@tinycloud/sdk-core 2.6.3-beta.0 → 2.7.0-beta.2

package/dist/policy/index.cjs.map

@@ -0,0 +1 @@
+{"version":3,"sources":["../../src/policy/index.ts","../../src/policy/errors.ts","../../src/policy/jcs.ts","../../src/policy/capability.ts","../../src/policy/signed-object.ts","../../src/identity.ts","../../src/policy/authoring.ts"],"sourcesContent":["export {\n  SignatureMaterialError,\n  SignatureVerificationError,\n  SignedObjectCanonicalizationError,\n  SignedObjectDigestError,\n  SignedObjectIdError,\n  SignedObjectProfileError,\n  SignedObjectSchemaError,\n  SigningKeyBindingError,\n  UnsupportedSignatureSuiteError,\n  toSignedObjectError,\n  type SignedObjectErrorCode,\n} from \"./errors\";\n\nexport {\n  jcsCanonicalize,\n  normalizeJson,\n  serialize as serializeJcsJson,\n  type JsonValue,\n} from \"./jcs\";\n\nexport {\n  PolicyCapabilityError,\n  canonicalizePolicyCapability,\n  normalizePolicyCapability,\n  policyCapabilityContains,\n  policyCapabilityDigestHex,\n  type PolicyCapability,\n  type PolicyCapabilityErrorCode,\n} from \"./capability\";\n\nexport {\n  POLICY_VERSION_V0,\n  OWNER_NODE_ENDPOINT_SCHEMA,\n  PolicyAuthoringError,\n  TRANSCRIPT_SHARE_BOOTSTRAP_SCHEMA,\n  W3C_VC_CREDENTIAL_VERIFIER,\n  composeTranscriptShareBootstrap,\n  createAndSignRequesterPolicyEngineRecord,\n  createAndSignTranscriptSharePolicy,\n  createUnsignedPolicyEngineRecord,\n  verifyPolicyEngineRecordForRequester,\n  type ComposeTranscriptShareBootstrapInput,\n  type CreatePolicyEngineRecordInput,\n  type CreateTranscriptSharePolicyInput,\n  type PolicyAuthoringErrorCode,\n  type TranscriptShareBootstrap,\n  type VerifyPolicyEngineRecordOptions,\n} from \"./authoring\";\n\nexport {\n  ED25519_JCS_SIGNATURE_SUITE,\n  EIP191_JCS_SIGNATURE_SUITE,\n  POLICY_ENGINE_RECORD_SCHEMA,\n  POLICY_SCHEMA,\n  POLICY_STATUS_SCHEMA,\n  canonicalizeSignedObjectUnsigned,\n  createAndSignPolicy,\n  createAndSignPolicyEngineRecord,\n  createAndSignPolicyStatus,\n  createAndSignSignedObject,\n  deriveSignedObjectMaterial,\n  signedObjectIdFor,\n  validatePolicyEngineRecordSigned,\n  validatePolicyEngineRecordSignedShape,\n  validatePolicyEngineRecordUnsigned,\n  validatePolicySigned,\n  validatePolicySignedShape,\n  validatePolicyStatusSigned,\n  validatePolicyStatusSignedShape,\n  validatePolicyStatusUnsigned,\n  validatePolicyUnsigned,\n  verifyPolicy,\n  verifyPolicyEngineRecord,\n  verifyPolicyStatus,\n  verifySignedObject,\n  type JsonObject,\n  type Policy,\n  type PolicyEngineRecord,\n  type PolicyStatus,\n  type SignatureSuite,\n  type SignedObjectKind,\n  type SignedObjectMaterial,\n  type SignedObjectSignature,\n  type SignedObjectSigner,\n  type SignedObjectVerificationResult,\n  type SignedPolicyObject,\n  type UnsignedPolicy,\n  type UnsignedPolicyEngineRecord,\n  type UnsignedPolicyObject,\n  type UnsignedPolicyStatus,\n} from \"./signed-object\";\n","export type SignedObjectErrorCode =\n  | \"schema-invalid\"\n  | \"canonicalization-mismatch\"\n  | \"digest-mismatch\"\n  | \"id-mismatch\"\n  | \"signing-key-binding\"\n  | \"signature-material-invalid\"\n  | \"signature-suite-unsupported\"\n  | \"signature-invalid\";\n\nexport class SignedObjectProfileError extends Error {\n  public readonly code: SignedObjectErrorCode;\n\n  constructor(code: SignedObjectErrorCode, message: string) {\n    super(message);\n    this.name = \"SignedObjectProfileError\";\n    this.code = code;\n  }\n}\n\nexport class SignedObjectSchemaError extends SignedObjectProfileError {\n  constructor(message: string) {\n    super(\"schema-invalid\", message);\n    this.name = \"SignedObjectSchemaError\";\n  }\n}\n\nexport class SignedObjectCanonicalizationError extends SignedObjectProfileError {\n  constructor(message: string) {\n    super(\"canonicalization-mismatch\", message);\n    this.name = \"SignedObjectCanonicalizationError\";\n  }\n}\n\nexport class SignedObjectDigestError extends SignedObjectProfileError {\n  constructor(message: string) {\n    super(\"digest-mismatch\", message);\n    this.name = \"SignedObjectDigestError\";\n  }\n}\n\nexport class SignedObjectIdError extends SignedObjectProfileError {\n  constructor(message: string) {\n    super(\"id-mismatch\", message);\n    this.name = \"SignedObjectIdError\";\n  }\n}\n\nexport class SigningKeyBindingError extends SignedObjectProfileError {\n  constructor(message: string) {\n    super(\"signing-key-binding\", message);\n    this.name = \"SigningKeyBindingError\";\n  }\n}\n\nexport class SignatureMaterialError extends SignedObjectProfileError {\n  constructor(message: string) {\n    super(\"signature-material-invalid\", message);\n    this.name = \"SignatureMaterialError\";\n  }\n}\n\nexport class UnsupportedSignatureSuiteError extends SignedObjectProfileError {\n  constructor(message: string) {\n    super(\"signature-suite-unsupported\", message);\n    this.name = \"UnsupportedSignatureSuiteError\";\n  }\n}\n\nexport class SignatureVerificationError extends SignedObjectProfileError {\n  constructor(message: string) {\n    super(\"signature-invalid\", message);\n    this.name = \"SignatureVerificationError\";\n  }\n}\n\nexport function toSignedObjectError(error: unknown): SignedObjectProfileError {\n  if (error instanceof SignedObjectProfileError) {\n    return error;\n  }\n  return new SignedObjectProfileError(\n    \"schema-invalid\",\n    error instanceof Error ? error.message : String(error),\n  );\n}\n","import { SignedObjectCanonicalizationError } from \"./errors\";\n\nexport type JsonValue =\n  | null\n  | boolean\n  | number\n  | string\n  | JsonValue[]\n  | { readonly [key: string]: JsonValue };\n\ntype MutableJsonObject = { [key: string]: JsonValue };\nconst objectHasOwn: (object: object, propertyKey: PropertyKey) => boolean =\n  (Object as ObjectConstructor & {\n    hasOwn?: (object: object, propertyKey: PropertyKey) => boolean;\n  }).hasOwn ??\n  (Object.prototype.hasOwnProperty.call.bind(\n    Object.prototype.hasOwnProperty,\n  ) as (object: object, propertyKey: PropertyKey) => boolean);\n\n/**\n * RFC 8785 JSON Canonicalization Scheme encoder for the signed-object profile.\n *\n * This local encoder is intentionally stricter than JSON.stringify:\n * it rejects non-plain JSON inputs, sparse arrays, undefined/functions/symbols,\n * non-finite numbers, BigInt, dangerous prototype keys, and lone surrogates.\n * Object keys are sorted by Unicode code point before serialization.\n */\nexport function jcsCanonicalize(input: unknown): string {\n  return serialize(normalizeJson(input, \"$\"));\n}\n\nexport function normalizeJson(input: unknown, path = \"$\"): JsonValue {\n  if (input === null) {\n    return null;\n  }\n\n  switch (typeof input) {\n    case \"boolean\":\n      return input;\n    case \"number\":\n      if (!Number.isFinite(input)) {\n        throw new SignedObjectCanonicalizationError(\n          `${path} must be a finite JSON number`,\n        );\n      }\n      return input;\n    case \"string\":\n      assertUnicodeScalarString(input, path);\n      return input;\n    case \"object\":\n      return normalizeJsonObjectOrArray(input, path);\n    case \"bigint\":\n    case \"function\":\n    case \"symbol\":\n    case \"undefined\":\n    default:\n      throw new SignedObjectCanonicalizationError(\n        `${path} is not a JSON value`,\n      );\n  }\n}\n\nexport function serialize(value: JsonValue): string {\n  if (value === null) {\n    return \"null\";\n  }\n\n  switch (typeof value) {\n    case \"boolean\":\n      return value ? \"true\" : \"false\";\n    case \"number\": {\n      const encoded = JSON.stringify(value);\n      if (encoded === undefined) {\n        throw new SignedObjectCanonicalizationError(\n          \"number could not be serialized as JSON\",\n        );\n      }\n      return encoded;\n    }\n    case \"string\":\n      return JSON.stringify(value);\n    case \"object\":\n      if (Array.isArray(value)) {\n        return `[${value.map((item) => serialize(item)).join(\",\")}]`;\n      }\n      return serializeObject(value);\n    default:\n      throw new SignedObjectCanonicalizationError(\n        `unsupported JSON value type ${typeof value}`,\n      );\n  }\n}\n\nfunction normalizeJsonObjectOrArray(input: object, path: string): JsonValue {\n  assertNoSymbolKeys(input, path);\n\n  if (Array.isArray(input)) {\n    for (const key of Object.getOwnPropertyNames(input)) {\n      if (key === \"length\") {\n        continue;\n      }\n      if (!isArrayIndexKey(key, input.length)) {\n        throw new SignedObjectCanonicalizationError(\n          `${path}.${key} is not allowed on a JSON array`,\n        );\n      }\n      const descriptor = Object.getOwnPropertyDescriptor(input, key);\n      if (descriptor?.enumerable !== true) {\n        throw new SignedObjectCanonicalizationError(\n          `${path}[${key}] must be an enumerable JSON array item`,\n        );\n      }\n      if (!(\"value\" in descriptor)) {\n        throw new SignedObjectCanonicalizationError(\n          `${path}[${key}] must be a JSON data property`,\n        );\n      }\n    }\n    const output: JsonValue[] = [];\n    for (let index = 0; index < input.length; index++) {\n      if (!objectHasOwn(input, index)) {\n        throw new SignedObjectCanonicalizationError(\n          `${path}[${index}] must not be a sparse array hole`,\n        );\n      }\n      output.push(normalizeJson(input[index], `${path}[${index}]`));\n    }\n    return output;\n  }\n\n  const proto = Object.getPrototypeOf(input);\n  if (proto !== Object.prototype && proto !== null) {\n    throw new SignedObjectCanonicalizationError(\n      `${path} must be a plain JSON object`,\n    );\n  }\n\n  const output = Object.create(null) as MutableJsonObject;\n  for (const key of Object.getOwnPropertyNames(input)) {\n    assertUnicodeScalarString(key, `${path} key`);\n    if (key === \"__proto__\" || key === \"constructor\") {\n      throw new SignedObjectCanonicalizationError(\n        `${path}.${key} is not allowed`,\n      );\n    }\n    const descriptor = Object.getOwnPropertyDescriptor(input, key);\n    if (descriptor?.enumerable !== true) {\n      throw new SignedObjectCanonicalizationError(\n        `${path}.${key} must be an enumerable JSON object property`,\n      );\n    }\n    if (!(\"value\" in descriptor)) {\n      throw new SignedObjectCanonicalizationError(\n        `${path}.${key} must be a JSON data property`,\n      );\n    }\n    const value = descriptor.value;\n    output[key] = normalizeJson(value, `${path}.${key}`);\n  }\n  return output;\n}\n\nfunction assertNoSymbolKeys(input: object, path: string): void {\n  if (Object.getOwnPropertySymbols(input).length > 0) {\n    throw new SignedObjectCanonicalizationError(\n      `${path} must not have symbol properties`,\n    );\n  }\n}\n\nfunction isArrayIndexKey(key: string, length: number): boolean {\n  if (!/^(0|[1-9]\\d*)$/.test(key)) {\n    return false;\n  }\n  const index = Number(key);\n  return Number.isSafeInteger(index) && index >= 0 && index < length;\n}\n\nfunction serializeObject(value: { readonly [key: string]: JsonValue }): string {\n  const keys = Object.keys(value).sort(compareCodePoints);\n  const parts = keys.map((key) => `${JSON.stringify(key)}:${serialize(value[key])}`);\n  return `{${parts.join(\",\")}}`;\n}\n\nfunction compareCodePoints(a: string, b: string): number {\n  const left = Array.from(a);\n  const right = Array.from(b);\n  const max = Math.min(left.length, right.length);\n  for (let index = 0; index < max; index++) {\n    const leftPoint = left[index].codePointAt(0) ?? 0;\n    const rightPoint = right[index].codePointAt(0) ?? 0;\n    if (leftPoint !== rightPoint) {\n      return leftPoint - rightPoint;\n    }\n  }\n  return left.length - right.length;\n}\n\nfunction assertUnicodeScalarString(value: string, path: string): void {\n  for (let index = 0; index < value.length; index++) {\n    const code = value.charCodeAt(index);\n    if (code >= 0xd800 && code <= 0xdbff) {\n      const next = value.charCodeAt(index + 1);\n      if (Number.isNaN(next) || next < 0xdc00 || next > 0xdfff) {\n        throw new SignedObjectCanonicalizationError(\n          `${path} contains a lone high surrogate`,\n        );\n      }\n      index++;\n      continue;\n    }\n    if (code >= 0xdc00 && code <= 0xdfff) {\n      throw new SignedObjectCanonicalizationError(\n        `${path} contains a lone low surrogate`,\n      );\n    }\n  }\n}\n","import { CAPABILITY_REGISTRY } from \"@tinycloud/bootstrap\";\nimport { bytesToHex, sha256 } from \"viem\";\nimport { jcsCanonicalize, normalizeJson, type JsonValue } from \"./jcs\";\n\nconst POLICY_CAPABILITY_DOMAIN = \"xyz.tinycloud.policy/PolicyCapability/v0\";\nconst textEncoder = new TextEncoder();\n\nexport type PolicyCapabilityErrorCode =\n  | \"policy-capability-malformed\"\n  | \"policy-capability-unknown-key\"\n  | \"policy-capability-malformed-service\"\n  | \"policy-capability-malformed-space\"\n  | \"policy-capability-malformed-path\"\n  | \"policy-capability-malformed-action\"\n  | \"policy-capability-empty-actions\"\n  | \"policy-capability-malformed-caveats\";\n\nexport class PolicyCapabilityError extends Error {\n  public readonly code: PolicyCapabilityErrorCode;\n\n  constructor(code: PolicyCapabilityErrorCode, message: string) {\n    super(message);\n    this.name = \"PolicyCapabilityError\";\n    this.code = code;\n  }\n}\n\nexport interface PolicyCapability {\n  readonly service: \"tinycloud.kv\" | \"tinycloud.sql\" | \"tinycloud.vfs\";\n  readonly space: string;\n  readonly path: string;\n  readonly actions: readonly string[];\n  readonly caveats?: JsonObject;\n}\n\nexport type JsonObject = { readonly [key: string]: JsonValue };\n\ninterface NormalizeOptions {\n  readonly allowPrefixPaths?: boolean;\n  readonly requireCanonical?: boolean;\n}\n\nconst objectHasOwn: (object: object, propertyKey: PropertyKey) => boolean =\n  (Object as ObjectConstructor & {\n    hasOwn?: (object: object, propertyKey: PropertyKey) => boolean;\n  }).hasOwn ??\n  (Object.prototype.hasOwnProperty.call.bind(\n    Object.prototype.hasOwnProperty,\n  ) as (object: object, propertyKey: PropertyKey) => boolean);\n\nconst CEILING_SERVICES = new Set([\"tinycloud.kv\", \"tinycloud.sql\", \"tinycloud.vfs\"]);\nconst GRANTABLE_ACTIONS = new Map<string, ReadonlySet<string>>();\n\nfor (const entry of CAPABILITY_REGISTRY) {\n  if (!CEILING_SERVICES.has(entry.service)) {\n    continue;\n  }\n  if (entry.aliasOf !== undefined || entry.implies !== undefined || entry.urn.endsWith(\"/*\")) {\n    continue;\n  }\n  const existing = GRANTABLE_ACTIONS.get(entry.service);\n  if (existing === undefined) {\n    GRANTABLE_ACTIONS.set(entry.service, new Set([entry.urn]));\n    continue;\n  }\n  (existing as Set<string>).add(entry.urn);\n}\n\n/**\n * Strict authoring validator for resolved Listen-adapter PolicyCapability JSON.\n * It accepts only concrete service/space/path/action/caveat forms and rejects\n * manifest-shaped permission payloads before any Policy is signed.\n */\nexport function normalizePolicyCapability(input: unknown): PolicyCapability {\n  return normalizePolicyCapabilityWithOptions(input, { requireCanonical: true });\n}\n\n/**\n * Frozen-vector canonicalizer for the m1-b-01a policy-capability vectors.\n * Prefix paths are allowed here only to preserve behavioral conformance with\n * the vendored engine vectors; authoring uses normalizePolicyCapability.\n */\nexport function canonicalizePolicyCapability(input: unknown): PolicyCapability {\n  return normalizePolicyCapabilityWithOptions(input, { allowPrefixPaths: true });\n}\n\nexport function policyCapabilityDigestHex(input: unknown): string {\n  const canonical = canonicalizePolicyCapability(input);\n  const jcs = textEncoder.encode(jcsCanonicalize(canonical));\n  const domain = textEncoder.encode(`${POLICY_CAPABILITY_DOMAIN}\\0`);\n  const bytes = new Uint8Array(domain.length + jcs.length);\n  bytes.set(domain, 0);\n  bytes.set(jcs, domain.length);\n  return bytesToHex(sha256(bytes, \"bytes\")).slice(2);\n}\n\nexport function policyCapabilityContains(authority: unknown, request: unknown): boolean {\n  let auth: PolicyCapability;\n  let req: PolicyCapability;\n  try {\n    auth = canonicalizePolicyCapability(authority);\n    req = canonicalizePolicyCapability(request);\n  } catch {\n    return false;\n  }\n  if (auth.service !== req.service || auth.space !== req.space) {\n    return false;\n  }\n  if (!pathContains(auth.path, req.path)) {\n    return false;\n  }\n  const authActions = new Set(auth.actions);\n  for (const action of req.actions) {\n    if (!authActions.has(action)) {\n      return false;\n    }\n  }\n  return caveatsContain(auth.caveats, req.caveats);\n}\n\nfunction normalizePolicyCapabilityWithOptions(\n  input: unknown,\n  options: NormalizeOptions,\n): PolicyCapability {\n  const object = expectObject(input, \"$\");\n  assertExactKeys(object, [\"service\", \"space\", \"path\", \"actions\", \"caveats\"], \"$\");\n  const service = requiredString(object, \"service\", \"$\", \"policy-capability-malformed-service\");\n  if (!CEILING_SERVICES.has(service)) {\n    throw new PolicyCapabilityError(\n      \"policy-capability-malformed-service\",\n      \"$.service is outside the frozen permissionsCeiling vocabulary\",\n    );\n  }\n  const space = requiredString(object, \"space\", \"$\", \"policy-capability-malformed-space\");\n  validateConcreteSpace(space);\n  const canonicalSpace = space.normalize(\"NFC\");\n  if (options.requireCanonical && canonicalSpace !== space) {\n    throw new PolicyCapabilityError(\n      \"policy-capability-malformed-space\",\n      \"$.space must already be canonical NFC\",\n    );\n  }\n  const rawPath = requiredString(object, \"path\", \"$\", \"policy-capability-malformed-path\");\n  validateRawPath(rawPath, options);\n  const path = normalizePath(rawPath);\n  if (options.requireCanonical && path !== rawPath) {\n    throw new PolicyCapabilityError(\n      \"policy-capability-malformed-path\",\n      \"$.path must already be canonical\",\n    );\n  }\n  validateRawPath(path, options);\n  const actions = normalizeActions(\n    requiredArray(object, \"actions\", \"$\", \"policy-capability-malformed-action\"),\n    service,\n    options,\n  );\n  const output = Object.create(null) as {\n    service: PolicyCapability[\"service\"];\n    space: string;\n    path: string;\n    actions: string[];\n    caveats?: JsonObject;\n  };\n  output.service = service as PolicyCapability[\"service\"];\n  output.space = canonicalSpace;\n  output.path = path;\n  output.actions = actions;\n  if (hasOwn(object, \"caveats\")) {\n    output.caveats = validateCaveats(\n      requiredValue(object, \"caveats\", \"$\", \"policy-capability-malformed-caveats\"),\n      output.service,\n    );\n  }\n  return output;\n}\n\nfunction expectObject(input: unknown, path: string): JsonObject {\n  try {\n    const normalized = normalizeJson(input);\n    if (normalized === null || typeof normalized !== \"object\" || Array.isArray(normalized)) {\n      throw new PolicyCapabilityError(\"policy-capability-malformed\", `${path} must be an object`);\n    }\n    return normalized as JsonObject;\n  } catch (error) {\n    if (error instanceof PolicyCapabilityError) {\n      throw error;\n    }\n    throw new PolicyCapabilityError(\n      \"policy-capability-malformed\",\n      error instanceof Error ? error.message : String(error),\n    );\n  }\n}\n\nfunction assertExactKeys(object: JsonObject, allowed: readonly string[], path: string): void {\n  const allowedSet = new Set(allowed);\n  for (const key of Object.keys(object)) {\n    if (!allowedSet.has(key)) {\n      throw new PolicyCapabilityError(\n        key === \"id\" || key === \"scope\" ? \"policy-capability-malformed\" : \"policy-capability-unknown-key\",\n        `${path} has unknown field ${key}`,\n      );\n    }\n  }\n}\n\nfunction requiredValue(\n  object: JsonObject,\n  key: string,\n  path: string,\n  code: PolicyCapabilityErrorCode,\n): JsonValue {\n  if (!hasOwn(object, key)) {\n    throw new PolicyCapabilityError(code, `${path}.${key} is required`);\n  }\n  return object[key];\n}\n\nfunction requiredString(\n  object: JsonObject,\n  key: string,\n  path: string,\n  code: PolicyCapabilityErrorCode,\n): string {\n  const value = requiredValue(object, key, path, code);\n  if (typeof value !== \"string\" || value.length === 0) {\n    throw new PolicyCapabilityError(code, `${path}.${key} must be a non-empty string`);\n  }\n  return value;\n}\n\nfunction requiredArray(\n  object: JsonObject,\n  key: string,\n  path: string,\n  code: PolicyCapabilityErrorCode,\n): readonly JsonValue[] {\n  const value = requiredValue(object, key, path, code);\n  if (!Array.isArray(value)) {\n    throw new PolicyCapabilityError(code, `${path}.${key} must be an array`);\n  }\n  return value;\n}\n\nfunction validateConcreteSpace(space: string): void {\n  if (space === \"*\" || space.includes(\"*\") || space.includes(\"?\") || space.includes(\"/\")) {\n    throw new PolicyCapabilityError(\n      \"policy-capability-malformed-space\",\n      \"$.space must be concrete\",\n    );\n  }\n}\n\nfunction validateRawPath(path: string, options: NormalizeOptions): void {\n  if (path.length === 0) {\n    throw new PolicyCapabilityError(\"policy-capability-malformed-path\", \"$.path is empty\");\n  }\n  if (!options.allowPrefixPaths && path.endsWith(\"/\")) {\n    throw new PolicyCapabilityError(\n      \"policy-capability-malformed-path\",\n      \"$.path must be an exact concrete path, not a prefix\",\n    );\n  }\n  if (path.endsWith(\"/*\") || path.includes(\"**\")) {\n    throw new PolicyCapabilityError(\"policy-capability-malformed-path\", \"$.path is a prefix form\");\n  }\n  const segments = path.split(\"/\");\n  for (let index = 0; index < segments.length; index++) {\n    const segment = segments[index]!;\n    const isTrailingPrefixSegment =\n      options.allowPrefixPaths && index === segments.length - 1 && segment.length === 0;\n    if (segment.length === 0 && !isTrailingPrefixSegment) {\n      throw new PolicyCapabilityError(\"policy-capability-malformed-path\", \"$.path has an empty segment\");\n    }\n    if (segment === \".\" || segment === \"..\") {\n      throw new PolicyCapabilityError(\n        \"policy-capability-malformed-path\",\n        \"$.path has a traversal segment\",\n      );\n    }\n    if (segment === \"*\" || segment === \"?\" || segment.includes(\"*\") || segment.includes(\"?\")) {\n      throw new PolicyCapabilityError(\n        \"policy-capability-malformed-path\",\n        \"$.path has a wildcard segment\",\n      );\n    }\n  }\n}\n\nfunction normalizePath(path: string): string {\n  return decodeUnreserved(path).normalize(\"NFC\");\n}\n\nfunction decodeUnreserved(path: string): string {\n  return path.replace(/%[0-9A-Fa-f]{2}/g, (encoded) => {\n    const char = String.fromCharCode(Number.parseInt(encoded.slice(1), 16));\n    return /^[A-Za-z0-9._~-]$/.test(char) ? char : encoded.toUpperCase();\n  });\n}\n\nfunction normalizeActions(\n  actions: readonly JsonValue[],\n  service: string,\n  options: NormalizeOptions,\n): string[] {\n  const accepted = GRANTABLE_ACTIONS.get(service);\n  if (accepted === undefined) {\n    throw new PolicyCapabilityError(\n      \"policy-capability-malformed-service\",\n      \"$.service is unsupported\",\n    );\n  }\n  const unique = new Set<string>();\n  const rawActions: string[] = [];\n  for (let index = 0; index < actions.length; index++) {\n    const action = actions[index];\n    if (typeof action !== \"string\" || action.length === 0) {\n      throw new PolicyCapabilityError(\n        \"policy-capability-malformed-action\",\n        `$.actions[${index}] must be a non-empty action URN`,\n      );\n    }\n    if (!action.startsWith(`${service}/`) || action.includes(\"*\") || !accepted.has(action)) {\n      throw new PolicyCapabilityError(\n        \"policy-capability-malformed-action\",\n        `$.actions[${index}] is not a grantable action URN`,\n      );\n    }\n    rawActions.push(action);\n    unique.add(action);\n  }\n  if (unique.size === 0) {\n    throw new PolicyCapabilityError(\n      \"policy-capability-empty-actions\",\n      \"$.actions must not be empty\",\n    );\n  }\n  const normalizedActions = [...unique].sort();\n  if (\n    options.requireCanonical &&\n    (rawActions.length !== normalizedActions.length ||\n      rawActions.some((action, index) => action !== normalizedActions[index]))\n  ) {\n    throw new PolicyCapabilityError(\n      \"policy-capability-malformed-action\",\n      \"$.actions must already be sorted, deduplicated canonical action URNs\",\n    );\n  }\n  return normalizedActions;\n}\n\nfunction validateCaveats(input: JsonValue, service: PolicyCapability[\"service\"]): JsonObject {\n  if (input === null || typeof input !== \"object\" || Array.isArray(input)) {\n    throw new PolicyCapabilityError(\n      \"policy-capability-malformed-caveats\",\n      \"$.caveats must be an object\",\n    );\n  }\n  if (service === \"tinycloud.sql\") {\n    return validateSqlCaveats(input as JsonObject);\n  }\n  throw new PolicyCapabilityError(\n    \"policy-capability-malformed-caveats\",\n    \"$.caveats are not defined for this service\",\n  );\n}\n\nfunction validateSqlCaveats(input: JsonObject): JsonObject {\n  assertCaveatKeys(input, [\"mode\", \"readOnly\", \"statements\"], \"$.caveats\");\n  const mode = caveatString(input, \"mode\", \"$.caveats\");\n  if (mode !== \"constrained-statements\") {\n    throw new PolicyCapabilityError(\n      \"policy-capability-malformed-caveats\",\n      \"$.caveats.mode is unsupported\",\n    );\n  }\n  if (requiredCaveat(input, \"readOnly\", \"$.caveats\") !== true) {\n    throw new PolicyCapabilityError(\n      \"policy-capability-malformed-caveats\",\n      \"$.caveats.readOnly must be true\",\n    );\n  }\n  const statements = requiredCaveat(input, \"statements\", \"$.caveats\");\n  if (!Array.isArray(statements) || statements.length === 0) {\n    throw new PolicyCapabilityError(\n      \"policy-capability-malformed-caveats\",\n      \"$.caveats.statements must be a non-empty array\",\n    );\n  }\n  for (let index = 0; index < statements.length; index++) {\n    validateSqlStatement(statements[index], `$.caveats.statements[${index}]`);\n  }\n  return input;\n}\n\nfunction validateSqlStatement(input: JsonValue, path: string): void {\n  if (input === null || typeof input !== \"object\" || Array.isArray(input)) {\n    throw new PolicyCapabilityError(\"policy-capability-malformed-caveats\", `${path} must be an object`);\n  }\n  const object = input as JsonObject;\n  assertCaveatKeys(object, [\"name\", \"sql\", \"fixedParams\"], path);\n  caveatString(object, \"name\", path);\n  caveatString(object, \"sql\", path);\n  const fixedParams = requiredCaveat(object, \"fixedParams\", path);\n  if (!Array.isArray(fixedParams)) {\n    throw new PolicyCapabilityError(\n      \"policy-capability-malformed-caveats\",\n      `${path}.fixedParams must be an array`,\n    );\n  }\n  for (let index = 0; index < fixedParams.length; index++) {\n    validateFixedParam(fixedParams[index], `${path}.fixedParams[${index}]`);\n  }\n}\n\nfunction validateFixedParam(input: JsonValue, path: string): void {\n  if (input === null || typeof input !== \"object\" || Array.isArray(input)) {\n    throw new PolicyCapabilityError(\"policy-capability-malformed-caveats\", `${path} must be an object`);\n  }\n  const object = input as JsonObject;\n  assertCaveatKeys(object, [\"index\", \"value\"], path);\n  const index = requiredCaveat(object, \"index\", path);\n  if (typeof index !== \"number\" || !Number.isSafeInteger(index) || index < 0) {\n    throw new PolicyCapabilityError(\n      \"policy-capability-malformed-caveats\",\n      `${path}.index must be a non-negative integer`,\n    );\n  }\n  requiredCaveat(object, \"value\", path);\n}\n\nfunction assertCaveatKeys(object: JsonObject, allowed: readonly string[], path: string): void {\n  const allowedSet = new Set(allowed);\n  for (const key of Object.keys(object)) {\n    if (!allowedSet.has(key)) {\n      throw new PolicyCapabilityError(\n        \"policy-capability-malformed-caveats\",\n        `${path} has unknown field ${key}`,\n      );\n    }\n  }\n}\n\nfunction requiredCaveat(object: JsonObject, key: string, path: string): JsonValue {\n  if (!hasOwn(object, key)) {\n    throw new PolicyCapabilityError(\n      \"policy-capability-malformed-caveats\",\n      `${path}.${key} is required`,\n    );\n  }\n  return object[key];\n}\n\nfunction caveatString(object: JsonObject, key: string, path: string): string {\n  const value = requiredCaveat(object, key, path);\n  if (typeof value !== \"string\" || value.length === 0) {\n    throw new PolicyCapabilityError(\n      \"policy-capability-malformed-caveats\",\n      `${path}.${key} must be a non-empty string`,\n    );\n  }\n  return value;\n}\n\nfunction pathContains(authority: string, request: string): boolean {\n  if (authority === request) {\n    return true;\n  }\n  return authority.endsWith(\"/\") && request.startsWith(authority);\n}\n\nfunction caveatsContain(authority: JsonObject | undefined, request: JsonObject | undefined): boolean {\n  if (authority === undefined) {\n    return request === undefined;\n  }\n  if (request === undefined) {\n    return Object.keys(authority).length === 0;\n  }\n  if (authority.mode !== \"constrained-statements\" || request.mode !== \"constrained-statements\") {\n    return false;\n  }\n  const authorityStatements = Array.isArray(authority.statements) ? authority.statements : [];\n  const requestStatements = Array.isArray(request.statements) ? request.statements : [];\n  return requestStatements.every((statement) =>\n    authorityStatements.some((candidate) => jcsCanonicalize(candidate) === jcsCanonicalize(statement)),\n  );\n}\n\nfunction hasOwn(object: JsonObject, key: string): boolean {\n  return objectHasOwn(object, key);\n}\n","import { ed25519 } from \"@noble/curves/ed25519\";\nimport { bases } from \"multiformats/basics\";\nimport { bytesToHex, sha256, verifyMessage } from \"viem\";\nimport { parsePkhDid } from \"../identity\";\nimport { canonicalizePolicyCapability, normalizePolicyCapability } from \"./capability\";\nimport {\n  SignatureMaterialError,\n  SignatureVerificationError,\n  SignedObjectDigestError,\n  SignedObjectIdError,\n  SignedObjectProfileError,\n  SignedObjectSchemaError,\n  SigningKeyBindingError,\n  UnsupportedSignatureSuiteError,\n  toSignedObjectError,\n} from \"./errors\";\nimport { type JsonValue, jcsCanonicalize, normalizeJson } from \"./jcs\";\n\nexport const POLICY_SCHEMA = \"xyz.tinycloud.policy/policy/v0\";\nexport const POLICY_STATUS_SCHEMA = \"xyz.tinycloud.policy/status/v0\";\nexport const POLICY_ENGINE_RECORD_SCHEMA =\n  \"xyz.tinycloud.policy/engine-record/v0\";\n\nexport const ED25519_JCS_SIGNATURE_SUITE = \"eddsa-ed25519-sha256-jcs-v1\";\nexport const EIP191_JCS_SIGNATURE_SUITE =\n  \"eip191-secp256k1-sha256-jcs-v1\";\n\nexport type SignedObjectKind = \"Policy\" | \"PolicyStatus\" | \"PolicyEngineRecord\";\n\nexport type SignatureSuite =\n  | typeof ED25519_JCS_SIGNATURE_SUITE\n  | typeof EIP191_JCS_SIGNATURE_SUITE;\n\nexport interface SignedObjectSignature {\n  suite: SignatureSuite;\n  signerDid: string;\n  value: string;\n}\n\nexport type JsonObject = { readonly [key: string]: JsonValue };\n\nexport interface Policy {\n  readonly schema: typeof POLICY_SCHEMA;\n  readonly policyId: string;\n  readonly ownerDid: string;\n  readonly signingKeyDid: string;\n  readonly createdAt: string;\n  readonly expiresAt?: string;\n  readonly resource: JsonObject;\n  readonly when: JsonObject;\n  readonly grant: JsonObject;\n  readonly disclosure?: JsonObject;\n  readonly audit?: JsonObject;\n  readonly signature: SignedObjectSignature;\n}\n\nexport type UnsignedPolicy = Omit<Policy, \"policyId\" | \"signature\">;\n\nexport interface PolicyStatus {\n  readonly schema: typeof POLICY_STATUS_SCHEMA;\n  readonly statusId: string;\n  readonly policyId: string;\n  readonly ownerDid: string;\n  readonly sequence: number;\n  readonly disposition: \"active\" | \"suspended\" | \"revoked\";\n  readonly effectiveAt: string;\n  readonly reasonCode?: string;\n  readonly signingKeyDid: string;\n  readonly signature: SignedObjectSignature;\n}\n\nexport type UnsignedPolicyStatus = Omit<PolicyStatus, \"statusId\" | \"signature\">;\n\nexport interface PolicyEngineRecord {\n  readonly schema: typeof POLICY_ENGINE_RECORD_SCHEMA;\n  readonly engineRecordId: string;\n  readonly ownerDid: string;\n  readonly endpoint: string;\n  readonly audience: string;\n  readonly supportedPolicyVersions: string[];\n  readonly supportedEvidenceVerifiers: string[];\n  readonly grantIssuerDid: string;\n  readonly expiresAt: string;\n  readonly signature: SignedObjectSignature;\n}\n\nexport type UnsignedPolicyEngineRecord = Omit<\n  PolicyEngineRecord,\n  \"engineRecordId\" | \"signature\"\n>;\n\nexport type SignedPolicyObject =\n  | Policy\n  | PolicyStatus\n  | PolicyEngineRecord;\n\nexport type UnsignedPolicyObject =\n  | UnsignedPolicy\n  | UnsignedPolicyStatus\n  | UnsignedPolicyEngineRecord;\n\nexport interface SignedObjectSigner {\n  readonly suite: SignatureSuite;\n  readonly signerDid: string;\n  signDigest(digest: Uint8Array): Promise<Uint8Array | string> | Uint8Array | string;\n}\n\nexport interface SignedObjectMaterial {\n  readonly kind: SignedObjectKind;\n  readonly idField: string;\n  readonly id: string;\n  readonly domain: string;\n  readonly unsigned: JsonObject;\n  readonly jcs: string;\n  readonly jcsBytes: Uint8Array;\n  readonly digest: Uint8Array;\n  readonly digestHex: string;\n}\n\nexport type SignedObjectVerificationResult<T extends SignedPolicyObject> =\n  | { readonly ok: true; readonly object: T; readonly material: SignedObjectMaterial }\n  | { readonly ok: false; readonly error: SignedObjectProfileError };\n\ninterface ObjectDescriptor {\n  readonly kind: SignedObjectKind;\n  readonly schema: string;\n  readonly idField: \"policyId\" | \"statusId\" | \"engineRecordId\";\n  readonly idPrefix: string;\n  readonly domain: string;\n}\n\nconst DESCRIPTORS: Record<SignedObjectKind, ObjectDescriptor> = {\n  Policy: {\n    kind: \"Policy\",\n    schema: POLICY_SCHEMA,\n    idField: \"policyId\",\n    idPrefix: \"pol_\",\n    domain: POLICY_SCHEMA,\n  },\n  PolicyStatus: {\n    kind: \"PolicyStatus\",\n    schema: POLICY_STATUS_SCHEMA,\n    idField: \"statusId\",\n    idPrefix: \"polst_\",\n    domain: POLICY_STATUS_SCHEMA,\n  },\n  PolicyEngineRecord: {\n    kind: \"PolicyEngineRecord\",\n    schema: POLICY_ENGINE_RECORD_SCHEMA,\n    idField: \"engineRecordId\",\n    idPrefix: \"peng_\",\n    domain: POLICY_ENGINE_RECORD_SCHEMA,\n  },\n};\n\nconst textEncoder = new TextEncoder();\nconst BASE32_ALPHABET = \"abcdefghijklmnopqrstuvwxyz234567\";\nconst BASE64URL_RE = /^[A-Za-z0-9_-]+$/;\nconst objectHasOwn: (object: object, propertyKey: PropertyKey) => boolean =\n  (Object as ObjectConstructor & {\n    hasOwn?: (object: object, propertyKey: PropertyKey) => boolean;\n  }).hasOwn ??\n  (Object.prototype.hasOwnProperty.call.bind(\n    Object.prototype.hasOwnProperty,\n  ) as (object: object, propertyKey: PropertyKey) => boolean);\n\nexport function canonicalizeSignedObjectUnsigned(input: unknown): string {\n  return jcsCanonicalize(input);\n}\n\nexport function deriveSignedObjectMaterial(input: unknown): SignedObjectMaterial {\n  const descriptor = descriptorForUnsigned(input);\n  const unsigned = validateUnsignedForDescriptor(input, descriptor);\n  return materialForUnsigned(unsigned, descriptor);\n}\n\nexport function signedObjectIdFor(input: unknown): string {\n  return deriveSignedObjectMaterial(input).id;\n}\n\nexport async function createAndSignSignedObject(\n  input: unknown,\n  signer: SignedObjectSigner,\n): Promise<SignedPolicyObject> {\n  const normalized = expectJsonObject(normalizeJson(input), \"$\");\n  const descriptor = descriptorForUnsigned(normalized);\n  const stripped = stripOwnIdAndSignature(normalized, descriptor);\n  const unsigned = validateUnsignedForDescriptor(stripped, descriptor);\n  if (descriptor.kind === \"Policy\") {\n    validatePolicyPermissionsCeilingForSigning(unsigned);\n  }\n  assertSupportedSignatureSuite(signer.suite);\n  requireStringType(signer.signerDid, \"$.signer.signerDid\");\n  assertSignerDidMatchesSuite(signer.signerDid, signer.suite);\n  assertSigningKeyBindingForCreate(unsigned, signer.signerDid);\n  const material = materialForUnsigned(unsigned, descriptor);\n  const signatureValue = encodeSignatureValue(\n    await signer.signDigest(material.digest),\n    signer.suite,\n  );\n  const signature = validateSignature({\n    suite: signer.suite,\n    signerDid: signer.signerDid,\n    value: signatureValue,\n  });\n  return {\n    ...unsigned,\n    [descriptor.idField]: material.id,\n    signature,\n  } as unknown as SignedPolicyObject;\n}\n\nexport function createAndSignPolicy(\n  input: unknown,\n  signer: SignedObjectSigner,\n): Promise<Policy> {\n  return createAndSignSignedObject(input, signer).then((object) =>\n    validatePolicySignedShape(object),\n  );\n}\n\nexport function createAndSignPolicyStatus(\n  input: unknown,\n  signer: SignedObjectSigner,\n): Promise<PolicyStatus> {\n  return createAndSignSignedObject(input, signer).then((object) =>\n    validatePolicyStatusSignedShape(object),\n  );\n}\n\nexport function createAndSignPolicyEngineRecord(\n  input: unknown,\n  signer: SignedObjectSigner,\n): Promise<PolicyEngineRecord> {\n  return createAndSignSignedObject(input, signer).then((object) =>\n    validatePolicyEngineRecordSignedShape(object),\n  );\n}\n\nexport async function verifySignedObject(\n  input: unknown,\n): Promise<{ object: SignedPolicyObject; material: SignedObjectMaterial }> {\n  const signed = validateSignedObjectShape(input);\n  const signedJson = signed as unknown as JsonObject;\n  const descriptor = descriptorForSchema(signed.schema);\n  const signature = validateSignature(signed.signature);\n  assertSigningKeyBindingForVerify(signedJson, signature);\n  const unsigned = stripOwnIdAndSignature(signedJson, descriptor);\n  const material = materialForUnsigned(unsigned, descriptor);\n  assertIdMatches(signedJson, material, descriptor);\n  if (!(await verifySignature(signature, material.digest))) {\n    throw new SignatureVerificationError(\"signature verification failed\");\n  }\n  return { object: signed, material };\n}\n\nexport async function verifyPolicy(\n  input: unknown,\n): Promise<{ object: Policy; material: SignedObjectMaterial }> {\n  const result = await verifySignedObject(input);\n  return {\n    object: validatePolicySignedShape(result.object),\n    material: result.material,\n  };\n}\n\nexport async function verifyPolicyStatus(\n  input: unknown,\n): Promise<{ object: PolicyStatus; material: SignedObjectMaterial }> {\n  const result = await verifySignedObject(input);\n  return {\n    object: validatePolicyStatusSignedShape(result.object),\n    material: result.material,\n  };\n}\n\nexport async function verifyPolicyEngineRecord(\n  input: unknown,\n): Promise<{ object: PolicyEngineRecord; material: SignedObjectMaterial }> {\n  const result = await verifySignedObject(input);\n  return {\n    object: validatePolicyEngineRecordSignedShape(result.object),\n    material: result.material,\n  };\n}\n\nexport async function validatePolicySigned(\n  input: unknown,\n): Promise<SignedObjectVerificationResult<Policy>> {\n  try {\n    const result = await verifyPolicy(input);\n    return { ok: true, object: result.object, material: result.material };\n  } catch (error) {\n    return { ok: false, error: toSignedObjectError(error) };\n  }\n}\n\nexport async function validatePolicyStatusSigned(\n  input: unknown,\n): Promise<SignedObjectVerificationResult<PolicyStatus>> {\n  try {\n    const result = await verifyPolicyStatus(input);\n    return { ok: true, object: result.object, material: result.material };\n  } catch (error) {\n    return { ok: false, error: toSignedObjectError(error) };\n  }\n}\n\nexport async function validatePolicyEngineRecordSigned(\n  input: unknown,\n): Promise<SignedObjectVerificationResult<PolicyEngineRecord>> {\n  try {\n    const result = await verifyPolicyEngineRecord(input);\n    return { ok: true, object: result.object, material: result.material };\n  } catch (error) {\n    return { ok: false, error: toSignedObjectError(error) };\n  }\n}\n\nexport function validatePolicyUnsigned(input: unknown): UnsignedPolicy {\n  return validatePolicyShape(input, false) as unknown as UnsignedPolicy;\n}\n\nexport function validatePolicyStatusUnsigned(input: unknown): UnsignedPolicyStatus {\n  return validatePolicyStatusShape(input, false) as unknown as UnsignedPolicyStatus;\n}\n\nexport function validatePolicyEngineRecordUnsigned(\n  input: unknown,\n): UnsignedPolicyEngineRecord {\n  return validatePolicyEngineRecordShape(input, false) as unknown as UnsignedPolicyEngineRecord;\n}\n\nexport function validatePolicySignedShape(input: unknown): Policy {\n  return validatePolicyShape(input, true) as unknown as Policy;\n}\n\nexport function validatePolicyStatusSignedShape(input: unknown): PolicyStatus {\n  return validatePolicyStatusShape(input, true) as unknown as PolicyStatus;\n}\n\nexport function validatePolicyEngineRecordSignedShape(\n  input: unknown,\n): PolicyEngineRecord {\n  return validatePolicyEngineRecordShape(input, true) as unknown as PolicyEngineRecord;\n}\n\nfunction validateSignedObjectShape(input: unknown): SignedPolicyObject {\n  const normalized = expectJsonObject(normalizeJson(input), \"$\");\n  const schema = requiredString(normalized, \"schema\", \"$\");\n  const descriptor = descriptorForSchema(schema);\n  switch (descriptor.kind) {\n    case \"Policy\":\n      return validatePolicySignedShape(normalized);\n    case \"PolicyStatus\":\n      return validatePolicyStatusSignedShape(normalized);\n    case \"PolicyEngineRecord\":\n      return validatePolicyEngineRecordSignedShape(normalized);\n  }\n}\n\nfunction validateUnsignedForDescriptor(\n  input: unknown,\n  descriptor: ObjectDescriptor,\n): JsonObject {\n  switch (descriptor.kind) {\n    case \"Policy\":\n      return validatePolicyUnsigned(input) as unknown as JsonObject;\n    case \"PolicyStatus\":\n      return validatePolicyStatusUnsigned(input) as unknown as JsonObject;\n    case \"PolicyEngineRecord\":\n      return validatePolicyEngineRecordUnsigned(input) as unknown as JsonObject;\n  }\n}\n\nfunction validatePolicyShape(input: unknown, signed: boolean): JsonObject {\n  const object = expectJsonObject(normalizeJson(input), \"$\");\n  assertExactKeys(\n    object,\n    signed\n      ? [\n          \"schema\",\n          \"policyId\",\n          \"ownerDid\",\n          \"signingKeyDid\",\n          \"createdAt\",\n          \"expiresAt\",\n          \"resource\",\n          \"when\",\n          \"grant\",\n          \"disclosure\",\n          \"audit\",\n          \"signature\",\n        ]\n      : [\n          \"schema\",\n          \"ownerDid\",\n          \"signingKeyDid\",\n          \"createdAt\",\n          \"expiresAt\",\n          \"resource\",\n          \"when\",\n          \"grant\",\n          \"disclosure\",\n          \"audit\",\n        ],\n    \"$\",\n  );\n  expectConst(requiredString(object, \"schema\", \"$\"), POLICY_SCHEMA, \"$.schema\");\n  if (signed) {\n    requiredString(object, \"policyId\", \"$\");\n    validateSignature(requiredValue(object, \"signature\", \"$\"));\n  }\n  requiredString(object, \"ownerDid\", \"$\");\n  requiredString(object, \"signingKeyDid\", \"$\");\n  requiredDateString(object, \"createdAt\", \"$\");\n  optionalDateString(object, \"expiresAt\", \"$\");\n  validatePolicyResource(requiredValue(object, \"resource\", \"$\"), \"$.resource\");\n  validateExpression(requiredValue(object, \"when\", \"$\"), \"$.when\");\n  validateGrant(requiredValue(object, \"grant\", \"$\"), \"$.grant\");\n  if (hasOwn(object, \"disclosure\")) {\n    validateDisclosure(requiredValue(object, \"disclosure\", \"$\"), \"$.disclosure\");\n  }\n  if (hasOwn(object, \"audit\")) {\n    validateAudit(requiredValue(object, \"audit\", \"$\"), \"$.audit\");\n  }\n  return object;\n}\n\nfunction validatePolicyStatusShape(input: unknown, signed: boolean): JsonObject {\n  const object = expectJsonObject(normalizeJson(input), \"$\");\n  assertExactKeys(\n    object,\n    signed\n      ? [\n          \"schema\",\n          \"statusId\",\n          \"policyId\",\n          \"ownerDid\",\n          \"sequence\",\n          \"disposition\",\n          \"effectiveAt\",\n          \"reasonCode\",\n          \"signingKeyDid\",\n          \"signature\",\n        ]\n      : [\n          \"schema\",\n          \"policyId\",\n          \"ownerDid\",\n          \"sequence\",\n          \"disposition\",\n          \"effectiveAt\",\n          \"reasonCode\",\n          \"signingKeyDid\",\n        ],\n    \"$\",\n  );\n  expectConst(requiredString(object, \"schema\", \"$\"), POLICY_STATUS_SCHEMA, \"$.schema\");\n  if (signed) {\n    requiredString(object, \"statusId\", \"$\");\n    validateSignature(requiredValue(object, \"signature\", \"$\"));\n  }\n  requiredString(object, \"policyId\", \"$\");\n  requiredString(object, \"ownerDid\", \"$\");\n  requiredInteger(object, \"sequence\", \"$\", 0);\n  expectOneOf(requiredString(object, \"disposition\", \"$\"), [\n    \"active\",\n    \"suspended\",\n    \"revoked\",\n  ], \"$.disposition\");\n  requiredDateString(object, \"effectiveAt\", \"$\");\n  optionalString(object, \"reasonCode\", \"$\");\n  requiredString(object, \"signingKeyDid\", \"$\");\n  return object;\n}\n\nfunction validatePolicyEngineRecordShape(\n  input: unknown,\n  signed: boolean,\n): JsonObject {\n  const object = expectJsonObject(normalizeJson(input), \"$\");\n  assertExactKeys(\n    object,\n    signed\n      ? [\n          \"schema\",\n          \"engineRecordId\",\n          \"ownerDid\",\n          \"endpoint\",\n          \"audience\",\n          \"supportedPolicyVersions\",\n          \"supportedEvidenceVerifiers\",\n          \"grantIssuerDid\",\n          \"expiresAt\",\n          \"signature\",\n        ]\n      : [\n          \"schema\",\n          \"ownerDid\",\n          \"endpoint\",\n          \"audience\",\n          \"supportedPolicyVersions\",\n          \"supportedEvidenceVerifiers\",\n          \"grantIssuerDid\",\n          \"expiresAt\",\n        ],\n    \"$\",\n  );\n  expectConst(\n    requiredString(object, \"schema\", \"$\"),\n    POLICY_ENGINE_RECORD_SCHEMA,\n    \"$.schema\",\n  );\n  if (signed) {\n    requiredString(object, \"engineRecordId\", \"$\");\n    validateSignature(requiredValue(object, \"signature\", \"$\"));\n  }\n  requiredString(object, \"ownerDid\", \"$\");\n  requiredString(object, \"endpoint\", \"$\");\n  requiredString(object, \"audience\", \"$\");\n  requiredStringArray(object, \"supportedPolicyVersions\", \"$\", (value, path) =>\n    expectConst(value, \"v0\", path),\n  );\n  requiredStringArray(object, \"supportedEvidenceVerifiers\", \"$\");\n  requiredString(object, \"grantIssuerDid\", \"$\");\n  requiredDateString(object, \"expiresAt\", \"$\");\n  return object;\n}\n\nfunction validateSignature(input: unknown): SignedObjectSignature {\n  const object = expectJsonObject(input, \"$.signature\");\n  assertExactKeys(object, [\"suite\", \"signerDid\", \"value\"], \"$.signature\");\n  const suite = requiredString(object, \"suite\", \"$.signature\");\n  assertSupportedSignatureSuite(suite);\n  const signerDid = requiredString(object, \"signerDid\", \"$.signature\");\n  const value = requiredString(object, \"value\", \"$.signature\");\n  decodeSignatureValue(value, suite);\n  return { suite, signerDid, value };\n}\n\nfunction validatePolicyResource(input: unknown, path: string): void {\n  const object = expectJsonObject(input, path);\n  assertExactKeys(object, [\"resourceType\", \"resourceId\", \"permissionsCeiling\"], path);\n  requiredString(object, \"resourceType\", path);\n  requiredString(object, \"resourceId\", path);\n  const ceiling = requiredArray(object, \"permissionsCeiling\", path, 1);\n  for (let index = 0; index < ceiling.length; index++) {\n    validatePolicyCapability(ceiling[index], `${path}.permissionsCeiling[${index}]`);\n  }\n}\n\nfunction validatePolicyPermissionsCeilingForSigning(input: JsonObject): void {\n  const resource = expectJsonObject(requiredValue(input, \"resource\", \"$\"), \"$.resource\");\n  const ceiling = requiredArray(resource, \"permissionsCeiling\", \"$.resource\", 1);\n  for (let index = 0; index < ceiling.length; index++) {\n    validatePolicyCapabilityForSigning(\n      ceiling[index],\n      `$.resource.permissionsCeiling[${index}]`,\n    );\n  }\n}\n\nfunction validatePolicyCapability(input: unknown, path: string): void {\n  const object = expectJsonObject(input, path);\n  try {\n    const canonical = canonicalizePolicyCapability(object);\n    if (jcsCanonicalize(object) !== jcsCanonicalize(canonical)) {\n      throw new SignedObjectSchemaError(`${path} must be canonical PolicyCapability JSON`);\n    }\n  } catch (error) {\n    if (error instanceof SignedObjectSchemaError) {\n      throw error;\n    }\n    throw new SignedObjectSchemaError(\n      error instanceof Error ? error.message : String(error),\n    );\n  }\n}\n\nfunction validatePolicyCapabilityForSigning(input: unknown, path: string): void {\n  const object = expectJsonObject(input, path);\n  try {\n    const canonical = normalizePolicyCapability(object);\n    if (jcsCanonicalize(object) !== jcsCanonicalize(canonical)) {\n      throw new SignedObjectSchemaError(`${path} must be strict canonical PolicyCapability JSON`);\n    }\n  } catch (error) {\n    if (error instanceof SignedObjectSchemaError) {\n      throw error;\n    }\n    throw new SignedObjectSchemaError(\n      error instanceof Error ? error.message : String(error),\n    );\n  }\n}\n\nfunction validateExpression(input: unknown, path: string): void {\n  const object = expectJsonObject(input, path);\n  const keys = Object.keys(object);\n  if (keys.length !== 1) {\n    throw new SignedObjectSchemaError(`${path} must have exactly one expression key`);\n  }\n  const key = keys[0];\n  if (key === \"allOf\" || key === \"anyOf\") {\n    const values = requiredArray(object, key, path, 1);\n    for (let index = 0; index < values.length; index++) {\n      validateExpression(values[index], `${path}.${key}[${index}]`);\n    }\n    return;\n  }\n  if (key === \"subject\") {\n    const subject = expectJsonObject(requiredValue(object, \"subject\", path), `${path}.subject`);\n    assertExactKeys(subject, [\"did\"], `${path}.subject`);\n    requiredString(subject, \"did\", `${path}.subject`);\n    return;\n  }\n  if (key === \"evidence\") {\n    validateEvidenceRequirement(requiredValue(object, \"evidence\", path), `${path}.evidence`);\n    return;\n  }\n  throw new SignedObjectSchemaError(`${path} has unknown expression key ${key}`);\n}\n\nfunction validateEvidenceRequirement(input: unknown, path: string): void {\n  const object = expectJsonObject(input, path);\n  assertExactKeys(\n    object,\n    [\"requirementId\", \"verifier\", \"requirements\", \"authority\", \"freshness\"],\n    path,\n  );\n  requiredString(object, \"requirementId\", path);\n  requiredString(object, \"verifier\", path);\n  requiredValue(object, \"requirements\", path);\n  if (hasOwn(object, \"authority\")) {\n    const authority = expectJsonObject(requiredValue(object, \"authority\", path), `${path}.authority`);\n    assertExactKeys(\n      authority,\n      [\"profile\", \"acceptedIssuers\", \"allowOwnerAuthorizedIssuer\"],\n      `${path}.authority`,\n    );\n    optionalString(authority, \"profile\", `${path}.authority`);\n    if (hasOwn(authority, \"acceptedIssuers\")) {\n      requiredStringArray(authority, \"acceptedIssuers\", `${path}.authority`);\n    }\n    optionalBoolean(authority, \"allowOwnerAuthorizedIssuer\", `${path}.authority`);\n  }\n  if (hasOwn(object, \"freshness\")) {\n    const freshness = expectJsonObject(requiredValue(object, \"freshness\", path), `${path}.freshness`);\n    assertExactKeys(freshness, [\"maxStatusAgeSeconds\"], `${path}.freshness`);\n    requiredInteger(freshness, \"maxStatusAgeSeconds\", `${path}.freshness`, 0);\n  }\n}\n\nfunction validateGrant(input: unknown, path: string): void {\n  const object = expectJsonObject(input, path);\n  assertExactKeys(object, [\"output\", \"maxTtlSeconds\", \"delegationMode\", \"revocation\"], path);\n  expectConst(requiredString(object, \"output\", path), \"portable-delegation\", `${path}.output`);\n  requiredInteger(object, \"maxTtlSeconds\", path, 1);\n  expectOneOf(requiredString(object, \"delegationMode\", path), [\n    \"terminal\",\n    \"attenuable\",\n  ], `${path}.delegationMode`);\n  expectOneOf(requiredString(object, \"revocation\", path), [\n    \"refresh_only\",\n    \"active_cutoff\",\n  ], `${path}.revocation`);\n}\n\nfunction validateDisclosure(input: unknown, path: string): void {\n  const object = expectJsonObject(input, path);\n  assertExactKeys(object, [\"denial\"], path);\n  expectOneOf(requiredString(object, \"denial\", path), [\"none\", \"code\", \"debug\"], `${path}.denial`);\n}\n\nfunction validateAudit(input: unknown, path: string): void {\n  const object = expectJsonObject(input, path);\n  assertExactKeys(object, [\"issuance\"], path);\n  expectOneOf(requiredString(object, \"issuance\", path), [\"off\", \"security\", \"full\"], `${path}.issuance`);\n}\n\nfunction materialForUnsigned(\n  unsigned: JsonObject,\n  descriptor: ObjectDescriptor,\n): SignedObjectMaterial {\n  const jcs = jcsCanonicalize(unsigned);\n  const jcsBytes = textEncoder.encode(jcs);\n  const digest = sha256Bytes(concatBytes(textEncoder.encode(`${descriptor.domain}\\0`), jcsBytes));\n  const id = `${descriptor.idPrefix}${base32LowerNoPad(digest)}`;\n  return {\n    kind: descriptor.kind,\n    idField: descriptor.idField,\n    id,\n    domain: descriptor.domain,\n    unsigned,\n    jcs,\n    jcsBytes,\n    digest,\n    digestHex: bytesToHex(digest).slice(2),\n  };\n}\n\nfunction assertIdMatches(\n  signed: JsonObject,\n  material: SignedObjectMaterial,\n  descriptor: ObjectDescriptor,\n): void {\n  const actual = requiredString(signed, descriptor.idField, \"$\");\n  if (actual === material.id) {\n    return;\n  }\n  if (new RegExp(`^${descriptor.idPrefix}[a-z2-7]{52}$`).test(actual)) {\n    throw new SignedObjectDigestError(\n      `${descriptor.idField} was not derived from the signed object digest`,\n    );\n  }\n  throw new SignedObjectIdError(`${descriptor.idField} does not match ${descriptor.idPrefix}`);\n}\n\nfunction assertSigningKeyBindingForCreate(\n  unsigned: JsonObject,\n  signerDid: string,\n): void {\n  if (!hasOwn(unsigned, \"signingKeyDid\")) {\n    return;\n  }\n  const signingKeyDid = requiredString(unsigned, \"signingKeyDid\", \"$\");\n  if (signingKeyDid !== signerDid) {\n    throw new SigningKeyBindingError(\n      `signer DID ${signerDid} does not match signingKeyDid ${signingKeyDid}`,\n    );\n  }\n}\n\nfunction assertSigningKeyBindingForVerify(\n  signed: JsonObject,\n  signature: SignedObjectSignature,\n): void {\n  if (!hasOwn(signed, \"signingKeyDid\")) {\n    return;\n  }\n  const signingKeyDid = requiredString(signed, \"signingKeyDid\", \"$\");\n  if (signature.signerDid !== signingKeyDid) {\n    throw new SigningKeyBindingError(\n      `signature signerDid ${signature.signerDid} does not match signingKeyDid ${signingKeyDid}`,\n    );\n  }\n}\n\nfunction assertSignerDidMatchesSuite(\n  signerDid: string,\n  suite: SignatureSuite,\n): void {\n  if (suite === ED25519_JCS_SIGNATURE_SUITE) {\n    ed25519PublicKeyFromDidKey(signerDid);\n    return;\n  }\n  if (suite === EIP191_JCS_SIGNATURE_SUITE) {\n    parseDidPkh(signerDid);\n    return;\n  }\n  throw new UnsupportedSignatureSuiteError(`unsupported signature suite: ${suite}`);\n}\n\nasync function verifySignature(\n  signature: SignedObjectSignature,\n  digest: Uint8Array,\n): Promise<boolean> {\n  if (signature.suite === ED25519_JCS_SIGNATURE_SUITE) {\n    const publicKey = ed25519PublicKeyFromDidKey(signature.signerDid);\n    const signatureBytes = decodeSignatureValue(signature.value, signature.suite);\n    try {\n      return ed25519.verify(signatureBytes, digest, publicKey);\n    } catch {\n      throw new SignatureVerificationError(\"Ed25519 signature verification failed\");\n    }\n  }\n\n  if (signature.suite === EIP191_JCS_SIGNATURE_SUITE) {\n    const pkh = parseDidPkh(signature.signerDid);\n    const signatureBytes = decodeSignatureValue(signature.value, signature.suite);\n    try {\n      return verifyMessage({\n        address: pkh.address,\n        message: { raw: digest },\n        signature: bytesToHex(signatureBytes),\n      });\n    } catch {\n      throw new SignatureVerificationError(\"EIP-191 signature verification failed\");\n    }\n  }\n\n  throw new UnsupportedSignatureSuiteError(`unsupported signature suite: ${signature.suite}`);\n}\n\nfunction ed25519PublicKeyFromDidKey(did: string): Uint8Array {\n  if (!did.startsWith(\"did:key:\")) {\n    throw new SignatureMaterialError(\"Ed25519 signerDid must be did:key\");\n  }\n  const identifier = did.slice(\"did:key:\".length);\n  if (!identifier.startsWith(\"z\")) {\n    throw new SignatureMaterialError(\"did:key must use base58btc multibase\");\n  }\n  let bytes: Uint8Array;\n  try {\n    bytes = bases.base58btc.decode(identifier);\n  } catch {\n    throw new SignatureMaterialError(\"did:key signerDid is undecodable\");\n  }\n  if (bytes.length === 34 && bytes[0] === 0xed && bytes[1] === 0x01) {\n    return bytes.slice(2);\n  }\n  throw new SignatureMaterialError(\"did:key signerDid is not an Ed25519 key\");\n}\n\nfunction parseDidPkh(did: string): { address: `0x${string}` } {\n  let parsed: ReturnType<typeof parsePkhDid>;\n  try {\n    parsed = parsePkhDid(did);\n  } catch {\n    throw new SignatureMaterialError(\"did:pkh signerDid is undecodable\");\n  }\n  if (!parsed) {\n    throw new SignatureMaterialError(\"EIP-191 signerDid must be did:pkh\");\n  }\n  return { address: parsed.address };\n}\n\nfunction decodeSignatureValue(value: string, suite: SignatureSuite): Uint8Array {\n  if (value.length === 0 || !BASE64URL_RE.test(value) || value.includes(\"=\")) {\n    throw new SignatureMaterialError(\"signature value must be base64url without padding\");\n  }\n  const bytes = base64UrlDecode(value);\n  if (suite === ED25519_JCS_SIGNATURE_SUITE && bytes.length !== 64) {\n    throw new SignatureMaterialError(\"Ed25519 signature must be 64 bytes\");\n  }\n  if (suite === EIP191_JCS_SIGNATURE_SUITE) {\n    if (bytes.length !== 65) {\n      throw new SignatureMaterialError(\"EIP-191 signature must be 65 bytes\");\n    }\n    const v = bytes[64];\n    if (v !== 27 && v !== 28) {\n      throw new SignatureMaterialError(\"EIP-191 signature recovery id must be 27 or 28\");\n    }\n  }\n  return bytes;\n}\n\nfunction encodeSignatureValue(\n  value: Uint8Array | string,\n  suite: SignatureSuite,\n): string {\n  if (typeof value === \"string\") {\n    const encoded = value.startsWith(\"0x\")\n      ? base64UrlEncode(hexToBytes(value))\n      : value;\n    decodeSignatureValue(encoded, suite);\n    return encoded;\n  }\n  const encoded = base64UrlEncode(value);\n  decodeSignatureValue(encoded, suite);\n  return encoded;\n}\n\nfunction stripOwnIdAndSignature(\n  object: JsonObject,\n  descriptor: ObjectDescriptor,\n): JsonObject {\n  const output = Object.create(null) as { [key: string]: JsonValue };\n  for (const [key, value] of Object.entries(object)) {\n    if (key === descriptor.idField || key === \"signature\") {\n      continue;\n    }\n    output[key] = value;\n  }\n  return output;\n}\n\nfunction descriptorForUnsigned(input: unknown): ObjectDescriptor {\n  const object = expectJsonObject(normalizeJson(input), \"$\");\n  return descriptorForSchema(requiredString(object, \"schema\", \"$\"));\n}\n\nfunction descriptorForSchema(schema: string): ObjectDescriptor {\n  if (schema === POLICY_SCHEMA) return DESCRIPTORS.Policy;\n  if (schema === POLICY_STATUS_SCHEMA) return DESCRIPTORS.PolicyStatus;\n  if (schema === POLICY_ENGINE_RECORD_SCHEMA) return DESCRIPTORS.PolicyEngineRecord;\n  throw new SignedObjectSchemaError(`unsupported signed-object schema: ${schema}`);\n}\n\nfunction expectJsonObject(input: unknown, path: string): JsonObject {\n  if (input === null || typeof input !== \"object\" || Array.isArray(input)) {\n    throw new SignedObjectSchemaError(`${path} must be an object`);\n  }\n  return input as JsonObject;\n}\n\nfunction assertExactKeys(object: JsonObject, allowed: readonly string[], path: string): void {\n  const allowedSet = new Set(allowed);\n  for (const key of Object.keys(object)) {\n    if (!allowedSet.has(key)) {\n      throw new SignedObjectSchemaError(`${path} has unknown field ${key}`);\n    }\n  }\n}\n\nfunction requiredValue(object: JsonObject, key: string, path: string): JsonValue {\n  if (!hasOwn(object, key)) {\n    throw new SignedObjectSchemaError(`${path}.${key} is required`);\n  }\n  return object[key];\n}\n\nfunction requiredString(object: JsonObject, key: string, path: string): string {\n  return requireStringType(requiredValue(object, key, path), `${path}.${key}`);\n}\n\nfunction optionalString(object: JsonObject, key: string, path: string): void {\n  if (!hasOwn(object, key)) {\n    return;\n  }\n  requireStringType(requiredValue(object, key, path), `${path}.${key}`);\n}\n\nfunction requireStringType(value: JsonValue, path: string): string {\n  if (typeof value !== \"string\" || value.length === 0) {\n    throw new SignedObjectSchemaError(`${path} must be a non-empty string`);\n  }\n  return value;\n}\n\nfunction optionalBoolean(object: JsonObject, key: string, path: string): void {\n  if (!hasOwn(object, key)) {\n    return;\n  }\n  if (typeof requiredValue(object, key, path) !== \"boolean\") {\n    throw new SignedObjectSchemaError(`${path}.${key} must be a boolean`);\n  }\n}\n\nfunction requiredInteger(\n  object: JsonObject,\n  key: string,\n  path: string,\n  minimum: number,\n): number {\n  const value = requiredValue(object, key, path);\n  if (typeof value !== \"number\" || !Number.isSafeInteger(value) || value < minimum) {\n    throw new SignedObjectSchemaError(\n      `${path}.${key} must be an integer >= ${minimum}`,\n    );\n  }\n  return value;\n}\n\nfunction requiredArray(\n  object: JsonObject,\n  key: string,\n  path: string,\n  minimum: number,\n): readonly JsonValue[] {\n  const value = requiredValue(object, key, path);\n  if (!Array.isArray(value) || value.length < minimum) {\n    throw new SignedObjectSchemaError(\n      `${path}.${key} must be an array with at least ${minimum} item(s)`,\n    );\n  }\n  return value;\n}\n\nfunction requiredStringArray(\n  object: JsonObject,\n  key: string,\n  path: string,\n  check?: (value: string, path: string) => void,\n): void {\n  const values = requiredArray(object, key, path, 0);\n  for (let index = 0; index < values.length; index++) {\n    const itemPath = `${path}.${key}[${index}]`;\n    const value = requireStringType(values[index], itemPath);\n    check?.(value, itemPath);\n  }\n}\n\nfunction requiredDateString(object: JsonObject, key: string, path: string): void {\n  assertRfc3339(requiredString(object, key, path), `${path}.${key}`);\n}\n\nfunction optionalDateString(object: JsonObject, key: string, path: string): void {\n  if (!hasOwn(object, key)) {\n    return;\n  }\n  assertRfc3339(requiredString(object, key, path), `${path}.${key}`);\n}\n\nfunction assertRfc3339(value: string, path: string): void {\n  const match = value.match(\n    /^(\\d{4})-(\\d{2})-(\\d{2})T(\\d{2}):(\\d{2}):(\\d{2})(\\.\\d+)?(Z|[+-]\\d{2}:\\d{2})$/,\n  );\n  if (!match) {\n    throw new SignedObjectSchemaError(`${path} must be strict RFC 3339`);\n  }\n  const parsed = Date.parse(value);\n  if (Number.isNaN(parsed)) {\n    throw new SignedObjectSchemaError(`${path} must be a parseable RFC 3339 timestamp`);\n  }\n  const canonical = new Date(parsed).toISOString().replace(\".000Z\", \"Z\");\n  if (canonical !== value) {\n    throw new SignedObjectSchemaError(`${path} must be a normalizable RFC 3339 timestamp`);\n  }\n}\n\nfunction expectConst<T extends string>(actual: string, expected: T, path: string): T {\n  if (actual !== expected) {\n    throw new SignedObjectSchemaError(`${path} must be ${expected}`);\n  }\n  return expected;\n}\n\nfunction expectOneOf<T extends string>(\n  actual: string,\n  allowed: readonly T[],\n  path: string,\n): T {\n  for (const value of allowed) {\n    if (actual === value) {\n      return value;\n    }\n  }\n  throw new SignedObjectSchemaError(`${path} has unsupported value ${actual}`);\n}\n\nfunction hasOwn(object: JsonObject, key: string): boolean {\n  return objectHasOwn(object, key);\n}\n\nfunction assertSupportedSignatureSuite(suite: string): asserts suite is SignatureSuite {\n  if (suite !== ED25519_JCS_SIGNATURE_SUITE && suite !== EIP191_JCS_SIGNATURE_SUITE) {\n    throw new UnsupportedSignatureSuiteError(`unsupported signature suite: ${suite}`);\n  }\n}\n\nfunction sha256Bytes(bytes: Uint8Array): Uint8Array {\n  return sha256(bytes, \"bytes\");\n}\n\nfunction concatBytes(left: Uint8Array, right: Uint8Array): Uint8Array {\n  const output = new Uint8Array(left.length + right.length);\n  output.set(left, 0);\n  output.set(right, left.length);\n  return output;\n}\n\nfunction base32LowerNoPad(bytes: Uint8Array): string {\n  let output = \"\";\n  let buffer = 0;\n  let bits = 0;\n  for (const byte of bytes) {\n    buffer = (buffer << 8) | byte;\n    bits += 8;\n    while (bits >= 5) {\n      bits -= 5;\n      output += BASE32_ALPHABET[(buffer >> bits) & 31];\n    }\n  }\n  if (bits > 0) {\n    output += BASE32_ALPHABET[(buffer << (5 - bits)) & 31];\n  }\n  return output;\n}\n\nfunction base64UrlEncode(bytes: Uint8Array): string {\n  const alphabet =\n    \"ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789-_\";\n  let output = \"\";\n  for (let index = 0; index < bytes.length; index += 3) {\n    const a = bytes[index];\n    const b = bytes[index + 1];\n    const c = bytes[index + 2];\n    const triplet = (a << 16) | ((b ?? 0) << 8) | (c ?? 0);\n    output += alphabet[(triplet >> 18) & 63];\n    output += alphabet[(triplet >> 12) & 63];\n    if (index + 1 < bytes.length) {\n      output += alphabet[(triplet >> 6) & 63];\n    }\n    if (index + 2 < bytes.length) {\n      output += alphabet[triplet & 63];\n    }\n  }\n  return output;\n}\n\nfunction base64UrlDecode(value: string): Uint8Array {\n  if (value.length % 4 === 1) {\n    throw new SignatureMaterialError(\"signature value is not canonical base64url\");\n  }\n  const alphabet =\n    \"ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789-_\";\n  const bytes: number[] = [];\n  let buffer = 0;\n  let bits = 0;\n  for (const char of value) {\n    const index = alphabet.indexOf(char);\n    if (index < 0) {\n      throw new SignatureMaterialError(\"signature value is not base64url\");\n    }\n    buffer = (buffer << 6) | index;\n    bits += 6;\n    if (bits >= 8) {\n      bits -= 8;\n      bytes.push((buffer >> bits) & 0xff);\n    }\n  }\n  const decoded = Uint8Array.from(bytes);\n  if (base64UrlEncode(decoded) !== value) {\n    throw new SignatureMaterialError(\"signature value is not canonical base64url\");\n  }\n  return decoded;\n}\n\nfunction hexToBytes(value: string): Uint8Array {\n  const hex = value.slice(2);\n  if (hex.length % 2 !== 0 || !/^[0-9a-fA-F]*$/.test(hex)) {\n    throw new SignatureMaterialError(\"hex signature must have even length\");\n  }\n  const output = new Uint8Array(hex.length / 2);\n  for (let index = 0; index < output.length; index++) {\n    output[index] = Number.parseInt(hex.slice(index * 2, index * 2 + 2), 16);\n  }\n  return output;\n}\n","import { getAddress, isAddress } from \"viem\";\n\nexport type CanonicalAddress = `0x${string}`;\n\nexport interface PkhDidParts {\n  method: \"pkh\";\n  namespace: \"eip155\";\n  chainId: number;\n  address: CanonicalAddress;\n}\n\nexport interface DidEqualsOptions {\n  ignoreFragment?: boolean;\n}\n\nexport interface DidCacheKeyOptions {\n  preserveFragment?: boolean;\n}\n\nexport class IdentityParseError extends Error {\n  constructor(message: string) {\n    super(message);\n    this.name = \"IdentityParseError\";\n  }\n}\n\nconst PKH_DID_RE = /^did:pkh:eip155:(\\d+):(0x[a-fA-F0-9]{40})$/;\nconst DID_RE = /^did:[a-z0-9]+:.+$/;\n\nfunction splitDidUrl(input: string): { did: string; fragment: string } {\n  const fragmentIndex = input.indexOf(\"#\");\n  if (fragmentIndex < 0) {\n    return { did: input, fragment: \"\" };\n  }\n  return {\n    did: input.slice(0, fragmentIndex),\n    fragment: input.slice(fragmentIndex),\n  };\n}\n\nfunction assertValidChainId(chainId: number): void {\n  if (!Number.isSafeInteger(chainId) || chainId <= 0) {\n    throw new IdentityParseError(`Invalid EIP-155 chain ID: ${chainId}`);\n  }\n}\n\nexport function isEvmAddress(input: string): boolean {\n  return isAddress(input, { strict: false });\n}\n\nexport function canonicalizeAddress(address: string): CanonicalAddress {\n  if (!isEvmAddress(address)) {\n    throw new IdentityParseError(`Invalid EVM address: ${address}`);\n  }\n  return getAddress(address) as CanonicalAddress;\n}\n\nexport function addressStorageKey(address: string): CanonicalAddress {\n  return canonicalizeAddress(address).toLowerCase() as CanonicalAddress;\n}\n\nexport function pkhDid(address: string, chainId: number = 1): string {\n  assertValidChainId(chainId);\n  return `did:pkh:eip155:${chainId}:${canonicalizeAddress(address)}`;\n}\n\nexport function parsePkhDid(did: string): PkhDidParts | null {\n  const match = did.match(PKH_DID_RE);\n  if (!match) return null;\n\n  const chainId = Number(match[1]);\n  assertValidChainId(chainId);\n\n  return {\n    method: \"pkh\",\n    namespace: \"eip155\",\n    chainId,\n    address: canonicalizeAddress(match[2]),\n  };\n}\n\nexport function canonicalizeDid(did: string): string {\n  const pkh = parsePkhDid(did);\n  if (pkh) {\n    return pkhDid(pkh.address, pkh.chainId);\n  }\n  if (DID_RE.test(did)) {\n    return did;\n  }\n  throw new IdentityParseError(`Invalid DID: ${did}`);\n}\n\nexport function canonicalizeDidUrl(didUrl: string): string {\n  const { did, fragment } = splitDidUrl(didUrl);\n  return `${canonicalizeDid(did)}${fragment}`;\n}\n\nexport function principalDid(didUrl: string): string {\n  return canonicalizeDid(splitDidUrl(didUrl).did);\n}\n\nexport function didEquals(a: string, b: string, options: DidEqualsOptions = {}): boolean {\n  const canonicalize = options.ignoreFragment ? principalDid : canonicalizeDidUrl;\n  return canonicalize(a) === canonicalize(b);\n}\n\nexport function principalDidEquals(a: string, b: string): boolean {\n  return didEquals(a, b, { ignoreFragment: true });\n}\n\nexport function didCacheKey(input: string, options: DidCacheKeyOptions = {}): string {\n  const { did, fragment } = splitDidUrl(input);\n  const pkh = parsePkhDid(did);\n  const base = pkh\n    ? `did:pkh:eip155:${pkh.chainId}:${addressStorageKey(pkh.address)}`\n    : canonicalizeDid(did);\n\n  return options.preserveFragment ? `${base}${fragment}` : base;\n}\n\nexport function makePkhSpaceId(\n  address: string,\n  chainId: number,\n  name: string,\n): string {\n  assertValidChainId(chainId);\n  if (!name) {\n    throw new IdentityParseError(\"Space name cannot be empty\");\n  }\n  return `tinycloud:pkh:eip155:${chainId}:${canonicalizeAddress(address)}:${name}`;\n}\n","import {\n  POLICY_ENGINE_RECORD_SCHEMA,\n  POLICY_SCHEMA,\n  createAndSignPolicy,\n  createAndSignPolicyEngineRecord,\n  validatePolicyEngineRecordSignedShape,\n  verifyPolicyEngineRecord,\n  type Policy,\n  type PolicyEngineRecord,\n  type SignedObjectSigner,\n  type UnsignedPolicyEngineRecord,\n} from \"./signed-object\";\nimport {\n  PolicyCapabilityError,\n  normalizePolicyCapability,\n  type JsonObject,\n  type PolicyCapability,\n} from \"./capability\";\nimport { normalizeJson, type JsonValue } from \"./jcs\";\nimport { SignedObjectProfileError, SignedObjectSchemaError } from \"./errors\";\n\nexport const TRANSCRIPT_SHARE_BOOTSTRAP_SCHEMA =\n  \"xyz.tinycloud.exchange/transcript-bootstrap/v0\" as const;\nexport const OWNER_NODE_ENDPOINT_SCHEMA =\n  \"xyz.tinycloud.exchange/owner-node-endpoint/v1\" as const;\nexport const POLICY_VERSION_V0 = \"v0\" as const;\nexport const W3C_VC_CREDENTIAL_VERIFIER = \"w3c.vc/credential/v1\" as const;\n\nexport type PolicyAuthoringErrorCode =\n  | PolicyCapabilityError[\"code\"]\n  | \"policy-authoring-malformed\"\n  | \"policy-authoring-unknown-key\"\n  | \"policy-engine-record-absent\"\n  | \"policy-engine-record-date-invalid\"\n  | \"policy-engine-record-signature-invalid\"\n  | \"policy-engine-record-audience-mismatch\"\n  | \"policy-engine-record-expired\"\n  | \"policy-engine-record-owner-mismatch\"\n  | \"policy-engine-record-grant-issuer-mismatch\"\n  | \"policy-engine-record-policy-version-unsupported\"\n  | \"policy-engine-record-evidence-verifier-unsupported\"\n  | \"transcript-share-bootstrap-malformed\";\n\nexport class PolicyAuthoringError extends Error {\n  public readonly code: PolicyAuthoringErrorCode;\n\n  constructor(code: PolicyAuthoringErrorCode, message: string) {\n    super(message);\n    this.name = \"PolicyAuthoringError\";\n    this.code = code;\n  }\n}\n\nexport interface CreateTranscriptSharePolicyInput {\n  readonly ownerDid: string;\n  readonly signingKeyDid: string;\n  readonly createdAt: string;\n  readonly expiresAt?: string;\n  readonly resourceType: string;\n  readonly resourceId: string;\n  readonly permissionsCeiling: readonly unknown[];\n  readonly when: JsonObject;\n  readonly grant: JsonObject;\n  readonly disclosure?: JsonObject;\n  readonly audit?: JsonObject;\n}\n\nexport interface TranscriptShareBootstrap {\n  readonly schema: typeof TRANSCRIPT_SHARE_BOOTSTRAP_SCHEMA;\n  readonly policyId: string;\n  readonly policyEngine: {\n    readonly endpoint: string;\n    readonly audience: string;\n    readonly supportedEvidenceVerifiers: readonly [\n      typeof W3C_VC_CREDENTIAL_VERIFIER,\n    ];\n    readonly signedRecord: PolicyEngineRecord;\n  };\n  /** Untrusted routing hint. Authority comes only from delegation/invocation validation. */\n  readonly ownerNode: {\n    readonly schema: typeof OWNER_NODE_ENDPOINT_SCHEMA;\n    readonly endpoint: string;\n    readonly spaceId: string;\n  };\n  readonly resourceHint: JsonObject;\n}\n\nexport interface ComposeTranscriptShareBootstrapInput {\n  readonly policyId: string;\n  readonly policyEngineRecord: PolicyEngineRecord;\n  readonly ownerNodeEndpoint: string;\n  readonly ownerSpaceId: string;\n  readonly resourceHint: JsonObject;\n}\n\nexport interface CreatePolicyEngineRecordInput {\n  readonly ownerDid: string;\n  readonly endpoint: string;\n  readonly audience: string;\n  readonly grantIssuerDid: string;\n  readonly expiresAt: string;\n  readonly supportedPolicyVersions?: readonly string[];\n  readonly supportedEvidenceVerifiers?: readonly string[];\n}\n\nexport interface VerifyPolicyEngineRecordOptions {\n  readonly signedRecord: unknown;\n  readonly ownerDid: string;\n  readonly audience: string;\n  readonly grantIssuerDid: string;\n  readonly now: string;\n  readonly requiredPolicyVersion?: string;\n  readonly requiredEvidenceVerifier?: string;\n}\n\n/**\n * Author a transcript-sharing Policy from already-resolved Listen-adapter\n * PolicyCapability JSON. Manifest PermissionEntry shapes are refused here; the\n * SDK does not expand or invent permissions while signing authority-bearing\n * objects.\n */\nexport async function createAndSignTranscriptSharePolicy(\n  input: CreateTranscriptSharePolicyInput,\n  signer: SignedObjectSigner,\n): Promise<Policy> {\n  const normalized = expectObject(input, \"$\", \"policy-authoring-malformed\");\n  assertExactKeys(\n    normalized,\n    [\n      \"ownerDid\",\n      \"signingKeyDid\",\n      \"createdAt\",\n      \"expiresAt\",\n      \"resourceType\",\n      \"resourceId\",\n      \"permissionsCeiling\",\n      \"when\",\n      \"grant\",\n      \"disclosure\",\n      \"audit\",\n    ],\n    \"$\",\n  );\n  const permissions = requiredArray(normalized, \"permissionsCeiling\", \"$\");\n  if (permissions.length === 0) {\n    throw new PolicyAuthoringError(\n      \"policy-authoring-malformed\",\n      \"$.permissionsCeiling must not be empty\",\n    );\n  }\n  const ceiling: PolicyCapability[] = [];\n  for (let index = 0; index < permissions.length; index++) {\n    ceiling.push(\n      wrapCapabilityError(() => normalizePolicyCapability(permissions[index])),\n    );\n  }\n  return createAndSignPolicy(\n    {\n      schema: POLICY_SCHEMA,\n      ownerDid: requiredString(normalized, \"ownerDid\", \"$\"),\n      signingKeyDid: requiredString(normalized, \"signingKeyDid\", \"$\"),\n      createdAt: requiredString(normalized, \"createdAt\", \"$\"),\n      ...(hasOwn(normalized, \"expiresAt\")\n        ? { expiresAt: requiredString(normalized, \"expiresAt\", \"$\") }\n        : {}),\n      resource: {\n        resourceType: requiredString(normalized, \"resourceType\", \"$\"),\n        resourceId: requiredString(normalized, \"resourceId\", \"$\"),\n        permissionsCeiling: ceiling,\n      },\n      when: requiredObject(normalized, \"when\", \"$\"),\n      grant: requiredObject(normalized, \"grant\", \"$\"),\n      ...(hasOwn(normalized, \"disclosure\")\n        ? { disclosure: requiredObject(normalized, \"disclosure\", \"$\") }\n        : {}),\n      ...(hasOwn(normalized, \"audit\")\n        ? { audit: requiredObject(normalized, \"audit\", \"$\") }\n        : {}),\n    },\n    signer,\n  ).catch((error) => {\n    throw wrapSignedObjectError(error);\n  });\n}\n\nexport function createUnsignedPolicyEngineRecord(\n  input: CreatePolicyEngineRecordInput,\n): UnsignedPolicyEngineRecord {\n  const normalized = expectObject(input, \"$\", \"policy-authoring-malformed\");\n  assertExactKeys(\n    normalized,\n    [\n      \"ownerDid\",\n      \"endpoint\",\n      \"audience\",\n      \"grantIssuerDid\",\n      \"expiresAt\",\n      \"supportedPolicyVersions\",\n      \"supportedEvidenceVerifiers\",\n    ],\n    \"$\",\n  );\n  const supportedPolicyVersions = hasOwn(normalized, \"supportedPolicyVersions\")\n    ? requiredStringArray(normalized, \"supportedPolicyVersions\", \"$\")\n    : [POLICY_VERSION_V0];\n  validateSupportedPolicyVersions(\n    supportedPolicyVersions,\n    \"$.supportedPolicyVersions\",\n  );\n  const supportedEvidenceVerifiers = hasOwn(\n    normalized,\n    \"supportedEvidenceVerifiers\",\n  )\n    ? requiredStringArray(normalized, \"supportedEvidenceVerifiers\", \"$\")\n    : [W3C_VC_CREDENTIAL_VERIFIER];\n  validateSupportedEvidenceVerifiers(\n    supportedEvidenceVerifiers,\n    \"$.supportedEvidenceVerifiers\",\n  );\n  const expiresAt = fieldString(\n    normalized,\n    \"expiresAt\",\n    \"$\",\n    \"policy-engine-record-date-invalid\",\n  );\n  parseStrictRfc3339(expiresAt, \"$.expiresAt\");\n\n  return {\n    schema: POLICY_ENGINE_RECORD_SCHEMA,\n    ownerDid: requiredString(normalized, \"ownerDid\", \"$\"),\n    endpoint: validatePolicyEngineEndpoint(\n      requiredString(normalized, \"endpoint\", \"$\"),\n    ),\n    audience: requiredString(normalized, \"audience\", \"$\"),\n    supportedPolicyVersions,\n    supportedEvidenceVerifiers,\n    grantIssuerDid: requiredString(normalized, \"grantIssuerDid\", \"$\"),\n    expiresAt,\n  };\n}\n\nexport async function createAndSignRequesterPolicyEngineRecord(\n  input: CreatePolicyEngineRecordInput,\n  signer: SignedObjectSigner,\n): Promise<PolicyEngineRecord> {\n  return createAndSignPolicyEngineRecord(\n    createUnsignedPolicyEngineRecord(input),\n    signer,\n  ).catch((error) => {\n    throw wrapSignedObjectError(error);\n  });\n}\n\n/**\n * Compose the SDK-level transcript-share bootstrap record. This record is not\n * an invitation and is not authority; it only tells a requester where to ask\n * and which policy id to reference.\n */\nexport function composeTranscriptShareBootstrap(\n  input: ComposeTranscriptShareBootstrapInput,\n): TranscriptShareBootstrap {\n  const normalized = expectObject(\n    input,\n    \"$\",\n    \"transcript-share-bootstrap-malformed\",\n  );\n  assertExactKeys(\n    normalized,\n    [\n      \"policyId\",\n      \"policyEngineRecord\",\n      \"ownerNodeEndpoint\",\n      \"ownerSpaceId\",\n      \"resourceHint\",\n    ],\n    \"$\",\n  );\n  const signedRecord = expectPolicyEngineRecord(\n    requiredValue(normalized, \"policyEngineRecord\", \"$\"),\n  );\n  if (\n    !signedRecord.supportedEvidenceVerifiers.includes(\n      W3C_VC_CREDENTIAL_VERIFIER,\n    )\n  ) {\n    throw new PolicyAuthoringError(\n      \"transcript-share-bootstrap-malformed\",\n      \"policy engine record does not support the bootstrap evidence verifier\",\n    );\n  }\n  return {\n    schema: TRANSCRIPT_SHARE_BOOTSTRAP_SCHEMA,\n    policyId: requiredString(normalized, \"policyId\", \"$\"),\n    policyEngine: {\n      endpoint: signedRecord.endpoint,\n      audience: signedRecord.audience,\n      supportedEvidenceVerifiers: [W3C_VC_CREDENTIAL_VERIFIER],\n      signedRecord,\n    },\n    ownerNode: {\n      schema: OWNER_NODE_ENDPOINT_SCHEMA,\n      endpoint: validateOwnerNodeEndpoint(\n        requiredString(normalized, \"ownerNodeEndpoint\", \"$\"),\n      ),\n      spaceId: requiredString(normalized, \"ownerSpaceId\", \"$\"),\n    },\n    resourceHint: requiredObject(normalized, \"resourceHint\", \"$\"),\n  };\n}\n\nfunction validateOwnerNodeEndpoint(value: string): string {\n  let url: URL;\n  try {\n    url = new URL(value);\n  } catch {\n    throw new PolicyAuthoringError(\n      \"transcript-share-bootstrap-malformed\",\n      \"$.ownerNodeEndpoint must be a URL\",\n    );\n  }\n  if (\n    url.protocol !== \"https:\" ||\n    url.username !== \"\" ||\n    url.password !== \"\" ||\n    url.hash !== \"\" ||\n    url.search !== \"\"\n  ) {\n    throw new PolicyAuthoringError(\n      \"transcript-share-bootstrap-malformed\",\n      \"$.ownerNodeEndpoint must be an HTTPS URL without credentials, query, or fragment\",\n    );\n  }\n  return url.toString().replace(/\\/$/, \"\");\n}\n\nfunction validatePolicyEngineEndpoint(value: string): string {\n  let url: URL;\n  try {\n    url = new URL(value);\n  } catch {\n    throw new PolicyAuthoringError(\n      \"policy-authoring-malformed\",\n      \"$.endpoint must be a URL\",\n    );\n  }\n  if (\n    url.protocol !== \"https:\" ||\n    url.username !== \"\" ||\n    url.password !== \"\" ||\n    url.hash !== \"\" ||\n    url.search !== \"\"\n  ) {\n    throw new PolicyAuthoringError(\n      \"policy-authoring-malformed\",\n      \"$.endpoint must be an HTTPS URL without credentials, query, or fragment\",\n    );\n  }\n  return url.toString().replace(/\\/$/, \"\");\n}\n\n/**\n * Requester-side authentication gate for policy-engine endpoints. A requester\n * MUST NOT send credential evidence or call /resolve unless this verification\n * succeeds.\n */\nexport async function verifyPolicyEngineRecordForRequester(\n  options: VerifyPolicyEngineRecordOptions,\n): Promise<PolicyEngineRecord> {\n  const normalized = expectObject(options, \"$\", \"policy-authoring-malformed\");\n  assertExactKeys(\n    normalized,\n    [\n      \"signedRecord\",\n      \"ownerDid\",\n      \"audience\",\n      \"grantIssuerDid\",\n      \"now\",\n      \"requiredPolicyVersion\",\n      \"requiredEvidenceVerifier\",\n    ],\n    \"$\",\n  );\n  if (!hasOwn(normalized, \"signedRecord\")) {\n    throw new PolicyAuthoringError(\n      \"policy-engine-record-absent\",\n      \"$.signedRecord must be present\",\n    );\n  }\n  const signedRecord = normalized[\"signedRecord\"];\n  if (\n    signedRecord === null ||\n    typeof signedRecord !== \"object\" ||\n    Array.isArray(signedRecord)\n  ) {\n    throw new PolicyAuthoringError(\n      \"policy-engine-record-absent\",\n      \"$.signedRecord must be present\",\n    );\n  }\n  const recordObject = signedRecord as JsonObject;\n  const expiresAt = fieldString(\n    recordObject,\n    \"expiresAt\",\n    \"$.signedRecord\",\n    \"policy-engine-record-date-invalid\",\n  );\n  const now = fieldString(\n    normalized,\n    \"now\",\n    \"$\",\n    \"policy-engine-record-date-invalid\",\n  );\n  const expiresMs = parseStrictRfc3339(expiresAt, \"$.signedRecord.expiresAt\");\n  const nowMs = parseStrictRfc3339(now, \"$.now\");\n  if (expiresMs <= nowMs) {\n    throw new PolicyAuthoringError(\n      \"policy-engine-record-expired\",\n      \"$.signedRecord.expiresAt is expired\",\n    );\n  }\n\n  let verified: PolicyEngineRecord;\n  try {\n    verified = (await verifyPolicyEngineRecord(recordObject)).object;\n  } catch (error) {\n    throw new PolicyAuthoringError(\n      \"policy-engine-record-signature-invalid\",\n      error instanceof Error ? error.message : String(error),\n    );\n  }\n  if (verified.signature.signerDid !== verified.ownerDid) {\n    throw new PolicyAuthoringError(\n      \"policy-engine-record-signature-invalid\",\n      \"$.signedRecord.signature.signerDid must match ownerDid for the direct-owner requester profile\",\n    );\n  }\n\n  const expectedOwnerDid = requiredString(normalized, \"ownerDid\", \"$\");\n  if (verified.ownerDid !== expectedOwnerDid) {\n    throw new PolicyAuthoringError(\n      \"policy-engine-record-owner-mismatch\",\n      \"$.signedRecord.ownerDid does not match\",\n    );\n  }\n  const expectedAudience = requiredString(normalized, \"audience\", \"$\");\n  if (verified.audience !== expectedAudience) {\n    throw new PolicyAuthoringError(\n      \"policy-engine-record-audience-mismatch\",\n      \"$.signedRecord.audience does not match\",\n    );\n  }\n  const expectedGrantIssuerDid = requiredString(\n    normalized,\n    \"grantIssuerDid\",\n    \"$\",\n  );\n  if (verified.grantIssuerDid !== expectedGrantIssuerDid) {\n    throw new PolicyAuthoringError(\n      \"policy-engine-record-grant-issuer-mismatch\",\n      \"$.signedRecord.grantIssuerDid does not match\",\n    );\n  }\n  const requiredPolicyVersion = hasOwn(normalized, \"requiredPolicyVersion\")\n    ? requiredString(normalized, \"requiredPolicyVersion\", \"$\")\n    : POLICY_VERSION_V0;\n  if (!verified.supportedPolicyVersions.includes(requiredPolicyVersion)) {\n    throw new PolicyAuthoringError(\n      \"policy-engine-record-policy-version-unsupported\",\n      \"$.signedRecord.supportedPolicyVersions does not include the required version\",\n    );\n  }\n  const requiredEvidenceVerifier = hasOwn(\n    normalized,\n    \"requiredEvidenceVerifier\",\n  )\n    ? requiredString(normalized, \"requiredEvidenceVerifier\", \"$\")\n    : W3C_VC_CREDENTIAL_VERIFIER;\n  if (!verified.supportedEvidenceVerifiers.includes(requiredEvidenceVerifier)) {\n    throw new PolicyAuthoringError(\n      \"policy-engine-record-evidence-verifier-unsupported\",\n      \"$.signedRecord.supportedEvidenceVerifiers does not include the required verifier\",\n    );\n  }\n  return verified;\n}\n\nfunction expectObject(\n  input: unknown,\n  path: string,\n  code: PolicyAuthoringErrorCode,\n): JsonObject {\n  try {\n    const normalized = normalizeJson(input);\n    if (\n      normalized === null ||\n      typeof normalized !== \"object\" ||\n      Array.isArray(normalized)\n    ) {\n      throw new PolicyAuthoringError(code, `${path} must be an object`);\n    }\n    return normalized as JsonObject;\n  } catch (error) {\n    if (error instanceof PolicyAuthoringError) {\n      throw error;\n    }\n    throw new PolicyAuthoringError(\n      code,\n      error instanceof Error ? error.message : String(error),\n    );\n  }\n}\n\nfunction expectPolicyEngineRecord(input: JsonValue): PolicyEngineRecord {\n  if (input === null || typeof input !== \"object\" || Array.isArray(input)) {\n    throw new PolicyAuthoringError(\n      \"transcript-share-bootstrap-malformed\",\n      \"$.policyEngineRecord must be an object\",\n    );\n  }\n  try {\n    return validatePolicyEngineRecordSignedShape(input);\n  } catch (error) {\n    throw new PolicyAuthoringError(\n      \"transcript-share-bootstrap-malformed\",\n      error instanceof Error ? error.message : String(error),\n    );\n  }\n}\n\nfunction assertExactKeys(\n  object: JsonObject,\n  allowed: readonly string[],\n  path: string,\n): void {\n  const allowedSet = new Set(allowed);\n  for (const key of Object.keys(object)) {\n    if (!allowedSet.has(key)) {\n      throw new PolicyAuthoringError(\n        \"policy-authoring-unknown-key\",\n        `${path} has unknown field ${key}`,\n      );\n    }\n  }\n}\n\nfunction requiredValue(\n  object: JsonObject,\n  key: string,\n  path: string,\n): JsonValue {\n  if (!hasOwn(object, key)) {\n    throw new PolicyAuthoringError(\n      \"policy-authoring-malformed\",\n      `${path}.${key} is required`,\n    );\n  }\n  return object[key];\n}\n\nfunction requiredString(object: JsonObject, key: string, path: string): string {\n  const value = requiredValue(object, key, path);\n  if (typeof value !== \"string\" || value.length === 0) {\n    throw new PolicyAuthoringError(\n      \"policy-authoring-malformed\",\n      `${path}.${key} must be a non-empty string`,\n    );\n  }\n  return value;\n}\n\nfunction fieldString(\n  object: JsonObject,\n  key: string,\n  path: string,\n  code: PolicyAuthoringErrorCode,\n): string {\n  if (!hasOwn(object, key)) {\n    throw new PolicyAuthoringError(code, `${path}.${key} is required`);\n  }\n  const value = object[key];\n  if (typeof value !== \"string\" || value.length === 0) {\n    throw new PolicyAuthoringError(\n      code,\n      `${path}.${key} must be a non-empty string`,\n    );\n  }\n  return value;\n}\n\nfunction requiredObject(\n  object: JsonObject,\n  key: string,\n  path: string,\n): JsonObject {\n  const value = requiredValue(object, key, path);\n  if (value === null || typeof value !== \"object\" || Array.isArray(value)) {\n    throw new PolicyAuthoringError(\n      \"policy-authoring-malformed\",\n      `${path}.${key} must be an object`,\n    );\n  }\n  return value as JsonObject;\n}\n\nfunction requiredArray(\n  object: JsonObject,\n  key: string,\n  path: string,\n): readonly JsonValue[] {\n  const value = requiredValue(object, key, path);\n  if (!Array.isArray(value)) {\n    throw new PolicyAuthoringError(\n      \"policy-authoring-malformed\",\n      `${path}.${key} must be an array`,\n    );\n  }\n  return value;\n}\n\nfunction requiredStringArray(\n  object: JsonObject,\n  key: string,\n  path: string,\n): string[] {\n  const values = requiredArray(object, key, path);\n  return values.map((value, index) => {\n    if (typeof value !== \"string\" || value.length === 0) {\n      throw new PolicyAuthoringError(\n        \"policy-authoring-malformed\",\n        `${path}.${key}[${index}] must be a non-empty string`,\n      );\n    }\n    return value;\n  });\n}\n\nfunction validateSupportedPolicyVersions(\n  values: readonly string[],\n  path: string,\n): void {\n  if (values.length === 0) {\n    throw new PolicyAuthoringError(\n      \"policy-authoring-malformed\",\n      `${path} must not be empty`,\n    );\n  }\n  for (let index = 0; index < values.length; index++) {\n    if (values[index] !== POLICY_VERSION_V0) {\n      throw new PolicyAuthoringError(\n        \"policy-authoring-malformed\",\n        `${path}[${index}] is unsupported`,\n      );\n    }\n  }\n}\n\nfunction validateSupportedEvidenceVerifiers(\n  values: readonly string[],\n  path: string,\n): void {\n  if (values.length === 0) {\n    throw new PolicyAuthoringError(\n      \"policy-authoring-malformed\",\n      `${path} must not be empty`,\n    );\n  }\n  for (let index = 0; index < values.length; index++) {\n    if (values[index] !== W3C_VC_CREDENTIAL_VERIFIER) {\n      throw new PolicyAuthoringError(\n        \"policy-authoring-malformed\",\n        `${path}[${index}] is unsupported`,\n      );\n    }\n  }\n}\n\nfunction wrapCapabilityError<T>(fn: () => T): T {\n  try {\n    return fn();\n  } catch (error) {\n    if (error instanceof PolicyCapabilityError) {\n      throw new PolicyAuthoringError(error.code, error.message);\n    }\n    throw error;\n  }\n}\n\nfunction wrapSignedObjectError(error: unknown): Error {\n  if (error instanceof PolicyAuthoringError) {\n    return error;\n  }\n  if (\n    error instanceof SignedObjectSchemaError ||\n    error instanceof SignedObjectProfileError\n  ) {\n    return new PolicyAuthoringError(\n      \"policy-authoring-malformed\",\n      error.message,\n    );\n  }\n  return new PolicyAuthoringError(\n    \"policy-authoring-malformed\",\n    error instanceof Error ? error.message : String(error),\n  );\n}\n\nfunction parseStrictRfc3339(value: string, path: string): number {\n  const match = value.match(\n    /^(\\d{4})-(\\d{2})-(\\d{2})T(\\d{2}):(\\d{2}):(\\d{2})(\\.\\d+)?Z$/,\n  );\n  if (!match) {\n    throw new PolicyAuthoringError(\n      \"policy-engine-record-date-invalid\",\n      `${path} must be strict RFC 3339`,\n    );\n  }\n  const parsed = Date.parse(value);\n  if (Number.isNaN(parsed)) {\n    throw new PolicyAuthoringError(\n      \"policy-engine-record-date-invalid\",\n      `${path} must be parseable`,\n    );\n  }\n  const canonical = new Date(parsed).toISOString().replace(\".000Z\", \"Z\");\n  if (canonical !== value) {\n    throw new PolicyAuthoringError(\n      \"policy-engine-record-date-invalid\",\n      `${path} must be normalizable`,\n    );\n  }\n  return parsed;\n}\n\nconst objectHasOwn: (object: object, propertyKey: PropertyKey) => boolean =\n  (\n    Object as ObjectConstructor & {\n      hasOwn?: (object: object, propertyKey: PropertyKey) => boolean;\n    }\n  ).hasOwn ??\n  (Object.prototype.hasOwnProperty.call.bind(\n    Object.prototype.hasOwnProperty,\n  ) as (object: object, propertyKey: PropertyKey) => boolean);\n\nfunction hasOwn(object: JsonObject, key: string): boolean {\n  return objectHasOwn(object, key);\n}\n"],"mappings":";;;;;;;;;;;;;;;;;;;;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;;;ACUO,IAAM,2BAAN,cAAuC,MAAM;AAAA,EAGlD,YAAY,MAA6B,SAAiB;AACxD,UAAM,OAAO;AACb,SAAK,OAAO;AACZ,SAAK,OAAO;AAAA,EACd;AACF;AAEO,IAAM,0BAAN,cAAsC,yBAAyB;AAAA,EACpE,YAAY,SAAiB;AAC3B,UAAM,kBAAkB,OAAO;AAC/B,SAAK,OAAO;AAAA,EACd;AACF;AAEO,IAAM,oCAAN,cAAgD,yBAAyB;AAAA,EAC9E,YAAY,SAAiB;AAC3B,UAAM,6BAA6B,OAAO;AAC1C,SAAK,OAAO;AAAA,EACd;AACF;AAEO,IAAM,0BAAN,cAAsC,yBAAyB;AAAA,EACpE,YAAY,SAAiB;AAC3B,UAAM,mBAAmB,OAAO;AAChC,SAAK,OAAO;AAAA,EACd;AACF;AAEO,IAAM,sBAAN,cAAkC,yBAAyB;AAAA,EAChE,YAAY,SAAiB;AAC3B,UAAM,eAAe,OAAO;AAC5B,SAAK,OAAO;AAAA,EACd;AACF;AAEO,IAAM,yBAAN,cAAqC,yBAAyB;AAAA,EACnE,YAAY,SAAiB;AAC3B,UAAM,uBAAuB,OAAO;AACpC,SAAK,OAAO;AAAA,EACd;AACF;AAEO,IAAM,yBAAN,cAAqC,yBAAyB;AAAA,EACnE,YAAY,SAAiB;AAC3B,UAAM,8BAA8B,OAAO;AAC3C,SAAK,OAAO;AAAA,EACd;AACF;AAEO,IAAM,iCAAN,cAA6C,yBAAyB;AAAA,EAC3E,YAAY,SAAiB;AAC3B,UAAM,+BAA+B,OAAO;AAC5C,SAAK,OAAO;AAAA,EACd;AACF;AAEO,IAAM,6BAAN,cAAyC,yBAAyB;AAAA,EACvE,YAAY,SAAiB;AAC3B,UAAM,qBAAqB,OAAO;AAClC,SAAK,OAAO;AAAA,EACd;AACF;AAEO,SAAS,oBAAoB,OAA0C;AAC5E,MAAI,iBAAiB,0BAA0B;AAC7C,WAAO;AAAA,EACT;AACA,SAAO,IAAI;AAAA,IACT;AAAA,IACA,iBAAiB,QAAQ,MAAM,UAAU,OAAO,KAAK;AAAA,EACvD;AACF;;;ACzEA,IAAM,eACH,OAEE,UACF,OAAO,UAAU,eAAe,KAAK;AAAA,EACpC,OAAO,UAAU;AACnB;AAUK,SAAS,gBAAgB,OAAwB;AACtD,SAAO,UAAU,cAAc,OAAO,GAAG,CAAC;AAC5C;AAEO,SAAS,cAAc,OAAgB,OAAO,KAAgB;AACnE,MAAI,UAAU,MAAM;AAClB,WAAO;AAAA,EACT;AAEA,UAAQ,OAAO,OAAO;AAAA,IACpB,KAAK;AACH,aAAO;AAAA,IACT,KAAK;AACH,UAAI,CAAC,OAAO,SAAS,KAAK,GAAG;AAC3B,cAAM,IAAI;AAAA,UACR,GAAG,IAAI;AAAA,QACT;AAAA,MACF;AACA,aAAO;AAAA,IACT,KAAK;AACH,gCAA0B,OAAO,IAAI;AACrC,aAAO;AAAA,IACT,KAAK;AACH,aAAO,2BAA2B,OAAO,IAAI;AAAA,IAC/C,KAAK;AAAA,IACL,KAAK;AAAA,IACL,KAAK;AAAA,IACL,KAAK;AAAA,IACL;AACE,YAAM,IAAI;AAAA,QACR,GAAG,IAAI;AAAA,MACT;AAAA,EACJ;AACF;AAEO,SAAS,UAAU,OAA0B;AAClD,MAAI,UAAU,MAAM;AAClB,WAAO;AAAA,EACT;AAEA,UAAQ,OAAO,OAAO;AAAA,IACpB,KAAK;AACH,aAAO,QAAQ,SAAS;AAAA,IAC1B,KAAK,UAAU;AACb,YAAM,UAAU,KAAK,UAAU,KAAK;AACpC,UAAI,YAAY,QAAW;AACzB,cAAM,IAAI;AAAA,UACR;AAAA,QACF;AAAA,MACF;AACA,aAAO;AAAA,IACT;AAAA,IACA,KAAK;AACH,aAAO,KAAK,UAAU,KAAK;AAAA,IAC7B,KAAK;AACH,UAAI,MAAM,QAAQ,KAAK,GAAG;AACxB,eAAO,IAAI,MAAM,IAAI,CAAC,SAAS,UAAU,IAAI,CAAC,EAAE,KAAK,GAAG,CAAC;AAAA,MAC3D;AACA,aAAO,gBAAgB,KAAK;AAAA,IAC9B;AACE,YAAM,IAAI;AAAA,QACR,+BAA+B,OAAO,KAAK;AAAA,MAC7C;AAAA,EACJ;AACF;AAEA,SAAS,2BAA2B,OAAe,MAAyB;AAC1E,qBAAmB,OAAO,IAAI;AAE9B,MAAI,MAAM,QAAQ,KAAK,GAAG;AACxB,eAAW,OAAO,OAAO,oBAAoB,KAAK,GAAG;AACnD,UAAI,QAAQ,UAAU;AACpB;AAAA,MACF;AACA,UAAI,CAAC,gBAAgB,KAAK,MAAM,MAAM,GAAG;AACvC,cAAM,IAAI;AAAA,UACR,GAAG,IAAI,IAAI,GAAG;AAAA,QAChB;AAAA,MACF;AACA,YAAM,aAAa,OAAO,yBAAyB,OAAO,GAAG;AAC7D,UAAI,YAAY,eAAe,MAAM;AACnC,cAAM,IAAI;AAAA,UACR,GAAG,IAAI,IAAI,GAAG;AAAA,QAChB;AAAA,MACF;AACA,UAAI,EAAE,WAAW,aAAa;AAC5B,cAAM,IAAI;AAAA,UACR,GAAG,IAAI,IAAI,GAAG;AAAA,QAChB;AAAA,MACF;AAAA,IACF;AACA,UAAMA,UAAsB,CAAC;AAC7B,aAAS,QAAQ,GAAG,QAAQ,MAAM,QAAQ,SAAS;AACjD,UAAI,CAAC,aAAa,OAAO,KAAK,GAAG;AAC/B,cAAM,IAAI;AAAA,UACR,GAAG,IAAI,IAAI,KAAK;AAAA,QAClB;AAAA,MACF;AACA,MAAAA,QAAO,KAAK,cAAc,MAAM,KAAK,GAAG,GAAG,IAAI,IAAI,KAAK,GAAG,CAAC;AAAA,IAC9D;AACA,WAAOA;AAAA,EACT;AAEA,QAAM,QAAQ,OAAO,eAAe,KAAK;AACzC,MAAI,UAAU,OAAO,aAAa,UAAU,MAAM;AAChD,UAAM,IAAI;AAAA,MACR,GAAG,IAAI;AAAA,IACT;AAAA,EACF;AAEA,QAAM,SAAS,uBAAO,OAAO,IAAI;AACjC,aAAW,OAAO,OAAO,oBAAoB,KAAK,GAAG;AACnD,8BAA0B,KAAK,GAAG,IAAI,MAAM;AAC5C,QAAI,QAAQ,eAAe,QAAQ,eAAe;AAChD,YAAM,IAAI;AAAA,QACR,GAAG,IAAI,IAAI,GAAG;AAAA,MAChB;AAAA,IACF;AACA,UAAM,aAAa,OAAO,yBAAyB,OAAO,GAAG;AAC7D,QAAI,YAAY,eAAe,MAAM;AACnC,YAAM,IAAI;AAAA,QACR,GAAG,IAAI,IAAI,GAAG;AAAA,MAChB;AAAA,IACF;AACA,QAAI,EAAE,WAAW,aAAa;AAC5B,YAAM,IAAI;AAAA,QACR,GAAG,IAAI,IAAI,GAAG;AAAA,MAChB;AAAA,IACF;AACA,UAAM,QAAQ,WAAW;AACzB,WAAO,GAAG,IAAI,cAAc,OAAO,GAAG,IAAI,IAAI,GAAG,EAAE;AAAA,EACrD;AACA,SAAO;AACT;AAEA,SAAS,mBAAmB,OAAe,MAAoB;AAC7D,MAAI,OAAO,sBAAsB,KAAK,EAAE,SAAS,GAAG;AAClD,UAAM,IAAI;AAAA,MACR,GAAG,IAAI;AAAA,IACT;AAAA,EACF;AACF;AAEA,SAAS,gBAAgB,KAAa,QAAyB;AAC7D,MAAI,CAAC,iBAAiB,KAAK,GAAG,GAAG;AAC/B,WAAO;AAAA,EACT;AACA,QAAM,QAAQ,OAAO,GAAG;AACxB,SAAO,OAAO,cAAc,KAAK,KAAK,SAAS,KAAK,QAAQ;AAC9D;AAEA,SAAS,gBAAgB,OAAsD;AAC7E,QAAM,OAAO,OAAO,KAAK,KAAK,EAAE,KAAK,iBAAiB;AACtD,QAAM,QAAQ,KAAK,IAAI,CAAC,QAAQ,GAAG,KAAK,UAAU,GAAG,CAAC,IAAI,UAAU,MAAM,GAAG,CAAC,CAAC,EAAE;AACjF,SAAO,IAAI,MAAM,KAAK,GAAG,CAAC;AAC5B;AAEA,SAAS,kBAAkB,GAAW,GAAmB;AACvD,QAAM,OAAO,MAAM,KAAK,CAAC;AACzB,QAAM,QAAQ,MAAM,KAAK,CAAC;AAC1B,QAAM,MAAM,KAAK,IAAI,KAAK,QAAQ,MAAM,MAAM;AAC9C,WAAS,QAAQ,GAAG,QAAQ,KAAK,SAAS;AACxC,UAAM,YAAY,KAAK,KAAK,EAAE,YAAY,CAAC,KAAK;AAChD,UAAM,aAAa,MAAM,KAAK,EAAE,YAAY,CAAC,KAAK;AAClD,QAAI,cAAc,YAAY;AAC5B,aAAO,YAAY;AAAA,IACrB;AAAA,EACF;AACA,SAAO,KAAK,SAAS,MAAM;AAC7B;AAEA,SAAS,0BAA0B,OAAe,MAAoB;AACpE,WAAS,QAAQ,GAAG,QAAQ,MAAM,QAAQ,SAAS;AACjD,UAAM,OAAO,MAAM,WAAW,KAAK;AACnC,QAAI,QAAQ,SAAU,QAAQ,OAAQ;AACpC,YAAM,OAAO,MAAM,WAAW,QAAQ,CAAC;AACvC,UAAI,OAAO,MAAM,IAAI,KAAK,OAAO,SAAU,OAAO,OAAQ;AACxD,cAAM,IAAI;AAAA,UACR,GAAG,IAAI;AAAA,QACT;AAAA,MACF;AACA;AACA;AAAA,IACF;AACA,QAAI,QAAQ,SAAU,QAAQ,OAAQ;AACpC,YAAM,IAAI;AAAA,QACR,GAAG,IAAI;AAAA,MACT;AAAA,IACF;AAAA,EACF;AACF;;;ACzNA,uBAAoC;AACpC,kBAAmC;AAGnC,IAAM,2BAA2B;AACjC,IAAM,cAAc,IAAI,YAAY;AAY7B,IAAM,wBAAN,cAAoC,MAAM;AAAA,EAG/C,YAAY,MAAiC,SAAiB;AAC5D,UAAM,OAAO;AACb,SAAK,OAAO;AACZ,SAAK,OAAO;AAAA,EACd;AACF;AAiBA,IAAMC,gBACH,OAEE,UACF,OAAO,UAAU,eAAe,KAAK;AAAA,EACpC,OAAO,UAAU;AACnB;AAEF,IAAM,mBAAmB,oBAAI,IAAI,CAAC,gBAAgB,iBAAiB,eAAe,CAAC;AACnF,IAAM,oBAAoB,oBAAI,IAAiC;AAE/D,WAAW,SAAS,sCAAqB;AACvC,MAAI,CAAC,iBAAiB,IAAI,MAAM,OAAO,GAAG;AACxC;AAAA,EACF;AACA,MAAI,MAAM,YAAY,UAAa,MAAM,YAAY,UAAa,MAAM,IAAI,SAAS,IAAI,GAAG;AAC1F;AAAA,EACF;AACA,QAAM,WAAW,kBAAkB,IAAI,MAAM,OAAO;AACpD,MAAI,aAAa,QAAW;AAC1B,sBAAkB,IAAI,MAAM,SAAS,oBAAI,IAAI,CAAC,MAAM,GAAG,CAAC,CAAC;AACzD;AAAA,EACF;AACA,EAAC,SAAyB,IAAI,MAAM,GAAG;AACzC;AAOO,SAAS,0BAA0B,OAAkC;AAC1E,SAAO,qCAAqC,OAAO,EAAE,kBAAkB,KAAK,CAAC;AAC/E;AAOO,SAAS,6BAA6B,OAAkC;AAC7E,SAAO,qCAAqC,OAAO,EAAE,kBAAkB,KAAK,CAAC;AAC/E;AAEO,SAAS,0BAA0B,OAAwB;AAChE,QAAM,YAAY,6BAA6B,KAAK;AACpD,QAAM,MAAM,YAAY,OAAO,gBAAgB,SAAS,CAAC;AACzD,QAAM,SAAS,YAAY,OAAO,GAAG,wBAAwB,IAAI;AACjE,QAAM,QAAQ,IAAI,WAAW,OAAO,SAAS,IAAI,MAAM;AACvD,QAAM,IAAI,QAAQ,CAAC;AACnB,QAAM,IAAI,KAAK,OAAO,MAAM;AAC5B,aAAO,4BAAW,oBAAO,OAAO,OAAO,CAAC,EAAE,MAAM,CAAC;AACnD;AAEO,SAAS,yBAAyB,WAAoB,SAA2B;AACtF,MAAI;AACJ,MAAI;AACJ,MAAI;AACF,WAAO,6BAA6B,SAAS;AAC7C,UAAM,6BAA6B,OAAO;AAAA,EAC5C,QAAQ;AACN,WAAO;AAAA,EACT;AACA,MAAI,KAAK,YAAY,IAAI,WAAW,KAAK,UAAU,IAAI,OAAO;AAC5D,WAAO;AAAA,EACT;AACA,MAAI,CAAC,aAAa,KAAK,MAAM,IAAI,IAAI,GAAG;AACtC,WAAO;AAAA,EACT;AACA,QAAM,cAAc,IAAI,IAAI,KAAK,OAAO;AACxC,aAAW,UAAU,IAAI,SAAS;AAChC,QAAI,CAAC,YAAY,IAAI,MAAM,GAAG;AAC5B,aAAO;AAAA,IACT;AAAA,EACF;AACA,SAAO,eAAe,KAAK,SAAS,IAAI,OAAO;AACjD;AAEA,SAAS,qCACP,OACA,SACkB;AAClB,QAAM,SAAS,aAAa,OAAO,GAAG;AACtC,kBAAgB,QAAQ,CAAC,WAAW,SAAS,QAAQ,WAAW,SAAS,GAAG,GAAG;AAC/E,QAAM,UAAU,eAAe,QAAQ,WAAW,KAAK,qCAAqC;AAC5F,MAAI,CAAC,iBAAiB,IAAI,OAAO,GAAG;AAClC,UAAM,IAAI;AAAA,MACR;AAAA,MACA;AAAA,IACF;AAAA,EACF;AACA,QAAM,QAAQ,eAAe,QAAQ,SAAS,KAAK,mCAAmC;AACtF,wBAAsB,KAAK;AAC3B,QAAM,iBAAiB,MAAM,UAAU,KAAK;AAC5C,MAAI,QAAQ,oBAAoB,mBAAmB,OAAO;AACxD,UAAM,IAAI;AAAA,MACR;AAAA,MACA;AAAA,IACF;AAAA,EACF;AACA,QAAM,UAAU,eAAe,QAAQ,QAAQ,KAAK,kCAAkC;AACtF,kBAAgB,SAAS,OAAO;AAChC,QAAM,OAAO,cAAc,OAAO;AAClC,MAAI,QAAQ,oBAAoB,SAAS,SAAS;AAChD,UAAM,IAAI;AAAA,MACR;AAAA,MACA;AAAA,IACF;AAAA,EACF;AACA,kBAAgB,MAAM,OAAO;AAC7B,QAAM,UAAU;AAAA,IACd,cAAc,QAAQ,WAAW,KAAK,oCAAoC;AAAA,IAC1E;AAAA,IACA;AAAA,EACF;AACA,QAAM,SAAS,uBAAO,OAAO,IAAI;AAOjC,SAAO,UAAU;AACjB,SAAO,QAAQ;AACf,SAAO,OAAO;AACd,SAAO,UAAU;AACjB,MAAI,OAAO,QAAQ,SAAS,GAAG;AAC7B,WAAO,UAAU;AAAA,MACf,cAAc,QAAQ,WAAW,KAAK,qCAAqC;AAAA,MAC3E,OAAO;AAAA,IACT;AAAA,EACF;AACA,SAAO;AACT;AAEA,SAAS,aAAa,OAAgB,MAA0B;AAC9D,MAAI;AACF,UAAM,aAAa,cAAc,KAAK;AACtC,QAAI,eAAe,QAAQ,OAAO,eAAe,YAAY,MAAM,QAAQ,UAAU,GAAG;AACtF,YAAM,IAAI,sBAAsB,+BAA+B,GAAG,IAAI,oBAAoB;AAAA,IAC5F;AACA,WAAO;AAAA,EACT,SAAS,OAAO;AACd,QAAI,iBAAiB,uBAAuB;AAC1C,YAAM;AAAA,IACR;AACA,UAAM,IAAI;AAAA,MACR;AAAA,MACA,iBAAiB,QAAQ,MAAM,UAAU,OAAO,KAAK;AAAA,IACvD;AAAA,EACF;AACF;AAEA,SAAS,gBAAgB,QAAoB,SAA4B,MAAoB;AAC3F,QAAM,aAAa,IAAI,IAAI,OAAO;AAClC,aAAW,OAAO,OAAO,KAAK,MAAM,GAAG;AACrC,QAAI,CAAC,WAAW,IAAI,GAAG,GAAG;AACxB,YAAM,IAAI;AAAA,QACR,QAAQ,QAAQ,QAAQ,UAAU,gCAAgC;AAAA,QAClE,GAAG,IAAI,sBAAsB,GAAG;AAAA,MAClC;AAAA,IACF;AAAA,EACF;AACF;AAEA,SAAS,cACP,QACA,KACA,MACA,MACW;AACX,MAAI,CAAC,OAAO,QAAQ,GAAG,GAAG;AACxB,UAAM,IAAI,sBAAsB,MAAM,GAAG,IAAI,IAAI,GAAG,cAAc;AAAA,EACpE;AACA,SAAO,OAAO,GAAG;AACnB;AAEA,SAAS,eACP,QACA,KACA,MACA,MACQ;AACR,QAAM,QAAQ,cAAc,QAAQ,KAAK,MAAM,IAAI;AACnD,MAAI,OAAO,UAAU,YAAY,MAAM,WAAW,GAAG;AACnD,UAAM,IAAI,sBAAsB,MAAM,GAAG,IAAI,IAAI,GAAG,6BAA6B;AAAA,EACnF;AACA,SAAO;AACT;AAEA,SAAS,cACP,QACA,KACA,MACA,MACsB;AACtB,QAAM,QAAQ,cAAc,QAAQ,KAAK,MAAM,IAAI;AACnD,MAAI,CAAC,MAAM,QAAQ,KAAK,GAAG;AACzB,UAAM,IAAI,sBAAsB,MAAM,GAAG,IAAI,IAAI,GAAG,mBAAmB;AAAA,EACzE;AACA,SAAO;AACT;AAEA,SAAS,sBAAsB,OAAqB;AAClD,MAAI,UAAU,OAAO,MAAM,SAAS,GAAG,KAAK,MAAM,SAAS,GAAG,KAAK,MAAM,SAAS,GAAG,GAAG;AACtF,UAAM,IAAI;AAAA,MACR;AAAA,MACA;AAAA,IACF;AAAA,EACF;AACF;AAEA,SAAS,gBAAgB,MAAc,SAAiC;AACtE,MAAI,KAAK,WAAW,GAAG;AACrB,UAAM,IAAI,sBAAsB,oCAAoC,iBAAiB;AAAA,EACvF;AACA,MAAI,CAAC,QAAQ,oBAAoB,KAAK,SAAS,GAAG,GAAG;AACnD,UAAM,IAAI;AAAA,MACR;AAAA,MACA;AAAA,IACF;AAAA,EACF;AACA,MAAI,KAAK,SAAS,IAAI,KAAK,KAAK,SAAS,IAAI,GAAG;AAC9C,UAAM,IAAI,sBAAsB,oCAAoC,yBAAyB;AAAA,EAC/F;AACA,QAAM,WAAW,KAAK,MAAM,GAAG;AAC/B,WAAS,QAAQ,GAAG,QAAQ,SAAS,QAAQ,SAAS;AACpD,UAAM,UAAU,SAAS,KAAK;AAC9B,UAAM,0BACJ,QAAQ,oBAAoB,UAAU,SAAS,SAAS,KAAK,QAAQ,WAAW;AAClF,QAAI,QAAQ,WAAW,KAAK,CAAC,yBAAyB;AACpD,YAAM,IAAI,sBAAsB,oCAAoC,6BAA6B;AAAA,IACnG;AACA,QAAI,YAAY,OAAO,YAAY,MAAM;AACvC,YAAM,IAAI;AAAA,QACR;AAAA,QACA;AAAA,MACF;AAAA,IACF;AACA,QAAI,YAAY,OAAO,YAAY,OAAO,QAAQ,SAAS,GAAG,KAAK,QAAQ,SAAS,GAAG,GAAG;AACxF,YAAM,IAAI;AAAA,QACR;AAAA,QACA;AAAA,MACF;AAAA,IACF;AAAA,EACF;AACF;AAEA,SAAS,cAAc,MAAsB;AAC3C,SAAO,iBAAiB,IAAI,EAAE,UAAU,KAAK;AAC/C;AAEA,SAAS,iBAAiB,MAAsB;AAC9C,SAAO,KAAK,QAAQ,oBAAoB,CAAC,YAAY;AACnD,UAAM,OAAO,OAAO,aAAa,OAAO,SAAS,QAAQ,MAAM,CAAC,GAAG,EAAE,CAAC;AACtE,WAAO,oBAAoB,KAAK,IAAI,IAAI,OAAO,QAAQ,YAAY;AAAA,EACrE,CAAC;AACH;AAEA,SAAS,iBACP,SACA,SACA,SACU;AACV,QAAM,WAAW,kBAAkB,IAAI,OAAO;AAC9C,MAAI,aAAa,QAAW;AAC1B,UAAM,IAAI;AAAA,MACR;AAAA,MACA;AAAA,IACF;AAAA,EACF;AACA,QAAM,SAAS,oBAAI,IAAY;AAC/B,QAAM,aAAuB,CAAC;AAC9B,WAAS,QAAQ,GAAG,QAAQ,QAAQ,QAAQ,SAAS;AACnD,UAAM,SAAS,QAAQ,KAAK;AAC5B,QAAI,OAAO,WAAW,YAAY,OAAO,WAAW,GAAG;AACrD,YAAM,IAAI;AAAA,QACR;AAAA,QACA,aAAa,KAAK;AAAA,MACpB;AAAA,IACF;AACA,QAAI,CAAC,OAAO,WAAW,GAAG,OAAO,GAAG,KAAK,OAAO,SAAS,GAAG,KAAK,CAAC,SAAS,IAAI,MAAM,GAAG;AACtF,YAAM,IAAI;AAAA,QACR;AAAA,QACA,aAAa,KAAK;AAAA,MACpB;AAAA,IACF;AACA,eAAW,KAAK,MAAM;AACtB,WAAO,IAAI,MAAM;AAAA,EACnB;AACA,MAAI,OAAO,SAAS,GAAG;AACrB,UAAM,IAAI;AAAA,MACR;AAAA,MACA;AAAA,IACF;AAAA,EACF;AACA,QAAM,oBAAoB,CAAC,GAAG,MAAM,EAAE,KAAK;AAC3C,MACE,QAAQ,qBACP,WAAW,WAAW,kBAAkB,UACvC,WAAW,KAAK,CAAC,QAAQ,UAAU,WAAW,kBAAkB,KAAK,CAAC,IACxE;AACA,UAAM,IAAI;AAAA,MACR;AAAA,MACA;AAAA,IACF;AAAA,EACF;AACA,SAAO;AACT;AAEA,SAAS,gBAAgB,OAAkB,SAAkD;AAC3F,MAAI,UAAU,QAAQ,OAAO,UAAU,YAAY,MAAM,QAAQ,KAAK,GAAG;AACvE,UAAM,IAAI;AAAA,MACR;AAAA,MACA;AAAA,IACF;AAAA,EACF;AACA,MAAI,YAAY,iBAAiB;AAC/B,WAAO,mBAAmB,KAAmB;AAAA,EAC/C;AACA,QAAM,IAAI;AAAA,IACR;AAAA,IACA;AAAA,EACF;AACF;AAEA,SAAS,mBAAmB,OAA+B;AACzD,mBAAiB,OAAO,CAAC,QAAQ,YAAY,YAAY,GAAG,WAAW;AACvE,QAAM,OAAO,aAAa,OAAO,QAAQ,WAAW;AACpD,MAAI,SAAS,0BAA0B;AACrC,UAAM,IAAI;AAAA,MACR;AAAA,MACA;AAAA,IACF;AAAA,EACF;AACA,MAAI,eAAe,OAAO,YAAY,WAAW,MAAM,MAAM;AAC3D,UAAM,IAAI;AAAA,MACR;AAAA,MACA;AAAA,IACF;AAAA,EACF;AACA,QAAM,aAAa,eAAe,OAAO,cAAc,WAAW;AAClE,MAAI,CAAC,MAAM,QAAQ,UAAU,KAAK,WAAW,WAAW,GAAG;AACzD,UAAM,IAAI;AAAA,MACR;AAAA,MACA;AAAA,IACF;AAAA,EACF;AACA,WAAS,QAAQ,GAAG,QAAQ,WAAW,QAAQ,SAAS;AACtD,yBAAqB,WAAW,KAAK,GAAG,wBAAwB,KAAK,GAAG;AAAA,EAC1E;AACA,SAAO;AACT;AAEA,SAAS,qBAAqB,OAAkB,MAAoB;AAClE,MAAI,UAAU,QAAQ,OAAO,UAAU,YAAY,MAAM,QAAQ,KAAK,GAAG;AACvE,UAAM,IAAI,sBAAsB,uCAAuC,GAAG,IAAI,oBAAoB;AAAA,EACpG;AACA,QAAM,SAAS;AACf,mBAAiB,QAAQ,CAAC,QAAQ,OAAO,aAAa,GAAG,IAAI;AAC7D,eAAa,QAAQ,QAAQ,IAAI;AACjC,eAAa,QAAQ,OAAO,IAAI;AAChC,QAAM,cAAc,eAAe,QAAQ,eAAe,IAAI;AAC9D,MAAI,CAAC,MAAM,QAAQ,WAAW,GAAG;AAC/B,UAAM,IAAI;AAAA,MACR;AAAA,MACA,GAAG,IAAI;AAAA,IACT;AAAA,EACF;AACA,WAAS,QAAQ,GAAG,QAAQ,YAAY,QAAQ,SAAS;AACvD,uBAAmB,YAAY,KAAK,GAAG,GAAG,IAAI,gBAAgB,KAAK,GAAG;AAAA,EACxE;AACF;AAEA,SAAS,mBAAmB,OAAkB,MAAoB;AAChE,MAAI,UAAU,QAAQ,OAAO,UAAU,YAAY,MAAM,QAAQ,KAAK,GAAG;AACvE,UAAM,IAAI,sBAAsB,uCAAuC,GAAG,IAAI,oBAAoB;AAAA,EACpG;AACA,QAAM,SAAS;AACf,mBAAiB,QAAQ,CAAC,SAAS,OAAO,GAAG,IAAI;AACjD,QAAM,QAAQ,eAAe,QAAQ,SAAS,IAAI;AAClD,MAAI,OAAO,UAAU,YAAY,CAAC,OAAO,cAAc,KAAK,KAAK,QAAQ,GAAG;AAC1E,UAAM,IAAI;AAAA,MACR;AAAA,MACA,GAAG,IAAI;AAAA,IACT;AAAA,EACF;AACA,iBAAe,QAAQ,SAAS,IAAI;AACtC;AAEA,SAAS,iBAAiB,QAAoB,SAA4B,MAAoB;AAC5F,QAAM,aAAa,IAAI,IAAI,OAAO;AAClC,aAAW,OAAO,OAAO,KAAK,MAAM,GAAG;AACrC,QAAI,CAAC,WAAW,IAAI,GAAG,GAAG;AACxB,YAAM,IAAI;AAAA,QACR;AAAA,QACA,GAAG,IAAI,sBAAsB,GAAG;AAAA,MAClC;AAAA,IACF;AAAA,EACF;AACF;AAEA,SAAS,eAAe,QAAoB,KAAa,MAAyB;AAChF,MAAI,CAAC,OAAO,QAAQ,GAAG,GAAG;AACxB,UAAM,IAAI;AAAA,MACR;AAAA,MACA,GAAG,IAAI,IAAI,GAAG;AAAA,IAChB;AAAA,EACF;AACA,SAAO,OAAO,GAAG;AACnB;AAEA,SAAS,aAAa,QAAoB,KAAa,MAAsB;AAC3E,QAAM,QAAQ,eAAe,QAAQ,KAAK,IAAI;AAC9C,MAAI,OAAO,UAAU,YAAY,MAAM,WAAW,GAAG;AACnD,UAAM,IAAI;AAAA,MACR;AAAA,MACA,GAAG,IAAI,IAAI,GAAG;AAAA,IAChB;AAAA,EACF;AACA,SAAO;AACT;AAEA,SAAS,aAAa,WAAmB,SAA0B;AACjE,MAAI,cAAc,SAAS;AACzB,WAAO;AAAA,EACT;AACA,SAAO,UAAU,SAAS,GAAG,KAAK,QAAQ,WAAW,SAAS;AAChE;AAEA,SAAS,eAAe,WAAmC,SAA0C;AACnG,MAAI,cAAc,QAAW;AAC3B,WAAO,YAAY;AAAA,EACrB;AACA,MAAI,YAAY,QAAW;AACzB,WAAO,OAAO,KAAK,SAAS,EAAE,WAAW;AAAA,EAC3C;AACA,MAAI,UAAU,SAAS,4BAA4B,QAAQ,SAAS,0BAA0B;AAC5F,WAAO;AAAA,EACT;AACA,QAAM,sBAAsB,MAAM,QAAQ,UAAU,UAAU,IAAI,UAAU,aAAa,CAAC;AAC1F,QAAM,oBAAoB,MAAM,QAAQ,QAAQ,UAAU,IAAI,QAAQ,aAAa,CAAC;AACpF,SAAO,kBAAkB;AAAA,IAAM,CAAC,cAC9B,oBAAoB,KAAK,CAAC,cAAc,gBAAgB,SAAS,MAAM,gBAAgB,SAAS,CAAC;AAAA,EACnG;AACF;AAEA,SAAS,OAAO,QAAoB,KAAsB;AACxD,SAAOA,cAAa,QAAQ,GAAG;AACjC;;;AC3eA,qBAAwB;AACxB,oBAAsB;AACtB,IAAAC,eAAkD;;;ACFlD,IAAAC,eAAsC;AAmB/B,IAAM,qBAAN,cAAiC,MAAM;AAAA,EAC5C,YAAY,SAAiB;AAC3B,UAAM,OAAO;AACb,SAAK,OAAO;AAAA,EACd;AACF;AAEA,IAAM,aAAa;AAcnB,SAAS,mBAAmB,SAAuB;AACjD,MAAI,CAAC,OAAO,cAAc,OAAO,KAAK,WAAW,GAAG;AAClD,UAAM,IAAI,mBAAmB,6BAA6B,OAAO,EAAE;AAAA,EACrE;AACF;AAEO,SAAS,aAAa,OAAwB;AACnD,aAAO,wBAAU,OAAO,EAAE,QAAQ,MAAM,CAAC;AAC3C;AAEO,SAAS,oBAAoB,SAAmC;AACrE,MAAI,CAAC,aAAa,OAAO,GAAG;AAC1B,UAAM,IAAI,mBAAmB,wBAAwB,OAAO,EAAE;AAAA,EAChE;AACA,aAAO,yBAAW,OAAO;AAC3B;AAWO,SAAS,YAAY,KAAiC;AAC3D,QAAM,QAAQ,IAAI,MAAM,UAAU;AAClC,MAAI,CAAC,MAAO,QAAO;AAEnB,QAAM,UAAU,OAAO,MAAM,CAAC,CAAC;AAC/B,qBAAmB,OAAO;AAE1B,SAAO;AAAA,IACL,QAAQ;AAAA,IACR,WAAW;AAAA,IACX;AAAA,IACA,SAAS,oBAAoB,MAAM,CAAC,CAAC;AAAA,EACvC;AACF;;;AD7DO,IAAM,gBAAgB;AACtB,IAAM,uBAAuB;AAC7B,IAAM,8BACX;AAEK,IAAM,8BAA8B;AACpC,IAAM,6BACX;AA0GF,IAAM,cAA0D;AAAA,EAC9D,QAAQ;AAAA,IACN,MAAM;AAAA,IACN,QAAQ;AAAA,IACR,SAAS;AAAA,IACT,UAAU;AAAA,IACV,QAAQ;AAAA,EACV;AAAA,EACA,cAAc;AAAA,IACZ,MAAM;AAAA,IACN,QAAQ;AAAA,IACR,SAAS;AAAA,IACT,UAAU;AAAA,IACV,QAAQ;AAAA,EACV;AAAA,EACA,oBAAoB;AAAA,IAClB,MAAM;AAAA,IACN,QAAQ;AAAA,IACR,SAAS;AAAA,IACT,UAAU;AAAA,IACV,QAAQ;AAAA,EACV;AACF;AAEA,IAAMC,eAAc,IAAI,YAAY;AACpC,IAAM,kBAAkB;AACxB,IAAM,eAAe;AACrB,IAAMC,gBACH,OAEE,UACF,OAAO,UAAU,eAAe,KAAK;AAAA,EACpC,OAAO,UAAU;AACnB;AAEK,SAAS,iCAAiC,OAAwB;AACvE,SAAO,gBAAgB,KAAK;AAC9B;AAEO,SAAS,2BAA2B,OAAsC;AAC/E,QAAM,aAAa,sBAAsB,KAAK;AAC9C,QAAM,WAAW,8BAA8B,OAAO,UAAU;AAChE,SAAO,oBAAoB,UAAU,UAAU;AACjD;AAEO,SAAS,kBAAkB,OAAwB;AACxD,SAAO,2BAA2B,KAAK,EAAE;AAC3C;AAEA,eAAsB,0BACpB,OACA,QAC6B;AAC7B,QAAM,aAAa,iBAAiB,cAAc,KAAK,GAAG,GAAG;AAC7D,QAAM,aAAa,sBAAsB,UAAU;AACnD,QAAM,WAAW,uBAAuB,YAAY,UAAU;AAC9D,QAAM,WAAW,8BAA8B,UAAU,UAAU;AACnE,MAAI,WAAW,SAAS,UAAU;AAChC,+CAA2C,QAAQ;AAAA,EACrD;AACA,gCAA8B,OAAO,KAAK;AAC1C,oBAAkB,OAAO,WAAW,oBAAoB;AACxD,8BAA4B,OAAO,WAAW,OAAO,KAAK;AAC1D,mCAAiC,UAAU,OAAO,SAAS;AAC3D,QAAM,WAAW,oBAAoB,UAAU,UAAU;AACzD,QAAM,iBAAiB;AAAA,IACrB,MAAM,OAAO,WAAW,SAAS,MAAM;AAAA,IACvC,OAAO;AAAA,EACT;AACA,QAAM,YAAY,kBAAkB;AAAA,IAClC,OAAO,OAAO;AAAA,IACd,WAAW,OAAO;AAAA,IAClB,OAAO;AAAA,EACT,CAAC;AACD,SAAO;AAAA,IACL,GAAG;AAAA,IACH,CAAC,WAAW,OAAO,GAAG,SAAS;AAAA,IAC/B;AAAA,EACF;AACF;AAEO,SAAS,oBACd,OACA,QACiB;AACjB,SAAO,0BAA0B,OAAO,MAAM,EAAE;AAAA,IAAK,CAAC,WACpD,0BAA0B,MAAM;AAAA,EAClC;AACF;AAEO,SAAS,0BACd,OACA,QACuB;AACvB,SAAO,0BAA0B,OAAO,MAAM,EAAE;AAAA,IAAK,CAAC,WACpD,gCAAgC,MAAM;AAAA,EACxC;AACF;AAEO,SAAS,gCACd,OACA,QAC6B;AAC7B,SAAO,0BAA0B,OAAO,MAAM,EAAE;AAAA,IAAK,CAAC,WACpD,sCAAsC,MAAM;AAAA,EAC9C;AACF;AAEA,eAAsB,mBACpB,OACyE;AACzE,QAAM,SAAS,0BAA0B,KAAK;AAC9C,QAAM,aAAa;AACnB,QAAM,aAAa,oBAAoB,OAAO,MAAM;AACpD,QAAM,YAAY,kBAAkB,OAAO,SAAS;AACpD,mCAAiC,YAAY,SAAS;AACtD,QAAM,WAAW,uBAAuB,YAAY,UAAU;AAC9D,QAAM,WAAW,oBAAoB,UAAU,UAAU;AACzD,kBAAgB,YAAY,UAAU,UAAU;AAChD,MAAI,CAAE,MAAM,gBAAgB,WAAW,SAAS,MAAM,GAAI;AACxD,UAAM,IAAI,2BAA2B,+BAA+B;AAAA,EACtE;AACA,SAAO,EAAE,QAAQ,QAAQ,SAAS;AACpC;AAEA,eAAsB,aACpB,OAC6D;AAC7D,QAAM,SAAS,MAAM,mBAAmB,KAAK;AAC7C,SAAO;AAAA,IACL,QAAQ,0BAA0B,OAAO,MAAM;AAAA,IAC/C,UAAU,OAAO;AAAA,EACnB;AACF;AAEA,eAAsB,mBACpB,OACmE;AACnE,QAAM,SAAS,MAAM,mBAAmB,KAAK;AAC7C,SAAO;AAAA,IACL,QAAQ,gCAAgC,OAAO,MAAM;AAAA,IACrD,UAAU,OAAO;AAAA,EACnB;AACF;AAEA,eAAsB,yBACpB,OACyE;AACzE,QAAM,SAAS,MAAM,mBAAmB,KAAK;AAC7C,SAAO;AAAA,IACL,QAAQ,sCAAsC,OAAO,MAAM;AAAA,IAC3D,UAAU,OAAO;AAAA,EACnB;AACF;AAEA,eAAsB,qBACpB,OACiD;AACjD,MAAI;AACF,UAAM,SAAS,MAAM,aAAa,KAAK;AACvC,WAAO,EAAE,IAAI,MAAM,QAAQ,OAAO,QAAQ,UAAU,OAAO,SAAS;AAAA,EACtE,SAAS,OAAO;AACd,WAAO,EAAE,IAAI,OAAO,OAAO,oBAAoB,KAAK,EAAE;AAAA,EACxD;AACF;AAEA,eAAsB,2BACpB,OACuD;AACvD,MAAI;AACF,UAAM,SAAS,MAAM,mBAAmB,KAAK;AAC7C,WAAO,EAAE,IAAI,MAAM,QAAQ,OAAO,QAAQ,UAAU,OAAO,SAAS;AAAA,EACtE,SAAS,OAAO;AACd,WAAO,EAAE,IAAI,OAAO,OAAO,oBAAoB,KAAK,EAAE;AAAA,EACxD;AACF;AAEA,eAAsB,iCACpB,OAC6D;AAC7D,MAAI;AACF,UAAM,SAAS,MAAM,yBAAyB,KAAK;AACnD,WAAO,EAAE,IAAI,MAAM,QAAQ,OAAO,QAAQ,UAAU,OAAO,SAAS;AAAA,EACtE,SAAS,OAAO;AACd,WAAO,EAAE,IAAI,OAAO,OAAO,oBAAoB,KAAK,EAAE;AAAA,EACxD;AACF;AAEO,SAAS,uBAAuB,OAAgC;AACrE,SAAO,oBAAoB,OAAO,KAAK;AACzC;AAEO,SAAS,6BAA6B,OAAsC;AACjF,SAAO,0BAA0B,OAAO,KAAK;AAC/C;AAEO,SAAS,mCACd,OAC4B;AAC5B,SAAO,gCAAgC,OAAO,KAAK;AACrD;AAEO,SAAS,0BAA0B,OAAwB;AAChE,SAAO,oBAAoB,OAAO,IAAI;AACxC;AAEO,SAAS,gCAAgC,OAA8B;AAC5E,SAAO,0BAA0B,OAAO,IAAI;AAC9C;AAEO,SAAS,sCACd,OACoB;AACpB,SAAO,gCAAgC,OAAO,IAAI;AACpD;AAEA,SAAS,0BAA0B,OAAoC;AACrE,QAAM,aAAa,iBAAiB,cAAc,KAAK,GAAG,GAAG;AAC7D,QAAM,SAASC,gBAAe,YAAY,UAAU,GAAG;AACvD,QAAM,aAAa,oBAAoB,MAAM;AAC7C,UAAQ,WAAW,MAAM;AAAA,IACvB,KAAK;AACH,aAAO,0BAA0B,UAAU;AAAA,IAC7C,KAAK;AACH,aAAO,gCAAgC,UAAU;AAAA,IACnD,KAAK;AACH,aAAO,sCAAsC,UAAU;AAAA,EAC3D;AACF;AAEA,SAAS,8BACP,OACA,YACY;AACZ,UAAQ,WAAW,MAAM;AAAA,IACvB,KAAK;AACH,aAAO,uBAAuB,KAAK;AAAA,IACrC,KAAK;AACH,aAAO,6BAA6B,KAAK;AAAA,IAC3C,KAAK;AACH,aAAO,mCAAmC,KAAK;AAAA,EACnD;AACF;AAEA,SAAS,oBAAoB,OAAgB,QAA6B;AACxE,QAAM,SAAS,iBAAiB,cAAc,KAAK,GAAG,GAAG;AACzD,EAAAC;AAAA,IACE;AAAA,IACA,SACI;AAAA,MACE;AAAA,MACA;AAAA,MACA;AAAA,MACA;AAAA,MACA;AAAA,MACA;AAAA,MACA;AAAA,MACA;AAAA,MACA;AAAA,MACA;AAAA,MACA;AAAA,MACA;AAAA,IACF,IACA;AAAA,MACE;AAAA,MACA;AAAA,MACA;AAAA,MACA;AAAA,MACA;AAAA,MACA;AAAA,MACA;AAAA,MACA;AAAA,MACA;AAAA,MACA;AAAA,IACF;AAAA,IACJ;AAAA,EACF;AACA,cAAYD,gBAAe,QAAQ,UAAU,GAAG,GAAG,eAAe,UAAU;AAC5E,MAAI,QAAQ;AACV,IAAAA,gBAAe,QAAQ,YAAY,GAAG;AACtC,sBAAkBE,eAAc,QAAQ,aAAa,GAAG,CAAC;AAAA,EAC3D;AACA,EAAAF,gBAAe,QAAQ,YAAY,GAAG;AACtC,EAAAA,gBAAe,QAAQ,iBAAiB,GAAG;AAC3C,qBAAmB,QAAQ,aAAa,GAAG;AAC3C,qBAAmB,QAAQ,aAAa,GAAG;AAC3C,yBAAuBE,eAAc,QAAQ,YAAY,GAAG,GAAG,YAAY;AAC3E,qBAAmBA,eAAc,QAAQ,QAAQ,GAAG,GAAG,QAAQ;AAC/D,gBAAcA,eAAc,QAAQ,SAAS,GAAG,GAAG,SAAS;AAC5D,MAAIC,QAAO,QAAQ,YAAY,GAAG;AAChC,uBAAmBD,eAAc,QAAQ,cAAc,GAAG,GAAG,cAAc;AAAA,EAC7E;AACA,MAAIC,QAAO,QAAQ,OAAO,GAAG;AAC3B,kBAAcD,eAAc,QAAQ,SAAS,GAAG,GAAG,SAAS;AAAA,EAC9D;AACA,SAAO;AACT;AAEA,SAAS,0BAA0B,OAAgB,QAA6B;AAC9E,QAAM,SAAS,iBAAiB,cAAc,KAAK,GAAG,GAAG;AACzD,EAAAD;AAAA,IACE;AAAA,IACA,SACI;AAAA,MACE;AAAA,MACA;AAAA,MACA;AAAA,MACA;AAAA,MACA;AAAA,MACA;AAAA,MACA;AAAA,MACA;AAAA,MACA;AAAA,MACA;AAAA,IACF,IACA;AAAA,MACE;AAAA,MACA;AAAA,MACA;AAAA,MACA;AAAA,MACA;AAAA,MACA;AAAA,MACA;AAAA,MACA;AAAA,IACF;AAAA,IACJ;AAAA,EACF;AACA,cAAYD,gBAAe,QAAQ,UAAU,GAAG,GAAG,sBAAsB,UAAU;AACnF,MAAI,QAAQ;AACV,IAAAA,gBAAe,QAAQ,YAAY,GAAG;AACtC,sBAAkBE,eAAc,QAAQ,aAAa,GAAG,CAAC;AAAA,EAC3D;AACA,EAAAF,gBAAe,QAAQ,YAAY,GAAG;AACtC,EAAAA,gBAAe,QAAQ,YAAY,GAAG;AACtC,kBAAgB,QAAQ,YAAY,KAAK,CAAC;AAC1C,cAAYA,gBAAe,QAAQ,eAAe,GAAG,GAAG;AAAA,IACtD;AAAA,IACA;AAAA,IACA;AAAA,EACF,GAAG,eAAe;AAClB,qBAAmB,QAAQ,eAAe,GAAG;AAC7C,iBAAe,QAAQ,cAAc,GAAG;AACxC,EAAAA,gBAAe,QAAQ,iBAAiB,GAAG;AAC3C,SAAO;AACT;AAEA,SAAS,gCACP,OACA,QACY;AACZ,QAAM,SAAS,iBAAiB,cAAc,KAAK,GAAG,GAAG;AACzD,EAAAC;AAAA,IACE;AAAA,IACA,SACI;AAAA,MACE;AAAA,MACA;AAAA,MACA;AAAA,MACA;AAAA,MACA;AAAA,MACA;AAAA,MACA;AAAA,MACA;AAAA,MACA;AAAA,MACA;AAAA,IACF,IACA;AAAA,MACE;AAAA,MACA;AAAA,MACA;AAAA,MACA;AAAA,MACA;AAAA,MACA;AAAA,MACA;AAAA,MACA;AAAA,IACF;AAAA,IACJ;AAAA,EACF;AACA;AAAA,IACED,gBAAe,QAAQ,UAAU,GAAG;AAAA,IACpC;AAAA,IACA;AAAA,EACF;AACA,MAAI,QAAQ;AACV,IAAAA,gBAAe,QAAQ,kBAAkB,GAAG;AAC5C,sBAAkBE,eAAc,QAAQ,aAAa,GAAG,CAAC;AAAA,EAC3D;AACA,EAAAF,gBAAe,QAAQ,YAAY,GAAG;AACtC,EAAAA,gBAAe,QAAQ,YAAY,GAAG;AACtC,EAAAA,gBAAe,QAAQ,YAAY,GAAG;AACtC;AAAA,IAAoB;AAAA,IAAQ;AAAA,IAA2B;AAAA,IAAK,CAAC,OAAO,SAClE,YAAY,OAAO,MAAM,IAAI;AAAA,EAC/B;AACA,sBAAoB,QAAQ,8BAA8B,GAAG;AAC7D,EAAAA,gBAAe,QAAQ,kBAAkB,GAAG;AAC5C,qBAAmB,QAAQ,aAAa,GAAG;AAC3C,SAAO;AACT;AAEA,SAAS,kBAAkB,OAAuC;AAChE,QAAM,SAAS,iBAAiB,OAAO,aAAa;AACpD,EAAAC,iBAAgB,QAAQ,CAAC,SAAS,aAAa,OAAO,GAAG,aAAa;AACtE,QAAM,QAAQD,gBAAe,QAAQ,SAAS,aAAa;AAC3D,gCAA8B,KAAK;AACnC,QAAM,YAAYA,gBAAe,QAAQ,aAAa,aAAa;AACnE,QAAM,QAAQA,gBAAe,QAAQ,SAAS,aAAa;AAC3D,uBAAqB,OAAO,KAAK;AACjC,SAAO,EAAE,OAAO,WAAW,MAAM;AACnC;AAEA,SAAS,uBAAuB,OAAgB,MAAoB;AAClE,QAAM,SAAS,iBAAiB,OAAO,IAAI;AAC3C,EAAAC,iBAAgB,QAAQ,CAAC,gBAAgB,cAAc,oBAAoB,GAAG,IAAI;AAClF,EAAAD,gBAAe,QAAQ,gBAAgB,IAAI;AAC3C,EAAAA,gBAAe,QAAQ,cAAc,IAAI;AACzC,QAAM,UAAUI,eAAc,QAAQ,sBAAsB,MAAM,CAAC;AACnE,WAAS,QAAQ,GAAG,QAAQ,QAAQ,QAAQ,SAAS;AACnD,6BAAyB,QAAQ,KAAK,GAAG,GAAG,IAAI,uBAAuB,KAAK,GAAG;AAAA,EACjF;AACF;AAEA,SAAS,2CAA2C,OAAyB;AAC3E,QAAM,WAAW,iBAAiBF,eAAc,OAAO,YAAY,GAAG,GAAG,YAAY;AACrF,QAAM,UAAUE,eAAc,UAAU,sBAAsB,cAAc,CAAC;AAC7E,WAAS,QAAQ,GAAG,QAAQ,QAAQ,QAAQ,SAAS;AACnD;AAAA,MACE,QAAQ,KAAK;AAAA,MACb,iCAAiC,KAAK;AAAA,IACxC;AAAA,EACF;AACF;AAEA,SAAS,yBAAyB,OAAgB,MAAoB;AACpE,QAAM,SAAS,iBAAiB,OAAO,IAAI;AAC3C,MAAI;AACF,UAAM,YAAY,6BAA6B,MAAM;AACrD,QAAI,gBAAgB,MAAM,MAAM,gBAAgB,SAAS,GAAG;AAC1D,YAAM,IAAI,wBAAwB,GAAG,IAAI,0CAA0C;AAAA,IACrF;AAAA,EACF,SAAS,OAAO;AACd,QAAI,iBAAiB,yBAAyB;AAC5C,YAAM;AAAA,IACR;AACA,UAAM,IAAI;AAAA,MACR,iBAAiB,QAAQ,MAAM,UAAU,OAAO,KAAK;AAAA,IACvD;AAAA,EACF;AACF;AAEA,SAAS,mCAAmC,OAAgB,MAAoB;AAC9E,QAAM,SAAS,iBAAiB,OAAO,IAAI;AAC3C,MAAI;AACF,UAAM,YAAY,0BAA0B,MAAM;AAClD,QAAI,gBAAgB,MAAM,MAAM,gBAAgB,SAAS,GAAG;AAC1D,YAAM,IAAI,wBAAwB,GAAG,IAAI,iDAAiD;AAAA,IAC5F;AAAA,EACF,SAAS,OAAO;AACd,QAAI,iBAAiB,yBAAyB;AAC5C,YAAM;AAAA,IACR;AACA,UAAM,IAAI;AAAA,MACR,iBAAiB,QAAQ,MAAM,UAAU,OAAO,KAAK;AAAA,IACvD;AAAA,EACF;AACF;AAEA,SAAS,mBAAmB,OAAgB,MAAoB;AAC9D,QAAM,SAAS,iBAAiB,OAAO,IAAI;AAC3C,QAAM,OAAO,OAAO,KAAK,MAAM;AAC/B,MAAI,KAAK,WAAW,GAAG;AACrB,UAAM,IAAI,wBAAwB,GAAG,IAAI,uCAAuC;AAAA,EAClF;AACA,QAAM,MAAM,KAAK,CAAC;AAClB,MAAI,QAAQ,WAAW,QAAQ,SAAS;AACtC,UAAM,SAASA,eAAc,QAAQ,KAAK,MAAM,CAAC;AACjD,aAAS,QAAQ,GAAG,QAAQ,OAAO,QAAQ,SAAS;AAClD,yBAAmB,OAAO,KAAK,GAAG,GAAG,IAAI,IAAI,GAAG,IAAI,KAAK,GAAG;AAAA,IAC9D;AACA;AAAA,EACF;AACA,MAAI,QAAQ,WAAW;AACrB,UAAM,UAAU,iBAAiBF,eAAc,QAAQ,WAAW,IAAI,GAAG,GAAG,IAAI,UAAU;AAC1F,IAAAD,iBAAgB,SAAS,CAAC,KAAK,GAAG,GAAG,IAAI,UAAU;AACnD,IAAAD,gBAAe,SAAS,OAAO,GAAG,IAAI,UAAU;AAChD;AAAA,EACF;AACA,MAAI,QAAQ,YAAY;AACtB,gCAA4BE,eAAc,QAAQ,YAAY,IAAI,GAAG,GAAG,IAAI,WAAW;AACvF;AAAA,EACF;AACA,QAAM,IAAI,wBAAwB,GAAG,IAAI,+BAA+B,GAAG,EAAE;AAC/E;AAEA,SAAS,4BAA4B,OAAgB,MAAoB;AACvE,QAAM,SAAS,iBAAiB,OAAO,IAAI;AAC3C,EAAAD;AAAA,IACE;AAAA,IACA,CAAC,iBAAiB,YAAY,gBAAgB,aAAa,WAAW;AAAA,IACtE;AAAA,EACF;AACA,EAAAD,gBAAe,QAAQ,iBAAiB,IAAI;AAC5C,EAAAA,gBAAe,QAAQ,YAAY,IAAI;AACvC,EAAAE,eAAc,QAAQ,gBAAgB,IAAI;AAC1C,MAAIC,QAAO,QAAQ,WAAW,GAAG;AAC/B,UAAM,YAAY,iBAAiBD,eAAc,QAAQ,aAAa,IAAI,GAAG,GAAG,IAAI,YAAY;AAChG,IAAAD;AAAA,MACE;AAAA,MACA,CAAC,WAAW,mBAAmB,4BAA4B;AAAA,MAC3D,GAAG,IAAI;AAAA,IACT;AACA,mBAAe,WAAW,WAAW,GAAG,IAAI,YAAY;AACxD,QAAIE,QAAO,WAAW,iBAAiB,GAAG;AACxC,0BAAoB,WAAW,mBAAmB,GAAG,IAAI,YAAY;AAAA,IACvE;AACA,oBAAgB,WAAW,8BAA8B,GAAG,IAAI,YAAY;AAAA,EAC9E;AACA,MAAIA,QAAO,QAAQ,WAAW,GAAG;AAC/B,UAAM,YAAY,iBAAiBD,eAAc,QAAQ,aAAa,IAAI,GAAG,GAAG,IAAI,YAAY;AAChG,IAAAD,iBAAgB,WAAW,CAAC,qBAAqB,GAAG,GAAG,IAAI,YAAY;AACvE,oBAAgB,WAAW,uBAAuB,GAAG,IAAI,cAAc,CAAC;AAAA,EAC1E;AACF;AAEA,SAAS,cAAc,OAAgB,MAAoB;AACzD,QAAM,SAAS,iBAAiB,OAAO,IAAI;AAC3C,EAAAA,iBAAgB,QAAQ,CAAC,UAAU,iBAAiB,kBAAkB,YAAY,GAAG,IAAI;AACzF,cAAYD,gBAAe,QAAQ,UAAU,IAAI,GAAG,uBAAuB,GAAG,IAAI,SAAS;AAC3F,kBAAgB,QAAQ,iBAAiB,MAAM,CAAC;AAChD,cAAYA,gBAAe,QAAQ,kBAAkB,IAAI,GAAG;AAAA,IAC1D;AAAA,IACA;AAAA,EACF,GAAG,GAAG,IAAI,iBAAiB;AAC3B,cAAYA,gBAAe,QAAQ,cAAc,IAAI,GAAG;AAAA,IACtD;AAAA,IACA;AAAA,EACF,GAAG,GAAG,IAAI,aAAa;AACzB;AAEA,SAAS,mBAAmB,OAAgB,MAAoB;AAC9D,QAAM,SAAS,iBAAiB,OAAO,IAAI;AAC3C,EAAAC,iBAAgB,QAAQ,CAAC,QAAQ,GAAG,IAAI;AACxC,cAAYD,gBAAe,QAAQ,UAAU,IAAI,GAAG,CAAC,QAAQ,QAAQ,OAAO,GAAG,GAAG,IAAI,SAAS;AACjG;AAEA,SAAS,cAAc,OAAgB,MAAoB;AACzD,QAAM,SAAS,iBAAiB,OAAO,IAAI;AAC3C,EAAAC,iBAAgB,QAAQ,CAAC,UAAU,GAAG,IAAI;AAC1C,cAAYD,gBAAe,QAAQ,YAAY,IAAI,GAAG,CAAC,OAAO,YAAY,MAAM,GAAG,GAAG,IAAI,WAAW;AACvG;AAEA,SAAS,oBACP,UACA,YACsB;AACtB,QAAM,MAAM,gBAAgB,QAAQ;AACpC,QAAM,WAAWF,aAAY,OAAO,GAAG;AACvC,QAAM,SAAS,YAAY,YAAYA,aAAY,OAAO,GAAG,WAAW,MAAM,IAAI,GAAG,QAAQ,CAAC;AAC9F,QAAM,KAAK,GAAG,WAAW,QAAQ,GAAG,iBAAiB,MAAM,CAAC;AAC5D,SAAO;AAAA,IACL,MAAM,WAAW;AAAA,IACjB,SAAS,WAAW;AAAA,IACpB;AAAA,IACA,QAAQ,WAAW;AAAA,IACnB;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA,eAAW,yBAAW,MAAM,EAAE,MAAM,CAAC;AAAA,EACvC;AACF;AAEA,SAAS,gBACP,QACA,UACA,YACM;AACN,QAAM,SAASE,gBAAe,QAAQ,WAAW,SAAS,GAAG;AAC7D,MAAI,WAAW,SAAS,IAAI;AAC1B;AAAA,EACF;AACA,MAAI,IAAI,OAAO,IAAI,WAAW,QAAQ,eAAe,EAAE,KAAK,MAAM,GAAG;AACnE,UAAM,IAAI;AAAA,MACR,GAAG,WAAW,OAAO;AAAA,IACvB;AAAA,EACF;AACA,QAAM,IAAI,oBAAoB,GAAG,WAAW,OAAO,mBAAmB,WAAW,QAAQ,EAAE;AAC7F;AAEA,SAAS,iCACP,UACA,WACM;AACN,MAAI,CAACG,QAAO,UAAU,eAAe,GAAG;AACtC;AAAA,EACF;AACA,QAAM,gBAAgBH,gBAAe,UAAU,iBAAiB,GAAG;AACnE,MAAI,kBAAkB,WAAW;AAC/B,UAAM,IAAI;AAAA,MACR,cAAc,SAAS,iCAAiC,aAAa;AAAA,IACvE;AAAA,EACF;AACF;AAEA,SAAS,iCACP,QACA,WACM;AACN,MAAI,CAACG,QAAO,QAAQ,eAAe,GAAG;AACpC;AAAA,EACF;AACA,QAAM,gBAAgBH,gBAAe,QAAQ,iBAAiB,GAAG;AACjE,MAAI,UAAU,cAAc,eAAe;AACzC,UAAM,IAAI;AAAA,MACR,uBAAuB,UAAU,SAAS,iCAAiC,aAAa;AAAA,IAC1F;AAAA,EACF;AACF;AAEA,SAAS,4BACP,WACA,OACM;AACN,MAAI,UAAU,6BAA6B;AACzC,+BAA2B,SAAS;AACpC;AAAA,EACF;AACA,MAAI,UAAU,4BAA4B;AACxC,gBAAY,SAAS;AACrB;AAAA,EACF;AACA,QAAM,IAAI,+BAA+B,gCAAgC,KAAK,EAAE;AAClF;AAEA,eAAe,gBACb,WACA,QACkB;AAClB,MAAI,UAAU,UAAU,6BAA6B;AACnD,UAAM,YAAY,2BAA2B,UAAU,SAAS;AAChE,UAAM,iBAAiB,qBAAqB,UAAU,OAAO,UAAU,KAAK;AAC5E,QAAI;AACF,aAAO,uBAAQ,OAAO,gBAAgB,QAAQ,SAAS;AAAA,IACzD,QAAQ;AACN,YAAM,IAAI,2BAA2B,uCAAuC;AAAA,IAC9E;AAAA,EACF;AAEA,MAAI,UAAU,UAAU,4BAA4B;AAClD,UAAM,MAAM,YAAY,UAAU,SAAS;AAC3C,UAAM,iBAAiB,qBAAqB,UAAU,OAAO,UAAU,KAAK;AAC5E,QAAI;AACF,iBAAO,4BAAc;AAAA,QACnB,SAAS,IAAI;AAAA,QACb,SAAS,EAAE,KAAK,OAAO;AAAA,QACvB,eAAW,yBAAW,cAAc;AAAA,MACtC,CAAC;AAAA,IACH,QAAQ;AACN,YAAM,IAAI,2BAA2B,uCAAuC;AAAA,IAC9E;AAAA,EACF;AAEA,QAAM,IAAI,+BAA+B,gCAAgC,UAAU,KAAK,EAAE;AAC5F;AAEA,SAAS,2BAA2B,KAAyB;AAC3D,MAAI,CAAC,IAAI,WAAW,UAAU,GAAG;AAC/B,UAAM,IAAI,uBAAuB,mCAAmC;AAAA,EACtE;AACA,QAAM,aAAa,IAAI,MAAM,WAAW,MAAM;AAC9C,MAAI,CAAC,WAAW,WAAW,GAAG,GAAG;AAC/B,UAAM,IAAI,uBAAuB,sCAAsC;AAAA,EACzE;AACA,MAAI;AACJ,MAAI;AACF,YAAQ,oBAAM,UAAU,OAAO,UAAU;AAAA,EAC3C,QAAQ;AACN,UAAM,IAAI,uBAAuB,kCAAkC;AAAA,EACrE;AACA,MAAI,MAAM,WAAW,MAAM,MAAM,CAAC,MAAM,OAAQ,MAAM,CAAC,MAAM,GAAM;AACjE,WAAO,MAAM,MAAM,CAAC;AAAA,EACtB;AACA,QAAM,IAAI,uBAAuB,yCAAyC;AAC5E;AAEA,SAAS,YAAY,KAAyC;AAC5D,MAAI;AACJ,MAAI;AACF,aAAS,YAAY,GAAG;AAAA,EAC1B,QAAQ;AACN,UAAM,IAAI,uBAAuB,kCAAkC;AAAA,EACrE;AACA,MAAI,CAAC,QAAQ;AACX,UAAM,IAAI,uBAAuB,mCAAmC;AAAA,EACtE;AACA,SAAO,EAAE,SAAS,OAAO,QAAQ;AACnC;AAEA,SAAS,qBAAqB,OAAe,OAAmC;AAC9E,MAAI,MAAM,WAAW,KAAK,CAAC,aAAa,KAAK,KAAK,KAAK,MAAM,SAAS,GAAG,GAAG;AAC1E,UAAM,IAAI,uBAAuB,mDAAmD;AAAA,EACtF;AACA,QAAM,QAAQ,gBAAgB,KAAK;AACnC,MAAI,UAAU,+BAA+B,MAAM,WAAW,IAAI;AAChE,UAAM,IAAI,uBAAuB,oCAAoC;AAAA,EACvE;AACA,MAAI,UAAU,4BAA4B;AACxC,QAAI,MAAM,WAAW,IAAI;AACvB,YAAM,IAAI,uBAAuB,oCAAoC;AAAA,IACvE;AACA,UAAM,IAAI,MAAM,EAAE;AAClB,QAAI,MAAM,MAAM,MAAM,IAAI;AACxB,YAAM,IAAI,uBAAuB,gDAAgD;AAAA,IACnF;AAAA,EACF;AACA,SAAO;AACT;AAEA,SAAS,qBACP,OACA,OACQ;AACR,MAAI,OAAO,UAAU,UAAU;AAC7B,UAAMK,WAAU,MAAM,WAAW,IAAI,IACjC,gBAAgB,WAAW,KAAK,CAAC,IACjC;AACJ,yBAAqBA,UAAS,KAAK;AACnC,WAAOA;AAAA,EACT;AACA,QAAM,UAAU,gBAAgB,KAAK;AACrC,uBAAqB,SAAS,KAAK;AACnC,SAAO;AACT;AAEA,SAAS,uBACP,QACA,YACY;AACZ,QAAM,SAAS,uBAAO,OAAO,IAAI;AACjC,aAAW,CAAC,KAAK,KAAK,KAAK,OAAO,QAAQ,MAAM,GAAG;AACjD,QAAI,QAAQ,WAAW,WAAW,QAAQ,aAAa;AACrD;AAAA,IACF;AACA,WAAO,GAAG,IAAI;AAAA,EAChB;AACA,SAAO;AACT;AAEA,SAAS,sBAAsB,OAAkC;AAC/D,QAAM,SAAS,iBAAiB,cAAc,KAAK,GAAG,GAAG;AACzD,SAAO,oBAAoBL,gBAAe,QAAQ,UAAU,GAAG,CAAC;AAClE;AAEA,SAAS,oBAAoB,QAAkC;AAC7D,MAAI,WAAW,cAAe,QAAO,YAAY;AACjD,MAAI,WAAW,qBAAsB,QAAO,YAAY;AACxD,MAAI,WAAW,4BAA6B,QAAO,YAAY;AAC/D,QAAM,IAAI,wBAAwB,qCAAqC,MAAM,EAAE;AACjF;AAEA,SAAS,iBAAiB,OAAgB,MAA0B;AAClE,MAAI,UAAU,QAAQ,OAAO,UAAU,YAAY,MAAM,QAAQ,KAAK,GAAG;AACvE,UAAM,IAAI,wBAAwB,GAAG,IAAI,oBAAoB;AAAA,EAC/D;AACA,SAAO;AACT;AAEA,SAASC,iBAAgB,QAAoB,SAA4B,MAAoB;AAC3F,QAAM,aAAa,IAAI,IAAI,OAAO;AAClC,aAAW,OAAO,OAAO,KAAK,MAAM,GAAG;AACrC,QAAI,CAAC,WAAW,IAAI,GAAG,GAAG;AACxB,YAAM,IAAI,wBAAwB,GAAG,IAAI,sBAAsB,GAAG,EAAE;AAAA,IACtE;AAAA,EACF;AACF;AAEA,SAASC,eAAc,QAAoB,KAAa,MAAyB;AAC/E,MAAI,CAACC,QAAO,QAAQ,GAAG,GAAG;AACxB,UAAM,IAAI,wBAAwB,GAAG,IAAI,IAAI,GAAG,cAAc;AAAA,EAChE;AACA,SAAO,OAAO,GAAG;AACnB;AAEA,SAASH,gBAAe,QAAoB,KAAa,MAAsB;AAC7E,SAAO,kBAAkBE,eAAc,QAAQ,KAAK,IAAI,GAAG,GAAG,IAAI,IAAI,GAAG,EAAE;AAC7E;AAEA,SAAS,eAAe,QAAoB,KAAa,MAAoB;AAC3E,MAAI,CAACC,QAAO,QAAQ,GAAG,GAAG;AACxB;AAAA,EACF;AACA,oBAAkBD,eAAc,QAAQ,KAAK,IAAI,GAAG,GAAG,IAAI,IAAI,GAAG,EAAE;AACtE;AAEA,SAAS,kBAAkB,OAAkB,MAAsB;AACjE,MAAI,OAAO,UAAU,YAAY,MAAM,WAAW,GAAG;AACnD,UAAM,IAAI,wBAAwB,GAAG,IAAI,6BAA6B;AAAA,EACxE;AACA,SAAO;AACT;AAEA,SAAS,gBAAgB,QAAoB,KAAa,MAAoB;AAC5E,MAAI,CAACC,QAAO,QAAQ,GAAG,GAAG;AACxB;AAAA,EACF;AACA,MAAI,OAAOD,eAAc,QAAQ,KAAK,IAAI,MAAM,WAAW;AACzD,UAAM,IAAI,wBAAwB,GAAG,IAAI,IAAI,GAAG,oBAAoB;AAAA,EACtE;AACF;AAEA,SAAS,gBACP,QACA,KACA,MACA,SACQ;AACR,QAAM,QAAQA,eAAc,QAAQ,KAAK,IAAI;AAC7C,MAAI,OAAO,UAAU,YAAY,CAAC,OAAO,cAAc,KAAK,KAAK,QAAQ,SAAS;AAChF,UAAM,IAAI;AAAA,MACR,GAAG,IAAI,IAAI,GAAG,0BAA0B,OAAO;AAAA,IACjD;AAAA,EACF;AACA,SAAO;AACT;AAEA,SAASE,eACP,QACA,KACA,MACA,SACsB;AACtB,QAAM,QAAQF,eAAc,QAAQ,KAAK,IAAI;AAC7C,MAAI,CAAC,MAAM,QAAQ,KAAK,KAAK,MAAM,SAAS,SAAS;AACnD,UAAM,IAAI;AAAA,MACR,GAAG,IAAI,IAAI,GAAG,mCAAmC,OAAO;AAAA,IAC1D;AAAA,EACF;AACA,SAAO;AACT;AAEA,SAAS,oBACP,QACA,KACA,MACA,OACM;AACN,QAAM,SAASE,eAAc,QAAQ,KAAK,MAAM,CAAC;AACjD,WAAS,QAAQ,GAAG,QAAQ,OAAO,QAAQ,SAAS;AAClD,UAAM,WAAW,GAAG,IAAI,IAAI,GAAG,IAAI,KAAK;AACxC,UAAM,QAAQ,kBAAkB,OAAO,KAAK,GAAG,QAAQ;AACvD,YAAQ,OAAO,QAAQ;AAAA,EACzB;AACF;AAEA,SAAS,mBAAmB,QAAoB,KAAa,MAAoB;AAC/E,gBAAcJ,gBAAe,QAAQ,KAAK,IAAI,GAAG,GAAG,IAAI,IAAI,GAAG,EAAE;AACnE;AAEA,SAAS,mBAAmB,QAAoB,KAAa,MAAoB;AAC/E,MAAI,CAACG,QAAO,QAAQ,GAAG,GAAG;AACxB;AAAA,EACF;AACA,gBAAcH,gBAAe,QAAQ,KAAK,IAAI,GAAG,GAAG,IAAI,IAAI,GAAG,EAAE;AACnE;AAEA,SAAS,cAAc,OAAe,MAAoB;AACxD,QAAM,QAAQ,MAAM;AAAA,IAClB;AAAA,EACF;AACA,MAAI,CAAC,OAAO;AACV,UAAM,IAAI,wBAAwB,GAAG,IAAI,0BAA0B;AAAA,EACrE;AACA,QAAM,SAAS,KAAK,MAAM,KAAK;AAC/B,MAAI,OAAO,MAAM,MAAM,GAAG;AACxB,UAAM,IAAI,wBAAwB,GAAG,IAAI,yCAAyC;AAAA,EACpF;AACA,QAAM,YAAY,IAAI,KAAK,MAAM,EAAE,YAAY,EAAE,QAAQ,SAAS,GAAG;AACrE,MAAI,cAAc,OAAO;AACvB,UAAM,IAAI,wBAAwB,GAAG,IAAI,4CAA4C;AAAA,EACvF;AACF;AAEA,SAAS,YAA8B,QAAgB,UAAa,MAAiB;AACnF,MAAI,WAAW,UAAU;AACvB,UAAM,IAAI,wBAAwB,GAAG,IAAI,YAAY,QAAQ,EAAE;AAAA,EACjE;AACA,SAAO;AACT;AAEA,SAAS,YACP,QACA,SACA,MACG;AACH,aAAW,SAAS,SAAS;AAC3B,QAAI,WAAW,OAAO;AACpB,aAAO;AAAA,IACT;AAAA,EACF;AACA,QAAM,IAAI,wBAAwB,GAAG,IAAI,0BAA0B,MAAM,EAAE;AAC7E;AAEA,SAASG,QAAO,QAAoB,KAAsB;AACxD,SAAOJ,cAAa,QAAQ,GAAG;AACjC;AAEA,SAAS,8BAA8B,OAAgD;AACrF,MAAI,UAAU,+BAA+B,UAAU,4BAA4B;AACjF,UAAM,IAAI,+BAA+B,gCAAgC,KAAK,EAAE;AAAA,EAClF;AACF;AAEA,SAAS,YAAY,OAA+B;AAClD,aAAO,qBAAO,OAAO,OAAO;AAC9B;AAEA,SAAS,YAAY,MAAkB,OAA+B;AACpE,QAAM,SAAS,IAAI,WAAW,KAAK,SAAS,MAAM,MAAM;AACxD,SAAO,IAAI,MAAM,CAAC;AAClB,SAAO,IAAI,OAAO,KAAK,MAAM;AAC7B,SAAO;AACT;AAEA,SAAS,iBAAiB,OAA2B;AACnD,MAAI,SAAS;AACb,MAAI,SAAS;AACb,MAAI,OAAO;AACX,aAAW,QAAQ,OAAO;AACxB,aAAU,UAAU,IAAK;AACzB,YAAQ;AACR,WAAO,QAAQ,GAAG;AAChB,cAAQ;AACR,gBAAU,gBAAiB,UAAU,OAAQ,EAAE;AAAA,IACjD;AAAA,EACF;AACA,MAAI,OAAO,GAAG;AACZ,cAAU,gBAAiB,UAAW,IAAI,OAAS,EAAE;AAAA,EACvD;AACA,SAAO;AACT;AAEA,SAAS,gBAAgB,OAA2B;AAClD,QAAM,WACJ;AACF,MAAI,SAAS;AACb,WAAS,QAAQ,GAAG,QAAQ,MAAM,QAAQ,SAAS,GAAG;AACpD,UAAM,IAAI,MAAM,KAAK;AACrB,UAAM,IAAI,MAAM,QAAQ,CAAC;AACzB,UAAM,IAAI,MAAM,QAAQ,CAAC;AACzB,UAAM,UAAW,KAAK,MAAQ,KAAK,MAAM,KAAM,KAAK;AACpD,cAAU,SAAU,WAAW,KAAM,EAAE;AACvC,cAAU,SAAU,WAAW,KAAM,EAAE;AACvC,QAAI,QAAQ,IAAI,MAAM,QAAQ;AAC5B,gBAAU,SAAU,WAAW,IAAK,EAAE;AAAA,IACxC;AACA,QAAI,QAAQ,IAAI,MAAM,QAAQ;AAC5B,gBAAU,SAAS,UAAU,EAAE;AAAA,IACjC;AAAA,EACF;AACA,SAAO;AACT;AAEA,SAAS,gBAAgB,OAA2B;AAClD,MAAI,MAAM,SAAS,MAAM,GAAG;AAC1B,UAAM,IAAI,uBAAuB,4CAA4C;AAAA,EAC/E;AACA,QAAM,WACJ;AACF,QAAM,QAAkB,CAAC;AACzB,MAAI,SAAS;AACb,MAAI,OAAO;AACX,aAAW,QAAQ,OAAO;AACxB,UAAM,QAAQ,SAAS,QAAQ,IAAI;AACnC,QAAI,QAAQ,GAAG;AACb,YAAM,IAAI,uBAAuB,kCAAkC;AAAA,IACrE;AACA,aAAU,UAAU,IAAK;AACzB,YAAQ;AACR,QAAI,QAAQ,GAAG;AACb,cAAQ;AACR,YAAM,KAAM,UAAU,OAAQ,GAAI;AAAA,IACpC;AAAA,EACF;AACA,QAAM,UAAU,WAAW,KAAK,KAAK;AACrC,MAAI,gBAAgB,OAAO,MAAM,OAAO;AACtC,UAAM,IAAI,uBAAuB,4CAA4C;AAAA,EAC/E;AACA,SAAO;AACT;AAEA,SAAS,WAAW,OAA2B;AAC7C,QAAM,MAAM,MAAM,MAAM,CAAC;AACzB,MAAI,IAAI,SAAS,MAAM,KAAK,CAAC,iBAAiB,KAAK,GAAG,GAAG;AACvD,UAAM,IAAI,uBAAuB,qCAAqC;AAAA,EACxE;AACA,QAAM,SAAS,IAAI,WAAW,IAAI,SAAS,CAAC;AAC5C,WAAS,QAAQ,GAAG,QAAQ,OAAO,QAAQ,SAAS;AAClD,WAAO,KAAK,IAAI,OAAO,SAAS,IAAI,MAAM,QAAQ,GAAG,QAAQ,IAAI,CAAC,GAAG,EAAE;AAAA,EACzE;AACA,SAAO;AACT;;;AErlCO,IAAM,oCACX;AACK,IAAM,6BACX;AACK,IAAM,oBAAoB;AAC1B,IAAM,6BAA6B;AAiBnC,IAAM,uBAAN,cAAmC,MAAM;AAAA,EAG9C,YAAY,MAAgC,SAAiB;AAC3D,UAAM,OAAO;AACb,SAAK,OAAO;AACZ,SAAK,OAAO;AAAA,EACd;AACF;AAsEA,eAAsB,mCACpB,OACA,QACiB;AACjB,QAAM,aAAaO,cAAa,OAAO,KAAK,4BAA4B;AACxE,EAAAC;AAAA,IACE;AAAA,IACA;AAAA,MACE;AAAA,MACA;AAAA,MACA;AAAA,MACA;AAAA,MACA;AAAA,MACA;AAAA,MACA;AAAA,MACA;AAAA,MACA;AAAA,MACA;AAAA,MACA;AAAA,IACF;AAAA,IACA;AAAA,EACF;AACA,QAAM,cAAcC,eAAc,YAAY,sBAAsB,GAAG;AACvE,MAAI,YAAY,WAAW,GAAG;AAC5B,UAAM,IAAI;AAAA,MACR;AAAA,MACA;AAAA,IACF;AAAA,EACF;AACA,QAAM,UAA8B,CAAC;AACrC,WAAS,QAAQ,GAAG,QAAQ,YAAY,QAAQ,SAAS;AACvD,YAAQ;AAAA,MACN,oBAAoB,MAAM,0BAA0B,YAAY,KAAK,CAAC,CAAC;AAAA,IACzE;AAAA,EACF;AACA,SAAO;AAAA,IACL;AAAA,MACE,QAAQ;AAAA,MACR,UAAUC,gBAAe,YAAY,YAAY,GAAG;AAAA,MACpD,eAAeA,gBAAe,YAAY,iBAAiB,GAAG;AAAA,MAC9D,WAAWA,gBAAe,YAAY,aAAa,GAAG;AAAA,MACtD,GAAIC,QAAO,YAAY,WAAW,IAC9B,EAAE,WAAWD,gBAAe,YAAY,aAAa,GAAG,EAAE,IAC1D,CAAC;AAAA,MACL,UAAU;AAAA,QACR,cAAcA,gBAAe,YAAY,gBAAgB,GAAG;AAAA,QAC5D,YAAYA,gBAAe,YAAY,cAAc,GAAG;AAAA,QACxD,oBAAoB;AAAA,MACtB;AAAA,MACA,MAAM,eAAe,YAAY,QAAQ,GAAG;AAAA,MAC5C,OAAO,eAAe,YAAY,SAAS,GAAG;AAAA,MAC9C,GAAIC,QAAO,YAAY,YAAY,IAC/B,EAAE,YAAY,eAAe,YAAY,cAAc,GAAG,EAAE,IAC5D,CAAC;AAAA,MACL,GAAIA,QAAO,YAAY,OAAO,IAC1B,EAAE,OAAO,eAAe,YAAY,SAAS,GAAG,EAAE,IAClD,CAAC;AAAA,IACP;AAAA,IACA;AAAA,EACF,EAAE,MAAM,CAAC,UAAU;AACjB,UAAM,sBAAsB,KAAK;AAAA,EACnC,CAAC;AACH;AAEO,SAAS,iCACd,OAC4B;AAC5B,QAAM,aAAaJ,cAAa,OAAO,KAAK,4BAA4B;AACxE,EAAAC;AAAA,IACE;AAAA,IACA;AAAA,MACE;AAAA,MACA;AAAA,MACA;AAAA,MACA;AAAA,MACA;AAAA,MACA;AAAA,MACA;AAAA,IACF;AAAA,IACA;AAAA,EACF;AACA,QAAM,0BAA0BG,QAAO,YAAY,yBAAyB,IACxEC,qBAAoB,YAAY,2BAA2B,GAAG,IAC9D,CAAC,iBAAiB;AACtB;AAAA,IACE;AAAA,IACA;AAAA,EACF;AACA,QAAM,6BAA6BD;AAAA,IACjC;AAAA,IACA;AAAA,EACF,IACIC,qBAAoB,YAAY,8BAA8B,GAAG,IACjE,CAAC,0BAA0B;AAC/B;AAAA,IACE;AAAA,IACA;AAAA,EACF;AACA,QAAM,YAAY;AAAA,IAChB;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,EACF;AACA,qBAAmB,WAAW,aAAa;AAE3C,SAAO;AAAA,IACL,QAAQ;AAAA,IACR,UAAUF,gBAAe,YAAY,YAAY,GAAG;AAAA,IACpD,UAAU;AAAA,MACRA,gBAAe,YAAY,YAAY,GAAG;AAAA,IAC5C;AAAA,IACA,UAAUA,gBAAe,YAAY,YAAY,GAAG;AAAA,IACpD;AAAA,IACA;AAAA,IACA,gBAAgBA,gBAAe,YAAY,kBAAkB,GAAG;AAAA,IAChE;AAAA,EACF;AACF;AAEA,eAAsB,yCACpB,OACA,QAC6B;AAC7B,SAAO;AAAA,IACL,iCAAiC,KAAK;AAAA,IACtC;AAAA,EACF,EAAE,MAAM,CAAC,UAAU;AACjB,UAAM,sBAAsB,KAAK;AAAA,EACnC,CAAC;AACH;AAOO,SAAS,gCACd,OAC0B;AAC1B,QAAM,aAAaH;AAAA,IACjB;AAAA,IACA;AAAA,IACA;AAAA,EACF;AACA,EAAAC;AAAA,IACE;AAAA,IACA;AAAA,MACE;AAAA,MACA;AAAA,MACA;AAAA,MACA;AAAA,MACA;AAAA,IACF;AAAA,IACA;AAAA,EACF;AACA,QAAM,eAAe;AAAA,IACnBK,eAAc,YAAY,sBAAsB,GAAG;AAAA,EACrD;AACA,MACE,CAAC,aAAa,2BAA2B;AAAA,IACvC;AAAA,EACF,GACA;AACA,UAAM,IAAI;AAAA,MACR;AAAA,MACA;AAAA,IACF;AAAA,EACF;AACA,SAAO;AAAA,IACL,QAAQ;AAAA,IACR,UAAUH,gBAAe,YAAY,YAAY,GAAG;AAAA,IACpD,cAAc;AAAA,MACZ,UAAU,aAAa;AAAA,MACvB,UAAU,aAAa;AAAA,MACvB,4BAA4B,CAAC,0BAA0B;AAAA,MACvD;AAAA,IACF;AAAA,IACA,WAAW;AAAA,MACT,QAAQ;AAAA,MACR,UAAU;AAAA,QACRA,gBAAe,YAAY,qBAAqB,GAAG;AAAA,MACrD;AAAA,MACA,SAASA,gBAAe,YAAY,gBAAgB,GAAG;AAAA,IACzD;AAAA,IACA,cAAc,eAAe,YAAY,gBAAgB,GAAG;AAAA,EAC9D;AACF;AAEA,SAAS,0BAA0B,OAAuB;AACxD,MAAI;AACJ,MAAI;AACF,UAAM,IAAI,IAAI,KAAK;AAAA,EACrB,QAAQ;AACN,UAAM,IAAI;AAAA,MACR;AAAA,MACA;AAAA,IACF;AAAA,EACF;AACA,MACE,IAAI,aAAa,YACjB,IAAI,aAAa,MACjB,IAAI,aAAa,MACjB,IAAI,SAAS,MACb,IAAI,WAAW,IACf;AACA,UAAM,IAAI;AAAA,MACR;AAAA,MACA;AAAA,IACF;AAAA,EACF;AACA,SAAO,IAAI,SAAS,EAAE,QAAQ,OAAO,EAAE;AACzC;AAEA,SAAS,6BAA6B,OAAuB;AAC3D,MAAI;AACJ,MAAI;AACF,UAAM,IAAI,IAAI,KAAK;AAAA,EACrB,QAAQ;AACN,UAAM,IAAI;AAAA,MACR;AAAA,MACA;AAAA,IACF;AAAA,EACF;AACA,MACE,IAAI,aAAa,YACjB,IAAI,aAAa,MACjB,IAAI,aAAa,MACjB,IAAI,SAAS,MACb,IAAI,WAAW,IACf;AACA,UAAM,IAAI;AAAA,MACR;AAAA,MACA;AAAA,IACF;AAAA,EACF;AACA,SAAO,IAAI,SAAS,EAAE,QAAQ,OAAO,EAAE;AACzC;AAOA,eAAsB,qCACpB,SAC6B;AAC7B,QAAM,aAAaH,cAAa,SAAS,KAAK,4BAA4B;AAC1E,EAAAC;AAAA,IACE;AAAA,IACA;AAAA,MACE;AAAA,MACA;AAAA,MACA;AAAA,MACA;AAAA,MACA;AAAA,MACA;AAAA,MACA;AAAA,IACF;AAAA,IACA;AAAA,EACF;AACA,MAAI,CAACG,QAAO,YAAY,cAAc,GAAG;AACvC,UAAM,IAAI;AAAA,MACR;AAAA,MACA;AAAA,IACF;AAAA,EACF;AACA,QAAM,eAAe,WAAW,cAAc;AAC9C,MACE,iBAAiB,QACjB,OAAO,iBAAiB,YACxB,MAAM,QAAQ,YAAY,GAC1B;AACA,UAAM,IAAI;AAAA,MACR;AAAA,MACA;AAAA,IACF;AAAA,EACF;AACA,QAAM,eAAe;AACrB,QAAM,YAAY;AAAA,IAChB;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,EACF;AACA,QAAM,MAAM;AAAA,IACV;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,EACF;AACA,QAAM,YAAY,mBAAmB,WAAW,0BAA0B;AAC1E,QAAM,QAAQ,mBAAmB,KAAK,OAAO;AAC7C,MAAI,aAAa,OAAO;AACtB,UAAM,IAAI;AAAA,MACR;AAAA,MACA;AAAA,IACF;AAAA,EACF;AAEA,MAAI;AACJ,MAAI;AACF,gBAAY,MAAM,yBAAyB,YAAY,GAAG;AAAA,EAC5D,SAAS,OAAO;AACd,UAAM,IAAI;AAAA,MACR;AAAA,MACA,iBAAiB,QAAQ,MAAM,UAAU,OAAO,KAAK;AAAA,IACvD;AAAA,EACF;AACA,MAAI,SAAS,UAAU,cAAc,SAAS,UAAU;AACtD,UAAM,IAAI;AAAA,MACR;AAAA,MACA;AAAA,IACF;AAAA,EACF;AAEA,QAAM,mBAAmBD,gBAAe,YAAY,YAAY,GAAG;AACnE,MAAI,SAAS,aAAa,kBAAkB;AAC1C,UAAM,IAAI;AAAA,MACR;AAAA,MACA;AAAA,IACF;AAAA,EACF;AACA,QAAM,mBAAmBA,gBAAe,YAAY,YAAY,GAAG;AACnE,MAAI,SAAS,aAAa,kBAAkB;AAC1C,UAAM,IAAI;AAAA,MACR;AAAA,MACA;AAAA,IACF;AAAA,EACF;AACA,QAAM,yBAAyBA;AAAA,IAC7B;AAAA,IACA;AAAA,IACA;AAAA,EACF;AACA,MAAI,SAAS,mBAAmB,wBAAwB;AACtD,UAAM,IAAI;AAAA,MACR;AAAA,MACA;AAAA,IACF;AAAA,EACF;AACA,QAAM,wBAAwBC,QAAO,YAAY,uBAAuB,IACpED,gBAAe,YAAY,yBAAyB,GAAG,IACvD;AACJ,MAAI,CAAC,SAAS,wBAAwB,SAAS,qBAAqB,GAAG;AACrE,UAAM,IAAI;AAAA,MACR;AAAA,MACA;AAAA,IACF;AAAA,EACF;AACA,QAAM,2BAA2BC;AAAA,IAC/B;AAAA,IACA;AAAA,EACF,IACID,gBAAe,YAAY,4BAA4B,GAAG,IAC1D;AACJ,MAAI,CAAC,SAAS,2BAA2B,SAAS,wBAAwB,GAAG;AAC3E,UAAM,IAAI;AAAA,MACR;AAAA,MACA;AAAA,IACF;AAAA,EACF;AACA,SAAO;AACT;AAEA,SAASH,cACP,OACA,MACA,MACY;AACZ,MAAI;AACF,UAAM,aAAa,cAAc,KAAK;AACtC,QACE,eAAe,QACf,OAAO,eAAe,YACtB,MAAM,QAAQ,UAAU,GACxB;AACA,YAAM,IAAI,qBAAqB,MAAM,GAAG,IAAI,oBAAoB;AAAA,IAClE;AACA,WAAO;AAAA,EACT,SAAS,OAAO;AACd,QAAI,iBAAiB,sBAAsB;AACzC,YAAM;AAAA,IACR;AACA,UAAM,IAAI;AAAA,MACR;AAAA,MACA,iBAAiB,QAAQ,MAAM,UAAU,OAAO,KAAK;AAAA,IACvD;AAAA,EACF;AACF;AAEA,SAAS,yBAAyB,OAAsC;AACtE,MAAI,UAAU,QAAQ,OAAO,UAAU,YAAY,MAAM,QAAQ,KAAK,GAAG;AACvE,UAAM,IAAI;AAAA,MACR;AAAA,MACA;AAAA,IACF;AAAA,EACF;AACA,MAAI;AACF,WAAO,sCAAsC,KAAK;AAAA,EACpD,SAAS,OAAO;AACd,UAAM,IAAI;AAAA,MACR;AAAA,MACA,iBAAiB,QAAQ,MAAM,UAAU,OAAO,KAAK;AAAA,IACvD;AAAA,EACF;AACF;AAEA,SAASC,iBACP,QACA,SACA,MACM;AACN,QAAM,aAAa,IAAI,IAAI,OAAO;AAClC,aAAW,OAAO,OAAO,KAAK,MAAM,GAAG;AACrC,QAAI,CAAC,WAAW,IAAI,GAAG,GAAG;AACxB,YAAM,IAAI;AAAA,QACR;AAAA,QACA,GAAG,IAAI,sBAAsB,GAAG;AAAA,MAClC;AAAA,IACF;AAAA,EACF;AACF;AAEA,SAASK,eACP,QACA,KACA,MACW;AACX,MAAI,CAACF,QAAO,QAAQ,GAAG,GAAG;AACxB,UAAM,IAAI;AAAA,MACR;AAAA,MACA,GAAG,IAAI,IAAI,GAAG;AAAA,IAChB;AAAA,EACF;AACA,SAAO,OAAO,GAAG;AACnB;AAEA,SAASD,gBAAe,QAAoB,KAAa,MAAsB;AAC7E,QAAM,QAAQG,eAAc,QAAQ,KAAK,IAAI;AAC7C,MAAI,OAAO,UAAU,YAAY,MAAM,WAAW,GAAG;AACnD,UAAM,IAAI;AAAA,MACR;AAAA,MACA,GAAG,IAAI,IAAI,GAAG;AAAA,IAChB;AAAA,EACF;AACA,SAAO;AACT;AAEA,SAAS,YACP,QACA,KACA,MACA,MACQ;AACR,MAAI,CAACF,QAAO,QAAQ,GAAG,GAAG;AACxB,UAAM,IAAI,qBAAqB,MAAM,GAAG,IAAI,IAAI,GAAG,cAAc;AAAA,EACnE;AACA,QAAM,QAAQ,OAAO,GAAG;AACxB,MAAI,OAAO,UAAU,YAAY,MAAM,WAAW,GAAG;AACnD,UAAM,IAAI;AAAA,MACR;AAAA,MACA,GAAG,IAAI,IAAI,GAAG;AAAA,IAChB;AAAA,EACF;AACA,SAAO;AACT;AAEA,SAAS,eACP,QACA,KACA,MACY;AACZ,QAAM,QAAQE,eAAc,QAAQ,KAAK,IAAI;AAC7C,MAAI,UAAU,QAAQ,OAAO,UAAU,YAAY,MAAM,QAAQ,KAAK,GAAG;AACvE,UAAM,IAAI;AAAA,MACR;AAAA,MACA,GAAG,IAAI,IAAI,GAAG;AAAA,IAChB;AAAA,EACF;AACA,SAAO;AACT;AAEA,SAASJ,eACP,QACA,KACA,MACsB;AACtB,QAAM,QAAQI,eAAc,QAAQ,KAAK,IAAI;AAC7C,MAAI,CAAC,MAAM,QAAQ,KAAK,GAAG;AACzB,UAAM,IAAI;AAAA,MACR;AAAA,MACA,GAAG,IAAI,IAAI,GAAG;AAAA,IAChB;AAAA,EACF;AACA,SAAO;AACT;AAEA,SAASD,qBACP,QACA,KACA,MACU;AACV,QAAM,SAASH,eAAc,QAAQ,KAAK,IAAI;AAC9C,SAAO,OAAO,IAAI,CAAC,OAAO,UAAU;AAClC,QAAI,OAAO,UAAU,YAAY,MAAM,WAAW,GAAG;AACnD,YAAM,IAAI;AAAA,QACR;AAAA,QACA,GAAG,IAAI,IAAI,GAAG,IAAI,KAAK;AAAA,MACzB;AAAA,IACF;AACA,WAAO;AAAA,EACT,CAAC;AACH;AAEA,SAAS,gCACP,QACA,MACM;AACN,MAAI,OAAO,WAAW,GAAG;AACvB,UAAM,IAAI;AAAA,MACR;AAAA,MACA,GAAG,IAAI;AAAA,IACT;AAAA,EACF;AACA,WAAS,QAAQ,GAAG,QAAQ,OAAO,QAAQ,SAAS;AAClD,QAAI,OAAO,KAAK,MAAM,mBAAmB;AACvC,YAAM,IAAI;AAAA,QACR;AAAA,QACA,GAAG,IAAI,IAAI,KAAK;AAAA,MAClB;AAAA,IACF;AAAA,EACF;AACF;AAEA,SAAS,mCACP,QACA,MACM;AACN,MAAI,OAAO,WAAW,GAAG;AACvB,UAAM,IAAI;AAAA,MACR;AAAA,MACA,GAAG,IAAI;AAAA,IACT;AAAA,EACF;AACA,WAAS,QAAQ,GAAG,QAAQ,OAAO,QAAQ,SAAS;AAClD,QAAI,OAAO,KAAK,MAAM,4BAA4B;AAChD,YAAM,IAAI;AAAA,QACR;AAAA,QACA,GAAG,IAAI,IAAI,KAAK;AAAA,MAClB;AAAA,IACF;AAAA,EACF;AACF;AAEA,SAAS,oBAAuB,IAAgB;AAC9C,MAAI;AACF,WAAO,GAAG;AAAA,EACZ,SAAS,OAAO;AACd,QAAI,iBAAiB,uBAAuB;AAC1C,YAAM,IAAI,qBAAqB,MAAM,MAAM,MAAM,OAAO;AAAA,IAC1D;AACA,UAAM;AAAA,EACR;AACF;AAEA,SAAS,sBAAsB,OAAuB;AACpD,MAAI,iBAAiB,sBAAsB;AACzC,WAAO;AAAA,EACT;AACA,MACE,iBAAiB,2BACjB,iBAAiB,0BACjB;AACA,WAAO,IAAI;AAAA,MACT;AAAA,MACA,MAAM;AAAA,IACR;AAAA,EACF;AACA,SAAO,IAAI;AAAA,IACT;AAAA,IACA,iBAAiB,QAAQ,MAAM,UAAU,OAAO,KAAK;AAAA,EACvD;AACF;AAEA,SAAS,mBAAmB,OAAe,MAAsB;AAC/D,QAAM,QAAQ,MAAM;AAAA,IAClB;AAAA,EACF;AACA,MAAI,CAAC,OAAO;AACV,UAAM,IAAI;AAAA,MACR;AAAA,MACA,GAAG,IAAI;AAAA,IACT;AAAA,EACF;AACA,QAAM,SAAS,KAAK,MAAM,KAAK;AAC/B,MAAI,OAAO,MAAM,MAAM,GAAG;AACxB,UAAM,IAAI;AAAA,MACR;AAAA,MACA,GAAG,IAAI;AAAA,IACT;AAAA,EACF;AACA,QAAM,YAAY,IAAI,KAAK,MAAM,EAAE,YAAY,EAAE,QAAQ,SAAS,GAAG;AACrE,MAAI,cAAc,OAAO;AACvB,UAAM,IAAI;AAAA,MACR;AAAA,MACA,GAAG,IAAI;AAAA,IACT;AAAA,EACF;AACA,SAAO;AACT;AAEA,IAAMK,gBAEF,OAGA,UACD,OAAO,UAAU,eAAe,KAAK;AAAA,EACpC,OAAO,UAAU;AACnB;AAEF,SAASH,QAAO,QAAoB,KAAsB;AACxD,SAAOG,cAAa,QAAQ,GAAG;AACjC;","names":["output","objectHasOwn","import_viem","import_viem","textEncoder","objectHasOwn","requiredString","assertExactKeys","requiredValue","hasOwn","requiredArray","encoded","expectObject","assertExactKeys","requiredArray","requiredString","hasOwn","requiredStringArray","requiredValue","objectHasOwn"]}

package/dist/policy/index.d.cts

@@ -0,0 +1,94 @@
+import { P as PolicyEngineRecord, S as SignedObjectSigner, a as Policy, U as UnsignedPolicyEngineRecord } from '../signed-object-Cy_81K45.cjs';
+export { E as ED25519_JCS_SIGNATURE_SUITE, b as EIP191_JCS_SIGNATURE_SUITE, J as JsonObject, c as POLICY_ENGINE_RECORD_SCHEMA, d as POLICY_SCHEMA, e as POLICY_STATUS_SCHEMA, f as PolicyStatus, g as SignatureMaterialError, h as SignatureSuite, i as SignatureVerificationError, j as SignedObjectCanonicalizationError, k as SignedObjectDigestError, l as SignedObjectErrorCode, m as SignedObjectIdError, n as SignedObjectKind, o as SignedObjectMaterial, p as SignedObjectProfileError, q as SignedObjectSchemaError, r as SignedObjectSignature, s as SignedObjectVerificationResult, t as SignedPolicyObject, u as SigningKeyBindingError, v as UnsignedPolicy, w as UnsignedPolicyObject, x as UnsignedPolicyStatus, y as UnsupportedSignatureSuiteError, z as canonicalizeSignedObjectUnsigned, A as createAndSignPolicy, B as createAndSignPolicyEngineRecord, C as createAndSignPolicyStatus, D as createAndSignSignedObject, F as deriveSignedObjectMaterial, G as signedObjectIdFor, H as toSignedObjectError, I as validatePolicyEngineRecordSigned, K as validatePolicyEngineRecordSignedShape, L as validatePolicyEngineRecordUnsigned, M as validatePolicySigned, N as validatePolicySignedShape, O as validatePolicyStatusSigned, Q as validatePolicyStatusSignedShape, R as validatePolicyStatusUnsigned, T as validatePolicyUnsigned, V as verifyPolicy, W as verifyPolicyEngineRecord, X as verifyPolicyStatus, Y as verifySignedObject } from '../signed-object-Cy_81K45.cjs';
+import { J as JsonObject, P as PolicyCapabilityError } from '../capability-Dbx-xqUh.cjs';
+export { a as JsonValue, b as PolicyCapability, c as PolicyCapabilityErrorCode, d as canonicalizePolicyCapability, j as jcsCanonicalize, n as normalizeJson, e as normalizePolicyCapability, p as policyCapabilityContains, f as policyCapabilityDigestHex, s as serializeJcsJson } from '../capability-Dbx-xqUh.cjs';
+
+declare const TRANSCRIPT_SHARE_BOOTSTRAP_SCHEMA: "xyz.tinycloud.exchange/transcript-bootstrap/v0";
+declare const OWNER_NODE_ENDPOINT_SCHEMA: "xyz.tinycloud.exchange/owner-node-endpoint/v1";
+declare const POLICY_VERSION_V0: "v0";
+declare const W3C_VC_CREDENTIAL_VERIFIER: "w3c.vc/credential/v1";
+type PolicyAuthoringErrorCode = PolicyCapabilityError["code"] | "policy-authoring-malformed" | "policy-authoring-unknown-key" | "policy-engine-record-absent" | "policy-engine-record-date-invalid" | "policy-engine-record-signature-invalid" | "policy-engine-record-audience-mismatch" | "policy-engine-record-expired" | "policy-engine-record-owner-mismatch" | "policy-engine-record-grant-issuer-mismatch" | "policy-engine-record-policy-version-unsupported" | "policy-engine-record-evidence-verifier-unsupported" | "transcript-share-bootstrap-malformed";
+declare class PolicyAuthoringError extends Error {
+    readonly code: PolicyAuthoringErrorCode;
+    constructor(code: PolicyAuthoringErrorCode, message: string);
+}
+interface CreateTranscriptSharePolicyInput {
+    readonly ownerDid: string;
+    readonly signingKeyDid: string;
+    readonly createdAt: string;
+    readonly expiresAt?: string;
+    readonly resourceType: string;
+    readonly resourceId: string;
+    readonly permissionsCeiling: readonly unknown[];
+    readonly when: JsonObject;
+    readonly grant: JsonObject;
+    readonly disclosure?: JsonObject;
+    readonly audit?: JsonObject;
+}
+interface TranscriptShareBootstrap {
+    readonly schema: typeof TRANSCRIPT_SHARE_BOOTSTRAP_SCHEMA;
+    readonly policyId: string;
+    readonly policyEngine: {
+        readonly endpoint: string;
+        readonly audience: string;
+        readonly supportedEvidenceVerifiers: readonly [
+            typeof W3C_VC_CREDENTIAL_VERIFIER
+        ];
+        readonly signedRecord: PolicyEngineRecord;
+    };
+    /** Untrusted routing hint. Authority comes only from delegation/invocation validation. */
+    readonly ownerNode: {
+        readonly schema: typeof OWNER_NODE_ENDPOINT_SCHEMA;
+        readonly endpoint: string;
+        readonly spaceId: string;
+    };
+    readonly resourceHint: JsonObject;
+}
+interface ComposeTranscriptShareBootstrapInput {
+    readonly policyId: string;
+    readonly policyEngineRecord: PolicyEngineRecord;
+    readonly ownerNodeEndpoint: string;
+    readonly ownerSpaceId: string;
+    readonly resourceHint: JsonObject;
+}
+interface CreatePolicyEngineRecordInput {
+    readonly ownerDid: string;
+    readonly endpoint: string;
+    readonly audience: string;
+    readonly grantIssuerDid: string;
+    readonly expiresAt: string;
+    readonly supportedPolicyVersions?: readonly string[];
+    readonly supportedEvidenceVerifiers?: readonly string[];
+}
+interface VerifyPolicyEngineRecordOptions {
+    readonly signedRecord: unknown;
+    readonly ownerDid: string;
+    readonly audience: string;
+    readonly grantIssuerDid: string;
+    readonly now: string;
+    readonly requiredPolicyVersion?: string;
+    readonly requiredEvidenceVerifier?: string;
+}
+/**
+ * Author a transcript-sharing Policy from already-resolved Listen-adapter
+ * PolicyCapability JSON. Manifest PermissionEntry shapes are refused here; the
+ * SDK does not expand or invent permissions while signing authority-bearing
+ * objects.
+ */
+declare function createAndSignTranscriptSharePolicy(input: CreateTranscriptSharePolicyInput, signer: SignedObjectSigner): Promise<Policy>;
+declare function createUnsignedPolicyEngineRecord(input: CreatePolicyEngineRecordInput): UnsignedPolicyEngineRecord;
+declare function createAndSignRequesterPolicyEngineRecord(input: CreatePolicyEngineRecordInput, signer: SignedObjectSigner): Promise<PolicyEngineRecord>;
+/**
+ * Compose the SDK-level transcript-share bootstrap record. This record is not
+ * an invitation and is not authority; it only tells a requester where to ask
+ * and which policy id to reference.
+ */
+declare function composeTranscriptShareBootstrap(input: ComposeTranscriptShareBootstrapInput): TranscriptShareBootstrap;
+/**
+ * Requester-side authentication gate for policy-engine endpoints. A requester
+ * MUST NOT send credential evidence or call /resolve unless this verification
+ * succeeds.
+ */
+declare function verifyPolicyEngineRecordForRequester(options: VerifyPolicyEngineRecordOptions): Promise<PolicyEngineRecord>;
+
+export { type ComposeTranscriptShareBootstrapInput, type CreatePolicyEngineRecordInput, type CreateTranscriptSharePolicyInput, OWNER_NODE_ENDPOINT_SCHEMA, POLICY_VERSION_V0, Policy, PolicyAuthoringError, type PolicyAuthoringErrorCode, PolicyCapabilityError, PolicyEngineRecord, SignedObjectSigner, TRANSCRIPT_SHARE_BOOTSTRAP_SCHEMA, type TranscriptShareBootstrap, UnsignedPolicyEngineRecord, type VerifyPolicyEngineRecordOptions, W3C_VC_CREDENTIAL_VERIFIER, composeTranscriptShareBootstrap, createAndSignRequesterPolicyEngineRecord, createAndSignTranscriptSharePolicy, createUnsignedPolicyEngineRecord, verifyPolicyEngineRecordForRequester };

package/dist/policy/index.d.ts

@@ -0,0 +1,94 @@
+import { P as PolicyEngineRecord, S as SignedObjectSigner, a as Policy, U as UnsignedPolicyEngineRecord } from '../signed-object-C9Gur3ZY.js';
+export { E as ED25519_JCS_SIGNATURE_SUITE, b as EIP191_JCS_SIGNATURE_SUITE, J as JsonObject, c as POLICY_ENGINE_RECORD_SCHEMA, d as POLICY_SCHEMA, e as POLICY_STATUS_SCHEMA, f as PolicyStatus, g as SignatureMaterialError, h as SignatureSuite, i as SignatureVerificationError, j as SignedObjectCanonicalizationError, k as SignedObjectDigestError, l as SignedObjectErrorCode, m as SignedObjectIdError, n as SignedObjectKind, o as SignedObjectMaterial, p as SignedObjectProfileError, q as SignedObjectSchemaError, r as SignedObjectSignature, s as SignedObjectVerificationResult, t as SignedPolicyObject, u as SigningKeyBindingError, v as UnsignedPolicy, w as UnsignedPolicyObject, x as UnsignedPolicyStatus, y as UnsupportedSignatureSuiteError, z as canonicalizeSignedObjectUnsigned, A as createAndSignPolicy, B as createAndSignPolicyEngineRecord, C as createAndSignPolicyStatus, D as createAndSignSignedObject, F as deriveSignedObjectMaterial, G as signedObjectIdFor, H as toSignedObjectError, I as validatePolicyEngineRecordSigned, K as validatePolicyEngineRecordSignedShape, L as validatePolicyEngineRecordUnsigned, M as validatePolicySigned, N as validatePolicySignedShape, O as validatePolicyStatusSigned, Q as validatePolicyStatusSignedShape, R as validatePolicyStatusUnsigned, T as validatePolicyUnsigned, V as verifyPolicy, W as verifyPolicyEngineRecord, X as verifyPolicyStatus, Y as verifySignedObject } from '../signed-object-C9Gur3ZY.js';
+import { J as JsonObject, P as PolicyCapabilityError } from '../capability-Dbx-xqUh.js';
+export { a as JsonValue, b as PolicyCapability, c as PolicyCapabilityErrorCode, d as canonicalizePolicyCapability, j as jcsCanonicalize, n as normalizeJson, e as normalizePolicyCapability, p as policyCapabilityContains, f as policyCapabilityDigestHex, s as serializeJcsJson } from '../capability-Dbx-xqUh.js';
+
+declare const TRANSCRIPT_SHARE_BOOTSTRAP_SCHEMA: "xyz.tinycloud.exchange/transcript-bootstrap/v0";
+declare const OWNER_NODE_ENDPOINT_SCHEMA: "xyz.tinycloud.exchange/owner-node-endpoint/v1";
+declare const POLICY_VERSION_V0: "v0";
+declare const W3C_VC_CREDENTIAL_VERIFIER: "w3c.vc/credential/v1";
+type PolicyAuthoringErrorCode = PolicyCapabilityError["code"] | "policy-authoring-malformed" | "policy-authoring-unknown-key" | "policy-engine-record-absent" | "policy-engine-record-date-invalid" | "policy-engine-record-signature-invalid" | "policy-engine-record-audience-mismatch" | "policy-engine-record-expired" | "policy-engine-record-owner-mismatch" | "policy-engine-record-grant-issuer-mismatch" | "policy-engine-record-policy-version-unsupported" | "policy-engine-record-evidence-verifier-unsupported" | "transcript-share-bootstrap-malformed";
+declare class PolicyAuthoringError extends Error {
+    readonly code: PolicyAuthoringErrorCode;
+    constructor(code: PolicyAuthoringErrorCode, message: string);
+}
+interface CreateTranscriptSharePolicyInput {
+    readonly ownerDid: string;
+    readonly signingKeyDid: string;
+    readonly createdAt: string;
+    readonly expiresAt?: string;
+    readonly resourceType: string;
+    readonly resourceId: string;
+    readonly permissionsCeiling: readonly unknown[];
+    readonly when: JsonObject;
+    readonly grant: JsonObject;
+    readonly disclosure?: JsonObject;
+    readonly audit?: JsonObject;
+}
+interface TranscriptShareBootstrap {
+    readonly schema: typeof TRANSCRIPT_SHARE_BOOTSTRAP_SCHEMA;
+    readonly policyId: string;
+    readonly policyEngine: {
+        readonly endpoint: string;
+        readonly audience: string;
+        readonly supportedEvidenceVerifiers: readonly [
+            typeof W3C_VC_CREDENTIAL_VERIFIER
+        ];
+        readonly signedRecord: PolicyEngineRecord;
+    };
+    /** Untrusted routing hint. Authority comes only from delegation/invocation validation. */
+    readonly ownerNode: {
+        readonly schema: typeof OWNER_NODE_ENDPOINT_SCHEMA;
+        readonly endpoint: string;
+        readonly spaceId: string;
+    };
+    readonly resourceHint: JsonObject;
+}
+interface ComposeTranscriptShareBootstrapInput {
+    readonly policyId: string;
+    readonly policyEngineRecord: PolicyEngineRecord;
+    readonly ownerNodeEndpoint: string;
+    readonly ownerSpaceId: string;
+    readonly resourceHint: JsonObject;
+}
+interface CreatePolicyEngineRecordInput {
+    readonly ownerDid: string;
+    readonly endpoint: string;
+    readonly audience: string;
+    readonly grantIssuerDid: string;
+    readonly expiresAt: string;
+    readonly supportedPolicyVersions?: readonly string[];
+    readonly supportedEvidenceVerifiers?: readonly string[];
+}
+interface VerifyPolicyEngineRecordOptions {
+    readonly signedRecord: unknown;
+    readonly ownerDid: string;
+    readonly audience: string;
+    readonly grantIssuerDid: string;
+    readonly now: string;
+    readonly requiredPolicyVersion?: string;
+    readonly requiredEvidenceVerifier?: string;
+}
+/**
+ * Author a transcript-sharing Policy from already-resolved Listen-adapter
+ * PolicyCapability JSON. Manifest PermissionEntry shapes are refused here; the
+ * SDK does not expand or invent permissions while signing authority-bearing
+ * objects.
+ */
+declare function createAndSignTranscriptSharePolicy(input: CreateTranscriptSharePolicyInput, signer: SignedObjectSigner): Promise<Policy>;
+declare function createUnsignedPolicyEngineRecord(input: CreatePolicyEngineRecordInput): UnsignedPolicyEngineRecord;
+declare function createAndSignRequesterPolicyEngineRecord(input: CreatePolicyEngineRecordInput, signer: SignedObjectSigner): Promise<PolicyEngineRecord>;
+/**
+ * Compose the SDK-level transcript-share bootstrap record. This record is not
+ * an invitation and is not authority; it only tells a requester where to ask
+ * and which policy id to reference.
+ */
+declare function composeTranscriptShareBootstrap(input: ComposeTranscriptShareBootstrapInput): TranscriptShareBootstrap;
+/**
+ * Requester-side authentication gate for policy-engine endpoints. A requester
+ * MUST NOT send credential evidence or call /resolve unless this verification
+ * succeeds.
+ */
+declare function verifyPolicyEngineRecordForRequester(options: VerifyPolicyEngineRecordOptions): Promise<PolicyEngineRecord>;
+
+export { type ComposeTranscriptShareBootstrapInput, type CreatePolicyEngineRecordInput, type CreateTranscriptSharePolicyInput, OWNER_NODE_ENDPOINT_SCHEMA, POLICY_VERSION_V0, Policy, PolicyAuthoringError, type PolicyAuthoringErrorCode, PolicyCapabilityError, PolicyEngineRecord, SignedObjectSigner, TRANSCRIPT_SHARE_BOOTSTRAP_SCHEMA, type TranscriptShareBootstrap, UnsignedPolicyEngineRecord, type VerifyPolicyEngineRecordOptions, W3C_VC_CREDENTIAL_VERIFIER, composeTranscriptShareBootstrap, createAndSignRequesterPolicyEngineRecord, createAndSignTranscriptSharePolicy, createUnsignedPolicyEngineRecord, verifyPolicyEngineRecordForRequester };