@tinycloud/sdk-core 2.6.3 → 2.7.0-beta.3

package/dist/requester/index.cjs.map

@@ -0,0 +1 @@
+{"version":3,"sources":["../../src/requester/index.ts","../../src/policy/errors.ts","../../src/policy/jcs.ts","../../src/policy/capability.ts","../../src/policy/signed-object.ts","../../src/identity.ts","../../src/policy/authoring.ts"],"sourcesContent":["import { bytesToHex, sha256 } from \"viem\";\nimport { blake3 } from \"@noble/hashes/blake3\";\nimport { CID } from \"multiformats/cid\";\nimport { create as createDigest } from \"multiformats/hashes/digest\";\nimport type {\n  InvokeAnyFunction,\n  InvokeFunction,\n  ServiceHeaders,\n  ServiceSession,\n} from \"@tinycloud/sdk-services\";\nimport { z } from \"zod\";\nimport {\n  POLICY_VERSION_V0,\n  TRANSCRIPT_SHARE_BOOTSTRAP_SCHEMA,\n  OWNER_NODE_ENDPOINT_SCHEMA,\n  W3C_VC_CREDENTIAL_VERIFIER,\n  jcsCanonicalize,\n  normalizePolicyCapability,\n  normalizeJson,\n  policyCapabilityContains,\n  verifyPolicyEngineRecordForRequester,\n  type PolicyCapability,\n  type TranscriptShareBootstrap,\n} from \"../policy\";\n\nexport const REQUESTER_NEAR_EXPIRY_SECONDS = 30;\nexport const REQUESTER_ENGINE_RETRY_ATTEMPTS = 3;\nexport const REQUESTER_ENGINE_RETRY_MAX_DELAY_MS = 250;\n\nexport const POLICY_ENGINE_CHALLENGE_REQUEST_SCHEMA =\n  \"xyz.tinycloud.policy-engine/challenge-request/v0\" as const;\nexport const POLICY_ENGINE_CHALLENGE_RESPONSE_SCHEMA =\n  \"xyz.tinycloud.policy/challenge/v0\" as const;\nexport const POLICY_ENGINE_RESOLVE_REQUEST_SCHEMA =\n  \"xyz.tinycloud.policy/presentation/v0\" as const;\nexport const POLICY_ENGINE_DENIAL_SCHEMA =\n  \"xyz.tinycloud.policy-engine/denial/v0\" as const;\nexport const HOLDER_KEY_BINDING_PRESENTATION_SCHEMA =\n  \"xyz.tinycloud.policy/presentation/v0\" as const;\nexport const PORTABLE_DELEGATION_SCHEMA =\n  \"xyz.tinycloud.policy/portable-delegation/v0\" as const;\n\nexport const POLICY_ENGINE_GRANT_PRESENTATION_DENIAL_CODES = [\n  \"schema-invalid\",\n  \"challenge-not-found\",\n  \"challenge-expired\",\n  \"challenge-nonce-consumed\",\n  \"presentation-expired\",\n  \"presentation-audience-mismatch\",\n  \"presentation-evidence-missing\",\n  \"digest-mismatch\",\n  \"evidence-requirement-unknown\",\n  \"evidence-requirement-duplicate\",\n  \"holder-signature-invalid\",\n  \"holder-signature-signer-mismatch\",\n  \"id-mismatch\",\n  \"requested-capabilities-exceeded\",\n  \"requested-capabilities-hash-mismatch\",\n  \"evidence-authority-missing\",\n  \"evidence-credential-invalid\",\n  \"evidence-domain-invalid\",\n  \"evidence-domain-missing\",\n  \"evidence-freshness-expired\",\n  \"evidence-freshness-unestablishable\",\n  \"evidence-issuer-missing\",\n  \"evidence-issuer-untrusted\",\n  \"evidence-presentation-invalid\",\n  \"evidence-requirements-invalid\",\n  \"evidence-verifier-unsupported\",\n  \"enrollment-binding-mismatch\",\n  \"enrollment-expired\",\n  \"enrollment-not-yet-valid\",\n  \"enrollment-out-of-scope\",\n  \"enrollment-revoked\",\n  \"enrollment-revoked-irreversible\",\n  \"enrollment-status-rollback\",\n  \"signature-invalid\",\n  \"signer-not-authorized\",\n  \"audience-mismatch\",\n  \"capability-not-contained\",\n  \"evidence-invalid\",\n  \"evidence-missing\",\n  \"evidence-stale\",\n  \"evidence-subject-mismatch\",\n  \"evidence-untrusted\",\n  \"grant-ttl-exceeds-policy\",\n  \"holder-did-mismatch\",\n  \"holder-key-not-permitted\",\n  \"holder-signature-invalid\",\n  \"owner-mismatch\",\n  \"policy-expired\",\n  \"policy-inactive\",\n  \"policy-not-found\",\n  \"policy-not-satisfied\",\n  \"policy-revoked\",\n  \"policy-status-rollback\",\n  \"rate-limited\",\n] as const;\n\nexport type PolicyEngineGrantPresentationDenialCode =\n  (typeof POLICY_ENGINE_GRANT_PRESENTATION_DENIAL_CODES)[number];\n\nexport type TranscriptRequesterErrorCode =\n  | \"requester-bootstrap-malformed\"\n  | \"requester-bootstrap-unknown-key\"\n  | \"requester-engine-record-signature-invalid\"\n  | \"requester-engine-record-owner-mismatch\"\n  | \"requester-engine-record-audience-mismatch\"\n  | \"requester-engine-record-endpoint-mismatch\"\n  | \"requester-engine-record-invalid\"\n  | \"requester-policy-engine-endpoint-invalid\"\n  | \"requester-engine-unreachable\"\n  | \"requester-engine-response-invalid\"\n  | \"requester-renewal-required\"\n  | \"requester-challenge-reused\"\n  | \"requester-presentation-invalid\"\n  | \"requester-delegation-invalid\"\n  | \"requester-delegation-wrong-holder\"\n  | \"requester-delegation-not-refresh-only\"\n  | \"requester-delegation-ttl-excessive\"\n  | \"requester-delegation-capability-wider\"\n  | \"requester-owner-node-endpoint-invalid\"\n  | \"requester-delegation-import-failed\"\n  | \"requester-invocation-signer-required\"\n  | \"requester-invocation-signer-mismatch\"\n  | \"requester-node-denied\"\n  | \"requester-node-unreachable\"\n  | \"requester-node-response-invalid\"\n  | \"requester-access-not-contained\"\n  | \"requester-access-denied\"\n  | \"requester-access-unreachable\"\n  | \"requester-access-ended\"\n  | `policy-engine-denied-${PolicyEngineGrantPresentationDenialCode}`;\n\nexport type TranscriptRequesterErrorState =\n  | \"bootstrap-invalid\"\n  | \"denied\"\n  | \"unreachable\"\n  | \"renewal-required\"\n  | \"access-ended\"\n  | \"invalid\"\n  | \"not-contained\";\n\nexport class TranscriptRequesterError extends Error {\n  public readonly code: TranscriptRequesterErrorCode;\n  public readonly state: TranscriptRequesterErrorState;\n  public readonly denialCode?: PolicyEngineGrantPresentationDenialCode;\n  public readonly status?: number;\n\n  constructor(\n    code: TranscriptRequesterErrorCode,\n    message: string,\n    state: TranscriptRequesterErrorState = \"invalid\",\n    denialCode?: PolicyEngineGrantPresentationDenialCode,\n    status?: number,\n  ) {\n    super(message);\n    this.name = \"TranscriptRequesterError\";\n    this.code = code;\n    this.state = state;\n    this.denialCode = denialCode;\n    this.status = status;\n  }\n}\n\nexport interface RequesterHttpRequest {\n  readonly method: \"POST\" | \"GET\";\n  readonly url: string;\n  readonly headers?: Readonly<Record<string, string>>;\n  readonly body?: unknown;\n  /** Endpoint requests must not follow redirects. */\n  readonly redirect?: \"error\";\n  /** Transport must connect only to one of these pre-resolved public addresses. */\n  readonly allowedResolvedAddresses?: readonly string[];\n}\n\nexport interface RequesterHttpResponse {\n  readonly status: number;\n  readonly body: unknown;\n  /** Required for policy-engine and owner-node requests; reports the non-redirected final URL. */\n  readonly finalUrl?: string;\n  /** Required for policy-engine and owner-node requests; reports the actual connected IP. */\n  readonly resolvedAddress?: string;\n}\n\nexport interface RequesterEndpointResolution {\n  readonly addresses: readonly string[];\n}\n\nexport interface RequesterTransport {\n  request(request: RequesterHttpRequest): Promise<RequesterHttpResponse>;\n  /** Resolve before egress so the requester can pin public addresses and detect rebinding. */\n  resolveEndpoint?(endpoint: string): Promise<RequesterEndpointResolution>;\n}\n\nexport interface RequesterInvocationCapability {\n  readonly holderDid: string;\n  readonly verificationMethod: string;\n  readonly jwk: object;\n  readonly invoke: InvokeFunction;\n  readonly invokeAny?: InvokeAnyFunction;\n}\n\nexport interface HolderKeyBindingPresentation {\n  readonly schema: typeof HOLDER_KEY_BINDING_PRESENTATION_SCHEMA;\n  readonly policyId: string;\n  readonly eligibleSubjectDid: string;\n  readonly holderDid: string;\n  readonly holderBinding: unknown;\n  readonly requestedCapabilities: readonly PolicyCapability[];\n  readonly requestedCapabilitiesHash: string;\n  readonly audience: string;\n  readonly nonce: string;\n  readonly expiresAt: string;\n  readonly evidence?: readonly unknown[];\n  readonly holderSignature: {\n    readonly suite: string;\n    readonly signerDid: string;\n    readonly value: string;\n  };\n}\n\nexport interface RequesterSigningCapability {\n  readonly holderDid: string;\n  readonly keyId: string;\n  readonly suite?: string;\n  readonly holderBinding?: unknown;\n  readonly eligibleSubjectDid?: string;\n  readonly evidence?: readonly unknown[];\n  signGrantPresentation?(input: {\n    readonly schema: typeof HOLDER_KEY_BINDING_PRESENTATION_SCHEMA;\n    readonly policyId: string;\n    readonly eligibleSubjectDid: string;\n    readonly holderDid: string;\n    readonly holderBinding: unknown;\n    readonly requestedCapabilities: readonly PolicyCapability[];\n    readonly requestedCapabilitiesHash: string;\n    readonly audience: string;\n    readonly nonce: string;\n    readonly expiresAt: string;\n    readonly evidence?: readonly unknown[];\n  }): Promise<string> | string;\n  signKeyBinding(input: {\n    readonly schema: typeof HOLDER_KEY_BINDING_PRESENTATION_SCHEMA;\n    readonly policyId?: string;\n    readonly eligibleSubjectDid?: string;\n    readonly holderDid: string;\n    readonly holderBinding?: unknown;\n    readonly requestedCapabilities?: readonly PolicyCapability[];\n    readonly requestedCapabilitiesHash?: string;\n    readonly audience: string;\n    readonly nonce: string;\n    readonly challengeId: string;\n    readonly issuedAt: string;\n    readonly keyId: string;\n  }): Promise<string> | string;\n}\n\nexport interface PortableDelegation {\n  readonly schema?: typeof PORTABLE_DELEGATION_SCHEMA;\n  readonly delegationId: string;\n  readonly policyId: string;\n  readonly issuerDid: string;\n  readonly holderDid: string;\n  readonly audience?: string;\n  readonly issuedAt: string;\n  readonly expiresAt: string;\n  readonly terminal: boolean;\n  readonly maxTtlSeconds: number;\n  readonly capabilities: readonly PolicyCapability[];\n  readonly encoded?: string;\n}\n\nexport interface TranscriptRequesterOptions {\n  readonly bootstrap: unknown;\n  readonly requesterDid: string;\n  readonly ownerDid: string;\n  readonly audience: string;\n  readonly grantIssuerDid: string;\n  /** Owner-node binding from trusted TinyCloud discovery/config, never copied from bootstrap. */\n  readonly trustedOwnerNode: {\n    readonly endpoint: string;\n    readonly spaceId: string;\n  };\n  readonly transport: RequesterTransport;\n  readonly signingCapability?: RequesterSigningCapability;\n  readonly invocationCapability?: RequesterInvocationCapability;\n  readonly eligibleSubjectDid?: string;\n  readonly holderBinding?: unknown;\n  readonly evidence?: readonly unknown[];\n  readonly presentationTtlSeconds?: number;\n  readonly now?: () => Date;\n  readonly sleep?: (milliseconds: number) => Promise<void>;\n  readonly random?: () => number;\n  readonly engineRetryAttempts?: number;\n}\n\nexport interface TranscriptRequesterReadSqlResult {\n  readonly rows: readonly unknown[];\n}\n\nexport interface TranscriptRequesterReadKvResult {\n  readonly value: unknown;\n}\n\nconst JsonValueSchema: z.ZodType<unknown> = z.lazy(() =>\n  z.union([\n    z.string(),\n    z.number().finite(),\n    z.boolean(),\n    z.null(),\n    z.array(JsonValueSchema),\n    z.record(JsonValueSchema),\n  ]),\n);\n\nconst Rfc3339Schema = z\n  .string()\n  .refine((value) => parseStrictRfc3339(value) !== undefined, {\n    message: \"must be strict RFC 3339 date-time with timezone\",\n  });\n\nconst SignedRecordSchema = z\n  .object({\n    schema: z.string(),\n    engineRecordId: z.string(),\n    ownerDid: z.string(),\n    endpoint: z.string(),\n    audience: z.string(),\n    supportedPolicyVersions: z.array(z.string()),\n    supportedEvidenceVerifiers: z.array(z.string()),\n    grantIssuerDid: z.string(),\n    expiresAt: Rfc3339Schema,\n    signature: z\n      .object({\n        suite: z.string(),\n        signerDid: z.string(),\n        value: z.string(),\n      })\n      .strict(),\n  })\n  .strict();\n\nconst PolicyEngineSchema = z\n  .object({\n    endpoint: z.string().url(),\n    audience: z.string(),\n    supportedEvidenceVerifiers: z.tuple([\n      z.literal(W3C_VC_CREDENTIAL_VERIFIER),\n    ]),\n    signedRecord: SignedRecordSchema,\n  })\n  .strict();\n\nconst OwnerNodeSchema = z\n  .object({\n    schema: z.literal(OWNER_NODE_ENDPOINT_SCHEMA),\n    endpoint: z.string().url(),\n    spaceId: z.string().min(1),\n  })\n  .strict();\n\nconst ResourceHintSchema = z\n  .object({\n    resourceType: z.string(),\n    resourceId: z.string(),\n    requestedCapabilities: z.array(JsonValueSchema).min(1),\n  })\n  .strict();\n\nconst BootstrapSchema = z\n  .object({\n    schema: z.literal(TRANSCRIPT_SHARE_BOOTSTRAP_SCHEMA),\n    policyId: z.string(),\n    policyEngine: PolicyEngineSchema,\n    ownerNode: OwnerNodeSchema,\n    resourceHint: ResourceHintSchema,\n  })\n  .strict();\n\nconst SignatureSchema = z\n  .object({\n    suite: z.string(),\n    signerDid: z.string(),\n    value: z.string(),\n  })\n  .strict();\n\nconst ChallengeSchema = z\n  .object({\n    schema: z.literal(POLICY_ENGINE_CHALLENGE_RESPONSE_SCHEMA),\n    challengeId: z.string(),\n    policyId: z.string(),\n    audience: z.string(),\n    nonce: z.string().min(16),\n    challengeExpiresAt: Rfc3339Schema,\n    acceptedSuites: z.array(z.string()).min(1),\n    requestedCapabilitiesTemplate: z.array(JsonValueSchema).optional(),\n    signature: SignatureSchema,\n  })\n  .strict();\n\nconst ChallengeResponseSchema = z\n  .object({ challenge: ChallengeSchema })\n  .strict();\n\nconst DenialSchema = z\n  .object({\n    schema: z.literal(POLICY_ENGINE_DENIAL_SCHEMA),\n    code: z.enum(POLICY_ENGINE_GRANT_PRESENTATION_DENIAL_CODES),\n    message: z.string().optional(),\n  })\n  .strict();\n\nconst ErrorEnvelopeDenialSchema = z\n  .object({\n    error: z\n      .object({\n        code: z.enum(POLICY_ENGINE_GRANT_PRESENTATION_DENIAL_CODES),\n        message: z.string().optional(),\n      })\n      .strict(),\n  })\n  .strict();\n\nconst WireDelegationSchema = z\n  .object({\n    delegationId: z.string(),\n    issuanceId: z.string().min(1),\n    issuerDid: z.string(),\n    holderDid: z.string(),\n    policyId: z.string(),\n    capabilityHashHex: z.string().regex(/^[0-9a-f]{64}$/),\n    revocationMode: z.literal(\"refresh_only\"),\n    issuedAt: Rfc3339Schema,\n    expiresAt: Rfc3339Schema,\n    terminal: z.boolean(),\n    encoded: z.string(),\n  })\n  .strict();\n\nconst ResolveResponseSchema = z\n  .object({ delegation: WireDelegationSchema })\n  .strict();\nconst DelegateReceiptSchema = z\n  .object({\n    cid: z.string().min(1),\n    activated: z.array(z.string()),\n    skipped: z.array(z.string()),\n  })\n  .strict();\n\nconst SqlReadResponseSchema = z\n  .object({ rows: z.array(JsonValueSchema) })\n  .strict();\nconst KvReadResponseSchema = z.object({ value: JsonValueSchema }).strict();\n\nexport const LISTEN_SQL_STATEMENT_CATALOG = [\n  {\n    name: \"listen.getConversation\",\n    sql: \"SELECT id, title, source, source_id, source_url, started_at, ended_at, duration_secs, summary, metadata, transcript_json, transcript_text, created_at, updated_at FROM conversation WHERE id = ?\",\n    fixedParams: [{ index: 0, value: \"{conversationId}\" }],\n  },\n  {\n    name: \"listen.listParticipants\",\n    sql: \"SELECT id, name, email, speaker_label FROM participant WHERE conversation_id = ? ORDER BY COALESCE(speaker_label, name), id\",\n    fixedParams: [{ index: 0, value: \"{conversationId}\" }],\n  },\n] as const;\n\nexport type ListenSqlStatementName =\n  (typeof LISTEN_SQL_STATEMENT_CATALOG)[number][\"name\"];\ntype ListenSqlStatement = (typeof LISTEN_SQL_STATEMENT_CATALOG)[number];\ntype ResolvedListenSqlStatement = {\n  readonly name: string;\n  readonly sql: string;\n  readonly fixedParams: readonly {\n    readonly index: number;\n    readonly value: unknown;\n  }[];\n};\n\nexport function listenTranscriptScopedStatementName(\n  statementName: ListenSqlStatementName,\n  conversationId: string,\n): string {\n  if (conversationId.length === 0) {\n    throw new TranscriptRequesterError(\n      \"requester-access-not-contained\",\n      \"conversation ID must be non-empty for a scoped Listen SQL read\",\n      \"not-contained\",\n    );\n  }\n  return `${statementName}@${encodeURIComponent(conversationId)}`;\n}\ntype NormalizedWireDelegation = PortableDelegation & {\n  readonly encoded: string;\n};\n\nconst LISTEN_SQL_STATEMENT_BY_NAME: ReadonlyMap<string, ListenSqlStatement> =\n  new Map(\n    LISTEN_SQL_STATEMENT_CATALOG.map((statement) => [\n      statement.name,\n      statement,\n    ]),\n  );\n\nexport class TranscriptRequester {\n  private readonly bootstrap: TranscriptShareBootstrap;\n  private readonly requesterDid: string;\n  private readonly ownerDid: string;\n  private readonly audience: string;\n  private readonly grantIssuerDid: string;\n  private readonly transport: RequesterTransport;\n  private readonly signingCapability?: RequesterSigningCapability;\n  private readonly invocationCapability?: RequesterInvocationCapability;\n  private readonly policyEngineRecordExpiresAtMs: number;\n  private readonly policyEngineAddresses: ReadonlySet<string>;\n  private readonly ownerNodeAddresses: ReadonlySet<string>;\n  private readonly now: () => Date;\n  private readonly sleep: (milliseconds: number) => Promise<void>;\n  private readonly random: () => number;\n  private readonly engineRetryAttempts: number;\n  private readonly requestedCapabilities: readonly PolicyCapability[];\n  private readonly nativeAuthorityCeiling: readonly PolicyCapability[];\n  private readonly requestedCapabilitiesHash: string;\n  private readonly eligibleSubjectDid: string;\n  private readonly holderBinding: unknown;\n  private readonly evidence?: readonly unknown[];\n  private readonly presentationTtlSeconds: number;\n  private readonly usedChallengeNonces = new Set<string>();\n  private importedDelegation?: PortableDelegation;\n  private importedDelegationCid?: string;\n  private accessEnded = false;\n\n  private constructor(\n    bootstrap: TranscriptShareBootstrap,\n    requestedCapabilities: readonly PolicyCapability[],\n    nativeAuthorityCeiling: readonly PolicyCapability[],\n    requestedCapabilitiesHash: string,\n    policyEngineRecordExpiresAtMs: number,\n    policyEngineAddresses: ReadonlySet<string>,\n    ownerNodeAddresses: ReadonlySet<string>,\n    options: TranscriptRequesterOptions,\n  ) {\n    this.bootstrap = bootstrap;\n    this.requestedCapabilities = requestedCapabilities;\n    this.nativeAuthorityCeiling = nativeAuthorityCeiling;\n    this.requestedCapabilitiesHash = requestedCapabilitiesHash;\n    this.requesterDid = options.requesterDid;\n    this.ownerDid = options.ownerDid;\n    this.audience = options.audience;\n    this.grantIssuerDid = options.grantIssuerDid;\n    this.transport = options.transport;\n    this.signingCapability = options.signingCapability;\n    this.invocationCapability = options.invocationCapability;\n    this.policyEngineRecordExpiresAtMs = policyEngineRecordExpiresAtMs;\n    this.policyEngineAddresses = policyEngineAddresses;\n    this.ownerNodeAddresses = ownerNodeAddresses;\n    this.eligibleSubjectDid =\n      options.eligibleSubjectDid ??\n      options.signingCapability?.eligibleSubjectDid ??\n      options.requesterDid;\n    this.holderBinding = options.holderBinding ??\n      options.signingCapability?.holderBinding ?? {\n        type: \"enrolled-agent\",\n        enrollment: {\n          schema: \"xyz.tinycloud.policy/holder-enrollment/v0\",\n          holderDid: options.requesterDid,\n        },\n      };\n    this.evidence = options.evidence ?? options.signingCapability?.evidence;\n    this.presentationTtlSeconds = Math.min(\n      Math.max(options.presentationTtlSeconds ?? 60, 1),\n      300,\n    );\n    this.now = options.now ?? (() => new Date());\n    this.sleep =\n      options.sleep ??\n      ((milliseconds) =>\n        new Promise((resolve) => setTimeout(resolve, milliseconds)));\n    this.random = options.random ?? Math.random;\n    this.engineRetryAttempts =\n      options.engineRetryAttempts ?? REQUESTER_ENGINE_RETRY_ATTEMPTS;\n  }\n\n  static async create(\n    options: TranscriptRequesterOptions,\n  ): Promise<TranscriptRequester> {\n    const bootstrap = parseBootstrap(options.bootstrap);\n    if (\n      bootstrap.ownerNode.endpoint !== options.trustedOwnerNode.endpoint ||\n      bootstrap.ownerNode.spaceId !== options.trustedOwnerNode.spaceId\n    ) {\n      throw endpointError(\n        \"owner-node\",\n        \"bootstrap owner-node binding does not match trusted discovery/config\",\n      );\n    }\n    const record = await verifyRecordBeforeEgress(bootstrap, options);\n    if (record.endpoint !== bootstrap.policyEngine.endpoint) {\n      throw new TranscriptRequesterError(\n        \"requester-engine-record-endpoint-mismatch\",\n        \"policy engine record endpoint does not match bootstrap endpoint\",\n        \"bootstrap-invalid\",\n      );\n    }\n    if (record.audience !== bootstrap.policyEngine.audience) {\n      throw new TranscriptRequesterError(\n        \"requester-engine-record-audience-mismatch\",\n        \"policy engine record audience does not match bootstrap audience\",\n        \"bootstrap-invalid\",\n      );\n    }\n    const policyEngineAddresses = await validateAndResolvePublicEndpoint(\n      bootstrap.policyEngine.endpoint,\n      options.transport,\n      \"policy-engine\",\n    );\n    const ownerNodeAddresses = await validateAndResolveOwnerNode(\n      bootstrap.ownerNode.endpoint,\n      options.transport,\n    );\n    const requestedCapabilities =\n      bootstrap.resourceHint.requestedCapabilities.map((capability, index) =>\n        parsePolicyCapability(\n          capability,\n          `$.resourceHint.requestedCapabilities[${index}]`,\n        ),\n      );\n    const nativeAuthorityCeiling = requestedCapabilities.map((capability) => ({\n      ...capability,\n      space: bootstrap.ownerNode.spaceId,\n    }));\n    return new TranscriptRequester(\n      bootstrap,\n      requestedCapabilities,\n      nativeAuthorityCeiling,\n      requestedCapabilitiesHash(requestedCapabilities),\n      parseStrictRfc3339(record.expiresAt)!,\n      policyEngineAddresses,\n      ownerNodeAddresses,\n      options,\n    );\n  }\n\n  get accessState(): \"active\" | \"needs-renewal\" | \"access-ended\" {\n    if (this.accessEnded) {\n      return \"access-ended\";\n    }\n    if (this.importedDelegation === undefined) {\n      return \"needs-renewal\";\n    }\n    if (this.requiresRenewal(this.importedDelegation)) {\n      return \"needs-renewal\";\n    }\n    return \"active\";\n  }\n\n  async readSql(\n    statementName: ListenSqlStatementName,\n    conversationId?: string,\n  ): Promise<TranscriptRequesterReadSqlResult> {\n    try {\n      const catalogStatement = listenSqlStatementFromCatalog(statementName);\n      const selectedConversationId =\n        conversationId ?? this.bootstrap.resourceHint.resourceId;\n      const statement: ResolvedListenSqlStatement = {\n        ...catalogStatement,\n        name:\n          conversationId === undefined\n            ? catalogStatement.name\n            : listenTranscriptScopedStatementName(\n                statementName,\n                conversationId,\n              ),\n        fixedParams: catalogStatement.fixedParams.map((item) => ({\n          ...item,\n          value:\n            item.value === \"{conversationId}\"\n              ? selectedConversationId\n              : item.value,\n        })),\n      };\n      const delegation = await this.ensureFreshDelegation();\n      const requested = this.sqlAccessCapabilityForDelegation(\n        delegation,\n        statement,\n      );\n      this.assertContainedByDelegation(delegation, requested);\n      const response = await this.nativeInvoke(\n        \"sql\",\n        requested.path,\n        \"tinycloud.sql/read\",\n        {\n          action: \"executeStatement\",\n          name: statement.name,\n          // The native constrained-SQL route injects caveat-pinned values and\n          // rejects callers that supply those indices. Uncaveated reads must\n          // resolve the catalog placeholder themselves.\n          params:\n            requested.caveats === undefined\n              ? statement.fixedParams.map((item) => item.value)\n              : [],\n        },\n        requested.caveats,\n      );\n      return parseNodeDataResponse(\n        response,\n        SqlReadResponseSchema,\n        \"SQL read\",\n      ) as TranscriptRequesterReadSqlResult;\n    } catch (error) {\n      this.recordAccessEnded(error);\n      throw error;\n    }\n  }\n\n  async readKv(path: string): Promise<TranscriptRequesterReadKvResult> {\n    try {\n      const delegation = await this.ensureFreshDelegation();\n      const grantedKv = delegation.capabilities.find(\n        (capability) =>\n          capability.service === \"tinycloud.kv\" &&\n          capability.path === path &&\n          capability.actions.includes(\"tinycloud.kv/get\"),\n      );\n      const requested = parsePolicyCapability(\n        {\n          service: \"tinycloud.kv\",\n          space: grantedKv?.space ?? \"applications\",\n          path,\n          actions: [\"tinycloud.kv/get\"],\n        },\n        \"$.kvRead\",\n      );\n      this.assertContainedByDelegation(delegation, requested);\n      const response = await this.nativeInvoke(\"kv\", path, \"tinycloud.kv/get\");\n      return parseNodeDataResponse(\n        response,\n        KvReadResponseSchema,\n        \"KV read\",\n      ) as TranscriptRequesterReadKvResult;\n    } catch (error) {\n      this.recordAccessEnded(error);\n      throw error;\n    }\n  }\n\n  private async nativeInvoke(\n    service: \"sql\" | \"kv\",\n    path: string,\n    action: \"tinycloud.sql/read\" | \"tinycloud.kv/get\",\n    body?: unknown,\n    caveats?: Record<string, unknown>,\n  ): Promise<RequesterHttpResponse> {\n    const capability = this.invocationCapability;\n    if (capability === undefined) {\n      throw new TranscriptRequesterError(\n        \"requester-invocation-signer-required\",\n        \"holder invocation capability is required for native reads\",\n      );\n    }\n    if (\n      capability.holderDid !== this.requesterDid ||\n      capability.holderDid !== this.signingCapability?.holderDid\n    ) {\n      throw new TranscriptRequesterError(\n        \"requester-invocation-signer-mismatch\",\n        \"invocation signer must be the presentation key-binding holder\",\n      );\n    }\n    if (\n      this.importedDelegationCid === undefined ||\n      this.importedDelegation === undefined\n    ) {\n      throw new TranscriptRequesterError(\n        \"requester-delegation-import-failed\",\n        \"native read requires a confirmed delegation import\",\n      );\n    }\n    const session: ServiceSession = {\n      delegationHeader: { Authorization: this.importedDelegation.encoded! },\n      delegationCid: this.importedDelegationCid,\n      spaceId: this.bootstrap.ownerNode.spaceId,\n      verificationMethod: capability.verificationMethod,\n      jwk: capability.jwk,\n    };\n    let invocationHeaders: ServiceHeaders;\n    if (caveats === undefined) {\n      invocationHeaders = capability.invoke(session, service, path, action);\n    } else {\n      if (capability.invokeAny === undefined) {\n        throw new TranscriptRequesterError(\n          \"requester-invocation-signer-required\",\n          \"holder invocation capability must support caveated native reads\",\n        );\n      }\n      invocationHeaders = capability.invokeAny(session, [\n        {\n          spaceId: this.bootstrap.ownerNode.spaceId,\n          service,\n          path,\n          action,\n          caveats: [caveats],\n        },\n      ]);\n    }\n    const headers = headersRecord(invocationHeaders);\n    const response = await this.transport.request({\n      method: \"POST\",\n      url: `${trimTrailingSlash(this.bootstrap.ownerNode.endpoint)}/invoke`,\n      headers,\n      redirect: \"error\",\n      allowedResolvedAddresses: [...this.ownerNodeAddresses],\n      ...(body === undefined ? {} : { body }),\n    });\n    this.assertOwnerNodeResponse(response, \"/invoke\");\n    return response;\n  }\n\n  private async ensureFreshDelegation(): Promise<PortableDelegation> {\n    if (this.accessEnded) {\n      throw new TranscriptRequesterError(\n        \"requester-access-ended\",\n        \"requester access has ended\",\n        \"access-ended\",\n      );\n    }\n    if (\n      this.importedDelegation !== undefined &&\n      !this.requiresRenewal(this.importedDelegation)\n    ) {\n      return this.importedDelegation;\n    }\n    if (\n      this.signingCapability === undefined ||\n      this.signingCapability.holderDid !== this.requesterDid\n    ) {\n      throw new TranscriptRequesterError(\n        \"requester-renewal-required\",\n        \"a permitted requester signing capability is required for access-triggered renewal\",\n        \"renewal-required\",\n      );\n    }\n    try {\n      let lastError: unknown;\n      const attempts = Math.max(1, this.engineRetryAttempts);\n      for (let attempt = 0; attempt < attempts; attempt++) {\n        const challenge = await this.obtainChallenge();\n        const presentation = await this.mintPresentation(challenge);\n        try {\n          const delegation = await this.resolveOnce(challenge, presentation);\n          this.importedDelegation = delegation;\n          return delegation;\n        } catch (error) {\n          if (\n            !(error instanceof TranscriptRequesterError) ||\n            error.state !== \"unreachable\"\n          ) {\n            throw error;\n          }\n          lastError = error;\n        }\n        if (attempt + 1 < attempts) {\n          await this.sleep(retryDelay(attempt, this.random()));\n        }\n      }\n      throw new TranscriptRequesterError(\n        \"requester-engine-unreachable\",\n        lastError instanceof Error\n          ? lastError.message\n          : \"policy engine unreachable\",\n        \"unreachable\",\n      );\n    } catch (error) {\n      this.recordAccessEnded(error);\n      throw error;\n    }\n  }\n\n  private recordAccessEnded(error: unknown): void {\n    if (\n      error instanceof TranscriptRequesterError &&\n      error.state === \"access-ended\"\n    ) {\n      this.accessEnded = true;\n    }\n  }\n\n  private async obtainChallenge(): Promise<z.infer<typeof ChallengeSchema>> {\n    this.assertPolicyEngineRecordCurrent();\n    const response = await this.challengeRequestWithRetry({\n      method: \"POST\",\n      url: `${trimTrailingSlash(this.bootstrap.policyEngine.endpoint)}/policy/v0/challenge`,\n      redirect: \"error\",\n      allowedResolvedAddresses: [...this.policyEngineAddresses],\n      body: {\n        policyId: this.bootstrap.policyId,\n      },\n    });\n    return parseEngineSuccess(\n      response.body,\n      ChallengeResponseSchema,\n      \"challenge response\",\n    ).challenge;\n  }\n\n  private async mintPresentation(\n    challenge: z.infer<typeof ChallengeSchema>,\n  ): Promise<HolderKeyBindingPresentation> {\n    if (\n      challenge.policyId !== this.bootstrap.policyId ||\n      challenge.audience !== this.bootstrap.policyEngine.audience ||\n      challenge.audience !== this.audience\n    ) {\n      throw new TranscriptRequesterError(\n        \"requester-engine-response-invalid\",\n        \"challenge response binding does not match requester context\",\n      );\n    }\n    if (this.usedChallengeNonces.has(challenge.nonce)) {\n      throw new TranscriptRequesterError(\n        \"requester-challenge-reused\",\n        \"challenge nonce was already used by this requester\",\n      );\n    }\n    this.usedChallengeNonces.add(challenge.nonce);\n    const expiresAt = new Date(\n      this.now().getTime() + this.presentationTtlSeconds * 1000,\n    )\n      .toISOString()\n      .replace(\".000Z\", \"Z\");\n    const input = {\n      schema: HOLDER_KEY_BINDING_PRESENTATION_SCHEMA,\n      policyId: this.bootstrap.policyId,\n      eligibleSubjectDid: this.eligibleSubjectDid,\n      holderDid: this.requesterDid,\n      holderBinding: this.holderBinding,\n      requestedCapabilities: this.requestedCapabilities,\n      requestedCapabilitiesHash: this.requestedCapabilitiesHash,\n      audience: this.audience,\n      nonce: challenge.nonce,\n      expiresAt,\n      ...(this.evidence === undefined ? {} : { evidence: this.evidence }),\n    } as const;\n    const signature =\n      this.signingCapability!.signGrantPresentation === undefined\n        ? await this.signingCapability!.signKeyBinding({\n            ...input,\n            challengeId: challenge.challengeId,\n            issuedAt: expiresAt,\n            keyId: this.signingCapability!.keyId,\n          })\n        : await this.signingCapability!.signGrantPresentation(input);\n    if (typeof signature !== \"string\" || signature.length === 0) {\n      throw new TranscriptRequesterError(\n        \"requester-presentation-invalid\",\n        \"signing capability returned an invalid holder key-binding signature\",\n      );\n    }\n    return {\n      ...input,\n      holderSignature: {\n        suite: this.signingCapability!.suite ?? challenge.acceptedSuites[0]!,\n        signerDid: this.requesterDid,\n        value: signature,\n      },\n    };\n  }\n\n  private async resolveOnce(\n    challenge: z.infer<typeof ChallengeSchema>,\n    presentation: HolderKeyBindingPresentation,\n  ): Promise<PortableDelegation> {\n    void challenge;\n    this.assertPolicyEngineRecordCurrent();\n    const response = await this.resolveRequestOnce({\n      method: \"POST\",\n      url: `${trimTrailingSlash(this.bootstrap.policyEngine.endpoint)}/policy/v0/resolve`,\n      redirect: \"error\",\n      allowedResolvedAddresses: [...this.policyEngineAddresses],\n      body: { presentation },\n    });\n    const parsed = parseEngineSuccess(\n      response.body,\n      ResolveResponseSchema,\n      \"resolve response\",\n    );\n    return this.importPortableDelegation(parsed.delegation);\n  }\n\n  private async importPortableDelegation(\n    input: unknown,\n  ): Promise<PortableDelegation> {\n    const parsed = parseNodeNativePortableDelegation(input);\n    if (parsed.policyId !== this.bootstrap.policyId) {\n      throw new TranscriptRequesterError(\n        \"requester-delegation-invalid\",\n        \"portable delegation policy id does not match bootstrap\",\n      );\n    }\n    if (parsed.holderDid !== this.requesterDid) {\n      throw new TranscriptRequesterError(\n        \"requester-delegation-wrong-holder\",\n        \"portable delegation is not targeted at the requester DID\",\n      );\n    }\n    if (parsed.issuerDid !== this.grantIssuerDid) {\n      throw new TranscriptRequesterError(\n        \"requester-delegation-invalid\",\n        \"portable delegation issuer does not match the verified grant issuer DID\",\n      );\n    }\n    if (parsed.maxTtlSeconds > 300) {\n      throw new TranscriptRequesterError(\n        \"requester-delegation-ttl-excessive\",\n        \"portable delegation TTL exceeds 300 seconds\",\n      );\n    }\n    const issuedAt = parseStrictRfc3339(parsed.issuedAt)!;\n    const expiresAt = parseStrictRfc3339(parsed.expiresAt)!;\n    if (\n      expiresAt <= issuedAt ||\n      expiresAt - issuedAt > parsed.maxTtlSeconds * 1000\n    ) {\n      throw new TranscriptRequesterError(\n        \"requester-delegation-ttl-excessive\",\n        \"portable delegation expires outside its maxTtlSeconds bound\",\n      );\n    }\n    const capabilities = parsed.capabilities.map((capability, index) =>\n      parsePolicyCapability(capability, `$.delegation.capabilities[${index}]`),\n    );\n    for (const granted of capabilities) {\n      if (\n        !this.nativeAuthorityCeiling.some((requested) =>\n          policyCapabilityContains(requested, granted),\n        )\n      ) {\n        throw new TranscriptRequesterError(\n          \"requester-delegation-capability-wider\",\n          \"portable delegation grants a capability outside the bootstrap requested set\",\n        );\n      }\n    }\n    if (\n      typeof parsed.encoded !== \"string\" ||\n      parsed.encoded.split(\".\").length !== 3\n    ) {\n      throw new TranscriptRequesterError(\n        \"requester-delegation-invalid\",\n        \"portable delegation is not a compact-JWS UCAN\",\n      );\n    }\n    const delegation = { ...parsed, capabilities } as PortableDelegation;\n    const response = await this.transport.request({\n      method: \"POST\",\n      url: `${trimTrailingSlash(this.bootstrap.ownerNode.endpoint)}/delegate`,\n      headers: { Authorization: parsed.encoded },\n      redirect: \"error\",\n      allowedResolvedAddresses: [...this.ownerNodeAddresses],\n    });\n    this.assertOwnerNodeResponse(response, \"/delegate\");\n    const receipt = parseDelegateReceipt(response);\n    const target = this.bootstrap.ownerNode.spaceId;\n    if (\n      !receipt.activated.includes(target) ||\n      receipt.skipped.includes(target)\n    ) {\n      throw new TranscriptRequesterError(\n        \"requester-delegation-import-failed\",\n        receipt.activated.includes(target) && receipt.skipped.includes(target)\n          ? \"owner node returned a contradictory delegation receipt\"\n          : \"owner node did not activate the target owner space\",\n      );\n    }\n    this.importedDelegationCid = deriveDelegationCid(parsed.encoded);\n    return delegation;\n  }\n\n  private assertOwnerNodeResponse(\n    response: RequesterHttpResponse,\n    path: string,\n  ): void {\n    this.assertEndpointResponse(\n      response,\n      this.bootstrap.ownerNode.endpoint,\n      path,\n      this.ownerNodeAddresses,\n      \"owner-node\",\n    );\n  }\n\n  private assertPolicyEngineRecordCurrent(): void {\n    if (this.policyEngineRecordExpiresAtMs <= this.now().getTime()) {\n      throw new TranscriptRequesterError(\n        \"requester-engine-record-invalid\",\n        \"verified policy engine record has expired\",\n        \"bootstrap-invalid\",\n      );\n    }\n  }\n\n  private assertPolicyEngineResponse(\n    response: RequesterHttpResponse,\n    path: string,\n  ): void {\n    this.assertEndpointResponse(\n      response,\n      this.bootstrap.policyEngine.endpoint,\n      path,\n      this.policyEngineAddresses,\n      \"policy-engine\",\n    );\n  }\n\n  private assertEndpointResponse(\n    response: RequesterHttpResponse,\n    endpoint: string,\n    path: string,\n    allowedAddresses: ReadonlySet<string>,\n    kind: \"owner-node\" | \"policy-engine\",\n  ): void {\n    const expected = `${trimTrailingSlash(endpoint)}${path}`;\n    const error = (message: string) => endpointError(kind, message);\n    if (\n      response.finalUrl !== expected ||\n      response.resolvedAddress === undefined\n    ) {\n      throw error(\n        `${kind} transport metadata is missing or indicates a redirect`,\n      );\n    }\n    if (!allowedAddresses.has(normalizeIp(response.resolvedAddress))) {\n      throw error(`${kind} address changed after endpoint validation`);\n    }\n  }\n\n  private assertContainedByDelegation(\n    delegation: PortableDelegation,\n    requested: PolicyCapability,\n  ): void {\n    if (this.requiresRenewal(delegation)) {\n      throw new TranscriptRequesterError(\n        \"requester-renewal-required\",\n        \"delegation requires renewal before access\",\n        \"renewal-required\",\n      );\n    }\n    if (\n      !delegation.capabilities.some((granted) =>\n        policyCapabilityContains(granted, requested),\n      )\n    ) {\n      throw new TranscriptRequesterError(\n        \"requester-access-not-contained\",\n        \"requested access is outside the imported delegation capabilities\",\n        \"not-contained\",\n      );\n    }\n  }\n\n  private sqlAccessCapabilityForDelegation(\n    delegation: PortableDelegation,\n    statement: ResolvedListenSqlStatement,\n  ): PolicyCapability {\n    const grantedSql = delegation.capabilities.find(\n      (capability) =>\n        capability.service === \"tinycloud.sql\" &&\n        capability.actions.includes(\"tinycloud.sql/read\"),\n    );\n    if (grantedSql === undefined) {\n      throw new TranscriptRequesterError(\n        \"requester-access-not-contained\",\n        \"delegation has no SQL read grant\",\n        \"not-contained\",\n      );\n    }\n    if (grantedSql.caveats !== undefined) {\n      const statements = (\n        grantedSql.caveats as {\n          statements?: readonly {\n            name?: unknown;\n            sql?: unknown;\n            fixedParams?: unknown;\n          }[];\n        }\n      ).statements;\n      const matchesCatalogSelection = statements?.some(\n        (candidate) =>\n          candidate.name === statement.name &&\n          candidate.sql === statement.sql &&\n          Array.isArray(candidate.fixedParams) &&\n          jcsCanonicalize(candidate.fixedParams) ===\n            jcsCanonicalize(statement.fixedParams),\n      );\n      if (!matchesCatalogSelection) {\n        throw new TranscriptRequesterError(\n          \"requester-access-not-contained\",\n          \"SQL statement is outside the delegated catalog-derived statement caveat\",\n          \"not-contained\",\n        );\n      }\n      return grantedSql;\n    }\n    return parsePolicyCapability(\n      {\n        service: \"tinycloud.sql\",\n        space: grantedSql.space,\n        path: grantedSql.path,\n        actions: [\"tinycloud.sql/read\"],\n      },\n      \"$.sqlRead\",\n    );\n  }\n\n  private requiresRenewal(delegation: PortableDelegation): boolean {\n    const expiresAt = parseStrictRfc3339(delegation.expiresAt)!;\n    return (\n      expiresAt - this.now().getTime() <= REQUESTER_NEAR_EXPIRY_SECONDS * 1000\n    );\n  }\n\n  private async challengeRequestWithRetry(\n    request: RequesterHttpRequest,\n  ): Promise<RequesterHttpResponse> {\n    let lastError: unknown;\n    const attempts = Math.max(1, this.engineRetryAttempts);\n    for (let attempt = 0; attempt < attempts; attempt++) {\n      try {\n        const response = await this.transport.request(request);\n        this.assertPolicyEngineResponse(response, \"/policy/v0/challenge\");\n        if (response.status >= 500) {\n          lastError = new Error(`engine returned ${response.status}`);\n        } else if (response.status >= 400) {\n          const denial = parseDenialBody(response.body);\n          if (denial !== undefined) {\n            throw errorForDenial(denial, response.status);\n          }\n          throw new TranscriptRequesterError(\n            \"requester-engine-response-invalid\",\n            \"policy engine returned an invalid denial body\",\n          );\n        } else {\n          return response;\n        }\n      } catch (error) {\n        if (\n          error instanceof TranscriptRequesterError &&\n          error.state !== \"unreachable\"\n        ) {\n          throw error;\n        }\n        lastError = error;\n      }\n      if (attempt + 1 < attempts) {\n        await this.sleep(retryDelay(attempt, this.random()));\n      }\n    }\n    throw new TranscriptRequesterError(\n      \"requester-engine-unreachable\",\n      lastError instanceof Error\n        ? lastError.message\n        : \"policy engine unreachable\",\n      \"unreachable\",\n    );\n  }\n\n  private async resolveRequestOnce(\n    request: RequesterHttpRequest,\n  ): Promise<RequesterHttpResponse> {\n    try {\n      const response = await this.transport.request(request);\n      this.assertPolicyEngineResponse(response, \"/policy/v0/resolve\");\n      if (response.status >= 500) {\n        throw new TranscriptRequesterError(\n          \"requester-engine-unreachable\",\n          `engine returned ${response.status}`,\n          \"unreachable\",\n        );\n      }\n      if (response.status >= 400) {\n        const denial = parseDenialBody(response.body);\n        if (denial !== undefined) {\n          throw errorForDenial(denial, response.status);\n        }\n        throw new TranscriptRequesterError(\n          \"requester-engine-response-invalid\",\n          \"policy engine returned an invalid denial body\",\n        );\n      }\n      return response;\n    } catch (error) {\n      if (error instanceof TranscriptRequesterError) {\n        throw error;\n      }\n      throw new TranscriptRequesterError(\n        \"requester-engine-unreachable\",\n        error instanceof Error ? error.message : \"policy engine unreachable\",\n        \"unreachable\",\n      );\n    }\n  }\n}\n\nexport async function createTranscriptRequester(\n  options: TranscriptRequesterOptions,\n): Promise<TranscriptRequester> {\n  return TranscriptRequester.create(options);\n}\n\nfunction parseBootstrap(input: unknown): TranscriptShareBootstrap & {\n  readonly resourceHint: { readonly requestedCapabilities: readonly unknown[] };\n} {\n  const normalized = normalizeExternal(input, \"requester-bootstrap-malformed\");\n  const parsed = BootstrapSchema.safeParse(normalized);\n  if (!parsed.success) {\n    throw new TranscriptRequesterError(\n      parsed.error.issues.some((issue) => issue.code === \"unrecognized_keys\")\n        ? \"requester-bootstrap-unknown-key\"\n        : \"requester-bootstrap-malformed\",\n      parsed.error.message,\n      \"bootstrap-invalid\",\n    );\n  }\n  return parsed.data as TranscriptShareBootstrap & {\n    readonly resourceHint: {\n      readonly requestedCapabilities: readonly unknown[];\n    };\n  };\n}\n\nasync function verifyRecordBeforeEgress(\n  bootstrap: TranscriptShareBootstrap,\n  options: TranscriptRequesterOptions,\n) {\n  try {\n    return await verifyPolicyEngineRecordForRequester({\n      signedRecord: bootstrap.policyEngine.signedRecord,\n      ownerDid: options.ownerDid,\n      audience: options.audience,\n      grantIssuerDid: options.grantIssuerDid,\n      now: (options.now ?? (() => new Date()))()\n        .toISOString()\n        .replace(\".000Z\", \"Z\"),\n      requiredPolicyVersion: POLICY_VERSION_V0,\n      requiredEvidenceVerifier: W3C_VC_CREDENTIAL_VERIFIER,\n    });\n  } catch (error) {\n    const code = errorCodeForRecordFailure(error);\n    throw new TranscriptRequesterError(\n      code,\n      error instanceof Error ? error.message : String(error),\n      \"bootstrap-invalid\",\n    );\n  }\n}\n\nfunction errorCodeForRecordFailure(\n  error: unknown,\n): TranscriptRequesterErrorCode {\n  const code =\n    typeof error === \"object\" && error !== null && \"code\" in error\n      ? (error as { code?: unknown }).code\n      : undefined;\n  if (code === \"policy-engine-record-signature-invalid\") {\n    return \"requester-engine-record-signature-invalid\";\n  }\n  if (code === \"policy-engine-record-owner-mismatch\") {\n    return \"requester-engine-record-owner-mismatch\";\n  }\n  if (code === \"policy-engine-record-audience-mismatch\") {\n    return \"requester-engine-record-audience-mismatch\";\n  }\n  return \"requester-engine-record-invalid\";\n}\n\nfunction parsePolicyCapability(input: unknown, path: string): PolicyCapability {\n  try {\n    return normalizePolicyCapabilityForRequester(\n      input,\n    ) as unknown as PolicyCapability;\n  } catch (error) {\n    throw new TranscriptRequesterError(\n      \"requester-delegation-invalid\",\n      `${path}: ${error instanceof Error ? error.message : String(error)}`,\n    );\n  }\n}\n\nfunction listenSqlStatementFromCatalog(\n  statementName: unknown,\n): ListenSqlStatement {\n  if (typeof statementName !== \"string\") {\n    throw new TranscriptRequesterError(\n      \"requester-access-not-contained\",\n      \"SQL statement name must be a string from the canonical Listen statement catalog\",\n      \"not-contained\",\n    );\n  }\n  const statement = LISTEN_SQL_STATEMENT_BY_NAME.get(statementName);\n  if (statement === undefined) {\n    throw new TranscriptRequesterError(\n      \"requester-access-not-contained\",\n      \"SQL statement is not in the canonical Listen statement catalog\",\n      \"not-contained\",\n    );\n  }\n  return statement;\n}\n\nfunction normalizePolicyCapabilityForRequester(\n  input: unknown,\n): PolicyCapability {\n  const normalized = normalizeExternal(input, \"requester-delegation-invalid\");\n  return normalizePolicyCapability(normalized);\n}\n\nfunction requestedCapabilitiesHash(\n  capabilities: readonly PolicyCapability[],\n): string {\n  const canonical = [...capabilities].sort((left, right) =>\n    `${left.service}\\0${left.space}\\0${left.path}`.localeCompare(\n      `${right.service}\\0${right.space}\\0${right.path}`,\n    ),\n  );\n  const encoder = new TextEncoder();\n  const domain = encoder.encode(\n    \"xyz.tinycloud.policy/RequestedCapabilities/v0\\0\",\n  );\n  const body = encoder.encode(jcsCanonicalize(canonical));\n  const bytes = new Uint8Array(domain.length + body.length);\n  bytes.set(domain, 0);\n  bytes.set(body, domain.length);\n  return bytesToHex(sha256(bytes, \"bytes\")).slice(2);\n}\n\nfunction normalizeWireDelegation(\n  delegation: z.infer<typeof WireDelegationSchema>,\n): NormalizedWireDelegation {\n  const signed = delegationAuthorityFromCompactJws(delegation.encoded);\n  const invalid = (field: string): never => {\n    throw new TranscriptRequesterError(\n      \"requester-delegation-invalid\",\n      `portable delegation ${field} does not match its signed compact-JWS authority`,\n    );\n  };\n  if (delegation.delegationId !== deriveDelegationCid(delegation.encoded))\n    invalid(\"delegationId\");\n  if (delegation.issuerDid !== signed.issuerDid) invalid(\"issuerDid\");\n  if (delegation.holderDid !== signed.holderDid) invalid(\"holderDid\");\n  if (delegation.policyId !== signed.policyId) invalid(\"policyId\");\n  if (Date.parse(delegation.issuedAt) !== signed.issuedAtMs)\n    invalid(\"issuedAt\");\n  if (Date.parse(delegation.expiresAt) !== signed.expiresAtMs)\n    invalid(\"expiresAt\");\n  if (delegation.terminal !== signed.terminal) invalid(\"terminal\");\n  if (delegation.issuanceId !== signed.issuanceId) invalid(\"issuanceId\");\n  if (delegation.capabilityHashHex !== signed.capabilityHashHex)\n    invalid(\"capabilityHashHex\");\n  if (delegation.revocationMode !== signed.revocationMode)\n    invalid(\"revocationMode\");\n  return {\n    delegationId: deriveDelegationCid(delegation.encoded),\n    issuerDid: signed.issuerDid,\n    holderDid: signed.holderDid,\n    policyId: signed.policyId,\n    issuedAt: new Date(signed.issuedAtMs).toISOString().replace(\".000Z\", \"Z\"),\n    expiresAt: new Date(signed.expiresAtMs).toISOString().replace(\".000Z\", \"Z\"),\n    terminal: signed.terminal,\n    maxTtlSeconds: Math.ceil((signed.expiresAtMs - signed.issuedAtMs) / 1000),\n    capabilities: signed.capabilities,\n    encoded: delegation.encoded,\n  };\n}\n\n/**\n * Parse a frozen policy-engine delegation response and derive its authority\n * exclusively from the signed compact-JWS payload. This performs no egress or\n * node import and is suitable for constrained runners that cannot honestly\n * satisfy the public-endpoint transport profile.\n */\nexport function parseNodeNativePortableDelegation(\n  input: unknown,\n): PortableDelegation {\n  return normalizeWireDelegation(\n    parseEngineSuccess(input, WireDelegationSchema, \"portable delegation\"),\n  );\n}\n\nfunction delegationAuthorityFromCompactJws(encoded: string): {\n  issuerDid: string;\n  holderDid: string;\n  policyId: string;\n  issuanceId: string;\n  capabilityHashHex: string;\n  revocationMode: \"refresh_only\";\n  issuedAtMs: number;\n  expiresAtMs: number;\n  terminal: boolean;\n  capabilities: PolicyCapability[];\n} {\n  try {\n    const parts = encoded.split(\".\");\n    if (parts.length !== 3) throw new Error(\"not compact JWS\");\n    const payload = normalizeJson(\n      JSON.parse(new TextDecoder().decode(base64UrlBytes(parts[1]!))),\n    ) as Record<string, unknown>;\n    const issuer = requiredPayloadString(payload, \"iss\");\n    const holderDid = requiredPayloadString(payload, \"aud\");\n    const issuedAt = requiredPayloadEpoch(payload, \"nbf\");\n    const expiresAt = requiredPayloadEpoch(payload, \"exp\");\n    const facts = payload.fct;\n    if (!Array.isArray(facts)) throw new Error(\"UCAN fct is absent\");\n    const authorityFacts = facts.filter(\n      (fact) =>\n        fact !== null &&\n        typeof fact === \"object\" &&\n        !Array.isArray(fact) &&\n        \"xyz.tinycloud.policy/policyId\" in fact,\n    ) as Record<string, unknown>[];\n    if (authorityFacts.length !== 1)\n      throw new Error(\"UCAN policy authority fact is not unique\");\n    const fact = authorityFacts[0]!;\n    const policyId = requiredPayloadString(\n      fact,\n      \"xyz.tinycloud.policy/policyId\",\n    );\n    const issuanceId = requiredPayloadString(\n      fact,\n      \"xyz.tinycloud.policy/issuanceId\",\n    );\n    const capabilityHashHex = requiredPayloadString(\n      fact,\n      \"xyz.tinycloud.policy/capabilityHashHex\",\n    );\n    if (!/^[0-9a-f]{64}$/.test(capabilityHashHex)) {\n      throw new Error(\n        \"UCAN capability hash is not 64 lowercase hex characters\",\n      );\n    }\n    const revocationMode = requiredPayloadString(\n      fact,\n      \"xyz.tinycloud.policy/revocationMode\",\n    );\n    const delegationMode = requiredPayloadString(\n      fact,\n      \"xyz.tinycloud.policy/delegationMode\",\n    );\n    if (revocationMode !== \"refresh_only\")\n      throw new Error(\"unsupported UCAN revocation mode\");\n    if (delegationMode !== \"terminal\")\n      throw new Error(\"UCAN delegation is not terminal\");\n    const att = payload.att;\n    if (att === null || typeof att !== \"object\" || Array.isArray(att)) {\n      throw new Error(\"UCAN att is absent\");\n    }\n    const capabilities: PolicyCapability[] = [];\n    for (const [resource, rawAbilities] of Object.entries(att)) {\n      if (\n        rawAbilities === null ||\n        typeof rawAbilities !== \"object\" ||\n        Array.isArray(rawAbilities)\n      ) {\n        throw new Error(\"UCAN att abilities are invalid\");\n      }\n      const abilities = rawAbilities as Record<string, unknown>;\n      const marker = resource.indexOf(\"/sql/\");\n      if (!resource.startsWith(\"tinycloud:\") || marker < 0)\n        throw new Error(\"unsupported UCAN resource\");\n      const space = resource.slice(0, marker);\n      const path = resource.slice(marker + \"/sql/\".length);\n      for (const [action, rawCaveats] of Object.entries(abilities)) {\n        const service = action.startsWith(\"tinycloud.sql/\")\n          ? \"tinycloud.sql\"\n          : action.startsWith(\"tinycloud.kv/\")\n            ? \"tinycloud.kv\"\n            : undefined;\n        if (!Array.isArray(rawCaveats) || rawCaveats.length !== 1) {\n          throw new Error(\"UCAN ability must have exactly one caveat branch\");\n        }\n        const caveats = rawCaveats;\n        if (service === undefined) throw new Error(\"unsupported UCAN ability\");\n        const first = caveats[0];\n        capabilities.push(\n          normalizePolicyCapability({\n            service,\n            space,\n            path,\n            actions: [action],\n            ...(first !== null &&\n            typeof first === \"object\" &&\n            !Array.isArray(first) &&\n            Object.keys(first).length > 0\n              ? { caveats: first }\n              : {}),\n          }),\n        );\n      }\n    }\n    if (capabilities.length === 0) throw new Error(\"UCAN att is empty\");\n    const fragment = issuer.indexOf(\"#\");\n    const issuerDid = fragment < 0 ? issuer : issuer.slice(0, fragment);\n    if (!issuerDid.startsWith(\"did:\") || !holderDid.startsWith(\"did:\")) {\n      throw new Error(\"UCAN issuer or audience is not a DID\");\n    }\n    return {\n      issuerDid,\n      holderDid,\n      policyId,\n      issuanceId,\n      capabilityHashHex,\n      revocationMode,\n      issuedAtMs: issuedAt * 1000,\n      expiresAtMs: expiresAt * 1000,\n      terminal: true,\n      capabilities,\n    };\n  } catch (error) {\n    throw new TranscriptRequesterError(\n      \"requester-delegation-invalid\",\n      `node-native compact-JWS capabilities are invalid: ${error instanceof Error ? error.message : String(error)}`,\n    );\n  }\n}\n\nfunction requiredPayloadString(\n  payload: Record<string, unknown>,\n  key: string,\n): string {\n  const value = payload[key];\n  if (typeof value !== \"string\" || value.length === 0) {\n    throw new Error(`UCAN ${key} is not a non-empty string`);\n  }\n  return value;\n}\n\nfunction requiredPayloadEpoch(\n  payload: Record<string, unknown>,\n  key: string,\n): number {\n  const value = payload[key];\n  if (typeof value !== \"number\" || !Number.isSafeInteger(value) || value < 0) {\n    throw new Error(`UCAN ${key} is not a non-negative integer epoch`);\n  }\n  return value;\n}\n\nfunction base64UrlBytes(value: string): Uint8Array {\n  const normalized = value.replace(/-/g, \"+\").replace(/_/g, \"/\");\n  const padded = normalized.padEnd(Math.ceil(normalized.length / 4) * 4, \"=\");\n  const binary = atob(padded);\n  return Uint8Array.from(binary, (character) => character.charCodeAt(0));\n}\n\nfunction parseEngineSuccess<T>(\n  input: unknown,\n  schema: z.ZodType<T>,\n  label: string,\n): T {\n  const normalized = normalizeExternal(\n    input,\n    \"requester-engine-response-invalid\",\n  );\n  const denial = parseDenialBody(normalized);\n  if (denial !== undefined) {\n    throw errorForDenial(denial);\n  }\n  const parsed = schema.safeParse(normalized);\n  if (!parsed.success) {\n    throw new TranscriptRequesterError(\n      \"requester-engine-response-invalid\",\n      `${label} failed validation: ${parsed.error.message}`,\n    );\n  }\n  return parsed.data;\n}\n\nfunction parseDataResponse<T>(\n  response: RequesterHttpResponse,\n  schema: z.ZodType<T>,\n  label: string,\n): T {\n  if (response.status >= 500) {\n    throw new TranscriptRequesterError(\n      \"requester-access-unreachable\",\n      `${label} endpoint returned ${response.status}`,\n      \"unreachable\",\n    );\n  }\n  if (response.status >= 400) {\n    const normalized = normalizeExternal(\n      response.body,\n      \"requester-access-denied\",\n    );\n    const denial = parseDenialBody(normalized);\n    if (denial !== undefined) {\n      throw errorForDenial(denial, response.status);\n    }\n    throw new TranscriptRequesterError(\n      \"requester-access-denied\",\n      `${label} denied`,\n      \"denied\",\n    );\n  }\n  const normalized = normalizeExternal(\n    response.body,\n    \"requester-engine-response-invalid\",\n  );\n  const parsed = schema.safeParse(normalized);\n  if (!parsed.success) {\n    throw new TranscriptRequesterError(\n      \"requester-engine-response-invalid\",\n      `${label} response failed validation: ${parsed.error.message}`,\n    );\n  }\n  return parsed.data;\n}\n\nfunction parseDelegateReceipt(\n  response: RequesterHttpResponse,\n): z.infer<typeof DelegateReceiptSchema> {\n  if (response.status !== 200) {\n    throw new TranscriptRequesterError(\n      \"requester-delegation-import-failed\",\n      `owner node delegation import returned ${response.status}`,\n      response.status >= 500 ? \"invalid\" : \"denied\",\n      undefined,\n      response.status,\n    );\n  }\n  const normalized = normalizeExternal(\n    response.body,\n    \"requester-delegation-import-failed\",\n  );\n  const parsed = DelegateReceiptSchema.safeParse(normalized);\n  if (!parsed.success) {\n    throw new TranscriptRequesterError(\n      \"requester-delegation-import-failed\",\n      `owner node delegation receipt failed validation: ${parsed.error.message}`,\n    );\n  }\n  return parsed.data;\n}\n\nfunction parseNodeDataResponse<T>(\n  response: RequesterHttpResponse,\n  schema: z.ZodType<T>,\n  label: string,\n): T {\n  if (response.status >= 500) {\n    throw new TranscriptRequesterError(\n      \"requester-node-unreachable\",\n      `${label} node returned ${response.status}: ${nodeErrorMessage(response.body)}`,\n      \"unreachable\",\n      undefined,\n      response.status,\n    );\n  }\n  if (response.status >= 400) {\n    throw new TranscriptRequesterError(\n      \"requester-node-denied\",\n      `${label} node denied: ${nodeErrorMessage(response.body)}`,\n      \"denied\",\n      undefined,\n      response.status,\n    );\n  }\n  const normalized = normalizeExternal(\n    response.body,\n    \"requester-node-response-invalid\",\n  );\n  const parsed = schema.safeParse(normalized);\n  if (!parsed.success) {\n    throw new TranscriptRequesterError(\n      \"requester-node-response-invalid\",\n      `${label} node response failed validation: ${parsed.error.message}`,\n    );\n  }\n  return parsed.data;\n}\n\nfunction nodeErrorMessage(body: unknown): string {\n  if (typeof body === \"string\") return body;\n  if (body !== null && typeof body === \"object\") {\n    const record = body as Record<string, unknown>;\n    const code = typeof record.code === \"string\" ? record.code : undefined;\n    const message =\n      typeof record.message === \"string\" ? record.message : undefined;\n    if (code !== undefined)\n      return message === undefined ? code : `${code}: ${message}`;\n  }\n  return \"native node refusal\";\n}\n\nexport function deriveDelegationCid(encoded: string): string {\n  const digest = createDigest(0x1e, blake3(new TextEncoder().encode(encoded)));\n  return CID.createV1(0x55, digest).toString();\n}\n\nfunction headersRecord(headers: ServiceHeaders): Record<string, string> {\n  return Array.isArray(headers) ? Object.fromEntries(headers) : headers;\n}\n\nasync function validateAndResolveOwnerNode(\n  endpoint: string,\n  transport: RequesterTransport,\n): Promise<ReadonlySet<string>> {\n  return validateAndResolvePublicEndpoint(endpoint, transport, \"owner-node\");\n}\n\nasync function validateAndResolvePublicEndpoint(\n  endpoint: string,\n  transport: RequesterTransport,\n  kind: \"owner-node\" | \"policy-engine\",\n): Promise<ReadonlySet<string>> {\n  let url: URL;\n  try {\n    url = new URL(endpoint);\n  } catch {\n    throw endpointError(kind, `${kind} endpoint is not a URL`);\n  }\n  if (\n    url.protocol !== \"https:\" ||\n    url.username !== \"\" ||\n    url.password !== \"\" ||\n    url.hash !== \"\" ||\n    url.search !== \"\"\n  ) {\n    throw endpointError(\n      kind,\n      `${kind} endpoint must use HTTPS without credentials, query, or fragment`,\n    );\n  }\n  if (transport.resolveEndpoint === undefined) {\n    throw endpointError(\n      kind,\n      `${kind} endpoint resolution metadata is required`,\n    );\n  }\n  let resolution: RequesterEndpointResolution;\n  try {\n    resolution = await transport.resolveEndpoint(url.origin);\n  } catch (error) {\n    throw endpointError(\n      kind,\n      `${kind} endpoint resolution failed: ${error instanceof Error ? error.message : String(error)}`,\n    );\n  }\n  if (resolution.addresses.length === 0) {\n    throw endpointError(kind, `${kind} endpoint resolved to no addresses`);\n  }\n  const addresses = new Set<string>();\n  for (const address of resolution.addresses) {\n    const normalized = normalizeIp(address);\n    if (!isPublicIp(normalized)) {\n      throw endpointError(\n        kind,\n        `${kind} endpoint resolved to a non-public address: ${address}`,\n      );\n    }\n    addresses.add(normalized);\n  }\n  return addresses;\n}\n\nfunction endpointError(\n  kind: \"owner-node\" | \"policy-engine\",\n  message: string,\n): TranscriptRequesterError {\n  return new TranscriptRequesterError(\n    kind === \"owner-node\"\n      ? \"requester-owner-node-endpoint-invalid\"\n      : \"requester-policy-engine-endpoint-invalid\",\n    message,\n    \"bootstrap-invalid\",\n  );\n}\n\nfunction normalizeIp(value: string): string {\n  return value.toLowerCase().replace(/^\\[|\\]$/g, \"\");\n}\n\nfunction isPublicIp(value: string): boolean {\n  const ip = normalizeIp(value);\n  const parts = ip.split(\".\");\n  if (\n    parts.length === 4 &&\n    parts.every((part) => /^\\d+$/.test(part) && Number(part) <= 255)\n  ) {\n    const [a, b] = parts.map(Number) as [number, number, number, number];\n    return !(\n      a === 0 ||\n      a === 10 ||\n      a === 127 ||\n      (a === 100 && b >= 64 && b <= 127) ||\n      (a === 169 && b === 254) ||\n      (a === 172 && b >= 16 && b <= 31) ||\n      (a === 192 && b === 0) ||\n      (a === 192 && b === 168) ||\n      (a === 198 && (b === 18 || b === 19)) ||\n      (a === 198 && b === 51 && parts[2] === \"100\") ||\n      (a === 203 && b === 0 && parts[2] === \"113\") ||\n      a >= 224\n    );\n  }\n  if (!ip.includes(\":\")) return false;\n  if (\n    ip === \"::\" ||\n    ip === \"::1\" ||\n    ip.startsWith(\"2001:db8:\") ||\n    ip.startsWith(\"fe8\") ||\n    ip.startsWith(\"fe9\") ||\n    ip.startsWith(\"fea\") ||\n    ip.startsWith(\"feb\") ||\n    ip.startsWith(\"fc\") ||\n    ip.startsWith(\"fd\") ||\n    ip.startsWith(\"ff\")\n  )\n    return false;\n  const mapped = ip.match(/^::ffff:(\\d+\\.\\d+\\.\\d+\\.\\d+)$/);\n  if (mapped !== null) return isPublicIp(mapped[1]!);\n  const mappedHex = ip.match(/^::ffff:([0-9a-f]{1,4}):([0-9a-f]{1,4})$/);\n  if (mappedHex !== null) {\n    const high = Number.parseInt(mappedHex[1]!, 16);\n    const low = Number.parseInt(mappedHex[2]!, 16);\n    return isPublicIp(`${high >> 8}.${high & 255}.${low >> 8}.${low & 255}`);\n  }\n  return true;\n}\n\nfunction parseDenialBody(\n  input: unknown,\n):\n  | { code: PolicyEngineGrantPresentationDenialCode; message?: string }\n  | undefined {\n  const normalized = normalizeExternal(\n    input,\n    \"requester-engine-response-invalid\",\n  );\n  const direct = DenialSchema.safeParse(normalized);\n  if (direct.success) {\n    return { code: direct.data.code, message: direct.data.message };\n  }\n  const envelope = ErrorEnvelopeDenialSchema.safeParse(normalized);\n  if (envelope.success) {\n    return {\n      code: envelope.data.error.code,\n      message: envelope.data.error.message,\n    };\n  }\n  return undefined;\n}\n\nfunction errorForDenial(\n  denial: { code: PolicyEngineGrantPresentationDenialCode; message?: string },\n  status?: number,\n): TranscriptRequesterError {\n  const accessEnded =\n    denial.code === \"policy-inactive\" ||\n    denial.code === \"policy-revoked\" ||\n    denial.code === \"policy-expired\";\n  return new TranscriptRequesterError(\n    `policy-engine-denied-${denial.code}`,\n    denial.message ?? `policy engine denied ${denial.code}`,\n    accessEnded ? \"access-ended\" : \"denied\",\n    denial.code,\n    status,\n  );\n}\n\nfunction retryDelay(attempt: number, random: number): number {\n  const base = Math.min(REQUESTER_ENGINE_RETRY_MAX_DELAY_MS, 50 * 2 ** attempt);\n  return Math.min(\n    REQUESTER_ENGINE_RETRY_MAX_DELAY_MS,\n    Math.floor(base * (0.5 + random)),\n  );\n}\n\nfunction trimTrailingSlash(value: string): string {\n  return value.endsWith(\"/\") ? value.slice(0, -1) : value;\n}\n\nfunction normalizeExternal(\n  input: unknown,\n  code: TranscriptRequesterErrorCode,\n): unknown {\n  try {\n    return normalizeJson(input);\n  } catch (error) {\n    throw new TranscriptRequesterError(\n      code,\n      error instanceof Error ? error.message : String(error),\n    );\n  }\n}\n\nfunction parseStrictRfc3339(value: string): number | undefined {\n  if (\n    !/^(\\d{4})-(\\d{2})-(\\d{2})T(\\d{2}):(\\d{2}):(\\d{2})(\\.\\d+)?(Z|[+-]\\d{2}:\\d{2})$/.test(\n      value,\n    )\n  ) {\n    return undefined;\n  }\n  const parsed = Date.parse(value);\n  if (Number.isNaN(parsed)) {\n    return undefined;\n  }\n  const canonical = new Date(parsed).toISOString().replace(\".000Z\", \"Z\");\n  const reparsed = Date.parse(value);\n  return Date.parse(canonical) === reparsed ? parsed : undefined;\n}\n","export type SignedObjectErrorCode =\n  | \"schema-invalid\"\n  | \"canonicalization-mismatch\"\n  | \"digest-mismatch\"\n  | \"id-mismatch\"\n  | \"signing-key-binding\"\n  | \"signature-material-invalid\"\n  | \"signature-suite-unsupported\"\n  | \"signature-invalid\";\n\nexport class SignedObjectProfileError extends Error {\n  public readonly code: SignedObjectErrorCode;\n\n  constructor(code: SignedObjectErrorCode, message: string) {\n    super(message);\n    this.name = \"SignedObjectProfileError\";\n    this.code = code;\n  }\n}\n\nexport class SignedObjectSchemaError extends SignedObjectProfileError {\n  constructor(message: string) {\n    super(\"schema-invalid\", message);\n    this.name = \"SignedObjectSchemaError\";\n  }\n}\n\nexport class SignedObjectCanonicalizationError extends SignedObjectProfileError {\n  constructor(message: string) {\n    super(\"canonicalization-mismatch\", message);\n    this.name = \"SignedObjectCanonicalizationError\";\n  }\n}\n\nexport class SignedObjectDigestError extends SignedObjectProfileError {\n  constructor(message: string) {\n    super(\"digest-mismatch\", message);\n    this.name = \"SignedObjectDigestError\";\n  }\n}\n\nexport class SignedObjectIdError extends SignedObjectProfileError {\n  constructor(message: string) {\n    super(\"id-mismatch\", message);\n    this.name = \"SignedObjectIdError\";\n  }\n}\n\nexport class SigningKeyBindingError extends SignedObjectProfileError {\n  constructor(message: string) {\n    super(\"signing-key-binding\", message);\n    this.name = \"SigningKeyBindingError\";\n  }\n}\n\nexport class SignatureMaterialError extends SignedObjectProfileError {\n  constructor(message: string) {\n    super(\"signature-material-invalid\", message);\n    this.name = \"SignatureMaterialError\";\n  }\n}\n\nexport class UnsupportedSignatureSuiteError extends SignedObjectProfileError {\n  constructor(message: string) {\n    super(\"signature-suite-unsupported\", message);\n    this.name = \"UnsupportedSignatureSuiteError\";\n  }\n}\n\nexport class SignatureVerificationError extends SignedObjectProfileError {\n  constructor(message: string) {\n    super(\"signature-invalid\", message);\n    this.name = \"SignatureVerificationError\";\n  }\n}\n\nexport function toSignedObjectError(error: unknown): SignedObjectProfileError {\n  if (error instanceof SignedObjectProfileError) {\n    return error;\n  }\n  return new SignedObjectProfileError(\n    \"schema-invalid\",\n    error instanceof Error ? error.message : String(error),\n  );\n}\n","import { SignedObjectCanonicalizationError } from \"./errors\";\n\nexport type JsonValue =\n  | null\n  | boolean\n  | number\n  | string\n  | JsonValue[]\n  | { readonly [key: string]: JsonValue };\n\ntype MutableJsonObject = { [key: string]: JsonValue };\nconst objectHasOwn: (object: object, propertyKey: PropertyKey) => boolean =\n  (Object as ObjectConstructor & {\n    hasOwn?: (object: object, propertyKey: PropertyKey) => boolean;\n  }).hasOwn ??\n  (Object.prototype.hasOwnProperty.call.bind(\n    Object.prototype.hasOwnProperty,\n  ) as (object: object, propertyKey: PropertyKey) => boolean);\n\n/**\n * RFC 8785 JSON Canonicalization Scheme encoder for the signed-object profile.\n *\n * This local encoder is intentionally stricter than JSON.stringify:\n * it rejects non-plain JSON inputs, sparse arrays, undefined/functions/symbols,\n * non-finite numbers, BigInt, dangerous prototype keys, and lone surrogates.\n * Object keys are sorted by Unicode code point before serialization.\n */\nexport function jcsCanonicalize(input: unknown): string {\n  return serialize(normalizeJson(input, \"$\"));\n}\n\nexport function normalizeJson(input: unknown, path = \"$\"): JsonValue {\n  if (input === null) {\n    return null;\n  }\n\n  switch (typeof input) {\n    case \"boolean\":\n      return input;\n    case \"number\":\n      if (!Number.isFinite(input)) {\n        throw new SignedObjectCanonicalizationError(\n          `${path} must be a finite JSON number`,\n        );\n      }\n      return input;\n    case \"string\":\n      assertUnicodeScalarString(input, path);\n      return input;\n    case \"object\":\n      return normalizeJsonObjectOrArray(input, path);\n    case \"bigint\":\n    case \"function\":\n    case \"symbol\":\n    case \"undefined\":\n    default:\n      throw new SignedObjectCanonicalizationError(\n        `${path} is not a JSON value`,\n      );\n  }\n}\n\nexport function serialize(value: JsonValue): string {\n  if (value === null) {\n    return \"null\";\n  }\n\n  switch (typeof value) {\n    case \"boolean\":\n      return value ? \"true\" : \"false\";\n    case \"number\": {\n      const encoded = JSON.stringify(value);\n      if (encoded === undefined) {\n        throw new SignedObjectCanonicalizationError(\n          \"number could not be serialized as JSON\",\n        );\n      }\n      return encoded;\n    }\n    case \"string\":\n      return JSON.stringify(value);\n    case \"object\":\n      if (Array.isArray(value)) {\n        return `[${value.map((item) => serialize(item)).join(\",\")}]`;\n      }\n      return serializeObject(value);\n    default:\n      throw new SignedObjectCanonicalizationError(\n        `unsupported JSON value type ${typeof value}`,\n      );\n  }\n}\n\nfunction normalizeJsonObjectOrArray(input: object, path: string): JsonValue {\n  assertNoSymbolKeys(input, path);\n\n  if (Array.isArray(input)) {\n    for (const key of Object.getOwnPropertyNames(input)) {\n      if (key === \"length\") {\n        continue;\n      }\n      if (!isArrayIndexKey(key, input.length)) {\n        throw new SignedObjectCanonicalizationError(\n          `${path}.${key} is not allowed on a JSON array`,\n        );\n      }\n      const descriptor = Object.getOwnPropertyDescriptor(input, key);\n      if (descriptor?.enumerable !== true) {\n        throw new SignedObjectCanonicalizationError(\n          `${path}[${key}] must be an enumerable JSON array item`,\n        );\n      }\n      if (!(\"value\" in descriptor)) {\n        throw new SignedObjectCanonicalizationError(\n          `${path}[${key}] must be a JSON data property`,\n        );\n      }\n    }\n    const output: JsonValue[] = [];\n    for (let index = 0; index < input.length; index++) {\n      if (!objectHasOwn(input, index)) {\n        throw new SignedObjectCanonicalizationError(\n          `${path}[${index}] must not be a sparse array hole`,\n        );\n      }\n      output.push(normalizeJson(input[index], `${path}[${index}]`));\n    }\n    return output;\n  }\n\n  const proto = Object.getPrototypeOf(input);\n  if (proto !== Object.prototype && proto !== null) {\n    throw new SignedObjectCanonicalizationError(\n      `${path} must be a plain JSON object`,\n    );\n  }\n\n  const output = Object.create(null) as MutableJsonObject;\n  for (const key of Object.getOwnPropertyNames(input)) {\n    assertUnicodeScalarString(key, `${path} key`);\n    if (key === \"__proto__\" || key === \"constructor\") {\n      throw new SignedObjectCanonicalizationError(\n        `${path}.${key} is not allowed`,\n      );\n    }\n    const descriptor = Object.getOwnPropertyDescriptor(input, key);\n    if (descriptor?.enumerable !== true) {\n      throw new SignedObjectCanonicalizationError(\n        `${path}.${key} must be an enumerable JSON object property`,\n      );\n    }\n    if (!(\"value\" in descriptor)) {\n      throw new SignedObjectCanonicalizationError(\n        `${path}.${key} must be a JSON data property`,\n      );\n    }\n    const value = descriptor.value;\n    output[key] = normalizeJson(value, `${path}.${key}`);\n  }\n  return output;\n}\n\nfunction assertNoSymbolKeys(input: object, path: string): void {\n  if (Object.getOwnPropertySymbols(input).length > 0) {\n    throw new SignedObjectCanonicalizationError(\n      `${path} must not have symbol properties`,\n    );\n  }\n}\n\nfunction isArrayIndexKey(key: string, length: number): boolean {\n  if (!/^(0|[1-9]\\d*)$/.test(key)) {\n    return false;\n  }\n  const index = Number(key);\n  return Number.isSafeInteger(index) && index >= 0 && index < length;\n}\n\nfunction serializeObject(value: { readonly [key: string]: JsonValue }): string {\n  const keys = Object.keys(value).sort(compareCodePoints);\n  const parts = keys.map((key) => `${JSON.stringify(key)}:${serialize(value[key])}`);\n  return `{${parts.join(\",\")}}`;\n}\n\nfunction compareCodePoints(a: string, b: string): number {\n  const left = Array.from(a);\n  const right = Array.from(b);\n  const max = Math.min(left.length, right.length);\n  for (let index = 0; index < max; index++) {\n    const leftPoint = left[index].codePointAt(0) ?? 0;\n    const rightPoint = right[index].codePointAt(0) ?? 0;\n    if (leftPoint !== rightPoint) {\n      return leftPoint - rightPoint;\n    }\n  }\n  return left.length - right.length;\n}\n\nfunction assertUnicodeScalarString(value: string, path: string): void {\n  for (let index = 0; index < value.length; index++) {\n    const code = value.charCodeAt(index);\n    if (code >= 0xd800 && code <= 0xdbff) {\n      const next = value.charCodeAt(index + 1);\n      if (Number.isNaN(next) || next < 0xdc00 || next > 0xdfff) {\n        throw new SignedObjectCanonicalizationError(\n          `${path} contains a lone high surrogate`,\n        );\n      }\n      index++;\n      continue;\n    }\n    if (code >= 0xdc00 && code <= 0xdfff) {\n      throw new SignedObjectCanonicalizationError(\n        `${path} contains a lone low surrogate`,\n      );\n    }\n  }\n}\n","import { CAPABILITY_REGISTRY } from \"@tinycloud/bootstrap\";\nimport { bytesToHex, sha256 } from \"viem\";\nimport { jcsCanonicalize, normalizeJson, type JsonValue } from \"./jcs\";\n\nconst POLICY_CAPABILITY_DOMAIN = \"xyz.tinycloud.policy/PolicyCapability/v0\";\nconst textEncoder = new TextEncoder();\n\nexport type PolicyCapabilityErrorCode =\n  | \"policy-capability-malformed\"\n  | \"policy-capability-unknown-key\"\n  | \"policy-capability-malformed-service\"\n  | \"policy-capability-malformed-space\"\n  | \"policy-capability-malformed-path\"\n  | \"policy-capability-malformed-action\"\n  | \"policy-capability-empty-actions\"\n  | \"policy-capability-malformed-caveats\";\n\nexport class PolicyCapabilityError extends Error {\n  public readonly code: PolicyCapabilityErrorCode;\n\n  constructor(code: PolicyCapabilityErrorCode, message: string) {\n    super(message);\n    this.name = \"PolicyCapabilityError\";\n    this.code = code;\n  }\n}\n\nexport interface PolicyCapability {\n  readonly service: \"tinycloud.kv\" | \"tinycloud.sql\" | \"tinycloud.vfs\";\n  readonly space: string;\n  readonly path: string;\n  readonly actions: readonly string[];\n  readonly caveats?: JsonObject;\n}\n\nexport type JsonObject = { readonly [key: string]: JsonValue };\n\ninterface NormalizeOptions {\n  readonly allowPrefixPaths?: boolean;\n  readonly requireCanonical?: boolean;\n}\n\nconst objectHasOwn: (object: object, propertyKey: PropertyKey) => boolean =\n  (Object as ObjectConstructor & {\n    hasOwn?: (object: object, propertyKey: PropertyKey) => boolean;\n  }).hasOwn ??\n  (Object.prototype.hasOwnProperty.call.bind(\n    Object.prototype.hasOwnProperty,\n  ) as (object: object, propertyKey: PropertyKey) => boolean);\n\nconst CEILING_SERVICES = new Set([\"tinycloud.kv\", \"tinycloud.sql\", \"tinycloud.vfs\"]);\nconst GRANTABLE_ACTIONS = new Map<string, ReadonlySet<string>>();\n\nfor (const entry of CAPABILITY_REGISTRY) {\n  if (!CEILING_SERVICES.has(entry.service)) {\n    continue;\n  }\n  if (entry.aliasOf !== undefined || entry.implies !== undefined || entry.urn.endsWith(\"/*\")) {\n    continue;\n  }\n  const existing = GRANTABLE_ACTIONS.get(entry.service);\n  if (existing === undefined) {\n    GRANTABLE_ACTIONS.set(entry.service, new Set([entry.urn]));\n    continue;\n  }\n  (existing as Set<string>).add(entry.urn);\n}\n\n/**\n * Strict authoring validator for resolved Listen-adapter PolicyCapability JSON.\n * It accepts only concrete service/space/path/action/caveat forms and rejects\n * manifest-shaped permission payloads before any Policy is signed.\n */\nexport function normalizePolicyCapability(input: unknown): PolicyCapability {\n  return normalizePolicyCapabilityWithOptions(input, { requireCanonical: true });\n}\n\n/**\n * Frozen-vector canonicalizer for the m1-b-01a policy-capability vectors.\n * Prefix paths are allowed here only to preserve behavioral conformance with\n * the vendored engine vectors; authoring uses normalizePolicyCapability.\n */\nexport function canonicalizePolicyCapability(input: unknown): PolicyCapability {\n  return normalizePolicyCapabilityWithOptions(input, { allowPrefixPaths: true });\n}\n\nexport function policyCapabilityDigestHex(input: unknown): string {\n  const canonical = canonicalizePolicyCapability(input);\n  const jcs = textEncoder.encode(jcsCanonicalize(canonical));\n  const domain = textEncoder.encode(`${POLICY_CAPABILITY_DOMAIN}\\0`);\n  const bytes = new Uint8Array(domain.length + jcs.length);\n  bytes.set(domain, 0);\n  bytes.set(jcs, domain.length);\n  return bytesToHex(sha256(bytes, \"bytes\")).slice(2);\n}\n\nexport function policyCapabilityContains(authority: unknown, request: unknown): boolean {\n  let auth: PolicyCapability;\n  let req: PolicyCapability;\n  try {\n    auth = canonicalizePolicyCapability(authority);\n    req = canonicalizePolicyCapability(request);\n  } catch {\n    return false;\n  }\n  if (auth.service !== req.service || auth.space !== req.space) {\n    return false;\n  }\n  if (!pathContains(auth.path, req.path)) {\n    return false;\n  }\n  const authActions = new Set(auth.actions);\n  for (const action of req.actions) {\n    if (!authActions.has(action)) {\n      return false;\n    }\n  }\n  return caveatsContain(auth.caveats, req.caveats);\n}\n\nfunction normalizePolicyCapabilityWithOptions(\n  input: unknown,\n  options: NormalizeOptions,\n): PolicyCapability {\n  const object = expectObject(input, \"$\");\n  assertExactKeys(object, [\"service\", \"space\", \"path\", \"actions\", \"caveats\"], \"$\");\n  const service = requiredString(object, \"service\", \"$\", \"policy-capability-malformed-service\");\n  if (!CEILING_SERVICES.has(service)) {\n    throw new PolicyCapabilityError(\n      \"policy-capability-malformed-service\",\n      \"$.service is outside the frozen permissionsCeiling vocabulary\",\n    );\n  }\n  const space = requiredString(object, \"space\", \"$\", \"policy-capability-malformed-space\");\n  validateConcreteSpace(space);\n  const canonicalSpace = space.normalize(\"NFC\");\n  if (options.requireCanonical && canonicalSpace !== space) {\n    throw new PolicyCapabilityError(\n      \"policy-capability-malformed-space\",\n      \"$.space must already be canonical NFC\",\n    );\n  }\n  const rawPath = requiredString(object, \"path\", \"$\", \"policy-capability-malformed-path\");\n  validateRawPath(rawPath, options);\n  const path = normalizePath(rawPath);\n  if (options.requireCanonical && path !== rawPath) {\n    throw new PolicyCapabilityError(\n      \"policy-capability-malformed-path\",\n      \"$.path must already be canonical\",\n    );\n  }\n  validateRawPath(path, options);\n  const actions = normalizeActions(\n    requiredArray(object, \"actions\", \"$\", \"policy-capability-malformed-action\"),\n    service,\n    options,\n  );\n  const output = Object.create(null) as {\n    service: PolicyCapability[\"service\"];\n    space: string;\n    path: string;\n    actions: string[];\n    caveats?: JsonObject;\n  };\n  output.service = service as PolicyCapability[\"service\"];\n  output.space = canonicalSpace;\n  output.path = path;\n  output.actions = actions;\n  if (hasOwn(object, \"caveats\")) {\n    output.caveats = validateCaveats(\n      requiredValue(object, \"caveats\", \"$\", \"policy-capability-malformed-caveats\"),\n      output.service,\n    );\n  }\n  return output;\n}\n\nfunction expectObject(input: unknown, path: string): JsonObject {\n  try {\n    const normalized = normalizeJson(input);\n    if (normalized === null || typeof normalized !== \"object\" || Array.isArray(normalized)) {\n      throw new PolicyCapabilityError(\"policy-capability-malformed\", `${path} must be an object`);\n    }\n    return normalized as JsonObject;\n  } catch (error) {\n    if (error instanceof PolicyCapabilityError) {\n      throw error;\n    }\n    throw new PolicyCapabilityError(\n      \"policy-capability-malformed\",\n      error instanceof Error ? error.message : String(error),\n    );\n  }\n}\n\nfunction assertExactKeys(object: JsonObject, allowed: readonly string[], path: string): void {\n  const allowedSet = new Set(allowed);\n  for (const key of Object.keys(object)) {\n    if (!allowedSet.has(key)) {\n      throw new PolicyCapabilityError(\n        key === \"id\" || key === \"scope\" ? \"policy-capability-malformed\" : \"policy-capability-unknown-key\",\n        `${path} has unknown field ${key}`,\n      );\n    }\n  }\n}\n\nfunction requiredValue(\n  object: JsonObject,\n  key: string,\n  path: string,\n  code: PolicyCapabilityErrorCode,\n): JsonValue {\n  if (!hasOwn(object, key)) {\n    throw new PolicyCapabilityError(code, `${path}.${key} is required`);\n  }\n  return object[key];\n}\n\nfunction requiredString(\n  object: JsonObject,\n  key: string,\n  path: string,\n  code: PolicyCapabilityErrorCode,\n): string {\n  const value = requiredValue(object, key, path, code);\n  if (typeof value !== \"string\" || value.length === 0) {\n    throw new PolicyCapabilityError(code, `${path}.${key} must be a non-empty string`);\n  }\n  return value;\n}\n\nfunction requiredArray(\n  object: JsonObject,\n  key: string,\n  path: string,\n  code: PolicyCapabilityErrorCode,\n): readonly JsonValue[] {\n  const value = requiredValue(object, key, path, code);\n  if (!Array.isArray(value)) {\n    throw new PolicyCapabilityError(code, `${path}.${key} must be an array`);\n  }\n  return value;\n}\n\nfunction validateConcreteSpace(space: string): void {\n  if (space === \"*\" || space.includes(\"*\") || space.includes(\"?\") || space.includes(\"/\")) {\n    throw new PolicyCapabilityError(\n      \"policy-capability-malformed-space\",\n      \"$.space must be concrete\",\n    );\n  }\n}\n\nfunction validateRawPath(path: string, options: NormalizeOptions): void {\n  if (path.length === 0) {\n    throw new PolicyCapabilityError(\"policy-capability-malformed-path\", \"$.path is empty\");\n  }\n  if (!options.allowPrefixPaths && path.endsWith(\"/\")) {\n    throw new PolicyCapabilityError(\n      \"policy-capability-malformed-path\",\n      \"$.path must be an exact concrete path, not a prefix\",\n    );\n  }\n  if (path.endsWith(\"/*\") || path.includes(\"**\")) {\n    throw new PolicyCapabilityError(\"policy-capability-malformed-path\", \"$.path is a prefix form\");\n  }\n  const segments = path.split(\"/\");\n  for (let index = 0; index < segments.length; index++) {\n    const segment = segments[index]!;\n    const isTrailingPrefixSegment =\n      options.allowPrefixPaths && index === segments.length - 1 && segment.length === 0;\n    if (segment.length === 0 && !isTrailingPrefixSegment) {\n      throw new PolicyCapabilityError(\"policy-capability-malformed-path\", \"$.path has an empty segment\");\n    }\n    if (segment === \".\" || segment === \"..\") {\n      throw new PolicyCapabilityError(\n        \"policy-capability-malformed-path\",\n        \"$.path has a traversal segment\",\n      );\n    }\n    if (segment === \"*\" || segment === \"?\" || segment.includes(\"*\") || segment.includes(\"?\")) {\n      throw new PolicyCapabilityError(\n        \"policy-capability-malformed-path\",\n        \"$.path has a wildcard segment\",\n      );\n    }\n  }\n}\n\nfunction normalizePath(path: string): string {\n  return decodeUnreserved(path).normalize(\"NFC\");\n}\n\nfunction decodeUnreserved(path: string): string {\n  return path.replace(/%[0-9A-Fa-f]{2}/g, (encoded) => {\n    const char = String.fromCharCode(Number.parseInt(encoded.slice(1), 16));\n    return /^[A-Za-z0-9._~-]$/.test(char) ? char : encoded.toUpperCase();\n  });\n}\n\nfunction normalizeActions(\n  actions: readonly JsonValue[],\n  service: string,\n  options: NormalizeOptions,\n): string[] {\n  const accepted = GRANTABLE_ACTIONS.get(service);\n  if (accepted === undefined) {\n    throw new PolicyCapabilityError(\n      \"policy-capability-malformed-service\",\n      \"$.service is unsupported\",\n    );\n  }\n  const unique = new Set<string>();\n  const rawActions: string[] = [];\n  for (let index = 0; index < actions.length; index++) {\n    const action = actions[index];\n    if (typeof action !== \"string\" || action.length === 0) {\n      throw new PolicyCapabilityError(\n        \"policy-capability-malformed-action\",\n        `$.actions[${index}] must be a non-empty action URN`,\n      );\n    }\n    if (!action.startsWith(`${service}/`) || action.includes(\"*\") || !accepted.has(action)) {\n      throw new PolicyCapabilityError(\n        \"policy-capability-malformed-action\",\n        `$.actions[${index}] is not a grantable action URN`,\n      );\n    }\n    rawActions.push(action);\n    unique.add(action);\n  }\n  if (unique.size === 0) {\n    throw new PolicyCapabilityError(\n      \"policy-capability-empty-actions\",\n      \"$.actions must not be empty\",\n    );\n  }\n  const normalizedActions = [...unique].sort();\n  if (\n    options.requireCanonical &&\n    (rawActions.length !== normalizedActions.length ||\n      rawActions.some((action, index) => action !== normalizedActions[index]))\n  ) {\n    throw new PolicyCapabilityError(\n      \"policy-capability-malformed-action\",\n      \"$.actions must already be sorted, deduplicated canonical action URNs\",\n    );\n  }\n  return normalizedActions;\n}\n\nfunction validateCaveats(input: JsonValue, service: PolicyCapability[\"service\"]): JsonObject {\n  if (input === null || typeof input !== \"object\" || Array.isArray(input)) {\n    throw new PolicyCapabilityError(\n      \"policy-capability-malformed-caveats\",\n      \"$.caveats must be an object\",\n    );\n  }\n  if (service === \"tinycloud.sql\") {\n    return validateSqlCaveats(input as JsonObject);\n  }\n  throw new PolicyCapabilityError(\n    \"policy-capability-malformed-caveats\",\n    \"$.caveats are not defined for this service\",\n  );\n}\n\nfunction validateSqlCaveats(input: JsonObject): JsonObject {\n  assertCaveatKeys(input, [\"mode\", \"readOnly\", \"statements\"], \"$.caveats\");\n  const mode = caveatString(input, \"mode\", \"$.caveats\");\n  if (mode !== \"constrained-statements\") {\n    throw new PolicyCapabilityError(\n      \"policy-capability-malformed-caveats\",\n      \"$.caveats.mode is unsupported\",\n    );\n  }\n  if (requiredCaveat(input, \"readOnly\", \"$.caveats\") !== true) {\n    throw new PolicyCapabilityError(\n      \"policy-capability-malformed-caveats\",\n      \"$.caveats.readOnly must be true\",\n    );\n  }\n  const statements = requiredCaveat(input, \"statements\", \"$.caveats\");\n  if (!Array.isArray(statements) || statements.length === 0) {\n    throw new PolicyCapabilityError(\n      \"policy-capability-malformed-caveats\",\n      \"$.caveats.statements must be a non-empty array\",\n    );\n  }\n  for (let index = 0; index < statements.length; index++) {\n    validateSqlStatement(statements[index], `$.caveats.statements[${index}]`);\n  }\n  return input;\n}\n\nfunction validateSqlStatement(input: JsonValue, path: string): void {\n  if (input === null || typeof input !== \"object\" || Array.isArray(input)) {\n    throw new PolicyCapabilityError(\"policy-capability-malformed-caveats\", `${path} must be an object`);\n  }\n  const object = input as JsonObject;\n  assertCaveatKeys(object, [\"name\", \"sql\", \"fixedParams\"], path);\n  caveatString(object, \"name\", path);\n  caveatString(object, \"sql\", path);\n  const fixedParams = requiredCaveat(object, \"fixedParams\", path);\n  if (!Array.isArray(fixedParams)) {\n    throw new PolicyCapabilityError(\n      \"policy-capability-malformed-caveats\",\n      `${path}.fixedParams must be an array`,\n    );\n  }\n  for (let index = 0; index < fixedParams.length; index++) {\n    validateFixedParam(fixedParams[index], `${path}.fixedParams[${index}]`);\n  }\n}\n\nfunction validateFixedParam(input: JsonValue, path: string): void {\n  if (input === null || typeof input !== \"object\" || Array.isArray(input)) {\n    throw new PolicyCapabilityError(\"policy-capability-malformed-caveats\", `${path} must be an object`);\n  }\n  const object = input as JsonObject;\n  assertCaveatKeys(object, [\"index\", \"value\"], path);\n  const index = requiredCaveat(object, \"index\", path);\n  if (typeof index !== \"number\" || !Number.isSafeInteger(index) || index < 0) {\n    throw new PolicyCapabilityError(\n      \"policy-capability-malformed-caveats\",\n      `${path}.index must be a non-negative integer`,\n    );\n  }\n  requiredCaveat(object, \"value\", path);\n}\n\nfunction assertCaveatKeys(object: JsonObject, allowed: readonly string[], path: string): void {\n  const allowedSet = new Set(allowed);\n  for (const key of Object.keys(object)) {\n    if (!allowedSet.has(key)) {\n      throw new PolicyCapabilityError(\n        \"policy-capability-malformed-caveats\",\n        `${path} has unknown field ${key}`,\n      );\n    }\n  }\n}\n\nfunction requiredCaveat(object: JsonObject, key: string, path: string): JsonValue {\n  if (!hasOwn(object, key)) {\n    throw new PolicyCapabilityError(\n      \"policy-capability-malformed-caveats\",\n      `${path}.${key} is required`,\n    );\n  }\n  return object[key];\n}\n\nfunction caveatString(object: JsonObject, key: string, path: string): string {\n  const value = requiredCaveat(object, key, path);\n  if (typeof value !== \"string\" || value.length === 0) {\n    throw new PolicyCapabilityError(\n      \"policy-capability-malformed-caveats\",\n      `${path}.${key} must be a non-empty string`,\n    );\n  }\n  return value;\n}\n\nfunction pathContains(authority: string, request: string): boolean {\n  if (authority === request) {\n    return true;\n  }\n  return authority.endsWith(\"/\") && request.startsWith(authority);\n}\n\nfunction caveatsContain(authority: JsonObject | undefined, request: JsonObject | undefined): boolean {\n  if (authority === undefined) {\n    return request === undefined;\n  }\n  if (request === undefined) {\n    return Object.keys(authority).length === 0;\n  }\n  if (authority.mode !== \"constrained-statements\" || request.mode !== \"constrained-statements\") {\n    return false;\n  }\n  const authorityStatements = Array.isArray(authority.statements) ? authority.statements : [];\n  const requestStatements = Array.isArray(request.statements) ? request.statements : [];\n  return requestStatements.every((statement) =>\n    authorityStatements.some((candidate) => jcsCanonicalize(candidate) === jcsCanonicalize(statement)),\n  );\n}\n\nfunction hasOwn(object: JsonObject, key: string): boolean {\n  return objectHasOwn(object, key);\n}\n","import { ed25519 } from \"@noble/curves/ed25519\";\nimport { bases } from \"multiformats/basics\";\nimport { bytesToHex, sha256, verifyMessage } from \"viem\";\nimport { parsePkhDid } from \"../identity\";\nimport { canonicalizePolicyCapability, normalizePolicyCapability } from \"./capability\";\nimport {\n  SignatureMaterialError,\n  SignatureVerificationError,\n  SignedObjectDigestError,\n  SignedObjectIdError,\n  SignedObjectProfileError,\n  SignedObjectSchemaError,\n  SigningKeyBindingError,\n  UnsupportedSignatureSuiteError,\n  toSignedObjectError,\n} from \"./errors\";\nimport { type JsonValue, jcsCanonicalize, normalizeJson } from \"./jcs\";\n\nexport const POLICY_SCHEMA = \"xyz.tinycloud.policy/policy/v0\";\nexport const POLICY_STATUS_SCHEMA = \"xyz.tinycloud.policy/status/v0\";\nexport const POLICY_ENGINE_RECORD_SCHEMA =\n  \"xyz.tinycloud.policy/engine-record/v0\";\n\nexport const ED25519_JCS_SIGNATURE_SUITE = \"eddsa-ed25519-sha256-jcs-v1\";\nexport const EIP191_JCS_SIGNATURE_SUITE =\n  \"eip191-secp256k1-sha256-jcs-v1\";\n\nexport type SignedObjectKind = \"Policy\" | \"PolicyStatus\" | \"PolicyEngineRecord\";\n\nexport type SignatureSuite =\n  | typeof ED25519_JCS_SIGNATURE_SUITE\n  | typeof EIP191_JCS_SIGNATURE_SUITE;\n\nexport interface SignedObjectSignature {\n  suite: SignatureSuite;\n  signerDid: string;\n  value: string;\n}\n\nexport type JsonObject = { readonly [key: string]: JsonValue };\n\nexport interface Policy {\n  readonly schema: typeof POLICY_SCHEMA;\n  readonly policyId: string;\n  readonly ownerDid: string;\n  readonly signingKeyDid: string;\n  readonly createdAt: string;\n  readonly expiresAt?: string;\n  readonly resource: JsonObject;\n  readonly when: JsonObject;\n  readonly grant: JsonObject;\n  readonly disclosure?: JsonObject;\n  readonly audit?: JsonObject;\n  readonly signature: SignedObjectSignature;\n}\n\nexport type UnsignedPolicy = Omit<Policy, \"policyId\" | \"signature\">;\n\nexport interface PolicyStatus {\n  readonly schema: typeof POLICY_STATUS_SCHEMA;\n  readonly statusId: string;\n  readonly policyId: string;\n  readonly ownerDid: string;\n  readonly sequence: number;\n  readonly disposition: \"active\" | \"suspended\" | \"revoked\";\n  readonly effectiveAt: string;\n  readonly reasonCode?: string;\n  readonly signingKeyDid: string;\n  readonly signature: SignedObjectSignature;\n}\n\nexport type UnsignedPolicyStatus = Omit<PolicyStatus, \"statusId\" | \"signature\">;\n\nexport interface PolicyEngineRecord {\n  readonly schema: typeof POLICY_ENGINE_RECORD_SCHEMA;\n  readonly engineRecordId: string;\n  readonly ownerDid: string;\n  readonly endpoint: string;\n  readonly audience: string;\n  readonly supportedPolicyVersions: string[];\n  readonly supportedEvidenceVerifiers: string[];\n  readonly grantIssuerDid: string;\n  readonly expiresAt: string;\n  readonly signature: SignedObjectSignature;\n}\n\nexport type UnsignedPolicyEngineRecord = Omit<\n  PolicyEngineRecord,\n  \"engineRecordId\" | \"signature\"\n>;\n\nexport type SignedPolicyObject =\n  | Policy\n  | PolicyStatus\n  | PolicyEngineRecord;\n\nexport type UnsignedPolicyObject =\n  | UnsignedPolicy\n  | UnsignedPolicyStatus\n  | UnsignedPolicyEngineRecord;\n\nexport interface SignedObjectSigner {\n  readonly suite: SignatureSuite;\n  readonly signerDid: string;\n  signDigest(digest: Uint8Array): Promise<Uint8Array | string> | Uint8Array | string;\n}\n\nexport interface SignedObjectMaterial {\n  readonly kind: SignedObjectKind;\n  readonly idField: string;\n  readonly id: string;\n  readonly domain: string;\n  readonly unsigned: JsonObject;\n  readonly jcs: string;\n  readonly jcsBytes: Uint8Array;\n  readonly digest: Uint8Array;\n  readonly digestHex: string;\n}\n\nexport type SignedObjectVerificationResult<T extends SignedPolicyObject> =\n  | { readonly ok: true; readonly object: T; readonly material: SignedObjectMaterial }\n  | { readonly ok: false; readonly error: SignedObjectProfileError };\n\ninterface ObjectDescriptor {\n  readonly kind: SignedObjectKind;\n  readonly schema: string;\n  readonly idField: \"policyId\" | \"statusId\" | \"engineRecordId\";\n  readonly idPrefix: string;\n  readonly domain: string;\n}\n\nconst DESCRIPTORS: Record<SignedObjectKind, ObjectDescriptor> = {\n  Policy: {\n    kind: \"Policy\",\n    schema: POLICY_SCHEMA,\n    idField: \"policyId\",\n    idPrefix: \"pol_\",\n    domain: POLICY_SCHEMA,\n  },\n  PolicyStatus: {\n    kind: \"PolicyStatus\",\n    schema: POLICY_STATUS_SCHEMA,\n    idField: \"statusId\",\n    idPrefix: \"polst_\",\n    domain: POLICY_STATUS_SCHEMA,\n  },\n  PolicyEngineRecord: {\n    kind: \"PolicyEngineRecord\",\n    schema: POLICY_ENGINE_RECORD_SCHEMA,\n    idField: \"engineRecordId\",\n    idPrefix: \"peng_\",\n    domain: POLICY_ENGINE_RECORD_SCHEMA,\n  },\n};\n\nconst textEncoder = new TextEncoder();\nconst BASE32_ALPHABET = \"abcdefghijklmnopqrstuvwxyz234567\";\nconst BASE64URL_RE = /^[A-Za-z0-9_-]+$/;\nconst objectHasOwn: (object: object, propertyKey: PropertyKey) => boolean =\n  (Object as ObjectConstructor & {\n    hasOwn?: (object: object, propertyKey: PropertyKey) => boolean;\n  }).hasOwn ??\n  (Object.prototype.hasOwnProperty.call.bind(\n    Object.prototype.hasOwnProperty,\n  ) as (object: object, propertyKey: PropertyKey) => boolean);\n\nexport function canonicalizeSignedObjectUnsigned(input: unknown): string {\n  return jcsCanonicalize(input);\n}\n\nexport function deriveSignedObjectMaterial(input: unknown): SignedObjectMaterial {\n  const descriptor = descriptorForUnsigned(input);\n  const unsigned = validateUnsignedForDescriptor(input, descriptor);\n  return materialForUnsigned(unsigned, descriptor);\n}\n\nexport function signedObjectIdFor(input: unknown): string {\n  return deriveSignedObjectMaterial(input).id;\n}\n\nexport async function createAndSignSignedObject(\n  input: unknown,\n  signer: SignedObjectSigner,\n): Promise<SignedPolicyObject> {\n  const normalized = expectJsonObject(normalizeJson(input), \"$\");\n  const descriptor = descriptorForUnsigned(normalized);\n  const stripped = stripOwnIdAndSignature(normalized, descriptor);\n  const unsigned = validateUnsignedForDescriptor(stripped, descriptor);\n  if (descriptor.kind === \"Policy\") {\n    validatePolicyPermissionsCeilingForSigning(unsigned);\n  }\n  assertSupportedSignatureSuite(signer.suite);\n  requireStringType(signer.signerDid, \"$.signer.signerDid\");\n  assertSignerDidMatchesSuite(signer.signerDid, signer.suite);\n  assertSigningKeyBindingForCreate(unsigned, signer.signerDid);\n  const material = materialForUnsigned(unsigned, descriptor);\n  const signatureValue = encodeSignatureValue(\n    await signer.signDigest(material.digest),\n    signer.suite,\n  );\n  const signature = validateSignature({\n    suite: signer.suite,\n    signerDid: signer.signerDid,\n    value: signatureValue,\n  });\n  return {\n    ...unsigned,\n    [descriptor.idField]: material.id,\n    signature,\n  } as unknown as SignedPolicyObject;\n}\n\nexport function createAndSignPolicy(\n  input: unknown,\n  signer: SignedObjectSigner,\n): Promise<Policy> {\n  return createAndSignSignedObject(input, signer).then((object) =>\n    validatePolicySignedShape(object),\n  );\n}\n\nexport function createAndSignPolicyStatus(\n  input: unknown,\n  signer: SignedObjectSigner,\n): Promise<PolicyStatus> {\n  return createAndSignSignedObject(input, signer).then((object) =>\n    validatePolicyStatusSignedShape(object),\n  );\n}\n\nexport function createAndSignPolicyEngineRecord(\n  input: unknown,\n  signer: SignedObjectSigner,\n): Promise<PolicyEngineRecord> {\n  return createAndSignSignedObject(input, signer).then((object) =>\n    validatePolicyEngineRecordSignedShape(object),\n  );\n}\n\nexport async function verifySignedObject(\n  input: unknown,\n): Promise<{ object: SignedPolicyObject; material: SignedObjectMaterial }> {\n  const signed = validateSignedObjectShape(input);\n  const signedJson = signed as unknown as JsonObject;\n  const descriptor = descriptorForSchema(signed.schema);\n  const signature = validateSignature(signed.signature);\n  assertSigningKeyBindingForVerify(signedJson, signature);\n  const unsigned = stripOwnIdAndSignature(signedJson, descriptor);\n  const material = materialForUnsigned(unsigned, descriptor);\n  assertIdMatches(signedJson, material, descriptor);\n  if (!(await verifySignature(signature, material.digest))) {\n    throw new SignatureVerificationError(\"signature verification failed\");\n  }\n  return { object: signed, material };\n}\n\nexport async function verifyPolicy(\n  input: unknown,\n): Promise<{ object: Policy; material: SignedObjectMaterial }> {\n  const result = await verifySignedObject(input);\n  return {\n    object: validatePolicySignedShape(result.object),\n    material: result.material,\n  };\n}\n\nexport async function verifyPolicyStatus(\n  input: unknown,\n): Promise<{ object: PolicyStatus; material: SignedObjectMaterial }> {\n  const result = await verifySignedObject(input);\n  return {\n    object: validatePolicyStatusSignedShape(result.object),\n    material: result.material,\n  };\n}\n\nexport async function verifyPolicyEngineRecord(\n  input: unknown,\n): Promise<{ object: PolicyEngineRecord; material: SignedObjectMaterial }> {\n  const result = await verifySignedObject(input);\n  return {\n    object: validatePolicyEngineRecordSignedShape(result.object),\n    material: result.material,\n  };\n}\n\nexport async function validatePolicySigned(\n  input: unknown,\n): Promise<SignedObjectVerificationResult<Policy>> {\n  try {\n    const result = await verifyPolicy(input);\n    return { ok: true, object: result.object, material: result.material };\n  } catch (error) {\n    return { ok: false, error: toSignedObjectError(error) };\n  }\n}\n\nexport async function validatePolicyStatusSigned(\n  input: unknown,\n): Promise<SignedObjectVerificationResult<PolicyStatus>> {\n  try {\n    const result = await verifyPolicyStatus(input);\n    return { ok: true, object: result.object, material: result.material };\n  } catch (error) {\n    return { ok: false, error: toSignedObjectError(error) };\n  }\n}\n\nexport async function validatePolicyEngineRecordSigned(\n  input: unknown,\n): Promise<SignedObjectVerificationResult<PolicyEngineRecord>> {\n  try {\n    const result = await verifyPolicyEngineRecord(input);\n    return { ok: true, object: result.object, material: result.material };\n  } catch (error) {\n    return { ok: false, error: toSignedObjectError(error) };\n  }\n}\n\nexport function validatePolicyUnsigned(input: unknown): UnsignedPolicy {\n  return validatePolicyShape(input, false) as unknown as UnsignedPolicy;\n}\n\nexport function validatePolicyStatusUnsigned(input: unknown): UnsignedPolicyStatus {\n  return validatePolicyStatusShape(input, false) as unknown as UnsignedPolicyStatus;\n}\n\nexport function validatePolicyEngineRecordUnsigned(\n  input: unknown,\n): UnsignedPolicyEngineRecord {\n  return validatePolicyEngineRecordShape(input, false) as unknown as UnsignedPolicyEngineRecord;\n}\n\nexport function validatePolicySignedShape(input: unknown): Policy {\n  return validatePolicyShape(input, true) as unknown as Policy;\n}\n\nexport function validatePolicyStatusSignedShape(input: unknown): PolicyStatus {\n  return validatePolicyStatusShape(input, true) as unknown as PolicyStatus;\n}\n\nexport function validatePolicyEngineRecordSignedShape(\n  input: unknown,\n): PolicyEngineRecord {\n  return validatePolicyEngineRecordShape(input, true) as unknown as PolicyEngineRecord;\n}\n\nfunction validateSignedObjectShape(input: unknown): SignedPolicyObject {\n  const normalized = expectJsonObject(normalizeJson(input), \"$\");\n  const schema = requiredString(normalized, \"schema\", \"$\");\n  const descriptor = descriptorForSchema(schema);\n  switch (descriptor.kind) {\n    case \"Policy\":\n      return validatePolicySignedShape(normalized);\n    case \"PolicyStatus\":\n      return validatePolicyStatusSignedShape(normalized);\n    case \"PolicyEngineRecord\":\n      return validatePolicyEngineRecordSignedShape(normalized);\n  }\n}\n\nfunction validateUnsignedForDescriptor(\n  input: unknown,\n  descriptor: ObjectDescriptor,\n): JsonObject {\n  switch (descriptor.kind) {\n    case \"Policy\":\n      return validatePolicyUnsigned(input) as unknown as JsonObject;\n    case \"PolicyStatus\":\n      return validatePolicyStatusUnsigned(input) as unknown as JsonObject;\n    case \"PolicyEngineRecord\":\n      return validatePolicyEngineRecordUnsigned(input) as unknown as JsonObject;\n  }\n}\n\nfunction validatePolicyShape(input: unknown, signed: boolean): JsonObject {\n  const object = expectJsonObject(normalizeJson(input), \"$\");\n  assertExactKeys(\n    object,\n    signed\n      ? [\n          \"schema\",\n          \"policyId\",\n          \"ownerDid\",\n          \"signingKeyDid\",\n          \"createdAt\",\n          \"expiresAt\",\n          \"resource\",\n          \"when\",\n          \"grant\",\n          \"disclosure\",\n          \"audit\",\n          \"signature\",\n        ]\n      : [\n          \"schema\",\n          \"ownerDid\",\n          \"signingKeyDid\",\n          \"createdAt\",\n          \"expiresAt\",\n          \"resource\",\n          \"when\",\n          \"grant\",\n          \"disclosure\",\n          \"audit\",\n        ],\n    \"$\",\n  );\n  expectConst(requiredString(object, \"schema\", \"$\"), POLICY_SCHEMA, \"$.schema\");\n  if (signed) {\n    requiredString(object, \"policyId\", \"$\");\n    validateSignature(requiredValue(object, \"signature\", \"$\"));\n  }\n  requiredString(object, \"ownerDid\", \"$\");\n  requiredString(object, \"signingKeyDid\", \"$\");\n  requiredDateString(object, \"createdAt\", \"$\");\n  optionalDateString(object, \"expiresAt\", \"$\");\n  validatePolicyResource(requiredValue(object, \"resource\", \"$\"), \"$.resource\");\n  validateExpression(requiredValue(object, \"when\", \"$\"), \"$.when\");\n  validateGrant(requiredValue(object, \"grant\", \"$\"), \"$.grant\");\n  if (hasOwn(object, \"disclosure\")) {\n    validateDisclosure(requiredValue(object, \"disclosure\", \"$\"), \"$.disclosure\");\n  }\n  if (hasOwn(object, \"audit\")) {\n    validateAudit(requiredValue(object, \"audit\", \"$\"), \"$.audit\");\n  }\n  return object;\n}\n\nfunction validatePolicyStatusShape(input: unknown, signed: boolean): JsonObject {\n  const object = expectJsonObject(normalizeJson(input), \"$\");\n  assertExactKeys(\n    object,\n    signed\n      ? [\n          \"schema\",\n          \"statusId\",\n          \"policyId\",\n          \"ownerDid\",\n          \"sequence\",\n          \"disposition\",\n          \"effectiveAt\",\n          \"reasonCode\",\n          \"signingKeyDid\",\n          \"signature\",\n        ]\n      : [\n          \"schema\",\n          \"policyId\",\n          \"ownerDid\",\n          \"sequence\",\n          \"disposition\",\n          \"effectiveAt\",\n          \"reasonCode\",\n          \"signingKeyDid\",\n        ],\n    \"$\",\n  );\n  expectConst(requiredString(object, \"schema\", \"$\"), POLICY_STATUS_SCHEMA, \"$.schema\");\n  if (signed) {\n    requiredString(object, \"statusId\", \"$\");\n    validateSignature(requiredValue(object, \"signature\", \"$\"));\n  }\n  requiredString(object, \"policyId\", \"$\");\n  requiredString(object, \"ownerDid\", \"$\");\n  requiredInteger(object, \"sequence\", \"$\", 0);\n  expectOneOf(requiredString(object, \"disposition\", \"$\"), [\n    \"active\",\n    \"suspended\",\n    \"revoked\",\n  ], \"$.disposition\");\n  requiredDateString(object, \"effectiveAt\", \"$\");\n  optionalString(object, \"reasonCode\", \"$\");\n  requiredString(object, \"signingKeyDid\", \"$\");\n  return object;\n}\n\nfunction validatePolicyEngineRecordShape(\n  input: unknown,\n  signed: boolean,\n): JsonObject {\n  const object = expectJsonObject(normalizeJson(input), \"$\");\n  assertExactKeys(\n    object,\n    signed\n      ? [\n          \"schema\",\n          \"engineRecordId\",\n          \"ownerDid\",\n          \"endpoint\",\n          \"audience\",\n          \"supportedPolicyVersions\",\n          \"supportedEvidenceVerifiers\",\n          \"grantIssuerDid\",\n          \"expiresAt\",\n          \"signature\",\n        ]\n      : [\n          \"schema\",\n          \"ownerDid\",\n          \"endpoint\",\n          \"audience\",\n          \"supportedPolicyVersions\",\n          \"supportedEvidenceVerifiers\",\n          \"grantIssuerDid\",\n          \"expiresAt\",\n        ],\n    \"$\",\n  );\n  expectConst(\n    requiredString(object, \"schema\", \"$\"),\n    POLICY_ENGINE_RECORD_SCHEMA,\n    \"$.schema\",\n  );\n  if (signed) {\n    requiredString(object, \"engineRecordId\", \"$\");\n    validateSignature(requiredValue(object, \"signature\", \"$\"));\n  }\n  requiredString(object, \"ownerDid\", \"$\");\n  requiredString(object, \"endpoint\", \"$\");\n  requiredString(object, \"audience\", \"$\");\n  requiredStringArray(object, \"supportedPolicyVersions\", \"$\", (value, path) =>\n    expectConst(value, \"v0\", path),\n  );\n  requiredStringArray(object, \"supportedEvidenceVerifiers\", \"$\");\n  requiredString(object, \"grantIssuerDid\", \"$\");\n  requiredDateString(object, \"expiresAt\", \"$\");\n  return object;\n}\n\nfunction validateSignature(input: unknown): SignedObjectSignature {\n  const object = expectJsonObject(input, \"$.signature\");\n  assertExactKeys(object, [\"suite\", \"signerDid\", \"value\"], \"$.signature\");\n  const suite = requiredString(object, \"suite\", \"$.signature\");\n  assertSupportedSignatureSuite(suite);\n  const signerDid = requiredString(object, \"signerDid\", \"$.signature\");\n  const value = requiredString(object, \"value\", \"$.signature\");\n  decodeSignatureValue(value, suite);\n  return { suite, signerDid, value };\n}\n\nfunction validatePolicyResource(input: unknown, path: string): void {\n  const object = expectJsonObject(input, path);\n  assertExactKeys(object, [\"resourceType\", \"resourceId\", \"permissionsCeiling\"], path);\n  requiredString(object, \"resourceType\", path);\n  requiredString(object, \"resourceId\", path);\n  const ceiling = requiredArray(object, \"permissionsCeiling\", path, 1);\n  for (let index = 0; index < ceiling.length; index++) {\n    validatePolicyCapability(ceiling[index], `${path}.permissionsCeiling[${index}]`);\n  }\n}\n\nfunction validatePolicyPermissionsCeilingForSigning(input: JsonObject): void {\n  const resource = expectJsonObject(requiredValue(input, \"resource\", \"$\"), \"$.resource\");\n  const ceiling = requiredArray(resource, \"permissionsCeiling\", \"$.resource\", 1);\n  for (let index = 0; index < ceiling.length; index++) {\n    validatePolicyCapabilityForSigning(\n      ceiling[index],\n      `$.resource.permissionsCeiling[${index}]`,\n    );\n  }\n}\n\nfunction validatePolicyCapability(input: unknown, path: string): void {\n  const object = expectJsonObject(input, path);\n  try {\n    const canonical = canonicalizePolicyCapability(object);\n    if (jcsCanonicalize(object) !== jcsCanonicalize(canonical)) {\n      throw new SignedObjectSchemaError(`${path} must be canonical PolicyCapability JSON`);\n    }\n  } catch (error) {\n    if (error instanceof SignedObjectSchemaError) {\n      throw error;\n    }\n    throw new SignedObjectSchemaError(\n      error instanceof Error ? error.message : String(error),\n    );\n  }\n}\n\nfunction validatePolicyCapabilityForSigning(input: unknown, path: string): void {\n  const object = expectJsonObject(input, path);\n  try {\n    const canonical = normalizePolicyCapability(object);\n    if (jcsCanonicalize(object) !== jcsCanonicalize(canonical)) {\n      throw new SignedObjectSchemaError(`${path} must be strict canonical PolicyCapability JSON`);\n    }\n  } catch (error) {\n    if (error instanceof SignedObjectSchemaError) {\n      throw error;\n    }\n    throw new SignedObjectSchemaError(\n      error instanceof Error ? error.message : String(error),\n    );\n  }\n}\n\nfunction validateExpression(input: unknown, path: string): void {\n  const object = expectJsonObject(input, path);\n  const keys = Object.keys(object);\n  if (keys.length !== 1) {\n    throw new SignedObjectSchemaError(`${path} must have exactly one expression key`);\n  }\n  const key = keys[0];\n  if (key === \"allOf\" || key === \"anyOf\") {\n    const values = requiredArray(object, key, path, 1);\n    for (let index = 0; index < values.length; index++) {\n      validateExpression(values[index], `${path}.${key}[${index}]`);\n    }\n    return;\n  }\n  if (key === \"subject\") {\n    const subject = expectJsonObject(requiredValue(object, \"subject\", path), `${path}.subject`);\n    assertExactKeys(subject, [\"did\"], `${path}.subject`);\n    requiredString(subject, \"did\", `${path}.subject`);\n    return;\n  }\n  if (key === \"evidence\") {\n    validateEvidenceRequirement(requiredValue(object, \"evidence\", path), `${path}.evidence`);\n    return;\n  }\n  throw new SignedObjectSchemaError(`${path} has unknown expression key ${key}`);\n}\n\nfunction validateEvidenceRequirement(input: unknown, path: string): void {\n  const object = expectJsonObject(input, path);\n  assertExactKeys(\n    object,\n    [\"requirementId\", \"verifier\", \"requirements\", \"authority\", \"freshness\"],\n    path,\n  );\n  requiredString(object, \"requirementId\", path);\n  requiredString(object, \"verifier\", path);\n  requiredValue(object, \"requirements\", path);\n  if (hasOwn(object, \"authority\")) {\n    const authority = expectJsonObject(requiredValue(object, \"authority\", path), `${path}.authority`);\n    assertExactKeys(\n      authority,\n      [\"profile\", \"acceptedIssuers\", \"allowOwnerAuthorizedIssuer\"],\n      `${path}.authority`,\n    );\n    optionalString(authority, \"profile\", `${path}.authority`);\n    if (hasOwn(authority, \"acceptedIssuers\")) {\n      requiredStringArray(authority, \"acceptedIssuers\", `${path}.authority`);\n    }\n    optionalBoolean(authority, \"allowOwnerAuthorizedIssuer\", `${path}.authority`);\n  }\n  if (hasOwn(object, \"freshness\")) {\n    const freshness = expectJsonObject(requiredValue(object, \"freshness\", path), `${path}.freshness`);\n    assertExactKeys(freshness, [\"maxStatusAgeSeconds\"], `${path}.freshness`);\n    requiredInteger(freshness, \"maxStatusAgeSeconds\", `${path}.freshness`, 0);\n  }\n}\n\nfunction validateGrant(input: unknown, path: string): void {\n  const object = expectJsonObject(input, path);\n  assertExactKeys(object, [\"output\", \"maxTtlSeconds\", \"delegationMode\", \"revocation\"], path);\n  expectConst(requiredString(object, \"output\", path), \"portable-delegation\", `${path}.output`);\n  requiredInteger(object, \"maxTtlSeconds\", path, 1);\n  expectOneOf(requiredString(object, \"delegationMode\", path), [\n    \"terminal\",\n    \"attenuable\",\n  ], `${path}.delegationMode`);\n  expectOneOf(requiredString(object, \"revocation\", path), [\n    \"refresh_only\",\n    \"active_cutoff\",\n  ], `${path}.revocation`);\n}\n\nfunction validateDisclosure(input: unknown, path: string): void {\n  const object = expectJsonObject(input, path);\n  assertExactKeys(object, [\"denial\"], path);\n  expectOneOf(requiredString(object, \"denial\", path), [\"none\", \"code\", \"debug\"], `${path}.denial`);\n}\n\nfunction validateAudit(input: unknown, path: string): void {\n  const object = expectJsonObject(input, path);\n  assertExactKeys(object, [\"issuance\"], path);\n  expectOneOf(requiredString(object, \"issuance\", path), [\"off\", \"security\", \"full\"], `${path}.issuance`);\n}\n\nfunction materialForUnsigned(\n  unsigned: JsonObject,\n  descriptor: ObjectDescriptor,\n): SignedObjectMaterial {\n  const jcs = jcsCanonicalize(unsigned);\n  const jcsBytes = textEncoder.encode(jcs);\n  const digest = sha256Bytes(concatBytes(textEncoder.encode(`${descriptor.domain}\\0`), jcsBytes));\n  const id = `${descriptor.idPrefix}${base32LowerNoPad(digest)}`;\n  return {\n    kind: descriptor.kind,\n    idField: descriptor.idField,\n    id,\n    domain: descriptor.domain,\n    unsigned,\n    jcs,\n    jcsBytes,\n    digest,\n    digestHex: bytesToHex(digest).slice(2),\n  };\n}\n\nfunction assertIdMatches(\n  signed: JsonObject,\n  material: SignedObjectMaterial,\n  descriptor: ObjectDescriptor,\n): void {\n  const actual = requiredString(signed, descriptor.idField, \"$\");\n  if (actual === material.id) {\n    return;\n  }\n  if (new RegExp(`^${descriptor.idPrefix}[a-z2-7]{52}$`).test(actual)) {\n    throw new SignedObjectDigestError(\n      `${descriptor.idField} was not derived from the signed object digest`,\n    );\n  }\n  throw new SignedObjectIdError(`${descriptor.idField} does not match ${descriptor.idPrefix}`);\n}\n\nfunction assertSigningKeyBindingForCreate(\n  unsigned: JsonObject,\n  signerDid: string,\n): void {\n  if (!hasOwn(unsigned, \"signingKeyDid\")) {\n    return;\n  }\n  const signingKeyDid = requiredString(unsigned, \"signingKeyDid\", \"$\");\n  if (signingKeyDid !== signerDid) {\n    throw new SigningKeyBindingError(\n      `signer DID ${signerDid} does not match signingKeyDid ${signingKeyDid}`,\n    );\n  }\n}\n\nfunction assertSigningKeyBindingForVerify(\n  signed: JsonObject,\n  signature: SignedObjectSignature,\n): void {\n  if (!hasOwn(signed, \"signingKeyDid\")) {\n    return;\n  }\n  const signingKeyDid = requiredString(signed, \"signingKeyDid\", \"$\");\n  if (signature.signerDid !== signingKeyDid) {\n    throw new SigningKeyBindingError(\n      `signature signerDid ${signature.signerDid} does not match signingKeyDid ${signingKeyDid}`,\n    );\n  }\n}\n\nfunction assertSignerDidMatchesSuite(\n  signerDid: string,\n  suite: SignatureSuite,\n): void {\n  if (suite === ED25519_JCS_SIGNATURE_SUITE) {\n    ed25519PublicKeyFromDidKey(signerDid);\n    return;\n  }\n  if (suite === EIP191_JCS_SIGNATURE_SUITE) {\n    parseDidPkh(signerDid);\n    return;\n  }\n  throw new UnsupportedSignatureSuiteError(`unsupported signature suite: ${suite}`);\n}\n\nasync function verifySignature(\n  signature: SignedObjectSignature,\n  digest: Uint8Array,\n): Promise<boolean> {\n  if (signature.suite === ED25519_JCS_SIGNATURE_SUITE) {\n    const publicKey = ed25519PublicKeyFromDidKey(signature.signerDid);\n    const signatureBytes = decodeSignatureValue(signature.value, signature.suite);\n    try {\n      return ed25519.verify(signatureBytes, digest, publicKey);\n    } catch {\n      throw new SignatureVerificationError(\"Ed25519 signature verification failed\");\n    }\n  }\n\n  if (signature.suite === EIP191_JCS_SIGNATURE_SUITE) {\n    const pkh = parseDidPkh(signature.signerDid);\n    const signatureBytes = decodeSignatureValue(signature.value, signature.suite);\n    try {\n      return verifyMessage({\n        address: pkh.address,\n        message: { raw: digest },\n        signature: bytesToHex(signatureBytes),\n      });\n    } catch {\n      throw new SignatureVerificationError(\"EIP-191 signature verification failed\");\n    }\n  }\n\n  throw new UnsupportedSignatureSuiteError(`unsupported signature suite: ${signature.suite}`);\n}\n\nfunction ed25519PublicKeyFromDidKey(did: string): Uint8Array {\n  if (!did.startsWith(\"did:key:\")) {\n    throw new SignatureMaterialError(\"Ed25519 signerDid must be did:key\");\n  }\n  const identifier = did.slice(\"did:key:\".length);\n  if (!identifier.startsWith(\"z\")) {\n    throw new SignatureMaterialError(\"did:key must use base58btc multibase\");\n  }\n  let bytes: Uint8Array;\n  try {\n    bytes = bases.base58btc.decode(identifier);\n  } catch {\n    throw new SignatureMaterialError(\"did:key signerDid is undecodable\");\n  }\n  if (bytes.length === 34 && bytes[0] === 0xed && bytes[1] === 0x01) {\n    return bytes.slice(2);\n  }\n  throw new SignatureMaterialError(\"did:key signerDid is not an Ed25519 key\");\n}\n\nfunction parseDidPkh(did: string): { address: `0x${string}` } {\n  let parsed: ReturnType<typeof parsePkhDid>;\n  try {\n    parsed = parsePkhDid(did);\n  } catch {\n    throw new SignatureMaterialError(\"did:pkh signerDid is undecodable\");\n  }\n  if (!parsed) {\n    throw new SignatureMaterialError(\"EIP-191 signerDid must be did:pkh\");\n  }\n  return { address: parsed.address };\n}\n\nfunction decodeSignatureValue(value: string, suite: SignatureSuite): Uint8Array {\n  if (value.length === 0 || !BASE64URL_RE.test(value) || value.includes(\"=\")) {\n    throw new SignatureMaterialError(\"signature value must be base64url without padding\");\n  }\n  const bytes = base64UrlDecode(value);\n  if (suite === ED25519_JCS_SIGNATURE_SUITE && bytes.length !== 64) {\n    throw new SignatureMaterialError(\"Ed25519 signature must be 64 bytes\");\n  }\n  if (suite === EIP191_JCS_SIGNATURE_SUITE) {\n    if (bytes.length !== 65) {\n      throw new SignatureMaterialError(\"EIP-191 signature must be 65 bytes\");\n    }\n    const v = bytes[64];\n    if (v !== 27 && v !== 28) {\n      throw new SignatureMaterialError(\"EIP-191 signature recovery id must be 27 or 28\");\n    }\n  }\n  return bytes;\n}\n\nfunction encodeSignatureValue(\n  value: Uint8Array | string,\n  suite: SignatureSuite,\n): string {\n  if (typeof value === \"string\") {\n    const encoded = value.startsWith(\"0x\")\n      ? base64UrlEncode(hexToBytes(value))\n      : value;\n    decodeSignatureValue(encoded, suite);\n    return encoded;\n  }\n  const encoded = base64UrlEncode(value);\n  decodeSignatureValue(encoded, suite);\n  return encoded;\n}\n\nfunction stripOwnIdAndSignature(\n  object: JsonObject,\n  descriptor: ObjectDescriptor,\n): JsonObject {\n  const output = Object.create(null) as { [key: string]: JsonValue };\n  for (const [key, value] of Object.entries(object)) {\n    if (key === descriptor.idField || key === \"signature\") {\n      continue;\n    }\n    output[key] = value;\n  }\n  return output;\n}\n\nfunction descriptorForUnsigned(input: unknown): ObjectDescriptor {\n  const object = expectJsonObject(normalizeJson(input), \"$\");\n  return descriptorForSchema(requiredString(object, \"schema\", \"$\"));\n}\n\nfunction descriptorForSchema(schema: string): ObjectDescriptor {\n  if (schema === POLICY_SCHEMA) return DESCRIPTORS.Policy;\n  if (schema === POLICY_STATUS_SCHEMA) return DESCRIPTORS.PolicyStatus;\n  if (schema === POLICY_ENGINE_RECORD_SCHEMA) return DESCRIPTORS.PolicyEngineRecord;\n  throw new SignedObjectSchemaError(`unsupported signed-object schema: ${schema}`);\n}\n\nfunction expectJsonObject(input: unknown, path: string): JsonObject {\n  if (input === null || typeof input !== \"object\" || Array.isArray(input)) {\n    throw new SignedObjectSchemaError(`${path} must be an object`);\n  }\n  return input as JsonObject;\n}\n\nfunction assertExactKeys(object: JsonObject, allowed: readonly string[], path: string): void {\n  const allowedSet = new Set(allowed);\n  for (const key of Object.keys(object)) {\n    if (!allowedSet.has(key)) {\n      throw new SignedObjectSchemaError(`${path} has unknown field ${key}`);\n    }\n  }\n}\n\nfunction requiredValue(object: JsonObject, key: string, path: string): JsonValue {\n  if (!hasOwn(object, key)) {\n    throw new SignedObjectSchemaError(`${path}.${key} is required`);\n  }\n  return object[key];\n}\n\nfunction requiredString(object: JsonObject, key: string, path: string): string {\n  return requireStringType(requiredValue(object, key, path), `${path}.${key}`);\n}\n\nfunction optionalString(object: JsonObject, key: string, path: string): void {\n  if (!hasOwn(object, key)) {\n    return;\n  }\n  requireStringType(requiredValue(object, key, path), `${path}.${key}`);\n}\n\nfunction requireStringType(value: JsonValue, path: string): string {\n  if (typeof value !== \"string\" || value.length === 0) {\n    throw new SignedObjectSchemaError(`${path} must be a non-empty string`);\n  }\n  return value;\n}\n\nfunction optionalBoolean(object: JsonObject, key: string, path: string): void {\n  if (!hasOwn(object, key)) {\n    return;\n  }\n  if (typeof requiredValue(object, key, path) !== \"boolean\") {\n    throw new SignedObjectSchemaError(`${path}.${key} must be a boolean`);\n  }\n}\n\nfunction requiredInteger(\n  object: JsonObject,\n  key: string,\n  path: string,\n  minimum: number,\n): number {\n  const value = requiredValue(object, key, path);\n  if (typeof value !== \"number\" || !Number.isSafeInteger(value) || value < minimum) {\n    throw new SignedObjectSchemaError(\n      `${path}.${key} must be an integer >= ${minimum}`,\n    );\n  }\n  return value;\n}\n\nfunction requiredArray(\n  object: JsonObject,\n  key: string,\n  path: string,\n  minimum: number,\n): readonly JsonValue[] {\n  const value = requiredValue(object, key, path);\n  if (!Array.isArray(value) || value.length < minimum) {\n    throw new SignedObjectSchemaError(\n      `${path}.${key} must be an array with at least ${minimum} item(s)`,\n    );\n  }\n  return value;\n}\n\nfunction requiredStringArray(\n  object: JsonObject,\n  key: string,\n  path: string,\n  check?: (value: string, path: string) => void,\n): void {\n  const values = requiredArray(object, key, path, 0);\n  for (let index = 0; index < values.length; index++) {\n    const itemPath = `${path}.${key}[${index}]`;\n    const value = requireStringType(values[index], itemPath);\n    check?.(value, itemPath);\n  }\n}\n\nfunction requiredDateString(object: JsonObject, key: string, path: string): void {\n  assertRfc3339(requiredString(object, key, path), `${path}.${key}`);\n}\n\nfunction optionalDateString(object: JsonObject, key: string, path: string): void {\n  if (!hasOwn(object, key)) {\n    return;\n  }\n  assertRfc3339(requiredString(object, key, path), `${path}.${key}`);\n}\n\nfunction assertRfc3339(value: string, path: string): void {\n  const match = value.match(\n    /^(\\d{4})-(\\d{2})-(\\d{2})T(\\d{2}):(\\d{2}):(\\d{2})(\\.\\d+)?(Z|[+-]\\d{2}:\\d{2})$/,\n  );\n  if (!match) {\n    throw new SignedObjectSchemaError(`${path} must be strict RFC 3339`);\n  }\n  const parsed = Date.parse(value);\n  if (Number.isNaN(parsed)) {\n    throw new SignedObjectSchemaError(`${path} must be a parseable RFC 3339 timestamp`);\n  }\n  const canonical = new Date(parsed).toISOString().replace(\".000Z\", \"Z\");\n  if (canonical !== value) {\n    throw new SignedObjectSchemaError(`${path} must be a normalizable RFC 3339 timestamp`);\n  }\n}\n\nfunction expectConst<T extends string>(actual: string, expected: T, path: string): T {\n  if (actual !== expected) {\n    throw new SignedObjectSchemaError(`${path} must be ${expected}`);\n  }\n  return expected;\n}\n\nfunction expectOneOf<T extends string>(\n  actual: string,\n  allowed: readonly T[],\n  path: string,\n): T {\n  for (const value of allowed) {\n    if (actual === value) {\n      return value;\n    }\n  }\n  throw new SignedObjectSchemaError(`${path} has unsupported value ${actual}`);\n}\n\nfunction hasOwn(object: JsonObject, key: string): boolean {\n  return objectHasOwn(object, key);\n}\n\nfunction assertSupportedSignatureSuite(suite: string): asserts suite is SignatureSuite {\n  if (suite !== ED25519_JCS_SIGNATURE_SUITE && suite !== EIP191_JCS_SIGNATURE_SUITE) {\n    throw new UnsupportedSignatureSuiteError(`unsupported signature suite: ${suite}`);\n  }\n}\n\nfunction sha256Bytes(bytes: Uint8Array): Uint8Array {\n  return sha256(bytes, \"bytes\");\n}\n\nfunction concatBytes(left: Uint8Array, right: Uint8Array): Uint8Array {\n  const output = new Uint8Array(left.length + right.length);\n  output.set(left, 0);\n  output.set(right, left.length);\n  return output;\n}\n\nfunction base32LowerNoPad(bytes: Uint8Array): string {\n  let output = \"\";\n  let buffer = 0;\n  let bits = 0;\n  for (const byte of bytes) {\n    buffer = (buffer << 8) | byte;\n    bits += 8;\n    while (bits >= 5) {\n      bits -= 5;\n      output += BASE32_ALPHABET[(buffer >> bits) & 31];\n    }\n  }\n  if (bits > 0) {\n    output += BASE32_ALPHABET[(buffer << (5 - bits)) & 31];\n  }\n  return output;\n}\n\nfunction base64UrlEncode(bytes: Uint8Array): string {\n  const alphabet =\n    \"ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789-_\";\n  let output = \"\";\n  for (let index = 0; index < bytes.length; index += 3) {\n    const a = bytes[index];\n    const b = bytes[index + 1];\n    const c = bytes[index + 2];\n    const triplet = (a << 16) | ((b ?? 0) << 8) | (c ?? 0);\n    output += alphabet[(triplet >> 18) & 63];\n    output += alphabet[(triplet >> 12) & 63];\n    if (index + 1 < bytes.length) {\n      output += alphabet[(triplet >> 6) & 63];\n    }\n    if (index + 2 < bytes.length) {\n      output += alphabet[triplet & 63];\n    }\n  }\n  return output;\n}\n\nfunction base64UrlDecode(value: string): Uint8Array {\n  if (value.length % 4 === 1) {\n    throw new SignatureMaterialError(\"signature value is not canonical base64url\");\n  }\n  const alphabet =\n    \"ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789-_\";\n  const bytes: number[] = [];\n  let buffer = 0;\n  let bits = 0;\n  for (const char of value) {\n    const index = alphabet.indexOf(char);\n    if (index < 0) {\n      throw new SignatureMaterialError(\"signature value is not base64url\");\n    }\n    buffer = (buffer << 6) | index;\n    bits += 6;\n    if (bits >= 8) {\n      bits -= 8;\n      bytes.push((buffer >> bits) & 0xff);\n    }\n  }\n  const decoded = Uint8Array.from(bytes);\n  if (base64UrlEncode(decoded) !== value) {\n    throw new SignatureMaterialError(\"signature value is not canonical base64url\");\n  }\n  return decoded;\n}\n\nfunction hexToBytes(value: string): Uint8Array {\n  const hex = value.slice(2);\n  if (hex.length % 2 !== 0 || !/^[0-9a-fA-F]*$/.test(hex)) {\n    throw new SignatureMaterialError(\"hex signature must have even length\");\n  }\n  const output = new Uint8Array(hex.length / 2);\n  for (let index = 0; index < output.length; index++) {\n    output[index] = Number.parseInt(hex.slice(index * 2, index * 2 + 2), 16);\n  }\n  return output;\n}\n","import { getAddress, isAddress } from \"viem\";\n\nexport type CanonicalAddress = `0x${string}`;\n\nexport interface PkhDidParts {\n  method: \"pkh\";\n  namespace: \"eip155\";\n  chainId: number;\n  address: CanonicalAddress;\n}\n\nexport interface DidEqualsOptions {\n  ignoreFragment?: boolean;\n}\n\nexport interface DidCacheKeyOptions {\n  preserveFragment?: boolean;\n}\n\nexport class IdentityParseError extends Error {\n  constructor(message: string) {\n    super(message);\n    this.name = \"IdentityParseError\";\n  }\n}\n\nconst PKH_DID_RE = /^did:pkh:eip155:(\\d+):(0x[a-fA-F0-9]{40})$/;\nconst DID_RE = /^did:[a-z0-9]+:.+$/;\n\nfunction splitDidUrl(input: string): { did: string; fragment: string } {\n  const fragmentIndex = input.indexOf(\"#\");\n  if (fragmentIndex < 0) {\n    return { did: input, fragment: \"\" };\n  }\n  return {\n    did: input.slice(0, fragmentIndex),\n    fragment: input.slice(fragmentIndex),\n  };\n}\n\nfunction assertValidChainId(chainId: number): void {\n  if (!Number.isSafeInteger(chainId) || chainId <= 0) {\n    throw new IdentityParseError(`Invalid EIP-155 chain ID: ${chainId}`);\n  }\n}\n\nexport function isEvmAddress(input: string): boolean {\n  return isAddress(input, { strict: false });\n}\n\nexport function canonicalizeAddress(address: string): CanonicalAddress {\n  if (!isEvmAddress(address)) {\n    throw new IdentityParseError(`Invalid EVM address: ${address}`);\n  }\n  return getAddress(address) as CanonicalAddress;\n}\n\nexport function addressStorageKey(address: string): CanonicalAddress {\n  return canonicalizeAddress(address).toLowerCase() as CanonicalAddress;\n}\n\nexport function pkhDid(address: string, chainId: number = 1): string {\n  assertValidChainId(chainId);\n  return `did:pkh:eip155:${chainId}:${canonicalizeAddress(address)}`;\n}\n\nexport function parsePkhDid(did: string): PkhDidParts | null {\n  const match = did.match(PKH_DID_RE);\n  if (!match) return null;\n\n  const chainId = Number(match[1]);\n  assertValidChainId(chainId);\n\n  return {\n    method: \"pkh\",\n    namespace: \"eip155\",\n    chainId,\n    address: canonicalizeAddress(match[2]),\n  };\n}\n\nexport function canonicalizeDid(did: string): string {\n  const pkh = parsePkhDid(did);\n  if (pkh) {\n    return pkhDid(pkh.address, pkh.chainId);\n  }\n  if (DID_RE.test(did)) {\n    return did;\n  }\n  throw new IdentityParseError(`Invalid DID: ${did}`);\n}\n\nexport function canonicalizeDidUrl(didUrl: string): string {\n  const { did, fragment } = splitDidUrl(didUrl);\n  return `${canonicalizeDid(did)}${fragment}`;\n}\n\nexport function principalDid(didUrl: string): string {\n  return canonicalizeDid(splitDidUrl(didUrl).did);\n}\n\nexport function didEquals(a: string, b: string, options: DidEqualsOptions = {}): boolean {\n  const canonicalize = options.ignoreFragment ? principalDid : canonicalizeDidUrl;\n  return canonicalize(a) === canonicalize(b);\n}\n\nexport function principalDidEquals(a: string, b: string): boolean {\n  return didEquals(a, b, { ignoreFragment: true });\n}\n\nexport function didCacheKey(input: string, options: DidCacheKeyOptions = {}): string {\n  const { did, fragment } = splitDidUrl(input);\n  const pkh = parsePkhDid(did);\n  const base = pkh\n    ? `did:pkh:eip155:${pkh.chainId}:${addressStorageKey(pkh.address)}`\n    : canonicalizeDid(did);\n\n  return options.preserveFragment ? `${base}${fragment}` : base;\n}\n\nexport function makePkhSpaceId(\n  address: string,\n  chainId: number,\n  name: string,\n): string {\n  assertValidChainId(chainId);\n  if (!name) {\n    throw new IdentityParseError(\"Space name cannot be empty\");\n  }\n  return `tinycloud:pkh:eip155:${chainId}:${canonicalizeAddress(address)}:${name}`;\n}\n","import {\n  POLICY_ENGINE_RECORD_SCHEMA,\n  POLICY_SCHEMA,\n  createAndSignPolicy,\n  createAndSignPolicyEngineRecord,\n  validatePolicyEngineRecordSignedShape,\n  verifyPolicyEngineRecord,\n  type Policy,\n  type PolicyEngineRecord,\n  type SignedObjectSigner,\n  type UnsignedPolicyEngineRecord,\n} from \"./signed-object\";\nimport {\n  PolicyCapabilityError,\n  normalizePolicyCapability,\n  type JsonObject,\n  type PolicyCapability,\n} from \"./capability\";\nimport { normalizeJson, type JsonValue } from \"./jcs\";\nimport { SignedObjectProfileError, SignedObjectSchemaError } from \"./errors\";\n\nexport const TRANSCRIPT_SHARE_BOOTSTRAP_SCHEMA =\n  \"xyz.tinycloud.exchange/transcript-bootstrap/v0\" as const;\nexport const OWNER_NODE_ENDPOINT_SCHEMA =\n  \"xyz.tinycloud.exchange/owner-node-endpoint/v1\" as const;\nexport const POLICY_VERSION_V0 = \"v0\" as const;\nexport const W3C_VC_CREDENTIAL_VERIFIER = \"w3c.vc/credential/v1\" as const;\n\nexport type PolicyAuthoringErrorCode =\n  | PolicyCapabilityError[\"code\"]\n  | \"policy-authoring-malformed\"\n  | \"policy-authoring-unknown-key\"\n  | \"policy-engine-record-absent\"\n  | \"policy-engine-record-date-invalid\"\n  | \"policy-engine-record-signature-invalid\"\n  | \"policy-engine-record-audience-mismatch\"\n  | \"policy-engine-record-expired\"\n  | \"policy-engine-record-owner-mismatch\"\n  | \"policy-engine-record-grant-issuer-mismatch\"\n  | \"policy-engine-record-policy-version-unsupported\"\n  | \"policy-engine-record-evidence-verifier-unsupported\"\n  | \"transcript-share-bootstrap-malformed\";\n\nexport class PolicyAuthoringError extends Error {\n  public readonly code: PolicyAuthoringErrorCode;\n\n  constructor(code: PolicyAuthoringErrorCode, message: string) {\n    super(message);\n    this.name = \"PolicyAuthoringError\";\n    this.code = code;\n  }\n}\n\nexport interface CreateTranscriptSharePolicyInput {\n  readonly ownerDid: string;\n  readonly signingKeyDid: string;\n  readonly createdAt: string;\n  readonly expiresAt?: string;\n  readonly resourceType: string;\n  readonly resourceId: string;\n  readonly permissionsCeiling: readonly unknown[];\n  readonly when: JsonObject;\n  readonly grant: JsonObject;\n  readonly disclosure?: JsonObject;\n  readonly audit?: JsonObject;\n}\n\nexport interface TranscriptShareBootstrap {\n  readonly schema: typeof TRANSCRIPT_SHARE_BOOTSTRAP_SCHEMA;\n  readonly policyId: string;\n  readonly policyEngine: {\n    readonly endpoint: string;\n    readonly audience: string;\n    readonly supportedEvidenceVerifiers: readonly [\n      typeof W3C_VC_CREDENTIAL_VERIFIER,\n    ];\n    readonly signedRecord: PolicyEngineRecord;\n  };\n  /** Untrusted routing hint. Authority comes only from delegation/invocation validation. */\n  readonly ownerNode: {\n    readonly schema: typeof OWNER_NODE_ENDPOINT_SCHEMA;\n    readonly endpoint: string;\n    readonly spaceId: string;\n  };\n  readonly resourceHint: JsonObject;\n}\n\nexport interface ComposeTranscriptShareBootstrapInput {\n  readonly policyId: string;\n  readonly policyEngineRecord: PolicyEngineRecord;\n  readonly ownerNodeEndpoint: string;\n  readonly ownerSpaceId: string;\n  readonly resourceHint: JsonObject;\n}\n\nexport interface CreatePolicyEngineRecordInput {\n  readonly ownerDid: string;\n  readonly endpoint: string;\n  readonly audience: string;\n  readonly grantIssuerDid: string;\n  readonly expiresAt: string;\n  readonly supportedPolicyVersions?: readonly string[];\n  readonly supportedEvidenceVerifiers?: readonly string[];\n}\n\nexport interface VerifyPolicyEngineRecordOptions {\n  readonly signedRecord: unknown;\n  readonly ownerDid: string;\n  readonly audience: string;\n  readonly grantIssuerDid: string;\n  readonly now: string;\n  readonly requiredPolicyVersion?: string;\n  readonly requiredEvidenceVerifier?: string;\n}\n\n/**\n * Author a transcript-sharing Policy from already-resolved Listen-adapter\n * PolicyCapability JSON. Manifest PermissionEntry shapes are refused here; the\n * SDK does not expand or invent permissions while signing authority-bearing\n * objects.\n */\nexport async function createAndSignTranscriptSharePolicy(\n  input: CreateTranscriptSharePolicyInput,\n  signer: SignedObjectSigner,\n): Promise<Policy> {\n  const normalized = expectObject(input, \"$\", \"policy-authoring-malformed\");\n  assertExactKeys(\n    normalized,\n    [\n      \"ownerDid\",\n      \"signingKeyDid\",\n      \"createdAt\",\n      \"expiresAt\",\n      \"resourceType\",\n      \"resourceId\",\n      \"permissionsCeiling\",\n      \"when\",\n      \"grant\",\n      \"disclosure\",\n      \"audit\",\n    ],\n    \"$\",\n  );\n  const permissions = requiredArray(normalized, \"permissionsCeiling\", \"$\");\n  if (permissions.length === 0) {\n    throw new PolicyAuthoringError(\n      \"policy-authoring-malformed\",\n      \"$.permissionsCeiling must not be empty\",\n    );\n  }\n  const ceiling: PolicyCapability[] = [];\n  for (let index = 0; index < permissions.length; index++) {\n    ceiling.push(\n      wrapCapabilityError(() => normalizePolicyCapability(permissions[index])),\n    );\n  }\n  return createAndSignPolicy(\n    {\n      schema: POLICY_SCHEMA,\n      ownerDid: requiredString(normalized, \"ownerDid\", \"$\"),\n      signingKeyDid: requiredString(normalized, \"signingKeyDid\", \"$\"),\n      createdAt: requiredString(normalized, \"createdAt\", \"$\"),\n      ...(hasOwn(normalized, \"expiresAt\")\n        ? { expiresAt: requiredString(normalized, \"expiresAt\", \"$\") }\n        : {}),\n      resource: {\n        resourceType: requiredString(normalized, \"resourceType\", \"$\"),\n        resourceId: requiredString(normalized, \"resourceId\", \"$\"),\n        permissionsCeiling: ceiling,\n      },\n      when: requiredObject(normalized, \"when\", \"$\"),\n      grant: requiredObject(normalized, \"grant\", \"$\"),\n      ...(hasOwn(normalized, \"disclosure\")\n        ? { disclosure: requiredObject(normalized, \"disclosure\", \"$\") }\n        : {}),\n      ...(hasOwn(normalized, \"audit\")\n        ? { audit: requiredObject(normalized, \"audit\", \"$\") }\n        : {}),\n    },\n    signer,\n  ).catch((error) => {\n    throw wrapSignedObjectError(error);\n  });\n}\n\nexport function createUnsignedPolicyEngineRecord(\n  input: CreatePolicyEngineRecordInput,\n): UnsignedPolicyEngineRecord {\n  const normalized = expectObject(input, \"$\", \"policy-authoring-malformed\");\n  assertExactKeys(\n    normalized,\n    [\n      \"ownerDid\",\n      \"endpoint\",\n      \"audience\",\n      \"grantIssuerDid\",\n      \"expiresAt\",\n      \"supportedPolicyVersions\",\n      \"supportedEvidenceVerifiers\",\n    ],\n    \"$\",\n  );\n  const supportedPolicyVersions = hasOwn(normalized, \"supportedPolicyVersions\")\n    ? requiredStringArray(normalized, \"supportedPolicyVersions\", \"$\")\n    : [POLICY_VERSION_V0];\n  validateSupportedPolicyVersions(\n    supportedPolicyVersions,\n    \"$.supportedPolicyVersions\",\n  );\n  const supportedEvidenceVerifiers = hasOwn(\n    normalized,\n    \"supportedEvidenceVerifiers\",\n  )\n    ? requiredStringArray(normalized, \"supportedEvidenceVerifiers\", \"$\")\n    : [W3C_VC_CREDENTIAL_VERIFIER];\n  validateSupportedEvidenceVerifiers(\n    supportedEvidenceVerifiers,\n    \"$.supportedEvidenceVerifiers\",\n  );\n  const expiresAt = fieldString(\n    normalized,\n    \"expiresAt\",\n    \"$\",\n    \"policy-engine-record-date-invalid\",\n  );\n  parseStrictRfc3339(expiresAt, \"$.expiresAt\");\n\n  return {\n    schema: POLICY_ENGINE_RECORD_SCHEMA,\n    ownerDid: requiredString(normalized, \"ownerDid\", \"$\"),\n    endpoint: validatePolicyEngineEndpoint(\n      requiredString(normalized, \"endpoint\", \"$\"),\n    ),\n    audience: requiredString(normalized, \"audience\", \"$\"),\n    supportedPolicyVersions,\n    supportedEvidenceVerifiers,\n    grantIssuerDid: requiredString(normalized, \"grantIssuerDid\", \"$\"),\n    expiresAt,\n  };\n}\n\nexport async function createAndSignRequesterPolicyEngineRecord(\n  input: CreatePolicyEngineRecordInput,\n  signer: SignedObjectSigner,\n): Promise<PolicyEngineRecord> {\n  return createAndSignPolicyEngineRecord(\n    createUnsignedPolicyEngineRecord(input),\n    signer,\n  ).catch((error) => {\n    throw wrapSignedObjectError(error);\n  });\n}\n\n/**\n * Compose the SDK-level transcript-share bootstrap record. This record is not\n * an invitation and is not authority; it only tells a requester where to ask\n * and which policy id to reference.\n */\nexport function composeTranscriptShareBootstrap(\n  input: ComposeTranscriptShareBootstrapInput,\n): TranscriptShareBootstrap {\n  const normalized = expectObject(\n    input,\n    \"$\",\n    \"transcript-share-bootstrap-malformed\",\n  );\n  assertExactKeys(\n    normalized,\n    [\n      \"policyId\",\n      \"policyEngineRecord\",\n      \"ownerNodeEndpoint\",\n      \"ownerSpaceId\",\n      \"resourceHint\",\n    ],\n    \"$\",\n  );\n  const signedRecord = expectPolicyEngineRecord(\n    requiredValue(normalized, \"policyEngineRecord\", \"$\"),\n  );\n  if (\n    !signedRecord.supportedEvidenceVerifiers.includes(\n      W3C_VC_CREDENTIAL_VERIFIER,\n    )\n  ) {\n    throw new PolicyAuthoringError(\n      \"transcript-share-bootstrap-malformed\",\n      \"policy engine record does not support the bootstrap evidence verifier\",\n    );\n  }\n  return {\n    schema: TRANSCRIPT_SHARE_BOOTSTRAP_SCHEMA,\n    policyId: requiredString(normalized, \"policyId\", \"$\"),\n    policyEngine: {\n      endpoint: signedRecord.endpoint,\n      audience: signedRecord.audience,\n      supportedEvidenceVerifiers: [W3C_VC_CREDENTIAL_VERIFIER],\n      signedRecord,\n    },\n    ownerNode: {\n      schema: OWNER_NODE_ENDPOINT_SCHEMA,\n      endpoint: validateOwnerNodeEndpoint(\n        requiredString(normalized, \"ownerNodeEndpoint\", \"$\"),\n      ),\n      spaceId: requiredString(normalized, \"ownerSpaceId\", \"$\"),\n    },\n    resourceHint: requiredObject(normalized, \"resourceHint\", \"$\"),\n  };\n}\n\nfunction validateOwnerNodeEndpoint(value: string): string {\n  let url: URL;\n  try {\n    url = new URL(value);\n  } catch {\n    throw new PolicyAuthoringError(\n      \"transcript-share-bootstrap-malformed\",\n      \"$.ownerNodeEndpoint must be a URL\",\n    );\n  }\n  if (\n    url.protocol !== \"https:\" ||\n    url.username !== \"\" ||\n    url.password !== \"\" ||\n    url.hash !== \"\" ||\n    url.search !== \"\"\n  ) {\n    throw new PolicyAuthoringError(\n      \"transcript-share-bootstrap-malformed\",\n      \"$.ownerNodeEndpoint must be an HTTPS URL without credentials, query, or fragment\",\n    );\n  }\n  return url.toString().replace(/\\/$/, \"\");\n}\n\nfunction validatePolicyEngineEndpoint(value: string): string {\n  let url: URL;\n  try {\n    url = new URL(value);\n  } catch {\n    throw new PolicyAuthoringError(\n      \"policy-authoring-malformed\",\n      \"$.endpoint must be a URL\",\n    );\n  }\n  if (\n    url.protocol !== \"https:\" ||\n    url.username !== \"\" ||\n    url.password !== \"\" ||\n    url.hash !== \"\" ||\n    url.search !== \"\"\n  ) {\n    throw new PolicyAuthoringError(\n      \"policy-authoring-malformed\",\n      \"$.endpoint must be an HTTPS URL without credentials, query, or fragment\",\n    );\n  }\n  return url.toString().replace(/\\/$/, \"\");\n}\n\n/**\n * Requester-side authentication gate for policy-engine endpoints. A requester\n * MUST NOT send credential evidence or call /resolve unless this verification\n * succeeds.\n */\nexport async function verifyPolicyEngineRecordForRequester(\n  options: VerifyPolicyEngineRecordOptions,\n): Promise<PolicyEngineRecord> {\n  const normalized = expectObject(options, \"$\", \"policy-authoring-malformed\");\n  assertExactKeys(\n    normalized,\n    [\n      \"signedRecord\",\n      \"ownerDid\",\n      \"audience\",\n      \"grantIssuerDid\",\n      \"now\",\n      \"requiredPolicyVersion\",\n      \"requiredEvidenceVerifier\",\n    ],\n    \"$\",\n  );\n  if (!hasOwn(normalized, \"signedRecord\")) {\n    throw new PolicyAuthoringError(\n      \"policy-engine-record-absent\",\n      \"$.signedRecord must be present\",\n    );\n  }\n  const signedRecord = normalized[\"signedRecord\"];\n  if (\n    signedRecord === null ||\n    typeof signedRecord !== \"object\" ||\n    Array.isArray(signedRecord)\n  ) {\n    throw new PolicyAuthoringError(\n      \"policy-engine-record-absent\",\n      \"$.signedRecord must be present\",\n    );\n  }\n  const recordObject = signedRecord as JsonObject;\n  const expiresAt = fieldString(\n    recordObject,\n    \"expiresAt\",\n    \"$.signedRecord\",\n    \"policy-engine-record-date-invalid\",\n  );\n  const now = fieldString(\n    normalized,\n    \"now\",\n    \"$\",\n    \"policy-engine-record-date-invalid\",\n  );\n  const expiresMs = parseStrictRfc3339(expiresAt, \"$.signedRecord.expiresAt\");\n  const nowMs = parseStrictRfc3339(now, \"$.now\");\n  if (expiresMs <= nowMs) {\n    throw new PolicyAuthoringError(\n      \"policy-engine-record-expired\",\n      \"$.signedRecord.expiresAt is expired\",\n    );\n  }\n\n  let verified: PolicyEngineRecord;\n  try {\n    verified = (await verifyPolicyEngineRecord(recordObject)).object;\n  } catch (error) {\n    throw new PolicyAuthoringError(\n      \"policy-engine-record-signature-invalid\",\n      error instanceof Error ? error.message : String(error),\n    );\n  }\n  if (verified.signature.signerDid !== verified.ownerDid) {\n    throw new PolicyAuthoringError(\n      \"policy-engine-record-signature-invalid\",\n      \"$.signedRecord.signature.signerDid must match ownerDid for the direct-owner requester profile\",\n    );\n  }\n\n  const expectedOwnerDid = requiredString(normalized, \"ownerDid\", \"$\");\n  if (verified.ownerDid !== expectedOwnerDid) {\n    throw new PolicyAuthoringError(\n      \"policy-engine-record-owner-mismatch\",\n      \"$.signedRecord.ownerDid does not match\",\n    );\n  }\n  const expectedAudience = requiredString(normalized, \"audience\", \"$\");\n  if (verified.audience !== expectedAudience) {\n    throw new PolicyAuthoringError(\n      \"policy-engine-record-audience-mismatch\",\n      \"$.signedRecord.audience does not match\",\n    );\n  }\n  const expectedGrantIssuerDid = requiredString(\n    normalized,\n    \"grantIssuerDid\",\n    \"$\",\n  );\n  if (verified.grantIssuerDid !== expectedGrantIssuerDid) {\n    throw new PolicyAuthoringError(\n      \"policy-engine-record-grant-issuer-mismatch\",\n      \"$.signedRecord.grantIssuerDid does not match\",\n    );\n  }\n  const requiredPolicyVersion = hasOwn(normalized, \"requiredPolicyVersion\")\n    ? requiredString(normalized, \"requiredPolicyVersion\", \"$\")\n    : POLICY_VERSION_V0;\n  if (!verified.supportedPolicyVersions.includes(requiredPolicyVersion)) {\n    throw new PolicyAuthoringError(\n      \"policy-engine-record-policy-version-unsupported\",\n      \"$.signedRecord.supportedPolicyVersions does not include the required version\",\n    );\n  }\n  const requiredEvidenceVerifier = hasOwn(\n    normalized,\n    \"requiredEvidenceVerifier\",\n  )\n    ? requiredString(normalized, \"requiredEvidenceVerifier\", \"$\")\n    : W3C_VC_CREDENTIAL_VERIFIER;\n  if (!verified.supportedEvidenceVerifiers.includes(requiredEvidenceVerifier)) {\n    throw new PolicyAuthoringError(\n      \"policy-engine-record-evidence-verifier-unsupported\",\n      \"$.signedRecord.supportedEvidenceVerifiers does not include the required verifier\",\n    );\n  }\n  return verified;\n}\n\nfunction expectObject(\n  input: unknown,\n  path: string,\n  code: PolicyAuthoringErrorCode,\n): JsonObject {\n  try {\n    const normalized = normalizeJson(input);\n    if (\n      normalized === null ||\n      typeof normalized !== \"object\" ||\n      Array.isArray(normalized)\n    ) {\n      throw new PolicyAuthoringError(code, `${path} must be an object`);\n    }\n    return normalized as JsonObject;\n  } catch (error) {\n    if (error instanceof PolicyAuthoringError) {\n      throw error;\n    }\n    throw new PolicyAuthoringError(\n      code,\n      error instanceof Error ? error.message : String(error),\n    );\n  }\n}\n\nfunction expectPolicyEngineRecord(input: JsonValue): PolicyEngineRecord {\n  if (input === null || typeof input !== \"object\" || Array.isArray(input)) {\n    throw new PolicyAuthoringError(\n      \"transcript-share-bootstrap-malformed\",\n      \"$.policyEngineRecord must be an object\",\n    );\n  }\n  try {\n    return validatePolicyEngineRecordSignedShape(input);\n  } catch (error) {\n    throw new PolicyAuthoringError(\n      \"transcript-share-bootstrap-malformed\",\n      error instanceof Error ? error.message : String(error),\n    );\n  }\n}\n\nfunction assertExactKeys(\n  object: JsonObject,\n  allowed: readonly string[],\n  path: string,\n): void {\n  const allowedSet = new Set(allowed);\n  for (const key of Object.keys(object)) {\n    if (!allowedSet.has(key)) {\n      throw new PolicyAuthoringError(\n        \"policy-authoring-unknown-key\",\n        `${path} has unknown field ${key}`,\n      );\n    }\n  }\n}\n\nfunction requiredValue(\n  object: JsonObject,\n  key: string,\n  path: string,\n): JsonValue {\n  if (!hasOwn(object, key)) {\n    throw new PolicyAuthoringError(\n      \"policy-authoring-malformed\",\n      `${path}.${key} is required`,\n    );\n  }\n  return object[key];\n}\n\nfunction requiredString(object: JsonObject, key: string, path: string): string {\n  const value = requiredValue(object, key, path);\n  if (typeof value !== \"string\" || value.length === 0) {\n    throw new PolicyAuthoringError(\n      \"policy-authoring-malformed\",\n      `${path}.${key} must be a non-empty string`,\n    );\n  }\n  return value;\n}\n\nfunction fieldString(\n  object: JsonObject,\n  key: string,\n  path: string,\n  code: PolicyAuthoringErrorCode,\n): string {\n  if (!hasOwn(object, key)) {\n    throw new PolicyAuthoringError(code, `${path}.${key} is required`);\n  }\n  const value = object[key];\n  if (typeof value !== \"string\" || value.length === 0) {\n    throw new PolicyAuthoringError(\n      code,\n      `${path}.${key} must be a non-empty string`,\n    );\n  }\n  return value;\n}\n\nfunction requiredObject(\n  object: JsonObject,\n  key: string,\n  path: string,\n): JsonObject {\n  const value = requiredValue(object, key, path);\n  if (value === null || typeof value !== \"object\" || Array.isArray(value)) {\n    throw new PolicyAuthoringError(\n      \"policy-authoring-malformed\",\n      `${path}.${key} must be an object`,\n    );\n  }\n  return value as JsonObject;\n}\n\nfunction requiredArray(\n  object: JsonObject,\n  key: string,\n  path: string,\n): readonly JsonValue[] {\n  const value = requiredValue(object, key, path);\n  if (!Array.isArray(value)) {\n    throw new PolicyAuthoringError(\n      \"policy-authoring-malformed\",\n      `${path}.${key} must be an array`,\n    );\n  }\n  return value;\n}\n\nfunction requiredStringArray(\n  object: JsonObject,\n  key: string,\n  path: string,\n): string[] {\n  const values = requiredArray(object, key, path);\n  return values.map((value, index) => {\n    if (typeof value !== \"string\" || value.length === 0) {\n      throw new PolicyAuthoringError(\n        \"policy-authoring-malformed\",\n        `${path}.${key}[${index}] must be a non-empty string`,\n      );\n    }\n    return value;\n  });\n}\n\nfunction validateSupportedPolicyVersions(\n  values: readonly string[],\n  path: string,\n): void {\n  if (values.length === 0) {\n    throw new PolicyAuthoringError(\n      \"policy-authoring-malformed\",\n      `${path} must not be empty`,\n    );\n  }\n  for (let index = 0; index < values.length; index++) {\n    if (values[index] !== POLICY_VERSION_V0) {\n      throw new PolicyAuthoringError(\n        \"policy-authoring-malformed\",\n        `${path}[${index}] is unsupported`,\n      );\n    }\n  }\n}\n\nfunction validateSupportedEvidenceVerifiers(\n  values: readonly string[],\n  path: string,\n): void {\n  if (values.length === 0) {\n    throw new PolicyAuthoringError(\n      \"policy-authoring-malformed\",\n      `${path} must not be empty`,\n    );\n  }\n  for (let index = 0; index < values.length; index++) {\n    if (values[index] !== W3C_VC_CREDENTIAL_VERIFIER) {\n      throw new PolicyAuthoringError(\n        \"policy-authoring-malformed\",\n        `${path}[${index}] is unsupported`,\n      );\n    }\n  }\n}\n\nfunction wrapCapabilityError<T>(fn: () => T): T {\n  try {\n    return fn();\n  } catch (error) {\n    if (error instanceof PolicyCapabilityError) {\n      throw new PolicyAuthoringError(error.code, error.message);\n    }\n    throw error;\n  }\n}\n\nfunction wrapSignedObjectError(error: unknown): Error {\n  if (error instanceof PolicyAuthoringError) {\n    return error;\n  }\n  if (\n    error instanceof SignedObjectSchemaError ||\n    error instanceof SignedObjectProfileError\n  ) {\n    return new PolicyAuthoringError(\n      \"policy-authoring-malformed\",\n      error.message,\n    );\n  }\n  return new PolicyAuthoringError(\n    \"policy-authoring-malformed\",\n    error instanceof Error ? error.message : String(error),\n  );\n}\n\nfunction parseStrictRfc3339(value: string, path: string): number {\n  const match = value.match(\n    /^(\\d{4})-(\\d{2})-(\\d{2})T(\\d{2}):(\\d{2}):(\\d{2})(\\.\\d+)?Z$/,\n  );\n  if (!match) {\n    throw new PolicyAuthoringError(\n      \"policy-engine-record-date-invalid\",\n      `${path} must be strict RFC 3339`,\n    );\n  }\n  const parsed = Date.parse(value);\n  if (Number.isNaN(parsed)) {\n    throw new PolicyAuthoringError(\n      \"policy-engine-record-date-invalid\",\n      `${path} must be parseable`,\n    );\n  }\n  const canonical = new Date(parsed).toISOString().replace(\".000Z\", \"Z\");\n  if (canonical !== value) {\n    throw new PolicyAuthoringError(\n      \"policy-engine-record-date-invalid\",\n      `${path} must be normalizable`,\n    );\n  }\n  return parsed;\n}\n\nconst objectHasOwn: (object: object, propertyKey: PropertyKey) => boolean =\n  (\n    Object as ObjectConstructor & {\n      hasOwn?: (object: object, propertyKey: PropertyKey) => boolean;\n    }\n  ).hasOwn ??\n  (Object.prototype.hasOwnProperty.call.bind(\n    Object.prototype.hasOwnProperty,\n  ) as (object: object, propertyKey: PropertyKey) => boolean);\n\nfunction hasOwn(object: JsonObject, key: string): boolean {\n  return objectHasOwn(object, key);\n}\n"],"mappings":";;;;;;;;;;;;;;;;;;;;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,IAAAA,eAAmC;AACnC,oBAAuB;AACvB,iBAAoB;AACpB,oBAAuC;AAOvC,iBAAkB;;;ACAX,IAAM,2BAAN,cAAuC,MAAM;AAAA,EAGlD,YAAY,MAA6B,SAAiB;AACxD,UAAM,OAAO;AACb,SAAK,OAAO;AACZ,SAAK,OAAO;AAAA,EACd;AACF;AAEO,IAAM,0BAAN,cAAsC,yBAAyB;AAAA,EACpE,YAAY,SAAiB;AAC3B,UAAM,kBAAkB,OAAO;AAC/B,SAAK,OAAO;AAAA,EACd;AACF;AAEO,IAAM,oCAAN,cAAgD,yBAAyB;AAAA,EAC9E,YAAY,SAAiB;AAC3B,UAAM,6BAA6B,OAAO;AAC1C,SAAK,OAAO;AAAA,EACd;AACF;AAEO,IAAM,0BAAN,cAAsC,yBAAyB;AAAA,EACpE,YAAY,SAAiB;AAC3B,UAAM,mBAAmB,OAAO;AAChC,SAAK,OAAO;AAAA,EACd;AACF;AAEO,IAAM,sBAAN,cAAkC,yBAAyB;AAAA,EAChE,YAAY,SAAiB;AAC3B,UAAM,eAAe,OAAO;AAC5B,SAAK,OAAO;AAAA,EACd;AACF;AAEO,IAAM,yBAAN,cAAqC,yBAAyB;AAAA,EACnE,YAAY,SAAiB;AAC3B,UAAM,uBAAuB,OAAO;AACpC,SAAK,OAAO;AAAA,EACd;AACF;AAEO,IAAM,yBAAN,cAAqC,yBAAyB;AAAA,EACnE,YAAY,SAAiB;AAC3B,UAAM,8BAA8B,OAAO;AAC3C,SAAK,OAAO;AAAA,EACd;AACF;AAEO,IAAM,iCAAN,cAA6C,yBAAyB;AAAA,EAC3E,YAAY,SAAiB;AAC3B,UAAM,+BAA+B,OAAO;AAC5C,SAAK,OAAO;AAAA,EACd;AACF;AAEO,IAAM,6BAAN,cAAyC,yBAAyB;AAAA,EACvE,YAAY,SAAiB;AAC3B,UAAM,qBAAqB,OAAO;AAClC,SAAK,OAAO;AAAA,EACd;AACF;;;AC/DA,IAAM,eACH,OAEE,UACF,OAAO,UAAU,eAAe,KAAK;AAAA,EACpC,OAAO,UAAU;AACnB;AAUK,SAAS,gBAAgB,OAAwB;AACtD,SAAO,UAAU,cAAc,OAAO,GAAG,CAAC;AAC5C;AAEO,SAAS,cAAc,OAAgB,OAAO,KAAgB;AACnE,MAAI,UAAU,MAAM;AAClB,WAAO;AAAA,EACT;AAEA,UAAQ,OAAO,OAAO;AAAA,IACpB,KAAK;AACH,aAAO;AAAA,IACT,KAAK;AACH,UAAI,CAAC,OAAO,SAAS,KAAK,GAAG;AAC3B,cAAM,IAAI;AAAA,UACR,GAAG,IAAI;AAAA,QACT;AAAA,MACF;AACA,aAAO;AAAA,IACT,KAAK;AACH,gCAA0B,OAAO,IAAI;AACrC,aAAO;AAAA,IACT,KAAK;AACH,aAAO,2BAA2B,OAAO,IAAI;AAAA,IAC/C,KAAK;AAAA,IACL,KAAK;AAAA,IACL,KAAK;AAAA,IACL,KAAK;AAAA,IACL;AACE,YAAM,IAAI;AAAA,QACR,GAAG,IAAI;AAAA,MACT;AAAA,EACJ;AACF;AAEO,SAAS,UAAU,OAA0B;AAClD,MAAI,UAAU,MAAM;AAClB,WAAO;AAAA,EACT;AAEA,UAAQ,OAAO,OAAO;AAAA,IACpB,KAAK;AACH,aAAO,QAAQ,SAAS;AAAA,IAC1B,KAAK,UAAU;AACb,YAAM,UAAU,KAAK,UAAU,KAAK;AACpC,UAAI,YAAY,QAAW;AACzB,cAAM,IAAI;AAAA,UACR;AAAA,QACF;AAAA,MACF;AACA,aAAO;AAAA,IACT;AAAA,IACA,KAAK;AACH,aAAO,KAAK,UAAU,KAAK;AAAA,IAC7B,KAAK;AACH,UAAI,MAAM,QAAQ,KAAK,GAAG;AACxB,eAAO,IAAI,MAAM,IAAI,CAAC,SAAS,UAAU,IAAI,CAAC,EAAE,KAAK,GAAG,CAAC;AAAA,MAC3D;AACA,aAAO,gBAAgB,KAAK;AAAA,IAC9B;AACE,YAAM,IAAI;AAAA,QACR,+BAA+B,OAAO,KAAK;AAAA,MAC7C;AAAA,EACJ;AACF;AAEA,SAAS,2BAA2B,OAAe,MAAyB;AAC1E,qBAAmB,OAAO,IAAI;AAE9B,MAAI,MAAM,QAAQ,KAAK,GAAG;AACxB,eAAW,OAAO,OAAO,oBAAoB,KAAK,GAAG;AACnD,UAAI,QAAQ,UAAU;AACpB;AAAA,MACF;AACA,UAAI,CAAC,gBAAgB,KAAK,MAAM,MAAM,GAAG;AACvC,cAAM,IAAI;AAAA,UACR,GAAG,IAAI,IAAI,GAAG;AAAA,QAChB;AAAA,MACF;AACA,YAAM,aAAa,OAAO,yBAAyB,OAAO,GAAG;AAC7D,UAAI,YAAY,eAAe,MAAM;AACnC,cAAM,IAAI;AAAA,UACR,GAAG,IAAI,IAAI,GAAG;AAAA,QAChB;AAAA,MACF;AACA,UAAI,EAAE,WAAW,aAAa;AAC5B,cAAM,IAAI;AAAA,UACR,GAAG,IAAI,IAAI,GAAG;AAAA,QAChB;AAAA,MACF;AAAA,IACF;AACA,UAAMC,UAAsB,CAAC;AAC7B,aAAS,QAAQ,GAAG,QAAQ,MAAM,QAAQ,SAAS;AACjD,UAAI,CAAC,aAAa,OAAO,KAAK,GAAG;AAC/B,cAAM,IAAI;AAAA,UACR,GAAG,IAAI,IAAI,KAAK;AAAA,QAClB;AAAA,MACF;AACA,MAAAA,QAAO,KAAK,cAAc,MAAM,KAAK,GAAG,GAAG,IAAI,IAAI,KAAK,GAAG,CAAC;AAAA,IAC9D;AACA,WAAOA;AAAA,EACT;AAEA,QAAM,QAAQ,OAAO,eAAe,KAAK;AACzC,MAAI,UAAU,OAAO,aAAa,UAAU,MAAM;AAChD,UAAM,IAAI;AAAA,MACR,GAAG,IAAI;AAAA,IACT;AAAA,EACF;AAEA,QAAM,SAAS,uBAAO,OAAO,IAAI;AACjC,aAAW,OAAO,OAAO,oBAAoB,KAAK,GAAG;AACnD,8BAA0B,KAAK,GAAG,IAAI,MAAM;AAC5C,QAAI,QAAQ,eAAe,QAAQ,eAAe;AAChD,YAAM,IAAI;AAAA,QACR,GAAG,IAAI,IAAI,GAAG;AAAA,MAChB;AAAA,IACF;AACA,UAAM,aAAa,OAAO,yBAAyB,OAAO,GAAG;AAC7D,QAAI,YAAY,eAAe,MAAM;AACnC,YAAM,IAAI;AAAA,QACR,GAAG,IAAI,IAAI,GAAG;AAAA,MAChB;AAAA,IACF;AACA,QAAI,EAAE,WAAW,aAAa;AAC5B,YAAM,IAAI;AAAA,QACR,GAAG,IAAI,IAAI,GAAG;AAAA,MAChB;AAAA,IACF;AACA,UAAM,QAAQ,WAAW;AACzB,WAAO,GAAG,IAAI,cAAc,OAAO,GAAG,IAAI,IAAI,GAAG,EAAE;AAAA,EACrD;AACA,SAAO;AACT;AAEA,SAAS,mBAAmB,OAAe,MAAoB;AAC7D,MAAI,OAAO,sBAAsB,KAAK,EAAE,SAAS,GAAG;AAClD,UAAM,IAAI;AAAA,MACR,GAAG,IAAI;AAAA,IACT;AAAA,EACF;AACF;AAEA,SAAS,gBAAgB,KAAa,QAAyB;AAC7D,MAAI,CAAC,iBAAiB,KAAK,GAAG,GAAG;AAC/B,WAAO;AAAA,EACT;AACA,QAAM,QAAQ,OAAO,GAAG;AACxB,SAAO,OAAO,cAAc,KAAK,KAAK,SAAS,KAAK,QAAQ;AAC9D;AAEA,SAAS,gBAAgB,OAAsD;AAC7E,QAAM,OAAO,OAAO,KAAK,KAAK,EAAE,KAAK,iBAAiB;AACtD,QAAM,QAAQ,KAAK,IAAI,CAAC,QAAQ,GAAG,KAAK,UAAU,GAAG,CAAC,IAAI,UAAU,MAAM,GAAG,CAAC,CAAC,EAAE;AACjF,SAAO,IAAI,MAAM,KAAK,GAAG,CAAC;AAC5B;AAEA,SAAS,kBAAkB,GAAW,GAAmB;AACvD,QAAM,OAAO,MAAM,KAAK,CAAC;AACzB,QAAM,QAAQ,MAAM,KAAK,CAAC;AAC1B,QAAM,MAAM,KAAK,IAAI,KAAK,QAAQ,MAAM,MAAM;AAC9C,WAAS,QAAQ,GAAG,QAAQ,KAAK,SAAS;AACxC,UAAM,YAAY,KAAK,KAAK,EAAE,YAAY,CAAC,KAAK;AAChD,UAAM,aAAa,MAAM,KAAK,EAAE,YAAY,CAAC,KAAK;AAClD,QAAI,cAAc,YAAY;AAC5B,aAAO,YAAY;AAAA,IACrB;AAAA,EACF;AACA,SAAO,KAAK,SAAS,MAAM;AAC7B;AAEA,SAAS,0BAA0B,OAAe,MAAoB;AACpE,WAAS,QAAQ,GAAG,QAAQ,MAAM,QAAQ,SAAS;AACjD,UAAM,OAAO,MAAM,WAAW,KAAK;AACnC,QAAI,QAAQ,SAAU,QAAQ,OAAQ;AACpC,YAAM,OAAO,MAAM,WAAW,QAAQ,CAAC;AACvC,UAAI,OAAO,MAAM,IAAI,KAAK,OAAO,SAAU,OAAO,OAAQ;AACxD,cAAM,IAAI;AAAA,UACR,GAAG,IAAI;AAAA,QACT;AAAA,MACF;AACA;AACA;AAAA,IACF;AACA,QAAI,QAAQ,SAAU,QAAQ,OAAQ;AACpC,YAAM,IAAI;AAAA,QACR,GAAG,IAAI;AAAA,MACT;AAAA,IACF;AAAA,EACF;AACF;;;ACzNA,uBAAoC;AACpC,kBAAmC;AAInC,IAAM,cAAc,IAAI,YAAY;AAY7B,IAAM,wBAAN,cAAoC,MAAM;AAAA,EAG/C,YAAY,MAAiC,SAAiB;AAC5D,UAAM,OAAO;AACb,SAAK,OAAO;AACZ,SAAK,OAAO;AAAA,EACd;AACF;AAiBA,IAAMC,gBACH,OAEE,UACF,OAAO,UAAU,eAAe,KAAK;AAAA,EACpC,OAAO,UAAU;AACnB;AAEF,IAAM,mBAAmB,oBAAI,IAAI,CAAC,gBAAgB,iBAAiB,eAAe,CAAC;AACnF,IAAM,oBAAoB,oBAAI,IAAiC;AAE/D,WAAW,SAAS,sCAAqB;AACvC,MAAI,CAAC,iBAAiB,IAAI,MAAM,OAAO,GAAG;AACxC;AAAA,EACF;AACA,MAAI,MAAM,YAAY,UAAa,MAAM,YAAY,UAAa,MAAM,IAAI,SAAS,IAAI,GAAG;AAC1F;AAAA,EACF;AACA,QAAM,WAAW,kBAAkB,IAAI,MAAM,OAAO;AACpD,MAAI,aAAa,QAAW;AAC1B,sBAAkB,IAAI,MAAM,SAAS,oBAAI,IAAI,CAAC,MAAM,GAAG,CAAC,CAAC;AACzD;AAAA,EACF;AACA,EAAC,SAAyB,IAAI,MAAM,GAAG;AACzC;AAOO,SAAS,0BAA0B,OAAkC;AAC1E,SAAO,qCAAqC,OAAO,EAAE,kBAAkB,KAAK,CAAC;AAC/E;AAOO,SAAS,6BAA6B,OAAkC;AAC7E,SAAO,qCAAqC,OAAO,EAAE,kBAAkB,KAAK,CAAC;AAC/E;AAYO,SAAS,yBAAyB,WAAoB,SAA2B;AACtF,MAAI;AACJ,MAAI;AACJ,MAAI;AACF,WAAO,6BAA6B,SAAS;AAC7C,UAAM,6BAA6B,OAAO;AAAA,EAC5C,QAAQ;AACN,WAAO;AAAA,EACT;AACA,MAAI,KAAK,YAAY,IAAI,WAAW,KAAK,UAAU,IAAI,OAAO;AAC5D,WAAO;AAAA,EACT;AACA,MAAI,CAAC,aAAa,KAAK,MAAM,IAAI,IAAI,GAAG;AACtC,WAAO;AAAA,EACT;AACA,QAAM,cAAc,IAAI,IAAI,KAAK,OAAO;AACxC,aAAW,UAAU,IAAI,SAAS;AAChC,QAAI,CAAC,YAAY,IAAI,MAAM,GAAG;AAC5B,aAAO;AAAA,IACT;AAAA,EACF;AACA,SAAO,eAAe,KAAK,SAAS,IAAI,OAAO;AACjD;AAEA,SAAS,qCACP,OACA,SACkB;AAClB,QAAM,SAAS,aAAa,OAAO,GAAG;AACtC,kBAAgB,QAAQ,CAAC,WAAW,SAAS,QAAQ,WAAW,SAAS,GAAG,GAAG;AAC/E,QAAM,UAAU,eAAe,QAAQ,WAAW,KAAK,qCAAqC;AAC5F,MAAI,CAAC,iBAAiB,IAAI,OAAO,GAAG;AAClC,UAAM,IAAI;AAAA,MACR;AAAA,MACA;AAAA,IACF;AAAA,EACF;AACA,QAAM,QAAQ,eAAe,QAAQ,SAAS,KAAK,mCAAmC;AACtF,wBAAsB,KAAK;AAC3B,QAAM,iBAAiB,MAAM,UAAU,KAAK;AAC5C,MAAI,QAAQ,oBAAoB,mBAAmB,OAAO;AACxD,UAAM,IAAI;AAAA,MACR;AAAA,MACA;AAAA,IACF;AAAA,EACF;AACA,QAAM,UAAU,eAAe,QAAQ,QAAQ,KAAK,kCAAkC;AACtF,kBAAgB,SAAS,OAAO;AAChC,QAAM,OAAO,cAAc,OAAO;AAClC,MAAI,QAAQ,oBAAoB,SAAS,SAAS;AAChD,UAAM,IAAI;AAAA,MACR;AAAA,MACA;AAAA,IACF;AAAA,EACF;AACA,kBAAgB,MAAM,OAAO;AAC7B,QAAM,UAAU;AAAA,IACd,cAAc,QAAQ,WAAW,KAAK,oCAAoC;AAAA,IAC1E;AAAA,IACA;AAAA,EACF;AACA,QAAM,SAAS,uBAAO,OAAO,IAAI;AAOjC,SAAO,UAAU;AACjB,SAAO,QAAQ;AACf,SAAO,OAAO;AACd,SAAO,UAAU;AACjB,MAAI,OAAO,QAAQ,SAAS,GAAG;AAC7B,WAAO,UAAU;AAAA,MACf,cAAc,QAAQ,WAAW,KAAK,qCAAqC;AAAA,MAC3E,OAAO;AAAA,IACT;AAAA,EACF;AACA,SAAO;AACT;AAEA,SAAS,aAAa,OAAgB,MAA0B;AAC9D,MAAI;AACF,UAAM,aAAa,cAAc,KAAK;AACtC,QAAI,eAAe,QAAQ,OAAO,eAAe,YAAY,MAAM,QAAQ,UAAU,GAAG;AACtF,YAAM,IAAI,sBAAsB,+BAA+B,GAAG,IAAI,oBAAoB;AAAA,IAC5F;AACA,WAAO;AAAA,EACT,SAAS,OAAO;AACd,QAAI,iBAAiB,uBAAuB;AAC1C,YAAM;AAAA,IACR;AACA,UAAM,IAAI;AAAA,MACR;AAAA,MACA,iBAAiB,QAAQ,MAAM,UAAU,OAAO,KAAK;AAAA,IACvD;AAAA,EACF;AACF;AAEA,SAAS,gBAAgB,QAAoB,SAA4B,MAAoB;AAC3F,QAAM,aAAa,IAAI,IAAI,OAAO;AAClC,aAAW,OAAO,OAAO,KAAK,MAAM,GAAG;AACrC,QAAI,CAAC,WAAW,IAAI,GAAG,GAAG;AACxB,YAAM,IAAI;AAAA,QACR,QAAQ,QAAQ,QAAQ,UAAU,gCAAgC;AAAA,QAClE,GAAG,IAAI,sBAAsB,GAAG;AAAA,MAClC;AAAA,IACF;AAAA,EACF;AACF;AAEA,SAAS,cACP,QACA,KACA,MACA,MACW;AACX,MAAI,CAAC,OAAO,QAAQ,GAAG,GAAG;AACxB,UAAM,IAAI,sBAAsB,MAAM,GAAG,IAAI,IAAI,GAAG,cAAc;AAAA,EACpE;AACA,SAAO,OAAO,GAAG;AACnB;AAEA,SAAS,eACP,QACA,KACA,MACA,MACQ;AACR,QAAM,QAAQ,cAAc,QAAQ,KAAK,MAAM,IAAI;AACnD,MAAI,OAAO,UAAU,YAAY,MAAM,WAAW,GAAG;AACnD,UAAM,IAAI,sBAAsB,MAAM,GAAG,IAAI,IAAI,GAAG,6BAA6B;AAAA,EACnF;AACA,SAAO;AACT;AAEA,SAAS,cACP,QACA,KACA,MACA,MACsB;AACtB,QAAM,QAAQ,cAAc,QAAQ,KAAK,MAAM,IAAI;AACnD,MAAI,CAAC,MAAM,QAAQ,KAAK,GAAG;AACzB,UAAM,IAAI,sBAAsB,MAAM,GAAG,IAAI,IAAI,GAAG,mBAAmB;AAAA,EACzE;AACA,SAAO;AACT;AAEA,SAAS,sBAAsB,OAAqB;AAClD,MAAI,UAAU,OAAO,MAAM,SAAS,GAAG,KAAK,MAAM,SAAS,GAAG,KAAK,MAAM,SAAS,GAAG,GAAG;AACtF,UAAM,IAAI;AAAA,MACR;AAAA,MACA;AAAA,IACF;AAAA,EACF;AACF;AAEA,SAAS,gBAAgB,MAAc,SAAiC;AACtE,MAAI,KAAK,WAAW,GAAG;AACrB,UAAM,IAAI,sBAAsB,oCAAoC,iBAAiB;AAAA,EACvF;AACA,MAAI,CAAC,QAAQ,oBAAoB,KAAK,SAAS,GAAG,GAAG;AACnD,UAAM,IAAI;AAAA,MACR;AAAA,MACA;AAAA,IACF;AAAA,EACF;AACA,MAAI,KAAK,SAAS,IAAI,KAAK,KAAK,SAAS,IAAI,GAAG;AAC9C,UAAM,IAAI,sBAAsB,oCAAoC,yBAAyB;AAAA,EAC/F;AACA,QAAM,WAAW,KAAK,MAAM,GAAG;AAC/B,WAAS,QAAQ,GAAG,QAAQ,SAAS,QAAQ,SAAS;AACpD,UAAM,UAAU,SAAS,KAAK;AAC9B,UAAM,0BACJ,QAAQ,oBAAoB,UAAU,SAAS,SAAS,KAAK,QAAQ,WAAW;AAClF,QAAI,QAAQ,WAAW,KAAK,CAAC,yBAAyB;AACpD,YAAM,IAAI,sBAAsB,oCAAoC,6BAA6B;AAAA,IACnG;AACA,QAAI,YAAY,OAAO,YAAY,MAAM;AACvC,YAAM,IAAI;AAAA,QACR;AAAA,QACA;AAAA,MACF;AAAA,IACF;AACA,QAAI,YAAY,OAAO,YAAY,OAAO,QAAQ,SAAS,GAAG,KAAK,QAAQ,SAAS,GAAG,GAAG;AACxF,YAAM,IAAI;AAAA,QACR;AAAA,QACA;AAAA,MACF;AAAA,IACF;AAAA,EACF;AACF;AAEA,SAAS,cAAc,MAAsB;AAC3C,SAAO,iBAAiB,IAAI,EAAE,UAAU,KAAK;AAC/C;AAEA,SAAS,iBAAiB,MAAsB;AAC9C,SAAO,KAAK,QAAQ,oBAAoB,CAAC,YAAY;AACnD,UAAM,OAAO,OAAO,aAAa,OAAO,SAAS,QAAQ,MAAM,CAAC,GAAG,EAAE,CAAC;AACtE,WAAO,oBAAoB,KAAK,IAAI,IAAI,OAAO,QAAQ,YAAY;AAAA,EACrE,CAAC;AACH;AAEA,SAAS,iBACP,SACA,SACA,SACU;AACV,QAAM,WAAW,kBAAkB,IAAI,OAAO;AAC9C,MAAI,aAAa,QAAW;AAC1B,UAAM,IAAI;AAAA,MACR;AAAA,MACA;AAAA,IACF;AAAA,EACF;AACA,QAAM,SAAS,oBAAI,IAAY;AAC/B,QAAM,aAAuB,CAAC;AAC9B,WAAS,QAAQ,GAAG,QAAQ,QAAQ,QAAQ,SAAS;AACnD,UAAM,SAAS,QAAQ,KAAK;AAC5B,QAAI,OAAO,WAAW,YAAY,OAAO,WAAW,GAAG;AACrD,YAAM,IAAI;AAAA,QACR;AAAA,QACA,aAAa,KAAK;AAAA,MACpB;AAAA,IACF;AACA,QAAI,CAAC,OAAO,WAAW,GAAG,OAAO,GAAG,KAAK,OAAO,SAAS,GAAG,KAAK,CAAC,SAAS,IAAI,MAAM,GAAG;AACtF,YAAM,IAAI;AAAA,QACR;AAAA,QACA,aAAa,KAAK;AAAA,MACpB;AAAA,IACF;AACA,eAAW,KAAK,MAAM;AACtB,WAAO,IAAI,MAAM;AAAA,EACnB;AACA,MAAI,OAAO,SAAS,GAAG;AACrB,UAAM,IAAI;AAAA,MACR;AAAA,MACA;AAAA,IACF;AAAA,EACF;AACA,QAAM,oBAAoB,CAAC,GAAG,MAAM,EAAE,KAAK;AAC3C,MACE,QAAQ,qBACP,WAAW,WAAW,kBAAkB,UACvC,WAAW,KAAK,CAAC,QAAQ,UAAU,WAAW,kBAAkB,KAAK,CAAC,IACxE;AACA,UAAM,IAAI;AAAA,MACR;AAAA,MACA;AAAA,IACF;AAAA,EACF;AACA,SAAO;AACT;AAEA,SAAS,gBAAgB,OAAkB,SAAkD;AAC3F,MAAI,UAAU,QAAQ,OAAO,UAAU,YAAY,MAAM,QAAQ,KAAK,GAAG;AACvE,UAAM,IAAI;AAAA,MACR;AAAA,MACA;AAAA,IACF;AAAA,EACF;AACA,MAAI,YAAY,iBAAiB;AAC/B,WAAO,mBAAmB,KAAmB;AAAA,EAC/C;AACA,QAAM,IAAI;AAAA,IACR;AAAA,IACA;AAAA,EACF;AACF;AAEA,SAAS,mBAAmB,OAA+B;AACzD,mBAAiB,OAAO,CAAC,QAAQ,YAAY,YAAY,GAAG,WAAW;AACvE,QAAM,OAAO,aAAa,OAAO,QAAQ,WAAW;AACpD,MAAI,SAAS,0BAA0B;AACrC,UAAM,IAAI;AAAA,MACR;AAAA,MACA;AAAA,IACF;AAAA,EACF;AACA,MAAI,eAAe,OAAO,YAAY,WAAW,MAAM,MAAM;AAC3D,UAAM,IAAI;AAAA,MACR;AAAA,MACA;AAAA,IACF;AAAA,EACF;AACA,QAAM,aAAa,eAAe,OAAO,cAAc,WAAW;AAClE,MAAI,CAAC,MAAM,QAAQ,UAAU,KAAK,WAAW,WAAW,GAAG;AACzD,UAAM,IAAI;AAAA,MACR;AAAA,MACA;AAAA,IACF;AAAA,EACF;AACA,WAAS,QAAQ,GAAG,QAAQ,WAAW,QAAQ,SAAS;AACtD,yBAAqB,WAAW,KAAK,GAAG,wBAAwB,KAAK,GAAG;AAAA,EAC1E;AACA,SAAO;AACT;AAEA,SAAS,qBAAqB,OAAkB,MAAoB;AAClE,MAAI,UAAU,QAAQ,OAAO,UAAU,YAAY,MAAM,QAAQ,KAAK,GAAG;AACvE,UAAM,IAAI,sBAAsB,uCAAuC,GAAG,IAAI,oBAAoB;AAAA,EACpG;AACA,QAAM,SAAS;AACf,mBAAiB,QAAQ,CAAC,QAAQ,OAAO,aAAa,GAAG,IAAI;AAC7D,eAAa,QAAQ,QAAQ,IAAI;AACjC,eAAa,QAAQ,OAAO,IAAI;AAChC,QAAM,cAAc,eAAe,QAAQ,eAAe,IAAI;AAC9D,MAAI,CAAC,MAAM,QAAQ,WAAW,GAAG;AAC/B,UAAM,IAAI;AAAA,MACR;AAAA,MACA,GAAG,IAAI;AAAA,IACT;AAAA,EACF;AACA,WAAS,QAAQ,GAAG,QAAQ,YAAY,QAAQ,SAAS;AACvD,uBAAmB,YAAY,KAAK,GAAG,GAAG,IAAI,gBAAgB,KAAK,GAAG;AAAA,EACxE;AACF;AAEA,SAAS,mBAAmB,OAAkB,MAAoB;AAChE,MAAI,UAAU,QAAQ,OAAO,UAAU,YAAY,MAAM,QAAQ,KAAK,GAAG;AACvE,UAAM,IAAI,sBAAsB,uCAAuC,GAAG,IAAI,oBAAoB;AAAA,EACpG;AACA,QAAM,SAAS;AACf,mBAAiB,QAAQ,CAAC,SAAS,OAAO,GAAG,IAAI;AACjD,QAAM,QAAQ,eAAe,QAAQ,SAAS,IAAI;AAClD,MAAI,OAAO,UAAU,YAAY,CAAC,OAAO,cAAc,KAAK,KAAK,QAAQ,GAAG;AAC1E,UAAM,IAAI;AAAA,MACR;AAAA,MACA,GAAG,IAAI;AAAA,IACT;AAAA,EACF;AACA,iBAAe,QAAQ,SAAS,IAAI;AACtC;AAEA,SAAS,iBAAiB,QAAoB,SAA4B,MAAoB;AAC5F,QAAM,aAAa,IAAI,IAAI,OAAO;AAClC,aAAW,OAAO,OAAO,KAAK,MAAM,GAAG;AACrC,QAAI,CAAC,WAAW,IAAI,GAAG,GAAG;AACxB,YAAM,IAAI;AAAA,QACR;AAAA,QACA,GAAG,IAAI,sBAAsB,GAAG;AAAA,MAClC;AAAA,IACF;AAAA,EACF;AACF;AAEA,SAAS,eAAe,QAAoB,KAAa,MAAyB;AAChF,MAAI,CAAC,OAAO,QAAQ,GAAG,GAAG;AACxB,UAAM,IAAI;AAAA,MACR;AAAA,MACA,GAAG,IAAI,IAAI,GAAG;AAAA,IAChB;AAAA,EACF;AACA,SAAO,OAAO,GAAG;AACnB;AAEA,SAAS,aAAa,QAAoB,KAAa,MAAsB;AAC3E,QAAM,QAAQ,eAAe,QAAQ,KAAK,IAAI;AAC9C,MAAI,OAAO,UAAU,YAAY,MAAM,WAAW,GAAG;AACnD,UAAM,IAAI;AAAA,MACR;AAAA,MACA,GAAG,IAAI,IAAI,GAAG;AAAA,IAChB;AAAA,EACF;AACA,SAAO;AACT;AAEA,SAAS,aAAa,WAAmB,SAA0B;AACjE,MAAI,cAAc,SAAS;AACzB,WAAO;AAAA,EACT;AACA,SAAO,UAAU,SAAS,GAAG,KAAK,QAAQ,WAAW,SAAS;AAChE;AAEA,SAAS,eAAe,WAAmC,SAA0C;AACnG,MAAI,cAAc,QAAW;AAC3B,WAAO,YAAY;AAAA,EACrB;AACA,MAAI,YAAY,QAAW;AACzB,WAAO,OAAO,KAAK,SAAS,EAAE,WAAW;AAAA,EAC3C;AACA,MAAI,UAAU,SAAS,4BAA4B,QAAQ,SAAS,0BAA0B;AAC5F,WAAO;AAAA,EACT;AACA,QAAM,sBAAsB,MAAM,QAAQ,UAAU,UAAU,IAAI,UAAU,aAAa,CAAC;AAC1F,QAAM,oBAAoB,MAAM,QAAQ,QAAQ,UAAU,IAAI,QAAQ,aAAa,CAAC;AACpF,SAAO,kBAAkB;AAAA,IAAM,CAAC,cAC9B,oBAAoB,KAAK,CAAC,cAAc,gBAAgB,SAAS,MAAM,gBAAgB,SAAS,CAAC;AAAA,EACnG;AACF;AAEA,SAAS,OAAO,QAAoB,KAAsB;AACxD,SAAOC,cAAa,QAAQ,GAAG;AACjC;;;AC3eA,qBAAwB;AACxB,oBAAsB;AACtB,IAAAC,eAAkD;;;ACFlD,IAAAC,eAAsC;AAmB/B,IAAM,qBAAN,cAAiC,MAAM;AAAA,EAC5C,YAAY,SAAiB;AAC3B,UAAM,OAAO;AACb,SAAK,OAAO;AAAA,EACd;AACF;AAEA,IAAM,aAAa;AAcnB,SAAS,mBAAmB,SAAuB;AACjD,MAAI,CAAC,OAAO,cAAc,OAAO,KAAK,WAAW,GAAG;AAClD,UAAM,IAAI,mBAAmB,6BAA6B,OAAO,EAAE;AAAA,EACrE;AACF;AAEO,SAAS,aAAa,OAAwB;AACnD,aAAO,wBAAU,OAAO,EAAE,QAAQ,MAAM,CAAC;AAC3C;AAEO,SAAS,oBAAoB,SAAmC;AACrE,MAAI,CAAC,aAAa,OAAO,GAAG;AAC1B,UAAM,IAAI,mBAAmB,wBAAwB,OAAO,EAAE;AAAA,EAChE;AACA,aAAO,yBAAW,OAAO;AAC3B;AAWO,SAAS,YAAY,KAAiC;AAC3D,QAAM,QAAQ,IAAI,MAAM,UAAU;AAClC,MAAI,CAAC,MAAO,QAAO;AAEnB,QAAM,UAAU,OAAO,MAAM,CAAC,CAAC;AAC/B,qBAAmB,OAAO;AAE1B,SAAO;AAAA,IACL,QAAQ;AAAA,IACR,WAAW;AAAA,IACX;AAAA,IACA,SAAS,oBAAoB,MAAM,CAAC,CAAC;AAAA,EACvC;AACF;;;AD7DO,IAAM,gBAAgB;AACtB,IAAM,uBAAuB;AAC7B,IAAM,8BACX;AAEK,IAAM,8BAA8B;AACpC,IAAM,6BACX;AA0GF,IAAM,cAA0D;AAAA,EAC9D,QAAQ;AAAA,IACN,MAAM;AAAA,IACN,QAAQ;AAAA,IACR,SAAS;AAAA,IACT,UAAU;AAAA,IACV,QAAQ;AAAA,EACV;AAAA,EACA,cAAc;AAAA,IACZ,MAAM;AAAA,IACN,QAAQ;AAAA,IACR,SAAS;AAAA,IACT,UAAU;AAAA,IACV,QAAQ;AAAA,EACV;AAAA,EACA,oBAAoB;AAAA,IAClB,MAAM;AAAA,IACN,QAAQ;AAAA,IACR,SAAS;AAAA,IACT,UAAU;AAAA,IACV,QAAQ;AAAA,EACV;AACF;AAEA,IAAMC,eAAc,IAAI,YAAY;AACpC,IAAM,kBAAkB;AACxB,IAAM,eAAe;AACrB,IAAMC,gBACH,OAEE,UACF,OAAO,UAAU,eAAe,KAAK;AAAA,EACpC,OAAO,UAAU;AACnB;AA2EF,eAAsB,mBACpB,OACyE;AACzE,QAAM,SAAS,0BAA0B,KAAK;AAC9C,QAAM,aAAa;AACnB,QAAM,aAAa,oBAAoB,OAAO,MAAM;AACpD,QAAM,YAAY,kBAAkB,OAAO,SAAS;AACpD,mCAAiC,YAAY,SAAS;AACtD,QAAM,WAAW,uBAAuB,YAAY,UAAU;AAC9D,QAAM,WAAW,oBAAoB,UAAU,UAAU;AACzD,kBAAgB,YAAY,UAAU,UAAU;AAChD,MAAI,CAAE,MAAM,gBAAgB,WAAW,SAAS,MAAM,GAAI;AACxD,UAAM,IAAI,2BAA2B,+BAA+B;AAAA,EACtE;AACA,SAAO,EAAE,QAAQ,QAAQ,SAAS;AACpC;AAsBA,eAAsB,yBACpB,OACyE;AACzE,QAAM,SAAS,MAAM,mBAAmB,KAAK;AAC7C,SAAO;AAAA,IACL,QAAQ,sCAAsC,OAAO,MAAM;AAAA,IAC3D,UAAU,OAAO;AAAA,EACnB;AACF;AAiDO,SAAS,0BAA0B,OAAwB;AAChE,SAAO,oBAAoB,OAAO,IAAI;AACxC;AAEO,SAAS,gCAAgC,OAA8B;AAC5E,SAAO,0BAA0B,OAAO,IAAI;AAC9C;AAEO,SAAS,sCACd,OACoB;AACpB,SAAO,gCAAgC,OAAO,IAAI;AACpD;AAEA,SAAS,0BAA0B,OAAoC;AACrE,QAAM,aAAa,iBAAiB,cAAc,KAAK,GAAG,GAAG;AAC7D,QAAM,SAASC,gBAAe,YAAY,UAAU,GAAG;AACvD,QAAM,aAAa,oBAAoB,MAAM;AAC7C,UAAQ,WAAW,MAAM;AAAA,IACvB,KAAK;AACH,aAAO,0BAA0B,UAAU;AAAA,IAC7C,KAAK;AACH,aAAO,gCAAgC,UAAU;AAAA,IACnD,KAAK;AACH,aAAO,sCAAsC,UAAU;AAAA,EAC3D;AACF;AAgBA,SAAS,oBAAoB,OAAgB,QAA6B;AACxE,QAAM,SAAS,iBAAiB,cAAc,KAAK,GAAG,GAAG;AACzD,EAAAC;AAAA,IACE;AAAA,IACA,SACI;AAAA,MACE;AAAA,MACA;AAAA,MACA;AAAA,MACA;AAAA,MACA;AAAA,MACA;AAAA,MACA;AAAA,MACA;AAAA,MACA;AAAA,MACA;AAAA,MACA;AAAA,MACA;AAAA,IACF,IACA;AAAA,MACE;AAAA,MACA;AAAA,MACA;AAAA,MACA;AAAA,MACA;AAAA,MACA;AAAA,MACA;AAAA,MACA;AAAA,MACA;AAAA,MACA;AAAA,IACF;AAAA,IACJ;AAAA,EACF;AACA,cAAYC,gBAAe,QAAQ,UAAU,GAAG,GAAG,eAAe,UAAU;AAC5E,MAAI,QAAQ;AACV,IAAAA,gBAAe,QAAQ,YAAY,GAAG;AACtC,sBAAkBC,eAAc,QAAQ,aAAa,GAAG,CAAC;AAAA,EAC3D;AACA,EAAAD,gBAAe,QAAQ,YAAY,GAAG;AACtC,EAAAA,gBAAe,QAAQ,iBAAiB,GAAG;AAC3C,qBAAmB,QAAQ,aAAa,GAAG;AAC3C,qBAAmB,QAAQ,aAAa,GAAG;AAC3C,yBAAuBC,eAAc,QAAQ,YAAY,GAAG,GAAG,YAAY;AAC3E,qBAAmBA,eAAc,QAAQ,QAAQ,GAAG,GAAG,QAAQ;AAC/D,gBAAcA,eAAc,QAAQ,SAAS,GAAG,GAAG,SAAS;AAC5D,MAAIC,QAAO,QAAQ,YAAY,GAAG;AAChC,uBAAmBD,eAAc,QAAQ,cAAc,GAAG,GAAG,cAAc;AAAA,EAC7E;AACA,MAAIC,QAAO,QAAQ,OAAO,GAAG;AAC3B,kBAAcD,eAAc,QAAQ,SAAS,GAAG,GAAG,SAAS;AAAA,EAC9D;AACA,SAAO;AACT;AAEA,SAAS,0BAA0B,OAAgB,QAA6B;AAC9E,QAAM,SAAS,iBAAiB,cAAc,KAAK,GAAG,GAAG;AACzD,EAAAF;AAAA,IACE;AAAA,IACA,SACI;AAAA,MACE;AAAA,MACA;AAAA,MACA;AAAA,MACA;AAAA,MACA;AAAA,MACA;AAAA,MACA;AAAA,MACA;AAAA,MACA;AAAA,MACA;AAAA,IACF,IACA;AAAA,MACE;AAAA,MACA;AAAA,MACA;AAAA,MACA;AAAA,MACA;AAAA,MACA;AAAA,MACA;AAAA,MACA;AAAA,IACF;AAAA,IACJ;AAAA,EACF;AACA,cAAYC,gBAAe,QAAQ,UAAU,GAAG,GAAG,sBAAsB,UAAU;AACnF,MAAI,QAAQ;AACV,IAAAA,gBAAe,QAAQ,YAAY,GAAG;AACtC,sBAAkBC,eAAc,QAAQ,aAAa,GAAG,CAAC;AAAA,EAC3D;AACA,EAAAD,gBAAe,QAAQ,YAAY,GAAG;AACtC,EAAAA,gBAAe,QAAQ,YAAY,GAAG;AACtC,kBAAgB,QAAQ,YAAY,KAAK,CAAC;AAC1C,cAAYA,gBAAe,QAAQ,eAAe,GAAG,GAAG;AAAA,IACtD;AAAA,IACA;AAAA,IACA;AAAA,EACF,GAAG,eAAe;AAClB,qBAAmB,QAAQ,eAAe,GAAG;AAC7C,iBAAe,QAAQ,cAAc,GAAG;AACxC,EAAAA,gBAAe,QAAQ,iBAAiB,GAAG;AAC3C,SAAO;AACT;AAEA,SAAS,gCACP,OACA,QACY;AACZ,QAAM,SAAS,iBAAiB,cAAc,KAAK,GAAG,GAAG;AACzD,EAAAD;AAAA,IACE;AAAA,IACA,SACI;AAAA,MACE;AAAA,MACA;AAAA,MACA;AAAA,MACA;AAAA,MACA;AAAA,MACA;AAAA,MACA;AAAA,MACA;AAAA,MACA;AAAA,MACA;AAAA,IACF,IACA;AAAA,MACE;AAAA,MACA;AAAA,MACA;AAAA,MACA;AAAA,MACA;AAAA,MACA;AAAA,MACA;AAAA,MACA;AAAA,IACF;AAAA,IACJ;AAAA,EACF;AACA;AAAA,IACEC,gBAAe,QAAQ,UAAU,GAAG;AAAA,IACpC;AAAA,IACA;AAAA,EACF;AACA,MAAI,QAAQ;AACV,IAAAA,gBAAe,QAAQ,kBAAkB,GAAG;AAC5C,sBAAkBC,eAAc,QAAQ,aAAa,GAAG,CAAC;AAAA,EAC3D;AACA,EAAAD,gBAAe,QAAQ,YAAY,GAAG;AACtC,EAAAA,gBAAe,QAAQ,YAAY,GAAG;AACtC,EAAAA,gBAAe,QAAQ,YAAY,GAAG;AACtC;AAAA,IAAoB;AAAA,IAAQ;AAAA,IAA2B;AAAA,IAAK,CAAC,OAAO,SAClE,YAAY,OAAO,MAAM,IAAI;AAAA,EAC/B;AACA,sBAAoB,QAAQ,8BAA8B,GAAG;AAC7D,EAAAA,gBAAe,QAAQ,kBAAkB,GAAG;AAC5C,qBAAmB,QAAQ,aAAa,GAAG;AAC3C,SAAO;AACT;AAEA,SAAS,kBAAkB,OAAuC;AAChE,QAAM,SAAS,iBAAiB,OAAO,aAAa;AACpD,EAAAD,iBAAgB,QAAQ,CAAC,SAAS,aAAa,OAAO,GAAG,aAAa;AACtE,QAAM,QAAQC,gBAAe,QAAQ,SAAS,aAAa;AAC3D,gCAA8B,KAAK;AACnC,QAAM,YAAYA,gBAAe,QAAQ,aAAa,aAAa;AACnE,QAAM,QAAQA,gBAAe,QAAQ,SAAS,aAAa;AAC3D,uBAAqB,OAAO,KAAK;AACjC,SAAO,EAAE,OAAO,WAAW,MAAM;AACnC;AAEA,SAAS,uBAAuB,OAAgB,MAAoB;AAClE,QAAM,SAAS,iBAAiB,OAAO,IAAI;AAC3C,EAAAD,iBAAgB,QAAQ,CAAC,gBAAgB,cAAc,oBAAoB,GAAG,IAAI;AAClF,EAAAC,gBAAe,QAAQ,gBAAgB,IAAI;AAC3C,EAAAA,gBAAe,QAAQ,cAAc,IAAI;AACzC,QAAM,UAAUG,eAAc,QAAQ,sBAAsB,MAAM,CAAC;AACnE,WAAS,QAAQ,GAAG,QAAQ,QAAQ,QAAQ,SAAS;AACnD,6BAAyB,QAAQ,KAAK,GAAG,GAAG,IAAI,uBAAuB,KAAK,GAAG;AAAA,EACjF;AACF;AAaA,SAAS,yBAAyB,OAAgB,MAAoB;AACpE,QAAM,SAAS,iBAAiB,OAAO,IAAI;AAC3C,MAAI;AACF,UAAM,YAAY,6BAA6B,MAAM;AACrD,QAAI,gBAAgB,MAAM,MAAM,gBAAgB,SAAS,GAAG;AAC1D,YAAM,IAAI,wBAAwB,GAAG,IAAI,0CAA0C;AAAA,IACrF;AAAA,EACF,SAAS,OAAO;AACd,QAAI,iBAAiB,yBAAyB;AAC5C,YAAM;AAAA,IACR;AACA,UAAM,IAAI;AAAA,MACR,iBAAiB,QAAQ,MAAM,UAAU,OAAO,KAAK;AAAA,IACvD;AAAA,EACF;AACF;AAmBA,SAAS,mBAAmB,OAAgB,MAAoB;AAC9D,QAAM,SAAS,iBAAiB,OAAO,IAAI;AAC3C,QAAM,OAAO,OAAO,KAAK,MAAM;AAC/B,MAAI,KAAK,WAAW,GAAG;AACrB,UAAM,IAAI,wBAAwB,GAAG,IAAI,uCAAuC;AAAA,EAClF;AACA,QAAM,MAAM,KAAK,CAAC;AAClB,MAAI,QAAQ,WAAW,QAAQ,SAAS;AACtC,UAAM,SAASC,eAAc,QAAQ,KAAK,MAAM,CAAC;AACjD,aAAS,QAAQ,GAAG,QAAQ,OAAO,QAAQ,SAAS;AAClD,yBAAmB,OAAO,KAAK,GAAG,GAAG,IAAI,IAAI,GAAG,IAAI,KAAK,GAAG;AAAA,IAC9D;AACA;AAAA,EACF;AACA,MAAI,QAAQ,WAAW;AACrB,UAAM,UAAU,iBAAiBC,eAAc,QAAQ,WAAW,IAAI,GAAG,GAAG,IAAI,UAAU;AAC1F,IAAAC,iBAAgB,SAAS,CAAC,KAAK,GAAG,GAAG,IAAI,UAAU;AACnD,IAAAC,gBAAe,SAAS,OAAO,GAAG,IAAI,UAAU;AAChD;AAAA,EACF;AACA,MAAI,QAAQ,YAAY;AACtB,gCAA4BF,eAAc,QAAQ,YAAY,IAAI,GAAG,GAAG,IAAI,WAAW;AACvF;AAAA,EACF;AACA,QAAM,IAAI,wBAAwB,GAAG,IAAI,+BAA+B,GAAG,EAAE;AAC/E;AAEA,SAAS,4BAA4B,OAAgB,MAAoB;AACvE,QAAM,SAAS,iBAAiB,OAAO,IAAI;AAC3C,EAAAC;AAAA,IACE;AAAA,IACA,CAAC,iBAAiB,YAAY,gBAAgB,aAAa,WAAW;AAAA,IACtE;AAAA,EACF;AACA,EAAAC,gBAAe,QAAQ,iBAAiB,IAAI;AAC5C,EAAAA,gBAAe,QAAQ,YAAY,IAAI;AACvC,EAAAF,eAAc,QAAQ,gBAAgB,IAAI;AAC1C,MAAIG,QAAO,QAAQ,WAAW,GAAG;AAC/B,UAAM,YAAY,iBAAiBH,eAAc,QAAQ,aAAa,IAAI,GAAG,GAAG,IAAI,YAAY;AAChG,IAAAC;AAAA,MACE;AAAA,MACA,CAAC,WAAW,mBAAmB,4BAA4B;AAAA,MAC3D,GAAG,IAAI;AAAA,IACT;AACA,mBAAe,WAAW,WAAW,GAAG,IAAI,YAAY;AACxD,QAAIE,QAAO,WAAW,iBAAiB,GAAG;AACxC,0BAAoB,WAAW,mBAAmB,GAAG,IAAI,YAAY;AAAA,IACvE;AACA,oBAAgB,WAAW,8BAA8B,GAAG,IAAI,YAAY;AAAA,EAC9E;AACA,MAAIA,QAAO,QAAQ,WAAW,GAAG;AAC/B,UAAM,YAAY,iBAAiBH,eAAc,QAAQ,aAAa,IAAI,GAAG,GAAG,IAAI,YAAY;AAChG,IAAAC,iBAAgB,WAAW,CAAC,qBAAqB,GAAG,GAAG,IAAI,YAAY;AACvE,oBAAgB,WAAW,uBAAuB,GAAG,IAAI,cAAc,CAAC;AAAA,EAC1E;AACF;AAEA,SAAS,cAAc,OAAgB,MAAoB;AACzD,QAAM,SAAS,iBAAiB,OAAO,IAAI;AAC3C,EAAAA,iBAAgB,QAAQ,CAAC,UAAU,iBAAiB,kBAAkB,YAAY,GAAG,IAAI;AACzF,cAAYC,gBAAe,QAAQ,UAAU,IAAI,GAAG,uBAAuB,GAAG,IAAI,SAAS;AAC3F,kBAAgB,QAAQ,iBAAiB,MAAM,CAAC;AAChD,cAAYA,gBAAe,QAAQ,kBAAkB,IAAI,GAAG;AAAA,IAC1D;AAAA,IACA;AAAA,EACF,GAAG,GAAG,IAAI,iBAAiB;AAC3B,cAAYA,gBAAe,QAAQ,cAAc,IAAI,GAAG;AAAA,IACtD;AAAA,IACA;AAAA,EACF,GAAG,GAAG,IAAI,aAAa;AACzB;AAEA,SAAS,mBAAmB,OAAgB,MAAoB;AAC9D,QAAM,SAAS,iBAAiB,OAAO,IAAI;AAC3C,EAAAD,iBAAgB,QAAQ,CAAC,QAAQ,GAAG,IAAI;AACxC,cAAYC,gBAAe,QAAQ,UAAU,IAAI,GAAG,CAAC,QAAQ,QAAQ,OAAO,GAAG,GAAG,IAAI,SAAS;AACjG;AAEA,SAAS,cAAc,OAAgB,MAAoB;AACzD,QAAM,SAAS,iBAAiB,OAAO,IAAI;AAC3C,EAAAD,iBAAgB,QAAQ,CAAC,UAAU,GAAG,IAAI;AAC1C,cAAYC,gBAAe,QAAQ,YAAY,IAAI,GAAG,CAAC,OAAO,YAAY,MAAM,GAAG,GAAG,IAAI,WAAW;AACvG;AAEA,SAAS,oBACP,UACA,YACsB;AACtB,QAAM,MAAM,gBAAgB,QAAQ;AACpC,QAAM,WAAWE,aAAY,OAAO,GAAG;AACvC,QAAM,SAAS,YAAY,YAAYA,aAAY,OAAO,GAAG,WAAW,MAAM,IAAI,GAAG,QAAQ,CAAC;AAC9F,QAAM,KAAK,GAAG,WAAW,QAAQ,GAAG,iBAAiB,MAAM,CAAC;AAC5D,SAAO;AAAA,IACL,MAAM,WAAW;AAAA,IACjB,SAAS,WAAW;AAAA,IACpB;AAAA,IACA,QAAQ,WAAW;AAAA,IACnB;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA,eAAW,yBAAW,MAAM,EAAE,MAAM,CAAC;AAAA,EACvC;AACF;AAEA,SAAS,gBACP,QACA,UACA,YACM;AACN,QAAM,SAASF,gBAAe,QAAQ,WAAW,SAAS,GAAG;AAC7D,MAAI,WAAW,SAAS,IAAI;AAC1B;AAAA,EACF;AACA,MAAI,IAAI,OAAO,IAAI,WAAW,QAAQ,eAAe,EAAE,KAAK,MAAM,GAAG;AACnE,UAAM,IAAI;AAAA,MACR,GAAG,WAAW,OAAO;AAAA,IACvB;AAAA,EACF;AACA,QAAM,IAAI,oBAAoB,GAAG,WAAW,OAAO,mBAAmB,WAAW,QAAQ,EAAE;AAC7F;AAiBA,SAAS,iCACP,QACA,WACM;AACN,MAAI,CAACG,QAAO,QAAQ,eAAe,GAAG;AACpC;AAAA,EACF;AACA,QAAM,gBAAgBC,gBAAe,QAAQ,iBAAiB,GAAG;AACjE,MAAI,UAAU,cAAc,eAAe;AACzC,UAAM,IAAI;AAAA,MACR,uBAAuB,UAAU,SAAS,iCAAiC,aAAa;AAAA,IAC1F;AAAA,EACF;AACF;AAiBA,eAAe,gBACb,WACA,QACkB;AAClB,MAAI,UAAU,UAAU,6BAA6B;AACnD,UAAM,YAAY,2BAA2B,UAAU,SAAS;AAChE,UAAM,iBAAiB,qBAAqB,UAAU,OAAO,UAAU,KAAK;AAC5E,QAAI;AACF,aAAO,uBAAQ,OAAO,gBAAgB,QAAQ,SAAS;AAAA,IACzD,QAAQ;AACN,YAAM,IAAI,2BAA2B,uCAAuC;AAAA,IAC9E;AAAA,EACF;AAEA,MAAI,UAAU,UAAU,4BAA4B;AAClD,UAAM,MAAM,YAAY,UAAU,SAAS;AAC3C,UAAM,iBAAiB,qBAAqB,UAAU,OAAO,UAAU,KAAK;AAC5E,QAAI;AACF,iBAAO,4BAAc;AAAA,QACnB,SAAS,IAAI;AAAA,QACb,SAAS,EAAE,KAAK,OAAO;AAAA,QACvB,eAAW,yBAAW,cAAc;AAAA,MACtC,CAAC;AAAA,IACH,QAAQ;AACN,YAAM,IAAI,2BAA2B,uCAAuC;AAAA,IAC9E;AAAA,EACF;AAEA,QAAM,IAAI,+BAA+B,gCAAgC,UAAU,KAAK,EAAE;AAC5F;AAEA,SAAS,2BAA2B,KAAyB;AAC3D,MAAI,CAAC,IAAI,WAAW,UAAU,GAAG;AAC/B,UAAM,IAAI,uBAAuB,mCAAmC;AAAA,EACtE;AACA,QAAM,aAAa,IAAI,MAAM,WAAW,MAAM;AAC9C,MAAI,CAAC,WAAW,WAAW,GAAG,GAAG;AAC/B,UAAM,IAAI,uBAAuB,sCAAsC;AAAA,EACzE;AACA,MAAI;AACJ,MAAI;AACF,YAAQ,oBAAM,UAAU,OAAO,UAAU;AAAA,EAC3C,QAAQ;AACN,UAAM,IAAI,uBAAuB,kCAAkC;AAAA,EACrE;AACA,MAAI,MAAM,WAAW,MAAM,MAAM,CAAC,MAAM,OAAQ,MAAM,CAAC,MAAM,GAAM;AACjE,WAAO,MAAM,MAAM,CAAC;AAAA,EACtB;AACA,QAAM,IAAI,uBAAuB,yCAAyC;AAC5E;AAEA,SAAS,YAAY,KAAyC;AAC5D,MAAI;AACJ,MAAI;AACF,aAAS,YAAY,GAAG;AAAA,EAC1B,QAAQ;AACN,UAAM,IAAI,uBAAuB,kCAAkC;AAAA,EACrE;AACA,MAAI,CAAC,QAAQ;AACX,UAAM,IAAI,uBAAuB,mCAAmC;AAAA,EACtE;AACA,SAAO,EAAE,SAAS,OAAO,QAAQ;AACnC;AAEA,SAAS,qBAAqB,OAAe,OAAmC;AAC9E,MAAI,MAAM,WAAW,KAAK,CAAC,aAAa,KAAK,KAAK,KAAK,MAAM,SAAS,GAAG,GAAG;AAC1E,UAAM,IAAI,uBAAuB,mDAAmD;AAAA,EACtF;AACA,QAAM,QAAQ,gBAAgB,KAAK;AACnC,MAAI,UAAU,+BAA+B,MAAM,WAAW,IAAI;AAChE,UAAM,IAAI,uBAAuB,oCAAoC;AAAA,EACvE;AACA,MAAI,UAAU,4BAA4B;AACxC,QAAI,MAAM,WAAW,IAAI;AACvB,YAAM,IAAI,uBAAuB,oCAAoC;AAAA,IACvE;AACA,UAAM,IAAI,MAAM,EAAE;AAClB,QAAI,MAAM,MAAM,MAAM,IAAI;AACxB,YAAM,IAAI,uBAAuB,gDAAgD;AAAA,IACnF;AAAA,EACF;AACA,SAAO;AACT;AAkBA,SAAS,uBACP,QACA,YACY;AACZ,QAAM,SAAS,uBAAO,OAAO,IAAI;AACjC,aAAW,CAAC,KAAK,KAAK,KAAK,OAAO,QAAQ,MAAM,GAAG;AACjD,QAAI,QAAQ,WAAW,WAAW,QAAQ,aAAa;AACrD;AAAA,IACF;AACA,WAAO,GAAG,IAAI;AAAA,EAChB;AACA,SAAO;AACT;AAOA,SAAS,oBAAoB,QAAkC;AAC7D,MAAI,WAAW,cAAe,QAAO,YAAY;AACjD,MAAI,WAAW,qBAAsB,QAAO,YAAY;AACxD,MAAI,WAAW,4BAA6B,QAAO,YAAY;AAC/D,QAAM,IAAI,wBAAwB,qCAAqC,MAAM,EAAE;AACjF;AAEA,SAAS,iBAAiB,OAAgB,MAA0B;AAClE,MAAI,UAAU,QAAQ,OAAO,UAAU,YAAY,MAAM,QAAQ,KAAK,GAAG;AACvE,UAAM,IAAI,wBAAwB,GAAG,IAAI,oBAAoB;AAAA,EAC/D;AACA,SAAO;AACT;AAEA,SAASC,iBAAgB,QAAoB,SAA4B,MAAoB;AAC3F,QAAM,aAAa,IAAI,IAAI,OAAO;AAClC,aAAW,OAAO,OAAO,KAAK,MAAM,GAAG;AACrC,QAAI,CAAC,WAAW,IAAI,GAAG,GAAG;AACxB,YAAM,IAAI,wBAAwB,GAAG,IAAI,sBAAsB,GAAG,EAAE;AAAA,IACtE;AAAA,EACF;AACF;AAEA,SAASC,eAAc,QAAoB,KAAa,MAAyB;AAC/E,MAAI,CAACC,QAAO,QAAQ,GAAG,GAAG;AACxB,UAAM,IAAI,wBAAwB,GAAG,IAAI,IAAI,GAAG,cAAc;AAAA,EAChE;AACA,SAAO,OAAO,GAAG;AACnB;AAEA,SAASC,gBAAe,QAAoB,KAAa,MAAsB;AAC7E,SAAO,kBAAkBF,eAAc,QAAQ,KAAK,IAAI,GAAG,GAAG,IAAI,IAAI,GAAG,EAAE;AAC7E;AAEA,SAAS,eAAe,QAAoB,KAAa,MAAoB;AAC3E,MAAI,CAACC,QAAO,QAAQ,GAAG,GAAG;AACxB;AAAA,EACF;AACA,oBAAkBD,eAAc,QAAQ,KAAK,IAAI,GAAG,GAAG,IAAI,IAAI,GAAG,EAAE;AACtE;AAEA,SAAS,kBAAkB,OAAkB,MAAsB;AACjE,MAAI,OAAO,UAAU,YAAY,MAAM,WAAW,GAAG;AACnD,UAAM,IAAI,wBAAwB,GAAG,IAAI,6BAA6B;AAAA,EACxE;AACA,SAAO;AACT;AAEA,SAAS,gBAAgB,QAAoB,KAAa,MAAoB;AAC5E,MAAI,CAACC,QAAO,QAAQ,GAAG,GAAG;AACxB;AAAA,EACF;AACA,MAAI,OAAOD,eAAc,QAAQ,KAAK,IAAI,MAAM,WAAW;AACzD,UAAM,IAAI,wBAAwB,GAAG,IAAI,IAAI,GAAG,oBAAoB;AAAA,EACtE;AACF;AAEA,SAAS,gBACP,QACA,KACA,MACA,SACQ;AACR,QAAM,QAAQA,eAAc,QAAQ,KAAK,IAAI;AAC7C,MAAI,OAAO,UAAU,YAAY,CAAC,OAAO,cAAc,KAAK,KAAK,QAAQ,SAAS;AAChF,UAAM,IAAI;AAAA,MACR,GAAG,IAAI,IAAI,GAAG,0BAA0B,OAAO;AAAA,IACjD;AAAA,EACF;AACA,SAAO;AACT;AAEA,SAASG,eACP,QACA,KACA,MACA,SACsB;AACtB,QAAM,QAAQH,eAAc,QAAQ,KAAK,IAAI;AAC7C,MAAI,CAAC,MAAM,QAAQ,KAAK,KAAK,MAAM,SAAS,SAAS;AACnD,UAAM,IAAI;AAAA,MACR,GAAG,IAAI,IAAI,GAAG,mCAAmC,OAAO;AAAA,IAC1D;AAAA,EACF;AACA,SAAO;AACT;AAEA,SAAS,oBACP,QACA,KACA,MACA,OACM;AACN,QAAM,SAASG,eAAc,QAAQ,KAAK,MAAM,CAAC;AACjD,WAAS,QAAQ,GAAG,QAAQ,OAAO,QAAQ,SAAS;AAClD,UAAM,WAAW,GAAG,IAAI,IAAI,GAAG,IAAI,KAAK;AACxC,UAAM,QAAQ,kBAAkB,OAAO,KAAK,GAAG,QAAQ;AACvD,YAAQ,OAAO,QAAQ;AAAA,EACzB;AACF;AAEA,SAAS,mBAAmB,QAAoB,KAAa,MAAoB;AAC/E,gBAAcD,gBAAe,QAAQ,KAAK,IAAI,GAAG,GAAG,IAAI,IAAI,GAAG,EAAE;AACnE;AAEA,SAAS,mBAAmB,QAAoB,KAAa,MAAoB;AAC/E,MAAI,CAACD,QAAO,QAAQ,GAAG,GAAG;AACxB;AAAA,EACF;AACA,gBAAcC,gBAAe,QAAQ,KAAK,IAAI,GAAG,GAAG,IAAI,IAAI,GAAG,EAAE;AACnE;AAEA,SAAS,cAAc,OAAe,MAAoB;AACxD,QAAM,QAAQ,MAAM;AAAA,IAClB;AAAA,EACF;AACA,MAAI,CAAC,OAAO;AACV,UAAM,IAAI,wBAAwB,GAAG,IAAI,0BAA0B;AAAA,EACrE;AACA,QAAM,SAAS,KAAK,MAAM,KAAK;AAC/B,MAAI,OAAO,MAAM,MAAM,GAAG;AACxB,UAAM,IAAI,wBAAwB,GAAG,IAAI,yCAAyC;AAAA,EACpF;AACA,QAAM,YAAY,IAAI,KAAK,MAAM,EAAE,YAAY,EAAE,QAAQ,SAAS,GAAG;AACrE,MAAI,cAAc,OAAO;AACvB,UAAM,IAAI,wBAAwB,GAAG,IAAI,4CAA4C;AAAA,EACvF;AACF;AAEA,SAAS,YAA8B,QAAgB,UAAa,MAAiB;AACnF,MAAI,WAAW,UAAU;AACvB,UAAM,IAAI,wBAAwB,GAAG,IAAI,YAAY,QAAQ,EAAE;AAAA,EACjE;AACA,SAAO;AACT;AAEA,SAAS,YACP,QACA,SACA,MACG;AACH,aAAW,SAAS,SAAS;AAC3B,QAAI,WAAW,OAAO;AACpB,aAAO;AAAA,IACT;AAAA,EACF;AACA,QAAM,IAAI,wBAAwB,GAAG,IAAI,0BAA0B,MAAM,EAAE;AAC7E;AAEA,SAASD,QAAO,QAAoB,KAAsB;AACxD,SAAOG,cAAa,QAAQ,GAAG;AACjC;AAEA,SAAS,8BAA8B,OAAgD;AACrF,MAAI,UAAU,+BAA+B,UAAU,4BAA4B;AACjF,UAAM,IAAI,+BAA+B,gCAAgC,KAAK,EAAE;AAAA,EAClF;AACF;AAEA,SAAS,YAAY,OAA+B;AAClD,aAAO,qBAAO,OAAO,OAAO;AAC9B;AAEA,SAAS,YAAY,MAAkB,OAA+B;AACpE,QAAM,SAAS,IAAI,WAAW,KAAK,SAAS,MAAM,MAAM;AACxD,SAAO,IAAI,MAAM,CAAC;AAClB,SAAO,IAAI,OAAO,KAAK,MAAM;AAC7B,SAAO;AACT;AAEA,SAAS,iBAAiB,OAA2B;AACnD,MAAI,SAAS;AACb,MAAI,SAAS;AACb,MAAI,OAAO;AACX,aAAW,QAAQ,OAAO;AACxB,aAAU,UAAU,IAAK;AACzB,YAAQ;AACR,WAAO,QAAQ,GAAG;AAChB,cAAQ;AACR,gBAAU,gBAAiB,UAAU,OAAQ,EAAE;AAAA,IACjD;AAAA,EACF;AACA,MAAI,OAAO,GAAG;AACZ,cAAU,gBAAiB,UAAW,IAAI,OAAS,EAAE;AAAA,EACvD;AACA,SAAO;AACT;AAEA,SAAS,gBAAgB,OAA2B;AAClD,QAAM,WACJ;AACF,MAAI,SAAS;AACb,WAAS,QAAQ,GAAG,QAAQ,MAAM,QAAQ,SAAS,GAAG;AACpD,UAAM,IAAI,MAAM,KAAK;AACrB,UAAM,IAAI,MAAM,QAAQ,CAAC;AACzB,UAAM,IAAI,MAAM,QAAQ,CAAC;AACzB,UAAM,UAAW,KAAK,MAAQ,KAAK,MAAM,KAAM,KAAK;AACpD,cAAU,SAAU,WAAW,KAAM,EAAE;AACvC,cAAU,SAAU,WAAW,KAAM,EAAE;AACvC,QAAI,QAAQ,IAAI,MAAM,QAAQ;AAC5B,gBAAU,SAAU,WAAW,IAAK,EAAE;AAAA,IACxC;AACA,QAAI,QAAQ,IAAI,MAAM,QAAQ;AAC5B,gBAAU,SAAS,UAAU,EAAE;AAAA,IACjC;AAAA,EACF;AACA,SAAO;AACT;AAEA,SAAS,gBAAgB,OAA2B;AAClD,MAAI,MAAM,SAAS,MAAM,GAAG;AAC1B,UAAM,IAAI,uBAAuB,4CAA4C;AAAA,EAC/E;AACA,QAAM,WACJ;AACF,QAAM,QAAkB,CAAC;AACzB,MAAI,SAAS;AACb,MAAI,OAAO;AACX,aAAW,QAAQ,OAAO;AACxB,UAAM,QAAQ,SAAS,QAAQ,IAAI;AACnC,QAAI,QAAQ,GAAG;AACb,YAAM,IAAI,uBAAuB,kCAAkC;AAAA,IACrE;AACA,aAAU,UAAU,IAAK;AACzB,YAAQ;AACR,QAAI,QAAQ,GAAG;AACb,cAAQ;AACR,YAAM,KAAM,UAAU,OAAQ,GAAI;AAAA,IACpC;AAAA,EACF;AACA,QAAM,UAAU,WAAW,KAAK,KAAK;AACrC,MAAI,gBAAgB,OAAO,MAAM,OAAO;AACtC,UAAM,IAAI,uBAAuB,4CAA4C;AAAA,EAC/E;AACA,SAAO;AACT;;;AEzkCO,IAAM,oCACX;AACK,IAAM,6BACX;AACK,IAAM,oBAAoB;AAC1B,IAAM,6BAA6B;AAiBnC,IAAM,uBAAN,cAAmC,MAAM;AAAA,EAG9C,YAAY,MAAgC,SAAiB;AAC3D,UAAM,OAAO;AACb,SAAK,OAAO;AACZ,SAAK,OAAO;AAAA,EACd;AACF;AA0TA,eAAsB,qCACpB,SAC6B;AAC7B,QAAM,aAAaC,cAAa,SAAS,KAAK,4BAA4B;AAC1E,EAAAC;AAAA,IACE;AAAA,IACA;AAAA,MACE;AAAA,MACA;AAAA,MACA;AAAA,MACA;AAAA,MACA;AAAA,MACA;AAAA,MACA;AAAA,IACF;AAAA,IACA;AAAA,EACF;AACA,MAAI,CAACC,QAAO,YAAY,cAAc,GAAG;AACvC,UAAM,IAAI;AAAA,MACR;AAAA,MACA;AAAA,IACF;AAAA,EACF;AACA,QAAM,eAAe,WAAW,cAAc;AAC9C,MACE,iBAAiB,QACjB,OAAO,iBAAiB,YACxB,MAAM,QAAQ,YAAY,GAC1B;AACA,UAAM,IAAI;AAAA,MACR;AAAA,MACA;AAAA,IACF;AAAA,EACF;AACA,QAAM,eAAe;AACrB,QAAM,YAAY;AAAA,IAChB;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,EACF;AACA,QAAM,MAAM;AAAA,IACV;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,EACF;AACA,QAAM,YAAY,mBAAmB,WAAW,0BAA0B;AAC1E,QAAM,QAAQ,mBAAmB,KAAK,OAAO;AAC7C,MAAI,aAAa,OAAO;AACtB,UAAM,IAAI;AAAA,MACR;AAAA,MACA;AAAA,IACF;AAAA,EACF;AAEA,MAAI;AACJ,MAAI;AACF,gBAAY,MAAM,yBAAyB,YAAY,GAAG;AAAA,EAC5D,SAAS,OAAO;AACd,UAAM,IAAI;AAAA,MACR;AAAA,MACA,iBAAiB,QAAQ,MAAM,UAAU,OAAO,KAAK;AAAA,IACvD;AAAA,EACF;AACA,MAAI,SAAS,UAAU,cAAc,SAAS,UAAU;AACtD,UAAM,IAAI;AAAA,MACR;AAAA,MACA;AAAA,IACF;AAAA,EACF;AAEA,QAAM,mBAAmBC,gBAAe,YAAY,YAAY,GAAG;AACnE,MAAI,SAAS,aAAa,kBAAkB;AAC1C,UAAM,IAAI;AAAA,MACR;AAAA,MACA;AAAA,IACF;AAAA,EACF;AACA,QAAM,mBAAmBA,gBAAe,YAAY,YAAY,GAAG;AACnE,MAAI,SAAS,aAAa,kBAAkB;AAC1C,UAAM,IAAI;AAAA,MACR;AAAA,MACA;AAAA,IACF;AAAA,EACF;AACA,QAAM,yBAAyBA;AAAA,IAC7B;AAAA,IACA;AAAA,IACA;AAAA,EACF;AACA,MAAI,SAAS,mBAAmB,wBAAwB;AACtD,UAAM,IAAI;AAAA,MACR;AAAA,MACA;AAAA,IACF;AAAA,EACF;AACA,QAAM,wBAAwBD,QAAO,YAAY,uBAAuB,IACpEC,gBAAe,YAAY,yBAAyB,GAAG,IACvD;AACJ,MAAI,CAAC,SAAS,wBAAwB,SAAS,qBAAqB,GAAG;AACrE,UAAM,IAAI;AAAA,MACR;AAAA,MACA;AAAA,IACF;AAAA,EACF;AACA,QAAM,2BAA2BD;AAAA,IAC/B;AAAA,IACA;AAAA,EACF,IACIC,gBAAe,YAAY,4BAA4B,GAAG,IAC1D;AACJ,MAAI,CAAC,SAAS,2BAA2B,SAAS,wBAAwB,GAAG;AAC3E,UAAM,IAAI;AAAA,MACR;AAAA,MACA;AAAA,IACF;AAAA,EACF;AACA,SAAO;AACT;AAEA,SAASH,cACP,OACA,MACA,MACY;AACZ,MAAI;AACF,UAAM,aAAa,cAAc,KAAK;AACtC,QACE,eAAe,QACf,OAAO,eAAe,YACtB,MAAM,QAAQ,UAAU,GACxB;AACA,YAAM,IAAI,qBAAqB,MAAM,GAAG,IAAI,oBAAoB;AAAA,IAClE;AACA,WAAO;AAAA,EACT,SAAS,OAAO;AACd,QAAI,iBAAiB,sBAAsB;AACzC,YAAM;AAAA,IACR;AACA,UAAM,IAAI;AAAA,MACR;AAAA,MACA,iBAAiB,QAAQ,MAAM,UAAU,OAAO,KAAK;AAAA,IACvD;AAAA,EACF;AACF;AAmBA,SAASI,iBACP,QACA,SACA,MACM;AACN,QAAM,aAAa,IAAI,IAAI,OAAO;AAClC,aAAW,OAAO,OAAO,KAAK,MAAM,GAAG;AACrC,QAAI,CAAC,WAAW,IAAI,GAAG,GAAG;AACxB,YAAM,IAAI;AAAA,QACR;AAAA,QACA,GAAG,IAAI,sBAAsB,GAAG;AAAA,MAClC;AAAA,IACF;AAAA,EACF;AACF;AAEA,SAASC,eACP,QACA,KACA,MACW;AACX,MAAI,CAACC,QAAO,QAAQ,GAAG,GAAG;AACxB,UAAM,IAAI;AAAA,MACR;AAAA,MACA,GAAG,IAAI,IAAI,GAAG;AAAA,IAChB;AAAA,EACF;AACA,SAAO,OAAO,GAAG;AACnB;AAEA,SAASC,gBAAe,QAAoB,KAAa,MAAsB;AAC7E,QAAM,QAAQF,eAAc,QAAQ,KAAK,IAAI;AAC7C,MAAI,OAAO,UAAU,YAAY,MAAM,WAAW,GAAG;AACnD,UAAM,IAAI;AAAA,MACR;AAAA,MACA,GAAG,IAAI,IAAI,GAAG;AAAA,IAChB;AAAA,EACF;AACA,SAAO;AACT;AAEA,SAAS,YACP,QACA,KACA,MACA,MACQ;AACR,MAAI,CAACC,QAAO,QAAQ,GAAG,GAAG;AACxB,UAAM,IAAI,qBAAqB,MAAM,GAAG,IAAI,IAAI,GAAG,cAAc;AAAA,EACnE;AACA,QAAM,QAAQ,OAAO,GAAG;AACxB,MAAI,OAAO,UAAU,YAAY,MAAM,WAAW,GAAG;AACnD,UAAM,IAAI;AAAA,MACR;AAAA,MACA,GAAG,IAAI,IAAI,GAAG;AAAA,IAChB;AAAA,EACF;AACA,SAAO;AACT;AAuHA,SAAS,mBAAmB,OAAe,MAAsB;AAC/D,QAAM,QAAQ,MAAM;AAAA,IAClB;AAAA,EACF;AACA,MAAI,CAAC,OAAO;AACV,UAAM,IAAI;AAAA,MACR;AAAA,MACA,GAAG,IAAI;AAAA,IACT;AAAA,EACF;AACA,QAAM,SAAS,KAAK,MAAM,KAAK;AAC/B,MAAI,OAAO,MAAM,MAAM,GAAG;AACxB,UAAM,IAAI;AAAA,MACR;AAAA,MACA,GAAG,IAAI;AAAA,IACT;AAAA,EACF;AACA,QAAM,YAAY,IAAI,KAAK,MAAM,EAAE,YAAY,EAAE,QAAQ,SAAS,GAAG;AACrE,MAAI,cAAc,OAAO;AACvB,UAAM,IAAI;AAAA,MACR;AAAA,MACA,GAAG,IAAI;AAAA,IACT;AAAA,EACF;AACA,SAAO;AACT;AAEA,IAAME,gBAEF,OAGA,UACD,OAAO,UAAU,eAAe,KAAK;AAAA,EACpC,OAAO,UAAU;AACnB;AAEF,SAASC,QAAO,QAAoB,KAAsB;AACxD,SAAOD,cAAa,QAAQ,GAAG;AACjC;;;ANhtBO,IAAM,gCAAgC;AACtC,IAAM,kCAAkC;AACxC,IAAM,sCAAsC;AAE5C,IAAM,yCACX;AACK,IAAM,0CACX;AACK,IAAM,uCACX;AACK,IAAM,8BACX;AACK,IAAM,yCACX;AACK,IAAM,6BACX;AAEK,IAAM,gDAAgD;AAAA,EAC3D;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AACF;AA8CO,IAAM,2BAAN,cAAuC,MAAM;AAAA,EAMlD,YACE,MACA,SACA,QAAuC,WACvC,YACA,QACA;AACA,UAAM,OAAO;AACb,SAAK,OAAO;AACZ,SAAK,OAAO;AACZ,SAAK,QAAQ;AACb,SAAK,aAAa;AAClB,SAAK,SAAS;AAAA,EAChB;AACF;AA8IA,IAAM,kBAAsC,aAAE;AAAA,EAAK,MACjD,aAAE,MAAM;AAAA,IACN,aAAE,OAAO;AAAA,IACT,aAAE,OAAO,EAAE,OAAO;AAAA,IAClB,aAAE,QAAQ;AAAA,IACV,aAAE,KAAK;AAAA,IACP,aAAE,MAAM,eAAe;AAAA,IACvB,aAAE,OAAO,eAAe;AAAA,EAC1B,CAAC;AACH;AAEA,IAAM,gBAAgB,aACnB,OAAO,EACP,OAAO,CAAC,UAAUE,oBAAmB,KAAK,MAAM,QAAW;AAAA,EAC1D,SAAS;AACX,CAAC;AAEH,IAAM,qBAAqB,aACxB,OAAO;AAAA,EACN,QAAQ,aAAE,OAAO;AAAA,EACjB,gBAAgB,aAAE,OAAO;AAAA,EACzB,UAAU,aAAE,OAAO;AAAA,EACnB,UAAU,aAAE,OAAO;AAAA,EACnB,UAAU,aAAE,OAAO;AAAA,EACnB,yBAAyB,aAAE,MAAM,aAAE,OAAO,CAAC;AAAA,EAC3C,4BAA4B,aAAE,MAAM,aAAE,OAAO,CAAC;AAAA,EAC9C,gBAAgB,aAAE,OAAO;AAAA,EACzB,WAAW;AAAA,EACX,WAAW,aACR,OAAO;AAAA,IACN,OAAO,aAAE,OAAO;AAAA,IAChB,WAAW,aAAE,OAAO;AAAA,IACpB,OAAO,aAAE,OAAO;AAAA,EAClB,CAAC,EACA,OAAO;AACZ,CAAC,EACA,OAAO;AAEV,IAAM,qBAAqB,aACxB,OAAO;AAAA,EACN,UAAU,aAAE,OAAO,EAAE,IAAI;AAAA,EACzB,UAAU,aAAE,OAAO;AAAA,EACnB,4BAA4B,aAAE,MAAM;AAAA,IAClC,aAAE,QAAQ,0BAA0B;AAAA,EACtC,CAAC;AAAA,EACD,cAAc;AAChB,CAAC,EACA,OAAO;AAEV,IAAM,kBAAkB,aACrB,OAAO;AAAA,EACN,QAAQ,aAAE,QAAQ,0BAA0B;AAAA,EAC5C,UAAU,aAAE,OAAO,EAAE,IAAI;AAAA,EACzB,SAAS,aAAE,OAAO,EAAE,IAAI,CAAC;AAC3B,CAAC,EACA,OAAO;AAEV,IAAM,qBAAqB,aACxB,OAAO;AAAA,EACN,cAAc,aAAE,OAAO;AAAA,EACvB,YAAY,aAAE,OAAO;AAAA,EACrB,uBAAuB,aAAE,MAAM,eAAe,EAAE,IAAI,CAAC;AACvD,CAAC,EACA,OAAO;AAEV,IAAM,kBAAkB,aACrB,OAAO;AAAA,EACN,QAAQ,aAAE,QAAQ,iCAAiC;AAAA,EACnD,UAAU,aAAE,OAAO;AAAA,EACnB,cAAc;AAAA,EACd,WAAW;AAAA,EACX,cAAc;AAChB,CAAC,EACA,OAAO;AAEV,IAAM,kBAAkB,aACrB,OAAO;AAAA,EACN,OAAO,aAAE,OAAO;AAAA,EAChB,WAAW,aAAE,OAAO;AAAA,EACpB,OAAO,aAAE,OAAO;AAClB,CAAC,EACA,OAAO;AAEV,IAAM,kBAAkB,aACrB,OAAO;AAAA,EACN,QAAQ,aAAE,QAAQ,uCAAuC;AAAA,EACzD,aAAa,aAAE,OAAO;AAAA,EACtB,UAAU,aAAE,OAAO;AAAA,EACnB,UAAU,aAAE,OAAO;AAAA,EACnB,OAAO,aAAE,OAAO,EAAE,IAAI,EAAE;AAAA,EACxB,oBAAoB;AAAA,EACpB,gBAAgB,aAAE,MAAM,aAAE,OAAO,CAAC,EAAE,IAAI,CAAC;AAAA,EACzC,+BAA+B,aAAE,MAAM,eAAe,EAAE,SAAS;AAAA,EACjE,WAAW;AACb,CAAC,EACA,OAAO;AAEV,IAAM,0BAA0B,aAC7B,OAAO,EAAE,WAAW,gBAAgB,CAAC,EACrC,OAAO;AAEV,IAAM,eAAe,aAClB,OAAO;AAAA,EACN,QAAQ,aAAE,QAAQ,2BAA2B;AAAA,EAC7C,MAAM,aAAE,KAAK,6CAA6C;AAAA,EAC1D,SAAS,aAAE,OAAO,EAAE,SAAS;AAC/B,CAAC,EACA,OAAO;AAEV,IAAM,4BAA4B,aAC/B,OAAO;AAAA,EACN,OAAO,aACJ,OAAO;AAAA,IACN,MAAM,aAAE,KAAK,6CAA6C;AAAA,IAC1D,SAAS,aAAE,OAAO,EAAE,SAAS;AAAA,EAC/B,CAAC,EACA,OAAO;AACZ,CAAC,EACA,OAAO;AAEV,IAAM,uBAAuB,aAC1B,OAAO;AAAA,EACN,cAAc,aAAE,OAAO;AAAA,EACvB,YAAY,aAAE,OAAO,EAAE,IAAI,CAAC;AAAA,EAC5B,WAAW,aAAE,OAAO;AAAA,EACpB,WAAW,aAAE,OAAO;AAAA,EACpB,UAAU,aAAE,OAAO;AAAA,EACnB,mBAAmB,aAAE,OAAO,EAAE,MAAM,gBAAgB;AAAA,EACpD,gBAAgB,aAAE,QAAQ,cAAc;AAAA,EACxC,UAAU;AAAA,EACV,WAAW;AAAA,EACX,UAAU,aAAE,QAAQ;AAAA,EACpB,SAAS,aAAE,OAAO;AACpB,CAAC,EACA,OAAO;AAEV,IAAM,wBAAwB,aAC3B,OAAO,EAAE,YAAY,qBAAqB,CAAC,EAC3C,OAAO;AACV,IAAM,wBAAwB,aAC3B,OAAO;AAAA,EACN,KAAK,aAAE,OAAO,EAAE,IAAI,CAAC;AAAA,EACrB,WAAW,aAAE,MAAM,aAAE,OAAO,CAAC;AAAA,EAC7B,SAAS,aAAE,MAAM,aAAE,OAAO,CAAC;AAC7B,CAAC,EACA,OAAO;AAEV,IAAM,wBAAwB,aAC3B,OAAO,EAAE,MAAM,aAAE,MAAM,eAAe,EAAE,CAAC,EACzC,OAAO;AACV,IAAM,uBAAuB,aAAE,OAAO,EAAE,OAAO,gBAAgB,CAAC,EAAE,OAAO;AAElE,IAAM,+BAA+B;AAAA,EAC1C;AAAA,IACE,MAAM;AAAA,IACN,KAAK;AAAA,IACL,aAAa,CAAC,EAAE,OAAO,GAAG,OAAO,mBAAmB,CAAC;AAAA,EACvD;AAAA,EACA;AAAA,IACE,MAAM;AAAA,IACN,KAAK;AAAA,IACL,aAAa,CAAC,EAAE,OAAO,GAAG,OAAO,mBAAmB,CAAC;AAAA,EACvD;AACF;AAcO,SAAS,oCACd,eACA,gBACQ;AACR,MAAI,eAAe,WAAW,GAAG;AAC/B,UAAM,IAAI;AAAA,MACR;AAAA,MACA;AAAA,MACA;AAAA,IACF;AAAA,EACF;AACA,SAAO,GAAG,aAAa,IAAI,mBAAmB,cAAc,CAAC;AAC/D;AAKA,IAAM,+BACJ,IAAI;AAAA,EACF,6BAA6B,IAAI,CAAC,cAAc;AAAA,IAC9C,UAAU;AAAA,IACV;AAAA,EACF,CAAC;AACH;AAEK,IAAM,sBAAN,MAAM,qBAAoB;AAAA,EA4BvB,YACN,WACA,uBACA,wBACAC,4BACA,+BACA,uBACA,oBACA,SACA;AAdF,SAAiB,sBAAsB,oBAAI,IAAY;AAGvD,SAAQ,cAAc;AAYpB,SAAK,YAAY;AACjB,SAAK,wBAAwB;AAC7B,SAAK,yBAAyB;AAC9B,SAAK,4BAA4BA;AACjC,SAAK,eAAe,QAAQ;AAC5B,SAAK,WAAW,QAAQ;AACxB,SAAK,WAAW,QAAQ;AACxB,SAAK,iBAAiB,QAAQ;AAC9B,SAAK,YAAY,QAAQ;AACzB,SAAK,oBAAoB,QAAQ;AACjC,SAAK,uBAAuB,QAAQ;AACpC,SAAK,gCAAgC;AACrC,SAAK,wBAAwB;AAC7B,SAAK,qBAAqB;AAC1B,SAAK,qBACH,QAAQ,sBACR,QAAQ,mBAAmB,sBAC3B,QAAQ;AACV,SAAK,gBAAgB,QAAQ,iBAC3B,QAAQ,mBAAmB,iBAAiB;AAAA,MAC1C,MAAM;AAAA,MACN,YAAY;AAAA,QACV,QAAQ;AAAA,QACR,WAAW,QAAQ;AAAA,MACrB;AAAA,IACF;AACF,SAAK,WAAW,QAAQ,YAAY,QAAQ,mBAAmB;AAC/D,SAAK,yBAAyB,KAAK;AAAA,MACjC,KAAK,IAAI,QAAQ,0BAA0B,IAAI,CAAC;AAAA,MAChD;AAAA,IACF;AACA,SAAK,MAAM,QAAQ,QAAQ,MAAM,oBAAI,KAAK;AAC1C,SAAK,QACH,QAAQ,UACP,CAAC,iBACA,IAAI,QAAQ,CAAC,YAAY,WAAW,SAAS,YAAY,CAAC;AAC9D,SAAK,SAAS,QAAQ,UAAU,KAAK;AACrC,SAAK,sBACH,QAAQ,uBAAuB;AAAA,EACnC;AAAA,EAEA,aAAa,OACX,SAC8B;AAC9B,UAAM,YAAY,eAAe,QAAQ,SAAS;AAClD,QACE,UAAU,UAAU,aAAa,QAAQ,iBAAiB,YAC1D,UAAU,UAAU,YAAY,QAAQ,iBAAiB,SACzD;AACA,YAAM;AAAA,QACJ;AAAA,QACA;AAAA,MACF;AAAA,IACF;AACA,UAAM,SAAS,MAAM,yBAAyB,WAAW,OAAO;AAChE,QAAI,OAAO,aAAa,UAAU,aAAa,UAAU;AACvD,YAAM,IAAI;AAAA,QACR;AAAA,QACA;AAAA,QACA;AAAA,MACF;AAAA,IACF;AACA,QAAI,OAAO,aAAa,UAAU,aAAa,UAAU;AACvD,YAAM,IAAI;AAAA,QACR;AAAA,QACA;AAAA,QACA;AAAA,MACF;AAAA,IACF;AACA,UAAM,wBAAwB,MAAM;AAAA,MAClC,UAAU,aAAa;AAAA,MACvB,QAAQ;AAAA,MACR;AAAA,IACF;AACA,UAAM,qBAAqB,MAAM;AAAA,MAC/B,UAAU,UAAU;AAAA,MACpB,QAAQ;AAAA,IACV;AACA,UAAM,wBACJ,UAAU,aAAa,sBAAsB;AAAA,MAAI,CAAC,YAAY,UAC5D;AAAA,QACE;AAAA,QACA,wCAAwC,KAAK;AAAA,MAC/C;AAAA,IACF;AACF,UAAM,yBAAyB,sBAAsB,IAAI,CAAC,gBAAgB;AAAA,MACxE,GAAG;AAAA,MACH,OAAO,UAAU,UAAU;AAAA,IAC7B,EAAE;AACF,WAAO,IAAI;AAAA,MACT;AAAA,MACA;AAAA,MACA;AAAA,MACA,0BAA0B,qBAAqB;AAAA,MAC/CD,oBAAmB,OAAO,SAAS;AAAA,MACnC;AAAA,MACA;AAAA,MACA;AAAA,IACF;AAAA,EACF;AAAA,EAEA,IAAI,cAA2D;AAC7D,QAAI,KAAK,aAAa;AACpB,aAAO;AAAA,IACT;AACA,QAAI,KAAK,uBAAuB,QAAW;AACzC,aAAO;AAAA,IACT;AACA,QAAI,KAAK,gBAAgB,KAAK,kBAAkB,GAAG;AACjD,aAAO;AAAA,IACT;AACA,WAAO;AAAA,EACT;AAAA,EAEA,MAAM,QACJ,eACA,gBAC2C;AAC3C,QAAI;AACF,YAAM,mBAAmB,8BAA8B,aAAa;AACpE,YAAM,yBACJ,kBAAkB,KAAK,UAAU,aAAa;AAChD,YAAM,YAAwC;AAAA,QAC5C,GAAG;AAAA,QACH,MACE,mBAAmB,SACf,iBAAiB,OACjB;AAAA,UACE;AAAA,UACA;AAAA,QACF;AAAA,QACN,aAAa,iBAAiB,YAAY,IAAI,CAAC,UAAU;AAAA,UACvD,GAAG;AAAA,UACH,OACE,KAAK,UAAU,qBACX,yBACA,KAAK;AAAA,QACb,EAAE;AAAA,MACJ;AACA,YAAM,aAAa,MAAM,KAAK,sBAAsB;AACpD,YAAM,YAAY,KAAK;AAAA,QACrB;AAAA,QACA;AAAA,MACF;AACA,WAAK,4BAA4B,YAAY,SAAS;AACtD,YAAM,WAAW,MAAM,KAAK;AAAA,QAC1B;AAAA,QACA,UAAU;AAAA,QACV;AAAA,QACA;AAAA,UACE,QAAQ;AAAA,UACR,MAAM,UAAU;AAAA;AAAA;AAAA;AAAA,UAIhB,QACE,UAAU,YAAY,SAClB,UAAU,YAAY,IAAI,CAAC,SAAS,KAAK,KAAK,IAC9C,CAAC;AAAA,QACT;AAAA,QACA,UAAU;AAAA,MACZ;AACA,aAAO;AAAA,QACL;AAAA,QACA;AAAA,QACA;AAAA,MACF;AAAA,IACF,SAAS,OAAO;AACd,WAAK,kBAAkB,KAAK;AAC5B,YAAM;AAAA,IACR;AAAA,EACF;AAAA,EAEA,MAAM,OAAO,MAAwD;AACnE,QAAI;AACF,YAAM,aAAa,MAAM,KAAK,sBAAsB;AACpD,YAAM,YAAY,WAAW,aAAa;AAAA,QACxC,CAAC,eACC,WAAW,YAAY,kBACvB,WAAW,SAAS,QACpB,WAAW,QAAQ,SAAS,kBAAkB;AAAA,MAClD;AACA,YAAM,YAAY;AAAA,QAChB;AAAA,UACE,SAAS;AAAA,UACT,OAAO,WAAW,SAAS;AAAA,UAC3B;AAAA,UACA,SAAS,CAAC,kBAAkB;AAAA,QAC9B;AAAA,QACA;AAAA,MACF;AACA,WAAK,4BAA4B,YAAY,SAAS;AACtD,YAAM,WAAW,MAAM,KAAK,aAAa,MAAM,MAAM,kBAAkB;AACvE,aAAO;AAAA,QACL;AAAA,QACA;AAAA,QACA;AAAA,MACF;AAAA,IACF,SAAS,OAAO;AACd,WAAK,kBAAkB,KAAK;AAC5B,YAAM;AAAA,IACR;AAAA,EACF;AAAA,EAEA,MAAc,aACZ,SACA,MACA,QACA,MACA,SACgC;AAChC,UAAM,aAAa,KAAK;AACxB,QAAI,eAAe,QAAW;AAC5B,YAAM,IAAI;AAAA,QACR;AAAA,QACA;AAAA,MACF;AAAA,IACF;AACA,QACE,WAAW,cAAc,KAAK,gBAC9B,WAAW,cAAc,KAAK,mBAAmB,WACjD;AACA,YAAM,IAAI;AAAA,QACR;AAAA,QACA;AAAA,MACF;AAAA,IACF;AACA,QACE,KAAK,0BAA0B,UAC/B,KAAK,uBAAuB,QAC5B;AACA,YAAM,IAAI;AAAA,QACR;AAAA,QACA;AAAA,MACF;AAAA,IACF;AACA,UAAM,UAA0B;AAAA,MAC9B,kBAAkB,EAAE,eAAe,KAAK,mBAAmB,QAAS;AAAA,MACpE,eAAe,KAAK;AAAA,MACpB,SAAS,KAAK,UAAU,UAAU;AAAA,MAClC,oBAAoB,WAAW;AAAA,MAC/B,KAAK,WAAW;AAAA,IAClB;AACA,QAAI;AACJ,QAAI,YAAY,QAAW;AACzB,0BAAoB,WAAW,OAAO,SAAS,SAAS,MAAM,MAAM;AAAA,IACtE,OAAO;AACL,UAAI,WAAW,cAAc,QAAW;AACtC,cAAM,IAAI;AAAA,UACR;AAAA,UACA;AAAA,QACF;AAAA,MACF;AACA,0BAAoB,WAAW,UAAU,SAAS;AAAA,QAChD;AAAA,UACE,SAAS,KAAK,UAAU,UAAU;AAAA,UAClC;AAAA,UACA;AAAA,UACA;AAAA,UACA,SAAS,CAAC,OAAO;AAAA,QACnB;AAAA,MACF,CAAC;AAAA,IACH;AACA,UAAM,UAAU,cAAc,iBAAiB;AAC/C,UAAM,WAAW,MAAM,KAAK,UAAU,QAAQ;AAAA,MAC5C,QAAQ;AAAA,MACR,KAAK,GAAG,kBAAkB,KAAK,UAAU,UAAU,QAAQ,CAAC;AAAA,MAC5D;AAAA,MACA,UAAU;AAAA,MACV,0BAA0B,CAAC,GAAG,KAAK,kBAAkB;AAAA,MACrD,GAAI,SAAS,SAAY,CAAC,IAAI,EAAE,KAAK;AAAA,IACvC,CAAC;AACD,SAAK,wBAAwB,UAAU,SAAS;AAChD,WAAO;AAAA,EACT;AAAA,EAEA,MAAc,wBAAqD;AACjE,QAAI,KAAK,aAAa;AACpB,YAAM,IAAI;AAAA,QACR;AAAA,QACA;AAAA,QACA;AAAA,MACF;AAAA,IACF;AACA,QACE,KAAK,uBAAuB,UAC5B,CAAC,KAAK,gBAAgB,KAAK,kBAAkB,GAC7C;AACA,aAAO,KAAK;AAAA,IACd;AACA,QACE,KAAK,sBAAsB,UAC3B,KAAK,kBAAkB,cAAc,KAAK,cAC1C;AACA,YAAM,IAAI;AAAA,QACR;AAAA,QACA;AAAA,QACA;AAAA,MACF;AAAA,IACF;AACA,QAAI;AACF,UAAI;AACJ,YAAM,WAAW,KAAK,IAAI,GAAG,KAAK,mBAAmB;AACrD,eAAS,UAAU,GAAG,UAAU,UAAU,WAAW;AACnD,cAAM,YAAY,MAAM,KAAK,gBAAgB;AAC7C,cAAM,eAAe,MAAM,KAAK,iBAAiB,SAAS;AAC1D,YAAI;AACF,gBAAM,aAAa,MAAM,KAAK,YAAY,WAAW,YAAY;AACjE,eAAK,qBAAqB;AAC1B,iBAAO;AAAA,QACT,SAAS,OAAO;AACd,cACE,EAAE,iBAAiB,6BACnB,MAAM,UAAU,eAChB;AACA,kBAAM;AAAA,UACR;AACA,sBAAY;AAAA,QACd;AACA,YAAI,UAAU,IAAI,UAAU;AAC1B,gBAAM,KAAK,MAAM,WAAW,SAAS,KAAK,OAAO,CAAC,CAAC;AAAA,QACrD;AAAA,MACF;AACA,YAAM,IAAI;AAAA,QACR;AAAA,QACA,qBAAqB,QACjB,UAAU,UACV;AAAA,QACJ;AAAA,MACF;AAAA,IACF,SAAS,OAAO;AACd,WAAK,kBAAkB,KAAK;AAC5B,YAAM;AAAA,IACR;AAAA,EACF;AAAA,EAEQ,kBAAkB,OAAsB;AAC9C,QACE,iBAAiB,4BACjB,MAAM,UAAU,gBAChB;AACA,WAAK,cAAc;AAAA,IACrB;AAAA,EACF;AAAA,EAEA,MAAc,kBAA4D;AACxE,SAAK,gCAAgC;AACrC,UAAM,WAAW,MAAM,KAAK,0BAA0B;AAAA,MACpD,QAAQ;AAAA,MACR,KAAK,GAAG,kBAAkB,KAAK,UAAU,aAAa,QAAQ,CAAC;AAAA,MAC/D,UAAU;AAAA,MACV,0BAA0B,CAAC,GAAG,KAAK,qBAAqB;AAAA,MACxD,MAAM;AAAA,QACJ,UAAU,KAAK,UAAU;AAAA,MAC3B;AAAA,IACF,CAAC;AACD,WAAO;AAAA,MACL,SAAS;AAAA,MACT;AAAA,MACA;AAAA,IACF,EAAE;AAAA,EACJ;AAAA,EAEA,MAAc,iBACZ,WACuC;AACvC,QACE,UAAU,aAAa,KAAK,UAAU,YACtC,UAAU,aAAa,KAAK,UAAU,aAAa,YACnD,UAAU,aAAa,KAAK,UAC5B;AACA,YAAM,IAAI;AAAA,QACR;AAAA,QACA;AAAA,MACF;AAAA,IACF;AACA,QAAI,KAAK,oBAAoB,IAAI,UAAU,KAAK,GAAG;AACjD,YAAM,IAAI;AAAA,QACR;AAAA,QACA;AAAA,MACF;AAAA,IACF;AACA,SAAK,oBAAoB,IAAI,UAAU,KAAK;AAC5C,UAAM,YAAY,IAAI;AAAA,MACpB,KAAK,IAAI,EAAE,QAAQ,IAAI,KAAK,yBAAyB;AAAA,IACvD,EACG,YAAY,EACZ,QAAQ,SAAS,GAAG;AACvB,UAAM,QAAQ;AAAA,MACZ,QAAQ;AAAA,MACR,UAAU,KAAK,UAAU;AAAA,MACzB,oBAAoB,KAAK;AAAA,MACzB,WAAW,KAAK;AAAA,MAChB,eAAe,KAAK;AAAA,MACpB,uBAAuB,KAAK;AAAA,MAC5B,2BAA2B,KAAK;AAAA,MAChC,UAAU,KAAK;AAAA,MACf,OAAO,UAAU;AAAA,MACjB;AAAA,MACA,GAAI,KAAK,aAAa,SAAY,CAAC,IAAI,EAAE,UAAU,KAAK,SAAS;AAAA,IACnE;AACA,UAAM,YACJ,KAAK,kBAAmB,0BAA0B,SAC9C,MAAM,KAAK,kBAAmB,eAAe;AAAA,MAC3C,GAAG;AAAA,MACH,aAAa,UAAU;AAAA,MACvB,UAAU;AAAA,MACV,OAAO,KAAK,kBAAmB;AAAA,IACjC,CAAC,IACD,MAAM,KAAK,kBAAmB,sBAAsB,KAAK;AAC/D,QAAI,OAAO,cAAc,YAAY,UAAU,WAAW,GAAG;AAC3D,YAAM,IAAI;AAAA,QACR;AAAA,QACA;AAAA,MACF;AAAA,IACF;AACA,WAAO;AAAA,MACL,GAAG;AAAA,MACH,iBAAiB;AAAA,QACf,OAAO,KAAK,kBAAmB,SAAS,UAAU,eAAe,CAAC;AAAA,QAClE,WAAW,KAAK;AAAA,QAChB,OAAO;AAAA,MACT;AAAA,IACF;AAAA,EACF;AAAA,EAEA,MAAc,YACZ,WACA,cAC6B;AAC7B,SAAK;AACL,SAAK,gCAAgC;AACrC,UAAM,WAAW,MAAM,KAAK,mBAAmB;AAAA,MAC7C,QAAQ;AAAA,MACR,KAAK,GAAG,kBAAkB,KAAK,UAAU,aAAa,QAAQ,CAAC;AAAA,MAC/D,UAAU;AAAA,MACV,0BAA0B,CAAC,GAAG,KAAK,qBAAqB;AAAA,MACxD,MAAM,EAAE,aAAa;AAAA,IACvB,CAAC;AACD,UAAM,SAAS;AAAA,MACb,SAAS;AAAA,MACT;AAAA,MACA;AAAA,IACF;AACA,WAAO,KAAK,yBAAyB,OAAO,UAAU;AAAA,EACxD;AAAA,EAEA,MAAc,yBACZ,OAC6B;AAC7B,UAAM,SAAS,kCAAkC,KAAK;AACtD,QAAI,OAAO,aAAa,KAAK,UAAU,UAAU;AAC/C,YAAM,IAAI;AAAA,QACR;AAAA,QACA;AAAA,MACF;AAAA,IACF;AACA,QAAI,OAAO,cAAc,KAAK,cAAc;AAC1C,YAAM,IAAI;AAAA,QACR;AAAA,QACA;AAAA,MACF;AAAA,IACF;AACA,QAAI,OAAO,cAAc,KAAK,gBAAgB;AAC5C,YAAM,IAAI;AAAA,QACR;AAAA,QACA;AAAA,MACF;AAAA,IACF;AACA,QAAI,OAAO,gBAAgB,KAAK;AAC9B,YAAM,IAAI;AAAA,QACR;AAAA,QACA;AAAA,MACF;AAAA,IACF;AACA,UAAM,WAAWA,oBAAmB,OAAO,QAAQ;AACnD,UAAM,YAAYA,oBAAmB,OAAO,SAAS;AACrD,QACE,aAAa,YACb,YAAY,WAAW,OAAO,gBAAgB,KAC9C;AACA,YAAM,IAAI;AAAA,QACR;AAAA,QACA;AAAA,MACF;AAAA,IACF;AACA,UAAM,eAAe,OAAO,aAAa;AAAA,MAAI,CAAC,YAAY,UACxD,sBAAsB,YAAY,6BAA6B,KAAK,GAAG;AAAA,IACzE;AACA,eAAW,WAAW,cAAc;AAClC,UACE,CAAC,KAAK,uBAAuB;AAAA,QAAK,CAAC,cACjC,yBAAyB,WAAW,OAAO;AAAA,MAC7C,GACA;AACA,cAAM,IAAI;AAAA,UACR;AAAA,UACA;AAAA,QACF;AAAA,MACF;AAAA,IACF;AACA,QACE,OAAO,OAAO,YAAY,YAC1B,OAAO,QAAQ,MAAM,GAAG,EAAE,WAAW,GACrC;AACA,YAAM,IAAI;AAAA,QACR;AAAA,QACA;AAAA,MACF;AAAA,IACF;AACA,UAAM,aAAa,EAAE,GAAG,QAAQ,aAAa;AAC7C,UAAM,WAAW,MAAM,KAAK,UAAU,QAAQ;AAAA,MAC5C,QAAQ;AAAA,MACR,KAAK,GAAG,kBAAkB,KAAK,UAAU,UAAU,QAAQ,CAAC;AAAA,MAC5D,SAAS,EAAE,eAAe,OAAO,QAAQ;AAAA,MACzC,UAAU;AAAA,MACV,0BAA0B,CAAC,GAAG,KAAK,kBAAkB;AAAA,IACvD,CAAC;AACD,SAAK,wBAAwB,UAAU,WAAW;AAClD,UAAM,UAAU,qBAAqB,QAAQ;AAC7C,UAAM,SAAS,KAAK,UAAU,UAAU;AACxC,QACE,CAAC,QAAQ,UAAU,SAAS,MAAM,KAClC,QAAQ,QAAQ,SAAS,MAAM,GAC/B;AACA,YAAM,IAAI;AAAA,QACR;AAAA,QACA,QAAQ,UAAU,SAAS,MAAM,KAAK,QAAQ,QAAQ,SAAS,MAAM,IACjE,2DACA;AAAA,MACN;AAAA,IACF;AACA,SAAK,wBAAwB,oBAAoB,OAAO,OAAO;AAC/D,WAAO;AAAA,EACT;AAAA,EAEQ,wBACN,UACA,MACM;AACN,SAAK;AAAA,MACH;AAAA,MACA,KAAK,UAAU,UAAU;AAAA,MACzB;AAAA,MACA,KAAK;AAAA,MACL;AAAA,IACF;AAAA,EACF;AAAA,EAEQ,kCAAwC;AAC9C,QAAI,KAAK,iCAAiC,KAAK,IAAI,EAAE,QAAQ,GAAG;AAC9D,YAAM,IAAI;AAAA,QACR;AAAA,QACA;AAAA,QACA;AAAA,MACF;AAAA,IACF;AAAA,EACF;AAAA,EAEQ,2BACN,UACA,MACM;AACN,SAAK;AAAA,MACH;AAAA,MACA,KAAK,UAAU,aAAa;AAAA,MAC5B;AAAA,MACA,KAAK;AAAA,MACL;AAAA,IACF;AAAA,EACF;AAAA,EAEQ,uBACN,UACA,UACA,MACA,kBACA,MACM;AACN,UAAM,WAAW,GAAG,kBAAkB,QAAQ,CAAC,GAAG,IAAI;AACtD,UAAM,QAAQ,CAAC,YAAoB,cAAc,MAAM,OAAO;AAC9D,QACE,SAAS,aAAa,YACtB,SAAS,oBAAoB,QAC7B;AACA,YAAM;AAAA,QACJ,GAAG,IAAI;AAAA,MACT;AAAA,IACF;AACA,QAAI,CAAC,iBAAiB,IAAI,YAAY,SAAS,eAAe,CAAC,GAAG;AAChE,YAAM,MAAM,GAAG,IAAI,4CAA4C;AAAA,IACjE;AAAA,EACF;AAAA,EAEQ,4BACN,YACA,WACM;AACN,QAAI,KAAK,gBAAgB,UAAU,GAAG;AACpC,YAAM,IAAI;AAAA,QACR;AAAA,QACA;AAAA,QACA;AAAA,MACF;AAAA,IACF;AACA,QACE,CAAC,WAAW,aAAa;AAAA,MAAK,CAAC,YAC7B,yBAAyB,SAAS,SAAS;AAAA,IAC7C,GACA;AACA,YAAM,IAAI;AAAA,QACR;AAAA,QACA;AAAA,QACA;AAAA,MACF;AAAA,IACF;AAAA,EACF;AAAA,EAEQ,iCACN,YACA,WACkB;AAClB,UAAM,aAAa,WAAW,aAAa;AAAA,MACzC,CAAC,eACC,WAAW,YAAY,mBACvB,WAAW,QAAQ,SAAS,oBAAoB;AAAA,IACpD;AACA,QAAI,eAAe,QAAW;AAC5B,YAAM,IAAI;AAAA,QACR;AAAA,QACA;AAAA,QACA;AAAA,MACF;AAAA,IACF;AACA,QAAI,WAAW,YAAY,QAAW;AACpC,YAAM,aACJ,WAAW,QAOX;AACF,YAAM,0BAA0B,YAAY;AAAA,QAC1C,CAAC,cACC,UAAU,SAAS,UAAU,QAC7B,UAAU,QAAQ,UAAU,OAC5B,MAAM,QAAQ,UAAU,WAAW,KACnC,gBAAgB,UAAU,WAAW,MACnC,gBAAgB,UAAU,WAAW;AAAA,MAC3C;AACA,UAAI,CAAC,yBAAyB;AAC5B,cAAM,IAAI;AAAA,UACR;AAAA,UACA;AAAA,UACA;AAAA,QACF;AAAA,MACF;AACA,aAAO;AAAA,IACT;AACA,WAAO;AAAA,MACL;AAAA,QACE,SAAS;AAAA,QACT,OAAO,WAAW;AAAA,QAClB,MAAM,WAAW;AAAA,QACjB,SAAS,CAAC,oBAAoB;AAAA,MAChC;AAAA,MACA;AAAA,IACF;AAAA,EACF;AAAA,EAEQ,gBAAgB,YAAyC;AAC/D,UAAM,YAAYA,oBAAmB,WAAW,SAAS;AACzD,WACE,YAAY,KAAK,IAAI,EAAE,QAAQ,KAAK,gCAAgC;AAAA,EAExE;AAAA,EAEA,MAAc,0BACZ,SACgC;AAChC,QAAI;AACJ,UAAM,WAAW,KAAK,IAAI,GAAG,KAAK,mBAAmB;AACrD,aAAS,UAAU,GAAG,UAAU,UAAU,WAAW;AACnD,UAAI;AACF,cAAM,WAAW,MAAM,KAAK,UAAU,QAAQ,OAAO;AACrD,aAAK,2BAA2B,UAAU,sBAAsB;AAChE,YAAI,SAAS,UAAU,KAAK;AAC1B,sBAAY,IAAI,MAAM,mBAAmB,SAAS,MAAM,EAAE;AAAA,QAC5D,WAAW,SAAS,UAAU,KAAK;AACjC,gBAAM,SAAS,gBAAgB,SAAS,IAAI;AAC5C,cAAI,WAAW,QAAW;AACxB,kBAAM,eAAe,QAAQ,SAAS,MAAM;AAAA,UAC9C;AACA,gBAAM,IAAI;AAAA,YACR;AAAA,YACA;AAAA,UACF;AAAA,QACF,OAAO;AACL,iBAAO;AAAA,QACT;AAAA,MACF,SAAS,OAAO;AACd,YACE,iBAAiB,4BACjB,MAAM,UAAU,eAChB;AACA,gBAAM;AAAA,QACR;AACA,oBAAY;AAAA,MACd;AACA,UAAI,UAAU,IAAI,UAAU;AAC1B,cAAM,KAAK,MAAM,WAAW,SAAS,KAAK,OAAO,CAAC,CAAC;AAAA,MACrD;AAAA,IACF;AACA,UAAM,IAAI;AAAA,MACR;AAAA,MACA,qBAAqB,QACjB,UAAU,UACV;AAAA,MACJ;AAAA,IACF;AAAA,EACF;AAAA,EAEA,MAAc,mBACZ,SACgC;AAChC,QAAI;AACF,YAAM,WAAW,MAAM,KAAK,UAAU,QAAQ,OAAO;AACrD,WAAK,2BAA2B,UAAU,oBAAoB;AAC9D,UAAI,SAAS,UAAU,KAAK;AAC1B,cAAM,IAAI;AAAA,UACR;AAAA,UACA,mBAAmB,SAAS,MAAM;AAAA,UAClC;AAAA,QACF;AAAA,MACF;AACA,UAAI,SAAS,UAAU,KAAK;AAC1B,cAAM,SAAS,gBAAgB,SAAS,IAAI;AAC5C,YAAI,WAAW,QAAW;AACxB,gBAAM,eAAe,QAAQ,SAAS,MAAM;AAAA,QAC9C;AACA,cAAM,IAAI;AAAA,UACR;AAAA,UACA;AAAA,QACF;AAAA,MACF;AACA,aAAO;AAAA,IACT,SAAS,OAAO;AACd,UAAI,iBAAiB,0BAA0B;AAC7C,cAAM;AAAA,MACR;AACA,YAAM,IAAI;AAAA,QACR;AAAA,QACA,iBAAiB,QAAQ,MAAM,UAAU;AAAA,QACzC;AAAA,MACF;AAAA,IACF;AAAA,EACF;AACF;AAEA,eAAsB,0BACpB,SAC8B;AAC9B,SAAO,oBAAoB,OAAO,OAAO;AAC3C;AAEA,SAAS,eAAe,OAEtB;AACA,QAAM,aAAa,kBAAkB,OAAO,+BAA+B;AAC3E,QAAM,SAAS,gBAAgB,UAAU,UAAU;AACnD,MAAI,CAAC,OAAO,SAAS;AACnB,UAAM,IAAI;AAAA,MACR,OAAO,MAAM,OAAO,KAAK,CAAC,UAAU,MAAM,SAAS,mBAAmB,IAClE,oCACA;AAAA,MACJ,OAAO,MAAM;AAAA,MACb;AAAA,IACF;AAAA,EACF;AACA,SAAO,OAAO;AAKhB;AAEA,eAAe,yBACb,WACA,SACA;AACA,MAAI;AACF,WAAO,MAAM,qCAAqC;AAAA,MAChD,cAAc,UAAU,aAAa;AAAA,MACrC,UAAU,QAAQ;AAAA,MAClB,UAAU,QAAQ;AAAA,MAClB,gBAAgB,QAAQ;AAAA,MACxB,MAAM,QAAQ,QAAQ,MAAM,oBAAI,KAAK,IAAI,EACtC,YAAY,EACZ,QAAQ,SAAS,GAAG;AAAA,MACvB,uBAAuB;AAAA,MACvB,0BAA0B;AAAA,IAC5B,CAAC;AAAA,EACH,SAAS,OAAO;AACd,UAAM,OAAO,0BAA0B,KAAK;AAC5C,UAAM,IAAI;AAAA,MACR;AAAA,MACA,iBAAiB,QAAQ,MAAM,UAAU,OAAO,KAAK;AAAA,MACrD;AAAA,IACF;AAAA,EACF;AACF;AAEA,SAAS,0BACP,OAC8B;AAC9B,QAAM,OACJ,OAAO,UAAU,YAAY,UAAU,QAAQ,UAAU,QACpD,MAA6B,OAC9B;AACN,MAAI,SAAS,0CAA0C;AACrD,WAAO;AAAA,EACT;AACA,MAAI,SAAS,uCAAuC;AAClD,WAAO;AAAA,EACT;AACA,MAAI,SAAS,0CAA0C;AACrD,WAAO;AAAA,EACT;AACA,SAAO;AACT;AAEA,SAAS,sBAAsB,OAAgB,MAAgC;AAC7E,MAAI;AACF,WAAO;AAAA,MACL;AAAA,IACF;AAAA,EACF,SAAS,OAAO;AACd,UAAM,IAAI;AAAA,MACR;AAAA,MACA,GAAG,IAAI,KAAK,iBAAiB,QAAQ,MAAM,UAAU,OAAO,KAAK,CAAC;AAAA,IACpE;AAAA,EACF;AACF;AAEA,SAAS,8BACP,eACoB;AACpB,MAAI,OAAO,kBAAkB,UAAU;AACrC,UAAM,IAAI;AAAA,MACR;AAAA,MACA;AAAA,MACA;AAAA,IACF;AAAA,EACF;AACA,QAAM,YAAY,6BAA6B,IAAI,aAAa;AAChE,MAAI,cAAc,QAAW;AAC3B,UAAM,IAAI;AAAA,MACR;AAAA,MACA;AAAA,MACA;AAAA,IACF;AAAA,EACF;AACA,SAAO;AACT;AAEA,SAAS,sCACP,OACkB;AAClB,QAAM,aAAa,kBAAkB,OAAO,8BAA8B;AAC1E,SAAO,0BAA0B,UAAU;AAC7C;AAEA,SAAS,0BACP,cACQ;AACR,QAAM,YAAY,CAAC,GAAG,YAAY,EAAE;AAAA,IAAK,CAAC,MAAM,UAC9C,GAAG,KAAK,OAAO,KAAK,KAAK,KAAK,KAAK,KAAK,IAAI,GAAG;AAAA,MAC7C,GAAG,MAAM,OAAO,KAAK,MAAM,KAAK,KAAK,MAAM,IAAI;AAAA,IACjD;AAAA,EACF;AACA,QAAM,UAAU,IAAI,YAAY;AAChC,QAAM,SAAS,QAAQ;AAAA,IACrB;AAAA,EACF;AACA,QAAM,OAAO,QAAQ,OAAO,gBAAgB,SAAS,CAAC;AACtD,QAAM,QAAQ,IAAI,WAAW,OAAO,SAAS,KAAK,MAAM;AACxD,QAAM,IAAI,QAAQ,CAAC;AACnB,QAAM,IAAI,MAAM,OAAO,MAAM;AAC7B,aAAO,6BAAW,qBAAO,OAAO,OAAO,CAAC,EAAE,MAAM,CAAC;AACnD;AAEA,SAAS,wBACP,YAC0B;AAC1B,QAAM,SAAS,kCAAkC,WAAW,OAAO;AACnE,QAAM,UAAU,CAAC,UAAyB;AACxC,UAAM,IAAI;AAAA,MACR;AAAA,MACA,uBAAuB,KAAK;AAAA,IAC9B;AAAA,EACF;AACA,MAAI,WAAW,iBAAiB,oBAAoB,WAAW,OAAO;AACpE,YAAQ,cAAc;AACxB,MAAI,WAAW,cAAc,OAAO,UAAW,SAAQ,WAAW;AAClE,MAAI,WAAW,cAAc,OAAO,UAAW,SAAQ,WAAW;AAClE,MAAI,WAAW,aAAa,OAAO,SAAU,SAAQ,UAAU;AAC/D,MAAI,KAAK,MAAM,WAAW,QAAQ,MAAM,OAAO;AAC7C,YAAQ,UAAU;AACpB,MAAI,KAAK,MAAM,WAAW,SAAS,MAAM,OAAO;AAC9C,YAAQ,WAAW;AACrB,MAAI,WAAW,aAAa,OAAO,SAAU,SAAQ,UAAU;AAC/D,MAAI,WAAW,eAAe,OAAO,WAAY,SAAQ,YAAY;AACrE,MAAI,WAAW,sBAAsB,OAAO;AAC1C,YAAQ,mBAAmB;AAC7B,MAAI,WAAW,mBAAmB,OAAO;AACvC,YAAQ,gBAAgB;AAC1B,SAAO;AAAA,IACL,cAAc,oBAAoB,WAAW,OAAO;AAAA,IACpD,WAAW,OAAO;AAAA,IAClB,WAAW,OAAO;AAAA,IAClB,UAAU,OAAO;AAAA,IACjB,UAAU,IAAI,KAAK,OAAO,UAAU,EAAE,YAAY,EAAE,QAAQ,SAAS,GAAG;AAAA,IACxE,WAAW,IAAI,KAAK,OAAO,WAAW,EAAE,YAAY,EAAE,QAAQ,SAAS,GAAG;AAAA,IAC1E,UAAU,OAAO;AAAA,IACjB,eAAe,KAAK,MAAM,OAAO,cAAc,OAAO,cAAc,GAAI;AAAA,IACxE,cAAc,OAAO;AAAA,IACrB,SAAS,WAAW;AAAA,EACtB;AACF;AAQO,SAAS,kCACd,OACoB;AACpB,SAAO;AAAA,IACL,mBAAmB,OAAO,sBAAsB,qBAAqB;AAAA,EACvE;AACF;AAEA,SAAS,kCAAkC,SAWzC;AACA,MAAI;AACF,UAAM,QAAQ,QAAQ,MAAM,GAAG;AAC/B,QAAI,MAAM,WAAW,EAAG,OAAM,IAAI,MAAM,iBAAiB;AACzD,UAAM,UAAU;AAAA,MACd,KAAK,MAAM,IAAI,YAAY,EAAE,OAAO,eAAe,MAAM,CAAC,CAAE,CAAC,CAAC;AAAA,IAChE;AACA,UAAM,SAAS,sBAAsB,SAAS,KAAK;AACnD,UAAM,YAAY,sBAAsB,SAAS,KAAK;AACtD,UAAM,WAAW,qBAAqB,SAAS,KAAK;AACpD,UAAM,YAAY,qBAAqB,SAAS,KAAK;AACrD,UAAM,QAAQ,QAAQ;AACtB,QAAI,CAAC,MAAM,QAAQ,KAAK,EAAG,OAAM,IAAI,MAAM,oBAAoB;AAC/D,UAAM,iBAAiB,MAAM;AAAA,MAC3B,CAACE,UACCA,UAAS,QACT,OAAOA,UAAS,YAChB,CAAC,MAAM,QAAQA,KAAI,KACnB,mCAAmCA;AAAA,IACvC;AACA,QAAI,eAAe,WAAW;AAC5B,YAAM,IAAI,MAAM,0CAA0C;AAC5D,UAAM,OAAO,eAAe,CAAC;AAC7B,UAAM,WAAW;AAAA,MACf;AAAA,MACA;AAAA,IACF;AACA,UAAM,aAAa;AAAA,MACjB;AAAA,MACA;AAAA,IACF;AACA,UAAM,oBAAoB;AAAA,MACxB;AAAA,MACA;AAAA,IACF;AACA,QAAI,CAAC,iBAAiB,KAAK,iBAAiB,GAAG;AAC7C,YAAM,IAAI;AAAA,QACR;AAAA,MACF;AAAA,IACF;AACA,UAAM,iBAAiB;AAAA,MACrB;AAAA,MACA;AAAA,IACF;AACA,UAAM,iBAAiB;AAAA,MACrB;AAAA,MACA;AAAA,IACF;AACA,QAAI,mBAAmB;AACrB,YAAM,IAAI,MAAM,kCAAkC;AACpD,QAAI,mBAAmB;AACrB,YAAM,IAAI,MAAM,iCAAiC;AACnD,UAAM,MAAM,QAAQ;AACpB,QAAI,QAAQ,QAAQ,OAAO,QAAQ,YAAY,MAAM,QAAQ,GAAG,GAAG;AACjE,YAAM,IAAI,MAAM,oBAAoB;AAAA,IACtC;AACA,UAAM,eAAmC,CAAC;AAC1C,eAAW,CAAC,UAAU,YAAY,KAAK,OAAO,QAAQ,GAAG,GAAG;AAC1D,UACE,iBAAiB,QACjB,OAAO,iBAAiB,YACxB,MAAM,QAAQ,YAAY,GAC1B;AACA,cAAM,IAAI,MAAM,gCAAgC;AAAA,MAClD;AACA,YAAM,YAAY;AAClB,YAAM,SAAS,SAAS,QAAQ,OAAO;AACvC,UAAI,CAAC,SAAS,WAAW,YAAY,KAAK,SAAS;AACjD,cAAM,IAAI,MAAM,2BAA2B;AAC7C,YAAM,QAAQ,SAAS,MAAM,GAAG,MAAM;AACtC,YAAM,OAAO,SAAS,MAAM,SAAS,QAAQ,MAAM;AACnD,iBAAW,CAAC,QAAQ,UAAU,KAAK,OAAO,QAAQ,SAAS,GAAG;AAC5D,cAAM,UAAU,OAAO,WAAW,gBAAgB,IAC9C,kBACA,OAAO,WAAW,eAAe,IAC/B,iBACA;AACN,YAAI,CAAC,MAAM,QAAQ,UAAU,KAAK,WAAW,WAAW,GAAG;AACzD,gBAAM,IAAI,MAAM,kDAAkD;AAAA,QACpE;AACA,cAAM,UAAU;AAChB,YAAI,YAAY,OAAW,OAAM,IAAI,MAAM,0BAA0B;AACrE,cAAM,QAAQ,QAAQ,CAAC;AACvB,qBAAa;AAAA,UACX,0BAA0B;AAAA,YACxB;AAAA,YACA;AAAA,YACA;AAAA,YACA,SAAS,CAAC,MAAM;AAAA,YAChB,GAAI,UAAU,QACd,OAAO,UAAU,YACjB,CAAC,MAAM,QAAQ,KAAK,KACpB,OAAO,KAAK,KAAK,EAAE,SAAS,IACxB,EAAE,SAAS,MAAM,IACjB,CAAC;AAAA,UACP,CAAC;AAAA,QACH;AAAA,MACF;AAAA,IACF;AACA,QAAI,aAAa,WAAW,EAAG,OAAM,IAAI,MAAM,mBAAmB;AAClE,UAAM,WAAW,OAAO,QAAQ,GAAG;AACnC,UAAM,YAAY,WAAW,IAAI,SAAS,OAAO,MAAM,GAAG,QAAQ;AAClE,QAAI,CAAC,UAAU,WAAW,MAAM,KAAK,CAAC,UAAU,WAAW,MAAM,GAAG;AAClE,YAAM,IAAI,MAAM,sCAAsC;AAAA,IACxD;AACA,WAAO;AAAA,MACL;AAAA,MACA;AAAA,MACA;AAAA,MACA;AAAA,MACA;AAAA,MACA;AAAA,MACA,YAAY,WAAW;AAAA,MACvB,aAAa,YAAY;AAAA,MACzB,UAAU;AAAA,MACV;AAAA,IACF;AAAA,EACF,SAAS,OAAO;AACd,UAAM,IAAI;AAAA,MACR;AAAA,MACA,qDAAqD,iBAAiB,QAAQ,MAAM,UAAU,OAAO,KAAK,CAAC;AAAA,IAC7G;AAAA,EACF;AACF;AAEA,SAAS,sBACP,SACA,KACQ;AACR,QAAM,QAAQ,QAAQ,GAAG;AACzB,MAAI,OAAO,UAAU,YAAY,MAAM,WAAW,GAAG;AACnD,UAAM,IAAI,MAAM,QAAQ,GAAG,4BAA4B;AAAA,EACzD;AACA,SAAO;AACT;AAEA,SAAS,qBACP,SACA,KACQ;AACR,QAAM,QAAQ,QAAQ,GAAG;AACzB,MAAI,OAAO,UAAU,YAAY,CAAC,OAAO,cAAc,KAAK,KAAK,QAAQ,GAAG;AAC1E,UAAM,IAAI,MAAM,QAAQ,GAAG,sCAAsC;AAAA,EACnE;AACA,SAAO;AACT;AAEA,SAAS,eAAe,OAA2B;AACjD,QAAM,aAAa,MAAM,QAAQ,MAAM,GAAG,EAAE,QAAQ,MAAM,GAAG;AAC7D,QAAM,SAAS,WAAW,OAAO,KAAK,KAAK,WAAW,SAAS,CAAC,IAAI,GAAG,GAAG;AAC1E,QAAM,SAAS,KAAK,MAAM;AAC1B,SAAO,WAAW,KAAK,QAAQ,CAAC,cAAc,UAAU,WAAW,CAAC,CAAC;AACvE;AAEA,SAAS,mBACP,OACA,QACA,OACG;AACH,QAAM,aAAa;AAAA,IACjB;AAAA,IACA;AAAA,EACF;AACA,QAAM,SAAS,gBAAgB,UAAU;AACzC,MAAI,WAAW,QAAW;AACxB,UAAM,eAAe,MAAM;AAAA,EAC7B;AACA,QAAM,SAAS,OAAO,UAAU,UAAU;AAC1C,MAAI,CAAC,OAAO,SAAS;AACnB,UAAM,IAAI;AAAA,MACR;AAAA,MACA,GAAG,KAAK,uBAAuB,OAAO,MAAM,OAAO;AAAA,IACrD;AAAA,EACF;AACA,SAAO,OAAO;AAChB;AA2CA,SAAS,qBACP,UACuC;AACvC,MAAI,SAAS,WAAW,KAAK;AAC3B,UAAM,IAAI;AAAA,MACR;AAAA,MACA,yCAAyC,SAAS,MAAM;AAAA,MACxD,SAAS,UAAU,MAAM,YAAY;AAAA,MACrC;AAAA,MACA,SAAS;AAAA,IACX;AAAA,EACF;AACA,QAAM,aAAa;AAAA,IACjB,SAAS;AAAA,IACT;AAAA,EACF;AACA,QAAM,SAAS,sBAAsB,UAAU,UAAU;AACzD,MAAI,CAAC,OAAO,SAAS;AACnB,UAAM,IAAI;AAAA,MACR;AAAA,MACA,oDAAoD,OAAO,MAAM,OAAO;AAAA,IAC1E;AAAA,EACF;AACA,SAAO,OAAO;AAChB;AAEA,SAAS,sBACP,UACA,QACA,OACG;AACH,MAAI,SAAS,UAAU,KAAK;AAC1B,UAAM,IAAI;AAAA,MACR;AAAA,MACA,GAAG,KAAK,kBAAkB,SAAS,MAAM,KAAK,iBAAiB,SAAS,IAAI,CAAC;AAAA,MAC7E;AAAA,MACA;AAAA,MACA,SAAS;AAAA,IACX;AAAA,EACF;AACA,MAAI,SAAS,UAAU,KAAK;AAC1B,UAAM,IAAI;AAAA,MACR;AAAA,MACA,GAAG,KAAK,iBAAiB,iBAAiB,SAAS,IAAI,CAAC;AAAA,MACxD;AAAA,MACA;AAAA,MACA,SAAS;AAAA,IACX;AAAA,EACF;AACA,QAAM,aAAa;AAAA,IACjB,SAAS;AAAA,IACT;AAAA,EACF;AACA,QAAM,SAAS,OAAO,UAAU,UAAU;AAC1C,MAAI,CAAC,OAAO,SAAS;AACnB,UAAM,IAAI;AAAA,MACR;AAAA,MACA,GAAG,KAAK,qCAAqC,OAAO,MAAM,OAAO;AAAA,IACnE;AAAA,EACF;AACA,SAAO,OAAO;AAChB;AAEA,SAAS,iBAAiB,MAAuB;AAC/C,MAAI,OAAO,SAAS,SAAU,QAAO;AACrC,MAAI,SAAS,QAAQ,OAAO,SAAS,UAAU;AAC7C,UAAM,SAAS;AACf,UAAM,OAAO,OAAO,OAAO,SAAS,WAAW,OAAO,OAAO;AAC7D,UAAM,UACJ,OAAO,OAAO,YAAY,WAAW,OAAO,UAAU;AACxD,QAAI,SAAS;AACX,aAAO,YAAY,SAAY,OAAO,GAAG,IAAI,KAAK,OAAO;AAAA,EAC7D;AACA,SAAO;AACT;AAEO,SAAS,oBAAoB,SAAyB;AAC3D,QAAM,aAAS,cAAAC,QAAa,QAAM,sBAAO,IAAI,YAAY,EAAE,OAAO,OAAO,CAAC,CAAC;AAC3E,SAAO,eAAI,SAAS,IAAM,MAAM,EAAE,SAAS;AAC7C;AAEA,SAAS,cAAc,SAAiD;AACtE,SAAO,MAAM,QAAQ,OAAO,IAAI,OAAO,YAAY,OAAO,IAAI;AAChE;AAEA,eAAe,4BACb,UACA,WAC8B;AAC9B,SAAO,iCAAiC,UAAU,WAAW,YAAY;AAC3E;AAEA,eAAe,iCACb,UACA,WACA,MAC8B;AAC9B,MAAI;AACJ,MAAI;AACF,UAAM,IAAI,IAAI,QAAQ;AAAA,EACxB,QAAQ;AACN,UAAM,cAAc,MAAM,GAAG,IAAI,wBAAwB;AAAA,EAC3D;AACA,MACE,IAAI,aAAa,YACjB,IAAI,aAAa,MACjB,IAAI,aAAa,MACjB,IAAI,SAAS,MACb,IAAI,WAAW,IACf;AACA,UAAM;AAAA,MACJ;AAAA,MACA,GAAG,IAAI;AAAA,IACT;AAAA,EACF;AACA,MAAI,UAAU,oBAAoB,QAAW;AAC3C,UAAM;AAAA,MACJ;AAAA,MACA,GAAG,IAAI;AAAA,IACT;AAAA,EACF;AACA,MAAI;AACJ,MAAI;AACF,iBAAa,MAAM,UAAU,gBAAgB,IAAI,MAAM;AAAA,EACzD,SAAS,OAAO;AACd,UAAM;AAAA,MACJ;AAAA,MACA,GAAG,IAAI,gCAAgC,iBAAiB,QAAQ,MAAM,UAAU,OAAO,KAAK,CAAC;AAAA,IAC/F;AAAA,EACF;AACA,MAAI,WAAW,UAAU,WAAW,GAAG;AACrC,UAAM,cAAc,MAAM,GAAG,IAAI,oCAAoC;AAAA,EACvE;AACA,QAAM,YAAY,oBAAI,IAAY;AAClC,aAAW,WAAW,WAAW,WAAW;AAC1C,UAAM,aAAa,YAAY,OAAO;AACtC,QAAI,CAAC,WAAW,UAAU,GAAG;AAC3B,YAAM;AAAA,QACJ;AAAA,QACA,GAAG,IAAI,+CAA+C,OAAO;AAAA,MAC/D;AAAA,IACF;AACA,cAAU,IAAI,UAAU;AAAA,EAC1B;AACA,SAAO;AACT;AAEA,SAAS,cACP,MACA,SAC0B;AAC1B,SAAO,IAAI;AAAA,IACT,SAAS,eACL,0CACA;AAAA,IACJ;AAAA,IACA;AAAA,EACF;AACF;AAEA,SAAS,YAAY,OAAuB;AAC1C,SAAO,MAAM,YAAY,EAAE,QAAQ,YAAY,EAAE;AACnD;AAEA,SAAS,WAAW,OAAwB;AAC1C,QAAM,KAAK,YAAY,KAAK;AAC5B,QAAM,QAAQ,GAAG,MAAM,GAAG;AAC1B,MACE,MAAM,WAAW,KACjB,MAAM,MAAM,CAAC,SAAS,QAAQ,KAAK,IAAI,KAAK,OAAO,IAAI,KAAK,GAAG,GAC/D;AACA,UAAM,CAAC,GAAG,CAAC,IAAI,MAAM,IAAI,MAAM;AAC/B,WAAO,EACL,MAAM,KACN,MAAM,MACN,MAAM,OACL,MAAM,OAAO,KAAK,MAAM,KAAK,OAC7B,MAAM,OAAO,MAAM,OACnB,MAAM,OAAO,KAAK,MAAM,KAAK,MAC7B,MAAM,OAAO,MAAM,KACnB,MAAM,OAAO,MAAM,OACnB,MAAM,QAAQ,MAAM,MAAM,MAAM,OAChC,MAAM,OAAO,MAAM,MAAM,MAAM,CAAC,MAAM,SACtC,MAAM,OAAO,MAAM,KAAK,MAAM,CAAC,MAAM,SACtC,KAAK;AAAA,EAET;AACA,MAAI,CAAC,GAAG,SAAS,GAAG,EAAG,QAAO;AAC9B,MACE,OAAO,QACP,OAAO,SACP,GAAG,WAAW,WAAW,KACzB,GAAG,WAAW,KAAK,KACnB,GAAG,WAAW,KAAK,KACnB,GAAG,WAAW,KAAK,KACnB,GAAG,WAAW,KAAK,KACnB,GAAG,WAAW,IAAI,KAClB,GAAG,WAAW,IAAI,KAClB,GAAG,WAAW,IAAI;AAElB,WAAO;AACT,QAAM,SAAS,GAAG,MAAM,+BAA+B;AACvD,MAAI,WAAW,KAAM,QAAO,WAAW,OAAO,CAAC,CAAE;AACjD,QAAM,YAAY,GAAG,MAAM,0CAA0C;AACrE,MAAI,cAAc,MAAM;AACtB,UAAM,OAAO,OAAO,SAAS,UAAU,CAAC,GAAI,EAAE;AAC9C,UAAM,MAAM,OAAO,SAAS,UAAU,CAAC,GAAI,EAAE;AAC7C,WAAO,WAAW,GAAG,QAAQ,CAAC,IAAI,OAAO,GAAG,IAAI,OAAO,CAAC,IAAI,MAAM,GAAG,EAAE;AAAA,EACzE;AACA,SAAO;AACT;AAEA,SAAS,gBACP,OAGY;AACZ,QAAM,aAAa;AAAA,IACjB;AAAA,IACA;AAAA,EACF;AACA,QAAM,SAAS,aAAa,UAAU,UAAU;AAChD,MAAI,OAAO,SAAS;AAClB,WAAO,EAAE,MAAM,OAAO,KAAK,MAAM,SAAS,OAAO,KAAK,QAAQ;AAAA,EAChE;AACA,QAAM,WAAW,0BAA0B,UAAU,UAAU;AAC/D,MAAI,SAAS,SAAS;AACpB,WAAO;AAAA,MACL,MAAM,SAAS,KAAK,MAAM;AAAA,MAC1B,SAAS,SAAS,KAAK,MAAM;AAAA,IAC/B;AAAA,EACF;AACA,SAAO;AACT;AAEA,SAAS,eACP,QACA,QAC0B;AAC1B,QAAM,cACJ,OAAO,SAAS,qBAChB,OAAO,SAAS,oBAChB,OAAO,SAAS;AAClB,SAAO,IAAI;AAAA,IACT,wBAAwB,OAAO,IAAI;AAAA,IACnC,OAAO,WAAW,wBAAwB,OAAO,IAAI;AAAA,IACrD,cAAc,iBAAiB;AAAA,IAC/B,OAAO;AAAA,IACP;AAAA,EACF;AACF;AAEA,SAAS,WAAW,SAAiB,QAAwB;AAC3D,QAAM,OAAO,KAAK,IAAI,qCAAqC,KAAK,KAAK,OAAO;AAC5E,SAAO,KAAK;AAAA,IACV;AAAA,IACA,KAAK,MAAM,QAAQ,MAAM,OAAO;AAAA,EAClC;AACF;AAEA,SAAS,kBAAkB,OAAuB;AAChD,SAAO,MAAM,SAAS,GAAG,IAAI,MAAM,MAAM,GAAG,EAAE,IAAI;AACpD;AAEA,SAAS,kBACP,OACA,MACS;AACT,MAAI;AACF,WAAO,cAAc,KAAK;AAAA,EAC5B,SAAS,OAAO;AACd,UAAM,IAAI;AAAA,MACR;AAAA,MACA,iBAAiB,QAAQ,MAAM,UAAU,OAAO,KAAK;AAAA,IACvD;AAAA,EACF;AACF;AAEA,SAASC,oBAAmB,OAAmC;AAC7D,MACE,CAAC,+EAA+E;AAAA,IAC9E;AAAA,EACF,GACA;AACA,WAAO;AAAA,EACT;AACA,QAAM,SAAS,KAAK,MAAM,KAAK;AAC/B,MAAI,OAAO,MAAM,MAAM,GAAG;AACxB,WAAO;AAAA,EACT;AACA,QAAM,YAAY,IAAI,KAAK,MAAM,EAAE,YAAY,EAAE,QAAQ,SAAS,GAAG;AACrE,QAAM,WAAW,KAAK,MAAM,KAAK;AACjC,SAAO,KAAK,MAAM,SAAS,MAAM,WAAW,SAAS;AACvD;","names":["import_viem","output","objectHasOwn","objectHasOwn","import_viem","import_viem","textEncoder","objectHasOwn","requiredString","assertExactKeys","requiredString","requiredValue","hasOwn","requiredArray","requiredArray","requiredValue","assertExactKeys","requiredString","hasOwn","textEncoder","hasOwn","requiredString","assertExactKeys","requiredValue","hasOwn","requiredString","requiredArray","objectHasOwn","expectObject","assertExactKeys","hasOwn","requiredString","assertExactKeys","requiredValue","hasOwn","requiredString","objectHasOwn","hasOwn","parseStrictRfc3339","requestedCapabilitiesHash","fact","createDigest","parseStrictRfc3339"]}