,MACrB,yBAAyB,oBAAoB;AAAA,IAC/C;AAAA,IACA,SAAS,iBAAiB,OAAO;AAAA,EACnC;AACA,SAAO,EAAE,SAAS;AACpB;AAEO,SAAS,wBAAwB,MAAc,UAA6F,CAAC,GAA+G;AACjQ,MAAI;AACJ,MAAI;AAAE,UAAM,IAAI,IAAI,IAAI;AAAA,EAAG,QAAQ;AAAE,UAAM,IAAI,mBAAmB,gBAAgB,oCAAoC;AAAA,EAAG;AACzH,QAAM,SAAS,gBAAgB,IAAI,MAAM;AACzC,MAAI,QAAQ,mBAAmB,UAAa,CAAC,QAAQ,eAAe,IAAI,eAAe,EAAE,SAAS,MAAM,EAAG,OAAM,IAAI,mBAAmB,mBAAmB,kCAAkC;AAC7L,MAAI,IAAI,WAAW,MAAM,IAAI,aAAa,MAAM,IAAI,aAAa,GAAI,OAAM,IAAI,mBAAmB,gBAAgB,6BAA6B;AAC/I,MAAI,IAAI,aAAa,eAAe,IAAI,KAAK,WAAW,SAAS,GAAG;AAClE,QAAI;AACJ,QAAI;AACF,YAAMA,SAAQ,iBAAiB,IAAI,KAAK,MAAM,UAAU,MAAM,CAAC;AAC/D,UAAIA,OAAM,UAAU,QAAQ,kBAAkB,4BAA4B,EAAG,OAAM,IAAI,MAAM,0BAA0B;AACvH,YAAM,QAAQ,KAAK,MAAM,IAAI,YAAY,SAAS,EAAE,OAAO,KAAK,CAAC,EAAE,OAAOA,MAAK,CAAC;AAChF,UAAI,OAAO,UAAU,YAAY,UAAU,QAAQ,MAAM,QAAQ,KAAK,EAAG,OAAM,IAAI,MAAM,sBAAsB;AAC/G,gBAAU;AAAA,IACZ,SAAS,OAAO;AAAE,YAAM,IAAI,mBAAmB,gBAAgB,iBAAiB,QAAQ,MAAM,UAAU,wBAAwB;AAAA,IAAG;AACnI,QAAI,QAAQ,MAAM,KAAK,OAAO,QAAQ,MAAM,YAAY,OAAO,QAAQ,QAAQ,YAAa,QAAQ,MAAM,UAAa,OAAO,QAAQ,MAAM,YAAa,OAAO,KAAK,OAAO,EAAE,KAAK,CAACQ,SAAQ,CAAC,CAAC,KAAK,KAAK,OAAO,GAAG,EAAE,SAASA,IAAG,CAAC,EAAG,OAAM,IAAI,mBAAmB,gBAAgB,mCAAmC;AACpT,UAAM,SAAS,iBAAiB,QAAQ,CAAC;AACzC,QAAI,CAAC,wBAAwB,QAAQ,KAAK,MAAM,EAAG,OAAM,IAAI,mBAAmB,gBAAgB,mCAAmC;AACnI,UAAMA,OAAM,QAAQ,MAAM,SAAY,SAAY,iBAAiB,QAAQ,CAAC;AAC5E,QAAIA,SAAQ,UAAaA,KAAI,WAAW,GAAI,OAAM,IAAI,mBAAmB,gBAAgB,+BAA+B;AACxH,WAAO,EAAE,QAAQ,KAAK,QAAQ,KAAK,GAAIA,SAAQ,SAAY,CAAC,IAAI,EAAE,KAAAA,KAAI,GAAI,OAAO;AAAA,EACnF;AACA,QAAM,QAAQ,qBAAqB,KAAK,IAAI,QAAQ;AACpD,MAAI,UAAU,QAAQ,CAAC,IAAI,KAAK,WAAW,KAAK,EAAG,OAAM,IAAI,mBAAmB,gBAAgB,iCAAiC;AACjI,QAAM,MAAM,iBAAiB,IAAI,KAAK,MAAM,CAAC,CAAC;AAC9C,MAAI,IAAI,WAAW,GAAI,OAAM,IAAI,mBAAmB,gBAAgB,+BAA+B;AACnG,MAAI;AACF,UAAMN,OAAM,IAAI,MAAM,MAAM,CAAC,CAAC;AAC9B,QAAIA,KAAI,YAAY,KAAKA,KAAI,SAAa,QAAQA,KAAI,UAAU,SAAS,OAAU,QAAQA,KAAI,SAAS,MAAM,MAAM,CAAC,EAAG,OAAM,IAAI,MAAM,KAAK;AAAA,EAC/I,QAAQ;AAAE,UAAM,IAAI,mBAAmB,gBAAgB,+BAA+B;AAAA,EAAG;AACzF,SAAO,EAAE,QAAQ,KAAK,MAAM,CAAC,GAAG,IAAI;AACtC;AAEO,SAAS,cAAc,MAAc,UAA6F,CAAC,GAAsB;AAC9J,MAAI;AACJ,MAAI;AAAE,UAAM,IAAI,IAAI,IAAI;AAAA,EAAG,QAAQ;AAAE,UAAM,IAAI,mBAAmB,gBAAgB,oCAAoC;AAAA,EAAG;AACzH,MAAI,IAAI,WAAW,GAAI,OAAM,IAAI,mBAAmB,gBAAgB,+CAA+C;AACnH,QAAM,SAAS,gBAAgB,IAAI,MAAM;AACzC,MAAI,QAAQ,mBAAmB,UAAa,CAAC,QAAQ,eAAe,IAAI,eAAe,EAAE,SAAS,MAAM,EAAG,OAAM,IAAI,mBAAmB,mBAAmB,kCAAkC;AAC7L,MAAI,IAAI,aAAa,eAAe,IAAI,KAAK,WAAW,SAAS,GAAG;AAClE,UAAM,YAAY,wBAAwB,MAAM,OAAO;AACvD,WAAO,EAAE,MAAM,UAAU,QAAQ,KAAK,UAAU,KAAK,KAAK,UAAU,KAAK,KAAK,GAAG,IAAI,MAAM,GAAG,IAAI,QAAQ,IAAI,UAAU,oBAAoB;AAAA,EAC9I;AACA,QAAM,QAAQ,IAAI,SAAS,MAAM,sBAAsB;AACvD,MAAI,CAAC,MAAO,OAAM,IAAI,mBAAmB,gBAAgB,4BAA4B;AACrF,QAAM,iBAAiB,IAAI,SAAS,KAAK,SAAY,IAAI,gBAAgB,IAAI,KAAK,MAAM,CAAC,CAAC;AAC1F,MAAI,mBAAmB,WAAc,eAAe,IAAI,GAAG,MAAM,QAAQ,CAAC,GAAG,eAAe,KAAK,CAAC,EAAE,KAAK,CAACM,SAAQA,SAAQ,GAAG,GAAI,OAAM,IAAI,mBAAmB,gBAAgB,sCAAsC;AACpN,QAAM,WAAW,gBAAgB,IAAI,GAAG;AACxC,QAAM,MAAM,aAAa,QAAQ,aAAa,SAAY,SAAY,iBAAiB,QAAQ;AAC/F,MAAI,QAAQ,UAAa,IAAI,WAAW,GAAI,OAAM,IAAI,mBAAmB,gBAAgB,+BAA+B;AACxH,MAAI,MAAM,CAAC,MAAM,QAAW;AAC1B,QAAI;AAAE,UAAI,IAAI,MAAM,MAAM,CAAC,CAAC,EAAE,SAAS,MAAM,MAAM,CAAC,EAAG,OAAM,IAAI,MAAM,mBAAmB;AAAA,IAAG,QACvF;AAAE,YAAM,IAAI,mBAAmB,gBAAgB,sBAAsB;AAAA,IAAG;AAC9E,UAAM,WAAW,IAAI,MAAM,MAAM,CAAC,CAAC,EAAE,UAAU,SAAS,OAAU,OAAO,sBAAsB;AAC/F,WAAO,EAAE,MAAM,WAAW,QAAQ,KAAK,MAAM,CAAC,GAAG,KAAK,KAAK,GAAG,IAAI,MAAM,GAAG,IAAI,QAAQ,IAAI,SAAS;AAAA,EACtG;AACA,QAAM,cAAc,iBAAiB,MAAM,CAAC,CAAC;AAC7C,MAAI,YAAY,cAAc,QAAQ,kBAAkB,0BAA2B,OAAM,IAAI,mBAAmB,qBAAqB,2CAA2C;AAChL,SAAO,EAAE,MAAM,UAAU,QAAQ,UAAU,mBAAmB,WAAW,GAAG,KAAK,KAAK,GAAG,IAAI,MAAM,GAAG,IAAI,QAAQ,GAAG;AACvH;AAEO,SAAS,cAAc,MAAuB;AACnD,MAAI;AAAE,WAAO,IAAI,IAAI,IAAI,EAAE,SAAS,WAAW,KAAK;AAAA,EAAG,QAAQ;AAAE,WAAO,KAAK,WAAW,aAAa;AAAA,EAAG;AAC1G;AAEA,eAAsB,kBAAkBR,QAAmB,KAAsC;AAC/F,SAAO,uBAAuBA,QAAO,GAAG;AAC1C;AAEA,eAAsB,uBAAuBA,QAAmB,KAAsC;AACpG,MAAI,IAAI,WAAW,GAAI,OAAM,IAAI,mBAAmB,uBAAuB,8BAA8B;AACzG,QAAM,KAAK,OAAO,gBAAgB,IAAI,WAAW,EAAE,CAAC;AACpD,QAAM,YAAY,MAAM,OAAO,OAAO,UAAU,OAAO,KAA+B,WAAW,OAAO,CAAC,SAAS,CAAC;AACnH,QAAM,aAAa,MAAM,OAAO,OAAO,QAAQ,EAAE,MAAM,WAAW,GAAiC,GAAG,WAAWA,MAA+B;AAChJ,SAAO,IAAI,WAAW,CAAC,GAAG,IAAI,GAAG,IAAI,WAAW,UAAU,CAAC,CAAC;AAC9D;AAEA,eAAsB,uBAAuBA,QAAmB,KAAsC;AACpG,MAAI,IAAI,WAAW,MAAMA,OAAM,SAAS,GAAI,OAAM,IAAI,mBAAmB,oBAAoB,mCAAmC;AAChI,MAAI;AACF,UAAM,YAAY,MAAM,OAAO,OAAO,UAAU,OAAO,KAA+B,WAAW,OAAO,CAAC,SAAS,CAAC;AACnH,WAAO,IAAI,WAAW,MAAM,OAAO,OAAO,QAAQ,EAAE,MAAM,WAAW,IAAIA,OAAM,MAAM,GAAG,EAAE,EAA4B,GAAG,WAAWA,OAAM,MAAM,EAAE,CAA2B,CAAC;AAAA,EAChL,QAAQ;AACN,UAAM,IAAI,mBAAmB,qBAAqB,yBAAyB;AAAA,EAC7E;AACF;AAEO,SAAS,oBAAoB,OAAgD;AAClF,QAAM,MAAM,MAAM;AAClB,MAAI,MAAM,cAAc,UAAa,QAAQ,OAAW,OAAM,IAAI,mBAAmB,uBAAuB,qCAAqC;AACjJ,MAAI,MAAM,wBAAwB,CAAC,MAAM,gCAAgC,MAAM,MAAM,eAAe,KAAK,MAAM,cAAc,UAAa,QAAQ,QAAY,OAAM,IAAI,mBAAmB,oBAAoB,oFAAoF;AACnS,MAAI,MAAM,MAAM,cAAc,MAAM,mBAAmB,4BAA6B,OAAM,IAAI,mBAAmB,qBAAqB,4CAA4C;AAClL,MAAI,QAAQ,OAAW,OAAM,IAAI,mBAAmB,oBAAoB,6CAA6C;AACrH,QAAM,WAAW,kBAAkB;AAAA,IACjC,QAAQ;AAAA,IACR,SAAS;AAAA,IACT,QAAQ,MAAM;AAAA,IACd,SAAS,MAAM;AAAA,IACf,WAAW,MAAM;AAAA,IACjB,eAAe,MAAM,WAAW;AAAA,IAChC,UAAU,MAAM;AAAA,IAChB,SAAS,MAAM;AAAA,IACf,SAAS,EAAE,UAAU,MAAM,UAAU,MAAM,MAAM,MAAM,YAAY,QAAQ,cAAc,MAAM,KAAK,GAAG,GAAI,MAAM,SAAS,WAAW,OAAO,IAAI,EAAE,SAAS,QAAiB,IAAI,CAAC,EAAG;AAAA,IACpL,WAAW;AAAA,IACX,WAAW,MAAM,UAAU,YAAY;AAAA,IACvC,WAAW,MAAM;AAAA,IACjB,kBAAkB,MAAM;AAAA,EAC1B,CAAC;AACD,QAAM,WAAW,EAAE,UAAU,SAAS,iBAAiB,MAAM,KAAK,EAAE;AACpE,SAAO,EAAE,UAAU,OAAO,oBAAoB,QAAQ,GAAG,KAAK,gBAAgB,oBAAoB,QAAQ,CAAC,EAAE;AAC/G;AAEA,eAAsB,yBAAyB,OAAyD;AACtG,QAAM,YAAY,MAAM,cAAc,SAAY,SAAY,8BAA8B,MAAM,SAAS;AAC3G,MAAI,cAAc,UAAa,MAAM,kBAAkB,OAAW,OAAM,IAAI,mBAAmB,uBAAuB,qCAAqC;AAC3J,MAAI,MAAM,wBAAwB,CAAC,MAAM,gCAAgC,MAAM,MAAM,eAAe,KAAK,cAAc,UAAa,MAAM,kBAAkB,QAAY,OAAM,IAAI,mBAAmB,oBAAoB,oFAAoF;AAC7S,MAAI,MAAM,MAAM,cAAc,MAAM,mBAAmB,yBAA0B,OAAM,IAAI,mBAAmB,qBAAqB,8CAA8C;AACjL,QAAM,iBAAiB,MAAM,kBAAkB,SAAY,MAAM,QAAQ,MAAM,uBAAuB,MAAM,OAAO,MAAM,aAAa;AACtI,MAAI,eAAe,aAAa,+BAAgC,OAAM,IAAI,mBAAmB,qBAAqB,mDAAmD;AACrK,QAAM,WAAW,kBAAkB;AAAA,IACjC,QAAQ;AAAA,IACR,SAAS;AAAA,IACT,QAAQ,MAAM;AAAA,IACd,SAAS,MAAM;AAAA,IACf,UAAU,MAAM;AAAA,IAChB,SAAS,MAAM;AAAA,IACf,SAAS,EAAE,UAAU,MAAM,UAAU,MAAM,eAAe,YAAY,QAAQ,cAAc,cAAc,GAAG,GAAI,MAAM,SAAS,WAAW,OAAO,IAAI,EAAE,SAAS,QAAiB,IAAI,CAAC,EAAG;AAAA,IAC1L,WAAW,MAAM,kBAAkB;AAAA,IACnC,WAAW,MAAM,UAAU,YAAY;AAAA,IACvC,WAAW,MAAM;AAAA,IACjB,kBAAkB,MAAM;AAAA,IACxB,GAAI,WAAW,SAAS,WAAW,EAAE,UAAU,IAAI,CAAC;AAAA,IACpD,GAAI,cAAc,SAAY,CAAC,IAAI,EAAE,eAAe,UAAU,KAAK;AAAA,EACrE,CAAC;AACD,QAAM,WAAW,EAAE,UAAU,SAAS,iBAAiB,cAAc,EAAE;AACvE,QAAMA,SAAQ,oBAAoB,QAAQ;AAC1C,SAAO,EAAE,UAAU,OAAAA,QAAO,KAAK,gBAAgBA,MAAK,GAAG,KAAK,MAAM,cAAc;AAClF;AAEO,SAAS,2BAA2B,SAA8B,WAAiE;AACxI,MAAI,QAAQ,YAAY,UAAU,QAAS,QAAO;AAClD,QAAM,OAAO,oBAAoB,QAAQ,UAAU,UAAU,QAAQ;AACrE,MAAI,SAAS,OAAW,QAAO;AAC/B,QAAM,UAAU,UAAU,QAAQ,OAAO,CAAC,WAAW,QAAQ,QAAQ,SAAS,MAAM,CAAC;AACrF,MAAI,QAAQ,WAAW,EAAG,QAAO;AACjC,SAAO,EAAE,SAAS,QAAQ,SAAS,UAAU,MAAM,SAAS,CAAC,GAAG,IAAI,IAAI,OAAO,CAAC,EAAE,KAAK,EAAmB;AAC5G;AAIA,SAAS,oBAAoB,MAAqB,OAAiD;AACjG,MAAI,KAAK,SAAS,WAAW,MAAM,SAAS,QAAS,QAAO,KAAK,SAAS,MAAM,OAAO,OAAO;AAC9F,MAAI,KAAK,SAAS,QAAS,QAAO,iBAAiB,OAAO,IAAI,IAAI,OAAO;AACzE,MAAI,MAAM,SAAS,QAAS,QAAO,iBAAiB,MAAM,KAAK,IAAI,QAAQ;AAC3E,MAAI,iBAAiB,MAAM,KAAK,EAAG,QAAO;AAC1C,MAAI,iBAAiB,OAAO,IAAI,EAAG,QAAO;AAC1C,SAAO;AACT;AAEO,SAAS,sBAAsB,YAAiC,QAAqB,MAAuB;AACjH,MAAI,CAAC,WAAW,QAAQ,SAAS,MAAM,EAAG,QAAO;AACjD,MAAI,WAAW,SAAS,SAAS,QAAS,QAAO,WAAW,UAAU,WAAW,SAAS,SAAS;AACnG,QAAM,SAAS,WAAW,SAAS,KAAK,QAAQ,OAAO,EAAE;AACzD,MAAI,WAAW,OAAQ,QAAO,KAAK,QAAQ,OAAO,EAAE,MAAM;AAC1D,QAAM,YAAY,KAAK,WAAW,GAAG,MAAM,GAAG,IAAI,KAAK,MAAM,OAAO,SAAS,CAAC,IAAI;AAClF,SAAO,UAAU,SAAS,KAAK,CAAC,UAAU,SAAS,GAAG;AACxD;;;ACnjCA,IAAAS,iBAAuB;AA6BvB,SAAS,SAAS,KAA4B;AAC5C,MAAI,CAAC,IAAI,OAAO,CAAC,IAAI,UAAW,OAAM,IAAI,MAAM,yCAAyC;AACzF,SAAO,GAAG,IAAI,GAAG,KAAK,IAAI,SAAS;AACrC;AAEA,SAASC,QAAOC,QAA+B;AAC7C,aAAO,uBAAOA,MAAK;AACrB;AAEA,SAAS,WAAW,MAAkB,OAA4B;AAChE,MAAI,KAAK,eAAe,MAAM,WAAY,QAAO;AACjD,SAAO,KAAK,MAAM,CAAC,MAAM,UAAU,SAAS,MAAM,KAAK,CAAC;AAC1D;AAOO,IAAM,mBAAN,MAA6C;AAAA,EAGlD,YAA6B,MAAkB,MAAM,oBAAI,KAAK,GAAG;AAApC;AAF7B,SAAiB,UAAU,oBAAI,IAA6B;AAAA,EAEM;AAAA,EAElE,MAAM,IAAI,KAAoB,MAAM,oBAAI,KAAK,GAAoC;AAC/E,UAAM,SAAS,SAAS,GAAG;AAC3B,UAAM,QAAQ,KAAK,QAAQ,IAAI,MAAM;AACrC,QAAI,UAAU,OAAW,QAAO;AAChC,QAAI,KAAK,MAAM,MAAM,IAAI,SAAS,KAAK,IAAI,QAAQ,KAAK,CAAC,WAAW,MAAM,QAAQD,QAAO,MAAM,KAAK,CAAC,GAAG;AACtG,WAAK,QAAQ,OAAO,MAAM;AAC1B,aAAO;AAAA,IACT;AACA,WAAO,MAAM,MAAM,MAAM;AAAA,EAC3B;AAAA,EAEA,MAAM,SAASE,MAAa,MAAM,oBAAI,KAAK,GAAyC;AAClF,UAAM,UAAU,CAAC,GAAG,KAAK,QAAQ,OAAO,CAAC,EAAE,OAAO,CAAC,UAAU,MAAM,IAAI,QAAQA,IAAG;AAClF,eAAW,SAAS,SAAS;AAC3B,UAAI,KAAK,MAAM,MAAM,IAAI,SAAS,KAAK,IAAI,QAAQ,KAAK,CAAC,WAAW,MAAM,QAAQF,QAAO,MAAM,KAAK,CAAC,GAAG;AACtG,aAAK,QAAQ,OAAO,SAAS,MAAM,GAAG,CAAC;AACvC;AAAA,MACF;AACA,aAAO;AAAA,QACL,KAAK,EAAE,GAAG,MAAM,IAAI;AAAA,QACpB,OAAO,MAAM,MAAM,MAAM;AAAA,QACzB,QAAQ,MAAM,OAAO,MAAM;AAAA,QAC3B,UAAU,EAAE,GAAG,MAAM,SAAS;AAAA,MAChC;AAAA,IACF;AACA,WAAO;AAAA,EACT;AAAA,EAEA,MAAM,IAAI,KAAoBC,QAAmB,UAA6C;AAC5F,QAAI,KAAK,MAAM,IAAI,SAAS,KAAK,KAAK,IAAI,EAAE,QAAQ,EAAG;AACvD,SAAK,QAAQ,IAAI,SAAS,GAAG,GAAG;AAAA,MAC9B,KAAK,EAAE,KAAK,IAAI,KAAK,WAAW,IAAI,UAAU;AAAA,MAC9C,OAAOA,OAAM,MAAM;AAAA,MACnB,QAAQD,QAAOC,MAAK;AAAA,MACpB,UAAU,EAAE,GAAG,SAAS;AAAA,IAC1B,CAAC;AAAA,EACH;AAAA,EAEA,MAAM,OAAO,KAAmC;AAC9C,SAAK,QAAQ,OAAO,SAAS,GAAG,CAAC;AAAA,EACnC;AAAA,EAEA,MAAM,QAAuB;AAC3B,SAAK,QAAQ,MAAM;AAAA,EACrB;AACF;;;AC8PO,IAAM,gBAAN,cAA4B,MAAM;AAAA,EAKvC,YAAY,MAAc,MAAe;AACvC,UAAM,wBAAwB,IAAI,mCAAmC;AALvE,SAAS,OAAO;AAMd,SAAK,OAAO;AACZ,SAAK,OAAO;AACZ,SAAK,OAAO;AAAA,EACd;AACF;AAEO,IAAM,mBAAN,cAA+B,MAAM;AAAA,EAI1C,YAAYE,OAAc,SAAkB,SAAmB;AAC7D,UAAM,WAAW,sCAAsC;AACvD,SAAK,OAAO;AACZ,SAAK,OAAOA;AACZ,SAAK,UAAU;AAAA,EACjB;AACF;;;ACvXA,IAAAC,cAAkB;AAEX,IAAM,6BAA6B,cAAE,mBAAmB,QAAQ;AAAA,EACrE,cAAE,OAAO,EAAE,MAAM,cAAE,QAAQ,YAAY,GAAG,OAAO,cAAE,OAAO,EAAE,IAAI,CAAC,EAAE,CAAC,EAAE,OAAO;AAAA,EAC7E,cAAE,OAAO,EAAE,MAAM,cAAE,QAAQ,aAAa,GAAG,OAAO,cAAE,OAAO,EAAE,IAAI,CAAC,EAAE,CAAC,EAAE,OAAO;AAAA,EAC9E,cAAE,OAAO,EAAE,MAAM,cAAE,QAAQ,cAAc,GAAG,OAAO,cAAE,OAAO,EAAE,MAAM,oBAAoB,EAAE,CAAC,EAAE,OAAO;AAAA,EACpG,cAAE,OAAO,EAAE,MAAM,cAAE,QAAQ,QAAQ,EAAE,CAAC,EAAE,OAAO;AACjD,CAAC;AAEM,IAAM,sBAAsB,cAAE,mBAAmB,QAAQ;AAAA,EAC9D,cAAE,OAAO,EAAE,MAAM,cAAE,QAAQ,OAAO,GAAG,MAAM,cAAE,OAAO,EAAE,IAAI,CAAC,EAAE,CAAC,EAAE,OAAO;AAAA,EACvE,cAAE,OAAO,EAAE,MAAM,cAAE,QAAQ,QAAQ,GAAG,MAAM,cAAE,OAAO,EAAE,IAAI,CAAC,EAAE,CAAC,EAAE,OAAO;AAC1E,CAAC;AAEM,IAAM,oBAAoB,cAAE,KAAK,CAAC,QAAQ,QAAQ,MAAM,CAAC;AAEzD,IAAM,6BAA6B,cAAE,OAAO;AAAA,EACjD,kBAAkB;AAAA,EAClB,SAAS,cAAE,OAAO,EAAE,IAAI,CAAC;AAAA,EACzB,UAAU;AAAA,EACV,SAAS,cAAE,MAAM,iBAAiB,EAAE,IAAI,CAAC;AAAA,EACzC,WAAW,cAAE,KAAK;AACpB,CAAC,EAAE,OAAO;AAEH,IAAM,oCAAoC,cAAE,OAAO;AAAA,EACxD,gBAAgB,cAAE,MAAM,cAAE,OAAO,EAAE,IAAI,CAAC,EAAE,IAAI,CAAC;AAAA,EAC/C,gBAAgB,cAAE,OAAO,EAAE,IAAI,EAAE,SAAS,EAAE,SAAS;AAAA,EACrD,kBAAkB,cAAE,OAAO,EAAE,IAAI,EAAE,SAAS,EAAE,SAAS;AAAA,EACvD,iBAAiB,cAAE,OAAO,EAAE,IAAI,EAAE,SAAS,EAAE,SAAS;AAAA,EACtD,uBAAuB,cAAE,OAAO,EAAE,IAAI,EAAE,SAAS,EAAE,SAAS;AAC9D,CAAC,EAAE,OAAO;AAEV,IAAM,0BAA0B,cAAE,KAAK,CAAC,oBAAoB,yBAAyB,qBAAqB,kBAAkB,CAAC;AAC7H,IAAM,wBAAwB,cAAE,KAAK,CAAC,oBAAoB,yBAAyB,qBAAqB,oBAAoB,oBAAoB,CAAC;AACjJ,IAAM,2BAA2B,cAAE,mBAAmB,QAAQ;AAAA,EAC5D,cAAE,OAAO;AAAA,IACP,MAAM,cAAE,QAAQ,IAAI;AAAA,IACpB,QAAQ;AAAA,IACR,OAAO,cAAE,OAAO,EAAE,IAAI,CAAC;AAAA,IACvB,MAAM,cAAE,OAAO,EAAE,IAAI,CAAC;AAAA,EACxB,CAAC,EAAE,OAAO;AAAA,EACV,cAAE,OAAO;AAAA,IACP,MAAM,cAAE,QAAQ,KAAK;AAAA,IACrB,QAAQ,cAAE,QAAQ,oBAAoB;AAAA,IACtC,OAAO,cAAE,OAAO,EAAE,IAAI,CAAC;AAAA,IACvB,UAAU,cAAE,OAAO,EAAE,IAAI,CAAC;AAAA,IAC1B,MAAM,cAAE,OAAO,EAAE,IAAI,CAAC;AAAA,IACtB,WAAW,cAAE,OAAO,EAAE,IAAI,CAAC;AAAA,IAC3B,WAAW,cAAE,OAAO,cAAE,OAAO,EAAE,IAAI,EAAE,KAAK,CAAC;AAAA,IAC3C,iBAAiB,cAAE,OAAO,EAAE,IAAI,CAAC;AAAA,EACnC,CAAC,EAAE,OAAO;AACZ,CAAC;AACD,IAAM,gCAAgC,cAAE,mBAAmB,QAAQ;AAAA,EACjE,cAAE,OAAO,EAAE,MAAM,cAAE,QAAQ,YAAY,GAAG,OAAO,cAAE,OAAO,EAAE,IAAI,CAAC,EAAE,CAAC,EAAE,OAAO;AAAA,EAC7E,cAAE,OAAO,EAAE,MAAM,cAAE,QAAQ,aAAa,GAAG,OAAO,cAAE,OAAO,EAAE,IAAI,CAAC,EAAE,CAAC,EAAE,OAAO;AAAA,EAC9E,cAAE,OAAO,EAAE,MAAM,cAAE,QAAQ,cAAc,GAAG,OAAO,cAAE,OAAO,EAAE,MAAM,oBAAoB,EAAE,CAAC,EAAE,OAAO;AACtG,CAAC;AAEM,IAAM,0CAA0C,cAAE,OAAO;AAAA,EAC9D,SAAS,cAAE,QAAQ,CAAC;AAAA,EACpB,OAAO,cAAE,OAAO,EAAE,IAAI,CAAC;AAAA,EACvB,KAAK,cAAE,OAAO,EAAE,IAAI,CAAC;AAAA,EACrB,WAAW,cAAE,OAAO,EAAE,IAAI,CAAC;AAAA,EAC3B,kBAAkB;AAAA,EAClB,cAAc,cAAE,OAAO,EAAE,IAAI;AAAA,EAC7B,cAAc,cAAE,OAAO,EAAE,IAAI,CAAC;AAAA,EAC9B,UAAU,cAAE,OAAO,EAAE,IAAI,CAAC;AAAA,EAC1B,SAAS,cAAE,OAAO,EAAE,IAAI,CAAC;AAAA,EACzB,eAAe,cAAE,OAAO,EAAE,IAAI,CAAC;AAAA,EAC/B,yBAAyB,cAAE,OAAO,EAAE,IAAI,CAAC;AAAA,EACzC,yBAAyB,cAAE,OAAO,EAAE,IAAI,CAAC;AAAA,EACzC,eAAe;AAAA,EACf,qBAAqB,cAAE,OAAO,EAAE,IAAI,CAAC;AAAA,EACrC,SAAS,cAAE,MAAM,qBAAqB,EAAE,IAAI,CAAC,EAAE,OAAO,CAAC,YAAY,IAAI,IAAI,OAAO,EAAE,SAAS,QAAQ,MAAM;AAAA,EAC3G,UAAU,cAAE,OAAO,EAAE,MAAM,cAAE,KAAK,CAAC,SAAS,QAAQ,CAAC,GAAG,OAAO,cAAE,OAAO,EAAE,IAAI,CAAC,EAAE,CAAC,EAAE,OAAO;AAAA,EAC3F,WAAW,cAAE,OAAO,EAAE,SAAS,EAAE,QAAQ,KAAK,CAAC;AAAA,EAC/C,mBAAmB,cAAE,OAAO,EAAE,IAAI,CAAC;AACrC,CAAC,EAAE,OAAO;AAEH,IAAM,2CAA2C,cAAE,OAAO;AAAA,EAC/D,SAAS;AAAA,EACT,OAAO,cAAE,OAAO,EAAE,KAAK,cAAE,QAAQ,OAAO,GAAG,KAAK,cAAE,OAAO,EAAE,IAAI,CAAC,GAAG,WAAW,cAAE,OAAO,EAAE,IAAI,CAAC,EAAE,CAAC,EAAE,OAAO;AAC5G,CAAC,EAAE,OAAO;AAEH,IAAM,2CAA2C,cAAE,OAAO;AAAA,EAC/D,MAAM,cAAE,QAAQ,mCAAmC;AAAA,EACnD,SAAS,cAAE,QAAQ,CAAC;AAAA,EACpB,OAAO,cAAE,OAAO,EAAE,IAAI,CAAC;AAAA,EACvB,KAAK,cAAE,OAAO,EAAE,IAAI,CAAC;AAAA,EACrB,WAAW,cAAE,OAAO,EAAE,IAAI,CAAC;AAAA,EAC3B,aAAa,cAAE,OAAO,EAAE,IAAI,CAAC;AAAA,EAC7B,cAAc,cAAE,OAAO,EAAE,IAAI,CAAC;AAAA,EAC9B,eAAe,cAAE,OAAO,EAAE,IAAI,CAAC;AAAA,EAC/B,iBAAiB,cAAE,OAAO,EAAE,IAAI,CAAC;AAAA,EACjC,kBAAkB,cAAE,OAAO,EAAE,IAAI,CAAC;AAAA,EAClC,yBAAyB,cAAE,OAAO,EAAE,IAAI,CAAC;AAAA,EACzC,yBAAyB,cAAE,OAAO,EAAE,IAAI,CAAC;AAAA,EACzC,SAAS,cAAE,MAAM,qBAAqB,EAAE,IAAI,CAAC,EAAE,OAAO,CAAC,YAAY,IAAI,IAAI,OAAO,EAAE,SAAS,QAAQ,MAAM;AAAA,EAC3G,UAAU,cAAE,OAAO,EAAE,MAAM,cAAE,KAAK,CAAC,SAAS,QAAQ,CAAC,GAAG,OAAO,cAAE,OAAO,EAAE,IAAI,CAAC,EAAE,CAAC,EAAE,OAAO;AAAA,EAC3F,WAAW,cAAE,OAAO,EAAE,SAAS,EAAE,QAAQ,KAAK,CAAC;AAAA,EAC/C,OAAO,cAAE,OAAO,EAAE,KAAK,cAAE,QAAQ,OAAO,GAAG,KAAK,cAAE,OAAO,EAAE,IAAI,CAAC,GAAG,WAAW,cAAE,OAAO,EAAE,IAAI,CAAC,EAAE,CAAC,EAAE,OAAO;AAC5G,CAAC,EAAE,OAAO;AAEV,IAAM,iCAAiC,cAAE,OAAO;AAAA,EAC9C,MAAM,cAAE,OAAO,EAAE,IAAI,CAAC;AAAA,EACtB,MAAM,cAAE,KAAK,CAAC,QAAQ,QAAQ,CAAC;AACjC,CAAC,EAAE,OAAO;AAOV,IAAM,0BAA0B;AAAA,EAC9B,MAAM,cAAE,QAAQ,8BAA8B;AAAA,EAC9C,SAAS,cAAE,QAAQ,CAAC;AAAA,EACpB,UAAU,cAAE,OAAO,EAAE,IAAI,CAAC;AAC5B;AAEO,IAAM,4BAA4B,cAAE,mBAAmB,UAAU;AAAA,EACtE,cAAE,OAAO;AAAA,IACP,GAAG;AAAA,IACH,QAAQ,cAAE,QAAQ,uBAAuB;AAAA,IACzC,UAAU,cAAE,OAAO,cAAE,OAAO,CAAC;AAAA,IAC7B,MAAM,cAAE,OAAO,EAAE,IAAI,CAAC,EAAE,SAAS;AAAA,EACnC,CAAC,EAAE,OAAO;AAAA,EACV,cAAE,OAAO;AAAA,IACP,GAAG;AAAA,IACH,QAAQ,cAAE,QAAQ,kBAAkB;AAAA,IACpC,WAAW,cAAE,OAAO,EAAE,IAAI,CAAC;AAAA,IAC3B,SAAS,cAAE,OAAO;AAAA,IAClB,YAAY,cAAE,OAAO,EAAE,IAAI,CAAC;AAAA,IAC5B,MAAM,cAAE,OAAO,EAAE,IAAI,CAAC,EAAE,SAAS;AAAA,EACnC,CAAC,EAAE,OAAO;AAAA,EACV,cAAE,OAAO;AAAA,IACP,GAAG;AAAA,IACH,QAAQ,cAAE,QAAQ,mBAAmB;AAAA,IACrC,SAAS,cAAE,MAAM,8BAA8B;AAAA,IAC/C,YAAY,cAAE,OAAO,EAAE,IAAI,CAAC,EAAE,SAAS;AAAA,EACzC,CAAC,EAAE,OAAO;AAAA,EACV,cAAE,OAAO;AAAA,IACP,GAAG;AAAA,IACH,QAAQ,cAAE,QAAQ,kBAAkB;AAAA,IACpC,MAAM,cAAE,OAAO,EAAE,IAAI,CAAC;AAAA,IACtB,YAAY,cAAE,OAAO,EAAE,IAAI,CAAC;AAAA,IAC5B,aAAa,cAAE,OAAO,EAAE,IAAI,CAAC;AAAA,EAC/B,CAAC,EAAE,OAAO;AACZ,CAAC;;;AJ5GD,IAAMC,8BAA6B;AACnC,IAAM,4BAA4B;AAClC,IAAM,mCAAmC;AACzC,IAAM,oBAAoB;AAC1B,IAAM,4BAA4B;AAClC,IAAM,4BAA4B;AAClC,IAAM,gCAAgC;AACtC,IAAM,gCAAgC;AACtC,IAAM,cAAc;AACpB,IAAM,0BAA0B,IAAI;AACpC,IAAM,mBAAmB;AACzB,IAAM,qBAAqB;AAwB3B,SAAS,aAAa,OAAwB;AAC5C,MAAI,iBAAiB,iBAAkB,QAAO,MAAM;AACpD,MAAI,iBAAiB,cAAe,QAAO,MAAM;AACjD,QAAMC,QAAO,SAAS,OAAO,UAAU,YAAY,UAAU,QAAS,MAAsC,OAAO;AACnH,MAAI,OAAOA,UAAS,SAAU,QAAO;AACrC,MAAIA,UAAS,gCAAW,0BAA0BA,UAAS,gCAAW,eAAeA,UAAS,MAAO,QAAO;AAC5G,MAAIA,UAAS,kBAAkBA,UAAS,eAAeA,UAAS,MAAO,QAAO;AAC9E,MAAIA,MAAK,SAAS,SAAS,KAAKA,UAAS,UAAW,QAAO;AAC3D,MAAIA,MAAK,SAAS,OAAO,EAAG,QAAO;AACnC,MAAIA,MAAK,SAAS,MAAM,KAAKA,MAAK,SAAS,QAAQ,KAAKA,UAAS,SAASA,UAAS,MAAO,QAAO;AACjG,MAAIA,MAAK,SAAS,SAAS,KAAKA,MAAK,SAAS,SAAS,KAAKA,UAAS,UAAW,QAAO;AACvF,MAAI,CAAC,gBAAgB,oBAAoB,WAAW,qBAAqB,gBAAgB,mBAAmB,qBAAqB,uBAAuB,kBAAkB,EAAE,SAASA,KAAI,EAAG,QAAOA;AACnM,SAAOA,MAAK,WAAW,QAAQ,IAAIA,QAAO;AAC5C;AAEA,SAAS,QAAQ,OAAkC;AACjD,MAAI,iBAAiB,iBAAkB,QAAO;AAC9C,SAAO,IAAI,iBAAiB,aAAa,KAAK,CAAC;AACjD;AAEA,SAAS,gBAAgB,QAA2D;AAClF,SAAO,WAAW,SAAS,WAAW,aAAa,SAAS,WAAW,SAAS,SAAS;AAC3F;AAEA,SAAS,cAAc,OAAuB;AAC5C,QAAM,QAAQ,MAAM,MAAM,GAAG;AAC7B,QAAM,cAAc,MAAM,KAAK,CAAC,MAAM,UAAU,SAAS,QAAQ,SAAS,OAAQ,SAAS,MAAM,EAAE,UAAU,MAAM,SAAS,KAAK,MAAM,SAAS,GAAG,EAAG;AACtJ,MAAI,UAAU,MAAM,MAAM,WAAW,GAAG,KAAK,0BAA0B,KAAK,KAAK,KAAK,eAAe,KAAK,KAAK,KAAK,aAAa;AAC/H,UAAM,IAAI,iBAAiB,oBAAoB;AAAA,EACjD;AACA,SAAO;AACT;AAEA,SAAS,sBAAsB,OAAwB;AACrD,MAAI,UAAU,QAAQ,OAAO,UAAU,YAAY,OAAO,UAAU,UAAW,QAAO,KAAK,UAAU,KAAK;AAC1G,MAAI,OAAO,UAAU,UAAU;AAC7B,QAAI,CAAC,OAAO,SAAS,KAAK,EAAG,OAAM,IAAI,iBAAiB,uBAAuB;AAC/E,WAAO,KAAK,UAAU,KAAK;AAAA,EAC7B;AACA,MAAI,MAAM,QAAQ,KAAK,EAAG,QAAO,IAAI,MAAM,IAAI,qBAAqB,EAAE,KAAK,GAAG,CAAC;AAC/E,MAAI,OAAO,UAAU,UAAU;AAC7B,UAAM,SAAS;AACf,WAAO,IAAI,OAAO,KAAK,MAAM,EAAE,KAAK,EAAE,IAAI,CAAC,QAAQ,GAAG,KAAK,UAAU,GAAG,CAAC,IAAI,sBAAsB,OAAO,GAAG,CAAC,CAAC,EAAE,EAAE,KAAK,GAAG,CAAC;AAAA,EAC9H;AACA,QAAM,IAAI,iBAAiB,uBAAuB;AACpD;AAEA,SAASC,kBAAiB,OAA2B;AACnD,MAAI,CAAC,mBAAmB,KAAK,KAAK,KAAK,MAAM,SAAS,MAAM,EAAG,OAAM,IAAI,MAAM,WAAW;AAC1F,QAAM,SAAS,MAAM,QAAQ,MAAM,GAAG,EAAE,QAAQ,MAAM,GAAG,IAAI,IAAI,QAAQ,IAAI,MAAM,SAAS,KAAK,CAAC;AAClG,QAAM,UAAU,OAAO,SAAS,aAAa,KAAK,MAAM,IAAI,OAAO,KAAK,QAAQ,QAAQ,EAAE,SAAS,QAAQ;AAC3G,QAAMC,SAAQ,WAAW,KAAK,SAAS,CAAC,SAAS,KAAK,WAAW,CAAC,CAAC;AACnE,MAAIC,kBAAiBD,MAAK,MAAM,MAAO,OAAM,IAAI,MAAM,yBAAyB;AAChF,SAAOA;AACT;AAEA,SAASC,kBAAiBD,QAA2B;AACnD,MAAI,SAAS;AACb,aAAW,QAAQA,OAAO,WAAU,OAAO,aAAa,IAAI;AAC5D,QAAM,UAAU,OAAO,SAAS,aAAa,KAAK,MAAM,IAAI,OAAO,KAAKA,MAAK,EAAE,SAAS,QAAQ;AAChG,SAAO,QAAQ,QAAQ,OAAO,GAAG,EAAE,QAAQ,OAAO,GAAG,EAAE,QAAQ,QAAQ,EAAE;AAC3E;AAEA,SAAS,YAAoB;AAC3B,QAAMA,SAAQ,IAAI,WAAW,EAAE;AAC/B,SAAO,gBAAgBA,MAAK;AAC5B,SAAOC,kBAAiBD,MAAK;AAC/B;AAEA,SAAS,gBAAgB,OAAwB;AAC/C,SAAOC,sBAAiB,uBAAO,IAAI,YAAY,EAAE,OAAO,sBAAsB,KAAK,CAAC,CAAC,CAAC;AACxF;AAEA,SAAS,WAAW,QAAgE;AAClF,SAAO,WAAW,QAAQ,qBAAqB,WAAW,aAAa,0BAA0B,WAAW,SAAS,sBAAsB;AAC7I;AAEA,SAAS,gBAAgB,OAA+C;AACtE,MAAI,UAAU,sBAAsB,UAAU,SAAS,UAAU,OAAQ,QAAO;AAChF,MAAI,UAAU,2BAA2B,UAAU,WAAY,QAAO;AACtE,MAAI,UAAU,uBAAuB,UAAU,OAAQ,QAAO;AAC9D,MAAI,UAAU,sBAAsB,UAAU,uBAAuB,UAAU,SAAS,UAAU,OAAQ,QAAO;AACjH,SAAO;AACT;AAEA,SAAS,gBAAgB,OAAyC;AAChE,QAAM,SAAS,gBAAgB,KAAK;AACpC,SAAO,WAAW,sBAAsB,WAAW,0BAA0B,SAAS,WAAW,sBAAsB,SAAS,WAAW,qBAAqB,SAAS;AAC3K;AAEA,SAAS,uBAAuB,QAAiD;AAC/E,QAAM,UAAU,OAAO,IAAI,eAAe;AAC1C,MAAI,QAAQ,KAAK,CAAC,WAAW,WAAW,MAAS,EAAG,OAAM,IAAI,iBAAiB,+BAA+B;AAC9G,SAAO,CAAC,GAAG,IAAI,IAAI,OAA8B,CAAC,EAAE,KAAK;AAC3D;AAEA,SAAS,cAAc,OAAgB,aAAoC,SAAoC;AAC7G,MAAI,OAAO,UAAU,UAAU;AAC7B,UAAM,OAAO,MAAM,SAAS,GAAG,IAAI,WAAW;AAC9C,WAAO,EAAE,MAAM,MAAM,SAAS,YAAY,CAAC,MAAM,SAAS,GAAG,IAAI,GAAG,KAAK,MAAM,MAAM;AAAA,EACvF;AACA,MAAI,CAAC,SAAS,KAAK,KAAM,MAAM,SAAS,WAAW,MAAM,SAAS,SAAW,QAAO;AACpF,QAAM,OAAO,OAAO,MAAM,SAAS,WAAW,MAAM,OAAO,OAAO,MAAM,UAAU,WAAW,MAAM,QAAQ;AAC3G,SAAO,SAAS,SAAY,SAAY,EAAE,MAAM,MAAM,MAAM,MAAM,MAAM,SAAS,YAAY,CAAC,KAAK,SAAS,GAAG,IAAI,GAAG,IAAI,MAAM,KAAK;AACvI;AAEA,SAAS,cAAc,SAA6D;AAClF,MAAI,YAAY,OAAW,QAAO,CAAC;AACnC,MAAI,MAAM,QAAQ,OAAO,EAAG,QAAO,OAAO,YAAY,QAAQ,IAAI,CAAC,CAAC,KAAK,KAAK,MAAM,CAAC,IAAI,YAAY,GAAG,KAAK,CAAC,CAAC;AAC/G,SAAO,OAAO,YAAY,OAAO,QAAQ,OAAO,EAAE,IAAI,CAAC,CAAC,KAAK,KAAK,MAAM,CAAC,IAAI,YAAY,GAAG,KAAK,CAAC,CAAC;AACrG;AAEA,SAAS,SAAS,OAAkD;AAClE,SAAO,UAAU,QAAQ,OAAO,UAAU,YAAY,CAAC,MAAM,QAAQ,KAAK;AAC5E;AAEA,SAAS,gBAAgB,QAA2E;AAClG,SAAO,UAAU;AACnB;AAEA,SAAS,oBAAoB,OAAgC,KAAsG;AACjK,QAAM,aAAwC,CAAC,KAAK;AACpD,aAAW,WAAW,CAAC,QAAQ,UAAU,QAAQ,UAAU,GAAY;AACrE,QAAI,SAAS,MAAM,OAAO,CAAC,EAAG,YAAW,KAAK,MAAM,OAAO,CAAC;AAAA,EAC9D;AACA,aAAW,aAAa,YAAY;AAClC,UAAM,UAAU,UAAU,GAAG;AAC7B,QAAI,SAAS,OAAO,GAAG;AACrB,YAAM,QAAQ,UAAU,SAAS,MAAM,SAAS,QAAQ;AACxD,UAAI,UAAU,OAAW,QAAO,EAAE,SAAS,MAAM;AAAA,IACnD;AAAA,EACF;AACA,QAAM,IAAI,iBAAiB,yBAAyB,QAAQ,GAAG,gCAAgC;AACjG;AAEA,SAAS,eAAe,OAAwB;AAC9C,MAAI,UAAU,QAAQ,OAAO,UAAU,YAAY,OAAO,UAAU,UAAW,QAAO,KAAK,UAAU,KAAK;AAC1G,MAAI,OAAO,UAAU,YAAY,OAAO,SAAS,KAAK,EAAG,QAAO,KAAK,UAAU,KAAK;AACpF,MAAI,MAAM,QAAQ,KAAK,EAAG,QAAO,IAAI,MAAM,IAAI,cAAc,EAAE,KAAK,GAAG,CAAC;AACxE,MAAI,SAAS,KAAK,EAAG,QAAO,IAAI,OAAO,KAAK,KAAK,EAAE,KAAK,EAAE,IAAI,CAAC,QAAQ,GAAG,KAAK,UAAU,GAAG,CAAC,IAAI,eAAe,MAAM,GAAG,CAAC,CAAC,EAAE,EAAE,KAAK,GAAG,CAAC;AACxI,QAAM,IAAI,iBAAiB,uBAAuB;AACpD;AAEA,SAAS,kBAAkB,MAAe,OAAgB,SAAuB;AAC/E,MAAI,SAAS,UAAa,UAAU,UAAa,eAAe,IAAI,MAAM,eAAe,KAAK,GAAG;AAC/F,UAAM,IAAI,iBAAiB,yBAAyB,OAAO;AAAA,EAC7D;AACF;AAEA,SAAS,UAAU,OAAoC;AACrD,MAAI,OAAO,UAAU,SAAU,QAAO;AACtC,QAAM,SAAS,KAAK,MAAM,KAAK;AAC/B,SAAO,OAAO,SAAS,MAAM,IAAI,SAAS;AAC5C;AAEA,SAAS,iBAAiB,OAAgC,SAA4B,OAAqB;AACzG,QAAM,OAAO,IAAI,IAAI,OAAO;AAC5B,MAAI,OAAO,KAAK,KAAK,EAAE,KAAK,CAAC,QAAQ,CAAC,KAAK,IAAI,GAAG,CAAC,EAAG,OAAM,IAAI,iBAAiB,yBAAyB,GAAG,KAAK,4BAA4B;AAChJ;AAEA,SAAS,iBAAiB,UAAoC;AAG5D,SAAO,SAAS,kBAAkB,YAAa,SAAS,kBAAkB,UAAa,SAAS,cAAc,SAAS,4BAA4B,UAAa,SAAS,4BAA4B;AACvM;AAEA,SAAS,aAAa,SAAyB,UAAkB,OAAe,SAAiC;AAC/G,QAAM,gBAAgB,QAAQ,kBAAkB;AAChD,MAAI,OAAO,kBAAkB,YAAY,cAAc,WAAW,EAAG,OAAM,IAAI,iBAAiB,wBAAwB;AACxH,SAAO,EAAE,eAAe,cAAc;AACxC;AAEO,IAAM,uBAAN,MAA2B;AAAA,EAKhC,YAA6B,SAAsC;AAAtC;AAC3B,SAAK,UAAU,QAAQ,SAAU,WAAW,MAAM,KAAK,UAAU;AACjE,SAAK,QAAQ,QAAQ,SAAS,IAAI,iBAAiB;AACnD,SAAK,MAAM,QAAQ,QAAQ,MAAM,oBAAI,KAAK;AAAA,EAC5C;AAAA,EAEA,MAAM,KAAK,MAAsC;AAC/C,QAAI;AACF,YAAM,WAAW,MAAM,KAAK,QAAQ,IAAI;AACxC,YAAM,EAAE,SAAS,IAAI,SAAS;AAC9B,YAAM,EAAE,SAAS,IAAI;AACrB,YAAM,SAAS,iBAAiB,QAAQ;AACxC,YAAM,SAAS,SAAS,kBAAkB,gBAAgB,SAAS,kBAAkB,iBAAiB,SAAS,4BAA4B;AAC3I,YAAM,eAAe,CAAC,UAAU,SAAS,kBAAkB;AAC3D,UAAI;AACJ,UAAI,SAAS,4BAA4B,gBAAgB;AACvD,YAAI,KAAK,QAAQ,iCAAiC,OAAW,OAAM,IAAI,iBAAiB,8BAA8B,6CAA6C;AACnK,cAAM,gBAAgB,MAAM,KAAK,QAAQ,6BAA6B,EAAE,UAAU,cAAc,SAAS,WAAW,SAAS,iBAAiB,SAAS,UAAU,QAAQ,GAAG,CAAC;AAC7K,YAAI,WAAW,eAAe;AAC5B,cAAI,cAAc,UAAU,yBAA0B,OAAM,IAAI,iBAAiB,8BAA8B,+CAA+C,aAAa;AAC3K,gBAAM,IAAI,iBAAiB,gBAAgB,0CAA0C,aAAa;AAAA,QACpG;AACA,8BAAsB;AAAA,MACxB;AACA,UAAI,UAAU,KAAK,QAAQ,kBAAkB,OAAW,OAAM,IAAI,iBAAiB,8BAA8B;AACjH,UAAI,UAAU,KAAK,QAAQ,iBAAiB,OAAW,OAAM,IAAI,iBAAiB,oCAAoC;AAEtH,YAAM,UAAU,UAAU,eACtB,KAAK,QAAQ,gBACb,sBACE,sBACF,UAAU,KAAK,QAAQ,2BAA2B,SAChD,MAAM,KAAK,QAAQ,uBAAuB,EAAE,UAAU,cAAc,KAAK,QAAQ,aAAa,CAAC,IAC/F,SAAS,MAAM,KAAK,uBAAuB,QAAQ,IAAI;AAC7D,YAAM,KAAK,UAAU,eACjB,YAAY,SAAY,SAAY,KAAK,SAAS,SAAS,QAAQ,OAAyB,IAC5F;AACJ,YAAM,gBAAgB,SAAS,UAA4C;AAC3E,UAAI,kBAAkB,OAAW,MAAK,4BAA4B,eAAe,QAAQ;AACzF,YAAM,uBAA4C,EAAE,SAAS,SAAS,SAAS,UAAU,SAAS,UAAU,SAAS,SAAS,QAAQ;AACtI,YAAM,aAAa,eAAe,eAAe,SAC7C,uBACA,2BAA2B,sBAAsB,cAAc,UAAU;AAC7E,UAAI,eAAe,OAAW,OAAM,IAAI,iBAAiB,wBAAwB;AAEjF,YAAM,MAAM,OAAO,OAAO,SAAS,SAAS,SAAS,UAAU,SAAS,SAAS,OAAO,OAAiC;AACvH,YAAI;AACF,gBAAM,eAAe,cAAc,IAAI;AACvC,eAAK,cAAc,YAAY,OAAO,YAAY;AAClD,cAAI,OAAO,QAAW;AACpB,kBAAM,SAAS,MAAM,GAAG,IAAgB,cAAc,EAAE,QAAQ,MAAM,kBAAkB,KAAK,QAAQ,mBAAmB,0BAA0B,CAAC;AACnJ,gBAAI,CAAC,OAAO,GAAI,OAAM,OAAO;AAC7B,mBAAO,EAAE,OAAO,OAAO,KAAK,MAAM,MAAM,OAAO,KAAK,QAAQ,MAAM,aAAa,OAAO,KAAK,QAAQ,aAAa,MAAM,OAAO,KAAK,KAAK,WAAW;AAAA,UACpJ;AACA,cAAI,kBAAkB,OAAW,QAAO,KAAK,UAAU,UAAU,eAAe,YAAY;AAC5F,cAAI,UAAU,SAAS,SAAS,SAAS,WAAW,iBAAiB,SAAS,SAAS,KAAM,OAAM,IAAI,iBAAiB,wBAAwB;AAChJ,iBAAO,EAAE,OAAO,SAAS,UAAU,MAAM,GAAG,aAAa,SAAS,QAAQ,UAAU,MAAM,SAAS,UAAU,WAAW;AAAA,QAC1H,SAAS,OAAO;AACd,gBAAM,QAAQ,KAAK;AAAA,QACrB;AAAA,MACF;AAEA,YAAM,eAAe,OAAO,QAAuF,CAAC,MAAgC;AAClJ,YAAI;AACF,gBAAM,QAAQ,cAAc,MAAM,QAAQ,SAAS,SAAS,IAAI;AAChE,eAAK,cAAc,YAAY,QAAQ,KAAK;AAC5C,cAAI,OAAO,UAAa,kBAAkB,OAAW,OAAM,IAAI,iBAAiB,wBAAwB;AACxG,cAAI,kBAAkB,OAAW,QAAO,KAAK,WAAW,UAAU,eAAe,OAAO,MAAM,OAAO,MAAM,MAAM;AACjH,gBAAM,SAAS,MAAM,GAAI,KAAK,EAAE,MAAM,OAAO,OAAO,MAAM,OAAO,QAAQ,MAAM,OAAO,CAAC;AACvF,cAAI,CAAC,OAAO,GAAI,OAAM,OAAO;AAE7B,iBAAO,EAAE,MAAM,OAAO,KAAK,MAAM,WAAW,OAAO,KAAK,WAAW,YAAY,OAAO,KAAK,WAAW;AAAA,QACxG,SAAS,OAAO;AACd,gBAAM,QAAQ,KAAK;AAAA,QACrB;AAAA,MACF;AAEA,YAAM,OAAO,OAAO,MAAcD,QAAmB,UAAyG;AAC5J,YAAI;AACF,gBAAM,eAAe,cAAc,IAAI;AACvC,eAAK,cAAc,YAAY,QAAQ,YAAY;AACnD,cAAI,OAAO,UAAa,kBAAkB,OAAW,OAAM,IAAI,iBAAiB,wBAAwB;AACxG,cAAI,kBAAkB,OAAW,QAAO,KAAK,WAAW,UAAU,eAAe,cAAcA,QAAO,KAAK;AAC3G,gBAAM,SAAS,MAAM,GAAI,IAAI,cAAcA,QAAO,EAAE,aAAa,MAAM,eAAe,SAAS,QAAQ,UAAU,SAAS,MAAM,KAAK,CAAC;AACtI,cAAI,CAAC,OAAO,IAAI;AACd,gBAAI,OAAO,MAAM,SAAS,gCAAW,0BAA0B,OAAO,MAAM,SAAS,gCAAW,YAAa,OAAM,IAAI,cAAc,cAAc,OAAO,MAAM,MAAM,IAA0B;AAChM,kBAAM,OAAO;AAAA,UACf;AACA,iBAAO,EAAE,MAAM,OAAO,KAAK,QAAQ,KAAK;AAAA,QAC1C,SAAS,OAAO;AACd,cAAI,iBAAiB,cAAe,OAAM;AAC1C,gBAAM,QAAQ,KAAK;AAAA,QACrB;AAAA,MACF;AAEA,YAAM,WAAW,OAAO,OAAO,SAAS,SAAS,SAAS,UAAU,SAAS,SAAS,OAAO,OAAqC;AAChI,cAAM,eAAe,cAAc,IAAI;AACvC,aAAK,cAAc,YAAY,YAAY,YAAY;AACvD,YAAI,kBAAkB,OAAW,QAAO,KAAK,eAAe,UAAU,eAAe,YAAY;AACjG,YAAI,OAAO,OAAW,OAAM,IAAI,iBAAiB,wBAAwB;AACzE,cAAM,SAAS,MAAM,GAAG,KAAK,YAAY;AACzC,YAAI,CAAC,OAAO,GAAI,OAAM,OAAO;AAC7B,eAAO,EAAE,UAAU,EAAE,gBAAgB,OAAO,KAAK,QAAQ,eAAe,4BAA4B,kBAAkB,OAAO,OAAO,KAAK,QAAQ,iBAAiB,EAAE,GAAG,GAAI,OAAO,KAAK,QAAQ,iBAAiB,SAAY,CAAC,IAAI,EAAE,iBAAiB,OAAO,KAAK,QAAQ,aAAa,EAAG,GAAG,MAAM,OAAO,KAAK,QAAQ,MAAM,aAAa,OAAO,KAAK,QAAQ,aAAa,MAAM,OAAO,KAAK,QAAQ,cAAc;AAAA,MACnZ;AAEA,aAAO,EAAE,MAAM,YAAY,UAAU,UAAU,EAAE,GAAG,UAAU,KAAK,OAAU,GAAG,UAAU,SAAS,UAAU,SAAS,SAAS,SAAS,WAAW,IAAI,KAAK,SAAS,SAAS,GAAG,IAAI,KAAK,cAAc,MAAM,SAAS;AAAA,IACzN,SAAS,OAAO;AACd,YAAM,QAAQ,KAAK;AAAA,IACrB;AAAA,EACF;AAAA,EAEQ,SAAS,QAAgB,SAAqC;AACpE,QAAI,KAAK,QAAQ,oBAAoB,QAAW;AAC9C,aAAO,KAAK,QAAQ,gBAAgB,EAAE,OAAO,CAAC,MAAM,GAAG,SAAS,QAAQ,KAAK,QAAQ,UAAU,cAAc,OAAO,KAAK,QAAQ,CAAC;AAAA,IACpI;AACA,UAAM,UAAU,IAAI,oCAAe,EAAE,OAAO,CAAC,MAAM,GAAG,SAAS,QAAQ,KAAK,QAAQ,UAAU,cAAc,OAAO,KAAK,QAAQ,CAAC;AACjI,UAAM,UAAU,IAAI,+BAAU,EAAE,QAAQ,GAAG,CAAC;AAC5C,YAAQ,gBAAgB,MAAM,OAAO;AACrC,YAAQ,WAAW,OAAO;AAC1B,WAAO;AAAA,EACT;AAAA,EAEA,MAAc,UAAU,UAA2B,SAA6B,MAAwC;AACtH,SAAK,0BAA0B,UAAU,SAAS,OAAO,IAAI;AAC7D,UAAM,SAAS,MAAM,KAAK,aAAa,EAAE,UAAU,SAAS,QAAQ,OAAO,UAAU,MAAM,WAAW,uCAAuC,CAAC;AAC9I,QAAI,OAAO,WAAW,IAAK,OAAM,IAAI,iBAAiB,iBAAiB;AACvE,QAAI,OAAO,WAAW,OAAO,OAAO,WAAW,IAAK,OAAM,IAAI,iBAAiB,cAAc;AAC7F,QAAI,CAAC,gBAAgB,MAAM,EAAG,OAAM,IAAI,iBAAiB,mBAAmB;AAC5E,QAAI,OAAO,SAAS,OAAO,OAAO,UAAU,OAAO,OAAO,UAAU,OAAW,OAAM,IAAI,iBAAiB,mBAAmB;AAC7H,SAAK,qBAAqB,OAAO,OAAO,OAAO,SAAS,OAAO,UAAU;AACzE,QAAI,OAAO,MAAM,cAAc,KAAK,QAAQ,mBAAmB,2BAA4B,OAAM,IAAI,iBAAiB,iBAAiB;AACvI,WAAO,EAAE,OAAO,OAAO,OAAO,MAAM,OAAO,SAAS,QAAQ,OAAO,MAAM,aAAa,OAAO,UAAU,cAAc,KAAK,OAAO,eAAe,SAAS,QAAQ,UAAU,MAAM,OAAO,MAAM,WAAW;AAAA,EAC3M;AAAA,EAEA,MAAc,eAAe,UAA2B,SAA6B,MAA4C;AAC/H,SAAK,0BAA0B,UAAU,SAAS,YAAY,IAAI;AAClE,UAAM,SAAS,MAAM,KAAK,aAAa,EAAE,UAAU,SAAS,QAAQ,YAAY,UAAU,MAAM,WAAW,uCAAuC,CAAC;AACnJ,QAAI,OAAO,WAAW,IAAK,OAAM,IAAI,iBAAiB,iBAAiB;AACvE,QAAI,OAAO,WAAW,OAAO,OAAO,WAAW,IAAK,OAAM,IAAI,iBAAiB,cAAc;AAC7F,QAAI,CAAC,gBAAgB,MAAM,KAAK,OAAO,aAAa,OAAW,OAAM,IAAI,iBAAiB,mBAAmB;AAC7G,WAAO,EAAE,UAAU,OAAO,UAAU,MAAM,OAAO,SAAS,QAAQ,OAAO,MAAM,aAAa,OAAO,UAAU,cAAc,KAAK,OAAO,YAAY;AAAA,EACrJ;AAAA,EAEA,MAAc,WAAW,UAA2B,SAA6B,MAAc,OAAgB,QAA2C;AACxJ,SAAK,0BAA0B,UAAU,SAAS,QAAQ,MAAM,OAAO,MAAM;AAC7E,UAAM,SAAS,MAAM,KAAK,aAAa,EAAE,UAAU,SAAS,QAAQ,QAAQ,UAAU,MAAM,OAAO,QAAQ,WAAW,uCAAuC,CAAC;AAC9J,QAAI,OAAO,WAAW,OAAO,OAAO,WAAW,IAAK,OAAM,IAAI,iBAAiB,cAAc;AAC7F,QAAI,OAAO,SAAS,OAAO,OAAO,UAAU,IAAK,OAAM,IAAI,iBAAiB,mBAAmB;AAC/F,QAAI,CAAC,gBAAgB,MAAM,EAAG,OAAM,IAAI,iBAAiB,mBAAmB;AAC5E,UAAM,OAAO,OAAO,QAAQ,OAAO,SAAS,IAAI,CAAC,UAAU,MAAM,IAAI;AACrE,QAAI,SAAS,OAAW,OAAM,IAAI,iBAAiB,mBAAmB;AACtE,UAAM,eAAe,OAAO,UAAU,yBAAyB;AAC/D,QAAI,iBAAiB,UAAa,OAAO,eAAe,UAAa,iBAAiB,OAAO,WAAY,OAAM,IAAI,iBAAiB,0BAA0B;AAC9J,SAAK,uBAAuB,MAAM,EAAE,GAAG,QAAQ,KAAK,CAAC;AACrD,WAAO,EAAE,MAAM,SAAS,OAAO,SAAS,WAAW,OAAO,WAAW,YAAY,OAAO,WAAW;AAAA,EACrG;AAAA,EAEA,MAAc,WAAW,UAA2B,SAA6B,MAAcA,QAAmB,OAAsG;AACtN,SAAK,0BAA0B,UAAU,SAAS,OAAO,IAAI;AAC7D,QAAIA,OAAM,cAAc,KAAK,QAAQ,mBAAmB,2BAA4B,OAAM,IAAI,iBAAiB,iBAAiB;AAChI,UAAM,cAAc,MAAM,eAAe,SAAS,QAAQ;AAC1D,QAAI,gBAAgB,SAAS,QAAQ,YAAY,CAAC,oCAAoC,KAAK,WAAW,EAAG,OAAM,IAAI,iBAAiB,4BAA4B;AAChK,UAAM,SAAS,MAAM,KAAK,aAAa,EAAE,UAAU,SAAS,QAAQ,OAAO,UAAU,MAAM,MAAMA,QAAO,YAAYC,sBAAiB,uBAAOD,MAAK,CAAC,GAAG,aAAa,SAAS,MAAM,MAAM,WAAW,uCAAuC,CAAC;AAC1O,QAAI,OAAO,WAAW,OAAO,OAAO,WAAW,IAAK,OAAM,IAAI,cAAc,MAAM,OAAO,SAAS,IAAI;AACtG,QAAI,OAAO,WAAW,OAAO,OAAO,WAAW,IAAK,OAAM,IAAI,iBAAiB,cAAc;AAC7F,QAAI,OAAO,SAAS,OAAO,OAAO,UAAU,IAAK,OAAM,IAAI,iBAAiB,oBAAoB;AAChG,QAAI,CAAC,gBAAgB,MAAM,EAAG,OAAM,IAAI,iBAAiB,oBAAoB;AAC7E,WAAO,EAAE,MAAM,OAAO,SAAS,QAAQ,OAAO,KAAK;AAAA,EACrD;AAAA,EAEA,MAAc,aAAa,OAAkH;AAC3I,QAAI,KAAK,QAAQ,iBAAiB,QAAW;AAC3C,YAAM,SAAS,MAAM,KAAK,QAAQ,aAAa,KAAK;AACpD,UAAI,CAAC,OAAO,cAAc,OAAO,MAAM,KAAK,OAAO,SAAS,OAAO,OAAO,SAAS,IAAK,OAAM,IAAI,iBAAiB,wBAAwB;AAC3I,UAAI,OAAO,UAAU,OAAO,OAAO,SAAS,IAAK,MAAK,qBAAqB,OAAO,MAAM;AACxF,aAAO;AAAA,IACT;AACA,UAAME,QAAO,MAAM,SAAS,OAAO,QAAQ,OAAO,EAAE;AACpD,QAAI,MAAM,cAAc,kBAAmB,OAAM,IAAI,iBAAiB,iCAAiC;AACvG,UAAM,UAAU,MAAM;AACtB,UAAM,UAAU,KAAK,QAAQ;AAC7B,UAAM,KAAK,QAAQ,YAAY,KAAK,SAAS,oBAAoB;AACjE,UAAM,WAAW,CAACC,QAAgBC,UAAyB;AACzD,UAAI,OAAOD,WAAU,YAAYA,OAAM,WAAW,EAAG,OAAM,IAAI,iBAAiB,yBAAyB,gBAAgBC,KAAI,aAAa;AAC1I,aAAOD;AAAA,IACT;AACA,UAAM,gBAAgB,QAAQ,iBAAiB,SAAS;AACxD,QAAI,CAAC,SAAS,aAAa,EAAG,OAAM,IAAI,iBAAiB,yBAAyB,gCAAgC;AAClH,UAAM,MAAM,KAAK,IAAI,EAAE,QAAQ;AAC/B,UAAM,SAAS,KAAK;AAAA,MAClB,MAAM;AAAA,MACN,UAAU,QAAQ,SAAS,KAAK;AAAA,MAChC,UAAU,MAAM,SAAS,SAAS,KAAK;AAAA,IACzC;AACA,QAAI,CAAC,OAAO,SAAS,MAAM,KAAK,UAAU,IAAK,OAAM,IAAI,iBAAiB,yBAAyB,6BAA6B;AAChI,UAAM,iBAAiB,WAAW,MAAM,MAAM;AAC9C,UAAM,eAAe,QAAQ,YAAY,SACrC,QAAQ,UACR,SAAS,YAAY,SACnB,QAAQ,UACR,QAAQ,WAAW,SACjB,CAAC,QAAQ,MAAM,IACf,SAAS,WAAW,SAClB,CAAC,QAAQ,MAAM,IACf,CAAC;AACX,UAAM,oBAAoB,uBAAuB,YAAY;AAC7D,QAAI,CAAC,kBAAkB,SAAS,cAAc,EAAG,OAAM,IAAI,iBAAiB,+BAA+B;AAC3G,UAAM,iBAAiB,cAAc,QAAQ,YAAY,SAAS,YAAY,MAAM,SAAS,UAAU,MAAM,SAAS,SAAS,IAAI;AACnI,QAAI,mBAAmB,UAAa,CAAC,sBAAsB,EAAE,SAAS,MAAM,SAAS,SAAS,UAAU,gBAAgB,SAAS,CAAC,gBAAgB,cAAc,CAAE,EAAE,GAAG,gBAAgB,cAAc,GAAI,MAAM,QAAQ,GAAG;AACxN,YAAM,IAAI,iBAAiB,oBAAoB;AAAA,IACjD;AACA,UAAM,iBAA0C;AAAA,MAC9C,MAAM;AAAA,MACN,SAAS;AAAA,MACT,WAAW,SAAS,QAAQ,WAAW,WAAW;AAAA,MAClD,UAAU,SAAS,QAAQ,YAAY,SAAS,UAAU,UAAU;AAAA,MACpE,SAAS,SAAS,QAAQ,WAAW,SAAS,SAAS,SAAS;AAAA,MAChE,eAAe,SAAS,QAAQ,iBAAiB,SAAS,eAAe,eAAe;AAAA,MACxF,WAAW,SAAS,QAAQ,aAAa,SAAS,WAAW,WAAW;AAAA,MACxE,GAAI,KAAK;AAAA,QACP,aAAa,SAAS,QAAQ,eAAe,SAAS,aAAa,aAAa;AAAA,QAChF,iBAAiB,SAAS,QAAQ,mBAAmB,SAAS,iBAAiB,iBAAiB;AAAA,QAChG,0BAA0B,SAAS,QAAQ,4BAA4B,SAAS,0BAA0B,0BAA0B;AAAA,MACtI,IAAI;AAAA,QACF,yBAAyB,SAAS,QAAQ,2BAA2B,SAAS,yBAAyB,yBAAyB;AAAA,QAChI,yBAAyB,SAAS,QAAQ,2BAA2B,SAAS,yBAAyB,yBAAyB;AAAA,MAClI;AAAA,MACA;AAAA,MACA,qBAAqB,SAAS,QAAQ,uBAAuB,SAAS,qBAAqB,qBAAqB;AAAA,MAChH,WAAW,SAAS,QAAQ,WAAW,WAAW;AAAA,MAClD,GAAI,KAAK,CAAC,IAAI,EAAE,cAAc,SAAS,QAAQ,gBAAgB,SAAS,gBAAgB,MAAM,SAAS,QAAQ,cAAc,EAAE;AAAA,MAC/H,cAAc,SAAS,QAAQ,gBAAgB,SAAS,cAAc,cAAc;AAAA,MACpF,QAAQ;AAAA,MACR,SAAS;AAAA,MACT,UAAU,MAAM;AAAA,MAChB,UAAU,IAAI,KAAK,GAAG,EAAE,YAAY;AAAA,MACpC,WAAW,IAAI,KAAK,MAAM,EAAE,YAAY;AAAA,MACxC,KAAK,UAAU;AAAA,MACf,GAAI,MAAM,eAAe,SAAY,CAAC,IAAI,EAAE,YAAY,MAAM,WAAW;AAAA,MACzE,GAAI,MAAM,YAAY,SAAY,CAAC,IAAI,EAAE,SAAS,MAAM,QAAQ;AAAA,MAChE,GAAI,MAAM,gBAAgB,SAAY,CAAC,IAAI,EAAE,aAAa,MAAM,YAAY;AAAA,MAC5E,GAAI,KAAK,CAAC,IAAI,EAAE,GAAI,MAAM,UAAU,SAAY,CAAC,IAAI,EAAE,OAAO,MAAM,MAAM,GAAI,GAAI,MAAM,WAAW,SAAY,CAAC,IAAI,EAAE,QAAQ,MAAM,OAAO,GAAI,IAAI,QAAQ,aAAa,SAAS,eAAe,SAAY,CAAC,IAAI,EAAE,WAAW,QAAQ,aAAa,SAAS,UAAU,GAAG,IAAI,QAAQ,aAAa,SAAS,eAAe,SAAY,CAAC,IAAI,EAAE,WAAW,QAAQ,aAAa,SAAS,UAAU,EAAE;AAAA,IACpY;AACA,UAAM,oBAAoB,gBAAgB,cAAc;AACxD,UAAM,aAAsC,EAAE,GAAG,gBAAgB,kBAAkB;AACnF,UAAM,SAAS,KAAK,QAAQ,gBAAgB,QAAQ;AACpD,QAAI,WAAW,OAAW,OAAM,IAAI,iBAAiB,8BAA8B;AACnF,UAAM,QAAQ,MAAM,OAAO,EAAE,QAAQ,KAAK,4BAA4B,2BAA2B,SAAS,WAAW,CAAC;AACtH,SAAK,oBAAoB,KAAK;AAC9B,UAAM,UAAmC,KACrC;AAAA,MACA,WAAW,WAAW;AAAA,MACtB,aAAa,WAAW;AAAA,MACxB,UAAU,WAAW;AAAA,MACrB,SAAS,WAAW;AAAA,MACpB,iBAAiB,WAAW;AAAA,MAC5B,eAAe,WAAW;AAAA,MAC1B,WAAW,WAAW;AAAA,MACtB,0BAA0B,WAAW;AAAA,MACrC;AAAA,MACA,qBAAqB,WAAW;AAAA,MAChC,WAAW,WAAW;AAAA,MACtB,cAAc,WAAW;AAAA,MACzB,QAAQ,WAAW;AAAA,MACnB,SAAS,WAAW;AAAA,MACpB,UAAU,WAAW;AAAA,MACrB;AAAA,MACA;AAAA,MACA;AAAA,IACF,IACE;AAAA,MACA,WAAW,WAAW;AAAA,MACtB,eAAe,WAAW;AAAA,MAC1B,yBAAyB,WAAW;AAAA,MACpC,yBAAyB,WAAW;AAAA,MACpC;AAAA,MACA,qBAAqB,WAAW;AAAA,MAChC,QAAQ,WAAW;AAAA,MACnB,SAAS,WAAW;AAAA,MACpB,UAAU,WAAW;AAAA,MACrB;AAAA,MACA;AAAA,MACA;AAAA,IACF;AACF,UAAM,OAAO;AAAA,MACX;AAAA,MACA,GAAI,MAAM,UAAU,SAAY,CAAC,IAAI,EAAE,OAAO,MAAM,MAAM;AAAA,MAC1D,GAAI,MAAM,WAAW,SAAY,CAAC,IAAI,EAAE,QAAQ,MAAM,OAAO;AAAA,MAC7D,GAAI,MAAM,SAAS,SAAY,CAAC,IAAI,EAAE,MAAMF,kBAAiB,MAAM,IAAI,EAAE;AAAA,MACzE,GAAI,MAAM,eAAe,SAAY,CAAC,IAAI,EAAE,YAAY,MAAM,WAAW;AAAA,MACzE,GAAI,MAAM,YAAY,SAAY,CAAC,IAAI,EAAE,SAAS,MAAM,QAAQ;AAAA,MAChE,GAAI,MAAM,gBAAgB,SAAY,CAAC,IAAI,EAAE,aAAa,MAAM,YAAY;AAAA,IAC9E;AACA,UAAM,SAAS,KAAK,QAAQ,qBAAqB,SAC7C,SACA,MAAM,KAAK,QAAQ,iBAAiB,EAAE,UAAU,MAAM,UAAU,SAAS,MAAM,SAAS,SAAS,KAAK,CAAC;AAC3G,UAAM,YAAY,KAAK,QAAQ,WAAW,UAAa,QAAQ,kBAAkB,UAAa,QAAQ,qBAAqB,SACvH,KAAK,qBAAqB,SAAS,MAAM,QAAQ,MAAM,UAAU,IAAI,IACrE;AACJ,UAAM,WAAW,MAAM,KAAK,QAAQ,KAAK,GAAGC,KAAI,qBAAqB,GAAGA,KAAI,WAAW;AAAA,MACrF,QAAQ;AAAA,MACR,SAAS,EAAE,GAAG,cAAc,SAAS,GAAG,GAAG,cAAc,MAAM,GAAG,gBAAgB,MAAM,WAAW,QAAQ,MAAM,UAAU;AAAA,MAC3H,MAAM,KAAK,UAAU,IAAI;AAAA,MACzB,UAAU;AAAA,IACZ,CAAC;AACD,QAAK,SAA0D,eAAe,QAAQ,SAAS,UAAU,OAAO,SAAS,SAAS,IAAK,OAAM,IAAI,iBAAiB,yBAAyB;AAC3L,UAAM,UAAkC,CAAC;AACzC,eAAWE,SAAQ,CAAC,QAAQ,gBAAgB,kBAAkB,8BAA8B,mBAAmB,2BAA2B,yBAAyB,GAAG;AACpK,YAAMD,SAAQ,SAAS,QAAQ,IAAIC,KAAI;AACvC,UAAID,WAAU,KAAM,SAAQC,KAAI,IAAID;AAAA,IACtC;AACA,QAAI,SAAS,SAAS,OAAO,SAAS,UAAU,IAAK,QAAO,EAAE,QAAQ,SAAS,QAAQ,QAAQ;AAC/F,UAAM,cAAc,SAAS,QAAQ,IAAI,cAAc,KAAK;AAC5D,QAAI,CAAC,YAAY,YAAY,EAAE,SAAS,MAAM,EAAG,OAAM,IAAI,iBAAiB,wBAAwB;AACpG,QAAI;AACJ,QAAI;AACJ,QAAI;AAAE,sBAAgB,IAAI,WAAW,MAAM,SAAS,YAAY,CAAC;AAAA,IAAG,QAAQ;AAAE,YAAM,IAAI,iBAAiB,wBAAwB;AAAA,IAAG;AACpI,QAAI,cAAc,cAAc,KAAK,QAAQ,oBAAoBN,6BAA6B,OAAM,IAAI,iBAAiB,iBAAiB;AAC1I,QAAI;AAAE,cAAQ,KAAK,MAAM,IAAI,YAAY,SAAS,EAAE,OAAO,KAAK,CAAC,EAAE,OAAO,aAAa,CAAC;AAAA,IAAG,QAAQ;AAAE,YAAM,IAAI,iBAAiB,wBAAwB;AAAA,IAAG;AAC3J,UAAM,SAAS,0BAA0B,UAAU,KAAK;AACxD,QAAI,CAAC,OAAO,QAAS,OAAM,IAAI,iBAAiB,wBAAwB;AACxE,UAAM,SAAS,OAAO;AACtB,UAAM,iBAAiB,WAAW,MAAM,MAAM;AAC9C,QAAI,OAAO,WAAW,kBAAkB,OAAO,YAAY,KAAK,OAAO,aAAa,MAAM,UAAU;AAClG,YAAM,IAAI,iBAAiB,yBAAyB;AAAA,IACtD;AACA,QAAI,OAAO,SAAS,UAAa,OAAO,SAAS,QAAQ,QAAQ,SAAS,UAAa,OAAO,SAAS,QAAQ,KAAM,OAAM,IAAI,iBAAiB,0BAA0B;AAC1K,QAAI,OAAO,SAAS,UAAa,OAAO,SAAS,KAAM,SAAQ,OAAO,OAAO;AAC7E,QAAI,MAAM,WAAW,QAAQ;AAC3B,UAAI,OAAO,YAAY,OAAW,OAAM,IAAI,iBAAiB,wBAAwB;AACrF,YAAM,aAAa,OAAO;AAC1B,UAAI,WAAW,SAAS,mBAAoB,OAAM,IAAI,iBAAiB,iBAAiB;AACxF,YAAM,UAA4B,CAAC,GAAG,UAAU;AAChD,YAAM,eAAe,SAAS,QAAQ,IAAI,yBAAyB;AACnE,UAAI,OAAO,eAAe,UAAa,OAAO,eAAe,QAAQ,iBAAiB,QAAQ,OAAO,eAAe,aAAc,OAAM,IAAI,iBAAiB,0BAA0B;AACvL,YAAM,aAAc,OAAO,cAAc,gBAAiB;AAC1D,UAAI,eAAe,UAAa,IAAI,YAAY,EAAE,OAAO,UAAU,EAAE,aAAa,wBAAyB,OAAM,IAAI,iBAAiB,iBAAiB;AACvJ,aAAO,EAAE,QAAQ,SAAS,QAAQ,SAAS,MAAM,OAAO,MAAM,SAAS,OAAO,SAAS,QAAQ,OAAO,QAAQ,UAAU,OAAO,UAAU,MAAM,QAAQ,IAAI,CAAC,UAAU,MAAM,IAAI,GAAG,SAAS,WAAW,eAAe,QAAW,WAAW;AAAA,IAC9O;AACA,QAAI,MAAM,WAAW,OAAO;AAC1B,UAAI,OAAO,YAAY,UAAa,OAAO,eAAe,OAAW,OAAM,IAAI,iBAAiB,wBAAwB;AACxH,UAAIG;AACJ,UAAI;AAAE,QAAAA,SAAQD,kBAAiB,OAAO,OAAO;AAAA,MAAG,QAAQ;AAAE,cAAM,IAAI,iBAAiB,wBAAwB;AAAA,MAAG;AAChH,UAAIC,OAAM,cAAc,KAAK,QAAQ,mBAAmB,8BAA8B,CAAC,KAAK,cAAc,OAAO,YAAYA,MAAK,EAAG,OAAM,IAAI,iBAAiB,0BAA0B;AAC1L,aAAO,EAAE,QAAQ,SAAS,QAAQ,SAAS,OAAAA,QAAO,YAAY,OAAO,YAAY,MAAM,OAAO,MAAM,SAAS,OAAO,SAAS,QAAQ,OAAO,QAAQ,UAAU,OAAO,SAAS;AAAA,IAChL;AACA,QAAI,MAAM,WAAW,YAAY;AAC/B,UAAI,OAAO,aAAa,OAAW,OAAM,IAAI,iBAAiB,wBAAwB;AACtF,aAAO,EAAE,QAAQ,SAAS,QAAQ,SAAS,UAAU,OAAO,UAAU,MAAM,OAAO,QAAQ,QAAW,MAAM,OAAO,MAAM,SAAS,OAAO,SAAS,QAAQ,OAAO,QAAQ,UAAU,OAAO,SAAS;AAAA,IACrM;AACA,UAAM,eAAe,OAAO;AAC5B,UAAM,qBAAqB,OAAO;AAClC,QAAI,iBAAiB,UAAa,iBAAiB,QAAQ,aAAa,WAAW,KAAK,QAAQ,SAAS,UAAa,iBAAiB,QAAQ,KAAM,OAAM,IAAI,iBAAiB,wBAAwB;AACxM,QAAI,MAAM,eAAe,UAAa,uBAAuB,UAAa,uBAAuB,MAAM,cAAc,CAAC,KAAK,cAAc,oBAAoB,MAAM,QAAQ,IAAI,WAAW,CAAC,EAAG,OAAM,IAAI,iBAAiB,0BAA0B;AACnP,WAAO,EAAE,QAAQ,SAAS,QAAQ,SAAS,YAAY,oBAAoB,MAAM,OAAO,MAAM,SAAS,OAAO,SAAS,QAAQ,OAAO,QAAQ,UAAU,OAAO,SAAS;AAAA,EAC1K;AAAA,EAEQ,qBAAqB,OAAgF,QAAuC;AAClJ,QAAI,CAAC,gBAAgB,MAAM,EAAG,OAAM,IAAI,iBAAiB,yBAAyB;AAClF,QAAI,OAAO,SAAS,kCAAkC,OAAO,YAAY,KAAK,OAAO,WAAW,WAAW,MAAM,MAAM,KAAK,OAAO,aAAa,MAAM,SAAU,OAAM,IAAI,iBAAiB,yBAAyB;AACpN,QAAI,MAAM,WAAW,OAAO;AAC1B,UAAI,OAAO,UAAU,UAAa,OAAO,eAAe,UAAa,CAAC,KAAK,cAAc,OAAO,YAAY,OAAO,KAAK,EAAG,OAAM,IAAI,iBAAiB,0BAA0B;AAChL,UAAI,OAAO,MAAM,cAAc,KAAK,QAAQ,mBAAmB,2BAA4B,OAAM,IAAI,iBAAiB,iBAAiB;AAAA,IACzI;AACA,QAAI,MAAM,WAAW,cAAc,OAAO,aAAa,OAAW,OAAM,IAAI,iBAAiB,wBAAwB;AACrH,QAAI,MAAM,WAAW,OAAQ,MAAK,uBAAuB,MAAM,UAAU,MAAM;AAC/E,QAAI,MAAM,WAAW,OAAO;AAC1B,YAAM,OAAO,OAAO,SAAS,QAAQ,OAAO;AAC5C,YAAM,aAAa,OAAO;AAC1B,UAAI,SAAS,UAAa,KAAK,WAAW,KAAK,eAAe,UAAa,eAAe,MAAM,cAAc,MAAM,SAAS,UAAa,CAAC,KAAK,cAAc,YAAY,MAAM,IAAI,EAAG,OAAM,IAAI,iBAAiB,0BAA0B;AAAA,IAC9O;AAAA,EACF;AAAA,EAEQ,uBAAuB,OAAe,QAAuC;AACnF,QAAI,CAAC,gBAAgB,MAAM,EAAG,OAAM,IAAI,iBAAiB,mBAAmB;AAC5E,QAAI,OAAO,SAAS,UAAa,OAAO,YAAY,UAAa,OAAO,KAAK,SAAS,sBAAsB,OAAO,QAAQ,WAAW,OAAO,KAAK,UAAU,OAAO,eAAe,UAAa,IAAI,YAAY,EAAE,OAAO,OAAO,UAAU,EAAE,aAAa,wBAAyB,OAAM,IAAI,iBAAiB,mBAAmB;AAC/T,QAAI,OAAO,QAAQ,KAAK,CAAC,OAAO,UAAU,CAAC,SAAS,KAAK,KAAK,OAAO,MAAM,SAAS,YAAa,MAAM,SAAS,UAAU,MAAM,SAAS,YAAa,MAAM,SAAS,OAAO,KAAM,KAAK,CAAC,EAAG,OAAM,IAAI,iBAAiB,wBAAwB;AAC9O,UAAM,OAAO,oBAAI,IAAY;AAC7B,eAAW,SAAS,OAAO,SAAS;AAClC,oBAAc,MAAM,IAAI;AACxB,UAAI,KAAK,IAAI,MAAM,IAAI,EAAG,OAAM,IAAI,iBAAiB,wBAAwB;AAC7E,WAAK,IAAI,MAAM,IAAI;AACnB,YAAM,SAAS,MAAM,QAAQ,OAAO,EAAE;AACtC,YAAM,WAAW,MAAM,SAAS,SAAS,KAAK,MAAM,KAAK,WAAW,GAAG,MAAM,GAAG,IAAI,MAAM,KAAK,MAAM,OAAO,SAAS,CAAC,IAAI;AAC1H,UAAI,aAAa,UAAa,SAAS,WAAW,KAAK,SAAS,SAAS,GAAG,EAAG,OAAM,IAAI,iBAAiB,yBAAyB;AAAA,IACrI;AAAA,EACF;AAAA,EAEQ,oBAAoB,OAAqD;AAC/E,UAAM,QAAQ,KAAK,cAAc,OAAO,cAAc;AACtD,qBAAiB,OAAO,CAAC,OAAO,OAAO,WAAW,GAAG,cAAc;AACnE,QAAI,MAAM,QAAQ,WAAW,OAAO,MAAM,QAAQ,YAAY,OAAO,MAAM,cAAc,YAAY,CAAC,sBAAsB,KAAK,MAAM,SAAS,GAAG;AACjJ,YAAM,IAAI,iBAAiB,4BAA4B;AAAA,IACzD;AAAA,EACF;AAAA,EAEQ,qBAAqB,SAA6B,QAA6C,UAAkB,SAAkD;AACzK,UAAM,gBAAgB,OAAO,QAAQ,kBAAkB,WACnD,QAAQ,gBACR,SAAS,QAAQ,gBAAgB,KAAK,OAAO,QAAQ,iBAAiB,kBAAkB,WACtF,QAAQ,iBAAiB,gBACzB;AACN,UAAM,gBAAgB;AAAA,MACpB,kBAAkB,EAAE,eAAe,iBAAiB,GAAG;AAAA,MACvD,eAAe,OAAO,QAAQ,kBAAkB,WAAW,QAAQ,gBAAgB,QAAQ;AAAA,MAC3F,SAAS,OAAO,QAAQ,YAAY,WAAW,QAAQ,UAAU;AAAA,MACjE,oBAAoB,OAAO,QAAQ,uBAAuB,WAAW,QAAQ,qBAAqB,QAAQ;AAAA,MAC1G,KAAK,SAAS,QAAQ,GAAG,IAAI,QAAQ,MAAM,CAAC;AAAA,IAC9C;AACA,QAAI,KAAK,QAAQ,WAAW,QAAW;AACrC,UAAI,kBAAkB,OAAW,OAAM,IAAI,iBAAiB,8BAA8B;AAC1F,aAAO,EAAE,eAAe,cAAc;AAAA,IACxC;AACA,WAAO,KAAK,QAAQ,OAAO,eAAe,SAAS,UAAU,mBAAmB,MAAM,IAAI,CAAC;AAAA,MACzF,gBAAgB,QAAQ;AAAA,MACxB,cAAc;AAAA,IAChB,CAAC,CAAC;AAAA,EACJ;AAAA,EAEQ,cAAc,OAAeA,QAA4B;AAC/D,UAAMK,UAASJ,sBAAiB,uBAAOD,MAAK,CAAC;AAC7C,WAAO,UAAUK,WAAU,UAAU,YAAYA,OAAM;AAAA,EACzD;AAAA,EAEQ,0BAA0B,UAA2B,SAA6B,WAAgD,MAAc,OAAgB,QAAuB;AAC7L,UAAM,UAAU,KAAK,QAAQ;AAC7B,UAAM,iBAAiB,cAAc,QAAQ,YAAY,SAAS,YAAY,SAAS,UAAU,SAAS,SAAS,IAAI;AACvH,UAAM,eAAe,WAAW,SAAS;AACzC,UAAM,eAAe,gBAAgB,YAAY;AACjD,QAAI,mBAAmB,UAAa,iBAAiB,UAAa,CAAC,sBAAsB,EAAE,SAAS,SAAS,SAAS,UAAU,gBAAgB,SAAS,CAAC,YAAY,EAAE,GAAG,cAAc,IAAI,EAAG,OAAM,IAAI,iBAAiB,oBAAoB;AAC/O,UAAM,SAAS,QAAQ,WAAW,SAAS,YAAY,QAAQ,WAAW,SAAY,CAAC,QAAQ,MAAM,IAAI,SAAS,WAAW,SAAY,CAAC,QAAQ,MAAM,IAAI,CAAC;AAC7J,QAAI,OAAO,WAAW,KAAK,CAAC,uBAAuB,MAAM,EAAE,SAAS,YAAY,EAAG,OAAM,IAAI,iBAAiB,+BAA+B;AAC7I,QAAI,UAAU,WAAc,CAAC,OAAO,cAAc,KAAK,KAAK,QAAQ,KAAK,QAAQ,kBAAmB,OAAM,IAAI,iBAAiB,qBAAqB;AACpJ,QAAI,WAAW,WAAc,OAAO,WAAW,KAAK,IAAI,YAAY,EAAE,OAAO,MAAM,EAAE,aAAa,yBAA0B,OAAM,IAAI,iBAAiB,sBAAsB;AAAA,EAC/K;AAAA,EAEQ,qBAAqBL,QAAmB,SAAmE,YAA2B;AAC5I,QAAI,eAAe,UAAa,CAAC,KAAK,cAAc,YAAYA,MAAK,EAAG,OAAM,IAAI,iBAAiB,0BAA0B;AAC7H,UAAMK,UAAS,UAAU,4BAA4B,KAAK,UAAU,gBAAgB;AACpF,QAAIA,YAAW,UAAa,CAAC,KAAK,cAAcA,SAAQL,MAAK,GAAG;AAC9D,YAAM,IAAI,iBAAiB,0BAA0B;AAAA,IACvD;AACA,UAAMM,OAAM,UAAU,yBAAyB,KAAK,UAAU,iBAAiB;AAC/E,QAAIA,SAAQ,UAAa,CAAC,wBAAwBA,MAAKN,MAAK,KAAK,CAAC,eAAeM,MAAKN,MAAK,EAAG,OAAM,IAAI,iBAAiB,0BAA0B;AAAA,EACrJ;AAAA,EAEA,MAAc,uBAAuB,UAAwD;AAC3F,QAAI,KAAK,QAAQ,iBAAiB,OAAW,OAAM,IAAI,iBAAiB,6BAA6B;AACrG,UAAME,QAAO,SAAS,OAAO,QAAQ,OAAO,EAAE;AAC9C,UAAM,eAAe,KAAK,QAAQ;AAClC,QAAI,iBAAiB,UAAa,OAAO,iBAAiB,YAAY,iBAAiB,MAAM;AAC3F,YAAM,IAAI,iBAAiB,6BAA6B;AAAA,IAC1D;AACA,UAAM,QAAQ;AACd,UAAM,KAAK,KAAK,QAAQ,eAAe,oBAAoB,UAAa,SAAS,MAAM,gBAAgB,KAAK,MAAM,iBAAiB,gBAAgB;AACnJ,UAAM,eAAe,KAAK,QAAQ,cAAc,aAAa,GAAGA,KAAI,IAAI,KAAK,aAAa,UAAU;AACpG,UAAM,aAAa,KAAK,QAAQ,cAAc,WAAW,GAAGA,KAAI,IAAI,KAAK,aAAa,UAAU;AAChG,UAAM,UAAU,MAAM,oBAAoB,KAAK,sBAAsB,UAAU,KAAK;AACpF,QAAI,YAAY,UAAa,OAAO,YAAY,YAAY,YAAY,QAAQ,MAAM,QAAQ,OAAO,EAAG,OAAM,IAAI,iBAAiB,yBAAyB,6CAA6C;AACzM,QAAI,KAAK,QAAQ,kBAAkB,OAAW,MAAK,6BAA6B,OAAkC;AAClH,UAAM,oBAAoB,MAAM,KAAK,SAAS,cAAc,OAAO;AACnE,UAAM,oBAAoB,oBAAoB,mBAAmB,WAAW;AAC5E,UAAM,YAAY,kBAAkB;AACpC,SAAK,gBAAgB,WAAW,kBAAkB,OAAO,wCAAwC,KAAK,OAAO,IAAI,IAAI;AACrH,SAAK,8BAA8B,SAA8C,SAAS;AAC1F,SAAK,qBAAqB,SAAS;AAEnC,UAAM,UAAU,KAAK,QAAQ;AAC7B,UAAM,iBAAiB,YAAY,SAC/B,MAAM,KAAK,iCAAiC,cAAc,SAAS,IACnE,MAAM,QAAQ,EAAE,UAAU,WAAW,kBAAkB,QAA6C,CAAC;AACzG,QAAI,mBAAmB,UAAa,OAAO,mBAAmB,YAAY,mBAAmB,QAAQ,MAAM,QAAQ,cAAc,EAAG,OAAM,IAAI,iBAAiB,yBAAyB,wDAAwD;AAChP,QAAI,KAAK,QAAQ,kBAAkB,OAAW,MAAK,2BAA2B,gBAA2C,IAAI,SAAS;AACtI,UAAM,kBAAkB,MAAM,KAAK,SAAS,YAAY,cAAc;AACtE,UAAM,kBAAkB,oBAAoB,iBAAiB,SAAS;AACtE,UAAM,UAAU,gBAAgB;AAChC,SAAK,gBAAgB,SAAS,gBAAgB,OAAO,sCAAsC,KAAK,OAAO,IAAI,IAAI;AAC/G,SAAK,qBAAqB,SAAS,UAAU,SAAS,WAAW,cAAc;AAC/E,WAAO;AAAA,MACL,GAAI,KAAK,QAAQ,iBAAiB,CAAC;AAAA,MACnC,GAAG;AAAA,MACH,WAAW,KAAK,eAAe,SAAS,WAAW;AAAA,MACnD,GAAI,OAAO,QAAQ,aAAa,WAAW,EAAE,UAAU,QAAQ,SAAS,IAAI,CAAC;AAAA,MAC7E,GAAI,OAAO,QAAQ,YAAY,WAAW,EAAE,SAAS,QAAQ,QAAQ,IAAI,CAAC;AAAA,MAC1E,GAAI,OAAO,QAAQ,cAAc,WAAW,EAAE,WAAW,QAAQ,UAAU,IAAI,CAAC;AAAA,MAChF,WAAW,KAAK,eAAe,SAAS,WAAW;AAAA,MACnD,WAAW,KAAK,eAAe,SAAS,WAAW;AAAA,MACnD,GAAI,QAAQ,eAAe,SAAY,EAAE,YAAY,KAAK,uBAAuB,QAAQ,UAAU,EAAE,IAAI,CAAC;AAAA,MAC1G,GAAI,KAAK,QAAQ,iBAAiB,CAAC;AAAA,MACnC,GAAI,SAAS,cAAc,KAAK,OAAO,eAAe,eAAe,WAAW,EAAE,YAAY,eAAe,WAAW,IAAI,CAAC;AAAA,MAC7H,GAAI,SAAS,cAAc,KAAK,eAAe,kBAAkB,SAAY,EAAE,eAAe,eAAe,cAAc,IAAI,CAAC;AAAA,MAChI,GAAI,SAAS,cAAc,KAAK,OAAO,eAAe,kBAAkB,WAAW,EAAE,eAAe,eAAe,cAAc,IAAI,CAAC;AAAA,MACtI,GAAI,KAAK,QAAQ,iBAAiB,SAAY,CAAC,IAAI,EAAE,cAAc,KAAK,QAAQ,aAAa;AAAA,IAC/F;AAAA,EACF;AAAA,EAEQ,sBAAsB,UAA2B,cAAgE;AACvH,UAAM,UAAU,KAAK,QAAQ;AAC7B,QAAI,YAAY,OAAW,OAAM,IAAI,iBAAiB,yBAAyB,6CAA6C;AAC5H,UAAM,WAAW,CAAC,OAAgBE,UAAyB;AACzD,UAAI,OAAO,UAAU,YAAY,MAAM,WAAW,EAAG,OAAM,IAAI,iBAAiB,yBAAyB,kBAAkBA,KAAI,aAAa;AAC5I,aAAO;AAAA,IACT;AACA,QAAI,CAAC,SAAS,QAAQ,qBAAqB,KAAK,CAAC,SAAS,QAAQ,aAAa,EAAG,OAAM,IAAI,iBAAiB,yBAAyB,8CAA8C;AACpL,UAAM,YAAY,OAAO,aAAa,cAAc,WAAW,aAAa,YAAY,QAAQ;AAChG,QAAI,cAAc,OAAW,OAAM,IAAI,iBAAiB,yBAAyB,4BAA4B;AAC7G,UAAM,SAAS,QAAQ,UAAU,QAAQ,UAAU,CAAC,KAAK;AACzD,UAAM,OAAgC;AAAA,MACpC,aAAa,SAAS,QAAQ,aAAa,aAAa;AAAA,MACxD,UAAU,QAAQ;AAAA,MAClB,SAAS,QAAQ;AAAA,MACjB,iBAAiB,SAAS,QAAQ,iBAAiB,iBAAiB;AAAA,MACpE,eAAe,QAAQ;AAAA,MACvB,WAAW,QAAQ;AAAA,MACnB,0BAA0B,SAAS,QAAQ,0BAA0B,0BAA0B;AAAA,MAC/F,uBAAuB,QAAQ;AAAA,MAC/B,eAAe,QAAQ;AAAA,MACvB,eAAe,QAAQ;AAAA,MACvB,qBAAqB,QAAQ;AAAA,MAC7B;AAAA,MACA,cAAc,QAAQ,gBAAgB,SAAS;AAAA,MAC/C,cAAc,QAAQ;AAAA,MACtB;AAAA,MACA,GAAI,QAAQ,YAAY,SAAY,CAAC,IAAI,EAAE,SAAS,CAAC,GAAG,QAAQ,OAAO,EAAE;AAAA,MACzE,UAAU,QAAQ;AAAA,IACpB;AACA,WAAO,EAAE,GAAG,MAAM,mBAAmB,gBAAgB,IAAI,EAAE;AAAA,EAC7D;AAAA,EAEQ,6BAA6B,SAAwC;AAC3E,UAAM,KAAK,QAAQ,gBAAgB,UAAa,KAAK,QAAQ,eAAe,oBAAoB;AAChG,UAAM,OAAO,KACT,CAAC,eAAe,YAAY,WAAW,mBAAmB,iBAAiB,aAAa,4BAA4B,yBAAyB,iBAAiB,iBAAiB,uBAAuB,aAAa,gBAAgB,gBAAgB,UAAU,WAAW,YAAY,mBAAmB,IACvS,CAAC,YAAY,WAAW,iBAAiB,2BAA2B,2BAA2B,aAAa,iBAAiB,uBAAuB,aAAa,gBAAgB,gBAAgB,UAAU,WAAW,YAAY,aAAa,aAAa,mBAAmB;AACnR,qBAAiB,SAAS,MAAM,wBAAwB;AACxD,eAAW,OAAO,KAAK,CAAC,eAAe,YAAY,WAAW,mBAAmB,iBAAiB,aAAa,4BAA4B,uBAAuB,aAAa,gBAAgB,gBAAgB,YAAY,mBAAmB,IAAI,CAAC,YAAY,WAAW,iBAAiB,2BAA2B,2BAA2B,aAAa,uBAAuB,aAAa,gBAAgB,gBAAgB,YAAY,mBAAmB,GAAG;AAClc,UAAI,OAAO,QAAQ,GAAG,MAAM,YAAY,QAAQ,GAAG,EAAE,WAAW,EAAG,OAAM,IAAI,iBAAiB,yBAAyB,kBAAkB,GAAG,aAAa;AAAA,IAC3J;AACA,QAAI,CAAC,SAAS,QAAQ,aAAa,KAAK,OAAO,QAAQ,WAAW,SAAU,OAAM,IAAI,iBAAiB,yBAAyB,kCAAkC;AAClK,QAAI,QAAQ,YAAY,WAAc,CAAC,MAAM,QAAQ,QAAQ,OAAO,KAAK,QAAQ,QAAQ,KAAK,CAAC,WAAW,OAAO,WAAW,QAAQ,GAAI,OAAM,IAAI,iBAAiB,yBAAyB,oCAAoC;AAChO,QAAI,QAAQ,cAAc,UAAa,UAAU,QAAQ,SAAS,MAAM,UAAa,QAAQ,cAAc,UAAa,UAAU,QAAQ,SAAS,MAAM,UAAa,UAAU,QAAQ,SAAS,MAAM,UAAa,UAAU,QAAQ,SAAS,MAAM,UAAa,UAAU,QAAQ,SAAS,IAAK,UAAU,QAAQ,SAAS,EAAI,OAAM,IAAI,iBAAiB,yBAAyB,0CAA0C;AAC/Z,UAAM,EAAE,mBAAmB,SAAS,GAAG,KAAK,IAAI;AAChD,QAAI,QAAQ,sBAAsB,gBAAgB,IAAI,EAAG,OAAM,IAAI,iBAAiB,yBAAyB,kCAAkC;AAAA,EACjJ;AAAA,EAEQ,2BAA2B,SAAkC,IAAa,WAA0C;AAC1H,UAAM,OAAO,KACT,CAAC,eAAe,SAAS,gBAAgB,cAAc,SAAS,iBAAiB,eAAe,IAChG,CAAC,gBAAgB,cAAc,SAAS,iBAAiB,eAAe;AAC5E,qBAAiB,SAAS,MAAM,sBAAsB;AACtD,QAAI,OAAO,QAAQ,gBAAgB,UAAU,eAAe,QAAQ,UAAU,UAAU,OAAQ,OAAM,IAAI,iBAAiB,yBAAyB,qCAAqC;AACzL,QAAI,CAAC,SAAS,QAAQ,YAAY,KAAK,OAAO,QAAQ,eAAe,YAAY,QAAQ,WAAW,WAAW,KAAK,CAAC,SAAS,QAAQ,KAAK,KAAK,QAAQ,kBAAkB,UAAa,OAAO,QAAQ,kBAAkB,SAAU,OAAM,IAAI,iBAAiB,yBAAyB,oCAAoC;AAC1T,SAAK,oBAAoB,QAAQ,KAAK;AAAA,EACxC;AAAA,EAEQ,uBAAuB,OAAqC;AAClE,UAAM,SAAS,KAAK,cAAc,OAAO,oBAAoB;AAC7D,QAAI,OAAO,OAAO,YAAY,SAAU,OAAM,IAAI,iBAAiB,yBAAyB,qCAAqC;AACjI,QAAI,CAAC,MAAM,QAAQ,OAAO,OAAO,KAAK,OAAO,QAAQ,KAAK,CAAC,WAAW,CAAC,CAAC,QAAQ,QAAQ,MAAM,EAAE,SAAS,MAAgB,CAAC,EAAG,OAAM,IAAI,iBAAiB,yBAAyB,wCAAwC;AACzN,UAAM,WAAW,KAAK,cAAc,OAAO,UAAU,6BAA6B;AAClF,QAAK,SAAS,SAAS,WAAW,SAAS,SAAS,YAAa,OAAO,SAAS,SAAS,SAAU,OAAM,IAAI,iBAAiB,yBAAyB,wCAAwC;AAChM,WAAO,EAAE,SAAS,OAAO,SAAS,SAAS,CAAC,GAAG,IAAI,IAAI,OAAO,OAAO,CAAC,GAAoB,UAAU,EAAE,MAAM,SAAS,MAAM,MAAM,SAAS,KAAK,EAAmB;AAAA,EACpK;AAAA,EAEQ,4BAA4B,SAA6B,UAAiC;AAChG,UAAM,gBAAgB,UAAU,QAAQ,SAAS;AACjD,QAAI,OAAO,QAAQ,cAAc,YAAY,OAAO,QAAQ,cAAc,YAAY,QAAQ,aAAa,UAAa,QAAQ,YAAY,UAAa,QAAQ,WAAW,UAAa,kBAAkB,UAAa,iBAAiB,KAAK,IAAI,EAAE,QAAQ,KAAK,iBAAiB,UAAU,SAAS,SAAS,KAAK,IAAI;AACrT,YAAM,IAAI,iBAAiB,uBAAuB;AAAA,IACpD;AACA,SAAK,mBAAmB,SAAS,UAAU,aAAa;AACxD,QAAI,SAAS,KAAK,QAAQ,YAAY,GAAG;AACvC,YAAM,eAAe,SAAS,KAAK,QAAQ,aAAa,YAAY,IAAI,KAAK,QAAQ,aAAa,eAAe,KAAK,QAAQ;AAC9H,YAAM,kBAAkB,OAAO,aAAa,cAAc,WAAW,aAAa,YAAY,SAAS,aAAa,MAAM,KAAK,OAAO,aAAa,OAAO,QAAQ,WAAW,aAAa,OAAO,MAAM;AACvM,UAAI,oBAAoB,UAAa,oBAAoB,QAAQ,UAAW,OAAM,IAAI,iBAAiB,yBAAyB,sDAAsD;AAAA,IACxL;AACA,UAAM,gBAAgB,QAAQ,gBAAgB,QAAQ;AACtD,QAAI,kBAAkB,UAAa,kBAAkB,SAAS,OAAQ,OAAM,IAAI,iBAAiB,yBAAyB,+CAA+C;AACzK,QAAI,QAAQ,aAAa,QAAW;AAClC,YAAM,kBAAkB,cAAc,QAAQ,UAAU,SAAS,SAAS,IAAI;AAC9E,UAAI,oBAAoB,UAAa,eAAe,eAAe,MAAM,eAAe,SAAS,QAAQ,EAAG,OAAM,IAAI,iBAAiB,yBAAyB,iDAAiD;AAAA,IACnN;AACA,UAAM,UAAU,KAAK,QAAQ;AAC7B,QAAI,YAAY,QAAW;AACzB,WAAK,oBAAoB,QAAQ,YAAY,QAAQ,WAAW,SAAY,CAAC,IAAI,CAAC,QAAQ,MAAM,IAAI,SAAS,OAAO;AACpH;AAAA,IACF;AACA,sBAAkB,QAAQ,WAAW,QAAQ,WAAW,mDAAmD;AAC3G,sBAAkB,QAAQ,WAAW,QAAQ,WAAW,mDAAmD;AAC3G,UAAM,gBAAgB,cAAc,QAAQ,UAAU,SAAS,SAAS,IAAI;AAC5E,QAAI,QAAQ,iBAAiB,SAAS,UAAU,kBAAkB,UAAa,eAAe,aAAa,MAAM,eAAe,SAAS,QAAQ,KAAK,QAAQ,cAAc,UAAa,QAAQ,cAAc,SAAS,WAAW;AACjO,YAAM,IAAI,iBAAiB,uBAAuB;AAAA,IACpD;AACA,eAAW,CAAC,KAAK,QAAQ,KAAK,OAAO,QAAQ;AAAA,MAC3C,UAAU,QAAQ;AAAA,MAClB,SAAS,QAAQ;AAAA,MACjB,eAAe,QAAQ;AAAA,MACvB,yBAAyB,QAAQ;AAAA,MACjC,yBAAyB,QAAQ;AAAA,MACjC,WAAW,QAAQ;AAAA,MACnB,qBAAqB,QAAQ;AAAA,MAC7B,cAAc,QAAQ;AAAA,MACtB,cAAc,QAAQ;AAAA,MACtB,UAAU;AAAA,IACZ,CAAC,GAAG;AACF,YAAM,SAAS,QAAQ,aACnB,cAAe,QAA+C,GAAG,GAAG,SAAS,SAAS,IAAI,IACzF,QAA+C,GAAG;AACvD,wBAAkB,QAAQ,UAAU,gBAAgB,GAAG,6BAA6B;AAAA,IACtF;AACA,QAAI,QAAQ,kBAAkB,OAAW,mBAAkB,QAAQ,eAAe,QAAQ,eAAe,wDAAwD;AACjK,SAAK,oBAAoB,QAAQ,WAAW,QAAQ,YAAY,QAAQ,WAAW,SAAY,QAAQ,WAAW,SAAY,CAAC,IAAI,CAAC,QAAQ,MAAM,IAAI,CAAC,QAAQ,MAAM,IAAI,SAAS,OAAO;AAAA,EAC3L;AAAA,EAEQ,mBAAmB,SAA6B,UAA2B,QAAsB;AACvG,UAAM,MAAM,UAAU,QAAQ,aAAa,KAAK,QAAQ,eAAe,SAAS;AAChF,UAAM,MAAM,UAAU,QAAQ,aAAa,KAAK,QAAQ,eAAe,SAAS;AAChF,SAAK,QAAQ,cAAc,UAAa,KAAK,QAAQ,eAAe,cAAc,WAAc,QAAQ,WAAc,QAAQ,cAAc,UAAa,KAAK,QAAQ,eAAe,cAAc,WAAc,QAAQ,UAAa,QAAQ,UAAa,QAAQ,UAAa,MAAM,OAAO,QAAQ,UAAa,SAAS,OAAO,QAAQ,UAAa,SAAS,KAAK;AACnW,YAAM,IAAI,iBAAiB,yBAAyB,4DAA4D;AAAA,IAClH;AAAA,EACF;AAAA,EAEQ,oBAAoB,QAA4B,iBAA+C;AACrG,QAAI,OAAO,WAAW,EAAG;AACzB,UAAM,gBAAgB,uBAAuB,MAAM;AACnD,UAAM,UAAU,IAAI,IAAI,eAAe;AACvC,QAAI,cAAc,WAAW,KAAK,cAAc,KAAK,CAAC,WAAW,CAAC,QAAQ,IAAI,gBAAgB,MAAM,CAAE,CAAC,EAAG,OAAM,IAAI,iBAAiB,+BAA+B;AAAA,EACtK;AAAA,EAEA,MAAc,iCAAiC,cAAuB,WAAsD;AAC1H,QAAI,CAAC,SAAS,YAAY,EAAG,OAAM,IAAI,iBAAiB,yBAAyB,kDAAkD;AACnI,QAAI,CAAC,SAAS,aAAa,cAAc,GAAG;AAC1C,YAAM,UAAU,KAAK,QAAQ;AAC7B,YAAM,aAAa,OAAO,aAAa,eAAe,WAAW,aAAa,aAAa;AAC3F,YAAM,YAAY,OAAO,aAAa,cAAc,WAAW,aAAa,YAAY,SAAS;AACjG,YAAM,gBAAgB,aAAa;AACnC,YAAM,gBAAgB,OAAO,aAAa,kBAAkB,WAAW,aAAa,gBAAgB;AACpG,YAAM,SAAS,KAAK,QAAQ;AAC5B,UAAI,YAAY,UAAa,eAAe,UAAa,cAAc,UAAa,kBAAkB,UAAa,kBAAkB,UAAa,WAAW,QAAW;AACtK,cAAM,IAAI,iBAAiB,yBAAyB,kDAAkD;AAAA,MACxG;AACA,YAAM,SAAS,QAAQ,UAAU,QAAQ,UAAU,CAAC,KAAK;AACzD,YAAM,OAAO,UAAU,YAAY;AACnC,YAAM,qBAA8C;AAAA,QAClD,MAAM;AAAA,QACN,SAAS,OAAO,IAAI;AAAA,QACpB,aAAa,UAAU;AAAA,QACvB,OAAO,UAAU;AAAA,QACjB,UAAU,QAAQ;AAAA,QAClB,SAAS,QAAQ;AAAA,QACjB,eAAe,QAAQ;AAAA,QACvB,WAAW,QAAQ;AAAA,QACnB,eAAe,QAAQ;AAAA,QACvB,qBAAqB,QAAQ;AAAA,QAC7B;AAAA,QACA,cAAc,QAAQ;AAAA,QACtB,cAAc,QAAQ;AAAA,QACtB,GAAI,OAAO;AAAA,UACT,aAAa,UAAU;AAAA,UACvB,kBAAkB,OAAO,aAAa,qBAAqB,WAAW,aAAa,mBAAmBH,sBAAiB,uBAAO,IAAI,YAAY,EAAE,OAAO,UAAU,CAAC,CAAC;AAAA,QACrK,IAAI,CAAC;AAAA,QACL;AAAA,QACA,GAAI,QAAQ,YAAY,SAAY,CAAC,IAAI,EAAE,SAAS,CAAC,GAAG,QAAQ,OAAO,EAAE;AAAA,QACzE,UAAU,QAAQ;AAAA,QAClB,mBAAmB,UAAU;AAAA,QAC7B,UAAU,IAAI,KAAK,KAAK,IAAI,CAAC,EAAE,YAAY;AAAA,QAC3C,WAAW,UAAU;AAAA,QACrB,KAAK,UAAU;AAAA,MACjB;AACA,YAAM,QAAQ,MAAM,OAAO,EAAE,QAAQ,OAAO,gCAAgC,+BAA+B,SAAS,mBAAmB,CAAC;AACxI,WAAK,oBAAoB,KAAK;AAC9B,aAAO,UAAU,YAAY,IACzB,EAAE,aAAa,UAAU,aAAa,OAAO,UAAU,OAAO,cAAc,oBAAoB,YAAY,OAAO,eAAe,cAAc,IAChJ,EAAE,cAAc,oBAAoB,YAAY,OAAO,eAAe,cAAc;AAAA,IAC1F;AACA,UAAM,UAAU,gBAAgB,aAAa,cAAc;AAC3D,UAAM,YAAY,SAAS,QAAQ,YAAY,IAAI,QAAQ,eAAe;AAC1E,QAAI,OAAO,UAAU,cAAc,SAAU,OAAM,IAAI,iBAAiB,yBAAyB,2CAA2C;AAC5I,cAAU,QAAQ,UAAU;AAC5B,QAAI,OAAO,UAAU,gBAAgB,SAAU,WAAU,cAAc,UAAU;AACjF,QAAI,UAAU,aAAa,UAAa,OAAO,UAAU,aAAa,SAAU,WAAU,WAAW,UAAU;AAC/G,QAAI,UAAU,YAAY,GAAG;AAC3B,cAAQ,cAAc,UAAU;AAChC,cAAQ,QAAQ,UAAU;AAAA,IAC5B;AACA,WAAO;AAAA,EACT;AAAA,EAEA,MAAc,SAAS,KAAa,MAAiD;AACnF,UAAM,WAAW,MAAM,KAAK,QAAQ,KAAK,EAAE,QAAQ,QAAQ,SAAS,EAAE,gBAAgB,mBAAmB,GAAG,MAAM,KAAK,UAAU,IAAI,GAAG,UAAU,QAAQ,CAAC;AAC3J,QAAK,SAA0D,eAAe,QAAQ,SAAS,UAAU,OAAO,SAAS,SAAS,IAAK,OAAM,IAAI,iBAAiB,yBAAyB;AAC3L,QAAI,CAAC,SAAS,GAAI,OAAM,IAAI,iBAAiB,SAAS,WAAW,OAAO,SAAS,WAAW,MAAM,iBAAiB,sBAAsB;AACzI,UAAM,QAAQ,MAAM,SAAS,KAAK;AAClC,QAAI,CAAC,SAAS,OAAO,UAAU,YAAY,MAAM,QAAQ,KAAK,EAAG,OAAM,IAAI,iBAAiB,uBAAuB;AACnH,WAAO;AAAA,EACT;AAAA,EAEQ,cAAc,OAAgB,OAAwC;AAC5E,QAAI,CAAC,SAAS,OAAO,UAAU,YAAY,MAAM,QAAQ,KAAK,EAAG,OAAM,IAAI,iBAAiB,yBAAyB,GAAG,KAAK,aAAa;AAC1I,WAAO;AAAA,EACT;AAAA,EAEQ,eAAe,OAAgC,KAAa,UAA2B;AAC7F,UAAM,SAAS,MAAM,GAAG,KAAK;AAC7B,QAAI,OAAO,WAAW,YAAY,OAAO,WAAW,EAAG,OAAM,IAAI,iBAAiB,yBAAyB,WAAW,GAAG,aAAa;AACtI,WAAO;AAAA,EACT;AAAA,EAEQ,gBAAgB,SAAkC,OAAgB,QAAsB;AAC9F,UAAM,WAAW,KAAK,cAAc,OAAO,OAAO;AAClD,UAAM,aAAa,SAAS,QAAQ,WAAW,OAAO,SAAS,QAAQ,YAAY,OAAO,SAAS,cAAc;AACjH,UAAM,iBAAiB,SAAS,cAAc,aAAa,OAAO,SAAS,cAAc,YAAY,OAAO,SAAS,UAAU;AAC/H,QAAI,CAAC,cAAc,CAAC,eAAgB,OAAM,IAAI,iBAAiB,yBAAyB,uBAAuB;AAC/G,QAAI,WAAY,kBAAiB,UAAU,CAAC,OAAO,OAAO,WAAW,GAAG,YAAY;AACpF,QAAI,eAAgB,kBAAiB,UAAU,CAAC,aAAa,aAAa,OAAO,GAAG,YAAY;AAChG,UAAM,YAAY,aACd,KAAK,QAAQ,mBAAmB,KAAK,CAAC,QAAQ,SAAS,QAAQ,GAAG,GAAG,IAAI,IAAI,MAAM,WAAW,MAAM,CAAC,EAAE,IACvG,KAAK,QAAQ,mBAAmB,KAAK,CAAC,QAAQ,QAAQ,SAAS,SAAS;AAC5E,QAAI,cAAc,OAAW,OAAM,IAAI,iBAAiB,wBAAwB;AAChF,UAAM,UAAU,UAAU,MAAM,WAAW,MAAM;AACjD,QAAI,CAAC,UAAU,WAAW,UAAU,KAAK,CAAC,QAAQ,WAAW,GAAG,EAAG,OAAM,IAAI,iBAAiB,yBAAyB,wBAAwB;AAC/I,QAAI;AACJ,QAAI;AACJ,QAAI;AACF,YAAM,UAAU,UAAU,OAAO,OAAO;AACxC,UAAI,QAAQ,WAAW,MAAM,QAAQ,CAAC,MAAM,OAAQ,QAAQ,CAAC,MAAM,EAAM,OAAM,IAAI,MAAM,KAAK;AAC9F,YAAM,QAAQ,MAAM,CAAC;AACrB,kBAAYF,kBAAkB,aAAa,SAAS,YAAY,SAAS,KAAgB;AAAA,IAC3F,QAAQ;AACN,YAAM,IAAI,iBAAiB,yBAAyB,gCAAgC;AAAA,IACtF;AACA,QAAK,cAAc,SAAS,QAAQ,GAAG,SAAS,IAAI,OAAO,MAAQ,kBAAkB,SAAS,cAAc,aAAc,UAAU,WAAW,GAAI,OAAM,IAAI,iBAAiB,yBAAyB,+BAA+B;AACtO,UAAMC,SAAQ,IAAI,YAAY,EAAE,OAAO,GAAG,MAAM,GAAG,sBAAsB,OAAO,CAAC,EAAE;AACnF,QAAI,CAAC,wBAAQ,OAAO,WAAWA,QAAO,GAAG,EAAG,OAAM,IAAI,iBAAiB,yBAAyB,iCAAiC;AAAA,EACnI;AAAA,EAEQ,8BAA8B,SAA4C,WAA0C;AAC1H,UAAM,SAAS,SAAS,QAAQ,IAAI,IAAI,QAAQ,OAAO;AACvD,eAAW,OAAO,CAAC,YAAY,WAAW,YAAY,iBAAiB,2BAA2B,2BAA2B,aAAa,iBAAiB,uBAAuB,aAAa,gBAAgB,gBAAgB,YAAY,YAAY,UAAU,WAAW,aAAa,WAAW,GAAY;AAC9S,wBAAkB,OAAO,GAAG,GAAG,UAAU,GAAG,GAAG,kBAAkB,GAAG,8BAA8B;AAAA,IACpG;AACA,QAAI,OAAO,UAAU,gBAAgB,YAAY,UAAU,YAAY,WAAW,KAAK,OAAO,UAAU,UAAU,YAAY,UAAU,MAAM,SAAS,GAAI,OAAM,IAAI,iBAAiB,yBAAyB,oCAAoC;AACnP,UAAM,UAAU,OAAO;AACvB,QAAI,OAAO,YAAY,UAAU;AAC/B,YAAM,EAAE,mBAAmB,UAAU,GAAG,KAAK,IAAI;AACjD,wBAAkB,SAAS,gBAAgB,IAAI,GAAG,0CAA0C;AAC5F,wBAAkB,UAAU,mBAAmB,SAAS,4CAA4C;AAAA,IACtG;AACA,QAAI,UAAU,kBAAkB,OAAW,mBAAkB,UAAU,eAAe,SAAS,0CAA0C;AAAA,EAC3I;AAAA,EAEQ,qBAAqB,WAA0C;AACrE,UAAM,YAAY,UAAU,UAAU,sBAAsB,UAAU,SAAS;AAC/E,QAAI,cAAc,UAAa,aAAa,KAAK,IAAI,EAAE,QAAQ,EAAG,OAAM,IAAI,iBAAiB,yBAAyB,kCAAkC;AAAA,EAC1J;AAAA,EAEQ,qBAAqB,SAAkC,UAA2B,SAAkB,WAAoC,gBAA+B;AAC7K,UAAM,gBAAgB,KAAK,cAAc,SAAS,mBAAmB;AACrE,UAAM,uBAAuB,KAAK,cAAc,gBAAgB,iBAAiB;AACjF,UAAM,iBAAiB,SAAS,cAAc,IAAI,IAAI,cAAc,OAAO;AAC3E,UAAM,eAAe,SAAS,qBAAqB,YAAY,IAAI,qBAAqB,eAAe;AACvG,UAAM,YAAY,OAAO,aAAa,cAAc,WAChD,aAAa,YACb,SAAS,aAAa,MAAM,KAAK,OAAO,aAAa,OAAO,QAAQ,WAAW,aAAa,OAAO,MAAM;AAC7G,QAAI,cAAc,OAAW,OAAM,IAAI,iBAAiB,yBAAyB,qCAAqC;AACtH,QAAI,UAAU,YAAY,GAAG;AAC3B,UAAI,QAAQ,YAAY,EAAG,OAAM,IAAI,iBAAiB,yBAAyB,iCAAiC;AAChH,iBAAW,OAAO,CAAC,eAAe,YAAY,WAAW,mBAAmB,iBAAiB,aAAa,4BAA4B,aAAa,gBAAgB,UAAU,WAAW,UAAU,GAAY;AAC5M,0BAAkB,QAAQ,GAAG,GAAG,eAAe,GAAG,KAAK,UAAU,GAAG,GAAG,mBAAmB,GAAG,eAAe;AAAA,MAC9G;AAAA,IACF;AACA,sBAAkB,WAAW,QAAQ,WAAW,sDAAsD;AACtG,QAAI,SAAS,aAAa,aAAa,KAAK,OAAO,aAAa,cAAc,cAAc,SAAU,mBAAkB,aAAa,cAAc,WAAW,QAAQ,WAAW,iDAAiD;AAClO,sBAAkB,aAAa,OAAO,UAAU,OAAO,uDAAuD;AAC9G,sBAAkB,aAAa,aAAa,UAAU,aAAa,0CAA0C;AAC7G,sBAAkB,aAAa,UAAU,UAAU,UAAU,0DAA0D;AACvH,UAAM,mBAAmB,IAAI,IAAI,CAAC,SAAS,QAAQ,KAAK,QAAQ,eAAe,YAAY,EAAE,OAAO,CAAC,UAA2B,UAAU,MAAS,CAAC;AACpJ,QAAI,OAAO,UAAU,aAAa,YAAY,CAAC,iBAAiB,IAAI,UAAU,QAAQ,KAAK,OAAO,aAAa,aAAa,YAAY,CAAC,iBAAiB,IAAI,aAAa,QAAQ,EAAG,OAAM,IAAI,iBAAiB,yBAAyB,gDAAgD;AAC1R,UAAM,gBAAgB,QAAQ,gBAAgB,QAAQ;AACtD,QAAI,kBAAkB,UAAa,kBAAkB,SAAS,OAAQ,OAAM,IAAI,iBAAiB,yBAAyB,+CAA+C;AACzK,QAAI,QAAQ,YAAY,UAAa,QAAQ,YAAY,SAAS,QAAS,OAAM,IAAI,iBAAiB,yBAAyB,8CAA8C;AAC7K,eAAW,OAAO,CAAC,YAAY,WAAW,aAAa,iBAAiB,2BAA2B,gBAAgB,gBAAgB,gBAAgB,YAAY,UAAU,aAAa,WAAW,GAAY;AAC3M,YAAM,eAAe,QAAQ,aAAa,cAAc,eAAe,GAAG,GAAG,SAAS,SAAS,IAAI,IAAI,eAAe,GAAG;AACzH,YAAM,eAAe,QAAQ,aAAa,cAAe,QAAoC,GAAG,GAAG,SAAS,SAAS,IAAI,IAAK,QAAoC,GAAG;AACrK,wBAAkB,cAAc,cAAc,gBAAgB,GAAG,8BAA8B;AAAA,IACjG;AACA,QAAI,QAAQ,aAAa,QAAW;AAClC,YAAM,kBAAkB,cAAc,QAAQ,UAAU,SAAS,SAAS,IAAI;AAC9E,UAAI,oBAAoB,UAAa,eAAe,eAAe,MAAM,eAAe,SAAS,QAAQ,EAAG,OAAM,IAAI,iBAAiB,yBAAyB,iDAAiD;AAAA,IACnN;AACA,QAAI,QAAQ,YAAY,QAAW;AACjC,UAAI,CAAC,MAAM,QAAQ,QAAQ,OAAO,EAAG,OAAM,IAAI,iBAAiB,yBAAyB,kCAAkC;AAC3H,WAAK,oBAAoB,QAAQ,SAAS,SAAS,OAAO;AAAA,IAC5D;AACA,UAAM,gBAAgB,UAAU,QAAQ,SAAS;AACjD,UAAM,iBAAiB,UAAU,SAAS,SAAS;AACnD,UAAM,qBAAqB,UAAU,aAAa,SAAS;AAC3D,QAAI,kBAAkB,UAAa,iBAAiB,KAAK,IAAI,EAAE,QAAQ,KAAK,mBAAmB,UAAa,gBAAgB,kBAAmB,uBAAuB,UAAa,gBAAgB,mBAAqB,OAAM,IAAI,iBAAiB,yBAAyB,gCAAgC;AAC5S,SAAK,mBAAmB,EAAE,GAAG,SAAS,WAAW,OAAO,QAAQ,cAAc,WAAW,QAAQ,YAAY,IAAI,WAAW,OAAO,QAAQ,cAAc,WAAW,QAAQ,YAAY,IAAI,WAAW,QAAQ,UAAoB,GAAG,UAAU,aAAa;AAC7P,sBAAkB,QAAQ,WAAW,eAAe,WAAW,oDAAoD;AACnH,sBAAkB,QAAQ,WAAW,eAAe,WAAW,oDAAoD;AAAA,EACrH;AAAA,EAEQ,cAAc,YAAsH,WAAiD,MAAoB;AAC/M,QAAI,CAAC,sBAAsB,YAAY,gBAAgB,SAAS,GAAG,IAAI,EAAG,OAAM,IAAI,iBAAiB,oBAAoB;AAAA,EAC3H;AAAA,EAEA,MAAc,QAAQ,MAAyC;AAC7D,UAAM,WAAW,cAAc,MAAM,EAAE,gBAAgB,KAAK,QAAQ,gBAAgB,gBAAgB,KAAK,QAAQ,eAAe,CAAC;AACjI,QAAI,SAAS,aAAa,oBAAqB,QAAO,KAAK,iBAAiB,IAAI;AAChF,QAAIA;AACJ,QAAI;AACJ,QAAI,SAAS,SAAS,UAAU;AAC9B,MAAAA,SAAQ,IAAI,YAAY,EAAE,OAAO,KAAK,UAAU,SAAS,QAAQ,CAAC;AAAA,IACpE,OAAO;AACL,UAAI,SAAS,QAAQ,OAAW,OAAM,IAAI,iBAAiB,eAAe;AAC1E,oBAAc,KAAK,MAAM,aAAa,SAAY,SAAY,MAAM,KAAK,MAAM,SAAS,SAAS,KAAK,KAAK,IAAI,CAAC;AAChH,UAAI,gBAAgB,QAAW;AAC7B,YAAI,CAAC,eAAe,SAAS,KAAK,YAAY,KAAK,KAAK,CAAC,KAAK,cAAcC,kBAAiB,YAAY,MAAM,GAAG,YAAY,KAAK,GAAG;AACpI,gBAAM,KAAK,MAAM,OAAO,YAAY,GAAG;AAGvC,UAAAD,SAAQ,MAAM,KAAK,cAAc,SAAS,QAAQ,SAAS,GAAG;AAAA,QAChE,OAAO;AACL,UAAAA,SAAQ,YAAY;AAAA,QACtB;AAAA,MACF,OAAO;AACL,QAAAA,SAAQ,MAAM,KAAK,cAAc,SAAS,QAAQ,SAAS,GAAG;AAAA,MAChE;AAAA,IACF;AACA,QAAI,WAAW,SAAS,YAAY,mBAAmBA,QAAO,EAAE,gBAAgB,SAAS,QAAQ,kBAAkB,KAAK,QAAQ,oBAAoBH,6BAA4B,iBAAiB,KAAK,QAAQ,mBAAmB,2BAA2B,uBAAuB,KAAK,QAAQ,yBAAyB,iCAAiC,CAAC;AAC3V,QAAI,gBAAgB,UAAa,YAAY,IAAI,cAAc,SAAS,SAAS,WAAW;AAC1F,YAAM,KAAK,MAAM,OAAO,YAAY,GAAG;AACvC,MAAAG,SAAQ,MAAM,KAAK,cAAc,SAAS,QAAQ,SAAS,GAAI;AAC/D,iBAAW,mBAAmBA,QAAO,EAAE,gBAAgB,SAAS,QAAQ,kBAAkB,KAAK,QAAQ,oBAAoBH,6BAA4B,iBAAiB,KAAK,QAAQ,mBAAmB,2BAA2B,uBAAuB,KAAK,QAAQ,yBAAyB,iCAAiC,CAAC;AAAA,IACpU;AACA,wBAAoB,SAAS,UAAU,EAAE,gBAAgB,SAAS,QAAQ,iBAAiB,KAAK,QAAQ,iBAAiB,uBAAuB,KAAK,QAAQ,yBAAyB,kCAAkC,KAAK,KAAK,IAAI,GAAG,mBAAmB,KAAK,QAAQ,kBAAkB,CAAC;AAC5R,QAAI,CAAC,SAAS,SAAS,aAAa,SAAS,QAAQ,OAAW,OAAM,IAAI,iBAAiB,kBAAkB;AAC7G,QAAI,SAAS,QAAQ,UAAa,CAAC,eAAe,SAAS,KAAKG,MAAK,GAAG;AACtE,YAAM,KAAK,MAAM,OAAO,EAAE,KAAK,SAAS,KAAK,WAAW,SAAS,SAAS,UAAU,CAAC;AACrF,YAAM,IAAI,iBAAiB,oBAAoB;AAAA,IACjD;AACA,QAAI,SAAS,QAAQ,OAAW,OAAM,KAAK,MAAM,IAAI,EAAE,KAAK,SAAS,KAAK,WAAW,SAAS,SAAS,UAAU,GAAGA,QAAO,EAAE,aAAa,SAAS,SAAS,QAAQ,UAAU,MAAM,SAAS,SAAS,QAAQ,MAAM,WAAW,SAAS,SAAS,UAAU,CAAC;AAC5P,UAAM,iBAAiB,KAAK,cAAc,SAAS,OAAO;AAC1D,UAAM,YAAY,SAAS,SAAS,YAChC,MAAM,uBAAuB,gBAAgB,SAAS,QAAQ,MAAM;AAAE,YAAM,IAAI,iBAAiB,oBAAoB;AAAA,IAAG,GAAG,CAAC,IAC5H;AACJ,QAAI,UAAU,cAAc,KAAK,QAAQ,mBAAmB,2BAA4B,OAAM,IAAI,iBAAiB,iBAAiB;AACpI,WAAO,EAAE,UAAU,UAAU,OAAAA,QAAO,UAAU;AAAA,EAChD;AAAA,EAEA,MAAc,cAAc,QAAgBM,MAAkC;AAC5E,UAAM,MAAM,KAAK,QAAQ,cAAc,EAAE,QAAQ,KAAAA,KAAI,CAAC,KAAK,GAAG,MAAM,MAAMA,IAAG;AAC7E,UAAM,WAAW,MAAM,KAAK,QAAQ,KAAK,EAAE,QAAQ,OAAO,SAAS,EAAE,QAAQ,kEAAkE,GAAG,UAAU,QAAQ,CAAC;AACrK,QAAK,SAA0D,eAAe,QAAQ,SAAS,UAAU,OAAO,SAAS,SAAS,IAAK,OAAM,IAAI,iBAAiB,yBAAyB;AAC3L,QAAI,CAAC,SAAS,GAAI,OAAM,IAAI,iBAAiB,oBAAoB;AACjE,UAAMN,SAAQ,IAAI,WAAW,MAAM,SAAS,YAAY,CAAC;AACzD,QAAIA,OAAM,cAAc,KAAK,QAAQ,oBAAoBH,6BAA6B,OAAM,IAAI,iBAAiB,iBAAiB;AAClI,QAAI,CAAC,eAAeS,MAAKN,MAAK,EAAG,OAAM,IAAI,iBAAiB,oBAAoB;AAChF,WAAOA;AAAA,EACT;AAAA,EAEA,MAAc,iBAAiB,MAAyC;AACtE,UAAM,YAAY,wBAAwB,MAAM,EAAE,gBAAgB,KAAK,QAAQ,gBAAgB,gBAAgB,KAAK,QAAQ,eAAe,CAAC;AAC5I,QAAI,SAAS,UAAU;AACvB,QAAI;AACJ,QAAI,WAAW,UAAa,KAAK,MAAM,aAAa,QAAW;AAC7D,eAAS,MAAM,KAAK,MAAM,SAAS,UAAU,KAAK,KAAK,IAAI,CAAC;AAC5D,UAAI,WAAW,UAAa,wBAAwB,UAAU,KAAK,OAAO,KAAK,KAAK,KAAK,cAAcC,kBAAiB,OAAO,MAAM,GAAG,OAAO,KAAK,EAAG,UAAS,OAAO;AAAA,eAC9J,WAAW,OAAW,OAAM,KAAK,MAAM,OAAO,OAAO,GAAG;AAAA,IACnE;AACA,QAAI,WAAW,QAAW;AACxB,YAAM,MAAM,KAAK,QAAQ,cAAc,EAAE,QAAQ,UAAU,QAAQ,KAAK,UAAU,IAAI,CAAC,KAAK,GAAG,UAAU,MAAM,MAAM,UAAU,GAAG;AAClI,YAAM,WAAW,MAAM,KAAK,QAAQ,KAAK,EAAE,QAAQ,OAAO,SAAS,EAAE,QAAQ,kEAAkE,GAAG,UAAU,QAAQ,CAAC;AACrK,UAAK,SAA0D,eAAe,QAAQ,SAAS,UAAU,OAAO,SAAS,SAAS,IAAK,OAAM,IAAI,iBAAiB,yBAAyB;AAC3L,UAAI,CAAC,SAAS,GAAI,OAAM,IAAI,iBAAiB,oBAAoB;AACjE,eAAS,IAAI,WAAW,MAAM,SAAS,YAAY,CAAC;AAAA,IACtD;AACA,QAAI,OAAO,cAAc,KAAK,QAAQ,yBAAyB,kCAAmC,OAAM,IAAI,iBAAiB,iBAAiB;AAC9I,QAAI,CAAC,wBAAwB,UAAU,KAAK,MAAM,EAAG,OAAM,IAAI,iBAAiB,oBAAoB;AACpG,UAAM,gBAAgB,UAAU,QAAQ,SAAY,SAAS,MAAM,uBAAuB,QAAQ,UAAU,GAAG;AAC/G,QAAI,YAAY,IAAI,WAAW;AAI/B,QAAI;AACJ,QAAI;AACF,oBAAc,4BAA4B,eAAe,EAAE,gBAAgB,UAAU,QAAQ,KAAK,KAAK,IAAI,GAAG,WAAW,mBAAmB,KAAK,QAAQ,kBAAkB,CAAC;AAAA,IAC9K,SAAS,OAAO;AACd,UAAI,EAAE,iBAAiB,UAAU,EAAE,UAAU,UAAW,MAAsC,SAAS,mBAAoB,OAAM;AACjI,YAAM,SAAS,kCAAkC,eAAe,EAAE,gBAAgB,UAAU,QAAQ,KAAK,KAAK,IAAI,GAAG,WAAW,mBAAmB,KAAK,QAAQ,kBAAkB,CAAC;AACnL,UAAI,KAAK,MAAM,aAAa,OAAW,OAAM,KAAK,MAAM,IAAI,EAAE,KAAK,UAAU,KAAK,WAAW,OAAO,SAAS,SAAS,UAAU,GAAG,QAAQ,EAAE,aAAa,OAAO,SAAS,SAAS,QAAQ,UAAU,MAAM,OAAO,YAAY,WAAW,KAAK,CAAC;AAC/O,YAAMM,YAA8B,EAAE,MAAM,UAAU,WAAW,SAAY,YAAY,UAAU,QAAQ,UAAU,QAAQ,KAAK,UAAU,KAAK,KAAK,GAAG,UAAU,MAAM,MAAM,UAAU,GAAG,QAAQ,UAAU,oBAAoB;AAClO,aAAO,EAAE,UAAAA,WAAU,UAAU,OAAO,UAAU,OAAO,QAAQ,UAAU;AAAA,IACzE;AACA,UAAM,UAAU,YAAY,SAAS;AACrC,QAAI,YAAY,QAAW;AACzB,YAAM,aAAa,KAAK,QAAQ,cAAc,EAAE,QAAQ,UAAU,QAAQ,KAAK,QAAQ,IAAI,CAAC,KAAK,GAAG,UAAU,MAAM,MAAM,QAAQ,GAAG;AACrI,YAAM,kBAAkB,MAAM,KAAK,QAAQ,YAAY,EAAE,QAAQ,OAAO,SAAS,EAAE,QAAQ,2BAA2B,GAAG,UAAU,QAAQ,CAAC;AAC5I,UAAK,gBAAiE,eAAe,QAAQ,gBAAgB,UAAU,OAAO,gBAAgB,SAAS,IAAK,OAAM,IAAI,iBAAiB,yBAAyB;AAChN,UAAI,CAAC,gBAAgB,GAAI,OAAM,IAAI,iBAAiB,oBAAoB;AACxE,YAAM,gBAAgB,IAAI,WAAW,MAAM,gBAAgB,YAAY,CAAC;AACxE,UAAI,cAAc,cAAc,KAAK,QAAQ,yBAAyB,kCAAmC,OAAM,IAAI,iBAAiB,iBAAiB;AACrJ,UAAI,CAAC,wBAAwB,QAAQ,KAAK,aAAa,EAAG,OAAM,IAAI,iBAAiB,oBAAoB;AACzG,kBAAY,IAAI,WAAW,MAAM,uBAAuB,eAAe,KAAK,cAAc,QAAQ,GAAG,CAAC,CAAC;AAAA,IACzG;AACA,UAAM,WAAW,4BAA4B,eAAe,EAAE,gBAAgB,UAAU,QAAQ,KAAK,KAAK,IAAI,GAAG,WAAW,mBAAmB,KAAK,QAAQ,kBAAkB,CAAC,EAAE;AACjL,QAAI,KAAK,MAAM,aAAa,OAAW,OAAM,KAAK,MAAM,IAAI,EAAE,KAAK,UAAU,KAAK,WAAW,SAAS,SAAS,UAAU,GAAG,QAAQ,EAAE,aAAa,SAAS,SAAS,QAAQ,UAAU,MAAM,OAAO,YAAY,WAAW,KAAK,CAAC;AACjO,UAAM,WAA8B,EAAE,MAAM,UAAU,WAAW,SAAY,YAAY,UAAU,QAAQ,UAAU,QAAQ,KAAK,UAAU,KAAK,KAAK,GAAG,UAAU,MAAM,MAAM,UAAU,GAAG,QAAQ,UAAU,oBAAoB;AAClO,WAAO,EAAE,UAAU,UAAU,OAAO,QAAQ,UAAU;AAAA,EACxD;AAAA,EAEQ,cAAc,OAA2B;AAC/C,UAAM,aAAa,MAAM,QAAQ,MAAM,GAAG,EAAE,QAAQ,MAAM,GAAG,IAAI,IAAI,QAAQ,IAAI,MAAM,SAAS,KAAK,CAAC;AACtG,QAAI,OAAO,SAAS,WAAY,QAAO,WAAW,KAAK,KAAK,UAAU,GAAG,CAAC,SAAS,KAAK,WAAW,CAAC,CAAC;AACrG,WAAO,IAAI,WAAW,OAAO,KAAK,YAAY,QAAQ,CAAC;AAAA,EACzD;AACF;;;ADxkCA,SAAS,gCACP,SACoB;AACpB,MAAI;AACJ,aAAW,UAAU,SAAS;AAC5B,UAAM,QAAQ,OAAO,QAAQ,GAAG;AAChC,QAAI,UAAU,GAAI,QAAO;AACzB,UAAM,cAAc,OAAO,MAAM,GAAG,KAAK;AACzC,UAAM,YAAY,sBAAsB,WAAW;AACnD,QAAI,cAAc,OAAW,QAAO;AACpC,QAAI,UAAU,QAAW;AACvB,cAAQ;AAAA,IACV,WAAW,UAAU,WAAW;AAC9B,aAAO;AAAA,IACT;AAAA,EACF;AACA,SAAO;AACT;AASA,IAAM,uBAAuB,CAAC,oBAAoB,uBAAuB;AAMzE,IAAM,oBAAoB,OAAO;AAKjC,IAAM,gBAAgB;AAStB,SAASC,aACPC,OACA,SACA,OACA,MACiB;AACjB,SAAO;AAAA,IACL,MAAAA;AAAA,IACA;AAAA,IACA,SAAS;AAAA,IACT;AAAA,IACA;AAAA,EACF;AACF;AAWA,SAAS,2BAA2B,KAA+B;AACjE,QAAM,QAAQ,eAAe,QAAQ,MAAM;AAC3C,QAAMA,QACJ,OAAO,OAAO,QAAQ,YAAY,UAAU,MACxC,OAAQ,IAA2B,QAAQ,EAAE,IAC7C;AACN,QAAMC,QAAO,eAAe,QAAQ,IAAI,OAAO;AAC/C,QAAM,UAAU,eAAe,QAAQ,IAAI,UAAU,OAAO,OAAO,EAAE;AAErE,QAAM,UACJD,UAAS,qBAAqB,WAC9BC,UAAS,gBACT,2CAA2C,KAAK,OAAO;AACzD,MAAI,SAAS;AACX,WAAOF;AAAA,MACL,qBAAqB;AAAA,MACrB;AAAA,MAEA;AAAA,IACF;AAAA,EACF;AAEA,QAAM,WACJC,UAAS,qBAAqB,WAC9BC,UAAS,kBACT,qBAAqB,KAAK,OAAO;AACnC,MAAI,UAAU;AACZ,WAAOF;AAAA,MACL,qBAAqB;AAAA,MACrB;AAAA,MAIA;AAAA,IACF;AAAA,EACF;AAEA,SAAOA;AAAA,IACL,qBAAqB;AAAA,IACrB;AAAA,IACA;AAAA,EACF;AACF;AAKA,SAAS,gBAAgB,MAAsB;AAE7C,MAAIG;AACJ,MAAI,OAAO,SAAS,aAAa;AAC/B,IAAAA,UAAS,KAAK,SAAS,mBAAmB,IAAI,CAAC,CAAC;AAAA,EAClD,WAAW,OAAO,WAAW,aAAa;AACxC,IAAAA,UAAS,OAAO,KAAK,MAAM,OAAO,EAAE,SAAS,QAAQ;AAAA,EACvD,OAAO;AACL,UAAM,IAAI,MAAM,8BAA8B;AAAA,EAChD;AAEA,SAAOA,QAAO,QAAQ,OAAO,GAAG,EAAE,QAAQ,OAAO,GAAG,EAAE,QAAQ,OAAO,EAAE;AACzE;AAKA,SAAS,gBAAgB,SAAyB;AAEhD,MAAIA,UAAS,QAAQ,QAAQ,MAAM,GAAG,EAAE,QAAQ,MAAM,GAAG;AAEzD,SAAOA,QAAO,SAAS,GAAG;AACxB,IAAAA,WAAU;AAAA,EACZ;AAEA,MAAI,OAAO,SAAS,aAAa;AAC/B,WAAO,mBAAmB,OAAO,KAAKA,OAAM,CAAC,CAAC;AAAA,EAChD,WAAW,OAAO,WAAW,aAAa;AACxC,WAAO,OAAO,KAAKA,SAAQ,QAAQ,EAAE,SAAS,OAAO;AAAA,EACvD,OAAO;AACL,UAAM,IAAI,MAAM,8BAA8B;AAAA,EAChD;AACF;AAgSO,IAAM,iBAAN,MAAgD;AAAA;AAAA;AAAA;AAAA,EAqBrD,YAAY,QAA8B;AACxC,SAAK,QAAQ,OAAO;AACpB,SAAK,UAAU,OAAO;AACtB,SAAK,SAAS,OAAO;AACrB,SAAK,UAAU,OAAO,SAAS,WAAW,MAAM,KAAK,UAAU;AAC/D,SAAK,cAAc,OAAO;AAC1B,SAAK,WAAW,OAAO;AACvB,SAAK,oBAAoB,OAAO;AAChC,SAAK,kBAAkB,OAAO;AAC9B,SAAK,WAAW,OAAO,WAAW,IAAI,QAAQ,OAAO,EAAE;AACvD,SAAK,qBAAqB,OAAO;AACjC,SAAK,yBAAyB,OAAO;AACrC,SAAK,eAAe,OAAO;AAC3B,SAAK,aAAa,OAAO,cAAc;AACvC,SAAK,gBAAgB,OAAO;AAC5B,SAAK,yBAAyB,OAAO;AACrC,SAAK,iBAAiB,OAAO;AAAA,EAC/B;AAAA;AAAA;AAAA;AAAA,EAKA,IAAY,OAAe;AACzB,WAAO,KAAK,MAAM,CAAC;AAAA,EACrB;AAAA;AAAA;AAAA;AAAA,EAKO,cAAc,SAA+B;AAClD,SAAK,iBAAiB;AACtB,SAAK,UAAU;AAAA,EACjB;AAAA;AAAA;AAAA;AAAA;AAAA,EAMO,aAAa,QAAgM;AAClN,SAAK,iBAAiB;AACtB,QAAI,OAAO,YAAY,QAAW;AAChC,WAAK,UAAU,OAAO;AAAA,IACxB;AACA,QAAI,OAAO,sBAAsB,QAAW;AAC1C,WAAK,oBAAoB,OAAO;AAAA,IAClC;AACA,QAAI,OAAO,qBAAqB,QAAW;AACzC,WAAK,qBAAqB,OAAO;AAAA,IACnC;AACA,QAAI,OAAO,yBAAyB,QAAW;AAC7C,WAAK,yBAAyB,OAAO;AAAA,IACvC;AACA,QAAI,OAAO,kBAAkB,QAAW;AACtC,WAAK,gBAAgB,OAAO;AAAA,IAC9B;AACA,QAAI,OAAO,2BAA2B,QAAW;AAC/C,WAAK,yBAAyB,OAAO;AAAA,IACvC;AACA,QAAI,OAAO,iBAAiB,QAAW;AACrC,WAAK,iBAAiB,OAAO;AAAA,IAC/B;AAAA,EACF;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAYA,MAAM,SAAS,QAA0E;AACvF,UAAM,cAAc,KAAK,kBAAkB;AAC3C,QAAI,YAAa,QAAO,EAAE,IAAI,OAAO,OAAO,YAAY;AAGxD,QAAI,CAAC,KAAK,SAAS;AACjB,aAAO;AAAA,QACL,IAAI;AAAA,QACJ,OAAOH;AAAA,UACL,qBAAqB;AAAA,UACrB;AAAA,QACF;AAAA,MACF;AAAA,IACF;AAGA,QAAI,CAAC,KAAK,0BAA0B,CAAC,KAAK,sBAAsB,CAAC,KAAK,mBAAmB;AACvF,aAAO;AAAA,QACL,IAAI;AAAA,QACJ,OAAOA;AAAA,UACL,qBAAqB;AAAA,UACrB;AAAA,QACF;AAAA,MACF;AAAA,IACF;AAGA,QAAI,CAAC,OAAO,MAAM;AAChB,aAAO;AAAA,QACL,IAAI;AAAA,QACJ,OAAOA;AAAA,UACL,qBAAqB;AAAA,UACrB;AAAA,QACF;AAAA,MACF;AAAA,IACF;AAEA,UAAM,UAAU,OAAO,WAAW;AAClC,UAAM,kBAAkB,OAAO,UAAU,IAAI,KAAK,KAAK,IAAI,IAAI,iBAAiB;AAChF,QAAI,SAAS;AAEb,UAAM,SAAsB,OAAO,UAAU;AAI7C,UAAM,WAAW,KAAK,aAClB,GAAG,KAAK,UAAU,IAAI,OAAO,IAAI,GAAG,QAAQ,QAAQ,GAAG,IACvD,OAAO;AAGX,QAAI,WAAW,UAAU;AACvB,aAAO;AAAA,QACL,IAAI;AAAA,QACJ,OAAOA;AAAA,UACL,qBAAqB;AAAA,UACrB,WAAW,MAAM;AAAA,QACnB;AAAA,MACF;AAAA,IACF;AAIA,QAAI;AACJ,QAAI;AACJ,QAAI;AAEJ,QAAI;AACF,YAAM,eAAe,SAAS,KAAK,IAAI,CAAC,IAAI,KAAK,OAAO,EAAE,SAAS,EAAE,EAAE,UAAU,GAAG,EAAE,CAAC;AACvF,cAAQ,MAAM,KAAK,YAAY,iBAAiB,YAAY;AAC5D,YAAM,yBAAyB,KAAK,kBAAkB;AACtD,UAAI,uBAAwB,QAAO,EAAE,IAAI,OAAO,OAAO,uBAAuB;AAC9E,eAAS,MAAM,KAAK,YAAY,OAAO,KAAK;AAC5C,YAAM,oBAAoB,KAAK,kBAAkB;AACjD,UAAI,kBAAmB,QAAO,EAAE,IAAI,OAAO,OAAO,kBAAkB;AACpE,eAAS,KAAK,YAAY,OAAO,KAAK;AAGtC,UAAI,CAAC,OAAO,GAAG;AACb,eAAO;AAAA,UACL,IAAI;AAAA,UACJ,OAAOA;AAAA,YACL,qBAAqB;AAAA,YACrB;AAAA,UACF;AAAA,QACF;AAAA,MACF;AAAA,IACF,SAAS,KAAK;AACZ,aAAO;AAAA,QACL,IAAI;AAAA,QACJ,OAAOA;AAAA,UACL,qBAAqB;AAAA,UACrB,6CAA6C,eAAe,QAAQ,IAAI,UAAU,OAAO,GAAG,CAAC;AAAA,UAC7F,eAAe,QAAQ,MAAM;AAAA,QAC/B;AAAA,MACF;AAAA,IACF;AAIA,QAAI;AAGJ,UAAM,WAAW,OAAO,MAAM,GAAG,EAAE,CAAC;AAGpC,UAAM,yBAAyB,CAC7B,WACuD;AACvD,UAAI,UAAU,OAAO,WAAW,YAAY,QAAQ,QAAQ;AAC1D,eAAO;AAAA,MACT;AACA,aAAO;AAAA,IACT;AAOA,UAAM,yBAAyB,KAAK;AAAA,MAClC;AAAA,MACA;AAAA,MACA;AAAA,IACF;AAEA,QAAI,wBAAwB;AAE1B,YAAM,mBAAmB,MAAM,KAAK,wBAAwB,UAAU,UAAU,SAAS,MAAM;AAC/F,YAAM,6BAA6B,KAAK,kBAAkB;AAC1D,UAAI,2BAA4B,QAAO,EAAE,IAAI,OAAO,OAAO,2BAA2B;AACtF,YAAM,SAAS,uBAAuB,gBAAgB;AACtD,UAAI,QAAQ,UAAU,OAAO,OAAO,OAAO;AACzC,eAAO;AAAA,MACT;AACA,mBAAa;AAAA,IACf,WAAW,KAAK,wBAAwB;AAEtC,UAAI;AACF,cAAM,iBAAiB,MAAM,KAAK,uBAAuB;AAAA,UACvD,aAAa;AAAA,UACb,SAAS,KAAK,QAAQ;AAAA,UACtB,MAAM;AAAA,UACN;AAAA,UACA;AAAA,QACF,CAAC;AACD,cAAM,4BAA4B,KAAK,kBAAkB;AACzD,YAAI,0BAA2B,QAAO,EAAE,IAAI,OAAO,OAAO,0BAA0B;AAEpF,YAAI,gBAAgB;AAClB,uBAAa;AACb,mBAAS;AAAA,QACX,OAAO;AACL,iBAAO;AAAA,YACL,IAAI;AAAA,YACJ,OAAOA;AAAA,cACL,qBAAqB;AAAA,cACrB;AAAA,YACF;AAAA,UACF;AAAA,QACF;AAAA,MACF,SAAS,KAAK;AAKZ,eAAO,EAAE,IAAI,OAAO,OAAO,2BAA2B,GAAG,EAAE;AAAA,MAC7D;AAAA,IACF,OAAO;AACL,aAAO;AAAA,QACL,IAAI;AAAA,QACJ,OAAOA;AAAA,UACL,qBAAqB;AAAA,UACrB;AAAA,QACF;AAAA,MACF;AAAA,IACF;AAEA,UAAM,mBAAmB,KAAK,kBAAkB;AAChD,QAAI,iBAAkB,QAAO,EAAE,IAAI,OAAO,OAAO,iBAAiB;AAGlE,UAAM,YAA8B;AAAA,MAClC,KAAK;AAAA,MACL;AAAA,MACA;AAAA,MACA,MAAM;AAAA,MACN,MAAM,KAAK;AAAA,MACX,SAAS,KAAK,QAAQ;AAAA,MACtB,SAAS;AAAA,IACX;AAGA,UAAM,cAAc,KAAK,WAAW,WAAW,MAAM;AAGrD,UAAM,UAAU,OAAO,WAAW,KAAK;AACvC,UAAM,MAAM,UAAU,GAAG,OAAO,UAAU,WAAW,KAAK;AAE1D,UAAM,YAAuB;AAAA,MAC3B,OAAO;AAAA,MACP;AAAA,MACA;AAAA,MACA;AAAA,MACA,WAAW;AAAA,MACX,aAAa,OAAO;AAAA,IACtB;AAEA,WAAO,EAAE,IAAI,MAAM,MAAM,UAAU;AAAA,EACrC;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAWQ,6BACN,MACA,SACA,iBACS;AAET,UAAM,UAAU,KAAK,SAAS,WAAW;AACzC,eAAW,OAAO,SAAS;AACzB,YAAM,cAAc,KAAK,SAAS,qBAAqB,IAAI,EAAE;AAC7D,iBAAW,cAAc,aAAa;AAIpC,YAAI,WAAW,YAAY,KAAK,SAAS,SAAS;AAChD;AAAA,QACF;AAKA,aAAK,WAAW,SAAS,UAAU,KAAK,GAAG;AACzC;AAAA,QACF;AAGA,YAAI,CAAC,KAAK,SAAS,kBAAkB,UAAU,GAAG;AAChD;AAAA,QACF;AAGA,YAAI,WAAW,SAAS,iBAAiB;AACvC;AAAA,QACF;AAGA,YAAI,WAAW,uBAAuB,OAAO;AAC3C;AAAA,QACF;AAGA,cAAM,iBAAiB,WAAW,QAAQ;AAC1C,YAAI,CAAC,KAAK,YAAY,gBAAgB,IAAI,GAAG;AAC3C;AAAA,QACF;AAGA,cAAM,oBAAoB,WAAW,WAAW,CAAC;AACjD,cAAM,gBAAgB,QAAQ;AAAA,UAAM,YAClC,kBAAkB,SAAS,MAAM,KAAK,kBAAkB,SAAS,GAAG;AAAA,QACtE;AACA,YAAI,CAAC,eAAe;AAClB;AAAA,QACF;AAGA,eAAO;AAAA,MACT;AAAA,IACF;AAEA,WAAO;AAAA,EACT;AAAA,EAEQ,oBAAiD;AACvD,QAAI;AACF,WAAK,iBAAiB;AACtB,aAAO;AAAA,IACT,SAAS,KAAK;AACZ,aAAOA;AAAA,QACL,qBAAqB;AAAA,QACrB;AAAA,QACA,eAAe,QAAQ,MAAM;AAAA,MAC/B;AAAA,IACF;AAAA,EACF;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAUQ,YAAY,gBAAwB,eAAgC;AAE1E,QAAI,mBAAmB,MAAM,mBAAmB,KAAK;AACnD,aAAO;AAAA,IACT;AAGA,QAAI,mBAAmB,eAAe;AACpC,aAAO;AAAA,IACT;AAGA,UAAM,uBAAuB,eAAe,QAAQ,OAAO,EAAE;AAC7D,UAAM,oBAAoB,cAAc,QAAQ,OAAO,EAAE;AAEzD,QAAI,kBAAkB,WAAW,uBAAuB,GAAG,GAAG;AAC5D,aAAO;AAAA,IACT;AAEA,WAAO;AAAA,EACT;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAOA,MAAc,wBACZ,aACA,MACA,SACA,QACsD;AACtD,UAAM,cAAc,KAAK,kBAAkB;AAC3C,QAAI,YAAa,QAAO,EAAE,IAAI,OAAO,OAAO,YAAY;AAExD,QAAI,CAAC,KAAK,SAAS;AACjB,aAAO;AAAA,QACL,IAAI;AAAA,QACJ,OAAOA;AAAA,UACL,qBAAqB;AAAA,UACrB;AAAA,QACF;AAAA,MACF;AAAA,IACF;AAEA,QAAI,KAAK,wBAAwB;AAc/B,UAAI;AACF,YAAI,QAAQ,WAAW,GAAG;AACxB,iBAAO;AAAA,YACL,IAAI;AAAA,YACJ,OAAOA;AAAA,cACL,qBAAqB;AAAA,cACrB;AAAA,YACF;AAAA,UACF;AAAA,QACF;AACA,cAAM,eAAe,gCAAgC,OAAO;AAC5D,YAAI,iBAAiB,QAAW;AAC9B,iBAAO;AAAA,YACL,IAAI;AAAA,YACJ,OAAOA;AAAA,cACL,qBAAqB;AAAA,cACrB,uDAAuD,KAAK,UAAU,OAAO,CAAC;AAAA,YAChF;AAAA,UACF;AAAA,QACF;AAEA,cAAM,aAAa,KAAK,uBAAuB;AAAA,UAC7C,SAAS,KAAK;AAAA,UACd;AAAA,UACA,SAAS,KAAK,QAAQ;AAAA,UACtB,WAAW;AAAA,YACT,CAAC,YAAY,GAAG;AAAA,cACd,CAAC,IAAI,GAAG,CAAC,GAAG,OAAO;AAAA,YACrB;AAAA,UACF;AAAA,UACA,gBAAgB,KAAK,MAAM,OAAO,QAAQ,IAAI,GAAI;AAAA,QACpD,CAAC;AACD,cAAM,0BAA0B,KAAK,kBAAkB;AACvD,YAAI,wBAAyB,QAAO,EAAE,IAAI,OAAO,OAAO,wBAAwB;AAGhF,cAAM,cAAc,MAAM,KAAK,QAAQ,GAAG,KAAK,IAAI,aAAa;AAAA,UAC9D,QAAQ;AAAA,UACR,SAAS;AAAA,YACP,eAAe,WAAW;AAAA,UAC5B;AAAA,QACF,CAAC;AACD,cAAM,0BAA0B,KAAK,kBAAkB;AACvD,YAAI,wBAAyB,QAAO,EAAE,IAAI,OAAO,OAAO,wBAAwB;AAEhF,YAAI,CAAC,YAAY,IAAI;AACnB,gBAAM,YAAY,MAAM,YAAY,KAAK;AACzC,gBAAM,8BAA8B,KAAK,kBAAkB;AAC3D,cAAI,4BAA6B,QAAO,EAAE,IAAI,OAAO,OAAO,4BAA4B;AACxF,iBAAO;AAAA,YACL,IAAI;AAAA,YACJ,OAAOA;AAAA,cACL,qBAAqB;AAAA,cACrB,8CAA8C,YAAY,MAAM,IAAI,SAAS;AAAA,YAC/E;AAAA,UACF;AAAA,QACF;AAOA,YAAI,WAAW,UAAU,WAAW,GAAG;AACrC,iBAAO;AAAA,YACL,IAAI;AAAA,YACJ,OAAOA;AAAA,cACL,qBAAqB;AAAA,cACrB;AAAA,YACF;AAAA,UACF;AAAA,QACF;AACA,cAAM,UAAU,WAAW,UAAU,CAAC;AACtC,eAAO;AAAA,UACL,KAAK,WAAW;AAAA,UAChB,aAAa,WAAW;AAAA,UACxB,SAAS,KAAK,QAAQ;AAAA,UACtB,MAAM,QAAQ;AAAA,UACd,SAAS,QAAQ;AAAA,UACjB,QAAQ,WAAW;AAAA,UACnB,WAAW;AAAA,UACX,YAAY,WAAW;AAAA,UACvB,oBAAoB;AAAA,UACpB,WAAW,oBAAI,KAAK;AAAA,QACtB;AAAA,MACF,SAAS,KAAK;AACZ,eAAO;AAAA,UACL,IAAI;AAAA,UACJ,OAAOA;AAAA,YACL,qBAAqB;AAAA,YACrB,yCAAyC,eAAe,QAAQ,IAAI,UAAU,OAAO,GAAG,CAAC;AAAA,YACzF,eAAe,QAAQ,MAAM;AAAA,UAC/B;AAAA,QACF;AAAA,MACF;AAAA,IACF,OAAO;AAEL,YAAM,mBAA2C;AAAA,QAC/C;AAAA,QACA;AAAA,QACA;AAAA,QACA;AAAA,QACA,sBAAsB;AAAA,MACxB;AAEA,YAAM,mBAAmB,KAAK,qBAC1B,MAAM,KAAK,mBAAmB,gBAAgB,IAC9C,MAAM,KAAK,kBAAmB,OAAO,gBAAgB;AACzD,YAAM,gCAAgC,KAAK,kBAAkB;AAC7D,UAAI,8BAA+B,QAAO,EAAE,IAAI,OAAO,OAAO,8BAA8B;AAE5F,UAAI,CAAC,iBAAiB,IAAI;AACxB,eAAO;AAAA,UACL,IAAI;AAAA,UACJ,OAAOA;AAAA,YACL,qBAAqB;AAAA,YACrB,0CAA0C,iBAAiB,MAAM,OAAO;AAAA,YACxE,iBAAiB,MAAM;AAAA,YACvB,iBAAiB,MAAM;AAAA,UACzB;AAAA,QACF;AAAA,MACF;AAEA,aAAO,iBAAiB;AAAA,IAC1B;AAAA,EACF;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAaA,MAAM,QACJ,MACA,UAA0B,CAAC,GACoB;AAC/C,UAAM,cAAc,KAAK,kBAAkB;AAC3C,QAAI,YAAa,QAAO,EAAE,IAAI,OAAO,OAAO,YAAY;AAExD,UAAM;AAAA,MACJ,kBAAkB;AAAA,MAClB,gBAAgB;AAAA,MAChB;AAAA,IACF,IAAI;AAGJ,UAAM,eAAe,KAAK,yBAAyB,IAAI;AACvD,QAAI,CAAC,aAAa,IAAI;AACpB,aAAO;AAAA,IACT;AACA,UAAM,YAAY,aAAa;AAM/B,UAAM,mBAAmB,IAAI,KAAK,UAAU,WAAW,MAAM;AAC7D,QAAI,mBAAmB,oBAAI,KAAK,GAAG;AACjC,aAAO;AAAA,QACL,IAAI;AAAA,QACJ,OAAOA;AAAA,UACL,qBAAqB;AAAA,UACrB;AAAA,QACF;AAAA,MACF;AAAA,IACF;AAGA,QAAI,UAAU,WAAW,WAAW;AAClC,aAAO;AAAA,QACL,IAAI;AAAA,QACJ,OAAOA;AAAA,UACL,qBAAqB;AAAA,UACrB;AAAA,QACF;AAAA,MACF;AAAA,IACF;AAGA,UAAM,UAAmB;AAAA,MACvB,IAAI,YAAY,UAAU,MAAM;AAAA,MAChC,KAAK,UAAU;AAAA,MACf,MAAM;AAAA,MACN,KAAK,UAAU;AAAA,MACf,UAAU;AAAA;AAAA,IACZ;AAEA,SAAK,SAAS,UAAU,SAAS,UAAU,YAAY,aAAa;AAGpE,QAAI,mBAAmB,UAAU;AACjC,QAAI,YAAY;AAGhB,QAAI,mBAAmB,iBAAiB,KAAK,SAAS;AACpD,YAAM,QAAQ,MAAM,KAAK,sBAAsB,MAAM;AAAA,QACnD,aAAa,KAAK,QAAQ;AAAA,QAC1B,cAAc,UAAU;AAAA,MAC1B,CAAC;AACD,UAAI,CAAC,MAAM,GAAI,QAAO;AACtB,yBAAmB,MAAM,KAAK;AAC9B,kBAAY;AAAA,QACV,IAAI,WAAW,aAAa,KAAK,QAAQ,kBAAkB,CAAC;AAAA,QAC5D,KAAK,KAAK,QAAQ;AAAA,QAClB,MAAM;AAAA,QACN,UAAU;AAAA,MACZ;AAAA,IACF;AAKA,UAAM,wBAAyB,iBAE5B,kBAAkB;AACrB,UAAM,aAAa,yBAAyB,iBAAiB,cAAc,UAAU,iBAAiB,GAAG;AACzG,UAAM,gBAAgB,UAAU,SAAS,aAAa,KAAK,UACvD,KAAK,UACL;AACJ,UAAM,eAA+B;AAAA,MACnC,kBAAkB,EAAE,eAAe,WAAW;AAAA,MAC9C,eAAe,iBAAiB;AAAA,MAChC,SAAS,UAAU;AAAA,MACnB,oBAAoB,eAAe,sBAAsB,UAAU;AAAA,MACnE,KAAK,eAAe,OAAO,UAAU;AAAA,IACvC;AAEA,UAAM,YAAY,KAAK,gBAAgB;AAAA,MACrC,OAAO,CAAC,UAAU,IAAI;AAAA,MACtB,SAAS;AAAA,MACT,QAAQ,KAAK;AAAA,MACb,OAAO,KAAK;AAAA,MACZ,YAAY,UAAU;AAAA,IACxB,CAAC;AAED,UAAM,cAA2B;AAAA,MAC/B,YAAY;AAAA,MACZ,KAAK;AAAA,MACL,IAAI;AAAA,MACJ,SAAS,UAAU;AAAA,MACnB,MAAM,UAAU;AAAA,IAClB;AAEA,WAAO,EAAE,IAAI,MAAM,MAAM,YAAY;AAAA,EACvC;AAAA,EAEA,MAAM,UACJ,MACA,UAAwG,CAAC,GACjF;AACxB,UAAM,SAAS,IAAI,qBAAqB;AAAA,MACtC,GAAG;AAAA,MACH,gBAAgB,KAAK;AAAA,MACrB,OAAO,KAAK;AAAA,MACZ,QAAQ,KAAK;AAAA,MACb,iBAAiB,KAAK;AAAA,IACxB,CAAC;AACD,WAAO,OAAO,KAAK,IAAI;AAAA,EACzB;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAWA,MAAM,sBACJ,MACA,QACwD;AACxD,UAAM,cAAc,KAAK,kBAAkB;AAC3C,QAAI,YAAa,QAAO,EAAE,IAAI,OAAO,OAAO,YAAY;AAExD,UAAM,UAAU,KAAK,yBAAyB,IAAI;AAClD,QAAI,CAAC,QAAQ,GAAI,QAAO;AACxB,UAAM,YAAY,QAAQ;AAC1B,SAAK,mCAAmC,UAAU,UAAU;AAE5D,UAAM,eAAe,IAAI,KAAK,UAAU,WAAW,MAAM;AACzD,UAAM,MAAM,oBAAI,KAAK;AACrB,QAAI,gBAAgB,KAAK;AACvB,aAAO;AAAA,QACL,IAAI;AAAA,QACJ,OAAOA,aAAY,qBAAqB,cAAc,0BAA0B;AAAA,MAClF;AAAA,IACF;AACA,QAAI,UAAU,WAAW,WAAW;AAClC,aAAO;AAAA,QACL,IAAI;AAAA,QACJ,OAAOA,aAAY,qBAAqB,SAAS,+BAA+B;AAAA,MAClF;AAAA,IACF;AACA,QAAI,UAAU,WAAW,uBAAuB,OAAO;AACrD,aAAO;AAAA,QACL,IAAI;AAAA,QACJ,OAAOA;AAAA,UACL,qBAAqB;AAAA,UACrB;AAAA,QACF;AAAA,MACF;AAAA,IACF;AACA,UAAM,cAAc,aAAa,OAAO,aAAa,KAAK,KAAK,EAAE;AACjE,QAAI,CAAC,2BAA2B,KAAK,WAAW,GAAG;AACjD,aAAO;AAAA,QACL,IAAI;AAAA,QACJ,OAAOA,aAAY,qBAAqB,eAAe,iCAAiC;AAAA,MAC1F;AAAA,IACF;AACA,UAAM,cAAc,kBAAkB,UAAU,MAAM,KAAK,OAAO,OAAO,YAAY;AACrF,QAAI,CAAC,aAAa;AAChB,aAAO;AAAA,QACL,IAAI;AAAA,QACJ,OAAOA;AAAA,UACL,qBAAqB;AAAA,UACrB;AAAA,QACF;AAAA,MACF;AAAA,IACF;AACA,QACE,UAAU,WAAW,YAAY,UAAU,WAC3C,aAAa,UAAU,WAAW,WAAW,MAAM,aAAa,UAAU,MAAM,KAChF,CAAC,mBAAmB,UAAU,KAAK,UAAU,MAAM,KACnD,CAAC,uBAAuB,UAAU,WAAW,MAAM,UAAU,IAAI,GACjE;AACA,aAAO;AAAA,QACL,IAAI;AAAA,QACJ,OAAOA;AAAA,UACL,qBAAqB;AAAA,UACrB;AAAA,QACF;AAAA,MACF;AAAA,IACF;AACA,QAAI,CAAC,UAAU,WAAW,YAAY;AACpC,aAAO;AAAA,QACL,IAAI;AAAA,QACJ,OAAOA;AAAA,UACL,qBAAqB;AAAA,UACrB;AAAA,QACF;AAAA,MACF;AAAA,IACF;AACA,QAAI,CAAC,KAAK,0BAA0B,CAAC,KAAK,cAAc;AACtD,aAAO;AAAA,QACL,IAAI;AAAA,QACJ,OAAOA;AAAA,UACL,qBAAqB;AAAA,UACrB;AAAA,QACF;AAAA,MACF;AAAA,IACF;AAEA,UAAM,OAAO,OAAO,QAAQ,UAAU;AACtC,QAAI,CAAC,uBAAuB,UAAU,MAAM,IAAI,GAAG;AACjD,aAAO;AAAA,QACL,IAAI;AAAA,QACJ,OAAOA;AAAA,UACL,qBAAqB;AAAA,UACrB;AAAA,QACF;AAAA,MACF;AAAA,IACF;AAEA,UAAM,gBAAgB,UAAU,WAAW;AAC3C,UAAM,UAAU,OAAO,WAAW,CAAC,GAAG,aAAa;AACnD,QACE,QAAQ,WAAW,KACnB,IAAI,IAAI,OAAO,EAAE,SAAS,QAAQ,UAClC,QAAQ,SAAS,GAAG,KACpB,QAAQ,KAAK,CAAC,WAAW,CAAC,cAAc,KAAK,CAAC,iBAAiB,eAAe,cAAc,MAAM,CAAC,CAAC,GACpG;AACA,aAAO;AAAA,QACL,IAAI;AAAA,QACJ,OAAOA;AAAA,UACL,qBAAqB;AAAA,UACrB;AAAA,QACF;AAAA,MACF;AAAA,IACF;AAEA,UAAM,SAAS,OAAO,UAAU;AAChC,QAAI,UAAU,OAAO,SAAS,cAAc;AAC1C,aAAO;AAAA,QACL,IAAI;AAAA,QACJ,OAAOA;AAAA,UACL,qBAAqB;AAAA,UACrB;AAAA,QACF;AAAA,MACF;AAAA,IACF;AAEA,UAAM,UAAU,gCAAgC,OAAO;AACvD,QAAI,CAAC,SAAS;AACZ,aAAO;AAAA,QACL,IAAI;AAAA,QACJ,OAAOA;AAAA,UACL,qBAAqB;AAAA,UACrB;AAAA,QACF;AAAA,MACF;AAAA,IACF;AAEA,UAAM,QAAQ,iBAAiB,UAAU,OAAO;AAChD,QAAI,CAAC,OAAO;AACV,aAAO;AAAA,QACL,IAAI;AAAA,QACJ,OAAOA;AAAA,UACL,qBAAqB;AAAA,UACrB;AAAA,QACF;AAAA,MACF;AAAA,IACF;AAEA,QAAI;AACF,YAAM,gBAAgC;AAAA,QACpC,kBAAkB,EAAE,eAAe,UAAU,WAAW,WAAW;AAAA,QACnE,eAAe,UAAU,WAAW;AAAA,QACpC,SAAS,UAAU;AAAA,QACnB,oBAAoB,UAAU;AAAA,QAC9B,KAAK,UAAU;AAAA,MACjB;AACA,YAAM,SAAS,KAAK,uBAAuB;AAAA,QACzC,SAAS;AAAA,QACT;AAAA,QACA,SAAS,UAAU;AAAA,QACnB,WAAW,EAAE,CAAC,OAAO,GAAG,EAAE,CAAC,IAAI,GAAG,QAAQ,EAAE;AAAA,QAC5C,gBAAgB,KAAK,MAAM,OAAO,QAAQ,IAAI,GAAI;AAAA,MACpD,CAAC;AACD,YAAM,0BAA0B,KAAK,kBAAkB;AACvD,UAAI,wBAAyB,QAAO,EAAE,IAAI,OAAO,OAAO,wBAAwB;AAChF,YAAM,gBAAgB,kBAAkB,QAAQ;AAAA,QAC9C;AAAA,QACA,WAAW,aAAa,UAAU,MAAM;AAAA,QACxC,WAAW,UAAU,WAAW;AAAA,QAChC;AAAA,QACA,SAAS,UAAU;AAAA,QACnB;AAAA,QACA;AAAA,QACA,WAAW;AAAA,QACX,iBAAiB;AAAA,MACnB,GAAG,KAAK,YAAY;AACpB,UAAI,CAAC,eAAe;AAClB,eAAO;AAAA,UACL,IAAI;AAAA,UACJ,OAAOA;AAAA,YACL,qBAAqB;AAAA,YACrB;AAAA,UACF;AAAA,QACF;AAAA,MACF;AAEA,YAAM,mBAAmB;AAAA,QACvB,QAAQ;AAAA,QACR,SAAS,EAAE,eAAe,OAAO,WAAW;AAAA,QAC5C,UAAU;AAAA,MACZ;AACA,YAAM,eAAe,MAAM,KAAK,QAAQ,IAAI,IAAI,aAAa,WAAW,EAAE,SAAS,GAAG,gBAAgB;AACtG,YAAM,0BAA0B,KAAK,kBAAkB;AACvD,UAAI,wBAAyB,QAAO,EAAE,IAAI,OAAO,OAAO,wBAAwB;AAChF,UAAI,CAAC,aAAa,IAAI;AACpB,cAAM,IAAI,MAAM,mCAAmC,aAAa,MAAM,GAAG;AAAA,MAC3E;AAEA,YAAM,UAAU,cAAc;AAC9B,aAAO;AAAA,QACL,IAAI;AAAA,QACJ,MAAM;AAAA,UACJ,YAAY;AAAA,YACV,KAAK,OAAO;AAAA,YACZ,aAAa,cAAc;AAAA,YAC3B,cAAc,UAAU,OAAO,MAAM,GAAG,EAAE,CAAC;AAAA,YAC3C,SAAS,UAAU;AAAA,YACnB,MAAM,QAAQ;AAAA,YACd,SAAS,QAAQ;AAAA,YACjB,QAAQ,cAAc;AAAA,YACtB,WAAW;AAAA,YACX,oBAAoB;AAAA,YACpB,WAAW,UAAU,WAAW;AAAA,YAChC,WAAW;AAAA,YACX,kBAAkB,EAAE,eAAe,OAAO,WAAW;AAAA,YACrD,cAAc,MAAM;AAAA,YACpB,SAAS,MAAM;AAAA,YACf,MAAM;AAAA,YACN,WAAW,OAAO;AAAA,YAClB,sBAAsB;AAAA,UACxB;AAAA,UACA,QAAQ;AAAA,YACN,WAAW,UAAU,WAAW;AAAA,YAChC,SAAS,UAAU;AAAA,YACnB,MAAM,QAAQ;AAAA,YACd,MAAM;AAAA,YACN,WAAW,cAAc;AAAA,UAC3B;AAAA,QACF;AAAA,MACF;AAAA,IACF,SAAS,KAAK;AACZ,aAAO;AAAA,QACL,IAAI;AAAA,QACJ,OAAOA;AAAA,UACL,qBAAqB;AAAA,UACrB;AAAA,QACF;AAAA,MACF;AAAA,IACF;AAAA,EACF;AAAA;AAAA;AAAA;AAAA;AAAA,EAMQ,mCAAmC,YAA8B;AACvE,QAAI,kBAAkB,WAAW,SAAS,MAAS,EAAG;AACtD,UAAM,UAAU,WAAW,QAAQ,CAAC,GAAG,MAAM,KAAK,CAAC,EAAE,CAAC,KAAK;AAC3D,UAAM,QAAyB;AAAA,MAC7B;AAAA,MACA,OAAO,WAAW;AAAA,MAClB,MAAM,WAAW;AAAA,MACjB,SAAS,CAAC,GAAG,WAAW,OAAO;AAAA,MAC/B,SAAS,WAAW,WAAW,CAAC;AAAA,IAClC;AACA,UAAM,IAAI,mCAAmC,CAAC,KAAK,CAAC;AAAA,EACtD;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EASA,WAAW,MAAwB,SAAsB,UAAkB;AACzE,QAAI,WAAW,UAAU;AACvB,YAAM,IAAI,MAAM,WAAW,MAAM,gDAAgD;AAAA,IACnF;AAEA,UAAM,aAAa,KAAK,UAAU,IAAI;AACtC,UAAM,UAAU,gBAAgB,UAAU;AAC1C,WAAO,GAAG,aAAa,GAAG,OAAO;AAAA,EACnC;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EASA,WAAW,MAAgC;AACzC,UAAM,SAAS,KAAK,yBAAyB,IAAI;AACjD,QAAI,CAAC,OAAO,IAAI;AACd,YAAM,IAAI,MAAM,OAAO,MAAM,OAAO;AAAA,IACtC;AACA,WAAO,OAAO;AAAA,EAChB;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAWQ,yBAAyB,MAAyD;AAExF,QAAI,UAAU;AAGd,QAAI,KAAK,SAAS,SAAS,GAAG;AAC5B,YAAM,QAAQ,KAAK,MAAM,SAAS;AAClC,gBAAU,MAAM,MAAM,SAAS,CAAC;AAAA,IAClC;AAGA,QAAI,KAAK,SAAS,SAAS,GAAG;AAC5B,UAAI;AACF,cAAM,MAAM,IAAI,IAAI,IAAI;AACxB,kBAAU,IAAI,aAAa,IAAI,OAAO,KAAK;AAAA,MAC7C,QAAQ;AACN,eAAO;AAAA,UACL,IAAI;AAAA,UACJ,OAAOA;AAAA,YACL,qBAAqB;AAAA,YACrB;AAAA,UACF;AAAA,QACF;AAAA,MACF;AAAA,IACF;AAGA,QAAI,CAAC,QAAQ,WAAW,aAAa,GAAG;AACtC,aAAO;AAAA,QACL,IAAI;AAAA,QACJ,OAAOA;AAAA,UACL,qBAAqB;AAAA,UACrB,iDAAiD,aAAa;AAAA,QAChE;AAAA,MACF;AAAA,IACF;AAEA,UAAM,aAAa,QAAQ,MAAM,cAAc,MAAM;AAErD,QAAI;AACJ,QAAI;AACF,mBAAa,gBAAgB,UAAU;AAAA,IACzC,SAAS,KAAK;AACZ,aAAO;AAAA,QACL,IAAI;AAAA,QACJ,OAAOA;AAAA,UACL,qBAAqB;AAAA,UACrB,iCAAiC,eAAe,QAAQ,IAAI,UAAU,OAAO,GAAG,CAAC;AAAA,UACjF,eAAe,QAAQ,MAAM;AAAA,QAC/B;AAAA,MACF;AAAA,IACF;AAEA,QAAI;AACJ,QAAI;AACF,eAAS,KAAK,MAAM,UAAU;AAAA,IAChC,SAAS,KAAK;AACZ,aAAO;AAAA,QACL,IAAI;AAAA,QACJ,OAAOA;AAAA,UACL,qBAAqB;AAAA,UACrB,oCAAoC,eAAe,QAAQ,IAAI,UAAU,OAAO,GAAG,CAAC;AAAA,UACpF,eAAe,QAAQ,MAAM;AAAA,QAC/B;AAAA,MACF;AAAA,IACF;AAIA,QACE,UACA,OAAO,WAAW,YAClB,gBAAgB,UAChB,OAAO,cACP,OAAO,OAAO,eAAe,YAC7B,YAAY,OAAO,cACnB,OAAO,OAAO,WAAW,WAAW,UACpC;AACA,MAAC,OAAO,WAAgC,SAAS,IAAI,KAAK,OAAO,WAAW,MAAM;AAAA,IACpF;AAGA,UAAM,mBAAmB,yBAAyB,MAAM;AACxD,QAAI,CAAC,iBAAiB,IAAI;AACxB,aAAO;AAAA,QACL,IAAI;AAAA,QACJ,OAAOA;AAAA,UACL,qBAAqB;AAAA,UACrB,iBAAiB,MAAM;AAAA,UACvB;AAAA,UACA,iBAAiB,MAAM;AAAA,QACzB;AAAA,MACF;AAAA,IACF;AAEA,WAAO,EAAE,IAAI,MAAM,MAAM,iBAAiB,KAAK;AAAA,EACjD;AACF;AAKO,SAAS,qBAAqB,QAA+C;AAClF,SAAO,IAAI,eAAe,MAAM;AAClC;AAEA,SAAS,iBAAiB,SAA8D;AACtF,QAAM,QAAQ,QAAQ,MAAM,kDAAkD;AAC9E,MAAI,CAAC,MAAO,QAAO;AACnB,QAAM,UAAU,OAAO,MAAM,CAAC,CAAC;AAC/B,MAAI,CAAC,OAAO,cAAc,OAAO,EAAG,QAAO;AAC3C,SAAO,EAAE,SAAS,SAAS,MAAM,CAAC,EAAE;AACtC;AAEA,SAAS,uBAAuB,OAA8B;AAC5D,MAAI;AACF,UAAM,MAAM,IAAI,IAAI,KAAK;AACzB,QACE,CAAC,CAAC,SAAS,QAAQ,EAAE,SAAS,IAAI,QAAQ,KAC1C,IAAI,YACJ,IAAI,YACH,IAAI,aAAa,MAAM,IAAI,aAAa,OACzC,IAAI,UACJ,IAAI,KACJ,QAAO;AACT,WAAO,IAAI,OAAO,YAAY;AAAA,EAChC,QAAQ;AACN,WAAO;AAAA,EACT;AACF;AAEA,SAAS,kBAAkB,WAAmB,YAAsB,UAAkC;AACpG,QAAM,SAAS,uBAAuB,SAAS;AAC/C,MAAI,CAAC,OAAQ,QAAO;AACpB,QAAM,UAAU,IAAI,IAAI,WAAW,IAAI,sBAAsB,EAAE,OAAO,CAAC,UAA2B,QAAQ,KAAK,CAAC,CAAC;AACjH,MAAI,CAAC,QAAQ,IAAI,MAAM,EAAG,QAAO;AACjC,MAAI,YAAY,uBAAuB,QAAQ,MAAM,OAAQ,QAAO;AACpE,SAAO;AACT;AAEA,SAAS,wBAAwB,MAA6B;AAC5D,MACE,oBAAoB,KAAK,IAAI,KAC7B,iBAAiB,KAAK,IAAI,KAC1B,KAAK,SAAS,IAAI,EAClB,QAAO;AACT,QAAM,gBAAgB,KAAK,QAAQ,GAAG;AACtC,MAAI,kBAAkB,MAAM,CAAC,KAAK,SAAS,IAAI,KAAK,CAAC,KAAK,SAAS,KAAK,EAAG,QAAO;AAClF,MAAI,KAAK,MAAM,GAAG,EAAE,EAAE,SAAS,GAAG,KAAM,KAAK,SAAS,IAAI,KAAK,KAAK,MAAM,GAAG,EAAE,EAAE,SAAS,GAAG,EAAI,QAAO;AACxG,QAAM,WAAW,KAAK,MAAM,GAAG;AAC/B,MAAI,SAAS,KAAK,CAAC,YAAY,YAAY,OAAO,YAAY,IAAI,EAAG,QAAO;AAC5E,SAAO;AACT;AAEA,SAAS,uBAAuB,QAAgB,OAAwB;AACtE,QAAM,kBAAkB,wBAAwB,MAAM;AACtD,QAAM,iBAAiB,wBAAwB,KAAK;AACpD,MAAI,oBAAoB,QAAQ,mBAAmB,KAAM,QAAO;AAChE,MAAI,oBAAoB,MAAM,oBAAoB,IAAK,QAAO;AAC9D,MAAI,oBAAoB,eAAgB,QAAO;AAC/C,MAAI,gBAAgB,SAAS,KAAK,GAAG;AACnC,WAAO,eAAe,WAAW,gBAAgB,MAAM,GAAG,EAAE,CAAC;AAAA,EAC/D;AACA,MAAI,gBAAgB,SAAS,IAAI,GAAG;AAClC,UAAM,SAAS,gBAAgB,MAAM,GAAG,EAAE;AAC1C,QAAI,CAAC,eAAe,WAAW,MAAM,EAAG,QAAO;AAC/C,UAAM,YAAY,eAAe,MAAM,OAAO,MAAM;AACpD,WAAO,UAAU,SAAS,KAAK,CAAC,UAAU,SAAS,GAAG;AAAA,EACxD;AACA,SAAO,gBAAgB,SAAS,GAAG,KAAK,eAAe,WAAW,eAAe;AACnF;AAEA,SAAS,mBAAmB,KAAU,QAAyB;AAC7D,MACE,IAAI,QAAQ,SACZ,IAAI,QAAQ,aACZ,OAAO,IAAI,MAAM,YACjB,OAAO,IAAI,MAAM,SACjB,QAAO;AACT,MAAI;AACF,UAAM,WAAW,MAAM,UAAU,OAAO,aAAa,MAAM,EAAE,MAAM,WAAW,MAAM,CAAC;AACrF,UAAM,YAAY,SAAS,WAAW,MAAM,SAAS,CAAC,MAAM,OAAQ,SAAS,CAAC,MAAM,IAChF,SAAS,MAAM,CAAC,IAChB;AACJ,QAAI,CAAC,UAAW,QAAO;AACvB,UAAM,WAAW,qBAAqB,IAAI,CAAC;AAC3C,UAAM,aAAa,qBAAqB,IAAI,CAAC;AAC7C,UAAM,mBAAmB,wBAAQ,aAAa,UAAU;AACxD,WACE,WAAW,WAAW,MACtB,UAAU,WAAW,SAAS,UAC9B,UAAU,MAAM,CAAC,MAAM,UAAU,SAAS,SAAS,KAAK,CAAC,KACzD,iBAAiB,WAAW,SAAS,UACrC,iBAAiB,MAAM,CAAC,MAAM,UAAU,SAAS,SAAS,KAAK,CAAC;AAAA,EAEpE,QAAQ;AACN,WAAO;AAAA,EACT;AACF;AAEA,SAAS,qBAAqB,OAA2B;AACvD,MAAI,UAAU,MAAM,QAAQ,MAAM,GAAG,EAAE,QAAQ,MAAM,GAAG;AACxD,SAAO,QAAQ,SAAS,EAAG,YAAW;AACtC,MAAI,OAAO,SAAS,aAAa;AAC/B,WAAO,WAAW,KAAK,KAAK,OAAO,GAAG,CAAC,cAAc,UAAU,WAAW,CAAC,CAAC;AAAA,EAC9E;AACA,SAAO,WAAW,KAAK,OAAO,KAAK,SAAS,QAAQ,CAAC;AACvD;AAEA,SAAS,kBACP,QACA,UAWA,YAC4G;AAC5G,QAAM,QAAQ,OAAO,WAAW,MAAM,GAAG;AACzC,MAAI,MAAM,WAAW,EAAG,QAAO;AAC/B,MAAI;AACJ,MAAI;AACF,cAAU,KAAK,MAAM,IAAI,YAAY,EAAE,OAAO,qBAAqB,MAAM,CAAC,CAAC,CAAC,CAAC;AAAA,EAC/E,QAAQ;AACN,WAAO;AAAA,EACT;AACA,QAAM,cAAc,OAAO,QAAQ,QAAQ,WAAW,aAAa,QAAQ,GAAG,IAAI;AAClF,QAAM,YAAY,OAAO,QAAQ,QAAQ,WAAW,aAAa,QAAQ,GAAG,IAAI;AAChF,QAAM,SAAS,MAAM,QAAQ,QAAQ,GAAG,IAAI,QAAQ,MAAM,CAAC;AAC3D,QAAM,iBAAiB,OAAO,QAAQ,QAAQ,YAAY,OAAO,UAAU,QAAQ,GAAG,IAAI,QAAQ,MAAM;AACxG,QAAM,YAAY,IAAI,KAAK,iBAAiB,GAAI;AAChD,MACE,gBAAgB,SAAS,eACzB,cAAc,SAAS,aACvB,OAAO,WAAW,KAClB,OAAO,CAAC,MAAM,SAAS,aACvB,aAAa,oBAAI,KAAK,KACtB,YAAY,SAAS,aACrB,YAAY,SAAS,mBACrB,WAAW,IAAI,YAAY,EAAE,OAAO,OAAO,UAAU,GAAG,KAAK,MAAM,OAAO,IAC1E,QAAO;AAET,QAAM,MAAM,QAAQ;AACpB,MAAI,CAAC,OAAO,OAAO,QAAQ,YAAY,MAAM,QAAQ,GAAG,EAAG,QAAO;AAClE,QAAM,UAAU,OAAO,QAAQ,GAA8B;AAC7D,MAAI,QAAQ,WAAW,EAAG,QAAO;AACjC,QAAM,CAAC,aAAa,YAAY,IAAI,QAAQ,CAAC;AAC7C,QAAM,SAAS,GAAG,SAAS,OAAO,IAAI,SAAS,OAAO;AACtD,MAAI,CAAC,YAAY,WAAW,MAAM,KAAK,YAAY,MAAM,OAAO,MAAM,MAAM,SAAS,KAAM,QAAO;AAClG,MAAI,CAAC,gBAAgB,OAAO,iBAAiB,YAAY,MAAM,QAAQ,YAAY,EAAG,QAAO;AAC7F,QAAM,gBAAgB,OAAO,KAAK,YAAuC,EAAE,KAAK;AAChF,QAAM,kBAAkB,CAAC,GAAG,SAAS,OAAO,EAAE,KAAK;AACnD,MACE,cAAc,WAAW,gBAAgB,UACzC,CAAC,cAAc,MAAM,CAAC,QAAQ,UAAU,WAAW,gBAAgB,KAAK,CAAC,EACzE,QAAO;AAET,MAAI,aAAa,OAAO,WAAW,MAAM,eAAe,OAAO,UAAU,WAAW,EAAG,QAAO;AAC9F,MAAI,OAAO,OAAO,QAAQ,MAAM,UAAU,QAAQ,EAAG,QAAO;AAC5D,QAAM,WAAW,OAAO,UAAU,CAAC;AACnC,MACE,SAAS,YAAY,SAAS,WAC9B,SAAS,UAAU,SAAS,WAC5B,SAAS,SAAS,SAAS,KAC3B,QAAO;AACT,QAAM,gBAAgB,CAAC,GAAG,SAAS,OAAO,EAAE,KAAK;AACjD,MACE,cAAc,WAAW,gBAAgB,UACzC,CAAC,cAAc,MAAM,CAAC,QAAQ,UAAU,WAAW,gBAAgB,KAAK,CAAC,EACzE,QAAO;AACT,SAAO,EAAE,aAAa,WAAW,SAAS;AAC5C;;;AMrxDA,IAAAI,kBAAwB;AACxB,IAAAC,iBAAuB;;;ACDvB,IAAAC,kBAAwB;AAExB,IAAAC,eAAkD;;;ACQ3C,IAAM,2BAAN,cAAuC,MAAM;AAAA,EAGlD,YAAYC,OAA6B,SAAiB;AACxD,UAAM,OAAO;AACb,SAAK,OAAO;AACZ,SAAK,OAAOA;AAAA,EACd;AACF;AASO,IAAM,oCAAN,cAAgD,yBAAyB;AAAA,EAC9E,YAAY,SAAiB;AAC3B,UAAM,6BAA6B,OAAO;AAC1C,SAAK,OAAO;AAAA,EACd;AACF;;;ACrBA,IAAM,eACH,OAEE,UACF,OAAO,UAAU,eAAe,KAAK;AAAA,EACpC,OAAO,UAAU;AACnB;AAWK,SAAS,gBAAgB,OAAwB;AACtD,SAAO,UAAU,cAAc,OAAO,GAAG,CAAC;AAC5C;AAEO,SAAS,cAAc,OAAgB,OAAO,KAAgB;AACnE,MAAI,UAAU,MAAM;AAClB,WAAO;AAAA,EACT;AAEA,UAAQ,OAAO,OAAO;AAAA,IACpB,KAAK;AACH,aAAO;AAAA,IACT,KAAK;AACH,UAAI,CAAC,OAAO,SAAS,KAAK,GAAG;AAC3B,cAAM,IAAI;AAAA,UACR,GAAG,IAAI;AAAA,QACT;AAAA,MACF;AACA,aAAO;AAAA,IACT,KAAK;AACH,gCAA0B,OAAO,IAAI;AACrC,aAAO;AAAA,IACT,KAAK;AACH,aAAO,2BAA2B,OAAO,IAAI;AAAA,IAC/C,KAAK;AAAA,IACL,KAAK;AAAA,IACL,KAAK;AAAA,IACL,KAAK;AAAA,IACL;AACE,YAAM,IAAI;AAAA,QACR,GAAG,IAAI;AAAA,MACT;AAAA,EACJ;AACF;AAEO,SAAS,UAAU,OAA0B;AAClD,MAAI,UAAU,MAAM;AAClB,WAAO;AAAA,EACT;AAEA,UAAQ,OAAO,OAAO;AAAA,IACpB,KAAK;AACH,aAAO,QAAQ,SAAS;AAAA,IAC1B,KAAK,UAAU;AACb,YAAM,UAAU,KAAK,UAAU,KAAK;AACpC,UAAI,YAAY,QAAW;AACzB,cAAM,IAAI;AAAA,UACR;AAAA,QACF;AAAA,MACF;AACA,aAAO;AAAA,IACT;AAAA,IACA,KAAK;AACH,aAAO,KAAK,UAAU,KAAK;AAAA,IAC7B,KAAK;AACH,UAAI,MAAM,QAAQ,KAAK,GAAG;AACxB,eAAO,IAAI,MAAM,IAAI,CAAC,SAAS,UAAU,IAAI,CAAC,EAAE,KAAK,GAAG,CAAC;AAAA,MAC3D;AACA,aAAO,gBAAgB,KAAK;AAAA,IAC9B;AACE,YAAM,IAAI;AAAA,QACR,+BAA+B,OAAO,KAAK;AAAA,MAC7C;AAAA,EACJ;AACF;AAEA,SAAS,2BAA2B,OAAe,MAAyB;AAC1E,qBAAmB,OAAO,IAAI;AAE9B,MAAI,MAAM,QAAQ,KAAK,GAAG;AACxB,eAAW,OAAO,OAAO,oBAAoB,KAAK,GAAG;AACnD,UAAI,QAAQ,UAAU;AACpB;AAAA,MACF;AACA,UAAI,CAAC,gBAAgB,KAAK,MAAM,MAAM,GAAG;AACvC,cAAM,IAAI;AAAA,UACR,GAAG,IAAI,IAAI,GAAG;AAAA,QAChB;AAAA,MACF;AACA,YAAM,aAAa,OAAO,yBAAyB,OAAO,GAAG;AAC7D,UAAI,YAAY,eAAe,MAAM;AACnC,cAAM,IAAI;AAAA,UACR,GAAG,IAAI,IAAI,GAAG;AAAA,QAChB;AAAA,MACF;AACA,UAAI,EAAE,WAAW,aAAa;AAC5B,cAAM,IAAI;AAAA,UACR,GAAG,IAAI,IAAI,GAAG;AAAA,QAChB;AAAA,MACF;AAAA,IACF;AACA,UAAMC,UAAsB,CAAC;AAC7B,aAAS,QAAQ,GAAG,QAAQ,MAAM,QAAQ,SAAS;AACjD,UAAI,CAAC,aAAa,OAAO,KAAK,GAAG;AAC/B,cAAM,IAAI;AAAA,UACR,GAAG,IAAI,IAAI,KAAK;AAAA,QAClB;AAAA,MACF;AACA,MAAAA,QAAO,KAAK,cAAc,MAAM,KAAK,GAAG,GAAG,IAAI,IAAI,KAAK,GAAG,CAAC;AAAA,IAC9D;AACA,WAAOA;AAAA,EACT;AAEA,QAAM,QAAQ,OAAO,eAAe,KAAK;AACzC,MAAI,UAAU,OAAO,aAAa,UAAU,MAAM;AAChD,UAAM,IAAI;AAAA,MACR,GAAG,IAAI;AAAA,IACT;AAAA,EACF;AAEA,QAAM,SAAS,uBAAO,OAAO,IAAI;AACjC,aAAW,OAAO,OAAO,oBAAoB,KAAK,GAAG;AACnD,8BAA0B,KAAK,GAAG,IAAI,MAAM;AAC5C,QAAI,QAAQ,eAAe,QAAQ,eAAe;AAChD,YAAM,IAAI;AAAA,QACR,GAAG,IAAI,IAAI,GAAG;AAAA,MAChB;AAAA,IACF;AACA,UAAM,aAAa,OAAO,yBAAyB,OAAO,GAAG;AAC7D,QAAI,YAAY,eAAe,MAAM;AACnC,YAAM,IAAI;AAAA,QACR,GAAG,IAAI,IAAI,GAAG;AAAA,MAChB;AAAA,IACF;AACA,QAAI,EAAE,WAAW,aAAa;AAC5B,YAAM,IAAI;AAAA,QACR,GAAG,IAAI,IAAI,GAAG;AAAA,MAChB;AAAA,IACF;AACA,UAAM,QAAQ,WAAW;AACzB,WAAO,GAAG,IAAI,cAAc,OAAO,GAAG,IAAI,IAAI,GAAG,EAAE;AAAA,EACrD;AACA,SAAO;AACT;AAEA,SAAS,mBAAmB,OAAe,MAAoB;AAC7D,MAAI,OAAO,sBAAsB,KAAK,EAAE,SAAS,GAAG;AAClD,UAAM,IAAI;AAAA,MACR,GAAG,IAAI;AAAA,IACT;AAAA,EACF;AACF;AAEA,SAAS,gBAAgB,KAAaC,SAAyB;AAC7D,MAAI,CAAC,iBAAiB,KAAK,GAAG,GAAG;AAC/B,WAAO;AAAA,EACT;AACA,QAAM,QAAQ,OAAO,GAAG;AACxB,SAAO,OAAO,cAAc,KAAK,KAAK,SAAS,KAAK,QAAQA;AAC9D;AAEA,SAAS,gBAAgB,OAAsD;AAC7E,QAAM,OAAO,OAAO,KAAK,KAAK,EAAE,KAAK,qBAAqB;AAC1D,QAAM,QAAQ,KAAK,IAAI,CAAC,QAAQ,GAAG,KAAK,UAAU,GAAG,CAAC,IAAI,UAAU,MAAM,GAAG,CAAC,CAAC,EAAE;AACjF,SAAO,IAAI,MAAM,KAAK,GAAG,CAAC;AAC5B;AAEA,SAAS,sBAAsB,GAAW,GAAmB;AAC3D,QAAM,MAAM,KAAK,IAAI,EAAE,QAAQ,EAAE,MAAM;AACvC,WAAS,QAAQ,GAAG,QAAQ,KAAK,SAAS;AACxC,UAAM,eAAe,EAAE,WAAW,KAAK;AACvC,UAAM,gBAAgB,EAAE,WAAW,KAAK;AACxC,QAAI,iBAAiB,eAAe;AAClC,aAAO,eAAe;AAAA,IACxB;AAAA,EACF;AACA,SAAO,EAAE,SAAS,EAAE;AACtB;AAEA,SAAS,0BAA0B,OAAe,MAAoB;AACpE,WAAS,QAAQ,GAAG,QAAQ,MAAM,QAAQ,SAAS;AACjD,UAAMC,QAAO,MAAM,WAAW,KAAK;AACnC,QAAIA,SAAQ,SAAUA,SAAQ,OAAQ;AACpC,YAAM,OAAO,MAAM,WAAW,QAAQ,CAAC;AACvC,UAAI,OAAO,MAAM,IAAI,KAAK,OAAO,SAAU,OAAO,OAAQ;AACxD,cAAM,IAAI;AAAA,UACR,GAAG,IAAI;AAAA,QACT;AAAA,MACF;AACA;AACA;AAAA,IACF;AACA,QAAIA,SAAQ,SAAUA,SAAQ,OAAQ;AACpC,YAAM,IAAI;AAAA,QACR,GAAG,IAAI;AAAA,MACT;AAAA,IACF;AAAA,EACF;AACF;;;AF7DA,IAAMC,eAAc,IAAI,YAAY;AAGpC,IAAMC,gBACH,OAEE,UACF,OAAO,UAAU,eAAe,KAAK;AAAA,EACpC,OAAO,UAAU;AACnB;AAEK,SAAS,iCAAiC,OAAwB;AACvE,SAAO,gBAAgB,KAAK;AAC9B;;;ADpHA,IAAM,oBAAoB,MAAM,OAAO;AACvC,IAAM,qBAAqB;AAC3B,IAAM,gBAAgB;AACf,IAAM,kCAAkC;AAuF/C,SAAS,MAAM,OAA+B;AAAE,SAAO,IAAI,WAAW,KAAK;AAAG;AAE9E,SAAS,IAAI,OAA2B;AACtC,MAAI,OAAO,SAAS,YAAY;AAC9B,QAAI,SAAS;AACb,eAAW,QAAQ,MAAO,WAAU,OAAO,aAAa,IAAI;AAC5D,WAAO,KAAK,MAAM,EAAE,QAAQ,OAAO,GAAG,EAAE,QAAQ,OAAO,GAAG,EAAE,QAAQ,QAAQ,EAAE;AAAA,EAChF;AACA,MAAI,OAAO,WAAW,YAAa,QAAO,OAAO,KAAK,KAAK,EAAE,SAAS,WAAW;AACjF,QAAM,IAAI,MAAM,mCAAmC;AACrD;AAEA,SAAS,QAAQ,OAA2B;AAC1C,MAAI,CAAC,mBAAmB,KAAK,KAAK,EAAG,OAAM,IAAI,MAAM,8CAA8C;AACnG,MAAI,OAAO,SAAS,YAAY;AAC9B,UAAM,SAAS,MAAM,QAAQ,MAAM,GAAG,EAAE,QAAQ,MAAM,GAAG,IAAI,IAAI,QAAQ,IAAI,MAAM,SAAS,KAAK,CAAC;AAClG,WAAO,WAAW,KAAK,KAAK,MAAM,GAAG,CAAC,cAAc,UAAU,WAAW,CAAC,CAAC;AAAA,EAC7E;AACA,MAAI,OAAO,WAAW,YAAa,QAAO,IAAI,WAAW,OAAO,KAAK,OAAO,WAAW,CAAC;AACxF,QAAM,IAAI,MAAM,mCAAmC;AACrD;AAEA,SAAS,IAAI,YAAgC;AAC3C,SAAO,IAAI,SAAa,MAAM,OAAa,OAAU,UAAM,uBAAO,UAAU,CAAC,CAAC,EAAE,SAAS,OAAO,OAAO;AACzG;AAEA,SAASC,QAAO,YAAgC;AAAE,SAAO,QAAI,uBAAO,UAAU,CAAC;AAAG;AAElF,SAAS,2BAA2B,WAA+B;AACjE,MAAI,UAAU,WAAW,GAAI,OAAM,IAAI,MAAM,uCAAuC;AACpF,QAAM,WAAW,IAAI,WAAW,EAAE;AAClC,WAAS,IAAI,CAAC,KAAM,CAAI,CAAC;AACzB,WAAS,IAAI,WAAW,CAAC;AACzB,SAAO,WAAW,UAAU,OAAO,QAAQ,CAAC;AAC9C;AAMA,SAAS,cAAc,OAA4B;AACjD,QAAM,SAAmB,CAAC;AAC1B,QAAM,cAAc,CAAC,OAAeC,YAAyB;AAC3D,QAAI,CAAC,OAAO,cAAcA,OAAM,KAAKA,UAAS,EAAG,OAAM,IAAI,MAAM,6BAA6B;AAC9F,QAAIA,UAAS,GAAI,QAAO,KAAM,SAAS,IAAKA,OAAM;AAAA,aACzCA,UAAS,IAAO,QAAO,KAAM,SAAS,IAAK,IAAIA,OAAM;AAAA,aACrDA,UAAS,MAAS,QAAO,KAAM,SAAS,IAAK,IAAIA,WAAU,GAAGA,UAAS,GAAI;AAAA,QAC/E,OAAM,IAAI,MAAM,6BAA6B;AAAA,EACpD;AACA,QAAM,QAAQ,CAAC,SAAwB;AACrC,QAAI,SAAS,MAAM;AAAE,aAAO,KAAK,GAAI;AAAG;AAAA,IAAQ;AAChD,QAAI,SAAS,OAAO;AAAE,aAAO,KAAK,GAAI;AAAG;AAAA,IAAQ;AACjD,QAAI,SAAS,MAAM;AAAE,aAAO,KAAK,GAAI;AAAG;AAAA,IAAQ;AAChD,QAAI,OAAO,SAAS,UAAU;AAC5B,YAAM,UAAU,IAAI,YAAY,EAAE,OAAO,IAAI;AAC7C,kBAAY,GAAG,QAAQ,MAAM;AAAG,aAAO,KAAK,GAAG,OAAO;AAAG;AAAA,IAC3D;AACA,QAAI,OAAO,SAAS,YAAY,OAAO,cAAc,IAAI,GAAG;AAC1D,UAAI,QAAQ,EAAG,aAAY,GAAG,IAAI;AAAA,UAC7B,aAAY,GAAG,KAAK,IAAI;AAC7B;AAAA,IACF;AACA,QAAI,MAAM,QAAQ,IAAI,GAAG;AACvB,kBAAY,GAAG,KAAK,MAAM;AAAG,WAAK,QAAQ,KAAK;AAAG;AAAA,IACpD;AACA,QAAI,OAAO,SAAS,YAAY,SAAS,MAAM;AAC7C,YAAM,UAAU,OAAO,QAAQ,IAA+B,EAAE,IAAI,CAAC,CAAC,KAAKC,MAAK,MAAM;AACpF,cAAM,WAAW,cAAc,GAAG;AAClC,eAAO,EAAE,KAAK,OAAAA,QAAO,SAAS;AAAA,MAChC,CAAC,EAAE,KAAK,CAAC,MAAM,UAAU;AACvB,YAAI,KAAK,SAAS,WAAW,MAAM,SAAS,OAAQ,QAAO,KAAK,SAAS,SAAS,MAAM,SAAS;AACjG,iBAAS,QAAQ,GAAG,QAAQ,KAAK,SAAS,QAAQ,SAAS,GAAG;AAC5D,cAAI,KAAK,SAAS,KAAK,MAAM,MAAM,SAAS,KAAK,EAAG,QAAO,KAAK,SAAS,KAAK,IAAI,MAAM,SAAS,KAAK;AAAA,QACxG;AACA,eAAO;AAAA,MACT,CAAC;AACD,kBAAY,GAAG,QAAQ,MAAM;AAC7B,cAAQ,QAAQ,CAAC,EAAE,KAAK,OAAAA,OAAM,MAAM;AAAE,cAAM,GAAG;AAAG,cAAMA,MAAK;AAAA,MAAG,CAAC;AACjE;AAAA,IACF;AACA,UAAM,IAAI,MAAM,4BAA4B;AAAA,EAC9C;AACA,QAAM,KAAK;AACX,SAAO,WAAW,KAAK,MAAM;AAC/B;AAEA,SAAS,aAAa,OAAgB,MAAyB,OAAwC;AACrG,MAAI,OAAO,UAAU,YAAY,UAAU,QAAQ,MAAM,QAAQ,KAAK,EAAG,OAAM,IAAI,MAAM,GAAG,KAAK,aAAa;AAC9G,QAAM,SAAS;AACf,MAAI,OAAO,KAAK,MAAM,EAAE,WAAW,KAAK,UAAU,KAAK,KAAK,CAAC,QAAQ,CAAC,OAAO,UAAU,eAAe,KAAK,QAAQ,GAAG,CAAC,EAAG,OAAM,IAAI,MAAM,GAAG,KAAK,gCAAgC;AAClL,SAAO;AACT;AAEA,eAAsB,wBAAwB,SAAwE;AACpH,MAAI,CAAC,WAAW,QAAQ,OAAQ,OAAM,IAAI,MAAM,wDAAwD;AACxG,QAAM,YAAY,MAAM,OAAO,OAAO,YAAY,EAAE,MAAM,UAAU,GAAG,QAAQ,aAAa,CAAC,QAAQ,QAAQ,CAAC;AAC9G,QAAM,aAAa,UAAU;AAC7B,QAAM,YAAY,IAAI,WAAW,MAAM,OAAO,OAAO,UAAU,OAAO,UAAU,SAAS,CAAC;AAC1F,MAAI,UAAU;AACd,QAAM,MAAyB;AAAA,IAC7B,KAAK,2BAA2B,SAAS;AAAA,IACzC,WAAW,MAAM,SAAS;AAAA,IAC1B,aAAa,QAAQ;AAAA,IACrB,WAAW;AAAA,IACX,GAAI,QAAQ,cAAc,EAAE,YAAY,MAAM,OAAO,OAAO,UAAU,OAAO,UAAU,EAA4B,IAAI,CAAC;AAAA,IACxH,MAAM,KAAK,OAAO;AAChB,UAAI,QAAS,OAAM,IAAI,MAAM,4BAA4B;AACzD,aAAO,IAAI,WAAW,MAAM,OAAO,OAAO,KAAK,EAAE,MAAM,UAAU,GAAG,YAAY,KAAK,CAAC;AAAA,IACxF;AAAA,IACA,QAAQ;AAAE,gBAAU;AAAA,IAAM;AAAA,EAC5B;AACA,SAAO;AACT;AASO,SAAS,yBAAyB,OAA6H;AACpK,MAAI,UAAU;AACd,SAAO;AAAA,IACL,KAAK,2BAA2B,MAAM,SAAS;AAAA,IAC/C,WAAW,MAAM,MAAM,SAAS;AAAA,IAChC,aAAa,MAAM;AAAA,IACnB,WAAW,MAAM;AAAA,IACjB,MAAM,KAAK,WAAW;AACpB,UAAI,QAAS,OAAM,IAAI,MAAM,4BAA4B;AACzD,UAAI,CAAC,WAAW,QAAQ,OAAQ,OAAM,IAAI,MAAM,wDAAwD;AACxG,aAAO,IAAI,WAAW,MAAM,OAAO,OAAO,KAAK,EAAE,MAAM,UAAU,GAAG,MAAM,YAAY,SAAS,CAAC;AAAA,IAClG;AAAA,IACA,QAAQ;AAAE,gBAAU;AAAA,IAAM;AAAA,EAC5B;AACF;AAEA,eAAsB,kCAAkC,OAa1B;AAC5B,MAAI,MAAM,SAAS,IAAI,WAAW,KAAK,MAAM,gBAAgB,cAAc,WAAW,EAAG,OAAM,IAAI,MAAM,6CAA6C;AACtJ,QAAM,QAAQ;AAAA,IACZ,oBAAoB,MAAM,gBAAgB;AAAA,IAC1C,WAAW,MAAM;AAAA,IACjB,SAAS,MAAM;AAAA,IACf,aAAa,MAAM,SAAS;AAAA,IAC5B,aAAa,MAAM;AAAA,IACnB,cAAc,MAAM;AAAA,IACpB,SAAS,MAAM;AAAA,IACf,MAAM,MAAM;AAAA,IACZ,SAAS,CAAC,GAAG,MAAM,OAAO;AAAA,IAC1B,GAAI,MAAM,eAAe,SAAY,CAAC,IAAI;AAAA,MACxC,qBAAqB,MAAM,WAAW;AAAA,MACtC,kBAAkB,MAAM,WAAW;AAAA,IACrC;AAAA,IACA,qBAAqB,MAAM;AAAA,IAC3B,WAAW,MAAM;AAAA,EACnB;AACA,QAAM,WAAW,EAAE,MAAM,mCAAmC,SAAS,GAAG,WAAW,MAAM,SAAS,KAAK,aAAa,MAAM,aAAa,MAAM;AAC7I,QAAM,eAAe,cAAc,EAAE,QAAQ,oBAAoB,SAAS,CAAC;AAC3E,QAAM,YAAY,IAAI,MAAM,MAAM,SAAS,KAAK,YAAY,CAAC;AAC7D,SAAO,EAAE,KAAK,IAAI,YAAY,GAAG,SAAS,IAAI,YAAY,GAAG,WAAW,MAAM,SAAS,KAAK,aAAa,MAAM,aAAa,OAAO,UAAU;AAC/I;AAEA,eAAsB,0BAA0B,QAAoH;AAClK,QAAM,OAAO,iCAAa,EAAE,QAAQ,eAAe,OAAO,CAAC;AAC3D,QAAM,cAAc,IAAI,YAAY,EAAE,OAAO,IAAI;AACjD,SAAO,EAAE,OAAO,aAAa,KAAK,IAAI,WAAW,GAAG,QAAQC,QAAO,WAAW,EAAE;AAClF;AAEO,SAAS,iCAAiC,cAA6E;AAC5H,SAAO,IAAI,IAAI,YAAY,EAAE,OAAO,iCAAa,YAAY,CAAC,CAAC;AACjE;AAEO,SAAS,qCAAqC,OAAgB,UAA+E;AAClJ,MAAI,IAAI,SAAS,OAAO,KAAK,MAAM,SAAS,OAAO,IAAK,OAAM,IAAI,MAAM,yDAAyD;AACjI,QAAM,OAAO,aAAa,OAAO,CAAC,gBAAgB,OAAO,GAAG,mCAAmC;AAC/F,QAAM,kBAAkB,KAAK;AAC7B,QAAM,gBAAgB,OAAO,oBAAoB,YAAY,oBAAoB,QAAQ,OAAO,UAAU,eAAe,KAAK,iBAAiB,YAAY;AAC3J,QAAM,eAAe,aAAa,KAAK,cAAc,CAAC,mBAAmB,aAAa,sBAAsB,4BAA4B,YAAY,eAAe,eAAe,WAAW,oBAAoB,UAAU,YAAY,WAAW,GAAI,gBAAgB,CAAC,YAAY,IAAI,CAAC,GAAI,iBAAiB,uBAAuB,gBAAgB,WAAW,GAAG,0BAA0B;AAC5X,QAAM,QAAQ,aAAa,KAAK,OAAO,CAAC,OAAO,OAAO,WAAW,GAAG,gCAAgC;AACpG,MAAI,aAAa,cAAc,SAAS,OAAO,OAAO,aAAa,uBAAuB,SAAS,gBAAgB,iBAAiB,aAAa,6BAA6B,SAAS,sBAAsB,OAAO,aAAa,wBAAwB,SAAS,oBAAqB,OAAM,IAAI,MAAM,8DAA8D;AACrW,MAAI;AACJ,MAAI;AAAE,kBAAc,KAAK,MAAM,IAAI,YAAY,SAAS,EAAE,OAAO,KAAK,CAAC,EAAE,OAAO,SAAS,OAAO,KAAK,CAAC;AAAA,EAA8B,QAAQ;AAAE,UAAM,IAAI,MAAM,sCAAsC;AAAA,EAAG;AACvM,QAAM,SAAS,YAAY;AAC3B,MAAI,YAAY,WAAW,qCAAqC,WAAW,UAAa,MAAM,QAAQ,MAAM,EAAG,OAAM,IAAI,MAAM,wCAAwC;AACvK,QAAM,SAAS,OAAO;AACtB,QAAM,WAAW,OAAO;AACxB,QAAM,qBAAqB,aAAa;AACxC,QAAM,uBAAuB,aAAa;AAC1C,QAAM,mBAAmB,SAAS,sBAAsB;AACxD,QAAM,aAAa,OAAO;AAC1B,QAAM,oBAAoB,eAAe,SACrC,aAAa,eAAe,SAC5B,aAAa,eAAe,UAAa,iCAAa,UAAU,MAAM,iCAAa,aAAa,UAAU;AAC9G,MAAI,OAAO,QAAQ,WAAW,YAAY,OAAO,OAAO,iBAAiB,YAAY,OAAO,OAAO,gBAAgB,YAAY,OAAO,OAAO,YAAY,YAAY,OAAO,UAAU,SAAS,YAAY,CAAC,CAAC,SAAS,QAAQ,EAAE,SAAS,SAAS,IAAI,KAAK,OAAO,UAAU,SAAS,YAAY,CAAC,MAAM,QAAQ,OAAO,OAAO,KAAK,OAAO,aAAa,aAAa,YAAY,OAAO,gBAAgB,aAAa,eAAe,OAAO,YAAY,aAAa,WAAW,iCAAa,OAAO,gBAAgB,MAAM,iCAAa,aAAa,gBAAgB,KAAK,OAAO,WAAW,mBAAmB,UAAU,OAAO,iBAAiB,mBAAmB,gBAAgB,OAAO,gBAAgB,aAAa,eAAe,OAAO,YAAY,mBAAmB,WAAW,SAAS,SAAS,qBAAqB,QAAQ,SAAS,SAAS,qBAAqB,QAAQ,iCAAa,OAAO,OAAO,MAAM,iCAAa,aAAa,OAAO,KAAK,CAAC,qBAAqB,iCAAa,OAAO,aAAa,MAAM,iCAAa,aAAa,aAAa,KAAK,OAAO,cAAc,aAAa,aAAa,OAAO,wBAAwB,aAAa,uBAAuB,iBAAiB,uBAAuB,aAAa,sBAAsB,iBAAiB,cAAc,aAAa,aAAa,iBAAiB,gBAAgB,aAAa,eAAe,iBAAiB,gBAAgB,aAAa,eAAe,iBAAiB,iBAAiB,mBAAmB,gBAAgB,iBAAiB,YAAY,mBAAmB,WAAW,iBAAiB,SAAS,qBAAqB,QAAQ,iCAAa,iBAAiB,OAAO,MAAM,iCAAa,aAAa,OAAO,KAAK,iBAAiB,wBAAwB,YAAY,aAAa,iBAAiB,qBAAqB,YAAY,UAAU,iBAAiB,cAAc,aAAa,UAAW,OAAM,IAAI,MAAM,+DAA+D;AAC/3D,MAAI,OAAO,aAAa,oBAAoB,YAAY,OAAO,aAAa,cAAc,YAAY,OAAO,aAAa,iBAAiB,SAAU,OAAM,IAAI,MAAM,iDAAiD;AACtN,MAAI,IAAI,KAAK,aAAa,SAAS,EAAE,YAAY,MAAM,aAAa,aAAa,KAAK,MAAM,aAAa,SAAS,KAAK,KAAK,IAAI,EAAG,OAAM,IAAI,MAAM,sDAAsD;AACzM,QAAM,EAAE,iBAAiB,kBAAkB,GAAG,iBAAiB,IAAI;AACnE,MAAI,iCAAiC,gBAAoF,MAAM,aAAa,gBAAiB,OAAM,IAAI,MAAM,gEAAgE;AAC7O,MAAI,MAAM,QAAQ,WAAW,OAAO,MAAM,QAAQ,YAAY,OAAO,MAAM,cAAc,SAAU,OAAM,IAAI,MAAM,2CAA2C;AAC9J,QAAM,WAAW,SAAS;AAC1B,MAAI,aAAa,OAAW,OAAM,IAAI,MAAM,2DAA2D;AACvG,MAAI,MAAM,QAAQ,SAAS,IAAK,OAAM,IAAI,MAAM,mDAAmD;AACnG,QAAM,aAAa,SAAS;AAC5B,MAAI,WAAW,WAAW,MAAM,WAAW,CAAC,MAAM,OAAQ,WAAW,CAAC,MAAM,GAAM;AAAA,EAElF,WAAW,WAAW,WAAW,GAAI,OAAM,IAAI,MAAM,+CAA+C;AACpG,QAAM,YAAY,WAAW,WAAW,KAAK,WAAW,MAAM,CAAC,IAAI;AACnE,QAAM,iBAAiB,QAAQ,MAAM,SAAS;AAC9C,QAAM,cAAc,IAAI,YAAY,EAAE,OAAO,GAAG,+BAA+B,GAAG,iCAAa,gBAAgB,CAAC,EAAE;AAClH,MAAI,eAAe,WAAW,MAAM,CAAC,wBAAQ,OAAO,gBAAgB,aAAa,SAAS,EAAG,OAAM,IAAI,MAAM,qDAAqD;AAClK,SAAO,EAAE,cAAuE,MAAwE;AAC1J;AAGO,SAAS,0CAA0C,YAAwB,UAA+E;AAC/J,MAAI;AACJ,MAAI;AACF,YAAQ,KAAK,MAAM,IAAI,YAAY,SAAS,EAAE,OAAO,KAAK,CAAC,EAAE,OAAO,UAAU,CAAC;AAAA,EACjF,QAAQ;AACN,UAAM,IAAI,MAAM,2DAA2D;AAAA,EAC7E;AACA,SAAO,qCAAqC,OAAO,QAAQ;AAC7D;;;AIzXA,IAAAC,kBAAwB;AAKjB,IAAM,sCAAsC;AAqFnD,SAAS,uBAAuB,OAAwB;AACtD,MAAI;AACJ,MAAI;AACF,UAAM,IAAI,IAAI,KAAK;AAAA,EACrB,QAAQ;AACN,WAAO;AAAA,EACT;AACA,SAAO,IAAI,aAAa,YACnB,IAAI,WAAW,SACf,IAAI,aAAa,OACjB,IAAI,WAAW,MACf,IAAI,SAAS,MACb,IAAI,aAAa,MACjB,IAAI,aAAa;AACxB;AAEA,IAAM,qBAAqB;AAAA,EACzB;AAAA,EAAQ;AAAA,EAAW;AAAA,EAAO;AAAA,EAAY;AAAA,EAAW;AAAA,EAAmB;AAAA,EACpE;AAAA,EAA4B;AAAA,EAAe;AAAA,EAAa;AAAA,EAAgB;AAAA,EACxE;AAAA,EACA;AAAA,EAAU;AAAA,EAAoB;AAAA,EAAiB;AAAA,EAAY;AAAA,EAAgB;AAAA,EAC3E;AAAA,EAAa;AAAA,EAAe;AAAA,EAAiB;AAAA,EAAuB;AAAA,EACpE;AAAA,EAAY;AAAA,EAAoB;AAAA,EAAW;AAAA,EAAY;AAAA,EACvD;AAAA,EAA2B;AAAA,EAAqB;AAAA,EAAkB;AAAA,EAAa;AACjF;AAEA,SAASC,cAAa,OAAgB,MAAyB,OAAwC;AACrG,MAAI,OAAO,UAAU,YAAY,UAAU,QAAQ,MAAM,QAAQ,KAAK,EAAG,OAAM,IAAI,MAAM,GAAG,KAAK,aAAa;AAC9G,QAAM,SAAS;AACf,MAAI,OAAO,KAAK,MAAM,EAAE,WAAW,KAAK,UAAU,KAAK,KAAK,CAAC,QAAQ,CAAC,OAAO,UAAU,eAAe,KAAK,QAAQ,GAAG,CAAC,EAAG,OAAM,IAAI,MAAM,GAAG,KAAK,gCAAgC;AAClL,SAAO;AACT;AAEA,SAASC,SAAQ,OAA2B;AAC1C,MAAI,CAAC,mBAAmB,KAAK,KAAK,EAAG,OAAM,IAAI,MAAM,iDAAiD;AACtG,MAAI,OAAO,SAAS,YAAY;AAC9B,UAAM,SAAS,MAAM,QAAQ,MAAM,GAAG,EAAE,QAAQ,MAAM,GAAG,IAAI,IAAI,QAAQ,IAAI,MAAM,SAAS,KAAK,CAAC;AAClG,WAAO,WAAW,KAAK,KAAK,MAAM,GAAG,CAAC,cAAc,UAAU,WAAW,CAAC,CAAC;AAAA,EAC7E;AACA,MAAI,OAAO,WAAW,YAAa,QAAO,IAAI,WAAW,OAAO,KAAK,OAAO,WAAW,CAAC;AACxF,QAAM,IAAI,MAAM,mCAAmC;AACrD;AAOO,SAAS,wCAAwC,YAAwB,UAAyF;AACvK,MAAI;AACJ,MAAI;AACF,YAAQ,KAAK,MAAM,IAAI,YAAY,SAAS,EAAE,OAAO,KAAK,CAAC,EAAE,OAAO,UAAU,CAAC;AAAA,EACjF,QAAQ;AACN,UAAM,IAAI,MAAM,+DAA+D;AAAA,EACjF;AACA,QAAM,OAAOD,cAAa,OAAO,CAAC,iBAAiB,OAAO,GAAG,uCAAuC;AACpG,QAAM,gBAAgBA,cAAa,KAAK,eAAe,oBAAoB,8BAA8B;AACzG,QAAM,QAAQA,cAAa,KAAK,OAAO,CAAC,OAAO,OAAO,WAAW,GAAG,oCAAoC;AAExG,QAAM,UAAU,SAAS;AACzB,MACE,cAAc,SAAS,yCACpB,cAAc,YAAY,KAC1B,cAAc,kBAAkB,SAChC,cAAc,QAAQ,QAAQ,OAC9B,cAAc,aAAa,QAAQ,YACnC,cAAc,YAAY,QAAQ,WAClC,cAAc,oBAAoB,QAAQ,mBAC1C,cAAc,kBAAkB,QAAQ,iBACxC,cAAc,6BAA6B,QAAQ,4BACnD,cAAc,gBAAgB,QAAQ,eACtC,cAAc,cAAc,QAAQ,aACpC,cAAc,kBAAkB,QAAQ,kBACxC,cAAc,aAAa,QAAQ,YACnC,cAAc,iBAAiB,QAAQ,gBACvC,cAAc,sBAAsB,QAAQ,qBAC5C,cAAc,cAAc,QAAQ,aACpC,cAAc,mBAAmB,QAAQ,kBACzC,cAAc,qBAAqB,QAAQ,OAC3C,cAAc,4BAA4B,QAAQ,iBACrD;AACA,UAAM,IAAI,MAAM,oEAAoE;AAAA,EACtF;AACA,MAAI,OAAO,cAAc,aAAa,YAAY,KAAK,MAAM,cAAc,QAAQ,IAAI,KAAK,IAAI,IAAI,IAAQ,OAAM,IAAI,MAAM,kDAAkD;AAC9K,MAAI,IAAI,KAAK,cAAc,SAAmB,EAAE,YAAY,MAAM,cAAc,UAAW,OAAM,IAAI,MAAM,yDAAyD;AAMpK,MACE,OAAO,cAAc,4BAA4B,YAC9C,CAAC,uBAAuB,cAAc,uBAAuB,KAC7D,cAAc,4BAA4B,SAAS,uBACnD,cAAc,4BAA4B,cAAc,gBACxD,cAAc,4BAA4B,cAAc,cAC3D;AACA,UAAM,IAAI,MAAM,8EAA8E;AAAA,EAChG;AAEA,MAAI,MAAM,QAAQ,WAAW,OAAO,MAAM,QAAQ,YAAY,OAAO,MAAM,cAAc,SAAU,OAAM,IAAI,MAAM,+CAA+C;AAClK,MAAI,MAAM,QAAQ,SAAS,UAAU,IAAK,OAAM,IAAI,MAAM,uDAAuD;AACjH,QAAM,aAAa,SAAS,UAAU;AACtC,QAAM,YAAY,WAAW,WAAW,MAAM,WAAW,CAAC,MAAM,OAAQ,WAAW,CAAC,MAAM,IAAO,WAAW,MAAM,CAAC,IAAI;AACvH,MAAI,UAAU,WAAW,GAAI,OAAM,IAAI,MAAM,mDAAmD;AAChG,QAAM,iBAAiBC,SAAQ,MAAM,SAAS;AAC9C,QAAM,cAAc,IAAI,YAAY,EAAE,OAAO,GAAG,mCAAmC,GAAG,iCAAa,aAAa,CAAC,EAAE;AACnH,MAAI,eAAe,WAAW,MAAM,CAAC,wBAAQ,OAAO,gBAAgB,aAAa,SAAS,EAAG,OAAM,IAAI,MAAM,yDAAyD;AAEtK,SAAO,EAAE,eAAuE,MAAsE;AACxJ;AAGO,SAAS,wBAAwB,WAA+B;AACrE,MAAI,UAAU,WAAW,GAAI,OAAM,IAAI,MAAM,kEAAkE;AAC/G,QAAM,WAAW,IAAI,WAAW,EAAE;AAClC,WAAS,IAAI,CAAC,KAAM,CAAI,CAAC;AACzB,WAAS,IAAI,WAAW,CAAC;AACzB,QAAM,MAAM,WAAW,UAAU,OAAO,QAAQ,CAAC;AACjD,SAAO,GAAG,GAAG,IAAI,IAAI,MAAM,WAAW,MAAM,CAAC;AAC/C;;;ACxJO,IAAM,iCAAN,MAAyE;AAAA,EAAzE;AACL,SAAiB,UAAU,oBAAI,IAA+B;AAAA;AAAA,EAE9D,MAAM,IAAI,QAA0C;AAClD,SAAK,QAAQ,IAAI,OAAO,SAAS,MAAM;AAAA,EACzC;AAAA,EAEA,MAAM,OAA8C;AAClD,WAAO,CAAC,GAAG,KAAK,QAAQ,OAAO,CAAC;AAAA,EAClC;AAAA,EAEA,MAAM,IAAI,SAAyD;AACjE,WAAO,KAAK,QAAQ,IAAI,OAAO;AAAA,EACjC;AAAA,EAEA,MAAM,OAAO,SAAgC;AAC3C,SAAK,QAAQ,OAAO,OAAO;AAAA,EAC7B;AACF;AAEO,IAAM,8BAAN,MAAmE;AAAA,EAAnE;AACL,SAAiB,OAAO,oBAAI,IAAkC;AAAA;AAAA,EAE9D,MAAM,IAAI,SAAiB,KAA0C;AACnE,SAAK,KAAK,IAAI,SAAS,GAAG;AAAA,EAC5B;AAAA,EAEA,MAAM,IAAI,SAA4D;AACpE,WAAO,KAAK,KAAK,IAAI,OAAO;AAAA,EAC9B;AAAA,EAEA,MAAM,OAAO,SAAgC;AAC3C,SAAK,KAAK,OAAO,OAAO;AAAA,EAC1B;AACF;AAgBO,IAAM,mBAAN,MAAuB;AAAA,EAK5B,YAAY,SAAkC;AAC5C,SAAK,UAAU,QAAQ;AACvB,SAAK,OAAO,QAAQ;AACpB,SAAK,MAAM,QAAQ,QAAQ,MAAM,oBAAI,KAAK;AAAA,EAC5C;AAAA;AAAA,EAGA,MAAM,KAAK,SAA8C,KAAoD;AAC3G,UAAM,eAAe,QAAQ;AAC7B,QAAI,aAAa,gBAAgB,IAAI,IAAK,OAAM,IAAI,MAAM,iDAAiD;AAC3G,UAAM,SAA4B;AAAA,MAChC,SAAS,aAAa;AAAA,MACtB,iBAAiB,aAAa;AAAA,MAC9B,WAAW,aAAa;AAAA,MACxB,oBAAoB,aAAa;AAAA,MACjC,0BAA0B,aAAa;AAAA,MACvC,aAAa,aAAa;AAAA,MAC1B,UAAU,aAAa;AAAA,MACvB,aAAa,aAAa;AAAA,MAC1B,QAAQ,aAAa;AAAA,MACrB,UAAU,aAAa;AAAA,MACvB,SAAS,aAAa;AAAA,MACtB,kBAAkB,aAAa;AAAA,MAC/B,cAAc,aAAa;AAAA,MAC3B,WAAW,aAAa;AAAA,IAC1B;AACA,UAAM,KAAK,QAAQ,IAAI,MAAM;AAC7B,UAAM,KAAK,KAAK,IAAI,OAAO,SAAS,EAAE,WAAW,IAAI,WAAW,WAAW,IAAI,WAAW,aAAa,IAAI,YAAY,CAAC;AACxH,WAAO;AAAA,EACT;AAAA;AAAA,EAGA,MAAM,KAAK,SAA2H;AACpI,UAAM,MAAM,KAAK,IAAI,EAAE,QAAQ;AAC/B,UAAM,UAAU,MAAM,KAAK,QAAQ,KAAK;AACxC,WAAO,QACJ,OAAO,CAAC,YAAY,SAAS,kBAAkB,UAAU,OAAO,cAAc,MAAS,EACvF,OAAO,CAAC,YAAY,SAAS,kBAAkB,UAAU,KAAK,MAAM,OAAO,SAAS,IAAI,GAAG,EAC3F,KAAK,CAAC,MAAM,UAAU,KAAK,MAAM,MAAM,YAAY,IAAI,KAAK,MAAM,KAAK,YAAY,CAAC;AAAA,EACzF;AAAA,EAEA,MAAM,IAAI,SAAyD;AACjE,WAAO,KAAK,QAAQ,IAAI,OAAO;AAAA,EACjC;AAAA;AAAA,EAGA,MAAM,QAAQ,SAAyD;AACrE,UAAM,SAAS,MAAM,KAAK,KAAK,IAAI,OAAO;AAC1C,QAAI,WAAW,OAAW,QAAO;AACjC,WAAO,yBAAyB;AAAA,MAC9B,YAAY,OAAO;AAAA,MACnB,WAAW,OAAO;AAAA,MAClB,aAAa,OAAO;AAAA,IACtB,CAAC;AAAA,EACH;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EASA,MAAM,iBAAiB,SAAiB,OAAoD;AAC1F,UAAM,SAAS,MAAM,KAAK,QAAQ,IAAI,OAAO;AAC7C,QAAI,WAAW,OAAW,OAAM,IAAI,MAAM,kBAAkB,OAAO,EAAE;AACrE,WAAO,UAAU,WAAW,OAAO,2BAA2B,OAAO;AAAA,EACvE;AAAA;AAAA,EAGA,MAAM,YAAY,SAAiB,YAAoB,KAAK,IAAI,EAAE,YAAY,GAA+B;AAC3G,UAAM,SAAS,MAAM,KAAK,QAAQ,IAAI,OAAO;AAC7C,QAAI,WAAW,OAAW,OAAM,IAAI,MAAM,kBAAkB,OAAO,EAAE;AACrE,UAAM,UAA6B,EAAE,GAAG,QAAQ,UAAU;AAC1D,UAAM,KAAK,QAAQ,IAAI,OAAO;AAC9B,WAAO;AAAA,EACT;AAAA;AAAA,EAGA,MAAM,OAAO,SAAgC;AAC3C,UAAM,KAAK,QAAQ,OAAO,OAAO;AACjC,UAAM,KAAK,KAAK,OAAO,OAAO;AAAA,EAChC;AACF;;;A1CTA,uBAgBO;AAqEP,IAAAC,oBAMO;","names":["code","cid","import_zod","name","encode","length","i","j","decode","name","bytes","encode","decode","alphabet","encode","decode","identity_exports","identity","encode","decode","decode","code","code","digest","bytes","decode","equals","code","encode","identity","from","name","code","encode","digest","name","from","base","bytes","cid","baseCache","code","bytes","digest","equals","base","decode","length","cache","identity_exports","import_ed25519","import_sdk_services","import_ed25519","import_sha256","code","bytes","digest","cid","matcher","actions","resource","source","resourceValue","key","import_sha256","digest","bytes","cid","code","import_zod","DEFAULT_MAX_ARTIFACT_BYTES","code","base64UrlToBytes","bytes","bytesToBase64Url","base","value","name","digest","cid","location","createError","code","name","base64","import_ed25519","import_sha256","import_ed25519","import_viem","code","output","length","code","textEncoder","objectHasOwn","digest","length","value","digest","import_ed25519","assertObject","fromB64","import_share_sdk"]}
+{"version":3,"sources":["../../src/delegations/index.ts","../../src/delegations/types.schema.ts","../../src/expiry.ts","../../src/delegations/DelegationManager.ts","../../src/delegations/SharingService.schema.ts","../../src/manifest.ts","../../src/identity.ts","../../src/capabilities.ts","../../../../node_modules/multiformats/src/bases/base10.ts","../../../../node_modules/multiformats/src/bytes.ts","../../../../node_modules/multiformats/src/vendor/base-x.js","../../../../node_modules/multiformats/src/bases/base.ts","../../../../node_modules/multiformats/src/bases/base16.ts","../../../../node_modules/multiformats/src/bases/base2.ts","../../../../node_modules/multiformats/src/bases/base256emoji.ts","../../../../node_modules/multiformats/src/bases/base32.ts","../../../../node_modules/multiformats/src/bases/base36.ts","../../../../node_modules/multiformats/src/bases/base58.ts","../../../../node_modules/multiformats/src/bases/base64.ts","../../../../node_modules/multiformats/src/bases/base8.ts","../../../../node_modules/multiformats/src/bases/identity.ts","../../../../node_modules/multiformats/src/codecs/json.ts","../../../../node_modules/multiformats/src/codecs/raw.ts","../../../../node_modules/multiformats/src/hashes/identity.ts","../../../../node_modules/multiformats/src/vendor/varint.js","../../../../node_modules/multiformats/src/varint.ts","../../../../node_modules/multiformats/src/hashes/digest.ts","../../../../node_modules/multiformats/src/hashes/sha2-browser.ts","../../../../node_modules/multiformats/src/hashes/hasher.ts","../../../../node_modules/multiformats/src/cid.ts","../../../../node_modules/multiformats/src/basics.ts","../../src/delegations/SharingService.ts","../../src/delegations/ShareRecipientClient.ts","../../src/delegations/share-envelope.ts","../../src/delegations/ShareCache.ts","../../src/delegations/recipient-types.ts","../../src/delegations/recipient-types.schema.ts","../../src/delegations/portable.ts","../../src/policy/unified.ts","../../src/policy/errors.ts","../../src/policy/jcs.ts","../../src/delegations/owner-policy.ts","../../src/policy/signed-object.ts","../../src/delegations/share-delivery.ts","../../src/delegations/sender-share-store.ts"],"sourcesContent":["/**\n * TinyCloud SDK Delegations Module\n *\n * This module provides delegation and sharing link functionality\n * for the TinyCloud SDK. It extracts and improves upon the delegation\n * functionality previously in ITinyCloudStorage.\n *\n * @packageDocumentation\n *\n * @example\n * ```typescript\n * import {\n *   DelegationManager,\n *   SharingService,\n *   Delegation,\n *   CreateDelegationParams,\n * } from \"@tinycloud/sdk-core/delegations\";\n *\n * // Create delegation manager\n * const delegations = new DelegationManager({\n *   hosts: [\"https://node.tinycloud.xyz\"],\n *   session,\n *   invoke,\n * });\n *\n * // Create a delegation\n * const result = await delegations.create({\n *   delegateDID: \"did:pkh:eip155:1:0x...\",\n *   path: \"shared/\",\n *   actions: [\"tinycloud.kv/get\", \"tinycloud.kv/list\"],\n * });\n * ```\n */\n\n// Types\nexport {\n  // Result pattern\n  Result,\n  DelegationError,\n  DelegationErrorCodes,\n  DelegationErrorCode,\n\n  // Delegation types\n  Delegation,\n  DelegationStatus,\n  DelegationRevocationReceipt,\n  AccountDelegationResource,\n  AccountDelegationRecord,\n  AccountDelegationPage,\n  AccountDelegationQueryOptions,\n  CreateDelegationParams,\n  DelegationChain,\n  DelegationApiResponse,\n\n  // Configuration types\n  DelegationManagerConfig,\n  KeyProvider,\n\n  // v2 types for CapabilityKeyRegistry\n  JWK,\n  KeyType,\n  KeyInfo,\n  CapabilityEntry,\n  DelegationRecord,\n  DelegationChainV2,\n  DelegationDirection,\n  DelegationFilters,\n  SpaceOwnership,\n  SpaceInfo,\n  ShareSchema,\n  ShareLink,\n  ShareLinkData,\n  IngestOptions,\n  GenerateShareParams,\n\n  // WASM delegation types\n  CreateDelegationWasmParams,\n  CreateDelegationWasmResult,\n  DelegatedResource,\n} from \"./types\";\n\n// Classes\nexport { DelegationManager } from \"./DelegationManager\";\n\n// v2 SharingService\nexport {\n  SharingService,\n  createSharingService,\n  ISharingService,\n  SharingServiceConfig,\n  EncodedShareData,\n  ReceiveOptions,\n  ShareAccess,\n  DelegateReceivedShareParams,\n  DelegatedShareAccess,\n} from \"./SharingService\";\n\nexport { ShareRecipientClient } from \"./ShareRecipientClient\";\nexport { delegatePortablePolicySession, importPortableDelegation, parsePortableDelegation, serializePortableDelegation } from \"./portable\";\nexport type { PortableDelegation as SharePortableDelegation, PortableDelegationImportReceipt } from \"./portable\";\nexport { MemoryShareCache } from \"./ShareCache\";\nexport type { ShareCache, ShareCacheEntry, ShareCacheKey, ShareCacheMetadata } from \"./ShareCache\";\nexport {\n  createShareArtifact,\n  createShareArtifactAsync,\n  createSharePolicy,\n  computeShareCid,\n  decryptShareBytesAsync,\n  encodeInlineShareUrl,\n  encodeShareArtifact,\n  encodeShareUrl,\n  encryptShareBytes,\n  encryptShareBytesAsync,\n  intersectShareCapabilities,\n  isV2ShareLink,\n  normalizeShareActions,\n  normalizeShareRecipientTarget,\n  normalizeShareResource,\n  parseShareArtifact,\n  parseShareUrl,\n  shareCapabilityAllows,\n  signShareEnvelope,\n  verifyShareCid,\n  verifyShareEnvelope,\n  ShareEnvelopeError,\n  MAX_SHARE_CONTENT_BYTES,\n  MAX_SEALED_SHARE_CONTENT_BYTES,\n  MAX_SHARE_ARTIFACT_BYTES,\n} from \"./share-envelope\";\nexport type {\n  ShareAction,\n  ShareArtifactInput,\n  ShareArtifactResult,\n  ShareArtifactV2,\n  ShareCapabilityLike,\n  ShareContentMetadata,\n  ShareEnvelopeV2,\n  ShareLinkLocation,\n  SharePolicy,\n  ShareRecipientTarget,\n  ShareResource,\n  VerifyShareEnvelopeOptions,\n} from \"./share-envelope\";\n\nexport {\n  createDelegatedShareKey,\n  restoreDelegatedShareKey,\n  createPolicyEnforcementDelegation,\n  canonicalOwnerSharePolicy,\n  computeOwnerShareRegistrationCid,\n  validateOwnerSharePolicyRegistration,\n  validateOwnerSharePolicyRegistrationBytes,\n  MAX_CONTENT_BYTES,\n} from \"./owner-policy\";\nexport type {\n  OwnerDelegationReceipt,\n  OwnerDelegationPermission,\n  CreateOwnerDelegationParams,\n  OwnerShareAction,\n  OwnerShareDecryption,\n  OwnerShareMatcher,\n  OwnerSharePolicyV2,\n  DelegatedShareKey,\n  SignedDelegation,\n  RegisterOwnerSharePolicyParams,\n  OwnerSharePolicyRegistration,\n  OwnerSharePolicyRegistrationReceipt,\n} from \"./owner-policy\";\n\nexport {\n  SHARE_DELIVERY_AUTHORIZATION_DOMAIN,\n  validateShareDeliveryAuthorizationBytes,\n  shareDeliveryTrustedKid,\n} from \"./share-delivery\";\nexport type {\n  ShareDeliveryAuthorizationRequest,\n  ShareDeliveryAuthorization,\n  ShareDeliveryAuthorizationReceipt,\n  ValidateShareDeliveryAuthorizationExpected,\n} from \"./share-delivery\";\n\nexport {\n  MemorySenderShareRecordStorage,\n  MemorySenderShareKeyStorage,\n  SenderShareStore,\n} from \"./sender-share-store\";\n\n/** Lifecycle and authorization operations are delegated to the canonical\n * headless package so sdk-core cannot grow a second Share verifier. */\nexport {\n  authorizeShare,\n  authorizationMethodForTarget,\n  notifyShare,\n  revokeShare,\n  listShares,\n  showShare,\n  publishTargetShare,\n  publishPolicyShare,\n  claimShare,\n  resumeShareAuthorization,\n  isLegacyShareLink,\n  receiveLegacyShare,\n  migrateShare,\n  MemoryEncryptedShareHistoryStorage,\n  EncryptedSenderShareHistory,\n} from \"@tinycloud/share-sdk\";\nexport type {\n  ShareAuthorizationMethod,\n  ShareAuthorizationRequired,\n  ShareAuthorizationDenied,\n  ShareAuthorizationReady,\n  ShareAuthorizationResult,\n  ShareAuthorizationAdapter,\n  ShareNotifyState,\n  ShareNotifyResult,\n  ShareDeliveryAdapter,\n  ShareRevocationResult,\n  ShareRevocationAdapter,\n  ShareHistoryView,\n  ShareTarget,\n  TargetPublishInput,\n  TargetPublishOutcome,\n  TargetPublishAdapter,\n  SharePolicyPublishAdapter,\n  LegacyShareReader,\n  LegacyMigrationResult,\n  EncryptedShareHistoryStorage,\n} from \"@tinycloud/share-sdk\";\nexport type {\n  SenderShareRecord,\n  SenderShareRecordStorage,\n  SenderShareKeyStorage,\n  SenderShareRevocationScope,\n} from \"./sender-share-store\";\nexport type {\n  ShareAccessV2,\n  ShareListResult,\n  ShareReadResult,\n  ShareRecipientClientOptions,\n  ShareNativeInvokeInput,\n  ShareNativeInvokeResult,\n  ShareNativeInvokeSuccessResult,\n  ShareNativeInvokeErrorResult,\n  ShareNativeAction,\n  ShareWireAction,\n  ShareAddressedRecipientMatcher,\n  ShareContentSource,\n  ShareKvContentSource,\n  ShareSqlContentSource,\n  ShareExpiryBounds,\n  ShareAddressedDelegationRequestV2,\n  ShareAddressedDelegationEnvelopeV2,\n  ShareAddressedDelegationResponseV2,\n  SharePolicySessionWireV1,\n  SharePolicySessionV1,\n  ShareReadInvocationV1,\n  ShareNativeInvokeEnvelopeV1,\n  ShareDetachedProof,\n  ShareListEntry,\n  SharePolicyBinding,\n  SharePolicySession,\n  ShareRecipientPolicy,\n  ShareRecipientResult,\n  ShareSaveOptions,\n} from \"./recipient-types\";\nexport type { ShareNativeResponse } from \"./recipient-types.schema\";\nexport { ShareAccessError, ShareConflict } from \"./recipient-types\";\n\n/**\n * Canonical headless Share foundation. The older SharingService and v2\n * artifact exports above remain compatibility adapters; new consumers should\n * use these package-owned codecs and redacted receive operations so browser\n * and Node callers share one verifier and one result taxonomy.\n */\nexport {\n  inspectShare,\n  receiveShare,\n  ShareReceiveError,\n  toShareErrorInfo,\n  verifyBearerEnvelope,\n} from \"@tinycloud/share-sdk\";\nexport type {\n  ShareErrorCode,\n  ShareErrorInfo,\n  ShareFetchOptions,\n  ShareInspection,\n  ShareMetadata,\n  ShareReceiveResult,\n  VerifyBearerEnvelopeOptions,\n} from \"@tinycloud/share-sdk\";\nexport {\n  ShareActionSchema,\n  ShareRecipientClientOptionsSchema,\n  ShareRecipientPolicySchema,\n  ShareRecipientTargetSchema,\n  ShareResourceSchema,\n  ShareNativeResponseSchema,\n  ShareAddressedDelegationRequestV2Schema,\n  ShareAddressedDelegationEnvelopeV2Schema,\n  ShareAddressedDelegationResponseV2Schema,\n} from \"./recipient-types.schema\";\n\n// SharingService Schemas and Validation\nexport {\n  EncodedShareDataSchema,\n  ReceiveOptionsSchema,\n  SharingServiceConfigSchema,\n  validateEncodedShareData,\n  validateReceiveOptions,\n  validateSharingServiceConfig,\n} from \"./SharingService.schema.js\";\n","/**\n * Zod schemas for delegation management types.\n *\n * These schemas provide runtime validation for delegation, capability key management,\n * and sharing link functionality. Types are derived from schemas using z.infer<>.\n *\n * @packageDocumentation\n */\n\nimport { z } from \"zod\";\nimport type {\n  FetchFunction,\n  InvokeAnyFunction,\n  InvokeFunction,\n  ServiceSession,\n} from \"@tinycloud/sdk-services\";\n\n// =============================================================================\n// Result Type (Generic)\n// =============================================================================\n\n/**\n * Creates a Result schema for a given data type and error type.\n * Result types provide explicit error handling instead of throwing.\n */\nexport function createResultSchema<T extends z.ZodTypeAny, E extends z.ZodTypeAny>(\n  dataSchema: T,\n  errorSchema: E\n) {\n  return z.discriminatedUnion(\"ok\", [\n    z.object({ ok: z.literal(true), data: dataSchema }),\n    z.object({ ok: z.literal(false), error: errorSchema }),\n  ]);\n}\n\n/**\n * Result type pattern for delegation operations.\n */\nexport type Result<T, E = DelegationError> =\n  | { ok: true; data: T }\n  | { ok: false; error: E };\n\n// =============================================================================\n// JWK Type (JSON Web Key)\n// =============================================================================\n\n/**\n * JSON Web Key representation for cryptographic keys.\n * Follows the JWK specification (RFC 7517).\n */\nexport const JWKSchema = z.object({\n  /** Key type (e.g., \"EC\", \"RSA\", \"OKP\") */\n  kty: z.string(),\n  /** Curve for EC/OKP keys (e.g., \"P-256\", \"Ed25519\") */\n  crv: z.string().optional(),\n  /** X coordinate for EC keys, public key for OKP */\n  x: z.string().optional(),\n  /** Y coordinate for EC keys */\n  y: z.string().optional(),\n  /** Private key value (d parameter) */\n  d: z.string().optional(),\n  /** Public exponent for RSA keys */\n  e: z.string().optional(),\n  /** Modulus for RSA keys */\n  n: z.string().optional(),\n  /** Key ID */\n  kid: z.string().optional(),\n  /** Algorithm */\n  alg: z.string().optional(),\n  /** Key use (e.g., \"sig\", \"enc\") */\n  use: z.string().optional(),\n  /** Key operations (e.g., [\"sign\", \"verify\"]) */\n  key_ops: z.array(z.string()).optional(),\n});\n\nexport type JWK = z.infer<typeof JWKSchema>;\n\n// =============================================================================\n// Key Management Types\n// =============================================================================\n\n/**\n * Type of key in the capability registry.\n */\nexport const KeyTypeSchema = z.enum([\"main\", \"session\", \"ingested\"]);\nexport type KeyType = z.infer<typeof KeyTypeSchema>;\n\n/**\n * Information about a cryptographic key used for delegations.\n */\nexport const KeyInfoSchema = z.object({\n  /** Unique identifier for this key */\n  id: z.string(),\n  /** DID associated with this key */\n  did: z.string(),\n  /** Type of key determining its authority level */\n  type: KeyTypeSchema,\n  /** Private key in JWK format */\n  jwk: JWKSchema.optional(),\n  /** Priority for key selection (lower = higher priority) */\n  priority: z.number(),\n});\n\nexport type KeyInfo = z.infer<typeof KeyInfoSchema>;\n\n// =============================================================================\n// Error Types\n// =============================================================================\n\n/**\n * Error type for delegation operations.\n */\nexport const DelegationErrorSchema = z.object({\n  /** Error code for programmatic handling */\n  code: z.string(),\n  /** Human-readable error message */\n  message: z.string(),\n  /** The service that produced the error */\n  service: z.literal(\"delegation\"),\n  /** Original error if wrapping another error */\n  cause: z.instanceof(Error).optional(),\n  /** Additional metadata about the error */\n  meta: z.record(z.string(), z.unknown()).optional(),\n});\n\nexport type DelegationError = z.infer<typeof DelegationErrorSchema>;\n\n/**\n * Error codes for delegation operations.\n */\nexport const DelegationErrorCodes = {\n  AUTH_REQUIRED: \"AUTH_REQUIRED\",\n  AUTH_EXPIRED: \"AUTH_EXPIRED\",\n  NOT_INITIALIZED: \"NOT_INITIALIZED\",\n  NOT_FOUND: \"NOT_FOUND\",\n  REVOKED: \"REVOKED\",\n  NETWORK_ERROR: \"NETWORK_ERROR\",\n  TIMEOUT: \"TIMEOUT\",\n  ABORTED: \"ABORTED\",\n  INVALID_INPUT: \"INVALID_INPUT\",\n  PERMISSION_DENIED: \"PERMISSION_DENIED\",\n  CREATION_FAILED: \"CREATION_FAILED\",\n  REVOCATION_FAILED: \"REVOCATION_FAILED\",\n  INVALID_TOKEN: \"INVALID_TOKEN\",\n  KV_SERVICE_UNAVAILABLE: \"KV_SERVICE_UNAVAILABLE\",\n  DATA_FETCH_FAILED: \"DATA_FETCH_FAILED\",\n  VALIDATION_ERROR: \"VALIDATION_ERROR\",\n} as const;\n\nexport type DelegationErrorCode =\n  (typeof DelegationErrorCodes)[keyof typeof DelegationErrorCodes];\n\n// =============================================================================\n// Delegation Types\n// =============================================================================\n\n/**\n * Represents a delegation from one DID to another.\n */\nexport const DelegationSchema = z.object({\n  /** Content identifier (CID) of the delegation */\n  cid: z.string(),\n  /** DID of the delegate (the party receiving the delegation) */\n  delegateDID: z.string(),\n  /** Space ID this delegation applies to */\n  spaceId: z.string(),\n  /** Resource path this delegation grants access to */\n  path: z.string(),\n  /** Actions this delegation authorizes */\n  actions: z.array(z.string()),\n  /** Exact ReCap caveats that constrain every action in this scope. */\n  caveats: z.array(z.record(z.string(), z.unknown())).optional(),\n  /** When this delegation expires (accepts Date or ISO string from JSON) */\n  expiry: z.coerce.date(),\n  /** Whether this delegation has been revoked */\n  isRevoked: z.boolean(),\n  /** DID of the delegator (the party granting the delegation) */\n  delegatorDID: z.string().optional(),\n  /** When this delegation was created (accepts Date or ISO string from JSON) */\n  createdAt: z.coerce.date().optional(),\n  /** Parent delegation CID if this is a sub-delegation */\n  parentCid: z.string().optional(),\n  /** Whether sub-delegation is allowed */\n  allowSubDelegation: z.boolean().optional(),\n  /** Authorization header (UCAN bearer token) */\n  authHeader: z.string().optional(),\n});\n\nexport type Delegation = z.infer<typeof DelegationSchema>;\n\n/** Node-confirmed lifecycle state for one delegation. */\nexport const DelegationStatusSchema = z.object({\n  cid: z.string().min(1),\n  status: z.enum([\"active\", \"revoked\", \"expired\", \"unavailable\", \"not_found\"]),\n  exists: z.boolean(),\n  active: z.boolean(),\n  revoked: z.boolean(),\n  expired: z.boolean(),\n}).strict().superRefine((value, context) => {\n  const valid = value.status === \"active\"\n    ? value.exists && value.active && !value.revoked && !value.expired\n    : value.status === \"revoked\"\n      ? value.exists && !value.active && value.revoked && !value.expired\n      : value.status === \"expired\"\n        ? value.exists && !value.active && !value.revoked && value.expired\n        : value.status === \"unavailable\"\n          ? value.exists && !value.active && !value.revoked && !value.expired\n          : !value.exists && !value.active && !value.revoked && !value.expired;\n  if (!valid) {\n    context.addIssue({\n      code: z.ZodIssueCode.custom,\n      message: \"delegation status flags do not match status\",\n    });\n  }\n});\n\nexport type DelegationStatus = z.infer<typeof DelegationStatusSchema>;\n\nexport const DelegationRevocationReceiptSchema = z.object({\n  revoked: z.literal(true),\n  cid: z.string().min(1),\n}).strict();\n\nexport type DelegationRevocationReceipt = z.infer<typeof DelegationRevocationReceiptSchema>;\n\nexport const AccountDelegationResourceSchema = z.object({\n  resource: z.string().min(1),\n  actions: z.array(z.string()),\n  caveats: z.array(z.record(z.string(), z.unknown())),\n}).strict();\n\nconst AccountDelegationDateSchema = z\n  .string()\n  .datetime({ offset: true })\n  .transform((value) => new Date(value));\n\nexport const AccountDelegationRecordSchema = z.object({\n  cid: z.string().min(1),\n  direction: z.enum([\"granted\", \"received\"]),\n  delegatorDid: z.string().min(1),\n  delegateDid: z.string().min(1),\n  resources: z.array(AccountDelegationResourceSchema),\n  parents: z.array(z.string()),\n  issuedAt: AccountDelegationDateSchema.nullable(),\n  notBefore: AccountDelegationDateSchema.nullable(),\n  expiresAt: AccountDelegationDateSchema.nullable(),\n  status: z.enum([\"active\", \"pending\", \"expired\", \"revoked\", \"ancestor_revoked\"]),\n  revokedAt: AccountDelegationDateSchema.nullable().optional(),\n  revokedBy: z.string().optional(),\n  revokedAncestorCid: z.string().optional(),\n}).strict();\n\nexport const AccountDelegationPageSchema = z.object({\n  schemaVersion: z.literal(2),\n  items: z.array(AccountDelegationRecordSchema),\n  nextCursor: z.string().optional(),\n}).strict();\n\nexport type AccountDelegationResource = z.infer<typeof AccountDelegationResourceSchema>;\nexport type AccountDelegationRecord = z.infer<typeof AccountDelegationRecordSchema>;\nexport type AccountDelegationPage = z.infer<typeof AccountDelegationPageSchema>;\n\nexport const AccountDelegationQueryOptionsSchema = z.object({\n  direction: z.enum([\"granted\", \"received\", \"all\"]).optional(),\n  status: z.enum([\"active\", \"pending\", \"expired\", \"revoked\", \"ancestor_revoked\"]).optional(),\n  space: z.string().trim().min(1).optional(),\n  limit: z.number().int().min(1).max(100).optional(),\n  cursor: z.string().min(1).optional(),\n}).strict();\n\nexport type AccountDelegationQueryOptions = z.infer<typeof AccountDelegationQueryOptionsSchema>;\n\n/**\n * Entry in the capability registry mapping a capability to available keys.\n */\nexport const CapabilityEntrySchema = z.object({\n  /** Resource URI this capability applies to */\n  resource: z.string(),\n  /** Action this capability authorizes */\n  action: z.string(),\n  /** Keys that can exercise this capability, ordered by priority */\n  keys: z.array(KeyInfoSchema),\n  /** The delegation that grants this capability */\n  delegation: DelegationSchema,\n  /** When this capability expires (accepts Date or ISO string from JSON) */\n  expiresAt: z.coerce.date().optional(),\n});\n\nexport type CapabilityEntry = z.infer<typeof CapabilityEntrySchema>;\n\n/**\n * Persistent record of a delegation stored in the system.\n */\nexport const DelegationRecordSchema = z.object({\n  /** Content identifier (CID) of the delegation */\n  cid: z.string(),\n  /** Space ID this delegation applies to */\n  spaceId: z.string(),\n  /** DID of the delegator (grantor) */\n  delegator: z.string(),\n  /** DID of the delegatee (recipient) */\n  delegatee: z.string(),\n  /** Key ID used to sign/exercise this delegation */\n  keyId: z.string().optional(),\n  /** Resource path pattern this delegation grants access to */\n  path: z.string(),\n  /** Actions this delegation authorizes */\n  actions: z.array(z.string()),\n  /** When this delegation expires (accepts Date or ISO string from JSON) */\n  expiry: z.coerce.date().optional(),\n  /** When this delegation becomes valid (not before) (accepts Date or ISO string) */\n  notBefore: z.coerce.date().optional(),\n  /** Whether this delegation has been revoked */\n  isRevoked: z.boolean(),\n  /** When this delegation was created (accepts Date or ISO string from JSON) */\n  createdAt: z.coerce.date(),\n  /** Parent delegation CID if this is a sub-delegation */\n  parentCid: z.string().optional(),\n});\n\nexport type DelegationRecord = z.infer<typeof DelegationRecordSchema>;\n\n/**\n * Parameters for creating a new delegation.\n */\nexport const CreateDelegationParamsSchema = z.object({\n  /** DID of the delegate (the party receiving the delegation) */\n  delegateDID: z.string(),\n  /** Resource path this delegation grants access to */\n  path: z.string(),\n  /** Actions to authorize */\n  actions: z.array(z.string()),\n  /** When this delegation expires (accepts Date or ISO string) */\n  expiry: z.coerce.date().optional(),\n  /** Whether to disable sub-delegation */\n  disableSubDelegation: z.boolean().optional(),\n  /** Optional statement for the SIWE message */\n  statement: z.string().optional(),\n});\n\nexport type CreateDelegationParams = z.infer<typeof CreateDelegationParamsSchema>;\n\n/**\n * A chain of delegations from root to leaf (array format).\n */\nexport const DelegationChainSchema = z.array(DelegationSchema);\nexport type DelegationChain = z.infer<typeof DelegationChainSchema>;\n\n/**\n * Structured delegation chain (v2 spec).\n */\nexport const DelegationChainV2Schema = z.object({\n  /** The root delegation from the original authority */\n  root: DelegationSchema,\n  /** Intermediate delegations in the chain (may be empty) */\n  chain: z.array(DelegationSchema),\n  /** The final delegation to the current user */\n  leaf: DelegationSchema,\n});\n\nexport type DelegationChainV2 = z.infer<typeof DelegationChainV2Schema>;\n\n// =============================================================================\n// Filtering and Query Types\n// =============================================================================\n\n/**\n * Direction of delegation to filter by.\n */\nexport const DelegationDirectionSchema = z.enum([\"granted\", \"received\", \"all\"]);\nexport type DelegationDirection = z.infer<typeof DelegationDirectionSchema>;\n\n/**\n * Filters for listing delegations.\n */\nexport const DelegationFiltersSchema = z.object({\n  /** Filter by delegation direction */\n  direction: DelegationDirectionSchema.optional(),\n  /** Filter by resource path pattern */\n  path: z.string().optional(),\n  /** Filter by required actions */\n  actions: z.array(z.string()).optional(),\n  /** Include revoked delegations */\n  includeRevoked: z.boolean().optional(),\n  /** Filter by delegator DID */\n  delegator: z.string().optional(),\n  /** Filter by delegatee DID */\n  delegatee: z.string().optional(),\n  /** Only include delegations valid at this time */\n  validAt: z.coerce.date().optional(),\n  /** Maximum number of results to return */\n  limit: z.number().optional(),\n  /** Cursor for pagination */\n  cursor: z.string().optional(),\n});\n\nexport type DelegationFilters = z.infer<typeof DelegationFiltersSchema>;\n\n// =============================================================================\n// Space Types\n// =============================================================================\n\n/**\n * Type of space ownership.\n */\nexport const SpaceOwnershipSchema = z.enum([\"owned\", \"delegated\"]);\nexport type SpaceOwnership = z.infer<typeof SpaceOwnershipSchema>;\n\n/**\n * Information about a space the user has access to.\n */\nexport const SpaceInfoSchema = z.object({\n  /** Space identifier */\n  id: z.string(),\n  /** Human-readable name for the space */\n  name: z.string().optional(),\n  /** DID of the space owner */\n  owner: z.string(),\n  /** Whether user owns or has delegated access */\n  type: SpaceOwnershipSchema,\n  /** Permissions the user has in this space */\n  permissions: z.array(z.string()).optional(),\n  /** When the access expires (for delegated spaces) */\n  expiresAt: z.coerce.date().optional(),\n});\n\nexport type SpaceInfo = z.infer<typeof SpaceInfoSchema>;\n\n// =============================================================================\n// Share Link Types\n// =============================================================================\n\n/**\n * Schema for encoding share link data.\n */\nexport const ShareSchemaSchema = z.enum([\"base64\", \"compact\", \"ipfs\"]);\nexport type ShareSchema = z.infer<typeof ShareSchemaSchema>;\n\n/**\n * A shareable link containing delegation credentials.\n */\nexport const ShareLinkSchema = z.object({\n  /** Unique token identifying this share link */\n  token: z.string(),\n  /** Full URL for sharing */\n  url: z.string(),\n  /** The delegation this link grants access to */\n  delegation: DelegationSchema,\n  /** Encoding schema used for the link */\n  schema: ShareSchemaSchema,\n  /** When this share link expires */\n  expiresAt: z.coerce.date().optional(),\n  /** Human-readable description of what is being shared */\n  description: z.string().optional(),\n});\n\nexport type ShareLink = z.infer<typeof ShareLinkSchema>;\n\n/**\n * Data retrieved from a share link.\n */\nexport function createShareLinkDataSchema<T extends z.ZodTypeAny>(dataSchema: T) {\n  return z.object({\n    /** The retrieved data */\n    data: dataSchema,\n    /** The delegation that authorized this access */\n    delegation: DelegationSchema,\n    /** The space the data belongs to */\n    spaceId: z.string(),\n    /** The resource path that was accessed */\n    path: z.string(),\n  });\n}\n\nexport const ShareLinkDataSchema = createShareLinkDataSchema(z.unknown());\nexport type ShareLinkData<T = unknown> = {\n  data: T;\n  delegation: Delegation;\n  spaceId: string;\n  path: string;\n};\n\n// =============================================================================\n// Ingestion Types\n// =============================================================================\n\n/**\n * Options for ingesting an external delegation.\n */\nexport const IngestOptionsSchema = z.object({\n  /** Whether to persist the delegation to storage */\n  persist: z.boolean().optional(),\n  /** Whether to validate the full delegation chain */\n  validateChain: z.boolean().optional(),\n  /** Name for the ingested key */\n  keyName: z.string().optional(),\n  /** Whether to create a session key for this delegation */\n  createSessionKey: z.boolean().optional(),\n  /** Override the priority for the ingested key */\n  priority: z.number().optional(),\n});\n\nexport type IngestOptions = z.infer<typeof IngestOptionsSchema>;\n\n// =============================================================================\n// Parameter Types\n// =============================================================================\n\n/**\n * Parameters for generating a share link.\n */\nexport const GenerateShareParamsSchema = z.object({\n  /** Resource path to share */\n  path: z.string(),\n  /** Actions to authorize */\n  actions: z.array(z.string()).optional(),\n  /** When the share link expires */\n  expiry: z.coerce.date().optional(),\n  /** Encoding schema for the link */\n  schema: ShareSchemaSchema.optional(),\n  /** Human-readable description */\n  description: z.string().optional(),\n  /** Base URL for the share link */\n  baseUrl: z.string().optional(),\n});\n\nexport type GenerateShareParams = z.infer<typeof GenerateShareParamsSchema>;\n\n// =============================================================================\n// Configuration Types\n// =============================================================================\n\n// Note: These types include functions and external types which cannot be fully validated at runtime.\n// We use z.unknown().refine() for runtime type checking while preserving TypeScript types.\n\n/**\n * Configuration for DelegationManager.\n * Note: ServiceSession, InvokeFunction, and FetchFunction are external types.\n */\nexport const DelegationManagerConfigSchema = z.object({\n  /** TinyCloud host URLs */\n  hosts: z.array(z.string()),\n  /** Account space used by account-wide delegation history queries */\n  accountSpaceId: z.string().min(1).optional(),\n  /** Active session for authentication */\n  session: z.unknown().refine(\n    (val): val is ServiceSession => val !== null && typeof val === \"object\",\n    { message: \"Expected a ServiceSession object\" }\n  ),\n  /** Platform-specific invoke function */\n  invoke: z.unknown().refine(\n    (val): val is InvokeFunction => typeof val === \"function\",\n    { message: \"Expected an invoke function\" }\n  ),\n  /** Platform-specific invoke function for raw resource URIs */\n  invokeAny: z.unknown().refine(\n    (val): val is InvokeAnyFunction => val === undefined || typeof val === \"function\",\n    { message: \"Expected an invokeAny function or undefined\" }\n  ).optional(),\n  /** Optional custom fetch implementation */\n  fetch: z.unknown().refine(\n    (val): val is FetchFunction => val === undefined || typeof val === \"function\",\n    { message: \"Expected a fetch function or undefined\" }\n  ).optional(),\n});\n\nexport type DelegationManagerConfig = z.infer<typeof DelegationManagerConfigSchema>;\n\n/**\n * Provider interface for cryptographic key operations.\n */\nexport const KeyProviderSchema = z.object({\n  /** Generate a new session key, returns key ID */\n  createSessionKey: z.unknown().refine(\n    (val): val is (name: string) => Promise<string> => typeof val === \"function\",\n    { message: \"Expected a function\" }\n  ),\n  /** Get JWK for a key */\n  getJWK: z.unknown().refine(\n    (val): val is (keyId: string) => object => typeof val === \"function\",\n    { message: \"Expected a function\" }\n  ),\n  /** Get DID for a key */\n  getDID: z.unknown().refine(\n    (val): val is (keyId: string) => Promise<string> => typeof val === \"function\",\n    { message: \"Expected a function\" }\n  ),\n});\n\nexport type KeyProvider = z.infer<typeof KeyProviderSchema>;\n\n// =============================================================================\n// API Response Types\n// =============================================================================\n\n/**\n * Response from the delegation API.\n */\nexport const DelegationApiResponseSchema = z.object({\n  /** SIWE message content */\n  siwe: z.string(),\n  /** Signature of the SIWE message */\n  signature: z.string(),\n  /** Delegation version */\n  version: z.number(),\n  /** CID of the created delegation */\n  cid: z.string().optional(),\n});\n\nexport type DelegationApiResponse = z.infer<typeof DelegationApiResponseSchema>;\n\n// =============================================================================\n// WASM Delegation Types\n// =============================================================================\n\n/**\n * A single (service, space, path, actions) entry inside a\n * createDelegation WASM result.\n *\n * Mirrors the Rust `DelegatedResource` struct in\n * `tinycloud-sdk-wasm/src/session.rs`. Field names match the manifest\n * {@link PermissionEntry} shape so callers can reconstruct what they sent\n * without having to re-parse the UCAN.\n *\n * `service` is the short form (e.g. `\"kv\"`, `\"sql\"`) as returned by the\n * Rust layer. The SDK layer translates to the long form\n * (`\"tinycloud.kv\"`) when comparing against manifests.\n */\nexport const DelegatedResourceSchema = z.object({\n  /** Short-form service name, e.g. \"kv\", \"sql\", \"duckdb\", \"capabilities\", \"hooks\". */\n  service: z.string(),\n  /** Full space id string, e.g. \"tinycloud:pkh:eip155:1:0x....:default\". */\n  space: z.string(),\n  /** Resource path; empty string when the resource URI had no path segment. */\n  path: z.string(),\n  /** Full-URN ability strings, e.g. [\"tinycloud.kv/get\", \"tinycloud.kv/put\"]. */\n  actions: z.array(z.string()),\n  /** Exact ReCap caveats that constrain every action in this scope. */\n  caveats: z.array(z.record(z.string(), z.unknown())).optional(),\n});\n\nexport type DelegatedResource = z.infer<typeof DelegatedResourceSchema>;\n\n/**\n * Input parameters for the createDelegation WASM function.\n *\n * A single call may encode multiple `(service, path, actions)` entries\n * via the `abilities` map — the underlying UCAN will contain one\n * attenuation entry per `(service, path)` pair, all signed by the same\n * session key in one blob.\n *\n * The `abilities` shape is identical to what `prepareSession` accepts\n * (`Record<shortService, Record<path, actionURNs[]>>`), so manifest\n * resolution can feed both sides from one data structure.\n */\nexport const CreateDelegationWasmParamsSchema = z.object({\n  /** The session containing delegation credentials */\n  session: z.unknown().refine(\n    (val): val is ServiceSession => val !== null && typeof val === \"object\",\n    { message: \"Expected a ServiceSession object\" }\n  ),\n  /** DID of the delegate */\n  delegateDID: z.string(),\n  /** Space ID this delegation applies to */\n  spaceId: z.string(),\n  /**\n   * Multi-resource abilities map: short-service → path → full-URN actions.\n   * Matches the shape accepted by `prepareSession`.\n   *\n   * Example:\n   * ```\n   * {\n   *   kv: {\n   *     \"com.listen.app/\": [\"tinycloud.kv/get\", \"tinycloud.kv/put\"]\n   *   },\n   *   sql: {\n   *     \"com.listen.app/data.sqlite\": [\"tinycloud.sql/read\"]\n   *   }\n   * }\n   * ```\n   */\n  abilities: z.record(z.string(), z.record(z.string(), z.array(z.string()))),\n  /** Expiration time in seconds since Unix epoch */\n  expirationSecs: z.number(),\n  /** Optional not-before time in seconds since Unix epoch */\n  notBeforeSecs: z.number().optional(),\n});\n\nexport type CreateDelegationWasmParams = z.infer<typeof CreateDelegationWasmParamsSchema>;\n\n/**\n * Result from the createDelegation WASM function.\n *\n * A single UCAN may cover multiple resources. The `resources` array\n * describes every `(service, space, path, actions)` entry granted, in\n * deterministic (service, path) lexicographic order (the Rust side sorts\n * the HashMap entries before signing).\n */\nexport const CreateDelegationWasmResultSchema = z.object({\n  /** Base64url-encoded UCAN delegation */\n  delegation: z.string(),\n  /** CID of the delegation */\n  cid: z.string(),\n  /** DID of the delegate */\n  delegateDID: z.string(),\n  /** Expiration time */\n  expiry: z.coerce.date(),\n  /**\n   * All (service, space, path, actions) entries granted by this delegation.\n   * Always non-empty on success.\n   */\n  resources: z.array(DelegatedResourceSchema),\n});\n\nexport type CreateDelegationWasmResult = z.infer<typeof CreateDelegationWasmResultSchema>;\n\n// =============================================================================\n// Validation Helpers\n// =============================================================================\n\n/**\n * Validates a Delegation object and returns a Result.\n */\nexport function validateDelegation(data: unknown): Result<Delegation, DelegationError> {\n  const result = DelegationSchema.safeParse(data);\n  if (!result.success) {\n    return {\n      ok: false,\n      error: {\n        code: DelegationErrorCodes.VALIDATION_ERROR,\n        message: result.error.message,\n        service: \"delegation\",\n        meta: { issues: result.error.issues },\n      },\n    };\n  }\n  return { ok: true, data: result.data };\n}\n\n/**\n * Validates a CreateDelegationParams object and returns a Result.\n */\nexport function validateCreateDelegationParams(\n  data: unknown\n): Result<CreateDelegationParams, DelegationError> {\n  const result = CreateDelegationParamsSchema.safeParse(data);\n  if (!result.success) {\n    return {\n      ok: false,\n      error: {\n        code: DelegationErrorCodes.VALIDATION_ERROR,\n        message: result.error.message,\n        service: \"delegation\",\n        meta: { issues: result.error.issues },\n      },\n    };\n  }\n  return { ok: true, data: result.data };\n}\n\n/**\n * Validates a DelegationFilters object and returns a Result.\n */\nexport function validateDelegationFilters(\n  data: unknown\n): Result<DelegationFilters, DelegationError> {\n  const result = DelegationFiltersSchema.safeParse(data);\n  if (!result.success) {\n    return {\n      ok: false,\n      error: {\n        code: DelegationErrorCodes.VALIDATION_ERROR,\n        message: result.error.message,\n        service: \"delegation\",\n        meta: { issues: result.error.issues },\n      },\n    };\n  }\n  return { ok: true, data: result.data };\n}\n\n/**\n * Validates a ShareLink object and returns a Result.\n */\nexport function validateShareLink(data: unknown): Result<ShareLink, DelegationError> {\n  const result = ShareLinkSchema.safeParse(data);\n  if (!result.success) {\n    return {\n      ok: false,\n      error: {\n        code: DelegationErrorCodes.VALIDATION_ERROR,\n        message: result.error.message,\n        service: \"delegation\",\n        meta: { issues: result.error.issues },\n      },\n    };\n  }\n  return { ok: true, data: result.data };\n}\n\n/**\n * Generic validation function factory.\n */\nexport function createValidator<T>(\n  schema: z.ZodType<T>\n): (data: unknown) => Result<T, DelegationError> {\n  return (data: unknown): Result<T, DelegationError> => {\n    const result = schema.safeParse(data);\n    if (!result.success) {\n      return {\n        ok: false,\n        error: {\n          code: DelegationErrorCodes.VALIDATION_ERROR,\n          message: result.error.message,\n          service: \"delegation\",\n          meta: { issues: result.error.issues },\n        },\n      };\n    }\n    return { ok: true, data: result.data };\n  };\n}\n","/**\n * Default lifetimes for the various delegation shapes the SDK mints.\n *\n * The SDK has many delegation flows (session sign-in, runtime grants,\n * share links, manifest installs, public-space sub-delegations, …) and\n * each one used to pick its own number freehand. That made it hard to\n * tell whether a chosen value was deliberate or copy-pasted, and made\n * silent inconsistencies easy to ship.\n *\n * Every default below answers two questions:\n *  - Who recovers if the delegation leaks? (re-auth, revocation, no one)\n *  - Who is the principal at use time? (issuer, third party)\n *\n * The five tiers fall out of those answers. Pick a tier, not a number,\n * when introducing a new delegation surface.\n *\n * @packageDocumentation\n */\n\n/**\n * Auto-refreshable, never user-visible. The SDK can re-derive these\n * transparently from the active session. Lifetime exists only to bound\n * replay if the wire format leaks.\n *\n * Use for: public-space sub-delegations, internal capability re-derivations.\n */\nconst EPHEMERAL_MS = 60 * 60 * 1000; // 1 hour\n\n/**\n * Short-lived bearer URLs for direct KV reads. Anyone holding the URL can\n * read the object until expiry, so the default is deliberately shorter than\n * delegation-style tiers. Callers can request a different TTL per URL.\n *\n * Use for: KV signed read URLs.\n */\nconst SIGNED_READ_URL_MS = 5 * 60 * 1000; // 5 minutes\n\n/**\n * The user's currently-active sign-in session. Recovery is trivial\n * (re-sign-in). Length tracks how long the user/agent is expected to\n * be working without re-prompt.\n *\n * Use for: TinyCloudNode session expiry, runtime permission grants\n * (which are capped by the session anyway).\n */\nconst SESSION_MS = 7 * 24 * 60 * 60 * 1000; // 7 days\n\n/**\n * Ad-hoc third-party delegations the caller often forgets to revoke.\n * Default sized so a forgotten share link prunes itself within a week\n * rather than living forever; callers pass longer for known recipients.\n *\n * Use for: SharingService share links, DelegationManager defaults,\n * SpaceService server-response fallback.\n */\nconst SHARE_MS = 7 * 24 * 60 * 60 * 1000; // 7 days\n\n/**\n * Manifest-declared delegations for installed apps. Long enough that\n * monthly re-prompts feel like maintenance, short enough that\n * abandoning an app prunes its access.\n *\n * Use for: manifest `expiry` defaults.\n */\nconst APP_MS = 30 * 24 * 60 * 60 * 1000; // 30 days\n\n/**\n * Hard ceiling for caller-supplied expiry. Effectively \"forever\" — the\n * constant exists primarily to guard against integer overflow / typo'd\n * input, not as a security policy lever. Long-lived API-token-style\n * delegations are a first-class use case; revocation is the right\n * control for them.\n */\nconst MAX_MS = 10 * 365 * 24 * 60 * 60 * 1000; // 10 years\n\nexport const EXPIRY = {\n  EPHEMERAL_MS,\n  SIGNED_READ_URL_MS,\n  SESSION_MS,\n  SHARE_MS,\n  APP_MS,\n  MAX_MS,\n} as const;\n\nexport const DEFAULT_SIGNED_READ_URL_EXPIRY_MS = EXPIRY.SIGNED_READ_URL_MS;\n\nexport type ExpiryTier = keyof typeof EXPIRY;\n","/**\n * DelegationManager - Handles delegation CRUD operations.\n *\n * This class manages the creation, revocation, listing, and querying\n * of delegations within TinyCloud. It extracts and improves upon the\n * delegation functionality previously in ITinyCloudStorage.\n *\n * @packageDocumentation\n */\n\nimport type {\n  FetchFunction,\n  FetchResponse,\n  InvokeAnyFunction,\n  InvokeFunction,\n  ServiceSession,\n} from \"@tinycloud/sdk-services\";\nimport {\n  Result,\n  DelegationError,\n  DelegationErrorCodes,\n  Delegation,\n  DelegationStatus,\n  DelegationStatusSchema,\n  DelegationRevocationReceipt,\n  DelegationRevocationReceiptSchema,\n  AccountDelegationPage,\n  AccountDelegationPageSchema,\n  AccountDelegationQueryOptionsSchema,\n  AccountDelegationQueryOptions,\n  CreateDelegationParams,\n  DelegationChain,\n  DelegationManagerConfig,\n  DelegationApiResponse,\n} from \"./types\";\nimport { EXPIRY } from \"../expiry\";\n\n/**\n * Delegation action constants.\n */\nconst DelegationAction = {\n  CREATE: \"tinycloud.delegation/create\",\n  REVOKE: \"tinycloud.delegation/revoke\",\n  STATUS: \"tinycloud.delegation/status\",\n  LIST: \"tinycloud.delegation/list\",\n  GET: \"tinycloud.delegation/get\",\n  CHECK: \"tinycloud.delegation/check\",\n} as const;\n\n/**\n * Creates a DelegationError with the given parameters.\n */\nfunction createError(\n  code: string,\n  message: string,\n  cause?: Error,\n  meta?: Record<string, unknown>\n): DelegationError {\n  return {\n    code,\n    message,\n    service: \"delegation\",\n    cause,\n    meta,\n  };\n}\n\n/**\n * DelegationManager handles all delegation-related operations.\n *\n * @example\n * ```typescript\n * import { DelegationManager } from \"@tinycloud/sdk-core/delegations\";\n *\n * const delegations = new DelegationManager({\n *   hosts: [\"https://node.tinycloud.xyz\"],\n *   session,\n *   invoke,\n * });\n *\n * // Create a delegation\n * const result = await delegations.create({\n *   delegateDID: \"did:pkh:eip155:1:0x...\",\n *   path: \"shared/\",\n *   actions: [\"tinycloud.kv/get\", \"tinycloud.kv/list\"],\n *   expiry: new Date(Date.now() + 24 * 60 * 60 * 1000), // 24 hours\n * });\n *\n * if (result.ok) {\n *   console.log(\"Created delegation:\", result.data.cid);\n * }\n * ```\n */\nexport class DelegationManager {\n  private hosts: string[];\n  private session: ServiceSession;\n  private invoke: InvokeFunction;\n  private invokeAny?: InvokeAnyFunction;\n  private fetchFn: FetchFunction;\n  private accountSpaceId?: string;\n\n  /**\n   * Creates a new DelegationManager instance.\n   *\n   * @param config - Configuration including hosts, session, and invoke function\n   */\n  constructor(config: DelegationManagerConfig) {\n    this.hosts = config.hosts;\n    this.session = config.session;\n    this.invoke = config.invoke;\n    this.invokeAny = config.invokeAny;\n    this.fetchFn = config.fetch ?? globalThis.fetch.bind(globalThis);\n    this.accountSpaceId = config.accountSpaceId;\n  }\n\n  /**\n   * Updates the session (e.g., after re-authentication).\n   *\n   * @param session - New session to use for operations\n   */\n  public updateSession(session: ServiceSession): void {\n    this.session = session;\n  }\n\n  /**\n   * Gets the primary host URL.\n   */\n  private get host(): string {\n    return this.hosts[0];\n  }\n\n  /**\n   * Executes an invoke operation against the delegation API.\n   */\n  private async invokeOperation(\n    path: string,\n    action: string,\n    body?: string\n  ): Promise<FetchResponse> {\n    const headers = this.invoke(this.session, \"delegation\", path, action);\n\n    return this.fetchFn(`${this.host}/invoke`, {\n      method: \"POST\",\n      headers,\n      body,\n    });\n  }\n\n  /**\n   * Creates a new delegation.\n   *\n   * Delegates specific permissions to another DID for a given path.\n   * The delegatee can then use these permissions to access resources\n   * within the specified scope.\n   *\n   * @param params - Parameters for the delegation\n   * @returns Result containing the created Delegation or an error\n   *\n   * @example\n   * ```typescript\n   * const result = await manager.create({\n   *   delegateDID: bob.did,\n   *   path: \"documents/shared/\",\n   *   actions: [\"tinycloud.kv/get\", \"tinycloud.kv/put\"],\n   *   expiry: new Date(Date.now() + 7 * 24 * 60 * 60 * 1000), // 7 days\n   * });\n   * ```\n   */\n  async create(params: CreateDelegationParams): Promise<Result<Delegation>> {\n    // Validate inputs\n    if (!params.delegateDID) {\n      return {\n        ok: false,\n        error: createError(\n          DelegationErrorCodes.INVALID_INPUT,\n          \"delegateDID is required\"\n        ),\n      };\n    }\n\n    if (!params.path) {\n      return {\n        ok: false,\n        error: createError(\n          DelegationErrorCodes.INVALID_INPUT,\n          \"path is required\"\n        ),\n      };\n    }\n\n    if (!params.actions || params.actions.length === 0) {\n      return {\n        ok: false,\n        error: createError(\n          DelegationErrorCodes.INVALID_INPUT,\n          \"at least one action is required\"\n        ),\n      };\n    }\n\n    try {\n      const body = JSON.stringify({\n        delegateDID: params.delegateDID,\n        path: params.path,\n        actions: params.actions,\n        expiry: params.expiry?.toISOString(),\n        disableSubDelegation: params.disableSubDelegation ?? false,\n        statement: params.statement,\n      });\n\n      const response = await this.invokeOperation(\n        params.path,\n        DelegationAction.CREATE,\n        body\n      );\n\n      if (!response.ok) {\n        const errorText = await response.text();\n        return {\n          ok: false,\n          error: createError(\n            DelegationErrorCodes.CREATION_FAILED,\n            `Failed to create delegation: ${response.status} - ${errorText}`,\n            undefined,\n            { status: response.status, path: params.path }\n          ),\n        };\n      }\n\n      const apiResponse = (await response.json()) as DelegationApiResponse;\n\n      const delegation: Delegation = {\n        cid: apiResponse.cid ?? \"\",\n        delegateDID: params.delegateDID,\n        spaceId: this.session.spaceId,\n        path: params.path,\n        actions: params.actions,\n        expiry: params.expiry ?? new Date(Date.now() + EXPIRY.SHARE_MS),\n        isRevoked: false,\n        allowSubDelegation: !(params.disableSubDelegation ?? false),\n        createdAt: new Date(),\n      };\n\n      return { ok: true, data: delegation };\n    } catch (error) {\n      if (error instanceof Error && error.name === \"AbortError\") {\n        return {\n          ok: false,\n          error: createError(\n            DelegationErrorCodes.ABORTED,\n            \"Request aborted\",\n            error\n          ),\n        };\n      }\n      return {\n        ok: false,\n        error: createError(\n          DelegationErrorCodes.NETWORK_ERROR,\n          `Network error during delegation creation: ${String(error)}`,\n          error instanceof Error ? error : undefined\n        ),\n      };\n    }\n  }\n\n  /**\n   * Revokes an existing delegation.\n   *\n   * Once revoked, the delegation can no longer be used to access resources.\n   * This also invalidates any sub-delegations derived from this delegation.\n   *\n   * @param cid - The CID of the delegation to revoke\n   * @returns Result indicating success or an error\n   *\n   * @example\n   * ```typescript\n   * const result = await manager.revoke(\"bafy...\");\n   * if (result.ok) {\n   *   console.log(\"Delegation revoked successfully\");\n   * }\n   * ```\n   */\n  async revoke(cid: string): Promise<Result<DelegationRevocationReceipt>> {\n    if (!cid) {\n      return {\n        ok: false,\n        error: createError(\n          DelegationErrorCodes.INVALID_INPUT,\n          \"cid is required\"\n        ),\n      };\n    }\n\n    try {\n      if (!this.invokeAny) {\n        return {\n          ok: false,\n          error: createError(\n            DelegationErrorCodes.NOT_INITIALIZED,\n            \"Revocation requires an invokeAny function that can sign the target CID\"\n          ),\n        };\n      }\n\n      const headers = this.invokeAny(\n        this.session,\n        [{\n          resource: `urn:cid:${cid}`,\n          service: \"delegation\",\n          path: \"\",\n          action: DelegationAction.REVOKE,\n        }],\n      );\n      const response = await this.fetchFn(`${this.host}/revoke`, {\n        method: \"POST\",\n        headers,\n      });\n\n      if (!response.ok) {\n        const errorText = await response.text();\n\n        if (response.status === 404) {\n          return {\n            ok: false,\n            error: createError(\n              DelegationErrorCodes.NOT_FOUND,\n              `Delegation not found: ${cid}`\n            ),\n          };\n        }\n\n        return {\n          ok: false,\n          error: createError(\n            DelegationErrorCodes.REVOCATION_FAILED,\n            `Failed to revoke delegation: ${response.status} - ${errorText}`,\n            undefined,\n            { status: response.status, cid }\n          ),\n        };\n      }\n\n      const parsed = DelegationRevocationReceiptSchema.safeParse(await response.json());\n      if (!parsed.success || parsed.data.cid !== cid) {\n        return {\n          ok: false,\n          error: createError(\n            DelegationErrorCodes.REVOCATION_FAILED,\n            \"Node returned an invalid delegation revocation receipt\",\n            undefined,\n            { cid },\n          ),\n        };\n      }\n      return { ok: true, data: parsed.data };\n    } catch (error) {\n      if (error instanceof Error && error.name === \"AbortError\") {\n        return {\n          ok: false,\n          error: createError(\n            DelegationErrorCodes.ABORTED,\n            \"Request aborted\",\n            error\n          ),\n        };\n      }\n      return {\n        ok: false,\n        error: createError(\n          DelegationErrorCodes.NETWORK_ERROR,\n          `Network error during delegation revocation: ${String(error)}`,\n          error instanceof Error ? error : undefined\n        ),\n      };\n    }\n  }\n\n  /**\n   * Reads the node-confirmed lifecycle state of one delegation without\n   * exposing delegation metadata.\n   */\n  async status(cid: string): Promise<Result<DelegationStatus>> {\n    if (!cid) {\n      return {\n        ok: false,\n        error: createError(DelegationErrorCodes.INVALID_INPUT, \"cid is required\"),\n      };\n    }\n    if (!this.invokeAny) {\n      return {\n        ok: false,\n        error: createError(\n          DelegationErrorCodes.NOT_INITIALIZED,\n          \"Delegation status requires an invokeAny function that can sign the target CID\"\n        ),\n      };\n    }\n\n    try {\n      const headers = this.invokeAny(this.session, [{\n        resource: `urn:cid:${cid}`,\n        service: \"delegation\",\n        path: \"\",\n        action: DelegationAction.STATUS,\n      }]);\n      const response = await this.fetchFn(`${this.host}/delegation/status`, {\n        method: \"POST\",\n        headers: { ...headers, \"Content-Type\": \"application/json\" },\n        body: JSON.stringify({ cid }),\n      });\n      if (!response.ok && response.status !== 404) {\n        const errorText = await response.text();\n        return {\n          ok: false,\n          error: createError(\n            DelegationErrorCodes.NETWORK_ERROR,\n            `Failed to get delegation status: ${response.status} - ${errorText}`,\n            undefined,\n            { status: response.status, cid }\n          ),\n        };\n      }\n      const parsed = DelegationStatusSchema.safeParse(await response.json());\n      const responseStatusMatches = parsed.success && (\n        response.status === 404\n          ? parsed.data.status === \"not_found\" && !parsed.data.exists\n          : parsed.data.status !== \"not_found\"\n      );\n      if (!parsed.success || parsed.data.cid !== cid || !responseStatusMatches) {\n        return {\n          ok: false,\n          error: createError(\n            DelegationErrorCodes.INVALID_TOKEN,\n            \"Node returned an invalid delegation status response\",\n            undefined,\n            { cid }\n          ),\n        };\n      }\n      return { ok: true, data: parsed.data };\n    } catch (error) {\n      if (error instanceof Error && error.name === \"AbortError\") {\n        return {\n          ok: false,\n          error: createError(DelegationErrorCodes.ABORTED, \"Request aborted\", error),\n        };\n      }\n      return {\n        ok: false,\n        error: createError(\n          DelegationErrorCodes.NETWORK_ERROR,\n          `Network error during delegation status: ${String(error)}`,\n          error instanceof Error ? error : undefined\n        ),\n      };\n    }\n  }\n\n  /** Query lifecycle-complete delegation history for the authenticated account. */\n  async query(\n    options: AccountDelegationQueryOptions = {},\n  ): Promise<Result<AccountDelegationPage>> {\n    const validated = AccountDelegationQueryOptionsSchema.safeParse(options);\n    if (!validated.success) {\n      return {\n        ok: false,\n        error: createError(\n          DelegationErrorCodes.INVALID_INPUT,\n          \"Invalid delegation query options\",\n          undefined,\n          { issues: validated.error.issues },\n        ),\n      };\n    }\n    if (!this.invokeAny) {\n      return {\n        ok: false,\n        error: createError(\n          DelegationErrorCodes.NOT_INITIALIZED,\n          \"Delegation query requires an invokeAny function\",\n        ),\n      };\n    }\n    if (!this.accountSpaceId) {\n      return {\n        ok: false,\n        error: createError(\n          DelegationErrorCodes.NOT_INITIALIZED,\n          \"Delegation query requires an account space\",\n        ),\n      };\n    }\n    try {\n      const invocationHeaders = this.invokeAny(this.session, [{\n        spaceId: this.accountSpaceId,\n        service: \"delegation\",\n        path: \"\",\n        action: DelegationAction.LIST,\n      }]);\n      const headers = Object.fromEntries(new Headers(invocationHeaders).entries());\n      headers[\"content-type\"] = \"application/json\";\n      const response = await this.fetchFn(`${this.host}/delegation/query`, {\n        method: \"POST\",\n        headers,\n        body: JSON.stringify(validated.data),\n      });\n      if (!response.ok) {\n        const errorText = await response.text();\n        return {\n          ok: false,\n          error: createError(\n            DelegationErrorCodes.NETWORK_ERROR,\n            `Failed to query delegations: ${response.status} - ${errorText}`,\n            undefined,\n            { status: response.status },\n          ),\n        };\n      }\n      const parsed = AccountDelegationPageSchema.safeParse(await response.json());\n      if (!parsed.success) {\n        return {\n          ok: false,\n          error: createError(\n            DelegationErrorCodes.INVALID_TOKEN,\n            \"Node returned an invalid delegation query response\",\n          ),\n        };\n      }\n      return { ok: true, data: parsed.data };\n    } catch (error) {\n      return {\n        ok: false,\n        error: createError(\n          DelegationErrorCodes.NETWORK_ERROR,\n          `Network error during delegation query: ${String(error)}`,\n          error instanceof Error ? error : undefined,\n        ),\n      };\n    }\n  }\n\n  /**\n   * Lists all delegations for the current session's space.\n   *\n   * Returns both delegations created by the current user (as delegator)\n   * and delegations granted to the current user (as delegatee).\n   *\n   * @returns Result containing an array of Delegations or an error\n   *\n   * @example\n   * ```typescript\n   * const result = await manager.list();\n   * if (result.ok) {\n   *   for (const delegation of result.data) {\n   *     console.log(`${delegation.cid}: ${delegation.path} -> ${delegation.delegateDID}`);\n   *   }\n   * }\n   * ```\n   */\n  async list(): Promise<Result<Delegation[]>> {\n    try {\n      const response = await this.invokeOperation(\"\", DelegationAction.LIST);\n\n      if (!response.ok) {\n        const errorText = await response.text();\n        return {\n          ok: false,\n          error: createError(\n            DelegationErrorCodes.NETWORK_ERROR,\n            `Failed to list delegations: ${response.status} - ${errorText}`,\n            undefined,\n            { status: response.status }\n          ),\n        };\n      }\n\n      const data = (await response.json()) as Array<{\n        cid: string;\n        delegateDID: string;\n        delegatorDID?: string;\n        spaceId: string;\n        path: string;\n        actions: string[];\n        expiry: string;\n        isRevoked: boolean;\n        createdAt?: string;\n        parentCid?: string;\n        allowSubDelegation?: boolean;\n      }>;\n\n      const delegations: Delegation[] = data.map((item) => ({\n        cid: item.cid,\n        delegateDID: item.delegateDID,\n        delegatorDID: item.delegatorDID,\n        spaceId: item.spaceId,\n        path: item.path,\n        actions: item.actions,\n        expiry: new Date(item.expiry),\n        isRevoked: item.isRevoked,\n        createdAt: item.createdAt ? new Date(item.createdAt) : undefined,\n        parentCid: item.parentCid,\n        allowSubDelegation: item.allowSubDelegation,\n      }));\n\n      return { ok: true, data: delegations };\n    } catch (error) {\n      if (error instanceof Error && error.name === \"AbortError\") {\n        return {\n          ok: false,\n          error: createError(\n            DelegationErrorCodes.ABORTED,\n            \"Request aborted\",\n            error\n          ),\n        };\n      }\n      return {\n        ok: false,\n        error: createError(\n          DelegationErrorCodes.NETWORK_ERROR,\n          `Network error during delegation list: ${String(error)}`,\n          error instanceof Error ? error : undefined\n        ),\n      };\n    }\n  }\n\n  /**\n   * Gets the full delegation chain for a given delegation.\n   *\n   * Returns the chain of delegations from the root (original delegator)\n   * to the specified delegation, including all intermediate sub-delegations.\n   *\n   * @param cid - The CID of the delegation to get the chain for\n   * @returns Result containing the DelegationChain or an error\n   *\n   * @example\n   * ```typescript\n   * const result = await manager.getChain(\"bafy...\");\n   * if (result.ok) {\n   *   console.log(\"Chain length:\", result.data.length);\n   *   for (const delegation of result.data) {\n   *     console.log(`- ${delegation.delegatorDID} -> ${delegation.delegateDID}`);\n   *   }\n   * }\n   * ```\n   */\n  async getChain(cid: string): Promise<Result<DelegationChain>> {\n    if (!cid) {\n      return {\n        ok: false,\n        error: createError(\n          DelegationErrorCodes.INVALID_INPUT,\n          \"cid is required\"\n        ),\n      };\n    }\n\n    try {\n      const body = JSON.stringify({ cid, includeChain: true });\n\n      const response = await this.invokeOperation(\n        cid,\n        DelegationAction.GET,\n        body\n      );\n\n      if (!response.ok) {\n        const errorText = await response.text();\n\n        if (response.status === 404) {\n          return {\n            ok: false,\n            error: createError(\n              DelegationErrorCodes.NOT_FOUND,\n              `Delegation not found: ${cid}`\n            ),\n          };\n        }\n\n        return {\n          ok: false,\n          error: createError(\n            DelegationErrorCodes.NETWORK_ERROR,\n            `Failed to get delegation chain: ${response.status} - ${errorText}`,\n            undefined,\n            { status: response.status, cid }\n          ),\n        };\n      }\n\n      const data = (await response.json()) as {\n        chain: Array<{\n          cid: string;\n          delegateDID: string;\n          delegatorDID?: string;\n          spaceId: string;\n          path: string;\n          actions: string[];\n          expiry: string;\n          isRevoked: boolean;\n          createdAt?: string;\n          parentCid?: string;\n          allowSubDelegation?: boolean;\n        }>;\n      };\n\n      const chain: DelegationChain = data.chain.map((item) => ({\n        cid: item.cid,\n        delegateDID: item.delegateDID,\n        delegatorDID: item.delegatorDID,\n        spaceId: item.spaceId,\n        path: item.path,\n        actions: item.actions,\n        expiry: new Date(item.expiry),\n        isRevoked: item.isRevoked,\n        createdAt: item.createdAt ? new Date(item.createdAt) : undefined,\n        parentCid: item.parentCid,\n        allowSubDelegation: item.allowSubDelegation,\n      }));\n\n      return { ok: true, data: chain };\n    } catch (error) {\n      if (error instanceof Error && error.name === \"AbortError\") {\n        return {\n          ok: false,\n          error: createError(\n            DelegationErrorCodes.ABORTED,\n            \"Request aborted\",\n            error\n          ),\n        };\n      }\n      return {\n        ok: false,\n        error: createError(\n          DelegationErrorCodes.NETWORK_ERROR,\n          `Network error during chain retrieval: ${String(error)}`,\n          error instanceof Error ? error : undefined\n        ),\n      };\n    }\n  }\n\n  /**\n   * Checks if the current session has permission for a given path and action.\n   *\n   * This can be used to verify permissions before attempting an operation,\n   * or to implement custom access control logic.\n   *\n   * @param path - The resource path to check\n   * @param action - The action to check (e.g., \"tinycloud.kv/get\")\n   * @returns Result containing a boolean indicating permission or an error\n   *\n   * @example\n   * ```typescript\n   * const result = await manager.checkPermission(\"documents/private/\", \"tinycloud.kv/put\");\n   * if (result.ok && result.data) {\n   *   console.log(\"Permission granted\");\n   * } else {\n   *   console.log(\"Permission denied\");\n   * }\n   * ```\n   */\n  async checkPermission(path: string, action: string): Promise<Result<boolean>> {\n    if (!path) {\n      return {\n        ok: false,\n        error: createError(\n          DelegationErrorCodes.INVALID_INPUT,\n          \"path is required\"\n        ),\n      };\n    }\n\n    if (!action) {\n      return {\n        ok: false,\n        error: createError(\n          DelegationErrorCodes.INVALID_INPUT,\n          \"action is required\"\n        ),\n      };\n    }\n\n    try {\n      const body = JSON.stringify({ path, action });\n\n      const response = await this.invokeOperation(\n        path,\n        DelegationAction.CHECK,\n        body\n      );\n\n      if (!response.ok) {\n        // 403 means permission denied, which is a valid result\n        if (response.status === 403) {\n          return { ok: true, data: false };\n        }\n\n        const errorText = await response.text();\n        return {\n          ok: false,\n          error: createError(\n            DelegationErrorCodes.NETWORK_ERROR,\n            `Failed to check permission: ${response.status} - ${errorText}`,\n            undefined,\n            { status: response.status, path, action }\n          ),\n        };\n      }\n\n      const data = (await response.json()) as { allowed: boolean };\n      return { ok: true, data: data.allowed };\n    } catch (error) {\n      if (error instanceof Error && error.name === \"AbortError\") {\n        return {\n          ok: false,\n          error: createError(\n            DelegationErrorCodes.ABORTED,\n            \"Request aborted\",\n            error\n          ),\n        };\n      }\n      return {\n        ok: false,\n        error: createError(\n          DelegationErrorCodes.NETWORK_ERROR,\n          `Network error during permission check: ${String(error)}`,\n          error instanceof Error ? error : undefined\n        ),\n      };\n    }\n  }\n}\n","/**\n * Zod schemas for SharingService types.\n *\n * These schemas provide runtime validation for sharing link data,\n * receive options, and service configuration.\n *\n * @packageDocumentation\n */\n\nimport { z } from \"zod\";\nimport type {\n  FetchFunction,\n  IKVService,\n  InvokeFunction,\n  ServiceSession,\n} from \"@tinycloud/sdk-services\";\nimport {\n  JWKSchema,\n  DelegationSchema,\n  KeyProviderSchema,\n  IngestOptionsSchema,\n  type Result,\n  type DelegationError,\n  DelegationErrorCodes,\n} from \"./types.schema.js\";\nimport type { ICapabilityKeyRegistry } from \"../authorization/CapabilityKeyRegistry.js\";\nimport type { DelegationManager } from \"./DelegationManager.js\";\n\n// =============================================================================\n// EncodedShareData Schema\n// =============================================================================\n\n/**\n * Schema for data encoded in a sharing link.\n *\n * This is the primary validation point for external share link data.\n * The link is base64-decoded and JSON-parsed, then validated against this schema.\n */\nexport const EncodedShareDataSchema = z.object({\n  /** Private key in JWK format (must include d parameter) */\n  key: JWKSchema.refine(\n    (jwk) => typeof jwk.d === \"string\" && jwk.d.length > 0,\n    { message: \"JWK must include private key (d parameter)\" }\n  ),\n  /** DID of the key */\n  keyDid: z.string().min(1, \"keyDid is required\"),\n  /** The delegation granting access */\n  delegation: DelegationSchema,\n  /** Resource path this link grants access to */\n  path: z.string().min(1, \"path is required\"),\n  /** TinyCloud host URL */\n  host: z.string().url(\"host must be a valid URL\"),\n  /** Space ID */\n  spaceId: z.string().min(1, \"spaceId is required\"),\n  /** Schema version (must be 1) */\n  version: z.literal(1),\n});\n\nexport type EncodedShareData = z.infer<typeof EncodedShareDataSchema>;\n\n// =============================================================================\n// ReceiveOptions Schema\n// =============================================================================\n\n/**\n * Schema for options when receiving a sharing link.\n */\nexport const ReceiveOptionsSchema = z.object({\n  /**\n   * Whether to automatically create a sub-delegation to the current session key.\n   * Default: true\n   */\n  autoSubdelegate: z.boolean().optional(),\n  /**\n   * Whether to use the current session key for operations (requires autoSubdelegate).\n   * Default: true\n   */\n  useSessionKey: z.boolean().optional(),\n  /**\n   * Ingestion options passed to CapabilityKeyRegistry.\n   */\n  ingestOptions: IngestOptionsSchema.optional(),\n});\n\nexport type ReceiveOptions = z.infer<typeof ReceiveOptionsSchema>;\n\n// =============================================================================\n// SharingServiceConfig Schema\n// =============================================================================\n\n/**\n * Schema for SharingService configuration.\n *\n * Note: Function fields use z.function() for shape validation only.\n * External types (ServiceSession, DelegationManager, ICapabilityKeyRegistry)\n * use z.unknown() with runtime type refinement.\n */\nexport const SharingServiceConfigSchema = z.object({\n  /** TinyCloud host URLs */\n  hosts: z.array(z.string().url()).min(1, \"At least one host URL is required\"),\n  /**\n   * Active session for authentication.\n   * Required for generate(), optional for receive().\n   */\n  session: z\n    .unknown()\n    .refine(\n      (val): val is ServiceSession =>\n        val === undefined || (val !== null && typeof val === \"object\"),\n      { message: \"Expected a ServiceSession object or undefined\" }\n    )\n    .optional(),\n  /** Platform-specific invoke function */\n  invoke: z\n    .unknown()\n    .refine((val): val is InvokeFunction => typeof val === \"function\", {\n      message: \"Expected an invoke function\",\n    }),\n  /** Optional custom fetch implementation */\n  fetch: z\n    .unknown()\n    .refine(\n      (val): val is FetchFunction =>\n        val === undefined || typeof val === \"function\",\n      { message: \"Expected a fetch function or undefined\" }\n    )\n    .optional(),\n  /** Key provider for cryptographic operations */\n  keyProvider: KeyProviderSchema,\n  /** Capability key registry for key/delegation management */\n  registry: z\n    .unknown()\n    .refine(\n      (val): val is ICapabilityKeyRegistry =>\n        val !== null && typeof val === \"object\",\n      { message: \"Expected an ICapabilityKeyRegistry object\" }\n    ),\n  /**\n   * Delegation manager for creating delegations.\n   * Required for generate(), optional for receive().\n   */\n  delegationManager: z\n    .unknown()\n    .refine(\n      (val): val is DelegationManager =>\n        val === undefined || (val !== null && typeof val === \"object\"),\n      { message: \"Expected a DelegationManager object or undefined\" }\n    )\n    .optional(),\n  /** Factory for creating KV service instances */\n  createKVService: z.unknown().refine(\n    (val): val is (config: {\n      hosts: string[];\n      session: ServiceSession;\n      invoke: InvokeFunction;\n      fetch?: FetchFunction;\n      pathPrefix?: string;\n    }) => IKVService => typeof val === \"function\",\n    { message: \"Expected a createKVService factory function\" }\n  ),\n  /** Base URL for sharing links (e.g., \"https://share.myapp.com\") */\n  baseUrl: z.string().optional(),\n  /**\n   * Custom delegation creation function.\n   */\n  createDelegation: z\n    .unknown()\n    .refine((val) => val === undefined || typeof val === \"function\", {\n      message: \"Expected a createDelegation function or undefined\",\n    })\n    .optional(),\n  /**\n   * WASM function for client-side delegation creation.\n   */\n  createDelegationWasm: z\n    .unknown()\n    .refine((val) => val === undefined || typeof val === \"function\", {\n      message: \"Expected a createDelegationWasm function or undefined\",\n    })\n    .optional(),\n  /** CID computation used to verify transportable child delegations. */\n  computeCid: z\n    .unknown()\n    .refine((val): val is (data: Uint8Array, codec: bigint) => string => val === undefined || typeof val === \"function\", {\n      message: \"Expected a computeCid function or undefined\",\n    })\n    .optional(),\n  /**\n   * Path prefix for KV operations.\n   */\n  pathPrefix: z.string().optional(),\n  /**\n   * Session expiry time.\n   */\n  sessionExpiry: z.date().optional(),\n  /**\n   * Callback to create a DIRECT delegation from wallet to share key.\n   * This is the preferred method for long-lived share links because it\n   * bypasses the session delegation chain entirely.\n   */\n  onRootDelegationNeeded: z\n    .unknown()\n    .refine((val) => val === undefined || typeof val === \"function\", {\n      message: \"Expected an onRootDelegationNeeded function or undefined\",\n    })\n    .optional(),\n});\n\nexport type SharingServiceConfig = z.infer<typeof SharingServiceConfigSchema>;\n\n// =============================================================================\n// Validation Helpers\n// =============================================================================\n\n/**\n * Validates encoded share data from a decoded link.\n *\n * @param data - Unknown data to validate (from JSON.parse)\n * @returns Result with validated data or validation error\n *\n * @example\n * ```typescript\n * const parsed = JSON.parse(base64UrlDecode(linkData));\n * const result = validateEncodedShareData(parsed);\n * if (!result.ok) {\n *   return result; // Forward the error\n * }\n * const shareData = result.data;\n * ```\n */\nexport function validateEncodedShareData(\n  data: unknown\n): Result<EncodedShareData, DelegationError> {\n  const result = EncodedShareDataSchema.safeParse(data);\n  if (!result.success) {\n    return {\n      ok: false,\n      error: {\n        code: DelegationErrorCodes.VALIDATION_ERROR,\n        message: `Invalid share data: ${result.error.message}`,\n        service: \"delegation\",\n        meta: { issues: result.error.issues },\n      },\n    };\n  }\n  return { ok: true, data: result.data };\n}\n\n/**\n * Validates receive options.\n *\n * @param data - Unknown data to validate\n * @returns Result with validated data or validation error\n */\nexport function validateReceiveOptions(\n  data: unknown\n): Result<ReceiveOptions, DelegationError> {\n  const result = ReceiveOptionsSchema.safeParse(data);\n  if (!result.success) {\n    return {\n      ok: false,\n      error: {\n        code: DelegationErrorCodes.VALIDATION_ERROR,\n        message: `Invalid receive options: ${result.error.message}`,\n        service: \"delegation\",\n        meta: { issues: result.error.issues },\n      },\n    };\n  }\n  return { ok: true, data: result.data };\n}\n\n/**\n * Validates SharingService configuration.\n *\n * @param data - Unknown data to validate\n * @returns Result with validated data or validation error\n */\nexport function validateSharingServiceConfig(\n  data: unknown\n): Result<SharingServiceConfig, DelegationError> {\n  const result = SharingServiceConfigSchema.safeParse(data);\n  if (!result.success) {\n    return {\n      ok: false,\n      error: {\n        code: DelegationErrorCodes.VALIDATION_ERROR,\n        message: `Invalid SharingService config: ${result.error.message}`,\n        service: \"delegation\",\n        meta: { issues: result.error.issues },\n      },\n    };\n  }\n  return { ok: true, data: result.data };\n}\n","/**\n * TinyCloud App Manifest\n *\n * A declarative description of an app's identity and the capabilities it\n * needs. The manifest drives the SIWE recap at sign-in time, enabling a\n * single wallet prompt that covers the app's own permissions plus any\n * pre-declared delegations.\n *\n * The SDK does NOT fetch external manifests. Apps compose their own manifest\n * (optionally including backend or agent addenda) before handing it to the\n * SDK.\n *\n * Canonical spec: `.claude/specs/manifest.md`.\n *\n * @packageDocumentation\n */\n\nimport ms from \"ms\";\nimport { ACCOUNT_MANIFEST_PERMISSIONS } from \"@tinycloud/bootstrap\";\nimport { resolveSecretPath, SECRET_NAME_RE } from \"@tinycloud/sdk-services\";\n\n// ---------------------------------------------------------------------------\n// Public types\n// ---------------------------------------------------------------------------\n\n/**\n * A single permission entry inside a manifest. This is the shape apps write\n * in their `manifest.json` and the shape we compare against when performing\n * the capability-subset derivability check in the delegation flow.\n *\n * `service` uses the long form (e.g. `\"tinycloud.kv\"`, `\"tinycloud.sql\"`).\n * `\"tinycloud.vault\"` is an SDK-only shorthand that expands to the KV\n * resources the vault service uses; it is never encoded as a recap service.\n */\nexport interface PermissionEntry {\n  /** Service namespace, e.g. \"tinycloud.kv\", \"tinycloud.sql\", \"tinycloud.duckdb\", \"tinycloud.capabilities\". */\n  service: string;\n  /** Space name or full space URI. Defaults to \"applications\" inside manifests. */\n  space?: string;\n  /**\n   * Service-specific path.\n   * - tinycloud.kv: hierarchical prefix. \"/\" = all, \"foo/\" = prefix match, \"foo\" = exact key\n   * - tinycloud.sql: database name/file (e.g. \"data.sqlite\") or \"/\" for all\n   * - tinycloud.duckdb: database name/file\n   * - tinycloud.capabilities: capability key URI or \"/\" for all\n   */\n  path: string;\n  /**\n   * Short action names (e.g. \"get\", \"put\", \"read\", \"schema\"). The SDK expands\n   * these to full URNs (e.g. `tinycloud.kv/get`) during resolution.\n   * Already-expanded URNs are passed through unchanged.\n   */\n  actions: string[];\n  /** Exact ReCap caveat branches when this authority came from a signed ReCap. */\n  caveats?: Record<string, unknown>[];\n  /** When true, the manifest prefix is NOT prepended to `path`. Default false. */\n  skipPrefix?: boolean;\n  /** Per-entry expiry override, ms-format. */\n  expiry?: string;\n  /** User/agent-facing context for why this permission is requested. */\n  description?: string;\n}\n\nexport type ManifestSecretActions =\n  | true\n  | string\n  | string[]\n  | {\n      /** Actual vault secret name. Defaults to the manifest object key. */\n      name?: string;\n      /** Optional scoped secret namespace. Omit for global secrets. */\n      scope?: string;\n      actions?: string | string[];\n      expiry?: string;\n      description?: string;\n    };\n\n/**\n * The valid values for `Manifest.defaults`.\n *\n * - `false` → no auto-included permissions\n * - `true` → standard tier (KV + SQL read/write + capabilities:read)\n * - `\"admin\"` → standard + SQL schema\n * - `\"all\"` → everything the SDK supports (including DuckDB)\n *\n * Unknown string values silently fall back to `true`. Values are normalized\n * (lowercase + trim) before matching.\n */\nexport type ManifestDefaults = boolean | \"admin\" | \"all\";\n\n/**\n * Agent-readable app knowledge bundle pointer.\n *\n * - `true` means the default root: `knowledge/index.md`\n * - string values must point at a markdown root under `knowledge/`\n */\nexport type ManifestKnowledge = true | string;\n\n/** Default root used when `manifest.knowledge === true`. */\nexport const DEFAULT_KNOWLEDGE_ROOT = \"knowledge/index.md\";\n\n/**\n * The raw manifest shape an app declares. See `.claude/specs/manifest.md`.\n */\nexport interface Manifest {\n  /** Schema version. Optional, defaults to 1. */\n  manifest_version?: 1;\n  /** Application identifier / namespace prefix. Required. */\n  app_id: string;\n  /** Display name. Required. */\n  name: string;\n  /** Description of what the app or delegate does. Optional. */\n  description?: string;\n  /** DID of this manifest's delegate target. Optional. Required only for delegation materialization. */\n  did?: string;\n  /** URL to app icon. Optional. */\n  icon?: string;\n  /** App version string. Optional. */\n  appVersion?: string;\n  /** Default expiry for permissions. ms-format (\"30d\", \"2h\", \"1y\"). Default \"30d\". */\n  expiry?: string;\n  /** Space name or full space URI. Optional, defaults to \"applications\". */\n  space?: string;\n  /**\n   * Path prefix auto-prepended to permission paths. Optional, defaults to\n   * `app_id`. Set to `\"\"` to disable entirely. Individual permissions can opt\n   * out with `skipPrefix: true`.\n   */\n  prefix?: string;\n  /**\n   * Default permission set to auto-include. Optional, defaults to `true`.\n   * See {@link ManifestDefaults}.\n   */\n  defaults?: ManifestDefaults | string;\n  /** Whether to include the public-space companion delegation. Default `true`. */\n  includePublicSpace?: boolean;\n  /** Agent-readable knowledge bundle root. `true` means `knowledge/index.md`. */\n  knowledge?: ManifestKnowledge;\n  /**\n   * Additional permissions beyond the defaults. Use for cross-space access,\n   * DuckDB (opt-in), or `skipPrefix: true` entries.\n   */\n  permissions?: PermissionEntry[];\n  /**\n   * Secret name shorthand. Entries resolve to encrypted vault KV resources in\n   * the `secrets` space.\n   */\n  secrets?: Record<string, ManifestSecretActions>;\n}\n\n/**\n * A resolved permission entry with fully-expanded paths and action URNs.\n * This is the shape the delegation flow compares against parsed recap\n * capabilities, and the shape the session-key delegation path actually uses.\n */\nexport interface ResourceCapability {\n  /** Long-form service, e.g. \"tinycloud.kv\". */\n  service: string;\n  /** Space name or URI. Short names are resolved to full SpaceIds at sign-in time. */\n  space: string;\n  /** Path with the manifest prefix applied (or skipped per `skipPrefix`). */\n  path: string;\n  /** Full-URN actions, e.g. [\"tinycloud.kv/get\", \"tinycloud.kv/put\"]. */\n  actions: string[];\n  /** Per-entry expiry override in milliseconds. */\n  expiryMs?: number;\n  /** User/agent-facing context copied from the source permission entry. */\n  description?: string;\n}\n\n/**\n * A resolved delegation entry with fully-expanded permissions.\n */\nexport interface ResolvedDelegate {\n  /** DID of the delegate. */\n  did: string;\n  /** Informational display name. Optional. */\n  name?: string;\n  /** Expiry in milliseconds (per-delegation > manifest default > 30 days). */\n  expiryMs: number;\n  /** Fully resolved permissions. */\n  permissions: ResourceCapability[];\n}\n\n/**\n * The output of {@link resolveManifest}: a fully-expanded capability set\n * ready to drive the SIWE recap.\n */\nexport interface ResolvedCapabilities {\n  /** Application identifier copied from manifest.app_id. */\n  app_id: string;\n  /** Delegate DID copied from manifest.did, when present. */\n  did?: string;\n  /** Effective default space for this manifest. */\n  space: string;\n  /** All session-key resources with paths fully resolved (prefix applied). */\n  resources: ResourceCapability[];\n  /** Default expiry for the session, in milliseconds. */\n  expiryMs: number;\n  /** Whether to include the public-space companion. */\n  includePublicSpace: boolean;\n  /** Delegate targets derived from manifests that declare `did`. */\n  additionalDelegates: ResolvedDelegate[];\n}\n\nexport interface ManifestRegistryRecord {\n  /** KV key inside the account space. */\n  key: string;\n  /** App id this record describes. */\n  app_id: string;\n  /** Latest manifest payloads composed for this app id. */\n  manifests: Manifest[];\n}\n\nexport interface ComposeManifestOptions {\n  /** Include implicit account-space registry permissions. Default true. */\n  includeAccountRegistryPermissions?: boolean;\n}\n\nexport interface ComposedManifestRequest {\n  /** Validated manifests that were composed. */\n  manifests: Manifest[];\n  /** Full permission union requested from the user in one SIWE. */\n  resources: ResourceCapability[];\n  /** Delegations that can be materialized after sign-in. */\n  delegationTargets: ResolvedDelegate[];\n  /** Account-space registry records to write after successful sign-in. */\n  registryRecords: ManifestRegistryRecord[];\n  /** Effective session expiry, using the longest composed manifest expiry. */\n  expiryMs: number;\n  /** Whether to include the public-space companion behavior. */\n  includePublicSpace: boolean;\n}\n\n/**\n * Thrown when the manifest fails validation (missing id/name, bad expiry,\n * empty actions on a permission, etc).\n */\nexport class ManifestValidationError extends Error {\n  constructor(message: string) {\n    super(`Manifest validation failed: ${message}`);\n    this.name = \"ManifestValidationError\";\n  }\n}\n\n// ---------------------------------------------------------------------------\n// Constants\n// ---------------------------------------------------------------------------\n\n/**\n * Default expiry when neither the manifest, delegation, nor permission\n * specifies one. APP tier — see `expiry.ts`. Spec: 30 days.\n *\n * Kept as an ms-format string because the manifest schema stores expiry\n * as a string and the parser is shared between this default and\n * caller-provided values; converting `EXPIRY.APP_MS` back to a string\n * here would duplicate that same `30d` literal in another form.\n */\nexport const DEFAULT_EXPIRY = \"30d\";\n\n/**\n * Default `defaults` value when the manifest omits it. Spec: standard tier.\n */\nexport const DEFAULT_DEFAULTS: ManifestDefaults = true;\n\n/** Default manifest schema version. */\nexport const DEFAULT_MANIFEST_VERSION = 1;\n\n/** Default space for manifest-declared app data. */\nexport const DEFAULT_MANIFEST_SPACE = \"applications\";\n\n/** Account-space name used for installed-application registry records. */\nexport const ACCOUNT_REGISTRY_SPACE = \"account\";\n\n/** Account-space KV prefix used for installed-application registry records. */\nexport const ACCOUNT_REGISTRY_PATH = \"applications/\";\n\nexport const SECRETS_SPACE = \"secrets\";\n\n/** SDK-only permission service for encrypted vault resources. */\nexport const VAULT_PERMISSION_SERVICE = \"tinycloud.vault\";\n\ntype VaultKVBase = \"vault\";\n\ninterface VaultActionExpansion {\n  bases: readonly VaultKVBase[];\n  action: string;\n}\n\n/**\n * Known services and their short-form (recap URI) names. The TinyCloud\n * node encodes the recap resource URI with the short service name, while\n * action URNs and manifest entries use the long `tinycloud.<short>` form.\n * This table is the canonical bridge between the two.\n */\nexport const SERVICE_SHORT_TO_LONG: Readonly<Record<string, string>> =\n  Object.freeze({\n    kv: \"tinycloud.kv\",\n    sql: \"tinycloud.sql\",\n    duckdb: \"tinycloud.duckdb\",\n    capabilities: \"tinycloud.capabilities\",\n    hooks: \"tinycloud.hooks\",\n    encryption: \"tinycloud.encryption\",\n    delegation: \"tinycloud.delegation\",\n  });\n\n/**\n * Manifest service identifier for TinyCloud encryption network grants.\n *\n * Encryption permissions live on a network id URN\n * (`urn:tinycloud:encryption:<ownerDid>:<network>`), not on a space.\n * The `path` field is the literal networkId; `actions` are\n * `[\"decrypt\"]` (expanded to `[\"tinycloud.encryption/decrypt\"]`).\n *\n * Apps should omit `space` for encryption permissions. The SDK may emit\n * an internal `\"encryption\"` compatibility label after expansion so the\n * older `PermissionEntry`/`ResourceCapability` shape can still carry the\n * raw network URN through subset checks.\n */\nexport const ENCRYPTION_PERMISSION_SERVICE = \"tinycloud.encryption\";\n\n/** Synthetic space label used by encryption manifest entries. */\nexport const ENCRYPTION_MANIFEST_SPACE = \"encryption\";\n\n/**\n * Inverse of {@link SERVICE_SHORT_TO_LONG}.\n */\nexport const SERVICE_LONG_TO_SHORT: Readonly<Record<string, string>> =\n  Object.freeze(\n    Object.fromEntries(\n      Object.entries(SERVICE_SHORT_TO_LONG).map(([s, l]) => [l, s]),\n    ),\n  );\n\n/**\n * Default permission entries for the `true` / standard tier.\n *\n * `tinycloud.capabilities/read` is added separately for every requested\n * space, without the app path prefix. That keeps capability introspection\n * space-scoped instead of app-data scoped.\n */\nconst DEFAULT_STANDARD_ENTRIES: readonly PermissionEntry[] = [\n  {\n    service: \"tinycloud.kv\",\n    space: DEFAULT_MANIFEST_SPACE,\n    path: \"/\",\n    actions: [\"get\", \"put\", \"del\", \"list\", \"metadata\"],\n  },\n  {\n    service: \"tinycloud.sql\",\n    space: DEFAULT_MANIFEST_SPACE,\n    path: \"/\",\n    actions: [\"read\", \"write\"],\n  },\n];\n\n/**\n * Default permission entries for the `\"admin\"` tier: standard + sql/schema.\n */\nconst DEFAULT_ADMIN_ENTRIES: readonly PermissionEntry[] = [\n  {\n    service: \"tinycloud.kv\",\n    space: DEFAULT_MANIFEST_SPACE,\n    path: \"/\",\n    actions: [\"get\", \"put\", \"del\", \"list\", \"metadata\"],\n  },\n  {\n    service: \"tinycloud.sql\",\n    space: DEFAULT_MANIFEST_SPACE,\n    path: \"/\",\n    actions: [\"read\", \"write\", \"schema\"],\n  },\n];\n\n/**\n * Default permission entries for the `\"all\"` tier: admin + DuckDB.\n *\n * DuckDB is opt-in and only appears in this tier or in explicit manifest\n * `permissions` entries.\n */\nconst DEFAULT_ALL_ENTRIES: readonly PermissionEntry[] = [\n  {\n    service: \"tinycloud.kv\",\n    space: DEFAULT_MANIFEST_SPACE,\n    path: \"/\",\n    actions: [\"get\", \"put\", \"del\", \"list\", \"metadata\"],\n  },\n  {\n    service: \"tinycloud.sql\",\n    space: DEFAULT_MANIFEST_SPACE,\n    path: \"/\",\n    actions: [\"read\", \"write\", \"schema\"],\n  },\n  {\n    service: \"tinycloud.duckdb\",\n    space: DEFAULT_MANIFEST_SPACE,\n    path: \"/\",\n    actions: [\"read\", \"write\"],\n  },\n];\n\n// ---------------------------------------------------------------------------\n// Public API\n// ---------------------------------------------------------------------------\n\n/**\n * Parse an ms-format duration string (e.g. \"30d\", \"2h\", \"1y\") into\n * milliseconds.\n *\n * @throws {ManifestValidationError} on empty string, non-string input, or\n * any input `ms()` cannot parse.\n */\nexport function parseExpiry(duration: string): number {\n  if (typeof duration !== \"string\" || duration.length === 0) {\n    throw new ManifestValidationError(\n      `expiry must be a non-empty duration string (got ${JSON.stringify(duration)})`,\n    );\n  }\n  // `ms` returns `undefined` for unparseable input and can return a number\n  // or a string depending on the call signature; cast explicitly.\n  const parsed = (ms as unknown as (v: string) => number | undefined)(duration);\n  if (typeof parsed !== \"number\" || !Number.isFinite(parsed) || parsed <= 0) {\n    throw new ManifestValidationError(\n      `invalid expiry duration: ${JSON.stringify(duration)}`,\n    );\n  }\n  return parsed;\n}\n\n/**\n * Expand a list of action short names (or already-expanded URNs) into full\n * ability URNs of the form `<service>/<action>`.\n *\n * Examples:\n *   `expandActionShortNames(\"tinycloud.kv\", [\"get\", \"put\"])`\n *     → `[\"tinycloud.kv/get\", \"tinycloud.kv/put\"]`\n *   `expandActionShortNames(\"tinycloud.kv\", [\"tinycloud.kv/get\"])`\n *     → `[\"tinycloud.kv/get\"]` (passed through unchanged)\n */\nexport function expandActionShortNames(\n  service: string,\n  actions: readonly string[],\n): string[] {\n  return actions.map((a) => {\n    if (a.includes(\"/\")) {\n      // Already a full URN — pass through.\n      return a;\n    }\n    return `${service}/${a}`;\n  });\n}\n\n/**\n * Expand SDK virtual permission services into concrete recap-capable services.\n *\n * Today this handles `\"tinycloud.vault\"`, which is backed by inline\n * network-encrypted KV records:\n * - read/get: `vault/<path>` with `tinycloud.kv/get`\n * - write/put: `vault/<path>` with `tinycloud.kv/put`\n * - delete/del: `vault/<path>` with `tinycloud.kv/del`\n * - list: `vault/<path>` with `tinycloud.kv/list`\n * - head: `vault/<path>` with `tinycloud.kv/get`\n * - metadata: `vault/<path>` with `tinycloud.kv/metadata`\n */\nexport function expandPermissionEntry(entry: PermissionEntry): PermissionEntry[] {\n  if (entry.service === ENCRYPTION_PERMISSION_SERVICE) {\n    return expandEncryptionPermissionEntry(entry);\n  }\n  if (entry.service !== VAULT_PERMISSION_SERVICE) {\n    return [\n      {\n        ...entry,\n        actions: expandActionShortNames(entry.service, entry.actions),\n      },\n    ];\n  }\n\n  return expandVaultPermissionEntry(entry);\n}\n\n/**\n * Expand a `tinycloud.encryption` manifest entry.\n *\n * - `path` MUST be a networkId URN (`urn:tinycloud:encryption:...`).\n *   The manifest prefix is always skipped — network ids are top-level\n *   owner-scoped resources, not space-scoped paths.\n * - `actions` must be `decrypt`, `network.create`, or `network.revoke`\n *   (or their already-expanded `tinycloud.encryption/*` forms).\n *\n * The returned entry uses an internal `space = \"encryption\"` compatibility\n * label so old manifest grouping code does not collapse it into the app's\n * data space, and `skipPrefix` is forced to `true` so the prefix application\n * step is a no-op.\n */\nfunction expandEncryptionPermissionEntry(\n  entry: PermissionEntry,\n): PermissionEntry[] {\n  if (\n    typeof entry.path !== \"string\" ||\n    !entry.path.startsWith(\"urn:tinycloud:encryption:\")\n  ) {\n    throw new ManifestValidationError(\n      `tinycloud.encryption entries require path to be a networkId URN ` +\n        `(got ${JSON.stringify(entry.path)})`,\n    );\n  }\n  const normalizedActions: string[] = [];\n  for (const action of entry.actions) {\n    if (action === \"decrypt\" || action === \"tinycloud.encryption/decrypt\") {\n      normalizedActions.push(\"tinycloud.encryption/decrypt\");\n      continue;\n    }\n    if (\n      action === \"network.create\" ||\n      action === \"tinycloud.encryption/network.create\"\n    ) {\n      normalizedActions.push(\"tinycloud.encryption/network.create\");\n      continue;\n    }\n    if (\n      action === \"network.revoke\" ||\n      action === \"tinycloud.encryption/network.revoke\"\n    ) {\n      normalizedActions.push(\"tinycloud.encryption/network.revoke\");\n      continue;\n    }\n    if (action.includes(\"/\")) {\n      throw new ManifestValidationError(\n        `unknown encryption action ${JSON.stringify(action)}; expected decrypt, network.create, or network.revoke`,\n      );\n    }\n    throw new ManifestValidationError(\n      `unknown encryption action ${JSON.stringify(action)}; expected decrypt, network.create, or network.revoke`,\n    );\n  }\n  // Dedupe while preserving order\n  const dedupedActions: string[] = [];\n  const seen = new Set<string>();\n  for (const a of normalizedActions) {\n    if (!seen.has(a)) {\n      dedupedActions.push(a);\n      seen.add(a);\n    }\n  }\n  // Encryption resources are network-scoped, not space-scoped. We\n  // always emit the synthetic \"encryption\" space label so manifest\n  // grouping can deal with it uniformly without collapsing the\n  // networkId URN into an app data space.\n  return [\n    {\n      service: ENCRYPTION_PERMISSION_SERVICE,\n      space: ENCRYPTION_MANIFEST_SPACE,\n      path: entry.path,\n      actions: dedupedActions,\n      skipPrefix: true,\n      ...(entry.expiry !== undefined ? { expiry: entry.expiry } : {}),\n      ...(entry.description !== undefined\n        ? { description: entry.description }\n        : {}),\n    },\n  ];\n}\n\n/**\n * Expand a list of permission entries using {@link expandPermissionEntry}.\n */\nexport function expandPermissionEntries(\n  entries: readonly PermissionEntry[],\n): PermissionEntry[] {\n  return entries.flatMap(expandPermissionEntry);\n}\n\n/**\n * Apply the manifest prefix to a permission path per the spec rules.\n *\n * - `skipPrefix: true` → path is returned as-is\n * - `prefix === \"\"` → path is returned as-is\n * - path starts with \"/\" → `prefix + path`  (e.g. \"com.listen.app\" + \"/\" → \"com.listen.app/\")\n * - otherwise → `prefix + \"/\" + path`  (e.g. \"com.listen.app\" + \"data.sqlite\" → \"com.listen.app/data.sqlite\")\n */\nexport function applyPrefix(\n  prefix: string,\n  path: string,\n  skipPrefix: boolean,\n): string {\n  if (skipPrefix) {\n    return path;\n  }\n  if (prefix === \"\") {\n    return path;\n  }\n  if (path.startsWith(\"/\")) {\n    return `${prefix}${path}`;\n  }\n  return `${prefix}/${path}`;\n}\n\n/**\n * Fetch and parse a manifest from a URL (browser) or file path (node).\n * The runtime decides the fetch strategy via `globalThis.fetch`; this is\n * platform-agnostic. Callers that want custom loading should JSON.parse a\n * Manifest themselves and skip this helper.\n *\n * @throws if the fetch fails, the JSON is invalid, or the manifest fails\n * validation.\n */\nexport async function loadManifest(url: string): Promise<Manifest> {\n  const fetchFn: typeof fetch | undefined = (\n    globalThis as { fetch?: typeof fetch }\n  ).fetch;\n  if (typeof fetchFn !== \"function\") {\n    throw new ManifestValidationError(\n      \"loadManifest requires a global fetch; pass the manifest object directly on runtimes without fetch\",\n    );\n  }\n  const res = await fetchFn(url);\n  if (!res.ok) {\n    throw new ManifestValidationError(\n      `failed to fetch manifest from ${url}: HTTP ${res.status}`,\n    );\n  }\n  const json = (await res.json()) as unknown;\n  return validateManifest(json);\n}\n\n/**\n * Validate a manifest-shaped object and return it strongly-typed.\n * Throws {@link ManifestValidationError} on any hard failure.\n */\nexport function validateManifest(input: unknown): Manifest {\n  if (input === null || typeof input !== \"object\") {\n    throw new ManifestValidationError(\"manifest must be an object\");\n  }\n  const m = input as Manifest;\n  if (\n    m.manifest_version !== undefined &&\n    m.manifest_version !== DEFAULT_MANIFEST_VERSION\n  ) {\n    throw new ManifestValidationError(\n      `manifest.manifest_version must be ${DEFAULT_MANIFEST_VERSION}`,\n    );\n  }\n  if (typeof m.app_id !== \"string\" || m.app_id.length === 0) {\n    throw new ManifestValidationError(\n      \"manifest.app_id is required and must be a non-empty string\",\n    );\n  }\n  if (typeof m.name !== \"string\" || m.name.length === 0) {\n    throw new ManifestValidationError(\n      \"manifest.name is required and must be a non-empty string\",\n    );\n  }\n  if (\n    m.did !== undefined &&\n    (typeof m.did !== \"string\" || m.did.length === 0)\n  ) {\n    throw new ManifestValidationError(\n      \"manifest.did must be a non-empty DID string\",\n    );\n  }\n  if (\n    m.space !== undefined &&\n    (typeof m.space !== \"string\" || m.space.length === 0)\n  ) {\n    throw new ManifestValidationError(\n      \"manifest.space must be a non-empty string\",\n    );\n  }\n  if (m.expiry !== undefined) {\n    // Will throw with a clear error if invalid.\n    parseExpiry(m.expiry);\n  }\n  if (m.knowledge !== undefined) {\n    resolveManifestKnowledgeRoot(m.knowledge);\n  }\n  if (m.permissions !== undefined) {\n    if (!Array.isArray(m.permissions)) {\n      throw new ManifestValidationError(\n        \"manifest.permissions must be an array\",\n      );\n    }\n    m.permissions.forEach((p, i) =>\n      validatePermissionEntry(p, `permissions[${i}]`),\n    );\n  }\n  if (m.secrets !== undefined) {\n    validateManifestSecrets(m.secrets);\n  }\n  return m;\n}\n\n/**\n * Resolve a manifest knowledge pointer to its root markdown file.\n *\n * This is metadata only; app knowledge does not create capabilities.\n */\nexport function resolveManifestKnowledgeRoot(\n  knowledge: Manifest[\"knowledge\"] | undefined,\n): string | undefined {\n  if (knowledge === undefined) {\n    return undefined;\n  }\n  if (knowledge === true) {\n    return DEFAULT_KNOWLEDGE_ROOT;\n  }\n  if (typeof knowledge !== \"string\" || knowledge.length === 0) {\n    throw new ManifestValidationError(\n      \"manifest.knowledge must be true or a knowledge/*.md root path\",\n    );\n  }\n  if (!/^knowledge\\/.+\\.md$/.test(knowledge)) {\n    throw new ManifestValidationError(\n      \"manifest.knowledge must be true or a knowledge/*.md root path\",\n    );\n  }\n  return knowledge;\n}\n\nfunction validateManifestSecrets(secrets: unknown): void {\n  if (secrets === null || typeof secrets !== \"object\" || Array.isArray(secrets)) {\n    throw new ManifestValidationError(\"manifest.secrets must be an object\");\n  }\n\n  for (const [name, spec] of Object.entries(secrets)) {\n    if (!SECRET_NAME_RE.test(name)) {\n      throw new ManifestValidationError(\n        `manifest.secrets.${name} must match ${SECRET_NAME_RE.source}`,\n      );\n    }\n    try {\n      resolveSecretPath(\n        secretNameFromSpec(name, spec as ManifestSecretActions),\n        { scope: secretScopeFromSpec(spec as ManifestSecretActions) },\n      );\n    } catch (error) {\n      throw new ManifestValidationError(\n        `manifest.secrets.${name}: ${error instanceof Error ? error.message : String(error)}`,\n      );\n    }\n    const actions = secretActionsFromSpec(name, spec as ManifestSecretActions);\n    if (actions.length === 0) {\n      throw new ManifestValidationError(\n        `manifest.secrets.${name} actions must be non-empty`,\n      );\n    }\n    for (const action of actions) {\n      if (typeof action !== \"string\" || action.length === 0) {\n        throw new ManifestValidationError(\n          `manifest.secrets.${name} actions must be non-empty strings`,\n        );\n      }\n    }\n    if (\n      spec !== null &&\n      typeof spec === \"object\" &&\n      !Array.isArray(spec) &&\n      (spec as { expiry?: unknown }).expiry !== undefined\n    ) {\n      parseExpiry((spec as { expiry: string }).expiry);\n    }\n  }\n}\n\nfunction validatePermissionEntry(p: unknown, path: string): void {\n  if (p === null || typeof p !== \"object\") {\n    throw new ManifestValidationError(`${path} must be an object`);\n  }\n  const entry = p as PermissionEntry;\n  if (typeof entry.service !== \"string\" || entry.service.length === 0) {\n    throw new ManifestValidationError(`${path}.service is required`);\n  }\n  if (\n    entry.space !== undefined &&\n    (typeof entry.space !== \"string\" || entry.space.length === 0)\n  ) {\n    throw new ManifestValidationError(\n      `${path}.space must be a non-empty string`,\n    );\n  }\n  if (typeof entry.path !== \"string\") {\n    throw new ManifestValidationError(\n      `${path}.path is required (use \"\" or \"/\" for root)`,\n    );\n  }\n  if (!Array.isArray(entry.actions) || entry.actions.length === 0) {\n    throw new ManifestValidationError(\n      `${path}.actions must be a non-empty array`,\n    );\n  }\n  for (const action of entry.actions) {\n    if (typeof action !== \"string\" || action.length === 0) {\n      throw new ManifestValidationError(\n        `${path}.actions must contain non-empty strings`,\n      );\n    }\n    if (entry.service === VAULT_PERMISSION_SERVICE) {\n      vaultActionExpansion(action);\n    }\n  }\n  if (entry.caveats !== undefined &&\n    (!Array.isArray(entry.caveats) || entry.caveats.some((caveat) =>\n      caveat === null || typeof caveat !== \"object\" || Array.isArray(caveat)\n    ))\n  ) {\n    throw new ManifestValidationError(`${path}.caveats must be an array of objects`);\n  }\n  if (entry.expiry !== undefined) {\n    parseExpiry(entry.expiry);\n  }\n}\n\n/**\n * Normalize a `defaults` value: lowercase + trim, then match against known\n * tiers. Unknown string values silently fall back to `true` (standard).\n * Boolean values pass through.\n */\nexport function normalizeDefaults(\n  value: Manifest[\"defaults\"] | undefined,\n): ManifestDefaults {\n  if (value === undefined) {\n    return DEFAULT_DEFAULTS;\n  }\n  if (typeof value === \"boolean\") {\n    return value;\n  }\n  if (typeof value !== \"string\") {\n    // Spec says unknown values silently fall back to `true`.\n    return true;\n  }\n  const normalized = value.trim().toLowerCase();\n  if (normalized === \"admin\" || normalized === \"all\") {\n    return normalized;\n  }\n  // Anything else, including \"true\"/\"false\"/\"standard\"/garbage, falls back\n  // to the standard tier per spec.\n  return true;\n}\n\n/**\n * Return the default permission entries for the given tier. Entries are\n * deep-cloned so callers can mutate them without affecting the constants.\n */\nfunction defaultEntriesForTier(tier: ManifestDefaults): PermissionEntry[] {\n  if (tier === false) {\n    return [];\n  }\n  const source =\n    tier === \"admin\"\n      ? DEFAULT_ADMIN_ENTRIES\n      : tier === \"all\"\n        ? DEFAULT_ALL_ENTRIES\n        : DEFAULT_STANDARD_ENTRIES;\n  return source.map((e) => ({\n    service: e.service,\n    space: e.space,\n    path: e.path,\n    actions: [...e.actions],\n    ...(e.skipPrefix !== undefined ? { skipPrefix: e.skipPrefix } : {}),\n  }));\n}\n\n/**\n * Resolve a raw manifest into a {@link ResolvedCapabilities} object: expand\n * shortform actions, apply the prefix, merge defaults, and compute effective\n * expiries. Pure function — does no I/O.\n *\n * Resolution semantics (spec):\n * - `prefix` defaults to `app_id`; set to `\"\"` to disable prefix application entirely.\n * - `space` defaults to `applications`; per-permission `space` overrides it.\n * - `defaults` defaults to `true` (standard tier); unknown string values fall back to `true`.\n * - Per-entry expiry overrides per-delegation overrides manifest > `DEFAULT_EXPIRY`.\n * - Default entries use `skipPrefix: false` so they inherit the manifest prefix.\n */\nexport function resolveManifest(input: Manifest): ResolvedCapabilities {\n  const manifest = validateManifest(input);\n\n  const prefix =\n    manifest.prefix !== undefined ? manifest.prefix : manifest.app_id;\n  const space = manifest.space ?? DEFAULT_MANIFEST_SPACE;\n  const expiryMs = parseExpiry(manifest.expiry ?? DEFAULT_EXPIRY);\n  const includePublicSpace = manifest.includePublicSpace ?? true;\n  const tier = normalizeDefaults(manifest.defaults);\n\n  const defaultEntries = defaultEntriesForTier(tier);\n  const explicitEntries = manifest.permissions ?? [];\n  const secretEntries = secretEntriesForManifest(manifest.secrets);\n\n  // Merge order: defaults first, then explicit entries, so explicit entries\n  // for the same (service, space, path) tuple override defaults.\n  const allEntries: PermissionEntry[] = [\n    ...defaultEntries,\n    ...explicitEntries,\n    ...secretEntries,\n  ];\n\n  const resources: ResourceCapability[] = withCapabilitiesReadForSpaces(\n    allEntries.flatMap((entry) => resolveEntry(entry, prefix, expiryMs, space)),\n  );\n\n  const additionalDelegates: ResolvedDelegate[] =\n    manifest.did === undefined\n      ? []\n      : [\n          {\n            did: manifest.did,\n            name: manifest.name,\n            expiryMs,\n            permissions: resources.map(cloneResourceCapability),\n          },\n        ];\n\n  return {\n    app_id: manifest.app_id,\n    ...(manifest.did !== undefined ? { did: manifest.did } : {}),\n    space,\n    resources,\n    expiryMs,\n    includePublicSpace,\n    additionalDelegates,\n  };\n}\n\nfunction normalizeSecretActions(actions: readonly string[]): string[] {\n  const out: string[] = [];\n  const seen = new Set<string>();\n  const add = (action: string) => {\n    if (!seen.has(action)) {\n      out.push(action);\n      seen.add(action);\n    }\n  };\n\n  for (const action of actions) {\n    if (action === \"read\") {\n      add(\"get\");\n      continue;\n    }\n    if (action === \"write\") {\n      add(\"put\");\n      continue;\n    }\n    if (action === \"delete\") {\n      add(\"del\");\n      continue;\n    }\n    if (\n      action === \"get\" ||\n      action === \"put\" ||\n      action === \"del\" ||\n      action === \"list\" ||\n      action === \"metadata\"\n    ) {\n      add(action);\n      continue;\n    }\n    if (\n      action === \"tinycloud.kv/get\" ||\n      action === \"tinycloud.kv/put\" ||\n      action === \"tinycloud.kv/del\" ||\n      action === \"tinycloud.kv/list\" ||\n      action === \"tinycloud.kv/metadata\"\n    ) {\n      add(action);\n      continue;\n    }\n    throw new ManifestValidationError(\n      `unknown secret action ${JSON.stringify(action)}; expected read, write, delete, list, or metadata`,\n    );\n  }\n\n  return out;\n}\n\nfunction secretNameFromSpec(\n  fallbackName: string,\n  spec: ManifestSecretActions,\n): string {\n  if (spec !== null && typeof spec === \"object\" && !Array.isArray(spec)) {\n    return spec.name ?? fallbackName;\n  }\n  return fallbackName;\n}\n\nfunction secretScopeFromSpec(\n  spec: ManifestSecretActions,\n): string | undefined {\n  if (spec !== null && typeof spec === \"object\" && !Array.isArray(spec)) {\n    return spec.scope;\n  }\n  return undefined;\n}\n\nfunction secretActionsFromSpec(\n  name: string,\n  spec: ManifestSecretActions,\n): string[] {\n  if (spec === true) {\n    return [\"read\"];\n  }\n  if (typeof spec === \"string\") {\n    return [spec];\n  }\n  if (Array.isArray(spec)) {\n    return spec;\n  }\n  if (spec === null || typeof spec !== \"object\") {\n    throw new ManifestValidationError(\n      `manifest.secrets.${name} must be true, a string action, an actions array, or an object`,\n    );\n  }\n  if (spec.actions === undefined) {\n    return [\"read\"];\n  }\n  if (typeof spec.actions === \"string\") {\n    return [spec.actions];\n  }\n  if (Array.isArray(spec.actions)) {\n    return spec.actions;\n  }\n  throw new ManifestValidationError(\n    `manifest.secrets.${name}.actions must be a string or array`,\n  );\n}\n\nfunction secretEntriesForManifest(\n  secrets: Manifest[\"secrets\"] | undefined,\n): PermissionEntry[] {\n  if (secrets === undefined) {\n    return [];\n  }\n\n  const entries: PermissionEntry[] = [];\n  for (const [name, spec] of Object.entries(secrets)) {\n    const actions = secretActionsFromSpec(name, spec);\n    const secretPath = resolveSecretPath(\n      secretNameFromSpec(name, spec),\n      { scope: secretScopeFromSpec(spec) },\n    );\n    const extra: { expiry?: string; description?: string } =\n      spec !== true && typeof spec === \"object\" && !Array.isArray(spec)\n        ? spec\n        : {};\n    entries.push({\n      service: VAULT_PERMISSION_SERVICE,\n      space: SECRETS_SPACE,\n      path: secretPath.vaultKey,\n      actions: normalizeSecretActions(actions),\n      skipPrefix: true,\n      ...(extra.expiry !== undefined ? { expiry: extra.expiry } : {}),\n      ...(extra.description !== undefined\n        ? { description: extra.description }\n        : {}),\n    });\n  }\n  return entries;\n}\n\n/**\n * Expand a single permission entry into a {@link ResourceCapability}:\n * apply the prefix to the path and expand short actions into full URNs.\n */\nfunction resolveEntry(\n  entry: PermissionEntry,\n  prefix: string,\n  _inheritedExpiryMs: number,\n  inheritedSpace: string,\n): ResourceCapability[] {\n  // Encryption permissions reference a networkId URN as their resource\n  // — the manifest prefix is meaningless against a top-level\n  // owner-scoped resource and would corrupt the URN. Always skip.\n  const skipPrefixForEntry =\n    entry.skipPrefix === true ||\n    entry.service === ENCRYPTION_PERMISSION_SERVICE;\n  const resolvedPath = applyPrefix(prefix, entry.path, skipPrefixForEntry);\n  const entryExpiryMs =\n    entry.expiry !== undefined ? parseExpiry(entry.expiry) : undefined;\n  return expandPermissionEntry({\n    ...entry,\n    space: entry.space ?? inheritedSpace,\n    path: resolvedPath,\n    skipPrefix: true,\n  }).map((expanded) => ({\n    service: expanded.service,\n    space: expanded.space ?? inheritedSpace,\n    path: expanded.path,\n    actions: expanded.actions,\n    // Only populate `expiryMs` when the entry had its own expiry override.\n    // When absent, callers use the parent (delegation or manifest) expiry\n    // which is carried on ResolvedDelegate.expiryMs / ResolvedCapabilities.expiryMs.\n    ...(entryExpiryMs !== undefined ? { expiryMs: entryExpiryMs } : {}),\n    ...(entry.description !== undefined\n      ? { description: entry.description }\n      : {}),\n  }));\n}\n\nfunction expandVaultPermissionEntry(entry: PermissionEntry): PermissionEntry[] {\n  const byBase = new Map<VaultKVBase, string[]>();\n\n  for (const action of entry.actions) {\n    const expansion = vaultActionExpansion(action);\n    for (const base of expansion.bases) {\n      const actions = byBase.get(base) ?? [];\n      if (!actions.includes(expansion.action)) {\n        actions.push(expansion.action);\n      }\n      byBase.set(base, actions);\n    }\n  }\n\n  return [...byBase.entries()].map(([base, actions]) => ({\n    ...entry,\n    service: \"tinycloud.kv\",\n    path: vaultKVPath(base, entry.path),\n    actions,\n    skipPrefix: true,\n  }));\n}\n\nfunction vaultActionExpansion(action: string): VaultActionExpansion {\n  const normalized = normalizeVaultAction(action);\n  if (normalized === \"read\" || normalized === \"get\") {\n    return { bases: [\"vault\"], action: \"tinycloud.kv/get\" };\n  }\n  if (normalized === \"write\" || normalized === \"put\") {\n    return { bases: [\"vault\"], action: \"tinycloud.kv/put\" };\n  }\n  if (normalized === \"delete\" || normalized === \"del\") {\n    return { bases: [\"vault\"], action: \"tinycloud.kv/del\" };\n  }\n  if (normalized === \"list\") {\n    return { bases: [\"vault\"], action: \"tinycloud.kv/list\" };\n  }\n  if (normalized === \"head\") {\n    return { bases: [\"vault\"], action: \"tinycloud.kv/get\" };\n  }\n  if (normalized === \"metadata\") {\n    return { bases: [\"vault\"], action: \"tinycloud.kv/metadata\" };\n  }\n\n  throw new ManifestValidationError(\n    `unknown vault action ${JSON.stringify(action)}; expected read, write, delete, get, put, del, list, head, or metadata`,\n  );\n}\n\nfunction normalizeVaultAction(action: string): string {\n  if (action.startsWith(`${VAULT_PERMISSION_SERVICE}/`)) {\n    return action.slice(`${VAULT_PERMISSION_SERVICE}/`.length);\n  }\n  if (action.startsWith(\"tinycloud.kv/\")) {\n    return action.slice(\"tinycloud.kv/\".length);\n  }\n  if (action.includes(\"/\")) {\n    throw new ManifestValidationError(\n      `unknown vault action ${JSON.stringify(action)}; expected a tinycloud.vault or tinycloud.kv action`,\n    );\n  }\n  return action;\n}\n\nfunction vaultKVPath(base: VaultKVBase, path: string): string {\n  const normalized = path.startsWith(\"/\") ? path.slice(1) : path;\n  return `${base}/${normalized}`;\n}\n\nfunction cloneResourceCapability(\n  entry: ResourceCapability,\n): ResourceCapability {\n  return {\n    service: entry.service,\n    space: entry.space,\n    path: entry.path,\n    actions: [...entry.actions],\n    ...(entry.expiryMs !== undefined ? { expiryMs: entry.expiryMs } : {}),\n    ...(entry.description !== undefined\n      ? { description: entry.description }\n      : {}),\n  };\n}\n\nfunction clonePermissionEntry(entry: PermissionEntry): PermissionEntry {\n  return {\n    service: entry.service,\n    ...(entry.space !== undefined ? { space: entry.space } : {}),\n    path: entry.path,\n    actions: [...entry.actions],\n    ...(entry.caveats !== undefined\n      ? { caveats: JSON.parse(JSON.stringify(entry.caveats)) as Record<string, unknown>[] }\n      : {}),\n    ...(entry.skipPrefix !== undefined ? { skipPrefix: entry.skipPrefix } : {}),\n    ...(entry.expiry !== undefined ? { expiry: entry.expiry } : {}),\n    ...(entry.description !== undefined\n      ? { description: entry.description }\n      : {}),\n  };\n}\n\nfunction dedupeResources(\n  resources: readonly ResourceCapability[],\n): ResourceCapability[] {\n  const byKey = new Map<string, ResourceCapability>();\n\n  for (const resource of resources) {\n    const key = `${resource.service}\\u0000${resource.space}\\u0000${resource.path}\\u0000${resource.expiryMs ?? \"\"}`;\n    const existing = byKey.get(key);\n    if (existing === undefined) {\n      byKey.set(key, cloneResourceCapability(resource));\n      continue;\n    }\n\n    const seen = new Set(existing.actions);\n    for (const action of resource.actions) {\n      if (!seen.has(action)) {\n        existing.actions.push(action);\n        seen.add(action);\n      }\n    }\n    if (\n      existing.description === undefined &&\n      resource.description !== undefined\n    ) {\n      existing.description = resource.description;\n    }\n  }\n\n  return [...byKey.values()];\n}\n\nfunction capabilitiesReadPermission(space: string): ResourceCapability {\n  return {\n    service: \"tinycloud.capabilities\",\n    space,\n    path: \"\",\n    actions: [\"tinycloud.capabilities/read\"],\n  };\n}\n\nfunction withCapabilitiesReadForSpaces(\n  resources: readonly ResourceCapability[],\n): ResourceCapability[] {\n  if (resources.length === 0) {\n    return [];\n  }\n\n  const spaces = new Set(\n    resources\n      .filter((resource) => resource.service !== ENCRYPTION_PERMISSION_SERVICE)\n      .map((resource) => resource.space),\n  );\n  return dedupeResources([\n    ...resources,\n    ...[...spaces].map(capabilitiesReadPermission),\n  ]);\n}\n\n/**\n * Compose one or more manifests into the single capability request that should\n * be signed. Fetching manifests is intentionally out of band; callers pass the\n * already-loaded manifest objects.\n */\nexport function composeManifestRequest(\n  inputs: readonly Manifest[],\n  options: ComposeManifestOptions = {},\n): ComposedManifestRequest {\n  if (!Array.isArray(inputs) || inputs.length === 0) {\n    throw new ManifestValidationError(\n      \"composeManifestRequest requires at least one manifest\",\n    );\n  }\n\n  const includeAccountRegistryPermissions =\n    options.includeAccountRegistryPermissions ?? true;\n  const manifests = inputs.map(validateManifest);\n  const resolved = manifests.map(resolveManifest);\n  const resources = resolved.flatMap((entry) => entry.resources);\n  const delegationTargets = resolved.flatMap((entry) =>\n    entry.additionalDelegates.map((delegate) => ({\n      ...delegate,\n      permissions: dedupeResources(delegate.permissions),\n    })),\n  );\n\n  if (includeAccountRegistryPermissions) {\n    resources.push(\n      ...ACCOUNT_MANIFEST_PERMISSIONS.map((resource) => ({\n        ...resource,\n        actions: [...resource.actions],\n      })),\n    );\n  }\n  const resourcesWithImplicitCapabilities =\n    withCapabilitiesReadForSpaces(resources);\n\n  const manifestsByAppId = new Map<string, Manifest[]>();\n  for (const manifest of manifests) {\n    const current = manifestsByAppId.get(manifest.app_id);\n    if (current === undefined) {\n      manifestsByAppId.set(manifest.app_id, [manifest]);\n    } else {\n      current.push(manifest);\n    }\n  }\n\n  const registryRecords: ManifestRegistryRecord[] =\n    includeAccountRegistryPermissions\n      ? [...manifestsByAppId.entries()].map(([app_id, appManifests]) => ({\n          key: `${ACCOUNT_REGISTRY_PATH}${app_id}`,\n          app_id,\n          manifests: appManifests.map((manifest) => ({\n            ...manifest,\n            permissions: manifest.permissions?.map(clonePermissionEntry),\n          })),\n        }))\n      : [];\n\n  return {\n    manifests,\n    resources: resourcesWithImplicitCapabilities,\n    delegationTargets,\n    registryRecords,\n    expiryMs: Math.max(...resolved.map((entry) => entry.expiryMs)),\n    includePublicSpace: resolved.some((entry) => entry.includePublicSpace),\n  };\n}\n\n// ---------------------------------------------------------------------------\n// Abilities map construction (bridge to WASM prepareSession / createDelegation)\n// ---------------------------------------------------------------------------\n\n/**\n * The shape `prepareSession` and the multi-resource `createDelegation` WASM\n * export both accept:\n *\n * ```\n * { [shortService]: { [path]: [fullUrnAction, ...] } }\n * ```\n *\n * - `shortService` is the recap-level service segment (`\"kv\"`, `\"sql\"`,\n *   `\"duckdb\"`, `\"capabilities\"`, `\"hooks\"`) — not the manifest long form.\n * - `path` is the fully-resolved path (prefix already applied). An empty\n *   string means \"no path segment\" on the resource URI.\n * - Action strings are full URNs like `\"tinycloud.kv/get\"`.\n *\n * This is a single source of truth for both the session's own recap (at\n * sign-in) and the delegations it can derive (post sign-in). We re-use it\n * for both so one manifest drives both sides.\n */\nexport type AbilitiesMap = Record<string, Record<string, string[]>>;\n\n/**\n * Per-space abilities map accepted by the newer WASM session config:\n *\n * ```\n * { [spaceIdOrName]: { [shortService]: { [path]: [fullUrnAction, ...] } } }\n * ```\n */\nexport type SpaceAbilitiesMap = Record<string, AbilitiesMap>;\n\n/**\n * Convert a list of {@link ResourceCapability} entries (manifest\n * long-form service, full-URN actions) into the {@link AbilitiesMap}\n * shape the WASM layer expects.\n *\n * When multiple entries target the same `(service, path)` pair, their\n * action lists are merged and deduped. Entries whose service has no\n * short-form mapping in {@link SERVICE_LONG_TO_SHORT} are rejected with\n * a {@link ManifestValidationError} — the SDK does not silently drop\n * unknown services because the recap encoding would lose them.\n *\n * Paths are kept verbatim: this function does NOT collapse\n * `\"com.listen.app/\"` and `\"com.listen.app\"` or reinterpret empty /\n * slash strings. Callers that care about path canonicalization should\n * normalize before calling.\n */\nexport function resourceCapabilitiesToAbilitiesMap(\n  resources: readonly ResourceCapability[],\n): AbilitiesMap {\n  const out: AbilitiesMap = {};\n  for (const r of resources) {\n    const shortService = SERVICE_LONG_TO_SHORT[r.service];\n    if (shortService === undefined) {\n      throw new ManifestValidationError(\n        `unknown service '${r.service}' — no short-form mapping. Known services: ${Object.keys(SERVICE_LONG_TO_SHORT).join(\", \")}`,\n      );\n    }\n    if (out[shortService] === undefined) {\n      out[shortService] = {};\n    }\n    const pathsMap = out[shortService];\n    const existing = pathsMap[r.path];\n    if (existing === undefined) {\n      // Copy so downstream mutation can't leak back into the input.\n      pathsMap[r.path] = [...r.actions];\n    } else {\n      // Merge + dedupe while preserving first-seen order.\n      const seen = new Set(existing);\n      for (const action of r.actions) {\n        if (!seen.has(action)) {\n          existing.push(action);\n          seen.add(action);\n        }\n      }\n    }\n  }\n  return out;\n}\n\n/**\n * Group resolved capabilities by `space`, then convert each group into a WASM\n * abilities map. Short space names are left as-is here; platform layers that\n * know the wallet address and chain id turn them into full SpaceIds.\n */\nexport function resourceCapabilitiesToSpaceAbilitiesMap(\n  resources: readonly ResourceCapability[],\n): SpaceAbilitiesMap {\n  const grouped = new Map<string, ResourceCapability[]>();\n  for (const resource of resources) {\n    const entries = grouped.get(resource.space);\n    if (entries === undefined) {\n      grouped.set(resource.space, [resource]);\n    } else {\n      entries.push(resource);\n    }\n  }\n\n  const out: SpaceAbilitiesMap = {};\n  for (const [space, entries] of grouped.entries()) {\n    out[space] = resourceCapabilitiesToAbilitiesMap(entries);\n  }\n  return out;\n}\n\n/**\n * Build the {@link AbilitiesMap} that a session should be signed with,\n * given a {@link ResolvedCapabilities} (i.e. the output of\n * {@link resolveManifest}).\n *\n * The resulting map is the **union** of:\n * 1. the app's own resources (`resolved.resources`), and\n * 2. every permission declared in every `additionalDelegates[*]` entry.\n *\n * The union is what makes the manifest's delegations ergonomic: at\n * sign-in, the session key acquires recap coverage for both the app's\n * runtime needs and every downstream delegation target. Post sign-in,\n * `delegateTo(backendDID, backendPermissions)` can then issue the\n * sub-delegation via the session key (no wallet prompt) because the\n * caps are already part of the granted set.\n *\n * Duplicate `(service, path, action)` triples across resources and\n * delegations are merged and deduped — the session SIWE doesn't need\n * them repeated.\n */\nexport function manifestAbilitiesUnion(\n  resolved: ResolvedCapabilities,\n): AbilitiesMap {\n  const all: ResourceCapability[] = [...resolved.resources];\n  for (const delegate of resolved.additionalDelegates) {\n    for (const perm of delegate.permissions) {\n      all.push(perm);\n    }\n  }\n  return resourceCapabilitiesToAbilitiesMap(all);\n}\n","import { getAddress, isAddress } from \"viem\";\n\nexport type CanonicalAddress = `0x${string}`;\n\nexport interface PkhDidParts {\n  method: \"pkh\";\n  namespace: \"eip155\";\n  chainId: number;\n  address: CanonicalAddress;\n}\n\nexport interface DidEqualsOptions {\n  ignoreFragment?: boolean;\n}\n\nexport interface DidCacheKeyOptions {\n  preserveFragment?: boolean;\n}\n\nexport class IdentityParseError extends Error {\n  constructor(message: string) {\n    super(message);\n    this.name = \"IdentityParseError\";\n  }\n}\n\nconst PKH_DID_RE = /^did:pkh:eip155:(\\d+):(0x[a-fA-F0-9]{40})$/;\nconst DID_RE = /^did:[a-z0-9]+:.+$/;\n\nfunction splitDidUrl(input: string): { did: string; fragment: string } {\n  const fragmentIndex = input.indexOf(\"#\");\n  if (fragmentIndex < 0) {\n    return { did: input, fragment: \"\" };\n  }\n  return {\n    did: input.slice(0, fragmentIndex),\n    fragment: input.slice(fragmentIndex),\n  };\n}\n\nfunction assertValidChainId(chainId: number): void {\n  if (!Number.isSafeInteger(chainId) || chainId <= 0) {\n    throw new IdentityParseError(`Invalid EIP-155 chain ID: ${chainId}`);\n  }\n}\n\nexport function isEvmAddress(input: string): boolean {\n  return isAddress(input, { strict: false });\n}\n\nexport function canonicalizeAddress(address: string): CanonicalAddress {\n  if (!isEvmAddress(address)) {\n    throw new IdentityParseError(`Invalid EVM address: ${address}`);\n  }\n  return getAddress(address) as CanonicalAddress;\n}\n\nexport function addressStorageKey(address: string): CanonicalAddress {\n  return canonicalizeAddress(address).toLowerCase() as CanonicalAddress;\n}\n\nexport function pkhDid(address: string, chainId: number = 1): string {\n  assertValidChainId(chainId);\n  return `did:pkh:eip155:${chainId}:${canonicalizeAddress(address)}`;\n}\n\nexport function parsePkhDid(did: string): PkhDidParts | null {\n  const match = did.match(PKH_DID_RE);\n  if (!match) return null;\n\n  const chainId = Number(match[1]);\n  assertValidChainId(chainId);\n\n  return {\n    method: \"pkh\",\n    namespace: \"eip155\",\n    chainId,\n    address: canonicalizeAddress(match[2]),\n  };\n}\n\nexport function canonicalizeDid(did: string): string {\n  const pkh = parsePkhDid(did);\n  if (pkh) {\n    return pkhDid(pkh.address, pkh.chainId);\n  }\n  if (DID_RE.test(did)) {\n    return did;\n  }\n  throw new IdentityParseError(`Invalid DID: ${did}`);\n}\n\nexport function canonicalizeDidUrl(didUrl: string): string {\n  const { did, fragment } = splitDidUrl(didUrl);\n  return `${canonicalizeDid(did)}${fragment}`;\n}\n\nexport function principalDid(didUrl: string): string {\n  return canonicalizeDid(splitDidUrl(didUrl).did);\n}\n\nexport function didEquals(a: string, b: string, options: DidEqualsOptions = {}): boolean {\n  const canonicalize = options.ignoreFragment ? principalDid : canonicalizeDidUrl;\n  return canonicalize(a) === canonicalize(b);\n}\n\nexport function principalDidEquals(a: string, b: string): boolean {\n  return didEquals(a, b, { ignoreFragment: true });\n}\n\nexport function didCacheKey(input: string, options: DidCacheKeyOptions = {}): string {\n  const { did, fragment } = splitDidUrl(input);\n  const pkh = parsePkhDid(did);\n  const base = pkh\n    ? `did:pkh:eip155:${pkh.chainId}:${addressStorageKey(pkh.address)}`\n    : canonicalizeDid(did);\n\n  return options.preserveFragment ? `${base}${fragment}` : base;\n}\n\nexport function makePkhSpaceId(\n  address: string,\n  chainId: number,\n  name: string,\n): string {\n  assertValidChainId(chainId);\n  if (!name) {\n    throw new IdentityParseError(\"Space name cannot be empty\");\n  }\n  return `tinycloud:pkh:eip155:${chainId}:${canonicalizeAddress(address)}:${name}`;\n}\n","/**\n * Capability subset checking and recap parsing.\n *\n * This module powers the capability-chain delegation flow. The key decision\n * a `delegateTo` call has to make is: \"are the requested capabilities a\n * subset of what the current session already grants?\"\n *\n * - If yes → issue the delegation via the session-key UCAN path (no wallet prompt).\n * - If no → raise {@link PermissionNotInManifestError} so the caller can\n *   trigger an escalation flow via `requestPermissions`.\n *\n * Canonical spec: `.claude/specs/capability-chain.md`.\n *\n * @packageDocumentation\n */\n\nimport {\n  DEFAULT_MANIFEST_SPACE,\n  type PermissionEntry,\n  SERVICE_SHORT_TO_LONG,\n  expandActionShortNames,\n} from \"./manifest\";\n\n// ---------------------------------------------------------------------------\n// Errors\n// ---------------------------------------------------------------------------\n\n/**\n * Thrown when a `delegateTo` call requests capabilities that the current\n * session does not already grant. The caller can catch this and trigger\n * `requestPermissions(missing)` to show an escalation modal.\n */\nexport class PermissionNotInManifestError extends Error {\n  public readonly missing: PermissionEntry[];\n  public readonly granted: PermissionEntry[];\n\n  constructor(missing: PermissionEntry[], granted: PermissionEntry[]) {\n    super(\n      `Requested capabilities exceed current session. Missing ${missing.length} entries.`\n    );\n    this.name = \"PermissionNotInManifestError\";\n    this.missing = missing;\n    this.granted = granted;\n  }\n}\n\n/**\n * Thrown when the current session has expired (or will expire within the\n * safety margin). The caller should trigger a fresh sign-in.\n */\nexport class SessionExpiredError extends Error {\n  public readonly expiredAt: Date;\n\n  constructor(expiredAt: Date) {\n    super(`Session expired at ${expiredAt.toISOString()}`);\n    this.name = \"SessionExpiredError\";\n    this.expiredAt = expiredAt;\n  }\n}\n\n/**\n * Thrown when the installed WASM delegation boundary cannot encode every\n * constrained ReCap branch in a requested child delegation.\n */\nexport class CaveatedDelegationUnsupportedError extends Error {\n  /** Stable machine-readable error code for fail-closed caveated delegation. */\n  code = \"CAVEATED_DELEGATION_UNSUPPORTED\" as const;\n  /** Requested entries whose constrained ReCap branches cannot be preserved. */\n  entries: PermissionEntry[];\n\n  constructor(entries: PermissionEntry[]) {\n    super(\n      \"Cannot create a caveated delegation because this WASM delegation boundary cannot preserve every ReCap caveat branch exactly.\"\n    );\n    this.name = \"CaveatedDelegationUnsupportedError\";\n    this.entries = entries.map(cloneEntry);\n  }\n}\n\n// ---------------------------------------------------------------------------\n// Space normalization\n// ---------------------------------------------------------------------------\n\n/**\n * Normalize a space identifier to its short-name form.\n *\n * Recap resource URIs in a signed SIWE encode the space as a full URI of the\n * form `tinycloud:pkh:eip155:{chainId}:{address}:{name}` (e.g.\n * `tinycloud:pkh:eip155:1:0xd559...:default`). Manifest permissions and\n * backend-advertised permissions use the short `{name}` form (e.g.\n * `\"default\"`).\n *\n * Strict string comparison between these two forms would always fail, so we\n * normalize both sides to the short name before comparing. The trailing\n * segment after the last `:` in a `tinycloud:` URI is the space name.\n *\n * Short names (`\"default\"`, `\"work-space\"`) are returned unchanged.\n * Any non-`tinycloud:` string is returned unchanged. A malformed URI with a\n * trailing colon is returned unchanged (so the check degrades to a strict\n * mismatch rather than collapsing to an empty string).\n *\n * @internal\n */\nexport function normalizeSpace(space: string): string {\n  if (!space.startsWith(\"tinycloud:\")) {\n    return space;\n  }\n  const lastColon = space.lastIndexOf(\":\");\n  if (lastColon === -1 || lastColon === space.length - 1) {\n    return space;\n  }\n  return space.slice(lastColon + 1);\n}\n\n// ---------------------------------------------------------------------------\n// Subset check\n// ---------------------------------------------------------------------------\n\nexport interface SubsetCheckResult {\n  /** True when every requested entry is covered by a granted entry. */\n  subset: boolean;\n  /** Entries the granted set does not cover (empty when `subset` is true). */\n  missing: PermissionEntry[];\n}\n\n/**\n * Check whether `requested` is a strict subset of `granted`.\n *\n * Matching rules for each `requested[i]`:\n * - `service` matches exactly.\n * - `space` matches exactly.\n * - Path containment:\n *     - If `granted.path` ends with `/`, it covers any `requested.path` that\n *       starts with `granted.path`.\n *     - Otherwise, the paths must match exactly.\n * - Action containment: every requested URN must be matched exactly or by a\n *   service-scoped wildcard such as `tinycloud.kv/*`.\n *\n * Grant entries with the same service, space, path coverage, and caveats are\n * considered together. This matters because ReCap parsers may return one\n * entry per action even when the original manifest grouped those actions.\n * Any `requested` entry whose actions are not collectively covered is added\n * to `missing` and the overall result is non-subset.\n *\n * Both sides are expected to be in the canonical long-form shape (service\n * starts with `tinycloud.`, actions are full URNs). Use {@link parseRecapCapabilities}\n * or `expandActionShortNames` to normalize inputs first.\n */\nexport function isCapabilitySubset(\n  requested: readonly PermissionEntry[],\n  granted: readonly PermissionEntry[]\n): SubsetCheckResult {\n  const missing: PermissionEntry[] = [];\n\n  for (const req of requested) {\n    const matchingScope = granted.filter((entry) =>\n      canonicalizeEntryScopeMatches(req, entry)\n    );\n    const requestedActions = expandActionShortNames(\n      req.service,\n      req.actions\n    );\n    const grantedActions = matchingScope.flatMap((entry) =>\n      expandActionShortNames(entry.service, entry.actions)\n    );\n    const covered = requestedActions.every((requestedAction) =>\n      grantedActions.some((grantedAction) =>\n        actionContains(grantedAction, requestedAction)\n      )\n    );\n    if (!covered) {\n      missing.push(cloneEntry(req));\n    }\n  }\n\n  return { subset: missing.length === 0, missing };\n}\n\n/**\n * Returns true when `granted` fully covers `requested` — same service, same\n * space, path containment per spec, and action set containment.\n */\nfunction canonicalizeEntryScopeMatches(\n  requested: PermissionEntry,\n  granted: PermissionEntry\n): boolean {\n  if (requested.service !== granted.service) {\n    return false;\n  }\n  // Normalize both sides so callers passing short names (`\"default\"`) match\n  // recap-parsed full URIs (`\"tinycloud:pkh:eip155:1:0xd559...:default\"`) and\n  // vice versa. Idempotent for short names.\n  if (\n    normalizeSpace(requested.space ?? DEFAULT_MANIFEST_SPACE) !==\n    normalizeSpace(granted.space ?? DEFAULT_MANIFEST_SPACE)\n  ) {\n    return false;\n  }\n  if (!pathContains(granted.path, requested.path)) {\n    return false;\n  }\n  // There is no safe general partial ordering for arbitrary ReCap caveat\n  // objects. A caveated authority therefore only covers the same caveat set;\n  // treating it as uncaveated would authorize a broader child delegation.\n  if (!recapCaveatsEqual(requested.caveats, granted.caveats)) {\n    return false;\n  }\n  return true;\n}\n\n/**\n * Compare ReCap caveat branch sets without losing signed branch structure.\n *\n * ReCap represents an unconstrained ability as `[{}]`, while SDK callers can\n * represent that same authority as `undefined` or `[]`. Those three forms are\n * equivalent. Every other branch, including an unconstrained branch mixed\n * with a constrained one, remains part of the canonical comparison.\n */\nexport function recapCaveatsEqual(\n  left: readonly Record<string, unknown>[] | undefined,\n  right: readonly Record<string, unknown>[] | undefined,\n): boolean {\n  return canonicalizeRecapCaveats(left) === canonicalizeRecapCaveats(right);\n}\n\n/**\n * Canonicalize a ReCap caveat branch set for exact equality checks.\n *\n * Object keys and branch order do not affect equality. A lone unconstrained\n * branch is normalized to the SDK's empty-caveat representation, but an\n * unconstrained branch in a mixed set is deliberately retained.\n */\nexport function canonicalizeRecapCaveats(\n  caveats: readonly Record<string, unknown>[] | undefined,\n): string {\n  const canonicalize = (value: unknown): string => {\n    if (value === null || typeof value === \"boolean\" || typeof value === \"string\") {\n      return JSON.stringify(value);\n    }\n    if (typeof value === \"number\") {\n      if (Number.isFinite(value)) return JSON.stringify(value);\n      throw new Error(\"ReCap caveats must contain only JSON values.\");\n    }\n    if (Array.isArray(value)) return `[${value.map(canonicalize).join(\",\")}]`;\n    if (typeof value === \"object\") {\n      const object = value as Record<string, unknown>;\n      const prototype = Object.getPrototypeOf(object);\n      if (prototype !== Object.prototype && prototype !== null) {\n        throw new Error(\"ReCap caveats must contain only JSON values.\");\n      }\n      return `{${Object.keys(object).sort().map((key) =>\n        `${JSON.stringify(key)}:${canonicalize(object[key])}`,\n      ).join(\",\")}}`;\n    }\n    throw new Error(\"ReCap caveats must contain only JSON values.\");\n  };\n  const branches = (caveats ?? []).map(canonicalize).sort();\n  if (branches.length === 0 || (branches.length === 1 && branches[0] === \"{}\")) {\n    return \"[]\";\n  }\n  return `[${branches.join(\",\")}]`;\n}\n\n/** Return whether a granted action pattern covers one requested action. */\nexport function actionContains(grantedAction: string, requestedAction: string): boolean {\n  if (grantedAction === \"*\" || grantedAction === requestedAction) return true;\n  if (!grantedAction.endsWith(\"/*\")) return false;\n  const service = grantedAction.slice(0, -2);\n  return requestedAction === service || requestedAction.startsWith(`${service}/`);\n}\n\n/**\n * Path containment per spec:\n * - `granted.path` ends with `/` → prefix match (requested starts with granted)\n * - otherwise → exact string match\n *\n * The empty string is treated as \"no path constraint\" and matches anything.\n * The single-character `\"/\"` also matches anything (it is a trailing-slash\n * prefix of zero-length).\n */\nfunction pathContains(grantedPath: string, requestedPath: string): boolean {\n  if (grantedPath === \"\" || grantedPath === \"/\") {\n    return true;\n  }\n  if (grantedPath.endsWith(\"/\")) {\n    return requestedPath.startsWith(grantedPath);\n  }\n  return requestedPath === grantedPath;\n}\n\nfunction cloneEntry(entry: PermissionEntry): PermissionEntry {\n  return {\n    service: entry.service,\n    ...(entry.space !== undefined ? { space: entry.space } : {}),\n    path: entry.path,\n    actions: [...entry.actions],\n    ...(entry.caveats !== undefined\n      ? { caveats: JSON.parse(JSON.stringify(entry.caveats)) as Record<string, unknown>[] }\n      : {}),\n    ...(entry.skipPrefix !== undefined ? { skipPrefix: entry.skipPrefix } : {}),\n    ...(entry.expiry !== undefined ? { expiry: entry.expiry } : {}),\n  };\n}\n\n// ---------------------------------------------------------------------------\n// Recap parsing (WASM wrapper)\n// ---------------------------------------------------------------------------\n\n/**\n * The raw shape returned from the WASM `parseRecapFromSiwe` export. The\n * Rust layer encodes the service in the short form (e.g. `\"kv\"`) because\n * that is what the SIWE recap resource URI actually contains. We normalize\n * to the manifest long form (`\"tinycloud.kv\"`) in {@link parseRecapCapabilities}.\n *\n * @internal\n */\nexport interface WasmRecapEntry {\n  service: string;\n  space: string;\n  path: string;\n  actions: string[];\n  /** Exact ReCap caveats shared by every action in this entry. */\n  caveats?: Record<string, unknown>[];\n}\n\n/**\n * Signature of the WASM `parseRecapFromSiwe` export. Accepts the signed\n * SIWE message string and returns an array of raw recap entries. Throws if\n * the SIWE is malformed or the recap statement has been tampered.\n *\n * Exposed as an interface so the SDK can inject the web or node binding\n * without `capabilities.ts` needing to know which.\n */\nexport type ParseRecapFromSiwe = (siweString: string) => WasmRecapEntry[];\n\n/**\n * Parse a signed SIWE message into an array of {@link PermissionEntry}\n * objects in the canonical long-form manifest shape.\n *\n * This is a thin wrapper around the WASM `parseRecapFromSiwe` export that:\n * 1. Normalizes short-form services (`\"kv\"`) to long-form (`\"tinycloud.kv\"`).\n * 2. Returns entries in a deterministic order (sorted by space, then service,\n *    then path) so downstream equality checks are stable.\n *\n * Returns an empty array when the SIWE has no recap resource (plain auth\n * SIWE); this matches the WASM function's behavior and the spec.\n *\n * @param parseWasm The WASM `parseRecapFromSiwe` binding.\n * @param siwe The signed SIWE message string (exactly what `session.siwe` stores).\n */\nexport function parseRecapCapabilities(\n  parseWasm: ParseRecapFromSiwe,\n  siwe: string\n): PermissionEntry[] {\n  const raw = parseWasm(siwe);\n  if (!Array.isArray(raw)) {\n    throw new Error(\n      \"parseRecapFromSiwe returned a non-array value; wasm binding may be out of sync\"\n    );\n  }\n  const normalized: PermissionEntry[] = raw.map((entry) => {\n    const longService =\n      SERVICE_SHORT_TO_LONG[entry.service] ??\n      // Unknown short names pass through. If the recap already contained a\n      // long-form service (e.g. a future tinycloud-node version emits long\n      // form directly), don't double-prefix.\n      (entry.service.startsWith(\"tinycloud.\")\n        ? entry.service\n        : `tinycloud.${entry.service}`);\n    return {\n      service: longService,\n      // The Rust layer emits the space as a full `tinycloud:pkh:...:name`\n      // URI (the recap target URI). Normalize to the short name so the\n      // returned entries match the shape manifests use.\n      space: normalizeSpace(entry.space),\n      path: entry.path,\n      actions: [...entry.actions],\n      ...(entry.caveats === undefined\n        ? {}\n        : { caveats: JSON.parse(JSON.stringify(entry.caveats)) as Record<string, unknown>[] }),\n    };\n  });\n\n  // Sort for determinism (callers do equality checks on arrays of entries\n  // in tests; deterministic ordering keeps those stable).\n  normalized.sort((a, b) => {\n    const aSpace = a.space ?? DEFAULT_MANIFEST_SPACE;\n    const bSpace = b.space ?? DEFAULT_MANIFEST_SPACE;\n    if (aSpace !== bSpace) return aSpace < bSpace ? -1 : 1;\n    if (a.service !== b.service) return a.service < b.service ? -1 : 1;\n    if (a.path !== b.path) return a.path < b.path ? -1 : 1;\n    return 0;\n  });\n\n  return normalized;\n}\n","import { baseX } from './base.js'\n\nexport const base10 = baseX({\n  prefix: '9',\n  name: 'base10',\n  alphabet: '0123456789'\n})\n","export const empty = new Uint8Array(0)\n\nexport function toHex (d: Uint8Array): string {\n  return d.reduce((hex, byte) => hex + byte.toString(16).padStart(2, '0'), '')\n}\n\nexport function fromHex (hex: string): Uint8Array {\n  const hexes = hex.match(/../g)\n  return hexes != null ? new Uint8Array(hexes.map(b => parseInt(b, 16))) : empty\n}\n\nexport function equals (aa: Uint8Array, bb: Uint8Array): boolean {\n  if (aa === bb) { return true }\n  if (aa.byteLength !== bb.byteLength) {\n    return false\n  }\n\n  for (let ii = 0; ii < aa.byteLength; ii++) {\n    if (aa[ii] !== bb[ii]) {\n      return false\n    }\n  }\n\n  return true\n}\n\nexport function coerce (o: ArrayBufferView | ArrayBuffer | Uint8Array): Uint8Array {\n  if (o instanceof Uint8Array && o.constructor.name === 'Uint8Array') { return o }\n  if (o instanceof ArrayBuffer) { return new Uint8Array(o) }\n  if (ArrayBuffer.isView(o)) {\n    return new Uint8Array(o.buffer, o.byteOffset, o.byteLength)\n  }\n  throw new Error('Unknown type, must be binary type')\n}\n\nexport function isBinary (o: unknown): o is ArrayBuffer | ArrayBufferView {\n  return o instanceof ArrayBuffer || ArrayBuffer.isView(o)\n}\n\nexport function fromString (str: string): Uint8Array {\n  return new TextEncoder().encode(str)\n}\n\nexport function toString (b: Uint8Array): string {\n  return new TextDecoder().decode(b)\n}\n","/* eslint-disable */\n// base-x encoding / decoding\n// Copyright (c) 2018 base-x contributors\n// Copyright (c) 2014-2018 The Bitcoin Core developers (base58.cpp)\n// Distributed under the MIT software license, see the accompanying\n// file LICENSE or http://www.opensource.org/licenses/mit-license.php.\n/**\n * @param {string} ALPHABET\n * @param {any} name\n */\nfunction base (ALPHABET, name) {\n  if (ALPHABET.length >= 255) { throw new TypeError('Alphabet too long') }\n  var BASE_MAP = new Uint8Array(256);\n  for (var j = 0; j < BASE_MAP.length; j++) {\n    BASE_MAP[j] = 255;\n  }\n  for (var i = 0; i < ALPHABET.length; i++) {\n    var x = ALPHABET.charAt(i);\n    var xc = x.charCodeAt(0);\n    if (BASE_MAP[xc] !== 255) { throw new TypeError(x + ' is ambiguous') }\n    BASE_MAP[xc] = i;\n  }\n  var BASE = ALPHABET.length;\n  var LEADER = ALPHABET.charAt(0);\n  var FACTOR = Math.log(BASE) / Math.log(256); // log(BASE) / log(256), rounded up\n  var iFACTOR = Math.log(256) / Math.log(BASE); // log(256) / log(BASE), rounded up\n  /**\n   * @param {any[] | Iterable<number>} source\n   */\n  function encode (source) {\n    // @ts-ignore\n    if (source instanceof Uint8Array) ; else if (ArrayBuffer.isView(source)) {\n      source = new Uint8Array(source.buffer, source.byteOffset, source.byteLength);\n    } else if (Array.isArray(source)) {\n      source = Uint8Array.from(source);\n    }\n    if (!(source instanceof Uint8Array)) { throw new TypeError('Expected Uint8Array') }\n    if (source.length === 0) { return '' }\n        // Skip & count leading zeroes.\n    var zeroes = 0;\n    var length = 0;\n    var pbegin = 0;\n    var pend = source.length;\n    while (pbegin !== pend && source[pbegin] === 0) {\n      pbegin++;\n      zeroes++;\n    }\n        // Allocate enough space in big-endian base58 representation.\n    var size = ((pend - pbegin) * iFACTOR + 1) >>> 0;\n    var b58 = new Uint8Array(size);\n        // Process the bytes.\n    while (pbegin !== pend) {\n      var carry = source[pbegin];\n            // Apply \"b58 = b58 * 256 + ch\".\n      var i = 0;\n      for (var it1 = size - 1; (carry !== 0 || i < length) && (it1 !== -1); it1--, i++) {\n        carry += (256 * b58[it1]) >>> 0;\n        b58[it1] = (carry % BASE) >>> 0;\n        carry = (carry / BASE) >>> 0;\n      }\n      if (carry !== 0) { throw new Error('Non-zero carry') }\n      length = i;\n      pbegin++;\n    }\n        // Skip leading zeroes in base58 result.\n    var it2 = size - length;\n    while (it2 !== size && b58[it2] === 0) {\n      it2++;\n    }\n        // Translate the result into a string.\n    var str = LEADER.repeat(zeroes);\n    for (; it2 < size; ++it2) { str += ALPHABET.charAt(b58[it2]); }\n    return str\n  }\n  /**\n   * @param {string | string[]} source\n   */\n  function decodeUnsafe (source) {\n    if (typeof source !== 'string') { throw new TypeError('Expected String') }\n    if (source.length === 0) { return new Uint8Array() }\n    var psz = 0;\n        // Skip leading spaces.\n    if (source[psz] === ' ') { return }\n        // Skip and count leading '1's.\n    var zeroes = 0;\n    var length = 0;\n    while (source[psz] === LEADER) {\n      zeroes++;\n      psz++;\n    }\n        // Allocate enough space in big-endian base256 representation.\n    var size = (((source.length - psz) * FACTOR) + 1) >>> 0; // log(58) / log(256), rounded up.\n    var b256 = new Uint8Array(size);\n        // Process the characters.\n    while (source[psz]) {\n            // Decode character\n      var carry = BASE_MAP[source.charCodeAt(psz)];\n            // Invalid character\n      if (carry === 255) { return }\n      var i = 0;\n      for (var it3 = size - 1; (carry !== 0 || i < length) && (it3 !== -1); it3--, i++) {\n        carry += (BASE * b256[it3]) >>> 0;\n        b256[it3] = (carry % 256) >>> 0;\n        carry = (carry / 256) >>> 0;\n      }\n      if (carry !== 0) { throw new Error('Non-zero carry') }\n      length = i;\n      psz++;\n    }\n        // Skip trailing spaces.\n    if (source[psz] === ' ') { return }\n        // Skip leading zeroes in b256.\n    var it4 = size - length;\n    while (it4 !== size && b256[it4] === 0) {\n      it4++;\n    }\n    var vch = new Uint8Array(zeroes + (size - it4));\n    var j = zeroes;\n    while (it4 !== size) {\n      vch[j++] = b256[it4++];\n    }\n    return vch\n  }\n  /**\n   * @param {string | string[]} string\n   */\n  function decode (string) {\n    var buffer = decodeUnsafe(string);\n    if (buffer) { return buffer }\n    throw new Error(`Non-${name} character`)\n  }\n  return {\n    encode: encode,\n    decodeUnsafe: decodeUnsafe,\n    decode: decode\n  }\n}\nvar src = base;\n\nvar _brrp__multiformats_scope_baseX = src;\n\nexport default _brrp__multiformats_scope_baseX;\n","import { coerce } from '../bytes.js'\nimport basex from '../vendor/base-x.js'\nimport type { BaseCodec, BaseDecoder, BaseEncoder, CombobaseDecoder, Multibase, MultibaseCodec, MultibaseDecoder, MultibaseEncoder, UnibaseDecoder } from './interface.js'\n\ninterface EncodeFn { (bytes: Uint8Array): string }\ninterface DecodeFn { (text: string): Uint8Array }\n\n/**\n * Class represents both BaseEncoder and MultibaseEncoder meaning it\n * can be used to encode to multibase or base encode without multibase\n * prefix.\n */\nclass Encoder<Base extends string, Prefix extends string> implements MultibaseEncoder<Prefix>, BaseEncoder {\n  readonly name: Base\n  readonly prefix: Prefix\n  readonly baseEncode: EncodeFn\n\n  constructor (name: Base, prefix: Prefix, baseEncode: EncodeFn) {\n    this.name = name\n    this.prefix = prefix\n    this.baseEncode = baseEncode\n  }\n\n  encode (bytes: Uint8Array): Multibase<Prefix> {\n    if (bytes instanceof Uint8Array) {\n      return `${this.prefix}${this.baseEncode(bytes)}`\n    } else {\n      throw Error('Unknown type, must be binary type')\n    }\n  }\n}\n\n/**\n * Class represents both BaseDecoder and MultibaseDecoder so it could be used\n * to decode multibases (with matching prefix) or just base decode strings\n * with corresponding base encoding.\n */\nclass Decoder<Base extends string, Prefix extends string> implements MultibaseDecoder<Prefix>, UnibaseDecoder<Prefix>, BaseDecoder {\n  readonly name: Base\n  readonly prefix: Prefix\n  readonly baseDecode: DecodeFn\n  private readonly prefixCodePoint: number\n\n  constructor (name: Base, prefix: Prefix, baseDecode: DecodeFn) {\n    this.name = name\n    this.prefix = prefix\n    const prefixCodePoint = prefix.codePointAt(0)\n    /* c8 ignore next 3 */\n    if (prefixCodePoint === undefined) {\n      throw new Error('Invalid prefix character')\n    }\n    this.prefixCodePoint = prefixCodePoint\n    this.baseDecode = baseDecode\n  }\n\n  decode (text: string): Uint8Array {\n    if (typeof text === 'string') {\n      if (text.codePointAt(0) !== this.prefixCodePoint) {\n        throw Error(`Unable to decode multibase string ${JSON.stringify(text)}, ${this.name} decoder only supports inputs prefixed with ${this.prefix}`)\n      }\n      return this.baseDecode(text.slice(this.prefix.length))\n    } else {\n      throw Error('Can only multibase decode strings')\n    }\n  }\n\n  or<OtherPrefix extends string> (decoder: UnibaseDecoder<OtherPrefix> | ComposedDecoder<OtherPrefix>): ComposedDecoder<Prefix | OtherPrefix> {\n    return or(this, decoder)\n  }\n}\n\ntype Decoders<Prefix extends string> = Record<Prefix, UnibaseDecoder<Prefix>>\n\nclass ComposedDecoder<Prefix extends string> implements MultibaseDecoder<Prefix>, CombobaseDecoder<Prefix> {\n  readonly decoders: Decoders<Prefix>\n\n  constructor (decoders: Decoders<Prefix>) {\n    this.decoders = decoders\n  }\n\n  or <OtherPrefix extends string> (decoder: UnibaseDecoder<OtherPrefix> | ComposedDecoder<OtherPrefix>): ComposedDecoder<Prefix | OtherPrefix> {\n    return or(this, decoder)\n  }\n\n  decode (input: string): Uint8Array {\n    const prefix = input[0] as Prefix\n    const decoder = this.decoders[prefix]\n    if (decoder != null) {\n      return decoder.decode(input)\n    } else {\n      throw RangeError(`Unable to decode multibase string ${JSON.stringify(input)}, only inputs prefixed with ${Object.keys(this.decoders)} are supported`)\n    }\n  }\n}\n\nexport function or <L extends string, R extends string> (left: UnibaseDecoder<L> | CombobaseDecoder<L>, right: UnibaseDecoder<R> | CombobaseDecoder<R>): ComposedDecoder<L | R> {\n  return new ComposedDecoder({\n    ...(left.decoders ?? { [(left as UnibaseDecoder<L>).prefix]: left }),\n    ...(right.decoders ?? { [(right as UnibaseDecoder<R>).prefix]: right })\n  } as Decoders<L | R>)\n}\n\nexport class Codec<Base extends string, Prefix extends string> implements MultibaseCodec<Prefix>, MultibaseEncoder<Prefix>, MultibaseDecoder<Prefix>, BaseCodec, BaseEncoder, BaseDecoder {\n  readonly name: Base\n  readonly prefix: Prefix\n  readonly baseEncode: EncodeFn\n  readonly baseDecode: DecodeFn\n  readonly encoder: Encoder<Base, Prefix>\n  readonly decoder: Decoder<Base, Prefix>\n\n  constructor (name: Base, prefix: Prefix, baseEncode: EncodeFn, baseDecode: DecodeFn) {\n    this.name = name\n    this.prefix = prefix\n    this.baseEncode = baseEncode\n    this.baseDecode = baseDecode\n    this.encoder = new Encoder(name, prefix, baseEncode)\n    this.decoder = new Decoder(name, prefix, baseDecode)\n  }\n\n  encode (input: Uint8Array): string {\n    return this.encoder.encode(input)\n  }\n\n  decode (input: string): Uint8Array {\n    return this.decoder.decode(input)\n  }\n}\n\nexport function from <Base extends string, Prefix extends string> ({ name, prefix, encode, decode }: { name: Base, prefix: Prefix, encode: EncodeFn, decode: DecodeFn }): Codec<Base, Prefix> {\n  return new Codec(name, prefix, encode, decode)\n}\n\nexport function baseX <Base extends string, Prefix extends string> ({ name, prefix, alphabet }: { name: Base, prefix: Prefix, alphabet: string }): Codec<Base, Prefix> {\n  const { encode, decode } = basex(alphabet, name)\n  return from({\n    prefix,\n    name,\n    encode,\n    decode: (text: string): Uint8Array => coerce(decode(text))\n  })\n}\n\nfunction decode (string: string, alphabetIdx: Record<string, number>, bitsPerChar: number, name: string): Uint8Array {\n  // Count the padding bytes:\n  let end = string.length\n  while (string[end - 1] === '=') {\n    --end\n  }\n\n  // Allocate the output:\n  const out = new Uint8Array((end * bitsPerChar / 8) | 0)\n\n  // Parse the data:\n  let bits = 0 // Number of bits currently in the buffer\n  let buffer = 0 // Bits waiting to be written out, MSB first\n  let written = 0 // Next byte to write\n  for (let i = 0; i < end; ++i) {\n    // Read one character from the string:\n    const value = alphabetIdx[string[i]]\n    if (value === undefined) {\n      throw new SyntaxError(`Non-${name} character`)\n    }\n\n    // Append the bits to the buffer:\n    buffer = (buffer << bitsPerChar) | value\n    bits += bitsPerChar\n\n    // Write out some bits if the buffer has a byte's worth:\n    if (bits >= 8) {\n      bits -= 8\n      out[written++] = 0xff & (buffer >> bits)\n    }\n  }\n\n  // Verify that we have received just enough bits:\n  if (bits >= bitsPerChar || (0xff & (buffer << (8 - bits))) !== 0) {\n    throw new SyntaxError('Unexpected end of data')\n  }\n\n  return out\n}\n\nfunction encode (data: Uint8Array, alphabet: string, bitsPerChar: number): string {\n  const pad = alphabet[alphabet.length - 1] === '='\n  const mask = (1 << bitsPerChar) - 1\n  let out = ''\n\n  let bits = 0 // Number of bits currently in the buffer\n  let buffer = 0 // Bits waiting to be written out, MSB first\n  for (let i = 0; i < data.length; ++i) {\n    // Slurp data into the buffer:\n    buffer = (buffer << 8) | data[i]\n    bits += 8\n\n    // Write out as much as we can:\n    while (bits > bitsPerChar) {\n      bits -= bitsPerChar\n      out += alphabet[mask & (buffer >> bits)]\n    }\n  }\n\n  // Partial character:\n  if (bits !== 0) {\n    out += alphabet[mask & (buffer << (bitsPerChar - bits))]\n  }\n\n  // Add padding characters until we hit a byte boundary:\n  if (pad) {\n    while (((out.length * bitsPerChar) & 7) !== 0) {\n      out += '='\n    }\n  }\n\n  return out\n}\n\nfunction createAlphabetIdx (alphabet: string): Record<string, number> {\n  // Build the character lookup table:\n  const alphabetIdx: Record<string, number> = {}\n  for (let i = 0; i < alphabet.length; ++i) {\n    alphabetIdx[alphabet[i]] = i\n  }\n  return alphabetIdx\n}\n\n/**\n * RFC4648 Factory\n */\nexport function rfc4648 <Base extends string, Prefix extends string> ({ name, prefix, bitsPerChar, alphabet }: { name: Base, prefix: Prefix, bitsPerChar: number, alphabet: string }): Codec<Base, Prefix> {\n  const alphabetIdx = createAlphabetIdx(alphabet)\n  return from({\n    prefix,\n    name,\n    encode (input: Uint8Array): string {\n      return encode(input, alphabet, bitsPerChar)\n    },\n    decode (input: string): Uint8Array {\n      return decode(input, alphabetIdx, bitsPerChar, name)\n    }\n  })\n}\n","import { rfc4648 } from './base.js'\n\nexport const base16 = rfc4648({\n  prefix: 'f',\n  name: 'base16',\n  alphabet: '0123456789abcdef',\n  bitsPerChar: 4\n})\n\nexport const base16upper = rfc4648({\n  prefix: 'F',\n  name: 'base16upper',\n  alphabet: '0123456789ABCDEF',\n  bitsPerChar: 4\n})\n","import { rfc4648 } from './base.js'\n\nexport const base2 = rfc4648({\n  prefix: '0',\n  name: 'base2',\n  alphabet: '01',\n  bitsPerChar: 1\n})\n","import { from } from './base.js'\n\nconst alphabet = Array.from('🚀🪐☄🛰🌌🌑🌒🌓🌔🌕🌖🌗🌘🌍🌏🌎🐉☀💻🖥💾💿😂❤😍🤣😊🙏💕😭😘👍😅👏😁🔥🥰💔💖💙😢🤔😆🙄💪😉☺👌🤗💜😔😎😇🌹🤦🎉💞✌✨🤷😱😌🌸🙌😋💗💚😏💛🙂💓🤩😄😀🖤😃💯🙈👇🎶😒🤭❣😜💋👀😪😑💥🙋😞😩😡🤪👊🥳😥🤤👉💃😳✋😚😝😴🌟😬🙃🍀🌷😻😓⭐✅🥺🌈😈🤘💦✔😣🏃💐☹🎊💘😠☝😕🌺🎂🌻😐🖕💝🙊😹🗣💫💀👑🎵🤞😛🔴😤🌼😫⚽🤙☕🏆🤫👈😮🙆🍻🍃🐶💁😲🌿🧡🎁⚡🌞🎈❌✊👋😰🤨😶🤝🚶💰🍓💢🤟🙁🚨💨🤬✈🎀🍺🤓😙💟🌱😖👶🥴▶➡❓💎💸⬇😨🌚🦋😷🕺⚠🙅😟😵👎🤲🤠🤧📌🔵💅🧐🐾🍒😗🤑🌊🤯🐷☎💧😯💆👆🎤🙇🍑❄🌴💣🐸💌📍🥀🤢👅💡💩👐📸👻🤐🤮🎼🥵🚩🍎🍊👼💍📣🥂')\nconst alphabetBytesToChars: string[] = (alphabet.reduce<string[]>((p, c, i) => { p[i] = c; return p }, ([])))\nconst alphabetCharsToBytes: number[] = (alphabet.reduce<number[]>((p, c, i) => {\n  const codePoint = c.codePointAt(0)\n  if (codePoint == null) {\n    throw new Error(`Invalid character: ${c}`)\n  }\n  p[codePoint] = i\n  return p\n}, ([])))\n\nfunction encode (data: Uint8Array): string {\n  return data.reduce((p, c) => {\n    p += alphabetBytesToChars[c]\n    return p\n  }, '')\n}\n\nfunction decode (str: string): Uint8Array {\n  const byts = []\n  for (const char of str) {\n    const codePoint = char.codePointAt(0)\n    if (codePoint == null) {\n      throw new Error(`Invalid character: ${char}`)\n    }\n    const byt = alphabetCharsToBytes[codePoint]\n    if (byt == null) {\n      throw new Error(`Non-base256emoji character: ${char}`)\n    }\n    byts.push(byt)\n  }\n  return new Uint8Array(byts)\n}\n\nexport const base256emoji = from({\n  prefix: '🚀',\n  name: 'base256emoji',\n  encode,\n  decode\n})\n","import { rfc4648 } from './base.js'\n\nexport const base32 = rfc4648({\n  prefix: 'b',\n  name: 'base32',\n  alphabet: 'abcdefghijklmnopqrstuvwxyz234567',\n  bitsPerChar: 5\n})\n\nexport const base32upper = rfc4648({\n  prefix: 'B',\n  name: 'base32upper',\n  alphabet: 'ABCDEFGHIJKLMNOPQRSTUVWXYZ234567',\n  bitsPerChar: 5\n})\n\nexport const base32pad = rfc4648({\n  prefix: 'c',\n  name: 'base32pad',\n  alphabet: 'abcdefghijklmnopqrstuvwxyz234567=',\n  bitsPerChar: 5\n})\n\nexport const base32padupper = rfc4648({\n  prefix: 'C',\n  name: 'base32padupper',\n  alphabet: 'ABCDEFGHIJKLMNOPQRSTUVWXYZ234567=',\n  bitsPerChar: 5\n})\n\nexport const base32hex = rfc4648({\n  prefix: 'v',\n  name: 'base32hex',\n  alphabet: '0123456789abcdefghijklmnopqrstuv',\n  bitsPerChar: 5\n})\n\nexport const base32hexupper = rfc4648({\n  prefix: 'V',\n  name: 'base32hexupper',\n  alphabet: '0123456789ABCDEFGHIJKLMNOPQRSTUV',\n  bitsPerChar: 5\n})\n\nexport const base32hexpad = rfc4648({\n  prefix: 't',\n  name: 'base32hexpad',\n  alphabet: '0123456789abcdefghijklmnopqrstuv=',\n  bitsPerChar: 5\n})\n\nexport const base32hexpadupper = rfc4648({\n  prefix: 'T',\n  name: 'base32hexpadupper',\n  alphabet: '0123456789ABCDEFGHIJKLMNOPQRSTUV=',\n  bitsPerChar: 5\n})\n\nexport const base32z = rfc4648({\n  prefix: 'h',\n  name: 'base32z',\n  alphabet: 'ybndrfg8ejkmcpqxot1uwisza345h769',\n  bitsPerChar: 5\n})\n","import { baseX } from './base.js'\n\nexport const base36 = baseX({\n  prefix: 'k',\n  name: 'base36',\n  alphabet: '0123456789abcdefghijklmnopqrstuvwxyz'\n})\n\nexport const base36upper = baseX({\n  prefix: 'K',\n  name: 'base36upper',\n  alphabet: '0123456789ABCDEFGHIJKLMNOPQRSTUVWXYZ'\n})\n","import { baseX } from './base.js'\n\nexport const base58btc = baseX({\n  name: 'base58btc',\n  prefix: 'z',\n  alphabet: '123456789ABCDEFGHJKLMNPQRSTUVWXYZabcdefghijkmnopqrstuvwxyz'\n})\n\nexport const base58flickr = baseX({\n  name: 'base58flickr',\n  prefix: 'Z',\n  alphabet: '123456789abcdefghijkmnopqrstuvwxyzABCDEFGHJKLMNPQRSTUVWXYZ'\n})\n","import { rfc4648 } from './base.js'\n\nexport const base64 = rfc4648({\n  prefix: 'm',\n  name: 'base64',\n  alphabet: 'ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+/',\n  bitsPerChar: 6\n})\n\nexport const base64pad = rfc4648({\n  prefix: 'M',\n  name: 'base64pad',\n  alphabet: 'ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+/=',\n  bitsPerChar: 6\n})\n\nexport const base64url = rfc4648({\n  prefix: 'u',\n  name: 'base64url',\n  alphabet: 'ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789-_',\n  bitsPerChar: 6\n})\n\nexport const base64urlpad = rfc4648({\n  prefix: 'U',\n  name: 'base64urlpad',\n  alphabet: 'ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789-_=',\n  bitsPerChar: 6\n})\n","import { rfc4648 } from './base.js'\n\nexport const base8 = rfc4648({\n  prefix: '7',\n  name: 'base8',\n  alphabet: '01234567',\n  bitsPerChar: 3\n})\n","import { fromString, toString } from '../bytes.js'\nimport { from } from './base.js'\n\nexport const identity = from({\n  prefix: '\\x00',\n  name: 'identity',\n  encode: (buf) => toString(buf),\n  decode: (str) => fromString(str)\n})\n","import type { ArrayBufferView, ByteView } from './interface.js'\n\nconst textEncoder = new TextEncoder()\nconst textDecoder = new TextDecoder()\n\nexport const name = 'json'\nexport const code = 0x0200\n\nexport function encode <T> (node: T): ByteView<T> {\n  return textEncoder.encode(JSON.stringify(node))\n}\n\nexport function decode <T> (data: ByteView<T> | ArrayBufferView<T>): T {\n  return JSON.parse(textDecoder.decode(data))\n}\n","import { coerce } from '../bytes.js'\nimport type { ArrayBufferView, ByteView } from './interface.js'\n\nexport const name = 'raw'\nexport const code = 0x55\n\nexport function encode (node: Uint8Array): ByteView<Uint8Array> {\n  return coerce(node)\n}\n\nexport function decode (data: ByteView<Uint8Array> | ArrayBufferView<Uint8Array>): Uint8Array {\n  return coerce(data)\n}\n","import { coerce } from '../bytes.js'\nimport * as Digest from './digest.js'\nimport type { DigestOptions } from './hasher.js'\n\nconst code: 0x0 = 0x0\nconst name = 'identity'\n\nconst encode: (input: Uint8Array) => Uint8Array = coerce\n\nfunction digest (input: Uint8Array, options?: DigestOptions): Digest.Digest<typeof code, number> {\n  if (options?.truncate != null && options.truncate !== input.byteLength) {\n    if (options.truncate < 0 || options.truncate > input.byteLength) {\n      throw new Error(`Invalid truncate option, must be less than or equal to ${input.byteLength}`)\n    }\n\n    input = input.subarray(0, options.truncate)\n  }\n\n  return Digest.create(code, encode(input))\n}\n\nexport const identity = { code, name, encode, digest }\n","/* eslint-disable */\nvar encode_1 = encode;\n\nvar MSB = 0x80\n  , REST = 0x7F\n  , MSBALL = ~REST\n  , INT = Math.pow(2, 31);\n\n/**\n * @param {number} num\n * @param {number[]} out\n * @param {number} offset\n */\nfunction encode(num, out, offset) {\n  out = out || [];\n  offset = offset || 0;\n  var oldOffset = offset;\n\n  while(num >= INT) {\n    out[offset++] = (num & 0xFF) | MSB;\n    num /= 128;\n  }\n  while(num & MSBALL) {\n    out[offset++] = (num & 0xFF) | MSB;\n    num >>>= 7;\n  }\n  out[offset] = num | 0;\n  \n  // @ts-ignore\n  encode.bytes = offset - oldOffset + 1;\n  \n  return out\n}\n\nvar decode = read;\n\nvar MSB$1 = 0x80\n  , REST$1 = 0x7F;\n\n/**\n * @param {string | any[]} buf\n * @param {number} offset\n */\nfunction read(buf, offset) {\n  var res    = 0\n    , offset = offset || 0\n    , shift  = 0\n    , counter = offset\n    , b\n    , l = buf.length;\n\n  do {\n    if (counter >= l) {\n      // @ts-ignore\n      read.bytes = 0;\n      throw new RangeError('Could not decode varint')\n    }\n    b = buf[counter++];\n    res += shift < 28\n      ? (b & REST$1) << shift\n      : (b & REST$1) * Math.pow(2, shift);\n    shift += 7;\n  } while (b >= MSB$1)\n\n  // @ts-ignore\n  read.bytes = counter - offset;\n\n  return res\n}\n\nvar N1 = Math.pow(2,  7);\nvar N2 = Math.pow(2, 14);\nvar N3 = Math.pow(2, 21);\nvar N4 = Math.pow(2, 28);\nvar N5 = Math.pow(2, 35);\nvar N6 = Math.pow(2, 42);\nvar N7 = Math.pow(2, 49);\nvar N8 = Math.pow(2, 56);\nvar N9 = Math.pow(2, 63);\n\nvar length = function (/** @type {number} */ value) {\n  return (\n    value < N1 ? 1\n  : value < N2 ? 2\n  : value < N3 ? 3\n  : value < N4 ? 4\n  : value < N5 ? 5\n  : value < N6 ? 6\n  : value < N7 ? 7\n  : value < N8 ? 8\n  : value < N9 ? 9\n  :              10\n  )\n};\n\nvar varint = {\n    encode: encode_1\n  , decode: decode\n  , encodingLength: length\n};\n\nvar _brrp_varint = varint;\n\nexport default _brrp_varint;\n","import varint from './vendor/varint.js'\n\nexport function decode (data: Uint8Array, offset = 0): [number, number] {\n  const code = varint.decode(data, offset)\n  return [code, varint.decode.bytes]\n}\n\nexport function encodeTo (int: number, target: Uint8Array, offset = 0): Uint8Array {\n  varint.encode(int, target, offset)\n  return target\n}\n\nexport function encodingLength (int: number): number {\n  return varint.encodingLength(int)\n}\n","import { coerce, equals as equalBytes } from '../bytes.js'\nimport * as varint from '../varint.js'\nimport type { MultihashDigest } from './interface.js'\n\n/**\n * Creates a multihash digest.\n */\nexport function create <Code extends number> (code: Code, digest: Uint8Array): Digest<Code, number> {\n  const size = digest.byteLength\n  const sizeOffset = varint.encodingLength(code)\n  const digestOffset = sizeOffset + varint.encodingLength(size)\n\n  const bytes = new Uint8Array(digestOffset + size)\n  varint.encodeTo(code, bytes, 0)\n  varint.encodeTo(size, bytes, sizeOffset)\n  bytes.set(digest, digestOffset)\n\n  return new Digest(code, size, digest, bytes)\n}\n\n/**\n * Turns bytes representation of multihash digest into an instance.\n */\nexport function decode (multihash: Uint8Array): MultihashDigest {\n  const bytes = coerce(multihash)\n  const [code, sizeOffset] = varint.decode(bytes)\n  const [size, digestOffset] = varint.decode(bytes.subarray(sizeOffset))\n  const digest = bytes.subarray(sizeOffset + digestOffset)\n\n  if (digest.byteLength !== size) {\n    throw new Error('Incorrect length')\n  }\n\n  return new Digest(code, size, digest, bytes)\n}\n\nexport function equals (a: MultihashDigest, b: unknown): b is MultihashDigest {\n  if (a === b) {\n    return true\n  } else {\n    const data = b as { code?: unknown, size?: unknown, bytes?: unknown }\n\n    return (\n      a.code === data.code &&\n      a.size === data.size &&\n      data.bytes instanceof Uint8Array &&\n      equalBytes(a.bytes, data.bytes)\n    )\n  }\n}\n\n/**\n * Represents a multihash digest which carries information about the\n * hashing algorithm and an actual hash digest.\n */\nexport class Digest<Code extends number, Size extends number> implements MultihashDigest {\n  readonly code: Code\n  readonly size: Size\n  readonly digest: Uint8Array\n  readonly bytes: Uint8Array\n\n  /**\n   * Creates a multihash digest.\n   */\n  constructor (code: Code, size: Size, digest: Uint8Array, bytes: Uint8Array) {\n    this.code = code\n    this.size = size\n    this.digest = digest\n    this.bytes = bytes\n  }\n}\n\n/**\n * Used to check that the passed multihash has the passed code\n */\nexport function hasCode <T extends number> (digest: MultihashDigest, code: T): digest is MultihashDigest<T> {\n  return digest.code === code\n}\n","/* global crypto */\n\nimport { from } from './hasher.js'\n\nfunction sha (name: AlgorithmIdentifier): (data: Uint8Array) => Promise<Uint8Array> {\n  return async data => new Uint8Array(await crypto.subtle.digest(name, data))\n}\n\nexport const sha256 = from({\n  name: 'sha2-256',\n  code: 0x12,\n  encode: sha('SHA-256')\n})\n\nexport const sha512 = from({\n  name: 'sha2-512',\n  code: 0x13,\n  encode: sha('SHA-512')\n})\n","import * as Digest from './digest.js'\nimport type { MultihashHasher } from './interface.js'\n\ntype Await<T> = Promise<T> | T\n\nconst DEFAULT_MIN_DIGEST_LENGTH = 20\n\nexport interface HasherInit <Name extends string, Code extends number> {\n  name: Name\n  code: Code\n  encode(input: Uint8Array): Await<Uint8Array>\n\n  /**\n   * The minimum length a hash is allowed to be truncated to in bytes\n   *\n   * @default 20\n   */\n  minDigestLength?: number\n\n  /**\n   * The maximum length a hash is allowed to be truncated to in bytes. If not\n   * specified it will be inferred from the length of the digest.\n   */\n  maxDigestLength?: number\n}\n\nexport function from <Name extends string, Code extends number> ({ name, code, encode, minDigestLength, maxDigestLength }: HasherInit<Name, Code>): Hasher<Name, Code> {\n  return new Hasher(name, code, encode, minDigestLength, maxDigestLength)\n}\n\nexport interface DigestOptions {\n  /**\n   * Truncate the returned digest to this number of bytes.\n   *\n   * This may cause the digest method to throw/reject if the passed value is\n   * greater than the digest length or below a threshold under which the risk of\n   * hash collisions is significant.\n   *\n   * The actual value of this threshold can depend on the hashing algorithm in\n   * use.\n   */\n  truncate?: number\n}\n\n/**\n * Hasher represents a hashing algorithm implementation that produces as\n * `MultihashDigest`.\n */\nexport class Hasher<Name extends string, Code extends number> implements MultihashHasher<Code> {\n  readonly name: Name\n  readonly code: Code\n  readonly encode: (input: Uint8Array) => Await<Uint8Array>\n  readonly minDigestLength: number\n  readonly maxDigestLength?: number\n\n  constructor (name: Name, code: Code, encode: (input: Uint8Array) => Await<Uint8Array>, minDigestLength?: number, maxDigestLength?: number) {\n    this.name = name\n    this.code = code\n    this.encode = encode\n    this.minDigestLength = minDigestLength ?? DEFAULT_MIN_DIGEST_LENGTH\n    this.maxDigestLength = maxDigestLength\n  }\n\n  digest (input: Uint8Array, options?: DigestOptions): Await<Digest.Digest<Code, number>> {\n    if (options?.truncate != null) {\n      if (options.truncate < this.minDigestLength) {\n        throw new Error(`Invalid truncate option, must be greater than or equal to ${this.minDigestLength}`)\n      }\n\n      if (this.maxDigestLength != null && options.truncate > this.maxDigestLength) {\n        throw new Error(`Invalid truncate option, must be less than or equal to ${this.maxDigestLength}`)\n      }\n    }\n\n    if (input instanceof Uint8Array) {\n      const result = this.encode(input)\n\n      if (result instanceof Uint8Array) {\n        return createDigest(result, this.code, options?.truncate)\n      }\n\n      return result.then(digest => createDigest(digest, this.code, options?.truncate))\n    } else {\n      throw Error('Unknown type, must be binary type')\n      /* c8 ignore next 1 */\n    }\n  }\n}\n\n/**\n * Create a Digest from the passed uint8array and code, optionally truncating it\n * first.\n */\nfunction createDigest <Code extends number> (digest: Uint8Array, code: Code, truncate?: number): Digest.Digest<Code, number> {\n  if (truncate != null && truncate !== digest.byteLength) {\n    if (truncate > digest.byteLength) {\n      throw new Error(`Invalid truncate option, must be less than or equal to ${digest.byteLength}`)\n    }\n\n    digest = digest.subarray(0, truncate)\n  }\n\n  return Digest.create(code, digest)\n}\n","import { base32 } from './bases/base32.js'\nimport { base36 } from './bases/base36.js'\nimport { base58btc } from './bases/base58.js'\nimport { coerce } from './bytes.js'\nimport * as Digest from './hashes/digest.js'\nimport * as varint from './varint.js'\nimport type * as API from './link/interface.js'\n\n// This way TS will also expose all the types from module\nexport * from './link/interface.js'\n\nexport function format <T extends API.Link<unknown, number, number, API.Version>, Prefix extends string> (link: T, base?: API.MultibaseEncoder<Prefix>): API.ToString<T, Prefix> {\n  const { bytes, version } = link\n  switch (version) {\n    case 0:\n      return toStringV0(\n        bytes,\n        baseCache(link),\n        base as API.MultibaseEncoder<'z'> ?? base58btc.encoder\n      )\n    default:\n      return toStringV1(\n        bytes,\n        baseCache(link),\n        (base ?? base32.encoder) as API.MultibaseEncoder<Prefix>\n      )\n  }\n}\n\nexport function toJSON <Link extends API.UnknownLink> (link: Link): API.LinkJSON<Link> {\n  return {\n    '/': format(link)\n  }\n}\n\nexport function fromJSON <Link extends API.UnknownLink> (json: API.LinkJSON<Link>): CID<unknown, number, number, API.Version> {\n  return CID.parse(json['/'])\n}\n\nconst cache = new WeakMap<API.UnknownLink, Map<string, string>>()\n\nfunction baseCache (cid: API.UnknownLink): Map<string, string> {\n  const baseCache = cache.get(cid)\n  if (baseCache == null) {\n    const baseCache = new Map()\n    cache.set(cid, baseCache)\n    return baseCache\n  }\n  return baseCache\n}\n\nexport class CID<Data = unknown, Format extends number = number, Alg extends number = number, Version extends API.Version = API.Version> implements API.Link<Data, Format, Alg, Version> {\n  readonly code: Format\n  readonly version: Version\n  readonly multihash: API.MultihashDigest<Alg>\n  readonly bytes: Uint8Array\n  readonly '/': Uint8Array\n\n  /**\n   * @param version - Version of the CID\n   * @param code - Code of the codec content is encoded in, see https://github.com/multiformats/multicodec/blob/master/table.csv\n   * @param multihash - (Multi)hash of the of the content.\n   */\n  constructor (version: Version, code: Format, multihash: API.MultihashDigest<Alg>, bytes: Uint8Array) {\n    this.code = code\n    this.version = version\n    this.multihash = multihash\n    this.bytes = bytes\n\n    // flag to serializers that this is a CID and\n    // should be treated specially\n    this['/'] = bytes\n  }\n\n  /**\n   * Signalling `cid.asCID === cid` has been replaced with `cid['/'] === cid.bytes`\n   * please either use `CID.asCID(cid)` or switch to new signalling mechanism\n   *\n   * @deprecated\n   */\n  get asCID (): this {\n    return this\n  }\n\n  // ArrayBufferView\n  get byteOffset (): number {\n    return this.bytes.byteOffset\n  }\n\n  // ArrayBufferView\n  get byteLength (): number {\n    return this.bytes.byteLength\n  }\n\n  toV0 (): CID<Data, API.DAG_PB, API.SHA_256, 0> {\n    switch (this.version) {\n      case 0: {\n        return this as CID<Data, API.DAG_PB, API.SHA_256, 0>\n      }\n      case 1: {\n        const { code, multihash } = this\n\n        if (code !== DAG_PB_CODE) {\n          throw new Error('Cannot convert a non dag-pb CID to CIDv0')\n        }\n\n        // sha2-256\n        if (multihash.code !== SHA_256_CODE) {\n          throw new Error('Cannot convert non sha2-256 multihash CID to CIDv0')\n        }\n\n        return (\n          CID.createV0(\n            multihash as API.MultihashDigest<API.SHA_256>\n          )\n        )\n      }\n      default: {\n        throw Error(\n          `Can not convert CID version ${this.version} to version 0. This is a bug please report`\n        )\n      }\n    }\n  }\n\n  toV1 (): CID<Data, Format, Alg, 1> {\n    switch (this.version) {\n      case 0: {\n        const { code, digest } = this.multihash\n        const multihash = Digest.create(code, digest)\n        return (\n          CID.createV1(this.code, multihash)\n        )\n      }\n      case 1: {\n        return this as CID<Data, Format, Alg, 1>\n      }\n      default: {\n        throw Error(\n          `Can not convert CID version ${this.version} to version 1. This is a bug please report`\n        )\n      }\n    }\n  }\n\n  equals (other: unknown): other is CID<Data, Format, Alg, Version> {\n    return CID.equals(this, other)\n  }\n\n  static equals <Data, Format extends number, Alg extends number, Version extends API.Version>(self: API.Link<Data, Format, Alg, Version>, other: unknown): other is CID {\n    const unknown = other as { code?: unknown, version?: unknown, multihash?: unknown }\n    return (\n      unknown != null &&\n      self.code === unknown.code &&\n      self.version === unknown.version &&\n      Digest.equals(self.multihash, unknown.multihash)\n    )\n  }\n\n  toString (base?: API.MultibaseEncoder<string>): string {\n    return format(this, base)\n  }\n\n  toJSON (): API.LinkJSON<this> {\n    return { '/': format(this) }\n  }\n\n  link (): this {\n    return this\n  }\n\n  readonly [Symbol.toStringTag] = 'CID';\n\n  // Legacy\n\n  [Symbol.for('nodejs.util.inspect.custom')] (): string {\n    return `CID(${this.toString()})`\n  }\n\n  /**\n   * Takes any input `value` and returns a `CID` instance if it was\n   * a `CID` otherwise returns `null`. If `value` is instanceof `CID`\n   * it will return value back. If `value` is not instance of this CID\n   * class, but is compatible CID it will return new instance of this\n   * `CID` class. Otherwise returns null.\n   *\n   * This allows two different incompatible versions of CID library to\n   * co-exist and interop as long as binary interface is compatible.\n   */\n  static asCID <Data, Format extends number, Alg extends number, Version extends API.Version, U>(input: API.Link<Data, Format, Alg, Version> | U): CID<Data, Format, Alg, Version> | null {\n    if (input == null) {\n      return null\n    }\n\n    const value = input as any\n    if (value instanceof CID) {\n      // If value is instance of CID then we're all set.\n      return value\n    } else if ((value['/'] != null && value['/'] === value.bytes) || value.asCID === value) {\n      // If value isn't instance of this CID class but `this.asCID === this` or\n      // `value['/'] === value.bytes` is true it is CID instance coming from a\n      // different implementation (diff version or duplicate). In that case we\n      // rebase it to this `CID` implementation so caller is guaranteed to get\n      // instance with expected API.\n      const { version, code, multihash, bytes } = value\n      return new CID(\n        version,\n        code,\n        multihash as API.MultihashDigest<Alg>,\n        bytes ?? encodeCID(version, code, multihash.bytes)\n      )\n    } else if (value[cidSymbol] === true) {\n      // If value is a CID from older implementation that used to be tagged via\n      // symbol we still rebase it to the this `CID` implementation by\n      // delegating that to a constructor.\n      const { version, multihash, code } = value\n      const digest = Digest.decode(multihash) as API.MultihashDigest<Alg>\n      return CID.create(version, code, digest)\n    } else {\n      // Otherwise value is not a CID (or an incompatible version of it) in\n      // which case we return `null`.\n      return null\n    }\n  }\n\n  /**\n   * @param version - Version of the CID\n   * @param code - Code of the codec content is encoded in, see https://github.com/multiformats/multicodec/blob/master/table.csv\n   * @param digest - (Multi)hash of the of the content.\n   */\n  static create <Data, Format extends number, Alg extends number, Version extends API.Version>(version: Version, code: Format, digest: API.MultihashDigest<Alg>): CID<Data, Format, Alg, Version> {\n    if (typeof code !== 'number') {\n      throw new Error('String codecs are no longer supported')\n    }\n\n    if (!(digest.bytes instanceof Uint8Array)) {\n      throw new Error('Invalid digest')\n    }\n\n    switch (version) {\n      case 0: {\n        if (code !== DAG_PB_CODE) {\n          throw new Error(\n            `Version 0 CID must use dag-pb (code: ${DAG_PB_CODE}) block encoding`\n          )\n        } else {\n          return new CID(version, code, digest, digest.bytes)\n        }\n      }\n      case 1: {\n        const bytes = encodeCID(version, code, digest.bytes)\n        return new CID(version, code, digest, bytes)\n      }\n      default: {\n        throw new Error('Invalid version')\n      }\n    }\n  }\n\n  /**\n   * Simplified version of `create` for CIDv0.\n   */\n  static createV0 <T = unknown>(digest: API.MultihashDigest<typeof SHA_256_CODE>): CID<T, typeof DAG_PB_CODE, typeof SHA_256_CODE, 0> {\n    return CID.create(0, DAG_PB_CODE, digest)\n  }\n\n  /**\n   * Simplified version of `create` for CIDv1.\n   *\n   * @param code - Content encoding format code.\n   * @param digest - Multihash of the content.\n   */\n  static createV1 <Data, Code extends number, Alg extends number>(code: Code, digest: API.MultihashDigest<Alg>): CID<Data, Code, Alg, 1> {\n    return CID.create(1, code, digest)\n  }\n\n  /**\n   * Decoded a CID from its binary representation. The byte array must contain\n   * only the CID with no additional bytes.\n   *\n   * An error will be thrown if the bytes provided do not contain a valid\n   * binary representation of a CID.\n   */\n  static decode <Data, Code extends number, Alg extends number, Version extends API.Version>(bytes: API.ByteView<API.Link<Data, Code, Alg, Version>>): CID<Data, Code, Alg, Version> {\n    const [cid, remainder] = CID.decodeFirst(bytes)\n    if (remainder.length !== 0) {\n      throw new Error('Incorrect length')\n    }\n    return cid\n  }\n\n  /**\n   * Decoded a CID from its binary representation at the beginning of a byte\n   * array.\n   *\n   * Returns an array with the first element containing the CID and the second\n   * element containing the remainder of the original byte array. The remainder\n   * will be a zero-length byte array if the provided bytes only contained a\n   * binary CID representation.\n   */\n  static decodeFirst <T, C extends number, A extends number, V extends API.Version>(bytes: API.ByteView<API.Link<T, C, A, V>>): [CID<T, C, A, V>, Uint8Array] {\n    const specs = CID.inspectBytes(bytes)\n    const prefixSize = specs.size - specs.multihashSize\n    const multihashBytes = coerce(\n      bytes.subarray(prefixSize, prefixSize + specs.multihashSize)\n    )\n    if (multihashBytes.byteLength !== specs.multihashSize) {\n      throw new Error('Incorrect length')\n    }\n    const digestBytes = multihashBytes.subarray(\n      specs.multihashSize - specs.digestSize\n    )\n    const digest = new Digest.Digest(\n      specs.multihashCode,\n      specs.digestSize,\n      digestBytes,\n      multihashBytes\n    )\n    const cid =\n      specs.version === 0\n        ? CID.createV0(digest as API.MultihashDigest<API.SHA_256>)\n        : CID.createV1(specs.codec, digest)\n    return [cid as CID<T, C, A, V>, bytes.subarray(specs.size)]\n  }\n\n  /**\n   * Inspect the initial bytes of a CID to determine its properties.\n   *\n   * Involves decoding up to 4 varints. Typically this will require only 4 to 6\n   * bytes but for larger multicodec code values and larger multihash digest\n   * lengths these varints can be quite large. It is recommended that at least\n   * 10 bytes be made available in the `initialBytes` argument for a complete\n   * inspection.\n   */\n  static inspectBytes <T, C extends number, A extends number, V extends API.Version>(initialBytes: API.ByteView<API.Link<T, C, A, V>>): { version: V, codec: C, multihashCode: A, digestSize: number, multihashSize: number, size: number } {\n    let offset = 0\n    const next = (): number => {\n      const [i, length] = varint.decode(initialBytes.subarray(offset))\n      offset += length\n      return i\n    }\n\n    let version = next() as V\n    let codec = DAG_PB_CODE as C\n    if (version as number === 18) {\n      // CIDv0\n      version = 0 as V\n      offset = 0\n    } else {\n      codec = next() as C\n    }\n\n    if (version !== 0 && version !== 1) {\n      throw new RangeError(`Invalid CID version ${version}`)\n    }\n\n    const prefixSize = offset\n    const multihashCode = next() as A // multihash code\n    const digestSize = next() // multihash length\n    const size = offset + digestSize\n    const multihashSize = size - prefixSize\n\n    return { version, codec, multihashCode, digestSize, multihashSize, size }\n  }\n\n  /**\n   * Takes cid in a string representation and creates an instance. If `base`\n   * decoder is not provided will use a default from the configuration. It will\n   * throw an error if encoding of the CID is not compatible with supplied (or\n   * a default decoder).\n   */\n  static parse <Prefix extends string, Data, Code extends number, Alg extends number, Version extends API.Version>(source: API.ToString<API.Link<Data, Code, Alg, Version>, Prefix>, base?: API.MultibaseDecoder<Prefix>): CID<Data, Code, Alg, Version> {\n    const [prefix, bytes] = parseCIDtoBytes(source, base)\n\n    const cid = CID.decode(bytes)\n\n    if (cid.version === 0 && source[0] !== 'Q') {\n      throw Error('Version 0 CID string must not include multibase prefix')\n    }\n\n    // Cache string representation to avoid computing it on `this.toString()`\n    baseCache(cid).set(prefix, source)\n\n    return cid\n  }\n}\n\nfunction parseCIDtoBytes <Prefix extends string, Data, Code extends number, Alg extends number, Version extends API.Version> (source: API.ToString<API.Link<Data, Code, Alg, Version>, Prefix>, base?: API.MultibaseDecoder<Prefix>): [Prefix, API.ByteView<API.Link<Data, Code, Alg, Version>>] {\n  switch (source[0]) {\n    // CIDv0 is parsed differently\n    case 'Q': {\n      const decoder = base ?? base58btc\n      return [\n        base58btc.prefix as Prefix,\n        decoder.decode(`${base58btc.prefix}${source}`)\n      ]\n    }\n    case base58btc.prefix: {\n      const decoder = base ?? base58btc\n      return [base58btc.prefix as Prefix, decoder.decode(source)]\n    }\n    case base32.prefix: {\n      const decoder = base ?? base32\n      return [base32.prefix as Prefix, decoder.decode(source)]\n    }\n    case base36.prefix: {\n      const decoder = base ?? base36\n      return [base36.prefix as Prefix, decoder.decode(source)]\n    }\n    default: {\n      if (base == null) {\n        throw Error(\n          'To parse non base32, base36 or base58btc encoded CID multibase decoder must be provided'\n        )\n      }\n      return [source[0] as Prefix, base.decode(source)]\n    }\n  }\n}\n\nfunction toStringV0 (bytes: Uint8Array, cache: Map<string, string>, base: API.MultibaseEncoder<'z'>): string {\n  const { prefix } = base\n  if (prefix !== base58btc.prefix) {\n    throw Error(`Cannot string encode V0 in ${base.name} encoding`)\n  }\n\n  const cid = cache.get(prefix)\n  if (cid == null) {\n    const cid = base.encode(bytes).slice(1)\n    cache.set(prefix, cid)\n    return cid\n  } else {\n    return cid\n  }\n}\n\nfunction toStringV1 <Prefix extends string> (bytes: Uint8Array, cache: Map<string, string>, base: API.MultibaseEncoder<Prefix>): string {\n  const { prefix } = base\n  const cid = cache.get(prefix)\n  if (cid == null) {\n    const cid = base.encode(bytes)\n    cache.set(prefix, cid)\n    return cid\n  } else {\n    return cid\n  }\n}\n\nconst DAG_PB_CODE = 0x70\nconst SHA_256_CODE = 0x12\n\nfunction encodeCID (version: API.Version, code: number, multihash: Uint8Array): Uint8Array {\n  const codeOffset = varint.encodingLength(version)\n  const hashOffset = codeOffset + varint.encodingLength(code)\n  const bytes = new Uint8Array(hashOffset + multihash.byteLength)\n  varint.encodeTo(version, bytes, 0)\n  varint.encodeTo(code, bytes, codeOffset)\n  bytes.set(multihash, hashOffset)\n  return bytes\n}\n\nconst cidSymbol = Symbol.for('@ipld/js-cid/CID')\n","import * as base10 from './bases/base10.js'\nimport * as base16 from './bases/base16.js'\nimport * as base2 from './bases/base2.js'\nimport * as base256emoji from './bases/base256emoji.js'\nimport * as base32 from './bases/base32.js'\nimport * as base36 from './bases/base36.js'\nimport * as base58 from './bases/base58.js'\nimport * as base64 from './bases/base64.js'\nimport * as base8 from './bases/base8.js'\nimport * as identityBase from './bases/identity.js'\nimport * as json from './codecs/json.js'\nimport * as raw from './codecs/raw.js'\nimport * as identity from './hashes/identity.js'\nimport * as sha2 from './hashes/sha2.js'\nimport { CID, hasher, digest, varint, bytes } from './index.js'\n\nexport const bases = { ...identityBase, ...base2, ...base8, ...base10, ...base16, ...base32, ...base36, ...base58, ...base64, ...base256emoji }\nexport const hashes = { ...sha2, ...identity }\nexport const codecs = { raw, json }\n\nexport { CID, hasher, digest, varint, bytes }\n","/**\n * SharingService - v2 sharing link service with embedded private keys.\n *\n * This service implements the v2 sharing specification, which embeds private keys\n * directly in sharing links. This allows recipients to exercise delegations\n * without requiring prior session setup.\n *\n * Key differences from v1 SharingLinks:\n * - Private keys are embedded in the link (not just tokens)\n * - Recipients can optionally sub-delegate to their own session key\n * - Pre-configured KV service returned for immediate use\n *\n * @packageDocumentation\n */\n\nimport type {\n  IKVService,\n  ServiceSession,\n  InvokeFunction,\n  FetchFunction,\n} from \"@tinycloud/sdk-services\";\nimport type {\n  Result,\n  DelegationError,\n  Delegation,\n  KeyInfo,\n  KeyProvider,\n  GenerateShareParams,\n  ShareLink,\n  ShareLinkData,\n  ShareSchema,\n  JWK,\n  IngestOptions,\n  CreateDelegationParams,\n  CreateDelegationWasmParams,\n  CreateDelegationWasmResult,\n} from \"./types\";\nimport { DelegationErrorCodes } from \"./types\";\nimport type { DelegationManager } from \"./DelegationManager\";\nimport type { ICapabilityKeyRegistry } from \"../authorization/CapabilityKeyRegistry\";\nimport { validateEncodedShareData } from \"./SharingService.schema.js\";\nimport { SERVICE_LONG_TO_SHORT, type PermissionEntry } from \"../manifest\";\nimport { principalDid } from \"../identity\";\nimport {\n  actionContains,\n  CaveatedDelegationUnsupportedError,\n  recapCaveatsEqual,\n} from \"../capabilities\";\nimport { bases } from \"multiformats/basics\";\nimport { ed25519 } from \"@noble/curves/ed25519\";\nimport { ShareRecipientClient } from \"./ShareRecipientClient\";\nimport type { ShareAccessV2, ShareRecipientClientOptions } from \"./recipient-types\";\n\n// ---------------------------------------------------------------------------\n// Local helpers\n// ---------------------------------------------------------------------------\n\n/**\n * Infer the short-form service name (`\"kv\"`, `\"sql\"`, etc) that all of the\n * given full-URN action strings belong to.\n *\n * SharingService issues single-service delegations (KV-only, SQL-only, …) —\n * the multi-resource WASM `createDelegation` call requires the service\n * segment explicitly because it's keyed separately from the action list.\n * This helper extracts the namespace half (`\"tinycloud.kv\"`) from each URN,\n * maps it to the short form via {@link SERVICE_LONG_TO_SHORT}, and returns\n * `undefined` if the actions are not all from the same known service.\n *\n * Returning `undefined` is intentional: the caller must surface a clear\n * error rather than guessing.\n */\nfunction inferShortServiceFromActionUrns(\n  actions: readonly string[]\n): string | undefined {\n  let short: string | undefined;\n  for (const action of actions) {\n    const slash = action.indexOf(\"/\");\n    if (slash === -1) return undefined;\n    const longService = action.slice(0, slash);\n    const candidate = SERVICE_LONG_TO_SHORT[longService];\n    if (candidate === undefined) return undefined;\n    if (short === undefined) {\n      short = candidate;\n    } else if (short !== candidate) {\n      return undefined;\n    }\n  }\n  return short;\n}\n\n// =============================================================================\n// Constants\n// =============================================================================\n\n/**\n * Default actions for read-only sharing links.\n */\nconst DEFAULT_READ_ACTIONS = [\"tinycloud.kv/get\", \"tinycloud.kv/metadata\"];\n\n/**\n * Default expiry for share links — SHARE tier (see ../expiry.ts).\n */\nimport { EXPIRY } from \"../expiry\";\nconst DEFAULT_EXPIRY_MS = EXPIRY.SHARE_MS;\n\n/**\n * Prefix for the base64 schema.\n */\nconst BASE64_PREFIX = \"tc1:\";\n\n// =============================================================================\n// Helper Functions\n// =============================================================================\n\n/**\n * Creates a DelegationError with the given parameters.\n */\nfunction createError(\n  code: string,\n  message: string,\n  cause?: Error,\n  meta?: Record<string, unknown>\n): DelegationError {\n  return {\n    code,\n    message,\n    service: \"delegation\",\n    cause,\n    meta,\n  };\n}\n\n/**\n * Classify a failure thrown by the root-delegation signing callback.\n *\n * The callback drives a wallet / OpenKey signing surface. \"The signer never\n * answered\" and \"the server said you may not do this\" both used to collapse\n * into a single `PERMISSION_DENIED` with an authorization-flavoured message,\n * which is wrong for the user (retrying the signature would have worked) and\n * useless for whoever is debugging it.\n */\nfunction rootDelegationSigningError(err: unknown): DelegationError {\n  const cause = err instanceof Error ? err : undefined;\n  const code =\n    err && typeof err === \"object\" && \"code\" in err\n      ? String((err as { code?: unknown }).code ?? \"\")\n      : \"\";\n  const name = err instanceof Error ? err.name : \"\";\n  const message = err instanceof Error ? err.message : String(err ?? \"\");\n\n  const aborted =\n    code === DelegationErrorCodes.ABORTED ||\n    name === \"AbortError\" ||\n    /\\bcancell?ed\\b|\\brejected\\b|user denied/i.test(message);\n  if (aborted) {\n    return createError(\n      DelegationErrorCodes.ABORTED,\n      \"The signature that authorizes this sharing link was cancelled. \" +\n        \"Approve the signing prompt to finish creating the link.\",\n      cause,\n    );\n  }\n\n  const timedOut =\n    code === DelegationErrorCodes.TIMEOUT ||\n    name === \"TimeoutError\" ||\n    /timed out|timeout/i.test(message);\n  if (timedOut) {\n    return createError(\n      DelegationErrorCodes.TIMEOUT,\n      \"Timed out waiting for the signature that authorizes this sharing link. \" +\n        \"Creating a long-lived link re-opens the signing prompt after sign-in; \" +\n        \"if you did not see one, check for a blocked popup or a hidden signing \" +\n        \"frame, then try again.\",\n      cause,\n    );\n  }\n\n  return createError(\n    DelegationErrorCodes.PERMISSION_DENIED,\n    \"The active session ReCap does not authorize this sharing delegation.\",\n    cause,\n  );\n}\n\n/**\n * Base64 encode for URLs (URL-safe base64).\n */\nfunction base64UrlEncode(data: string): string {\n  // Use btoa for browser, Buffer for Node.js\n  let base64: string;\n  if (typeof btoa !== \"undefined\") {\n    base64 = btoa(unescape(encodeURIComponent(data)));\n  } else if (typeof Buffer !== \"undefined\") {\n    base64 = Buffer.from(data, \"utf-8\").toString(\"base64\");\n  } else {\n    throw new Error(\"No base64 encoding available\");\n  }\n  // Make URL-safe\n  return base64.replace(/\\+/g, \"-\").replace(/\\//g, \"_\").replace(/=+$/, \"\");\n}\n\n/**\n * Base64 decode for URLs (URL-safe base64).\n */\nfunction base64UrlDecode(encoded: string): string {\n  // Restore standard base64\n  let base64 = encoded.replace(/-/g, \"+\").replace(/_/g, \"/\");\n  // Add padding if needed\n  while (base64.length % 4) {\n    base64 += \"=\";\n  }\n  // Decode\n  if (typeof atob !== \"undefined\") {\n    return decodeURIComponent(escape(atob(base64)));\n  } else if (typeof Buffer !== \"undefined\") {\n    return Buffer.from(base64, \"base64\").toString(\"utf-8\");\n  } else {\n    throw new Error(\"No base64 decoding available\");\n  }\n}\n\n// =============================================================================\n// Types\n// =============================================================================\n\n/**\n * Data encoded in a sharing link.\n */\nexport interface EncodedShareData {\n  /** Private key in JWK format (includes d parameter) */\n  key: JWK;\n  /** DID of the key */\n  keyDid: string;\n  /** The delegation granting access */\n  delegation: Delegation;\n  /** Resource path this link grants access to */\n  path: string;\n  /** TinyCloud host URL */\n  host: string;\n  /** Space ID */\n  spaceId: string;\n  /** Schema version */\n  version: 1;\n}\n\n/**\n * Options for receiving a sharing link.\n */\nexport interface ReceiveOptions {\n  /**\n   * Whether to automatically create a sub-delegation to the current session key.\n   * Default: true\n   */\n  autoSubdelegate?: boolean;\n  /**\n   * Whether to use the current session key for operations (requires autoSubdelegate).\n   * Default: true\n   */\n  useSessionKey?: boolean;\n  /**\n   * Ingestion options passed to CapabilityKeyRegistry.\n   */\n  ingestOptions?: IngestOptions;\n}\n\n/**\n * Result of receiving a sharing link.\n */\nexport interface ShareAccess {\n  /** The delegation that was received/created */\n  delegation: Delegation;\n  /** Key info for the received key */\n  key: KeyInfo;\n  /** Pre-configured KV service for the shared path */\n  kv: IKVService;\n  /** The space ID */\n  spaceId: string;\n  /** The path prefix for this share */\n  path: string;\n}\n\n/**\n * Parameters for attenuating a received share to another principal.\n *\n * Omitted path/actions/expiry inherit the received share's exact values. Any\n * supplied value must be equal to or an attenuated subset of the parent.\n */\nexport interface DelegateReceivedShareParams {\n  /** DID that may exercise the child delegation. */\n  delegateDID: string;\n  /** Equal to or below the shared path. Defaults to the shared path. */\n  path?: string;\n  /** Subset of the shared actions. Defaults to all shared actions. */\n  actions?: string[];\n  /** No later than the sharing-link expiry. Defaults to the parent expiry. */\n  expiry?: Date;\n  /** Optional node origin that further narrows the configured-host allowlist. */\n  expectedHost?: string;\n}\n\n/**\n * A transport-ready child delegation with non-secret source lineage.\n *\n * `delegation.delegationHeader` is a live bearer credential. Treat it like a\n * secret: do not log it or persist it outside secure credential storage.\n * Only `source` is safe to retain as non-secret lineage metadata.\n */\nexport interface DelegatedShareAccess {\n  delegation: Delegation & {\n    delegationHeader: { Authorization: string };\n    ownerAddress: string;\n    chainId: number;\n    host: string;\n    resources: Array<{ service: string; space: string; path: string; actions: string[] }>;\n    disableSubDelegation: boolean;\n  };\n  source: {\n    parentCid: string;\n    spaceId: string;\n    path: string;\n    host: string;\n    expiresAt: Date;\n  };\n}\n\n/**\n * Configuration for SharingService.\n */\nexport interface SharingServiceConfig {\n  /** TinyCloud host URLs */\n  hosts: string[];\n  /**\n   * Active session for authentication.\n   * Required for generate(), optional for receive().\n   */\n  session?: ServiceSession;\n  /** Platform-specific invoke function */\n  invoke: InvokeFunction;\n  /** Optional custom fetch implementation */\n  fetch?: FetchFunction;\n  /** Key provider for cryptographic operations */\n  keyProvider: KeyProvider;\n  /** Capability key registry for key/delegation management */\n  registry: ICapabilityKeyRegistry;\n  /**\n   * Delegation manager for creating delegations (used if createDelegation not provided).\n   * Required for generate(), optional for receive().\n   */\n  delegationManager?: DelegationManager;\n  /** Factory for creating KV service instances */\n  createKVService: (config: {\n    hosts: string[];\n    session: ServiceSession;\n    invoke: InvokeFunction;\n    fetch?: FetchFunction;\n    pathPrefix?: string;\n  }) => IKVService;\n  /** Base URL for sharing links (e.g., \"https://share.myapp.com\") */\n  baseUrl?: string;\n  /**\n   * Custom delegation creation function. When provided, this is used instead\n   * of delegationManager.create(). This allows platforms to use their own\n   * delegation creation logic (e.g., SIWE-based /delegate endpoint).\n   */\n  createDelegation?: (params: CreateDelegationParams) => Promise<Result<Delegation, DelegationError>>;\n  /**\n   * WASM function for client-side delegation creation.\n   * When provided, this is preferred over server-side creation (createDelegation/delegationManager).\n   * Creates UCAN delegations directly without requiring server roundtrip.\n   */\n  createDelegationWasm?: (params: CreateDelegationWasmParams) => CreateDelegationWasmResult;\n  /** Compute a CID for serialized delegation bytes. Required for share attenuation. */\n  computeCid?: (data: Uint8Array, codec: bigint) => string;\n  /**\n   * Path prefix for KV operations.\n   * When set, paths passed to generate() are prefixed with this value.\n   * This ensures the share path matches the session's authorized paths.\n   */\n  pathPrefix?: string;\n  /**\n   * Session expiry time.\n   * When set, sharing link expiry is clamped to not exceed this value\n   * unless onRootDelegationNeeded is provided and returns a new delegation.\n   */\n  sessionExpiry?: Date;\n  /**\n   * Callback to create a DIRECT delegation from the root (wallet) to a share key.\n   * This bypasses the session delegation chain, allowing share links with\n   * expiry longer than the current session.\n   *\n   * When provided and share expiry > session expiry:\n   * 1. SharingService creates the ephemeral share key\n   * 2. This callback is invoked with the share key DID\n   * 3. The callback signs a direct PKH -> share key delegation with the wallet\n   * 4. The returned delegation is used for the share link\n   *\n   * This is the CORRECT solution for long-lived share links because:\n   * - It creates a fresh delegation chain: PKH -> share key\n   * - Not constrained by session expiry (no sub-delegation from session key)\n   *\n   * @param params - Parameters for creating the root delegation\n   * @returns The delegation from wallet to share key, or undefined to fall back to session extension\n   */\n  onRootDelegationNeeded?: (params: {\n    /** DID of the share key to delegate to */\n    shareKeyDID: string;\n    /** Space ID */\n    spaceId: string;\n    /** Path to grant access to */\n    path: string;\n    /** Actions to grant */\n    actions: string[];\n    /** Requested expiry time */\n    requestedExpiry: Date;\n  }) => Promise<Delegation | undefined>;\n  /** Reject operations after the host session/service graph has been retired. */\n  assertActive?: () => void;\n}\n\n/**\n * Interface for the SharingService.\n */\nexport interface ISharingService {\n  /**\n   * Generate a sharing link with an embedded private key.\n   *\n   * This creates a new session key, delegates to it, and encodes\n   * the key and delegation into a shareable link.\n   */\n  generate(params: GenerateShareParams): Promise<Result<ShareLink, DelegationError>>;\n\n  /**\n   * Receive and activate a sharing link.\n   *\n   * Decodes the link, ingests the key into the registry, and optionally\n   * creates a sub-delegation to the current session key.\n   */\n  receive(link: string, options?: ReceiveOptions): Promise<Result<ShareAccess, DelegationError>>;\n\n  /** Receive a signed v2 envelope/link without changing the legacy tc1 API. */\n  receiveV2(\n    link: string,\n    options?: Omit<ShareRecipientClientOptions, \"trustedOrigins\" | \"fetch\" | \"invoke\" | \"createKVService\">,\n  ): Promise<ShareAccessV2>;\n\n  /**\n   * Consume a sharing link locally and create an attenuated child delegation.\n   * The raw link and embedded private JWK are never returned. The returned\n   * child delegation is itself a sensitive bearer credential.\n   */\n  delegateReceivedShare(\n    link: string,\n    params: DelegateReceivedShareParams\n  ): Promise<Result<DelegatedShareAccess, DelegationError>>;\n\n  /**\n   * Encode sharing data into a link string.\n   */\n  encodeLink(data: EncodedShareData, schema?: ShareSchema): string;\n\n  /**\n   * Decode a link string into sharing data.\n   */\n  decodeLink(link: string): EncodedShareData;\n}\n\n// =============================================================================\n// Implementation\n// =============================================================================\n\n/**\n * SharingService - v2 sharing link service with embedded private keys.\n *\n * @example\n * ```typescript\n * import { SharingService } from \"@tinycloud/sdk-core/delegations\";\n *\n * const sharing = new SharingService({\n *   hosts: [\"https://node.tinycloud.xyz\"],\n *   session,\n *   invoke,\n *   keyProvider,\n *   registry,\n *   delegationManager,\n *   createKVService,\n *   baseUrl: \"https://share.myapp.com\"\n * });\n *\n * // Generate a sharing link\n * const result = await sharing.generate({\n *   path: \"/kv/documents/report.pdf\",\n *   actions: [\"tinycloud.kv/get\"],\n *   expiry: new Date(\"2024-12-31\")\n * });\n *\n * if (result.ok) {\n *   console.log(\"Share this URL:\", result.data.url);\n * }\n *\n * // Receive a sharing link\n * const receiveResult = await sharing.receive(shareUrl);\n * if (receiveResult.ok) {\n *   // Use the pre-configured KV service\n *   const data = await receiveResult.data.kv.get(\"report.pdf\");\n * }\n * ```\n */\nexport class SharingService implements ISharingService {\n  private hosts: string[];\n  private session?: ServiceSession;\n  private invoke: InvokeFunction;\n  private fetchFn: FetchFunction;\n  private keyProvider: KeyProvider;\n  private registry: ICapabilityKeyRegistry;\n  private delegationManager?: DelegationManager;\n  private createKVService: SharingServiceConfig[\"createKVService\"];\n  private baseUrl: string;\n  private createDelegationFn?: SharingServiceConfig[\"createDelegation\"];\n  private createDelegationWasmFn?: SharingServiceConfig[\"createDelegationWasm\"];\n  private computeCidFn?: SharingServiceConfig[\"computeCid\"];\n  private pathPrefix: string;\n  private sessionExpiry?: Date;\n  private onRootDelegationNeeded?: SharingServiceConfig[\"onRootDelegationNeeded\"];\n  private assertActiveFn?: SharingServiceConfig[\"assertActive\"];\n\n  /**\n   * Creates a new SharingService instance.\n   */\n  constructor(config: SharingServiceConfig) {\n    this.hosts = config.hosts;\n    this.session = config.session;\n    this.invoke = config.invoke;\n    this.fetchFn = config.fetch ?? globalThis.fetch.bind(globalThis);\n    this.keyProvider = config.keyProvider;\n    this.registry = config.registry;\n    this.delegationManager = config.delegationManager;\n    this.createKVService = config.createKVService;\n    this.baseUrl = (config.baseUrl ?? \"\").replace(/\\/$/, \"\"); // Remove trailing slash\n    this.createDelegationFn = config.createDelegation;\n    this.createDelegationWasmFn = config.createDelegationWasm;\n    this.computeCidFn = config.computeCid;\n    this.pathPrefix = config.pathPrefix ?? \"\";\n    this.sessionExpiry = config.sessionExpiry;\n    this.onRootDelegationNeeded = config.onRootDelegationNeeded;\n    this.assertActiveFn = config.assertActive;\n  }\n\n  /**\n   * Gets the primary host URL.\n   */\n  private get host(): string {\n    return this.hosts[0];\n  }\n\n  /**\n   * Updates the session (e.g., after re-authentication).\n   */\n  public updateSession(session: ServiceSession): void {\n    this.assertActiveFn?.();\n    this.session = session;\n  }\n\n  /**\n   * Updates the service configuration.\n   * Used to add full capabilities (session, delegationManager, createDelegation, createDelegationWasm) after signIn.\n   */\n  public updateConfig(config: Partial<Pick<SharingServiceConfig, \"session\" | \"delegationManager\" | \"createDelegation\" | \"createDelegationWasm\" | \"sessionExpiry\" | \"onRootDelegationNeeded\" | \"assertActive\">>): void {\n    this.assertActiveFn?.();\n    if (config.session !== undefined) {\n      this.session = config.session;\n    }\n    if (config.delegationManager !== undefined) {\n      this.delegationManager = config.delegationManager;\n    }\n    if (config.createDelegation !== undefined) {\n      this.createDelegationFn = config.createDelegation;\n    }\n    if (config.createDelegationWasm !== undefined) {\n      this.createDelegationWasmFn = config.createDelegationWasm;\n    }\n    if (config.sessionExpiry !== undefined) {\n      this.sessionExpiry = config.sessionExpiry;\n    }\n    if (config.onRootDelegationNeeded !== undefined) {\n      this.onRootDelegationNeeded = config.onRootDelegationNeeded;\n    }\n    if (config.assertActive !== undefined) {\n      this.assertActiveFn = config.assertActive;\n    }\n  }\n\n  /**\n   * Generate a sharing link with an embedded private key.\n   *\n   * Flow:\n   * 1. Spawn new session key (unique per share)\n   * 2. Create delegation from current session to spawned key\n   * 3. Package: { key (with private!), delegation, path, host }\n   * 4. Encode based on schema (base64 for now)\n   * 5. Return link string\n   */\n  async generate(params: GenerateShareParams): Promise<Result<ShareLink, DelegationError>> {\n    const activeError = this.retiredGraphError();\n    if (activeError) return { ok: false, error: activeError };\n\n    // Require session for generating (not for receiving)\n    if (!this.session) {\n      return {\n        ok: false,\n        error: createError(\n          DelegationErrorCodes.NOT_INITIALIZED,\n          \"Session required for generating sharing links. Call signIn() first.\"\n        ),\n      };\n    }\n\n    // Require delegation capability\n    if (!this.createDelegationWasmFn && !this.createDelegationFn && !this.delegationManager) {\n      return {\n        ok: false,\n        error: createError(\n          DelegationErrorCodes.NOT_INITIALIZED,\n          \"DelegationManager, createDelegation, or createDelegationWasm function required for generating sharing links.\"\n        ),\n      };\n    }\n\n    // Validate path\n    if (!params.path) {\n      return {\n        ok: false,\n        error: createError(\n          DelegationErrorCodes.INVALID_INPUT,\n          \"path is required\"\n        ),\n      };\n    }\n\n    const actions = params.actions ?? DEFAULT_READ_ACTIONS;\n    const requestedExpiry = params.expiry ?? new Date(Date.now() + DEFAULT_EXPIRY_MS);\n    let expiry = requestedExpiry;\n\n    const schema: ShareSchema = params.schema ?? \"base64\";\n\n    // Build full path with prefix (matches how KVService stores data)\n    // If pathPrefix is \"demo-app\" and path is \"hello\", fullPath is \"demo-app/hello\"\n    const fullPath = this.pathPrefix\n      ? `${this.pathPrefix}/${params.path}`.replace(/\\/+/g, \"/\") // Normalize slashes\n      : params.path;\n\n    // Only base64 schema is implemented in v1\n    if (schema !== \"base64\") {\n      return {\n        ok: false,\n        error: createError(\n          DelegationErrorCodes.INVALID_INPUT,\n          `Schema '${schema}' not implemented. Only 'base64' is supported.`\n        ),\n      };\n    }\n\n    // Step 1: Spawn a new session key unique to this share\n    // We create this FIRST so we can pass its DID to onRootDelegationNeeded if needed\n    let keyId: string;\n    let keyDid: string;\n    let keyJwk: JWK;\n\n    try {\n      const shareKeyName = `share:${Date.now()}:${Math.random().toString(36).substring(2, 10)}`;\n      keyId = await this.keyProvider.createSessionKey(shareKeyName);\n      const keyCreationActiveError = this.retiredGraphError();\n      if (keyCreationActiveError) return { ok: false, error: keyCreationActiveError };\n      keyDid = await this.keyProvider.getDID(keyId);\n      const keyDidActiveError = this.retiredGraphError();\n      if (keyDidActiveError) return { ok: false, error: keyDidActiveError };\n      keyJwk = this.keyProvider.getJWK(keyId) as JWK;\n\n      // Ensure the private key is included\n      if (!keyJwk.d) {\n        return {\n          ok: false,\n          error: createError(\n            DelegationErrorCodes.CREATION_FAILED,\n            \"KeyProvider did not return private key (d parameter) in JWK\"\n          ),\n        };\n      }\n    } catch (err) {\n      return {\n        ok: false,\n        error: createError(\n          DelegationErrorCodes.CREATION_FAILED,\n          `Failed to generate session key for share: ${err instanceof Error ? err.message : String(err)}`,\n          err instanceof Error ? err : undefined\n        ),\n      };\n    }\n\n    // Step 2: Check if any existing key can satisfy this delegation\n    // Only prompt for root delegation if NO existing key in the registry can handle it\n    let delegation: Delegation;\n    // Strip fragment from DID URL to get plain DID for UCAN audience\n    // getDID() returns \"did:key:z6Mk...#z6Mk...\" but audience needs \"did:key:z6Mk...\"\n    const plainDID = keyDid.split('#')[0];\n\n    // Helper to handle delegation result (returns early on error)\n    const handleDelegationResult = (\n      result: Awaited<ReturnType<typeof this.createSessionDelegation>>\n    ): Delegation | { ok: false; error: DelegationError } => {\n      if (result && typeof result === 'object' && 'ok' in result) {\n        return result as { ok: false; error: DelegationError };\n      }\n      return result as Delegation;\n    };\n\n    // Check if any key in the registry can satisfy this delegation request\n    // A key can satisfy the request if it has a delegation that:\n    // 1. Covers the required path and actions\n    // 2. Has sufficient expiry (delegation.expiry >= requestedExpiry)\n    // 3. Allows sub-delegation\n    const canSatisfyFromRegistry = this.findSuitableKeyForDelegation(\n      fullPath,\n      actions,\n      requestedExpiry\n    );\n\n    if (canSatisfyFromRegistry) {\n      // An existing key can satisfy this request - use session delegation (no prompt)\n      const delegationResult = await this.createSessionDelegation(plainDID, fullPath, actions, expiry);\n      const childDelegationActiveError = this.retiredGraphError();\n      if (childDelegationActiveError) return { ok: false, error: childDelegationActiveError };\n      const parsed = handleDelegationResult(delegationResult);\n      if ('ok' in parsed && parsed.ok === false) {\n        return parsed;\n      }\n      delegation = parsed as Delegation;\n    } else if (this.onRootDelegationNeeded) {\n      // No existing key can satisfy the request - try root delegation\n      try {\n        const rootDelegation = await this.onRootDelegationNeeded({\n          shareKeyDID: plainDID,\n          spaceId: this.session.spaceId,\n          path: fullPath,\n          actions,\n          requestedExpiry,\n        });\n        const rootDelegationActiveError = this.retiredGraphError();\n        if (rootDelegationActiveError) return { ok: false, error: rootDelegationActiveError };\n\n        if (rootDelegation) {\n          delegation = rootDelegation;\n          expiry = requestedExpiry;\n        } else {\n          return {\n            ok: false,\n            error: createError(\n              DelegationErrorCodes.PERMISSION_DENIED,\n              \"The active session ReCap does not authorize this sharing delegation.\",\n            ),\n          };\n        }\n      } catch (err) {\n        // `onRootDelegationNeeded` re-opens the wallet/OpenKey signing surface\n        // mid-compose, long after sign-in. An unanswered or cancelled signature\n        // is a completely different problem from \"you are not authorized\", and\n        // must not be reported as the same thing.\n        return { ok: false, error: rootDelegationSigningError(err) };\n      }\n    } else {\n      return {\n        ok: false,\n        error: createError(\n          DelegationErrorCodes.PERMISSION_DENIED,\n          \"The active session ReCap does not authorize this sharing delegation.\",\n        ),\n      };\n    }\n\n    const finalActiveError = this.retiredGraphError();\n    if (finalActiveError) return { ok: false, error: finalActiveError };\n\n    // Step 3: Package the share data\n    const shareData: EncodedShareData = {\n      key: keyJwk,\n      keyDid,\n      delegation,\n      path: fullPath,\n      host: this.host,\n      spaceId: this.session.spaceId,\n      version: 1,\n    };\n\n    // Step 4: Encode the link\n    const encodedData = this.encodeLink(shareData, schema);\n\n    // Step 5: Build the full URL\n    const baseUrl = params.baseUrl ?? this.baseUrl;\n    const url = baseUrl ? `${baseUrl}/share/${encodedData}` : encodedData;\n\n    const shareLink: ShareLink = {\n      token: encodedData,\n      url,\n      delegation,\n      schema,\n      expiresAt: expiry,\n      description: params.description,\n    };\n\n    return { ok: true, data: shareLink };\n  }\n\n  /**\n   * Check if any key in the registry can satisfy the delegation request.\n   * A key can satisfy if it has a delegation that:\n   * 1. Covers the required path (exact match or parent path)\n   * 2. Has all required actions\n   * 3. Has sufficient expiry (delegation.expiry >= requestedExpiry)\n   * 4. Allows sub-delegation\n   * @internal\n   */\n  private findSuitableKeyForDelegation(\n    path: string,\n    actions: string[],\n    requestedExpiry: Date\n  ): boolean {\n    // Check registry for keys with sufficient capabilities\n    const allKeys = this.registry.getAllKeys();\n    for (const key of allKeys) {\n      const delegations = this.registry.getDelegationsForKey(key.id);\n      for (const delegation of delegations) {\n        // A registry can contain capabilities for several spaces. A share\n        // created by this service may only spend authority for its own\n        // session space.\n        if (delegation.spaceId !== this.session?.spaceId) {\n          continue;\n        }\n\n        // SharingService cannot reproduce arbitrary signed ReCap caveats when\n        // issuing a child delegation.  Treat caveated authority as unusable\n        // here rather than minting a broader child capability.\n        if ((delegation.caveats?.length ?? 0) > 0) {\n          continue;\n        }\n\n        // Check if delegation is valid and not expired\n        if (!this.registry.isDelegationValid(delegation)) {\n          continue;\n        }\n\n        // Check if delegation has sufficient expiry\n        if (delegation.expiry < requestedExpiry) {\n          continue;\n        }\n\n        // Check if delegation allows sub-delegation\n        if (delegation.allowSubDelegation === false) {\n          continue;\n        }\n\n        // Check if delegation covers the path (exact match or parent path)\n        const delegationPath = delegation.path || '';\n        if (!this.pathMatches(delegationPath, path)) {\n          continue;\n        }\n\n        // Check if delegation has all required actions\n        const delegationActions = delegation.actions || [];\n        const hasAllActions = actions.every(action =>\n          delegationActions.includes(action) || delegationActions.includes('*')\n        );\n        if (!hasAllActions) {\n          continue;\n        }\n\n        // Found a suitable key\n        return true;\n      }\n    }\n\n    return false;\n  }\n\n  private retiredGraphError(): DelegationError | undefined {\n    try {\n      this.assertActiveFn?.();\n      return undefined;\n    } catch (err) {\n      return createError(\n        DelegationErrorCodes.NOT_INITIALIZED,\n        \"The session service graph has been retired.\",\n        err instanceof Error ? err : undefined,\n      );\n    }\n  }\n\n  /**\n   * Check if a delegation path matches/covers the requested path.\n   * A delegation path covers the request if:\n   * - It's an exact match\n   * - It's a parent path (e.g., delegation for \"\" covers \"foo/bar\")\n   * - It uses wildcards that match\n   * @internal\n   */\n  private pathMatches(delegationPath: string, requestedPath: string): boolean {\n    // Empty delegation path covers everything\n    if (delegationPath === '' || delegationPath === '*') {\n      return true;\n    }\n\n    // Exact match\n    if (delegationPath === requestedPath) {\n      return true;\n    }\n\n    // Check if delegation path is a parent of requested path\n    const normalizedDelegation = delegationPath.replace(/\\/$/, '');\n    const normalizedRequest = requestedPath.replace(/\\/$/, '');\n\n    if (normalizedRequest.startsWith(normalizedDelegation + '/')) {\n      return true;\n    }\n\n    return false;\n  }\n\n  /**\n   * Create a delegation from the current session to a share key.\n   * This is the fallback path when root delegation is not available.\n   * @internal\n   */\n  private async createSessionDelegation(\n    delegateDID: string,\n    path: string,\n    actions: string[],\n    expiry: Date\n  ): Promise<Delegation | Result<never, DelegationError>> {\n    const activeError = this.retiredGraphError();\n    if (activeError) return { ok: false, error: activeError };\n\n    if (!this.session) {\n      return {\n        ok: false,\n        error: createError(\n          DelegationErrorCodes.NOT_INITIALIZED,\n          \"Session required for creating delegation\"\n        ),\n      };\n    }\n\n    if (this.createDelegationWasmFn) {\n      // Client-side delegation creation via WASM.\n      //\n      // SharingService always issues single-resource delegations (one\n      // path, one action list). The multi-resource WASM API takes an\n      // `abilities` map shaped `Record<shortService, Record<path,\n      // actions[]>>`, so we infer the short service from the first\n      // action URN (every action in a share call shares the same\n      // service namespace by construction — KV-only, SQL-only, etc).\n      //\n      // The result comes back with a `resources` array; for a\n      // single-entry call it always has exactly one entry, and we\n      // mirror that entry's `path` + `actions` back into the flat\n      // Delegation shape that the rest of SharingService works with.\n      try {\n        if (actions.length === 0) {\n          return {\n            ok: false,\n            error: createError(\n              DelegationErrorCodes.VALIDATION_ERROR,\n              \"createDelegation requires at least one action\"\n            ),\n          };\n        }\n        const shortService = inferShortServiceFromActionUrns(actions);\n        if (shortService === undefined) {\n          return {\n            ok: false,\n            error: createError(\n              DelegationErrorCodes.VALIDATION_ERROR,\n              `createDelegation: cannot infer service from actions ${JSON.stringify(actions)} — expected full URNs like \"tinycloud.kv/get\"`\n            ),\n          };\n        }\n\n        const wasmResult = this.createDelegationWasmFn({\n          session: this.session,\n          delegateDID,\n          spaceId: this.session.spaceId,\n          abilities: {\n            [shortService]: {\n              [path]: [...actions],\n            },\n          },\n          expirationSecs: Math.floor(expiry.getTime() / 1000),\n        });\n        const childSigningActiveError = this.retiredGraphError();\n        if (childSigningActiveError) return { ok: false, error: childSigningActiveError };\n\n        // Register the delegation with the server\n        const registerRes = await this.fetchFn(`${this.host}/delegate`, {\n          method: \"POST\",\n          headers: {\n            Authorization: wasmResult.delegation,\n          },\n        });\n        const registrationActiveError = this.retiredGraphError();\n        if (registrationActiveError) return { ok: false, error: registrationActiveError };\n\n        if (!registerRes.ok) {\n          const errorText = await registerRes.text();\n          const registrationTextActiveError = this.retiredGraphError();\n          if (registrationTextActiveError) return { ok: false, error: registrationTextActiveError };\n          return {\n            ok: false,\n            error: createError(\n              DelegationErrorCodes.CREATION_FAILED,\n              `Failed to register delegation with server: ${registerRes.status} ${errorText}`\n            ),\n          };\n        }\n\n        // Single-entry call → resources[0] is authoritative for the\n        // flat Delegation shape. We assert length here because a\n        // zero-length result would mean the Rust side dropped our\n        // single input — that's a protocol bug, not a runtime\n        // condition to silently coerce.\n        if (wasmResult.resources.length === 0) {\n          return {\n            ok: false,\n            error: createError(\n              DelegationErrorCodes.CREATION_FAILED,\n              \"createDelegation WASM returned empty resources array for a single-entry request\"\n            ),\n          };\n        }\n        const primary = wasmResult.resources[0];\n        return {\n          cid: wasmResult.cid,\n          delegateDID: wasmResult.delegateDID,\n          spaceId: this.session.spaceId,\n          path: primary.path,\n          actions: primary.actions,\n          expiry: wasmResult.expiry,\n          isRevoked: false,\n          authHeader: wasmResult.delegation,\n          allowSubDelegation: true,\n          createdAt: new Date(),\n        };\n      } catch (err) {\n        return {\n          ok: false,\n          error: createError(\n            DelegationErrorCodes.CREATION_FAILED,\n            `Failed to create delegation via WASM: ${err instanceof Error ? err.message : String(err)}`,\n            err instanceof Error ? err : undefined\n          ),\n        };\n      }\n    } else {\n      // Server-side delegation creation (fallback)\n      const delegationParams: CreateDelegationParams = {\n        delegateDID,\n        path,\n        actions,\n        expiry,\n        disableSubDelegation: false,\n      };\n\n      const delegationResult = this.createDelegationFn\n        ? await this.createDelegationFn(delegationParams)\n        : await this.delegationManager!.create(delegationParams);\n      const delegationCreationActiveError = this.retiredGraphError();\n      if (delegationCreationActiveError) return { ok: false, error: delegationCreationActiveError };\n\n      if (!delegationResult.ok) {\n        return {\n          ok: false,\n          error: createError(\n            DelegationErrorCodes.CREATION_FAILED,\n            `Failed to create delegation for share: ${delegationResult.error.message}`,\n            delegationResult.error.cause,\n            delegationResult.error.meta\n          ),\n        };\n      }\n\n      return delegationResult.data;\n    }\n  }\n\n  /**\n   * Receive and activate a sharing link.\n   *\n   * Flow:\n   * 1. Decode link -> extract { key, delegation, path, host }\n   * 2. Ingest key into CapabilityKeyRegistry\n   * 3. If autoSubdelegate (default true) + useSessionKey:\n   *    - Create sub-delegation from ingested key -> current session\n   *    - Register sub-delegation capabilities\n   * 4. Return ShareAccess with pre-configured KV service\n   */\n  async receive(\n    link: string,\n    options: ReceiveOptions = {}\n  ): Promise<Result<ShareAccess, DelegationError>> {\n    const activeError = this.retiredGraphError();\n    if (activeError) return { ok: false, error: activeError };\n\n    const {\n      autoSubdelegate = true,\n      useSessionKey = true,\n      ingestOptions,\n    } = options;\n\n    // Step 1: Decode and validate the link\n    const decodeResult = this.decodeLinkWithValidation(link);\n    if (!decodeResult.ok) {\n      return decodeResult;\n    }\n    const shareData = decodeResult.data;\n\n    // Schema validation ensures key.d and delegation exist, but we need\n    // to check business rules (expiry, revocation) separately\n\n    // Check delegation expiry\n    const delegationExpiry = new Date(shareData.delegation.expiry);\n    if (delegationExpiry < new Date()) {\n      return {\n        ok: false,\n        error: createError(\n          DelegationErrorCodes.AUTH_EXPIRED,\n          \"Sharing link has expired\"\n        ),\n      };\n    }\n\n    // Check delegation revocation\n    if (shareData.delegation.isRevoked) {\n      return {\n        ok: false,\n        error: createError(\n          DelegationErrorCodes.REVOKED,\n          \"Sharing link has been revoked\"\n        ),\n      };\n    }\n\n    // Step 2: Create KeyInfo and ingest into registry\n    const keyInfo: KeyInfo = {\n      id: `ingested:${shareData.keyDid}`,\n      did: shareData.keyDid,\n      type: \"ingested\",\n      jwk: shareData.key,\n      priority: 2, // Ingested keys have lowest priority\n    };\n\n    this.registry.ingestKey(keyInfo, shareData.delegation, ingestOptions);\n\n    // The delegation and key to use for operations\n    let activeDelegation = shareData.delegation;\n    let activeKey = keyInfo;\n\n    // Step 3: Auto-subdelegate if requested\n    if (autoSubdelegate && useSessionKey && this.session) {\n      const child = await this.delegateReceivedShare(link, {\n        delegateDID: this.session.verificationMethod,\n        expectedHost: shareData.host,\n      });\n      if (!child.ok) return child;\n      activeDelegation = child.data.delegation;\n      activeKey = {\n        id: `session:${principalDid(this.session.verificationMethod)}`,\n        did: this.session.verificationMethod,\n        type: \"session\",\n        priority: 0,\n      };\n    }\n\n    // Step 4: Create pre-configured KV service for the shared path\n    // Construct session from share data - no need for existing session\n    // Use the authHeader if available, otherwise fall back to constructing from CID\n    const portableAuthorization = (activeDelegation as Delegation & {\n      delegationHeader?: { Authorization?: string };\n    }).delegationHeader?.Authorization;\n    const authHeader = portableAuthorization ?? activeDelegation.authHeader ?? `Bearer ${activeDelegation.cid}`;\n    const activeSession = activeKey.type === \"session\" && this.session\n      ? this.session\n      : undefined;\n    const shareSession: ServiceSession = {\n      delegationHeader: { Authorization: authHeader },\n      delegationCid: activeDelegation.cid,\n      spaceId: shareData.spaceId,\n      verificationMethod: activeSession?.verificationMethod ?? shareData.keyDid,\n      jwk: activeSession?.jwk ?? shareData.key,\n    };\n\n    const kvService = this.createKVService({\n      hosts: [shareData.host],\n      session: shareSession,\n      invoke: this.invoke,\n      fetch: this.fetchFn,\n      pathPrefix: shareData.path,\n    });\n\n    const shareAccess: ShareAccess = {\n      delegation: activeDelegation,\n      key: activeKey,\n      kv: kvService,\n      spaceId: shareData.spaceId,\n      path: shareData.path,\n    };\n\n    return { ok: true, data: shareAccess };\n  }\n\n  async receiveV2(\n    link: string,\n    options: Omit<ShareRecipientClientOptions, \"trustedOrigins\" | \"fetch\" | \"invoke\" | \"createKVService\"> = {},\n  ): Promise<ShareAccessV2> {\n    const client = new ShareRecipientClient({\n      ...options,\n      trustedOrigins: this.hosts,\n      fetch: this.fetchFn,\n      invoke: this.invoke,\n      createKVService: this.createKVService,\n    });\n    return client.open(link);\n  }\n\n  /**\n   * Create a constrained child delegation from a received sharing link.\n   *\n   * This is the safe handoff for a browser delegating shared input to an\n   * agent or service: the bearer link is decoded and used only in this SDK\n   * instance, while the recipient receives a child UCAN without the embedded\n   * private key. The child UCAN is a sensitive bearer credential and must not\n   * be logged or stored insecurely.\n   */\n  async delegateReceivedShare(\n    link: string,\n    params: DelegateReceivedShareParams\n  ): Promise<Result<DelegatedShareAccess, DelegationError>> {\n    const activeError = this.retiredGraphError();\n    if (activeError) return { ok: false, error: activeError };\n\n    const decoded = this.decodeLinkWithValidation(link);\n    if (!decoded.ok) return decoded;\n    const shareData = decoded.data;\n    this.assertDelegationCaveatsPreservable(shareData.delegation);\n\n    const parentExpiry = new Date(shareData.delegation.expiry);\n    const now = new Date();\n    if (parentExpiry <= now) {\n      return {\n        ok: false,\n        error: createError(DelegationErrorCodes.AUTH_EXPIRED, \"Sharing link has expired\"),\n      };\n    }\n    if (shareData.delegation.isRevoked) {\n      return {\n        ok: false,\n        error: createError(DelegationErrorCodes.REVOKED, \"Sharing link has been revoked\"),\n      };\n    }\n    if (shareData.delegation.allowSubDelegation === false) {\n      return {\n        ok: false,\n        error: createError(\n          DelegationErrorCodes.PERMISSION_DENIED,\n          \"Sharing link does not allow delegation\"\n        ),\n      };\n    }\n    const delegateDID = principalDid(params.delegateDID?.trim() ?? \"\");\n    if (!/^did:(?:key|pkh):[^\\s]+$/.test(delegateDID)) {\n      return {\n        ok: false,\n        error: createError(DelegationErrorCodes.INVALID_INPUT, \"A valid delegateDID is required\"),\n      };\n    }\n    const trustedHost = trustedNodeOrigin(shareData.host, this.hosts, params.expectedHost);\n    if (!trustedHost) {\n      return {\n        ok: false,\n        error: createError(\n          DelegationErrorCodes.PERMISSION_DENIED,\n          \"Sharing-link host is not a configured TinyCloud host\"\n        ),\n      };\n    }\n    if (\n      shareData.delegation.spaceId !== shareData.spaceId ||\n      principalDid(shareData.delegation.delegateDID) !== principalDid(shareData.keyDid) ||\n      !shareKeyMatchesDid(shareData.key, shareData.keyDid) ||\n      !capabilityPathContains(shareData.delegation.path, shareData.path)\n    ) {\n      return {\n        ok: false,\n        error: createError(\n          DelegationErrorCodes.INVALID_TOKEN,\n          \"Sharing-link metadata does not match its parent delegation\"\n        ),\n      };\n    }\n    if (!shareData.delegation.authHeader) {\n      return {\n        ok: false,\n        error: createError(\n          DelegationErrorCodes.INVALID_TOKEN,\n          \"Sharing link is missing its signed parent delegation\"\n        ),\n      };\n    }\n    if (!this.createDelegationWasmFn || !this.computeCidFn) {\n      return {\n        ok: false,\n        error: createError(\n          DelegationErrorCodes.NOT_INITIALIZED,\n          \"Client-side delegation and CID support are required\"\n        ),\n      };\n    }\n\n    const path = params.path ?? shareData.path;\n    if (!capabilityPathContains(shareData.path, path)) {\n      return {\n        ok: false,\n        error: createError(\n          DelegationErrorCodes.PERMISSION_DENIED,\n          \"Requested path exceeds the sharing-link capability\"\n        ),\n      };\n    }\n\n    const parentActions = shareData.delegation.actions;\n    const actions = params.actions ?? [...parentActions];\n    if (\n      actions.length === 0 ||\n      new Set(actions).size !== actions.length ||\n      actions.includes(\"*\") ||\n      actions.some((action) => !parentActions.some((parentAction) => actionContains(parentAction, action)))\n    ) {\n      return {\n        ok: false,\n        error: createError(\n          DelegationErrorCodes.PERMISSION_DENIED,\n          \"Requested actions exceed the sharing-link capability\"\n        ),\n      };\n    }\n\n    const expiry = params.expiry ?? parentExpiry;\n    if (expiry <= now || expiry > parentExpiry) {\n      return {\n        ok: false,\n        error: createError(\n          DelegationErrorCodes.PERMISSION_DENIED,\n          \"Child delegation expiry must be active and no later than the sharing link\"\n        ),\n      };\n    }\n\n    const service = inferShortServiceFromActionUrns(actions);\n    if (!service) {\n      return {\n        ok: false,\n        error: createError(\n          DelegationErrorCodes.INVALID_INPUT,\n          \"Sharing-link actions must belong to one known TinyCloud service\"\n        ),\n      };\n    }\n\n    const owner = ownerFromSpaceId(shareData.spaceId);\n    if (!owner) {\n      return {\n        ok: false,\n        error: createError(\n          DelegationErrorCodes.INVALID_TOKEN,\n          \"Sharing link has an unsupported owner space\"\n        ),\n      };\n    }\n\n    try {\n      const parentSession: ServiceSession = {\n        delegationHeader: { Authorization: shareData.delegation.authHeader },\n        delegationCid: shareData.delegation.cid,\n        spaceId: shareData.spaceId,\n        verificationMethod: shareData.keyDid,\n        jwk: shareData.key,\n      };\n      const result = this.createDelegationWasmFn({\n        session: parentSession,\n        delegateDID,\n        spaceId: shareData.spaceId,\n        abilities: { [service]: { [path]: actions } },\n        expirationSecs: Math.floor(expiry.getTime() / 1000),\n      });\n      const childSigningActiveError = this.retiredGraphError();\n      if (childSigningActiveError) return { ok: false, error: childSigningActiveError };\n      const verifiedChild = verifySignedChild(result, {\n        delegateDID,\n        issuerDID: principalDid(shareData.keyDid),\n        parentCid: shareData.delegation.cid,\n        service,\n        spaceId: shareData.spaceId,\n        path,\n        actions,\n        expiresAt: expiry,\n        parentExpiresAt: parentExpiry,\n      }, this.computeCidFn);\n      if (!verifiedChild) {\n        return {\n          ok: false,\n          error: createError(\n            DelegationErrorCodes.CREATION_FAILED,\n            \"Delegation signer returned a child outside the requested capability\"\n          ),\n        };\n      }\n\n      const registrationInit = {\n        method: \"POST\",\n        headers: { Authorization: result.delegation },\n        redirect: \"error\" as const,\n      };\n      const registration = await this.fetchFn(new URL(\"/delegate\", trustedHost).toString(), registrationInit);\n      const registrationActiveError = this.retiredGraphError();\n      if (registrationActiveError) return { ok: false, error: registrationActiveError };\n      if (!registration.ok) {\n        throw new Error(`node rejected child delegation (${registration.status})`);\n      }\n\n      const primary = verifiedChild.resource;\n      return {\n        ok: true,\n        data: {\n          delegation: {\n            cid: result.cid,\n            delegateDID: verifiedChild.delegateDID,\n            delegatorDID: shareData.keyDid.split(\"#\")[0],\n            spaceId: shareData.spaceId,\n            path: primary.path,\n            actions: primary.actions,\n            expiry: verifiedChild.expiresAt,\n            isRevoked: false,\n            allowSubDelegation: false,\n            parentCid: shareData.delegation.cid,\n            createdAt: now,\n            delegationHeader: { Authorization: result.delegation },\n            ownerAddress: owner.address,\n            chainId: owner.chainId,\n            host: trustedHost,\n            resources: result.resources,\n            disableSubDelegation: true,\n          },\n          source: {\n            parentCid: shareData.delegation.cid,\n            spaceId: shareData.spaceId,\n            path: primary.path,\n            host: trustedHost,\n            expiresAt: verifiedChild.expiresAt,\n          },\n        },\n      };\n    } catch (err) {\n      return {\n        ok: false,\n        error: createError(\n          DelegationErrorCodes.CREATION_FAILED,\n          \"Failed to create or register the child delegation\"\n        ),\n      };\n    }\n  }\n\n  /**\n   * The child-delegation WASM boundary accepts action-only abilities. Reject\n   * every constrained parent branch before that boundary can broaden it.\n   */\n  private assertDelegationCaveatsPreservable(delegation: Delegation): void {\n    if (recapCaveatsEqual(delegation.caveats, undefined)) return;\n    const service = delegation.actions[0]?.split(\"/\", 1)[0] ?? \"tinycloud.unknown\";\n    const entry: PermissionEntry = {\n      service,\n      space: delegation.spaceId,\n      path: delegation.path,\n      actions: [...delegation.actions],\n      caveats: delegation.caveats ?? [],\n    };\n    throw new CaveatedDelegationUnsupportedError([entry]);\n  }\n\n  /**\n   * Encode sharing data into a link string.\n   *\n   * @param data - The share data to encode\n   * @param schema - The encoding schema (default: \"base64\")\n   * @returns Encoded link string\n   */\n  encodeLink(data: EncodedShareData, schema: ShareSchema = \"base64\"): string {\n    if (schema !== \"base64\") {\n      throw new Error(`Schema '${schema}' not implemented. Only 'base64' is supported.`);\n    }\n\n    const jsonString = JSON.stringify(data);\n    const encoded = base64UrlEncode(jsonString);\n    return `${BASE64_PREFIX}${encoded}`;\n  }\n\n  /**\n   * Decode a link string into sharing data.\n   *\n   * @param link - The encoded link string (may include URL prefix)\n   * @returns Decoded share data\n   * @throws Error if link format is invalid or data fails validation\n   */\n  decodeLink(link: string): EncodedShareData {\n    const result = this.decodeLinkWithValidation(link);\n    if (!result.ok) {\n      throw new Error(result.error.message);\n    }\n    return result.data;\n  }\n\n  /**\n   * Decode and validate a link string into sharing data.\n   *\n   * Internal method that returns a Result instead of throwing.\n   * Used by receive() for proper error handling.\n   *\n   * @param link - The encoded link string (may include URL prefix)\n   * @returns Result with decoded share data or validation error\n   */\n  private decodeLinkWithValidation(link: string): Result<EncodedShareData, DelegationError> {\n    // Extract the encoded data from the link\n    let encoded = link;\n\n    // Handle full URL format: https://share.example.com/share/tc1:...\n    if (link.includes(\"/share/\")) {\n      const parts = link.split(\"/share/\");\n      encoded = parts[parts.length - 1];\n    }\n\n    // Handle query parameter format: ?share=tc1:...\n    if (link.includes(\"?share=\")) {\n      try {\n        const url = new URL(link);\n        encoded = url.searchParams.get(\"share\") ?? encoded;\n      } catch {\n        return {\n          ok: false,\n          error: createError(\n            DelegationErrorCodes.INVALID_TOKEN,\n            \"Invalid URL format in sharing link\"\n          ),\n        };\n      }\n    }\n\n    // Remove the schema prefix\n    if (!encoded.startsWith(BASE64_PREFIX)) {\n      return {\n        ok: false,\n        error: createError(\n          DelegationErrorCodes.INVALID_TOKEN,\n          `Invalid sharing link format. Expected prefix '${BASE64_PREFIX}'`\n        ),\n      };\n    }\n\n    const base64Data = encoded.slice(BASE64_PREFIX.length);\n\n    let jsonString: string;\n    try {\n      jsonString = base64UrlDecode(base64Data);\n    } catch (err) {\n      return {\n        ok: false,\n        error: createError(\n          DelegationErrorCodes.INVALID_TOKEN,\n          `Failed to decode base64 data: ${err instanceof Error ? err.message : String(err)}`,\n          err instanceof Error ? err : undefined\n        ),\n      };\n    }\n\n    let parsed: unknown;\n    try {\n      parsed = JSON.parse(jsonString);\n    } catch (err) {\n      return {\n        ok: false,\n        error: createError(\n          DelegationErrorCodes.INVALID_TOKEN,\n          `Failed to parse share data JSON: ${err instanceof Error ? err.message : String(err)}`,\n          err instanceof Error ? err : undefined\n        ),\n      };\n    }\n\n    // Convert delegation expiry to Date before validation if it's a string\n    // This is needed because JSON.parse doesn't restore Date objects\n    if (\n      parsed &&\n      typeof parsed === \"object\" &&\n      \"delegation\" in parsed &&\n      parsed.delegation &&\n      typeof parsed.delegation === \"object\" &&\n      \"expiry\" in parsed.delegation &&\n      typeof parsed.delegation.expiry === \"string\"\n    ) {\n      (parsed.delegation as { expiry: Date }).expiry = new Date(parsed.delegation.expiry);\n    }\n\n    // Validate against schema\n    const validationResult = validateEncodedShareData(parsed);\n    if (!validationResult.ok) {\n      return {\n        ok: false,\n        error: createError(\n          DelegationErrorCodes.INVALID_TOKEN,\n          validationResult.error.message,\n          undefined,\n          validationResult.error.meta\n        ),\n      };\n    }\n\n    return { ok: true, data: validationResult.data };\n  }\n}\n\n/**\n * Create a new SharingService instance.\n */\nexport function createSharingService(config: SharingServiceConfig): ISharingService {\n  return new SharingService(config);\n}\n\nfunction ownerFromSpaceId(spaceId: string): { chainId: number; address: string } | null {\n  const match = spaceId.match(/^tinycloud:pkh:eip155:(\\d+):(0x[a-fA-F0-9]{40}):/);\n  if (!match) return null;\n  const chainId = Number(match[1]);\n  if (!Number.isSafeInteger(chainId)) return null;\n  return { chainId, address: match[2] };\n}\n\nfunction parseTrustedNodeOrigin(value: string): string | null {\n  try {\n    const url = new URL(value);\n    if (\n      ![\"http:\", \"https:\"].includes(url.protocol) ||\n      url.username ||\n      url.password ||\n      (url.pathname !== \"\" && url.pathname !== \"/\") ||\n      url.search ||\n      url.hash\n    ) return null;\n    return url.origin.toLowerCase();\n  } catch {\n    return null;\n  }\n}\n\nfunction trustedNodeOrigin(candidate: string, configured: string[], expected?: string): string | null {\n  const origin = parseTrustedNodeOrigin(candidate);\n  if (!origin) return null;\n  const allowed = new Set(configured.map(parseTrustedNodeOrigin).filter((value): value is string => Boolean(value)));\n  if (!allowed.has(origin)) return null;\n  if (expected && parseTrustedNodeOrigin(expected) !== origin) return null;\n  return origin;\n}\n\nfunction canonicalCapabilityPath(path: string): string | null {\n  if (\n    /[\\u0000-\\u001f\\\\]/.test(path) ||\n    /%(?:2e|2f|5c)/i.test(path) ||\n    path.includes(\"//\")\n  ) return null;\n  const wildcardIndex = path.indexOf(\"*\");\n  if (wildcardIndex !== -1 && !path.endsWith(\"/*\") && !path.endsWith(\"/**\")) return null;\n  if (path.slice(0, -3).includes(\"*\") || (path.endsWith(\"/*\") && path.slice(0, -2).includes(\"*\"))) return null;\n  const segments = path.split(\"/\");\n  if (segments.some((segment) => segment === \".\" || segment === \"..\")) return null;\n  return path;\n}\n\nfunction capabilityPathContains(parent: string, child: string): boolean {\n  const canonicalParent = canonicalCapabilityPath(parent);\n  const canonicalChild = canonicalCapabilityPath(child);\n  if (canonicalParent === null || canonicalChild === null) return false;\n  if (canonicalParent === \"\" || canonicalParent === \"/\") return true;\n  if (canonicalParent === canonicalChild) return true;\n  if (canonicalParent.endsWith(\"/**\")) {\n    return canonicalChild.startsWith(canonicalParent.slice(0, -2));\n  }\n  if (canonicalParent.endsWith(\"/*\")) {\n    const prefix = canonicalParent.slice(0, -1);\n    if (!canonicalChild.startsWith(prefix)) return false;\n    const remainder = canonicalChild.slice(prefix.length);\n    return remainder.length > 0 && !remainder.includes(\"/\");\n  }\n  return canonicalParent.endsWith(\"/\") && canonicalChild.startsWith(canonicalParent);\n}\n\nfunction shareKeyMatchesDid(key: JWK, didUrl: string): boolean {\n  if (\n    key.kty !== \"OKP\" ||\n    key.crv !== \"Ed25519\" ||\n    typeof key.x !== \"string\" ||\n    typeof key.d !== \"string\"\n  ) return false;\n  try {\n    const didBytes = bases.base58btc.decode(principalDid(didUrl).slice(\"did:key:\".length));\n    const publicKey = didBytes.length === 34 && didBytes[0] === 0xed && didBytes[1] === 0x01\n      ? didBytes.slice(2)\n      : null;\n    if (!publicKey) return false;\n    const jwkBytes = decodeBase64UrlBytes(key.x);\n    const privateKey = decodeBase64UrlBytes(key.d);\n    const derivedPublicKey = ed25519.getPublicKey(privateKey);\n    return (\n      privateKey.length === 32 &&\n      publicKey.length === jwkBytes.length &&\n      publicKey.every((byte, index) => byte === jwkBytes[index]) &&\n      derivedPublicKey.length === jwkBytes.length &&\n      derivedPublicKey.every((byte, index) => byte === jwkBytes[index])\n    );\n  } catch {\n    return false;\n  }\n}\n\nfunction decodeBase64UrlBytes(value: string): Uint8Array {\n  let encoded = value.replace(/-/g, \"+\").replace(/_/g, \"/\");\n  while (encoded.length % 4) encoded += \"=\";\n  if (typeof atob !== \"undefined\") {\n    return Uint8Array.from(atob(encoded), (character) => character.charCodeAt(0));\n  }\n  return Uint8Array.from(Buffer.from(encoded, \"base64\"));\n}\n\nfunction verifySignedChild(\n  result: CreateDelegationWasmResult,\n  expected: {\n    delegateDID: string;\n    issuerDID: string;\n    parentCid: string;\n    service: string;\n    spaceId: string;\n    path: string;\n    actions: string[];\n    expiresAt: Date;\n    parentExpiresAt: Date;\n  },\n  computeCid: NonNullable<SharingServiceConfig[\"computeCid\"]>,\n): { delegateDID: string; expiresAt: Date; resource: CreateDelegationWasmResult[\"resources\"][number] } | null {\n  const parts = result.delegation.split(\".\");\n  if (parts.length !== 3) return null;\n  let payload: Record<string, unknown>;\n  try {\n    payload = JSON.parse(new TextDecoder().decode(decodeBase64UrlBytes(parts[1]))) as Record<string, unknown>;\n  } catch {\n    return null;\n  }\n  const delegateDID = typeof payload.aud === \"string\" ? principalDid(payload.aud) : \"\";\n  const issuerDID = typeof payload.iss === \"string\" ? principalDid(payload.iss) : \"\";\n  const proofs = Array.isArray(payload.prf) ? payload.prf : [];\n  const expirationSecs = typeof payload.exp === \"number\" && Number.isInteger(payload.exp) ? payload.exp : 0;\n  const expiresAt = new Date(expirationSecs * 1000);\n  if (\n    delegateDID !== expected.delegateDID ||\n    issuerDID !== expected.issuerDID ||\n    proofs.length !== 1 ||\n    proofs[0] !== expected.parentCid ||\n    expiresAt <= new Date() ||\n    expiresAt > expected.expiresAt ||\n    expiresAt > expected.parentExpiresAt ||\n    computeCid(new TextEncoder().encode(result.delegation), 0x55n) !== result.cid\n  ) return null;\n\n  const att = payload.att;\n  if (!att || typeof att !== \"object\" || Array.isArray(att)) return null;\n  const entries = Object.entries(att as Record<string, unknown>);\n  if (entries.length !== 1) return null;\n  const [resourceUri, abilityValue] = entries[0];\n  const prefix = `${expected.spaceId}/${expected.service}/`;\n  if (!resourceUri.startsWith(prefix) || resourceUri.slice(prefix.length) !== expected.path) return null;\n  if (!abilityValue || typeof abilityValue !== \"object\" || Array.isArray(abilityValue)) return null;\n  const signedActions = Object.keys(abilityValue as Record<string, unknown>).sort();\n  const expectedActions = [...expected.actions].sort();\n  if (\n    signedActions.length !== expectedActions.length ||\n    !signedActions.every((action, index) => action === expectedActions[index])\n  ) return null;\n\n  if (principalDid(result.delegateDID) !== delegateDID || result.resources.length !== 1) return null;\n  if (result.expiry.getTime() !== expiresAt.getTime()) return null;\n  const resource = result.resources[0];\n  if (\n    resource.service !== expected.service ||\n    resource.space !== expected.spaceId ||\n    resource.path !== expected.path\n  ) return null;\n  const actualActions = [...resource.actions].sort();\n  if (\n    actualActions.length !== expectedActions.length ||\n    !actualActions.every((action, index) => action === expectedActions[index])\n  ) return null;\n  return { delegateDID, expiresAt, resource };\n}\n","import {\n  ErrorCodes,\n  KVService,\n  ServiceContext,\n  type FetchFunction,\n  type IKVService,\n  type InvokeFunction,\n  type ServiceHeaders,\n  type ServiceSession,\n} from \"@tinycloud/sdk-services\";\nimport { ed25519 } from \"@noble/curves/ed25519\";\nimport { sha256 } from \"@noble/hashes/sha256\";\nimport { base58btc } from \"multiformats/bases/base58\";\nimport {\n  decryptShareBytesAsync,\n  openPublishedShareBlob,\n  parseShareArtifact,\n  parsePublishedShareEnvelope,\n  parseLegacyPublishedShareEnvelope,\n  parsePublishedShareLink,\n  parseShareUrl,\n  shareCapabilityAllows,\n  intersectShareCapabilities,\n  verifyShareCid,\n  verifyPublishedShareCid,\n  verifyShareEnvelope,\n  MAX_SEALED_SHARE_CONTENT_BYTES,\n  MAX_SHARE_ARTIFACT_BYTES,\n  MAX_SHARE_CONTENT_BYTES,\n  type ShareAction,\n  type ShareEnvelopeV2,\n  type ShareLinkLocation,\n  type ShareResource,\n  type ShareCapabilityLike,\n} from \"./share-envelope\";\nimport { MemoryShareCache, type ShareCache, type ShareCacheEntry } from \"./ShareCache\";\nimport { ShareAccessError, ShareConflict, type ShareAccessV2, type ShareDetachedProof, type ShareNativeAction, type ShareNativeInvokeResult, type ShareNativeInvokeSuccessResult, type SharePolicyBinding, type SharePolicySession, type ShareRecipientClientOptions, type ShareReadResult, type ShareMetadataResult, type ShareListEntry, type ShareListResult } from \"./recipient-types\";\nimport { ShareNativeResponseSchema } from \"./recipient-types.schema\";\nimport { importPortableDelegation, parsePortableDelegation, type PortableDelegation } from \"./portable\";\nimport { createCompactPolicyInvocation, parsePolicySessionUcan } from \"../policy/unified\";\n\nconst DEFAULT_MAX_ARTIFACT_BYTES = MAX_SHARE_ARTIFACT_BYTES;\nconst DEFAULT_MAX_CONTENT_BYTES = MAX_SHARE_CONTENT_BYTES;\nconst DEFAULT_MAX_SEALED_CONTENT_BYTES = MAX_SEALED_SHARE_CONTENT_BYTES;\nconst NATIVE_MEDIA_TYPE = \"application/vnd.tinycloud.share+json\" as const;\nconst READ_INVOCATION_DOMAIN_V1 = \"xyz.tinycloud.share/read-invocation/v1\\0\";\nconst READ_INVOCATION_DOMAIN_V2 = \"xyz.tinycloud.share/invocation/v2\\0\";\nconst POLICY_PRESENTATION_DOMAIN_V1 = \"xyz.tinycloud.share/policy-presentation/v1\\0\";\nconst POLICY_PRESENTATION_DOMAIN_V2 = \"xyz.tinycloud.share/policy-session/v2\\0\";\nconst READ_TTL_MS = 60_000;\nconst MAX_NATIVE_CURSOR_BYTES = 8 * 1024;\nconst MAX_NATIVE_LIMIT = 1_000;\nconst MAX_NATIVE_ENTRIES = 10_000;\n\ninterface ResolvedArtifact {\n  readonly location: ShareLinkLocation;\n  readonly artifact: ReturnType<typeof parseShareArtifact>;\n  readonly bytes: Uint8Array;\n  readonly plaintext: Uint8Array;\n}\n\ninterface NativeResponseRecord {\n  readonly type: \"TinyCloudShareInvokeResponse\";\n  readonly version: 2;\n  readonly action: ShareNativeAction;\n  readonly resource: string;\n  readonly mediaType?: string;\n  readonly content?: string;\n  readonly bodyDigest?: string;\n  readonly etag?: string | null;\n  readonly entries?: readonly ShareListEntry[];\n  readonly nextCursor?: string | null;\n  readonly contentType?: string;\n  readonly metadata?: Readonly<Record<string, string>>;\n}\n\nfunction redactedCode(error: unknown): string {\n  if (error instanceof ShareAccessError) return error.code;\n  if (error instanceof ShareConflict) return error.code;\n  const code = error && typeof error === \"object\" && \"code\" in error ? (error as { readonly code?: unknown }).code : undefined;\n  if (typeof code !== \"string\") return \"SHARE_INVALID\";\n  if (code === ErrorCodes.KV_PRECONDITION_FAILED || code === ErrorCodes.KV_CONFLICT || code === \"412\") return \"SHARE_CONFLICT\";\n  if (code === \"KV_NOT_FOUND\" || code === \"NOT_FOUND\" || code === \"404\") return \"SHARE_NOT_FOUND\";\n  if (code.includes(\"EXPIRED\") || code === \"expired\") return \"SHARE_EXPIRED\";\n  if (code.includes(\"REVOK\")) return \"SHARE_REVOKED\";\n  if (code.includes(\"AUTH\") || code.includes(\"DENIED\") || code === \"403\" || code === \"401\") return \"SHARE_DENIED\";\n  if (code.includes(\"NETWORK\") || code.includes(\"TIMEOUT\") || code === \"OFFLINE\") return \"SHARE_OFFLINE\";\n  if ([\"invalid-link\", \"invalid-envelope\", \"expired\", \"signature-invalid\", \"cid-mismatch\", \"origin-mismatch\", \"content-too-large\", \"encryption-required\", \"unsafe-plaintext\"].includes(code)) return code;\n  return code.startsWith(\"SHARE_\") ? code : \"SHARE_INVALID\";\n}\n\nfunction asError(error: unknown): ShareAccessError {\n  if (error instanceof ShareAccessError) return error;\n  return new ShareAccessError(redactedCode(error));\n}\n\nfunction operationAction(action: \"get\" | \"metadata\" | \"list\" | \"save\"): ShareAction {\n  return action === \"get\" || action === \"metadata\" ? \"read\" : action === \"list\" ? \"list\" : \"edit\";\n}\n\nfunction normalizePath(value: string): string {\n  const parts = value.split(\"/\");\n  const invalidPart = parts.some((part, index) => part === \"..\" || part === \".\" || (part === \"\" && !(index === parts.length - 1 && value.endsWith(\"/\"))));\n  if (value === \"\" || value.startsWith(\"/\") || /[\\u0000-\\u001f\\u007f\\\\]/.test(value) || /%2f|%5c|%2e/i.test(value) || invalidPart) {\n    throw new ShareAccessError(\"SHARE_INVALID_PATH\");\n  }\n  return value;\n}\n\nfunction canonicalJsonForProof(value: unknown): string {\n  if (value === null || typeof value === \"string\" || typeof value === \"boolean\") return JSON.stringify(value);\n  if (typeof value === \"number\") {\n    if (!Number.isFinite(value)) throw new ShareAccessError(\"SHARE_SESSION_INVALID\");\n    return JSON.stringify(value);\n  }\n  if (Array.isArray(value)) return `[${value.map(canonicalJsonForProof).join(\",\")}]`;\n  if (typeof value === \"object\") {\n    const object = value as Record<string, unknown>;\n    return `{${Object.keys(object).sort().map((key) => `${JSON.stringify(key)}:${canonicalJsonForProof(object[key])}`).join(\",\")}}`;\n  }\n  throw new ShareAccessError(\"SHARE_SESSION_INVALID\");\n}\n\nfunction base64UrlToBytes(value: string): Uint8Array {\n  if (!/^[A-Za-z0-9_-]*$/.test(value) || value.length % 4 === 1) throw new Error(\"base64url\");\n  const padded = value.replace(/-/g, \"+\").replace(/_/g, \"/\") + \"=\".repeat((4 - value.length % 4) % 4);\n  const decoded = typeof atob === \"function\" ? atob(padded) : Buffer.from(padded, \"base64\").toString(\"binary\");\n  const bytes = Uint8Array.from(decoded, (char) => char.charCodeAt(0));\n  if (bytesToBase64Url(bytes) !== value) throw new Error(\"non-canonical base64url\");\n  return bytes;\n}\n\nfunction bytesToBase64Url(bytes: Uint8Array): string {\n  let binary = \"\";\n  for (const byte of bytes) binary += String.fromCharCode(byte);\n  const encoded = typeof btoa === \"function\" ? btoa(binary) : Buffer.from(bytes).toString(\"base64\");\n  return encoded.replace(/\\+/g, \"-\").replace(/\\//g, \"_\").replace(/=+$/g, \"\");\n}\n\nfunction randomJti(): string {\n  const bytes = new Uint8Array(16);\n  crypto.getRandomValues(bytes);\n  return bytesToBase64Url(bytes);\n}\n\nfunction digestCanonical(value: unknown): string {\n  return bytesToBase64Url(sha256(new TextEncoder().encode(canonicalJsonForProof(value))));\n}\n\nfunction actionWire(action: \"get\" | \"metadata\" | \"list\" | \"put\"): ShareNativeAction {\n  return action === \"get\" ? \"tinycloud.kv/get\" : action === \"metadata\" ? \"tinycloud.kv/metadata\" : action === \"list\" ? \"tinycloud.kv/list\" : \"tinycloud.kv/put\";\n}\n\nfunction nativeActionFor(value: unknown): ShareNativeAction | undefined {\n  if (value === \"tinycloud.kv/get\" || value === \"get\" || value === \"read\") return \"tinycloud.kv/get\";\n  if (value === \"tinycloud.kv/metadata\" || value === \"metadata\") return \"tinycloud.kv/metadata\";\n  if (value === \"tinycloud.kv/list\" || value === \"list\") return \"tinycloud.kv/list\";\n  if (value === \"tinycloud.kv/put\" || value === \"tinycloud.kv/edit\" || value === \"put\" || value === \"edit\") return \"tinycloud.kv/put\";\n  return undefined;\n}\n\nfunction policyActionFor(value: unknown): ShareAction | undefined {\n  const native = nativeActionFor(value);\n  return native === \"tinycloud.kv/get\" || native === \"tinycloud.kv/metadata\" ? \"read\" : native === \"tinycloud.kv/list\" ? \"list\" : native === \"tinycloud.kv/put\" ? \"edit\" : undefined;\n}\n\nfunction canonicalNativeActions(values: readonly unknown[]): ShareNativeAction[] {\n  const actions = values.map(nativeActionFor);\n  if (actions.some((action) => action === undefined)) throw new ShareAccessError(\"SHARE_SESSION_ACTION_MISMATCH\");\n  return [...new Set(actions as ShareNativeAction[])].sort();\n}\n\nfunction resourceValue(value: unknown, stringKind: ShareResource[\"kind\"] = \"exact\"): ShareResource | undefined {\n  if (typeof value === \"string\") {\n    const kind = value.endsWith(\"/\") ? \"prefix\" : stringKind;\n    return { kind, path: kind === \"prefix\" && !value.endsWith(\"/\") ? `${value}/` : value };\n  }\n  if (!isRecord(value) || (value.kind !== \"exact\" && value.kind !== \"prefix\")) return undefined;\n  const path = typeof value.path === \"string\" ? value.path : typeof value.value === \"string\" ? value.value : undefined;\n  return path === undefined ? undefined : { kind: value.kind, path: value.kind === \"prefix\" && !path.endsWith(\"/\") ? `${path}/` : path };\n}\n\nfunction headersRecord(headers: ServiceHeaders | undefined): Record<string, string> {\n  if (headers === undefined) return {};\n  if (Array.isArray(headers)) return Object.fromEntries(headers.map(([key, value]) => [key.toLowerCase(), value]));\n  return Object.fromEntries(Object.entries(headers).map(([key, value]) => [key.toLowerCase(), value]));\n}\n\nfunction isRecord(value: unknown): value is Record<string, unknown> {\n  return value !== null && typeof value === \"object\" && !Array.isArray(value);\n}\n\nfunction isNativeSuccess(result: ShareNativeInvokeResult): result is ShareNativeInvokeSuccessResult {\n  return \"type\" in result;\n}\n\nfunction unwrapProofResponse(value: Record<string, unknown>, key: \"challenge\" | \"session\"): { readonly message: Record<string, unknown>; readonly proof: unknown } {\n  const candidates: Record<string, unknown>[] = [value];\n  for (const wrapper of [\"data\", \"result\", \"body\", \"response\"] as const) {\n    if (isRecord(value[wrapper])) candidates.push(value[wrapper]);\n  }\n  for (const candidate of candidates) {\n    const message = candidate[key];\n    if (isRecord(message)) {\n      const proof = candidate.proof ?? value.proof ?? message.proof;\n      if (proof !== undefined) return { message, proof };\n    }\n  }\n  throw new ShareAccessError(\"SHARE_SESSION_INVALID\", `Node ${key} response is missing its proof`);\n}\n\nfunction canonicalValue(value: unknown): string {\n  if (value === null || typeof value === \"string\" || typeof value === \"boolean\") return JSON.stringify(value);\n  if (typeof value === \"number\" && Number.isFinite(value)) return JSON.stringify(value);\n  if (Array.isArray(value)) return `[${value.map(canonicalValue).join(\",\")}]`;\n  if (isRecord(value)) return `{${Object.keys(value).sort().map((key) => `${JSON.stringify(key)}:${canonicalValue(value[key])}`).join(\",\")}}`;\n  throw new ShareAccessError(\"SHARE_SESSION_INVALID\");\n}\n\nfunction compareBoundValue(left: unknown, right: unknown, message: string): void {\n  if (left !== undefined && right !== undefined && canonicalValue(left) !== canonicalValue(right)) {\n    throw new ShareAccessError(\"SHARE_SESSION_INVALID\", message);\n  }\n}\n\nfunction dateValue(value: unknown): number | undefined {\n  if (typeof value !== \"string\") return undefined;\n  const parsed = Date.parse(value);\n  return Number.isFinite(parsed) ? parsed : undefined;\n}\n\nfunction assertObjectKeys(value: Record<string, unknown>, allowed: readonly string[], label: string): void {\n  const keys = new Set(allowed);\n  if (Object.keys(value).some((key) => !keys.has(key))) throw new ShareAccessError(\"SHARE_SESSION_INVALID\", `${label} contains an unknown field`);\n}\n\nfunction isBearerEnvelope(envelope: ShareEnvelopeV2): boolean {\n  // Missing recipientKind is retained for old bearer artifacts. New policy\n  // artifacts always carry the non-PII discriminator.\n  return envelope.recipientKind === \"bearer\" || (envelope.recipientKind === undefined && envelope.encrypted && (envelope.authorizationTargetKind === undefined || envelope.authorizationTargetKind === \"bearerKey\"));\n}\n\nfunction nativeInvoke(session: ServiceSession, _service: string, _path: string, _action: string): ServiceHeaders {\n  const authorization = session.delegationHeader?.Authorization;\n  if (typeof authorization !== \"string\" || authorization.length === 0) throw new ShareAccessError(\"SHARE_SESSION_REQUIRED\");\n  return { Authorization: authorization };\n}\n\nexport class ShareRecipientClient {\n  private readonly fetchFn: FetchFunction;\n  private readonly cache: ShareCache;\n  private readonly now: () => Date;\n\n  constructor(private readonly options: ShareRecipientClientOptions) {\n    this.fetchFn = options.fetch ?? (globalThis.fetch.bind(globalThis) as FetchFunction);\n    this.cache = options.cache ?? new MemoryShareCache();\n    this.now = options.now ?? (() => new Date());\n  }\n\n  async open(link: string): Promise<ShareAccessV2> {\n    try {\n      const resolved = await this.resolve(link);\n      const { envelope } = resolved.artifact;\n      const { location } = resolved;\n      const bearer = isBearerEnvelope(envelope);\n      const policy = envelope.recipientKind === \"exactEmail\" || envelope.recipientKind === \"emailDomain\" || envelope.authorizationTargetKind === \"recipientDid\";\n      const legacyBearer = !policy && envelope.recipientKind === undefined;\n      let recipientDidSession: SharePolicySession | undefined;\n      if (envelope.authorizationTargetKind === \"recipientDid\") {\n        if (this.options.establishRecipientDidSession === undefined) throw new ShareAccessError(\"SHARE_DEVICE_AUTH_REQUIRED\", \"an OpenKey device authorization is required\");\n        const authorization = await this.options.establishRecipientDidSession({ envelope, recipientDid: envelope.recipient?.kind === \"recipientDid\" ? envelope.recipient.value : \"\" });\n        if (\"state\" in authorization) {\n          if (authorization.state === \"authorization-required\") throw new ShareAccessError(\"SHARE_DEVICE_AUTH_REQUIRED\", \"an OpenKey device authorization is required\", authorization);\n          throw new ShareAccessError(\"SHARE_DENIED\", \"recipient DID authorization was denied\", authorization);\n        }\n        recipientDidSession = authorization;\n      }\n      if (policy && this.options.bearerSession !== undefined) throw new ShareAccessError(\"SHARE_POLICY_BEARER_MISMATCH\");\n      if (bearer && this.options.presentation !== undefined) throw new ShareAccessError(\"SHARE_BEARER_PRESENTATION_MISMATCH\");\n\n      const session = bearer || legacyBearer\n        ? this.options.bearerSession\n        : recipientDidSession\n          ? recipientDidSession\n        : policy && this.options.establishPolicySession !== undefined\n          ? await this.options.establishPolicySession({ envelope, presentation: this.options.presentation })\n          : policy ? await this.establishPolicySession(envelope) : undefined;\n      const policySession = policy ? session as SharePolicySession | undefined : undefined;\n      if (policySession !== undefined) this.assertProvidedPolicySession(policySession, envelope);\n      const portableDelegation = policySession === undefined ? undefined : this.policySessionDelegation(policySession, envelope.origin);\n      const portableInvoke: InvokeFunction | undefined = portableDelegation === undefined\n        ? undefined\n        : this.policyInvocationSigner(portableDelegation);\n      if (portableDelegation !== undefined) {\n        if (this.options.importDelegation === undefined) {\n          await importPortableDelegation(this.fetchFn, envelope.origin, portableDelegation);\n        } else {\n          const imported = await this.options.importDelegation(portableDelegation);\n          if (imported !== undefined) {\n            const normalized = parsePortableDelegation(imported);\n            if (normalized.delegationHeader.Authorization !== portableDelegation.delegationHeader.Authorization) {\n              throw new ShareAccessError(\"SHARE_SESSION_INVALID\", \"delegation importer changed authorization bytes\");\n            }\n          }\n        }\n      }\n      const ordinarySession = portableDelegation === undefined ? undefined : {\n        delegationHeader: portableDelegation.delegationHeader,\n        delegationCid: portableDelegation.cid,\n        spaceId: this.policySessionProjection(portableDelegation).spaceId,\n        verificationMethod: portableDelegation.delegateDID,\n        jwk: this.options.bearerSession?.jwk ?? {},\n      } satisfies ServiceSession;\n      const kv = bearer || legacyBearer || ordinarySession !== undefined\n        ? (session === undefined && ordinarySession === undefined ? undefined : this.createKV(envelope.origin, (ordinarySession ?? session) as ServiceSession, portableInvoke))\n        : undefined;\n      const advertisedCapability: ShareCapabilityLike = { spaceId: envelope.spaceId, resource: envelope.resource, actions: envelope.actions };\n      const capability = policySession?.capability === undefined\n        ? advertisedCapability\n        : intersectShareCapabilities(advertisedCapability, policySession.capability);\n      if (capability === undefined) throw new ShareAccessError(\"SHARE_CAPABILITY_EMPTY\");\n\n      const get = async (path = envelope.resource.kind === \"exact\" ? envelope.resource.path : \"\"): Promise<ShareReadResult> => {\n        try {\n          const resolvedPath = normalizePath(path);\n          this.assertAllowed(capability, \"get\", resolvedPath);\n          if (kv !== undefined) {\n            const result = await kv.get<Uint8Array>(resolvedPath, { binary: true, maxResponseBytes: this.options.maxContentBytes ?? DEFAULT_MAX_CONTENT_BYTES });\n            if (!result.ok) throw result.error;\n            return { bytes: result.data.data, etag: result.data.headers.etag, contentType: result.data.headers.contentType, size: result.data.data.byteLength };\n          }\n          if (policySession !== undefined) return this.nativeGet(envelope, policySession, resolvedPath);\n          if (policy || envelope.resource.kind !== \"exact\" || resolvedPath !== envelope.resource.path) throw new ShareAccessError(\"SHARE_SESSION_REQUIRED\");\n          return { bytes: resolved.plaintext.slice(), contentType: envelope.content.mimeType, size: resolved.plaintext.byteLength };\n        } catch (error) {\n          throw asError(error);\n        }\n      };\n\n      const listChildren = async (input: { readonly path?: string; readonly limit?: number; readonly cursor?: string } = {}): Promise<ShareListResult> => {\n        try {\n          const scope = normalizePath(input.path ?? envelope.resource.path);\n          this.assertAllowed(capability, \"list\", scope);\n          if (kv === undefined && policySession === undefined) throw new ShareAccessError(\"SHARE_SESSION_REQUIRED\");\n          if (portableDelegation !== undefined && kv !== undefined) {\n            const result = await kv.list({ path: scope, limit: input.limit, cursor: input.cursor });\n            if (!result.ok) throw result.error;\n            return { keys: result.data.keys, truncated: result.data.truncated, nextCursor: result.data.nextCursor };\n          }\n          if (policySession !== undefined) return this.nativeList(envelope, policySession, scope, input.limit, input.cursor);\n          const result = await kv!.list({ path: scope, limit: input.limit, cursor: input.cursor });\n          if (!result.ok) throw result.error;\n          // Node is authoritative for direct-child filtering and pagination.\n          return { keys: result.data.keys, truncated: result.data.truncated, nextCursor: result.data.nextCursor };\n        } catch (error) {\n          throw asError(error);\n        }\n      };\n\n      const save = async (path: string, bytes: Uint8Array, input: { readonly etag: string; readonly contentType?: string }): Promise<{ readonly etag?: string }> => {\n        try {\n          const resolvedPath = normalizePath(path);\n          this.assertAllowed(capability, \"save\", resolvedPath);\n          if (kv === undefined && policySession === undefined) throw new ShareAccessError(\"SHARE_SESSION_REQUIRED\");\n          if (portableDelegation !== undefined && kv !== undefined) {\n            const result = await kv.put(resolvedPath, bytes, { contentType: input.contentType ?? envelope.content.mimeType, ifMatch: input.etag });\n            if (!result.ok) {\n              if (result.error.code === ErrorCodes.KV_PRECONDITION_FAILED || result.error.code === ErrorCodes.KV_CONFLICT) throw new ShareConflict(resolvedPath, result.error.meta?.etag as string | undefined);\n              throw result.error;\n            }\n            return { etag: result.data.headers.etag };\n          }\n          if (policySession !== undefined) return this.nativeSave(envelope, policySession, resolvedPath, bytes, input);\n          const result = await kv!.put(resolvedPath, bytes, { contentType: input.contentType ?? envelope.content.mimeType, ifMatch: input.etag });\n          if (!result.ok) {\n            if (result.error.code === ErrorCodes.KV_PRECONDITION_FAILED || result.error.code === ErrorCodes.KV_CONFLICT) throw new ShareConflict(resolvedPath, result.error.meta?.etag as string | undefined);\n            throw result.error;\n          }\n          return { etag: result.data.headers.etag };\n        } catch (error) {\n          if (error instanceof ShareConflict) throw error;\n          throw asError(error);\n        }\n      };\n\n      const metadata = async (path = envelope.resource.kind === \"exact\" ? envelope.resource.path : \"\"): Promise<ShareMetadataResult> => {\n        const resolvedPath = normalizePath(path);\n        this.assertAllowed(capability, \"metadata\", resolvedPath);\n        if (portableDelegation !== undefined && kv !== undefined) {\n          const result = await kv.head(resolvedPath);\n          if (!result.ok) throw result.error;\n          return { metadata: { \"content-type\": result.data.headers.contentType ?? \"application/octet-stream\", \"content-length\": String(result.data.headers.contentLength ?? \"\"), ...(result.data.headers.lastModified === undefined ? {} : { \"last-modified\": result.data.headers.lastModified }) }, etag: result.data.headers.etag, contentType: result.data.headers.contentType, size: result.data.headers.contentLength };\n        }\n        if (policySession !== undefined) return this.nativeMetadata(envelope, policySession, resolvedPath);\n        if (kv === undefined) throw new ShareAccessError(\"SHARE_SESSION_REQUIRED\");\n        const result = await kv.head(resolvedPath);\n        if (!result.ok) throw result.error;\n        return { metadata: { \"content-type\": result.data.headers.contentType ?? \"application/octet-stream\", \"content-length\": String(result.data.headers.contentLength ?? \"\"), ...(result.data.headers.lastModified === undefined ? {} : { \"last-modified\": result.data.headers.lastModified }) }, etag: result.data.headers.etag, contentType: result.data.headers.contentType, size: result.data.headers.contentLength };\n      };\n\n      return { kind: \"share-v2\", envelope, location: { ...location, key: undefined }, resource: envelope.resource, actions: envelope.actions, expiresAt: new Date(envelope.expiresAt), kv, portableDelegation, get, listChildren, save, metadata };\n    } catch (error) {\n      throw asError(error);\n    }\n  }\n\n  private policySessionDelegation(session: SharePolicySession, origin: string): PortableDelegation | undefined {\n    if (session.runtimeDelegation === undefined) return undefined;\n    const delegation = parsePortableDelegation(session.runtimeDelegation);\n    if (delegation.host !== undefined && delegation.host.replace(/\\/+$/, \"\") !== origin.replace(/\\/+$/, \"\")) throw new ShareAccessError(\"SHARE_ORIGIN_MISMATCH\", \"delegation host does not match the trusted share origin\");\n    return delegation;\n  }\n\n  private policyInvocationSigner(delegation: PortableDelegation): InvokeFunction {\n    const privateKey = this.options.policySessionPrivateKey;\n    if (privateKey === undefined) throw new ShareAccessError(\"SHARE_SESSION_SIGNER_REQUIRED\");\n    const session = parsePolicySessionUcan(delegation.delegationHeader.Authorization);\n    if (session.cid !== delegation.cid || session.aud !== delegation.delegateDID)\n      throw new ShareAccessError(\"SHARE_SESSION_INVALID\");\n    return (_serviceSession, service, path, action, facts) => {\n      const serviceName = service.replace(/^tinycloud\\./, \"\");\n      const cleanPath = path.replace(/^\\//, \"\").replace(/\\/$/, \"\");\n      const authority = Object.entries(session.att).find(([parentResource, abilities]) => {\n        if (!(action in abilities)) return false;\n        if (serviceName === \"encryption\") return parentResource.startsWith(\"urn:tinycloud:encryption:\") && parentResource === cleanPath;\n        const match = /^tinycloud:\\/\\/[^/]+\\/kv\\/(.+)$/.exec(parentResource);\n        if (match === null) return false;\n        const parentPath = match[1]!;\n        const caveats = abilities[action] ?? [];\n        const prefix = caveats.some((value) => isRecord(value) && value.kind === \"prefix\");\n        return cleanPath === parentPath || (prefix && cleanPath.startsWith(`${parentPath}/`));\n      });\n      if (authority === undefined) throw new ShareAccessError(\"SHARE_OUT_OF_SCOPE\");\n      const resource = serviceName === \"encryption\"\n        ? authority[0]\n        : `${authority[0].slice(0, authority[0].indexOf(\"/kv/\") + 4)}${cleanPath}`;\n      const caveat = serviceName === \"encryption\" ? {} : { type: \"xyz.tinycloud.resource/selector\", kind: \"exact\", value: resource };\n      const invocation = createCompactPolicyInvocation({\n        sessionAuthorization: delegation.delegationHeader.Authorization,\n        sessionCid: delegation.cid,\n        recipientDid: delegation.delegateDID,\n        audienceDid: String(session.fact.nodeAudience),\n        resource,\n        action,\n        caveat,\n        ...(facts?.length === 1 ? { facts: facts[0] as Readonly<Record<string, unknown>> } : {}),\n        privateKey,\n        now: Math.floor(this.now().getTime() / 1000),\n      });\n      return { Authorization: invocation.authorization };\n    };\n  }\n\n  private policySessionProjection(delegation: PortableDelegation): { readonly spaceId: string } {\n    const session = parsePolicySessionUcan(delegation.delegationHeader.Authorization);\n    if (session.cid !== delegation.cid || session.aud !== delegation.delegateDID) throw new ShareAccessError(\"SHARE_SESSION_INVALID\");\n    const kvResource = Object.keys(session.att).find((resource) => /^tinycloud:\\/\\/[^/]+\\/kv\\/.+$/.test(resource));\n    const match = kvResource === undefined ? undefined : /^tinycloud:\\/\\/([^/]+)\\/kv\\/(.+)$/.exec(kvResource);\n    if (match === undefined || match === null) throw new ShareAccessError(\"SHARE_SESSION_INVALID\");\n    return { spaceId: match[1]! };\n  }\n\n  private createKV(origin: string, session: ServiceSession, invokeOverride?: InvokeFunction): IKVService {\n    const invoke = invokeOverride ?? this.options.invoke ?? nativeInvoke;\n    if (this.options.createKVService !== undefined) {\n      return this.options.createKVService({ hosts: [origin], session, invoke, fetch: this.fetchFn });\n    }\n    const context = new ServiceContext({ hosts: [origin], session, invoke, fetch: this.fetchFn });\n    const service = new KVService({ prefix: \"\" });\n    context.registerService(\"kv\", service);\n    service.initialize(context);\n    return service;\n  }\n\n  private async nativeGet(envelope: ShareEnvelopeV2, session: SharePolicySession, path: string): Promise<ShareReadResult> {\n    this.assertNativeRequestBounds(envelope, session, \"get\", path);\n    const result = await this.invokeNative({ envelope, session, action: \"get\", resource: path, mediaType: \"application/vnd.tinycloud.share+json\" });\n    if (result.status === 404) throw new ShareAccessError(\"SHARE_NOT_FOUND\");\n    if (result.status === 401 || result.status === 403) throw new ShareAccessError(\"SHARE_DENIED\");\n    if (!isNativeSuccess(result)) throw new ShareAccessError(\"SHARE_READ_FAILED\");\n    if (result.status < 200 || result.status >= 300 || result.bytes === undefined) throw new ShareAccessError(\"SHARE_READ_FAILED\");\n    this.verifyNativeResponse(result.bytes, result.headers, result.bodyDigest);\n    if (result.bytes.byteLength > (this.options.maxContentBytes ?? DEFAULT_MAX_CONTENT_BYTES)) throw new ShareAccessError(\"SHARE_TOO_LARGE\");\n    return { bytes: result.bytes, etag: result.headers?.etag ?? result.etag, contentType: result.headers?.[\"content-type\"] ?? result.contentType ?? envelope.content.mimeType, size: result.bytes.byteLength };\n  }\n\n  private async nativeMetadata(envelope: ShareEnvelopeV2, session: SharePolicySession, path: string): Promise<ShareMetadataResult> {\n    this.assertNativeRequestBounds(envelope, session, \"metadata\", path);\n    const result = await this.invokeNative({ envelope, session, action: \"metadata\", resource: path, mediaType: \"application/vnd.tinycloud.share+json\" });\n    if (result.status === 404) throw new ShareAccessError(\"SHARE_NOT_FOUND\");\n    if (result.status === 401 || result.status === 403) throw new ShareAccessError(\"SHARE_DENIED\");\n    if (!isNativeSuccess(result) || result.metadata === undefined) throw new ShareAccessError(\"SHARE_READ_FAILED\");\n    return { metadata: result.metadata, etag: result.headers?.etag ?? result.etag, contentType: result.headers?.[\"content-type\"] ?? result.contentType };\n  }\n\n  private async nativeList(envelope: ShareEnvelopeV2, session: SharePolicySession, path: string, limit?: number, cursor?: string): Promise<ShareListResult> {\n    this.assertNativeRequestBounds(envelope, session, \"list\", path, limit, cursor);\n    const result = await this.invokeNative({ envelope, session, action: \"list\", resource: path, limit, cursor, mediaType: \"application/vnd.tinycloud.share+json\" });\n    if (result.status === 401 || result.status === 403) throw new ShareAccessError(\"SHARE_DENIED\");\n    if (result.status < 200 || result.status >= 300) throw new ShareAccessError(\"SHARE_LIST_FAILED\");\n    if (!isNativeSuccess(result)) throw new ShareAccessError(\"SHARE_LIST_FAILED\");\n    const keys = result.keys ?? result.entries?.map((entry) => entry.path);\n    if (keys === undefined) throw new ShareAccessError(\"SHARE_LIST_FAILED\");\n    const headerCursor = result.headers?.[\"x-tinycloud-next-cursor\"];\n    if (headerCursor !== undefined && result.nextCursor !== undefined && headerCursor !== result.nextCursor) throw new ShareAccessError(\"SHARE_RESPONSE_INTEGRITY\");\n    this.assertNativeListResult(path, { ...result, keys });\n    return { keys, entries: result.entries, truncated: result.truncated, nextCursor: result.nextCursor };\n  }\n\n  private async nativeSave(envelope: ShareEnvelopeV2, session: SharePolicySession, path: string, bytes: Uint8Array, input: { readonly etag: string; readonly contentType?: string }): Promise<{ readonly etag?: string }> {\n    this.assertNativeRequestBounds(envelope, session, \"put\", path);\n    if (bytes.byteLength > (this.options.maxContentBytes ?? DEFAULT_MAX_CONTENT_BYTES)) throw new ShareAccessError(\"SHARE_TOO_LARGE\");\n    const contentType = input.contentType ?? envelope.content.mimeType;\n    if (contentType !== envelope.content.mimeType && !/^text\\/(?:plain|markdown)(?:;|$)/i.test(contentType)) throw new ShareAccessError(\"SHARE_CONTENT_TYPE_INVALID\");\n    const result = await this.invokeNative({ envelope, session, action: \"put\", resource: path, body: bytes, bodyDigest: bytesToBase64Url(sha256(bytes)), contentType, ifMatch: input.etag, mediaType: \"application/vnd.tinycloud.share+json\" });\n    if (result.status === 412 || result.status === 409) throw new ShareConflict(path, result.headers?.etag);\n    if (result.status === 401 || result.status === 403) throw new ShareAccessError(\"SHARE_DENIED\");\n    if (result.status < 200 || result.status >= 300) throw new ShareAccessError(\"SHARE_WRITE_FAILED\");\n    if (!isNativeSuccess(result)) throw new ShareAccessError(\"SHARE_WRITE_FAILED\");\n    return { etag: result.headers?.etag ?? result.etag };\n  }\n\n  private async invokeNative(input: Parameters<NonNullable<ShareRecipientClientOptions[\"nativeInvoke\"]>>[0]): Promise<ShareNativeInvokeResult> {\n    if (this.options.nativeInvoke !== undefined) {\n      const result = await this.options.nativeInvoke(input);\n      if (!Number.isSafeInteger(result.status) || result.status < 100 || result.status > 599) throw new ShareAccessError(\"SHARE_RESPONSE_INVALID\");\n      if (result.status >= 200 && result.status < 300) this.validateNativeResult(input, result);\n      return result;\n    }\n    const base = input.envelope.origin.replace(/\\/$/, \"\");\n    if (input.mediaType !== NATIVE_MEDIA_TYPE) throw new ShareAccessError(\"SHARE_NATIVE_MEDIA_TYPE_INVALID\");\n    const session = input.session;\n    const binding = this.options.policyBinding;\n    const v2 = session.version === 2 || binding?.registrationCid !== undefined;\n    const required = (value: unknown, name: string): string => {\n      if (typeof value !== \"string\" || value.length === 0) throw new ShareAccessError(\"SHARE_SESSION_INVALID\", `Node session ${name} is missing`);\n      return value;\n    };\n    const contentSource = session.contentSource ?? binding?.contentSource;\n    if (!isRecord(contentSource)) throw new ShareAccessError(\"SHARE_SESSION_INVALID\", \"Node content source is missing\");\n    const now = this.now().getTime();\n    const expiry = Math.min(\n      now + READ_TTL_MS,\n      dateValue(session.expiresAt) ?? now,\n      dateValue(input.envelope.expiresAt) ?? now,\n    );\n    if (!Number.isFinite(expiry) || expiry <= now) throw new ShareAccessError(\"SHARE_SESSION_INVALID\", \"Node read expiry is invalid\");\n    const selectedAction = actionWire(input.action);\n    const actionClaims = session.actions !== undefined\n      ? session.actions\n      : binding?.actions !== undefined\n        ? binding.actions\n        : session.action !== undefined\n          ? [session.action]\n          : binding?.action !== undefined\n            ? [binding.action]\n            : [];\n    const authorizedActions = canonicalNativeActions(actionClaims);\n    if (!authorizedActions.includes(selectedAction)) throw new ShareAccessError(\"SHARE_SESSION_ACTION_MISMATCH\");\n    const signedResource = resourceValue(session.resource ?? binding?.resource ?? input.envelope.resource, input.envelope.resource.kind);\n    if (signedResource === undefined || !shareCapabilityAllows({ spaceId: input.envelope.spaceId, resource: signedResource, actions: [policyActionFor(selectedAction)!] }, policyActionFor(selectedAction)!, input.resource)) {\n      throw new ShareAccessError(\"SHARE_OUT_OF_SCOPE\");\n    }\n    const invocationBase: Record<string, unknown> = {\n      type: \"TinyCloudShareReadInvocation\",\n      version: 2,\n      sessionId: required(session.sessionId, \"sessionId\"),\n      shareCid: required(session.shareCid ?? binding?.shareCid, \"shareCid\"),\n      shareId: required(session.shareId ?? binding?.shareId, \"shareId\"),\n      delegationCid: required(session.delegationCid ?? binding?.delegationCid, \"delegationCid\"),\n      policyCid: required(session.policyCid ?? binding?.policyCid, \"policyCid\"),\n      ...(v2 ? {\n        envelopeCid: required(session.envelopeCid ?? binding?.envelopeCid, \"envelopeCid\"),\n        registrationCid: required(session.registrationCid ?? binding?.registrationCid, \"registrationCid\"),\n        enforcementDelegationCid: required(session.enforcementDelegationCid ?? binding?.enforcementDelegationCid, \"enforcementDelegationCid\"),\n      } : {\n        authorityMaterialHandle: required(session.authorityMaterialHandle ?? binding?.authorityMaterialHandle, \"authorityMaterialHandle\"),\n        authorityMaterialDigest: required(session.authorityMaterialDigest ?? binding?.authorityMaterialDigest, \"authorityMaterialDigest\"),\n      }),\n      contentSource,\n      contentSourceDigest: required(session.contentSourceDigest ?? binding?.contentSourceDigest, \"contentSourceDigest\"),\n      holderDid: required(session.holderDid, \"holderDid\"),\n      ...(v2 ? {} : { targetOrigin: required(session.targetOrigin ?? binding?.targetOrigin ?? input.envelope.origin, \"targetOrigin\") }),\n      nodeAudience: required(session.nodeAudience ?? binding?.nodeAudience, \"nodeAudience\"),\n      action: selectedAction,\n      actions: authorizedActions,\n      resource: input.resource,\n      issuedAt: new Date(now).toISOString(),\n      expiresAt: new Date(expiry).toISOString(),\n      jti: randomJti(),\n      ...(input.bodyDigest === undefined ? {} : { bodyDigest: input.bodyDigest }),\n      ...(input.ifMatch === undefined ? {} : { ifMatch: input.ifMatch }),\n      ...(input.contentType === undefined ? {} : { contentType: input.contentType }),\n      ...(v2 ? {} : { ...(input.limit === undefined ? {} : { limit: input.limit }), ...(input.cursor === undefined ? {} : { cursor: input.cursor }), ...(session.expiryMin ?? binding?.expiryMin) === undefined ? {} : { expiryMin: session.expiryMin ?? binding?.expiryMin }, ...(session.expiryMax ?? binding?.expiryMax) === undefined ? {} : { expiryMax: session.expiryMax ?? binding?.expiryMax } }),\n    };\n    const requestBodyDigest = digestCanonical(invocationBase);\n    const invocation: Record<string, unknown> = { ...invocationBase, requestBodyDigest };\n    const signer = this.options.holderSigner ?? session.holderSigner;\n    if (signer === undefined) throw new ShareAccessError(\"SHARE_NATIVE_SIGNER_REQUIRED\");\n    const proof = await signer({ domain: v2 ? READ_INVOCATION_DOMAIN_V2 : READ_INVOCATION_DOMAIN_V1, message: invocation });\n    this.assertDetachedProof(proof);\n    const request: Record<string, unknown> = v2\n      ? {\n        sessionId: invocation.sessionId,\n        envelopeCid: invocation.envelopeCid,\n        shareCid: invocation.shareCid,\n        shareId: invocation.shareId,\n        registrationCid: invocation.registrationCid,\n        delegationCid: invocation.delegationCid,\n        policyCid: invocation.policyCid,\n        enforcementDelegationCid: invocation.enforcementDelegationCid,\n        contentSource,\n        contentSourceDigest: invocation.contentSourceDigest,\n        holderDid: invocation.holderDid,\n        nodeAudience: invocation.nodeAudience,\n        action: invocation.action,\n        actions: invocation.actions,\n        resource: invocation.resource,\n        requestBodyDigest,\n        invocation,\n        proof,\n      }\n      : {\n        sessionId: invocation.sessionId,\n        delegationCid: invocation.delegationCid,\n        authorityMaterialHandle: invocation.authorityMaterialHandle,\n        authorityMaterialDigest: invocation.authorityMaterialDigest,\n        contentSource,\n        contentSourceDigest: invocation.contentSourceDigest,\n        action: invocation.action,\n        actions: invocation.actions,\n        resource: invocation.resource,\n        requestBodyDigest,\n        invocation,\n        proof,\n      };\n    const body = {\n      request,\n      ...(input.limit === undefined ? {} : { limit: input.limit }),\n      ...(input.cursor === undefined ? {} : { cursor: input.cursor }),\n      ...(input.body === undefined ? {} : { body: bytesToBase64Url(input.body) }),\n      ...(input.bodyDigest === undefined ? {} : { bodyDigest: input.bodyDigest }),\n      ...(input.ifMatch === undefined ? {} : { ifMatch: input.ifMatch }),\n      ...(input.contentType === undefined ? {} : { contentType: input.contentType }),\n    };\n    const signed = this.options.signNativeInvoke === undefined\n      ? undefined\n      : await this.options.signNativeInvoke({ envelope: input.envelope, session: input.session, request: body });\n    const transport = this.options.invoke !== undefined || session.authorization !== undefined || session.delegationHeader !== undefined\n      ? this.defaultNativeHeaders(session, input.action, input.resource, body)\n      : undefined;\n    // Addressed shares are ordinary UCAN data-plane operations.  The\n    // sharing-specific v2 resolver is retired for all new sessions; keeping\n    // its URL here silently bypasses the common replay and ancestry kernel.\n    const response = await this.fetchFn(`${base}/invoke`, {\n      method: \"POST\",\n      headers: { ...headersRecord(transport), ...headersRecord(signed), \"content-type\": input.mediaType, accept: input.mediaType },\n      body: JSON.stringify(body),\n      redirect: \"error\",\n    });\n    if ((response as unknown as { readonly redirected?: boolean }).redirected === true || response.status >= 300 && response.status < 400) throw new ShareAccessError(\"SHARE_REDIRECT_REJECTED\");\n    const headers: Record<string, string> = {};\n    for (const name of [\"etag\", \"content-type\", \"content-digest\", \"x-tinycloud-content-digest\", \"x-tinycloud-cid\", \"x-tinycloud-content-cid\", \"x-tinycloud-next-cursor\"]) {\n      const value = response.headers.get(name);\n      if (value !== null) headers[name] = value;\n    }\n    if (response.status < 200 || response.status >= 300) return { status: response.status, headers };\n    const contentType = response.headers.get(\"content-type\") ?? \"\";\n    if (!contentType.toLowerCase().includes(\"json\")) throw new ShareAccessError(\"SHARE_RESPONSE_INVALID\");\n    let value: unknown;\n    let responseBytes: Uint8Array;\n    try { responseBytes = new Uint8Array(await response.arrayBuffer()); } catch { throw new ShareAccessError(\"SHARE_RESPONSE_INVALID\"); }\n    if (responseBytes.byteLength > (this.options.maxArtifactBytes ?? DEFAULT_MAX_ARTIFACT_BYTES)) throw new ShareAccessError(\"SHARE_TOO_LARGE\");\n    try { value = JSON.parse(new TextDecoder(\"utf-8\", { fatal: true }).decode(responseBytes)); } catch { throw new ShareAccessError(\"SHARE_RESPONSE_INVALID\"); }\n    const parsed = ShareNativeResponseSchema.safeParse(value);\n    if (!parsed.success) throw new ShareAccessError(\"SHARE_RESPONSE_INVALID\");\n    const record = parsed.data as NativeResponseRecord;\n    const expectedAction = actionWire(input.action) as ShareNativeAction;\n    if (record.action !== expectedAction || record.version !== 2 || record.resource !== input.resource) {\n      throw new ShareAccessError(\"SHARE_RESPONSE_MISMATCH\");\n    }\n    if (record.etag !== undefined && record.etag !== null && headers.etag !== undefined && record.etag !== headers.etag) throw new ShareAccessError(\"SHARE_RESPONSE_INTEGRITY\");\n    if (record.etag !== undefined && record.etag !== null) headers.etag = record.etag;\n    if (input.action === \"list\") {\n      if (record.entries === undefined) throw new ShareAccessError(\"SHARE_RESPONSE_INVALID\");\n      const rawEntries = record.entries;\n      if (rawEntries.length > MAX_NATIVE_ENTRIES) throw new ShareAccessError(\"SHARE_TOO_LARGE\");\n      const entries: ShareListEntry[] = [...rawEntries];\n      const headerCursor = response.headers.get(\"x-tinycloud-next-cursor\");\n      if (record.nextCursor !== undefined && record.nextCursor !== null && headerCursor !== null && record.nextCursor !== headerCursor) throw new ShareAccessError(\"SHARE_RESPONSE_INTEGRITY\");\n      const nextCursor = (record.nextCursor ?? headerCursor) ?? undefined;\n      if (nextCursor !== undefined && new TextEncoder().encode(nextCursor).byteLength > MAX_NATIVE_CURSOR_BYTES) throw new ShareAccessError(\"SHARE_TOO_LARGE\");\n      return { status: response.status, headers, type: record.type, version: record.version, action: record.action, resource: record.resource, keys: entries.map((entry) => entry.path), entries, truncated: nextCursor !== undefined, nextCursor };\n    }\n    if (input.action === \"get\") {\n      if (record.content === undefined || record.bodyDigest === undefined) throw new ShareAccessError(\"SHARE_RESPONSE_INVALID\");\n      let bytes: Uint8Array;\n      try { bytes = base64UrlToBytes(record.content); } catch { throw new ShareAccessError(\"SHARE_RESPONSE_INVALID\"); }\n      if (bytes.byteLength > (this.options.maxContentBytes ?? DEFAULT_MAX_CONTENT_BYTES) || !this.digestMatches(record.bodyDigest, bytes)) throw new ShareAccessError(\"SHARE_RESPONSE_INTEGRITY\");\n      return { status: response.status, headers, bytes, bodyDigest: record.bodyDigest, type: record.type, version: record.version, action: record.action, resource: record.resource };\n    }\n    if (input.action === \"metadata\") {\n      if (record.metadata === undefined) throw new ShareAccessError(\"SHARE_RESPONSE_INVALID\");\n      return { status: response.status, headers, metadata: record.metadata, etag: record.etag ?? undefined, type: record.type, version: record.version, action: record.action, resource: record.resource };\n    }\n    const responseEtag = record.etag;\n    const responseBodyDigest = record.bodyDigest;\n    if (responseEtag === undefined || responseEtag === null || responseEtag.length === 0 || headers.etag !== undefined && responseEtag !== headers.etag) throw new ShareAccessError(\"SHARE_RESPONSE_INVALID\");\n    if (input.bodyDigest === undefined || responseBodyDigest === undefined || responseBodyDigest !== input.bodyDigest || !this.digestMatches(responseBodyDigest, input.body ?? new Uint8Array())) throw new ShareAccessError(\"SHARE_RESPONSE_INTEGRITY\");\n    return { status: response.status, headers, bodyDigest: responseBodyDigest, type: record.type, version: record.version, action: record.action, resource: record.resource };\n  }\n\n  private validateNativeResult(input: Parameters<NonNullable<ShareRecipientClientOptions[\"nativeInvoke\"]>>[0], result: ShareNativeInvokeResult): void {\n    if (!isNativeSuccess(result)) throw new ShareAccessError(\"SHARE_RESPONSE_MISMATCH\");\n    if (result.type !== \"TinyCloudShareInvokeResponse\" || result.version !== 2 || result.action !== actionWire(input.action) || result.resource !== input.resource) throw new ShareAccessError(\"SHARE_RESPONSE_MISMATCH\");\n    if (input.action === \"get\") {\n      if (result.bytes === undefined || result.bodyDigest === undefined || !this.digestMatches(result.bodyDigest, result.bytes)) throw new ShareAccessError(\"SHARE_RESPONSE_INTEGRITY\");\n      if (result.bytes.byteLength > (this.options.maxContentBytes ?? DEFAULT_MAX_CONTENT_BYTES)) throw new ShareAccessError(\"SHARE_TOO_LARGE\");\n    }\n    if (input.action === \"metadata\" && result.metadata === undefined) throw new ShareAccessError(\"SHARE_RESPONSE_INVALID\");\n    if (input.action === \"list\") this.assertNativeListResult(input.resource, result);\n    if (input.action === \"put\") {\n      const etag = result.headers?.etag ?? result.etag;\n      const bodyDigest = result.bodyDigest;\n      if (etag === undefined || etag.length === 0 || bodyDigest === undefined || bodyDigest !== input.bodyDigest || input.body === undefined || !this.digestMatches(bodyDigest, input.body)) throw new ShareAccessError(\"SHARE_RESPONSE_INTEGRITY\");\n    }\n  }\n\n  private assertNativeListResult(scope: string, result: ShareNativeInvokeResult): void {\n    if (!isNativeSuccess(result)) throw new ShareAccessError(\"SHARE_LIST_FAILED\");\n    if (result.keys === undefined || result.entries === undefined || result.keys.length > MAX_NATIVE_ENTRIES || result.entries.length !== result.keys.length || result.nextCursor !== undefined && new TextEncoder().encode(result.nextCursor).byteLength > MAX_NATIVE_CURSOR_BYTES) throw new ShareAccessError(\"SHARE_LIST_FAILED\");\n    if (result.entries.some((entry, index) => !isRecord(entry) || typeof entry.path !== \"string\" || (entry.kind !== \"file\" && entry.kind !== \"folder\") || entry.path !== result.keys![index])) throw new ShareAccessError(\"SHARE_RESPONSE_INVALID\");\n    const seen = new Set<string>();\n    for (const entry of result.entries) {\n      normalizePath(entry.path);\n      if (seen.has(entry.path)) throw new ShareAccessError(\"SHARE_RESPONSE_INVALID\");\n      seen.add(entry.path);\n      const prefix = scope.replace(/\\/$/, \"\");\n      const relative = entry.path === prefix ? \"\" : entry.path.startsWith(`${prefix}/`) ? entry.path.slice(prefix.length + 1) : undefined;\n      if (relative === undefined || relative.length === 0 || relative.includes(\"/\")) throw new ShareAccessError(\"SHARE_RESPONSE_MISMATCH\");\n    }\n  }\n\n  private assertDetachedProof(value: unknown): asserts value is ShareDetachedProof {\n    const proof = this.requireObject(value, \"holder proof\");\n    assertObjectKeys(proof, [\"alg\", \"kid\", \"signature\"], \"holder proof\");\n    if (proof.alg !== \"EdDSA\" || typeof proof.kid !== \"string\" || typeof proof.signature !== \"string\" || !/^[A-Za-z0-9_-]{86}$/.test(proof.signature)) {\n      throw new ShareAccessError(\"SHARE_NATIVE_PROOF_INVALID\");\n    }\n  }\n\n  private defaultNativeHeaders(session: SharePolicySession, action: \"get\" | \"metadata\" | \"list\" | \"put\", resource: string, request: Record<string, unknown>): ServiceHeaders {\n    const authorization = typeof session.authorization === \"string\"\n      ? session.authorization\n      : isRecord(session.delegationHeader) && typeof session.delegationHeader.Authorization === \"string\"\n        ? session.delegationHeader.Authorization\n        : undefined;\n    const invokeSession = {\n      delegationHeader: { Authorization: authorization ?? \"\" },\n      delegationCid: typeof session.delegationCid === \"string\" ? session.delegationCid : session.sessionId,\n      spaceId: typeof session.spaceId === \"string\" ? session.spaceId : \"share\",\n      verificationMethod: typeof session.verificationMethod === \"string\" ? session.verificationMethod : session.holderDid,\n      jwk: isRecord(session.jwk) ? session.jwk : {},\n    } as ServiceSession;\n    if (this.options.invoke === undefined) {\n      if (authorization === undefined) throw new ShareAccessError(\"SHARE_NATIVE_INVOKE_REQUIRED\");\n      return { Authorization: authorization };\n    }\n    return this.options.invoke(invokeSession, \"share\", resource, `tinycloud.share/${action}`, [{\n      shareSessionId: session.sessionId,\n      shareRequest: request,\n    }]);\n  }\n\n  private digestMatches(value: string, bytes: Uint8Array): boolean {\n    const digest = bytesToBase64Url(sha256(bytes));\n    return value === digest || value === `sha-256=:${digest}:`;\n  }\n\n  private assertNativeRequestBounds(envelope: ShareEnvelopeV2, session: SharePolicySession, operation: \"get\" | \"metadata\" | \"list\" | \"put\", path: string, limit?: number, cursor?: string): void {\n    const binding = this.options.policyBinding;\n    const signedResource = resourceValue(session.resource ?? binding?.resource ?? envelope.resource, envelope.resource.kind);\n    const nativeAction = actionWire(operation);\n    const policyAction = policyActionFor(nativeAction);\n    if (signedResource === undefined || policyAction === undefined || !shareCapabilityAllows({ spaceId: envelope.spaceId, resource: signedResource, actions: [policyAction] }, policyAction, path)) throw new ShareAccessError(\"SHARE_OUT_OF_SCOPE\");\n    const claims = session.actions ?? binding?.actions ?? (session.action !== undefined ? [session.action] : binding?.action !== undefined ? [binding.action] : []);\n    if (claims.length === 0 || !canonicalNativeActions(claims).includes(nativeAction)) throw new ShareAccessError(\"SHARE_SESSION_ACTION_MISMATCH\");\n    if (limit !== undefined && (!Number.isSafeInteger(limit) || limit < 1 || limit > MAX_NATIVE_LIMIT)) throw new ShareAccessError(\"SHARE_INVALID_LIMIT\");\n    if (cursor !== undefined && (cursor.length === 0 || new TextEncoder().encode(cursor).byteLength > MAX_NATIVE_CURSOR_BYTES)) throw new ShareAccessError(\"SHARE_INVALID_CURSOR\");\n  }\n\n  private verifyNativeResponse(bytes: Uint8Array, headers: Readonly<Record<string, string | undefined>> | undefined, bodyDigest?: string): void {\n    if (bodyDigest !== undefined && !this.digestMatches(bodyDigest, bytes)) throw new ShareAccessError(\"SHARE_RESPONSE_INTEGRITY\");\n    const digest = headers?.[\"x-tinycloud-content-digest\"] ?? headers?.[\"content-digest\"];\n    if (digest !== undefined && !this.digestMatches(digest, bytes)) {\n      throw new ShareAccessError(\"SHARE_RESPONSE_INTEGRITY\");\n    }\n    const cid = headers?.[\"x-tinycloud-content-cid\"] ?? headers?.[\"x-tinycloud-cid\"];\n    if (cid !== undefined && !verifyPublishedShareCid(cid, bytes) && !verifyShareCid(cid, bytes)) throw new ShareAccessError(\"SHARE_RESPONSE_INTEGRITY\");\n  }\n\n  private async establishPolicySession(envelope: ShareEnvelopeV2): Promise<SharePolicySession> {\n    if (this.options.presentation === undefined) throw new ShareAccessError(\"SHARE_PRESENTATION_REQUIRED\");\n    const base = envelope.origin.replace(/\\/$/, \"\");\n    const presentation = this.options.presentation;\n    if (presentation === undefined || typeof presentation !== \"object\" || presentation === null) {\n      throw new ShareAccessError(\"SHARE_PRESENTATION_REQUIRED\");\n    }\n    const input = presentation as Record<string, unknown>;\n    const v2 = this.options.policyBinding?.registrationCid !== undefined || isRecord(input.challengeRequest) && input.challengeRequest.envelopeCid !== undefined;\n    const challengeUrl = this.options.policyRoutes?.challenge ?? `${base}/${v2 ? \"share/v2\" : \"share/v1\"}/policy/challenges`;\n    const sessionUrl = this.options.policyRoutes?.session ?? `${base}/${v2 ? \"share/v2\" : \"share/v1\"}/policy/session`;\n    const request = input.challengeRequest ?? this.buildChallengeRequest(envelope, input);\n    if (request === undefined || typeof request !== \"object\" || request === null || Array.isArray(request)) throw new ShareAccessError(\"SHARE_SESSION_INVALID\", \"a Node policy challenge request is required\");\n    if (this.options.policyBinding !== undefined) this.assertStrictChallengeRequest(request as Record<string, unknown>);\n    const challengeResponse = await this.postJson(challengeUrl, request);\n    const challengeEnvelope = unwrapProofResponse(challengeResponse, \"challenge\");\n    const challenge = challengeEnvelope.message;\n    this.verifyNodeProof(challenge, challengeEnvelope.proof, `xyz.tinycloud.share/policy-challenge/${v2 ? \"v2\" : \"v1\"}\\0`);\n    this.assertChallengeRequestBinding(request as Readonly<Record<string, unknown>>, challenge);\n    this.assertChallengeFresh(challenge);\n\n    const builder = this.options.buildPolicySessionRequest;\n    const sessionRequest = builder === undefined\n      ? await this.buildDefaultPolicySessionRequest(presentation, challenge)\n      : await builder({ envelope, challenge, challengeRequest: request as Readonly<Record<string, unknown>> });\n    if (sessionRequest === undefined || typeof sessionRequest !== \"object\" || sessionRequest === null || Array.isArray(sessionRequest)) throw new ShareAccessError(\"SHARE_SESSION_INVALID\", \"the policy session builder returned an invalid request\");\n    if (this.options.policyBinding !== undefined) this.assertStrictSessionRequest(sessionRequest as Record<string, unknown>, v2, challenge);\n    const sessionResponse = await this.postJson(sessionUrl, sessionRequest);\n    const sessionEnvelope = unwrapProofResponse(sessionResponse, \"session\");\n    const session = sessionEnvelope.message;\n    this.verifyNodeProof(session, sessionEnvelope.proof, `xyz.tinycloud.share/policy-session/${v2 ? \"v2\" : \"v1\"}\\0`);\n    this.assertSessionBinding(session, envelope, request, challenge, sessionRequest);\n    return {\n      ...(this.options.policyBinding ?? {}),\n      ...session,\n      sessionId: this.requiredString(session, \"sessionId\"),\n      ...(typeof session.shareCid === \"string\" ? { shareCid: session.shareCid } : {}),\n      ...(typeof session.shareId === \"string\" ? { shareId: session.shareId } : {}),\n      ...(typeof session.policyCid === \"string\" ? { policyCid: session.policyCid } : {}),\n      holderDid: this.requiredString(session, \"holderDid\"),\n      expiresAt: this.requiredString(session, \"expiresAt\"),\n      ...(session.capability !== undefined ? { capability: this.parseSessionCapability(session.capability) } : {}),\n      ...(this.options.policyBinding ?? {}),\n      ...(isRecord(sessionRequest) && typeof sessionRequest.credential === \"string\" ? { credential: sessionRequest.credential } : {}),\n      ...(isRecord(sessionRequest) && sessionRequest.holderBinding !== undefined ? { holderBinding: sessionRequest.holderBinding } : {}),\n      ...(isRecord(sessionRequest) && typeof sessionRequest.readSignerDid === \"string\" ? { readSignerDid: sessionRequest.readSignerDid } : {}),\n      ...(this.options.holderSigner === undefined ? {} : { holderSigner: this.options.holderSigner }),\n    };\n  }\n\n  private buildChallengeRequest(envelope: ShareEnvelopeV2, presentation: Record<string, unknown>): Record<string, unknown> {\n    const binding = this.options.policyBinding;\n    if (binding === undefined) throw new ShareAccessError(\"SHARE_SESSION_INVALID\", \"a Node policy challenge request is required\");\n    const required = (value: unknown, name: string): string => {\n      if (typeof value !== \"string\" || value.length === 0) throw new ShareAccessError(\"SHARE_SESSION_INVALID\", `Node challenge ${name} is missing`);\n      return value;\n    };\n    if (!isRecord(binding.enforcementDelegation) || !isRecord(binding.outerEnvelope)) throw new ShareAccessError(\"SHARE_SESSION_INVALID\", \"Node challenge authority material is missing\");\n    const holderDid = typeof presentation.holderDid === \"string\" ? presentation.holderDid : binding.holderDid;\n    if (holderDid === undefined) throw new ShareAccessError(\"SHARE_SESSION_INVALID\", \"the holder DID is required\");\n    const action = binding.action ?? binding.actions?.[0] ?? \"tinycloud.kv/get\";\n    const body: Record<string, unknown> = {\n      envelopeCid: required(binding.envelopeCid, \"envelopeCid\"),\n      shareCid: binding.shareCid,\n      shareId: binding.shareId,\n      registrationCid: required(binding.registrationCid, \"registrationCid\"),\n      delegationCid: binding.delegationCid,\n      policyCid: binding.policyCid,\n      enforcementDelegationCid: required(binding.enforcementDelegationCid, \"enforcementDelegationCid\"),\n      enforcementDelegation: binding.enforcementDelegation,\n      outerEnvelope: binding.outerEnvelope,\n      contentSource: binding.contentSource,\n      contentSourceDigest: binding.contentSourceDigest,\n      holderDid,\n      targetOrigin: binding.targetOrigin || envelope.origin,\n      nodeAudience: binding.nodeAudience,\n      action,\n      ...(binding.actions === undefined ? {} : { actions: [...binding.actions] }),\n      resource: binding.resource,\n    };\n    return { ...body, requestBodyDigest: digestCanonical(body) };\n  }\n\n  private assertStrictChallengeRequest(request: Record<string, unknown>): void {\n    const v2 = request.envelopeCid !== undefined || this.options.policyBinding?.registrationCid !== undefined;\n    const keys = v2\n      ? [\"envelopeCid\", \"shareCid\", \"shareId\", \"registrationCid\", \"delegationCid\", \"policyCid\", \"enforcementDelegationCid\", \"enforcementDelegation\", \"outerEnvelope\", \"contentSource\", \"contentSourceDigest\", \"holderDid\", \"targetOrigin\", \"nodeAudience\", \"action\", \"actions\", \"resource\", \"requestBodyDigest\"]\n      : [\"shareCid\", \"shareId\", \"delegationCid\", \"authorityMaterialHandle\", \"authorityMaterialDigest\", \"policyCid\", \"contentSource\", \"contentSourceDigest\", \"holderDid\", \"targetOrigin\", \"nodeAudience\", \"action\", \"actions\", \"resource\", \"expiryMin\", \"expiryMax\", \"requestBodyDigest\"];\n    assertObjectKeys(request, keys, \"Node challenge request\");\n    for (const key of v2 ? [\"envelopeCid\", \"shareCid\", \"shareId\", \"registrationCid\", \"delegationCid\", \"policyCid\", \"enforcementDelegationCid\", \"contentSourceDigest\", \"holderDid\", \"targetOrigin\", \"nodeAudience\", \"resource\", \"requestBodyDigest\"] : [\"shareCid\", \"shareId\", \"delegationCid\", \"authorityMaterialHandle\", \"authorityMaterialDigest\", \"policyCid\", \"contentSourceDigest\", \"holderDid\", \"targetOrigin\", \"nodeAudience\", \"resource\", \"requestBodyDigest\"]) {\n      if (typeof request[key] !== \"string\" || request[key].length === 0) throw new ShareAccessError(\"SHARE_SESSION_INVALID\", `Node challenge ${key} is invalid`);\n    }\n    if (!isRecord(request.contentSource) || typeof request.action !== \"string\") throw new ShareAccessError(\"SHARE_SESSION_INVALID\", \"Node challenge source is invalid\");\n    if (request.actions !== undefined && (!Array.isArray(request.actions) || request.actions.some((action) => typeof action !== \"string\"))) throw new ShareAccessError(\"SHARE_SESSION_INVALID\", \"Node challenge actions are invalid\");\n    if (request.expiryMin !== undefined && dateValue(request.expiryMin) === undefined || request.expiryMax !== undefined && dateValue(request.expiryMax) === undefined || dateValue(request.expiryMin) !== undefined && dateValue(request.expiryMax) !== undefined && dateValue(request.expiryMin)! > dateValue(request.expiryMax)!) throw new ShareAccessError(\"SHARE_SESSION_INVALID\", \"Node challenge expiry bounds are invalid\");\n    const { requestBodyDigest: _digest, ...body } = request;\n    if (request.requestBodyDigest !== digestCanonical(body)) throw new ShareAccessError(\"SHARE_SESSION_INVALID\", \"Node challenge digest is invalid\");\n  }\n\n  private assertStrictSessionRequest(request: Record<string, unknown>, v2: boolean, challenge: Record<string, unknown>): void {\n    const keys = v2\n      ? [\"challengeId\", \"nonce\", \"presentation\", \"credential\", \"proof\", \"holderBinding\", \"readSignerDid\"]\n      : [\"presentation\", \"credential\", \"proof\", \"holderBinding\", \"readSignerDid\"];\n    assertObjectKeys(request, keys, \"Node session request\");\n    if (v2 && (request.challengeId !== challenge.challengeId || request.nonce !== challenge.nonce)) throw new ShareAccessError(\"SHARE_SESSION_INVALID\", \"Node session challenge is not bound\");\n    if (!isRecord(request.presentation) || typeof request.credential !== \"string\" || request.credential.length === 0 || !isRecord(request.proof) || request.holderBinding === undefined || typeof request.readSignerDid !== \"string\") throw new ShareAccessError(\"SHARE_SESSION_INVALID\", \"Node session request is incomplete\");\n    this.assertDetachedProof(request.proof);\n  }\n\n  private parseSessionCapability(value: unknown): ShareCapabilityLike {\n    const object = this.requireObject(value, \"session capability\");\n    if (typeof object.spaceId !== \"string\") throw new ShareAccessError(\"SHARE_SESSION_INVALID\", \"session capability space is invalid\");\n    if (!Array.isArray(object.actions) || object.actions.some((action) => ![\"read\", \"list\", \"edit\"].includes(action as string))) throw new ShareAccessError(\"SHARE_SESSION_INVALID\", \"session capability actions are invalid\");\n    const resource = this.requireObject(object.resource, \"session capability resource\");\n    if ((resource.kind !== \"exact\" && resource.kind !== \"prefix\") || typeof resource.path !== \"string\") throw new ShareAccessError(\"SHARE_SESSION_INVALID\", \"session capability resource is invalid\");\n    return { spaceId: object.spaceId, actions: [...new Set(object.actions)] as ShareAction[], resource: { kind: resource.kind, path: resource.path } as ShareResource };\n  }\n\n  private assertProvidedPolicySession(session: SharePolicySession, envelope: ShareEnvelopeV2): void {\n    const sessionExpiry = dateValue(session.expiresAt);\n    if (typeof session.sessionId !== \"string\" || typeof session.holderDid !== \"string\" || session.resource === undefined || session.actions === undefined && session.action === undefined || sessionExpiry === undefined || sessionExpiry <= this.now().getTime() || sessionExpiry > (dateValue(envelope.expiresAt) ?? 0)) {\n      throw new ShareAccessError(\"SHARE_SESSION_INVALID\");\n    }\n    this.assertExpiryBounds(session, envelope, sessionExpiry);\n    if (isRecord(this.options.presentation)) {\n      const presentation = isRecord(this.options.presentation.presentation) ? this.options.presentation.presentation : this.options.presentation;\n      const presentedHolder = typeof presentation.holderDid === \"string\" ? presentation.holderDid : isRecord(presentation.holder) && typeof presentation.holder.did === \"string\" ? presentation.holder.did : undefined;\n      if (presentedHolder !== undefined && presentedHolder !== session.holderDid) throw new ShareAccessError(\"SHARE_SESSION_INVALID\", \"Node session holder is not bound to the presentation\");\n    }\n    const sessionOrigin = session.targetOrigin ?? session.origin;\n    if (sessionOrigin !== undefined && sessionOrigin !== envelope.origin) throw new ShareAccessError(\"SHARE_SESSION_INVALID\", \"Node session origin is not bound to the share\");\n    if (session.resource !== undefined) {\n      const sessionResource = resourceValue(session.resource, envelope.resource.kind);\n      if (sessionResource === undefined || canonicalValue(sessionResource) !== canonicalValue(envelope.resource)) throw new ShareAccessError(\"SHARE_SESSION_INVALID\", \"Node session resource is not bound to the share\");\n    }\n    const binding = this.options.policyBinding;\n    if (binding === undefined) {\n      this.assertServerActions(session.actions ?? (session.action === undefined ? [] : [session.action]), envelope.actions);\n      return;\n    }\n    compareBoundValue(session.expiryMin, binding.expiryMin, \"Node session expiryMin is not bound to the policy\");\n    compareBoundValue(session.expiryMax, binding.expiryMax, \"Node session expiryMax is not bound to the policy\");\n    const boundResource = resourceValue(binding.resource, envelope.resource.kind);\n    if (binding.targetOrigin !== envelope.origin || boundResource === undefined || canonicalValue(boundResource) !== canonicalValue(envelope.resource) || binding.expiresAt !== undefined && binding.expiresAt !== envelope.expiresAt) {\n      throw new ShareAccessError(\"SHARE_SESSION_INVALID\");\n    }\n    for (const [key, expected] of Object.entries({\n      shareCid: binding.shareCid,\n      shareId: binding.shareId,\n      delegationCid: binding.delegationCid,\n      authorityMaterialHandle: binding.authorityMaterialHandle,\n      authorityMaterialDigest: binding.authorityMaterialDigest,\n      policyCid: binding.policyCid,\n      contentSourceDigest: binding.contentSourceDigest,\n      targetOrigin: binding.targetOrigin,\n      nodeAudience: binding.nodeAudience,\n      resource: boundResource,\n    })) {\n      const actual = key === \"resource\"\n        ? resourceValue((session as unknown as Record<string, unknown>)[key], envelope.resource.kind)\n        : (session as unknown as Record<string, unknown>)[key];\n      compareBoundValue(actual, expected, `Node session ${key} is not bound to the policy`);\n    }\n    if (session.contentSource !== undefined) compareBoundValue(session.contentSource, binding.contentSource, \"Node session content source is not bound to the policy\");\n    this.assertServerActions(session.actions ?? binding.actions ?? (session.action === undefined ? binding.action === undefined ? [] : [binding.action] : [session.action]), envelope.actions);\n  }\n\n  private assertExpiryBounds(session: SharePolicySession, envelope: ShareEnvelopeV2, expiry: number): void {\n    const min = dateValue(session.expiryMin ?? this.options.policyBinding?.expiryMin);\n    const max = dateValue(session.expiryMax ?? this.options.policyBinding?.expiryMax);\n    if ((session.expiryMin !== undefined || this.options.policyBinding?.expiryMin !== undefined) && min === undefined || (session.expiryMax !== undefined || this.options.policyBinding?.expiryMax !== undefined) && max === undefined || min !== undefined && max !== undefined && min > max || min !== undefined && expiry < min || max !== undefined && expiry > max) {\n      throw new ShareAccessError(\"SHARE_SESSION_INVALID\", \"Node session expiry is outside the inclusive policy bounds\");\n    }\n  }\n\n  private assertServerActions(values: readonly unknown[], envelopeActions: readonly ShareAction[]): void {\n    if (values.length === 0) return;\n    const nativeActions = canonicalNativeActions(values);\n    const allowed = new Set(envelopeActions);\n    if (nativeActions.length === 0 || nativeActions.some((action) => !allowed.has(policyActionFor(action)!))) throw new ShareAccessError(\"SHARE_SESSION_ACTION_MISMATCH\");\n  }\n\n  private async buildDefaultPolicySessionRequest(presentation: unknown, challenge: Record<string, unknown>): Promise<unknown> {\n    if (!isRecord(presentation)) throw new ShareAccessError(\"SHARE_SESSION_INVALID\", \"a nonce-bound policy session builder is required\");\n    if (!isRecord(presentation.sessionRequest)) {\n      const binding = this.options.policyBinding;\n      const credential = typeof presentation.credential === \"string\" ? presentation.credential : undefined;\n      const holderDid = typeof presentation.holderDid === \"string\" ? presentation.holderDid : binding?.holderDid;\n      const holderBinding = presentation.holderBinding;\n      const readSignerDid = typeof presentation.readSignerDid === \"string\" ? presentation.readSignerDid : holderDid;\n      const signer = this.options.holderSigner;\n      if (binding === undefined || credential === undefined || holderDid === undefined || holderBinding === undefined || readSignerDid === undefined || signer === undefined) {\n        throw new ShareAccessError(\"SHARE_SESSION_INVALID\", \"a nonce-bound policy session builder is required\");\n      }\n      const action = binding.action ?? binding.actions?.[0] ?? \"tinycloud.kv/get\";\n      const isV2 = challenge.version === 2;\n      const policyPresentation: Record<string, unknown> = {\n        type: \"TinyCloudSharePolicyPresentation\",\n        version: isV2 ? 2 : 1,\n        challengeId: challenge.challengeId,\n        nonce: challenge.nonce,\n        shareCid: binding.shareCid,\n        shareId: binding.shareId,\n        delegationCid: binding.delegationCid,\n        policyCid: binding.policyCid,\n        contentSource: binding.contentSource,\n        contentSourceDigest: binding.contentSourceDigest,\n        holderDid,\n        targetOrigin: binding.targetOrigin,\n        nodeAudience: binding.nodeAudience,\n        ...(isV2 ? {\n          enforcerDid: challenge.enforcerDid,\n          credentialDigest: typeof presentation.credentialDigest === \"string\" ? presentation.credentialDigest : bytesToBase64Url(sha256(new TextEncoder().encode(credential))),\n        } : {}),\n        action,\n        ...(binding.actions === undefined ? {} : { actions: [...binding.actions] }),\n        resource: binding.resource,\n        requestBodyDigest: challenge.requestBodyDigest,\n        issuedAt: new Date(this.now()).toISOString(),\n        expiresAt: challenge.expiresAt,\n        jti: randomJti(),\n      };\n      const proof = await signer({ domain: isV2 ? POLICY_PRESENTATION_DOMAIN_V2 : POLICY_PRESENTATION_DOMAIN_V1, message: policyPresentation });\n      this.assertDetachedProof(proof);\n      return challenge.version === 2\n        ? { challengeId: challenge.challengeId, nonce: challenge.nonce, presentation: policyPresentation, credential, proof, holderBinding, readSignerDid }\n        : { presentation: policyPresentation, credential, proof, holderBinding, readSignerDid };\n    }\n    const request = structuredClone(presentation.sessionRequest) as Record<string, unknown>;\n    const candidate = isRecord(request.presentation) ? request.presentation : request;\n    if (typeof candidate.holderDid !== \"string\") throw new ShareAccessError(\"SHARE_SESSION_INVALID\", \"the policy presentation holder is invalid\");\n    candidate.nonce = challenge.nonce;\n    if (typeof challenge.challengeId === \"string\") candidate.challengeId = challenge.challengeId;\n    if (candidate.audience === undefined && typeof challenge.audience === \"string\") candidate.audience = challenge.audience;\n    if (challenge.version === 2) {\n      request.challengeId = challenge.challengeId;\n      request.nonce = challenge.nonce;\n    }\n    return request;\n  }\n\n  private async postJson(url: string, body: unknown): Promise<Record<string, unknown>> {\n    const response = await this.fetchFn(url, { method: \"POST\", headers: { \"content-type\": \"application/json\" }, body: JSON.stringify(body), redirect: \"error\" });\n    if ((response as unknown as { readonly redirected?: boolean }).redirected === true || response.status >= 300 && response.status < 400) throw new ShareAccessError(\"SHARE_REDIRECT_REJECTED\");\n    if (!response.ok) throw new ShareAccessError(response.status === 401 || response.status === 403 ? \"SHARE_DENIED\" : \"SHARE_SESSION_FAILED\");\n    const value = await response.json();\n    if (!value || typeof value !== \"object\" || Array.isArray(value)) throw new ShareAccessError(\"SHARE_SESSION_INVALID\");\n    return value as Record<string, unknown>;\n  }\n\n  private requireObject(value: unknown, label: string): Record<string, unknown> {\n    if (!value || typeof value !== \"object\" || Array.isArray(value)) throw new ShareAccessError(\"SHARE_SESSION_INVALID\", `${label} is invalid`);\n    return value as Record<string, unknown>;\n  }\n\n  private requiredString(value: Record<string, unknown>, key: string, fallback?: string): string {\n    const result = value[key] ?? fallback;\n    if (typeof result !== \"string\" || result.length === 0) throw new ShareAccessError(\"SHARE_SESSION_INVALID\", `session ${key} is invalid`);\n    return result;\n  }\n\n  private verifyNodeProof(message: Record<string, unknown>, proof: unknown, domain: string): void {\n    const detached = this.requireObject(proof, \"proof\");\n    const isJwsProof = detached.alg === \"EdDSA\" && typeof detached.kid === \"string\" && typeof detached.signature === \"string\";\n    const isEd25519Proof = detached.algorithm === \"Ed25519\" && typeof detached.signerDid === \"string\" && typeof detached.value === \"string\";\n    if (!isJwsProof && !isEd25519Proof) throw new ShareAccessError(\"SHARE_SESSION_INVALID\", \"Node proof is invalid\");\n    if (isJwsProof) assertObjectKeys(detached, [\"alg\", \"kid\", \"signature\"], \"Node proof\");\n    if (isEd25519Proof) assertObjectKeys(detached, [\"algorithm\", \"signerDid\", \"value\"], \"Node proof\");\n    const signerDid = isJwsProof\n      ? this.options.trustedSignerDids?.find((did) => detached.kid === `${did}#${did.slice(\"did:key:\".length)}`)\n      : this.options.trustedSignerDids?.find((did) => did === detached.signerDid);\n    if (signerDid === undefined) throw new ShareAccessError(\"SHARE_SIGNER_UNTRUSTED\");\n    const encoded = signerDid.slice(\"did:key:\".length);\n    if (!signerDid.startsWith(\"did:key:\") || !encoded.startsWith(\"z\")) throw new ShareAccessError(\"SHARE_SESSION_INVALID\", \"Node signer is invalid\");\n    let key: Uint8Array;\n    let signature: Uint8Array;\n    try {\n      const decoded = base58btc.decode(encoded);\n      if (decoded.length !== 34 || decoded[0] !== 0xed || decoded[1] !== 0x01) throw new Error(\"key\");\n      key = decoded.slice(2);\n      signature = base64UrlToBytes((isJwsProof ? detached.signature : detached.value) as string);\n    } catch {\n      throw new ShareAccessError(\"SHARE_SESSION_INVALID\", \"Node proof encoding is invalid\");\n    }\n    if ((isJwsProof && detached.kid !== `${signerDid}#${encoded}`) || (isEd25519Proof && detached.signerDid !== signerDid) || signature.length !== 64) throw new ShareAccessError(\"SHARE_SESSION_INVALID\", \"Node proof binding is invalid\");\n    const bytes = new TextEncoder().encode(`${domain}${canonicalJsonForProof(message)}`);\n    if (!ed25519.verify(signature, bytes, key)) throw new ShareAccessError(\"SHARE_SESSION_INVALID\", \"Node proof signature is invalid\");\n  }\n\n  private assertChallengeRequestBinding(request: Readonly<Record<string, unknown>>, challenge: Record<string, unknown>): void {\n    const source = isRecord(request.body) ? request.body : request;\n    for (const key of [\"policyId\", \"shareId\", \"shareCid\", \"delegationCid\", \"authorityMaterialHandle\", \"authorityMaterialDigest\", \"policyCid\", \"contentSource\", \"contentSourceDigest\", \"holderDid\", \"targetOrigin\", \"nodeAudience\", \"audience\", \"resource\", \"action\", \"actions\", \"expiryMin\", \"expiryMax\"] as const) {\n      compareBoundValue(source[key], challenge[key], `Node challenge ${key} is not bound to the request`);\n    }\n    if (typeof challenge.challengeId !== \"string\" || challenge.challengeId.length === 0 || typeof challenge.nonce !== \"string\" || challenge.nonce.length < 16) throw new ShareAccessError(\"SHARE_SESSION_INVALID\", \"Node challenge identity is invalid\");\n    const claimed = source.requestBodyDigest;\n    if (typeof claimed === \"string\") {\n      const { requestBodyDigest: _ignored, ...body } = source;\n      compareBoundValue(claimed, digestCanonical(body), \"Node challenge request digest is invalid\");\n      compareBoundValue(challenge.requestBodyDigest, claimed, \"Node challenge request digest is not bound\");\n    }\n    if (challenge.requestDigest !== undefined) compareBoundValue(challenge.requestDigest, claimed, \"Node challenge request digest is invalid\");\n  }\n\n  private assertChallengeFresh(challenge: Record<string, unknown>): void {\n    const expiresAt = dateValue(challenge.challengeExpiresAt ?? challenge.expiresAt);\n    if (expiresAt === undefined || expiresAt <= this.now().getTime()) throw new ShareAccessError(\"SHARE_SESSION_INVALID\", \"Node challenge expiry is invalid\");\n  }\n\n  private assertSessionBinding(session: Record<string, unknown>, envelope: ShareEnvelopeV2, request: unknown, challenge: Record<string, unknown>, sessionRequest: unknown): void {\n    const requestObject = this.requireObject(request, \"challenge request\");\n    const sessionRequestObject = this.requireObject(sessionRequest, \"session request\");\n    const requestBinding = isRecord(requestObject.body) ? requestObject.body : requestObject;\n    const presentation = isRecord(sessionRequestObject.presentation) ? sessionRequestObject.presentation : sessionRequestObject;\n    const holderDid = typeof presentation.holderDid === \"string\"\n      ? presentation.holderDid\n      : isRecord(presentation.holder) && typeof presentation.holder.did === \"string\" ? presentation.holder.did : undefined;\n    if (holderDid === undefined) throw new ShareAccessError(\"SHARE_SESSION_INVALID\", \"Node presentation holder is missing\");\n    if (challenge.version === 2) {\n      if (session.version !== 2) throw new ShareAccessError(\"SHARE_SESSION_INVALID\", \"Node session version is invalid\");\n      for (const key of [\"envelopeCid\", \"shareCid\", \"shareId\", \"registrationCid\", \"delegationCid\", \"policyCid\", \"enforcementDelegationCid\", \"holderDid\", \"nodeAudience\", \"action\", \"actions\", \"resource\"] as const) {\n        compareBoundValue(session[key], requestBinding[key] ?? challenge[key], `Node v2 session ${key} is not bound`);\n      }\n    }\n    compareBoundValue(holderDid, session.holderDid, \"Node session holder is not bound to the presentation\");\n    if (isRecord(presentation.holderBinding) && typeof presentation.holderBinding.holderDid === \"string\") compareBoundValue(presentation.holderBinding.holderDid, session.holderDid, \"Node holder binding is not bound to the session\");\n    compareBoundValue(presentation.nonce, challenge.nonce, \"Node presentation nonce is not bound to the challenge\");\n    compareBoundValue(presentation.challengeId, challenge.challengeId, \"Node presentation challenge is not bound\");\n    compareBoundValue(presentation.audience, challenge.audience, \"Node presentation audience is not bound to the challenge\");\n    const allowedAudiences = new Set([envelope.origin, this.options.policyBinding?.nodeAudience].filter((value): value is string => value !== undefined));\n    if (typeof challenge.audience === \"string\" && !allowedAudiences.has(challenge.audience) || typeof presentation.audience === \"string\" && !allowedAudiences.has(presentation.audience)) throw new ShareAccessError(\"SHARE_SESSION_INVALID\", \"Node audience is not bound to the share origin\");\n    const sessionOrigin = session.targetOrigin ?? session.origin;\n    if (sessionOrigin !== undefined && sessionOrigin !== envelope.origin) throw new ShareAccessError(\"SHARE_SESSION_INVALID\", \"Node session origin is not bound to the share\");\n    if (session.spaceId !== undefined && session.spaceId !== envelope.spaceId) throw new ShareAccessError(\"SHARE_SESSION_INVALID\", \"Node session space is not bound to the share\");\n    for (const key of [\"shareCid\", \"shareId\", \"policyCid\", \"delegationCid\", \"authorityMaterialDigest\", \"sourceDigest\", \"targetOrigin\", \"nodeAudience\", \"resource\", \"action\", \"expiryMin\", \"expiryMax\"] as const) {\n      const requestValue = key === \"resource\" ? resourceValue(requestBinding[key], envelope.resource.kind) : requestBinding[key];\n      const sessionValue = key === \"resource\" ? resourceValue((session as Record<string, unknown>)[key], envelope.resource.kind) : (session as Record<string, unknown>)[key];\n      compareBoundValue(requestValue, sessionValue, `Node session ${key} is not bound to the request`);\n    }\n    if (session.resource !== undefined) {\n      const sessionResource = resourceValue(session.resource, envelope.resource.kind);\n      if (sessionResource === undefined || canonicalValue(sessionResource) !== canonicalValue(envelope.resource)) throw new ShareAccessError(\"SHARE_SESSION_INVALID\", \"Node session resource is not bound to the share\");\n    }\n    if (session.actions !== undefined) {\n      if (!Array.isArray(session.actions)) throw new ShareAccessError(\"SHARE_SESSION_INVALID\", \"Node session actions are invalid\");\n      this.assertServerActions(session.actions, envelope.actions);\n    }\n    const sessionExpiry = dateValue(session.expiresAt);\n    const envelopeExpiry = dateValue(envelope.expiresAt);\n    const presentationExpiry = dateValue(presentation.expiresAt);\n    if (sessionExpiry === undefined || sessionExpiry <= this.now().getTime() || envelopeExpiry === undefined || sessionExpiry > envelopeExpiry || (presentationExpiry !== undefined && sessionExpiry > presentationExpiry)) throw new ShareAccessError(\"SHARE_SESSION_INVALID\", \"Node session expiry is invalid\");\n    this.assertExpiryBounds({ ...session, sessionId: typeof session.sessionId === \"string\" ? session.sessionId : \"\", holderDid: typeof session.holderDid === \"string\" ? session.holderDid : \"\", expiresAt: session.expiresAt as string }, envelope, sessionExpiry);\n    compareBoundValue(session.expiryMin, requestBinding.expiryMin, \"Node session expiryMin is not bound to the request\");\n    compareBoundValue(session.expiryMax, requestBinding.expiryMax, \"Node session expiryMax is not bound to the request\");\n  }\n\n  private assertAllowed(capability: { readonly spaceId: string; readonly resource: ShareResource; readonly actions: readonly ShareAction[] }, operation: \"get\" | \"metadata\" | \"list\" | \"save\", path: string): void {\n    if (!shareCapabilityAllows(capability, operationAction(operation), path)) throw new ShareAccessError(\"SHARE_OUT_OF_SCOPE\");\n  }\n\n  private async resolve(link: string): Promise<ResolvedArtifact> {\n    const location = parseShareUrl(link, { trustedOrigins: this.options.trustedOrigins, maxInlineBytes: this.options.maxInlineBytes });\n    if (location.protocol === \"share-envelope-v2\") return this.resolvePublished(link);\n    let bytes: Uint8Array;\n    let cachedEntry: ShareCacheEntry | undefined;\n    if (location.kind === \"inline\") {\n      bytes = new TextEncoder().encode(JSON.stringify(location.artifact));\n    } else {\n      if (location.cid === undefined) throw new ShareAccessError(\"SHARE_INVALID\");\n      cachedEntry = this.cache.getByCid === undefined ? undefined : await this.cache.getByCid(location.cid, this.now());\n      if (cachedEntry !== undefined) {\n        if (!verifyShareCid(location.cid, cachedEntry.bytes) || !this.digestMatches(bytesToBase64Url(cachedEntry.digest), cachedEntry.bytes)) {\n          await this.cache.delete(cachedEntry.key);\n          // A cache is an optimization, never an authority. Re-fetch the\n          // canonical object once after evicting a corrupt entry.\n          bytes = await this.fetchArtifact(location.origin, location.cid);\n        } else {\n          bytes = cachedEntry.bytes;\n        }\n      } else {\n        bytes = await this.fetchArtifact(location.origin, location.cid);\n      }\n    }\n    let artifact = location.artifact ?? parseShareArtifact(bytes, { expectedOrigin: location.origin, maxArtifactBytes: this.options.maxArtifactBytes ?? DEFAULT_MAX_ARTIFACT_BYTES, maxContentBytes: this.options.maxContentBytes ?? DEFAULT_MAX_CONTENT_BYTES, maxSealedContentBytes: this.options.maxSealedContentBytes ?? DEFAULT_MAX_SEALED_CONTENT_BYTES });\n    if (cachedEntry !== undefined && cachedEntry.key.expiresAt !== artifact.envelope.expiresAt) {\n      await this.cache.delete(cachedEntry.key);\n      bytes = await this.fetchArtifact(location.origin, location.cid!);\n      artifact = parseShareArtifact(bytes, { expectedOrigin: location.origin, maxArtifactBytes: this.options.maxArtifactBytes ?? DEFAULT_MAX_ARTIFACT_BYTES, maxContentBytes: this.options.maxContentBytes ?? DEFAULT_MAX_CONTENT_BYTES, maxSealedContentBytes: this.options.maxSealedContentBytes ?? DEFAULT_MAX_SEALED_CONTENT_BYTES });\n    }\n    verifyShareEnvelope(artifact.envelope, { expectedOrigin: location.origin, maxContentBytes: this.options.maxContentBytes, maxSealedContentBytes: this.options.maxSealedContentBytes ?? DEFAULT_MAX_SEALED_CONTENT_BYTES, now: this.now(), trustedSignerDids: this.options.trustedSignerDids });\n    if (!artifact.envelope.encrypted && location.key !== undefined) throw new ShareAccessError(\"unsafe-plaintext\");\n    if (location.cid !== undefined && !verifyShareCid(location.cid, bytes)) {\n      await this.cache.delete({ cid: location.cid, expiresAt: artifact.envelope.expiresAt });\n      throw new ShareAccessError(\"SHARE_CID_MISMATCH\");\n    }\n    if (location.cid !== undefined) await this.cache.set({ cid: location.cid, expiresAt: artifact.envelope.expiresAt }, bytes, { contentType: artifact.envelope.content.mimeType, size: artifact.envelope.content.size, encrypted: artifact.envelope.encrypted });\n    const encodedContent = this.base64ToBytes(artifact.content);\n    const plaintext = artifact.envelope.encrypted\n      ? await decryptShareBytesAsync(encodedContent, location.key ?? (() => { throw new ShareAccessError(\"SHARE_KEY_REQUIRED\"); })())\n      : encodedContent;\n    if (plaintext.byteLength > (this.options.maxContentBytes ?? DEFAULT_MAX_CONTENT_BYTES)) throw new ShareAccessError(\"SHARE_TOO_LARGE\");\n    return { location, artifact, bytes, plaintext };\n  }\n\n  private async fetchArtifact(origin: string, cid: string): Promise<Uint8Array> {\n    const url = this.options.artifactUrl?.({ origin, cid }) ?? `${origin}/s/${cid}/raw`;\n    const response = await this.fetchFn(url, { method: \"GET\", headers: { accept: \"application/vnd.tinycloud.share-artifact+json, application/json\" }, redirect: \"error\" });\n    if ((response as unknown as { readonly redirected?: boolean }).redirected === true || response.status >= 300 && response.status < 400) throw new ShareAccessError(\"SHARE_REDIRECT_REJECTED\");\n    if (!response.ok) throw new ShareAccessError(\"SHARE_FETCH_FAILED\");\n    const bytes = new Uint8Array(await response.arrayBuffer());\n    if (bytes.byteLength > (this.options.maxArtifactBytes ?? DEFAULT_MAX_ARTIFACT_BYTES)) throw new ShareAccessError(\"SHARE_TOO_LARGE\");\n    if (!verifyShareCid(cid, bytes)) throw new ShareAccessError(\"SHARE_CID_MISMATCH\");\n    return bytes;\n  }\n\n  private async resolvePublished(link: string): Promise<ResolvedArtifact> {\n    const published = parsePublishedShareLink(link, { trustedOrigins: this.options.trustedOrigins, maxInlineBytes: this.options.maxInlineBytes });\n    let sealed = published.sealed;\n    let cached: ShareCacheEntry | undefined;\n    if (sealed === undefined && this.cache.getByCid !== undefined) {\n      cached = await this.cache.getByCid(published.cid, this.now());\n      if (cached !== undefined && verifyPublishedShareCid(published.cid, cached.bytes) && this.digestMatches(bytesToBase64Url(cached.digest), cached.bytes)) sealed = cached.bytes;\n      else if (cached !== undefined) await this.cache.delete(cached.key);\n    }\n    if (sealed === undefined) {\n      const url = this.options.artifactUrl?.({ origin: published.origin, cid: published.cid }) ?? `${published.origin}/s/${published.cid}/raw`;\n      const response = await this.fetchFn(url, { method: \"GET\", headers: { accept: \"application/vnd.tinycloud.share-envelope+json, application/json\" }, redirect: \"error\" });\n      if ((response as unknown as { readonly redirected?: boolean }).redirected === true || response.status >= 300 && response.status < 400) throw new ShareAccessError(\"SHARE_REDIRECT_REJECTED\");\n      if (!response.ok) throw new ShareAccessError(\"SHARE_FETCH_FAILED\");\n      sealed = new Uint8Array(await response.arrayBuffer());\n    }\n    if (sealed.byteLength > (this.options.maxSealedContentBytes ?? DEFAULT_MAX_SEALED_CONTENT_BYTES)) throw new ShareAccessError(\"SHARE_TOO_LARGE\");\n    if (!verifyPublishedShareCid(published.cid, sealed)) throw new ShareAccessError(\"SHARE_CID_MISMATCH\");\n    const envelopeBytes = published.key === undefined ? sealed : await openPublishedShareBlob(sealed, published.key);\n    let plaintext = new Uint8Array();\n    // Verify the signed envelope before following any content pointer. A\n    // pointer is data, not authority, and must never create a pre-signature\n    // fetch side channel.\n    let preliminary: ReturnType<typeof parsePublishedShareEnvelope>;\n    try {\n      preliminary = parsePublishedShareEnvelope(envelopeBytes, { expectedOrigin: published.origin, now: this.now(), plaintext, trustedSignerDids: this.options.trustedSignerDids });\n    } catch (error) {\n      if (!(error instanceof Error) || !(\"code\" in error) || (error as { readonly code?: unknown }).code !== \"invalid-envelope\") throw error;\n      const legacy = parseLegacyPublishedShareEnvelope(envelopeBytes, { expectedOrigin: published.origin, now: this.now(), plaintext, trustedSignerDids: this.options.trustedSignerDids });\n      if (this.cache.getByCid !== undefined) await this.cache.set({ cid: published.cid, expiresAt: legacy.artifact.envelope.expiresAt }, sealed, { contentType: legacy.artifact.envelope.content.mimeType, size: sealed.byteLength, encrypted: true });\n      const location: ShareLinkLocation = { kind: published.sealed === undefined ? \"compact\" : \"inline\", origin: published.origin, cid: published.cid, url: `${published.origin}/s/${published.cid}/raw`, protocol: \"share-envelope-v2\" };\n      return { location, artifact: legacy.artifact, bytes: sealed, plaintext };\n    }\n    const pointer = preliminary.envelope.content;\n    if (pointer !== undefined) {\n      const contentUrl = this.options.artifactUrl?.({ origin: published.origin, cid: pointer.cid }) ?? `${published.origin}/s/${pointer.cid}/raw`;\n      const contentResponse = await this.fetchFn(contentUrl, { method: \"GET\", headers: { accept: \"application/octet-stream\" }, redirect: \"error\" });\n      if ((contentResponse as unknown as { readonly redirected?: boolean }).redirected === true || contentResponse.status >= 300 && contentResponse.status < 400) throw new ShareAccessError(\"SHARE_REDIRECT_REJECTED\");\n      if (!contentResponse.ok) throw new ShareAccessError(\"SHARE_FETCH_FAILED\");\n      const contentSealed = new Uint8Array(await contentResponse.arrayBuffer());\n      if (contentSealed.byteLength > (this.options.maxSealedContentBytes ?? DEFAULT_MAX_SEALED_CONTENT_BYTES)) throw new ShareAccessError(\"SHARE_TOO_LARGE\");\n      if (!verifyPublishedShareCid(pointer.cid, contentSealed)) throw new ShareAccessError(\"SHARE_CID_MISMATCH\");\n      plaintext = new Uint8Array(await openPublishedShareBlob(contentSealed, this.base64ToBytes(pointer.key)));\n    }\n    const artifact = parsePublishedShareEnvelope(envelopeBytes, { expectedOrigin: published.origin, now: this.now(), plaintext, trustedSignerDids: this.options.trustedSignerDids }).artifact;\n    if (this.cache.getByCid !== undefined) await this.cache.set({ cid: published.cid, expiresAt: artifact.envelope.expiresAt }, sealed, { contentType: artifact.envelope.content.mimeType, size: sealed.byteLength, encrypted: true });\n    const location: ShareLinkLocation = { kind: published.sealed === undefined ? \"compact\" : \"inline\", origin: published.origin, cid: published.cid, url: `${published.origin}/s/${published.cid}/raw`, protocol: \"share-envelope-v2\" };\n    return { location, artifact, bytes: sealed, plaintext };\n  }\n\n  private base64ToBytes(value: string): Uint8Array {\n    const normalized = value.replace(/-/g, \"+\").replace(/_/g, \"/\") + \"=\".repeat((4 - value.length % 4) % 4);\n    if (typeof atob === \"function\") return Uint8Array.from(atob(normalized), (char) => char.charCodeAt(0));\n    return new Uint8Array(Buffer.from(normalized, \"base64\"));\n  }\n}\n","import { ed25519 } from \"@noble/curves/ed25519\";\nimport { blake3 } from \"@noble/hashes/blake3\";\nimport { sha256 } from \"@noble/hashes/sha256\";\nimport { CID } from \"multiformats/cid\";\nimport { create as createDigest } from \"multiformats/hashes/digest\";\nimport * as raw from \"multiformats/codecs/raw\";\nimport { sha256 as sha256Cid } from \"multiformats/hashes/sha2\";\nimport { base58btc } from \"multiformats/bases/base58\";\n\nconst ENVELOPE_SCHEMA = \"xyz.tinycloud.share/envelope\" as const;\nconst INLINE_PREFIX = \"tc2:\";\nconst RAW_CID_CODEC = 0x55;\nconst BLAKE3_256_CODE = 0x1e;\nconst DEFAULT_MAX_INLINE_BYTES = 256 * 1024;\nexport const MAX_SHARE_CONTENT_BYTES = 100 * 1024 * 1024;\n/** AES-GCM plus the published version byte, IV, and authentication tag. */\nexport const MAX_SEALED_SHARE_CONTENT_BYTES = MAX_SHARE_CONTENT_BYTES + 29;\n/** Canonical JSON is independently bounded from plaintext and sealed bytes. */\nexport const MAX_SHARE_ARTIFACT_BYTES =\n  Math.ceil((MAX_SEALED_SHARE_CONTENT_BYTES * 4) / 3) + 2 * 1024 * 1024;\nconst DEFAULT_MAX_ARTIFACT_BYTES = MAX_SHARE_ARTIFACT_BYTES;\n\nexport type ShareRecipientTarget =\n  | { readonly kind: \"exactEmail\"; readonly value: string }\n  | { readonly kind: \"emailDomain\"; readonly value: string }\n  | { readonly kind: \"recipientDid\"; readonly value: string }\n  | { readonly kind: \"bearer\" };\n\nexport type ShareResource =\n  | { readonly kind: \"exact\"; readonly path: string }\n  | { readonly kind: \"prefix\"; readonly path: string };\n\nexport type ShareAction = \"read\" | \"list\" | \"edit\";\n\nexport interface SharePolicy {\n  readonly matcher: ShareRecipientTarget;\n  readonly spaceId: string;\n  readonly resource: ShareResource;\n  readonly actions: readonly ShareAction[];\n  readonly expiresAt: string;\n}\n\nexport interface ShareContentMetadata {\n  readonly mimeType: string;\n  readonly size: number;\n  readonly digest: string;\n  readonly charset?: \"utf-8\";\n}\n\nexport interface ShareEnvelopeV2 {\n  readonly schema: typeof ENVELOPE_SCHEMA;\n  readonly version: 2;\n  readonly origin: string;\n  readonly spaceId: string;\n  readonly recipient?: ShareRecipientTarget;\n  /** Public routing discriminator. Matcher values are never serialized here. */\n  readonly recipientKind?: ShareRecipientTarget[\"kind\"];\n  readonly resource: ShareResource;\n  readonly actions: readonly ShareAction[];\n  readonly content: ShareContentMetadata;\n  readonly encrypted: boolean;\n  readonly expiresAt: string;\n  readonly signer: { readonly did: string; readonly publicKey: string };\n  readonly signature: string;\n  /** Internal marker for the published Share-v2 adapter; never serialized by legacy artifacts. */\n  readonly authorizationTargetKind?: string;\n}\n\nexport interface ShareArtifactV2 {\n  readonly envelope: ShareEnvelopeV2;\n  /** Canonical base64url bytes. For an encrypted artifact these are ciphertext. */\n  readonly content: string;\n}\n\nexport interface ShareLinkLocation {\n  readonly kind: \"compact\" | \"inline\";\n  readonly origin: string;\n  readonly cid?: string;\n  readonly key?: Uint8Array;\n  readonly artifact?: ShareArtifactV2;\n  readonly url: string;\n  /** Canonical Share envelope links use the published SHA-256/sealed-blob wire format. */\n  readonly protocol?: \"legacy\" | \"share-envelope-v2\";\n}\n\nexport interface VerifyShareEnvelopeOptions {\n  readonly now?: Date;\n  readonly expectedOrigin?: string;\n  readonly expectedCid?: string;\n  readonly maxArtifactBytes?: number;\n  readonly maxContentBytes?: number;\n  readonly maxSealedContentBytes?: number;\n  /** Trusted signer DIDs for addressed policy artifacts. */\n  readonly trustedSignerDids?: readonly string[];\n}\n\nexport interface ShareArtifactInput {\n  readonly origin: string;\n  readonly spaceId: string;\n  readonly recipient?: ShareRecipientTarget;\n  readonly resource: ShareResource;\n  readonly actions: readonly ShareAction[];\n  readonly mimeType: string;\n  readonly bytes: Uint8Array;\n  readonly expiresAt: Date;\n  readonly signerDid: string;\n  readonly signerPrivateKey: Uint8Array;\n  readonly encryptionKey?: Uint8Array;\n  readonly maxContentBytes?: number;\n  /** Required acknowledgement for the intentionally content-free policy-only plaintext form. */\n  readonly plaintextPolicyOnly?: boolean;\n  readonly plaintextWarningAcknowledged?: boolean;\n}\n\nexport interface ShareArtifactResult {\n  readonly artifact: ShareArtifactV2;\n  readonly bytes: Uint8Array;\n  readonly cid: string;\n  readonly key?: Uint8Array;\n}\n\nexport class ShareEnvelopeError extends Error {\n  readonly code:\n    | \"invalid-link\"\n    | \"invalid-envelope\"\n    | \"expired\"\n    | \"signature-invalid\"\n    | \"cid-mismatch\"\n    | \"origin-mismatch\"\n    | \"content-too-large\"\n    | \"encryption-required\"\n    | \"unsafe-plaintext\";\n\n  constructor(code: ShareEnvelopeError[\"code\"], message: string) {\n    super(message);\n    this.name = \"ShareEnvelopeError\";\n    this.code = code;\n  }\n}\n\nfunction bytesToBase64Url(bytes: Uint8Array): string {\n  let binary = \"\";\n  for (const byte of bytes) binary += String.fromCharCode(byte);\n  const encoded = typeof btoa === \"function\"\n    ? btoa(binary)\n    : Buffer.from(bytes).toString(\"base64\");\n  return encoded.replace(/\\+/g, \"-\").replace(/\\//g, \"_\").replace(/=+$/g, \"\");\n}\n\nfunction base64UrlToBytes(value: string): Uint8Array {\n  if (!/^[A-Za-z0-9_-]*$/.test(value) || value.length % 4 === 1) {\n    throw new ShareEnvelopeError(\"invalid-link\", \"non-canonical base64url\");\n  }\n  const padded = value.replace(/-/g, \"+\").replace(/_/g, \"/\") + \"=\".repeat((4 - value.length % 4) % 4);\n  const decoded = typeof atob === \"function\"\n    ? (() => {\n        const binary = atob(padded);\n        return Uint8Array.from(binary, (char) => char.charCodeAt(0));\n      })()\n    : new Uint8Array(Buffer.from(padded, \"base64\"));\n  if (bytesToBase64Url(decoded) !== value) throw new ShareEnvelopeError(\"invalid-link\", \"non-canonical base64url\");\n  return decoded;\n}\n\nfunction assertKeys(value: object, allowed: readonly string[], label: string): void {\n  const permitted = new Set(allowed);\n  for (const key of Object.keys(value)) if (!permitted.has(key)) throw new ShareEnvelopeError(\"invalid-envelope\", `${label} contains an unknown field`);\n}\n\nfunction canonicalJson(value: unknown): string {\n  if (value === null || typeof value === \"string\" || typeof value === \"boolean\") {\n    return JSON.stringify(value);\n  }\n  if (typeof value === \"number\") {\n    if (!Number.isFinite(value)) throw new ShareEnvelopeError(\"invalid-envelope\", \"non-finite number\");\n    return JSON.stringify(value);\n  }\n  if (Array.isArray(value)) return `[${value.map(canonicalJson).join(\",\")}]`;\n  if (typeof value === \"object\") {\n    const object = value as Record<string, unknown>;\n    return `{${Object.keys(object).sort().map((key) => `${JSON.stringify(key)}:${canonicalJson(object[key])}`).join(\",\")}}`;\n  }\n  throw new ShareEnvelopeError(\"invalid-envelope\", \"unsupported JSON value\");\n}\n\nfunction skipWhitespace(text: string, start: number): number {\n  let index = start;\n  while (/\\s/.test(text[index] ?? \"\")) index += 1;\n  return index;\n}\n\nfunction scanJsonValue(text: string, start: number): number {\n  let index = skipWhitespace(text, start);\n  const first = text[index];\n  if (first === '\"') {\n    index += 1;\n    while (index < text.length) {\n      if (text[index] === \"\\\\\") index += 2;\n      else if (text[index++] === '\"') return index;\n    }\n    throw new ShareEnvelopeError(\"invalid-envelope\", \"unterminated JSON string\");\n  }\n  if (first === \"{\") {\n    const keys = new Set<string>();\n    index = skipWhitespace(text, index + 1);\n    if (text[index] === \"}\") return index + 1;\n    while (index < text.length) {\n      index = skipWhitespace(text, index);\n      if (text[index] !== '\"') throw new ShareEnvelopeError(\"invalid-envelope\", \"object key must be a string\");\n      const keyStart = index;\n      index = scanJsonValue(text, index);\n      const key = JSON.parse(text.slice(keyStart, index)) as string;\n      if (keys.has(key)) throw new ShareEnvelopeError(\"invalid-envelope\", `duplicate JSON key ${key}`);\n      keys.add(key);\n      index = skipWhitespace(text, index);\n      if (text[index++] !== \":\") throw new ShareEnvelopeError(\"invalid-envelope\", \"missing object colon\");\n      index = scanJsonValue(text, index);\n      index = skipWhitespace(text, index);\n      if (text[index] === \"}\") return index + 1;\n      if (text[index++] !== \",\") throw new ShareEnvelopeError(\"invalid-envelope\", \"invalid object separator\");\n    }\n    throw new ShareEnvelopeError(\"invalid-envelope\", \"unterminated JSON object\");\n  }\n  if (first === \"[\") {\n    index = skipWhitespace(text, index + 1);\n    if (text[index] === \"]\") return index + 1;\n    while (index < text.length) {\n      index = scanJsonValue(text, index);\n      index = skipWhitespace(text, index);\n      if (text[index] === \"]\") return index + 1;\n      if (text[index++] !== \",\") throw new ShareEnvelopeError(\"invalid-envelope\", \"invalid array separator\");\n    }\n    throw new ShareEnvelopeError(\"invalid-envelope\", \"unterminated JSON array\");\n  }\n  const match = text.slice(index).match(/^(?:true|false|null|-?(?:0|[1-9]\\d*)(?:\\.\\d+)?(?:[eE][+-]?\\d+)?)/);\n  if (!match) throw new ShareEnvelopeError(\"invalid-envelope\", \"invalid JSON value\");\n  return index + match[0].length;\n}\n\nfunction parseCanonicalJson(text: string): unknown {\n  try {\n    const end = scanJsonValue(text, 0);\n    if (skipWhitespace(text, end) !== text.length) throw new Error(\"trailing JSON\");\n    const parsed = JSON.parse(text) as unknown;\n    if (canonicalJson(parsed) !== text) throw new Error(\"non-canonical JSON\");\n    return parsed;\n  } catch (error) {\n    if (error instanceof ShareEnvelopeError) throw error;\n    throw new ShareEnvelopeError(\"invalid-envelope\", error instanceof Error ? error.message : \"invalid JSON\");\n  }\n}\n\nfunction normalizeOrigin(value: string): string {\n  try {\n    const url = new URL(value);\n    if (![\"http:\", \"https:\"].includes(url.protocol) || url.username || url.password || url.search || url.hash) {\n      throw new Error(\"origin must be a credential-free URL\");\n    }\n    return url.origin;\n  } catch {\n    throw new ShareEnvelopeError(\"invalid-envelope\", \"invalid trusted origin\");\n  }\n}\n\nfunction normalizeResource(resource: ShareResource): ShareResource {\n  if (resource.kind !== \"exact\" && resource.kind !== \"prefix\") throw new ShareEnvelopeError(\"invalid-envelope\", \"invalid resource kind\");\n  if (!resource.path || resource.path.startsWith(\"/\") || /[\\u0000-\\u001f\\u007f\\\\]/.test(resource.path) || /%2f|%5c|%2e/i.test(resource.path) || resource.path.split(\"/\").some((part, index, parts) => part === \".\" || part === \"..\" || (part.length === 0 && !(resource.kind === \"prefix\" && index === parts.length - 1)))) {\n    throw new ShareEnvelopeError(\"invalid-envelope\", \"resource path is not canonical\");\n  }\n  return { kind: resource.kind, path: resource.kind === \"prefix\" && !resource.path.endsWith(\"/\") ? `${resource.path}/` : resource.path };\n}\n\nfunction normalizeActions(actions: readonly ShareAction[]): ShareAction[] {\n  const allowed = new Set<ShareAction>([\"read\", \"list\", \"edit\"]);\n  if (actions.length === 0 || new Set(actions).size !== actions.length || actions.some((action) => !allowed.has(action))) {\n    throw new ShareEnvelopeError(\"invalid-envelope\", \"actions must be a non-empty canonical set\");\n  }\n  return [...actions].sort((a, b) => a.localeCompare(b));\n}\n\nfunction normalizeRecipient(recipient: ShareRecipientTarget | undefined): ShareRecipientTarget | undefined {\n  if (recipient === undefined) return undefined;\n  if (recipient.kind === \"bearer\") return { kind: \"bearer\" };\n  if (typeof recipient.value !== \"string\" || recipient.value.length === 0 || /[\\r\\n]/.test(recipient.value)) {\n    throw new ShareEnvelopeError(\"invalid-envelope\", \"recipient value is invalid\");\n  }\n  if (recipient.kind === \"emailDomain\") {\n    const domain = recipient.value.toLowerCase();\n    if (!/^(?:[a-z0-9](?:[a-z0-9-]{0,61}[a-z0-9])?)(?:\\.(?:[a-z0-9](?:[a-z0-9-]{0,61}[a-z0-9])?))+$/i.test(domain)) {\n      throw new ShareEnvelopeError(\"invalid-envelope\", \"recipient domain is invalid\");\n    }\n    return { kind: recipient.kind, value: domain };\n  }\n  if (recipient.kind === \"recipientDid\") {\n    if (!isCanonicalRecipientDid(recipient.value)) throw new ShareEnvelopeError(\"invalid-envelope\", \"recipient DID is invalid\");\n    return { kind: recipient.kind, value: recipient.value };\n  }\n  // Mailbox matching is case-sensitive in the local part.  Only the DNS\n  // portion is normalized, which is the same contract used by the auth and\n  // node layers.  Trimming is limited to transport framing; it must never\n  // alter characters inside the mailbox.\n  const exact = recipient.value.trim();\n  const at = exact.lastIndexOf(\"@\");\n  const normalizedExact = at > 0 ? `${exact.slice(0, at)}@${exact.slice(at + 1).toLowerCase()}` : exact;\n  if (recipient.kind !== \"exactEmail\" || !/^[^@\\s]+@[^@\\s]+$/.test(normalizedExact)) {\n    throw new ShareEnvelopeError(\"invalid-envelope\", \"recipient matcher is invalid\");\n  }\n  return { kind: recipient.kind, value: normalizedExact };\n}\n\nfunction isCanonicalRecipientDid(value: string): boolean {\n  if (value.length === 0 || value.length > 2048 || /[\\u0000-\\u0020\\u007f]/.test(value)) return false;\n  const parts = value.split(\":\");\n  if (parts.length < 3 || parts[0] !== \"did\" || !/^[a-z0-9]+$/.test(parts[1] ?? \"\")) return false;\n  const identifier = parts.slice(2);\n  if (identifier.some((part) => part.length === 0)) return false;\n  if (parts[1] === \"web\") {\n    const host = identifier[0] ?? \"\";\n    if (host.length > 253 || host.split(\".\").some((label) => !label || label.length > 63 || !/^[A-Za-z0-9-]+$/.test(label) || label.startsWith(\"-\") || label.endsWith(\"-\"))) return false;\n    return identifier.slice(1).every((part) => /^[A-Za-z0-9._%-]+$/.test(part));\n  }\n  if (parts[1] === \"pkh\") return identifier.length >= 3 && identifier.every((part) => /^[A-Za-z0-9._%-]+$/.test(part));\n  if (parts[1] === \"key\") {\n    try {\n      const bytes = base58btc.decode(identifier.join(\":\"));\n      return bytes.length === 34 && bytes[0] === 0xed && bytes[1] === 0x01;\n    } catch {\n      return false;\n    }\n  }\n  return false;\n}\n\nexport function normalizeShareRecipientTarget(recipient: ShareRecipientTarget): ShareRecipientTarget {\n  const normalized = normalizeRecipient(recipient);\n  if (normalized === undefined) throw new ShareEnvelopeError(\"invalid-envelope\", \"recipient matcher is required\");\n  return normalized;\n}\n\nexport function normalizeShareResource(resource: ShareResource): ShareResource {\n  return normalizeResource(resource);\n}\n\nexport function normalizeShareActions(actions: readonly ShareAction[]): ShareAction[] {\n  return normalizeActions(actions);\n}\n\nfunction resourceContains(outer: ShareResource, inner: ShareResource): boolean {\n  if (outer.kind === \"exact\") return inner.kind === \"exact\" && outer.path === inner.path;\n  const prefix = outer.path.endsWith(\"/\") ? outer.path : `${outer.path}/`;\n  const outerPath = prefix.slice(0, -1);\n  if (inner.kind === \"exact\") return inner.path.startsWith(prefix) || inner.path === outerPath;\n  const innerPrefix = inner.path.endsWith(\"/\") ? inner.path : `${inner.path}/`;\n  return inner.path === outerPath || innerPrefix.startsWith(prefix);\n}\n\nexport function createSharePolicy(input: Omit<SharePolicy, \"expiresAt\"> & { readonly expiresAt: Date }): SharePolicy {\n  return {\n    matcher: normalizeShareRecipientTarget(input.matcher),\n    spaceId: input.spaceId,\n    resource: normalizeShareResource(input.resource),\n    actions: normalizeShareActions(input.actions),\n    expiresAt: input.expiresAt.toISOString(),\n  };\n}\n\nfunction contentDigest(bytes: Uint8Array): string {\n  return bytesToBase64Url(sha256(bytes));\n}\n\nexport function computeShareCid(bytes: Uint8Array): string {\n  const digest = createDigest(BLAKE3_256_CODE, blake3(bytes));\n  return CID.createV1(RAW_CID_CODEC, digest).toString();\n}\n\nexport function verifyShareCid(cid: string, bytes: Uint8Array): boolean {\n  try {\n    const parsed = CID.parse(cid);\n    if (parsed.toString() !== cid || parsed.multihash.code !== BLAKE3_256_CODE) return false;\n    return parsed.equals(CID.createV1(parsed.code, createDigest(parsed.multihash.code, blake3(bytes))));\n  } catch {\n    return false;\n  }\n}\n\nfunction envelopeSigningBytes(envelope: Omit<ShareEnvelopeV2, \"signature\">): Uint8Array {\n  return new TextEncoder().encode(canonicalJson(envelope));\n}\n\nexport function signShareEnvelope(input: Omit<ShareEnvelopeV2, \"signature\" | \"signer\"> & { signerDid: string; signerPrivateKey: Uint8Array }): ShareEnvelopeV2 {\n  if (input.signerPrivateKey.length !== 32) throw new ShareEnvelopeError(\"invalid-envelope\", \"Ed25519 private key must be 32 bytes\");\n  const publicKey = ed25519.getPublicKey(input.signerPrivateKey);\n  const unsigned = {\n    schema: ENVELOPE_SCHEMA,\n    version: 2 as const,\n    origin: normalizeOrigin(input.origin),\n    spaceId: input.spaceId,\n    ...(normalizeRecipient(input.recipient)?.kind === \"bearer\" ? { recipient: { kind: \"bearer\" as const } } : {}),\n    ...(input.recipientKind === undefined && input.recipient === undefined ? {} : { recipientKind: input.recipientKind ?? normalizeRecipient(input.recipient)?.kind }),\n    resource: normalizeResource(input.resource),\n    actions: normalizeActions(input.actions),\n    content: input.content,\n    encrypted: input.encrypted,\n    expiresAt: new Date(input.expiresAt).toISOString(),\n    signer: { did: input.signerDid, publicKey: bytesToBase64Url(publicKey) },\n  } satisfies Omit<ShareEnvelopeV2, \"signature\">;\n  return { ...unsigned, signature: bytesToBase64Url(ed25519.sign(envelopeSigningBytes(unsigned), input.signerPrivateKey)) };\n}\n\nexport function verifyShareEnvelope(envelope: ShareEnvelopeV2, options: VerifyShareEnvelopeOptions = {}): ShareEnvelopeV2 {\n  try {\n    assertKeys(envelope as object, [\"schema\", \"version\", \"origin\", \"spaceId\", \"recipient\", \"recipientKind\", \"resource\", \"actions\", \"content\", \"encrypted\", \"expiresAt\", \"signer\", \"signature\"], \"share envelope\");\n    assertKeys(envelope.resource as object, [\"kind\", \"path\"], \"share resource\");\n    assertKeys(envelope.content as object, [\"mimeType\", \"size\", \"digest\", \"charset\"], \"share content\");\n    assertKeys(envelope.signer as object, [\"did\", \"publicKey\"], \"share signer\");\n    if (envelope.recipient !== undefined) assertKeys(envelope.recipient as object, envelope.recipient.kind === \"bearer\" ? [\"kind\"] : [\"kind\", \"value\"], \"share recipient\");\n    if (envelope.schema !== ENVELOPE_SCHEMA || envelope.version !== 2 || typeof envelope.signature !== \"string\") throw new Error(\"unsupported envelope\");\n    if (normalizeOrigin(envelope.origin) !== envelope.origin) throw new Error(\"origin is not canonical\");\n    if (options.expectedOrigin !== undefined && normalizeOrigin(options.expectedOrigin) !== envelope.origin) throw new ShareEnvelopeError(\"origin-mismatch\", \"envelope origin is not trusted\");\n    const expiry = Date.parse(envelope.expiresAt);\n    if (!Number.isFinite(expiry) || expiry <= (options.now ?? new Date()).getTime()) throw new ShareEnvelopeError(\"expired\", \"share envelope has expired\");\n    if (new Date(expiry).toISOString() !== envelope.expiresAt) throw new ShareEnvelopeError(\"invalid-envelope\", \"expiry is not canonical\");\n    const resource = normalizeResource(envelope.resource);\n    if (resource.kind !== envelope.resource.kind || resource.path !== envelope.resource.path) throw new ShareEnvelopeError(\"invalid-envelope\", \"resource is not canonical\");\n    const actions = normalizeActions(envelope.actions);\n    if (actions.join(\"\\0\") !== envelope.actions.join(\"\\0\")) throw new ShareEnvelopeError(\"invalid-envelope\", \"actions are not canonical\");\n    const recipient = normalizeRecipient(envelope.recipient);\n    if (recipient !== undefined && JSON.stringify(recipient) !== JSON.stringify(envelope.recipient)) throw new ShareEnvelopeError(\"invalid-envelope\", \"recipient is not canonical\");\n    if (recipient?.kind === \"exactEmail\" || recipient?.kind === \"emailDomain\") throw new ShareEnvelopeError(\"unsafe-plaintext\", \"recipient matchers are not public envelope fields\");\n    if (envelope.recipientKind !== undefined && ![\"exactEmail\", \"emailDomain\", \"recipientDid\", \"bearer\"].includes(envelope.recipientKind)) throw new ShareEnvelopeError(\"invalid-envelope\", \"recipient mode is invalid\");\n    if (envelope.recipientKind === \"bearer\" && recipient?.kind !== undefined && recipient.kind !== \"bearer\") throw new ShareEnvelopeError(\"invalid-envelope\", \"recipient mode does not match recipient\");\n    if ((envelope.recipientKind === \"exactEmail\" || envelope.recipientKind === \"emailDomain\" || envelope.recipientKind === \"recipientDid\") && !envelope.encrypted) throw new ShareEnvelopeError(\"unsafe-plaintext\", \"addressed shares require encryption\");\n    if (typeof envelope.spaceId !== \"string\" || envelope.spaceId.length === 0 || typeof envelope.content.mimeType !== \"string\" || envelope.content.mimeType.length === 0 || typeof envelope.content.digest !== \"string\" || !/^[A-Za-z0-9_-]+$/.test(envelope.content.digest)) throw new ShareEnvelopeError(\"invalid-envelope\", \"content metadata is invalid\");\n    const maxContentBytes = envelope.encrypted\n      ? options.maxSealedContentBytes ?? MAX_SEALED_SHARE_CONTENT_BYTES\n      : options.maxContentBytes ?? MAX_SHARE_CONTENT_BYTES;\n    if (!Number.isInteger(envelope.content.size) || envelope.content.size < 0 || envelope.content.size > maxContentBytes) throw new ShareEnvelopeError(\"content-too-large\", \"share content exceeds the configured limit\");\n    const publicKey = base64UrlToBytes(envelope.signer.publicKey);\n    const signature = base64UrlToBytes(envelope.signature);\n    const unsigned = { ...envelope } as Omit<ShareEnvelopeV2, \"signature\">;\n    delete (unsigned as { signature?: string }).signature;\n    if (publicKey.length !== 32 || signature.length !== 64 || !ed25519.verify(signature, envelopeSigningBytes(unsigned), publicKey)) throw new ShareEnvelopeError(\"signature-invalid\", \"share envelope signature is invalid\");\n    if (options.trustedSignerDids !== undefined && envelope.recipientKind !== undefined && !options.trustedSignerDids.includes(envelope.signer.did)) throw new ShareEnvelopeError(\"signature-invalid\", \"share signer is not trusted\");\n    return envelope;\n  } catch (error) {\n    if (error instanceof ShareEnvelopeError) throw error;\n    throw new ShareEnvelopeError(\"invalid-envelope\", error instanceof Error ? error.message : \"invalid envelope\");\n  }\n}\n\nexport function encodeShareArtifact(artifact: ShareArtifactV2): Uint8Array {\n  const normalized = parseShareArtifact(new TextEncoder().encode(canonicalJson(artifact)), { verify: false });\n  return new TextEncoder().encode(canonicalJson(normalized));\n}\n\nexport function parseShareArtifact(bytes: Uint8Array, options: VerifyShareEnvelopeOptions & { readonly verify?: boolean } = {}): ShareArtifactV2 {\n  if (bytes.byteLength > (options.maxArtifactBytes ?? DEFAULT_MAX_ARTIFACT_BYTES)) throw new ShareEnvelopeError(\"content-too-large\", \"share artifact exceeds the configured limit\");\n  const parsed = parseCanonicalJson(new TextDecoder().decode(bytes));\n  if (parsed === null || typeof parsed !== \"object\" || Array.isArray(parsed)) throw new ShareEnvelopeError(\"invalid-envelope\", \"share artifact must be an object\");\n  const artifact = parsed as ShareArtifactV2;\n  if (!artifact.envelope || typeof artifact.content !== \"string\" || !/^[A-Za-z0-9_-]*$/.test(artifact.content)) throw new ShareEnvelopeError(\"invalid-envelope\", \"share artifact shape is invalid\");\n  assertKeys(artifact as object, [\"envelope\", \"content\"], \"share artifact\");\n  if (options.verify !== false) verifyShareEnvelope(artifact.envelope, options);\n  const bytesValue = base64UrlToBytes(artifact.content);\n  if (bytesValue.byteLength !== artifact.envelope.content.size || contentDigest(bytesValue) !== artifact.envelope.content.digest) throw new ShareEnvelopeError(\"invalid-envelope\", \"share content digest does not match envelope\");\n  if (artifact.envelope.encrypted && bytesValue.byteLength < 16) throw new ShareEnvelopeError(\"invalid-envelope\", \"encrypted share content is too short\");\n  if (!artifact.envelope.encrypted && artifact.envelope.recipient !== undefined) {\n    throw new ShareEnvelopeError(\"unsafe-plaintext\", \"recipient PII cannot be placed in an unencrypted envelope\");\n  }\n  return artifact;\n}\n\nexport function encodeShareUrl(input: { readonly origin: string; readonly cid: string; readonly key?: Uint8Array }): string {\n  const origin = normalizeOrigin(input.origin);\n  try {\n    if (CID.parse(input.cid).toString() !== input.cid) throw new Error(\"non-canonical CID\");\n  } catch {\n    throw new ShareEnvelopeError(\"invalid-link\", \"CID is not canonical\");\n  }\n  if (input.key !== undefined && input.key.length !== 32) throw new ShareEnvelopeError(\"invalid-link\", \"fragment key must be 32 bytes\");\n  return `${origin}/s/${input.cid}${input.key === undefined ? \"\" : `#k=${bytesToBase64Url(input.key)}`}`;\n}\n\nexport function encodeInlineShareUrl(input: { readonly origin: string; readonly artifact: ShareArtifactV2; readonly key?: Uint8Array; readonly maxInlineBytes?: number }): string {\n  const bytes = encodeShareArtifact(input.artifact);\n  const encoded = bytesToBase64Url(bytes);\n  if (bytes.byteLength > (input.maxInlineBytes ?? DEFAULT_MAX_INLINE_BYTES)) throw new ShareEnvelopeError(\"content-too-large\", \"inline share exceeds the configured limit\");\n  if (input.artifact.envelope.encrypted && (input.key === undefined || input.key.length !== 32)) throw new ShareEnvelopeError(\"encryption-required\", \"encrypted inline shares require a 32-byte fragment key\");\n  if (!input.artifact.envelope.encrypted && input.key !== undefined) throw new ShareEnvelopeError(\"unsafe-plaintext\", \"plaintext shares cannot carry a fragment key\");\n  return `${normalizeOrigin(input.origin)}/s/i/${encoded}${input.key === undefined ? \"\" : `#k=${bytesToBase64Url(input.key)}`}`;\n}\n\n/** The published Share package's v2 envelope, kept local so the SDK has no runtime dependency on the Share app. */\nexport interface PublishedShareEnvelopeV2 {\n  /** The published envelope wire format is v1; the SDK's normalized artifact is v2. */\n  readonly version: 1;\n  readonly shareId: string;\n  readonly delegation: string;\n  readonly authorizationTarget:\n    | { readonly kind: \"policy\"; readonly policyCid: string; readonly policyBytes: string }\n    | { readonly kind: \"bearerKey\"; readonly sessionJwk: Record<string, unknown> }\n    | { readonly kind: \"recipientDid\"; readonly did: string };\n  readonly target: { readonly origin: string; readonly nodeAudience: string; readonly spaceId: string; readonly resource: ShareResource };\n  readonly display: { readonly senderName?: string; readonly filename?: string; readonly recipientHint?: string; readonly mode?: \"document\" | \"source\" | \"folder\" };\n  readonly expiry: string;\n  readonly content?: { readonly cid: string; readonly key: string };\n  readonly signature: { readonly signerDid: string; readonly algorithm: \"Ed25519\"; readonly value: string };\n}\n\nconst PUBLISHED_AAD = new TextEncoder().encode(\"tinycloud-share-envelope-v1\");\n\nfunction publishedCid(bytes: Uint8Array): string {\n  return CID.create(1, raw.code, createDigest(sha256Cid.code, sha256(bytes))).toString();\n}\n\nfunction isPublishedCid(value: string): boolean {\n  try {\n    const parsed = CID.parse(value);\n    return parsed.version === 1 && parsed.code === raw.code && parsed.multihash.code === sha256Cid.code && parsed.toString() === value;\n  } catch {\n    return false;\n  }\n}\n\nfunction publishedPublicKey(did: string): Uint8Array {\n  const value = did.slice(\"did:key:\".length);\n  const encoded = base58btc.decode(value);\n  if (encoded.length !== 34 || encoded[0] !== 0xed || encoded[1] !== 0x01) throw new ShareEnvelopeError(\"invalid-envelope\", \"published signer is not Ed25519\");\n  return encoded.slice(2);\n}\n\nfunction publishedEnvelopeSigningBytes(envelope: PublishedShareEnvelopeV2): Uint8Array {\n  const { signature: _signature, ...unsigned } = envelope;\n  const domain = new TextEncoder().encode(\"xyz.tinycloud.share/envelope/v2\\0\");\n  const body = new TextEncoder().encode(canonicalJson(unsigned));\n  const result = new Uint8Array(domain.length + body.length);\n  result.set(domain);\n  result.set(body, domain.length);\n  return result;\n}\n\ninterface PublishedPolicyMetadata {\n  readonly recipientKind: \"exactEmail\" | \"emailDomain\" | \"recipientDid\";\n  readonly actions: readonly ShareAction[];\n  readonly resource: ShareResource;\n}\n\nfunction publishedArtifact(envelope: PublishedShareEnvelopeV2, plaintext: Uint8Array, policy?: PublishedPolicyMetadata): ShareArtifactV2 {\n  const content = bytesToBase64Url(plaintext);\n  const signerKey = publishedPublicKey(envelope.signature.signerDid);\n  return {\n    envelope: {\n      schema: ENVELOPE_SCHEMA,\n      version: 2,\n      origin: envelope.target.origin,\n      spaceId: envelope.target.spaceId,\n      ...(policy === undefined ? { recipientKind: envelope.authorizationTarget.kind === \"bearerKey\" ? \"bearer\" as const : envelope.authorizationTarget.kind === \"recipientDid\" ? \"bearer\" as const : undefined } : { recipientKind: policy.recipientKind }),\n      resource: policy?.resource ?? envelope.target.resource,\n      actions: [...(policy?.actions ?? [\"read\"])],\n      content: {\n        mimeType: \"application/octet-stream\",\n        size: plaintext.byteLength,\n        digest: bytesToBase64Url(sha256(plaintext)),\n      },\n      // Addressed policy metadata is confidential even though this function\n      // is called after the outer envelope has been opened. Keep the\n      // normalized artifact marked encrypted so generic envelope validation\n      // cannot mistake it for a public plaintext grant.\n      encrypted: envelope.authorizationTarget.kind !== \"bearerKey\",\n      expiresAt: envelope.expiry,\n      signer: { did: envelope.signature.signerDid, publicKey: bytesToBase64Url(signerKey) },\n      signature: envelope.signature.value,\n      authorizationTargetKind: envelope.authorizationTarget.kind,\n    },\n    content,\n  };\n}\n\nexport function verifyPublishedShareCid(cid: string, bytes: Uint8Array): boolean {\n  try {\n    const parsed = CID.parse(cid);\n    return parsed.version === 1 && parsed.code === raw.code && parsed.multihash.code === sha256Cid.code && parsed.toString() === cid && publishedCid(bytes) === cid;\n  } catch {\n    return false;\n  }\n}\n\nexport async function openPublishedShareBlob(blob: Uint8Array, key: Uint8Array): Promise<Uint8Array> {\n  if (key.length !== 32 || blob.length < 29 || blob[0] !== 1) throw new ShareEnvelopeError(\"invalid-link\", \"published sealed blob is invalid\");\n  try {\n    const cryptoKey = await crypto.subtle.importKey(\"raw\", key as unknown as ArrayBuffer, \"AES-GCM\", false, [\"decrypt\"]);\n    return new Uint8Array(await crypto.subtle.decrypt({ name: \"AES-GCM\", iv: blob.slice(1, 13) as unknown as ArrayBuffer, additionalData: PUBLISHED_AAD as unknown as ArrayBuffer }, cryptoKey, blob.slice(13) as unknown as ArrayBuffer));\n  } catch (error) {\n    throw new ShareEnvelopeError(\"signature-invalid\", error instanceof Error ? error.message : \"published envelope decryption failed\");\n  }\n}\n\nfunction parsePolicyMetadata(policyBytes: string, target: PublishedShareEnvelopeV2[\"target\"], expectedExpiry: string): PublishedPolicyMetadata {\n  const raw = base64UrlToBytes(policyBytes);\n  const value = parseCanonicalJson(new TextDecoder(\"utf-8\", { fatal: true }).decode(raw));\n  if (!value || typeof value !== \"object\" || Array.isArray(value)) throw new ShareEnvelopeError(\"invalid-envelope\", \"policy material is not an object\");\n  const policy = value as Record<string, unknown>;\n  const version = policy.version;\n  if (policy.type !== \"TinyCloudSharePolicy\" || (version !== 1 && version !== 2)) throw new ShareEnvelopeError(\"invalid-envelope\", \"policy material has an unsupported schema\");\n  if (version === 2 && policy.target !== undefined) {\n    assertKeys(policy, [\"type\", \"version\", \"issuerDid\", \"recipientMatcher\", \"target\", \"delegation\", \"authority\", \"actions\", \"resource\", \"content-source\", \"expiresAt\"], \"published canonical policy material\");\n    if (typeof policy.issuerDid !== \"string\" || typeof policy.expiresAt !== \"string\" || policy.expiresAt !== expectedExpiry) throw new ShareEnvelopeError(\"invalid-envelope\", \"policy expiry is not bound to the envelope\");\n    const matcherValue = policy.recipientMatcher;\n    if (!isPlainObject(matcherValue) || (matcherValue.kind !== \"exactEmail\" && matcherValue.kind !== \"emailDomain\" && matcherValue.kind !== \"recipientDid\") || typeof matcherValue.value !== \"string\") throw new ShareEnvelopeError(\"invalid-envelope\", \"policy matcher is invalid\");\n    const matcher = normalizeRecipient(matcherValue as ShareRecipientTarget);\n    if (matcher === undefined || matcher.kind === \"bearer\") throw new ShareEnvelopeError(\"invalid-envelope\", \"policy matcher is invalid\");\n    if (!isPlainObject(policy.target)) throw new ShareEnvelopeError(\"invalid-envelope\", \"policy target is invalid\");\n    assertKeys(policy.target, [\"origin\", \"nodeAudience\", \"spaceId\"], \"published policy target\");\n    if (policy.target.origin !== target.origin || policy.target.spaceId !== target.spaceId || policy.target.nodeAudience !== target.nodeAudience) throw new ShareEnvelopeError(\"invalid-envelope\", \"policy target is not bound to the envelope\");\n    if (!(typeof policy.delegation === \"string\" || isPlainObject(policy.delegation)) || !(typeof policy.authority === \"string\" || isPlainObject(policy.authority))) throw new ShareEnvelopeError(\"invalid-envelope\", \"policy authority material is invalid\");\n    if (!Array.isArray(policy.actions)) throw new ShareEnvelopeError(\"invalid-envelope\", \"policy actions are invalid\");\n    const actions = normalizeActions(policy.actions as ShareAction[]);\n    if (!isPlainObject(policy.resource) || (policy.resource.kind !== \"exact\" && policy.resource.kind !== \"prefix\") || typeof policy.resource.value !== \"string\") throw new ShareEnvelopeError(\"invalid-envelope\", \"policy resource is invalid\");\n    const resource = normalizeResource({ kind: policy.resource.kind, path: policy.resource.value });\n    if (!resourceContains(resource, target.resource)) throw new ShareEnvelopeError(\"invalid-envelope\", \"policy resource is not bound to the envelope\");\n    if (!isPlainObject(policy[\"content-source\"])) throw new ShareEnvelopeError(\"invalid-envelope\", \"policy content source is missing\");\n    const source = policy[\"content-source\"] as Record<string, unknown>;\n    assertKeys(source, [\"kind\", \"space\", \"path\", \"action\", \"database\", \"statement\", \"arguments\", \"argumentsDigest\", \"digest\"], \"published canonical content source\");\n    if (source.kind !== \"kv\" && source.kind !== \"sql\") throw new ShareEnvelopeError(\"invalid-envelope\", \"policy content source kind is invalid\");\n    if (typeof source.space !== \"string\" || typeof source.path !== \"string\" || typeof source.action !== \"string\") throw new ShareEnvelopeError(\"invalid-envelope\", \"policy content source is invalid\");\n    if (source.kind === \"sql\" && (typeof source.database !== \"string\" || typeof source.statement !== \"string\" || !isPlainObject(source.arguments) || typeof source.argumentsDigest !== \"string\")) throw new ShareEnvelopeError(\"invalid-envelope\", \"policy SQL content source is invalid\");\n    return { recipientKind: matcher.kind, actions, resource };\n  }\n  const allowed = version === 1\n    ? [\"type\", \"version\", \"issuerDid\", \"recipientEmail\", \"expiresAt\", \"action\", \"resource\", \"contentSource\", \"contentSourceDigest\"]\n    : [\"type\", \"version\", \"issuerDid\", \"recipientMatcher\", \"expiresAt\", \"actions\", \"resource\", \"content-source\", \"contentSourceDigest\"];\n  assertKeys(policy, allowed, \"published policy material\");\n  if (typeof policy.issuerDid !== \"string\" || typeof policy.expiresAt !== \"string\" || policy.expiresAt !== expectedExpiry) throw new ShareEnvelopeError(\"invalid-envelope\", \"policy expiry is not bound to the envelope\");\n  const matcher = policy.recipientMatcher;\n  let recipientKind: \"exactEmail\" | \"emailDomain\";\n  if (version === 1) {\n    if (typeof policy.recipientEmail !== \"string\") throw new ShareEnvelopeError(\"invalid-envelope\", \"policy recipient is missing\");\n    normalizeRecipient({ kind: \"exactEmail\", value: policy.recipientEmail });\n    recipientKind = \"exactEmail\";\n  } else {\n    if (!matcher || typeof matcher !== \"object\" || Array.isArray(matcher)) throw new ShareEnvelopeError(\"invalid-envelope\", \"policy matcher is missing\");\n    const parsedMatcher = matcher as Record<string, unknown>;\n    if (parsedMatcher.kind !== \"exactEmail\" && parsedMatcher.kind !== \"emailDomain\" || typeof parsedMatcher.value !== \"string\") throw new ShareEnvelopeError(\"invalid-envelope\", \"policy matcher is invalid\");\n    normalizeRecipient(parsedMatcher as ShareRecipientTarget);\n    if (policy.deliveryEmail !== undefined) normalizeRecipient({ kind: \"exactEmail\", value: policy.deliveryEmail as string });\n    recipientKind = parsedMatcher.kind;\n  }\n  const actionValue = policy.actions ?? policy.action;\n  const actionNames = Array.isArray(actionValue) ? actionValue : [actionValue];\n  const actions = normalizeActions(actionNames.map((action) => action === \"tinycloud.kv/get\" || action === \"get\" || action === \"read\" ? \"read\" : action === \"tinycloud.kv/list\" || action === \"list\" ? \"list\" : action === \"tinycloud.kv/put\" || action === \"tinycloud.kv/edit\" || action === \"put\" || action === \"edit\" ? \"edit\" : action) as ShareAction[]);\n  const resourceValue = policy.resource;\n  let resource: ShareResource;\n  if (resourceValue && typeof resourceValue === \"object\" && !Array.isArray(resourceValue)) {\n    const candidate = resourceValue as Record<string, unknown>;\n    // v2 policy resources use {kind,value}; v1 uses {kind,path}.  Accepting\n    // both here is intentional: the v1 adapter remains read-only while v2\n    // links and vectors use the canonical value spelling.\n    const path = typeof candidate.path === \"string\" ? candidate.path : candidate.value;\n    if (typeof path !== \"string\" || (candidate.kind !== \"exact\" && candidate.kind !== \"prefix\")) throw new ShareEnvelopeError(\"invalid-envelope\", \"policy resource is invalid\");\n    resource = normalizeResource({ kind: candidate.kind, path });\n  } else {\n    resource = normalizeResource({ kind: \"exact\", path: typeof resourceValue === \"string\" ? resourceValue : target.resource.path });\n  }\n  // The policy/delegation is the authority ceiling.  The envelope may only\n  // attenuate it; the inverse check would accept a policy for one exact file\n  // wrapped in a broader prefix envelope.\n  if (!resourceContains(resource, target.resource)) throw new ShareEnvelopeError(\"invalid-envelope\", \"policy resource is not bound to the envelope\");\n  const contentSourceValue = version === 2 ? policy[\"content-source\"] : policy.contentSource;\n  if (!contentSourceValue || typeof contentSourceValue !== \"object\" || Array.isArray(contentSourceValue)) throw new ShareEnvelopeError(\"invalid-envelope\", \"policy content source is missing\");\n  const source = contentSourceValue as Record<string, unknown>;\n  if (source.kind === \"kv\") {\n    assertKeys(source, [\"kind\", \"space\", \"path\", \"action\"], \"published KV content source\");\n    if (typeof source.space !== \"string\" || typeof source.path !== \"string\" || ![\"tinycloud.kv/get\", \"tinycloud.kv/list\", \"tinycloud.kv/put\"].includes(source.action as string)) throw new ShareEnvelopeError(\"invalid-envelope\", \"published KV content source is invalid\");\n  } else if (source.kind === \"sql\") {\n    assertKeys(source, [\"kind\", \"space\", \"database\", \"path\", \"statement\", \"arguments\", \"argumentsDigest\", \"action\"], \"published SQL content source\");\n    if (typeof source.space !== \"string\" || typeof source.database !== \"string\" || typeof source.path !== \"string\" || typeof source.statement !== \"string\" || !source.arguments || typeof source.arguments !== \"object\" || Array.isArray(source.arguments) || typeof source.argumentsDigest !== \"string\" || source.action !== \"tinycloud.sql/read\") throw new ShareEnvelopeError(\"invalid-envelope\", \"published SQL content source is invalid\");\n    for (const argument of Object.values(source.arguments as Record<string, unknown>)) if (!Number.isSafeInteger(argument)) throw new ShareEnvelopeError(\"invalid-envelope\", \"published SQL arguments are invalid\");\n    if (bytesToBase64Url(sha256(new TextEncoder().encode(canonicalJson(source.arguments)))) !== source.argumentsDigest) throw new ShareEnvelopeError(\"invalid-envelope\", \"published SQL argument digest is invalid\");\n  }\n  else throw new ShareEnvelopeError(\"invalid-envelope\", \"policy content source kind is invalid\");\n  if (typeof policy.contentSourceDigest !== \"string\" || bytesToBase64Url(sha256(new TextEncoder().encode(canonicalJson(source)))) !== policy.contentSourceDigest) throw new ShareEnvelopeError(\"invalid-envelope\", \"policy content source digest is invalid\");\n  return { recipientKind, actions, resource };\n}\n\n/**\n * Parse the canonical Share v2 publication.  The hyphenated content-source\n * member is intentional: it is part of the signed wire contract and is not\n * interchangeable with the v1 contentSource spelling.\n */\nfunction parseCanonicalPublishedV2(value: Record<string, unknown>, options: { readonly expectedOrigin?: string; readonly now?: Date; readonly plaintext?: Uint8Array; readonly trustedSignerDids?: readonly string[] }): { readonly artifact: ShareArtifactV2; readonly envelope: PublishedShareEnvelopeV2 } {\n  assertKeys(value, [\"version\", \"shareId\", \"target\", \"delegation\", \"authority\", \"recipientMatcher\", \"actions\", \"resource\", \"content-source\", \"expiry\", \"signature\"], \"published v2 envelope\");\n  if (value.version !== 2 || typeof value.shareId !== \"string\" || value.shareId.length === 0 || typeof value.expiry !== \"string\") throw new ShareEnvelopeError(\"invalid-envelope\", \"published v2 envelope shape is invalid\");\n  const target = value.target;\n  const delegation = value.delegation;\n  const authority = value.authority;\n  const resourceValue = value.resource;\n  if (!isPlainObject(target) || !isPlainObject(delegation) || !isPlainObject(authority) || !isPlainObject(resourceValue)) throw new ShareEnvelopeError(\"invalid-envelope\", \"published v2 binding is invalid\");\n  assertKeys(target, [\"origin\", \"nodeAudience\", \"spaceId\"], \"published v2 target\");\n  assertKeys(delegation, [\"cid\", \"issuerDid\", \"audience\", \"expiresAt\", \"encoded\"], \"published v2 delegation\");\n  assertKeys(authority, [\"kind\", \"did\", \"publicKey\", \"cid\", \"signature\"], \"published v2 authority\");\n  assertKeys(resourceValue, [\"kind\", \"value\"], \"published v2 resource\");\n  const origin = target.origin;\n  const spaceId = target.spaceId;\n  const nodeAudience = target.nodeAudience;\n  if (typeof origin !== \"string\" || normalizeOrigin(origin) !== origin || typeof spaceId !== \"string\" || spaceId.length === 0 || typeof nodeAudience !== \"string\" || nodeAudience.length === 0) throw new ShareEnvelopeError(\"invalid-envelope\", \"published v2 target is invalid\");\n  if (options.expectedOrigin !== undefined && normalizeOrigin(options.expectedOrigin) !== origin) throw new ShareEnvelopeError(\"origin-mismatch\", \"published envelope origin is not trusted\");\n  const expiry = Date.parse(value.expiry);\n  if (!Number.isFinite(expiry) || expiry <= (options.now ?? new Date()).getTime() || new Date(expiry).toISOString() !== value.expiry) throw new ShareEnvelopeError(\"expired\", \"published share envelope has expired\");\n  if (typeof delegation.cid !== \"string\" || typeof delegation.issuerDid !== \"string\" || typeof delegation.audience !== \"string\" || typeof delegation.expiresAt !== \"string\" || Date.parse(delegation.expiresAt) > expiry) throw new ShareEnvelopeError(\"invalid-envelope\", \"published v2 delegation is invalid\");\n  const matcher = value.recipientMatcher;\n  if (!isPlainObject(matcher) || (matcher.kind !== \"exactEmail\" && matcher.kind !== \"emailDomain\" && matcher.kind !== \"recipientDid\") || typeof matcher.value !== \"string\") throw new ShareEnvelopeError(\"invalid-envelope\", \"published v2 recipient matcher is invalid\");\n  const normalizedMatcher = normalizeRecipient(matcher as ShareRecipientTarget);\n  if (normalizedMatcher === undefined || normalizedMatcher.kind === \"bearer\") throw new ShareEnvelopeError(\"invalid-envelope\", \"published v2 recipient matcher is invalid\");\n  if (!Array.isArray(value.actions)) throw new ShareEnvelopeError(\"invalid-envelope\", \"published v2 actions are invalid\");\n  const actions = normalizeActions(value.actions as ShareAction[]);\n  if (!isPlainObject(value[\"content-source\"])) throw new ShareEnvelopeError(\"invalid-envelope\", \"published v2 content source is invalid\");\n  const contentSource = value[\"content-source\"] as Record<string, unknown>;\n  assertKeys(contentSource, [\"kind\", \"cid\", \"key\", \"digest\", \"mimeType\", \"size\"], \"published v2 content source\");\n  if (typeof contentSource.kind !== \"string\" || typeof contentSource.cid !== \"string\" || !isPublishedCid(contentSource.cid)) throw new ShareEnvelopeError(\"invalid-envelope\", \"published v2 content source is invalid\");\n  const resource = normalizeResource({ kind: resourceValue.kind as ShareResource[\"kind\"], path: resourceValue.value as string });\n  if (resourceValue.kind !== resource.kind || resourceValue.value !== resource.path) throw new ShareEnvelopeError(\"invalid-envelope\", \"published v2 resource is not canonical\");\n  const signature = value.signature;\n  if (!isPlainObject(signature)) throw new ShareEnvelopeError(\"invalid-envelope\", \"published v2 signature is invalid\");\n  assertKeys(signature, [\"signerDid\", \"algorithm\", \"value\"], \"published v2 signature\");\n  if (typeof signature.signerDid !== \"string\" || signature.algorithm !== \"Ed25519\" || typeof signature.value !== \"string\") throw new ShareEnvelopeError(\"invalid-envelope\", \"published v2 signature is invalid\");\n  const signerKey = publishedPublicKey(signature.signerDid);\n  if (options.trustedSignerDids !== undefined && !options.trustedSignerDids.includes(signature.signerDid)) throw new ShareEnvelopeError(\"signature-invalid\", \"a trusted authority is required for addressed shares\");\n  const signatureBytes = base64UrlToBytes(signature.value);\n  const { signature: _signature, ...unsigned } = value;\n  const domain = new TextEncoder().encode(\"xyz.tinycloud.share/envelope/v2\\0\");\n  const body = new TextEncoder().encode(canonicalJson(unsigned));\n  const signingBytes = new Uint8Array(domain.length + body.length);\n  signingBytes.set(domain); signingBytes.set(body, domain.length);\n  if (signatureBytes.length !== 64 || !ed25519.verify(signatureBytes, signingBytes, signerKey)) throw new ShareEnvelopeError(\"signature-invalid\", \"published v2 envelope signature is invalid\");\n  const content = options.plaintext ?? new Uint8Array();\n  const normalized: ShareEnvelopeV2 = {\n    schema: ENVELOPE_SCHEMA,\n    version: 2,\n    origin,\n    spaceId,\n    recipientKind: normalizedMatcher.kind,\n    resource,\n    actions,\n    content: { mimeType: typeof contentSource.mimeType === \"string\" ? contentSource.mimeType : \"application/octet-stream\", size: content.byteLength, digest: bytesToBase64Url(sha256(content)) },\n    encrypted: true,\n    expiresAt: value.expiry,\n    signer: { did: signature.signerDid, publicKey: bytesToBase64Url(signerKey) },\n    signature: signature.value,\n    authorizationTargetKind: \"policy\",\n  };\n  return { envelope: value as unknown as PublishedShareEnvelopeV2, artifact: { envelope: normalized, content: bytesToBase64Url(content) } };\n}\n\nfunction isPlainObject(value: unknown): value is Record<string, unknown> {\n  return value !== null && typeof value === \"object\" && !Array.isArray(value);\n}\n\nfunction parsePublishedEnvelopeObject(value: unknown): PublishedShareEnvelopeV2 {\n  if (!value || typeof value !== \"object\" || Array.isArray(value)) throw new ShareEnvelopeError(\"invalid-envelope\", \"published envelope is not an object\");\n  const envelope = value as Record<string, unknown>;\n  assertKeys(envelope, [\"version\", \"shareId\", \"delegation\", \"authorizationTarget\", \"target\", \"display\", \"expiry\", \"content\", \"signature\"], \"published envelope\");\n  if (envelope.version !== 1 || typeof envelope.shareId !== \"string\" || envelope.shareId.length === 0 || typeof envelope.delegation !== \"string\" || envelope.delegation.length === 0 || typeof envelope.expiry !== \"string\") throw new ShareEnvelopeError(\"invalid-envelope\", \"published envelope shape is invalid\");\n  const target = envelope.target;\n  if (!target || typeof target !== \"object\" || Array.isArray(target)) throw new ShareEnvelopeError(\"invalid-envelope\", \"published target is invalid\");\n  assertKeys(target, [\"origin\", \"nodeAudience\", \"spaceId\", \"resource\"], \"published target\");\n  const targetValue = target as Record<string, unknown>;\n  if (typeof targetValue.origin !== \"string\" || !/^https:\\/\\//.test(targetValue.origin) || normalizeOrigin(targetValue.origin) !== targetValue.origin || typeof targetValue.nodeAudience !== \"string\" || targetValue.nodeAudience.length === 0 || typeof targetValue.spaceId !== \"string\" || targetValue.spaceId.length === 0 || /[\\u0000-\\u001f\\u007f\\\\/]/.test(targetValue.spaceId)) throw new ShareEnvelopeError(\"invalid-envelope\", \"published target binding is invalid\");\n  const resource = normalizeResource(targetValue.resource as ShareResource);\n  if (JSON.stringify(resource) !== JSON.stringify(targetValue.resource)) throw new ShareEnvelopeError(\"invalid-envelope\", \"published resource is not canonical\");\n  const display = envelope.display;\n  if (!display || typeof display !== \"object\" || Array.isArray(display)) throw new ShareEnvelopeError(\"invalid-envelope\", \"published display is invalid\");\n  const displayValue = display as Record<string, unknown>;\n  assertKeys(displayValue, [\"senderName\", \"filename\", \"recipientHint\", \"mode\"], \"published display\");\n  for (const key of [\"senderName\", \"filename\", \"recipientHint\"] as const) if (displayValue[key] !== undefined && typeof displayValue[key] !== \"string\") throw new ShareEnvelopeError(\"invalid-envelope\", \"published display field is invalid\");\n  if (displayValue.mode !== undefined && ![\"document\", \"source\", \"folder\"].includes(displayValue.mode as string)) throw new ShareEnvelopeError(\"invalid-envelope\", \"published display mode is invalid\");\n  const targetAuthorization = envelope.authorizationTarget;\n  if (!targetAuthorization || typeof targetAuthorization !== \"object\" || Array.isArray(targetAuthorization)) throw new ShareEnvelopeError(\"invalid-envelope\", \"published authorization target is invalid\");\n  const authorizationTarget = targetAuthorization as Record<string, unknown>;\n  if (authorizationTarget.kind === \"policy\") {\n    assertKeys(authorizationTarget, [\"kind\", \"policyCid\", \"policyBytes\"], \"published policy target\");\n    if (typeof authorizationTarget.policyCid !== \"string\" || typeof authorizationTarget.policyBytes !== \"string\" || !verifyPublishedShareCid(authorizationTarget.policyCid, base64UrlToBytes(authorizationTarget.policyBytes))) throw new ShareEnvelopeError(\"invalid-envelope\", \"published policy material is not bound\");\n  } else if (authorizationTarget.kind === \"bearerKey\") {\n    assertKeys(authorizationTarget, [\"kind\", \"sessionJwk\"], \"published bearer target\");\n    const jwk = authorizationTarget.sessionJwk;\n    if (!jwk || typeof jwk !== \"object\" || Array.isArray(jwk)) throw new ShareEnvelopeError(\"invalid-envelope\", \"published bearer key is invalid\");\n    const jwkValue = jwk as Record<string, unknown>;\n    assertKeys(jwkValue, [\"kty\", \"crv\", \"x\", \"y\", \"d\", \"alg\", \"use\", \"key_ops\", \"kid\", \"ext\"], \"published session JWK\");\n    if (jwkValue.kty !== \"OKP\" && jwkValue.kty !== \"EC\" || typeof jwkValue.crv !== \"string\" || typeof jwkValue.x !== \"string\" || typeof jwkValue.d !== \"string\") throw new ShareEnvelopeError(\"invalid-envelope\", \"published session JWK is invalid\");\n    if (jwkValue.kty === \"EC\" && typeof jwkValue.y !== \"string\") throw new ShareEnvelopeError(\"invalid-envelope\", \"published EC session JWK is invalid\");\n    if (jwkValue.alg !== undefined && typeof jwkValue.alg !== \"string\" || jwkValue.use !== undefined && typeof jwkValue.use !== \"string\" || jwkValue.kid !== undefined && typeof jwkValue.kid !== \"string\" || jwkValue.ext !== undefined && typeof jwkValue.ext !== \"boolean\" || jwkValue.key_ops !== undefined && (!Array.isArray(jwkValue.key_ops) || jwkValue.key_ops.some((operation) => typeof operation !== \"string\"))) throw new ShareEnvelopeError(\"invalid-envelope\", \"published session JWK members are invalid\");\n    for (const member of [jwkValue.x, jwkValue.y, jwkValue.d]) if (member !== undefined) base64UrlToBytes(member as string);\n  } else if (authorizationTarget.kind === \"recipientDid\") {\n    assertKeys(authorizationTarget, [\"kind\", \"did\"], \"published DID target\");\n    if (typeof authorizationTarget.did !== \"string\" || !/^did:[a-z0-9]+:.+$/.test(authorizationTarget.did)) throw new ShareEnvelopeError(\"invalid-envelope\", \"published recipient DID is invalid\");\n  } else throw new ShareEnvelopeError(\"invalid-envelope\", \"published authorization target kind is invalid\");\n  if (envelope.content !== undefined) {\n    if (!envelope.content || typeof envelope.content !== \"object\" || Array.isArray(envelope.content)) throw new ShareEnvelopeError(\"invalid-envelope\", \"published content pointer is invalid\");\n    assertKeys(envelope.content, [\"cid\", \"key\"], \"published content pointer\");\n    const content = envelope.content as Record<string, unknown>;\n    if (typeof content.cid !== \"string\" || typeof content.key !== \"string\" || !isPublishedCid(content.cid)) throw new ShareEnvelopeError(\"invalid-envelope\", \"published content pointer is invalid\");\n    if (base64UrlToBytes(content.key).length !== 32) throw new ShareEnvelopeError(\"invalid-envelope\", \"published content key is invalid\");\n    if (authorizationTarget.kind !== \"bearerKey\") throw new ShareEnvelopeError(\"unsafe-plaintext\", \"policy envelopes cannot contain content pointers\");\n  }\n  const signature = envelope.signature;\n  if (!signature || typeof signature !== \"object\" || Array.isArray(signature)) throw new ShareEnvelopeError(\"invalid-envelope\", \"published signature is invalid\");\n  assertKeys(signature, [\"signerDid\", \"algorithm\", \"value\"], \"published signature\");\n  const signatureValue = signature as Record<string, unknown>;\n  if (typeof signatureValue.signerDid !== \"string\" || signatureValue.algorithm !== \"Ed25519\" || typeof signatureValue.value !== \"string\") throw new ShareEnvelopeError(\"invalid-envelope\", \"published signature is invalid\");\n  const signerKey = publishedPublicKey(signatureValue.signerDid);\n  if (base64UrlToBytes(signatureValue.value).length !== 64) throw new ShareEnvelopeError(\"invalid-envelope\", \"published signature length is invalid\");\n  return envelope as unknown as PublishedShareEnvelopeV2;\n}\n\nexport function parsePublishedShareEnvelope(bytes: Uint8Array, options: { readonly expectedOrigin?: string; readonly now?: Date; readonly plaintext?: Uint8Array; readonly trustedSignerDids?: readonly string[] } = {}): { readonly envelope: PublishedShareEnvelopeV2; readonly artifact: ShareArtifactV2 } {\n  let parsed: unknown;\n  try { parsed = JSON.parse(new TextDecoder(\"utf-8\", { fatal: true }).decode(bytes)); } catch { throw new ShareEnvelopeError(\"invalid-envelope\", \"published envelope is not JSON\"); }\n  if (isPlainObject(parsed) && parsed.version === 2 && parsed[\"content-source\"] !== undefined) {\n    return parseCanonicalPublishedV2(parsed, options);\n  }\n  // Current Share publishes the v2 envelope fields directly (recipient,\n  // actions, encrypted, metadata/content) rather than the older v1\n  // authorizationTarget wrapper.  Keep this adapter strict and normalize it\n  // into the SDK artifact shape before any policy/session work.\n  if (parsed && typeof parsed === \"object\" && !Array.isArray(parsed) && ((parsed as Record<string, unknown>).schema === ENVELOPE_SCHEMA || ((parsed as Record<string, unknown>).version === 2 && ((parsed as Record<string, unknown>).metadata !== undefined || (parsed as Record<string, unknown>).recipient !== undefined))) ) {\n    const direct = parsed as Record<string, unknown>;\n    const envelopeValue = direct.envelope && typeof direct.envelope === \"object\" && !Array.isArray(direct.envelope) ? direct.envelope as Record<string, unknown> : direct;\n    const value = { ...envelopeValue } as Record<string, unknown>;\n    if (value.content === undefined && value.metadata !== undefined) value.content = value.metadata;\n    delete value.metadata;\n    const contentValue = value.content;\n    if (!contentValue || typeof contentValue !== \"object\" || Array.isArray(contentValue)) throw new ShareEnvelopeError(\"invalid-envelope\", \"published v2 metadata is invalid\");\n    const artifactContent = typeof direct.content === \"string\" ? direct.content : options.plaintext === undefined ? \"\" : bytesToBase64Url(options.plaintext);\n    const artifactValue = { envelope: value, content: artifactContent };\n    const artifact = parseShareArtifact(new TextEncoder().encode(canonicalJson(artifactValue)), { expectedOrigin: options.expectedOrigin, now: options.now, maxContentBytes: DEFAULT_MAX_ARTIFACT_BYTES });\n    if (options.trustedSignerDids !== undefined && artifact.envelope.recipientKind !== undefined && !options.trustedSignerDids.includes(artifact.envelope.signer.did)) throw new ShareEnvelopeError(\"signature-invalid\", \"a trusted authority is required for addressed shares\");\n    return { envelope: direct as unknown as PublishedShareEnvelopeV2, artifact };\n  }\n  const envelope = parsePublishedEnvelopeObject(parsed);\n  if (options.expectedOrigin !== undefined && envelope.target.origin !== options.expectedOrigin) throw new ShareEnvelopeError(\"origin-mismatch\", \"published envelope origin is not trusted\");\n  if (!Number.isFinite(Date.parse(envelope.expiry)) || Date.parse(envelope.expiry) <= (options.now ?? new Date()).getTime()) throw new ShareEnvelopeError(\"expired\", \"published share envelope has expired\");\n  if (new Date(envelope.expiry).toISOString() !== envelope.expiry) throw new ShareEnvelopeError(\"invalid-envelope\", \"published expiry is not canonical\");\n  const policy = envelope.authorizationTarget.kind === \"policy\" ? parsePolicyMetadata(envelope.authorizationTarget.policyBytes, envelope.target, envelope.expiry) : undefined;\n  if (envelope.authorizationTarget.kind !== \"bearerKey\" && (options.trustedSignerDids === undefined || !options.trustedSignerDids.includes(envelope.signature.signerDid))) throw new ShareEnvelopeError(\"signature-invalid\", \"a trusted authority is required for addressed shares\");\n  const signature = base64UrlToBytes(envelope.signature.value);\n  const publicKey = publishedPublicKey(envelope.signature.signerDid);\n  if (signature.length !== 64 || !ed25519.verify(signature, publishedEnvelopeSigningBytes(envelope), publicKey)) throw new ShareEnvelopeError(\"signature-invalid\", \"published envelope signature is invalid\");\n  return { envelope, artifact: publishedArtifact(envelope, options.plaintext ?? new Uint8Array(), policy) };\n}\n\n/**\n * Read the v1 sealed envelope emitted by the existing authenticated Share\n * policy composer. It is deliberately exposed as a read-only compatibility\n * adapter: the resulting artifact carries an authorization marker, so the\n * SDK never treats this policy envelope as a local bearer grant.\n */\nexport function parseLegacyPublishedShareEnvelope(bytes: Uint8Array, options: { readonly expectedOrigin?: string; readonly now?: Date; readonly plaintext?: Uint8Array; readonly trustedSignerDids?: readonly string[] } = {}): { readonly artifact: ShareArtifactV2 } {\n  let parsed: unknown;\n  try { parsed = JSON.parse(new TextDecoder(\"utf-8\", { fatal: true }).decode(bytes)); } catch { throw new ShareEnvelopeError(\"invalid-envelope\", \"published v1 envelope is not JSON\"); }\n  if (typeof parsed !== \"object\" || parsed === null || Array.isArray(parsed)) throw new ShareEnvelopeError(\"invalid-envelope\", \"published v1 envelope is not an object\");\n  const envelope = parsed as Record<string, unknown>;\n  const target = envelope.target as Record<string, unknown> | undefined;\n  const resource = target?.resource as Record<string, unknown> | undefined;\n  const authorizationTarget = envelope.authorizationTarget as Record<string, unknown> | undefined;\n  const signature = envelope.signature as Record<string, unknown> | undefined;\n  assertKeys(envelope, [\"version\", \"shareId\", \"delegation\", \"authorizationTarget\", \"target\", \"display\", \"expiry\", \"content\", \"signature\"], \"published v1 envelope\");\n  if (target !== undefined) assertKeys(target, [\"origin\", \"nodeAudience\", \"spaceId\", \"resource\"], \"published v1 target\");\n  if (resource !== undefined) assertKeys(resource, [\"kind\", \"path\"], \"published v1 resource\");\n  if (authorizationTarget !== undefined) {\n    if (authorizationTarget.kind === \"policy\") assertKeys(authorizationTarget, [\"kind\", \"policyCid\", \"policyBytes\"], \"published v1 policy target\");\n    else if (authorizationTarget.kind === \"bearerKey\") assertKeys(authorizationTarget, [\"kind\", \"sessionJwk\"], \"published v1 bearer target\");\n    else if (authorizationTarget.kind === \"recipientDid\") assertKeys(authorizationTarget, [\"kind\", \"did\"], \"published v1 DID target\");\n    else assertKeys(authorizationTarget, [\"kind\"], \"published v1 authorization target\");\n  }\n  if (signature !== undefined) assertKeys(signature, [\"signerDid\", \"algorithm\", \"value\"], \"published v1 signature\");\n  if (envelope.version !== 1 || typeof envelope.shareId !== \"string\" || typeof envelope.expiry !== \"string\" || typeof target?.origin !== \"string\" || typeof target.spaceId !== \"string\" || typeof target.nodeAudience !== \"string\" || (resource?.kind !== \"exact\" && resource?.kind !== \"prefix\") || typeof resource.path !== \"string\" || typeof authorizationTarget?.kind !== \"string\" || typeof signature?.signerDid !== \"string\" || signature.algorithm !== \"Ed25519\" || typeof signature.value !== \"string\") throw new ShareEnvelopeError(\"invalid-envelope\", \"published v1 envelope shape is invalid\");\n  if (options.expectedOrigin !== undefined && target.origin !== options.expectedOrigin) throw new ShareEnvelopeError(\"origin-mismatch\", \"published envelope origin is not trusted\");\n  const expiry = Date.parse(envelope.expiry);\n  if (!Number.isFinite(expiry) || expiry <= (options.now ?? new Date()).getTime()) throw new ShareEnvelopeError(\"expired\", \"published share envelope has expired\");\n  const signerKey = publishedPublicKey(signature.signerDid);\n  if (authorizationTarget.kind !== \"bearer\" && (options.trustedSignerDids === undefined || !options.trustedSignerDids.includes(signature.signerDid))) throw new ShareEnvelopeError(\"signature-invalid\", \"a trusted authority is required for addressed shares\");\n  const signatureBytes = base64UrlToBytes(signature.value);\n  const { signature: _signature, ...unsigned } = envelope;\n  const domain = new TextEncoder().encode(\"xyz.tinycloud.share/envelope/v1\\0\");\n  const body = new TextEncoder().encode(canonicalJson(unsigned));\n  const signingBytes = new Uint8Array(domain.length + body.length);\n  signingBytes.set(domain); signingBytes.set(body, domain.length);\n  if (signatureBytes.length !== 64 || !ed25519.verify(signatureBytes, signingBytes, signerKey)) throw new ShareEnvelopeError(\"signature-invalid\", \"published v1 envelope signature is invalid\");\n  const content = options.plaintext ?? new Uint8Array();\n  const artifact: ShareArtifactV2 = {\n    envelope: {\n      schema: ENVELOPE_SCHEMA,\n      version: 2,\n      origin: target.origin,\n      spaceId: target.spaceId,\n      resource: { kind: resource.kind, path: resource.path },\n      recipientKind: authorizationTarget.kind === \"bearer\" ? \"bearer\" : authorizationTarget.kind === \"exact-email\" ? \"exactEmail\" : authorizationTarget.kind === \"email-domain\" ? \"emailDomain\" : undefined,\n      actions: [\"read\"],\n      content: { mimeType: \"application/octet-stream\", size: content.byteLength, digest: bytesToBase64Url(sha256(content)) },\n      encrypted: true,\n      expiresAt: envelope.expiry,\n      signer: { did: signature.signerDid, publicKey: bytesToBase64Url(signerKey) },\n      signature: signature.value,\n      authorizationTargetKind: authorizationTarget.kind,\n    },\n    content: bytesToBase64Url(content),\n  };\n  return { artifact };\n}\n\nexport function parsePublishedShareLink(link: string, options: { readonly trustedOrigins?: readonly string[]; readonly maxInlineBytes?: number } = {}): { readonly origin: string; readonly cid: string; readonly key?: Uint8Array; readonly sealed?: Uint8Array } {\n  let url: URL;\n  try { url = new URL(link); } catch { throw new ShareEnvelopeError(\"invalid-link\", \"share link must be an absolute URL\"); }\n  const origin = normalizeOrigin(url.origin);\n  if (options.trustedOrigins !== undefined && !options.trustedOrigins.map(normalizeOrigin).includes(origin)) throw new ShareEnvelopeError(\"origin-mismatch\", \"share link origin is not trusted\");\n  if (url.search !== \"\" || url.username !== \"\" || url.password !== \"\") throw new ShareEnvelopeError(\"invalid-link\", \"share link is not canonical\");\n  if (url.pathname === \"/s/inline\" && url.hash.startsWith(\"#v=2&p=\")) {\n    let payload: Record<string, unknown>;\n    try {\n      const bytes = base64UrlToBytes(url.hash.slice(\"#v=2&p=\".length));\n      if (bytes.length > (options.maxInlineBytes ?? DEFAULT_MAX_INLINE_BYTES) * 2) throw new Error(\"inline payload too large\");\n      const value = JSON.parse(new TextDecoder(\"utf-8\", { fatal: true }).decode(bytes)) as unknown;\n      if (typeof value !== \"object\" || value === null || Array.isArray(value)) throw new Error(\"inline payload shape\");\n      payload = value as Record<string, unknown>;\n    } catch (error) { throw new ShareEnvelopeError(\"invalid-link\", error instanceof Error ? error.message : \"invalid inline payload\"); }\n    if (payload.v !== 2 || typeof payload.c !== \"string\" || typeof payload.cid !== \"string\" || (payload.k !== undefined && typeof payload.k !== \"string\") || Object.keys(payload).some((key) => ![\"v\", \"c\", \"cid\", \"k\"].includes(key))) throw new ShareEnvelopeError(\"invalid-link\", \"inline payload fields are invalid\");\n    const sealed = base64UrlToBytes(payload.c);\n    if (!verifyPublishedShareCid(payload.cid, sealed)) throw new ShareEnvelopeError(\"cid-mismatch\", \"inline payload CID does not match\");\n    const key = payload.k === undefined ? undefined : base64UrlToBytes(payload.k);\n    if (key !== undefined && key.length !== 32) throw new ShareEnvelopeError(\"invalid-link\", \"inline payload key is invalid\");\n    return { origin, cid: payload.cid, ...(key === undefined ? {} : { key }), sealed };\n  }\n  const match = /^\\/s\\/([a-z2-7]+)$/.exec(url.pathname);\n  if (match === null || !url.hash.startsWith(\"#k=\")) throw new ShareEnvelopeError(\"invalid-link\", \"published share link is invalid\");\n  const key = base64UrlToBytes(url.hash.slice(3));\n  if (key.length !== 32) throw new ShareEnvelopeError(\"invalid-link\", \"published link key is invalid\");\n  try {\n    const cid = CID.parse(match[1]);\n    if (cid.version !== 1 || cid.code !== raw.code || cid.multihash.code !== sha256Cid.code || cid.toString() !== match[1]) throw new Error(\"CID\");\n  } catch { throw new ShareEnvelopeError(\"invalid-link\", \"published link CID is invalid\"); }\n  return { origin, cid: match[1], key };\n}\n\nexport function parseShareUrl(link: string, options: { readonly trustedOrigins?: readonly string[]; readonly maxInlineBytes?: number } = {}): ShareLinkLocation {\n  let url: URL;\n  try { url = new URL(link); } catch { throw new ShareEnvelopeError(\"invalid-link\", \"share link must be an absolute URL\"); }\n  if (url.search !== \"\") throw new ShareEnvelopeError(\"invalid-link\", \"share links must not contain query parameters\");\n  const origin = normalizeOrigin(url.origin);\n  if (options.trustedOrigins !== undefined && !options.trustedOrigins.map(normalizeOrigin).includes(origin)) throw new ShareEnvelopeError(\"origin-mismatch\", \"share link origin is not trusted\");\n  if (url.pathname === \"/s/inline\" && url.hash.startsWith(\"#v=2&p=\")) {\n    const published = parsePublishedShareLink(link, options);\n    return { kind: \"inline\", origin, cid: published.cid, key: published.key, url: `${url.origin}${url.pathname}`, protocol: \"share-envelope-v2\" };\n  }\n  const match = url.pathname.match(/^\\/s\\/(i\\/)?([^/]+)$/);\n  if (!match) throw new ShareEnvelopeError(\"invalid-link\", \"share link path is invalid\");\n  const fragmentParams = url.hash === \"\" ? undefined : new URLSearchParams(url.hash.slice(1));\n  if (fragmentParams !== undefined && (fragmentParams.get(\"k\") === null || [...fragmentParams.keys()].some((key) => key !== \"k\"))) throw new ShareEnvelopeError(\"invalid-link\", \"share link fragment is not canonical\");\n  const fragment = fragmentParams?.get(\"k\");\n  const key = fragment === null || fragment === undefined ? undefined : base64UrlToBytes(fragment);\n  if (key !== undefined && key.length !== 32) throw new ShareEnvelopeError(\"invalid-link\", \"fragment key must be 32 bytes\");\n  if (match[1] === undefined) {\n    try { if (CID.parse(match[2]).toString() !== match[2]) throw new Error(\"non-canonical CID\"); }\n    catch { throw new ShareEnvelopeError(\"invalid-link\", \"CID is not canonical\"); }\n    const protocol = CID.parse(match[2]).multihash.code === sha256Cid.code ? \"share-envelope-v2\" : \"legacy\";\n    return { kind: \"compact\", origin, cid: match[2], key, url: `${url.origin}${url.pathname}`, protocol };\n  }\n  const inlineBytes = base64UrlToBytes(match[2]);\n  if (inlineBytes.byteLength > (options.maxInlineBytes ?? DEFAULT_MAX_INLINE_BYTES)) throw new ShareEnvelopeError(\"content-too-large\", \"inline share exceeds the configured limit\");\n  return { kind: \"inline\", origin, artifact: parseShareArtifact(inlineBytes), key, url: `${url.origin}${url.pathname}` };\n}\n\nexport function isV2ShareLink(link: string): boolean {\n  try { return new URL(link).pathname.startsWith(\"/s/\"); } catch { return link.startsWith(INLINE_PREFIX); }\n}\n\nexport async function encryptShareBytes(bytes: Uint8Array, key: Uint8Array): Promise<Uint8Array> {\n  return encryptShareBytesAsync(bytes, key);\n}\n\nexport async function encryptShareBytesAsync(bytes: Uint8Array, key: Uint8Array): Promise<Uint8Array> {\n  if (key.length !== 32) throw new ShareEnvelopeError(\"encryption-required\", \"AES-GCM key must be 32 bytes\");\n  const iv = crypto.getRandomValues(new Uint8Array(12));\n  const cryptoKey = await crypto.subtle.importKey(\"raw\", key as unknown as ArrayBuffer, \"AES-GCM\", false, [\"encrypt\"]);\n  const ciphertext = await crypto.subtle.encrypt({ name: \"AES-GCM\", iv: iv as unknown as ArrayBuffer }, cryptoKey, bytes as unknown as ArrayBuffer);\n  return new Uint8Array([...iv, ...new Uint8Array(ciphertext)]);\n}\n\nexport async function decryptShareBytesAsync(bytes: Uint8Array, key: Uint8Array): Promise<Uint8Array> {\n  if (key.length !== 32 || bytes.length < 28) throw new ShareEnvelopeError(\"invalid-envelope\", \"encrypted share bytes are invalid\");\n  try {\n    const cryptoKey = await crypto.subtle.importKey(\"raw\", key as unknown as ArrayBuffer, \"AES-GCM\", false, [\"decrypt\"]);\n    return new Uint8Array(await crypto.subtle.decrypt({ name: \"AES-GCM\", iv: bytes.slice(0, 12) as unknown as ArrayBuffer }, cryptoKey, bytes.slice(12) as unknown as ArrayBuffer));\n  } catch {\n    throw new ShareEnvelopeError(\"signature-invalid\", \"share decryption failed\");\n  }\n}\n\nexport function createShareArtifact(input: ShareArtifactInput): ShareArtifactResult {\n  const key = input.encryptionKey;\n  if (input.recipient !== undefined && key === undefined) throw new ShareEnvelopeError(\"encryption-required\", \"recipient shares require encryption\");\n  if (input.plaintextPolicyOnly && (!input.plaintextWarningAcknowledged || input.bytes.byteLength !== 0 || input.recipient !== undefined || key !== undefined)) throw new ShareEnvelopeError(\"unsafe-plaintext\", \"plaintext policy artifacts require explicit acknowledgement and contain no content\");\n  if (input.bytes.byteLength > (input.maxContentBytes ?? DEFAULT_MAX_ARTIFACT_BYTES)) throw new ShareEnvelopeError(\"content-too-large\", \"share content exceeds the configured limit\");\n  if (key !== undefined) throw new ShareEnvelopeError(\"invalid-envelope\", \"use createShareArtifactAsync for encryption\");\n  const envelope = signShareEnvelope({\n    schema: ENVELOPE_SCHEMA,\n    version: 2,\n    origin: input.origin,\n    spaceId: input.spaceId,\n    recipient: input.recipient,\n    recipientKind: input.recipient?.kind,\n    resource: input.resource,\n    actions: input.actions,\n    content: { mimeType: input.mimeType, size: input.bytes.byteLength, digest: contentDigest(input.bytes), ...(input.mimeType.startsWith(\"text/\") ? { charset: \"utf-8\" as const } : {}) },\n    encrypted: false,\n    expiresAt: input.expiresAt.toISOString(),\n    signerDid: input.signerDid,\n    signerPrivateKey: input.signerPrivateKey,\n  });\n  const artifact = { envelope, content: bytesToBase64Url(input.bytes) } satisfies ShareArtifactV2;\n  return { artifact, bytes: encodeShareArtifact(artifact), cid: computeShareCid(encodeShareArtifact(artifact)) };\n}\n\nexport async function createShareArtifactAsync(input: ShareArtifactInput): Promise<ShareArtifactResult> {\n  const recipient = input.recipient === undefined ? undefined : normalizeShareRecipientTarget(input.recipient);\n  if (recipient !== undefined && input.encryptionKey === undefined) throw new ShareEnvelopeError(\"encryption-required\", \"recipient shares require encryption\");\n  if (input.plaintextPolicyOnly && (!input.plaintextWarningAcknowledged || input.bytes.byteLength !== 0 || recipient !== undefined || input.encryptionKey !== undefined)) throw new ShareEnvelopeError(\"unsafe-plaintext\", \"plaintext policy artifacts require explicit acknowledgement and contain no content\");\n  if (input.bytes.byteLength > (input.maxContentBytes ?? MAX_SHARE_CONTENT_BYTES)) throw new ShareEnvelopeError(\"content-too-large\", \"share plaintext exceeds the configured limit\");\n  const encryptedBytes = input.encryptionKey === undefined ? input.bytes : await encryptShareBytesAsync(input.bytes, input.encryptionKey);\n  if (encryptedBytes.byteLength > MAX_SEALED_SHARE_CONTENT_BYTES) throw new ShareEnvelopeError(\"content-too-large\", \"sealed share content exceeds the configured limit\");\n  const envelope = signShareEnvelope({\n    schema: ENVELOPE_SCHEMA,\n    version: 2,\n    origin: input.origin,\n    spaceId: input.spaceId,\n    resource: input.resource,\n    actions: input.actions,\n    content: { mimeType: input.mimeType, size: encryptedBytes.byteLength, digest: contentDigest(encryptedBytes), ...(input.mimeType.startsWith(\"text/\") ? { charset: \"utf-8\" as const } : {}) },\n    encrypted: input.encryptionKey !== undefined,\n    expiresAt: input.expiresAt.toISOString(),\n    signerDid: input.signerDid,\n    signerPrivateKey: input.signerPrivateKey,\n    ...(recipient?.kind === \"bearer\" ? { recipient } : {}),\n    ...(recipient === undefined ? {} : { recipientKind: recipient.kind }),\n  });\n  const artifact = { envelope, content: bytesToBase64Url(encryptedBytes) } satisfies ShareArtifactV2;\n  const bytes = encodeShareArtifact(artifact);\n  return { artifact, bytes, cid: computeShareCid(bytes), key: input.encryptionKey };\n}\n\nexport function intersectShareCapabilities(granted: ShareCapabilityLike, requested: ShareCapabilityLike): ShareCapabilityLike | undefined {\n  if (granted.spaceId !== requested.spaceId) return undefined;\n  const path = intersectSharePaths(granted.resource, requested.resource);\n  if (path === undefined) return undefined;\n  const actions = requested.actions.filter((action) => granted.actions.includes(action));\n  if (actions.length === 0) return undefined;\n  return { spaceId: granted.spaceId, resource: path, actions: [...new Set(actions)].sort() as ShareAction[] };\n}\n\nexport interface ShareCapabilityLike { readonly spaceId: string; readonly resource: ShareResource; readonly actions: readonly ShareAction[]; }\n\nfunction intersectSharePaths(left: ShareResource, right: ShareResource): ShareResource | undefined {\n  if (left.kind === \"exact\" && right.kind === \"exact\") return left.path === right.path ? left : undefined;\n  if (left.kind === \"exact\") return resourceContains(right, left) ? left : undefined;\n  if (right.kind === \"exact\") return resourceContains(left, right) ? right : undefined;\n  if (resourceContains(left, right)) return right;\n  if (resourceContains(right, left)) return left;\n  return undefined;\n}\n\nexport function shareCapabilityAllows(capability: ShareCapabilityLike, action: ShareAction, path: string): boolean {\n  if (!capability.actions.includes(action)) return false;\n  if (capability.resource.kind === \"exact\") return action !== \"list\" && capability.resource.path === path;\n  const prefix = capability.resource.path.replace(/\\/$/, \"\");\n  if (action === \"list\") return path.replace(/\\/$/, \"\") === prefix;\n  const remainder = path.startsWith(`${prefix}/`) ? path.slice(prefix.length + 1) : \"\";\n  return remainder.length > 0 && !remainder.includes(\"/\");\n}\n\nexport { ENVELOPE_SCHEMA, INLINE_PREFIX, DEFAULT_MAX_INLINE_BYTES };\n","import { sha256 } from \"@noble/hashes/sha256\";\n\nexport interface ShareCacheKey {\n  readonly cid: string;\n  readonly expiresAt: string;\n}\n\nexport interface ShareCacheMetadata {\n  readonly contentType: string;\n  readonly size: number;\n  readonly encrypted: boolean;\n}\n\nexport interface ShareCacheEntry {\n  readonly key: ShareCacheKey;\n  readonly bytes: Uint8Array;\n  readonly digest: Uint8Array;\n  readonly metadata: ShareCacheMetadata;\n}\n\nexport interface ShareCache {\n  get(key: ShareCacheKey, now?: Date): Promise<Uint8Array | undefined>;\n  /** Retrieve a valid entry without a process-local expiry index. */\n  getByCid?(cid: string, now?: Date): Promise<ShareCacheEntry | undefined>;\n  set(key: ShareCacheKey, bytes: Uint8Array, metadata: ShareCacheMetadata): Promise<void>;\n  delete(key: ShareCacheKey): Promise<void>;\n  clear(): Promise<void>;\n}\n\nfunction cacheKey(key: ShareCacheKey): string {\n  if (!key.cid || !key.expiresAt) throw new Error(\"share cache keys require CID and expiry\");\n  return `${key.cid}\\0${key.expiresAt}`;\n}\n\nfunction digest(bytes: Uint8Array): Uint8Array {\n  return sha256(bytes);\n}\n\nfunction equalBytes(left: Uint8Array, right: Uint8Array): boolean {\n  if (left.byteLength !== right.byteLength) return false;\n  return left.every((byte, index) => byte === right[index]);\n}\n\n/**\n * A deliberately memory-only cache. It stores verified artifact bytes and\n * non-secret metadata only; fragment keys, presentations, sessions, and\n * decrypted content never cross this boundary.\n */\nexport class MemoryShareCache implements ShareCache {\n  private readonly entries = new Map<string, ShareCacheEntry>();\n\n  constructor(private readonly now: () => Date = () => new Date()) {}\n\n  async get(key: ShareCacheKey, now = new Date()): Promise<Uint8Array | undefined> {\n    const mapKey = cacheKey(key);\n    const entry = this.entries.get(mapKey);\n    if (entry === undefined) return undefined;\n    if (Date.parse(entry.key.expiresAt) <= now.getTime() || !equalBytes(entry.digest, digest(entry.bytes))) {\n      this.entries.delete(mapKey);\n      return undefined;\n    }\n    return entry.bytes.slice();\n  }\n\n  async getByCid(cid: string, now = new Date()): Promise<ShareCacheEntry | undefined> {\n    const entries = [...this.entries.values()].filter((entry) => entry.key.cid === cid);\n    for (const entry of entries) {\n      if (Date.parse(entry.key.expiresAt) <= now.getTime() || !equalBytes(entry.digest, digest(entry.bytes))) {\n        this.entries.delete(cacheKey(entry.key));\n        continue;\n      }\n      return {\n        key: { ...entry.key },\n        bytes: entry.bytes.slice(),\n        digest: entry.digest.slice(),\n        metadata: { ...entry.metadata },\n      };\n    }\n    return undefined;\n  }\n\n  async set(key: ShareCacheKey, bytes: Uint8Array, metadata: ShareCacheMetadata): Promise<void> {\n    if (Date.parse(key.expiresAt) <= this.now().getTime()) return;\n    this.entries.set(cacheKey(key), {\n      key: { cid: key.cid, expiresAt: key.expiresAt },\n      bytes: bytes.slice(),\n      digest: digest(bytes),\n      metadata: { ...metadata },\n    });\n  }\n\n  async delete(key: ShareCacheKey): Promise<void> {\n    this.entries.delete(cacheKey(key));\n  }\n\n  async clear(): Promise<void> {\n    this.entries.clear();\n  }\n}\n","import type { FetchFunction, IKVService, InvokeFunction, Result, ServiceError, ServiceHeaders, ServiceSession } from \"@tinycloud/sdk-services\";\nimport type { ShareAction, ShareCapabilityLike, ShareEnvelopeV2, ShareLinkLocation, ShareResource, ShareRecipientTarget } from \"./share-envelope\";\nimport type { PortableDelegation } from \"./portable\";\n\nexport type { ShareAction, ShareEnvelopeV2, ShareLinkLocation, ShareResource, ShareRecipientTarget };\n\n/** Native action names used by the addressed Node data plane. */\nexport type ShareNativeAction = \"tinycloud.kv/get\" | \"tinycloud.kv/metadata\" | \"tinycloud.kv/list\" | \"tinycloud.kv/put\";\nexport type ShareWireAction = ShareNativeAction | \"tinycloud.sql/read\";\nexport type ShareAddressedRecipientMatcher = Exclude<ShareRecipientTarget, { readonly kind: \"bearer\" }>;\n\n/** The closed v2 content-source union emitted by Node. */\nexport interface ShareKvContentSource {\n  readonly kind: \"kv\";\n  readonly action: ShareNativeAction;\n  readonly space: string;\n  readonly path: string;\n}\n\nexport interface ShareSqlContentSource {\n  readonly kind: \"sql\";\n  readonly action: \"tinycloud.sql/read\";\n  readonly space: string;\n  readonly database: string;\n  readonly path: string;\n  readonly statement: string;\n  readonly arguments: Readonly<Record<string, number>>;\n  readonly argumentsDigest: string;\n}\n\nexport type ShareContentSource = ShareKvContentSource | ShareSqlContentSource;\n\n/** Inclusive expiry interval resolved by Node for an addressed policy. */\nexport interface ShareExpiryBounds {\n  readonly expiryMin?: string;\n  readonly expiryMax?: string;\n}\n\n/** Node's closed addressed-authoring v2 request. */\nexport interface ShareAddressedDelegationRequestV2 {\n  readonly version: 2;\n  readonly nonce: string;\n  readonly jti: string;\n  readonly senderDid: string;\n  readonly recipientMatcher: ShareAddressedRecipientMatcher;\n  readonly targetOrigin: string;\n  readonly nodeAudience: string;\n  readonly shareCid: string;\n  readonly shareId: string;\n  readonly delegationCid: string;\n  readonly authorityMaterialHandle: string;\n  readonly authorityMaterialDigest: string;\n  readonly contentSource: ShareContentSource;\n  readonly contentSourceDigest: string;\n  readonly actions: readonly ShareWireAction[];\n  readonly resource: { readonly kind: \"exact\" | \"prefix\"; readonly value: string };\n  readonly expiresAt: string;\n  readonly requestBodyDigest: string;\n}\n\nexport interface ShareAddressedDelegationEnvelopeV2 {\n  readonly request: ShareAddressedDelegationRequestV2;\n  readonly proof: ShareDetachedProof;\n}\n\nexport interface ShareAddressedDelegationResponseV2 {\n  readonly type: \"TinyCloudShareAddressedDelegation\";\n  readonly version: 2;\n  readonly nonce: string;\n  readonly jti: string;\n  readonly policyCid: string;\n  readonly policyBytes: string;\n  readonly policyDigest: string;\n  readonly delegationCid: string;\n  readonly delegationBytes: string;\n  readonly delegationDigest: string;\n  readonly authorityMaterialHandle: string;\n  readonly authorityMaterialDigest: string;\n  readonly actions: readonly ShareWireAction[];\n  readonly resource: { readonly kind: \"exact\" | \"prefix\"; readonly value: string };\n  readonly expiresAt: string;\n  readonly proof: ShareDetachedProof;\n}\n\n/** Closed v1 policy-session response emitted by Node's compatibility route. */\nexport interface SharePolicySessionWireV1 {\n  readonly type: \"TinyCloudSharePolicySession\";\n  readonly version: 1;\n  readonly sessionId: string;\n  readonly shareCid: string;\n  readonly shareId: string;\n  readonly delegationCid: string;\n  readonly authorityMaterialHandle: string;\n  readonly authorityMaterialDigest: string;\n  readonly policyCid: string;\n  readonly contentSource: ShareContentSource;\n  readonly contentSourceDigest: string;\n  readonly holderDid: string;\n  readonly targetOrigin: string;\n  readonly nodeAudience: string;\n  readonly action: ShareWireAction;\n  readonly actions?: readonly ShareWireAction[];\n  readonly resource: string;\n  readonly credentialDigest: string;\n  readonly issuedAt: string;\n  readonly expiresAt: string;\n}\n\n/** Explicit v1 wire names retained for callers using the legacy read path. */\nexport type SharePolicySessionV1 = SharePolicySession;\nexport type ShareReadInvocationV1 = ShareNativeInvokeInput;\n\nexport interface ShareRecipientPolicy {\n  readonly recipientMatcher: ShareRecipientTarget;\n  readonly spaceId: string;\n  readonly resource: ShareResource;\n  readonly actions: readonly ShareAction[];\n  readonly expiresAt: Date;\n}\n\nexport interface ShareRecipientClientOptions {\n  readonly trustedOrigins: readonly string[];\n  readonly fetch?: FetchFunction;\n  readonly invoke?: InvokeFunction;\n  readonly createKVService?: (config: {\n    hosts: string[];\n    session: ServiceSession;\n    invoke: InvokeFunction;\n    fetch?: FetchFunction;\n    pathPrefix?: string;\n  }) => IKVService;\n  /** Raw publication endpoint. The default is the Share raw artifact route. */\n  readonly artifactUrl?: (input: { readonly origin: string; readonly cid: string }) => string;\n  /** Trusted signer DIDs for addressed policy artifacts. */\n  readonly trustedSignerDids?: readonly string[];\n  /** A verified Node policy session. It is intentionally not a bearer token. */\n  readonly establishPolicySession?: (input: {\n    readonly envelope: ShareEnvelopeV2;\n    readonly presentation?: unknown;\n  }) => Promise<SharePolicySession>;\n  /** Direct DID authorization is explicit and may return a resumable device step. */\n  readonly establishRecipientDidSession?: (input: {\n    readonly envelope: ShareEnvelopeV2;\n    readonly recipientDid: string;\n  }) => Promise<SharePolicySession | { readonly state: \"authorization-required\"; readonly method: \"openkey-device\"; readonly continueUrl?: string; readonly resumeToken: string } | { readonly state: \"denied\"; readonly reason: string }>;\n  /**\n   * Builds the holder presentation/session request after Node returns a\n   * fresh challenge.  The callback is deliberately invoked only after the\n   * challenge proof has been verified; callers cannot precompute a reusable\n   * nonce-bound session request.\n   */\n  readonly buildPolicySessionRequest?: (input: {\n    readonly envelope: ShareEnvelopeV2;\n    readonly challenge: Readonly<Record<string, unknown>>;\n    readonly challengeRequest: Readonly<Record<string, unknown>>;\n  }) => Promise<unknown> | unknown;\n  /**\n   * Authoritative Node policy tuple. This is supplied by the Share host after\n   * Node has created/persisted the policy; the recipient never invents it.\n   */\n  readonly policyBinding?: SharePolicyBinding;\n  /** Holder proof signer used for the strict Node session and /invoke wires. */\n  readonly holderSigner?: (input: {\n    readonly domain: string;\n    readonly message: Readonly<Record<string, unknown>>;\n  }) => Promise<ShareDetachedProof> | ShareDetachedProof;\n  /**\n   * Node's addressed-sharing data plane. Implementations must sign the\n   * application/vnd.tinycloud.share+json request with the holder proof and\n   * send it to Node /invoke; the SDK never turns a policy session into a\n   * generic KV bearer session.\n   */\n  readonly nativeInvoke?: (input: ShareNativeInvokeInput) => Promise<ShareNativeInvokeResult>;\n  /** Import a normal policy-session UCAN through the caller's delegation manager. */\n  readonly importDelegation?: (delegation: PortableDelegation) => Promise<void | PortableDelegation>;\n  /** Extractable Ed25519 recipient seed used only to sign fresh S0 descendants/invocations. */\n  readonly policySessionPrivateKey?: Uint8Array;\n  /** Optional holder signer for the built-in addressed /invoke transport. */\n  readonly signNativeInvoke?: (input: {\n    readonly envelope: ShareEnvelopeV2;\n    readonly session: SharePolicySession;\n    readonly request: Readonly<Record<string, unknown>>;\n  }) => Promise<ServiceHeaders> | ServiceHeaders;\n  /** Optional route overrides for deployments that mount Share under a prefix. */\n  readonly policyRoutes?: {\n    readonly challenge?: string;\n    readonly session?: string;\n  };\n  readonly presentation?: unknown;\n  readonly bearerSession?: ServiceSession;\n  readonly cache?: import(\"./ShareCache\").ShareCache;\n  readonly now?: () => Date;\n  readonly maxInlineBytes?: number;\n  readonly maxArtifactBytes?: number;\n  readonly maxContentBytes?: number;\n  readonly maxSealedContentBytes?: number;\n}\n\nexport interface SharePolicySession {\n  readonly type?: \"TinyCloudSharePolicySession\";\n  readonly version?: 1 | 2;\n  readonly sessionId: string;\n  readonly envelopeCid?: string;\n  readonly registrationCid?: string;\n  readonly shareCid?: string;\n  readonly shareId?: string;\n  readonly policyCid?: string;\n  readonly enforcementDelegationCid?: string;\n  readonly runtimeDelegation?: unknown;\n  readonly holderDid: string;\n  readonly expiresAt: string;\n  readonly expiryMin?: string;\n  readonly expiryMax?: string;\n  readonly capability?: ShareCapabilityLike;\n  readonly delegationCid?: string;\n  readonly authorityMaterialHandle?: string;\n  readonly authorityMaterialDigest?: string;\n  readonly contentSource?: ShareContentSource;\n  readonly contentSourceDigest?: string;\n  readonly targetOrigin?: string;\n  readonly nodeAudience?: string;\n  readonly action?: ShareWireAction | ShareAction;\n  readonly actions?: readonly (ShareWireAction | ShareAction)[];\n  readonly resource?: ShareResource | string;\n  readonly credentialDigest?: string;\n  readonly credential?: string;\n  readonly holderBinding?: unknown;\n  readonly readSignerDid?: string;\n  readonly holderSigner?: ShareRecipientClientOptions[\"holderSigner\"];\n  /** Legacy v1 transport fields retained for compatibility with Node sessions. */\n  readonly authorization?: string;\n  readonly delegationHeader?: { readonly Authorization?: string };\n  readonly spaceId?: string;\n  readonly origin?: string;\n  readonly audience?: string;\n  readonly sourceDigest?: string;\n  readonly verificationMethod?: string;\n  readonly jwk?: Readonly<Record<string, unknown>>;\n}\n\nexport interface ShareDetachedProof {\n  readonly alg: \"EdDSA\";\n  readonly kid: string;\n  readonly signature: string;\n}\n\n/** Exact fields Node resolves from its persisted policy authority tuple. */\nexport interface SharePolicyBinding {\n  readonly envelopeCid?: string;\n  readonly shareCid: string;\n  readonly shareId: string;\n  readonly registrationCid?: string;\n  readonly delegationCid: string;\n  readonly authorityMaterialHandle: string;\n  readonly authorityMaterialDigest: string;\n  readonly policyCid: string;\n  readonly enforcementDelegationCid?: string;\n  readonly enforcementDelegation?: unknown;\n  readonly outerEnvelope?: unknown;\n  readonly contentSource: ShareContentSource;\n  readonly contentSourceDigest: string;\n  readonly holderDid?: string;\n  readonly targetOrigin: string;\n  readonly nodeAudience: string;\n  readonly action?: ShareWireAction | ShareAction;\n  readonly actions?: readonly (ShareWireAction | ShareAction)[];\n  readonly resource: ShareResource | string;\n  readonly expiryMin?: string;\n  readonly expiryMax?: string;\n  readonly expiresAt?: string;\n}\n\nexport interface ShareNativeInvokeInput {\n  readonly envelope: ShareEnvelopeV2;\n  readonly session: SharePolicySession;\n  /** Native Node data-plane verb, kept distinct from public envelope actions. */\n  readonly action: \"get\" | \"metadata\" | \"list\" | \"put\";\n  readonly resource: string;\n  readonly body?: Uint8Array;\n  /** Digest of the exact decoded body; holder signing must cover this value. */\n  readonly bodyDigest?: string;\n  readonly contentType?: string;\n  readonly ifMatch?: string;\n  readonly cursor?: string;\n  readonly limit?: number;\n  readonly mediaType: \"application/vnd.tinycloud.share+json\";\n}\n\n/** The legacy v1 /invoke wrapper remains named and closed for adapters. */\nexport interface ShareNativeInvokeEnvelopeV1 {\n  readonly request: Readonly<Record<string, unknown>>;\n  readonly limit?: number;\n  readonly cursor?: string;\n  readonly body?: string;\n  readonly bodyDigest?: string;\n  readonly ifMatch?: string;\n  readonly contentType?: string;\n}\n\nexport interface ShareNativeInvokeErrorResult {\n  readonly status: number;\n  readonly headers?: Readonly<Record<string, string | undefined>>;\n}\n\nexport interface ShareNativeInvokeSuccessResult {\n  readonly status: number;\n  readonly type: \"TinyCloudShareInvokeResponse\";\n  readonly version: 2;\n  readonly action: ShareNativeAction;\n  readonly resource: string;\n  readonly bytes?: Uint8Array;\n  readonly headers?: Readonly<Record<string, string | undefined>>;\n  readonly keys?: readonly string[];\n  readonly truncated?: boolean;\n  readonly nextCursor?: string;\n  readonly entries?: readonly ShareListEntry[];\n  /** Normalized header aliases accepted by native adapters. */\n  readonly etag?: string;\n  readonly contentType?: string;\n  readonly metadata?: Readonly<Record<string, string>>;\n  readonly content?: string;\n  readonly bodyDigest?: string;\n}\n\nexport type ShareNativeInvokeResult = ShareNativeInvokeErrorResult | ShareNativeInvokeSuccessResult;\n\nexport interface ShareListEntry {\n  readonly path: string;\n  readonly kind: \"file\" | \"folder\";\n}\n\nexport interface ShareReadResult {\n  readonly bytes: Uint8Array;\n  readonly etag?: string;\n  readonly contentType?: string;\n  readonly size: number;\n}\n\nexport interface ShareMetadataResult {\n  readonly metadata: Readonly<Record<string, string>>;\n  readonly etag?: string;\n  readonly contentType?: string;\n  readonly size?: number;\n}\n\nexport interface ShareListResult {\n  readonly keys: readonly string[];\n  readonly entries?: readonly ShareListEntry[];\n  readonly nextCursor?: string;\n  readonly truncated?: boolean;\n}\n\nexport interface ShareSaveOptions {\n  readonly etag: string;\n  readonly contentType?: string;\n}\n\nexport class ShareConflict extends Error {\n  readonly code = \"SHARE_CONFLICT\" as const;\n  readonly path: string;\n  readonly etag?: string;\n\n  constructor(path: string, etag?: string) {\n    super(`The shared object at ${path} changed before it could be saved`);\n    this.name = \"ShareConflict\";\n    this.path = path;\n    this.etag = etag;\n  }\n}\n\nexport class ShareAccessError extends Error {\n  readonly code: string;\n  readonly details?: unknown;\n\n  constructor(code: string, message?: string, details?: unknown) {\n    super(message ?? \"shared access could not be completed\");\n    this.name = \"ShareAccessError\";\n    this.code = code;\n    this.details = details;\n  }\n}\n\nexport interface ShareAccessV2 {\n  readonly kind: \"share-v2\";\n  readonly envelope: ShareEnvelopeV2;\n  readonly location: ShareLinkLocation;\n  readonly resource: ShareResource;\n  readonly actions: readonly ShareAction[];\n  readonly expiresAt: Date;\n  /** The normal UCAN admitted for this recipient, when the link is v3. */\n  readonly portableDelegation?: PortableDelegation;\n  readonly kv?: IKVService;\n  readonly get: (path?: string) => Promise<ShareReadResult>;\n  readonly listChildren: (options?: { readonly path?: string; readonly limit?: number; readonly cursor?: string }) => Promise<ShareListResult>;\n  readonly save: (path: string, bytes: Uint8Array, options: ShareSaveOptions) => Promise<{ readonly etag?: string }>;\n  readonly metadata: (path?: string) => Promise<ShareMetadataResult>;\n}\n\nexport type ShareRecipientResult<T> = Result<T, ServiceError | ShareAccessError | ShareConflict>;\n","import { z } from \"zod\";\n\nexport const ShareRecipientTargetSchema = z.discriminatedUnion(\"kind\", [\n  z.object({ kind: z.literal(\"exactEmail\"), value: z.string().min(1) }).strict(),\n  z.object({ kind: z.literal(\"emailDomain\"), value: z.string().min(1) }).strict(),\n  z.object({ kind: z.literal(\"recipientDid\"), value: z.string().regex(/^did:[a-z0-9]+:.+$/) }).strict(),\n  z.object({ kind: z.literal(\"bearer\") }).strict(),\n]);\n\nexport const ShareResourceSchema = z.discriminatedUnion(\"kind\", [\n  z.object({ kind: z.literal(\"exact\"), path: z.string().min(1) }).strict(),\n  z.object({ kind: z.literal(\"prefix\"), path: z.string().min(1) }).strict(),\n]);\n\nexport const ShareActionSchema = z.enum([\"read\", \"list\", \"edit\"]);\n\nexport const ShareRecipientPolicySchema = z.object({\n  recipientMatcher: ShareRecipientTargetSchema,\n  spaceId: z.string().min(1),\n  resource: ShareResourceSchema,\n  actions: z.array(ShareActionSchema).min(1),\n  expiresAt: z.date(),\n}).strict();\n\nexport const ShareRecipientClientOptionsSchema = z.object({\n  trustedOrigins: z.array(z.string().url()).min(1),\n  maxInlineBytes: z.number().int().positive().optional(),\n  maxArtifactBytes: z.number().int().positive().optional(),\n  maxContentBytes: z.number().int().positive().optional(),\n  maxSealedContentBytes: z.number().int().positive().optional(),\n}).strict();\n\nconst ShareNativeActionSchema = z.enum([\"tinycloud.kv/get\", \"tinycloud.kv/metadata\", \"tinycloud.kv/list\", \"tinycloud.kv/put\"]);\nconst ShareWireActionSchema = z.enum([\"tinycloud.kv/get\", \"tinycloud.kv/metadata\", \"tinycloud.kv/list\", \"tinycloud.kv/put\", \"tinycloud.sql/read\"]);\nconst ShareContentSourceSchema = z.discriminatedUnion(\"kind\", [\n  z.object({\n    kind: z.literal(\"kv\"),\n    action: ShareNativeActionSchema,\n    space: z.string().min(1),\n    path: z.string().min(1),\n  }).strict(),\n  z.object({\n    kind: z.literal(\"sql\"),\n    action: z.literal(\"tinycloud.sql/read\"),\n    space: z.string().min(1),\n    database: z.string().min(1),\n    path: z.string().min(1),\n    statement: z.string().min(1),\n    arguments: z.record(z.number().int().safe()),\n    argumentsDigest: z.string().min(1),\n  }).strict(),\n]);\nconst ShareAddressedRecipientSchema = z.discriminatedUnion(\"kind\", [\n  z.object({ kind: z.literal(\"exactEmail\"), value: z.string().min(1) }).strict(),\n  z.object({ kind: z.literal(\"emailDomain\"), value: z.string().min(1) }).strict(),\n  z.object({ kind: z.literal(\"recipientDid\"), value: z.string().regex(/^did:[a-z0-9]+:.+$/) }).strict(),\n]);\n\nexport const ShareAddressedDelegationRequestV2Schema = z.object({\n  version: z.literal(2),\n  nonce: z.string().min(1),\n  jti: z.string().min(1),\n  senderDid: z.string().min(1),\n  recipientMatcher: ShareAddressedRecipientSchema,\n  targetOrigin: z.string().url(),\n  nodeAudience: z.string().min(1),\n  shareCid: z.string().min(1),\n  shareId: z.string().min(1),\n  delegationCid: z.string().min(1),\n  authorityMaterialHandle: z.string().min(1),\n  authorityMaterialDigest: z.string().min(1),\n  contentSource: ShareContentSourceSchema,\n  contentSourceDigest: z.string().min(1),\n  actions: z.array(ShareWireActionSchema).min(1).refine((actions) => new Set(actions).size === actions.length),\n  resource: z.object({ kind: z.enum([\"exact\", \"prefix\"]), value: z.string().min(1) }).strict(),\n  expiresAt: z.string().datetime({ offset: true }),\n  requestBodyDigest: z.string().min(1),\n}).strict();\n\nexport const ShareAddressedDelegationEnvelopeV2Schema = z.object({\n  request: ShareAddressedDelegationRequestV2Schema,\n  proof: z.object({ alg: z.literal(\"EdDSA\"), kid: z.string().min(1), signature: z.string().min(1) }).strict(),\n}).strict();\n\nexport const ShareAddressedDelegationResponseV2Schema = z.object({\n  type: z.literal(\"TinyCloudShareAddressedDelegation\"),\n  version: z.literal(2),\n  nonce: z.string().min(1),\n  jti: z.string().min(1),\n  policyCid: z.string().min(1),\n  policyBytes: z.string().min(1),\n  policyDigest: z.string().min(1),\n  delegationCid: z.string().min(1),\n  delegationBytes: z.string().min(1),\n  delegationDigest: z.string().min(1),\n  authorityMaterialHandle: z.string().min(1),\n  authorityMaterialDigest: z.string().min(1),\n  actions: z.array(ShareWireActionSchema).min(1).refine((actions) => new Set(actions).size === actions.length),\n  resource: z.object({ kind: z.enum([\"exact\", \"prefix\"]), value: z.string().min(1) }).strict(),\n  expiresAt: z.string().datetime({ offset: true }),\n  proof: z.object({ alg: z.literal(\"EdDSA\"), kid: z.string().min(1), signature: z.string().min(1) }).strict(),\n}).strict();\n\nconst ShareNativeResponseEntrySchema = z.object({\n  path: z.string().min(1),\n  kind: z.enum([\"file\", \"folder\"]),\n}).strict();\n\n/**\n * Closed response envelope for the addressed Node data plane.\n * Addressed native responses are closed v2 envelopes.  Every operation binds\n * its exact action and resource before action-specific fields are consumed.\n */\nconst ShareNativeResponseBase = {\n  type: z.literal(\"TinyCloudShareInvokeResponse\"),\n  version: z.literal(2),\n  resource: z.string().min(1),\n};\n\nexport const ShareNativeResponseSchema = z.discriminatedUnion(\"action\", [\n  z.object({\n    ...ShareNativeResponseBase,\n    action: z.literal(\"tinycloud.kv/metadata\"),\n    metadata: z.record(z.string()),\n    etag: z.string().min(1).nullable(),\n  }).strict(),\n  z.object({\n    ...ShareNativeResponseBase,\n    action: z.literal(\"tinycloud.kv/get\"),\n    mediaType: z.string().min(1),\n    content: z.string(),\n    bodyDigest: z.string().min(1),\n    etag: z.string().min(1).nullable(),\n  }).strict(),\n  z.object({\n    ...ShareNativeResponseBase,\n    action: z.literal(\"tinycloud.kv/list\"),\n    entries: z.array(ShareNativeResponseEntrySchema),\n    nextCursor: z.string().min(1).nullable(),\n  }).strict(),\n  z.object({\n    ...ShareNativeResponseBase,\n    action: z.literal(\"tinycloud.kv/put\"),\n    etag: z.string().min(1),\n    bodyDigest: z.string().min(1),\n    contentType: z.string().min(1),\n  }).strict(),\n]);\n\nexport type ShareNativeResponse = z.infer<typeof ShareNativeResponseSchema>;\n","import { z } from \"zod\";\nimport type { FetchFunction } from \"@tinycloud/sdk-services\";\nimport type { DelegatedResource } from \"./types\";\nimport { createCompactPolicyDescendant } from \"../policy/unified\";\n\n/** Transport form shared by addressed-share recipients and normal agents. */\nexport interface PortableDelegation {\n  readonly cid: string;\n  readonly delegationHeader: { readonly Authorization: string };\n  readonly ownerAddress: string;\n  readonly chainId: number;\n  readonly host?: string;\n  readonly spaceId: string;\n  readonly path: string;\n  readonly actions: readonly string[];\n  readonly caveats?: readonly Record<string, unknown>[];\n  readonly expiry: Date;\n  readonly delegateDID: string;\n  readonly delegatorDID?: string;\n  readonly parentCid?: string;\n  readonly disableSubDelegation?: boolean;\n  readonly resources?: readonly DelegatedResource[];\n}\n\nconst ResourceSchema = z\n  .object({\n    service: z.string().min(1),\n    space: z.string().min(1),\n    path: z.string(),\n    actions: z.array(z.string().min(1)).min(1),\n    caveats: z.array(z.record(z.unknown())).optional(),\n  })\n  .strict();\n\nconst PortableDelegationSchema = z\n  .object({\n    cid: z.string().min(1),\n    delegationHeader: z.object({ Authorization: z.string().min(1) }).strict(),\n    ownerAddress: z.string().min(1),\n    chainId: z.number().int().nonnegative(),\n    host: z.string().url().optional(),\n    spaceId: z.string().min(1),\n    path: z.string(),\n    actions: z.array(z.string().min(1)).min(1),\n    caveats: z.array(z.record(z.unknown())).optional(),\n    expiry: z.coerce.date(),\n    delegateDID: z.string().min(1),\n    delegatorDID: z.string().min(1).optional(),\n    parentCid: z.string().min(1).optional(),\n    disableSubDelegation: z.boolean().optional(),\n    resources: z.array(ResourceSchema).min(1).optional(),\n  })\n  .strict();\n\n/** Validate a normal delegation received from a v3 claim/admission response. */\nexport function parsePortableDelegation(input: unknown): PortableDelegation {\n  const parsed = PortableDelegationSchema.parse(input);\n  if (parsed.resources !== undefined && parsed.resources.length === 0)\n    throw new Error(\"portable delegation resources must not be empty\");\n  return parsed;\n}\n\nexport function serializePortableDelegation(\n  delegation: PortableDelegation,\n): string {\n  return JSON.stringify({\n    ...delegation,\n    expiry: delegation.expiry.toISOString(),\n  });\n}\n\nexport interface PortableDelegationImportReceipt {\n  readonly activated?: readonly string[];\n  readonly skipped?: readonly string[];\n  readonly [key: string]: unknown;\n}\n\n/** Admit a normal delegation through POST /delegate. */\nexport async function importPortableDelegation(\n  fetchFn: FetchFunction,\n  host: string,\n  delegation: PortableDelegation,\n): Promise<PortableDelegationImportReceipt> {\n  const parsed = parsePortableDelegation(delegation);\n  const response = await fetchFn(`${host.replace(/\\/+$/, \"\")}/delegate`, {\n    method: \"POST\",\n    headers: { Authorization: parsed.delegationHeader.Authorization },\n  });\n  if (!response.ok)\n    throw new Error(`node rejected delegation import (${response.status})`);\n  const body: unknown = await response.json().catch(() => ({}));\n  if (body === null || typeof body !== \"object\" || Array.isArray(body))\n    return {};\n  return body as PortableDelegationImportReceipt;\n}\n\n/**\n * Create and admit an ordinary protected descendant below a v3 policy\n * session. This is the recipient-to-agent path; it deliberately bypasses the\n * legacy `prepareSession`/`rawAbilities` builder because that builder cannot\n * preserve the signed policy fact or the exact immediate-parent proof.\n */\nexport async function delegatePortablePolicySession(input: {\n  readonly fetch: FetchFunction;\n  readonly host: string;\n  readonly parent: PortableDelegation;\n  readonly issuerPrivateKey: Uint8Array;\n  readonly delegateDID: string;\n  readonly attenuation: Readonly<Record<string, Readonly<Record<string, readonly unknown[]>>>>;\n  readonly now?: number;\n  readonly expiresAt?: number;\n  readonly nonce?: string;\n}): Promise<PortableDelegation> {\n  const parent = parsePortableDelegation(input.parent);\n  const descendant = createCompactPolicyDescendant({\n    parentAuthorization: parent.delegationHeader.Authorization.replace(/^Bearer\\s+/i, \"\"),\n    parentCid: parent.cid,\n    issuerDid: parent.delegateDID,\n    audienceDid: input.delegateDID,\n    attenuation: input.attenuation,\n    privateKey: input.issuerPrivateKey,\n    ...(input.now === undefined ? {} : { now: input.now }),\n    ...(input.expiresAt === undefined ? {} : { expiresAt: input.expiresAt }),\n    ...(input.nonce === undefined ? {} : { nonce: input.nonce }),\n  });\n  const resources: DelegatedResource[] = Object.entries(descendant.payload.att).map(([resource, abilities]) => {\n    const actions = Object.keys(abilities);\n    if (resource.startsWith(\"urn:tinycloud:encryption:\")) {\n      return { service: \"encryption\", space: \"encryption\", path: resource, actions };\n    }\n    const match = /^tinycloud:\\/\\/([^/]+)\\/kv\\/(.+)$/.exec(resource);\n    if (match === null) throw new Error(\"policy descendant resource is invalid\");\n    const caveats = Object.values(abilities).flat().filter((value): value is Record<string, unknown> => value !== null && typeof value === \"object\" && !Array.isArray(value));\n    return { service: \"kv\", space: match[1]!, path: match[2]!, actions, ...(caveats.length === 0 ? {} : { caveats }) };\n  });\n  const primary = resources.find((resource) => resource.service === \"kv\") ?? resources[0];\n  if (primary === undefined) throw new Error(\"policy descendant attenuation is empty\");\n  const portable: PortableDelegation = {\n    cid: descendant.cid,\n    delegationHeader: { Authorization: descendant.authorization },\n    ownerAddress: parent.ownerAddress,\n    chainId: parent.chainId,\n    host: input.host,\n    spaceId: primary.space,\n    path: primary.path,\n    actions: primary.actions,\n    expiry: new Date(descendant.payload.exp * 1000),\n    delegateDID: input.delegateDID,\n    delegatorDID: parent.delegateDID,\n    parentCid: parent.cid,\n    disableSubDelegation: descendant.payload.fct[0]?.remainingRedelegationDepth === 0,\n    resources,\n  };\n  await importPortableDelegation(input.fetch, input.host, portable);\n  return portable;\n}\n","import { sha256 } from \"@noble/hashes/sha256\";\nimport { blake3 } from \"@noble/hashes/blake3\";\nimport { ed25519 } from \"@noble/curves/ed25519\";\nimport { CID } from \"multiformats/cid\";\nimport { base58btc } from \"multiformats/bases/base58\";\nimport { create as createDigest } from \"multiformats/hashes/digest\";\nimport { z } from \"zod\";\nimport { jcsCanonicalize } from \"./jcs\";\n\nexport const POLICY_V1_SCHEMA = \"xyz.tinycloud.policy/policy/v1\" as const;\nexport const POLICY_CAPABILITY_V1_SCHEMA =\n  \"xyz.tinycloud.policy/capability/v1\" as const;\nexport const POLICY_ENFORCEMENT_DELEGATION_V2_SCHEMA =\n  \"xyz.tinycloud.policy/enforcement-delegation/v2\" as const;\nexport const ATTESTED_ENFORCER_BINDING_V2_SCHEMA =\n  \"xyz.tinycloud.policy/attested-enforcer/v2\" as const;\nexport const ROOT_STATUS_CHECKPOINT_V1_SCHEMA =\n  \"xyz.tinycloud.policy/root-status/v1\" as const;\nexport const ROOT_REVOCATION_V1_SCHEMA =\n  \"xyz.tinycloud.policy/root-revocation/v1\" as const;\nexport const POLICY_SESSION_UCAN_V1_PROFILE = \"policy-session-ucan/v1\" as const;\n\nexport const POLICY_V1_DOMAIN = \"xyz.tinycloud.policy/policy/v1\\0\";\nexport const POLICY_CAPABILITY_V1_DOMAIN =\n  \"xyz.tinycloud.policy/PolicyCapability/v1\\0\";\nexport const CONTENT_SOURCE_V1_DOMAIN =\n  \"xyz.tinycloud.policy/ContentSource/v1\\0\";\nexport const NATIVE_PROJECTION_V1_DOMAIN =\n  \"xyz.tinycloud.policy/NativeProjection/v1\\0\";\nexport const ROOT_STATUS_V1_DOMAIN =\n  \"xyz.tinycloud.policy/RootStatusCheckpoint/v1\\0\";\nexport const ROOT_STATUS_RENEWAL_V1_DOMAIN =\n  \"xyz.tinycloud.policy/RootStatusRenewal/v1\\0\";\nexport const ROOT_REVOCATION_V1_DOMAIN =\n  \"xyz.tinycloud.policy/RootRevocation/v1\\0\";\n\nexport const LAST_V2_CREATE_AT = \"2026-09-30T00:00:00Z\" as const;\nexport const MAX_LEGACY_ENVELOPE_EXPIRES_AT = \"2026-12-29T00:00:00Z\" as const;\nexport const LAST_V2_READ_AT = \"2027-01-05T00:00:00Z\" as const;\n\nexport type UnifiedResourceSelector = \"exact\" | \"prefix\";\n\nexport interface UnifiedKvCapability {\n  readonly kind: \"kv\";\n  readonly resource: string;\n  readonly selector: UnifiedResourceSelector;\n  readonly actions: readonly (\n    | \"tinycloud.kv/get\"\n    | \"tinycloud.kv/list\"\n    | \"tinycloud.kv/metadata\"\n    | \"tinycloud.kv/put\"\n  )[];\n}\n\nexport interface UnifiedEncryptionCapability {\n  readonly kind: \"encryption\";\n  readonly resource: string;\n  readonly action: \"tinycloud.encryption/decrypt\";\n}\n\nexport type UnifiedPolicyCapability =\n  | UnifiedKvCapability\n  | UnifiedEncryptionCapability;\n\nexport interface UnifiedNativeCapability {\n  readonly service: \"tinycloud.kv\" | \"tinycloud.encryption\";\n  readonly space: string;\n  readonly path: string;\n  readonly actions: readonly string[];\n  readonly caveat?: Readonly<Record<string, string>>;\n}\n\nexport interface UnifiedContentSource {\n  readonly shareId: string;\n  readonly kvResource: string;\n  readonly selector: UnifiedResourceSelector;\n  readonly encryptionNetwork: string;\n  readonly encryptedSymmetricKeyDigestHex: string;\n  readonly keyVersion: number;\n  readonly mode: \"mutable\" | \"immutable\";\n  readonly initialCiphertextDigestHex?: string;\n}\n\nexport interface UnifiedPolicyV1 {\n  readonly schema: typeof POLICY_V1_SCHEMA;\n  readonly policyId: string;\n  readonly ownerDid: string;\n  readonly createdAt: string;\n  readonly expiresAt?: string;\n  readonly contentSource: UnifiedContentSource;\n  readonly capabilityCeiling: readonly UnifiedPolicyCapability[];\n  readonly signature: {\n    readonly suite: string;\n    readonly signerDid: string;\n    readonly value: string;\n  };\n}\n\nexport interface PolicySessionUcanV1 {\n  readonly authorization: string;\n  readonly cid: string;\n  readonly iss: string;\n  readonly aud: string;\n  readonly prf: readonly [string, string];\n  readonly att: Readonly<Record<string, Readonly<Record<string, readonly unknown[]>>>>;\n  readonly nbf: number;\n  readonly exp: number;\n  readonly nnc: string;\n  readonly fact: Readonly<Record<string, unknown>>;\n}\n\nexport interface PolicyChallengeV3 {\n  readonly challengeId: string;\n  readonly nonce: string;\n  readonly policyCid: string;\n  readonly recipientDid: string;\n  readonly [key: string]: unknown;\n}\n\nexport async function requestPolicyChallengeV3(input: {\n  readonly nodeOrigin: string;\n  readonly policyCid: string;\n  readonly recipientDid: string;\n  readonly requestedCapabilities: readonly UnifiedPolicyCapability[];\n  readonly fetch?: typeof fetch;\n}): Promise<PolicyChallengeV3> {\n  const fetchFn = input.fetch ?? globalThis.fetch.bind(globalThis);\n  const response = await fetchFn(new URL(\"/share/v3/policy/challenges\", input.nodeOrigin), {\n    method: \"POST\",\n    redirect: \"error\",\n    headers: { accept: \"application/json\", \"content-type\": \"application/json\" },\n    body: JSON.stringify({ policyCid: input.policyCid, recipientDid: input.recipientDid, requestedCapabilities: input.requestedCapabilities.map(normalizeUnifiedPolicyCapability) }),\n  });\n  if (!response.ok) throw new Error(`policy challenge rejected (${response.status})`);\n  const value = object(await response.json(), \"policy challenge\") as PolicyChallengeV3;\n  if (typeof value.challengeId !== \"string\" || typeof value.nonce !== \"string\" || value.policyCid !== input.policyCid || value.recipientDid !== input.recipientDid)\n    throw new Error(\"policy challenge binding is invalid\");\n  return value;\n}\n\nexport async function mintPolicySessionV3(input: {\n  readonly nodeOrigin: string;\n  readonly policyCid: string;\n  readonly policyRootCid: string;\n  readonly enforcementRootCid: string;\n  readonly recipientDid: string;\n  readonly requestedCapabilities: readonly UnifiedPolicyCapability[];\n  readonly expectedFacts?: Readonly<Record<string, string | number>>;\n  readonly claim: Readonly<Record<string, unknown>>;\n  readonly presentation: Readonly<Record<string, unknown>>;\n  readonly challenge?: PolicyChallengeV3;\n  readonly fetch?: typeof fetch;\n}): Promise<PolicySessionUcanV1> {\n  const fetchFn = input.fetch ?? globalThis.fetch.bind(globalThis);\n  const challenge = input.challenge ?? await requestPolicyChallengeV3(input);\n  if (challenge.policyCid !== input.policyCid || challenge.recipientDid !== input.recipientDid)\n    throw new Error(\"policy challenge binding is invalid\");\n  const response = await fetchFn(new URL(\"/share/v3/policy/delegations\", input.nodeOrigin), {\n    method: \"POST\",\n    redirect: \"error\",\n    headers: { accept: \"application/json\", \"content-type\": \"application/json\" },\n    body: JSON.stringify({ policyCid: input.policyCid, challengeId: challenge.challengeId, nonce: challenge.nonce, claim: input.claim, presentation: input.presentation }),\n  });\n  if (!response.ok) throw new Error(`policy delegation rejected (${response.status})`);\n  const value = object(await response.json(), \"policy delegation\");\n  if (value.admitted !== true || typeof value.sessionCid !== \"string\" || typeof value.authorization !== \"string\")\n    throw new Error(\"policy delegation response is invalid\");\n  const session = parsePolicySessionUcan(value.authorization, [input.policyRootCid, input.enforcementRootCid]);\n  const expectedAttenuation = compactAttenuationForPolicyCapabilities(input.requestedCapabilities);\n  if (session.cid !== value.sessionCid\n    || session.aud !== input.recipientDid\n    || session.fact.policyCid !== input.policyCid\n    || session.fact.recipientDid !== input.recipientDid\n    || session.fact.policyDelegationCid !== input.policyRootCid\n    || session.fact.enforcementDelegationCid !== input.enforcementRootCid\n    || jcsCanonicalize(session.att) !== jcsCanonicalize(expectedAttenuation)\n    || Object.entries(input.expectedFacts ?? {}).some(([key, expected]) => session.fact[key] !== expected))\n    throw new Error(\"policy delegation signed binding is invalid\");\n  return session;\n}\n\nfunction compactAttenuationForPolicyCapabilities(\n  input: readonly UnifiedPolicyCapability[],\n): Readonly<Record<string, Readonly<Record<string, readonly unknown[]>>>> {\n  const attenuation: Record<string, Record<string, readonly unknown[]>> = {};\n  for (const raw of input) {\n    const capability = normalizeUnifiedPolicyCapability(raw);\n    if (attenuation[capability.resource] !== undefined)\n      throw new Error(\"policy capabilities contain a duplicate resource\");\n    attenuation[capability.resource] = capability.kind === \"encryption\"\n      ? { [capability.action]: [{}] }\n      : Object.fromEntries(capability.actions.map((action) => [action, [{\n          type: \"xyz.tinycloud.resource/selector\",\n          kind: capability.selector,\n          value: capability.resource,\n        }]]));\n  }\n  return attenuation;\n}\n\nexport interface PolicyRootStatusV3 {\n  readonly rootCid: string;\n  readonly state: \"active\" | \"revoked\";\n  readonly checkpoint: Readonly<Record<string, unknown>>;\n  readonly revocation?: Readonly<Record<string, unknown>>;\n}\n\nexport function verifyPolicyRootStatusCheckpointV3(input: {\n  readonly rootCid: string;\n  readonly checkpoint: Readonly<Record<string, unknown>>;\n  readonly expectedNodeAudience?: string;\n  readonly now?: Date;\n}): boolean {\n  const checkpoint = input.checkpoint;\n  const allowed = new Set([\"schema\", \"targetCid\", \"targetRole\", \"ownerDid\", \"nodeAudience\", \"state\", \"sequence\", \"checkedAt\", \"freshUntil\", \"revokedAt\", \"revocationCid\", \"previousCheckpointDigestHex\", \"issuerDid\", \"signature\"]);\n  if (Object.keys(checkpoint).some((key) => !allowed.has(key))\n    || checkpoint.schema !== ROOT_STATUS_CHECKPOINT_V1_SCHEMA\n    || checkpoint.targetCid !== input.rootCid\n    || (checkpoint.targetRole !== \"policy-authority\" && checkpoint.targetRole !== \"policy-enforcement\")\n    || (checkpoint.state !== \"active\" && checkpoint.state !== \"revoked\")\n    || typeof checkpoint.ownerDid !== \"string\"\n    || typeof checkpoint.nodeAudience !== \"string\"\n    || checkpoint.issuerDid !== checkpoint.nodeAudience\n    || (input.expectedNodeAudience !== undefined && checkpoint.nodeAudience !== input.expectedNodeAudience)\n    || !Number.isInteger(checkpoint.sequence)\n    || (checkpoint.sequence as number) < 1\n    || typeof checkpoint.checkedAt !== \"string\"\n    || typeof checkpoint.freshUntil !== \"string\") return false;\n  const checkedAt = Date.parse(checkpoint.checkedAt as string);\n  const freshUntil = Date.parse(checkpoint.freshUntil as string);\n  const now = (input.now ?? new Date()).getTime();\n  if (!Number.isFinite(checkedAt) || !Number.isFinite(freshUntil)\n    || freshUntil < now || freshUntil <= checkedAt || freshUntil - checkedAt > 300_000) return false;\n  if ((checkpoint.sequence === 1) !== (checkpoint.previousCheckpointDigestHex === undefined)) return false;\n  if (checkpoint.sequence !== 1 && (typeof checkpoint.previousCheckpointDigestHex !== \"string\" || !/^[0-9a-f]{64}$/.test(checkpoint.previousCheckpointDigestHex))) return false;\n  if (checkpoint.state === \"active\" && (checkpoint.revokedAt !== undefined || checkpoint.revocationCid !== undefined)) return false;\n  if (checkpoint.state === \"revoked\" && (typeof checkpoint.revokedAt !== \"string\" || typeof checkpoint.revocationCid !== \"string\")) return false;\n  const signature = checkpoint.signature;\n  if (!isRecordValue(signature) || Object.keys(signature).length !== 3 || signature.suite !== \"Ed25519\" || signature.signerDid !== checkpoint.issuerDid || typeof signature.value !== \"string\") return false;\n  try {\n    const principal = (checkpoint.issuerDid as string).split(\"#\", 1)[0]!;\n    const didMaterial = principal.startsWith(\"did:key:\") ? base58btc.decode(principal.slice(\"did:key:\".length)) : new Uint8Array();\n    if (didMaterial.length !== 34 || didMaterial[0] !== 0xed || didMaterial[1] !== 0x01) return false;\n    const unsigned = { ...checkpoint } as Record<string, unknown>;\n    delete unsigned.signature;\n    return ed25519.verify(\n      decodeBase64Url(signature.value),\n      sha256(new TextEncoder().encode(ROOT_STATUS_V1_DOMAIN + jcsCanonicalize(unsigned))),\n      didMaterial.slice(2),\n    );\n  } catch {\n    return false;\n  }\n}\n\nexport async function getPolicyRootStatusV3(input: {\n  readonly nodeOrigin: string;\n  readonly rootCid: string;\n  readonly expectedNodeAudience?: string;\n  readonly expectedEnforcerDid?: string;\n  readonly now?: Date;\n  readonly fetch?: typeof fetch;\n}): Promise<PolicyRootStatusV3> {\n  const fetchFn = input.fetch ?? globalThis.fetch.bind(globalThis);\n  const response = await fetchFn(new URL(`/share/v3/policy/status/${encodeURIComponent(input.rootCid)}`, input.nodeOrigin), {\n    method: \"GET\",\n    redirect: \"error\",\n    headers: { accept: \"application/json\" },\n  });\n  if (!response.ok) throw new Error(`policy root status rejected (${response.status})`);\n  const value = object(await response.json(), \"policy root status\");\n  const checkpoint = object(value.checkpoint, \"policy root checkpoint\");\n  if (value.rootCid !== input.rootCid\n    || (value.state !== \"active\" && value.state !== \"revoked\")\n    || value.state !== checkpoint.state\n    || !verifyPolicyRootStatusCheckpointV3({ rootCid: input.rootCid, checkpoint, expectedNodeAudience: input.expectedNodeAudience, now: input.now }))\n    throw new Error(\"policy root status binding is invalid\");\n  const revocation = value.revocation === undefined ? undefined : object(value.revocation, \"policy root revocation\");\n  if ((value.state === \"revoked\") !== (revocation !== undefined)\n    || revocation !== undefined && !verifyPolicyRootRevocationV3({\n      rootCid: input.rootCid,\n      checkpoint,\n      revocation,\n      expectedEnforcerDid: input.expectedEnforcerDid,\n    })) throw new Error(\"policy root status revocation evidence is invalid\");\n  return { rootCid: input.rootCid, state: value.state, checkpoint, ...(revocation === undefined ? {} : { revocation }) };\n}\n\nexport function verifyPolicyRootRevocationV3(input: {\n  readonly rootCid: string;\n  readonly checkpoint: Readonly<Record<string, unknown>>;\n  readonly revocation: Readonly<Record<string, unknown>>;\n  readonly expectedEnforcerDid?: string;\n}): boolean {\n  const value = input.revocation;\n  const allowed = [\"schema\", \"targetCid\", \"targetRole\", \"ownerDid\", \"nodeAudience\", \"revokedAt\", \"reason\", \"issuerDid\", \"signature\"];\n  if (Object.keys(value).length !== allowed.length || Object.keys(value).some((key) => !allowed.includes(key))\n    || value.schema !== ROOT_REVOCATION_V1_SCHEMA\n    || value.targetCid !== input.rootCid\n    || value.targetRole !== input.checkpoint.targetRole\n    || value.ownerDid !== input.checkpoint.ownerDid\n    || value.nodeAudience !== input.checkpoint.nodeAudience\n    || value.revokedAt !== input.checkpoint.revokedAt\n    || typeof value.reason !== \"string\" || value.reason.length === 0\n    || typeof value.issuerDid !== \"string\") return false;\n  const authorized = value.issuerDid === value.ownerDid\n    || value.targetRole === \"policy-enforcement\" && value.issuerDid === input.expectedEnforcerDid;\n  if (!authorized) return false;\n  const signature = value.signature;\n  if (!isRecordValue(signature) || Object.keys(signature).length !== 3 || signature.suite !== \"Ed25519\" || signature.signerDid !== value.issuerDid || typeof signature.value !== \"string\") return false;\n  try {\n    const principal = (value.issuerDid as string).split(\"#\", 1)[0]!;\n    const didMaterial = principal.startsWith(\"did:key:\") ? base58btc.decode(principal.slice(\"did:key:\".length)) : new Uint8Array();\n    if (didMaterial.length !== 34 || didMaterial[0] !== 0xed || didMaterial[1] !== 0x01) return false;\n    const unsigned = { ...value } as Record<string, unknown>;\n    delete unsigned.signature;\n    const digest = sha256(new TextEncoder().encode(ROOT_REVOCATION_V1_DOMAIN + jcsCanonicalize(unsigned)));\n    return input.checkpoint.revocationCid === hex(digest)\n      && ed25519.verify(decodeBase64Url(signature.value), digest, didMaterial.slice(2));\n  } catch {\n    return false;\n  }\n}\n\nexport async function renewPolicyRootStatusV3(input: {\n  readonly nodeOrigin: string;\n  readonly rootCid: string;\n  readonly ownerDid: string;\n  readonly nodeAudience: string;\n  readonly sign: (digest: Uint8Array) => Promise<Uint8Array>;\n  readonly now?: Date;\n  readonly nonce?: string;\n  readonly fetch?: typeof fetch;\n}): Promise<Readonly<Record<string, unknown>>> {\n  const fetchFn = input.fetch ?? globalThis.fetch.bind(globalThis);\n  const current = await getPolicyRootStatusV3({ nodeOrigin: input.nodeOrigin, rootCid: input.rootCid, expectedNodeAudience: input.nodeAudience, now: input.now, fetch: fetchFn });\n  if (current.state !== \"active\" || current.checkpoint.ownerDid !== input.ownerDid || current.checkpoint.nodeAudience !== input.nodeAudience || current.checkpoint.state !== \"active\" || !Number.isInteger(current.checkpoint.sequence))\n    throw new Error(\"policy root status cannot be renewed\");\n  const currentUnsigned = { ...current.checkpoint };\n  delete currentUnsigned.signature;\n  const previousCheckpointDigestHex = hex(sha256(new TextEncoder().encode(ROOT_STATUS_V1_DOMAIN + jcsCanonicalize(currentUnsigned))));\n  const unsigned = {\n    schema: \"xyz.tinycloud.policy/root-status-renewal/v1\",\n    targetCid: input.rootCid,\n    ownerDid: input.ownerDid,\n    nodeAudience: input.nodeAudience,\n    issuedAt: (input.now ?? new Date()).toISOString(),\n    nonce: input.nonce ?? encodeBase64Url(crypto.getRandomValues(new Uint8Array(16))),\n    sequence: (current.checkpoint.sequence as number) + 1,\n    previousCheckpointDigestHex,\n  };\n  const signature = await input.sign(sha256(new TextEncoder().encode(ROOT_STATUS_RENEWAL_V1_DOMAIN + jcsCanonicalize(unsigned))));\n  if (signature.length !== 64) throw new Error(\"policy root renewal signature must be Ed25519\");\n  const response = await fetchFn(new URL(\"/share/v3/policy/status\", input.nodeOrigin), {\n    method: \"POST\",\n    redirect: \"error\",\n    headers: { accept: \"application/json\", \"content-type\": \"application/json\" },\n    body: JSON.stringify({ rootCid: input.rootCid, renewal: { ...unsigned, signature: { suite: \"Ed25519\", signerDid: input.ownerDid, value: encodeBase64Url(signature) } } }),\n  });\n  if (!response.ok) throw new Error(`policy root renewal rejected (${response.status})`);\n  return object(await response.json(), \"policy root renewal\");\n}\n\nexport async function revokePolicyRootV3(input: {\n  readonly nodeOrigin: string;\n  readonly rootCid: string;\n  readonly targetRole: \"policy-authority\" | \"policy-enforcement\";\n  readonly ownerDid: string;\n  readonly issuerDid: string;\n  readonly nodeAudience: string;\n  readonly reason: string;\n  readonly sign: (digest: Uint8Array) => Promise<Uint8Array>;\n  readonly now?: Date;\n  readonly fetch?: typeof fetch;\n}): Promise<Readonly<Record<string, unknown>>> {\n  if (input.reason.length === 0) throw new Error(\"policy root revocation reason is required\");\n  const unsigned = {\n    schema: ROOT_REVOCATION_V1_SCHEMA,\n    targetCid: input.rootCid,\n    targetRole: input.targetRole,\n    ownerDid: input.ownerDid,\n    nodeAudience: input.nodeAudience,\n    revokedAt: (input.now ?? new Date()).toISOString(),\n    reason: input.reason,\n    issuerDid: input.issuerDid,\n  };\n  const signature = await input.sign(sha256(new TextEncoder().encode(ROOT_REVOCATION_V1_DOMAIN + jcsCanonicalize(unsigned))));\n  if (signature.length !== 64) throw new Error(\"policy root revocation signature must be Ed25519\");\n  const fetchFn = input.fetch ?? globalThis.fetch.bind(globalThis);\n  const response = await fetchFn(new URL(\"/revoke\", input.nodeOrigin), {\n    method: \"POST\",\n    redirect: \"error\",\n    headers: { accept: \"application/json\", \"content-type\": \"application/json\" },\n    body: JSON.stringify({ revocation: { ...unsigned, signature: { suite: \"Ed25519\", signerDid: input.issuerDid, value: encodeBase64Url(signature) } } }),\n  });\n  if (!response.ok) throw new Error(`policy root revocation rejected (${response.status})`);\n  return object(await response.json(), \"policy root revocation\");\n}\n\nconst POLICY_SESSION_FACT_KEYS = [\n  \"profile\",\n  \"ownerDid\",\n  \"policyId\",\n  \"policyDigestHex\",\n  \"policyCid\",\n  \"policyDelegationCid\",\n  \"enforcementDelegationCid\",\n  \"contentSourceDigestHex\",\n  \"capabilityCeilingHashHex\",\n  \"nativeProjectionHashHex\",\n  \"enforcerDid\",\n  \"nodeAudience\",\n  \"recipientDid\",\n  \"challengeId\",\n  \"claimDigestHex\",\n  \"claimJti\",\n  \"vpDigestHex\",\n  \"credentialEvidenceDigestHex\",\n  \"decisionContextDigestHex\",\n  \"issuanceAuditDigestHex\",\n  \"remainingRedelegationDepth\",\n] as const;\n\nconst KV_ACTIONS = new Set<string>([\n  \"tinycloud.kv/get\",\n  \"tinycloud.kv/list\",\n  \"tinycloud.kv/metadata\",\n  \"tinycloud.kv/put\",\n]);\n\nfunction object(value: unknown, label: string): Record<string, unknown> {\n  if (value === null || typeof value !== \"object\" || Array.isArray(value)) {\n    throw new Error(`${label} must be an object`);\n  }\n  return value as Record<string, unknown>;\n}\n\nfunction exactKeys(\n  value: Record<string, unknown>,\n  allowed: readonly string[],\n  label: string,\n): void {\n  const keys = new Set(allowed);\n  if (Object.keys(value).some((key) => !keys.has(key)))\n    throw new Error(`${label} contains an unknown field`);\n}\n\nfunction nonEmptyString(value: unknown, label: string): string {\n  if (typeof value !== \"string\" || value.length === 0)\n    throw new Error(`${label} must be a non-empty string`);\n  return value;\n}\n\nfunction parseKvResource(resource: string): { space: string; path: string } {\n  const match = /^tinycloud:\\/\\/([^/]+)\\/kv\\/(.+)$/.exec(resource);\n  if (\n    !match ||\n    match[1]!.includes(\":\") ||\n    match[1]!.includes(\"?\") ||\n    match[1]!.includes(\"#\") ||\n    match[1]!.includes(\"%\") ||\n    match[2]!.startsWith(\"/\") ||\n    match[2]!.endsWith(\"/\") ||\n    match[2]!.includes(\"//\") ||\n    match[2]!\n      .split(\"/\")\n      .some((part) => part === \".\" || part === \"..\" || part.length === 0)\n  ) {\n    throw new Error(\"KV resource is not canonical\");\n  }\n  return { space: match[1]!, path: match[2]! };\n}\n\nfunction parseEncryptionResource(resource: string): void {\n  if (!resource.startsWith(\"urn:tinycloud:encryption:\")) throw new Error(\"encryption capability is invalid\");\n  const rest = resource.slice(\"urn:tinycloud:encryption:\".length);\n  const separator = rest.lastIndexOf(\":\");\n  const ownerDid = separator < 0 ? \"\" : rest.slice(0, separator);\n  const network = separator < 0 ? \"\" : rest.slice(separator + 1);\n  if (!ownerDid.startsWith(\"did:\") || network.length === 0 || network.includes(\":\") || network.includes(\"/\") || network.includes(\"%\") || network.includes(\"?\") || network.includes(\"#\")) {\n    throw new Error(\"encryption capability is invalid\");\n  }\n}\n\nexport function normalizeUnifiedPolicyCapability(\n  input: unknown,\n): UnifiedPolicyCapability {\n  const value = object(input, \"capability\");\n  const kind = nonEmptyString(value.kind, \"capability.kind\");\n  if (kind === \"kv\") {\n    exactKeys(\n      value,\n      [\"kind\", \"resource\", \"selector\", \"actions\"],\n      \"KV capability\",\n    );\n    const resource = nonEmptyString(value.resource, \"capability.resource\");\n    parseKvResource(resource);\n    if (value.selector !== \"exact\" && value.selector !== \"prefix\")\n      throw new Error(\"capability.selector is invalid\");\n    if (!Array.isArray(value.actions) || value.actions.length === 0)\n      throw new Error(\"capability.actions is invalid\");\n    const actions = value.actions.map((action) =>\n      nonEmptyString(action, \"capability.actions[]\"),\n    );\n    if (\n      new Set(actions).size !== actions.length ||\n      actions.some((action) => !KV_ACTIONS.has(action))\n    )\n      throw new Error(\"capability.actions is invalid\");\n    return {\n      kind: \"kv\",\n      resource,\n      selector: value.selector,\n      actions: [...actions].sort() as UnifiedKvCapability[\"actions\"],\n    };\n  }\n  if (kind === \"encryption\") {\n    exactKeys(value, [\"kind\", \"resource\", \"action\"], \"encryption capability\");\n    const resource = nonEmptyString(value.resource, \"capability.resource\");\n    if (value.action !== \"tinycloud.encryption/decrypt\")\n      throw new Error(\"encryption capability is invalid\");\n    parseEncryptionResource(resource);\n    return {\n      kind: \"encryption\",\n      resource,\n      action: \"tinycloud.encryption/decrypt\",\n    };\n  }\n  throw new Error(\"capability.kind is invalid\");\n}\n\nexport function canonicalizeUnifiedPolicyCapability(\n  input: unknown,\n): UnifiedPolicyCapability {\n  return normalizeUnifiedPolicyCapability(input);\n}\n\nexport function unifiedPolicyCapabilityDigestHex(input: unknown): string {\n  return hex(\n    sha256(\n      new TextEncoder().encode(\n        POLICY_CAPABILITY_V1_DOMAIN +\n          jcsCanonicalize(normalizeUnifiedPolicyCapability(input)),\n      ),\n    ),\n  );\n}\n\nexport function unifiedPolicyCapabilityContains(\n  authorityInput: unknown,\n  requestedInput: unknown,\n): boolean {\n  try {\n    const authority = normalizeUnifiedPolicyCapability(authorityInput);\n    const requested = normalizeUnifiedPolicyCapability(requestedInput);\n    if (authority.kind !== requested.kind) return false;\n    if (authority.kind === \"encryption\" && requested.kind === \"encryption\")\n      return (\n        authority.resource === requested.resource &&\n        authority.action === requested.action\n      );\n    if (authority.kind !== \"kv\" || requested.kind !== \"kv\") return false;\n    const { resource: authorized } = authority;\n    const { resource: requestedResource } = requested;\n    const pathContained =\n      authority.selector === \"exact\"\n        ? authorized === requestedResource\n        : authorized === requestedResource ||\n          requestedResource.startsWith(`${authorized}/`);\n    if (\n      !pathContained ||\n      (authority.selector === \"exact\" && requested.selector === \"prefix\")\n    )\n      return false;\n    return requested.actions.every((action) =>\n      authority.actions.includes(action),\n    );\n  } catch {\n    return false;\n  }\n}\n\nexport function projectUnifiedPolicyCapability(\n  input: unknown,\n): UnifiedNativeCapability {\n  const capability = normalizeUnifiedPolicyCapability(input);\n  if (capability.kind === \"encryption\") {\n    return {\n      service: \"tinycloud.encryption\",\n      space: capability.resource,\n      path: capability.resource,\n      actions: [capability.action],\n    };\n  }\n  const { space, path } = parseKvResource(capability.resource);\n  return {\n    service: \"tinycloud.kv\",\n    space,\n    path,\n    actions: [...capability.actions],\n    caveat: {\n      type: \"xyz.tinycloud.resource/selector\",\n      kind: capability.selector,\n      value: capability.resource,\n    },\n  };\n}\n\nexport function projectUnifiedPolicyCapabilities(\n  input: readonly unknown[],\n): UnifiedNativeCapability[] {\n  return input\n    .map(projectUnifiedPolicyCapability)\n    .sort((left, right) => {\n      const a = jcsCanonicalize(left);\n      const b = jcsCanonicalize(right);\n      return a < b ? -1 : a > b ? 1 : 0;\n    });\n}\n\nexport function unifiedNativeProjectionHashHex(\n  input: readonly unknown[],\n): string {\n  return hex(\n    sha256(\n      new TextEncoder().encode(\n        NATIVE_PROJECTION_V1_DOMAIN +\n          jcsCanonicalize(projectUnifiedPolicyCapabilities(input)),\n      ),\n    ),\n  );\n}\n\nexport function unifiedPolicyCapabilityFromNative(\n  input: unknown,\n): UnifiedPolicyCapability {\n  const value = object(input, \"native capability\");\n  exactKeys(\n    value,\n    [\"service\", \"space\", \"path\", \"actions\", \"caveat\"],\n    \"native capability\",\n  );\n  const service = nonEmptyString(value.service, \"native.service\");\n  const actions = value.actions;\n  if (!Array.isArray(actions)) throw new Error(\"native.actions is invalid\");\n  if (\n    service === \"tinycloud.encryption\" &&\n    value.caveat === undefined &&\n    value.space === value.path &&\n    actions.length === 1 &&\n    actions[0] === \"tinycloud.encryption/decrypt\"\n  ) {\n    return normalizeUnifiedPolicyCapability({\n      kind: \"encryption\",\n      resource: value.space,\n      action: actions[0],\n    });\n  }\n  if (\n    service !== \"tinycloud.kv\" ||\n    typeof value.space !== \"string\" ||\n    typeof value.path !== \"string\"\n  )\n    throw new Error(\"native capability is not supported\");\n  const caveat = object(value.caveat, \"native.caveat\");\n  exactKeys(caveat, [\"type\", \"kind\", \"value\"], \"native selector caveat\");\n  if (\n    caveat.type !== \"xyz.tinycloud.resource/selector\" ||\n    (caveat.kind !== \"exact\" && caveat.kind !== \"prefix\") ||\n    caveat.value !== `tinycloud://${value.space}/kv/${value.path}`\n  )\n    throw new Error(\"native selector caveat does not match capability\");\n  return normalizeUnifiedPolicyCapability({\n    kind: \"kv\",\n    resource: caveat.value,\n    selector: caveat.kind,\n    actions,\n  });\n}\n\nexport function contentSourceDigestHex(input: UnifiedContentSource): string {\n  return hex(\n    sha256(\n      new TextEncoder().encode(\n        CONTENT_SOURCE_V1_DOMAIN + jcsCanonicalize(input),\n      ),\n    ),\n  );\n}\n\nexport function policyDigestHex(\n  policy: Omit<UnifiedPolicyV1, \"policyId\" | \"signature\">,\n): string {\n  const canonicalPolicy = {\n    ...policy,\n    capabilityCeiling: policy.capabilityCeiling.map(\n      normalizeUnifiedPolicyCapability,\n    ),\n  };\n  return hex(\n    sha256(\n      new TextEncoder().encode(\n        POLICY_V1_DOMAIN + jcsCanonicalize(canonicalPolicy),\n      ),\n    ),\n  );\n}\n\nexport function policyIdForDigestHex(digestHex: string): string {\n  const digest = Uint8Array.from(\n    (digestHex.match(/.{2}/g) ?? []).map((byte) => Number.parseInt(byte, 16)),\n  );\n  if (digest.length !== 32) throw new Error(\"policy digest must be 32 bytes\");\n  return `pol_${base32Lower(digest)}`;\n}\n\nexport function policyCidFromCanonicalBytes(bytes: Uint8Array): string {\n  return CID.createV1(0x55, createDigest(0x12, sha256(bytes))).toString();\n}\n\nconst CompactHeaderSchema = z.object({\n  alg: z.literal(\"EdDSA\"),\n  jwk: z.object({ alg: z.literal(\"EdDSA\"), crv: z.literal(\"Ed25519\"), kty: z.literal(\"OKP\"), x: z.string().min(1) }).strict(),\n  typ: z.literal(\"JWT\"),\n  ucv: z.literal(\"0.10.0\"),\n}).strict();\nconst CompactPayloadSchema = z.object({\n  att: z.record(z.record(z.array(z.unknown()).min(1))),\n  aud: z.string().min(1),\n  exp: z.number().int(),\n  fct: z.array(z.record(z.unknown())).length(1),\n  iss: z.string().min(1),\n  nbf: z.number().int(),\n  nnc: z.string().min(1),\n  prf: z.array(z.string().min(1)),\n}).strict();\n\nexport interface CompactUcanAuthorizationV1 {\n  readonly authorization: string;\n  readonly cid: string;\n  readonly header: z.infer<typeof CompactHeaderSchema>;\n  readonly payload: z.infer<typeof CompactPayloadSchema>;\n}\n\nexport interface SignCompactUcanAuthorizationInput {\n  readonly issuerDid: string;\n  readonly audienceDid: string;\n  readonly attenuation: Readonly<Record<string, Readonly<Record<string, readonly unknown[]>>>>;\n  readonly facts: readonly [Readonly<Record<string, unknown>>];\n  readonly proofs: readonly string[];\n  readonly notBefore: number;\n  readonly expiresAt: number;\n  readonly nonce: string;\n  readonly sign: (bytes: Uint8Array) => Promise<Uint8Array>;\n}\n\n/** Sign exact compact-UCAN bytes with a caller-owned, potentially non-extractable key. */\nexport async function signCompactUcanAuthorization(\n  input: SignCompactUcanAuthorizationInput,\n): Promise<CompactUcanAuthorizationV1> {\n  if (input.notBefore >= input.expiresAt || input.expiresAt - input.notBefore > 60)\n    throw new Error(\"compact invocation lifetime must be between one and 60 seconds\");\n  const principal = input.issuerDid.split(\"#\", 1)[0]!;\n  const didMaterial = principal.startsWith(\"did:key:\")\n    ? base58btc.decode(principal.slice(\"did:key:\".length))\n    : new Uint8Array();\n  if (didMaterial.length !== 34 || didMaterial[0] !== 0xed || didMaterial[1] !== 0x01)\n    throw new Error(\"compact UCAN signer must be did:key Ed25519\");\n  const header = { alg: \"EdDSA\", jwk: { alg: \"EdDSA\", crv: \"Ed25519\", kty: \"OKP\", x: encodeBase64Url(didMaterial.slice(2)) }, typ: \"JWT\", ucv: \"0.10.0\" };\n  const payload = {\n    att: input.attenuation,\n    aud: input.audienceDid,\n    exp: input.expiresAt,\n    fct: input.facts,\n    iss: input.issuerDid.includes(\"#\") ? input.issuerDid : `${principal}#${principal.slice(\"did:key:\".length)}`,\n    nbf: input.notBefore,\n    nnc: input.nonce,\n    prf: input.proofs,\n  };\n  const protectedSegment = encodeBase64Url(new TextEncoder().encode(jcsCanonicalize(header)));\n  const payloadSegment = encodeBase64Url(new TextEncoder().encode(jcsCanonicalize(payload)));\n  const signature = await input.sign(new TextEncoder().encode(`${protectedSegment}.${payloadSegment}`));\n  if (signature.length !== 64) throw new Error(\"compact Authorization signature must be Ed25519\");\n  return parseCompactUcanAuthorization(`${protectedSegment}.${payloadSegment}.${encodeBase64Url(signature)}`);\n}\n\nexport interface CompactPolicyInvocationInput {\n  readonly sessionAuthorization: string;\n  readonly sessionCid: string;\n  readonly recipientDid: string;\n  readonly audienceDid: string;\n  readonly resource: string;\n  readonly action: string;\n  readonly caveat?: Readonly<Record<string, unknown>>;\n  readonly facts?: Readonly<Record<string, unknown>>;\n  readonly privateKey: Uint8Array;\n  readonly now?: number;\n  readonly nonce?: string;\n}\n\n/** Sign a fresh one-parent ordinary invocation; S0 itself is never a bearer. */\nexport function createCompactPolicyInvocation(\n  input: CompactPolicyInvocationInput,\n): CompactUcanAuthorizationV1 {\n  const session = parsePolicySessionUcan(input.sessionAuthorization);\n  if (session.cid !== input.sessionCid || session.aud !== input.recipientDid)\n    throw new Error(\"policy session does not bind the recipient signer\");\n  const principal = input.recipientDid.split(\"#\", 1)[0]!;\n  const didMaterial = base58btc.decode(principal.slice(\"did:key:\".length));\n  if (didMaterial.length !== 34 || didMaterial[0] !== 0xed || didMaterial[1] !== 0x01)\n    throw new Error(\"policy invocation signer must be did:key Ed25519\");\n  const publicKey = ed25519.getPublicKey(input.privateKey);\n  if (!equalBytes(publicKey, didMaterial.slice(2)))\n    throw new Error(\"policy invocation private key does not bind recipient DID\");\n  const now = input.now ?? Math.floor(Date.now() / 1000);\n  const exp = Math.min(now + 60, session.exp);\n  if (exp <= now) throw new Error(\"policy session has expired\");\n  const header = { alg: \"EdDSA\", jwk: { alg: \"EdDSA\", crv: \"Ed25519\", kty: \"OKP\", x: encodeBase64Url(publicKey) }, typ: \"JWT\", ucv: \"0.10.0\" };\n  const payload = {\n    att: { [input.resource]: { [input.action]: [input.caveat ?? {}] } },\n    aud: input.audienceDid,\n    exp,\n    fct: [input.facts ?? { type: \"tinycloud.policy.invocation/v1\", policyCid: session.fact.policyCid, sessionCid: session.cid }],\n    iss: input.recipientDid.includes(\"#\") ? input.recipientDid : `${principal}#${principal.slice(\"did:key:\".length)}`,\n    nbf: now,\n    nnc: input.nonce ?? encodeBase64Url(crypto.getRandomValues(new Uint8Array(16))),\n    prf: [session.cid],\n  };\n  const protectedSegment = encodeBase64Url(new TextEncoder().encode(jcsCanonicalize(header)));\n  const payloadSegment = encodeBase64Url(new TextEncoder().encode(jcsCanonicalize(payload)));\n  const signingInput = new TextEncoder().encode(`${protectedSegment}.${payloadSegment}`);\n  const signature = ed25519.sign(signingInput, input.privateKey);\n  return parseCompactUcanAuthorization(`${protectedSegment}.${payloadSegment}.${encodeBase64Url(signature)}`);\n}\n\nexport function createCompactPolicyDescendant(input: {\n  readonly parentAuthorization: string;\n  readonly parentCid: string;\n  readonly issuerDid: string;\n  readonly audienceDid: string;\n  readonly attenuation: Readonly<Record<string, Readonly<Record<string, readonly unknown[]>>>>;\n  readonly privateKey: Uint8Array;\n  readonly now?: number;\n  readonly expiresAt?: number;\n  readonly nonce?: string;\n}): CompactUcanAuthorizationV1 {\n  const parent = parseCompactUcanAuthorization(input.parentAuthorization, input.parentCid);\n  if (parent.payload.aud !== input.issuerDid) throw new Error(\"policy descendant issuer is not the parent audience\");\n  const parentFact = parent.payload.fct[0]!;\n  const depth = parentFact.remainingRedelegationDepth;\n  if (!Number.isInteger(depth) || (depth as number) <= 0) throw new Error(\"policy descendant depth is exhausted\");\n  if (!compactAttenuationContains(parent.payload.att, input.attenuation))\n    throw new Error(\"policy descendant exceeds the parent attenuation\");\n  const principal = input.issuerDid.split(\"#\", 1)[0]!;\n  const didMaterial = base58btc.decode(principal.slice(\"did:key:\".length));\n  const publicKey = ed25519.getPublicKey(input.privateKey);\n  if (didMaterial.length !== 34 || !equalBytes(publicKey, didMaterial.slice(2))) throw new Error(\"policy descendant signer does not bind issuer DID\");\n  const now = Math.max(input.now ?? Math.floor(Date.now() / 1000), parent.payload.nbf + 1);\n  const exp = Math.min(input.expiresAt ?? now + 60, now + 60, parent.payload.exp - 1);\n  if (exp <= now) throw new Error(\"policy parent has no strictly narrower validity window\");\n  const header = { alg: \"EdDSA\", jwk: { alg: \"EdDSA\", crv: \"Ed25519\", kty: \"OKP\", x: encodeBase64Url(publicKey) }, typ: \"JWT\", ucv: \"0.10.0\" };\n  const payload = {\n    att: input.attenuation,\n    aud: input.audienceDid,\n    exp,\n    fct: [{ ...parentFact, remainingRedelegationDepth: (depth as number) - 1 }],\n    iss: input.issuerDid.includes(\"#\") ? input.issuerDid : `${principal}#${principal.slice(\"did:key:\".length)}`,\n    nbf: now,\n    nnc: input.nonce ?? encodeBase64Url(crypto.getRandomValues(new Uint8Array(16))),\n    prf: [parent.cid],\n  };\n  const protectedSegment = encodeBase64Url(new TextEncoder().encode(jcsCanonicalize(header)));\n  const payloadSegment = encodeBase64Url(new TextEncoder().encode(jcsCanonicalize(payload)));\n  const signature = ed25519.sign(new TextEncoder().encode(`${protectedSegment}.${payloadSegment}`), input.privateKey);\n  return parseCompactUcanAuthorization(`${protectedSegment}.${payloadSegment}.${encodeBase64Url(signature)}`);\n}\n\n/** Byte-independent semantic containment shared by S0, descendants and mint requests. */\nexport function compactAttenuationContains(\n  parent: Readonly<Record<string, Readonly<Record<string, readonly unknown[]>>>>,\n  child: Readonly<Record<string, Readonly<Record<string, readonly unknown[]>>>>,\n): boolean {\n  const selector = (value: readonly unknown[]): { readonly kind: \"exact\" | \"prefix\"; readonly value: string } | undefined => {\n    if (value.length !== 1 || !isRecordValue(value[0])) return undefined;\n    const caveat = value[0];\n    if (Object.keys(caveat).length !== 3 || caveat.type !== \"xyz.tinycloud.resource/selector\" || (caveat.kind !== \"exact\" && caveat.kind !== \"prefix\") || typeof caveat.value !== \"string\") return undefined;\n    return { kind: caveat.kind, value: caveat.value };\n  };\n  const equal = (left: unknown, right: unknown): boolean => jcsCanonicalize(left) === jcsCanonicalize(right);\n  return Object.entries(child).every(([childResource, childActions]) =>\n    Object.entries(childActions).every(([action, childCaveats]) =>\n      Object.entries(parent).some(([parentResource, parentActions]) => {\n        const parentCaveats = parentActions[action];\n        if (parentCaveats === undefined) return false;\n        if (parentResource === childResource && equal(parentCaveats, childCaveats)) return true;\n        const parentSelector = selector(parentCaveats);\n        const childSelector = selector(childCaveats);\n        return parentSelector?.kind === \"prefix\"\n          && childSelector !== undefined\n          && parentSelector.value === parentResource\n          && childSelector.value === childResource\n          && (childResource === parentResource || childResource.startsWith(`${parentResource}/`));\n      }),\n    ),\n  );\n}\n\nfunction isRecordValue(value: unknown): value is Record<string, unknown> {\n  return value !== null && typeof value === \"object\" && !Array.isArray(value);\n}\n\nexport function parseCompactUcanAuthorization(\n  input: string,\n  expectedCid?: string,\n): CompactUcanAuthorizationV1 {\n  if (typeof input !== \"string\" || /\\s/.test(input))\n    throw new Error(\"Authorization must be compact UCAN bytes\");\n  const segments = input.split(\".\");\n  if (segments.length !== 3 || segments.some((segment) => segment.length === 0))\n    throw new Error(\"Authorization must have three compact segments\");\n  const [headerSegment, payloadSegment, signatureSegment] = segments as [string, string, string];\n  const headerBytes = decodeBase64Url(headerSegment);\n  const payloadBytes = decodeBase64Url(payloadSegment);\n  const signature = decodeBase64Url(signatureSegment);\n  const headerValue: unknown = JSON.parse(new TextDecoder(\"utf-8\", { fatal: true }).decode(headerBytes));\n  const payloadValue: unknown = JSON.parse(new TextDecoder(\"utf-8\", { fatal: true }).decode(payloadBytes));\n  if (jcsCanonicalize(headerValue) !== new TextDecoder().decode(headerBytes)\n    || jcsCanonicalize(payloadValue) !== new TextDecoder().decode(payloadBytes))\n    throw new Error(\"compact UCAN segments are not canonical JCS\");\n  const header = CompactHeaderSchema.parse(headerValue);\n  const payload = CompactPayloadSchema.parse(payloadValue);\n  if (payload.nbf >= payload.exp) throw new Error(\"compact UCAN validity is empty\");\n  const principal = payload.iss.split(\"#\", 1)[0]!;\n  const didMaterial = principal.startsWith(\"did:key:\")\n    ? base58btc.decode(principal.slice(\"did:key:\".length))\n    : new Uint8Array();\n  if (didMaterial.length !== 34 || didMaterial[0] !== 0xed || didMaterial[1] !== 0x01)\n    throw new Error(\"compact UCAN issuer must be did:key Ed25519\");\n  const publicKey = didMaterial.slice(2);\n  if (!equalBytes(publicKey, decodeBase64Url(header.jwk.x)))\n    throw new Error(\"compact UCAN JWK does not bind issuer\");\n  if (!ed25519.verify(signature, new TextEncoder().encode(`${headerSegment}.${payloadSegment}`), publicKey))\n    throw new Error(\"compact UCAN signature is invalid\");\n  const cid = CID.createV1(0x55, createDigest(0x1e, blake3(new TextEncoder().encode(input)))).toString();\n  if (expectedCid !== undefined && cid !== expectedCid)\n    throw new Error(\"compact UCAN CID does not match exact Authorization bytes\");\n  return { authorization: input, cid, header, payload };\n}\n\nexport function parsePolicySessionUcan(\n  authorization: string,\n  expectedProofs?: readonly [string, string],\n): PolicySessionUcanV1 {\n  const parsed = parseCompactUcanAuthorization(authorization);\n  const fact = parsed.payload.fct[0]!;\n  if (parsed.payload.prf.length !== 2 || parsed.payload.prf[0] === parsed.payload.prf[1])\n    throw new Error(\"policy session UCAN requires two distinct ordered proofs\");\n  if (expectedProofs !== undefined\n    && (parsed.payload.prf[0] !== expectedProofs[0] || parsed.payload.prf[1] !== expectedProofs[1]))\n    throw new Error(\"policy session UCAN ordered proofs do not match\");\n  const factKeys = Object.keys(fact);\n  if (\n    factKeys.length !== POLICY_SESSION_FACT_KEYS.length ||\n    factKeys.some((key) => !POLICY_SESSION_FACT_KEYS.includes(key as never)) ||\n    POLICY_SESSION_FACT_KEYS.some((key) => !(key in fact))\n  )\n    throw new Error(\"policy session UCAN fact is incomplete\");\n  if (\n    fact.profile !== POLICY_SESSION_UCAN_V1_PROFILE ||\n    typeof fact.remainingRedelegationDepth !== \"number\" ||\n    !Number.isInteger(fact.remainingRedelegationDepth) ||\n    fact.remainingRedelegationDepth < 0 ||\n    fact.remainingRedelegationDepth > 8 ||\n    parsed.payload.exp - parsed.payload.nbf > 60 ||\n    parsed.payload.iss.split(\"#\", 1)[0] !== fact.enforcerDid ||\n    parsed.payload.aud !== fact.recipientDid\n  )\n    throw new Error(\"policy session UCAN fact is invalid\");\n  return {\n    authorization,\n    cid: parsed.cid,\n    iss: parsed.payload.iss,\n    aud: parsed.payload.aud,\n    prf: parsed.payload.prf as [string, string],\n    att: parsed.payload.att,\n    nbf: parsed.payload.nbf,\n    exp: parsed.payload.exp,\n    nnc: parsed.payload.nnc,\n    fact,\n  };\n}\n\nfunction decodeBase64Url(value: string): Uint8Array {\n  if (!/^[A-Za-z0-9_-]+$/.test(value) || value.length % 4 === 1)\n    throw new Error(\"value is not canonical base64url\");\n  const normalized = value.replace(/-/g, \"+\").replace(/_/g, \"/\");\n  const binary = typeof Buffer !== \"undefined\"\n    ? Buffer.from(normalized, \"base64\").toString(\"binary\")\n    : atob(normalized.padEnd(Math.ceil(normalized.length / 4) * 4, \"=\"));\n  const bytes = Uint8Array.from(binary, (character) => character.charCodeAt(0));\n  const encoded = typeof Buffer !== \"undefined\"\n    ? Buffer.from(bytes).toString(\"base64url\")\n    : btoa(String.fromCharCode(...bytes)).replace(/=/g, \"\").replace(/\\+/g, \"-\").replace(/\\//g, \"_\");\n  if (encoded !== value) throw new Error(\"value is not canonical base64url\");\n  return bytes;\n}\n\nfunction encodeBase64Url(value: Uint8Array): string {\n  return typeof Buffer !== \"undefined\"\n    ? Buffer.from(value).toString(\"base64url\")\n    : btoa(String.fromCharCode(...value)).replace(/=/g, \"\").replace(/\\+/g, \"-\").replace(/\\//g, \"_\");\n}\n\nfunction equalBytes(left: Uint8Array, right: Uint8Array): boolean {\n  return left.length === right.length && left.every((byte, index) => byte === right[index]);\n}\n\nfunction hex(bytes: Uint8Array): string {\n  return [...bytes].map((byte) => byte.toString(16).padStart(2, \"0\")).join(\"\");\n}\n\nfunction base32Lower(bytes: Uint8Array): string {\n  const alphabet = \"abcdefghijklmnopqrstuvwxyz234567\";\n  let output = \"\";\n  let buffer = 0;\n  let bits = 0;\n  for (const byte of bytes) {\n    buffer = (buffer << 8) | byte;\n    bits += 8;\n    while (bits >= 5) {\n      output += alphabet[(buffer >>> (bits - 5)) & 31];\n      bits -= 5;\n    }\n  }\n  if (bits > 0) output += alphabet[(buffer << (5 - bits)) & 31];\n  return output;\n}\n","export type SignedObjectErrorCode =\n  | \"schema-invalid\"\n  | \"canonicalization-mismatch\"\n  | \"digest-mismatch\"\n  | \"id-mismatch\"\n  | \"signing-key-binding\"\n  | \"signature-material-invalid\"\n  | \"signature-suite-unsupported\"\n  | \"signature-invalid\";\n\nexport class SignedObjectProfileError extends Error {\n  public readonly code: SignedObjectErrorCode;\n\n  constructor(code: SignedObjectErrorCode, message: string) {\n    super(message);\n    this.name = \"SignedObjectProfileError\";\n    this.code = code;\n  }\n}\n\nexport class SignedObjectSchemaError extends SignedObjectProfileError {\n  constructor(message: string) {\n    super(\"schema-invalid\", message);\n    this.name = \"SignedObjectSchemaError\";\n  }\n}\n\nexport class SignedObjectCanonicalizationError extends SignedObjectProfileError {\n  constructor(message: string) {\n    super(\"canonicalization-mismatch\", message);\n    this.name = \"SignedObjectCanonicalizationError\";\n  }\n}\n\nexport class SignedObjectDigestError extends SignedObjectProfileError {\n  constructor(message: string) {\n    super(\"digest-mismatch\", message);\n    this.name = \"SignedObjectDigestError\";\n  }\n}\n\nexport class SignedObjectIdError extends SignedObjectProfileError {\n  constructor(message: string) {\n    super(\"id-mismatch\", message);\n    this.name = \"SignedObjectIdError\";\n  }\n}\n\nexport class SigningKeyBindingError extends SignedObjectProfileError {\n  constructor(message: string) {\n    super(\"signing-key-binding\", message);\n    this.name = \"SigningKeyBindingError\";\n  }\n}\n\nexport class SignatureMaterialError extends SignedObjectProfileError {\n  constructor(message: string) {\n    super(\"signature-material-invalid\", message);\n    this.name = \"SignatureMaterialError\";\n  }\n}\n\nexport class UnsupportedSignatureSuiteError extends SignedObjectProfileError {\n  constructor(message: string) {\n    super(\"signature-suite-unsupported\", message);\n    this.name = \"UnsupportedSignatureSuiteError\";\n  }\n}\n\nexport class SignatureVerificationError extends SignedObjectProfileError {\n  constructor(message: string) {\n    super(\"signature-invalid\", message);\n    this.name = \"SignatureVerificationError\";\n  }\n}\n\nexport function toSignedObjectError(error: unknown): SignedObjectProfileError {\n  if (error instanceof SignedObjectProfileError) {\n    return error;\n  }\n  return new SignedObjectProfileError(\n    \"schema-invalid\",\n    error instanceof Error ? error.message : String(error),\n  );\n}\n","import { SignedObjectCanonicalizationError } from \"./errors\";\n\nexport type JsonValue =\n  | null\n  | boolean\n  | number\n  | string\n  | JsonValue[]\n  | { readonly [key: string]: JsonValue };\n\ntype MutableJsonObject = { [key: string]: JsonValue };\nconst objectHasOwn: (object: object, propertyKey: PropertyKey) => boolean =\n  (Object as ObjectConstructor & {\n    hasOwn?: (object: object, propertyKey: PropertyKey) => boolean;\n  }).hasOwn ??\n  (Object.prototype.hasOwnProperty.call.bind(\n    Object.prototype.hasOwnProperty,\n  ) as (object: object, propertyKey: PropertyKey) => boolean);\n\n/**\n * RFC 8785 JSON Canonicalization Scheme encoder for the signed-object profile.\n *\n * This local encoder is intentionally stricter than JSON.stringify:\n * it rejects non-plain JSON inputs, sparse arrays, undefined/functions/symbols,\n * non-finite numbers, BigInt, dangerous prototype keys, and lone surrogates.\n * Object keys are sorted lexicographically by their raw UTF-16 code units,\n * as required by RFC 8785 section 3.2.3, before serialization.\n */\nexport function jcsCanonicalize(input: unknown): string {\n  return serialize(normalizeJson(input, \"$\"));\n}\n\nexport function normalizeJson(input: unknown, path = \"$\"): JsonValue {\n  if (input === null) {\n    return null;\n  }\n\n  switch (typeof input) {\n    case \"boolean\":\n      return input;\n    case \"number\":\n      if (!Number.isFinite(input)) {\n        throw new SignedObjectCanonicalizationError(\n          `${path} must be a finite JSON number`,\n        );\n      }\n      return input;\n    case \"string\":\n      assertUnicodeScalarString(input, path);\n      return input;\n    case \"object\":\n      return normalizeJsonObjectOrArray(input, path);\n    case \"bigint\":\n    case \"function\":\n    case \"symbol\":\n    case \"undefined\":\n    default:\n      throw new SignedObjectCanonicalizationError(\n        `${path} is not a JSON value`,\n      );\n  }\n}\n\nexport function serialize(value: JsonValue): string {\n  if (value === null) {\n    return \"null\";\n  }\n\n  switch (typeof value) {\n    case \"boolean\":\n      return value ? \"true\" : \"false\";\n    case \"number\": {\n      const encoded = JSON.stringify(value);\n      if (encoded === undefined) {\n        throw new SignedObjectCanonicalizationError(\n          \"number could not be serialized as JSON\",\n        );\n      }\n      return encoded;\n    }\n    case \"string\":\n      return JSON.stringify(value);\n    case \"object\":\n      if (Array.isArray(value)) {\n        return `[${value.map((item) => serialize(item)).join(\",\")}]`;\n      }\n      return serializeObject(value);\n    default:\n      throw new SignedObjectCanonicalizationError(\n        `unsupported JSON value type ${typeof value}`,\n      );\n  }\n}\n\nfunction normalizeJsonObjectOrArray(input: object, path: string): JsonValue {\n  assertNoSymbolKeys(input, path);\n\n  if (Array.isArray(input)) {\n    for (const key of Object.getOwnPropertyNames(input)) {\n      if (key === \"length\") {\n        continue;\n      }\n      if (!isArrayIndexKey(key, input.length)) {\n        throw new SignedObjectCanonicalizationError(\n          `${path}.${key} is not allowed on a JSON array`,\n        );\n      }\n      const descriptor = Object.getOwnPropertyDescriptor(input, key);\n      if (descriptor?.enumerable !== true) {\n        throw new SignedObjectCanonicalizationError(\n          `${path}[${key}] must be an enumerable JSON array item`,\n        );\n      }\n      if (!(\"value\" in descriptor)) {\n        throw new SignedObjectCanonicalizationError(\n          `${path}[${key}] must be a JSON data property`,\n        );\n      }\n    }\n    const output: JsonValue[] = [];\n    for (let index = 0; index < input.length; index++) {\n      if (!objectHasOwn(input, index)) {\n        throw new SignedObjectCanonicalizationError(\n          `${path}[${index}] must not be a sparse array hole`,\n        );\n      }\n      output.push(normalizeJson(input[index], `${path}[${index}]`));\n    }\n    return output;\n  }\n\n  const proto = Object.getPrototypeOf(input);\n  if (proto !== Object.prototype && proto !== null) {\n    throw new SignedObjectCanonicalizationError(\n      `${path} must be a plain JSON object`,\n    );\n  }\n\n  const output = Object.create(null) as MutableJsonObject;\n  for (const key of Object.getOwnPropertyNames(input)) {\n    assertUnicodeScalarString(key, `${path} key`);\n    if (key === \"__proto__\" || key === \"constructor\") {\n      throw new SignedObjectCanonicalizationError(\n        `${path}.${key} is not allowed`,\n      );\n    }\n    const descriptor = Object.getOwnPropertyDescriptor(input, key);\n    if (descriptor?.enumerable !== true) {\n      throw new SignedObjectCanonicalizationError(\n        `${path}.${key} must be an enumerable JSON object property`,\n      );\n    }\n    if (!(\"value\" in descriptor)) {\n      throw new SignedObjectCanonicalizationError(\n        `${path}.${key} must be a JSON data property`,\n      );\n    }\n    const value = descriptor.value;\n    output[key] = normalizeJson(value, `${path}.${key}`);\n  }\n  return output;\n}\n\nfunction assertNoSymbolKeys(input: object, path: string): void {\n  if (Object.getOwnPropertySymbols(input).length > 0) {\n    throw new SignedObjectCanonicalizationError(\n      `${path} must not have symbol properties`,\n    );\n  }\n}\n\nfunction isArrayIndexKey(key: string, length: number): boolean {\n  if (!/^(0|[1-9]\\d*)$/.test(key)) {\n    return false;\n  }\n  const index = Number(key);\n  return Number.isSafeInteger(index) && index >= 0 && index < length;\n}\n\nfunction serializeObject(value: { readonly [key: string]: JsonValue }): string {\n  const keys = Object.keys(value).sort(compareUtf16CodeUnits);\n  const parts = keys.map((key) => `${JSON.stringify(key)}:${serialize(value[key])}`);\n  return `{${parts.join(\",\")}}`;\n}\n\nfunction compareUtf16CodeUnits(a: string, b: string): number {\n  const max = Math.min(a.length, b.length);\n  for (let index = 0; index < max; index++) {\n    const leftCodeUnit = a.charCodeAt(index);\n    const rightCodeUnit = b.charCodeAt(index);\n    if (leftCodeUnit !== rightCodeUnit) {\n      return leftCodeUnit - rightCodeUnit;\n    }\n  }\n  return a.length - b.length;\n}\n\nfunction assertUnicodeScalarString(value: string, path: string): void {\n  for (let index = 0; index < value.length; index++) {\n    const code = value.charCodeAt(index);\n    if (code >= 0xd800 && code <= 0xdbff) {\n      const next = value.charCodeAt(index + 1);\n      if (Number.isNaN(next) || next < 0xdc00 || next > 0xdfff) {\n        throw new SignedObjectCanonicalizationError(\n          `${path} contains a lone high surrogate`,\n        );\n      }\n      index++;\n      continue;\n    }\n    if (code >= 0xdc00 && code <= 0xdfff) {\n      throw new SignedObjectCanonicalizationError(\n        `${path} contains a lone low surrogate`,\n      );\n    }\n  }\n}\n","import { ed25519 } from \"@noble/curves/ed25519\";\nimport { sha256 } from \"@noble/hashes/sha256\";\nimport { base32 } from \"multiformats/bases/base32\";\nimport { CID } from \"multiformats/cid\";\nimport { create as createDigest } from \"multiformats/hashes/digest\";\nimport { sha256 as sha256Cid } from \"multiformats/hashes/sha2\";\nimport * as raw from \"multiformats/codecs/raw\";\nimport { base58btc } from \"multiformats/bases/base58\";\nimport { canonicalizeSignedObjectUnsigned as canonicalize } from \"../policy/signed-object.js\";\n\nexport interface OwnerDelegationReceipt {\n  readonly delegationCid: string;\n  readonly signedDagCbor: Uint8Array;\n  readonly delegation: { readonly delegateDID: string; readonly spaceId: string; readonly path: string; readonly actions: readonly string[]; readonly expiry: Date };\n  /** Exact service-scoped capabilities encoded in the signed owner delegation. */\n  readonly permissions: readonly OwnerDelegationPermission[];\n}\n\nexport interface OwnerDelegationPermission {\n  /** Canonical long-form service name, for example `tinycloud.kv`. */\n  readonly service: string;\n  /** Exact service resource path. Encryption permissions use a network URN. */\n  readonly path: string;\n  /** Canonical full action URNs belonging to `service`. */\n  readonly actions: readonly string[];\n}\n\ninterface CreateOwnerDelegationBase {\n  readonly delegateDid: string;\n  readonly spaceId: string;\n  readonly expiresAt: Date;\n}\n\n/**\n * A wallet-rooted owner delegation accepts either the historical single-path\n * shape or an exact list of service-scoped permissions. The two forms are\n * mutually exclusive so callers cannot sign authority from one field while\n * displaying or persisting a contradictory second field.\n */\nexport type CreateOwnerDelegationParams = CreateOwnerDelegationBase & (\n  | {\n      readonly path: string;\n      readonly actions: readonly string[];\n      readonly permissions?: never;\n    }\n  | {\n      readonly permissions: readonly OwnerDelegationPermission[];\n      readonly path?: never;\n      readonly actions?: never;\n    }\n);\n\nconst MAX_CONTENT_BYTES = 100 * 1024 * 1024;\nconst ENFORCEMENT_DOMAIN = \"xyz.tinycloud.share/policy-enforcement/v2\\0\";\nconst POLICY_DOMAIN = \"xyz.tinycloud.share/policy/v2\\0\";\nexport const OWNER_SHARE_REGISTRATION_DOMAIN = \"xyz.tinycloud.share/policy-registration/v2\\0\";\n\nexport type OwnerShareAction = \"tinycloud.kv/get\" | \"tinycloud.kv/list\" | \"tinycloud.kv/metadata\" | \"tinycloud.kv/put\";\nexport interface OwnerShareDecryption {\n  readonly networkId: string;\n  readonly action: \"tinycloud.encryption/decrypt\";\n}\nexport type OwnerShareMatcher =\n  | { readonly kind: \"exactEmail\"; readonly value: string }\n  | { readonly kind: \"emailDomain\"; readonly value: string }\n  | { readonly kind: \"recipientDid\"; readonly value: string };\n\nexport interface OwnerSharePolicyV2 {\n  readonly type: \"TinyCloudSharePolicy\";\n  readonly version: 2;\n  readonly shareId: string;\n  readonly ownerDid: string;\n  readonly shareKeyDid: string;\n  readonly recipientMatcher: OwnerShareMatcher;\n  readonly target: { readonly origin: string; readonly nodeAudience: string; readonly enforcerDid: string; readonly spaceId: string };\n  readonly resource: { readonly kind: \"exact\" | \"prefix\"; readonly path: string };\n  readonly actions: readonly OwnerShareAction[];\n  readonly decryption?: OwnerShareDecryption;\n  readonly contentSource: { readonly kind: \"kv\"; readonly space: string; readonly path: string; readonly action: \"tinycloud.kv/get\" };\n  readonly contentSourceDigest: string;\n  readonly ownerDelegationCid: string;\n  readonly expiresAt: string;\n}\n\nexport interface DelegatedShareKey {\n  readonly did: string;\n  readonly publicKey: Uint8Array;\n  readonly extractable: boolean;\n  readonly privateJwk?: Record<string, string>;\n  /**\n   * The underlying WebCrypto private key. Non-extractable keys are still\n   * structured-clonable, so this handle (not `privateJwk`) is what callers\n   * must persist (e.g. in IndexedDB) to recover signing across a reload.\n   */\n  readonly cryptoKey: CryptoKey;\n  sign(bytes: Uint8Array): Promise<Uint8Array>;\n  clear(): void;\n}\n\nexport interface SignedDelegation {\n  readonly cid: string;\n  readonly dagCbor: string;\n  readonly issuerDid: string;\n  readonly audienceDid: string;\n  readonly facts: Record<string, string | readonly string[]>;\n  readonly signature: string;\n}\n\nexport interface RegisterOwnerSharePolicyParams {\n  readonly policy: { readonly bytes: Uint8Array; readonly cid: string; readonly proof: string };\n  readonly ownerDelegation: OwnerDelegationReceipt;\n  readonly enforcementDelegation: SignedDelegation;\n  readonly contentSourceDigest: string;\n  /** The enrolled receipt key from the node trust bundle. */\n  readonly nodeProof?: { readonly kid: string; readonly publicKey: Uint8Array };\n}\n\nexport interface OwnerSharePolicyRegistration {\n  readonly registrationCid: string;\n  readonly policyCid: string;\n  readonly ownerDelegationCid: string;\n  readonly enforcementDelegationCid: string;\n  readonly ownerDid: string;\n  readonly shareKeyDid: string;\n  readonly enforcerDid: string;\n  readonly shareId: string;\n  readonly recipientMatcher: OwnerShareMatcher;\n  readonly target: { readonly origin: string; readonly nodeAudience: string; readonly spaceId: string };\n  readonly resource: { readonly kind: \"exact\" | \"prefix\"; readonly path: string };\n  readonly actions: readonly OwnerShareAction[];\n  readonly decryption?: OwnerShareDecryption;\n  readonly contentSource: { readonly kind: \"kv\"; readonly space: string; readonly path: string; readonly action: \"tinycloud.kv/get\" };\n  readonly contentSourceDigest: string;\n  readonly registeredAt: string;\n  readonly expiresAt: string;\n}\n\nexport interface OwnerSharePolicyRegistrationReceipt {\n  readonly registration: OwnerSharePolicyRegistration;\n  readonly proof: { readonly alg: \"EdDSA\"; readonly kid: string; readonly signature: string };\n}\n\nfunction bytes(value: Uint8Array): Uint8Array { return new Uint8Array(value); }\n\nfunction b64(value: Uint8Array): string {\n  if (typeof btoa === \"function\") {\n    let binary = \"\";\n    for (const byte of value) binary += String.fromCharCode(byte);\n    return btoa(binary).replace(/\\+/g, \"-\").replace(/\\//g, \"_\").replace(/=+$/g, \"\");\n  }\n  if (typeof Buffer !== \"undefined\") return Buffer.from(value).toString(\"base64url\");\n  throw new Error(\"base64url encoding is unavailable\");\n}\n\nfunction fromB64(value: string): Uint8Array {\n  if (!/^[A-Za-z0-9_-]+$/.test(value)) throw new Error(\"owner-share value is not canonical base64url\");\n  if (typeof atob === \"function\") {\n    const padded = value.replace(/-/g, \"+\").replace(/_/g, \"/\") + \"=\".repeat((4 - value.length % 4) % 4);\n    return Uint8Array.from(atob(padded), (character) => character.charCodeAt(0));\n  }\n  if (typeof Buffer !== \"undefined\") return new Uint8Array(Buffer.from(value, \"base64url\"));\n  throw new Error(\"base64url decoding is unavailable\");\n}\n\nfunction cid(bytesValue: Uint8Array): string {\n  return CID.createV1(raw.code, createDigest(sha256Cid.code, sha256(bytesValue))).toString(base32.encoder);\n}\n\nfunction digest(bytesValue: Uint8Array): string { return b64(sha256(bytesValue)); }\n\nfunction didKeyFromEd25519PublicKey(publicKey: Uint8Array): string {\n  if (publicKey.length !== 32) throw new Error(\"share key public key must be 32 bytes\");\n  const prefixed = new Uint8Array(34);\n  prefixed.set([0xed, 0x01]);\n  prefixed.set(publicKey, 2);\n  return `did:key:${base58btc.encode(prefixed)}`;\n}\n\nfunction assertCanonical(value: string, label: string): void {\n  if (value !== canonicalize(JSON.parse(value))) throw new Error(`${label} is not canonical JSON`);\n}\n\nfunction dagCborEncode(value: unknown): Uint8Array {\n  const output: number[] = [];\n  const writeHeader = (major: number, length: number): void => {\n    if (!Number.isSafeInteger(length) || length < 0) throw new Error(\"DAG-CBOR value is too large\");\n    if (length < 24) output.push((major << 5) | length);\n    else if (length < 0x100) output.push((major << 5) | 24, length);\n    else if (length < 0x10000) output.push((major << 5) | 25, length >> 8, length & 0xff);\n    else throw new Error(\"DAG-CBOR value is too large\");\n  };\n  const write = (item: unknown): void => {\n    if (item === null) { output.push(0xf6); return; }\n    if (item === false) { output.push(0xf4); return; }\n    if (item === true) { output.push(0xf5); return; }\n    if (typeof item === \"string\") {\n      const encoded = new TextEncoder().encode(item);\n      writeHeader(3, encoded.length); output.push(...encoded); return;\n    }\n    if (typeof item === \"number\" && Number.isSafeInteger(item)) {\n      if (item >= 0) writeHeader(0, item);\n      else writeHeader(1, -1 - item);\n      return;\n    }\n    if (Array.isArray(item)) {\n      writeHeader(4, item.length); item.forEach(write); return;\n    }\n    if (typeof item === \"object\" && item !== null) {\n      const entries = Object.entries(item as Record<string, unknown>).map(([key, value]) => {\n        const keyBytes = dagCborEncode(key);\n        return { key, value, keyBytes };\n      }).sort((left, right) => {\n        if (left.keyBytes.length !== right.keyBytes.length) return left.keyBytes.length - right.keyBytes.length;\n        for (let index = 0; index < left.keyBytes.length; index += 1) {\n          if (left.keyBytes[index] !== right.keyBytes[index]) return left.keyBytes[index] - right.keyBytes[index];\n        }\n        return 0;\n      });\n      writeHeader(5, entries.length);\n      entries.forEach(({ key, value }) => { write(key); write(value); });\n      return;\n    }\n    throw new Error(\"Unsupported DAG-CBOR value\");\n  };\n  write(value);\n  return Uint8Array.from(output);\n}\n\nfunction assertObject(value: unknown, keys: readonly string[], label: string): Record<string, unknown> {\n  if (typeof value !== \"object\" || value === null || Array.isArray(value)) throw new Error(`${label} is invalid`);\n  const record = value as Record<string, unknown>;\n  if (Object.keys(record).length !== keys.length || keys.some((key) => !Object.prototype.hasOwnProperty.call(record, key))) throw new Error(`${label} has unknown or missing fields`);\n  return record;\n}\n\nexport async function createDelegatedShareKey(options: { readonly extractable: boolean }): Promise<DelegatedShareKey> {\n  if (!globalThis.crypto?.subtle) throw new Error(\"WebCrypto Ed25519 is required for delegated share keys\");\n  const generated = await crypto.subtle.generateKey({ name: \"Ed25519\" }, options.extractable, [\"sign\", \"verify\"]) as CryptoKeyPair;\n  const privateKey = generated.privateKey;\n  const publicKey = new Uint8Array(await crypto.subtle.exportKey(\"raw\", generated.publicKey));\n  let cleared = false;\n  const key: DelegatedShareKey = {\n    did: didKeyFromEd25519PublicKey(publicKey),\n    publicKey: bytes(publicKey),\n    extractable: options.extractable,\n    cryptoKey: privateKey,\n    ...(options.extractable ? { privateJwk: await crypto.subtle.exportKey(\"jwk\", privateKey) as Record<string, string> } : {}),\n    async sign(input) {\n      if (cleared) throw new Error(\"share key has been cleared\");\n      return new Uint8Array(await crypto.subtle.sign({ name: \"Ed25519\" }, privateKey, input));\n    },\n    clear() { cleared = true; },\n  };\n  return key;\n}\n\n/**\n * Rehydrate a signer wrapper around a `DelegatedShareKey`'s private\n * `CryptoKey` handle that was persisted (e.g. via IndexedDB structured\n * clone) and recovered after a reload. `privateKey` must be the same\n * non-extractable Ed25519 `CryptoKey` originally produced by\n * {@link createDelegatedShareKey}.\n */\nexport function restoreDelegatedShareKey(input: { readonly privateKey: CryptoKey; readonly publicKey: Uint8Array; readonly extractable: boolean }): DelegatedShareKey {\n  let cleared = false;\n  return {\n    did: didKeyFromEd25519PublicKey(input.publicKey),\n    publicKey: bytes(input.publicKey),\n    extractable: input.extractable,\n    cryptoKey: input.privateKey,\n    async sign(signBytes) {\n      if (cleared) throw new Error(\"share key has been cleared\");\n      if (!globalThis.crypto?.subtle) throw new Error(\"WebCrypto Ed25519 is required for delegated share keys\");\n      return new Uint8Array(await crypto.subtle.sign({ name: \"Ed25519\" }, input.privateKey, signBytes));\n    },\n    clear() { cleared = true; },\n  };\n}\n\nexport async function createPolicyEnforcementDelegation(input: {\n  readonly ownerDelegation: OwnerDelegationReceipt;\n  readonly shareKey: DelegatedShareKey;\n  readonly enforcerDid: string;\n  readonly policyCid: string;\n  readonly shareId: string;\n  readonly spaceId: string;\n  readonly nodeAudience: string;\n  readonly path: string;\n  readonly actions: readonly OwnerShareAction[];\n  readonly decryption?: OwnerShareDecryption;\n  readonly contentSourceDigest: string;\n  readonly expiresAt: string;\n}): Promise<SignedDelegation> {\n  if (input.shareKey.did.length === 0 || input.ownerDelegation.delegationCid.length === 0) throw new Error(\"owner delegation and share key are required\");\n  const facts = {\n    ownerDelegationCid: input.ownerDelegation.delegationCid,\n    policyCid: input.policyCid,\n    shareId: input.shareId,\n    shareKeyDid: input.shareKey.did,\n    enforcerDid: input.enforcerDid,\n    nodeAudience: input.nodeAudience,\n    spaceId: input.spaceId,\n    path: input.path,\n    actions: [...input.actions],\n    ...(input.decryption === undefined ? {} : {\n      decryptionNetworkId: input.decryption.networkId,\n      decryptionAction: input.decryption.action,\n    }),\n    contentSourceDigest: input.contentSourceDigest,\n    expiresAt: input.expiresAt,\n  } satisfies Record<string, string | readonly string[]>;\n  const unsigned = { type: \"TinyCloudSharePolicyEnforcement\", version: 2, issuerDid: input.shareKey.did, audienceDid: input.enforcerDid, facts };\n  const dagCborBytes = dagCborEncode({ domain: ENFORCEMENT_DOMAIN, unsigned });\n  const signature = b64(await input.shareKey.sign(dagCborBytes));\n  return { cid: cid(dagCborBytes), dagCbor: b64(dagCborBytes), issuerDid: input.shareKey.did, audienceDid: input.enforcerDid, facts, signature };\n}\n\nexport async function canonicalOwnerSharePolicy(policy: OwnerSharePolicyV2): Promise<{ readonly bytes: Uint8Array; readonly cid: string; readonly digest: string }> {\n  const text = canonicalize({ domain: POLICY_DOMAIN, policy });\n  const policyBytes = new TextEncoder().encode(text);\n  return { bytes: policyBytes, cid: cid(policyBytes), digest: digest(policyBytes) };\n}\n\nexport function computeOwnerShareRegistrationCid(registration: Omit<OwnerSharePolicyRegistration, \"registrationCid\">): string {\n  return cid(new TextEncoder().encode(canonicalize(registration)));\n}\n\nexport function validateOwnerSharePolicyRegistration(value: unknown, expected: RegisterOwnerSharePolicyParams): OwnerSharePolicyRegistrationReceipt {\n  if (cid(expected.policy.bytes) !== expected.policy.cid) throw new Error(\"submitted owner-share policy bytes do not match its CID\");\n  const root = assertObject(value, [\"registration\", \"proof\"], \"owner-share registration response\");\n  const rawRegistration = root.registration as Record<string, unknown> | undefined;\n  const hasDecryption = typeof rawRegistration === \"object\" && rawRegistration !== null && Object.prototype.hasOwnProperty.call(rawRegistration, \"decryption\");\n  const registration = assertObject(root.registration, [\"registrationCid\", \"policyCid\", \"ownerDelegationCid\", \"enforcementDelegationCid\", \"ownerDid\", \"shareKeyDid\", \"enforcerDid\", \"shareId\", \"recipientMatcher\", \"target\", \"resource\", \"actions\", ...(hasDecryption ? [\"decryption\"] : []), \"contentSource\", \"contentSourceDigest\", \"registeredAt\", \"expiresAt\"], \"owner-share registration\");\n  const proof = assertObject(root.proof, [\"alg\", \"kid\", \"signature\"], \"owner-share registration proof\");\n  if (registration.policyCid !== expected.policy.cid || registration.ownerDelegationCid !== expected.ownerDelegation.delegationCid || registration.enforcementDelegationCid !== expected.enforcementDelegation.cid || registration.contentSourceDigest !== expected.contentSourceDigest) throw new Error(\"owner-share registration is not bound to the submitted chain\");\n  let policyValue: Record<string, unknown>;\n  try { policyValue = JSON.parse(new TextDecoder(\"utf-8\", { fatal: true }).decode(expected.policy.bytes)) as Record<string, unknown>; } catch { throw new Error(\"owner-share policy is not valid JSON\"); }\n  const policy = policyValue.policy as Record<string, unknown> | undefined;\n  if (policyValue.domain !== \"xyz.tinycloud.share/policy/v2\\0\" || policy === undefined || Array.isArray(policy)) throw new Error(\"owner-share policy envelope is invalid\");\n  const target = policy.target as Record<string, unknown> | undefined;\n  const resource = policy.resource as Record<string, unknown> | undefined;\n  const registrationTarget = registration.target as Record<string, unknown>;\n  const registrationResource = registration.resource as Record<string, unknown>;\n  const enforcementFacts = expected.enforcementDelegation.facts;\n  const decryption = policy.decryption as Record<string, unknown> | undefined;\n  const decryptionMatches = decryption === undefined\n    ? registration.decryption === undefined\n    : registration.decryption !== undefined && canonicalize(decryption) === canonicalize(registration.decryption);\n  if (typeof target?.origin !== \"string\" || typeof target.nodeAudience !== \"string\" || typeof target.enforcerDid !== \"string\" || typeof target.spaceId !== \"string\" || typeof resource?.kind !== \"string\" || ![\"exact\", \"prefix\"].includes(resource.kind) || typeof resource?.path !== \"string\" || !Array.isArray(policy.actions) || policy.ownerDid !== registration.ownerDid || policy.shareKeyDid !== registration.shareKeyDid || policy.shareId !== registration.shareId || canonicalize(policy.recipientMatcher) !== canonicalize(registration.recipientMatcher) || target.origin !== registrationTarget.origin || target.nodeAudience !== registrationTarget.nodeAudience || target.enforcerDid !== registration.enforcerDid || target.spaceId !== registrationTarget.spaceId || resource.kind !== registrationResource.kind || resource.path !== registrationResource.path || canonicalize(policy.actions) !== canonicalize(registration.actions) || !decryptionMatches || canonicalize(policy.contentSource) !== canonicalize(registration.contentSource) || policy.expiresAt !== registration.expiresAt || policy.contentSourceDigest !== registration.contentSourceDigest || enforcementFacts.ownerDelegationCid !== registration.ownerDelegationCid || enforcementFacts.policyCid !== registration.policyCid || enforcementFacts.shareKeyDid !== registration.shareKeyDid || enforcementFacts.enforcerDid !== registration.enforcerDid || enforcementFacts.nodeAudience !== registrationTarget.nodeAudience || enforcementFacts.spaceId !== registrationTarget.spaceId || enforcementFacts.path !== registrationResource.path || canonicalize(enforcementFacts.actions) !== canonicalize(registration.actions) || enforcementFacts.decryptionNetworkId !== decryption?.networkId || enforcementFacts.decryptionAction !== decryption?.action || enforcementFacts.expiresAt !== registration.expiresAt) throw new Error(\"owner-share registration is not bound to the canonical policy\");\n  if (typeof registration.registrationCid !== \"string\" || typeof registration.expiresAt !== \"string\" || typeof registration.registeredAt !== \"string\") throw new Error(\"owner-share registration timestamps are invalid\");\n  if (new Date(registration.expiresAt).toISOString() !== registration.expiresAt || Date.parse(registration.expiresAt) <= Date.now()) throw new Error(\"owner-share registration is expired or non-canonical\");\n  const { registrationCid: _registrationCid, ...registrationCore } = registration;\n  if (computeOwnerShareRegistrationCid(registrationCore as unknown as Omit<OwnerSharePolicyRegistration, \"registrationCid\">) !== registration.registrationCid) throw new Error(\"owner-share registration CID does not match its canonical core\");\n  if (proof.alg !== \"EdDSA\" || typeof proof.kid !== \"string\" || typeof proof.signature !== \"string\") throw new Error(\"owner-share registration proof is invalid\");\n  const proofKey = expected.nodeProof;\n  if (proofKey === undefined) throw new Error(\"owner-share registration proof trust material is required\");\n  if (proof.kid !== proofKey.kid) throw new Error(\"owner-share registration proof key is not trusted\");\n  const encodedKid = proofKey.publicKey;\n  if (encodedKid.length === 34 && encodedKid[0] === 0xed && encodedKid[1] === 0x01) {\n    // did:key multicodec prefix is removed below.\n  } else if (encodedKid.length !== 32) throw new Error(\"owner-share registration proof key is invalid\");\n  const publicKey = encodedKid.length === 34 ? encodedKid.slice(2) : encodedKid;\n  const signatureBytes = fromB64(proof.signature);\n  const signedBytes = new TextEncoder().encode(`${OWNER_SHARE_REGISTRATION_DOMAIN}${canonicalize(registrationCore)}`);\n  if (signatureBytes.length !== 64 || !ed25519.verify(signatureBytes, signedBytes, publicKey)) throw new Error(\"owner-share registration proof signature is invalid\");\n  return { registration: registration as unknown as OwnerSharePolicyRegistration, proof: proof as unknown as OwnerSharePolicyRegistrationReceipt[\"proof\"] };\n}\n\n/** Validate the exact UTF-8 response bytes emitted by the registration route. */\nexport function validateOwnerSharePolicyRegistrationBytes(bytesValue: Uint8Array, expected: RegisterOwnerSharePolicyParams): OwnerSharePolicyRegistrationReceipt {\n  let value: unknown;\n  try {\n    value = JSON.parse(new TextDecoder(\"utf-8\", { fatal: true }).decode(bytesValue));\n  } catch {\n    throw new Error(\"owner-share registration response is not valid UTF-8 JSON\");\n  }\n  return validateOwnerSharePolicyRegistration(value, expected);\n}\n\nexport { MAX_CONTENT_BYTES };\n","import { ed25519 } from \"@noble/curves/ed25519\";\nimport { bases } from \"multiformats/basics\";\nimport { bytesToHex, sha256, verifyMessage } from \"viem\";\nimport { parsePkhDid } from \"../identity\";\nimport { canonicalizePolicyCapability, normalizePolicyCapability } from \"./capability\";\nimport {\n  SignatureMaterialError,\n  SignatureVerificationError,\n  SignedObjectDigestError,\n  SignedObjectIdError,\n  SignedObjectProfileError,\n  SignedObjectSchemaError,\n  SigningKeyBindingError,\n  UnsupportedSignatureSuiteError,\n  toSignedObjectError,\n} from \"./errors\";\nimport { type JsonValue, jcsCanonicalize, normalizeJson } from \"./jcs\";\n\nexport const POLICY_SCHEMA = \"xyz.tinycloud.policy/policy/v0\";\nexport const POLICY_STATUS_SCHEMA = \"xyz.tinycloud.policy/status/v0\";\nexport const POLICY_ENGINE_RECORD_SCHEMA =\n  \"xyz.tinycloud.policy/engine-record/v0\";\n\nexport const ED25519_JCS_SIGNATURE_SUITE = \"eddsa-ed25519-sha256-jcs-v1\";\nexport const EIP191_JCS_SIGNATURE_SUITE =\n  \"eip191-secp256k1-sha256-jcs-v1\";\n\nexport type SignedObjectKind = \"Policy\" | \"PolicyStatus\" | \"PolicyEngineRecord\";\n\nexport type SignatureSuite =\n  | typeof ED25519_JCS_SIGNATURE_SUITE\n  | typeof EIP191_JCS_SIGNATURE_SUITE;\n\nexport interface SignedObjectSignature {\n  suite: SignatureSuite;\n  signerDid: string;\n  value: string;\n}\n\nexport type JsonObject = { readonly [key: string]: JsonValue };\n\nexport interface Policy {\n  readonly schema: typeof POLICY_SCHEMA;\n  readonly policyId: string;\n  readonly ownerDid: string;\n  readonly signingKeyDid: string;\n  readonly createdAt: string;\n  readonly expiresAt?: string;\n  readonly resource: JsonObject;\n  readonly when: JsonObject;\n  readonly grant: JsonObject;\n  readonly disclosure?: JsonObject;\n  readonly audit?: JsonObject;\n  readonly signature: SignedObjectSignature;\n}\n\nexport type UnsignedPolicy = Omit<Policy, \"policyId\" | \"signature\">;\n\nexport interface PolicyStatus {\n  readonly schema: typeof POLICY_STATUS_SCHEMA;\n  readonly statusId: string;\n  readonly policyId: string;\n  readonly ownerDid: string;\n  readonly sequence: number;\n  readonly disposition: \"active\" | \"suspended\" | \"revoked\";\n  readonly effectiveAt: string;\n  readonly reasonCode?: string;\n  readonly signingKeyDid: string;\n  readonly signature: SignedObjectSignature;\n}\n\nexport type UnsignedPolicyStatus = Omit<PolicyStatus, \"statusId\" | \"signature\">;\n\nexport interface PolicyEngineRecord {\n  readonly schema: typeof POLICY_ENGINE_RECORD_SCHEMA;\n  readonly engineRecordId: string;\n  readonly ownerDid: string;\n  readonly endpoint: string;\n  readonly audience: string;\n  readonly supportedPolicyVersions: string[];\n  readonly supportedEvidenceVerifiers: string[];\n  readonly grantIssuerDid: string;\n  readonly expiresAt: string;\n  readonly signature: SignedObjectSignature;\n}\n\nexport type UnsignedPolicyEngineRecord = Omit<\n  PolicyEngineRecord,\n  \"engineRecordId\" | \"signature\"\n>;\n\nexport type SignedPolicyObject =\n  | Policy\n  | PolicyStatus\n  | PolicyEngineRecord;\n\nexport type UnsignedPolicyObject =\n  | UnsignedPolicy\n  | UnsignedPolicyStatus\n  | UnsignedPolicyEngineRecord;\n\nexport interface SignedObjectSigner {\n  readonly suite: SignatureSuite;\n  readonly signerDid: string;\n  signDigest(digest: Uint8Array): Promise<Uint8Array | string> | Uint8Array | string;\n}\n\nexport interface SignedObjectMaterial {\n  readonly kind: SignedObjectKind;\n  readonly idField: string;\n  readonly id: string;\n  readonly domain: string;\n  readonly unsigned: JsonObject;\n  readonly jcs: string;\n  readonly jcsBytes: Uint8Array;\n  readonly digest: Uint8Array;\n  readonly digestHex: string;\n}\n\nexport type SignedObjectVerificationResult<T extends SignedPolicyObject> =\n  | { readonly ok: true; readonly object: T; readonly material: SignedObjectMaterial }\n  | { readonly ok: false; readonly error: SignedObjectProfileError };\n\ninterface ObjectDescriptor {\n  readonly kind: SignedObjectKind;\n  readonly schema: string;\n  readonly idField: \"policyId\" | \"statusId\" | \"engineRecordId\";\n  readonly idPrefix: string;\n  readonly domain: string;\n}\n\nconst DESCRIPTORS: Record<SignedObjectKind, ObjectDescriptor> = {\n  Policy: {\n    kind: \"Policy\",\n    schema: POLICY_SCHEMA,\n    idField: \"policyId\",\n    idPrefix: \"pol_\",\n    domain: POLICY_SCHEMA,\n  },\n  PolicyStatus: {\n    kind: \"PolicyStatus\",\n    schema: POLICY_STATUS_SCHEMA,\n    idField: \"statusId\",\n    idPrefix: \"polst_\",\n    domain: POLICY_STATUS_SCHEMA,\n  },\n  PolicyEngineRecord: {\n    kind: \"PolicyEngineRecord\",\n    schema: POLICY_ENGINE_RECORD_SCHEMA,\n    idField: \"engineRecordId\",\n    idPrefix: \"peng_\",\n    domain: POLICY_ENGINE_RECORD_SCHEMA,\n  },\n};\n\nconst textEncoder = new TextEncoder();\nconst BASE32_ALPHABET = \"abcdefghijklmnopqrstuvwxyz234567\";\nconst BASE64URL_RE = /^[A-Za-z0-9_-]+$/;\nconst objectHasOwn: (object: object, propertyKey: PropertyKey) => boolean =\n  (Object as ObjectConstructor & {\n    hasOwn?: (object: object, propertyKey: PropertyKey) => boolean;\n  }).hasOwn ??\n  (Object.prototype.hasOwnProperty.call.bind(\n    Object.prototype.hasOwnProperty,\n  ) as (object: object, propertyKey: PropertyKey) => boolean);\n\nexport function canonicalizeSignedObjectUnsigned(input: unknown): string {\n  return jcsCanonicalize(input);\n}\n\nexport function deriveSignedObjectMaterial(input: unknown): SignedObjectMaterial {\n  const descriptor = descriptorForUnsigned(input);\n  const unsigned = validateUnsignedForDescriptor(input, descriptor);\n  return materialForUnsigned(unsigned, descriptor);\n}\n\nexport function signedObjectIdFor(input: unknown): string {\n  return deriveSignedObjectMaterial(input).id;\n}\n\nexport async function createAndSignSignedObject(\n  input: unknown,\n  signer: SignedObjectSigner,\n): Promise<SignedPolicyObject> {\n  const normalized = expectJsonObject(normalizeJson(input), \"$\");\n  const descriptor = descriptorForUnsigned(normalized);\n  const stripped = stripOwnIdAndSignature(normalized, descriptor);\n  const unsigned = validateUnsignedForDescriptor(stripped, descriptor);\n  if (descriptor.kind === \"Policy\") {\n    validatePolicyPermissionsCeilingForSigning(unsigned);\n  }\n  assertSupportedSignatureSuite(signer.suite);\n  requireStringType(signer.signerDid, \"$.signer.signerDid\");\n  assertSignerDidMatchesSuite(signer.signerDid, signer.suite);\n  assertSigningKeyBindingForCreate(unsigned, signer.signerDid);\n  const material = materialForUnsigned(unsigned, descriptor);\n  const signatureValue = encodeSignatureValue(\n    await signer.signDigest(material.digest),\n    signer.suite,\n  );\n  const signature = validateSignature({\n    suite: signer.suite,\n    signerDid: signer.signerDid,\n    value: signatureValue,\n  });\n  return {\n    ...unsigned,\n    [descriptor.idField]: material.id,\n    signature,\n  } as unknown as SignedPolicyObject;\n}\n\nexport function createAndSignPolicy(\n  input: unknown,\n  signer: SignedObjectSigner,\n): Promise<Policy> {\n  return createAndSignSignedObject(input, signer).then((object) =>\n    validatePolicySignedShape(object),\n  );\n}\n\nexport function createAndSignPolicyStatus(\n  input: unknown,\n  signer: SignedObjectSigner,\n): Promise<PolicyStatus> {\n  return createAndSignSignedObject(input, signer).then((object) =>\n    validatePolicyStatusSignedShape(object),\n  );\n}\n\nexport function createAndSignPolicyEngineRecord(\n  input: unknown,\n  signer: SignedObjectSigner,\n): Promise<PolicyEngineRecord> {\n  return createAndSignSignedObject(input, signer).then((object) =>\n    validatePolicyEngineRecordSignedShape(object),\n  );\n}\n\nexport async function verifySignedObject(\n  input: unknown,\n): Promise<{ object: SignedPolicyObject; material: SignedObjectMaterial }> {\n  const signed = validateSignedObjectShape(input);\n  const signedJson = signed as unknown as JsonObject;\n  const descriptor = descriptorForSchema(signed.schema);\n  const signature = validateSignature(signed.signature);\n  assertSigningKeyBindingForVerify(signedJson, signature);\n  const unsigned = stripOwnIdAndSignature(signedJson, descriptor);\n  const material = materialForUnsigned(unsigned, descriptor);\n  assertIdMatches(signedJson, material, descriptor);\n  if (!(await verifySignature(signature, material.digest))) {\n    throw new SignatureVerificationError(\"signature verification failed\");\n  }\n  return { object: signed, material };\n}\n\nexport async function verifyPolicy(\n  input: unknown,\n): Promise<{ object: Policy; material: SignedObjectMaterial }> {\n  const result = await verifySignedObject(input);\n  return {\n    object: validatePolicySignedShape(result.object),\n    material: result.material,\n  };\n}\n\nexport async function verifyPolicyStatus(\n  input: unknown,\n): Promise<{ object: PolicyStatus; material: SignedObjectMaterial }> {\n  const result = await verifySignedObject(input);\n  return {\n    object: validatePolicyStatusSignedShape(result.object),\n    material: result.material,\n  };\n}\n\nexport async function verifyPolicyEngineRecord(\n  input: unknown,\n): Promise<{ object: PolicyEngineRecord; material: SignedObjectMaterial }> {\n  const result = await verifySignedObject(input);\n  return {\n    object: validatePolicyEngineRecordSignedShape(result.object),\n    material: result.material,\n  };\n}\n\nexport async function validatePolicySigned(\n  input: unknown,\n): Promise<SignedObjectVerificationResult<Policy>> {\n  try {\n    const result = await verifyPolicy(input);\n    return { ok: true, object: result.object, material: result.material };\n  } catch (error) {\n    return { ok: false, error: toSignedObjectError(error) };\n  }\n}\n\nexport async function validatePolicyStatusSigned(\n  input: unknown,\n): Promise<SignedObjectVerificationResult<PolicyStatus>> {\n  try {\n    const result = await verifyPolicyStatus(input);\n    return { ok: true, object: result.object, material: result.material };\n  } catch (error) {\n    return { ok: false, error: toSignedObjectError(error) };\n  }\n}\n\nexport async function validatePolicyEngineRecordSigned(\n  input: unknown,\n): Promise<SignedObjectVerificationResult<PolicyEngineRecord>> {\n  try {\n    const result = await verifyPolicyEngineRecord(input);\n    return { ok: true, object: result.object, material: result.material };\n  } catch (error) {\n    return { ok: false, error: toSignedObjectError(error) };\n  }\n}\n\nexport function validatePolicyUnsigned(input: unknown): UnsignedPolicy {\n  return validatePolicyShape(input, false) as unknown as UnsignedPolicy;\n}\n\nexport function validatePolicyStatusUnsigned(input: unknown): UnsignedPolicyStatus {\n  return validatePolicyStatusShape(input, false) as unknown as UnsignedPolicyStatus;\n}\n\nexport function validatePolicyEngineRecordUnsigned(\n  input: unknown,\n): UnsignedPolicyEngineRecord {\n  return validatePolicyEngineRecordShape(input, false) as unknown as UnsignedPolicyEngineRecord;\n}\n\nexport function validatePolicySignedShape(input: unknown): Policy {\n  return validatePolicyShape(input, true) as unknown as Policy;\n}\n\nexport function validatePolicyStatusSignedShape(input: unknown): PolicyStatus {\n  return validatePolicyStatusShape(input, true) as unknown as PolicyStatus;\n}\n\nexport function validatePolicyEngineRecordSignedShape(\n  input: unknown,\n): PolicyEngineRecord {\n  return validatePolicyEngineRecordShape(input, true) as unknown as PolicyEngineRecord;\n}\n\nfunction validateSignedObjectShape(input: unknown): SignedPolicyObject {\n  const normalized = expectJsonObject(normalizeJson(input), \"$\");\n  const schema = requiredString(normalized, \"schema\", \"$\");\n  const descriptor = descriptorForSchema(schema);\n  switch (descriptor.kind) {\n    case \"Policy\":\n      return validatePolicySignedShape(normalized);\n    case \"PolicyStatus\":\n      return validatePolicyStatusSignedShape(normalized);\n    case \"PolicyEngineRecord\":\n      return validatePolicyEngineRecordSignedShape(normalized);\n  }\n}\n\nfunction validateUnsignedForDescriptor(\n  input: unknown,\n  descriptor: ObjectDescriptor,\n): JsonObject {\n  switch (descriptor.kind) {\n    case \"Policy\":\n      return validatePolicyUnsigned(input) as unknown as JsonObject;\n    case \"PolicyStatus\":\n      return validatePolicyStatusUnsigned(input) as unknown as JsonObject;\n    case \"PolicyEngineRecord\":\n      return validatePolicyEngineRecordUnsigned(input) as unknown as JsonObject;\n  }\n}\n\nfunction validatePolicyShape(input: unknown, signed: boolean): JsonObject {\n  const object = expectJsonObject(normalizeJson(input), \"$\");\n  assertExactKeys(\n    object,\n    signed\n      ? [\n          \"schema\",\n          \"policyId\",\n          \"ownerDid\",\n          \"signingKeyDid\",\n          \"createdAt\",\n          \"expiresAt\",\n          \"resource\",\n          \"when\",\n          \"grant\",\n          \"disclosure\",\n          \"audit\",\n          \"signature\",\n        ]\n      : [\n          \"schema\",\n          \"ownerDid\",\n          \"signingKeyDid\",\n          \"createdAt\",\n          \"expiresAt\",\n          \"resource\",\n          \"when\",\n          \"grant\",\n          \"disclosure\",\n          \"audit\",\n        ],\n    \"$\",\n  );\n  expectConst(requiredString(object, \"schema\", \"$\"), POLICY_SCHEMA, \"$.schema\");\n  if (signed) {\n    requiredString(object, \"policyId\", \"$\");\n    validateSignature(requiredValue(object, \"signature\", \"$\"));\n  }\n  requiredString(object, \"ownerDid\", \"$\");\n  requiredString(object, \"signingKeyDid\", \"$\");\n  requiredDateString(object, \"createdAt\", \"$\");\n  optionalDateString(object, \"expiresAt\", \"$\");\n  validatePolicyResource(requiredValue(object, \"resource\", \"$\"), \"$.resource\");\n  validateExpression(requiredValue(object, \"when\", \"$\"), \"$.when\");\n  validateGrant(requiredValue(object, \"grant\", \"$\"), \"$.grant\");\n  if (hasOwn(object, \"disclosure\")) {\n    validateDisclosure(requiredValue(object, \"disclosure\", \"$\"), \"$.disclosure\");\n  }\n  if (hasOwn(object, \"audit\")) {\n    validateAudit(requiredValue(object, \"audit\", \"$\"), \"$.audit\");\n  }\n  return object;\n}\n\nfunction validatePolicyStatusShape(input: unknown, signed: boolean): JsonObject {\n  const object = expectJsonObject(normalizeJson(input), \"$\");\n  assertExactKeys(\n    object,\n    signed\n      ? [\n          \"schema\",\n          \"statusId\",\n          \"policyId\",\n          \"ownerDid\",\n          \"sequence\",\n          \"disposition\",\n          \"effectiveAt\",\n          \"reasonCode\",\n          \"signingKeyDid\",\n          \"signature\",\n        ]\n      : [\n          \"schema\",\n          \"policyId\",\n          \"ownerDid\",\n          \"sequence\",\n          \"disposition\",\n          \"effectiveAt\",\n          \"reasonCode\",\n          \"signingKeyDid\",\n        ],\n    \"$\",\n  );\n  expectConst(requiredString(object, \"schema\", \"$\"), POLICY_STATUS_SCHEMA, \"$.schema\");\n  if (signed) {\n    requiredString(object, \"statusId\", \"$\");\n    validateSignature(requiredValue(object, \"signature\", \"$\"));\n  }\n  requiredString(object, \"policyId\", \"$\");\n  requiredString(object, \"ownerDid\", \"$\");\n  requiredInteger(object, \"sequence\", \"$\", 0);\n  expectOneOf(requiredString(object, \"disposition\", \"$\"), [\n    \"active\",\n    \"suspended\",\n    \"revoked\",\n  ], \"$.disposition\");\n  requiredDateString(object, \"effectiveAt\", \"$\");\n  optionalString(object, \"reasonCode\", \"$\");\n  requiredString(object, \"signingKeyDid\", \"$\");\n  return object;\n}\n\nfunction validatePolicyEngineRecordShape(\n  input: unknown,\n  signed: boolean,\n): JsonObject {\n  const object = expectJsonObject(normalizeJson(input), \"$\");\n  assertExactKeys(\n    object,\n    signed\n      ? [\n          \"schema\",\n          \"engineRecordId\",\n          \"ownerDid\",\n          \"endpoint\",\n          \"audience\",\n          \"supportedPolicyVersions\",\n          \"supportedEvidenceVerifiers\",\n          \"grantIssuerDid\",\n          \"expiresAt\",\n          \"signature\",\n        ]\n      : [\n          \"schema\",\n          \"ownerDid\",\n          \"endpoint\",\n          \"audience\",\n          \"supportedPolicyVersions\",\n          \"supportedEvidenceVerifiers\",\n          \"grantIssuerDid\",\n          \"expiresAt\",\n        ],\n    \"$\",\n  );\n  expectConst(\n    requiredString(object, \"schema\", \"$\"),\n    POLICY_ENGINE_RECORD_SCHEMA,\n    \"$.schema\",\n  );\n  if (signed) {\n    requiredString(object, \"engineRecordId\", \"$\");\n    validateSignature(requiredValue(object, \"signature\", \"$\"));\n  }\n  requiredString(object, \"ownerDid\", \"$\");\n  requiredString(object, \"endpoint\", \"$\");\n  requiredString(object, \"audience\", \"$\");\n  requiredStringArray(object, \"supportedPolicyVersions\", \"$\", (value, path) =>\n    expectConst(value, \"v0\", path),\n  );\n  requiredStringArray(object, \"supportedEvidenceVerifiers\", \"$\");\n  requiredString(object, \"grantIssuerDid\", \"$\");\n  requiredDateString(object, \"expiresAt\", \"$\");\n  return object;\n}\n\nfunction validateSignature(input: unknown): SignedObjectSignature {\n  const object = expectJsonObject(input, \"$.signature\");\n  assertExactKeys(object, [\"suite\", \"signerDid\", \"value\"], \"$.signature\");\n  const suite = requiredString(object, \"suite\", \"$.signature\");\n  assertSupportedSignatureSuite(suite);\n  const signerDid = requiredString(object, \"signerDid\", \"$.signature\");\n  const value = requiredString(object, \"value\", \"$.signature\");\n  decodeSignatureValue(value, suite);\n  return { suite, signerDid, value };\n}\n\nfunction validatePolicyResource(input: unknown, path: string): void {\n  const object = expectJsonObject(input, path);\n  assertExactKeys(object, [\"resourceType\", \"resourceId\", \"permissionsCeiling\"], path);\n  requiredString(object, \"resourceType\", path);\n  requiredString(object, \"resourceId\", path);\n  const ceiling = requiredArray(object, \"permissionsCeiling\", path, 1);\n  for (let index = 0; index < ceiling.length; index++) {\n    validatePolicyCapability(ceiling[index], `${path}.permissionsCeiling[${index}]`);\n  }\n}\n\nfunction validatePolicyPermissionsCeilingForSigning(input: JsonObject): void {\n  const resource = expectJsonObject(requiredValue(input, \"resource\", \"$\"), \"$.resource\");\n  const ceiling = requiredArray(resource, \"permissionsCeiling\", \"$.resource\", 1);\n  for (let index = 0; index < ceiling.length; index++) {\n    validatePolicyCapabilityForSigning(\n      ceiling[index],\n      `$.resource.permissionsCeiling[${index}]`,\n    );\n  }\n}\n\nfunction validatePolicyCapability(input: unknown, path: string): void {\n  const object = expectJsonObject(input, path);\n  try {\n    const canonical = canonicalizePolicyCapability(object);\n    if (jcsCanonicalize(object) !== jcsCanonicalize(canonical)) {\n      throw new SignedObjectSchemaError(`${path} must be canonical PolicyCapability JSON`);\n    }\n  } catch (error) {\n    if (error instanceof SignedObjectSchemaError) {\n      throw error;\n    }\n    throw new SignedObjectSchemaError(\n      error instanceof Error ? error.message : String(error),\n    );\n  }\n}\n\nfunction validatePolicyCapabilityForSigning(input: unknown, path: string): void {\n  const object = expectJsonObject(input, path);\n  try {\n    const canonical = normalizePolicyCapability(object);\n    if (jcsCanonicalize(object) !== jcsCanonicalize(canonical)) {\n      throw new SignedObjectSchemaError(`${path} must be strict canonical PolicyCapability JSON`);\n    }\n  } catch (error) {\n    if (error instanceof SignedObjectSchemaError) {\n      throw error;\n    }\n    throw new SignedObjectSchemaError(\n      error instanceof Error ? error.message : String(error),\n    );\n  }\n}\n\nfunction validateExpression(input: unknown, path: string): void {\n  const object = expectJsonObject(input, path);\n  const keys = Object.keys(object);\n  if (keys.length !== 1) {\n    throw new SignedObjectSchemaError(`${path} must have exactly one expression key`);\n  }\n  const key = keys[0];\n  if (key === \"allOf\" || key === \"anyOf\") {\n    const values = requiredArray(object, key, path, 1);\n    for (let index = 0; index < values.length; index++) {\n      validateExpression(values[index], `${path}.${key}[${index}]`);\n    }\n    return;\n  }\n  if (key === \"subject\") {\n    const subject = expectJsonObject(requiredValue(object, \"subject\", path), `${path}.subject`);\n    assertExactKeys(subject, [\"did\"], `${path}.subject`);\n    requiredString(subject, \"did\", `${path}.subject`);\n    return;\n  }\n  if (key === \"evidence\") {\n    validateEvidenceRequirement(requiredValue(object, \"evidence\", path), `${path}.evidence`);\n    return;\n  }\n  throw new SignedObjectSchemaError(`${path} has unknown expression key ${key}`);\n}\n\nfunction validateEvidenceRequirement(input: unknown, path: string): void {\n  const object = expectJsonObject(input, path);\n  assertExactKeys(\n    object,\n    [\"requirementId\", \"verifier\", \"requirements\", \"authority\", \"freshness\"],\n    path,\n  );\n  requiredString(object, \"requirementId\", path);\n  requiredString(object, \"verifier\", path);\n  requiredValue(object, \"requirements\", path);\n  if (hasOwn(object, \"authority\")) {\n    const authority = expectJsonObject(requiredValue(object, \"authority\", path), `${path}.authority`);\n    assertExactKeys(\n      authority,\n      [\"profile\", \"acceptedIssuers\", \"allowOwnerAuthorizedIssuer\"],\n      `${path}.authority`,\n    );\n    optionalString(authority, \"profile\", `${path}.authority`);\n    if (hasOwn(authority, \"acceptedIssuers\")) {\n      requiredStringArray(authority, \"acceptedIssuers\", `${path}.authority`);\n    }\n    optionalBoolean(authority, \"allowOwnerAuthorizedIssuer\", `${path}.authority`);\n  }\n  if (hasOwn(object, \"freshness\")) {\n    const freshness = expectJsonObject(requiredValue(object, \"freshness\", path), `${path}.freshness`);\n    assertExactKeys(freshness, [\"maxStatusAgeSeconds\"], `${path}.freshness`);\n    requiredInteger(freshness, \"maxStatusAgeSeconds\", `${path}.freshness`, 0);\n  }\n}\n\nfunction validateGrant(input: unknown, path: string): void {\n  const object = expectJsonObject(input, path);\n  assertExactKeys(object, [\"output\", \"maxTtlSeconds\", \"delegationMode\", \"revocation\"], path);\n  expectConst(requiredString(object, \"output\", path), \"portable-delegation\", `${path}.output`);\n  requiredInteger(object, \"maxTtlSeconds\", path, 1);\n  expectOneOf(requiredString(object, \"delegationMode\", path), [\n    \"terminal\",\n    \"attenuable\",\n  ], `${path}.delegationMode`);\n  expectOneOf(requiredString(object, \"revocation\", path), [\n    \"refresh_only\",\n    \"active_cutoff\",\n  ], `${path}.revocation`);\n}\n\nfunction validateDisclosure(input: unknown, path: string): void {\n  const object = expectJsonObject(input, path);\n  assertExactKeys(object, [\"denial\"], path);\n  expectOneOf(requiredString(object, \"denial\", path), [\"none\", \"code\", \"debug\"], `${path}.denial`);\n}\n\nfunction validateAudit(input: unknown, path: string): void {\n  const object = expectJsonObject(input, path);\n  assertExactKeys(object, [\"issuance\"], path);\n  expectOneOf(requiredString(object, \"issuance\", path), [\"off\", \"security\", \"full\"], `${path}.issuance`);\n}\n\nfunction materialForUnsigned(\n  unsigned: JsonObject,\n  descriptor: ObjectDescriptor,\n): SignedObjectMaterial {\n  const jcs = jcsCanonicalize(unsigned);\n  const jcsBytes = textEncoder.encode(jcs);\n  const digest = sha256Bytes(concatBytes(textEncoder.encode(`${descriptor.domain}\\0`), jcsBytes));\n  const id = `${descriptor.idPrefix}${base32LowerNoPad(digest)}`;\n  return {\n    kind: descriptor.kind,\n    idField: descriptor.idField,\n    id,\n    domain: descriptor.domain,\n    unsigned,\n    jcs,\n    jcsBytes,\n    digest,\n    digestHex: bytesToHex(digest).slice(2),\n  };\n}\n\nfunction assertIdMatches(\n  signed: JsonObject,\n  material: SignedObjectMaterial,\n  descriptor: ObjectDescriptor,\n): void {\n  const actual = requiredString(signed, descriptor.idField, \"$\");\n  if (actual === material.id) {\n    return;\n  }\n  if (new RegExp(`^${descriptor.idPrefix}[a-z2-7]{52}$`).test(actual)) {\n    throw new SignedObjectDigestError(\n      `${descriptor.idField} was not derived from the signed object digest`,\n    );\n  }\n  throw new SignedObjectIdError(`${descriptor.idField} does not match ${descriptor.idPrefix}`);\n}\n\nfunction assertSigningKeyBindingForCreate(\n  unsigned: JsonObject,\n  signerDid: string,\n): void {\n  if (!hasOwn(unsigned, \"signingKeyDid\")) {\n    return;\n  }\n  const signingKeyDid = requiredString(unsigned, \"signingKeyDid\", \"$\");\n  if (signingKeyDid !== signerDid) {\n    throw new SigningKeyBindingError(\n      `signer DID ${signerDid} does not match signingKeyDid ${signingKeyDid}`,\n    );\n  }\n}\n\nfunction assertSigningKeyBindingForVerify(\n  signed: JsonObject,\n  signature: SignedObjectSignature,\n): void {\n  if (!hasOwn(signed, \"signingKeyDid\")) {\n    return;\n  }\n  const signingKeyDid = requiredString(signed, \"signingKeyDid\", \"$\");\n  if (signature.signerDid !== signingKeyDid) {\n    throw new SigningKeyBindingError(\n      `signature signerDid ${signature.signerDid} does not match signingKeyDid ${signingKeyDid}`,\n    );\n  }\n}\n\nfunction assertSignerDidMatchesSuite(\n  signerDid: string,\n  suite: SignatureSuite,\n): void {\n  if (suite === ED25519_JCS_SIGNATURE_SUITE) {\n    ed25519PublicKeyFromDidKey(signerDid);\n    return;\n  }\n  if (suite === EIP191_JCS_SIGNATURE_SUITE) {\n    parseDidPkh(signerDid);\n    return;\n  }\n  throw new UnsupportedSignatureSuiteError(`unsupported signature suite: ${suite}`);\n}\n\nasync function verifySignature(\n  signature: SignedObjectSignature,\n  digest: Uint8Array,\n): Promise<boolean> {\n  if (signature.suite === ED25519_JCS_SIGNATURE_SUITE) {\n    const publicKey = ed25519PublicKeyFromDidKey(signature.signerDid);\n    const signatureBytes = decodeSignatureValue(signature.value, signature.suite);\n    try {\n      return ed25519.verify(signatureBytes, digest, publicKey);\n    } catch {\n      throw new SignatureVerificationError(\"Ed25519 signature verification failed\");\n    }\n  }\n\n  if (signature.suite === EIP191_JCS_SIGNATURE_SUITE) {\n    const pkh = parseDidPkh(signature.signerDid);\n    const signatureBytes = decodeSignatureValue(signature.value, signature.suite);\n    try {\n      return verifyMessage({\n        address: pkh.address,\n        message: { raw: digest },\n        signature: bytesToHex(signatureBytes),\n      });\n    } catch {\n      throw new SignatureVerificationError(\"EIP-191 signature verification failed\");\n    }\n  }\n\n  throw new UnsupportedSignatureSuiteError(`unsupported signature suite: ${signature.suite}`);\n}\n\nfunction ed25519PublicKeyFromDidKey(did: string): Uint8Array {\n  if (!did.startsWith(\"did:key:\")) {\n    throw new SignatureMaterialError(\"Ed25519 signerDid must be did:key\");\n  }\n  const identifier = did.slice(\"did:key:\".length);\n  if (!identifier.startsWith(\"z\")) {\n    throw new SignatureMaterialError(\"did:key must use base58btc multibase\");\n  }\n  let bytes: Uint8Array;\n  try {\n    bytes = bases.base58btc.decode(identifier);\n  } catch {\n    throw new SignatureMaterialError(\"did:key signerDid is undecodable\");\n  }\n  if (bytes.length === 34 && bytes[0] === 0xed && bytes[1] === 0x01) {\n    return bytes.slice(2);\n  }\n  throw new SignatureMaterialError(\"did:key signerDid is not an Ed25519 key\");\n}\n\nfunction parseDidPkh(did: string): { address: `0x${string}` } {\n  let parsed: ReturnType<typeof parsePkhDid>;\n  try {\n    parsed = parsePkhDid(did);\n  } catch {\n    throw new SignatureMaterialError(\"did:pkh signerDid is undecodable\");\n  }\n  if (!parsed) {\n    throw new SignatureMaterialError(\"EIP-191 signerDid must be did:pkh\");\n  }\n  return { address: parsed.address };\n}\n\nfunction decodeSignatureValue(value: string, suite: SignatureSuite): Uint8Array {\n  if (value.length === 0 || !BASE64URL_RE.test(value) || value.includes(\"=\")) {\n    throw new SignatureMaterialError(\"signature value must be base64url without padding\");\n  }\n  const bytes = base64UrlDecode(value);\n  if (suite === ED25519_JCS_SIGNATURE_SUITE && bytes.length !== 64) {\n    throw new SignatureMaterialError(\"Ed25519 signature must be 64 bytes\");\n  }\n  if (suite === EIP191_JCS_SIGNATURE_SUITE) {\n    if (bytes.length !== 65) {\n      throw new SignatureMaterialError(\"EIP-191 signature must be 65 bytes\");\n    }\n    const v = bytes[64];\n    if (v !== 27 && v !== 28) {\n      throw new SignatureMaterialError(\"EIP-191 signature recovery id must be 27 or 28\");\n    }\n  }\n  return bytes;\n}\n\nfunction encodeSignatureValue(\n  value: Uint8Array | string,\n  suite: SignatureSuite,\n): string {\n  if (typeof value === \"string\") {\n    const encoded = value.startsWith(\"0x\")\n      ? base64UrlEncode(hexToBytes(value))\n      : value;\n    decodeSignatureValue(encoded, suite);\n    return encoded;\n  }\n  const encoded = base64UrlEncode(value);\n  decodeSignatureValue(encoded, suite);\n  return encoded;\n}\n\nfunction stripOwnIdAndSignature(\n  object: JsonObject,\n  descriptor: ObjectDescriptor,\n): JsonObject {\n  const output = Object.create(null) as { [key: string]: JsonValue };\n  for (const [key, value] of Object.entries(object)) {\n    if (key === descriptor.idField || key === \"signature\") {\n      continue;\n    }\n    output[key] = value;\n  }\n  return output;\n}\n\nfunction descriptorForUnsigned(input: unknown): ObjectDescriptor {\n  const object = expectJsonObject(normalizeJson(input), \"$\");\n  return descriptorForSchema(requiredString(object, \"schema\", \"$\"));\n}\n\nfunction descriptorForSchema(schema: string): ObjectDescriptor {\n  if (schema === POLICY_SCHEMA) return DESCRIPTORS.Policy;\n  if (schema === POLICY_STATUS_SCHEMA) return DESCRIPTORS.PolicyStatus;\n  if (schema === POLICY_ENGINE_RECORD_SCHEMA) return DESCRIPTORS.PolicyEngineRecord;\n  throw new SignedObjectSchemaError(`unsupported signed-object schema: ${schema}`);\n}\n\nfunction expectJsonObject(input: unknown, path: string): JsonObject {\n  if (input === null || typeof input !== \"object\" || Array.isArray(input)) {\n    throw new SignedObjectSchemaError(`${path} must be an object`);\n  }\n  return input as JsonObject;\n}\n\nfunction assertExactKeys(object: JsonObject, allowed: readonly string[], path: string): void {\n  const allowedSet = new Set(allowed);\n  for (const key of Object.keys(object)) {\n    if (!allowedSet.has(key)) {\n      throw new SignedObjectSchemaError(`${path} has unknown field ${key}`);\n    }\n  }\n}\n\nfunction requiredValue(object: JsonObject, key: string, path: string): JsonValue {\n  if (!hasOwn(object, key)) {\n    throw new SignedObjectSchemaError(`${path}.${key} is required`);\n  }\n  return object[key];\n}\n\nfunction requiredString(object: JsonObject, key: string, path: string): string {\n  return requireStringType(requiredValue(object, key, path), `${path}.${key}`);\n}\n\nfunction optionalString(object: JsonObject, key: string, path: string): void {\n  if (!hasOwn(object, key)) {\n    return;\n  }\n  requireStringType(requiredValue(object, key, path), `${path}.${key}`);\n}\n\nfunction requireStringType(value: JsonValue, path: string): string {\n  if (typeof value !== \"string\" || value.length === 0) {\n    throw new SignedObjectSchemaError(`${path} must be a non-empty string`);\n  }\n  return value;\n}\n\nfunction optionalBoolean(object: JsonObject, key: string, path: string): void {\n  if (!hasOwn(object, key)) {\n    return;\n  }\n  if (typeof requiredValue(object, key, path) !== \"boolean\") {\n    throw new SignedObjectSchemaError(`${path}.${key} must be a boolean`);\n  }\n}\n\nfunction requiredInteger(\n  object: JsonObject,\n  key: string,\n  path: string,\n  minimum: number,\n): number {\n  const value = requiredValue(object, key, path);\n  if (typeof value !== \"number\" || !Number.isSafeInteger(value) || value < minimum) {\n    throw new SignedObjectSchemaError(\n      `${path}.${key} must be an integer >= ${minimum}`,\n    );\n  }\n  return value;\n}\n\nfunction requiredArray(\n  object: JsonObject,\n  key: string,\n  path: string,\n  minimum: number,\n): readonly JsonValue[] {\n  const value = requiredValue(object, key, path);\n  if (!Array.isArray(value) || value.length < minimum) {\n    throw new SignedObjectSchemaError(\n      `${path}.${key} must be an array with at least ${minimum} item(s)`,\n    );\n  }\n  return value;\n}\n\nfunction requiredStringArray(\n  object: JsonObject,\n  key: string,\n  path: string,\n  check?: (value: string, path: string) => void,\n): void {\n  const values = requiredArray(object, key, path, 0);\n  for (let index = 0; index < values.length; index++) {\n    const itemPath = `${path}.${key}[${index}]`;\n    const value = requireStringType(values[index], itemPath);\n    check?.(value, itemPath);\n  }\n}\n\nfunction requiredDateString(object: JsonObject, key: string, path: string): void {\n  assertRfc3339(requiredString(object, key, path), `${path}.${key}`);\n}\n\nfunction optionalDateString(object: JsonObject, key: string, path: string): void {\n  if (!hasOwn(object, key)) {\n    return;\n  }\n  assertRfc3339(requiredString(object, key, path), `${path}.${key}`);\n}\n\nfunction assertRfc3339(value: string, path: string): void {\n  const match = value.match(\n    /^(\\d{4})-(\\d{2})-(\\d{2})T(\\d{2}):(\\d{2}):(\\d{2})(\\.\\d+)?(Z|[+-]\\d{2}:\\d{2})$/,\n  );\n  if (!match) {\n    throw new SignedObjectSchemaError(`${path} must be strict RFC 3339`);\n  }\n  const parsed = Date.parse(value);\n  if (Number.isNaN(parsed)) {\n    throw new SignedObjectSchemaError(`${path} must be a parseable RFC 3339 timestamp`);\n  }\n  const canonical = new Date(parsed).toISOString().replace(\".000Z\", \"Z\");\n  if (canonical !== value) {\n    throw new SignedObjectSchemaError(`${path} must be a normalizable RFC 3339 timestamp`);\n  }\n}\n\nfunction expectConst<T extends string>(actual: string, expected: T, path: string): T {\n  if (actual !== expected) {\n    throw new SignedObjectSchemaError(`${path} must be ${expected}`);\n  }\n  return expected;\n}\n\nfunction expectOneOf<T extends string>(\n  actual: string,\n  allowed: readonly T[],\n  path: string,\n): T {\n  for (const value of allowed) {\n    if (actual === value) {\n      return value;\n    }\n  }\n  throw new SignedObjectSchemaError(`${path} has unsupported value ${actual}`);\n}\n\nfunction hasOwn(object: JsonObject, key: string): boolean {\n  return objectHasOwn(object, key);\n}\n\nfunction assertSupportedSignatureSuite(suite: string): asserts suite is SignatureSuite {\n  if (suite !== ED25519_JCS_SIGNATURE_SUITE && suite !== EIP191_JCS_SIGNATURE_SUITE) {\n    throw new UnsupportedSignatureSuiteError(`unsupported signature suite: ${suite}`);\n  }\n}\n\nfunction sha256Bytes(bytes: Uint8Array): Uint8Array {\n  return sha256(bytes, \"bytes\");\n}\n\nfunction concatBytes(left: Uint8Array, right: Uint8Array): Uint8Array {\n  const output = new Uint8Array(left.length + right.length);\n  output.set(left, 0);\n  output.set(right, left.length);\n  return output;\n}\n\nfunction base32LowerNoPad(bytes: Uint8Array): string {\n  let output = \"\";\n  let buffer = 0;\n  let bits = 0;\n  for (const byte of bytes) {\n    buffer = (buffer << 8) | byte;\n    bits += 8;\n    while (bits >= 5) {\n      bits -= 5;\n      output += BASE32_ALPHABET[(buffer >> bits) & 31];\n    }\n  }\n  if (bits > 0) {\n    output += BASE32_ALPHABET[(buffer << (5 - bits)) & 31];\n  }\n  return output;\n}\n\nfunction base64UrlEncode(bytes: Uint8Array): string {\n  const alphabet =\n    \"ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789-_\";\n  let output = \"\";\n  for (let index = 0; index < bytes.length; index += 3) {\n    const a = bytes[index];\n    const b = bytes[index + 1];\n    const c = bytes[index + 2];\n    const triplet = (a << 16) | ((b ?? 0) << 8) | (c ?? 0);\n    output += alphabet[(triplet >> 18) & 63];\n    output += alphabet[(triplet >> 12) & 63];\n    if (index + 1 < bytes.length) {\n      output += alphabet[(triplet >> 6) & 63];\n    }\n    if (index + 2 < bytes.length) {\n      output += alphabet[triplet & 63];\n    }\n  }\n  return output;\n}\n\nfunction base64UrlDecode(value: string): Uint8Array {\n  if (value.length % 4 === 1) {\n    throw new SignatureMaterialError(\"signature value is not canonical base64url\");\n  }\n  const alphabet =\n    \"ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789-_\";\n  const bytes: number[] = [];\n  let buffer = 0;\n  let bits = 0;\n  for (const char of value) {\n    const index = alphabet.indexOf(char);\n    if (index < 0) {\n      throw new SignatureMaterialError(\"signature value is not base64url\");\n    }\n    buffer = (buffer << 6) | index;\n    bits += 6;\n    if (bits >= 8) {\n      bits -= 8;\n      bytes.push((buffer >> bits) & 0xff);\n    }\n  }\n  const decoded = Uint8Array.from(bytes);\n  if (base64UrlEncode(decoded) !== value) {\n    throw new SignatureMaterialError(\"signature value is not canonical base64url\");\n  }\n  return decoded;\n}\n\nfunction hexToBytes(value: string): Uint8Array {\n  const hex = value.slice(2);\n  if (hex.length % 2 !== 0 || !/^[0-9a-fA-F]*$/.test(hex)) {\n    throw new SignatureMaterialError(\"hex signature must have even length\");\n  }\n  const output = new Uint8Array(hex.length / 2);\n  for (let index = 0; index < output.length; index++) {\n    output[index] = Number.parseInt(hex.slice(index * 2, index * 2 + 2), 16);\n  }\n  return output;\n}\n","import { ed25519 } from \"@noble/curves/ed25519\";\nimport { base58btc } from \"multiformats/bases/base58\";\nimport { canonicalizeSignedObjectUnsigned as canonicalize } from \"../policy/signed-object.js\";\n\n/** Matches V2_DELIVERY_DOMAIN in tinycloud-node-server/src/share_v2.rs. */\nexport const SHARE_DELIVERY_AUTHORIZATION_DOMAIN = \"xyz.tinycloud.share/delivery-authorization/v2\\0\";\n\n/** Exact camelCase mirror of the Rust `V2DeliveryRequest` wire struct. */\nexport interface ShareDeliveryAuthorizationRequest {\n  readonly envelopeCid: string;\n  readonly shareCid: string;\n  readonly shareId: string;\n  readonly registrationCid: string;\n  readonly policyCid: string;\n  readonly delegationCid: string;\n  readonly enforcementDelegationCid: string;\n  readonly recipientEmail: string;\n  readonly shareUrl: string;\n  readonly documentName: string;\n  readonly jti: string;\n  readonly idempotencyKey: string;\n  readonly expiresAt: string;\n  readonly requestBodyDigest: string;\n}\n\n/** Exact mirror of the `authorization` object the Node route signs and returns. */\nexport interface ShareDeliveryAuthorization {\n  readonly type: \"TinyCloudShareDeliveryAuthorization\";\n  readonly version: 2;\n  readonly jti: string;\n  readonly shareCid: string;\n  readonly shareId: string;\n  readonly registrationCid: string;\n  readonly delegationCid: string;\n  readonly enforcementDelegationCid: string;\n  readonly envelopeCid: string;\n  readonly policyCid: string;\n  readonly nodeAudience: string;\n  readonly targetOrigin: string;\n  /**\n   * The OpenCredentials witness this delivery is scoped to, sourced from\n   * Node's own trusted credentials origin. Deliberately distinct from\n   * `nodeAudience` (the node's own DID) and `returnOrigin` (Share's page\n   * origin) — conflating any of these three would let a party impersonate\n   * another's audience.\n   */\n  readonly openCredentialsAudience: string;\n  readonly holder: string;\n  readonly recipientMatcher: unknown;\n  readonly deliveryEmail: string;\n  readonly shareUrl: string;\n  readonly returnOrigin: string;\n  readonly documentName: string;\n  readonly senderDid: string;\n  readonly senderTrust: string;\n  readonly contentSource: unknown;\n  readonly contentSourceDigest: string;\n  readonly shareExpiresAt: string;\n  readonly issuedAt: string;\n  readonly reportAbuseToken: string;\n  readonly actions: readonly string[];\n  readonly resource: string;\n  readonly authorityMaterialHandle: string;\n  readonly authorityMaterialDigest: string;\n  readonly requestBodyDigest: string;\n  readonly idempotencyKey: string;\n  readonly expiresAt: string;\n  readonly dataAuthority: false;\n}\n\nexport interface ShareDeliveryAuthorizationReceipt {\n  readonly authorization: ShareDeliveryAuthorization;\n  readonly proof: { readonly alg: \"EdDSA\"; readonly kid: string; readonly signature: string };\n}\n\nexport interface ValidateShareDeliveryAuthorizationExpected {\n  readonly request: ShareDeliveryAuthorizationRequest;\n  /** The enrolled receipt key from the node trust bundle. */\n  readonly nodeProof: { readonly kid: string; readonly publicKey: Uint8Array };\n  /**\n   * The OpenCredentials witness origin the caller trusts, from the same\n   * trust bundle as `nodeProof`. Validated independently of the\n   * authorization's own `nodeAudience`/`returnOrigin` fields so a Node that\n   * mislabels or omits its credentials origin fails closed here rather than\n   * silently inheriting one of those unrelated identities.\n   */\n  readonly credentialsAudience: string;\n}\n\n/** Matches `canonical_https_origin` in tinycloud-node-server/src/config.rs. */\nfunction isCanonicalHttpsOrigin(value: string): boolean {\n  let url: URL;\n  try {\n    url = new URL(value);\n  } catch {\n    return false;\n  }\n  return url.protocol === \"https:\"\n    && url.origin === value\n    && url.pathname === \"/\"\n    && url.search === \"\"\n    && url.hash === \"\"\n    && url.username === \"\"\n    && url.password === \"\";\n}\n\nconst AUTHORIZATION_KEYS = [\n  \"type\", \"version\", \"jti\", \"shareCid\", \"shareId\", \"registrationCid\", \"delegationCid\",\n  \"enforcementDelegationCid\", \"envelopeCid\", \"policyCid\", \"nodeAudience\", \"targetOrigin\",\n  \"openCredentialsAudience\",\n  \"holder\", \"recipientMatcher\", \"deliveryEmail\", \"shareUrl\", \"returnOrigin\", \"documentName\",\n  \"senderDid\", \"senderTrust\", \"contentSource\", \"contentSourceDigest\", \"shareExpiresAt\",\n  \"issuedAt\", \"reportAbuseToken\", \"actions\", \"resource\", \"authorityMaterialHandle\",\n  \"authorityMaterialDigest\", \"requestBodyDigest\", \"idempotencyKey\", \"expiresAt\", \"dataAuthority\",\n] as const;\n\nfunction assertObject(value: unknown, keys: readonly string[], label: string): Record<string, unknown> {\n  if (typeof value !== \"object\" || value === null || Array.isArray(value)) throw new Error(`${label} is invalid`);\n  const record = value as Record<string, unknown>;\n  if (Object.keys(record).length !== keys.length || keys.some((key) => !Object.prototype.hasOwnProperty.call(record, key))) throw new Error(`${label} has unknown or missing fields`);\n  return record;\n}\n\nfunction fromB64(value: string): Uint8Array {\n  if (!/^[A-Za-z0-9_-]+$/.test(value)) throw new Error(\"share delivery value is not canonical base64url\");\n  if (typeof atob === \"function\") {\n    const padded = value.replace(/-/g, \"+\").replace(/_/g, \"/\") + \"=\".repeat((4 - value.length % 4) % 4);\n    return Uint8Array.from(atob(padded), (character) => character.charCodeAt(0));\n  }\n  if (typeof Buffer !== \"undefined\") return new Uint8Array(Buffer.from(value, \"base64url\"));\n  throw new Error(\"base64url decoding is unavailable\");\n}\n\n/**\n * Validate the exact UTF-8 response bytes emitted by\n * `POST /share/v2/deliveries/authorize`, bind them to the submitted\n * request, and verify the Node's detached EdDSA proof.\n */\nexport function validateShareDeliveryAuthorizationBytes(bytesValue: Uint8Array, expected: ValidateShareDeliveryAuthorizationExpected): ShareDeliveryAuthorizationReceipt {\n  let value: unknown;\n  try {\n    value = JSON.parse(new TextDecoder(\"utf-8\", { fatal: true }).decode(bytesValue));\n  } catch {\n    throw new Error(\"share delivery authorization response is not valid UTF-8 JSON\");\n  }\n  const root = assertObject(value, [\"authorization\", \"proof\"], \"share delivery authorization response\");\n  const authorization = assertObject(root.authorization, AUTHORIZATION_KEYS, \"share delivery authorization\");\n  const proof = assertObject(root.proof, [\"alg\", \"kid\", \"signature\"], \"share delivery authorization proof\");\n\n  const request = expected.request;\n  if (\n    authorization.type !== \"TinyCloudShareDeliveryAuthorization\"\n    || authorization.version !== 2\n    || authorization.dataAuthority !== false\n    || authorization.jti !== request.jti\n    || authorization.shareCid !== request.shareCid\n    || authorization.shareId !== request.shareId\n    || authorization.registrationCid !== request.registrationCid\n    || authorization.delegationCid !== request.delegationCid\n    || authorization.enforcementDelegationCid !== request.enforcementDelegationCid\n    || authorization.envelopeCid !== request.envelopeCid\n    || authorization.policyCid !== request.policyCid\n    || authorization.deliveryEmail !== request.recipientEmail\n    || authorization.shareUrl !== request.shareUrl\n    || authorization.documentName !== request.documentName\n    || authorization.requestBodyDigest !== request.requestBodyDigest\n    || authorization.expiresAt !== request.expiresAt\n    || authorization.idempotencyKey !== request.idempotencyKey\n    || authorization.reportAbuseToken !== request.jti\n    || authorization.authorityMaterialHandle !== request.registrationCid\n  ) {\n    throw new Error(\"share delivery authorization is not bound to the submitted request\");\n  }\n  if (typeof authorization.issuedAt !== \"string\" || Date.parse(authorization.issuedAt) > Date.now() + 60_000) throw new Error(\"share delivery authorization issuedAt is invalid\");\n  if (new Date(authorization.expiresAt as string).toISOString() !== authorization.expiresAt) throw new Error(\"share delivery authorization expiresAt is non-canonical\");\n\n  // Independent audience check: the OpenCredentials witness field must be a\n  // canonical https origin, must equal the caller's own trusted value (never\n  // derived from the response), and must not collapse into the node's own\n  // audience or Share's return origin.\n  if (\n    typeof authorization.openCredentialsAudience !== \"string\"\n    || !isCanonicalHttpsOrigin(authorization.openCredentialsAudience)\n    || authorization.openCredentialsAudience !== expected.credentialsAudience\n    || authorization.openCredentialsAudience === authorization.nodeAudience\n    || authorization.openCredentialsAudience === authorization.returnOrigin\n  ) {\n    throw new Error(\"share delivery authorization openCredentialsAudience is missing or untrusted\");\n  }\n\n  if (proof.alg !== \"EdDSA\" || typeof proof.kid !== \"string\" || typeof proof.signature !== \"string\") throw new Error(\"share delivery authorization proof is invalid\");\n  if (proof.kid !== expected.nodeProof.kid) throw new Error(\"share delivery authorization proof key is not trusted\");\n  const encodedKid = expected.nodeProof.publicKey;\n  const publicKey = encodedKid.length === 34 && encodedKid[0] === 0xed && encodedKid[1] === 0x01 ? encodedKid.slice(2) : encodedKid;\n  if (publicKey.length !== 32) throw new Error(\"share delivery authorization proof key is invalid\");\n  const signatureBytes = fromB64(proof.signature);\n  const signedBytes = new TextEncoder().encode(`${SHARE_DELIVERY_AUTHORIZATION_DOMAIN}${canonicalize(authorization)}`);\n  if (signatureBytes.length !== 64 || !ed25519.verify(signatureBytes, signedBytes, publicKey)) throw new Error(\"share delivery authorization proof signature is invalid\");\n\n  return { authorization: authorization as unknown as ShareDeliveryAuthorization, proof: proof as unknown as ShareDeliveryAuthorizationReceipt[\"proof\"] };\n}\n\n/** Build the trusted-signer descriptor `did:key:...#z...` expects from a raw node signing key. */\nexport function shareDeliveryTrustedKid(publicKey: Uint8Array): string {\n  if (publicKey.length !== 32) throw new Error(\"share delivery node key must be a raw 32-byte Ed25519 public key\");\n  const prefixed = new Uint8Array(34);\n  prefixed.set([0xed, 0x01]);\n  prefixed.set(publicKey, 2);\n  const did = `did:key:${base58btc.encode(prefixed)}`;\n  return `${did}#${did.slice(\"did:key:\".length)}`;\n}\n","import type { DelegatedShareKey, OwnerShareAction, OwnerShareMatcher, OwnerSharePolicyRegistrationReceipt } from \"./owner-policy\";\nimport { restoreDelegatedShareKey } from \"./owner-policy\";\n\n/**\n * The durable record a sender needs, after a reload, to display and manage\n * a share it created. Every identity/CID here comes verbatim from the\n * Node-verified {@link OwnerSharePolicyRegistrationReceipt}; nothing is\n * re-derived or guessed.\n */\nexport interface SenderShareRecord {\n  readonly shareId: string;\n  readonly registrationCid: string;\n  readonly policyCid: string;\n  readonly ownerDelegationCid: string;\n  readonly enforcementDelegationCid: string;\n  readonly shareKeyDid: string;\n  readonly ownerDid: string;\n  readonly enforcerDid: string;\n  readonly target: { readonly origin: string; readonly nodeAudience: string; readonly spaceId: string };\n  readonly resource: { readonly kind: \"exact\" | \"prefix\"; readonly path: string };\n  readonly actions: readonly OwnerShareAction[];\n  readonly recipientMatcher: OwnerShareMatcher;\n  readonly registeredAt: string;\n  readonly expiresAt: string;\n  readonly revokedAt?: string;\n}\n\n/**\n * \"direct\" revokes only this share's enforcement delegation. \"ancestor\"\n * revokes the owner delegation the share descends from, which transitively\n * denies every share built on it (see `revocation_in_ancestry` in\n * `tinycloud-node-server/src/share_v2.rs`). Both are existing CIDs that a\n * caller passes to the node's generic `tinycloud.delegation/revoke`\n * invocation (`DelegationManager.revoke` / `TinyCloudNode.revokeDelegation`)\n * -- there is no share-v2-specific revoke route.\n */\nexport type SenderShareRevocationScope = \"direct\" | \"ancestor\";\n\nexport interface SenderShareRecordStorage {\n  put(record: SenderShareRecord): Promise<void>;\n  list(): Promise<readonly SenderShareRecord[]>;\n  get(shareId: string): Promise<SenderShareRecord | undefined>;\n  delete(shareId: string): Promise<void>;\n}\n\nexport interface StoredSenderShareKey {\n  readonly cryptoKey: CryptoKey;\n  readonly publicKey: Uint8Array;\n  readonly extractable: boolean;\n}\n\nexport interface SenderShareKeyStorage {\n  put(shareId: string, key: StoredSenderShareKey): Promise<void>;\n  get(shareId: string): Promise<StoredSenderShareKey | undefined>;\n  delete(shareId: string): Promise<void>;\n}\n\n/** In-memory reference implementation. Real deployments back these with IndexedDB so the non-extractable `CryptoKey` survives a reload via structured clone. */\nexport class MemorySenderShareRecordStorage implements SenderShareRecordStorage {\n  private readonly records = new Map<string, SenderShareRecord>();\n\n  async put(record: SenderShareRecord): Promise<void> {\n    this.records.set(record.shareId, record);\n  }\n\n  async list(): Promise<readonly SenderShareRecord[]> {\n    return [...this.records.values()];\n  }\n\n  async get(shareId: string): Promise<SenderShareRecord | undefined> {\n    return this.records.get(shareId);\n  }\n\n  async delete(shareId: string): Promise<void> {\n    this.records.delete(shareId);\n  }\n}\n\nexport class MemorySenderShareKeyStorage implements SenderShareKeyStorage {\n  private readonly keys = new Map<string, StoredSenderShareKey>();\n\n  async put(shareId: string, key: StoredSenderShareKey): Promise<void> {\n    this.keys.set(shareId, key);\n  }\n\n  async get(shareId: string): Promise<StoredSenderShareKey | undefined> {\n    return this.keys.get(shareId);\n  }\n\n  async delete(shareId: string): Promise<void> {\n    this.keys.delete(shareId);\n  }\n}\n\nexport interface SenderShareStoreOptions {\n  readonly records: SenderShareRecordStorage;\n  readonly keys: SenderShareKeyStorage;\n  readonly now?: () => Date;\n}\n\n/**\n * Reload-safe sender-side management for shares created through\n * {@link canonicalOwnerSharePolicy} / `registerOwnerSharePolicy`. Persists\n * the registration receipt's canonical identity tuple plus the ephemeral\n * share key's non-extractable `CryptoKey` handle, so a sender can list,\n * inspect, and revoke shares it created in an earlier session -- without\n * ever re-exporting private key material.\n */\nexport class SenderShareStore {\n  private readonly records: SenderShareRecordStorage;\n  private readonly keys: SenderShareKeyStorage;\n  private readonly now: () => Date;\n\n  constructor(options: SenderShareStoreOptions) {\n    this.records = options.records;\n    this.keys = options.keys;\n    this.now = options.now ?? (() => new Date());\n  }\n\n  /** Persist a Node-verified registration receipt and its share key handle. */\n  async save(receipt: OwnerSharePolicyRegistrationReceipt, key: DelegatedShareKey): Promise<SenderShareRecord> {\n    const registration = receipt.registration;\n    if (registration.shareKeyDid !== key.did) throw new Error(\"share key does not match the registered receipt\");\n    const record: SenderShareRecord = {\n      shareId: registration.shareId,\n      registrationCid: registration.registrationCid,\n      policyCid: registration.policyCid,\n      ownerDelegationCid: registration.ownerDelegationCid,\n      enforcementDelegationCid: registration.enforcementDelegationCid,\n      shareKeyDid: registration.shareKeyDid,\n      ownerDid: registration.ownerDid,\n      enforcerDid: registration.enforcerDid,\n      target: registration.target,\n      resource: registration.resource,\n      actions: registration.actions,\n      recipientMatcher: registration.recipientMatcher,\n      registeredAt: registration.registeredAt,\n      expiresAt: registration.expiresAt,\n    };\n    await this.records.put(record);\n    await this.keys.put(record.shareId, { cryptoKey: key.cryptoKey, publicKey: key.publicKey, extractable: key.extractable });\n    return record;\n  }\n\n  /** List shares created in any session, most recent first. */\n  async list(options?: { readonly includeRevoked?: boolean; readonly includeExpired?: boolean }): Promise<readonly SenderShareRecord[]> {\n    const now = this.now().getTime();\n    const records = await this.records.list();\n    return records\n      .filter((record) => (options?.includeRevoked ?? false) || record.revokedAt === undefined)\n      .filter((record) => (options?.includeExpired ?? false) || Date.parse(record.expiresAt) > now)\n      .sort((left, right) => Date.parse(right.registeredAt) - Date.parse(left.registeredAt));\n  }\n\n  async get(shareId: string): Promise<SenderShareRecord | undefined> {\n    return this.records.get(shareId);\n  }\n\n  /** Recover a signer for the persisted share key after a reload. */\n  async loadKey(shareId: string): Promise<DelegatedShareKey | undefined> {\n    const stored = await this.keys.get(shareId);\n    if (stored === undefined) return undefined;\n    return restoreDelegatedShareKey({\n      privateKey: stored.cryptoKey,\n      publicKey: stored.publicKey,\n      extractable: stored.extractable,\n    });\n  }\n\n  /**\n   * The delegation CID to pass to the node's existing generic\n   * `tinycloud.delegation/revoke` invocation to revoke this share at the\n   * requested scope. Does not itself call the node -- callers invoke\n   * their own `revokeDelegation`/`DelegationManager.revoke` with the\n   * returned CID, then call {@link markRevoked} once that succeeds.\n   */\n  async revocationTarget(shareId: string, scope: SenderShareRevocationScope): Promise<string> {\n    const record = await this.records.get(shareId);\n    if (record === undefined) throw new Error(`Unknown share: ${shareId}`);\n    return scope === \"direct\" ? record.enforcementDelegationCid : record.ownerDelegationCid;\n  }\n\n  /** Mark a share revoked locally after the caller's node-side revoke call succeeds. */\n  async markRevoked(shareId: string, revokedAt: string = this.now().toISOString()): Promise<SenderShareRecord> {\n    const record = await this.records.get(shareId);\n    if (record === undefined) throw new Error(`Unknown share: ${shareId}`);\n    const revoked: SenderShareRecord = { ...record, revokedAt };\n    await this.records.put(revoked);\n    return revoked;\n  }\n\n  /** Forget a share and clear its persisted key handle. */\n  async remove(shareId: string): Promise<void> {\n    await this.records.delete(shareId);\n    await this.keys.delete(shareId);\n  }\n}\n"],"mappings":";;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;;;ACSA,iBAAkB;AAyCX,IAAM,YAAY,aAAE,OAAO;AAAA;AAAA,EAEhC,KAAK,aAAE,OAAO;AAAA;AAAA,EAEd,KAAK,aAAE,OAAO,EAAE,SAAS;AAAA;AAAA,EAEzB,GAAG,aAAE,OAAO,EAAE,SAAS;AAAA;AAAA,EAEvB,GAAG,aAAE,OAAO,EAAE,SAAS;AAAA;AAAA,EAEvB,GAAG,aAAE,OAAO,EAAE,SAAS;AAAA;AAAA,EAEvB,GAAG,aAAE,OAAO,EAAE,SAAS;AAAA;AAAA,EAEvB,GAAG,aAAE,OAAO,EAAE,SAAS;AAAA;AAAA,EAEvB,KAAK,aAAE,OAAO,EAAE,SAAS;AAAA;AAAA,EAEzB,KAAK,aAAE,OAAO,EAAE,SAAS;AAAA;AAAA,EAEzB,KAAK,aAAE,OAAO,EAAE,SAAS;AAAA;AAAA,EAEzB,SAAS,aAAE,MAAM,aAAE,OAAO,CAAC,EAAE,SAAS;AACxC,CAAC;AAWM,IAAM,gBAAgB,aAAE,KAAK,CAAC,QAAQ,WAAW,UAAU,CAAC;AAM5D,IAAM,gBAAgB,aAAE,OAAO;AAAA;AAAA,EAEpC,IAAI,aAAE,OAAO;AAAA;AAAA,EAEb,KAAK,aAAE,OAAO;AAAA;AAAA,EAEd,MAAM;AAAA;AAAA,EAEN,KAAK,UAAU,SAAS;AAAA;AAAA,EAExB,UAAU,aAAE,OAAO;AACrB,CAAC;AAWM,IAAM,wBAAwB,aAAE,OAAO;AAAA;AAAA,EAE5C,MAAM,aAAE,OAAO;AAAA;AAAA,EAEf,SAAS,aAAE,OAAO;AAAA;AAAA,EAElB,SAAS,aAAE,QAAQ,YAAY;AAAA;AAAA,EAE/B,OAAO,aAAE,WAAW,KAAK,EAAE,SAAS;AAAA;AAAA,EAEpC,MAAM,aAAE,OAAO,aAAE,OAAO,GAAG,aAAE,QAAQ,CAAC,EAAE,SAAS;AACnD,CAAC;AAOM,IAAM,uBAAuB;AAAA,EAClC,eAAe;AAAA,EACf,cAAc;AAAA,EACd,iBAAiB;AAAA,EACjB,WAAW;AAAA,EACX,SAAS;AAAA,EACT,eAAe;AAAA,EACf,SAAS;AAAA,EACT,SAAS;AAAA,EACT,eAAe;AAAA,EACf,mBAAmB;AAAA,EACnB,iBAAiB;AAAA,EACjB,mBAAmB;AAAA,EACnB,eAAe;AAAA,EACf,wBAAwB;AAAA,EACxB,mBAAmB;AAAA,EACnB,kBAAkB;AACpB;AAYO,IAAM,mBAAmB,aAAE,OAAO;AAAA;AAAA,EAEvC,KAAK,aAAE,OAAO;AAAA;AAAA,EAEd,aAAa,aAAE,OAAO;AAAA;AAAA,EAEtB,SAAS,aAAE,OAAO;AAAA;AAAA,EAElB,MAAM,aAAE,OAAO;AAAA;AAAA,EAEf,SAAS,aAAE,MAAM,aAAE,OAAO,CAAC;AAAA;AAAA,EAE3B,SAAS,aAAE,MAAM,aAAE,OAAO,aAAE,OAAO,GAAG,aAAE,QAAQ,CAAC,CAAC,EAAE,SAAS;AAAA;AAAA,EAE7D,QAAQ,aAAE,OAAO,KAAK;AAAA;AAAA,EAEtB,WAAW,aAAE,QAAQ;AAAA;AAAA,EAErB,cAAc,aAAE,OAAO,EAAE,SAAS;AAAA;AAAA,EAElC,WAAW,aAAE,OAAO,KAAK,EAAE,SAAS;AAAA;AAAA,EAEpC,WAAW,aAAE,OAAO,EAAE,SAAS;AAAA;AAAA,EAE/B,oBAAoB,aAAE,QAAQ,EAAE,SAAS;AAAA;AAAA,EAEzC,YAAY,aAAE,OAAO,EAAE,SAAS;AAClC,CAAC;AAKM,IAAM,yBAAyB,aAAE,OAAO;AAAA,EAC7C,KAAK,aAAE,OAAO,EAAE,IAAI,CAAC;AAAA,EACrB,QAAQ,aAAE,KAAK,CAAC,UAAU,WAAW,WAAW,eAAe,WAAW,CAAC;AAAA,EAC3E,QAAQ,aAAE,QAAQ;AAAA,EAClB,QAAQ,aAAE,QAAQ;AAAA,EAClB,SAAS,aAAE,QAAQ;AAAA,EACnB,SAAS,aAAE,QAAQ;AACrB,CAAC,EAAE,OAAO,EAAE,YAAY,CAAC,OAAO,YAAY;AAC1C,QAAM,QAAQ,MAAM,WAAW,WAC3B,MAAM,UAAU,MAAM,UAAU,CAAC,MAAM,WAAW,CAAC,MAAM,UACzD,MAAM,WAAW,YACf,MAAM,UAAU,CAAC,MAAM,UAAU,MAAM,WAAW,CAAC,MAAM,UACzD,MAAM,WAAW,YACf,MAAM,UAAU,CAAC,MAAM,UAAU,CAAC,MAAM,WAAW,MAAM,UACzD,MAAM,WAAW,gBACf,MAAM,UAAU,CAAC,MAAM,UAAU,CAAC,MAAM,WAAW,CAAC,MAAM,UAC1D,CAAC,MAAM,UAAU,CAAC,MAAM,UAAU,CAAC,MAAM,WAAW,CAAC,MAAM;AACrE,MAAI,CAAC,OAAO;AACV,YAAQ,SAAS;AAAA,MACf,MAAM,aAAE,aAAa;AAAA,MACrB,SAAS;AAAA,IACX,CAAC;AAAA,EACH;AACF,CAAC;AAIM,IAAM,oCAAoC,aAAE,OAAO;AAAA,EACxD,SAAS,aAAE,QAAQ,IAAI;AAAA,EACvB,KAAK,aAAE,OAAO,EAAE,IAAI,CAAC;AACvB,CAAC,EAAE,OAAO;AAIH,IAAM,kCAAkC,aAAE,OAAO;AAAA,EACtD,UAAU,aAAE,OAAO,EAAE,IAAI,CAAC;AAAA,EAC1B,SAAS,aAAE,MAAM,aAAE,OAAO,CAAC;AAAA,EAC3B,SAAS,aAAE,MAAM,aAAE,OAAO,aAAE,OAAO,GAAG,aAAE,QAAQ,CAAC,CAAC;AACpD,CAAC,EAAE,OAAO;AAEV,IAAM,8BAA8B,aACjC,OAAO,EACP,SAAS,EAAE,QAAQ,KAAK,CAAC,EACzB,UAAU,CAAC,UAAU,IAAI,KAAK,KAAK,CAAC;AAEhC,IAAM,gCAAgC,aAAE,OAAO;AAAA,EACpD,KAAK,aAAE,OAAO,EAAE,IAAI,CAAC;AAAA,EACrB,WAAW,aAAE,KAAK,CAAC,WAAW,UAAU,CAAC;AAAA,EACzC,cAAc,aAAE,OAAO,EAAE,IAAI,CAAC;AAAA,EAC9B,aAAa,aAAE,OAAO,EAAE,IAAI,CAAC;AAAA,EAC7B,WAAW,aAAE,MAAM,+BAA+B;AAAA,EAClD,SAAS,aAAE,MAAM,aAAE,OAAO,CAAC;AAAA,EAC3B,UAAU,4BAA4B,SAAS;AAAA,EAC/C,WAAW,4BAA4B,SAAS;AAAA,EAChD,WAAW,4BAA4B,SAAS;AAAA,EAChD,QAAQ,aAAE,KAAK,CAAC,UAAU,WAAW,WAAW,WAAW,kBAAkB,CAAC;AAAA,EAC9E,WAAW,4BAA4B,SAAS,EAAE,SAAS;AAAA,EAC3D,WAAW,aAAE,OAAO,EAAE,SAAS;AAAA,EAC/B,oBAAoB,aAAE,OAAO,EAAE,SAAS;AAC1C,CAAC,EAAE,OAAO;AAEH,IAAM,8BAA8B,aAAE,OAAO;AAAA,EAClD,eAAe,aAAE,QAAQ,CAAC;AAAA,EAC1B,OAAO,aAAE,MAAM,6BAA6B;AAAA,EAC5C,YAAY,aAAE,OAAO,EAAE,SAAS;AAClC,CAAC,EAAE,OAAO;AAMH,IAAM,sCAAsC,aAAE,OAAO;AAAA,EAC1D,WAAW,aAAE,KAAK,CAAC,WAAW,YAAY,KAAK,CAAC,EAAE,SAAS;AAAA,EAC3D,QAAQ,aAAE,KAAK,CAAC,UAAU,WAAW,WAAW,WAAW,kBAAkB,CAAC,EAAE,SAAS;AAAA,EACzF,OAAO,aAAE,OAAO,EAAE,KAAK,EAAE,IAAI,CAAC,EAAE,SAAS;AAAA,EACzC,OAAO,aAAE,OAAO,EAAE,IAAI,EAAE,IAAI,CAAC,EAAE,IAAI,GAAG,EAAE,SAAS;AAAA,EACjD,QAAQ,aAAE,OAAO,EAAE,IAAI,CAAC,EAAE,SAAS;AACrC,CAAC,EAAE,OAAO;AAOH,IAAM,wBAAwB,aAAE,OAAO;AAAA;AAAA,EAE5C,UAAU,aAAE,OAAO;AAAA;AAAA,EAEnB,QAAQ,aAAE,OAAO;AAAA;AAAA,EAEjB,MAAM,aAAE,MAAM,aAAa;AAAA;AAAA,EAE3B,YAAY;AAAA;AAAA,EAEZ,WAAW,aAAE,OAAO,KAAK,EAAE,SAAS;AACtC,CAAC;AAOM,IAAM,yBAAyB,aAAE,OAAO;AAAA;AAAA,EAE7C,KAAK,aAAE,OAAO;AAAA;AAAA,EAEd,SAAS,aAAE,OAAO;AAAA;AAAA,EAElB,WAAW,aAAE,OAAO;AAAA;AAAA,EAEpB,WAAW,aAAE,OAAO;AAAA;AAAA,EAEpB,OAAO,aAAE,OAAO,EAAE,SAAS;AAAA;AAAA,EAE3B,MAAM,aAAE,OAAO;AAAA;AAAA,EAEf,SAAS,aAAE,MAAM,aAAE,OAAO,CAAC;AAAA;AAAA,EAE3B,QAAQ,aAAE,OAAO,KAAK,EAAE,SAAS;AAAA;AAAA,EAEjC,WAAW,aAAE,OAAO,KAAK,EAAE,SAAS;AAAA;AAAA,EAEpC,WAAW,aAAE,QAAQ;AAAA;AAAA,EAErB,WAAW,aAAE,OAAO,KAAK;AAAA;AAAA,EAEzB,WAAW,aAAE,OAAO,EAAE,SAAS;AACjC,CAAC;AAOM,IAAM,+BAA+B,aAAE,OAAO;AAAA;AAAA,EAEnD,aAAa,aAAE,OAAO;AAAA;AAAA,EAEtB,MAAM,aAAE,OAAO;AAAA;AAAA,EAEf,SAAS,aAAE,MAAM,aAAE,OAAO,CAAC;AAAA;AAAA,EAE3B,QAAQ,aAAE,OAAO,KAAK,EAAE,SAAS;AAAA;AAAA,EAEjC,sBAAsB,aAAE,QAAQ,EAAE,SAAS;AAAA;AAAA,EAE3C,WAAW,aAAE,OAAO,EAAE,SAAS;AACjC,CAAC;AAOM,IAAM,wBAAwB,aAAE,MAAM,gBAAgB;AAMtD,IAAM,0BAA0B,aAAE,OAAO;AAAA;AAAA,EAE9C,MAAM;AAAA;AAAA,EAEN,OAAO,aAAE,MAAM,gBAAgB;AAAA;AAAA,EAE/B,MAAM;AACR,CAAC;AAWM,IAAM,4BAA4B,aAAE,KAAK,CAAC,WAAW,YAAY,KAAK,CAAC;AAMvE,IAAM,0BAA0B,aAAE,OAAO;AAAA;AAAA,EAE9C,WAAW,0BAA0B,SAAS;AAAA;AAAA,EAE9C,MAAM,aAAE,OAAO,EAAE,SAAS;AAAA;AAAA,EAE1B,SAAS,aAAE,MAAM,aAAE,OAAO,CAAC,EAAE,SAAS;AAAA;AAAA,EAEtC,gBAAgB,aAAE,QAAQ,EAAE,SAAS;AAAA;AAAA,EAErC,WAAW,aAAE,OAAO,EAAE,SAAS;AAAA;AAAA,EAE/B,WAAW,aAAE,OAAO,EAAE,SAAS;AAAA;AAAA,EAE/B,SAAS,aAAE,OAAO,KAAK,EAAE,SAAS;AAAA;AAAA,EAElC,OAAO,aAAE,OAAO,EAAE,SAAS;AAAA;AAAA,EAE3B,QAAQ,aAAE,OAAO,EAAE,SAAS;AAC9B,CAAC;AAWM,IAAM,uBAAuB,aAAE,KAAK,CAAC,SAAS,WAAW,CAAC;AAM1D,IAAM,kBAAkB,aAAE,OAAO;AAAA;AAAA,EAEtC,IAAI,aAAE,OAAO;AAAA;AAAA,EAEb,MAAM,aAAE,OAAO,EAAE,SAAS;AAAA;AAAA,EAE1B,OAAO,aAAE,OAAO;AAAA;AAAA,EAEhB,MAAM;AAAA;AAAA,EAEN,aAAa,aAAE,MAAM,aAAE,OAAO,CAAC,EAAE,SAAS;AAAA;AAAA,EAE1C,WAAW,aAAE,OAAO,KAAK,EAAE,SAAS;AACtC,CAAC;AAWM,IAAM,oBAAoB,aAAE,KAAK,CAAC,UAAU,WAAW,MAAM,CAAC;AAM9D,IAAM,kBAAkB,aAAE,OAAO;AAAA;AAAA,EAEtC,OAAO,aAAE,OAAO;AAAA;AAAA,EAEhB,KAAK,aAAE,OAAO;AAAA;AAAA,EAEd,YAAY;AAAA;AAAA,EAEZ,QAAQ;AAAA;AAAA,EAER,WAAW,aAAE,OAAO,KAAK,EAAE,SAAS;AAAA;AAAA,EAEpC,aAAa,aAAE,OAAO,EAAE,SAAS;AACnC,CAAC;AAOM,SAAS,0BAAkD,YAAe;AAC/E,SAAO,aAAE,OAAO;AAAA;AAAA,IAEd,MAAM;AAAA;AAAA,IAEN,YAAY;AAAA;AAAA,IAEZ,SAAS,aAAE,OAAO;AAAA;AAAA,IAElB,MAAM,aAAE,OAAO;AAAA,EACjB,CAAC;AACH;AAEO,IAAM,sBAAsB,0BAA0B,aAAE,QAAQ,CAAC;AAejE,IAAM,sBAAsB,aAAE,OAAO;AAAA;AAAA,EAE1C,SAAS,aAAE,QAAQ,EAAE,SAAS;AAAA;AAAA,EAE9B,eAAe,aAAE,QAAQ,EAAE,SAAS;AAAA;AAAA,EAEpC,SAAS,aAAE,OAAO,EAAE,SAAS;AAAA;AAAA,EAE7B,kBAAkB,aAAE,QAAQ,EAAE,SAAS;AAAA;AAAA,EAEvC,UAAU,aAAE,OAAO,EAAE,SAAS;AAChC,CAAC;AAWM,IAAM,4BAA4B,aAAE,OAAO;AAAA;AAAA,EAEhD,MAAM,aAAE,OAAO;AAAA;AAAA,EAEf,SAAS,aAAE,MAAM,aAAE,OAAO,CAAC,EAAE,SAAS;AAAA;AAAA,EAEtC,QAAQ,aAAE,OAAO,KAAK,EAAE,SAAS;AAAA;AAAA,EAEjC,QAAQ,kBAAkB,SAAS;AAAA;AAAA,EAEnC,aAAa,aAAE,OAAO,EAAE,SAAS;AAAA;AAAA,EAEjC,SAAS,aAAE,OAAO,EAAE,SAAS;AAC/B,CAAC;AAeM,IAAM,gCAAgC,aAAE,OAAO;AAAA;AAAA,EAEpD,OAAO,aAAE,MAAM,aAAE,OAAO,CAAC;AAAA;AAAA,EAEzB,gBAAgB,aAAE,OAAO,EAAE,IAAI,CAAC,EAAE,SAAS;AAAA;AAAA,EAE3C,SAAS,aAAE,QAAQ,EAAE;AAAA,IACnB,CAAC,QAA+B,QAAQ,QAAQ,OAAO,QAAQ;AAAA,IAC/D,EAAE,SAAS,mCAAmC;AAAA,EAChD;AAAA;AAAA,EAEA,QAAQ,aAAE,QAAQ,EAAE;AAAA,IAClB,CAAC,QAA+B,OAAO,QAAQ;AAAA,IAC/C,EAAE,SAAS,8BAA8B;AAAA,EAC3C;AAAA;AAAA,EAEA,WAAW,aAAE,QAAQ,EAAE;AAAA,IACrB,CAAC,QAAkC,QAAQ,UAAa,OAAO,QAAQ;AAAA,IACvE,EAAE,SAAS,8CAA8C;AAAA,EAC3D,EAAE,SAAS;AAAA;AAAA,EAEX,OAAO,aAAE,QAAQ,EAAE;AAAA,IACjB,CAAC,QAA8B,QAAQ,UAAa,OAAO,QAAQ;AAAA,IACnE,EAAE,SAAS,yCAAyC;AAAA,EACtD,EAAE,SAAS;AACb,CAAC;AAOM,IAAM,oBAAoB,aAAE,OAAO;AAAA;AAAA,EAExC,kBAAkB,aAAE,QAAQ,EAAE;AAAA,IAC5B,CAAC,QAAkD,OAAO,QAAQ;AAAA,IAClE,EAAE,SAAS,sBAAsB;AAAA,EACnC;AAAA;AAAA,EAEA,QAAQ,aAAE,QAAQ,EAAE;AAAA,IAClB,CAAC,QAA0C,OAAO,QAAQ;AAAA,IAC1D,EAAE,SAAS,sBAAsB;AAAA,EACnC;AAAA;AAAA,EAEA,QAAQ,aAAE,QAAQ,EAAE;AAAA,IAClB,CAAC,QAAmD,OAAO,QAAQ;AAAA,IACnE,EAAE,SAAS,sBAAsB;AAAA,EACnC;AACF,CAAC;AAWM,IAAM,8BAA8B,aAAE,OAAO;AAAA;AAAA,EAElD,MAAM,aAAE,OAAO;AAAA;AAAA,EAEf,WAAW,aAAE,OAAO;AAAA;AAAA,EAEpB,SAAS,aAAE,OAAO;AAAA;AAAA,EAElB,KAAK,aAAE,OAAO,EAAE,SAAS;AAC3B,CAAC;AAqBM,IAAM,0BAA0B,aAAE,OAAO;AAAA;AAAA,EAE9C,SAAS,aAAE,OAAO;AAAA;AAAA,EAElB,OAAO,aAAE,OAAO;AAAA;AAAA,EAEhB,MAAM,aAAE,OAAO;AAAA;AAAA,EAEf,SAAS,aAAE,MAAM,aAAE,OAAO,CAAC;AAAA;AAAA,EAE3B,SAAS,aAAE,MAAM,aAAE,OAAO,aAAE,OAAO,GAAG,aAAE,QAAQ,CAAC,CAAC,EAAE,SAAS;AAC/D,CAAC;AAgBM,IAAM,mCAAmC,aAAE,OAAO;AAAA;AAAA,EAEvD,SAAS,aAAE,QAAQ,EAAE;AAAA,IACnB,CAAC,QAA+B,QAAQ,QAAQ,OAAO,QAAQ;AAAA,IAC/D,EAAE,SAAS,mCAAmC;AAAA,EAChD;AAAA;AAAA,EAEA,aAAa,aAAE,OAAO;AAAA;AAAA,EAEtB,SAAS,aAAE,OAAO;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAiBlB,WAAW,aAAE,OAAO,aAAE,OAAO,GAAG,aAAE,OAAO,aAAE,OAAO,GAAG,aAAE,MAAM,aAAE,OAAO,CAAC,CAAC,CAAC;AAAA;AAAA,EAEzE,gBAAgB,aAAE,OAAO;AAAA;AAAA,EAEzB,eAAe,aAAE,OAAO,EAAE,SAAS;AACrC,CAAC;AAYM,IAAM,mCAAmC,aAAE,OAAO;AAAA;AAAA,EAEvD,YAAY,aAAE,OAAO;AAAA;AAAA,EAErB,KAAK,aAAE,OAAO;AAAA;AAAA,EAEd,aAAa,aAAE,OAAO;AAAA;AAAA,EAEtB,QAAQ,aAAE,OAAO,KAAK;AAAA;AAAA;AAAA;AAAA;AAAA,EAKtB,WAAW,aAAE,MAAM,uBAAuB;AAC5C,CAAC;;;AC9qBD,IAAM,eAAe,KAAK,KAAK;AAS/B,IAAM,qBAAqB,IAAI,KAAK;AAUpC,IAAM,aAAa,IAAI,KAAK,KAAK,KAAK;AAUtC,IAAM,WAAW,IAAI,KAAK,KAAK,KAAK;AASpC,IAAM,SAAS,KAAK,KAAK,KAAK,KAAK;AASnC,IAAM,SAAS,KAAK,MAAM,KAAK,KAAK,KAAK;AAElC,IAAM,SAAS;AAAA,EACpB;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AACF;AAEO,IAAM,oCAAoC,OAAO;;;AC5CxD,IAAM,mBAAmB;AAAA,EACvB,QAAQ;AAAA,EACR,QAAQ;AAAA,EACR,QAAQ;AAAA,EACR,MAAM;AAAA,EACN,KAAK;AAAA,EACL,OAAO;AACT;AAKA,SAAS,YACPA,OACA,SACA,OACA,MACiB;AACjB,SAAO;AAAA,IACL,MAAAA;AAAA,IACA;AAAA,IACA,SAAS;AAAA,IACT;AAAA,IACA;AAAA,EACF;AACF;AA4BO,IAAM,oBAAN,MAAwB;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAa7B,YAAY,QAAiC;AAC3C,SAAK,QAAQ,OAAO;AACpB,SAAK,UAAU,OAAO;AACtB,SAAK,SAAS,OAAO;AACrB,SAAK,YAAY,OAAO;AACxB,SAAK,UAAU,OAAO,SAAS,WAAW,MAAM,KAAK,UAAU;AAC/D,SAAK,iBAAiB,OAAO;AAAA,EAC/B;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAOO,cAAc,SAA+B;AAClD,SAAK,UAAU;AAAA,EACjB;AAAA;AAAA;AAAA;AAAA,EAKA,IAAY,OAAe;AACzB,WAAO,KAAK,MAAM,CAAC;AAAA,EACrB;AAAA;AAAA;AAAA;AAAA,EAKA,MAAc,gBACZ,MACA,QACA,MACwB;AACxB,UAAM,UAAU,KAAK,OAAO,KAAK,SAAS,cAAc,MAAM,MAAM;AAEpE,WAAO,KAAK,QAAQ,GAAG,KAAK,IAAI,WAAW;AAAA,MACzC,QAAQ;AAAA,MACR;AAAA,MACA;AAAA,IACF,CAAC;AAAA,EACH;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAsBA,MAAM,OAAO,QAA6D;AAExE,QAAI,CAAC,OAAO,aAAa;AACvB,aAAO;AAAA,QACL,IAAI;AAAA,QACJ,OAAO;AAAA,UACL,qBAAqB;AAAA,UACrB;AAAA,QACF;AAAA,MACF;AAAA,IACF;AAEA,QAAI,CAAC,OAAO,MAAM;AAChB,aAAO;AAAA,QACL,IAAI;AAAA,QACJ,OAAO;AAAA,UACL,qBAAqB;AAAA,UACrB;AAAA,QACF;AAAA,MACF;AAAA,IACF;AAEA,QAAI,CAAC,OAAO,WAAW,OAAO,QAAQ,WAAW,GAAG;AAClD,aAAO;AAAA,QACL,IAAI;AAAA,QACJ,OAAO;AAAA,UACL,qBAAqB;AAAA,UACrB;AAAA,QACF;AAAA,MACF;AAAA,IACF;AAEA,QAAI;AACF,YAAM,OAAO,KAAK,UAAU;AAAA,QAC1B,aAAa,OAAO;AAAA,QACpB,MAAM,OAAO;AAAA,QACb,SAAS,OAAO;AAAA,QAChB,QAAQ,OAAO,QAAQ,YAAY;AAAA,QACnC,sBAAsB,OAAO,wBAAwB;AAAA,QACrD,WAAW,OAAO;AAAA,MACpB,CAAC;AAED,YAAM,WAAW,MAAM,KAAK;AAAA,QAC1B,OAAO;AAAA,QACP,iBAAiB;AAAA,QACjB;AAAA,MACF;AAEA,UAAI,CAAC,SAAS,IAAI;AAChB,cAAM,YAAY,MAAM,SAAS,KAAK;AACtC,eAAO;AAAA,UACL,IAAI;AAAA,UACJ,OAAO;AAAA,YACL,qBAAqB;AAAA,YACrB,gCAAgC,SAAS,MAAM,MAAM,SAAS;AAAA,YAC9D;AAAA,YACA,EAAE,QAAQ,SAAS,QAAQ,MAAM,OAAO,KAAK;AAAA,UAC/C;AAAA,QACF;AAAA,MACF;AAEA,YAAM,cAAe,MAAM,SAAS,KAAK;AAEzC,YAAM,aAAyB;AAAA,QAC7B,KAAK,YAAY,OAAO;AAAA,QACxB,aAAa,OAAO;AAAA,QACpB,SAAS,KAAK,QAAQ;AAAA,QACtB,MAAM,OAAO;AAAA,QACb,SAAS,OAAO;AAAA,QAChB,QAAQ,OAAO,UAAU,IAAI,KAAK,KAAK,IAAI,IAAI,OAAO,QAAQ;AAAA,QAC9D,WAAW;AAAA,QACX,oBAAoB,EAAE,OAAO,wBAAwB;AAAA,QACrD,WAAW,oBAAI,KAAK;AAAA,MACtB;AAEA,aAAO,EAAE,IAAI,MAAM,MAAM,WAAW;AAAA,IACtC,SAAS,OAAO;AACd,UAAI,iBAAiB,SAAS,MAAM,SAAS,cAAc;AACzD,eAAO;AAAA,UACL,IAAI;AAAA,UACJ,OAAO;AAAA,YACL,qBAAqB;AAAA,YACrB;AAAA,YACA;AAAA,UACF;AAAA,QACF;AAAA,MACF;AACA,aAAO;AAAA,QACL,IAAI;AAAA,QACJ,OAAO;AAAA,UACL,qBAAqB;AAAA,UACrB,6CAA6C,OAAO,KAAK,CAAC;AAAA,UAC1D,iBAAiB,QAAQ,QAAQ;AAAA,QACnC;AAAA,MACF;AAAA,IACF;AAAA,EACF;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAmBA,MAAM,OAAOC,MAA2D;AACtE,QAAI,CAACA,MAAK;AACR,aAAO;AAAA,QACL,IAAI;AAAA,QACJ,OAAO;AAAA,UACL,qBAAqB;AAAA,UACrB;AAAA,QACF;AAAA,MACF;AAAA,IACF;AAEA,QAAI;AACF,UAAI,CAAC,KAAK,WAAW;AACnB,eAAO;AAAA,UACL,IAAI;AAAA,UACJ,OAAO;AAAA,YACL,qBAAqB;AAAA,YACrB;AAAA,UACF;AAAA,QACF;AAAA,MACF;AAEA,YAAM,UAAU,KAAK;AAAA,QACnB,KAAK;AAAA,QACL,CAAC;AAAA,UACC,UAAU,WAAWA,IAAG;AAAA,UACxB,SAAS;AAAA,UACT,MAAM;AAAA,UACN,QAAQ,iBAAiB;AAAA,QAC3B,CAAC;AAAA,MACH;AACA,YAAM,WAAW,MAAM,KAAK,QAAQ,GAAG,KAAK,IAAI,WAAW;AAAA,QACzD,QAAQ;AAAA,QACR;AAAA,MACF,CAAC;AAED,UAAI,CAAC,SAAS,IAAI;AAChB,cAAM,YAAY,MAAM,SAAS,KAAK;AAEtC,YAAI,SAAS,WAAW,KAAK;AAC3B,iBAAO;AAAA,YACL,IAAI;AAAA,YACJ,OAAO;AAAA,cACL,qBAAqB;AAAA,cACrB,yBAAyBA,IAAG;AAAA,YAC9B;AAAA,UACF;AAAA,QACF;AAEA,eAAO;AAAA,UACL,IAAI;AAAA,UACJ,OAAO;AAAA,YACL,qBAAqB;AAAA,YACrB,gCAAgC,SAAS,MAAM,MAAM,SAAS;AAAA,YAC9D;AAAA,YACA,EAAE,QAAQ,SAAS,QAAQ,KAAAA,KAAI;AAAA,UACjC;AAAA,QACF;AAAA,MACF;AAEA,YAAM,SAAS,kCAAkC,UAAU,MAAM,SAAS,KAAK,CAAC;AAChF,UAAI,CAAC,OAAO,WAAW,OAAO,KAAK,QAAQA,MAAK;AAC9C,eAAO;AAAA,UACL,IAAI;AAAA,UACJ,OAAO;AAAA,YACL,qBAAqB;AAAA,YACrB;AAAA,YACA;AAAA,YACA,EAAE,KAAAA,KAAI;AAAA,UACR;AAAA,QACF;AAAA,MACF;AACA,aAAO,EAAE,IAAI,MAAM,MAAM,OAAO,KAAK;AAAA,IACvC,SAAS,OAAO;AACd,UAAI,iBAAiB,SAAS,MAAM,SAAS,cAAc;AACzD,eAAO;AAAA,UACL,IAAI;AAAA,UACJ,OAAO;AAAA,YACL,qBAAqB;AAAA,YACrB;AAAA,YACA;AAAA,UACF;AAAA,QACF;AAAA,MACF;AACA,aAAO;AAAA,QACL,IAAI;AAAA,QACJ,OAAO;AAAA,UACL,qBAAqB;AAAA,UACrB,+CAA+C,OAAO,KAAK,CAAC;AAAA,UAC5D,iBAAiB,QAAQ,QAAQ;AAAA,QACnC;AAAA,MACF;AAAA,IACF;AAAA,EACF;AAAA;AAAA;AAAA;AAAA;AAAA,EAMA,MAAM,OAAOA,MAAgD;AAC3D,QAAI,CAACA,MAAK;AACR,aAAO;AAAA,QACL,IAAI;AAAA,QACJ,OAAO,YAAY,qBAAqB,eAAe,iBAAiB;AAAA,MAC1E;AAAA,IACF;AACA,QAAI,CAAC,KAAK,WAAW;AACnB,aAAO;AAAA,QACL,IAAI;AAAA,QACJ,OAAO;AAAA,UACL,qBAAqB;AAAA,UACrB;AAAA,QACF;AAAA,MACF;AAAA,IACF;AAEA,QAAI;AACF,YAAM,UAAU,KAAK,UAAU,KAAK,SAAS,CAAC;AAAA,QAC5C,UAAU,WAAWA,IAAG;AAAA,QACxB,SAAS;AAAA,QACT,MAAM;AAAA,QACN,QAAQ,iBAAiB;AAAA,MAC3B,CAAC,CAAC;AACF,YAAM,WAAW,MAAM,KAAK,QAAQ,GAAG,KAAK,IAAI,sBAAsB;AAAA,QACpE,QAAQ;AAAA,QACR,SAAS,EAAE,GAAG,SAAS,gBAAgB,mBAAmB;AAAA,QAC1D,MAAM,KAAK,UAAU,EAAE,KAAAA,KAAI,CAAC;AAAA,MAC9B,CAAC;AACD,UAAI,CAAC,SAAS,MAAM,SAAS,WAAW,KAAK;AAC3C,cAAM,YAAY,MAAM,SAAS,KAAK;AACtC,eAAO;AAAA,UACL,IAAI;AAAA,UACJ,OAAO;AAAA,YACL,qBAAqB;AAAA,YACrB,oCAAoC,SAAS,MAAM,MAAM,SAAS;AAAA,YAClE;AAAA,YACA,EAAE,QAAQ,SAAS,QAAQ,KAAAA,KAAI;AAAA,UACjC;AAAA,QACF;AAAA,MACF;AACA,YAAM,SAAS,uBAAuB,UAAU,MAAM,SAAS,KAAK,CAAC;AACrE,YAAM,wBAAwB,OAAO,YACnC,SAAS,WAAW,MAChB,OAAO,KAAK,WAAW,eAAe,CAAC,OAAO,KAAK,SACnD,OAAO,KAAK,WAAW;AAE7B,UAAI,CAAC,OAAO,WAAW,OAAO,KAAK,QAAQA,QAAO,CAAC,uBAAuB;AACxE,eAAO;AAAA,UACL,IAAI;AAAA,UACJ,OAAO;AAAA,YACL,qBAAqB;AAAA,YACrB;AAAA,YACA;AAAA,YACA,EAAE,KAAAA,KAAI;AAAA,UACR;AAAA,QACF;AAAA,MACF;AACA,aAAO,EAAE,IAAI,MAAM,MAAM,OAAO,KAAK;AAAA,IACvC,SAAS,OAAO;AACd,UAAI,iBAAiB,SAAS,MAAM,SAAS,cAAc;AACzD,eAAO;AAAA,UACL,IAAI;AAAA,UACJ,OAAO,YAAY,qBAAqB,SAAS,mBAAmB,KAAK;AAAA,QAC3E;AAAA,MACF;AACA,aAAO;AAAA,QACL,IAAI;AAAA,QACJ,OAAO;AAAA,UACL,qBAAqB;AAAA,UACrB,2CAA2C,OAAO,KAAK,CAAC;AAAA,UACxD,iBAAiB,QAAQ,QAAQ;AAAA,QACnC;AAAA,MACF;AAAA,IACF;AAAA,EACF;AAAA;AAAA,EAGA,MAAM,MACJ,UAAyC,CAAC,GACF;AACxC,UAAM,YAAY,oCAAoC,UAAU,OAAO;AACvE,QAAI,CAAC,UAAU,SAAS;AACtB,aAAO;AAAA,QACL,IAAI;AAAA,QACJ,OAAO;AAAA,UACL,qBAAqB;AAAA,UACrB;AAAA,UACA;AAAA,UACA,EAAE,QAAQ,UAAU,MAAM,OAAO;AAAA,QACnC;AAAA,MACF;AAAA,IACF;AACA,QAAI,CAAC,KAAK,WAAW;AACnB,aAAO;AAAA,QACL,IAAI;AAAA,QACJ,OAAO;AAAA,UACL,qBAAqB;AAAA,UACrB;AAAA,QACF;AAAA,MACF;AAAA,IACF;AACA,QAAI,CAAC,KAAK,gBAAgB;AACxB,aAAO;AAAA,QACL,IAAI;AAAA,QACJ,OAAO;AAAA,UACL,qBAAqB;AAAA,UACrB;AAAA,QACF;AAAA,MACF;AAAA,IACF;AACA,QAAI;AACF,YAAM,oBAAoB,KAAK,UAAU,KAAK,SAAS,CAAC;AAAA,QACtD,SAAS,KAAK;AAAA,QACd,SAAS;AAAA,QACT,MAAM;AAAA,QACN,QAAQ,iBAAiB;AAAA,MAC3B,CAAC,CAAC;AACF,YAAM,UAAU,OAAO,YAAY,IAAI,QAAQ,iBAAiB,EAAE,QAAQ,CAAC;AAC3E,cAAQ,cAAc,IAAI;AAC1B,YAAM,WAAW,MAAM,KAAK,QAAQ,GAAG,KAAK,IAAI,qBAAqB;AAAA,QACnE,QAAQ;AAAA,QACR;AAAA,QACA,MAAM,KAAK,UAAU,UAAU,IAAI;AAAA,MACrC,CAAC;AACD,UAAI,CAAC,SAAS,IAAI;AAChB,cAAM,YAAY,MAAM,SAAS,KAAK;AACtC,eAAO;AAAA,UACL,IAAI;AAAA,UACJ,OAAO;AAAA,YACL,qBAAqB;AAAA,YACrB,gCAAgC,SAAS,MAAM,MAAM,SAAS;AAAA,YAC9D;AAAA,YACA,EAAE,QAAQ,SAAS,OAAO;AAAA,UAC5B;AAAA,QACF;AAAA,MACF;AACA,YAAM,SAAS,4BAA4B,UAAU,MAAM,SAAS,KAAK,CAAC;AAC1E,UAAI,CAAC,OAAO,SAAS;AACnB,eAAO;AAAA,UACL,IAAI;AAAA,UACJ,OAAO;AAAA,YACL,qBAAqB;AAAA,YACrB;AAAA,UACF;AAAA,QACF;AAAA,MACF;AACA,aAAO,EAAE,IAAI,MAAM,MAAM,OAAO,KAAK;AAAA,IACvC,SAAS,OAAO;AACd,aAAO;AAAA,QACL,IAAI;AAAA,QACJ,OAAO;AAAA,UACL,qBAAqB;AAAA,UACrB,0CAA0C,OAAO,KAAK,CAAC;AAAA,UACvD,iBAAiB,QAAQ,QAAQ;AAAA,QACnC;AAAA,MACF;AAAA,IACF;AAAA,EACF;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAoBA,MAAM,OAAsC;AAC1C,QAAI;AACF,YAAM,WAAW,MAAM,KAAK,gBAAgB,IAAI,iBAAiB,IAAI;AAErE,UAAI,CAAC,SAAS,IAAI;AAChB,cAAM,YAAY,MAAM,SAAS,KAAK;AACtC,eAAO;AAAA,UACL,IAAI;AAAA,UACJ,OAAO;AAAA,YACL,qBAAqB;AAAA,YACrB,+BAA+B,SAAS,MAAM,MAAM,SAAS;AAAA,YAC7D;AAAA,YACA,EAAE,QAAQ,SAAS,OAAO;AAAA,UAC5B;AAAA,QACF;AAAA,MACF;AAEA,YAAM,OAAQ,MAAM,SAAS,KAAK;AAclC,YAAM,cAA4B,KAAK,IAAI,CAAC,UAAU;AAAA,QACpD,KAAK,KAAK;AAAA,QACV,aAAa,KAAK;AAAA,QAClB,cAAc,KAAK;AAAA,QACnB,SAAS,KAAK;AAAA,QACd,MAAM,KAAK;AAAA,QACX,SAAS,KAAK;AAAA,QACd,QAAQ,IAAI,KAAK,KAAK,MAAM;AAAA,QAC5B,WAAW,KAAK;AAAA,QAChB,WAAW,KAAK,YAAY,IAAI,KAAK,KAAK,SAAS,IAAI;AAAA,QACvD,WAAW,KAAK;AAAA,QAChB,oBAAoB,KAAK;AAAA,MAC3B,EAAE;AAEF,aAAO,EAAE,IAAI,MAAM,MAAM,YAAY;AAAA,IACvC,SAAS,OAAO;AACd,UAAI,iBAAiB,SAAS,MAAM,SAAS,cAAc;AACzD,eAAO;AAAA,UACL,IAAI;AAAA,UACJ,OAAO;AAAA,YACL,qBAAqB;AAAA,YACrB;AAAA,YACA;AAAA,UACF;AAAA,QACF;AAAA,MACF;AACA,aAAO;AAAA,QACL,IAAI;AAAA,QACJ,OAAO;AAAA,UACL,qBAAqB;AAAA,UACrB,yCAAyC,OAAO,KAAK,CAAC;AAAA,UACtD,iBAAiB,QAAQ,QAAQ;AAAA,QACnC;AAAA,MACF;AAAA,IACF;AAAA,EACF;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAsBA,MAAM,SAASA,MAA+C;AAC5D,QAAI,CAACA,MAAK;AACR,aAAO;AAAA,QACL,IAAI;AAAA,QACJ,OAAO;AAAA,UACL,qBAAqB;AAAA,UACrB;AAAA,QACF;AAAA,MACF;AAAA,IACF;AAEA,QAAI;AACF,YAAM,OAAO,KAAK,UAAU,EAAE,KAAAA,MAAK,cAAc,KAAK,CAAC;AAEvD,YAAM,WAAW,MAAM,KAAK;AAAA,QAC1BA;AAAA,QACA,iBAAiB;AAAA,QACjB;AAAA,MACF;AAEA,UAAI,CAAC,SAAS,IAAI;AAChB,cAAM,YAAY,MAAM,SAAS,KAAK;AAEtC,YAAI,SAAS,WAAW,KAAK;AAC3B,iBAAO;AAAA,YACL,IAAI;AAAA,YACJ,OAAO;AAAA,cACL,qBAAqB;AAAA,cACrB,yBAAyBA,IAAG;AAAA,YAC9B;AAAA,UACF;AAAA,QACF;AAEA,eAAO;AAAA,UACL,IAAI;AAAA,UACJ,OAAO;AAAA,YACL,qBAAqB;AAAA,YACrB,mCAAmC,SAAS,MAAM,MAAM,SAAS;AAAA,YACjE;AAAA,YACA,EAAE,QAAQ,SAAS,QAAQ,KAAAA,KAAI;AAAA,UACjC;AAAA,QACF;AAAA,MACF;AAEA,YAAM,OAAQ,MAAM,SAAS,KAAK;AAgBlC,YAAM,QAAyB,KAAK,MAAM,IAAI,CAAC,UAAU;AAAA,QACvD,KAAK,KAAK;AAAA,QACV,aAAa,KAAK;AAAA,QAClB,cAAc,KAAK;AAAA,QACnB,SAAS,KAAK;AAAA,QACd,MAAM,KAAK;AAAA,QACX,SAAS,KAAK;AAAA,QACd,QAAQ,IAAI,KAAK,KAAK,MAAM;AAAA,QAC5B,WAAW,KAAK;AAAA,QAChB,WAAW,KAAK,YAAY,IAAI,KAAK,KAAK,SAAS,IAAI;AAAA,QACvD,WAAW,KAAK;AAAA,QAChB,oBAAoB,KAAK;AAAA,MAC3B,EAAE;AAEF,aAAO,EAAE,IAAI,MAAM,MAAM,MAAM;AAAA,IACjC,SAAS,OAAO;AACd,UAAI,iBAAiB,SAAS,MAAM,SAAS,cAAc;AACzD,eAAO;AAAA,UACL,IAAI;AAAA,UACJ,OAAO;AAAA,YACL,qBAAqB;AAAA,YACrB;AAAA,YACA;AAAA,UACF;AAAA,QACF;AAAA,MACF;AACA,aAAO;AAAA,QACL,IAAI;AAAA,QACJ,OAAO;AAAA,UACL,qBAAqB;AAAA,UACrB,yCAAyC,OAAO,KAAK,CAAC;AAAA,UACtD,iBAAiB,QAAQ,QAAQ;AAAA,QACnC;AAAA,MACF;AAAA,IACF;AAAA,EACF;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAsBA,MAAM,gBAAgB,MAAc,QAA0C;AAC5E,QAAI,CAAC,MAAM;AACT,aAAO;AAAA,QACL,IAAI;AAAA,QACJ,OAAO;AAAA,UACL,qBAAqB;AAAA,UACrB;AAAA,QACF;AAAA,MACF;AAAA,IACF;AAEA,QAAI,CAAC,QAAQ;AACX,aAAO;AAAA,QACL,IAAI;AAAA,QACJ,OAAO;AAAA,UACL,qBAAqB;AAAA,UACrB;AAAA,QACF;AAAA,MACF;AAAA,IACF;AAEA,QAAI;AACF,YAAM,OAAO,KAAK,UAAU,EAAE,MAAM,OAAO,CAAC;AAE5C,YAAM,WAAW,MAAM,KAAK;AAAA,QAC1B;AAAA,QACA,iBAAiB;AAAA,QACjB;AAAA,MACF;AAEA,UAAI,CAAC,SAAS,IAAI;AAEhB,YAAI,SAAS,WAAW,KAAK;AAC3B,iBAAO,EAAE,IAAI,MAAM,MAAM,MAAM;AAAA,QACjC;AAEA,cAAM,YAAY,MAAM,SAAS,KAAK;AACtC,eAAO;AAAA,UACL,IAAI;AAAA,UACJ,OAAO;AAAA,YACL,qBAAqB;AAAA,YACrB,+BAA+B,SAAS,MAAM,MAAM,SAAS;AAAA,YAC7D;AAAA,YACA,EAAE,QAAQ,SAAS,QAAQ,MAAM,OAAO;AAAA,UAC1C;AAAA,QACF;AAAA,MACF;AAEA,YAAM,OAAQ,MAAM,SAAS,KAAK;AAClC,aAAO,EAAE,IAAI,MAAM,MAAM,KAAK,QAAQ;AAAA,IACxC,SAAS,OAAO;AACd,UAAI,iBAAiB,SAAS,MAAM,SAAS,cAAc;AACzD,eAAO;AAAA,UACL,IAAI;AAAA,UACJ,OAAO;AAAA,YACL,qBAAqB;AAAA,YACrB;AAAA,YACA;AAAA,UACF;AAAA,QACF;AAAA,MACF;AACA,aAAO;AAAA,QACL,IAAI;AAAA,QACJ,OAAO;AAAA,UACL,qBAAqB;AAAA,UACrB,0CAA0C,OAAO,KAAK,CAAC;AAAA,UACvD,iBAAiB,QAAQ,QAAQ;AAAA,QACnC;AAAA,MACF;AAAA,IACF;AAAA,EACF;AACF;;;AC3zBA,IAAAC,cAAkB;AA6BX,IAAM,yBAAyB,cAAE,OAAO;AAAA;AAAA,EAE7C,KAAK,UAAU;AAAA,IACb,CAAC,QAAQ,OAAO,IAAI,MAAM,YAAY,IAAI,EAAE,SAAS;AAAA,IACrD,EAAE,SAAS,6CAA6C;AAAA,EAC1D;AAAA;AAAA,EAEA,QAAQ,cAAE,OAAO,EAAE,IAAI,GAAG,oBAAoB;AAAA;AAAA,EAE9C,YAAY;AAAA;AAAA,EAEZ,MAAM,cAAE,OAAO,EAAE,IAAI,GAAG,kBAAkB;AAAA;AAAA,EAE1C,MAAM,cAAE,OAAO,EAAE,IAAI,0BAA0B;AAAA;AAAA,EAE/C,SAAS,cAAE,OAAO,EAAE,IAAI,GAAG,qBAAqB;AAAA;AAAA,EAEhD,SAAS,cAAE,QAAQ,CAAC;AACtB,CAAC;AAWM,IAAM,uBAAuB,cAAE,OAAO;AAAA;AAAA;AAAA;AAAA;AAAA,EAK3C,iBAAiB,cAAE,QAAQ,EAAE,SAAS;AAAA;AAAA;AAAA;AAAA;AAAA,EAKtC,eAAe,cAAE,QAAQ,EAAE,SAAS;AAAA;AAAA;AAAA;AAAA,EAIpC,eAAe,oBAAoB,SAAS;AAC9C,CAAC;AAeM,IAAM,6BAA6B,cAAE,OAAO;AAAA;AAAA,EAEjD,OAAO,cAAE,MAAM,cAAE,OAAO,EAAE,IAAI,CAAC,EAAE,IAAI,GAAG,mCAAmC;AAAA;AAAA;AAAA;AAAA;AAAA,EAK3E,SAAS,cACN,QAAQ,EACR;AAAA,IACC,CAAC,QACC,QAAQ,UAAc,QAAQ,QAAQ,OAAO,QAAQ;AAAA,IACvD,EAAE,SAAS,gDAAgD;AAAA,EAC7D,EACC,SAAS;AAAA;AAAA,EAEZ,QAAQ,cACL,QAAQ,EACR,OAAO,CAAC,QAA+B,OAAO,QAAQ,YAAY;AAAA,IACjE,SAAS;AAAA,EACX,CAAC;AAAA;AAAA,EAEH,OAAO,cACJ,QAAQ,EACR;AAAA,IACC,CAAC,QACC,QAAQ,UAAa,OAAO,QAAQ;AAAA,IACtC,EAAE,SAAS,yCAAyC;AAAA,EACtD,EACC,SAAS;AAAA;AAAA,EAEZ,aAAa;AAAA;AAAA,EAEb,UAAU,cACP,QAAQ,EACR;AAAA,IACC,CAAC,QACC,QAAQ,QAAQ,OAAO,QAAQ;AAAA,IACjC,EAAE,SAAS,4CAA4C;AAAA,EACzD;AAAA;AAAA;AAAA;AAAA;AAAA,EAKF,mBAAmB,cAChB,QAAQ,EACR;AAAA,IACC,CAAC,QACC,QAAQ,UAAc,QAAQ,QAAQ,OAAO,QAAQ;AAAA,IACvD,EAAE,SAAS,mDAAmD;AAAA,EAChE,EACC,SAAS;AAAA;AAAA,EAEZ,iBAAiB,cAAE,QAAQ,EAAE;AAAA,IAC3B,CAAC,QAMmB,OAAO,QAAQ;AAAA,IACnC,EAAE,SAAS,8CAA8C;AAAA,EAC3D;AAAA;AAAA,EAEA,SAAS,cAAE,OAAO,EAAE,SAAS;AAAA;AAAA;AAAA;AAAA,EAI7B,kBAAkB,cACf,QAAQ,EACR,OAAO,CAAC,QAAQ,QAAQ,UAAa,OAAO,QAAQ,YAAY;AAAA,IAC/D,SAAS;AAAA,EACX,CAAC,EACA,SAAS;AAAA;AAAA;AAAA;AAAA,EAIZ,sBAAsB,cACnB,QAAQ,EACR,OAAO,CAAC,QAAQ,QAAQ,UAAa,OAAO,QAAQ,YAAY;AAAA,IAC/D,SAAS;AAAA,EACX,CAAC,EACA,SAAS;AAAA;AAAA,EAEZ,YAAY,cACT,QAAQ,EACR,OAAO,CAAC,QAA4D,QAAQ,UAAa,OAAO,QAAQ,YAAY;AAAA,IACnH,SAAS;AAAA,EACX,CAAC,EACA,SAAS;AAAA;AAAA;AAAA;AAAA,EAIZ,YAAY,cAAE,OAAO,EAAE,SAAS;AAAA;AAAA;AAAA;AAAA,EAIhC,eAAe,cAAE,KAAK,EAAE,SAAS;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAMjC,wBAAwB,cACrB,QAAQ,EACR,OAAO,CAAC,QAAQ,QAAQ,UAAa,OAAO,QAAQ,YAAY;AAAA,IAC/D,SAAS;AAAA,EACX,CAAC,EACA,SAAS;AACd,CAAC;AAwBM,SAAS,yBACd,MAC2C;AAC3C,QAAM,SAAS,uBAAuB,UAAU,IAAI;AACpD,MAAI,CAAC,OAAO,SAAS;AACnB,WAAO;AAAA,MACL,IAAI;AAAA,MACJ,OAAO;AAAA,QACL,MAAM,qBAAqB;AAAA,QAC3B,SAAS,uBAAuB,OAAO,MAAM,OAAO;AAAA,QACpD,SAAS;AAAA,QACT,MAAM,EAAE,QAAQ,OAAO,MAAM,OAAO;AAAA,MACtC;AAAA,IACF;AAAA,EACF;AACA,SAAO,EAAE,IAAI,MAAM,MAAM,OAAO,KAAK;AACvC;AAQO,SAAS,uBACd,MACyC;AACzC,QAAM,SAAS,qBAAqB,UAAU,IAAI;AAClD,MAAI,CAAC,OAAO,SAAS;AACnB,WAAO;AAAA,MACL,IAAI;AAAA,MACJ,OAAO;AAAA,QACL,MAAM,qBAAqB;AAAA,QAC3B,SAAS,4BAA4B,OAAO,MAAM,OAAO;AAAA,QACzD,SAAS;AAAA,QACT,MAAM,EAAE,QAAQ,OAAO,MAAM,OAAO;AAAA,MACtC;AAAA,IACF;AAAA,EACF;AACA,SAAO,EAAE,IAAI,MAAM,MAAM,OAAO,KAAK;AACvC;AAQO,SAAS,6BACd,MAC+C;AAC/C,QAAM,SAAS,2BAA2B,UAAU,IAAI;AACxD,MAAI,CAAC,OAAO,SAAS;AACnB,WAAO;AAAA,MACL,IAAI;AAAA,MACJ,OAAO;AAAA,QACL,MAAM,qBAAqB;AAAA,QAC3B,SAAS,kCAAkC,OAAO,MAAM,OAAO;AAAA,QAC/D,SAAS;AAAA,QACT,MAAM,EAAE,QAAQ,OAAO,MAAM,OAAO;AAAA,MACtC;AAAA,IACF;AAAA,EACF;AACA,SAAO,EAAE,IAAI,MAAM,MAAM,OAAO,KAAK;AACvC;;;ACrRA,gBAAe;AACf,uBAA6C;AAC7C,0BAAkD;AAoR3C,IAAM,wBACX,OAAO,OAAO;AAAA,EACZ,IAAI;AAAA,EACJ,KAAK;AAAA,EACL,QAAQ;AAAA,EACR,cAAc;AAAA,EACd,OAAO;AAAA,EACP,YAAY;AAAA,EACZ,YAAY;AACd,CAAC;AAuBI,IAAM,wBACX,OAAO;AAAA,EACL,OAAO;AAAA,IACL,OAAO,QAAQ,qBAAqB,EAAE,IAAI,CAAC,CAAC,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC;AAAA,EAC9D;AACF;;;AC5UF,kBAAsC;AAmB/B,IAAM,qBAAN,cAAiC,MAAM;AAAA,EAC5C,YAAY,SAAiB;AAC3B,UAAM,OAAO;AACb,SAAK,OAAO;AAAA,EACd;AACF;AAEA,IAAM,aAAa;AACnB,IAAM,SAAS;AAEf,SAAS,YAAY,OAAkD;AACrE,QAAM,gBAAgB,MAAM,QAAQ,GAAG;AACvC,MAAI,gBAAgB,GAAG;AACrB,WAAO,EAAE,KAAK,OAAO,UAAU,GAAG;AAAA,EACpC;AACA,SAAO;AAAA,IACL,KAAK,MAAM,MAAM,GAAG,aAAa;AAAA,IACjC,UAAU,MAAM,MAAM,aAAa;AAAA,EACrC;AACF;AAEA,SAAS,mBAAmB,SAAuB;AACjD,MAAI,CAAC,OAAO,cAAc,OAAO,KAAK,WAAW,GAAG;AAClD,UAAM,IAAI,mBAAmB,6BAA6B,OAAO,EAAE;AAAA,EACrE;AACF;AAEO,SAAS,aAAa,OAAwB;AACnD,aAAO,uBAAU,OAAO,EAAE,QAAQ,MAAM,CAAC;AAC3C;AAEO,SAAS,oBAAoB,SAAmC;AACrE,MAAI,CAAC,aAAa,OAAO,GAAG;AAC1B,UAAM,IAAI,mBAAmB,wBAAwB,OAAO,EAAE;AAAA,EAChE;AACA,aAAO,wBAAW,OAAO;AAC3B;AAMO,SAAS,OAAO,SAAiB,UAAkB,GAAW;AACnE,qBAAmB,OAAO;AAC1B,SAAO,kBAAkB,OAAO,IAAI,oBAAoB,OAAO,CAAC;AAClE;AAEO,SAAS,YAAY,KAAiC;AAC3D,QAAM,QAAQ,IAAI,MAAM,UAAU;AAClC,MAAI,CAAC,MAAO,QAAO;AAEnB,QAAM,UAAU,OAAO,MAAM,CAAC,CAAC;AAC/B,qBAAmB,OAAO;AAE1B,SAAO;AAAA,IACL,QAAQ;AAAA,IACR,WAAW;AAAA,IACX;AAAA,IACA,SAAS,oBAAoB,MAAM,CAAC,CAAC;AAAA,EACvC;AACF;AAEO,SAAS,gBAAgB,KAAqB;AACnD,QAAM,MAAM,YAAY,GAAG;AAC3B,MAAI,KAAK;AACP,WAAO,OAAO,IAAI,SAAS,IAAI,OAAO;AAAA,EACxC;AACA,MAAI,OAAO,KAAK,GAAG,GAAG;AACpB,WAAO;AAAA,EACT;AACA,QAAM,IAAI,mBAAmB,gBAAgB,GAAG,EAAE;AACpD;AAOO,SAAS,aAAa,QAAwB;AACnD,SAAO,gBAAgB,YAAY,MAAM,EAAE,GAAG;AAChD;;;ACnCO,IAAM,qCAAN,cAAiD,MAAM;AAAA,EAM5D,YAAY,SAA4B;AACtC;AAAA,MACE;AAAA,IACF;AAPF;AAAA,gBAAO;AAQL,SAAK,OAAO;AACZ,SAAK,UAAU,QAAQ,IAAI,UAAU;AAAA,EACvC;AACF;AA6IO,SAAS,kBACd,MACA,OACS;AACT,SAAO,yBAAyB,IAAI,MAAM,yBAAyB,KAAK;AAC1E;AASO,SAAS,yBACd,SACQ;AACR,QAAM,eAAe,CAAC,UAA2B;AAC/C,QAAI,UAAU,QAAQ,OAAO,UAAU,aAAa,OAAO,UAAU,UAAU;AAC7E,aAAO,KAAK,UAAU,KAAK;AAAA,IAC7B;AACA,QAAI,OAAO,UAAU,UAAU;AAC7B,UAAI,OAAO,SAAS,KAAK,EAAG,QAAO,KAAK,UAAU,KAAK;AACvD,YAAM,IAAI,MAAM,8CAA8C;AAAA,IAChE;AACA,QAAI,MAAM,QAAQ,KAAK,EAAG,QAAO,IAAI,MAAM,IAAI,YAAY,EAAE,KAAK,GAAG,CAAC;AACtE,QAAI,OAAO,UAAU,UAAU;AAC7B,YAAM,SAAS;AACf,YAAM,YAAY,OAAO,eAAe,MAAM;AAC9C,UAAI,cAAc,OAAO,aAAa,cAAc,MAAM;AACxD,cAAM,IAAI,MAAM,8CAA8C;AAAA,MAChE;AACA,aAAO,IAAI,OAAO,KAAK,MAAM,EAAE,KAAK,EAAE;AAAA,QAAI,CAAC,QACzC,GAAG,KAAK,UAAU,GAAG,CAAC,IAAI,aAAa,OAAO,GAAG,CAAC,CAAC;AAAA,MACrD,EAAE,KAAK,GAAG,CAAC;AAAA,IACb;AACA,UAAM,IAAI,MAAM,8CAA8C;AAAA,EAChE;AACA,QAAM,YAAY,WAAW,CAAC,GAAG,IAAI,YAAY,EAAE,KAAK;AACxD,MAAI,SAAS,WAAW,KAAM,SAAS,WAAW,KAAK,SAAS,CAAC,MAAM,MAAO;AAC5E,WAAO;AAAA,EACT;AACA,SAAO,IAAI,SAAS,KAAK,GAAG,CAAC;AAC/B;AAGO,SAAS,eAAe,eAAuB,iBAAkC;AACtF,MAAI,kBAAkB,OAAO,kBAAkB,gBAAiB,QAAO;AACvE,MAAI,CAAC,cAAc,SAAS,IAAI,EAAG,QAAO;AAC1C,QAAM,UAAU,cAAc,MAAM,GAAG,EAAE;AACzC,SAAO,oBAAoB,WAAW,gBAAgB,WAAW,GAAG,OAAO,GAAG;AAChF;AAqBA,SAAS,WAAW,OAAyC;AAC3D,SAAO;AAAA,IACL,SAAS,MAAM;AAAA,IACf,GAAI,MAAM,UAAU,SAAY,EAAE,OAAO,MAAM,MAAM,IAAI,CAAC;AAAA,IAC1D,MAAM,MAAM;AAAA,IACZ,SAAS,CAAC,GAAG,MAAM,OAAO;AAAA,IAC1B,GAAI,MAAM,YAAY,SAClB,EAAE,SAAS,KAAK,MAAM,KAAK,UAAU,MAAM,OAAO,CAAC,EAA+B,IAClF,CAAC;AAAA,IACL,GAAI,MAAM,eAAe,SAAY,EAAE,YAAY,MAAM,WAAW,IAAI,CAAC;AAAA,IACzE,GAAI,MAAM,WAAW,SAAY,EAAE,QAAQ,MAAM,OAAO,IAAI,CAAC;AAAA,EAC/D;AACF;;;AC9SA;;;;;;ACAO,IAAM,QAAQ,IAAI,WAAW,CAAC;AAW/B,SAAU,OAAQ,IAAgB,IAAc;AACpD,MAAI,OAAO,IAAI;AAAE,WAAO;EAAK;AAC7B,MAAI,GAAG,eAAe,GAAG,YAAY;AACnC,WAAO;EACT;AAEA,WAAS,KAAK,GAAG,KAAK,GAAG,YAAY,MAAM;AACzC,QAAI,GAAG,EAAE,MAAM,GAAG,EAAE,GAAG;AACrB,aAAO;IACT;EACF;AAEA,SAAO;AACT;AAEM,SAAU,OAAQ,GAA6C;AACnE,MAAI,aAAa,cAAc,EAAE,YAAY,SAAS,cAAc;AAAE,WAAO;EAAE;AAC/E,MAAI,aAAa,aAAa;AAAE,WAAO,IAAI,WAAW,CAAC;EAAE;AACzD,MAAI,YAAY,OAAO,CAAC,GAAG;AACzB,WAAO,IAAI,WAAW,EAAE,QAAQ,EAAE,YAAY,EAAE,UAAU;EAC5D;AACA,QAAM,IAAI,MAAM,mCAAmC;AACrD;AAMM,SAAU,WAAY,KAAW;AACrC,SAAO,IAAI,YAAW,EAAG,OAAO,GAAG;AACrC;AAEM,SAAU,SAAU,GAAa;AACrC,SAAO,IAAI,YAAW,EAAG,OAAO,CAAC;AACnC;;;ACnCA,SAAS,KAAM,UAAUC,OAAI;AAC3B,MAAI,SAAS,UAAU,KAAK;AAAE,UAAM,IAAI,UAAU,mBAAmB;EAAE;AACvE,MAAI,WAAW,IAAI,WAAW,GAAG;AACjC,WAAS,IAAI,GAAG,IAAI,SAAS,QAAQ,KAAK;AACxC,aAAS,CAAC,IAAI;EAChB;AACA,WAAS,IAAI,GAAG,IAAI,SAAS,QAAQ,KAAK;AACxC,QAAI,IAAI,SAAS,OAAO,CAAC;AACzB,QAAI,KAAK,EAAE,WAAW,CAAC;AACvB,QAAI,SAAS,EAAE,MAAM,KAAK;AAAE,YAAM,IAAI,UAAU,IAAI,eAAe;IAAE;AACrE,aAAS,EAAE,IAAI;EACjB;AACA,MAAI,OAAO,SAAS;AACpB,MAAI,SAAS,SAAS,OAAO,CAAC;AAC9B,MAAI,SAAS,KAAK,IAAI,IAAI,IAAI,KAAK,IAAI,GAAG;AAC1C,MAAI,UAAU,KAAK,IAAI,GAAG,IAAI,KAAK,IAAI,IAAI;AAI3C,WAASC,QAAQ,QAAM;AAErB,QAAI,kBAAkB;AAAY;aAAW,YAAY,OAAO,MAAM,GAAG;AACvE,eAAS,IAAI,WAAW,OAAO,QAAQ,OAAO,YAAY,OAAO,UAAU;IAC7E,WAAW,MAAM,QAAQ,MAAM,GAAG;AAChC,eAAS,WAAW,KAAK,MAAM;IACjC;AACA,QAAI,EAAE,kBAAkB,aAAa;AAAE,YAAM,IAAI,UAAU,qBAAqB;IAAE;AAClF,QAAI,OAAO,WAAW,GAAG;AAAE,aAAO;IAAG;AAErC,QAAI,SAAS;AACb,QAAIC,UAAS;AACb,QAAI,SAAS;AACb,QAAI,OAAO,OAAO;AAClB,WAAO,WAAW,QAAQ,OAAO,MAAM,MAAM,GAAG;AAC9C;AACA;IACF;AAEA,QAAI,QAAS,OAAO,UAAU,UAAU,MAAO;AAC/C,QAAI,MAAM,IAAI,WAAW,IAAI;AAE7B,WAAO,WAAW,MAAM;AACtB,UAAI,QAAQ,OAAO,MAAM;AAEzB,UAAIC,KAAI;AACR,eAAS,MAAM,OAAO,IAAI,UAAU,KAAKA,KAAID,YAAY,QAAQ,IAAK,OAAOC,MAAK;AAChF,iBAAU,MAAM,IAAI,GAAG,MAAO;AAC9B,YAAI,GAAG,IAAK,QAAQ,SAAU;AAC9B,gBAAS,QAAQ,SAAU;MAC7B;AACA,UAAI,UAAU,GAAG;AAAE,cAAM,IAAI,MAAM,gBAAgB;MAAE;AACrD,MAAAD,UAASC;AACT;IACF;AAEA,QAAI,MAAM,OAAOD;AACjB,WAAO,QAAQ,QAAQ,IAAI,GAAG,MAAM,GAAG;AACrC;IACF;AAEA,QAAI,MAAM,OAAO,OAAO,MAAM;AAC9B,WAAO,MAAM,MAAM,EAAE,KAAK;AAAE,aAAO,SAAS,OAAO,IAAI,GAAG,CAAC;IAAG;AAC9D,WAAO;EACT;AAIA,WAAS,aAAc,QAAM;AAC3B,QAAI,OAAO,WAAW,UAAU;AAAE,YAAM,IAAI,UAAU,iBAAiB;IAAE;AACzE,QAAI,OAAO,WAAW,GAAG;AAAE,aAAO,IAAI,WAAU;IAAG;AACnD,QAAI,MAAM;AAEV,QAAI,OAAO,GAAG,MAAM,KAAK;AAAE;IAAO;AAElC,QAAI,SAAS;AACb,QAAIA,UAAS;AACb,WAAO,OAAO,GAAG,MAAM,QAAQ;AAC7B;AACA;IACF;AAEA,QAAI,QAAU,OAAO,SAAS,OAAO,SAAU,MAAO;AACtD,QAAI,OAAO,IAAI,WAAW,IAAI;AAE9B,WAAO,OAAO,GAAG,GAAG;AAElB,UAAI,QAAQ,SAAS,OAAO,WAAW,GAAG,CAAC;AAE3C,UAAI,UAAU,KAAK;AAAE;MAAO;AAC5B,UAAIC,KAAI;AACR,eAAS,MAAM,OAAO,IAAI,UAAU,KAAKA,KAAID,YAAY,QAAQ,IAAK,OAAOC,MAAK;AAChF,iBAAU,OAAO,KAAK,GAAG,MAAO;AAChC,aAAK,GAAG,IAAK,QAAQ,QAAS;AAC9B,gBAAS,QAAQ,QAAS;MAC5B;AACA,UAAI,UAAU,GAAG;AAAE,cAAM,IAAI,MAAM,gBAAgB;MAAE;AACrD,MAAAD,UAASC;AACT;IACF;AAEA,QAAI,OAAO,GAAG,MAAM,KAAK;AAAE;IAAO;AAElC,QAAI,MAAM,OAAOD;AACjB,WAAO,QAAQ,QAAQ,KAAK,GAAG,MAAM,GAAG;AACtC;IACF;AACA,QAAI,MAAM,IAAI,WAAW,UAAU,OAAO,IAAI;AAC9C,QAAIE,KAAI;AACR,WAAO,QAAQ,MAAM;AACnB,UAAIA,IAAG,IAAI,KAAK,KAAK;IACvB;AACA,WAAO;EACT;AAIA,WAASC,QAAQ,QAAM;AACrB,QAAI,SAAS,aAAa,MAAM;AAChC,QAAI,QAAQ;AAAE,aAAO;IAAO;AAC5B,UAAM,IAAI,MAAM,OAAOL,KAAI,YAAY;EACzC;AACA,SAAO;IACL,QAAQC;IACR;IACA,QAAQI;;AAEZ;AACA,IAAI,MAAM;AAEV,IAAI,kCAAkC;AAEtC,IAAA,iBAAe;;;ACjIf,IAAM,UAAN,MAAa;EAKX,YAAaC,OAAY,QAAgB,YAAoB;AAJpD;AACA;AACA;AAGP,SAAK,OAAOA;AACZ,SAAK,SAAS;AACd,SAAK,aAAa;EACpB;EAEA,OAAQC,QAAiB;AACvB,QAAIA,kBAAiB,YAAY;AAC/B,aAAO,GAAG,KAAK,MAAM,GAAG,KAAK,WAAWA,MAAK,CAAC;IAChD,OAAO;AACL,YAAM,MAAM,mCAAmC;IACjD;EACF;;AAQF,IAAM,UAAN,MAAa;EAMX,YAAaD,OAAY,QAAgB,YAAoB;AALpD;AACA;AACA;AACQ;AAGf,SAAK,OAAOA;AACZ,SAAK,SAAS;AACd,UAAM,kBAAkB,OAAO,YAAY,CAAC;AAE5C,QAAI,oBAAoB,QAAW;AACjC,YAAM,IAAI,MAAM,0BAA0B;IAC5C;AACA,SAAK,kBAAkB;AACvB,SAAK,aAAa;EACpB;EAEA,OAAQ,MAAY;AAClB,QAAI,OAAO,SAAS,UAAU;AAC5B,UAAI,KAAK,YAAY,CAAC,MAAM,KAAK,iBAAiB;AAChD,cAAM,MAAM,qCAAqC,KAAK,UAAU,IAAI,CAAC,KAAK,KAAK,IAAI,+CAA+C,KAAK,MAAM,EAAE;MACjJ;AACA,aAAO,KAAK,WAAW,KAAK,MAAM,KAAK,OAAO,MAAM,CAAC;IACvD,OAAO;AACL,YAAM,MAAM,mCAAmC;IACjD;EACF;EAEA,GAAgC,SAAmE;AACjG,WAAO,GAAG,MAAM,OAAO;EACzB;;AAKF,IAAM,kBAAN,MAAqB;EAGnB,YAAa,UAA0B;AAF9B;AAGP,SAAK,WAAW;EAClB;EAEA,GAAiC,SAAmE;AAClG,WAAO,GAAG,MAAM,OAAO;EACzB;EAEA,OAAQ,OAAa;AACnB,UAAM,SAAS,MAAM,CAAC;AACtB,UAAM,UAAU,KAAK,SAAS,MAAM;AACpC,QAAI,WAAW,MAAM;AACnB,aAAO,QAAQ,OAAO,KAAK;IAC7B,OAAO;AACL,YAAM,WAAW,qCAAqC,KAAK,UAAU,KAAK,CAAC,+BAA+B,OAAO,KAAK,KAAK,QAAQ,CAAC,gBAAgB;IACtJ;EACF;;AAGI,SAAU,GAAyC,MAA+C,OAA8C;AACpJ,SAAO,IAAI,gBAAgB;IACzB,GAAI,KAAK,YAAY,EAAE,CAAE,KAA2B,MAAM,GAAG,KAAI;IACjE,GAAI,MAAM,YAAY,EAAE,CAAE,MAA4B,MAAM,GAAG,MAAK;GAClD;AACtB;AAEM,IAAO,QAAP,MAAY;EAQhB,YAAaA,OAAY,QAAgB,YAAsB,YAAoB;AAP1E;AACA;AACA;AACA;AACA;AACA;AAGP,SAAK,OAAOA;AACZ,SAAK,SAAS;AACd,SAAK,aAAa;AAClB,SAAK,aAAa;AAClB,SAAK,UAAU,IAAI,QAAQA,OAAM,QAAQ,UAAU;AACnD,SAAK,UAAU,IAAI,QAAQA,OAAM,QAAQ,UAAU;EACrD;EAEA,OAAQ,OAAiB;AACvB,WAAO,KAAK,QAAQ,OAAO,KAAK;EAClC;EAEA,OAAQ,OAAa;AACnB,WAAO,KAAK,QAAQ,OAAO,KAAK;EAClC;;AAGI,SAAU,KAAmD,EAAE,MAAAA,OAAM,QAAQ,QAAAE,SAAQ,QAAAC,QAAM,GAAsE;AACrK,SAAO,IAAI,MAAMH,OAAM,QAAQE,SAAQC,OAAM;AAC/C;AAEM,SAAU,MAAoD,EAAE,MAAAH,OAAM,QAAQ,UAAAI,UAAQ,GAAoD;AAC9I,QAAM,EAAE,QAAAF,SAAQ,QAAAC,QAAM,IAAK,eAAMC,WAAUJ,KAAI;AAC/C,SAAO,KAAK;IACV;IACA,MAAAA;IACA,QAAAE;IACA,QAAQ,CAAC,SAA6B,OAAOC,QAAO,IAAI,CAAC;GAC1D;AACH;AAEA,SAAS,OAAQ,QAAgB,aAAqC,aAAqBH,OAAY;AAErG,MAAI,MAAM,OAAO;AACjB,SAAO,OAAO,MAAM,CAAC,MAAM,KAAK;AAC9B,MAAE;EACJ;AAGA,QAAM,MAAM,IAAI,WAAY,MAAM,cAAc,IAAK,CAAC;AAGtD,MAAI,OAAO;AACX,MAAI,SAAS;AACb,MAAI,UAAU;AACd,WAAS,IAAI,GAAG,IAAI,KAAK,EAAE,GAAG;AAE5B,UAAM,QAAQ,YAAY,OAAO,CAAC,CAAC;AACnC,QAAI,UAAU,QAAW;AACvB,YAAM,IAAI,YAAY,OAAOA,KAAI,YAAY;IAC/C;AAGA,aAAU,UAAU,cAAe;AACnC,YAAQ;AAGR,QAAI,QAAQ,GAAG;AACb,cAAQ;AACR,UAAI,SAAS,IAAI,MAAQ,UAAU;IACrC;EACF;AAGA,MAAI,QAAQ,gBAAgB,MAAQ,UAAW,IAAI,UAAY,GAAG;AAChE,UAAM,IAAI,YAAY,wBAAwB;EAChD;AAEA,SAAO;AACT;AAEA,SAAS,OAAQ,MAAkBI,WAAkB,aAAmB;AACtE,QAAM,MAAMA,UAASA,UAAS,SAAS,CAAC,MAAM;AAC9C,QAAM,QAAQ,KAAK,eAAe;AAClC,MAAI,MAAM;AAEV,MAAI,OAAO;AACX,MAAI,SAAS;AACb,WAAS,IAAI,GAAG,IAAI,KAAK,QAAQ,EAAE,GAAG;AAEpC,aAAU,UAAU,IAAK,KAAK,CAAC;AAC/B,YAAQ;AAGR,WAAO,OAAO,aAAa;AACzB,cAAQ;AACR,aAAOA,UAAS,OAAQ,UAAU,IAAK;IACzC;EACF;AAGA,MAAI,SAAS,GAAG;AACd,WAAOA,UAAS,OAAQ,UAAW,cAAc,IAAM;EACzD;AAGA,MAAI,KAAK;AACP,YAAS,IAAI,SAAS,cAAe,OAAO,GAAG;AAC7C,aAAO;IACT;EACF;AAEA,SAAO;AACT;AAEA,SAAS,kBAAmBA,WAAgB;AAE1C,QAAM,cAAsC,CAAA;AAC5C,WAAS,IAAI,GAAG,IAAIA,UAAS,QAAQ,EAAE,GAAG;AACxC,gBAAYA,UAAS,CAAC,CAAC,IAAI;EAC7B;AACA,SAAO;AACT;AAKM,SAAU,QAAsD,EAAE,MAAAJ,OAAM,QAAQ,aAAa,UAAAI,UAAQ,GAAyE;AAClL,QAAM,cAAc,kBAAkBA,SAAQ;AAC9C,SAAO,KAAK;IACV;IACA,MAAAJ;IACA,OAAQ,OAAiB;AACvB,aAAO,OAAO,OAAOI,WAAU,WAAW;IAC5C;IACA,OAAQ,OAAa;AACnB,aAAO,OAAO,OAAO,aAAa,aAAaJ,KAAI;IACrD;GACD;AACH;;;AH9OO,IAAM,SAAS,MAAM;EAC1B,QAAQ;EACR,MAAM;EACN,UAAU;CACX;;;AIND;;;;;AAEO,IAAM,SAAS,QAAQ;EAC5B,QAAQ;EACR,MAAM;EACN,UAAU;EACV,aAAa;CACd;AAEM,IAAM,cAAc,QAAQ;EACjC,QAAQ;EACR,MAAM;EACN,UAAU;EACV,aAAa;CACd;;;ACdD;;;;AAEO,IAAM,QAAQ,QAAQ;EAC3B,QAAQ;EACR,MAAM;EACN,UAAU;EACV,aAAa;CACd;;;ACPD;;;;AAEA,IAAM,WAAW,MAAM,KAAK,orEAAwe;AACpgB,IAAM,uBAAkC,SAAS,OAAiB,CAAC,GAAG,GAAG,MAAK;AAAG,IAAE,CAAC,IAAI;AAAG,SAAO;AAAE,GAAI,CAAA,CAAG;AAC3G,IAAM,uBAAkC,SAAS,OAAiB,CAAC,GAAG,GAAG,MAAK;AAC5E,QAAM,YAAY,EAAE,YAAY,CAAC;AACjC,MAAI,aAAa,MAAM;AACrB,UAAM,IAAI,MAAM,sBAAsB,CAAC,EAAE;EAC3C;AACA,IAAE,SAAS,IAAI;AACf,SAAO;AACT,GAAI,CAAA,CAAG;AAEP,SAASK,QAAQ,MAAgB;AAC/B,SAAO,KAAK,OAAO,CAAC,GAAG,MAAK;AAC1B,SAAK,qBAAqB,CAAC;AAC3B,WAAO;EACT,GAAG,EAAE;AACP;AAEA,SAASC,QAAQ,KAAW;AAC1B,QAAM,OAAO,CAAA;AACb,aAAW,QAAQ,KAAK;AACtB,UAAM,YAAY,KAAK,YAAY,CAAC;AACpC,QAAI,aAAa,MAAM;AACrB,YAAM,IAAI,MAAM,sBAAsB,IAAI,EAAE;IAC9C;AACA,UAAM,MAAM,qBAAqB,SAAS;AAC1C,QAAI,OAAO,MAAM;AACf,YAAM,IAAI,MAAM,+BAA+B,IAAI,EAAE;IACvD;AACA,SAAK,KAAK,GAAG;EACf;AACA,SAAO,IAAI,WAAW,IAAI;AAC5B;AAEO,IAAM,eAAe,KAAK;EAC/B,QAAQ;EACR,MAAM;EACN,QAAAD;EACA,QAAAC;CACD;;;ACzCD;;;;;;;;;;;;AAEO,IAAM,SAAS,QAAQ;EAC5B,QAAQ;EACR,MAAM;EACN,UAAU;EACV,aAAa;CACd;AAEM,IAAM,cAAc,QAAQ;EACjC,QAAQ;EACR,MAAM;EACN,UAAU;EACV,aAAa;CACd;AAEM,IAAM,YAAY,QAAQ;EAC/B,QAAQ;EACR,MAAM;EACN,UAAU;EACV,aAAa;CACd;AAEM,IAAM,iBAAiB,QAAQ;EACpC,QAAQ;EACR,MAAM;EACN,UAAU;EACV,aAAa;CACd;AAEM,IAAM,YAAY,QAAQ;EAC/B,QAAQ;EACR,MAAM;EACN,UAAU;EACV,aAAa;CACd;AAEM,IAAM,iBAAiB,QAAQ;EACpC,QAAQ;EACR,MAAM;EACN,UAAU;EACV,aAAa;CACd;AAEM,IAAM,eAAe,QAAQ;EAClC,QAAQ;EACR,MAAM;EACN,UAAU;EACV,aAAa;CACd;AAEM,IAAM,oBAAoB,QAAQ;EACvC,QAAQ;EACR,MAAM;EACN,UAAU;EACV,aAAa;CACd;AAEM,IAAM,UAAU,QAAQ;EAC7B,QAAQ;EACR,MAAM;EACN,UAAU;EACV,aAAa;CACd;;;AC/DD;;;;;AAEO,IAAM,SAAS,MAAM;EAC1B,QAAQ;EACR,MAAM;EACN,UAAU;CACX;AAEM,IAAM,cAAc,MAAM;EAC/B,QAAQ;EACR,MAAM;EACN,UAAU;CACX;;;ACZD;;;;;AAEO,IAAM,YAAY,MAAM;EAC7B,MAAM;EACN,QAAQ;EACR,UAAU;CACX;AAEM,IAAM,eAAe,MAAM;EAChC,MAAM;EACN,QAAQ;EACR,UAAU;CACX;;;ACZD;;;;;;;AAEO,IAAM,SAAS,QAAQ;EAC5B,QAAQ;EACR,MAAM;EACN,UAAU;EACV,aAAa;CACd;AAEM,IAAM,YAAY,QAAQ;EAC/B,QAAQ;EACR,MAAM;EACN,UAAU;EACV,aAAa;CACd;AAEM,IAAM,YAAY,QAAQ;EAC/B,QAAQ;EACR,MAAM;EACN,UAAU;EACV,aAAa;CACd;AAEM,IAAM,eAAe,QAAQ;EAClC,QAAQ;EACR,MAAM;EACN,UAAU;EACV,aAAa;CACd;;;AC5BD;;;;AAEO,IAAM,QAAQ,QAAQ;EAC3B,QAAQ;EACR,MAAM;EACN,UAAU;EACV,aAAa;CACd;;;ACPD;;;;AAGO,IAAM,WAAW,KAAK;EAC3B,QAAQ;EACR,MAAM;EACN,QAAQ,CAAC,QAAQ,SAAS,GAAG;EAC7B,QAAQ,CAAC,QAAQ,WAAW,GAAG;CAChC;;;ACND,IAAM,cAAc,IAAI,YAAW;AACnC,IAAM,cAAc,IAAI,YAAW;;;ACC5B,IAAM,OAAO;;;ACJpB,IAAAC,oBAAA;SAAAA,mBAAA;kBAAAC;;;;ACCA,IAAI,WAAWC;AAEf,IAAI,MAAM;AAAV,IACI,OAAO;AADX,IAEI,SAAS,CAAC;AAFd,IAGI,MAAM,KAAK,IAAI,GAAG,EAAE;AAOxB,SAASA,QAAO,KAAK,KAAK,QAAM;AAC9B,QAAM,OAAO,CAAA;AACb,WAAS,UAAU;AACnB,MAAI,YAAY;AAEhB,SAAM,OAAO,KAAK;AAChB,QAAI,QAAQ,IAAK,MAAM,MAAQ;AAC/B,WAAO;EACT;AACA,SAAM,MAAM,QAAQ;AAClB,QAAI,QAAQ,IAAK,MAAM,MAAQ;AAC/B,aAAS;EACX;AACA,MAAI,MAAM,IAAI,MAAM;AAGpB,EAAAA,QAAO,QAAQ,SAAS,YAAY;AAEpC,SAAO;AACT;AAEA,IAAIC,UAAS;AAEb,IAAI,QAAQ;AAAZ,IACI,SAAS;AAMb,SAAS,KAAK,KAAK,QAAM;AACvB,MAAI,MAAS,GACT,SAAS,UAAU,GACnB,QAAS,GACT,UAAU,QACV,GACA,IAAI,IAAI;AAEZ,KAAG;AACD,QAAI,WAAW,GAAG;AAEhB,WAAK,QAAQ;AACb,YAAM,IAAI,WAAW,yBAAyB;IAChD;AACA,QAAI,IAAI,SAAS;AACjB,WAAO,QAAQ,MACV,IAAI,WAAW,SACf,IAAI,UAAU,KAAK,IAAI,GAAG,KAAK;AACpC,aAAS;EACX,SAAS,KAAK;AAGd,OAAK,QAAQ,UAAU;AAEvB,SAAO;AACT;AAEA,IAAI,KAAK,KAAK,IAAI,GAAI,CAAC;AACvB,IAAI,KAAK,KAAK,IAAI,GAAG,EAAE;AACvB,IAAI,KAAK,KAAK,IAAI,GAAG,EAAE;AACvB,IAAI,KAAK,KAAK,IAAI,GAAG,EAAE;AACvB,IAAI,KAAK,KAAK,IAAI,GAAG,EAAE;AACvB,IAAI,KAAK,KAAK,IAAI,GAAG,EAAE;AACvB,IAAI,KAAK,KAAK,IAAI,GAAG,EAAE;AACvB,IAAI,KAAK,KAAK,IAAI,GAAG,EAAE;AACvB,IAAI,KAAK,KAAK,IAAI,GAAG,EAAE;AAEvB,IAAI,SAAS,SAAgC,OAAK;AAChD,SACE,QAAQ,KAAK,IACb,QAAQ,KAAK,IACb,QAAQ,KAAK,IACb,QAAQ,KAAK,IACb,QAAQ,KAAK,IACb,QAAQ,KAAK,IACb,QAAQ,KAAK,IACb,QAAQ,KAAK,IACb,QAAQ,KAAK,IACA;AAEjB;AAEA,IAAI,SAAS;EACT,QAAQ;EACR,QAAQA;EACR,gBAAgB;;AAGpB,IAAI,eAAe;AAEnB,IAAA,iBAAe;;;ACrGT,SAAUC,QAAQ,MAAkB,SAAS,GAAC;AAClD,QAAMC,QAAO,eAAO,OAAO,MAAM,MAAM;AACvC,SAAO,CAACA,OAAM,eAAO,OAAO,KAAK;AACnC;AAEM,SAAU,SAAU,KAAa,QAAoB,SAAS,GAAC;AACnE,iBAAO,OAAO,KAAK,QAAQ,MAAM;AACjC,SAAO;AACT;AAEM,SAAU,eAAgB,KAAW;AACzC,SAAO,eAAO,eAAe,GAAG;AAClC;;;ACPM,SAAU,OAA8BC,OAAYC,SAAkB;AAC1E,QAAM,OAAOA,QAAO;AACpB,QAAM,aAAoB,eAAeD,KAAI;AAC7C,QAAM,eAAe,aAAoB,eAAe,IAAI;AAE5D,QAAME,SAAQ,IAAI,WAAW,eAAe,IAAI;AAChD,EAAO,SAASF,OAAME,QAAO,CAAC;AAC9B,EAAO,SAAS,MAAMA,QAAO,UAAU;AACvC,EAAAA,OAAM,IAAID,SAAQ,YAAY;AAE9B,SAAO,IAAI,OAAOD,OAAM,MAAMC,SAAQC,MAAK;AAC7C;AAKM,SAAUC,QAAQ,WAAqB;AAC3C,QAAMD,SAAQ,OAAO,SAAS;AAC9B,QAAM,CAACF,OAAM,UAAU,IAAWG,QAAOD,MAAK;AAC9C,QAAM,CAAC,MAAM,YAAY,IAAWC,QAAOD,OAAM,SAAS,UAAU,CAAC;AACrE,QAAMD,UAASC,OAAM,SAAS,aAAa,YAAY;AAEvD,MAAID,QAAO,eAAe,MAAM;AAC9B,UAAM,IAAI,MAAM,kBAAkB;EACpC;AAEA,SAAO,IAAI,OAAOD,OAAM,MAAMC,SAAQC,MAAK;AAC7C;AAEM,SAAUE,QAAQ,GAAoB,GAAU;AACpD,MAAI,MAAM,GAAG;AACX,WAAO;EACT,OAAO;AACL,UAAM,OAAO;AAEb,WACE,EAAE,SAAS,KAAK,QAChB,EAAE,SAAS,KAAK,QAChB,KAAK,iBAAiB,cACtB,OAAW,EAAE,OAAO,KAAK,KAAK;EAElC;AACF;AAMM,IAAO,SAAP,MAAa;;;;EASjB,YAAaJ,OAAY,MAAYC,SAAoBC,QAAiB;AARjE;AACA;AACA;AACA;AAMP,SAAK,OAAOF;AACZ,SAAK,OAAO;AACZ,SAAK,SAASC;AACd,SAAK,QAAQC;EACf;;;;AHjEF,IAAMG,QAAY;AAClB,IAAM,OAAO;AAEb,IAAMC,UAA4C;AAElD,SAAS,OAAQ,OAAmB,SAAuB;AACzD,MAAI,SAAS,YAAY,QAAQ,QAAQ,aAAa,MAAM,YAAY;AACtE,QAAI,QAAQ,WAAW,KAAK,QAAQ,WAAW,MAAM,YAAY;AAC/D,YAAM,IAAI,MAAM,0DAA0D,MAAM,UAAU,EAAE;IAC9F;AAEA,YAAQ,MAAM,SAAS,GAAG,QAAQ,QAAQ;EAC5C;AAEA,SAAc,OAAOD,OAAMC,QAAO,KAAK,CAAC;AAC1C;AAEO,IAAMC,YAAW,EAAE,MAAAF,OAAM,MAAM,QAAAC,SAAQ,OAAM;;;AIrBpD;;;;;;;ACKA,IAAM,4BAA4B;AAqB5B,SAAUE,MAAiD,EAAE,MAAAC,OAAM,MAAAC,OAAM,QAAAC,SAAQ,iBAAiB,gBAAe,GAA0B;AAC/I,SAAO,IAAI,OAAOF,OAAMC,OAAMC,SAAQ,iBAAiB,eAAe;AACxE;AAoBM,IAAO,SAAP,MAAa;EAOjB,YAAaF,OAAYC,OAAYC,SAAkD,iBAA0B,iBAAwB;AANhI;AACA;AACA;AACA;AACA;AAGP,SAAK,OAAOF;AACZ,SAAK,OAAOC;AACZ,SAAK,SAASC;AACd,SAAK,kBAAkB,mBAAmB;AAC1C,SAAK,kBAAkB;EACzB;EAEA,OAAQ,OAAmB,SAAuB;AAChD,QAAI,SAAS,YAAY,MAAM;AAC7B,UAAI,QAAQ,WAAW,KAAK,iBAAiB;AAC3C,cAAM,IAAI,MAAM,6DAA6D,KAAK,eAAe,EAAE;MACrG;AAEA,UAAI,KAAK,mBAAmB,QAAQ,QAAQ,WAAW,KAAK,iBAAiB;AAC3E,cAAM,IAAI,MAAM,0DAA0D,KAAK,eAAe,EAAE;MAClG;IACF;AAEA,QAAI,iBAAiB,YAAY;AAC/B,YAAM,SAAS,KAAK,OAAO,KAAK;AAEhC,UAAI,kBAAkB,YAAY;AAChC,eAAO,aAAa,QAAQ,KAAK,MAAM,SAAS,QAAQ;MAC1D;AAEA,aAAO,OAAO,KAAK,CAAAC,YAAU,aAAaA,SAAQ,KAAK,MAAM,SAAS,QAAQ,CAAC;IACjF,OAAO;AACL,YAAM,MAAM,mCAAmC;IAEjD;EACF;;AAOF,SAAS,aAAoCA,SAAoBF,OAAY,UAAiB;AAC5F,MAAI,YAAY,QAAQ,aAAaE,QAAO,YAAY;AACtD,QAAI,WAAWA,QAAO,YAAY;AAChC,YAAM,IAAI,MAAM,0DAA0DA,QAAO,UAAU,EAAE;IAC/F;AAEA,IAAAA,UAASA,QAAO,SAAS,GAAG,QAAQ;EACtC;AAEA,SAAc,OAAOF,OAAME,OAAM;AACnC;;;ADnGA,SAAS,IAAKC,OAAyB;AACrC,SAAO,OAAM,SAAQ,IAAI,WAAW,MAAM,OAAO,OAAO,OAAOA,OAAM,IAAI,CAAC;AAC5E;AAEO,IAAM,SAASC,MAAK;EACzB,MAAM;EACN,MAAM;EACN,QAAQ,IAAI,SAAS;CACtB;AAEM,IAAM,SAASA,MAAK;EACzB,MAAM;EACN,MAAM;EACN,QAAQ,IAAI,SAAS;CACtB;;;AEPK,SAAU,OAA0F,MAASC,OAAmC;AACpJ,QAAM,EAAE,OAAAC,QAAO,QAAO,IAAK;AAC3B,UAAQ,SAAS;IACf,KAAK;AACH,aAAO,WACLA,QACA,UAAU,IAAI,GACdD,SAAqC,UAAU,OAAO;IAE1D;AACE,aAAO,WACLC,QACA,UAAU,IAAI,GACbD,SAAQ,OAAO,OAAwC;EAE9D;AACF;AAYA,IAAM,QAAQ,oBAAI,QAAO;AAEzB,SAAS,UAAWE,MAAoB;AACtC,QAAMC,aAAY,MAAM,IAAID,IAAG;AAC/B,MAAIC,cAAa,MAAM;AACrB,UAAMA,aAAY,oBAAI,IAAG;AACzB,UAAM,IAAID,MAAKC,UAAS;AACxB,WAAOA;EACT;AACA,SAAOA;AACT;AAjDA;AAmDM,IAAO,MAAP,MAAO,KAAG;;;;;;EAYd,YAAa,SAAkBC,OAAc,WAAqCC,QAAiB;AAX1F;AACA;AACA;AACA;AACA;AAmHA,wBAAC,IAAsB;AA3G9B,SAAK,OAAOD;AACZ,SAAK,UAAU;AACf,SAAK,YAAY;AACjB,SAAK,QAAQC;AAIb,SAAK,GAAG,IAAIA;EACd;;;;;;;EAQA,IAAI,QAAK;AACP,WAAO;EACT;;EAGA,IAAI,aAAU;AACZ,WAAO,KAAK,MAAM;EACpB;;EAGA,IAAI,aAAU;AACZ,WAAO,KAAK,MAAM;EACpB;EAEA,OAAI;AACF,YAAQ,KAAK,SAAS;MACpB,KAAK,GAAG;AACN,eAAO;MACT;MACA,KAAK,GAAG;AACN,cAAM,EAAE,MAAAD,OAAM,UAAS,IAAK;AAE5B,YAAIA,UAAS,aAAa;AACxB,gBAAM,IAAI,MAAM,0CAA0C;QAC5D;AAGA,YAAI,UAAU,SAAS,cAAc;AACnC,gBAAM,IAAI,MAAM,oDAAoD;QACtE;AAEA,eACE,KAAI,SACF,SAA6C;MAGnD;MACA,SAAS;AACP,cAAM,MACJ,+BAA+B,KAAK,OAAO,4CAA4C;MAE3F;IACF;EACF;EAEA,OAAI;AACF,YAAQ,KAAK,SAAS;MACpB,KAAK,GAAG;AACN,cAAM,EAAE,MAAAA,OAAM,QAAAE,QAAM,IAAK,KAAK;AAC9B,cAAM,YAAmB,OAAOF,OAAME,OAAM;AAC5C,eACE,KAAI,SAAS,KAAK,MAAM,SAAS;MAErC;MACA,KAAK,GAAG;AACN,eAAO;MACT;MACA,SAAS;AACP,cAAM,MACJ,+BAA+B,KAAK,OAAO,4CAA4C;MAE3F;IACF;EACF;EAEA,OAAQ,OAAc;AACpB,WAAO,KAAI,OAAO,MAAM,KAAK;EAC/B;EAEA,OAAO,OAAsF,MAA4C,OAAc;AACrJ,UAAM,UAAU;AAChB,WACE,WAAW,QACX,KAAK,SAAS,QAAQ,QACtB,KAAK,YAAY,QAAQ,WAClBC,QAAO,KAAK,WAAW,QAAQ,SAAS;EAEnD;EAEA,SAAUC,OAAmC;AAC3C,WAAO,OAAO,MAAMA,KAAI;EAC1B;EAEA,SAAM;AACJ,WAAO,EAAE,KAAK,OAAO,IAAI,EAAC;EAC5B;EAEA,OAAI;AACF,WAAO;EACT;;EAMA,EAJU,YAAO,aAIhB,uBAAO,IAAI,4BAA4B,EAAC,IAAC;AACxC,WAAO,OAAO,KAAK,SAAQ,CAAE;EAC/B;;;;;;;;;;;EAYA,OAAO,MAAwF,OAA+C;AAC5I,QAAI,SAAS,MAAM;AACjB,aAAO;IACT;AAEA,UAAM,QAAQ;AACd,QAAI,iBAAiB,MAAK;AAExB,aAAO;IACT,WAAY,MAAM,GAAG,KAAK,QAAQ,MAAM,GAAG,MAAM,MAAM,SAAU,MAAM,UAAU,OAAO;AAMtF,YAAM,EAAE,SAAS,MAAAJ,OAAM,WAAW,OAAAC,OAAK,IAAK;AAC5C,aAAO,IAAI,KACT,SACAD,OACA,WACAC,UAAS,UAAU,SAASD,OAAM,UAAU,KAAK,CAAC;IAEtD,WAAW,MAAM,SAAS,MAAM,MAAM;AAIpC,YAAM,EAAE,SAAS,WAAW,MAAAA,MAAI,IAAK;AACrC,YAAME,UAAgBG,QAAO,SAAS;AACtC,aAAO,KAAI,OAAO,SAASL,OAAME,OAAM;IACzC,OAAO;AAGL,aAAO;IACT;EACF;;;;;;EAOA,OAAO,OAAsF,SAAkBF,OAAcE,SAAgC;AAC3J,QAAI,OAAOF,UAAS,UAAU;AAC5B,YAAM,IAAI,MAAM,uCAAuC;IACzD;AAEA,QAAI,EAAEE,QAAO,iBAAiB,aAAa;AACzC,YAAM,IAAI,MAAM,gBAAgB;IAClC;AAEA,YAAQ,SAAS;MACf,KAAK,GAAG;AACN,YAAIF,UAAS,aAAa;AACxB,gBAAM,IAAI,MACR,wCAAwC,WAAW,kBAAkB;QAEzE,OAAO;AACL,iBAAO,IAAI,KAAI,SAASA,OAAME,SAAQA,QAAO,KAAK;QACpD;MACF;MACA,KAAK,GAAG;AACN,cAAMD,SAAQ,UAAU,SAASD,OAAME,QAAO,KAAK;AACnD,eAAO,IAAI,KAAI,SAASF,OAAME,SAAQD,MAAK;MAC7C;MACA,SAAS;AACP,cAAM,IAAI,MAAM,iBAAiB;MACnC;IACF;EACF;;;;EAKA,OAAO,SAAuBC,SAAgD;AAC5E,WAAO,KAAI,OAAO,GAAG,aAAaA,OAAM;EAC1C;;;;;;;EAQA,OAAO,SAAyDF,OAAYE,SAAgC;AAC1G,WAAO,KAAI,OAAO,GAAGF,OAAME,OAAM;EACnC;;;;;;;;EASA,OAAO,OAAoFD,QAAuD;AAChJ,UAAM,CAACH,MAAK,SAAS,IAAI,KAAI,YAAYG,MAAK;AAC9C,QAAI,UAAU,WAAW,GAAG;AAC1B,YAAM,IAAI,MAAM,kBAAkB;IACpC;AACA,WAAOH;EACT;;;;;;;;;;EAWA,OAAO,YAA2EG,QAAyC;AACzH,UAAM,QAAQ,KAAI,aAAaA,MAAK;AACpC,UAAM,aAAa,MAAM,OAAO,MAAM;AACtC,UAAM,iBAAiB,OACrBA,OAAM,SAAS,YAAY,aAAa,MAAM,aAAa,CAAC;AAE9D,QAAI,eAAe,eAAe,MAAM,eAAe;AACrD,YAAM,IAAI,MAAM,kBAAkB;IACpC;AACA,UAAM,cAAc,eAAe,SACjC,MAAM,gBAAgB,MAAM,UAAU;AAExC,UAAMC,UAAS,IAAW,OACxB,MAAM,eACN,MAAM,YACN,aACA,cAAc;AAEhB,UAAMJ,OACJ,MAAM,YAAY,IACd,KAAI,SAASI,OAA0C,IACvD,KAAI,SAAS,MAAM,OAAOA,OAAM;AACtC,WAAO,CAACJ,MAAwBG,OAAM,SAAS,MAAM,IAAI,CAAC;EAC5D;;;;;;;;;;EAWA,OAAO,aAA4E,cAAgD;AACjI,QAAI,SAAS;AACb,UAAM,OAAO,MAAa;AACxB,YAAM,CAAC,GAAGK,OAAM,IAAWD,QAAO,aAAa,SAAS,MAAM,CAAC;AAC/D,gBAAUC;AACV,aAAO;IACT;AAEA,QAAI,UAAU,KAAI;AAClB,QAAI,QAAQ;AACZ,QAAI,YAAsB,IAAI;AAE5B,gBAAU;AACV,eAAS;IACX,OAAO;AACL,cAAQ,KAAI;IACd;AAEA,QAAI,YAAY,KAAK,YAAY,GAAG;AAClC,YAAM,IAAI,WAAW,uBAAuB,OAAO,EAAE;IACvD;AAEA,UAAM,aAAa;AACnB,UAAM,gBAAgB,KAAI;AAC1B,UAAM,aAAa,KAAI;AACvB,UAAM,OAAO,SAAS;AACtB,UAAM,gBAAgB,OAAO;AAE7B,WAAO,EAAE,SAAS,OAAO,eAAe,YAAY,eAAe,KAAI;EACzE;;;;;;;EAQA,OAAO,MAA0G,QAAkEF,OAAmC;AACpN,UAAM,CAAC,QAAQH,MAAK,IAAI,gBAAgB,QAAQG,KAAI;AAEpD,UAAMN,OAAM,KAAI,OAAOG,MAAK;AAE5B,QAAIH,KAAI,YAAY,KAAK,OAAO,CAAC,MAAM,KAAK;AAC1C,YAAM,MAAM,wDAAwD;IACtE;AAGA,cAAUA,IAAG,EAAE,IAAI,QAAQ,MAAM;AAEjC,WAAOA;EACT;;AAGF,SAAS,gBAAqH,QAAkEM,OAAmC;AACjO,UAAQ,OAAO,CAAC,GAAG;;IAEjB,KAAK,KAAK;AACR,YAAM,UAAUA,SAAQ;AACxB,aAAO;QACL,UAAU;QACV,QAAQ,OAAO,GAAG,UAAU,MAAM,GAAG,MAAM,EAAE;;IAEjD;IACA,KAAK,UAAU,QAAQ;AACrB,YAAM,UAAUA,SAAQ;AACxB,aAAO,CAAC,UAAU,QAAkB,QAAQ,OAAO,MAAM,CAAC;IAC5D;IACA,KAAK,OAAO,QAAQ;AAClB,YAAM,UAAUA,SAAQ;AACxB,aAAO,CAAC,OAAO,QAAkB,QAAQ,OAAO,MAAM,CAAC;IACzD;IACA,KAAK,OAAO,QAAQ;AAClB,YAAM,UAAUA,SAAQ;AACxB,aAAO,CAAC,OAAO,QAAkB,QAAQ,OAAO,MAAM,CAAC;IACzD;IACA,SAAS;AACP,UAAIA,SAAQ,MAAM;AAChB,cAAM,MACJ,yFAAyF;MAE7F;AACA,aAAO,CAAC,OAAO,CAAC,GAAaA,MAAK,OAAO,MAAM,CAAC;IAClD;EACF;AACF;AAEA,SAAS,WAAYH,QAAmBM,QAA4BH,OAA+B;AACjG,QAAM,EAAE,OAAM,IAAKA;AACnB,MAAI,WAAW,UAAU,QAAQ;AAC/B,UAAM,MAAM,8BAA8BA,MAAK,IAAI,WAAW;EAChE;AAEA,QAAMN,OAAMS,OAAM,IAAI,MAAM;AAC5B,MAAIT,QAAO,MAAM;AACf,UAAMA,OAAMM,MAAK,OAAOH,MAAK,EAAE,MAAM,CAAC;AACtC,IAAAM,OAAM,IAAI,QAAQT,IAAG;AACrB,WAAOA;EACT,OAAO;AACL,WAAOA;EACT;AACF;AAEA,SAAS,WAAoCG,QAAmBM,QAA4BH,OAAkC;AAC5H,QAAM,EAAE,OAAM,IAAKA;AACnB,QAAMN,OAAMS,OAAM,IAAI,MAAM;AAC5B,MAAIT,QAAO,MAAM;AACf,UAAMA,OAAMM,MAAK,OAAOH,MAAK;AAC7B,IAAAM,OAAM,IAAI,QAAQT,IAAG;AACrB,WAAOA;EACT,OAAO;AACL,WAAOA;EACT;AACF;AAEA,IAAM,cAAc;AACpB,IAAM,eAAe;AAErB,SAAS,UAAW,SAAsBE,OAAc,WAAqB;AAC3E,QAAM,aAAoB,eAAe,OAAO;AAChD,QAAM,aAAa,aAAoB,eAAeA,KAAI;AAC1D,QAAMC,SAAQ,IAAI,WAAW,aAAa,UAAU,UAAU;AAC9D,EAAO,SAAS,SAASA,QAAO,CAAC;AACjC,EAAO,SAASD,OAAMC,QAAO,UAAU;AACvC,EAAAA,OAAM,IAAI,WAAW,UAAU;AAC/B,SAAOA;AACT;AAEA,IAAM,YAAY,uBAAO,IAAI,kBAAkB;;;AC7bxC,IAAM,QAAQ,EAAE,GAAG,kBAAc,GAAG,eAAO,GAAG,eAAO,GAAG,gBAAQ,GAAG,gBAAQ,GAAG,gBAAQ,GAAG,gBAAQ,GAAG,gBAAQ,GAAG,gBAAQ,GAAG,qBAAY;AACtI,IAAM,SAAS,EAAE,GAAG,sBAAM,GAAGO,kBAAQ;;;ACgC5C,IAAAC,kBAAwB;;;ACjDxB,IAAAC,uBASO;AACP,IAAAC,kBAAwB;AACxB,IAAAC,iBAAuB;;;ACXvB,qBAAwB;AACxB,oBAAuB;AACvB,oBAAuB;AAOvB,IAAM,kBAAkB;AACxB,IAAM,gBAAgB;AACtB,IAAM,gBAAgB;AACtB,IAAM,kBAAkB;AACxB,IAAM,2BAA2B,MAAM;AAChC,IAAM,0BAA0B,MAAM,OAAO;AAE7C,IAAM,iCAAiC,0BAA0B;AAEjE,IAAM,2BACX,KAAK,KAAM,iCAAiC,IAAK,CAAC,IAAI,IAAI,OAAO;AACnE,IAAM,6BAA6B;AAqG5B,IAAM,qBAAN,cAAiC,MAAM;AAAA,EAY5C,YAAYC,OAAkC,SAAiB;AAC7D,UAAM,OAAO;AACb,SAAK,OAAO;AACZ,SAAK,OAAOA;AAAA,EACd;AACF;AAEA,SAAS,iBAAiBC,QAA2B;AACnD,MAAI,SAAS;AACb,aAAW,QAAQA,OAAO,WAAU,OAAO,aAAa,IAAI;AAC5D,QAAM,UAAU,OAAO,SAAS,aAC5B,KAAK,MAAM,IACX,OAAO,KAAKA,MAAK,EAAE,SAAS,QAAQ;AACxC,SAAO,QAAQ,QAAQ,OAAO,GAAG,EAAE,QAAQ,OAAO,GAAG,EAAE,QAAQ,QAAQ,EAAE;AAC3E;AAEA,SAAS,iBAAiB,OAA2B;AACnD,MAAI,CAAC,mBAAmB,KAAK,KAAK,KAAK,MAAM,SAAS,MAAM,GAAG;AAC7D,UAAM,IAAI,mBAAmB,gBAAgB,yBAAyB;AAAA,EACxE;AACA,QAAM,SAAS,MAAM,QAAQ,MAAM,GAAG,EAAE,QAAQ,MAAM,GAAG,IAAI,IAAI,QAAQ,IAAI,MAAM,SAAS,KAAK,CAAC;AAClG,QAAM,UAAU,OAAO,SAAS,cAC3B,MAAM;AACL,UAAM,SAAS,KAAK,MAAM;AAC1B,WAAO,WAAW,KAAK,QAAQ,CAAC,SAAS,KAAK,WAAW,CAAC,CAAC;AAAA,EAC7D,GAAG,IACH,IAAI,WAAW,OAAO,KAAK,QAAQ,QAAQ,CAAC;AAChD,MAAI,iBAAiB,OAAO,MAAM,MAAO,OAAM,IAAI,mBAAmB,gBAAgB,yBAAyB;AAC/G,SAAO;AACT;AAEA,SAAS,WAAW,OAAe,SAA4B,OAAqB;AAClF,QAAM,YAAY,IAAI,IAAI,OAAO;AACjC,aAAW,OAAO,OAAO,KAAK,KAAK,EAAG,KAAI,CAAC,UAAU,IAAI,GAAG,EAAG,OAAM,IAAI,mBAAmB,oBAAoB,GAAG,KAAK,4BAA4B;AACtJ;AAEA,SAAS,cAAc,OAAwB;AAC7C,MAAI,UAAU,QAAQ,OAAO,UAAU,YAAY,OAAO,UAAU,WAAW;AAC7E,WAAO,KAAK,UAAU,KAAK;AAAA,EAC7B;AACA,MAAI,OAAO,UAAU,UAAU;AAC7B,QAAI,CAAC,OAAO,SAAS,KAAK,EAAG,OAAM,IAAI,mBAAmB,oBAAoB,mBAAmB;AACjG,WAAO,KAAK,UAAU,KAAK;AAAA,EAC7B;AACA,MAAI,MAAM,QAAQ,KAAK,EAAG,QAAO,IAAI,MAAM,IAAI,aAAa,EAAE,KAAK,GAAG,CAAC;AACvE,MAAI,OAAO,UAAU,UAAU;AAC7B,UAAM,SAAS;AACf,WAAO,IAAI,OAAO,KAAK,MAAM,EAAE,KAAK,EAAE,IAAI,CAAC,QAAQ,GAAG,KAAK,UAAU,GAAG,CAAC,IAAI,cAAc,OAAO,GAAG,CAAC,CAAC,EAAE,EAAE,KAAK,GAAG,CAAC;AAAA,EACtH;AACA,QAAM,IAAI,mBAAmB,oBAAoB,wBAAwB;AAC3E;AAEA,SAAS,eAAe,MAAc,OAAuB;AAC3D,MAAI,QAAQ;AACZ,SAAO,KAAK,KAAK,KAAK,KAAK,KAAK,EAAE,EAAG,UAAS;AAC9C,SAAO;AACT;AAEA,SAAS,cAAc,MAAc,OAAuB;AAC1D,MAAI,QAAQ,eAAe,MAAM,KAAK;AACtC,QAAM,QAAQ,KAAK,KAAK;AACxB,MAAI,UAAU,KAAK;AACjB,aAAS;AACT,WAAO,QAAQ,KAAK,QAAQ;AAC1B,UAAI,KAAK,KAAK,MAAM,KAAM,UAAS;AAAA,eAC1B,KAAK,OAAO,MAAM,IAAK,QAAO;AAAA,IACzC;AACA,UAAM,IAAI,mBAAmB,oBAAoB,0BAA0B;AAAA,EAC7E;AACA,MAAI,UAAU,KAAK;AACjB,UAAM,OAAO,oBAAI,IAAY;AAC7B,YAAQ,eAAe,MAAM,QAAQ,CAAC;AACtC,QAAI,KAAK,KAAK,MAAM,IAAK,QAAO,QAAQ;AACxC,WAAO,QAAQ,KAAK,QAAQ;AAC1B,cAAQ,eAAe,MAAM,KAAK;AAClC,UAAI,KAAK,KAAK,MAAM,IAAK,OAAM,IAAI,mBAAmB,oBAAoB,6BAA6B;AACvG,YAAM,WAAW;AACjB,cAAQ,cAAc,MAAM,KAAK;AACjC,YAAM,MAAM,KAAK,MAAM,KAAK,MAAM,UAAU,KAAK,CAAC;AAClD,UAAI,KAAK,IAAI,GAAG,EAAG,OAAM,IAAI,mBAAmB,oBAAoB,sBAAsB,GAAG,EAAE;AAC/F,WAAK,IAAI,GAAG;AACZ,cAAQ,eAAe,MAAM,KAAK;AAClC,UAAI,KAAK,OAAO,MAAM,IAAK,OAAM,IAAI,mBAAmB,oBAAoB,sBAAsB;AAClG,cAAQ,cAAc,MAAM,KAAK;AACjC,cAAQ,eAAe,MAAM,KAAK;AAClC,UAAI,KAAK,KAAK,MAAM,IAAK,QAAO,QAAQ;AACxC,UAAI,KAAK,OAAO,MAAM,IAAK,OAAM,IAAI,mBAAmB,oBAAoB,0BAA0B;AAAA,IACxG;AACA,UAAM,IAAI,mBAAmB,oBAAoB,0BAA0B;AAAA,EAC7E;AACA,MAAI,UAAU,KAAK;AACjB,YAAQ,eAAe,MAAM,QAAQ,CAAC;AACtC,QAAI,KAAK,KAAK,MAAM,IAAK,QAAO,QAAQ;AACxC,WAAO,QAAQ,KAAK,QAAQ;AAC1B,cAAQ,cAAc,MAAM,KAAK;AACjC,cAAQ,eAAe,MAAM,KAAK;AAClC,UAAI,KAAK,KAAK,MAAM,IAAK,QAAO,QAAQ;AACxC,UAAI,KAAK,OAAO,MAAM,IAAK,OAAM,IAAI,mBAAmB,oBAAoB,yBAAyB;AAAA,IACvG;AACA,UAAM,IAAI,mBAAmB,oBAAoB,yBAAyB;AAAA,EAC5E;AACA,QAAM,QAAQ,KAAK,MAAM,KAAK,EAAE,MAAM,kEAAkE;AACxG,MAAI,CAAC,MAAO,OAAM,IAAI,mBAAmB,oBAAoB,oBAAoB;AACjF,SAAO,QAAQ,MAAM,CAAC,EAAE;AAC1B;AAEA,SAAS,mBAAmB,MAAuB;AACjD,MAAI;AACF,UAAM,MAAM,cAAc,MAAM,CAAC;AACjC,QAAI,eAAe,MAAM,GAAG,MAAM,KAAK,OAAQ,OAAM,IAAI,MAAM,eAAe;AAC9E,UAAM,SAAS,KAAK,MAAM,IAAI;AAC9B,QAAI,cAAc,MAAM,MAAM,KAAM,OAAM,IAAI,MAAM,oBAAoB;AACxE,WAAO;AAAA,EACT,SAAS,OAAO;AACd,QAAI,iBAAiB,mBAAoB,OAAM;AAC/C,UAAM,IAAI,mBAAmB,oBAAoB,iBAAiB,QAAQ,MAAM,UAAU,cAAc;AAAA,EAC1G;AACF;AAEA,SAAS,gBAAgB,OAAuB;AAC9C,MAAI;AACF,UAAM,MAAM,IAAI,IAAI,KAAK;AACzB,QAAI,CAAC,CAAC,SAAS,QAAQ,EAAE,SAAS,IAAI,QAAQ,KAAK,IAAI,YAAY,IAAI,YAAY,IAAI,UAAU,IAAI,MAAM;AACzG,YAAM,IAAI,MAAM,sCAAsC;AAAA,IACxD;AACA,WAAO,IAAI;AAAA,EACb,QAAQ;AACN,UAAM,IAAI,mBAAmB,oBAAoB,wBAAwB;AAAA,EAC3E;AACF;AAEA,SAAS,kBAAkB,UAAwC;AACjE,MAAI,SAAS,SAAS,WAAW,SAAS,SAAS,SAAU,OAAM,IAAI,mBAAmB,oBAAoB,uBAAuB;AACrI,MAAI,CAAC,SAAS,QAAQ,SAAS,KAAK,WAAW,GAAG,KAAK,0BAA0B,KAAK,SAAS,IAAI,KAAK,eAAe,KAAK,SAAS,IAAI,KAAK,SAAS,KAAK,MAAM,GAAG,EAAE,KAAK,CAAC,MAAM,OAAO,UAAU,SAAS,OAAO,SAAS,QAAS,KAAK,WAAW,KAAK,EAAE,SAAS,SAAS,YAAY,UAAU,MAAM,SAAS,EAAG,GAAG;AACxT,UAAM,IAAI,mBAAmB,oBAAoB,gCAAgC;AAAA,EACnF;AACA,SAAO,EAAE,MAAM,SAAS,MAAM,MAAM,SAAS,SAAS,YAAY,CAAC,SAAS,KAAK,SAAS,GAAG,IAAI,GAAG,SAAS,IAAI,MAAM,SAAS,KAAK;AACvI;AAEA,SAAS,iBAAiB,SAAgD;AACxE,QAAM,UAAU,oBAAI,IAAiB,CAAC,QAAQ,QAAQ,MAAM,CAAC;AAC7D,MAAI,QAAQ,WAAW,KAAK,IAAI,IAAI,OAAO,EAAE,SAAS,QAAQ,UAAU,QAAQ,KAAK,CAAC,WAAW,CAAC,QAAQ,IAAI,MAAM,CAAC,GAAG;AACtH,UAAM,IAAI,mBAAmB,oBAAoB,2CAA2C;AAAA,EAC9F;AACA,SAAO,CAAC,GAAG,OAAO,EAAE,KAAK,CAAC,GAAG,MAAM,EAAE,cAAc,CAAC,CAAC;AACvD;AAEA,SAAS,mBAAmB,WAA+E;AACzG,MAAI,cAAc,OAAW,QAAO;AACpC,MAAI,UAAU,SAAS,SAAU,QAAO,EAAE,MAAM,SAAS;AACzD,MAAI,OAAO,UAAU,UAAU,YAAY,UAAU,MAAM,WAAW,KAAK,SAAS,KAAK,UAAU,KAAK,GAAG;AACzG,UAAM,IAAI,mBAAmB,oBAAoB,4BAA4B;AAAA,EAC/E;AACA,MAAI,UAAU,SAAS,eAAe;AACpC,UAAM,SAAS,UAAU,MAAM,YAAY;AAC3C,QAAI,CAAC,6FAA6F,KAAK,MAAM,GAAG;AAC9G,YAAM,IAAI,mBAAmB,oBAAoB,6BAA6B;AAAA,IAChF;AACA,WAAO,EAAE,MAAM,UAAU,MAAM,OAAO,OAAO;AAAA,EAC/C;AACA,MAAI,UAAU,SAAS,gBAAgB;AACrC,QAAI,CAAC,wBAAwB,UAAU,KAAK,EAAG,OAAM,IAAI,mBAAmB,oBAAoB,0BAA0B;AAC1H,WAAO,EAAE,MAAM,UAAU,MAAM,OAAO,UAAU,MAAM;AAAA,EACxD;AAKA,QAAM,QAAQ,UAAU,MAAM,KAAK;AACnC,QAAM,KAAK,MAAM,YAAY,GAAG;AAChC,QAAM,kBAAkB,KAAK,IAAI,GAAG,MAAM,MAAM,GAAG,EAAE,CAAC,IAAI,MAAM,MAAM,KAAK,CAAC,EAAE,YAAY,CAAC,KAAK;AAChG,MAAI,UAAU,SAAS,gBAAgB,CAAC,oBAAoB,KAAK,eAAe,GAAG;AACjF,UAAM,IAAI,mBAAmB,oBAAoB,8BAA8B;AAAA,EACjF;AACA,SAAO,EAAE,MAAM,UAAU,MAAM,OAAO,gBAAgB;AACxD;AAEA,SAAS,wBAAwB,OAAwB;AACvD,MAAI,MAAM,WAAW,KAAK,MAAM,SAAS,QAAQ,wBAAwB,KAAK,KAAK,EAAG,QAAO;AAC7F,QAAM,QAAQ,MAAM,MAAM,GAAG;AAC7B,MAAI,MAAM,SAAS,KAAK,MAAM,CAAC,MAAM,SAAS,CAAC,cAAc,KAAK,MAAM,CAAC,KAAK,EAAE,EAAG,QAAO;AAC1F,QAAM,aAAa,MAAM,MAAM,CAAC;AAChC,MAAI,WAAW,KAAK,CAAC,SAAS,KAAK,WAAW,CAAC,EAAG,QAAO;AACzD,MAAI,MAAM,CAAC,MAAM,OAAO;AACtB,UAAM,OAAO,WAAW,CAAC,KAAK;AAC9B,QAAI,KAAK,SAAS,OAAO,KAAK,MAAM,GAAG,EAAE,KAAK,CAAC,UAAU,CAAC,SAAS,MAAM,SAAS,MAAM,CAAC,kBAAkB,KAAK,KAAK,KAAK,MAAM,WAAW,GAAG,KAAK,MAAM,SAAS,GAAG,CAAC,EAAG,QAAO;AAChL,WAAO,WAAW,MAAM,CAAC,EAAE,MAAM,CAAC,SAAS,qBAAqB,KAAK,IAAI,CAAC;AAAA,EAC5E;AACA,MAAI,MAAM,CAAC,MAAM,MAAO,QAAO,WAAW,UAAU,KAAK,WAAW,MAAM,CAAC,SAAS,qBAAqB,KAAK,IAAI,CAAC;AACnH,MAAI,MAAM,CAAC,MAAM,OAAO;AACtB,QAAI;AACF,YAAMA,SAAQ,UAAU,OAAO,WAAW,KAAK,GAAG,CAAC;AACnD,aAAOA,OAAM,WAAW,MAAMA,OAAM,CAAC,MAAM,OAAQA,OAAM,CAAC,MAAM;AAAA,IAClE,QAAQ;AACN,aAAO;AAAA,IACT;AAAA,EACF;AACA,SAAO;AACT;AAEO,SAAS,8BAA8B,WAAuD;AACnG,QAAM,aAAa,mBAAmB,SAAS;AAC/C,MAAI,eAAe,OAAW,OAAM,IAAI,mBAAmB,oBAAoB,+BAA+B;AAC9G,SAAO;AACT;AAEO,SAAS,uBAAuB,UAAwC;AAC7E,SAAO,kBAAkB,QAAQ;AACnC;AAEO,SAAS,sBAAsB,SAAgD;AACpF,SAAO,iBAAiB,OAAO;AACjC;AAEA,SAAS,iBAAiB,OAAsB,OAA+B;AAC7E,MAAI,MAAM,SAAS,QAAS,QAAO,MAAM,SAAS,WAAW,MAAM,SAAS,MAAM;AAClF,QAAM,SAAS,MAAM,KAAK,SAAS,GAAG,IAAI,MAAM,OAAO,GAAG,MAAM,IAAI;AACpE,QAAM,YAAY,OAAO,MAAM,GAAG,EAAE;AACpC,MAAI,MAAM,SAAS,QAAS,QAAO,MAAM,KAAK,WAAW,MAAM,KAAK,MAAM,SAAS;AACnF,QAAM,cAAc,MAAM,KAAK,SAAS,GAAG,IAAI,MAAM,OAAO,GAAG,MAAM,IAAI;AACzE,SAAO,MAAM,SAAS,aAAa,YAAY,WAAW,MAAM;AAClE;AAEO,SAAS,kBAAkB,OAAmF;AACnH,SAAO;AAAA,IACL,SAAS,8BAA8B,MAAM,OAAO;AAAA,IACpD,SAAS,MAAM;AAAA,IACf,UAAU,uBAAuB,MAAM,QAAQ;AAAA,IAC/C,SAAS,sBAAsB,MAAM,OAAO;AAAA,IAC5C,WAAW,MAAM,UAAU,YAAY;AAAA,EACzC;AACF;AAEA,SAAS,cAAcA,QAA2B;AAChD,SAAO,qBAAiB,sBAAOA,MAAK,CAAC;AACvC;AAEO,SAAS,gBAAgBA,QAA2B;AACzD,QAAMC,UAAS,OAAa,qBAAiB,sBAAOD,MAAK,CAAC;AAC1D,SAAO,IAAI,SAAS,eAAeC,OAAM,EAAE,SAAS;AACtD;AAEO,SAAS,eAAeC,MAAaF,QAA4B;AACtE,MAAI;AACF,UAAM,SAAS,IAAI,MAAME,IAAG;AAC5B,QAAI,OAAO,SAAS,MAAMA,QAAO,OAAO,UAAU,SAAS,gBAAiB,QAAO;AACnF,WAAO,OAAO,OAAO,IAAI,SAAS,OAAO,MAAM,OAAa,OAAO,UAAU,UAAM,sBAAOF,MAAK,CAAC,CAAC,CAAC;AAAA,EACpG,QAAQ;AACN,WAAO;AAAA,EACT;AACF;AAEA,SAAS,qBAAqB,UAA0D;AACtF,SAAO,IAAI,YAAY,EAAE,OAAO,cAAc,QAAQ,CAAC;AACzD;AAEO,SAAS,kBAAkB,OAA6H;AAC7J,MAAI,MAAM,iBAAiB,WAAW,GAAI,OAAM,IAAI,mBAAmB,oBAAoB,sCAAsC;AACjI,QAAM,YAAY,uBAAQ,aAAa,MAAM,gBAAgB;AAC7D,QAAM,WAAW;AAAA,IACf,QAAQ;AAAA,IACR,SAAS;AAAA,IACT,QAAQ,gBAAgB,MAAM,MAAM;AAAA,IACpC,SAAS,MAAM;AAAA,IACf,GAAI,mBAAmB,MAAM,SAAS,GAAG,SAAS,WAAW,EAAE,WAAW,EAAE,MAAM,SAAkB,EAAE,IAAI,CAAC;AAAA,IAC3G,GAAI,MAAM,kBAAkB,UAAa,MAAM,cAAc,SAAY,CAAC,IAAI,EAAE,eAAe,MAAM,iBAAiB,mBAAmB,MAAM,SAAS,GAAG,KAAK;AAAA,IAChK,UAAU,kBAAkB,MAAM,QAAQ;AAAA,IAC1C,SAAS,iBAAiB,MAAM,OAAO;AAAA,IACvC,SAAS,MAAM;AAAA,IACf,WAAW,MAAM;AAAA,IACjB,WAAW,IAAI,KAAK,MAAM,SAAS,EAAE,YAAY;AAAA,IACjD,QAAQ,EAAE,KAAK,MAAM,WAAW,WAAW,iBAAiB,SAAS,EAAE;AAAA,EACzE;AACA,SAAO,EAAE,GAAG,UAAU,WAAW,iBAAiB,uBAAQ,KAAK,qBAAqB,QAAQ,GAAG,MAAM,gBAAgB,CAAC,EAAE;AAC1H;AAEO,SAAS,oBAAoB,UAA2B,UAAsC,CAAC,GAAoB;AACxH,MAAI;AACF,eAAW,UAAoB,CAAC,UAAU,WAAW,UAAU,WAAW,aAAa,iBAAiB,YAAY,WAAW,WAAW,aAAa,aAAa,UAAU,WAAW,GAAG,gBAAgB;AAC5M,eAAW,SAAS,UAAoB,CAAC,QAAQ,MAAM,GAAG,gBAAgB;AAC1E,eAAW,SAAS,SAAmB,CAAC,YAAY,QAAQ,UAAU,SAAS,GAAG,eAAe;AACjG,eAAW,SAAS,QAAkB,CAAC,OAAO,WAAW,GAAG,cAAc;AAC1E,QAAI,SAAS,cAAc,OAAW,YAAW,SAAS,WAAqB,SAAS,UAAU,SAAS,WAAW,CAAC,MAAM,IAAI,CAAC,QAAQ,OAAO,GAAG,iBAAiB;AACrK,QAAI,SAAS,WAAW,mBAAmB,SAAS,YAAY,KAAK,OAAO,SAAS,cAAc,SAAU,OAAM,IAAI,MAAM,sBAAsB;AACnJ,QAAI,gBAAgB,SAAS,MAAM,MAAM,SAAS,OAAQ,OAAM,IAAI,MAAM,yBAAyB;AACnG,QAAI,QAAQ,mBAAmB,UAAa,gBAAgB,QAAQ,cAAc,MAAM,SAAS,OAAQ,OAAM,IAAI,mBAAmB,mBAAmB,gCAAgC;AACzL,UAAM,SAAS,KAAK,MAAM,SAAS,SAAS;AAC5C,QAAI,CAAC,OAAO,SAAS,MAAM,KAAK,WAAW,QAAQ,OAAO,oBAAI,KAAK,GAAG,QAAQ,EAAG,OAAM,IAAI,mBAAmB,WAAW,4BAA4B;AACrJ,QAAI,IAAI,KAAK,MAAM,EAAE,YAAY,MAAM,SAAS,UAAW,OAAM,IAAI,mBAAmB,oBAAoB,yBAAyB;AACrI,UAAM,WAAW,kBAAkB,SAAS,QAAQ;AACpD,QAAI,SAAS,SAAS,SAAS,SAAS,QAAQ,SAAS,SAAS,SAAS,SAAS,KAAM,OAAM,IAAI,mBAAmB,oBAAoB,2BAA2B;AACtK,UAAM,UAAU,iBAAiB,SAAS,OAAO;AACjD,QAAI,QAAQ,KAAK,IAAI,MAAM,SAAS,QAAQ,KAAK,IAAI,EAAG,OAAM,IAAI,mBAAmB,oBAAoB,2BAA2B;AACpI,UAAM,YAAY,mBAAmB,SAAS,SAAS;AACvD,QAAI,cAAc,UAAa,KAAK,UAAU,SAAS,MAAM,KAAK,UAAU,SAAS,SAAS,EAAG,OAAM,IAAI,mBAAmB,oBAAoB,4BAA4B;AAC9K,QAAI,WAAW,SAAS,gBAAgB,WAAW,SAAS,cAAe,OAAM,IAAI,mBAAmB,oBAAoB,mDAAmD;AAC/K,QAAI,SAAS,kBAAkB,UAAa,CAAC,CAAC,cAAc,eAAe,gBAAgB,QAAQ,EAAE,SAAS,SAAS,aAAa,EAAG,OAAM,IAAI,mBAAmB,oBAAoB,2BAA2B;AACnN,QAAI,SAAS,kBAAkB,YAAY,WAAW,SAAS,UAAa,UAAU,SAAS,SAAU,OAAM,IAAI,mBAAmB,oBAAoB,yCAAyC;AACnM,SAAK,SAAS,kBAAkB,gBAAgB,SAAS,kBAAkB,iBAAiB,SAAS,kBAAkB,mBAAmB,CAAC,SAAS,UAAW,OAAM,IAAI,mBAAmB,oBAAoB,qCAAqC;AACrP,QAAI,OAAO,SAAS,YAAY,YAAY,SAAS,QAAQ,WAAW,KAAK,OAAO,SAAS,QAAQ,aAAa,YAAY,SAAS,QAAQ,SAAS,WAAW,KAAK,OAAO,SAAS,QAAQ,WAAW,YAAY,CAAC,mBAAmB,KAAK,SAAS,QAAQ,MAAM,EAAG,OAAM,IAAI,mBAAmB,oBAAoB,6BAA6B;AACxV,UAAM,kBAAkB,SAAS,YAC7B,QAAQ,yBAAyB,iCACjC,QAAQ,mBAAmB;AAC/B,QAAI,CAAC,OAAO,UAAU,SAAS,QAAQ,IAAI,KAAK,SAAS,QAAQ,OAAO,KAAK,SAAS,QAAQ,OAAO,gBAAiB,OAAM,IAAI,mBAAmB,qBAAqB,4CAA4C;AACpN,UAAM,YAAY,iBAAiB,SAAS,OAAO,SAAS;AAC5D,UAAM,YAAY,iBAAiB,SAAS,SAAS;AACrD,UAAM,WAAW,EAAE,GAAG,SAAS;AAC/B,WAAQ,SAAoC;AAC5C,QAAI,UAAU,WAAW,MAAM,UAAU,WAAW,MAAM,CAAC,uBAAQ,OAAO,WAAW,qBAAqB,QAAQ,GAAG,SAAS,EAAG,OAAM,IAAI,mBAAmB,qBAAqB,qCAAqC;AACxN,QAAI,QAAQ,sBAAsB,UAAa,SAAS,kBAAkB,UAAa,CAAC,QAAQ,kBAAkB,SAAS,SAAS,OAAO,GAAG,EAAG,OAAM,IAAI,mBAAmB,qBAAqB,6BAA6B;AAChO,WAAO;AAAA,EACT,SAAS,OAAO;AACd,QAAI,iBAAiB,mBAAoB,OAAM;AAC/C,UAAM,IAAI,mBAAmB,oBAAoB,iBAAiB,QAAQ,MAAM,UAAU,kBAAkB;AAAA,EAC9G;AACF;AAEO,SAAS,oBAAoB,UAAuC;AACzE,QAAM,aAAa,mBAAmB,IAAI,YAAY,EAAE,OAAO,cAAc,QAAQ,CAAC,GAAG,EAAE,QAAQ,MAAM,CAAC;AAC1G,SAAO,IAAI,YAAY,EAAE,OAAO,cAAc,UAAU,CAAC;AAC3D;AAEO,SAAS,mBAAmBA,QAAmB,UAAsE,CAAC,GAAoB;AAC/I,MAAIA,OAAM,cAAc,QAAQ,oBAAoB,4BAA6B,OAAM,IAAI,mBAAmB,qBAAqB,6CAA6C;AAChL,QAAM,SAAS,mBAAmB,IAAI,YAAY,EAAE,OAAOA,MAAK,CAAC;AACjE,MAAI,WAAW,QAAQ,OAAO,WAAW,YAAY,MAAM,QAAQ,MAAM,EAAG,OAAM,IAAI,mBAAmB,oBAAoB,kCAAkC;AAC/J,QAAM,WAAW;AACjB,MAAI,CAAC,SAAS,YAAY,OAAO,SAAS,YAAY,YAAY,CAAC,mBAAmB,KAAK,SAAS,OAAO,EAAG,OAAM,IAAI,mBAAmB,oBAAoB,iCAAiC;AAChM,aAAW,UAAoB,CAAC,YAAY,SAAS,GAAG,gBAAgB;AACxE,MAAI,QAAQ,WAAW,MAAO,qBAAoB,SAAS,UAAU,OAAO;AAC5E,QAAM,aAAa,iBAAiB,SAAS,OAAO;AACpD,MAAI,WAAW,eAAe,SAAS,SAAS,QAAQ,QAAQ,cAAc,UAAU,MAAM,SAAS,SAAS,QAAQ,OAAQ,OAAM,IAAI,mBAAmB,oBAAoB,8CAA8C;AAC/N,MAAI,SAAS,SAAS,aAAa,WAAW,aAAa,GAAI,OAAM,IAAI,mBAAmB,oBAAoB,sCAAsC;AACtJ,MAAI,CAAC,SAAS,SAAS,aAAa,SAAS,SAAS,cAAc,QAAW;AAC7E,UAAM,IAAI,mBAAmB,oBAAoB,2DAA2D;AAAA,EAC9G;AACA,SAAO;AACT;AAEO,SAAS,eAAe,OAA6F;AAC1H,QAAM,SAAS,gBAAgB,MAAM,MAAM;AAC3C,MAAI;AACF,QAAI,IAAI,MAAM,MAAM,GAAG,EAAE,SAAS,MAAM,MAAM,IAAK,OAAM,IAAI,MAAM,mBAAmB;AAAA,EACxF,QAAQ;AACN,UAAM,IAAI,mBAAmB,gBAAgB,sBAAsB;AAAA,EACrE;AACA,MAAI,MAAM,QAAQ,UAAa,MAAM,IAAI,WAAW,GAAI,OAAM,IAAI,mBAAmB,gBAAgB,+BAA+B;AACpI,SAAO,GAAG,MAAM,MAAM,MAAM,GAAG,GAAG,MAAM,QAAQ,SAAY,KAAK,MAAM,iBAAiB,MAAM,GAAG,CAAC,EAAE;AACtG;AAEO,SAAS,qBAAqB,OAA6I;AAChL,QAAMA,SAAQ,oBAAoB,MAAM,QAAQ;AAChD,QAAM,UAAU,iBAAiBA,MAAK;AACtC,MAAIA,OAAM,cAAc,MAAM,kBAAkB,0BAA2B,OAAM,IAAI,mBAAmB,qBAAqB,2CAA2C;AACxK,MAAI,MAAM,SAAS,SAAS,cAAc,MAAM,QAAQ,UAAa,MAAM,IAAI,WAAW,IAAK,OAAM,IAAI,mBAAmB,uBAAuB,wDAAwD;AAC3M,MAAI,CAAC,MAAM,SAAS,SAAS,aAAa,MAAM,QAAQ,OAAW,OAAM,IAAI,mBAAmB,oBAAoB,8CAA8C;AAClK,SAAO,GAAG,gBAAgB,MAAM,MAAM,CAAC,QAAQ,OAAO,GAAG,MAAM,QAAQ,SAAY,KAAK,MAAM,iBAAiB,MAAM,GAAG,CAAC,EAAE;AAC7H;AAmBA,IAAM,gBAAgB,IAAI,YAAY,EAAE,OAAO,6BAA6B;AAE5E,SAAS,aAAaA,QAA2B;AAC/C,SAAO,IAAI,OAAO,GAAO,MAAM,OAAa,OAAU,UAAM,sBAAOA,MAAK,CAAC,CAAC,EAAE,SAAS;AACvF;AAEA,SAAS,eAAe,OAAwB;AAC9C,MAAI;AACF,UAAM,SAAS,IAAI,MAAM,KAAK;AAC9B,WAAO,OAAO,YAAY,KAAK,OAAO,SAAa,QAAQ,OAAO,UAAU,SAAS,OAAU,QAAQ,OAAO,SAAS,MAAM;AAAA,EAC/H,QAAQ;AACN,WAAO;AAAA,EACT;AACF;AAEA,SAAS,mBAAmB,KAAyB;AACnD,QAAM,QAAQ,IAAI,MAAM,WAAW,MAAM;AACzC,QAAM,UAAU,UAAU,OAAO,KAAK;AACtC,MAAI,QAAQ,WAAW,MAAM,QAAQ,CAAC,MAAM,OAAQ,QAAQ,CAAC,MAAM,EAAM,OAAM,IAAI,mBAAmB,oBAAoB,iCAAiC;AAC3J,SAAO,QAAQ,MAAM,CAAC;AACxB;AAEA,SAAS,8BAA8B,UAAgD;AACrF,QAAM,EAAE,WAAW,YAAY,GAAG,SAAS,IAAI;AAC/C,QAAM,SAAS,IAAI,YAAY,EAAE,OAAO,mCAAmC;AAC3E,QAAM,OAAO,IAAI,YAAY,EAAE,OAAO,cAAc,QAAQ,CAAC;AAC7D,QAAM,SAAS,IAAI,WAAW,OAAO,SAAS,KAAK,MAAM;AACzD,SAAO,IAAI,MAAM;AACjB,SAAO,IAAI,MAAM,OAAO,MAAM;AAC9B,SAAO;AACT;AAQA,SAAS,kBAAkB,UAAoC,WAAuB,QAAmD;AACvI,QAAM,UAAU,iBAAiB,SAAS;AAC1C,QAAM,YAAY,mBAAmB,SAAS,UAAU,SAAS;AACjE,SAAO;AAAA,IACL,UAAU;AAAA,MACR,QAAQ;AAAA,MACR,SAAS;AAAA,MACT,QAAQ,SAAS,OAAO;AAAA,MACxB,SAAS,SAAS,OAAO;AAAA,MACzB,GAAI,WAAW,SAAY,EAAE,eAAe,SAAS,oBAAoB,SAAS,cAAc,WAAoB,SAAS,oBAAoB,SAAS,iBAAiB,WAAoB,OAAU,IAAI,EAAE,eAAe,OAAO,cAAc;AAAA,MACnP,UAAU,QAAQ,YAAY,SAAS,OAAO;AAAA,MAC9C,SAAS,CAAC,GAAI,QAAQ,WAAW,CAAC,MAAM,CAAE;AAAA,MAC1C,SAAS;AAAA,QACP,UAAU;AAAA,QACV,MAAM,UAAU;AAAA,QAChB,QAAQ,qBAAiB,sBAAO,SAAS,CAAC;AAAA,MAC5C;AAAA;AAAA;AAAA;AAAA;AAAA,MAKA,WAAW,SAAS,oBAAoB,SAAS;AAAA,MACjD,WAAW,SAAS;AAAA,MACpB,QAAQ,EAAE,KAAK,SAAS,UAAU,WAAW,WAAW,iBAAiB,SAAS,EAAE;AAAA,MACpF,WAAW,SAAS,UAAU;AAAA,MAC9B,yBAAyB,SAAS,oBAAoB;AAAA,IACxD;AAAA,IACA;AAAA,EACF;AACF;AAEO,SAAS,wBAAwBE,MAAaF,QAA4B;AAC/E,MAAI;AACF,UAAM,SAAS,IAAI,MAAME,IAAG;AAC5B,WAAO,OAAO,YAAY,KAAK,OAAO,SAAa,QAAQ,OAAO,UAAU,SAAS,OAAU,QAAQ,OAAO,SAAS,MAAMA,QAAO,aAAaF,MAAK,MAAME;AAAA,EAC9J,QAAQ;AACN,WAAO;AAAA,EACT;AACF;AAEA,eAAsB,uBAAuB,MAAkB,KAAsC;AACnG,MAAI,IAAI,WAAW,MAAM,KAAK,SAAS,MAAM,KAAK,CAAC,MAAM,EAAG,OAAM,IAAI,mBAAmB,gBAAgB,kCAAkC;AAC3I,MAAI;AACF,UAAM,YAAY,MAAM,OAAO,OAAO,UAAU,OAAO,KAA+B,WAAW,OAAO,CAAC,SAAS,CAAC;AACnH,WAAO,IAAI,WAAW,MAAM,OAAO,OAAO,QAAQ,EAAE,MAAM,WAAW,IAAI,KAAK,MAAM,GAAG,EAAE,GAA6B,gBAAgB,cAAwC,GAAG,WAAW,KAAK,MAAM,EAAE,CAA2B,CAAC;AAAA,EACvO,SAAS,OAAO;AACd,UAAM,IAAI,mBAAmB,qBAAqB,iBAAiB,QAAQ,MAAM,UAAU,sCAAsC;AAAA,EACnI;AACF;AAEA,SAAS,oBAAoB,aAAqB,QAA4C,gBAAiD;AAC7I,QAAM,MAAM,iBAAiB,WAAW;AACxC,QAAM,QAAQ,mBAAmB,IAAI,YAAY,SAAS,EAAE,OAAO,KAAK,CAAC,EAAE,OAAO,GAAG,CAAC;AACtF,MAAI,CAAC,SAAS,OAAO,UAAU,YAAY,MAAM,QAAQ,KAAK,EAAG,OAAM,IAAI,mBAAmB,oBAAoB,kCAAkC;AACpJ,QAAM,SAAS;AACf,QAAM,UAAU,OAAO;AACvB,MAAI,OAAO,SAAS,0BAA2B,YAAY,KAAK,YAAY,EAAI,OAAM,IAAI,mBAAmB,oBAAoB,2CAA2C;AAC5K,MAAI,YAAY,KAAK,OAAO,WAAW,QAAW;AAChD,eAAW,QAAQ,CAAC,QAAQ,WAAW,aAAa,oBAAoB,UAAU,cAAc,aAAa,WAAW,YAAY,kBAAkB,WAAW,GAAG,qCAAqC;AACzM,QAAI,OAAO,OAAO,cAAc,YAAY,OAAO,OAAO,cAAc,YAAY,OAAO,cAAc,eAAgB,OAAM,IAAI,mBAAmB,oBAAoB,4CAA4C;AACtN,UAAM,eAAe,OAAO;AAC5B,QAAI,CAAC,cAAc,YAAY,KAAM,aAAa,SAAS,gBAAgB,aAAa,SAAS,iBAAiB,aAAa,SAAS,kBAAmB,OAAO,aAAa,UAAU,SAAU,OAAM,IAAI,mBAAmB,oBAAoB,2BAA2B;AAC/Q,UAAMC,WAAU,mBAAmB,YAAoC;AACvE,QAAIA,aAAY,UAAaA,SAAQ,SAAS,SAAU,OAAM,IAAI,mBAAmB,oBAAoB,2BAA2B;AACpI,QAAI,CAAC,cAAc,OAAO,MAAM,EAAG,OAAM,IAAI,mBAAmB,oBAAoB,0BAA0B;AAC9G,eAAW,OAAO,QAAQ,CAAC,UAAU,gBAAgB,SAAS,GAAG,yBAAyB;AAC1F,QAAI,OAAO,OAAO,WAAW,OAAO,UAAU,OAAO,OAAO,YAAY,OAAO,WAAW,OAAO,OAAO,iBAAiB,OAAO,aAAc,OAAM,IAAI,mBAAmB,oBAAoB,4CAA4C;AAC3O,QAAI,EAAE,OAAO,OAAO,eAAe,YAAY,cAAc,OAAO,UAAU,MAAM,EAAE,OAAO,OAAO,cAAc,YAAY,cAAc,OAAO,SAAS,GAAI,OAAM,IAAI,mBAAmB,oBAAoB,sCAAsC;AACvP,QAAI,CAAC,MAAM,QAAQ,OAAO,OAAO,EAAG,OAAM,IAAI,mBAAmB,oBAAoB,4BAA4B;AACjH,UAAMC,WAAU,iBAAiB,OAAO,OAAwB;AAChE,QAAI,CAAC,cAAc,OAAO,QAAQ,KAAM,OAAO,SAAS,SAAS,WAAW,OAAO,SAAS,SAAS,YAAa,OAAO,OAAO,SAAS,UAAU,SAAU,OAAM,IAAI,mBAAmB,oBAAoB,4BAA4B;AAC1O,UAAMC,YAAW,kBAAkB,EAAE,MAAM,OAAO,SAAS,MAAM,MAAM,OAAO,SAAS,MAAM,CAAC;AAC9F,QAAI,CAAC,iBAAiBA,WAAU,OAAO,QAAQ,EAAG,OAAM,IAAI,mBAAmB,oBAAoB,8CAA8C;AACjJ,QAAI,CAAC,cAAc,OAAO,gBAAgB,CAAC,EAAG,OAAM,IAAI,mBAAmB,oBAAoB,kCAAkC;AACjI,UAAMC,UAAS,OAAO,gBAAgB;AACtC,eAAWA,SAAQ,CAAC,QAAQ,SAAS,QAAQ,UAAU,YAAY,aAAa,aAAa,mBAAmB,QAAQ,GAAG,oCAAoC;AAC/J,QAAIA,QAAO,SAAS,QAAQA,QAAO,SAAS,MAAO,OAAM,IAAI,mBAAmB,oBAAoB,uCAAuC;AAC3I,QAAI,OAAOA,QAAO,UAAU,YAAY,OAAOA,QAAO,SAAS,YAAY,OAAOA,QAAO,WAAW,SAAU,OAAM,IAAI,mBAAmB,oBAAoB,kCAAkC;AACjM,QAAIA,QAAO,SAAS,UAAU,OAAOA,QAAO,aAAa,YAAY,OAAOA,QAAO,cAAc,YAAY,CAAC,cAAcA,QAAO,SAAS,KAAK,OAAOA,QAAO,oBAAoB,UAAW,OAAM,IAAI,mBAAmB,oBAAoB,sCAAsC;AACrR,WAAO,EAAE,eAAeH,SAAQ,MAAM,SAAAC,UAAS,UAAAC,UAAS;AAAA,EAC1D;AACA,QAAM,UAAU,YAAY,IACxB,CAAC,QAAQ,WAAW,aAAa,kBAAkB,aAAa,UAAU,YAAY,iBAAiB,qBAAqB,IAC5H,CAAC,QAAQ,WAAW,aAAa,oBAAoB,aAAa,WAAW,YAAY,kBAAkB,qBAAqB;AACpI,aAAW,QAAQ,SAAS,2BAA2B;AACvD,MAAI,OAAO,OAAO,cAAc,YAAY,OAAO,OAAO,cAAc,YAAY,OAAO,cAAc,eAAgB,OAAM,IAAI,mBAAmB,oBAAoB,4CAA4C;AACtN,QAAM,UAAU,OAAO;AACvB,MAAI;AACJ,MAAI,YAAY,GAAG;AACjB,QAAI,OAAO,OAAO,mBAAmB,SAAU,OAAM,IAAI,mBAAmB,oBAAoB,6BAA6B;AAC7H,uBAAmB,EAAE,MAAM,cAAc,OAAO,OAAO,eAAe,CAAC;AACvE,oBAAgB;AAAA,EAClB,OAAO;AACL,QAAI,CAAC,WAAW,OAAO,YAAY,YAAY,MAAM,QAAQ,OAAO,EAAG,OAAM,IAAI,mBAAmB,oBAAoB,2BAA2B;AACnJ,UAAM,gBAAgB;AACtB,QAAI,cAAc,SAAS,gBAAgB,cAAc,SAAS,iBAAiB,OAAO,cAAc,UAAU,SAAU,OAAM,IAAI,mBAAmB,oBAAoB,2BAA2B;AACxM,uBAAmB,aAAqC;AACxD,QAAI,OAAO,kBAAkB,OAAW,oBAAmB,EAAE,MAAM,cAAc,OAAO,OAAO,cAAwB,CAAC;AACxH,oBAAgB,cAAc;AAAA,EAChC;AACA,QAAM,cAAc,OAAO,WAAW,OAAO;AAC7C,QAAM,cAAc,MAAM,QAAQ,WAAW,IAAI,cAAc,CAAC,WAAW;AAC3E,QAAM,UAAU,iBAAiB,YAAY,IAAI,CAAC,WAAW,WAAW,sBAAsB,WAAW,SAAS,WAAW,SAAS,SAAS,WAAW,uBAAuB,WAAW,SAAS,SAAS,WAAW,sBAAsB,WAAW,uBAAuB,WAAW,SAAS,WAAW,SAAS,SAAS,MAAM,CAAkB;AAC1V,QAAME,iBAAgB,OAAO;AAC7B,MAAI;AACJ,MAAIA,kBAAiB,OAAOA,mBAAkB,YAAY,CAAC,MAAM,QAAQA,cAAa,GAAG;AACvF,UAAM,YAAYA;AAIlB,UAAM,OAAO,OAAO,UAAU,SAAS,WAAW,UAAU,OAAO,UAAU;AAC7E,QAAI,OAAO,SAAS,YAAa,UAAU,SAAS,WAAW,UAAU,SAAS,SAAW,OAAM,IAAI,mBAAmB,oBAAoB,4BAA4B;AAC1K,eAAW,kBAAkB,EAAE,MAAM,UAAU,MAAM,KAAK,CAAC;AAAA,EAC7D,OAAO;AACL,eAAW,kBAAkB,EAAE,MAAM,SAAS,MAAM,OAAOA,mBAAkB,WAAWA,iBAAgB,OAAO,SAAS,KAAK,CAAC;AAAA,EAChI;AAIA,MAAI,CAAC,iBAAiB,UAAU,OAAO,QAAQ,EAAG,OAAM,IAAI,mBAAmB,oBAAoB,8CAA8C;AACjJ,QAAM,qBAAqB,YAAY,IAAI,OAAO,gBAAgB,IAAI,OAAO;AAC7E,MAAI,CAAC,sBAAsB,OAAO,uBAAuB,YAAY,MAAM,QAAQ,kBAAkB,EAAG,OAAM,IAAI,mBAAmB,oBAAoB,kCAAkC;AAC3L,QAAM,SAAS;AACf,MAAI,OAAO,SAAS,MAAM;AACxB,eAAW,QAAQ,CAAC,QAAQ,SAAS,QAAQ,QAAQ,GAAG,6BAA6B;AACrF,QAAI,OAAO,OAAO,UAAU,YAAY,OAAO,OAAO,SAAS,YAAY,CAAC,CAAC,oBAAoB,qBAAqB,kBAAkB,EAAE,SAAS,OAAO,MAAgB,EAAG,OAAM,IAAI,mBAAmB,oBAAoB,wCAAwC;AAAA,EACxQ,WAAW,OAAO,SAAS,OAAO;AAChC,eAAW,QAAQ,CAAC,QAAQ,SAAS,YAAY,QAAQ,aAAa,aAAa,mBAAmB,QAAQ,GAAG,8BAA8B;AAC/I,QAAI,OAAO,OAAO,UAAU,YAAY,OAAO,OAAO,aAAa,YAAY,OAAO,OAAO,SAAS,YAAY,OAAO,OAAO,cAAc,YAAY,CAAC,OAAO,aAAa,OAAO,OAAO,cAAc,YAAY,MAAM,QAAQ,OAAO,SAAS,KAAK,OAAO,OAAO,oBAAoB,YAAY,OAAO,WAAW,qBAAsB,OAAM,IAAI,mBAAmB,oBAAoB,yCAAyC;AAC1a,eAAW,YAAY,OAAO,OAAO,OAAO,SAAoC,EAAG,KAAI,CAAC,OAAO,cAAc,QAAQ,EAAG,OAAM,IAAI,mBAAmB,oBAAoB,qCAAqC;AAC9M,QAAI,qBAAiB,sBAAO,IAAI,YAAY,EAAE,OAAO,cAAc,OAAO,SAAS,CAAC,CAAC,CAAC,MAAM,OAAO,gBAAiB,OAAM,IAAI,mBAAmB,oBAAoB,0CAA0C;AAAA,EACjN,MACK,OAAM,IAAI,mBAAmB,oBAAoB,uCAAuC;AAC7F,MAAI,OAAO,OAAO,wBAAwB,YAAY,qBAAiB,sBAAO,IAAI,YAAY,EAAE,OAAO,cAAc,MAAM,CAAC,CAAC,CAAC,MAAM,OAAO,oBAAqB,OAAM,IAAI,mBAAmB,oBAAoB,yCAAyC;AAC1P,SAAO,EAAE,eAAe,SAAS,SAAS;AAC5C;AAOA,SAAS,0BAA0B,OAAgC,SAA0O;AAC3S,aAAW,OAAO,CAAC,WAAW,WAAW,UAAU,cAAc,aAAa,oBAAoB,WAAW,YAAY,kBAAkB,UAAU,WAAW,GAAG,uBAAuB;AAC1L,MAAI,MAAM,YAAY,KAAK,OAAO,MAAM,YAAY,YAAY,MAAM,QAAQ,WAAW,KAAK,OAAO,MAAM,WAAW,SAAU,OAAM,IAAI,mBAAmB,oBAAoB,wCAAwC;AACzN,QAAM,SAAS,MAAM;AACrB,QAAM,aAAa,MAAM;AACzB,QAAM,YAAY,MAAM;AACxB,QAAMA,iBAAgB,MAAM;AAC5B,MAAI,CAAC,cAAc,MAAM,KAAK,CAAC,cAAc,UAAU,KAAK,CAAC,cAAc,SAAS,KAAK,CAAC,cAAcA,cAAa,EAAG,OAAM,IAAI,mBAAmB,oBAAoB,iCAAiC;AAC1M,aAAW,QAAQ,CAAC,UAAU,gBAAgB,SAAS,GAAG,qBAAqB;AAC/E,aAAW,YAAY,CAAC,OAAO,aAAa,YAAY,aAAa,SAAS,GAAG,yBAAyB;AAC1G,aAAW,WAAW,CAAC,QAAQ,OAAO,aAAa,OAAO,WAAW,GAAG,wBAAwB;AAChG,aAAWA,gBAAe,CAAC,QAAQ,OAAO,GAAG,uBAAuB;AACpE,QAAM,SAAS,OAAO;AACtB,QAAM,UAAU,OAAO;AACvB,QAAM,eAAe,OAAO;AAC5B,MAAI,OAAO,WAAW,YAAY,gBAAgB,MAAM,MAAM,UAAU,OAAO,YAAY,YAAY,QAAQ,WAAW,KAAK,OAAO,iBAAiB,YAAY,aAAa,WAAW,EAAG,OAAM,IAAI,mBAAmB,oBAAoB,gCAAgC;AAC/Q,MAAI,QAAQ,mBAAmB,UAAa,gBAAgB,QAAQ,cAAc,MAAM,OAAQ,OAAM,IAAI,mBAAmB,mBAAmB,0CAA0C;AAC1L,QAAM,SAAS,KAAK,MAAM,MAAM,MAAM;AACtC,MAAI,CAAC,OAAO,SAAS,MAAM,KAAK,WAAW,QAAQ,OAAO,oBAAI,KAAK,GAAG,QAAQ,KAAK,IAAI,KAAK,MAAM,EAAE,YAAY,MAAM,MAAM,OAAQ,OAAM,IAAI,mBAAmB,WAAW,sCAAsC;AAClN,MAAI,OAAO,WAAW,QAAQ,YAAY,OAAO,WAAW,cAAc,YAAY,OAAO,WAAW,aAAa,YAAY,OAAO,WAAW,cAAc,YAAY,KAAK,MAAM,WAAW,SAAS,IAAI,OAAQ,OAAM,IAAI,mBAAmB,oBAAoB,oCAAoC;AAC7S,QAAM,UAAU,MAAM;AACtB,MAAI,CAAC,cAAc,OAAO,KAAM,QAAQ,SAAS,gBAAgB,QAAQ,SAAS,iBAAiB,QAAQ,SAAS,kBAAmB,OAAO,QAAQ,UAAU,SAAU,OAAM,IAAI,mBAAmB,oBAAoB,2CAA2C;AACtQ,QAAM,oBAAoB,mBAAmB,OAA+B;AAC5E,MAAI,sBAAsB,UAAa,kBAAkB,SAAS,SAAU,OAAM,IAAI,mBAAmB,oBAAoB,2CAA2C;AACxK,MAAI,CAAC,MAAM,QAAQ,MAAM,OAAO,EAAG,OAAM,IAAI,mBAAmB,oBAAoB,kCAAkC;AACtH,QAAM,UAAU,iBAAiB,MAAM,OAAwB;AAC/D,MAAI,CAAC,cAAc,MAAM,gBAAgB,CAAC,EAAG,OAAM,IAAI,mBAAmB,oBAAoB,wCAAwC;AACtI,QAAM,gBAAgB,MAAM,gBAAgB;AAC5C,aAAW,eAAe,CAAC,QAAQ,OAAO,OAAO,UAAU,YAAY,MAAM,GAAG,6BAA6B;AAC7G,MAAI,OAAO,cAAc,SAAS,YAAY,OAAO,cAAc,QAAQ,YAAY,CAAC,eAAe,cAAc,GAAG,EAAG,OAAM,IAAI,mBAAmB,oBAAoB,wCAAwC;AACpN,QAAM,WAAW,kBAAkB,EAAE,MAAMA,eAAc,MAA+B,MAAMA,eAAc,MAAgB,CAAC;AAC7H,MAAIA,eAAc,SAAS,SAAS,QAAQA,eAAc,UAAU,SAAS,KAAM,OAAM,IAAI,mBAAmB,oBAAoB,wCAAwC;AAC5K,QAAM,YAAY,MAAM;AACxB,MAAI,CAAC,cAAc,SAAS,EAAG,OAAM,IAAI,mBAAmB,oBAAoB,mCAAmC;AACnH,aAAW,WAAW,CAAC,aAAa,aAAa,OAAO,GAAG,wBAAwB;AACnF,MAAI,OAAO,UAAU,cAAc,YAAY,UAAU,cAAc,aAAa,OAAO,UAAU,UAAU,SAAU,OAAM,IAAI,mBAAmB,oBAAoB,mCAAmC;AAC7M,QAAM,YAAY,mBAAmB,UAAU,SAAS;AACxD,MAAI,QAAQ,sBAAsB,UAAa,CAAC,QAAQ,kBAAkB,SAAS,UAAU,SAAS,EAAG,OAAM,IAAI,mBAAmB,qBAAqB,sDAAsD;AACjN,QAAM,iBAAiB,iBAAiB,UAAU,KAAK;AACvD,QAAM,EAAE,WAAW,YAAY,GAAG,SAAS,IAAI;AAC/C,QAAM,SAAS,IAAI,YAAY,EAAE,OAAO,mCAAmC;AAC3E,QAAM,OAAO,IAAI,YAAY,EAAE,OAAO,cAAc,QAAQ,CAAC;AAC7D,QAAM,eAAe,IAAI,WAAW,OAAO,SAAS,KAAK,MAAM;AAC/D,eAAa,IAAI,MAAM;AAAG,eAAa,IAAI,MAAM,OAAO,MAAM;AAC9D,MAAI,eAAe,WAAW,MAAM,CAAC,uBAAQ,OAAO,gBAAgB,cAAc,SAAS,EAAG,OAAM,IAAI,mBAAmB,qBAAqB,4CAA4C;AAC5L,QAAM,UAAU,QAAQ,aAAa,IAAI,WAAW;AACpD,QAAM,aAA8B;AAAA,IAClC,QAAQ;AAAA,IACR,SAAS;AAAA,IACT;AAAA,IACA;AAAA,IACA,eAAe,kBAAkB;AAAA,IACjC;AAAA,IACA;AAAA,IACA,SAAS,EAAE,UAAU,OAAO,cAAc,aAAa,WAAW,cAAc,WAAW,4BAA4B,MAAM,QAAQ,YAAY,QAAQ,qBAAiB,sBAAO,OAAO,CAAC,EAAE;AAAA,IAC3L,WAAW;AAAA,IACX,WAAW,MAAM;AAAA,IACjB,QAAQ,EAAE,KAAK,UAAU,WAAW,WAAW,iBAAiB,SAAS,EAAE;AAAA,IAC3E,WAAW,UAAU;AAAA,IACrB,yBAAyB;AAAA,EAC3B;AACA,SAAO,EAAE,UAAU,OAA8C,UAAU,EAAE,UAAU,YAAY,SAAS,iBAAiB,OAAO,EAAE,EAAE;AAC1I;AAEA,SAAS,cAAc,OAAkD;AACvE,SAAO,UAAU,QAAQ,OAAO,UAAU,YAAY,CAAC,MAAM,QAAQ,KAAK;AAC5E;AAEA,SAAS,6BAA6B,OAA0C;AAC9E,MAAI,CAAC,SAAS,OAAO,UAAU,YAAY,MAAM,QAAQ,KAAK,EAAG,OAAM,IAAI,mBAAmB,oBAAoB,qCAAqC;AACvJ,QAAM,WAAW;AACjB,aAAW,UAAU,CAAC,WAAW,WAAW,cAAc,uBAAuB,UAAU,WAAW,UAAU,WAAW,WAAW,GAAG,oBAAoB;AAC7J,MAAI,SAAS,YAAY,KAAK,OAAO,SAAS,YAAY,YAAY,SAAS,QAAQ,WAAW,KAAK,OAAO,SAAS,eAAe,YAAY,SAAS,WAAW,WAAW,KAAK,OAAO,SAAS,WAAW,SAAU,OAAM,IAAI,mBAAmB,oBAAoB,qCAAqC;AACjT,QAAM,SAAS,SAAS;AACxB,MAAI,CAAC,UAAU,OAAO,WAAW,YAAY,MAAM,QAAQ,MAAM,EAAG,OAAM,IAAI,mBAAmB,oBAAoB,6BAA6B;AAClJ,aAAW,QAAQ,CAAC,UAAU,gBAAgB,WAAW,UAAU,GAAG,kBAAkB;AACxF,QAAM,cAAc;AACpB,MAAI,OAAO,YAAY,WAAW,YAAY,CAAC,cAAc,KAAK,YAAY,MAAM,KAAK,gBAAgB,YAAY,MAAM,MAAM,YAAY,UAAU,OAAO,YAAY,iBAAiB,YAAY,YAAY,aAAa,WAAW,KAAK,OAAO,YAAY,YAAY,YAAY,YAAY,QAAQ,WAAW,KAAK,2BAA2B,KAAK,YAAY,OAAO,EAAG,OAAM,IAAI,mBAAmB,oBAAoB,qCAAqC;AAC3c,QAAM,WAAW,kBAAkB,YAAY,QAAyB;AACxE,MAAI,KAAK,UAAU,QAAQ,MAAM,KAAK,UAAU,YAAY,QAAQ,EAAG,OAAM,IAAI,mBAAmB,oBAAoB,qCAAqC;AAC7J,QAAM,UAAU,SAAS;AACzB,MAAI,CAAC,WAAW,OAAO,YAAY,YAAY,MAAM,QAAQ,OAAO,EAAG,OAAM,IAAI,mBAAmB,oBAAoB,8BAA8B;AACtJ,QAAM,eAAe;AACrB,aAAW,cAAc,CAAC,cAAc,YAAY,iBAAiB,MAAM,GAAG,mBAAmB;AACjG,aAAW,OAAO,CAAC,cAAc,YAAY,eAAe,EAAY,KAAI,aAAa,GAAG,MAAM,UAAa,OAAO,aAAa,GAAG,MAAM,SAAU,OAAM,IAAI,mBAAmB,oBAAoB,oCAAoC;AAC3O,MAAI,aAAa,SAAS,UAAa,CAAC,CAAC,YAAY,UAAU,QAAQ,EAAE,SAAS,aAAa,IAAc,EAAG,OAAM,IAAI,mBAAmB,oBAAoB,mCAAmC;AACpM,QAAM,sBAAsB,SAAS;AACrC,MAAI,CAAC,uBAAuB,OAAO,wBAAwB,YAAY,MAAM,QAAQ,mBAAmB,EAAG,OAAM,IAAI,mBAAmB,oBAAoB,2CAA2C;AACvM,QAAM,sBAAsB;AAC5B,MAAI,oBAAoB,SAAS,UAAU;AACzC,eAAW,qBAAqB,CAAC,QAAQ,aAAa,aAAa,GAAG,yBAAyB;AAC/F,QAAI,OAAO,oBAAoB,cAAc,YAAY,OAAO,oBAAoB,gBAAgB,YAAY,CAAC,wBAAwB,oBAAoB,WAAW,iBAAiB,oBAAoB,WAAW,CAAC,EAAG,OAAM,IAAI,mBAAmB,oBAAoB,wCAAwC;AAAA,EACvT,WAAW,oBAAoB,SAAS,aAAa;AACnD,eAAW,qBAAqB,CAAC,QAAQ,YAAY,GAAG,yBAAyB;AACjF,UAAM,MAAM,oBAAoB;AAChC,QAAI,CAAC,OAAO,OAAO,QAAQ,YAAY,MAAM,QAAQ,GAAG,EAAG,OAAM,IAAI,mBAAmB,oBAAoB,iCAAiC;AAC7I,UAAM,WAAW;AACjB,eAAW,UAAU,CAAC,OAAO,OAAO,KAAK,KAAK,KAAK,OAAO,OAAO,WAAW,OAAO,KAAK,GAAG,uBAAuB;AAClH,QAAI,SAAS,QAAQ,SAAS,SAAS,QAAQ,QAAQ,OAAO,SAAS,QAAQ,YAAY,OAAO,SAAS,MAAM,YAAY,OAAO,SAAS,MAAM,SAAU,OAAM,IAAI,mBAAmB,oBAAoB,kCAAkC;AAChP,QAAI,SAAS,QAAQ,QAAQ,OAAO,SAAS,MAAM,SAAU,OAAM,IAAI,mBAAmB,oBAAoB,qCAAqC;AACnJ,QAAI,SAAS,QAAQ,UAAa,OAAO,SAAS,QAAQ,YAAY,SAAS,QAAQ,UAAa,OAAO,SAAS,QAAQ,YAAY,SAAS,QAAQ,UAAa,OAAO,SAAS,QAAQ,YAAY,SAAS,QAAQ,UAAa,OAAO,SAAS,QAAQ,aAAa,SAAS,YAAY,WAAc,CAAC,MAAM,QAAQ,SAAS,OAAO,KAAK,SAAS,QAAQ,KAAK,CAAC,cAAc,OAAO,cAAc,QAAQ,GAAI,OAAM,IAAI,mBAAmB,oBAAoB,2CAA2C;AACtf,eAAW,UAAU,CAAC,SAAS,GAAG,SAAS,GAAG,SAAS,CAAC,EAAG,KAAI,WAAW,OAAW,kBAAiB,MAAgB;AAAA,EACxH,WAAW,oBAAoB,SAAS,gBAAgB;AACtD,eAAW,qBAAqB,CAAC,QAAQ,KAAK,GAAG,sBAAsB;AACvE,QAAI,OAAO,oBAAoB,QAAQ,YAAY,CAAC,qBAAqB,KAAK,oBAAoB,GAAG,EAAG,OAAM,IAAI,mBAAmB,oBAAoB,oCAAoC;AAAA,EAC/L,MAAO,OAAM,IAAI,mBAAmB,oBAAoB,gDAAgD;AACxG,MAAI,SAAS,YAAY,QAAW;AAClC,QAAI,CAAC,SAAS,WAAW,OAAO,SAAS,YAAY,YAAY,MAAM,QAAQ,SAAS,OAAO,EAAG,OAAM,IAAI,mBAAmB,oBAAoB,sCAAsC;AACzL,eAAW,SAAS,SAAS,CAAC,OAAO,KAAK,GAAG,2BAA2B;AACxE,UAAM,UAAU,SAAS;AACzB,QAAI,OAAO,QAAQ,QAAQ,YAAY,OAAO,QAAQ,QAAQ,YAAY,CAAC,eAAe,QAAQ,GAAG,EAAG,OAAM,IAAI,mBAAmB,oBAAoB,sCAAsC;AAC/L,QAAI,iBAAiB,QAAQ,GAAG,EAAE,WAAW,GAAI,OAAM,IAAI,mBAAmB,oBAAoB,kCAAkC;AACpI,QAAI,oBAAoB,SAAS,YAAa,OAAM,IAAI,mBAAmB,oBAAoB,kDAAkD;AAAA,EACnJ;AACA,QAAM,YAAY,SAAS;AAC3B,MAAI,CAAC,aAAa,OAAO,cAAc,YAAY,MAAM,QAAQ,SAAS,EAAG,OAAM,IAAI,mBAAmB,oBAAoB,gCAAgC;AAC9J,aAAW,WAAW,CAAC,aAAa,aAAa,OAAO,GAAG,qBAAqB;AAChF,QAAM,iBAAiB;AACvB,MAAI,OAAO,eAAe,cAAc,YAAY,eAAe,cAAc,aAAa,OAAO,eAAe,UAAU,SAAU,OAAM,IAAI,mBAAmB,oBAAoB,gCAAgC;AACzN,QAAM,YAAY,mBAAmB,eAAe,SAAS;AAC7D,MAAI,iBAAiB,eAAe,KAAK,EAAE,WAAW,GAAI,OAAM,IAAI,mBAAmB,oBAAoB,uCAAuC;AAClJ,SAAO;AACT;AAEO,SAAS,4BAA4BP,QAAmB,UAAsJ,CAAC,GAAwF;AAC5S,MAAI;AACJ,MAAI;AAAE,aAAS,KAAK,MAAM,IAAI,YAAY,SAAS,EAAE,OAAO,KAAK,CAAC,EAAE,OAAOA,MAAK,CAAC;AAAA,EAAG,QAAQ;AAAE,UAAM,IAAI,mBAAmB,oBAAoB,gCAAgC;AAAA,EAAG;AAClL,MAAI,cAAc,MAAM,KAAK,OAAO,YAAY,KAAK,OAAO,gBAAgB,MAAM,QAAW;AAC3F,WAAO,0BAA0B,QAAQ,OAAO;AAAA,EAClD;AAKA,MAAI,UAAU,OAAO,WAAW,YAAY,CAAC,MAAM,QAAQ,MAAM,MAAO,OAAmC,WAAW,mBAAqB,OAAmC,YAAY,MAAO,OAAmC,aAAa,UAAc,OAAmC,cAAc,UAAe;AAC7T,UAAM,SAAS;AACf,UAAM,gBAAgB,OAAO,YAAY,OAAO,OAAO,aAAa,YAAY,CAAC,MAAM,QAAQ,OAAO,QAAQ,IAAI,OAAO,WAAsC;AAC/J,UAAM,QAAQ,EAAE,GAAG,cAAc;AACjC,QAAI,MAAM,YAAY,UAAa,MAAM,aAAa,OAAW,OAAM,UAAU,MAAM;AACvF,WAAO,MAAM;AACb,UAAM,eAAe,MAAM;AAC3B,QAAI,CAAC,gBAAgB,OAAO,iBAAiB,YAAY,MAAM,QAAQ,YAAY,EAAG,OAAM,IAAI,mBAAmB,oBAAoB,kCAAkC;AACzK,UAAM,kBAAkB,OAAO,OAAO,YAAY,WAAW,OAAO,UAAU,QAAQ,cAAc,SAAY,KAAK,iBAAiB,QAAQ,SAAS;AACvJ,UAAM,gBAAgB,EAAE,UAAU,OAAO,SAAS,gBAAgB;AAClE,UAAM,WAAW,mBAAmB,IAAI,YAAY,EAAE,OAAO,cAAc,aAAa,CAAC,GAAG,EAAE,gBAAgB,QAAQ,gBAAgB,KAAK,QAAQ,KAAK,iBAAiB,2BAA2B,CAAC;AACrM,QAAI,QAAQ,sBAAsB,UAAa,SAAS,SAAS,kBAAkB,UAAa,CAAC,QAAQ,kBAAkB,SAAS,SAAS,SAAS,OAAO,GAAG,EAAG,OAAM,IAAI,mBAAmB,qBAAqB,sDAAsD;AAC3Q,WAAO,EAAE,UAAU,QAA+C,SAAS;AAAA,EAC7E;AACA,QAAM,WAAW,6BAA6B,MAAM;AACpD,MAAI,QAAQ,mBAAmB,UAAa,SAAS,OAAO,WAAW,QAAQ,eAAgB,OAAM,IAAI,mBAAmB,mBAAmB,0CAA0C;AACzL,MAAI,CAAC,OAAO,SAAS,KAAK,MAAM,SAAS,MAAM,CAAC,KAAK,KAAK,MAAM,SAAS,MAAM,MAAM,QAAQ,OAAO,oBAAI,KAAK,GAAG,QAAQ,EAAG,OAAM,IAAI,mBAAmB,WAAW,sCAAsC;AACzM,MAAI,IAAI,KAAK,SAAS,MAAM,EAAE,YAAY,MAAM,SAAS,OAAQ,OAAM,IAAI,mBAAmB,oBAAoB,mCAAmC;AACrJ,QAAM,SAAS,SAAS,oBAAoB,SAAS,WAAW,oBAAoB,SAAS,oBAAoB,aAAa,SAAS,QAAQ,SAAS,MAAM,IAAI;AAClK,MAAI,SAAS,oBAAoB,SAAS,gBAAgB,QAAQ,sBAAsB,UAAa,CAAC,QAAQ,kBAAkB,SAAS,SAAS,UAAU,SAAS,GAAI,OAAM,IAAI,mBAAmB,qBAAqB,sDAAsD;AACjR,QAAM,YAAY,iBAAiB,SAAS,UAAU,KAAK;AAC3D,QAAM,YAAY,mBAAmB,SAAS,UAAU,SAAS;AACjE,MAAI,UAAU,WAAW,MAAM,CAAC,uBAAQ,OAAO,WAAW,8BAA8B,QAAQ,GAAG,SAAS,EAAG,OAAM,IAAI,mBAAmB,qBAAqB,yCAAyC;AAC1M,SAAO,EAAE,UAAU,UAAU,kBAAkB,UAAU,QAAQ,aAAa,IAAI,WAAW,GAAG,MAAM,EAAE;AAC1G;AAQO,SAAS,kCAAkCA,QAAmB,UAAsJ,CAAC,GAA2C;AACrQ,MAAI;AACJ,MAAI;AAAE,aAAS,KAAK,MAAM,IAAI,YAAY,SAAS,EAAE,OAAO,KAAK,CAAC,EAAE,OAAOA,MAAK,CAAC;AAAA,EAAG,QAAQ;AAAE,UAAM,IAAI,mBAAmB,oBAAoB,mCAAmC;AAAA,EAAG;AACrL,MAAI,OAAO,WAAW,YAAY,WAAW,QAAQ,MAAM,QAAQ,MAAM,EAAG,OAAM,IAAI,mBAAmB,oBAAoB,wCAAwC;AACrK,QAAM,WAAW;AACjB,QAAM,SAAS,SAAS;AACxB,QAAM,WAAW,QAAQ;AACzB,QAAM,sBAAsB,SAAS;AACrC,QAAM,YAAY,SAAS;AAC3B,aAAW,UAAU,CAAC,WAAW,WAAW,cAAc,uBAAuB,UAAU,WAAW,UAAU,WAAW,WAAW,GAAG,uBAAuB;AAChK,MAAI,WAAW,OAAW,YAAW,QAAQ,CAAC,UAAU,gBAAgB,WAAW,UAAU,GAAG,qBAAqB;AACrH,MAAI,aAAa,OAAW,YAAW,UAAU,CAAC,QAAQ,MAAM,GAAG,uBAAuB;AAC1F,MAAI,wBAAwB,QAAW;AACrC,QAAI,oBAAoB,SAAS,SAAU,YAAW,qBAAqB,CAAC,QAAQ,aAAa,aAAa,GAAG,4BAA4B;AAAA,aACpI,oBAAoB,SAAS,YAAa,YAAW,qBAAqB,CAAC,QAAQ,YAAY,GAAG,4BAA4B;AAAA,aAC9H,oBAAoB,SAAS,eAAgB,YAAW,qBAAqB,CAAC,QAAQ,KAAK,GAAG,yBAAyB;AAAA,QAC3H,YAAW,qBAAqB,CAAC,MAAM,GAAG,mCAAmC;AAAA,EACpF;AACA,MAAI,cAAc,OAAW,YAAW,WAAW,CAAC,aAAa,aAAa,OAAO,GAAG,wBAAwB;AAChH,MAAI,SAAS,YAAY,KAAK,OAAO,SAAS,YAAY,YAAY,OAAO,SAAS,WAAW,YAAY,OAAO,QAAQ,WAAW,YAAY,OAAO,OAAO,YAAY,YAAY,OAAO,OAAO,iBAAiB,YAAa,UAAU,SAAS,WAAW,UAAU,SAAS,YAAa,OAAO,SAAS,SAAS,YAAY,OAAO,qBAAqB,SAAS,YAAY,OAAO,WAAW,cAAc,YAAY,UAAU,cAAc,aAAa,OAAO,UAAU,UAAU,SAAU,OAAM,IAAI,mBAAmB,oBAAoB,wCAAwC;AACxkB,MAAI,QAAQ,mBAAmB,UAAa,OAAO,WAAW,QAAQ,eAAgB,OAAM,IAAI,mBAAmB,mBAAmB,0CAA0C;AAChL,QAAM,SAAS,KAAK,MAAM,SAAS,MAAM;AACzC,MAAI,CAAC,OAAO,SAAS,MAAM,KAAK,WAAW,QAAQ,OAAO,oBAAI,KAAK,GAAG,QAAQ,EAAG,OAAM,IAAI,mBAAmB,WAAW,sCAAsC;AAC/J,QAAM,YAAY,mBAAmB,UAAU,SAAS;AACxD,MAAI,oBAAoB,SAAS,aAAa,QAAQ,sBAAsB,UAAa,CAAC,QAAQ,kBAAkB,SAAS,UAAU,SAAS,GAAI,OAAM,IAAI,mBAAmB,qBAAqB,sDAAsD;AAC5P,QAAM,iBAAiB,iBAAiB,UAAU,KAAK;AACvD,QAAM,EAAE,WAAW,YAAY,GAAG,SAAS,IAAI;AAC/C,QAAM,SAAS,IAAI,YAAY,EAAE,OAAO,mCAAmC;AAC3E,QAAM,OAAO,IAAI,YAAY,EAAE,OAAO,cAAc,QAAQ,CAAC;AAC7D,QAAM,eAAe,IAAI,WAAW,OAAO,SAAS,KAAK,MAAM;AAC/D,eAAa,IAAI,MAAM;AAAG,eAAa,IAAI,MAAM,OAAO,MAAM;AAC9D,MAAI,eAAe,WAAW,MAAM,CAAC,uBAAQ,OAAO,gBAAgB,cAAc,SAAS,EAAG,OAAM,IAAI,mBAAmB,qBAAqB,4CAA4C;AAC5L,QAAM,UAAU,QAAQ,aAAa,IAAI,WAAW;AACpD,QAAM,WAA4B;AAAA,IAChC,UAAU;AAAA,MACR,QAAQ;AAAA,MACR,SAAS;AAAA,MACT,QAAQ,OAAO;AAAA,MACf,SAAS,OAAO;AAAA,MAChB,UAAU,EAAE,MAAM,SAAS,MAAM,MAAM,SAAS,KAAK;AAAA,MACrD,eAAe,oBAAoB,SAAS,WAAW,WAAW,oBAAoB,SAAS,gBAAgB,eAAe,oBAAoB,SAAS,iBAAiB,gBAAgB;AAAA,MAC5L,SAAS,CAAC,MAAM;AAAA,MAChB,SAAS,EAAE,UAAU,4BAA4B,MAAM,QAAQ,YAAY,QAAQ,qBAAiB,sBAAO,OAAO,CAAC,EAAE;AAAA,MACrH,WAAW;AAAA,MACX,WAAW,SAAS;AAAA,MACpB,QAAQ,EAAE,KAAK,UAAU,WAAW,WAAW,iBAAiB,SAAS,EAAE;AAAA,MAC3E,WAAW,UAAU;AAAA,MACrB,yBAAyB,oBAAoB;AAAA,IAC/C;AAAA,IACA,SAAS,iBAAiB,OAAO;AAAA,EACnC;AACA,SAAO,EAAE,SAAS;AACpB;AAEO,SAAS,wBAAwB,MAAc,UAA6F,CAAC,GAA+G;AACjQ,MAAI;AACJ,MAAI;AAAE,UAAM,IAAI,IAAI,IAAI;AAAA,EAAG,QAAQ;AAAE,UAAM,IAAI,mBAAmB,gBAAgB,oCAAoC;AAAA,EAAG;AACzH,QAAM,SAAS,gBAAgB,IAAI,MAAM;AACzC,MAAI,QAAQ,mBAAmB,UAAa,CAAC,QAAQ,eAAe,IAAI,eAAe,EAAE,SAAS,MAAM,EAAG,OAAM,IAAI,mBAAmB,mBAAmB,kCAAkC;AAC7L,MAAI,IAAI,WAAW,MAAM,IAAI,aAAa,MAAM,IAAI,aAAa,GAAI,OAAM,IAAI,mBAAmB,gBAAgB,6BAA6B;AAC/I,MAAI,IAAI,aAAa,eAAe,IAAI,KAAK,WAAW,SAAS,GAAG;AAClE,QAAI;AACJ,QAAI;AACF,YAAMA,SAAQ,iBAAiB,IAAI,KAAK,MAAM,UAAU,MAAM,CAAC;AAC/D,UAAIA,OAAM,UAAU,QAAQ,kBAAkB,4BAA4B,EAAG,OAAM,IAAI,MAAM,0BAA0B;AACvH,YAAM,QAAQ,KAAK,MAAM,IAAI,YAAY,SAAS,EAAE,OAAO,KAAK,CAAC,EAAE,OAAOA,MAAK,CAAC;AAChF,UAAI,OAAO,UAAU,YAAY,UAAU,QAAQ,MAAM,QAAQ,KAAK,EAAG,OAAM,IAAI,MAAM,sBAAsB;AAC/G,gBAAU;AAAA,IACZ,SAAS,OAAO;AAAE,YAAM,IAAI,mBAAmB,gBAAgB,iBAAiB,QAAQ,MAAM,UAAU,wBAAwB;AAAA,IAAG;AACnI,QAAI,QAAQ,MAAM,KAAK,OAAO,QAAQ,MAAM,YAAY,OAAO,QAAQ,QAAQ,YAAa,QAAQ,MAAM,UAAa,OAAO,QAAQ,MAAM,YAAa,OAAO,KAAK,OAAO,EAAE,KAAK,CAACQ,SAAQ,CAAC,CAAC,KAAK,KAAK,OAAO,GAAG,EAAE,SAASA,IAAG,CAAC,EAAG,OAAM,IAAI,mBAAmB,gBAAgB,mCAAmC;AACpT,UAAM,SAAS,iBAAiB,QAAQ,CAAC;AACzC,QAAI,CAAC,wBAAwB,QAAQ,KAAK,MAAM,EAAG,OAAM,IAAI,mBAAmB,gBAAgB,mCAAmC;AACnI,UAAMA,OAAM,QAAQ,MAAM,SAAY,SAAY,iBAAiB,QAAQ,CAAC;AAC5E,QAAIA,SAAQ,UAAaA,KAAI,WAAW,GAAI,OAAM,IAAI,mBAAmB,gBAAgB,+BAA+B;AACxH,WAAO,EAAE,QAAQ,KAAK,QAAQ,KAAK,GAAIA,SAAQ,SAAY,CAAC,IAAI,EAAE,KAAAA,KAAI,GAAI,OAAO;AAAA,EACnF;AACA,QAAM,QAAQ,qBAAqB,KAAK,IAAI,QAAQ;AACpD,MAAI,UAAU,QAAQ,CAAC,IAAI,KAAK,WAAW,KAAK,EAAG,OAAM,IAAI,mBAAmB,gBAAgB,iCAAiC;AACjI,QAAM,MAAM,iBAAiB,IAAI,KAAK,MAAM,CAAC,CAAC;AAC9C,MAAI,IAAI,WAAW,GAAI,OAAM,IAAI,mBAAmB,gBAAgB,+BAA+B;AACnG,MAAI;AACF,UAAMN,OAAM,IAAI,MAAM,MAAM,CAAC,CAAC;AAC9B,QAAIA,KAAI,YAAY,KAAKA,KAAI,SAAa,QAAQA,KAAI,UAAU,SAAS,OAAU,QAAQA,KAAI,SAAS,MAAM,MAAM,CAAC,EAAG,OAAM,IAAI,MAAM,KAAK;AAAA,EAC/I,QAAQ;AAAE,UAAM,IAAI,mBAAmB,gBAAgB,+BAA+B;AAAA,EAAG;AACzF,SAAO,EAAE,QAAQ,KAAK,MAAM,CAAC,GAAG,IAAI;AACtC;AAEO,SAAS,cAAc,MAAc,UAA6F,CAAC,GAAsB;AAC9J,MAAI;AACJ,MAAI;AAAE,UAAM,IAAI,IAAI,IAAI;AAAA,EAAG,QAAQ;AAAE,UAAM,IAAI,mBAAmB,gBAAgB,oCAAoC;AAAA,EAAG;AACzH,MAAI,IAAI,WAAW,GAAI,OAAM,IAAI,mBAAmB,gBAAgB,+CAA+C;AACnH,QAAM,SAAS,gBAAgB,IAAI,MAAM;AACzC,MAAI,QAAQ,mBAAmB,UAAa,CAAC,QAAQ,eAAe,IAAI,eAAe,EAAE,SAAS,MAAM,EAAG,OAAM,IAAI,mBAAmB,mBAAmB,kCAAkC;AAC7L,MAAI,IAAI,aAAa,eAAe,IAAI,KAAK,WAAW,SAAS,GAAG;AAClE,UAAM,YAAY,wBAAwB,MAAM,OAAO;AACvD,WAAO,EAAE,MAAM,UAAU,QAAQ,KAAK,UAAU,KAAK,KAAK,UAAU,KAAK,KAAK,GAAG,IAAI,MAAM,GAAG,IAAI,QAAQ,IAAI,UAAU,oBAAoB;AAAA,EAC9I;AACA,QAAM,QAAQ,IAAI,SAAS,MAAM,sBAAsB;AACvD,MAAI,CAAC,MAAO,OAAM,IAAI,mBAAmB,gBAAgB,4BAA4B;AACrF,QAAM,iBAAiB,IAAI,SAAS,KAAK,SAAY,IAAI,gBAAgB,IAAI,KAAK,MAAM,CAAC,CAAC;AAC1F,MAAI,mBAAmB,WAAc,eAAe,IAAI,GAAG,MAAM,QAAQ,CAAC,GAAG,eAAe,KAAK,CAAC,EAAE,KAAK,CAACM,SAAQA,SAAQ,GAAG,GAAI,OAAM,IAAI,mBAAmB,gBAAgB,sCAAsC;AACpN,QAAM,WAAW,gBAAgB,IAAI,GAAG;AACxC,QAAM,MAAM,aAAa,QAAQ,aAAa,SAAY,SAAY,iBAAiB,QAAQ;AAC/F,MAAI,QAAQ,UAAa,IAAI,WAAW,GAAI,OAAM,IAAI,mBAAmB,gBAAgB,+BAA+B;AACxH,MAAI,MAAM,CAAC,MAAM,QAAW;AAC1B,QAAI;AAAE,UAAI,IAAI,MAAM,MAAM,CAAC,CAAC,EAAE,SAAS,MAAM,MAAM,CAAC,EAAG,OAAM,IAAI,MAAM,mBAAmB;AAAA,IAAG,QACvF;AAAE,YAAM,IAAI,mBAAmB,gBAAgB,sBAAsB;AAAA,IAAG;AAC9E,UAAM,WAAW,IAAI,MAAM,MAAM,CAAC,CAAC,EAAE,UAAU,SAAS,OAAU,OAAO,sBAAsB;AAC/F,WAAO,EAAE,MAAM,WAAW,QAAQ,KAAK,MAAM,CAAC,GAAG,KAAK,KAAK,GAAG,IAAI,MAAM,GAAG,IAAI,QAAQ,IAAI,SAAS;AAAA,EACtG;AACA,QAAM,cAAc,iBAAiB,MAAM,CAAC,CAAC;AAC7C,MAAI,YAAY,cAAc,QAAQ,kBAAkB,0BAA2B,OAAM,IAAI,mBAAmB,qBAAqB,2CAA2C;AAChL,SAAO,EAAE,MAAM,UAAU,QAAQ,UAAU,mBAAmB,WAAW,GAAG,KAAK,KAAK,GAAG,IAAI,MAAM,GAAG,IAAI,QAAQ,GAAG;AACvH;AAEO,SAAS,cAAc,MAAuB;AACnD,MAAI;AAAE,WAAO,IAAI,IAAI,IAAI,EAAE,SAAS,WAAW,KAAK;AAAA,EAAG,QAAQ;AAAE,WAAO,KAAK,WAAW,aAAa;AAAA,EAAG;AAC1G;AAEA,eAAsB,kBAAkBR,QAAmB,KAAsC;AAC/F,SAAO,uBAAuBA,QAAO,GAAG;AAC1C;AAEA,eAAsB,uBAAuBA,QAAmB,KAAsC;AACpG,MAAI,IAAI,WAAW,GAAI,OAAM,IAAI,mBAAmB,uBAAuB,8BAA8B;AACzG,QAAM,KAAK,OAAO,gBAAgB,IAAI,WAAW,EAAE,CAAC;AACpD,QAAM,YAAY,MAAM,OAAO,OAAO,UAAU,OAAO,KAA+B,WAAW,OAAO,CAAC,SAAS,CAAC;AACnH,QAAM,aAAa,MAAM,OAAO,OAAO,QAAQ,EAAE,MAAM,WAAW,GAAiC,GAAG,WAAWA,MAA+B;AAChJ,SAAO,IAAI,WAAW,CAAC,GAAG,IAAI,GAAG,IAAI,WAAW,UAAU,CAAC,CAAC;AAC9D;AAEA,eAAsB,uBAAuBA,QAAmB,KAAsC;AACpG,MAAI,IAAI,WAAW,MAAMA,OAAM,SAAS,GAAI,OAAM,IAAI,mBAAmB,oBAAoB,mCAAmC;AAChI,MAAI;AACF,UAAM,YAAY,MAAM,OAAO,OAAO,UAAU,OAAO,KAA+B,WAAW,OAAO,CAAC,SAAS,CAAC;AACnH,WAAO,IAAI,WAAW,MAAM,OAAO,OAAO,QAAQ,EAAE,MAAM,WAAW,IAAIA,OAAM,MAAM,GAAG,EAAE,EAA4B,GAAG,WAAWA,OAAM,MAAM,EAAE,CAA2B,CAAC;AAAA,EAChL,QAAQ;AACN,UAAM,IAAI,mBAAmB,qBAAqB,yBAAyB;AAAA,EAC7E;AACF;AAEO,SAAS,oBAAoB,OAAgD;AAClF,QAAM,MAAM,MAAM;AAClB,MAAI,MAAM,cAAc,UAAa,QAAQ,OAAW,OAAM,IAAI,mBAAmB,uBAAuB,qCAAqC;AACjJ,MAAI,MAAM,wBAAwB,CAAC,MAAM,gCAAgC,MAAM,MAAM,eAAe,KAAK,MAAM,cAAc,UAAa,QAAQ,QAAY,OAAM,IAAI,mBAAmB,oBAAoB,oFAAoF;AACnS,MAAI,MAAM,MAAM,cAAc,MAAM,mBAAmB,4BAA6B,OAAM,IAAI,mBAAmB,qBAAqB,4CAA4C;AAClL,MAAI,QAAQ,OAAW,OAAM,IAAI,mBAAmB,oBAAoB,6CAA6C;AACrH,QAAM,WAAW,kBAAkB;AAAA,IACjC,QAAQ;AAAA,IACR,SAAS;AAAA,IACT,QAAQ,MAAM;AAAA,IACd,SAAS,MAAM;AAAA,IACf,WAAW,MAAM;AAAA,IACjB,eAAe,MAAM,WAAW;AAAA,IAChC,UAAU,MAAM;AAAA,IAChB,SAAS,MAAM;AAAA,IACf,SAAS,EAAE,UAAU,MAAM,UAAU,MAAM,MAAM,MAAM,YAAY,QAAQ,cAAc,MAAM,KAAK,GAAG,GAAI,MAAM,SAAS,WAAW,OAAO,IAAI,EAAE,SAAS,QAAiB,IAAI,CAAC,EAAG;AAAA,IACpL,WAAW;AAAA,IACX,WAAW,MAAM,UAAU,YAAY;AAAA,IACvC,WAAW,MAAM;AAAA,IACjB,kBAAkB,MAAM;AAAA,EAC1B,CAAC;AACD,QAAM,WAAW,EAAE,UAAU,SAAS,iBAAiB,MAAM,KAAK,EAAE;AACpE,SAAO,EAAE,UAAU,OAAO,oBAAoB,QAAQ,GAAG,KAAK,gBAAgB,oBAAoB,QAAQ,CAAC,EAAE;AAC/G;AAEA,eAAsB,yBAAyB,OAAyD;AACtG,QAAM,YAAY,MAAM,cAAc,SAAY,SAAY,8BAA8B,MAAM,SAAS;AAC3G,MAAI,cAAc,UAAa,MAAM,kBAAkB,OAAW,OAAM,IAAI,mBAAmB,uBAAuB,qCAAqC;AAC3J,MAAI,MAAM,wBAAwB,CAAC,MAAM,gCAAgC,MAAM,MAAM,eAAe,KAAK,cAAc,UAAa,MAAM,kBAAkB,QAAY,OAAM,IAAI,mBAAmB,oBAAoB,oFAAoF;AAC7S,MAAI,MAAM,MAAM,cAAc,MAAM,mBAAmB,yBAA0B,OAAM,IAAI,mBAAmB,qBAAqB,8CAA8C;AACjL,QAAM,iBAAiB,MAAM,kBAAkB,SAAY,MAAM,QAAQ,MAAM,uBAAuB,MAAM,OAAO,MAAM,aAAa;AACtI,MAAI,eAAe,aAAa,+BAAgC,OAAM,IAAI,mBAAmB,qBAAqB,mDAAmD;AACrK,QAAM,WAAW,kBAAkB;AAAA,IACjC,QAAQ;AAAA,IACR,SAAS;AAAA,IACT,QAAQ,MAAM;AAAA,IACd,SAAS,MAAM;AAAA,IACf,UAAU,MAAM;AAAA,IAChB,SAAS,MAAM;AAAA,IACf,SAAS,EAAE,UAAU,MAAM,UAAU,MAAM,eAAe,YAAY,QAAQ,cAAc,cAAc,GAAG,GAAI,MAAM,SAAS,WAAW,OAAO,IAAI,EAAE,SAAS,QAAiB,IAAI,CAAC,EAAG;AAAA,IAC1L,WAAW,MAAM,kBAAkB;AAAA,IACnC,WAAW,MAAM,UAAU,YAAY;AAAA,IACvC,WAAW,MAAM;AAAA,IACjB,kBAAkB,MAAM;AAAA,IACxB,GAAI,WAAW,SAAS,WAAW,EAAE,UAAU,IAAI,CAAC;AAAA,IACpD,GAAI,cAAc,SAAY,CAAC,IAAI,EAAE,eAAe,UAAU,KAAK;AAAA,EACrE,CAAC;AACD,QAAM,WAAW,EAAE,UAAU,SAAS,iBAAiB,cAAc,EAAE;AACvE,QAAMA,SAAQ,oBAAoB,QAAQ;AAC1C,SAAO,EAAE,UAAU,OAAAA,QAAO,KAAK,gBAAgBA,MAAK,GAAG,KAAK,MAAM,cAAc;AAClF;AAEO,SAAS,2BAA2B,SAA8B,WAAiE;AACxI,MAAI,QAAQ,YAAY,UAAU,QAAS,QAAO;AAClD,QAAM,OAAO,oBAAoB,QAAQ,UAAU,UAAU,QAAQ;AACrE,MAAI,SAAS,OAAW,QAAO;AAC/B,QAAM,UAAU,UAAU,QAAQ,OAAO,CAAC,WAAW,QAAQ,QAAQ,SAAS,MAAM,CAAC;AACrF,MAAI,QAAQ,WAAW,EAAG,QAAO;AACjC,SAAO,EAAE,SAAS,QAAQ,SAAS,UAAU,MAAM,SAAS,CAAC,GAAG,IAAI,IAAI,OAAO,CAAC,EAAE,KAAK,EAAmB;AAC5G;AAIA,SAAS,oBAAoB,MAAqB,OAAiD;AACjG,MAAI,KAAK,SAAS,WAAW,MAAM,SAAS,QAAS,QAAO,KAAK,SAAS,MAAM,OAAO,OAAO;AAC9F,MAAI,KAAK,SAAS,QAAS,QAAO,iBAAiB,OAAO,IAAI,IAAI,OAAO;AACzE,MAAI,MAAM,SAAS,QAAS,QAAO,iBAAiB,MAAM,KAAK,IAAI,QAAQ;AAC3E,MAAI,iBAAiB,MAAM,KAAK,EAAG,QAAO;AAC1C,MAAI,iBAAiB,OAAO,IAAI,EAAG,QAAO;AAC1C,SAAO;AACT;AAEO,SAAS,sBAAsB,YAAiC,QAAqB,MAAuB;AACjH,MAAI,CAAC,WAAW,QAAQ,SAAS,MAAM,EAAG,QAAO;AACjD,MAAI,WAAW,SAAS,SAAS,QAAS,QAAO,WAAW,UAAU,WAAW,SAAS,SAAS;AACnG,QAAM,SAAS,WAAW,SAAS,KAAK,QAAQ,OAAO,EAAE;AACzD,MAAI,WAAW,OAAQ,QAAO,KAAK,QAAQ,OAAO,EAAE,MAAM;AAC1D,QAAM,YAAY,KAAK,WAAW,GAAG,MAAM,GAAG,IAAI,KAAK,MAAM,OAAO,SAAS,CAAC,IAAI;AAClF,SAAO,UAAU,SAAS,KAAK,CAAC,UAAU,SAAS,GAAG;AACxD;;;ACnjCA,IAAAS,iBAAuB;AA6BvB,SAAS,SAAS,KAA4B;AAC5C,MAAI,CAAC,IAAI,OAAO,CAAC,IAAI,UAAW,OAAM,IAAI,MAAM,yCAAyC;AACzF,SAAO,GAAG,IAAI,GAAG,KAAK,IAAI,SAAS;AACrC;AAEA,SAASC,QAAOC,QAA+B;AAC7C,aAAO,uBAAOA,MAAK;AACrB;AAEA,SAAS,WAAW,MAAkB,OAA4B;AAChE,MAAI,KAAK,eAAe,MAAM,WAAY,QAAO;AACjD,SAAO,KAAK,MAAM,CAAC,MAAM,UAAU,SAAS,MAAM,KAAK,CAAC;AAC1D;AAOO,IAAM,mBAAN,MAA6C;AAAA,EAGlD,YAA6B,MAAkB,MAAM,oBAAI,KAAK,GAAG;AAApC;AAF7B,SAAiB,UAAU,oBAAI,IAA6B;AAAA,EAEM;AAAA,EAElE,MAAM,IAAI,KAAoB,MAAM,oBAAI,KAAK,GAAoC;AAC/E,UAAM,SAAS,SAAS,GAAG;AAC3B,UAAM,QAAQ,KAAK,QAAQ,IAAI,MAAM;AACrC,QAAI,UAAU,OAAW,QAAO;AAChC,QAAI,KAAK,MAAM,MAAM,IAAI,SAAS,KAAK,IAAI,QAAQ,KAAK,CAAC,WAAW,MAAM,QAAQD,QAAO,MAAM,KAAK,CAAC,GAAG;AACtG,WAAK,QAAQ,OAAO,MAAM;AAC1B,aAAO;AAAA,IACT;AACA,WAAO,MAAM,MAAM,MAAM;AAAA,EAC3B;AAAA,EAEA,MAAM,SAASE,MAAa,MAAM,oBAAI,KAAK,GAAyC;AAClF,UAAM,UAAU,CAAC,GAAG,KAAK,QAAQ,OAAO,CAAC,EAAE,OAAO,CAAC,UAAU,MAAM,IAAI,QAAQA,IAAG;AAClF,eAAW,SAAS,SAAS;AAC3B,UAAI,KAAK,MAAM,MAAM,IAAI,SAAS,KAAK,IAAI,QAAQ,KAAK,CAAC,WAAW,MAAM,QAAQF,QAAO,MAAM,KAAK,CAAC,GAAG;AACtG,aAAK,QAAQ,OAAO,SAAS,MAAM,GAAG,CAAC;AACvC;AAAA,MACF;AACA,aAAO;AAAA,QACL,KAAK,EAAE,GAAG,MAAM,IAAI;AAAA,QACpB,OAAO,MAAM,MAAM,MAAM;AAAA,QACzB,QAAQ,MAAM,OAAO,MAAM;AAAA,QAC3B,UAAU,EAAE,GAAG,MAAM,SAAS;AAAA,MAChC;AAAA,IACF;AACA,WAAO;AAAA,EACT;AAAA,EAEA,MAAM,IAAI,KAAoBC,QAAmB,UAA6C;AAC5F,QAAI,KAAK,MAAM,IAAI,SAAS,KAAK,KAAK,IAAI,EAAE,QAAQ,EAAG;AACvD,SAAK,QAAQ,IAAI,SAAS,GAAG,GAAG;AAAA,MAC9B,KAAK,EAAE,KAAK,IAAI,KAAK,WAAW,IAAI,UAAU;AAAA,MAC9C,OAAOA,OAAM,MAAM;AAAA,MACnB,QAAQD,QAAOC,MAAK;AAAA,MACpB,UAAU,EAAE,GAAG,SAAS;AAAA,IAC1B,CAAC;AAAA,EACH;AAAA,EAEA,MAAM,OAAO,KAAmC;AAC9C,SAAK,QAAQ,OAAO,SAAS,GAAG,CAAC;AAAA,EACnC;AAAA,EAEA,MAAM,QAAuB;AAC3B,SAAK,QAAQ,MAAM;AAAA,EACrB;AACF;;;ACmQO,IAAM,gBAAN,cAA4B,MAAM;AAAA,EAKvC,YAAY,MAAc,MAAe;AACvC,UAAM,wBAAwB,IAAI,mCAAmC;AALvE,SAAS,OAAO;AAMd,SAAK,OAAO;AACZ,SAAK,OAAO;AACZ,SAAK,OAAO;AAAA,EACd;AACF;AAEO,IAAM,mBAAN,cAA+B,MAAM;AAAA,EAI1C,YAAYE,OAAc,SAAkB,SAAmB;AAC7D,UAAM,WAAW,sCAAsC;AACvD,SAAK,OAAO;AACZ,SAAK,OAAOA;AACZ,SAAK,UAAU;AAAA,EACjB;AACF;;;AC5XA,IAAAC,cAAkB;AAEX,IAAM,6BAA6B,cAAE,mBAAmB,QAAQ;AAAA,EACrE,cAAE,OAAO,EAAE,MAAM,cAAE,QAAQ,YAAY,GAAG,OAAO,cAAE,OAAO,EAAE,IAAI,CAAC,EAAE,CAAC,EAAE,OAAO;AAAA,EAC7E,cAAE,OAAO,EAAE,MAAM,cAAE,QAAQ,aAAa,GAAG,OAAO,cAAE,OAAO,EAAE,IAAI,CAAC,EAAE,CAAC,EAAE,OAAO;AAAA,EAC9E,cAAE,OAAO,EAAE,MAAM,cAAE,QAAQ,cAAc,GAAG,OAAO,cAAE,OAAO,EAAE,MAAM,oBAAoB,EAAE,CAAC,EAAE,OAAO;AAAA,EACpG,cAAE,OAAO,EAAE,MAAM,cAAE,QAAQ,QAAQ,EAAE,CAAC,EAAE,OAAO;AACjD,CAAC;AAEM,IAAM,sBAAsB,cAAE,mBAAmB,QAAQ;AAAA,EAC9D,cAAE,OAAO,EAAE,MAAM,cAAE,QAAQ,OAAO,GAAG,MAAM,cAAE,OAAO,EAAE,IAAI,CAAC,EAAE,CAAC,EAAE,OAAO;AAAA,EACvE,cAAE,OAAO,EAAE,MAAM,cAAE,QAAQ,QAAQ,GAAG,MAAM,cAAE,OAAO,EAAE,IAAI,CAAC,EAAE,CAAC,EAAE,OAAO;AAC1E,CAAC;AAEM,IAAM,oBAAoB,cAAE,KAAK,CAAC,QAAQ,QAAQ,MAAM,CAAC;AAEzD,IAAM,6BAA6B,cAAE,OAAO;AAAA,EACjD,kBAAkB;AAAA,EAClB,SAAS,cAAE,OAAO,EAAE,IAAI,CAAC;AAAA,EACzB,UAAU;AAAA,EACV,SAAS,cAAE,MAAM,iBAAiB,EAAE,IAAI,CAAC;AAAA,EACzC,WAAW,cAAE,KAAK;AACpB,CAAC,EAAE,OAAO;AAEH,IAAM,oCAAoC,cAAE,OAAO;AAAA,EACxD,gBAAgB,cAAE,MAAM,cAAE,OAAO,EAAE,IAAI,CAAC,EAAE,IAAI,CAAC;AAAA,EAC/C,gBAAgB,cAAE,OAAO,EAAE,IAAI,EAAE,SAAS,EAAE,SAAS;AAAA,EACrD,kBAAkB,cAAE,OAAO,EAAE,IAAI,EAAE,SAAS,EAAE,SAAS;AAAA,EACvD,iBAAiB,cAAE,OAAO,EAAE,IAAI,EAAE,SAAS,EAAE,SAAS;AAAA,EACtD,uBAAuB,cAAE,OAAO,EAAE,IAAI,EAAE,SAAS,EAAE,SAAS;AAC9D,CAAC,EAAE,OAAO;AAEV,IAAM,0BAA0B,cAAE,KAAK,CAAC,oBAAoB,yBAAyB,qBAAqB,kBAAkB,CAAC;AAC7H,IAAM,wBAAwB,cAAE,KAAK,CAAC,oBAAoB,yBAAyB,qBAAqB,oBAAoB,oBAAoB,CAAC;AACjJ,IAAM,2BAA2B,cAAE,mBAAmB,QAAQ;AAAA,EAC5D,cAAE,OAAO;AAAA,IACP,MAAM,cAAE,QAAQ,IAAI;AAAA,IACpB,QAAQ;AAAA,IACR,OAAO,cAAE,OAAO,EAAE,IAAI,CAAC;AAAA,IACvB,MAAM,cAAE,OAAO,EAAE,IAAI,CAAC;AAAA,EACxB,CAAC,EAAE,OAAO;AAAA,EACV,cAAE,OAAO;AAAA,IACP,MAAM,cAAE,QAAQ,KAAK;AAAA,IACrB,QAAQ,cAAE,QAAQ,oBAAoB;AAAA,IACtC,OAAO,cAAE,OAAO,EAAE,IAAI,CAAC;AAAA,IACvB,UAAU,cAAE,OAAO,EAAE,IAAI,CAAC;AAAA,IAC1B,MAAM,cAAE,OAAO,EAAE,IAAI,CAAC;AAAA,IACtB,WAAW,cAAE,OAAO,EAAE,IAAI,CAAC;AAAA,IAC3B,WAAW,cAAE,OAAO,cAAE,OAAO,EAAE,IAAI,EAAE,KAAK,CAAC;AAAA,IAC3C,iBAAiB,cAAE,OAAO,EAAE,IAAI,CAAC;AAAA,EACnC,CAAC,EAAE,OAAO;AACZ,CAAC;AACD,IAAM,gCAAgC,cAAE,mBAAmB,QAAQ;AAAA,EACjE,cAAE,OAAO,EAAE,MAAM,cAAE,QAAQ,YAAY,GAAG,OAAO,cAAE,OAAO,EAAE,IAAI,CAAC,EAAE,CAAC,EAAE,OAAO;AAAA,EAC7E,cAAE,OAAO,EAAE,MAAM,cAAE,QAAQ,aAAa,GAAG,OAAO,cAAE,OAAO,EAAE,IAAI,CAAC,EAAE,CAAC,EAAE,OAAO;AAAA,EAC9E,cAAE,OAAO,EAAE,MAAM,cAAE,QAAQ,cAAc,GAAG,OAAO,cAAE,OAAO,EAAE,MAAM,oBAAoB,EAAE,CAAC,EAAE,OAAO;AACtG,CAAC;AAEM,IAAM,0CAA0C,cAAE,OAAO;AAAA,EAC9D,SAAS,cAAE,QAAQ,CAAC;AAAA,EACpB,OAAO,cAAE,OAAO,EAAE,IAAI,CAAC;AAAA,EACvB,KAAK,cAAE,OAAO,EAAE,IAAI,CAAC;AAAA,EACrB,WAAW,cAAE,OAAO,EAAE,IAAI,CAAC;AAAA,EAC3B,kBAAkB;AAAA,EAClB,cAAc,cAAE,OAAO,EAAE,IAAI;AAAA,EAC7B,cAAc,cAAE,OAAO,EAAE,IAAI,CAAC;AAAA,EAC9B,UAAU,cAAE,OAAO,EAAE,IAAI,CAAC;AAAA,EAC1B,SAAS,cAAE,OAAO,EAAE,IAAI,CAAC;AAAA,EACzB,eAAe,cAAE,OAAO,EAAE,IAAI,CAAC;AAAA,EAC/B,yBAAyB,cAAE,OAAO,EAAE,IAAI,CAAC;AAAA,EACzC,yBAAyB,cAAE,OAAO,EAAE,IAAI,CAAC;AAAA,EACzC,eAAe;AAAA,EACf,qBAAqB,cAAE,OAAO,EAAE,IAAI,CAAC;AAAA,EACrC,SAAS,cAAE,MAAM,qBAAqB,EAAE,IAAI,CAAC,EAAE,OAAO,CAAC,YAAY,IAAI,IAAI,OAAO,EAAE,SAAS,QAAQ,MAAM;AAAA,EAC3G,UAAU,cAAE,OAAO,EAAE,MAAM,cAAE,KAAK,CAAC,SAAS,QAAQ,CAAC,GAAG,OAAO,cAAE,OAAO,EAAE,IAAI,CAAC,EAAE,CAAC,EAAE,OAAO;AAAA,EAC3F,WAAW,cAAE,OAAO,EAAE,SAAS,EAAE,QAAQ,KAAK,CAAC;AAAA,EAC/C,mBAAmB,cAAE,OAAO,EAAE,IAAI,CAAC;AACrC,CAAC,EAAE,OAAO;AAEH,IAAM,2CAA2C,cAAE,OAAO;AAAA,EAC/D,SAAS;AAAA,EACT,OAAO,cAAE,OAAO,EAAE,KAAK,cAAE,QAAQ,OAAO,GAAG,KAAK,cAAE,OAAO,EAAE,IAAI,CAAC,GAAG,WAAW,cAAE,OAAO,EAAE,IAAI,CAAC,EAAE,CAAC,EAAE,OAAO;AAC5G,CAAC,EAAE,OAAO;AAEH,IAAM,2CAA2C,cAAE,OAAO;AAAA,EAC/D,MAAM,cAAE,QAAQ,mCAAmC;AAAA,EACnD,SAAS,cAAE,QAAQ,CAAC;AAAA,EACpB,OAAO,cAAE,OAAO,EAAE,IAAI,CAAC;AAAA,EACvB,KAAK,cAAE,OAAO,EAAE,IAAI,CAAC;AAAA,EACrB,WAAW,cAAE,OAAO,EAAE,IAAI,CAAC;AAAA,EAC3B,aAAa,cAAE,OAAO,EAAE,IAAI,CAAC;AAAA,EAC7B,cAAc,cAAE,OAAO,EAAE,IAAI,CAAC;AAAA,EAC9B,eAAe,cAAE,OAAO,EAAE,IAAI,CAAC;AAAA,EAC/B,iBAAiB,cAAE,OAAO,EAAE,IAAI,CAAC;AAAA,EACjC,kBAAkB,cAAE,OAAO,EAAE,IAAI,CAAC;AAAA,EAClC,yBAAyB,cAAE,OAAO,EAAE,IAAI,CAAC;AAAA,EACzC,yBAAyB,cAAE,OAAO,EAAE,IAAI,CAAC;AAAA,EACzC,SAAS,cAAE,MAAM,qBAAqB,EAAE,IAAI,CAAC,EAAE,OAAO,CAAC,YAAY,IAAI,IAAI,OAAO,EAAE,SAAS,QAAQ,MAAM;AAAA,EAC3G,UAAU,cAAE,OAAO,EAAE,MAAM,cAAE,KAAK,CAAC,SAAS,QAAQ,CAAC,GAAG,OAAO,cAAE,OAAO,EAAE,IAAI,CAAC,EAAE,CAAC,EAAE,OAAO;AAAA,EAC3F,WAAW,cAAE,OAAO,EAAE,SAAS,EAAE,QAAQ,KAAK,CAAC;AAAA,EAC/C,OAAO,cAAE,OAAO,EAAE,KAAK,cAAE,QAAQ,OAAO,GAAG,KAAK,cAAE,OAAO,EAAE,IAAI,CAAC,GAAG,WAAW,cAAE,OAAO,EAAE,IAAI,CAAC,EAAE,CAAC,EAAE,OAAO;AAC5G,CAAC,EAAE,OAAO;AAEV,IAAM,iCAAiC,cAAE,OAAO;AAAA,EAC9C,MAAM,cAAE,OAAO,EAAE,IAAI,CAAC;AAAA,EACtB,MAAM,cAAE,KAAK,CAAC,QAAQ,QAAQ,CAAC;AACjC,CAAC,EAAE,OAAO;AAOV,IAAM,0BAA0B;AAAA,EAC9B,MAAM,cAAE,QAAQ,8BAA8B;AAAA,EAC9C,SAAS,cAAE,QAAQ,CAAC;AAAA,EACpB,UAAU,cAAE,OAAO,EAAE,IAAI,CAAC;AAC5B;AAEO,IAAM,4BAA4B,cAAE,mBAAmB,UAAU;AAAA,EACtE,cAAE,OAAO;AAAA,IACP,GAAG;AAAA,IACH,QAAQ,cAAE,QAAQ,uBAAuB;AAAA,IACzC,UAAU,cAAE,OAAO,cAAE,OAAO,CAAC;AAAA,IAC7B,MAAM,cAAE,OAAO,EAAE,IAAI,CAAC,EAAE,SAAS;AAAA,EACnC,CAAC,EAAE,OAAO;AAAA,EACV,cAAE,OAAO;AAAA,IACP,GAAG;AAAA,IACH,QAAQ,cAAE,QAAQ,kBAAkB;AAAA,IACpC,WAAW,cAAE,OAAO,EAAE,IAAI,CAAC;AAAA,IAC3B,SAAS,cAAE,OAAO;AAAA,IAClB,YAAY,cAAE,OAAO,EAAE,IAAI,CAAC;AAAA,IAC5B,MAAM,cAAE,OAAO,EAAE,IAAI,CAAC,EAAE,SAAS;AAAA,EACnC,CAAC,EAAE,OAAO;AAAA,EACV,cAAE,OAAO;AAAA,IACP,GAAG;AAAA,IACH,QAAQ,cAAE,QAAQ,mBAAmB;AAAA,IACrC,SAAS,cAAE,MAAM,8BAA8B;AAAA,IAC/C,YAAY,cAAE,OAAO,EAAE,IAAI,CAAC,EAAE,SAAS;AAAA,EACzC,CAAC,EAAE,OAAO;AAAA,EACV,cAAE,OAAO;AAAA,IACP,GAAG;AAAA,IACH,QAAQ,cAAE,QAAQ,kBAAkB;AAAA,IACpC,MAAM,cAAE,OAAO,EAAE,IAAI,CAAC;AAAA,IACtB,YAAY,cAAE,OAAO,EAAE,IAAI,CAAC;AAAA,IAC5B,aAAa,cAAE,OAAO,EAAE,IAAI,CAAC;AAAA,EAC/B,CAAC,EAAE,OAAO;AACZ,CAAC;;;ACnJD,IAAAC,cAAkB;;;ACAlB,IAAAC,iBAAuB;AACvB,IAAAC,iBAAuB;AACvB,IAAAC,kBAAwB;AAIxB,IAAAC,cAAkB;;;ACIX,IAAM,2BAAN,cAAuC,MAAM;AAAA,EAGlD,YAAYC,OAA6B,SAAiB;AACxD,UAAM,OAAO;AACb,SAAK,OAAO;AACZ,SAAK,OAAOA;AAAA,EACd;AACF;AASO,IAAM,oCAAN,cAAgD,yBAAyB;AAAA,EAC9E,YAAY,SAAiB;AAC3B,UAAM,6BAA6B,OAAO;AAC1C,SAAK,OAAO;AAAA,EACd;AACF;;;ACrBA,IAAM,eACH,OAEE,UACF,OAAO,UAAU,eAAe,KAAK;AAAA,EACpC,OAAO,UAAU;AACnB;AAWK,SAAS,gBAAgB,OAAwB;AACtD,SAAO,UAAU,cAAc,OAAO,GAAG,CAAC;AAC5C;AAEO,SAAS,cAAc,OAAgB,OAAO,KAAgB;AACnE,MAAI,UAAU,MAAM;AAClB,WAAO;AAAA,EACT;AAEA,UAAQ,OAAO,OAAO;AAAA,IACpB,KAAK;AACH,aAAO;AAAA,IACT,KAAK;AACH,UAAI,CAAC,OAAO,SAAS,KAAK,GAAG;AAC3B,cAAM,IAAI;AAAA,UACR,GAAG,IAAI;AAAA,QACT;AAAA,MACF;AACA,aAAO;AAAA,IACT,KAAK;AACH,gCAA0B,OAAO,IAAI;AACrC,aAAO;AAAA,IACT,KAAK;AACH,aAAO,2BAA2B,OAAO,IAAI;AAAA,IAC/C,KAAK;AAAA,IACL,KAAK;AAAA,IACL,KAAK;AAAA,IACL,KAAK;AAAA,IACL;AACE,YAAM,IAAI;AAAA,QACR,GAAG,IAAI;AAAA,MACT;AAAA,EACJ;AACF;AAEO,SAAS,UAAU,OAA0B;AAClD,MAAI,UAAU,MAAM;AAClB,WAAO;AAAA,EACT;AAEA,UAAQ,OAAO,OAAO;AAAA,IACpB,KAAK;AACH,aAAO,QAAQ,SAAS;AAAA,IAC1B,KAAK,UAAU;AACb,YAAM,UAAU,KAAK,UAAU,KAAK;AACpC,UAAI,YAAY,QAAW;AACzB,cAAM,IAAI;AAAA,UACR;AAAA,QACF;AAAA,MACF;AACA,aAAO;AAAA,IACT;AAAA,IACA,KAAK;AACH,aAAO,KAAK,UAAU,KAAK;AAAA,IAC7B,KAAK;AACH,UAAI,MAAM,QAAQ,KAAK,GAAG;AACxB,eAAO,IAAI,MAAM,IAAI,CAAC,SAAS,UAAU,IAAI,CAAC,EAAE,KAAK,GAAG,CAAC;AAAA,MAC3D;AACA,aAAO,gBAAgB,KAAK;AAAA,IAC9B;AACE,YAAM,IAAI;AAAA,QACR,+BAA+B,OAAO,KAAK;AAAA,MAC7C;AAAA,EACJ;AACF;AAEA,SAAS,2BAA2B,OAAe,MAAyB;AAC1E,qBAAmB,OAAO,IAAI;AAE9B,MAAI,MAAM,QAAQ,KAAK,GAAG;AACxB,eAAW,OAAO,OAAO,oBAAoB,KAAK,GAAG;AACnD,UAAI,QAAQ,UAAU;AACpB;AAAA,MACF;AACA,UAAI,CAAC,gBAAgB,KAAK,MAAM,MAAM,GAAG;AACvC,cAAM,IAAI;AAAA,UACR,GAAG,IAAI,IAAI,GAAG;AAAA,QAChB;AAAA,MACF;AACA,YAAM,aAAa,OAAO,yBAAyB,OAAO,GAAG;AAC7D,UAAI,YAAY,eAAe,MAAM;AACnC,cAAM,IAAI;AAAA,UACR,GAAG,IAAI,IAAI,GAAG;AAAA,QAChB;AAAA,MACF;AACA,UAAI,EAAE,WAAW,aAAa;AAC5B,cAAM,IAAI;AAAA,UACR,GAAG,IAAI,IAAI,GAAG;AAAA,QAChB;AAAA,MACF;AAAA,IACF;AACA,UAAMC,UAAsB,CAAC;AAC7B,aAAS,QAAQ,GAAG,QAAQ,MAAM,QAAQ,SAAS;AACjD,UAAI,CAAC,aAAa,OAAO,KAAK,GAAG;AAC/B,cAAM,IAAI;AAAA,UACR,GAAG,IAAI,IAAI,KAAK;AAAA,QAClB;AAAA,MACF;AACA,MAAAA,QAAO,KAAK,cAAc,MAAM,KAAK,GAAG,GAAG,IAAI,IAAI,KAAK,GAAG,CAAC;AAAA,IAC9D;AACA,WAAOA;AAAA,EACT;AAEA,QAAM,QAAQ,OAAO,eAAe,KAAK;AACzC,MAAI,UAAU,OAAO,aAAa,UAAU,MAAM;AAChD,UAAM,IAAI;AAAA,MACR,GAAG,IAAI;AAAA,IACT;AAAA,EACF;AAEA,QAAM,SAAS,uBAAO,OAAO,IAAI;AACjC,aAAW,OAAO,OAAO,oBAAoB,KAAK,GAAG;AACnD,8BAA0B,KAAK,GAAG,IAAI,MAAM;AAC5C,QAAI,QAAQ,eAAe,QAAQ,eAAe;AAChD,YAAM,IAAI;AAAA,QACR,GAAG,IAAI,IAAI,GAAG;AAAA,MAChB;AAAA,IACF;AACA,UAAM,aAAa,OAAO,yBAAyB,OAAO,GAAG;AAC7D,QAAI,YAAY,eAAe,MAAM;AACnC,YAAM,IAAI;AAAA,QACR,GAAG,IAAI,IAAI,GAAG;AAAA,MAChB;AAAA,IACF;AACA,QAAI,EAAE,WAAW,aAAa;AAC5B,YAAM,IAAI;AAAA,QACR,GAAG,IAAI,IAAI,GAAG;AAAA,MAChB;AAAA,IACF;AACA,UAAM,QAAQ,WAAW;AACzB,WAAO,GAAG,IAAI,cAAc,OAAO,GAAG,IAAI,IAAI,GAAG,EAAE;AAAA,EACrD;AACA,SAAO;AACT;AAEA,SAAS,mBAAmB,OAAe,MAAoB;AAC7D,MAAI,OAAO,sBAAsB,KAAK,EAAE,SAAS,GAAG;AAClD,UAAM,IAAI;AAAA,MACR,GAAG,IAAI;AAAA,IACT;AAAA,EACF;AACF;AAEA,SAAS,gBAAgB,KAAaC,SAAyB;AAC7D,MAAI,CAAC,iBAAiB,KAAK,GAAG,GAAG;AAC/B,WAAO;AAAA,EACT;AACA,QAAM,QAAQ,OAAO,GAAG;AACxB,SAAO,OAAO,cAAc,KAAK,KAAK,SAAS,KAAK,QAAQA;AAC9D;AAEA,SAAS,gBAAgB,OAAsD;AAC7E,QAAM,OAAO,OAAO,KAAK,KAAK,EAAE,KAAK,qBAAqB;AAC1D,QAAM,QAAQ,KAAK,IAAI,CAAC,QAAQ,GAAG,KAAK,UAAU,GAAG,CAAC,IAAI,UAAU,MAAM,GAAG,CAAC,CAAC,EAAE;AACjF,SAAO,IAAI,MAAM,KAAK,GAAG,CAAC;AAC5B;AAEA,SAAS,sBAAsB,GAAW,GAAmB;AAC3D,QAAM,MAAM,KAAK,IAAI,EAAE,QAAQ,EAAE,MAAM;AACvC,WAAS,QAAQ,GAAG,QAAQ,KAAK,SAAS;AACxC,UAAM,eAAe,EAAE,WAAW,KAAK;AACvC,UAAM,gBAAgB,EAAE,WAAW,KAAK;AACxC,QAAI,iBAAiB,eAAe;AAClC,aAAO,eAAe;AAAA,IACxB;AAAA,EACF;AACA,SAAO,EAAE,SAAS,EAAE;AACtB;AAEA,SAAS,0BAA0B,OAAe,MAAoB;AACpE,WAAS,QAAQ,GAAG,QAAQ,MAAM,QAAQ,SAAS;AACjD,UAAMC,QAAO,MAAM,WAAW,KAAK;AACnC,QAAIA,SAAQ,SAAUA,SAAQ,OAAQ;AACpC,YAAM,OAAO,MAAM,WAAW,QAAQ,CAAC;AACvC,UAAI,OAAO,MAAM,IAAI,KAAK,OAAO,SAAU,OAAO,OAAQ;AACxD,cAAM,IAAI;AAAA,UACR,GAAG,IAAI;AAAA,QACT;AAAA,MACF;AACA;AACA;AAAA,IACF;AACA,QAAIA,SAAQ,SAAUA,SAAQ,OAAQ;AACpC,YAAM,IAAI;AAAA,QACR,GAAG,IAAI;AAAA,MACT;AAAA,IACF;AAAA,EACF;AACF;;;AFpMO,IAAM,iCAAiC;AA2X9C,IAAM,2BAA2B;AAAA,EAC/B;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AACF;AA2SA,IAAM,sBAAsB,cAAE,OAAO;AAAA,EACnC,KAAK,cAAE,QAAQ,OAAO;AAAA,EACtB,KAAK,cAAE,OAAO,EAAE,KAAK,cAAE,QAAQ,OAAO,GAAG,KAAK,cAAE,QAAQ,SAAS,GAAG,KAAK,cAAE,QAAQ,KAAK,GAAG,GAAG,cAAE,OAAO,EAAE,IAAI,CAAC,EAAE,CAAC,EAAE,OAAO;AAAA,EAC1H,KAAK,cAAE,QAAQ,KAAK;AAAA,EACpB,KAAK,cAAE,QAAQ,QAAQ;AACzB,CAAC,EAAE,OAAO;AACV,IAAM,uBAAuB,cAAE,OAAO;AAAA,EACpC,KAAK,cAAE,OAAO,cAAE,OAAO,cAAE,MAAM,cAAE,QAAQ,CAAC,EAAE,IAAI,CAAC,CAAC,CAAC;AAAA,EACnD,KAAK,cAAE,OAAO,EAAE,IAAI,CAAC;AAAA,EACrB,KAAK,cAAE,OAAO,EAAE,IAAI;AAAA,EACpB,KAAK,cAAE,MAAM,cAAE,OAAO,cAAE,QAAQ,CAAC,CAAC,EAAE,OAAO,CAAC;AAAA,EAC5C,KAAK,cAAE,OAAO,EAAE,IAAI,CAAC;AAAA,EACrB,KAAK,cAAE,OAAO,EAAE,IAAI;AAAA,EACpB,KAAK,cAAE,OAAO,EAAE,IAAI,CAAC;AAAA,EACrB,KAAK,cAAE,MAAM,cAAE,OAAO,EAAE,IAAI,CAAC,CAAC;AAChC,CAAC,EAAE,OAAO;AAkEH,SAAS,8BACd,OAC4B;AAC5B,QAAM,UAAU,uBAAuB,MAAM,oBAAoB;AACjE,MAAI,QAAQ,QAAQ,MAAM,cAAc,QAAQ,QAAQ,MAAM;AAC5D,UAAM,IAAI,MAAM,mDAAmD;AACrE,QAAM,YAAY,MAAM,aAAa,MAAM,KAAK,CAAC,EAAE,CAAC;AACpD,QAAM,cAAc,UAAU,OAAO,UAAU,MAAM,WAAW,MAAM,CAAC;AACvE,MAAI,YAAY,WAAW,MAAM,YAAY,CAAC,MAAM,OAAQ,YAAY,CAAC,MAAM;AAC7E,UAAM,IAAI,MAAM,kDAAkD;AACpE,QAAM,YAAY,wBAAQ,aAAa,MAAM,UAAU;AACvD,MAAI,CAACC,YAAW,WAAW,YAAY,MAAM,CAAC,CAAC;AAC7C,UAAM,IAAI,MAAM,2DAA2D;AAC7E,QAAM,MAAM,MAAM,OAAO,KAAK,MAAM,KAAK,IAAI,IAAI,GAAI;AACrD,QAAM,MAAM,KAAK,IAAI,MAAM,IAAI,QAAQ,GAAG;AAC1C,MAAI,OAAO,IAAK,OAAM,IAAI,MAAM,4BAA4B;AAC5D,QAAM,SAAS,EAAE,KAAK,SAAS,KAAK,EAAE,KAAK,SAAS,KAAK,WAAW,KAAK,OAAO,GAAG,gBAAgB,SAAS,EAAE,GAAG,KAAK,OAAO,KAAK,SAAS;AAC3I,QAAM,UAAU;AAAA,IACd,KAAK,EAAE,CAAC,MAAM,QAAQ,GAAG,EAAE,CAAC,MAAM,MAAM,GAAG,CAAC,MAAM,UAAU,CAAC,CAAC,EAAE,EAAE;AAAA,IAClE,KAAK,MAAM;AAAA,IACX;AAAA,IACA,KAAK,CAAC,MAAM,SAAS,EAAE,MAAM,kCAAkC,WAAW,QAAQ,KAAK,WAAW,YAAY,QAAQ,IAAI,CAAC;AAAA,IAC3H,KAAK,MAAM,aAAa,SAAS,GAAG,IAAI,MAAM,eAAe,GAAG,SAAS,IAAI,UAAU,MAAM,WAAW,MAAM,CAAC;AAAA,IAC/G,KAAK;AAAA,IACL,KAAK,MAAM,SAAS,gBAAgB,OAAO,gBAAgB,IAAI,WAAW,EAAE,CAAC,CAAC;AAAA,IAC9E,KAAK,CAAC,QAAQ,GAAG;AAAA,EACnB;AACA,QAAM,mBAAmB,gBAAgB,IAAI,YAAY,EAAE,OAAO,gBAAgB,MAAM,CAAC,CAAC;AAC1F,QAAM,iBAAiB,gBAAgB,IAAI,YAAY,EAAE,OAAO,gBAAgB,OAAO,CAAC,CAAC;AACzF,QAAM,eAAe,IAAI,YAAY,EAAE,OAAO,GAAG,gBAAgB,IAAI,cAAc,EAAE;AACrF,QAAM,YAAY,wBAAQ,KAAK,cAAc,MAAM,UAAU;AAC7D,SAAO,8BAA8B,GAAG,gBAAgB,IAAI,cAAc,IAAI,gBAAgB,SAAS,CAAC,EAAE;AAC5G;AAEO,SAAS,8BAA8B,OAUf;AAC7B,QAAM,SAAS,8BAA8B,MAAM,qBAAqB,MAAM,SAAS;AACvF,MAAI,OAAO,QAAQ,QAAQ,MAAM,UAAW,OAAM,IAAI,MAAM,qDAAqD;AACjH,QAAM,aAAa,OAAO,QAAQ,IAAI,CAAC;AACvC,QAAM,QAAQ,WAAW;AACzB,MAAI,CAAC,OAAO,UAAU,KAAK,KAAM,SAAoB,EAAG,OAAM,IAAI,MAAM,sCAAsC;AAC9G,MAAI,CAAC,2BAA2B,OAAO,QAAQ,KAAK,MAAM,WAAW;AACnE,UAAM,IAAI,MAAM,kDAAkD;AACpE,QAAM,YAAY,MAAM,UAAU,MAAM,KAAK,CAAC,EAAE,CAAC;AACjD,QAAM,cAAc,UAAU,OAAO,UAAU,MAAM,WAAW,MAAM,CAAC;AACvE,QAAM,YAAY,wBAAQ,aAAa,MAAM,UAAU;AACvD,MAAI,YAAY,WAAW,MAAM,CAACA,YAAW,WAAW,YAAY,MAAM,CAAC,CAAC,EAAG,OAAM,IAAI,MAAM,mDAAmD;AAClJ,QAAM,MAAM,KAAK,IAAI,MAAM,OAAO,KAAK,MAAM,KAAK,IAAI,IAAI,GAAI,GAAG,OAAO,QAAQ,MAAM,CAAC;AACvF,QAAM,MAAM,KAAK,IAAI,MAAM,aAAa,MAAM,IAAI,MAAM,IAAI,OAAO,QAAQ,MAAM,CAAC;AAClF,MAAI,OAAO,IAAK,OAAM,IAAI,MAAM,wDAAwD;AACxF,QAAM,SAAS,EAAE,KAAK,SAAS,KAAK,EAAE,KAAK,SAAS,KAAK,WAAW,KAAK,OAAO,GAAG,gBAAgB,SAAS,EAAE,GAAG,KAAK,OAAO,KAAK,SAAS;AAC3I,QAAM,UAAU;AAAA,IACd,KAAK,MAAM;AAAA,IACX,KAAK,MAAM;AAAA,IACX;AAAA,IACA,KAAK,CAAC,EAAE,GAAG,YAAY,4BAA6B,QAAmB,EAAE,CAAC;AAAA,IAC1E,KAAK,MAAM,UAAU,SAAS,GAAG,IAAI,MAAM,YAAY,GAAG,SAAS,IAAI,UAAU,MAAM,WAAW,MAAM,CAAC;AAAA,IACzG,KAAK;AAAA,IACL,KAAK,MAAM,SAAS,gBAAgB,OAAO,gBAAgB,IAAI,WAAW,EAAE,CAAC,CAAC;AAAA,IAC9E,KAAK,CAAC,OAAO,GAAG;AAAA,EAClB;AACA,QAAM,mBAAmB,gBAAgB,IAAI,YAAY,EAAE,OAAO,gBAAgB,MAAM,CAAC,CAAC;AAC1F,QAAM,iBAAiB,gBAAgB,IAAI,YAAY,EAAE,OAAO,gBAAgB,OAAO,CAAC,CAAC;AACzF,QAAM,YAAY,wBAAQ,KAAK,IAAI,YAAY,EAAE,OAAO,GAAG,gBAAgB,IAAI,cAAc,EAAE,GAAG,MAAM,UAAU;AAClH,SAAO,8BAA8B,GAAG,gBAAgB,IAAI,cAAc,IAAI,gBAAgB,SAAS,CAAC,EAAE;AAC5G;AAGO,SAAS,2BACd,QACA,OACS;AACT,QAAM,WAAW,CAAC,UAAyG;AACzH,QAAI,MAAM,WAAW,KAAK,CAAC,cAAc,MAAM,CAAC,CAAC,EAAG,QAAO;AAC3D,UAAM,SAAS,MAAM,CAAC;AACtB,QAAI,OAAO,KAAK,MAAM,EAAE,WAAW,KAAK,OAAO,SAAS,qCAAsC,OAAO,SAAS,WAAW,OAAO,SAAS,YAAa,OAAO,OAAO,UAAU,SAAU,QAAO;AAC/L,WAAO,EAAE,MAAM,OAAO,MAAM,OAAO,OAAO,MAAM;AAAA,EAClD;AACA,QAAM,QAAQ,CAAC,MAAe,UAA4B,gBAAgB,IAAI,MAAM,gBAAgB,KAAK;AACzG,SAAO,OAAO,QAAQ,KAAK,EAAE;AAAA,IAAM,CAAC,CAAC,eAAe,YAAY,MAC9D,OAAO,QAAQ,YAAY,EAAE;AAAA,MAAM,CAAC,CAAC,QAAQ,YAAY,MACvD,OAAO,QAAQ,MAAM,EAAE,KAAK,CAAC,CAAC,gBAAgB,aAAa,MAAM;AAC/D,cAAM,gBAAgB,cAAc,MAAM;AAC1C,YAAI,kBAAkB,OAAW,QAAO;AACxC,YAAI,mBAAmB,iBAAiB,MAAM,eAAe,YAAY,EAAG,QAAO;AACnF,cAAM,iBAAiB,SAAS,aAAa;AAC7C,cAAM,gBAAgB,SAAS,YAAY;AAC3C,eAAO,gBAAgB,SAAS,YAC3B,kBAAkB,UAClB,eAAe,UAAU,kBACzB,cAAc,UAAU,kBACvB,kBAAkB,kBAAkB,cAAc,WAAW,GAAG,cAAc,GAAG;AAAA,MACzF,CAAC;AAAA,IACH;AAAA,EACF;AACF;AAEA,SAAS,cAAc,OAAkD;AACvE,SAAO,UAAU,QAAQ,OAAO,UAAU,YAAY,CAAC,MAAM,QAAQ,KAAK;AAC5E;AAEO,SAAS,8BACd,OACA,aAC4B;AAC5B,MAAI,OAAO,UAAU,YAAY,KAAK,KAAK,KAAK;AAC9C,UAAM,IAAI,MAAM,0CAA0C;AAC5D,QAAM,WAAW,MAAM,MAAM,GAAG;AAChC,MAAI,SAAS,WAAW,KAAK,SAAS,KAAK,CAAC,YAAY,QAAQ,WAAW,CAAC;AAC1E,UAAM,IAAI,MAAM,gDAAgD;AAClE,QAAM,CAAC,eAAe,gBAAgB,gBAAgB,IAAI;AAC1D,QAAM,cAAc,gBAAgB,aAAa;AACjD,QAAM,eAAe,gBAAgB,cAAc;AACnD,QAAM,YAAY,gBAAgB,gBAAgB;AAClD,QAAM,cAAuB,KAAK,MAAM,IAAI,YAAY,SAAS,EAAE,OAAO,KAAK,CAAC,EAAE,OAAO,WAAW,CAAC;AACrG,QAAM,eAAwB,KAAK,MAAM,IAAI,YAAY,SAAS,EAAE,OAAO,KAAK,CAAC,EAAE,OAAO,YAAY,CAAC;AACvG,MAAI,gBAAgB,WAAW,MAAM,IAAI,YAAY,EAAE,OAAO,WAAW,KACpE,gBAAgB,YAAY,MAAM,IAAI,YAAY,EAAE,OAAO,YAAY;AAC1E,UAAM,IAAI,MAAM,6CAA6C;AAC/D,QAAM,SAAS,oBAAoB,MAAM,WAAW;AACpD,QAAM,UAAU,qBAAqB,MAAM,YAAY;AACvD,MAAI,QAAQ,OAAO,QAAQ,IAAK,OAAM,IAAI,MAAM,gCAAgC;AAChF,QAAM,YAAY,QAAQ,IAAI,MAAM,KAAK,CAAC,EAAE,CAAC;AAC7C,QAAM,cAAc,UAAU,WAAW,UAAU,IAC/C,UAAU,OAAO,UAAU,MAAM,WAAW,MAAM,CAAC,IACnD,IAAI,WAAW;AACnB,MAAI,YAAY,WAAW,MAAM,YAAY,CAAC,MAAM,OAAQ,YAAY,CAAC,MAAM;AAC7E,UAAM,IAAI,MAAM,6CAA6C;AAC/D,QAAM,YAAY,YAAY,MAAM,CAAC;AACrC,MAAI,CAACA,YAAW,WAAW,gBAAgB,OAAO,IAAI,CAAC,CAAC;AACtD,UAAM,IAAI,MAAM,uCAAuC;AACzD,MAAI,CAAC,wBAAQ,OAAO,WAAW,IAAI,YAAY,EAAE,OAAO,GAAG,aAAa,IAAI,cAAc,EAAE,GAAG,SAAS;AACtG,UAAM,IAAI,MAAM,mCAAmC;AACrD,QAAMC,OAAM,IAAI,SAAS,IAAM,OAAa,QAAM,uBAAO,IAAI,YAAY,EAAE,OAAO,KAAK,CAAC,CAAC,CAAC,EAAE,SAAS;AACrG,MAAI,gBAAgB,UAAaA,SAAQ;AACvC,UAAM,IAAI,MAAM,2DAA2D;AAC7E,SAAO,EAAE,eAAe,OAAO,KAAAA,MAAK,QAAQ,QAAQ;AACtD;AAEO,SAAS,uBACd,eACA,gBACqB;AACrB,QAAM,SAAS,8BAA8B,aAAa;AAC1D,QAAM,OAAO,OAAO,QAAQ,IAAI,CAAC;AACjC,MAAI,OAAO,QAAQ,IAAI,WAAW,KAAK,OAAO,QAAQ,IAAI,CAAC,MAAM,OAAO,QAAQ,IAAI,CAAC;AACnF,UAAM,IAAI,MAAM,0DAA0D;AAC5E,MAAI,mBAAmB,WACjB,OAAO,QAAQ,IAAI,CAAC,MAAM,eAAe,CAAC,KAAK,OAAO,QAAQ,IAAI,CAAC,MAAM,eAAe,CAAC;AAC7F,UAAM,IAAI,MAAM,iDAAiD;AACnE,QAAM,WAAW,OAAO,KAAK,IAAI;AACjC,MACE,SAAS,WAAW,yBAAyB,UAC7C,SAAS,KAAK,CAAC,QAAQ,CAAC,yBAAyB,SAAS,GAAY,CAAC,KACvE,yBAAyB,KAAK,CAAC,QAAQ,EAAE,OAAO,KAAK;AAErD,UAAM,IAAI,MAAM,wCAAwC;AAC1D,MACE,KAAK,YAAY,kCACjB,OAAO,KAAK,+BAA+B,YAC3C,CAAC,OAAO,UAAU,KAAK,0BAA0B,KACjD,KAAK,6BAA6B,KAClC,KAAK,6BAA6B,KAClC,OAAO,QAAQ,MAAM,OAAO,QAAQ,MAAM,MAC1C,OAAO,QAAQ,IAAI,MAAM,KAAK,CAAC,EAAE,CAAC,MAAM,KAAK,eAC7C,OAAO,QAAQ,QAAQ,KAAK;AAE5B,UAAM,IAAI,MAAM,qCAAqC;AACvD,SAAO;AAAA,IACL;AAAA,IACA,KAAK,OAAO;AAAA,IACZ,KAAK,OAAO,QAAQ;AAAA,IACpB,KAAK,OAAO,QAAQ;AAAA,IACpB,KAAK,OAAO,QAAQ;AAAA,IACpB,KAAK,OAAO,QAAQ;AAAA,IACpB,KAAK,OAAO,QAAQ;AAAA,IACpB,KAAK,OAAO,QAAQ;AAAA,IACpB,KAAK,OAAO,QAAQ;AAAA,IACpB;AAAA,EACF;AACF;AAEA,SAAS,gBAAgB,OAA2B;AAClD,MAAI,CAAC,mBAAmB,KAAK,KAAK,KAAK,MAAM,SAAS,MAAM;AAC1D,UAAM,IAAI,MAAM,kCAAkC;AACpD,QAAM,aAAa,MAAM,QAAQ,MAAM,GAAG,EAAE,QAAQ,MAAM,GAAG;AAC7D,QAAM,SAAS,OAAO,WAAW,cAC7B,OAAO,KAAK,YAAY,QAAQ,EAAE,SAAS,QAAQ,IACnD,KAAK,WAAW,OAAO,KAAK,KAAK,WAAW,SAAS,CAAC,IAAI,GAAG,GAAG,CAAC;AACrE,QAAMC,SAAQ,WAAW,KAAK,QAAQ,CAAC,cAAc,UAAU,WAAW,CAAC,CAAC;AAC5E,QAAM,UAAU,OAAO,WAAW,cAC9B,OAAO,KAAKA,MAAK,EAAE,SAAS,WAAW,IACvC,KAAK,OAAO,aAAa,GAAGA,MAAK,CAAC,EAAE,QAAQ,MAAM,EAAE,EAAE,QAAQ,OAAO,GAAG,EAAE,QAAQ,OAAO,GAAG;AAChG,MAAI,YAAY,MAAO,OAAM,IAAI,MAAM,kCAAkC;AACzE,SAAOA;AACT;AAEA,SAAS,gBAAgB,OAA2B;AAClD,SAAO,OAAO,WAAW,cACrB,OAAO,KAAK,KAAK,EAAE,SAAS,WAAW,IACvC,KAAK,OAAO,aAAa,GAAG,KAAK,CAAC,EAAE,QAAQ,MAAM,EAAE,EAAE,QAAQ,OAAO,GAAG,EAAE,QAAQ,OAAO,GAAG;AAClG;AAEA,SAASF,YAAW,MAAkB,OAA4B;AAChE,SAAO,KAAK,WAAW,MAAM,UAAU,KAAK,MAAM,CAAC,MAAM,UAAU,SAAS,MAAM,KAAK,CAAC;AAC1F;;;AD/9BA,IAAM,iBAAiB,cACpB,OAAO;AAAA,EACN,SAAS,cAAE,OAAO,EAAE,IAAI,CAAC;AAAA,EACzB,OAAO,cAAE,OAAO,EAAE,IAAI,CAAC;AAAA,EACvB,MAAM,cAAE,OAAO;AAAA,EACf,SAAS,cAAE,MAAM,cAAE,OAAO,EAAE,IAAI,CAAC,CAAC,EAAE,IAAI,CAAC;AAAA,EACzC,SAAS,cAAE,MAAM,cAAE,OAAO,cAAE,QAAQ,CAAC,CAAC,EAAE,SAAS;AACnD,CAAC,EACA,OAAO;AAEV,IAAM,2BAA2B,cAC9B,OAAO;AAAA,EACN,KAAK,cAAE,OAAO,EAAE,IAAI,CAAC;AAAA,EACrB,kBAAkB,cAAE,OAAO,EAAE,eAAe,cAAE,OAAO,EAAE,IAAI,CAAC,EAAE,CAAC,EAAE,OAAO;AAAA,EACxE,cAAc,cAAE,OAAO,EAAE,IAAI,CAAC;AAAA,EAC9B,SAAS,cAAE,OAAO,EAAE,IAAI,EAAE,YAAY;AAAA,EACtC,MAAM,cAAE,OAAO,EAAE,IAAI,EAAE,SAAS;AAAA,EAChC,SAAS,cAAE,OAAO,EAAE,IAAI,CAAC;AAAA,EACzB,MAAM,cAAE,OAAO;AAAA,EACf,SAAS,cAAE,MAAM,cAAE,OAAO,EAAE,IAAI,CAAC,CAAC,EAAE,IAAI,CAAC;AAAA,EACzC,SAAS,cAAE,MAAM,cAAE,OAAO,cAAE,QAAQ,CAAC,CAAC,EAAE,SAAS;AAAA,EACjD,QAAQ,cAAE,OAAO,KAAK;AAAA,EACtB,aAAa,cAAE,OAAO,EAAE,IAAI,CAAC;AAAA,EAC7B,cAAc,cAAE,OAAO,EAAE,IAAI,CAAC,EAAE,SAAS;AAAA,EACzC,WAAW,cAAE,OAAO,EAAE,IAAI,CAAC,EAAE,SAAS;AAAA,EACtC,sBAAsB,cAAE,QAAQ,EAAE,SAAS;AAAA,EAC3C,WAAW,cAAE,MAAM,cAAc,EAAE,IAAI,CAAC,EAAE,SAAS;AACrD,CAAC,EACA,OAAO;AAGH,SAAS,wBAAwB,OAAoC;AAC1E,QAAM,SAAS,yBAAyB,MAAM,KAAK;AACnD,MAAI,OAAO,cAAc,UAAa,OAAO,UAAU,WAAW;AAChE,UAAM,IAAI,MAAM,iDAAiD;AACnE,SAAO;AACT;AAEO,SAAS,4BACd,YACQ;AACR,SAAO,KAAK,UAAU;AAAA,IACpB,GAAG;AAAA,IACH,QAAQ,WAAW,OAAO,YAAY;AAAA,EACxC,CAAC;AACH;AASA,eAAsB,yBACpB,SACA,MACA,YAC0C;AAC1C,QAAM,SAAS,wBAAwB,UAAU;AACjD,QAAM,WAAW,MAAM,QAAQ,GAAG,KAAK,QAAQ,QAAQ,EAAE,CAAC,aAAa;AAAA,IACrE,QAAQ;AAAA,IACR,SAAS,EAAE,eAAe,OAAO,iBAAiB,cAAc;AAAA,EAClE,CAAC;AACD,MAAI,CAAC,SAAS;AACZ,UAAM,IAAI,MAAM,oCAAoC,SAAS,MAAM,GAAG;AACxE,QAAM,OAAgB,MAAM,SAAS,KAAK,EAAE,MAAM,OAAO,CAAC,EAAE;AAC5D,MAAI,SAAS,QAAQ,OAAO,SAAS,YAAY,MAAM,QAAQ,IAAI;AACjE,WAAO,CAAC;AACV,SAAO;AACT;AAQA,eAAsB,8BAA8B,OAUpB;AAC9B,QAAM,SAAS,wBAAwB,MAAM,MAAM;AACnD,QAAM,aAAa,8BAA8B;AAAA,IAC/C,qBAAqB,OAAO,iBAAiB,cAAc,QAAQ,eAAe,EAAE;AAAA,IACpF,WAAW,OAAO;AAAA,IAClB,WAAW,OAAO;AAAA,IAClB,aAAa,MAAM;AAAA,IACnB,aAAa,MAAM;AAAA,IACnB,YAAY,MAAM;AAAA,IAClB,GAAI,MAAM,QAAQ,SAAY,CAAC,IAAI,EAAE,KAAK,MAAM,IAAI;AAAA,IACpD,GAAI,MAAM,cAAc,SAAY,CAAC,IAAI,EAAE,WAAW,MAAM,UAAU;AAAA,IACtE,GAAI,MAAM,UAAU,SAAY,CAAC,IAAI,EAAE,OAAO,MAAM,MAAM;AAAA,EAC5D,CAAC;AACD,QAAM,YAAiC,OAAO,QAAQ,WAAW,QAAQ,GAAG,EAAE,IAAI,CAAC,CAAC,UAAU,SAAS,MAAM;AAC3G,UAAM,UAAU,OAAO,KAAK,SAAS;AACrC,QAAI,SAAS,WAAW,2BAA2B,GAAG;AACpD,aAAO,EAAE,SAAS,cAAc,OAAO,cAAc,MAAM,UAAU,QAAQ;AAAA,IAC/E;AACA,UAAM,QAAQ,oCAAoC,KAAK,QAAQ;AAC/D,QAAI,UAAU,KAAM,OAAM,IAAI,MAAM,uCAAuC;AAC3E,UAAM,UAAU,OAAO,OAAO,SAAS,EAAE,KAAK,EAAE,OAAO,CAAC,UAA4C,UAAU,QAAQ,OAAO,UAAU,YAAY,CAAC,MAAM,QAAQ,KAAK,CAAC;AACxK,WAAO,EAAE,SAAS,MAAM,OAAO,MAAM,CAAC,GAAI,MAAM,MAAM,CAAC,GAAI,SAAS,GAAI,QAAQ,WAAW,IAAI,CAAC,IAAI,EAAE,QAAQ,EAAG;AAAA,EACnH,CAAC;AACD,QAAM,UAAU,UAAU,KAAK,CAAC,aAAa,SAAS,YAAY,IAAI,KAAK,UAAU,CAAC;AACtF,MAAI,YAAY,OAAW,OAAM,IAAI,MAAM,wCAAwC;AACnF,QAAM,WAA+B;AAAA,IACnC,KAAK,WAAW;AAAA,IAChB,kBAAkB,EAAE,eAAe,WAAW,cAAc;AAAA,IAC5D,cAAc,OAAO;AAAA,IACrB,SAAS,OAAO;AAAA,IAChB,MAAM,MAAM;AAAA,IACZ,SAAS,QAAQ;AAAA,IACjB,MAAM,QAAQ;AAAA,IACd,SAAS,QAAQ;AAAA,IACjB,QAAQ,IAAI,KAAK,WAAW,QAAQ,MAAM,GAAI;AAAA,IAC9C,aAAa,MAAM;AAAA,IACnB,cAAc,OAAO;AAAA,IACrB,WAAW,OAAO;AAAA,IAClB,sBAAsB,WAAW,QAAQ,IAAI,CAAC,GAAG,+BAA+B;AAAA,IAChF;AAAA,EACF;AACA,QAAM,yBAAyB,MAAM,OAAO,MAAM,MAAM,QAAQ;AAChE,SAAO;AACT;;;ALlHA,IAAMG,8BAA6B;AACnC,IAAM,4BAA4B;AAClC,IAAM,mCAAmC;AACzC,IAAM,oBAAoB;AAC1B,IAAM,4BAA4B;AAClC,IAAM,4BAA4B;AAClC,IAAM,gCAAgC;AACtC,IAAM,gCAAgC;AACtC,IAAM,cAAc;AACpB,IAAM,0BAA0B,IAAI;AACpC,IAAM,mBAAmB;AACzB,IAAM,qBAAqB;AAwB3B,SAAS,aAAa,OAAwB;AAC5C,MAAI,iBAAiB,iBAAkB,QAAO,MAAM;AACpD,MAAI,iBAAiB,cAAe,QAAO,MAAM;AACjD,QAAMC,QAAO,SAAS,OAAO,UAAU,YAAY,UAAU,QAAS,MAAsC,OAAO;AACnH,MAAI,OAAOA,UAAS,SAAU,QAAO;AACrC,MAAIA,UAAS,gCAAW,0BAA0BA,UAAS,gCAAW,eAAeA,UAAS,MAAO,QAAO;AAC5G,MAAIA,UAAS,kBAAkBA,UAAS,eAAeA,UAAS,MAAO,QAAO;AAC9E,MAAIA,MAAK,SAAS,SAAS,KAAKA,UAAS,UAAW,QAAO;AAC3D,MAAIA,MAAK,SAAS,OAAO,EAAG,QAAO;AACnC,MAAIA,MAAK,SAAS,MAAM,KAAKA,MAAK,SAAS,QAAQ,KAAKA,UAAS,SAASA,UAAS,MAAO,QAAO;AACjG,MAAIA,MAAK,SAAS,SAAS,KAAKA,MAAK,SAAS,SAAS,KAAKA,UAAS,UAAW,QAAO;AACvF,MAAI,CAAC,gBAAgB,oBAAoB,WAAW,qBAAqB,gBAAgB,mBAAmB,qBAAqB,uBAAuB,kBAAkB,EAAE,SAASA,KAAI,EAAG,QAAOA;AACnM,SAAOA,MAAK,WAAW,QAAQ,IAAIA,QAAO;AAC5C;AAEA,SAAS,QAAQ,OAAkC;AACjD,MAAI,iBAAiB,iBAAkB,QAAO;AAC9C,SAAO,IAAI,iBAAiB,aAAa,KAAK,CAAC;AACjD;AAEA,SAAS,gBAAgB,QAA2D;AAClF,SAAO,WAAW,SAAS,WAAW,aAAa,SAAS,WAAW,SAAS,SAAS;AAC3F;AAEA,SAAS,cAAc,OAAuB;AAC5C,QAAM,QAAQ,MAAM,MAAM,GAAG;AAC7B,QAAM,cAAc,MAAM,KAAK,CAAC,MAAM,UAAU,SAAS,QAAQ,SAAS,OAAQ,SAAS,MAAM,EAAE,UAAU,MAAM,SAAS,KAAK,MAAM,SAAS,GAAG,EAAG;AACtJ,MAAI,UAAU,MAAM,MAAM,WAAW,GAAG,KAAK,0BAA0B,KAAK,KAAK,KAAK,eAAe,KAAK,KAAK,KAAK,aAAa;AAC/H,UAAM,IAAI,iBAAiB,oBAAoB;AAAA,EACjD;AACA,SAAO;AACT;AAEA,SAAS,sBAAsB,OAAwB;AACrD,MAAI,UAAU,QAAQ,OAAO,UAAU,YAAY,OAAO,UAAU,UAAW,QAAO,KAAK,UAAU,KAAK;AAC1G,MAAI,OAAO,UAAU,UAAU;AAC7B,QAAI,CAAC,OAAO,SAAS,KAAK,EAAG,OAAM,IAAI,iBAAiB,uBAAuB;AAC/E,WAAO,KAAK,UAAU,KAAK;AAAA,EAC7B;AACA,MAAI,MAAM,QAAQ,KAAK,EAAG,QAAO,IAAI,MAAM,IAAI,qBAAqB,EAAE,KAAK,GAAG,CAAC;AAC/E,MAAI,OAAO,UAAU,UAAU;AAC7B,UAAM,SAAS;AACf,WAAO,IAAI,OAAO,KAAK,MAAM,EAAE,KAAK,EAAE,IAAI,CAAC,QAAQ,GAAG,KAAK,UAAU,GAAG,CAAC,IAAI,sBAAsB,OAAO,GAAG,CAAC,CAAC,EAAE,EAAE,KAAK,GAAG,CAAC;AAAA,EAC9H;AACA,QAAM,IAAI,iBAAiB,uBAAuB;AACpD;AAEA,SAASC,kBAAiB,OAA2B;AACnD,MAAI,CAAC,mBAAmB,KAAK,KAAK,KAAK,MAAM,SAAS,MAAM,EAAG,OAAM,IAAI,MAAM,WAAW;AAC1F,QAAM,SAAS,MAAM,QAAQ,MAAM,GAAG,EAAE,QAAQ,MAAM,GAAG,IAAI,IAAI,QAAQ,IAAI,MAAM,SAAS,KAAK,CAAC;AAClG,QAAM,UAAU,OAAO,SAAS,aAAa,KAAK,MAAM,IAAI,OAAO,KAAK,QAAQ,QAAQ,EAAE,SAAS,QAAQ;AAC3G,QAAMC,SAAQ,WAAW,KAAK,SAAS,CAAC,SAAS,KAAK,WAAW,CAAC,CAAC;AACnE,MAAIC,kBAAiBD,MAAK,MAAM,MAAO,OAAM,IAAI,MAAM,yBAAyB;AAChF,SAAOA;AACT;AAEA,SAASC,kBAAiBD,QAA2B;AACnD,MAAI,SAAS;AACb,aAAW,QAAQA,OAAO,WAAU,OAAO,aAAa,IAAI;AAC5D,QAAM,UAAU,OAAO,SAAS,aAAa,KAAK,MAAM,IAAI,OAAO,KAAKA,MAAK,EAAE,SAAS,QAAQ;AAChG,SAAO,QAAQ,QAAQ,OAAO,GAAG,EAAE,QAAQ,OAAO,GAAG,EAAE,QAAQ,QAAQ,EAAE;AAC3E;AAEA,SAAS,YAAoB;AAC3B,QAAMA,SAAQ,IAAI,WAAW,EAAE;AAC/B,SAAO,gBAAgBA,MAAK;AAC5B,SAAOC,kBAAiBD,MAAK;AAC/B;AAEA,SAAS,gBAAgB,OAAwB;AAC/C,SAAOC,sBAAiB,uBAAO,IAAI,YAAY,EAAE,OAAO,sBAAsB,KAAK,CAAC,CAAC,CAAC;AACxF;AAEA,SAAS,WAAW,QAAgE;AAClF,SAAO,WAAW,QAAQ,qBAAqB,WAAW,aAAa,0BAA0B,WAAW,SAAS,sBAAsB;AAC7I;AAEA,SAAS,gBAAgB,OAA+C;AACtE,MAAI,UAAU,sBAAsB,UAAU,SAAS,UAAU,OAAQ,QAAO;AAChF,MAAI,UAAU,2BAA2B,UAAU,WAAY,QAAO;AACtE,MAAI,UAAU,uBAAuB,UAAU,OAAQ,QAAO;AAC9D,MAAI,UAAU,sBAAsB,UAAU,uBAAuB,UAAU,SAAS,UAAU,OAAQ,QAAO;AACjH,SAAO;AACT;AAEA,SAAS,gBAAgB,OAAyC;AAChE,QAAM,SAAS,gBAAgB,KAAK;AACpC,SAAO,WAAW,sBAAsB,WAAW,0BAA0B,SAAS,WAAW,sBAAsB,SAAS,WAAW,qBAAqB,SAAS;AAC3K;AAEA,SAAS,uBAAuB,QAAiD;AAC/E,QAAM,UAAU,OAAO,IAAI,eAAe;AAC1C,MAAI,QAAQ,KAAK,CAAC,WAAW,WAAW,MAAS,EAAG,OAAM,IAAI,iBAAiB,+BAA+B;AAC9G,SAAO,CAAC,GAAG,IAAI,IAAI,OAA8B,CAAC,EAAE,KAAK;AAC3D;AAEA,SAAS,cAAc,OAAgB,aAAoC,SAAoC;AAC7G,MAAI,OAAO,UAAU,UAAU;AAC7B,UAAM,OAAO,MAAM,SAAS,GAAG,IAAI,WAAW;AAC9C,WAAO,EAAE,MAAM,MAAM,SAAS,YAAY,CAAC,MAAM,SAAS,GAAG,IAAI,GAAG,KAAK,MAAM,MAAM;AAAA,EACvF;AACA,MAAI,CAAC,SAAS,KAAK,KAAM,MAAM,SAAS,WAAW,MAAM,SAAS,SAAW,QAAO;AACpF,QAAM,OAAO,OAAO,MAAM,SAAS,WAAW,MAAM,OAAO,OAAO,MAAM,UAAU,WAAW,MAAM,QAAQ;AAC3G,SAAO,SAAS,SAAY,SAAY,EAAE,MAAM,MAAM,MAAM,MAAM,MAAM,SAAS,YAAY,CAAC,KAAK,SAAS,GAAG,IAAI,GAAG,IAAI,MAAM,KAAK;AACvI;AAEA,SAAS,cAAc,SAA6D;AAClF,MAAI,YAAY,OAAW,QAAO,CAAC;AACnC,MAAI,MAAM,QAAQ,OAAO,EAAG,QAAO,OAAO,YAAY,QAAQ,IAAI,CAAC,CAAC,KAAK,KAAK,MAAM,CAAC,IAAI,YAAY,GAAG,KAAK,CAAC,CAAC;AAC/G,SAAO,OAAO,YAAY,OAAO,QAAQ,OAAO,EAAE,IAAI,CAAC,CAAC,KAAK,KAAK,MAAM,CAAC,IAAI,YAAY,GAAG,KAAK,CAAC,CAAC;AACrG;AAEA,SAAS,SAAS,OAAkD;AAClE,SAAO,UAAU,QAAQ,OAAO,UAAU,YAAY,CAAC,MAAM,QAAQ,KAAK;AAC5E;AAEA,SAAS,gBAAgB,QAA2E;AAClG,SAAO,UAAU;AACnB;AAEA,SAAS,oBAAoB,OAAgC,KAAsG;AACjK,QAAM,aAAwC,CAAC,KAAK;AACpD,aAAW,WAAW,CAAC,QAAQ,UAAU,QAAQ,UAAU,GAAY;AACrE,QAAI,SAAS,MAAM,OAAO,CAAC,EAAG,YAAW,KAAK,MAAM,OAAO,CAAC;AAAA,EAC9D;AACA,aAAW,aAAa,YAAY;AAClC,UAAM,UAAU,UAAU,GAAG;AAC7B,QAAI,SAAS,OAAO,GAAG;AACrB,YAAM,QAAQ,UAAU,SAAS,MAAM,SAAS,QAAQ;AACxD,UAAI,UAAU,OAAW,QAAO,EAAE,SAAS,MAAM;AAAA,IACnD;AAAA,EACF;AACA,QAAM,IAAI,iBAAiB,yBAAyB,QAAQ,GAAG,gCAAgC;AACjG;AAEA,SAAS,eAAe,OAAwB;AAC9C,MAAI,UAAU,QAAQ,OAAO,UAAU,YAAY,OAAO,UAAU,UAAW,QAAO,KAAK,UAAU,KAAK;AAC1G,MAAI,OAAO,UAAU,YAAY,OAAO,SAAS,KAAK,EAAG,QAAO,KAAK,UAAU,KAAK;AACpF,MAAI,MAAM,QAAQ,KAAK,EAAG,QAAO,IAAI,MAAM,IAAI,cAAc,EAAE,KAAK,GAAG,CAAC;AACxE,MAAI,SAAS,KAAK,EAAG,QAAO,IAAI,OAAO,KAAK,KAAK,EAAE,KAAK,EAAE,IAAI,CAAC,QAAQ,GAAG,KAAK,UAAU,GAAG,CAAC,IAAI,eAAe,MAAM,GAAG,CAAC,CAAC,EAAE,EAAE,KAAK,GAAG,CAAC;AACxI,QAAM,IAAI,iBAAiB,uBAAuB;AACpD;AAEA,SAAS,kBAAkB,MAAe,OAAgB,SAAuB;AAC/E,MAAI,SAAS,UAAa,UAAU,UAAa,eAAe,IAAI,MAAM,eAAe,KAAK,GAAG;AAC/F,UAAM,IAAI,iBAAiB,yBAAyB,OAAO;AAAA,EAC7D;AACF;AAEA,SAAS,UAAU,OAAoC;AACrD,MAAI,OAAO,UAAU,SAAU,QAAO;AACtC,QAAM,SAAS,KAAK,MAAM,KAAK;AAC/B,SAAO,OAAO,SAAS,MAAM,IAAI,SAAS;AAC5C;AAEA,SAAS,iBAAiB,OAAgC,SAA4B,OAAqB;AACzG,QAAM,OAAO,IAAI,IAAI,OAAO;AAC5B,MAAI,OAAO,KAAK,KAAK,EAAE,KAAK,CAAC,QAAQ,CAAC,KAAK,IAAI,GAAG,CAAC,EAAG,OAAM,IAAI,iBAAiB,yBAAyB,GAAG,KAAK,4BAA4B;AAChJ;AAEA,SAAS,iBAAiB,UAAoC;AAG5D,SAAO,SAAS,kBAAkB,YAAa,SAAS,kBAAkB,UAAa,SAAS,cAAc,SAAS,4BAA4B,UAAa,SAAS,4BAA4B;AACvM;AAEA,SAAS,aAAa,SAAyB,UAAkB,OAAe,SAAiC;AAC/G,QAAM,gBAAgB,QAAQ,kBAAkB;AAChD,MAAI,OAAO,kBAAkB,YAAY,cAAc,WAAW,EAAG,OAAM,IAAI,iBAAiB,wBAAwB;AACxH,SAAO,EAAE,eAAe,cAAc;AACxC;AAEO,IAAM,uBAAN,MAA2B;AAAA,EAKhC,YAA6B,SAAsC;AAAtC;AAC3B,SAAK,UAAU,QAAQ,SAAU,WAAW,MAAM,KAAK,UAAU;AACjE,SAAK,QAAQ,QAAQ,SAAS,IAAI,iBAAiB;AACnD,SAAK,MAAM,QAAQ,QAAQ,MAAM,oBAAI,KAAK;AAAA,EAC5C;AAAA,EAEA,MAAM,KAAK,MAAsC;AAC/C,QAAI;AACF,YAAM,WAAW,MAAM,KAAK,QAAQ,IAAI;AACxC,YAAM,EAAE,SAAS,IAAI,SAAS;AAC9B,YAAM,EAAE,SAAS,IAAI;AACrB,YAAM,SAAS,iBAAiB,QAAQ;AACxC,YAAM,SAAS,SAAS,kBAAkB,gBAAgB,SAAS,kBAAkB,iBAAiB,SAAS,4BAA4B;AAC3I,YAAM,eAAe,CAAC,UAAU,SAAS,kBAAkB;AAC3D,UAAI;AACJ,UAAI,SAAS,4BAA4B,gBAAgB;AACvD,YAAI,KAAK,QAAQ,iCAAiC,OAAW,OAAM,IAAI,iBAAiB,8BAA8B,6CAA6C;AACnK,cAAM,gBAAgB,MAAM,KAAK,QAAQ,6BAA6B,EAAE,UAAU,cAAc,SAAS,WAAW,SAAS,iBAAiB,SAAS,UAAU,QAAQ,GAAG,CAAC;AAC7K,YAAI,WAAW,eAAe;AAC5B,cAAI,cAAc,UAAU,yBAA0B,OAAM,IAAI,iBAAiB,8BAA8B,+CAA+C,aAAa;AAC3K,gBAAM,IAAI,iBAAiB,gBAAgB,0CAA0C,aAAa;AAAA,QACpG;AACA,8BAAsB;AAAA,MACxB;AACA,UAAI,UAAU,KAAK,QAAQ,kBAAkB,OAAW,OAAM,IAAI,iBAAiB,8BAA8B;AACjH,UAAI,UAAU,KAAK,QAAQ,iBAAiB,OAAW,OAAM,IAAI,iBAAiB,oCAAoC;AAEtH,YAAM,UAAU,UAAU,eACtB,KAAK,QAAQ,gBACb,sBACE,sBACF,UAAU,KAAK,QAAQ,2BAA2B,SAChD,MAAM,KAAK,QAAQ,uBAAuB,EAAE,UAAU,cAAc,KAAK,QAAQ,aAAa,CAAC,IAC/F,SAAS,MAAM,KAAK,uBAAuB,QAAQ,IAAI;AAC7D,YAAM,gBAAgB,SAAS,UAA4C;AAC3E,UAAI,kBAAkB,OAAW,MAAK,4BAA4B,eAAe,QAAQ;AACzF,YAAM,qBAAqB,kBAAkB,SAAY,SAAY,KAAK,wBAAwB,eAAe,SAAS,MAAM;AAChI,YAAM,iBAA6C,uBAAuB,SACtE,SACA,KAAK,uBAAuB,kBAAkB;AAClD,UAAI,uBAAuB,QAAW;AACpC,YAAI,KAAK,QAAQ,qBAAqB,QAAW;AAC/C,gBAAM,yBAAyB,KAAK,SAAS,SAAS,QAAQ,kBAAkB;AAAA,QAClF,OAAO;AACL,gBAAM,WAAW,MAAM,KAAK,QAAQ,iBAAiB,kBAAkB;AACvE,cAAI,aAAa,QAAW;AAC1B,kBAAM,aAAa,wBAAwB,QAAQ;AACnD,gBAAI,WAAW,iBAAiB,kBAAkB,mBAAmB,iBAAiB,eAAe;AACnG,oBAAM,IAAI,iBAAiB,yBAAyB,iDAAiD;AAAA,YACvG;AAAA,UACF;AAAA,QACF;AAAA,MACF;AACA,YAAM,kBAAkB,uBAAuB,SAAY,SAAY;AAAA,QACrE,kBAAkB,mBAAmB;AAAA,QACrC,eAAe,mBAAmB;AAAA,QAClC,SAAS,KAAK,wBAAwB,kBAAkB,EAAE;AAAA,QAC1D,oBAAoB,mBAAmB;AAAA,QACvC,KAAK,KAAK,QAAQ,eAAe,OAAO,CAAC;AAAA,MAC3C;AACA,YAAM,KAAK,UAAU,gBAAgB,oBAAoB,SACpD,YAAY,UAAa,oBAAoB,SAAY,SAAY,KAAK,SAAS,SAAS,QAAS,mBAAmB,SAA4B,cAAc,IACnK;AACJ,YAAM,uBAA4C,EAAE,SAAS,SAAS,SAAS,UAAU,SAAS,UAAU,SAAS,SAAS,QAAQ;AACtI,YAAM,aAAa,eAAe,eAAe,SAC7C,uBACA,2BAA2B,sBAAsB,cAAc,UAAU;AAC7E,UAAI,eAAe,OAAW,OAAM,IAAI,iBAAiB,wBAAwB;AAEjF,YAAM,MAAM,OAAO,OAAO,SAAS,SAAS,SAAS,UAAU,SAAS,SAAS,OAAO,OAAiC;AACvH,YAAI;AACF,gBAAM,eAAe,cAAc,IAAI;AACvC,eAAK,cAAc,YAAY,OAAO,YAAY;AAClD,cAAI,OAAO,QAAW;AACpB,kBAAM,SAAS,MAAM,GAAG,IAAgB,cAAc,EAAE,QAAQ,MAAM,kBAAkB,KAAK,QAAQ,mBAAmB,0BAA0B,CAAC;AACnJ,gBAAI,CAAC,OAAO,GAAI,OAAM,OAAO;AAC7B,mBAAO,EAAE,OAAO,OAAO,KAAK,MAAM,MAAM,OAAO,KAAK,QAAQ,MAAM,aAAa,OAAO,KAAK,QAAQ,aAAa,MAAM,OAAO,KAAK,KAAK,WAAW;AAAA,UACpJ;AACA,cAAI,kBAAkB,OAAW,QAAO,KAAK,UAAU,UAAU,eAAe,YAAY;AAC5F,cAAI,UAAU,SAAS,SAAS,SAAS,WAAW,iBAAiB,SAAS,SAAS,KAAM,OAAM,IAAI,iBAAiB,wBAAwB;AAChJ,iBAAO,EAAE,OAAO,SAAS,UAAU,MAAM,GAAG,aAAa,SAAS,QAAQ,UAAU,MAAM,SAAS,UAAU,WAAW;AAAA,QAC1H,SAAS,OAAO;AACd,gBAAM,QAAQ,KAAK;AAAA,QACrB;AAAA,MACF;AAEA,YAAM,eAAe,OAAO,QAAuF,CAAC,MAAgC;AAClJ,YAAI;AACF,gBAAM,QAAQ,cAAc,MAAM,QAAQ,SAAS,SAAS,IAAI;AAChE,eAAK,cAAc,YAAY,QAAQ,KAAK;AAC5C,cAAI,OAAO,UAAa,kBAAkB,OAAW,OAAM,IAAI,iBAAiB,wBAAwB;AACxG,cAAI,uBAAuB,UAAa,OAAO,QAAW;AACxD,kBAAMC,UAAS,MAAM,GAAG,KAAK,EAAE,MAAM,OAAO,OAAO,MAAM,OAAO,QAAQ,MAAM,OAAO,CAAC;AACtF,gBAAI,CAACA,QAAO,GAAI,OAAMA,QAAO;AAC7B,mBAAO,EAAE,MAAMA,QAAO,KAAK,MAAM,WAAWA,QAAO,KAAK,WAAW,YAAYA,QAAO,KAAK,WAAW;AAAA,UACxG;AACA,cAAI,kBAAkB,OAAW,QAAO,KAAK,WAAW,UAAU,eAAe,OAAO,MAAM,OAAO,MAAM,MAAM;AACjH,gBAAM,SAAS,MAAM,GAAI,KAAK,EAAE,MAAM,OAAO,OAAO,MAAM,OAAO,QAAQ,MAAM,OAAO,CAAC;AACvF,cAAI,CAAC,OAAO,GAAI,OAAM,OAAO;AAE7B,iBAAO,EAAE,MAAM,OAAO,KAAK,MAAM,WAAW,OAAO,KAAK,WAAW,YAAY,OAAO,KAAK,WAAW;AAAA,QACxG,SAAS,OAAO;AACd,gBAAM,QAAQ,KAAK;AAAA,QACrB;AAAA,MACF;AAEA,YAAM,OAAO,OAAO,MAAcF,QAAmB,UAAyG;AAC5J,YAAI;AACF,gBAAM,eAAe,cAAc,IAAI;AACvC,eAAK,cAAc,YAAY,QAAQ,YAAY;AACnD,cAAI,OAAO,UAAa,kBAAkB,OAAW,OAAM,IAAI,iBAAiB,wBAAwB;AACxG,cAAI,uBAAuB,UAAa,OAAO,QAAW;AACxD,kBAAME,UAAS,MAAM,GAAG,IAAI,cAAcF,QAAO,EAAE,aAAa,MAAM,eAAe,SAAS,QAAQ,UAAU,SAAS,MAAM,KAAK,CAAC;AACrI,gBAAI,CAACE,QAAO,IAAI;AACd,kBAAIA,QAAO,MAAM,SAAS,gCAAW,0BAA0BA,QAAO,MAAM,SAAS,gCAAW,YAAa,OAAM,IAAI,cAAc,cAAcA,QAAO,MAAM,MAAM,IAA0B;AAChM,oBAAMA,QAAO;AAAA,YACf;AACA,mBAAO,EAAE,MAAMA,QAAO,KAAK,QAAQ,KAAK;AAAA,UAC1C;AACA,cAAI,kBAAkB,OAAW,QAAO,KAAK,WAAW,UAAU,eAAe,cAAcF,QAAO,KAAK;AAC3G,gBAAM,SAAS,MAAM,GAAI,IAAI,cAAcA,QAAO,EAAE,aAAa,MAAM,eAAe,SAAS,QAAQ,UAAU,SAAS,MAAM,KAAK,CAAC;AACtI,cAAI,CAAC,OAAO,IAAI;AACd,gBAAI,OAAO,MAAM,SAAS,gCAAW,0BAA0B,OAAO,MAAM,SAAS,gCAAW,YAAa,OAAM,IAAI,cAAc,cAAc,OAAO,MAAM,MAAM,IAA0B;AAChM,kBAAM,OAAO;AAAA,UACf;AACA,iBAAO,EAAE,MAAM,OAAO,KAAK,QAAQ,KAAK;AAAA,QAC1C,SAAS,OAAO;AACd,cAAI,iBAAiB,cAAe,OAAM;AAC1C,gBAAM,QAAQ,KAAK;AAAA,QACrB;AAAA,MACF;AAEA,YAAM,WAAW,OAAO,OAAO,SAAS,SAAS,SAAS,UAAU,SAAS,SAAS,OAAO,OAAqC;AAChI,cAAM,eAAe,cAAc,IAAI;AACvC,aAAK,cAAc,YAAY,YAAY,YAAY;AACvD,YAAI,uBAAuB,UAAa,OAAO,QAAW;AACxD,gBAAME,UAAS,MAAM,GAAG,KAAK,YAAY;AACzC,cAAI,CAACA,QAAO,GAAI,OAAMA,QAAO;AAC7B,iBAAO,EAAE,UAAU,EAAE,gBAAgBA,QAAO,KAAK,QAAQ,eAAe,4BAA4B,kBAAkB,OAAOA,QAAO,KAAK,QAAQ,iBAAiB,EAAE,GAAG,GAAIA,QAAO,KAAK,QAAQ,iBAAiB,SAAY,CAAC,IAAI,EAAE,iBAAiBA,QAAO,KAAK,QAAQ,aAAa,EAAG,GAAG,MAAMA,QAAO,KAAK,QAAQ,MAAM,aAAaA,QAAO,KAAK,QAAQ,aAAa,MAAMA,QAAO,KAAK,QAAQ,cAAc;AAAA,QACnZ;AACA,YAAI,kBAAkB,OAAW,QAAO,KAAK,eAAe,UAAU,eAAe,YAAY;AACjG,YAAI,OAAO,OAAW,OAAM,IAAI,iBAAiB,wBAAwB;AACzE,cAAM,SAAS,MAAM,GAAG,KAAK,YAAY;AACzC,YAAI,CAAC,OAAO,GAAI,OAAM,OAAO;AAC7B,eAAO,EAAE,UAAU,EAAE,gBAAgB,OAAO,KAAK,QAAQ,eAAe,4BAA4B,kBAAkB,OAAO,OAAO,KAAK,QAAQ,iBAAiB,EAAE,GAAG,GAAI,OAAO,KAAK,QAAQ,iBAAiB,SAAY,CAAC,IAAI,EAAE,iBAAiB,OAAO,KAAK,QAAQ,aAAa,EAAG,GAAG,MAAM,OAAO,KAAK,QAAQ,MAAM,aAAa,OAAO,KAAK,QAAQ,aAAa,MAAM,OAAO,KAAK,QAAQ,cAAc;AAAA,MACnZ;AAEA,aAAO,EAAE,MAAM,YAAY,UAAU,UAAU,EAAE,GAAG,UAAU,KAAK,OAAU,GAAG,UAAU,SAAS,UAAU,SAAS,SAAS,SAAS,WAAW,IAAI,KAAK,SAAS,SAAS,GAAG,IAAI,oBAAoB,KAAK,cAAc,MAAM,SAAS;AAAA,IAC7O,SAAS,OAAO;AACd,YAAM,QAAQ,KAAK;AAAA,IACrB;AAAA,EACF;AAAA,EAEQ,wBAAwB,SAA6B,QAAgD;AAC3G,QAAI,QAAQ,sBAAsB,OAAW,QAAO;AACpD,UAAM,aAAa,wBAAwB,QAAQ,iBAAiB;AACpE,QAAI,WAAW,SAAS,UAAa,WAAW,KAAK,QAAQ,QAAQ,EAAE,MAAM,OAAO,QAAQ,QAAQ,EAAE,EAAG,OAAM,IAAI,iBAAiB,yBAAyB,yDAAyD;AACtN,WAAO;AAAA,EACT;AAAA,EAEQ,uBAAuB,YAAgD;AAC7E,UAAM,aAAa,KAAK,QAAQ;AAChC,QAAI,eAAe,OAAW,OAAM,IAAI,iBAAiB,+BAA+B;AACxF,UAAM,UAAU,uBAAuB,WAAW,iBAAiB,aAAa;AAChF,QAAI,QAAQ,QAAQ,WAAW,OAAO,QAAQ,QAAQ,WAAW;AAC/D,YAAM,IAAI,iBAAiB,uBAAuB;AACpD,WAAO,CAAC,iBAAiB,SAAS,MAAM,QAAQ,UAAU;AACxD,YAAM,cAAc,QAAQ,QAAQ,gBAAgB,EAAE;AACtD,YAAM,YAAY,KAAK,QAAQ,OAAO,EAAE,EAAE,QAAQ,OAAO,EAAE;AAC3D,YAAM,YAAY,OAAO,QAAQ,QAAQ,GAAG,EAAE,KAAK,CAAC,CAAC,gBAAgB,SAAS,MAAM;AAClF,YAAI,EAAE,UAAU,WAAY,QAAO;AACnC,YAAI,gBAAgB,aAAc,QAAO,eAAe,WAAW,2BAA2B,KAAK,mBAAmB;AACtH,cAAM,QAAQ,kCAAkC,KAAK,cAAc;AACnE,YAAI,UAAU,KAAM,QAAO;AAC3B,cAAM,aAAa,MAAM,CAAC;AAC1B,cAAM,UAAU,UAAU,MAAM,KAAK,CAAC;AACtC,cAAM,SAAS,QAAQ,KAAK,CAAC,UAAU,SAAS,KAAK,KAAK,MAAM,SAAS,QAAQ;AACjF,eAAO,cAAc,cAAe,UAAU,UAAU,WAAW,GAAG,UAAU,GAAG;AAAA,MACrF,CAAC;AACD,UAAI,cAAc,OAAW,OAAM,IAAI,iBAAiB,oBAAoB;AAC5E,YAAM,WAAW,gBAAgB,eAC7B,UAAU,CAAC,IACX,GAAG,UAAU,CAAC,EAAE,MAAM,GAAG,UAAU,CAAC,EAAE,QAAQ,MAAM,IAAI,CAAC,CAAC,GAAG,SAAS;AAC1E,YAAM,SAAS,gBAAgB,eAAe,CAAC,IAAI,EAAE,MAAM,mCAAmC,MAAM,SAAS,OAAO,SAAS;AAC7H,YAAM,aAAa,8BAA8B;AAAA,QAC/C,sBAAsB,WAAW,iBAAiB;AAAA,QAClD,YAAY,WAAW;AAAA,QACvB,cAAc,WAAW;AAAA,QACzB,aAAa,OAAO,QAAQ,KAAK,YAAY;AAAA,QAC7C;AAAA,QACA;AAAA,QACA;AAAA,QACA,GAAI,OAAO,WAAW,IAAI,EAAE,OAAO,MAAM,CAAC,EAAuC,IAAI,CAAC;AAAA,QACtF;AAAA,QACA,KAAK,KAAK,MAAM,KAAK,IAAI,EAAE,QAAQ,IAAI,GAAI;AAAA,MAC7C,CAAC;AACD,aAAO,EAAE,eAAe,WAAW,cAAc;AAAA,IACnD;AAAA,EACF;AAAA,EAEQ,wBAAwB,YAA8D;AAC5F,UAAM,UAAU,uBAAuB,WAAW,iBAAiB,aAAa;AAChF,QAAI,QAAQ,QAAQ,WAAW,OAAO,QAAQ,QAAQ,WAAW,YAAa,OAAM,IAAI,iBAAiB,uBAAuB;AAChI,UAAM,aAAa,OAAO,KAAK,QAAQ,GAAG,EAAE,KAAK,CAAC,aAAa,gCAAgC,KAAK,QAAQ,CAAC;AAC7G,UAAM,QAAQ,eAAe,SAAY,SAAY,oCAAoC,KAAK,UAAU;AACxG,QAAI,UAAU,UAAa,UAAU,KAAM,OAAM,IAAI,iBAAiB,uBAAuB;AAC7F,WAAO,EAAE,SAAS,MAAM,CAAC,EAAG;AAAA,EAC9B;AAAA,EAEQ,SAAS,QAAgB,SAAyB,gBAA6C;AACrG,UAAM,SAAS,kBAAkB,KAAK,QAAQ,UAAU;AACxD,QAAI,KAAK,QAAQ,oBAAoB,QAAW;AAC9C,aAAO,KAAK,QAAQ,gBAAgB,EAAE,OAAO,CAAC,MAAM,GAAG,SAAS,QAAQ,OAAO,KAAK,QAAQ,CAAC;AAAA,IAC/F;AACA,UAAM,UAAU,IAAI,oCAAe,EAAE,OAAO,CAAC,MAAM,GAAG,SAAS,QAAQ,OAAO,KAAK,QAAQ,CAAC;AAC5F,UAAM,UAAU,IAAI,+BAAU,EAAE,QAAQ,GAAG,CAAC;AAC5C,YAAQ,gBAAgB,MAAM,OAAO;AACrC,YAAQ,WAAW,OAAO;AAC1B,WAAO;AAAA,EACT;AAAA,EAEA,MAAc,UAAU,UAA2B,SAA6B,MAAwC;AACtH,SAAK,0BAA0B,UAAU,SAAS,OAAO,IAAI;AAC7D,UAAM,SAAS,MAAM,KAAK,aAAa,EAAE,UAAU,SAAS,QAAQ,OAAO,UAAU,MAAM,WAAW,uCAAuC,CAAC;AAC9I,QAAI,OAAO,WAAW,IAAK,OAAM,IAAI,iBAAiB,iBAAiB;AACvE,QAAI,OAAO,WAAW,OAAO,OAAO,WAAW,IAAK,OAAM,IAAI,iBAAiB,cAAc;AAC7F,QAAI,CAAC,gBAAgB,MAAM,EAAG,OAAM,IAAI,iBAAiB,mBAAmB;AAC5E,QAAI,OAAO,SAAS,OAAO,OAAO,UAAU,OAAO,OAAO,UAAU,OAAW,OAAM,IAAI,iBAAiB,mBAAmB;AAC7H,SAAK,qBAAqB,OAAO,OAAO,OAAO,SAAS,OAAO,UAAU;AACzE,QAAI,OAAO,MAAM,cAAc,KAAK,QAAQ,mBAAmB,2BAA4B,OAAM,IAAI,iBAAiB,iBAAiB;AACvI,WAAO,EAAE,OAAO,OAAO,OAAO,MAAM,OAAO,SAAS,QAAQ,OAAO,MAAM,aAAa,OAAO,UAAU,cAAc,KAAK,OAAO,eAAe,SAAS,QAAQ,UAAU,MAAM,OAAO,MAAM,WAAW;AAAA,EAC3M;AAAA,EAEA,MAAc,eAAe,UAA2B,SAA6B,MAA4C;AAC/H,SAAK,0BAA0B,UAAU,SAAS,YAAY,IAAI;AAClE,UAAM,SAAS,MAAM,KAAK,aAAa,EAAE,UAAU,SAAS,QAAQ,YAAY,UAAU,MAAM,WAAW,uCAAuC,CAAC;AACnJ,QAAI,OAAO,WAAW,IAAK,OAAM,IAAI,iBAAiB,iBAAiB;AACvE,QAAI,OAAO,WAAW,OAAO,OAAO,WAAW,IAAK,OAAM,IAAI,iBAAiB,cAAc;AAC7F,QAAI,CAAC,gBAAgB,MAAM,KAAK,OAAO,aAAa,OAAW,OAAM,IAAI,iBAAiB,mBAAmB;AAC7G,WAAO,EAAE,UAAU,OAAO,UAAU,MAAM,OAAO,SAAS,QAAQ,OAAO,MAAM,aAAa,OAAO,UAAU,cAAc,KAAK,OAAO,YAAY;AAAA,EACrJ;AAAA,EAEA,MAAc,WAAW,UAA2B,SAA6B,MAAc,OAAgB,QAA2C;AACxJ,SAAK,0BAA0B,UAAU,SAAS,QAAQ,MAAM,OAAO,MAAM;AAC7E,UAAM,SAAS,MAAM,KAAK,aAAa,EAAE,UAAU,SAAS,QAAQ,QAAQ,UAAU,MAAM,OAAO,QAAQ,WAAW,uCAAuC,CAAC;AAC9J,QAAI,OAAO,WAAW,OAAO,OAAO,WAAW,IAAK,OAAM,IAAI,iBAAiB,cAAc;AAC7F,QAAI,OAAO,SAAS,OAAO,OAAO,UAAU,IAAK,OAAM,IAAI,iBAAiB,mBAAmB;AAC/F,QAAI,CAAC,gBAAgB,MAAM,EAAG,OAAM,IAAI,iBAAiB,mBAAmB;AAC5E,UAAM,OAAO,OAAO,QAAQ,OAAO,SAAS,IAAI,CAAC,UAAU,MAAM,IAAI;AACrE,QAAI,SAAS,OAAW,OAAM,IAAI,iBAAiB,mBAAmB;AACtE,UAAM,eAAe,OAAO,UAAU,yBAAyB;AAC/D,QAAI,iBAAiB,UAAa,OAAO,eAAe,UAAa,iBAAiB,OAAO,WAAY,OAAM,IAAI,iBAAiB,0BAA0B;AAC9J,SAAK,uBAAuB,MAAM,EAAE,GAAG,QAAQ,KAAK,CAAC;AACrD,WAAO,EAAE,MAAM,SAAS,OAAO,SAAS,WAAW,OAAO,WAAW,YAAY,OAAO,WAAW;AAAA,EACrG;AAAA,EAEA,MAAc,WAAW,UAA2B,SAA6B,MAAcF,QAAmB,OAAsG;AACtN,SAAK,0BAA0B,UAAU,SAAS,OAAO,IAAI;AAC7D,QAAIA,OAAM,cAAc,KAAK,QAAQ,mBAAmB,2BAA4B,OAAM,IAAI,iBAAiB,iBAAiB;AAChI,UAAM,cAAc,MAAM,eAAe,SAAS,QAAQ;AAC1D,QAAI,gBAAgB,SAAS,QAAQ,YAAY,CAAC,oCAAoC,KAAK,WAAW,EAAG,OAAM,IAAI,iBAAiB,4BAA4B;AAChK,UAAM,SAAS,MAAM,KAAK,aAAa,EAAE,UAAU,SAAS,QAAQ,OAAO,UAAU,MAAM,MAAMA,QAAO,YAAYC,sBAAiB,uBAAOD,MAAK,CAAC,GAAG,aAAa,SAAS,MAAM,MAAM,WAAW,uCAAuC,CAAC;AAC1O,QAAI,OAAO,WAAW,OAAO,OAAO,WAAW,IAAK,OAAM,IAAI,cAAc,MAAM,OAAO,SAAS,IAAI;AACtG,QAAI,OAAO,WAAW,OAAO,OAAO,WAAW,IAAK,OAAM,IAAI,iBAAiB,cAAc;AAC7F,QAAI,OAAO,SAAS,OAAO,OAAO,UAAU,IAAK,OAAM,IAAI,iBAAiB,oBAAoB;AAChG,QAAI,CAAC,gBAAgB,MAAM,EAAG,OAAM,IAAI,iBAAiB,oBAAoB;AAC7E,WAAO,EAAE,MAAM,OAAO,SAAS,QAAQ,OAAO,KAAK;AAAA,EACrD;AAAA,EAEA,MAAc,aAAa,OAAkH;AAC3I,QAAI,KAAK,QAAQ,iBAAiB,QAAW;AAC3C,YAAM,SAAS,MAAM,KAAK,QAAQ,aAAa,KAAK;AACpD,UAAI,CAAC,OAAO,cAAc,OAAO,MAAM,KAAK,OAAO,SAAS,OAAO,OAAO,SAAS,IAAK,OAAM,IAAI,iBAAiB,wBAAwB;AAC3I,UAAI,OAAO,UAAU,OAAO,OAAO,SAAS,IAAK,MAAK,qBAAqB,OAAO,MAAM;AACxF,aAAO;AAAA,IACT;AACA,UAAMG,QAAO,MAAM,SAAS,OAAO,QAAQ,OAAO,EAAE;AACpD,QAAI,MAAM,cAAc,kBAAmB,OAAM,IAAI,iBAAiB,iCAAiC;AACvG,UAAM,UAAU,MAAM;AACtB,UAAM,UAAU,KAAK,QAAQ;AAC7B,UAAM,KAAK,QAAQ,YAAY,KAAK,SAAS,oBAAoB;AACjE,UAAM,WAAW,CAACC,QAAgBC,UAAyB;AACzD,UAAI,OAAOD,WAAU,YAAYA,OAAM,WAAW,EAAG,OAAM,IAAI,iBAAiB,yBAAyB,gBAAgBC,KAAI,aAAa;AAC1I,aAAOD;AAAA,IACT;AACA,UAAM,gBAAgB,QAAQ,iBAAiB,SAAS;AACxD,QAAI,CAAC,SAAS,aAAa,EAAG,OAAM,IAAI,iBAAiB,yBAAyB,gCAAgC;AAClH,UAAM,MAAM,KAAK,IAAI,EAAE,QAAQ;AAC/B,UAAM,SAAS,KAAK;AAAA,MAClB,MAAM;AAAA,MACN,UAAU,QAAQ,SAAS,KAAK;AAAA,MAChC,UAAU,MAAM,SAAS,SAAS,KAAK;AAAA,IACzC;AACA,QAAI,CAAC,OAAO,SAAS,MAAM,KAAK,UAAU,IAAK,OAAM,IAAI,iBAAiB,yBAAyB,6BAA6B;AAChI,UAAM,iBAAiB,WAAW,MAAM,MAAM;AAC9C,UAAM,eAAe,QAAQ,YAAY,SACrC,QAAQ,UACR,SAAS,YAAY,SACnB,QAAQ,UACR,QAAQ,WAAW,SACjB,CAAC,QAAQ,MAAM,IACf,SAAS,WAAW,SAClB,CAAC,QAAQ,MAAM,IACf,CAAC;AACX,UAAM,oBAAoB,uBAAuB,YAAY;AAC7D,QAAI,CAAC,kBAAkB,SAAS,cAAc,EAAG,OAAM,IAAI,iBAAiB,+BAA+B;AAC3G,UAAM,iBAAiB,cAAc,QAAQ,YAAY,SAAS,YAAY,MAAM,SAAS,UAAU,MAAM,SAAS,SAAS,IAAI;AACnI,QAAI,mBAAmB,UAAa,CAAC,sBAAsB,EAAE,SAAS,MAAM,SAAS,SAAS,UAAU,gBAAgB,SAAS,CAAC,gBAAgB,cAAc,CAAE,EAAE,GAAG,gBAAgB,cAAc,GAAI,MAAM,QAAQ,GAAG;AACxN,YAAM,IAAI,iBAAiB,oBAAoB;AAAA,IACjD;AACA,UAAM,iBAA0C;AAAA,MAC9C,MAAM;AAAA,MACN,SAAS;AAAA,MACT,WAAW,SAAS,QAAQ,WAAW,WAAW;AAAA,MAClD,UAAU,SAAS,QAAQ,YAAY,SAAS,UAAU,UAAU;AAAA,MACpE,SAAS,SAAS,QAAQ,WAAW,SAAS,SAAS,SAAS;AAAA,MAChE,eAAe,SAAS,QAAQ,iBAAiB,SAAS,eAAe,eAAe;AAAA,MACxF,WAAW,SAAS,QAAQ,aAAa,SAAS,WAAW,WAAW;AAAA,MACxE,GAAI,KAAK;AAAA,QACP,aAAa,SAAS,QAAQ,eAAe,SAAS,aAAa,aAAa;AAAA,QAChF,iBAAiB,SAAS,QAAQ,mBAAmB,SAAS,iBAAiB,iBAAiB;AAAA,QAChG,0BAA0B,SAAS,QAAQ,4BAA4B,SAAS,0BAA0B,0BAA0B;AAAA,MACtI,IAAI;AAAA,QACF,yBAAyB,SAAS,QAAQ,2BAA2B,SAAS,yBAAyB,yBAAyB;AAAA,QAChI,yBAAyB,SAAS,QAAQ,2BAA2B,SAAS,yBAAyB,yBAAyB;AAAA,MAClI;AAAA,MACA;AAAA,MACA,qBAAqB,SAAS,QAAQ,uBAAuB,SAAS,qBAAqB,qBAAqB;AAAA,MAChH,WAAW,SAAS,QAAQ,WAAW,WAAW;AAAA,MAClD,GAAI,KAAK,CAAC,IAAI,EAAE,cAAc,SAAS,QAAQ,gBAAgB,SAAS,gBAAgB,MAAM,SAAS,QAAQ,cAAc,EAAE;AAAA,MAC/H,cAAc,SAAS,QAAQ,gBAAgB,SAAS,cAAc,cAAc;AAAA,MACpF,QAAQ;AAAA,MACR,SAAS;AAAA,MACT,UAAU,MAAM;AAAA,MAChB,UAAU,IAAI,KAAK,GAAG,EAAE,YAAY;AAAA,MACpC,WAAW,IAAI,KAAK,MAAM,EAAE,YAAY;AAAA,MACxC,KAAK,UAAU;AAAA,MACf,GAAI,MAAM,eAAe,SAAY,CAAC,IAAI,EAAE,YAAY,MAAM,WAAW;AAAA,MACzE,GAAI,MAAM,YAAY,SAAY,CAAC,IAAI,EAAE,SAAS,MAAM,QAAQ;AAAA,MAChE,GAAI,MAAM,gBAAgB,SAAY,CAAC,IAAI,EAAE,aAAa,MAAM,YAAY;AAAA,MAC5E,GAAI,KAAK,CAAC,IAAI,EAAE,GAAI,MAAM,UAAU,SAAY,CAAC,IAAI,EAAE,OAAO,MAAM,MAAM,GAAI,GAAI,MAAM,WAAW,SAAY,CAAC,IAAI,EAAE,QAAQ,MAAM,OAAO,GAAI,IAAI,QAAQ,aAAa,SAAS,eAAe,SAAY,CAAC,IAAI,EAAE,WAAW,QAAQ,aAAa,SAAS,UAAU,GAAG,IAAI,QAAQ,aAAa,SAAS,eAAe,SAAY,CAAC,IAAI,EAAE,WAAW,QAAQ,aAAa,SAAS,UAAU,EAAE;AAAA,IACpY;AACA,UAAM,oBAAoB,gBAAgB,cAAc;AACxD,UAAM,aAAsC,EAAE,GAAG,gBAAgB,kBAAkB;AACnF,UAAM,SAAS,KAAK,QAAQ,gBAAgB,QAAQ;AACpD,QAAI,WAAW,OAAW,OAAM,IAAI,iBAAiB,8BAA8B;AACnF,UAAM,QAAQ,MAAM,OAAO,EAAE,QAAQ,KAAK,4BAA4B,2BAA2B,SAAS,WAAW,CAAC;AACtH,SAAK,oBAAoB,KAAK;AAC9B,UAAM,UAAmC,KACrC;AAAA,MACA,WAAW,WAAW;AAAA,MACtB,aAAa,WAAW;AAAA,MACxB,UAAU,WAAW;AAAA,MACrB,SAAS,WAAW;AAAA,MACpB,iBAAiB,WAAW;AAAA,MAC5B,eAAe,WAAW;AAAA,MAC1B,WAAW,WAAW;AAAA,MACtB,0BAA0B,WAAW;AAAA,MACrC;AAAA,MACA,qBAAqB,WAAW;AAAA,MAChC,WAAW,WAAW;AAAA,MACtB,cAAc,WAAW;AAAA,MACzB,QAAQ,WAAW;AAAA,MACnB,SAAS,WAAW;AAAA,MACpB,UAAU,WAAW;AAAA,MACrB;AAAA,MACA;AAAA,MACA;AAAA,IACF,IACE;AAAA,MACA,WAAW,WAAW;AAAA,MACtB,eAAe,WAAW;AAAA,MAC1B,yBAAyB,WAAW;AAAA,MACpC,yBAAyB,WAAW;AAAA,MACpC;AAAA,MACA,qBAAqB,WAAW;AAAA,MAChC,QAAQ,WAAW;AAAA,MACnB,SAAS,WAAW;AAAA,MACpB,UAAU,WAAW;AAAA,MACrB;AAAA,MACA;AAAA,MACA;AAAA,IACF;AACF,UAAM,OAAO;AAAA,MACX;AAAA,MACA,GAAI,MAAM,UAAU,SAAY,CAAC,IAAI,EAAE,OAAO,MAAM,MAAM;AAAA,MAC1D,GAAI,MAAM,WAAW,SAAY,CAAC,IAAI,EAAE,QAAQ,MAAM,OAAO;AAAA,MAC7D,GAAI,MAAM,SAAS,SAAY,CAAC,IAAI,EAAE,MAAMH,kBAAiB,MAAM,IAAI,EAAE;AAAA,MACzE,GAAI,MAAM,eAAe,SAAY,CAAC,IAAI,EAAE,YAAY,MAAM,WAAW;AAAA,MACzE,GAAI,MAAM,YAAY,SAAY,CAAC,IAAI,EAAE,SAAS,MAAM,QAAQ;AAAA,MAChE,GAAI,MAAM,gBAAgB,SAAY,CAAC,IAAI,EAAE,aAAa,MAAM,YAAY;AAAA,IAC9E;AACA,UAAM,SAAS,KAAK,QAAQ,qBAAqB,SAC7C,SACA,MAAM,KAAK,QAAQ,iBAAiB,EAAE,UAAU,MAAM,UAAU,SAAS,MAAM,SAAS,SAAS,KAAK,CAAC;AAC3G,UAAM,YAAY,KAAK,QAAQ,WAAW,UAAa,QAAQ,kBAAkB,UAAa,QAAQ,qBAAqB,SACvH,KAAK,qBAAqB,SAAS,MAAM,QAAQ,MAAM,UAAU,IAAI,IACrE;AAIJ,UAAM,WAAW,MAAM,KAAK,QAAQ,GAAGE,KAAI,WAAW;AAAA,MACpD,QAAQ;AAAA,MACR,SAAS,EAAE,GAAG,cAAc,SAAS,GAAG,GAAG,cAAc,MAAM,GAAG,gBAAgB,MAAM,WAAW,QAAQ,MAAM,UAAU;AAAA,MAC3H,MAAM,KAAK,UAAU,IAAI;AAAA,MACzB,UAAU;AAAA,IACZ,CAAC;AACD,QAAK,SAA0D,eAAe,QAAQ,SAAS,UAAU,OAAO,SAAS,SAAS,IAAK,OAAM,IAAI,iBAAiB,yBAAyB;AAC3L,UAAM,UAAkC,CAAC;AACzC,eAAWE,SAAQ,CAAC,QAAQ,gBAAgB,kBAAkB,8BAA8B,mBAAmB,2BAA2B,yBAAyB,GAAG;AACpK,YAAMD,SAAQ,SAAS,QAAQ,IAAIC,KAAI;AACvC,UAAID,WAAU,KAAM,SAAQC,KAAI,IAAID;AAAA,IACtC;AACA,QAAI,SAAS,SAAS,OAAO,SAAS,UAAU,IAAK,QAAO,EAAE,QAAQ,SAAS,QAAQ,QAAQ;AAC/F,UAAM,cAAc,SAAS,QAAQ,IAAI,cAAc,KAAK;AAC5D,QAAI,CAAC,YAAY,YAAY,EAAE,SAAS,MAAM,EAAG,OAAM,IAAI,iBAAiB,wBAAwB;AACpG,QAAI;AACJ,QAAI;AACJ,QAAI;AAAE,sBAAgB,IAAI,WAAW,MAAM,SAAS,YAAY,CAAC;AAAA,IAAG,QAAQ;AAAE,YAAM,IAAI,iBAAiB,wBAAwB;AAAA,IAAG;AACpI,QAAI,cAAc,cAAc,KAAK,QAAQ,oBAAoBP,6BAA6B,OAAM,IAAI,iBAAiB,iBAAiB;AAC1I,QAAI;AAAE,cAAQ,KAAK,MAAM,IAAI,YAAY,SAAS,EAAE,OAAO,KAAK,CAAC,EAAE,OAAO,aAAa,CAAC;AAAA,IAAG,QAAQ;AAAE,YAAM,IAAI,iBAAiB,wBAAwB;AAAA,IAAG;AAC3J,UAAM,SAAS,0BAA0B,UAAU,KAAK;AACxD,QAAI,CAAC,OAAO,QAAS,OAAM,IAAI,iBAAiB,wBAAwB;AACxE,UAAM,SAAS,OAAO;AACtB,UAAM,iBAAiB,WAAW,MAAM,MAAM;AAC9C,QAAI,OAAO,WAAW,kBAAkB,OAAO,YAAY,KAAK,OAAO,aAAa,MAAM,UAAU;AAClG,YAAM,IAAI,iBAAiB,yBAAyB;AAAA,IACtD;AACA,QAAI,OAAO,SAAS,UAAa,OAAO,SAAS,QAAQ,QAAQ,SAAS,UAAa,OAAO,SAAS,QAAQ,KAAM,OAAM,IAAI,iBAAiB,0BAA0B;AAC1K,QAAI,OAAO,SAAS,UAAa,OAAO,SAAS,KAAM,SAAQ,OAAO,OAAO;AAC7E,QAAI,MAAM,WAAW,QAAQ;AAC3B,UAAI,OAAO,YAAY,OAAW,OAAM,IAAI,iBAAiB,wBAAwB;AACrF,YAAM,aAAa,OAAO;AAC1B,UAAI,WAAW,SAAS,mBAAoB,OAAM,IAAI,iBAAiB,iBAAiB;AACxF,YAAM,UAA4B,CAAC,GAAG,UAAU;AAChD,YAAM,eAAe,SAAS,QAAQ,IAAI,yBAAyB;AACnE,UAAI,OAAO,eAAe,UAAa,OAAO,eAAe,QAAQ,iBAAiB,QAAQ,OAAO,eAAe,aAAc,OAAM,IAAI,iBAAiB,0BAA0B;AACvL,YAAM,aAAc,OAAO,cAAc,gBAAiB;AAC1D,UAAI,eAAe,UAAa,IAAI,YAAY,EAAE,OAAO,UAAU,EAAE,aAAa,wBAAyB,OAAM,IAAI,iBAAiB,iBAAiB;AACvJ,aAAO,EAAE,QAAQ,SAAS,QAAQ,SAAS,MAAM,OAAO,MAAM,SAAS,OAAO,SAAS,QAAQ,OAAO,QAAQ,UAAU,OAAO,UAAU,MAAM,QAAQ,IAAI,CAAC,UAAU,MAAM,IAAI,GAAG,SAAS,WAAW,eAAe,QAAW,WAAW;AAAA,IAC9O;AACA,QAAI,MAAM,WAAW,OAAO;AAC1B,UAAI,OAAO,YAAY,UAAa,OAAO,eAAe,OAAW,OAAM,IAAI,iBAAiB,wBAAwB;AACxH,UAAIG;AACJ,UAAI;AAAE,QAAAA,SAAQD,kBAAiB,OAAO,OAAO;AAAA,MAAG,QAAQ;AAAE,cAAM,IAAI,iBAAiB,wBAAwB;AAAA,MAAG;AAChH,UAAIC,OAAM,cAAc,KAAK,QAAQ,mBAAmB,8BAA8B,CAAC,KAAK,cAAc,OAAO,YAAYA,MAAK,EAAG,OAAM,IAAI,iBAAiB,0BAA0B;AAC1L,aAAO,EAAE,QAAQ,SAAS,QAAQ,SAAS,OAAAA,QAAO,YAAY,OAAO,YAAY,MAAM,OAAO,MAAM,SAAS,OAAO,SAAS,QAAQ,OAAO,QAAQ,UAAU,OAAO,SAAS;AAAA,IAChL;AACA,QAAI,MAAM,WAAW,YAAY;AAC/B,UAAI,OAAO,aAAa,OAAW,OAAM,IAAI,iBAAiB,wBAAwB;AACtF,aAAO,EAAE,QAAQ,SAAS,QAAQ,SAAS,UAAU,OAAO,UAAU,MAAM,OAAO,QAAQ,QAAW,MAAM,OAAO,MAAM,SAAS,OAAO,SAAS,QAAQ,OAAO,QAAQ,UAAU,OAAO,SAAS;AAAA,IACrM;AACA,UAAM,eAAe,OAAO;AAC5B,UAAM,qBAAqB,OAAO;AAClC,QAAI,iBAAiB,UAAa,iBAAiB,QAAQ,aAAa,WAAW,KAAK,QAAQ,SAAS,UAAa,iBAAiB,QAAQ,KAAM,OAAM,IAAI,iBAAiB,wBAAwB;AACxM,QAAI,MAAM,eAAe,UAAa,uBAAuB,UAAa,uBAAuB,MAAM,cAAc,CAAC,KAAK,cAAc,oBAAoB,MAAM,QAAQ,IAAI,WAAW,CAAC,EAAG,OAAM,IAAI,iBAAiB,0BAA0B;AACnP,WAAO,EAAE,QAAQ,SAAS,QAAQ,SAAS,YAAY,oBAAoB,MAAM,OAAO,MAAM,SAAS,OAAO,SAAS,QAAQ,OAAO,QAAQ,UAAU,OAAO,SAAS;AAAA,EAC1K;AAAA,EAEQ,qBAAqB,OAAgF,QAAuC;AAClJ,QAAI,CAAC,gBAAgB,MAAM,EAAG,OAAM,IAAI,iBAAiB,yBAAyB;AAClF,QAAI,OAAO,SAAS,kCAAkC,OAAO,YAAY,KAAK,OAAO,WAAW,WAAW,MAAM,MAAM,KAAK,OAAO,aAAa,MAAM,SAAU,OAAM,IAAI,iBAAiB,yBAAyB;AACpN,QAAI,MAAM,WAAW,OAAO;AAC1B,UAAI,OAAO,UAAU,UAAa,OAAO,eAAe,UAAa,CAAC,KAAK,cAAc,OAAO,YAAY,OAAO,KAAK,EAAG,OAAM,IAAI,iBAAiB,0BAA0B;AAChL,UAAI,OAAO,MAAM,cAAc,KAAK,QAAQ,mBAAmB,2BAA4B,OAAM,IAAI,iBAAiB,iBAAiB;AAAA,IACzI;AACA,QAAI,MAAM,WAAW,cAAc,OAAO,aAAa,OAAW,OAAM,IAAI,iBAAiB,wBAAwB;AACrH,QAAI,MAAM,WAAW,OAAQ,MAAK,uBAAuB,MAAM,UAAU,MAAM;AAC/E,QAAI,MAAM,WAAW,OAAO;AAC1B,YAAM,OAAO,OAAO,SAAS,QAAQ,OAAO;AAC5C,YAAM,aAAa,OAAO;AAC1B,UAAI,SAAS,UAAa,KAAK,WAAW,KAAK,eAAe,UAAa,eAAe,MAAM,cAAc,MAAM,SAAS,UAAa,CAAC,KAAK,cAAc,YAAY,MAAM,IAAI,EAAG,OAAM,IAAI,iBAAiB,0BAA0B;AAAA,IAC9O;AAAA,EACF;AAAA,EAEQ,uBAAuB,OAAe,QAAuC;AACnF,QAAI,CAAC,gBAAgB,MAAM,EAAG,OAAM,IAAI,iBAAiB,mBAAmB;AAC5E,QAAI,OAAO,SAAS,UAAa,OAAO,YAAY,UAAa,OAAO,KAAK,SAAS,sBAAsB,OAAO,QAAQ,WAAW,OAAO,KAAK,UAAU,OAAO,eAAe,UAAa,IAAI,YAAY,EAAE,OAAO,OAAO,UAAU,EAAE,aAAa,wBAAyB,OAAM,IAAI,iBAAiB,mBAAmB;AAC/T,QAAI,OAAO,QAAQ,KAAK,CAAC,OAAO,UAAU,CAAC,SAAS,KAAK,KAAK,OAAO,MAAM,SAAS,YAAa,MAAM,SAAS,UAAU,MAAM,SAAS,YAAa,MAAM,SAAS,OAAO,KAAM,KAAK,CAAC,EAAG,OAAM,IAAI,iBAAiB,wBAAwB;AAC9O,UAAM,OAAO,oBAAI,IAAY;AAC7B,eAAW,SAAS,OAAO,SAAS;AAClC,oBAAc,MAAM,IAAI;AACxB,UAAI,KAAK,IAAI,MAAM,IAAI,EAAG,OAAM,IAAI,iBAAiB,wBAAwB;AAC7E,WAAK,IAAI,MAAM,IAAI;AACnB,YAAM,SAAS,MAAM,QAAQ,OAAO,EAAE;AACtC,YAAM,WAAW,MAAM,SAAS,SAAS,KAAK,MAAM,KAAK,WAAW,GAAG,MAAM,GAAG,IAAI,MAAM,KAAK,MAAM,OAAO,SAAS,CAAC,IAAI;AAC1H,UAAI,aAAa,UAAa,SAAS,WAAW,KAAK,SAAS,SAAS,GAAG,EAAG,OAAM,IAAI,iBAAiB,yBAAyB;AAAA,IACrI;AAAA,EACF;AAAA,EAEQ,oBAAoB,OAAqD;AAC/E,UAAM,QAAQ,KAAK,cAAc,OAAO,cAAc;AACtD,qBAAiB,OAAO,CAAC,OAAO,OAAO,WAAW,GAAG,cAAc;AACnE,QAAI,MAAM,QAAQ,WAAW,OAAO,MAAM,QAAQ,YAAY,OAAO,MAAM,cAAc,YAAY,CAAC,sBAAsB,KAAK,MAAM,SAAS,GAAG;AACjJ,YAAM,IAAI,iBAAiB,4BAA4B;AAAA,IACzD;AAAA,EACF;AAAA,EAEQ,qBAAqB,SAA6B,QAA6C,UAAkB,SAAkD;AACzK,UAAM,gBAAgB,OAAO,QAAQ,kBAAkB,WACnD,QAAQ,gBACR,SAAS,QAAQ,gBAAgB,KAAK,OAAO,QAAQ,iBAAiB,kBAAkB,WACtF,QAAQ,iBAAiB,gBACzB;AACN,UAAM,gBAAgB;AAAA,MACpB,kBAAkB,EAAE,eAAe,iBAAiB,GAAG;AAAA,MACvD,eAAe,OAAO,QAAQ,kBAAkB,WAAW,QAAQ,gBAAgB,QAAQ;AAAA,MAC3F,SAAS,OAAO,QAAQ,YAAY,WAAW,QAAQ,UAAU;AAAA,MACjE,oBAAoB,OAAO,QAAQ,uBAAuB,WAAW,QAAQ,qBAAqB,QAAQ;AAAA,MAC1G,KAAK,SAAS,QAAQ,GAAG,IAAI,QAAQ,MAAM,CAAC;AAAA,IAC9C;AACA,QAAI,KAAK,QAAQ,WAAW,QAAW;AACrC,UAAI,kBAAkB,OAAW,OAAM,IAAI,iBAAiB,8BAA8B;AAC1F,aAAO,EAAE,eAAe,cAAc;AAAA,IACxC;AACA,WAAO,KAAK,QAAQ,OAAO,eAAe,SAAS,UAAU,mBAAmB,MAAM,IAAI,CAAC;AAAA,MACzF,gBAAgB,QAAQ;AAAA,MACxB,cAAc;AAAA,IAChB,CAAC,CAAC;AAAA,EACJ;AAAA,EAEQ,cAAc,OAAeA,QAA4B;AAC/D,UAAMM,UAASL,sBAAiB,uBAAOD,MAAK,CAAC;AAC7C,WAAO,UAAUM,WAAU,UAAU,YAAYA,OAAM;AAAA,EACzD;AAAA,EAEQ,0BAA0B,UAA2B,SAA6B,WAAgD,MAAc,OAAgB,QAAuB;AAC7L,UAAM,UAAU,KAAK,QAAQ;AAC7B,UAAM,iBAAiB,cAAc,QAAQ,YAAY,SAAS,YAAY,SAAS,UAAU,SAAS,SAAS,IAAI;AACvH,UAAM,eAAe,WAAW,SAAS;AACzC,UAAM,eAAe,gBAAgB,YAAY;AACjD,QAAI,mBAAmB,UAAa,iBAAiB,UAAa,CAAC,sBAAsB,EAAE,SAAS,SAAS,SAAS,UAAU,gBAAgB,SAAS,CAAC,YAAY,EAAE,GAAG,cAAc,IAAI,EAAG,OAAM,IAAI,iBAAiB,oBAAoB;AAC/O,UAAM,SAAS,QAAQ,WAAW,SAAS,YAAY,QAAQ,WAAW,SAAY,CAAC,QAAQ,MAAM,IAAI,SAAS,WAAW,SAAY,CAAC,QAAQ,MAAM,IAAI,CAAC;AAC7J,QAAI,OAAO,WAAW,KAAK,CAAC,uBAAuB,MAAM,EAAE,SAAS,YAAY,EAAG,OAAM,IAAI,iBAAiB,+BAA+B;AAC7I,QAAI,UAAU,WAAc,CAAC,OAAO,cAAc,KAAK,KAAK,QAAQ,KAAK,QAAQ,kBAAmB,OAAM,IAAI,iBAAiB,qBAAqB;AACpJ,QAAI,WAAW,WAAc,OAAO,WAAW,KAAK,IAAI,YAAY,EAAE,OAAO,MAAM,EAAE,aAAa,yBAA0B,OAAM,IAAI,iBAAiB,sBAAsB;AAAA,EAC/K;AAAA,EAEQ,qBAAqBN,QAAmB,SAAmE,YAA2B;AAC5I,QAAI,eAAe,UAAa,CAAC,KAAK,cAAc,YAAYA,MAAK,EAAG,OAAM,IAAI,iBAAiB,0BAA0B;AAC7H,UAAMM,UAAS,UAAU,4BAA4B,KAAK,UAAU,gBAAgB;AACpF,QAAIA,YAAW,UAAa,CAAC,KAAK,cAAcA,SAAQN,MAAK,GAAG;AAC9D,YAAM,IAAI,iBAAiB,0BAA0B;AAAA,IACvD;AACA,UAAMO,OAAM,UAAU,yBAAyB,KAAK,UAAU,iBAAiB;AAC/E,QAAIA,SAAQ,UAAa,CAAC,wBAAwBA,MAAKP,MAAK,KAAK,CAAC,eAAeO,MAAKP,MAAK,EAAG,OAAM,IAAI,iBAAiB,0BAA0B;AAAA,EACrJ;AAAA,EAEA,MAAc,uBAAuB,UAAwD;AAC3F,QAAI,KAAK,QAAQ,iBAAiB,OAAW,OAAM,IAAI,iBAAiB,6BAA6B;AACrG,UAAMG,QAAO,SAAS,OAAO,QAAQ,OAAO,EAAE;AAC9C,UAAM,eAAe,KAAK,QAAQ;AAClC,QAAI,iBAAiB,UAAa,OAAO,iBAAiB,YAAY,iBAAiB,MAAM;AAC3F,YAAM,IAAI,iBAAiB,6BAA6B;AAAA,IAC1D;AACA,UAAM,QAAQ;AACd,UAAM,KAAK,KAAK,QAAQ,eAAe,oBAAoB,UAAa,SAAS,MAAM,gBAAgB,KAAK,MAAM,iBAAiB,gBAAgB;AACnJ,UAAM,eAAe,KAAK,QAAQ,cAAc,aAAa,GAAGA,KAAI,IAAI,KAAK,aAAa,UAAU;AACpG,UAAM,aAAa,KAAK,QAAQ,cAAc,WAAW,GAAGA,KAAI,IAAI,KAAK,aAAa,UAAU;AAChG,UAAM,UAAU,MAAM,oBAAoB,KAAK,sBAAsB,UAAU,KAAK;AACpF,QAAI,YAAY,UAAa,OAAO,YAAY,YAAY,YAAY,QAAQ,MAAM,QAAQ,OAAO,EAAG,OAAM,IAAI,iBAAiB,yBAAyB,6CAA6C;AACzM,QAAI,KAAK,QAAQ,kBAAkB,OAAW,MAAK,6BAA6B,OAAkC;AAClH,UAAM,oBAAoB,MAAM,KAAK,SAAS,cAAc,OAAO;AACnE,UAAM,oBAAoB,oBAAoB,mBAAmB,WAAW;AAC5E,UAAM,YAAY,kBAAkB;AACpC,SAAK,gBAAgB,WAAW,kBAAkB,OAAO,wCAAwC,KAAK,OAAO,IAAI,IAAI;AACrH,SAAK,8BAA8B,SAA8C,SAAS;AAC1F,SAAK,qBAAqB,SAAS;AAEnC,UAAM,UAAU,KAAK,QAAQ;AAC7B,UAAM,iBAAiB,YAAY,SAC/B,MAAM,KAAK,iCAAiC,cAAc,SAAS,IACnE,MAAM,QAAQ,EAAE,UAAU,WAAW,kBAAkB,QAA6C,CAAC;AACzG,QAAI,mBAAmB,UAAa,OAAO,mBAAmB,YAAY,mBAAmB,QAAQ,MAAM,QAAQ,cAAc,EAAG,OAAM,IAAI,iBAAiB,yBAAyB,wDAAwD;AAChP,QAAI,KAAK,QAAQ,kBAAkB,OAAW,MAAK,2BAA2B,gBAA2C,IAAI,SAAS;AACtI,UAAM,kBAAkB,MAAM,KAAK,SAAS,YAAY,cAAc;AACtE,UAAM,kBAAkB,oBAAoB,iBAAiB,SAAS;AACtE,UAAM,UAAU,gBAAgB;AAChC,SAAK,gBAAgB,SAAS,gBAAgB,OAAO,sCAAsC,KAAK,OAAO,IAAI,IAAI;AAC/G,SAAK,qBAAqB,SAAS,UAAU,SAAS,WAAW,cAAc;AAC/E,WAAO;AAAA,MACL,GAAI,KAAK,QAAQ,iBAAiB,CAAC;AAAA,MACnC,GAAG;AAAA,MACH,WAAW,KAAK,eAAe,SAAS,WAAW;AAAA,MACnD,GAAI,OAAO,QAAQ,aAAa,WAAW,EAAE,UAAU,QAAQ,SAAS,IAAI,CAAC;AAAA,MAC7E,GAAI,OAAO,QAAQ,YAAY,WAAW,EAAE,SAAS,QAAQ,QAAQ,IAAI,CAAC;AAAA,MAC1E,GAAI,OAAO,QAAQ,cAAc,WAAW,EAAE,WAAW,QAAQ,UAAU,IAAI,CAAC;AAAA,MAChF,WAAW,KAAK,eAAe,SAAS,WAAW;AAAA,MACnD,WAAW,KAAK,eAAe,SAAS,WAAW;AAAA,MACnD,GAAI,QAAQ,eAAe,SAAY,EAAE,YAAY,KAAK,uBAAuB,QAAQ,UAAU,EAAE,IAAI,CAAC;AAAA,MAC1G,GAAI,KAAK,QAAQ,iBAAiB,CAAC;AAAA,MACnC,GAAI,SAAS,cAAc,KAAK,OAAO,eAAe,eAAe,WAAW,EAAE,YAAY,eAAe,WAAW,IAAI,CAAC;AAAA,MAC7H,GAAI,SAAS,cAAc,KAAK,eAAe,kBAAkB,SAAY,EAAE,eAAe,eAAe,cAAc,IAAI,CAAC;AAAA,MAChI,GAAI,SAAS,cAAc,KAAK,OAAO,eAAe,kBAAkB,WAAW,EAAE,eAAe,eAAe,cAAc,IAAI,CAAC;AAAA,MACtI,GAAI,KAAK,QAAQ,iBAAiB,SAAY,CAAC,IAAI,EAAE,cAAc,KAAK,QAAQ,aAAa;AAAA,IAC/F;AAAA,EACF;AAAA,EAEQ,sBAAsB,UAA2B,cAAgE;AACvH,UAAM,UAAU,KAAK,QAAQ;AAC7B,QAAI,YAAY,OAAW,OAAM,IAAI,iBAAiB,yBAAyB,6CAA6C;AAC5H,UAAM,WAAW,CAAC,OAAgBE,UAAyB;AACzD,UAAI,OAAO,UAAU,YAAY,MAAM,WAAW,EAAG,OAAM,IAAI,iBAAiB,yBAAyB,kBAAkBA,KAAI,aAAa;AAC5I,aAAO;AAAA,IACT;AACA,QAAI,CAAC,SAAS,QAAQ,qBAAqB,KAAK,CAAC,SAAS,QAAQ,aAAa,EAAG,OAAM,IAAI,iBAAiB,yBAAyB,8CAA8C;AACpL,UAAM,YAAY,OAAO,aAAa,cAAc,WAAW,aAAa,YAAY,QAAQ;AAChG,QAAI,cAAc,OAAW,OAAM,IAAI,iBAAiB,yBAAyB,4BAA4B;AAC7G,UAAM,SAAS,QAAQ,UAAU,QAAQ,UAAU,CAAC,KAAK;AACzD,UAAM,OAAgC;AAAA,MACpC,aAAa,SAAS,QAAQ,aAAa,aAAa;AAAA,MACxD,UAAU,QAAQ;AAAA,MAClB,SAAS,QAAQ;AAAA,MACjB,iBAAiB,SAAS,QAAQ,iBAAiB,iBAAiB;AAAA,MACpE,eAAe,QAAQ;AAAA,MACvB,WAAW,QAAQ;AAAA,MACnB,0BAA0B,SAAS,QAAQ,0BAA0B,0BAA0B;AAAA,MAC/F,uBAAuB,QAAQ;AAAA,MAC/B,eAAe,QAAQ;AAAA,MACvB,eAAe,QAAQ;AAAA,MACvB,qBAAqB,QAAQ;AAAA,MAC7B;AAAA,MACA,cAAc,QAAQ,gBAAgB,SAAS;AAAA,MAC/C,cAAc,QAAQ;AAAA,MACtB;AAAA,MACA,GAAI,QAAQ,YAAY,SAAY,CAAC,IAAI,EAAE,SAAS,CAAC,GAAG,QAAQ,OAAO,EAAE;AAAA,MACzE,UAAU,QAAQ;AAAA,IACpB;AACA,WAAO,EAAE,GAAG,MAAM,mBAAmB,gBAAgB,IAAI,EAAE;AAAA,EAC7D;AAAA,EAEQ,6BAA6B,SAAwC;AAC3E,UAAM,KAAK,QAAQ,gBAAgB,UAAa,KAAK,QAAQ,eAAe,oBAAoB;AAChG,UAAM,OAAO,KACT,CAAC,eAAe,YAAY,WAAW,mBAAmB,iBAAiB,aAAa,4BAA4B,yBAAyB,iBAAiB,iBAAiB,uBAAuB,aAAa,gBAAgB,gBAAgB,UAAU,WAAW,YAAY,mBAAmB,IACvS,CAAC,YAAY,WAAW,iBAAiB,2BAA2B,2BAA2B,aAAa,iBAAiB,uBAAuB,aAAa,gBAAgB,gBAAgB,UAAU,WAAW,YAAY,aAAa,aAAa,mBAAmB;AACnR,qBAAiB,SAAS,MAAM,wBAAwB;AACxD,eAAW,OAAO,KAAK,CAAC,eAAe,YAAY,WAAW,mBAAmB,iBAAiB,aAAa,4BAA4B,uBAAuB,aAAa,gBAAgB,gBAAgB,YAAY,mBAAmB,IAAI,CAAC,YAAY,WAAW,iBAAiB,2BAA2B,2BAA2B,aAAa,uBAAuB,aAAa,gBAAgB,gBAAgB,YAAY,mBAAmB,GAAG;AAClc,UAAI,OAAO,QAAQ,GAAG,MAAM,YAAY,QAAQ,GAAG,EAAE,WAAW,EAAG,OAAM,IAAI,iBAAiB,yBAAyB,kBAAkB,GAAG,aAAa;AAAA,IAC3J;AACA,QAAI,CAAC,SAAS,QAAQ,aAAa,KAAK,OAAO,QAAQ,WAAW,SAAU,OAAM,IAAI,iBAAiB,yBAAyB,kCAAkC;AAClK,QAAI,QAAQ,YAAY,WAAc,CAAC,MAAM,QAAQ,QAAQ,OAAO,KAAK,QAAQ,QAAQ,KAAK,CAAC,WAAW,OAAO,WAAW,QAAQ,GAAI,OAAM,IAAI,iBAAiB,yBAAyB,oCAAoC;AAChO,QAAI,QAAQ,cAAc,UAAa,UAAU,QAAQ,SAAS,MAAM,UAAa,QAAQ,cAAc,UAAa,UAAU,QAAQ,SAAS,MAAM,UAAa,UAAU,QAAQ,SAAS,MAAM,UAAa,UAAU,QAAQ,SAAS,MAAM,UAAa,UAAU,QAAQ,SAAS,IAAK,UAAU,QAAQ,SAAS,EAAI,OAAM,IAAI,iBAAiB,yBAAyB,0CAA0C;AAC/Z,UAAM,EAAE,mBAAmB,SAAS,GAAG,KAAK,IAAI;AAChD,QAAI,QAAQ,sBAAsB,gBAAgB,IAAI,EAAG,OAAM,IAAI,iBAAiB,yBAAyB,kCAAkC;AAAA,EACjJ;AAAA,EAEQ,2BAA2B,SAAkC,IAAa,WAA0C;AAC1H,UAAM,OAAO,KACT,CAAC,eAAe,SAAS,gBAAgB,cAAc,SAAS,iBAAiB,eAAe,IAChG,CAAC,gBAAgB,cAAc,SAAS,iBAAiB,eAAe;AAC5E,qBAAiB,SAAS,MAAM,sBAAsB;AACtD,QAAI,OAAO,QAAQ,gBAAgB,UAAU,eAAe,QAAQ,UAAU,UAAU,OAAQ,OAAM,IAAI,iBAAiB,yBAAyB,qCAAqC;AACzL,QAAI,CAAC,SAAS,QAAQ,YAAY,KAAK,OAAO,QAAQ,eAAe,YAAY,QAAQ,WAAW,WAAW,KAAK,CAAC,SAAS,QAAQ,KAAK,KAAK,QAAQ,kBAAkB,UAAa,OAAO,QAAQ,kBAAkB,SAAU,OAAM,IAAI,iBAAiB,yBAAyB,oCAAoC;AAC1T,SAAK,oBAAoB,QAAQ,KAAK;AAAA,EACxC;AAAA,EAEQ,uBAAuB,OAAqC;AAClE,UAAM,SAAS,KAAK,cAAc,OAAO,oBAAoB;AAC7D,QAAI,OAAO,OAAO,YAAY,SAAU,OAAM,IAAI,iBAAiB,yBAAyB,qCAAqC;AACjI,QAAI,CAAC,MAAM,QAAQ,OAAO,OAAO,KAAK,OAAO,QAAQ,KAAK,CAAC,WAAW,CAAC,CAAC,QAAQ,QAAQ,MAAM,EAAE,SAAS,MAAgB,CAAC,EAAG,OAAM,IAAI,iBAAiB,yBAAyB,wCAAwC;AACzN,UAAM,WAAW,KAAK,cAAc,OAAO,UAAU,6BAA6B;AAClF,QAAK,SAAS,SAAS,WAAW,SAAS,SAAS,YAAa,OAAO,SAAS,SAAS,SAAU,OAAM,IAAI,iBAAiB,yBAAyB,wCAAwC;AAChM,WAAO,EAAE,SAAS,OAAO,SAAS,SAAS,CAAC,GAAG,IAAI,IAAI,OAAO,OAAO,CAAC,GAAoB,UAAU,EAAE,MAAM,SAAS,MAAM,MAAM,SAAS,KAAK,EAAmB;AAAA,EACpK;AAAA,EAEQ,4BAA4B,SAA6B,UAAiC;AAChG,UAAM,gBAAgB,UAAU,QAAQ,SAAS;AACjD,QAAI,OAAO,QAAQ,cAAc,YAAY,OAAO,QAAQ,cAAc,YAAY,QAAQ,aAAa,UAAa,QAAQ,YAAY,UAAa,QAAQ,WAAW,UAAa,kBAAkB,UAAa,iBAAiB,KAAK,IAAI,EAAE,QAAQ,KAAK,iBAAiB,UAAU,SAAS,SAAS,KAAK,IAAI;AACrT,YAAM,IAAI,iBAAiB,uBAAuB;AAAA,IACpD;AACA,SAAK,mBAAmB,SAAS,UAAU,aAAa;AACxD,QAAI,SAAS,KAAK,QAAQ,YAAY,GAAG;AACvC,YAAM,eAAe,SAAS,KAAK,QAAQ,aAAa,YAAY,IAAI,KAAK,QAAQ,aAAa,eAAe,KAAK,QAAQ;AAC9H,YAAM,kBAAkB,OAAO,aAAa,cAAc,WAAW,aAAa,YAAY,SAAS,aAAa,MAAM,KAAK,OAAO,aAAa,OAAO,QAAQ,WAAW,aAAa,OAAO,MAAM;AACvM,UAAI,oBAAoB,UAAa,oBAAoB,QAAQ,UAAW,OAAM,IAAI,iBAAiB,yBAAyB,sDAAsD;AAAA,IACxL;AACA,UAAM,gBAAgB,QAAQ,gBAAgB,QAAQ;AACtD,QAAI,kBAAkB,UAAa,kBAAkB,SAAS,OAAQ,OAAM,IAAI,iBAAiB,yBAAyB,+CAA+C;AACzK,QAAI,QAAQ,aAAa,QAAW;AAClC,YAAM,kBAAkB,cAAc,QAAQ,UAAU,SAAS,SAAS,IAAI;AAC9E,UAAI,oBAAoB,UAAa,eAAe,eAAe,MAAM,eAAe,SAAS,QAAQ,EAAG,OAAM,IAAI,iBAAiB,yBAAyB,iDAAiD;AAAA,IACnN;AACA,UAAM,UAAU,KAAK,QAAQ;AAC7B,QAAI,YAAY,QAAW;AACzB,WAAK,oBAAoB,QAAQ,YAAY,QAAQ,WAAW,SAAY,CAAC,IAAI,CAAC,QAAQ,MAAM,IAAI,SAAS,OAAO;AACpH;AAAA,IACF;AACA,sBAAkB,QAAQ,WAAW,QAAQ,WAAW,mDAAmD;AAC3G,sBAAkB,QAAQ,WAAW,QAAQ,WAAW,mDAAmD;AAC3G,UAAM,gBAAgB,cAAc,QAAQ,UAAU,SAAS,SAAS,IAAI;AAC5E,QAAI,QAAQ,iBAAiB,SAAS,UAAU,kBAAkB,UAAa,eAAe,aAAa,MAAM,eAAe,SAAS,QAAQ,KAAK,QAAQ,cAAc,UAAa,QAAQ,cAAc,SAAS,WAAW;AACjO,YAAM,IAAI,iBAAiB,uBAAuB;AAAA,IACpD;AACA,eAAW,CAAC,KAAK,QAAQ,KAAK,OAAO,QAAQ;AAAA,MAC3C,UAAU,QAAQ;AAAA,MAClB,SAAS,QAAQ;AAAA,MACjB,eAAe,QAAQ;AAAA,MACvB,yBAAyB,QAAQ;AAAA,MACjC,yBAAyB,QAAQ;AAAA,MACjC,WAAW,QAAQ;AAAA,MACnB,qBAAqB,QAAQ;AAAA,MAC7B,cAAc,QAAQ;AAAA,MACtB,cAAc,QAAQ;AAAA,MACtB,UAAU;AAAA,IACZ,CAAC,GAAG;AACF,YAAM,SAAS,QAAQ,aACnB,cAAe,QAA+C,GAAG,GAAG,SAAS,SAAS,IAAI,IACzF,QAA+C,GAAG;AACvD,wBAAkB,QAAQ,UAAU,gBAAgB,GAAG,6BAA6B;AAAA,IACtF;AACA,QAAI,QAAQ,kBAAkB,OAAW,mBAAkB,QAAQ,eAAe,QAAQ,eAAe,wDAAwD;AACjK,SAAK,oBAAoB,QAAQ,WAAW,QAAQ,YAAY,QAAQ,WAAW,SAAY,QAAQ,WAAW,SAAY,CAAC,IAAI,CAAC,QAAQ,MAAM,IAAI,CAAC,QAAQ,MAAM,IAAI,SAAS,OAAO;AAAA,EAC3L;AAAA,EAEQ,mBAAmB,SAA6B,UAA2B,QAAsB;AACvG,UAAM,MAAM,UAAU,QAAQ,aAAa,KAAK,QAAQ,eAAe,SAAS;AAChF,UAAM,MAAM,UAAU,QAAQ,aAAa,KAAK,QAAQ,eAAe,SAAS;AAChF,SAAK,QAAQ,cAAc,UAAa,KAAK,QAAQ,eAAe,cAAc,WAAc,QAAQ,WAAc,QAAQ,cAAc,UAAa,KAAK,QAAQ,eAAe,cAAc,WAAc,QAAQ,UAAa,QAAQ,UAAa,QAAQ,UAAa,MAAM,OAAO,QAAQ,UAAa,SAAS,OAAO,QAAQ,UAAa,SAAS,KAAK;AACnW,YAAM,IAAI,iBAAiB,yBAAyB,4DAA4D;AAAA,IAClH;AAAA,EACF;AAAA,EAEQ,oBAAoB,QAA4B,iBAA+C;AACrG,QAAI,OAAO,WAAW,EAAG;AACzB,UAAM,gBAAgB,uBAAuB,MAAM;AACnD,UAAM,UAAU,IAAI,IAAI,eAAe;AACvC,QAAI,cAAc,WAAW,KAAK,cAAc,KAAK,CAAC,WAAW,CAAC,QAAQ,IAAI,gBAAgB,MAAM,CAAE,CAAC,EAAG,OAAM,IAAI,iBAAiB,+BAA+B;AAAA,EACtK;AAAA,EAEA,MAAc,iCAAiC,cAAuB,WAAsD;AAC1H,QAAI,CAAC,SAAS,YAAY,EAAG,OAAM,IAAI,iBAAiB,yBAAyB,kDAAkD;AACnI,QAAI,CAAC,SAAS,aAAa,cAAc,GAAG;AAC1C,YAAM,UAAU,KAAK,QAAQ;AAC7B,YAAM,aAAa,OAAO,aAAa,eAAe,WAAW,aAAa,aAAa;AAC3F,YAAM,YAAY,OAAO,aAAa,cAAc,WAAW,aAAa,YAAY,SAAS;AACjG,YAAM,gBAAgB,aAAa;AACnC,YAAM,gBAAgB,OAAO,aAAa,kBAAkB,WAAW,aAAa,gBAAgB;AACpG,YAAM,SAAS,KAAK,QAAQ;AAC5B,UAAI,YAAY,UAAa,eAAe,UAAa,cAAc,UAAa,kBAAkB,UAAa,kBAAkB,UAAa,WAAW,QAAW;AACtK,cAAM,IAAI,iBAAiB,yBAAyB,kDAAkD;AAAA,MACxG;AACA,YAAM,SAAS,QAAQ,UAAU,QAAQ,UAAU,CAAC,KAAK;AACzD,YAAM,OAAO,UAAU,YAAY;AACnC,YAAM,qBAA8C;AAAA,QAClD,MAAM;AAAA,QACN,SAAS,OAAO,IAAI;AAAA,QACpB,aAAa,UAAU;AAAA,QACvB,OAAO,UAAU;AAAA,QACjB,UAAU,QAAQ;AAAA,QAClB,SAAS,QAAQ;AAAA,QACjB,eAAe,QAAQ;AAAA,QACvB,WAAW,QAAQ;AAAA,QACnB,eAAe,QAAQ;AAAA,QACvB,qBAAqB,QAAQ;AAAA,QAC7B;AAAA,QACA,cAAc,QAAQ;AAAA,QACtB,cAAc,QAAQ;AAAA,QACtB,GAAI,OAAO;AAAA,UACT,aAAa,UAAU;AAAA,UACvB,kBAAkB,OAAO,aAAa,qBAAqB,WAAW,aAAa,mBAAmBJ,sBAAiB,uBAAO,IAAI,YAAY,EAAE,OAAO,UAAU,CAAC,CAAC;AAAA,QACrK,IAAI,CAAC;AAAA,QACL;AAAA,QACA,GAAI,QAAQ,YAAY,SAAY,CAAC,IAAI,EAAE,SAAS,CAAC,GAAG,QAAQ,OAAO,EAAE;AAAA,QACzE,UAAU,QAAQ;AAAA,QAClB,mBAAmB,UAAU;AAAA,QAC7B,UAAU,IAAI,KAAK,KAAK,IAAI,CAAC,EAAE,YAAY;AAAA,QAC3C,WAAW,UAAU;AAAA,QACrB,KAAK,UAAU;AAAA,MACjB;AACA,YAAM,QAAQ,MAAM,OAAO,EAAE,QAAQ,OAAO,gCAAgC,+BAA+B,SAAS,mBAAmB,CAAC;AACxI,WAAK,oBAAoB,KAAK;AAC9B,aAAO,UAAU,YAAY,IACzB,EAAE,aAAa,UAAU,aAAa,OAAO,UAAU,OAAO,cAAc,oBAAoB,YAAY,OAAO,eAAe,cAAc,IAChJ,EAAE,cAAc,oBAAoB,YAAY,OAAO,eAAe,cAAc;AAAA,IAC1F;AACA,UAAM,UAAU,gBAAgB,aAAa,cAAc;AAC3D,UAAM,YAAY,SAAS,QAAQ,YAAY,IAAI,QAAQ,eAAe;AAC1E,QAAI,OAAO,UAAU,cAAc,SAAU,OAAM,IAAI,iBAAiB,yBAAyB,2CAA2C;AAC5I,cAAU,QAAQ,UAAU;AAC5B,QAAI,OAAO,UAAU,gBAAgB,SAAU,WAAU,cAAc,UAAU;AACjF,QAAI,UAAU,aAAa,UAAa,OAAO,UAAU,aAAa,SAAU,WAAU,WAAW,UAAU;AAC/G,QAAI,UAAU,YAAY,GAAG;AAC3B,cAAQ,cAAc,UAAU;AAChC,cAAQ,QAAQ,UAAU;AAAA,IAC5B;AACA,WAAO;AAAA,EACT;AAAA,EAEA,MAAc,SAAS,KAAa,MAAiD;AACnF,UAAM,WAAW,MAAM,KAAK,QAAQ,KAAK,EAAE,QAAQ,QAAQ,SAAS,EAAE,gBAAgB,mBAAmB,GAAG,MAAM,KAAK,UAAU,IAAI,GAAG,UAAU,QAAQ,CAAC;AAC3J,QAAK,SAA0D,eAAe,QAAQ,SAAS,UAAU,OAAO,SAAS,SAAS,IAAK,OAAM,IAAI,iBAAiB,yBAAyB;AAC3L,QAAI,CAAC,SAAS,GAAI,OAAM,IAAI,iBAAiB,SAAS,WAAW,OAAO,SAAS,WAAW,MAAM,iBAAiB,sBAAsB;AACzI,UAAM,QAAQ,MAAM,SAAS,KAAK;AAClC,QAAI,CAAC,SAAS,OAAO,UAAU,YAAY,MAAM,QAAQ,KAAK,EAAG,OAAM,IAAI,iBAAiB,uBAAuB;AACnH,WAAO;AAAA,EACT;AAAA,EAEQ,cAAc,OAAgB,OAAwC;AAC5E,QAAI,CAAC,SAAS,OAAO,UAAU,YAAY,MAAM,QAAQ,KAAK,EAAG,OAAM,IAAI,iBAAiB,yBAAyB,GAAG,KAAK,aAAa;AAC1I,WAAO;AAAA,EACT;AAAA,EAEQ,eAAe,OAAgC,KAAa,UAA2B;AAC7F,UAAM,SAAS,MAAM,GAAG,KAAK;AAC7B,QAAI,OAAO,WAAW,YAAY,OAAO,WAAW,EAAG,OAAM,IAAI,iBAAiB,yBAAyB,WAAW,GAAG,aAAa;AACtI,WAAO;AAAA,EACT;AAAA,EAEQ,gBAAgB,SAAkC,OAAgB,QAAsB;AAC9F,UAAM,WAAW,KAAK,cAAc,OAAO,OAAO;AAClD,UAAM,aAAa,SAAS,QAAQ,WAAW,OAAO,SAAS,QAAQ,YAAY,OAAO,SAAS,cAAc;AACjH,UAAM,iBAAiB,SAAS,cAAc,aAAa,OAAO,SAAS,cAAc,YAAY,OAAO,SAAS,UAAU;AAC/H,QAAI,CAAC,cAAc,CAAC,eAAgB,OAAM,IAAI,iBAAiB,yBAAyB,uBAAuB;AAC/G,QAAI,WAAY,kBAAiB,UAAU,CAAC,OAAO,OAAO,WAAW,GAAG,YAAY;AACpF,QAAI,eAAgB,kBAAiB,UAAU,CAAC,aAAa,aAAa,OAAO,GAAG,YAAY;AAChG,UAAM,YAAY,aACd,KAAK,QAAQ,mBAAmB,KAAK,CAAC,QAAQ,SAAS,QAAQ,GAAG,GAAG,IAAI,IAAI,MAAM,WAAW,MAAM,CAAC,EAAE,IACvG,KAAK,QAAQ,mBAAmB,KAAK,CAAC,QAAQ,QAAQ,SAAS,SAAS;AAC5E,QAAI,cAAc,OAAW,OAAM,IAAI,iBAAiB,wBAAwB;AAChF,UAAM,UAAU,UAAU,MAAM,WAAW,MAAM;AACjD,QAAI,CAAC,UAAU,WAAW,UAAU,KAAK,CAAC,QAAQ,WAAW,GAAG,EAAG,OAAM,IAAI,iBAAiB,yBAAyB,wBAAwB;AAC/I,QAAI;AACJ,QAAI;AACJ,QAAI;AACF,YAAM,UAAU,UAAU,OAAO,OAAO;AACxC,UAAI,QAAQ,WAAW,MAAM,QAAQ,CAAC,MAAM,OAAQ,QAAQ,CAAC,MAAM,EAAM,OAAM,IAAI,MAAM,KAAK;AAC9F,YAAM,QAAQ,MAAM,CAAC;AACrB,kBAAYF,kBAAkB,aAAa,SAAS,YAAY,SAAS,KAAgB;AAAA,IAC3F,QAAQ;AACN,YAAM,IAAI,iBAAiB,yBAAyB,gCAAgC;AAAA,IACtF;AACA,QAAK,cAAc,SAAS,QAAQ,GAAG,SAAS,IAAI,OAAO,MAAQ,kBAAkB,SAAS,cAAc,aAAc,UAAU,WAAW,GAAI,OAAM,IAAI,iBAAiB,yBAAyB,+BAA+B;AACtO,UAAMC,SAAQ,IAAI,YAAY,EAAE,OAAO,GAAG,MAAM,GAAG,sBAAsB,OAAO,CAAC,EAAE;AACnF,QAAI,CAAC,wBAAQ,OAAO,WAAWA,QAAO,GAAG,EAAG,OAAM,IAAI,iBAAiB,yBAAyB,iCAAiC;AAAA,EACnI;AAAA,EAEQ,8BAA8B,SAA4C,WAA0C;AAC1H,UAAM,SAAS,SAAS,QAAQ,IAAI,IAAI,QAAQ,OAAO;AACvD,eAAW,OAAO,CAAC,YAAY,WAAW,YAAY,iBAAiB,2BAA2B,2BAA2B,aAAa,iBAAiB,uBAAuB,aAAa,gBAAgB,gBAAgB,YAAY,YAAY,UAAU,WAAW,aAAa,WAAW,GAAY;AAC9S,wBAAkB,OAAO,GAAG,GAAG,UAAU,GAAG,GAAG,kBAAkB,GAAG,8BAA8B;AAAA,IACpG;AACA,QAAI,OAAO,UAAU,gBAAgB,YAAY,UAAU,YAAY,WAAW,KAAK,OAAO,UAAU,UAAU,YAAY,UAAU,MAAM,SAAS,GAAI,OAAM,IAAI,iBAAiB,yBAAyB,oCAAoC;AACnP,UAAM,UAAU,OAAO;AACvB,QAAI,OAAO,YAAY,UAAU;AAC/B,YAAM,EAAE,mBAAmB,UAAU,GAAG,KAAK,IAAI;AACjD,wBAAkB,SAAS,gBAAgB,IAAI,GAAG,0CAA0C;AAC5F,wBAAkB,UAAU,mBAAmB,SAAS,4CAA4C;AAAA,IACtG;AACA,QAAI,UAAU,kBAAkB,OAAW,mBAAkB,UAAU,eAAe,SAAS,0CAA0C;AAAA,EAC3I;AAAA,EAEQ,qBAAqB,WAA0C;AACrE,UAAM,YAAY,UAAU,UAAU,sBAAsB,UAAU,SAAS;AAC/E,QAAI,cAAc,UAAa,aAAa,KAAK,IAAI,EAAE,QAAQ,EAAG,OAAM,IAAI,iBAAiB,yBAAyB,kCAAkC;AAAA,EAC1J;AAAA,EAEQ,qBAAqB,SAAkC,UAA2B,SAAkB,WAAoC,gBAA+B;AAC7K,UAAM,gBAAgB,KAAK,cAAc,SAAS,mBAAmB;AACrE,UAAM,uBAAuB,KAAK,cAAc,gBAAgB,iBAAiB;AACjF,UAAM,iBAAiB,SAAS,cAAc,IAAI,IAAI,cAAc,OAAO;AAC3E,UAAM,eAAe,SAAS,qBAAqB,YAAY,IAAI,qBAAqB,eAAe;AACvG,UAAM,YAAY,OAAO,aAAa,cAAc,WAChD,aAAa,YACb,SAAS,aAAa,MAAM,KAAK,OAAO,aAAa,OAAO,QAAQ,WAAW,aAAa,OAAO,MAAM;AAC7G,QAAI,cAAc,OAAW,OAAM,IAAI,iBAAiB,yBAAyB,qCAAqC;AACtH,QAAI,UAAU,YAAY,GAAG;AAC3B,UAAI,QAAQ,YAAY,EAAG,OAAM,IAAI,iBAAiB,yBAAyB,iCAAiC;AAChH,iBAAW,OAAO,CAAC,eAAe,YAAY,WAAW,mBAAmB,iBAAiB,aAAa,4BAA4B,aAAa,gBAAgB,UAAU,WAAW,UAAU,GAAY;AAC5M,0BAAkB,QAAQ,GAAG,GAAG,eAAe,GAAG,KAAK,UAAU,GAAG,GAAG,mBAAmB,GAAG,eAAe;AAAA,MAC9G;AAAA,IACF;AACA,sBAAkB,WAAW,QAAQ,WAAW,sDAAsD;AACtG,QAAI,SAAS,aAAa,aAAa,KAAK,OAAO,aAAa,cAAc,cAAc,SAAU,mBAAkB,aAAa,cAAc,WAAW,QAAQ,WAAW,iDAAiD;AAClO,sBAAkB,aAAa,OAAO,UAAU,OAAO,uDAAuD;AAC9G,sBAAkB,aAAa,aAAa,UAAU,aAAa,0CAA0C;AAC7G,sBAAkB,aAAa,UAAU,UAAU,UAAU,0DAA0D;AACvH,UAAM,mBAAmB,IAAI,IAAI,CAAC,SAAS,QAAQ,KAAK,QAAQ,eAAe,YAAY,EAAE,OAAO,CAAC,UAA2B,UAAU,MAAS,CAAC;AACpJ,QAAI,OAAO,UAAU,aAAa,YAAY,CAAC,iBAAiB,IAAI,UAAU,QAAQ,KAAK,OAAO,aAAa,aAAa,YAAY,CAAC,iBAAiB,IAAI,aAAa,QAAQ,EAAG,OAAM,IAAI,iBAAiB,yBAAyB,gDAAgD;AAC1R,UAAM,gBAAgB,QAAQ,gBAAgB,QAAQ;AACtD,QAAI,kBAAkB,UAAa,kBAAkB,SAAS,OAAQ,OAAM,IAAI,iBAAiB,yBAAyB,+CAA+C;AACzK,QAAI,QAAQ,YAAY,UAAa,QAAQ,YAAY,SAAS,QAAS,OAAM,IAAI,iBAAiB,yBAAyB,8CAA8C;AAC7K,eAAW,OAAO,CAAC,YAAY,WAAW,aAAa,iBAAiB,2BAA2B,gBAAgB,gBAAgB,gBAAgB,YAAY,UAAU,aAAa,WAAW,GAAY;AAC3M,YAAM,eAAe,QAAQ,aAAa,cAAc,eAAe,GAAG,GAAG,SAAS,SAAS,IAAI,IAAI,eAAe,GAAG;AACzH,YAAM,eAAe,QAAQ,aAAa,cAAe,QAAoC,GAAG,GAAG,SAAS,SAAS,IAAI,IAAK,QAAoC,GAAG;AACrK,wBAAkB,cAAc,cAAc,gBAAgB,GAAG,8BAA8B;AAAA,IACjG;AACA,QAAI,QAAQ,aAAa,QAAW;AAClC,YAAM,kBAAkB,cAAc,QAAQ,UAAU,SAAS,SAAS,IAAI;AAC9E,UAAI,oBAAoB,UAAa,eAAe,eAAe,MAAM,eAAe,SAAS,QAAQ,EAAG,OAAM,IAAI,iBAAiB,yBAAyB,iDAAiD;AAAA,IACnN;AACA,QAAI,QAAQ,YAAY,QAAW;AACjC,UAAI,CAAC,MAAM,QAAQ,QAAQ,OAAO,EAAG,OAAM,IAAI,iBAAiB,yBAAyB,kCAAkC;AAC3H,WAAK,oBAAoB,QAAQ,SAAS,SAAS,OAAO;AAAA,IAC5D;AACA,UAAM,gBAAgB,UAAU,QAAQ,SAAS;AACjD,UAAM,iBAAiB,UAAU,SAAS,SAAS;AACnD,UAAM,qBAAqB,UAAU,aAAa,SAAS;AAC3D,QAAI,kBAAkB,UAAa,iBAAiB,KAAK,IAAI,EAAE,QAAQ,KAAK,mBAAmB,UAAa,gBAAgB,kBAAmB,uBAAuB,UAAa,gBAAgB,mBAAqB,OAAM,IAAI,iBAAiB,yBAAyB,gCAAgC;AAC5S,SAAK,mBAAmB,EAAE,GAAG,SAAS,WAAW,OAAO,QAAQ,cAAc,WAAW,QAAQ,YAAY,IAAI,WAAW,OAAO,QAAQ,cAAc,WAAW,QAAQ,YAAY,IAAI,WAAW,QAAQ,UAAoB,GAAG,UAAU,aAAa;AAC7P,sBAAkB,QAAQ,WAAW,eAAe,WAAW,oDAAoD;AACnH,sBAAkB,QAAQ,WAAW,eAAe,WAAW,oDAAoD;AAAA,EACrH;AAAA,EAEQ,cAAc,YAAsH,WAAiD,MAAoB;AAC/M,QAAI,CAAC,sBAAsB,YAAY,gBAAgB,SAAS,GAAG,IAAI,EAAG,OAAM,IAAI,iBAAiB,oBAAoB;AAAA,EAC3H;AAAA,EAEA,MAAc,QAAQ,MAAyC;AAC7D,UAAM,WAAW,cAAc,MAAM,EAAE,gBAAgB,KAAK,QAAQ,gBAAgB,gBAAgB,KAAK,QAAQ,eAAe,CAAC;AACjI,QAAI,SAAS,aAAa,oBAAqB,QAAO,KAAK,iBAAiB,IAAI;AAChF,QAAIA;AACJ,QAAI;AACJ,QAAI,SAAS,SAAS,UAAU;AAC9B,MAAAA,SAAQ,IAAI,YAAY,EAAE,OAAO,KAAK,UAAU,SAAS,QAAQ,CAAC;AAAA,IACpE,OAAO;AACL,UAAI,SAAS,QAAQ,OAAW,OAAM,IAAI,iBAAiB,eAAe;AAC1E,oBAAc,KAAK,MAAM,aAAa,SAAY,SAAY,MAAM,KAAK,MAAM,SAAS,SAAS,KAAK,KAAK,IAAI,CAAC;AAChH,UAAI,gBAAgB,QAAW;AAC7B,YAAI,CAAC,eAAe,SAAS,KAAK,YAAY,KAAK,KAAK,CAAC,KAAK,cAAcC,kBAAiB,YAAY,MAAM,GAAG,YAAY,KAAK,GAAG;AACpI,gBAAM,KAAK,MAAM,OAAO,YAAY,GAAG;AAGvC,UAAAD,SAAQ,MAAM,KAAK,cAAc,SAAS,QAAQ,SAAS,GAAG;AAAA,QAChE,OAAO;AACL,UAAAA,SAAQ,YAAY;AAAA,QACtB;AAAA,MACF,OAAO;AACL,QAAAA,SAAQ,MAAM,KAAK,cAAc,SAAS,QAAQ,SAAS,GAAG;AAAA,MAChE;AAAA,IACF;AACA,QAAI,WAAW,SAAS,YAAY,mBAAmBA,QAAO,EAAE,gBAAgB,SAAS,QAAQ,kBAAkB,KAAK,QAAQ,oBAAoBH,6BAA4B,iBAAiB,KAAK,QAAQ,mBAAmB,2BAA2B,uBAAuB,KAAK,QAAQ,yBAAyB,iCAAiC,CAAC;AAC3V,QAAI,gBAAgB,UAAa,YAAY,IAAI,cAAc,SAAS,SAAS,WAAW;AAC1F,YAAM,KAAK,MAAM,OAAO,YAAY,GAAG;AACvC,MAAAG,SAAQ,MAAM,KAAK,cAAc,SAAS,QAAQ,SAAS,GAAI;AAC/D,iBAAW,mBAAmBA,QAAO,EAAE,gBAAgB,SAAS,QAAQ,kBAAkB,KAAK,QAAQ,oBAAoBH,6BAA4B,iBAAiB,KAAK,QAAQ,mBAAmB,2BAA2B,uBAAuB,KAAK,QAAQ,yBAAyB,iCAAiC,CAAC;AAAA,IACpU;AACA,wBAAoB,SAAS,UAAU,EAAE,gBAAgB,SAAS,QAAQ,iBAAiB,KAAK,QAAQ,iBAAiB,uBAAuB,KAAK,QAAQ,yBAAyB,kCAAkC,KAAK,KAAK,IAAI,GAAG,mBAAmB,KAAK,QAAQ,kBAAkB,CAAC;AAC5R,QAAI,CAAC,SAAS,SAAS,aAAa,SAAS,QAAQ,OAAW,OAAM,IAAI,iBAAiB,kBAAkB;AAC7G,QAAI,SAAS,QAAQ,UAAa,CAAC,eAAe,SAAS,KAAKG,MAAK,GAAG;AACtE,YAAM,KAAK,MAAM,OAAO,EAAE,KAAK,SAAS,KAAK,WAAW,SAAS,SAAS,UAAU,CAAC;AACrF,YAAM,IAAI,iBAAiB,oBAAoB;AAAA,IACjD;AACA,QAAI,SAAS,QAAQ,OAAW,OAAM,KAAK,MAAM,IAAI,EAAE,KAAK,SAAS,KAAK,WAAW,SAAS,SAAS,UAAU,GAAGA,QAAO,EAAE,aAAa,SAAS,SAAS,QAAQ,UAAU,MAAM,SAAS,SAAS,QAAQ,MAAM,WAAW,SAAS,SAAS,UAAU,CAAC;AAC5P,UAAM,iBAAiB,KAAK,cAAc,SAAS,OAAO;AAC1D,UAAM,YAAY,SAAS,SAAS,YAChC,MAAM,uBAAuB,gBAAgB,SAAS,QAAQ,MAAM;AAAE,YAAM,IAAI,iBAAiB,oBAAoB;AAAA,IAAG,GAAG,CAAC,IAC5H;AACJ,QAAI,UAAU,cAAc,KAAK,QAAQ,mBAAmB,2BAA4B,OAAM,IAAI,iBAAiB,iBAAiB;AACpI,WAAO,EAAE,UAAU,UAAU,OAAAA,QAAO,UAAU;AAAA,EAChD;AAAA,EAEA,MAAc,cAAc,QAAgBO,MAAkC;AAC5E,UAAM,MAAM,KAAK,QAAQ,cAAc,EAAE,QAAQ,KAAAA,KAAI,CAAC,KAAK,GAAG,MAAM,MAAMA,IAAG;AAC7E,UAAM,WAAW,MAAM,KAAK,QAAQ,KAAK,EAAE,QAAQ,OAAO,SAAS,EAAE,QAAQ,kEAAkE,GAAG,UAAU,QAAQ,CAAC;AACrK,QAAK,SAA0D,eAAe,QAAQ,SAAS,UAAU,OAAO,SAAS,SAAS,IAAK,OAAM,IAAI,iBAAiB,yBAAyB;AAC3L,QAAI,CAAC,SAAS,GAAI,OAAM,IAAI,iBAAiB,oBAAoB;AACjE,UAAMP,SAAQ,IAAI,WAAW,MAAM,SAAS,YAAY,CAAC;AACzD,QAAIA,OAAM,cAAc,KAAK,QAAQ,oBAAoBH,6BAA6B,OAAM,IAAI,iBAAiB,iBAAiB;AAClI,QAAI,CAAC,eAAeU,MAAKP,MAAK,EAAG,OAAM,IAAI,iBAAiB,oBAAoB;AAChF,WAAOA;AAAA,EACT;AAAA,EAEA,MAAc,iBAAiB,MAAyC;AACtE,UAAM,YAAY,wBAAwB,MAAM,EAAE,gBAAgB,KAAK,QAAQ,gBAAgB,gBAAgB,KAAK,QAAQ,eAAe,CAAC;AAC5I,QAAI,SAAS,UAAU;AACvB,QAAI;AACJ,QAAI,WAAW,UAAa,KAAK,MAAM,aAAa,QAAW;AAC7D,eAAS,MAAM,KAAK,MAAM,SAAS,UAAU,KAAK,KAAK,IAAI,CAAC;AAC5D,UAAI,WAAW,UAAa,wBAAwB,UAAU,KAAK,OAAO,KAAK,KAAK,KAAK,cAAcC,kBAAiB,OAAO,MAAM,GAAG,OAAO,KAAK,EAAG,UAAS,OAAO;AAAA,eAC9J,WAAW,OAAW,OAAM,KAAK,MAAM,OAAO,OAAO,GAAG;AAAA,IACnE;AACA,QAAI,WAAW,QAAW;AACxB,YAAM,MAAM,KAAK,QAAQ,cAAc,EAAE,QAAQ,UAAU,QAAQ,KAAK,UAAU,IAAI,CAAC,KAAK,GAAG,UAAU,MAAM,MAAM,UAAU,GAAG;AAClI,YAAM,WAAW,MAAM,KAAK,QAAQ,KAAK,EAAE,QAAQ,OAAO,SAAS,EAAE,QAAQ,kEAAkE,GAAG,UAAU,QAAQ,CAAC;AACrK,UAAK,SAA0D,eAAe,QAAQ,SAAS,UAAU,OAAO,SAAS,SAAS,IAAK,OAAM,IAAI,iBAAiB,yBAAyB;AAC3L,UAAI,CAAC,SAAS,GAAI,OAAM,IAAI,iBAAiB,oBAAoB;AACjE,eAAS,IAAI,WAAW,MAAM,SAAS,YAAY,CAAC;AAAA,IACtD;AACA,QAAI,OAAO,cAAc,KAAK,QAAQ,yBAAyB,kCAAmC,OAAM,IAAI,iBAAiB,iBAAiB;AAC9I,QAAI,CAAC,wBAAwB,UAAU,KAAK,MAAM,EAAG,OAAM,IAAI,iBAAiB,oBAAoB;AACpG,UAAM,gBAAgB,UAAU,QAAQ,SAAY,SAAS,MAAM,uBAAuB,QAAQ,UAAU,GAAG;AAC/G,QAAI,YAAY,IAAI,WAAW;AAI/B,QAAI;AACJ,QAAI;AACF,oBAAc,4BAA4B,eAAe,EAAE,gBAAgB,UAAU,QAAQ,KAAK,KAAK,IAAI,GAAG,WAAW,mBAAmB,KAAK,QAAQ,kBAAkB,CAAC;AAAA,IAC9K,SAAS,OAAO;AACd,UAAI,EAAE,iBAAiB,UAAU,EAAE,UAAU,UAAW,MAAsC,SAAS,mBAAoB,OAAM;AACjI,YAAM,SAAS,kCAAkC,eAAe,EAAE,gBAAgB,UAAU,QAAQ,KAAK,KAAK,IAAI,GAAG,WAAW,mBAAmB,KAAK,QAAQ,kBAAkB,CAAC;AACnL,UAAI,KAAK,MAAM,aAAa,OAAW,OAAM,KAAK,MAAM,IAAI,EAAE,KAAK,UAAU,KAAK,WAAW,OAAO,SAAS,SAAS,UAAU,GAAG,QAAQ,EAAE,aAAa,OAAO,SAAS,SAAS,QAAQ,UAAU,MAAM,OAAO,YAAY,WAAW,KAAK,CAAC;AAC/O,YAAMO,YAA8B,EAAE,MAAM,UAAU,WAAW,SAAY,YAAY,UAAU,QAAQ,UAAU,QAAQ,KAAK,UAAU,KAAK,KAAK,GAAG,UAAU,MAAM,MAAM,UAAU,GAAG,QAAQ,UAAU,oBAAoB;AAClO,aAAO,EAAE,UAAAA,WAAU,UAAU,OAAO,UAAU,OAAO,QAAQ,UAAU;AAAA,IACzE;AACA,UAAM,UAAU,YAAY,SAAS;AACrC,QAAI,YAAY,QAAW;AACzB,YAAM,aAAa,KAAK,QAAQ,cAAc,EAAE,QAAQ,UAAU,QAAQ,KAAK,QAAQ,IAAI,CAAC,KAAK,GAAG,UAAU,MAAM,MAAM,QAAQ,GAAG;AACrI,YAAM,kBAAkB,MAAM,KAAK,QAAQ,YAAY,EAAE,QAAQ,OAAO,SAAS,EAAE,QAAQ,2BAA2B,GAAG,UAAU,QAAQ,CAAC;AAC5I,UAAK,gBAAiE,eAAe,QAAQ,gBAAgB,UAAU,OAAO,gBAAgB,SAAS,IAAK,OAAM,IAAI,iBAAiB,yBAAyB;AAChN,UAAI,CAAC,gBAAgB,GAAI,OAAM,IAAI,iBAAiB,oBAAoB;AACxE,YAAM,gBAAgB,IAAI,WAAW,MAAM,gBAAgB,YAAY,CAAC;AACxE,UAAI,cAAc,cAAc,KAAK,QAAQ,yBAAyB,kCAAmC,OAAM,IAAI,iBAAiB,iBAAiB;AACrJ,UAAI,CAAC,wBAAwB,QAAQ,KAAK,aAAa,EAAG,OAAM,IAAI,iBAAiB,oBAAoB;AACzG,kBAAY,IAAI,WAAW,MAAM,uBAAuB,eAAe,KAAK,cAAc,QAAQ,GAAG,CAAC,CAAC;AAAA,IACzG;AACA,UAAM,WAAW,4BAA4B,eAAe,EAAE,gBAAgB,UAAU,QAAQ,KAAK,KAAK,IAAI,GAAG,WAAW,mBAAmB,KAAK,QAAQ,kBAAkB,CAAC,EAAE;AACjL,QAAI,KAAK,MAAM,aAAa,OAAW,OAAM,KAAK,MAAM,IAAI,EAAE,KAAK,UAAU,KAAK,WAAW,SAAS,SAAS,UAAU,GAAG,QAAQ,EAAE,aAAa,SAAS,SAAS,QAAQ,UAAU,MAAM,OAAO,YAAY,WAAW,KAAK,CAAC;AACjO,UAAM,WAA8B,EAAE,MAAM,UAAU,WAAW,SAAY,YAAY,UAAU,QAAQ,UAAU,QAAQ,KAAK,UAAU,KAAK,KAAK,GAAG,UAAU,MAAM,MAAM,UAAU,GAAG,QAAQ,UAAU,oBAAoB;AAClO,WAAO,EAAE,UAAU,UAAU,OAAO,QAAQ,UAAU;AAAA,EACxD;AAAA,EAEQ,cAAc,OAA2B;AAC/C,UAAM,aAAa,MAAM,QAAQ,MAAM,GAAG,EAAE,QAAQ,MAAM,GAAG,IAAI,IAAI,QAAQ,IAAI,MAAM,SAAS,KAAK,CAAC;AACtG,QAAI,OAAO,SAAS,WAAY,QAAO,WAAW,KAAK,KAAK,UAAU,GAAG,CAAC,SAAS,KAAK,WAAW,CAAC,CAAC;AACrG,WAAO,IAAI,WAAW,OAAO,KAAK,YAAY,QAAQ,CAAC;AAAA,EACzD;AACF;;;ADhrCA,SAAS,gCACP,SACoB;AACpB,MAAI;AACJ,aAAW,UAAU,SAAS;AAC5B,UAAM,QAAQ,OAAO,QAAQ,GAAG;AAChC,QAAI,UAAU,GAAI,QAAO;AACzB,UAAM,cAAc,OAAO,MAAM,GAAG,KAAK;AACzC,UAAM,YAAY,sBAAsB,WAAW;AACnD,QAAI,cAAc,OAAW,QAAO;AACpC,QAAI,UAAU,QAAW;AACvB,cAAQ;AAAA,IACV,WAAW,UAAU,WAAW;AAC9B,aAAO;AAAA,IACT;AAAA,EACF;AACA,SAAO;AACT;AASA,IAAM,uBAAuB,CAAC,oBAAoB,uBAAuB;AAMzE,IAAM,oBAAoB,OAAO;AAKjC,IAAM,gBAAgB;AAStB,SAASC,aACPC,OACA,SACA,OACA,MACiB;AACjB,SAAO;AAAA,IACL,MAAAA;AAAA,IACA;AAAA,IACA,SAAS;AAAA,IACT;AAAA,IACA;AAAA,EACF;AACF;AAWA,SAAS,2BAA2B,KAA+B;AACjE,QAAM,QAAQ,eAAe,QAAQ,MAAM;AAC3C,QAAMA,QACJ,OAAO,OAAO,QAAQ,YAAY,UAAU,MACxC,OAAQ,IAA2B,QAAQ,EAAE,IAC7C;AACN,QAAMC,QAAO,eAAe,QAAQ,IAAI,OAAO;AAC/C,QAAM,UAAU,eAAe,QAAQ,IAAI,UAAU,OAAO,OAAO,EAAE;AAErE,QAAM,UACJD,UAAS,qBAAqB,WAC9BC,UAAS,gBACT,2CAA2C,KAAK,OAAO;AACzD,MAAI,SAAS;AACX,WAAOF;AAAA,MACL,qBAAqB;AAAA,MACrB;AAAA,MAEA;AAAA,IACF;AAAA,EACF;AAEA,QAAM,WACJC,UAAS,qBAAqB,WAC9BC,UAAS,kBACT,qBAAqB,KAAK,OAAO;AACnC,MAAI,UAAU;AACZ,WAAOF;AAAA,MACL,qBAAqB;AAAA,MACrB;AAAA,MAIA;AAAA,IACF;AAAA,EACF;AAEA,SAAOA;AAAA,IACL,qBAAqB;AAAA,IACrB;AAAA,IACA;AAAA,EACF;AACF;AAKA,SAAS,gBAAgB,MAAsB;AAE7C,MAAIG;AACJ,MAAI,OAAO,SAAS,aAAa;AAC/B,IAAAA,UAAS,KAAK,SAAS,mBAAmB,IAAI,CAAC,CAAC;AAAA,EAClD,WAAW,OAAO,WAAW,aAAa;AACxC,IAAAA,UAAS,OAAO,KAAK,MAAM,OAAO,EAAE,SAAS,QAAQ;AAAA,EACvD,OAAO;AACL,UAAM,IAAI,MAAM,8BAA8B;AAAA,EAChD;AAEA,SAAOA,QAAO,QAAQ,OAAO,GAAG,EAAE,QAAQ,OAAO,GAAG,EAAE,QAAQ,OAAO,EAAE;AACzE;AAKA,SAAS,gBAAgB,SAAyB;AAEhD,MAAIA,UAAS,QAAQ,QAAQ,MAAM,GAAG,EAAE,QAAQ,MAAM,GAAG;AAEzD,SAAOA,QAAO,SAAS,GAAG;AACxB,IAAAA,WAAU;AAAA,EACZ;AAEA,MAAI,OAAO,SAAS,aAAa;AAC/B,WAAO,mBAAmB,OAAO,KAAKA,OAAM,CAAC,CAAC;AAAA,EAChD,WAAW,OAAO,WAAW,aAAa;AACxC,WAAO,OAAO,KAAKA,SAAQ,QAAQ,EAAE,SAAS,OAAO;AAAA,EACvD,OAAO;AACL,UAAM,IAAI,MAAM,8BAA8B;AAAA,EAChD;AACF;AAgSO,IAAM,iBAAN,MAAgD;AAAA;AAAA;AAAA;AAAA,EAqBrD,YAAY,QAA8B;AACxC,SAAK,QAAQ,OAAO;AACpB,SAAK,UAAU,OAAO;AACtB,SAAK,SAAS,OAAO;AACrB,SAAK,UAAU,OAAO,SAAS,WAAW,MAAM,KAAK,UAAU;AAC/D,SAAK,cAAc,OAAO;AAC1B,SAAK,WAAW,OAAO;AACvB,SAAK,oBAAoB,OAAO;AAChC,SAAK,kBAAkB,OAAO;AAC9B,SAAK,WAAW,OAAO,WAAW,IAAI,QAAQ,OAAO,EAAE;AACvD,SAAK,qBAAqB,OAAO;AACjC,SAAK,yBAAyB,OAAO;AACrC,SAAK,eAAe,OAAO;AAC3B,SAAK,aAAa,OAAO,cAAc;AACvC,SAAK,gBAAgB,OAAO;AAC5B,SAAK,yBAAyB,OAAO;AACrC,SAAK,iBAAiB,OAAO;AAAA,EAC/B;AAAA;AAAA;AAAA;AAAA,EAKA,IAAY,OAAe;AACzB,WAAO,KAAK,MAAM,CAAC;AAAA,EACrB;AAAA;AAAA;AAAA;AAAA,EAKO,cAAc,SAA+B;AAClD,SAAK,iBAAiB;AACtB,SAAK,UAAU;AAAA,EACjB;AAAA;AAAA;AAAA;AAAA;AAAA,EAMO,aAAa,QAAgM;AAClN,SAAK,iBAAiB;AACtB,QAAI,OAAO,YAAY,QAAW;AAChC,WAAK,UAAU,OAAO;AAAA,IACxB;AACA,QAAI,OAAO,sBAAsB,QAAW;AAC1C,WAAK,oBAAoB,OAAO;AAAA,IAClC;AACA,QAAI,OAAO,qBAAqB,QAAW;AACzC,WAAK,qBAAqB,OAAO;AAAA,IACnC;AACA,QAAI,OAAO,yBAAyB,QAAW;AAC7C,WAAK,yBAAyB,OAAO;AAAA,IACvC;AACA,QAAI,OAAO,kBAAkB,QAAW;AACtC,WAAK,gBAAgB,OAAO;AAAA,IAC9B;AACA,QAAI,OAAO,2BAA2B,QAAW;AAC/C,WAAK,yBAAyB,OAAO;AAAA,IACvC;AACA,QAAI,OAAO,iBAAiB,QAAW;AACrC,WAAK,iBAAiB,OAAO;AAAA,IAC/B;AAAA,EACF;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAYA,MAAM,SAAS,QAA0E;AACvF,UAAM,cAAc,KAAK,kBAAkB;AAC3C,QAAI,YAAa,QAAO,EAAE,IAAI,OAAO,OAAO,YAAY;AAGxD,QAAI,CAAC,KAAK,SAAS;AACjB,aAAO;AAAA,QACL,IAAI;AAAA,QACJ,OAAOH;AAAA,UACL,qBAAqB;AAAA,UACrB;AAAA,QACF;AAAA,MACF;AAAA,IACF;AAGA,QAAI,CAAC,KAAK,0BAA0B,CAAC,KAAK,sBAAsB,CAAC,KAAK,mBAAmB;AACvF,aAAO;AAAA,QACL,IAAI;AAAA,QACJ,OAAOA;AAAA,UACL,qBAAqB;AAAA,UACrB;AAAA,QACF;AAAA,MACF;AAAA,IACF;AAGA,QAAI,CAAC,OAAO,MAAM;AAChB,aAAO;AAAA,QACL,IAAI;AAAA,QACJ,OAAOA;AAAA,UACL,qBAAqB;AAAA,UACrB;AAAA,QACF;AAAA,MACF;AAAA,IACF;AAEA,UAAM,UAAU,OAAO,WAAW;AAClC,UAAM,kBAAkB,OAAO,UAAU,IAAI,KAAK,KAAK,IAAI,IAAI,iBAAiB;AAChF,QAAI,SAAS;AAEb,UAAM,SAAsB,OAAO,UAAU;AAI7C,UAAM,WAAW,KAAK,aAClB,GAAG,KAAK,UAAU,IAAI,OAAO,IAAI,GAAG,QAAQ,QAAQ,GAAG,IACvD,OAAO;AAGX,QAAI,WAAW,UAAU;AACvB,aAAO;AAAA,QACL,IAAI;AAAA,QACJ,OAAOA;AAAA,UACL,qBAAqB;AAAA,UACrB,WAAW,MAAM;AAAA,QACnB;AAAA,MACF;AAAA,IACF;AAIA,QAAI;AACJ,QAAI;AACJ,QAAI;AAEJ,QAAI;AACF,YAAM,eAAe,SAAS,KAAK,IAAI,CAAC,IAAI,KAAK,OAAO,EAAE,SAAS,EAAE,EAAE,UAAU,GAAG,EAAE,CAAC;AACvF,cAAQ,MAAM,KAAK,YAAY,iBAAiB,YAAY;AAC5D,YAAM,yBAAyB,KAAK,kBAAkB;AACtD,UAAI,uBAAwB,QAAO,EAAE,IAAI,OAAO,OAAO,uBAAuB;AAC9E,eAAS,MAAM,KAAK,YAAY,OAAO,KAAK;AAC5C,YAAM,oBAAoB,KAAK,kBAAkB;AACjD,UAAI,kBAAmB,QAAO,EAAE,IAAI,OAAO,OAAO,kBAAkB;AACpE,eAAS,KAAK,YAAY,OAAO,KAAK;AAGtC,UAAI,CAAC,OAAO,GAAG;AACb,eAAO;AAAA,UACL,IAAI;AAAA,UACJ,OAAOA;AAAA,YACL,qBAAqB;AAAA,YACrB;AAAA,UACF;AAAA,QACF;AAAA,MACF;AAAA,IACF,SAAS,KAAK;AACZ,aAAO;AAAA,QACL,IAAI;AAAA,QACJ,OAAOA;AAAA,UACL,qBAAqB;AAAA,UACrB,6CAA6C,eAAe,QAAQ,IAAI,UAAU,OAAO,GAAG,CAAC;AAAA,UAC7F,eAAe,QAAQ,MAAM;AAAA,QAC/B;AAAA,MACF;AAAA,IACF;AAIA,QAAI;AAGJ,UAAM,WAAW,OAAO,MAAM,GAAG,EAAE,CAAC;AAGpC,UAAM,yBAAyB,CAC7B,WACuD;AACvD,UAAI,UAAU,OAAO,WAAW,YAAY,QAAQ,QAAQ;AAC1D,eAAO;AAAA,MACT;AACA,aAAO;AAAA,IACT;AAOA,UAAM,yBAAyB,KAAK;AAAA,MAClC;AAAA,MACA;AAAA,MACA;AAAA,IACF;AAEA,QAAI,wBAAwB;AAE1B,YAAM,mBAAmB,MAAM,KAAK,wBAAwB,UAAU,UAAU,SAAS,MAAM;AAC/F,YAAM,6BAA6B,KAAK,kBAAkB;AAC1D,UAAI,2BAA4B,QAAO,EAAE,IAAI,OAAO,OAAO,2BAA2B;AACtF,YAAM,SAAS,uBAAuB,gBAAgB;AACtD,UAAI,QAAQ,UAAU,OAAO,OAAO,OAAO;AACzC,eAAO;AAAA,MACT;AACA,mBAAa;AAAA,IACf,WAAW,KAAK,wBAAwB;AAEtC,UAAI;AACF,cAAM,iBAAiB,MAAM,KAAK,uBAAuB;AAAA,UACvD,aAAa;AAAA,UACb,SAAS,KAAK,QAAQ;AAAA,UACtB,MAAM;AAAA,UACN;AAAA,UACA;AAAA,QACF,CAAC;AACD,cAAM,4BAA4B,KAAK,kBAAkB;AACzD,YAAI,0BAA2B,QAAO,EAAE,IAAI,OAAO,OAAO,0BAA0B;AAEpF,YAAI,gBAAgB;AAClB,uBAAa;AACb,mBAAS;AAAA,QACX,OAAO;AACL,iBAAO;AAAA,YACL,IAAI;AAAA,YACJ,OAAOA;AAAA,cACL,qBAAqB;AAAA,cACrB;AAAA,YACF;AAAA,UACF;AAAA,QACF;AAAA,MACF,SAAS,KAAK;AAKZ,eAAO,EAAE,IAAI,OAAO,OAAO,2BAA2B,GAAG,EAAE;AAAA,MAC7D;AAAA,IACF,OAAO;AACL,aAAO;AAAA,QACL,IAAI;AAAA,QACJ,OAAOA;AAAA,UACL,qBAAqB;AAAA,UACrB;AAAA,QACF;AAAA,MACF;AAAA,IACF;AAEA,UAAM,mBAAmB,KAAK,kBAAkB;AAChD,QAAI,iBAAkB,QAAO,EAAE,IAAI,OAAO,OAAO,iBAAiB;AAGlE,UAAM,YAA8B;AAAA,MAClC,KAAK;AAAA,MACL;AAAA,MACA;AAAA,MACA,MAAM;AAAA,MACN,MAAM,KAAK;AAAA,MACX,SAAS,KAAK,QAAQ;AAAA,MACtB,SAAS;AAAA,IACX;AAGA,UAAM,cAAc,KAAK,WAAW,WAAW,MAAM;AAGrD,UAAM,UAAU,OAAO,WAAW,KAAK;AACvC,UAAM,MAAM,UAAU,GAAG,OAAO,UAAU,WAAW,KAAK;AAE1D,UAAM,YAAuB;AAAA,MAC3B,OAAO;AAAA,MACP;AAAA,MACA;AAAA,MACA;AAAA,MACA,WAAW;AAAA,MACX,aAAa,OAAO;AAAA,IACtB;AAEA,WAAO,EAAE,IAAI,MAAM,MAAM,UAAU;AAAA,EACrC;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAWQ,6BACN,MACA,SACA,iBACS;AAET,UAAM,UAAU,KAAK,SAAS,WAAW;AACzC,eAAW,OAAO,SAAS;AACzB,YAAM,cAAc,KAAK,SAAS,qBAAqB,IAAI,EAAE;AAC7D,iBAAW,cAAc,aAAa;AAIpC,YAAI,WAAW,YAAY,KAAK,SAAS,SAAS;AAChD;AAAA,QACF;AAKA,aAAK,WAAW,SAAS,UAAU,KAAK,GAAG;AACzC;AAAA,QACF;AAGA,YAAI,CAAC,KAAK,SAAS,kBAAkB,UAAU,GAAG;AAChD;AAAA,QACF;AAGA,YAAI,WAAW,SAAS,iBAAiB;AACvC;AAAA,QACF;AAGA,YAAI,WAAW,uBAAuB,OAAO;AAC3C;AAAA,QACF;AAGA,cAAM,iBAAiB,WAAW,QAAQ;AAC1C,YAAI,CAAC,KAAK,YAAY,gBAAgB,IAAI,GAAG;AAC3C;AAAA,QACF;AAGA,cAAM,oBAAoB,WAAW,WAAW,CAAC;AACjD,cAAM,gBAAgB,QAAQ;AAAA,UAAM,YAClC,kBAAkB,SAAS,MAAM,KAAK,kBAAkB,SAAS,GAAG;AAAA,QACtE;AACA,YAAI,CAAC,eAAe;AAClB;AAAA,QACF;AAGA,eAAO;AAAA,MACT;AAAA,IACF;AAEA,WAAO;AAAA,EACT;AAAA,EAEQ,oBAAiD;AACvD,QAAI;AACF,WAAK,iBAAiB;AACtB,aAAO;AAAA,IACT,SAAS,KAAK;AACZ,aAAOA;AAAA,QACL,qBAAqB;AAAA,QACrB;AAAA,QACA,eAAe,QAAQ,MAAM;AAAA,MAC/B;AAAA,IACF;AAAA,EACF;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAUQ,YAAY,gBAAwB,eAAgC;AAE1E,QAAI,mBAAmB,MAAM,mBAAmB,KAAK;AACnD,aAAO;AAAA,IACT;AAGA,QAAI,mBAAmB,eAAe;AACpC,aAAO;AAAA,IACT;AAGA,UAAM,uBAAuB,eAAe,QAAQ,OAAO,EAAE;AAC7D,UAAM,oBAAoB,cAAc,QAAQ,OAAO,EAAE;AAEzD,QAAI,kBAAkB,WAAW,uBAAuB,GAAG,GAAG;AAC5D,aAAO;AAAA,IACT;AAEA,WAAO;AAAA,EACT;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAOA,MAAc,wBACZ,aACA,MACA,SACA,QACsD;AACtD,UAAM,cAAc,KAAK,kBAAkB;AAC3C,QAAI,YAAa,QAAO,EAAE,IAAI,OAAO,OAAO,YAAY;AAExD,QAAI,CAAC,KAAK,SAAS;AACjB,aAAO;AAAA,QACL,IAAI;AAAA,QACJ,OAAOA;AAAA,UACL,qBAAqB;AAAA,UACrB;AAAA,QACF;AAAA,MACF;AAAA,IACF;AAEA,QAAI,KAAK,wBAAwB;AAc/B,UAAI;AACF,YAAI,QAAQ,WAAW,GAAG;AACxB,iBAAO;AAAA,YACL,IAAI;AAAA,YACJ,OAAOA;AAAA,cACL,qBAAqB;AAAA,cACrB;AAAA,YACF;AAAA,UACF;AAAA,QACF;AACA,cAAM,eAAe,gCAAgC,OAAO;AAC5D,YAAI,iBAAiB,QAAW;AAC9B,iBAAO;AAAA,YACL,IAAI;AAAA,YACJ,OAAOA;AAAA,cACL,qBAAqB;AAAA,cACrB,uDAAuD,KAAK,UAAU,OAAO,CAAC;AAAA,YAChF;AAAA,UACF;AAAA,QACF;AAEA,cAAM,aAAa,KAAK,uBAAuB;AAAA,UAC7C,SAAS,KAAK;AAAA,UACd;AAAA,UACA,SAAS,KAAK,QAAQ;AAAA,UACtB,WAAW;AAAA,YACT,CAAC,YAAY,GAAG;AAAA,cACd,CAAC,IAAI,GAAG,CAAC,GAAG,OAAO;AAAA,YACrB;AAAA,UACF;AAAA,UACA,gBAAgB,KAAK,MAAM,OAAO,QAAQ,IAAI,GAAI;AAAA,QACpD,CAAC;AACD,cAAM,0BAA0B,KAAK,kBAAkB;AACvD,YAAI,wBAAyB,QAAO,EAAE,IAAI,OAAO,OAAO,wBAAwB;AAGhF,cAAM,cAAc,MAAM,KAAK,QAAQ,GAAG,KAAK,IAAI,aAAa;AAAA,UAC9D,QAAQ;AAAA,UACR,SAAS;AAAA,YACP,eAAe,WAAW;AAAA,UAC5B;AAAA,QACF,CAAC;AACD,cAAM,0BAA0B,KAAK,kBAAkB;AACvD,YAAI,wBAAyB,QAAO,EAAE,IAAI,OAAO,OAAO,wBAAwB;AAEhF,YAAI,CAAC,YAAY,IAAI;AACnB,gBAAM,YAAY,MAAM,YAAY,KAAK;AACzC,gBAAM,8BAA8B,KAAK,kBAAkB;AAC3D,cAAI,4BAA6B,QAAO,EAAE,IAAI,OAAO,OAAO,4BAA4B;AACxF,iBAAO;AAAA,YACL,IAAI;AAAA,YACJ,OAAOA;AAAA,cACL,qBAAqB;AAAA,cACrB,8CAA8C,YAAY,MAAM,IAAI,SAAS;AAAA,YAC/E;AAAA,UACF;AAAA,QACF;AAOA,YAAI,WAAW,UAAU,WAAW,GAAG;AACrC,iBAAO;AAAA,YACL,IAAI;AAAA,YACJ,OAAOA;AAAA,cACL,qBAAqB;AAAA,cACrB;AAAA,YACF;AAAA,UACF;AAAA,QACF;AACA,cAAM,UAAU,WAAW,UAAU,CAAC;AACtC,eAAO;AAAA,UACL,KAAK,WAAW;AAAA,UAChB,aAAa,WAAW;AAAA,UACxB,SAAS,KAAK,QAAQ;AAAA,UACtB,MAAM,QAAQ;AAAA,UACd,SAAS,QAAQ;AAAA,UACjB,QAAQ,WAAW;AAAA,UACnB,WAAW;AAAA,UACX,YAAY,WAAW;AAAA,UACvB,oBAAoB;AAAA,UACpB,WAAW,oBAAI,KAAK;AAAA,QACtB;AAAA,MACF,SAAS,KAAK;AACZ,eAAO;AAAA,UACL,IAAI;AAAA,UACJ,OAAOA;AAAA,YACL,qBAAqB;AAAA,YACrB,yCAAyC,eAAe,QAAQ,IAAI,UAAU,OAAO,GAAG,CAAC;AAAA,YACzF,eAAe,QAAQ,MAAM;AAAA,UAC/B;AAAA,QACF;AAAA,MACF;AAAA,IACF,OAAO;AAEL,YAAM,mBAA2C;AAAA,QAC/C;AAAA,QACA;AAAA,QACA;AAAA,QACA;AAAA,QACA,sBAAsB;AAAA,MACxB;AAEA,YAAM,mBAAmB,KAAK,qBAC1B,MAAM,KAAK,mBAAmB,gBAAgB,IAC9C,MAAM,KAAK,kBAAmB,OAAO,gBAAgB;AACzD,YAAM,gCAAgC,KAAK,kBAAkB;AAC7D,UAAI,8BAA+B,QAAO,EAAE,IAAI,OAAO,OAAO,8BAA8B;AAE5F,UAAI,CAAC,iBAAiB,IAAI;AACxB,eAAO;AAAA,UACL,IAAI;AAAA,UACJ,OAAOA;AAAA,YACL,qBAAqB;AAAA,YACrB,0CAA0C,iBAAiB,MAAM,OAAO;AAAA,YACxE,iBAAiB,MAAM;AAAA,YACvB,iBAAiB,MAAM;AAAA,UACzB;AAAA,QACF;AAAA,MACF;AAEA,aAAO,iBAAiB;AAAA,IAC1B;AAAA,EACF;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAaA,MAAM,QACJ,MACA,UAA0B,CAAC,GACoB;AAC/C,UAAM,cAAc,KAAK,kBAAkB;AAC3C,QAAI,YAAa,QAAO,EAAE,IAAI,OAAO,OAAO,YAAY;AAExD,UAAM;AAAA,MACJ,kBAAkB;AAAA,MAClB,gBAAgB;AAAA,MAChB;AAAA,IACF,IAAI;AAGJ,UAAM,eAAe,KAAK,yBAAyB,IAAI;AACvD,QAAI,CAAC,aAAa,IAAI;AACpB,aAAO;AAAA,IACT;AACA,UAAM,YAAY,aAAa;AAM/B,UAAM,mBAAmB,IAAI,KAAK,UAAU,WAAW,MAAM;AAC7D,QAAI,mBAAmB,oBAAI,KAAK,GAAG;AACjC,aAAO;AAAA,QACL,IAAI;AAAA,QACJ,OAAOA;AAAA,UACL,qBAAqB;AAAA,UACrB;AAAA,QACF;AAAA,MACF;AAAA,IACF;AAGA,QAAI,UAAU,WAAW,WAAW;AAClC,aAAO;AAAA,QACL,IAAI;AAAA,QACJ,OAAOA;AAAA,UACL,qBAAqB;AAAA,UACrB;AAAA,QACF;AAAA,MACF;AAAA,IACF;AAGA,UAAM,UAAmB;AAAA,MACvB,IAAI,YAAY,UAAU,MAAM;AAAA,MAChC,KAAK,UAAU;AAAA,MACf,MAAM;AAAA,MACN,KAAK,UAAU;AAAA,MACf,UAAU;AAAA;AAAA,IACZ;AAEA,SAAK,SAAS,UAAU,SAAS,UAAU,YAAY,aAAa;AAGpE,QAAI,mBAAmB,UAAU;AACjC,QAAI,YAAY;AAGhB,QAAI,mBAAmB,iBAAiB,KAAK,SAAS;AACpD,YAAM,QAAQ,MAAM,KAAK,sBAAsB,MAAM;AAAA,QACnD,aAAa,KAAK,QAAQ;AAAA,QAC1B,cAAc,UAAU;AAAA,MAC1B,CAAC;AACD,UAAI,CAAC,MAAM,GAAI,QAAO;AACtB,yBAAmB,MAAM,KAAK;AAC9B,kBAAY;AAAA,QACV,IAAI,WAAW,aAAa,KAAK,QAAQ,kBAAkB,CAAC;AAAA,QAC5D,KAAK,KAAK,QAAQ;AAAA,QAClB,MAAM;AAAA,QACN,UAAU;AAAA,MACZ;AAAA,IACF;AAKA,UAAM,wBAAyB,iBAE5B,kBAAkB;AACrB,UAAM,aAAa,yBAAyB,iBAAiB,cAAc,UAAU,iBAAiB,GAAG;AACzG,UAAM,gBAAgB,UAAU,SAAS,aAAa,KAAK,UACvD,KAAK,UACL;AACJ,UAAM,eAA+B;AAAA,MACnC,kBAAkB,EAAE,eAAe,WAAW;AAAA,MAC9C,eAAe,iBAAiB;AAAA,MAChC,SAAS,UAAU;AAAA,MACnB,oBAAoB,eAAe,sBAAsB,UAAU;AAAA,MACnE,KAAK,eAAe,OAAO,UAAU;AAAA,IACvC;AAEA,UAAM,YAAY,KAAK,gBAAgB;AAAA,MACrC,OAAO,CAAC,UAAU,IAAI;AAAA,MACtB,SAAS;AAAA,MACT,QAAQ,KAAK;AAAA,MACb,OAAO,KAAK;AAAA,MACZ,YAAY,UAAU;AAAA,IACxB,CAAC;AAED,UAAM,cAA2B;AAAA,MAC/B,YAAY;AAAA,MACZ,KAAK;AAAA,MACL,IAAI;AAAA,MACJ,SAAS,UAAU;AAAA,MACnB,MAAM,UAAU;AAAA,IAClB;AAEA,WAAO,EAAE,IAAI,MAAM,MAAM,YAAY;AAAA,EACvC;AAAA,EAEA,MAAM,UACJ,MACA,UAAwG,CAAC,GACjF;AACxB,UAAM,SAAS,IAAI,qBAAqB;AAAA,MACtC,GAAG;AAAA,MACH,gBAAgB,KAAK;AAAA,MACrB,OAAO,KAAK;AAAA,MACZ,QAAQ,KAAK;AAAA,MACb,iBAAiB,KAAK;AAAA,IACxB,CAAC;AACD,WAAO,OAAO,KAAK,IAAI;AAAA,EACzB;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAWA,MAAM,sBACJ,MACA,QACwD;AACxD,UAAM,cAAc,KAAK,kBAAkB;AAC3C,QAAI,YAAa,QAAO,EAAE,IAAI,OAAO,OAAO,YAAY;AAExD,UAAM,UAAU,KAAK,yBAAyB,IAAI;AAClD,QAAI,CAAC,QAAQ,GAAI,QAAO;AACxB,UAAM,YAAY,QAAQ;AAC1B,SAAK,mCAAmC,UAAU,UAAU;AAE5D,UAAM,eAAe,IAAI,KAAK,UAAU,WAAW,MAAM;AACzD,UAAM,MAAM,oBAAI,KAAK;AACrB,QAAI,gBAAgB,KAAK;AACvB,aAAO;AAAA,QACL,IAAI;AAAA,QACJ,OAAOA,aAAY,qBAAqB,cAAc,0BAA0B;AAAA,MAClF;AAAA,IACF;AACA,QAAI,UAAU,WAAW,WAAW;AAClC,aAAO;AAAA,QACL,IAAI;AAAA,QACJ,OAAOA,aAAY,qBAAqB,SAAS,+BAA+B;AAAA,MAClF;AAAA,IACF;AACA,QAAI,UAAU,WAAW,uBAAuB,OAAO;AACrD,aAAO;AAAA,QACL,IAAI;AAAA,QACJ,OAAOA;AAAA,UACL,qBAAqB;AAAA,UACrB;AAAA,QACF;AAAA,MACF;AAAA,IACF;AACA,UAAM,cAAc,aAAa,OAAO,aAAa,KAAK,KAAK,EAAE;AACjE,QAAI,CAAC,2BAA2B,KAAK,WAAW,GAAG;AACjD,aAAO;AAAA,QACL,IAAI;AAAA,QACJ,OAAOA,aAAY,qBAAqB,eAAe,iCAAiC;AAAA,MAC1F;AAAA,IACF;AACA,UAAM,cAAc,kBAAkB,UAAU,MAAM,KAAK,OAAO,OAAO,YAAY;AACrF,QAAI,CAAC,aAAa;AAChB,aAAO;AAAA,QACL,IAAI;AAAA,QACJ,OAAOA;AAAA,UACL,qBAAqB;AAAA,UACrB;AAAA,QACF;AAAA,MACF;AAAA,IACF;AACA,QACE,UAAU,WAAW,YAAY,UAAU,WAC3C,aAAa,UAAU,WAAW,WAAW,MAAM,aAAa,UAAU,MAAM,KAChF,CAAC,mBAAmB,UAAU,KAAK,UAAU,MAAM,KACnD,CAAC,uBAAuB,UAAU,WAAW,MAAM,UAAU,IAAI,GACjE;AACA,aAAO;AAAA,QACL,IAAI;AAAA,QACJ,OAAOA;AAAA,UACL,qBAAqB;AAAA,UACrB;AAAA,QACF;AAAA,MACF;AAAA,IACF;AACA,QAAI,CAAC,UAAU,WAAW,YAAY;AACpC,aAAO;AAAA,QACL,IAAI;AAAA,QACJ,OAAOA;AAAA,UACL,qBAAqB;AAAA,UACrB;AAAA,QACF;AAAA,MACF;AAAA,IACF;AACA,QAAI,CAAC,KAAK,0BAA0B,CAAC,KAAK,cAAc;AACtD,aAAO;AAAA,QACL,IAAI;AAAA,QACJ,OAAOA;AAAA,UACL,qBAAqB;AAAA,UACrB;AAAA,QACF;AAAA,MACF;AAAA,IACF;AAEA,UAAM,OAAO,OAAO,QAAQ,UAAU;AACtC,QAAI,CAAC,uBAAuB,UAAU,MAAM,IAAI,GAAG;AACjD,aAAO;AAAA,QACL,IAAI;AAAA,QACJ,OAAOA;AAAA,UACL,qBAAqB;AAAA,UACrB;AAAA,QACF;AAAA,MACF;AAAA,IACF;AAEA,UAAM,gBAAgB,UAAU,WAAW;AAC3C,UAAM,UAAU,OAAO,WAAW,CAAC,GAAG,aAAa;AACnD,QACE,QAAQ,WAAW,KACnB,IAAI,IAAI,OAAO,EAAE,SAAS,QAAQ,UAClC,QAAQ,SAAS,GAAG,KACpB,QAAQ,KAAK,CAAC,WAAW,CAAC,cAAc,KAAK,CAAC,iBAAiB,eAAe,cAAc,MAAM,CAAC,CAAC,GACpG;AACA,aAAO;AAAA,QACL,IAAI;AAAA,QACJ,OAAOA;AAAA,UACL,qBAAqB;AAAA,UACrB;AAAA,QACF;AAAA,MACF;AAAA,IACF;AAEA,UAAM,SAAS,OAAO,UAAU;AAChC,QAAI,UAAU,OAAO,SAAS,cAAc;AAC1C,aAAO;AAAA,QACL,IAAI;AAAA,QACJ,OAAOA;AAAA,UACL,qBAAqB;AAAA,UACrB;AAAA,QACF;AAAA,MACF;AAAA,IACF;AAEA,UAAM,UAAU,gCAAgC,OAAO;AACvD,QAAI,CAAC,SAAS;AACZ,aAAO;AAAA,QACL,IAAI;AAAA,QACJ,OAAOA;AAAA,UACL,qBAAqB;AAAA,UACrB;AAAA,QACF;AAAA,MACF;AAAA,IACF;AAEA,UAAM,QAAQ,iBAAiB,UAAU,OAAO;AAChD,QAAI,CAAC,OAAO;AACV,aAAO;AAAA,QACL,IAAI;AAAA,QACJ,OAAOA;AAAA,UACL,qBAAqB;AAAA,UACrB;AAAA,QACF;AAAA,MACF;AAAA,IACF;AAEA,QAAI;AACF,YAAM,gBAAgC;AAAA,QACpC,kBAAkB,EAAE,eAAe,UAAU,WAAW,WAAW;AAAA,QACnE,eAAe,UAAU,WAAW;AAAA,QACpC,SAAS,UAAU;AAAA,QACnB,oBAAoB,UAAU;AAAA,QAC9B,KAAK,UAAU;AAAA,MACjB;AACA,YAAM,SAAS,KAAK,uBAAuB;AAAA,QACzC,SAAS;AAAA,QACT;AAAA,QACA,SAAS,UAAU;AAAA,QACnB,WAAW,EAAE,CAAC,OAAO,GAAG,EAAE,CAAC,IAAI,GAAG,QAAQ,EAAE;AAAA,QAC5C,gBAAgB,KAAK,MAAM,OAAO,QAAQ,IAAI,GAAI;AAAA,MACpD,CAAC;AACD,YAAM,0BAA0B,KAAK,kBAAkB;AACvD,UAAI,wBAAyB,QAAO,EAAE,IAAI,OAAO,OAAO,wBAAwB;AAChF,YAAM,gBAAgB,kBAAkB,QAAQ;AAAA,QAC9C;AAAA,QACA,WAAW,aAAa,UAAU,MAAM;AAAA,QACxC,WAAW,UAAU,WAAW;AAAA,QAChC;AAAA,QACA,SAAS,UAAU;AAAA,QACnB;AAAA,QACA;AAAA,QACA,WAAW;AAAA,QACX,iBAAiB;AAAA,MACnB,GAAG,KAAK,YAAY;AACpB,UAAI,CAAC,eAAe;AAClB,eAAO;AAAA,UACL,IAAI;AAAA,UACJ,OAAOA;AAAA,YACL,qBAAqB;AAAA,YACrB;AAAA,UACF;AAAA,QACF;AAAA,MACF;AAEA,YAAM,mBAAmB;AAAA,QACvB,QAAQ;AAAA,QACR,SAAS,EAAE,eAAe,OAAO,WAAW;AAAA,QAC5C,UAAU;AAAA,MACZ;AACA,YAAM,eAAe,MAAM,KAAK,QAAQ,IAAI,IAAI,aAAa,WAAW,EAAE,SAAS,GAAG,gBAAgB;AACtG,YAAM,0BAA0B,KAAK,kBAAkB;AACvD,UAAI,wBAAyB,QAAO,EAAE,IAAI,OAAO,OAAO,wBAAwB;AAChF,UAAI,CAAC,aAAa,IAAI;AACpB,cAAM,IAAI,MAAM,mCAAmC,aAAa,MAAM,GAAG;AAAA,MAC3E;AAEA,YAAM,UAAU,cAAc;AAC9B,aAAO;AAAA,QACL,IAAI;AAAA,QACJ,MAAM;AAAA,UACJ,YAAY;AAAA,YACV,KAAK,OAAO;AAAA,YACZ,aAAa,cAAc;AAAA,YAC3B,cAAc,UAAU,OAAO,MAAM,GAAG,EAAE,CAAC;AAAA,YAC3C,SAAS,UAAU;AAAA,YACnB,MAAM,QAAQ;AAAA,YACd,SAAS,QAAQ;AAAA,YACjB,QAAQ,cAAc;AAAA,YACtB,WAAW;AAAA,YACX,oBAAoB;AAAA,YACpB,WAAW,UAAU,WAAW;AAAA,YAChC,WAAW;AAAA,YACX,kBAAkB,EAAE,eAAe,OAAO,WAAW;AAAA,YACrD,cAAc,MAAM;AAAA,YACpB,SAAS,MAAM;AAAA,YACf,MAAM;AAAA,YACN,WAAW,OAAO;AAAA,YAClB,sBAAsB;AAAA,UACxB;AAAA,UACA,QAAQ;AAAA,YACN,WAAW,UAAU,WAAW;AAAA,YAChC,SAAS,UAAU;AAAA,YACnB,MAAM,QAAQ;AAAA,YACd,MAAM;AAAA,YACN,WAAW,cAAc;AAAA,UAC3B;AAAA,QACF;AAAA,MACF;AAAA,IACF,SAAS,KAAK;AACZ,aAAO;AAAA,QACL,IAAI;AAAA,QACJ,OAAOA;AAAA,UACL,qBAAqB;AAAA,UACrB;AAAA,QACF;AAAA,MACF;AAAA,IACF;AAAA,EACF;AAAA;AAAA;AAAA;AAAA;AAAA,EAMQ,mCAAmC,YAA8B;AACvE,QAAI,kBAAkB,WAAW,SAAS,MAAS,EAAG;AACtD,UAAM,UAAU,WAAW,QAAQ,CAAC,GAAG,MAAM,KAAK,CAAC,EAAE,CAAC,KAAK;AAC3D,UAAM,QAAyB;AAAA,MAC7B;AAAA,MACA,OAAO,WAAW;AAAA,MAClB,MAAM,WAAW;AAAA,MACjB,SAAS,CAAC,GAAG,WAAW,OAAO;AAAA,MAC/B,SAAS,WAAW,WAAW,CAAC;AAAA,IAClC;AACA,UAAM,IAAI,mCAAmC,CAAC,KAAK,CAAC;AAAA,EACtD;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EASA,WAAW,MAAwB,SAAsB,UAAkB;AACzE,QAAI,WAAW,UAAU;AACvB,YAAM,IAAI,MAAM,WAAW,MAAM,gDAAgD;AAAA,IACnF;AAEA,UAAM,aAAa,KAAK,UAAU,IAAI;AACtC,UAAM,UAAU,gBAAgB,UAAU;AAC1C,WAAO,GAAG,aAAa,GAAG,OAAO;AAAA,EACnC;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EASA,WAAW,MAAgC;AACzC,UAAM,SAAS,KAAK,yBAAyB,IAAI;AACjD,QAAI,CAAC,OAAO,IAAI;AACd,YAAM,IAAI,MAAM,OAAO,MAAM,OAAO;AAAA,IACtC;AACA,WAAO,OAAO;AAAA,EAChB;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAWQ,yBAAyB,MAAyD;AAExF,QAAI,UAAU;AAGd,QAAI,KAAK,SAAS,SAAS,GAAG;AAC5B,YAAM,QAAQ,KAAK,MAAM,SAAS;AAClC,gBAAU,MAAM,MAAM,SAAS,CAAC;AAAA,IAClC;AAGA,QAAI,KAAK,SAAS,SAAS,GAAG;AAC5B,UAAI;AACF,cAAM,MAAM,IAAI,IAAI,IAAI;AACxB,kBAAU,IAAI,aAAa,IAAI,OAAO,KAAK;AAAA,MAC7C,QAAQ;AACN,eAAO;AAAA,UACL,IAAI;AAAA,UACJ,OAAOA;AAAA,YACL,qBAAqB;AAAA,YACrB;AAAA,UACF;AAAA,QACF;AAAA,MACF;AAAA,IACF;AAGA,QAAI,CAAC,QAAQ,WAAW,aAAa,GAAG;AACtC,aAAO;AAAA,QACL,IAAI;AAAA,QACJ,OAAOA;AAAA,UACL,qBAAqB;AAAA,UACrB,iDAAiD,aAAa;AAAA,QAChE;AAAA,MACF;AAAA,IACF;AAEA,UAAM,aAAa,QAAQ,MAAM,cAAc,MAAM;AAErD,QAAI;AACJ,QAAI;AACF,mBAAa,gBAAgB,UAAU;AAAA,IACzC,SAAS,KAAK;AACZ,aAAO;AAAA,QACL,IAAI;AAAA,QACJ,OAAOA;AAAA,UACL,qBAAqB;AAAA,UACrB,iCAAiC,eAAe,QAAQ,IAAI,UAAU,OAAO,GAAG,CAAC;AAAA,UACjF,eAAe,QAAQ,MAAM;AAAA,QAC/B;AAAA,MACF;AAAA,IACF;AAEA,QAAI;AACJ,QAAI;AACF,eAAS,KAAK,MAAM,UAAU;AAAA,IAChC,SAAS,KAAK;AACZ,aAAO;AAAA,QACL,IAAI;AAAA,QACJ,OAAOA;AAAA,UACL,qBAAqB;AAAA,UACrB,oCAAoC,eAAe,QAAQ,IAAI,UAAU,OAAO,GAAG,CAAC;AAAA,UACpF,eAAe,QAAQ,MAAM;AAAA,QAC/B;AAAA,MACF;AAAA,IACF;AAIA,QACE,UACA,OAAO,WAAW,YAClB,gBAAgB,UAChB,OAAO,cACP,OAAO,OAAO,eAAe,YAC7B,YAAY,OAAO,cACnB,OAAO,OAAO,WAAW,WAAW,UACpC;AACA,MAAC,OAAO,WAAgC,SAAS,IAAI,KAAK,OAAO,WAAW,MAAM;AAAA,IACpF;AAGA,UAAM,mBAAmB,yBAAyB,MAAM;AACxD,QAAI,CAAC,iBAAiB,IAAI;AACxB,aAAO;AAAA,QACL,IAAI;AAAA,QACJ,OAAOA;AAAA,UACL,qBAAqB;AAAA,UACrB,iBAAiB,MAAM;AAAA,UACvB;AAAA,UACA,iBAAiB,MAAM;AAAA,QACzB;AAAA,MACF;AAAA,IACF;AAEA,WAAO,EAAE,IAAI,MAAM,MAAM,iBAAiB,KAAK;AAAA,EACjD;AACF;AAKO,SAAS,qBAAqB,QAA+C;AAClF,SAAO,IAAI,eAAe,MAAM;AAClC;AAEA,SAAS,iBAAiB,SAA8D;AACtF,QAAM,QAAQ,QAAQ,MAAM,kDAAkD;AAC9E,MAAI,CAAC,MAAO,QAAO;AACnB,QAAM,UAAU,OAAO,MAAM,CAAC,CAAC;AAC/B,MAAI,CAAC,OAAO,cAAc,OAAO,EAAG,QAAO;AAC3C,SAAO,EAAE,SAAS,SAAS,MAAM,CAAC,EAAE;AACtC;AAEA,SAAS,uBAAuB,OAA8B;AAC5D,MAAI;AACF,UAAM,MAAM,IAAI,IAAI,KAAK;AACzB,QACE,CAAC,CAAC,SAAS,QAAQ,EAAE,SAAS,IAAI,QAAQ,KAC1C,IAAI,YACJ,IAAI,YACH,IAAI,aAAa,MAAM,IAAI,aAAa,OACzC,IAAI,UACJ,IAAI,KACJ,QAAO;AACT,WAAO,IAAI,OAAO,YAAY;AAAA,EAChC,QAAQ;AACN,WAAO;AAAA,EACT;AACF;AAEA,SAAS,kBAAkB,WAAmB,YAAsB,UAAkC;AACpG,QAAM,SAAS,uBAAuB,SAAS;AAC/C,MAAI,CAAC,OAAQ,QAAO;AACpB,QAAM,UAAU,IAAI,IAAI,WAAW,IAAI,sBAAsB,EAAE,OAAO,CAAC,UAA2B,QAAQ,KAAK,CAAC,CAAC;AACjH,MAAI,CAAC,QAAQ,IAAI,MAAM,EAAG,QAAO;AACjC,MAAI,YAAY,uBAAuB,QAAQ,MAAM,OAAQ,QAAO;AACpE,SAAO;AACT;AAEA,SAAS,wBAAwB,MAA6B;AAC5D,MACE,oBAAoB,KAAK,IAAI,KAC7B,iBAAiB,KAAK,IAAI,KAC1B,KAAK,SAAS,IAAI,EAClB,QAAO;AACT,QAAM,gBAAgB,KAAK,QAAQ,GAAG;AACtC,MAAI,kBAAkB,MAAM,CAAC,KAAK,SAAS,IAAI,KAAK,CAAC,KAAK,SAAS,KAAK,EAAG,QAAO;AAClF,MAAI,KAAK,MAAM,GAAG,EAAE,EAAE,SAAS,GAAG,KAAM,KAAK,SAAS,IAAI,KAAK,KAAK,MAAM,GAAG,EAAE,EAAE,SAAS,GAAG,EAAI,QAAO;AACxG,QAAM,WAAW,KAAK,MAAM,GAAG;AAC/B,MAAI,SAAS,KAAK,CAAC,YAAY,YAAY,OAAO,YAAY,IAAI,EAAG,QAAO;AAC5E,SAAO;AACT;AAEA,SAAS,uBAAuB,QAAgB,OAAwB;AACtE,QAAM,kBAAkB,wBAAwB,MAAM;AACtD,QAAM,iBAAiB,wBAAwB,KAAK;AACpD,MAAI,oBAAoB,QAAQ,mBAAmB,KAAM,QAAO;AAChE,MAAI,oBAAoB,MAAM,oBAAoB,IAAK,QAAO;AAC9D,MAAI,oBAAoB,eAAgB,QAAO;AAC/C,MAAI,gBAAgB,SAAS,KAAK,GAAG;AACnC,WAAO,eAAe,WAAW,gBAAgB,MAAM,GAAG,EAAE,CAAC;AAAA,EAC/D;AACA,MAAI,gBAAgB,SAAS,IAAI,GAAG;AAClC,UAAM,SAAS,gBAAgB,MAAM,GAAG,EAAE;AAC1C,QAAI,CAAC,eAAe,WAAW,MAAM,EAAG,QAAO;AAC/C,UAAM,YAAY,eAAe,MAAM,OAAO,MAAM;AACpD,WAAO,UAAU,SAAS,KAAK,CAAC,UAAU,SAAS,GAAG;AAAA,EACxD;AACA,SAAO,gBAAgB,SAAS,GAAG,KAAK,eAAe,WAAW,eAAe;AACnF;AAEA,SAAS,mBAAmB,KAAU,QAAyB;AAC7D,MACE,IAAI,QAAQ,SACZ,IAAI,QAAQ,aACZ,OAAO,IAAI,MAAM,YACjB,OAAO,IAAI,MAAM,SACjB,QAAO;AACT,MAAI;AACF,UAAM,WAAW,MAAM,UAAU,OAAO,aAAa,MAAM,EAAE,MAAM,WAAW,MAAM,CAAC;AACrF,UAAM,YAAY,SAAS,WAAW,MAAM,SAAS,CAAC,MAAM,OAAQ,SAAS,CAAC,MAAM,IAChF,SAAS,MAAM,CAAC,IAChB;AACJ,QAAI,CAAC,UAAW,QAAO;AACvB,UAAM,WAAW,qBAAqB,IAAI,CAAC;AAC3C,UAAM,aAAa,qBAAqB,IAAI,CAAC;AAC7C,UAAM,mBAAmB,wBAAQ,aAAa,UAAU;AACxD,WACE,WAAW,WAAW,MACtB,UAAU,WAAW,SAAS,UAC9B,UAAU,MAAM,CAAC,MAAM,UAAU,SAAS,SAAS,KAAK,CAAC,KACzD,iBAAiB,WAAW,SAAS,UACrC,iBAAiB,MAAM,CAAC,MAAM,UAAU,SAAS,SAAS,KAAK,CAAC;AAAA,EAEpE,QAAQ;AACN,WAAO;AAAA,EACT;AACF;AAEA,SAAS,qBAAqB,OAA2B;AACvD,MAAI,UAAU,MAAM,QAAQ,MAAM,GAAG,EAAE,QAAQ,MAAM,GAAG;AACxD,SAAO,QAAQ,SAAS,EAAG,YAAW;AACtC,MAAI,OAAO,SAAS,aAAa;AAC/B,WAAO,WAAW,KAAK,KAAK,OAAO,GAAG,CAAC,cAAc,UAAU,WAAW,CAAC,CAAC;AAAA,EAC9E;AACA,SAAO,WAAW,KAAK,OAAO,KAAK,SAAS,QAAQ,CAAC;AACvD;AAEA,SAAS,kBACP,QACA,UAWA,YAC4G;AAC5G,QAAM,QAAQ,OAAO,WAAW,MAAM,GAAG;AACzC,MAAI,MAAM,WAAW,EAAG,QAAO;AAC/B,MAAI;AACJ,MAAI;AACF,cAAU,KAAK,MAAM,IAAI,YAAY,EAAE,OAAO,qBAAqB,MAAM,CAAC,CAAC,CAAC,CAAC;AAAA,EAC/E,QAAQ;AACN,WAAO;AAAA,EACT;AACA,QAAM,cAAc,OAAO,QAAQ,QAAQ,WAAW,aAAa,QAAQ,GAAG,IAAI;AAClF,QAAM,YAAY,OAAO,QAAQ,QAAQ,WAAW,aAAa,QAAQ,GAAG,IAAI;AAChF,QAAM,SAAS,MAAM,QAAQ,QAAQ,GAAG,IAAI,QAAQ,MAAM,CAAC;AAC3D,QAAM,iBAAiB,OAAO,QAAQ,QAAQ,YAAY,OAAO,UAAU,QAAQ,GAAG,IAAI,QAAQ,MAAM;AACxG,QAAM,YAAY,IAAI,KAAK,iBAAiB,GAAI;AAChD,MACE,gBAAgB,SAAS,eACzB,cAAc,SAAS,aACvB,OAAO,WAAW,KAClB,OAAO,CAAC,MAAM,SAAS,aACvB,aAAa,oBAAI,KAAK,KACtB,YAAY,SAAS,aACrB,YAAY,SAAS,mBACrB,WAAW,IAAI,YAAY,EAAE,OAAO,OAAO,UAAU,GAAG,KAAK,MAAM,OAAO,IAC1E,QAAO;AAET,QAAM,MAAM,QAAQ;AACpB,MAAI,CAAC,OAAO,OAAO,QAAQ,YAAY,MAAM,QAAQ,GAAG,EAAG,QAAO;AAClE,QAAM,UAAU,OAAO,QAAQ,GAA8B;AAC7D,MAAI,QAAQ,WAAW,EAAG,QAAO;AACjC,QAAM,CAAC,aAAa,YAAY,IAAI,QAAQ,CAAC;AAC7C,QAAM,SAAS,GAAG,SAAS,OAAO,IAAI,SAAS,OAAO;AACtD,MAAI,CAAC,YAAY,WAAW,MAAM,KAAK,YAAY,MAAM,OAAO,MAAM,MAAM,SAAS,KAAM,QAAO;AAClG,MAAI,CAAC,gBAAgB,OAAO,iBAAiB,YAAY,MAAM,QAAQ,YAAY,EAAG,QAAO;AAC7F,QAAM,gBAAgB,OAAO,KAAK,YAAuC,EAAE,KAAK;AAChF,QAAM,kBAAkB,CAAC,GAAG,SAAS,OAAO,EAAE,KAAK;AACnD,MACE,cAAc,WAAW,gBAAgB,UACzC,CAAC,cAAc,MAAM,CAAC,QAAQ,UAAU,WAAW,gBAAgB,KAAK,CAAC,EACzE,QAAO;AAET,MAAI,aAAa,OAAO,WAAW,MAAM,eAAe,OAAO,UAAU,WAAW,EAAG,QAAO;AAC9F,MAAI,OAAO,OAAO,QAAQ,MAAM,UAAU,QAAQ,EAAG,QAAO;AAC5D,QAAM,WAAW,OAAO,UAAU,CAAC;AACnC,MACE,SAAS,YAAY,SAAS,WAC9B,SAAS,UAAU,SAAS,WAC5B,SAAS,SAAS,SAAS,KAC3B,QAAO;AACT,QAAM,gBAAgB,CAAC,GAAG,SAAS,OAAO,EAAE,KAAK;AACjD,MACE,cAAc,WAAW,gBAAgB,UACzC,CAAC,cAAc,MAAM,CAAC,QAAQ,UAAU,WAAW,gBAAgB,KAAK,CAAC,EACzE,QAAO;AACT,SAAO,EAAE,aAAa,WAAW,SAAS;AAC5C;;;AUrxDA,IAAAI,kBAAwB;AACxB,IAAAC,iBAAuB;;;ACDvB,IAAAC,kBAAwB;AAExB,IAAAC,eAAkD;AAyJlD,IAAMC,eAAc,IAAI,YAAY;AAGpC,IAAMC,gBACH,OAEE,UACF,OAAO,UAAU,eAAe,KAAK;AAAA,EACpC,OAAO,UAAU;AACnB;AAEK,SAAS,iCAAiC,OAAwB;AACvE,SAAO,gBAAgB,KAAK;AAC9B;;;ADpHA,IAAM,oBAAoB,MAAM,OAAO;AACvC,IAAM,qBAAqB;AAC3B,IAAM,gBAAgB;AACf,IAAM,kCAAkC;AAuF/C,SAAS,MAAM,OAA+B;AAAE,SAAO,IAAI,WAAW,KAAK;AAAG;AAE9E,SAAS,IAAI,OAA2B;AACtC,MAAI,OAAO,SAAS,YAAY;AAC9B,QAAI,SAAS;AACb,eAAW,QAAQ,MAAO,WAAU,OAAO,aAAa,IAAI;AAC5D,WAAO,KAAK,MAAM,EAAE,QAAQ,OAAO,GAAG,EAAE,QAAQ,OAAO,GAAG,EAAE,QAAQ,QAAQ,EAAE;AAAA,EAChF;AACA,MAAI,OAAO,WAAW,YAAa,QAAO,OAAO,KAAK,KAAK,EAAE,SAAS,WAAW;AACjF,QAAM,IAAI,MAAM,mCAAmC;AACrD;AAEA,SAAS,QAAQ,OAA2B;AAC1C,MAAI,CAAC,mBAAmB,KAAK,KAAK,EAAG,OAAM,IAAI,MAAM,8CAA8C;AACnG,MAAI,OAAO,SAAS,YAAY;AAC9B,UAAM,SAAS,MAAM,QAAQ,MAAM,GAAG,EAAE,QAAQ,MAAM,GAAG,IAAI,IAAI,QAAQ,IAAI,MAAM,SAAS,KAAK,CAAC;AAClG,WAAO,WAAW,KAAK,KAAK,MAAM,GAAG,CAAC,cAAc,UAAU,WAAW,CAAC,CAAC;AAAA,EAC7E;AACA,MAAI,OAAO,WAAW,YAAa,QAAO,IAAI,WAAW,OAAO,KAAK,OAAO,WAAW,CAAC;AACxF,QAAM,IAAI,MAAM,mCAAmC;AACrD;AAEA,SAAS,IAAI,YAAgC;AAC3C,SAAO,IAAI,SAAa,MAAM,OAAa,OAAU,UAAM,uBAAO,UAAU,CAAC,CAAC,EAAE,SAAS,OAAO,OAAO;AACzG;AAEA,SAASC,QAAO,YAAgC;AAAE,SAAO,QAAI,uBAAO,UAAU,CAAC;AAAG;AAElF,SAAS,2BAA2B,WAA+B;AACjE,MAAI,UAAU,WAAW,GAAI,OAAM,IAAI,MAAM,uCAAuC;AACpF,QAAM,WAAW,IAAI,WAAW,EAAE;AAClC,WAAS,IAAI,CAAC,KAAM,CAAI,CAAC;AACzB,WAAS,IAAI,WAAW,CAAC;AACzB,SAAO,WAAW,UAAU,OAAO,QAAQ,CAAC;AAC9C;AAMA,SAAS,cAAc,OAA4B;AACjD,QAAM,SAAmB,CAAC;AAC1B,QAAM,cAAc,CAAC,OAAeC,YAAyB;AAC3D,QAAI,CAAC,OAAO,cAAcA,OAAM,KAAKA,UAAS,EAAG,OAAM,IAAI,MAAM,6BAA6B;AAC9F,QAAIA,UAAS,GAAI,QAAO,KAAM,SAAS,IAAKA,OAAM;AAAA,aACzCA,UAAS,IAAO,QAAO,KAAM,SAAS,IAAK,IAAIA,OAAM;AAAA,aACrDA,UAAS,MAAS,QAAO,KAAM,SAAS,IAAK,IAAIA,WAAU,GAAGA,UAAS,GAAI;AAAA,QAC/E,OAAM,IAAI,MAAM,6BAA6B;AAAA,EACpD;AACA,QAAM,QAAQ,CAAC,SAAwB;AACrC,QAAI,SAAS,MAAM;AAAE,aAAO,KAAK,GAAI;AAAG;AAAA,IAAQ;AAChD,QAAI,SAAS,OAAO;AAAE,aAAO,KAAK,GAAI;AAAG;AAAA,IAAQ;AACjD,QAAI,SAAS,MAAM;AAAE,aAAO,KAAK,GAAI;AAAG;AAAA,IAAQ;AAChD,QAAI,OAAO,SAAS,UAAU;AAC5B,YAAM,UAAU,IAAI,YAAY,EAAE,OAAO,IAAI;AAC7C,kBAAY,GAAG,QAAQ,MAAM;AAAG,aAAO,KAAK,GAAG,OAAO;AAAG;AAAA,IAC3D;AACA,QAAI,OAAO,SAAS,YAAY,OAAO,cAAc,IAAI,GAAG;AAC1D,UAAI,QAAQ,EAAG,aAAY,GAAG,IAAI;AAAA,UAC7B,aAAY,GAAG,KAAK,IAAI;AAC7B;AAAA,IACF;AACA,QAAI,MAAM,QAAQ,IAAI,GAAG;AACvB,kBAAY,GAAG,KAAK,MAAM;AAAG,WAAK,QAAQ,KAAK;AAAG;AAAA,IACpD;AACA,QAAI,OAAO,SAAS,YAAY,SAAS,MAAM;AAC7C,YAAM,UAAU,OAAO,QAAQ,IAA+B,EAAE,IAAI,CAAC,CAAC,KAAKC,MAAK,MAAM;AACpF,cAAM,WAAW,cAAc,GAAG;AAClC,eAAO,EAAE,KAAK,OAAAA,QAAO,SAAS;AAAA,MAChC,CAAC,EAAE,KAAK,CAAC,MAAM,UAAU;AACvB,YAAI,KAAK,SAAS,WAAW,MAAM,SAAS,OAAQ,QAAO,KAAK,SAAS,SAAS,MAAM,SAAS;AACjG,iBAAS,QAAQ,GAAG,QAAQ,KAAK,SAAS,QAAQ,SAAS,GAAG;AAC5D,cAAI,KAAK,SAAS,KAAK,MAAM,MAAM,SAAS,KAAK,EAAG,QAAO,KAAK,SAAS,KAAK,IAAI,MAAM,SAAS,KAAK;AAAA,QACxG;AACA,eAAO;AAAA,MACT,CAAC;AACD,kBAAY,GAAG,QAAQ,MAAM;AAC7B,cAAQ,QAAQ,CAAC,EAAE,KAAK,OAAAA,OAAM,MAAM;AAAE,cAAM,GAAG;AAAG,cAAMA,MAAK;AAAA,MAAG,CAAC;AACjE;AAAA,IACF;AACA,UAAM,IAAI,MAAM,4BAA4B;AAAA,EAC9C;AACA,QAAM,KAAK;AACX,SAAO,WAAW,KAAK,MAAM;AAC/B;AAEA,SAAS,aAAa,OAAgB,MAAyB,OAAwC;AACrG,MAAI,OAAO,UAAU,YAAY,UAAU,QAAQ,MAAM,QAAQ,KAAK,EAAG,OAAM,IAAI,MAAM,GAAG,KAAK,aAAa;AAC9G,QAAM,SAAS;AACf,MAAI,OAAO,KAAK,MAAM,EAAE,WAAW,KAAK,UAAU,KAAK,KAAK,CAAC,QAAQ,CAAC,OAAO,UAAU,eAAe,KAAK,QAAQ,GAAG,CAAC,EAAG,OAAM,IAAI,MAAM,GAAG,KAAK,gCAAgC;AAClL,SAAO;AACT;AAEA,eAAsB,wBAAwB,SAAwE;AACpH,MAAI,CAAC,WAAW,QAAQ,OAAQ,OAAM,IAAI,MAAM,wDAAwD;AACxG,QAAM,YAAY,MAAM,OAAO,OAAO,YAAY,EAAE,MAAM,UAAU,GAAG,QAAQ,aAAa,CAAC,QAAQ,QAAQ,CAAC;AAC9G,QAAM,aAAa,UAAU;AAC7B,QAAM,YAAY,IAAI,WAAW,MAAM,OAAO,OAAO,UAAU,OAAO,UAAU,SAAS,CAAC;AAC1F,MAAI,UAAU;AACd,QAAM,MAAyB;AAAA,IAC7B,KAAK,2BAA2B,SAAS;AAAA,IACzC,WAAW,MAAM,SAAS;AAAA,IAC1B,aAAa,QAAQ;AAAA,IACrB,WAAW;AAAA,IACX,GAAI,QAAQ,cAAc,EAAE,YAAY,MAAM,OAAO,OAAO,UAAU,OAAO,UAAU,EAA4B,IAAI,CAAC;AAAA,IACxH,MAAM,KAAK,OAAO;AAChB,UAAI,QAAS,OAAM,IAAI,MAAM,4BAA4B;AACzD,aAAO,IAAI,WAAW,MAAM,OAAO,OAAO,KAAK,EAAE,MAAM,UAAU,GAAG,YAAY,KAAK,CAAC;AAAA,IACxF;AAAA,IACA,QAAQ;AAAE,gBAAU;AAAA,IAAM;AAAA,EAC5B;AACA,SAAO;AACT;AASO,SAAS,yBAAyB,OAA6H;AACpK,MAAI,UAAU;AACd,SAAO;AAAA,IACL,KAAK,2BAA2B,MAAM,SAAS;AAAA,IAC/C,WAAW,MAAM,MAAM,SAAS;AAAA,IAChC,aAAa,MAAM;AAAA,IACnB,WAAW,MAAM;AAAA,IACjB,MAAM,KAAK,WAAW;AACpB,UAAI,QAAS,OAAM,IAAI,MAAM,4BAA4B;AACzD,UAAI,CAAC,WAAW,QAAQ,OAAQ,OAAM,IAAI,MAAM,wDAAwD;AACxG,aAAO,IAAI,WAAW,MAAM,OAAO,OAAO,KAAK,EAAE,MAAM,UAAU,GAAG,MAAM,YAAY,SAAS,CAAC;AAAA,IAClG;AAAA,IACA,QAAQ;AAAE,gBAAU;AAAA,IAAM;AAAA,EAC5B;AACF;AAEA,eAAsB,kCAAkC,OAa1B;AAC5B,MAAI,MAAM,SAAS,IAAI,WAAW,KAAK,MAAM,gBAAgB,cAAc,WAAW,EAAG,OAAM,IAAI,MAAM,6CAA6C;AACtJ,QAAM,QAAQ;AAAA,IACZ,oBAAoB,MAAM,gBAAgB;AAAA,IAC1C,WAAW,MAAM;AAAA,IACjB,SAAS,MAAM;AAAA,IACf,aAAa,MAAM,SAAS;AAAA,IAC5B,aAAa,MAAM;AAAA,IACnB,cAAc,MAAM;AAAA,IACpB,SAAS,MAAM;AAAA,IACf,MAAM,MAAM;AAAA,IACZ,SAAS,CAAC,GAAG,MAAM,OAAO;AAAA,IAC1B,GAAI,MAAM,eAAe,SAAY,CAAC,IAAI;AAAA,MACxC,qBAAqB,MAAM,WAAW;AAAA,MACtC,kBAAkB,MAAM,WAAW;AAAA,IACrC;AAAA,IACA,qBAAqB,MAAM;AAAA,IAC3B,WAAW,MAAM;AAAA,EACnB;AACA,QAAM,WAAW,EAAE,MAAM,mCAAmC,SAAS,GAAG,WAAW,MAAM,SAAS,KAAK,aAAa,MAAM,aAAa,MAAM;AAC7I,QAAM,eAAe,cAAc,EAAE,QAAQ,oBAAoB,SAAS,CAAC;AAC3E,QAAM,YAAY,IAAI,MAAM,MAAM,SAAS,KAAK,YAAY,CAAC;AAC7D,SAAO,EAAE,KAAK,IAAI,YAAY,GAAG,SAAS,IAAI,YAAY,GAAG,WAAW,MAAM,SAAS,KAAK,aAAa,MAAM,aAAa,OAAO,UAAU;AAC/I;AAEA,eAAsB,0BAA0B,QAAoH;AAClK,QAAM,OAAO,iCAAa,EAAE,QAAQ,eAAe,OAAO,CAAC;AAC3D,QAAM,cAAc,IAAI,YAAY,EAAE,OAAO,IAAI;AACjD,SAAO,EAAE,OAAO,aAAa,KAAK,IAAI,WAAW,GAAG,QAAQC,QAAO,WAAW,EAAE;AAClF;AAEO,SAAS,iCAAiC,cAA6E;AAC5H,SAAO,IAAI,IAAI,YAAY,EAAE,OAAO,iCAAa,YAAY,CAAC,CAAC;AACjE;AAEO,SAAS,qCAAqC,OAAgB,UAA+E;AAClJ,MAAI,IAAI,SAAS,OAAO,KAAK,MAAM,SAAS,OAAO,IAAK,OAAM,IAAI,MAAM,yDAAyD;AACjI,QAAM,OAAO,aAAa,OAAO,CAAC,gBAAgB,OAAO,GAAG,mCAAmC;AAC/F,QAAM,kBAAkB,KAAK;AAC7B,QAAM,gBAAgB,OAAO,oBAAoB,YAAY,oBAAoB,QAAQ,OAAO,UAAU,eAAe,KAAK,iBAAiB,YAAY;AAC3J,QAAM,eAAe,aAAa,KAAK,cAAc,CAAC,mBAAmB,aAAa,sBAAsB,4BAA4B,YAAY,eAAe,eAAe,WAAW,oBAAoB,UAAU,YAAY,WAAW,GAAI,gBAAgB,CAAC,YAAY,IAAI,CAAC,GAAI,iBAAiB,uBAAuB,gBAAgB,WAAW,GAAG,0BAA0B;AAC5X,QAAM,QAAQ,aAAa,KAAK,OAAO,CAAC,OAAO,OAAO,WAAW,GAAG,gCAAgC;AACpG,MAAI,aAAa,cAAc,SAAS,OAAO,OAAO,aAAa,uBAAuB,SAAS,gBAAgB,iBAAiB,aAAa,6BAA6B,SAAS,sBAAsB,OAAO,aAAa,wBAAwB,SAAS,oBAAqB,OAAM,IAAI,MAAM,8DAA8D;AACrW,MAAI;AACJ,MAAI;AAAE,kBAAc,KAAK,MAAM,IAAI,YAAY,SAAS,EAAE,OAAO,KAAK,CAAC,EAAE,OAAO,SAAS,OAAO,KAAK,CAAC;AAAA,EAA8B,QAAQ;AAAE,UAAM,IAAI,MAAM,sCAAsC;AAAA,EAAG;AACvM,QAAM,SAAS,YAAY;AAC3B,MAAI,YAAY,WAAW,qCAAqC,WAAW,UAAa,MAAM,QAAQ,MAAM,EAAG,OAAM,IAAI,MAAM,wCAAwC;AACvK,QAAM,SAAS,OAAO;AACtB,QAAM,WAAW,OAAO;AACxB,QAAM,qBAAqB,aAAa;AACxC,QAAM,uBAAuB,aAAa;AAC1C,QAAM,mBAAmB,SAAS,sBAAsB;AACxD,QAAM,aAAa,OAAO;AAC1B,QAAM,oBAAoB,eAAe,SACrC,aAAa,eAAe,SAC5B,aAAa,eAAe,UAAa,iCAAa,UAAU,MAAM,iCAAa,aAAa,UAAU;AAC9G,MAAI,OAAO,QAAQ,WAAW,YAAY,OAAO,OAAO,iBAAiB,YAAY,OAAO,OAAO,gBAAgB,YAAY,OAAO,OAAO,YAAY,YAAY,OAAO,UAAU,SAAS,YAAY,CAAC,CAAC,SAAS,QAAQ,EAAE,SAAS,SAAS,IAAI,KAAK,OAAO,UAAU,SAAS,YAAY,CAAC,MAAM,QAAQ,OAAO,OAAO,KAAK,OAAO,aAAa,aAAa,YAAY,OAAO,gBAAgB,aAAa,eAAe,OAAO,YAAY,aAAa,WAAW,iCAAa,OAAO,gBAAgB,MAAM,iCAAa,aAAa,gBAAgB,KAAK,OAAO,WAAW,mBAAmB,UAAU,OAAO,iBAAiB,mBAAmB,gBAAgB,OAAO,gBAAgB,aAAa,eAAe,OAAO,YAAY,mBAAmB,WAAW,SAAS,SAAS,qBAAqB,QAAQ,SAAS,SAAS,qBAAqB,QAAQ,iCAAa,OAAO,OAAO,MAAM,iCAAa,aAAa,OAAO,KAAK,CAAC,qBAAqB,iCAAa,OAAO,aAAa,MAAM,iCAAa,aAAa,aAAa,KAAK,OAAO,cAAc,aAAa,aAAa,OAAO,wBAAwB,aAAa,uBAAuB,iBAAiB,uBAAuB,aAAa,sBAAsB,iBAAiB,cAAc,aAAa,aAAa,iBAAiB,gBAAgB,aAAa,eAAe,iBAAiB,gBAAgB,aAAa,eAAe,iBAAiB,iBAAiB,mBAAmB,gBAAgB,iBAAiB,YAAY,mBAAmB,WAAW,iBAAiB,SAAS,qBAAqB,QAAQ,iCAAa,iBAAiB,OAAO,MAAM,iCAAa,aAAa,OAAO,KAAK,iBAAiB,wBAAwB,YAAY,aAAa,iBAAiB,qBAAqB,YAAY,UAAU,iBAAiB,cAAc,aAAa,UAAW,OAAM,IAAI,MAAM,+DAA+D;AAC/3D,MAAI,OAAO,aAAa,oBAAoB,YAAY,OAAO,aAAa,cAAc,YAAY,OAAO,aAAa,iBAAiB,SAAU,OAAM,IAAI,MAAM,iDAAiD;AACtN,MAAI,IAAI,KAAK,aAAa,SAAS,EAAE,YAAY,MAAM,aAAa,aAAa,KAAK,MAAM,aAAa,SAAS,KAAK,KAAK,IAAI,EAAG,OAAM,IAAI,MAAM,sDAAsD;AACzM,QAAM,EAAE,iBAAiB,kBAAkB,GAAG,iBAAiB,IAAI;AACnE,MAAI,iCAAiC,gBAAoF,MAAM,aAAa,gBAAiB,OAAM,IAAI,MAAM,gEAAgE;AAC7O,MAAI,MAAM,QAAQ,WAAW,OAAO,MAAM,QAAQ,YAAY,OAAO,MAAM,cAAc,SAAU,OAAM,IAAI,MAAM,2CAA2C;AAC9J,QAAM,WAAW,SAAS;AAC1B,MAAI,aAAa,OAAW,OAAM,IAAI,MAAM,2DAA2D;AACvG,MAAI,MAAM,QAAQ,SAAS,IAAK,OAAM,IAAI,MAAM,mDAAmD;AACnG,QAAM,aAAa,SAAS;AAC5B,MAAI,WAAW,WAAW,MAAM,WAAW,CAAC,MAAM,OAAQ,WAAW,CAAC,MAAM,GAAM;AAAA,EAElF,WAAW,WAAW,WAAW,GAAI,OAAM,IAAI,MAAM,+CAA+C;AACpG,QAAM,YAAY,WAAW,WAAW,KAAK,WAAW,MAAM,CAAC,IAAI;AACnE,QAAM,iBAAiB,QAAQ,MAAM,SAAS;AAC9C,QAAM,cAAc,IAAI,YAAY,EAAE,OAAO,GAAG,+BAA+B,GAAG,iCAAa,gBAAgB,CAAC,EAAE;AAClH,MAAI,eAAe,WAAW,MAAM,CAAC,wBAAQ,OAAO,gBAAgB,aAAa,SAAS,EAAG,OAAM,IAAI,MAAM,qDAAqD;AAClK,SAAO,EAAE,cAAuE,MAAwE;AAC1J;AAGO,SAAS,0CAA0C,YAAwB,UAA+E;AAC/J,MAAI;AACJ,MAAI;AACF,YAAQ,KAAK,MAAM,IAAI,YAAY,SAAS,EAAE,OAAO,KAAK,CAAC,EAAE,OAAO,UAAU,CAAC;AAAA,EACjF,QAAQ;AACN,UAAM,IAAI,MAAM,2DAA2D;AAAA,EAC7E;AACA,SAAO,qCAAqC,OAAO,QAAQ;AAC7D;;;AEzXA,IAAAC,kBAAwB;AAKjB,IAAM,sCAAsC;AAqFnD,SAAS,uBAAuB,OAAwB;AACtD,MAAI;AACJ,MAAI;AACF,UAAM,IAAI,IAAI,KAAK;AAAA,EACrB,QAAQ;AACN,WAAO;AAAA,EACT;AACA,SAAO,IAAI,aAAa,YACnB,IAAI,WAAW,SACf,IAAI,aAAa,OACjB,IAAI,WAAW,MACf,IAAI,SAAS,MACb,IAAI,aAAa,MACjB,IAAI,aAAa;AACxB;AAEA,IAAM,qBAAqB;AAAA,EACzB;AAAA,EAAQ;AAAA,EAAW;AAAA,EAAO;AAAA,EAAY;AAAA,EAAW;AAAA,EAAmB;AAAA,EACpE;AAAA,EAA4B;AAAA,EAAe;AAAA,EAAa;AAAA,EAAgB;AAAA,EACxE;AAAA,EACA;AAAA,EAAU;AAAA,EAAoB;AAAA,EAAiB;AAAA,EAAY;AAAA,EAAgB;AAAA,EAC3E;AAAA,EAAa;AAAA,EAAe;AAAA,EAAiB;AAAA,EAAuB;AAAA,EACpE;AAAA,EAAY;AAAA,EAAoB;AAAA,EAAW;AAAA,EAAY;AAAA,EACvD;AAAA,EAA2B;AAAA,EAAqB;AAAA,EAAkB;AAAA,EAAa;AACjF;AAEA,SAASC,cAAa,OAAgB,MAAyB,OAAwC;AACrG,MAAI,OAAO,UAAU,YAAY,UAAU,QAAQ,MAAM,QAAQ,KAAK,EAAG,OAAM,IAAI,MAAM,GAAG,KAAK,aAAa;AAC9G,QAAM,SAAS;AACf,MAAI,OAAO,KAAK,MAAM,EAAE,WAAW,KAAK,UAAU,KAAK,KAAK,CAAC,QAAQ,CAAC,OAAO,UAAU,eAAe,KAAK,QAAQ,GAAG,CAAC,EAAG,OAAM,IAAI,MAAM,GAAG,KAAK,gCAAgC;AAClL,SAAO;AACT;AAEA,SAASC,SAAQ,OAA2B;AAC1C,MAAI,CAAC,mBAAmB,KAAK,KAAK,EAAG,OAAM,IAAI,MAAM,iDAAiD;AACtG,MAAI,OAAO,SAAS,YAAY;AAC9B,UAAM,SAAS,MAAM,QAAQ,MAAM,GAAG,EAAE,QAAQ,MAAM,GAAG,IAAI,IAAI,QAAQ,IAAI,MAAM,SAAS,KAAK,CAAC;AAClG,WAAO,WAAW,KAAK,KAAK,MAAM,GAAG,CAAC,cAAc,UAAU,WAAW,CAAC,CAAC;AAAA,EAC7E;AACA,MAAI,OAAO,WAAW,YAAa,QAAO,IAAI,WAAW,OAAO,KAAK,OAAO,WAAW,CAAC;AACxF,QAAM,IAAI,MAAM,mCAAmC;AACrD;AAOO,SAAS,wCAAwC,YAAwB,UAAyF;AACvK,MAAI;AACJ,MAAI;AACF,YAAQ,KAAK,MAAM,IAAI,YAAY,SAAS,EAAE,OAAO,KAAK,CAAC,EAAE,OAAO,UAAU,CAAC;AAAA,EACjF,QAAQ;AACN,UAAM,IAAI,MAAM,+DAA+D;AAAA,EACjF;AACA,QAAM,OAAOD,cAAa,OAAO,CAAC,iBAAiB,OAAO,GAAG,uCAAuC;AACpG,QAAM,gBAAgBA,cAAa,KAAK,eAAe,oBAAoB,8BAA8B;AACzG,QAAM,QAAQA,cAAa,KAAK,OAAO,CAAC,OAAO,OAAO,WAAW,GAAG,oCAAoC;AAExG,QAAM,UAAU,SAAS;AACzB,MACE,cAAc,SAAS,yCACpB,cAAc,YAAY,KAC1B,cAAc,kBAAkB,SAChC,cAAc,QAAQ,QAAQ,OAC9B,cAAc,aAAa,QAAQ,YACnC,cAAc,YAAY,QAAQ,WAClC,cAAc,oBAAoB,QAAQ,mBAC1C,cAAc,kBAAkB,QAAQ,iBACxC,cAAc,6BAA6B,QAAQ,4BACnD,cAAc,gBAAgB,QAAQ,eACtC,cAAc,cAAc,QAAQ,aACpC,cAAc,kBAAkB,QAAQ,kBACxC,cAAc,aAAa,QAAQ,YACnC,cAAc,iBAAiB,QAAQ,gBACvC,cAAc,sBAAsB,QAAQ,qBAC5C,cAAc,cAAc,QAAQ,aACpC,cAAc,mBAAmB,QAAQ,kBACzC,cAAc,qBAAqB,QAAQ,OAC3C,cAAc,4BAA4B,QAAQ,iBACrD;AACA,UAAM,IAAI,MAAM,oEAAoE;AAAA,EACtF;AACA,MAAI,OAAO,cAAc,aAAa,YAAY,KAAK,MAAM,cAAc,QAAQ,IAAI,KAAK,IAAI,IAAI,IAAQ,OAAM,IAAI,MAAM,kDAAkD;AAC9K,MAAI,IAAI,KAAK,cAAc,SAAmB,EAAE,YAAY,MAAM,cAAc,UAAW,OAAM,IAAI,MAAM,yDAAyD;AAMpK,MACE,OAAO,cAAc,4BAA4B,YAC9C,CAAC,uBAAuB,cAAc,uBAAuB,KAC7D,cAAc,4BAA4B,SAAS,uBACnD,cAAc,4BAA4B,cAAc,gBACxD,cAAc,4BAA4B,cAAc,cAC3D;AACA,UAAM,IAAI,MAAM,8EAA8E;AAAA,EAChG;AAEA,MAAI,MAAM,QAAQ,WAAW,OAAO,MAAM,QAAQ,YAAY,OAAO,MAAM,cAAc,SAAU,OAAM,IAAI,MAAM,+CAA+C;AAClK,MAAI,MAAM,QAAQ,SAAS,UAAU,IAAK,OAAM,IAAI,MAAM,uDAAuD;AACjH,QAAM,aAAa,SAAS,UAAU;AACtC,QAAM,YAAY,WAAW,WAAW,MAAM,WAAW,CAAC,MAAM,OAAQ,WAAW,CAAC,MAAM,IAAO,WAAW,MAAM,CAAC,IAAI;AACvH,MAAI,UAAU,WAAW,GAAI,OAAM,IAAI,MAAM,mDAAmD;AAChG,QAAM,iBAAiBC,SAAQ,MAAM,SAAS;AAC9C,QAAM,cAAc,IAAI,YAAY,EAAE,OAAO,GAAG,mCAAmC,GAAG,iCAAa,aAAa,CAAC,EAAE;AACnH,MAAI,eAAe,WAAW,MAAM,CAAC,wBAAQ,OAAO,gBAAgB,aAAa,SAAS,EAAG,OAAM,IAAI,MAAM,yDAAyD;AAEtK,SAAO,EAAE,eAAuE,MAAsE;AACxJ;AAGO,SAAS,wBAAwB,WAA+B;AACrE,MAAI,UAAU,WAAW,GAAI,OAAM,IAAI,MAAM,kEAAkE;AAC/G,QAAM,WAAW,IAAI,WAAW,EAAE;AAClC,WAAS,IAAI,CAAC,KAAM,CAAI,CAAC;AACzB,WAAS,IAAI,WAAW,CAAC;AACzB,QAAM,MAAM,WAAW,UAAU,OAAO,QAAQ,CAAC;AACjD,SAAO,GAAG,GAAG,IAAI,IAAI,MAAM,WAAW,MAAM,CAAC;AAC/C;;;ACxJO,IAAM,iCAAN,MAAyE;AAAA,EAAzE;AACL,SAAiB,UAAU,oBAAI,IAA+B;AAAA;AAAA,EAE9D,MAAM,IAAI,QAA0C;AAClD,SAAK,QAAQ,IAAI,OAAO,SAAS,MAAM;AAAA,EACzC;AAAA,EAEA,MAAM,OAA8C;AAClD,WAAO,CAAC,GAAG,KAAK,QAAQ,OAAO,CAAC;AAAA,EAClC;AAAA,EAEA,MAAM,IAAI,SAAyD;AACjE,WAAO,KAAK,QAAQ,IAAI,OAAO;AAAA,EACjC;AAAA,EAEA,MAAM,OAAO,SAAgC;AAC3C,SAAK,QAAQ,OAAO,OAAO;AAAA,EAC7B;AACF;AAEO,IAAM,8BAAN,MAAmE;AAAA,EAAnE;AACL,SAAiB,OAAO,oBAAI,IAAkC;AAAA;AAAA,EAE9D,MAAM,IAAI,SAAiB,KAA0C;AACnE,SAAK,KAAK,IAAI,SAAS,GAAG;AAAA,EAC5B;AAAA,EAEA,MAAM,IAAI,SAA4D;AACpE,WAAO,KAAK,KAAK,IAAI,OAAO;AAAA,EAC9B;AAAA,EAEA,MAAM,OAAO,SAAgC;AAC3C,SAAK,KAAK,OAAO,OAAO;AAAA,EAC1B;AACF;AAgBO,IAAM,mBAAN,MAAuB;AAAA,EAK5B,YAAY,SAAkC;AAC5C,SAAK,UAAU,QAAQ;AACvB,SAAK,OAAO,QAAQ;AACpB,SAAK,MAAM,QAAQ,QAAQ,MAAM,oBAAI,KAAK;AAAA,EAC5C;AAAA;AAAA,EAGA,MAAM,KAAK,SAA8C,KAAoD;AAC3G,UAAM,eAAe,QAAQ;AAC7B,QAAI,aAAa,gBAAgB,IAAI,IAAK,OAAM,IAAI,MAAM,iDAAiD;AAC3G,UAAM,SAA4B;AAAA,MAChC,SAAS,aAAa;AAAA,MACtB,iBAAiB,aAAa;AAAA,MAC9B,WAAW,aAAa;AAAA,MACxB,oBAAoB,aAAa;AAAA,MACjC,0BAA0B,aAAa;AAAA,MACvC,aAAa,aAAa;AAAA,MAC1B,UAAU,aAAa;AAAA,MACvB,aAAa,aAAa;AAAA,MAC1B,QAAQ,aAAa;AAAA,MACrB,UAAU,aAAa;AAAA,MACvB,SAAS,aAAa;AAAA,MACtB,kBAAkB,aAAa;AAAA,MAC/B,cAAc,aAAa;AAAA,MAC3B,WAAW,aAAa;AAAA,IAC1B;AACA,UAAM,KAAK,QAAQ,IAAI,MAAM;AAC7B,UAAM,KAAK,KAAK,IAAI,OAAO,SAAS,EAAE,WAAW,IAAI,WAAW,WAAW,IAAI,WAAW,aAAa,IAAI,YAAY,CAAC;AACxH,WAAO;AAAA,EACT;AAAA;AAAA,EAGA,MAAM,KAAK,SAA2H;AACpI,UAAM,MAAM,KAAK,IAAI,EAAE,QAAQ;AAC/B,UAAM,UAAU,MAAM,KAAK,QAAQ,KAAK;AACxC,WAAO,QACJ,OAAO,CAAC,YAAY,SAAS,kBAAkB,UAAU,OAAO,cAAc,MAAS,EACvF,OAAO,CAAC,YAAY,SAAS,kBAAkB,UAAU,KAAK,MAAM,OAAO,SAAS,IAAI,GAAG,EAC3F,KAAK,CAAC,MAAM,UAAU,KAAK,MAAM,MAAM,YAAY,IAAI,KAAK,MAAM,KAAK,YAAY,CAAC;AAAA,EACzF;AAAA,EAEA,MAAM,IAAI,SAAyD;AACjE,WAAO,KAAK,QAAQ,IAAI,OAAO;AAAA,EACjC;AAAA;AAAA,EAGA,MAAM,QAAQ,SAAyD;AACrE,UAAM,SAAS,MAAM,KAAK,KAAK,IAAI,OAAO;AAC1C,QAAI,WAAW,OAAW,QAAO;AACjC,WAAO,yBAAyB;AAAA,MAC9B,YAAY,OAAO;AAAA,MACnB,WAAW,OAAO;AAAA,MAClB,aAAa,OAAO;AAAA,IACtB,CAAC;AAAA,EACH;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EASA,MAAM,iBAAiB,SAAiB,OAAoD;AAC1F,UAAM,SAAS,MAAM,KAAK,QAAQ,IAAI,OAAO;AAC7C,QAAI,WAAW,OAAW,OAAM,IAAI,MAAM,kBAAkB,OAAO,EAAE;AACrE,WAAO,UAAU,WAAW,OAAO,2BAA2B,OAAO;AAAA,EACvE;AAAA;AAAA,EAGA,MAAM,YAAY,SAAiB,YAAoB,KAAK,IAAI,EAAE,YAAY,GAA+B;AAC3G,UAAM,SAAS,MAAM,KAAK,QAAQ,IAAI,OAAO;AAC7C,QAAI,WAAW,OAAW,OAAM,IAAI,MAAM,kBAAkB,OAAO,EAAE;AACrE,UAAM,UAA6B,EAAE,GAAG,QAAQ,UAAU;AAC1D,UAAM,KAAK,QAAQ,IAAI,OAAO;AAC9B,WAAO;AAAA,EACT;AAAA;AAAA,EAGA,MAAM,OAAO,SAAgC;AAC3C,UAAM,KAAK,QAAQ,OAAO,OAAO;AACjC,UAAM,KAAK,KAAK,OAAO,OAAO;AAAA,EAChC;AACF;;;A5CPA,uBAgBO;AAqEP,IAAAC,oBAMO;","names":["code","cid","import_zod","name","encode","length","i","j","decode","name","bytes","encode","decode","alphabet","encode","decode","identity_exports","identity","encode","decode","decode","code","code","digest","bytes","decode","equals","code","encode","identity","from","name","code","encode","digest","name","from","base","bytes","cid","baseCache","code","bytes","digest","equals","base","decode","length","cache","identity_exports","import_ed25519","import_sdk_services","import_ed25519","import_sha256","code","bytes","digest","cid","matcher","actions","resource","source","resourceValue","key","import_sha256","digest","bytes","cid","code","import_zod","import_zod","import_sha256","import_blake3","import_ed25519","import_zod","code","output","length","code","equalBytes","cid","bytes","DEFAULT_MAX_ARTIFACT_BYTES","code","base64UrlToBytes","bytes","bytesToBase64Url","result","base","value","name","digest","cid","location","createError","code","name","base64","import_ed25519","import_sha256","import_ed25519","import_viem","textEncoder","objectHasOwn","digest","length","value","digest","import_ed25519","assertObject","fromB64","import_share_sdk"]}