@tinycloud/sdk-core 2.7.0-beta.3 → 2.7.0

package/dist/requester/index.cjs.map

@@ -1 +1 @@
-{"version":3,"sources":["../../src/requester/index.ts","../../src/policy/errors.ts","../../src/policy/jcs.ts","../../src/policy/capability.ts","../../src/policy/signed-object.ts","../../src/identity.ts","../../src/policy/authoring.ts"],"sourcesContent":["import { bytesToHex, sha256 } from \"viem\";\nimport { blake3 } from \"@noble/hashes/blake3\";\nimport { CID } from \"multiformats/cid\";\nimport { create as createDigest } from \"multiformats/hashes/digest\";\nimport type {\n  InvokeAnyFunction,\n  InvokeFunction,\n  ServiceHeaders,\n  ServiceSession,\n} from \"@tinycloud/sdk-services\";\nimport { z } from \"zod\";\nimport {\n  POLICY_VERSION_V0,\n  TRANSCRIPT_SHARE_BOOTSTRAP_SCHEMA,\n  OWNER_NODE_ENDPOINT_SCHEMA,\n  W3C_VC_CREDENTIAL_VERIFIER,\n  jcsCanonicalize,\n  normalizePolicyCapability,\n  normalizeJson,\n  policyCapabilityContains,\n  verifyPolicyEngineRecordForRequester,\n  type PolicyCapability,\n  type TranscriptShareBootstrap,\n} from \"../policy\";\n\nexport const REQUESTER_NEAR_EXPIRY_SECONDS = 30;\nexport const REQUESTER_ENGINE_RETRY_ATTEMPTS = 3;\nexport const REQUESTER_ENGINE_RETRY_MAX_DELAY_MS = 250;\n\nexport const POLICY_ENGINE_CHALLENGE_REQUEST_SCHEMA =\n  \"xyz.tinycloud.policy-engine/challenge-request/v0\" as const;\nexport const POLICY_ENGINE_CHALLENGE_RESPONSE_SCHEMA =\n  \"xyz.tinycloud.policy/challenge/v0\" as const;\nexport const POLICY_ENGINE_RESOLVE_REQUEST_SCHEMA =\n  \"xyz.tinycloud.policy/presentation/v0\" as const;\nexport const POLICY_ENGINE_DENIAL_SCHEMA =\n  \"xyz.tinycloud.policy-engine/denial/v0\" as const;\nexport const HOLDER_KEY_BINDING_PRESENTATION_SCHEMA =\n  \"xyz.tinycloud.policy/presentation/v0\" as const;\nexport const PORTABLE_DELEGATION_SCHEMA =\n  \"xyz.tinycloud.policy/portable-delegation/v0\" as const;\n\nexport const POLICY_ENGINE_GRANT_PRESENTATION_DENIAL_CODES = [\n  \"schema-invalid\",\n  \"challenge-not-found\",\n  \"challenge-expired\",\n  \"challenge-nonce-consumed\",\n  \"presentation-expired\",\n  \"presentation-audience-mismatch\",\n  \"presentation-evidence-missing\",\n  \"digest-mismatch\",\n  \"evidence-requirement-unknown\",\n  \"evidence-requirement-duplicate\",\n  \"holder-signature-invalid\",\n  \"holder-signature-signer-mismatch\",\n  \"id-mismatch\",\n  \"requested-capabilities-exceeded\",\n  \"requested-capabilities-hash-mismatch\",\n  \"evidence-authority-missing\",\n  \"evidence-credential-invalid\",\n  \"evidence-domain-invalid\",\n  \"evidence-domain-missing\",\n  \"evidence-freshness-expired\",\n  \"evidence-freshness-unestablishable\",\n  \"evidence-issuer-missing\",\n  \"evidence-issuer-untrusted\",\n  \"evidence-presentation-invalid\",\n  \"evidence-requirements-invalid\",\n  \"evidence-verifier-unsupported\",\n  \"enrollment-binding-mismatch\",\n  \"enrollment-expired\",\n  \"enrollment-not-yet-valid\",\n  \"enrollment-out-of-scope\",\n  \"enrollment-revoked\",\n  \"enrollment-revoked-irreversible\",\n  \"enrollment-status-rollback\",\n  \"signature-invalid\",\n  \"signer-not-authorized\",\n  \"audience-mismatch\",\n  \"capability-not-contained\",\n  \"evidence-invalid\",\n  \"evidence-missing\",\n  \"evidence-stale\",\n  \"evidence-subject-mismatch\",\n  \"evidence-untrusted\",\n  \"grant-ttl-exceeds-policy\",\n  \"holder-did-mismatch\",\n  \"holder-key-not-permitted\",\n  \"holder-signature-invalid\",\n  \"owner-mismatch\",\n  \"policy-expired\",\n  \"policy-inactive\",\n  \"policy-not-found\",\n  \"policy-not-satisfied\",\n  \"policy-revoked\",\n  \"policy-status-rollback\",\n  \"rate-limited\",\n] as const;\n\nexport type PolicyEngineGrantPresentationDenialCode =\n  (typeof POLICY_ENGINE_GRANT_PRESENTATION_DENIAL_CODES)[number];\n\nexport type TranscriptRequesterErrorCode =\n  | \"requester-bootstrap-malformed\"\n  | \"requester-bootstrap-unknown-key\"\n  | \"requester-engine-record-signature-invalid\"\n  | \"requester-engine-record-owner-mismatch\"\n  | \"requester-engine-record-audience-mismatch\"\n  | \"requester-engine-record-endpoint-mismatch\"\n  | \"requester-engine-record-invalid\"\n  | \"requester-policy-engine-endpoint-invalid\"\n  | \"requester-engine-unreachable\"\n  | \"requester-engine-response-invalid\"\n  | \"requester-renewal-required\"\n  | \"requester-challenge-reused\"\n  | \"requester-presentation-invalid\"\n  | \"requester-delegation-invalid\"\n  | \"requester-delegation-wrong-holder\"\n  | \"requester-delegation-not-refresh-only\"\n  | \"requester-delegation-ttl-excessive\"\n  | \"requester-delegation-capability-wider\"\n  | \"requester-owner-node-endpoint-invalid\"\n  | \"requester-delegation-import-failed\"\n  | \"requester-invocation-signer-required\"\n  | \"requester-invocation-signer-mismatch\"\n  | \"requester-node-denied\"\n  | \"requester-node-unreachable\"\n  | \"requester-node-response-invalid\"\n  | \"requester-access-not-contained\"\n  | \"requester-access-denied\"\n  | \"requester-access-unreachable\"\n  | \"requester-access-ended\"\n  | `policy-engine-denied-${PolicyEngineGrantPresentationDenialCode}`;\n\nexport type TranscriptRequesterErrorState =\n  | \"bootstrap-invalid\"\n  | \"denied\"\n  | \"unreachable\"\n  | \"renewal-required\"\n  | \"access-ended\"\n  | \"invalid\"\n  | \"not-contained\";\n\nexport class TranscriptRequesterError extends Error {\n  public readonly code: TranscriptRequesterErrorCode;\n  public readonly state: TranscriptRequesterErrorState;\n  public readonly denialCode?: PolicyEngineGrantPresentationDenialCode;\n  public readonly status?: number;\n\n  constructor(\n    code: TranscriptRequesterErrorCode,\n    message: string,\n    state: TranscriptRequesterErrorState = \"invalid\",\n    denialCode?: PolicyEngineGrantPresentationDenialCode,\n    status?: number,\n  ) {\n    super(message);\n    this.name = \"TranscriptRequesterError\";\n    this.code = code;\n    this.state = state;\n    this.denialCode = denialCode;\n    this.status = status;\n  }\n}\n\nexport interface RequesterHttpRequest {\n  readonly method: \"POST\" | \"GET\";\n  readonly url: string;\n  readonly headers?: Readonly<Record<string, string>>;\n  readonly body?: unknown;\n  /** Endpoint requests must not follow redirects. */\n  readonly redirect?: \"error\";\n  /** Transport must connect only to one of these pre-resolved public addresses. */\n  readonly allowedResolvedAddresses?: readonly string[];\n}\n\nexport interface RequesterHttpResponse {\n  readonly status: number;\n  readonly body: unknown;\n  /** Required for policy-engine and owner-node requests; reports the non-redirected final URL. */\n  readonly finalUrl?: string;\n  /** Required for policy-engine and owner-node requests; reports the actual connected IP. */\n  readonly resolvedAddress?: string;\n}\n\nexport interface RequesterEndpointResolution {\n  readonly addresses: readonly string[];\n}\n\nexport interface RequesterTransport {\n  request(request: RequesterHttpRequest): Promise<RequesterHttpResponse>;\n  /** Resolve before egress so the requester can pin public addresses and detect rebinding. */\n  resolveEndpoint?(endpoint: string): Promise<RequesterEndpointResolution>;\n}\n\nexport interface RequesterInvocationCapability {\n  readonly holderDid: string;\n  readonly verificationMethod: string;\n  readonly jwk: object;\n  readonly invoke: InvokeFunction;\n  readonly invokeAny?: InvokeAnyFunction;\n}\n\nexport interface HolderKeyBindingPresentation {\n  readonly schema: typeof HOLDER_KEY_BINDING_PRESENTATION_SCHEMA;\n  readonly policyId: string;\n  readonly eligibleSubjectDid: string;\n  readonly holderDid: string;\n  readonly holderBinding: unknown;\n  readonly requestedCapabilities: readonly PolicyCapability[];\n  readonly requestedCapabilitiesHash: string;\n  readonly audience: string;\n  readonly nonce: string;\n  readonly expiresAt: string;\n  readonly evidence?: readonly unknown[];\n  readonly holderSignature: {\n    readonly suite: string;\n    readonly signerDid: string;\n    readonly value: string;\n  };\n}\n\nexport interface RequesterSigningCapability {\n  readonly holderDid: string;\n  readonly keyId: string;\n  readonly suite?: string;\n  readonly holderBinding?: unknown;\n  readonly eligibleSubjectDid?: string;\n  readonly evidence?: readonly unknown[];\n  signGrantPresentation?(input: {\n    readonly schema: typeof HOLDER_KEY_BINDING_PRESENTATION_SCHEMA;\n    readonly policyId: string;\n    readonly eligibleSubjectDid: string;\n    readonly holderDid: string;\n    readonly holderBinding: unknown;\n    readonly requestedCapabilities: readonly PolicyCapability[];\n    readonly requestedCapabilitiesHash: string;\n    readonly audience: string;\n    readonly nonce: string;\n    readonly expiresAt: string;\n    readonly evidence?: readonly unknown[];\n  }): Promise<string> | string;\n  signKeyBinding(input: {\n    readonly schema: typeof HOLDER_KEY_BINDING_PRESENTATION_SCHEMA;\n    readonly policyId?: string;\n    readonly eligibleSubjectDid?: string;\n    readonly holderDid: string;\n    readonly holderBinding?: unknown;\n    readonly requestedCapabilities?: readonly PolicyCapability[];\n    readonly requestedCapabilitiesHash?: string;\n    readonly audience: string;\n    readonly nonce: string;\n    readonly challengeId: string;\n    readonly issuedAt: string;\n    readonly keyId: string;\n  }): Promise<string> | string;\n}\n\nexport interface PortableDelegation {\n  readonly schema?: typeof PORTABLE_DELEGATION_SCHEMA;\n  readonly delegationId: string;\n  readonly policyId: string;\n  readonly issuerDid: string;\n  readonly holderDid: string;\n  readonly audience?: string;\n  readonly issuedAt: string;\n  readonly expiresAt: string;\n  readonly terminal: boolean;\n  readonly maxTtlSeconds: number;\n  readonly capabilities: readonly PolicyCapability[];\n  readonly encoded?: string;\n}\n\nexport interface TranscriptRequesterOptions {\n  readonly bootstrap: unknown;\n  readonly requesterDid: string;\n  readonly ownerDid: string;\n  readonly audience: string;\n  readonly grantIssuerDid: string;\n  /** Owner-node binding from trusted TinyCloud discovery/config, never copied from bootstrap. */\n  readonly trustedOwnerNode: {\n    readonly endpoint: string;\n    readonly spaceId: string;\n  };\n  readonly transport: RequesterTransport;\n  readonly signingCapability?: RequesterSigningCapability;\n  readonly invocationCapability?: RequesterInvocationCapability;\n  readonly eligibleSubjectDid?: string;\n  readonly holderBinding?: unknown;\n  readonly evidence?: readonly unknown[];\n  readonly presentationTtlSeconds?: number;\n  readonly now?: () => Date;\n  readonly sleep?: (milliseconds: number) => Promise<void>;\n  readonly random?: () => number;\n  readonly engineRetryAttempts?: number;\n}\n\nexport interface TranscriptRequesterReadSqlResult {\n  readonly rows: readonly unknown[];\n}\n\nexport interface TranscriptRequesterReadKvResult {\n  readonly value: unknown;\n}\n\nconst JsonValueSchema: z.ZodType<unknown> = z.lazy(() =>\n  z.union([\n    z.string(),\n    z.number().finite(),\n    z.boolean(),\n    z.null(),\n    z.array(JsonValueSchema),\n    z.record(JsonValueSchema),\n  ]),\n);\n\nconst Rfc3339Schema = z\n  .string()\n  .refine((value) => parseStrictRfc3339(value) !== undefined, {\n    message: \"must be strict RFC 3339 date-time with timezone\",\n  });\n\nconst SignedRecordSchema = z\n  .object({\n    schema: z.string(),\n    engineRecordId: z.string(),\n    ownerDid: z.string(),\n    endpoint: z.string(),\n    audience: z.string(),\n    supportedPolicyVersions: z.array(z.string()),\n    supportedEvidenceVerifiers: z.array(z.string()),\n    grantIssuerDid: z.string(),\n    expiresAt: Rfc3339Schema,\n    signature: z\n      .object({\n        suite: z.string(),\n        signerDid: z.string(),\n        value: z.string(),\n      })\n      .strict(),\n  })\n  .strict();\n\nconst PolicyEngineSchema = z\n  .object({\n    endpoint: z.string().url(),\n    audience: z.string(),\n    supportedEvidenceVerifiers: z.tuple([\n      z.literal(W3C_VC_CREDENTIAL_VERIFIER),\n    ]),\n    signedRecord: SignedRecordSchema,\n  })\n  .strict();\n\nconst OwnerNodeSchema = z\n  .object({\n    schema: z.literal(OWNER_NODE_ENDPOINT_SCHEMA),\n    endpoint: z.string().url(),\n    spaceId: z.string().min(1),\n  })\n  .strict();\n\nconst ResourceHintSchema = z\n  .object({\n    resourceType: z.string(),\n    resourceId: z.string(),\n    requestedCapabilities: z.array(JsonValueSchema).min(1),\n  })\n  .strict();\n\nconst BootstrapSchema = z\n  .object({\n    schema: z.literal(TRANSCRIPT_SHARE_BOOTSTRAP_SCHEMA),\n    policyId: z.string(),\n    policyEngine: PolicyEngineSchema,\n    ownerNode: OwnerNodeSchema,\n    resourceHint: ResourceHintSchema,\n  })\n  .strict();\n\nconst SignatureSchema = z\n  .object({\n    suite: z.string(),\n    signerDid: z.string(),\n    value: z.string(),\n  })\n  .strict();\n\nconst ChallengeSchema = z\n  .object({\n    schema: z.literal(POLICY_ENGINE_CHALLENGE_RESPONSE_SCHEMA),\n    challengeId: z.string(),\n    policyId: z.string(),\n    audience: z.string(),\n    nonce: z.string().min(16),\n    challengeExpiresAt: Rfc3339Schema,\n    acceptedSuites: z.array(z.string()).min(1),\n    requestedCapabilitiesTemplate: z.array(JsonValueSchema).optional(),\n    signature: SignatureSchema,\n  })\n  .strict();\n\nconst ChallengeResponseSchema = z\n  .object({ challenge: ChallengeSchema })\n  .strict();\n\nconst DenialSchema = z\n  .object({\n    schema: z.literal(POLICY_ENGINE_DENIAL_SCHEMA),\n    code: z.enum(POLICY_ENGINE_GRANT_PRESENTATION_DENIAL_CODES),\n    message: z.string().optional(),\n  })\n  .strict();\n\nconst ErrorEnvelopeDenialSchema = z\n  .object({\n    error: z\n      .object({\n        code: z.enum(POLICY_ENGINE_GRANT_PRESENTATION_DENIAL_CODES),\n        message: z.string().optional(),\n      })\n      .strict(),\n  })\n  .strict();\n\nconst WireDelegationSchema = z\n  .object({\n    delegationId: z.string(),\n    issuanceId: z.string().min(1),\n    issuerDid: z.string(),\n    holderDid: z.string(),\n    policyId: z.string(),\n    capabilityHashHex: z.string().regex(/^[0-9a-f]{64}$/),\n    revocationMode: z.literal(\"refresh_only\"),\n    issuedAt: Rfc3339Schema,\n    expiresAt: Rfc3339Schema,\n    terminal: z.boolean(),\n    encoded: z.string(),\n  })\n  .strict();\n\nconst ResolveResponseSchema = z\n  .object({ delegation: WireDelegationSchema })\n  .strict();\nconst DelegateReceiptSchema = z\n  .object({\n    cid: z.string().min(1),\n    activated: z.array(z.string()),\n    skipped: z.array(z.string()),\n  })\n  .strict();\n\nconst SqlReadResponseSchema = z\n  .object({ rows: z.array(JsonValueSchema) })\n  .strict();\nconst KvReadResponseSchema = z.object({ value: JsonValueSchema }).strict();\n\nexport const LISTEN_SQL_STATEMENT_CATALOG = [\n  {\n    name: \"listen.getConversation\",\n    sql: \"SELECT id, title, source, source_id, source_url, started_at, ended_at, duration_secs, summary, metadata, transcript_json, transcript_text, created_at, updated_at FROM conversation WHERE id = ?\",\n    fixedParams: [{ index: 0, value: \"{conversationId}\" }],\n  },\n  {\n    name: \"listen.listParticipants\",\n    sql: \"SELECT id, name, email, speaker_label FROM participant WHERE conversation_id = ? ORDER BY COALESCE(speaker_label, name), id\",\n    fixedParams: [{ index: 0, value: \"{conversationId}\" }],\n  },\n] as const;\n\nexport type ListenSqlStatementName =\n  (typeof LISTEN_SQL_STATEMENT_CATALOG)[number][\"name\"];\ntype ListenSqlStatement = (typeof LISTEN_SQL_STATEMENT_CATALOG)[number];\ntype ResolvedListenSqlStatement = {\n  readonly name: string;\n  readonly sql: string;\n  readonly fixedParams: readonly {\n    readonly index: number;\n    readonly value: unknown;\n  }[];\n};\n\nexport function listenTranscriptScopedStatementName(\n  statementName: ListenSqlStatementName,\n  conversationId: string,\n): string {\n  if (conversationId.length === 0) {\n    throw new TranscriptRequesterError(\n      \"requester-access-not-contained\",\n      \"conversation ID must be non-empty for a scoped Listen SQL read\",\n      \"not-contained\",\n    );\n  }\n  return `${statementName}@${encodeURIComponent(conversationId)}`;\n}\ntype NormalizedWireDelegation = PortableDelegation & {\n  readonly encoded: string;\n};\n\nconst LISTEN_SQL_STATEMENT_BY_NAME: ReadonlyMap<string, ListenSqlStatement> =\n  new Map(\n    LISTEN_SQL_STATEMENT_CATALOG.map((statement) => [\n      statement.name,\n      statement,\n    ]),\n  );\n\nexport class TranscriptRequester {\n  private readonly bootstrap: TranscriptShareBootstrap;\n  private readonly requesterDid: string;\n  private readonly ownerDid: string;\n  private readonly audience: string;\n  private readonly grantIssuerDid: string;\n  private readonly transport: RequesterTransport;\n  private readonly signingCapability?: RequesterSigningCapability;\n  private readonly invocationCapability?: RequesterInvocationCapability;\n  private readonly policyEngineRecordExpiresAtMs: number;\n  private readonly policyEngineAddresses: ReadonlySet<string>;\n  private readonly ownerNodeAddresses: ReadonlySet<string>;\n  private readonly now: () => Date;\n  private readonly sleep: (milliseconds: number) => Promise<void>;\n  private readonly random: () => number;\n  private readonly engineRetryAttempts: number;\n  private readonly requestedCapabilities: readonly PolicyCapability[];\n  private readonly nativeAuthorityCeiling: readonly PolicyCapability[];\n  private readonly requestedCapabilitiesHash: string;\n  private readonly eligibleSubjectDid: string;\n  private readonly holderBinding: unknown;\n  private readonly evidence?: readonly unknown[];\n  private readonly presentationTtlSeconds: number;\n  private readonly usedChallengeNonces = new Set<string>();\n  private importedDelegation?: PortableDelegation;\n  private importedDelegationCid?: string;\n  private accessEnded = false;\n\n  private constructor(\n    bootstrap: TranscriptShareBootstrap,\n    requestedCapabilities: readonly PolicyCapability[],\n    nativeAuthorityCeiling: readonly PolicyCapability[],\n    requestedCapabilitiesHash: string,\n    policyEngineRecordExpiresAtMs: number,\n    policyEngineAddresses: ReadonlySet<string>,\n    ownerNodeAddresses: ReadonlySet<string>,\n    options: TranscriptRequesterOptions,\n  ) {\n    this.bootstrap = bootstrap;\n    this.requestedCapabilities = requestedCapabilities;\n    this.nativeAuthorityCeiling = nativeAuthorityCeiling;\n    this.requestedCapabilitiesHash = requestedCapabilitiesHash;\n    this.requesterDid = options.requesterDid;\n    this.ownerDid = options.ownerDid;\n    this.audience = options.audience;\n    this.grantIssuerDid = options.grantIssuerDid;\n    this.transport = options.transport;\n    this.signingCapability = options.signingCapability;\n    this.invocationCapability = options.invocationCapability;\n    this.policyEngineRecordExpiresAtMs = policyEngineRecordExpiresAtMs;\n    this.policyEngineAddresses = policyEngineAddresses;\n    this.ownerNodeAddresses = ownerNodeAddresses;\n    this.eligibleSubjectDid =\n      options.eligibleSubjectDid ??\n      options.signingCapability?.eligibleSubjectDid ??\n      options.requesterDid;\n    this.holderBinding = options.holderBinding ??\n      options.signingCapability?.holderBinding ?? {\n        type: \"enrolled-agent\",\n        enrollment: {\n          schema: \"xyz.tinycloud.policy/holder-enrollment/v0\",\n          holderDid: options.requesterDid,\n        },\n      };\n    this.evidence = options.evidence ?? options.signingCapability?.evidence;\n    this.presentationTtlSeconds = Math.min(\n      Math.max(options.presentationTtlSeconds ?? 60, 1),\n      300,\n    );\n    this.now = options.now ?? (() => new Date());\n    this.sleep =\n      options.sleep ??\n      ((milliseconds) =>\n        new Promise((resolve) => setTimeout(resolve, milliseconds)));\n    this.random = options.random ?? Math.random;\n    this.engineRetryAttempts =\n      options.engineRetryAttempts ?? REQUESTER_ENGINE_RETRY_ATTEMPTS;\n  }\n\n  static async create(\n    options: TranscriptRequesterOptions,\n  ): Promise<TranscriptRequester> {\n    const bootstrap = parseBootstrap(options.bootstrap);\n    if (\n      bootstrap.ownerNode.endpoint !== options.trustedOwnerNode.endpoint ||\n      bootstrap.ownerNode.spaceId !== options.trustedOwnerNode.spaceId\n    ) {\n      throw endpointError(\n        \"owner-node\",\n        \"bootstrap owner-node binding does not match trusted discovery/config\",\n      );\n    }\n    const record = await verifyRecordBeforeEgress(bootstrap, options);\n    if (record.endpoint !== bootstrap.policyEngine.endpoint) {\n      throw new TranscriptRequesterError(\n        \"requester-engine-record-endpoint-mismatch\",\n        \"policy engine record endpoint does not match bootstrap endpoint\",\n        \"bootstrap-invalid\",\n      );\n    }\n    if (record.audience !== bootstrap.policyEngine.audience) {\n      throw new TranscriptRequesterError(\n        \"requester-engine-record-audience-mismatch\",\n        \"policy engine record audience does not match bootstrap audience\",\n        \"bootstrap-invalid\",\n      );\n    }\n    const policyEngineAddresses = await validateAndResolvePublicEndpoint(\n      bootstrap.policyEngine.endpoint,\n      options.transport,\n      \"policy-engine\",\n    );\n    const ownerNodeAddresses = await validateAndResolveOwnerNode(\n      bootstrap.ownerNode.endpoint,\n      options.transport,\n    );\n    const requestedCapabilities =\n      bootstrap.resourceHint.requestedCapabilities.map((capability, index) =>\n        parsePolicyCapability(\n          capability,\n          `$.resourceHint.requestedCapabilities[${index}]`,\n        ),\n      );\n    const nativeAuthorityCeiling = requestedCapabilities.map((capability) => ({\n      ...capability,\n      space: bootstrap.ownerNode.spaceId,\n    }));\n    return new TranscriptRequester(\n      bootstrap,\n      requestedCapabilities,\n      nativeAuthorityCeiling,\n      requestedCapabilitiesHash(requestedCapabilities),\n      parseStrictRfc3339(record.expiresAt)!,\n      policyEngineAddresses,\n      ownerNodeAddresses,\n      options,\n    );\n  }\n\n  get accessState(): \"active\" | \"needs-renewal\" | \"access-ended\" {\n    if (this.accessEnded) {\n      return \"access-ended\";\n    }\n    if (this.importedDelegation === undefined) {\n      return \"needs-renewal\";\n    }\n    if (this.requiresRenewal(this.importedDelegation)) {\n      return \"needs-renewal\";\n    }\n    return \"active\";\n  }\n\n  async readSql(\n    statementName: ListenSqlStatementName,\n    conversationId?: string,\n  ): Promise<TranscriptRequesterReadSqlResult> {\n    try {\n      const catalogStatement = listenSqlStatementFromCatalog(statementName);\n      const selectedConversationId =\n        conversationId ?? this.bootstrap.resourceHint.resourceId;\n      const statement: ResolvedListenSqlStatement = {\n        ...catalogStatement,\n        name:\n          conversationId === undefined\n            ? catalogStatement.name\n            : listenTranscriptScopedStatementName(\n                statementName,\n                conversationId,\n              ),\n        fixedParams: catalogStatement.fixedParams.map((item) => ({\n          ...item,\n          value:\n            item.value === \"{conversationId}\"\n              ? selectedConversationId\n              : item.value,\n        })),\n      };\n      const delegation = await this.ensureFreshDelegation();\n      const requested = this.sqlAccessCapabilityForDelegation(\n        delegation,\n        statement,\n      );\n      this.assertContainedByDelegation(delegation, requested);\n      const response = await this.nativeInvoke(\n        \"sql\",\n        requested.path,\n        \"tinycloud.sql/read\",\n        {\n          action: \"executeStatement\",\n          name: statement.name,\n          // The native constrained-SQL route injects caveat-pinned values and\n          // rejects callers that supply those indices. Uncaveated reads must\n          // resolve the catalog placeholder themselves.\n          params:\n            requested.caveats === undefined\n              ? statement.fixedParams.map((item) => item.value)\n              : [],\n        },\n        requested.caveats,\n      );\n      return parseNodeDataResponse(\n        response,\n        SqlReadResponseSchema,\n        \"SQL read\",\n      ) as TranscriptRequesterReadSqlResult;\n    } catch (error) {\n      this.recordAccessEnded(error);\n      throw error;\n    }\n  }\n\n  async readKv(path: string): Promise<TranscriptRequesterReadKvResult> {\n    try {\n      const delegation = await this.ensureFreshDelegation();\n      const grantedKv = delegation.capabilities.find(\n        (capability) =>\n          capability.service === \"tinycloud.kv\" &&\n          capability.path === path &&\n          capability.actions.includes(\"tinycloud.kv/get\"),\n      );\n      const requested = parsePolicyCapability(\n        {\n          service: \"tinycloud.kv\",\n          space: grantedKv?.space ?? \"applications\",\n          path,\n          actions: [\"tinycloud.kv/get\"],\n        },\n        \"$.kvRead\",\n      );\n      this.assertContainedByDelegation(delegation, requested);\n      const response = await this.nativeInvoke(\"kv\", path, \"tinycloud.kv/get\");\n      return parseNodeDataResponse(\n        response,\n        KvReadResponseSchema,\n        \"KV read\",\n      ) as TranscriptRequesterReadKvResult;\n    } catch (error) {\n      this.recordAccessEnded(error);\n      throw error;\n    }\n  }\n\n  private async nativeInvoke(\n    service: \"sql\" | \"kv\",\n    path: string,\n    action: \"tinycloud.sql/read\" | \"tinycloud.kv/get\",\n    body?: unknown,\n    caveats?: Record<string, unknown>,\n  ): Promise<RequesterHttpResponse> {\n    const capability = this.invocationCapability;\n    if (capability === undefined) {\n      throw new TranscriptRequesterError(\n        \"requester-invocation-signer-required\",\n        \"holder invocation capability is required for native reads\",\n      );\n    }\n    if (\n      capability.holderDid !== this.requesterDid ||\n      capability.holderDid !== this.signingCapability?.holderDid\n    ) {\n      throw new TranscriptRequesterError(\n        \"requester-invocation-signer-mismatch\",\n        \"invocation signer must be the presentation key-binding holder\",\n      );\n    }\n    if (\n      this.importedDelegationCid === undefined ||\n      this.importedDelegation === undefined\n    ) {\n      throw new TranscriptRequesterError(\n        \"requester-delegation-import-failed\",\n        \"native read requires a confirmed delegation import\",\n      );\n    }\n    const session: ServiceSession = {\n      delegationHeader: { Authorization: this.importedDelegation.encoded! },\n      delegationCid: this.importedDelegationCid,\n      spaceId: this.bootstrap.ownerNode.spaceId,\n      verificationMethod: capability.verificationMethod,\n      jwk: capability.jwk,\n    };\n    let invocationHeaders: ServiceHeaders;\n    if (caveats === undefined) {\n      invocationHeaders = capability.invoke(session, service, path, action);\n    } else {\n      if (capability.invokeAny === undefined) {\n        throw new TranscriptRequesterError(\n          \"requester-invocation-signer-required\",\n          \"holder invocation capability must support caveated native reads\",\n        );\n      }\n      invocationHeaders = capability.invokeAny(session, [\n        {\n          spaceId: this.bootstrap.ownerNode.spaceId,\n          service,\n          path,\n          action,\n          caveats: [caveats],\n        },\n      ]);\n    }\n    const headers = headersRecord(invocationHeaders);\n    const response = await this.transport.request({\n      method: \"POST\",\n      url: `${trimTrailingSlash(this.bootstrap.ownerNode.endpoint)}/invoke`,\n      headers,\n      redirect: \"error\",\n      allowedResolvedAddresses: [...this.ownerNodeAddresses],\n      ...(body === undefined ? {} : { body }),\n    });\n    this.assertOwnerNodeResponse(response, \"/invoke\");\n    return response;\n  }\n\n  private async ensureFreshDelegation(): Promise<PortableDelegation> {\n    if (this.accessEnded) {\n      throw new TranscriptRequesterError(\n        \"requester-access-ended\",\n        \"requester access has ended\",\n        \"access-ended\",\n      );\n    }\n    if (\n      this.importedDelegation !== undefined &&\n      !this.requiresRenewal(this.importedDelegation)\n    ) {\n      return this.importedDelegation;\n    }\n    if (\n      this.signingCapability === undefined ||\n      this.signingCapability.holderDid !== this.requesterDid\n    ) {\n      throw new TranscriptRequesterError(\n        \"requester-renewal-required\",\n        \"a permitted requester signing capability is required for access-triggered renewal\",\n        \"renewal-required\",\n      );\n    }\n    try {\n      let lastError: unknown;\n      const attempts = Math.max(1, this.engineRetryAttempts);\n      for (let attempt = 0; attempt < attempts; attempt++) {\n        const challenge = await this.obtainChallenge();\n        const presentation = await this.mintPresentation(challenge);\n        try {\n          const delegation = await this.resolveOnce(challenge, presentation);\n          this.importedDelegation = delegation;\n          return delegation;\n        } catch (error) {\n          if (\n            !(error instanceof TranscriptRequesterError) ||\n            error.state !== \"unreachable\"\n          ) {\n            throw error;\n          }\n          lastError = error;\n        }\n        if (attempt + 1 < attempts) {\n          await this.sleep(retryDelay(attempt, this.random()));\n        }\n      }\n      throw new TranscriptRequesterError(\n        \"requester-engine-unreachable\",\n        lastError instanceof Error\n          ? lastError.message\n          : \"policy engine unreachable\",\n        \"unreachable\",\n      );\n    } catch (error) {\n      this.recordAccessEnded(error);\n      throw error;\n    }\n  }\n\n  private recordAccessEnded(error: unknown): void {\n    if (\n      error instanceof TranscriptRequesterError &&\n      error.state === \"access-ended\"\n    ) {\n      this.accessEnded = true;\n    }\n  }\n\n  private async obtainChallenge(): Promise<z.infer<typeof ChallengeSchema>> {\n    this.assertPolicyEngineRecordCurrent();\n    const response = await this.challengeRequestWithRetry({\n      method: \"POST\",\n      url: `${trimTrailingSlash(this.bootstrap.policyEngine.endpoint)}/policy/v0/challenge`,\n      redirect: \"error\",\n      allowedResolvedAddresses: [...this.policyEngineAddresses],\n      body: {\n        policyId: this.bootstrap.policyId,\n      },\n    });\n    return parseEngineSuccess(\n      response.body,\n      ChallengeResponseSchema,\n      \"challenge response\",\n    ).challenge;\n  }\n\n  private async mintPresentation(\n    challenge: z.infer<typeof ChallengeSchema>,\n  ): Promise<HolderKeyBindingPresentation> {\n    if (\n      challenge.policyId !== this.bootstrap.policyId ||\n      challenge.audience !== this.bootstrap.policyEngine.audience ||\n      challenge.audience !== this.audience\n    ) {\n      throw new TranscriptRequesterError(\n        \"requester-engine-response-invalid\",\n        \"challenge response binding does not match requester context\",\n      );\n    }\n    if (this.usedChallengeNonces.has(challenge.nonce)) {\n      throw new TranscriptRequesterError(\n        \"requester-challenge-reused\",\n        \"challenge nonce was already used by this requester\",\n      );\n    }\n    this.usedChallengeNonces.add(challenge.nonce);\n    const expiresAt = new Date(\n      this.now().getTime() + this.presentationTtlSeconds * 1000,\n    )\n      .toISOString()\n      .replace(\".000Z\", \"Z\");\n    const input = {\n      schema: HOLDER_KEY_BINDING_PRESENTATION_SCHEMA,\n      policyId: this.bootstrap.policyId,\n      eligibleSubjectDid: this.eligibleSubjectDid,\n      holderDid: this.requesterDid,\n      holderBinding: this.holderBinding,\n      requestedCapabilities: this.requestedCapabilities,\n      requestedCapabilitiesHash: this.requestedCapabilitiesHash,\n      audience: this.audience,\n      nonce: challenge.nonce,\n      expiresAt,\n      ...(this.evidence === undefined ? {} : { evidence: this.evidence }),\n    } as const;\n    const signature =\n      this.signingCapability!.signGrantPresentation === undefined\n        ? await this.signingCapability!.signKeyBinding({\n            ...input,\n            challengeId: challenge.challengeId,\n            issuedAt: expiresAt,\n            keyId: this.signingCapability!.keyId,\n          })\n        : await this.signingCapability!.signGrantPresentation(input);\n    if (typeof signature !== \"string\" || signature.length === 0) {\n      throw new TranscriptRequesterError(\n        \"requester-presentation-invalid\",\n        \"signing capability returned an invalid holder key-binding signature\",\n      );\n    }\n    return {\n      ...input,\n      holderSignature: {\n        suite: this.signingCapability!.suite ?? challenge.acceptedSuites[0]!,\n        signerDid: this.requesterDid,\n        value: signature,\n      },\n    };\n  }\n\n  private async resolveOnce(\n    challenge: z.infer<typeof ChallengeSchema>,\n    presentation: HolderKeyBindingPresentation,\n  ): Promise<PortableDelegation> {\n    void challenge;\n    this.assertPolicyEngineRecordCurrent();\n    const response = await this.resolveRequestOnce({\n      method: \"POST\",\n      url: `${trimTrailingSlash(this.bootstrap.policyEngine.endpoint)}/policy/v0/resolve`,\n      redirect: \"error\",\n      allowedResolvedAddresses: [...this.policyEngineAddresses],\n      body: { presentation },\n    });\n    const parsed = parseEngineSuccess(\n      response.body,\n      ResolveResponseSchema,\n      \"resolve response\",\n    );\n    return this.importPortableDelegation(parsed.delegation);\n  }\n\n  private async importPortableDelegation(\n    input: unknown,\n  ): Promise<PortableDelegation> {\n    const parsed = parseNodeNativePortableDelegation(input);\n    if (parsed.policyId !== this.bootstrap.policyId) {\n      throw new TranscriptRequesterError(\n        \"requester-delegation-invalid\",\n        \"portable delegation policy id does not match bootstrap\",\n      );\n    }\n    if (parsed.holderDid !== this.requesterDid) {\n      throw new TranscriptRequesterError(\n        \"requester-delegation-wrong-holder\",\n        \"portable delegation is not targeted at the requester DID\",\n      );\n    }\n    if (parsed.issuerDid !== this.grantIssuerDid) {\n      throw new TranscriptRequesterError(\n        \"requester-delegation-invalid\",\n        \"portable delegation issuer does not match the verified grant issuer DID\",\n      );\n    }\n    if (parsed.maxTtlSeconds > 300) {\n      throw new TranscriptRequesterError(\n        \"requester-delegation-ttl-excessive\",\n        \"portable delegation TTL exceeds 300 seconds\",\n      );\n    }\n    const issuedAt = parseStrictRfc3339(parsed.issuedAt)!;\n    const expiresAt = parseStrictRfc3339(parsed.expiresAt)!;\n    if (\n      expiresAt <= issuedAt ||\n      expiresAt - issuedAt > parsed.maxTtlSeconds * 1000\n    ) {\n      throw new TranscriptRequesterError(\n        \"requester-delegation-ttl-excessive\",\n        \"portable delegation expires outside its maxTtlSeconds bound\",\n      );\n    }\n    const capabilities = parsed.capabilities.map((capability, index) =>\n      parsePolicyCapability(capability, `$.delegation.capabilities[${index}]`),\n    );\n    for (const granted of capabilities) {\n      if (\n        !this.nativeAuthorityCeiling.some((requested) =>\n          policyCapabilityContains(requested, granted),\n        )\n      ) {\n        throw new TranscriptRequesterError(\n          \"requester-delegation-capability-wider\",\n          \"portable delegation grants a capability outside the bootstrap requested set\",\n        );\n      }\n    }\n    if (\n      typeof parsed.encoded !== \"string\" ||\n      parsed.encoded.split(\".\").length !== 3\n    ) {\n      throw new TranscriptRequesterError(\n        \"requester-delegation-invalid\",\n        \"portable delegation is not a compact-JWS UCAN\",\n      );\n    }\n    const delegation = { ...parsed, capabilities } as PortableDelegation;\n    const response = await this.transport.request({\n      method: \"POST\",\n      url: `${trimTrailingSlash(this.bootstrap.ownerNode.endpoint)}/delegate`,\n      headers: { Authorization: parsed.encoded },\n      redirect: \"error\",\n      allowedResolvedAddresses: [...this.ownerNodeAddresses],\n    });\n    this.assertOwnerNodeResponse(response, \"/delegate\");\n    const receipt = parseDelegateReceipt(response);\n    const target = this.bootstrap.ownerNode.spaceId;\n    if (\n      !receipt.activated.includes(target) ||\n      receipt.skipped.includes(target)\n    ) {\n      throw new TranscriptRequesterError(\n        \"requester-delegation-import-failed\",\n        receipt.activated.includes(target) && receipt.skipped.includes(target)\n          ? \"owner node returned a contradictory delegation receipt\"\n          : \"owner node did not activate the target owner space\",\n      );\n    }\n    this.importedDelegationCid = deriveDelegationCid(parsed.encoded);\n    return delegation;\n  }\n\n  private assertOwnerNodeResponse(\n    response: RequesterHttpResponse,\n    path: string,\n  ): void {\n    this.assertEndpointResponse(\n      response,\n      this.bootstrap.ownerNode.endpoint,\n      path,\n      this.ownerNodeAddresses,\n      \"owner-node\",\n    );\n  }\n\n  private assertPolicyEngineRecordCurrent(): void {\n    if (this.policyEngineRecordExpiresAtMs <= this.now().getTime()) {\n      throw new TranscriptRequesterError(\n        \"requester-engine-record-invalid\",\n        \"verified policy engine record has expired\",\n        \"bootstrap-invalid\",\n      );\n    }\n  }\n\n  private assertPolicyEngineResponse(\n    response: RequesterHttpResponse,\n    path: string,\n  ): void {\n    this.assertEndpointResponse(\n      response,\n      this.bootstrap.policyEngine.endpoint,\n      path,\n      this.policyEngineAddresses,\n      \"policy-engine\",\n    );\n  }\n\n  private assertEndpointResponse(\n    response: RequesterHttpResponse,\n    endpoint: string,\n    path: string,\n    allowedAddresses: ReadonlySet<string>,\n    kind: \"owner-node\" | \"policy-engine\",\n  ): void {\n    const expected = `${trimTrailingSlash(endpoint)}${path}`;\n    const error = (message: string) => endpointError(kind, message);\n    if (\n      response.finalUrl !== expected ||\n      response.resolvedAddress === undefined\n    ) {\n      throw error(\n        `${kind} transport metadata is missing or indicates a redirect`,\n      );\n    }\n    if (!allowedAddresses.has(normalizeIp(response.resolvedAddress))) {\n      throw error(`${kind} address changed after endpoint validation`);\n    }\n  }\n\n  private assertContainedByDelegation(\n    delegation: PortableDelegation,\n    requested: PolicyCapability,\n  ): void {\n    if (this.requiresRenewal(delegation)) {\n      throw new TranscriptRequesterError(\n        \"requester-renewal-required\",\n        \"delegation requires renewal before access\",\n        \"renewal-required\",\n      );\n    }\n    if (\n      !delegation.capabilities.some((granted) =>\n        policyCapabilityContains(granted, requested),\n      )\n    ) {\n      throw new TranscriptRequesterError(\n        \"requester-access-not-contained\",\n        \"requested access is outside the imported delegation capabilities\",\n        \"not-contained\",\n      );\n    }\n  }\n\n  private sqlAccessCapabilityForDelegation(\n    delegation: PortableDelegation,\n    statement: ResolvedListenSqlStatement,\n  ): PolicyCapability {\n    const grantedSql = delegation.capabilities.find(\n      (capability) =>\n        capability.service === \"tinycloud.sql\" &&\n        capability.actions.includes(\"tinycloud.sql/read\"),\n    );\n    if (grantedSql === undefined) {\n      throw new TranscriptRequesterError(\n        \"requester-access-not-contained\",\n        \"delegation has no SQL read grant\",\n        \"not-contained\",\n      );\n    }\n    if (grantedSql.caveats !== undefined) {\n      const statements = (\n        grantedSql.caveats as {\n          statements?: readonly {\n            name?: unknown;\n            sql?: unknown;\n            fixedParams?: unknown;\n          }[];\n        }\n      ).statements;\n      const matchesCatalogSelection = statements?.some(\n        (candidate) =>\n          candidate.name === statement.name &&\n          candidate.sql === statement.sql &&\n          Array.isArray(candidate.fixedParams) &&\n          jcsCanonicalize(candidate.fixedParams) ===\n            jcsCanonicalize(statement.fixedParams),\n      );\n      if (!matchesCatalogSelection) {\n        throw new TranscriptRequesterError(\n          \"requester-access-not-contained\",\n          \"SQL statement is outside the delegated catalog-derived statement caveat\",\n          \"not-contained\",\n        );\n      }\n      return grantedSql;\n    }\n    return parsePolicyCapability(\n      {\n        service: \"tinycloud.sql\",\n        space: grantedSql.space,\n        path: grantedSql.path,\n        actions: [\"tinycloud.sql/read\"],\n      },\n      \"$.sqlRead\",\n    );\n  }\n\n  private requiresRenewal(delegation: PortableDelegation): boolean {\n    const expiresAt = parseStrictRfc3339(delegation.expiresAt)!;\n    return (\n      expiresAt - this.now().getTime() <= REQUESTER_NEAR_EXPIRY_SECONDS * 1000\n    );\n  }\n\n  private async challengeRequestWithRetry(\n    request: RequesterHttpRequest,\n  ): Promise<RequesterHttpResponse> {\n    let lastError: unknown;\n    const attempts = Math.max(1, this.engineRetryAttempts);\n    for (let attempt = 0; attempt < attempts; attempt++) {\n      try {\n        const response = await this.transport.request(request);\n        this.assertPolicyEngineResponse(response, \"/policy/v0/challenge\");\n        if (response.status >= 500) {\n          lastError = new Error(`engine returned ${response.status}`);\n        } else if (response.status >= 400) {\n          const denial = parseDenialBody(response.body);\n          if (denial !== undefined) {\n            throw errorForDenial(denial, response.status);\n          }\n          throw new TranscriptRequesterError(\n            \"requester-engine-response-invalid\",\n            \"policy engine returned an invalid denial body\",\n          );\n        } else {\n          return response;\n        }\n      } catch (error) {\n        if (\n          error instanceof TranscriptRequesterError &&\n          error.state !== \"unreachable\"\n        ) {\n          throw error;\n        }\n        lastError = error;\n      }\n      if (attempt + 1 < attempts) {\n        await this.sleep(retryDelay(attempt, this.random()));\n      }\n    }\n    throw new TranscriptRequesterError(\n      \"requester-engine-unreachable\",\n      lastError instanceof Error\n        ? lastError.message\n        : \"policy engine unreachable\",\n      \"unreachable\",\n    );\n  }\n\n  private async resolveRequestOnce(\n    request: RequesterHttpRequest,\n  ): Promise<RequesterHttpResponse> {\n    try {\n      const response = await this.transport.request(request);\n      this.assertPolicyEngineResponse(response, \"/policy/v0/resolve\");\n      if (response.status >= 500) {\n        throw new TranscriptRequesterError(\n          \"requester-engine-unreachable\",\n          `engine returned ${response.status}`,\n          \"unreachable\",\n        );\n      }\n      if (response.status >= 400) {\n        const denial = parseDenialBody(response.body);\n        if (denial !== undefined) {\n          throw errorForDenial(denial, response.status);\n        }\n        throw new TranscriptRequesterError(\n          \"requester-engine-response-invalid\",\n          \"policy engine returned an invalid denial body\",\n        );\n      }\n      return response;\n    } catch (error) {\n      if (error instanceof TranscriptRequesterError) {\n        throw error;\n      }\n      throw new TranscriptRequesterError(\n        \"requester-engine-unreachable\",\n        error instanceof Error ? error.message : \"policy engine unreachable\",\n        \"unreachable\",\n      );\n    }\n  }\n}\n\nexport async function createTranscriptRequester(\n  options: TranscriptRequesterOptions,\n): Promise<TranscriptRequester> {\n  return TranscriptRequester.create(options);\n}\n\nfunction parseBootstrap(input: unknown): TranscriptShareBootstrap & {\n  readonly resourceHint: { readonly requestedCapabilities: readonly unknown[] };\n} {\n  const normalized = normalizeExternal(input, \"requester-bootstrap-malformed\");\n  const parsed = BootstrapSchema.safeParse(normalized);\n  if (!parsed.success) {\n    throw new TranscriptRequesterError(\n      parsed.error.issues.some((issue) => issue.code === \"unrecognized_keys\")\n        ? \"requester-bootstrap-unknown-key\"\n        : \"requester-bootstrap-malformed\",\n      parsed.error.message,\n      \"bootstrap-invalid\",\n    );\n  }\n  return parsed.data as TranscriptShareBootstrap & {\n    readonly resourceHint: {\n      readonly requestedCapabilities: readonly unknown[];\n    };\n  };\n}\n\nasync function verifyRecordBeforeEgress(\n  bootstrap: TranscriptShareBootstrap,\n  options: TranscriptRequesterOptions,\n) {\n  try {\n    return await verifyPolicyEngineRecordForRequester({\n      signedRecord: bootstrap.policyEngine.signedRecord,\n      ownerDid: options.ownerDid,\n      audience: options.audience,\n      grantIssuerDid: options.grantIssuerDid,\n      now: (options.now ?? (() => new Date()))()\n        .toISOString()\n        .replace(\".000Z\", \"Z\"),\n      requiredPolicyVersion: POLICY_VERSION_V0,\n      requiredEvidenceVerifier: W3C_VC_CREDENTIAL_VERIFIER,\n    });\n  } catch (error) {\n    const code = errorCodeForRecordFailure(error);\n    throw new TranscriptRequesterError(\n      code,\n      error instanceof Error ? error.message : String(error),\n      \"bootstrap-invalid\",\n    );\n  }\n}\n\nfunction errorCodeForRecordFailure(\n  error: unknown,\n): TranscriptRequesterErrorCode {\n  const code =\n    typeof error === \"object\" && error !== null && \"code\" in error\n      ? (error as { code?: unknown }).code\n      : undefined;\n  if (code === \"policy-engine-record-signature-invalid\") {\n    return \"requester-engine-record-signature-invalid\";\n  }\n  if (code === \"policy-engine-record-owner-mismatch\") {\n    return \"requester-engine-record-owner-mismatch\";\n  }\n  if (code === \"policy-engine-record-audience-mismatch\") {\n    return \"requester-engine-record-audience-mismatch\";\n  }\n  return \"requester-engine-record-invalid\";\n}\n\nfunction parsePolicyCapability(input: unknown, path: string): PolicyCapability {\n  try {\n    return normalizePolicyCapabilityForRequester(\n      input,\n    ) as unknown as PolicyCapability;\n  } catch (error) {\n    throw new TranscriptRequesterError(\n      \"requester-delegation-invalid\",\n      `${path}: ${error instanceof Error ? error.message : String(error)}`,\n    );\n  }\n}\n\nfunction listenSqlStatementFromCatalog(\n  statementName: unknown,\n): ListenSqlStatement {\n  if (typeof statementName !== \"string\") {\n    throw new TranscriptRequesterError(\n      \"requester-access-not-contained\",\n      \"SQL statement name must be a string from the canonical Listen statement catalog\",\n      \"not-contained\",\n    );\n  }\n  const statement = LISTEN_SQL_STATEMENT_BY_NAME.get(statementName);\n  if (statement === undefined) {\n    throw new TranscriptRequesterError(\n      \"requester-access-not-contained\",\n      \"SQL statement is not in the canonical Listen statement catalog\",\n      \"not-contained\",\n    );\n  }\n  return statement;\n}\n\nfunction normalizePolicyCapabilityForRequester(\n  input: unknown,\n): PolicyCapability {\n  const normalized = normalizeExternal(input, \"requester-delegation-invalid\");\n  return normalizePolicyCapability(normalized);\n}\n\nfunction requestedCapabilitiesHash(\n  capabilities: readonly PolicyCapability[],\n): string {\n  const canonical = [...capabilities].sort((left, right) =>\n    `${left.service}\\0${left.space}\\0${left.path}`.localeCompare(\n      `${right.service}\\0${right.space}\\0${right.path}`,\n    ),\n  );\n  const encoder = new TextEncoder();\n  const domain = encoder.encode(\n    \"xyz.tinycloud.policy/RequestedCapabilities/v0\\0\",\n  );\n  const body = encoder.encode(jcsCanonicalize(canonical));\n  const bytes = new Uint8Array(domain.length + body.length);\n  bytes.set(domain, 0);\n  bytes.set(body, domain.length);\n  return bytesToHex(sha256(bytes, \"bytes\")).slice(2);\n}\n\nfunction normalizeWireDelegation(\n  delegation: z.infer<typeof WireDelegationSchema>,\n): NormalizedWireDelegation {\n  const signed = delegationAuthorityFromCompactJws(delegation.encoded);\n  const invalid = (field: string): never => {\n    throw new TranscriptRequesterError(\n      \"requester-delegation-invalid\",\n      `portable delegation ${field} does not match its signed compact-JWS authority`,\n    );\n  };\n  if (delegation.delegationId !== deriveDelegationCid(delegation.encoded))\n    invalid(\"delegationId\");\n  if (delegation.issuerDid !== signed.issuerDid) invalid(\"issuerDid\");\n  if (delegation.holderDid !== signed.holderDid) invalid(\"holderDid\");\n  if (delegation.policyId !== signed.policyId) invalid(\"policyId\");\n  if (Date.parse(delegation.issuedAt) !== signed.issuedAtMs)\n    invalid(\"issuedAt\");\n  if (Date.parse(delegation.expiresAt) !== signed.expiresAtMs)\n    invalid(\"expiresAt\");\n  if (delegation.terminal !== signed.terminal) invalid(\"terminal\");\n  if (delegation.issuanceId !== signed.issuanceId) invalid(\"issuanceId\");\n  if (delegation.capabilityHashHex !== signed.capabilityHashHex)\n    invalid(\"capabilityHashHex\");\n  if (delegation.revocationMode !== signed.revocationMode)\n    invalid(\"revocationMode\");\n  return {\n    delegationId: deriveDelegationCid(delegation.encoded),\n    issuerDid: signed.issuerDid,\n    holderDid: signed.holderDid,\n    policyId: signed.policyId,\n    issuedAt: new Date(signed.issuedAtMs).toISOString().replace(\".000Z\", \"Z\"),\n    expiresAt: new Date(signed.expiresAtMs).toISOString().replace(\".000Z\", \"Z\"),\n    terminal: signed.terminal,\n    maxTtlSeconds: Math.ceil((signed.expiresAtMs - signed.issuedAtMs) / 1000),\n    capabilities: signed.capabilities,\n    encoded: delegation.encoded,\n  };\n}\n\n/**\n * Parse a frozen policy-engine delegation response and derive its authority\n * exclusively from the signed compact-JWS payload. This performs no egress or\n * node import and is suitable for constrained runners that cannot honestly\n * satisfy the public-endpoint transport profile.\n */\nexport function parseNodeNativePortableDelegation(\n  input: unknown,\n): PortableDelegation {\n  return normalizeWireDelegation(\n    parseEngineSuccess(input, WireDelegationSchema, \"portable delegation\"),\n  );\n}\n\nfunction delegationAuthorityFromCompactJws(encoded: string): {\n  issuerDid: string;\n  holderDid: string;\n  policyId: string;\n  issuanceId: string;\n  capabilityHashHex: string;\n  revocationMode: \"refresh_only\";\n  issuedAtMs: number;\n  expiresAtMs: number;\n  terminal: boolean;\n  capabilities: PolicyCapability[];\n} {\n  try {\n    const parts = encoded.split(\".\");\n    if (parts.length !== 3) throw new Error(\"not compact JWS\");\n    const payload = normalizeJson(\n      JSON.parse(new TextDecoder().decode(base64UrlBytes(parts[1]!))),\n    ) as Record<string, unknown>;\n    const issuer = requiredPayloadString(payload, \"iss\");\n    const holderDid = requiredPayloadString(payload, \"aud\");\n    const issuedAt = requiredPayloadEpoch(payload, \"nbf\");\n    const expiresAt = requiredPayloadEpoch(payload, \"exp\");\n    const facts = payload.fct;\n    if (!Array.isArray(facts)) throw new Error(\"UCAN fct is absent\");\n    const authorityFacts = facts.filter(\n      (fact) =>\n        fact !== null &&\n        typeof fact === \"object\" &&\n        !Array.isArray(fact) &&\n        \"xyz.tinycloud.policy/policyId\" in fact,\n    ) as Record<string, unknown>[];\n    if (authorityFacts.length !== 1)\n      throw new Error(\"UCAN policy authority fact is not unique\");\n    const fact = authorityFacts[0]!;\n    const policyId = requiredPayloadString(\n      fact,\n      \"xyz.tinycloud.policy/policyId\",\n    );\n    const issuanceId = requiredPayloadString(\n      fact,\n      \"xyz.tinycloud.policy/issuanceId\",\n    );\n    const capabilityHashHex = requiredPayloadString(\n      fact,\n      \"xyz.tinycloud.policy/capabilityHashHex\",\n    );\n    if (!/^[0-9a-f]{64}$/.test(capabilityHashHex)) {\n      throw new Error(\n        \"UCAN capability hash is not 64 lowercase hex characters\",\n      );\n    }\n    const revocationMode = requiredPayloadString(\n      fact,\n      \"xyz.tinycloud.policy/revocationMode\",\n    );\n    const delegationMode = requiredPayloadString(\n      fact,\n      \"xyz.tinycloud.policy/delegationMode\",\n    );\n    if (revocationMode !== \"refresh_only\")\n      throw new Error(\"unsupported UCAN revocation mode\");\n    if (delegationMode !== \"terminal\")\n      throw new Error(\"UCAN delegation is not terminal\");\n    const att = payload.att;\n    if (att === null || typeof att !== \"object\" || Array.isArray(att)) {\n      throw new Error(\"UCAN att is absent\");\n    }\n    const capabilities: PolicyCapability[] = [];\n    for (const [resource, rawAbilities] of Object.entries(att)) {\n      if (\n        rawAbilities === null ||\n        typeof rawAbilities !== \"object\" ||\n        Array.isArray(rawAbilities)\n      ) {\n        throw new Error(\"UCAN att abilities are invalid\");\n      }\n      const abilities = rawAbilities as Record<string, unknown>;\n      const marker = resource.indexOf(\"/sql/\");\n      if (!resource.startsWith(\"tinycloud:\") || marker < 0)\n        throw new Error(\"unsupported UCAN resource\");\n      const space = resource.slice(0, marker);\n      const path = resource.slice(marker + \"/sql/\".length);\n      for (const [action, rawCaveats] of Object.entries(abilities)) {\n        const service = action.startsWith(\"tinycloud.sql/\")\n          ? \"tinycloud.sql\"\n          : action.startsWith(\"tinycloud.kv/\")\n            ? \"tinycloud.kv\"\n            : undefined;\n        if (!Array.isArray(rawCaveats) || rawCaveats.length !== 1) {\n          throw new Error(\"UCAN ability must have exactly one caveat branch\");\n        }\n        const caveats = rawCaveats;\n        if (service === undefined) throw new Error(\"unsupported UCAN ability\");\n        const first = caveats[0];\n        capabilities.push(\n          normalizePolicyCapability({\n            service,\n            space,\n            path,\n            actions: [action],\n            ...(first !== null &&\n            typeof first === \"object\" &&\n            !Array.isArray(first) &&\n            Object.keys(first).length > 0\n              ? { caveats: first }\n              : {}),\n          }),\n        );\n      }\n    }\n    if (capabilities.length === 0) throw new Error(\"UCAN att is empty\");\n    const fragment = issuer.indexOf(\"#\");\n    const issuerDid = fragment < 0 ? issuer : issuer.slice(0, fragment);\n    if (!issuerDid.startsWith(\"did:\") || !holderDid.startsWith(\"did:\")) {\n      throw new Error(\"UCAN issuer or audience is not a DID\");\n    }\n    return {\n      issuerDid,\n      holderDid,\n      policyId,\n      issuanceId,\n      capabilityHashHex,\n      revocationMode,\n      issuedAtMs: issuedAt * 1000,\n      expiresAtMs: expiresAt * 1000,\n      terminal: true,\n      capabilities,\n    };\n  } catch (error) {\n    throw new TranscriptRequesterError(\n      \"requester-delegation-invalid\",\n      `node-native compact-JWS capabilities are invalid: ${error instanceof Error ? error.message : String(error)}`,\n    );\n  }\n}\n\nfunction requiredPayloadString(\n  payload: Record<string, unknown>,\n  key: string,\n): string {\n  const value = payload[key];\n  if (typeof value !== \"string\" || value.length === 0) {\n    throw new Error(`UCAN ${key} is not a non-empty string`);\n  }\n  return value;\n}\n\nfunction requiredPayloadEpoch(\n  payload: Record<string, unknown>,\n  key: string,\n): number {\n  const value = payload[key];\n  if (typeof value !== \"number\" || !Number.isSafeInteger(value) || value < 0) {\n    throw new Error(`UCAN ${key} is not a non-negative integer epoch`);\n  }\n  return value;\n}\n\nfunction base64UrlBytes(value: string): Uint8Array {\n  const normalized = value.replace(/-/g, \"+\").replace(/_/g, \"/\");\n  const padded = normalized.padEnd(Math.ceil(normalized.length / 4) * 4, \"=\");\n  const binary = atob(padded);\n  return Uint8Array.from(binary, (character) => character.charCodeAt(0));\n}\n\nfunction parseEngineSuccess<T>(\n  input: unknown,\n  schema: z.ZodType<T>,\n  label: string,\n): T {\n  const normalized = normalizeExternal(\n    input,\n    \"requester-engine-response-invalid\",\n  );\n  const denial = parseDenialBody(normalized);\n  if (denial !== undefined) {\n    throw errorForDenial(denial);\n  }\n  const parsed = schema.safeParse(normalized);\n  if (!parsed.success) {\n    throw new TranscriptRequesterError(\n      \"requester-engine-response-invalid\",\n      `${label} failed validation: ${parsed.error.message}`,\n    );\n  }\n  return parsed.data;\n}\n\nfunction parseDataResponse<T>(\n  response: RequesterHttpResponse,\n  schema: z.ZodType<T>,\n  label: string,\n): T {\n  if (response.status >= 500) {\n    throw new TranscriptRequesterError(\n      \"requester-access-unreachable\",\n      `${label} endpoint returned ${response.status}`,\n      \"unreachable\",\n    );\n  }\n  if (response.status >= 400) {\n    const normalized = normalizeExternal(\n      response.body,\n      \"requester-access-denied\",\n    );\n    const denial = parseDenialBody(normalized);\n    if (denial !== undefined) {\n      throw errorForDenial(denial, response.status);\n    }\n    throw new TranscriptRequesterError(\n      \"requester-access-denied\",\n      `${label} denied`,\n      \"denied\",\n    );\n  }\n  const normalized = normalizeExternal(\n    response.body,\n    \"requester-engine-response-invalid\",\n  );\n  const parsed = schema.safeParse(normalized);\n  if (!parsed.success) {\n    throw new TranscriptRequesterError(\n      \"requester-engine-response-invalid\",\n      `${label} response failed validation: ${parsed.error.message}`,\n    );\n  }\n  return parsed.data;\n}\n\nfunction parseDelegateReceipt(\n  response: RequesterHttpResponse,\n): z.infer<typeof DelegateReceiptSchema> {\n  if (response.status !== 200) {\n    throw new TranscriptRequesterError(\n      \"requester-delegation-import-failed\",\n      `owner node delegation import returned ${response.status}`,\n      response.status >= 500 ? \"invalid\" : \"denied\",\n      undefined,\n      response.status,\n    );\n  }\n  const normalized = normalizeExternal(\n    response.body,\n    \"requester-delegation-import-failed\",\n  );\n  const parsed = DelegateReceiptSchema.safeParse(normalized);\n  if (!parsed.success) {\n    throw new TranscriptRequesterError(\n      \"requester-delegation-import-failed\",\n      `owner node delegation receipt failed validation: ${parsed.error.message}`,\n    );\n  }\n  return parsed.data;\n}\n\nfunction parseNodeDataResponse<T>(\n  response: RequesterHttpResponse,\n  schema: z.ZodType<T>,\n  label: string,\n): T {\n  if (response.status >= 500) {\n    throw new TranscriptRequesterError(\n      \"requester-node-unreachable\",\n      `${label} node returned ${response.status}: ${nodeErrorMessage(response.body)}`,\n      \"unreachable\",\n      undefined,\n      response.status,\n    );\n  }\n  if (response.status >= 400) {\n    throw new TranscriptRequesterError(\n      \"requester-node-denied\",\n      `${label} node denied: ${nodeErrorMessage(response.body)}`,\n      \"denied\",\n      undefined,\n      response.status,\n    );\n  }\n  const normalized = normalizeExternal(\n    response.body,\n    \"requester-node-response-invalid\",\n  );\n  const parsed = schema.safeParse(normalized);\n  if (!parsed.success) {\n    throw new TranscriptRequesterError(\n      \"requester-node-response-invalid\",\n      `${label} node response failed validation: ${parsed.error.message}`,\n    );\n  }\n  return parsed.data;\n}\n\nfunction nodeErrorMessage(body: unknown): string {\n  if (typeof body === \"string\") return body;\n  if (body !== null && typeof body === \"object\") {\n    const record = body as Record<string, unknown>;\n    const code = typeof record.code === \"string\" ? record.code : undefined;\n    const message =\n      typeof record.message === \"string\" ? record.message : undefined;\n    if (code !== undefined)\n      return message === undefined ? code : `${code}: ${message}`;\n  }\n  return \"native node refusal\";\n}\n\nexport function deriveDelegationCid(encoded: string): string {\n  const digest = createDigest(0x1e, blake3(new TextEncoder().encode(encoded)));\n  return CID.createV1(0x55, digest).toString();\n}\n\nfunction headersRecord(headers: ServiceHeaders): Record<string, string> {\n  return Array.isArray(headers) ? Object.fromEntries(headers) : headers;\n}\n\nasync function validateAndResolveOwnerNode(\n  endpoint: string,\n  transport: RequesterTransport,\n): Promise<ReadonlySet<string>> {\n  return validateAndResolvePublicEndpoint(endpoint, transport, \"owner-node\");\n}\n\nasync function validateAndResolvePublicEndpoint(\n  endpoint: string,\n  transport: RequesterTransport,\n  kind: \"owner-node\" | \"policy-engine\",\n): Promise<ReadonlySet<string>> {\n  let url: URL;\n  try {\n    url = new URL(endpoint);\n  } catch {\n    throw endpointError(kind, `${kind} endpoint is not a URL`);\n  }\n  if (\n    url.protocol !== \"https:\" ||\n    url.username !== \"\" ||\n    url.password !== \"\" ||\n    url.hash !== \"\" ||\n    url.search !== \"\"\n  ) {\n    throw endpointError(\n      kind,\n      `${kind} endpoint must use HTTPS without credentials, query, or fragment`,\n    );\n  }\n  if (transport.resolveEndpoint === undefined) {\n    throw endpointError(\n      kind,\n      `${kind} endpoint resolution metadata is required`,\n    );\n  }\n  let resolution: RequesterEndpointResolution;\n  try {\n    resolution = await transport.resolveEndpoint(url.origin);\n  } catch (error) {\n    throw endpointError(\n      kind,\n      `${kind} endpoint resolution failed: ${error instanceof Error ? error.message : String(error)}`,\n    );\n  }\n  if (resolution.addresses.length === 0) {\n    throw endpointError(kind, `${kind} endpoint resolved to no addresses`);\n  }\n  const addresses = new Set<string>();\n  for (const address of resolution.addresses) {\n    const normalized = normalizeIp(address);\n    if (!isPublicIp(normalized)) {\n      throw endpointError(\n        kind,\n        `${kind} endpoint resolved to a non-public address: ${address}`,\n      );\n    }\n    addresses.add(normalized);\n  }\n  return addresses;\n}\n\nfunction endpointError(\n  kind: \"owner-node\" | \"policy-engine\",\n  message: string,\n): TranscriptRequesterError {\n  return new TranscriptRequesterError(\n    kind === \"owner-node\"\n      ? \"requester-owner-node-endpoint-invalid\"\n      : \"requester-policy-engine-endpoint-invalid\",\n    message,\n    \"bootstrap-invalid\",\n  );\n}\n\nfunction normalizeIp(value: string): string {\n  return value.toLowerCase().replace(/^\\[|\\]$/g, \"\");\n}\n\nfunction isPublicIp(value: string): boolean {\n  const ip = normalizeIp(value);\n  const parts = ip.split(\".\");\n  if (\n    parts.length === 4 &&\n    parts.every((part) => /^\\d+$/.test(part) && Number(part) <= 255)\n  ) {\n    const [a, b] = parts.map(Number) as [number, number, number, number];\n    return !(\n      a === 0 ||\n      a === 10 ||\n      a === 127 ||\n      (a === 100 && b >= 64 && b <= 127) ||\n      (a === 169 && b === 254) ||\n      (a === 172 && b >= 16 && b <= 31) ||\n      (a === 192 && b === 0) ||\n      (a === 192 && b === 168) ||\n      (a === 198 && (b === 18 || b === 19)) ||\n      (a === 198 && b === 51 && parts[2] === \"100\") ||\n      (a === 203 && b === 0 && parts[2] === \"113\") ||\n      a >= 224\n    );\n  }\n  if (!ip.includes(\":\")) return false;\n  if (\n    ip === \"::\" ||\n    ip === \"::1\" ||\n    ip.startsWith(\"2001:db8:\") ||\n    ip.startsWith(\"fe8\") ||\n    ip.startsWith(\"fe9\") ||\n    ip.startsWith(\"fea\") ||\n    ip.startsWith(\"feb\") ||\n    ip.startsWith(\"fc\") ||\n    ip.startsWith(\"fd\") ||\n    ip.startsWith(\"ff\")\n  )\n    return false;\n  const mapped = ip.match(/^::ffff:(\\d+\\.\\d+\\.\\d+\\.\\d+)$/);\n  if (mapped !== null) return isPublicIp(mapped[1]!);\n  const mappedHex = ip.match(/^::ffff:([0-9a-f]{1,4}):([0-9a-f]{1,4})$/);\n  if (mappedHex !== null) {\n    const high = Number.parseInt(mappedHex[1]!, 16);\n    const low = Number.parseInt(mappedHex[2]!, 16);\n    return isPublicIp(`${high >> 8}.${high & 255}.${low >> 8}.${low & 255}`);\n  }\n  return true;\n}\n\nfunction parseDenialBody(\n  input: unknown,\n):\n  | { code: PolicyEngineGrantPresentationDenialCode; message?: string }\n  | undefined {\n  const normalized = normalizeExternal(\n    input,\n    \"requester-engine-response-invalid\",\n  );\n  const direct = DenialSchema.safeParse(normalized);\n  if (direct.success) {\n    return { code: direct.data.code, message: direct.data.message };\n  }\n  const envelope = ErrorEnvelopeDenialSchema.safeParse(normalized);\n  if (envelope.success) {\n    return {\n      code: envelope.data.error.code,\n      message: envelope.data.error.message,\n    };\n  }\n  return undefined;\n}\n\nfunction errorForDenial(\n  denial: { code: PolicyEngineGrantPresentationDenialCode; message?: string },\n  status?: number,\n): TranscriptRequesterError {\n  const accessEnded =\n    denial.code === \"policy-inactive\" ||\n    denial.code === \"policy-revoked\" ||\n    denial.code === \"policy-expired\";\n  return new TranscriptRequesterError(\n    `policy-engine-denied-${denial.code}`,\n    denial.message ?? `policy engine denied ${denial.code}`,\n    accessEnded ? \"access-ended\" : \"denied\",\n    denial.code,\n    status,\n  );\n}\n\nfunction retryDelay(attempt: number, random: number): number {\n  const base = Math.min(REQUESTER_ENGINE_RETRY_MAX_DELAY_MS, 50 * 2 ** attempt);\n  return Math.min(\n    REQUESTER_ENGINE_RETRY_MAX_DELAY_MS,\n    Math.floor(base * (0.5 + random)),\n  );\n}\n\nfunction trimTrailingSlash(value: string): string {\n  return value.endsWith(\"/\") ? value.slice(0, -1) : value;\n}\n\nfunction normalizeExternal(\n  input: unknown,\n  code: TranscriptRequesterErrorCode,\n): unknown {\n  try {\n    return normalizeJson(input);\n  } catch (error) {\n    throw new TranscriptRequesterError(\n      code,\n      error instanceof Error ? error.message : String(error),\n    );\n  }\n}\n\nfunction parseStrictRfc3339(value: string): number | undefined {\n  if (\n    !/^(\\d{4})-(\\d{2})-(\\d{2})T(\\d{2}):(\\d{2}):(\\d{2})(\\.\\d+)?(Z|[+-]\\d{2}:\\d{2})$/.test(\n      value,\n    )\n  ) {\n    return undefined;\n  }\n  const parsed = Date.parse(value);\n  if (Number.isNaN(parsed)) {\n    return undefined;\n  }\n  const canonical = new Date(parsed).toISOString().replace(\".000Z\", \"Z\");\n  const reparsed = Date.parse(value);\n  return Date.parse(canonical) === reparsed ? parsed : undefined;\n}\n","export type SignedObjectErrorCode =\n  | \"schema-invalid\"\n  | \"canonicalization-mismatch\"\n  | \"digest-mismatch\"\n  | \"id-mismatch\"\n  | \"signing-key-binding\"\n  | \"signature-material-invalid\"\n  | \"signature-suite-unsupported\"\n  | \"signature-invalid\";\n\nexport class SignedObjectProfileError extends Error {\n  public readonly code: SignedObjectErrorCode;\n\n  constructor(code: SignedObjectErrorCode, message: string) {\n    super(message);\n    this.name = \"SignedObjectProfileError\";\n    this.code = code;\n  }\n}\n\nexport class SignedObjectSchemaError extends SignedObjectProfileError {\n  constructor(message: string) {\n    super(\"schema-invalid\", message);\n    this.name = \"SignedObjectSchemaError\";\n  }\n}\n\nexport class SignedObjectCanonicalizationError extends SignedObjectProfileError {\n  constructor(message: string) {\n    super(\"canonicalization-mismatch\", message);\n    this.name = \"SignedObjectCanonicalizationError\";\n  }\n}\n\nexport class SignedObjectDigestError extends SignedObjectProfileError {\n  constructor(message: string) {\n    super(\"digest-mismatch\", message);\n    this.name = \"SignedObjectDigestError\";\n  }\n}\n\nexport class SignedObjectIdError extends SignedObjectProfileError {\n  constructor(message: string) {\n    super(\"id-mismatch\", message);\n    this.name = \"SignedObjectIdError\";\n  }\n}\n\nexport class SigningKeyBindingError extends SignedObjectProfileError {\n  constructor(message: string) {\n    super(\"signing-key-binding\", message);\n    this.name = \"SigningKeyBindingError\";\n  }\n}\n\nexport class SignatureMaterialError extends SignedObjectProfileError {\n  constructor(message: string) {\n    super(\"signature-material-invalid\", message);\n    this.name = \"SignatureMaterialError\";\n  }\n}\n\nexport class UnsupportedSignatureSuiteError extends SignedObjectProfileError {\n  constructor(message: string) {\n    super(\"signature-suite-unsupported\", message);\n    this.name = \"UnsupportedSignatureSuiteError\";\n  }\n}\n\nexport class SignatureVerificationError extends SignedObjectProfileError {\n  constructor(message: string) {\n    super(\"signature-invalid\", message);\n    this.name = \"SignatureVerificationError\";\n  }\n}\n\nexport function toSignedObjectError(error: unknown): SignedObjectProfileError {\n  if (error instanceof SignedObjectProfileError) {\n    return error;\n  }\n  return new SignedObjectProfileError(\n    \"schema-invalid\",\n    error instanceof Error ? error.message : String(error),\n  );\n}\n","import { SignedObjectCanonicalizationError } from \"./errors\";\n\nexport type JsonValue =\n  | null\n  | boolean\n  | number\n  | string\n  | JsonValue[]\n  | { readonly [key: string]: JsonValue };\n\ntype MutableJsonObject = { [key: string]: JsonValue };\nconst objectHasOwn: (object: object, propertyKey: PropertyKey) => boolean =\n  (Object as ObjectConstructor & {\n    hasOwn?: (object: object, propertyKey: PropertyKey) => boolean;\n  }).hasOwn ??\n  (Object.prototype.hasOwnProperty.call.bind(\n    Object.prototype.hasOwnProperty,\n  ) as (object: object, propertyKey: PropertyKey) => boolean);\n\n/**\n * RFC 8785 JSON Canonicalization Scheme encoder for the signed-object profile.\n *\n * This local encoder is intentionally stricter than JSON.stringify:\n * it rejects non-plain JSON inputs, sparse arrays, undefined/functions/symbols,\n * non-finite numbers, BigInt, dangerous prototype keys, and lone surrogates.\n * Object keys are sorted by Unicode code point before serialization.\n */\nexport function jcsCanonicalize(input: unknown): string {\n  return serialize(normalizeJson(input, \"$\"));\n}\n\nexport function normalizeJson(input: unknown, path = \"$\"): JsonValue {\n  if (input === null) {\n    return null;\n  }\n\n  switch (typeof input) {\n    case \"boolean\":\n      return input;\n    case \"number\":\n      if (!Number.isFinite(input)) {\n        throw new SignedObjectCanonicalizationError(\n          `${path} must be a finite JSON number`,\n        );\n      }\n      return input;\n    case \"string\":\n      assertUnicodeScalarString(input, path);\n      return input;\n    case \"object\":\n      return normalizeJsonObjectOrArray(input, path);\n    case \"bigint\":\n    case \"function\":\n    case \"symbol\":\n    case \"undefined\":\n    default:\n      throw new SignedObjectCanonicalizationError(\n        `${path} is not a JSON value`,\n      );\n  }\n}\n\nexport function serialize(value: JsonValue): string {\n  if (value === null) {\n    return \"null\";\n  }\n\n  switch (typeof value) {\n    case \"boolean\":\n      return value ? \"true\" : \"false\";\n    case \"number\": {\n      const encoded = JSON.stringify(value);\n      if (encoded === undefined) {\n        throw new SignedObjectCanonicalizationError(\n          \"number could not be serialized as JSON\",\n        );\n      }\n      return encoded;\n    }\n    case \"string\":\n      return JSON.stringify(value);\n    case \"object\":\n      if (Array.isArray(value)) {\n        return `[${value.map((item) => serialize(item)).join(\",\")}]`;\n      }\n      return serializeObject(value);\n    default:\n      throw new SignedObjectCanonicalizationError(\n        `unsupported JSON value type ${typeof value}`,\n      );\n  }\n}\n\nfunction normalizeJsonObjectOrArray(input: object, path: string): JsonValue {\n  assertNoSymbolKeys(input, path);\n\n  if (Array.isArray(input)) {\n    for (const key of Object.getOwnPropertyNames(input)) {\n      if (key === \"length\") {\n        continue;\n      }\n      if (!isArrayIndexKey(key, input.length)) {\n        throw new SignedObjectCanonicalizationError(\n          `${path}.${key} is not allowed on a JSON array`,\n        );\n      }\n      const descriptor = Object.getOwnPropertyDescriptor(input, key);\n      if (descriptor?.enumerable !== true) {\n        throw new SignedObjectCanonicalizationError(\n          `${path}[${key}] must be an enumerable JSON array item`,\n        );\n      }\n      if (!(\"value\" in descriptor)) {\n        throw new SignedObjectCanonicalizationError(\n          `${path}[${key}] must be a JSON data property`,\n        );\n      }\n    }\n    const output: JsonValue[] = [];\n    for (let index = 0; index < input.length; index++) {\n      if (!objectHasOwn(input, index)) {\n        throw new SignedObjectCanonicalizationError(\n          `${path}[${index}] must not be a sparse array hole`,\n        );\n      }\n      output.push(normalizeJson(input[index], `${path}[${index}]`));\n    }\n    return output;\n  }\n\n  const proto = Object.getPrototypeOf(input);\n  if (proto !== Object.prototype && proto !== null) {\n    throw new SignedObjectCanonicalizationError(\n      `${path} must be a plain JSON object`,\n    );\n  }\n\n  const output = Object.create(null) as MutableJsonObject;\n  for (const key of Object.getOwnPropertyNames(input)) {\n    assertUnicodeScalarString(key, `${path} key`);\n    if (key === \"__proto__\" || key === \"constructor\") {\n      throw new SignedObjectCanonicalizationError(\n        `${path}.${key} is not allowed`,\n      );\n    }\n    const descriptor = Object.getOwnPropertyDescriptor(input, key);\n    if (descriptor?.enumerable !== true) {\n      throw new SignedObjectCanonicalizationError(\n        `${path}.${key} must be an enumerable JSON object property`,\n      );\n    }\n    if (!(\"value\" in descriptor)) {\n      throw new SignedObjectCanonicalizationError(\n        `${path}.${key} must be a JSON data property`,\n      );\n    }\n    const value = descriptor.value;\n    output[key] = normalizeJson(value, `${path}.${key}`);\n  }\n  return output;\n}\n\nfunction assertNoSymbolKeys(input: object, path: string): void {\n  if (Object.getOwnPropertySymbols(input).length > 0) {\n    throw new SignedObjectCanonicalizationError(\n      `${path} must not have symbol properties`,\n    );\n  }\n}\n\nfunction isArrayIndexKey(key: string, length: number): boolean {\n  if (!/^(0|[1-9]\\d*)$/.test(key)) {\n    return false;\n  }\n  const index = Number(key);\n  return Number.isSafeInteger(index) && index >= 0 && index < length;\n}\n\nfunction serializeObject(value: { readonly [key: string]: JsonValue }): string {\n  const keys = Object.keys(value).sort(compareCodePoints);\n  const parts = keys.map((key) => `${JSON.stringify(key)}:${serialize(value[key])}`);\n  return `{${parts.join(\",\")}}`;\n}\n\nfunction compareCodePoints(a: string, b: string): number {\n  const left = Array.from(a);\n  const right = Array.from(b);\n  const max = Math.min(left.length, right.length);\n  for (let index = 0; index < max; index++) {\n    const leftPoint = left[index].codePointAt(0) ?? 0;\n    const rightPoint = right[index].codePointAt(0) ?? 0;\n    if (leftPoint !== rightPoint) {\n      return leftPoint - rightPoint;\n    }\n  }\n  return left.length - right.length;\n}\n\nfunction assertUnicodeScalarString(value: string, path: string): void {\n  for (let index = 0; index < value.length; index++) {\n    const code = value.charCodeAt(index);\n    if (code >= 0xd800 && code <= 0xdbff) {\n      const next = value.charCodeAt(index + 1);\n      if (Number.isNaN(next) || next < 0xdc00 || next > 0xdfff) {\n        throw new SignedObjectCanonicalizationError(\n          `${path} contains a lone high surrogate`,\n        );\n      }\n      index++;\n      continue;\n    }\n    if (code >= 0xdc00 && code <= 0xdfff) {\n      throw new SignedObjectCanonicalizationError(\n        `${path} contains a lone low surrogate`,\n      );\n    }\n  }\n}\n","import { CAPABILITY_REGISTRY } from \"@tinycloud/bootstrap\";\nimport { bytesToHex, sha256 } from \"viem\";\nimport { jcsCanonicalize, normalizeJson, type JsonValue } from \"./jcs\";\n\nconst POLICY_CAPABILITY_DOMAIN = \"xyz.tinycloud.policy/PolicyCapability/v0\";\nconst textEncoder = new TextEncoder();\n\nexport type PolicyCapabilityErrorCode =\n  | \"policy-capability-malformed\"\n  | \"policy-capability-unknown-key\"\n  | \"policy-capability-malformed-service\"\n  | \"policy-capability-malformed-space\"\n  | \"policy-capability-malformed-path\"\n  | \"policy-capability-malformed-action\"\n  | \"policy-capability-empty-actions\"\n  | \"policy-capability-malformed-caveats\";\n\nexport class PolicyCapabilityError extends Error {\n  public readonly code: PolicyCapabilityErrorCode;\n\n  constructor(code: PolicyCapabilityErrorCode, message: string) {\n    super(message);\n    this.name = \"PolicyCapabilityError\";\n    this.code = code;\n  }\n}\n\nexport interface PolicyCapability {\n  readonly service: \"tinycloud.kv\" | \"tinycloud.sql\" | \"tinycloud.vfs\";\n  readonly space: string;\n  readonly path: string;\n  readonly actions: readonly string[];\n  readonly caveats?: JsonObject;\n}\n\nexport type JsonObject = { readonly [key: string]: JsonValue };\n\ninterface NormalizeOptions {\n  readonly allowPrefixPaths?: boolean;\n  readonly requireCanonical?: boolean;\n}\n\nconst objectHasOwn: (object: object, propertyKey: PropertyKey) => boolean =\n  (Object as ObjectConstructor & {\n    hasOwn?: (object: object, propertyKey: PropertyKey) => boolean;\n  }).hasOwn ??\n  (Object.prototype.hasOwnProperty.call.bind(\n    Object.prototype.hasOwnProperty,\n  ) as (object: object, propertyKey: PropertyKey) => boolean);\n\nconst CEILING_SERVICES = new Set([\"tinycloud.kv\", \"tinycloud.sql\", \"tinycloud.vfs\"]);\nconst GRANTABLE_ACTIONS = new Map<string, ReadonlySet<string>>();\n\nfor (const entry of CAPABILITY_REGISTRY) {\n  if (!CEILING_SERVICES.has(entry.service)) {\n    continue;\n  }\n  if (entry.aliasOf !== undefined || entry.implies !== undefined || entry.urn.endsWith(\"/*\")) {\n    continue;\n  }\n  const existing = GRANTABLE_ACTIONS.get(entry.service);\n  if (existing === undefined) {\n    GRANTABLE_ACTIONS.set(entry.service, new Set([entry.urn]));\n    continue;\n  }\n  (existing as Set<string>).add(entry.urn);\n}\n\n/**\n * Strict authoring validator for resolved Listen-adapter PolicyCapability JSON.\n * It accepts only concrete service/space/path/action/caveat forms and rejects\n * manifest-shaped permission payloads before any Policy is signed.\n */\nexport function normalizePolicyCapability(input: unknown): PolicyCapability {\n  return normalizePolicyCapabilityWithOptions(input, { requireCanonical: true });\n}\n\n/**\n * Frozen-vector canonicalizer for the m1-b-01a policy-capability vectors.\n * Prefix paths are allowed here only to preserve behavioral conformance with\n * the vendored engine vectors; authoring uses normalizePolicyCapability.\n */\nexport function canonicalizePolicyCapability(input: unknown): PolicyCapability {\n  return normalizePolicyCapabilityWithOptions(input, { allowPrefixPaths: true });\n}\n\nexport function policyCapabilityDigestHex(input: unknown): string {\n  const canonical = canonicalizePolicyCapability(input);\n  const jcs = textEncoder.encode(jcsCanonicalize(canonical));\n  const domain = textEncoder.encode(`${POLICY_CAPABILITY_DOMAIN}\\0`);\n  const bytes = new Uint8Array(domain.length + jcs.length);\n  bytes.set(domain, 0);\n  bytes.set(jcs, domain.length);\n  return bytesToHex(sha256(bytes, \"bytes\")).slice(2);\n}\n\nexport function policyCapabilityContains(authority: unknown, request: unknown): boolean {\n  let auth: PolicyCapability;\n  let req: PolicyCapability;\n  try {\n    auth = canonicalizePolicyCapability(authority);\n    req = canonicalizePolicyCapability(request);\n  } catch {\n    return false;\n  }\n  if (auth.service !== req.service || auth.space !== req.space) {\n    return false;\n  }\n  if (!pathContains(auth.path, req.path)) {\n    return false;\n  }\n  const authActions = new Set(auth.actions);\n  for (const action of req.actions) {\n    if (!authActions.has(action)) {\n      return false;\n    }\n  }\n  return caveatsContain(auth.caveats, req.caveats);\n}\n\nfunction normalizePolicyCapabilityWithOptions(\n  input: unknown,\n  options: NormalizeOptions,\n): PolicyCapability {\n  const object = expectObject(input, \"$\");\n  assertExactKeys(object, [\"service\", \"space\", \"path\", \"actions\", \"caveats\"], \"$\");\n  const service = requiredString(object, \"service\", \"$\", \"policy-capability-malformed-service\");\n  if (!CEILING_SERVICES.has(service)) {\n    throw new PolicyCapabilityError(\n      \"policy-capability-malformed-service\",\n      \"$.service is outside the frozen permissionsCeiling vocabulary\",\n    );\n  }\n  const space = requiredString(object, \"space\", \"$\", \"policy-capability-malformed-space\");\n  validateConcreteSpace(space);\n  const canonicalSpace = space.normalize(\"NFC\");\n  if (options.requireCanonical && canonicalSpace !== space) {\n    throw new PolicyCapabilityError(\n      \"policy-capability-malformed-space\",\n      \"$.space must already be canonical NFC\",\n    );\n  }\n  const rawPath = requiredString(object, \"path\", \"$\", \"policy-capability-malformed-path\");\n  validateRawPath(rawPath, options);\n  const path = normalizePath(rawPath);\n  if (options.requireCanonical && path !== rawPath) {\n    throw new PolicyCapabilityError(\n      \"policy-capability-malformed-path\",\n      \"$.path must already be canonical\",\n    );\n  }\n  validateRawPath(path, options);\n  const actions = normalizeActions(\n    requiredArray(object, \"actions\", \"$\", \"policy-capability-malformed-action\"),\n    service,\n    options,\n  );\n  const output = Object.create(null) as {\n    service: PolicyCapability[\"service\"];\n    space: string;\n    path: string;\n    actions: string[];\n    caveats?: JsonObject;\n  };\n  output.service = service as PolicyCapability[\"service\"];\n  output.space = canonicalSpace;\n  output.path = path;\n  output.actions = actions;\n  if (hasOwn(object, \"caveats\")) {\n    output.caveats = validateCaveats(\n      requiredValue(object, \"caveats\", \"$\", \"policy-capability-malformed-caveats\"),\n      output.service,\n    );\n  }\n  return output;\n}\n\nfunction expectObject(input: unknown, path: string): JsonObject {\n  try {\n    const normalized = normalizeJson(input);\n    if (normalized === null || typeof normalized !== \"object\" || Array.isArray(normalized)) {\n      throw new PolicyCapabilityError(\"policy-capability-malformed\", `${path} must be an object`);\n    }\n    return normalized as JsonObject;\n  } catch (error) {\n    if (error instanceof PolicyCapabilityError) {\n      throw error;\n    }\n    throw new PolicyCapabilityError(\n      \"policy-capability-malformed\",\n      error instanceof Error ? error.message : String(error),\n    );\n  }\n}\n\nfunction assertExactKeys(object: JsonObject, allowed: readonly string[], path: string): void {\n  const allowedSet = new Set(allowed);\n  for (const key of Object.keys(object)) {\n    if (!allowedSet.has(key)) {\n      throw new PolicyCapabilityError(\n        key === \"id\" || key === \"scope\" ? \"policy-capability-malformed\" : \"policy-capability-unknown-key\",\n        `${path} has unknown field ${key}`,\n      );\n    }\n  }\n}\n\nfunction requiredValue(\n  object: JsonObject,\n  key: string,\n  path: string,\n  code: PolicyCapabilityErrorCode,\n): JsonValue {\n  if (!hasOwn(object, key)) {\n    throw new PolicyCapabilityError(code, `${path}.${key} is required`);\n  }\n  return object[key];\n}\n\nfunction requiredString(\n  object: JsonObject,\n  key: string,\n  path: string,\n  code: PolicyCapabilityErrorCode,\n): string {\n  const value = requiredValue(object, key, path, code);\n  if (typeof value !== \"string\" || value.length === 0) {\n    throw new PolicyCapabilityError(code, `${path}.${key} must be a non-empty string`);\n  }\n  return value;\n}\n\nfunction requiredArray(\n  object: JsonObject,\n  key: string,\n  path: string,\n  code: PolicyCapabilityErrorCode,\n): readonly JsonValue[] {\n  const value = requiredValue(object, key, path, code);\n  if (!Array.isArray(value)) {\n    throw new PolicyCapabilityError(code, `${path}.${key} must be an array`);\n  }\n  return value;\n}\n\nfunction validateConcreteSpace(space: string): void {\n  if (space === \"*\" || space.includes(\"*\") || space.includes(\"?\") || space.includes(\"/\")) {\n    throw new PolicyCapabilityError(\n      \"policy-capability-malformed-space\",\n      \"$.space must be concrete\",\n    );\n  }\n}\n\nfunction validateRawPath(path: string, options: NormalizeOptions): void {\n  if (path.length === 0) {\n    throw new PolicyCapabilityError(\"policy-capability-malformed-path\", \"$.path is empty\");\n  }\n  if (!options.allowPrefixPaths && path.endsWith(\"/\")) {\n    throw new PolicyCapabilityError(\n      \"policy-capability-malformed-path\",\n      \"$.path must be an exact concrete path, not a prefix\",\n    );\n  }\n  if (path.endsWith(\"/*\") || path.includes(\"**\")) {\n    throw new PolicyCapabilityError(\"policy-capability-malformed-path\", \"$.path is a prefix form\");\n  }\n  const segments = path.split(\"/\");\n  for (let index = 0; index < segments.length; index++) {\n    const segment = segments[index]!;\n    const isTrailingPrefixSegment =\n      options.allowPrefixPaths && index === segments.length - 1 && segment.length === 0;\n    if (segment.length === 0 && !isTrailingPrefixSegment) {\n      throw new PolicyCapabilityError(\"policy-capability-malformed-path\", \"$.path has an empty segment\");\n    }\n    if (segment === \".\" || segment === \"..\") {\n      throw new PolicyCapabilityError(\n        \"policy-capability-malformed-path\",\n        \"$.path has a traversal segment\",\n      );\n    }\n    if (segment === \"*\" || segment === \"?\" || segment.includes(\"*\") || segment.includes(\"?\")) {\n      throw new PolicyCapabilityError(\n        \"policy-capability-malformed-path\",\n        \"$.path has a wildcard segment\",\n      );\n    }\n  }\n}\n\nfunction normalizePath(path: string): string {\n  return decodeUnreserved(path).normalize(\"NFC\");\n}\n\nfunction decodeUnreserved(path: string): string {\n  return path.replace(/%[0-9A-Fa-f]{2}/g, (encoded) => {\n    const char = String.fromCharCode(Number.parseInt(encoded.slice(1), 16));\n    return /^[A-Za-z0-9._~-]$/.test(char) ? char : encoded.toUpperCase();\n  });\n}\n\nfunction normalizeActions(\n  actions: readonly JsonValue[],\n  service: string,\n  options: NormalizeOptions,\n): string[] {\n  const accepted = GRANTABLE_ACTIONS.get(service);\n  if (accepted === undefined) {\n    throw new PolicyCapabilityError(\n      \"policy-capability-malformed-service\",\n      \"$.service is unsupported\",\n    );\n  }\n  const unique = new Set<string>();\n  const rawActions: string[] = [];\n  for (let index = 0; index < actions.length; index++) {\n    const action = actions[index];\n    if (typeof action !== \"string\" || action.length === 0) {\n      throw new PolicyCapabilityError(\n        \"policy-capability-malformed-action\",\n        `$.actions[${index}] must be a non-empty action URN`,\n      );\n    }\n    if (!action.startsWith(`${service}/`) || action.includes(\"*\") || !accepted.has(action)) {\n      throw new PolicyCapabilityError(\n        \"policy-capability-malformed-action\",\n        `$.actions[${index}] is not a grantable action URN`,\n      );\n    }\n    rawActions.push(action);\n    unique.add(action);\n  }\n  if (unique.size === 0) {\n    throw new PolicyCapabilityError(\n      \"policy-capability-empty-actions\",\n      \"$.actions must not be empty\",\n    );\n  }\n  const normalizedActions = [...unique].sort();\n  if (\n    options.requireCanonical &&\n    (rawActions.length !== normalizedActions.length ||\n      rawActions.some((action, index) => action !== normalizedActions[index]))\n  ) {\n    throw new PolicyCapabilityError(\n      \"policy-capability-malformed-action\",\n      \"$.actions must already be sorted, deduplicated canonical action URNs\",\n    );\n  }\n  return normalizedActions;\n}\n\nfunction validateCaveats(input: JsonValue, service: PolicyCapability[\"service\"]): JsonObject {\n  if (input === null || typeof input !== \"object\" || Array.isArray(input)) {\n    throw new PolicyCapabilityError(\n      \"policy-capability-malformed-caveats\",\n      \"$.caveats must be an object\",\n    );\n  }\n  if (service === \"tinycloud.sql\") {\n    return validateSqlCaveats(input as JsonObject);\n  }\n  throw new PolicyCapabilityError(\n    \"policy-capability-malformed-caveats\",\n    \"$.caveats are not defined for this service\",\n  );\n}\n\nfunction validateSqlCaveats(input: JsonObject): JsonObject {\n  assertCaveatKeys(input, [\"mode\", \"readOnly\", \"statements\"], \"$.caveats\");\n  const mode = caveatString(input, \"mode\", \"$.caveats\");\n  if (mode !== \"constrained-statements\") {\n    throw new PolicyCapabilityError(\n      \"policy-capability-malformed-caveats\",\n      \"$.caveats.mode is unsupported\",\n    );\n  }\n  if (requiredCaveat(input, \"readOnly\", \"$.caveats\") !== true) {\n    throw new PolicyCapabilityError(\n      \"policy-capability-malformed-caveats\",\n      \"$.caveats.readOnly must be true\",\n    );\n  }\n  const statements = requiredCaveat(input, \"statements\", \"$.caveats\");\n  if (!Array.isArray(statements) || statements.length === 0) {\n    throw new PolicyCapabilityError(\n      \"policy-capability-malformed-caveats\",\n      \"$.caveats.statements must be a non-empty array\",\n    );\n  }\n  for (let index = 0; index < statements.length; index++) {\n    validateSqlStatement(statements[index], `$.caveats.statements[${index}]`);\n  }\n  return input;\n}\n\nfunction validateSqlStatement(input: JsonValue, path: string): void {\n  if (input === null || typeof input !== \"object\" || Array.isArray(input)) {\n    throw new PolicyCapabilityError(\"policy-capability-malformed-caveats\", `${path} must be an object`);\n  }\n  const object = input as JsonObject;\n  assertCaveatKeys(object, [\"name\", \"sql\", \"fixedParams\"], path);\n  caveatString(object, \"name\", path);\n  caveatString(object, \"sql\", path);\n  const fixedParams = requiredCaveat(object, \"fixedParams\", path);\n  if (!Array.isArray(fixedParams)) {\n    throw new PolicyCapabilityError(\n      \"policy-capability-malformed-caveats\",\n      `${path}.fixedParams must be an array`,\n    );\n  }\n  for (let index = 0; index < fixedParams.length; index++) {\n    validateFixedParam(fixedParams[index], `${path}.fixedParams[${index}]`);\n  }\n}\n\nfunction validateFixedParam(input: JsonValue, path: string): void {\n  if (input === null || typeof input !== \"object\" || Array.isArray(input)) {\n    throw new PolicyCapabilityError(\"policy-capability-malformed-caveats\", `${path} must be an object`);\n  }\n  const object = input as JsonObject;\n  assertCaveatKeys(object, [\"index\", \"value\"], path);\n  const index = requiredCaveat(object, \"index\", path);\n  if (typeof index !== \"number\" || !Number.isSafeInteger(index) || index < 0) {\n    throw new PolicyCapabilityError(\n      \"policy-capability-malformed-caveats\",\n      `${path}.index must be a non-negative integer`,\n    );\n  }\n  requiredCaveat(object, \"value\", path);\n}\n\nfunction assertCaveatKeys(object: JsonObject, allowed: readonly string[], path: string): void {\n  const allowedSet = new Set(allowed);\n  for (const key of Object.keys(object)) {\n    if (!allowedSet.has(key)) {\n      throw new PolicyCapabilityError(\n        \"policy-capability-malformed-caveats\",\n        `${path} has unknown field ${key}`,\n      );\n    }\n  }\n}\n\nfunction requiredCaveat(object: JsonObject, key: string, path: string): JsonValue {\n  if (!hasOwn(object, key)) {\n    throw new PolicyCapabilityError(\n      \"policy-capability-malformed-caveats\",\n      `${path}.${key} is required`,\n    );\n  }\n  return object[key];\n}\n\nfunction caveatString(object: JsonObject, key: string, path: string): string {\n  const value = requiredCaveat(object, key, path);\n  if (typeof value !== \"string\" || value.length === 0) {\n    throw new PolicyCapabilityError(\n      \"policy-capability-malformed-caveats\",\n      `${path}.${key} must be a non-empty string`,\n    );\n  }\n  return value;\n}\n\nfunction pathContains(authority: string, request: string): boolean {\n  if (authority === request) {\n    return true;\n  }\n  return authority.endsWith(\"/\") && request.startsWith(authority);\n}\n\nfunction caveatsContain(authority: JsonObject | undefined, request: JsonObject | undefined): boolean {\n  if (authority === undefined) {\n    return request === undefined;\n  }\n  if (request === undefined) {\n    return Object.keys(authority).length === 0;\n  }\n  if (authority.mode !== \"constrained-statements\" || request.mode !== \"constrained-statements\") {\n    return false;\n  }\n  const authorityStatements = Array.isArray(authority.statements) ? authority.statements : [];\n  const requestStatements = Array.isArray(request.statements) ? request.statements : [];\n  return requestStatements.every((statement) =>\n    authorityStatements.some((candidate) => jcsCanonicalize(candidate) === jcsCanonicalize(statement)),\n  );\n}\n\nfunction hasOwn(object: JsonObject, key: string): boolean {\n  return objectHasOwn(object, key);\n}\n","import { ed25519 } from \"@noble/curves/ed25519\";\nimport { bases } from \"multiformats/basics\";\nimport { bytesToHex, sha256, verifyMessage } from \"viem\";\nimport { parsePkhDid } from \"../identity\";\nimport { canonicalizePolicyCapability, normalizePolicyCapability } from \"./capability\";\nimport {\n  SignatureMaterialError,\n  SignatureVerificationError,\n  SignedObjectDigestError,\n  SignedObjectIdError,\n  SignedObjectProfileError,\n  SignedObjectSchemaError,\n  SigningKeyBindingError,\n  UnsupportedSignatureSuiteError,\n  toSignedObjectError,\n} from \"./errors\";\nimport { type JsonValue, jcsCanonicalize, normalizeJson } from \"./jcs\";\n\nexport const POLICY_SCHEMA = \"xyz.tinycloud.policy/policy/v0\";\nexport const POLICY_STATUS_SCHEMA = \"xyz.tinycloud.policy/status/v0\";\nexport const POLICY_ENGINE_RECORD_SCHEMA =\n  \"xyz.tinycloud.policy/engine-record/v0\";\n\nexport const ED25519_JCS_SIGNATURE_SUITE = \"eddsa-ed25519-sha256-jcs-v1\";\nexport const EIP191_JCS_SIGNATURE_SUITE =\n  \"eip191-secp256k1-sha256-jcs-v1\";\n\nexport type SignedObjectKind = \"Policy\" | \"PolicyStatus\" | \"PolicyEngineRecord\";\n\nexport type SignatureSuite =\n  | typeof ED25519_JCS_SIGNATURE_SUITE\n  | typeof EIP191_JCS_SIGNATURE_SUITE;\n\nexport interface SignedObjectSignature {\n  suite: SignatureSuite;\n  signerDid: string;\n  value: string;\n}\n\nexport type JsonObject = { readonly [key: string]: JsonValue };\n\nexport interface Policy {\n  readonly schema: typeof POLICY_SCHEMA;\n  readonly policyId: string;\n  readonly ownerDid: string;\n  readonly signingKeyDid: string;\n  readonly createdAt: string;\n  readonly expiresAt?: string;\n  readonly resource: JsonObject;\n  readonly when: JsonObject;\n  readonly grant: JsonObject;\n  readonly disclosure?: JsonObject;\n  readonly audit?: JsonObject;\n  readonly signature: SignedObjectSignature;\n}\n\nexport type UnsignedPolicy = Omit<Policy, \"policyId\" | \"signature\">;\n\nexport interface PolicyStatus {\n  readonly schema: typeof POLICY_STATUS_SCHEMA;\n  readonly statusId: string;\n  readonly policyId: string;\n  readonly ownerDid: string;\n  readonly sequence: number;\n  readonly disposition: \"active\" | \"suspended\" | \"revoked\";\n  readonly effectiveAt: string;\n  readonly reasonCode?: string;\n  readonly signingKeyDid: string;\n  readonly signature: SignedObjectSignature;\n}\n\nexport type UnsignedPolicyStatus = Omit<PolicyStatus, \"statusId\" | \"signature\">;\n\nexport interface PolicyEngineRecord {\n  readonly schema: typeof POLICY_ENGINE_RECORD_SCHEMA;\n  readonly engineRecordId: string;\n  readonly ownerDid: string;\n  readonly endpoint: string;\n  readonly audience: string;\n  readonly supportedPolicyVersions: string[];\n  readonly supportedEvidenceVerifiers: string[];\n  readonly grantIssuerDid: string;\n  readonly expiresAt: string;\n  readonly signature: SignedObjectSignature;\n}\n\nexport type UnsignedPolicyEngineRecord = Omit<\n  PolicyEngineRecord,\n  \"engineRecordId\" | \"signature\"\n>;\n\nexport type SignedPolicyObject =\n  | Policy\n  | PolicyStatus\n  | PolicyEngineRecord;\n\nexport type UnsignedPolicyObject =\n  | UnsignedPolicy\n  | UnsignedPolicyStatus\n  | UnsignedPolicyEngineRecord;\n\nexport interface SignedObjectSigner {\n  readonly suite: SignatureSuite;\n  readonly signerDid: string;\n  signDigest(digest: Uint8Array): Promise<Uint8Array | string> | Uint8Array | string;\n}\n\nexport interface SignedObjectMaterial {\n  readonly kind: SignedObjectKind;\n  readonly idField: string;\n  readonly id: string;\n  readonly domain: string;\n  readonly unsigned: JsonObject;\n  readonly jcs: string;\n  readonly jcsBytes: Uint8Array;\n  readonly digest: Uint8Array;\n  readonly digestHex: string;\n}\n\nexport type SignedObjectVerificationResult<T extends SignedPolicyObject> =\n  | { readonly ok: true; readonly object: T; readonly material: SignedObjectMaterial }\n  | { readonly ok: false; readonly error: SignedObjectProfileError };\n\ninterface ObjectDescriptor {\n  readonly kind: SignedObjectKind;\n  readonly schema: string;\n  readonly idField: \"policyId\" | \"statusId\" | \"engineRecordId\";\n  readonly idPrefix: string;\n  readonly domain: string;\n}\n\nconst DESCRIPTORS: Record<SignedObjectKind, ObjectDescriptor> = {\n  Policy: {\n    kind: \"Policy\",\n    schema: POLICY_SCHEMA,\n    idField: \"policyId\",\n    idPrefix: \"pol_\",\n    domain: POLICY_SCHEMA,\n  },\n  PolicyStatus: {\n    kind: \"PolicyStatus\",\n    schema: POLICY_STATUS_SCHEMA,\n    idField: \"statusId\",\n    idPrefix: \"polst_\",\n    domain: POLICY_STATUS_SCHEMA,\n  },\n  PolicyEngineRecord: {\n    kind: \"PolicyEngineRecord\",\n    schema: POLICY_ENGINE_RECORD_SCHEMA,\n    idField: \"engineRecordId\",\n    idPrefix: \"peng_\",\n    domain: POLICY_ENGINE_RECORD_SCHEMA,\n  },\n};\n\nconst textEncoder = new TextEncoder();\nconst BASE32_ALPHABET = \"abcdefghijklmnopqrstuvwxyz234567\";\nconst BASE64URL_RE = /^[A-Za-z0-9_-]+$/;\nconst objectHasOwn: (object: object, propertyKey: PropertyKey) => boolean =\n  (Object as ObjectConstructor & {\n    hasOwn?: (object: object, propertyKey: PropertyKey) => boolean;\n  }).hasOwn ??\n  (Object.prototype.hasOwnProperty.call.bind(\n    Object.prototype.hasOwnProperty,\n  ) as (object: object, propertyKey: PropertyKey) => boolean);\n\nexport function canonicalizeSignedObjectUnsigned(input: unknown): string {\n  return jcsCanonicalize(input);\n}\n\nexport function deriveSignedObjectMaterial(input: unknown): SignedObjectMaterial {\n  const descriptor = descriptorForUnsigned(input);\n  const unsigned = validateUnsignedForDescriptor(input, descriptor);\n  return materialForUnsigned(unsigned, descriptor);\n}\n\nexport function signedObjectIdFor(input: unknown): string {\n  return deriveSignedObjectMaterial(input).id;\n}\n\nexport async function createAndSignSignedObject(\n  input: unknown,\n  signer: SignedObjectSigner,\n): Promise<SignedPolicyObject> {\n  const normalized = expectJsonObject(normalizeJson(input), \"$\");\n  const descriptor = descriptorForUnsigned(normalized);\n  const stripped = stripOwnIdAndSignature(normalized, descriptor);\n  const unsigned = validateUnsignedForDescriptor(stripped, descriptor);\n  if (descriptor.kind === \"Policy\") {\n    validatePolicyPermissionsCeilingForSigning(unsigned);\n  }\n  assertSupportedSignatureSuite(signer.suite);\n  requireStringType(signer.signerDid, \"$.signer.signerDid\");\n  assertSignerDidMatchesSuite(signer.signerDid, signer.suite);\n  assertSigningKeyBindingForCreate(unsigned, signer.signerDid);\n  const material = materialForUnsigned(unsigned, descriptor);\n  const signatureValue = encodeSignatureValue(\n    await signer.signDigest(material.digest),\n    signer.suite,\n  );\n  const signature = validateSignature({\n    suite: signer.suite,\n    signerDid: signer.signerDid,\n    value: signatureValue,\n  });\n  return {\n    ...unsigned,\n    [descriptor.idField]: material.id,\n    signature,\n  } as unknown as SignedPolicyObject;\n}\n\nexport function createAndSignPolicy(\n  input: unknown,\n  signer: SignedObjectSigner,\n): Promise<Policy> {\n  return createAndSignSignedObject(input, signer).then((object) =>\n    validatePolicySignedShape(object),\n  );\n}\n\nexport function createAndSignPolicyStatus(\n  input: unknown,\n  signer: SignedObjectSigner,\n): Promise<PolicyStatus> {\n  return createAndSignSignedObject(input, signer).then((object) =>\n    validatePolicyStatusSignedShape(object),\n  );\n}\n\nexport function createAndSignPolicyEngineRecord(\n  input: unknown,\n  signer: SignedObjectSigner,\n): Promise<PolicyEngineRecord> {\n  return createAndSignSignedObject(input, signer).then((object) =>\n    validatePolicyEngineRecordSignedShape(object),\n  );\n}\n\nexport async function verifySignedObject(\n  input: unknown,\n): Promise<{ object: SignedPolicyObject; material: SignedObjectMaterial }> {\n  const signed = validateSignedObjectShape(input);\n  const signedJson = signed as unknown as JsonObject;\n  const descriptor = descriptorForSchema(signed.schema);\n  const signature = validateSignature(signed.signature);\n  assertSigningKeyBindingForVerify(signedJson, signature);\n  const unsigned = stripOwnIdAndSignature(signedJson, descriptor);\n  const material = materialForUnsigned(unsigned, descriptor);\n  assertIdMatches(signedJson, material, descriptor);\n  if (!(await verifySignature(signature, material.digest))) {\n    throw new SignatureVerificationError(\"signature verification failed\");\n  }\n  return { object: signed, material };\n}\n\nexport async function verifyPolicy(\n  input: unknown,\n): Promise<{ object: Policy; material: SignedObjectMaterial }> {\n  const result = await verifySignedObject(input);\n  return {\n    object: validatePolicySignedShape(result.object),\n    material: result.material,\n  };\n}\n\nexport async function verifyPolicyStatus(\n  input: unknown,\n): Promise<{ object: PolicyStatus; material: SignedObjectMaterial }> {\n  const result = await verifySignedObject(input);\n  return {\n    object: validatePolicyStatusSignedShape(result.object),\n    material: result.material,\n  };\n}\n\nexport async function verifyPolicyEngineRecord(\n  input: unknown,\n): Promise<{ object: PolicyEngineRecord; material: SignedObjectMaterial }> {\n  const result = await verifySignedObject(input);\n  return {\n    object: validatePolicyEngineRecordSignedShape(result.object),\n    material: result.material,\n  };\n}\n\nexport async function validatePolicySigned(\n  input: unknown,\n): Promise<SignedObjectVerificationResult<Policy>> {\n  try {\n    const result = await verifyPolicy(input);\n    return { ok: true, object: result.object, material: result.material };\n  } catch (error) {\n    return { ok: false, error: toSignedObjectError(error) };\n  }\n}\n\nexport async function validatePolicyStatusSigned(\n  input: unknown,\n): Promise<SignedObjectVerificationResult<PolicyStatus>> {\n  try {\n    const result = await verifyPolicyStatus(input);\n    return { ok: true, object: result.object, material: result.material };\n  } catch (error) {\n    return { ok: false, error: toSignedObjectError(error) };\n  }\n}\n\nexport async function validatePolicyEngineRecordSigned(\n  input: unknown,\n): Promise<SignedObjectVerificationResult<PolicyEngineRecord>> {\n  try {\n    const result = await verifyPolicyEngineRecord(input);\n    return { ok: true, object: result.object, material: result.material };\n  } catch (error) {\n    return { ok: false, error: toSignedObjectError(error) };\n  }\n}\n\nexport function validatePolicyUnsigned(input: unknown): UnsignedPolicy {\n  return validatePolicyShape(input, false) as unknown as UnsignedPolicy;\n}\n\nexport function validatePolicyStatusUnsigned(input: unknown): UnsignedPolicyStatus {\n  return validatePolicyStatusShape(input, false) as unknown as UnsignedPolicyStatus;\n}\n\nexport function validatePolicyEngineRecordUnsigned(\n  input: unknown,\n): UnsignedPolicyEngineRecord {\n  return validatePolicyEngineRecordShape(input, false) as unknown as UnsignedPolicyEngineRecord;\n}\n\nexport function validatePolicySignedShape(input: unknown): Policy {\n  return validatePolicyShape(input, true) as unknown as Policy;\n}\n\nexport function validatePolicyStatusSignedShape(input: unknown): PolicyStatus {\n  return validatePolicyStatusShape(input, true) as unknown as PolicyStatus;\n}\n\nexport function validatePolicyEngineRecordSignedShape(\n  input: unknown,\n): PolicyEngineRecord {\n  return validatePolicyEngineRecordShape(input, true) as unknown as PolicyEngineRecord;\n}\n\nfunction validateSignedObjectShape(input: unknown): SignedPolicyObject {\n  const normalized = expectJsonObject(normalizeJson(input), \"$\");\n  const schema = requiredString(normalized, \"schema\", \"$\");\n  const descriptor = descriptorForSchema(schema);\n  switch (descriptor.kind) {\n    case \"Policy\":\n      return validatePolicySignedShape(normalized);\n    case \"PolicyStatus\":\n      return validatePolicyStatusSignedShape(normalized);\n    case \"PolicyEngineRecord\":\n      return validatePolicyEngineRecordSignedShape(normalized);\n  }\n}\n\nfunction validateUnsignedForDescriptor(\n  input: unknown,\n  descriptor: ObjectDescriptor,\n): JsonObject {\n  switch (descriptor.kind) {\n    case \"Policy\":\n      return validatePolicyUnsigned(input) as unknown as JsonObject;\n    case \"PolicyStatus\":\n      return validatePolicyStatusUnsigned(input) as unknown as JsonObject;\n    case \"PolicyEngineRecord\":\n      return validatePolicyEngineRecordUnsigned(input) as unknown as JsonObject;\n  }\n}\n\nfunction validatePolicyShape(input: unknown, signed: boolean): JsonObject {\n  const object = expectJsonObject(normalizeJson(input), \"$\");\n  assertExactKeys(\n    object,\n    signed\n      ? [\n          \"schema\",\n          \"policyId\",\n          \"ownerDid\",\n          \"signingKeyDid\",\n          \"createdAt\",\n          \"expiresAt\",\n          \"resource\",\n          \"when\",\n          \"grant\",\n          \"disclosure\",\n          \"audit\",\n          \"signature\",\n        ]\n      : [\n          \"schema\",\n          \"ownerDid\",\n          \"signingKeyDid\",\n          \"createdAt\",\n          \"expiresAt\",\n          \"resource\",\n          \"when\",\n          \"grant\",\n          \"disclosure\",\n          \"audit\",\n        ],\n    \"$\",\n  );\n  expectConst(requiredString(object, \"schema\", \"$\"), POLICY_SCHEMA, \"$.schema\");\n  if (signed) {\n    requiredString(object, \"policyId\", \"$\");\n    validateSignature(requiredValue(object, \"signature\", \"$\"));\n  }\n  requiredString(object, \"ownerDid\", \"$\");\n  requiredString(object, \"signingKeyDid\", \"$\");\n  requiredDateString(object, \"createdAt\", \"$\");\n  optionalDateString(object, \"expiresAt\", \"$\");\n  validatePolicyResource(requiredValue(object, \"resource\", \"$\"), \"$.resource\");\n  validateExpression(requiredValue(object, \"when\", \"$\"), \"$.when\");\n  validateGrant(requiredValue(object, \"grant\", \"$\"), \"$.grant\");\n  if (hasOwn(object, \"disclosure\")) {\n    validateDisclosure(requiredValue(object, \"disclosure\", \"$\"), \"$.disclosure\");\n  }\n  if (hasOwn(object, \"audit\")) {\n    validateAudit(requiredValue(object, \"audit\", \"$\"), \"$.audit\");\n  }\n  return object;\n}\n\nfunction validatePolicyStatusShape(input: unknown, signed: boolean): JsonObject {\n  const object = expectJsonObject(normalizeJson(input), \"$\");\n  assertExactKeys(\n    object,\n    signed\n      ? [\n          \"schema\",\n          \"statusId\",\n          \"policyId\",\n          \"ownerDid\",\n          \"sequence\",\n          \"disposition\",\n          \"effectiveAt\",\n          \"reasonCode\",\n          \"signingKeyDid\",\n          \"signature\",\n        ]\n      : [\n          \"schema\",\n          \"policyId\",\n          \"ownerDid\",\n          \"sequence\",\n          \"disposition\",\n          \"effectiveAt\",\n          \"reasonCode\",\n          \"signingKeyDid\",\n        ],\n    \"$\",\n  );\n  expectConst(requiredString(object, \"schema\", \"$\"), POLICY_STATUS_SCHEMA, \"$.schema\");\n  if (signed) {\n    requiredString(object, \"statusId\", \"$\");\n    validateSignature(requiredValue(object, \"signature\", \"$\"));\n  }\n  requiredString(object, \"policyId\", \"$\");\n  requiredString(object, \"ownerDid\", \"$\");\n  requiredInteger(object, \"sequence\", \"$\", 0);\n  expectOneOf(requiredString(object, \"disposition\", \"$\"), [\n    \"active\",\n    \"suspended\",\n    \"revoked\",\n  ], \"$.disposition\");\n  requiredDateString(object, \"effectiveAt\", \"$\");\n  optionalString(object, \"reasonCode\", \"$\");\n  requiredString(object, \"signingKeyDid\", \"$\");\n  return object;\n}\n\nfunction validatePolicyEngineRecordShape(\n  input: unknown,\n  signed: boolean,\n): JsonObject {\n  const object = expectJsonObject(normalizeJson(input), \"$\");\n  assertExactKeys(\n    object,\n    signed\n      ? [\n          \"schema\",\n          \"engineRecordId\",\n          \"ownerDid\",\n          \"endpoint\",\n          \"audience\",\n          \"supportedPolicyVersions\",\n          \"supportedEvidenceVerifiers\",\n          \"grantIssuerDid\",\n          \"expiresAt\",\n          \"signature\",\n        ]\n      : [\n          \"schema\",\n          \"ownerDid\",\n          \"endpoint\",\n          \"audience\",\n          \"supportedPolicyVersions\",\n          \"supportedEvidenceVerifiers\",\n          \"grantIssuerDid\",\n          \"expiresAt\",\n        ],\n    \"$\",\n  );\n  expectConst(\n    requiredString(object, \"schema\", \"$\"),\n    POLICY_ENGINE_RECORD_SCHEMA,\n    \"$.schema\",\n  );\n  if (signed) {\n    requiredString(object, \"engineRecordId\", \"$\");\n    validateSignature(requiredValue(object, \"signature\", \"$\"));\n  }\n  requiredString(object, \"ownerDid\", \"$\");\n  requiredString(object, \"endpoint\", \"$\");\n  requiredString(object, \"audience\", \"$\");\n  requiredStringArray(object, \"supportedPolicyVersions\", \"$\", (value, path) =>\n    expectConst(value, \"v0\", path),\n  );\n  requiredStringArray(object, \"supportedEvidenceVerifiers\", \"$\");\n  requiredString(object, \"grantIssuerDid\", \"$\");\n  requiredDateString(object, \"expiresAt\", \"$\");\n  return object;\n}\n\nfunction validateSignature(input: unknown): SignedObjectSignature {\n  const object = expectJsonObject(input, \"$.signature\");\n  assertExactKeys(object, [\"suite\", \"signerDid\", \"value\"], \"$.signature\");\n  const suite = requiredString(object, \"suite\", \"$.signature\");\n  assertSupportedSignatureSuite(suite);\n  const signerDid = requiredString(object, \"signerDid\", \"$.signature\");\n  const value = requiredString(object, \"value\", \"$.signature\");\n  decodeSignatureValue(value, suite);\n  return { suite, signerDid, value };\n}\n\nfunction validatePolicyResource(input: unknown, path: string): void {\n  const object = expectJsonObject(input, path);\n  assertExactKeys(object, [\"resourceType\", \"resourceId\", \"permissionsCeiling\"], path);\n  requiredString(object, \"resourceType\", path);\n  requiredString(object, \"resourceId\", path);\n  const ceiling = requiredArray(object, \"permissionsCeiling\", path, 1);\n  for (let index = 0; index < ceiling.length; index++) {\n    validatePolicyCapability(ceiling[index], `${path}.permissionsCeiling[${index}]`);\n  }\n}\n\nfunction validatePolicyPermissionsCeilingForSigning(input: JsonObject): void {\n  const resource = expectJsonObject(requiredValue(input, \"resource\", \"$\"), \"$.resource\");\n  const ceiling = requiredArray(resource, \"permissionsCeiling\", \"$.resource\", 1);\n  for (let index = 0; index < ceiling.length; index++) {\n    validatePolicyCapabilityForSigning(\n      ceiling[index],\n      `$.resource.permissionsCeiling[${index}]`,\n    );\n  }\n}\n\nfunction validatePolicyCapability(input: unknown, path: string): void {\n  const object = expectJsonObject(input, path);\n  try {\n    const canonical = canonicalizePolicyCapability(object);\n    if (jcsCanonicalize(object) !== jcsCanonicalize(canonical)) {\n      throw new SignedObjectSchemaError(`${path} must be canonical PolicyCapability JSON`);\n    }\n  } catch (error) {\n    if (error instanceof SignedObjectSchemaError) {\n      throw error;\n    }\n    throw new SignedObjectSchemaError(\n      error instanceof Error ? error.message : String(error),\n    );\n  }\n}\n\nfunction validatePolicyCapabilityForSigning(input: unknown, path: string): void {\n  const object = expectJsonObject(input, path);\n  try {\n    const canonical = normalizePolicyCapability(object);\n    if (jcsCanonicalize(object) !== jcsCanonicalize(canonical)) {\n      throw new SignedObjectSchemaError(`${path} must be strict canonical PolicyCapability JSON`);\n    }\n  } catch (error) {\n    if (error instanceof SignedObjectSchemaError) {\n      throw error;\n    }\n    throw new SignedObjectSchemaError(\n      error instanceof Error ? error.message : String(error),\n    );\n  }\n}\n\nfunction validateExpression(input: unknown, path: string): void {\n  const object = expectJsonObject(input, path);\n  const keys = Object.keys(object);\n  if (keys.length !== 1) {\n    throw new SignedObjectSchemaError(`${path} must have exactly one expression key`);\n  }\n  const key = keys[0];\n  if (key === \"allOf\" || key === \"anyOf\") {\n    const values = requiredArray(object, key, path, 1);\n    for (let index = 0; index < values.length; index++) {\n      validateExpression(values[index], `${path}.${key}[${index}]`);\n    }\n    return;\n  }\n  if (key === \"subject\") {\n    const subject = expectJsonObject(requiredValue(object, \"subject\", path), `${path}.subject`);\n    assertExactKeys(subject, [\"did\"], `${path}.subject`);\n    requiredString(subject, \"did\", `${path}.subject`);\n    return;\n  }\n  if (key === \"evidence\") {\n    validateEvidenceRequirement(requiredValue(object, \"evidence\", path), `${path}.evidence`);\n    return;\n  }\n  throw new SignedObjectSchemaError(`${path} has unknown expression key ${key}`);\n}\n\nfunction validateEvidenceRequirement(input: unknown, path: string): void {\n  const object = expectJsonObject(input, path);\n  assertExactKeys(\n    object,\n    [\"requirementId\", \"verifier\", \"requirements\", \"authority\", \"freshness\"],\n    path,\n  );\n  requiredString(object, \"requirementId\", path);\n  requiredString(object, \"verifier\", path);\n  requiredValue(object, \"requirements\", path);\n  if (hasOwn(object, \"authority\")) {\n    const authority = expectJsonObject(requiredValue(object, \"authority\", path), `${path}.authority`);\n    assertExactKeys(\n      authority,\n      [\"profile\", \"acceptedIssuers\", \"allowOwnerAuthorizedIssuer\"],\n      `${path}.authority`,\n    );\n    optionalString(authority, \"profile\", `${path}.authority`);\n    if (hasOwn(authority, \"acceptedIssuers\")) {\n      requiredStringArray(authority, \"acceptedIssuers\", `${path}.authority`);\n    }\n    optionalBoolean(authority, \"allowOwnerAuthorizedIssuer\", `${path}.authority`);\n  }\n  if (hasOwn(object, \"freshness\")) {\n    const freshness = expectJsonObject(requiredValue(object, \"freshness\", path), `${path}.freshness`);\n    assertExactKeys(freshness, [\"maxStatusAgeSeconds\"], `${path}.freshness`);\n    requiredInteger(freshness, \"maxStatusAgeSeconds\", `${path}.freshness`, 0);\n  }\n}\n\nfunction validateGrant(input: unknown, path: string): void {\n  const object = expectJsonObject(input, path);\n  assertExactKeys(object, [\"output\", \"maxTtlSeconds\", \"delegationMode\", \"revocation\"], path);\n  expectConst(requiredString(object, \"output\", path), \"portable-delegation\", `${path}.output`);\n  requiredInteger(object, \"maxTtlSeconds\", path, 1);\n  expectOneOf(requiredString(object, \"delegationMode\", path), [\n    \"terminal\",\n    \"attenuable\",\n  ], `${path}.delegationMode`);\n  expectOneOf(requiredString(object, \"revocation\", path), [\n    \"refresh_only\",\n    \"active_cutoff\",\n  ], `${path}.revocation`);\n}\n\nfunction validateDisclosure(input: unknown, path: string): void {\n  const object = expectJsonObject(input, path);\n  assertExactKeys(object, [\"denial\"], path);\n  expectOneOf(requiredString(object, \"denial\", path), [\"none\", \"code\", \"debug\"], `${path}.denial`);\n}\n\nfunction validateAudit(input: unknown, path: string): void {\n  const object = expectJsonObject(input, path);\n  assertExactKeys(object, [\"issuance\"], path);\n  expectOneOf(requiredString(object, \"issuance\", path), [\"off\", \"security\", \"full\"], `${path}.issuance`);\n}\n\nfunction materialForUnsigned(\n  unsigned: JsonObject,\n  descriptor: ObjectDescriptor,\n): SignedObjectMaterial {\n  const jcs = jcsCanonicalize(unsigned);\n  const jcsBytes = textEncoder.encode(jcs);\n  const digest = sha256Bytes(concatBytes(textEncoder.encode(`${descriptor.domain}\\0`), jcsBytes));\n  const id = `${descriptor.idPrefix}${base32LowerNoPad(digest)}`;\n  return {\n    kind: descriptor.kind,\n    idField: descriptor.idField,\n    id,\n    domain: descriptor.domain,\n    unsigned,\n    jcs,\n    jcsBytes,\n    digest,\n    digestHex: bytesToHex(digest).slice(2),\n  };\n}\n\nfunction assertIdMatches(\n  signed: JsonObject,\n  material: SignedObjectMaterial,\n  descriptor: ObjectDescriptor,\n): void {\n  const actual = requiredString(signed, descriptor.idField, \"$\");\n  if (actual === material.id) {\n    return;\n  }\n  if (new RegExp(`^${descriptor.idPrefix}[a-z2-7]{52}$`).test(actual)) {\n    throw new SignedObjectDigestError(\n      `${descriptor.idField} was not derived from the signed object digest`,\n    );\n  }\n  throw new SignedObjectIdError(`${descriptor.idField} does not match ${descriptor.idPrefix}`);\n}\n\nfunction assertSigningKeyBindingForCreate(\n  unsigned: JsonObject,\n  signerDid: string,\n): void {\n  if (!hasOwn(unsigned, \"signingKeyDid\")) {\n    return;\n  }\n  const signingKeyDid = requiredString(unsigned, \"signingKeyDid\", \"$\");\n  if (signingKeyDid !== signerDid) {\n    throw new SigningKeyBindingError(\n      `signer DID ${signerDid} does not match signingKeyDid ${signingKeyDid}`,\n    );\n  }\n}\n\nfunction assertSigningKeyBindingForVerify(\n  signed: JsonObject,\n  signature: SignedObjectSignature,\n): void {\n  if (!hasOwn(signed, \"signingKeyDid\")) {\n    return;\n  }\n  const signingKeyDid = requiredString(signed, \"signingKeyDid\", \"$\");\n  if (signature.signerDid !== signingKeyDid) {\n    throw new SigningKeyBindingError(\n      `signature signerDid ${signature.signerDid} does not match signingKeyDid ${signingKeyDid}`,\n    );\n  }\n}\n\nfunction assertSignerDidMatchesSuite(\n  signerDid: string,\n  suite: SignatureSuite,\n): void {\n  if (suite === ED25519_JCS_SIGNATURE_SUITE) {\n    ed25519PublicKeyFromDidKey(signerDid);\n    return;\n  }\n  if (suite === EIP191_JCS_SIGNATURE_SUITE) {\n    parseDidPkh(signerDid);\n    return;\n  }\n  throw new UnsupportedSignatureSuiteError(`unsupported signature suite: ${suite}`);\n}\n\nasync function verifySignature(\n  signature: SignedObjectSignature,\n  digest: Uint8Array,\n): Promise<boolean> {\n  if (signature.suite === ED25519_JCS_SIGNATURE_SUITE) {\n    const publicKey = ed25519PublicKeyFromDidKey(signature.signerDid);\n    const signatureBytes = decodeSignatureValue(signature.value, signature.suite);\n    try {\n      return ed25519.verify(signatureBytes, digest, publicKey);\n    } catch {\n      throw new SignatureVerificationError(\"Ed25519 signature verification failed\");\n    }\n  }\n\n  if (signature.suite === EIP191_JCS_SIGNATURE_SUITE) {\n    const pkh = parseDidPkh(signature.signerDid);\n    const signatureBytes = decodeSignatureValue(signature.value, signature.suite);\n    try {\n      return verifyMessage({\n        address: pkh.address,\n        message: { raw: digest },\n        signature: bytesToHex(signatureBytes),\n      });\n    } catch {\n      throw new SignatureVerificationError(\"EIP-191 signature verification failed\");\n    }\n  }\n\n  throw new UnsupportedSignatureSuiteError(`unsupported signature suite: ${signature.suite}`);\n}\n\nfunction ed25519PublicKeyFromDidKey(did: string): Uint8Array {\n  if (!did.startsWith(\"did:key:\")) {\n    throw new SignatureMaterialError(\"Ed25519 signerDid must be did:key\");\n  }\n  const identifier = did.slice(\"did:key:\".length);\n  if (!identifier.startsWith(\"z\")) {\n    throw new SignatureMaterialError(\"did:key must use base58btc multibase\");\n  }\n  let bytes: Uint8Array;\n  try {\n    bytes = bases.base58btc.decode(identifier);\n  } catch {\n    throw new SignatureMaterialError(\"did:key signerDid is undecodable\");\n  }\n  if (bytes.length === 34 && bytes[0] === 0xed && bytes[1] === 0x01) {\n    return bytes.slice(2);\n  }\n  throw new SignatureMaterialError(\"did:key signerDid is not an Ed25519 key\");\n}\n\nfunction parseDidPkh(did: string): { address: `0x${string}` } {\n  let parsed: ReturnType<typeof parsePkhDid>;\n  try {\n    parsed = parsePkhDid(did);\n  } catch {\n    throw new SignatureMaterialError(\"did:pkh signerDid is undecodable\");\n  }\n  if (!parsed) {\n    throw new SignatureMaterialError(\"EIP-191 signerDid must be did:pkh\");\n  }\n  return { address: parsed.address };\n}\n\nfunction decodeSignatureValue(value: string, suite: SignatureSuite): Uint8Array {\n  if (value.length === 0 || !BASE64URL_RE.test(value) || value.includes(\"=\")) {\n    throw new SignatureMaterialError(\"signature value must be base64url without padding\");\n  }\n  const bytes = base64UrlDecode(value);\n  if (suite === ED25519_JCS_SIGNATURE_SUITE && bytes.length !== 64) {\n    throw new SignatureMaterialError(\"Ed25519 signature must be 64 bytes\");\n  }\n  if (suite === EIP191_JCS_SIGNATURE_SUITE) {\n    if (bytes.length !== 65) {\n      throw new SignatureMaterialError(\"EIP-191 signature must be 65 bytes\");\n    }\n    const v = bytes[64];\n    if (v !== 27 && v !== 28) {\n      throw new SignatureMaterialError(\"EIP-191 signature recovery id must be 27 or 28\");\n    }\n  }\n  return bytes;\n}\n\nfunction encodeSignatureValue(\n  value: Uint8Array | string,\n  suite: SignatureSuite,\n): string {\n  if (typeof value === \"string\") {\n    const encoded = value.startsWith(\"0x\")\n      ? base64UrlEncode(hexToBytes(value))\n      : value;\n    decodeSignatureValue(encoded, suite);\n    return encoded;\n  }\n  const encoded = base64UrlEncode(value);\n  decodeSignatureValue(encoded, suite);\n  return encoded;\n}\n\nfunction stripOwnIdAndSignature(\n  object: JsonObject,\n  descriptor: ObjectDescriptor,\n): JsonObject {\n  const output = Object.create(null) as { [key: string]: JsonValue };\n  for (const [key, value] of Object.entries(object)) {\n    if (key === descriptor.idField || key === \"signature\") {\n      continue;\n    }\n    output[key] = value;\n  }\n  return output;\n}\n\nfunction descriptorForUnsigned(input: unknown): ObjectDescriptor {\n  const object = expectJsonObject(normalizeJson(input), \"$\");\n  return descriptorForSchema(requiredString(object, \"schema\", \"$\"));\n}\n\nfunction descriptorForSchema(schema: string): ObjectDescriptor {\n  if (schema === POLICY_SCHEMA) return DESCRIPTORS.Policy;\n  if (schema === POLICY_STATUS_SCHEMA) return DESCRIPTORS.PolicyStatus;\n  if (schema === POLICY_ENGINE_RECORD_SCHEMA) return DESCRIPTORS.PolicyEngineRecord;\n  throw new SignedObjectSchemaError(`unsupported signed-object schema: ${schema}`);\n}\n\nfunction expectJsonObject(input: unknown, path: string): JsonObject {\n  if (input === null || typeof input !== \"object\" || Array.isArray(input)) {\n    throw new SignedObjectSchemaError(`${path} must be an object`);\n  }\n  return input as JsonObject;\n}\n\nfunction assertExactKeys(object: JsonObject, allowed: readonly string[], path: string): void {\n  const allowedSet = new Set(allowed);\n  for (const key of Object.keys(object)) {\n    if (!allowedSet.has(key)) {\n      throw new SignedObjectSchemaError(`${path} has unknown field ${key}`);\n    }\n  }\n}\n\nfunction requiredValue(object: JsonObject, key: string, path: string): JsonValue {\n  if (!hasOwn(object, key)) {\n    throw new SignedObjectSchemaError(`${path}.${key} is required`);\n  }\n  return object[key];\n}\n\nfunction requiredString(object: JsonObject, key: string, path: string): string {\n  return requireStringType(requiredValue(object, key, path), `${path}.${key}`);\n}\n\nfunction optionalString(object: JsonObject, key: string, path: string): void {\n  if (!hasOwn(object, key)) {\n    return;\n  }\n  requireStringType(requiredValue(object, key, path), `${path}.${key}`);\n}\n\nfunction requireStringType(value: JsonValue, path: string): string {\n  if (typeof value !== \"string\" || value.length === 0) {\n    throw new SignedObjectSchemaError(`${path} must be a non-empty string`);\n  }\n  return value;\n}\n\nfunction optionalBoolean(object: JsonObject, key: string, path: string): void {\n  if (!hasOwn(object, key)) {\n    return;\n  }\n  if (typeof requiredValue(object, key, path) !== \"boolean\") {\n    throw new SignedObjectSchemaError(`${path}.${key} must be a boolean`);\n  }\n}\n\nfunction requiredInteger(\n  object: JsonObject,\n  key: string,\n  path: string,\n  minimum: number,\n): number {\n  const value = requiredValue(object, key, path);\n  if (typeof value !== \"number\" || !Number.isSafeInteger(value) || value < minimum) {\n    throw new SignedObjectSchemaError(\n      `${path}.${key} must be an integer >= ${minimum}`,\n    );\n  }\n  return value;\n}\n\nfunction requiredArray(\n  object: JsonObject,\n  key: string,\n  path: string,\n  minimum: number,\n): readonly JsonValue[] {\n  const value = requiredValue(object, key, path);\n  if (!Array.isArray(value) || value.length < minimum) {\n    throw new SignedObjectSchemaError(\n      `${path}.${key} must be an array with at least ${minimum} item(s)`,\n    );\n  }\n  return value;\n}\n\nfunction requiredStringArray(\n  object: JsonObject,\n  key: string,\n  path: string,\n  check?: (value: string, path: string) => void,\n): void {\n  const values = requiredArray(object, key, path, 0);\n  for (let index = 0; index < values.length; index++) {\n    const itemPath = `${path}.${key}[${index}]`;\n    const value = requireStringType(values[index], itemPath);\n    check?.(value, itemPath);\n  }\n}\n\nfunction requiredDateString(object: JsonObject, key: string, path: string): void {\n  assertRfc3339(requiredString(object, key, path), `${path}.${key}`);\n}\n\nfunction optionalDateString(object: JsonObject, key: string, path: string): void {\n  if (!hasOwn(object, key)) {\n    return;\n  }\n  assertRfc3339(requiredString(object, key, path), `${path}.${key}`);\n}\n\nfunction assertRfc3339(value: string, path: string): void {\n  const match = value.match(\n    /^(\\d{4})-(\\d{2})-(\\d{2})T(\\d{2}):(\\d{2}):(\\d{2})(\\.\\d+)?(Z|[+-]\\d{2}:\\d{2})$/,\n  );\n  if (!match) {\n    throw new SignedObjectSchemaError(`${path} must be strict RFC 3339`);\n  }\n  const parsed = Date.parse(value);\n  if (Number.isNaN(parsed)) {\n    throw new SignedObjectSchemaError(`${path} must be a parseable RFC 3339 timestamp`);\n  }\n  const canonical = new Date(parsed).toISOString().replace(\".000Z\", \"Z\");\n  if (canonical !== value) {\n    throw new SignedObjectSchemaError(`${path} must be a normalizable RFC 3339 timestamp`);\n  }\n}\n\nfunction expectConst<T extends string>(actual: string, expected: T, path: string): T {\n  if (actual !== expected) {\n    throw new SignedObjectSchemaError(`${path} must be ${expected}`);\n  }\n  return expected;\n}\n\nfunction expectOneOf<T extends string>(\n  actual: string,\n  allowed: readonly T[],\n  path: string,\n): T {\n  for (const value of allowed) {\n    if (actual === value) {\n      return value;\n    }\n  }\n  throw new SignedObjectSchemaError(`${path} has unsupported value ${actual}`);\n}\n\nfunction hasOwn(object: JsonObject, key: string): boolean {\n  return objectHasOwn(object, key);\n}\n\nfunction assertSupportedSignatureSuite(suite: string): asserts suite is SignatureSuite {\n  if (suite !== ED25519_JCS_SIGNATURE_SUITE && suite !== EIP191_JCS_SIGNATURE_SUITE) {\n    throw new UnsupportedSignatureSuiteError(`unsupported signature suite: ${suite}`);\n  }\n}\n\nfunction sha256Bytes(bytes: Uint8Array): Uint8Array {\n  return sha256(bytes, \"bytes\");\n}\n\nfunction concatBytes(left: Uint8Array, right: Uint8Array): Uint8Array {\n  const output = new Uint8Array(left.length + right.length);\n  output.set(left, 0);\n  output.set(right, left.length);\n  return output;\n}\n\nfunction base32LowerNoPad(bytes: Uint8Array): string {\n  let output = \"\";\n  let buffer = 0;\n  let bits = 0;\n  for (const byte of bytes) {\n    buffer = (buffer << 8) | byte;\n    bits += 8;\n    while (bits >= 5) {\n      bits -= 5;\n      output += BASE32_ALPHABET[(buffer >> bits) & 31];\n    }\n  }\n  if (bits > 0) {\n    output += BASE32_ALPHABET[(buffer << (5 - bits)) & 31];\n  }\n  return output;\n}\n\nfunction base64UrlEncode(bytes: Uint8Array): string {\n  const alphabet =\n    \"ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789-_\";\n  let output = \"\";\n  for (let index = 0; index < bytes.length; index += 3) {\n    const a = bytes[index];\n    const b = bytes[index + 1];\n    const c = bytes[index + 2];\n    const triplet = (a << 16) | ((b ?? 0) << 8) | (c ?? 0);\n    output += alphabet[(triplet >> 18) & 63];\n    output += alphabet[(triplet >> 12) & 63];\n    if (index + 1 < bytes.length) {\n      output += alphabet[(triplet >> 6) & 63];\n    }\n    if (index + 2 < bytes.length) {\n      output += alphabet[triplet & 63];\n    }\n  }\n  return output;\n}\n\nfunction base64UrlDecode(value: string): Uint8Array {\n  if (value.length % 4 === 1) {\n    throw new SignatureMaterialError(\"signature value is not canonical base64url\");\n  }\n  const alphabet =\n    \"ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789-_\";\n  const bytes: number[] = [];\n  let buffer = 0;\n  let bits = 0;\n  for (const char of value) {\n    const index = alphabet.indexOf(char);\n    if (index < 0) {\n      throw new SignatureMaterialError(\"signature value is not base64url\");\n    }\n    buffer = (buffer << 6) | index;\n    bits += 6;\n    if (bits >= 8) {\n      bits -= 8;\n      bytes.push((buffer >> bits) & 0xff);\n    }\n  }\n  const decoded = Uint8Array.from(bytes);\n  if (base64UrlEncode(decoded) !== value) {\n    throw new SignatureMaterialError(\"signature value is not canonical base64url\");\n  }\n  return decoded;\n}\n\nfunction hexToBytes(value: string): Uint8Array {\n  const hex = value.slice(2);\n  if (hex.length % 2 !== 0 || !/^[0-9a-fA-F]*$/.test(hex)) {\n    throw new SignatureMaterialError(\"hex signature must have even length\");\n  }\n  const output = new Uint8Array(hex.length / 2);\n  for (let index = 0; index < output.length; index++) {\n    output[index] = Number.parseInt(hex.slice(index * 2, index * 2 + 2), 16);\n  }\n  return output;\n}\n","import { getAddress, isAddress } from \"viem\";\n\nexport type CanonicalAddress = `0x${string}`;\n\nexport interface PkhDidParts {\n  method: \"pkh\";\n  namespace: \"eip155\";\n  chainId: number;\n  address: CanonicalAddress;\n}\n\nexport interface DidEqualsOptions {\n  ignoreFragment?: boolean;\n}\n\nexport interface DidCacheKeyOptions {\n  preserveFragment?: boolean;\n}\n\nexport class IdentityParseError extends Error {\n  constructor(message: string) {\n    super(message);\n    this.name = \"IdentityParseError\";\n  }\n}\n\nconst PKH_DID_RE = /^did:pkh:eip155:(\\d+):(0x[a-fA-F0-9]{40})$/;\nconst DID_RE = /^did:[a-z0-9]+:.+$/;\n\nfunction splitDidUrl(input: string): { did: string; fragment: string } {\n  const fragmentIndex = input.indexOf(\"#\");\n  if (fragmentIndex < 0) {\n    return { did: input, fragment: \"\" };\n  }\n  return {\n    did: input.slice(0, fragmentIndex),\n    fragment: input.slice(fragmentIndex),\n  };\n}\n\nfunction assertValidChainId(chainId: number): void {\n  if (!Number.isSafeInteger(chainId) || chainId <= 0) {\n    throw new IdentityParseError(`Invalid EIP-155 chain ID: ${chainId}`);\n  }\n}\n\nexport function isEvmAddress(input: string): boolean {\n  return isAddress(input, { strict: false });\n}\n\nexport function canonicalizeAddress(address: string): CanonicalAddress {\n  if (!isEvmAddress(address)) {\n    throw new IdentityParseError(`Invalid EVM address: ${address}`);\n  }\n  return getAddress(address) as CanonicalAddress;\n}\n\nexport function addressStorageKey(address: string): CanonicalAddress {\n  return canonicalizeAddress(address).toLowerCase() as CanonicalAddress;\n}\n\nexport function pkhDid(address: string, chainId: number = 1): string {\n  assertValidChainId(chainId);\n  return `did:pkh:eip155:${chainId}:${canonicalizeAddress(address)}`;\n}\n\nexport function parsePkhDid(did: string): PkhDidParts | null {\n  const match = did.match(PKH_DID_RE);\n  if (!match) return null;\n\n  const chainId = Number(match[1]);\n  assertValidChainId(chainId);\n\n  return {\n    method: \"pkh\",\n    namespace: \"eip155\",\n    chainId,\n    address: canonicalizeAddress(match[2]),\n  };\n}\n\nexport function canonicalizeDid(did: string): string {\n  const pkh = parsePkhDid(did);\n  if (pkh) {\n    return pkhDid(pkh.address, pkh.chainId);\n  }\n  if (DID_RE.test(did)) {\n    return did;\n  }\n  throw new IdentityParseError(`Invalid DID: ${did}`);\n}\n\nexport function canonicalizeDidUrl(didUrl: string): string {\n  const { did, fragment } = splitDidUrl(didUrl);\n  return `${canonicalizeDid(did)}${fragment}`;\n}\n\nexport function principalDid(didUrl: string): string {\n  return canonicalizeDid(splitDidUrl(didUrl).did);\n}\n\nexport function didEquals(a: string, b: string, options: DidEqualsOptions = {}): boolean {\n  const canonicalize = options.ignoreFragment ? principalDid : canonicalizeDidUrl;\n  return canonicalize(a) === canonicalize(b);\n}\n\nexport function principalDidEquals(a: string, b: string): boolean {\n  return didEquals(a, b, { ignoreFragment: true });\n}\n\nexport function didCacheKey(input: string, options: DidCacheKeyOptions = {}): string {\n  const { did, fragment } = splitDidUrl(input);\n  const pkh = parsePkhDid(did);\n  const base = pkh\n    ? `did:pkh:eip155:${pkh.chainId}:${addressStorageKey(pkh.address)}`\n    : canonicalizeDid(did);\n\n  return options.preserveFragment ? `${base}${fragment}` : base;\n}\n\nexport function makePkhSpaceId(\n  address: string,\n  chainId: number,\n  name: string,\n): string {\n  assertValidChainId(chainId);\n  if (!name) {\n    throw new IdentityParseError(\"Space name cannot be empty\");\n  }\n  return `tinycloud:pkh:eip155:${chainId}:${canonicalizeAddress(address)}:${name}`;\n}\n","import {\n  POLICY_ENGINE_RECORD_SCHEMA,\n  POLICY_SCHEMA,\n  createAndSignPolicy,\n  createAndSignPolicyEngineRecord,\n  validatePolicyEngineRecordSignedShape,\n  verifyPolicyEngineRecord,\n  type Policy,\n  type PolicyEngineRecord,\n  type SignedObjectSigner,\n  type UnsignedPolicyEngineRecord,\n} from \"./signed-object\";\nimport {\n  PolicyCapabilityError,\n  normalizePolicyCapability,\n  type JsonObject,\n  type PolicyCapability,\n} from \"./capability\";\nimport { normalizeJson, type JsonValue } from \"./jcs\";\nimport { SignedObjectProfileError, SignedObjectSchemaError } from \"./errors\";\n\nexport const TRANSCRIPT_SHARE_BOOTSTRAP_SCHEMA =\n  \"xyz.tinycloud.exchange/transcript-bootstrap/v0\" as const;\nexport const OWNER_NODE_ENDPOINT_SCHEMA =\n  \"xyz.tinycloud.exchange/owner-node-endpoint/v1\" as const;\nexport const POLICY_VERSION_V0 = \"v0\" as const;\nexport const W3C_VC_CREDENTIAL_VERIFIER = \"w3c.vc/credential/v1\" as const;\n\nexport type PolicyAuthoringErrorCode =\n  | PolicyCapabilityError[\"code\"]\n  | \"policy-authoring-malformed\"\n  | \"policy-authoring-unknown-key\"\n  | \"policy-engine-record-absent\"\n  | \"policy-engine-record-date-invalid\"\n  | \"policy-engine-record-signature-invalid\"\n  | \"policy-engine-record-audience-mismatch\"\n  | \"policy-engine-record-expired\"\n  | \"policy-engine-record-owner-mismatch\"\n  | \"policy-engine-record-grant-issuer-mismatch\"\n  | \"policy-engine-record-policy-version-unsupported\"\n  | \"policy-engine-record-evidence-verifier-unsupported\"\n  | \"transcript-share-bootstrap-malformed\";\n\nexport class PolicyAuthoringError extends Error {\n  public readonly code: PolicyAuthoringErrorCode;\n\n  constructor(code: PolicyAuthoringErrorCode, message: string) {\n    super(message);\n    this.name = \"PolicyAuthoringError\";\n    this.code = code;\n  }\n}\n\nexport interface CreateTranscriptSharePolicyInput {\n  readonly ownerDid: string;\n  readonly signingKeyDid: string;\n  readonly createdAt: string;\n  readonly expiresAt?: string;\n  readonly resourceType: string;\n  readonly resourceId: string;\n  readonly permissionsCeiling: readonly unknown[];\n  readonly when: JsonObject;\n  readonly grant: JsonObject;\n  readonly disclosure?: JsonObject;\n  readonly audit?: JsonObject;\n}\n\nexport interface TranscriptShareBootstrap {\n  readonly schema: typeof TRANSCRIPT_SHARE_BOOTSTRAP_SCHEMA;\n  readonly policyId: string;\n  readonly policyEngine: {\n    readonly endpoint: string;\n    readonly audience: string;\n    readonly supportedEvidenceVerifiers: readonly [\n      typeof W3C_VC_CREDENTIAL_VERIFIER,\n    ];\n    readonly signedRecord: PolicyEngineRecord;\n  };\n  /** Untrusted routing hint. Authority comes only from delegation/invocation validation. */\n  readonly ownerNode: {\n    readonly schema: typeof OWNER_NODE_ENDPOINT_SCHEMA;\n    readonly endpoint: string;\n    readonly spaceId: string;\n  };\n  readonly resourceHint: JsonObject;\n}\n\nexport interface ComposeTranscriptShareBootstrapInput {\n  readonly policyId: string;\n  readonly policyEngineRecord: PolicyEngineRecord;\n  readonly ownerNodeEndpoint: string;\n  readonly ownerSpaceId: string;\n  readonly resourceHint: JsonObject;\n}\n\nexport interface CreatePolicyEngineRecordInput {\n  readonly ownerDid: string;\n  readonly endpoint: string;\n  readonly audience: string;\n  readonly grantIssuerDid: string;\n  readonly expiresAt: string;\n  readonly supportedPolicyVersions?: readonly string[];\n  readonly supportedEvidenceVerifiers?: readonly string[];\n}\n\nexport interface VerifyPolicyEngineRecordOptions {\n  readonly signedRecord: unknown;\n  readonly ownerDid: string;\n  readonly audience: string;\n  readonly grantIssuerDid: string;\n  readonly now: string;\n  readonly requiredPolicyVersion?: string;\n  readonly requiredEvidenceVerifier?: string;\n}\n\n/**\n * Author a transcript-sharing Policy from already-resolved Listen-adapter\n * PolicyCapability JSON. Manifest PermissionEntry shapes are refused here; the\n * SDK does not expand or invent permissions while signing authority-bearing\n * objects.\n */\nexport async function createAndSignTranscriptSharePolicy(\n  input: CreateTranscriptSharePolicyInput,\n  signer: SignedObjectSigner,\n): Promise<Policy> {\n  const normalized = expectObject(input, \"$\", \"policy-authoring-malformed\");\n  assertExactKeys(\n    normalized,\n    [\n      \"ownerDid\",\n      \"signingKeyDid\",\n      \"createdAt\",\n      \"expiresAt\",\n      \"resourceType\",\n      \"resourceId\",\n      \"permissionsCeiling\",\n      \"when\",\n      \"grant\",\n      \"disclosure\",\n      \"audit\",\n    ],\n    \"$\",\n  );\n  const permissions = requiredArray(normalized, \"permissionsCeiling\", \"$\");\n  if (permissions.length === 0) {\n    throw new PolicyAuthoringError(\n      \"policy-authoring-malformed\",\n      \"$.permissionsCeiling must not be empty\",\n    );\n  }\n  const ceiling: PolicyCapability[] = [];\n  for (let index = 0; index < permissions.length; index++) {\n    ceiling.push(\n      wrapCapabilityError(() => normalizePolicyCapability(permissions[index])),\n    );\n  }\n  return createAndSignPolicy(\n    {\n      schema: POLICY_SCHEMA,\n      ownerDid: requiredString(normalized, \"ownerDid\", \"$\"),\n      signingKeyDid: requiredString(normalized, \"signingKeyDid\", \"$\"),\n      createdAt: requiredString(normalized, \"createdAt\", \"$\"),\n      ...(hasOwn(normalized, \"expiresAt\")\n        ? { expiresAt: requiredString(normalized, \"expiresAt\", \"$\") }\n        : {}),\n      resource: {\n        resourceType: requiredString(normalized, \"resourceType\", \"$\"),\n        resourceId: requiredString(normalized, \"resourceId\", \"$\"),\n        permissionsCeiling: ceiling,\n      },\n      when: requiredObject(normalized, \"when\", \"$\"),\n      grant: requiredObject(normalized, \"grant\", \"$\"),\n      ...(hasOwn(normalized, \"disclosure\")\n        ? { disclosure: requiredObject(normalized, \"disclosure\", \"$\") }\n        : {}),\n      ...(hasOwn(normalized, \"audit\")\n        ? { audit: requiredObject(normalized, \"audit\", \"$\") }\n        : {}),\n    },\n    signer,\n  ).catch((error) => {\n    throw wrapSignedObjectError(error);\n  });\n}\n\nexport function createUnsignedPolicyEngineRecord(\n  input: CreatePolicyEngineRecordInput,\n): UnsignedPolicyEngineRecord {\n  const normalized = expectObject(input, \"$\", \"policy-authoring-malformed\");\n  assertExactKeys(\n    normalized,\n    [\n      \"ownerDid\",\n      \"endpoint\",\n      \"audience\",\n      \"grantIssuerDid\",\n      \"expiresAt\",\n      \"supportedPolicyVersions\",\n      \"supportedEvidenceVerifiers\",\n    ],\n    \"$\",\n  );\n  const supportedPolicyVersions = hasOwn(normalized, \"supportedPolicyVersions\")\n    ? requiredStringArray(normalized, \"supportedPolicyVersions\", \"$\")\n    : [POLICY_VERSION_V0];\n  validateSupportedPolicyVersions(\n    supportedPolicyVersions,\n    \"$.supportedPolicyVersions\",\n  );\n  const supportedEvidenceVerifiers = hasOwn(\n    normalized,\n    \"supportedEvidenceVerifiers\",\n  )\n    ? requiredStringArray(normalized, \"supportedEvidenceVerifiers\", \"$\")\n    : [W3C_VC_CREDENTIAL_VERIFIER];\n  validateSupportedEvidenceVerifiers(\n    supportedEvidenceVerifiers,\n    \"$.supportedEvidenceVerifiers\",\n  );\n  const expiresAt = fieldString(\n    normalized,\n    \"expiresAt\",\n    \"$\",\n    \"policy-engine-record-date-invalid\",\n  );\n  parseStrictRfc3339(expiresAt, \"$.expiresAt\");\n\n  return {\n    schema: POLICY_ENGINE_RECORD_SCHEMA,\n    ownerDid: requiredString(normalized, \"ownerDid\", \"$\"),\n    endpoint: validatePolicyEngineEndpoint(\n      requiredString(normalized, \"endpoint\", \"$\"),\n    ),\n    audience: requiredString(normalized, \"audience\", \"$\"),\n    supportedPolicyVersions,\n    supportedEvidenceVerifiers,\n    grantIssuerDid: requiredString(normalized, \"grantIssuerDid\", \"$\"),\n    expiresAt,\n  };\n}\n\nexport async function createAndSignRequesterPolicyEngineRecord(\n  input: CreatePolicyEngineRecordInput,\n  signer: SignedObjectSigner,\n): Promise<PolicyEngineRecord> {\n  return createAndSignPolicyEngineRecord(\n    createUnsignedPolicyEngineRecord(input),\n    signer,\n  ).catch((error) => {\n    throw wrapSignedObjectError(error);\n  });\n}\n\n/**\n * Compose the SDK-level transcript-share bootstrap record. This record is not\n * an invitation and is not authority; it only tells a requester where to ask\n * and which policy id to reference.\n */\nexport function composeTranscriptShareBootstrap(\n  input: ComposeTranscriptShareBootstrapInput,\n): TranscriptShareBootstrap {\n  const normalized = expectObject(\n    input,\n    \"$\",\n    \"transcript-share-bootstrap-malformed\",\n  );\n  assertExactKeys(\n    normalized,\n    [\n      \"policyId\",\n      \"policyEngineRecord\",\n      \"ownerNodeEndpoint\",\n      \"ownerSpaceId\",\n      \"resourceHint\",\n    ],\n    \"$\",\n  );\n  const signedRecord = expectPolicyEngineRecord(\n    requiredValue(normalized, \"policyEngineRecord\", \"$\"),\n  );\n  if (\n    !signedRecord.supportedEvidenceVerifiers.includes(\n      W3C_VC_CREDENTIAL_VERIFIER,\n    )\n  ) {\n    throw new PolicyAuthoringError(\n      \"transcript-share-bootstrap-malformed\",\n      \"policy engine record does not support the bootstrap evidence verifier\",\n    );\n  }\n  return {\n    schema: TRANSCRIPT_SHARE_BOOTSTRAP_SCHEMA,\n    policyId: requiredString(normalized, \"policyId\", \"$\"),\n    policyEngine: {\n      endpoint: signedRecord.endpoint,\n      audience: signedRecord.audience,\n      supportedEvidenceVerifiers: [W3C_VC_CREDENTIAL_VERIFIER],\n      signedRecord,\n    },\n    ownerNode: {\n      schema: OWNER_NODE_ENDPOINT_SCHEMA,\n      endpoint: validateOwnerNodeEndpoint(\n        requiredString(normalized, \"ownerNodeEndpoint\", \"$\"),\n      ),\n      spaceId: requiredString(normalized, \"ownerSpaceId\", \"$\"),\n    },\n    resourceHint: requiredObject(normalized, \"resourceHint\", \"$\"),\n  };\n}\n\nfunction validateOwnerNodeEndpoint(value: string): string {\n  let url: URL;\n  try {\n    url = new URL(value);\n  } catch {\n    throw new PolicyAuthoringError(\n      \"transcript-share-bootstrap-malformed\",\n      \"$.ownerNodeEndpoint must be a URL\",\n    );\n  }\n  if (\n    url.protocol !== \"https:\" ||\n    url.username !== \"\" ||\n    url.password !== \"\" ||\n    url.hash !== \"\" ||\n    url.search !== \"\"\n  ) {\n    throw new PolicyAuthoringError(\n      \"transcript-share-bootstrap-malformed\",\n      \"$.ownerNodeEndpoint must be an HTTPS URL without credentials, query, or fragment\",\n    );\n  }\n  return url.toString().replace(/\\/$/, \"\");\n}\n\nfunction validatePolicyEngineEndpoint(value: string): string {\n  let url: URL;\n  try {\n    url = new URL(value);\n  } catch {\n    throw new PolicyAuthoringError(\n      \"policy-authoring-malformed\",\n      \"$.endpoint must be a URL\",\n    );\n  }\n  if (\n    url.protocol !== \"https:\" ||\n    url.username !== \"\" ||\n    url.password !== \"\" ||\n    url.hash !== \"\" ||\n    url.search !== \"\"\n  ) {\n    throw new PolicyAuthoringError(\n      \"policy-authoring-malformed\",\n      \"$.endpoint must be an HTTPS URL without credentials, query, or fragment\",\n    );\n  }\n  return url.toString().replace(/\\/$/, \"\");\n}\n\n/**\n * Requester-side authentication gate for policy-engine endpoints. A requester\n * MUST NOT send credential evidence or call /resolve unless this verification\n * succeeds.\n */\nexport async function verifyPolicyEngineRecordForRequester(\n  options: VerifyPolicyEngineRecordOptions,\n): Promise<PolicyEngineRecord> {\n  const normalized = expectObject(options, \"$\", \"policy-authoring-malformed\");\n  assertExactKeys(\n    normalized,\n    [\n      \"signedRecord\",\n      \"ownerDid\",\n      \"audience\",\n      \"grantIssuerDid\",\n      \"now\",\n      \"requiredPolicyVersion\",\n      \"requiredEvidenceVerifier\",\n    ],\n    \"$\",\n  );\n  if (!hasOwn(normalized, \"signedRecord\")) {\n    throw new PolicyAuthoringError(\n      \"policy-engine-record-absent\",\n      \"$.signedRecord must be present\",\n    );\n  }\n  const signedRecord = normalized[\"signedRecord\"];\n  if (\n    signedRecord === null ||\n    typeof signedRecord !== \"object\" ||\n    Array.isArray(signedRecord)\n  ) {\n    throw new PolicyAuthoringError(\n      \"policy-engine-record-absent\",\n      \"$.signedRecord must be present\",\n    );\n  }\n  const recordObject = signedRecord as JsonObject;\n  const expiresAt = fieldString(\n    recordObject,\n    \"expiresAt\",\n    \"$.signedRecord\",\n    \"policy-engine-record-date-invalid\",\n  );\n  const now = fieldString(\n    normalized,\n    \"now\",\n    \"$\",\n    \"policy-engine-record-date-invalid\",\n  );\n  const expiresMs = parseStrictRfc3339(expiresAt, \"$.signedRecord.expiresAt\");\n  const nowMs = parseStrictRfc3339(now, \"$.now\");\n  if (expiresMs <= nowMs) {\n    throw new PolicyAuthoringError(\n      \"policy-engine-record-expired\",\n      \"$.signedRecord.expiresAt is expired\",\n    );\n  }\n\n  let verified: PolicyEngineRecord;\n  try {\n    verified = (await verifyPolicyEngineRecord(recordObject)).object;\n  } catch (error) {\n    throw new PolicyAuthoringError(\n      \"policy-engine-record-signature-invalid\",\n      error instanceof Error ? error.message : String(error),\n    );\n  }\n  if (verified.signature.signerDid !== verified.ownerDid) {\n    throw new PolicyAuthoringError(\n      \"policy-engine-record-signature-invalid\",\n      \"$.signedRecord.signature.signerDid must match ownerDid for the direct-owner requester profile\",\n    );\n  }\n\n  const expectedOwnerDid = requiredString(normalized, \"ownerDid\", \"$\");\n  if (verified.ownerDid !== expectedOwnerDid) {\n    throw new PolicyAuthoringError(\n      \"policy-engine-record-owner-mismatch\",\n      \"$.signedRecord.ownerDid does not match\",\n    );\n  }\n  const expectedAudience = requiredString(normalized, \"audience\", \"$\");\n  if (verified.audience !== expectedAudience) {\n    throw new PolicyAuthoringError(\n      \"policy-engine-record-audience-mismatch\",\n      \"$.signedRecord.audience does not match\",\n    );\n  }\n  const expectedGrantIssuerDid = requiredString(\n    normalized,\n    \"grantIssuerDid\",\n    \"$\",\n  );\n  if (verified.grantIssuerDid !== expectedGrantIssuerDid) {\n    throw new PolicyAuthoringError(\n      \"policy-engine-record-grant-issuer-mismatch\",\n      \"$.signedRecord.grantIssuerDid does not match\",\n    );\n  }\n  const requiredPolicyVersion = hasOwn(normalized, \"requiredPolicyVersion\")\n    ? requiredString(normalized, \"requiredPolicyVersion\", \"$\")\n    : POLICY_VERSION_V0;\n  if (!verified.supportedPolicyVersions.includes(requiredPolicyVersion)) {\n    throw new PolicyAuthoringError(\n      \"policy-engine-record-policy-version-unsupported\",\n      \"$.signedRecord.supportedPolicyVersions does not include the required version\",\n    );\n  }\n  const requiredEvidenceVerifier = hasOwn(\n    normalized,\n    \"requiredEvidenceVerifier\",\n  )\n    ? requiredString(normalized, \"requiredEvidenceVerifier\", \"$\")\n    : W3C_VC_CREDENTIAL_VERIFIER;\n  if (!verified.supportedEvidenceVerifiers.includes(requiredEvidenceVerifier)) {\n    throw new PolicyAuthoringError(\n      \"policy-engine-record-evidence-verifier-unsupported\",\n      \"$.signedRecord.supportedEvidenceVerifiers does not include the required verifier\",\n    );\n  }\n  return verified;\n}\n\nfunction expectObject(\n  input: unknown,\n  path: string,\n  code: PolicyAuthoringErrorCode,\n): JsonObject {\n  try {\n    const normalized = normalizeJson(input);\n    if (\n      normalized === null ||\n      typeof normalized !== \"object\" ||\n      Array.isArray(normalized)\n    ) {\n      throw new PolicyAuthoringError(code, `${path} must be an object`);\n    }\n    return normalized as JsonObject;\n  } catch (error) {\n    if (error instanceof PolicyAuthoringError) {\n      throw error;\n    }\n    throw new PolicyAuthoringError(\n      code,\n      error instanceof Error ? error.message : String(error),\n    );\n  }\n}\n\nfunction expectPolicyEngineRecord(input: JsonValue): PolicyEngineRecord {\n  if (input === null || typeof input !== \"object\" || Array.isArray(input)) {\n    throw new PolicyAuthoringError(\n      \"transcript-share-bootstrap-malformed\",\n      \"$.policyEngineRecord must be an object\",\n    );\n  }\n  try {\n    return validatePolicyEngineRecordSignedShape(input);\n  } catch (error) {\n    throw new PolicyAuthoringError(\n      \"transcript-share-bootstrap-malformed\",\n      error instanceof Error ? error.message : String(error),\n    );\n  }\n}\n\nfunction assertExactKeys(\n  object: JsonObject,\n  allowed: readonly string[],\n  path: string,\n): void {\n  const allowedSet = new Set(allowed);\n  for (const key of Object.keys(object)) {\n    if (!allowedSet.has(key)) {\n      throw new PolicyAuthoringError(\n        \"policy-authoring-unknown-key\",\n        `${path} has unknown field ${key}`,\n      );\n    }\n  }\n}\n\nfunction requiredValue(\n  object: JsonObject,\n  key: string,\n  path: string,\n): JsonValue {\n  if (!hasOwn(object, key)) {\n    throw new PolicyAuthoringError(\n      \"policy-authoring-malformed\",\n      `${path}.${key} is required`,\n    );\n  }\n  return object[key];\n}\n\nfunction requiredString(object: JsonObject, key: string, path: string): string {\n  const value = requiredValue(object, key, path);\n  if (typeof value !== \"string\" || value.length === 0) {\n    throw new PolicyAuthoringError(\n      \"policy-authoring-malformed\",\n      `${path}.${key} must be a non-empty string`,\n    );\n  }\n  return value;\n}\n\nfunction fieldString(\n  object: JsonObject,\n  key: string,\n  path: string,\n  code: PolicyAuthoringErrorCode,\n): string {\n  if (!hasOwn(object, key)) {\n    throw new PolicyAuthoringError(code, `${path}.${key} is required`);\n  }\n  const value = object[key];\n  if (typeof value !== \"string\" || value.length === 0) {\n    throw new PolicyAuthoringError(\n      code,\n      `${path}.${key} must be a non-empty string`,\n    );\n  }\n  return value;\n}\n\nfunction requiredObject(\n  object: JsonObject,\n  key: string,\n  path: string,\n): JsonObject {\n  const value = requiredValue(object, key, path);\n  if (value === null || typeof value !== \"object\" || Array.isArray(value)) {\n    throw new PolicyAuthoringError(\n      \"policy-authoring-malformed\",\n      `${path}.${key} must be an object`,\n    );\n  }\n  return value as JsonObject;\n}\n\nfunction requiredArray(\n  object: JsonObject,\n  key: string,\n  path: string,\n): readonly JsonValue[] {\n  const value = requiredValue(object, key, path);\n  if (!Array.isArray(value)) {\n    throw new PolicyAuthoringError(\n      \"policy-authoring-malformed\",\n      `${path}.${key} must be an array`,\n    );\n  }\n  return value;\n}\n\nfunction requiredStringArray(\n  object: JsonObject,\n  key: string,\n  path: string,\n): string[] {\n  const values = requiredArray(object, key, path);\n  return values.map((value, index) => {\n    if (typeof value !== \"string\" || value.length === 0) {\n      throw new PolicyAuthoringError(\n        \"policy-authoring-malformed\",\n        `${path}.${key}[${index}] must be a non-empty string`,\n      );\n    }\n    return value;\n  });\n}\n\nfunction validateSupportedPolicyVersions(\n  values: readonly string[],\n  path: string,\n): void {\n  if (values.length === 0) {\n    throw new PolicyAuthoringError(\n      \"policy-authoring-malformed\",\n      `${path} must not be empty`,\n    );\n  }\n  for (let index = 0; index < values.length; index++) {\n    if (values[index] !== POLICY_VERSION_V0) {\n      throw new PolicyAuthoringError(\n        \"policy-authoring-malformed\",\n        `${path}[${index}] is unsupported`,\n      );\n    }\n  }\n}\n\nfunction validateSupportedEvidenceVerifiers(\n  values: readonly string[],\n  path: string,\n): void {\n  if (values.length === 0) {\n    throw new PolicyAuthoringError(\n      \"policy-authoring-malformed\",\n      `${path} must not be empty`,\n    );\n  }\n  for (let index = 0; index < values.length; index++) {\n    if (values[index] !== W3C_VC_CREDENTIAL_VERIFIER) {\n      throw new PolicyAuthoringError(\n        \"policy-authoring-malformed\",\n        `${path}[${index}] is unsupported`,\n      );\n    }\n  }\n}\n\nfunction wrapCapabilityError<T>(fn: () => T): T {\n  try {\n    return fn();\n  } catch (error) {\n    if (error instanceof PolicyCapabilityError) {\n      throw new PolicyAuthoringError(error.code, error.message);\n    }\n    throw error;\n  }\n}\n\nfunction wrapSignedObjectError(error: unknown): Error {\n  if (error instanceof PolicyAuthoringError) {\n    return error;\n  }\n  if (\n    error instanceof SignedObjectSchemaError ||\n    error instanceof SignedObjectProfileError\n  ) {\n    return new PolicyAuthoringError(\n      \"policy-authoring-malformed\",\n      error.message,\n    );\n  }\n  return new PolicyAuthoringError(\n    \"policy-authoring-malformed\",\n    error instanceof Error ? error.message : String(error),\n  );\n}\n\nfunction parseStrictRfc3339(value: string, path: string): number {\n  const match = value.match(\n    /^(\\d{4})-(\\d{2})-(\\d{2})T(\\d{2}):(\\d{2}):(\\d{2})(\\.\\d+)?Z$/,\n  );\n  if (!match) {\n    throw new PolicyAuthoringError(\n      \"policy-engine-record-date-invalid\",\n      `${path} must be strict RFC 3339`,\n    );\n  }\n  const parsed = Date.parse(value);\n  if (Number.isNaN(parsed)) {\n    throw new PolicyAuthoringError(\n      \"policy-engine-record-date-invalid\",\n      `${path} must be parseable`,\n    );\n  }\n  const canonical = new Date(parsed).toISOString().replace(\".000Z\", \"Z\");\n  if (canonical !== value) {\n    throw new PolicyAuthoringError(\n      \"policy-engine-record-date-invalid\",\n      `${path} must be normalizable`,\n    );\n  }\n  return parsed;\n}\n\nconst objectHasOwn: (object: object, propertyKey: PropertyKey) => boolean =\n  (\n    Object as ObjectConstructor & {\n      hasOwn?: (object: object, propertyKey: PropertyKey) => boolean;\n    }\n  ).hasOwn ??\n  (Object.prototype.hasOwnProperty.call.bind(\n    Object.prototype.hasOwnProperty,\n  ) as (object: object, propertyKey: PropertyKey) => boolean);\n\nfunction hasOwn(object: JsonObject, key: string): boolean {\n  return objectHasOwn(object, key);\n}\n"],"mappings":";;;;;;;;;;;;;;;;;;;;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,IAAAA,eAAmC;AACnC,oBAAuB;AACvB,iBAAoB;AACpB,oBAAuC;AAOvC,iBAAkB;;;ACAX,IAAM,2BAAN,cAAuC,MAAM;AAAA,EAGlD,YAAY,MAA6B,SAAiB;AACxD,UAAM,OAAO;AACb,SAAK,OAAO;AACZ,SAAK,OAAO;AAAA,EACd;AACF;AAEO,IAAM,0BAAN,cAAsC,yBAAyB;AAAA,EACpE,YAAY,SAAiB;AAC3B,UAAM,kBAAkB,OAAO;AAC/B,SAAK,OAAO;AAAA,EACd;AACF;AAEO,IAAM,oCAAN,cAAgD,yBAAyB;AAAA,EAC9E,YAAY,SAAiB;AAC3B,UAAM,6BAA6B,OAAO;AAC1C,SAAK,OAAO;AAAA,EACd;AACF;AAEO,IAAM,0BAAN,cAAsC,yBAAyB;AAAA,EACpE,YAAY,SAAiB;AAC3B,UAAM,mBAAmB,OAAO;AAChC,SAAK,OAAO;AAAA,EACd;AACF;AAEO,IAAM,sBAAN,cAAkC,yBAAyB;AAAA,EAChE,YAAY,SAAiB;AAC3B,UAAM,eAAe,OAAO;AAC5B,SAAK,OAAO;AAAA,EACd;AACF;AAEO,IAAM,yBAAN,cAAqC,yBAAyB;AAAA,EACnE,YAAY,SAAiB;AAC3B,UAAM,uBAAuB,OAAO;AACpC,SAAK,OAAO;AAAA,EACd;AACF;AAEO,IAAM,yBAAN,cAAqC,yBAAyB;AAAA,EACnE,YAAY,SAAiB;AAC3B,UAAM,8BAA8B,OAAO;AAC3C,SAAK,OAAO;AAAA,EACd;AACF;AAEO,IAAM,iCAAN,cAA6C,yBAAyB;AAAA,EAC3E,YAAY,SAAiB;AAC3B,UAAM,+BAA+B,OAAO;AAC5C,SAAK,OAAO;AAAA,EACd;AACF;AAEO,IAAM,6BAAN,cAAyC,yBAAyB;AAAA,EACvE,YAAY,SAAiB;AAC3B,UAAM,qBAAqB,OAAO;AAClC,SAAK,OAAO;AAAA,EACd;AACF;;;AC/DA,IAAM,eACH,OAEE,UACF,OAAO,UAAU,eAAe,KAAK;AAAA,EACpC,OAAO,UAAU;AACnB;AAUK,SAAS,gBAAgB,OAAwB;AACtD,SAAO,UAAU,cAAc,OAAO,GAAG,CAAC;AAC5C;AAEO,SAAS,cAAc,OAAgB,OAAO,KAAgB;AACnE,MAAI,UAAU,MAAM;AAClB,WAAO;AAAA,EACT;AAEA,UAAQ,OAAO,OAAO;AAAA,IACpB,KAAK;AACH,aAAO;AAAA,IACT,KAAK;AACH,UAAI,CAAC,OAAO,SAAS,KAAK,GAAG;AAC3B,cAAM,IAAI;AAAA,UACR,GAAG,IAAI;AAAA,QACT;AAAA,MACF;AACA,aAAO;AAAA,IACT,KAAK;AACH,gCAA0B,OAAO,IAAI;AACrC,aAAO;AAAA,IACT,KAAK;AACH,aAAO,2BAA2B,OAAO,IAAI;AAAA,IAC/C,KAAK;AAAA,IACL,KAAK;AAAA,IACL,KAAK;AAAA,IACL,KAAK;AAAA,IACL;AACE,YAAM,IAAI;AAAA,QACR,GAAG,IAAI;AAAA,MACT;AAAA,EACJ;AACF;AAEO,SAAS,UAAU,OAA0B;AAClD,MAAI,UAAU,MAAM;AAClB,WAAO;AAAA,EACT;AAEA,UAAQ,OAAO,OAAO;AAAA,IACpB,KAAK;AACH,aAAO,QAAQ,SAAS;AAAA,IAC1B,KAAK,UAAU;AACb,YAAM,UAAU,KAAK,UAAU,KAAK;AACpC,UAAI,YAAY,QAAW;AACzB,cAAM,IAAI;AAAA,UACR;AAAA,QACF;AAAA,MACF;AACA,aAAO;AAAA,IACT;AAAA,IACA,KAAK;AACH,aAAO,KAAK,UAAU,KAAK;AAAA,IAC7B,KAAK;AACH,UAAI,MAAM,QAAQ,KAAK,GAAG;AACxB,eAAO,IAAI,MAAM,IAAI,CAAC,SAAS,UAAU,IAAI,CAAC,EAAE,KAAK,GAAG,CAAC;AAAA,MAC3D;AACA,aAAO,gBAAgB,KAAK;AAAA,IAC9B;AACE,YAAM,IAAI;AAAA,QACR,+BAA+B,OAAO,KAAK;AAAA,MAC7C;AAAA,EACJ;AACF;AAEA,SAAS,2BAA2B,OAAe,MAAyB;AAC1E,qBAAmB,OAAO,IAAI;AAE9B,MAAI,MAAM,QAAQ,KAAK,GAAG;AACxB,eAAW,OAAO,OAAO,oBAAoB,KAAK,GAAG;AACnD,UAAI,QAAQ,UAAU;AACpB;AAAA,MACF;AACA,UAAI,CAAC,gBAAgB,KAAK,MAAM,MAAM,GAAG;AACvC,cAAM,IAAI;AAAA,UACR,GAAG,IAAI,IAAI,GAAG;AAAA,QAChB;AAAA,MACF;AACA,YAAM,aAAa,OAAO,yBAAyB,OAAO,GAAG;AAC7D,UAAI,YAAY,eAAe,MAAM;AACnC,cAAM,IAAI;AAAA,UACR,GAAG,IAAI,IAAI,GAAG;AAAA,QAChB;AAAA,MACF;AACA,UAAI,EAAE,WAAW,aAAa;AAC5B,cAAM,IAAI;AAAA,UACR,GAAG,IAAI,IAAI,GAAG;AAAA,QAChB;AAAA,MACF;AAAA,IACF;AACA,UAAMC,UAAsB,CAAC;AAC7B,aAAS,QAAQ,GAAG,QAAQ,MAAM,QAAQ,SAAS;AACjD,UAAI,CAAC,aAAa,OAAO,KAAK,GAAG;AAC/B,cAAM,IAAI;AAAA,UACR,GAAG,IAAI,IAAI,KAAK;AAAA,QAClB;AAAA,MACF;AACA,MAAAA,QAAO,KAAK,cAAc,MAAM,KAAK,GAAG,GAAG,IAAI,IAAI,KAAK,GAAG,CAAC;AAAA,IAC9D;AACA,WAAOA;AAAA,EACT;AAEA,QAAM,QAAQ,OAAO,eAAe,KAAK;AACzC,MAAI,UAAU,OAAO,aAAa,UAAU,MAAM;AAChD,UAAM,IAAI;AAAA,MACR,GAAG,IAAI;AAAA,IACT;AAAA,EACF;AAEA,QAAM,SAAS,uBAAO,OAAO,IAAI;AACjC,aAAW,OAAO,OAAO,oBAAoB,KAAK,GAAG;AACnD,8BAA0B,KAAK,GAAG,IAAI,MAAM;AAC5C,QAAI,QAAQ,eAAe,QAAQ,eAAe;AAChD,YAAM,IAAI;AAAA,QACR,GAAG,IAAI,IAAI,GAAG;AAAA,MAChB;AAAA,IACF;AACA,UAAM,aAAa,OAAO,yBAAyB,OAAO,GAAG;AAC7D,QAAI,YAAY,eAAe,MAAM;AACnC,YAAM,IAAI;AAAA,QACR,GAAG,IAAI,IAAI,GAAG;AAAA,MAChB;AAAA,IACF;AACA,QAAI,EAAE,WAAW,aAAa;AAC5B,YAAM,IAAI;AAAA,QACR,GAAG,IAAI,IAAI,GAAG;AAAA,MAChB;AAAA,IACF;AACA,UAAM,QAAQ,WAAW;AACzB,WAAO,GAAG,IAAI,cAAc,OAAO,GAAG,IAAI,IAAI,GAAG,EAAE;AAAA,EACrD;AACA,SAAO;AACT;AAEA,SAAS,mBAAmB,OAAe,MAAoB;AAC7D,MAAI,OAAO,sBAAsB,KAAK,EAAE,SAAS,GAAG;AAClD,UAAM,IAAI;AAAA,MACR,GAAG,IAAI;AAAA,IACT;AAAA,EACF;AACF;AAEA,SAAS,gBAAgB,KAAa,QAAyB;AAC7D,MAAI,CAAC,iBAAiB,KAAK,GAAG,GAAG;AAC/B,WAAO;AAAA,EACT;AACA,QAAM,QAAQ,OAAO,GAAG;AACxB,SAAO,OAAO,cAAc,KAAK,KAAK,SAAS,KAAK,QAAQ;AAC9D;AAEA,SAAS,gBAAgB,OAAsD;AAC7E,QAAM,OAAO,OAAO,KAAK,KAAK,EAAE,KAAK,iBAAiB;AACtD,QAAM,QAAQ,KAAK,IAAI,CAAC,QAAQ,GAAG,KAAK,UAAU,GAAG,CAAC,IAAI,UAAU,MAAM,GAAG,CAAC,CAAC,EAAE;AACjF,SAAO,IAAI,MAAM,KAAK,GAAG,CAAC;AAC5B;AAEA,SAAS,kBAAkB,GAAW,GAAmB;AACvD,QAAM,OAAO,MAAM,KAAK,CAAC;AACzB,QAAM,QAAQ,MAAM,KAAK,CAAC;AAC1B,QAAM,MAAM,KAAK,IAAI,KAAK,QAAQ,MAAM,MAAM;AAC9C,WAAS,QAAQ,GAAG,QAAQ,KAAK,SAAS;AACxC,UAAM,YAAY,KAAK,KAAK,EAAE,YAAY,CAAC,KAAK;AAChD,UAAM,aAAa,MAAM,KAAK,EAAE,YAAY,CAAC,KAAK;AAClD,QAAI,cAAc,YAAY;AAC5B,aAAO,YAAY;AAAA,IACrB;AAAA,EACF;AACA,SAAO,KAAK,SAAS,MAAM;AAC7B;AAEA,SAAS,0BAA0B,OAAe,MAAoB;AACpE,WAAS,QAAQ,GAAG,QAAQ,MAAM,QAAQ,SAAS;AACjD,UAAM,OAAO,MAAM,WAAW,KAAK;AACnC,QAAI,QAAQ,SAAU,QAAQ,OAAQ;AACpC,YAAM,OAAO,MAAM,WAAW,QAAQ,CAAC;AACvC,UAAI,OAAO,MAAM,IAAI,KAAK,OAAO,SAAU,OAAO,OAAQ;AACxD,cAAM,IAAI;AAAA,UACR,GAAG,IAAI;AAAA,QACT;AAAA,MACF;AACA;AACA;AAAA,IACF;AACA,QAAI,QAAQ,SAAU,QAAQ,OAAQ;AACpC,YAAM,IAAI;AAAA,QACR,GAAG,IAAI;AAAA,MACT;AAAA,IACF;AAAA,EACF;AACF;;;ACzNA,uBAAoC;AACpC,kBAAmC;AAInC,IAAM,cAAc,IAAI,YAAY;AAY7B,IAAM,wBAAN,cAAoC,MAAM;AAAA,EAG/C,YAAY,MAAiC,SAAiB;AAC5D,UAAM,OAAO;AACb,SAAK,OAAO;AACZ,SAAK,OAAO;AAAA,EACd;AACF;AAiBA,IAAMC,gBACH,OAEE,UACF,OAAO,UAAU,eAAe,KAAK;AAAA,EACpC,OAAO,UAAU;AACnB;AAEF,IAAM,mBAAmB,oBAAI,IAAI,CAAC,gBAAgB,iBAAiB,eAAe,CAAC;AACnF,IAAM,oBAAoB,oBAAI,IAAiC;AAE/D,WAAW,SAAS,sCAAqB;AACvC,MAAI,CAAC,iBAAiB,IAAI,MAAM,OAAO,GAAG;AACxC;AAAA,EACF;AACA,MAAI,MAAM,YAAY,UAAa,MAAM,YAAY,UAAa,MAAM,IAAI,SAAS,IAAI,GAAG;AAC1F;AAAA,EACF;AACA,QAAM,WAAW,kBAAkB,IAAI,MAAM,OAAO;AACpD,MAAI,aAAa,QAAW;AAC1B,sBAAkB,IAAI,MAAM,SAAS,oBAAI,IAAI,CAAC,MAAM,GAAG,CAAC,CAAC;AACzD;AAAA,EACF;AACA,EAAC,SAAyB,IAAI,MAAM,GAAG;AACzC;AAOO,SAAS,0BAA0B,OAAkC;AAC1E,SAAO,qCAAqC,OAAO,EAAE,kBAAkB,KAAK,CAAC;AAC/E;AAOO,SAAS,6BAA6B,OAAkC;AAC7E,SAAO,qCAAqC,OAAO,EAAE,kBAAkB,KAAK,CAAC;AAC/E;AAYO,SAAS,yBAAyB,WAAoB,SAA2B;AACtF,MAAI;AACJ,MAAI;AACJ,MAAI;AACF,WAAO,6BAA6B,SAAS;AAC7C,UAAM,6BAA6B,OAAO;AAAA,EAC5C,QAAQ;AACN,WAAO;AAAA,EACT;AACA,MAAI,KAAK,YAAY,IAAI,WAAW,KAAK,UAAU,IAAI,OAAO;AAC5D,WAAO;AAAA,EACT;AACA,MAAI,CAAC,aAAa,KAAK,MAAM,IAAI,IAAI,GAAG;AACtC,WAAO;AAAA,EACT;AACA,QAAM,cAAc,IAAI,IAAI,KAAK,OAAO;AACxC,aAAW,UAAU,IAAI,SAAS;AAChC,QAAI,CAAC,YAAY,IAAI,MAAM,GAAG;AAC5B,aAAO;AAAA,IACT;AAAA,EACF;AACA,SAAO,eAAe,KAAK,SAAS,IAAI,OAAO;AACjD;AAEA,SAAS,qCACP,OACA,SACkB;AAClB,QAAM,SAAS,aAAa,OAAO,GAAG;AACtC,kBAAgB,QAAQ,CAAC,WAAW,SAAS,QAAQ,WAAW,SAAS,GAAG,GAAG;AAC/E,QAAM,UAAU,eAAe,QAAQ,WAAW,KAAK,qCAAqC;AAC5F,MAAI,CAAC,iBAAiB,IAAI,OAAO,GAAG;AAClC,UAAM,IAAI;AAAA,MACR;AAAA,MACA;AAAA,IACF;AAAA,EACF;AACA,QAAM,QAAQ,eAAe,QAAQ,SAAS,KAAK,mCAAmC;AACtF,wBAAsB,KAAK;AAC3B,QAAM,iBAAiB,MAAM,UAAU,KAAK;AAC5C,MAAI,QAAQ,oBAAoB,mBAAmB,OAAO;AACxD,UAAM,IAAI;AAAA,MACR;AAAA,MACA;AAAA,IACF;AAAA,EACF;AACA,QAAM,UAAU,eAAe,QAAQ,QAAQ,KAAK,kCAAkC;AACtF,kBAAgB,SAAS,OAAO;AAChC,QAAM,OAAO,cAAc,OAAO;AAClC,MAAI,QAAQ,oBAAoB,SAAS,SAAS;AAChD,UAAM,IAAI;AAAA,MACR;AAAA,MACA;AAAA,IACF;AAAA,EACF;AACA,kBAAgB,MAAM,OAAO;AAC7B,QAAM,UAAU;AAAA,IACd,cAAc,QAAQ,WAAW,KAAK,oCAAoC;AAAA,IAC1E;AAAA,IACA;AAAA,EACF;AACA,QAAM,SAAS,uBAAO,OAAO,IAAI;AAOjC,SAAO,UAAU;AACjB,SAAO,QAAQ;AACf,SAAO,OAAO;AACd,SAAO,UAAU;AACjB,MAAI,OAAO,QAAQ,SAAS,GAAG;AAC7B,WAAO,UAAU;AAAA,MACf,cAAc,QAAQ,WAAW,KAAK,qCAAqC;AAAA,MAC3E,OAAO;AAAA,IACT;AAAA,EACF;AACA,SAAO;AACT;AAEA,SAAS,aAAa,OAAgB,MAA0B;AAC9D,MAAI;AACF,UAAM,aAAa,cAAc,KAAK;AACtC,QAAI,eAAe,QAAQ,OAAO,eAAe,YAAY,MAAM,QAAQ,UAAU,GAAG;AACtF,YAAM,IAAI,sBAAsB,+BAA+B,GAAG,IAAI,oBAAoB;AAAA,IAC5F;AACA,WAAO;AAAA,EACT,SAAS,OAAO;AACd,QAAI,iBAAiB,uBAAuB;AAC1C,YAAM;AAAA,IACR;AACA,UAAM,IAAI;AAAA,MACR;AAAA,MACA,iBAAiB,QAAQ,MAAM,UAAU,OAAO,KAAK;AAAA,IACvD;AAAA,EACF;AACF;AAEA,SAAS,gBAAgB,QAAoB,SAA4B,MAAoB;AAC3F,QAAM,aAAa,IAAI,IAAI,OAAO;AAClC,aAAW,OAAO,OAAO,KAAK,MAAM,GAAG;AACrC,QAAI,CAAC,WAAW,IAAI,GAAG,GAAG;AACxB,YAAM,IAAI;AAAA,QACR,QAAQ,QAAQ,QAAQ,UAAU,gCAAgC;AAAA,QAClE,GAAG,IAAI,sBAAsB,GAAG;AAAA,MAClC;AAAA,IACF;AAAA,EACF;AACF;AAEA,SAAS,cACP,QACA,KACA,MACA,MACW;AACX,MAAI,CAAC,OAAO,QAAQ,GAAG,GAAG;AACxB,UAAM,IAAI,sBAAsB,MAAM,GAAG,IAAI,IAAI,GAAG,cAAc;AAAA,EACpE;AACA,SAAO,OAAO,GAAG;AACnB;AAEA,SAAS,eACP,QACA,KACA,MACA,MACQ;AACR,QAAM,QAAQ,cAAc,QAAQ,KAAK,MAAM,IAAI;AACnD,MAAI,OAAO,UAAU,YAAY,MAAM,WAAW,GAAG;AACnD,UAAM,IAAI,sBAAsB,MAAM,GAAG,IAAI,IAAI,GAAG,6BAA6B;AAAA,EACnF;AACA,SAAO;AACT;AAEA,SAAS,cACP,QACA,KACA,MACA,MACsB;AACtB,QAAM,QAAQ,cAAc,QAAQ,KAAK,MAAM,IAAI;AACnD,MAAI,CAAC,MAAM,QAAQ,KAAK,GAAG;AACzB,UAAM,IAAI,sBAAsB,MAAM,GAAG,IAAI,IAAI,GAAG,mBAAmB;AAAA,EACzE;AACA,SAAO;AACT;AAEA,SAAS,sBAAsB,OAAqB;AAClD,MAAI,UAAU,OAAO,MAAM,SAAS,GAAG,KAAK,MAAM,SAAS,GAAG,KAAK,MAAM,SAAS,GAAG,GAAG;AACtF,UAAM,IAAI;AAAA,MACR;AAAA,MACA;AAAA,IACF;AAAA,EACF;AACF;AAEA,SAAS,gBAAgB,MAAc,SAAiC;AACtE,MAAI,KAAK,WAAW,GAAG;AACrB,UAAM,IAAI,sBAAsB,oCAAoC,iBAAiB;AAAA,EACvF;AACA,MAAI,CAAC,QAAQ,oBAAoB,KAAK,SAAS,GAAG,GAAG;AACnD,UAAM,IAAI;AAAA,MACR;AAAA,MACA;AAAA,IACF;AAAA,EACF;AACA,MAAI,KAAK,SAAS,IAAI,KAAK,KAAK,SAAS,IAAI,GAAG;AAC9C,UAAM,IAAI,sBAAsB,oCAAoC,yBAAyB;AAAA,EAC/F;AACA,QAAM,WAAW,KAAK,MAAM,GAAG;AAC/B,WAAS,QAAQ,GAAG,QAAQ,SAAS,QAAQ,SAAS;AACpD,UAAM,UAAU,SAAS,KAAK;AAC9B,UAAM,0BACJ,QAAQ,oBAAoB,UAAU,SAAS,SAAS,KAAK,QAAQ,WAAW;AAClF,QAAI,QAAQ,WAAW,KAAK,CAAC,yBAAyB;AACpD,YAAM,IAAI,sBAAsB,oCAAoC,6BAA6B;AAAA,IACnG;AACA,QAAI,YAAY,OAAO,YAAY,MAAM;AACvC,YAAM,IAAI;AAAA,QACR;AAAA,QACA;AAAA,MACF;AAAA,IACF;AACA,QAAI,YAAY,OAAO,YAAY,OAAO,QAAQ,SAAS,GAAG,KAAK,QAAQ,SAAS,GAAG,GAAG;AACxF,YAAM,IAAI;AAAA,QACR;AAAA,QACA;AAAA,MACF;AAAA,IACF;AAAA,EACF;AACF;AAEA,SAAS,cAAc,MAAsB;AAC3C,SAAO,iBAAiB,IAAI,EAAE,UAAU,KAAK;AAC/C;AAEA,SAAS,iBAAiB,MAAsB;AAC9C,SAAO,KAAK,QAAQ,oBAAoB,CAAC,YAAY;AACnD,UAAM,OAAO,OAAO,aAAa,OAAO,SAAS,QAAQ,MAAM,CAAC,GAAG,EAAE,CAAC;AACtE,WAAO,oBAAoB,KAAK,IAAI,IAAI,OAAO,QAAQ,YAAY;AAAA,EACrE,CAAC;AACH;AAEA,SAAS,iBACP,SACA,SACA,SACU;AACV,QAAM,WAAW,kBAAkB,IAAI,OAAO;AAC9C,MAAI,aAAa,QAAW;AAC1B,UAAM,IAAI;AAAA,MACR;AAAA,MACA;AAAA,IACF;AAAA,EACF;AACA,QAAM,SAAS,oBAAI,IAAY;AAC/B,QAAM,aAAuB,CAAC;AAC9B,WAAS,QAAQ,GAAG,QAAQ,QAAQ,QAAQ,SAAS;AACnD,UAAM,SAAS,QAAQ,KAAK;AAC5B,QAAI,OAAO,WAAW,YAAY,OAAO,WAAW,GAAG;AACrD,YAAM,IAAI;AAAA,QACR;AAAA,QACA,aAAa,KAAK;AAAA,MACpB;AAAA,IACF;AACA,QAAI,CAAC,OAAO,WAAW,GAAG,OAAO,GAAG,KAAK,OAAO,SAAS,GAAG,KAAK,CAAC,SAAS,IAAI,MAAM,GAAG;AACtF,YAAM,IAAI;AAAA,QACR;AAAA,QACA,aAAa,KAAK;AAAA,MACpB;AAAA,IACF;AACA,eAAW,KAAK,MAAM;AACtB,WAAO,IAAI,MAAM;AAAA,EACnB;AACA,MAAI,OAAO,SAAS,GAAG;AACrB,UAAM,IAAI;AAAA,MACR;AAAA,MACA;AAAA,IACF;AAAA,EACF;AACA,QAAM,oBAAoB,CAAC,GAAG,MAAM,EAAE,KAAK;AAC3C,MACE,QAAQ,qBACP,WAAW,WAAW,kBAAkB,UACvC,WAAW,KAAK,CAAC,QAAQ,UAAU,WAAW,kBAAkB,KAAK,CAAC,IACxE;AACA,UAAM,IAAI;AAAA,MACR;AAAA,MACA;AAAA,IACF;AAAA,EACF;AACA,SAAO;AACT;AAEA,SAAS,gBAAgB,OAAkB,SAAkD;AAC3F,MAAI,UAAU,QAAQ,OAAO,UAAU,YAAY,MAAM,QAAQ,KAAK,GAAG;AACvE,UAAM,IAAI;AAAA,MACR;AAAA,MACA;AAAA,IACF;AAAA,EACF;AACA,MAAI,YAAY,iBAAiB;AAC/B,WAAO,mBAAmB,KAAmB;AAAA,EAC/C;AACA,QAAM,IAAI;AAAA,IACR;AAAA,IACA;AAAA,EACF;AACF;AAEA,SAAS,mBAAmB,OAA+B;AACzD,mBAAiB,OAAO,CAAC,QAAQ,YAAY,YAAY,GAAG,WAAW;AACvE,QAAM,OAAO,aAAa,OAAO,QAAQ,WAAW;AACpD,MAAI,SAAS,0BAA0B;AACrC,UAAM,IAAI;AAAA,MACR;AAAA,MACA;AAAA,IACF;AAAA,EACF;AACA,MAAI,eAAe,OAAO,YAAY,WAAW,MAAM,MAAM;AAC3D,UAAM,IAAI;AAAA,MACR;AAAA,MACA;AAAA,IACF;AAAA,EACF;AACA,QAAM,aAAa,eAAe,OAAO,cAAc,WAAW;AAClE,MAAI,CAAC,MAAM,QAAQ,UAAU,KAAK,WAAW,WAAW,GAAG;AACzD,UAAM,IAAI;AAAA,MACR;AAAA,MACA;AAAA,IACF;AAAA,EACF;AACA,WAAS,QAAQ,GAAG,QAAQ,WAAW,QAAQ,SAAS;AACtD,yBAAqB,WAAW,KAAK,GAAG,wBAAwB,KAAK,GAAG;AAAA,EAC1E;AACA,SAAO;AACT;AAEA,SAAS,qBAAqB,OAAkB,MAAoB;AAClE,MAAI,UAAU,QAAQ,OAAO,UAAU,YAAY,MAAM,QAAQ,KAAK,GAAG;AACvE,UAAM,IAAI,sBAAsB,uCAAuC,GAAG,IAAI,oBAAoB;AAAA,EACpG;AACA,QAAM,SAAS;AACf,mBAAiB,QAAQ,CAAC,QAAQ,OAAO,aAAa,GAAG,IAAI;AAC7D,eAAa,QAAQ,QAAQ,IAAI;AACjC,eAAa,QAAQ,OAAO,IAAI;AAChC,QAAM,cAAc,eAAe,QAAQ,eAAe,IAAI;AAC9D,MAAI,CAAC,MAAM,QAAQ,WAAW,GAAG;AAC/B,UAAM,IAAI;AAAA,MACR;AAAA,MACA,GAAG,IAAI;AAAA,IACT;AAAA,EACF;AACA,WAAS,QAAQ,GAAG,QAAQ,YAAY,QAAQ,SAAS;AACvD,uBAAmB,YAAY,KAAK,GAAG,GAAG,IAAI,gBAAgB,KAAK,GAAG;AAAA,EACxE;AACF;AAEA,SAAS,mBAAmB,OAAkB,MAAoB;AAChE,MAAI,UAAU,QAAQ,OAAO,UAAU,YAAY,MAAM,QAAQ,KAAK,GAAG;AACvE,UAAM,IAAI,sBAAsB,uCAAuC,GAAG,IAAI,oBAAoB;AAAA,EACpG;AACA,QAAM,SAAS;AACf,mBAAiB,QAAQ,CAAC,SAAS,OAAO,GAAG,IAAI;AACjD,QAAM,QAAQ,eAAe,QAAQ,SAAS,IAAI;AAClD,MAAI,OAAO,UAAU,YAAY,CAAC,OAAO,cAAc,KAAK,KAAK,QAAQ,GAAG;AAC1E,UAAM,IAAI;AAAA,MACR;AAAA,MACA,GAAG,IAAI;AAAA,IACT;AAAA,EACF;AACA,iBAAe,QAAQ,SAAS,IAAI;AACtC;AAEA,SAAS,iBAAiB,QAAoB,SAA4B,MAAoB;AAC5F,QAAM,aAAa,IAAI,IAAI,OAAO;AAClC,aAAW,OAAO,OAAO,KAAK,MAAM,GAAG;AACrC,QAAI,CAAC,WAAW,IAAI,GAAG,GAAG;AACxB,YAAM,IAAI;AAAA,QACR;AAAA,QACA,GAAG,IAAI,sBAAsB,GAAG;AAAA,MAClC;AAAA,IACF;AAAA,EACF;AACF;AAEA,SAAS,eAAe,QAAoB,KAAa,MAAyB;AAChF,MAAI,CAAC,OAAO,QAAQ,GAAG,GAAG;AACxB,UAAM,IAAI;AAAA,MACR;AAAA,MACA,GAAG,IAAI,IAAI,GAAG;AAAA,IAChB;AAAA,EACF;AACA,SAAO,OAAO,GAAG;AACnB;AAEA,SAAS,aAAa,QAAoB,KAAa,MAAsB;AAC3E,QAAM,QAAQ,eAAe,QAAQ,KAAK,IAAI;AAC9C,MAAI,OAAO,UAAU,YAAY,MAAM,WAAW,GAAG;AACnD,UAAM,IAAI;AAAA,MACR;AAAA,MACA,GAAG,IAAI,IAAI,GAAG;AAAA,IAChB;AAAA,EACF;AACA,SAAO;AACT;AAEA,SAAS,aAAa,WAAmB,SAA0B;AACjE,MAAI,cAAc,SAAS;AACzB,WAAO;AAAA,EACT;AACA,SAAO,UAAU,SAAS,GAAG,KAAK,QAAQ,WAAW,SAAS;AAChE;AAEA,SAAS,eAAe,WAAmC,SAA0C;AACnG,MAAI,cAAc,QAAW;AAC3B,WAAO,YAAY;AAAA,EACrB;AACA,MAAI,YAAY,QAAW;AACzB,WAAO,OAAO,KAAK,SAAS,EAAE,WAAW;AAAA,EAC3C;AACA,MAAI,UAAU,SAAS,4BAA4B,QAAQ,SAAS,0BAA0B;AAC5F,WAAO;AAAA,EACT;AACA,QAAM,sBAAsB,MAAM,QAAQ,UAAU,UAAU,IAAI,UAAU,aAAa,CAAC;AAC1F,QAAM,oBAAoB,MAAM,QAAQ,QAAQ,UAAU,IAAI,QAAQ,aAAa,CAAC;AACpF,SAAO,kBAAkB;AAAA,IAAM,CAAC,cAC9B,oBAAoB,KAAK,CAAC,cAAc,gBAAgB,SAAS,MAAM,gBAAgB,SAAS,CAAC;AAAA,EACnG;AACF;AAEA,SAAS,OAAO,QAAoB,KAAsB;AACxD,SAAOC,cAAa,QAAQ,GAAG;AACjC;;;AC3eA,qBAAwB;AACxB,oBAAsB;AACtB,IAAAC,eAAkD;;;ACFlD,IAAAC,eAAsC;AAmB/B,IAAM,qBAAN,cAAiC,MAAM;AAAA,EAC5C,YAAY,SAAiB;AAC3B,UAAM,OAAO;AACb,SAAK,OAAO;AAAA,EACd;AACF;AAEA,IAAM,aAAa;AAcnB,SAAS,mBAAmB,SAAuB;AACjD,MAAI,CAAC,OAAO,cAAc,OAAO,KAAK,WAAW,GAAG;AAClD,UAAM,IAAI,mBAAmB,6BAA6B,OAAO,EAAE;AAAA,EACrE;AACF;AAEO,SAAS,aAAa,OAAwB;AACnD,aAAO,wBAAU,OAAO,EAAE,QAAQ,MAAM,CAAC;AAC3C;AAEO,SAAS,oBAAoB,SAAmC;AACrE,MAAI,CAAC,aAAa,OAAO,GAAG;AAC1B,UAAM,IAAI,mBAAmB,wBAAwB,OAAO,EAAE;AAAA,EAChE;AACA,aAAO,yBAAW,OAAO;AAC3B;AAWO,SAAS,YAAY,KAAiC;AAC3D,QAAM,QAAQ,IAAI,MAAM,UAAU;AAClC,MAAI,CAAC,MAAO,QAAO;AAEnB,QAAM,UAAU,OAAO,MAAM,CAAC,CAAC;AAC/B,qBAAmB,OAAO;AAE1B,SAAO;AAAA,IACL,QAAQ;AAAA,IACR,WAAW;AAAA,IACX;AAAA,IACA,SAAS,oBAAoB,MAAM,CAAC,CAAC;AAAA,EACvC;AACF;;;AD7DO,IAAM,gBAAgB;AACtB,IAAM,uBAAuB;AAC7B,IAAM,8BACX;AAEK,IAAM,8BAA8B;AACpC,IAAM,6BACX;AA0GF,IAAM,cAA0D;AAAA,EAC9D,QAAQ;AAAA,IACN,MAAM;AAAA,IACN,QAAQ;AAAA,IACR,SAAS;AAAA,IACT,UAAU;AAAA,IACV,QAAQ;AAAA,EACV;AAAA,EACA,cAAc;AAAA,IACZ,MAAM;AAAA,IACN,QAAQ;AAAA,IACR,SAAS;AAAA,IACT,UAAU;AAAA,IACV,QAAQ;AAAA,EACV;AAAA,EACA,oBAAoB;AAAA,IAClB,MAAM;AAAA,IACN,QAAQ;AAAA,IACR,SAAS;AAAA,IACT,UAAU;AAAA,IACV,QAAQ;AAAA,EACV;AACF;AAEA,IAAMC,eAAc,IAAI,YAAY;AACpC,IAAM,kBAAkB;AACxB,IAAM,eAAe;AACrB,IAAMC,gBACH,OAEE,UACF,OAAO,UAAU,eAAe,KAAK;AAAA,EACpC,OAAO,UAAU;AACnB;AA2EF,eAAsB,mBACpB,OACyE;AACzE,QAAM,SAAS,0BAA0B,KAAK;AAC9C,QAAM,aAAa;AACnB,QAAM,aAAa,oBAAoB,OAAO,MAAM;AACpD,QAAM,YAAY,kBAAkB,OAAO,SAAS;AACpD,mCAAiC,YAAY,SAAS;AACtD,QAAM,WAAW,uBAAuB,YAAY,UAAU;AAC9D,QAAM,WAAW,oBAAoB,UAAU,UAAU;AACzD,kBAAgB,YAAY,UAAU,UAAU;AAChD,MAAI,CAAE,MAAM,gBAAgB,WAAW,SAAS,MAAM,GAAI;AACxD,UAAM,IAAI,2BAA2B,+BAA+B;AAAA,EACtE;AACA,SAAO,EAAE,QAAQ,QAAQ,SAAS;AACpC;AAsBA,eAAsB,yBACpB,OACyE;AACzE,QAAM,SAAS,MAAM,mBAAmB,KAAK;AAC7C,SAAO;AAAA,IACL,QAAQ,sCAAsC,OAAO,MAAM;AAAA,IAC3D,UAAU,OAAO;AAAA,EACnB;AACF;AAiDO,SAAS,0BAA0B,OAAwB;AAChE,SAAO,oBAAoB,OAAO,IAAI;AACxC;AAEO,SAAS,gCAAgC,OAA8B;AAC5E,SAAO,0BAA0B,OAAO,IAAI;AAC9C;AAEO,SAAS,sCACd,OACoB;AACpB,SAAO,gCAAgC,OAAO,IAAI;AACpD;AAEA,SAAS,0BAA0B,OAAoC;AACrE,QAAM,aAAa,iBAAiB,cAAc,KAAK,GAAG,GAAG;AAC7D,QAAM,SAASC,gBAAe,YAAY,UAAU,GAAG;AACvD,QAAM,aAAa,oBAAoB,MAAM;AAC7C,UAAQ,WAAW,MAAM;AAAA,IACvB,KAAK;AACH,aAAO,0BAA0B,UAAU;AAAA,IAC7C,KAAK;AACH,aAAO,gCAAgC,UAAU;AAAA,IACnD,KAAK;AACH,aAAO,sCAAsC,UAAU;AAAA,EAC3D;AACF;AAgBA,SAAS,oBAAoB,OAAgB,QAA6B;AACxE,QAAM,SAAS,iBAAiB,cAAc,KAAK,GAAG,GAAG;AACzD,EAAAC;AAAA,IACE;AAAA,IACA,SACI;AAAA,MACE;AAAA,MACA;AAAA,MACA;AAAA,MACA;AAAA,MACA;AAAA,MACA;AAAA,MACA;AAAA,MACA;AAAA,MACA;AAAA,MACA;AAAA,MACA;AAAA,MACA;AAAA,IACF,IACA;AAAA,MACE;AAAA,MACA;AAAA,MACA;AAAA,MACA;AAAA,MACA;AAAA,MACA;AAAA,MACA;AAAA,MACA;AAAA,MACA;AAAA,MACA;AAAA,IACF;AAAA,IACJ;AAAA,EACF;AACA,cAAYC,gBAAe,QAAQ,UAAU,GAAG,GAAG,eAAe,UAAU;AAC5E,MAAI,QAAQ;AACV,IAAAA,gBAAe,QAAQ,YAAY,GAAG;AACtC,sBAAkBC,eAAc,QAAQ,aAAa,GAAG,CAAC;AAAA,EAC3D;AACA,EAAAD,gBAAe,QAAQ,YAAY,GAAG;AACtC,EAAAA,gBAAe,QAAQ,iBAAiB,GAAG;AAC3C,qBAAmB,QAAQ,aAAa,GAAG;AAC3C,qBAAmB,QAAQ,aAAa,GAAG;AAC3C,yBAAuBC,eAAc,QAAQ,YAAY,GAAG,GAAG,YAAY;AAC3E,qBAAmBA,eAAc,QAAQ,QAAQ,GAAG,GAAG,QAAQ;AAC/D,gBAAcA,eAAc,QAAQ,SAAS,GAAG,GAAG,SAAS;AAC5D,MAAIC,QAAO,QAAQ,YAAY,GAAG;AAChC,uBAAmBD,eAAc,QAAQ,cAAc,GAAG,GAAG,cAAc;AAAA,EAC7E;AACA,MAAIC,QAAO,QAAQ,OAAO,GAAG;AAC3B,kBAAcD,eAAc,QAAQ,SAAS,GAAG,GAAG,SAAS;AAAA,EAC9D;AACA,SAAO;AACT;AAEA,SAAS,0BAA0B,OAAgB,QAA6B;AAC9E,QAAM,SAAS,iBAAiB,cAAc,KAAK,GAAG,GAAG;AACzD,EAAAF;AAAA,IACE;AAAA,IACA,SACI;AAAA,MACE;AAAA,MACA;AAAA,MACA;AAAA,MACA;AAAA,MACA;AAAA,MACA;AAAA,MACA;AAAA,MACA;AAAA,MACA;AAAA,MACA;AAAA,IACF,IACA;AAAA,MACE;AAAA,MACA;AAAA,MACA;AAAA,MACA;AAAA,MACA;AAAA,MACA;AAAA,MACA;AAAA,MACA;AAAA,IACF;AAAA,IACJ;AAAA,EACF;AACA,cAAYC,gBAAe,QAAQ,UAAU,GAAG,GAAG,sBAAsB,UAAU;AACnF,MAAI,QAAQ;AACV,IAAAA,gBAAe,QAAQ,YAAY,GAAG;AACtC,sBAAkBC,eAAc,QAAQ,aAAa,GAAG,CAAC;AAAA,EAC3D;AACA,EAAAD,gBAAe,QAAQ,YAAY,GAAG;AACtC,EAAAA,gBAAe,QAAQ,YAAY,GAAG;AACtC,kBAAgB,QAAQ,YAAY,KAAK,CAAC;AAC1C,cAAYA,gBAAe,QAAQ,eAAe,GAAG,GAAG;AAAA,IACtD;AAAA,IACA;AAAA,IACA;AAAA,EACF,GAAG,eAAe;AAClB,qBAAmB,QAAQ,eAAe,GAAG;AAC7C,iBAAe,QAAQ,cAAc,GAAG;AACxC,EAAAA,gBAAe,QAAQ,iBAAiB,GAAG;AAC3C,SAAO;AACT;AAEA,SAAS,gCACP,OACA,QACY;AACZ,QAAM,SAAS,iBAAiB,cAAc,KAAK,GAAG,GAAG;AACzD,EAAAD;AAAA,IACE;AAAA,IACA,SACI;AAAA,MACE;AAAA,MACA;AAAA,MACA;AAAA,MACA;AAAA,MACA;AAAA,MACA;AAAA,MACA;AAAA,MACA;AAAA,MACA;AAAA,MACA;AAAA,IACF,IACA;AAAA,MACE;AAAA,MACA;AAAA,MACA;AAAA,MACA;AAAA,MACA;AAAA,MACA;AAAA,MACA;AAAA,MACA;AAAA,IACF;AAAA,IACJ;AAAA,EACF;AACA;AAAA,IACEC,gBAAe,QAAQ,UAAU,GAAG;AAAA,IACpC;AAAA,IACA;AAAA,EACF;AACA,MAAI,QAAQ;AACV,IAAAA,gBAAe,QAAQ,kBAAkB,GAAG;AAC5C,sBAAkBC,eAAc,QAAQ,aAAa,GAAG,CAAC;AAAA,EAC3D;AACA,EAAAD,gBAAe,QAAQ,YAAY,GAAG;AACtC,EAAAA,gBAAe,QAAQ,YAAY,GAAG;AACtC,EAAAA,gBAAe,QAAQ,YAAY,GAAG;AACtC;AAAA,IAAoB;AAAA,IAAQ;AAAA,IAA2B;AAAA,IAAK,CAAC,OAAO,SAClE,YAAY,OAAO,MAAM,IAAI;AAAA,EAC/B;AACA,sBAAoB,QAAQ,8BAA8B,GAAG;AAC7D,EAAAA,gBAAe,QAAQ,kBAAkB,GAAG;AAC5C,qBAAmB,QAAQ,aAAa,GAAG;AAC3C,SAAO;AACT;AAEA,SAAS,kBAAkB,OAAuC;AAChE,QAAM,SAAS,iBAAiB,OAAO,aAAa;AACpD,EAAAD,iBAAgB,QAAQ,CAAC,SAAS,aAAa,OAAO,GAAG,aAAa;AACtE,QAAM,QAAQC,gBAAe,QAAQ,SAAS,aAAa;AAC3D,gCAA8B,KAAK;AACnC,QAAM,YAAYA,gBAAe,QAAQ,aAAa,aAAa;AACnE,QAAM,QAAQA,gBAAe,QAAQ,SAAS,aAAa;AAC3D,uBAAqB,OAAO,KAAK;AACjC,SAAO,EAAE,OAAO,WAAW,MAAM;AACnC;AAEA,SAAS,uBAAuB,OAAgB,MAAoB;AAClE,QAAM,SAAS,iBAAiB,OAAO,IAAI;AAC3C,EAAAD,iBAAgB,QAAQ,CAAC,gBAAgB,cAAc,oBAAoB,GAAG,IAAI;AAClF,EAAAC,gBAAe,QAAQ,gBAAgB,IAAI;AAC3C,EAAAA,gBAAe,QAAQ,cAAc,IAAI;AACzC,QAAM,UAAUG,eAAc,QAAQ,sBAAsB,MAAM,CAAC;AACnE,WAAS,QAAQ,GAAG,QAAQ,QAAQ,QAAQ,SAAS;AACnD,6BAAyB,QAAQ,KAAK,GAAG,GAAG,IAAI,uBAAuB,KAAK,GAAG;AAAA,EACjF;AACF;AAaA,SAAS,yBAAyB,OAAgB,MAAoB;AACpE,QAAM,SAAS,iBAAiB,OAAO,IAAI;AAC3C,MAAI;AACF,UAAM,YAAY,6BAA6B,MAAM;AACrD,QAAI,gBAAgB,MAAM,MAAM,gBAAgB,SAAS,GAAG;AAC1D,YAAM,IAAI,wBAAwB,GAAG,IAAI,0CAA0C;AAAA,IACrF;AAAA,EACF,SAAS,OAAO;AACd,QAAI,iBAAiB,yBAAyB;AAC5C,YAAM;AAAA,IACR;AACA,UAAM,IAAI;AAAA,MACR,iBAAiB,QAAQ,MAAM,UAAU,OAAO,KAAK;AAAA,IACvD;AAAA,EACF;AACF;AAmBA,SAAS,mBAAmB,OAAgB,MAAoB;AAC9D,QAAM,SAAS,iBAAiB,OAAO,IAAI;AAC3C,QAAM,OAAO,OAAO,KAAK,MAAM;AAC/B,MAAI,KAAK,WAAW,GAAG;AACrB,UAAM,IAAI,wBAAwB,GAAG,IAAI,uCAAuC;AAAA,EAClF;AACA,QAAM,MAAM,KAAK,CAAC;AAClB,MAAI,QAAQ,WAAW,QAAQ,SAAS;AACtC,UAAM,SAASC,eAAc,QAAQ,KAAK,MAAM,CAAC;AACjD,aAAS,QAAQ,GAAG,QAAQ,OAAO,QAAQ,SAAS;AAClD,yBAAmB,OAAO,KAAK,GAAG,GAAG,IAAI,IAAI,GAAG,IAAI,KAAK,GAAG;AAAA,IAC9D;AACA;AAAA,EACF;AACA,MAAI,QAAQ,WAAW;AACrB,UAAM,UAAU,iBAAiBC,eAAc,QAAQ,WAAW,IAAI,GAAG,GAAG,IAAI,UAAU;AAC1F,IAAAC,iBAAgB,SAAS,CAAC,KAAK,GAAG,GAAG,IAAI,UAAU;AACnD,IAAAC,gBAAe,SAAS,OAAO,GAAG,IAAI,UAAU;AAChD;AAAA,EACF;AACA,MAAI,QAAQ,YAAY;AACtB,gCAA4BF,eAAc,QAAQ,YAAY,IAAI,GAAG,GAAG,IAAI,WAAW;AACvF;AAAA,EACF;AACA,QAAM,IAAI,wBAAwB,GAAG,IAAI,+BAA+B,GAAG,EAAE;AAC/E;AAEA,SAAS,4BAA4B,OAAgB,MAAoB;AACvE,QAAM,SAAS,iBAAiB,OAAO,IAAI;AAC3C,EAAAC;AAAA,IACE;AAAA,IACA,CAAC,iBAAiB,YAAY,gBAAgB,aAAa,WAAW;AAAA,IACtE;AAAA,EACF;AACA,EAAAC,gBAAe,QAAQ,iBAAiB,IAAI;AAC5C,EAAAA,gBAAe,QAAQ,YAAY,IAAI;AACvC,EAAAF,eAAc,QAAQ,gBAAgB,IAAI;AAC1C,MAAIG,QAAO,QAAQ,WAAW,GAAG;AAC/B,UAAM,YAAY,iBAAiBH,eAAc,QAAQ,aAAa,IAAI,GAAG,GAAG,IAAI,YAAY;AAChG,IAAAC;AAAA,MACE;AAAA,MACA,CAAC,WAAW,mBAAmB,4BAA4B;AAAA,MAC3D,GAAG,IAAI;AAAA,IACT;AACA,mBAAe,WAAW,WAAW,GAAG,IAAI,YAAY;AACxD,QAAIE,QAAO,WAAW,iBAAiB,GAAG;AACxC,0BAAoB,WAAW,mBAAmB,GAAG,IAAI,YAAY;AAAA,IACvE;AACA,oBAAgB,WAAW,8BAA8B,GAAG,IAAI,YAAY;AAAA,EAC9E;AACA,MAAIA,QAAO,QAAQ,WAAW,GAAG;AAC/B,UAAM,YAAY,iBAAiBH,eAAc,QAAQ,aAAa,IAAI,GAAG,GAAG,IAAI,YAAY;AAChG,IAAAC,iBAAgB,WAAW,CAAC,qBAAqB,GAAG,GAAG,IAAI,YAAY;AACvE,oBAAgB,WAAW,uBAAuB,GAAG,IAAI,cAAc,CAAC;AAAA,EAC1E;AACF;AAEA,SAAS,cAAc,OAAgB,MAAoB;AACzD,QAAM,SAAS,iBAAiB,OAAO,IAAI;AAC3C,EAAAA,iBAAgB,QAAQ,CAAC,UAAU,iBAAiB,kBAAkB,YAAY,GAAG,IAAI;AACzF,cAAYC,gBAAe,QAAQ,UAAU,IAAI,GAAG,uBAAuB,GAAG,IAAI,SAAS;AAC3F,kBAAgB,QAAQ,iBAAiB,MAAM,CAAC;AAChD,cAAYA,gBAAe,QAAQ,kBAAkB,IAAI,GAAG;AAAA,IAC1D;AAAA,IACA;AAAA,EACF,GAAG,GAAG,IAAI,iBAAiB;AAC3B,cAAYA,gBAAe,QAAQ,cAAc,IAAI,GAAG;AAAA,IACtD;AAAA,IACA;AAAA,EACF,GAAG,GAAG,IAAI,aAAa;AACzB;AAEA,SAAS,mBAAmB,OAAgB,MAAoB;AAC9D,QAAM,SAAS,iBAAiB,OAAO,IAAI;AAC3C,EAAAD,iBAAgB,QAAQ,CAAC,QAAQ,GAAG,IAAI;AACxC,cAAYC,gBAAe,QAAQ,UAAU,IAAI,GAAG,CAAC,QAAQ,QAAQ,OAAO,GAAG,GAAG,IAAI,SAAS;AACjG;AAEA,SAAS,cAAc,OAAgB,MAAoB;AACzD,QAAM,SAAS,iBAAiB,OAAO,IAAI;AAC3C,EAAAD,iBAAgB,QAAQ,CAAC,UAAU,GAAG,IAAI;AAC1C,cAAYC,gBAAe,QAAQ,YAAY,IAAI,GAAG,CAAC,OAAO,YAAY,MAAM,GAAG,GAAG,IAAI,WAAW;AACvG;AAEA,SAAS,oBACP,UACA,YACsB;AACtB,QAAM,MAAM,gBAAgB,QAAQ;AACpC,QAAM,WAAWE,aAAY,OAAO,GAAG;AACvC,QAAM,SAAS,YAAY,YAAYA,aAAY,OAAO,GAAG,WAAW,MAAM,IAAI,GAAG,QAAQ,CAAC;AAC9F,QAAM,KAAK,GAAG,WAAW,QAAQ,GAAG,iBAAiB,MAAM,CAAC;AAC5D,SAAO;AAAA,IACL,MAAM,WAAW;AAAA,IACjB,SAAS,WAAW;AAAA,IACpB;AAAA,IACA,QAAQ,WAAW;AAAA,IACnB;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA,eAAW,yBAAW,MAAM,EAAE,MAAM,CAAC;AAAA,EACvC;AACF;AAEA,SAAS,gBACP,QACA,UACA,YACM;AACN,QAAM,SAASF,gBAAe,QAAQ,WAAW,SAAS,GAAG;AAC7D,MAAI,WAAW,SAAS,IAAI;AAC1B;AAAA,EACF;AACA,MAAI,IAAI,OAAO,IAAI,WAAW,QAAQ,eAAe,EAAE,KAAK,MAAM,GAAG;AACnE,UAAM,IAAI;AAAA,MACR,GAAG,WAAW,OAAO;AAAA,IACvB;AAAA,EACF;AACA,QAAM,IAAI,oBAAoB,GAAG,WAAW,OAAO,mBAAmB,WAAW,QAAQ,EAAE;AAC7F;AAiBA,SAAS,iCACP,QACA,WACM;AACN,MAAI,CAACG,QAAO,QAAQ,eAAe,GAAG;AACpC;AAAA,EACF;AACA,QAAM,gBAAgBC,gBAAe,QAAQ,iBAAiB,GAAG;AACjE,MAAI,UAAU,cAAc,eAAe;AACzC,UAAM,IAAI;AAAA,MACR,uBAAuB,UAAU,SAAS,iCAAiC,aAAa;AAAA,IAC1F;AAAA,EACF;AACF;AAiBA,eAAe,gBACb,WACA,QACkB;AAClB,MAAI,UAAU,UAAU,6BAA6B;AACnD,UAAM,YAAY,2BAA2B,UAAU,SAAS;AAChE,UAAM,iBAAiB,qBAAqB,UAAU,OAAO,UAAU,KAAK;AAC5E,QAAI;AACF,aAAO,uBAAQ,OAAO,gBAAgB,QAAQ,SAAS;AAAA,IACzD,QAAQ;AACN,YAAM,IAAI,2BAA2B,uCAAuC;AAAA,IAC9E;AAAA,EACF;AAEA,MAAI,UAAU,UAAU,4BAA4B;AAClD,UAAM,MAAM,YAAY,UAAU,SAAS;AAC3C,UAAM,iBAAiB,qBAAqB,UAAU,OAAO,UAAU,KAAK;AAC5E,QAAI;AACF,iBAAO,4BAAc;AAAA,QACnB,SAAS,IAAI;AAAA,QACb,SAAS,EAAE,KAAK,OAAO;AAAA,QACvB,eAAW,yBAAW,cAAc;AAAA,MACtC,CAAC;AAAA,IACH,QAAQ;AACN,YAAM,IAAI,2BAA2B,uCAAuC;AAAA,IAC9E;AAAA,EACF;AAEA,QAAM,IAAI,+BAA+B,gCAAgC,UAAU,KAAK,EAAE;AAC5F;AAEA,SAAS,2BAA2B,KAAyB;AAC3D,MAAI,CAAC,IAAI,WAAW,UAAU,GAAG;AAC/B,UAAM,IAAI,uBAAuB,mCAAmC;AAAA,EACtE;AACA,QAAM,aAAa,IAAI,MAAM,WAAW,MAAM;AAC9C,MAAI,CAAC,WAAW,WAAW,GAAG,GAAG;AAC/B,UAAM,IAAI,uBAAuB,sCAAsC;AAAA,EACzE;AACA,MAAI;AACJ,MAAI;AACF,YAAQ,oBAAM,UAAU,OAAO,UAAU;AAAA,EAC3C,QAAQ;AACN,UAAM,IAAI,uBAAuB,kCAAkC;AAAA,EACrE;AACA,MAAI,MAAM,WAAW,MAAM,MAAM,CAAC,MAAM,OAAQ,MAAM,CAAC,MAAM,GAAM;AACjE,WAAO,MAAM,MAAM,CAAC;AAAA,EACtB;AACA,QAAM,IAAI,uBAAuB,yCAAyC;AAC5E;AAEA,SAAS,YAAY,KAAyC;AAC5D,MAAI;AACJ,MAAI;AACF,aAAS,YAAY,GAAG;AAAA,EAC1B,QAAQ;AACN,UAAM,IAAI,uBAAuB,kCAAkC;AAAA,EACrE;AACA,MAAI,CAAC,QAAQ;AACX,UAAM,IAAI,uBAAuB,mCAAmC;AAAA,EACtE;AACA,SAAO,EAAE,SAAS,OAAO,QAAQ;AACnC;AAEA,SAAS,qBAAqB,OAAe,OAAmC;AAC9E,MAAI,MAAM,WAAW,KAAK,CAAC,aAAa,KAAK,KAAK,KAAK,MAAM,SAAS,GAAG,GAAG;AAC1E,UAAM,IAAI,uBAAuB,mDAAmD;AAAA,EACtF;AACA,QAAM,QAAQ,gBAAgB,KAAK;AACnC,MAAI,UAAU,+BAA+B,MAAM,WAAW,IAAI;AAChE,UAAM,IAAI,uBAAuB,oCAAoC;AAAA,EACvE;AACA,MAAI,UAAU,4BAA4B;AACxC,QAAI,MAAM,WAAW,IAAI;AACvB,YAAM,IAAI,uBAAuB,oCAAoC;AAAA,IACvE;AACA,UAAM,IAAI,MAAM,EAAE;AAClB,QAAI,MAAM,MAAM,MAAM,IAAI;AACxB,YAAM,IAAI,uBAAuB,gDAAgD;AAAA,IACnF;AAAA,EACF;AACA,SAAO;AACT;AAkBA,SAAS,uBACP,QACA,YACY;AACZ,QAAM,SAAS,uBAAO,OAAO,IAAI;AACjC,aAAW,CAAC,KAAK,KAAK,KAAK,OAAO,QAAQ,MAAM,GAAG;AACjD,QAAI,QAAQ,WAAW,WAAW,QAAQ,aAAa;AACrD;AAAA,IACF;AACA,WAAO,GAAG,IAAI;AAAA,EAChB;AACA,SAAO;AACT;AAOA,SAAS,oBAAoB,QAAkC;AAC7D,MAAI,WAAW,cAAe,QAAO,YAAY;AACjD,MAAI,WAAW,qBAAsB,QAAO,YAAY;AACxD,MAAI,WAAW,4BAA6B,QAAO,YAAY;AAC/D,QAAM,IAAI,wBAAwB,qCAAqC,MAAM,EAAE;AACjF;AAEA,SAAS,iBAAiB,OAAgB,MAA0B;AAClE,MAAI,UAAU,QAAQ,OAAO,UAAU,YAAY,MAAM,QAAQ,KAAK,GAAG;AACvE,UAAM,IAAI,wBAAwB,GAAG,IAAI,oBAAoB;AAAA,EAC/D;AACA,SAAO;AACT;AAEA,SAASC,iBAAgB,QAAoB,SAA4B,MAAoB;AAC3F,QAAM,aAAa,IAAI,IAAI,OAAO;AAClC,aAAW,OAAO,OAAO,KAAK,MAAM,GAAG;AACrC,QAAI,CAAC,WAAW,IAAI,GAAG,GAAG;AACxB,YAAM,IAAI,wBAAwB,GAAG,IAAI,sBAAsB,GAAG,EAAE;AAAA,IACtE;AAAA,EACF;AACF;AAEA,SAASC,eAAc,QAAoB,KAAa,MAAyB;AAC/E,MAAI,CAACC,QAAO,QAAQ,GAAG,GAAG;AACxB,UAAM,IAAI,wBAAwB,GAAG,IAAI,IAAI,GAAG,cAAc;AAAA,EAChE;AACA,SAAO,OAAO,GAAG;AACnB;AAEA,SAASC,gBAAe,QAAoB,KAAa,MAAsB;AAC7E,SAAO,kBAAkBF,eAAc,QAAQ,KAAK,IAAI,GAAG,GAAG,IAAI,IAAI,GAAG,EAAE;AAC7E;AAEA,SAAS,eAAe,QAAoB,KAAa,MAAoB;AAC3E,MAAI,CAACC,QAAO,QAAQ,GAAG,GAAG;AACxB;AAAA,EACF;AACA,oBAAkBD,eAAc,QAAQ,KAAK,IAAI,GAAG,GAAG,IAAI,IAAI,GAAG,EAAE;AACtE;AAEA,SAAS,kBAAkB,OAAkB,MAAsB;AACjE,MAAI,OAAO,UAAU,YAAY,MAAM,WAAW,GAAG;AACnD,UAAM,IAAI,wBAAwB,GAAG,IAAI,6BAA6B;AAAA,EACxE;AACA,SAAO;AACT;AAEA,SAAS,gBAAgB,QAAoB,KAAa,MAAoB;AAC5E,MAAI,CAACC,QAAO,QAAQ,GAAG,GAAG;AACxB;AAAA,EACF;AACA,MAAI,OAAOD,eAAc,QAAQ,KAAK,IAAI,MAAM,WAAW;AACzD,UAAM,IAAI,wBAAwB,GAAG,IAAI,IAAI,GAAG,oBAAoB;AAAA,EACtE;AACF;AAEA,SAAS,gBACP,QACA,KACA,MACA,SACQ;AACR,QAAM,QAAQA,eAAc,QAAQ,KAAK,IAAI;AAC7C,MAAI,OAAO,UAAU,YAAY,CAAC,OAAO,cAAc,KAAK,KAAK,QAAQ,SAAS;AAChF,UAAM,IAAI;AAAA,MACR,GAAG,IAAI,IAAI,GAAG,0BAA0B,OAAO;AAAA,IACjD;AAAA,EACF;AACA,SAAO;AACT;AAEA,SAASG,eACP,QACA,KACA,MACA,SACsB;AACtB,QAAM,QAAQH,eAAc,QAAQ,KAAK,IAAI;AAC7C,MAAI,CAAC,MAAM,QAAQ,KAAK,KAAK,MAAM,SAAS,SAAS;AACnD,UAAM,IAAI;AAAA,MACR,GAAG,IAAI,IAAI,GAAG,mCAAmC,OAAO;AAAA,IAC1D;AAAA,EACF;AACA,SAAO;AACT;AAEA,SAAS,oBACP,QACA,KACA,MACA,OACM;AACN,QAAM,SAASG,eAAc,QAAQ,KAAK,MAAM,CAAC;AACjD,WAAS,QAAQ,GAAG,QAAQ,OAAO,QAAQ,SAAS;AAClD,UAAM,WAAW,GAAG,IAAI,IAAI,GAAG,IAAI,KAAK;AACxC,UAAM,QAAQ,kBAAkB,OAAO,KAAK,GAAG,QAAQ;AACvD,YAAQ,OAAO,QAAQ;AAAA,EACzB;AACF;AAEA,SAAS,mBAAmB,QAAoB,KAAa,MAAoB;AAC/E,gBAAcD,gBAAe,QAAQ,KAAK,IAAI,GAAG,GAAG,IAAI,IAAI,GAAG,EAAE;AACnE;AAEA,SAAS,mBAAmB,QAAoB,KAAa,MAAoB;AAC/E,MAAI,CAACD,QAAO,QAAQ,GAAG,GAAG;AACxB;AAAA,EACF;AACA,gBAAcC,gBAAe,QAAQ,KAAK,IAAI,GAAG,GAAG,IAAI,IAAI,GAAG,EAAE;AACnE;AAEA,SAAS,cAAc,OAAe,MAAoB;AACxD,QAAM,QAAQ,MAAM;AAAA,IAClB;AAAA,EACF;AACA,MAAI,CAAC,OAAO;AACV,UAAM,IAAI,wBAAwB,GAAG,IAAI,0BAA0B;AAAA,EACrE;AACA,QAAM,SAAS,KAAK,MAAM,KAAK;AAC/B,MAAI,OAAO,MAAM,MAAM,GAAG;AACxB,UAAM,IAAI,wBAAwB,GAAG,IAAI,yCAAyC;AAAA,EACpF;AACA,QAAM,YAAY,IAAI,KAAK,MAAM,EAAE,YAAY,EAAE,QAAQ,SAAS,GAAG;AACrE,MAAI,cAAc,OAAO;AACvB,UAAM,IAAI,wBAAwB,GAAG,IAAI,4CAA4C;AAAA,EACvF;AACF;AAEA,SAAS,YAA8B,QAAgB,UAAa,MAAiB;AACnF,MAAI,WAAW,UAAU;AACvB,UAAM,IAAI,wBAAwB,GAAG,IAAI,YAAY,QAAQ,EAAE;AAAA,EACjE;AACA,SAAO;AACT;AAEA,SAAS,YACP,QACA,SACA,MACG;AACH,aAAW,SAAS,SAAS;AAC3B,QAAI,WAAW,OAAO;AACpB,aAAO;AAAA,IACT;AAAA,EACF;AACA,QAAM,IAAI,wBAAwB,GAAG,IAAI,0BAA0B,MAAM,EAAE;AAC7E;AAEA,SAASD,QAAO,QAAoB,KAAsB;AACxD,SAAOG,cAAa,QAAQ,GAAG;AACjC;AAEA,SAAS,8BAA8B,OAAgD;AACrF,MAAI,UAAU,+BAA+B,UAAU,4BAA4B;AACjF,UAAM,IAAI,+BAA+B,gCAAgC,KAAK,EAAE;AAAA,EAClF;AACF;AAEA,SAAS,YAAY,OAA+B;AAClD,aAAO,qBAAO,OAAO,OAAO;AAC9B;AAEA,SAAS,YAAY,MAAkB,OAA+B;AACpE,QAAM,SAAS,IAAI,WAAW,KAAK,SAAS,MAAM,MAAM;AACxD,SAAO,IAAI,MAAM,CAAC;AAClB,SAAO,IAAI,OAAO,KAAK,MAAM;AAC7B,SAAO;AACT;AAEA,SAAS,iBAAiB,OAA2B;AACnD,MAAI,SAAS;AACb,MAAI,SAAS;AACb,MAAI,OAAO;AACX,aAAW,QAAQ,OAAO;AACxB,aAAU,UAAU,IAAK;AACzB,YAAQ;AACR,WAAO,QAAQ,GAAG;AAChB,cAAQ;AACR,gBAAU,gBAAiB,UAAU,OAAQ,EAAE;AAAA,IACjD;AAAA,EACF;AACA,MAAI,OAAO,GAAG;AACZ,cAAU,gBAAiB,UAAW,IAAI,OAAS,EAAE;AAAA,EACvD;AACA,SAAO;AACT;AAEA,SAAS,gBAAgB,OAA2B;AAClD,QAAM,WACJ;AACF,MAAI,SAAS;AACb,WAAS,QAAQ,GAAG,QAAQ,MAAM,QAAQ,SAAS,GAAG;AACpD,UAAM,IAAI,MAAM,KAAK;AACrB,UAAM,IAAI,MAAM,QAAQ,CAAC;AACzB,UAAM,IAAI,MAAM,QAAQ,CAAC;AACzB,UAAM,UAAW,KAAK,MAAQ,KAAK,MAAM,KAAM,KAAK;AACpD,cAAU,SAAU,WAAW,KAAM,EAAE;AACvC,cAAU,SAAU,WAAW,KAAM,EAAE;AACvC,QAAI,QAAQ,IAAI,MAAM,QAAQ;AAC5B,gBAAU,SAAU,WAAW,IAAK,EAAE;AAAA,IACxC;AACA,QAAI,QAAQ,IAAI,MAAM,QAAQ;AAC5B,gBAAU,SAAS,UAAU,EAAE;AAAA,IACjC;AAAA,EACF;AACA,SAAO;AACT;AAEA,SAAS,gBAAgB,OAA2B;AAClD,MAAI,MAAM,SAAS,MAAM,GAAG;AAC1B,UAAM,IAAI,uBAAuB,4CAA4C;AAAA,EAC/E;AACA,QAAM,WACJ;AACF,QAAM,QAAkB,CAAC;AACzB,MAAI,SAAS;AACb,MAAI,OAAO;AACX,aAAW,QAAQ,OAAO;AACxB,UAAM,QAAQ,SAAS,QAAQ,IAAI;AACnC,QAAI,QAAQ,GAAG;AACb,YAAM,IAAI,uBAAuB,kCAAkC;AAAA,IACrE;AACA,aAAU,UAAU,IAAK;AACzB,YAAQ;AACR,QAAI,QAAQ,GAAG;AACb,cAAQ;AACR,YAAM,KAAM,UAAU,OAAQ,GAAI;AAAA,IACpC;AAAA,EACF;AACA,QAAM,UAAU,WAAW,KAAK,KAAK;AACrC,MAAI,gBAAgB,OAAO,MAAM,OAAO;AACtC,UAAM,IAAI,uBAAuB,4CAA4C;AAAA,EAC/E;AACA,SAAO;AACT;;;AEzkCO,IAAM,oCACX;AACK,IAAM,6BACX;AACK,IAAM,oBAAoB;AAC1B,IAAM,6BAA6B;AAiBnC,IAAM,uBAAN,cAAmC,MAAM;AAAA,EAG9C,YAAY,MAAgC,SAAiB;AAC3D,UAAM,OAAO;AACb,SAAK,OAAO;AACZ,SAAK,OAAO;AAAA,EACd;AACF;AA0TA,eAAsB,qCACpB,SAC6B;AAC7B,QAAM,aAAaC,cAAa,SAAS,KAAK,4BAA4B;AAC1E,EAAAC;AAAA,IACE;AAAA,IACA;AAAA,MACE;AAAA,MACA;AAAA,MACA;AAAA,MACA;AAAA,MACA;AAAA,MACA;AAAA,MACA;AAAA,IACF;AAAA,IACA;AAAA,EACF;AACA,MAAI,CAACC,QAAO,YAAY,cAAc,GAAG;AACvC,UAAM,IAAI;AAAA,MACR;AAAA,MACA;AAAA,IACF;AAAA,EACF;AACA,QAAM,eAAe,WAAW,cAAc;AAC9C,MACE,iBAAiB,QACjB,OAAO,iBAAiB,YACxB,MAAM,QAAQ,YAAY,GAC1B;AACA,UAAM,IAAI;AAAA,MACR;AAAA,MACA;AAAA,IACF;AAAA,EACF;AACA,QAAM,eAAe;AACrB,QAAM,YAAY;AAAA,IAChB;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,EACF;AACA,QAAM,MAAM;AAAA,IACV;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,EACF;AACA,QAAM,YAAY,mBAAmB,WAAW,0BAA0B;AAC1E,QAAM,QAAQ,mBAAmB,KAAK,OAAO;AAC7C,MAAI,aAAa,OAAO;AACtB,UAAM,IAAI;AAAA,MACR;AAAA,MACA;AAAA,IACF;AAAA,EACF;AAEA,MAAI;AACJ,MAAI;AACF,gBAAY,MAAM,yBAAyB,YAAY,GAAG;AAAA,EAC5D,SAAS,OAAO;AACd,UAAM,IAAI;AAAA,MACR;AAAA,MACA,iBAAiB,QAAQ,MAAM,UAAU,OAAO,KAAK;AAAA,IACvD;AAAA,EACF;AACA,MAAI,SAAS,UAAU,cAAc,SAAS,UAAU;AACtD,UAAM,IAAI;AAAA,MACR;AAAA,MACA;AAAA,IACF;AAAA,EACF;AAEA,QAAM,mBAAmBC,gBAAe,YAAY,YAAY,GAAG;AACnE,MAAI,SAAS,aAAa,kBAAkB;AAC1C,UAAM,IAAI;AAAA,MACR;AAAA,MACA;AAAA,IACF;AAAA,EACF;AACA,QAAM,mBAAmBA,gBAAe,YAAY,YAAY,GAAG;AACnE,MAAI,SAAS,aAAa,kBAAkB;AAC1C,UAAM,IAAI;AAAA,MACR;AAAA,MACA;AAAA,IACF;AAAA,EACF;AACA,QAAM,yBAAyBA;AAAA,IAC7B;AAAA,IACA;AAAA,IACA;AAAA,EACF;AACA,MAAI,SAAS,mBAAmB,wBAAwB;AACtD,UAAM,IAAI;AAAA,MACR;AAAA,MACA;AAAA,IACF;AAAA,EACF;AACA,QAAM,wBAAwBD,QAAO,YAAY,uBAAuB,IACpEC,gBAAe,YAAY,yBAAyB,GAAG,IACvD;AACJ,MAAI,CAAC,SAAS,wBAAwB,SAAS,qBAAqB,GAAG;AACrE,UAAM,IAAI;AAAA,MACR;AAAA,MACA;AAAA,IACF;AAAA,EACF;AACA,QAAM,2BAA2BD;AAAA,IAC/B;AAAA,IACA;AAAA,EACF,IACIC,gBAAe,YAAY,4BAA4B,GAAG,IAC1D;AACJ,MAAI,CAAC,SAAS,2BAA2B,SAAS,wBAAwB,GAAG;AAC3E,UAAM,IAAI;AAAA,MACR;AAAA,MACA;AAAA,IACF;AAAA,EACF;AACA,SAAO;AACT;AAEA,SAASH,cACP,OACA,MACA,MACY;AACZ,MAAI;AACF,UAAM,aAAa,cAAc,KAAK;AACtC,QACE,eAAe,QACf,OAAO,eAAe,YACtB,MAAM,QAAQ,UAAU,GACxB;AACA,YAAM,IAAI,qBAAqB,MAAM,GAAG,IAAI,oBAAoB;AAAA,IAClE;AACA,WAAO;AAAA,EACT,SAAS,OAAO;AACd,QAAI,iBAAiB,sBAAsB;AACzC,YAAM;AAAA,IACR;AACA,UAAM,IAAI;AAAA,MACR;AAAA,MACA,iBAAiB,QAAQ,MAAM,UAAU,OAAO,KAAK;AAAA,IACvD;AAAA,EACF;AACF;AAmBA,SAASI,iBACP,QACA,SACA,MACM;AACN,QAAM,aAAa,IAAI,IAAI,OAAO;AAClC,aAAW,OAAO,OAAO,KAAK,MAAM,GAAG;AACrC,QAAI,CAAC,WAAW,IAAI,GAAG,GAAG;AACxB,YAAM,IAAI;AAAA,QACR;AAAA,QACA,GAAG,IAAI,sBAAsB,GAAG;AAAA,MAClC;AAAA,IACF;AAAA,EACF;AACF;AAEA,SAASC,eACP,QACA,KACA,MACW;AACX,MAAI,CAACC,QAAO,QAAQ,GAAG,GAAG;AACxB,UAAM,IAAI;AAAA,MACR;AAAA,MACA,GAAG,IAAI,IAAI,GAAG;AAAA,IAChB;AAAA,EACF;AACA,SAAO,OAAO,GAAG;AACnB;AAEA,SAASC,gBAAe,QAAoB,KAAa,MAAsB;AAC7E,QAAM,QAAQF,eAAc,QAAQ,KAAK,IAAI;AAC7C,MAAI,OAAO,UAAU,YAAY,MAAM,WAAW,GAAG;AACnD,UAAM,IAAI;AAAA,MACR;AAAA,MACA,GAAG,IAAI,IAAI,GAAG;AAAA,IAChB;AAAA,EACF;AACA,SAAO;AACT;AAEA,SAAS,YACP,QACA,KACA,MACA,MACQ;AACR,MAAI,CAACC,QAAO,QAAQ,GAAG,GAAG;AACxB,UAAM,IAAI,qBAAqB,MAAM,GAAG,IAAI,IAAI,GAAG,cAAc;AAAA,EACnE;AACA,QAAM,QAAQ,OAAO,GAAG;AACxB,MAAI,OAAO,UAAU,YAAY,MAAM,WAAW,GAAG;AACnD,UAAM,IAAI;AAAA,MACR;AAAA,MACA,GAAG,IAAI,IAAI,GAAG;AAAA,IAChB;AAAA,EACF;AACA,SAAO;AACT;AAuHA,SAAS,mBAAmB,OAAe,MAAsB;AAC/D,QAAM,QAAQ,MAAM;AAAA,IAClB;AAAA,EACF;AACA,MAAI,CAAC,OAAO;AACV,UAAM,IAAI;AAAA,MACR;AAAA,MACA,GAAG,IAAI;AAAA,IACT;AAAA,EACF;AACA,QAAM,SAAS,KAAK,MAAM,KAAK;AAC/B,MAAI,OAAO,MAAM,MAAM,GAAG;AACxB,UAAM,IAAI;AAAA,MACR;AAAA,MACA,GAAG,IAAI;AAAA,IACT;AAAA,EACF;AACA,QAAM,YAAY,IAAI,KAAK,MAAM,EAAE,YAAY,EAAE,QAAQ,SAAS,GAAG;AACrE,MAAI,cAAc,OAAO;AACvB,UAAM,IAAI;AAAA,MACR;AAAA,MACA,GAAG,IAAI;AAAA,IACT;AAAA,EACF;AACA,SAAO;AACT;AAEA,IAAME,gBAEF,OAGA,UACD,OAAO,UAAU,eAAe,KAAK;AAAA,EACpC,OAAO,UAAU;AACnB;AAEF,SAASC,QAAO,QAAoB,KAAsB;AACxD,SAAOD,cAAa,QAAQ,GAAG;AACjC;;;ANhtBO,IAAM,gCAAgC;AACtC,IAAM,kCAAkC;AACxC,IAAM,sCAAsC;AAE5C,IAAM,yCACX;AACK,IAAM,0CACX;AACK,IAAM,uCACX;AACK,IAAM,8BACX;AACK,IAAM,yCACX;AACK,IAAM,6BACX;AAEK,IAAM,gDAAgD;AAAA,EAC3D;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AACF;AA8CO,IAAM,2BAAN,cAAuC,MAAM;AAAA,EAMlD,YACE,MACA,SACA,QAAuC,WACvC,YACA,QACA;AACA,UAAM,OAAO;AACb,SAAK,OAAO;AACZ,SAAK,OAAO;AACZ,SAAK,QAAQ;AACb,SAAK,aAAa;AAClB,SAAK,SAAS;AAAA,EAChB;AACF;AA8IA,IAAM,kBAAsC,aAAE;AAAA,EAAK,MACjD,aAAE,MAAM;AAAA,IACN,aAAE,OAAO;AAAA,IACT,aAAE,OAAO,EAAE,OAAO;AAAA,IAClB,aAAE,QAAQ;AAAA,IACV,aAAE,KAAK;AAAA,IACP,aAAE,MAAM,eAAe;AAAA,IACvB,aAAE,OAAO,eAAe;AAAA,EAC1B,CAAC;AACH;AAEA,IAAM,gBAAgB,aACnB,OAAO,EACP,OAAO,CAAC,UAAUE,oBAAmB,KAAK,MAAM,QAAW;AAAA,EAC1D,SAAS;AACX,CAAC;AAEH,IAAM,qBAAqB,aACxB,OAAO;AAAA,EACN,QAAQ,aAAE,OAAO;AAAA,EACjB,gBAAgB,aAAE,OAAO;AAAA,EACzB,UAAU,aAAE,OAAO;AAAA,EACnB,UAAU,aAAE,OAAO;AAAA,EACnB,UAAU,aAAE,OAAO;AAAA,EACnB,yBAAyB,aAAE,MAAM,aAAE,OAAO,CAAC;AAAA,EAC3C,4BAA4B,aAAE,MAAM,aAAE,OAAO,CAAC;AAAA,EAC9C,gBAAgB,aAAE,OAAO;AAAA,EACzB,WAAW;AAAA,EACX,WAAW,aACR,OAAO;AAAA,IACN,OAAO,aAAE,OAAO;AAAA,IAChB,WAAW,aAAE,OAAO;AAAA,IACpB,OAAO,aAAE,OAAO;AAAA,EAClB,CAAC,EACA,OAAO;AACZ,CAAC,EACA,OAAO;AAEV,IAAM,qBAAqB,aACxB,OAAO;AAAA,EACN,UAAU,aAAE,OAAO,EAAE,IAAI;AAAA,EACzB,UAAU,aAAE,OAAO;AAAA,EACnB,4BAA4B,aAAE,MAAM;AAAA,IAClC,aAAE,QAAQ,0BAA0B;AAAA,EACtC,CAAC;AAAA,EACD,cAAc;AAChB,CAAC,EACA,OAAO;AAEV,IAAM,kBAAkB,aACrB,OAAO;AAAA,EACN,QAAQ,aAAE,QAAQ,0BAA0B;AAAA,EAC5C,UAAU,aAAE,OAAO,EAAE,IAAI;AAAA,EACzB,SAAS,aAAE,OAAO,EAAE,IAAI,CAAC;AAC3B,CAAC,EACA,OAAO;AAEV,IAAM,qBAAqB,aACxB,OAAO;AAAA,EACN,cAAc,aAAE,OAAO;AAAA,EACvB,YAAY,aAAE,OAAO;AAAA,EACrB,uBAAuB,aAAE,MAAM,eAAe,EAAE,IAAI,CAAC;AACvD,CAAC,EACA,OAAO;AAEV,IAAM,kBAAkB,aACrB,OAAO;AAAA,EACN,QAAQ,aAAE,QAAQ,iCAAiC;AAAA,EACnD,UAAU,aAAE,OAAO;AAAA,EACnB,cAAc;AAAA,EACd,WAAW;AAAA,EACX,cAAc;AAChB,CAAC,EACA,OAAO;AAEV,IAAM,kBAAkB,aACrB,OAAO;AAAA,EACN,OAAO,aAAE,OAAO;AAAA,EAChB,WAAW,aAAE,OAAO;AAAA,EACpB,OAAO,aAAE,OAAO;AAClB,CAAC,EACA,OAAO;AAEV,IAAM,kBAAkB,aACrB,OAAO;AAAA,EACN,QAAQ,aAAE,QAAQ,uCAAuC;AAAA,EACzD,aAAa,aAAE,OAAO;AAAA,EACtB,UAAU,aAAE,OAAO;AAAA,EACnB,UAAU,aAAE,OAAO;AAAA,EACnB,OAAO,aAAE,OAAO,EAAE,IAAI,EAAE;AAAA,EACxB,oBAAoB;AAAA,EACpB,gBAAgB,aAAE,MAAM,aAAE,OAAO,CAAC,EAAE,IAAI,CAAC;AAAA,EACzC,+BAA+B,aAAE,MAAM,eAAe,EAAE,SAAS;AAAA,EACjE,WAAW;AACb,CAAC,EACA,OAAO;AAEV,IAAM,0BAA0B,aAC7B,OAAO,EAAE,WAAW,gBAAgB,CAAC,EACrC,OAAO;AAEV,IAAM,eAAe,aAClB,OAAO;AAAA,EACN,QAAQ,aAAE,QAAQ,2BAA2B;AAAA,EAC7C,MAAM,aAAE,KAAK,6CAA6C;AAAA,EAC1D,SAAS,aAAE,OAAO,EAAE,SAAS;AAC/B,CAAC,EACA,OAAO;AAEV,IAAM,4BAA4B,aAC/B,OAAO;AAAA,EACN,OAAO,aACJ,OAAO;AAAA,IACN,MAAM,aAAE,KAAK,6CAA6C;AAAA,IAC1D,SAAS,aAAE,OAAO,EAAE,SAAS;AAAA,EAC/B,CAAC,EACA,OAAO;AACZ,CAAC,EACA,OAAO;AAEV,IAAM,uBAAuB,aAC1B,OAAO;AAAA,EACN,cAAc,aAAE,OAAO;AAAA,EACvB,YAAY,aAAE,OAAO,EAAE,IAAI,CAAC;AAAA,EAC5B,WAAW,aAAE,OAAO;AAAA,EACpB,WAAW,aAAE,OAAO;AAAA,EACpB,UAAU,aAAE,OAAO;AAAA,EACnB,mBAAmB,aAAE,OAAO,EAAE,MAAM,gBAAgB;AAAA,EACpD,gBAAgB,aAAE,QAAQ,cAAc;AAAA,EACxC,UAAU;AAAA,EACV,WAAW;AAAA,EACX,UAAU,aAAE,QAAQ;AAAA,EACpB,SAAS,aAAE,OAAO;AACpB,CAAC,EACA,OAAO;AAEV,IAAM,wBAAwB,aAC3B,OAAO,EAAE,YAAY,qBAAqB,CAAC,EAC3C,OAAO;AACV,IAAM,wBAAwB,aAC3B,OAAO;AAAA,EACN,KAAK,aAAE,OAAO,EAAE,IAAI,CAAC;AAAA,EACrB,WAAW,aAAE,MAAM,aAAE,OAAO,CAAC;AAAA,EAC7B,SAAS,aAAE,MAAM,aAAE,OAAO,CAAC;AAC7B,CAAC,EACA,OAAO;AAEV,IAAM,wBAAwB,aAC3B,OAAO,EAAE,MAAM,aAAE,MAAM,eAAe,EAAE,CAAC,EACzC,OAAO;AACV,IAAM,uBAAuB,aAAE,OAAO,EAAE,OAAO,gBAAgB,CAAC,EAAE,OAAO;AAElE,IAAM,+BAA+B;AAAA,EAC1C;AAAA,IACE,MAAM;AAAA,IACN,KAAK;AAAA,IACL,aAAa,CAAC,EAAE,OAAO,GAAG,OAAO,mBAAmB,CAAC;AAAA,EACvD;AAAA,EACA;AAAA,IACE,MAAM;AAAA,IACN,KAAK;AAAA,IACL,aAAa,CAAC,EAAE,OAAO,GAAG,OAAO,mBAAmB,CAAC;AAAA,EACvD;AACF;AAcO,SAAS,oCACd,eACA,gBACQ;AACR,MAAI,eAAe,WAAW,GAAG;AAC/B,UAAM,IAAI;AAAA,MACR;AAAA,MACA;AAAA,MACA;AAAA,IACF;AAAA,EACF;AACA,SAAO,GAAG,aAAa,IAAI,mBAAmB,cAAc,CAAC;AAC/D;AAKA,IAAM,+BACJ,IAAI;AAAA,EACF,6BAA6B,IAAI,CAAC,cAAc;AAAA,IAC9C,UAAU;AAAA,IACV;AAAA,EACF,CAAC;AACH;AAEK,IAAM,sBAAN,MAAM,qBAAoB;AAAA,EA4BvB,YACN,WACA,uBACA,wBACAC,4BACA,+BACA,uBACA,oBACA,SACA;AAdF,SAAiB,sBAAsB,oBAAI,IAAY;AAGvD,SAAQ,cAAc;AAYpB,SAAK,YAAY;AACjB,SAAK,wBAAwB;AAC7B,SAAK,yBAAyB;AAC9B,SAAK,4BAA4BA;AACjC,SAAK,eAAe,QAAQ;AAC5B,SAAK,WAAW,QAAQ;AACxB,SAAK,WAAW,QAAQ;AACxB,SAAK,iBAAiB,QAAQ;AAC9B,SAAK,YAAY,QAAQ;AACzB,SAAK,oBAAoB,QAAQ;AACjC,SAAK,uBAAuB,QAAQ;AACpC,SAAK,gCAAgC;AACrC,SAAK,wBAAwB;AAC7B,SAAK,qBAAqB;AAC1B,SAAK,qBACH,QAAQ,sBACR,QAAQ,mBAAmB,sBAC3B,QAAQ;AACV,SAAK,gBAAgB,QAAQ,iBAC3B,QAAQ,mBAAmB,iBAAiB;AAAA,MAC1C,MAAM;AAAA,MACN,YAAY;AAAA,QACV,QAAQ;AAAA,QACR,WAAW,QAAQ;AAAA,MACrB;AAAA,IACF;AACF,SAAK,WAAW,QAAQ,YAAY,QAAQ,mBAAmB;AAC/D,SAAK,yBAAyB,KAAK;AAAA,MACjC,KAAK,IAAI,QAAQ,0BAA0B,IAAI,CAAC;AAAA,MAChD;AAAA,IACF;AACA,SAAK,MAAM,QAAQ,QAAQ,MAAM,oBAAI,KAAK;AAC1C,SAAK,QACH,QAAQ,UACP,CAAC,iBACA,IAAI,QAAQ,CAAC,YAAY,WAAW,SAAS,YAAY,CAAC;AAC9D,SAAK,SAAS,QAAQ,UAAU,KAAK;AACrC,SAAK,sBACH,QAAQ,uBAAuB;AAAA,EACnC;AAAA,EAEA,aAAa,OACX,SAC8B;AAC9B,UAAM,YAAY,eAAe,QAAQ,SAAS;AAClD,QACE,UAAU,UAAU,aAAa,QAAQ,iBAAiB,YAC1D,UAAU,UAAU,YAAY,QAAQ,iBAAiB,SACzD;AACA,YAAM;AAAA,QACJ;AAAA,QACA;AAAA,MACF;AAAA,IACF;AACA,UAAM,SAAS,MAAM,yBAAyB,WAAW,OAAO;AAChE,QAAI,OAAO,aAAa,UAAU,aAAa,UAAU;AACvD,YAAM,IAAI;AAAA,QACR;AAAA,QACA;AAAA,QACA;AAAA,MACF;AAAA,IACF;AACA,QAAI,OAAO,aAAa,UAAU,aAAa,UAAU;AACvD,YAAM,IAAI;AAAA,QACR;AAAA,QACA;AAAA,QACA;AAAA,MACF;AAAA,IACF;AACA,UAAM,wBAAwB,MAAM;AAAA,MAClC,UAAU,aAAa;AAAA,MACvB,QAAQ;AAAA,MACR;AAAA,IACF;AACA,UAAM,qBAAqB,MAAM;AAAA,MAC/B,UAAU,UAAU;AAAA,MACpB,QAAQ;AAAA,IACV;AACA,UAAM,wBACJ,UAAU,aAAa,sBAAsB;AAAA,MAAI,CAAC,YAAY,UAC5D;AAAA,QACE;AAAA,QACA,wCAAwC,KAAK;AAAA,MAC/C;AAAA,IACF;AACF,UAAM,yBAAyB,sBAAsB,IAAI,CAAC,gBAAgB;AAAA,MACxE,GAAG;AAAA,MACH,OAAO,UAAU,UAAU;AAAA,IAC7B,EAAE;AACF,WAAO,IAAI;AAAA,MACT;AAAA,MACA;AAAA,MACA;AAAA,MACA,0BAA0B,qBAAqB;AAAA,MAC/CD,oBAAmB,OAAO,SAAS;AAAA,MACnC;AAAA,MACA;AAAA,MACA;AAAA,IACF;AAAA,EACF;AAAA,EAEA,IAAI,cAA2D;AAC7D,QAAI,KAAK,aAAa;AACpB,aAAO;AAAA,IACT;AACA,QAAI,KAAK,uBAAuB,QAAW;AACzC,aAAO;AAAA,IACT;AACA,QAAI,KAAK,gBAAgB,KAAK,kBAAkB,GAAG;AACjD,aAAO;AAAA,IACT;AACA,WAAO;AAAA,EACT;AAAA,EAEA,MAAM,QACJ,eACA,gBAC2C;AAC3C,QAAI;AACF,YAAM,mBAAmB,8BAA8B,aAAa;AACpE,YAAM,yBACJ,kBAAkB,KAAK,UAAU,aAAa;AAChD,YAAM,YAAwC;AAAA,QAC5C,GAAG;AAAA,QACH,MACE,mBAAmB,SACf,iBAAiB,OACjB;AAAA,UACE;AAAA,UACA;AAAA,QACF;AAAA,QACN,aAAa,iBAAiB,YAAY,IAAI,CAAC,UAAU;AAAA,UACvD,GAAG;AAAA,UACH,OACE,KAAK,UAAU,qBACX,yBACA,KAAK;AAAA,QACb,EAAE;AAAA,MACJ;AACA,YAAM,aAAa,MAAM,KAAK,sBAAsB;AACpD,YAAM,YAAY,KAAK;AAAA,QACrB;AAAA,QACA;AAAA,MACF;AACA,WAAK,4BAA4B,YAAY,SAAS;AACtD,YAAM,WAAW,MAAM,KAAK;AAAA,QAC1B;AAAA,QACA,UAAU;AAAA,QACV;AAAA,QACA;AAAA,UACE,QAAQ;AAAA,UACR,MAAM,UAAU;AAAA;AAAA;AAAA;AAAA,UAIhB,QACE,UAAU,YAAY,SAClB,UAAU,YAAY,IAAI,CAAC,SAAS,KAAK,KAAK,IAC9C,CAAC;AAAA,QACT;AAAA,QACA,UAAU;AAAA,MACZ;AACA,aAAO;AAAA,QACL;AAAA,QACA;AAAA,QACA;AAAA,MACF;AAAA,IACF,SAAS,OAAO;AACd,WAAK,kBAAkB,KAAK;AAC5B,YAAM;AAAA,IACR;AAAA,EACF;AAAA,EAEA,MAAM,OAAO,MAAwD;AACnE,QAAI;AACF,YAAM,aAAa,MAAM,KAAK,sBAAsB;AACpD,YAAM,YAAY,WAAW,aAAa;AAAA,QACxC,CAAC,eACC,WAAW,YAAY,kBACvB,WAAW,SAAS,QACpB,WAAW,QAAQ,SAAS,kBAAkB;AAAA,MAClD;AACA,YAAM,YAAY;AAAA,QAChB;AAAA,UACE,SAAS;AAAA,UACT,OAAO,WAAW,SAAS;AAAA,UAC3B;AAAA,UACA,SAAS,CAAC,kBAAkB;AAAA,QAC9B;AAAA,QACA;AAAA,MACF;AACA,WAAK,4BAA4B,YAAY,SAAS;AACtD,YAAM,WAAW,MAAM,KAAK,aAAa,MAAM,MAAM,kBAAkB;AACvE,aAAO;AAAA,QACL;AAAA,QACA;AAAA,QACA;AAAA,MACF;AAAA,IACF,SAAS,OAAO;AACd,WAAK,kBAAkB,KAAK;AAC5B,YAAM;AAAA,IACR;AAAA,EACF;AAAA,EAEA,MAAc,aACZ,SACA,MACA,QACA,MACA,SACgC;AAChC,UAAM,aAAa,KAAK;AACxB,QAAI,eAAe,QAAW;AAC5B,YAAM,IAAI;AAAA,QACR;AAAA,QACA;AAAA,MACF;AAAA,IACF;AACA,QACE,WAAW,cAAc,KAAK,gBAC9B,WAAW,cAAc,KAAK,mBAAmB,WACjD;AACA,YAAM,IAAI;AAAA,QACR;AAAA,QACA;AAAA,MACF;AAAA,IACF;AACA,QACE,KAAK,0BAA0B,UAC/B,KAAK,uBAAuB,QAC5B;AACA,YAAM,IAAI;AAAA,QACR;AAAA,QACA;AAAA,MACF;AAAA,IACF;AACA,UAAM,UAA0B;AAAA,MAC9B,kBAAkB,EAAE,eAAe,KAAK,mBAAmB,QAAS;AAAA,MACpE,eAAe,KAAK;AAAA,MACpB,SAAS,KAAK,UAAU,UAAU;AAAA,MAClC,oBAAoB,WAAW;AAAA,MAC/B,KAAK,WAAW;AAAA,IAClB;AACA,QAAI;AACJ,QAAI,YAAY,QAAW;AACzB,0BAAoB,WAAW,OAAO,SAAS,SAAS,MAAM,MAAM;AAAA,IACtE,OAAO;AACL,UAAI,WAAW,cAAc,QAAW;AACtC,cAAM,IAAI;AAAA,UACR;AAAA,UACA;AAAA,QACF;AAAA,MACF;AACA,0BAAoB,WAAW,UAAU,SAAS;AAAA,QAChD;AAAA,UACE,SAAS,KAAK,UAAU,UAAU;AAAA,UAClC;AAAA,UACA;AAAA,UACA;AAAA,UACA,SAAS,CAAC,OAAO;AAAA,QACnB;AAAA,MACF,CAAC;AAAA,IACH;AACA,UAAM,UAAU,cAAc,iBAAiB;AAC/C,UAAM,WAAW,MAAM,KAAK,UAAU,QAAQ;AAAA,MAC5C,QAAQ;AAAA,MACR,KAAK,GAAG,kBAAkB,KAAK,UAAU,UAAU,QAAQ,CAAC;AAAA,MAC5D;AAAA,MACA,UAAU;AAAA,MACV,0BAA0B,CAAC,GAAG,KAAK,kBAAkB;AAAA,MACrD,GAAI,SAAS,SAAY,CAAC,IAAI,EAAE,KAAK;AAAA,IACvC,CAAC;AACD,SAAK,wBAAwB,UAAU,SAAS;AAChD,WAAO;AAAA,EACT;AAAA,EAEA,MAAc,wBAAqD;AACjE,QAAI,KAAK,aAAa;AACpB,YAAM,IAAI;AAAA,QACR;AAAA,QACA;AAAA,QACA;AAAA,MACF;AAAA,IACF;AACA,QACE,KAAK,uBAAuB,UAC5B,CAAC,KAAK,gBAAgB,KAAK,kBAAkB,GAC7C;AACA,aAAO,KAAK;AAAA,IACd;AACA,QACE,KAAK,sBAAsB,UAC3B,KAAK,kBAAkB,cAAc,KAAK,cAC1C;AACA,YAAM,IAAI;AAAA,QACR;AAAA,QACA;AAAA,QACA;AAAA,MACF;AAAA,IACF;AACA,QAAI;AACF,UAAI;AACJ,YAAM,WAAW,KAAK,IAAI,GAAG,KAAK,mBAAmB;AACrD,eAAS,UAAU,GAAG,UAAU,UAAU,WAAW;AACnD,cAAM,YAAY,MAAM,KAAK,gBAAgB;AAC7C,cAAM,eAAe,MAAM,KAAK,iBAAiB,SAAS;AAC1D,YAAI;AACF,gBAAM,aAAa,MAAM,KAAK,YAAY,WAAW,YAAY;AACjE,eAAK,qBAAqB;AAC1B,iBAAO;AAAA,QACT,SAAS,OAAO;AACd,cACE,EAAE,iBAAiB,6BACnB,MAAM,UAAU,eAChB;AACA,kBAAM;AAAA,UACR;AACA,sBAAY;AAAA,QACd;AACA,YAAI,UAAU,IAAI,UAAU;AAC1B,gBAAM,KAAK,MAAM,WAAW,SAAS,KAAK,OAAO,CAAC,CAAC;AAAA,QACrD;AAAA,MACF;AACA,YAAM,IAAI;AAAA,QACR;AAAA,QACA,qBAAqB,QACjB,UAAU,UACV;AAAA,QACJ;AAAA,MACF;AAAA,IACF,SAAS,OAAO;AACd,WAAK,kBAAkB,KAAK;AAC5B,YAAM;AAAA,IACR;AAAA,EACF;AAAA,EAEQ,kBAAkB,OAAsB;AAC9C,QACE,iBAAiB,4BACjB,MAAM,UAAU,gBAChB;AACA,WAAK,cAAc;AAAA,IACrB;AAAA,EACF;AAAA,EAEA,MAAc,kBAA4D;AACxE,SAAK,gCAAgC;AACrC,UAAM,WAAW,MAAM,KAAK,0BAA0B;AAAA,MACpD,QAAQ;AAAA,MACR,KAAK,GAAG,kBAAkB,KAAK,UAAU,aAAa,QAAQ,CAAC;AAAA,MAC/D,UAAU;AAAA,MACV,0BAA0B,CAAC,GAAG,KAAK,qBAAqB;AAAA,MACxD,MAAM;AAAA,QACJ,UAAU,KAAK,UAAU;AAAA,MAC3B;AAAA,IACF,CAAC;AACD,WAAO;AAAA,MACL,SAAS;AAAA,MACT;AAAA,MACA;AAAA,IACF,EAAE;AAAA,EACJ;AAAA,EAEA,MAAc,iBACZ,WACuC;AACvC,QACE,UAAU,aAAa,KAAK,UAAU,YACtC,UAAU,aAAa,KAAK,UAAU,aAAa,YACnD,UAAU,aAAa,KAAK,UAC5B;AACA,YAAM,IAAI;AAAA,QACR;AAAA,QACA;AAAA,MACF;AAAA,IACF;AACA,QAAI,KAAK,oBAAoB,IAAI,UAAU,KAAK,GAAG;AACjD,YAAM,IAAI;AAAA,QACR;AAAA,QACA;AAAA,MACF;AAAA,IACF;AACA,SAAK,oBAAoB,IAAI,UAAU,KAAK;AAC5C,UAAM,YAAY,IAAI;AAAA,MACpB,KAAK,IAAI,EAAE,QAAQ,IAAI,KAAK,yBAAyB;AAAA,IACvD,EACG,YAAY,EACZ,QAAQ,SAAS,GAAG;AACvB,UAAM,QAAQ;AAAA,MACZ,QAAQ;AAAA,MACR,UAAU,KAAK,UAAU;AAAA,MACzB,oBAAoB,KAAK;AAAA,MACzB,WAAW,KAAK;AAAA,MAChB,eAAe,KAAK;AAAA,MACpB,uBAAuB,KAAK;AAAA,MAC5B,2BAA2B,KAAK;AAAA,MAChC,UAAU,KAAK;AAAA,MACf,OAAO,UAAU;AAAA,MACjB;AAAA,MACA,GAAI,KAAK,aAAa,SAAY,CAAC,IAAI,EAAE,UAAU,KAAK,SAAS;AAAA,IACnE;AACA,UAAM,YACJ,KAAK,kBAAmB,0BAA0B,SAC9C,MAAM,KAAK,kBAAmB,eAAe;AAAA,MAC3C,GAAG;AAAA,MACH,aAAa,UAAU;AAAA,MACvB,UAAU;AAAA,MACV,OAAO,KAAK,kBAAmB;AAAA,IACjC,CAAC,IACD,MAAM,KAAK,kBAAmB,sBAAsB,KAAK;AAC/D,QAAI,OAAO,cAAc,YAAY,UAAU,WAAW,GAAG;AAC3D,YAAM,IAAI;AAAA,QACR;AAAA,QACA;AAAA,MACF;AAAA,IACF;AACA,WAAO;AAAA,MACL,GAAG;AAAA,MACH,iBAAiB;AAAA,QACf,OAAO,KAAK,kBAAmB,SAAS,UAAU,eAAe,CAAC;AAAA,QAClE,WAAW,KAAK;AAAA,QAChB,OAAO;AAAA,MACT;AAAA,IACF;AAAA,EACF;AAAA,EAEA,MAAc,YACZ,WACA,cAC6B;AAC7B,SAAK;AACL,SAAK,gCAAgC;AACrC,UAAM,WAAW,MAAM,KAAK,mBAAmB;AAAA,MAC7C,QAAQ;AAAA,MACR,KAAK,GAAG,kBAAkB,KAAK,UAAU,aAAa,QAAQ,CAAC;AAAA,MAC/D,UAAU;AAAA,MACV,0BAA0B,CAAC,GAAG,KAAK,qBAAqB;AAAA,MACxD,MAAM,EAAE,aAAa;AAAA,IACvB,CAAC;AACD,UAAM,SAAS;AAAA,MACb,SAAS;AAAA,MACT;AAAA,MACA;AAAA,IACF;AACA,WAAO,KAAK,yBAAyB,OAAO,UAAU;AAAA,EACxD;AAAA,EAEA,MAAc,yBACZ,OAC6B;AAC7B,UAAM,SAAS,kCAAkC,KAAK;AACtD,QAAI,OAAO,aAAa,KAAK,UAAU,UAAU;AAC/C,YAAM,IAAI;AAAA,QACR;AAAA,QACA;AAAA,MACF;AAAA,IACF;AACA,QAAI,OAAO,cAAc,KAAK,cAAc;AAC1C,YAAM,IAAI;AAAA,QACR;AAAA,QACA;AAAA,MACF;AAAA,IACF;AACA,QAAI,OAAO,cAAc,KAAK,gBAAgB;AAC5C,YAAM,IAAI;AAAA,QACR;AAAA,QACA;AAAA,MACF;AAAA,IACF;AACA,QAAI,OAAO,gBAAgB,KAAK;AAC9B,YAAM,IAAI;AAAA,QACR;AAAA,QACA;AAAA,MACF;AAAA,IACF;AACA,UAAM,WAAWA,oBAAmB,OAAO,QAAQ;AACnD,UAAM,YAAYA,oBAAmB,OAAO,SAAS;AACrD,QACE,aAAa,YACb,YAAY,WAAW,OAAO,gBAAgB,KAC9C;AACA,YAAM,IAAI;AAAA,QACR;AAAA,QACA;AAAA,MACF;AAAA,IACF;AACA,UAAM,eAAe,OAAO,aAAa;AAAA,MAAI,CAAC,YAAY,UACxD,sBAAsB,YAAY,6BAA6B,KAAK,GAAG;AAAA,IACzE;AACA,eAAW,WAAW,cAAc;AAClC,UACE,CAAC,KAAK,uBAAuB;AAAA,QAAK,CAAC,cACjC,yBAAyB,WAAW,OAAO;AAAA,MAC7C,GACA;AACA,cAAM,IAAI;AAAA,UACR;AAAA,UACA;AAAA,QACF;AAAA,MACF;AAAA,IACF;AACA,QACE,OAAO,OAAO,YAAY,YAC1B,OAAO,QAAQ,MAAM,GAAG,EAAE,WAAW,GACrC;AACA,YAAM,IAAI;AAAA,QACR;AAAA,QACA;AAAA,MACF;AAAA,IACF;AACA,UAAM,aAAa,EAAE,GAAG,QAAQ,aAAa;AAC7C,UAAM,WAAW,MAAM,KAAK,UAAU,QAAQ;AAAA,MAC5C,QAAQ;AAAA,MACR,KAAK,GAAG,kBAAkB,KAAK,UAAU,UAAU,QAAQ,CAAC;AAAA,MAC5D,SAAS,EAAE,eAAe,OAAO,QAAQ;AAAA,MACzC,UAAU;AAAA,MACV,0BAA0B,CAAC,GAAG,KAAK,kBAAkB;AAAA,IACvD,CAAC;AACD,SAAK,wBAAwB,UAAU,WAAW;AAClD,UAAM,UAAU,qBAAqB,QAAQ;AAC7C,UAAM,SAAS,KAAK,UAAU,UAAU;AACxC,QACE,CAAC,QAAQ,UAAU,SAAS,MAAM,KAClC,QAAQ,QAAQ,SAAS,MAAM,GAC/B;AACA,YAAM,IAAI;AAAA,QACR;AAAA,QACA,QAAQ,UAAU,SAAS,MAAM,KAAK,QAAQ,QAAQ,SAAS,MAAM,IACjE,2DACA;AAAA,MACN;AAAA,IACF;AACA,SAAK,wBAAwB,oBAAoB,OAAO,OAAO;AAC/D,WAAO;AAAA,EACT;AAAA,EAEQ,wBACN,UACA,MACM;AACN,SAAK;AAAA,MACH;AAAA,MACA,KAAK,UAAU,UAAU;AAAA,MACzB;AAAA,MACA,KAAK;AAAA,MACL;AAAA,IACF;AAAA,EACF;AAAA,EAEQ,kCAAwC;AAC9C,QAAI,KAAK,iCAAiC,KAAK,IAAI,EAAE,QAAQ,GAAG;AAC9D,YAAM,IAAI;AAAA,QACR;AAAA,QACA;AAAA,QACA;AAAA,MACF;AAAA,IACF;AAAA,EACF;AAAA,EAEQ,2BACN,UACA,MACM;AACN,SAAK;AAAA,MACH;AAAA,MACA,KAAK,UAAU,aAAa;AAAA,MAC5B;AAAA,MACA,KAAK;AAAA,MACL;AAAA,IACF;AAAA,EACF;AAAA,EAEQ,uBACN,UACA,UACA,MACA,kBACA,MACM;AACN,UAAM,WAAW,GAAG,kBAAkB,QAAQ,CAAC,GAAG,IAAI;AACtD,UAAM,QAAQ,CAAC,YAAoB,cAAc,MAAM,OAAO;AAC9D,QACE,SAAS,aAAa,YACtB,SAAS,oBAAoB,QAC7B;AACA,YAAM;AAAA,QACJ,GAAG,IAAI;AAAA,MACT;AAAA,IACF;AACA,QAAI,CAAC,iBAAiB,IAAI,YAAY,SAAS,eAAe,CAAC,GAAG;AAChE,YAAM,MAAM,GAAG,IAAI,4CAA4C;AAAA,IACjE;AAAA,EACF;AAAA,EAEQ,4BACN,YACA,WACM;AACN,QAAI,KAAK,gBAAgB,UAAU,GAAG;AACpC,YAAM,IAAI;AAAA,QACR;AAAA,QACA;AAAA,QACA;AAAA,MACF;AAAA,IACF;AACA,QACE,CAAC,WAAW,aAAa;AAAA,MAAK,CAAC,YAC7B,yBAAyB,SAAS,SAAS;AAAA,IAC7C,GACA;AACA,YAAM,IAAI;AAAA,QACR;AAAA,QACA;AAAA,QACA;AAAA,MACF;AAAA,IACF;AAAA,EACF;AAAA,EAEQ,iCACN,YACA,WACkB;AAClB,UAAM,aAAa,WAAW,aAAa;AAAA,MACzC,CAAC,eACC,WAAW,YAAY,mBACvB,WAAW,QAAQ,SAAS,oBAAoB;AAAA,IACpD;AACA,QAAI,eAAe,QAAW;AAC5B,YAAM,IAAI;AAAA,QACR;AAAA,QACA;AAAA,QACA;AAAA,MACF;AAAA,IACF;AACA,QAAI,WAAW,YAAY,QAAW;AACpC,YAAM,aACJ,WAAW,QAOX;AACF,YAAM,0BAA0B,YAAY;AAAA,QAC1C,CAAC,cACC,UAAU,SAAS,UAAU,QAC7B,UAAU,QAAQ,UAAU,OAC5B,MAAM,QAAQ,UAAU,WAAW,KACnC,gBAAgB,UAAU,WAAW,MACnC,gBAAgB,UAAU,WAAW;AAAA,MAC3C;AACA,UAAI,CAAC,yBAAyB;AAC5B,cAAM,IAAI;AAAA,UACR;AAAA,UACA;AAAA,UACA;AAAA,QACF;AAAA,MACF;AACA,aAAO;AAAA,IACT;AACA,WAAO;AAAA,MACL;AAAA,QACE,SAAS;AAAA,QACT,OAAO,WAAW;AAAA,QAClB,MAAM,WAAW;AAAA,QACjB,SAAS,CAAC,oBAAoB;AAAA,MAChC;AAAA,MACA;AAAA,IACF;AAAA,EACF;AAAA,EAEQ,gBAAgB,YAAyC;AAC/D,UAAM,YAAYA,oBAAmB,WAAW,SAAS;AACzD,WACE,YAAY,KAAK,IAAI,EAAE,QAAQ,KAAK,gCAAgC;AAAA,EAExE;AAAA,EAEA,MAAc,0BACZ,SACgC;AAChC,QAAI;AACJ,UAAM,WAAW,KAAK,IAAI,GAAG,KAAK,mBAAmB;AACrD,aAAS,UAAU,GAAG,UAAU,UAAU,WAAW;AACnD,UAAI;AACF,cAAM,WAAW,MAAM,KAAK,UAAU,QAAQ,OAAO;AACrD,aAAK,2BAA2B,UAAU,sBAAsB;AAChE,YAAI,SAAS,UAAU,KAAK;AAC1B,sBAAY,IAAI,MAAM,mBAAmB,SAAS,MAAM,EAAE;AAAA,QAC5D,WAAW,SAAS,UAAU,KAAK;AACjC,gBAAM,SAAS,gBAAgB,SAAS,IAAI;AAC5C,cAAI,WAAW,QAAW;AACxB,kBAAM,eAAe,QAAQ,SAAS,MAAM;AAAA,UAC9C;AACA,gBAAM,IAAI;AAAA,YACR;AAAA,YACA;AAAA,UACF;AAAA,QACF,OAAO;AACL,iBAAO;AAAA,QACT;AAAA,MACF,SAAS,OAAO;AACd,YACE,iBAAiB,4BACjB,MAAM,UAAU,eAChB;AACA,gBAAM;AAAA,QACR;AACA,oBAAY;AAAA,MACd;AACA,UAAI,UAAU,IAAI,UAAU;AAC1B,cAAM,KAAK,MAAM,WAAW,SAAS,KAAK,OAAO,CAAC,CAAC;AAAA,MACrD;AAAA,IACF;AACA,UAAM,IAAI;AAAA,MACR;AAAA,MACA,qBAAqB,QACjB,UAAU,UACV;AAAA,MACJ;AAAA,IACF;AAAA,EACF;AAAA,EAEA,MAAc,mBACZ,SACgC;AAChC,QAAI;AACF,YAAM,WAAW,MAAM,KAAK,UAAU,QAAQ,OAAO;AACrD,WAAK,2BAA2B,UAAU,oBAAoB;AAC9D,UAAI,SAAS,UAAU,KAAK;AAC1B,cAAM,IAAI;AAAA,UACR;AAAA,UACA,mBAAmB,SAAS,MAAM;AAAA,UAClC;AAAA,QACF;AAAA,MACF;AACA,UAAI,SAAS,UAAU,KAAK;AAC1B,cAAM,SAAS,gBAAgB,SAAS,IAAI;AAC5C,YAAI,WAAW,QAAW;AACxB,gBAAM,eAAe,QAAQ,SAAS,MAAM;AAAA,QAC9C;AACA,cAAM,IAAI;AAAA,UACR;AAAA,UACA;AAAA,QACF;AAAA,MACF;AACA,aAAO;AAAA,IACT,SAAS,OAAO;AACd,UAAI,iBAAiB,0BAA0B;AAC7C,cAAM;AAAA,MACR;AACA,YAAM,IAAI;AAAA,QACR;AAAA,QACA,iBAAiB,QAAQ,MAAM,UAAU;AAAA,QACzC;AAAA,MACF;AAAA,IACF;AAAA,EACF;AACF;AAEA,eAAsB,0BACpB,SAC8B;AAC9B,SAAO,oBAAoB,OAAO,OAAO;AAC3C;AAEA,SAAS,eAAe,OAEtB;AACA,QAAM,aAAa,kBAAkB,OAAO,+BAA+B;AAC3E,QAAM,SAAS,gBAAgB,UAAU,UAAU;AACnD,MAAI,CAAC,OAAO,SAAS;AACnB,UAAM,IAAI;AAAA,MACR,OAAO,MAAM,OAAO,KAAK,CAAC,UAAU,MAAM,SAAS,mBAAmB,IAClE,oCACA;AAAA,MACJ,OAAO,MAAM;AAAA,MACb;AAAA,IACF;AAAA,EACF;AACA,SAAO,OAAO;AAKhB;AAEA,eAAe,yBACb,WACA,SACA;AACA,MAAI;AACF,WAAO,MAAM,qCAAqC;AAAA,MAChD,cAAc,UAAU,aAAa;AAAA,MACrC,UAAU,QAAQ;AAAA,MAClB,UAAU,QAAQ;AAAA,MAClB,gBAAgB,QAAQ;AAAA,MACxB,MAAM,QAAQ,QAAQ,MAAM,oBAAI,KAAK,IAAI,EACtC,YAAY,EACZ,QAAQ,SAAS,GAAG;AAAA,MACvB,uBAAuB;AAAA,MACvB,0BAA0B;AAAA,IAC5B,CAAC;AAAA,EACH,SAAS,OAAO;AACd,UAAM,OAAO,0BAA0B,KAAK;AAC5C,UAAM,IAAI;AAAA,MACR;AAAA,MACA,iBAAiB,QAAQ,MAAM,UAAU,OAAO,KAAK;AAAA,MACrD;AAAA,IACF;AAAA,EACF;AACF;AAEA,SAAS,0BACP,OAC8B;AAC9B,QAAM,OACJ,OAAO,UAAU,YAAY,UAAU,QAAQ,UAAU,QACpD,MAA6B,OAC9B;AACN,MAAI,SAAS,0CAA0C;AACrD,WAAO;AAAA,EACT;AACA,MAAI,SAAS,uCAAuC;AAClD,WAAO;AAAA,EACT;AACA,MAAI,SAAS,0CAA0C;AACrD,WAAO;AAAA,EACT;AACA,SAAO;AACT;AAEA,SAAS,sBAAsB,OAAgB,MAAgC;AAC7E,MAAI;AACF,WAAO;AAAA,MACL;AAAA,IACF;AAAA,EACF,SAAS,OAAO;AACd,UAAM,IAAI;AAAA,MACR;AAAA,MACA,GAAG,IAAI,KAAK,iBAAiB,QAAQ,MAAM,UAAU,OAAO,KAAK,CAAC;AAAA,IACpE;AAAA,EACF;AACF;AAEA,SAAS,8BACP,eACoB;AACpB,MAAI,OAAO,kBAAkB,UAAU;AACrC,UAAM,IAAI;AAAA,MACR;AAAA,MACA;AAAA,MACA;AAAA,IACF;AAAA,EACF;AACA,QAAM,YAAY,6BAA6B,IAAI,aAAa;AAChE,MAAI,cAAc,QAAW;AAC3B,UAAM,IAAI;AAAA,MACR;AAAA,MACA;AAAA,MACA;AAAA,IACF;AAAA,EACF;AACA,SAAO;AACT;AAEA,SAAS,sCACP,OACkB;AAClB,QAAM,aAAa,kBAAkB,OAAO,8BAA8B;AAC1E,SAAO,0BAA0B,UAAU;AAC7C;AAEA,SAAS,0BACP,cACQ;AACR,QAAM,YAAY,CAAC,GAAG,YAAY,EAAE;AAAA,IAAK,CAAC,MAAM,UAC9C,GAAG,KAAK,OAAO,KAAK,KAAK,KAAK,KAAK,KAAK,IAAI,GAAG;AAAA,MAC7C,GAAG,MAAM,OAAO,KAAK,MAAM,KAAK,KAAK,MAAM,IAAI;AAAA,IACjD;AAAA,EACF;AACA,QAAM,UAAU,IAAI,YAAY;AAChC,QAAM,SAAS,QAAQ;AAAA,IACrB;AAAA,EACF;AACA,QAAM,OAAO,QAAQ,OAAO,gBAAgB,SAAS,CAAC;AACtD,QAAM,QAAQ,IAAI,WAAW,OAAO,SAAS,KAAK,MAAM;AACxD,QAAM,IAAI,QAAQ,CAAC;AACnB,QAAM,IAAI,MAAM,OAAO,MAAM;AAC7B,aAAO,6BAAW,qBAAO,OAAO,OAAO,CAAC,EAAE,MAAM,CAAC;AACnD;AAEA,SAAS,wBACP,YAC0B;AAC1B,QAAM,SAAS,kCAAkC,WAAW,OAAO;AACnE,QAAM,UAAU,CAAC,UAAyB;AACxC,UAAM,IAAI;AAAA,MACR;AAAA,MACA,uBAAuB,KAAK;AAAA,IAC9B;AAAA,EACF;AACA,MAAI,WAAW,iBAAiB,oBAAoB,WAAW,OAAO;AACpE,YAAQ,cAAc;AACxB,MAAI,WAAW,cAAc,OAAO,UAAW,SAAQ,WAAW;AAClE,MAAI,WAAW,cAAc,OAAO,UAAW,SAAQ,WAAW;AAClE,MAAI,WAAW,aAAa,OAAO,SAAU,SAAQ,UAAU;AAC/D,MAAI,KAAK,MAAM,WAAW,QAAQ,MAAM,OAAO;AAC7C,YAAQ,UAAU;AACpB,MAAI,KAAK,MAAM,WAAW,SAAS,MAAM,OAAO;AAC9C,YAAQ,WAAW;AACrB,MAAI,WAAW,aAAa,OAAO,SAAU,SAAQ,UAAU;AAC/D,MAAI,WAAW,eAAe,OAAO,WAAY,SAAQ,YAAY;AACrE,MAAI,WAAW,sBAAsB,OAAO;AAC1C,YAAQ,mBAAmB;AAC7B,MAAI,WAAW,mBAAmB,OAAO;AACvC,YAAQ,gBAAgB;AAC1B,SAAO;AAAA,IACL,cAAc,oBAAoB,WAAW,OAAO;AAAA,IACpD,WAAW,OAAO;AAAA,IAClB,WAAW,OAAO;AAAA,IAClB,UAAU,OAAO;AAAA,IACjB,UAAU,IAAI,KAAK,OAAO,UAAU,EAAE,YAAY,EAAE,QAAQ,SAAS,GAAG;AAAA,IACxE,WAAW,IAAI,KAAK,OAAO,WAAW,EAAE,YAAY,EAAE,QAAQ,SAAS,GAAG;AAAA,IAC1E,UAAU,OAAO;AAAA,IACjB,eAAe,KAAK,MAAM,OAAO,cAAc,OAAO,cAAc,GAAI;AAAA,IACxE,cAAc,OAAO;AAAA,IACrB,SAAS,WAAW;AAAA,EACtB;AACF;AAQO,SAAS,kCACd,OACoB;AACpB,SAAO;AAAA,IACL,mBAAmB,OAAO,sBAAsB,qBAAqB;AAAA,EACvE;AACF;AAEA,SAAS,kCAAkC,SAWzC;AACA,MAAI;AACF,UAAM,QAAQ,QAAQ,MAAM,GAAG;AAC/B,QAAI,MAAM,WAAW,EAAG,OAAM,IAAI,MAAM,iBAAiB;AACzD,UAAM,UAAU;AAAA,MACd,KAAK,MAAM,IAAI,YAAY,EAAE,OAAO,eAAe,MAAM,CAAC,CAAE,CAAC,CAAC;AAAA,IAChE;AACA,UAAM,SAAS,sBAAsB,SAAS,KAAK;AACnD,UAAM,YAAY,sBAAsB,SAAS,KAAK;AACtD,UAAM,WAAW,qBAAqB,SAAS,KAAK;AACpD,UAAM,YAAY,qBAAqB,SAAS,KAAK;AACrD,UAAM,QAAQ,QAAQ;AACtB,QAAI,CAAC,MAAM,QAAQ,KAAK,EAAG,OAAM,IAAI,MAAM,oBAAoB;AAC/D,UAAM,iBAAiB,MAAM;AAAA,MAC3B,CAACE,UACCA,UAAS,QACT,OAAOA,UAAS,YAChB,CAAC,MAAM,QAAQA,KAAI,KACnB,mCAAmCA;AAAA,IACvC;AACA,QAAI,eAAe,WAAW;AAC5B,YAAM,IAAI,MAAM,0CAA0C;AAC5D,UAAM,OAAO,eAAe,CAAC;AAC7B,UAAM,WAAW;AAAA,MACf;AAAA,MACA;AAAA,IACF;AACA,UAAM,aAAa;AAAA,MACjB;AAAA,MACA;AAAA,IACF;AACA,UAAM,oBAAoB;AAAA,MACxB;AAAA,MACA;AAAA,IACF;AACA,QAAI,CAAC,iBAAiB,KAAK,iBAAiB,GAAG;AAC7C,YAAM,IAAI;AAAA,QACR;AAAA,MACF;AAAA,IACF;AACA,UAAM,iBAAiB;AAAA,MACrB;AAAA,MACA;AAAA,IACF;AACA,UAAM,iBAAiB;AAAA,MACrB;AAAA,MACA;AAAA,IACF;AACA,QAAI,mBAAmB;AACrB,YAAM,IAAI,MAAM,kCAAkC;AACpD,QAAI,mBAAmB;AACrB,YAAM,IAAI,MAAM,iCAAiC;AACnD,UAAM,MAAM,QAAQ;AACpB,QAAI,QAAQ,QAAQ,OAAO,QAAQ,YAAY,MAAM,QAAQ,GAAG,GAAG;AACjE,YAAM,IAAI,MAAM,oBAAoB;AAAA,IACtC;AACA,UAAM,eAAmC,CAAC;AAC1C,eAAW,CAAC,UAAU,YAAY,KAAK,OAAO,QAAQ,GAAG,GAAG;AAC1D,UACE,iBAAiB,QACjB,OAAO,iBAAiB,YACxB,MAAM,QAAQ,YAAY,GAC1B;AACA,cAAM,IAAI,MAAM,gCAAgC;AAAA,MAClD;AACA,YAAM,YAAY;AAClB,YAAM,SAAS,SAAS,QAAQ,OAAO;AACvC,UAAI,CAAC,SAAS,WAAW,YAAY,KAAK,SAAS;AACjD,cAAM,IAAI,MAAM,2BAA2B;AAC7C,YAAM,QAAQ,SAAS,MAAM,GAAG,MAAM;AACtC,YAAM,OAAO,SAAS,MAAM,SAAS,QAAQ,MAAM;AACnD,iBAAW,CAAC,QAAQ,UAAU,KAAK,OAAO,QAAQ,SAAS,GAAG;AAC5D,cAAM,UAAU,OAAO,WAAW,gBAAgB,IAC9C,kBACA,OAAO,WAAW,eAAe,IAC/B,iBACA;AACN,YAAI,CAAC,MAAM,QAAQ,UAAU,KAAK,WAAW,WAAW,GAAG;AACzD,gBAAM,IAAI,MAAM,kDAAkD;AAAA,QACpE;AACA,cAAM,UAAU;AAChB,YAAI,YAAY,OAAW,OAAM,IAAI,MAAM,0BAA0B;AACrE,cAAM,QAAQ,QAAQ,CAAC;AACvB,qBAAa;AAAA,UACX,0BAA0B;AAAA,YACxB;AAAA,YACA;AAAA,YACA;AAAA,YACA,SAAS,CAAC,MAAM;AAAA,YAChB,GAAI,UAAU,QACd,OAAO,UAAU,YACjB,CAAC,MAAM,QAAQ,KAAK,KACpB,OAAO,KAAK,KAAK,EAAE,SAAS,IACxB,EAAE,SAAS,MAAM,IACjB,CAAC;AAAA,UACP,CAAC;AAAA,QACH;AAAA,MACF;AAAA,IACF;AACA,QAAI,aAAa,WAAW,EAAG,OAAM,IAAI,MAAM,mBAAmB;AAClE,UAAM,WAAW,OAAO,QAAQ,GAAG;AACnC,UAAM,YAAY,WAAW,IAAI,SAAS,OAAO,MAAM,GAAG,QAAQ;AAClE,QAAI,CAAC,UAAU,WAAW,MAAM,KAAK,CAAC,UAAU,WAAW,MAAM,GAAG;AAClE,YAAM,IAAI,MAAM,sCAAsC;AAAA,IACxD;AACA,WAAO;AAAA,MACL;AAAA,MACA;AAAA,MACA;AAAA,MACA;AAAA,MACA;AAAA,MACA;AAAA,MACA,YAAY,WAAW;AAAA,MACvB,aAAa,YAAY;AAAA,MACzB,UAAU;AAAA,MACV;AAAA,IACF;AAAA,EACF,SAAS,OAAO;AACd,UAAM,IAAI;AAAA,MACR;AAAA,MACA,qDAAqD,iBAAiB,QAAQ,MAAM,UAAU,OAAO,KAAK,CAAC;AAAA,IAC7G;AAAA,EACF;AACF;AAEA,SAAS,sBACP,SACA,KACQ;AACR,QAAM,QAAQ,QAAQ,GAAG;AACzB,MAAI,OAAO,UAAU,YAAY,MAAM,WAAW,GAAG;AACnD,UAAM,IAAI,MAAM,QAAQ,GAAG,4BAA4B;AAAA,EACzD;AACA,SAAO;AACT;AAEA,SAAS,qBACP,SACA,KACQ;AACR,QAAM,QAAQ,QAAQ,GAAG;AACzB,MAAI,OAAO,UAAU,YAAY,CAAC,OAAO,cAAc,KAAK,KAAK,QAAQ,GAAG;AAC1E,UAAM,IAAI,MAAM,QAAQ,GAAG,sCAAsC;AAAA,EACnE;AACA,SAAO;AACT;AAEA,SAAS,eAAe,OAA2B;AACjD,QAAM,aAAa,MAAM,QAAQ,MAAM,GAAG,EAAE,QAAQ,MAAM,GAAG;AAC7D,QAAM,SAAS,WAAW,OAAO,KAAK,KAAK,WAAW,SAAS,CAAC,IAAI,GAAG,GAAG;AAC1E,QAAM,SAAS,KAAK,MAAM;AAC1B,SAAO,WAAW,KAAK,QAAQ,CAAC,cAAc,UAAU,WAAW,CAAC,CAAC;AACvE;AAEA,SAAS,mBACP,OACA,QACA,OACG;AACH,QAAM,aAAa;AAAA,IACjB;AAAA,IACA;AAAA,EACF;AACA,QAAM,SAAS,gBAAgB,UAAU;AACzC,MAAI,WAAW,QAAW;AACxB,UAAM,eAAe,MAAM;AAAA,EAC7B;AACA,QAAM,SAAS,OAAO,UAAU,UAAU;AAC1C,MAAI,CAAC,OAAO,SAAS;AACnB,UAAM,IAAI;AAAA,MACR;AAAA,MACA,GAAG,KAAK,uBAAuB,OAAO,MAAM,OAAO;AAAA,IACrD;AAAA,EACF;AACA,SAAO,OAAO;AAChB;AA2CA,SAAS,qBACP,UACuC;AACvC,MAAI,SAAS,WAAW,KAAK;AAC3B,UAAM,IAAI;AAAA,MACR;AAAA,MACA,yCAAyC,SAAS,MAAM;AAAA,MACxD,SAAS,UAAU,MAAM,YAAY;AAAA,MACrC;AAAA,MACA,SAAS;AAAA,IACX;AAAA,EACF;AACA,QAAM,aAAa;AAAA,IACjB,SAAS;AAAA,IACT;AAAA,EACF;AACA,QAAM,SAAS,sBAAsB,UAAU,UAAU;AACzD,MAAI,CAAC,OAAO,SAAS;AACnB,UAAM,IAAI;AAAA,MACR;AAAA,MACA,oDAAoD,OAAO,MAAM,OAAO;AAAA,IAC1E;AAAA,EACF;AACA,SAAO,OAAO;AAChB;AAEA,SAAS,sBACP,UACA,QACA,OACG;AACH,MAAI,SAAS,UAAU,KAAK;AAC1B,UAAM,IAAI;AAAA,MACR;AAAA,MACA,GAAG,KAAK,kBAAkB,SAAS,MAAM,KAAK,iBAAiB,SAAS,IAAI,CAAC;AAAA,MAC7E;AAAA,MACA;AAAA,MACA,SAAS;AAAA,IACX;AAAA,EACF;AACA,MAAI,SAAS,UAAU,KAAK;AAC1B,UAAM,IAAI;AAAA,MACR;AAAA,MACA,GAAG,KAAK,iBAAiB,iBAAiB,SAAS,IAAI,CAAC;AAAA,MACxD;AAAA,MACA;AAAA,MACA,SAAS;AAAA,IACX;AAAA,EACF;AACA,QAAM,aAAa;AAAA,IACjB,SAAS;AAAA,IACT;AAAA,EACF;AACA,QAAM,SAAS,OAAO,UAAU,UAAU;AAC1C,MAAI,CAAC,OAAO,SAAS;AACnB,UAAM,IAAI;AAAA,MACR;AAAA,MACA,GAAG,KAAK,qCAAqC,OAAO,MAAM,OAAO;AAAA,IACnE;AAAA,EACF;AACA,SAAO,OAAO;AAChB;AAEA,SAAS,iBAAiB,MAAuB;AAC/C,MAAI,OAAO,SAAS,SAAU,QAAO;AACrC,MAAI,SAAS,QAAQ,OAAO,SAAS,UAAU;AAC7C,UAAM,SAAS;AACf,UAAM,OAAO,OAAO,OAAO,SAAS,WAAW,OAAO,OAAO;AAC7D,UAAM,UACJ,OAAO,OAAO,YAAY,WAAW,OAAO,UAAU;AACxD,QAAI,SAAS;AACX,aAAO,YAAY,SAAY,OAAO,GAAG,IAAI,KAAK,OAAO;AAAA,EAC7D;AACA,SAAO;AACT;AAEO,SAAS,oBAAoB,SAAyB;AAC3D,QAAM,aAAS,cAAAC,QAAa,QAAM,sBAAO,IAAI,YAAY,EAAE,OAAO,OAAO,CAAC,CAAC;AAC3E,SAAO,eAAI,SAAS,IAAM,MAAM,EAAE,SAAS;AAC7C;AAEA,SAAS,cAAc,SAAiD;AACtE,SAAO,MAAM,QAAQ,OAAO,IAAI,OAAO,YAAY,OAAO,IAAI;AAChE;AAEA,eAAe,4BACb,UACA,WAC8B;AAC9B,SAAO,iCAAiC,UAAU,WAAW,YAAY;AAC3E;AAEA,eAAe,iCACb,UACA,WACA,MAC8B;AAC9B,MAAI;AACJ,MAAI;AACF,UAAM,IAAI,IAAI,QAAQ;AAAA,EACxB,QAAQ;AACN,UAAM,cAAc,MAAM,GAAG,IAAI,wBAAwB;AAAA,EAC3D;AACA,MACE,IAAI,aAAa,YACjB,IAAI,aAAa,MACjB,IAAI,aAAa,MACjB,IAAI,SAAS,MACb,IAAI,WAAW,IACf;AACA,UAAM;AAAA,MACJ;AAAA,MACA,GAAG,IAAI;AAAA,IACT;AAAA,EACF;AACA,MAAI,UAAU,oBAAoB,QAAW;AAC3C,UAAM;AAAA,MACJ;AAAA,MACA,GAAG,IAAI;AAAA,IACT;AAAA,EACF;AACA,MAAI;AACJ,MAAI;AACF,iBAAa,MAAM,UAAU,gBAAgB,IAAI,MAAM;AAAA,EACzD,SAAS,OAAO;AACd,UAAM;AAAA,MACJ;AAAA,MACA,GAAG,IAAI,gCAAgC,iBAAiB,QAAQ,MAAM,UAAU,OAAO,KAAK,CAAC;AAAA,IAC/F;AAAA,EACF;AACA,MAAI,WAAW,UAAU,WAAW,GAAG;AACrC,UAAM,cAAc,MAAM,GAAG,IAAI,oCAAoC;AAAA,EACvE;AACA,QAAM,YAAY,oBAAI,IAAY;AAClC,aAAW,WAAW,WAAW,WAAW;AAC1C,UAAM,aAAa,YAAY,OAAO;AACtC,QAAI,CAAC,WAAW,UAAU,GAAG;AAC3B,YAAM;AAAA,QACJ;AAAA,QACA,GAAG,IAAI,+CAA+C,OAAO;AAAA,MAC/D;AAAA,IACF;AACA,cAAU,IAAI,UAAU;AAAA,EAC1B;AACA,SAAO;AACT;AAEA,SAAS,cACP,MACA,SAC0B;AAC1B,SAAO,IAAI;AAAA,IACT,SAAS,eACL,0CACA;AAAA,IACJ;AAAA,IACA;AAAA,EACF;AACF;AAEA,SAAS,YAAY,OAAuB;AAC1C,SAAO,MAAM,YAAY,EAAE,QAAQ,YAAY,EAAE;AACnD;AAEA,SAAS,WAAW,OAAwB;AAC1C,QAAM,KAAK,YAAY,KAAK;AAC5B,QAAM,QAAQ,GAAG,MAAM,GAAG;AAC1B,MACE,MAAM,WAAW,KACjB,MAAM,MAAM,CAAC,SAAS,QAAQ,KAAK,IAAI,KAAK,OAAO,IAAI,KAAK,GAAG,GAC/D;AACA,UAAM,CAAC,GAAG,CAAC,IAAI,MAAM,IAAI,MAAM;AAC/B,WAAO,EACL,MAAM,KACN,MAAM,MACN,MAAM,OACL,MAAM,OAAO,KAAK,MAAM,KAAK,OAC7B,MAAM,OAAO,MAAM,OACnB,MAAM,OAAO,KAAK,MAAM,KAAK,MAC7B,MAAM,OAAO,MAAM,KACnB,MAAM,OAAO,MAAM,OACnB,MAAM,QAAQ,MAAM,MAAM,MAAM,OAChC,MAAM,OAAO,MAAM,MAAM,MAAM,CAAC,MAAM,SACtC,MAAM,OAAO,MAAM,KAAK,MAAM,CAAC,MAAM,SACtC,KAAK;AAAA,EAET;AACA,MAAI,CAAC,GAAG,SAAS,GAAG,EAAG,QAAO;AAC9B,MACE,OAAO,QACP,OAAO,SACP,GAAG,WAAW,WAAW,KACzB,GAAG,WAAW,KAAK,KACnB,GAAG,WAAW,KAAK,KACnB,GAAG,WAAW,KAAK,KACnB,GAAG,WAAW,KAAK,KACnB,GAAG,WAAW,IAAI,KAClB,GAAG,WAAW,IAAI,KAClB,GAAG,WAAW,IAAI;AAElB,WAAO;AACT,QAAM,SAAS,GAAG,MAAM,+BAA+B;AACvD,MAAI,WAAW,KAAM,QAAO,WAAW,OAAO,CAAC,CAAE;AACjD,QAAM,YAAY,GAAG,MAAM,0CAA0C;AACrE,MAAI,cAAc,MAAM;AACtB,UAAM,OAAO,OAAO,SAAS,UAAU,CAAC,GAAI,EAAE;AAC9C,UAAM,MAAM,OAAO,SAAS,UAAU,CAAC,GAAI,EAAE;AAC7C,WAAO,WAAW,GAAG,QAAQ,CAAC,IAAI,OAAO,GAAG,IAAI,OAAO,CAAC,IAAI,MAAM,GAAG,EAAE;AAAA,EACzE;AACA,SAAO;AACT;AAEA,SAAS,gBACP,OAGY;AACZ,QAAM,aAAa;AAAA,IACjB;AAAA,IACA;AAAA,EACF;AACA,QAAM,SAAS,aAAa,UAAU,UAAU;AAChD,MAAI,OAAO,SAAS;AAClB,WAAO,EAAE,MAAM,OAAO,KAAK,MAAM,SAAS,OAAO,KAAK,QAAQ;AAAA,EAChE;AACA,QAAM,WAAW,0BAA0B,UAAU,UAAU;AAC/D,MAAI,SAAS,SAAS;AACpB,WAAO;AAAA,MACL,MAAM,SAAS,KAAK,MAAM;AAAA,MAC1B,SAAS,SAAS,KAAK,MAAM;AAAA,IAC/B;AAAA,EACF;AACA,SAAO;AACT;AAEA,SAAS,eACP,QACA,QAC0B;AAC1B,QAAM,cACJ,OAAO,SAAS,qBAChB,OAAO,SAAS,oBAChB,OAAO,SAAS;AAClB,SAAO,IAAI;AAAA,IACT,wBAAwB,OAAO,IAAI;AAAA,IACnC,OAAO,WAAW,wBAAwB,OAAO,IAAI;AAAA,IACrD,cAAc,iBAAiB;AAAA,IAC/B,OAAO;AAAA,IACP;AAAA,EACF;AACF;AAEA,SAAS,WAAW,SAAiB,QAAwB;AAC3D,QAAM,OAAO,KAAK,IAAI,qCAAqC,KAAK,KAAK,OAAO;AAC5E,SAAO,KAAK;AAAA,IACV;AAAA,IACA,KAAK,MAAM,QAAQ,MAAM,OAAO;AAAA,EAClC;AACF;AAEA,SAAS,kBAAkB,OAAuB;AAChD,SAAO,MAAM,SAAS,GAAG,IAAI,MAAM,MAAM,GAAG,EAAE,IAAI;AACpD;AAEA,SAAS,kBACP,OACA,MACS;AACT,MAAI;AACF,WAAO,cAAc,KAAK;AAAA,EAC5B,SAAS,OAAO;AACd,UAAM,IAAI;AAAA,MACR;AAAA,MACA,iBAAiB,QAAQ,MAAM,UAAU,OAAO,KAAK;AAAA,IACvD;AAAA,EACF;AACF;AAEA,SAASC,oBAAmB,OAAmC;AAC7D,MACE,CAAC,+EAA+E;AAAA,IAC9E;AAAA,EACF,GACA;AACA,WAAO;AAAA,EACT;AACA,QAAM,SAAS,KAAK,MAAM,KAAK;AAC/B,MAAI,OAAO,MAAM,MAAM,GAAG;AACxB,WAAO;AAAA,EACT;AACA,QAAM,YAAY,IAAI,KAAK,MAAM,EAAE,YAAY,EAAE,QAAQ,SAAS,GAAG;AACrE,QAAM,WAAW,KAAK,MAAM,KAAK;AACjC,SAAO,KAAK,MAAM,SAAS,MAAM,WAAW,SAAS;AACvD;","names":["import_viem","output","objectHasOwn","objectHasOwn","import_viem","import_viem","textEncoder","objectHasOwn","requiredString","assertExactKeys","requiredString","requiredValue","hasOwn","requiredArray","requiredArray","requiredValue","assertExactKeys","requiredString","hasOwn","textEncoder","hasOwn","requiredString","assertExactKeys","requiredValue","hasOwn","requiredString","requiredArray","objectHasOwn","expectObject","assertExactKeys","hasOwn","requiredString","assertExactKeys","requiredValue","hasOwn","requiredString","objectHasOwn","hasOwn","parseStrictRfc3339","requestedCapabilitiesHash","fact","createDigest","parseStrictRfc3339"]}
+{"version":3,"sources":["../../src/requester/index.ts","../../../../node_modules/multiformats/src/bases/base32.ts","../../../../node_modules/multiformats/src/bytes.ts","../../../../node_modules/multiformats/src/vendor/base-x.js","../../../../node_modules/multiformats/src/bases/base.ts","../../../../node_modules/multiformats/src/bases/base36.ts","../../../../node_modules/multiformats/src/bases/base58.ts","../../../../node_modules/multiformats/src/vendor/varint.js","../../../../node_modules/multiformats/src/varint.ts","../../../../node_modules/multiformats/src/hashes/digest.ts","../../../../node_modules/multiformats/src/cid.ts","../../src/policy/errors.ts","../../src/policy/jcs.ts","../../src/policy/capability.ts","../../src/policy/signed-object.ts","../../../../node_modules/multiformats/src/bases/base10.ts","../../../../node_modules/multiformats/src/bases/base16.ts","../../../../node_modules/multiformats/src/bases/base2.ts","../../../../node_modules/multiformats/src/bases/base256emoji.ts","../../../../node_modules/multiformats/src/bases/base64.ts","../../../../node_modules/multiformats/src/bases/base8.ts","../../../../node_modules/multiformats/src/bases/identity.ts","../../../../node_modules/multiformats/src/codecs/json.ts","../../../../node_modules/multiformats/src/hashes/identity.ts","../../../../node_modules/multiformats/src/hashes/sha2.ts","../../../../node_modules/multiformats/src/hashes/hasher.ts","../../../../node_modules/multiformats/src/basics.ts","../../src/identity.ts","../../src/policy/authoring.ts"],"sourcesContent":["import { bytesToHex, sha256 } from \"viem\";\nimport { blake3 } from \"@noble/hashes/blake3\";\nimport { CID } from \"multiformats/cid\";\nimport { create as createDigest } from \"multiformats/hashes/digest\";\nimport type {\n  InvokeAnyFunction,\n  InvokeFunction,\n  ServiceHeaders,\n  ServiceSession,\n} from \"@tinycloud/sdk-services\";\nimport { z } from \"zod\";\nimport {\n  POLICY_VERSION_V0,\n  TRANSCRIPT_SHARE_BOOTSTRAP_SCHEMA,\n  OWNER_NODE_ENDPOINT_SCHEMA,\n  W3C_VC_CREDENTIAL_VERIFIER,\n  jcsCanonicalize,\n  normalizePolicyCapability,\n  normalizeJson,\n  policyCapabilityContains,\n  verifyPolicyEngineRecordForRequester,\n  type PolicyCapability,\n  type TranscriptShareBootstrap,\n} from \"../policy\";\n\nexport const REQUESTER_NEAR_EXPIRY_SECONDS = 30;\nexport const REQUESTER_ENGINE_RETRY_ATTEMPTS = 3;\nexport const REQUESTER_ENGINE_RETRY_MAX_DELAY_MS = 250;\n\nexport const POLICY_ENGINE_CHALLENGE_REQUEST_SCHEMA =\n  \"xyz.tinycloud.policy-engine/challenge-request/v0\" as const;\nexport const POLICY_ENGINE_CHALLENGE_RESPONSE_SCHEMA =\n  \"xyz.tinycloud.policy/challenge/v0\" as const;\nexport const POLICY_ENGINE_RESOLVE_REQUEST_SCHEMA =\n  \"xyz.tinycloud.policy/presentation/v0\" as const;\nexport const POLICY_ENGINE_DENIAL_SCHEMA =\n  \"xyz.tinycloud.policy-engine/denial/v0\" as const;\nexport const HOLDER_KEY_BINDING_PRESENTATION_SCHEMA =\n  \"xyz.tinycloud.policy/presentation/v0\" as const;\nexport const PORTABLE_DELEGATION_SCHEMA =\n  \"xyz.tinycloud.policy/portable-delegation/v0\" as const;\n\nexport const POLICY_ENGINE_GRANT_PRESENTATION_DENIAL_CODES = [\n  \"schema-invalid\",\n  \"challenge-not-found\",\n  \"challenge-expired\",\n  \"challenge-nonce-consumed\",\n  \"presentation-expired\",\n  \"presentation-audience-mismatch\",\n  \"presentation-evidence-missing\",\n  \"digest-mismatch\",\n  \"evidence-requirement-unknown\",\n  \"evidence-requirement-duplicate\",\n  \"holder-signature-invalid\",\n  \"holder-signature-signer-mismatch\",\n  \"id-mismatch\",\n  \"requested-capabilities-exceeded\",\n  \"requested-capabilities-hash-mismatch\",\n  \"evidence-authority-missing\",\n  \"evidence-credential-invalid\",\n  \"evidence-domain-invalid\",\n  \"evidence-domain-missing\",\n  \"evidence-freshness-expired\",\n  \"evidence-freshness-unestablishable\",\n  \"evidence-issuer-missing\",\n  \"evidence-issuer-untrusted\",\n  \"evidence-presentation-invalid\",\n  \"evidence-requirements-invalid\",\n  \"evidence-verifier-unsupported\",\n  \"enrollment-binding-mismatch\",\n  \"enrollment-expired\",\n  \"enrollment-not-yet-valid\",\n  \"enrollment-out-of-scope\",\n  \"enrollment-revoked\",\n  \"enrollment-revoked-irreversible\",\n  \"enrollment-status-rollback\",\n  \"signature-invalid\",\n  \"signer-not-authorized\",\n  \"audience-mismatch\",\n  \"capability-not-contained\",\n  \"evidence-invalid\",\n  \"evidence-missing\",\n  \"evidence-stale\",\n  \"evidence-subject-mismatch\",\n  \"evidence-untrusted\",\n  \"grant-ttl-exceeds-policy\",\n  \"holder-did-mismatch\",\n  \"holder-key-not-permitted\",\n  \"holder-signature-invalid\",\n  \"owner-mismatch\",\n  \"policy-expired\",\n  \"policy-inactive\",\n  \"policy-not-found\",\n  \"policy-not-satisfied\",\n  \"policy-revoked\",\n  \"policy-status-rollback\",\n  \"rate-limited\",\n] as const;\n\nexport type PolicyEngineGrantPresentationDenialCode =\n  (typeof POLICY_ENGINE_GRANT_PRESENTATION_DENIAL_CODES)[number];\n\nexport type TranscriptRequesterErrorCode =\n  | \"requester-bootstrap-malformed\"\n  | \"requester-bootstrap-unknown-key\"\n  | \"requester-engine-record-signature-invalid\"\n  | \"requester-engine-record-owner-mismatch\"\n  | \"requester-engine-record-audience-mismatch\"\n  | \"requester-engine-record-endpoint-mismatch\"\n  | \"requester-engine-record-invalid\"\n  | \"requester-policy-engine-endpoint-invalid\"\n  | \"requester-engine-unreachable\"\n  | \"requester-engine-response-invalid\"\n  | \"requester-renewal-required\"\n  | \"requester-challenge-reused\"\n  | \"requester-presentation-invalid\"\n  | \"requester-delegation-invalid\"\n  | \"requester-delegation-wrong-holder\"\n  | \"requester-delegation-not-refresh-only\"\n  | \"requester-delegation-ttl-excessive\"\n  | \"requester-delegation-capability-wider\"\n  | \"requester-owner-node-endpoint-invalid\"\n  | \"requester-delegation-import-failed\"\n  | \"requester-invocation-signer-required\"\n  | \"requester-invocation-signer-mismatch\"\n  | \"requester-node-denied\"\n  | \"requester-node-unreachable\"\n  | \"requester-node-response-invalid\"\n  | \"requester-access-not-contained\"\n  | \"requester-access-denied\"\n  | \"requester-access-unreachable\"\n  | \"requester-access-ended\"\n  | `policy-engine-denied-${PolicyEngineGrantPresentationDenialCode}`;\n\nexport type TranscriptRequesterErrorState =\n  | \"bootstrap-invalid\"\n  | \"denied\"\n  | \"unreachable\"\n  | \"renewal-required\"\n  | \"access-ended\"\n  | \"invalid\"\n  | \"not-contained\";\n\nexport class TranscriptRequesterError extends Error {\n  public readonly code: TranscriptRequesterErrorCode;\n  public readonly state: TranscriptRequesterErrorState;\n  public readonly denialCode?: PolicyEngineGrantPresentationDenialCode;\n  public readonly status?: number;\n\n  constructor(\n    code: TranscriptRequesterErrorCode,\n    message: string,\n    state: TranscriptRequesterErrorState = \"invalid\",\n    denialCode?: PolicyEngineGrantPresentationDenialCode,\n    status?: number,\n  ) {\n    super(message);\n    this.name = \"TranscriptRequesterError\";\n    this.code = code;\n    this.state = state;\n    this.denialCode = denialCode;\n    this.status = status;\n  }\n}\n\nexport interface RequesterHttpRequest {\n  readonly method: \"POST\" | \"GET\";\n  readonly url: string;\n  readonly headers?: Readonly<Record<string, string>>;\n  readonly body?: unknown;\n  /** Endpoint requests must not follow redirects. */\n  readonly redirect?: \"error\";\n  /** Transport must connect only to one of these pre-resolved public addresses. */\n  readonly allowedResolvedAddresses?: readonly string[];\n}\n\nexport interface RequesterHttpResponse {\n  readonly status: number;\n  readonly body: unknown;\n  /** Required for policy-engine and owner-node requests; reports the non-redirected final URL. */\n  readonly finalUrl?: string;\n  /** Required for policy-engine and owner-node requests; reports the actual connected IP. */\n  readonly resolvedAddress?: string;\n}\n\nexport interface RequesterEndpointResolution {\n  readonly addresses: readonly string[];\n}\n\nexport interface RequesterTransport {\n  request(request: RequesterHttpRequest): Promise<RequesterHttpResponse>;\n  /** Resolve before egress so the requester can pin public addresses and detect rebinding. */\n  resolveEndpoint?(endpoint: string): Promise<RequesterEndpointResolution>;\n}\n\nexport interface RequesterInvocationCapability {\n  readonly holderDid: string;\n  readonly verificationMethod: string;\n  readonly jwk: object;\n  readonly invoke: InvokeFunction;\n  readonly invokeAny?: InvokeAnyFunction;\n}\n\nexport interface HolderKeyBindingPresentation {\n  readonly schema: typeof HOLDER_KEY_BINDING_PRESENTATION_SCHEMA;\n  readonly policyId: string;\n  readonly eligibleSubjectDid: string;\n  readonly holderDid: string;\n  readonly holderBinding: unknown;\n  readonly requestedCapabilities: readonly PolicyCapability[];\n  readonly requestedCapabilitiesHash: string;\n  readonly audience: string;\n  readonly nonce: string;\n  readonly expiresAt: string;\n  readonly evidence?: readonly unknown[];\n  readonly holderSignature: {\n    readonly suite: string;\n    readonly signerDid: string;\n    readonly value: string;\n  };\n}\n\nexport interface RequesterSigningCapability {\n  readonly holderDid: string;\n  readonly keyId: string;\n  readonly suite?: string;\n  readonly holderBinding?: unknown;\n  readonly eligibleSubjectDid?: string;\n  readonly evidence?: readonly unknown[];\n  signGrantPresentation?(input: {\n    readonly schema: typeof HOLDER_KEY_BINDING_PRESENTATION_SCHEMA;\n    readonly policyId: string;\n    readonly eligibleSubjectDid: string;\n    readonly holderDid: string;\n    readonly holderBinding: unknown;\n    readonly requestedCapabilities: readonly PolicyCapability[];\n    readonly requestedCapabilitiesHash: string;\n    readonly audience: string;\n    readonly nonce: string;\n    readonly expiresAt: string;\n    readonly evidence?: readonly unknown[];\n  }): Promise<string> | string;\n  signKeyBinding(input: {\n    readonly schema: typeof HOLDER_KEY_BINDING_PRESENTATION_SCHEMA;\n    readonly policyId?: string;\n    readonly eligibleSubjectDid?: string;\n    readonly holderDid: string;\n    readonly holderBinding?: unknown;\n    readonly requestedCapabilities?: readonly PolicyCapability[];\n    readonly requestedCapabilitiesHash?: string;\n    readonly audience: string;\n    readonly nonce: string;\n    readonly challengeId: string;\n    readonly issuedAt: string;\n    readonly keyId: string;\n  }): Promise<string> | string;\n}\n\nexport interface PortableDelegation {\n  readonly schema?: typeof PORTABLE_DELEGATION_SCHEMA;\n  readonly delegationId: string;\n  readonly policyId: string;\n  readonly issuerDid: string;\n  readonly holderDid: string;\n  readonly audience?: string;\n  readonly issuedAt: string;\n  readonly expiresAt: string;\n  readonly terminal: boolean;\n  readonly maxTtlSeconds: number;\n  readonly capabilities: readonly PolicyCapability[];\n  readonly encoded?: string;\n}\n\nexport interface TranscriptRequesterOptions {\n  readonly bootstrap: unknown;\n  readonly requesterDid: string;\n  readonly ownerDid: string;\n  readonly audience: string;\n  readonly grantIssuerDid: string;\n  /** Owner-node binding from trusted TinyCloud discovery/config, never copied from bootstrap. */\n  readonly trustedOwnerNode: {\n    readonly endpoint: string;\n    readonly spaceId: string;\n  };\n  readonly transport: RequesterTransport;\n  readonly signingCapability?: RequesterSigningCapability;\n  readonly invocationCapability?: RequesterInvocationCapability;\n  readonly eligibleSubjectDid?: string;\n  readonly holderBinding?: unknown;\n  readonly evidence?: readonly unknown[];\n  readonly presentationTtlSeconds?: number;\n  readonly now?: () => Date;\n  readonly sleep?: (milliseconds: number) => Promise<void>;\n  readonly random?: () => number;\n  readonly engineRetryAttempts?: number;\n}\n\nexport interface TranscriptRequesterReadSqlResult {\n  readonly rows: readonly unknown[];\n}\n\nexport interface TranscriptRequesterReadKvResult {\n  readonly value: unknown;\n}\n\nconst JsonValueSchema: z.ZodType<unknown> = z.lazy(() =>\n  z.union([\n    z.string(),\n    z.number().finite(),\n    z.boolean(),\n    z.null(),\n    z.array(JsonValueSchema),\n    z.record(JsonValueSchema),\n  ]),\n);\n\nconst Rfc3339Schema = z\n  .string()\n  .refine((value) => parseStrictRfc3339(value) !== undefined, {\n    message: \"must be strict RFC 3339 date-time with timezone\",\n  });\n\nconst SignedRecordSchema = z\n  .object({\n    schema: z.string(),\n    engineRecordId: z.string(),\n    ownerDid: z.string(),\n    endpoint: z.string(),\n    audience: z.string(),\n    supportedPolicyVersions: z.array(z.string()),\n    supportedEvidenceVerifiers: z.array(z.string()),\n    grantIssuerDid: z.string(),\n    expiresAt: Rfc3339Schema,\n    signature: z\n      .object({\n        suite: z.string(),\n        signerDid: z.string(),\n        value: z.string(),\n      })\n      .strict(),\n  })\n  .strict();\n\nconst PolicyEngineSchema = z\n  .object({\n    endpoint: z.string().url(),\n    audience: z.string(),\n    supportedEvidenceVerifiers: z.tuple([\n      z.literal(W3C_VC_CREDENTIAL_VERIFIER),\n    ]),\n    signedRecord: SignedRecordSchema,\n  })\n  .strict();\n\nconst OwnerNodeSchema = z\n  .object({\n    schema: z.literal(OWNER_NODE_ENDPOINT_SCHEMA),\n    endpoint: z.string().url(),\n    spaceId: z.string().min(1),\n  })\n  .strict();\n\nconst ResourceHintSchema = z\n  .object({\n    resourceType: z.string(),\n    resourceId: z.string(),\n    requestedCapabilities: z.array(JsonValueSchema).min(1),\n  })\n  .strict();\n\nconst BootstrapSchema = z\n  .object({\n    schema: z.literal(TRANSCRIPT_SHARE_BOOTSTRAP_SCHEMA),\n    policyId: z.string(),\n    policyEngine: PolicyEngineSchema,\n    ownerNode: OwnerNodeSchema,\n    resourceHint: ResourceHintSchema,\n  })\n  .strict();\n\nconst SignatureSchema = z\n  .object({\n    suite: z.string(),\n    signerDid: z.string(),\n    value: z.string(),\n  })\n  .strict();\n\nconst ChallengeSchema = z\n  .object({\n    schema: z.literal(POLICY_ENGINE_CHALLENGE_RESPONSE_SCHEMA),\n    challengeId: z.string(),\n    policyId: z.string(),\n    audience: z.string(),\n    nonce: z.string().min(16),\n    challengeExpiresAt: Rfc3339Schema,\n    acceptedSuites: z.array(z.string()).min(1),\n    requestedCapabilitiesTemplate: z.array(JsonValueSchema).optional(),\n    signature: SignatureSchema,\n  })\n  .strict();\n\nconst ChallengeResponseSchema = z\n  .object({ challenge: ChallengeSchema })\n  .strict();\n\nconst DenialSchema = z\n  .object({\n    schema: z.literal(POLICY_ENGINE_DENIAL_SCHEMA),\n    code: z.enum(POLICY_ENGINE_GRANT_PRESENTATION_DENIAL_CODES),\n    message: z.string().optional(),\n  })\n  .strict();\n\nconst ErrorEnvelopeDenialSchema = z\n  .object({\n    error: z\n      .object({\n        code: z.enum(POLICY_ENGINE_GRANT_PRESENTATION_DENIAL_CODES),\n        message: z.string().optional(),\n      })\n      .strict(),\n  })\n  .strict();\n\nconst WireDelegationSchema = z\n  .object({\n    delegationId: z.string(),\n    issuanceId: z.string().min(1),\n    issuerDid: z.string(),\n    holderDid: z.string(),\n    policyId: z.string(),\n    capabilityHashHex: z.string().regex(/^[0-9a-f]{64}$/),\n    revocationMode: z.literal(\"refresh_only\"),\n    issuedAt: Rfc3339Schema,\n    expiresAt: Rfc3339Schema,\n    terminal: z.boolean(),\n    encoded: z.string(),\n  })\n  .strict();\n\nconst ResolveResponseSchema = z\n  .object({ delegation: WireDelegationSchema })\n  .strict();\nconst DelegateReceiptSchema = z\n  .object({\n    cid: z.string().min(1),\n    activated: z.array(z.string()),\n    skipped: z.array(z.string()),\n  })\n  .strict();\n\nconst SqlReadResponseSchema = z\n  .object({ rows: z.array(JsonValueSchema) })\n  .strict();\nconst KvReadResponseSchema = z.object({ value: JsonValueSchema }).strict();\n\nexport const LISTEN_SQL_STATEMENT_CATALOG = [\n  {\n    name: \"listen.getConversation\",\n    sql: \"SELECT id, title, source, source_id, source_url, started_at, ended_at, duration_secs, summary, metadata, transcript_json, transcript_text, created_at, updated_at FROM conversation WHERE id = ?\",\n    fixedParams: [{ index: 0, value: \"{conversationId}\" }],\n  },\n  {\n    name: \"listen.listParticipants\",\n    sql: \"SELECT id, name, email, speaker_label FROM participant WHERE conversation_id = ? ORDER BY COALESCE(speaker_label, name), id\",\n    fixedParams: [{ index: 0, value: \"{conversationId}\" }],\n  },\n] as const;\n\nexport type ListenSqlStatementName =\n  (typeof LISTEN_SQL_STATEMENT_CATALOG)[number][\"name\"];\ntype ListenSqlStatement = (typeof LISTEN_SQL_STATEMENT_CATALOG)[number];\ntype ResolvedListenSqlStatement = {\n  readonly name: string;\n  readonly sql: string;\n  readonly fixedParams: readonly {\n    readonly index: number;\n    readonly value: unknown;\n  }[];\n};\n\nexport function listenTranscriptScopedStatementName(\n  statementName: ListenSqlStatementName,\n  conversationId: string,\n): string {\n  if (conversationId.length === 0) {\n    throw new TranscriptRequesterError(\n      \"requester-access-not-contained\",\n      \"conversation ID must be non-empty for a scoped Listen SQL read\",\n      \"not-contained\",\n    );\n  }\n  return `${statementName}@${encodeURIComponent(conversationId)}`;\n}\ntype NormalizedWireDelegation = PortableDelegation & {\n  readonly encoded: string;\n};\n\nconst LISTEN_SQL_STATEMENT_BY_NAME: ReadonlyMap<string, ListenSqlStatement> =\n  new Map(\n    LISTEN_SQL_STATEMENT_CATALOG.map((statement) => [\n      statement.name,\n      statement,\n    ]),\n  );\n\nexport class TranscriptRequester {\n  private readonly bootstrap: TranscriptShareBootstrap;\n  private readonly requesterDid: string;\n  private readonly ownerDid: string;\n  private readonly audience: string;\n  private readonly grantIssuerDid: string;\n  private readonly transport: RequesterTransport;\n  private readonly signingCapability?: RequesterSigningCapability;\n  private readonly invocationCapability?: RequesterInvocationCapability;\n  private readonly policyEngineRecordExpiresAtMs: number;\n  private readonly policyEngineAddresses: ReadonlySet<string>;\n  private readonly ownerNodeAddresses: ReadonlySet<string>;\n  private readonly now: () => Date;\n  private readonly sleep: (milliseconds: number) => Promise<void>;\n  private readonly random: () => number;\n  private readonly engineRetryAttempts: number;\n  private readonly requestedCapabilities: readonly PolicyCapability[];\n  private readonly nativeAuthorityCeiling: readonly PolicyCapability[];\n  private readonly requestedCapabilitiesHash: string;\n  private readonly eligibleSubjectDid: string;\n  private readonly holderBinding: unknown;\n  private readonly evidence?: readonly unknown[];\n  private readonly presentationTtlSeconds: number;\n  private readonly usedChallengeNonces = new Set<string>();\n  private importedDelegation?: PortableDelegation;\n  private importedDelegationCid?: string;\n  private accessEnded = false;\n\n  private constructor(\n    bootstrap: TranscriptShareBootstrap,\n    requestedCapabilities: readonly PolicyCapability[],\n    nativeAuthorityCeiling: readonly PolicyCapability[],\n    requestedCapabilitiesHash: string,\n    policyEngineRecordExpiresAtMs: number,\n    policyEngineAddresses: ReadonlySet<string>,\n    ownerNodeAddresses: ReadonlySet<string>,\n    options: TranscriptRequesterOptions,\n  ) {\n    this.bootstrap = bootstrap;\n    this.requestedCapabilities = requestedCapabilities;\n    this.nativeAuthorityCeiling = nativeAuthorityCeiling;\n    this.requestedCapabilitiesHash = requestedCapabilitiesHash;\n    this.requesterDid = options.requesterDid;\n    this.ownerDid = options.ownerDid;\n    this.audience = options.audience;\n    this.grantIssuerDid = options.grantIssuerDid;\n    this.transport = options.transport;\n    this.signingCapability = options.signingCapability;\n    this.invocationCapability = options.invocationCapability;\n    this.policyEngineRecordExpiresAtMs = policyEngineRecordExpiresAtMs;\n    this.policyEngineAddresses = policyEngineAddresses;\n    this.ownerNodeAddresses = ownerNodeAddresses;\n    this.eligibleSubjectDid =\n      options.eligibleSubjectDid ??\n      options.signingCapability?.eligibleSubjectDid ??\n      options.requesterDid;\n    this.holderBinding = options.holderBinding ??\n      options.signingCapability?.holderBinding ?? {\n        type: \"enrolled-agent\",\n        enrollment: {\n          schema: \"xyz.tinycloud.policy/holder-enrollment/v0\",\n          holderDid: options.requesterDid,\n        },\n      };\n    this.evidence = options.evidence ?? options.signingCapability?.evidence;\n    this.presentationTtlSeconds = Math.min(\n      Math.max(options.presentationTtlSeconds ?? 60, 1),\n      300,\n    );\n    this.now = options.now ?? (() => new Date());\n    this.sleep =\n      options.sleep ??\n      ((milliseconds) =>\n        new Promise((resolve) => setTimeout(resolve, milliseconds)));\n    this.random = options.random ?? Math.random;\n    this.engineRetryAttempts =\n      options.engineRetryAttempts ?? REQUESTER_ENGINE_RETRY_ATTEMPTS;\n  }\n\n  static async create(\n    options: TranscriptRequesterOptions,\n  ): Promise<TranscriptRequester> {\n    const bootstrap = parseBootstrap(options.bootstrap);\n    if (\n      bootstrap.ownerNode.endpoint !== options.trustedOwnerNode.endpoint ||\n      bootstrap.ownerNode.spaceId !== options.trustedOwnerNode.spaceId\n    ) {\n      throw endpointError(\n        \"owner-node\",\n        \"bootstrap owner-node binding does not match trusted discovery/config\",\n      );\n    }\n    const record = await verifyRecordBeforeEgress(bootstrap, options);\n    if (record.endpoint !== bootstrap.policyEngine.endpoint) {\n      throw new TranscriptRequesterError(\n        \"requester-engine-record-endpoint-mismatch\",\n        \"policy engine record endpoint does not match bootstrap endpoint\",\n        \"bootstrap-invalid\",\n      );\n    }\n    if (record.audience !== bootstrap.policyEngine.audience) {\n      throw new TranscriptRequesterError(\n        \"requester-engine-record-audience-mismatch\",\n        \"policy engine record audience does not match bootstrap audience\",\n        \"bootstrap-invalid\",\n      );\n    }\n    const policyEngineAddresses = await validateAndResolvePublicEndpoint(\n      bootstrap.policyEngine.endpoint,\n      options.transport,\n      \"policy-engine\",\n    );\n    const ownerNodeAddresses = await validateAndResolveOwnerNode(\n      bootstrap.ownerNode.endpoint,\n      options.transport,\n    );\n    const requestedCapabilities =\n      bootstrap.resourceHint.requestedCapabilities.map((capability, index) =>\n        parsePolicyCapability(\n          capability,\n          `$.resourceHint.requestedCapabilities[${index}]`,\n        ),\n      );\n    const nativeAuthorityCeiling = requestedCapabilities.map((capability) => ({\n      ...capability,\n      space: bootstrap.ownerNode.spaceId,\n    }));\n    return new TranscriptRequester(\n      bootstrap,\n      requestedCapabilities,\n      nativeAuthorityCeiling,\n      requestedCapabilitiesHash(requestedCapabilities),\n      parseStrictRfc3339(record.expiresAt)!,\n      policyEngineAddresses,\n      ownerNodeAddresses,\n      options,\n    );\n  }\n\n  get accessState(): \"active\" | \"needs-renewal\" | \"access-ended\" {\n    if (this.accessEnded) {\n      return \"access-ended\";\n    }\n    if (this.importedDelegation === undefined) {\n      return \"needs-renewal\";\n    }\n    if (this.requiresRenewal(this.importedDelegation)) {\n      return \"needs-renewal\";\n    }\n    return \"active\";\n  }\n\n  async readSql(\n    statementName: ListenSqlStatementName,\n    conversationId?: string,\n  ): Promise<TranscriptRequesterReadSqlResult> {\n    try {\n      const catalogStatement = listenSqlStatementFromCatalog(statementName);\n      const selectedConversationId =\n        conversationId ?? this.bootstrap.resourceHint.resourceId;\n      const statement: ResolvedListenSqlStatement = {\n        ...catalogStatement,\n        name:\n          conversationId === undefined\n            ? catalogStatement.name\n            : listenTranscriptScopedStatementName(\n                statementName,\n                conversationId,\n              ),\n        fixedParams: catalogStatement.fixedParams.map((item) => ({\n          ...item,\n          value:\n            item.value === \"{conversationId}\"\n              ? selectedConversationId\n              : item.value,\n        })),\n      };\n      const delegation = await this.ensureFreshDelegation();\n      const requested = this.sqlAccessCapabilityForDelegation(\n        delegation,\n        statement,\n      );\n      this.assertContainedByDelegation(delegation, requested);\n      const response = await this.nativeInvoke(\n        \"sql\",\n        requested.path,\n        \"tinycloud.sql/read\",\n        {\n          action: \"executeStatement\",\n          name: statement.name,\n          // The native constrained-SQL route injects caveat-pinned values and\n          // rejects callers that supply those indices. Uncaveated reads must\n          // resolve the catalog placeholder themselves.\n          params:\n            requested.caveats === undefined\n              ? statement.fixedParams.map((item) => item.value)\n              : [],\n        },\n        requested.caveats,\n      );\n      return parseNodeDataResponse(\n        response,\n        SqlReadResponseSchema,\n        \"SQL read\",\n      ) as TranscriptRequesterReadSqlResult;\n    } catch (error) {\n      this.recordAccessEnded(error);\n      throw error;\n    }\n  }\n\n  async readKv(path: string): Promise<TranscriptRequesterReadKvResult> {\n    try {\n      const delegation = await this.ensureFreshDelegation();\n      const grantedKv = delegation.capabilities.find(\n        (capability) =>\n          capability.service === \"tinycloud.kv\" &&\n          capability.path === path &&\n          capability.actions.includes(\"tinycloud.kv/get\"),\n      );\n      const requested = parsePolicyCapability(\n        {\n          service: \"tinycloud.kv\",\n          space: grantedKv?.space ?? \"applications\",\n          path,\n          actions: [\"tinycloud.kv/get\"],\n        },\n        \"$.kvRead\",\n      );\n      this.assertContainedByDelegation(delegation, requested);\n      const response = await this.nativeInvoke(\"kv\", path, \"tinycloud.kv/get\");\n      return parseNodeDataResponse(\n        response,\n        KvReadResponseSchema,\n        \"KV read\",\n      ) as TranscriptRequesterReadKvResult;\n    } catch (error) {\n      this.recordAccessEnded(error);\n      throw error;\n    }\n  }\n\n  private async nativeInvoke(\n    service: \"sql\" | \"kv\",\n    path: string,\n    action: \"tinycloud.sql/read\" | \"tinycloud.kv/get\",\n    body?: unknown,\n    caveats?: Record<string, unknown>,\n  ): Promise<RequesterHttpResponse> {\n    const capability = this.invocationCapability;\n    if (capability === undefined) {\n      throw new TranscriptRequesterError(\n        \"requester-invocation-signer-required\",\n        \"holder invocation capability is required for native reads\",\n      );\n    }\n    if (\n      capability.holderDid !== this.requesterDid ||\n      capability.holderDid !== this.signingCapability?.holderDid\n    ) {\n      throw new TranscriptRequesterError(\n        \"requester-invocation-signer-mismatch\",\n        \"invocation signer must be the presentation key-binding holder\",\n      );\n    }\n    if (\n      this.importedDelegationCid === undefined ||\n      this.importedDelegation === undefined\n    ) {\n      throw new TranscriptRequesterError(\n        \"requester-delegation-import-failed\",\n        \"native read requires a confirmed delegation import\",\n      );\n    }\n    const session: ServiceSession = {\n      delegationHeader: { Authorization: this.importedDelegation.encoded! },\n      delegationCid: this.importedDelegationCid,\n      spaceId: this.bootstrap.ownerNode.spaceId,\n      verificationMethod: capability.verificationMethod,\n      jwk: capability.jwk,\n    };\n    let invocationHeaders: ServiceHeaders;\n    if (caveats === undefined) {\n      invocationHeaders = capability.invoke(session, service, path, action);\n    } else {\n      if (capability.invokeAny === undefined) {\n        throw new TranscriptRequesterError(\n          \"requester-invocation-signer-required\",\n          \"holder invocation capability must support caveated native reads\",\n        );\n      }\n      invocationHeaders = capability.invokeAny(session, [\n        {\n          spaceId: this.bootstrap.ownerNode.spaceId,\n          service,\n          path,\n          action,\n          caveats: [caveats],\n        },\n      ]);\n    }\n    const headers = headersRecord(invocationHeaders);\n    const response = await this.transport.request({\n      method: \"POST\",\n      url: `${trimTrailingSlash(this.bootstrap.ownerNode.endpoint)}/invoke`,\n      headers,\n      redirect: \"error\",\n      allowedResolvedAddresses: [...this.ownerNodeAddresses],\n      ...(body === undefined ? {} : { body }),\n    });\n    this.assertOwnerNodeResponse(response, \"/invoke\");\n    return response;\n  }\n\n  private async ensureFreshDelegation(): Promise<PortableDelegation> {\n    if (this.accessEnded) {\n      throw new TranscriptRequesterError(\n        \"requester-access-ended\",\n        \"requester access has ended\",\n        \"access-ended\",\n      );\n    }\n    if (\n      this.importedDelegation !== undefined &&\n      !this.requiresRenewal(this.importedDelegation)\n    ) {\n      return this.importedDelegation;\n    }\n    if (\n      this.signingCapability === undefined ||\n      this.signingCapability.holderDid !== this.requesterDid\n    ) {\n      throw new TranscriptRequesterError(\n        \"requester-renewal-required\",\n        \"a permitted requester signing capability is required for access-triggered renewal\",\n        \"renewal-required\",\n      );\n    }\n    try {\n      let lastError: unknown;\n      const attempts = Math.max(1, this.engineRetryAttempts);\n      for (let attempt = 0; attempt < attempts; attempt++) {\n        const challenge = await this.obtainChallenge();\n        const presentation = await this.mintPresentation(challenge);\n        try {\n          const delegation = await this.resolveOnce(challenge, presentation);\n          this.importedDelegation = delegation;\n          return delegation;\n        } catch (error) {\n          if (\n            !(error instanceof TranscriptRequesterError) ||\n            error.state !== \"unreachable\"\n          ) {\n            throw error;\n          }\n          lastError = error;\n        }\n        if (attempt + 1 < attempts) {\n          await this.sleep(retryDelay(attempt, this.random()));\n        }\n      }\n      throw new TranscriptRequesterError(\n        \"requester-engine-unreachable\",\n        lastError instanceof Error\n          ? lastError.message\n          : \"policy engine unreachable\",\n        \"unreachable\",\n      );\n    } catch (error) {\n      this.recordAccessEnded(error);\n      throw error;\n    }\n  }\n\n  private recordAccessEnded(error: unknown): void {\n    if (\n      error instanceof TranscriptRequesterError &&\n      error.state === \"access-ended\"\n    ) {\n      this.accessEnded = true;\n    }\n  }\n\n  private async obtainChallenge(): Promise<z.infer<typeof ChallengeSchema>> {\n    this.assertPolicyEngineRecordCurrent();\n    const response = await this.challengeRequestWithRetry({\n      method: \"POST\",\n      url: `${trimTrailingSlash(this.bootstrap.policyEngine.endpoint)}/policy/v0/challenge`,\n      redirect: \"error\",\n      allowedResolvedAddresses: [...this.policyEngineAddresses],\n      body: {\n        policyId: this.bootstrap.policyId,\n      },\n    });\n    return parseEngineSuccess(\n      response.body,\n      ChallengeResponseSchema,\n      \"challenge response\",\n    ).challenge;\n  }\n\n  private async mintPresentation(\n    challenge: z.infer<typeof ChallengeSchema>,\n  ): Promise<HolderKeyBindingPresentation> {\n    if (\n      challenge.policyId !== this.bootstrap.policyId ||\n      challenge.audience !== this.bootstrap.policyEngine.audience ||\n      challenge.audience !== this.audience\n    ) {\n      throw new TranscriptRequesterError(\n        \"requester-engine-response-invalid\",\n        \"challenge response binding does not match requester context\",\n      );\n    }\n    if (this.usedChallengeNonces.has(challenge.nonce)) {\n      throw new TranscriptRequesterError(\n        \"requester-challenge-reused\",\n        \"challenge nonce was already used by this requester\",\n      );\n    }\n    this.usedChallengeNonces.add(challenge.nonce);\n    const expiresAt = new Date(\n      this.now().getTime() + this.presentationTtlSeconds * 1000,\n    )\n      .toISOString()\n      .replace(\".000Z\", \"Z\");\n    const input = {\n      schema: HOLDER_KEY_BINDING_PRESENTATION_SCHEMA,\n      policyId: this.bootstrap.policyId,\n      eligibleSubjectDid: this.eligibleSubjectDid,\n      holderDid: this.requesterDid,\n      holderBinding: this.holderBinding,\n      requestedCapabilities: this.requestedCapabilities,\n      requestedCapabilitiesHash: this.requestedCapabilitiesHash,\n      audience: this.audience,\n      nonce: challenge.nonce,\n      expiresAt,\n      ...(this.evidence === undefined ? {} : { evidence: this.evidence }),\n    } as const;\n    const signature =\n      this.signingCapability!.signGrantPresentation === undefined\n        ? await this.signingCapability!.signKeyBinding({\n            ...input,\n            challengeId: challenge.challengeId,\n            issuedAt: expiresAt,\n            keyId: this.signingCapability!.keyId,\n          })\n        : await this.signingCapability!.signGrantPresentation(input);\n    if (typeof signature !== \"string\" || signature.length === 0) {\n      throw new TranscriptRequesterError(\n        \"requester-presentation-invalid\",\n        \"signing capability returned an invalid holder key-binding signature\",\n      );\n    }\n    return {\n      ...input,\n      holderSignature: {\n        suite: this.signingCapability!.suite ?? challenge.acceptedSuites[0]!,\n        signerDid: this.requesterDid,\n        value: signature,\n      },\n    };\n  }\n\n  private async resolveOnce(\n    challenge: z.infer<typeof ChallengeSchema>,\n    presentation: HolderKeyBindingPresentation,\n  ): Promise<PortableDelegation> {\n    void challenge;\n    this.assertPolicyEngineRecordCurrent();\n    const response = await this.resolveRequestOnce({\n      method: \"POST\",\n      url: `${trimTrailingSlash(this.bootstrap.policyEngine.endpoint)}/policy/v0/resolve`,\n      redirect: \"error\",\n      allowedResolvedAddresses: [...this.policyEngineAddresses],\n      body: { presentation },\n    });\n    const parsed = parseEngineSuccess(\n      response.body,\n      ResolveResponseSchema,\n      \"resolve response\",\n    );\n    return this.importPortableDelegation(parsed.delegation);\n  }\n\n  private async importPortableDelegation(\n    input: unknown,\n  ): Promise<PortableDelegation> {\n    const parsed = parseNodeNativePortableDelegation(input);\n    if (parsed.policyId !== this.bootstrap.policyId) {\n      throw new TranscriptRequesterError(\n        \"requester-delegation-invalid\",\n        \"portable delegation policy id does not match bootstrap\",\n      );\n    }\n    if (parsed.holderDid !== this.requesterDid) {\n      throw new TranscriptRequesterError(\n        \"requester-delegation-wrong-holder\",\n        \"portable delegation is not targeted at the requester DID\",\n      );\n    }\n    if (parsed.issuerDid !== this.grantIssuerDid) {\n      throw new TranscriptRequesterError(\n        \"requester-delegation-invalid\",\n        \"portable delegation issuer does not match the verified grant issuer DID\",\n      );\n    }\n    if (parsed.maxTtlSeconds > 300) {\n      throw new TranscriptRequesterError(\n        \"requester-delegation-ttl-excessive\",\n        \"portable delegation TTL exceeds 300 seconds\",\n      );\n    }\n    const issuedAt = parseStrictRfc3339(parsed.issuedAt)!;\n    const expiresAt = parseStrictRfc3339(parsed.expiresAt)!;\n    if (\n      expiresAt <= issuedAt ||\n      expiresAt - issuedAt > parsed.maxTtlSeconds * 1000\n    ) {\n      throw new TranscriptRequesterError(\n        \"requester-delegation-ttl-excessive\",\n        \"portable delegation expires outside its maxTtlSeconds bound\",\n      );\n    }\n    const capabilities = parsed.capabilities.map((capability, index) =>\n      parsePolicyCapability(capability, `$.delegation.capabilities[${index}]`),\n    );\n    for (const granted of capabilities) {\n      if (\n        !this.nativeAuthorityCeiling.some((requested) =>\n          policyCapabilityContains(requested, granted),\n        )\n      ) {\n        throw new TranscriptRequesterError(\n          \"requester-delegation-capability-wider\",\n          \"portable delegation grants a capability outside the bootstrap requested set\",\n        );\n      }\n    }\n    if (\n      typeof parsed.encoded !== \"string\" ||\n      parsed.encoded.split(\".\").length !== 3\n    ) {\n      throw new TranscriptRequesterError(\n        \"requester-delegation-invalid\",\n        \"portable delegation is not a compact-JWS UCAN\",\n      );\n    }\n    const delegation = { ...parsed, capabilities } as PortableDelegation;\n    const response = await this.transport.request({\n      method: \"POST\",\n      url: `${trimTrailingSlash(this.bootstrap.ownerNode.endpoint)}/delegate`,\n      headers: { Authorization: parsed.encoded },\n      redirect: \"error\",\n      allowedResolvedAddresses: [...this.ownerNodeAddresses],\n    });\n    this.assertOwnerNodeResponse(response, \"/delegate\");\n    const receipt = parseDelegateReceipt(response);\n    const target = this.bootstrap.ownerNode.spaceId;\n    if (\n      !receipt.activated.includes(target) ||\n      receipt.skipped.includes(target)\n    ) {\n      throw new TranscriptRequesterError(\n        \"requester-delegation-import-failed\",\n        receipt.activated.includes(target) && receipt.skipped.includes(target)\n          ? \"owner node returned a contradictory delegation receipt\"\n          : \"owner node did not activate the target owner space\",\n      );\n    }\n    this.importedDelegationCid = deriveDelegationCid(parsed.encoded);\n    return delegation;\n  }\n\n  private assertOwnerNodeResponse(\n    response: RequesterHttpResponse,\n    path: string,\n  ): void {\n    this.assertEndpointResponse(\n      response,\n      this.bootstrap.ownerNode.endpoint,\n      path,\n      this.ownerNodeAddresses,\n      \"owner-node\",\n    );\n  }\n\n  private assertPolicyEngineRecordCurrent(): void {\n    if (this.policyEngineRecordExpiresAtMs <= this.now().getTime()) {\n      throw new TranscriptRequesterError(\n        \"requester-engine-record-invalid\",\n        \"verified policy engine record has expired\",\n        \"bootstrap-invalid\",\n      );\n    }\n  }\n\n  private assertPolicyEngineResponse(\n    response: RequesterHttpResponse,\n    path: string,\n  ): void {\n    this.assertEndpointResponse(\n      response,\n      this.bootstrap.policyEngine.endpoint,\n      path,\n      this.policyEngineAddresses,\n      \"policy-engine\",\n    );\n  }\n\n  private assertEndpointResponse(\n    response: RequesterHttpResponse,\n    endpoint: string,\n    path: string,\n    allowedAddresses: ReadonlySet<string>,\n    kind: \"owner-node\" | \"policy-engine\",\n  ): void {\n    const expected = `${trimTrailingSlash(endpoint)}${path}`;\n    const error = (message: string) => endpointError(kind, message);\n    if (\n      response.finalUrl !== expected ||\n      response.resolvedAddress === undefined\n    ) {\n      throw error(\n        `${kind} transport metadata is missing or indicates a redirect`,\n      );\n    }\n    if (!allowedAddresses.has(normalizeIp(response.resolvedAddress))) {\n      throw error(`${kind} address changed after endpoint validation`);\n    }\n  }\n\n  private assertContainedByDelegation(\n    delegation: PortableDelegation,\n    requested: PolicyCapability,\n  ): void {\n    if (this.requiresRenewal(delegation)) {\n      throw new TranscriptRequesterError(\n        \"requester-renewal-required\",\n        \"delegation requires renewal before access\",\n        \"renewal-required\",\n      );\n    }\n    if (\n      !delegation.capabilities.some((granted) =>\n        policyCapabilityContains(granted, requested),\n      )\n    ) {\n      throw new TranscriptRequesterError(\n        \"requester-access-not-contained\",\n        \"requested access is outside the imported delegation capabilities\",\n        \"not-contained\",\n      );\n    }\n  }\n\n  private sqlAccessCapabilityForDelegation(\n    delegation: PortableDelegation,\n    statement: ResolvedListenSqlStatement,\n  ): PolicyCapability {\n    const grantedSql = delegation.capabilities.find(\n      (capability) =>\n        capability.service === \"tinycloud.sql\" &&\n        capability.actions.includes(\"tinycloud.sql/read\"),\n    );\n    if (grantedSql === undefined) {\n      throw new TranscriptRequesterError(\n        \"requester-access-not-contained\",\n        \"delegation has no SQL read grant\",\n        \"not-contained\",\n      );\n    }\n    if (grantedSql.caveats !== undefined) {\n      const statements = (\n        grantedSql.caveats as {\n          statements?: readonly {\n            name?: unknown;\n            sql?: unknown;\n            fixedParams?: unknown;\n          }[];\n        }\n      ).statements;\n      const matchesCatalogSelection = statements?.some(\n        (candidate) =>\n          candidate.name === statement.name &&\n          candidate.sql === statement.sql &&\n          Array.isArray(candidate.fixedParams) &&\n          jcsCanonicalize(candidate.fixedParams) ===\n            jcsCanonicalize(statement.fixedParams),\n      );\n      if (!matchesCatalogSelection) {\n        throw new TranscriptRequesterError(\n          \"requester-access-not-contained\",\n          \"SQL statement is outside the delegated catalog-derived statement caveat\",\n          \"not-contained\",\n        );\n      }\n      return grantedSql;\n    }\n    return parsePolicyCapability(\n      {\n        service: \"tinycloud.sql\",\n        space: grantedSql.space,\n        path: grantedSql.path,\n        actions: [\"tinycloud.sql/read\"],\n      },\n      \"$.sqlRead\",\n    );\n  }\n\n  private requiresRenewal(delegation: PortableDelegation): boolean {\n    const expiresAt = parseStrictRfc3339(delegation.expiresAt)!;\n    return (\n      expiresAt - this.now().getTime() <= REQUESTER_NEAR_EXPIRY_SECONDS * 1000\n    );\n  }\n\n  private async challengeRequestWithRetry(\n    request: RequesterHttpRequest,\n  ): Promise<RequesterHttpResponse> {\n    let lastError: unknown;\n    const attempts = Math.max(1, this.engineRetryAttempts);\n    for (let attempt = 0; attempt < attempts; attempt++) {\n      try {\n        const response = await this.transport.request(request);\n        this.assertPolicyEngineResponse(response, \"/policy/v0/challenge\");\n        if (response.status >= 500) {\n          lastError = new Error(`engine returned ${response.status}`);\n        } else if (response.status >= 400) {\n          const denial = parseDenialBody(response.body);\n          if (denial !== undefined) {\n            throw errorForDenial(denial, response.status);\n          }\n          throw new TranscriptRequesterError(\n            \"requester-engine-response-invalid\",\n            \"policy engine returned an invalid denial body\",\n          );\n        } else {\n          return response;\n        }\n      } catch (error) {\n        if (\n          error instanceof TranscriptRequesterError &&\n          error.state !== \"unreachable\"\n        ) {\n          throw error;\n        }\n        lastError = error;\n      }\n      if (attempt + 1 < attempts) {\n        await this.sleep(retryDelay(attempt, this.random()));\n      }\n    }\n    throw new TranscriptRequesterError(\n      \"requester-engine-unreachable\",\n      lastError instanceof Error\n        ? lastError.message\n        : \"policy engine unreachable\",\n      \"unreachable\",\n    );\n  }\n\n  private async resolveRequestOnce(\n    request: RequesterHttpRequest,\n  ): Promise<RequesterHttpResponse> {\n    try {\n      const response = await this.transport.request(request);\n      this.assertPolicyEngineResponse(response, \"/policy/v0/resolve\");\n      if (response.status >= 500) {\n        throw new TranscriptRequesterError(\n          \"requester-engine-unreachable\",\n          `engine returned ${response.status}`,\n          \"unreachable\",\n        );\n      }\n      if (response.status >= 400) {\n        const denial = parseDenialBody(response.body);\n        if (denial !== undefined) {\n          throw errorForDenial(denial, response.status);\n        }\n        throw new TranscriptRequesterError(\n          \"requester-engine-response-invalid\",\n          \"policy engine returned an invalid denial body\",\n        );\n      }\n      return response;\n    } catch (error) {\n      if (error instanceof TranscriptRequesterError) {\n        throw error;\n      }\n      throw new TranscriptRequesterError(\n        \"requester-engine-unreachable\",\n        error instanceof Error ? error.message : \"policy engine unreachable\",\n        \"unreachable\",\n      );\n    }\n  }\n}\n\nexport async function createTranscriptRequester(\n  options: TranscriptRequesterOptions,\n): Promise<TranscriptRequester> {\n  return TranscriptRequester.create(options);\n}\n\nfunction parseBootstrap(input: unknown): TranscriptShareBootstrap & {\n  readonly resourceHint: { readonly requestedCapabilities: readonly unknown[] };\n} {\n  const normalized = normalizeExternal(input, \"requester-bootstrap-malformed\");\n  const parsed = BootstrapSchema.safeParse(normalized);\n  if (!parsed.success) {\n    throw new TranscriptRequesterError(\n      parsed.error.issues.some((issue) => issue.code === \"unrecognized_keys\")\n        ? \"requester-bootstrap-unknown-key\"\n        : \"requester-bootstrap-malformed\",\n      parsed.error.message,\n      \"bootstrap-invalid\",\n    );\n  }\n  return parsed.data as TranscriptShareBootstrap & {\n    readonly resourceHint: {\n      readonly requestedCapabilities: readonly unknown[];\n    };\n  };\n}\n\nasync function verifyRecordBeforeEgress(\n  bootstrap: TranscriptShareBootstrap,\n  options: TranscriptRequesterOptions,\n) {\n  try {\n    return await verifyPolicyEngineRecordForRequester({\n      signedRecord: bootstrap.policyEngine.signedRecord,\n      ownerDid: options.ownerDid,\n      audience: options.audience,\n      grantIssuerDid: options.grantIssuerDid,\n      now: (options.now ?? (() => new Date()))()\n        .toISOString()\n        .replace(\".000Z\", \"Z\"),\n      requiredPolicyVersion: POLICY_VERSION_V0,\n      requiredEvidenceVerifier: W3C_VC_CREDENTIAL_VERIFIER,\n    });\n  } catch (error) {\n    const code = errorCodeForRecordFailure(error);\n    throw new TranscriptRequesterError(\n      code,\n      error instanceof Error ? error.message : String(error),\n      \"bootstrap-invalid\",\n    );\n  }\n}\n\nfunction errorCodeForRecordFailure(\n  error: unknown,\n): TranscriptRequesterErrorCode {\n  const code =\n    typeof error === \"object\" && error !== null && \"code\" in error\n      ? (error as { code?: unknown }).code\n      : undefined;\n  if (code === \"policy-engine-record-signature-invalid\") {\n    return \"requester-engine-record-signature-invalid\";\n  }\n  if (code === \"policy-engine-record-owner-mismatch\") {\n    return \"requester-engine-record-owner-mismatch\";\n  }\n  if (code === \"policy-engine-record-audience-mismatch\") {\n    return \"requester-engine-record-audience-mismatch\";\n  }\n  return \"requester-engine-record-invalid\";\n}\n\nfunction parsePolicyCapability(input: unknown, path: string): PolicyCapability {\n  try {\n    return normalizePolicyCapabilityForRequester(\n      input,\n    ) as unknown as PolicyCapability;\n  } catch (error) {\n    throw new TranscriptRequesterError(\n      \"requester-delegation-invalid\",\n      `${path}: ${error instanceof Error ? error.message : String(error)}`,\n    );\n  }\n}\n\nfunction listenSqlStatementFromCatalog(\n  statementName: unknown,\n): ListenSqlStatement {\n  if (typeof statementName !== \"string\") {\n    throw new TranscriptRequesterError(\n      \"requester-access-not-contained\",\n      \"SQL statement name must be a string from the canonical Listen statement catalog\",\n      \"not-contained\",\n    );\n  }\n  const statement = LISTEN_SQL_STATEMENT_BY_NAME.get(statementName);\n  if (statement === undefined) {\n    throw new TranscriptRequesterError(\n      \"requester-access-not-contained\",\n      \"SQL statement is not in the canonical Listen statement catalog\",\n      \"not-contained\",\n    );\n  }\n  return statement;\n}\n\nfunction normalizePolicyCapabilityForRequester(\n  input: unknown,\n): PolicyCapability {\n  const normalized = normalizeExternal(input, \"requester-delegation-invalid\");\n  return normalizePolicyCapability(normalized);\n}\n\nfunction requestedCapabilitiesHash(\n  capabilities: readonly PolicyCapability[],\n): string {\n  const canonical = [...capabilities].sort((left, right) =>\n    `${left.service}\\0${left.space}\\0${left.path}`.localeCompare(\n      `${right.service}\\0${right.space}\\0${right.path}`,\n    ),\n  );\n  const encoder = new TextEncoder();\n  const domain = encoder.encode(\n    \"xyz.tinycloud.policy/RequestedCapabilities/v0\\0\",\n  );\n  const body = encoder.encode(jcsCanonicalize(canonical));\n  const bytes = new Uint8Array(domain.length + body.length);\n  bytes.set(domain, 0);\n  bytes.set(body, domain.length);\n  return bytesToHex(sha256(bytes, \"bytes\")).slice(2);\n}\n\nfunction normalizeWireDelegation(\n  delegation: z.infer<typeof WireDelegationSchema>,\n): NormalizedWireDelegation {\n  const signed = delegationAuthorityFromCompactJws(delegation.encoded);\n  const invalid = (field: string): never => {\n    throw new TranscriptRequesterError(\n      \"requester-delegation-invalid\",\n      `portable delegation ${field} does not match its signed compact-JWS authority`,\n    );\n  };\n  if (delegation.delegationId !== deriveDelegationCid(delegation.encoded))\n    invalid(\"delegationId\");\n  if (delegation.issuerDid !== signed.issuerDid) invalid(\"issuerDid\");\n  if (delegation.holderDid !== signed.holderDid) invalid(\"holderDid\");\n  if (delegation.policyId !== signed.policyId) invalid(\"policyId\");\n  if (Date.parse(delegation.issuedAt) !== signed.issuedAtMs)\n    invalid(\"issuedAt\");\n  if (Date.parse(delegation.expiresAt) !== signed.expiresAtMs)\n    invalid(\"expiresAt\");\n  if (delegation.terminal !== signed.terminal) invalid(\"terminal\");\n  if (delegation.issuanceId !== signed.issuanceId) invalid(\"issuanceId\");\n  if (delegation.capabilityHashHex !== signed.capabilityHashHex)\n    invalid(\"capabilityHashHex\");\n  if (delegation.revocationMode !== signed.revocationMode)\n    invalid(\"revocationMode\");\n  return {\n    delegationId: deriveDelegationCid(delegation.encoded),\n    issuerDid: signed.issuerDid,\n    holderDid: signed.holderDid,\n    policyId: signed.policyId,\n    issuedAt: new Date(signed.issuedAtMs).toISOString().replace(\".000Z\", \"Z\"),\n    expiresAt: new Date(signed.expiresAtMs).toISOString().replace(\".000Z\", \"Z\"),\n    terminal: signed.terminal,\n    maxTtlSeconds: Math.ceil((signed.expiresAtMs - signed.issuedAtMs) / 1000),\n    capabilities: signed.capabilities,\n    encoded: delegation.encoded,\n  };\n}\n\n/**\n * Parse a frozen policy-engine delegation response and derive its authority\n * exclusively from the signed compact-JWS payload. This performs no egress or\n * node import and is suitable for constrained runners that cannot honestly\n * satisfy the public-endpoint transport profile.\n */\nexport function parseNodeNativePortableDelegation(\n  input: unknown,\n): PortableDelegation {\n  return normalizeWireDelegation(\n    parseEngineSuccess(input, WireDelegationSchema, \"portable delegation\"),\n  );\n}\n\nfunction delegationAuthorityFromCompactJws(encoded: string): {\n  issuerDid: string;\n  holderDid: string;\n  policyId: string;\n  issuanceId: string;\n  capabilityHashHex: string;\n  revocationMode: \"refresh_only\";\n  issuedAtMs: number;\n  expiresAtMs: number;\n  terminal: boolean;\n  capabilities: PolicyCapability[];\n} {\n  try {\n    const parts = encoded.split(\".\");\n    if (parts.length !== 3) throw new Error(\"not compact JWS\");\n    const payload = normalizeJson(\n      JSON.parse(new TextDecoder().decode(base64UrlBytes(parts[1]!))),\n    ) as Record<string, unknown>;\n    const issuer = requiredPayloadString(payload, \"iss\");\n    const holderDid = requiredPayloadString(payload, \"aud\");\n    const issuedAt = requiredPayloadEpoch(payload, \"nbf\");\n    const expiresAt = requiredPayloadEpoch(payload, \"exp\");\n    const facts = payload.fct;\n    if (!Array.isArray(facts)) throw new Error(\"UCAN fct is absent\");\n    const authorityFacts = facts.filter(\n      (fact) =>\n        fact !== null &&\n        typeof fact === \"object\" &&\n        !Array.isArray(fact) &&\n        \"xyz.tinycloud.policy/policyId\" in fact,\n    ) as Record<string, unknown>[];\n    if (authorityFacts.length !== 1)\n      throw new Error(\"UCAN policy authority fact is not unique\");\n    const fact = authorityFacts[0]!;\n    const policyId = requiredPayloadString(\n      fact,\n      \"xyz.tinycloud.policy/policyId\",\n    );\n    const issuanceId = requiredPayloadString(\n      fact,\n      \"xyz.tinycloud.policy/issuanceId\",\n    );\n    const capabilityHashHex = requiredPayloadString(\n      fact,\n      \"xyz.tinycloud.policy/capabilityHashHex\",\n    );\n    if (!/^[0-9a-f]{64}$/.test(capabilityHashHex)) {\n      throw new Error(\n        \"UCAN capability hash is not 64 lowercase hex characters\",\n      );\n    }\n    const revocationMode = requiredPayloadString(\n      fact,\n      \"xyz.tinycloud.policy/revocationMode\",\n    );\n    const delegationMode = requiredPayloadString(\n      fact,\n      \"xyz.tinycloud.policy/delegationMode\",\n    );\n    if (revocationMode !== \"refresh_only\")\n      throw new Error(\"unsupported UCAN revocation mode\");\n    if (delegationMode !== \"terminal\")\n      throw new Error(\"UCAN delegation is not terminal\");\n    const att = payload.att;\n    if (att === null || typeof att !== \"object\" || Array.isArray(att)) {\n      throw new Error(\"UCAN att is absent\");\n    }\n    const capabilities: PolicyCapability[] = [];\n    for (const [resource, rawAbilities] of Object.entries(att)) {\n      if (\n        rawAbilities === null ||\n        typeof rawAbilities !== \"object\" ||\n        Array.isArray(rawAbilities)\n      ) {\n        throw new Error(\"UCAN att abilities are invalid\");\n      }\n      const abilities = rawAbilities as Record<string, unknown>;\n      const marker = resource.indexOf(\"/sql/\");\n      if (!resource.startsWith(\"tinycloud:\") || marker < 0)\n        throw new Error(\"unsupported UCAN resource\");\n      const space = resource.slice(0, marker);\n      const path = resource.slice(marker + \"/sql/\".length);\n      for (const [action, rawCaveats] of Object.entries(abilities)) {\n        const service = action.startsWith(\"tinycloud.sql/\")\n          ? \"tinycloud.sql\"\n          : action.startsWith(\"tinycloud.kv/\")\n            ? \"tinycloud.kv\"\n            : undefined;\n        if (!Array.isArray(rawCaveats) || rawCaveats.length !== 1) {\n          throw new Error(\"UCAN ability must have exactly one caveat branch\");\n        }\n        const caveats = rawCaveats;\n        if (service === undefined) throw new Error(\"unsupported UCAN ability\");\n        const first = caveats[0];\n        capabilities.push(\n          normalizePolicyCapability({\n            service,\n            space,\n            path,\n            actions: [action],\n            ...(first !== null &&\n            typeof first === \"object\" &&\n            !Array.isArray(first) &&\n            Object.keys(first).length > 0\n              ? { caveats: first }\n              : {}),\n          }),\n        );\n      }\n    }\n    if (capabilities.length === 0) throw new Error(\"UCAN att is empty\");\n    const fragment = issuer.indexOf(\"#\");\n    const issuerDid = fragment < 0 ? issuer : issuer.slice(0, fragment);\n    if (!issuerDid.startsWith(\"did:\") || !holderDid.startsWith(\"did:\")) {\n      throw new Error(\"UCAN issuer or audience is not a DID\");\n    }\n    return {\n      issuerDid,\n      holderDid,\n      policyId,\n      issuanceId,\n      capabilityHashHex,\n      revocationMode,\n      issuedAtMs: issuedAt * 1000,\n      expiresAtMs: expiresAt * 1000,\n      terminal: true,\n      capabilities,\n    };\n  } catch (error) {\n    throw new TranscriptRequesterError(\n      \"requester-delegation-invalid\",\n      `node-native compact-JWS capabilities are invalid: ${error instanceof Error ? error.message : String(error)}`,\n    );\n  }\n}\n\nfunction requiredPayloadString(\n  payload: Record<string, unknown>,\n  key: string,\n): string {\n  const value = payload[key];\n  if (typeof value !== \"string\" || value.length === 0) {\n    throw new Error(`UCAN ${key} is not a non-empty string`);\n  }\n  return value;\n}\n\nfunction requiredPayloadEpoch(\n  payload: Record<string, unknown>,\n  key: string,\n): number {\n  const value = payload[key];\n  if (typeof value !== \"number\" || !Number.isSafeInteger(value) || value < 0) {\n    throw new Error(`UCAN ${key} is not a non-negative integer epoch`);\n  }\n  return value;\n}\n\nfunction base64UrlBytes(value: string): Uint8Array {\n  const normalized = value.replace(/-/g, \"+\").replace(/_/g, \"/\");\n  const padded = normalized.padEnd(Math.ceil(normalized.length / 4) * 4, \"=\");\n  const binary = atob(padded);\n  return Uint8Array.from(binary, (character) => character.charCodeAt(0));\n}\n\nfunction parseEngineSuccess<T>(\n  input: unknown,\n  schema: z.ZodType<T>,\n  label: string,\n): T {\n  const normalized = normalizeExternal(\n    input,\n    \"requester-engine-response-invalid\",\n  );\n  const denial = parseDenialBody(normalized);\n  if (denial !== undefined) {\n    throw errorForDenial(denial);\n  }\n  const parsed = schema.safeParse(normalized);\n  if (!parsed.success) {\n    throw new TranscriptRequesterError(\n      \"requester-engine-response-invalid\",\n      `${label} failed validation: ${parsed.error.message}`,\n    );\n  }\n  return parsed.data;\n}\n\nfunction parseDataResponse<T>(\n  response: RequesterHttpResponse,\n  schema: z.ZodType<T>,\n  label: string,\n): T {\n  if (response.status >= 500) {\n    throw new TranscriptRequesterError(\n      \"requester-access-unreachable\",\n      `${label} endpoint returned ${response.status}`,\n      \"unreachable\",\n    );\n  }\n  if (response.status >= 400) {\n    const normalized = normalizeExternal(\n      response.body,\n      \"requester-access-denied\",\n    );\n    const denial = parseDenialBody(normalized);\n    if (denial !== undefined) {\n      throw errorForDenial(denial, response.status);\n    }\n    throw new TranscriptRequesterError(\n      \"requester-access-denied\",\n      `${label} denied`,\n      \"denied\",\n    );\n  }\n  const normalized = normalizeExternal(\n    response.body,\n    \"requester-engine-response-invalid\",\n  );\n  const parsed = schema.safeParse(normalized);\n  if (!parsed.success) {\n    throw new TranscriptRequesterError(\n      \"requester-engine-response-invalid\",\n      `${label} response failed validation: ${parsed.error.message}`,\n    );\n  }\n  return parsed.data;\n}\n\nfunction parseDelegateReceipt(\n  response: RequesterHttpResponse,\n): z.infer<typeof DelegateReceiptSchema> {\n  if (response.status !== 200) {\n    throw new TranscriptRequesterError(\n      \"requester-delegation-import-failed\",\n      `owner node delegation import returned ${response.status}`,\n      response.status >= 500 ? \"invalid\" : \"denied\",\n      undefined,\n      response.status,\n    );\n  }\n  const normalized = normalizeExternal(\n    response.body,\n    \"requester-delegation-import-failed\",\n  );\n  const parsed = DelegateReceiptSchema.safeParse(normalized);\n  if (!parsed.success) {\n    throw new TranscriptRequesterError(\n      \"requester-delegation-import-failed\",\n      `owner node delegation receipt failed validation: ${parsed.error.message}`,\n    );\n  }\n  return parsed.data;\n}\n\nfunction parseNodeDataResponse<T>(\n  response: RequesterHttpResponse,\n  schema: z.ZodType<T>,\n  label: string,\n): T {\n  if (response.status >= 500) {\n    throw new TranscriptRequesterError(\n      \"requester-node-unreachable\",\n      `${label} node returned ${response.status}: ${nodeErrorMessage(response.body)}`,\n      \"unreachable\",\n      undefined,\n      response.status,\n    );\n  }\n  if (response.status >= 400) {\n    throw new TranscriptRequesterError(\n      \"requester-node-denied\",\n      `${label} node denied: ${nodeErrorMessage(response.body)}`,\n      \"denied\",\n      undefined,\n      response.status,\n    );\n  }\n  const normalized = normalizeExternal(\n    response.body,\n    \"requester-node-response-invalid\",\n  );\n  const parsed = schema.safeParse(normalized);\n  if (!parsed.success) {\n    throw new TranscriptRequesterError(\n      \"requester-node-response-invalid\",\n      `${label} node response failed validation: ${parsed.error.message}`,\n    );\n  }\n  return parsed.data;\n}\n\nfunction nodeErrorMessage(body: unknown): string {\n  if (typeof body === \"string\") return body;\n  if (body !== null && typeof body === \"object\") {\n    const record = body as Record<string, unknown>;\n    const code = typeof record.code === \"string\" ? record.code : undefined;\n    const message =\n      typeof record.message === \"string\" ? record.message : undefined;\n    if (code !== undefined)\n      return message === undefined ? code : `${code}: ${message}`;\n  }\n  return \"native node refusal\";\n}\n\nexport function deriveDelegationCid(encoded: string): string {\n  const digest = createDigest(0x1e, blake3(new TextEncoder().encode(encoded)));\n  return CID.createV1(0x55, digest).toString();\n}\n\nfunction headersRecord(headers: ServiceHeaders): Record<string, string> {\n  return Array.isArray(headers) ? Object.fromEntries(headers) : headers;\n}\n\nasync function validateAndResolveOwnerNode(\n  endpoint: string,\n  transport: RequesterTransport,\n): Promise<ReadonlySet<string>> {\n  return validateAndResolvePublicEndpoint(endpoint, transport, \"owner-node\");\n}\n\nasync function validateAndResolvePublicEndpoint(\n  endpoint: string,\n  transport: RequesterTransport,\n  kind: \"owner-node\" | \"policy-engine\",\n): Promise<ReadonlySet<string>> {\n  let url: URL;\n  try {\n    url = new URL(endpoint);\n  } catch {\n    throw endpointError(kind, `${kind} endpoint is not a URL`);\n  }\n  if (\n    url.protocol !== \"https:\" ||\n    url.username !== \"\" ||\n    url.password !== \"\" ||\n    url.hash !== \"\" ||\n    url.search !== \"\"\n  ) {\n    throw endpointError(\n      kind,\n      `${kind} endpoint must use HTTPS without credentials, query, or fragment`,\n    );\n  }\n  if (transport.resolveEndpoint === undefined) {\n    throw endpointError(\n      kind,\n      `${kind} endpoint resolution metadata is required`,\n    );\n  }\n  let resolution: RequesterEndpointResolution;\n  try {\n    resolution = await transport.resolveEndpoint(url.origin);\n  } catch (error) {\n    throw endpointError(\n      kind,\n      `${kind} endpoint resolution failed: ${error instanceof Error ? error.message : String(error)}`,\n    );\n  }\n  if (resolution.addresses.length === 0) {\n    throw endpointError(kind, `${kind} endpoint resolved to no addresses`);\n  }\n  const addresses = new Set<string>();\n  for (const address of resolution.addresses) {\n    const normalized = normalizeIp(address);\n    if (!isPublicIp(normalized)) {\n      throw endpointError(\n        kind,\n        `${kind} endpoint resolved to a non-public address: ${address}`,\n      );\n    }\n    addresses.add(normalized);\n  }\n  return addresses;\n}\n\nfunction endpointError(\n  kind: \"owner-node\" | \"policy-engine\",\n  message: string,\n): TranscriptRequesterError {\n  return new TranscriptRequesterError(\n    kind === \"owner-node\"\n      ? \"requester-owner-node-endpoint-invalid\"\n      : \"requester-policy-engine-endpoint-invalid\",\n    message,\n    \"bootstrap-invalid\",\n  );\n}\n\nfunction normalizeIp(value: string): string {\n  return value.toLowerCase().replace(/^\\[|\\]$/g, \"\");\n}\n\nfunction isPublicIp(value: string): boolean {\n  const ip = normalizeIp(value);\n  const parts = ip.split(\".\");\n  if (\n    parts.length === 4 &&\n    parts.every((part) => /^\\d+$/.test(part) && Number(part) <= 255)\n  ) {\n    const [a, b] = parts.map(Number) as [number, number, number, number];\n    return !(\n      a === 0 ||\n      a === 10 ||\n      a === 127 ||\n      (a === 100 && b >= 64 && b <= 127) ||\n      (a === 169 && b === 254) ||\n      (a === 172 && b >= 16 && b <= 31) ||\n      (a === 192 && b === 0) ||\n      (a === 192 && b === 168) ||\n      (a === 198 && (b === 18 || b === 19)) ||\n      (a === 198 && b === 51 && parts[2] === \"100\") ||\n      (a === 203 && b === 0 && parts[2] === \"113\") ||\n      a >= 224\n    );\n  }\n  if (!ip.includes(\":\")) return false;\n  if (\n    ip === \"::\" ||\n    ip === \"::1\" ||\n    ip.startsWith(\"2001:db8:\") ||\n    ip.startsWith(\"fe8\") ||\n    ip.startsWith(\"fe9\") ||\n    ip.startsWith(\"fea\") ||\n    ip.startsWith(\"feb\") ||\n    ip.startsWith(\"fc\") ||\n    ip.startsWith(\"fd\") ||\n    ip.startsWith(\"ff\")\n  )\n    return false;\n  const mapped = ip.match(/^::ffff:(\\d+\\.\\d+\\.\\d+\\.\\d+)$/);\n  if (mapped !== null) return isPublicIp(mapped[1]!);\n  const mappedHex = ip.match(/^::ffff:([0-9a-f]{1,4}):([0-9a-f]{1,4})$/);\n  if (mappedHex !== null) {\n    const high = Number.parseInt(mappedHex[1]!, 16);\n    const low = Number.parseInt(mappedHex[2]!, 16);\n    return isPublicIp(`${high >> 8}.${high & 255}.${low >> 8}.${low & 255}`);\n  }\n  return true;\n}\n\nfunction parseDenialBody(\n  input: unknown,\n):\n  | { code: PolicyEngineGrantPresentationDenialCode; message?: string }\n  | undefined {\n  const normalized = normalizeExternal(\n    input,\n    \"requester-engine-response-invalid\",\n  );\n  const direct = DenialSchema.safeParse(normalized);\n  if (direct.success) {\n    return { code: direct.data.code, message: direct.data.message };\n  }\n  const envelope = ErrorEnvelopeDenialSchema.safeParse(normalized);\n  if (envelope.success) {\n    return {\n      code: envelope.data.error.code,\n      message: envelope.data.error.message,\n    };\n  }\n  return undefined;\n}\n\nfunction errorForDenial(\n  denial: { code: PolicyEngineGrantPresentationDenialCode; message?: string },\n  status?: number,\n): TranscriptRequesterError {\n  const accessEnded =\n    denial.code === \"policy-inactive\" ||\n    denial.code === \"policy-revoked\" ||\n    denial.code === \"policy-expired\";\n  return new TranscriptRequesterError(\n    `policy-engine-denied-${denial.code}`,\n    denial.message ?? `policy engine denied ${denial.code}`,\n    accessEnded ? \"access-ended\" : \"denied\",\n    denial.code,\n    status,\n  );\n}\n\nfunction retryDelay(attempt: number, random: number): number {\n  const base = Math.min(REQUESTER_ENGINE_RETRY_MAX_DELAY_MS, 50 * 2 ** attempt);\n  return Math.min(\n    REQUESTER_ENGINE_RETRY_MAX_DELAY_MS,\n    Math.floor(base * (0.5 + random)),\n  );\n}\n\nfunction trimTrailingSlash(value: string): string {\n  return value.endsWith(\"/\") ? value.slice(0, -1) : value;\n}\n\nfunction normalizeExternal(\n  input: unknown,\n  code: TranscriptRequesterErrorCode,\n): unknown {\n  try {\n    return normalizeJson(input);\n  } catch (error) {\n    throw new TranscriptRequesterError(\n      code,\n      error instanceof Error ? error.message : String(error),\n    );\n  }\n}\n\nfunction parseStrictRfc3339(value: string): number | undefined {\n  if (\n    !/^(\\d{4})-(\\d{2})-(\\d{2})T(\\d{2}):(\\d{2}):(\\d{2})(\\.\\d+)?(Z|[+-]\\d{2}:\\d{2})$/.test(\n      value,\n    )\n  ) {\n    return undefined;\n  }\n  const parsed = Date.parse(value);\n  if (Number.isNaN(parsed)) {\n    return undefined;\n  }\n  const canonical = new Date(parsed).toISOString().replace(\".000Z\", \"Z\");\n  const reparsed = Date.parse(value);\n  return Date.parse(canonical) === reparsed ? parsed : undefined;\n}\n","import { rfc4648 } from './base.js'\n\nexport const base32 = rfc4648({\n  prefix: 'b',\n  name: 'base32',\n  alphabet: 'abcdefghijklmnopqrstuvwxyz234567',\n  bitsPerChar: 5\n})\n\nexport const base32upper = rfc4648({\n  prefix: 'B',\n  name: 'base32upper',\n  alphabet: 'ABCDEFGHIJKLMNOPQRSTUVWXYZ234567',\n  bitsPerChar: 5\n})\n\nexport const base32pad = rfc4648({\n  prefix: 'c',\n  name: 'base32pad',\n  alphabet: 'abcdefghijklmnopqrstuvwxyz234567=',\n  bitsPerChar: 5\n})\n\nexport const base32padupper = rfc4648({\n  prefix: 'C',\n  name: 'base32padupper',\n  alphabet: 'ABCDEFGHIJKLMNOPQRSTUVWXYZ234567=',\n  bitsPerChar: 5\n})\n\nexport const base32hex = rfc4648({\n  prefix: 'v',\n  name: 'base32hex',\n  alphabet: '0123456789abcdefghijklmnopqrstuv',\n  bitsPerChar: 5\n})\n\nexport const base32hexupper = rfc4648({\n  prefix: 'V',\n  name: 'base32hexupper',\n  alphabet: '0123456789ABCDEFGHIJKLMNOPQRSTUV',\n  bitsPerChar: 5\n})\n\nexport const base32hexpad = rfc4648({\n  prefix: 't',\n  name: 'base32hexpad',\n  alphabet: '0123456789abcdefghijklmnopqrstuv=',\n  bitsPerChar: 5\n})\n\nexport const base32hexpadupper = rfc4648({\n  prefix: 'T',\n  name: 'base32hexpadupper',\n  alphabet: '0123456789ABCDEFGHIJKLMNOPQRSTUV=',\n  bitsPerChar: 5\n})\n\nexport const base32z = rfc4648({\n  prefix: 'h',\n  name: 'base32z',\n  alphabet: 'ybndrfg8ejkmcpqxot1uwisza345h769',\n  bitsPerChar: 5\n})\n","export const empty = new Uint8Array(0)\n\nexport function toHex (d: Uint8Array): string {\n  return d.reduce((hex, byte) => hex + byte.toString(16).padStart(2, '0'), '')\n}\n\nexport function fromHex (hex: string): Uint8Array {\n  const hexes = hex.match(/../g)\n  return hexes != null ? new Uint8Array(hexes.map(b => parseInt(b, 16))) : empty\n}\n\nexport function equals (aa: Uint8Array, bb: Uint8Array): boolean {\n  if (aa === bb) { return true }\n  if (aa.byteLength !== bb.byteLength) {\n    return false\n  }\n\n  for (let ii = 0; ii < aa.byteLength; ii++) {\n    if (aa[ii] !== bb[ii]) {\n      return false\n    }\n  }\n\n  return true\n}\n\nexport function coerce (o: ArrayBufferView | ArrayBuffer | Uint8Array): Uint8Array {\n  if (o instanceof Uint8Array && o.constructor.name === 'Uint8Array') { return o }\n  if (o instanceof ArrayBuffer) { return new Uint8Array(o) }\n  if (ArrayBuffer.isView(o)) {\n    return new Uint8Array(o.buffer, o.byteOffset, o.byteLength)\n  }\n  throw new Error('Unknown type, must be binary type')\n}\n\nexport function isBinary (o: unknown): o is ArrayBuffer | ArrayBufferView {\n  return o instanceof ArrayBuffer || ArrayBuffer.isView(o)\n}\n\nexport function fromString (str: string): Uint8Array {\n  return new TextEncoder().encode(str)\n}\n\nexport function toString (b: Uint8Array): string {\n  return new TextDecoder().decode(b)\n}\n","/* eslint-disable */\n// base-x encoding / decoding\n// Copyright (c) 2018 base-x contributors\n// Copyright (c) 2014-2018 The Bitcoin Core developers (base58.cpp)\n// Distributed under the MIT software license, see the accompanying\n// file LICENSE or http://www.opensource.org/licenses/mit-license.php.\n/**\n * @param {string} ALPHABET\n * @param {any} name\n */\nfunction base (ALPHABET, name) {\n  if (ALPHABET.length >= 255) { throw new TypeError('Alphabet too long') }\n  var BASE_MAP = new Uint8Array(256);\n  for (var j = 0; j < BASE_MAP.length; j++) {\n    BASE_MAP[j] = 255;\n  }\n  for (var i = 0; i < ALPHABET.length; i++) {\n    var x = ALPHABET.charAt(i);\n    var xc = x.charCodeAt(0);\n    if (BASE_MAP[xc] !== 255) { throw new TypeError(x + ' is ambiguous') }\n    BASE_MAP[xc] = i;\n  }\n  var BASE = ALPHABET.length;\n  var LEADER = ALPHABET.charAt(0);\n  var FACTOR = Math.log(BASE) / Math.log(256); // log(BASE) / log(256), rounded up\n  var iFACTOR = Math.log(256) / Math.log(BASE); // log(256) / log(BASE), rounded up\n  /**\n   * @param {any[] | Iterable<number>} source\n   */\n  function encode (source) {\n    // @ts-ignore\n    if (source instanceof Uint8Array) ; else if (ArrayBuffer.isView(source)) {\n      source = new Uint8Array(source.buffer, source.byteOffset, source.byteLength);\n    } else if (Array.isArray(source)) {\n      source = Uint8Array.from(source);\n    }\n    if (!(source instanceof Uint8Array)) { throw new TypeError('Expected Uint8Array') }\n    if (source.length === 0) { return '' }\n        // Skip & count leading zeroes.\n    var zeroes = 0;\n    var length = 0;\n    var pbegin = 0;\n    var pend = source.length;\n    while (pbegin !== pend && source[pbegin] === 0) {\n      pbegin++;\n      zeroes++;\n    }\n        // Allocate enough space in big-endian base58 representation.\n    var size = ((pend - pbegin) * iFACTOR + 1) >>> 0;\n    var b58 = new Uint8Array(size);\n        // Process the bytes.\n    while (pbegin !== pend) {\n      var carry = source[pbegin];\n            // Apply \"b58 = b58 * 256 + ch\".\n      var i = 0;\n      for (var it1 = size - 1; (carry !== 0 || i < length) && (it1 !== -1); it1--, i++) {\n        carry += (256 * b58[it1]) >>> 0;\n        b58[it1] = (carry % BASE) >>> 0;\n        carry = (carry / BASE) >>> 0;\n      }\n      if (carry !== 0) { throw new Error('Non-zero carry') }\n      length = i;\n      pbegin++;\n    }\n        // Skip leading zeroes in base58 result.\n    var it2 = size - length;\n    while (it2 !== size && b58[it2] === 0) {\n      it2++;\n    }\n        // Translate the result into a string.\n    var str = LEADER.repeat(zeroes);\n    for (; it2 < size; ++it2) { str += ALPHABET.charAt(b58[it2]); }\n    return str\n  }\n  /**\n   * @param {string | string[]} source\n   */\n  function decodeUnsafe (source) {\n    if (typeof source !== 'string') { throw new TypeError('Expected String') }\n    if (source.length === 0) { return new Uint8Array() }\n    var psz = 0;\n        // Skip leading spaces.\n    if (source[psz] === ' ') { return }\n        // Skip and count leading '1's.\n    var zeroes = 0;\n    var length = 0;\n    while (source[psz] === LEADER) {\n      zeroes++;\n      psz++;\n    }\n        // Allocate enough space in big-endian base256 representation.\n    var size = (((source.length - psz) * FACTOR) + 1) >>> 0; // log(58) / log(256), rounded up.\n    var b256 = new Uint8Array(size);\n        // Process the characters.\n    while (source[psz]) {\n            // Decode character\n      var carry = BASE_MAP[source.charCodeAt(psz)];\n            // Invalid character\n      if (carry === 255) { return }\n      var i = 0;\n      for (var it3 = size - 1; (carry !== 0 || i < length) && (it3 !== -1); it3--, i++) {\n        carry += (BASE * b256[it3]) >>> 0;\n        b256[it3] = (carry % 256) >>> 0;\n        carry = (carry / 256) >>> 0;\n      }\n      if (carry !== 0) { throw new Error('Non-zero carry') }\n      length = i;\n      psz++;\n    }\n        // Skip trailing spaces.\n    if (source[psz] === ' ') { return }\n        // Skip leading zeroes in b256.\n    var it4 = size - length;\n    while (it4 !== size && b256[it4] === 0) {\n      it4++;\n    }\n    var vch = new Uint8Array(zeroes + (size - it4));\n    var j = zeroes;\n    while (it4 !== size) {\n      vch[j++] = b256[it4++];\n    }\n    return vch\n  }\n  /**\n   * @param {string | string[]} string\n   */\n  function decode (string) {\n    var buffer = decodeUnsafe(string);\n    if (buffer) { return buffer }\n    throw new Error(`Non-${name} character`)\n  }\n  return {\n    encode: encode,\n    decodeUnsafe: decodeUnsafe,\n    decode: decode\n  }\n}\nvar src = base;\n\nvar _brrp__multiformats_scope_baseX = src;\n\nexport default _brrp__multiformats_scope_baseX;\n","import { coerce } from '../bytes.js'\nimport basex from '../vendor/base-x.js'\nimport type { BaseCodec, BaseDecoder, BaseEncoder, CombobaseDecoder, Multibase, MultibaseCodec, MultibaseDecoder, MultibaseEncoder, UnibaseDecoder } from './interface.js'\n\ninterface EncodeFn { (bytes: Uint8Array): string }\ninterface DecodeFn { (text: string): Uint8Array }\n\n/**\n * Class represents both BaseEncoder and MultibaseEncoder meaning it\n * can be used to encode to multibase or base encode without multibase\n * prefix.\n */\nclass Encoder<Base extends string, Prefix extends string> implements MultibaseEncoder<Prefix>, BaseEncoder {\n  readonly name: Base\n  readonly prefix: Prefix\n  readonly baseEncode: EncodeFn\n\n  constructor (name: Base, prefix: Prefix, baseEncode: EncodeFn) {\n    this.name = name\n    this.prefix = prefix\n    this.baseEncode = baseEncode\n  }\n\n  encode (bytes: Uint8Array): Multibase<Prefix> {\n    if (bytes instanceof Uint8Array) {\n      return `${this.prefix}${this.baseEncode(bytes)}`\n    } else {\n      throw Error('Unknown type, must be binary type')\n    }\n  }\n}\n\n/**\n * Class represents both BaseDecoder and MultibaseDecoder so it could be used\n * to decode multibases (with matching prefix) or just base decode strings\n * with corresponding base encoding.\n */\nclass Decoder<Base extends string, Prefix extends string> implements MultibaseDecoder<Prefix>, UnibaseDecoder<Prefix>, BaseDecoder {\n  readonly name: Base\n  readonly prefix: Prefix\n  readonly baseDecode: DecodeFn\n  private readonly prefixCodePoint: number\n\n  constructor (name: Base, prefix: Prefix, baseDecode: DecodeFn) {\n    this.name = name\n    this.prefix = prefix\n    const prefixCodePoint = prefix.codePointAt(0)\n    /* c8 ignore next 3 */\n    if (prefixCodePoint === undefined) {\n      throw new Error('Invalid prefix character')\n    }\n    this.prefixCodePoint = prefixCodePoint\n    this.baseDecode = baseDecode\n  }\n\n  decode (text: string): Uint8Array {\n    if (typeof text === 'string') {\n      if (text.codePointAt(0) !== this.prefixCodePoint) {\n        throw Error(`Unable to decode multibase string ${JSON.stringify(text)}, ${this.name} decoder only supports inputs prefixed with ${this.prefix}`)\n      }\n      return this.baseDecode(text.slice(this.prefix.length))\n    } else {\n      throw Error('Can only multibase decode strings')\n    }\n  }\n\n  or<OtherPrefix extends string> (decoder: UnibaseDecoder<OtherPrefix> | ComposedDecoder<OtherPrefix>): ComposedDecoder<Prefix | OtherPrefix> {\n    return or(this, decoder)\n  }\n}\n\ntype Decoders<Prefix extends string> = Record<Prefix, UnibaseDecoder<Prefix>>\n\nclass ComposedDecoder<Prefix extends string> implements MultibaseDecoder<Prefix>, CombobaseDecoder<Prefix> {\n  readonly decoders: Decoders<Prefix>\n\n  constructor (decoders: Decoders<Prefix>) {\n    this.decoders = decoders\n  }\n\n  or <OtherPrefix extends string> (decoder: UnibaseDecoder<OtherPrefix> | ComposedDecoder<OtherPrefix>): ComposedDecoder<Prefix | OtherPrefix> {\n    return or(this, decoder)\n  }\n\n  decode (input: string): Uint8Array {\n    const prefix = input[0] as Prefix\n    const decoder = this.decoders[prefix]\n    if (decoder != null) {\n      return decoder.decode(input)\n    } else {\n      throw RangeError(`Unable to decode multibase string ${JSON.stringify(input)}, only inputs prefixed with ${Object.keys(this.decoders)} are supported`)\n    }\n  }\n}\n\nexport function or <L extends string, R extends string> (left: UnibaseDecoder<L> | CombobaseDecoder<L>, right: UnibaseDecoder<R> | CombobaseDecoder<R>): ComposedDecoder<L | R> {\n  return new ComposedDecoder({\n    ...(left.decoders ?? { [(left as UnibaseDecoder<L>).prefix]: left }),\n    ...(right.decoders ?? { [(right as UnibaseDecoder<R>).prefix]: right })\n  } as Decoders<L | R>)\n}\n\nexport class Codec<Base extends string, Prefix extends string> implements MultibaseCodec<Prefix>, MultibaseEncoder<Prefix>, MultibaseDecoder<Prefix>, BaseCodec, BaseEncoder, BaseDecoder {\n  readonly name: Base\n  readonly prefix: Prefix\n  readonly baseEncode: EncodeFn\n  readonly baseDecode: DecodeFn\n  readonly encoder: Encoder<Base, Prefix>\n  readonly decoder: Decoder<Base, Prefix>\n\n  constructor (name: Base, prefix: Prefix, baseEncode: EncodeFn, baseDecode: DecodeFn) {\n    this.name = name\n    this.prefix = prefix\n    this.baseEncode = baseEncode\n    this.baseDecode = baseDecode\n    this.encoder = new Encoder(name, prefix, baseEncode)\n    this.decoder = new Decoder(name, prefix, baseDecode)\n  }\n\n  encode (input: Uint8Array): string {\n    return this.encoder.encode(input)\n  }\n\n  decode (input: string): Uint8Array {\n    return this.decoder.decode(input)\n  }\n}\n\nexport function from <Base extends string, Prefix extends string> ({ name, prefix, encode, decode }: { name: Base, prefix: Prefix, encode: EncodeFn, decode: DecodeFn }): Codec<Base, Prefix> {\n  return new Codec(name, prefix, encode, decode)\n}\n\nexport function baseX <Base extends string, Prefix extends string> ({ name, prefix, alphabet }: { name: Base, prefix: Prefix, alphabet: string }): Codec<Base, Prefix> {\n  const { encode, decode } = basex(alphabet, name)\n  return from({\n    prefix,\n    name,\n    encode,\n    decode: (text: string): Uint8Array => coerce(decode(text))\n  })\n}\n\nfunction decode (string: string, alphabetIdx: Record<string, number>, bitsPerChar: number, name: string): Uint8Array {\n  // Count the padding bytes:\n  let end = string.length\n  while (string[end - 1] === '=') {\n    --end\n  }\n\n  // Allocate the output:\n  const out = new Uint8Array((end * bitsPerChar / 8) | 0)\n\n  // Parse the data:\n  let bits = 0 // Number of bits currently in the buffer\n  let buffer = 0 // Bits waiting to be written out, MSB first\n  let written = 0 // Next byte to write\n  for (let i = 0; i < end; ++i) {\n    // Read one character from the string:\n    const value = alphabetIdx[string[i]]\n    if (value === undefined) {\n      throw new SyntaxError(`Non-${name} character`)\n    }\n\n    // Append the bits to the buffer:\n    buffer = (buffer << bitsPerChar) | value\n    bits += bitsPerChar\n\n    // Write out some bits if the buffer has a byte's worth:\n    if (bits >= 8) {\n      bits -= 8\n      out[written++] = 0xff & (buffer >> bits)\n    }\n  }\n\n  // Verify that we have received just enough bits:\n  if (bits >= bitsPerChar || (0xff & (buffer << (8 - bits))) !== 0) {\n    throw new SyntaxError('Unexpected end of data')\n  }\n\n  return out\n}\n\nfunction encode (data: Uint8Array, alphabet: string, bitsPerChar: number): string {\n  const pad = alphabet[alphabet.length - 1] === '='\n  const mask = (1 << bitsPerChar) - 1\n  let out = ''\n\n  let bits = 0 // Number of bits currently in the buffer\n  let buffer = 0 // Bits waiting to be written out, MSB first\n  for (let i = 0; i < data.length; ++i) {\n    // Slurp data into the buffer:\n    buffer = (buffer << 8) | data[i]\n    bits += 8\n\n    // Write out as much as we can:\n    while (bits > bitsPerChar) {\n      bits -= bitsPerChar\n      out += alphabet[mask & (buffer >> bits)]\n    }\n  }\n\n  // Partial character:\n  if (bits !== 0) {\n    out += alphabet[mask & (buffer << (bitsPerChar - bits))]\n  }\n\n  // Add padding characters until we hit a byte boundary:\n  if (pad) {\n    while (((out.length * bitsPerChar) & 7) !== 0) {\n      out += '='\n    }\n  }\n\n  return out\n}\n\nfunction createAlphabetIdx (alphabet: string): Record<string, number> {\n  // Build the character lookup table:\n  const alphabetIdx: Record<string, number> = {}\n  for (let i = 0; i < alphabet.length; ++i) {\n    alphabetIdx[alphabet[i]] = i\n  }\n  return alphabetIdx\n}\n\n/**\n * RFC4648 Factory\n */\nexport function rfc4648 <Base extends string, Prefix extends string> ({ name, prefix, bitsPerChar, alphabet }: { name: Base, prefix: Prefix, bitsPerChar: number, alphabet: string }): Codec<Base, Prefix> {\n  const alphabetIdx = createAlphabetIdx(alphabet)\n  return from({\n    prefix,\n    name,\n    encode (input: Uint8Array): string {\n      return encode(input, alphabet, bitsPerChar)\n    },\n    decode (input: string): Uint8Array {\n      return decode(input, alphabetIdx, bitsPerChar, name)\n    }\n  })\n}\n","import { baseX } from './base.js'\n\nexport const base36 = baseX({\n  prefix: 'k',\n  name: 'base36',\n  alphabet: '0123456789abcdefghijklmnopqrstuvwxyz'\n})\n\nexport const base36upper = baseX({\n  prefix: 'K',\n  name: 'base36upper',\n  alphabet: '0123456789ABCDEFGHIJKLMNOPQRSTUVWXYZ'\n})\n","import { baseX } from './base.js'\n\nexport const base58btc = baseX({\n  name: 'base58btc',\n  prefix: 'z',\n  alphabet: '123456789ABCDEFGHJKLMNPQRSTUVWXYZabcdefghijkmnopqrstuvwxyz'\n})\n\nexport const base58flickr = baseX({\n  name: 'base58flickr',\n  prefix: 'Z',\n  alphabet: '123456789abcdefghijkmnopqrstuvwxyzABCDEFGHJKLMNPQRSTUVWXYZ'\n})\n","/* eslint-disable */\nvar encode_1 = encode;\n\nvar MSB = 0x80\n  , REST = 0x7F\n  , MSBALL = ~REST\n  , INT = Math.pow(2, 31);\n\n/**\n * @param {number} num\n * @param {number[]} out\n * @param {number} offset\n */\nfunction encode(num, out, offset) {\n  out = out || [];\n  offset = offset || 0;\n  var oldOffset = offset;\n\n  while(num >= INT) {\n    out[offset++] = (num & 0xFF) | MSB;\n    num /= 128;\n  }\n  while(num & MSBALL) {\n    out[offset++] = (num & 0xFF) | MSB;\n    num >>>= 7;\n  }\n  out[offset] = num | 0;\n  \n  // @ts-ignore\n  encode.bytes = offset - oldOffset + 1;\n  \n  return out\n}\n\nvar decode = read;\n\nvar MSB$1 = 0x80\n  , REST$1 = 0x7F;\n\n/**\n * @param {string | any[]} buf\n * @param {number} offset\n */\nfunction read(buf, offset) {\n  var res    = 0\n    , offset = offset || 0\n    , shift  = 0\n    , counter = offset\n    , b\n    , l = buf.length;\n\n  do {\n    if (counter >= l) {\n      // @ts-ignore\n      read.bytes = 0;\n      throw new RangeError('Could not decode varint')\n    }\n    b = buf[counter++];\n    res += shift < 28\n      ? (b & REST$1) << shift\n      : (b & REST$1) * Math.pow(2, shift);\n    shift += 7;\n  } while (b >= MSB$1)\n\n  // @ts-ignore\n  read.bytes = counter - offset;\n\n  return res\n}\n\nvar N1 = Math.pow(2,  7);\nvar N2 = Math.pow(2, 14);\nvar N3 = Math.pow(2, 21);\nvar N4 = Math.pow(2, 28);\nvar N5 = Math.pow(2, 35);\nvar N6 = Math.pow(2, 42);\nvar N7 = Math.pow(2, 49);\nvar N8 = Math.pow(2, 56);\nvar N9 = Math.pow(2, 63);\n\nvar length = function (/** @type {number} */ value) {\n  return (\n    value < N1 ? 1\n  : value < N2 ? 2\n  : value < N3 ? 3\n  : value < N4 ? 4\n  : value < N5 ? 5\n  : value < N6 ? 6\n  : value < N7 ? 7\n  : value < N8 ? 8\n  : value < N9 ? 9\n  :              10\n  )\n};\n\nvar varint = {\n    encode: encode_1\n  , decode: decode\n  , encodingLength: length\n};\n\nvar _brrp_varint = varint;\n\nexport default _brrp_varint;\n","import varint from './vendor/varint.js'\n\nexport function decode (data: Uint8Array, offset = 0): [number, number] {\n  const code = varint.decode(data, offset)\n  return [code, varint.decode.bytes]\n}\n\nexport function encodeTo (int: number, target: Uint8Array, offset = 0): Uint8Array {\n  varint.encode(int, target, offset)\n  return target\n}\n\nexport function encodingLength (int: number): number {\n  return varint.encodingLength(int)\n}\n","import { coerce, equals as equalBytes } from '../bytes.js'\nimport * as varint from '../varint.js'\nimport type { MultihashDigest } from './interface.js'\n\n/**\n * Creates a multihash digest.\n */\nexport function create <Code extends number> (code: Code, digest: Uint8Array): Digest<Code, number> {\n  const size = digest.byteLength\n  const sizeOffset = varint.encodingLength(code)\n  const digestOffset = sizeOffset + varint.encodingLength(size)\n\n  const bytes = new Uint8Array(digestOffset + size)\n  varint.encodeTo(code, bytes, 0)\n  varint.encodeTo(size, bytes, sizeOffset)\n  bytes.set(digest, digestOffset)\n\n  return new Digest(code, size, digest, bytes)\n}\n\n/**\n * Turns bytes representation of multihash digest into an instance.\n */\nexport function decode (multihash: Uint8Array): MultihashDigest {\n  const bytes = coerce(multihash)\n  const [code, sizeOffset] = varint.decode(bytes)\n  const [size, digestOffset] = varint.decode(bytes.subarray(sizeOffset))\n  const digest = bytes.subarray(sizeOffset + digestOffset)\n\n  if (digest.byteLength !== size) {\n    throw new Error('Incorrect length')\n  }\n\n  return new Digest(code, size, digest, bytes)\n}\n\nexport function equals (a: MultihashDigest, b: unknown): b is MultihashDigest {\n  if (a === b) {\n    return true\n  } else {\n    const data = b as { code?: unknown, size?: unknown, bytes?: unknown }\n\n    return (\n      a.code === data.code &&\n      a.size === data.size &&\n      data.bytes instanceof Uint8Array &&\n      equalBytes(a.bytes, data.bytes)\n    )\n  }\n}\n\n/**\n * Represents a multihash digest which carries information about the\n * hashing algorithm and an actual hash digest.\n */\nexport class Digest<Code extends number, Size extends number> implements MultihashDigest {\n  readonly code: Code\n  readonly size: Size\n  readonly digest: Uint8Array\n  readonly bytes: Uint8Array\n\n  /**\n   * Creates a multihash digest.\n   */\n  constructor (code: Code, size: Size, digest: Uint8Array, bytes: Uint8Array) {\n    this.code = code\n    this.size = size\n    this.digest = digest\n    this.bytes = bytes\n  }\n}\n\n/**\n * Used to check that the passed multihash has the passed code\n */\nexport function hasCode <T extends number> (digest: MultihashDigest, code: T): digest is MultihashDigest<T> {\n  return digest.code === code\n}\n","import { base32 } from './bases/base32.js'\nimport { base36 } from './bases/base36.js'\nimport { base58btc } from './bases/base58.js'\nimport { coerce } from './bytes.js'\nimport * as Digest from './hashes/digest.js'\nimport * as varint from './varint.js'\nimport type * as API from './link/interface.js'\n\n// This way TS will also expose all the types from module\nexport * from './link/interface.js'\n\nexport function format <T extends API.Link<unknown, number, number, API.Version>, Prefix extends string> (link: T, base?: API.MultibaseEncoder<Prefix>): API.ToString<T, Prefix> {\n  const { bytes, version } = link\n  switch (version) {\n    case 0:\n      return toStringV0(\n        bytes,\n        baseCache(link),\n        base as API.MultibaseEncoder<'z'> ?? base58btc.encoder\n      )\n    default:\n      return toStringV1(\n        bytes,\n        baseCache(link),\n        (base ?? base32.encoder) as API.MultibaseEncoder<Prefix>\n      )\n  }\n}\n\nexport function toJSON <Link extends API.UnknownLink> (link: Link): API.LinkJSON<Link> {\n  return {\n    '/': format(link)\n  }\n}\n\nexport function fromJSON <Link extends API.UnknownLink> (json: API.LinkJSON<Link>): CID<unknown, number, number, API.Version> {\n  return CID.parse(json['/'])\n}\n\nconst cache = new WeakMap<API.UnknownLink, Map<string, string>>()\n\nfunction baseCache (cid: API.UnknownLink): Map<string, string> {\n  const baseCache = cache.get(cid)\n  if (baseCache == null) {\n    const baseCache = new Map()\n    cache.set(cid, baseCache)\n    return baseCache\n  }\n  return baseCache\n}\n\nexport class CID<Data = unknown, Format extends number = number, Alg extends number = number, Version extends API.Version = API.Version> implements API.Link<Data, Format, Alg, Version> {\n  readonly code: Format\n  readonly version: Version\n  readonly multihash: API.MultihashDigest<Alg>\n  readonly bytes: Uint8Array\n  readonly '/': Uint8Array\n\n  /**\n   * @param version - Version of the CID\n   * @param code - Code of the codec content is encoded in, see https://github.com/multiformats/multicodec/blob/master/table.csv\n   * @param multihash - (Multi)hash of the of the content.\n   */\n  constructor (version: Version, code: Format, multihash: API.MultihashDigest<Alg>, bytes: Uint8Array) {\n    this.code = code\n    this.version = version\n    this.multihash = multihash\n    this.bytes = bytes\n\n    // flag to serializers that this is a CID and\n    // should be treated specially\n    this['/'] = bytes\n  }\n\n  /**\n   * Signalling `cid.asCID === cid` has been replaced with `cid['/'] === cid.bytes`\n   * please either use `CID.asCID(cid)` or switch to new signalling mechanism\n   *\n   * @deprecated\n   */\n  get asCID (): this {\n    return this\n  }\n\n  // ArrayBufferView\n  get byteOffset (): number {\n    return this.bytes.byteOffset\n  }\n\n  // ArrayBufferView\n  get byteLength (): number {\n    return this.bytes.byteLength\n  }\n\n  toV0 (): CID<Data, API.DAG_PB, API.SHA_256, 0> {\n    switch (this.version) {\n      case 0: {\n        return this as CID<Data, API.DAG_PB, API.SHA_256, 0>\n      }\n      case 1: {\n        const { code, multihash } = this\n\n        if (code !== DAG_PB_CODE) {\n          throw new Error('Cannot convert a non dag-pb CID to CIDv0')\n        }\n\n        // sha2-256\n        if (multihash.code !== SHA_256_CODE) {\n          throw new Error('Cannot convert non sha2-256 multihash CID to CIDv0')\n        }\n\n        return (\n          CID.createV0(\n            multihash as API.MultihashDigest<API.SHA_256>\n          )\n        )\n      }\n      default: {\n        throw Error(\n          `Can not convert CID version ${this.version} to version 0. This is a bug please report`\n        )\n      }\n    }\n  }\n\n  toV1 (): CID<Data, Format, Alg, 1> {\n    switch (this.version) {\n      case 0: {\n        const { code, digest } = this.multihash\n        const multihash = Digest.create(code, digest)\n        return (\n          CID.createV1(this.code, multihash)\n        )\n      }\n      case 1: {\n        return this as CID<Data, Format, Alg, 1>\n      }\n      default: {\n        throw Error(\n          `Can not convert CID version ${this.version} to version 1. This is a bug please report`\n        )\n      }\n    }\n  }\n\n  equals (other: unknown): other is CID<Data, Format, Alg, Version> {\n    return CID.equals(this, other)\n  }\n\n  static equals <Data, Format extends number, Alg extends number, Version extends API.Version>(self: API.Link<Data, Format, Alg, Version>, other: unknown): other is CID {\n    const unknown = other as { code?: unknown, version?: unknown, multihash?: unknown }\n    return (\n      unknown != null &&\n      self.code === unknown.code &&\n      self.version === unknown.version &&\n      Digest.equals(self.multihash, unknown.multihash)\n    )\n  }\n\n  toString (base?: API.MultibaseEncoder<string>): string {\n    return format(this, base)\n  }\n\n  toJSON (): API.LinkJSON<this> {\n    return { '/': format(this) }\n  }\n\n  link (): this {\n    return this\n  }\n\n  readonly [Symbol.toStringTag] = 'CID';\n\n  // Legacy\n\n  [Symbol.for('nodejs.util.inspect.custom')] (): string {\n    return `CID(${this.toString()})`\n  }\n\n  /**\n   * Takes any input `value` and returns a `CID` instance if it was\n   * a `CID` otherwise returns `null`. If `value` is instanceof `CID`\n   * it will return value back. If `value` is not instance of this CID\n   * class, but is compatible CID it will return new instance of this\n   * `CID` class. Otherwise returns null.\n   *\n   * This allows two different incompatible versions of CID library to\n   * co-exist and interop as long as binary interface is compatible.\n   */\n  static asCID <Data, Format extends number, Alg extends number, Version extends API.Version, U>(input: API.Link<Data, Format, Alg, Version> | U): CID<Data, Format, Alg, Version> | null {\n    if (input == null) {\n      return null\n    }\n\n    const value = input as any\n    if (value instanceof CID) {\n      // If value is instance of CID then we're all set.\n      return value\n    } else if ((value['/'] != null && value['/'] === value.bytes) || value.asCID === value) {\n      // If value isn't instance of this CID class but `this.asCID === this` or\n      // `value['/'] === value.bytes` is true it is CID instance coming from a\n      // different implementation (diff version or duplicate). In that case we\n      // rebase it to this `CID` implementation so caller is guaranteed to get\n      // instance with expected API.\n      const { version, code, multihash, bytes } = value\n      return new CID(\n        version,\n        code,\n        multihash as API.MultihashDigest<Alg>,\n        bytes ?? encodeCID(version, code, multihash.bytes)\n      )\n    } else if (value[cidSymbol] === true) {\n      // If value is a CID from older implementation that used to be tagged via\n      // symbol we still rebase it to the this `CID` implementation by\n      // delegating that to a constructor.\n      const { version, multihash, code } = value\n      const digest = Digest.decode(multihash) as API.MultihashDigest<Alg>\n      return CID.create(version, code, digest)\n    } else {\n      // Otherwise value is not a CID (or an incompatible version of it) in\n      // which case we return `null`.\n      return null\n    }\n  }\n\n  /**\n   * @param version - Version of the CID\n   * @param code - Code of the codec content is encoded in, see https://github.com/multiformats/multicodec/blob/master/table.csv\n   * @param digest - (Multi)hash of the of the content.\n   */\n  static create <Data, Format extends number, Alg extends number, Version extends API.Version>(version: Version, code: Format, digest: API.MultihashDigest<Alg>): CID<Data, Format, Alg, Version> {\n    if (typeof code !== 'number') {\n      throw new Error('String codecs are no longer supported')\n    }\n\n    if (!(digest.bytes instanceof Uint8Array)) {\n      throw new Error('Invalid digest')\n    }\n\n    switch (version) {\n      case 0: {\n        if (code !== DAG_PB_CODE) {\n          throw new Error(\n            `Version 0 CID must use dag-pb (code: ${DAG_PB_CODE}) block encoding`\n          )\n        } else {\n          return new CID(version, code, digest, digest.bytes)\n        }\n      }\n      case 1: {\n        const bytes = encodeCID(version, code, digest.bytes)\n        return new CID(version, code, digest, bytes)\n      }\n      default: {\n        throw new Error('Invalid version')\n      }\n    }\n  }\n\n  /**\n   * Simplified version of `create` for CIDv0.\n   */\n  static createV0 <T = unknown>(digest: API.MultihashDigest<typeof SHA_256_CODE>): CID<T, typeof DAG_PB_CODE, typeof SHA_256_CODE, 0> {\n    return CID.create(0, DAG_PB_CODE, digest)\n  }\n\n  /**\n   * Simplified version of `create` for CIDv1.\n   *\n   * @param code - Content encoding format code.\n   * @param digest - Multihash of the content.\n   */\n  static createV1 <Data, Code extends number, Alg extends number>(code: Code, digest: API.MultihashDigest<Alg>): CID<Data, Code, Alg, 1> {\n    return CID.create(1, code, digest)\n  }\n\n  /**\n   * Decoded a CID from its binary representation. The byte array must contain\n   * only the CID with no additional bytes.\n   *\n   * An error will be thrown if the bytes provided do not contain a valid\n   * binary representation of a CID.\n   */\n  static decode <Data, Code extends number, Alg extends number, Version extends API.Version>(bytes: API.ByteView<API.Link<Data, Code, Alg, Version>>): CID<Data, Code, Alg, Version> {\n    const [cid, remainder] = CID.decodeFirst(bytes)\n    if (remainder.length !== 0) {\n      throw new Error('Incorrect length')\n    }\n    return cid\n  }\n\n  /**\n   * Decoded a CID from its binary representation at the beginning of a byte\n   * array.\n   *\n   * Returns an array with the first element containing the CID and the second\n   * element containing the remainder of the original byte array. The remainder\n   * will be a zero-length byte array if the provided bytes only contained a\n   * binary CID representation.\n   */\n  static decodeFirst <T, C extends number, A extends number, V extends API.Version>(bytes: API.ByteView<API.Link<T, C, A, V>>): [CID<T, C, A, V>, Uint8Array] {\n    const specs = CID.inspectBytes(bytes)\n    const prefixSize = specs.size - specs.multihashSize\n    const multihashBytes = coerce(\n      bytes.subarray(prefixSize, prefixSize + specs.multihashSize)\n    )\n    if (multihashBytes.byteLength !== specs.multihashSize) {\n      throw new Error('Incorrect length')\n    }\n    const digestBytes = multihashBytes.subarray(\n      specs.multihashSize - specs.digestSize\n    )\n    const digest = new Digest.Digest(\n      specs.multihashCode,\n      specs.digestSize,\n      digestBytes,\n      multihashBytes\n    )\n    const cid =\n      specs.version === 0\n        ? CID.createV0(digest as API.MultihashDigest<API.SHA_256>)\n        : CID.createV1(specs.codec, digest)\n    return [cid as CID<T, C, A, V>, bytes.subarray(specs.size)]\n  }\n\n  /**\n   * Inspect the initial bytes of a CID to determine its properties.\n   *\n   * Involves decoding up to 4 varints. Typically this will require only 4 to 6\n   * bytes but for larger multicodec code values and larger multihash digest\n   * lengths these varints can be quite large. It is recommended that at least\n   * 10 bytes be made available in the `initialBytes` argument for a complete\n   * inspection.\n   */\n  static inspectBytes <T, C extends number, A extends number, V extends API.Version>(initialBytes: API.ByteView<API.Link<T, C, A, V>>): { version: V, codec: C, multihashCode: A, digestSize: number, multihashSize: number, size: number } {\n    let offset = 0\n    const next = (): number => {\n      const [i, length] = varint.decode(initialBytes.subarray(offset))\n      offset += length\n      return i\n    }\n\n    let version = next() as V\n    let codec = DAG_PB_CODE as C\n    if (version as number === 18) {\n      // CIDv0\n      version = 0 as V\n      offset = 0\n    } else {\n      codec = next() as C\n    }\n\n    if (version !== 0 && version !== 1) {\n      throw new RangeError(`Invalid CID version ${version}`)\n    }\n\n    const prefixSize = offset\n    const multihashCode = next() as A // multihash code\n    const digestSize = next() // multihash length\n    const size = offset + digestSize\n    const multihashSize = size - prefixSize\n\n    return { version, codec, multihashCode, digestSize, multihashSize, size }\n  }\n\n  /**\n   * Takes cid in a string representation and creates an instance. If `base`\n   * decoder is not provided will use a default from the configuration. It will\n   * throw an error if encoding of the CID is not compatible with supplied (or\n   * a default decoder).\n   */\n  static parse <Prefix extends string, Data, Code extends number, Alg extends number, Version extends API.Version>(source: API.ToString<API.Link<Data, Code, Alg, Version>, Prefix>, base?: API.MultibaseDecoder<Prefix>): CID<Data, Code, Alg, Version> {\n    const [prefix, bytes] = parseCIDtoBytes(source, base)\n\n    const cid = CID.decode(bytes)\n\n    if (cid.version === 0 && source[0] !== 'Q') {\n      throw Error('Version 0 CID string must not include multibase prefix')\n    }\n\n    // Cache string representation to avoid computing it on `this.toString()`\n    baseCache(cid).set(prefix, source)\n\n    return cid\n  }\n}\n\nfunction parseCIDtoBytes <Prefix extends string, Data, Code extends number, Alg extends number, Version extends API.Version> (source: API.ToString<API.Link<Data, Code, Alg, Version>, Prefix>, base?: API.MultibaseDecoder<Prefix>): [Prefix, API.ByteView<API.Link<Data, Code, Alg, Version>>] {\n  switch (source[0]) {\n    // CIDv0 is parsed differently\n    case 'Q': {\n      const decoder = base ?? base58btc\n      return [\n        base58btc.prefix as Prefix,\n        decoder.decode(`${base58btc.prefix}${source}`)\n      ]\n    }\n    case base58btc.prefix: {\n      const decoder = base ?? base58btc\n      return [base58btc.prefix as Prefix, decoder.decode(source)]\n    }\n    case base32.prefix: {\n      const decoder = base ?? base32\n      return [base32.prefix as Prefix, decoder.decode(source)]\n    }\n    case base36.prefix: {\n      const decoder = base ?? base36\n      return [base36.prefix as Prefix, decoder.decode(source)]\n    }\n    default: {\n      if (base == null) {\n        throw Error(\n          'To parse non base32, base36 or base58btc encoded CID multibase decoder must be provided'\n        )\n      }\n      return [source[0] as Prefix, base.decode(source)]\n    }\n  }\n}\n\nfunction toStringV0 (bytes: Uint8Array, cache: Map<string, string>, base: API.MultibaseEncoder<'z'>): string {\n  const { prefix } = base\n  if (prefix !== base58btc.prefix) {\n    throw Error(`Cannot string encode V0 in ${base.name} encoding`)\n  }\n\n  const cid = cache.get(prefix)\n  if (cid == null) {\n    const cid = base.encode(bytes).slice(1)\n    cache.set(prefix, cid)\n    return cid\n  } else {\n    return cid\n  }\n}\n\nfunction toStringV1 <Prefix extends string> (bytes: Uint8Array, cache: Map<string, string>, base: API.MultibaseEncoder<Prefix>): string {\n  const { prefix } = base\n  const cid = cache.get(prefix)\n  if (cid == null) {\n    const cid = base.encode(bytes)\n    cache.set(prefix, cid)\n    return cid\n  } else {\n    return cid\n  }\n}\n\nconst DAG_PB_CODE = 0x70\nconst SHA_256_CODE = 0x12\n\nfunction encodeCID (version: API.Version, code: number, multihash: Uint8Array): Uint8Array {\n  const codeOffset = varint.encodingLength(version)\n  const hashOffset = codeOffset + varint.encodingLength(code)\n  const bytes = new Uint8Array(hashOffset + multihash.byteLength)\n  varint.encodeTo(version, bytes, 0)\n  varint.encodeTo(code, bytes, codeOffset)\n  bytes.set(multihash, hashOffset)\n  return bytes\n}\n\nconst cidSymbol = Symbol.for('@ipld/js-cid/CID')\n","export type SignedObjectErrorCode =\n  | \"schema-invalid\"\n  | \"canonicalization-mismatch\"\n  | \"digest-mismatch\"\n  | \"id-mismatch\"\n  | \"signing-key-binding\"\n  | \"signature-material-invalid\"\n  | \"signature-suite-unsupported\"\n  | \"signature-invalid\";\n\nexport class SignedObjectProfileError extends Error {\n  public readonly code: SignedObjectErrorCode;\n\n  constructor(code: SignedObjectErrorCode, message: string) {\n    super(message);\n    this.name = \"SignedObjectProfileError\";\n    this.code = code;\n  }\n}\n\nexport class SignedObjectSchemaError extends SignedObjectProfileError {\n  constructor(message: string) {\n    super(\"schema-invalid\", message);\n    this.name = \"SignedObjectSchemaError\";\n  }\n}\n\nexport class SignedObjectCanonicalizationError extends SignedObjectProfileError {\n  constructor(message: string) {\n    super(\"canonicalization-mismatch\", message);\n    this.name = \"SignedObjectCanonicalizationError\";\n  }\n}\n\nexport class SignedObjectDigestError extends SignedObjectProfileError {\n  constructor(message: string) {\n    super(\"digest-mismatch\", message);\n    this.name = \"SignedObjectDigestError\";\n  }\n}\n\nexport class SignedObjectIdError extends SignedObjectProfileError {\n  constructor(message: string) {\n    super(\"id-mismatch\", message);\n    this.name = \"SignedObjectIdError\";\n  }\n}\n\nexport class SigningKeyBindingError extends SignedObjectProfileError {\n  constructor(message: string) {\n    super(\"signing-key-binding\", message);\n    this.name = \"SigningKeyBindingError\";\n  }\n}\n\nexport class SignatureMaterialError extends SignedObjectProfileError {\n  constructor(message: string) {\n    super(\"signature-material-invalid\", message);\n    this.name = \"SignatureMaterialError\";\n  }\n}\n\nexport class UnsupportedSignatureSuiteError extends SignedObjectProfileError {\n  constructor(message: string) {\n    super(\"signature-suite-unsupported\", message);\n    this.name = \"UnsupportedSignatureSuiteError\";\n  }\n}\n\nexport class SignatureVerificationError extends SignedObjectProfileError {\n  constructor(message: string) {\n    super(\"signature-invalid\", message);\n    this.name = \"SignatureVerificationError\";\n  }\n}\n\nexport function toSignedObjectError(error: unknown): SignedObjectProfileError {\n  if (error instanceof SignedObjectProfileError) {\n    return error;\n  }\n  return new SignedObjectProfileError(\n    \"schema-invalid\",\n    error instanceof Error ? error.message : String(error),\n  );\n}\n","import { SignedObjectCanonicalizationError } from \"./errors\";\n\nexport type JsonValue =\n  | null\n  | boolean\n  | number\n  | string\n  | JsonValue[]\n  | { readonly [key: string]: JsonValue };\n\ntype MutableJsonObject = { [key: string]: JsonValue };\nconst objectHasOwn: (object: object, propertyKey: PropertyKey) => boolean =\n  (Object as ObjectConstructor & {\n    hasOwn?: (object: object, propertyKey: PropertyKey) => boolean;\n  }).hasOwn ??\n  (Object.prototype.hasOwnProperty.call.bind(\n    Object.prototype.hasOwnProperty,\n  ) as (object: object, propertyKey: PropertyKey) => boolean);\n\n/**\n * RFC 8785 JSON Canonicalization Scheme encoder for the signed-object profile.\n *\n * This local encoder is intentionally stricter than JSON.stringify:\n * it rejects non-plain JSON inputs, sparse arrays, undefined/functions/symbols,\n * non-finite numbers, BigInt, dangerous prototype keys, and lone surrogates.\n * Object keys are sorted lexicographically by their raw UTF-16 code units,\n * as required by RFC 8785 section 3.2.3, before serialization.\n */\nexport function jcsCanonicalize(input: unknown): string {\n  return serialize(normalizeJson(input, \"$\"));\n}\n\nexport function normalizeJson(input: unknown, path = \"$\"): JsonValue {\n  if (input === null) {\n    return null;\n  }\n\n  switch (typeof input) {\n    case \"boolean\":\n      return input;\n    case \"number\":\n      if (!Number.isFinite(input)) {\n        throw new SignedObjectCanonicalizationError(\n          `${path} must be a finite JSON number`,\n        );\n      }\n      return input;\n    case \"string\":\n      assertUnicodeScalarString(input, path);\n      return input;\n    case \"object\":\n      return normalizeJsonObjectOrArray(input, path);\n    case \"bigint\":\n    case \"function\":\n    case \"symbol\":\n    case \"undefined\":\n    default:\n      throw new SignedObjectCanonicalizationError(\n        `${path} is not a JSON value`,\n      );\n  }\n}\n\nexport function serialize(value: JsonValue): string {\n  if (value === null) {\n    return \"null\";\n  }\n\n  switch (typeof value) {\n    case \"boolean\":\n      return value ? \"true\" : \"false\";\n    case \"number\": {\n      const encoded = JSON.stringify(value);\n      if (encoded === undefined) {\n        throw new SignedObjectCanonicalizationError(\n          \"number could not be serialized as JSON\",\n        );\n      }\n      return encoded;\n    }\n    case \"string\":\n      return JSON.stringify(value);\n    case \"object\":\n      if (Array.isArray(value)) {\n        return `[${value.map((item) => serialize(item)).join(\",\")}]`;\n      }\n      return serializeObject(value);\n    default:\n      throw new SignedObjectCanonicalizationError(\n        `unsupported JSON value type ${typeof value}`,\n      );\n  }\n}\n\nfunction normalizeJsonObjectOrArray(input: object, path: string): JsonValue {\n  assertNoSymbolKeys(input, path);\n\n  if (Array.isArray(input)) {\n    for (const key of Object.getOwnPropertyNames(input)) {\n      if (key === \"length\") {\n        continue;\n      }\n      if (!isArrayIndexKey(key, input.length)) {\n        throw new SignedObjectCanonicalizationError(\n          `${path}.${key} is not allowed on a JSON array`,\n        );\n      }\n      const descriptor = Object.getOwnPropertyDescriptor(input, key);\n      if (descriptor?.enumerable !== true) {\n        throw new SignedObjectCanonicalizationError(\n          `${path}[${key}] must be an enumerable JSON array item`,\n        );\n      }\n      if (!(\"value\" in descriptor)) {\n        throw new SignedObjectCanonicalizationError(\n          `${path}[${key}] must be a JSON data property`,\n        );\n      }\n    }\n    const output: JsonValue[] = [];\n    for (let index = 0; index < input.length; index++) {\n      if (!objectHasOwn(input, index)) {\n        throw new SignedObjectCanonicalizationError(\n          `${path}[${index}] must not be a sparse array hole`,\n        );\n      }\n      output.push(normalizeJson(input[index], `${path}[${index}]`));\n    }\n    return output;\n  }\n\n  const proto = Object.getPrototypeOf(input);\n  if (proto !== Object.prototype && proto !== null) {\n    throw new SignedObjectCanonicalizationError(\n      `${path} must be a plain JSON object`,\n    );\n  }\n\n  const output = Object.create(null) as MutableJsonObject;\n  for (const key of Object.getOwnPropertyNames(input)) {\n    assertUnicodeScalarString(key, `${path} key`);\n    if (key === \"__proto__\" || key === \"constructor\") {\n      throw new SignedObjectCanonicalizationError(\n        `${path}.${key} is not allowed`,\n      );\n    }\n    const descriptor = Object.getOwnPropertyDescriptor(input, key);\n    if (descriptor?.enumerable !== true) {\n      throw new SignedObjectCanonicalizationError(\n        `${path}.${key} must be an enumerable JSON object property`,\n      );\n    }\n    if (!(\"value\" in descriptor)) {\n      throw new SignedObjectCanonicalizationError(\n        `${path}.${key} must be a JSON data property`,\n      );\n    }\n    const value = descriptor.value;\n    output[key] = normalizeJson(value, `${path}.${key}`);\n  }\n  return output;\n}\n\nfunction assertNoSymbolKeys(input: object, path: string): void {\n  if (Object.getOwnPropertySymbols(input).length > 0) {\n    throw new SignedObjectCanonicalizationError(\n      `${path} must not have symbol properties`,\n    );\n  }\n}\n\nfunction isArrayIndexKey(key: string, length: number): boolean {\n  if (!/^(0|[1-9]\\d*)$/.test(key)) {\n    return false;\n  }\n  const index = Number(key);\n  return Number.isSafeInteger(index) && index >= 0 && index < length;\n}\n\nfunction serializeObject(value: { readonly [key: string]: JsonValue }): string {\n  const keys = Object.keys(value).sort(compareUtf16CodeUnits);\n  const parts = keys.map((key) => `${JSON.stringify(key)}:${serialize(value[key])}`);\n  return `{${parts.join(\",\")}}`;\n}\n\nfunction compareUtf16CodeUnits(a: string, b: string): number {\n  const max = Math.min(a.length, b.length);\n  for (let index = 0; index < max; index++) {\n    const leftCodeUnit = a.charCodeAt(index);\n    const rightCodeUnit = b.charCodeAt(index);\n    if (leftCodeUnit !== rightCodeUnit) {\n      return leftCodeUnit - rightCodeUnit;\n    }\n  }\n  return a.length - b.length;\n}\n\nfunction assertUnicodeScalarString(value: string, path: string): void {\n  for (let index = 0; index < value.length; index++) {\n    const code = value.charCodeAt(index);\n    if (code >= 0xd800 && code <= 0xdbff) {\n      const next = value.charCodeAt(index + 1);\n      if (Number.isNaN(next) || next < 0xdc00 || next > 0xdfff) {\n        throw new SignedObjectCanonicalizationError(\n          `${path} contains a lone high surrogate`,\n        );\n      }\n      index++;\n      continue;\n    }\n    if (code >= 0xdc00 && code <= 0xdfff) {\n      throw new SignedObjectCanonicalizationError(\n        `${path} contains a lone low surrogate`,\n      );\n    }\n  }\n}\n","import { CAPABILITY_REGISTRY } from \"@tinycloud/bootstrap\";\nimport { bytesToHex, sha256 } from \"viem\";\nimport { jcsCanonicalize, normalizeJson, type JsonValue } from \"./jcs\";\n\nconst POLICY_CAPABILITY_DOMAIN = \"xyz.tinycloud.policy/PolicyCapability/v0\";\nconst textEncoder = new TextEncoder();\n\nexport type PolicyCapabilityErrorCode =\n  | \"policy-capability-malformed\"\n  | \"policy-capability-unknown-key\"\n  | \"policy-capability-malformed-service\"\n  | \"policy-capability-malformed-space\"\n  | \"policy-capability-malformed-path\"\n  | \"policy-capability-malformed-action\"\n  | \"policy-capability-empty-actions\"\n  | \"policy-capability-malformed-caveats\";\n\nexport class PolicyCapabilityError extends Error {\n  public readonly code: PolicyCapabilityErrorCode;\n\n  constructor(code: PolicyCapabilityErrorCode, message: string) {\n    super(message);\n    this.name = \"PolicyCapabilityError\";\n    this.code = code;\n  }\n}\n\nexport interface PolicyCapability {\n  readonly service: \"tinycloud.kv\" | \"tinycloud.sql\" | \"tinycloud.vfs\";\n  readonly space: string;\n  readonly path: string;\n  readonly actions: readonly string[];\n  readonly caveats?: JsonObject;\n}\n\nexport type JsonObject = { readonly [key: string]: JsonValue };\n\ninterface NormalizeOptions {\n  readonly allowPrefixPaths?: boolean;\n  readonly requireCanonical?: boolean;\n}\n\nconst objectHasOwn: (object: object, propertyKey: PropertyKey) => boolean =\n  (Object as ObjectConstructor & {\n    hasOwn?: (object: object, propertyKey: PropertyKey) => boolean;\n  }).hasOwn ??\n  (Object.prototype.hasOwnProperty.call.bind(\n    Object.prototype.hasOwnProperty,\n  ) as (object: object, propertyKey: PropertyKey) => boolean);\n\nconst CEILING_SERVICES = new Set([\"tinycloud.kv\", \"tinycloud.sql\", \"tinycloud.vfs\"]);\nconst GRANTABLE_ACTIONS = new Map<string, ReadonlySet<string>>();\n\nfor (const entry of CAPABILITY_REGISTRY) {\n  if (!CEILING_SERVICES.has(entry.service)) {\n    continue;\n  }\n  if (entry.aliasOf !== undefined || entry.implies !== undefined || entry.urn.endsWith(\"/*\")) {\n    continue;\n  }\n  const existing = GRANTABLE_ACTIONS.get(entry.service);\n  if (existing === undefined) {\n    GRANTABLE_ACTIONS.set(entry.service, new Set([entry.urn]));\n    continue;\n  }\n  (existing as Set<string>).add(entry.urn);\n}\n\n/**\n * Strict authoring validator for resolved Listen-adapter PolicyCapability JSON.\n * It accepts only concrete service/space/path/action/caveat forms and rejects\n * manifest-shaped permission payloads before any Policy is signed.\n */\nexport function normalizePolicyCapability(input: unknown): PolicyCapability {\n  return normalizePolicyCapabilityWithOptions(input, { requireCanonical: true });\n}\n\n/**\n * Frozen-vector canonicalizer for the m1-b-01a policy-capability vectors.\n * Prefix paths are allowed here only to preserve behavioral conformance with\n * the vendored engine vectors; authoring uses normalizePolicyCapability.\n */\nexport function canonicalizePolicyCapability(input: unknown): PolicyCapability {\n  return normalizePolicyCapabilityWithOptions(input, { allowPrefixPaths: true });\n}\n\nexport function policyCapabilityDigestHex(input: unknown): string {\n  const canonical = canonicalizePolicyCapability(input);\n  const jcs = textEncoder.encode(jcsCanonicalize(canonical));\n  const domain = textEncoder.encode(`${POLICY_CAPABILITY_DOMAIN}\\0`);\n  const bytes = new Uint8Array(domain.length + jcs.length);\n  bytes.set(domain, 0);\n  bytes.set(jcs, domain.length);\n  return bytesToHex(sha256(bytes, \"bytes\")).slice(2);\n}\n\nexport function policyCapabilityContains(authority: unknown, request: unknown): boolean {\n  let auth: PolicyCapability;\n  let req: PolicyCapability;\n  try {\n    auth = canonicalizePolicyCapability(authority);\n    req = canonicalizePolicyCapability(request);\n  } catch {\n    return false;\n  }\n  if (auth.service !== req.service || auth.space !== req.space) {\n    return false;\n  }\n  if (!pathContains(auth.path, req.path)) {\n    return false;\n  }\n  const authActions = new Set(auth.actions);\n  for (const action of req.actions) {\n    if (!authActions.has(action)) {\n      return false;\n    }\n  }\n  return caveatsContain(auth.caveats, req.caveats);\n}\n\nfunction normalizePolicyCapabilityWithOptions(\n  input: unknown,\n  options: NormalizeOptions,\n): PolicyCapability {\n  const object = expectObject(input, \"$\");\n  assertExactKeys(object, [\"service\", \"space\", \"path\", \"actions\", \"caveats\"], \"$\");\n  const service = requiredString(object, \"service\", \"$\", \"policy-capability-malformed-service\");\n  if (!CEILING_SERVICES.has(service)) {\n    throw new PolicyCapabilityError(\n      \"policy-capability-malformed-service\",\n      \"$.service is outside the frozen permissionsCeiling vocabulary\",\n    );\n  }\n  const space = requiredString(object, \"space\", \"$\", \"policy-capability-malformed-space\");\n  validateConcreteSpace(space);\n  const canonicalSpace = space.normalize(\"NFC\");\n  if (options.requireCanonical && canonicalSpace !== space) {\n    throw new PolicyCapabilityError(\n      \"policy-capability-malformed-space\",\n      \"$.space must already be canonical NFC\",\n    );\n  }\n  const rawPath = requiredString(object, \"path\", \"$\", \"policy-capability-malformed-path\");\n  validateRawPath(rawPath, options);\n  const path = normalizePath(rawPath);\n  if (options.requireCanonical && path !== rawPath) {\n    throw new PolicyCapabilityError(\n      \"policy-capability-malformed-path\",\n      \"$.path must already be canonical\",\n    );\n  }\n  validateRawPath(path, options);\n  const actions = normalizeActions(\n    requiredArray(object, \"actions\", \"$\", \"policy-capability-malformed-action\"),\n    service,\n    options,\n  );\n  const output = Object.create(null) as {\n    service: PolicyCapability[\"service\"];\n    space: string;\n    path: string;\n    actions: string[];\n    caveats?: JsonObject;\n  };\n  output.service = service as PolicyCapability[\"service\"];\n  output.space = canonicalSpace;\n  output.path = path;\n  output.actions = actions;\n  if (hasOwn(object, \"caveats\")) {\n    output.caveats = validateCaveats(\n      requiredValue(object, \"caveats\", \"$\", \"policy-capability-malformed-caveats\"),\n      output.service,\n    );\n  }\n  return output;\n}\n\nfunction expectObject(input: unknown, path: string): JsonObject {\n  try {\n    const normalized = normalizeJson(input);\n    if (normalized === null || typeof normalized !== \"object\" || Array.isArray(normalized)) {\n      throw new PolicyCapabilityError(\"policy-capability-malformed\", `${path} must be an object`);\n    }\n    return normalized as JsonObject;\n  } catch (error) {\n    if (error instanceof PolicyCapabilityError) {\n      throw error;\n    }\n    throw new PolicyCapabilityError(\n      \"policy-capability-malformed\",\n      error instanceof Error ? error.message : String(error),\n    );\n  }\n}\n\nfunction assertExactKeys(object: JsonObject, allowed: readonly string[], path: string): void {\n  const allowedSet = new Set(allowed);\n  for (const key of Object.keys(object)) {\n    if (!allowedSet.has(key)) {\n      throw new PolicyCapabilityError(\n        key === \"id\" || key === \"scope\" ? \"policy-capability-malformed\" : \"policy-capability-unknown-key\",\n        `${path} has unknown field ${key}`,\n      );\n    }\n  }\n}\n\nfunction requiredValue(\n  object: JsonObject,\n  key: string,\n  path: string,\n  code: PolicyCapabilityErrorCode,\n): JsonValue {\n  if (!hasOwn(object, key)) {\n    throw new PolicyCapabilityError(code, `${path}.${key} is required`);\n  }\n  return object[key];\n}\n\nfunction requiredString(\n  object: JsonObject,\n  key: string,\n  path: string,\n  code: PolicyCapabilityErrorCode,\n): string {\n  const value = requiredValue(object, key, path, code);\n  if (typeof value !== \"string\" || value.length === 0) {\n    throw new PolicyCapabilityError(code, `${path}.${key} must be a non-empty string`);\n  }\n  return value;\n}\n\nfunction requiredArray(\n  object: JsonObject,\n  key: string,\n  path: string,\n  code: PolicyCapabilityErrorCode,\n): readonly JsonValue[] {\n  const value = requiredValue(object, key, path, code);\n  if (!Array.isArray(value)) {\n    throw new PolicyCapabilityError(code, `${path}.${key} must be an array`);\n  }\n  return value;\n}\n\nfunction validateConcreteSpace(space: string): void {\n  if (space === \"*\" || space.includes(\"*\") || space.includes(\"?\") || space.includes(\"/\")) {\n    throw new PolicyCapabilityError(\n      \"policy-capability-malformed-space\",\n      \"$.space must be concrete\",\n    );\n  }\n}\n\nfunction validateRawPath(path: string, options: NormalizeOptions): void {\n  if (path.length === 0) {\n    throw new PolicyCapabilityError(\"policy-capability-malformed-path\", \"$.path is empty\");\n  }\n  if (!options.allowPrefixPaths && path.endsWith(\"/\")) {\n    throw new PolicyCapabilityError(\n      \"policy-capability-malformed-path\",\n      \"$.path must be an exact concrete path, not a prefix\",\n    );\n  }\n  if (path.endsWith(\"/*\") || path.includes(\"**\")) {\n    throw new PolicyCapabilityError(\"policy-capability-malformed-path\", \"$.path is a prefix form\");\n  }\n  const segments = path.split(\"/\");\n  for (let index = 0; index < segments.length; index++) {\n    const segment = segments[index]!;\n    const isTrailingPrefixSegment =\n      options.allowPrefixPaths && index === segments.length - 1 && segment.length === 0;\n    if (segment.length === 0 && !isTrailingPrefixSegment) {\n      throw new PolicyCapabilityError(\"policy-capability-malformed-path\", \"$.path has an empty segment\");\n    }\n    if (segment === \".\" || segment === \"..\") {\n      throw new PolicyCapabilityError(\n        \"policy-capability-malformed-path\",\n        \"$.path has a traversal segment\",\n      );\n    }\n    if (segment === \"*\" || segment === \"?\" || segment.includes(\"*\") || segment.includes(\"?\")) {\n      throw new PolicyCapabilityError(\n        \"policy-capability-malformed-path\",\n        \"$.path has a wildcard segment\",\n      );\n    }\n  }\n}\n\nfunction normalizePath(path: string): string {\n  return decodeUnreserved(path).normalize(\"NFC\");\n}\n\nfunction decodeUnreserved(path: string): string {\n  return path.replace(/%[0-9A-Fa-f]{2}/g, (encoded) => {\n    const char = String.fromCharCode(Number.parseInt(encoded.slice(1), 16));\n    return /^[A-Za-z0-9._~-]$/.test(char) ? char : encoded.toUpperCase();\n  });\n}\n\nfunction normalizeActions(\n  actions: readonly JsonValue[],\n  service: string,\n  options: NormalizeOptions,\n): string[] {\n  const accepted = GRANTABLE_ACTIONS.get(service);\n  if (accepted === undefined) {\n    throw new PolicyCapabilityError(\n      \"policy-capability-malformed-service\",\n      \"$.service is unsupported\",\n    );\n  }\n  const unique = new Set<string>();\n  const rawActions: string[] = [];\n  for (let index = 0; index < actions.length; index++) {\n    const action = actions[index];\n    if (typeof action !== \"string\" || action.length === 0) {\n      throw new PolicyCapabilityError(\n        \"policy-capability-malformed-action\",\n        `$.actions[${index}] must be a non-empty action URN`,\n      );\n    }\n    if (!action.startsWith(`${service}/`) || action.includes(\"*\") || !accepted.has(action)) {\n      throw new PolicyCapabilityError(\n        \"policy-capability-malformed-action\",\n        `$.actions[${index}] is not a grantable action URN`,\n      );\n    }\n    rawActions.push(action);\n    unique.add(action);\n  }\n  if (unique.size === 0) {\n    throw new PolicyCapabilityError(\n      \"policy-capability-empty-actions\",\n      \"$.actions must not be empty\",\n    );\n  }\n  const normalizedActions = [...unique].sort();\n  if (\n    options.requireCanonical &&\n    (rawActions.length !== normalizedActions.length ||\n      rawActions.some((action, index) => action !== normalizedActions[index]))\n  ) {\n    throw new PolicyCapabilityError(\n      \"policy-capability-malformed-action\",\n      \"$.actions must already be sorted, deduplicated canonical action URNs\",\n    );\n  }\n  return normalizedActions;\n}\n\nfunction validateCaveats(input: JsonValue, service: PolicyCapability[\"service\"]): JsonObject {\n  if (input === null || typeof input !== \"object\" || Array.isArray(input)) {\n    throw new PolicyCapabilityError(\n      \"policy-capability-malformed-caveats\",\n      \"$.caveats must be an object\",\n    );\n  }\n  if (service === \"tinycloud.sql\") {\n    return validateSqlCaveats(input as JsonObject);\n  }\n  throw new PolicyCapabilityError(\n    \"policy-capability-malformed-caveats\",\n    \"$.caveats are not defined for this service\",\n  );\n}\n\nfunction validateSqlCaveats(input: JsonObject): JsonObject {\n  assertCaveatKeys(input, [\"mode\", \"readOnly\", \"statements\"], \"$.caveats\");\n  const mode = caveatString(input, \"mode\", \"$.caveats\");\n  if (mode !== \"constrained-statements\") {\n    throw new PolicyCapabilityError(\n      \"policy-capability-malformed-caveats\",\n      \"$.caveats.mode is unsupported\",\n    );\n  }\n  if (requiredCaveat(input, \"readOnly\", \"$.caveats\") !== true) {\n    throw new PolicyCapabilityError(\n      \"policy-capability-malformed-caveats\",\n      \"$.caveats.readOnly must be true\",\n    );\n  }\n  const statements = requiredCaveat(input, \"statements\", \"$.caveats\");\n  if (!Array.isArray(statements) || statements.length === 0) {\n    throw new PolicyCapabilityError(\n      \"policy-capability-malformed-caveats\",\n      \"$.caveats.statements must be a non-empty array\",\n    );\n  }\n  for (let index = 0; index < statements.length; index++) {\n    validateSqlStatement(statements[index], `$.caveats.statements[${index}]`);\n  }\n  return input;\n}\n\nfunction validateSqlStatement(input: JsonValue, path: string): void {\n  if (input === null || typeof input !== \"object\" || Array.isArray(input)) {\n    throw new PolicyCapabilityError(\"policy-capability-malformed-caveats\", `${path} must be an object`);\n  }\n  const object = input as JsonObject;\n  assertCaveatKeys(object, [\"name\", \"sql\", \"fixedParams\"], path);\n  caveatString(object, \"name\", path);\n  caveatString(object, \"sql\", path);\n  const fixedParams = requiredCaveat(object, \"fixedParams\", path);\n  if (!Array.isArray(fixedParams)) {\n    throw new PolicyCapabilityError(\n      \"policy-capability-malformed-caveats\",\n      `${path}.fixedParams must be an array`,\n    );\n  }\n  for (let index = 0; index < fixedParams.length; index++) {\n    validateFixedParam(fixedParams[index], `${path}.fixedParams[${index}]`);\n  }\n}\n\nfunction validateFixedParam(input: JsonValue, path: string): void {\n  if (input === null || typeof input !== \"object\" || Array.isArray(input)) {\n    throw new PolicyCapabilityError(\"policy-capability-malformed-caveats\", `${path} must be an object`);\n  }\n  const object = input as JsonObject;\n  assertCaveatKeys(object, [\"index\", \"value\"], path);\n  const index = requiredCaveat(object, \"index\", path);\n  if (typeof index !== \"number\" || !Number.isSafeInteger(index) || index < 0) {\n    throw new PolicyCapabilityError(\n      \"policy-capability-malformed-caveats\",\n      `${path}.index must be a non-negative integer`,\n    );\n  }\n  requiredCaveat(object, \"value\", path);\n}\n\nfunction assertCaveatKeys(object: JsonObject, allowed: readonly string[], path: string): void {\n  const allowedSet = new Set(allowed);\n  for (const key of Object.keys(object)) {\n    if (!allowedSet.has(key)) {\n      throw new PolicyCapabilityError(\n        \"policy-capability-malformed-caveats\",\n        `${path} has unknown field ${key}`,\n      );\n    }\n  }\n}\n\nfunction requiredCaveat(object: JsonObject, key: string, path: string): JsonValue {\n  if (!hasOwn(object, key)) {\n    throw new PolicyCapabilityError(\n      \"policy-capability-malformed-caveats\",\n      `${path}.${key} is required`,\n    );\n  }\n  return object[key];\n}\n\nfunction caveatString(object: JsonObject, key: string, path: string): string {\n  const value = requiredCaveat(object, key, path);\n  if (typeof value !== \"string\" || value.length === 0) {\n    throw new PolicyCapabilityError(\n      \"policy-capability-malformed-caveats\",\n      `${path}.${key} must be a non-empty string`,\n    );\n  }\n  return value;\n}\n\nfunction pathContains(authority: string, request: string): boolean {\n  if (authority === request) {\n    return true;\n  }\n  return authority.endsWith(\"/\") && request.startsWith(authority);\n}\n\nfunction caveatsContain(authority: JsonObject | undefined, request: JsonObject | undefined): boolean {\n  if (authority === undefined) {\n    return request === undefined;\n  }\n  if (request === undefined) {\n    return Object.keys(authority).length === 0;\n  }\n  if (authority.mode !== \"constrained-statements\" || request.mode !== \"constrained-statements\") {\n    return false;\n  }\n  const authorityStatements = Array.isArray(authority.statements) ? authority.statements : [];\n  const requestStatements = Array.isArray(request.statements) ? request.statements : [];\n  return requestStatements.every((statement) =>\n    authorityStatements.some((candidate) => jcsCanonicalize(candidate) === jcsCanonicalize(statement)),\n  );\n}\n\nfunction hasOwn(object: JsonObject, key: string): boolean {\n  return objectHasOwn(object, key);\n}\n","import { ed25519 } from \"@noble/curves/ed25519\";\nimport { bases } from \"multiformats/basics\";\nimport { bytesToHex, sha256, verifyMessage } from \"viem\";\nimport { parsePkhDid } from \"../identity\";\nimport { canonicalizePolicyCapability, normalizePolicyCapability } from \"./capability\";\nimport {\n  SignatureMaterialError,\n  SignatureVerificationError,\n  SignedObjectDigestError,\n  SignedObjectIdError,\n  SignedObjectProfileError,\n  SignedObjectSchemaError,\n  SigningKeyBindingError,\n  UnsupportedSignatureSuiteError,\n  toSignedObjectError,\n} from \"./errors\";\nimport { type JsonValue, jcsCanonicalize, normalizeJson } from \"./jcs\";\n\nexport const POLICY_SCHEMA = \"xyz.tinycloud.policy/policy/v0\";\nexport const POLICY_STATUS_SCHEMA = \"xyz.tinycloud.policy/status/v0\";\nexport const POLICY_ENGINE_RECORD_SCHEMA =\n  \"xyz.tinycloud.policy/engine-record/v0\";\n\nexport const ED25519_JCS_SIGNATURE_SUITE = \"eddsa-ed25519-sha256-jcs-v1\";\nexport const EIP191_JCS_SIGNATURE_SUITE =\n  \"eip191-secp256k1-sha256-jcs-v1\";\n\nexport type SignedObjectKind = \"Policy\" | \"PolicyStatus\" | \"PolicyEngineRecord\";\n\nexport type SignatureSuite =\n  | typeof ED25519_JCS_SIGNATURE_SUITE\n  | typeof EIP191_JCS_SIGNATURE_SUITE;\n\nexport interface SignedObjectSignature {\n  suite: SignatureSuite;\n  signerDid: string;\n  value: string;\n}\n\nexport type JsonObject = { readonly [key: string]: JsonValue };\n\nexport interface Policy {\n  readonly schema: typeof POLICY_SCHEMA;\n  readonly policyId: string;\n  readonly ownerDid: string;\n  readonly signingKeyDid: string;\n  readonly createdAt: string;\n  readonly expiresAt?: string;\n  readonly resource: JsonObject;\n  readonly when: JsonObject;\n  readonly grant: JsonObject;\n  readonly disclosure?: JsonObject;\n  readonly audit?: JsonObject;\n  readonly signature: SignedObjectSignature;\n}\n\nexport type UnsignedPolicy = Omit<Policy, \"policyId\" | \"signature\">;\n\nexport interface PolicyStatus {\n  readonly schema: typeof POLICY_STATUS_SCHEMA;\n  readonly statusId: string;\n  readonly policyId: string;\n  readonly ownerDid: string;\n  readonly sequence: number;\n  readonly disposition: \"active\" | \"suspended\" | \"revoked\";\n  readonly effectiveAt: string;\n  readonly reasonCode?: string;\n  readonly signingKeyDid: string;\n  readonly signature: SignedObjectSignature;\n}\n\nexport type UnsignedPolicyStatus = Omit<PolicyStatus, \"statusId\" | \"signature\">;\n\nexport interface PolicyEngineRecord {\n  readonly schema: typeof POLICY_ENGINE_RECORD_SCHEMA;\n  readonly engineRecordId: string;\n  readonly ownerDid: string;\n  readonly endpoint: string;\n  readonly audience: string;\n  readonly supportedPolicyVersions: string[];\n  readonly supportedEvidenceVerifiers: string[];\n  readonly grantIssuerDid: string;\n  readonly expiresAt: string;\n  readonly signature: SignedObjectSignature;\n}\n\nexport type UnsignedPolicyEngineRecord = Omit<\n  PolicyEngineRecord,\n  \"engineRecordId\" | \"signature\"\n>;\n\nexport type SignedPolicyObject =\n  | Policy\n  | PolicyStatus\n  | PolicyEngineRecord;\n\nexport type UnsignedPolicyObject =\n  | UnsignedPolicy\n  | UnsignedPolicyStatus\n  | UnsignedPolicyEngineRecord;\n\nexport interface SignedObjectSigner {\n  readonly suite: SignatureSuite;\n  readonly signerDid: string;\n  signDigest(digest: Uint8Array): Promise<Uint8Array | string> | Uint8Array | string;\n}\n\nexport interface SignedObjectMaterial {\n  readonly kind: SignedObjectKind;\n  readonly idField: string;\n  readonly id: string;\n  readonly domain: string;\n  readonly unsigned: JsonObject;\n  readonly jcs: string;\n  readonly jcsBytes: Uint8Array;\n  readonly digest: Uint8Array;\n  readonly digestHex: string;\n}\n\nexport type SignedObjectVerificationResult<T extends SignedPolicyObject> =\n  | { readonly ok: true; readonly object: T; readonly material: SignedObjectMaterial }\n  | { readonly ok: false; readonly error: SignedObjectProfileError };\n\ninterface ObjectDescriptor {\n  readonly kind: SignedObjectKind;\n  readonly schema: string;\n  readonly idField: \"policyId\" | \"statusId\" | \"engineRecordId\";\n  readonly idPrefix: string;\n  readonly domain: string;\n}\n\nconst DESCRIPTORS: Record<SignedObjectKind, ObjectDescriptor> = {\n  Policy: {\n    kind: \"Policy\",\n    schema: POLICY_SCHEMA,\n    idField: \"policyId\",\n    idPrefix: \"pol_\",\n    domain: POLICY_SCHEMA,\n  },\n  PolicyStatus: {\n    kind: \"PolicyStatus\",\n    schema: POLICY_STATUS_SCHEMA,\n    idField: \"statusId\",\n    idPrefix: \"polst_\",\n    domain: POLICY_STATUS_SCHEMA,\n  },\n  PolicyEngineRecord: {\n    kind: \"PolicyEngineRecord\",\n    schema: POLICY_ENGINE_RECORD_SCHEMA,\n    idField: \"engineRecordId\",\n    idPrefix: \"peng_\",\n    domain: POLICY_ENGINE_RECORD_SCHEMA,\n  },\n};\n\nconst textEncoder = new TextEncoder();\nconst BASE32_ALPHABET = \"abcdefghijklmnopqrstuvwxyz234567\";\nconst BASE64URL_RE = /^[A-Za-z0-9_-]+$/;\nconst objectHasOwn: (object: object, propertyKey: PropertyKey) => boolean =\n  (Object as ObjectConstructor & {\n    hasOwn?: (object: object, propertyKey: PropertyKey) => boolean;\n  }).hasOwn ??\n  (Object.prototype.hasOwnProperty.call.bind(\n    Object.prototype.hasOwnProperty,\n  ) as (object: object, propertyKey: PropertyKey) => boolean);\n\nexport function canonicalizeSignedObjectUnsigned(input: unknown): string {\n  return jcsCanonicalize(input);\n}\n\nexport function deriveSignedObjectMaterial(input: unknown): SignedObjectMaterial {\n  const descriptor = descriptorForUnsigned(input);\n  const unsigned = validateUnsignedForDescriptor(input, descriptor);\n  return materialForUnsigned(unsigned, descriptor);\n}\n\nexport function signedObjectIdFor(input: unknown): string {\n  return deriveSignedObjectMaterial(input).id;\n}\n\nexport async function createAndSignSignedObject(\n  input: unknown,\n  signer: SignedObjectSigner,\n): Promise<SignedPolicyObject> {\n  const normalized = expectJsonObject(normalizeJson(input), \"$\");\n  const descriptor = descriptorForUnsigned(normalized);\n  const stripped = stripOwnIdAndSignature(normalized, descriptor);\n  const unsigned = validateUnsignedForDescriptor(stripped, descriptor);\n  if (descriptor.kind === \"Policy\") {\n    validatePolicyPermissionsCeilingForSigning(unsigned);\n  }\n  assertSupportedSignatureSuite(signer.suite);\n  requireStringType(signer.signerDid, \"$.signer.signerDid\");\n  assertSignerDidMatchesSuite(signer.signerDid, signer.suite);\n  assertSigningKeyBindingForCreate(unsigned, signer.signerDid);\n  const material = materialForUnsigned(unsigned, descriptor);\n  const signatureValue = encodeSignatureValue(\n    await signer.signDigest(material.digest),\n    signer.suite,\n  );\n  const signature = validateSignature({\n    suite: signer.suite,\n    signerDid: signer.signerDid,\n    value: signatureValue,\n  });\n  return {\n    ...unsigned,\n    [descriptor.idField]: material.id,\n    signature,\n  } as unknown as SignedPolicyObject;\n}\n\nexport function createAndSignPolicy(\n  input: unknown,\n  signer: SignedObjectSigner,\n): Promise<Policy> {\n  return createAndSignSignedObject(input, signer).then((object) =>\n    validatePolicySignedShape(object),\n  );\n}\n\nexport function createAndSignPolicyStatus(\n  input: unknown,\n  signer: SignedObjectSigner,\n): Promise<PolicyStatus> {\n  return createAndSignSignedObject(input, signer).then((object) =>\n    validatePolicyStatusSignedShape(object),\n  );\n}\n\nexport function createAndSignPolicyEngineRecord(\n  input: unknown,\n  signer: SignedObjectSigner,\n): Promise<PolicyEngineRecord> {\n  return createAndSignSignedObject(input, signer).then((object) =>\n    validatePolicyEngineRecordSignedShape(object),\n  );\n}\n\nexport async function verifySignedObject(\n  input: unknown,\n): Promise<{ object: SignedPolicyObject; material: SignedObjectMaterial }> {\n  const signed = validateSignedObjectShape(input);\n  const signedJson = signed as unknown as JsonObject;\n  const descriptor = descriptorForSchema(signed.schema);\n  const signature = validateSignature(signed.signature);\n  assertSigningKeyBindingForVerify(signedJson, signature);\n  const unsigned = stripOwnIdAndSignature(signedJson, descriptor);\n  const material = materialForUnsigned(unsigned, descriptor);\n  assertIdMatches(signedJson, material, descriptor);\n  if (!(await verifySignature(signature, material.digest))) {\n    throw new SignatureVerificationError(\"signature verification failed\");\n  }\n  return { object: signed, material };\n}\n\nexport async function verifyPolicy(\n  input: unknown,\n): Promise<{ object: Policy; material: SignedObjectMaterial }> {\n  const result = await verifySignedObject(input);\n  return {\n    object: validatePolicySignedShape(result.object),\n    material: result.material,\n  };\n}\n\nexport async function verifyPolicyStatus(\n  input: unknown,\n): Promise<{ object: PolicyStatus; material: SignedObjectMaterial }> {\n  const result = await verifySignedObject(input);\n  return {\n    object: validatePolicyStatusSignedShape(result.object),\n    material: result.material,\n  };\n}\n\nexport async function verifyPolicyEngineRecord(\n  input: unknown,\n): Promise<{ object: PolicyEngineRecord; material: SignedObjectMaterial }> {\n  const result = await verifySignedObject(input);\n  return {\n    object: validatePolicyEngineRecordSignedShape(result.object),\n    material: result.material,\n  };\n}\n\nexport async function validatePolicySigned(\n  input: unknown,\n): Promise<SignedObjectVerificationResult<Policy>> {\n  try {\n    const result = await verifyPolicy(input);\n    return { ok: true, object: result.object, material: result.material };\n  } catch (error) {\n    return { ok: false, error: toSignedObjectError(error) };\n  }\n}\n\nexport async function validatePolicyStatusSigned(\n  input: unknown,\n): Promise<SignedObjectVerificationResult<PolicyStatus>> {\n  try {\n    const result = await verifyPolicyStatus(input);\n    return { ok: true, object: result.object, material: result.material };\n  } catch (error) {\n    return { ok: false, error: toSignedObjectError(error) };\n  }\n}\n\nexport async function validatePolicyEngineRecordSigned(\n  input: unknown,\n): Promise<SignedObjectVerificationResult<PolicyEngineRecord>> {\n  try {\n    const result = await verifyPolicyEngineRecord(input);\n    return { ok: true, object: result.object, material: result.material };\n  } catch (error) {\n    return { ok: false, error: toSignedObjectError(error) };\n  }\n}\n\nexport function validatePolicyUnsigned(input: unknown): UnsignedPolicy {\n  return validatePolicyShape(input, false) as unknown as UnsignedPolicy;\n}\n\nexport function validatePolicyStatusUnsigned(input: unknown): UnsignedPolicyStatus {\n  return validatePolicyStatusShape(input, false) as unknown as UnsignedPolicyStatus;\n}\n\nexport function validatePolicyEngineRecordUnsigned(\n  input: unknown,\n): UnsignedPolicyEngineRecord {\n  return validatePolicyEngineRecordShape(input, false) as unknown as UnsignedPolicyEngineRecord;\n}\n\nexport function validatePolicySignedShape(input: unknown): Policy {\n  return validatePolicyShape(input, true) as unknown as Policy;\n}\n\nexport function validatePolicyStatusSignedShape(input: unknown): PolicyStatus {\n  return validatePolicyStatusShape(input, true) as unknown as PolicyStatus;\n}\n\nexport function validatePolicyEngineRecordSignedShape(\n  input: unknown,\n): PolicyEngineRecord {\n  return validatePolicyEngineRecordShape(input, true) as unknown as PolicyEngineRecord;\n}\n\nfunction validateSignedObjectShape(input: unknown): SignedPolicyObject {\n  const normalized = expectJsonObject(normalizeJson(input), \"$\");\n  const schema = requiredString(normalized, \"schema\", \"$\");\n  const descriptor = descriptorForSchema(schema);\n  switch (descriptor.kind) {\n    case \"Policy\":\n      return validatePolicySignedShape(normalized);\n    case \"PolicyStatus\":\n      return validatePolicyStatusSignedShape(normalized);\n    case \"PolicyEngineRecord\":\n      return validatePolicyEngineRecordSignedShape(normalized);\n  }\n}\n\nfunction validateUnsignedForDescriptor(\n  input: unknown,\n  descriptor: ObjectDescriptor,\n): JsonObject {\n  switch (descriptor.kind) {\n    case \"Policy\":\n      return validatePolicyUnsigned(input) as unknown as JsonObject;\n    case \"PolicyStatus\":\n      return validatePolicyStatusUnsigned(input) as unknown as JsonObject;\n    case \"PolicyEngineRecord\":\n      return validatePolicyEngineRecordUnsigned(input) as unknown as JsonObject;\n  }\n}\n\nfunction validatePolicyShape(input: unknown, signed: boolean): JsonObject {\n  const object = expectJsonObject(normalizeJson(input), \"$\");\n  assertExactKeys(\n    object,\n    signed\n      ? [\n          \"schema\",\n          \"policyId\",\n          \"ownerDid\",\n          \"signingKeyDid\",\n          \"createdAt\",\n          \"expiresAt\",\n          \"resource\",\n          \"when\",\n          \"grant\",\n          \"disclosure\",\n          \"audit\",\n          \"signature\",\n        ]\n      : [\n          \"schema\",\n          \"ownerDid\",\n          \"signingKeyDid\",\n          \"createdAt\",\n          \"expiresAt\",\n          \"resource\",\n          \"when\",\n          \"grant\",\n          \"disclosure\",\n          \"audit\",\n        ],\n    \"$\",\n  );\n  expectConst(requiredString(object, \"schema\", \"$\"), POLICY_SCHEMA, \"$.schema\");\n  if (signed) {\n    requiredString(object, \"policyId\", \"$\");\n    validateSignature(requiredValue(object, \"signature\", \"$\"));\n  }\n  requiredString(object, \"ownerDid\", \"$\");\n  requiredString(object, \"signingKeyDid\", \"$\");\n  requiredDateString(object, \"createdAt\", \"$\");\n  optionalDateString(object, \"expiresAt\", \"$\");\n  validatePolicyResource(requiredValue(object, \"resource\", \"$\"), \"$.resource\");\n  validateExpression(requiredValue(object, \"when\", \"$\"), \"$.when\");\n  validateGrant(requiredValue(object, \"grant\", \"$\"), \"$.grant\");\n  if (hasOwn(object, \"disclosure\")) {\n    validateDisclosure(requiredValue(object, \"disclosure\", \"$\"), \"$.disclosure\");\n  }\n  if (hasOwn(object, \"audit\")) {\n    validateAudit(requiredValue(object, \"audit\", \"$\"), \"$.audit\");\n  }\n  return object;\n}\n\nfunction validatePolicyStatusShape(input: unknown, signed: boolean): JsonObject {\n  const object = expectJsonObject(normalizeJson(input), \"$\");\n  assertExactKeys(\n    object,\n    signed\n      ? [\n          \"schema\",\n          \"statusId\",\n          \"policyId\",\n          \"ownerDid\",\n          \"sequence\",\n          \"disposition\",\n          \"effectiveAt\",\n          \"reasonCode\",\n          \"signingKeyDid\",\n          \"signature\",\n        ]\n      : [\n          \"schema\",\n          \"policyId\",\n          \"ownerDid\",\n          \"sequence\",\n          \"disposition\",\n          \"effectiveAt\",\n          \"reasonCode\",\n          \"signingKeyDid\",\n        ],\n    \"$\",\n  );\n  expectConst(requiredString(object, \"schema\", \"$\"), POLICY_STATUS_SCHEMA, \"$.schema\");\n  if (signed) {\n    requiredString(object, \"statusId\", \"$\");\n    validateSignature(requiredValue(object, \"signature\", \"$\"));\n  }\n  requiredString(object, \"policyId\", \"$\");\n  requiredString(object, \"ownerDid\", \"$\");\n  requiredInteger(object, \"sequence\", \"$\", 0);\n  expectOneOf(requiredString(object, \"disposition\", \"$\"), [\n    \"active\",\n    \"suspended\",\n    \"revoked\",\n  ], \"$.disposition\");\n  requiredDateString(object, \"effectiveAt\", \"$\");\n  optionalString(object, \"reasonCode\", \"$\");\n  requiredString(object, \"signingKeyDid\", \"$\");\n  return object;\n}\n\nfunction validatePolicyEngineRecordShape(\n  input: unknown,\n  signed: boolean,\n): JsonObject {\n  const object = expectJsonObject(normalizeJson(input), \"$\");\n  assertExactKeys(\n    object,\n    signed\n      ? [\n          \"schema\",\n          \"engineRecordId\",\n          \"ownerDid\",\n          \"endpoint\",\n          \"audience\",\n          \"supportedPolicyVersions\",\n          \"supportedEvidenceVerifiers\",\n          \"grantIssuerDid\",\n          \"expiresAt\",\n          \"signature\",\n        ]\n      : [\n          \"schema\",\n          \"ownerDid\",\n          \"endpoint\",\n          \"audience\",\n          \"supportedPolicyVersions\",\n          \"supportedEvidenceVerifiers\",\n          \"grantIssuerDid\",\n          \"expiresAt\",\n        ],\n    \"$\",\n  );\n  expectConst(\n    requiredString(object, \"schema\", \"$\"),\n    POLICY_ENGINE_RECORD_SCHEMA,\n    \"$.schema\",\n  );\n  if (signed) {\n    requiredString(object, \"engineRecordId\", \"$\");\n    validateSignature(requiredValue(object, \"signature\", \"$\"));\n  }\n  requiredString(object, \"ownerDid\", \"$\");\n  requiredString(object, \"endpoint\", \"$\");\n  requiredString(object, \"audience\", \"$\");\n  requiredStringArray(object, \"supportedPolicyVersions\", \"$\", (value, path) =>\n    expectConst(value, \"v0\", path),\n  );\n  requiredStringArray(object, \"supportedEvidenceVerifiers\", \"$\");\n  requiredString(object, \"grantIssuerDid\", \"$\");\n  requiredDateString(object, \"expiresAt\", \"$\");\n  return object;\n}\n\nfunction validateSignature(input: unknown): SignedObjectSignature {\n  const object = expectJsonObject(input, \"$.signature\");\n  assertExactKeys(object, [\"suite\", \"signerDid\", \"value\"], \"$.signature\");\n  const suite = requiredString(object, \"suite\", \"$.signature\");\n  assertSupportedSignatureSuite(suite);\n  const signerDid = requiredString(object, \"signerDid\", \"$.signature\");\n  const value = requiredString(object, \"value\", \"$.signature\");\n  decodeSignatureValue(value, suite);\n  return { suite, signerDid, value };\n}\n\nfunction validatePolicyResource(input: unknown, path: string): void {\n  const object = expectJsonObject(input, path);\n  assertExactKeys(object, [\"resourceType\", \"resourceId\", \"permissionsCeiling\"], path);\n  requiredString(object, \"resourceType\", path);\n  requiredString(object, \"resourceId\", path);\n  const ceiling = requiredArray(object, \"permissionsCeiling\", path, 1);\n  for (let index = 0; index < ceiling.length; index++) {\n    validatePolicyCapability(ceiling[index], `${path}.permissionsCeiling[${index}]`);\n  }\n}\n\nfunction validatePolicyPermissionsCeilingForSigning(input: JsonObject): void {\n  const resource = expectJsonObject(requiredValue(input, \"resource\", \"$\"), \"$.resource\");\n  const ceiling = requiredArray(resource, \"permissionsCeiling\", \"$.resource\", 1);\n  for (let index = 0; index < ceiling.length; index++) {\n    validatePolicyCapabilityForSigning(\n      ceiling[index],\n      `$.resource.permissionsCeiling[${index}]`,\n    );\n  }\n}\n\nfunction validatePolicyCapability(input: unknown, path: string): void {\n  const object = expectJsonObject(input, path);\n  try {\n    const canonical = canonicalizePolicyCapability(object);\n    if (jcsCanonicalize(object) !== jcsCanonicalize(canonical)) {\n      throw new SignedObjectSchemaError(`${path} must be canonical PolicyCapability JSON`);\n    }\n  } catch (error) {\n    if (error instanceof SignedObjectSchemaError) {\n      throw error;\n    }\n    throw new SignedObjectSchemaError(\n      error instanceof Error ? error.message : String(error),\n    );\n  }\n}\n\nfunction validatePolicyCapabilityForSigning(input: unknown, path: string): void {\n  const object = expectJsonObject(input, path);\n  try {\n    const canonical = normalizePolicyCapability(object);\n    if (jcsCanonicalize(object) !== jcsCanonicalize(canonical)) {\n      throw new SignedObjectSchemaError(`${path} must be strict canonical PolicyCapability JSON`);\n    }\n  } catch (error) {\n    if (error instanceof SignedObjectSchemaError) {\n      throw error;\n    }\n    throw new SignedObjectSchemaError(\n      error instanceof Error ? error.message : String(error),\n    );\n  }\n}\n\nfunction validateExpression(input: unknown, path: string): void {\n  const object = expectJsonObject(input, path);\n  const keys = Object.keys(object);\n  if (keys.length !== 1) {\n    throw new SignedObjectSchemaError(`${path} must have exactly one expression key`);\n  }\n  const key = keys[0];\n  if (key === \"allOf\" || key === \"anyOf\") {\n    const values = requiredArray(object, key, path, 1);\n    for (let index = 0; index < values.length; index++) {\n      validateExpression(values[index], `${path}.${key}[${index}]`);\n    }\n    return;\n  }\n  if (key === \"subject\") {\n    const subject = expectJsonObject(requiredValue(object, \"subject\", path), `${path}.subject`);\n    assertExactKeys(subject, [\"did\"], `${path}.subject`);\n    requiredString(subject, \"did\", `${path}.subject`);\n    return;\n  }\n  if (key === \"evidence\") {\n    validateEvidenceRequirement(requiredValue(object, \"evidence\", path), `${path}.evidence`);\n    return;\n  }\n  throw new SignedObjectSchemaError(`${path} has unknown expression key ${key}`);\n}\n\nfunction validateEvidenceRequirement(input: unknown, path: string): void {\n  const object = expectJsonObject(input, path);\n  assertExactKeys(\n    object,\n    [\"requirementId\", \"verifier\", \"requirements\", \"authority\", \"freshness\"],\n    path,\n  );\n  requiredString(object, \"requirementId\", path);\n  requiredString(object, \"verifier\", path);\n  requiredValue(object, \"requirements\", path);\n  if (hasOwn(object, \"authority\")) {\n    const authority = expectJsonObject(requiredValue(object, \"authority\", path), `${path}.authority`);\n    assertExactKeys(\n      authority,\n      [\"profile\", \"acceptedIssuers\", \"allowOwnerAuthorizedIssuer\"],\n      `${path}.authority`,\n    );\n    optionalString(authority, \"profile\", `${path}.authority`);\n    if (hasOwn(authority, \"acceptedIssuers\")) {\n      requiredStringArray(authority, \"acceptedIssuers\", `${path}.authority`);\n    }\n    optionalBoolean(authority, \"allowOwnerAuthorizedIssuer\", `${path}.authority`);\n  }\n  if (hasOwn(object, \"freshness\")) {\n    const freshness = expectJsonObject(requiredValue(object, \"freshness\", path), `${path}.freshness`);\n    assertExactKeys(freshness, [\"maxStatusAgeSeconds\"], `${path}.freshness`);\n    requiredInteger(freshness, \"maxStatusAgeSeconds\", `${path}.freshness`, 0);\n  }\n}\n\nfunction validateGrant(input: unknown, path: string): void {\n  const object = expectJsonObject(input, path);\n  assertExactKeys(object, [\"output\", \"maxTtlSeconds\", \"delegationMode\", \"revocation\"], path);\n  expectConst(requiredString(object, \"output\", path), \"portable-delegation\", `${path}.output`);\n  requiredInteger(object, \"maxTtlSeconds\", path, 1);\n  expectOneOf(requiredString(object, \"delegationMode\", path), [\n    \"terminal\",\n    \"attenuable\",\n  ], `${path}.delegationMode`);\n  expectOneOf(requiredString(object, \"revocation\", path), [\n    \"refresh_only\",\n    \"active_cutoff\",\n  ], `${path}.revocation`);\n}\n\nfunction validateDisclosure(input: unknown, path: string): void {\n  const object = expectJsonObject(input, path);\n  assertExactKeys(object, [\"denial\"], path);\n  expectOneOf(requiredString(object, \"denial\", path), [\"none\", \"code\", \"debug\"], `${path}.denial`);\n}\n\nfunction validateAudit(input: unknown, path: string): void {\n  const object = expectJsonObject(input, path);\n  assertExactKeys(object, [\"issuance\"], path);\n  expectOneOf(requiredString(object, \"issuance\", path), [\"off\", \"security\", \"full\"], `${path}.issuance`);\n}\n\nfunction materialForUnsigned(\n  unsigned: JsonObject,\n  descriptor: ObjectDescriptor,\n): SignedObjectMaterial {\n  const jcs = jcsCanonicalize(unsigned);\n  const jcsBytes = textEncoder.encode(jcs);\n  const digest = sha256Bytes(concatBytes(textEncoder.encode(`${descriptor.domain}\\0`), jcsBytes));\n  const id = `${descriptor.idPrefix}${base32LowerNoPad(digest)}`;\n  return {\n    kind: descriptor.kind,\n    idField: descriptor.idField,\n    id,\n    domain: descriptor.domain,\n    unsigned,\n    jcs,\n    jcsBytes,\n    digest,\n    digestHex: bytesToHex(digest).slice(2),\n  };\n}\n\nfunction assertIdMatches(\n  signed: JsonObject,\n  material: SignedObjectMaterial,\n  descriptor: ObjectDescriptor,\n): void {\n  const actual = requiredString(signed, descriptor.idField, \"$\");\n  if (actual === material.id) {\n    return;\n  }\n  if (new RegExp(`^${descriptor.idPrefix}[a-z2-7]{52}$`).test(actual)) {\n    throw new SignedObjectDigestError(\n      `${descriptor.idField} was not derived from the signed object digest`,\n    );\n  }\n  throw new SignedObjectIdError(`${descriptor.idField} does not match ${descriptor.idPrefix}`);\n}\n\nfunction assertSigningKeyBindingForCreate(\n  unsigned: JsonObject,\n  signerDid: string,\n): void {\n  if (!hasOwn(unsigned, \"signingKeyDid\")) {\n    return;\n  }\n  const signingKeyDid = requiredString(unsigned, \"signingKeyDid\", \"$\");\n  if (signingKeyDid !== signerDid) {\n    throw new SigningKeyBindingError(\n      `signer DID ${signerDid} does not match signingKeyDid ${signingKeyDid}`,\n    );\n  }\n}\n\nfunction assertSigningKeyBindingForVerify(\n  signed: JsonObject,\n  signature: SignedObjectSignature,\n): void {\n  if (!hasOwn(signed, \"signingKeyDid\")) {\n    return;\n  }\n  const signingKeyDid = requiredString(signed, \"signingKeyDid\", \"$\");\n  if (signature.signerDid !== signingKeyDid) {\n    throw new SigningKeyBindingError(\n      `signature signerDid ${signature.signerDid} does not match signingKeyDid ${signingKeyDid}`,\n    );\n  }\n}\n\nfunction assertSignerDidMatchesSuite(\n  signerDid: string,\n  suite: SignatureSuite,\n): void {\n  if (suite === ED25519_JCS_SIGNATURE_SUITE) {\n    ed25519PublicKeyFromDidKey(signerDid);\n    return;\n  }\n  if (suite === EIP191_JCS_SIGNATURE_SUITE) {\n    parseDidPkh(signerDid);\n    return;\n  }\n  throw new UnsupportedSignatureSuiteError(`unsupported signature suite: ${suite}`);\n}\n\nasync function verifySignature(\n  signature: SignedObjectSignature,\n  digest: Uint8Array,\n): Promise<boolean> {\n  if (signature.suite === ED25519_JCS_SIGNATURE_SUITE) {\n    const publicKey = ed25519PublicKeyFromDidKey(signature.signerDid);\n    const signatureBytes = decodeSignatureValue(signature.value, signature.suite);\n    try {\n      return ed25519.verify(signatureBytes, digest, publicKey);\n    } catch {\n      throw new SignatureVerificationError(\"Ed25519 signature verification failed\");\n    }\n  }\n\n  if (signature.suite === EIP191_JCS_SIGNATURE_SUITE) {\n    const pkh = parseDidPkh(signature.signerDid);\n    const signatureBytes = decodeSignatureValue(signature.value, signature.suite);\n    try {\n      return verifyMessage({\n        address: pkh.address,\n        message: { raw: digest },\n        signature: bytesToHex(signatureBytes),\n      });\n    } catch {\n      throw new SignatureVerificationError(\"EIP-191 signature verification failed\");\n    }\n  }\n\n  throw new UnsupportedSignatureSuiteError(`unsupported signature suite: ${signature.suite}`);\n}\n\nfunction ed25519PublicKeyFromDidKey(did: string): Uint8Array {\n  if (!did.startsWith(\"did:key:\")) {\n    throw new SignatureMaterialError(\"Ed25519 signerDid must be did:key\");\n  }\n  const identifier = did.slice(\"did:key:\".length);\n  if (!identifier.startsWith(\"z\")) {\n    throw new SignatureMaterialError(\"did:key must use base58btc multibase\");\n  }\n  let bytes: Uint8Array;\n  try {\n    bytes = bases.base58btc.decode(identifier);\n  } catch {\n    throw new SignatureMaterialError(\"did:key signerDid is undecodable\");\n  }\n  if (bytes.length === 34 && bytes[0] === 0xed && bytes[1] === 0x01) {\n    return bytes.slice(2);\n  }\n  throw new SignatureMaterialError(\"did:key signerDid is not an Ed25519 key\");\n}\n\nfunction parseDidPkh(did: string): { address: `0x${string}` } {\n  let parsed: ReturnType<typeof parsePkhDid>;\n  try {\n    parsed = parsePkhDid(did);\n  } catch {\n    throw new SignatureMaterialError(\"did:pkh signerDid is undecodable\");\n  }\n  if (!parsed) {\n    throw new SignatureMaterialError(\"EIP-191 signerDid must be did:pkh\");\n  }\n  return { address: parsed.address };\n}\n\nfunction decodeSignatureValue(value: string, suite: SignatureSuite): Uint8Array {\n  if (value.length === 0 || !BASE64URL_RE.test(value) || value.includes(\"=\")) {\n    throw new SignatureMaterialError(\"signature value must be base64url without padding\");\n  }\n  const bytes = base64UrlDecode(value);\n  if (suite === ED25519_JCS_SIGNATURE_SUITE && bytes.length !== 64) {\n    throw new SignatureMaterialError(\"Ed25519 signature must be 64 bytes\");\n  }\n  if (suite === EIP191_JCS_SIGNATURE_SUITE) {\n    if (bytes.length !== 65) {\n      throw new SignatureMaterialError(\"EIP-191 signature must be 65 bytes\");\n    }\n    const v = bytes[64];\n    if (v !== 27 && v !== 28) {\n      throw new SignatureMaterialError(\"EIP-191 signature recovery id must be 27 or 28\");\n    }\n  }\n  return bytes;\n}\n\nfunction encodeSignatureValue(\n  value: Uint8Array | string,\n  suite: SignatureSuite,\n): string {\n  if (typeof value === \"string\") {\n    const encoded = value.startsWith(\"0x\")\n      ? base64UrlEncode(hexToBytes(value))\n      : value;\n    decodeSignatureValue(encoded, suite);\n    return encoded;\n  }\n  const encoded = base64UrlEncode(value);\n  decodeSignatureValue(encoded, suite);\n  return encoded;\n}\n\nfunction stripOwnIdAndSignature(\n  object: JsonObject,\n  descriptor: ObjectDescriptor,\n): JsonObject {\n  const output = Object.create(null) as { [key: string]: JsonValue };\n  for (const [key, value] of Object.entries(object)) {\n    if (key === descriptor.idField || key === \"signature\") {\n      continue;\n    }\n    output[key] = value;\n  }\n  return output;\n}\n\nfunction descriptorForUnsigned(input: unknown): ObjectDescriptor {\n  const object = expectJsonObject(normalizeJson(input), \"$\");\n  return descriptorForSchema(requiredString(object, \"schema\", \"$\"));\n}\n\nfunction descriptorForSchema(schema: string): ObjectDescriptor {\n  if (schema === POLICY_SCHEMA) return DESCRIPTORS.Policy;\n  if (schema === POLICY_STATUS_SCHEMA) return DESCRIPTORS.PolicyStatus;\n  if (schema === POLICY_ENGINE_RECORD_SCHEMA) return DESCRIPTORS.PolicyEngineRecord;\n  throw new SignedObjectSchemaError(`unsupported signed-object schema: ${schema}`);\n}\n\nfunction expectJsonObject(input: unknown, path: string): JsonObject {\n  if (input === null || typeof input !== \"object\" || Array.isArray(input)) {\n    throw new SignedObjectSchemaError(`${path} must be an object`);\n  }\n  return input as JsonObject;\n}\n\nfunction assertExactKeys(object: JsonObject, allowed: readonly string[], path: string): void {\n  const allowedSet = new Set(allowed);\n  for (const key of Object.keys(object)) {\n    if (!allowedSet.has(key)) {\n      throw new SignedObjectSchemaError(`${path} has unknown field ${key}`);\n    }\n  }\n}\n\nfunction requiredValue(object: JsonObject, key: string, path: string): JsonValue {\n  if (!hasOwn(object, key)) {\n    throw new SignedObjectSchemaError(`${path}.${key} is required`);\n  }\n  return object[key];\n}\n\nfunction requiredString(object: JsonObject, key: string, path: string): string {\n  return requireStringType(requiredValue(object, key, path), `${path}.${key}`);\n}\n\nfunction optionalString(object: JsonObject, key: string, path: string): void {\n  if (!hasOwn(object, key)) {\n    return;\n  }\n  requireStringType(requiredValue(object, key, path), `${path}.${key}`);\n}\n\nfunction requireStringType(value: JsonValue, path: string): string {\n  if (typeof value !== \"string\" || value.length === 0) {\n    throw new SignedObjectSchemaError(`${path} must be a non-empty string`);\n  }\n  return value;\n}\n\nfunction optionalBoolean(object: JsonObject, key: string, path: string): void {\n  if (!hasOwn(object, key)) {\n    return;\n  }\n  if (typeof requiredValue(object, key, path) !== \"boolean\") {\n    throw new SignedObjectSchemaError(`${path}.${key} must be a boolean`);\n  }\n}\n\nfunction requiredInteger(\n  object: JsonObject,\n  key: string,\n  path: string,\n  minimum: number,\n): number {\n  const value = requiredValue(object, key, path);\n  if (typeof value !== \"number\" || !Number.isSafeInteger(value) || value < minimum) {\n    throw new SignedObjectSchemaError(\n      `${path}.${key} must be an integer >= ${minimum}`,\n    );\n  }\n  return value;\n}\n\nfunction requiredArray(\n  object: JsonObject,\n  key: string,\n  path: string,\n  minimum: number,\n): readonly JsonValue[] {\n  const value = requiredValue(object, key, path);\n  if (!Array.isArray(value) || value.length < minimum) {\n    throw new SignedObjectSchemaError(\n      `${path}.${key} must be an array with at least ${minimum} item(s)`,\n    );\n  }\n  return value;\n}\n\nfunction requiredStringArray(\n  object: JsonObject,\n  key: string,\n  path: string,\n  check?: (value: string, path: string) => void,\n): void {\n  const values = requiredArray(object, key, path, 0);\n  for (let index = 0; index < values.length; index++) {\n    const itemPath = `${path}.${key}[${index}]`;\n    const value = requireStringType(values[index], itemPath);\n    check?.(value, itemPath);\n  }\n}\n\nfunction requiredDateString(object: JsonObject, key: string, path: string): void {\n  assertRfc3339(requiredString(object, key, path), `${path}.${key}`);\n}\n\nfunction optionalDateString(object: JsonObject, key: string, path: string): void {\n  if (!hasOwn(object, key)) {\n    return;\n  }\n  assertRfc3339(requiredString(object, key, path), `${path}.${key}`);\n}\n\nfunction assertRfc3339(value: string, path: string): void {\n  const match = value.match(\n    /^(\\d{4})-(\\d{2})-(\\d{2})T(\\d{2}):(\\d{2}):(\\d{2})(\\.\\d+)?(Z|[+-]\\d{2}:\\d{2})$/,\n  );\n  if (!match) {\n    throw new SignedObjectSchemaError(`${path} must be strict RFC 3339`);\n  }\n  const parsed = Date.parse(value);\n  if (Number.isNaN(parsed)) {\n    throw new SignedObjectSchemaError(`${path} must be a parseable RFC 3339 timestamp`);\n  }\n  const canonical = new Date(parsed).toISOString().replace(\".000Z\", \"Z\");\n  if (canonical !== value) {\n    throw new SignedObjectSchemaError(`${path} must be a normalizable RFC 3339 timestamp`);\n  }\n}\n\nfunction expectConst<T extends string>(actual: string, expected: T, path: string): T {\n  if (actual !== expected) {\n    throw new SignedObjectSchemaError(`${path} must be ${expected}`);\n  }\n  return expected;\n}\n\nfunction expectOneOf<T extends string>(\n  actual: string,\n  allowed: readonly T[],\n  path: string,\n): T {\n  for (const value of allowed) {\n    if (actual === value) {\n      return value;\n    }\n  }\n  throw new SignedObjectSchemaError(`${path} has unsupported value ${actual}`);\n}\n\nfunction hasOwn(object: JsonObject, key: string): boolean {\n  return objectHasOwn(object, key);\n}\n\nfunction assertSupportedSignatureSuite(suite: string): asserts suite is SignatureSuite {\n  if (suite !== ED25519_JCS_SIGNATURE_SUITE && suite !== EIP191_JCS_SIGNATURE_SUITE) {\n    throw new UnsupportedSignatureSuiteError(`unsupported signature suite: ${suite}`);\n  }\n}\n\nfunction sha256Bytes(bytes: Uint8Array): Uint8Array {\n  return sha256(bytes, \"bytes\");\n}\n\nfunction concatBytes(left: Uint8Array, right: Uint8Array): Uint8Array {\n  const output = new Uint8Array(left.length + right.length);\n  output.set(left, 0);\n  output.set(right, left.length);\n  return output;\n}\n\nfunction base32LowerNoPad(bytes: Uint8Array): string {\n  let output = \"\";\n  let buffer = 0;\n  let bits = 0;\n  for (const byte of bytes) {\n    buffer = (buffer << 8) | byte;\n    bits += 8;\n    while (bits >= 5) {\n      bits -= 5;\n      output += BASE32_ALPHABET[(buffer >> bits) & 31];\n    }\n  }\n  if (bits > 0) {\n    output += BASE32_ALPHABET[(buffer << (5 - bits)) & 31];\n  }\n  return output;\n}\n\nfunction base64UrlEncode(bytes: Uint8Array): string {\n  const alphabet =\n    \"ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789-_\";\n  let output = \"\";\n  for (let index = 0; index < bytes.length; index += 3) {\n    const a = bytes[index];\n    const b = bytes[index + 1];\n    const c = bytes[index + 2];\n    const triplet = (a << 16) | ((b ?? 0) << 8) | (c ?? 0);\n    output += alphabet[(triplet >> 18) & 63];\n    output += alphabet[(triplet >> 12) & 63];\n    if (index + 1 < bytes.length) {\n      output += alphabet[(triplet >> 6) & 63];\n    }\n    if (index + 2 < bytes.length) {\n      output += alphabet[triplet & 63];\n    }\n  }\n  return output;\n}\n\nfunction base64UrlDecode(value: string): Uint8Array {\n  if (value.length % 4 === 1) {\n    throw new SignatureMaterialError(\"signature value is not canonical base64url\");\n  }\n  const alphabet =\n    \"ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789-_\";\n  const bytes: number[] = [];\n  let buffer = 0;\n  let bits = 0;\n  for (const char of value) {\n    const index = alphabet.indexOf(char);\n    if (index < 0) {\n      throw new SignatureMaterialError(\"signature value is not base64url\");\n    }\n    buffer = (buffer << 6) | index;\n    bits += 6;\n    if (bits >= 8) {\n      bits -= 8;\n      bytes.push((buffer >> bits) & 0xff);\n    }\n  }\n  const decoded = Uint8Array.from(bytes);\n  if (base64UrlEncode(decoded) !== value) {\n    throw new SignatureMaterialError(\"signature value is not canonical base64url\");\n  }\n  return decoded;\n}\n\nfunction hexToBytes(value: string): Uint8Array {\n  const hex = value.slice(2);\n  if (hex.length % 2 !== 0 || !/^[0-9a-fA-F]*$/.test(hex)) {\n    throw new SignatureMaterialError(\"hex signature must have even length\");\n  }\n  const output = new Uint8Array(hex.length / 2);\n  for (let index = 0; index < output.length; index++) {\n    output[index] = Number.parseInt(hex.slice(index * 2, index * 2 + 2), 16);\n  }\n  return output;\n}\n","import { baseX } from './base.js'\n\nexport const base10 = baseX({\n  prefix: '9',\n  name: 'base10',\n  alphabet: '0123456789'\n})\n","import { rfc4648 } from './base.js'\n\nexport const base16 = rfc4648({\n  prefix: 'f',\n  name: 'base16',\n  alphabet: '0123456789abcdef',\n  bitsPerChar: 4\n})\n\nexport const base16upper = rfc4648({\n  prefix: 'F',\n  name: 'base16upper',\n  alphabet: '0123456789ABCDEF',\n  bitsPerChar: 4\n})\n","import { rfc4648 } from './base.js'\n\nexport const base2 = rfc4648({\n  prefix: '0',\n  name: 'base2',\n  alphabet: '01',\n  bitsPerChar: 1\n})\n","import { from } from './base.js'\n\nconst alphabet = Array.from('🚀🪐☄🛰🌌🌑🌒🌓🌔🌕🌖🌗🌘🌍🌏🌎🐉☀💻🖥💾💿😂❤😍🤣😊🙏💕😭😘👍😅👏😁🔥🥰💔💖💙😢🤔😆🙄💪😉☺👌🤗💜😔😎😇🌹🤦🎉💞✌✨🤷😱😌🌸🙌😋💗💚😏💛🙂💓🤩😄😀🖤😃💯🙈👇🎶😒🤭❣😜💋👀😪😑💥🙋😞😩😡🤪👊🥳😥🤤👉💃😳✋😚😝😴🌟😬🙃🍀🌷😻😓⭐✅🥺🌈😈🤘💦✔😣🏃💐☹🎊💘😠☝😕🌺🎂🌻😐🖕💝🙊😹🗣💫💀👑🎵🤞😛🔴😤🌼😫⚽🤙☕🏆🤫👈😮🙆🍻🍃🐶💁😲🌿🧡🎁⚡🌞🎈❌✊👋😰🤨😶🤝🚶💰🍓💢🤟🙁🚨💨🤬✈🎀🍺🤓😙💟🌱😖👶🥴▶➡❓💎💸⬇😨🌚🦋😷🕺⚠🙅😟😵👎🤲🤠🤧📌🔵💅🧐🐾🍒😗🤑🌊🤯🐷☎💧😯💆👆🎤🙇🍑❄🌴💣🐸💌📍🥀🤢👅💡💩👐📸👻🤐🤮🎼🥵🚩🍎🍊👼💍📣🥂')\nconst alphabetBytesToChars: string[] = (alphabet.reduce<string[]>((p, c, i) => { p[i] = c; return p }, ([])))\nconst alphabetCharsToBytes: number[] = (alphabet.reduce<number[]>((p, c, i) => {\n  const codePoint = c.codePointAt(0)\n  if (codePoint == null) {\n    throw new Error(`Invalid character: ${c}`)\n  }\n  p[codePoint] = i\n  return p\n}, ([])))\n\nfunction encode (data: Uint8Array): string {\n  return data.reduce((p, c) => {\n    p += alphabetBytesToChars[c]\n    return p\n  }, '')\n}\n\nfunction decode (str: string): Uint8Array {\n  const byts = []\n  for (const char of str) {\n    const codePoint = char.codePointAt(0)\n    if (codePoint == null) {\n      throw new Error(`Invalid character: ${char}`)\n    }\n    const byt = alphabetCharsToBytes[codePoint]\n    if (byt == null) {\n      throw new Error(`Non-base256emoji character: ${char}`)\n    }\n    byts.push(byt)\n  }\n  return new Uint8Array(byts)\n}\n\nexport const base256emoji = from({\n  prefix: '🚀',\n  name: 'base256emoji',\n  encode,\n  decode\n})\n","import { rfc4648 } from './base.js'\n\nexport const base64 = rfc4648({\n  prefix: 'm',\n  name: 'base64',\n  alphabet: 'ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+/',\n  bitsPerChar: 6\n})\n\nexport const base64pad = rfc4648({\n  prefix: 'M',\n  name: 'base64pad',\n  alphabet: 'ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+/=',\n  bitsPerChar: 6\n})\n\nexport const base64url = rfc4648({\n  prefix: 'u',\n  name: 'base64url',\n  alphabet: 'ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789-_',\n  bitsPerChar: 6\n})\n\nexport const base64urlpad = rfc4648({\n  prefix: 'U',\n  name: 'base64urlpad',\n  alphabet: 'ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789-_=',\n  bitsPerChar: 6\n})\n","import { rfc4648 } from './base.js'\n\nexport const base8 = rfc4648({\n  prefix: '7',\n  name: 'base8',\n  alphabet: '01234567',\n  bitsPerChar: 3\n})\n","import { fromString, toString } from '../bytes.js'\nimport { from } from './base.js'\n\nexport const identity = from({\n  prefix: '\\x00',\n  name: 'identity',\n  encode: (buf) => toString(buf),\n  decode: (str) => fromString(str)\n})\n","import type { ArrayBufferView, ByteView } from './interface.js'\n\nconst textEncoder = new TextEncoder()\nconst textDecoder = new TextDecoder()\n\nexport const name = 'json'\nexport const code = 0x0200\n\nexport function encode <T> (node: T): ByteView<T> {\n  return textEncoder.encode(JSON.stringify(node))\n}\n\nexport function decode <T> (data: ByteView<T> | ArrayBufferView<T>): T {\n  return JSON.parse(textDecoder.decode(data))\n}\n","import { coerce } from '../bytes.js'\nimport * as Digest from './digest.js'\nimport type { DigestOptions } from './hasher.js'\n\nconst code: 0x0 = 0x0\nconst name = 'identity'\n\nconst encode: (input: Uint8Array) => Uint8Array = coerce\n\nfunction digest (input: Uint8Array, options?: DigestOptions): Digest.Digest<typeof code, number> {\n  if (options?.truncate != null && options.truncate !== input.byteLength) {\n    if (options.truncate < 0 || options.truncate > input.byteLength) {\n      throw new Error(`Invalid truncate option, must be less than or equal to ${input.byteLength}`)\n    }\n\n    input = input.subarray(0, options.truncate)\n  }\n\n  return Digest.create(code, encode(input))\n}\n\nexport const identity = { code, name, encode, digest }\n","import crypto from 'crypto'\nimport { coerce } from '../bytes.js'\nimport { from } from './hasher.js'\n\nexport const sha256 = from({\n  name: 'sha2-256',\n  code: 0x12,\n  encode: (input) => coerce(crypto.createHash('sha256').update(input).digest())\n})\n\nexport const sha512 = from({\n  name: 'sha2-512',\n  code: 0x13,\n  encode: input => coerce(crypto.createHash('sha512').update(input).digest())\n})\n","import * as Digest from './digest.js'\nimport type { MultihashHasher } from './interface.js'\n\ntype Await<T> = Promise<T> | T\n\nconst DEFAULT_MIN_DIGEST_LENGTH = 20\n\nexport interface HasherInit <Name extends string, Code extends number> {\n  name: Name\n  code: Code\n  encode(input: Uint8Array): Await<Uint8Array>\n\n  /**\n   * The minimum length a hash is allowed to be truncated to in bytes\n   *\n   * @default 20\n   */\n  minDigestLength?: number\n\n  /**\n   * The maximum length a hash is allowed to be truncated to in bytes. If not\n   * specified it will be inferred from the length of the digest.\n   */\n  maxDigestLength?: number\n}\n\nexport function from <Name extends string, Code extends number> ({ name, code, encode, minDigestLength, maxDigestLength }: HasherInit<Name, Code>): Hasher<Name, Code> {\n  return new Hasher(name, code, encode, minDigestLength, maxDigestLength)\n}\n\nexport interface DigestOptions {\n  /**\n   * Truncate the returned digest to this number of bytes.\n   *\n   * This may cause the digest method to throw/reject if the passed value is\n   * greater than the digest length or below a threshold under which the risk of\n   * hash collisions is significant.\n   *\n   * The actual value of this threshold can depend on the hashing algorithm in\n   * use.\n   */\n  truncate?: number\n}\n\n/**\n * Hasher represents a hashing algorithm implementation that produces as\n * `MultihashDigest`.\n */\nexport class Hasher<Name extends string, Code extends number> implements MultihashHasher<Code> {\n  readonly name: Name\n  readonly code: Code\n  readonly encode: (input: Uint8Array) => Await<Uint8Array>\n  readonly minDigestLength: number\n  readonly maxDigestLength?: number\n\n  constructor (name: Name, code: Code, encode: (input: Uint8Array) => Await<Uint8Array>, minDigestLength?: number, maxDigestLength?: number) {\n    this.name = name\n    this.code = code\n    this.encode = encode\n    this.minDigestLength = minDigestLength ?? DEFAULT_MIN_DIGEST_LENGTH\n    this.maxDigestLength = maxDigestLength\n  }\n\n  digest (input: Uint8Array, options?: DigestOptions): Await<Digest.Digest<Code, number>> {\n    if (options?.truncate != null) {\n      if (options.truncate < this.minDigestLength) {\n        throw new Error(`Invalid truncate option, must be greater than or equal to ${this.minDigestLength}`)\n      }\n\n      if (this.maxDigestLength != null && options.truncate > this.maxDigestLength) {\n        throw new Error(`Invalid truncate option, must be less than or equal to ${this.maxDigestLength}`)\n      }\n    }\n\n    if (input instanceof Uint8Array) {\n      const result = this.encode(input)\n\n      if (result instanceof Uint8Array) {\n        return createDigest(result, this.code, options?.truncate)\n      }\n\n      return result.then(digest => createDigest(digest, this.code, options?.truncate))\n    } else {\n      throw Error('Unknown type, must be binary type')\n      /* c8 ignore next 1 */\n    }\n  }\n}\n\n/**\n * Create a Digest from the passed uint8array and code, optionally truncating it\n * first.\n */\nfunction createDigest <Code extends number> (digest: Uint8Array, code: Code, truncate?: number): Digest.Digest<Code, number> {\n  if (truncate != null && truncate !== digest.byteLength) {\n    if (truncate > digest.byteLength) {\n      throw new Error(`Invalid truncate option, must be less than or equal to ${digest.byteLength}`)\n    }\n\n    digest = digest.subarray(0, truncate)\n  }\n\n  return Digest.create(code, digest)\n}\n","import * as base10 from './bases/base10.js'\nimport * as base16 from './bases/base16.js'\nimport * as base2 from './bases/base2.js'\nimport * as base256emoji from './bases/base256emoji.js'\nimport * as base32 from './bases/base32.js'\nimport * as base36 from './bases/base36.js'\nimport * as base58 from './bases/base58.js'\nimport * as base64 from './bases/base64.js'\nimport * as base8 from './bases/base8.js'\nimport * as identityBase from './bases/identity.js'\nimport * as json from './codecs/json.js'\nimport * as raw from './codecs/raw.js'\nimport * as identity from './hashes/identity.js'\nimport * as sha2 from './hashes/sha2.js'\nimport { CID, hasher, digest, varint, bytes } from './index.js'\n\nexport const bases = { ...identityBase, ...base2, ...base8, ...base10, ...base16, ...base32, ...base36, ...base58, ...base64, ...base256emoji }\nexport const hashes = { ...sha2, ...identity }\nexport const codecs = { raw, json }\n\nexport { CID, hasher, digest, varint, bytes }\n","import { getAddress, isAddress } from \"viem\";\n\nexport type CanonicalAddress = `0x${string}`;\n\nexport interface PkhDidParts {\n  method: \"pkh\";\n  namespace: \"eip155\";\n  chainId: number;\n  address: CanonicalAddress;\n}\n\nexport interface DidEqualsOptions {\n  ignoreFragment?: boolean;\n}\n\nexport interface DidCacheKeyOptions {\n  preserveFragment?: boolean;\n}\n\nexport class IdentityParseError extends Error {\n  constructor(message: string) {\n    super(message);\n    this.name = \"IdentityParseError\";\n  }\n}\n\nconst PKH_DID_RE = /^did:pkh:eip155:(\\d+):(0x[a-fA-F0-9]{40})$/;\nconst DID_RE = /^did:[a-z0-9]+:.+$/;\n\nfunction splitDidUrl(input: string): { did: string; fragment: string } {\n  const fragmentIndex = input.indexOf(\"#\");\n  if (fragmentIndex < 0) {\n    return { did: input, fragment: \"\" };\n  }\n  return {\n    did: input.slice(0, fragmentIndex),\n    fragment: input.slice(fragmentIndex),\n  };\n}\n\nfunction assertValidChainId(chainId: number): void {\n  if (!Number.isSafeInteger(chainId) || chainId <= 0) {\n    throw new IdentityParseError(`Invalid EIP-155 chain ID: ${chainId}`);\n  }\n}\n\nexport function isEvmAddress(input: string): boolean {\n  return isAddress(input, { strict: false });\n}\n\nexport function canonicalizeAddress(address: string): CanonicalAddress {\n  if (!isEvmAddress(address)) {\n    throw new IdentityParseError(`Invalid EVM address: ${address}`);\n  }\n  return getAddress(address) as CanonicalAddress;\n}\n\nexport function addressStorageKey(address: string): CanonicalAddress {\n  return canonicalizeAddress(address).toLowerCase() as CanonicalAddress;\n}\n\nexport function pkhDid(address: string, chainId: number = 1): string {\n  assertValidChainId(chainId);\n  return `did:pkh:eip155:${chainId}:${canonicalizeAddress(address)}`;\n}\n\nexport function parsePkhDid(did: string): PkhDidParts | null {\n  const match = did.match(PKH_DID_RE);\n  if (!match) return null;\n\n  const chainId = Number(match[1]);\n  assertValidChainId(chainId);\n\n  return {\n    method: \"pkh\",\n    namespace: \"eip155\",\n    chainId,\n    address: canonicalizeAddress(match[2]),\n  };\n}\n\nexport function canonicalizeDid(did: string): string {\n  const pkh = parsePkhDid(did);\n  if (pkh) {\n    return pkhDid(pkh.address, pkh.chainId);\n  }\n  if (DID_RE.test(did)) {\n    return did;\n  }\n  throw new IdentityParseError(`Invalid DID: ${did}`);\n}\n\nexport function canonicalizeDidUrl(didUrl: string): string {\n  const { did, fragment } = splitDidUrl(didUrl);\n  return `${canonicalizeDid(did)}${fragment}`;\n}\n\nexport function principalDid(didUrl: string): string {\n  return canonicalizeDid(splitDidUrl(didUrl).did);\n}\n\nexport function didEquals(a: string, b: string, options: DidEqualsOptions = {}): boolean {\n  const canonicalize = options.ignoreFragment ? principalDid : canonicalizeDidUrl;\n  return canonicalize(a) === canonicalize(b);\n}\n\nexport function principalDidEquals(a: string, b: string): boolean {\n  return didEquals(a, b, { ignoreFragment: true });\n}\n\nexport function didCacheKey(input: string, options: DidCacheKeyOptions = {}): string {\n  const { did, fragment } = splitDidUrl(input);\n  const pkh = parsePkhDid(did);\n  const base = pkh\n    ? `did:pkh:eip155:${pkh.chainId}:${addressStorageKey(pkh.address)}`\n    : canonicalizeDid(did);\n\n  return options.preserveFragment ? `${base}${fragment}` : base;\n}\n\nexport function makePkhSpaceId(\n  address: string,\n  chainId: number,\n  name: string,\n): string {\n  assertValidChainId(chainId);\n  if (!name) {\n    throw new IdentityParseError(\"Space name cannot be empty\");\n  }\n  return `tinycloud:pkh:eip155:${chainId}:${canonicalizeAddress(address)}:${name}`;\n}\n","import {\n  POLICY_ENGINE_RECORD_SCHEMA,\n  POLICY_SCHEMA,\n  createAndSignPolicy,\n  createAndSignPolicyEngineRecord,\n  validatePolicyEngineRecordSignedShape,\n  verifyPolicyEngineRecord,\n  type Policy,\n  type PolicyEngineRecord,\n  type SignedObjectSigner,\n  type UnsignedPolicyEngineRecord,\n} from \"./signed-object\";\nimport {\n  PolicyCapabilityError,\n  normalizePolicyCapability,\n  type JsonObject,\n  type PolicyCapability,\n} from \"./capability\";\nimport { normalizeJson, type JsonValue } from \"./jcs\";\nimport { SignedObjectProfileError, SignedObjectSchemaError } from \"./errors\";\n\nexport const TRANSCRIPT_SHARE_BOOTSTRAP_SCHEMA =\n  \"xyz.tinycloud.exchange/transcript-bootstrap/v0\" as const;\nexport const OWNER_NODE_ENDPOINT_SCHEMA =\n  \"xyz.tinycloud.exchange/owner-node-endpoint/v1\" as const;\nexport const POLICY_VERSION_V0 = \"v0\" as const;\nexport const W3C_VC_CREDENTIAL_VERIFIER = \"w3c.vc/credential/v1\" as const;\n\nexport type PolicyAuthoringErrorCode =\n  | PolicyCapabilityError[\"code\"]\n  | \"policy-authoring-malformed\"\n  | \"policy-authoring-unknown-key\"\n  | \"policy-engine-record-absent\"\n  | \"policy-engine-record-date-invalid\"\n  | \"policy-engine-record-signature-invalid\"\n  | \"policy-engine-record-audience-mismatch\"\n  | \"policy-engine-record-expired\"\n  | \"policy-engine-record-owner-mismatch\"\n  | \"policy-engine-record-grant-issuer-mismatch\"\n  | \"policy-engine-record-policy-version-unsupported\"\n  | \"policy-engine-record-evidence-verifier-unsupported\"\n  | \"transcript-share-bootstrap-malformed\";\n\nexport class PolicyAuthoringError extends Error {\n  public readonly code: PolicyAuthoringErrorCode;\n\n  constructor(code: PolicyAuthoringErrorCode, message: string) {\n    super(message);\n    this.name = \"PolicyAuthoringError\";\n    this.code = code;\n  }\n}\n\nexport interface CreateTranscriptSharePolicyInput {\n  readonly ownerDid: string;\n  readonly signingKeyDid: string;\n  readonly createdAt: string;\n  readonly expiresAt?: string;\n  readonly resourceType: string;\n  readonly resourceId: string;\n  readonly permissionsCeiling: readonly unknown[];\n  readonly when: JsonObject;\n  readonly grant: JsonObject;\n  readonly disclosure?: JsonObject;\n  readonly audit?: JsonObject;\n}\n\nexport interface TranscriptShareBootstrap {\n  readonly schema: typeof TRANSCRIPT_SHARE_BOOTSTRAP_SCHEMA;\n  readonly policyId: string;\n  readonly policyEngine: {\n    readonly endpoint: string;\n    readonly audience: string;\n    readonly supportedEvidenceVerifiers: readonly [\n      typeof W3C_VC_CREDENTIAL_VERIFIER,\n    ];\n    readonly signedRecord: PolicyEngineRecord;\n  };\n  /** Untrusted routing hint. Authority comes only from delegation/invocation validation. */\n  readonly ownerNode: {\n    readonly schema: typeof OWNER_NODE_ENDPOINT_SCHEMA;\n    readonly endpoint: string;\n    readonly spaceId: string;\n  };\n  readonly resourceHint: JsonObject;\n}\n\nexport interface ComposeTranscriptShareBootstrapInput {\n  readonly policyId: string;\n  readonly policyEngineRecord: PolicyEngineRecord;\n  readonly ownerNodeEndpoint: string;\n  readonly ownerSpaceId: string;\n  readonly resourceHint: JsonObject;\n}\n\nexport interface CreatePolicyEngineRecordInput {\n  readonly ownerDid: string;\n  readonly endpoint: string;\n  readonly audience: string;\n  readonly grantIssuerDid: string;\n  readonly expiresAt: string;\n  readonly supportedPolicyVersions?: readonly string[];\n  readonly supportedEvidenceVerifiers?: readonly string[];\n}\n\nexport interface VerifyPolicyEngineRecordOptions {\n  readonly signedRecord: unknown;\n  readonly ownerDid: string;\n  readonly audience: string;\n  readonly grantIssuerDid: string;\n  readonly now: string;\n  readonly requiredPolicyVersion?: string;\n  readonly requiredEvidenceVerifier?: string;\n}\n\n/**\n * Author a transcript-sharing Policy from already-resolved Listen-adapter\n * PolicyCapability JSON. Manifest PermissionEntry shapes are refused here; the\n * SDK does not expand or invent permissions while signing authority-bearing\n * objects.\n */\nexport async function createAndSignTranscriptSharePolicy(\n  input: CreateTranscriptSharePolicyInput,\n  signer: SignedObjectSigner,\n): Promise<Policy> {\n  const normalized = expectObject(input, \"$\", \"policy-authoring-malformed\");\n  assertExactKeys(\n    normalized,\n    [\n      \"ownerDid\",\n      \"signingKeyDid\",\n      \"createdAt\",\n      \"expiresAt\",\n      \"resourceType\",\n      \"resourceId\",\n      \"permissionsCeiling\",\n      \"when\",\n      \"grant\",\n      \"disclosure\",\n      \"audit\",\n    ],\n    \"$\",\n  );\n  const permissions = requiredArray(normalized, \"permissionsCeiling\", \"$\");\n  if (permissions.length === 0) {\n    throw new PolicyAuthoringError(\n      \"policy-authoring-malformed\",\n      \"$.permissionsCeiling must not be empty\",\n    );\n  }\n  const ceiling: PolicyCapability[] = [];\n  for (let index = 0; index < permissions.length; index++) {\n    ceiling.push(\n      wrapCapabilityError(() => normalizePolicyCapability(permissions[index])),\n    );\n  }\n  return createAndSignPolicy(\n    {\n      schema: POLICY_SCHEMA,\n      ownerDid: requiredString(normalized, \"ownerDid\", \"$\"),\n      signingKeyDid: requiredString(normalized, \"signingKeyDid\", \"$\"),\n      createdAt: requiredString(normalized, \"createdAt\", \"$\"),\n      ...(hasOwn(normalized, \"expiresAt\")\n        ? { expiresAt: requiredString(normalized, \"expiresAt\", \"$\") }\n        : {}),\n      resource: {\n        resourceType: requiredString(normalized, \"resourceType\", \"$\"),\n        resourceId: requiredString(normalized, \"resourceId\", \"$\"),\n        permissionsCeiling: ceiling,\n      },\n      when: requiredObject(normalized, \"when\", \"$\"),\n      grant: requiredObject(normalized, \"grant\", \"$\"),\n      ...(hasOwn(normalized, \"disclosure\")\n        ? { disclosure: requiredObject(normalized, \"disclosure\", \"$\") }\n        : {}),\n      ...(hasOwn(normalized, \"audit\")\n        ? { audit: requiredObject(normalized, \"audit\", \"$\") }\n        : {}),\n    },\n    signer,\n  ).catch((error) => {\n    throw wrapSignedObjectError(error);\n  });\n}\n\nexport function createUnsignedPolicyEngineRecord(\n  input: CreatePolicyEngineRecordInput,\n): UnsignedPolicyEngineRecord {\n  const normalized = expectObject(input, \"$\", \"policy-authoring-malformed\");\n  assertExactKeys(\n    normalized,\n    [\n      \"ownerDid\",\n      \"endpoint\",\n      \"audience\",\n      \"grantIssuerDid\",\n      \"expiresAt\",\n      \"supportedPolicyVersions\",\n      \"supportedEvidenceVerifiers\",\n    ],\n    \"$\",\n  );\n  const supportedPolicyVersions = hasOwn(normalized, \"supportedPolicyVersions\")\n    ? requiredStringArray(normalized, \"supportedPolicyVersions\", \"$\")\n    : [POLICY_VERSION_V0];\n  validateSupportedPolicyVersions(\n    supportedPolicyVersions,\n    \"$.supportedPolicyVersions\",\n  );\n  const supportedEvidenceVerifiers = hasOwn(\n    normalized,\n    \"supportedEvidenceVerifiers\",\n  )\n    ? requiredStringArray(normalized, \"supportedEvidenceVerifiers\", \"$\")\n    : [W3C_VC_CREDENTIAL_VERIFIER];\n  validateSupportedEvidenceVerifiers(\n    supportedEvidenceVerifiers,\n    \"$.supportedEvidenceVerifiers\",\n  );\n  const expiresAt = fieldString(\n    normalized,\n    \"expiresAt\",\n    \"$\",\n    \"policy-engine-record-date-invalid\",\n  );\n  parseStrictRfc3339(expiresAt, \"$.expiresAt\");\n\n  return {\n    schema: POLICY_ENGINE_RECORD_SCHEMA,\n    ownerDid: requiredString(normalized, \"ownerDid\", \"$\"),\n    endpoint: validatePolicyEngineEndpoint(\n      requiredString(normalized, \"endpoint\", \"$\"),\n    ),\n    audience: requiredString(normalized, \"audience\", \"$\"),\n    supportedPolicyVersions,\n    supportedEvidenceVerifiers,\n    grantIssuerDid: requiredString(normalized, \"grantIssuerDid\", \"$\"),\n    expiresAt,\n  };\n}\n\nexport async function createAndSignRequesterPolicyEngineRecord(\n  input: CreatePolicyEngineRecordInput,\n  signer: SignedObjectSigner,\n): Promise<PolicyEngineRecord> {\n  return createAndSignPolicyEngineRecord(\n    createUnsignedPolicyEngineRecord(input),\n    signer,\n  ).catch((error) => {\n    throw wrapSignedObjectError(error);\n  });\n}\n\n/**\n * Compose the SDK-level transcript-share bootstrap record. This record is not\n * an invitation and is not authority; it only tells a requester where to ask\n * and which policy id to reference.\n */\nexport function composeTranscriptShareBootstrap(\n  input: ComposeTranscriptShareBootstrapInput,\n): TranscriptShareBootstrap {\n  const normalized = expectObject(\n    input,\n    \"$\",\n    \"transcript-share-bootstrap-malformed\",\n  );\n  assertExactKeys(\n    normalized,\n    [\n      \"policyId\",\n      \"policyEngineRecord\",\n      \"ownerNodeEndpoint\",\n      \"ownerSpaceId\",\n      \"resourceHint\",\n    ],\n    \"$\",\n  );\n  const signedRecord = expectPolicyEngineRecord(\n    requiredValue(normalized, \"policyEngineRecord\", \"$\"),\n  );\n  if (\n    !signedRecord.supportedEvidenceVerifiers.includes(\n      W3C_VC_CREDENTIAL_VERIFIER,\n    )\n  ) {\n    throw new PolicyAuthoringError(\n      \"transcript-share-bootstrap-malformed\",\n      \"policy engine record does not support the bootstrap evidence verifier\",\n    );\n  }\n  return {\n    schema: TRANSCRIPT_SHARE_BOOTSTRAP_SCHEMA,\n    policyId: requiredString(normalized, \"policyId\", \"$\"),\n    policyEngine: {\n      endpoint: signedRecord.endpoint,\n      audience: signedRecord.audience,\n      supportedEvidenceVerifiers: [W3C_VC_CREDENTIAL_VERIFIER],\n      signedRecord,\n    },\n    ownerNode: {\n      schema: OWNER_NODE_ENDPOINT_SCHEMA,\n      endpoint: validateOwnerNodeEndpoint(\n        requiredString(normalized, \"ownerNodeEndpoint\", \"$\"),\n      ),\n      spaceId: requiredString(normalized, \"ownerSpaceId\", \"$\"),\n    },\n    resourceHint: requiredObject(normalized, \"resourceHint\", \"$\"),\n  };\n}\n\nfunction validateOwnerNodeEndpoint(value: string): string {\n  let url: URL;\n  try {\n    url = new URL(value);\n  } catch {\n    throw new PolicyAuthoringError(\n      \"transcript-share-bootstrap-malformed\",\n      \"$.ownerNodeEndpoint must be a URL\",\n    );\n  }\n  if (\n    url.protocol !== \"https:\" ||\n    url.username !== \"\" ||\n    url.password !== \"\" ||\n    url.hash !== \"\" ||\n    url.search !== \"\"\n  ) {\n    throw new PolicyAuthoringError(\n      \"transcript-share-bootstrap-malformed\",\n      \"$.ownerNodeEndpoint must be an HTTPS URL without credentials, query, or fragment\",\n    );\n  }\n  return url.toString().replace(/\\/$/, \"\");\n}\n\nfunction validatePolicyEngineEndpoint(value: string): string {\n  let url: URL;\n  try {\n    url = new URL(value);\n  } catch {\n    throw new PolicyAuthoringError(\n      \"policy-authoring-malformed\",\n      \"$.endpoint must be a URL\",\n    );\n  }\n  if (\n    url.protocol !== \"https:\" ||\n    url.username !== \"\" ||\n    url.password !== \"\" ||\n    url.hash !== \"\" ||\n    url.search !== \"\"\n  ) {\n    throw new PolicyAuthoringError(\n      \"policy-authoring-malformed\",\n      \"$.endpoint must be an HTTPS URL without credentials, query, or fragment\",\n    );\n  }\n  return url.toString().replace(/\\/$/, \"\");\n}\n\n/**\n * Requester-side authentication gate for policy-engine endpoints. A requester\n * MUST NOT send credential evidence or call /resolve unless this verification\n * succeeds.\n */\nexport async function verifyPolicyEngineRecordForRequester(\n  options: VerifyPolicyEngineRecordOptions,\n): Promise<PolicyEngineRecord> {\n  const normalized = expectObject(options, \"$\", \"policy-authoring-malformed\");\n  assertExactKeys(\n    normalized,\n    [\n      \"signedRecord\",\n      \"ownerDid\",\n      \"audience\",\n      \"grantIssuerDid\",\n      \"now\",\n      \"requiredPolicyVersion\",\n      \"requiredEvidenceVerifier\",\n    ],\n    \"$\",\n  );\n  if (!hasOwn(normalized, \"signedRecord\")) {\n    throw new PolicyAuthoringError(\n      \"policy-engine-record-absent\",\n      \"$.signedRecord must be present\",\n    );\n  }\n  const signedRecord = normalized[\"signedRecord\"];\n  if (\n    signedRecord === null ||\n    typeof signedRecord !== \"object\" ||\n    Array.isArray(signedRecord)\n  ) {\n    throw new PolicyAuthoringError(\n      \"policy-engine-record-absent\",\n      \"$.signedRecord must be present\",\n    );\n  }\n  const recordObject = signedRecord as JsonObject;\n  const expiresAt = fieldString(\n    recordObject,\n    \"expiresAt\",\n    \"$.signedRecord\",\n    \"policy-engine-record-date-invalid\",\n  );\n  const now = fieldString(\n    normalized,\n    \"now\",\n    \"$\",\n    \"policy-engine-record-date-invalid\",\n  );\n  const expiresMs = parseStrictRfc3339(expiresAt, \"$.signedRecord.expiresAt\");\n  const nowMs = parseStrictRfc3339(now, \"$.now\");\n  if (expiresMs <= nowMs) {\n    throw new PolicyAuthoringError(\n      \"policy-engine-record-expired\",\n      \"$.signedRecord.expiresAt is expired\",\n    );\n  }\n\n  let verified: PolicyEngineRecord;\n  try {\n    verified = (await verifyPolicyEngineRecord(recordObject)).object;\n  } catch (error) {\n    throw new PolicyAuthoringError(\n      \"policy-engine-record-signature-invalid\",\n      error instanceof Error ? error.message : String(error),\n    );\n  }\n  if (verified.signature.signerDid !== verified.ownerDid) {\n    throw new PolicyAuthoringError(\n      \"policy-engine-record-signature-invalid\",\n      \"$.signedRecord.signature.signerDid must match ownerDid for the direct-owner requester profile\",\n    );\n  }\n\n  const expectedOwnerDid = requiredString(normalized, \"ownerDid\", \"$\");\n  if (verified.ownerDid !== expectedOwnerDid) {\n    throw new PolicyAuthoringError(\n      \"policy-engine-record-owner-mismatch\",\n      \"$.signedRecord.ownerDid does not match\",\n    );\n  }\n  const expectedAudience = requiredString(normalized, \"audience\", \"$\");\n  if (verified.audience !== expectedAudience) {\n    throw new PolicyAuthoringError(\n      \"policy-engine-record-audience-mismatch\",\n      \"$.signedRecord.audience does not match\",\n    );\n  }\n  const expectedGrantIssuerDid = requiredString(\n    normalized,\n    \"grantIssuerDid\",\n    \"$\",\n  );\n  if (verified.grantIssuerDid !== expectedGrantIssuerDid) {\n    throw new PolicyAuthoringError(\n      \"policy-engine-record-grant-issuer-mismatch\",\n      \"$.signedRecord.grantIssuerDid does not match\",\n    );\n  }\n  const requiredPolicyVersion = hasOwn(normalized, \"requiredPolicyVersion\")\n    ? requiredString(normalized, \"requiredPolicyVersion\", \"$\")\n    : POLICY_VERSION_V0;\n  if (!verified.supportedPolicyVersions.includes(requiredPolicyVersion)) {\n    throw new PolicyAuthoringError(\n      \"policy-engine-record-policy-version-unsupported\",\n      \"$.signedRecord.supportedPolicyVersions does not include the required version\",\n    );\n  }\n  const requiredEvidenceVerifier = hasOwn(\n    normalized,\n    \"requiredEvidenceVerifier\",\n  )\n    ? requiredString(normalized, \"requiredEvidenceVerifier\", \"$\")\n    : W3C_VC_CREDENTIAL_VERIFIER;\n  if (!verified.supportedEvidenceVerifiers.includes(requiredEvidenceVerifier)) {\n    throw new PolicyAuthoringError(\n      \"policy-engine-record-evidence-verifier-unsupported\",\n      \"$.signedRecord.supportedEvidenceVerifiers does not include the required verifier\",\n    );\n  }\n  return verified;\n}\n\nfunction expectObject(\n  input: unknown,\n  path: string,\n  code: PolicyAuthoringErrorCode,\n): JsonObject {\n  try {\n    const normalized = normalizeJson(input);\n    if (\n      normalized === null ||\n      typeof normalized !== \"object\" ||\n      Array.isArray(normalized)\n    ) {\n      throw new PolicyAuthoringError(code, `${path} must be an object`);\n    }\n    return normalized as JsonObject;\n  } catch (error) {\n    if (error instanceof PolicyAuthoringError) {\n      throw error;\n    }\n    throw new PolicyAuthoringError(\n      code,\n      error instanceof Error ? error.message : String(error),\n    );\n  }\n}\n\nfunction expectPolicyEngineRecord(input: JsonValue): PolicyEngineRecord {\n  if (input === null || typeof input !== \"object\" || Array.isArray(input)) {\n    throw new PolicyAuthoringError(\n      \"transcript-share-bootstrap-malformed\",\n      \"$.policyEngineRecord must be an object\",\n    );\n  }\n  try {\n    return validatePolicyEngineRecordSignedShape(input);\n  } catch (error) {\n    throw new PolicyAuthoringError(\n      \"transcript-share-bootstrap-malformed\",\n      error instanceof Error ? error.message : String(error),\n    );\n  }\n}\n\nfunction assertExactKeys(\n  object: JsonObject,\n  allowed: readonly string[],\n  path: string,\n): void {\n  const allowedSet = new Set(allowed);\n  for (const key of Object.keys(object)) {\n    if (!allowedSet.has(key)) {\n      throw new PolicyAuthoringError(\n        \"policy-authoring-unknown-key\",\n        `${path} has unknown field ${key}`,\n      );\n    }\n  }\n}\n\nfunction requiredValue(\n  object: JsonObject,\n  key: string,\n  path: string,\n): JsonValue {\n  if (!hasOwn(object, key)) {\n    throw new PolicyAuthoringError(\n      \"policy-authoring-malformed\",\n      `${path}.${key} is required`,\n    );\n  }\n  return object[key];\n}\n\nfunction requiredString(object: JsonObject, key: string, path: string): string {\n  const value = requiredValue(object, key, path);\n  if (typeof value !== \"string\" || value.length === 0) {\n    throw new PolicyAuthoringError(\n      \"policy-authoring-malformed\",\n      `${path}.${key} must be a non-empty string`,\n    );\n  }\n  return value;\n}\n\nfunction fieldString(\n  object: JsonObject,\n  key: string,\n  path: string,\n  code: PolicyAuthoringErrorCode,\n): string {\n  if (!hasOwn(object, key)) {\n    throw new PolicyAuthoringError(code, `${path}.${key} is required`);\n  }\n  const value = object[key];\n  if (typeof value !== \"string\" || value.length === 0) {\n    throw new PolicyAuthoringError(\n      code,\n      `${path}.${key} must be a non-empty string`,\n    );\n  }\n  return value;\n}\n\nfunction requiredObject(\n  object: JsonObject,\n  key: string,\n  path: string,\n): JsonObject {\n  const value = requiredValue(object, key, path);\n  if (value === null || typeof value !== \"object\" || Array.isArray(value)) {\n    throw new PolicyAuthoringError(\n      \"policy-authoring-malformed\",\n      `${path}.${key} must be an object`,\n    );\n  }\n  return value as JsonObject;\n}\n\nfunction requiredArray(\n  object: JsonObject,\n  key: string,\n  path: string,\n): readonly JsonValue[] {\n  const value = requiredValue(object, key, path);\n  if (!Array.isArray(value)) {\n    throw new PolicyAuthoringError(\n      \"policy-authoring-malformed\",\n      `${path}.${key} must be an array`,\n    );\n  }\n  return value;\n}\n\nfunction requiredStringArray(\n  object: JsonObject,\n  key: string,\n  path: string,\n): string[] {\n  const values = requiredArray(object, key, path);\n  return values.map((value, index) => {\n    if (typeof value !== \"string\" || value.length === 0) {\n      throw new PolicyAuthoringError(\n        \"policy-authoring-malformed\",\n        `${path}.${key}[${index}] must be a non-empty string`,\n      );\n    }\n    return value;\n  });\n}\n\nfunction validateSupportedPolicyVersions(\n  values: readonly string[],\n  path: string,\n): void {\n  if (values.length === 0) {\n    throw new PolicyAuthoringError(\n      \"policy-authoring-malformed\",\n      `${path} must not be empty`,\n    );\n  }\n  for (let index = 0; index < values.length; index++) {\n    if (values[index] !== POLICY_VERSION_V0) {\n      throw new PolicyAuthoringError(\n        \"policy-authoring-malformed\",\n        `${path}[${index}] is unsupported`,\n      );\n    }\n  }\n}\n\nfunction validateSupportedEvidenceVerifiers(\n  values: readonly string[],\n  path: string,\n): void {\n  if (values.length === 0) {\n    throw new PolicyAuthoringError(\n      \"policy-authoring-malformed\",\n      `${path} must not be empty`,\n    );\n  }\n  for (let index = 0; index < values.length; index++) {\n    if (values[index] !== W3C_VC_CREDENTIAL_VERIFIER) {\n      throw new PolicyAuthoringError(\n        \"policy-authoring-malformed\",\n        `${path}[${index}] is unsupported`,\n      );\n    }\n  }\n}\n\nfunction wrapCapabilityError<T>(fn: () => T): T {\n  try {\n    return fn();\n  } catch (error) {\n    if (error instanceof PolicyCapabilityError) {\n      throw new PolicyAuthoringError(error.code, error.message);\n    }\n    throw error;\n  }\n}\n\nfunction wrapSignedObjectError(error: unknown): Error {\n  if (error instanceof PolicyAuthoringError) {\n    return error;\n  }\n  if (\n    error instanceof SignedObjectSchemaError ||\n    error instanceof SignedObjectProfileError\n  ) {\n    return new PolicyAuthoringError(\n      \"policy-authoring-malformed\",\n      error.message,\n    );\n  }\n  return new PolicyAuthoringError(\n    \"policy-authoring-malformed\",\n    error instanceof Error ? error.message : String(error),\n  );\n}\n\nfunction parseStrictRfc3339(value: string, path: string): number {\n  const match = value.match(\n    /^(\\d{4})-(\\d{2})-(\\d{2})T(\\d{2}):(\\d{2}):(\\d{2})(\\.\\d+)?Z$/,\n  );\n  if (!match) {\n    throw new PolicyAuthoringError(\n      \"policy-engine-record-date-invalid\",\n      `${path} must be strict RFC 3339`,\n    );\n  }\n  const parsed = Date.parse(value);\n  if (Number.isNaN(parsed)) {\n    throw new PolicyAuthoringError(\n      \"policy-engine-record-date-invalid\",\n      `${path} must be parseable`,\n    );\n  }\n  const canonical = new Date(parsed).toISOString().replace(\".000Z\", \"Z\");\n  if (canonical !== value) {\n    throw new PolicyAuthoringError(\n      \"policy-engine-record-date-invalid\",\n      `${path} must be normalizable`,\n    );\n  }\n  return parsed;\n}\n\nconst objectHasOwn: (object: object, propertyKey: PropertyKey) => boolean =\n  (\n    Object as ObjectConstructor & {\n      hasOwn?: (object: object, propertyKey: PropertyKey) => boolean;\n    }\n  ).hasOwn ??\n  (Object.prototype.hasOwnProperty.call.bind(\n    Object.prototype.hasOwnProperty,\n  ) as (object: object, propertyKey: PropertyKey) => boolean);\n\nfunction hasOwn(object: JsonObject, key: string): boolean {\n  return objectHasOwn(object, key);\n}\n"],"mappings":";;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,IAAAA,eAAmC;AACnC,oBAAuB;;;ACDvB;;;;;;;;;;;;;;ACAO,IAAM,QAAQ,IAAI,WAAW,CAAC;AAW/B,SAAU,OAAQ,IAAgB,IAAc;AACpD,MAAI,OAAO,IAAI;AAAE,WAAO;EAAK;AAC7B,MAAI,GAAG,eAAe,GAAG,YAAY;AACnC,WAAO;EACT;AAEA,WAAS,KAAK,GAAG,KAAK,GAAG,YAAY,MAAM;AACzC,QAAI,GAAG,EAAE,MAAM,GAAG,EAAE,GAAG;AACrB,aAAO;IACT;EACF;AAEA,SAAO;AACT;AAEM,SAAU,OAAQ,GAA6C;AACnE,MAAI,aAAa,cAAc,EAAE,YAAY,SAAS,cAAc;AAAE,WAAO;EAAE;AAC/E,MAAI,aAAa,aAAa;AAAE,WAAO,IAAI,WAAW,CAAC;EAAE;AACzD,MAAI,YAAY,OAAO,CAAC,GAAG;AACzB,WAAO,IAAI,WAAW,EAAE,QAAQ,EAAE,YAAY,EAAE,UAAU;EAC5D;AACA,QAAM,IAAI,MAAM,mCAAmC;AACrD;AAMM,SAAU,WAAY,KAAW;AACrC,SAAO,IAAI,YAAW,EAAG,OAAO,GAAG;AACrC;AAEM,SAAU,SAAU,GAAa;AACrC,SAAO,IAAI,YAAW,EAAG,OAAO,CAAC;AACnC;;;ACnCA,SAAS,KAAM,UAAUC,OAAI;AAC3B,MAAI,SAAS,UAAU,KAAK;AAAE,UAAM,IAAI,UAAU,mBAAmB;EAAE;AACvE,MAAI,WAAW,IAAI,WAAW,GAAG;AACjC,WAAS,IAAI,GAAG,IAAI,SAAS,QAAQ,KAAK;AACxC,aAAS,CAAC,IAAI;EAChB;AACA,WAAS,IAAI,GAAG,IAAI,SAAS,QAAQ,KAAK;AACxC,QAAI,IAAI,SAAS,OAAO,CAAC;AACzB,QAAI,KAAK,EAAE,WAAW,CAAC;AACvB,QAAI,SAAS,EAAE,MAAM,KAAK;AAAE,YAAM,IAAI,UAAU,IAAI,eAAe;IAAE;AACrE,aAAS,EAAE,IAAI;EACjB;AACA,MAAI,OAAO,SAAS;AACpB,MAAI,SAAS,SAAS,OAAO,CAAC;AAC9B,MAAI,SAAS,KAAK,IAAI,IAAI,IAAI,KAAK,IAAI,GAAG;AAC1C,MAAI,UAAU,KAAK,IAAI,GAAG,IAAI,KAAK,IAAI,IAAI;AAI3C,WAASC,QAAQ,QAAM;AAErB,QAAI,kBAAkB;AAAY;aAAW,YAAY,OAAO,MAAM,GAAG;AACvE,eAAS,IAAI,WAAW,OAAO,QAAQ,OAAO,YAAY,OAAO,UAAU;IAC7E,WAAW,MAAM,QAAQ,MAAM,GAAG;AAChC,eAAS,WAAW,KAAK,MAAM;IACjC;AACA,QAAI,EAAE,kBAAkB,aAAa;AAAE,YAAM,IAAI,UAAU,qBAAqB;IAAE;AAClF,QAAI,OAAO,WAAW,GAAG;AAAE,aAAO;IAAG;AAErC,QAAI,SAAS;AACb,QAAIC,UAAS;AACb,QAAI,SAAS;AACb,QAAI,OAAO,OAAO;AAClB,WAAO,WAAW,QAAQ,OAAO,MAAM,MAAM,GAAG;AAC9C;AACA;IACF;AAEA,QAAI,QAAS,OAAO,UAAU,UAAU,MAAO;AAC/C,QAAI,MAAM,IAAI,WAAW,IAAI;AAE7B,WAAO,WAAW,MAAM;AACtB,UAAI,QAAQ,OAAO,MAAM;AAEzB,UAAIC,KAAI;AACR,eAAS,MAAM,OAAO,IAAI,UAAU,KAAKA,KAAID,YAAY,QAAQ,IAAK,OAAOC,MAAK;AAChF,iBAAU,MAAM,IAAI,GAAG,MAAO;AAC9B,YAAI,GAAG,IAAK,QAAQ,SAAU;AAC9B,gBAAS,QAAQ,SAAU;MAC7B;AACA,UAAI,UAAU,GAAG;AAAE,cAAM,IAAI,MAAM,gBAAgB;MAAE;AACrD,MAAAD,UAASC;AACT;IACF;AAEA,QAAI,MAAM,OAAOD;AACjB,WAAO,QAAQ,QAAQ,IAAI,GAAG,MAAM,GAAG;AACrC;IACF;AAEA,QAAI,MAAM,OAAO,OAAO,MAAM;AAC9B,WAAO,MAAM,MAAM,EAAE,KAAK;AAAE,aAAO,SAAS,OAAO,IAAI,GAAG,CAAC;IAAG;AAC9D,WAAO;EACT;AAIA,WAAS,aAAc,QAAM;AAC3B,QAAI,OAAO,WAAW,UAAU;AAAE,YAAM,IAAI,UAAU,iBAAiB;IAAE;AACzE,QAAI,OAAO,WAAW,GAAG;AAAE,aAAO,IAAI,WAAU;IAAG;AACnD,QAAI,MAAM;AAEV,QAAI,OAAO,GAAG,MAAM,KAAK;AAAE;IAAO;AAElC,QAAI,SAAS;AACb,QAAIA,UAAS;AACb,WAAO,OAAO,GAAG,MAAM,QAAQ;AAC7B;AACA;IACF;AAEA,QAAI,QAAU,OAAO,SAAS,OAAO,SAAU,MAAO;AACtD,QAAI,OAAO,IAAI,WAAW,IAAI;AAE9B,WAAO,OAAO,GAAG,GAAG;AAElB,UAAI,QAAQ,SAAS,OAAO,WAAW,GAAG,CAAC;AAE3C,UAAI,UAAU,KAAK;AAAE;MAAO;AAC5B,UAAIC,KAAI;AACR,eAAS,MAAM,OAAO,IAAI,UAAU,KAAKA,KAAID,YAAY,QAAQ,IAAK,OAAOC,MAAK;AAChF,iBAAU,OAAO,KAAK,GAAG,MAAO;AAChC,aAAK,GAAG,IAAK,QAAQ,QAAS;AAC9B,gBAAS,QAAQ,QAAS;MAC5B;AACA,UAAI,UAAU,GAAG;AAAE,cAAM,IAAI,MAAM,gBAAgB;MAAE;AACrD,MAAAD,UAASC;AACT;IACF;AAEA,QAAI,OAAO,GAAG,MAAM,KAAK;AAAE;IAAO;AAElC,QAAI,MAAM,OAAOD;AACjB,WAAO,QAAQ,QAAQ,KAAK,GAAG,MAAM,GAAG;AACtC;IACF;AACA,QAAI,MAAM,IAAI,WAAW,UAAU,OAAO,IAAI;AAC9C,QAAIE,KAAI;AACR,WAAO,QAAQ,MAAM;AACnB,UAAIA,IAAG,IAAI,KAAK,KAAK;IACvB;AACA,WAAO;EACT;AAIA,WAASC,QAAQ,QAAM;AACrB,QAAI,SAAS,aAAa,MAAM;AAChC,QAAI,QAAQ;AAAE,aAAO;IAAO;AAC5B,UAAM,IAAI,MAAM,OAAOL,KAAI,YAAY;EACzC;AACA,SAAO;IACL,QAAQC;IACR;IACA,QAAQI;;AAEZ;AACA,IAAI,MAAM;AAEV,IAAI,kCAAkC;AAEtC,IAAA,iBAAe;;;ACjIf,IAAM,UAAN,MAAa;EAKX,YAAaC,OAAY,QAAgB,YAAoB;AAJpD;AACA;AACA;AAGP,SAAK,OAAOA;AACZ,SAAK,SAAS;AACd,SAAK,aAAa;EACpB;EAEA,OAAQ,OAAiB;AACvB,QAAI,iBAAiB,YAAY;AAC/B,aAAO,GAAG,KAAK,MAAM,GAAG,KAAK,WAAW,KAAK,CAAC;IAChD,OAAO;AACL,YAAM,MAAM,mCAAmC;IACjD;EACF;;AAQF,IAAM,UAAN,MAAa;EAMX,YAAaA,OAAY,QAAgB,YAAoB;AALpD;AACA;AACA;AACQ;AAGf,SAAK,OAAOA;AACZ,SAAK,SAAS;AACd,UAAM,kBAAkB,OAAO,YAAY,CAAC;AAE5C,QAAI,oBAAoB,QAAW;AACjC,YAAM,IAAI,MAAM,0BAA0B;IAC5C;AACA,SAAK,kBAAkB;AACvB,SAAK,aAAa;EACpB;EAEA,OAAQ,MAAY;AAClB,QAAI,OAAO,SAAS,UAAU;AAC5B,UAAI,KAAK,YAAY,CAAC,MAAM,KAAK,iBAAiB;AAChD,cAAM,MAAM,qCAAqC,KAAK,UAAU,IAAI,CAAC,KAAK,KAAK,IAAI,+CAA+C,KAAK,MAAM,EAAE;MACjJ;AACA,aAAO,KAAK,WAAW,KAAK,MAAM,KAAK,OAAO,MAAM,CAAC;IACvD,OAAO;AACL,YAAM,MAAM,mCAAmC;IACjD;EACF;EAEA,GAAgC,SAAmE;AACjG,WAAO,GAAG,MAAM,OAAO;EACzB;;AAKF,IAAM,kBAAN,MAAqB;EAGnB,YAAa,UAA0B;AAF9B;AAGP,SAAK,WAAW;EAClB;EAEA,GAAiC,SAAmE;AAClG,WAAO,GAAG,MAAM,OAAO;EACzB;EAEA,OAAQ,OAAa;AACnB,UAAM,SAAS,MAAM,CAAC;AACtB,UAAM,UAAU,KAAK,SAAS,MAAM;AACpC,QAAI,WAAW,MAAM;AACnB,aAAO,QAAQ,OAAO,KAAK;IAC7B,OAAO;AACL,YAAM,WAAW,qCAAqC,KAAK,UAAU,KAAK,CAAC,+BAA+B,OAAO,KAAK,KAAK,QAAQ,CAAC,gBAAgB;IACtJ;EACF;;AAGI,SAAU,GAAyC,MAA+C,OAA8C;AACpJ,SAAO,IAAI,gBAAgB;IACzB,GAAI,KAAK,YAAY,EAAE,CAAE,KAA2B,MAAM,GAAG,KAAI;IACjE,GAAI,MAAM,YAAY,EAAE,CAAE,MAA4B,MAAM,GAAG,MAAK;GAClD;AACtB;AAEM,IAAO,QAAP,MAAY;EAQhB,YAAaA,OAAY,QAAgB,YAAsB,YAAoB;AAP1E;AACA;AACA;AACA;AACA;AACA;AAGP,SAAK,OAAOA;AACZ,SAAK,SAAS;AACd,SAAK,aAAa;AAClB,SAAK,aAAa;AAClB,SAAK,UAAU,IAAI,QAAQA,OAAM,QAAQ,UAAU;AACnD,SAAK,UAAU,IAAI,QAAQA,OAAM,QAAQ,UAAU;EACrD;EAEA,OAAQ,OAAiB;AACvB,WAAO,KAAK,QAAQ,OAAO,KAAK;EAClC;EAEA,OAAQ,OAAa;AACnB,WAAO,KAAK,QAAQ,OAAO,KAAK;EAClC;;AAGI,SAAU,KAAmD,EAAE,MAAAA,OAAM,QAAQ,QAAAC,SAAQ,QAAAC,QAAM,GAAsE;AACrK,SAAO,IAAI,MAAMF,OAAM,QAAQC,SAAQC,OAAM;AAC/C;AAEM,SAAU,MAAoD,EAAE,MAAAF,OAAM,QAAQ,UAAAG,UAAQ,GAAoD;AAC9I,QAAM,EAAE,QAAAF,SAAQ,QAAAC,QAAM,IAAK,eAAMC,WAAUH,KAAI;AAC/C,SAAO,KAAK;IACV;IACA,MAAAA;IACA,QAAAC;IACA,QAAQ,CAAC,SAA6B,OAAOC,QAAO,IAAI,CAAC;GAC1D;AACH;AAEA,SAAS,OAAQ,QAAgB,aAAqC,aAAqBF,OAAY;AAErG,MAAI,MAAM,OAAO;AACjB,SAAO,OAAO,MAAM,CAAC,MAAM,KAAK;AAC9B,MAAE;EACJ;AAGA,QAAM,MAAM,IAAI,WAAY,MAAM,cAAc,IAAK,CAAC;AAGtD,MAAI,OAAO;AACX,MAAI,SAAS;AACb,MAAI,UAAU;AACd,WAAS,IAAI,GAAG,IAAI,KAAK,EAAE,GAAG;AAE5B,UAAM,QAAQ,YAAY,OAAO,CAAC,CAAC;AACnC,QAAI,UAAU,QAAW;AACvB,YAAM,IAAI,YAAY,OAAOA,KAAI,YAAY;IAC/C;AAGA,aAAU,UAAU,cAAe;AACnC,YAAQ;AAGR,QAAI,QAAQ,GAAG;AACb,cAAQ;AACR,UAAI,SAAS,IAAI,MAAQ,UAAU;IACrC;EACF;AAGA,MAAI,QAAQ,gBAAgB,MAAQ,UAAW,IAAI,UAAY,GAAG;AAChE,UAAM,IAAI,YAAY,wBAAwB;EAChD;AAEA,SAAO;AACT;AAEA,SAAS,OAAQ,MAAkBG,WAAkB,aAAmB;AACtE,QAAM,MAAMA,UAASA,UAAS,SAAS,CAAC,MAAM;AAC9C,QAAM,QAAQ,KAAK,eAAe;AAClC,MAAI,MAAM;AAEV,MAAI,OAAO;AACX,MAAI,SAAS;AACb,WAAS,IAAI,GAAG,IAAI,KAAK,QAAQ,EAAE,GAAG;AAEpC,aAAU,UAAU,IAAK,KAAK,CAAC;AAC/B,YAAQ;AAGR,WAAO,OAAO,aAAa;AACzB,cAAQ;AACR,aAAOA,UAAS,OAAQ,UAAU,IAAK;IACzC;EACF;AAGA,MAAI,SAAS,GAAG;AACd,WAAOA,UAAS,OAAQ,UAAW,cAAc,IAAM;EACzD;AAGA,MAAI,KAAK;AACP,YAAS,IAAI,SAAS,cAAe,OAAO,GAAG;AAC7C,aAAO;IACT;EACF;AAEA,SAAO;AACT;AAEA,SAAS,kBAAmBA,WAAgB;AAE1C,QAAM,cAAsC,CAAA;AAC5C,WAAS,IAAI,GAAG,IAAIA,UAAS,QAAQ,EAAE,GAAG;AACxC,gBAAYA,UAAS,CAAC,CAAC,IAAI;EAC7B;AACA,SAAO;AACT;AAKM,SAAU,QAAsD,EAAE,MAAAH,OAAM,QAAQ,aAAa,UAAAG,UAAQ,GAAyE;AAClL,QAAM,cAAc,kBAAkBA,SAAQ;AAC9C,SAAO,KAAK;IACV;IACA,MAAAH;IACA,OAAQ,OAAiB;AACvB,aAAO,OAAO,OAAOG,WAAU,WAAW;IAC5C;IACA,OAAQ,OAAa;AACnB,aAAO,OAAO,OAAO,aAAa,aAAaH,KAAI;IACrD;GACD;AACH;;;AH9OO,IAAM,SAAS,QAAQ;EAC5B,QAAQ;EACR,MAAM;EACN,UAAU;EACV,aAAa;CACd;AAEM,IAAM,cAAc,QAAQ;EACjC,QAAQ;EACR,MAAM;EACN,UAAU;EACV,aAAa;CACd;AAEM,IAAM,YAAY,QAAQ;EAC/B,QAAQ;EACR,MAAM;EACN,UAAU;EACV,aAAa;CACd;AAEM,IAAM,iBAAiB,QAAQ;EACpC,QAAQ;EACR,MAAM;EACN,UAAU;EACV,aAAa;CACd;AAEM,IAAM,YAAY,QAAQ;EAC/B,QAAQ;EACR,MAAM;EACN,UAAU;EACV,aAAa;CACd;AAEM,IAAM,iBAAiB,QAAQ;EACpC,QAAQ;EACR,MAAM;EACN,UAAU;EACV,aAAa;CACd;AAEM,IAAM,eAAe,QAAQ;EAClC,QAAQ;EACR,MAAM;EACN,UAAU;EACV,aAAa;CACd;AAEM,IAAM,oBAAoB,QAAQ;EACvC,QAAQ;EACR,MAAM;EACN,UAAU;EACV,aAAa;CACd;AAEM,IAAM,UAAU,QAAQ;EAC7B,QAAQ;EACR,MAAM;EACN,UAAU;EACV,aAAa;CACd;;;AI/DD;;;;;AAEO,IAAM,SAAS,MAAM;EAC1B,QAAQ;EACR,MAAM;EACN,UAAU;CACX;AAEM,IAAM,cAAc,MAAM;EAC/B,QAAQ;EACR,MAAM;EACN,UAAU;CACX;;;ACZD;;;;;AAEO,IAAM,YAAY,MAAM;EAC7B,MAAM;EACN,QAAQ;EACR,UAAU;CACX;AAEM,IAAM,eAAe,MAAM;EAChC,MAAM;EACN,QAAQ;EACR,UAAU;CACX;;;ACXD,IAAI,WAAWI;AAEf,IAAI,MAAM;AAAV,IACI,OAAO;AADX,IAEI,SAAS,CAAC;AAFd,IAGI,MAAM,KAAK,IAAI,GAAG,EAAE;AAOxB,SAASA,QAAO,KAAK,KAAK,QAAM;AAC9B,QAAM,OAAO,CAAA;AACb,WAAS,UAAU;AACnB,MAAI,YAAY;AAEhB,SAAM,OAAO,KAAK;AAChB,QAAI,QAAQ,IAAK,MAAM,MAAQ;AAC/B,WAAO;EACT;AACA,SAAM,MAAM,QAAQ;AAClB,QAAI,QAAQ,IAAK,MAAM,MAAQ;AAC/B,aAAS;EACX;AACA,MAAI,MAAM,IAAI,MAAM;AAGpB,EAAAA,QAAO,QAAQ,SAAS,YAAY;AAEpC,SAAO;AACT;AAEA,IAAIC,UAAS;AAEb,IAAI,QAAQ;AAAZ,IACI,SAAS;AAMb,SAAS,KAAK,KAAK,QAAM;AACvB,MAAI,MAAS,GACT,SAAS,UAAU,GACnB,QAAS,GACT,UAAU,QACV,GACA,IAAI,IAAI;AAEZ,KAAG;AACD,QAAI,WAAW,GAAG;AAEhB,WAAK,QAAQ;AACb,YAAM,IAAI,WAAW,yBAAyB;IAChD;AACA,QAAI,IAAI,SAAS;AACjB,WAAO,QAAQ,MACV,IAAI,WAAW,SACf,IAAI,UAAU,KAAK,IAAI,GAAG,KAAK;AACpC,aAAS;EACX,SAAS,KAAK;AAGd,OAAK,QAAQ,UAAU;AAEvB,SAAO;AACT;AAEA,IAAI,KAAK,KAAK,IAAI,GAAI,CAAC;AACvB,IAAI,KAAK,KAAK,IAAI,GAAG,EAAE;AACvB,IAAI,KAAK,KAAK,IAAI,GAAG,EAAE;AACvB,IAAI,KAAK,KAAK,IAAI,GAAG,EAAE;AACvB,IAAI,KAAK,KAAK,IAAI,GAAG,EAAE;AACvB,IAAI,KAAK,KAAK,IAAI,GAAG,EAAE;AACvB,IAAI,KAAK,KAAK,IAAI,GAAG,EAAE;AACvB,IAAI,KAAK,KAAK,IAAI,GAAG,EAAE;AACvB,IAAI,KAAK,KAAK,IAAI,GAAG,EAAE;AAEvB,IAAI,SAAS,SAAgC,OAAK;AAChD,SACE,QAAQ,KAAK,IACb,QAAQ,KAAK,IACb,QAAQ,KAAK,IACb,QAAQ,KAAK,IACb,QAAQ,KAAK,IACb,QAAQ,KAAK,IACb,QAAQ,KAAK,IACb,QAAQ,KAAK,IACb,QAAQ,KAAK,IACA;AAEjB;AAEA,IAAI,SAAS;EACT,QAAQ;EACR,QAAQA;EACR,gBAAgB;;AAGpB,IAAI,eAAe;AAEnB,IAAA,iBAAe;;;ACrGT,SAAUC,QAAQ,MAAkB,SAAS,GAAC;AAClD,QAAMC,QAAO,eAAO,OAAO,MAAM,MAAM;AACvC,SAAO,CAACA,OAAM,eAAO,OAAO,KAAK;AACnC;AAEM,SAAU,SAAU,KAAa,QAAoB,SAAS,GAAC;AACnE,iBAAO,OAAO,KAAK,QAAQ,MAAM;AACjC,SAAO;AACT;AAEM,SAAU,eAAgB,KAAW;AACzC,SAAO,eAAO,eAAe,GAAG;AAClC;;;ACPM,SAAU,OAA8BC,OAAYC,SAAkB;AAC1E,QAAM,OAAOA,QAAO;AACpB,QAAM,aAAoB,eAAeD,KAAI;AAC7C,QAAM,eAAe,aAAoB,eAAe,IAAI;AAE5D,QAAM,QAAQ,IAAI,WAAW,eAAe,IAAI;AAChD,EAAO,SAASA,OAAM,OAAO,CAAC;AAC9B,EAAO,SAAS,MAAM,OAAO,UAAU;AACvC,QAAM,IAAIC,SAAQ,YAAY;AAE9B,SAAO,IAAI,OAAOD,OAAM,MAAMC,SAAQ,KAAK;AAC7C;AAKM,SAAUC,QAAQ,WAAqB;AAC3C,QAAM,QAAQ,OAAO,SAAS;AAC9B,QAAM,CAACF,OAAM,UAAU,IAAWE,QAAO,KAAK;AAC9C,QAAM,CAAC,MAAM,YAAY,IAAWA,QAAO,MAAM,SAAS,UAAU,CAAC;AACrE,QAAMD,UAAS,MAAM,SAAS,aAAa,YAAY;AAEvD,MAAIA,QAAO,eAAe,MAAM;AAC9B,UAAM,IAAI,MAAM,kBAAkB;EACpC;AAEA,SAAO,IAAI,OAAOD,OAAM,MAAMC,SAAQ,KAAK;AAC7C;AAEM,SAAUE,QAAQ,GAAoB,GAAU;AACpD,MAAI,MAAM,GAAG;AACX,WAAO;EACT,OAAO;AACL,UAAM,OAAO;AAEb,WACE,EAAE,SAAS,KAAK,QAChB,EAAE,SAAS,KAAK,QAChB,KAAK,iBAAiB,cACtB,OAAW,EAAE,OAAO,KAAK,KAAK;EAElC;AACF;AAMM,IAAO,SAAP,MAAa;;;;EASjB,YAAaH,OAAY,MAAYC,SAAoB,OAAiB;AARjE;AACA;AACA;AACA;AAMP,SAAK,OAAOD;AACZ,SAAK,OAAO;AACZ,SAAK,SAASC;AACd,SAAK,QAAQ;EACf;;;;AC1DI,SAAU,OAA0F,MAASG,OAAmC;AACpJ,QAAM,EAAE,OAAO,QAAO,IAAK;AAC3B,UAAQ,SAAS;IACf,KAAK;AACH,aAAO,WACL,OACA,UAAU,IAAI,GACdA,SAAqC,UAAU,OAAO;IAE1D;AACE,aAAO,WACL,OACA,UAAU,IAAI,GACbA,SAAQ,OAAO,OAAwC;EAE9D;AACF;AAYA,IAAM,QAAQ,oBAAI,QAAO;AAEzB,SAAS,UAAW,KAAoB;AACtC,QAAMC,aAAY,MAAM,IAAI,GAAG;AAC/B,MAAIA,cAAa,MAAM;AACrB,UAAMA,aAAY,oBAAI,IAAG;AACzB,UAAM,IAAI,KAAKA,UAAS;AACxB,WAAOA;EACT;AACA,SAAOA;AACT;AAjDA;AAmDM,IAAO,MAAP,MAAO,KAAG;;;;;;EAYd,YAAa,SAAkBC,OAAc,WAAqC,OAAiB;AAX1F;AACA;AACA;AACA;AACA;AAmHA,wBAAC,IAAsB;AA3G9B,SAAK,OAAOA;AACZ,SAAK,UAAU;AACf,SAAK,YAAY;AACjB,SAAK,QAAQ;AAIb,SAAK,GAAG,IAAI;EACd;;;;;;;EAQA,IAAI,QAAK;AACP,WAAO;EACT;;EAGA,IAAI,aAAU;AACZ,WAAO,KAAK,MAAM;EACpB;;EAGA,IAAI,aAAU;AACZ,WAAO,KAAK,MAAM;EACpB;EAEA,OAAI;AACF,YAAQ,KAAK,SAAS;MACpB,KAAK,GAAG;AACN,eAAO;MACT;MACA,KAAK,GAAG;AACN,cAAM,EAAE,MAAAA,OAAM,UAAS,IAAK;AAE5B,YAAIA,UAAS,aAAa;AACxB,gBAAM,IAAI,MAAM,0CAA0C;QAC5D;AAGA,YAAI,UAAU,SAAS,cAAc;AACnC,gBAAM,IAAI,MAAM,oDAAoD;QACtE;AAEA,eACE,KAAI,SACF,SAA6C;MAGnD;MACA,SAAS;AACP,cAAM,MACJ,+BAA+B,KAAK,OAAO,4CAA4C;MAE3F;IACF;EACF;EAEA,OAAI;AACF,YAAQ,KAAK,SAAS;MACpB,KAAK,GAAG;AACN,cAAM,EAAE,MAAAA,OAAM,QAAAC,QAAM,IAAK,KAAK;AAC9B,cAAM,YAAmB,OAAOD,OAAMC,OAAM;AAC5C,eACE,KAAI,SAAS,KAAK,MAAM,SAAS;MAErC;MACA,KAAK,GAAG;AACN,eAAO;MACT;MACA,SAAS;AACP,cAAM,MACJ,+BAA+B,KAAK,OAAO,4CAA4C;MAE3F;IACF;EACF;EAEA,OAAQ,OAAc;AACpB,WAAO,KAAI,OAAO,MAAM,KAAK;EAC/B;EAEA,OAAO,OAAsF,MAA4C,OAAc;AACrJ,UAAM,UAAU;AAChB,WACE,WAAW,QACX,KAAK,SAAS,QAAQ,QACtB,KAAK,YAAY,QAAQ,WAClBC,QAAO,KAAK,WAAW,QAAQ,SAAS;EAEnD;EAEA,SAAUC,OAAmC;AAC3C,WAAO,OAAO,MAAMA,KAAI;EAC1B;EAEA,SAAM;AACJ,WAAO,EAAE,KAAK,OAAO,IAAI,EAAC;EAC5B;EAEA,OAAI;AACF,WAAO;EACT;;EAMA,EAJU,YAAO,aAIhB,uBAAO,IAAI,4BAA4B,EAAC,IAAC;AACxC,WAAO,OAAO,KAAK,SAAQ,CAAE;EAC/B;;;;;;;;;;;EAYA,OAAO,MAAwF,OAA+C;AAC5I,QAAI,SAAS,MAAM;AACjB,aAAO;IACT;AAEA,UAAM,QAAQ;AACd,QAAI,iBAAiB,MAAK;AAExB,aAAO;IACT,WAAY,MAAM,GAAG,KAAK,QAAQ,MAAM,GAAG,MAAM,MAAM,SAAU,MAAM,UAAU,OAAO;AAMtF,YAAM,EAAE,SAAS,MAAAH,OAAM,WAAW,MAAK,IAAK;AAC5C,aAAO,IAAI,KACT,SACAA,OACA,WACA,SAAS,UAAU,SAASA,OAAM,UAAU,KAAK,CAAC;IAEtD,WAAW,MAAM,SAAS,MAAM,MAAM;AAIpC,YAAM,EAAE,SAAS,WAAW,MAAAA,MAAI,IAAK;AACrC,YAAMC,UAAgBG,QAAO,SAAS;AACtC,aAAO,KAAI,OAAO,SAASJ,OAAMC,OAAM;IACzC,OAAO;AAGL,aAAO;IACT;EACF;;;;;;EAOA,OAAO,OAAsF,SAAkBD,OAAcC,SAAgC;AAC3J,QAAI,OAAOD,UAAS,UAAU;AAC5B,YAAM,IAAI,MAAM,uCAAuC;IACzD;AAEA,QAAI,EAAEC,QAAO,iBAAiB,aAAa;AACzC,YAAM,IAAI,MAAM,gBAAgB;IAClC;AAEA,YAAQ,SAAS;MACf,KAAK,GAAG;AACN,YAAID,UAAS,aAAa;AACxB,gBAAM,IAAI,MACR,wCAAwC,WAAW,kBAAkB;QAEzE,OAAO;AACL,iBAAO,IAAI,KAAI,SAASA,OAAMC,SAAQA,QAAO,KAAK;QACpD;MACF;MACA,KAAK,GAAG;AACN,cAAM,QAAQ,UAAU,SAASD,OAAMC,QAAO,KAAK;AACnD,eAAO,IAAI,KAAI,SAASD,OAAMC,SAAQ,KAAK;MAC7C;MACA,SAAS;AACP,cAAM,IAAI,MAAM,iBAAiB;MACnC;IACF;EACF;;;;EAKA,OAAO,SAAuBA,SAAgD;AAC5E,WAAO,KAAI,OAAO,GAAG,aAAaA,OAAM;EAC1C;;;;;;;EAQA,OAAO,SAAyDD,OAAYC,SAAgC;AAC1G,WAAO,KAAI,OAAO,GAAGD,OAAMC,OAAM;EACnC;;;;;;;;EASA,OAAO,OAAoF,OAAuD;AAChJ,UAAM,CAAC,KAAK,SAAS,IAAI,KAAI,YAAY,KAAK;AAC9C,QAAI,UAAU,WAAW,GAAG;AAC1B,YAAM,IAAI,MAAM,kBAAkB;IACpC;AACA,WAAO;EACT;;;;;;;;;;EAWA,OAAO,YAA2E,OAAyC;AACzH,UAAM,QAAQ,KAAI,aAAa,KAAK;AACpC,UAAM,aAAa,MAAM,OAAO,MAAM;AACtC,UAAM,iBAAiB,OACrB,MAAM,SAAS,YAAY,aAAa,MAAM,aAAa,CAAC;AAE9D,QAAI,eAAe,eAAe,MAAM,eAAe;AACrD,YAAM,IAAI,MAAM,kBAAkB;IACpC;AACA,UAAM,cAAc,eAAe,SACjC,MAAM,gBAAgB,MAAM,UAAU;AAExC,UAAMA,UAAS,IAAW,OACxB,MAAM,eACN,MAAM,YACN,aACA,cAAc;AAEhB,UAAM,MACJ,MAAM,YAAY,IACd,KAAI,SAASA,OAA0C,IACvD,KAAI,SAAS,MAAM,OAAOA,OAAM;AACtC,WAAO,CAAC,KAAwB,MAAM,SAAS,MAAM,IAAI,CAAC;EAC5D;;;;;;;;;;EAWA,OAAO,aAA4E,cAAgD;AACjI,QAAI,SAAS;AACb,UAAM,OAAO,MAAa;AACxB,YAAM,CAAC,GAAGI,OAAM,IAAWD,QAAO,aAAa,SAAS,MAAM,CAAC;AAC/D,gBAAUC;AACV,aAAO;IACT;AAEA,QAAI,UAAU,KAAI;AAClB,QAAI,QAAQ;AACZ,QAAI,YAAsB,IAAI;AAE5B,gBAAU;AACV,eAAS;IACX,OAAO;AACL,cAAQ,KAAI;IACd;AAEA,QAAI,YAAY,KAAK,YAAY,GAAG;AAClC,YAAM,IAAI,WAAW,uBAAuB,OAAO,EAAE;IACvD;AAEA,UAAM,aAAa;AACnB,UAAM,gBAAgB,KAAI;AAC1B,UAAM,aAAa,KAAI;AACvB,UAAM,OAAO,SAAS;AACtB,UAAM,gBAAgB,OAAO;AAE7B,WAAO,EAAE,SAAS,OAAO,eAAe,YAAY,eAAe,KAAI;EACzE;;;;;;;EAQA,OAAO,MAA0G,QAAkEF,OAAmC;AACpN,UAAM,CAAC,QAAQ,KAAK,IAAI,gBAAgB,QAAQA,KAAI;AAEpD,UAAM,MAAM,KAAI,OAAO,KAAK;AAE5B,QAAI,IAAI,YAAY,KAAK,OAAO,CAAC,MAAM,KAAK;AAC1C,YAAM,MAAM,wDAAwD;IACtE;AAGA,cAAU,GAAG,EAAE,IAAI,QAAQ,MAAM;AAEjC,WAAO;EACT;;AAGF,SAAS,gBAAqH,QAAkEA,OAAmC;AACjO,UAAQ,OAAO,CAAC,GAAG;;IAEjB,KAAK,KAAK;AACR,YAAM,UAAUA,SAAQ;AACxB,aAAO;QACL,UAAU;QACV,QAAQ,OAAO,GAAG,UAAU,MAAM,GAAG,MAAM,EAAE;;IAEjD;IACA,KAAK,UAAU,QAAQ;AACrB,YAAM,UAAUA,SAAQ;AACxB,aAAO,CAAC,UAAU,QAAkB,QAAQ,OAAO,MAAM,CAAC;IAC5D;IACA,KAAK,OAAO,QAAQ;AAClB,YAAM,UAAUA,SAAQ;AACxB,aAAO,CAAC,OAAO,QAAkB,QAAQ,OAAO,MAAM,CAAC;IACzD;IACA,KAAK,OAAO,QAAQ;AAClB,YAAM,UAAUA,SAAQ;AACxB,aAAO,CAAC,OAAO,QAAkB,QAAQ,OAAO,MAAM,CAAC;IACzD;IACA,SAAS;AACP,UAAIA,SAAQ,MAAM;AAChB,cAAM,MACJ,yFAAyF;MAE7F;AACA,aAAO,CAAC,OAAO,CAAC,GAAaA,MAAK,OAAO,MAAM,CAAC;IAClD;EACF;AACF;AAEA,SAAS,WAAY,OAAmBG,QAA4BH,OAA+B;AACjG,QAAM,EAAE,OAAM,IAAKA;AACnB,MAAI,WAAW,UAAU,QAAQ;AAC/B,UAAM,MAAM,8BAA8BA,MAAK,IAAI,WAAW;EAChE;AAEA,QAAM,MAAMG,OAAM,IAAI,MAAM;AAC5B,MAAI,OAAO,MAAM;AACf,UAAMC,OAAMJ,MAAK,OAAO,KAAK,EAAE,MAAM,CAAC;AACtC,IAAAG,OAAM,IAAI,QAAQC,IAAG;AACrB,WAAOA;EACT,OAAO;AACL,WAAO;EACT;AACF;AAEA,SAAS,WAAoC,OAAmBD,QAA4BH,OAAkC;AAC5H,QAAM,EAAE,OAAM,IAAKA;AACnB,QAAM,MAAMG,OAAM,IAAI,MAAM;AAC5B,MAAI,OAAO,MAAM;AACf,UAAMC,OAAMJ,MAAK,OAAO,KAAK;AAC7B,IAAAG,OAAM,IAAI,QAAQC,IAAG;AACrB,WAAOA;EACT,OAAO;AACL,WAAO;EACT;AACF;AAEA,IAAM,cAAc;AACpB,IAAM,eAAe;AAErB,SAAS,UAAW,SAAsBP,OAAc,WAAqB;AAC3E,QAAM,aAAoB,eAAe,OAAO;AAChD,QAAM,aAAa,aAAoB,eAAeA,KAAI;AAC1D,QAAM,QAAQ,IAAI,WAAW,aAAa,UAAU,UAAU;AAC9D,EAAO,SAAS,SAAS,OAAO,CAAC;AACjC,EAAO,SAASA,OAAM,OAAO,UAAU;AACvC,QAAM,IAAI,WAAW,UAAU;AAC/B,SAAO;AACT;AAEA,IAAM,YAAY,uBAAO,IAAI,kBAAkB;;;AVnc/C,iBAAkB;;;AWAX,IAAM,2BAAN,cAAuC,MAAM;AAAA,EAGlD,YAAYQ,OAA6B,SAAiB;AACxD,UAAM,OAAO;AACb,SAAK,OAAO;AACZ,SAAK,OAAOA;AAAA,EACd;AACF;AAEO,IAAM,0BAAN,cAAsC,yBAAyB;AAAA,EACpE,YAAY,SAAiB;AAC3B,UAAM,kBAAkB,OAAO;AAC/B,SAAK,OAAO;AAAA,EACd;AACF;AAEO,IAAM,oCAAN,cAAgD,yBAAyB;AAAA,EAC9E,YAAY,SAAiB;AAC3B,UAAM,6BAA6B,OAAO;AAC1C,SAAK,OAAO;AAAA,EACd;AACF;AAEO,IAAM,0BAAN,cAAsC,yBAAyB;AAAA,EACpE,YAAY,SAAiB;AAC3B,UAAM,mBAAmB,OAAO;AAChC,SAAK,OAAO;AAAA,EACd;AACF;AAEO,IAAM,sBAAN,cAAkC,yBAAyB;AAAA,EAChE,YAAY,SAAiB;AAC3B,UAAM,eAAe,OAAO;AAC5B,SAAK,OAAO;AAAA,EACd;AACF;AAEO,IAAM,yBAAN,cAAqC,yBAAyB;AAAA,EACnE,YAAY,SAAiB;AAC3B,UAAM,uBAAuB,OAAO;AACpC,SAAK,OAAO;AAAA,EACd;AACF;AAEO,IAAM,yBAAN,cAAqC,yBAAyB;AAAA,EACnE,YAAY,SAAiB;AAC3B,UAAM,8BAA8B,OAAO;AAC3C,SAAK,OAAO;AAAA,EACd;AACF;AAEO,IAAM,iCAAN,cAA6C,yBAAyB;AAAA,EAC3E,YAAY,SAAiB;AAC3B,UAAM,+BAA+B,OAAO;AAC5C,SAAK,OAAO;AAAA,EACd;AACF;AAEO,IAAM,6BAAN,cAAyC,yBAAyB;AAAA,EACvE,YAAY,SAAiB;AAC3B,UAAM,qBAAqB,OAAO;AAClC,SAAK,OAAO;AAAA,EACd;AACF;;;AC/DA,IAAM,eACH,OAEE,UACF,OAAO,UAAU,eAAe,KAAK;AAAA,EACpC,OAAO,UAAU;AACnB;AAWK,SAAS,gBAAgB,OAAwB;AACtD,SAAO,UAAU,cAAc,OAAO,GAAG,CAAC;AAC5C;AAEO,SAAS,cAAc,OAAgB,OAAO,KAAgB;AACnE,MAAI,UAAU,MAAM;AAClB,WAAO;AAAA,EACT;AAEA,UAAQ,OAAO,OAAO;AAAA,IACpB,KAAK;AACH,aAAO;AAAA,IACT,KAAK;AACH,UAAI,CAAC,OAAO,SAAS,KAAK,GAAG;AAC3B,cAAM,IAAI;AAAA,UACR,GAAG,IAAI;AAAA,QACT;AAAA,MACF;AACA,aAAO;AAAA,IACT,KAAK;AACH,gCAA0B,OAAO,IAAI;AACrC,aAAO;AAAA,IACT,KAAK;AACH,aAAO,2BAA2B,OAAO,IAAI;AAAA,IAC/C,KAAK;AAAA,IACL,KAAK;AAAA,IACL,KAAK;AAAA,IACL,KAAK;AAAA,IACL;AACE,YAAM,IAAI;AAAA,QACR,GAAG,IAAI;AAAA,MACT;AAAA,EACJ;AACF;AAEO,SAAS,UAAU,OAA0B;AAClD,MAAI,UAAU,MAAM;AAClB,WAAO;AAAA,EACT;AAEA,UAAQ,OAAO,OAAO;AAAA,IACpB,KAAK;AACH,aAAO,QAAQ,SAAS;AAAA,IAC1B,KAAK,UAAU;AACb,YAAM,UAAU,KAAK,UAAU,KAAK;AACpC,UAAI,YAAY,QAAW;AACzB,cAAM,IAAI;AAAA,UACR;AAAA,QACF;AAAA,MACF;AACA,aAAO;AAAA,IACT;AAAA,IACA,KAAK;AACH,aAAO,KAAK,UAAU,KAAK;AAAA,IAC7B,KAAK;AACH,UAAI,MAAM,QAAQ,KAAK,GAAG;AACxB,eAAO,IAAI,MAAM,IAAI,CAAC,SAAS,UAAU,IAAI,CAAC,EAAE,KAAK,GAAG,CAAC;AAAA,MAC3D;AACA,aAAO,gBAAgB,KAAK;AAAA,IAC9B;AACE,YAAM,IAAI;AAAA,QACR,+BAA+B,OAAO,KAAK;AAAA,MAC7C;AAAA,EACJ;AACF;AAEA,SAAS,2BAA2B,OAAe,MAAyB;AAC1E,qBAAmB,OAAO,IAAI;AAE9B,MAAI,MAAM,QAAQ,KAAK,GAAG;AACxB,eAAW,OAAO,OAAO,oBAAoB,KAAK,GAAG;AACnD,UAAI,QAAQ,UAAU;AACpB;AAAA,MACF;AACA,UAAI,CAAC,gBAAgB,KAAK,MAAM,MAAM,GAAG;AACvC,cAAM,IAAI;AAAA,UACR,GAAG,IAAI,IAAI,GAAG;AAAA,QAChB;AAAA,MACF;AACA,YAAM,aAAa,OAAO,yBAAyB,OAAO,GAAG;AAC7D,UAAI,YAAY,eAAe,MAAM;AACnC,cAAM,IAAI;AAAA,UACR,GAAG,IAAI,IAAI,GAAG;AAAA,QAChB;AAAA,MACF;AACA,UAAI,EAAE,WAAW,aAAa;AAC5B,cAAM,IAAI;AAAA,UACR,GAAG,IAAI,IAAI,GAAG;AAAA,QAChB;AAAA,MACF;AAAA,IACF;AACA,UAAMC,UAAsB,CAAC;AAC7B,aAAS,QAAQ,GAAG,QAAQ,MAAM,QAAQ,SAAS;AACjD,UAAI,CAAC,aAAa,OAAO,KAAK,GAAG;AAC/B,cAAM,IAAI;AAAA,UACR,GAAG,IAAI,IAAI,KAAK;AAAA,QAClB;AAAA,MACF;AACA,MAAAA,QAAO,KAAK,cAAc,MAAM,KAAK,GAAG,GAAG,IAAI,IAAI,KAAK,GAAG,CAAC;AAAA,IAC9D;AACA,WAAOA;AAAA,EACT;AAEA,QAAM,QAAQ,OAAO,eAAe,KAAK;AACzC,MAAI,UAAU,OAAO,aAAa,UAAU,MAAM;AAChD,UAAM,IAAI;AAAA,MACR,GAAG,IAAI;AAAA,IACT;AAAA,EACF;AAEA,QAAM,SAAS,uBAAO,OAAO,IAAI;AACjC,aAAW,OAAO,OAAO,oBAAoB,KAAK,GAAG;AACnD,8BAA0B,KAAK,GAAG,IAAI,MAAM;AAC5C,QAAI,QAAQ,eAAe,QAAQ,eAAe;AAChD,YAAM,IAAI;AAAA,QACR,GAAG,IAAI,IAAI,GAAG;AAAA,MAChB;AAAA,IACF;AACA,UAAM,aAAa,OAAO,yBAAyB,OAAO,GAAG;AAC7D,QAAI,YAAY,eAAe,MAAM;AACnC,YAAM,IAAI;AAAA,QACR,GAAG,IAAI,IAAI,GAAG;AAAA,MAChB;AAAA,IACF;AACA,QAAI,EAAE,WAAW,aAAa;AAC5B,YAAM,IAAI;AAAA,QACR,GAAG,IAAI,IAAI,GAAG;AAAA,MAChB;AAAA,IACF;AACA,UAAM,QAAQ,WAAW;AACzB,WAAO,GAAG,IAAI,cAAc,OAAO,GAAG,IAAI,IAAI,GAAG,EAAE;AAAA,EACrD;AACA,SAAO;AACT;AAEA,SAAS,mBAAmB,OAAe,MAAoB;AAC7D,MAAI,OAAO,sBAAsB,KAAK,EAAE,SAAS,GAAG;AAClD,UAAM,IAAI;AAAA,MACR,GAAG,IAAI;AAAA,IACT;AAAA,EACF;AACF;AAEA,SAAS,gBAAgB,KAAaC,SAAyB;AAC7D,MAAI,CAAC,iBAAiB,KAAK,GAAG,GAAG;AAC/B,WAAO;AAAA,EACT;AACA,QAAM,QAAQ,OAAO,GAAG;AACxB,SAAO,OAAO,cAAc,KAAK,KAAK,SAAS,KAAK,QAAQA;AAC9D;AAEA,SAAS,gBAAgB,OAAsD;AAC7E,QAAM,OAAO,OAAO,KAAK,KAAK,EAAE,KAAK,qBAAqB;AAC1D,QAAM,QAAQ,KAAK,IAAI,CAAC,QAAQ,GAAG,KAAK,UAAU,GAAG,CAAC,IAAI,UAAU,MAAM,GAAG,CAAC,CAAC,EAAE;AACjF,SAAO,IAAI,MAAM,KAAK,GAAG,CAAC;AAC5B;AAEA,SAAS,sBAAsB,GAAW,GAAmB;AAC3D,QAAM,MAAM,KAAK,IAAI,EAAE,QAAQ,EAAE,MAAM;AACvC,WAAS,QAAQ,GAAG,QAAQ,KAAK,SAAS;AACxC,UAAM,eAAe,EAAE,WAAW,KAAK;AACvC,UAAM,gBAAgB,EAAE,WAAW,KAAK;AACxC,QAAI,iBAAiB,eAAe;AAClC,aAAO,eAAe;AAAA,IACxB;AAAA,EACF;AACA,SAAO,EAAE,SAAS,EAAE;AACtB;AAEA,SAAS,0BAA0B,OAAe,MAAoB;AACpE,WAAS,QAAQ,GAAG,QAAQ,MAAM,QAAQ,SAAS;AACjD,UAAMC,QAAO,MAAM,WAAW,KAAK;AACnC,QAAIA,SAAQ,SAAUA,SAAQ,OAAQ;AACpC,YAAM,OAAO,MAAM,WAAW,QAAQ,CAAC;AACvC,UAAI,OAAO,MAAM,IAAI,KAAK,OAAO,SAAU,OAAO,OAAQ;AACxD,cAAM,IAAI;AAAA,UACR,GAAG,IAAI;AAAA,QACT;AAAA,MACF;AACA;AACA;AAAA,IACF;AACA,QAAIA,SAAQ,SAAUA,SAAQ,OAAQ;AACpC,YAAM,IAAI;AAAA,QACR,GAAG,IAAI;AAAA,MACT;AAAA,IACF;AAAA,EACF;AACF;;;ACxNA,uBAAoC;AACpC,kBAAmC;AAInC,IAAM,cAAc,IAAI,YAAY;AAY7B,IAAM,wBAAN,cAAoC,MAAM;AAAA,EAG/C,YAAYC,OAAiC,SAAiB;AAC5D,UAAM,OAAO;AACb,SAAK,OAAO;AACZ,SAAK,OAAOA;AAAA,EACd;AACF;AAiBA,IAAMC,gBACH,OAEE,UACF,OAAO,UAAU,eAAe,KAAK;AAAA,EACpC,OAAO,UAAU;AACnB;AAEF,IAAM,mBAAmB,oBAAI,IAAI,CAAC,gBAAgB,iBAAiB,eAAe,CAAC;AACnF,IAAM,oBAAoB,oBAAI,IAAiC;AAE/D,WAAW,SAAS,sCAAqB;AACvC,MAAI,CAAC,iBAAiB,IAAI,MAAM,OAAO,GAAG;AACxC;AAAA,EACF;AACA,MAAI,MAAM,YAAY,UAAa,MAAM,YAAY,UAAa,MAAM,IAAI,SAAS,IAAI,GAAG;AAC1F;AAAA,EACF;AACA,QAAM,WAAW,kBAAkB,IAAI,MAAM,OAAO;AACpD,MAAI,aAAa,QAAW;AAC1B,sBAAkB,IAAI,MAAM,SAAS,oBAAI,IAAI,CAAC,MAAM,GAAG,CAAC,CAAC;AACzD;AAAA,EACF;AACA,EAAC,SAAyB,IAAI,MAAM,GAAG;AACzC;AAOO,SAAS,0BAA0B,OAAkC;AAC1E,SAAO,qCAAqC,OAAO,EAAE,kBAAkB,KAAK,CAAC;AAC/E;AAOO,SAAS,6BAA6B,OAAkC;AAC7E,SAAO,qCAAqC,OAAO,EAAE,kBAAkB,KAAK,CAAC;AAC/E;AAYO,SAAS,yBAAyB,WAAoB,SAA2B;AACtF,MAAI;AACJ,MAAI;AACJ,MAAI;AACF,WAAO,6BAA6B,SAAS;AAC7C,UAAM,6BAA6B,OAAO;AAAA,EAC5C,QAAQ;AACN,WAAO;AAAA,EACT;AACA,MAAI,KAAK,YAAY,IAAI,WAAW,KAAK,UAAU,IAAI,OAAO;AAC5D,WAAO;AAAA,EACT;AACA,MAAI,CAAC,aAAa,KAAK,MAAM,IAAI,IAAI,GAAG;AACtC,WAAO;AAAA,EACT;AACA,QAAM,cAAc,IAAI,IAAI,KAAK,OAAO;AACxC,aAAW,UAAU,IAAI,SAAS;AAChC,QAAI,CAAC,YAAY,IAAI,MAAM,GAAG;AAC5B,aAAO;AAAA,IACT;AAAA,EACF;AACA,SAAO,eAAe,KAAK,SAAS,IAAI,OAAO;AACjD;AAEA,SAAS,qCACP,OACA,SACkB;AAClB,QAAM,SAAS,aAAa,OAAO,GAAG;AACtC,kBAAgB,QAAQ,CAAC,WAAW,SAAS,QAAQ,WAAW,SAAS,GAAG,GAAG;AAC/E,QAAM,UAAU,eAAe,QAAQ,WAAW,KAAK,qCAAqC;AAC5F,MAAI,CAAC,iBAAiB,IAAI,OAAO,GAAG;AAClC,UAAM,IAAI;AAAA,MACR;AAAA,MACA;AAAA,IACF;AAAA,EACF;AACA,QAAM,QAAQ,eAAe,QAAQ,SAAS,KAAK,mCAAmC;AACtF,wBAAsB,KAAK;AAC3B,QAAM,iBAAiB,MAAM,UAAU,KAAK;AAC5C,MAAI,QAAQ,oBAAoB,mBAAmB,OAAO;AACxD,UAAM,IAAI;AAAA,MACR;AAAA,MACA;AAAA,IACF;AAAA,EACF;AACA,QAAM,UAAU,eAAe,QAAQ,QAAQ,KAAK,kCAAkC;AACtF,kBAAgB,SAAS,OAAO;AAChC,QAAM,OAAO,cAAc,OAAO;AAClC,MAAI,QAAQ,oBAAoB,SAAS,SAAS;AAChD,UAAM,IAAI;AAAA,MACR;AAAA,MACA;AAAA,IACF;AAAA,EACF;AACA,kBAAgB,MAAM,OAAO;AAC7B,QAAM,UAAU;AAAA,IACd,cAAc,QAAQ,WAAW,KAAK,oCAAoC;AAAA,IAC1E;AAAA,IACA;AAAA,EACF;AACA,QAAM,SAAS,uBAAO,OAAO,IAAI;AAOjC,SAAO,UAAU;AACjB,SAAO,QAAQ;AACf,SAAO,OAAO;AACd,SAAO,UAAU;AACjB,MAAI,OAAO,QAAQ,SAAS,GAAG;AAC7B,WAAO,UAAU;AAAA,MACf,cAAc,QAAQ,WAAW,KAAK,qCAAqC;AAAA,MAC3E,OAAO;AAAA,IACT;AAAA,EACF;AACA,SAAO;AACT;AAEA,SAAS,aAAa,OAAgB,MAA0B;AAC9D,MAAI;AACF,UAAM,aAAa,cAAc,KAAK;AACtC,QAAI,eAAe,QAAQ,OAAO,eAAe,YAAY,MAAM,QAAQ,UAAU,GAAG;AACtF,YAAM,IAAI,sBAAsB,+BAA+B,GAAG,IAAI,oBAAoB;AAAA,IAC5F;AACA,WAAO;AAAA,EACT,SAAS,OAAO;AACd,QAAI,iBAAiB,uBAAuB;AAC1C,YAAM;AAAA,IACR;AACA,UAAM,IAAI;AAAA,MACR;AAAA,MACA,iBAAiB,QAAQ,MAAM,UAAU,OAAO,KAAK;AAAA,IACvD;AAAA,EACF;AACF;AAEA,SAAS,gBAAgB,QAAoB,SAA4B,MAAoB;AAC3F,QAAM,aAAa,IAAI,IAAI,OAAO;AAClC,aAAW,OAAO,OAAO,KAAK,MAAM,GAAG;AACrC,QAAI,CAAC,WAAW,IAAI,GAAG,GAAG;AACxB,YAAM,IAAI;AAAA,QACR,QAAQ,QAAQ,QAAQ,UAAU,gCAAgC;AAAA,QAClE,GAAG,IAAI,sBAAsB,GAAG;AAAA,MAClC;AAAA,IACF;AAAA,EACF;AACF;AAEA,SAAS,cACP,QACA,KACA,MACAC,OACW;AACX,MAAI,CAAC,OAAO,QAAQ,GAAG,GAAG;AACxB,UAAM,IAAI,sBAAsBA,OAAM,GAAG,IAAI,IAAI,GAAG,cAAc;AAAA,EACpE;AACA,SAAO,OAAO,GAAG;AACnB;AAEA,SAAS,eACP,QACA,KACA,MACAA,OACQ;AACR,QAAM,QAAQ,cAAc,QAAQ,KAAK,MAAMA,KAAI;AACnD,MAAI,OAAO,UAAU,YAAY,MAAM,WAAW,GAAG;AACnD,UAAM,IAAI,sBAAsBA,OAAM,GAAG,IAAI,IAAI,GAAG,6BAA6B;AAAA,EACnF;AACA,SAAO;AACT;AAEA,SAAS,cACP,QACA,KACA,MACAA,OACsB;AACtB,QAAM,QAAQ,cAAc,QAAQ,KAAK,MAAMA,KAAI;AACnD,MAAI,CAAC,MAAM,QAAQ,KAAK,GAAG;AACzB,UAAM,IAAI,sBAAsBA,OAAM,GAAG,IAAI,IAAI,GAAG,mBAAmB;AAAA,EACzE;AACA,SAAO;AACT;AAEA,SAAS,sBAAsB,OAAqB;AAClD,MAAI,UAAU,OAAO,MAAM,SAAS,GAAG,KAAK,MAAM,SAAS,GAAG,KAAK,MAAM,SAAS,GAAG,GAAG;AACtF,UAAM,IAAI;AAAA,MACR;AAAA,MACA;AAAA,IACF;AAAA,EACF;AACF;AAEA,SAAS,gBAAgB,MAAc,SAAiC;AACtE,MAAI,KAAK,WAAW,GAAG;AACrB,UAAM,IAAI,sBAAsB,oCAAoC,iBAAiB;AAAA,EACvF;AACA,MAAI,CAAC,QAAQ,oBAAoB,KAAK,SAAS,GAAG,GAAG;AACnD,UAAM,IAAI;AAAA,MACR;AAAA,MACA;AAAA,IACF;AAAA,EACF;AACA,MAAI,KAAK,SAAS,IAAI,KAAK,KAAK,SAAS,IAAI,GAAG;AAC9C,UAAM,IAAI,sBAAsB,oCAAoC,yBAAyB;AAAA,EAC/F;AACA,QAAM,WAAW,KAAK,MAAM,GAAG;AAC/B,WAAS,QAAQ,GAAG,QAAQ,SAAS,QAAQ,SAAS;AACpD,UAAM,UAAU,SAAS,KAAK;AAC9B,UAAM,0BACJ,QAAQ,oBAAoB,UAAU,SAAS,SAAS,KAAK,QAAQ,WAAW;AAClF,QAAI,QAAQ,WAAW,KAAK,CAAC,yBAAyB;AACpD,YAAM,IAAI,sBAAsB,oCAAoC,6BAA6B;AAAA,IACnG;AACA,QAAI,YAAY,OAAO,YAAY,MAAM;AACvC,YAAM,IAAI;AAAA,QACR;AAAA,QACA;AAAA,MACF;AAAA,IACF;AACA,QAAI,YAAY,OAAO,YAAY,OAAO,QAAQ,SAAS,GAAG,KAAK,QAAQ,SAAS,GAAG,GAAG;AACxF,YAAM,IAAI;AAAA,QACR;AAAA,QACA;AAAA,MACF;AAAA,IACF;AAAA,EACF;AACF;AAEA,SAAS,cAAc,MAAsB;AAC3C,SAAO,iBAAiB,IAAI,EAAE,UAAU,KAAK;AAC/C;AAEA,SAAS,iBAAiB,MAAsB;AAC9C,SAAO,KAAK,QAAQ,oBAAoB,CAAC,YAAY;AACnD,UAAM,OAAO,OAAO,aAAa,OAAO,SAAS,QAAQ,MAAM,CAAC,GAAG,EAAE,CAAC;AACtE,WAAO,oBAAoB,KAAK,IAAI,IAAI,OAAO,QAAQ,YAAY;AAAA,EACrE,CAAC;AACH;AAEA,SAAS,iBACP,SACA,SACA,SACU;AACV,QAAM,WAAW,kBAAkB,IAAI,OAAO;AAC9C,MAAI,aAAa,QAAW;AAC1B,UAAM,IAAI;AAAA,MACR;AAAA,MACA;AAAA,IACF;AAAA,EACF;AACA,QAAM,SAAS,oBAAI,IAAY;AAC/B,QAAM,aAAuB,CAAC;AAC9B,WAAS,QAAQ,GAAG,QAAQ,QAAQ,QAAQ,SAAS;AACnD,UAAM,SAAS,QAAQ,KAAK;AAC5B,QAAI,OAAO,WAAW,YAAY,OAAO,WAAW,GAAG;AACrD,YAAM,IAAI;AAAA,QACR;AAAA,QACA,aAAa,KAAK;AAAA,MACpB;AAAA,IACF;AACA,QAAI,CAAC,OAAO,WAAW,GAAG,OAAO,GAAG,KAAK,OAAO,SAAS,GAAG,KAAK,CAAC,SAAS,IAAI,MAAM,GAAG;AACtF,YAAM,IAAI;AAAA,QACR;AAAA,QACA,aAAa,KAAK;AAAA,MACpB;AAAA,IACF;AACA,eAAW,KAAK,MAAM;AACtB,WAAO,IAAI,MAAM;AAAA,EACnB;AACA,MAAI,OAAO,SAAS,GAAG;AACrB,UAAM,IAAI;AAAA,MACR;AAAA,MACA;AAAA,IACF;AAAA,EACF;AACA,QAAM,oBAAoB,CAAC,GAAG,MAAM,EAAE,KAAK;AAC3C,MACE,QAAQ,qBACP,WAAW,WAAW,kBAAkB,UACvC,WAAW,KAAK,CAAC,QAAQ,UAAU,WAAW,kBAAkB,KAAK,CAAC,IACxE;AACA,UAAM,IAAI;AAAA,MACR;AAAA,MACA;AAAA,IACF;AAAA,EACF;AACA,SAAO;AACT;AAEA,SAAS,gBAAgB,OAAkB,SAAkD;AAC3F,MAAI,UAAU,QAAQ,OAAO,UAAU,YAAY,MAAM,QAAQ,KAAK,GAAG;AACvE,UAAM,IAAI;AAAA,MACR;AAAA,MACA;AAAA,IACF;AAAA,EACF;AACA,MAAI,YAAY,iBAAiB;AAC/B,WAAO,mBAAmB,KAAmB;AAAA,EAC/C;AACA,QAAM,IAAI;AAAA,IACR;AAAA,IACA;AAAA,EACF;AACF;AAEA,SAAS,mBAAmB,OAA+B;AACzD,mBAAiB,OAAO,CAAC,QAAQ,YAAY,YAAY,GAAG,WAAW;AACvE,QAAM,OAAO,aAAa,OAAO,QAAQ,WAAW;AACpD,MAAI,SAAS,0BAA0B;AACrC,UAAM,IAAI;AAAA,MACR;AAAA,MACA;AAAA,IACF;AAAA,EACF;AACA,MAAI,eAAe,OAAO,YAAY,WAAW,MAAM,MAAM;AAC3D,UAAM,IAAI;AAAA,MACR;AAAA,MACA;AAAA,IACF;AAAA,EACF;AACA,QAAM,aAAa,eAAe,OAAO,cAAc,WAAW;AAClE,MAAI,CAAC,MAAM,QAAQ,UAAU,KAAK,WAAW,WAAW,GAAG;AACzD,UAAM,IAAI;AAAA,MACR;AAAA,MACA;AAAA,IACF;AAAA,EACF;AACA,WAAS,QAAQ,GAAG,QAAQ,WAAW,QAAQ,SAAS;AACtD,yBAAqB,WAAW,KAAK,GAAG,wBAAwB,KAAK,GAAG;AAAA,EAC1E;AACA,SAAO;AACT;AAEA,SAAS,qBAAqB,OAAkB,MAAoB;AAClE,MAAI,UAAU,QAAQ,OAAO,UAAU,YAAY,MAAM,QAAQ,KAAK,GAAG;AACvE,UAAM,IAAI,sBAAsB,uCAAuC,GAAG,IAAI,oBAAoB;AAAA,EACpG;AACA,QAAM,SAAS;AACf,mBAAiB,QAAQ,CAAC,QAAQ,OAAO,aAAa,GAAG,IAAI;AAC7D,eAAa,QAAQ,QAAQ,IAAI;AACjC,eAAa,QAAQ,OAAO,IAAI;AAChC,QAAM,cAAc,eAAe,QAAQ,eAAe,IAAI;AAC9D,MAAI,CAAC,MAAM,QAAQ,WAAW,GAAG;AAC/B,UAAM,IAAI;AAAA,MACR;AAAA,MACA,GAAG,IAAI;AAAA,IACT;AAAA,EACF;AACA,WAAS,QAAQ,GAAG,QAAQ,YAAY,QAAQ,SAAS;AACvD,uBAAmB,YAAY,KAAK,GAAG,GAAG,IAAI,gBAAgB,KAAK,GAAG;AAAA,EACxE;AACF;AAEA,SAAS,mBAAmB,OAAkB,MAAoB;AAChE,MAAI,UAAU,QAAQ,OAAO,UAAU,YAAY,MAAM,QAAQ,KAAK,GAAG;AACvE,UAAM,IAAI,sBAAsB,uCAAuC,GAAG,IAAI,oBAAoB;AAAA,EACpG;AACA,QAAM,SAAS;AACf,mBAAiB,QAAQ,CAAC,SAAS,OAAO,GAAG,IAAI;AACjD,QAAM,QAAQ,eAAe,QAAQ,SAAS,IAAI;AAClD,MAAI,OAAO,UAAU,YAAY,CAAC,OAAO,cAAc,KAAK,KAAK,QAAQ,GAAG;AAC1E,UAAM,IAAI;AAAA,MACR;AAAA,MACA,GAAG,IAAI;AAAA,IACT;AAAA,EACF;AACA,iBAAe,QAAQ,SAAS,IAAI;AACtC;AAEA,SAAS,iBAAiB,QAAoB,SAA4B,MAAoB;AAC5F,QAAM,aAAa,IAAI,IAAI,OAAO;AAClC,aAAW,OAAO,OAAO,KAAK,MAAM,GAAG;AACrC,QAAI,CAAC,WAAW,IAAI,GAAG,GAAG;AACxB,YAAM,IAAI;AAAA,QACR;AAAA,QACA,GAAG,IAAI,sBAAsB,GAAG;AAAA,MAClC;AAAA,IACF;AAAA,EACF;AACF;AAEA,SAAS,eAAe,QAAoB,KAAa,MAAyB;AAChF,MAAI,CAAC,OAAO,QAAQ,GAAG,GAAG;AACxB,UAAM,IAAI;AAAA,MACR;AAAA,MACA,GAAG,IAAI,IAAI,GAAG;AAAA,IAChB;AAAA,EACF;AACA,SAAO,OAAO,GAAG;AACnB;AAEA,SAAS,aAAa,QAAoB,KAAa,MAAsB;AAC3E,QAAM,QAAQ,eAAe,QAAQ,KAAK,IAAI;AAC9C,MAAI,OAAO,UAAU,YAAY,MAAM,WAAW,GAAG;AACnD,UAAM,IAAI;AAAA,MACR;AAAA,MACA,GAAG,IAAI,IAAI,GAAG;AAAA,IAChB;AAAA,EACF;AACA,SAAO;AACT;AAEA,SAAS,aAAa,WAAmB,SAA0B;AACjE,MAAI,cAAc,SAAS;AACzB,WAAO;AAAA,EACT;AACA,SAAO,UAAU,SAAS,GAAG,KAAK,QAAQ,WAAW,SAAS;AAChE;AAEA,SAAS,eAAe,WAAmC,SAA0C;AACnG,MAAI,cAAc,QAAW;AAC3B,WAAO,YAAY;AAAA,EACrB;AACA,MAAI,YAAY,QAAW;AACzB,WAAO,OAAO,KAAK,SAAS,EAAE,WAAW;AAAA,EAC3C;AACA,MAAI,UAAU,SAAS,4BAA4B,QAAQ,SAAS,0BAA0B;AAC5F,WAAO;AAAA,EACT;AACA,QAAM,sBAAsB,MAAM,QAAQ,UAAU,UAAU,IAAI,UAAU,aAAa,CAAC;AAC1F,QAAM,oBAAoB,MAAM,QAAQ,QAAQ,UAAU,IAAI,QAAQ,aAAa,CAAC;AACpF,SAAO,kBAAkB;AAAA,IAAM,CAAC,cAC9B,oBAAoB,KAAK,CAAC,cAAc,gBAAgB,SAAS,MAAM,gBAAgB,SAAS,CAAC;AAAA,EACnG;AACF;AAEA,SAAS,OAAO,QAAoB,KAAsB;AACxD,SAAOC,cAAa,QAAQ,GAAG;AACjC;;;AC3eA,qBAAwB;;;ACAxB;;;;AAEO,IAAM,SAAS,MAAM;EAC1B,QAAQ;EACR,MAAM;EACN,UAAU;CACX;;;ACND;;;;;AAEO,IAAM,SAAS,QAAQ;EAC5B,QAAQ;EACR,MAAM;EACN,UAAU;EACV,aAAa;CACd;AAEM,IAAM,cAAc,QAAQ;EACjC,QAAQ;EACR,MAAM;EACN,UAAU;EACV,aAAa;CACd;;;ACdD;;;;AAEO,IAAM,QAAQ,QAAQ;EAC3B,QAAQ;EACR,MAAM;EACN,UAAU;EACV,aAAa;CACd;;;ACPD;;;;AAEA,IAAM,WAAW,MAAM,KAAK,orEAAwe;AACpgB,IAAM,uBAAkC,SAAS,OAAiB,CAAC,GAAG,GAAG,MAAK;AAAG,IAAE,CAAC,IAAI;AAAG,SAAO;AAAE,GAAI,CAAA,CAAG;AAC3G,IAAM,uBAAkC,SAAS,OAAiB,CAAC,GAAG,GAAG,MAAK;AAC5E,QAAM,YAAY,EAAE,YAAY,CAAC;AACjC,MAAI,aAAa,MAAM;AACrB,UAAM,IAAI,MAAM,sBAAsB,CAAC,EAAE;EAC3C;AACA,IAAE,SAAS,IAAI;AACf,SAAO;AACT,GAAI,CAAA,CAAG;AAEP,SAASC,QAAQ,MAAgB;AAC/B,SAAO,KAAK,OAAO,CAAC,GAAG,MAAK;AAC1B,SAAK,qBAAqB,CAAC;AAC3B,WAAO;EACT,GAAG,EAAE;AACP;AAEA,SAASC,QAAQ,KAAW;AAC1B,QAAM,OAAO,CAAA;AACb,aAAW,QAAQ,KAAK;AACtB,UAAM,YAAY,KAAK,YAAY,CAAC;AACpC,QAAI,aAAa,MAAM;AACrB,YAAM,IAAI,MAAM,sBAAsB,IAAI,EAAE;IAC9C;AACA,UAAM,MAAM,qBAAqB,SAAS;AAC1C,QAAI,OAAO,MAAM;AACf,YAAM,IAAI,MAAM,+BAA+B,IAAI,EAAE;IACvD;AACA,SAAK,KAAK,GAAG;EACf;AACA,SAAO,IAAI,WAAW,IAAI;AAC5B;AAEO,IAAM,eAAe,KAAK;EAC/B,QAAQ;EACR,MAAM;EACN,QAAAD;EACA,QAAAC;CACD;;;ACzCD;;;;;;;AAEO,IAAM,SAAS,QAAQ;EAC5B,QAAQ;EACR,MAAM;EACN,UAAU;EACV,aAAa;CACd;AAEM,IAAM,YAAY,QAAQ;EAC/B,QAAQ;EACR,MAAM;EACN,UAAU;EACV,aAAa;CACd;AAEM,IAAM,YAAY,QAAQ;EAC/B,QAAQ;EACR,MAAM;EACN,UAAU;EACV,aAAa;CACd;AAEM,IAAM,eAAe,QAAQ;EAClC,QAAQ;EACR,MAAM;EACN,UAAU;EACV,aAAa;CACd;;;AC5BD;;;;AAEO,IAAM,QAAQ,QAAQ;EAC3B,QAAQ;EACR,MAAM;EACN,UAAU;EACV,aAAa;CACd;;;ACPD;;;;AAGO,IAAM,WAAW,KAAK;EAC3B,QAAQ;EACR,MAAM;EACN,QAAQ,CAAC,QAAQ,SAAS,GAAG;EAC7B,QAAQ,CAAC,QAAQ,WAAW,GAAG;CAChC;;;ACND,IAAMC,eAAc,IAAI,YAAW;AACnC,IAAM,cAAc,IAAI,YAAW;;;ACHnC,IAAAC,oBAAA;SAAAA,mBAAA;kBAAAC;;AAIA,IAAM,OAAY;AAClB,IAAM,OAAO;AAEb,IAAMC,UAA4C;AAElD,SAAS,OAAQ,OAAmB,SAAuB;AACzD,MAAI,SAAS,YAAY,QAAQ,QAAQ,aAAa,MAAM,YAAY;AACtE,QAAI,QAAQ,WAAW,KAAK,QAAQ,WAAW,MAAM,YAAY;AAC/D,YAAM,IAAI,MAAM,0DAA0D,MAAM,UAAU,EAAE;IAC9F;AAEA,YAAQ,MAAM,SAAS,GAAG,QAAQ,QAAQ;EAC5C;AAEA,SAAc,OAAO,MAAMA,QAAO,KAAK,CAAC;AAC1C;AAEO,IAAMC,YAAW,EAAE,MAAM,MAAM,QAAAD,SAAQ,OAAM;;;ACrBpD;;gBAAAE;EAAA;;oBAAmB;;;ACKnB,IAAM,4BAA4B;AAqB5B,SAAUC,MAAiD,EAAE,MAAAC,OAAM,MAAAC,OAAM,QAAAC,SAAQ,iBAAiB,gBAAe,GAA0B;AAC/I,SAAO,IAAI,OAAOF,OAAMC,OAAMC,SAAQ,iBAAiB,eAAe;AACxE;AAoBM,IAAO,SAAP,MAAa;EAOjB,YAAaF,OAAYC,OAAYC,SAAkD,iBAA0B,iBAAwB;AANhI;AACA;AACA;AACA;AACA;AAGP,SAAK,OAAOF;AACZ,SAAK,OAAOC;AACZ,SAAK,SAASC;AACd,SAAK,kBAAkB,mBAAmB;AAC1C,SAAK,kBAAkB;EACzB;EAEA,OAAQ,OAAmB,SAAuB;AAChD,QAAI,SAAS,YAAY,MAAM;AAC7B,UAAI,QAAQ,WAAW,KAAK,iBAAiB;AAC3C,cAAM,IAAI,MAAM,6DAA6D,KAAK,eAAe,EAAE;MACrG;AAEA,UAAI,KAAK,mBAAmB,QAAQ,QAAQ,WAAW,KAAK,iBAAiB;AAC3E,cAAM,IAAI,MAAM,0DAA0D,KAAK,eAAe,EAAE;MAClG;IACF;AAEA,QAAI,iBAAiB,YAAY;AAC/B,YAAM,SAAS,KAAK,OAAO,KAAK;AAEhC,UAAI,kBAAkB,YAAY;AAChC,eAAO,aAAa,QAAQ,KAAK,MAAM,SAAS,QAAQ;MAC1D;AAEA,aAAO,OAAO,KAAK,CAAAC,YAAU,aAAaA,SAAQ,KAAK,MAAM,SAAS,QAAQ,CAAC;IACjF,OAAO;AACL,YAAM,MAAM,mCAAmC;IAEjD;EACF;;AAOF,SAAS,aAAoCA,SAAoBF,OAAY,UAAiB;AAC5F,MAAI,YAAY,QAAQ,aAAaE,QAAO,YAAY;AACtD,QAAI,WAAWA,QAAO,YAAY;AAChC,YAAM,IAAI,MAAM,0DAA0DA,QAAO,UAAU,EAAE;IAC/F;AAEA,IAAAA,UAASA,QAAO,SAAS,GAAG,QAAQ;EACtC;AAEA,SAAc,OAAOF,OAAME,OAAM;AACnC;;;ADnGO,IAAMC,UAASC,MAAK;EACzB,MAAM;EACN,MAAM;EACN,QAAQ,CAAC,UAAU,OAAO,cAAAC,QAAO,WAAW,QAAQ,EAAE,OAAO,KAAK,EAAE,OAAM,CAAE;CAC7E;AAEM,IAAM,SAASD,MAAK;EACzB,MAAM;EACN,MAAM;EACN,QAAQ,WAAS,OAAO,cAAAC,QAAO,WAAW,QAAQ,EAAE,OAAO,KAAK,EAAE,OAAM,CAAE;CAC3E;;;AEEM,IAAM,QAAQ,EAAE,GAAG,kBAAc,GAAG,eAAO,GAAG,eAAO,GAAG,gBAAQ,GAAG,gBAAQ,GAAG,gBAAQ,GAAG,gBAAQ,GAAG,gBAAQ,GAAG,gBAAQ,GAAG,qBAAY;AACtI,IAAM,SAAS,EAAE,GAAG,cAAM,GAAGC,kBAAQ;;;AZf5C,IAAAC,eAAkD;;;AaFlD,IAAAC,eAAsC;AAmB/B,IAAM,qBAAN,cAAiC,MAAM;AAAA,EAC5C,YAAY,SAAiB;AAC3B,UAAM,OAAO;AACb,SAAK,OAAO;AAAA,EACd;AACF;AAEA,IAAM,aAAa;AAcnB,SAAS,mBAAmB,SAAuB;AACjD,MAAI,CAAC,OAAO,cAAc,OAAO,KAAK,WAAW,GAAG;AAClD,UAAM,IAAI,mBAAmB,6BAA6B,OAAO,EAAE;AAAA,EACrE;AACF;AAEO,SAAS,aAAa,OAAwB;AACnD,aAAO,wBAAU,OAAO,EAAE,QAAQ,MAAM,CAAC;AAC3C;AAEO,SAAS,oBAAoB,SAAmC;AACrE,MAAI,CAAC,aAAa,OAAO,GAAG;AAC1B,UAAM,IAAI,mBAAmB,wBAAwB,OAAO,EAAE;AAAA,EAChE;AACA,aAAO,yBAAW,OAAO;AAC3B;AAWO,SAAS,YAAY,KAAiC;AAC3D,QAAM,QAAQ,IAAI,MAAM,UAAU;AAClC,MAAI,CAAC,MAAO,QAAO;AAEnB,QAAM,UAAU,OAAO,MAAM,CAAC,CAAC;AAC/B,qBAAmB,OAAO;AAE1B,SAAO;AAAA,IACL,QAAQ;AAAA,IACR,WAAW;AAAA,IACX;AAAA,IACA,SAAS,oBAAoB,MAAM,CAAC,CAAC;AAAA,EACvC;AACF;;;Ab7DO,IAAM,gBAAgB;AACtB,IAAM,uBAAuB;AAC7B,IAAM,8BACX;AAEK,IAAM,8BAA8B;AACpC,IAAM,6BACX;AA0GF,IAAM,cAA0D;AAAA,EAC9D,QAAQ;AAAA,IACN,MAAM;AAAA,IACN,QAAQ;AAAA,IACR,SAAS;AAAA,IACT,UAAU;AAAA,IACV,QAAQ;AAAA,EACV;AAAA,EACA,cAAc;AAAA,IACZ,MAAM;AAAA,IACN,QAAQ;AAAA,IACR,SAAS;AAAA,IACT,UAAU;AAAA,IACV,QAAQ;AAAA,EACV;AAAA,EACA,oBAAoB;AAAA,IAClB,MAAM;AAAA,IACN,QAAQ;AAAA,IACR,SAAS;AAAA,IACT,UAAU;AAAA,IACV,QAAQ;AAAA,EACV;AACF;AAEA,IAAMC,eAAc,IAAI,YAAY;AACpC,IAAM,kBAAkB;AACxB,IAAM,eAAe;AACrB,IAAMC,gBACH,OAEE,UACF,OAAO,UAAU,eAAe,KAAK;AAAA,EACpC,OAAO,UAAU;AACnB;AA2EF,eAAsB,mBACpB,OACyE;AACzE,QAAM,SAAS,0BAA0B,KAAK;AAC9C,QAAM,aAAa;AACnB,QAAM,aAAa,oBAAoB,OAAO,MAAM;AACpD,QAAM,YAAY,kBAAkB,OAAO,SAAS;AACpD,mCAAiC,YAAY,SAAS;AACtD,QAAM,WAAW,uBAAuB,YAAY,UAAU;AAC9D,QAAM,WAAW,oBAAoB,UAAU,UAAU;AACzD,kBAAgB,YAAY,UAAU,UAAU;AAChD,MAAI,CAAE,MAAM,gBAAgB,WAAW,SAAS,MAAM,GAAI;AACxD,UAAM,IAAI,2BAA2B,+BAA+B;AAAA,EACtE;AACA,SAAO,EAAE,QAAQ,QAAQ,SAAS;AACpC;AAsBA,eAAsB,yBACpB,OACyE;AACzE,QAAM,SAAS,MAAM,mBAAmB,KAAK;AAC7C,SAAO;AAAA,IACL,QAAQ,sCAAsC,OAAO,MAAM;AAAA,IAC3D,UAAU,OAAO;AAAA,EACnB;AACF;AAiDO,SAAS,0BAA0B,OAAwB;AAChE,SAAO,oBAAoB,OAAO,IAAI;AACxC;AAEO,SAAS,gCAAgC,OAA8B;AAC5E,SAAO,0BAA0B,OAAO,IAAI;AAC9C;AAEO,SAAS,sCACd,OACoB;AACpB,SAAO,gCAAgC,OAAO,IAAI;AACpD;AAEA,SAAS,0BAA0B,OAAoC;AACrE,QAAM,aAAa,iBAAiB,cAAc,KAAK,GAAG,GAAG;AAC7D,QAAM,SAASC,gBAAe,YAAY,UAAU,GAAG;AACvD,QAAM,aAAa,oBAAoB,MAAM;AAC7C,UAAQ,WAAW,MAAM;AAAA,IACvB,KAAK;AACH,aAAO,0BAA0B,UAAU;AAAA,IAC7C,KAAK;AACH,aAAO,gCAAgC,UAAU;AAAA,IACnD,KAAK;AACH,aAAO,sCAAsC,UAAU;AAAA,EAC3D;AACF;AAgBA,SAAS,oBAAoB,OAAgB,QAA6B;AACxE,QAAM,SAAS,iBAAiB,cAAc,KAAK,GAAG,GAAG;AACzD,EAAAC;AAAA,IACE;AAAA,IACA,SACI;AAAA,MACE;AAAA,MACA;AAAA,MACA;AAAA,MACA;AAAA,MACA;AAAA,MACA;AAAA,MACA;AAAA,MACA;AAAA,MACA;AAAA,MACA;AAAA,MACA;AAAA,MACA;AAAA,IACF,IACA;AAAA,MACE;AAAA,MACA;AAAA,MACA;AAAA,MACA;AAAA,MACA;AAAA,MACA;AAAA,MACA;AAAA,MACA;AAAA,MACA;AAAA,MACA;AAAA,IACF;AAAA,IACJ;AAAA,EACF;AACA,cAAYC,gBAAe,QAAQ,UAAU,GAAG,GAAG,eAAe,UAAU;AAC5E,MAAI,QAAQ;AACV,IAAAA,gBAAe,QAAQ,YAAY,GAAG;AACtC,sBAAkBC,eAAc,QAAQ,aAAa,GAAG,CAAC;AAAA,EAC3D;AACA,EAAAD,gBAAe,QAAQ,YAAY,GAAG;AACtC,EAAAA,gBAAe,QAAQ,iBAAiB,GAAG;AAC3C,qBAAmB,QAAQ,aAAa,GAAG;AAC3C,qBAAmB,QAAQ,aAAa,GAAG;AAC3C,yBAAuBC,eAAc,QAAQ,YAAY,GAAG,GAAG,YAAY;AAC3E,qBAAmBA,eAAc,QAAQ,QAAQ,GAAG,GAAG,QAAQ;AAC/D,gBAAcA,eAAc,QAAQ,SAAS,GAAG,GAAG,SAAS;AAC5D,MAAIC,QAAO,QAAQ,YAAY,GAAG;AAChC,uBAAmBD,eAAc,QAAQ,cAAc,GAAG,GAAG,cAAc;AAAA,EAC7E;AACA,MAAIC,QAAO,QAAQ,OAAO,GAAG;AAC3B,kBAAcD,eAAc,QAAQ,SAAS,GAAG,GAAG,SAAS;AAAA,EAC9D;AACA,SAAO;AACT;AAEA,SAAS,0BAA0B,OAAgB,QAA6B;AAC9E,QAAM,SAAS,iBAAiB,cAAc,KAAK,GAAG,GAAG;AACzD,EAAAF;AAAA,IACE;AAAA,IACA,SACI;AAAA,MACE;AAAA,MACA;AAAA,MACA;AAAA,MACA;AAAA,MACA;AAAA,MACA;AAAA,MACA;AAAA,MACA;AAAA,MACA;AAAA,MACA;AAAA,IACF,IACA;AAAA,MACE;AAAA,MACA;AAAA,MACA;AAAA,MACA;AAAA,MACA;AAAA,MACA;AAAA,MACA;AAAA,MACA;AAAA,IACF;AAAA,IACJ;AAAA,EACF;AACA,cAAYC,gBAAe,QAAQ,UAAU,GAAG,GAAG,sBAAsB,UAAU;AACnF,MAAI,QAAQ;AACV,IAAAA,gBAAe,QAAQ,YAAY,GAAG;AACtC,sBAAkBC,eAAc,QAAQ,aAAa,GAAG,CAAC;AAAA,EAC3D;AACA,EAAAD,gBAAe,QAAQ,YAAY,GAAG;AACtC,EAAAA,gBAAe,QAAQ,YAAY,GAAG;AACtC,kBAAgB,QAAQ,YAAY,KAAK,CAAC;AAC1C,cAAYA,gBAAe,QAAQ,eAAe,GAAG,GAAG;AAAA,IACtD;AAAA,IACA;AAAA,IACA;AAAA,EACF,GAAG,eAAe;AAClB,qBAAmB,QAAQ,eAAe,GAAG;AAC7C,iBAAe,QAAQ,cAAc,GAAG;AACxC,EAAAA,gBAAe,QAAQ,iBAAiB,GAAG;AAC3C,SAAO;AACT;AAEA,SAAS,gCACP,OACA,QACY;AACZ,QAAM,SAAS,iBAAiB,cAAc,KAAK,GAAG,GAAG;AACzD,EAAAD;AAAA,IACE;AAAA,IACA,SACI;AAAA,MACE;AAAA,MACA;AAAA,MACA;AAAA,MACA;AAAA,MACA;AAAA,MACA;AAAA,MACA;AAAA,MACA;AAAA,MACA;AAAA,MACA;AAAA,IACF,IACA;AAAA,MACE;AAAA,MACA;AAAA,MACA;AAAA,MACA;AAAA,MACA;AAAA,MACA;AAAA,MACA;AAAA,MACA;AAAA,IACF;AAAA,IACJ;AAAA,EACF;AACA;AAAA,IACEC,gBAAe,QAAQ,UAAU,GAAG;AAAA,IACpC;AAAA,IACA;AAAA,EACF;AACA,MAAI,QAAQ;AACV,IAAAA,gBAAe,QAAQ,kBAAkB,GAAG;AAC5C,sBAAkBC,eAAc,QAAQ,aAAa,GAAG,CAAC;AAAA,EAC3D;AACA,EAAAD,gBAAe,QAAQ,YAAY,GAAG;AACtC,EAAAA,gBAAe,QAAQ,YAAY,GAAG;AACtC,EAAAA,gBAAe,QAAQ,YAAY,GAAG;AACtC;AAAA,IAAoB;AAAA,IAAQ;AAAA,IAA2B;AAAA,IAAK,CAAC,OAAO,SAClE,YAAY,OAAO,MAAM,IAAI;AAAA,EAC/B;AACA,sBAAoB,QAAQ,8BAA8B,GAAG;AAC7D,EAAAA,gBAAe,QAAQ,kBAAkB,GAAG;AAC5C,qBAAmB,QAAQ,aAAa,GAAG;AAC3C,SAAO;AACT;AAEA,SAAS,kBAAkB,OAAuC;AAChE,QAAM,SAAS,iBAAiB,OAAO,aAAa;AACpD,EAAAD,iBAAgB,QAAQ,CAAC,SAAS,aAAa,OAAO,GAAG,aAAa;AACtE,QAAM,QAAQC,gBAAe,QAAQ,SAAS,aAAa;AAC3D,gCAA8B,KAAK;AACnC,QAAM,YAAYA,gBAAe,QAAQ,aAAa,aAAa;AACnE,QAAM,QAAQA,gBAAe,QAAQ,SAAS,aAAa;AAC3D,uBAAqB,OAAO,KAAK;AACjC,SAAO,EAAE,OAAO,WAAW,MAAM;AACnC;AAEA,SAAS,uBAAuB,OAAgB,MAAoB;AAClE,QAAM,SAAS,iBAAiB,OAAO,IAAI;AAC3C,EAAAD,iBAAgB,QAAQ,CAAC,gBAAgB,cAAc,oBAAoB,GAAG,IAAI;AAClF,EAAAC,gBAAe,QAAQ,gBAAgB,IAAI;AAC3C,EAAAA,gBAAe,QAAQ,cAAc,IAAI;AACzC,QAAM,UAAUG,eAAc,QAAQ,sBAAsB,MAAM,CAAC;AACnE,WAAS,QAAQ,GAAG,QAAQ,QAAQ,QAAQ,SAAS;AACnD,6BAAyB,QAAQ,KAAK,GAAG,GAAG,IAAI,uBAAuB,KAAK,GAAG;AAAA,EACjF;AACF;AAaA,SAAS,yBAAyB,OAAgB,MAAoB;AACpE,QAAM,SAAS,iBAAiB,OAAO,IAAI;AAC3C,MAAI;AACF,UAAM,YAAY,6BAA6B,MAAM;AACrD,QAAI,gBAAgB,MAAM,MAAM,gBAAgB,SAAS,GAAG;AAC1D,YAAM,IAAI,wBAAwB,GAAG,IAAI,0CAA0C;AAAA,IACrF;AAAA,EACF,SAAS,OAAO;AACd,QAAI,iBAAiB,yBAAyB;AAC5C,YAAM;AAAA,IACR;AACA,UAAM,IAAI;AAAA,MACR,iBAAiB,QAAQ,MAAM,UAAU,OAAO,KAAK;AAAA,IACvD;AAAA,EACF;AACF;AAmBA,SAAS,mBAAmB,OAAgB,MAAoB;AAC9D,QAAM,SAAS,iBAAiB,OAAO,IAAI;AAC3C,QAAM,OAAO,OAAO,KAAK,MAAM;AAC/B,MAAI,KAAK,WAAW,GAAG;AACrB,UAAM,IAAI,wBAAwB,GAAG,IAAI,uCAAuC;AAAA,EAClF;AACA,QAAM,MAAM,KAAK,CAAC;AAClB,MAAI,QAAQ,WAAW,QAAQ,SAAS;AACtC,UAAM,SAASC,eAAc,QAAQ,KAAK,MAAM,CAAC;AACjD,aAAS,QAAQ,GAAG,QAAQ,OAAO,QAAQ,SAAS;AAClD,yBAAmB,OAAO,KAAK,GAAG,GAAG,IAAI,IAAI,GAAG,IAAI,KAAK,GAAG;AAAA,IAC9D;AACA;AAAA,EACF;AACA,MAAI,QAAQ,WAAW;AACrB,UAAM,UAAU,iBAAiBC,eAAc,QAAQ,WAAW,IAAI,GAAG,GAAG,IAAI,UAAU;AAC1F,IAAAC,iBAAgB,SAAS,CAAC,KAAK,GAAG,GAAG,IAAI,UAAU;AACnD,IAAAC,gBAAe,SAAS,OAAO,GAAG,IAAI,UAAU;AAChD;AAAA,EACF;AACA,MAAI,QAAQ,YAAY;AACtB,gCAA4BF,eAAc,QAAQ,YAAY,IAAI,GAAG,GAAG,IAAI,WAAW;AACvF;AAAA,EACF;AACA,QAAM,IAAI,wBAAwB,GAAG,IAAI,+BAA+B,GAAG,EAAE;AAC/E;AAEA,SAAS,4BAA4B,OAAgB,MAAoB;AACvE,QAAM,SAAS,iBAAiB,OAAO,IAAI;AAC3C,EAAAC;AAAA,IACE;AAAA,IACA,CAAC,iBAAiB,YAAY,gBAAgB,aAAa,WAAW;AAAA,IACtE;AAAA,EACF;AACA,EAAAC,gBAAe,QAAQ,iBAAiB,IAAI;AAC5C,EAAAA,gBAAe,QAAQ,YAAY,IAAI;AACvC,EAAAF,eAAc,QAAQ,gBAAgB,IAAI;AAC1C,MAAIG,QAAO,QAAQ,WAAW,GAAG;AAC/B,UAAM,YAAY,iBAAiBH,eAAc,QAAQ,aAAa,IAAI,GAAG,GAAG,IAAI,YAAY;AAChG,IAAAC;AAAA,MACE;AAAA,MACA,CAAC,WAAW,mBAAmB,4BAA4B;AAAA,MAC3D,GAAG,IAAI;AAAA,IACT;AACA,mBAAe,WAAW,WAAW,GAAG,IAAI,YAAY;AACxD,QAAIE,QAAO,WAAW,iBAAiB,GAAG;AACxC,0BAAoB,WAAW,mBAAmB,GAAG,IAAI,YAAY;AAAA,IACvE;AACA,oBAAgB,WAAW,8BAA8B,GAAG,IAAI,YAAY;AAAA,EAC9E;AACA,MAAIA,QAAO,QAAQ,WAAW,GAAG;AAC/B,UAAM,YAAY,iBAAiBH,eAAc,QAAQ,aAAa,IAAI,GAAG,GAAG,IAAI,YAAY;AAChG,IAAAC,iBAAgB,WAAW,CAAC,qBAAqB,GAAG,GAAG,IAAI,YAAY;AACvE,oBAAgB,WAAW,uBAAuB,GAAG,IAAI,cAAc,CAAC;AAAA,EAC1E;AACF;AAEA,SAAS,cAAc,OAAgB,MAAoB;AACzD,QAAM,SAAS,iBAAiB,OAAO,IAAI;AAC3C,EAAAA,iBAAgB,QAAQ,CAAC,UAAU,iBAAiB,kBAAkB,YAAY,GAAG,IAAI;AACzF,cAAYC,gBAAe,QAAQ,UAAU,IAAI,GAAG,uBAAuB,GAAG,IAAI,SAAS;AAC3F,kBAAgB,QAAQ,iBAAiB,MAAM,CAAC;AAChD,cAAYA,gBAAe,QAAQ,kBAAkB,IAAI,GAAG;AAAA,IAC1D;AAAA,IACA;AAAA,EACF,GAAG,GAAG,IAAI,iBAAiB;AAC3B,cAAYA,gBAAe,QAAQ,cAAc,IAAI,GAAG;AAAA,IACtD;AAAA,IACA;AAAA,EACF,GAAG,GAAG,IAAI,aAAa;AACzB;AAEA,SAAS,mBAAmB,OAAgB,MAAoB;AAC9D,QAAM,SAAS,iBAAiB,OAAO,IAAI;AAC3C,EAAAD,iBAAgB,QAAQ,CAAC,QAAQ,GAAG,IAAI;AACxC,cAAYC,gBAAe,QAAQ,UAAU,IAAI,GAAG,CAAC,QAAQ,QAAQ,OAAO,GAAG,GAAG,IAAI,SAAS;AACjG;AAEA,SAAS,cAAc,OAAgB,MAAoB;AACzD,QAAM,SAAS,iBAAiB,OAAO,IAAI;AAC3C,EAAAD,iBAAgB,QAAQ,CAAC,UAAU,GAAG,IAAI;AAC1C,cAAYC,gBAAe,QAAQ,YAAY,IAAI,GAAG,CAAC,OAAO,YAAY,MAAM,GAAG,GAAG,IAAI,WAAW;AACvG;AAEA,SAAS,oBACP,UACA,YACsB;AACtB,QAAM,MAAM,gBAAgB,QAAQ;AACpC,QAAM,WAAWE,aAAY,OAAO,GAAG;AACvC,QAAMC,UAAS,YAAY,YAAYD,aAAY,OAAO,GAAG,WAAW,MAAM,IAAI,GAAG,QAAQ,CAAC;AAC9F,QAAM,KAAK,GAAG,WAAW,QAAQ,GAAG,iBAAiBC,OAAM,CAAC;AAC5D,SAAO;AAAA,IACL,MAAM,WAAW;AAAA,IACjB,SAAS,WAAW;AAAA,IACpB;AAAA,IACA,QAAQ,WAAW;AAAA,IACnB;AAAA,IACA;AAAA,IACA;AAAA,IACA,QAAAA;AAAA,IACA,eAAW,yBAAWA,OAAM,EAAE,MAAM,CAAC;AAAA,EACvC;AACF;AAEA,SAAS,gBACP,QACA,UACA,YACM;AACN,QAAM,SAASH,gBAAe,QAAQ,WAAW,SAAS,GAAG;AAC7D,MAAI,WAAW,SAAS,IAAI;AAC1B;AAAA,EACF;AACA,MAAI,IAAI,OAAO,IAAI,WAAW,QAAQ,eAAe,EAAE,KAAK,MAAM,GAAG;AACnE,UAAM,IAAI;AAAA,MACR,GAAG,WAAW,OAAO;AAAA,IACvB;AAAA,EACF;AACA,QAAM,IAAI,oBAAoB,GAAG,WAAW,OAAO,mBAAmB,WAAW,QAAQ,EAAE;AAC7F;AAiBA,SAAS,iCACP,QACA,WACM;AACN,MAAI,CAACI,QAAO,QAAQ,eAAe,GAAG;AACpC;AAAA,EACF;AACA,QAAM,gBAAgBC,gBAAe,QAAQ,iBAAiB,GAAG;AACjE,MAAI,UAAU,cAAc,eAAe;AACzC,UAAM,IAAI;AAAA,MACR,uBAAuB,UAAU,SAAS,iCAAiC,aAAa;AAAA,IAC1F;AAAA,EACF;AACF;AAiBA,eAAe,gBACb,WACAC,SACkB;AAClB,MAAI,UAAU,UAAU,6BAA6B;AACnD,UAAM,YAAY,2BAA2B,UAAU,SAAS;AAChE,UAAM,iBAAiB,qBAAqB,UAAU,OAAO,UAAU,KAAK;AAC5E,QAAI;AACF,aAAO,uBAAQ,OAAO,gBAAgBA,SAAQ,SAAS;AAAA,IACzD,QAAQ;AACN,YAAM,IAAI,2BAA2B,uCAAuC;AAAA,IAC9E;AAAA,EACF;AAEA,MAAI,UAAU,UAAU,4BAA4B;AAClD,UAAM,MAAM,YAAY,UAAU,SAAS;AAC3C,UAAM,iBAAiB,qBAAqB,UAAU,OAAO,UAAU,KAAK;AAC5E,QAAI;AACF,iBAAO,4BAAc;AAAA,QACnB,SAAS,IAAI;AAAA,QACb,SAAS,EAAE,KAAKA,QAAO;AAAA,QACvB,eAAW,yBAAW,cAAc;AAAA,MACtC,CAAC;AAAA,IACH,QAAQ;AACN,YAAM,IAAI,2BAA2B,uCAAuC;AAAA,IAC9E;AAAA,EACF;AAEA,QAAM,IAAI,+BAA+B,gCAAgC,UAAU,KAAK,EAAE;AAC5F;AAEA,SAAS,2BAA2B,KAAyB;AAC3D,MAAI,CAAC,IAAI,WAAW,UAAU,GAAG;AAC/B,UAAM,IAAI,uBAAuB,mCAAmC;AAAA,EACtE;AACA,QAAM,aAAa,IAAI,MAAM,WAAW,MAAM;AAC9C,MAAI,CAAC,WAAW,WAAW,GAAG,GAAG;AAC/B,UAAM,IAAI,uBAAuB,sCAAsC;AAAA,EACzE;AACA,MAAI;AACJ,MAAI;AACF,YAAQ,MAAM,UAAU,OAAO,UAAU;AAAA,EAC3C,QAAQ;AACN,UAAM,IAAI,uBAAuB,kCAAkC;AAAA,EACrE;AACA,MAAI,MAAM,WAAW,MAAM,MAAM,CAAC,MAAM,OAAQ,MAAM,CAAC,MAAM,GAAM;AACjE,WAAO,MAAM,MAAM,CAAC;AAAA,EACtB;AACA,QAAM,IAAI,uBAAuB,yCAAyC;AAC5E;AAEA,SAAS,YAAY,KAAyC;AAC5D,MAAI;AACJ,MAAI;AACF,aAAS,YAAY,GAAG;AAAA,EAC1B,QAAQ;AACN,UAAM,IAAI,uBAAuB,kCAAkC;AAAA,EACrE;AACA,MAAI,CAAC,QAAQ;AACX,UAAM,IAAI,uBAAuB,mCAAmC;AAAA,EACtE;AACA,SAAO,EAAE,SAAS,OAAO,QAAQ;AACnC;AAEA,SAAS,qBAAqB,OAAe,OAAmC;AAC9E,MAAI,MAAM,WAAW,KAAK,CAAC,aAAa,KAAK,KAAK,KAAK,MAAM,SAAS,GAAG,GAAG;AAC1E,UAAM,IAAI,uBAAuB,mDAAmD;AAAA,EACtF;AACA,QAAM,QAAQ,gBAAgB,KAAK;AACnC,MAAI,UAAU,+BAA+B,MAAM,WAAW,IAAI;AAChE,UAAM,IAAI,uBAAuB,oCAAoC;AAAA,EACvE;AACA,MAAI,UAAU,4BAA4B;AACxC,QAAI,MAAM,WAAW,IAAI;AACvB,YAAM,IAAI,uBAAuB,oCAAoC;AAAA,IACvE;AACA,UAAM,IAAI,MAAM,EAAE;AAClB,QAAI,MAAM,MAAM,MAAM,IAAI;AACxB,YAAM,IAAI,uBAAuB,gDAAgD;AAAA,IACnF;AAAA,EACF;AACA,SAAO;AACT;AAkBA,SAAS,uBACP,QACA,YACY;AACZ,QAAM,SAAS,uBAAO,OAAO,IAAI;AACjC,aAAW,CAAC,KAAK,KAAK,KAAK,OAAO,QAAQ,MAAM,GAAG;AACjD,QAAI,QAAQ,WAAW,WAAW,QAAQ,aAAa;AACrD;AAAA,IACF;AACA,WAAO,GAAG,IAAI;AAAA,EAChB;AACA,SAAO;AACT;AAOA,SAAS,oBAAoB,QAAkC;AAC7D,MAAI,WAAW,cAAe,QAAO,YAAY;AACjD,MAAI,WAAW,qBAAsB,QAAO,YAAY;AACxD,MAAI,WAAW,4BAA6B,QAAO,YAAY;AAC/D,QAAM,IAAI,wBAAwB,qCAAqC,MAAM,EAAE;AACjF;AAEA,SAAS,iBAAiB,OAAgB,MAA0B;AAClE,MAAI,UAAU,QAAQ,OAAO,UAAU,YAAY,MAAM,QAAQ,KAAK,GAAG;AACvE,UAAM,IAAI,wBAAwB,GAAG,IAAI,oBAAoB;AAAA,EAC/D;AACA,SAAO;AACT;AAEA,SAASC,iBAAgB,QAAoB,SAA4B,MAAoB;AAC3F,QAAM,aAAa,IAAI,IAAI,OAAO;AAClC,aAAW,OAAO,OAAO,KAAK,MAAM,GAAG;AACrC,QAAI,CAAC,WAAW,IAAI,GAAG,GAAG;AACxB,YAAM,IAAI,wBAAwB,GAAG,IAAI,sBAAsB,GAAG,EAAE;AAAA,IACtE;AAAA,EACF;AACF;AAEA,SAASC,eAAc,QAAoB,KAAa,MAAyB;AAC/E,MAAI,CAACC,QAAO,QAAQ,GAAG,GAAG;AACxB,UAAM,IAAI,wBAAwB,GAAG,IAAI,IAAI,GAAG,cAAc;AAAA,EAChE;AACA,SAAO,OAAO,GAAG;AACnB;AAEA,SAASC,gBAAe,QAAoB,KAAa,MAAsB;AAC7E,SAAO,kBAAkBF,eAAc,QAAQ,KAAK,IAAI,GAAG,GAAG,IAAI,IAAI,GAAG,EAAE;AAC7E;AAEA,SAAS,eAAe,QAAoB,KAAa,MAAoB;AAC3E,MAAI,CAACC,QAAO,QAAQ,GAAG,GAAG;AACxB;AAAA,EACF;AACA,oBAAkBD,eAAc,QAAQ,KAAK,IAAI,GAAG,GAAG,IAAI,IAAI,GAAG,EAAE;AACtE;AAEA,SAAS,kBAAkB,OAAkB,MAAsB;AACjE,MAAI,OAAO,UAAU,YAAY,MAAM,WAAW,GAAG;AACnD,UAAM,IAAI,wBAAwB,GAAG,IAAI,6BAA6B;AAAA,EACxE;AACA,SAAO;AACT;AAEA,SAAS,gBAAgB,QAAoB,KAAa,MAAoB;AAC5E,MAAI,CAACC,QAAO,QAAQ,GAAG,GAAG;AACxB;AAAA,EACF;AACA,MAAI,OAAOD,eAAc,QAAQ,KAAK,IAAI,MAAM,WAAW;AACzD,UAAM,IAAI,wBAAwB,GAAG,IAAI,IAAI,GAAG,oBAAoB;AAAA,EACtE;AACF;AAEA,SAAS,gBACP,QACA,KACA,MACA,SACQ;AACR,QAAM,QAAQA,eAAc,QAAQ,KAAK,IAAI;AAC7C,MAAI,OAAO,UAAU,YAAY,CAAC,OAAO,cAAc,KAAK,KAAK,QAAQ,SAAS;AAChF,UAAM,IAAI;AAAA,MACR,GAAG,IAAI,IAAI,GAAG,0BAA0B,OAAO;AAAA,IACjD;AAAA,EACF;AACA,SAAO;AACT;AAEA,SAASG,eACP,QACA,KACA,MACA,SACsB;AACtB,QAAM,QAAQH,eAAc,QAAQ,KAAK,IAAI;AAC7C,MAAI,CAAC,MAAM,QAAQ,KAAK,KAAK,MAAM,SAAS,SAAS;AACnD,UAAM,IAAI;AAAA,MACR,GAAG,IAAI,IAAI,GAAG,mCAAmC,OAAO;AAAA,IAC1D;AAAA,EACF;AACA,SAAO;AACT;AAEA,SAAS,oBACP,QACA,KACA,MACA,OACM;AACN,QAAM,SAASG,eAAc,QAAQ,KAAK,MAAM,CAAC;AACjD,WAAS,QAAQ,GAAG,QAAQ,OAAO,QAAQ,SAAS;AAClD,UAAM,WAAW,GAAG,IAAI,IAAI,GAAG,IAAI,KAAK;AACxC,UAAM,QAAQ,kBAAkB,OAAO,KAAK,GAAG,QAAQ;AACvD,YAAQ,OAAO,QAAQ;AAAA,EACzB;AACF;AAEA,SAAS,mBAAmB,QAAoB,KAAa,MAAoB;AAC/E,gBAAcD,gBAAe,QAAQ,KAAK,IAAI,GAAG,GAAG,IAAI,IAAI,GAAG,EAAE;AACnE;AAEA,SAAS,mBAAmB,QAAoB,KAAa,MAAoB;AAC/E,MAAI,CAACD,QAAO,QAAQ,GAAG,GAAG;AACxB;AAAA,EACF;AACA,gBAAcC,gBAAe,QAAQ,KAAK,IAAI,GAAG,GAAG,IAAI,IAAI,GAAG,EAAE;AACnE;AAEA,SAAS,cAAc,OAAe,MAAoB;AACxD,QAAM,QAAQ,MAAM;AAAA,IAClB;AAAA,EACF;AACA,MAAI,CAAC,OAAO;AACV,UAAM,IAAI,wBAAwB,GAAG,IAAI,0BAA0B;AAAA,EACrE;AACA,QAAM,SAAS,KAAK,MAAM,KAAK;AAC/B,MAAI,OAAO,MAAM,MAAM,GAAG;AACxB,UAAM,IAAI,wBAAwB,GAAG,IAAI,yCAAyC;AAAA,EACpF;AACA,QAAM,YAAY,IAAI,KAAK,MAAM,EAAE,YAAY,EAAE,QAAQ,SAAS,GAAG;AACrE,MAAI,cAAc,OAAO;AACvB,UAAM,IAAI,wBAAwB,GAAG,IAAI,4CAA4C;AAAA,EACvF;AACF;AAEA,SAAS,YAA8B,QAAgB,UAAa,MAAiB;AACnF,MAAI,WAAW,UAAU;AACvB,UAAM,IAAI,wBAAwB,GAAG,IAAI,YAAY,QAAQ,EAAE;AAAA,EACjE;AACA,SAAO;AACT;AAEA,SAAS,YACP,QACA,SACA,MACG;AACH,aAAW,SAAS,SAAS;AAC3B,QAAI,WAAW,OAAO;AACpB,aAAO;AAAA,IACT;AAAA,EACF;AACA,QAAM,IAAI,wBAAwB,GAAG,IAAI,0BAA0B,MAAM,EAAE;AAC7E;AAEA,SAASD,QAAO,QAAoB,KAAsB;AACxD,SAAOG,cAAa,QAAQ,GAAG;AACjC;AAEA,SAAS,8BAA8B,OAAgD;AACrF,MAAI,UAAU,+BAA+B,UAAU,4BAA4B;AACjF,UAAM,IAAI,+BAA+B,gCAAgC,KAAK,EAAE;AAAA,EAClF;AACF;AAEA,SAAS,YAAY,OAA+B;AAClD,aAAO,qBAAO,OAAO,OAAO;AAC9B;AAEA,SAAS,YAAY,MAAkB,OAA+B;AACpE,QAAM,SAAS,IAAI,WAAW,KAAK,SAAS,MAAM,MAAM;AACxD,SAAO,IAAI,MAAM,CAAC;AAClB,SAAO,IAAI,OAAO,KAAK,MAAM;AAC7B,SAAO;AACT;AAEA,SAAS,iBAAiB,OAA2B;AACnD,MAAI,SAAS;AACb,MAAI,SAAS;AACb,MAAI,OAAO;AACX,aAAW,QAAQ,OAAO;AACxB,aAAU,UAAU,IAAK;AACzB,YAAQ;AACR,WAAO,QAAQ,GAAG;AAChB,cAAQ;AACR,gBAAU,gBAAiB,UAAU,OAAQ,EAAE;AAAA,IACjD;AAAA,EACF;AACA,MAAI,OAAO,GAAG;AACZ,cAAU,gBAAiB,UAAW,IAAI,OAAS,EAAE;AAAA,EACvD;AACA,SAAO;AACT;AAEA,SAAS,gBAAgB,OAA2B;AAClD,QAAMC,YACJ;AACF,MAAI,SAAS;AACb,WAAS,QAAQ,GAAG,QAAQ,MAAM,QAAQ,SAAS,GAAG;AACpD,UAAM,IAAI,MAAM,KAAK;AACrB,UAAM,IAAI,MAAM,QAAQ,CAAC;AACzB,UAAM,IAAI,MAAM,QAAQ,CAAC;AACzB,UAAM,UAAW,KAAK,MAAQ,KAAK,MAAM,KAAM,KAAK;AACpD,cAAUA,UAAU,WAAW,KAAM,EAAE;AACvC,cAAUA,UAAU,WAAW,KAAM,EAAE;AACvC,QAAI,QAAQ,IAAI,MAAM,QAAQ;AAC5B,gBAAUA,UAAU,WAAW,IAAK,EAAE;AAAA,IACxC;AACA,QAAI,QAAQ,IAAI,MAAM,QAAQ;AAC5B,gBAAUA,UAAS,UAAU,EAAE;AAAA,IACjC;AAAA,EACF;AACA,SAAO;AACT;AAEA,SAAS,gBAAgB,OAA2B;AAClD,MAAI,MAAM,SAAS,MAAM,GAAG;AAC1B,UAAM,IAAI,uBAAuB,4CAA4C;AAAA,EAC/E;AACA,QAAMA,YACJ;AACF,QAAM,QAAkB,CAAC;AACzB,MAAI,SAAS;AACb,MAAI,OAAO;AACX,aAAW,QAAQ,OAAO;AACxB,UAAM,QAAQA,UAAS,QAAQ,IAAI;AACnC,QAAI,QAAQ,GAAG;AACb,YAAM,IAAI,uBAAuB,kCAAkC;AAAA,IACrE;AACA,aAAU,UAAU,IAAK;AACzB,YAAQ;AACR,QAAI,QAAQ,GAAG;AACb,cAAQ;AACR,YAAM,KAAM,UAAU,OAAQ,GAAI;AAAA,IACpC;AAAA,EACF;AACA,QAAM,UAAU,WAAW,KAAK,KAAK;AACrC,MAAI,gBAAgB,OAAO,MAAM,OAAO;AACtC,UAAM,IAAI,uBAAuB,4CAA4C;AAAA,EAC/E;AACA,SAAO;AACT;;;AczkCO,IAAM,oCACX;AACK,IAAM,6BACX;AACK,IAAM,oBAAoB;AAC1B,IAAM,6BAA6B;AAiBnC,IAAM,uBAAN,cAAmC,MAAM;AAAA,EAG9C,YAAYC,OAAgC,SAAiB;AAC3D,UAAM,OAAO;AACb,SAAK,OAAO;AACZ,SAAK,OAAOA;AAAA,EACd;AACF;AA0TA,eAAsB,qCACpB,SAC6B;AAC7B,QAAM,aAAaC,cAAa,SAAS,KAAK,4BAA4B;AAC1E,EAAAC;AAAA,IACE;AAAA,IACA;AAAA,MACE;AAAA,MACA;AAAA,MACA;AAAA,MACA;AAAA,MACA;AAAA,MACA;AAAA,MACA;AAAA,IACF;AAAA,IACA;AAAA,EACF;AACA,MAAI,CAACC,QAAO,YAAY,cAAc,GAAG;AACvC,UAAM,IAAI;AAAA,MACR;AAAA,MACA;AAAA,IACF;AAAA,EACF;AACA,QAAM,eAAe,WAAW,cAAc;AAC9C,MACE,iBAAiB,QACjB,OAAO,iBAAiB,YACxB,MAAM,QAAQ,YAAY,GAC1B;AACA,UAAM,IAAI;AAAA,MACR;AAAA,MACA;AAAA,IACF;AAAA,EACF;AACA,QAAM,eAAe;AACrB,QAAM,YAAY;AAAA,IAChB;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,EACF;AACA,QAAM,MAAM;AAAA,IACV;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,EACF;AACA,QAAM,YAAY,mBAAmB,WAAW,0BAA0B;AAC1E,QAAM,QAAQ,mBAAmB,KAAK,OAAO;AAC7C,MAAI,aAAa,OAAO;AACtB,UAAM,IAAI;AAAA,MACR;AAAA,MACA;AAAA,IACF;AAAA,EACF;AAEA,MAAI;AACJ,MAAI;AACF,gBAAY,MAAM,yBAAyB,YAAY,GAAG;AAAA,EAC5D,SAAS,OAAO;AACd,UAAM,IAAI;AAAA,MACR;AAAA,MACA,iBAAiB,QAAQ,MAAM,UAAU,OAAO,KAAK;AAAA,IACvD;AAAA,EACF;AACA,MAAI,SAAS,UAAU,cAAc,SAAS,UAAU;AACtD,UAAM,IAAI;AAAA,MACR;AAAA,MACA;AAAA,IACF;AAAA,EACF;AAEA,QAAM,mBAAmBC,gBAAe,YAAY,YAAY,GAAG;AACnE,MAAI,SAAS,aAAa,kBAAkB;AAC1C,UAAM,IAAI;AAAA,MACR;AAAA,MACA;AAAA,IACF;AAAA,EACF;AACA,QAAM,mBAAmBA,gBAAe,YAAY,YAAY,GAAG;AACnE,MAAI,SAAS,aAAa,kBAAkB;AAC1C,UAAM,IAAI;AAAA,MACR;AAAA,MACA;AAAA,IACF;AAAA,EACF;AACA,QAAM,yBAAyBA;AAAA,IAC7B;AAAA,IACA;AAAA,IACA;AAAA,EACF;AACA,MAAI,SAAS,mBAAmB,wBAAwB;AACtD,UAAM,IAAI;AAAA,MACR;AAAA,MACA;AAAA,IACF;AAAA,EACF;AACA,QAAM,wBAAwBD,QAAO,YAAY,uBAAuB,IACpEC,gBAAe,YAAY,yBAAyB,GAAG,IACvD;AACJ,MAAI,CAAC,SAAS,wBAAwB,SAAS,qBAAqB,GAAG;AACrE,UAAM,IAAI;AAAA,MACR;AAAA,MACA;AAAA,IACF;AAAA,EACF;AACA,QAAM,2BAA2BD;AAAA,IAC/B;AAAA,IACA;AAAA,EACF,IACIC,gBAAe,YAAY,4BAA4B,GAAG,IAC1D;AACJ,MAAI,CAAC,SAAS,2BAA2B,SAAS,wBAAwB,GAAG;AAC3E,UAAM,IAAI;AAAA,MACR;AAAA,MACA;AAAA,IACF;AAAA,EACF;AACA,SAAO;AACT;AAEA,SAASH,cACP,OACA,MACAI,OACY;AACZ,MAAI;AACF,UAAM,aAAa,cAAc,KAAK;AACtC,QACE,eAAe,QACf,OAAO,eAAe,YACtB,MAAM,QAAQ,UAAU,GACxB;AACA,YAAM,IAAI,qBAAqBA,OAAM,GAAG,IAAI,oBAAoB;AAAA,IAClE;AACA,WAAO;AAAA,EACT,SAAS,OAAO;AACd,QAAI,iBAAiB,sBAAsB;AACzC,YAAM;AAAA,IACR;AACA,UAAM,IAAI;AAAA,MACRA;AAAA,MACA,iBAAiB,QAAQ,MAAM,UAAU,OAAO,KAAK;AAAA,IACvD;AAAA,EACF;AACF;AAmBA,SAASC,iBACP,QACA,SACA,MACM;AACN,QAAM,aAAa,IAAI,IAAI,OAAO;AAClC,aAAW,OAAO,OAAO,KAAK,MAAM,GAAG;AACrC,QAAI,CAAC,WAAW,IAAI,GAAG,GAAG;AACxB,YAAM,IAAI;AAAA,QACR;AAAA,QACA,GAAG,IAAI,sBAAsB,GAAG;AAAA,MAClC;AAAA,IACF;AAAA,EACF;AACF;AAEA,SAASC,eACP,QACA,KACA,MACW;AACX,MAAI,CAACC,QAAO,QAAQ,GAAG,GAAG;AACxB,UAAM,IAAI;AAAA,MACR;AAAA,MACA,GAAG,IAAI,IAAI,GAAG;AAAA,IAChB;AAAA,EACF;AACA,SAAO,OAAO,GAAG;AACnB;AAEA,SAASC,gBAAe,QAAoB,KAAa,MAAsB;AAC7E,QAAM,QAAQF,eAAc,QAAQ,KAAK,IAAI;AAC7C,MAAI,OAAO,UAAU,YAAY,MAAM,WAAW,GAAG;AACnD,UAAM,IAAI;AAAA,MACR;AAAA,MACA,GAAG,IAAI,IAAI,GAAG;AAAA,IAChB;AAAA,EACF;AACA,SAAO;AACT;AAEA,SAAS,YACP,QACA,KACA,MACAG,OACQ;AACR,MAAI,CAACF,QAAO,QAAQ,GAAG,GAAG;AACxB,UAAM,IAAI,qBAAqBE,OAAM,GAAG,IAAI,IAAI,GAAG,cAAc;AAAA,EACnE;AACA,QAAM,QAAQ,OAAO,GAAG;AACxB,MAAI,OAAO,UAAU,YAAY,MAAM,WAAW,GAAG;AACnD,UAAM,IAAI;AAAA,MACRA;AAAA,MACA,GAAG,IAAI,IAAI,GAAG;AAAA,IAChB;AAAA,EACF;AACA,SAAO;AACT;AAuHA,SAAS,mBAAmB,OAAe,MAAsB;AAC/D,QAAM,QAAQ,MAAM;AAAA,IAClB;AAAA,EACF;AACA,MAAI,CAAC,OAAO;AACV,UAAM,IAAI;AAAA,MACR;AAAA,MACA,GAAG,IAAI;AAAA,IACT;AAAA,EACF;AACA,QAAM,SAAS,KAAK,MAAM,KAAK;AAC/B,MAAI,OAAO,MAAM,MAAM,GAAG;AACxB,UAAM,IAAI;AAAA,MACR;AAAA,MACA,GAAG,IAAI;AAAA,IACT;AAAA,EACF;AACA,QAAM,YAAY,IAAI,KAAK,MAAM,EAAE,YAAY,EAAE,QAAQ,SAAS,GAAG;AACrE,MAAI,cAAc,OAAO;AACvB,UAAM,IAAI;AAAA,MACR;AAAA,MACA,GAAG,IAAI;AAAA,IACT;AAAA,EACF;AACA,SAAO;AACT;AAEA,IAAMC,gBAEF,OAGA,UACD,OAAO,UAAU,eAAe,KAAK;AAAA,EACpC,OAAO,UAAU;AACnB;AAEF,SAASC,QAAO,QAAoB,KAAsB;AACxD,SAAOD,cAAa,QAAQ,GAAG;AACjC;;;A5BhtBO,IAAM,gCAAgC;AACtC,IAAM,kCAAkC;AACxC,IAAM,sCAAsC;AAE5C,IAAM,yCACX;AACK,IAAM,0CACX;AACK,IAAM,uCACX;AACK,IAAM,8BACX;AACK,IAAM,yCACX;AACK,IAAM,6BACX;AAEK,IAAM,gDAAgD;AAAA,EAC3D;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AACF;AA8CO,IAAM,2BAAN,cAAuC,MAAM;AAAA,EAMlD,YACEE,OACA,SACA,QAAuC,WACvC,YACA,QACA;AACA,UAAM,OAAO;AACb,SAAK,OAAO;AACZ,SAAK,OAAOA;AACZ,SAAK,QAAQ;AACb,SAAK,aAAa;AAClB,SAAK,SAAS;AAAA,EAChB;AACF;AA8IA,IAAM,kBAAsC,aAAE;AAAA,EAAK,MACjD,aAAE,MAAM;AAAA,IACN,aAAE,OAAO;AAAA,IACT,aAAE,OAAO,EAAE,OAAO;AAAA,IAClB,aAAE,QAAQ;AAAA,IACV,aAAE,KAAK;AAAA,IACP,aAAE,MAAM,eAAe;AAAA,IACvB,aAAE,OAAO,eAAe;AAAA,EAC1B,CAAC;AACH;AAEA,IAAM,gBAAgB,aACnB,OAAO,EACP,OAAO,CAAC,UAAUC,oBAAmB,KAAK,MAAM,QAAW;AAAA,EAC1D,SAAS;AACX,CAAC;AAEH,IAAM,qBAAqB,aACxB,OAAO;AAAA,EACN,QAAQ,aAAE,OAAO;AAAA,EACjB,gBAAgB,aAAE,OAAO;AAAA,EACzB,UAAU,aAAE,OAAO;AAAA,EACnB,UAAU,aAAE,OAAO;AAAA,EACnB,UAAU,aAAE,OAAO;AAAA,EACnB,yBAAyB,aAAE,MAAM,aAAE,OAAO,CAAC;AAAA,EAC3C,4BAA4B,aAAE,MAAM,aAAE,OAAO,CAAC;AAAA,EAC9C,gBAAgB,aAAE,OAAO;AAAA,EACzB,WAAW;AAAA,EACX,WAAW,aACR,OAAO;AAAA,IACN,OAAO,aAAE,OAAO;AAAA,IAChB,WAAW,aAAE,OAAO;AAAA,IACpB,OAAO,aAAE,OAAO;AAAA,EAClB,CAAC,EACA,OAAO;AACZ,CAAC,EACA,OAAO;AAEV,IAAM,qBAAqB,aACxB,OAAO;AAAA,EACN,UAAU,aAAE,OAAO,EAAE,IAAI;AAAA,EACzB,UAAU,aAAE,OAAO;AAAA,EACnB,4BAA4B,aAAE,MAAM;AAAA,IAClC,aAAE,QAAQ,0BAA0B;AAAA,EACtC,CAAC;AAAA,EACD,cAAc;AAChB,CAAC,EACA,OAAO;AAEV,IAAM,kBAAkB,aACrB,OAAO;AAAA,EACN,QAAQ,aAAE,QAAQ,0BAA0B;AAAA,EAC5C,UAAU,aAAE,OAAO,EAAE,IAAI;AAAA,EACzB,SAAS,aAAE,OAAO,EAAE,IAAI,CAAC;AAC3B,CAAC,EACA,OAAO;AAEV,IAAM,qBAAqB,aACxB,OAAO;AAAA,EACN,cAAc,aAAE,OAAO;AAAA,EACvB,YAAY,aAAE,OAAO;AAAA,EACrB,uBAAuB,aAAE,MAAM,eAAe,EAAE,IAAI,CAAC;AACvD,CAAC,EACA,OAAO;AAEV,IAAM,kBAAkB,aACrB,OAAO;AAAA,EACN,QAAQ,aAAE,QAAQ,iCAAiC;AAAA,EACnD,UAAU,aAAE,OAAO;AAAA,EACnB,cAAc;AAAA,EACd,WAAW;AAAA,EACX,cAAc;AAChB,CAAC,EACA,OAAO;AAEV,IAAM,kBAAkB,aACrB,OAAO;AAAA,EACN,OAAO,aAAE,OAAO;AAAA,EAChB,WAAW,aAAE,OAAO;AAAA,EACpB,OAAO,aAAE,OAAO;AAClB,CAAC,EACA,OAAO;AAEV,IAAM,kBAAkB,aACrB,OAAO;AAAA,EACN,QAAQ,aAAE,QAAQ,uCAAuC;AAAA,EACzD,aAAa,aAAE,OAAO;AAAA,EACtB,UAAU,aAAE,OAAO;AAAA,EACnB,UAAU,aAAE,OAAO;AAAA,EACnB,OAAO,aAAE,OAAO,EAAE,IAAI,EAAE;AAAA,EACxB,oBAAoB;AAAA,EACpB,gBAAgB,aAAE,MAAM,aAAE,OAAO,CAAC,EAAE,IAAI,CAAC;AAAA,EACzC,+BAA+B,aAAE,MAAM,eAAe,EAAE,SAAS;AAAA,EACjE,WAAW;AACb,CAAC,EACA,OAAO;AAEV,IAAM,0BAA0B,aAC7B,OAAO,EAAE,WAAW,gBAAgB,CAAC,EACrC,OAAO;AAEV,IAAM,eAAe,aAClB,OAAO;AAAA,EACN,QAAQ,aAAE,QAAQ,2BAA2B;AAAA,EAC7C,MAAM,aAAE,KAAK,6CAA6C;AAAA,EAC1D,SAAS,aAAE,OAAO,EAAE,SAAS;AAC/B,CAAC,EACA,OAAO;AAEV,IAAM,4BAA4B,aAC/B,OAAO;AAAA,EACN,OAAO,aACJ,OAAO;AAAA,IACN,MAAM,aAAE,KAAK,6CAA6C;AAAA,IAC1D,SAAS,aAAE,OAAO,EAAE,SAAS;AAAA,EAC/B,CAAC,EACA,OAAO;AACZ,CAAC,EACA,OAAO;AAEV,IAAM,uBAAuB,aAC1B,OAAO;AAAA,EACN,cAAc,aAAE,OAAO;AAAA,EACvB,YAAY,aAAE,OAAO,EAAE,IAAI,CAAC;AAAA,EAC5B,WAAW,aAAE,OAAO;AAAA,EACpB,WAAW,aAAE,OAAO;AAAA,EACpB,UAAU,aAAE,OAAO;AAAA,EACnB,mBAAmB,aAAE,OAAO,EAAE,MAAM,gBAAgB;AAAA,EACpD,gBAAgB,aAAE,QAAQ,cAAc;AAAA,EACxC,UAAU;AAAA,EACV,WAAW;AAAA,EACX,UAAU,aAAE,QAAQ;AAAA,EACpB,SAAS,aAAE,OAAO;AACpB,CAAC,EACA,OAAO;AAEV,IAAM,wBAAwB,aAC3B,OAAO,EAAE,YAAY,qBAAqB,CAAC,EAC3C,OAAO;AACV,IAAM,wBAAwB,aAC3B,OAAO;AAAA,EACN,KAAK,aAAE,OAAO,EAAE,IAAI,CAAC;AAAA,EACrB,WAAW,aAAE,MAAM,aAAE,OAAO,CAAC;AAAA,EAC7B,SAAS,aAAE,MAAM,aAAE,OAAO,CAAC;AAC7B,CAAC,EACA,OAAO;AAEV,IAAM,wBAAwB,aAC3B,OAAO,EAAE,MAAM,aAAE,MAAM,eAAe,EAAE,CAAC,EACzC,OAAO;AACV,IAAM,uBAAuB,aAAE,OAAO,EAAE,OAAO,gBAAgB,CAAC,EAAE,OAAO;AAElE,IAAM,+BAA+B;AAAA,EAC1C;AAAA,IACE,MAAM;AAAA,IACN,KAAK;AAAA,IACL,aAAa,CAAC,EAAE,OAAO,GAAG,OAAO,mBAAmB,CAAC;AAAA,EACvD;AAAA,EACA;AAAA,IACE,MAAM;AAAA,IACN,KAAK;AAAA,IACL,aAAa,CAAC,EAAE,OAAO,GAAG,OAAO,mBAAmB,CAAC;AAAA,EACvD;AACF;AAcO,SAAS,oCACd,eACA,gBACQ;AACR,MAAI,eAAe,WAAW,GAAG;AAC/B,UAAM,IAAI;AAAA,MACR;AAAA,MACA;AAAA,MACA;AAAA,IACF;AAAA,EACF;AACA,SAAO,GAAG,aAAa,IAAI,mBAAmB,cAAc,CAAC;AAC/D;AAKA,IAAM,+BACJ,IAAI;AAAA,EACF,6BAA6B,IAAI,CAAC,cAAc;AAAA,IAC9C,UAAU;AAAA,IACV;AAAA,EACF,CAAC;AACH;AAEK,IAAM,sBAAN,MAAM,qBAAoB;AAAA,EA4BvB,YACN,WACA,uBACA,wBACAC,4BACA,+BACA,uBACA,oBACA,SACA;AAdF,SAAiB,sBAAsB,oBAAI,IAAY;AAGvD,SAAQ,cAAc;AAYpB,SAAK,YAAY;AACjB,SAAK,wBAAwB;AAC7B,SAAK,yBAAyB;AAC9B,SAAK,4BAA4BA;AACjC,SAAK,eAAe,QAAQ;AAC5B,SAAK,WAAW,QAAQ;AACxB,SAAK,WAAW,QAAQ;AACxB,SAAK,iBAAiB,QAAQ;AAC9B,SAAK,YAAY,QAAQ;AACzB,SAAK,oBAAoB,QAAQ;AACjC,SAAK,uBAAuB,QAAQ;AACpC,SAAK,gCAAgC;AACrC,SAAK,wBAAwB;AAC7B,SAAK,qBAAqB;AAC1B,SAAK,qBACH,QAAQ,sBACR,QAAQ,mBAAmB,sBAC3B,QAAQ;AACV,SAAK,gBAAgB,QAAQ,iBAC3B,QAAQ,mBAAmB,iBAAiB;AAAA,MAC1C,MAAM;AAAA,MACN,YAAY;AAAA,QACV,QAAQ;AAAA,QACR,WAAW,QAAQ;AAAA,MACrB;AAAA,IACF;AACF,SAAK,WAAW,QAAQ,YAAY,QAAQ,mBAAmB;AAC/D,SAAK,yBAAyB,KAAK;AAAA,MACjC,KAAK,IAAI,QAAQ,0BAA0B,IAAI,CAAC;AAAA,MAChD;AAAA,IACF;AACA,SAAK,MAAM,QAAQ,QAAQ,MAAM,oBAAI,KAAK;AAC1C,SAAK,QACH,QAAQ,UACP,CAAC,iBACA,IAAI,QAAQ,CAAC,YAAY,WAAW,SAAS,YAAY,CAAC;AAC9D,SAAK,SAAS,QAAQ,UAAU,KAAK;AACrC,SAAK,sBACH,QAAQ,uBAAuB;AAAA,EACnC;AAAA,EAEA,aAAa,OACX,SAC8B;AAC9B,UAAM,YAAY,eAAe,QAAQ,SAAS;AAClD,QACE,UAAU,UAAU,aAAa,QAAQ,iBAAiB,YAC1D,UAAU,UAAU,YAAY,QAAQ,iBAAiB,SACzD;AACA,YAAM;AAAA,QACJ;AAAA,QACA;AAAA,MACF;AAAA,IACF;AACA,UAAM,SAAS,MAAM,yBAAyB,WAAW,OAAO;AAChE,QAAI,OAAO,aAAa,UAAU,aAAa,UAAU;AACvD,YAAM,IAAI;AAAA,QACR;AAAA,QACA;AAAA,QACA;AAAA,MACF;AAAA,IACF;AACA,QAAI,OAAO,aAAa,UAAU,aAAa,UAAU;AACvD,YAAM,IAAI;AAAA,QACR;AAAA,QACA;AAAA,QACA;AAAA,MACF;AAAA,IACF;AACA,UAAM,wBAAwB,MAAM;AAAA,MAClC,UAAU,aAAa;AAAA,MACvB,QAAQ;AAAA,MACR;AAAA,IACF;AACA,UAAM,qBAAqB,MAAM;AAAA,MAC/B,UAAU,UAAU;AAAA,MACpB,QAAQ;AAAA,IACV;AACA,UAAM,wBACJ,UAAU,aAAa,sBAAsB;AAAA,MAAI,CAAC,YAAY,UAC5D;AAAA,QACE;AAAA,QACA,wCAAwC,KAAK;AAAA,MAC/C;AAAA,IACF;AACF,UAAM,yBAAyB,sBAAsB,IAAI,CAAC,gBAAgB;AAAA,MACxE,GAAG;AAAA,MACH,OAAO,UAAU,UAAU;AAAA,IAC7B,EAAE;AACF,WAAO,IAAI;AAAA,MACT;AAAA,MACA;AAAA,MACA;AAAA,MACA,0BAA0B,qBAAqB;AAAA,MAC/CD,oBAAmB,OAAO,SAAS;AAAA,MACnC;AAAA,MACA;AAAA,MACA;AAAA,IACF;AAAA,EACF;AAAA,EAEA,IAAI,cAA2D;AAC7D,QAAI,KAAK,aAAa;AACpB,aAAO;AAAA,IACT;AACA,QAAI,KAAK,uBAAuB,QAAW;AACzC,aAAO;AAAA,IACT;AACA,QAAI,KAAK,gBAAgB,KAAK,kBAAkB,GAAG;AACjD,aAAO;AAAA,IACT;AACA,WAAO;AAAA,EACT;AAAA,EAEA,MAAM,QACJ,eACA,gBAC2C;AAC3C,QAAI;AACF,YAAM,mBAAmB,8BAA8B,aAAa;AACpE,YAAM,yBACJ,kBAAkB,KAAK,UAAU,aAAa;AAChD,YAAM,YAAwC;AAAA,QAC5C,GAAG;AAAA,QACH,MACE,mBAAmB,SACf,iBAAiB,OACjB;AAAA,UACE;AAAA,UACA;AAAA,QACF;AAAA,QACN,aAAa,iBAAiB,YAAY,IAAI,CAAC,UAAU;AAAA,UACvD,GAAG;AAAA,UACH,OACE,KAAK,UAAU,qBACX,yBACA,KAAK;AAAA,QACb,EAAE;AAAA,MACJ;AACA,YAAM,aAAa,MAAM,KAAK,sBAAsB;AACpD,YAAM,YAAY,KAAK;AAAA,QACrB;AAAA,QACA;AAAA,MACF;AACA,WAAK,4BAA4B,YAAY,SAAS;AACtD,YAAM,WAAW,MAAM,KAAK;AAAA,QAC1B;AAAA,QACA,UAAU;AAAA,QACV;AAAA,QACA;AAAA,UACE,QAAQ;AAAA,UACR,MAAM,UAAU;AAAA;AAAA;AAAA;AAAA,UAIhB,QACE,UAAU,YAAY,SAClB,UAAU,YAAY,IAAI,CAAC,SAAS,KAAK,KAAK,IAC9C,CAAC;AAAA,QACT;AAAA,QACA,UAAU;AAAA,MACZ;AACA,aAAO;AAAA,QACL;AAAA,QACA;AAAA,QACA;AAAA,MACF;AAAA,IACF,SAAS,OAAO;AACd,WAAK,kBAAkB,KAAK;AAC5B,YAAM;AAAA,IACR;AAAA,EACF;AAAA,EAEA,MAAM,OAAO,MAAwD;AACnE,QAAI;AACF,YAAM,aAAa,MAAM,KAAK,sBAAsB;AACpD,YAAM,YAAY,WAAW,aAAa;AAAA,QACxC,CAAC,eACC,WAAW,YAAY,kBACvB,WAAW,SAAS,QACpB,WAAW,QAAQ,SAAS,kBAAkB;AAAA,MAClD;AACA,YAAM,YAAY;AAAA,QAChB;AAAA,UACE,SAAS;AAAA,UACT,OAAO,WAAW,SAAS;AAAA,UAC3B;AAAA,UACA,SAAS,CAAC,kBAAkB;AAAA,QAC9B;AAAA,QACA;AAAA,MACF;AACA,WAAK,4BAA4B,YAAY,SAAS;AACtD,YAAM,WAAW,MAAM,KAAK,aAAa,MAAM,MAAM,kBAAkB;AACvE,aAAO;AAAA,QACL;AAAA,QACA;AAAA,QACA;AAAA,MACF;AAAA,IACF,SAAS,OAAO;AACd,WAAK,kBAAkB,KAAK;AAC5B,YAAM;AAAA,IACR;AAAA,EACF;AAAA,EAEA,MAAc,aACZ,SACA,MACA,QACA,MACA,SACgC;AAChC,UAAM,aAAa,KAAK;AACxB,QAAI,eAAe,QAAW;AAC5B,YAAM,IAAI;AAAA,QACR;AAAA,QACA;AAAA,MACF;AAAA,IACF;AACA,QACE,WAAW,cAAc,KAAK,gBAC9B,WAAW,cAAc,KAAK,mBAAmB,WACjD;AACA,YAAM,IAAI;AAAA,QACR;AAAA,QACA;AAAA,MACF;AAAA,IACF;AACA,QACE,KAAK,0BAA0B,UAC/B,KAAK,uBAAuB,QAC5B;AACA,YAAM,IAAI;AAAA,QACR;AAAA,QACA;AAAA,MACF;AAAA,IACF;AACA,UAAM,UAA0B;AAAA,MAC9B,kBAAkB,EAAE,eAAe,KAAK,mBAAmB,QAAS;AAAA,MACpE,eAAe,KAAK;AAAA,MACpB,SAAS,KAAK,UAAU,UAAU;AAAA,MAClC,oBAAoB,WAAW;AAAA,MAC/B,KAAK,WAAW;AAAA,IAClB;AACA,QAAI;AACJ,QAAI,YAAY,QAAW;AACzB,0BAAoB,WAAW,OAAO,SAAS,SAAS,MAAM,MAAM;AAAA,IACtE,OAAO;AACL,UAAI,WAAW,cAAc,QAAW;AACtC,cAAM,IAAI;AAAA,UACR;AAAA,UACA;AAAA,QACF;AAAA,MACF;AACA,0BAAoB,WAAW,UAAU,SAAS;AAAA,QAChD;AAAA,UACE,SAAS,KAAK,UAAU,UAAU;AAAA,UAClC;AAAA,UACA;AAAA,UACA;AAAA,UACA,SAAS,CAAC,OAAO;AAAA,QACnB;AAAA,MACF,CAAC;AAAA,IACH;AACA,UAAM,UAAU,cAAc,iBAAiB;AAC/C,UAAM,WAAW,MAAM,KAAK,UAAU,QAAQ;AAAA,MAC5C,QAAQ;AAAA,MACR,KAAK,GAAG,kBAAkB,KAAK,UAAU,UAAU,QAAQ,CAAC;AAAA,MAC5D;AAAA,MACA,UAAU;AAAA,MACV,0BAA0B,CAAC,GAAG,KAAK,kBAAkB;AAAA,MACrD,GAAI,SAAS,SAAY,CAAC,IAAI,EAAE,KAAK;AAAA,IACvC,CAAC;AACD,SAAK,wBAAwB,UAAU,SAAS;AAChD,WAAO;AAAA,EACT;AAAA,EAEA,MAAc,wBAAqD;AACjE,QAAI,KAAK,aAAa;AACpB,YAAM,IAAI;AAAA,QACR;AAAA,QACA;AAAA,QACA;AAAA,MACF;AAAA,IACF;AACA,QACE,KAAK,uBAAuB,UAC5B,CAAC,KAAK,gBAAgB,KAAK,kBAAkB,GAC7C;AACA,aAAO,KAAK;AAAA,IACd;AACA,QACE,KAAK,sBAAsB,UAC3B,KAAK,kBAAkB,cAAc,KAAK,cAC1C;AACA,YAAM,IAAI;AAAA,QACR;AAAA,QACA;AAAA,QACA;AAAA,MACF;AAAA,IACF;AACA,QAAI;AACF,UAAI;AACJ,YAAM,WAAW,KAAK,IAAI,GAAG,KAAK,mBAAmB;AACrD,eAAS,UAAU,GAAG,UAAU,UAAU,WAAW;AACnD,cAAM,YAAY,MAAM,KAAK,gBAAgB;AAC7C,cAAM,eAAe,MAAM,KAAK,iBAAiB,SAAS;AAC1D,YAAI;AACF,gBAAM,aAAa,MAAM,KAAK,YAAY,WAAW,YAAY;AACjE,eAAK,qBAAqB;AAC1B,iBAAO;AAAA,QACT,SAAS,OAAO;AACd,cACE,EAAE,iBAAiB,6BACnB,MAAM,UAAU,eAChB;AACA,kBAAM;AAAA,UACR;AACA,sBAAY;AAAA,QACd;AACA,YAAI,UAAU,IAAI,UAAU;AAC1B,gBAAM,KAAK,MAAM,WAAW,SAAS,KAAK,OAAO,CAAC,CAAC;AAAA,QACrD;AAAA,MACF;AACA,YAAM,IAAI;AAAA,QACR;AAAA,QACA,qBAAqB,QACjB,UAAU,UACV;AAAA,QACJ;AAAA,MACF;AAAA,IACF,SAAS,OAAO;AACd,WAAK,kBAAkB,KAAK;AAC5B,YAAM;AAAA,IACR;AAAA,EACF;AAAA,EAEQ,kBAAkB,OAAsB;AAC9C,QACE,iBAAiB,4BACjB,MAAM,UAAU,gBAChB;AACA,WAAK,cAAc;AAAA,IACrB;AAAA,EACF;AAAA,EAEA,MAAc,kBAA4D;AACxE,SAAK,gCAAgC;AACrC,UAAM,WAAW,MAAM,KAAK,0BAA0B;AAAA,MACpD,QAAQ;AAAA,MACR,KAAK,GAAG,kBAAkB,KAAK,UAAU,aAAa,QAAQ,CAAC;AAAA,MAC/D,UAAU;AAAA,MACV,0BAA0B,CAAC,GAAG,KAAK,qBAAqB;AAAA,MACxD,MAAM;AAAA,QACJ,UAAU,KAAK,UAAU;AAAA,MAC3B;AAAA,IACF,CAAC;AACD,WAAO;AAAA,MACL,SAAS;AAAA,MACT;AAAA,MACA;AAAA,IACF,EAAE;AAAA,EACJ;AAAA,EAEA,MAAc,iBACZ,WACuC;AACvC,QACE,UAAU,aAAa,KAAK,UAAU,YACtC,UAAU,aAAa,KAAK,UAAU,aAAa,YACnD,UAAU,aAAa,KAAK,UAC5B;AACA,YAAM,IAAI;AAAA,QACR;AAAA,QACA;AAAA,MACF;AAAA,IACF;AACA,QAAI,KAAK,oBAAoB,IAAI,UAAU,KAAK,GAAG;AACjD,YAAM,IAAI;AAAA,QACR;AAAA,QACA;AAAA,MACF;AAAA,IACF;AACA,SAAK,oBAAoB,IAAI,UAAU,KAAK;AAC5C,UAAM,YAAY,IAAI;AAAA,MACpB,KAAK,IAAI,EAAE,QAAQ,IAAI,KAAK,yBAAyB;AAAA,IACvD,EACG,YAAY,EACZ,QAAQ,SAAS,GAAG;AACvB,UAAM,QAAQ;AAAA,MACZ,QAAQ;AAAA,MACR,UAAU,KAAK,UAAU;AAAA,MACzB,oBAAoB,KAAK;AAAA,MACzB,WAAW,KAAK;AAAA,MAChB,eAAe,KAAK;AAAA,MACpB,uBAAuB,KAAK;AAAA,MAC5B,2BAA2B,KAAK;AAAA,MAChC,UAAU,KAAK;AAAA,MACf,OAAO,UAAU;AAAA,MACjB;AAAA,MACA,GAAI,KAAK,aAAa,SAAY,CAAC,IAAI,EAAE,UAAU,KAAK,SAAS;AAAA,IACnE;AACA,UAAM,YACJ,KAAK,kBAAmB,0BAA0B,SAC9C,MAAM,KAAK,kBAAmB,eAAe;AAAA,MAC3C,GAAG;AAAA,MACH,aAAa,UAAU;AAAA,MACvB,UAAU;AAAA,MACV,OAAO,KAAK,kBAAmB;AAAA,IACjC,CAAC,IACD,MAAM,KAAK,kBAAmB,sBAAsB,KAAK;AAC/D,QAAI,OAAO,cAAc,YAAY,UAAU,WAAW,GAAG;AAC3D,YAAM,IAAI;AAAA,QACR;AAAA,QACA;AAAA,MACF;AAAA,IACF;AACA,WAAO;AAAA,MACL,GAAG;AAAA,MACH,iBAAiB;AAAA,QACf,OAAO,KAAK,kBAAmB,SAAS,UAAU,eAAe,CAAC;AAAA,QAClE,WAAW,KAAK;AAAA,QAChB,OAAO;AAAA,MACT;AAAA,IACF;AAAA,EACF;AAAA,EAEA,MAAc,YACZ,WACA,cAC6B;AAC7B,SAAK;AACL,SAAK,gCAAgC;AACrC,UAAM,WAAW,MAAM,KAAK,mBAAmB;AAAA,MAC7C,QAAQ;AAAA,MACR,KAAK,GAAG,kBAAkB,KAAK,UAAU,aAAa,QAAQ,CAAC;AAAA,MAC/D,UAAU;AAAA,MACV,0BAA0B,CAAC,GAAG,KAAK,qBAAqB;AAAA,MACxD,MAAM,EAAE,aAAa;AAAA,IACvB,CAAC;AACD,UAAM,SAAS;AAAA,MACb,SAAS;AAAA,MACT;AAAA,MACA;AAAA,IACF;AACA,WAAO,KAAK,yBAAyB,OAAO,UAAU;AAAA,EACxD;AAAA,EAEA,MAAc,yBACZ,OAC6B;AAC7B,UAAM,SAAS,kCAAkC,KAAK;AACtD,QAAI,OAAO,aAAa,KAAK,UAAU,UAAU;AAC/C,YAAM,IAAI;AAAA,QACR;AAAA,QACA;AAAA,MACF;AAAA,IACF;AACA,QAAI,OAAO,cAAc,KAAK,cAAc;AAC1C,YAAM,IAAI;AAAA,QACR;AAAA,QACA;AAAA,MACF;AAAA,IACF;AACA,QAAI,OAAO,cAAc,KAAK,gBAAgB;AAC5C,YAAM,IAAI;AAAA,QACR;AAAA,QACA;AAAA,MACF;AAAA,IACF;AACA,QAAI,OAAO,gBAAgB,KAAK;AAC9B,YAAM,IAAI;AAAA,QACR;AAAA,QACA;AAAA,MACF;AAAA,IACF;AACA,UAAM,WAAWA,oBAAmB,OAAO,QAAQ;AACnD,UAAM,YAAYA,oBAAmB,OAAO,SAAS;AACrD,QACE,aAAa,YACb,YAAY,WAAW,OAAO,gBAAgB,KAC9C;AACA,YAAM,IAAI;AAAA,QACR;AAAA,QACA;AAAA,MACF;AAAA,IACF;AACA,UAAM,eAAe,OAAO,aAAa;AAAA,MAAI,CAAC,YAAY,UACxD,sBAAsB,YAAY,6BAA6B,KAAK,GAAG;AAAA,IACzE;AACA,eAAW,WAAW,cAAc;AAClC,UACE,CAAC,KAAK,uBAAuB;AAAA,QAAK,CAAC,cACjC,yBAAyB,WAAW,OAAO;AAAA,MAC7C,GACA;AACA,cAAM,IAAI;AAAA,UACR;AAAA,UACA;AAAA,QACF;AAAA,MACF;AAAA,IACF;AACA,QACE,OAAO,OAAO,YAAY,YAC1B,OAAO,QAAQ,MAAM,GAAG,EAAE,WAAW,GACrC;AACA,YAAM,IAAI;AAAA,QACR;AAAA,QACA;AAAA,MACF;AAAA,IACF;AACA,UAAM,aAAa,EAAE,GAAG,QAAQ,aAAa;AAC7C,UAAM,WAAW,MAAM,KAAK,UAAU,QAAQ;AAAA,MAC5C,QAAQ;AAAA,MACR,KAAK,GAAG,kBAAkB,KAAK,UAAU,UAAU,QAAQ,CAAC;AAAA,MAC5D,SAAS,EAAE,eAAe,OAAO,QAAQ;AAAA,MACzC,UAAU;AAAA,MACV,0BAA0B,CAAC,GAAG,KAAK,kBAAkB;AAAA,IACvD,CAAC;AACD,SAAK,wBAAwB,UAAU,WAAW;AAClD,UAAM,UAAU,qBAAqB,QAAQ;AAC7C,UAAM,SAAS,KAAK,UAAU,UAAU;AACxC,QACE,CAAC,QAAQ,UAAU,SAAS,MAAM,KAClC,QAAQ,QAAQ,SAAS,MAAM,GAC/B;AACA,YAAM,IAAI;AAAA,QACR;AAAA,QACA,QAAQ,UAAU,SAAS,MAAM,KAAK,QAAQ,QAAQ,SAAS,MAAM,IACjE,2DACA;AAAA,MACN;AAAA,IACF;AACA,SAAK,wBAAwB,oBAAoB,OAAO,OAAO;AAC/D,WAAO;AAAA,EACT;AAAA,EAEQ,wBACN,UACA,MACM;AACN,SAAK;AAAA,MACH;AAAA,MACA,KAAK,UAAU,UAAU;AAAA,MACzB;AAAA,MACA,KAAK;AAAA,MACL;AAAA,IACF;AAAA,EACF;AAAA,EAEQ,kCAAwC;AAC9C,QAAI,KAAK,iCAAiC,KAAK,IAAI,EAAE,QAAQ,GAAG;AAC9D,YAAM,IAAI;AAAA,QACR;AAAA,QACA;AAAA,QACA;AAAA,MACF;AAAA,IACF;AAAA,EACF;AAAA,EAEQ,2BACN,UACA,MACM;AACN,SAAK;AAAA,MACH;AAAA,MACA,KAAK,UAAU,aAAa;AAAA,MAC5B;AAAA,MACA,KAAK;AAAA,MACL;AAAA,IACF;AAAA,EACF;AAAA,EAEQ,uBACN,UACA,UACA,MACA,kBACA,MACM;AACN,UAAM,WAAW,GAAG,kBAAkB,QAAQ,CAAC,GAAG,IAAI;AACtD,UAAM,QAAQ,CAAC,YAAoB,cAAc,MAAM,OAAO;AAC9D,QACE,SAAS,aAAa,YACtB,SAAS,oBAAoB,QAC7B;AACA,YAAM;AAAA,QACJ,GAAG,IAAI;AAAA,MACT;AAAA,IACF;AACA,QAAI,CAAC,iBAAiB,IAAI,YAAY,SAAS,eAAe,CAAC,GAAG;AAChE,YAAM,MAAM,GAAG,IAAI,4CAA4C;AAAA,IACjE;AAAA,EACF;AAAA,EAEQ,4BACN,YACA,WACM;AACN,QAAI,KAAK,gBAAgB,UAAU,GAAG;AACpC,YAAM,IAAI;AAAA,QACR;AAAA,QACA;AAAA,QACA;AAAA,MACF;AAAA,IACF;AACA,QACE,CAAC,WAAW,aAAa;AAAA,MAAK,CAAC,YAC7B,yBAAyB,SAAS,SAAS;AAAA,IAC7C,GACA;AACA,YAAM,IAAI;AAAA,QACR;AAAA,QACA;AAAA,QACA;AAAA,MACF;AAAA,IACF;AAAA,EACF;AAAA,EAEQ,iCACN,YACA,WACkB;AAClB,UAAM,aAAa,WAAW,aAAa;AAAA,MACzC,CAAC,eACC,WAAW,YAAY,mBACvB,WAAW,QAAQ,SAAS,oBAAoB;AAAA,IACpD;AACA,QAAI,eAAe,QAAW;AAC5B,YAAM,IAAI;AAAA,QACR;AAAA,QACA;AAAA,QACA;AAAA,MACF;AAAA,IACF;AACA,QAAI,WAAW,YAAY,QAAW;AACpC,YAAM,aACJ,WAAW,QAOX;AACF,YAAM,0BAA0B,YAAY;AAAA,QAC1C,CAAC,cACC,UAAU,SAAS,UAAU,QAC7B,UAAU,QAAQ,UAAU,OAC5B,MAAM,QAAQ,UAAU,WAAW,KACnC,gBAAgB,UAAU,WAAW,MACnC,gBAAgB,UAAU,WAAW;AAAA,MAC3C;AACA,UAAI,CAAC,yBAAyB;AAC5B,cAAM,IAAI;AAAA,UACR;AAAA,UACA;AAAA,UACA;AAAA,QACF;AAAA,MACF;AACA,aAAO;AAAA,IACT;AACA,WAAO;AAAA,MACL;AAAA,QACE,SAAS;AAAA,QACT,OAAO,WAAW;AAAA,QAClB,MAAM,WAAW;AAAA,QACjB,SAAS,CAAC,oBAAoB;AAAA,MAChC;AAAA,MACA;AAAA,IACF;AAAA,EACF;AAAA,EAEQ,gBAAgB,YAAyC;AAC/D,UAAM,YAAYA,oBAAmB,WAAW,SAAS;AACzD,WACE,YAAY,KAAK,IAAI,EAAE,QAAQ,KAAK,gCAAgC;AAAA,EAExE;AAAA,EAEA,MAAc,0BACZ,SACgC;AAChC,QAAI;AACJ,UAAM,WAAW,KAAK,IAAI,GAAG,KAAK,mBAAmB;AACrD,aAAS,UAAU,GAAG,UAAU,UAAU,WAAW;AACnD,UAAI;AACF,cAAM,WAAW,MAAM,KAAK,UAAU,QAAQ,OAAO;AACrD,aAAK,2BAA2B,UAAU,sBAAsB;AAChE,YAAI,SAAS,UAAU,KAAK;AAC1B,sBAAY,IAAI,MAAM,mBAAmB,SAAS,MAAM,EAAE;AAAA,QAC5D,WAAW,SAAS,UAAU,KAAK;AACjC,gBAAM,SAAS,gBAAgB,SAAS,IAAI;AAC5C,cAAI,WAAW,QAAW;AACxB,kBAAM,eAAe,QAAQ,SAAS,MAAM;AAAA,UAC9C;AACA,gBAAM,IAAI;AAAA,YACR;AAAA,YACA;AAAA,UACF;AAAA,QACF,OAAO;AACL,iBAAO;AAAA,QACT;AAAA,MACF,SAAS,OAAO;AACd,YACE,iBAAiB,4BACjB,MAAM,UAAU,eAChB;AACA,gBAAM;AAAA,QACR;AACA,oBAAY;AAAA,MACd;AACA,UAAI,UAAU,IAAI,UAAU;AAC1B,cAAM,KAAK,MAAM,WAAW,SAAS,KAAK,OAAO,CAAC,CAAC;AAAA,MACrD;AAAA,IACF;AACA,UAAM,IAAI;AAAA,MACR;AAAA,MACA,qBAAqB,QACjB,UAAU,UACV;AAAA,MACJ;AAAA,IACF;AAAA,EACF;AAAA,EAEA,MAAc,mBACZ,SACgC;AAChC,QAAI;AACF,YAAM,WAAW,MAAM,KAAK,UAAU,QAAQ,OAAO;AACrD,WAAK,2BAA2B,UAAU,oBAAoB;AAC9D,UAAI,SAAS,UAAU,KAAK;AAC1B,cAAM,IAAI;AAAA,UACR;AAAA,UACA,mBAAmB,SAAS,MAAM;AAAA,UAClC;AAAA,QACF;AAAA,MACF;AACA,UAAI,SAAS,UAAU,KAAK;AAC1B,cAAM,SAAS,gBAAgB,SAAS,IAAI;AAC5C,YAAI,WAAW,QAAW;AACxB,gBAAM,eAAe,QAAQ,SAAS,MAAM;AAAA,QAC9C;AACA,cAAM,IAAI;AAAA,UACR;AAAA,UACA;AAAA,QACF;AAAA,MACF;AACA,aAAO;AAAA,IACT,SAAS,OAAO;AACd,UAAI,iBAAiB,0BAA0B;AAC7C,cAAM;AAAA,MACR;AACA,YAAM,IAAI;AAAA,QACR;AAAA,QACA,iBAAiB,QAAQ,MAAM,UAAU;AAAA,QACzC;AAAA,MACF;AAAA,IACF;AAAA,EACF;AACF;AAEA,eAAsB,0BACpB,SAC8B;AAC9B,SAAO,oBAAoB,OAAO,OAAO;AAC3C;AAEA,SAAS,eAAe,OAEtB;AACA,QAAM,aAAa,kBAAkB,OAAO,+BAA+B;AAC3E,QAAM,SAAS,gBAAgB,UAAU,UAAU;AACnD,MAAI,CAAC,OAAO,SAAS;AACnB,UAAM,IAAI;AAAA,MACR,OAAO,MAAM,OAAO,KAAK,CAAC,UAAU,MAAM,SAAS,mBAAmB,IAClE,oCACA;AAAA,MACJ,OAAO,MAAM;AAAA,MACb;AAAA,IACF;AAAA,EACF;AACA,SAAO,OAAO;AAKhB;AAEA,eAAe,yBACb,WACA,SACA;AACA,MAAI;AACF,WAAO,MAAM,qCAAqC;AAAA,MAChD,cAAc,UAAU,aAAa;AAAA,MACrC,UAAU,QAAQ;AAAA,MAClB,UAAU,QAAQ;AAAA,MAClB,gBAAgB,QAAQ;AAAA,MACxB,MAAM,QAAQ,QAAQ,MAAM,oBAAI,KAAK,IAAI,EACtC,YAAY,EACZ,QAAQ,SAAS,GAAG;AAAA,MACvB,uBAAuB;AAAA,MACvB,0BAA0B;AAAA,IAC5B,CAAC;AAAA,EACH,SAAS,OAAO;AACd,UAAMD,QAAO,0BAA0B,KAAK;AAC5C,UAAM,IAAI;AAAA,MACRA;AAAA,MACA,iBAAiB,QAAQ,MAAM,UAAU,OAAO,KAAK;AAAA,MACrD;AAAA,IACF;AAAA,EACF;AACF;AAEA,SAAS,0BACP,OAC8B;AAC9B,QAAMA,QACJ,OAAO,UAAU,YAAY,UAAU,QAAQ,UAAU,QACpD,MAA6B,OAC9B;AACN,MAAIA,UAAS,0CAA0C;AACrD,WAAO;AAAA,EACT;AACA,MAAIA,UAAS,uCAAuC;AAClD,WAAO;AAAA,EACT;AACA,MAAIA,UAAS,0CAA0C;AACrD,WAAO;AAAA,EACT;AACA,SAAO;AACT;AAEA,SAAS,sBAAsB,OAAgB,MAAgC;AAC7E,MAAI;AACF,WAAO;AAAA,MACL;AAAA,IACF;AAAA,EACF,SAAS,OAAO;AACd,UAAM,IAAI;AAAA,MACR;AAAA,MACA,GAAG,IAAI,KAAK,iBAAiB,QAAQ,MAAM,UAAU,OAAO,KAAK,CAAC;AAAA,IACpE;AAAA,EACF;AACF;AAEA,SAAS,8BACP,eACoB;AACpB,MAAI,OAAO,kBAAkB,UAAU;AACrC,UAAM,IAAI;AAAA,MACR;AAAA,MACA;AAAA,MACA;AAAA,IACF;AAAA,EACF;AACA,QAAM,YAAY,6BAA6B,IAAI,aAAa;AAChE,MAAI,cAAc,QAAW;AAC3B,UAAM,IAAI;AAAA,MACR;AAAA,MACA;AAAA,MACA;AAAA,IACF;AAAA,EACF;AACA,SAAO;AACT;AAEA,SAAS,sCACP,OACkB;AAClB,QAAM,aAAa,kBAAkB,OAAO,8BAA8B;AAC1E,SAAO,0BAA0B,UAAU;AAC7C;AAEA,SAAS,0BACP,cACQ;AACR,QAAM,YAAY,CAAC,GAAG,YAAY,EAAE;AAAA,IAAK,CAAC,MAAM,UAC9C,GAAG,KAAK,OAAO,KAAK,KAAK,KAAK,KAAK,KAAK,IAAI,GAAG;AAAA,MAC7C,GAAG,MAAM,OAAO,KAAK,MAAM,KAAK,KAAK,MAAM,IAAI;AAAA,IACjD;AAAA,EACF;AACA,QAAM,UAAU,IAAI,YAAY;AAChC,QAAM,SAAS,QAAQ;AAAA,IACrB;AAAA,EACF;AACA,QAAM,OAAO,QAAQ,OAAO,gBAAgB,SAAS,CAAC;AACtD,QAAM,QAAQ,IAAI,WAAW,OAAO,SAAS,KAAK,MAAM;AACxD,QAAM,IAAI,QAAQ,CAAC;AACnB,QAAM,IAAI,MAAM,OAAO,MAAM;AAC7B,aAAO,6BAAW,qBAAO,OAAO,OAAO,CAAC,EAAE,MAAM,CAAC;AACnD;AAEA,SAAS,wBACP,YAC0B;AAC1B,QAAM,SAAS,kCAAkC,WAAW,OAAO;AACnE,QAAM,UAAU,CAAC,UAAyB;AACxC,UAAM,IAAI;AAAA,MACR;AAAA,MACA,uBAAuB,KAAK;AAAA,IAC9B;AAAA,EACF;AACA,MAAI,WAAW,iBAAiB,oBAAoB,WAAW,OAAO;AACpE,YAAQ,cAAc;AACxB,MAAI,WAAW,cAAc,OAAO,UAAW,SAAQ,WAAW;AAClE,MAAI,WAAW,cAAc,OAAO,UAAW,SAAQ,WAAW;AAClE,MAAI,WAAW,aAAa,OAAO,SAAU,SAAQ,UAAU;AAC/D,MAAI,KAAK,MAAM,WAAW,QAAQ,MAAM,OAAO;AAC7C,YAAQ,UAAU;AACpB,MAAI,KAAK,MAAM,WAAW,SAAS,MAAM,OAAO;AAC9C,YAAQ,WAAW;AACrB,MAAI,WAAW,aAAa,OAAO,SAAU,SAAQ,UAAU;AAC/D,MAAI,WAAW,eAAe,OAAO,WAAY,SAAQ,YAAY;AACrE,MAAI,WAAW,sBAAsB,OAAO;AAC1C,YAAQ,mBAAmB;AAC7B,MAAI,WAAW,mBAAmB,OAAO;AACvC,YAAQ,gBAAgB;AAC1B,SAAO;AAAA,IACL,cAAc,oBAAoB,WAAW,OAAO;AAAA,IACpD,WAAW,OAAO;AAAA,IAClB,WAAW,OAAO;AAAA,IAClB,UAAU,OAAO;AAAA,IACjB,UAAU,IAAI,KAAK,OAAO,UAAU,EAAE,YAAY,EAAE,QAAQ,SAAS,GAAG;AAAA,IACxE,WAAW,IAAI,KAAK,OAAO,WAAW,EAAE,YAAY,EAAE,QAAQ,SAAS,GAAG;AAAA,IAC1E,UAAU,OAAO;AAAA,IACjB,eAAe,KAAK,MAAM,OAAO,cAAc,OAAO,cAAc,GAAI;AAAA,IACxE,cAAc,OAAO;AAAA,IACrB,SAAS,WAAW;AAAA,EACtB;AACF;AAQO,SAAS,kCACd,OACoB;AACpB,SAAO;AAAA,IACL,mBAAmB,OAAO,sBAAsB,qBAAqB;AAAA,EACvE;AACF;AAEA,SAAS,kCAAkC,SAWzC;AACA,MAAI;AACF,UAAM,QAAQ,QAAQ,MAAM,GAAG;AAC/B,QAAI,MAAM,WAAW,EAAG,OAAM,IAAI,MAAM,iBAAiB;AACzD,UAAM,UAAU;AAAA,MACd,KAAK,MAAM,IAAI,YAAY,EAAE,OAAO,eAAe,MAAM,CAAC,CAAE,CAAC,CAAC;AAAA,IAChE;AACA,UAAM,SAAS,sBAAsB,SAAS,KAAK;AACnD,UAAM,YAAY,sBAAsB,SAAS,KAAK;AACtD,UAAM,WAAW,qBAAqB,SAAS,KAAK;AACpD,UAAM,YAAY,qBAAqB,SAAS,KAAK;AACrD,UAAM,QAAQ,QAAQ;AACtB,QAAI,CAAC,MAAM,QAAQ,KAAK,EAAG,OAAM,IAAI,MAAM,oBAAoB;AAC/D,UAAM,iBAAiB,MAAM;AAAA,MAC3B,CAACG,UACCA,UAAS,QACT,OAAOA,UAAS,YAChB,CAAC,MAAM,QAAQA,KAAI,KACnB,mCAAmCA;AAAA,IACvC;AACA,QAAI,eAAe,WAAW;AAC5B,YAAM,IAAI,MAAM,0CAA0C;AAC5D,UAAM,OAAO,eAAe,CAAC;AAC7B,UAAM,WAAW;AAAA,MACf;AAAA,MACA;AAAA,IACF;AACA,UAAM,aAAa;AAAA,MACjB;AAAA,MACA;AAAA,IACF;AACA,UAAM,oBAAoB;AAAA,MACxB;AAAA,MACA;AAAA,IACF;AACA,QAAI,CAAC,iBAAiB,KAAK,iBAAiB,GAAG;AAC7C,YAAM,IAAI;AAAA,QACR;AAAA,MACF;AAAA,IACF;AACA,UAAM,iBAAiB;AAAA,MACrB;AAAA,MACA;AAAA,IACF;AACA,UAAM,iBAAiB;AAAA,MACrB;AAAA,MACA;AAAA,IACF;AACA,QAAI,mBAAmB;AACrB,YAAM,IAAI,MAAM,kCAAkC;AACpD,QAAI,mBAAmB;AACrB,YAAM,IAAI,MAAM,iCAAiC;AACnD,UAAM,MAAM,QAAQ;AACpB,QAAI,QAAQ,QAAQ,OAAO,QAAQ,YAAY,MAAM,QAAQ,GAAG,GAAG;AACjE,YAAM,IAAI,MAAM,oBAAoB;AAAA,IACtC;AACA,UAAM,eAAmC,CAAC;AAC1C,eAAW,CAAC,UAAU,YAAY,KAAK,OAAO,QAAQ,GAAG,GAAG;AAC1D,UACE,iBAAiB,QACjB,OAAO,iBAAiB,YACxB,MAAM,QAAQ,YAAY,GAC1B;AACA,cAAM,IAAI,MAAM,gCAAgC;AAAA,MAClD;AACA,YAAM,YAAY;AAClB,YAAM,SAAS,SAAS,QAAQ,OAAO;AACvC,UAAI,CAAC,SAAS,WAAW,YAAY,KAAK,SAAS;AACjD,cAAM,IAAI,MAAM,2BAA2B;AAC7C,YAAM,QAAQ,SAAS,MAAM,GAAG,MAAM;AACtC,YAAM,OAAO,SAAS,MAAM,SAAS,QAAQ,MAAM;AACnD,iBAAW,CAAC,QAAQ,UAAU,KAAK,OAAO,QAAQ,SAAS,GAAG;AAC5D,cAAM,UAAU,OAAO,WAAW,gBAAgB,IAC9C,kBACA,OAAO,WAAW,eAAe,IAC/B,iBACA;AACN,YAAI,CAAC,MAAM,QAAQ,UAAU,KAAK,WAAW,WAAW,GAAG;AACzD,gBAAM,IAAI,MAAM,kDAAkD;AAAA,QACpE;AACA,cAAM,UAAU;AAChB,YAAI,YAAY,OAAW,OAAM,IAAI,MAAM,0BAA0B;AACrE,cAAM,QAAQ,QAAQ,CAAC;AACvB,qBAAa;AAAA,UACX,0BAA0B;AAAA,YACxB;AAAA,YACA;AAAA,YACA;AAAA,YACA,SAAS,CAAC,MAAM;AAAA,YAChB,GAAI,UAAU,QACd,OAAO,UAAU,YACjB,CAAC,MAAM,QAAQ,KAAK,KACpB,OAAO,KAAK,KAAK,EAAE,SAAS,IACxB,EAAE,SAAS,MAAM,IACjB,CAAC;AAAA,UACP,CAAC;AAAA,QACH;AAAA,MACF;AAAA,IACF;AACA,QAAI,aAAa,WAAW,EAAG,OAAM,IAAI,MAAM,mBAAmB;AAClE,UAAM,WAAW,OAAO,QAAQ,GAAG;AACnC,UAAM,YAAY,WAAW,IAAI,SAAS,OAAO,MAAM,GAAG,QAAQ;AAClE,QAAI,CAAC,UAAU,WAAW,MAAM,KAAK,CAAC,UAAU,WAAW,MAAM,GAAG;AAClE,YAAM,IAAI,MAAM,sCAAsC;AAAA,IACxD;AACA,WAAO;AAAA,MACL;AAAA,MACA;AAAA,MACA;AAAA,MACA;AAAA,MACA;AAAA,MACA;AAAA,MACA,YAAY,WAAW;AAAA,MACvB,aAAa,YAAY;AAAA,MACzB,UAAU;AAAA,MACV;AAAA,IACF;AAAA,EACF,SAAS,OAAO;AACd,UAAM,IAAI;AAAA,MACR;AAAA,MACA,qDAAqD,iBAAiB,QAAQ,MAAM,UAAU,OAAO,KAAK,CAAC;AAAA,IAC7G;AAAA,EACF;AACF;AAEA,SAAS,sBACP,SACA,KACQ;AACR,QAAM,QAAQ,QAAQ,GAAG;AACzB,MAAI,OAAO,UAAU,YAAY,MAAM,WAAW,GAAG;AACnD,UAAM,IAAI,MAAM,QAAQ,GAAG,4BAA4B;AAAA,EACzD;AACA,SAAO;AACT;AAEA,SAAS,qBACP,SACA,KACQ;AACR,QAAM,QAAQ,QAAQ,GAAG;AACzB,MAAI,OAAO,UAAU,YAAY,CAAC,OAAO,cAAc,KAAK,KAAK,QAAQ,GAAG;AAC1E,UAAM,IAAI,MAAM,QAAQ,GAAG,sCAAsC;AAAA,EACnE;AACA,SAAO;AACT;AAEA,SAAS,eAAe,OAA2B;AACjD,QAAM,aAAa,MAAM,QAAQ,MAAM,GAAG,EAAE,QAAQ,MAAM,GAAG;AAC7D,QAAM,SAAS,WAAW,OAAO,KAAK,KAAK,WAAW,SAAS,CAAC,IAAI,GAAG,GAAG;AAC1E,QAAM,SAAS,KAAK,MAAM;AAC1B,SAAO,WAAW,KAAK,QAAQ,CAAC,cAAc,UAAU,WAAW,CAAC,CAAC;AACvE;AAEA,SAAS,mBACP,OACA,QACA,OACG;AACH,QAAM,aAAa;AAAA,IACjB;AAAA,IACA;AAAA,EACF;AACA,QAAM,SAAS,gBAAgB,UAAU;AACzC,MAAI,WAAW,QAAW;AACxB,UAAM,eAAe,MAAM;AAAA,EAC7B;AACA,QAAM,SAAS,OAAO,UAAU,UAAU;AAC1C,MAAI,CAAC,OAAO,SAAS;AACnB,UAAM,IAAI;AAAA,MACR;AAAA,MACA,GAAG,KAAK,uBAAuB,OAAO,MAAM,OAAO;AAAA,IACrD;AAAA,EACF;AACA,SAAO,OAAO;AAChB;AA2CA,SAAS,qBACP,UACuC;AACvC,MAAI,SAAS,WAAW,KAAK;AAC3B,UAAM,IAAI;AAAA,MACR;AAAA,MACA,yCAAyC,SAAS,MAAM;AAAA,MACxD,SAAS,UAAU,MAAM,YAAY;AAAA,MACrC;AAAA,MACA,SAAS;AAAA,IACX;AAAA,EACF;AACA,QAAM,aAAa;AAAA,IACjB,SAAS;AAAA,IACT;AAAA,EACF;AACA,QAAM,SAAS,sBAAsB,UAAU,UAAU;AACzD,MAAI,CAAC,OAAO,SAAS;AACnB,UAAM,IAAI;AAAA,MACR;AAAA,MACA,oDAAoD,OAAO,MAAM,OAAO;AAAA,IAC1E;AAAA,EACF;AACA,SAAO,OAAO;AAChB;AAEA,SAAS,sBACP,UACA,QACA,OACG;AACH,MAAI,SAAS,UAAU,KAAK;AAC1B,UAAM,IAAI;AAAA,MACR;AAAA,MACA,GAAG,KAAK,kBAAkB,SAAS,MAAM,KAAK,iBAAiB,SAAS,IAAI,CAAC;AAAA,MAC7E;AAAA,MACA;AAAA,MACA,SAAS;AAAA,IACX;AAAA,EACF;AACA,MAAI,SAAS,UAAU,KAAK;AAC1B,UAAM,IAAI;AAAA,MACR;AAAA,MACA,GAAG,KAAK,iBAAiB,iBAAiB,SAAS,IAAI,CAAC;AAAA,MACxD;AAAA,MACA;AAAA,MACA,SAAS;AAAA,IACX;AAAA,EACF;AACA,QAAM,aAAa;AAAA,IACjB,SAAS;AAAA,IACT;AAAA,EACF;AACA,QAAM,SAAS,OAAO,UAAU,UAAU;AAC1C,MAAI,CAAC,OAAO,SAAS;AACnB,UAAM,IAAI;AAAA,MACR;AAAA,MACA,GAAG,KAAK,qCAAqC,OAAO,MAAM,OAAO;AAAA,IACnE;AAAA,EACF;AACA,SAAO,OAAO;AAChB;AAEA,SAAS,iBAAiB,MAAuB;AAC/C,MAAI,OAAO,SAAS,SAAU,QAAO;AACrC,MAAI,SAAS,QAAQ,OAAO,SAAS,UAAU;AAC7C,UAAM,SAAS;AACf,UAAMC,QAAO,OAAO,OAAO,SAAS,WAAW,OAAO,OAAO;AAC7D,UAAM,UACJ,OAAO,OAAO,YAAY,WAAW,OAAO,UAAU;AACxD,QAAIA,UAAS;AACX,aAAO,YAAY,SAAYA,QAAO,GAAGA,KAAI,KAAK,OAAO;AAAA,EAC7D;AACA,SAAO;AACT;AAEO,SAAS,oBAAoB,SAAyB;AAC3D,QAAMC,UAAS,OAAa,QAAM,sBAAO,IAAI,YAAY,EAAE,OAAO,OAAO,CAAC,CAAC;AAC3E,SAAO,IAAI,SAAS,IAAMA,OAAM,EAAE,SAAS;AAC7C;AAEA,SAAS,cAAc,SAAiD;AACtE,SAAO,MAAM,QAAQ,OAAO,IAAI,OAAO,YAAY,OAAO,IAAI;AAChE;AAEA,eAAe,4BACb,UACA,WAC8B;AAC9B,SAAO,iCAAiC,UAAU,WAAW,YAAY;AAC3E;AAEA,eAAe,iCACb,UACA,WACA,MAC8B;AAC9B,MAAI;AACJ,MAAI;AACF,UAAM,IAAI,IAAI,QAAQ;AAAA,EACxB,QAAQ;AACN,UAAM,cAAc,MAAM,GAAG,IAAI,wBAAwB;AAAA,EAC3D;AACA,MACE,IAAI,aAAa,YACjB,IAAI,aAAa,MACjB,IAAI,aAAa,MACjB,IAAI,SAAS,MACb,IAAI,WAAW,IACf;AACA,UAAM;AAAA,MACJ;AAAA,MACA,GAAG,IAAI;AAAA,IACT;AAAA,EACF;AACA,MAAI,UAAU,oBAAoB,QAAW;AAC3C,UAAM;AAAA,MACJ;AAAA,MACA,GAAG,IAAI;AAAA,IACT;AAAA,EACF;AACA,MAAI;AACJ,MAAI;AACF,iBAAa,MAAM,UAAU,gBAAgB,IAAI,MAAM;AAAA,EACzD,SAAS,OAAO;AACd,UAAM;AAAA,MACJ;AAAA,MACA,GAAG,IAAI,gCAAgC,iBAAiB,QAAQ,MAAM,UAAU,OAAO,KAAK,CAAC;AAAA,IAC/F;AAAA,EACF;AACA,MAAI,WAAW,UAAU,WAAW,GAAG;AACrC,UAAM,cAAc,MAAM,GAAG,IAAI,oCAAoC;AAAA,EACvE;AACA,QAAM,YAAY,oBAAI,IAAY;AAClC,aAAW,WAAW,WAAW,WAAW;AAC1C,UAAM,aAAa,YAAY,OAAO;AACtC,QAAI,CAAC,WAAW,UAAU,GAAG;AAC3B,YAAM;AAAA,QACJ;AAAA,QACA,GAAG,IAAI,+CAA+C,OAAO;AAAA,MAC/D;AAAA,IACF;AACA,cAAU,IAAI,UAAU;AAAA,EAC1B;AACA,SAAO;AACT;AAEA,SAAS,cACP,MACA,SAC0B;AAC1B,SAAO,IAAI;AAAA,IACT,SAAS,eACL,0CACA;AAAA,IACJ;AAAA,IACA;AAAA,EACF;AACF;AAEA,SAAS,YAAY,OAAuB;AAC1C,SAAO,MAAM,YAAY,EAAE,QAAQ,YAAY,EAAE;AACnD;AAEA,SAAS,WAAW,OAAwB;AAC1C,QAAM,KAAK,YAAY,KAAK;AAC5B,QAAM,QAAQ,GAAG,MAAM,GAAG;AAC1B,MACE,MAAM,WAAW,KACjB,MAAM,MAAM,CAAC,SAAS,QAAQ,KAAK,IAAI,KAAK,OAAO,IAAI,KAAK,GAAG,GAC/D;AACA,UAAM,CAAC,GAAG,CAAC,IAAI,MAAM,IAAI,MAAM;AAC/B,WAAO,EACL,MAAM,KACN,MAAM,MACN,MAAM,OACL,MAAM,OAAO,KAAK,MAAM,KAAK,OAC7B,MAAM,OAAO,MAAM,OACnB,MAAM,OAAO,KAAK,MAAM,KAAK,MAC7B,MAAM,OAAO,MAAM,KACnB,MAAM,OAAO,MAAM,OACnB,MAAM,QAAQ,MAAM,MAAM,MAAM,OAChC,MAAM,OAAO,MAAM,MAAM,MAAM,CAAC,MAAM,SACtC,MAAM,OAAO,MAAM,KAAK,MAAM,CAAC,MAAM,SACtC,KAAK;AAAA,EAET;AACA,MAAI,CAAC,GAAG,SAAS,GAAG,EAAG,QAAO;AAC9B,MACE,OAAO,QACP,OAAO,SACP,GAAG,WAAW,WAAW,KACzB,GAAG,WAAW,KAAK,KACnB,GAAG,WAAW,KAAK,KACnB,GAAG,WAAW,KAAK,KACnB,GAAG,WAAW,KAAK,KACnB,GAAG,WAAW,IAAI,KAClB,GAAG,WAAW,IAAI,KAClB,GAAG,WAAW,IAAI;AAElB,WAAO;AACT,QAAM,SAAS,GAAG,MAAM,+BAA+B;AACvD,MAAI,WAAW,KAAM,QAAO,WAAW,OAAO,CAAC,CAAE;AACjD,QAAM,YAAY,GAAG,MAAM,0CAA0C;AACrE,MAAI,cAAc,MAAM;AACtB,UAAM,OAAO,OAAO,SAAS,UAAU,CAAC,GAAI,EAAE;AAC9C,UAAM,MAAM,OAAO,SAAS,UAAU,CAAC,GAAI,EAAE;AAC7C,WAAO,WAAW,GAAG,QAAQ,CAAC,IAAI,OAAO,GAAG,IAAI,OAAO,CAAC,IAAI,MAAM,GAAG,EAAE;AAAA,EACzE;AACA,SAAO;AACT;AAEA,SAAS,gBACP,OAGY;AACZ,QAAM,aAAa;AAAA,IACjB;AAAA,IACA;AAAA,EACF;AACA,QAAM,SAAS,aAAa,UAAU,UAAU;AAChD,MAAI,OAAO,SAAS;AAClB,WAAO,EAAE,MAAM,OAAO,KAAK,MAAM,SAAS,OAAO,KAAK,QAAQ;AAAA,EAChE;AACA,QAAM,WAAW,0BAA0B,UAAU,UAAU;AAC/D,MAAI,SAAS,SAAS;AACpB,WAAO;AAAA,MACL,MAAM,SAAS,KAAK,MAAM;AAAA,MAC1B,SAAS,SAAS,KAAK,MAAM;AAAA,IAC/B;AAAA,EACF;AACA,SAAO;AACT;AAEA,SAAS,eACP,QACA,QAC0B;AAC1B,QAAM,cACJ,OAAO,SAAS,qBAChB,OAAO,SAAS,oBAChB,OAAO,SAAS;AAClB,SAAO,IAAI;AAAA,IACT,wBAAwB,OAAO,IAAI;AAAA,IACnC,OAAO,WAAW,wBAAwB,OAAO,IAAI;AAAA,IACrD,cAAc,iBAAiB;AAAA,IAC/B,OAAO;AAAA,IACP;AAAA,EACF;AACF;AAEA,SAAS,WAAW,SAAiB,QAAwB;AAC3D,QAAMC,QAAO,KAAK,IAAI,qCAAqC,KAAK,KAAK,OAAO;AAC5E,SAAO,KAAK;AAAA,IACV;AAAA,IACA,KAAK,MAAMA,SAAQ,MAAM,OAAO;AAAA,EAClC;AACF;AAEA,SAAS,kBAAkB,OAAuB;AAChD,SAAO,MAAM,SAAS,GAAG,IAAI,MAAM,MAAM,GAAG,EAAE,IAAI;AACpD;AAEA,SAAS,kBACP,OACAF,OACS;AACT,MAAI;AACF,WAAO,cAAc,KAAK;AAAA,EAC5B,SAAS,OAAO;AACd,UAAM,IAAI;AAAA,MACRA;AAAA,MACA,iBAAiB,QAAQ,MAAM,UAAU,OAAO,KAAK;AAAA,IACvD;AAAA,EACF;AACF;AAEA,SAASG,oBAAmB,OAAmC;AAC7D,MACE,CAAC,+EAA+E;AAAA,IAC9E;AAAA,EACF,GACA;AACA,WAAO;AAAA,EACT;AACA,QAAM,SAAS,KAAK,MAAM,KAAK;AAC/B,MAAI,OAAO,MAAM,MAAM,GAAG;AACxB,WAAO;AAAA,EACT;AACA,QAAM,YAAY,IAAI,KAAK,MAAM,EAAE,YAAY,EAAE,QAAQ,SAAS,GAAG;AACrE,QAAM,WAAW,KAAK,MAAM,KAAK;AACjC,SAAO,KAAK,MAAM,SAAS,MAAM,WAAW,SAAS;AACvD;","names":["import_viem","name","encode","length","i","j","decode","name","encode","decode","alphabet","encode","decode","decode","code","code","digest","decode","equals","base","baseCache","code","digest","equals","base","decode","length","cache","cid","code","output","length","code","code","objectHasOwn","code","objectHasOwn","encode","decode","textEncoder","identity_exports","identity","encode","identity","sha256","from","name","code","encode","digest","sha256","from","crypto","identity_exports","import_viem","import_viem","textEncoder","objectHasOwn","requiredString","assertExactKeys","requiredString","requiredValue","hasOwn","requiredArray","requiredArray","requiredValue","assertExactKeys","requiredString","hasOwn","textEncoder","digest","hasOwn","requiredString","digest","assertExactKeys","requiredValue","hasOwn","requiredString","requiredArray","objectHasOwn","alphabet","code","expectObject","assertExactKeys","hasOwn","requiredString","code","assertExactKeys","requiredValue","hasOwn","requiredString","code","objectHasOwn","hasOwn","code","parseStrictRfc3339","requestedCapabilitiesHash","fact","code","digest","base","parseStrictRfc3339"]}